gnu: mercurial: Add package and rename former to mercurial/pinned.

Mercurial currently has CVEs. IMHO, it's unsafe to carry them around
in a profile.  However, updating mercurial potential leads to a lot of
rebuilds and I don't want to tackle this right now.

As for other packages, the way forward is to add a variant of the
package only used for hg-fetch, here mercurial/pinned.

* gnu/packages/version-control.scm
(mercurial-check-phase): Add helper variable.
(mercurial): Update to 7.1.
[arguments]: Use gexps.
<#:phases>: Refresh them. Add phase 'add-install-to-pythonpath for
running tests. Run tests after install. Add phase 'configure-check.
<#:imported-modules, #:modules>: Add them for
'add-install-for-pythonpath.k
[native-inputs]: Remove python-nose. Add python-setuptools-next,
python-setuptools-scm-next.
(mercurial/pinned): Inherit from mercurial, but build the exact same
derivation as the previous mercurial variable.

* guix/hg-download.scm (hg-package): Use mercurial/pinned.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>

gnu/packages/version-control.scm

@@ -2725,34 +2725,12 @@ execution of any hook written in any language before every commit.")
 (define-public python-pre-commit
   (deprecated-package "python-pre-commit" pre-commit))
 
-(define-public mercurial
+;; XXX: This is a temporary helper to avoid recompiling mercurial/pinned.
-  (package
+;; If you update mercurial, don't touch it but work around it.
-    (name "mercurial")
+;; If you update mercurial/pinned, include that in mercurial, and use inheritance
-    (version "6.9.5")
+;; for mercurial/pinned.
-    (source (origin
+(define mercurial-check-phase
-             (method url-fetch)
+  #~(lambda* (#:key tests? #:allow-other-keys)
-             (uri (string-append "https://www.mercurial-scm.org/"
-                                 "release/mercurial-" version ".tar.gz"))
-             (patches (search-patches "mercurial-hg-extension-path.patch"))
-             (sha256
-              (base32
-               "1zb5rjqs5z0y900hml0v4wsmv59cdhi50a8kcbjxdp79z7p2mwnk"))))
-    (build-system gnu-build-system)
-    (arguments
-     `(#:make-flags
-       (list (string-append "PREFIX=" (assoc-ref %outputs "out")))
-       #:phases
-       (modify-phases %standard-phases
-         (delete 'configure)
-         (add-after 'unpack 'patch-tests
-           (lambda _
-             (substitute* (find-files "tests" "\\.(t|py)$")
-               (("/bin/sh")
-                (which "sh"))
-               (("/usr/bin/env")
-                (which "env")))))
-         (replace 'check
-           (lambda* (#:key tests? #:allow-other-keys)
       (with-directory-excursion "tests"
         ;; The following tests are known to fail.
         (for-each delete-file
@@ -2815,11 +2793,58 @@ execution of any hook written in any language before every commit.")
                   "--slowtimeout" "86400"
                   ;; The test suite takes a long time and produces little
                   ;; output by default.  Prevent timeouts due to silence.
-                         "-v"))))))))
+                  "-v")))))
+
+(define-public mercurial
+  (package
+    (name "mercurial")
+    (version "7.1")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://www.mercurial-scm.org/"
+                           "release/mercurial-" version ".tar.gz"))
+       (patches (search-patches "mercurial-hg-extension-path.patch"))
+       (sha256
+        (base32 "1jz54akdnsp5frlbsr2xg71kbp2919v61gkkx7c7bi1q7k421ng8"))))
+    (build-system gnu-build-system)
+    (arguments
+     (list
+      #:imported-modules `((guix build python-build-system)
+                           ,@%default-gnu-imported-modules)
+      #:modules '((guix build gnu-build-system)
+                  ((guix build python-build-system) #:prefix py:)
+                  (guix build utils))
+      #:make-flags
+      #~(list (string-append "PREFIX=" #$output))
+      #:phases
+      #~(modify-phases %standard-phases
+          (delete 'configure)
+          (add-after 'unpack 'patch-tests
+            (lambda* (#:key inputs #:allow-other-keys)
+              (substitute* (find-files "tests" "\\.(t|py)$")
+                (("/bin/sh")
+                 (search-input-file inputs "bin/sh"))
+                (("/usr/bin/env")
+                 (search-input-file inputs "bin/env")))))
+          (add-before 'check 'configure-check
+            (lambda* (#:key tests? #:allow-other-keys)
+              (with-directory-excursion "tests"
+                (substitute* "run-tests.py"
+                  ;; XXX: Adapt pip call to build daemon chroot.
+                  (("b\"install\", b\"\\.\"")
+                   "b\"install\", b\"--no-build-isolation\", b\".\"")
+                  ;; XXX: Log the actual PYTHONPATH.
+                  (("\"PYTHONPATH\"")
+                   "\"GUIX_PYTHONPATH\"")))))
+          (add-before 'configure-check 'add-install-to-pythonpath
+            (assoc-ref py:%standard-phases 'add-install-to-pythonpath))
+          (delete 'check)
+          (add-after 'install 'check #$mercurial-check-phase))))
     (native-inputs
      (list python-docutils
            ;; The following inputs are only needed to run the tests.
-           python-nose unzip which))
+           python-setuptools-next python-setuptools-scm-next python-wheel unzip which))
     (inputs
      (list python-wrapper))
     ;; Find third-party extensions.
@@ -2835,6 +2860,38 @@ efficiently handles projects of any size and offers an easy and intuitive
 interface.")
     (license license:gpl2+)))
 
+(define-public mercurial/pinned
+  (package
+    (inherit mercurial)
+    (version "6.9.5")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://www.mercurial-scm.org/"
+                           "release/mercurial-" version ".tar.gz"))
+       (patches (search-patches "mercurial-hg-extension-path.patch"))
+       (sha256
+        (base32 "1zb5rjqs5z0y900hml0v4wsmv59cdhi50a8kcbjxdp79z7p2mwnk"))))
+    (arguments
+     (list
+      #:make-flags
+      #~(list (string-append "PREFIX=" (assoc-ref %outputs "out")))
+      #:phases
+      #~(modify-phases %standard-phases
+          (delete 'configure)
+          (add-after 'unpack 'patch-tests
+            (lambda _
+              (substitute* (find-files "tests" "\\.(t|py)$")
+                (("/bin/sh")
+                 (which "sh"))
+                (("/usr/bin/env")
+                 (which "env")))))
+          (replace 'check #$mercurial-check-phase))))
+    (native-inputs
+     (list python-docutils
+           ;; The following inputs are only needed to run the tests.
+           python-nose unzip which))))
+
 (define-public python-hg-evolve
   (package
     (name "python-hg-evolve")

guix/hg-download.scm

@@ -57,7 +57,7 @@
 (define (hg-package)
   "Return the default Mercurial package."
   (let ((distro (resolve-interface '(gnu packages version-control))))
-    (module-ref distro 'mercurial)))
+    (module-ref distro 'mercurial/pinned)))
 
 (define (hg-fetch-builder hg hash-algo)
   (define inputs