Unsigned kernel code error when trying to compile a fresh browser project

[ento]

I was going through the Hello World tutorial of the book, and ran into this error:

$ gren make src/Main.gren
Dependency problem!
-- PROBLEM BUILDING DEPENDENCIES (UNSIGNED KERNEL CODE) ------------------------

I ran into a compilation error when trying to build the following package:

    gren-lang/url 2.0.0

This package contains kernel code which has not been signed by the lead
developer of Gren. Kernel code can violate all the guarantees that Gren provide,
and is therefore carefully managed.

Note: To help with the root problem, please report this to the package author.

The gren.json file that got generated by gren init:

$ cat gren.json
{
    "type": "application",
    "platform": "browser",
    "source-directories": [
        "src"
    ],
    "gren-version": "0.2.1",
    "dependencies": {
        "direct": {
            "gren-lang/browser": "2.0.0",
            "gren-lang/core": "3.0.2"
        },
        "indirect": {
            "gren-lang/url": "2.0.0"
        }
    }
}

v2.0.1 of gren-lang/url appears to have a signature:

$ cd ~/.cache/gren/0.2.1/packages/gren-lang/url/2.0.0
$ git fetch --tags
...
$ git cat-file -p 2.0.1
tree 14e07055ebe5207a29080d97735c2c3453e3750a
parent 3d00bca2edf0ad31254356a441c59e8471557299
author Robin Heggelund Hansen <git@heghan.org> 1678811480 +0100
committer Robin Heggelund Hansen <git@heghan.org> 1678811480 +0100
gpgsig -----BEGIN SSH SIGNATURE-----
 U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgQTj50Wtmhxjke0YoyFqFJDTXnM
 AF/F5ziKY/k3Qv4fAAAAADZ2l0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5
 AAAAQKZmV0g5qOmxrk1NnSnaecalbP2ASMCloGt4wtvToKymwTbFZVP1aryURsHqU9tb2A
 ZyvB1/ki/r3MndOoxIEAs=
 -----END SSH SIGNATURE-----

Editing gren.json to bump the version of gren-lang/url to 2.0.1 fixed the error:

$ gren make src/Main.gren
Starting downloads...

  ● gren-lang/url 2.0.1

Dependencies ready!         
Success! Compiled 1 module.

    Main ───> index.html

The indirect dependency on gren-lang/url comes from gren-lang/browser. Maybe there should be a v2.0.1 release of gren-lang/browser with the minimum bound of the dependency constraint of gren-lang/url set to 2.0.1?

[robinheghan]

Thank you for this in-depth bug report. A new version of gren-lang/browser has been published.