From dd49e078cbbc63abd38d1ea42e93bca348915ab9 Mon Sep 17 00:00:00 2001 From: 06kellyjac Date: Thu, 16 Oct 2025 19:32:49 +0100 Subject: [PATCH 1/5] witness: 0.9.2 -> 0.10.1 Diff: https://github.com/in-toto/witness/compare/v0.9.2...v0.10.1 Changelog: https://github.com/testifysec/witness/releases/tag/v0.10.1 --- pkgs/by-name/wi/witness/package.nix | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/wi/witness/package.nix b/pkgs/by-name/wi/witness/package.nix index 214aec9cf025..8e1930bf8c81 100644 --- a/pkgs/by-name/wi/witness/package.nix +++ b/pkgs/by-name/wi/witness/package.nix @@ -12,15 +12,15 @@ buildGoModule rec { pname = "witness"; - version = "0.9.2"; + version = "0.10.1"; src = fetchFromGitHub { owner = "in-toto"; repo = "witness"; rev = "v${version}"; - sha256 = "sha256-0Q+6nG5N3Xp5asmRMPZccLxw6dWiZVX6fuIUf1rT+mI="; + sha256 = "sha256-MKiPIZFeCWOT4zTbG7SjwdNUHFuqsL4pGu4VvVwyn3s="; }; - vendorHash = "sha256-oH/aWt8Hl/BIN+IYLcuVYWDpQZaYABAOGxXyLssjQg0="; + vendorHash = "sha256-V3SuhBbhXyA0SFOGfBrV/qH+cROr2obHOBcivkgRO6U="; nativeBuildInputs = [ installShellFiles ]; @@ -38,6 +38,8 @@ buildGoModule rec { # want but also limits the tests preCheck = '' unset subPackages + # tests expect no version set + unset ldflags ''; postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) '' From f2b7d7b9c87c8cbf598d053771f25e16e6cdfe50 Mon Sep 17 00:00:00 2001 From: 06kellyjac Date: Thu, 16 Oct 2025 19:33:47 +0100 Subject: [PATCH 2/5] witness: provide completions for cross-compile Already skipped to keep compatible with cross but now also provide completions. --- pkgs/by-name/wi/witness/package.nix | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/wi/witness/package.nix b/pkgs/by-name/wi/witness/package.nix index 8e1930bf8c81..01a474354757 100644 --- a/pkgs/by-name/wi/witness/package.nix +++ b/pkgs/by-name/wi/witness/package.nix @@ -3,11 +3,14 @@ stdenv, buildGoModule, fetchFromGitHub, - installShellFiles, # testing testers, witness, + + installShellFiles, + + buildPackages, }: buildGoModule rec { @@ -42,12 +45,20 @@ buildGoModule rec { unset ldflags ''; - postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) '' - installShellCompletion --cmd witness \ - --bash <($out/bin/witness completion bash) \ - --fish <($out/bin/witness completion fish) \ - --zsh <($out/bin/witness completion zsh) - ''; + postInstall = + let + exe = + if stdenv.buildPlatform.canExecute stdenv.hostPlatform then + "$out/bin/witness" + else + lib.getExe buildPackages.witness; + in + '' + installShellCompletion --cmd witness \ + --bash <(${exe} completion bash) \ + --fish <(${exe} completion fish) \ + --zsh <(${exe} completion zsh) + ''; passthru.tests.version = testers.testVersion { package = witness; From 69baf2130dab51e4ee7089b74c39abc50be4d561 Mon Sep 17 00:00:00 2001 From: 06kellyjac Date: Thu, 16 Oct 2025 19:35:43 +0100 Subject: [PATCH 3/5] witness: switch to versionCheckHook --- pkgs/by-name/wi/witness/package.nix | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/pkgs/by-name/wi/witness/package.nix b/pkgs/by-name/wi/witness/package.nix index 01a474354757..ba7d7adbc6f5 100644 --- a/pkgs/by-name/wi/witness/package.nix +++ b/pkgs/by-name/wi/witness/package.nix @@ -4,13 +4,10 @@ buildGoModule, fetchFromGitHub, - # testing - testers, - witness, - + buildPackages, installShellFiles, - buildPackages, + versionCheckHook, }: buildGoModule rec { @@ -60,11 +57,11 @@ buildGoModule rec { --zsh <(${exe} completion zsh) ''; - passthru.tests.version = testers.testVersion { - package = witness; - command = "witness version"; - version = "v${version}"; - }; + doInstallCheck = true; + nativeInstallCheckInputs = [ + versionCheckHook + ]; + versionCheckProgramArg = "version"; meta = { description = "Pluggable framework for software supply chain security. Witness prevents tampering of build materials and verifies the integrity of the build process from source to target"; From 22991b2345076b417547b6c7915f44256d0aafef Mon Sep 17 00:00:00 2001 From: 06kellyjac Date: Thu, 16 Oct 2025 19:37:00 +0100 Subject: [PATCH 4/5] witness: move to finalAttrs pattern --- pkgs/by-name/wi/witness/package.nix | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/by-name/wi/witness/package.nix b/pkgs/by-name/wi/witness/package.nix index ba7d7adbc6f5..707edd4a4dcb 100644 --- a/pkgs/by-name/wi/witness/package.nix +++ b/pkgs/by-name/wi/witness/package.nix @@ -10,14 +10,14 @@ versionCheckHook, }: -buildGoModule rec { +buildGoModule (finalAttrs: { pname = "witness"; version = "0.10.1"; src = fetchFromGitHub { owner = "in-toto"; repo = "witness"; - rev = "v${version}"; + rev = "v${finalAttrs.version}"; sha256 = "sha256-MKiPIZFeCWOT4zTbG7SjwdNUHFuqsL4pGu4VvVwyn3s="; }; vendorHash = "sha256-V3SuhBbhXyA0SFOGfBrV/qH+cROr2obHOBcivkgRO6U="; @@ -30,7 +30,7 @@ buildGoModule rec { ldflags = [ "-s" "-w" - "-X github.com/in-toto/witness/cmd.Version=v${version}" + "-X github.com/in-toto/witness/cmd.Version=v${finalAttrs.version}" ]; # Feed in all tests for testing @@ -76,11 +76,11 @@ buildGoModule rec { ''; mainProgram = "witness"; homepage = "https://github.com/testifysec/witness"; - changelog = "https://github.com/testifysec/witness/releases/tag/v${version}"; + changelog = "https://github.com/testifysec/witness/releases/tag/v${finalAttrs.version}"; license = lib.licenses.asl20; maintainers = with lib.maintainers; [ fkautz jk ]; }; -} +}) From fab9ed88ee44e431ff3a9779a9d097c262c7acf0 Mon Sep 17 00:00:00 2001 From: 06kellyjac Date: Thu, 16 Oct 2025 19:37:45 +0100 Subject: [PATCH 5/5] witness: use tag for src --- pkgs/by-name/wi/witness/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/wi/witness/package.nix b/pkgs/by-name/wi/witness/package.nix index 707edd4a4dcb..bd8f7799e5df 100644 --- a/pkgs/by-name/wi/witness/package.nix +++ b/pkgs/by-name/wi/witness/package.nix @@ -17,7 +17,7 @@ buildGoModule (finalAttrs: { src = fetchFromGitHub { owner = "in-toto"; repo = "witness"; - rev = "v${finalAttrs.version}"; + tag = "v${finalAttrs.version}"; sha256 = "sha256-MKiPIZFeCWOT4zTbG7SjwdNUHFuqsL4pGu4VvVwyn3s="; }; vendorHash = "sha256-V3SuhBbhXyA0SFOGfBrV/qH+cROr2obHOBcivkgRO6U="; @@ -30,7 +30,7 @@ buildGoModule (finalAttrs: { ldflags = [ "-s" "-w" - "-X github.com/in-toto/witness/cmd.Version=v${finalAttrs.version}" + "-X github.com/in-toto/witness/cmd.Version=${finalAttrs.src.tag}" ]; # Feed in all tests for testing @@ -76,7 +76,7 @@ buildGoModule (finalAttrs: { ''; mainProgram = "witness"; homepage = "https://github.com/testifysec/witness"; - changelog = "https://github.com/testifysec/witness/releases/tag/v${finalAttrs.version}"; + changelog = "https://github.com/testifysec/witness/releases/tag/${finalAttrs.src.tag}"; license = lib.licenses.asl20; maintainers = with lib.maintainers; [ fkautz