From 0b8d60aeebd62a0e034f0dc95e8502aeb1c0e6aa Mon Sep 17 00:00:00 2001
From: guangtao <gtrunsec@hardenedlinux.org>
Date: Sat, 25 Nov 2023 22:54:28 -0800
Subject: [PATCH] feat(pops/scripts): add writeShellApplication

---
 examples/packages/_sources/generated.json    | 32 +++++-----
 examples/packages/_sources/generated.nix     |  7 +--
 src/pops/_misc/writeShellApplication.nix     | 61 ++++++++++++++++++++
 src/pops/scripts.nix                         |  1 +
 units/scripts/nvfetcher-update/default.nix   |  7 +--
 units/scripts/nvfetcher-update/entrypoint.sh |  7 ++-
 6 files changed, 86 insertions(+), 29 deletions(-)
 create mode 100644 src/pops/_misc/writeShellApplication.nix

diff --git a/examples/packages/_sources/generated.json b/examples/packages/_sources/generated.json
index c88b9f4..582da2c 100644
--- a/examples/packages/_sources/generated.json
+++ b/examples/packages/_sources/generated.json
@@ -1,17 +1,17 @@
 {
-  "flake8-black": {
-    "cargoLocks": null,
-    "date": null,
-    "extract": null,
-    "name": "flake8-black",
-    "passthru": null,
-    "pinned": false,
-    "src": {
-      "name": null,
-      "sha256": "sha256-DfvKMnR3d5KlvLKviHpMrXLHLQ6GyU4I46PeFRu0HDQ=",
-      "type": "url",
-      "url": "https://pypi.org/packages/source/f/flake8-black/flake8-black-0.3.6.tar.gz"
-    },
-    "version": "0.3.6"
-  }
-}
+    "flake8-black": {
+        "cargoLocks": null,
+        "date": null,
+        "extract": null,
+        "name": "flake8-black",
+        "passthru": null,
+        "pinned": false,
+        "src": {
+            "name": null,
+            "sha256": "sha256-DfvKMnR3d5KlvLKviHpMrXLHLQ6GyU4I46PeFRu0HDQ=",
+            "type": "url",
+            "url": "https://pypi.org/packages/source/f/flake8-black/flake8-black-0.3.6.tar.gz"
+        },
+        "version": "0.3.6"
+    }
+}
\ No newline at end of file
diff --git a/examples/packages/_sources/generated.nix b/examples/packages/_sources/generated.nix
index d4d34c8..6f761ad 100644
--- a/examples/packages/_sources/generated.nix
+++ b/examples/packages/_sources/generated.nix
@@ -1,10 +1,5 @@
 # This file was generated by nvfetcher, please do not modify it manually.
-{
-  fetchgit,
-  fetchurl,
-  fetchFromGitHub,
-  dockerTools,
-}:
+{ fetchgit, fetchurl, fetchFromGitHub, dockerTools }:
 {
   flake8-black = {
     pname = "flake8-black";
diff --git a/src/pops/_misc/writeShellApplication.nix b/src/pops/_misc/writeShellApplication.nix
new file mode 100644
index 0000000..640e89f
--- /dev/null
+++ b/src/pops/_misc/writeShellApplication.nix
@@ -0,0 +1,61 @@
+_:
+{ nixpkgs }:
+let
+  l = nixpkgs.lib // builtins;
+in
+{
+  name,
+  text,
+  runtimeInputs ? [ ],
+  runtimeEnv ? { },
+  runtimeShell ? nixpkgs.runtimeShell,
+  checkPhase ? null,
+}:
+let
+  runtimeShell' =
+    if runtimeShell != nixpkgs.runtimeShell then
+      (l.getExe runtimeShell)
+    else
+      runtimeShell;
+  text' = if l.isPath text then nixpkgs.lib.fileContents text else text;
+in
+nixpkgs.writeTextFile {
+  inherit name;
+  executable = true;
+  destination = "/bin/${name}";
+  text =
+    ''
+      #!${runtimeShell'}
+      # shellcheck shell=bash
+      set -o errexit
+      set -o nounset
+      set -o pipefail
+
+    ''
+    + l.optionalString (runtimeInputs != [ ]) ''
+      export PATH="${l.makeBinPath runtimeInputs}:$PATH"
+    ''
+    + l.optionalString (runtimeEnv != { }) ''
+      ${l.concatStringsSep "\n" (
+        l.mapAttrsToList (n: v: "export ${n}=${''"$''}{${n}:-${toString v}}${''"''}")
+          runtimeEnv
+      )}
+    ''
+    + ''
+
+      ${text'}
+    '';
+
+  checkPhase =
+    if checkPhase == null then
+      ''
+        runHook preCheck
+        ${nixpkgs.stdenv.shellDryRun} "$target"
+        ${nixpkgs.shellcheck}/bin/shellcheck "$target"
+        runHook postCheck
+      ''
+    else
+      checkPhase;
+
+  meta.mainProgram = name;
+}
diff --git a/src/pops/scripts.nix b/src/pops/scripts.nix
index e55d617..6ca12dc 100644
--- a/src/pops/scripts.nix
+++ b/src/pops/scripts.nix
@@ -32,6 +32,7 @@
       x
       // {
         inherit nixpkgs;
+        writeShellApplication = super.misc.writeShellApplication { inherit nixpkgs; };
       }
       // lib.optionalAttrs (x.inputs ? climodSrc) {
         climod = nixpkgs.callPackage inputs.climodSrc { pkgs = nixpkgs; };
diff --git a/units/scripts/nvfetcher-update/default.nix b/units/scripts/nvfetcher-update/default.nix
index e93abf5..9a2161c 100644
--- a/units/scripts/nvfetcher-update/default.nix
+++ b/units/scripts/nvfetcher-update/default.nix
@@ -1,6 +1,5 @@
-makeScript {
+writeShellApplication {
   name = "nvfetcher-update";
-  searchPaths.bin = [ nixpkgs.nvfetcher ];
-  searchPaths.source = [ ];
-  entrypoint = ./entrypoint.sh;
+  runtimeInputs = [ nixpkgs.nvfetcher ];
+  text = nixpkgs.lib.fileContents ./entrypoint.sh;
 }
diff --git a/units/scripts/nvfetcher-update/entrypoint.sh b/units/scripts/nvfetcher-update/entrypoint.sh
index 16e87ad..0cee3ba 100644
--- a/units/scripts/nvfetcher-update/entrypoint.sh
+++ b/units/scripts/nvfetcher-update/entrypoint.sh
@@ -1,13 +1,14 @@
 #!/usr/bin/env bash
 
 # Move to the directory of the script
-
 PRJ_ROOT="${PRJ_ROOT:-"$(git rev-parse --show-toplevel)"}"
 
-cd "$(dirname "$PRJ_ROOT/$1")"
+# shellcheck disable=all
+cd "$(dirname "$PRJ_ROOT/$@")"
 
 # Run nvfetcher with the provided arguments
-nvfetcher -c "$PRJ_ROOT/$1" -l /tmp/nvfetcher-changelog
+# shellcheck disable=all
+nvfetcher -c "$PRJ_ROOT/$@" -l /tmp/nvfetcher-changelog
 
 # If the changelog is not empty and the GITHUB_ENV variable is set
 if [[ -s /tmp/nvfetcher-changelog && -n ${GITHUB_ENV:-} ]]; then