Skip to content

Inject the repository commit id in boot menu entries - #228

Open
nlewo wants to merge 2 commits into
cloud-gouv:mainfrom
nlewo:boot-entry-commit-id
Open

nlewo wants to merge 2 commits into
cloud-gouv:mainfrom
nlewo:boot-entry-commit-id

Conversation

@nlewo

@nlewo nlewo commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

For convenience, it allows to get the commit id from the boot menu, but this modifies the derivation produced by nixos-rebuild since the commit id is injected via the builtins.getEnv.

Comment thread modules/updates/automatic-pull.nix Outdated
;
# nixos-rebuild is wrapped to add the repository HEAD commit id to the added boot menu entry.
# Note the derivation produced by this nixos-rebuild wrapper then differs from the one produced from the repository itself since it injects the commit id via builtins.getEnv.
nixos-rebuild-wrapped = pkgs.writeShellApplication {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it should be moved into a proper overlay directory and overlaid in the ambient pkgs so that every other module can refer to it, including the upgrade manual command

i also think it should shadow nixos-rebuild directly and re-expose nixos-rebuild unwrapped as an attribute on it as it's usual etiquette in nixpkgs

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the overlay, i then added nixos-rebuild (wrapped with git rev-parse) and nixos-rebuild-unwrapped (original version).

I built the auto-upgrade systemd unit to confirm the nixos-rebuild tool is the wrapped one.

For convenience, it allows to get the commit id from the boot menu,
but this modifies the derivation produced by nixos-rebuild since the
commit id is injected via the builtins.getEnv.
@nlewo
nlewo force-pushed the boot-entry-commit-id branch from 62c6b8d to 120f20e Compare August 26, 2026 15:54
@nlewo

nlewo commented Aug 26, 2026

Copy link
Copy Markdown
Contributor Author

@rlahfa-dinum I also renamed self: super: (which were not correctly ordered) to final: prev: which is the new nixpkgs convention.

@rlahfa-dinum rlahfa-dinum added status: awaiting-maintainers This is blocked on a maintainer's review bandwidth A/lifecycle Update system, system lifecycle: OTA, auto-pull, etc. labels Sep 2, 2026
git
];
text = ''
revision=$(git rev-parse HEAD)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What happens if this is run not in a Git repo? Can we have minimal fallback/error-handling here?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

#
# SPDX-License-Identifier: MIT

# nixos-rebuild is wrapped to add the repository HEAD commit id to the added boot menu entry.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be called git-aware-nixos-rebuild or something.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I finally called it nixos-rebuild-git-aware.

Actually, i'm a bit confused because in your previous comments, I had understood that you wanted to override nixos-rebuild while exposing the original one via the attribute nixos-rebuild-unwrapped.

In this fixup commit, I do not modify the attribute nixos-rebuild but just add an attribute nixos-rebuild-git-aware. This is much simpler.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wrote:

it should be moved into a proper overlay directory and overlaid in the ambient pkgs so that every other module can refer to it, including the upgrade manual command

i also think it should shadow nixos-rebuild directly and re-expose nixos-rebuild unwrapped as an attribute on it as it's usual etiquette in nixpkgs

this doesn't say anything about the name of the attribute? shadowing meant that it should shadow the nixos-rebuild binary in $PATH, but you can have the attribute named nixos-rebuild-git-aware producing a bin/nixos-rebuild and having a nixos-rebuild-git-aware.unwrapped attribute to get you access to the git-unaware attribute?

Comment thread pkgs/overlay.nix Outdated

super: self: (import ./default.nix { inherit (super) callPackage; })
final: prev:
(import ./default.nix {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's avoid passing all the arguments one by one and reuse dependency injection via callPackage otherwise the pattern is self defeating.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this is still relevant with my last commit.

Comment thread pkgs/default.nix Outdated
{ callPackage, nixos-rebuild }: {
mkPlasmaLookAndFeelPackage = callPackage ./plasma/mk-look-and-feel-package.nix { };
plasma-portail-tray-icon = callPackage ./plasma/portail-tray-icon { };
nixos-rebuild = callPackage ./nixos-rebuild { inherit nixos-rebuild; };

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You should define git-aware-nixos-rebuild on its own here while letting callPackage polyfill it.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this is still relevant with my last commit.

Comment thread pkgs/overlay.nix Outdated
final: prev:
(import ./default.nix {
inherit (final) callPackage;
nixos-rebuild = prev.nixos-rebuild;

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You should define a new overlay on its own, not in pkgs/default here, that makes use of a prev.callPackage pattern.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this is still relevant with my last commit.

# SPDX-License-Identifier: MIT

# nixos-rebuild is wrapped to add the repository HEAD commit id to the added boot menu entry.
# Note the derivation produced by this nixos-rebuild wrapper then differs from the one produced from the repository itself since it injects the commit id via builtins.getEnv.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add a link to the nixos-rebuild wrapper produced by the repository itself and the place where it makes use of builtins.getEnv ?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you add a link to the nixos-rebuild wrapper produced by the repository itself

What do you mean?
(This file contains the wrapper itself.)

I added a link to the nixpkgs code using getEnv (maybeEnv actually, which is a wrapper around getEnv).

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note the derivation produced by this nixos-rebuild wrapper then differs from the one produced from the repository itself since it injects the commit id via builtins.getEnv.

This comment seems to say there's a different piece of code to look at. Otherwise, can you try to rework the comment? I think I have trouble understanding it after rereading a couple of review passes already.

@rlahfa-dinum rlahfa-dinum left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor points but I think this is going to cause confusion otherwise if we do not nip this in the bud.

@rlahfa-dinum rlahfa-dinum added status: awaiting-author Blocked on author's actions and removed status: awaiting-maintainers This is blocked on a maintainer's review bandwidth labels Sep 2, 2026

@rlahfa-dinum rlahfa-dinum left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me, I think this should be tested real quick. Let's wait on someone from the team who has time to test this branch.

@rlahfa-dinum rlahfa-dinum added the status: awaiting smoke testing Awaiting basic smoke testing on the Sécurix team side. label Sep 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

A/lifecycle Update system, system lifecycle: OTA, auto-pull, etc. status: awaiting smoke testing Awaiting basic smoke testing on the Sécurix team side. status: awaiting-author Blocked on author's actions

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants