pki: Introduce 'write-acl', and fix wrong conversion in 'ensure-acl'.

* guix/pki.scm (write-acl): New procedure.
  (ensure-acl): Use it.  Fixes a regression introduced in 39831f1,
  whereby 'ensure-acl' would yield a wrong-type-arg error.
* guix/scripts/archive.scm (authorize-key): Use 'write-acl'.

guix/pki.scm

@@ -30,6 +30,7 @@
             public-keys->acl
             acl->public-keys
             authorized-key?
+            write-acl
 
             signature-sexp
             signature-subject
@@ -83,9 +84,13 @@ element in KEYS must be a canonical sexp with type 'public-key'."
         (mkdir-p (dirname %acl-file))
         (with-atomic-file-output %acl-file
           (lambda (port)
-            (display (canonical-sexp->string
-                      (public-keys->acl (list public-key)))
-                     port)))))))
+            (write-acl (public-keys->acl (list public-key))
+                       port)))))))
+
+(define (write-acl acl port)
+  "Write ACL to PORT in canonical-sexp format."
+  (let ((sexp (sexp->canonical-sexp acl)))
+    (display (canonical-sexp->string sexp) port)))
 
 (define (current-acl)
   "Return the current ACL."

guix/scripts/archive.scm

@@ -288,9 +288,7 @@ the input port."
     (let ((acl (public-keys->acl (cons key (acl->public-keys acl)))))
       (mkdir-p (dirname %acl-file))
       (with-atomic-file-output %acl-file
-        (lambda (port)
-          (display (canonical-sexp->string (sexp->canonical-sexp acl))
-                   port))))))
+        (cut write-acl acl <>)))))
 
 (define (guix-archive . args)
   (define (parse-options)