diff --git a/maintainers/scripts/bootstrap-files/README.md b/maintainers/scripts/bootstrap-files/README.md index 9abc4402a414..a353be6e3f60 100644 --- a/maintainers/scripts/bootstrap-files/README.md +++ b/maintainers/scripts/bootstrap-files/README.md @@ -11,10 +11,53 @@ These are called "bootstrap files". Bootstrap files should always be fetched from hydra and uploaded to `tarballs.nixos.org` to guarantee that all the binaries were built from the code committed into `nixpkgs` repository. -The uploads to `tarballs.nixos.org` are done by `@lovesegfault` today. +The uploads to `tarballs.nixos.org` are done by `@NixOS/infra` team members who have S3 write access. This document describes the procedure of updating bootstrap files in `nixpkgs`. +## How to upload bootstrap files (for infra team) + +When a PR updates bootstrap files, the commit message contains the upload commands. +Infra team members with S3 access can upload as follows: + +1. Clone or navigate to the [nixos-infra](https://github.com/NixOS/nixos-infra) repository and enter the `terraform` directory: + + ``` + $ cd nixos-infra/terraform + ``` + +2. Authenticate with AWS SSO: + + ``` + $ aws sso login + ``` + +3. Realize the build output locally (fetch from hydra cache): + + ``` + $ nix-store --realize /nix/store/-stdenv-bootstrap-tools + ``` + +4. Upload to S3 with public-read ACL: + + ``` + $ aws s3 cp --recursive --acl public-read \ + /nix/store/-stdenv-bootstrap-tools/on-server/ \ + s3://nixpkgs-tarballs/stdenv/// + ``` + +5. Verify the upload by downloading and checking hashes: + + ``` + $ aws s3 cp --recursive s3://nixpkgs-tarballs/stdenv/// ./ + $ sha256sum bootstrap-tools.tar.xz busybox + $ sha256sum /nix/store/-stdenv-bootstrap-tools/on-server/* + ``` + + Compare these hashes with those shown in the PR's commit message. + +The exact paths and hashes are provided in each bootstrap update commit message generated by `refresh-tarballs.bash`. + ## How to request the bootstrap seed update To get the tarballs updated let's use an example `i686-unknown-linux-gnu` target: @@ -34,7 +77,7 @@ To get the tarballs updated let's use an example `i686-unknown-linux-gnu` target To validate cross-targets `binfmt` `NixOS` helper can be useful. For `riscv64-unknown-linux-gnu` the `/etc/nixos/configuration.nix` entry would be `boot.binfmt.emulatedSystems = [ "riscv64-linux" ]`. -3. Propose the commit as a PR to update bootstrap tarballs, tag people who can help you test the updated architecture and once reviewed tag `@lovesegfault` to upload the tarballs. +3. Propose the commit as a PR to update bootstrap tarballs, tag people who can help you test the updated architecture and once reviewed tag `@NixOS/infra-build` to upload the tarballs. ## How to add bootstrap files for a new target