Merge pull request #163 from ryantm/rtm-2-21-recursive-nix

contrib: add direct tests for agenix

.github/workflows/ci.yaml

@@ -9,7 +9,9 @@ jobs:
     - uses: actions/checkout@v3
     - uses: cachix/install-nix-action@v22
       with:
-        extra_nix_config: "system-features = nixos-test benchmark big-parallel kvm"
+        extra_nix_config: |
+          system-features = nixos-test recursive-nix benchmark big-parallel kvm
+          extra-experimental-features = recursive-nix nix-command flakes
     - run: nix build
     - run: nix build .#doc
     - run: nix fmt . -- --check
@@ -20,7 +22,9 @@ jobs:
     - uses: actions/checkout@v3
     - uses: cachix/install-nix-action@v22
       with:
-        extra_nix_config: "system-features = nixos-test benchmark big-parallel kvm"
+        extra_nix_config: |
+          system-features = nixos-test recursive-nix benchmark big-parallel kvm
+          extra-experimental-features = recursive-nix nix-command flakes
     - run: nix build
     - run: nix build .#doc
     - run: nix fmt . -- --check

pkgs/agenix.nix

@@ -9,29 +9,49 @@
   substituteAll,
   ageBin ? "${rage}/bin/rage",
   shellcheck,
-}:
+}: let
-stdenv.mkDerivation rec {
+  bin = "${placeholder "out"}/bin/agenix";
-  pname = "agenix";
+in
-  version = "0.15.0";
+  stdenv.mkDerivation rec {
-  src = substituteAll {
+    pname = "agenix";
-    inherit ageBin version;
+    version = "0.15.0";
-    jqBin = "${jq}/bin/jq";
+    src = substituteAll {
-    nixInstantiate = "${nix}/bin/nix-instantiate";
+      inherit ageBin version;
-    mktempBin = "${mktemp}/bin/mktemp";
+      jqBin = "${jq}/bin/jq";
-    diffBin = "${diffutils}/bin/diff";
+      nixInstantiate = "${nix}/bin/nix-instantiate";
-    src = ./agenix.sh;
+      mktempBin = "${mktemp}/bin/mktemp";
-  };
+      diffBin = "${diffutils}/bin/diff";
-  dontUnpack = true;
+      src = ./agenix.sh;
+    };
+    dontUnpack = true;
+    doInstallCheck = true;
+    installCheckInputs = [shellcheck];
+    postInstallCheck = ''
+      shellcheck ${bin}
+      ${bin} -h | grep ${version}
 
-  doCheck = true;
+      mkdir -p /tmp/home/.ssh
-  checkInputs = [shellcheck];
+      cp -r "${../example}" /tmp/home/secrets
-  postCheck = ''
+      chmod -R u+rw /tmp/home/secrets
-    shellcheck $src
+      export HOME=/tmp/home
-  '';
+      (
+      umask u=rw,g=r,o=r
+      cp ${../example_keys/user1.pub} $HOME/.ssh/id_ed25519.pub
+      chown $UID $HOME/.ssh/id_ed25519.pub
+      )
+      (
+      umask u=rw,g=,o=
+      cp ${../example_keys/user1} $HOME/.ssh/id_ed25519
+      chown $UID $HOME/.ssh/id_ed25519
+      )
 
-  installPhase = ''
+      cd /tmp/home/secrets
-    install -D $src ${placeholder "out"}/bin/agenix
+      test $(${bin} -d secret1.age) = "hello"
-  '';
+    '';
 
-  meta.description = "age-encrypted secrets for NixOS";
+    installPhase = ''
-}
+      install -D $src ${bin}
+    '';
+
+    meta.description = "age-encrypted secrets for NixOS";
+  }