tjh.dev
1#!/usr/bin/env nix-shell
2#!nix-shell -i bash -p nix common-updater-scripts jq
3
4# Build both the cacert package and an overridden version where we use the source attribute of NSS.
5# Cacert and NSS are both from the same upstream sources. They are decoupled as
6# the cacert output only cares about a few infrequently changing files in the
7# sources while the NSS source code changes frequently.
8#
9# By having cacert on a older source revision that produces the same
10# certificate output as a newer version we can avoid large amounts of
11# unnecessary rebuilds.
12#
13# As of this writing there are a few magnitudes more packages depending on
14# cacert than on nss.
15#
16# We use `nss_latest` instead of `nss_esr`, because that is the newer version
17# and we want up-to-date certificates.
18# `nss_esr` is used for the ecosystem at large through the `nss` attribute,
19# because it is updated less frequently and maintained for longer, whereas `nss_latest`
20# is used for software that actually needs a new nss, e.g. Firefox.
21
22set -ex
23
24BASEDIR="$(dirname "$0")/../../../.."
25
26
27CURRENT_PATH=$(nix-build --no-out-link -A cacert.out)
28PATCHED_PATH=$(nix-build --no-out-link -E "with import $BASEDIR {}; (cacert.override { nssOverride = nss_latest; }).out")
29
30# Check the hash of the etc subfolder
31# We can't check the entire output as that contains the nix-support folder
32# which contains the output path itself.
33CURRENT_HASH=$(nix-hash "$CURRENT_PATH/etc")
34PATCHED_HASH=$(nix-hash "$PATCHED_PATH/etc")
35
36if [[ "$CURRENT_HASH" != "$PATCHED_HASH" ]]; then
37 NSS_VERSION=$(nix-instantiate --json --eval -E "with import $BASEDIR {}; nss_latest.version" | jq -r .)
38 update-source-version --version-key=srcVersion cacert.src "$NSS_VERSION"
39fi