forgejo: 1.19.0-2 -> 1.19.0-3, use "predictable URLs" in src.url
#224877
Conversation
Not sure how long codeberg.org already supports this. I only just found out about them after a maintainer mentioned them in https://matrix.to/#/#forgejo-chat:matrix.org Similar URLs are also used at https://forgejo.org/download/
emilylange
changed the title
src.url
Yes, I'm a potential user and only took part in that conversation due to my role in the nixpkgs security team. Note that go 1.20.3 is on staging-next (#224806) right now. |
| src = fetchurl { | ||
| name = "${pname}-src-${version}.tar.gz"; | ||
| # see https://codeberg.org/forgejo/forgejo/releases | ||
| url = "https://codeberg.org/attachments/2bf497db-fa91-4260-9c98-5c791b6b397c"; | ||
| hash = "sha256-neDIT+V3qHR8xgP4iy4TJQ6PCWO3svpSA7FLCacQSMI="; | ||
| url = "https://codeberg.org/forgejo/forgejo/releases/download/v${version}/forgejo-src-${version}.tar.gz"; | ||
| hash = "sha256-u27DDw3JUtVJ2nvkKfaGzpYP8bpRnwc1LUVra8Epkjc="; | ||
| }; |
There was a problem hiding this comment.
We also have fetchFromGitea fwiw.
There was a problem hiding this comment.
fetchFromGitea needs a rev, but this URL doesn't. We are using a release artifact/tarball.
I can reach back to explain why, if you are interested.
But the tl;dr; is forgejo provides release tarballs, that already include the frontend.
So we don't need to build everything from source. Similarly to Gitea1.
If you go to https://codeberg.org/forgejo/forgejo/releases/tag/v1.19.0-3 you can compare Source Code (TAR.GZ) with forgejo-src-1.19.0-3.tar.gz
Footnotes
There was a problem hiding this comment.
Ideally, we would build the frontend from source. This could be done using buildNpmPackage, but should probably happen outside a regular update.
ofborg
bot
added
11.by: package-maintainer
|
This pull request has been mentioned on NixOS Discourse. There might be relevant details there: https://discourse.nixos.org/t/prs-ready-for-review/3032/2042 |
If that would be linked in the web ui... |
|
Description of changes
release notes: https://codeberg.org/forgejo/forgejo/src/commit/4c132e77ea2cba9a1161f4cfc18b82b9e2e1b35f/RELEASE-NOTES.md#1-19-0-3
The security section in those release notes does not apply to nixpkgs :)
Or rather isn't specific to forgejo, as #224714 hasn't landed in nixos-unstable yet /shrug
Also changed the
src.urlto use a predictable URL instead ofhttps://codeberg.org/attachments/$uuid.Not sure how long codeberg.org already supports this.
I only just found out about them after a maintainer mentioned them in https://matrix.to/#/#forgejo-chat:matrix.org
Similar URLs are also used at https://forgejo.org/download/
cc @mweinelt as I've spotted you in https://matrix.to/#/#forgejo-chat:matrix.org 👀
Things done
sandbox = trueset innix.conf? (See Nix manual)nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)