X-Git-Url: http://git.scottworley.com/auto-upgrade-with-pinch/blobdiff_plain/eb0fa99c7cfcb863cfcc3c1ba15aa0fbc2fcb120..9d0c0d71309239cfdc6c19996d2b730fdf06a692:/modules/auto-upgrade.nix diff --git a/modules/auto-upgrade.nix b/modules/auto-upgrade.nix index 216c4ba..66d857f 100644 --- a/modules/auto-upgrade.nix +++ b/modules/auto-upgrade.nix @@ -3,7 +3,7 @@ with lib; let cfg = config.system.autoUpgradeWithPinch; auto-upgrade-script = pkgs.writeShellScript "auto-upgrade" '' - flock /run/auto-upgrade-with-pinch ${ + ${pkgs.utillinux}/bin/flock /run/auto-upgrade-with-pinch ${ pkgs.writeShellScript "auto-upgrade-with-lock-held" '' set -e @@ -18,7 +18,7 @@ let as_user() { ${ if cfg.userEnvironment.enable then '' - sudo -u ${escapeShellArg cfg.userEnvironment.user} "$@" + /run/wrappers/bin/sudo -u ${escapeShellArg cfg.userEnvironment.user} "$@" '' else '' : '' @@ -28,13 +28,13 @@ let # Update channels ( cd /etc/nixos - ${pkgs.keyedgit cfg.key}/bin/git pull --ff-only --verify-signatures + ${pkgs.keyedgit cfg.keys}/bin/git pull --ff-only --verify-signatures ${pkgs.pinch}/bin/pinch update channels ) # Build in_tmpdir ${config.system.build.nixos-rebuild}/bin/nixos-rebuild build - as_user nix-build '' -A ${ + as_user nix-build --no-out-link '' -A ${ escapeShellArg cfg.userEnvironment.package } @@ -71,11 +71,12 @@ in { ''; }; - key = mkOption { + keys = mkOption { type = types.path; description = '' - GPG key that signs updates. Updates are only merged if the commit - at the tip of the remote branch is signed with this key. + File containing GPG keys that sign updates. Updates are only merged + if the commit at the tip of the remote branch is signed with one of + these keys. ''; }; @@ -137,7 +138,7 @@ in { (import ../overlays/pinch.nix) (self: super: { auto-upgrade = super.writeShellScriptBin "auto-upgrade" '' - sudo ${auto-upgrade-script} + /run/wrappers/bin/sudo ${auto-upgrade-script} ''; }) ];