pull, time-machine: Support transparent download of channel files.

* guix/scripts/pull.scm (%default-options): Add ‘require-trusted-channels?’.
(show-help, %options): Add ‘--allow-untrusted-channels’.
(trusted-channels, equivalent-channels?, check-trusted-channels): New
procedures.
(channel-list)[require-trusted-channels?]: New variable.
[load-channels]: Honor it and call ‘check-trusted-channels’.
* guix/scripts/time-machine.scm (show-help, %options): Add
‘--allow-untrusted-channels’.
(%default-options): Add ‘require-trusted-channels?’.
* tests/guix-time-machine.sh: Add test.
* doc/guix.texi (Invoking guix pull): Update ‘--channels’ documentation and
document ‘allow-untrusted-channels’.
(Invoking guix time-machine): Likewise.
(Channels with Substitutes): Add example of ‘guix pull’ with a URL.

Change-Id: If0bb6acaedf324e35a21c9c7d285f3e423ae49aa
Signed-off-by: Ludovic Courtès <ludo@gnu.org>

1 files changed, 32 insertions, 0 deletions

diff --git a/tests/guix-time-machine.sh b/tests/guix-time-machine.sh
index 30daf13ef1e..35b186ad6d1 100644
--- a/tests/guix-time-machine.sh
+++ b/tests/guix-time-machine.sh
@@ -41,6 +41,38 @@ EOF
 # Likewise, 'use-modules' is not available.
 guix time-machine -C "$channels_file" && echo false
 
+# Get 'time-machine' to download a channel file with an untrusted channel.
+# Check that this fails with a "'guix' is not trusted" message.
+cat > "$channels_file" <<EOF
+(use-modules (guix tests http)
+             (guix diagnostics)
+             (guix scripts time-machine))
+
+(define channels
+  '(list (channel
+           (name 'guix)
+           (url "https://example.org/evil/guix.git")
+           (branch "devel")
+           (commit "cabba9e900d2350aef42e65643de78500b2aad06")
+           (introduction
+            (make-channel-introduction
+             "badcafef1d5c170db68aa4bbfb77024fdc468ed3"
+             (openpgp-fingerprint
+              "CABB A9EE 8A84 FDC6 9DB4  0CFB 090B 1199 3D9A EBB5"))))))
+
+(with-http-server (list (list 200 (object->string channels)))
+  (let ((error (open-output-string)))
+    (catch 'quit
+      (lambda ()
+        (parameterize ((guix-warning-port error))
+          (guix-time-machine "-C" (%local-url) "--" "describe")
+          (primitive-exit 1)))
+      (lambda _
+        (exit (->bool (string-contains (get-output-string error)
+                                       "'guix' is not trusted")))))))
+EOF
+guix repl -- "$channels_file"
+
 if [ -d "$abs_top_srcdir/.git" ] \
    || guile -c '(getaddrinfo "www.gnu.org" "80" AI_NUMERICSERV)' 2> /dev/null
 then