pull, time-machine: ‘--allow-untrusted-channels’ takes an argument.

* guix/scripts/pull.scm (%default-options): Change ‘require-trusted-channels?’
to ‘require-trusted-channels’.
(show-help, %options): Support optional argument to
‘--allow-untrusted-channels’.
(channel-list): Adjust accordingly.
* guix/scripts/time-machine.scm (show-help, %options)
(%default-options): Likewise.
* tests/guix-time-machine.sh: Add test.
* doc/guix.texi (Invoking guix pull)
(Invoking guix time-machine): Adjust accordingly.

Suggested-by: Reepca Russelstein <reepca@russelstein.xyz>
Change-Id: I342ebbcc7355953487a5c6c8ac85048943a5ac46
Signed-off-by: Ludovic Courtès <ludo@gnu.org>

4 files changed, 55 insertions, 28 deletions

diff --git a/doc/guix.texi b/doc/guix.texi
index a8af7659b9b..a2c79346777 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -4827,14 +4827,17 @@ or, if the above file doesn't exist, the currently-used channels as
 returned by @command{guix describe}.
 @end itemize
 
-@item --allow-untrusted-channels
-When @option{--channels} is passed a URL, this option causes
-@command{guix pull} to pull the channels returned from that URL, even if
-they are not trusted.
+@item --allow-untrusted-channels[=yes|no]
+Whether to allow pulls from untrusted channels.
+
+By default, @command{guix pull} aborts when downloading a channel file
+that specifies an untrusted channel and merely warns if the list of
+channels comes from a local file.  This option allows you to change
+that.
 
 @quotation Warning
-Using this option can effectively lead to arbitrary code execution on
-your system.
+Allowing untrusted channels can effectively lead to arbitrary code
+execution on your system.
 @end quotation
 
 @anchor{unsafe-channel-evaluation}
@@ -5140,14 +5143,12 @@ immutable.
 
 @xref{Invoking guix pull}, for more information.
 
-@item --allow-untrusted-channels
-When @option{--channels} is passed a URL, this option causes
-@command{guix time-machine} to pull the channels returned from that URL,
-even if they are not trusted.
+@item --allow-untrusted-channels[=yes|no]
+Whether to allow pulls from untrusted channels.
 
 @quotation Warning
-Using this option can effectively lead to arbitrary code execution on
-your system.
+Allowing untrusted channels can effectively lead to arbitrary code
+execution on your system.
 @end quotation
 
 @xref{trusted-channels, @command{guix pull} documentation}, for more
diff --git a/guix/scripts/pull.scm b/guix/scripts/pull.scm
index 8474f28ea6e..0e7f8684f23 100644
--- a/guix/scripts/pull.scm
+++ b/guix/scripts/pull.scm
@@ -79,7 +79,7 @@
     (graft? . #t)
     (debug . 0)
     (verbosity . 1)
-    (require-trusted-channels? . #t)
+    (require-trusted-channels . default)
     (isolated-channel-evaluation? . #t)
     (authenticate-channels? . #t)
     (verify-certificate? . #t)
@@ -105,8 +105,9 @@ Download and deploy the latest version of Guix.\n"))
       --disable-authentication
                          disable channel authentication"))
   (display (G_ "
-      --allow-untrusted-channels
-                         when downloading channels, allow untrusted channels"))
+      --allow-untrusted-channels[=yes|no]
+                         whether to allow untrusted channels (default: yes
+                         for local channel files, no otherwise)"))
   (display (G_ "
       --unsafe-channel-evaluation
                          evaluate channels file with the full user authority"))
@@ -198,9 +199,14 @@ Download and deploy the latest version of Guix.\n"))
          (option '("disable-authentication") #f #f
                  (lambda (opt name arg result)
                    (alist-cons 'authenticate-channels? #f result)))
-         (option '("allow-untrusted-channels") #f #f
+         (option '("allow-untrusted-channels") #f #t
                  (lambda (opt name arg result)
-                   (alist-cons 'require-trusted-channels? #f result)))
+                   (alist-cons 'require-trusted-channels
+                               (match (and arg (string-downcase arg))
+                                 ("yes" #f)
+                                 ("no" #t)
+                                 (_ 'default))
+                               result)))
          (option '("unsafe-channel-evaluation") #f #f
                  (lambda (opt name arg result)
                    (alist-cons 'isolated-channel-evaluation? #f result)))
@@ -821,8 +827,8 @@ transformations specified in OPTS (resulting from '--url', '--commit', or
   (define isolated?
     (assoc-ref opts 'isolated-channel-evaluation?))
 
-  (define require-trusted-channels?
-    (assoc-ref opts 'require-trusted-channels?))
+  (define require-trusted-channels
+    (assoc-ref opts 'require-trusted-channels))
 
   (define (load-channels file)
     (let* ((url? (or (string-prefix? "https://" file)
@@ -839,10 +845,13 @@ transformations specified in OPTS (resulting from '--url', '--commit', or
             ;; When downloading channels, keep going if and only if these are
             ;; channels the user trusts.
             (check-trusted-channels result
-                                    (if (and (or url? swhid?)
-                                             require-trusted-channels?)
-                                        'error
-                                        'warning))
+                                    (match require-trusted-channels
+                                      ((? boolean? x)
+                                       (if x 'error 'warning))
+                                      ('default
+                                       (if (or url? swhid?)
+                                           'error
+                                           'warning))))
             result)
           (leave (G_ "'~a' did not return a list of channels~%") file))))
 
diff --git a/guix/scripts/time-machine.scm b/guix/scripts/time-machine.scm
index 9be92213ddb..fdd84ddece2 100644
--- a/guix/scripts/time-machine.scm
+++ b/guix/scripts/time-machine.scm
@@ -71,8 +71,9 @@ If COMMAND is not provided, print path to the time-machine profile.\n"))
       --disable-authentication
                          disable channel authentication"))
   (display (G_ "
-      --allow-untrusted-channels
-                         when downloading channels, allow untrusted channels"))
+      --allow-untrusted-channels[=yes|no]
+                         whether to allow untrusted channels (default: yes
+                         for local channel files, no otherwise)"))
   (display (G_ "
       --unsafe-channel-evaluation
                          evaluate channels file with the full user authority"))
@@ -113,9 +114,14 @@ If COMMAND is not provided, print path to the time-machine profile.\n"))
          (option '("disable-authentication") #f #f
                  (lambda (opt name arg result)
                    (alist-cons 'authenticate-channels? #f result)))
-         (option '("allow-untrusted-channels") #f #f
+         (option '("allow-untrusted-channels") #f #t
                  (lambda (opt name arg result)
-                   (alist-cons 'require-trusted-channels? #f result)))
+                   (alist-cons 'require-trusted-channels
+                               (match (and arg (string-downcase arg))
+                                 ("yes" #f)
+                                 ("no" #t)
+                                 (_ 'default))
+                               result)))
          (option '("no-check-certificate") #f #f
                  (lambda (opt name arg result)
                    (alist-cons 'verify-certificate? #f result)))
@@ -137,7 +143,7 @@ If COMMAND is not provided, print path to the time-machine profile.\n"))
     (print-build-trace? . #t)
     (print-extended-build-trace? . #t)
     (multiplexed-build-output? . #t)
-    (require-trusted-channels? . #t)
+    (require-trusted-channels . default)
     (isolated-channel-evaluation? . #t)
     (authenticate-channels? . #t)
     (verify-certificate? . #t)
diff --git a/tests/guix-time-machine.sh b/tests/guix-time-machine.sh
index 262e3d5fef8..e61232f94fa 100644
--- a/tests/guix-time-machine.sh
+++ b/tests/guix-time-machine.sh
@@ -74,6 +74,17 @@ cat > "$channels_file" <<EOF
 EOF
 guix repl -- "$channels_file"
 
+# Under 'pre-inst-env', there are zero trusted channels by default.
+cat > "$channels_file" <<EOF
+%default-channels
+EOF
+
+# Ignore the user's ~/.config/guix/trusted-channels.scm and ensure this
+# command fails.
+XDG_CONFIG_HOME="$XDG_CACHE_HOME/dot-config" \
+guix time-machine -C "$channels_file" --allow-untrusted-channels=no 2> "$log_file" && false
+grep "'guix' is not trusted" "$log_file"
+
 if guile -c '(getaddrinfo "www.gnu.org" "80" AI_NUMERICSERV)' 2> /dev/null
 then
     # Ignore the user's ~/.config/guix/trusted-channels.scm.  Under