alioth/nixpkgs
3
0
Fork 0
forked from mirrors/nixpkgs
Code Releases Activity

Merge pull request #31356 from FRidh/fetchgitPrivate

Browse source 
fetchgitPrivate: put our custom ssh on PATH
This commit is contained in:
Frederik Rietdijk 2017-11-10 10:57:50 +01:00 committed by GitHub
parent 0a97b9de7b f8eed5f7a5
commit 4508a17da7
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 20 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
pkgs/build-support/fetchgit/private.nix
View file

@ -1,19 +1,26 @@
{ fetchgit, writeScript, openssh, stdenv }: args: derivation ((fetchgit args).drvAttrs // {
{ fetchgit, runCommand, makeWrapper, openssh, stdenv }: args: derivation ((fetchgit args).drvAttrs // {
SSH_AUTH_SOCK = if (builtins.tryEval <ssh-auth-sock>).success
then builtins.toString <ssh-auth-sock>
else null;
GIT_SSH = writeScript "fetchgit-ssh" ''
#! ${stdenv.shell}
exec -a ssh ${openssh}/bin/ssh -F ${let
sshConfigFile = if (builtins.tryEval <ssh-config-file>).success
then <ssh-config-file>
else builtins.trace ''
Please set your nix-path such that ssh-config-file points to a file that will allow ssh to access private repositories. The builder will not be able to see any running ssh agent sessions unless ssh-auth-sock is also set in the nix-path.
Note that the config file and any keys it points to must be readable by the build user, which depending on your nix configuration means making it readable by the build-users-group, the user of the running nix-daemon, or the user calling the nix command which started the build. Similarly, if using an ssh agent ssh-auth-sock must point to a socket the build user can access.
GIT_SSH = let
config = ''${let
sshConfigFile = if (builtins.tryEval <ssh-config-file>).success
then <ssh-config-file>
else builtins.trace ''
Please set your nix-path such that ssh-config-file points to a file that will allow ssh to access private repositories. The builder will not be able to see any running ssh agent sessions unless ssh-auth-sock is also set in the nix-path.
You may need StrictHostKeyChecking=no in the config file. Since ssh will refuse to use a group-readable private key, if using build-users you will likely want to use something like IdentityFile /some/directory/%u/key and have a directory for each build user accessible to that user.
'' "/var/lib/empty/config";
in builtins.toString sshConfigFile} "$@"
'';
Note that the config file and any keys it points to must be readable by the build user, which depending on your nix configuration means making it readable by the build-users-group, the user of the running nix-daemon, or the user calling the nix command which started the build. Similarly, if using an ssh agent ssh-auth-sock must point to a socket the build user can access.
You may need StrictHostKeyChecking=no in the config file. Since ssh will refuse to use a group-readable private key, if using build-users you will likely want to use something like IdentityFile /some/directory/%u/key and have a directory for each build user accessible to that user.
'' "/var/lib/empty/config";
in builtins.toString sshConfigFile}'';
ssh-wrapped = runCommand "fetchgit-ssh" {
buildInputs = [ makeWrapper ];
} ''
mkdir -p $out/bin
makeWrapper ${openssh}/bin/ssh $out/bin/ssh --prefix PATH : "$out/bin" --add-flags "-F ${config}" "$@"
'';
in "${ssh-wrapped}/bin/ssh";
})