From 356629a5a1e7fc0cc8f151549d7d01970234cdee Mon Sep 17 00:00:00 2001 From: NeilClack Date: Tue, 1 Sep 2026 15:55:34 -0500 Subject: [PATCH] Fix attic verify: fetch deps from cache.nixos.org The verify step fetched the closure from Attic alone, but Attic's upstream-cache filter (cache.nixos.org-1) intentionally skips nixpkgs deps like sqlite, so `nix copy` failed on 'path is not valid'. Mirror the kiosk updater and fetch from Attic + cache.nixos.org together, Attic first so a truncated RadiantWave NAR still fails before the manifest is published. --- .gitea/workflows/dev.yml | 18 ++++++++++++------ .gitea/workflows/main.yml | 18 ++++++++++++------ 2 files changed, 24 insertions(+), 12 deletions(-) diff --git a/.gitea/workflows/dev.yml b/.gitea/workflows/dev.yml index 56b6143..8c41e52 100644 --- a/.gitea/workflows/dev.yml +++ b/.gitea/workflows/dev.yml @@ -70,15 +70,21 @@ jobs: # attic push can exit 0 while storing a truncated NAR (dropped # connection, disk full on the attic host), which kiosks then fail to # fetch. Re-fetch the whole closure into a throwaway store to verify - # every NAR; if the upload is incomplete, `nix copy` errors and the + # every NAR; if the upload is incomplete, `nix-store -r` errors and the # manifest below is never published. + # + # NOTE: Attic's upstream-cache filter (upstream_cache_key_names = + # cache.nixos.org-1) intentionally skips re-uploading nixpkgs deps + # (e.g. sqlite) that are already signed by cache.nixos.org, so this must + # fetch from Attic AND cache.nixos.org together, exactly like the kiosk + # updater does. Attic stays the primary source (it's listed first, so a + # truncated RadiantWave NAR still fails here). - name: Verify Attic upload run: | - nix copy \ - --from "https://attic.radiantwavetech.com/radiantwave-dev" \ - --to "$PWD/.attic-verify-store" \ - --no-check-sigs \ - "$(readlink -f ./result-pkg)" + nix-store -r "$(readlink -f ./result-pkg)" \ + --store "$PWD/.attic-verify-store" \ + --option require-sigs false \ + --option substituters "https://attic.radiantwavetech.com/radiantwave-dev https://cache.nixos.org" rm -rf "$PWD/.attic-verify-store" # Publish the manifest kiosks poll for live app updates. `storePath` diff --git a/.gitea/workflows/main.yml b/.gitea/workflows/main.yml index c5e754a..15c2a2a 100644 --- a/.gitea/workflows/main.yml +++ b/.gitea/workflows/main.yml @@ -78,15 +78,21 @@ jobs: # attic push can exit 0 while storing a truncated NAR (dropped # connection, disk full on the attic host), which kiosks then fail to # fetch. Re-fetch the whole closure into a throwaway store to verify - # every NAR; if the upload is incomplete, `nix copy` errors and the + # every NAR; if the upload is incomplete, `nix-store -r` errors and the # manifest below is never published. + # + # NOTE: Attic's upstream-cache filter (upstream_cache_key_names = + # cache.nixos.org-1) intentionally skips re-uploading nixpkgs deps + # (e.g. sqlite) that are already signed by cache.nixos.org, so this must + # fetch from Attic AND cache.nixos.org together, exactly like the kiosk + # updater does. Attic stays the primary source (it's listed first, so a + # truncated RadiantWave NAR still fails here). - name: Verify Attic upload run: | - nix copy \ - --from "https://attic.radiantwavetech.com/radiantwave" \ - --to "$PWD/.attic-verify-store" \ - --no-check-sigs \ - "$(readlink -f ./result-pkg)" + nix-store -r "$(readlink -f ./result-pkg)" \ + --store "$PWD/.attic-verify-store" \ + --option require-sigs false \ + --option substituters "https://attic.radiantwavetech.com/radiantwave https://cache.nixos.org" rm -rf "$PWD/.attic-verify-store" # Publish the manifest production kiosks poll for live app updates.