Verify unknown config fields raise errors

[pinch] / pinch.py

diff --git a/pinch.py b/pinch.py
index 4c2341f6f03d772525c5e6531fda657ff5458fd9..9b845e3414df7a5c66a0cd940890a8562ebf7da8 100644 (file)
--- a/pinch.py
+++ b/pinch.py
@@ -1,4 +1,3 @@
-from abc import ABC, abstractmethod

 import argparse
 import configparser
 import filecmp
 import argparse
 import configparser
 import filecmp


@@ -19,21 +18,25 @@ import urllib.request
 import xml.dom.minidom
 
 from typing import (
 import xml.dom.minidom
 
 from typing import (

+    Callable,

     Dict,
     Iterable,
     List,
     Mapping,
     NamedTuple,
     NewType,
     Dict,
     Iterable,
     List,
     Mapping,
     NamedTuple,
     NewType,

+    Optional,
+    Set,

     Tuple,
     Type,
     Tuple,
     Type,

+    TypeVar,

     Union,
 )
 
 # Use xdg module when it's less painful to have as a dependency
 
 
     Union,
 )
 
 # Use xdg module when it's less painful to have as a dependency
 
 

-class XDG(types.SimpleNamespace):
+class XDG(NamedTuple):

     XDG_CACHE_HOME: str
 
 
     XDG_CACHE_HOME: str
 
 


@@ -109,83 +112,64 @@ class ChannelPin(NamedTuple):
 Pin = Union[AliasPin, GitPin, ChannelPin]
 
 
 Pin = Union[AliasPin, GitPin, ChannelPin]
 
 

-class SearchPath(types.SimpleNamespace, ABC):
+class AliasSearchPath(NamedTuple):
+    alias_of: str

 
 

-    @abstractmethod
-    def pin(self, v: Verification) -> Pin:
-        pass
+    # pylint: disable=no-self-use
+    def pin(self, _: Verification, __: Optional[Pin]) -> AliasPin:
+        return AliasPin()

 
 
 
 

-class AliasSearchPath(SearchPath):
-    alias_of: str
+class GitSearchPath(NamedTuple):
+    git_ref: str
+    git_repo: str

 
 

-    def pin(self, v: Verification) -> AliasPin:
-        assert not hasattr(self, 'git_repo')
-        return AliasPin()
+    def pin(self, v: Verification, old_pin: Optional[Pin]) -> GitPin:
+        if old_pin is not None:
+            assert isinstance(old_pin, GitPin)
+        old_revision = old_pin.git_revision if old_pin is not None else None
+
+        new_revision = git_fetch(v, self, None, old_revision)
+        return GitPin(release_name=git_revision_name(v, self, new_revision),
+                      git_revision=new_revision)
+
+    def fetch(self, v: Verification, pin: Pin) -> str:
+        assert isinstance(pin, GitPin)
+        ensure_git_rev_available(v, self, pin, None)
+        return git_get_tarball(v, self, pin)

 
 
 
 

-# (This lint-disable is for pylint bug https://github.com/PyCQA/pylint/issues/179
-# which is fixed in pylint 2.5.)
-class TarrableSearchPath(SearchPath, ABC):  # pylint: disable=abstract-method
-    channel_html: bytes
+class ChannelSearchPath(NamedTuple):

     channel_url: str
     channel_url: str

-    forwarded_url: str

     git_ref: str
     git_repo: str
     git_ref: str
     git_repo: str

-    old_git_revision: str
-    table: Dict[str, ChannelTableEntry]
-
-
-class GitSearchPath(TarrableSearchPath):
-    def pin(self, v: Verification) -> GitPin:
-        if hasattr(self, 'git_revision'):
-            self.old_git_revision = self.git_revision
-            del self.git_revision
-
-        git_fetch(v, self)
-        return GitPin(release_name=git_revision_name(v, self),
-                      git_revision=self.git_revision)
-
-    def fetch(self, v: Verification, section: str,
-              conf: configparser.SectionProxy) -> str:
-        if 'git_revision' not in conf or 'release_name' not in conf:
-            raise Exception(
-                'Cannot update unpinned channel "%s" (Run "pin" before "update")' %
-                section)
-
-        ensure_git_rev_available(v, self)
-        return git_get_tarball(v, self)
-
-
-class ChannelSearchPath(TarrableSearchPath):
-    def pin(self, v: Verification) -> ChannelPin:
-        if hasattr(self, 'git_revision'):
-            self.old_git_revision = self.git_revision
-            del self.git_revision
-
-        fetch(v, self)
-        parse_channel(v, self)
-        fetch_resources(v, self)
-        ensure_git_rev_available(v, self)
-        check_channel_contents(v, self)
+
+    def pin(self, v: Verification, old_pin: Optional[Pin]) -> ChannelPin:
+        if old_pin is not None:
+            assert isinstance(old_pin, ChannelPin)
+        old_revision = old_pin.git_revision if old_pin is not None else None
+
+        channel_html, forwarded_url = fetch_channel(v, self)
+        table, new_gitpin = parse_channel(v, channel_html)
+        fetch_resources(v, new_gitpin, forwarded_url, table)
+        ensure_git_rev_available(v, self, new_gitpin, old_revision)
+        check_channel_contents(v, self, table, new_gitpin)

         return ChannelPin(
         return ChannelPin(

-            release_name=self.release_name,
-            tarball_url=self.table['nixexprs.tar.xz'].absolute_url,
-            tarball_sha256=self.table['nixexprs.tar.xz'].digest,
-            git_revision=self.git_revision)
+            release_name=new_gitpin.release_name,
+            tarball_url=table['nixexprs.tar.xz'].absolute_url,
+            tarball_sha256=table['nixexprs.tar.xz'].digest,
+            git_revision=new_gitpin.git_revision)

 
 

-    # Lint TODO: Put tarball_url and tarball_sha256 in ChannelSearchPath

     # pylint: disable=no-self-use
     # pylint: disable=no-self-use

-    def fetch(self, v: Verification, section: str,
-              conf: configparser.SectionProxy) -> str:
-        if 'git_repo' not in conf or 'release_name' not in conf:
-            raise Exception(
-                'Cannot update unpinned channel "%s" (Run "pin" before "update")' %
-                section)
+    def fetch(self, v: Verification, pin: Pin) -> str:
+        assert isinstance(pin, ChannelPin)

 
         return fetch_with_nix_prefetch_url(
 
         return fetch_with_nix_prefetch_url(

-            v, conf['tarball_url'], Digest16(
-                conf['tarball_sha256']))
+            v, pin.tarball_url, Digest16(pin.tarball_sha256))
+
+
+SearchPath = Union[AliasSearchPath, GitSearchPath, ChannelSearchPath]
+TarrableSearchPath = Union[GitSearchPath, ChannelSearchPath]

 
 
 def compare(a: str, b: str) -> Tuple[List[str], List[str], List[str]]:
 
 
 def compare(a: str, b: str) -> Tuple[List[str], List[str], List[str]]:


@@ -216,18 +200,21 @@ def compare(a: str, b: str) -> Tuple[List[str], List[str], List[str]]:
     return filecmp.cmpfiles(a, b, files, shallow=False)
 
 
     return filecmp.cmpfiles(a, b, files, shallow=False)
 
 

-def fetch(v: Verification, channel: TarrableSearchPath) -> None:
+def fetch_channel(
+        v: Verification, channel: ChannelSearchPath) -> Tuple[str, str]:

     v.status('Fetching channel')
     request = urllib.request.urlopen(channel.channel_url, timeout=10)
     v.status('Fetching channel')
     request = urllib.request.urlopen(channel.channel_url, timeout=10)

-    channel.channel_html = request.read()
-    channel.forwarded_url = request.geturl()
+    channel_html = request.read()
+    forwarded_url = request.geturl()

     v.result(request.status == 200)  # type: ignore  # (for old mypy)
     v.result(request.status == 200)  # type: ignore  # (for old mypy)

-    v.check('Got forwarded', channel.channel_url != channel.forwarded_url)
+    v.check('Got forwarded', channel.channel_url != forwarded_url)
+    return channel_html, forwarded_url

 
 
 
 

-def parse_channel(v: Verification, channel: TarrableSearchPath) -> None:
+def parse_channel(v: Verification, channel_html: str) \
+        -> Tuple[Dict[str, ChannelTableEntry], GitPin]:

     v.status('Parsing channel description as XML')
     v.status('Parsing channel description as XML')

-    d = xml.dom.minidom.parseString(channel.channel_html)
+    d = xml.dom.minidom.parseString(channel_html)

     v.ok()
 
     v.status('Extracting release name:')
     v.ok()
 
     v.status('Extracting release name:')


@@ -236,26 +223,25 @@ def parse_channel(v: Verification, channel: TarrableSearchPath) -> None:
     h1_name = d.getElementsByTagName('h1')[0].firstChild.nodeValue.split()[2]
     v.status(title_name)
     v.result(title_name == h1_name)
     h1_name = d.getElementsByTagName('h1')[0].firstChild.nodeValue.split()[2]
     v.status(title_name)
     v.result(title_name == h1_name)

-    channel.release_name = title_name

 
     v.status('Extracting git commit:')
     git_commit_node = d.getElementsByTagName('tt')[0]
 
     v.status('Extracting git commit:')
     git_commit_node = d.getElementsByTagName('tt')[0]

-    channel.git_revision = git_commit_node.firstChild.nodeValue
-    v.status(channel.git_revision)
+    git_revision = git_commit_node.firstChild.nodeValue
+    v.status(git_revision)

     v.ok()
     v.status('Verifying git commit label')
     v.result(git_commit_node.previousSibling.nodeValue == 'Git commit ')
 
     v.status('Parsing table')
     v.ok()
     v.status('Verifying git commit label')
     v.result(git_commit_node.previousSibling.nodeValue == 'Git commit ')
 
     v.status('Parsing table')

-    channel.table = {}
+    table: Dict[str, ChannelTableEntry] = {}

     for row in d.getElementsByTagName('tr')[1:]:
         name = row.childNodes[0].firstChild.firstChild.nodeValue
         url = row.childNodes[0].firstChild.getAttribute('href')
         size = int(row.childNodes[1].firstChild.nodeValue)
         digest = Digest16(row.childNodes[2].firstChild.firstChild.nodeValue)
     for row in d.getElementsByTagName('tr')[1:]:
         name = row.childNodes[0].firstChild.firstChild.nodeValue
         url = row.childNodes[0].firstChild.getAttribute('href')
         size = int(row.childNodes[1].firstChild.nodeValue)
         digest = Digest16(row.childNodes[2].firstChild.firstChild.nodeValue)

-        channel.table[name] = ChannelTableEntry(
-            url=url, digest=digest, size=size)
+        table[name] = ChannelTableEntry(url=url, digest=digest, size=size)

     v.ok()
     v.ok()

+    return table, GitPin(release_name=title_name, git_revision=git_revision)

 
 
 def digest_string(s: bytes) -> Digest16:
 
 
 def digest_string(s: bytes) -> Digest16:


@@ -305,17 +291,18 @@ def fetch_with_nix_prefetch_url(
     return path  # type: ignore  # (for old mypy)
 
 
     return path  # type: ignore  # (for old mypy)
 
 

-def fetch_resources(v: Verification, channel: ChannelSearchPath) -> None:
+def fetch_resources(
+        v: Verification,
+        pin: GitPin,
+        forwarded_url: str,
+        table: Dict[str, ChannelTableEntry]) -> None:

     for resource in ['git-revision', 'nixexprs.tar.xz']:
     for resource in ['git-revision', 'nixexprs.tar.xz']:

-        fields = channel.table[resource]
-        fields.absolute_url = urllib.parse.urljoin(
-            channel.forwarded_url, fields.url)
+        fields = table[resource]
+        fields.absolute_url = urllib.parse.urljoin(forwarded_url, fields.url)

         fields.file = fetch_with_nix_prefetch_url(
             v, fields.absolute_url, fields.digest)
     v.status('Verifying git commit on main page matches git commit in table')
         fields.file = fetch_with_nix_prefetch_url(
             v, fields.absolute_url, fields.digest)
     v.status('Verifying git commit on main page matches git commit in table')

-    v.result(
-        open(
-            channel.table['git-revision'].file).read(999) == channel.git_revision)
+    v.result(open(table['git-revision'].file).read(999) == pin.git_revision)

 
 
 def git_cachedir(git_repo: str) -> str:
 
 
 def git_cachedir(git_repo: str) -> str:


@@ -325,17 +312,21 @@ def git_cachedir(git_repo: str) -> str:
         digest_string(git_repo.encode()))
 
 
         digest_string(git_repo.encode()))
 
 

-def tarball_cache_file(channel: TarrableSearchPath) -> str:
+def tarball_cache_file(channel: TarrableSearchPath, pin: GitPin) -> str:

     return os.path.join(
         xdg.XDG_CACHE_HOME,
         'pinch/git-tarball',
         '%s-%s-%s' %
         (digest_string(channel.git_repo.encode()),
     return os.path.join(
         xdg.XDG_CACHE_HOME,
         'pinch/git-tarball',
         '%s-%s-%s' %
         (digest_string(channel.git_repo.encode()),

-         channel.git_revision,
-         channel.release_name))
+         pin.git_revision,
+         pin.release_name))

 
 
 
 

-def verify_git_ancestry(v: Verification, channel: TarrableSearchPath) -> None:
+def verify_git_ancestry(
+        v: Verification,
+        channel: TarrableSearchPath,
+        new_revision: str,
+        old_revision: Optional[str]) -> None:

     cachedir = git_cachedir(channel.git_repo)
     v.status('Verifying rev is an ancestor of ref')
     process = subprocess.run(['git',
     cachedir = git_cachedir(channel.git_repo)
     v.status('Verifying rev is an ancestor of ref')
     process = subprocess.run(['git',


@@ -343,25 +334,29 @@ def verify_git_ancestry(v: Verification, channel: TarrableSearchPath) -> None:
                               cachedir,
                               'merge-base',
                               '--is-ancestor',
                               cachedir,
                               'merge-base',
                               '--is-ancestor',

-                              channel.git_revision,
+                              new_revision,

                               channel.git_ref])
     v.result(process.returncode == 0)
 
                               channel.git_ref])
     v.result(process.returncode == 0)
 

-    if hasattr(channel, 'old_git_revision'):
+    if old_revision is not None:

         v.status(
             'Verifying rev is an ancestor of previous rev %s' %
         v.status(
             'Verifying rev is an ancestor of previous rev %s' %

-            channel.old_git_revision)
+            old_revision)

         process = subprocess.run(['git',
                                   '-C',
                                   cachedir,
                                   'merge-base',
                                   '--is-ancestor',
         process = subprocess.run(['git',
                                   '-C',
                                   cachedir,
                                   'merge-base',
                                   '--is-ancestor',

-                                  channel.old_git_revision,
-                                  channel.git_revision])
+                                  old_revision,
+                                  new_revision])

         v.result(process.returncode == 0)
 
 
         v.result(process.returncode == 0)
 
 

-def git_fetch(v: Verification, channel: TarrableSearchPath) -> None:
+def git_fetch(
+        v: Verification,
+        channel: TarrableSearchPath,
+        desired_revision: Optional[str],
+        old_revision: Optional[str]) -> str:

     # It would be nice if we could share the nix git cache, but as of the time
     # of writing it is transitioning from gitv2 (deprecated) to gitv3 (not ready
     # yet), and trying to straddle them both is too far into nix implementation
     # It would be nice if we could share the nix git cache, but as of the time
     # of writing it is transitioning from gitv2 (deprecated) to gitv3 (not ready
     # yet), and trying to straddle them both is too far into nix implementation


@@ -387,49 +382,53 @@ def git_fetch(v: Verification, channel: TarrableSearchPath) -> None:
                                          channel.git_ref)])
     v.result(process.returncode == 0)
 
                                          channel.git_ref)])
     v.result(process.returncode == 0)
 

-    if hasattr(channel, 'git_revision'):
+    if desired_revision is not None:

         v.status('Verifying that fetch retrieved this rev')
         process = subprocess.run(
         v.status('Verifying that fetch retrieved this rev')
         process = subprocess.run(

-            ['git', '-C', cachedir, 'cat-file', '-e', channel.git_revision])
+            ['git', '-C', cachedir, 'cat-file', '-e', desired_revision])

         v.result(process.returncode == 0)
         v.result(process.returncode == 0)

-    else:
-        channel.git_revision = open(
-            os.path.join(
-                cachedir,
-                'refs',
-                'heads',
-                channel.git_ref)).read(999).strip()

 
 

-    verify_git_ancestry(v, channel)
+    new_revision = open(
+        os.path.join(
+            cachedir,
+            'refs',
+            'heads',
+            channel.git_ref)).read(999).strip()
+
+    verify_git_ancestry(v, channel, new_revision, old_revision)
+
+    return new_revision

 
 
 def ensure_git_rev_available(
         v: Verification,
 
 
 def ensure_git_rev_available(
         v: Verification,

-        channel: TarrableSearchPath) -> None:
+        channel: TarrableSearchPath,
+        pin: GitPin,
+        old_revision: Optional[str]) -> None:

     cachedir = git_cachedir(channel.git_repo)
     if os.path.exists(cachedir):
         v.status('Checking if we already have this rev:')
         process = subprocess.run(
     cachedir = git_cachedir(channel.git_repo)
     if os.path.exists(cachedir):
         v.status('Checking if we already have this rev:')
         process = subprocess.run(

-            ['git', '-C', cachedir, 'cat-file', '-e', channel.git_revision])
+            ['git', '-C', cachedir, 'cat-file', '-e', pin.git_revision])

         if process.returncode == 0:
             v.status('yes')
         if process.returncode == 1:
             v.status('no')
         v.result(process.returncode == 0 or process.returncode == 1)
         if process.returncode == 0:
         if process.returncode == 0:
             v.status('yes')
         if process.returncode == 1:
             v.status('no')
         v.result(process.returncode == 0 or process.returncode == 1)
         if process.returncode == 0:

-            verify_git_ancestry(v, channel)
+            verify_git_ancestry(v, channel, pin.git_revision, old_revision)

             return
             return

-    git_fetch(v, channel)
+    git_fetch(v, channel, pin.git_revision, old_revision)

 
 
 def compare_tarball_and_git(
         v: Verification,
 
 
 def compare_tarball_and_git(
         v: Verification,

-        channel: TarrableSearchPath,
+        pin: GitPin,

         channel_contents: str,
         git_contents: str) -> None:
     v.status('Comparing channel tarball with git checkout')
     match, mismatch, errors = compare(os.path.join(
         channel_contents: str,
         git_contents: str) -> None:
     v.status('Comparing channel tarball with git checkout')
     match, mismatch, errors = compare(os.path.join(

-        channel_contents, channel.release_name), git_contents)
+        channel_contents, pin.release_name), git_contents)

     v.ok()
     v.check('%d files match' % len(match), len(match) > 0)
     v.check('%d files differ' % len(mismatch), len(mismatch) == 0)
     v.ok()
     v.check('%d files match' % len(match), len(match) > 0)
     v.check('%d files differ' % len(mismatch), len(mismatch) == 0)


@@ -457,26 +456,24 @@ def compare_tarball_and_git(
 
 def extract_tarball(
         v: Verification,
 
 def extract_tarball(
         v: Verification,

-        channel: TarrableSearchPath,
+        table: Dict[str, ChannelTableEntry],

         dest: str) -> None:
         dest: str) -> None:

-    v.status('Extracting tarball %s' %
-             channel.table['nixexprs.tar.xz'].file)
-    shutil.unpack_archive(
-        channel.table['nixexprs.tar.xz'].file,
-        dest)
+    v.status('Extracting tarball %s' % table['nixexprs.tar.xz'].file)
+    shutil.unpack_archive(table['nixexprs.tar.xz'].file, dest)

     v.ok()
 
 
 def git_checkout(
         v: Verification,
         channel: TarrableSearchPath,
     v.ok()
 
 
 def git_checkout(
         v: Verification,
         channel: TarrableSearchPath,

+        pin: GitPin,

         dest: str) -> None:
     v.status('Checking out corresponding git revision')
     git = subprocess.Popen(['git',
                             '-C',
                             git_cachedir(channel.git_repo),
                             'archive',
         dest: str) -> None:
     v.status('Checking out corresponding git revision')
     git = subprocess.Popen(['git',
                             '-C',
                             git_cachedir(channel.git_repo),
                             'archive',

-                            channel.git_revision],
+                            pin.git_revision],

                            stdout=subprocess.PIPE)
     tar = subprocess.Popen(
         ['tar', 'x', '-C', dest, '-f', '-'], stdin=git.stdout)
                            stdout=subprocess.PIPE)
     tar = subprocess.Popen(
         ['tar', 'x', '-C', dest, '-f', '-'], stdin=git.stdout)


@@ -487,8 +484,11 @@ def git_checkout(
     v.result(git.returncode == 0 and tar.returncode == 0)
 
 
     v.result(git.returncode == 0 and tar.returncode == 0)
 
 

-def git_get_tarball(v: Verification, channel: TarrableSearchPath) -> str:
-    cache_file = tarball_cache_file(channel)
+def git_get_tarball(
+        v: Verification,
+        channel: TarrableSearchPath,
+        pin: GitPin) -> str:
+    cache_file = tarball_cache_file(channel, pin)

     if os.path.exists(cache_file):
         cached_tarball = open(cache_file).read(9999)
         if os.path.exists(cached_tarball):
     if os.path.exists(cache_file):
         cached_tarball = open(cache_file).read(9999)
         if os.path.exists(cached_tarball):


@@ -496,17 +496,17 @@ def git_get_tarball(v: Verification, channel: TarrableSearchPath) -> str:
 
     with tempfile.TemporaryDirectory() as output_dir:
         output_filename = os.path.join(
 
     with tempfile.TemporaryDirectory() as output_dir:
         output_filename = os.path.join(

-            output_dir, channel.release_name + '.tar.xz')
+            output_dir, pin.release_name + '.tar.xz')

         with open(output_filename, 'w') as output_file:
             v.status(
                 'Generating tarball for git revision %s' %
         with open(output_filename, 'w') as output_file:
             v.status(
                 'Generating tarball for git revision %s' %

-                channel.git_revision)
+                pin.git_revision)

             git = subprocess.Popen(['git',
                                     '-C',
                                     git_cachedir(channel.git_repo),
                                     'archive',
             git = subprocess.Popen(['git',
                                     '-C',
                                     git_cachedir(channel.git_repo),
                                     'archive',

-                                    '--prefix=%s/' % channel.release_name,
-                                    channel.git_revision],
+                                    '--prefix=%s/' % pin.release_name,
+                                    pin.git_revision],

                                    stdout=subprocess.PIPE)
             xz = subprocess.Popen(['xz'], stdin=git.stdout, stdout=output_file)
             xz.wait()
                                    stdout=subprocess.PIPE)
             xz = subprocess.Popen(['xz'], stdin=git.stdout, stdout=output_file)
             xz.wait()


@@ -526,46 +526,51 @@ def git_get_tarball(v: Verification, channel: TarrableSearchPath) -> str:
 
 def check_channel_metadata(
         v: Verification,
 
 def check_channel_metadata(
         v: Verification,

-        channel: TarrableSearchPath,
+        pin: GitPin,

         channel_contents: str) -> None:
     v.status('Verifying git commit in channel tarball')
     v.result(
         open(
             os.path.join(
                 channel_contents,
         channel_contents: str) -> None:
     v.status('Verifying git commit in channel tarball')
     v.result(
         open(
             os.path.join(
                 channel_contents,

-                channel.release_name,
-                '.git-revision')).read(999) == channel.git_revision)
+                pin.release_name,
+                '.git-revision')).read(999) == pin.git_revision)

 
     v.status(
         'Verifying version-suffix is a suffix of release name %s:' %
 
     v.status(
         'Verifying version-suffix is a suffix of release name %s:' %

-        channel.release_name)
+        pin.release_name)

     version_suffix = open(
         os.path.join(
             channel_contents,
     version_suffix = open(
         os.path.join(
             channel_contents,

-            channel.release_name,
+            pin.release_name,

             '.version-suffix')).read(999)
     v.status(version_suffix)
             '.version-suffix')).read(999)
     v.status(version_suffix)

-    v.result(channel.release_name.endswith(version_suffix))
+    v.result(pin.release_name.endswith(version_suffix))

 
 
 def check_channel_contents(
         v: Verification,
 
 
 def check_channel_contents(
         v: Verification,

-        channel: TarrableSearchPath) -> None:
+        channel: TarrableSearchPath,
+        table: Dict[str, ChannelTableEntry],
+        pin: GitPin) -> None:

     with tempfile.TemporaryDirectory() as channel_contents, \
             tempfile.TemporaryDirectory() as git_contents:
 
     with tempfile.TemporaryDirectory() as channel_contents, \
             tempfile.TemporaryDirectory() as git_contents:
 

-        extract_tarball(v, channel, channel_contents)
-        check_channel_metadata(v, channel, channel_contents)
+        extract_tarball(v, table, channel_contents)
+        check_channel_metadata(v, pin, channel_contents)

 
 

-        git_checkout(v, channel, git_contents)
+        git_checkout(v, channel, pin, git_contents)

 
 

-        compare_tarball_and_git(v, channel, channel_contents, git_contents)
+        compare_tarball_and_git(v, pin, channel_contents, git_contents)

 
         v.status('Removing temporary directories')
     v.ok()
 
 
 
         v.status('Removing temporary directories')
     v.ok()
 
 

-def git_revision_name(v: Verification, channel: TarrableSearchPath) -> str:
+def git_revision_name(
+        v: Verification,
+        channel: TarrableSearchPath,
+        git_revision: str) -> str:

     v.status('Getting commit date')
     process = subprocess.run(['git',
                               '-C',
     v.status('Getting commit date')
     process = subprocess.run(['git',
                               '-C',


@@ -575,20 +580,58 @@ def git_revision_name(v: Verification, channel: TarrableSearchPath) -> str:
                               '--format=%ct-%h',
                               '--abbrev=11',
                               '--no-show-signature',
                               '--format=%ct-%h',
                               '--abbrev=11',
                               '--no-show-signature',

-                              channel.git_revision],
+                              git_revision],

                              stdout=subprocess.PIPE)
     v.result(process.returncode == 0 and process.stdout != b'')
     return '%s-%s' % (os.path.basename(channel.git_repo),
                       process.stdout.decode().strip())
 
 
                              stdout=subprocess.PIPE)
     v.result(process.returncode == 0 and process.stdout != b'')
     return '%s-%s' % (os.path.basename(channel.git_repo),
                       process.stdout.decode().strip())
 
 

-def read_search_path(conf: configparser.SectionProxy) -> SearchPath:
-    mapping: Mapping[str, Type[SearchPath]] = {
-        'alias': AliasSearchPath,
-        'channel': ChannelSearchPath,
-        'git': GitSearchPath,
+K = TypeVar('K')
+V = TypeVar('V')
+
+
+def partition_dict(pred: Callable[[K, V], bool],
+                   d: Dict[K, V]) -> Tuple[Dict[K, V], Dict[K, V]]:
+    selected: Dict[K, V] = {}
+    remaining: Dict[K, V] = {}
+    for k, v in d.items():
+        if pred(k, v):
+            selected[k] = v
+        else:
+            remaining[k] = v
+    return selected, remaining
+
+
+def filter_dict(d: Dict[K, V], fields: Set[K]
+                ) -> Tuple[Dict[K, V], Dict[K, V]]:
+    return partition_dict(lambda k, v: k in fields, d)
+
+
+def read_config_section(
+        conf: configparser.SectionProxy) -> Tuple[SearchPath, Optional[Pin]]:
+    mapping: Mapping[str, Tuple[Type[SearchPath], Type[Pin]]] = {
+        'alias': (AliasSearchPath, AliasPin),
+        'channel': (ChannelSearchPath, ChannelPin),
+        'git': (GitSearchPath, GitPin),

     }
     }

-    return mapping[conf['type']](**dict(conf.items()))
+    SP, P = mapping[conf['type']]
+    _, all_fields = filter_dict(dict(conf.items()), set(['type']))
+    pin_fields, remaining_fields = filter_dict(all_fields, set(P._fields))
+    # Error suppression works around https://github.com/python/mypy/issues/9007
+    pin_present = pin_fields != {} or P._fields == ()
+    pin = P(**pin_fields) if pin_present else None  # type:ignore[call-arg]
+    return SP(**remaining_fields), pin
+
+
+def read_pinned_config_section(
+        section: str, conf: configparser.SectionProxy) -> Tuple[SearchPath, Pin]:
+    sp, pin = read_config_section(conf)
+    if pin is None:
+        raise Exception(
+            'Cannot update unpinned channel "%s" (Run "pin" before "update")' %
+            section)
+    return sp, pin

 
 
 def read_config(filename: str) -> configparser.ConfigParser:
 
 
 def read_config(filename: str) -> configparser.ConfigParser:


@@ -616,9 +659,9 @@ def pinCommand(args: argparse.Namespace) -> None:
         if args.channels and section not in args.channels:
             continue
 
         if args.channels and section not in args.channels:
             continue
 

-        sp = read_search_path(config[section])
+        sp, old_pin = read_config_section(config[section])

 
 

-        config[section].update(sp.pin(v)._asdict())
+        config[section].update(sp.pin(v, old_pin)._asdict())

 
     with open(args.channels_file, 'w') as configfile:
         config.write(configfile)
 
     with open(args.channels_file, 'w') as configfile:
         config.write(configfile)


@@ -627,20 +670,24 @@ def pinCommand(args: argparse.Namespace) -> None:
 def updateCommand(args: argparse.Namespace) -> None:
     v = Verification()
     exprs: Dict[str, str] = {}
 def updateCommand(args: argparse.Namespace) -> None:
     v = Verification()
     exprs: Dict[str, str] = {}

-    config = read_config_files(args.channels_file)
-    for section in config:
-        sp = read_search_path(config[section])
-        if isinstance(sp, AliasSearchPath):
-            assert 'git_repo' not in config[section]
-            continue
-        tarball = sp.fetch(v, section, config[section])
+    config = {
+        section: read_pinned_config_section(section, conf) for section,
+        conf in read_config_files(
+            args.channels_file).items()}
+    alias, nonalias = partition_dict(
+        lambda k, v: isinstance(v[0], AliasSearchPath), config)
+
+    for section, (sp, pin) in nonalias.items():
+        assert not isinstance(sp, AliasSearchPath)  # mypy can't see through
+        assert not isinstance(pin, AliasPin)        # partition_dict()
+        tarball = sp.fetch(v, pin)

         exprs[section] = (
             'f: f { name = "%s"; channelName = "%%s"; src = builtins.storePath "%s"; }' %
         exprs[section] = (
             'f: f { name = "%s"; channelName = "%%s"; src = builtins.storePath "%s"; }' %

-            (config[section]['release_name'], tarball))
+            (pin.release_name, tarball))

 
 

-    for section in config:
-        if 'alias_of' in config[section]:
-            exprs[section] = exprs[str(config[section]['alias_of'])]
+    for section, (sp, pin) in alias.items():
+        assert isinstance(sp, AliasSearchPath)  # For mypy
+        exprs[section] = exprs[sp.alias_of]

 
     command = [
         'nix-env',
 
     command = [
         'nix-env',