tailscale/update-flake.sh

#!/bin/sh
# Updates SRI hashes for flake.nix.

set -eu

REV=$(cat go.toolchain.rev)

OUT=$(mktemp -d -t nar-hash-XXXXXX)
rm -rf $OUT

./tool/go mod vendor -o $OUT
./tool/go run tailscale.com/cmd/nardump --sri $OUT >go.mod.sri
rm -rf $OUT

# nix-direnv only watches the top-level nix file for changes. As a
# result, when we change a referenced SRI file, we have to cause some
# change to shell.nix and flake.nix as well, so that nix-direnv
# notices and reevaluates everything. Sigh.
perl -pi -e "s,# nix-direnv cache busting line:.*,# nix-direnv cache busting line: $(cat go.mod.sri)," shell.nix
perl -pi -e "s,# nix-direnv cache busting line:.*,# nix-direnv cache busting line: $(cat go.mod.sri)," flake.nix
update-flake.sh: tooling to keep Nix SRI hashes in sync. Also fixes the Go toolchain SRI hash from a7f05c6bb0fed3f060435f0828625f705839d56d, it turns out I initialized the file with an SRI hash for an older toolchain version, and because of the unique way fixed-output derivations work in nix, nix didn't tell me about the mismatch because it just cache-hit on the older toolchain and moved on. Sigh. Updates #6845. Signed-off-by: David Anderson <danderson@tailscale.com> 1 year ago			`#!/bin/sh`
			`# Updates SRI hashes for flake.nix.`

			`set -eu`

			`REV=$(cat go.toolchain.rev)`

			`OUT=$(mktemp -d -t nar-hash-XXXXXX)`
			`rm -rf $OUT`

.github/workflows: add workflow to update go.mod Nix SRI hash So that I just get a quick PR to approve and merge instead of periodically discovering that the SRI hash has bitrotted. Signed-off-by: David Anderson <danderson@tailscale.com> 1 year ago			`./tool/go mod vendor -o $OUT`
			`./tool/go run tailscale.com/cmd/nardump --sri $OUT >go.mod.sri`
update-flake.sh: tooling to keep Nix SRI hashes in sync. Also fixes the Go toolchain SRI hash from a7f05c6bb0fed3f060435f0828625f705839d56d, it turns out I initialized the file with an SRI hash for an older toolchain version, and because of the unique way fixed-output derivations work in nix, nix didn't tell me about the mismatch because it just cache-hit on the older toolchain and moved on. Sigh. Updates #6845. Signed-off-by: David Anderson <danderson@tailscale.com> 1 year ago			`rm -rf $OUT`

			`# nix-direnv only watches the top-level nix file for changes. As a`
			`# result, when we change a referenced SRI file, we have to cause some`
			`# change to shell.nix and flake.nix as well, so that nix-direnv`
			`# notices and reevaluates everything. Sigh.`
go.toolchain.rev: use new statically built toolchain Also removes the toolchain builds from flake.nix. For now the flake build uses upstream Go 1.20, a followup change will switch it back to our custom toolchain. Updates tailscale/corp#9005 Signed-off-by: David Anderson <danderson@tailscale.com> 1 year ago			`perl -pi -e "s,# nix-direnv cache busting line:.*,# nix-direnv cache busting line: $(cat go.mod.sri)," shell.nix`
			`perl -pi -e "s,# nix-direnv cache busting line:.*,# nix-direnv cache busting line: $(cat go.mod.sri)," flake.nix`