push sheeet

pkgs/build-support/fetchgithub/default.nix

@@ -0,0 +1,167 @@
+{
+  lib,
+  repoRevToNameMaybe,
+  fetchgit,
+  fetchzip,
+}:
+
+lib.makeOverridable (
+  {
+    owner,
+    repo,
+    tag ? null,
+    rev ? null,
+    name ? repoRevToNameMaybe repo (lib.revOrTag rev tag) "github",
+    fetchSubmodules ? false,
+    leaveDotGit ? null,
+    deepClone ? false,
+    private ? false,
+    forceFetchGit ? false,
+    fetchLFS ? false,
+    rootDir ? "",
+    sparseCheckout ? lib.optional (rootDir != "") rootDir,
+    githubBase ? "github.com",
+    varPrefix ? null,
+    meta ? { },
+    ... # For hash agility
+  }@args:
+
+  assert (
+    lib.assertMsg (lib.xor (tag == null) (
+      rev == null
+    )) "fetchFromGitHub requires one of either `rev` or `tag` to be provided (not both)."
+  );
+
+  let
+
+    position = (
+      if args.meta.description or null != null then
+        builtins.unsafeGetAttrPos "description" args.meta
+      else if tag != null then
+        builtins.unsafeGetAttrPos "tag" args
+      else
+        builtins.unsafeGetAttrPos "rev" args
+    );
+    baseUrl = "https://${githubBase}/${owner}/${repo}";
+    newMeta =
+      meta
+      // {
+        homepage = meta.homepage or baseUrl;
+      }
+      // lib.optionalAttrs (position != null) {
+        # to indicate where derivation originates, similar to make-derivation.nix's mkDerivation
+        position = "${position.file}:${toString position.line}";
+      };
+    passthruAttrs = removeAttrs args [
+      "owner"
+      "repo"
+      "tag"
+      "rev"
+      "fetchSubmodules"
+      "forceFetchGit"
+      "private"
+      "githubBase"
+      "varPrefix"
+    ];
+    varBase = "NIX${lib.optionalString (varPrefix != null) "_${varPrefix}"}_GITHUB_PRIVATE_";
+    useFetchGit =
+      fetchSubmodules
+      || (leaveDotGit == true)
+      || deepClone
+      || forceFetchGit
+      || fetchLFS
+      || (rootDir != "")
+      || (sparseCheckout != [ ]);
+    # We prefer fetchzip in cases we don't need submodules as the hash
+    # is more stable in that case.
+    fetcher =
+      if useFetchGit then
+        fetchgit
+      # fetchzip may not be overridable when using external tools, for example nix-prefetch
+      else if fetchzip ? override then
+        fetchzip.override { withUnzip = false; }
+      else
+        fetchzip;
+    privateAttrs = lib.optionalAttrs private {
+      netrcPhase =
+        # When using private repos:
+        # - Fetching with git works using https://github.com but not with the GitHub API endpoint
+        # - Fetching a tarball from a private repo requires to use the GitHub API endpoint
+        let
+          machineName = if githubBase == "github.com" && !useFetchGit then "api.github.com" else githubBase;
+        in
+        ''
+          if [ -z "''$${varBase}USERNAME" -o -z "''$${varBase}PASSWORD" ]; then
+            echo "Error: Private fetchFromGitHub requires the nix building process (nix-daemon in multi user mode) to have the ${varBase}USERNAME and ${varBase}PASSWORD env vars set." >&2
+            exit 1
+          fi
+          cat > netrc <<EOF
+          machine ${machineName}
+                  login ''$${varBase}USERNAME
+                  password ''$${varBase}PASSWORD
+          EOF
+        '';
+      netrcImpureEnvVars = [
+        "${varBase}USERNAME"
+        "${varBase}PASSWORD"
+      ];
+    };
+
+    gitRepoUrl = "${baseUrl}.git";
+
+    revWithTag = if tag != null then "refs/tags/${tag}" else rev;
+
+    fetcherArgs =
+      (
+        if useFetchGit then
+          {
+            inherit
+              tag
+              rev
+              deepClone
+              fetchSubmodules
+              sparseCheckout
+              fetchLFS
+              ;
+            url = gitRepoUrl;
+          }
+          // lib.optionalAttrs (leaveDotGit != null) { inherit leaveDotGit; }
+        else
+          {
+            # Use the API endpoint for private repos, as the archive URI doesn't
+            # support access with GitHub's fine-grained access tokens.
+            #
+            # Use the archive URI for non-private repos, as the API endpoint has
+            # relatively restrictive rate limits for unauthenticated users.
+            url =
+              if private then
+                let
+                  endpoint = "/repos/${owner}/${repo}/tarball/${revWithTag}";
+                in
+                if githubBase == "github.com" then
+                  "https://api.github.com${endpoint}"
+                else
+                  "https://${githubBase}/api/v3${endpoint}"
+              else
+                "${baseUrl}/archive/${revWithTag}.tar.gz";
+            extension = "tar.gz";
+
+            passthru = {
+              inherit gitRepoUrl;
+            };
+          }
+      )
+      // privateAttrs
+      // passthruAttrs
+      // {
+        inherit name;
+      };
+  in
+
+  fetcher fetcherArgs
+  // {
+    meta = newMeta;
+    inherit owner repo tag;
+    rev = revWithTag;
+  }
+)

pkgs/build-support/fetchgithub/tests.nix

@@ -0,0 +1,119 @@
+{ testers, fetchFromGitHub, ... }:
+{
+  simple = testers.invalidateFetcherByDrvHash fetchFromGitHub {
+    name = "simple-nix-source";
+    owner = "NixOS";
+    repo = "nix";
+    rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
+    hash = "sha256-7DszvbCNTjpzGRmpIVAWXk20P0/XTrWZ79KSOGLrUWY=";
+  };
+
+  sparseCheckout = testers.invalidateFetcherByDrvHash fetchFromGitHub {
+    name = "sparse-checkout-nix-source";
+    owner = "NixOS";
+    repo = "nix";
+    rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
+    sparseCheckout = [
+      "src"
+      "tests"
+    ];
+    sha256 = "sha256-g1PHGTWgAcd/+sXHo1o6AjVWCvC6HiocOfMbMh873LQ=";
+  };
+
+  sparseCheckoutNonConeMode = testers.invalidateFetcherByDrvHash fetchFromGitHub {
+    name = "sparse-checkout-non-cone-nix-source";
+    owner = "NixOS";
+    repo = "nix";
+    rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
+    sparseCheckout = [
+      "src"
+      "tests"
+    ];
+    nonConeMode = true;
+    sha256 = "sha256-FknO6C/PSnMPfhUqObD4vsW4PhkwdmPa9blNzcNvJQ4=";
+  };
+
+  leave-git = testers.invalidateFetcherByDrvHash fetchFromGitHub {
+    name = "leave-git-nix-source";
+    owner = "NixOS";
+    repo = "nix";
+    rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
+    sha256 = "sha256-VmQ38+lr+rNPaTnjjV41uC2XSN4fkfZAfytE2uKyLfo=";
+    leaveDotGit = true;
+  };
+
+  submodule-simple = testers.invalidateFetcherByDrvHash fetchFromGitHub {
+    name = "submodule-simple-source";
+    owner = "pineapplehunter";
+    repo = "nix-test-repo-with-submodule";
+    rev = "26473335b84ead88ee0a3b649b1c7fa4a91cfd4a";
+    sha256 = "sha256-rmP8PQT0wJBopdtr/hsB7Y/L1G+ZPdHC2r9LB05Qrj4=";
+    fetchSubmodules = true;
+  };
+
+  submodule-leave-git = testers.invalidateFetcherByDrvHash fetchFromGitHub {
+    name = "submodule-leave-git-source";
+    owner = "pineapplehunter";
+    repo = "nix-test-repo-with-submodule";
+    rev = "26473335b84ead88ee0a3b649b1c7fa4a91cfd4a";
+    sha256 = "sha256-EC2PMEEtA7f5OFdsluHn7pi4QXhCZuFML8tib4pV7Ek=";
+    leaveDotGit = true;
+    fetchSubmodules = true;
+  };
+
+  submodule-deep = testers.invalidateFetcherByDrvHash fetchFromGitHub {
+    name = "submodule-deep-source";
+    owner = "pineapplehunter";
+    repo = "nix-test-repo-with-submodule";
+    rev = "26473335b84ead88ee0a3b649b1c7fa4a91cfd4a";
+    sha256 = "sha256-3zWogs6EZBnzUfz6gBnigETTKGYl9KFKFgsy6Bl4DME=";
+    deepClone = true;
+    fetchSubmodules = true;
+    # deepClone implies leaveDotGit, so delete the .git directory after
+    # fetching to distinguish from the submodule-leave-git-deep test.
+    postFetch = "rm -r $out/.git";
+  };
+
+  submodule-leave-git-deep = testers.invalidateFetcherByDrvHash fetchFromGitHub {
+    name = "submodule-leave-git-deep-source";
+    owner = "pineapplehunter";
+    repo = "nix-test-repo-with-submodule";
+    rev = "26473335b84ead88ee0a3b649b1c7fa4a91cfd4a";
+    sha256 = "sha256-ieYn9I/0RgeSwQkSqwKaU3RgjKFlRqMg7zw0Nvu3azA=";
+    deepClone = true;
+    leaveDotGit = true;
+    fetchSubmodules = true;
+  };
+
+  dumb-http-signed-tag = testers.invalidateFetcherByDrvHash fetchFromGitHub {
+    name = "dumb-http-signed-tag-source";
+    owner = "NixOS";
+    repo = "nix";
+    tag = "2.9.2";
+    sha256 = "sha256-uZCaBo9rdWRO/AlQMvVVjpAwzYijB2H5KKQqde6eHkg=";
+  };
+
+  fetchTags = testers.invalidateFetcherByDrvHash fetchFromGitHub {
+    name = "fetchFromGitHub-fetch-tags-test";
+    owner = "NixOS";
+    repo = "nix";
+    rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
+    fetchTags = true;
+    leaveDotGit = true;
+    sha256 = "sha256-y7l+46lVP2pzJwGON5qEV0EoxWofRoWAym5q9VXvpc8=";
+    postFetch = ''
+      cd $out && git describe --tags --always > describe-output.txt 2>&1 || echo "git describe failed" > describe-output.txt
+      # See https://github.com/NixOS/nixpkgs/issues/412967#issuecomment-2927452118
+      rm -rf .git
+    '';
+  };
+
+  rootDir = testers.invalidateFetcherByDrvHash fetchFromGitHub {
+    name = "fetchFromGitHub-with-rootdir";
+    owner = "NixOS";
+    repo = "nix";
+    rev = "9d9dbe6ed05854e03811c361a3380e09183f4f4a";
+    rootDir = "misc/systemd";
+    hash = "sha256-UhxHk4SrXYq7ZDMtXLig5SigpbITrVgkpFTmryuvpcM=";
+  };
+}