lib

Core libraries for Radroots
git clone https://radroots.dev/git/lib.git
Log | Files | Refs | README

native-inputs.nix (1369B)

      1 { lib }:
      2 {
      3   nativeBuildInputs ? [ ],
      4   buildInputs ? [ ],
      5   environment ? { },
      6 }:
      7 assert lib.assertMsg (builtins.isList nativeBuildInputs) "nativeBuildInputs must be a list";
      8 assert lib.assertMsg (builtins.isList buildInputs) "buildInputs must be a list";
      9 assert lib.assertMsg (builtins.isAttrs environment) "environment must be an attribute set";
     10 assert lib.assertMsg (lib.all (name: builtins.match "^[A-Za-z_][A-Za-z0-9_]*$" name != null) (
     11   builtins.attrNames environment
     12 )) "environment names must be shell identifiers";
     13 assert lib.assertMsg (lib.all (
     14   name: builtins.match ".*(CREDENTIAL|PASSWORD|PRIVATE_KEY|SECRET|TOKEN).*" (lib.toUpper name) == null
     15 ) (builtins.attrNames environment)) "environment names must not identify secret material";
     16 assert lib.assertMsg (lib.all (
     17   entry:
     18   builtins.isAttrs entry
     19   &&
     20     builtins.attrNames entry == [
     21       "classification"
     22       "value"
     23     ]
     24   && entry.classification == "nonsecret"
     25   && builtins.isString entry.value
     26   && builtins.stringLength entry.value <= 4096
     27 ) (builtins.attrValues environment)) "environment values must be bounded typed nonsecret values";
     28 {
     29   schema = "radroots.service.native-inputs.v1";
     30   nativeBuildInputs = lib.unique nativeBuildInputs;
     31   buildInputs = lib.unique buildInputs;
     32   environment = lib.mapAttrs (_: entry: entry.value) environment;
     33   environmentContract = environment;
     34 }