diff --git a/.github/workflows/actionci.yml b/.github/workflows/actionci.yml index 9a3f9e2..f8482e6 100644 --- a/.github/workflows/actionci.yml +++ b/.github/workflows/actionci.yml @@ -16,6 +16,7 @@ jobs: actionci: permissions: contents: read + actions: read security-events: write uses: smallstep/workflows/.github/workflows/actionci.yml@main secrets: inherit diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 7890712..ebf3a77 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -10,23 +10,8 @@ on: permissions: read-all jobs: - release-check: - permissions: {} - runs-on: ubuntu-latest - outputs: - is-release: ${{ steps.condition-check.outputs.match }} - steps: - - id: condition-check - uses: actions-ecosystem/action-regex-match@9e6c4fb3d5e898f505be7a1fb6e7b0a278f6665b # v2.0.2 - with: - # matches: package_name: vX.Y.Z -> vX.Y.Z where XYZ are digits (including rc, e.g: vX.Y.Z-rcN) - # it detects a commit from goreleaser with a new nix package version. - regex: '\s*[a-zA-Z][\w]+:\s*v\d+\.\d+\.\d+(-rc\d+)?\s*->\s*v\d+\.\d+\.\d+(-rc\d+)?' - text: ${{ github.event.head_commit.message }} - tests: permissions: {} - needs: release-check strategy: matrix: nixPath: @@ -35,7 +20,6 @@ jobs: - nixpkgs=https://github.com/NixOS/nixpkgs/archive/refs/heads/nixos-25.11.tar.gz runs-on: ubuntu-latest - if: needs.release-check.outputs.is-release != '' steps: - name: Checkout repository uses: actions/checkout@v6 @@ -55,50 +39,7 @@ jobs: --option restrict-eval true \ --option allow-import-from-derivation true \ --drv-path --show-trace \ - -I nixpkgs=$(nix-instantiate --find-file nixpkgs) \ - -I $PWD + -I "nixpkgs=$(nix-instantiate --find-file nixpkgs)" \ + -I "$PWD" - name: Build nix packages run: nix shell -f '' nix-build-uncached -c nix-build-uncached ci.nix -A cacheOutputs - - add-pkg: - permissions: - contents: write - needs: [release-check, tests] - runs-on: ubuntu-latest - - if: needs.release-check.outputs.is-release != '' - steps: - - name: Configure PAT for git push - run: | - git config --global url.https://${{ secrets.NUR_PAT }}@github.com/.insteadOf https://github.com/ - - - name: Checkout repository - uses: actions/checkout@v6 - with: - token: ${{ secrets.NUR_PAT }} - - - name: Make addpkg script executable - run: chmod +x ./addpkg.sh - - name: Execute addpkg.sh to update nix package's catalog - run: ./addpkg.sh step-agent - - name: Setup bot SSH signing key - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0 - env: - HAS_SSH_PRIVATE_KEY: ${{ secrets.STEP_TRAVIS_CI_GH_PRIVATE_SIGNING_KEY != '' }} - if: ${{ env.HAS_SSH_PRIVATE_KEY == 'true' }} - with: - ssh-private-key: | - ${{ secrets.STEP_TRAVIS_CI_GH_PRIVATE_SIGNING_KEY }} - - name: Add and Commit default.nix - run: | - git config user.email "eng+ci@smallstep.com" - git config user.name "step-ci" - - # Configure GH commit signing key. - git config --global commit.gpgsign true - git config --global gpg.format ssh - git config --global user.signingkey "${{ secrets.STEP_TRAVIS_CI_GH_PUBLIC_SIGNING_KEY }}" - - git add default.nix && git commit -m "Add new package to default.nix" - - name: Push changes - run: git push diff --git a/README.md b/README.md index 1c7ab33..304342d 100644 --- a/README.md +++ b/README.md @@ -77,5 +77,23 @@ $ step-agent version ``` 8. More information about `step-agent` can be found on the following page: [Step Agent docs](https://smallstep.com/docs/platform/smallstep-app/) + +## Packaging + +Attributes are generated from the contents of `pkgs/`. Every +`pkgs//_.nix` is registered automatically as +`_`, with `.` replaced by `_`: + +| File | Attribute | +|------|-----------| +| `pkgs/step-agent/step-agent_0.69.0.nix` | `step-agent_0_69_0` | +| `pkgs/step-agent/step-agent_0.69.1-rc1.nix` | `step-agent_0_69_1-rc1` | + +The unsuffixed `step-agent` attribute is the highest **stable** version present +— prereleases are only reachable by their explicit attribute. + +Releasing is therefore just committing the derivation: goreleaser writes the +file from `smallstep/agent` and there is no package list to keep in sync. + ![Build and populate cache](https://github.com/smallstep/nur/workflows/Build%20and%20populate%20cache/badge.svg) diff --git a/addpkg.sh b/addpkg.sh deleted file mode 100755 index 3d52b04..0000000 --- a/addpkg.sh +++ /dev/null @@ -1,58 +0,0 @@ -#!/bin/bash - -[ $# -lt 1 ] && { - echo "usage: $0 " - exit 1 -} - -pkg="$1" -pkg_with_version=$(basename $(ls -1 pkgs/${pkg}/${pkg}_* | sort -Vr | head -n 1) .nix) -pkg_name="$(echo ${pkg_with_version} | tr '.' '_')" -nix_entry="pkgs.callPackage ./pkgs/${pkg}/${pkg_with_version}.nix { };" - -unameOut="$(uname -s)" -OS=Linux - -case "${unameOut}" in -Darwin*) OS=Mac ;; -esac - -# Handle differences between MacOS and Linux sed implementation. -if [ "$OS" = "Mac" ]; then - xsed() { - sed -i "" "$@" - } -else - xsed() { - sed -i "$@" - } -fi - -# Add a new entry for the package version to default.nix, including rc and dev releases. -# Example, for a ${pkg_with_version} = "step-agent_0_65_0-rc11", the entry below would be added: -# step-agent_0_65_0-rc11 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.0-rc11.nix { }; -if ! grep -Eqs "${pkg_with_version}[[:blank:]]*=" default.nix; then - echo "Adding new package entry to default.nix: pkg=$pkg version=$version" - - xsed "//a\\ - ${pkg_name} = ${nix_entry}" default.nix -fi - -# Check if package is a stable release, if so we update the default step-agent package entry to point to it. -# Otherwise quit. -if [[ ! "$pkg_with_version" =~ _[0-9]+_[0-9]+_[0-9]+$ ]]; then - echo "Non stable release $pkg_with_version, skipping default package update." - exit 0 -fi - -# patch default package name to point to the latest version -if ! grep -Eqs "${pkg}[[:blank:]]*=" default.nix; then - echo "Adding default $pkg package entry..." - - xsed "//a\\ - ${pkg} = ${nix_entry}" default.nix -else - echo "Updating $pkg to point to new version $version" - - xsed "s#^.*${pkg} *=.*\$# ${pkg} = ${nix_entry}#" default.nix -fi diff --git a/default.nix b/default.nix index 35335c9..7e17286 100644 --- a/default.nix +++ b/default.nix @@ -8,43 +8,57 @@ { pkgs ? import { } }: +let + inherit (pkgs) lib; + + # Every derivation under pkgs// is registered automatically, so this + # attribute set can never drift from what goreleaser has committed. Releases + # add a file and nothing else: there is no package list to keep in sync. + # + # pkgs/step-agent/step-agent_0.69.0.nix -> step-agent_0_69_0 + # pkgs/step-agent/step-agent_0.69.0-rc1.nix -> step-agent_0_69_0-rc1 + # + # Version and attribute name differ only in the separator, so we keep both. + releasesOf = name: + let + dir = ./pkgs + "/${name}"; + isRelease = file: type: type == "regular" && lib.hasSuffix ".nix" file; + versionOf = file: lib.removePrefix "${name}_" (lib.removeSuffix ".nix" file); + in + lib.mapAttrsToList + (file: _: rec { + version = versionOf file; + attr = "${name}_${builtins.replaceStrings [ "." ] [ "_" ] version}"; + package = pkgs.callPackage (dir + "/${file}") { }; + }) + (lib.filterAttrs isRelease (builtins.readDir dir)); + + # A release is stable when its version carries no -rc/-dev/nightly suffix. + isStable = release: builtins.match "[0-9]+\\.[0-9]+\\.[0-9]+" release.version != null; + + newest = releases: + lib.head (lib.sort (a: b: builtins.compareVersions a.version b.version > 0) releases); + + # `nur.repos.smallstep.step-agent` is the obvious thing to type, so it has to + # mean the current stable release rather than whichever file happens to sort + # last -- `sort -V` ranks 0.68.0-rc1 above 0.68.0, and prerelease lines run + # ahead of stable ones. + packageSet = name: + let + releases = releasesOf name; + byAttr = lib.listToAttrs + (map (r: lib.nameValuePair r.attr r.package) releases); + stable = lib.filter isStable releases; + in + byAttr // lib.optionalAttrs (stable != [ ]) { + ${name} = (newest stable).package; + }; + +in { # The `lib`, `modules`, and `overlays` names are special lib = import ./lib { inherit pkgs; }; # functions modules = import ./modules; # NixOS modules overlays = import ./overlays; # nixpkgs overlays - - # : DO NOT REMOVE THIS LINE - step-agent_0_70_0-rc2 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.70.0-rc2.nix { }; - step-agent_0_70_0-rc1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.70.0-rc1.nix { }; - step-agent_0_68_0-rc1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.68.0-rc1.nix { }; - step-agent_0_67_4-rc12 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc12.nix { }; - step-agent_0_67_4-rc11 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc11.nix { }; - step-agent_0_67_4-rc10 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc10.nix { }; - step-agent_0_67_4-rc9 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc9.nix { }; - step-agent_0_67_4-rc8 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc8.nix { }; - step-agent_0_67_4-rc7 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc7.nix { }; - step-agent_0_67_4-rc6 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc6.nix { }; - step-agent_0_67_4-rc4 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc4.nix { }; - step-agent_0_67_4-rc3 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc3.nix { }; - step-agent_0_67_4-rc2 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc2.nix { }; - step-agent_0_67_4-rc1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.4-rc1.nix { }; - step-agent_0_67_3-rc3 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.3-rc3.nix { }; - step-agent_0_67_3-rc2 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.3-rc2.nix { }; - step-agent_0_67_3-rc1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.3-rc1.nix { }; - step-agent_0_67_2 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.2.nix { }; - step-agent_0_67_1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.1.nix { }; - step-agent_0_67_0 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.67.0.nix { }; - step-agent_0_66_0 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.66.0.nix { }; - step-agent_0_65_6 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.6.nix { }; - step-agent_0_65_5-rc2 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.5-rc2.nix { }; - step-agent_0_65_5-rc1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.5-rc1.nix { }; - step-agent_0_65_4 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.4.nix { }; - step-agent_0_65_2 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.2.nix { }; - step-agent_0_65_1 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.1.nix { }; - step-agent_0_65_0-rc21 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.0-rc21.nix { }; - step-agent_0_65_0-rc20 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.0-rc20.nix { }; - step-agent_0_65_0-rc19 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.0-rc19.nix { }; - step-agent = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.0-rc11.nix { }; - step-agent_0_65_0-rc11 = pkgs.callPackage ./pkgs/step-agent/step-agent_0.65.0-rc11.nix { }; } +// packageSet "step-agent" diff --git a/pkgs/step-agent/step-agent_0.0.0-nightly.20260327.nix b/pkgs/step-agent/step-agent_0.0.0-nightly.20260327.nix deleted file mode 100644 index fc6ff2e..0000000 --- a/pkgs/step-agent/step-agent_0.0.0-nightly.20260327.nix +++ /dev/null @@ -1,62 +0,0 @@ -# This file was generated by GoReleaser. DO NOT EDIT. -# vim: set ft=nix ts=2 sw=2 sts=2 et sta -{ - lib, - fetchurl, - installShellFiles, - stdenvNoCC, - stdenv, - autoPatchelfHook, - desktop-file-utils, - makeWrapper, - p11-kit, - polkit, - tpm2-openssl, - tpm2-tss, -}: -let - inherit (stdenvNoCC.hostPlatform) system; - shaMap = { - x86_64-linux = "0a2hvvnp3zvn6d9z4jn9r0il5cswq9g9qi3p298xld6880lb0jgz"; - aarch64-linux = "1si1nsd2g34ml6c71zlj9hk0q2sypmsk4f9xf118p4hq8gcz423j"; - }; - - urlMap = { - x86_64-linux = "https://github.com/smallstep/agent/releases/download/v0.0.0-nightly.20260327/step-agent_0.0.0-nightly.20260327_linux_amd64.tar.gz"; - aarch64-linux = "https://github.com/smallstep/agent/releases/download/v0.0.0-nightly.20260327/step-agent_0.0.0-nightly.20260327_linux_arm64.tar.gz"; - }; -in -stdenvNoCC.mkDerivation { - pname = "step-agent-plugin"; - version = "0.0.0-nightly.20260327"; - src = fetchurl { - url = urlMap.${system}; - sha256 = shaMap.${system}; - }; - - sourceRoot = "."; - - nativeBuildInputs = [ installShellFiles makeWrapper ] ++ lib.optionals stdenvNoCC.isLinux [ autoPatchelfHook ]; - - buildInputs = lib.optionals stdenvNoCC.isLinux [ - stdenv.cc.cc.lib - ]; - - installPhase = '' - mkdir -p $out/bin - cp -vr ./step-agent $out/bin/step-agent - wrapProgram $out/bin/step-agent --prefix PATH : ${lib.makeBinPath (lib.optionals stdenvNoCC.isLinux [ tpm2-tss tpm2-openssl desktop-file-utils polkit p11-kit ])} - ''; - - meta = { - description = "step-agent-plugin is an automated certificate management agent plugin for step-cli."; - homepage = "https://github.com/smallstep/step-agent-plugin/"; - - sourceProvenance = [ lib.sourceTypes.binaryNativeCode ]; - - platforms = [ - "aarch64-linux" - "x86_64-linux" - ]; - }; -} diff --git a/pkgs/step-agent/step-agent_0.0.0-nightly.20260331.nix b/pkgs/step-agent/step-agent_0.0.0-nightly.20260331.nix deleted file mode 100644 index 4753b59..0000000 --- a/pkgs/step-agent/step-agent_0.0.0-nightly.20260331.nix +++ /dev/null @@ -1,62 +0,0 @@ -# This file was generated by GoReleaser. DO NOT EDIT. -# vim: set ft=nix ts=2 sw=2 sts=2 et sta -{ - lib, - fetchurl, - installShellFiles, - stdenvNoCC, - stdenv, - autoPatchelfHook, - desktop-file-utils, - makeWrapper, - p11-kit, - polkit, - tpm2-openssl, - tpm2-tss, -}: -let - inherit (stdenvNoCC.hostPlatform) system; - shaMap = { - x86_64-linux = "0cfm02v7yp4dv6dr3axpj5pysr5a57afc0wj0r1rbzf5mn0avsc9"; - aarch64-linux = "1xivymjana1fk333vnw8rkig6skh8mgg793fz4x6y0qd5ayid6i1"; - }; - - urlMap = { - x86_64-linux = "https://github.com/smallstep/agent/releases/download/v0.0.0-nightly.20260331/step-agent_0.0.0-nightly.20260331_linux_amd64.tar.gz"; - aarch64-linux = "https://github.com/smallstep/agent/releases/download/v0.0.0-nightly.20260331/step-agent_0.0.0-nightly.20260331_linux_arm64.tar.gz"; - }; -in -stdenvNoCC.mkDerivation { - pname = "step-agent-plugin"; - version = "0.0.0-nightly.20260331"; - src = fetchurl { - url = urlMap.${system}; - sha256 = shaMap.${system}; - }; - - sourceRoot = "."; - - nativeBuildInputs = [ installShellFiles makeWrapper ] ++ lib.optionals stdenvNoCC.isLinux [ autoPatchelfHook ]; - - buildInputs = lib.optionals stdenvNoCC.isLinux [ - stdenv.cc.cc.lib - ]; - - installPhase = '' - mkdir -p $out/bin - cp -vr ./step-agent $out/bin/step-agent - wrapProgram $out/bin/step-agent --prefix PATH : ${lib.makeBinPath (lib.optionals stdenvNoCC.isLinux [ tpm2-tss tpm2-openssl desktop-file-utils polkit p11-kit ])} - ''; - - meta = { - description = "step-agent-plugin is an automated certificate management agent plugin for step-cli."; - homepage = "https://github.com/smallstep/step-agent-plugin/"; - - sourceProvenance = [ lib.sourceTypes.binaryNativeCode ]; - - platforms = [ - "aarch64-linux" - "x86_64-linux" - ]; - }; -} diff --git a/pkgs/step-agent/step-agent_0.64.0-dev70.nix b/pkgs/step-agent/step-agent_0.64.0-dev70.nix deleted file mode 100644 index 5a804f9..0000000 --- a/pkgs/step-agent/step-agent_0.64.0-dev70.nix +++ /dev/null @@ -1,62 +0,0 @@ -# This file was generated by GoReleaser. DO NOT EDIT. -# vim: set ft=nix ts=2 sw=2 sts=2 et sta -{ - lib, - fetchurl, - installShellFiles, - stdenvNoCC, - stdenv, - autoPatchelfHook, - desktop-file-utils, - makeWrapper, - p11-kit, - polkit, - tpm2-openssl, - tpm2-tss, -}: -let - inherit (stdenvNoCC.hostPlatform) system; - shaMap = { - x86_64-linux = "1y377njw0cnclc7xif77gnqlnyhq5vx4x2aains9lbmsqz6vxs1m"; - aarch64-linux = "1bvi62npvn8hw5n683p8nw8z6zdqzh53zijz6z0cazwfzrnkyfky"; - }; - - urlMap = { - x86_64-linux = "https://github.com/smallstep/agent/releases/download/v0.64.0-dev70/step-agent_0.64.0-dev70_linux_amd64.tar.gz"; - aarch64-linux = "https://github.com/smallstep/agent/releases/download/v0.64.0-dev70/step-agent_0.64.0-dev70_linux_arm64.tar.gz"; - }; -in -stdenvNoCC.mkDerivation { - pname = "step-agent-plugin"; - version = "0.64.0-dev70"; - src = fetchurl { - url = urlMap.${system}; - sha256 = shaMap.${system}; - }; - - sourceRoot = "."; - - nativeBuildInputs = [ installShellFiles makeWrapper ] ++ lib.optionals stdenvNoCC.isLinux [ autoPatchelfHook ]; - - buildInputs = lib.optionals stdenvNoCC.isLinux [ - stdenv.cc.cc.lib - ]; - - installPhase = '' - mkdir -p $out/bin - cp -vr ./step-agent $out/bin/step-agent - wrapProgram $out/bin/step-agent --prefix PATH : ${lib.makeBinPath (lib.optionals stdenvNoCC.isLinux [ tpm2-tss tpm2-openssl desktop-file-utils polkit p11-kit ])} - ''; - - meta = { - description = "step-agent-plugin is an automated certificate management agent plugin for step-cli."; - homepage = "https://github.com/smallstep/step-agent-plugin/"; - - sourceProvenance = [ lib.sourceTypes.binaryNativeCode ]; - - platforms = [ - "aarch64-linux" - "x86_64-linux" - ]; - }; -} diff --git a/pkgs/step-agent/step-agent_0.64.0-dev72.nix b/pkgs/step-agent/step-agent_0.64.0-dev72.nix deleted file mode 100644 index 20bee54..0000000 --- a/pkgs/step-agent/step-agent_0.64.0-dev72.nix +++ /dev/null @@ -1,62 +0,0 @@ -# This file was generated by GoReleaser. DO NOT EDIT. -# vim: set ft=nix ts=2 sw=2 sts=2 et sta -{ - lib, - fetchurl, - installShellFiles, - stdenvNoCC, - stdenv, - autoPatchelfHook, - desktop-file-utils, - makeWrapper, - p11-kit, - polkit, - tpm2-openssl, - tpm2-tss, -}: -let - inherit (stdenvNoCC.hostPlatform) system; - shaMap = { - x86_64-linux = "0zm3r1llnxn60ai913rfbp231z2ha7642628gx02zsy8inmakcca"; - aarch64-linux = "0z4v5d5nrdz85q80ilv1ch34kkpj0c0c49c6giml74y2x8i9fqzb"; - }; - - urlMap = { - x86_64-linux = "https://github.com/smallstep/agent/releases/download/v0.64.0-dev72/step-agent_0.64.0-dev72_linux_amd64.tar.gz"; - aarch64-linux = "https://github.com/smallstep/agent/releases/download/v0.64.0-dev72/step-agent_0.64.0-dev72_linux_arm64.tar.gz"; - }; -in -stdenvNoCC.mkDerivation { - pname = "step-agent-plugin"; - version = "0.64.0-dev72"; - src = fetchurl { - url = urlMap.${system}; - sha256 = shaMap.${system}; - }; - - sourceRoot = "."; - - nativeBuildInputs = [ installShellFiles makeWrapper ] ++ lib.optionals stdenvNoCC.isLinux [ autoPatchelfHook ]; - - buildInputs = lib.optionals stdenvNoCC.isLinux [ - stdenv.cc.cc.lib - ]; - - installPhase = '' - mkdir -p $out/bin - cp -vr ./step-agent $out/bin/step-agent - wrapProgram $out/bin/step-agent --prefix PATH : ${lib.makeBinPath (lib.optionals stdenvNoCC.isLinux [ tpm2-tss tpm2-openssl desktop-file-utils polkit p11-kit ])} - ''; - - meta = { - description = "step-agent-plugin is an automated certificate management agent plugin for step-cli."; - homepage = "https://github.com/smallstep/step-agent-plugin/"; - - sourceProvenance = [ lib.sourceTypes.binaryNativeCode ]; - - platforms = [ - "aarch64-linux" - "x86_64-linux" - ]; - }; -}