3 files changed, 119 insertions, 29 deletions

diff --git a/pkgs/by-name/ta/tails-iso/files.json b/pkgs/by-name/ta/tails-iso/files.json
new file mode 100644
index 00000000..bc00b07a
--- /dev/null
+++ b/pkgs/by-name/ta/tails-iso/files.json
@@ -0,0 +1,7 @@
+{
+  "version": "7.10",
+  "files": {
+    "iso.sig": "sha256-UDdZgDOrgcpQnWnnysmyy16CRQD2dzNvwauO/2ZpRz4=",
+    "iso": "sha256-basjshTPOlXXWpDf17GA57wmptqXv6FP/MAiON3NF0M="
+  }
+}
diff --git a/modules/by-name/bo/boot/tails_iso.nix b/pkgs/by-name/ta/tails-iso/package.nix
index ec2b740b..3acefd61 100644
--- a/modules/by-name/bo/boot/tails_iso.nix
+++ b/pkgs/by-name/ta/tails-iso/package.nix
@@ -7,21 +7,28 @@
 #
 # You should have received a copy of the License along with this program.
 # If not, see <https://www.gnu.org/licenses/gpl-3.0.txt>.
-{pkgs ? (builtins.getFlake "nixpkgs").legacyPackages."x86_64-linux"}: let
-  checked_iso = pkgs.stdenv.mkDerivation (finalAttrs: {
-    pname = "tails-iso";
-    version = "amd64-7.8";
+{
+  stdenv,
+  fetchurl,
+  sequoia-sq,
+  libarchive, # for bsdtar
+}: let
+  files = builtins.fromJSON (builtins.readFile (./files.json));
+
+  checked_iso = stdenv.mkDerivation (finalAttrs: {
+    pname = "raw-tails-iso";
+    version = "amd64-${files.version}";
 
     srcs = [
-      (pkgs.fetchurl {
+      (fetchurl {
         url = "https://tails.net/torrents/files/tails-${finalAttrs.version}.iso.sig";
-        hash = "sha256-58vDQdXQYYqeVUHzupmDPtVVpSrxtT25+gwHe2OfvkA=";
+        hash = files.files."iso.sig";
       })
-      (pkgs.fetchurl {
+      (fetchurl {
         url = "https://download.tails.net/tails/stable/tails-${finalAttrs.version}/tails-${finalAttrs.version}.iso";
-        hash = "sha256-ewLHQ+3iI3aHgvKdBgysQ9QAudQ7AM83WP+VdYFmxt0=";
+        hash = files.files."iso";
       })
-      (pkgs.fetchurl {
+      (fetchurl {
         url = "https://tails.net/tails-signing.key";
         hash = "sha256-OwdqyM7o7K6F5Km0U1RU3hzsnaT+Yw0sjQk/thMeq1k=";
       })
@@ -30,38 +37,35 @@
     dontUnpack = true;
 
     nativeBuildInputs = [
-      pkgs.sequoia-sq
+      sequoia-sq
     ];
 
-    buildPhase =
-      /*
-      bash
-      */
-      ''
-        for src in $srcs; do
-          cp --recursive "$src" "$(stripHash "$src")"
-        done
+    buildPhase = ''
+      for src in $srcs; do
+        cp --recursive "$src" "$(stripHash "$src")"
+      done
 
-        sq verify \
-          --signer-file=tails-signing.key \
-          --signature-file=tails-${finalAttrs.version}.iso.sig \
-          tails-${finalAttrs.version}.iso
-      '';
+      sq verify \
+        --signer-file=tails-signing.key \
+        --signature-file=tails-${finalAttrs.version}.iso.sig \
+        tails-${finalAttrs.version}.iso
+    '';
 
     installPhase = ''
       cp tails-${finalAttrs.version}.iso "$out";
     '';
   });
 in
-  pkgs.stdenv.mkDerivation {
-    name = "live_iso_boot_entry";
+  stdenv.mkDerivation {
+    pname = "tails-iso-package";
+    inherit (checked_iso) version;
 
     src = checked_iso;
 
     dontUnpack = true;
 
-    nativeBuildInputs = with pkgs; [
-      libarchive # for bsdtar
+    nativeBuildInputs = [
+      libarchive
     ];
 
     buildPhase = ''
@@ -69,10 +73,15 @@ in
       bsdtar -xf "$src" -C iso
     '';
 
+    passthru = {
+      inherit (files) version;
+    };
+
     installPhase = ''
-      install -D ./iso/live/initrd.img "$out/live/initramfs-linux.img"
+      install -D "$src" "$out/tails.iso"
       install -D ./iso/live/vmlinuz "$out/live/vmlinuz-linux"
+      install -D ./iso/live/initrd.img "$out/live/initrd.img"
 
-      install -D "$src" "$out/tails.iso"
+      chmod --recursive -x $out/tails.iso $out/live/*
     '';
   }
diff --git a/pkgs/by-name/ta/tails-iso/update.sh b/pkgs/by-name/ta/tails-iso/update.sh
new file mode 100755
index 00000000..fbd0fc77
--- /dev/null
+++ b/pkgs/by-name/ta/tails-iso/update.sh
@@ -0,0 +1,74 @@
+#! /usr/bin/env sh
+
+set -e
+
+root="$(git rev-parse --show-toplevel)"
+
+cd "$root/pgks/by-name/ta/tails-iso/"
+
+tmpHomePath="$(mktemp -d "${TMPDIR:-/tmp}/nix-prefetch-url-XXXXXXXXXX")"
+cleanup() {
+    chmod -R u+w "$tmpHomePath"
+    rm -rf "$tmpHomePath"
+}
+trap cleanup EXIT
+
+info() {
+    echo "$1" 1>&2
+}
+
+# Returns a name based on the url and reference
+#
+# This function needs to be in sync with nix's fetchgit implementation
+# of urlToName() to re-use the same nix store paths.
+url_to_name() {
+    url=$1
+
+    basename "$url" .git | cut -d: -f2
+}
+
+get_sha256() {
+    url="$1"
+    storePathName="$(url_to_name "$url")"
+    hashType="sha256"
+
+    tmpOut="$tmpHomePath/$storePathName"
+    info "Prefetching '$url'..."
+
+    curl --follow "$url" >"$tmpOut"
+
+    # Compute the hash.
+    hash=$(nix-hash --flat --type "$hashType" --sri "$tmpOut")
+
+    # Add the downloaded file to the Nix store.
+    finalPath=$(nix-store --add-fixed "$hashType" "$tmpOut")
+
+    info "  -> Downloaded to '$finalPath'"
+    echo "$hash"
+}
+
+new_version="$(curl --follow https://download.tails.net/tails/stable/ 2>/dev/null | html2text -links | grep --regexp='\s*[0-9]\. tails-amd64-' | sed 's/\s*[0-9]\. tails-amd64-\(.*\)\//\1/')"
+
+# The `files.json` file might not be present, if a previous update failed.
+if test -f ./files.json; then
+    old_version="$(jq .version --raw-output <./files.json)"
+
+    if [ "$old_version" = "$new_version" ]; then
+        # No need to update.
+        exit 0
+    fi
+fi
+
+final_version="amd64-$new_version"
+
+cat <<EOF | jq . | tee ./files.json
+{
+    "version": "$new_version",
+    "files": {
+        "iso.sig": "$(get_sha256 "https://tails.net/torrents/files/tails-$final_version.iso.sig")",
+        "iso": "$(get_sha256 "https://download.tails.net/tails/stable/tails-$final_version/tails-$final_version.iso")"
+    }
+}
+EOF
+
+# vim: ft=sh