From 3914ca2b7c3eb556e0965a9e5df7fb9ffa3b8903 Mon Sep 17 00:00:00 2001 From: Aliaksandr Date: Wed, 1 Jul 2026 22:31:58 +0300 Subject: [PATCH 1/3] lens: 2024.11.261604 -> 2026.6.260931 Also switch the pinned hashes to sha512 SRI, sourced directly from the upstream electron-builder update manifests (latest-linux.yml / latest-mac.yml). Assisted-by: claude-code with claude-opus-4-8[1m]-high --- pkgs/by-name/le/lens/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/le/lens/package.nix b/pkgs/by-name/le/lens/package.nix index 6cbe93baffc1..40658c839cbe 100644 --- a/pkgs/by-name/le/lens/package.nix +++ b/pkgs/by-name/le/lens/package.nix @@ -8,20 +8,20 @@ let pname = "lens-desktop"; - version = "2024.11.261604"; + version = "2026.6.260931"; sources = { x86_64-linux = { url = "https://api.k8slens.dev/binaries/Lens-${version}-latest.x86_64.AppImage"; - hash = "sha256-AbuEU5gOckVU+eDIFnomc7ryLq68ihuk3c0XosoJp74="; + hash = "sha512-P9PrtbGKaHNlzZsm10ovkYCBBfQpVWBgcVsYLETMwINP2bzrIIK5HVbkbcTEUsxK90L7MQmFwpAssojW0b9G5Q=="; }; x86_64-darwin = { url = "https://api.k8slens.dev/binaries/Lens-${version}-latest.dmg"; - hash = "sha256-MQQRGTCe+LEHXJi6zjnpENbtlWNP+XVH9rWXRMk+26w="; + hash = "sha512-I/i9s7O3jT+eNqqUu6B+rB+YbegKhAsZwHlc3mp2wNWW9YDilQbzKrhF9Fq2dSz2WKVZUscBtSGtXCuiPcFXzw=="; }; aarch64-darwin = { url = "https://api.k8slens.dev/binaries/Lens-${version}-latest-arm64.dmg"; - hash = "sha256-aakJCLnQBAnUdrrniTcahS+q3/kP09mlaPTV8FW5afI="; + hash = "sha512-eCE3w7NlYrHiexCirH2wFN0nOO3qAt5acbldXbDMVIrG94tbgM8Y5ZO8/YIUN45XbotYtKW8/Nw+WsrTp6DPBg=="; }; }; From 265f057e0476bd245a7f54c75242e37b806b83b4 Mon Sep 17 00:00:00 2001 From: Aliaksandr Date: Wed, 1 Jul 2026 22:40:56 +0300 Subject: [PATCH 2/3] lens: add update script Drives version bumps off upstream's electron-builder auto-update manifests (latest-linux.yml / latest-mac.yml), which carry the version and the base64 sha512 digests for every artifact. Because the digests double as valid Nix SRI hashes, all three platforms are updated without downloading the (~250 MiB) images: update-source-version is called per --system with the hash passed explicitly. Assisted-by: claude-code with claude-opus-4-8[1m]-high --- pkgs/by-name/le/lens/darwin.nix | 3 +++ pkgs/by-name/le/lens/linux.nix | 3 +++ pkgs/by-name/le/lens/package.nix | 4 ++++ pkgs/by-name/le/lens/update.sh | 37 ++++++++++++++++++++++++++++++++ 4 files changed, 47 insertions(+) create mode 100755 pkgs/by-name/le/lens/update.sh diff --git a/pkgs/by-name/le/lens/darwin.nix b/pkgs/by-name/le/lens/darwin.nix index 3acc21000c51..81d520d5fbd1 100644 --- a/pkgs/by-name/le/lens/darwin.nix +++ b/pkgs/by-name/le/lens/darwin.nix @@ -4,6 +4,7 @@ version, src, meta, + updateScript, undmg, }: @@ -29,4 +30,6 @@ stdenv.mkDerivation { ''; dontFixup = true; + + passthru = { inherit updateScript; }; } diff --git a/pkgs/by-name/le/lens/linux.nix b/pkgs/by-name/le/lens/linux.nix index e101ab53556c..81ed42f60958 100644 --- a/pkgs/by-name/le/lens/linux.nix +++ b/pkgs/by-name/le/lens/linux.nix @@ -3,6 +3,7 @@ version, src, meta, + updateScript, appimageTools, makeWrapper, }: @@ -21,6 +22,8 @@ appimageTools.wrapType2 { meta ; + passthru = { inherit updateScript; }; + nativeBuildInputs = [ makeWrapper ]; extraInstallCommands = '' diff --git a/pkgs/by-name/le/lens/package.nix b/pkgs/by-name/le/lens/package.nix index 40658c839cbe..0decf480c2ad 100644 --- a/pkgs/by-name/le/lens/package.nix +++ b/pkgs/by-name/le/lens/package.nix @@ -41,6 +41,8 @@ let platforms = builtins.attrNames sources; }; + updateScript = ./update.sh; + in if stdenv.hostPlatform.isDarwin then callPackage ./darwin.nix { @@ -49,6 +51,7 @@ if stdenv.hostPlatform.isDarwin then version src meta + updateScript ; } else @@ -58,5 +61,6 @@ else version src meta + updateScript ; } diff --git a/pkgs/by-name/le/lens/update.sh b/pkgs/by-name/le/lens/update.sh new file mode 100755 index 000000000000..12174d9799fc --- /dev/null +++ b/pkgs/by-name/le/lens/update.sh @@ -0,0 +1,37 @@ +#!/usr/bin/env nix-shell +#!nix-shell -i bash -p common-updater-scripts curl yq-go jq + +set -euo pipefail + +base="https://api.k8slens.dev/binaries" + +# Lens is built with electron-builder, which publishes an auto-update manifest +# next to each binary. These manifests carry both the latest version and the +# base64 sha512 digest of every artifact, so we can bump all platforms without +# downloading the (~250 MiB) images ourselves. +linux_manifest=$(curl -sfL "$base/latest-linux.yml" | yq -o=json) +mac_manifest=$(curl -sfL "$base/latest-mac.yml" | yq -o=json) + +# The manifest reports e.g. "2026.6.260931-latest"; the "-latest" suffix only +# lives in the download URL, so drop it from the Nix version. +version=$(jq -r '.version' <<<"$linux_manifest") +version=${version%-latest} + +# electron-builder records base64-encoded sha512 digests, which are already +# valid Nix SRI hashes once prefixed with "sha512-". Match artifacts by filename +# suffix (endswith) rather than a regex to keep jq's string escaping out of play. +manifest_hash() { + echo "sha512-$(jq -r --arg suffix "$1" '.files[] | select(.url | endswith($suffix)) | .sha512' <<<"$2" | head -n1)" +} + +appimage_hash=$(manifest_hash '.x86_64.AppImage' "$linux_manifest") +dmg_hash=$(manifest_hash '-latest.dmg' "$mac_manifest") +arm64_dmg_hash=$(manifest_hash '-arm64.dmg' "$mac_manifest") + +# The three platforms share one version but have distinct hashes. --system picks +# which source (and therefore which hash) update-source-version rewrites; passing +# the hash explicitly avoids a download. The version is written on the first call, +# so the darwin calls need --ignore-same-version to not early-exit as "unchanged". +update-source-version lens "$version" "$appimage_hash" --system=x86_64-linux +update-source-version lens "$version" "$dmg_hash" --system=x86_64-darwin --ignore-same-version +update-source-version lens "$version" "$arm64_dmg_hash" --system=aarch64-darwin --ignore-same-version From 95efce09c3512e6cb4c579cd515d3acac793fa82 Mon Sep 17 00:00:00 2001 From: Aliaksandr Date: Wed, 1 Jul 2026 22:41:37 +0300 Subject: [PATCH 3/3] lens: add qweered as maintainer Assisted-by: claude-code with claude-opus-4-8[1m]-high --- pkgs/by-name/le/lens/package.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/le/lens/package.nix b/pkgs/by-name/le/lens/package.nix index 0decf480c2ad..dd955dbe67de 100644 --- a/pkgs/by-name/le/lens/package.nix +++ b/pkgs/by-name/le/lens/package.nix @@ -35,6 +35,7 @@ let license = lib.licenses.lens; maintainers = with lib.maintainers; [ dbirks + qweered RossComputerGuy starkca90 ];