Freight fails to build ... 1

(No. 0)  No. 1 

I left intact dev1-miro since it comsumes so little space, but I have almost a real Pale Moon package/sources for distribution, very soon (hopefully), fully compliant with the license as you can read all the discussion, and final approval, at:
A Pale Moon repo for Devuan/Debian
in dev1miro.

But, in the meantime, I have work to do with Freight. Some testing work.

Read here:
the call, and my promise to do it. Alas, after creating the package for using Freight to test creating a repo with it (from scratch), and test the pull request that way, it took me some two hours just how to get the pull request to be able to install the Freight commit to test... Here's what I did to get the:
create InRelease file #79 commit cloned locally.

At first I was perplexed for not being able to grep 6c3172ef544d00 anywhere in the main freight-team git repo... Because it is ("was", for most readers, we're likely to be way on with the talking and the code, by the time you read here) in team member mmoll's repo, not in the main!
https://github.com/mmoll/freight
So I cloned mmoll's repo. And there I found the string in:

$ cat /some/where/local/freight_mmoll/.git/packed-refs 
# pack-refs with: peeled fully-peeled sorted 
6c3172ef544d0041f3f8a3767e2fe499fd6d052b refs/remotes/origin/InRelease
decd3b20f7fa2afc265500dc9071ca9dae7380c6 refs/remotes/origin/gh-pages
cbd97a294eeb1702096072487c8f29110de5c5ab refs/remotes/origin/issue72
[...]
  

Then I found, in the progit.pdf book by Github creators, downloadable completely for free (not hard to find, but find it yourself) that I needed to do:

git update-ref HEAD 6c3172ef544d00
  

And the hardest thing for me (at this stage) to figure out, was that what I had on the disk, the files as they were, when updating the head in that way, didn't contain any new InRelease string with the new code...

I kept looking at this diff

$ git diff --cached
diff --git a/.gitignore b/.gitignore
index 214166a..f1e755f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,7 +7,6 @@
 *.orig.tar.gz
 *.tar.gz
 *~
-.idea/
 etc/freight.conf
 var
 test/tmp
diff --git a/lib/freight/apt.sh b/lib/freight/apt.sh
index 2b7214f..69b09fb 100644
--- a/lib/freight/apt.sh
+++ b/lib/freight/apt.sh
@@ -207,31 +207,25 @@ EOF
 
     } >"$DISTCACHE/Release"
 
-    # compose one gpg parameter string with all GPG keys
-    USERKEYS=""
+    # Sign the top-level `Release` file with `gpg`, for each key and
+    # concatenate signatures.
     for GPGKEY in $GPG; do
-        USERKEYS="$USERKEYS$(printf %s "-u$GPGKEY") "
-    done
-
-    # Sign the top-level `Release` file with `gpg`
-    # shellcheck disable=SC2046 disable=SC2086 disable=SC2015
-    gpg -abs$([ "$TTY" ] || echo " --no-tty") --use-agent ${USERKEYS} \
-        $([ "$GPG_PASSPHRASE_FILE" ] && echo " --batch --passphrase-fd 1 --passphrase-file $GPG_PASSPHRASE_FILE") \
-        $([ "$GPG_DIGEST_ALGO" ] && echo " --personal-digest-preferences $GPG_DIGEST_ALGO") \
-        -o"$DISTCACHE/Release.gpg" "$DISTCACHE/Release" &&
-    # Create/Sign the top-level `InRelease` file with `gpg`
-    gpg --clearsign$([ "$TTY" ] || echo " --no-tty") --use-agent ${USERKEYS} \
-        $([ "$GPG_PASSPHRASE_FILE" ] && echo " --batch --passphrase-fd 1 --passphrase-file $GPG_PASSPHRASE_FILE") \
-        $([ "$GPG_DIGEST_ALGO" ] && echo " --personal-digest-preferences $GPG_DIGEST_ALGO") \
-        -o"$DISTCACHE/InRelease" "$DISTCACHE/Release" || {
-        cat <<EOF
+        # shellcheck disable=SC2046
+        gpg -abs$([ "$TTY" ] || echo " --no-tty") --use-agent -u"$GPGKEY" \
+            $([ "$GPG_PASSPHRASE_FILE" ] && echo " --batch --passphrase-fd 1 --passphrase-file $GPG_PASSPHRASE_FILE") \
+            $([ "$GPG_DIGEST_ALGO" ] && echo " --personal-digest-preferences $GPG_DIGEST_ALGO") \
+            -o"$TMP/release_last_signature.gpg" "$DISTCACHE/Release" || {
+            cat <<EOF
 # [freight] couldn't sign the repository, perhaps you need to run
 # [freight] gpg --gen-key and update the GPG setting in $CONF
 # [freight] (see freight(5) for more information)
 EOF
[...]
  

But pls. see it in better format, and certainly very likely without any errors, at:
https://github.com/freight-team/freight/pull/79/files

At first I kept commiting... (and that was losing the new code)... It took me a while to understand that only when I issued:

$ git reset HEAj
Unstaged changes after reset:
M       .gitignore
M       lib/freight/apt.sh
M       test/apt_cache.bats
$
  

git gave me the advice on what to do to finally get the new code:

$ git status
On branch master
Your branch is ahead of 'origin/master' by 3 commits.
  (use "git push" to publish your local commits)

Changes not staged for commit:
  (use "git add ..." to update what will be committed)
  (use "git checkout -- ..." to discard changes in working directory)

        modified:   .gitignore
        modified:   lib/freight/apt.sh
        modified:   test/apt_cache.bats

no changes added to commit (use "git add" and/or "git commit -a")
$
  

But what is that advice? It's to discard the changes one!

$ git checkout -- lib/freight/apt.sh
$ git checkout -- test/apt_cache.bats
$ git checkout -- .gitignore
  

That finally got the code in real files on my local disk for me. Only that... Phew!

$ git log -3
commit 6c3172ef544d0041f3f8a3767e2fe499fd6d052b (HEAD -> master, origin/InRelease)
Author: Michael Moll 
Date:   Thu Apr 5 02:34:59 2018 +0200

    create InRelease file

commit 7053f4891ab97d894a2ac24024df696b82f5d748
Author: Michael Moll 
Date:   Thu Apr 5 00:26:12 2018 +0200

    refactor signing of the Release file

commit de3c87538261cdf0b56cdd91b6b15607f78c5a3e
Author: Michael Moll 
Date:   Thu Apr 5 02:14:01 2018 +0200

    refactor multikey signing test
$
  

And only now can I install this Freight that is from mmoll's repo and is "ahead of 'origin/master' by 3 commits".

And I wrote all this down so that one secret of git should remain no secret to me anymore.

---