Suggested by Leo Famulari and others.
* guix/scripts/system.scm (maybe-suggest-running-guix-pull): New
procedure.
(perform-action): Call it when ACTION is 'reconfigure.
This allows GuixSD to default to the right list of URLs, with
mirror.hydra.gnu.org coming first.
Reported by Chris Marusich <cmmarusich@gmail.com>.
* guix/store.scm (%default-substitute-urls): Prepend
"mirror.hydra.gnu.org."
Switching to execlp means that the process spawned in a container is PID
1, which obsoleted one of the 'guix environment --container' tests
because the init process can't be killed in the usual manner.
* guix/scripts/environment.scm (launch-environment/fork): New procedure.
(launch-environment): Switch from system* to execlp. Add handler for
SIGINT.
(guix-environment): Use launch-environment/fork.
* tests/guix-environment-container.sh: Replace abnormal exit test with
one that works now that the spawned process is PID 1.
* guix/scripts/environment.scm (launch-environment/container): Change
$HOME to the current user's home directory instead of
/homeless-shelter. Create a dummy /etc/passwd with a single entry for
the current user.
* doc/guix.texi ("invoking guix environment"): Add a note about the
dummy home directory and /etc/passwd.
* guix/scripts/build.scm: Use the right 'package-name->name+version'
procedure. Fixes a regression introduced in
1b846da8c3.
* tests/scripts-build.scm ("options->transformation, with-source, with
version"): New test.
Suggested by Jookia.
* guix/derivations.scm (&file-search-error): New error condition.
(search-path*): Raise it when 'search-path' returns #f.
* guix/gexp.scm (search-path*): Remove.
* guix/ui.scm (call-with-error-handling): Add case for
'file-search-error?'.
* tests/derivations.scm ("build-expression->derivation and invalid
module name"): New test.
Fixes <http://bugs.gnu.org/23062>.
Reported by Danny Milosavljevic <dannym@scratchpost.org>.
* guix/import/pypi.scm (make-pypi-sexp): Check whether 'pypi-uri'
returns SOURCE-URL and fall back to the full URL otherwise.
* tests/pypi.scm ("pypi->guix-package"): Adjust expected URI
accordingly.
Co-authored-by: Danny Milosavljevic <dannym@scratchpost.org>
Partially fixes <http://bugs.gnu.org/20145>.
* guix/build/download.scm (add-weak-reference): Remove.
(%tls-ports): New variable.
(register-tls-record-port): New procedure.
(tls-wrap): Use it instead of 'add-weak-reference'.
(close-connection): New procedure.
Before that, 'guix build --substitute-urls=""' would lead to using the
daemon's own URL list instead of the empty list. The 'or*' hack, which
is to blame, had become unnecessary since commit
fb4bf72be3.
Reported by Mark H Weaver <mhw@netris.org>.
* guix/scripts/substitute.scm (or*): Remove.
(%cache-urls): Use 'or' instead of 'or*'.
* tests/store.scm ("substitute query, alternating URLs"): Add test with
empty URL list.
* doc/guix.texi (Common Build Options): Mention the empty string.
This allows substitute servers to tell 'guix substitute' how long they
can cache narinfo lookups.
* guix/scripts/substitute.scm (cache-narinfo!): Add 'ttl' parameter.
[cache-entry]: Honor it.
(fetch-narinfos)[handle-narinfo-response]: Check the 'Cache-Control'
header of RESPONSE and pass its 'max-age' value to 'cache-narinfo!'.
* guix/scripts/substitute.scm (cached-narinfo): Expect 'narinfo' sexp
version 2 with a 'ttl' field.
(cache-narinfo!)[cache-entry]: Produce 'narinfo' sexp version 2 with a
'ttl' field.
(remove-expired-cached-narinfos)[expired?]: Read 'narinfo' sexp version 2.
The connection used to fetch /nix-cache-info is now reused for the
subsequent narinfo requests.
* guix/scripts/substitute.scm (download-cache-info)[download]: Remove.
[uri, read-cache-info]: New variables.
Rewrite in terms of 'http-fetch' instead of 'fetch'. Return an open
port in addition to a <cache-info>.
* guix/scripts/substitute.scm (http-multiple-get): Add #:port parameter
and honor it.
(fetch-narinfos)[do-fetch]: Add 'port' parameter.
Adjust to new 'download-cache-info' and 'do-fetch' signatures.
This parameter became unused with the switch to HTTP pipelining in
commit d3a652037e.
* guix/scripts/substitute.scm (fetch): Remove #:quiet-404? and adjust
accordingly.
The "Modified" database that we were reading is much smaller, but it
only shows CVEs modified over the past week.
* guix/cve.scm (%now, %current-year, %past-year): New variables.
(yearly-feed-uri): New procedure.
(%cve-feed-uri, %ttl): Remove.
(%current-year-ttl, %past-year-ttl): New variables.
(call-with-cve-port): Add 'uri' and 'ttl' parameters and honor them.
Add 'setvbuf' call.
(current-vulnerabilities)[read-vulnerabilities]: New procedure.
Read from both %LAST-YEAR and %CURRENT-YEAR.
Fixes <http://bugs.gnu.org/22937>.
Reported by Chris Marusich <cmmarusich@gmail.com>.
* guix/scripts/substitute.scm (fetch): Add 'https' alongside 'http'.
Use 'open-connection-for-uri' instead of 'open-socket-for-uri'. Call
'setvbuf' only when PORT matches 'file-port?'.
(http-multiple-get): Likewise. Change 'base-url' parameter to
'base-uri'.
(fetch-narinfos)[do-fetch]: Add 'https' case alongside 'http'. Pass URI
instead of URL to 'http-multiple-get'.
* doc/guix.texi (Requirements): Move GnuTLS one level higher and mention
HTTPS substitutes.
(Substitutes): Mention HTTPS and recommend it. Explain why servers
are not authenticated. Add "On Trusting Binaries" subsection.
Reported in <http://bugs.gnu.org/22937>
by Chris Marusich <cmmarusich@gmail.com>.
* guix/scripts/substitute.scm (fetch): Add 'else' case and call 'leave'.
Previously, the resulting 'signature-urls' would contain N times the
same URL.
* guix/upstream.scm (coalesce-sources): Fix TWO in 'signature-urls'.
* tests/upstream.scm: New file.
* Makefile.am (SCM_TESTS): Add it.
This reduces the wall-clock time of
guix environment gnutls --pure -E true
by ~35%.
* guix/packages.scm (%graft-cache): New variable.
(input-graft): Use 'cached' to cache to %GRAFT-CACHE.
This reduces the wall-clock time of
guix environment gnutls --pure -E true
by ~25%.
* guix/packages.scm (%bag-cache): New variable.
(package->bag): Use 'cached' to cache things to %BAG-CACHE.
* guix/packages.scm (cache): Rename to...
(cache!): ... this. Add 'cache' parameter, and use it.
(cached): Add a rule to allow the cache to be specified.
Before that, 'references/substitutes' would assume that
'substitutable-path-info' would return things in the same order as its
arguments, which is not the case. Thus, it would sometimes provide
incorrect reference information, occasionally leading to infinite
loop (because dependency information would denote cycles.)
Fixes <http://bugs.gnu.org/22914>.
Reported by Eric Bavier <ericbavier@openmailbox.org>.
* guix/store.scm (references/substitutes): Make ITEMS the first argument
of the loop; match on it. Use 'any' to find a matching substitute.
(substitutable-path-info): Clarify docstring about ordering.
The time for:
guix build inkscape -n --no-substitutes
goes down by 30% (in the presence of 3 replacements among all the
packages.)
* guix/grafts.scm (cumulative-grafts): Turn into a monadic procedure in
%STATE-MONAD. Use the current state as a derivation-to-graft cache.
(graft-derivation): Call 'cumulative-grafts' within 'run-with-state'.
This avoids starting derivation builds just for the sake of knowing the
references of their outputs, thereby restoring the expected behavior of
--dry-run when substitutes are available.
* guix/grafts.scm (non-self-references): Remove 'store' parameter, and
add 'references'. Use it. Update caller.
(references-oracle): New variable.
(cumulative-grafts): Add 'references' parameter and use it. Update
callers.
(graft-derivation): Remove 'build-derivations' call. Add call to
'references-oracle'.
This fixes a bug whereby, with grafts leading to builds very early,
build options such as --substitute-urls would not be taken into account
yet.
Reported by Andreas Enge <andreas@enge.fr>.
* guix/scripts/build.scm (guix-build): Move 'opts' to the beginning.
Use 'with-store' instead of 'open-connection'. Call
'set-build-options-from-command-line' right after 'with-store'.
Reported by Mark H Weaver.
* guix/scripts/build.scm (options->derivations): When SRC and GRAFT? are
true, use the source of P's replacement.
* tests/guix-build.sh: Add test.
This provides the ability to use numbers in package names.
Fixes <http://bugs.gnu.org/19219>.
* guix/utils.scm (package-name->name+version): New procedure.
* gnu/packages.scm (%find-package): Add a FALLBACK? keyword argument.
Use the previous method when no package is found.
(specification->package+output, specification->package): Adapt
documentation to new syntax.
* doc/guix.texi (Invoking guix package, Invoking guix import): Likewise.
* guix/ui.scm (package-specification->name+version+output): Likewise.
* guix/scripts/import/hackage.scm (show-help): Likewise.
* tests/guix-build.sh: Adapt to new syntax.
* tests/guix-lint.sh: Likewise.
* tests/guix-package.sh: Likewise.
* tests/ui.scm ("package-specification->name+version+output"): Likewise.
* tests/utils.scm ("package-name->name+version"): Likewise.
* NEWS: Mention new syntax.
Previously 'GUIX_BUILD_OPTIONS' would be honored, but 'guix graph' does
not support the common build options.
* guix/scripts/graph.scm (guix-graph): Use 'args-fold*' instead of
'parse-command-line'.
Fixes <http://bugs.gnu.org/22139>.
* guix/grafts.scm (graft-derivation): Rename to...
(graft-derivation/shallow): ... this.
(graft-origin-file-name, item->deriver, non-self-references)
(cumulative-grafts, graft-derivation): New procedures
* tests/grafts.scm ("graft-derivation, grafted item is a direct
dependency"): Clarify title. Use 'grafted' instead of 'graft' to refer
to the grafted derivation.
("graft-derivation, grafted item is an indirect dependency")
("graft-derivation, no dependencies on grafted output"): New tests.
* guix/packages.scm (input-graft): Change to take a package instead of
an input.
(input-cross-graft): Likewise.
(fold-bag-dependencies): New procedure.
(bag-grafts): Rewrite in terms of 'fold-bag-dependencies'.
* tests/packages.scm ("package-derivation, indirect grafts"): Comment out.
* doc/guix.texi (Security Updates): Mention run-time dependencies and
recursive grafting.
Before that, outputs of a derivation could be left referring to the
ungrafted version of the derivation.
* guix/grafts.scm (graft-derivation)[outputs]: Change to a list of
name/file pairs.
* guix/grafts.scm (graft-derivation)[build]: Add 'old-outputs' variable
and use it when computing 'mapping'. Use 'mapping' directly.
* tests/grafts.scm ("graft-derivation, multiple outputs"): New test.
* guix/store.scm (read-path-info): Use #f when we get the empty string
for DERIVER.
* guix/scripts/publish.scm (narinfo-string): Adjust accordingly.
* tests/store.scm ("path-info-deriver"): New test.
* guix/http-client.scm (cache-file-for-uri): New procedure.
(http-fetch/cached): Use it. Remove 'directory' variable.
[update-cache]: Make the 'dirname' of FILE.
Fixes <http://bugs.gnu.org/22753>.
Reported by Mark H Weaver <mhw@netris.org>.
* guix/scripts/system.scm (save-load-path-excursion): New variable.
(upgrade-shepherd-services): Add comment about the issue.
(switch-to-system): Use 'save-load-path-excursion' around
'primitive-load' call.
Before that, /nar requests could succeed if the requested store item
exists but is invalid (although such requests were unlikely because the
corresponding narinfo request would have failed.)
* guix/scripts/publish.scm (render-nar): Add 'store' parameter. Use
'valid-path?' instead of 'file-exists?'.
(make-request-handler): Adjust 'render-nar' call accordingly.
* tests/publish.scm ("/nar/invalid"): New test.
* guix/gnu-maintenance.scm (xorg-package?, latest-xorg-release): New
private functions.
(%xorg-updater): New public variable.
* guix/scripts/refresh.scm (%updaters): Add %xorg-updater.
* doc/guix.texi (Invoking guix refresh): Mention the new updater.
Reported by Leo Famulari <leo@famulari.name>
and Ben Woodcroft <b.woodcroft@uq.edu.au>
at <http://bugs.gnu.org/22752>.
* guix/scripts/refresh.scm: Remove unneeded and harmful import of (guix
import gem).
Suggested by Federico Beffa.
Fixes <http://bugs.gnu.org/22676>.
Reported by Danny Milosavljevic <dannym@scratchpost.org>.
* gnu/packages/engineering.scm (broken-tarball-fetch): Remove.
(fastcap)[source](method): Use URL-FETCH/TARBOMB instead.
* gnu/packages/scheme.scm (broken-tarball-fetch): Remove.
(scmutils)[source](method): Use URL-FETCH/TARBOMB instead.
* guix/download.scm (url-fetch/tarbomb): New procedure, renamed from
'broken-tarball-fetch'.
Fixes <http://bugs.gnu.org/19816>.
* guix/scripts/environment.scm (evaluate-input-search-paths)
(build-inputs): Delete.
(evaluate-profile-search-paths, strip-input-name)
(package-or-package+output?, package-environment-inputs)
(build-environment, inputs->profile-derivations): New procedures.
(create-environment, show-search-paths, launch-environment)
(launch-environment/container): Replace 'inputs' argument
with 'profile' argument.
(package+propagated-inputs): Strip off names off of input tuples.
(options/resolve-packages): Handle input tuples that specify an output
in expressions.
(guix-environment): Convert inputs into a profile to use in the
environment. Remove non-package inputs such as origins from
environment inputs.
* doc/guix.texi ("invoking guix environment"): Document package+output
tuples for --expression option.
* tests/guix-environment.sh: Update tests.
* tests/guix-environment-container.sh: Likewise.
Co-authored-by: Ludovic Courtès <ludo@gnu.org>
* guix/build/bournish.scm: New file.
* Makefile.am (MODULES): Add it.
* gnu/system/linux-initrd.scm (base-initrd): Add (guix build bournish)
and use it.
Fixes <http://bugs.gnu.org/22437>.
Reported by Leo Famulari <leo@famulari.name> and others.
* guix/build-system/python.scm (package-with-explicit-python): Add
#:variant-property and honor it.
(strip-python2-variant): New procedure.
Before that 'open-connection' would return #f, and thus
'current-services' would return a single #f value when its continuation
expects two.
Reported by calher on #guix.
* gnu/services/herd.scm (open-connection): Rethrow system-error
exceptions.
(with-shepherd): Expect CONNECTION to always be true; remove useless
'dynamic-wind'.
* guix/scripts/system.scm (warn-on-system-error): New macro.
(upgrade-shepherd-services): Wrap body in 'warn-on-system-error'.
Partly fixes <http://bugs.gnu.org/22039>.
* gnu/services/herd.scm: New file.
* gnu-system.am (GNU_SYSTEM_MODULES): Add it.
* gnu/services/shepherd.scm (shepherd-service-canonical-name): New
procedure.
(shepherd-service-file): Export.
* guix/scripts/system.scm (upgrade-shepherd-services): New procedure.
(switch-to-system): Use it.
* guix/ui.scm (info): New procedure.
* doc/guix.texi (Invoking guix system): Mention system services.
This fixes interfaces with a dash or other characters being ignored.
Suggested by Jookia <166291@gmail.com>.
* guix/build/syscalls.scm (%interface-line): Use [[:graph:]] instead
of [[:alnum:]].
* guix/scripts/build.scm (transform-package-source): Return a procedure
that expects a single object rather than a list of packages.
(options->transformation): Rewrite to precompute the list of applicable
transformations and to return a procedure that expects a single object
rather than a list of objects.
(options->derivations): Adjust accordingly.
* tests/scripts-build.scm: New file.
* Makefile.am (SCM_TESTS): Add it.
* guix/packages.scm <package>: Use '@' in record printer.
* guix/import/cabal.scm <cabal-package>: Likewise
* guix/import/elpa.scm <elpa-package>: Likewise.
* tests/packages.scm: Adapt to it.
* guix/scripts/lint.scm (check-patch-file-names): Don't check if patches
start with the package full name since matching the package name (which
is a prefix of the full name) is sufficient.
* guix/import/cran.scm (%bioconductor-updater,
latest-bioconductor-release, bioconductor-package?): New procedures.
(cran->guix-package): Support repositories other than CRAN.
(%bioconductor-url, %bioconductor-svn-url): New variables.
(description->package): Update signature to distinguish between packages
from different repositories.
(latest-release): Rename procedure ...
(latest-cran-release): ... to this.
(cran-package?): Do not assume all R packages are available on CRAN.
* tests/cran.scm: Update tests.
* guix/scripts/import/cran.scm: Add "--archive" option and default to
CRAN.
* guix/scripts/refresh.scm (%updaters): Add "%bioconductor-updater".
* doc/guix.texi: Document Bioconductor importer and updater.
* guix/monad-repl.scm (store-monad-language): Add 'store' parameter and
use it. Remove call to 'open-connection'.
(enter-store-monad): Use 'with-store' and pass the store to
'store-monad-language.
Previously paths to the GEM_HOME of certain Ruby packages were
hard-coded, so packages failed to build when Ruby was updated to 2.3.0.
* guix/build/ruby-build-system.scm (gem-home): New procedure.
* gnu/packages/ruby.scm (ruby-metaclass, ruby-instantiator,
ruby-introspection, ruby-mocha, ruby-minitest-tu-shim): Use it.
The .gem file stored in GEM_HOME after install is both redundant and an
archive that stores timestamped files which makes builds
non-deterministic, so delete it after 'gem install'.
* guix/build/ruby-build-system.scm (install): Remove cached gem after
install.
This phase is inherited by other build systems, which ensures
'SOURCE_DATE_EPOCH' is always set in practice.
* guix/build/python-build-system.scm (set-SOURCE-DATE-EPOCH): Remove.
(%standard-phases): Don't add it.
* guix/build/gnu-build-system.scm (set-SOURCE-DATE-EPOCH): New
procedure.
(%standard-phases): Add it.
(gnu-build): Remove 'setenv' call for "SOURCE_DATE_EPOCH".
* guix/scripts/package.scm (find-packages-by-description): Change 'rx'
parameter to 'regexps'.
[matches-all?, matches-one?]: New procedures.
Use them.
(process-query): Collect regexps from all 'search' queries, and pass
them to 'find-packages-by-description'.
* tests/guix-package.sh: Add tests.
* doc/guix.texi (Invoking guix package): Document it.
Previously, the 'git checkout' invocation would remove sub-modules that
had been initialized by 'git clone --recursive'.
* guix/build/git.scm (git-fetch): Never use "git clone --recursive".
Invoke "git submodule update --init --recursive" after "git checkout".
Remove '.git' directories as the last step.
Before that it would include #f for most origins since that the default
value of 'origin-patch-guile'.
* guix/scripts/graph.scm (bag-node-edges): When 'origin-patch-guile'
returns #f, use (default-guile).
* tests/graph.scm ("bag DAG, including origins"): Check for an edge from
O to (default-guile).
Fixes <http://bugs.gnu.org/22280>.
Reported by Leo Famulari <leo@famulari.name>.
* guix/scripts/graph.scm (%bag-emerged-node-type)[edges]: Mimic
%BAG-NODE-TYPE. This is a followup to 38b92da.
This is a followup to 3eb34c6.
* guix/build-system/gnu.scm (gnu-build, gnu-cross-build): Use
"--enable-deterministic-archives" instead of "-D" to work around
Binutils bug <https://sourceware.org/bugzilla/show_bug.cgi?id=17671>.
* guix/build/gnu-build-system.scm (strip): Likewise.
* guix/packages.scm (package-transitive-native-search-paths): New
procedure.
* tests/packages.scm ("package-transitive-native-search-paths"): New
test.
Reported by Efraim Flashner <efraim@flashner.co.il>
at <https://lists.gnu.org/archive/html/guix-devel/2015-12/msg00202.html>.
* guix/gnu-maintenance.scm (latest-ftp-release): Call KEEP-FILE? on
directories too.
(latest-gnome-release)[even-minor-version?]: Protect again MINOR being
false; change pattern to match VERSION with two or more numbers. Remove
use of 'version-major+minor'.
[even-numbered-tarball?]: Rename to...
[even-numbered?]: ... this. Use 'package-name->name+version'. When
VERSION is #f, check NAME.
* guix/derivations.scm (substitution-oracle): Add #:mode parameter and
honor it.
(derivation-prerequisites-to-build): Likewise.
[derivation-built?]: Take it into account.
* guix/ui.scm (show-what-to-build): Add #:mode parameter. Pass it to
'substitute-oracle' and 'derivations-prerequisites-to-build'.
* tests/derivations.scm ("derivation-prerequisites-to-build in 'check'
mode"): New test.
Suggested by Efraim Flashner <efraim@flashner.co.il>.
* guix/gnu-maintenance.scm (latest-ftp-release): Add #:keep-file?
parameter and honor it.
(latest-gnome-release)[%not-dot]: New variable.
[even-minor-version?, even-numbered-tarball?]: New procedures.
Pass EVEN-NUMBERED-TARBALL? as #:keep-file? argument.
* guix/gnu-maintenance.scm (latest-ftp-release): Add #:file->signature
parameter. Honor it.
(latest-gnome-release): Pass #:file->signature.
* guix/upstream.scm (coalesce-sources): Keep 'signature-urls' as #f
unless both sources provide it.
With this, (latest-release "gcc") returns an <upstream-source> with URL:
ftp://ftp.gnu.org/gnu/gcc/gcc-5.3.0/gcc-5.3.0.tar.gz
Previous it would omit "gcc-5.3.0/" from the URL.
Fixes a regression introduced in 0a7c5a0.
* guix/gnu-maintenance.scm (latest-release)[file->url, file->source]:
Add 'directory' parameter. Update users.
* guix/store.scm (%protocol-version): Set minor to 15.
(build-mode): New enumerate type.
(build-things): Add 'mode' parameter; pass it to the RPC.
* tests/store.scm ("build-things, check mode"): New check.
Reported by Andreas Enge <andreas@enge.fr>
at <https://lists.gnu.org/archive/html/guix-devel/2015-11/msg00764.html>.
* guix/import/pypi.scm (&missing-source-error): New error type.
(latest-source-release): Raise it instead of using 'error'.
(pypi->guix-package): Guard against it and use 'leave' to report the
error.
(latest-release): Guard against it and return #f when caught.
* guix/scripts/build.scm (options/resolve-packages): Remove.
(options->things-to-build, transform-package-source): New procedure.
(%transformations): New variable.
(options->transformation): New procedure.
(options->derivations): Rewrite to use 'options->things-to-build' and
'options->transformation'.
* guix/scripts/package.scm (options->upgrade-predicate)
(store-item->manifest-entry): New procedures.
* guix/scripts/package.scm (options->installable): Use them. Remove the
'packages-to-upgrade' and 'packages-to-install' variables by getting rid
of a level of indirection.
* guix/scripts/package.scm (build-and-use-profile): New procedure.
Adapted and moved from...
(guix-package)[process-actions]: ... here. Adjust call sites.
* gnu/packages/python.scm (python-2)[arguments]: Set SOURCE_DATE_EPOCH
to 1 to match what the daemon does.
* guix/build/python-build-system.scm (set-SOURCE-DATE-EPOCH): Likewise.
* gnu/packages/patches/python-2.7-source-date-epoch.patch: New file.
* gnu/packages/python.scm (python-2)[source]: Use it.
[arguments]: Set SOURCE_DATE_EPOCH in 'patch-lib-shells' phase.
* guix/build/python-build-system.scm (set-SOURCE-DATE-EPOCH): New
procedure.
(%standard-phases): Add it.
* gnu-system.am (dist_patch_DATA): Add patch.
This is a followup to b68d2db, which added a check for updaters at
macro-expansion time. The problem is that, when running 'guix pull',
Guile-JSON is found, so the PyPi updater (say) is added to %UPDATERS,
but then at run time Guile-JSON might be missing.
Reported by orbea on #guix.
* guix/scripts/refresh.scm (maybe-updater): Rewrite as 'syntax-rules'.
Produce code that checks conditions at run time.
(list-updaters): Update docstring.
This fixes a bug whereby some options, such as #:substitute-urls, would
be passed to the daemon too late to have an effect.
* guix/scripts/environment.scm (build-inputs): Remove call to
'set-build-options-from-command-line*'.
(guix-environment): Add call to 'set-build-options-from-command-line' as
early as possible.
* guix/scripts/lint.scm (patch-file-name): New procedure.
(check-vulnerabilities): Use it to filter out patched vulnerabilities.
* tests/lint.scm ("cve: one patched vulnerability"): New test.
Suggested by Hynek Urban <hynek.urban@gmail.com>.
* guix/scripts/substitute.scm (fetch-narinfos): Move body to...
[do-fetch]: ... here. New procedure.
Emit a warning when CACHE-INFO's prefix does not match.
Ricardo Wurmus