diff options
| -rw-r--r-- | guix/transformations.scm | 20 |
1 files changed, 16 insertions, 4 deletions
diff --git a/guix/transformations.scm b/guix/transformations.scm index a32aad39f2..3f7d20beaa 100644 --- a/guix/transformations.scm +++ b/guix/transformations.scm @@ -31,7 +31,8 @@ #:autoload (guix download) (download-to-store) #:autoload (guix git-download) (git-reference? git-reference-url) #:autoload (guix git) (git-checkout git-checkout? git-checkout-url) - #:autoload (guix upstream) (package-latest-release + #:autoload (guix upstream) (upstream-source + package-latest-release upstream-source-version upstream-source-signature-urls) #:autoload (guix cpu) (current-cpu @@ -856,13 +857,24 @@ additional patches." "This origin method simply downloads SOURCE, an <upstream-source> record." (lower-object source system)) +(define (upstream-source-without-signatures source) + "Return SOURCE with #f as its 'signature-urls' field." + (upstream-source (inherit source) + (signature-urls #f))) + (define* (package-with-upstream-version p #:optional version - #:key (preserve-patches? #f)) + #:key + (preserve-patches? #f) + (authenticate? #t)) "Return package P changed to use the given upstream VERSION or, if VERSION is #f, the latest known upstream version. When PRESERVE-PATCHES? is true, preserve patches and snippets found in the source of P, provided it's an -origin." - (let ((source (package-latest-release p #:version version))) +origin. When AUTHENTICATE? is false, disable OpenPGP signature verification +of upstream source code." + (let ((source (and=> (package-latest-release p #:version version) + (if authenticate? + identity + upstream-source-without-signatures)))) (cond ((not source) (if version (warning |