bug#49006: MELPA importer uses the wrong source when called from CLI

[Xinglu Chen]

When importing a package from MELPA, the source for generated package
definition points to a (potentially unstable?) MELPA URL.

  https://melpa.org/packages/PACKAGE-VERSION.tar

--8<---------------cut here---------------start------------->8---
~/src/guix [env]$ ./pre-inst-env guix import elpa -a melpa magit

Starting download of /tmp/guix-file.wbtAlA
From https://melpa.org/packages/magit-20210609.2000.tar...
 …609.2000.tar  1.7MiB                472KiB/s 00:04 [##################] 100.0%
(package
  (name "emacs-magit")
  (version "20210609.2000")
  (source
    (origin
      (method url-fetch)
      (uri (string-append
             "https://melpa.org/packages/magit-";
             version
             ".tar"))
      (sha256
        (base32
          "0pplizxy20i3i9zqm5kfjz4la93gpz8wwh1ybwdwngv5ks7vhdsr"))))
  (build-system emacs-build-system)
  (propagated-inputs
    `(("emacs-dash" ,emacs-dash)
      ("emacs-git-commit" ,emacs-git-commit)
      ("emacs-magit-section" ,emacs-magit-section)
      ("emacs-transient" ,emacs-transient)
      ("emacs-with-editor" ,emacs-with-editor)))
  (home-page "https://github.com/magit/magit";)
  (synopsis "A Git porcelain inside Emacs.")
  (description
    "Magit is a text-based Git user interface that puts an unmatched focus
on streamlining workflows.  Commands are invoked using short mnemonic
key sequences that take the cursor’s position in the highly actionable
interface into account to provide context-sensitive behavior.

With Magit you can do nearly everything that you can do when using Git
on the command-line, but at greater speed and while taking advantage
of advanced features that previously seemed too daunting to use on a
daily basis.  Many users will find that by using Magit they can become
more effective Git user.
")
  (license #f))
--8<---------------cut here---------------end--------------->8---

However, looking at (guix import elpa), it has a ‘melpa-recipe->origin’
procedure, which calls the ‘git-repository->origin’ procedure, which
returns an origin that uses ‘git-fetch’.

#+begin_src scheme
(define (git-repository->origin recipe url)
  "Fetch origin details from the Git repository at URL for the provided MELPA
RECIPE."
  (define ref
    (cond
     ((assoc-ref recipe #:branch)
      => (lambda (branch) (cons 'branch branch)))
     ((assoc-ref recipe #:commit)
      => (lambda (commit) (cons 'commit commit)))
     (else
      '(branch . "master"))))

  (let-values (((directory commit) (download-git-repository url ref)))
    `(origin
       (method git-fetch)
       (uri (git-reference
             (url ,url)
             (commit ,commit)))
       (sha256
        (base32
         ,(bytevector->nix-base32-string
           (file-hash directory (negate vcs-file?) #t)))))))

(define* (melpa-recipe->origin recipe)
  "Fetch origin details from the MELPA recipe and associated repository for
the package named PACKAGE-NAME."
  (define (github-repo->url repo)
    (string-append "https://github.com/"; repo ".git"))
  (define (gitlab-repo->url repo)
    (string-append "https://gitlab.com/"; repo ".git"))

  (match (assq-ref recipe ':fetcher)
    ('github (git-repository->origin recipe (github-repo->url (assq-ref recipe 
':repo))))
    ('gitlab (git-repository->origin recipe (gitlab-repo->url (assq-ref recipe 
':repo))))
    ('git    (git-repository->origin recipe (assq-ref recipe ':url)))
    (#f #f)   ; if we're not using melpa then this stops us printing a warning
    (_ (warning (G_ "Unsupported MELPA fetcher: ~a, falling back to unstable 
MELPA source.~%")
                (assq-ref recipe ':fetcher))
       #f)))
#+end_src

‘melpa-recipe->origin’ is used in the ‘elpa-package->sexp’ procedure,
and takes precedence over the ‘url-fetch’ origin.  Meaning that
‘melpa-source’ must have been #f, otherwise it shouldn’t have used
’url-fetch’.

#+begin_src scheme
(define melpa-source
  (melpa-recipe->origin melpa-recipe))

(values
 `(package
   (name ,(elpa-name->package-name name))
   (version ,version)
   (source ,(or melpa-source  ;here
                (let ((tarball (with-store store
                                           (download-to-store store 
source-url))))
                  `(origin
                    (method url-fetch)
                    (uri (string-append ,@(factorize-uri source-url version)))
                    (sha256
                     (base32
                      ,(if tarball
                           (bytevector->nix-base32-string (file-sha256 tarball))
                         "failed to download package")))))))
   ...))
#+end_src

What’s weird is that calling ‘elpa->guix-package’ in the REPL generates
a package definition that uses ’git-fetch’ instead of ’url-fetch’

--8<---------------cut here---------------start------------->8---
scheme@(guile-user)> ,use(guix import elpa)
scheme@(guile-user)> (elpa->guix-package "magit" #:repo 'melpa)
$2 = (package (name "emacs-magit") (version "20210609.2000") (source (origin 
(method git-fetch) (uri (git-reference (url 
"https://github.com/magit/magit.git";) (commit 
"71f57c5582448be81b02ba53750dd2ea39ed0eaf"))) (sha256 (base32 
"16ip50a46nk6xxj8qkpf6rmp28zjc1bhyjj9bfgibim8ywj87dlq")))) (build-system 
emacs-build-system) (propagated-inputs (quasiquote (("emacs-dash" (unquote 
emacs-dash)) ("emacs-git-commit" (unquote emacs-git-commit)) 
("emacs-magit-section" (unquote emacs-magit-section)) ("emacs-transient" 
(unquote emacs-transient)) ("emacs-with-editor" (unquote emacs-with-editor))))) 
(arguments (quote (#:include (quote ("^lisp/magit$" "^lisp/magit[^/]+.el$" 
"^lisp/git-rebase.el$" "^Documentation/magit.texi$" 
"^Documentation/AUTHORS.md$" "^LICENSE$")) #:exclude (quote 
("^lisp/magit-libgit.el$" "^lisp/magit-section.el$"))))) (home-page 
"https://github.com/magit/magit";) (synopsis "A Git porcelain inside Emacs.") 
(description "Magit is a text-based Git user interface that puts an unmatched 
focus\non streamlining workflows.  Commands are invoked using short 
mnemonic\nkey sequences that take the cursor’s position in the highly 
actionable\ninterface into account to provide context-sensitive 
behavior.\n\nWith Magit you can do nearly everything that you can do when using 
Git\non the command-line, but at greater speed and while taking advantage\nof 
advanced features that previously seemed too daunting to use on a\ndaily basis. 
 Many users will find that by using Magit they can become\nmore effective Git 
user.\n") (license license:gpl3+))
$3 = ("dash" "git-commit" "magit-section" "transient" "with-editor")
--8<---------------cut here---------------end--------------->8---

signature.asc
Description: PGP signature