nixpkgs/pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh
David McFarland b60c9fd2fe nuget-to-nix: find sources deterministically
The source used to download a particular package still isn't
deterministic in nuget. Even worse, the hash of the package can vary
between sources. This makes nuget use the first enabled source
containing the package.

The order of the dependencies may be slightly different because it now
uses glob order of the lower-case package names and versions, instead of
sorting the output.

If the package actually downloaded was the first source that contains
the package, then it will be hashed from disk to avoid downloading it
again.
2022-10-02 16:09:27 -03:00

85 lines
2.4 KiB
Bash
Executable File

#!@runtimeShell@
set -euo pipefail
export PATH="@binPath@"
# used for glob ordering of package names
export LC_ALL=C
if [ $# -eq 0 ]; then
>&2 echo "Usage: $0 <packages directory> [path to excluded package source] > deps.nix"
exit 1
fi
pkgs=$1
tmp=$(realpath "$(mktemp -td nuget-to-nix.XXXXXX)")
trap 'rm -r "$tmp"' EXIT
excluded_source=$(realpath "${2:-$tmp/empty}")
export DOTNET_NOLOGO=1
export DOTNET_CLI_TELEMETRY_OPTOUT=1
mapfile -t sources < <(dotnet nuget list source --format short | awk '/^E / { print $2 }')
declare -A base_addresses
for index in "${sources[@]}"; do
base_addresses[$index]=$(
curl --compressed --netrc -fsL "$index" | \
jq -r '.resources[] | select(."@type" == "PackageBaseAddress/3.0.0")."@id"')
done
echo "{ fetchNuGet }: ["
cd "$pkgs"
for package in *; do
cd "$package"
for version in *; do
id=$(xq -r .package.metadata.id "$version/$package".nuspec)
if [[ -e "$excluded_source/$id.$version".nupkg ]]; then
continue
fi
used_source="$(jq -r '.source' "$version"/.nupkg.metadata)"
for source in "${sources[@]}"; do
url="${base_addresses[$source]}$package/$version/$package.$version.nupkg"
if [[ "$source" == "$used_source" ]]; then
sha256="$(nix-hash --type sha256 --flat --base32 "$version/$package.$version".nupkg)"
found=true
break
else
if sha256=$(nix-prefetch-url "$url" 2>"$tmp"/error); then
# If multiple remote sources are enabled, nuget will try them all
# concurrently and use the one that responds first. We always use the
# first source that has the package.
echo "$package $version is available on $url, but was downloaded from ${base_addresses[$used_source]}$package/$version/$package.$version.nupkg" 1>&2
found=true
break
else
if ! grep -q 'HTTP error 404' "$tmp/error"; then
cat "$tmp/error" 1>&2
exit 1
fi
fi
fi
done
if ! ${found-false}; then
echo "couldn't find $package $version" >&2
exit 1
fi
if [[ "$source" != https://api.nuget.org/v3/index.json ]]; then
echo " (fetchNuGet { pname = \"$id\"; version = \"$version\"; sha256 = \"$sha256\"; url = \"$url\"; })"
else
echo " (fetchNuGet { pname = \"$id\"; version = \"$version\"; sha256 = \"$sha256\"; })"
fi
done
cd ..
done
cat << EOL
]
EOL