chromium-hsts-preload-list: init at 151.0.7891.2

pkgs/by-name/ch/chromium-hsts-preload-list/package.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "chromium-hsts-preload-list";
+  version = "151.0.7891.2";
+
+  src = fetchurl {
+    url = "https://raw.github.com/chromium/chromium/${finalAttrs.version}/net/http/transport_security_state_static.json";
+    hash = "sha256-YuiotSk0Lf3IHz/UjgCmU/brdB1lszob6DN4DXyjiWU=";
+  };
+
+  dontUnpack = true;
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm444 $src $out/share/chromium-hsts-preload-list/transport_security_state_static.json
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Chromium HSTS preload list";
+    homepage = "https://www.chromium.org/hsts/";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ schembriaiden ];
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/ch/chromium-hsts-preload-list/update.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p common-updater-scripts curl jq nix
+
+set -euo pipefail
+
+latest_version=$(
+    curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/chromium/chromium/tags" \
+        | jq -r 'map(select(.prerelease | not)) | .[1].name'
+)
+
+hash=$(
+    nix-prefetch-url "https://raw.github.com/chromium/chromium/$latest_version/net/http/transport_security_state_static.json"
+)
+sri_hash=$(nix hash convert --hash-algo sha256 --to sri "$hash")
+
+cd "$(dirname "$0")/../../../.."
+update-source-version chromium-hsts-preload-list "$latest_version" "$sri_hash"

pkgs/by-name/la/ladybird/package.nix

@@ -3,11 +3,11 @@
   stdenv,
   fetchFromGitHub,
   fetchpatch,
-  fetchurl,
   unicode-emoji,
   unicode-character-database,
   unicode-idna,
   publicsuffix-list,
+  chromium-hsts-preload-list,
   cmake,
   ninja,
   pkg-config,
@@ -44,12 +44,6 @@
   simdjson,
 }:
 
-let
-  hstsPreloadData = fetchurl {
-    url = "https://raw.githubusercontent.com/chromium/chromium/aa04f175415addb04bb78936b0d8b973fbd8ea61/net/http/transport_security_state_static.json";
-    hash = "sha256-TKcPBRVxoZgka8M3vTV/dZ+4+f3t2+ZrZZYJl1QO4WM=";
-  };
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ladybird";
   version = "0-unstable-2026-06-05";
@@ -97,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
     cp ${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat build/Caches/PublicSuffix
 
     mkdir build/Caches/HSTSPreload
-    cp ${hstsPreloadData} build/Caches/HSTSPreload/transport_security_state_static.json
+    cp ${chromium-hsts-preload-list}/share/chromium-hsts-preload-list/transport_security_state_static.json build/Caches/HSTSPreload
   '';
 
   nativeBuildInputs = [

pkgs/by-name/li/libhsts/package.nix

@@ -2,21 +2,12 @@
   lib,
   stdenv,
   fetchFromGitLab,
-  fetchurl,
+  chromium-hsts-preload-list,
   autoconf-archive,
   autoreconfHook,
   pkg-config,
   python3,
 }:
-let
-  chromium_version = "151.0.7891.2";
-
-  hsts_list = fetchurl {
-    url = "https://raw.github.com/chromium/chromium/${chromium_version}/net/http/transport_security_state_static.json";
-    hash = "sha256-YuiotSk0Lf3IHz/UjgCmU/brdB1lszob6DN4DXyjiWU=";
-  };
-
-in
 stdenv.mkDerivation rec {
   pname = "libhsts";
   version = "0.1.0";
@@ -39,7 +30,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     pushd tests
-    cp ${hsts_list} transport_security_state_static.json
+    cp ${chromium-hsts-preload-list}/share/chromium-hsts-preload-list/transport_security_state_static.json .
     # strip comments from json
     sed 's/^ *\/\/.*$//g' transport_security_state_static.json >hsts.json
     popd
@@ -53,8 +44,6 @@ stdenv.mkDerivation rec {
     python3
   ];
 
-  passthru.updateScript = ./update.sh;
-
   meta = {
     description = "Library to easily check a domain against the Chromium HSTS Preload list";
     mainProgram = "hsts";

pkgs/by-name/li/libhsts/update.sh

@@ -1,14 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl jq
-
-set -euo pipefail -x
-
-cd "$(dirname "$0")"
-
-chromium_version=$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/chromium/chromium/tags" | jq -r 'map(select(.prerelease | not)) | .[1].name')
-sha256=$(nix-prefetch-url "https://raw.github.com/chromium/chromium/$chromium_version/net/http/transport_security_state_static.json")
-hash=$(nix hash convert --to sri "$sha256")
-
-sed -e "0,/chromium_version/s/chromium_version = \".*\"/chromium_version = \"$chromium_version\"/" \
-    -e "0,/hash/s/hash = \".*\"/sha256 = \"$hash\"/" \
-  --in-place ./default.nix