tjh.dev
nixpkgs mirror (for testing)
github.com/NixOS/nixpkgs
nix
1{ stdenv, lib, python3 }:
2
3stdenv.mkDerivation {
4 name = "replace-secret";
5 buildInputs = [ python3 ];
6 dontUnpack = true;
7 installPhase = ''
8 runHook preInstall
9 install -D ${./replace-secret.py} $out/bin/replace-secret
10 patchShebangs $out
11 runHook postInstall
12 '';
13 installCheckPhase = ''
14 install -m 0600 ${./test/input_file} long_test
15 $out/bin/replace-secret "replace this" ${./test/passwd} long_test
16 $out/bin/replace-secret "and this" ${./test/rsa} long_test
17 diff ${./test/expected_long_output} long_test
18
19 install -m 0600 ${./test/input_file} short_test
20 $out/bin/replace-secret "replace this" <(echo "a") short_test
21 $out/bin/replace-secret "and this" <(echo "b") short_test
22 diff ${./test/expected_short_output} short_test
23 '';
24 meta = with lib; {
25 platforms = platforms.all;
26 maintainers = with maintainers; [ talyz ];
27 license = licenses.mit;
28 description = "Replace a string in one file with a secret from a second file";
29 longDescription = ''
30 Replace a string in one file with a secret from a second file.
31
32 Since the secret is read from a file, it won't be leaked through
33 '/proc/<pid>/cmdline', unlike when 'sed' or 'replace' is used.
34 '';
35 mainProgram = "replace-secret";
36 };
37}