diff options
| -rw-r--r-- | pkgs/by-name/ta/tails-iso/files.json | 7 | ||||
| -rw-r--r-- | pkgs/by-name/ta/tails-iso/package.nix | 10 | ||||
| -rwxr-xr-x | pkgs/by-name/ta/tails-iso/update.sh | 66 |
3 files changed, 78 insertions, 5 deletions
diff --git a/pkgs/by-name/ta/tails-iso/files.json b/pkgs/by-name/ta/tails-iso/files.json new file mode 100644 index 00000000..0e42badf --- /dev/null +++ b/pkgs/by-name/ta/tails-iso/files.json @@ -0,0 +1,7 @@ +{ + "version": "7.8.1", + "files": { + "iso.sig": "sha256-DQm+EHe0KllmzLQzGU61cqaRDNjhU3KUCtDzHKDwWck=", + "iso": "sha256-Y4Sch1ZgWUODi9rxcXimVrFvicXPCN6SgLvINvJGcvw=" + } +} diff --git a/pkgs/by-name/ta/tails-iso/package.nix b/pkgs/by-name/ta/tails-iso/package.nix index d790befd..b74e4023 100644 --- a/pkgs/by-name/ta/tails-iso/package.nix +++ b/pkgs/by-name/ta/tails-iso/package.nix @@ -13,20 +13,20 @@ sequoia-sq, libarchive, # for bsdtar }: let - version = "7.8.1"; + files = builtins.fromJSON (builtins.readFile (./files.json)); checked_iso = stdenv.mkDerivation (finalAttrs: { pname = "tails-iso"; - version = "amd64-${version}"; + version = "amd64-${files.version}"; srcs = [ (fetchurl { url = "https://tails.net/torrents/files/tails-${finalAttrs.version}.iso.sig"; - hash = "sha256-DQm+EHe0KllmzLQzGU61cqaRDNjhU3KUCtDzHKDwWck="; + hash = files.files."iso.sig"; }) (fetchurl { url = "https://download.tails.net/tails/stable/tails-${finalAttrs.version}/tails-${finalAttrs.version}.iso"; - hash = "sha256-Y4Sch1ZgWUODi9rxcXimVrFvicXPCN6SgLvINvJGcvw="; + hash = files.files."iso"; }) (fetchurl { url = "https://tails.net/tails-signing.key"; @@ -77,7 +77,7 @@ in ''; passthru = { - inherit version; + inherit (files) version; }; installPhase = '' diff --git a/pkgs/by-name/ta/tails-iso/update.sh b/pkgs/by-name/ta/tails-iso/update.sh new file mode 100755 index 00000000..5a2a81cd --- /dev/null +++ b/pkgs/by-name/ta/tails-iso/update.sh @@ -0,0 +1,66 @@ +#! /usr/bin/env sh + +set -e + +tmpHomePath="$(mktemp -d "${TMPDIR:-/tmp}/nix-prefetch-url-XXXXXXXXXX")" +cleanup() { + chmod -R u+w "$tmpHomePath" + rm -rf "$tmpHomePath" +} +trap cleanup EXIT + +info() { + echo "$1" 1>&2 +} + +# Returns a name based on the url and reference +# +# This function needs to be in sync with nix's fetchgit implementation +# of urlToName() to re-use the same nix store paths. +url_to_name() { + url=$1 + + basename "$url" .git | cut -d: -f2 +} + +get_sha256() { + url="$1" + storePathName="$(url_to_name "$url")" + hashType="sha256" + + tmpOut="$tmpHomePath/$storePathName" + info "Prefetching '$url'..." + + curl --follow "$url" >"$tmpOut" + + # Compute the hash. + hash=$(nix-hash --flat --type "$hashType" --sri "$tmpOut") + + # Add the downloaded file to the Nix store. + finalPath=$(nix-store --add-fixed "$hashType" "$tmpOut") + + info " -> Downloaded to '$finalPath'" + echo "$hash" +} + +old_version="$(jq .version --raw-output <./files.json)" +new_version="$(curl --follow https://download.tails.net/tails/stable/ 2>/dev/null | html2text -links | grep --regexp='\s*[0-9]\. tails-amd64-' | sed 's/\s*[0-9]\. tails-amd64-\(.*\)\//\1/')" + +if [ "$old_version" = "$new_version" ]; then + # No need to update. + info exit 0 +fi + +final_version="amd64-$new_version" + +cat <<EOF | jq . | tee ./files.json +{ + "version": "$new_version", + "files": { + "iso.sig": "$(get_sha256 "https://tails.net/torrents/files/tails-$final_version.iso.sig")", + "iso": "$(get_sha256 "https://download.tails.net/tails/stable/tails-$final_version/tails-$final_version.iso")" + } +} +EOF + +# vim: ft=sh |