diff --git a/pkgs/by-name/bi/bisq1/package.nix b/pkgs/by-name/bi/bisq1/package.nix index 8895ec305994..e5ca6ad35ec8 100644 --- a/pkgs/by-name/bi/bisq1/package.nix +++ b/pkgs/by-name/bi/bisq1/package.nix @@ -36,7 +36,10 @@ }: let - version = "1.10.2"; + # This is separated into its own file so it's easier for `update.sh`. + sources = import ./sources.nix; + + version = sources.version; # JDK 21 is the toolchain required by docs/build.md. enableJavaFX is not # strictly required (Bisq bundles its own JavaFX jars), but mirrors the @@ -86,17 +89,17 @@ let publicKey = { "E222AA02" = fetchurl { url = "https://github.com/bisq-network/bisq/releases/download/v${version}/E222AA02.asc"; - hash = "sha256-Ue/UmS6F440/ybEEIAR+pdPEIksAt6QSMN6G5TZVWzc="; + hash = sources."key-E222AA02-hash"; }; "4A133008" = fetchurl { url = "https://github.com/bisq-network/bisq/releases/download/v${version}/4A133008.asc"; - hash = "sha256-UijG3DkJNNTakVJd2wl30mDepa27n6R/Xxfl4sjt0sk="; + hash = sources."key-4A133008-hash"; }; "387C8307" = fetchurl { url = "https://github.com/bisq-network/bisq/releases/download/v${version}/387C8307.asc"; - hash = "sha256-PrRYZLT0xv82dUscOBgQGKNf6zwzWUDhriAffZbNpmI="; + hash = sources."key-387C8307-hash"; }; }; @@ -133,7 +136,7 @@ stdenv.mkDerivation (finalAttrs: { src = fetchurl { url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb"; - hash = "sha256-e7rPUhA6KF3Tz3zlYqEfM9G0owe9hAUFDifKseRvb6A="; + hash = sources."deb-hash"; # Verify the upstream Debian package's detached PGP signature prior to use. # This ensures that a successful build of this Nix package requires the @@ -158,7 +161,7 @@ stdenv.mkDerivation (finalAttrs: { signature = fetchurl { url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb.asc"; - hash = "sha256-kBRaOXuP22DvXMkJ1XQatwvTmu/Ds8FvmUgYnRT7Vg0="; + hash = sources."sig-hash"; }; nativeBuildInputs = [ @@ -241,6 +244,8 @@ stdenv.mkDerivation (finalAttrs: { runHook postInstall ''; + passthru.updateScript = ./update.sh; + meta = { description = "Decentralized bitcoin exchange network (Bisq 1)"; homepage = "https://bisq.network"; diff --git a/pkgs/by-name/bi/bisq1/sources.nix b/pkgs/by-name/bi/bisq1/sources.nix new file mode 100644 index 000000000000..8b9f276e8cf1 --- /dev/null +++ b/pkgs/by-name/bi/bisq1/sources.nix @@ -0,0 +1,9 @@ +# Generated by ./update.sh - do not update manually! +{ + version = "1.10.3"; + deb-hash = "sha256-kzLtadq8gfX6j9XU3PD5kNV43wLDoICPlXdJqULkAWE="; + sig-hash = "sha256-+51j+SBp7buukop1T4Gz0YDUga6540BVxDRoU2YE3pY="; + key-E222AA02-hash = "sha256-Ue/UmS6F440/ybEEIAR+pdPEIksAt6QSMN6G5TZVWzc="; + key-4A133008-hash = "sha256-UijG3DkJNNTakVJd2wl30mDepa27n6R/Xxfl4sjt0sk="; + key-387C8307-hash = "sha256-PrRYZLT0xv82dUscOBgQGKNf6zwzWUDhriAffZbNpmI="; +} diff --git a/pkgs/by-name/bi/bisq1/update.sh b/pkgs/by-name/bi/bisq1/update.sh new file mode 100755 index 000000000000..c162a4e6190b --- /dev/null +++ b/pkgs/by-name/bi/bisq1/update.sh @@ -0,0 +1,79 @@ +#!/usr/bin/env nix-shell +#!nix-shell -i bash --pure --keep GITHUB_TOKEN -p nix git curl cacert jq + +set -euo pipefail + +cd "$(dirname "${BASH_SOURCE[0]}")" + +# Fetch the latest release version from GitHub +payload=$(curl -sL https://api.github.com/repos/bisq-network/bisq/releases/latest) +version=$(jq -r .tag_name <<< "$payload" | sed 's/^v//') + +echo "Updating bisq1 to version $version" + +# URLs for the new version +deb_url="https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb" +sig_url="https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb.asc" + +# Fetch and compute hashes using nix-prefetch-url and convert to SRI format +echo "Prefetching .deb package..." +deb_hash_raw=$(nix-prefetch-url "$deb_url" 2>/dev/null) +deb_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$deb_hash_raw") +echo " deb hash: $deb_hash" + +echo "Prefetching signature..." +sig_hash_raw=$(nix-prefetch-url "$sig_url" 2>/dev/null) +sig_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$sig_hash_raw") +echo " signature hash: $sig_hash" + +# Fetch and compute hashes for public keys (these may not exist in all releases) +get_key_hash() { + local key_name=$1 + local url="https://github.com/bisq-network/bisq/releases/download/v${version}/${key_name}.asc" + local hash_raw + if hash_raw=$(nix-prefetch-url "$url" 2>/dev/null); then + nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$hash_raw" + else + echo "" # Return empty if key doesn't exist + fi +} + +echo "Prefetching public keys..." +key_E222AA02_hash=$(get_key_hash "E222AA02") +if [ -n "$key_E222AA02_hash" ]; then + echo " E222AA02 hash: $key_E222AA02_hash" +else + echo " E222AA02: not found in this release, keeping old hash" + key_E222AA02_hash=$(grep 'key-E222AA02-hash' sources.nix | sed 's/.*= "\(.*\)".*/\1/') +fi + +key_4A133008_hash=$(get_key_hash "4A133008") +if [ -n "$key_4A133008_hash" ]; then + echo " 4A133008 hash: $key_4A133008_hash" +else + echo " 4A133008: not found in this release, keeping old hash" + key_4A133008_hash=$(grep 'key-4A133008-hash' sources.nix | sed 's/.*= "\(.*\)".*/\1/') +fi + +key_387C8307_hash=$(get_key_hash "387C8307") +if [ -n "$key_387C8307_hash" ]; then + echo " 387C8307 hash: $key_387C8307_hash" +else + echo " 387C8307: not found in this release, keeping old hash" + key_387C8307_hash=$(grep 'key-387C8307-hash' sources.nix | sed 's/.*= "\(.*\)".*/\1/') +fi + +# Write sources.nix (only include keys that exist) +cat >sources.nix <