transformations: Add #:authenticate? to ‘package-with-upstream-version’.

* guix/transformations.scm (upstream-source-without-signatures): New
procedures.
(package-with-upstream-version): Add #:authenticate? and honor it.

Change-Id: Ib86feb765f57bc1b129e813780abc605c43ed97b

guix/transformations.scm

@@ -31,7 +31,8 @@
   #:autoload   (guix download) (download-to-store)
   #:autoload   (guix git-download) (git-reference? git-reference-url)
   #:autoload   (guix git) (git-checkout git-checkout? git-checkout-url)
-  #:autoload   (guix upstream) (package-latest-release
+  #:autoload   (guix upstream) (upstream-source
+                                package-latest-release
                                 upstream-source-version
                                 upstream-source-signature-urls)
   #:autoload   (guix cpu) (current-cpu
@@ -856,13 +857,24 @@ additional patches."
   "This origin method simply downloads SOURCE, an <upstream-source> record."
   (lower-object source system))
 
+(define (upstream-source-without-signatures source)
+  "Return SOURCE with #f as its 'signature-urls' field."
+  (upstream-source (inherit source)
+                   (signature-urls #f)))
+
 (define* (package-with-upstream-version p #:optional version
-                                        #:key (preserve-patches? #f))
+                                        #:key
+                                        (preserve-patches? #f)
+                                        (authenticate? #t))
   "Return package P changed to use the given upstream VERSION or, if VERSION
 is #f, the latest known upstream version.  When PRESERVE-PATCHES? is true,
 preserve patches and snippets found in the source of P, provided it's an
-origin."
-  (let ((source (package-latest-release p #:version version)))
+origin.  When AUTHENTICATE? is false, disable OpenPGP signature verification
+of upstream source code."
+  (let ((source (and=> (package-latest-release p #:version version)
+                       (if authenticate?
+                           identity
+                           upstream-source-without-signatures))))
     (cond ((not source)
            (if version
                (warning