Merge #128: Add content hashes for pinned channels

46edb39d2f Add content hashes for pinned channels (Erik Arvstedt)
961e8217a9 Rename contrib/ to helper/ (Erik Arvstedt)

Pull request description:

  Unhashed external content is bad for security and performance (due to
  re-fetches when the cache times out).
  Use this simple fix until https://github.com/fort-nix/nix-bitcoin/pull/78 is fleshed out.

  For testing, run this in the repo root dir:
  ```bash
  nix eval '(import ./pkgs/nixpkgs-pinned.nix)'
  ```

ACKs for top commit:
  jonasnick:
    ACK 46edb39d2f

Tree-SHA512: cb098a4714aecf00e8d0f9fe6d388b6322416c1d2f8d55b54dc16328145331a87a71fbf68e2faa85105727cbd6370542799f1c2d84ac2bee90a6710b96eba9bd
This commit is contained in:
Jonas Nick 2019-11-11 19:50:19 +00:00
commit bea9a87aae
No known key found for this signature in database
GPG Key ID: 4861DBF262123605
4 changed files with 21 additions and 4 deletions

View File

@ -128,7 +128,7 @@ See [usage.md](usage.md) for usage instructions, such as how to update.
To resize the VM disk image, you can use this helper script from within nix-shell: To resize the VM disk image, you can use this helper script from within nix-shell:
``` ```
./contrib/vbox-resize-disk1.sh --help ./helper/vbox-resize-disk1.sh --help
``` ```
---- ----

6
helper/fetch-channel Executable file
View File

@ -0,0 +1,6 @@
#!/usr/bin/env bash
rev=$1
sha256=$(nix-prefetch-url --unpack https://github.com/nixos/nixpkgs-channels/archive/$rev.tar.gz)
echo "rev = \"$rev\";"
echo "sha256 = \"$sha256\";"

View File

@ -1,7 +1,18 @@
let let
fetch = rev: builtins.fetchTarball "https://github.com/nixos/nixpkgs-channels/archive/${rev}.tar.gz"; fetch = { rev, sha256 }:
builtins.fetchTarball {
url = "https://github.com/nixos/nixpkgs-channels/archive/${rev}.tar.gz";
inherit sha256;
};
in in
{ {
nixpkgs = fetch "27a5ddcf747fb2bb81ea9c63f63f2eb3eec7a2ec"; # To update, run ../helper/fetch-channel REV
nixpkgs-unstable = fetch "4cd2cb43fb3a87f48c1e10bb65aee99d8f24cb9d"; nixpkgs = fetch {
rev = "27a5ddcf747fb2bb81ea9c63f63f2eb3eec7a2ec";
sha256 = "1bp11q2marsqj3g2prdrghkhmv483ab5pi078d83xkhkk2jh3h81";
};
nixpkgs-unstable = fetch {
rev = "4cd2cb43fb3a87f48c1e10bb65aee99d8f24cb9d";
sha256 = "1d6rmq67kdg5gmk94wx2774qw89nvbhy6g1f2lms3c9ph37hways";
};
} }