vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

remove the hive-c0re forge-credential chain nothing reads any more

Browse source 
With no nix build on the hive, the boot publish of the forge token for nix has no reader. Removes the ForgeSweep node, the token file, the git credential helper and hive-c0re's forge gitconfig sections.
This commit is contained in:
atlas 2026-10-29 22:55:31 +01:00
commit 221c3f35a1
1 changed files with 69 additions and 310 deletions
Download patch file Download diff file Expand all files Collapse all files

45
nix/host-modules/lib/hive-forge-git.nix
View file

@ -1,45 +0,0 @@
# Git settings for the host processes that hand nix a forge URL: hive-c0re
# (prebuilds as `hive-core`) and hive-priv (builds as root, with a HOME of its
# own), each through its own `$HOME/.gitconfig`. nix runs `git` for a `git+…`
# input, so git's config is the only credential and URL plumbing it has.
#
# - `credential`: the forge host answers through `git-credential-hive-forge`,
# which reads the hive's own forge account and token from the file hive-c0re
# publishes. An empty `helper =` first resets the list, so no /etc/gitconfig
# helper (e.g. `oauth`, which waits on a browser) runs ahead of ours.
# - `url`: the swarm's `internal/meta` lock names its inputs by the forge's
# `https` URL, which only the builder's credential helper answers for. They
# are fetched over the `http` URL the helper above is scoped to.
#
# Pure function — NOT a NixOS module (don't add it to the host-modules
# aggregator). Call it from a module's `let`:
#
# forgeGit = import ./lib/hive-forge-git.nix { inherit pkgs; forgeDomain = …; };
# # then put `forgeGit.credentialHelper` on the unit's `path` and
# # `forgeGit.config` into its gitconfig.
{ pkgs, forgeDomain }:
{
# Answers only `get`. The file (`/run/hyperhive/forge-hive-token`, hive-c0re's
# `paths::FORGE_HIVE_TOKEN`) holds the account on its first line and the
# token on its second; it is read on every invocation, so it never holds a
# stale copy and survives token rotation. Prints nothing where the file is
# absent or incomplete.
credentialHelper = pkgs.writeShellScriptBin "git-credential-hive-forge" ''
[ "''${1:-}" = "get" ] || exit 0
[ -r /run/hyperhive/forge-hive-token ] || exit 0
{ read -r login; read -r token; } < /run/hyperhive/forge-hive-token || true
[ -n "$login" ] && [ -n "$token" ] || exit 0
printf 'username=%s\n' "$login"
printf 'password=%s\n' "$token"
'';
config = ''
[credential]
helper =
[credential "http://${forgeDomain}"]
helper =
helper = hive-forge
[url "http://${forgeDomain}/"]
insteadOf = https://${forgeDomain}/
'';
}