tjh.dev
Clone of https://github.com/NixOS/nixpkgs.git (to stress-test knotserver)
1#! /usr/bin/env bash
2
3set -e -o pipefail
4
5url=
6rev=
7expHash=
8hashType=$NIX_HASH_ALGO
9deepClone=$NIX_PREFETCH_GIT_DEEP_CLONE
10leaveDotGit=$NIX_PREFETCH_GIT_LEAVE_DOT_GIT
11fetchSubmodules=
12fetchLFS=
13builder=
14branchName=$NIX_PREFETCH_GIT_BRANCH_NAME
15
16# ENV params
17out=${out:-}
18http_proxy=${http_proxy:-}
19
20# allow overwriting cacert's ca-bundle.crt with a custom one
21# this can be done by setting NIX_GIT_SSL_CAINFO and NIX_SSL_CERT_FILE environment variables for the nix-daemon
22GIT_SSL_CAINFO=${NIX_GIT_SSL_CAINFO:-$GIT_SSL_CAINFO}
23
24# populated by clone_user_rev()
25fullRev=
26humanReadableRev=
27commitDate=
28commitDateStrict8601=
29
30if test -n "$deepClone"; then
31 deepClone=true
32else
33 deepClone=
34fi
35
36if test "$leaveDotGit" != 1; then
37 leaveDotGit=
38else
39 leaveDotGit=true
40fi
41
42usage(){
43 echo >&2 "syntax: nix-prefetch-git [options] [URL [REVISION [EXPECTED-HASH]]]
44
45Options:
46 --out path Path where the output would be stored.
47 --url url Any url understood by 'git clone'.
48 --rev ref Any sha1 or references (such as refs/heads/master)
49 --hash h Expected hash.
50 --branch-name Branch name to check out into
51 --sparse-checkout Only fetch and checkout part of the repository.
52 --non-cone-mode Use non-cone mode for sparse checkouts.
53 --deepClone Clone the entire repository.
54 --no-deepClone Make a shallow clone of just the required ref.
55 --leave-dotGit Keep the .git directories.
56 --fetch-lfs Fetch git Large File Storage (LFS) files.
57 --fetch-submodules Fetch submodules.
58 --builder Clone as fetchgit does, but url, rev, and out option are mandatory.
59 --quiet Only print the final json summary.
60"
61 exit 1
62}
63
64# some git commands print to stdout, which would contaminate our JSON output
65clean_git(){
66 git "$@" >&2
67}
68
69argi=0
70argfun=""
71for arg; do
72 if test -z "$argfun"; then
73 case $arg in
74 --out) argfun=set_out;;
75 --url) argfun=set_url;;
76 --rev) argfun=set_rev;;
77 --hash) argfun=set_hashType;;
78 --branch-name) argfun=set_branchName;;
79 --deepClone) deepClone=true;;
80 --sparse-checkout) argfun=set_sparseCheckout;;
81 --non-cone-mode) nonConeMode=true;;
82 --quiet) QUIET=true;;
83 --no-deepClone) deepClone=;;
84 --leave-dotGit) leaveDotGit=true;;
85 --fetch-lfs) fetchLFS=true;;
86 --fetch-submodules) fetchSubmodules=true;;
87 --builder) builder=true;;
88 -h|--help) usage; exit;;
89 *)
90 : $((++argi))
91 case $argi in
92 1) url=$arg;;
93 2) rev=$arg;;
94 3) expHash=$arg;;
95 *) exit 1;;
96 esac
97 ;;
98 esac
99 else
100 case $argfun in
101 set_*)
102 var=${argfun#set_}
103 eval "$var=$(printf %q "$arg")"
104 ;;
105 esac
106 argfun=""
107 fi
108done
109
110if test -z "$url"; then
111 usage
112fi
113
114
115init_remote(){
116 local url=$1
117 clean_git init --initial-branch=master
118 clean_git remote add origin "$url"
119 if [ -n "$sparseCheckout" ]; then
120 git config remote.origin.partialclonefilter "blob:none"
121 echo "$sparseCheckout" | git sparse-checkout set --stdin ${nonConeMode:+--no-cone}
122 fi
123 ( [ -n "$http_proxy" ] && clean_git config http.proxy "$http_proxy" ) || true
124}
125
126# Return the reference of an hash if it exists on the remote repository.
127ref_from_hash(){
128 local hash=$1
129 git ls-remote origin | sed -n "\,$hash\t, { s,\(.*\)\t\(.*\),\2,; p; q}"
130}
131
132# Return the hash of a reference if it exists on the remote repository.
133hash_from_ref(){
134 local ref=$1
135 git ls-remote origin | sed -n "\,\t$ref, { s,\(.*\)\t\(.*\),\1,; p; q}"
136}
137
138# Returns a name based on the url and reference
139#
140# This function needs to be in sync with nix's fetchgit implementation
141# of urlToName() to re-use the same nix store paths.
142url_to_name(){
143 local url=$1
144 local ref=$2
145 local base
146 base=$(basename "$url" .git | cut -d: -f2)
147
148 if [[ $ref =~ ^[a-z0-9]+$ ]]; then
149 echo "$base-${ref:0:7}"
150 else
151 echo "$base"
152 fi
153}
154
155# Fetch and checkout the right sha1
156checkout_hash(){
157 local hash="$1"
158 local ref="$2"
159
160 if test -z "$hash"; then
161 hash=$(hash_from_ref "$ref")
162 fi
163
164 [[ -z "$deepClone" ]] && \
165 clean_git fetch ${builder:+--progress} --depth=1 origin "$hash" || \
166 clean_git fetch -t ${builder:+--progress} origin || return 1
167
168 local object_type=$(git cat-file -t "$hash")
169 if [[ "$object_type" == "commit" ]]; then
170 clean_git checkout -b "$branchName" "$hash" || return 1
171 elif [[ "$object_type" == "tree" ]]; then
172 clean_git config user.email "nix-prefetch-git@localhost"
173 clean_git config user.name "nix-prefetch-git"
174 local commit_id=$(git commit-tree "$hash" -m "Commit created from tree hash $hash")
175 clean_git checkout -b "$branchName" "$commit_id" || return 1
176 else
177 echo "Unrecognized git object type: $object_type"
178 return 1
179 fi
180}
181
182# Fetch only a branch/tag and checkout it.
183checkout_ref(){
184 local hash="$1"
185 local ref="$2"
186
187 if [[ -n "$deepClone" ]]; then
188 # The caller explicitly asked for a deep clone. Deep clones
189 # allow "git describe" and similar tools to work. See
190 # https://marc.info/?l=nix-dev&m=139641582514772
191 # for a discussion.
192 return 1
193 fi
194
195 if test -z "$ref"; then
196 ref=$(ref_from_hash "$hash")
197 fi
198
199 if test -n "$ref"; then
200 # --depth option is ignored on http repository.
201 clean_git fetch ${builder:+--progress} --depth 1 origin +"$ref" || return 1
202 clean_git checkout -b "$branchName" FETCH_HEAD || return 1
203 else
204 return 1
205 fi
206}
207
208# Update submodules
209init_submodules(){
210 clean_git submodule update --init --recursive -j ${NIX_BUILD_CORES:-1}
211}
212
213clone(){
214 local top=$PWD
215 local dir="$1"
216 local url="$2"
217 local hash="$3"
218 local ref="$4"
219
220 cd "$dir"
221
222 # Initialize the repository.
223 init_remote "$url"
224
225 # Download data from the repository.
226 checkout_ref "$hash" "$ref" ||
227 checkout_hash "$hash" "$ref" || (
228 echo 1>&2 "Unable to checkout $hash$ref from $url."
229 exit 1
230 )
231
232 # Checkout linked sources.
233 if test -n "$fetchSubmodules"; then
234 init_submodules
235 fi
236
237 if [ -z "$builder" ] && [ -f .topdeps ]; then
238 if tg help &>/dev/null; then
239 echo "populating TopGit branches..."
240 tg remote --populate origin
241 else
242 echo "WARNING: would populate TopGit branches but TopGit is not available" >&2
243 echo "WARNING: install TopGit to fix the problem" >&2
244 fi
245 fi
246
247 cd "$top"
248}
249
250# Remove all remote branches, remove tags not reachable from HEAD, do a full
251# repack and then garbage collect unreferenced objects.
252make_deterministic_repo(){
253 local repo="$1"
254
255 # run in sub-shell to not touch current working directory
256 (
257 cd "$repo"
258 # Remove files that contain timestamps or otherwise have non-deterministic
259 # properties.
260 rm -rf .git/logs/ .git/hooks/ .git/index .git/FETCH_HEAD .git/ORIG_HEAD \
261 .git/refs/remotes/origin/HEAD .git/config
262
263 # Remove all remote branches.
264 git branch -r | while read -r branch; do
265 clean_git branch -rD "$branch"
266 done
267
268 # Remove tags not reachable from HEAD. If we're exactly on a tag, don't
269 # delete it.
270 maybe_tag=$(git tag --points-at HEAD)
271 git tag --contains HEAD | while read -r tag; do
272 if [ "$tag" != "$maybe_tag" ]; then
273 clean_git tag -d "$tag"
274 fi
275 done
276
277 # Do a full repack. Must run single-threaded, or else we lose determinism.
278 clean_git config pack.threads 1
279 clean_git repack -A -d -f
280 rm -f .git/config
281
282 # Garbage collect unreferenced objects.
283 # Note: --keep-largest-pack prevents non-deterministic ordering of packs
284 # listed in .git/objects/info/packs by only using a single pack
285 clean_git gc --prune=all --keep-largest-pack
286 )
287}
288
289
290clone_user_rev() {
291 local dir="$1"
292 local url="$2"
293 local rev="${3:-HEAD}"
294
295 if [ -n "$fetchLFS" ]; then
296 tmpHomePath="$(mktemp -d "${TMPDIR:-/tmp}/nix-prefetch-git-tmp-home-XXXXXXXXXX")"
297 exit_handlers+=(remove_tmpHomePath)
298 HOME="$tmpHomePath"
299 clean_git lfs install
300 fi
301
302 # Perform the checkout.
303 case "$rev" in
304 HEAD|refs/*)
305 clone "$dir" "$url" "" "$rev" 1>&2;;
306 *)
307 if test -z "$(echo "$rev" | tr -d 0123456789abcdef)"; then
308 clone "$dir" "$url" "$rev" "" 1>&2
309 else
310 # if revision is not hexadecimal it might be a tag
311 clone "$dir" "$url" "" "refs/tags/$rev" 1>&2
312 fi;;
313 esac
314
315 pushd "$dir" >/dev/null
316 fullRev=$( (git rev-parse "$rev" 2>/dev/null || git rev-parse "refs/heads/$branchName") | tail -n1)
317 humanReadableRev=$(git describe "$fullRev" 2> /dev/null || git describe --tags "$fullRev" 2> /dev/null || echo -- none --)
318 commitDate=$(git show -1 --no-patch --pretty=%ci "$fullRev")
319 commitDateStrict8601=$(git show -1 --no-patch --pretty=%cI "$fullRev")
320 popd >/dev/null
321
322 # Allow doing additional processing before .git removal
323 eval "$NIX_PREFETCH_GIT_CHECKOUT_HOOK"
324 if test -z "$leaveDotGit"; then
325 echo "removing \`.git'..." >&2
326 find "$dir" -name .git -print0 | xargs -0 rm -rf
327 else
328 find "$dir" -name .git | while read -r gitdir; do
329 make_deterministic_repo "$(readlink -f "$gitdir/..")"
330 done
331 fi
332}
333
334exit_handlers=()
335
336run_exit_handlers() {
337 exit_status=$?
338 for handler in "${exit_handlers[@]}"; do
339 eval "$handler $exit_status"
340 done
341}
342
343trap run_exit_handlers EXIT
344
345quiet_exit_handler() {
346 exec 2>&3 3>&-
347 if [ $1 -ne 0 ]; then
348 cat "$errfile" >&2
349 fi
350 rm -f "$errfile"
351}
352
353quiet_mode() {
354 errfile="$(mktemp "${TMPDIR:-/tmp}/git-checkout-err-XXXXXXXX")"
355 exit_handlers+=(quiet_exit_handler)
356 exec 3>&2 2>"$errfile"
357}
358
359json_escape() {
360 local s="$1"
361 s="${s//\\/\\\\}" # \
362 s="${s//\"/\\\"}" # "
363 s="${s//^H/\\\b}" # \b (backspace)
364 s="${s//^L/\\\f}" # \f (form feed)
365 s="${s//
366/\\\n}" # \n (newline)
367 s="${s//^M/\\\r}" # \r (carriage return)
368 s="${s// /\\t}" # \t (tab)
369 echo "$s"
370}
371
372print_results() {
373 hash="$1"
374 if ! test -n "$QUIET"; then
375 echo "" >&2
376 echo "git revision is $fullRev" >&2
377 if test -n "$finalPath"; then
378 echo "path is $finalPath" >&2
379 fi
380 echo "git human-readable version is $humanReadableRev" >&2
381 echo "Commit date is $commitDate" >&2
382 if test -n "$hash"; then
383 echo "hash is $hash" >&2
384 fi
385 fi
386 if test -n "$hash"; then
387 cat <<EOF
388{
389 "url": "$(json_escape "$url")",
390 "rev": "$(json_escape "$fullRev")",
391 "date": "$(json_escape "$commitDateStrict8601")",
392 "path": "$(json_escape "$finalPath")",
393 "$(json_escape "$hashType")": "$(json_escape "$hash")",
394 "hash": "$(nix-hash --to-sri --type $hashType $hash)",
395 "fetchLFS": $([[ -n "$fetchLFS" ]] && echo true || echo false),
396 "fetchSubmodules": $([[ -n "$fetchSubmodules" ]] && echo true || echo false),
397 "deepClone": $([[ -n "$deepClone" ]] && echo true || echo false),
398 "leaveDotGit": $([[ -n "$leaveDotGit" ]] && echo true || echo false)
399}
400EOF
401 fi
402}
403
404remove_tmpPath() {
405 rm -rf "$tmpPath"
406}
407
408remove_tmpHomePath() {
409 rm -rf "$tmpHomePath"
410}
411
412if test -n "$QUIET"; then
413 quiet_mode
414fi
415
416if test -z "$branchName"; then
417 branchName=fetchgit
418fi
419
420if test -n "$builder"; then
421 test -n "$out" -a -n "$url" -a -n "$rev" || usage
422 mkdir -p "$out"
423 clone_user_rev "$out" "$url" "$rev"
424else
425 if test -z "$hashType"; then
426 hashType=sha256
427 fi
428
429 # If the hash was given, a file with that hash may already be in the
430 # store.
431 if test -n "$expHash"; then
432 finalPath=$(nix-store --print-fixed-path --recursive "$hashType" "$expHash" "$(url_to_name "$url" "$rev")")
433 if ! nix-store --check-validity "$finalPath" 2> /dev/null; then
434 finalPath=
435 fi
436 hash=$expHash
437 fi
438
439 # If we don't know the hash or a path with that hash doesn't exist,
440 # download the file and add it to the store.
441 if test -z "$finalPath"; then
442
443 tmpPath="$(mktemp -d "${TMPDIR:-/tmp}/git-checkout-tmp-XXXXXXXX")"
444 exit_handlers+=(remove_tmpPath)
445
446 tmpFile="$tmpPath/$(url_to_name "$url" "$rev")"
447 mkdir -p "$tmpFile"
448
449 # Perform the checkout.
450 clone_user_rev "$tmpFile" "$url" "$rev"
451
452 # Compute the hash.
453 hash=$(nix-hash --type $hashType --base32 "$tmpFile")
454
455 # Add the downloaded file to the Nix store.
456 finalPath=$(nix-store --add-fixed --recursive "$hashType" "$tmpFile")
457
458 if test -n "$expHash" -a "$expHash" != "$hash"; then
459 echo "hash mismatch for URL \`$url'. Got \`$hash'; expected \`$expHash'." >&2
460 exit 1
461 fi
462 fi
463
464 print_results "$hash"
465
466 if test -n "$PRINT_PATH"; then
467 echo "$finalPath"
468 fi
469fi