Stop using ancient nix_2_3

Nix commit 787469c7b66aec12ab6847e7db2cdc8aef5c325e removed
<nix/unpack-channel.nix>, preferring to stuff its contents into the nix
binary & write it out to a temp file to use it.

Pinch unpacks channels.  So to retain access to unpack-channel.nix,
pinch pinned its nix dependency to nix 2.3.

This is no longer viable.  The 2.3 branch is no longer maintained.
It now has known security vulnerabilities, noted in knownVulnerabilities
(which causes it to refuse to build).

So now pinch does it the same way as nix, holding its own little
unpack-channel.nix and writing it out to a temp file to use it.

This lets us go back to not caring about the version of the nix
dependency.

diff --git a/Changelog b/Changelog
index f6df13b4badc65c774e4243785a9f2046ee533c6..db6a06a848303ebe3ac8a8ff34f306b0879d3d27 100644 (file)
--- a/Changelog
+++ b/Changelog
@@ -1,4 +1,5 @@
 ## [Unreleased]
+- Stop using ancient nix_2_3
 
 
 ## [3.1.0] - 2024-06-29

diff --git a/default.nix b/default.nix
index 6f297e74c1f1eedb0fb2f67f35b588cfacfe4cdb..2173f2a16d4f4269b06534e754117db881f521ba 100644 (file)
--- a/default.nix
+++ b/default.nix
@@ -21,7 +21,7 @@ let
       checkPhase = "./test.sh";
     };
 
-in pkgs.python3Packages.callPackage ({ lib, buildPythonPackage, nix_2_3, git
+in pkgs.python3Packages.callPackage ({ lib, buildPythonPackage, nix, git
   , autopep8, makeWrapper, mypy, pylint, git-cache, }:
   buildPythonPackage rec {
     pname = "pinch";
@@ -29,10 +29,10 @@ in pkgs.python3Packages.callPackage ({ lib, buildPythonPackage, nix_2_3, git
     src = lib.cleanSource ./.;
     buildInputs = [ makeWrapper ];
     propagatedBuildInputs = [ git-cache ];
-    "${checkInputsName}" = [ nix_2_3 git mypy ]
+    "${checkInputsName}" = [ nix git mypy ]
       ++ lib.optionals lint [ autopep8 pylint ];
     postInstall = ''
-      wrapProgram "$out/bin/pinch" --prefix PATH : ${nix_2_3}/bin
+      wrapProgram "$out/bin/pinch" --prefix PATH : ${nix}/bin
     '';
     doCheck = true;
     checkPhase = "./test.sh";
@@ -46,5 +46,4 @@ in pkgs.python3Packages.callPackage ({ lib, buildPythonPackage, nix_2_3, git
     git-cache =
       pkgs.python3Packages.git-cache or (pkgs.python3Packages.callPackage
         git-cache-fallback { });
-    nix_2_3 = pkgs.nix_2_3 or pkgs.nix;
   }

diff --git a/pinch.py b/pinch.py
index 1a3a94b5ee041693f56f2e5eed227cdfa4a02e75..bdd7a6ebbf39e8af5581980c161c3bf73a0d2d83 100644 (file)
--- a/pinch.py
+++ b/pinch.py
@@ -685,23 +685,35 @@ def updateCommand(args: argparse.Namespace) -> None:
         assert isinstance(sp, AliasSearchPath)  # For mypy
         exprs[section] = exprs[sp.alias_of]
 
-    command = [
-        'nix-env',
-        '--profile',
-        args.profile,
-        '--show-trace',
-        '--file',
-        '<nix/unpack-channel.nix>',
-        '--install',
-        '--remove-all',
-    ] + search_paths + ['--from-expression'] + [
-        exprs[name] % name for name in sorted(exprs.keys())]
-    if args.dry_run:
-        print(' '.join(map(shlex.quote, command)))
-    else:
-        v.status('Installing channels with nix-env')
-        process = subprocess.run(command)
-        v.result(process.returncode == 0)
+    with tempfile.NamedTemporaryFile() as unpack_channel_nix:
+        unpack_channel_nix.write(b'''
+            { name, channelName, src, }:
+            derivation {
+              inherit name channelName src;
+              builder = "builtin:unpack-channel";
+              system = "builtin";
+              preferLocalBuild = true;
+            }
+            ''')
+        unpack_channel_nix.flush()
+
+        command = [
+            'nix-env',
+            '--profile',
+            args.profile,
+            '--show-trace',
+            '--file',
+            unpack_channel_nix.name,
+            '--install',
+            '--remove-all',
+        ] + search_paths + ['--from-expression'] + [
+            exprs[name] % name for name in sorted(exprs.keys())]
+        if args.dry_run:
+            print(' '.join(map(shlex.quote, command)))
+        else:
+            v.status('Installing channels with nix-env')
+            process = subprocess.run(command)
+            v.result(process.returncode == 0)
 
 
 def main() -> None:

diff --git a/tests/alias.sh b/tests/alias.sh
index bf83c18a1ba0fe733ddc4e50de27139c9db6bc71..470cb13f1100ace9aafbd3f81ad65b9b6f931743 100755 (executable)
--- a/tests/alias.sh
+++ b/tests/alias.sh
@@ -14,7 +14,7 @@ python3 ./pinch.py pin "$conf"
 
 actual_env_command=`python3 ./pinch.py update --dry-run "$conf"`
 
-expected_env_command_RE='^nix-env --profile /nix/var/nix/profiles/per-user/[^/]+/channels --show-trace --file '\''<nix/unpack-channel.nix>'\'' --install --remove-all (-I pinch_profile=/nix/var/nix/profiles/per-user/[^/]+/channels -I pinch_profile_manifest=/nix/store/.{32}-env-manifest.nix )?-I pinch_tarball_for_(repo-[0-9]{10}-[0-9a-f]{11})=('"$NIX_STORE_DIR"'/.{32}-\2.tar.xz) --from-expression '\''f: f \{ name = "\2"; channelName = "bar"; src = builtins.storePath "\3"; \}'\'' '\''f: f \{ name = "\2"; channelName = "foo"; src = builtins.storePath "\3"; \}'\''$'
+expected_env_command_RE='^nix-env --profile /nix/var/nix/profiles/per-user/[^/]+/channels --show-trace --file [^ ]+ --install --remove-all (-I pinch_profile=/nix/var/nix/profiles/per-user/[^/]+/channels -I pinch_profile_manifest=/nix/store/.{32}-env-manifest.nix )?-I pinch_tarball_for_(repo-[0-9]{10}-[0-9a-f]{11})=('"$NIX_STORE_DIR"'/.{32}-\2.tar.xz) --from-expression '\''f: f \{ name = "\2"; channelName = "bar"; src = builtins.storePath "\3"; \}'\'' '\''f: f \{ name = "\2"; channelName = "foo"; src = builtins.storePath "\3"; \}'\''$'
 
 if echo "$actual_env_command" | egrep "$expected_env_command_RE" > /dev/null;then
   echo PASS

diff --git a/tests/core.sh b/tests/core.sh
index b0721df1b0aeefc079c7184cc4c1341efedb86a3..851525dca7ac2892d98796d03ee70e7dc30265a3 100755 (executable)
--- a/tests/core.sh
+++ b/tests/core.sh
@@ -8,7 +8,7 @@ python3 ./pinch.py pin "$conf"
 
 actual_env_command=`python3 ./pinch.py update --dry-run "$conf"`
 
-expected_env_command_RE='^nix-env --profile /nix/var/nix/profiles/per-user/[^/]+/channels --show-trace --file '\''<nix/unpack-channel.nix>'\'' --install --remove-all (-I pinch_profile=/nix/var/nix/profiles/per-user/[^/]+/channels -I pinch_profile_manifest=/nix/store/.{32}-env-manifest.nix )?-I pinch_tarball_for_(repo-[0-9]{10}-[0-9a-f]{11})=('"$NIX_STORE_DIR"'/.{32}-\2.tar.xz) --from-expression '\''f: f \{ name = "\2"; channelName = "foo"; src = builtins.storePath "\3"; \}'\''$'
+expected_env_command_RE='^nix-env --profile /nix/var/nix/profiles/per-user/[^/]+/channels --show-trace --file [^ ]+ --install --remove-all (-I pinch_profile=/nix/var/nix/profiles/per-user/[^/]+/channels -I pinch_profile_manifest=/nix/store/.{32}-env-manifest.nix )?-I pinch_tarball_for_(repo-[0-9]{10}-[0-9a-f]{11})=('"$NIX_STORE_DIR"'/.{32}-\2.tar.xz) --from-expression '\''f: f \{ name = "\2"; channelName = "foo"; src = builtins.storePath "\3"; \}'\''$'
 
 if echo "$actual_env_command" | egrep "$expected_env_command_RE" > /dev/null;then
   echo PASS

diff --git a/tests/multi-update.sh b/tests/multi-update.sh
index 5d191ecee62e7fd723346c1e7e09f61c2b948596..b87b7c6f891c6724215048d98a371e7ae45b926d 100755 (executable)
--- a/tests/multi-update.sh
+++ b/tests/multi-update.sh
@@ -18,7 +18,7 @@ actual_env_command=`python3 ./pinch.py update --dry-run "$conf" "$conf2"`
 
 rm -rf "$conf2"
 
-expected_env_command_RE='^nix-env --profile /nix/var/nix/profiles/per-user/[^/]+/channels --show-trace --file '\''<nix/unpack-channel.nix>'\'' --install --remove-all (-I pinch_profile=/nix/var/nix/profiles/per-user/[^/]+/channels -I pinch_profile_manifest=/nix/store/.{32}-env-manifest.nix )?-I pinch_tarball_for_(repo-[0-9]{10}-[0-9a-f]{11})=('"$NIX_STORE_DIR"'/.{32}-\2.tar.xz) --from-expression '\''f: f \{ name = "\2"; channelName = "bar"; src = builtins.storePath "\3"; \}'\'' '\''f: f \{ name = "\2"; channelName = "foo"; src = builtins.storePath "\3"; \}'\''$'
+expected_env_command_RE='^nix-env --profile /nix/var/nix/profiles/per-user/[^/]+/channels --show-trace --file [^ ]+ --install --remove-all (-I pinch_profile=/nix/var/nix/profiles/per-user/[^/]+/channels -I pinch_profile_manifest=/nix/store/.{32}-env-manifest.nix )?-I pinch_tarball_for_(repo-[0-9]{10}-[0-9a-f]{11})=('"$NIX_STORE_DIR"'/.{32}-\2.tar.xz) --from-expression '\''f: f \{ name = "\2"; channelName = "bar"; src = builtins.storePath "\3"; \}'\'' '\''f: f \{ name = "\2"; channelName = "foo"; src = builtins.storePath "\3"; \}'\''$'
 
 if echo "$actual_env_command" | egrep "$expected_env_command_RE" > /dev/null;then
   echo PASS

diff --git a/tests/pin-twice.sh b/tests/pin-twice.sh
index fda548bc3dcc4f32b4e989016c3f5ef19d13d158..0e651d26b593f92884272985424b9362d1646b9f 100755 (executable)
--- a/tests/pin-twice.sh
+++ b/tests/pin-twice.sh
@@ -17,7 +17,7 @@ python3 ./pinch.py pin "$conf"
 
 actual_env_command=`python3 ./pinch.py update --dry-run "$conf"`
 
-expected_env_command_RE='^nix-env --profile /nix/var/nix/profiles/per-user/[^/]+/channels --show-trace --file '\''<nix/unpack-channel.nix>'\'' --install --remove-all (-I pinch_profile=/nix/var/nix/profiles/per-user/[^/]+/channels -I pinch_profile_manifest=/nix/store/.{32}-env-manifest.nix )?-I pinch_tarball_for_(repo-[0-9]{10}-[0-9a-f]{11})=('"$NIX_STORE_DIR"'/.{32}-\2.tar.xz) --from-expression '\''f: f \{ name = "\2"; channelName = "foo"; src = builtins.storePath "\3"; \}'\''$'
+expected_env_command_RE='^nix-env --profile /nix/var/nix/profiles/per-user/[^/]+/channels --show-trace --file [^ ]+ --install --remove-all (-I pinch_profile=/nix/var/nix/profiles/per-user/[^/]+/channels -I pinch_profile_manifest=/nix/store/.{32}-env-manifest.nix )?-I pinch_tarball_for_(repo-[0-9]{10}-[0-9a-f]{11})=('"$NIX_STORE_DIR"'/.{32}-\2.tar.xz) --from-expression '\''f: f \{ name = "\2"; channelName = "foo"; src = builtins.storePath "\3"; \}'\''$'
 
 if echo "$actual_env_command" | egrep "$expected_env_command_RE" > /dev/null;then
   echo PASS

diff --git a/tests/profile.sh b/tests/profile.sh
index 085f2ce55497dff05a1ab853d5d2683bcae54392..dc1572bdb5a2b358a2203433645f33b276560dbc 100755 (executable)
--- a/tests/profile.sh
+++ b/tests/profile.sh
@@ -8,7 +8,7 @@ python3 ./pinch.py pin "$conf"
 
 actual_env_command=`python3 ./pinch.py update --dry-run --profile /path/to/profile "$conf"`
 
-expected_env_command_RE='^nix-env --profile /path/to/profile --show-trace --file '\''<nix/unpack-channel.nix>'\'' --install --remove-all -I pinch_tarball_for_(repo-[0-9]{10}-[0-9a-f]{11})=('"$NIX_STORE_DIR"'/.{32}-\1.tar.xz) --from-expression '\''f: f \{ name = "\1"; channelName = "foo"; src = builtins.storePath "\2"; \}'\''$'
+expected_env_command_RE='^nix-env --profile /path/to/profile --show-trace --file [^ ]+ --install --remove-all -I pinch_tarball_for_(repo-[0-9]{10}-[0-9a-f]{11})=('"$NIX_STORE_DIR"'/.{32}-\1.tar.xz) --from-expression '\''f: f \{ name = "\1"; channelName = "foo"; src = builtins.storePath "\2"; \}'\''$'
 
 if echo "$actual_env_command" | egrep "$expected_env_command_RE" > /dev/null;then
   echo PASS

diff --git a/tests/symlink.sh b/tests/symlink.sh
index 8b59794014ae93e0abb71ad5c39f8e3e87b8ceb2..e1fa69b8c9133c2edf84b4be478c46793e2bb0e1 100755 (executable)
--- a/tests/symlink.sh
+++ b/tests/symlink.sh
@@ -14,7 +14,7 @@ python3 ./pinch.py pin "$conf"
 
 actual_env_command=`python3 ./pinch.py update --dry-run "$conf"`
 
-expected_env_command_RE='^nix-env --profile /nix/var/nix/profiles/per-user/[^/]+/channels --show-trace --file '\''<nix/unpack-channel.nix>'\'' --install --remove-all (-I pinch_profile=/nix/var/nix/profiles/per-user/[^/]+/channels -I pinch_profile_manifest=/nix/store/.{32}-env-manifest.nix )?-I pinch_tarball_for_link=('"$NIX_STORE_DIR"'/.{32}-link.tar.gz) -I pinch_tarball_for_(repo-[0-9]{10}-[0-9a-f]{11})=('"$NIX_STORE_DIR"'/.{32}-\3.tar.xz) --from-expression '\''f: f \{ name = "link"; channelName = "bar"; src = builtins.storePath "\2"; \}'\'' '\''f: f \{ name = "\3"; channelName = "foo"; src = builtins.storePath "\4"; \}'\''$'
+expected_env_command_RE='^nix-env --profile /nix/var/nix/profiles/per-user/[^/]+/channels --show-trace --file [^ ]+ --install --remove-all (-I pinch_profile=/nix/var/nix/profiles/per-user/[^/]+/channels -I pinch_profile_manifest=/nix/store/.{32}-env-manifest.nix )?-I pinch_tarball_for_link=('"$NIX_STORE_DIR"'/.{32}-link.tar.gz) -I pinch_tarball_for_(repo-[0-9]{10}-[0-9a-f]{11})=('"$NIX_STORE_DIR"'/.{32}-\3.tar.xz) --from-expression '\''f: f \{ name = "link"; channelName = "bar"; src = builtins.storePath "\2"; \}'\'' '\''f: f \{ name = "\3"; channelName = "foo"; src = builtins.storePath "\4"; \}'\''$'
 
 if echo "$actual_env_command" | egrep "$expected_env_command_RE" > /dev/null;then
   echo PASS