pkgs/servers/authelia/update.sh

   1 #! /usr/bin/env nix-shell
   2 #! nix-shell -I nixpkgs=./. -i bash -p coreutils gnused curl nix jq nodePackages.npm
   3 set -euo pipefail
   4
   5 DRV_DIR="$(dirname "${BASH_SOURCE[0]}")"
   6 DRV_DIR=$(realpath "$DRV_DIR")
   7 NIXPKGS_ROOT="$DRV_DIR/../../.."
   8 NIXPKGS_ROOT=$(realpath "$NIXPKGS_ROOT")
   9
  10 instantiateClean() {
  11     nix-instantiate --eval --strict -E "with import ./. {}; $1" | cut -d\" -f2
  12 }
  13 fetchNewHash() {
  14     set +eo pipefail
  15     HASH="$(nix-build -A "$1" 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g')"
  16     set -eo pipefail
  17     if [ -z "$HASH" ]; then
  18       echo "Could not generate hash" >&2
  19       exit 1
  20     else
  21       echo "$HASH"
  22     fi
  23 }
  24 replace() {
  25     sed -i "s@$1@$2@g" "$3"
  26 }
  27
  28 grab_version() {
  29     instantiateClean "authelia.version"
  30 }
  31
  32 # provide a github token so you don't get rate limited
  33 # if you use gh cli you can use:
  34 #     `export GITHUB_TOKEN="$(cat ~/.config/gh/config.yml | yq '.hosts."github.com".oauth_token' -r)"`
  35 # or just set your token by hand:
  36 #     `read -s -p "Enter your token: " GITHUB_TOKEN; export GITHUB_TOKEN`
  37 #     (we use read so it doesn't show in our shell history and in secret mode so the token you paste isn't visible)
  38 if [ -z "${GITHUB_TOKEN:-}" ]; then
  39     echo "no GITHUB_TOKEN provided - you could meet API request limiting" >&2
  40 fi
  41
  42 OLD_VERSION=$(instantiateClean "authelia.version")
  43
  44 LATEST_TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --silent https://api.github.com/repos/authelia/authelia/releases/latest | jq -r '.tag_name')
  45 NEW_VERSION=$(echo ${LATEST_TAG} | sed 's/^v//')
  46
  47 if [[ "$OLD_VERSION" == "$NEW_VERSION" ]]; then
  48     echo "already up to date"
  49     exit
  50 fi
  51
  52 TMP_HASH="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
  53 echo "New version $NEW_VERSION"
  54 replace "$OLD_VERSION" "$NEW_VERSION" "$DRV_DIR/sources.nix"
  55 OLD_SRC_HASH="$(instantiateClean authelia.src.outputHash)"
  56 echo "Old src hash $OLD_SRC_HASH"
  57 replace "$OLD_SRC_HASH" "$TMP_HASH" "$DRV_DIR/sources.nix"
  58 NEW_SRC_HASH="$(fetchNewHash authelia.src)"
  59 echo "New src hash $NEW_SRC_HASH"
  60 replace "$TMP_HASH" "$NEW_SRC_HASH" "$DRV_DIR/sources.nix"
  61
  62 # after updating src the next focus is the web dependencies
  63 # build package-lock.json since authelia uses pnpm
  64 WEB_DIR=$(mktemp -d)
  65 clean_up() {
  66   rm -rf "$WEB_DIR"
  67 }
  68 trap clean_up EXIT
  69
  70 OLD_PWD=$PWD
  71 cd $WEB_DIR
  72 OUT=$(nix-build -E "with import $NIXPKGS_ROOT {}; authelia.src" --no-out-link)
  73 cp -r $OUT/web/package.json .
  74 npm install --package-lock-only --legacy-peer-deps --ignore-scripts
  75 mv package-lock.json "$DRV_DIR/"
  76 cd $OLD_PWD
  77
  78 OLD_NPM_DEPS_HASH="$(instantiateClean authelia.web.npmDepsHash)"
  79 echo "Old npm deps hash $OLD_NPM_DEPS_HASH"
  80 replace "$OLD_NPM_DEPS_HASH" "$TMP_HASH" "$DRV_DIR/sources.nix"
  81 NEW_NPM_DEPS_HASH="$(fetchNewHash authelia.web)"
  82 echo "New npm deps hash $NEW_NPM_DEPS_HASH"
  83 replace "$TMP_HASH" "$NEW_NPM_DEPS_HASH" "$DRV_DIR/sources.nix"
  84 clean_up
  85
  86 OLD_GO_VENDOR_HASH="$(instantiateClean authelia.vendorHash)"
  87 echo "Old go vendor hash $OLD_GO_VENDOR_HASH"
  88 replace "$OLD_GO_VENDOR_HASH" "$TMP_HASH" "$DRV_DIR/sources.nix"
  89 NEW_GO_VENDOR_HASH="$(fetchNewHash authelia.goModules)"
  90 echo "New go vendor hash $NEW_GO_VENDOR_HASH"
  91 replace "$TMP_HASH" "$NEW_GO_VENDOR_HASH" "$DRV_DIR/sources.nix"