push sheeet

pkgs/development/tools/infisical/default.nix

@@ -0,0 +1,96 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  testers,
+  installShellFiles,
+}:
+
+# this expression is mostly automated, and you are STRONGLY
+# RECOMMENDED to use to nix-update for updating this expression when new
+# releases come out, which runs the sibling `update.sh` script.
+#
+# from the root of the nixpkgs git repository, run:
+#
+#    nix-shell maintainers/scripts/update.nix \
+#      --argstr commit true \
+#      --argstr package infisical
+
+let
+  # build hashes, which correspond to the hashes of the precompiled binaries procured by GitHub Actions.
+  buildHashes = builtins.fromJSON (builtins.readFile ./hashes.json);
+
+  # the version of infisical
+  version = "0.41.90";
+
+  # the platform-specific, statically linked binary
+  src =
+    let
+      suffix =
+        {
+          # map the platform name to the golang toolchain suffix
+          # NOTE: must be synchronized with update.sh!
+          x86_64-linux = "linux_amd64";
+          x86_64-darwin = "darwin_amd64";
+          aarch64-linux = "linux_arm64";
+          aarch64-darwin = "darwin_arm64";
+        }
+        ."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+      name = "infisical_${version}_${suffix}.tar.gz";
+      hash = buildHashes."${stdenv.hostPlatform.system}";
+      url = "https://github.com/Infisical/infisical/releases/download/infisical-cli%2Fv${version}/${name}";
+    in
+    fetchurl { inherit name url hash; };
+
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "infisical";
+  version = version;
+  inherit src;
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  doCheck = true;
+  dontConfigure = true;
+  dontStrip = true;
+
+  sourceRoot = ".";
+  buildPhase = "chmod +x ./infisical";
+  checkPhase = "./infisical --version";
+  installPhase = ''
+    mkdir -p $out/bin/ $out/share/completions/ $out/share/man/
+    cp infisical $out/bin
+    cp completions/* $out/share/completions/
+    cp manpages/* $out/share/man/
+  '';
+  postInstall = ''
+    installManPage share/man/infisical.1.gz
+    installShellCompletion share/completions/infisical.{bash,fish,zsh}
+  '';
+
+  passthru = {
+    updateScript = ./update.sh;
+    tests.version = testers.testVersion { package = finalAttrs.finalPackage; };
+  };
+
+  meta = with lib; {
+    description = "Official Infisical CLI";
+    longDescription = ''
+      Infisical is the open-source secret management platform:
+      Sync secrets across your team/infrastructure and prevent secret leaks.
+    '';
+    homepage = "https://infisical.com";
+    changelog = "https://github.com/infisical/infisical/releases/tag/infisical-cli%2Fv${version}";
+    license = licenses.mit;
+    mainProgram = "infisical";
+    maintainers = with maintainers; [ hausken ];
+    teams = [ teams.infisical ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "aarch64-darwin"
+      "x86_64-darwin"
+    ];
+  };
+})

pkgs/development/tools/infisical/hashes.json

@@ -0,0 +1,6 @@
+{ "_comment": "@generated by pkgs/development/tools/infisical/update.sh"
+, "x86_64-linux": "sha256-/2fksPX6/hsz6hYGdn5iNah0LMR+avY0zf9UuNH8zAo="
+, "x86_64-darwin": "sha256-SQD0zqHl8eLBz8jsSf6tOqKSFimgrjAX+7M0o8yAEqo="
+, "aarch64-linux": "sha256-lrkyolCSgLQiet287Br0aGYCP/daaYzJAaqMvsqsbsw="
+, "aarch64-darwin": "sha256-pw06koxiY9gYvDw0b6tRTMy3BGYS36mxV0q8TWEA7vM="
+}

pkgs/development/tools/infisical/update.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -I nixpkgs=./. -i bash -p curl jq nix-prefetch common-updater-scripts nix coreutils
+# shellcheck shell=bash
+set -euo pipefail
+
+RELEASE_NAME=$(curl -s https://api.github.com/repos/infisical/infisical/releases \
+  | jq -r 'sort_by(.created_at) | reverse |
+           (map
+             (select ((.prerelease == false) and (.draft == false) and (.name | contains("infisical-cli")))) |
+             first
+           ) | .name')
+VERSION=$(echo "$RELEASE_NAME" | sed -E 's/^infisical-cli\/v//')
+
+echo "Latest infisical release: $VERSION"
+
+ARCHS=(
+    "x86_64-linux:linux_amd64"
+    "x86_64-darwin:darwin_amd64"
+    "aarch64-linux:linux_arm64"
+    "aarch64-darwin:darwin_arm64"
+)
+
+NFILE=pkgs/development/tools/infisical/default.nix
+HFILE=pkgs/development/tools/infisical/hashes.json
+rm -f "$HFILE" && touch "$HFILE"
+
+printf "{ \"_comment\": \"@generated by pkgs/development/tools/infisical/update.sh\"\n" >> "$HFILE"
+
+for arch in "${ARCHS[@]}"; do
+    IFS=: read -r arch_name arch_target <<< "$arch"
+    sha256hash="$(nix-prefetch-url --type sha256 "https://github.com/infisical/infisical/releases/download/${RELEASE_NAME}/infisical_${VERSION}_${arch_target}.tar.gz")"
+    srihash="$(nix --extra-experimental-features nix-command hash to-sri --type sha256 "$sha256hash")"
+    echo ", \"$arch_name\": \"$srihash\"" >> "$HFILE"
+done
+echo "}" >> "$HFILE"
+
+sed -i \
+  '0,/version\s*=\s*".*";/s//version = "'"$VERSION"'";/' \
+  "$NFILE"
+
+echo "Done; wrote $HFILE and updated version in $NFILE."