Merge pull request #54 from flyingcircusio/nixpkgs-23.05-compatibility

Keep flake compatible with nixpkgs-23.05

.github/workflows/python-app.yml

@@ -45,4 +45,9 @@ jobs:
 
       - name: check flake
         run: |
+          nix run
           nix flake check -L
+
+      - name: check 23.05
+        run: |
+          nix run --override-input nixpkgs github:NixOS/nixpkgs/nixos-23.05

flake.nix

@@ -9,68 +9,29 @@
     let
       supportedSystems = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ];
       forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
-      pkgs = forAllSystems (system: nixpkgs.legacyPackages.${system});
-      poetryOverrides = pkgs: [
-        # https://github.com/nix-community/poetry2nix/pull/899#issuecomment-1620306977
-        pkgs.poetry2nix.defaultPoetryOverrides
-        (self: super: {
-          python-lzo = super.python-lzo.overrideAttrs (old: {
-            buildInputs = (old.buildInputs or []) ++ [ pkgs.lzo ];
-          });
-          scriv = super.scriv.overrideAttrs (old: {
-            buildInputs = (old.buildInputs or []) ++ [ super.setuptools ];
-          });
-          telnetlib3 = super.telnetlib3.overrideAttrs (old: {
-            buildInputs = (old.buildInputs or []) ++ [ super.setuptools ];
-          });
-          execnet = super.execnet.overrideAttrs (old: {
-            buildInputs = (old.buildInputs or []) ++ [ super.hatchling super.hatch-vcs ];
-          });
-          consulate-fc-nix-test = super.consulate-fc-nix-test.overrideAttrs (old: {
-            buildInputs = (old.buildInputs or []) ++ [ super.setuptools super.setuptools-scm ];
-          });
-        })
-      ];
-      poetryEnv = pkgs: pkgs.poetry2nix.mkPoetryEnv {
-        projectDir = self;
-        python = pkgs.python310;
-        overrides = poetryOverrides pkgs;
-        editablePackageSources = {
-          backy = ./src;
+      #pkgs = forAllSystems (system: nixpkgs.legacyPackages.${system});
+      pkgs = forAllSystems (system: import nixpkgs {
+        inherit system;
+        config = {
+          permittedInsecurePackages = [
+            "python3.10-requests-2.28.2"
+            "python3.10-requests-2.29.0"
+          ];
         };
-      };
+      });
+      lib = forAllSystems (system: pkgs.${system}.callPackage "${self}/lib.nix" {});
     in
     {
-      packages = forAllSystems (system: {
-        default = pkgs.${system}.poetry2nix.mkPoetryApplication {
-          projectDir = self;
-          doCheck = true;
-          python = pkgs.${system}.python310;
-          overrides = poetryOverrides pkgs.${system};
-        };
+      packages = forAllSystems (system:
+        lib.${system}.packages
+      );
 
-        venv = poetryEnv pkgs.${system};
-      });
+      devShells = forAllSystems (system:
+        lib.${system}.devShells
+      );
 
-      devShells = forAllSystems (system: {
-        default = pkgs.${system}.mkShellNoCC {
-          BACKY_CMD = "backy";
-          packages = with pkgs.${system}; [
-            (poetryEnv pkgs.${system})
-            poetry
-          ];
-        };
-      });
-
-      checks = forAllSystems (system: {
-        pytest = pkgs.${system}.runCommand "pytest" {
-          nativeBuildInputs = [ (poetryEnv pkgs.${system}) ];
-        } ''
-          export BACKY_CMD=backy
-          cd ${self}
-          pytest -vv -p no:cacheprovider --no-cov
-          touch $out
-        '';
-      });
+      checks = forAllSystems (system:
+        lib.${system}.checks
+      );
     };
 }

lib.nix

@@ -0,0 +1,83 @@
+{
+  poetry2nix,
+  lzo,
+  python310,
+  mkShellNoCC,
+  poetry,
+  runCommand,
+  ...
+}:
+let
+  poetryOverrides = [
+    # https://github.com/nix-community/poetry2nix/pull/899#issuecomment-1620306977
+    poetry2nix.defaultPoetryOverrides
+    (self: super: {
+      python-lzo = super.python-lzo.overrideAttrs (old: {
+        buildInputs = (old.buildInputs or []) ++ [ lzo ];
+      });
+      scriv = super.scriv.overrideAttrs (old: {
+        buildInputs = (old.buildInputs or []) ++ [ super.setuptools ];
+      });
+      telnetlib3 = super.telnetlib3.overrideAttrs (old: {
+        buildInputs = (old.buildInputs or []) ++ [ super.setuptools ];
+      });
+      execnet = super.execnet.overrideAttrs (old: {
+        buildInputs = (old.buildInputs or []) ++ [ super.hatchling super.hatch-vcs ];
+      });
+      attrs = super.attrs.overrideAttrs (old: {
+        buildInputs = (old.buildInputs or []) ++ [ super.hatchling super.hatch-vcs super.hatch-fancy-pypi-readme ];
+      });
+      urllib3 = super.urllib3.overrideAttrs (old: {
+        buildInputs = (old.buildInputs or []) ++ [ super.hatchling super.hatch-vcs ];
+      });
+      consulate-fc-nix-test = super.consulate-fc-nix-test.overrideAttrs (old: {
+        buildInputs = (old.buildInputs or []) ++ [ super.setuptools super.setuptools-scm ];
+      });
+      shortuuid = super.shortuuid.overrideAttrs (old: {
+        # replace poetry to avoid dependency on vulnerable python-cryptography package
+        nativeBuildInputs = [ super.poetry-core ] ++ builtins.filter (p: p.pname or "" != "poetry") old.nativeBuildInputs;
+      });
+    })
+  ];
+  poetryEnv = poetry2nix.mkPoetryEnv {
+    projectDir = ./.;
+    python = python310;
+    overrides = poetryOverrides;
+    editablePackageSources = {
+      backy = ./src;
+    };
+  };
+  poetryApplication = poetry2nix.mkPoetryApplication {
+      projectDir = ./.;
+      doCheck = true;
+      python = python310;
+      overrides = poetryOverrides;
+    };
+in
+{
+  packages = {
+    default = poetryApplication;
+    venv = poetryEnv;
+  };
+
+  devShells = {
+    default = mkShellNoCC {
+      BACKY_CMD = "backy";
+      packages = [
+        poetryEnv
+        poetry
+      ];
+    };
+  };
+
+  checks = {
+    pytest = runCommand "pytest" {
+      nativeBuildInputs = [ poetryEnv ];
+    } ''
+      export BACKY_CMD=${poetryApplication}/bin/backy
+      cd ${./.}
+      pytest -vv -p no:cacheprovider --no-cov
+      touch $out
+    '';
+  };
+}