rework: fix all vulnerabilities

.gitea/workflows/runner-nix-smoke.yaml

@@ -10,10 +10,15 @@ on:
       - flake.lock
       - flake.nix
       - infra/gitea-runners/**
+      - lib/**
+      - legacy/**
+      - nixos/**
+      - package/**
+      - test/**
 
 jobs:
   smoke:
-    name: nix label smoke
+    name: nix label and flake smoke
     runs-on: nix
     steps:
       - name: Checkout repository
@@ -26,7 +31,7 @@ jobs:
           nix config show substituters
           nix config show trusted-public-keys
 
-      - name: Repository flake metadata
+      - name: Repository flake evaluation
         run: |
           set -eu
-          nix flake metadata --no-write-lock-file
+          nix --option eval-cache false flake check --no-build --no-write-lock-file

package/db-tool/default.nix

@@ -16,16 +16,16 @@ let
         "errexit"
         "nounset"
       ];
-      excludeShellChecks = [ "SC2209" ];
+    excludeShellChecks = [ "SC1091" "SC2209" ];
       name = "database";
       runtimeInputs = [ hectic.migrator hectic.parse-uri postgresql neovim openssh coreutils gawk ];
 
       text = ''
-        ${builtins.readFile hectic.helpers.posix-shell.log}
+        . ${hectic.helpers.posix-shell.log}/bin/log.sh
-        ${builtins.readFile hectic.helpers.posix-shell.change_namespace}
+        . ${hectic.helpers.posix-shell.change_namespace}/bin/change_namespace.sh
-        ${builtins.readFile hectic.helpers.posix-shell.quote}
+        . ${hectic.helpers.posix-shell.quote}/bin/quote.sh
-        ${builtins.readFile hectic.helpers.posix-shell.pager_or_cat}
+        . ${hectic.helpers.posix-shell.pager_or_cat}/bin/pager_or_cat.sh
-        ${builtins.readFile hectic.helpers.posix-shell.with_closed_fds}
+        . ${hectic.helpers.posix-shell.with_closed_fds}/bin/with_closed_fds.sh
         ${applyBundle}
         ${builtins.readFile ./db-dev.sh}
       '';
@@ -44,13 +44,13 @@ let
         "errexit"
         "nounset"
       ];
-      excludeShellChecks = [ "SC2209" ];
+    excludeShellChecks = [ "SC1091" "SC2209" ];
       name = "db-ops";
       runtimeInputs = [ postgresql coreutils ];
 
       text = ''
-        ${builtins.readFile hectic.helpers.posix-shell.log}
+        . ${hectic.helpers.posix-shell.log}/bin/log.sh
-        ${builtins.readFile hectic.helpers.posix-shell.change_namespace}
+        . ${hectic.helpers.posix-shell.change_namespace}/bin/change_namespace.sh
         ${applyBundle}
         ${builtins.readFile ./db-ops.sh}
       '';
@@ -70,7 +70,7 @@ let
       runtimeInputs = [ postgresql coreutils ];
 
       text = ''
-        ${builtins.readFile hectic.helpers.posix-shell.with_closed_fds}
+        . ${hectic.helpers.posix-shell.with_closed_fds}/bin/with_closed_fds.sh
         ${builtins.readFile ./postgres-init.sh}
       '';
 

package/default.nix

@@ -10,15 +10,9 @@
     };
   };
   buildPostgresqlExtension =
-    pkgs: pkgs.callPackage (import (builtins.path {
+    pkgs: pkgs.callPackage ./buildPostgresqlExtension.nix;
-      name = "extension-builder";
-      path = ./buildPostgresqlExtension.nix;
-    }));
   buildPgrxExtension = pkgs: 
-    pkgs.callPackage (import (builtins.path {
+    pkgs.callPackage ./buildPgrxExtension.nix {
-      name = "extension-builder";
-      path = ./buildPgrxExtension.nix;
-    })) { 
       cargo-pgrx = pkgs.cargo-pgrx_0_12_6;
       inherit (pkgs.darwin.apple_sdk.frameworks) Security;
     };

package/deploy/default.nix

@@ -8,6 +8,7 @@ let
 
   deploy = hectic.writeShellApplication {
     inherit shell bashOptions;
+    excludeShellChecks = [ "SC1091" "SC2034" ];
     name = "deploy";
     runtimeInputs = [
       ssh-to-age
@@ -15,7 +16,7 @@ let
     ];
 
     text = ''
-      ${builtins.readFile hectic.helpers.posix-shell.log}
+      . ${hectic.helpers.posix-shell.log}/bin/log.sh
       ${builtins.readFile ./deploy.sh}
     '';
   };

package/hemar/parser/default.nix

@@ -8,13 +8,14 @@ let
 
   hemar = hectic.writeShellApplication {
     inherit shell bashOptions;
+    excludeShellChecks = [ "SC1091" ];
     name = "hemar";
     runtimeInputs = [ yq-go ];
 
     text = ''
       # shellcheck disable=SC2034
       WORKSPACE=${./.}
-      ${builtins.readFile hectic.helpers.posix-shell.log}
+      . ${hectic.helpers.posix-shell.log}/bin/log.sh
       ${builtins.readFile ./hemar.sh}
     '';
   };

package/hemar/parser/hemar.sh

@@ -299,7 +299,7 @@ parse_tag() {
           log trace "tag in ws -> type: \`${TAG_type:-}\`"
           case "${TAG_type:-unknown}" in
             unknown) finalize_first_arg ;;
-            for) 
+            'for')
               # NOTE: 
               # grammar: for i in key."subkey" ; so we know
               # 1st argument after `for` - string (name of variable)
@@ -427,13 +427,13 @@ finish() {
     unknown) 
       finish_interpolation_tag
     ;;
-    done)
+    'done')
       finish_done_tag
     ;;
     '{[')
       finish_bracket_tag
     ;;
-    for) ;;
+    'for') ;;
     *) log panic 'unexpected TAG_type on finish'; exit 13; ;;
   esac
 }
@@ -442,14 +442,14 @@ finalize_first_arg() {
   log trace "finalize first arg"
   log trace "buffer: $(cat "$CURRENT_STAGE_BUFFER")"
   case "$(cat "$CURRENT_STAGE_BUFFER")" in
-    for)
+    'for')
       TAG_type='for'
       # NOTE: we know that next argument after `for` is string
       TAG_grammar_mode=string
       log error 'for unimplemented'
       exit 13
     ;;
-    done)
+    'done')
       finish_done_tag
     ;;
     '{[')
@@ -651,4 +651,4 @@ if [ -z "${AS_LIBRARY+x}" ]; then
   # return the output
   # shellcheck disable=SC2086
   yq ${OUTPUT_ARGS:-} -o j "$AST"
-fi
+fi

package/linux-devshell/default.nix

@@ -13,7 +13,7 @@ let
     inherit shell bashOptions;
     name = "linux-devshell";
     runtimeInputs = [ curl coreutils gawk procps ];
-    excludeShellChecks = [ "SC2034" "SC1090" ];
+  excludeShellChecks = [ "SC1090" "SC1091" "SC2034" ];
 
     text = ''
       ${logHelpers}

package/merge-archive/default.nix

@@ -8,13 +8,13 @@ hectic.writeShellApplication {
     "errexit"
     "nounset"
   ];
-  excludeShellChecks = [ "SC2209" ];
+  excludeShellChecks = [ "SC1091" "SC2209" ];
   name = "merge-archive";
   runtimeInputs = [ git gnutar gzip bzip2 xz unzip coreutils file ];
 
   text = ''
-    ${builtins.readFile hectic.helpers.posix-shell.log}
+    . ${hectic.helpers.posix-shell.log}/bin/log.sh
-    ${builtins.readFile hectic.helpers.posix-shell.pager_or_cat}
+    . ${hectic.helpers.posix-shell.pager_or_cat}/bin/pager_or_cat.sh
     ${builtins.readFile ./merge-archive.sh}
   '';
 

package/migrator/default.nix

@@ -10,11 +10,12 @@ let
 
   migrator = hectic.writeShellApplication {
     inherit shell bashOptions;
+    excludeShellChecks = [ "SC1091" ];
     name = "migrator";
     runtimeInputs = [ sqlite postgresql_17 gawk coreutils ];
 
     text = ''
-      ${builtins.readFile hectic.helpers.posix-shell.log}
+      . ${hectic.helpers.posix-shell.log}/bin/log.sh
       ${applyBundle}
       ${builtins.readFile ./migrator.sh}
     '';

package/slpt.nix

@@ -1,12 +1,15 @@
-{ lib, writeShellScriptBin, fetchFromGitHub, pkgs }: let
+{ lib, fetchFromGitHub, runCommand, makeWrapper, jq }: let
   src = fetchFromGitHub {
     owner = "nativerv";
     repo = "slpt";
     rev = "8d70db4d8dfcd624ed49b9e6fb0ad449b6f25b89";
     hash = "sha256-sCHZsf7Y36iAesh7BeSxy9WhE/uQv13/VWmjlaVSEcU=";
   };
-in writeShellScriptBin "slpt" ''
+in runCommand "slpt" {
-  #!${pkgs.runtimeShell}
+  inherit src;
-  PATH=${lib.makeBinPath [ pkgs.jq ]}:$PATH
+  nativeBuildInputs = [ makeWrapper ];
-  ${builtins.readFile "${src}/slpt"}
+} ''
+  install -Dm755 "$src/slpt" "$out/bin/slpt"
+  patchShebangs "$out/bin/slpt"
+  wrapProgram "$out/bin/slpt" --prefix PATH : "${lib.makeBinPath [ jq ]}"
 ''

package/windows-devshell/default.nix

@@ -1,26 +1,10 @@
-{ pkgs, writeTextFile, lib, linux-devshell-standalone }:
+{ pkgs, linux-devshell-standalone }:
-let
-  psScriptTemplate = builtins.readFile ./windows-devshell.ps1;
-
-  # Get the linux-devshell standalone script content and base64 encode it
-  linuxDevShellBase64 = lib.removeSuffix "\n"
-    (builtins.readFile
-      (pkgs.runCommand "base64-linux-devshell" {}
-        ''
-          ${pkgs.coreutils}/bin/base64 -w 0 ${linux-devshell-standalone} > $out
-        ''));
-
-  # Standalone PowerShell script (single file for Windows)
-  windowsDevShellStandalone = writeTextFile {
-    name = "windows-devshell.ps1";
-    executable = false;
-    text = lib.replaceStrings ["@LINUX_DEVSHELL_BASE64@"] [linuxDevShellBase64] psScriptTemplate;
-    meta = {
-      description = "Standalone windows-devshell PowerShell script (single file)";
-    };
-  };
-
-in
 {
-  windows-devshell-standalone = windowsDevShellStandalone;
+  windows-devshell-standalone = pkgs.runCommand "windows-devshell.ps1" {
+    meta.description = "Standalone windows-devshell PowerShell script (single file)";
+  } ''
+    linux_dev_shell_base64=$(${pkgs.coreutils}/bin/base64 -w 0 ${linux-devshell-standalone})
+    ${pkgs.gnused}/bin/sed "s|@LINUX_DEVSHELL_BASE64@|$linux_dev_shell_base64|g" \
+      ${./windows-devshell.ps1} > "$out"
+  '';
 }

test/package/db-tool/default.nix

@@ -51,7 +51,7 @@
     nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ];
     buildInputs       = [ database dbOps postgresInit postgresCleanup pkgs.postgresql_17 pkgs.dash ];
   } ''
-    ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
+        . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
     test=${testDrv}
     export HECTIC_LOG=trace
     set -eu
@@ -67,7 +67,7 @@
     nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ];
     buildInputs       = [ database dbOps postgresInit postgresCleanup pkgs.postgresql_17 pkgs.dash pkgs.netcat-openbsd ];
   } ''
-    ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
+        . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
     test=${testDrv}
     export HECTIC_LOG=trace
     set -eu

test/package/hemar/default.nix

@@ -37,7 +37,7 @@
     nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ];
     buildInputs = [ hemar pkgs.yq-go pkgs.which ];
   } ''
-    ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
+        . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
     test=${testDrv}
     ${builtins.readFile ./lauch.sh}
 

test/package/linux-devshell/default.nix

@@ -47,7 +47,7 @@
       linuxDevShell = linuxDevShell;
       linuxDevShellStandalone = linuxDevShellStandalone;
     } ''
-      ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
+      . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
       export HECTIC_LOG=trace
       test=${testDrv}
       linuxDevShell="${linuxDevShell}"
@@ -64,7 +64,7 @@
       linuxDevShellStandalone = linuxDevShellStandalone;
       archBootstrap = archBootstrap;
     } ''
-      ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
+      . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
       export HECTIC_LOG=trace
 
       log notice "test case: ''${WHITE}arch ${name}"
@@ -156,7 +156,7 @@
       linuxDevShellStandalone = linuxDevShellStandalone;
       ubuntuBootstrap = ubuntuBootstrap;
     } ''
-      ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
+      . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
       export HECTIC_LOG=trace
 
       log notice "test case: ''${WHITE}ubuntu ${name}"

test/package/migrator/default.nix

@@ -41,7 +41,7 @@
     nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ];
     buildInputs       = [ pkgs.which migrator pkgs.postgresql ];
   } ''
-    ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
+        . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
     test=${testDrv}
     export HECTIC_LOG=trace
     ${builtins.readFile ./util.sh}
@@ -57,7 +57,7 @@
     nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ];
     buildInputs       = [ pkgs.which migrator pkgs.sqlite ];
   } ''
-    ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
+        . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
     test=${testDrv}
     export HECTIC_LOG=trace
     ${builtins.readFile ./util.sh}

test/package/sentinèlla/default.nix

@@ -34,7 +34,7 @@
       nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ];
       buildInputs       = [ sentinella pkgs.curl pkgs.jq pkgs.socat ];
     } ''
-      ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
+      . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
       export HECTIC_LOG=trace
       test=${testDrv}
       ${builtins.readFile ./launch.sh}

test/package/windows-devshell/default.nix

@@ -9,7 +9,7 @@ let
       nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep ];
       windowsDevShellStandalone = windowsDevShellStandalone;
     } ''
-      ${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
+      . ${self.legacyPackages.${system}.helpers.posix-shell.log}/bin/log.sh
       test=${testDrv}
       ${builtins.readFile ./launch.sh}
       mkdir -p "$out"