substitute-binary: Be slightly less verbose when downloading.

* guix/scripts/substitute-binary.scm (guix-substitute-binary)<"--substitute">:
  Be slightly less verbose.

Break module cycle involving (guix store) and (guix ui).

Before, there was a cycle along the lines of:

  (guix store) -> (guix nar) -> (guix ui) -> (guix store)

This caused problems, as discussed at:

  http://lists.gnu.org/archive/html/guix-devel/2014-10/msg00109.html

This patch removes cycles in the (guix ...) modules.

* guix/nar.scm (&nar-error, &nar-read-error, dump, write-contents,
  read-contents, %archive-version-1, write-file, restore-file): Move to...
* guix/serialization.scm: ... here.
* guix/store.scm: Remove dependency on (guix nar).
* guix/scripts/hash.scm, guix/scripts/offload.scm,
  guix/scripts/substitute-binary.scm, tests/nar.scm, tests/store.scm,
  tests/substitute-binary.scm: Adjust accordingly.

substitute-binary: Ignore $GUIX_BINARY_SUBSTITUTE_URL.

* guix/scripts/substitute-binary.scm (%cache-url): Ignore the
  'GUIX_BINARY_SUBSTITUTE_URL' environment variable.
* test-env.in: Invoke 'guix-daemon' with '--substitute-urls'.
* tests/substitute-binary.scm: Set '%cache-url' to the value of
  'GUIX_BINARY_SUBSTITUTE_URL'.

daemon: Add '--substitute-urls' option.

* nix/nix-daemon/guix-daemon.cc (GUIX_OPT_SUBSTITUTE_URLS): New macro.
  (GUIX_OPT_NO_BUILD_HOOK, GUIX_OPT_GC_KEEP_OUTPUTS,
  GUIX_OPT_GC_KEEP_DERIVATIONS): Renumber.
  (options): Add '--substitute-urls'.
  (parse_opt): Honor it.
  (main): Add 'settings.set' call for the default "substitute-urls"
  value.
* guix/scripts/substitute-binary.scm (daemon-options,
  find-daemon-option): New procedures.
  (%cache-url): Define based on the "substitute-urls" daemon option.
* doc/guix.texi (Invoking guix-daemon): Document '--substitute-urls'.
  (Substitutes): Mention it.

Merge branch 'core-updates'

substitute-binary: Warn about uninitialized ACL.

* guix/scripts/substitute-binary.scm (guix-substitute-binary): Call
  'check-acl-initialized'.
  (check-acl-initialized): Don't rely on 'equal?' to compare keys.
  Instead, convert keys to strings.

substitute-binary: Avoid the term "narinfo" in user messages.

* guix/scripts/substitute-binary.scm (assert-valid-narinfo): Change
  message to avoid the term "narinfo".

Merge branch 'master' into core-updates

pk-crypto: Add pretty-printer to 'gcry-error' exceptions.

* guix/pk-crypto.scm (string->canonical-sexp, sign, generate-key): Pass
  the procedure name as the first argument to 'throw'.
  (gcrypt-error-printer): New procedure.
  <top level>: Add call to 'set-exception-printer!'.
* guix/nar.scm (restore-one-item): Add 'proc' parameter to 'catch'
  handler for 'gcry-error.
* guix/scripts/archive.scm (%options, generate-key-pair, authorize-key):
  Likewise.
* guix/scripts/substitute-binary.scm (narinfo-signature->canonical-sexp):
  Likewise.

substitute-binary: Avoid consing 'regexp-exec' arguments.

* guix/scripts/substitute-binary.scm (regexp-exec): Change formals
  to (rx str . rest).

substitute-binary: Avoid reloading the ACL repeatedly.

* guix/scripts/substitute-binary.scm (guix-substitute-binary) <--query>:
  Cache the result of (current-acl); pass it to 'valid-narinfo?' calls.
  This saves 12% wall-clock time for "guix build emacs -n".

Use 'signature-case' in (guix nar) and 'substitute-binary'.

* guix/nar.scm (restore-file-set)[assert-valid-signature]: Rewrite in
  terms of 'signature-case'.
* guix/scripts/substitute-binary.scm (narinfo-signature->canonical-sexp):
  Call 'leave' instead of 'raise' when SIGNATURE is invalid.
  (&nar-signature-error, &nar-invalid-hash-error): Remove.
  (assert-valid-signature): Add 'narinfo' parameter; remove 'port'.
  Rewrite in terms of 'signature-case' and 'leave'.  Mention NARINFO's
  URI in error messages.  Adjust caller.
  (narinfo-sha256): New procedure.
  (assert-valid-narinfo): Use it.
  (valid-narinfo?): Rewrite using 'narinfo-sha256' and
  'signature-case'.
* tests/substitute-binary.scm (assert-valid-signature,
  test-error-condition): Remove.
  ("corrupt signature data", "unauthorized public key", "invalid
  signature"): Remove.

substitute-binary: Notify of valid signatures.

* guix/scripts/substitute-binary.scm (assert-valid-narinfo): Add
  #:verbose? parameter; when true, write "found valid signature".
  (valid-narinfo?): Pass #:verbose? #f.

substitute-binary: Defer narinfo authentication and authorization checks.

* guix/scripts/substitute-binary.scm (narinfo-signature->canonical-sexp):
  Catch 'gcry-error' around 'string->canonical-sexp' call, and re-raise
  as a SRFI-35 &message and &nar-signature-error.
  (narinfo-maker): Handle when SIGNATURE is #f or an invalid canonical
  sexp.
  (&nar-signature-error, &nar-invalid-hash-error): New variables.
  (assert-valid-signature): Use them.  Expect 'signature' to be a
  canonical sexp.
  (read-narinfo): Remove authentication and authorization checks.
  (%signature-line-rx): New variable.
  (assert-valid-narinfo, valid-narinfo?): New procedures.
  (guix-substitute-binary): Wrap body in 'with-error-handling'.
  [valid?]: New procedure.
  <--query>: Show only store items of narinfos that match
  'valid-narinfo?'.
  <--substitute>: Call 'assert-valid-narinfo'.
* tests/substitute-binary.scm (test-error*): Use 'test-equal'.
  (%keypair): Remove.
  (%public-key, %private-key): Load from signing-key.{pub,sec}.
  (signature-body): Add #:public-key parameter.
  (call-with-narinfo): New procedure.
  (with-narinfo): New macro.
  ("corrupt signature data", "unauthorized public key", "invalid
  signature"): Make the first argument to 'assert-valid-signature' a
  canonical sexp.
  ("invalid hash", "valid read-narinfo", "valid write-narinfo"):
  Remove.
  ("query narinfo with invalid hash", "query narinfo signed with
  authorized key", "query narinfo signed with unauthorized key",
  "substitute, invalid hash", "substitute, unauthorized key"): New
  tests.

substitute-binary: Store the cache's URI in the local cached narinfo.

* guix/scripts/substitute-binary.scm (<narinfo>)[uri-base]: New field.
  (narinfo-maker): Pass CACHE-URL as the 'uri-base' value.
  (string->narinfo): Add 'cache-uri' parameter.
  (lookup-narinfo)[cache-entry]: Switch to version 1.  Add 'cache-uri'
  field.  Adjust body accordingly.
  (remove-expired-cached-narinfos): Switch to version 1 by default.

substitute-binary: Support the Signature field of a narinfo file.

* guix/scripts/substitute-binary.scm (<narinfo>): Add the 'signature'
  and 'contents' fields.
  (narinfo-signature->canonical-sexp): New function.
  (narinfo-maker): Add the 'signature' argument and use it.
  (assert-valid-signature): New function.
  (read-narinfo): Support the Signature field.
  (write-narinfo): Use 'narinfo-contents'.
  (%allow-unauthenticated-substitutes?): New variable.
* guix/base64.scm, tests/base64.scm, tests/substitute-binary.scm: New files.
* Makefile.am (SCM_TESTS): Add tests/base64.scm and
  tests/substitute-binary.scm.
  (MODULES): Add guix/base64.scm.
* test-env.in: Set 'GUIX_ALLOW_UNAUTHENTICATED_SUBSTITUTES'.

utils: Add 'decompressed-port' and 'compressed-port'.

* guix/utils.scm (decompressed-port, compressed-port): New procedures.
* guix/scripts/substitute-binary.scm (decompressed-port): Remove.
  (guix-substitute-binary): Pass a symbol or #f as the first argument to
  'decompress-port'.
* tests/utils.scm ("compressed-port, decompressed-port, non-file"): New
  test.

Merge branch 'master' into core-updates

substitute-binary: Quietly handle 404s when fetching narinfos.

* guix/scripts/substitute-binary.scm (fetch): Add #:quiet-404?
  parameter.  Upon &http-get-error, re-raise C if the QUIET-404? is
  true and the code is 404.
  (fetch-narinfo): Pass #:quiet-404? #t.

Merge branch 'master' into core-updates