OpenAI Coding Assistant
000a177607
A blanket sudo -v requests a password under verifypw=all even when the command itself is NOPASSWD. Keep unprivileged builds and retain the lock through activation without the unnecessary credential preflight.
61 lines
1.8 KiB
Bash
Executable File
61 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# The installed command gets its host/path from updates.nix on both machines.
|
|
# Direct execution from this checkout defaults to the laptop, never the login name.
|
|
set -euo pipefail
|
|
repo=${NIXOS_CONFIG_REPO:-/etc/nix}
|
|
host=${NIXOS_UPDATE_HOST:-nixos}
|
|
|
|
usage() {
|
|
printf 'Usage: %s [switch|dry-activate|boot|test]\n' "$0"
|
|
printf 'Build %s#%s using flake.lock.\n' "$repo" "$host"
|
|
printf '%s\n' \
|
|
'Default: switch now and save for boot (an explicit manual action).' \
|
|
'dry-activate previews changes; boot stages them; test applies temporarily.' \
|
|
'Does not pull Git, update package pins, delete generations, or reboot.'
|
|
}
|
|
|
|
if [[ $# -eq 1 && ($1 == --help || $1 == -h) ]]; then
|
|
usage
|
|
exit 0
|
|
fi
|
|
if (($# > 1)); then
|
|
usage >&2
|
|
exit 2
|
|
fi
|
|
action=${1:-switch}
|
|
case "$action" in
|
|
switch | dry-activate | boot | test) ;;
|
|
*)
|
|
usage >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
|
|
case "$host" in
|
|
nixos | dev) ;;
|
|
*)
|
|
printf 'Unsupported host: %s\n' "$host" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
|
|
# Keep builds/Git access under the checkout owner, including when invoked via sudo.
|
|
# Only activating the built system needs root.
|
|
if ((EUID == 0)); then
|
|
exec runuser -u dev -- env NIXOS_CONFIG_REPO="$repo" NIXOS_UPDATE_HOST="$host" \
|
|
"$(readlink -f -- "${BASH_SOURCE[0]}")" "$@"
|
|
fi
|
|
|
|
# Share the automatic updater's lock. Directory ownership is managed by NixOS.
|
|
state=${CACHE_DIRECTORY:-/var/cache/nixos-update}
|
|
mkdir -p "$state"
|
|
exec 9>"$state/lock"
|
|
flock 9
|
|
|
|
cd "$repo"
|
|
printf 'Building %s#%s (%s).\n' "$repo" "$host" "$action"
|
|
built=$(nix build ".#nixosConfigurations.$host.config.system.build.toplevel" \
|
|
--no-update-lock-file --no-link --print-out-paths)
|
|
# Keep this shell alive holding the lock: sudo closes inherited descriptors.
|
|
sudo "$built/sw/bin/nixos-rebuild" "$action" --no-reexec --store-path "$built"
|