Merge #325

325: feature: Add pkgs fetch manager nvfetcher r=GTrunSec a=GTrunSec

Regarding motivation in #299

Any question here?

Example: 
-  overlay 
```
inherit (prev.sources.<PackageName>) pname version src;
```

- pkgs 
```
stdenv.mkDerivation rec {
 inherit (sources.<PackageName>) pname version src;
```

Co-authored-by: David Arnold <dar@xoe.solutions>
Co-authored-by: GTrunSec <gtrunsec@hardenedlinux.org>
Co-authored-by: David Arnold <dgx.arnold@gmail.com>
Co-authored-by: Pacman99 <pachum99@myrdd.info>

.github/ISSUE_TEMPLATE/upstream_notice.md

@@ -0,0 +1,16 @@
+---
+name: Upstream notice (Issues or Changes)
+about: Create an upstream notice to help our research
+title: '[ <put the upstream project> ]: <topic>'
+labels: 'upstream'
+assignees: ''
+
+---
+
+## Link
+<!-- just place a link to the upstream issue, or PR -->
+
+
+## Context
+<!-- We want to make this as cheap for you as possible.
+Context is not required but helpful -->

.gitignore

@@ -8,3 +8,5 @@ doc/index.html
 vm
 iso
 doi
+
+pkgs/_sources/.shake*

README.md

@@ -69,6 +69,7 @@ following giants][giants]:
 ### :family: — like family
 - [`numtide/devshell`][devshell]
 - [`serokell/deploy-rs`][deploy]
+- [`berberman/nvfetcher`][nvfetcher]
 - [`NixOS/nixpkgs`][nixpkgs]
 
 :heart:
@@ -94,22 +95,23 @@ goals are sufficiently upstreamed into "the Nix", dissolved.
 # License
 DevOS is licensed under the [MIT License][mit].
 
-[mk-flake]: https://github.com/divnix/digga/tree/master/src/mkFlake
-[nixpkgs]: https://github.com/NixOS/nixpkgs
+[community]: https://github.com/divnix/devos/tree/community
+[core]: https://github.com/divnix/devos
 [deploy]: https://github.com/serokell/deploy-rs
-[toc]: https://github.com/divnix/devos/blob/core/flake.nix
-[giants]: https://en.wikipedia.org/wiki/Standing_on_the_shoulders_of_giants
+[devshell]: https://github.com/numtide/devshell
 [digga]: https://github.com/divnix/digga
-[fup]: https://github.com/gytis-ivaskevicius/flake-utils-plus
+[dotfiles]: https://github.com/hlissner/dotfiles
+[flake-doc]: https://github.com/NixOS/nix/blob/master/src/nix/flake.md
+[flakes]: https://nixos.wiki/wiki/Flakes
 [fu]: https://github.com/numtide/flake-utils
-[devshell]: https://github.com/numtide/devshell
-[nix]: https://nixos.org/manual/nix/stable
+[fup]: https://github.com/gytis-ivaskevicius/flake-utils-plus
+[giants]: https://en.wikipedia.org/wiki/Standing_on_the_shoulders_of_giants
+[home-manager]: https://nix-community.github.io/home-manager
 [mit]: https://mit-license.org
+[mk-flake]: https://github.com/divnix/digga/tree/master/src/mkFlake
+[nix]: https://nixos.org/manual/nix/stable
 [nixos]: https://nixos.org/manual/nixos/stable
-[home-manager]: https://nix-community.github.io/home-manager
-[flakes]: https://nixos.wiki/wiki/Flakes
-[flake-doc]: https://github.com/NixOS/nix/blob/master/src/nix/flake.md
-[core]: https://github.com/divnix/devos
-[community]: https://github.com/divnix/devos/tree/community
-[dotfiles]: https://github.com/hlissner/dotfiles
+[nixpkgs]: https://github.com/NixOS/nixpkgs
+[nvfetcher]: https://github.com/berberman/nvfetcher
 [please]: https://github.com/nrdxp/devos/tree/nrd
+[toc]: https://github.com/divnix/devos/blob/core/flake.nix

doc/SUMMARY.md

@@ -31,5 +31,6 @@
 - [Integrations](./integrations/index.md)
   - [Cachix](./integrations/cachix.md)
   - [Deploy RS](./integrations/deploy.md)
+  - [NvFetcher](./integrations/nvfetcher.md)
   - [Hercules CI](./integrations/hercules.md)
 - [Contributing](./CONTRIBUTING.md)

doc/integrations/nvfetcher.md

@@ -0,0 +1,43 @@
+# nvfetcher
+[NvFetcher][nvf] is a workflow companion for updating nix sources.
+
+You can specify an origin source and an update configuration, and
+nvfetcher can for example track updates to a specific branch and
+automatically update your nix sources configuration on each run
+to the tip of that branch.
+
+All package source declaration is done in [sources.toml][sources.toml].
+
+From within the devshell of this repo, run `nvfetcher`, a wrapped
+version of `nvfetcher` that knows where to find and place its files
+and commit the results.
+
+## Usage
+
+Statically fetching (not tracking) a particular tag from a github repo:
+```toml
+[manix]
+src.manual = "v0.6.3"
+fetch.github = "mlvzk/manix"
+```
+
+Tracking the latest github _release_ from a github repo:
+```toml
+[manix]
+src.github = "mlvzk/manix" # responsible for tracking
+fetch.github = "mlvzk/manix" # responsible for fetching
+```
+
+Tracking the latest commit of a git repository and fetch from a git repo:
+```toml
+[manix]
+src.git = "https://github.com/mlvzk/manix.git" # responsible for tracking
+fetch.git = "https://github.com/mlvzk/manix.git" # responsible for fetching
+```
+
+> ##### _Note:_
+> Please refer to the [NvFetcher Readme][nvf-readme] for more options.
+
+[nvf: https://github.com/berberman/nvfetcher
+[nvf-readme]: https://github.com/berberman/nvfetcher#readme
+[sources.toml]: https://github.com/divnix/devos/tree/core/pkgs/sources.toml

flake.nix

@@ -5,7 +5,7 @@
     {
       nixos.url = "nixpkgs/nixos-unstable";
       latest.url = "nixpkgs";
-      digga.url = "github:divnix/digga/master";
+      digga.url = "github:divnix/digga/develop";
 
       ci-agent = {
         url = "github:hercules-ci/hercules-ci-agent";
@@ -21,20 +21,20 @@
       agenix.inputs.nixpkgs.follows = "latest";
       nixos-hardware.url = "github:nixos/nixos-hardware";
 
-      pkgs.url = "path:./pkgs";
-      pkgs.inputs.nixpkgs.follows = "nixos";
+      nvfetcher-flake.url = "github:berberman/nvfetcher";
+      nvfetcher-flake.inputs.nixpkgs.follows = "latest";
     };
 
   outputs =
     { self
-    , pkgs
     , digga
     , nixos
     , ci-agent
     , home
     , nixos-hardware
     , nur
     , agenix
+    , nvfetcher-flake
     , ...
     } @ inputs:
     digga.lib.mkFlake {
@@ -46,10 +46,10 @@
         nixos = {
           imports = [ (digga.lib.importers.overlays ./overlays) ];
           overlays = [
-            ./pkgs/default.nix
-            pkgs.overlay # for `srcs`
             nur.overlay
             agenix.overlay
+            nvfetcher-flake.overlay
+            ./pkgs/default.nix
           ];
         };
         latest = { };
@@ -106,7 +106,13 @@
       };
 
       devshell.externalModules = { pkgs, ... }: {
-        packages = [ pkgs.agenix ];
+        commands = [
+          { package = pkgs.agenix; category = "secrets"; }
+          {
+            name = pkgs.nvfetcher-bin.pname;
+            help = pkgs.nvfetcher-bin.meta.description;
+            command = "cd $DEVSHELL_ROOT/pkgs; ${pkgs.nvfetcher-bin}/bin/nvfetcher -c ./sources.toml $@"; }
+        ];
       };
 
       homeConfigurations = digga.lib.mkHomeConfigurations self.nixosConfigurations;

overlays/manix.nix

@@ -0,0 +1,5 @@
+final: prev: {
+  manix = prev.manix.overrideAttrs (o: rec{
+    inherit (prev.sources.manix) pname version src;
+  });
+}

overlays/overrides.nix

@@ -7,7 +7,6 @@ channels: final: prev: {
     dhall
     discord
     element-desktop
-    manix
     rage
     nixpkgs-fmt
     qutebrowser

pkgs/_sources/generated.nix

@@ -0,0 +1,17 @@
+# This file was generated by nvfetcher, please do not modify it manually.
+{ fetchgit, fetchurl }:
+{
+  manix = {
+    pname = "manix";
+    version = "v0.6.3";
+    src = fetchgit {
+      url = "https://github.com/mlvzk/manix";
+      rev = "v0.6.3";
+      fetchSubmodules = false;
+      deepClone = false;
+      leaveDotGit = false;
+      sha256 = "1b7xi8c2drbwzfz70czddc4j33s7g1alirv12dwl91hbqxifx8qs";
+    };
+
+  };
+}

pkgs/default.nix

@@ -1 +1,5 @@
-final: prev: { }
+final: prev: {
+  # keep sources this first
+  sources = prev.callPackage (import ./sources.nix) { };
+  # then, call packages with `final.callPackage`
+}