pull, time-machine: Evaluate channels in a sandbox by default.

* guix/scripts/pull.scm (%default-options): Add
‘isolated-channel-evaluation?’.
(show-help, %options): Add ‘--unsafe-channel-evaluation’.
(%safe-channel-bindings): New variable.
(channel-list): Honor ‘isolated-channel-evaluation?’.
* guix/scripts/time-machine.scm (show-help, %options): Add
‘--unsafe-channel-evaluation’.
(%default-options): Add ‘isolated-channel-evaluation?’.
* tests/guix-time-machine.sh: Test use of unauthorized bindings in channel
files.
* doc/guix.texi (Invoking guix time-machine): Document
‘--unsafe-channel-evaluation’.
(Invoking guix pull): Likewise.
(Channels with Substitutes): Add index entry for
‘channel-with-substitutes-available’.  Mention that it requires
‘--unsafe-channel-evaluation’.

Change-Id: I75f60dba516f42ef62a9d779cde8e2f0a9d0c140
Signed-off-by: Ludovic Courtès <ludo@gnu.org>

1 files changed, 21 insertions, 1 deletions

diff --git a/tests/guix-time-machine.sh b/tests/guix-time-machine.sh
index 608d4d560bf..30daf13ef1e 100644
--- a/tests/guix-time-machine.sh
+++ b/tests/guix-time-machine.sh
@@ -1,6 +1,6 @@
 # GNU Guix --- Functional package management for GNU
 # Copyright © 2023 Maxim Cournoyer <maxim@guixotic.coop>
-# Copyright © 2023-2024 Ludovic Courtès <ludo@gnu.org>
+# Copyright © 2023-2024, 2026 Ludovic Courtès <ludo@gnu.org>
 #
 # This file is part of GNU Guix.
 #
@@ -21,6 +21,26 @@
 # Test the 'guix time-machine' command-line utility.
 #
 
+channels_file="channels-test-$$.scm"
+trap "rm -f $channels_file" EXIT
+
+cat > "$channels_file" <<EOF
+(system "echo rm -rf /")
+%default-channels
+EOF
+
+# This must fail: 'system' is not among the available bindings in the
+# evaluation sandbox.
+guix time-machine -C "$channels_file" && echo false
+
+cat > "$channels_file" <<EOF
+(use-modules (system foreign))
+%default-channels
+EOF
+
+# Likewise, 'use-modules' is not available.
+guix time-machine -C "$channels_file" && echo false
+
 if [ -d "$abs_top_srcdir/.git" ] \
    || guile -c '(getaddrinfo "www.gnu.org" "80" AI_NUMERICSERV)' 2> /dev/null
 then