agenix: import initial user dns keys

npins/default.nix

@@ -9,15 +9,8 @@
 */
 # Generated by npins. Do not modify; will be overwritten regularly
 let
-  # Backwards-compatibly make something that previously didn't take any arguments take some
-  # The function must return an attrset, and will unfortunately be eagerly evaluated
-  # Same thing, but it catches eval errors on the default argument so that one may still call it with other arguments
-  mkFunctor =
-    fn:
-    let
-      e = builtins.tryEval (fn { });
-    in
-    (if e.success then e.value else { error = fn { }; }) // { __functor = _self: fn; };
+  data = builtins.fromJSON (builtins.readFile ./sources.json);
+  version = data.version;
 
   # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/lists.nix#L295
   range =
@@ -28,6 +21,7 @@ let
 
   # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L269
   stringAsChars = f: s: concatStrings (map f (stringToCharacters s));
+  concatMapStrings = f: list: concatStrings (map f list);
   concatStrings = builtins.concatStringsSep "";
 
   # If the environment variable NPINS_OVERRIDE_${name} is set, then use
@@ -54,87 +48,41 @@ let
 
   mkSource =
     name: spec:
-    {
-      pkgs ? null,
-    }:
     assert spec ? type;
     let
-      # Unify across builtin and pkgs fetchers.
-      # `fetchGit` requires a wrapper because of slight API differences.
-      fetchers =
-        if pkgs == null then
-          {
-            inherit (builtins) fetchTarball fetchurl;
-            # For some fucking reason, fetchGit has a different signature than the other builtin fetchers …
-            fetchGit = args: (builtins.fetchGit args).outPath;
-          }
-        else
-          {
-            fetchTarball =
-              {
-                url,
-                sha256,
-              }:
-              pkgs.fetchzip {
-                inherit url sha256;
-                extension = "tar";
-              };
-            inherit (pkgs) fetchurl;
-            fetchGit =
-              {
-                url,
-                submodules,
-                rev,
-                name,
-                narHash,
-              }:
-              pkgs.fetchgit {
-                inherit url rev name;
-                fetchSubmodules = submodules;
-                hash = narHash;
-              };
-          };
-
-      # Dispatch to the correct code path based on the type
       path =
         if spec.type == "Git" then
-          mkGitSource fetchers spec
+          mkGitSource spec
         else if spec.type == "GitRelease" then
-          mkGitSource fetchers spec
+          mkGitSource spec
         else if spec.type == "PyPi" then
-          mkPyPiSource fetchers spec
+          mkPyPiSource spec
         else if spec.type == "Channel" then
-          mkChannelSource fetchers spec
+          mkChannelSource spec
         else if spec.type == "Tarball" then
-          mkTarballSource fetchers spec
-        else if spec.type == "Container" then
-          mkContainerSource pkgs spec
+          mkTarballSource spec
         else
           builtins.throw "Unknown source type ${spec.type}";
     in
     spec // { outPath = mayOverride name path; };
 
   mkGitSource =
-    {
-      fetchTarball,
-      fetchGit,
-      ...
-    }:
     {
       repository,
       revision,
       url ? null,
       submodules,
       hash,
+      branch ? null,
       ...
     }:
     assert repository ? type;
     # At the moment, either it is a plain git repository (which has an url), or it is a GitHub/GitLab repository
     # In the latter case, there we will always be an url to the tarball
     if url != null && !submodules then
-      fetchTarball {
+      builtins.fetchTarball {
         inherit url;
-        sha256 = hash;
+        sha256 = hash; # FIXME: check nix version & use SRI hashes
       }
     else
       let
@@ -145,8 +93,6 @@ let
             "https://github.com/${repository.owner}/${repository.repo}.git"
           else if repository.type == "GitLab" then
             "${repository.server}/${repository.repo_path}.git"
-          else if repository.type == "Forgejo" then
-            "${repository.server}/${repository.owner}/${repository.repo}.git"
           else
             throw "Unrecognized repository type ${repository.type}";
         urlToName =
@@ -161,89 +107,40 @@ let
           "${if matched == null then "source" else builtins.head matched}${appendShort}";
         name = urlToName url revision;
       in
-      fetchGit {
+      builtins.fetchGit {
         rev = revision;
-        narHash = hash;
-
-        inherit name submodules url;
+        inherit name;
+        # hash = hash;
+        inherit url submodules;
       };
 
   mkPyPiSource =
-    { fetchurl, ... }:
-    {
-      url,
-      hash,
-      ...
-    }:
-    fetchurl {
+    { url, hash, ... }:
+    builtins.fetchurl {
       inherit url;
       sha256 = hash;
     };
 
   mkChannelSource =
-    { fetchTarball, ... }:
-    {
-      url,
-      hash,
-      ...
-    }:
-    fetchTarball {
+    { url, hash, ... }:
+    builtins.fetchTarball {
       inherit url;
       sha256 = hash;
     };
 
   mkTarballSource =
-    { fetchTarball, ... }:
     {
       url,
       locked_url ? url,
       hash,
       ...
     }:
-    fetchTarball {
+    builtins.fetchTarball {
       url = locked_url;
       sha256 = hash;
     };
-
-  mkContainerSource =
-    pkgs:
-    {
-      image_name,
-      image_tag,
-      image_digest,
-      ...
-    }:
-    if pkgs == null then
-      builtins.throw "container sources require passing in a Nixpkgs value: https://github.com/andir/npins/blob/master/README.md#using-the-nixpkgs-fetchers"
-    else
-      pkgs.dockerTools.pullImage {
-        imageName = image_name;
-        imageDigest = image_digest;
-        finalImageTag = image_tag;
-      };
 in
-mkFunctor (
-  {
-    input ? ./sources.json,
-  }:
-  let
-    data =
-      if builtins.isPath input then
-        # while `readFile` will throw an error anyways if the path doesn't exist,
-        # we still need to check beforehand because *our* error can be caught but not the one from the builtin
-        # *piegames sighs*
-        if builtins.pathExists input then
-          builtins.fromJSON (builtins.readFile input)
-        else
-          throw "Input path ${toString input} does not exist"
-      else if builtins.isAttrs input then
-        input
-      else
-        throw "Unsupported input type ${builtins.typeOf input}, must be a path or an attrset";
-    version = data.version;
-  in
-  if version == 7 then
-    builtins.mapAttrs (name: spec: mkFunctor (mkSource name spec)) data.pins
-  else
-    throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`"
-)
+if version == 5 then
+  builtins.mapAttrs mkSource data.pins
+else
+  throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`"

npins/sources.json

@@ -1,4 +1,4 @@
 {
   "pins": {},
-  "version": 7
+  "version": 5
 }