don't do fetchTarball

nix/apps/does-it-build/default.nix

@@ -1,8 +1,8 @@
 { pkgs, lib, my-projects-versions, ... }:
 let
-  does-it-build-base = (import (fetchTarball "https://github.com/Noratrieb/does-it-build/archive/${my-projects-versions.does-it-build}.tar.gz")) { inherit pkgs; };
+  does-it-build-base = (import (pkgs.fetchFromGitHub my-projects-versions.does-it-build.fetchFromGitHub)) { inherit pkgs; };
   does-it-build = does-it-build-base.overrideAttrs (finalAttrs: previousAttrs: {
-    DOES_IT_BUILD_OVERRIDE_VERSION = my-projects-versions.does-it-build;
+    DOES_IT_BUILD_OVERRIDE_VERSION = my-projects-versions.does-it-build.commit;
   });
 in
 {

nix/apps/fakessh/default.nix

@@ -1,5 +1,6 @@
 { lib, pkgs, my-projects-versions, ... }:
-let cluelessh = import (fetchTarball "https://github.com/Noratrieb/cluelessh/archive/${my-projects-versions.cluelessh}.tar.gz");
+let
+  cluelessh = import (pkgs.fetchFromGitHub my-projects-versions.cluelessh.fetchFromGitHub);
 in
 {
   systemd.services.fakessh = {

nix/apps/upload-files/default.nix

@@ -1,5 +1,7 @@
 { my-projects-versions, pkgs, lib, config, ... }:
-let upload-files = import (fetchTarball "https://github.com/Noratrieb/upload.files.noratrieb.dev/archive/${my-projects-versions."upload.files.noratrieb.dev"}.tar.gz"); in
+let
+  upload-files = import (pkgs.fetchFromGitHub my-projects-versions."upload.files.noratrieb.dev".fetchFromGitHub);
+in
 {
   age.secrets.upload_files_s3_secret.file = ../../secrets/upload_files_s3_secret.age;
 

nix/apps/website/default.nix

@@ -1,8 +1,8 @@
 { pkgs, lib, my-projects-versions, ... }:
 let
-  website = import (fetchTarball "https://github.com/Noratrieb/website/archive/${my-projects-versions.website}.tar.gz");
+  website = import (pkgs.fetchFromGitHub my-projects-versions.website.fetchFromGitHub);
-  blog = fetchTarball "https://github.com/Noratrieb/blog/archive/${my-projects-versions.blog}.tar.gz";
+  blog = pkgs.fetchFromGitHub my-projects-versions.blog.fetchFromGitHub;
-  slides = fetchTarball "https://github.com/Noratrieb/slides/archive/${my-projects-versions.slides}.tar.gz";
+  slides = pkgs.fetchFromGitHub my-projects-versions.slides.fetchFromGitHub;
   website-build = website { inherit pkgs slides blog; };
 in
 {

nix/apps/widetom/default.nix

@@ -1,12 +1,7 @@
 { config, pkgs, lib, my-projects-versions, ... }:
 let
   widetom = pkgs.rustPlatform.buildRustPackage {
-    src = pkgs.fetchFromGitHub {
+    src = pkgs.fetchFromGitHub my-projects-versions.widetom.fetchFromGitHub;
-      owner = "Noratrieb";
-      repo = "widetom";
-      rev = my-projects-versions.widetom;
-      hash = "sha256-lSjlDozwKRLF62jsDaWo+8+rcQdeEgurEnuw00hk3o8=";
-    };
     pname = "widetom";
     version = "0.1.0";
     cargoHash = "sha256-AWbdPcDc+QOW7U/FYbqlIsg+3MwfggKCTCw1z/ZbSEE=";

nix/modules/default/default.nix

@@ -1,7 +1,7 @@
 { pkgs, lib, name, my-projects-versions, networkingConfig, nixpkgs-path, ... }:
 let
-  pretense = import (fetchTarball "https://github.com/Noratrieb/pretense/archive/${my-projects-versions.pretense}.tar.gz");
+  pretense = import (pkgs.fetchFromGitHub my-projects-versions.pretense.fetchFromGitHub);
-  quotdd = import (fetchTarball "https://github.com/Noratrieb/quotdd/archive/${my-projects-versions.quotdd}.tar.gz");
+  quotdd = import (pkgs.fetchFromGitHub my-projects-versions.quotdd.fetchFromGitHub);
 in
 {
   deployment.targetHost = "${name}.infra.noratrieb.dev";

nix/my-projects.json

@@ -1,11 +1,83 @@
 {
-  "website": "57c4a239da5d17eafde4ade165f3c6706639a9b4",
+  "website": {
-  "blog": "ea2758dd10f29e8d66ca3f54d7303f2ac20005d2",
+    "commit": "57c4a239da5d17eafde4ade165f3c6706639a9b4",
-  "slides": "0401f35c22b124b69447655f0c537badae9e223c",
+    "fetchFromGitHub": {
-  "pretense": "270b01fc1118dfd713c1c41530d1a7d98f04527d",
+      "owner": "Noratrieb",
-  "quotdd": "e922229e1d9e055be35dabd112bafc87a0686548",
+      "repo": "website",
-  "does-it-build": "81790825173d87f89656f66f12a123bc99e2f6f1",
+      "rev": "57c4a239da5d17eafde4ade165f3c6706639a9b4",
-  "upload.files.noratrieb.dev": "9f31fe53f040f73edbbdc8afcc9bd3cdbc1cd8ab",
+      "hash": "sha256-or6mCQjbc7tWAzzAKQpznZv+2vWJMhyzqxBPwRE2HKw="
-  "cluelessh": "c711cd405da4b7951e554577d09c9576bedf7970",
+    }
-  "widetom": "33d1738799618d72fe2b86896f766cbfea58dc76"
+  },
+  "blog": {
+    "commit": "ea2758dd10f29e8d66ca3f54d7303f2ac20005d2",
+    "fetchFromGitHub": {
+      "owner": "Noratrieb",
+      "repo": "blog",
+      "rev": "ea2758dd10f29e8d66ca3f54d7303f2ac20005d2",
+      "hash": "sha256-LvQ41eJzOvI7mLYDTvlFwGZ2TKrZO26rasydqnEZ/t4="
+    }
+  },
+  "slides": {
+    "commit": "0401f35c22b124b69447655f0c537badae9e223c",
+    "fetchFromGitHub": {
+      "owner": "Noratrieb",
+      "repo": "slides",
+      "rev": "0401f35c22b124b69447655f0c537badae9e223c",
+      "hash": "sha256-K1Me4wf/GSfoc1PGWVJygPyTVV8SXienxUrzXkdCrjQ="
+    }
+  },
+  "pretense": {
+    "commit": "270b01fc1118dfd713c1c41530d1a7d98f04527d",
+    "fetchFromGitHub": {
+      "owner": "Noratrieb",
+      "repo": "pretense",
+      "rev": "270b01fc1118dfd713c1c41530d1a7d98f04527d",
+      "hash": "sha256-76ixjjrZ2xFz3uy92LHT4zbeNvab2f4J9C46MDVr+xQ="
+    }
+  },
+  "quotdd": {
+    "commit": "e922229e1d9e055be35dabd112bafc87a0686548",
+    "fetchFromGitHub": {
+      "owner": "Noratrieb",
+      "repo": "quotdd",
+      "rev": "e922229e1d9e055be35dabd112bafc87a0686548",
+      "hash": "sha256-LhTrUDAZDIVyggaO1deFjoC13M6aktzV3QINY01ThfY="
+    }
+  },
+  "does-it-build": {
+    "commit": "81790825173d87f89656f66f12a123bc99e2f6f1",
+    "fetchFromGitHub": {
+      "owner": "Noratrieb",
+      "repo": "does-it-build",
+      "rev": "81790825173d87f89656f66f12a123bc99e2f6f1",
+      "hash": "sha256-MCgGDd7Sg+BiG8L20Bbz8bHMB/Xuc1ztOVwv/b37BnQ="
+    }
+  },
+  "upload.files.noratrieb.dev": {
+    "commit": "9f31fe53f040f73edbbdc8afcc9bd3cdbc1cd8ab",
+    "fetchFromGitHub": {
+      "owner": "Noratrieb",
+      "repo": "upload.files.noratrieb.dev",
+      "rev": "9f31fe53f040f73edbbdc8afcc9bd3cdbc1cd8ab",
+      "hash": "sha256-IQug0slBlMpHTqrj/SlJKPWCMijSka+s33HDeMf8rd0="
+    }
+  },
+  "cluelessh": {
+    "commit": "c711cd405da4b7951e554577d09c9576bedf7970",
+    "fetchFromGitHub": {
+      "owner": "Noratrieb",
+      "repo": "cluelessh",
+      "rev": "c711cd405da4b7951e554577d09c9576bedf7970",
+      "hash": "sha256-UTo5RUda/AcwGiPEeeliuA78TVMJzvBhhXs4Fr2+BGg="
+    }
+  },
+  "widetom": {
+    "commit": "33d1738799618d72fe2b86896f766cbfea58dc76",
+    "fetchFromGitHub": {
+      "owner": "Noratrieb",
+      "repo": "widetom",
+      "rev": "33d1738799618d72fe2b86896f766cbfea58dc76",
+      "hash": "sha256-lSjlDozwKRLF62jsDaWo+8+rcQdeEgurEnuw00hk3o8="
+    }
+  }
 }

nix/update-my-projects.mjs

@@ -1,11 +1,28 @@
 import fs from "node:fs/promises";
+import child_process from "node:child_process";
+
+const fetchHash = (url) => {
+  const res = child_process.execFileSync("nix", [
+    "store",
+    "prefetch-file",
+    "--unpack",
+    "--hash-type",
+    "sha256",
+    "--json",
+    url,
+  ]);
+  const out = new TextDecoder().decode(res).trim();
+  const { hash } = JSON.parse(out);
+  return hash;
+};
 
 const path = `${import.meta.dirname}/my-projects.json`;
 const projects = JSON.parse(await fs.readFile(path));
 
 let hasChanges = false;
 
-for (const [name, commit] of Object.entries(projects)) {
+for (const [name, state] of Object.entries(projects)) {
+  const { commit } = state;
   const res = await fetch(
     `https://api.github.com/repos/Noratrieb/${name}/commits/HEAD`
   );
@@ -21,7 +38,18 @@ for (const [name, commit] of Object.entries(projects)) {
     console.log(
       `${name} changed from ${commit} -> ${latestCommit} (${body.commit.message})`
     );
-    projects[name] = latestCommit;
+
+    const url = `https://github.com/Noratrieb/${name}/archive/${latestCommit}.tar.gz`;
+
+    projects[name] = {
+      commit: latestCommit,
+      fetchFromGitHub: {
+        owner: "Noratrieb",
+        repo: name,
+        rev: latestCommit,
+        hash: fetchHash(url),
+      },
+    };
     hasChanges = true;
   }
 }

shell.nix

@@ -12,6 +12,13 @@
     python311Packages.zstandard
     python311Packages.brotli
     nodejs
-    (import (builtins.fetchTarball "https://github.com/ryantm/agenix/archive/531beac616433bac6f9e2a19feb8e99a22a66baf.tar.gz") { }).agenix
+    (import
+      (pkgs.fetchFromGitHub {
+        owner = "ryantm";
+        repo = "agenix";
+        rev = "531beac616433bac6f9e2a19feb8e99a22a66baf";
+        hash = "sha256-9P1FziAwl5+3edkfFcr5HeGtQUtrSdk/MksX39GieoA=";
+      })
+      { }).agenix
   ];
 }