|
7 | 7 |
|
8 | 8 | short = builtins.substring 0 7 rev; |
9 | 9 |
|
10 | | - appendShort = if (builtins.match "[a-f0-9]*" rev) != null |
11 | | - then "-${short}" |
12 | | - else ""; |
| 10 | + appendShort = lib.optionalString ((builtins.match "[a-f0-9]*" rev) != null) "-${short}"; |
13 | 11 | in "${if matched == null then base else builtins.head matched}${appendShort}"; |
14 | 12 | in |
15 | | -{ url, rev ? "HEAD", md5 ? "", sha256 ? "", hash ? "", leaveDotGit ? deepClone |
| 13 | +lib.makeOverridable (lib.fetchers.withNormalizedHash { } ( |
| 14 | +# NOTE Please document parameter additions or changes in |
| 15 | +# doc/build-helpers/fetchers.chapter.md |
| 16 | +{ url |
| 17 | +, tag ? null |
| 18 | +, rev ? null |
| 19 | +, leaveDotGit ? deepClone |
| 20 | +, outputHash ? lib.fakeHash, outputHashAlgo ? null |
16 | 21 | , fetchSubmodules ? true, deepClone ? false |
17 | 22 | , branchName ? null |
18 | | -, name ? urlToName url rev |
| 23 | +, sparseCheckout ? [] |
| 24 | +, nonConeMode ? false |
| 25 | +, name ? null |
19 | 26 | , # Shell code executed after the file has been fetched |
20 | 27 | # successfully. This can do things like check or transform the file. |
21 | 28 | postFetch ? "" |
|
26 | 33 | , # Impure env vars (https://nixos.org/nix/manual/#sec-advanced-attributes) |
27 | 34 | # needed for netrcPhase |
28 | 35 | netrcImpureEnvVars ? [] |
| 36 | +, meta ? {} |
| 37 | +, allowedRequisites ? null |
29 | 38 | }: |
30 | 39 |
|
31 | 40 | /* NOTE: |
32 | 41 | fetchgit has one problem: git fetch only works for refs. |
33 | | - This is because fetching arbitrary (maybe dangling) commits may be a security risk |
| 42 | + This is because fetching arbitrary (maybe dangling) commits creates garbage collection risks |
34 | 43 | and checking whether a commit belongs to a ref is expensive. This may |
35 | 44 | change in the future when some caching is added to git (?) |
36 | 45 | Usually refs are either tags (refs/tags/*) or branches (refs/heads/*) |
|
51 | 60 | */ |
52 | 61 |
|
53 | 62 | assert deepClone -> leaveDotGit; |
| 63 | +assert nonConeMode -> (sparseCheckout != []); |
| 64 | + |
| 65 | +let |
| 66 | + revWithTag = |
| 67 | + let |
| 68 | + warningMsg = "fetchgit requires one of either `rev` or `tag` to be provided (not both)."; |
| 69 | + otherIsNull = other: lib.assertMsg (other == null) warningMsg; |
| 70 | + in |
| 71 | + if tag != null then |
| 72 | + assert (otherIsNull rev); |
| 73 | + "refs/tags/${tag}" |
| 74 | + else if rev != null then |
| 75 | + assert (otherIsNull tag); |
| 76 | + rev |
| 77 | + else |
| 78 | + # FIXME fetching HEAD if no rev or tag is provided is problematic at best |
| 79 | + "HEAD"; |
| 80 | +in |
54 | 81 |
|
55 | | -if md5 != "" then |
56 | | - throw "fetchgit does not support md5 anymore, please use sha256" |
57 | | -else if hash != "" && sha256 != "" then |
58 | | - throw "Only one of sha256 or hash can be set" |
| 82 | +if builtins.isString sparseCheckout then |
| 83 | + # Changed to throw on 2023-06-04 |
| 84 | + throw "Please provide directories/patterns for sparse checkout as a list of strings. Passing a (multi-line) string is not supported any more." |
59 | 85 | else |
60 | 86 | stdenvNoCC.mkDerivation { |
61 | | - inherit name; |
| 87 | + name = if name != null then name else urlToName url revWithTag; |
| 88 | + |
62 | 89 | builder = ./builder.sh; |
63 | | - fetcher = ./nix-prefetch-git; # This must be a string to ensure it's called with bash. |
| 90 | + fetcher = ./nix-prefetch-git; |
64 | 91 |
|
65 | | - nativeBuildInputs = [ git ] |
| 92 | + nativeBuildInputs = [ git cacert ] |
66 | 93 | ++ lib.optionals fetchLFS [ git-lfs ]; |
67 | 94 |
|
68 | | - outputHashAlgo = if hash != "" then null else "sha256"; |
| 95 | + inherit outputHash outputHashAlgo; |
69 | 96 | outputHashMode = "recursive"; |
70 | | - outputHash = if hash != "" then |
71 | | - hash |
72 | | - else if sha256 != "" then |
73 | | - sha256 |
74 | | - else |
75 | | - lib.fakeSha256; |
76 | 97 |
|
77 | | - inherit url rev leaveDotGit fetchLFS fetchSubmodules deepClone branchName postFetch; |
| 98 | + # git-sparse-checkout(1) says: |
| 99 | + # > When the --stdin option is provided, the directories or patterns are read |
| 100 | + # > from standard in as a newline-delimited list instead of from the arguments. |
| 101 | + sparseCheckout = builtins.concatStringsSep "\n" sparseCheckout; |
| 102 | + |
| 103 | + inherit url leaveDotGit fetchLFS fetchSubmodules deepClone branchName nonConeMode postFetch; |
| 104 | + rev = revWithTag; |
78 | 105 |
|
79 | 106 | postHook = if netrcPhase == null then null else '' |
80 | 107 | ${netrcPhase} |
81 | 108 | # required that git uses the netrc file |
82 | 109 | mv {,.}netrc |
| 110 | + export NETRC=$PWD/.netrc |
83 | 111 | export HOME=$PWD |
84 | 112 | ''; |
85 | 113 |
|
86 | | - GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt"; |
87 | | - |
88 | 114 | impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ netrcImpureEnvVars ++ [ |
89 | 115 | "GIT_PROXY_COMMAND" "NIX_GIT_SSL_CAINFO" "SOCKS_SERVER" |
90 | | - "ROBOTNIX_GIT_MIRRORS" |
91 | 116 | ]; |
92 | 117 |
|
93 | | - inherit preferLocalBuild; |
| 118 | + |
| 119 | + inherit preferLocalBuild meta allowedRequisites; |
| 120 | + |
| 121 | + passthru = { |
| 122 | + gitRepoUrl = url; |
| 123 | + inherit tag; |
| 124 | + }; |
94 | 125 | } |
| 126 | +)) |
0 commit comments