test fix for ghcr

.github/workflows/build.yaml

@@ -11,7 +11,7 @@ jobs:
       - run: nix build -L .#nixos-runner
       - run: nix run .#push-container -- result
         env:
-          REGISTRY: ghcr.io/${{ github.repository_owner }}
+          REGISTRY: https://ghcr.io/${{ github.repository_owner }}
           REPOSITORY: nixos-runner
           USERNAME: ${{ github.actor }}
           PASSWORD: ${{ github.token }}

flake.lock

@@ -5,11 +5,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1692799911,
+        "lastModified": 1710146030,
-        "narHash": "sha256-3eihraek4qL744EvQXsK1Ha6C3CR7nnT8X2qWap4RNk=",
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "f9e7cf818399d17d347f847525c5a5a8032e4e44",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
         "type": "github"
       },
       "original": {
@@ -18,13 +18,81 @@
         "type": "github"
       }
     },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flakey-profile": {
+      "locked": {
+        "lastModified": 1712898590,
+        "narHash": "sha256-FhGIEU93VHAChKEXx905TSiPZKga69bWl1VB37FK//I=",
+        "owner": "lf-",
+        "repo": "flakey-profile",
+        "rev": "243c903fd8eadc0f63d205665a92d4df91d42d9d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lf-",
+        "repo": "flakey-profile",
+        "type": "github"
+      }
+    },
+    "lix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1723503926,
+        "narHash": "sha256-Rosl9iA9MybF5Bud4BTAQ9adbY81aGmPfV8dDBGl34s=",
+        "rev": "bcaeb6388b8916ac6d1736e3aa2b13313e6a6bd2",
+        "type": "tarball",
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/bcaeb6388b8916ac6d1736e3aa2b13313e6a6bd2.tar.gz?rev=bcaeb6388b8916ac6d1736e3aa2b13313e6a6bd2"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://git.lix.systems/lix-project/lix/archive/2.91.0.tar.gz"
+      }
+    },
+    "lix-module": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "flakey-profile": "flakey-profile",
+        "lix": "lix",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1723510904,
+        "narHash": "sha256-zNW/rqNJwhq2lYmQf19wJerRuNimjhxHKmzrWWFJYts=",
+        "rev": "622a2253a071a1fb97a4d3c8103a91114acc1140",
+        "type": "tarball",
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/622a2253a071a1fb97a4d3c8103a91114acc1140.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://git.lix.systems/lix-project/nixos-module/archive/2.91.0.tar.gz"
+      }
+    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1693158576,
+        "lastModified": 1725634671,
-        "narHash": "sha256-aRTTXkYvhXosGx535iAFUaoFboUrZSYb1Ooih/auGp0=",
+        "narHash": "sha256-v3rIhsJBOMLR8e/RNWxr828tB+WywYIoajrZKFM+0Gg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a999c1cc0c9eb2095729d5aa03e0d8f7ed256780",
+        "rev": "574d1eac1c200690e27b8eb4e24887f8df7ac27c",
         "type": "github"
       },
       "original": {
@@ -36,6 +104,7 @@
     "root": {
       "inputs": {
         "flake-utils": "flake-utils",
+        "lix-module": "lix-module",
         "nixpkgs": "nixpkgs"
       }
     },
@@ -53,6 +122,21 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -8,56 +8,66 @@
     flake-utils = {
       url = "github:numtide/flake-utils";
     };
+    lix-module = {
+      url = "https://git.lix.systems/lix-project/nixos-module/archive/2.91.0.tar.gz";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
-  outputs = { self, nixpkgs, flake-utils }@inputs:
+  outputs = {
-    (flake-utils.lib.eachDefaultSystem
+    self,
-      (system:
+    flake-utils,
-        let
+    lix-module,
+    nixpkgs,
+  }: (
+    flake-utils.lib.eachDefaultSystem
+    (
+      system: let
         pkgs = import nixpkgs {
           inherit system;
-            config.permittedInsecurePackages = [
+          imports = [
-              "nodejs-16.20.2"
+            lix-module.nixosModules.default
           ];
+          nix.package = pkgs.lix;
+
+          # config.permittedInsecurePackages = [
+          #   "nodejs-16.20.2"
+          # ];
           overlays = [
-              (
+            # (
-                self: super: {
+            #   self: super: {
-                  regclient =
+            #     regclient = let
-                    let
+            #       pname = "regclient";
-                      pname = "regclient";
+            #       version = "0.5.1+";
-                      version = "0.5.1+";
+            #       src = pkgs.fetchFromGitHub {
-                      src = pkgs.fetchFromGitHub {
+            #         owner = "regclient";
-                        owner = "regclient";
+            #         repo = "regclient";
-                        repo = "regclient";
+            #         rev = "72df49963a17092138854c5d9d7943deac1dde6b";
-                        rev = "72df49963a17092138854c5d9d7943deac1dde6b";
+            #         hash = "sha256-9k1VXtaHTF1GMIDs5qGzJkqPZa+ZKrWes+LakVKaQ38=";
-                        hash = "sha256-9k1VXtaHTF1GMIDs5qGzJkqPZa+ZKrWes+LakVKaQ38=";
+            #       };
-                      };
+            #       vendorHash = "sha256-j+XidIgjJ5uw1d4OXRl3pjiW5Hvy7WqNM0KdVWMvWls=";
-                      vendorHash = "sha256-j+XidIgjJ5uw1d4OXRl3pjiW5Hvy7WqNM0KdVWMvWls=";
+            #     in
-                    in
+            #       super.buildGoModule {
-                    super.buildGoModule {
+            #         inherit pname version src vendorHash;
-                      inherit pname version src vendorHash;
+            #         inherit (super.regclient) meta outputs postInstall;
-                      inherit (super.regclient) meta outputs postInstall;
+            #         ldflags = [
-                      ldflags = [
+            #           "-s"
-                        "-s"
+            #           "-w"
-                        "-w"
+            #           "-X main.VCSTag=v${version}"
-                        "-X main.VCSTag=v${version}"
+            #         ];
-                      ];
+            #         doCheck = false;
-                      doCheck = false;
+            #       };
-                    };
+            #   }
-                }
+            # )
-              )
           ];
         };
         lib = pkgs.lib;
-          docker-client = pkgs.docker_24.override {
+        docker-client = pkgs.docker_26.override {
           clientOnly = true;
         };
-        in
+      in {
-        {
-
         packages = {
-            nixos-runner =
+          nixos-runner = let
-              let
             bundleNixpkgs = true;
             channelName = "nixpkgs";
             channelURL = "https://nixos.org/channels/nixos-unstable";
@@ -74,23 +84,26 @@
               pkgs.gnused
               pkgs.gzip
               pkgs.iputils
-                  pkgs.nix
+              pkgs.less
-                  pkgs.nodejs-16_x
+              pkgs.lix
+              # pkgs.nix
+              pkgs.nodejs_20
               pkgs.nushell
+              pkgs.more
               pkgs.podman
               pkgs.regctl
               pkgs.stdenv.cc.cc.lib
+              pkgs.which
 
               docker-client
 
-                  # self.packages.${system}.podman-push-container
-                  # self.packages.${system}.docker-push-container
               self.packages.${system}.push-container
             ];
 
             flake-registry = null;
 
-                users = {
+            users =
+              {
                 root = {
                   uid = 0;
                   shell = "${pkgs.bashInteractive}/bin/bash";
@@ -107,7 +120,8 @@
                   groups = ["nobody"];
                   description = "Unprivileged account (don't use!)";
                 };
-                } // lib.listToAttrs (
+              }
+              // lib.listToAttrs (
                 map
                 (
                   n: {
@@ -130,14 +144,14 @@
             };
 
             userToPasswd = (
-                  k:
+              data: {
-                  { uid
+                uid,
-                  , gid ? 65534
+                gid ? 65534,
-                  , home ? "/var/empty"
+                home ? "/var/empty",
-                  , description ? ""
+                description ? "",
-                  , shell ? "/bin/false"
+                shell ? "/bin/false",
-                  , groups ? [ ]
+                ...
-                  }: "${k}:x:${toString uid}:${toString gid}:${description}:${home}:${shell}"
+              }: "${data}:x:${toString uid}:${toString gid}:${description}:${home}:${shell}"
             );
 
             passwdContents = (
@@ -145,7 +159,7 @@
               (lib.attrValues (lib.mapAttrs userToPasswd users))
             );
 
-                userToShadow = k: { ... }: "${k}:!:1::::::";
+            userToShadow = username: {...}: "${username}:!:1::::::";
 
             shadowContents = (
               lib.concatStringsSep "\n"
@@ -158,11 +172,11 @@
                 mappings = (
                   builtins.foldl'
                   (
-                          acc: user:
+                    acc: user: let
-                            let
                       groups = users.${user}.groups or [];
                     in
-                            acc ++ map
+                      acc
+                      ++ map
                       (group: {
                         inherit user group;
                       })
@@ -171,23 +185,23 @@
                   []
                   (lib.attrNames users)
                 );
-                  in
+              in (
-                  (
                 builtins.foldl'
                 (
-                        acc: v: acc // {
+                  acc: v:
+                    acc
+                    // {
                       ${v.group} = acc.${v.group} or [] ++ [v.user];
                     }
                 )
                 {}
-                      mappings)
+                mappings
+              )
             );
 
-                groupToGroup = k: { gid }:
+            groupToGroup = k: {gid}: let
-                  let
               members = groupMemberMap.${k} or [];
-                  in
+            in "${k}:x:${toString gid}:${lib.concatStringsSep "," members}";
-                  "${k}:x:${toString gid}:${lib.concatStringsSep "," members}";
 
             groupContents = (
               lib.concatStringsSep "\n"
@@ -206,13 +220,19 @@
               ];
             };
 
-                nixConfContents = (lib.concatStringsSep "\n" (lib.mapAttrsFlatten
+            nixConfContents =
-                  (n: v:
+              (lib.concatStringsSep "\n" (
-                    let
+                lib.attrsets.mapAttrsToList (
-                      vStr = if builtins.isList v then lib.concatStringsSep " " v else v;
+                  n: v: let
-                    in
+                    vStr =
-                    "${n} = ${vStr}")
+                      if builtins.isList v
-                  defaultNixConf)) + "\n";
+                      then lib.concatStringsSep " " v
+                      else v;
+                  in "${n} = ${vStr}"
+                )
+                defaultNixConf
+              ))
+              + "\n";
 
             containerSettings = ''
               [engine]
@@ -260,8 +280,7 @@
               };
             };
 
-                baseSystem =
+            baseSystem = let
-                  let
               nixpkgs = pkgs.path;
               channel = pkgs.runCommand "channel-nixos" {inherit bundleNixpkgs;} ''
                 mkdir $out
@@ -283,7 +302,8 @@
                     {
                       ${lib.concatStringsSep "\n" (builtins.map (output: ''
                         ${output} = { outPath = "${lib.getOutput output drv}"; };
-                          '') outputs)}
+                      '')
+                      outputs)}
                       outputs = [ ${lib.concatStringsSep " " (builtins.map (x: "\"${x}\"") outputs)} ];
                       name = "${drv.name}";
                       outPath = "${drv}";
@@ -291,7 +311,8 @@
                       type = "derivation";
                       meta = { };
                     }
-                      '') defaultPkgs)}
+                  '')
+                  defaultPkgs)}
                 ]
                 EOF
               '';
@@ -311,7 +332,8 @@
                   groupContents
                   nixConfContents
                   passwdContents
-                        shadowContents;
+                  shadowContents
+                  ;
                 passAsFile = [
                   "containerPolicy"
                   "containerRegistries"
@@ -366,7 +388,8 @@
                 mkdir -p $out/bin $out/usr/bin
                 ln -s ${pkgs.coreutils}/bin/env $out/usr/bin/env
                 ln -s ${pkgs.bashInteractive}/bin/bash $out/bin/sh
-                  '' + (lib.optionalString (flake-registry != null) ''
+              ''
+              + (lib.optionalString (flake-registry != null) ''
                 nixCacheDir="/root/.cache/nix"
                 mkdir -p $out$nixCacheDir
                 globalFlakeRegistryPath="$nixCacheDir/flake-registry.json"
@@ -380,9 +403,11 @@
               name = "nixos-runner";
               tag = "latest";
               maxLayers = 2;
-                contents = [
+              contents =
+                [
                   baseSystem
-                ] ++ defaultPkgs;
+                ]
+                ++ defaultPkgs;
               extraCommands = ''
                 rm -rf nix-support
                 ln -s /nix/var/nix/profiles nix/var/nix/gcroots/profiles
@@ -412,61 +437,21 @@
                 ];
               };
             };
-            # podman-push-container = pkgs.writeTextFile {
-            #   name = "podman-push-container";
-            #   destination = "/bin/podman-push-container";
-            #   text = builtins.replaceStrings
-            #     [
-            #       "@nushell@"
-            #       "@client@"
-            #     ]
-            #     [
-            #       "${pkgs.nushell}/bin/nu"
-            #       "${pkgs.podman}/bin/podman"
-            #     ]
-            #     (builtins.readFile ./push-container.nu);
-            #   executable = true;
-            # };
-            # docker-push-container = pkgs.writeTextFile {
-            #   name = "docker-push-container";
-            #   destination = "/bin/docker-push-container";
-            #   text = builtins.replaceStrings
-            #     [
-            #       "@nushell@"
-            #       "@client@"
-            #     ]
-            #     [
-            #       "${pkgs.nushell}/bin/nu"
-            #       "${docker-client}/bin/docker"
-            #     ]
-            #     (builtins.readFile ./push-container.nu);
-            #   executable = true;
-            # };
           push-container = pkgs.writeTextFile {
             name = "push-container";
             destination = "/bin/push-container";
-              text = builtins.replaceStrings
+            text = lib.concatStringsSep "\n" [
-                [
+              "#!${pkgs.nushell}/bin/nu"
-                  "@nushell@"
+              ""
-                  "@regctl@"
+              "alias regctl = ^${pkgs.regctl}/bin/regctl --verbosity warning"
-                ]
+              "alias gzip = ^${pkgs.gzip}/bin/gzip"
-                [
+              ""
-                  "${pkgs.nushell}/bin/nu"
+              (builtins.readFile ./push-container.nu)
-                  "${pkgs.regctl}/bin/regctl"
+            ];
-                ]
-                (builtins.readFile ./push-container.nu);
             executable = true;
           };
         };
         apps = {
-            # podman-push-container = {
-            #   type = "app";
-            #   program = "${self.packages.${system}.podman-push-container}/bin/podman-push-container";
-            # };
-            # docker-push-container = {
-            #   type = "app";
-            #   program = "${self.packages.${system}.docker-push-container}/bin/docker-push-container";
-            # };
           push-container = {
             type = "app";
             program = "${self.packages.${system}.push-container}/bin/push-container";

push-container.nu

@@ -1,4 +1,3 @@
-#!@nushell@
 def main [
     input: string # tar.gz file containing container image to be pushed to repository
     ...tags: string # Tags to be added to pushed container image
@@ -133,8 +132,6 @@ def main [
         }
     )
 
-    alias regctl = ^@regctl@ --verbosity warning
-    alias gzip = ^@gzip@
 
     regctl registry login $registry --user $auth.username --pass $auth.password