grafted package and CLI

[zimoun <zimon.toutoune@gmail.com>]

Hi,

Commit 3fc6709d4285f44d1e861c7b09951adf3073e898 is a security fixes for
the package ’curl’; it reads,

--8<---------------cut here---------------start------------->8---
(define-public curl
   (package
    (name "curl")
    (version "7.79.1")
+   (replacement curl-7.84.0)

[...]

+;; Replacement package with fixes for multiple vulnerabilities.
+;; See <https://curl.se/docs/security.html>.
+(define curl-7.84.0
+  (package
+    (inherit curl)
--8<---------------cut here---------------end--------------->8---

So far, so good!  Well, it leads to these behaviour:

        $ guix show curl | recsel -p name,version
        name: curl
        version: 7.79.1

        $ guix build curl -S
        /gnu/store/67w9zrlm1xahczf55f9rd15aaqadbixj-curl-7.84.0.tar.xz

Or even, it can be confusing:

        $ guix shell curl@7.79.1 -- curl --version
        curl 7.84.0 (x86_64-unknown-linux-gnu) libcurl/7.84.0 GnuTLS/3.7.2 zlib/1.2.11 libidn2/2.3.1 nghttp2/1.44.0
        Release-Date: 2022-06-27
        [..]

The issue is not new, e.g., see [1].  I proposed a patch [2] (see below)
which addresses the issue with “guix show”.

However, it does not address issue with “guix package -A | grep ^curl”;
and it is potentially not fixable because it uses
’fold-available-packages’ which loads the cache (for performance) and
this cache does not contain the ’replacement’ field – it is not a good
idea to introduce it, IMHO.

About “guix shell”, a warning could be added.

Well, WDYT?


Cheers,
simon


--8<---------------cut here---------------start------------->8---
diff --git a/guix/ui.scm b/guix/ui.scm
index 7fbd4c63a2..b6497f5e5c 100644
--- a/guix/ui.scm
+++ b/guix/ui.scm
@@ -1528,9 +1528,18 @@ HYPERLINKS? is true, emit hyperlink escape sequences when appropriate."
   (define (package<? p1 p2)
     (string<? (package-full-name p1) (package-full-name p2)))

+  (define replacement
+    (package-replacement p))
+
   ;; Note: Don't i18n field names so that people can post-process it.
   (format port "name: ~a~%" (package-name p))
   (format port "version: ~a~%" (package-version p))
+  (when replacement
+    (unless
+     (string=?
+      (package-version p)
+      (package-version replacement))
+     (format port "replacement: ~a~%" (package-version replacement))))
   (format port "outputs: ~a~%" (string-join (package-outputs p)))
   (format port "systems: ~a~%"
           (string-join (package-transitive-supported-systems p)))
--8<---------------cut here---------------end--------------->8---

1: <https://yhetil.org/guix/871rc5jv1o.fsf@netris.org>
2: <https://yhetil.org/guix/86im5a6ea4.fsf@gmail.com>