diff options
| author | Ludovic Courtès <ludo@gnu.org> | 2024-11-28 22:27:00 +0100 |
|---|---|---|
| committer | Ludovic Courtès <ludo@gnu.org> | 2024-12-01 20:14:16 +0100 |
| commit | 3dfb757a45f49dbc83769477fc8d0d88b8e71556 (patch) | |
| tree | 0e4cd826699c09165af26e42e9c097ba26295b12 | |
| parent | dbce5c2d47cda46854dc900a04ea101333d7d99a (diff) | |
| download | guix-3dfb757a45f49dbc83769477fc8d0d88b8e71556.tar guix-3dfb757a45f49dbc83769477fc8d0d88b8e71556.tar.gz | |
transformations: Add #:authenticate? to ‘package-with-upstream-version’.
* guix/transformations.scm (upstream-source-without-signatures): New
procedures.
(package-with-upstream-version): Add #:authenticate? and honor it.
Change-Id: Ib86feb765f57bc1b129e813780abc605c43ed97b
| -rw-r--r-- | guix/transformations.scm | 20 |
1 files changed, 16 insertions, 4 deletions
diff --git a/guix/transformations.scm b/guix/transformations.scm index a32aad39f2..3f7d20beaa 100644 --- a/guix/transformations.scm +++ b/guix/transformations.scm @@ -31,7 +31,8 @@ #:autoload (guix download) (download-to-store) #:autoload (guix git-download) (git-reference? git-reference-url) #:autoload (guix git) (git-checkout git-checkout? git-checkout-url) - #:autoload (guix upstream) (package-latest-release + #:autoload (guix upstream) (upstream-source + package-latest-release upstream-source-version upstream-source-signature-urls) #:autoload (guix cpu) (current-cpu @@ -856,13 +857,24 @@ additional patches." "This origin method simply downloads SOURCE, an <upstream-source> record." (lower-object source system)) +(define (upstream-source-without-signatures source) + "Return SOURCE with #f as its 'signature-urls' field." + (upstream-source (inherit source) + (signature-urls #f))) + (define* (package-with-upstream-version p #:optional version - #:key (preserve-patches? #f)) + #:key + (preserve-patches? #f) + (authenticate? #t)) "Return package P changed to use the given upstream VERSION or, if VERSION is #f, the latest known upstream version. When PRESERVE-PATCHES? is true, preserve patches and snippets found in the source of P, provided it's an -origin." - (let ((source (package-latest-release p #:version version))) +origin. When AUTHENTICATE? is false, disable OpenPGP signature verification +of upstream source code." + (let ((source (and=> (package-latest-release p #:version version) + (if authenticate? + identity + upstream-source-without-signatures)))) (cond ((not source) (if version (warning |