From ef2b47a345906375d3a059404e6131cdac1342c4 Mon Sep 17 00:00:00 2001 From: xzfc <5121426+xzfc@users.noreply.github.com> Date: Wed, 8 Apr 2026 03:51:23 +0000 Subject: [PATCH] shell.nix: update pinned dependencies (#8623) Problems: - The pinned `uv` version sometimes pulls broken python interpreter. - The pinned `just` is too old to read `lib/edge/Justfile`. Solution: update everything. nix-shell --run 'cd tools/nix && npins update' # for default.nix nix-shell --run 'cd tools/nix && npins upgrade' # for sources.json Also, in this nixpkgs version, renames `nixfmt-rfc-style` into `nixfmt`. --- shell.nix | 2 +- tools/nix/npins/default.nix | 151 +++++++++++++++++++++++++++++------ tools/nix/npins/sources.json | 12 +-- 3 files changed, 134 insertions(+), 31 deletions(-) diff --git a/shell.nix b/shell.nix index 1c59408bbc..d508e90ec9 100644 --- a/shell.nix +++ b/shell.nix @@ -44,7 +44,7 @@ mkShell { pkgs.jq # used in ./tests and ./tools pkgs.just # for lib/edge/Justfile pkgs.maturin # mentioned in lib/edge/python/README.md - pkgs.nixfmt-rfc-style # to format this file + pkgs.nixfmt # to format this file pkgs.npins # used in tools/nix/update.py pkgs.python3 # used in ./tests, ./tools, lib/edge pkgs.sccache # mentioned in shellHook diff --git a/tools/nix/npins/default.nix b/tools/nix/npins/default.nix index 6592476262..884fc8cc58 100644 --- a/tools/nix/npins/default.nix +++ b/tools/nix/npins/default.nix @@ -9,8 +9,15 @@ */ # Generated by npins. Do not modify; will be overwritten regularly let - data = builtins.fromJSON (builtins.readFile ./sources.json); - version = data.version; + # Backwards-compatibly make something that previously didn't take any arguments take some + # The function must return an attrset, and will unfortunately be eagerly evaluated + # Same thing, but it catches eval errors on the default argument so that one may still call it with other arguments + mkFunctor = + fn: + let + e = builtins.tryEval (fn { }); + in + (if e.success then e.value else { error = fn { }; }) // { __functor = _self: fn; }; # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/lists.nix#L295 range = @@ -21,7 +28,6 @@ let # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L269 stringAsChars = f: s: concatStrings (map f (stringToCharacters s)); - concatMapStrings = f: list: concatStrings (map f list); concatStrings = builtins.concatStringsSep ""; # If the environment variable NPINS_OVERRIDE_${name} is set, then use @@ -48,41 +54,87 @@ let mkSource = name: spec: + { + pkgs ? null, + }: assert spec ? type; let + # Unify across builtin and pkgs fetchers. + # `fetchGit` requires a wrapper because of slight API differences. + fetchers = + if pkgs == null then + { + inherit (builtins) fetchTarball fetchurl; + # For some fucking reason, fetchGit has a different signature than the other builtin fetchers … + fetchGit = args: (builtins.fetchGit args).outPath; + } + else + { + fetchTarball = + { + url, + sha256, + }: + pkgs.fetchzip { + inherit url sha256; + extension = "tar"; + }; + inherit (pkgs) fetchurl; + fetchGit = + { + url, + submodules, + rev, + name, + narHash, + }: + pkgs.fetchgit { + inherit url rev name; + fetchSubmodules = submodules; + hash = narHash; + }; + }; + + # Dispatch to the correct code path based on the type path = if spec.type == "Git" then - mkGitSource spec + mkGitSource fetchers spec else if spec.type == "GitRelease" then - mkGitSource spec + mkGitSource fetchers spec else if spec.type == "PyPi" then - mkPyPiSource spec + mkPyPiSource fetchers spec else if spec.type == "Channel" then - mkChannelSource spec + mkChannelSource fetchers spec else if spec.type == "Tarball" then - mkTarballSource spec + mkTarballSource fetchers spec + else if spec.type == "Container" then + mkContainerSource pkgs spec else builtins.throw "Unknown source type ${spec.type}"; in spec // { outPath = mayOverride name path; }; mkGitSource = + { + fetchTarball, + fetchGit, + ... + }: { repository, revision, url ? null, submodules, hash, - branch ? null, ... }: assert repository ? type; # At the moment, either it is a plain git repository (which has an url), or it is a GitHub/GitLab repository # In the latter case, there we will always be an url to the tarball if url != null && !submodules then - builtins.fetchTarball { + fetchTarball { inherit url; - sha256 = hash; # FIXME: check nix version & use SRI hashes + sha256 = hash; } else let @@ -93,6 +145,8 @@ let "https://github.com/${repository.owner}/${repository.repo}.git" else if repository.type == "GitLab" then "${repository.server}/${repository.repo_path}.git" + else if repository.type == "Forgejo" then + "${repository.server}/${repository.owner}/${repository.repo}.git" else throw "Unrecognized repository type ${repository.type}"; urlToName = @@ -107,40 +161,89 @@ let "${if matched == null then "source" else builtins.head matched}${appendShort}"; name = urlToName url revision; in - builtins.fetchGit { + fetchGit { rev = revision; - inherit name; - # hash = hash; - inherit url submodules; + narHash = hash; + + inherit name submodules url; }; mkPyPiSource = - { url, hash, ... }: - builtins.fetchurl { + { fetchurl, ... }: + { + url, + hash, + ... + }: + fetchurl { inherit url; sha256 = hash; }; mkChannelSource = - { url, hash, ... }: - builtins.fetchTarball { + { fetchTarball, ... }: + { + url, + hash, + ... + }: + fetchTarball { inherit url; sha256 = hash; }; mkTarballSource = + { fetchTarball, ... }: { url, locked_url ? url, hash, ... }: - builtins.fetchTarball { + fetchTarball { url = locked_url; sha256 = hash; }; + + mkContainerSource = + pkgs: + { + image_name, + image_tag, + image_digest, + ... + }: + if pkgs == null then + builtins.throw "container sources require passing in a Nixpkgs value: https://github.com/andir/npins/blob/master/README.md#using-the-nixpkgs-fetchers" + else + pkgs.dockerTools.pullImage { + imageName = image_name; + imageDigest = image_digest; + finalImageTag = image_tag; + }; in -if version == 5 then - builtins.mapAttrs mkSource data.pins -else - throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`" +mkFunctor ( + { + input ? ./sources.json, + }: + let + data = + if builtins.isPath input then + # while `readFile` will throw an error anyways if the path doesn't exist, + # we still need to check beforehand because *our* error can be caught but not the one from the builtin + # *piegames sighs* + if builtins.pathExists input then + builtins.fromJSON (builtins.readFile input) + else + throw "Input path ${toString input} does not exist" + else if builtins.isAttrs input then + input + else + throw "Unsupported input type ${builtins.typeOf input}, must be a path or an attrset"; + version = data.version; + in + if version == 7 then + builtins.mapAttrs (name: spec: mkFunctor (mkSource name spec)) data.pins + else + throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`" +) diff --git a/tools/nix/npins/sources.json b/tools/nix/npins/sources.json index dba72c9bc6..e4b085e49b 100644 --- a/tools/nix/npins/sources.json +++ b/tools/nix/npins/sources.json @@ -9,16 +9,16 @@ }, "branch": "main", "submodules": false, - "revision": "34e07cd9d91ece6b1c69ea3c7ae7f9cdeb19448f", - "url": "https://github.com/nix-community/fenix/archive/34e07cd9d91ece6b1c69ea3c7ae7f9cdeb19448f.tar.gz", - "hash": "1l2m7a64j4b61x3j3zwmqi02qmypkv9rf5wlfrgq4cjyq7qajd2q" + "revision": "a260dea172f86c7afa65cec0c6e6a9dd91530017", + "url": "https://github.com/nix-community/fenix/archive/a260dea172f86c7afa65cec0c6e6a9dd91530017.tar.gz", + "hash": "sha256-dNIhLmwrR7N78amgliAJvFx58RjrhDWorV9B9Kiayeo=" }, "nixpkgs": { "type": "Channel", "name": "nixpkgs-unstable", - "url": "https://releases.nixos.org/nixpkgs/nixpkgs-25.05pre800239.b1bebd0fe266/nixexprs.tar.xz", - "hash": "0vnfj9d7kzk673i7s1vnkbx513a4gh5mfcd8fag2c7wi6hz471n6" + "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre976537.a3db02183b5d/nixexprs.tar.xz", + "hash": "sha256-rFByy+vYdvd2IZ7GYibTcc4fuJKj5+g/YkJxqxvt2+o=" } }, - "version": 5 + "version": 7 }