Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: NixOS/nixops
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: 1ce9aff239d3
Choose a base ref
...
head repository: NixOS/nixops
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: af1a6a575cf8
Choose a head ref
  • 5 commits
  • 3 files changed
  • 2 contributors

Commits on Dec 9, 2016

  1. Bundle ca-certs with hetzner bootstrap, fixes #356

    @grahamc
    grahamc committed Dec 9, 2016

    Verified

    This commit was signed with the committer’s verified signature. The key has expired.
    grahamc Graham Christensen
    GPG key ID: ACA1C1D120C83D5C
    Expired
    Verified
    Learn about vigilant mode
    Copy the full SHA
    8ce1ccc View commit details

Commits on Jan 2, 2017

  1. Merge pull request #564 from grahamc/fix-certs 

    This bundles ca-certs with hetzner-bootstrap.nix, so it should fix #356
where @manveru reported that binary cache substititions didn't work
because of certificate errors.

Although the change is quite trivial I usually try to test things on a
real machine before actually merging it, but I currently don't have a
free Hetzner machine available for testing.

I'm merging this based on @grahamc's assertion "This patch has worked on
provisioning several boxes" and testing this by building and manually
verifying the bootstrap installer and also running the "hetzner" VM test
on x86_64-linux.

So I think the worst thing that could happen is that #356 isn't fixed
after all.

Fixes: #356
    @aszlig
    aszlig committed Jan 2, 2017
    Copy the full SHA
    b09e618 View commit details

  2. tests/hetzner: Make getting GPG key ID more robust 

    GnuPG has a --with-colons flag, so we don't need to use a complicated
sed expression to extract the key ID.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
    @aszlig
    aszlig committed Jan 2, 2017
    Copy the full SHA
    9c3aecb View commit details

  3. tests/hetzner/repos: Pin GnuPG version to v2.0 

    I ran into this while trying to run tests prior to merging #564 (merge
commit b09e618).

The default GnuPG version in <nixpkgs> is 2.1, but the Debian version
used while building the Debian repository is GnuPG version 2.0, so we
need to make sure both versions match at least in major and minor.

The test for the Hetzner backend now still fails, but at least it
doesn't fail anymore because one of its dependencies are failing.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
    @aszlig
    aszlig committed Jan 2, 2017
    Copy the full SHA
    a29d334 View commit details

  4. tests/hetzner: Fix up coordinator dependencies 

    As we don't have networking access within tests, we also need to add
pkgs.lib{xml2,xslt}.dev or pkgs.lib{xml2,xslt} as fallback.

I'm using .dev here, because it references all of the other outputs of
the corresponding library as well so we don't need to list all the
possible outputs.

Unfortunately, I'm not quite sure what has led to this requirement,
because I don't want to bisect a whole lot of changes since NixOS
release 16.03 just to find out the origin of this.

Adding these dependencies now causes the test to succeed with NixOS
unstable and release-16.09.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
    @aszlig
    aszlig committed Jan 2, 2017
    Copy the full SHA
    af1a6a5 View commit details
Showing with 18 additions and 11 deletions.
  1. +2 −0 nix/hetzner-bootstrap.nix
  2. +3 −1 tests/hetzner-backend/default.nix
  3. +13 −10 tests/hetzner-backend/repository.nix
2 changes: 2 additions & 0 deletions nix/hetzner-bootstrap.nix
View file
Original file line number Diff line number Diff line change
@@ -19,6 +19,7 @@ let
mkdir -p "$out/bin"
ln -s "${nix}"/bin/* "$out/bin/"
ln -s "${stdenv.shell}" "$out/bin/sh"
ln -s "${pkgsNative.cacert}" "$out/etc-certs"
'';
};
in stdenv.mkDerivation {
@@ -42,6 +43,7 @@ in stdenv.mkDerivation {
local wrapper="usr/bin/$name"
( echo "#!/bin/sh"
echo "export SSL_CERT_FILE=${pkgsNative.cacert}/etc/ssl/certs/ca-bundle.crt"
echo "export PATH=\"$syspath/bin\''${PATH:+:}\$PATH\""
if [ -n "$fullpath" ]; then
echo "if chroot /mnt \"$syspath/bin/true\" > /dev/null 2>&1; then"
4 changes: 3 additions & 1 deletion tests/hetzner-backend/default.nix
View file
Original file line number Diff line number Diff line change
@@ -116,8 +116,10 @@ in makeTest {
(import ../../nix/hetzner-bootstrap.nix)
# ... and this is for other requirements for a basic deployment.
pkgs.stdenv pkgs.busybox pkgs.module_init_tools pkgs.grub2
pkgs.xfsprogs pkgs.btrfsProgs pkgs.docbook_xsl_ns pkgs.libxslt
pkgs.xfsprogs pkgs.btrfsProgs pkgs.docbook_xsl_ns
pkgs.docbook5 pkgs.ntp pkgs.perlPackages.ArchiveCpio
(pkgs.libxslt.dev or pkgs.libxslt)
(pkgs.libxml2.dev or pkgs.libxml2)
# Firmware used in <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
pkgs.firmwareLinuxNonfree
];
23 changes: 13 additions & 10 deletions tests/hetzner-backend/repository.nix
View file
Original file line number Diff line number Diff line change
@@ -3,6 +3,9 @@
}:

let
# Has to match with the version used in the Debian repository.
gnupg = pkgs.gnupg20;

reprepro = pkgs.stdenv.mkDerivation rec {
name = "reprepro-${version}";
version = "4.16.0";
@@ -13,10 +16,12 @@ let
sha256 = "14gmk16k9n04xda4446ydfj8cr5pmzsmm4il8ysf69ivybiwmlpx";
};

buildInputs = with pkgs; [ makeWrapper db gpgme libarchive bzip2 xz zlib ];
nativeBuildInputs = [ pkgs.makeWrapper ];
buildInputs = pkgs.lib.singleton (pkgs.gpgme.override { inherit gnupg; })
++ (with pkgs; [ db libarchive bzip2 xz zlib ]);

postInstall = ''
wrapProgram "$out/bin/reprepro" --prefix PATH : "${pkgs.gnupg}/bin"
wrapProgram "$out/bin/reprepro" --prefix PATH : "${gnupg}/bin"
'';
};

@@ -45,15 +50,13 @@ let
%echo Repository key created
EOF
${pkgs.gnupg}/bin/gpg2 --batch --gen-key template
${gnupg}/bin/gpg2 --batch --gen-key template
${pkgs.gnupg}/bin/gpg2 --list-secret-keys | \
sed -n -re 's,^sec +[^/]*/([^ ]+).*,\1,p' \
> "$secretKeyId"
${pkgs.gnupg}/bin/gpg2 --list-public-keys | \
sed -n -re 's,^pub +[^/]*/([^ ]+).*,\1,p' \
> "$publicKeyId"
${pkgs.gnupg}/bin/gpg2 --export \
${gnupg}/bin/gpg2 --list-secret-keys --with-colons | \
grep '^sec:' | cut -d: -f5 > "$secretKeyId"
${gnupg}/bin/gpg2 --list-public-keys --with-colons | \
grep '^pub:' | cut -d: -f5 > "$publicKeyId"
${gnupg}/bin/gpg2 --export \
"$(< "$publicKeyId")" \
> "$publicKey"
'';