gexp: Add #:disallowed-references.

* guix/gexp.scm (gexp->derivation): Add #:disallowed-references and
honor it.
* tests/gexp.scm ("gexp->derivation #:disallowed-references, allowed")
("gexp->derivation #:disallowed-references"): New tests.
* doc/guix.texi (G-Expressions): Adjust accordingly.

derivations: Add #:disallowed-references.

* guix/derivations.scm (derivation): Add #:disallowed-references.
[user+system-env-vars]: Honor it.
(build-expression->derivation): Likewise.
* tests/derivations.scm ("derivation #:disallowed-references, ok")
("derivation #:disallowed-references, not ok"): New tests.
* doc/guix.texi (Derivations): Adjust accordingly.

build: Protect against misconfiguration of localstatedir.

Suggested by Jookia <166291@gmail.com>.

* m4/guix.m4 (GUIX_CURRENT_LOCALSTATEDIR, GUIX_CHECK_LOCALSTATEDIR): New
macros.
* config-daemon.ac: Use 'GUIX_CHECK_LOCALSTATEDIR'.
* Makefile.am (DISTCHECK_CONFIGURE_FLAGS): Add --localstatedir.
* doc/guix.texi (Requirements): Mention --localstatedir.
(The Store): Mention LOCALSTATEDIR as such.

doc: Add missing comma after @xref.

Reported by Alex Kost <alezost@gmail.com>.

* doc/guix.texi (Service Reference): Add comma after @xref.

doc: GNOME is now available.

* doc/guix.texi (Limitations): Rephrase item about GNOME and KDE.

substitute: Honor client-provided empty URL list.

Before that, 'guix build --substitute-urls=""' would lead to using the
daemon's own URL list instead of the empty list.  The 'or*' hack, which
is to blame, had become unnecessary since commit
fb4bf72be3fbc23bca35ba4b842b7e1517ef0e3a.

Reported by Mark H Weaver <mhw@netris.org>.

* guix/scripts/substitute.scm (or*): Remove.
(%cache-urls): Use 'or' instead of 'or*'.
* tests/store.scm ("substitute query, alternating URLs"): Add test with
empty URL list.
* doc/guix.texi (Common Build Options): Mention the empty string.

build: Default to "https://mirror.hydra.gnu.org/" for substitutes.

* config-daemon.ac: Check for (gnutls) and define 'GUIX_SUBSTITUTE_URLS'.
* nix/nix-daemon/guix-daemon.cc (main): Use GUIX_SUBSTITUTE_URLS.
* guix/store.scm (%default-substitute-urls): Use 'https' when (gnutls)
is available.
* doc/guix.texi (Binary Installation): Mention mirrors
(Invoking guix-daemon): Mention mirror.hydra.gnu.org.
(Substitutes): Mention mirrors.
(Invoking guix archive): Show https URLs.

gnu: services: Add GNOME and XFCE desktop services.

* gnu/services/desktop.scm (package-direct-input-selector): New
  function.
  (<gnome-desktop-configuration>, gnome-desktop-service-type)
  (<xfce-desktop-configuration>, xfce-desktop-service-type): New
  variables.
  (gnome-desktop-service, xfce-desktop-service): New public variables.

* doc/guix.texi (Desktop Services): Document new variables.

doc: Clarify and consolidate modify-services documentation.

* doc/guix.texi ("Using the Configuration System"): Move the example...
("Service Reference"): ...to here, and clarify more.
* gnu/services.scm (modify-services): Update docstring to mention the
return type.

Co-authored-by: Ludovic Courtès <ludo@gnu.org>

doc: Add "Hardware Considerations" node.

Suggested by Nils Gillmann <niasterisk@grrlz.net>.

* doc/guix.texi (Hardware Considerations): New node.
(operating-system Reference): Mention it.

doc: Fix incorrect use of @xref.

This is a follow-up to commit 1068f26b797ed7c1475d93cab6eed53c9097c7f6.
Reported by Alex Kost <alezost@gmail.com>.

* doc/guix.texi (Building the Installation Image): Replace @xref by @ref.

build: Add Ant build system.

* guix/build-system/ant.scm: New file.
* guix/build/ant-build-system: New file.
* Makefile.am (MODULES): Add new files.
* doc/guix.texi (Build Systems): Document ant-build-system.

doc: Suggest `guix.scm' for upstream maintainers.

* doc/guix.texi (Invoking guix package): Suggest `guix.scm'.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>

substitute: Add HTTPS support.

Fixes <http://bugs.gnu.org/22937>.
Reported by Chris Marusich <cmmarusich@gmail.com>.

* guix/scripts/substitute.scm (fetch): Add 'https' alongside 'http'.
Use 'open-connection-for-uri' instead of 'open-socket-for-uri'.  Call
'setvbuf' only when PORT matches 'file-port?'.
(http-multiple-get): Likewise.  Change 'base-url' parameter to
'base-uri'.
(fetch-narinfos)[do-fetch]: Add 'https' case alongside 'http'.  Pass URI
instead of URL to 'http-multiple-get'.
* doc/guix.texi (Requirements): Move GnuTLS one level higher and mention
HTTPS substitutes.
(Substitutes): Mention HTTPS and recommend it.  Explain why servers
are not authenticated.  Add "On Trusting Binaries" subsection.

doc: Add note on store immutability.

* doc/guix.texi (The Store): Mention "store items" and the database
location.  Add note on the store's immutability.

guix build: Add '--quiet'.

Fixes <http://bugs.gnu.org/19772>.
Reported by Andrei Osipov <andrspv@gmail.com>.

* guix/scripts/build.scm (show-help, %options): Add --quiet.
(guix-build): Parameterize 'current-build-output-port' accordingly.
* doc/guix.texi (Invoking guix build): Use it in example.
(Additional Build Options): Document it.

doc: Explain how to check whether security updates are used.

Based on
<https://lists.gnu.org/archive/html/guix-devel/2016-03/msg00009.html>.

* doc/guix.texi (Security Updates): Explain how to check whether we're
using a grafted version.

doc: Typos and small stylistic changes.

* guix.texi: Correct typos and make minor changes.

doc: Mention syslogd configuration.

* gnu/services/base.scm (syslog-service): Add xref to Inetutils in the
docstring.
(%default-syslog.conf): Export.
* doc/guix.texi (Base Services): Update accordingly.

doc: Improve Info categories.

* doc/guix.texi: Change main category to "System administration".  Fix
syntax of subnodes.  Add entries for 'guix pull' and 'guix gc'.  Add
"Emacs" category.