2021-01-27 05:50:30 +00:00
|
|
|
{lib, stdenvNoCC, git, git-lfs, cacert}: let
|
2015-01-01 13:34:56 +00:00
|
|
|
urlToName = url: rev: let
|
2021-01-27 05:50:30 +00:00
|
|
|
inherit (lib) removeSuffix splitString last;
|
2017-06-18 11:42:39 +00:00
|
|
|
base = last (splitString ":" (baseNameOf (removeSuffix "/" url)));
|
2015-01-01 13:34:56 +00:00
|
|
|
|
2021-02-03 17:35:42 +00:00
|
|
|
matched = builtins.match "(.*)\\.git" base;
|
2015-01-01 13:34:56 +00:00
|
|
|
|
|
|
|
short = builtins.substring 0 7 rev;
|
|
|
|
|
2023-02-06 20:49:02 +00:00
|
|
|
appendShort = lib.optionalString ((builtins.match "[a-f0-9]*" rev) != null) "-${short}";
|
2015-01-01 13:34:56 +00:00
|
|
|
in "${if matched == null then base else builtins.head matched}${appendShort}";
|
2015-01-13 18:43:08 +00:00
|
|
|
in
|
2021-11-05 03:03:05 +00:00
|
|
|
{ url, rev ? "HEAD", md5 ? "", sha256 ? "", hash ? "", leaveDotGit ? deepClone
|
2015-03-10 11:40:19 +00:00
|
|
|
, fetchSubmodules ? true, deepClone ? false
|
2015-04-20 12:25:14 +00:00
|
|
|
, branchName ? null
|
2022-11-07 18:42:19 +00:00
|
|
|
, sparseCheckout ? []
|
2022-08-04 19:26:03 +00:00
|
|
|
, nonConeMode ? false
|
2015-01-01 13:34:56 +00:00
|
|
|
, name ? urlToName url rev
|
2017-06-03 18:45:51 +00:00
|
|
|
, # Shell code executed after the file has been fetched
|
|
|
|
# successfully. This can do things like check or transform the file.
|
|
|
|
postFetch ? ""
|
2018-12-31 07:10:28 +00:00
|
|
|
, preferLocalBuild ? true
|
2020-12-05 07:32:48 +00:00
|
|
|
, fetchLFS ? false
|
2021-09-15 14:17:05 +00:00
|
|
|
, # Shell code to build a netrc file for BASIC auth
|
|
|
|
netrcPhase ? null
|
|
|
|
, # Impure env vars (https://nixos.org/nix/manual/#sec-advanced-attributes)
|
|
|
|
# needed for netrcPhase
|
|
|
|
netrcImpureEnvVars ? []
|
2022-04-18 01:06:02 +00:00
|
|
|
, meta ? {}
|
fetchgit: allow passing allowedRequisites through to stdenv.mkDerivation
When maintainers override stages of `fetchgit' (e.g. `postPatch`) it
is very easy for them to accidentally leak the outpath-hash of their
current `stdenv` into `fetchgit''s output, and therefore into the
value they paste into `sha256`.
This is a problem, because the resulting expression will break
whenever any change is made to `stdenv` or when anybody attempts to
build the expression on a different platform than the one used by the
original maintainer.
Almost as much of a problem is the fact that CI **does not catch**
these problems. The `fetchgit` is run only once, then its output goes
into cachix, and all future builds (hydra, CI, ofborg) pull from
cachix.
Let's offer maintainers the option to check that they aren't making
this mistake, by passing through `allowedRequisites`. The default
value is `null`, but it might be worth changing that at some point in
the future.
It is also sometimes difficult to communicate to package maintainers
why their expression is problematic. Having `allowedRequisites`
passed through makes it easier to do this: "look, when I switch on
`allowedRequisites` your package breaks; are you sure you meant to
hardcode the hash today's `x86_64-linux.stdenv` into your expression?`
For an example use case, see https://github.com/NixOS/nixpkgs/pull/171223
The issue above is part of a larger problem with nixpkgs infra: there
large parts of cachix cannot be reproduced easily if they are lost.
Once something ends goes into cachix, we never ever again reverify the
procedure by which it was placed into cachix.
2022-05-02 09:51:11 +00:00
|
|
|
, allowedRequisites ? null
|
2014-09-03 17:48:15 +00:00
|
|
|
}:
|
2009-06-24 12:48:01 +00:00
|
|
|
|
2009-11-08 03:02:10 +00:00
|
|
|
/* NOTE:
|
|
|
|
fetchgit has one problem: git fetch only works for refs.
|
2022-08-03 12:07:34 +00:00
|
|
|
This is because fetching arbitrary (maybe dangling) commits creates garbage collection risks
|
2009-11-08 03:02:10 +00:00
|
|
|
and checking whether a commit belongs to a ref is expensive. This may
|
|
|
|
change in the future when some caching is added to git (?)
|
|
|
|
Usually refs are either tags (refs/tags/*) or branches (refs/heads/*)
|
|
|
|
Cloning branches will make the hash check fail when there is an update.
|
|
|
|
But not all patches we want can be accessed by tags.
|
|
|
|
|
2016-11-18 10:56:08 +00:00
|
|
|
The workaround is getting the last n commits so that it's likely that they
|
2009-11-08 03:02:10 +00:00
|
|
|
still contain the hash we want.
|
|
|
|
|
|
|
|
for now : increase depth iteratively (TODO)
|
|
|
|
|
|
|
|
real fix: ask git folks to add a
|
|
|
|
git fetch $HASH contained in $BRANCH
|
|
|
|
facility because checking that $HASH is contained in $BRANCH is less
|
|
|
|
expensive than fetching --depth $N.
|
|
|
|
Even if git folks implemented this feature soon it may take years until
|
|
|
|
server admins start using the new version?
|
|
|
|
*/
|
|
|
|
|
2015-03-10 11:40:19 +00:00
|
|
|
assert deepClone -> leaveDotGit;
|
2022-11-07 18:42:19 +00:00
|
|
|
assert nonConeMode -> !(sparseCheckout == "" || sparseCheckout == []);
|
2014-02-18 18:11:57 +00:00
|
|
|
|
2017-03-13 12:31:44 +00:00
|
|
|
if md5 != "" then
|
|
|
|
throw "fetchgit does not support md5 anymore, please use sha256"
|
2021-11-05 03:03:05 +00:00
|
|
|
else if hash != "" && sha256 != "" then
|
|
|
|
throw "Only one of sha256 or hash can be set"
|
2017-03-13 12:31:44 +00:00
|
|
|
else
|
2022-11-07 18:42:19 +00:00
|
|
|
# Added 2022-11-12
|
|
|
|
lib.warnIf (builtins.isString sparseCheckout)
|
|
|
|
"Please provide directories/patterns for sparse checkout as a list of strings. Support for passing a (multi-line) string is deprecated and will be removed in the next release."
|
2018-01-09 23:38:19 +00:00
|
|
|
stdenvNoCC.mkDerivation {
|
2014-09-03 17:48:15 +00:00
|
|
|
inherit name;
|
2009-06-24 12:48:01 +00:00
|
|
|
builder = ./builder.sh;
|
2019-09-08 23:38:31 +00:00
|
|
|
fetcher = ./nix-prefetch-git; # This must be a string to ensure it's called with bash.
|
2020-12-05 07:32:48 +00:00
|
|
|
|
|
|
|
nativeBuildInputs = [ git ]
|
2021-01-27 05:50:30 +00:00
|
|
|
++ lib.optionals fetchLFS [ git-lfs ];
|
2009-06-24 12:48:01 +00:00
|
|
|
|
2021-11-05 03:03:05 +00:00
|
|
|
outputHashAlgo = if hash != "" then null else "sha256";
|
2009-06-24 12:48:01 +00:00
|
|
|
outputHashMode = "recursive";
|
2021-11-05 03:03:05 +00:00
|
|
|
outputHash = if hash != "" then
|
|
|
|
hash
|
|
|
|
else if sha256 != "" then
|
|
|
|
sha256
|
|
|
|
else
|
|
|
|
lib.fakeSha256;
|
2009-06-24 12:48:01 +00:00
|
|
|
|
2022-11-07 18:42:19 +00:00
|
|
|
# git-sparse-checkout(1) says:
|
|
|
|
# > When the --stdin option is provided, the directories or patterns are read
|
|
|
|
# > from standard in as a newline-delimited list instead of from the arguments.
|
|
|
|
sparseCheckout = if builtins.isString sparseCheckout then sparseCheckout else builtins.concatStringsSep "\n" sparseCheckout;
|
|
|
|
|
|
|
|
inherit url rev leaveDotGit fetchLFS fetchSubmodules deepClone branchName nonConeMode postFetch;
|
2009-06-24 12:48:01 +00:00
|
|
|
|
2021-09-15 14:17:05 +00:00
|
|
|
postHook = if netrcPhase == null then null else ''
|
|
|
|
${netrcPhase}
|
|
|
|
# required that git uses the netrc file
|
|
|
|
mv {,.}netrc
|
|
|
|
export HOME=$PWD
|
|
|
|
'';
|
|
|
|
|
2015-06-05 20:00:52 +00:00
|
|
|
GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
|
2011-08-28 16:03:14 +00:00
|
|
|
|
2021-09-15 14:17:05 +00:00
|
|
|
impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ netrcImpureEnvVars ++ [
|
|
|
|
"GIT_PROXY_COMMAND" "NIX_GIT_SSL_CAINFO" "SOCKS_SERVER"
|
2016-09-17 19:50:01 +00:00
|
|
|
];
|
2014-02-10 20:03:17 +00:00
|
|
|
|
fetchgit: allow passing allowedRequisites through to stdenv.mkDerivation
When maintainers override stages of `fetchgit' (e.g. `postPatch`) it
is very easy for them to accidentally leak the outpath-hash of their
current `stdenv` into `fetchgit''s output, and therefore into the
value they paste into `sha256`.
This is a problem, because the resulting expression will break
whenever any change is made to `stdenv` or when anybody attempts to
build the expression on a different platform than the one used by the
original maintainer.
Almost as much of a problem is the fact that CI **does not catch**
these problems. The `fetchgit` is run only once, then its output goes
into cachix, and all future builds (hydra, CI, ofborg) pull from
cachix.
Let's offer maintainers the option to check that they aren't making
this mistake, by passing through `allowedRequisites`. The default
value is `null`, but it might be worth changing that at some point in
the future.
It is also sometimes difficult to communicate to package maintainers
why their expression is problematic. Having `allowedRequisites`
passed through makes it easier to do this: "look, when I switch on
`allowedRequisites` your package breaks; are you sure you meant to
hardcode the hash today's `x86_64-linux.stdenv` into your expression?`
For an example use case, see https://github.com/NixOS/nixpkgs/pull/171223
The issue above is part of a larger problem with nixpkgs infra: there
large parts of cachix cannot be reproduced easily if they are lost.
Once something ends goes into cachix, we never ever again reverify the
procedure by which it was placed into cachix.
2022-05-02 09:51:11 +00:00
|
|
|
|
|
|
|
inherit preferLocalBuild meta allowedRequisites;
|
2022-05-24 16:03:46 +00:00
|
|
|
|
|
|
|
passthru = {
|
|
|
|
gitRepoUrl = url;
|
|
|
|
};
|
2009-06-24 12:48:01 +00:00
|
|
|
}
|