@@ -157,17 +157,46 @@ let
157157 # restricted-eval mode (as long as a sha256 is included).
158158 # Replace source-repository-package blocks that have a sha256 with
159159 # packages: block containing nix store paths of the fetched repos.
160+
161+ hashPath = path:
162+ builtins.readFile (pkgs.runCommand "hash-path" { preferLocalBuild = true; }
163+ "echo -n $(${pkgs.nix}/bin/nix-hash --type sha256 --base32 ${path}) > $out");
164+
160165 replaceSoureRepos = projectFile:
161166 let
167+ fetchRepo = fetchgit: repoData:
168+ let
169+ fetched =
170+ if repoData.sha256 != null
171+ then fetchgit { inherit (repoData) url sha256; rev = repoData.ref; }
172+ else
173+ let drv = builtins.fetchGit { inherit (repoData) url ref; };
174+ in __trace "WARNING: No sha256 found for source-repository-package ${repoData.url} ${repoData.ref} download may fail in restricted mode (hydra)"
175+ (__trace "Consider adding `--sha256: ${hashPath drv}` to the ${cabalProjectFileName} file or passing in a lookupSha256 argument"
176+ drv);
177+ in fetched + (if repoData.subdir == "." then "" else "/" + repoData.subdir);
178+
162179 blocks = pkgs.lib.splitString "\nsource-repository-package\n" ("\n" + projectFile);
163180 initialText = pkgs.lib.lists.take 1 blocks;
164181 repoBlocks = builtins.map (pkgs.haskell-nix.haskellLib.parseBlock cabalProjectFileName lookupSha256) (pkgs.lib.lists.drop 1 blocks);
165− sourceRepos = pkgs.lib.lists.concatMap (x: x.sourceRepo) repoBlocks;
182+ sourceRepoData = pkgs.lib.lists.concatMap (x: x.sourceRepo) repoBlocks;
166183 otherText = pkgs.evalPackages.writeText "cabal.project" (pkgs.lib.strings.concatStringsSep "\n" (
167184 initialText
168185 ++ (builtins.map (x: x.otherText) repoBlocks)));
186+
187+ # we need the repository content twice:
188+ # * at eval time (below to build the fixed project file)
189+ # Here we want to use pkgs.evalPackages.fetchgit, so one can calculate
190+ # the build plan for any target without a remote builder
191+ # * at built time (passed out)
192+ # Here we want to use plain pkgs.fetchgit, which is what a builder
193+ # on the target system would use, so that the derivation is unaffected
194+ # and, say, a linux release build job can identify the derivation
195+ # as built by a darwin builder, and fetch it from a cache
196+ sourceReposBuild = builtins.map (fetchRepo pkgs.evalPackages.fetchgit) sourceRepoData ;
197+ sourceReposEval = builtins.map (fetchRepo pkgs.fetchgit) sourceRepoData;
169198 in {
170− inherit sourceRepos;
199+ sourceRepos = sourceReposBuild;
171200 makeFixedProjectFile = ''
172201 cp -f ${otherText} ./cabal.project
173202 chmod +w -R ./cabal.project
@@ -184,18 +213,15 @@ let
184213 "${f}/" "./.source-repository-packages/${builtins.toString n}/"
185214 echo " ./.source-repository-packages/${builtins.toString n}" >> ./cabal.project
186215 '')
187− (pkgs.lib.lists.range 0 ((builtins.length fixedProject.sourceRepos) - 1))
188− sourceRepos
216+ (pkgs.lib.lists.range 0 ((builtins.length sourceReposEval) - 1))
217+ sourceReposEval
189218 )
190219 );
191220 };
192221
193222 fixedProject =
194223 if rawCabalProject == null
195− then {
196− sourceRepos = [];
197− makeFixedProjectFile = "";
198− }
224+ then { sourceRepos = []; makeFixedProjectFile = ""; }
199225 else replaceSoureRepos rawCabalProject;
200226
201227 # The use of the actual GHC can cause significant problems: