From 24fd1e9bdceef5c2c21228f2f5a65bb9a2181574 Mon Sep 17 00:00:00 2001 From: Erik Arvstedt Date: Wed, 8 Sep 2021 17:01:17 +0200 Subject: [PATCH] improve examples/shell.nix The user's local node configuration directory usually contains a copy of examples/shell.nix. 1. Move the shell implementation from shell.nix to nix-bitcoin/helper/makeShell.nix Because the shell is no longer defined locally in the user's config directory, we can now ship new shell features via nix-bitcoin updates. 2. Simplify examples/nix-bitcoin-release.nix nix-bitcoin-release.nix, as generated via `fetch-release`, now contains a simple fetchTarball statement which can be directly imported. This allows us to get rid of the extra `nix-bitcoin-unpacked` derivation which adds a dependency on the user's local nixpkgs. To keep `fetch-release` as simple as possible for easy auditing, we just fetch and verify a `nar-hash.txt` file that is now uploaded via `push-release.sh`. A migration guide for updating the user's local `shell.nix` is automatically printed when the user starts a new shell after updating nix-bitcoin. This is achieved by throwing an error in `generate-secrets`, which is called on shell startup. This commit is required to deploy the new extensible `generate-secrets` mechanism introduced in the next commit. --- examples/shell.nix | 57 +++------------------------- flake.nix | 2 +- helper/fetch-release | 24 ++++++------ helper/makeShell.nix | 43 +++++++++++++++++++++ helper/push-release.sh | 8 ++++ pkgs/default.nix | 2 +- pkgs/generate-secrets-deprecated.nix | 14 +++++++ 7 files changed, 86 insertions(+), 64 deletions(-) create mode 100644 helper/makeShell.nix create mode 100644 pkgs/generate-secrets-deprecated.nix diff --git a/examples/shell.nix b/examples/shell.nix index 47b1e47..d378e67 100644 --- a/examples/shell.nix +++ b/examples/shell.nix @@ -1,53 +1,8 @@ let - # This is either a path to a local nix-bitcoin source or an attribute set to - # be used as the fetchurl argument. - nix-bitcoin-release = import ./nix-bitcoin-release.nix; - - nix-bitcoin-path = - if builtins.isAttrs nix-bitcoin-release then nix-bitcoin-unpacked - else nix-bitcoin-release; - - nixpkgs-path = (import "${toString nix-bitcoin-path}/pkgs/nixpkgs-pinned.nix").nixpkgs; - pkgs = import nixpkgs-path {}; - nix-bitcoin = pkgs.callPackage nix-bitcoin-path {}; - - nix-bitcoin-unpacked = (import {}).runCommand "nix-bitcoin-src" {} '' - mkdir $out; tar xf ${builtins.fetchurl nix-bitcoin-release} -C $out - ''; + nix-bitcoin = toString (import ./nix-bitcoin-release.nix); in -with pkgs; -stdenv.mkDerivation rec { - name = "nix-bitcoin-environment"; - - path = lib.makeBinPath [ nix-bitcoin.extra-container ]; - - shellHook = '' - export NIX_PATH="nixpkgs=${nixpkgs-path}:nix-bitcoin=${toString nix-bitcoin-path}:." - export PATH="${path}''${PATH:+:}$PATH" - - export NIX_BITCOIN_EXAMPLES_DIR="${toString ./.}" - - fetch-release() { - ${toString nix-bitcoin-path}/helper/fetch-release - } - - krops-deploy() { - # Ensure strict permissions on secrets/ directory before rsyncing it to - # the target machine - chmod 700 ${toString ./secrets} - $(nix-build --no-out-link ${toString ./krops/deploy.nix}) - } - - # Print logo if - # 1. stdout is a TTY, i.e. we're not piping the output - # 2. the shell is interactive - if [[ -t 1 && $- == *i* ]]; then - ${figlet}/bin/figlet "nix-bitcoin" - fi - - (mkdir -p secrets; cd secrets; env -i ${nix-bitcoin.generate-secrets}) - - # Don't run this hook when another nix-shell is run inside this shell - unset shellHook - ''; -} + import "${nix-bitcoin}/helper/makeShell.nix" { + configDir = ./.; + # Set this to modify your shell + # extraShellInitCmds = (pkgs: ''''); + } diff --git a/flake.nix b/flake.nix index 12828a1..302b612 100644 --- a/flake.nix +++ b/flake.nix @@ -62,7 +62,7 @@ nbPkgs = self.mkNbPkgs { inherit system pkgs; }; packages = flake-utils.lib.flattenTree (removeAttrs nbPkgs [ - "pinned" "modulesPkgs" "nixops19_09" "krops" + "pinned" "modulesPkgs" "nixops19_09" "krops" "generate-secrets" ]) // { runVM = mkVMScript packages.vm; diff --git a/helper/fetch-release b/helper/fetch-release index 13513d8..2fe87ee 100755 --- a/helper/fetch-release +++ b/helper/fetch-release @@ -15,26 +15,28 @@ trap "rm -rf $TMPDIR" EXIT GPG_HOME=$TMPDIR/gpg-home mkdir -p -m 700 "$GPG_HOME" -cd $TMPDIR -baseUrl=https://github.com/$repo/releases/download/v$version -curl --silent -L -O $baseUrl/SHA256SUMS.txt -curl --silent -L -O $baseUrl/SHA256SUMS.txt.asc - # Import key gpg --homedir $GPG_HOME --import "$scriptDir/key-jonasnick.bin" &> /dev/null # Verify key fingerprint gpg --homedir $GPG_HOME --list-keys 36C71A37C9D988BDE82508D9B1A70E4F8DCD0366 > /dev/null -# Verify signature for SHA256SUMS.txt -gpg --homedir $GPG_HOME --verify SHA256SUMS.txt.asc &> /dev/null || { +# Fetch nar-hash of release +cd $TMPDIR +baseUrl=https://github.com/$repo/releases/download/v$version +curl --silent -L -O $baseUrl/nar-hash.txt +curl --silent -L -O $baseUrl/nar-hash.txt.asc + +# Verify signature for nar-hash +gpg --homedir $GPG_HOME --verify nar-hash.txt.asc &> /dev/null || { echo "Error: Signature verification failed. Please open an issue in the project repository." exit 1 } -sha256=$(cat SHA256SUMS.txt | cut -d\ -f1) +>&2 echo "Fetched and verified release $version" + cat < $SHA256SUMS) gpg -o $SHA256SUMS.asc -a --detach-sig $SHA256SUMS +cd $TMPDIR +nix hash to-sri --type sha256 $(nix-prefetch-url --unpack file://$ARCHIVE 2> /dev/null) > nar-hash.txt +gpg -o nar-hash.txt.asc -a --detach-sig nar-hash.txt + if [[ $DRY_RUN ]]; then echo "Created v$TAG_NAME in $TMPDIR" exit 0 @@ -77,6 +81,10 @@ post_asset() { curl -H "Authorization: token $OAUTH_TOKEN" --data-binary "@$1" -H "Content-Type: application/octet-stream" \ $GH_ASSET/$(basename $1) &> /dev/null } +post_asset nar-hash.txt +post_asset nar-hash.txt.asc +# Post additional assets for backwards compatibility. +# This allows older nix-bitcoin installations to upgrade via `fetch-release`. post_asset $ARCHIVE post_asset $SHA256SUMS post_asset $SHA256SUMS.asc diff --git a/pkgs/default.nix b/pkgs/default.nix index 1e41b01..39df452 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -9,7 +9,7 @@ let self = { spark-wallet = pkgs.callPackage ./spark-wallet { }; liquid-swap = pkgs.python3Packages.callPackage ./liquid-swap { }; joinmarket = pkgs.callPackage ./joinmarket { inherit (self) nbPython3Packages; }; - generate-secrets = pkgs.callPackage ./generate-secrets { }; + generate-secrets = import ./generate-secrets-deprecated.nix; nixops19_09 = pkgs.callPackage ./nixops { }; krops = import ./krops { }; netns-exec = pkgs.callPackage ./netns-exec { }; diff --git a/pkgs/generate-secrets-deprecated.nix b/pkgs/generate-secrets-deprecated.nix new file mode 100644 index 0000000..4bb491b --- /dev/null +++ b/pkgs/generate-secrets-deprecated.nix @@ -0,0 +1,14 @@ +throw '' + Please update the `shell.nix` of your node configuration. + + To update, do the following: + 1. Switch to the directory containing your `configuration.nix` and `shell.nix`. + 2. Run the following Bash expression (Warning: This overwrites your `shell.nix`): + + # Only update nix-bitcoin-release.nix if it contains a release hash + if grep -q sha256 nix-bitcoin-release.nix; then + ${toString ../helper/fetch-release} > nix-bitcoin-release.nix && cp ${toString ../examples/shell.nix} . + else + cp ${toString ../examples/shell.nix} . + fi +''