From 7d8cc56ba03751198def31065d89af17fd7e5dad Mon Sep 17 00:00:00 2001 From: NeilClack Date: Fri, 28 Aug 2026 15:25:04 -0500 Subject: [PATCH] Fetch updater closures from cache.nixos.org as well as Attic nix copy --from only pulls from that single store, so nixpkgs deps (e.g. sqlite) that Attic skips and leaves on cache.nixos.org were missing -> 'path is not valid'. Realize the closure through the machine's substituters so the app comes from the dev Attic and its upstream deps resolve from cache.nixos.org, without building from source. --- radiantwave-updater.nix | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/radiantwave-updater.nix b/radiantwave-updater.nix index af27ef7..008de79 100644 --- a/radiantwave-updater.nix +++ b/radiantwave-updater.nix @@ -56,10 +56,15 @@ in exit 0 fi - # Fetch the closure from the signed Attic cache only. This never - # builds from source; it fails outright if the path isn't there. + # Realize the closure via the machine's substituters. The app itself + # only exists in the dev Attic cache, but nixpkgs deps (e.g. sqlite) + # are signed by cache.nixos.org and Attic intentionally skips them to + # avoid re-uploading the world. Fetch those from cache.nixos.org so + # the whole closure resolves without ever building from source. echo "radiantwave-updater: acquiring ''${NEW_PATH}" - ${pkgs.nix}/bin/nix copy --from "${cfg.atticUrl}" "$NEW_PATH" || { + ${pkgs.nix}/bin/nix-store -r "$NEW_PATH" \ + --option extra-substituters "https://attic.radiantwavetech.com/radiantwave-dev https://cache.nixos.org" \ + --option extra-trusted-public-keys "radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" || { echo "radiantwave-updater: nix copy failed for ''${NEW_PATH}" exit 1 }