GNU bug report logs - #74542
[PATCH 00/11] Improved tooling for package updates

Previous Next

Full log

Message #158 received at 74542 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: 74542 <at> debbugs.gnu.org
Cc: Ludovic Courtès <ludo <at> gnu.org>
Subject: [PATCH v2 15/16] transformations: Add #:authenticate? to ‘package-with-upstream-version’.
Date: Fri, 29 Nov 2024 10:40:18 +0100

* guix/transformations.scm (upstream-source-without-signatures): New
procedures.
(package-with-upstream-version): Add #:authenticate? and honor it.

Change-Id: Ib86feb765f57bc1b129e813780abc605c43ed97b
---
 guix/transformations.scm | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/guix/transformations.scm b/guix/transformations.scm
index a32aad39f2..3f7d20beaa 100644
--- a/guix/transformations.scm
+++ b/guix/transformations.scm
@@ -31,7 +31,8 @@ (define-module (guix transformations)
   #:autoload   (guix download) (download-to-store)
   #:autoload   (guix git-download) (git-reference? git-reference-url)
   #:autoload   (guix git) (git-checkout git-checkout? git-checkout-url)
-  #:autoload   (guix upstream) (package-latest-release
+  #:autoload   (guix upstream) (upstream-source
+                                package-latest-release
                                 upstream-source-version
                                 upstream-source-signature-urls)
   #:autoload   (guix cpu) (current-cpu
@@ -856,13 +857,24 @@ (define* (upstream-fetch source hash-algo hash
   "This origin method simply downloads SOURCE, an <upstream-source> record."
   (lower-object source system))
 
+(define (upstream-source-without-signatures source)
+  "Return SOURCE with #f as its 'signature-urls' field."
+  (upstream-source (inherit source)
+                   (signature-urls #f)))
+
 (define* (package-with-upstream-version p #:optional version
-                                        #:key (preserve-patches? #f))
+                                        #:key
+                                        (preserve-patches? #f)
+                                        (authenticate? #t))
   "Return package P changed to use the given upstream VERSION or, if VERSION
 is #f, the latest known upstream version.  When PRESERVE-PATCHES? is true,
 preserve patches and snippets found in the source of P, provided it's an
-origin."
-  (let ((source (package-latest-release p #:version version)))
+origin.  When AUTHENTICATE? is false, disable OpenPGP signature verification
+of upstream source code."
+  (let ((source (and=> (package-latest-release p #:version version)
+                       (if authenticate?
+                           identity
+                           upstream-source-without-signatures))))
     (cond ((not source)
            (if version
                (warning
-- 
2.46.0

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.