bug#68822: Channel dependencies picked at the wrong commit

["Ludovic Courtès" <ludovic.courtes@inria.fr>]

When a channel is specified both implicitly, as the dependency of
another channel, and explicitly, in the user-provided channels file, the
“most specific” one wins—the one that has a non-#f ‘commit’ field.

However, the dependencies of that channel may be read from the wrong
one—the least-specific one.  And they can be wrong.

Here’s an example that illustrates this corner case with ‘guix
time-machine’ taken from current Guix
(ca. 65dc2d40cb113382fb98796f1d04099f28cab355).

--8<---------------cut here---------------start------------->8---
$ guix time-machine -C channels.pinned.scm -- describe
Updating channel 'guix' from Git repository at 'https://git.savannah.gnu.org/git/guix.git'...
Updating channel 'guix-hpc-non-free' from Git repository at 'https://gitlab.inria.fr/guix-hpc/guix-hpc-non-free.git'...
Updating channel 'guix-hpc' from Git repository at 'https://gitlab.inria.fr/guix-hpc/guix-hpc.git'...
Updating channel 'guix-science-nonfree' from Git repository at 'https://github.com/guix-science/guix-science-nonfree.git'...
Updating channel 'guix-science' from Git repository at 'https://github.com/guix-science/guix-science.git'...
Updating channel 'guix-past' from Git repository at 'https://gitlab.inria.fr/guix-hpc/guix-past'...
Updating channel 'guix-science-nonfree' from Git repository at 'https://github.com/guix-science/guix-science-nonfree.git'...
Updating channel 'guix-past' from Git repository at 'https://gitlab.inria.fr/guix-hpc/guix-past'...
Updating channel 'guix-hpc' from Git repository at 'https://gitlab.inria.fr/guix-hpc/guix-hpc.git'...
Computing Guix derivation for 'x86_64-linux'... /
substitute: updating substitutes from 'https://ci.guix.gnu.org'... 100.0%
substitute: updating substitutes from 'https://bordeaux.guix.gnu.org'... 100.0%
substitute: updating substitutes from 'https://guix.bordeaux.inria.fr'... 100.0%
The following derivations will be built:
  /gnu/store/m54f7d5prrnilnlkp6iqr9h0wqb70pk2-profile.drv
  /gnu/store/4bkkgq25zgc93iz8d1rzjf63y394ya9d-guix-science-nonfree.drv
  /gnu/store/cnqz5j3mp0qahwvlhv0ykq5bc3m5knnx-inferior-script.scm.drv
  /gnu/store/5agf7bgp7k4sddi5ll6g972cyv5jaksq-module-import-compiled.drv
  /gnu/store/8aql4dp23w2k4dvz26dbkxxix6l2rx7v-guix-past.drv
  /gnu/store/zzb5g3lfvmhmbw9vf6zzz1pdjmy5zikl-inferior-script.scm.drv
  /gnu/store/w8ga4919913v1s3flg21pij60hwsndg4-guix-hpc-non-free.drv
  /gnu/store/lj20q8hc772fm9kh148lxi0zxdral7bv-inferior-script.scm.drv
  /gnu/store/lvmnbdl4d008dyjdf8i4dbzrd5lvbn2m-module-import-compiled.drv
  /gnu/store/yykh03drscwzra0fjnc0657c3fhjn7bh-guix-science.drv
  /gnu/store/7s850hb4zv0wn9hclpsq3gykmxmcrcbc-profile.drv
  /gnu/store/as87m36426pk6bfx7f2aix4kdsk1ials-inferior-script.scm.drv

builder for `/gnu/store/pjrgzdpndm31m0kg6jgrlmkzxnbhp0pz-guix-science' failed previously (cached)
build of /gnu/store/yykh03drscwzra0fjnc0657c3fhjn7bh-guix-science.drv failed
View build log at '/var/log/guix/drvs/yy/kh03drscwzra0fjnc0657c3fhjn7bh-guix-science.drv.gz'.
$ cat channels.pinned.scm
(list (channel
        (name 'guix)
        (url "https://git.savannah.gnu.org/git/guix.git")
        (branch "master")
        (commit
          "597f1cd1c46ffb92c3e0145de0071545a4c64865")
        (introduction
          (make-channel-introduction
            "9edb3f66fd807b096b48283debdcddccfea34bad"
            (openpgp-fingerprint
              "BBB0 2DDF 2CEA F6A8 0D1D  E643 A2A0 6DF2 A33A 54FA"))))
      (channel
        (name 'guix-hpc-non-free)
        (url "https://gitlab.inria.fr/guix-hpc/guix-hpc-non-free.git")
        (branch "master")
        (commit
          "372c5f471448b32c9204f79c1d46e9b984d03c07"))
      (channel
        (name 'guix-science-nonfree)
        (url "https://github.com/guix-science/guix-science-nonfree.git")
        (branch "master")
        (commit
          "9a3f3824d8ed289832d706679410edadac1202ae")
        (introduction
          (make-channel-introduction
            "58661b110325fd5d9b40e6f0177cc486a615817e"
            (openpgp-fingerprint
              "CA4F 8CF4 37D7 478F DA05  5FD4 4213 7701 1A37 8446"))))
      (channel
        (name 'guix-past)
        (url "https://gitlab.inria.fr/guix-hpc/guix-past")
        (branch "master")
        (commit
          "1e25b23faa6b1716deaf7e1782becb5da6855942")
        (introduction
          (make-channel-introduction
            "0c119db2ea86a389769f4d2b9c6f5c41c027e336"
            (openpgp-fingerprint
              "3CE4 6455 8A84 FDC6 9DB4  0CFB 090B 1199 3D9A EBB5"))))
      (channel
        (name 'guix-hpc)
        (url "https://gitlab.inria.fr/guix-hpc/guix-hpc.git")
        (branch "master")
        (commit
          "3ffe8f79a2f128111785fb1107d5f803e00bf00c")))
$ zcat /var/log/guix/drvs/yy/kh03drscwzra0fjnc0657c3fhjn7bh-guix-science.drv.gz
(repl-version 0 1 1)
WARNING: (guix-science build bazel-build-system): imported module (guix build utils) overrides core binding `delete'
(exception unbound-variable (value #f) (value "Unbound variable: ~S") (value (python-nr-stream)) (value #f))
--8<---------------cut here---------------end--------------->8---

The bug here is this: ‘guix-science-nonfree’ is pulling ‘guix-science’
as a dependency, even though it was not a dependency as of commit
9a3f3824d8ed289832d706679410edadac1202ae.

Interesting, no?

Ludo’.