1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
|
{
lib,
pkgs,
config,
checkForUpdates ? true,
}:
rec {
# Fetch the latest release tag from the GitHub releases API
fetchLatestGithubReleaseTag =
{ owner, repo }:
let
raw = builtins.fetchurl {
url = "https://api.github.com/repos/${owner}/${repo}/releases/latest";
name = "${repo}-latest-release.json";
};
json = builtins.fromJSON (builtins.readFile raw);
in
json.tag_name;
# Abort if the pinned version is older than the latest upstream release
checkExtensionVersion =
{
pname,
owner,
repo,
version,
urlTemplate, # human-readable template shown in the error message
tagPrefix ? "", # e.g. "v" if tags look like "v1.2.3"
}:
if !checkForUpdates then
version
else
let
latestTag = fetchLatestGithubReleaseTag { inherit owner repo; };
latestVersion =
if lib.hasPrefix tagPrefix latestTag then lib.removePrefix tagPrefix latestTag else latestTag;
in
if latestVersion != version then
throw ''
[${pname}] A newer release is available upstream — refusing to build a stale extension.
pinned version : ${version}
latest version : ${latestVersion} (tag: ${latestTag})
To upgrade, edit extensions/${pname}.nix:
1. Set version = "${latestVersion}";
2. Point the url at the new release asset:
${urlTemplate}
3. Set hash = lib.fakeHash;
then re-run your switch — it'll fail with a hash mismatch showing
the real sha256. Paste that in as the final hash.
4. Re-run once more. This check passes once pinned == latest.
To skip this check for now (e.g. offline / pure eval), set:
web.chromium.checkForUpdates = false;
''
else
version;
# Download and unpack a zip or crx file into an unpacked extension directory
fetchUnpackedExtension =
{
pname,
version,
url,
hash,
isCrx ? false,
extensionKey ? null, # Accept an optional public key
}:
pkgs.stdenv.mkDerivation {
inherit pname version;
src = pkgs.fetchurl { inherit url hash; };
nativeBuildInputs = [
config.file-management.ouch.package
pkgs.jq # Required for safely editing manifest.json
];
dontUnpack = true;
buildPhase = ''
runHook preBuild
mkdir -p $out
if [ "${lib.boolToString isCrx}" = "true" ]; then
# Verify the Cr24 magic header
magic=$(head -c 4 "$src")
if [ "$magic" != "Cr24" ]; then
echo "Error: $src is not a valid CRX file" >&2
exit 1
fi
# Extract header length in bytes 8 to 11
bytes=$(od -An -j8 -N4 -tu1 "$src")
read b1 b2 b3 b4 <<< $bytes
hlen=$(( b1 + (b2 << 8) + (b3 << 16) + (b4 << 24) ))
offset=$(( 12 + hlen ))
dd if=$src of=payload.zip bs=1 skip=$offset status=none
ouch decompress payload.zip --dir $out
else
ouch decompress $src --dir $out
fi
# Flatten a single wrapping folder
if [ "$(ls -1 $out | wc -l)" -eq 1 ] && [ -d "$out"/* ]; then
shopt -s dotglob
mv "$out"/*/* "$out"/ 2>/dev/null || true
rmdir "$out"/*/ 2>/dev/null || true
shopt -u dotglob
fi
# Inject the public key into manifest.json if provided
${lib.optionalString (extensionKey != null) ''
if [ -f "$out/manifest.json" ]; then
echo "Injecting extension key into manifest.json to lock the extension ID..."
jq '.key = "${extensionKey}"' "$out/manifest.json" > "$out/manifest.tmp.json"
mv "$out/manifest.tmp.json" "$out/manifest.json"
else
echo "Warning: No manifest.json found in $out to inject the key!" >&2
fi
''}
runHook postBuild
'';
installPhase = "true";
}; # Package a local directory as an unpacked extension
mkLocalExtension =
{
pname,
srcDir,
version ? "1.0.0",
}:
pkgs.stdenv.mkDerivation {
inherit pname version;
src = srcDir;
phases = [ "installPhase" ];
installPhase = ''
mkdir -p $out
cp -r $src/* $out/
'';
};
}
|
