Início / unix / Perguntas / 557977
Accepted
Chris Stryczynski
Asked: 2019-12-19 13:51:55 +0800 CST

Como clonar um repositório git privado em uma derivação nix

  • 772
{
  nixpkgs ? import <nixpkgs> {}
}:nixpkgs.pkgs.fetchgitPrivate {
        url = "ssh://[email protected]/trycatchchris/blog.git";
        rev = "0f5fe7ebf0724eb17aea4141e0cf3f1758a6d716";
        sha256 = "02951e82c1183aaf1ce4b9669bf9ae32e50c4c641550797eed37739cd4528b58";
      }

Eu tenho a expressão nix acima, onde o repositório é um repositório git privado.

Eu tenho acesso a este repositório por meio de uma chave pública para meu usuário.

Se eu tentar um normal nix-build:

nix-build
trace: Please set your nix-path such that ssh-config-file points to a file that will allow ssh to access private repositories. The builder will not be able to see any running ssh agent sessions unless ssh-auth-sock is also set in the nix-path.

Note that the config file and any keys it points to must be readable by the build user, which depending on your nix configuration means making it readable by the build-users-group, the user of the running nix-daemon, or the user calling the nix command which started the build. Similarly, if using an ssh agent ssh-auth-sock must point to a socket the build user can access.

You may need StrictHostKeyChecking=no in the config file. Since ssh will refuse to use a group-readable private key, if using build-users you will likely want to use something like IdentityFile /some/directory/%u/key and have a directory for each build user accessible to that user.

these derivations will be built:
  /nix/store/hlnshdb0ckckih46cv66xj8pyqds6w7y-blog-0f5fe7e.drv
building '/nix/store/hlnshdb0ckckih46cv66xj8pyqds6w7y-blog-0f5fe7e.drv'...
exporting ssh://[email protected]/trycatchchris/blog.git (rev 0f5fe7ebf0724eb17aea4141e0cf3f1758a6d716) into /nix/store/mkinydhkdyg6dyw7fp399m90qw5bsbqd-blog-0f5fe7e
Initialized empty Git repository in /nix/store/mkinydhkdyg6dyw7fp399m90qw5bsbqd-blog-0f5fe7e/.git/
Can't open user config file /var/lib/empty/config: No such file or directory
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
Can't open user config file /var/lib/empty/config: No such file or directory
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
Unable to checkout 0f5fe7ebf0724eb17aea4141e0cf3f1758a6d716 from ssh://[email protected]/trycatchchris/blog.git.
builder for '/nix/store/hlnshdb0ckckih46cv66xj8pyqds6w7y-blog-0f5fe7e.drv' failed with exit code 1
error: build of '/nix/store/hlnshdb0ckckih46cv66xj8pyqds6w7y-blog-0f5fe7e.drv' failed

Eu tentei usar o agente ssh também (de https://github.com/NixOS/nixpkgs/issues/4004#issuecomment-236434045 ):

criando um ssharquivo com conteúdo de:

Host gitlab.com
  StrictHostKeyChecking No
  UserKnownHostsFile /dev/null
  IdentityFile /home/chris/.ssh/id_rsa

E executando:

nix-build -I ssh-config-file=$PWD/ssh           
these derivations will be built:
  /nix/store/ng4qdayni3a69b57kfmrvf4ba03ryfv9-blog-0f5fe7e.drv
building '/nix/store/ng4qdayni3a69b57kfmrvf4ba03ryfv9-blog-0f5fe7e.drv'...
exporting ssh://[email protected]/trycatchchris/blog.git (rev 0f5fe7ebf0724eb17aea4141e0cf3f1758a6d716) into /nix/store/mkinydhkdyg6dyw7fp399m90qw5bsbqd-blog-0f5fe7e
Initialized empty Git repository in /nix/store/mkinydhkdyg6dyw7fp399m90qw5bsbqd-blog-0f5fe7e/.git/
Can't open user config file /home/chris/temp/wiptemp/11/ssh: No such file or directory
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
Can't open user config file /home/chris/temp/wiptemp/11/ssh: No such file or directory
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
Unable to checkout 0f5fe7ebf0724eb17aea4141e0cf3f1758a6d716 from ssh://[email protected]/trycatchchris/blog.git.
builder for '/nix/store/ng4qdayni3a69b57kfmrvf4ba03ryfv9-blog-0f5fe7e.drv' failed with exit code 1
error: build of '/nix/store/ng4qdayni3a69b57kfmrvf4ba03ryfv9-blog-0f5fe7e.drv' failed

No entanto, isso também falha... Como posso clonar o repositório privado usando a abordagem acima ou alguma outra abordagem?

nix

1 respostas

  1. Best Answer
    {
  nixpkgs ? import <nixpkgs> {}
}:(import (builtins.fetchGit {
        url = "ssh://[email protected]/trycatchchris/blog.git";
        rev = "4d127272689a5bc172e82529132b91e5943bb16f";
      }) {})

    O ( builtins.fetchGit) acima parece funcionar perfeitamente sem a necessidade de configurar uma sandbox etc (usa a chave padrão ~/.ssh/id_rsa).

    Se estiver usando Nix < v2.4 e buscando um commit que não está no masterbranch, você precisará adicionar um refatributo adicional com o nome do branch, por exemplo:

    {
            url = "ssh://[email protected]/trycatchchris/blog.git";
            rev = "4d127272689a5bc172e82529132b91e5943bb16f";
            ref = "branchNameGoesHere"; # here
          }

    https://github.com/nix-community/naersk/pull/211

    • 5

relate perguntas