@@ -1,16 +1,33 @@
1−{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
1+{ lib, buildGoModule, fetchFromGitHub, fetchgit, installShellFiles }:
22
33buildGoModule rec {
44 pname = "scorecard";
5− version = "2.2.8";
5+ version = "3.0.1";
66
77 src = fetchFromGitHub {
88 owner = "ossf";
99 repo = pname;
1010 rev = "v${version}";
11− sha256 = "sha256-U29NCZFXOhu0xLfDlJ1Q7m8TbAm+C6+ecYFhcI5gg6s=";
11+ sha256 = "sha256-19XDAgv9ARCZ7eNlWUPcsbGNyKA9vYFry8m6D3+vQP8=";
12+ # populate values otherwise taken care of by goreleaser,
13+ # unfortunately these require us to use git. By doing
14+ # this in postFetch we can delete .git afterwards and
15+ # maintain better reproducibility of the src.
16+ leaveDotGit = true;
17+ postFetch = ''
18+ cd "$out"
19+
20+ commit="$(git rev-parse HEAD)"
21+ source_date_epoch=$(git log --date=iso8601-strict -1 --pretty=%ct)
22+
23+ substituteInPlace "$out/pkg/scorecard_version.go" \
24+ --replace 'gitCommit = "unknown"' "gitCommit = \"$commit\"" \
25+ --replace 'buildDate = "unknown"' "buildDate = \"$source_date_epoch\""
26+
27+ find "$out" -name .git -print0 | xargs -0 rm -rf
28+ '';
1229 };
13− vendorSha256 = "sha256-hOATCXjBE0doHnY2BaRKZocQ6SIigL0q4m9eEJGKh6Q=";
30+ vendorSha256 = "sha256-ucF26pTEvG8tkzsyC9WNbvl8QCeetKBvBIcQL2NTfjo=";
1431
1532 # Install completions post-install
1633 nativeBuildInputs = [ installShellFiles ];
@@ -20,8 +37,8 @@ buildGoModule rec {
2037 ldflags = [
2138 "-s"
2239 "-w"
23− "-X github.com/ossf/scorecard/v2/pkg.gitVersion=v${version}"
24− "-X github.com/ossf/scorecard/v2/pkg.gitTreeState=clean"
40+ "-X github.com/ossf/scorecard/v${lib.versions.major version}/pkg.gitVersion=v${version}"
41+ "-X github.com/ossf/scorecard/v${lib.versions.major version}/pkg.gitTreeState=clean"
2542 ];
2643
2744 preCheck = ''