]>
Commit | Line | Data |
---|---|---|
1 | #!/bin/bash | |
2 | ||
3 | set -euo pipefail | |
4 | ||
5 | if ! which nix 2>/dev/null >/dev/null; then | |
6 | cat <<-EOF | |
7 | nix is needed, please install it: | |
8 | > curl https://nixos.org/nix/install | sh | |
9 | (or any other way handled by your distribution) | |
10 | EOF | |
11 | exit 1 | |
12 | fi | |
13 | ||
14 | if [ "${NIX_STORE:-/nix/store}" != "/nix/store" ]; then | |
15 | cat <<-EOF | |
16 | Nix store outside of /nix/store is not supported | |
17 | EOF | |
18 | exit 1 | |
19 | fi | |
20 | ||
21 | gpg_keys=$(pass ls Nixops/GPGKeys | sed -e "1d" | cut -d" " -f2) | |
22 | for key in $gpg_keys; do | |
23 | content=$(pass show Nixops/GPGKeys/$key) | |
24 | fpr=$(echo "$content" | gpg --import-options show-only --import --with-colons | grep -e "^pub" | cut -d':' -f5) | |
25 | gpg --list-key "$fpr" >/dev/null 2>/dev/null && imported=yes || imported=no | |
26 | # /usr/share/doc/gnupg/DETAILS field 2 | |
27 | (echo "$content" | gpg --import-options show-only --import --with-colons | | |
28 | grep -E '^pub:' | | |
29 | cut -d':' -f2 | | |
30 | grep -q '[fu]') && signed=yes || signed=no | |
31 | if [ "$signed" = no -o "$imported" = no ] ; then | |
32 | echo "The key for $key needs to be imported and signed (a local signature is enough)" | |
33 | echo "$content" | gpg --import-options show-only --import | |
34 | echo "Continue? [y/N]" | |
35 | read y | |
36 | if [ "$y" = "y" -o "$y" = "Y" ]; then | |
37 | echo "$content" | gpg --import | |
38 | gpg --expert --edit-key "$fpr" lsign quit | |
39 | else | |
40 | echo "Aborting" | |
41 | exit 1 | |
42 | fi | |
43 | fi | |
44 | done | |
45 | ||
46 | if nix show-config --json | jq -e '.sandbox.value == "true"' >/dev/null; then | |
47 | cat <<-EOF | |
48 | There used to be some impure derivations (grep __noChroot), you may need | |
49 | sandbox = "relaxed" | |
50 | in /etc/nix/nix.conf | |
51 | you may also want to add | |
52 | keep-outputs = true | |
53 | keep-derivations = true | |
54 | to prevent garbage collector from deleting build dependencies (they take a lot of time to build) | |
55 | and | |
56 | allow-import-from-derivation = false | |
57 | as an attempt to avoid having build-time derivations (doesn’t work for all packages) | |
58 | press key to continue | |
59 | EOF | |
60 | read y | |
61 | fi | |
62 | ||
63 | cat <<-EOF | |
64 | All set up. | |
65 | Please make sure you’re using make commands when deploying | |
66 | EOF |