15/16: transformations: Add #:authenticate? to ‘package-with-upstream-version’.

[guix-commits]

civodul pushed a commit to branch master
in repository guix.

commit 3dfb757a45f49dbc83769477fc8d0d88b8e71556
Author: Ludovic Courtès <ludo@gnu.org>
AuthorDate: Thu Nov 28 22:27:00 2024 +0100

    transformations: Add #:authenticate? to ‘package-with-upstream-version’.
    
    * guix/transformations.scm (upstream-source-without-signatures): New
    procedures.
    (package-with-upstream-version): Add #:authenticate? and honor it.
    
    Change-Id: Ib86feb765f57bc1b129e813780abc605c43ed97b
---
 guix/transformations.scm | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/guix/transformations.scm b/guix/transformations.scm
index a32aad39f2..3f7d20beaa 100644
--- a/guix/transformations.scm
+++ b/guix/transformations.scm
@@ -31,7 +31,8 @@
   #:autoload   (guix download) (download-to-store)
   #:autoload   (guix git-download) (git-reference? git-reference-url)
   #:autoload   (guix git) (git-checkout git-checkout? git-checkout-url)
-  #:autoload   (guix upstream) (package-latest-release
+  #:autoload   (guix upstream) (upstream-source
+                                package-latest-release
                                 upstream-source-version
                                 upstream-source-signature-urls)
   #:autoload   (guix cpu) (current-cpu
@@ -856,13 +857,24 @@ additional patches."
   "This origin method simply downloads SOURCE, an <upstream-source> record."
   (lower-object source system))
 
+(define (upstream-source-without-signatures source)
+  "Return SOURCE with #f as its 'signature-urls' field."
+  (upstream-source (inherit source)
+                   (signature-urls #f)))
+
 (define* (package-with-upstream-version p #:optional version
-                                        #:key (preserve-patches? #f))
+                                        #:key
+                                        (preserve-patches? #f)
+                                        (authenticate? #t))
   "Return package P changed to use the given upstream VERSION or, if VERSION
 is #f, the latest known upstream version.  When PRESERVE-PATCHES? is true,
 preserve patches and snippets found in the source of P, provided it's an
-origin."
-  (let ((source (package-latest-release p #:version version)))
+origin.  When AUTHENTICATE? is false, disable OpenPGP signature verification
+of upstream source code."
+  (let ((source (and=> (package-latest-release p #:version version)
+                       (if authenticate?
+                           identity
+                           upstream-source-without-signatures))))
     (cond ((not source)
            (if version
                (warning