[bug#50072] [PATCH v2 4/4] upstream: Support updating 'git-fetch' origins.

[Ludovic Courtès]

Maxime Devos <maximedevos@telenet.be> skribis:

> From: Sarah Morgensen <iskarian@mgsn.dev>
>
> Updaters need to be modified to return 'git-reference' objects.
> This patch modifies the 'generic-git' and 'minetest' updater,
> but others might need to be modified as well.
>
> * guix/upstream.scm (package-update/git-fetch): New procedure.
>   (<upstream-source>)[urls]: Document it can be a 'git-reference'.
>   (%method-updates): Add 'git-fetch' mapping.
>   (update-package-source): Support 'git-reference' sources.
>   (upstream-source-compiler): Bail out gracefully if the source is a git
>   origin.
> * guix/import/git.scm
>   (latest-git-tag-version): Always return two values and document that the tag
>   is returned as well.
>   (latest-git-release)[urls]: Use the 'git-reference' instead of the
>   repository URL.
> * guix/import/minetest.scm (latest-minetest-release)[urls]: Don't wrap the
>   'git-reference' in a list.
> * tests/minetest.scm (upstream-source->sexp): Adjust to new convention.
>
> Co-authored-by: Maxime Devos <maximedevos@telenet.be>

[...]

>                                                  system target)
>    "Download SOURCE from its first URL and lower it as a fixed-output
>  derivation that would fetch it."
> -  (mlet* %store-monad ((url -> (first (upstream-source-urls source)))
> -                       (signature
> +  (define url
> +    (match (upstream-source-urls source)
> +      ((first . _) first)
> +      (_ (raise (formatted-message
> +                 (G_ "git origins are unsupported by --with-latest"))))))

We should probably not refer to ‘--with-latest’ in
‘upstream-source-compiler’ to keep things separate.

> +(define* (package-update/git-fetch store package source #:key key-download)
> +  "Return the version, checkout, and SOURCE, to update PACKAGE to
> +SOURCE, an <upstream-source>."
> +  ;; TODO: it would be nice to authenticate commits, e.g. with
> +  ;; "guix git authenticate" or a list of permitted signing keys.
> +  (define ref (upstream-source-urls source)) ; a <git-reference>
> +  (values (upstream-source-version source)
> +          (latest-repository-commit

It’s a bummer that <upstream-source> no longer models things correctly:
‘urls’ can be either a list of URLs or a <git-reference>, as can be seen
in the two examples above, and ‘signature-urls’ is meaningless for Git
origins.

We can probably leave it for a future patch series, but I think we
should do something about it.

In particular, as the comment notes, IWBN to make provisions to allow
for tag signature verification, which is probably the most widespread
practice.

Thanks,
Ludo’.