bug#22693: `guix refresh -u` updates other packages with same version

[iyzsong@member.fsf.org (宋文武)]

Leo Famulari <leo@famulari.name> writes:

> I've noticed that `guix refresh -u` will update extraneous packages if
> they happen to have the same version and be in the same module.
>
> For example, from commit d694230ab, you can reproduce the bug:
>
> $ ./pre-inst-env guix environment guix -- ./pre-inst-env guix refresh -u python-pytest
> $ git diff
> diff --git a/gnu/packages/python.scm b/gnu/packages/python.scm
> index 3dd3862..ae14404 100644
> --- a/gnu/packages/python.scm
> +++ b/gnu/packages/python.scm
> @@ -796,7 +796,7 @@ Python 3 support.")
>  (define-public python-pycrypto
>    (package
>      (name "python-pycrypto")
> -    (version "2.6.1")
> +    (version "2.8.7")
>      (source
>       (origin
>        (method url-fetch)
> @@ -1565,7 +1565,7 @@ code introspection, and logging.")
>  (define-public python-pytest
>    (package
>      (name "python-pytest")
> -    (version "2.6.1")
> +    (version "2.8.7")
>      (source
>       (origin
>         (method url-fetch)
> @@ -1574,7 +1574,7 @@ code introspection, and logging.")
>               version ".tar.gz"))
>         (sha256
>          (base32
> -         "0g2w4p0n42wvz8rq4k6gnzpkakgz3g8sfanxk8jrsra9675snkcr"))
> +         "1bwb06g64x2gky8x5hcrfpg6r351xwvafimnhm5qxq7wajz8ck7w"))
>         (modules '((guix build utils)))
>         (snippet
>          ;; One of the tests involves the /usr directory, so it fails.
How to fix this?

The procedure is ‘update-package-source’ in (guix upstream).
it find the file, then use ‘substitute’ to replace the version and
hash.  ‘substitute’ works line-by-line, it can’t match mutiple lines.

I try:
 - use ‘package-location’ and ‘read’ to get the package object,
   but it lost all format and comments.
 - use ‘string-match’, but I have no idea how to match the whole
   package sexp.