106 lines
3.1 KiB
Nix
106 lines
3.1 KiB
Nix
{
|
|
stdenv,
|
|
lib,
|
|
haskellPackages,
|
|
writeText,
|
|
gawk,
|
|
}:
|
|
let
|
|
awk = "${gawk}/bin/awk";
|
|
dockerCredentialsFile = import ./credentials.nix { inherit lib; };
|
|
in
|
|
{
|
|
fetcher,
|
|
name,
|
|
registry ? "https://registry-1.docker.io/v2/",
|
|
repository ? "library",
|
|
imageName,
|
|
sha256,
|
|
tag ? "",
|
|
layerDigest ? "",
|
|
}:
|
|
|
|
# There must be no slashes in the repository or container names since
|
|
# we use these to make the output derivation name for the nix store
|
|
# path
|
|
assert null == lib.findFirst (c: "/" == c) null (lib.stringToCharacters repository);
|
|
assert null == lib.findFirst (c: "/" == c) null (lib.stringToCharacters imageName);
|
|
|
|
# Only allow hocker-config and hocker-layer as fetchers for now
|
|
assert (
|
|
builtins.elem fetcher [
|
|
"hocker-config"
|
|
"hocker-layer"
|
|
]
|
|
);
|
|
|
|
# If layerDigest is non-empty then it must not have a 'sha256:' prefix!
|
|
assert (if layerDigest != "" then !lib.hasPrefix "sha256:" layerDigest else true);
|
|
|
|
let
|
|
layerDigestFlag = lib.optionalString (layerDigest != "") "--layer ${layerDigest}";
|
|
in
|
|
stdenv.mkDerivation {
|
|
inherit name;
|
|
builder = writeText "${fetcher}-builder.sh" ''
|
|
source "$stdenv/setup"
|
|
echo "${fetcher} exporting to $out"
|
|
|
|
declare -A creds
|
|
|
|
# This is a hack for Hydra since we have no way of adding values
|
|
# to the NIX_PATH for Hydra jobsets!!
|
|
staticCredentialsFile="/etc/nix-docker-credentials.txt"
|
|
if [ ! -f "$dockerCredentialsFile" -a -f "$staticCredentialsFile" ]; then
|
|
echo "credentials file not set, falling back on static credentials file at: $staticCredentialsFile"
|
|
dockerCredentialsFile=$staticCredentialsFile
|
|
fi
|
|
|
|
if [ -f "$dockerCredentialsFile" ]; then
|
|
echo "using credentials from $dockerCredentialsFile"
|
|
|
|
CREDSFILE=$(cat "$dockerCredentialsFile")
|
|
creds[token]=$(${awk} -F'=' '/DOCKER_TOKEN/ {print $2}' <<< "$CREDSFILE" | head -n1)
|
|
|
|
# Prefer DOCKER_TOKEN over the username and password
|
|
# authentication method
|
|
if [ -z "''${creds[token]}" ]; then
|
|
creds[user]=$(${awk} -F'=' '/DOCKER_USER/ {print $2}' <<< "$CREDSFILE" | head -n1)
|
|
creds[pass]=$(${awk} -F'=' '/DOCKER_PASS/ {print $2}' <<< "$CREDSFILE" | head -n1)
|
|
fi
|
|
fi
|
|
|
|
# These variables will be filled in first by the impureEnvVars, if
|
|
# those variables are empty then they will default to the
|
|
# credentials that may have been read in from the 'DOCKER_CREDENTIALS'
|
|
DOCKER_USER="''${DOCKER_USER:-''${creds[user]}}"
|
|
DOCKER_PASS="''${DOCKER_PASS:-''${creds[pass]}}"
|
|
DOCKER_TOKEN="''${DOCKER_TOKEN:-''${creds[token]}}"
|
|
|
|
${fetcher} --out="$out" \
|
|
''${registry:+--registry "$registry"} \
|
|
''${DOCKER_USER:+--username "$DOCKER_USER"} \
|
|
''${DOCKER_PASS:+--password "$DOCKER_PASS"} \
|
|
''${DOCKER_TOKEN:+--token "$DOCKER_TOKEN"} \
|
|
${layerDigestFlag} \
|
|
"${repository}/${imageName}" \
|
|
"${tag}"
|
|
'';
|
|
|
|
buildInputs = [ haskellPackages.hocker ];
|
|
|
|
outputHashAlgo = "sha256";
|
|
outputHashMode = "flat";
|
|
outputHash = sha256;
|
|
|
|
preferLocalBuild = true;
|
|
|
|
impureEnvVars = [
|
|
"DOCKER_USER"
|
|
"DOCKER_PASS"
|
|
"DOCKER_TOKEN"
|
|
];
|
|
|
|
inherit registry dockerCredentialsFile;
|
|
}
|