Merge pull request #71 from vst/68-add-executable-dependencies-to-pat…

…h-nix-packaging-and-testing Fixes for testing and packaging under Nix
vst · Apr 15, 2024 · 09f65b1 · 09f65b1
2 parents 6a27625 + 03933ce
commit 09f65b1
Show file tree

Hide file tree

Showing 3 changed files with 29 additions and 10 deletions.
diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
@@ -22,8 +22,8 @@ jobs:
 
       - name: "Check Application"
         run: |
-          nix-shell --run "dev-test-build"
+          nix-shell --pure --run "dev-test-build"
 
       - name: "Check Website"
         run: |
-          nix-shell --run "cd website && npm install && npm run check"
+          nix-shell --pure --run "cd website && npm install && npm run check"
diff --git a/default.nix b/default.nix
@@ -105,7 +105,11 @@ let
       thisHaskell.hlint
       thisHaskell.hpack
 
-      ## Other build inputs for various development requirements:
+      ## Build inputs for testing requirements:
+      pkgs.curl
+      pkgs.openssh
+
+      ## Build inputs for various development requirements:
       pkgs.docker-client
       pkgs.git
       pkgs.nil
@@ -117,6 +121,10 @@ let
       ## Our custom scripts:
       dev-test-build
     ];
+
+    ## Include CA certificates for testing under pure shell:
+    SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+    NODE_EXTRA_CA_CERTS = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
   };
 
   #################
@@ -130,6 +138,7 @@ let
       pkgs.bashInteractive ## Added for bash-based CLI option completions
     ];
     nativeBuildInputs = [
+      pkgs.curl ## Required by the application tests
       pkgs.openssh ## Required by the application tests
     ];
   };

diff --git a/src/HostPatrol/Remote.hs b/src/HostPatrol/Remote.hs
@@ -435,15 +435,15 @@ _toSshError h =
 -- If the given 'T.Text' is a GitHub username, it will attempt to
 -- fetch keys from GitHub and then parse them using @ssh-keygen@.
 --
--- >>> runExceptT $ parseSshPublicKeys "gh:vst"
+-- > runExceptT $ parseSshPublicKeys "gh:vst"
 -- Right [SshPublicKey {_sshPublicKeyData = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJIQtEmoHu44pUDwX5GEw20JLmfZaI+xVXin74GI396z", _sshPublicKeyType = "ED25519", _sshPublicKeyLength = 256, _sshPublicKeyComment = "gh:vst", _sshPublicKeyFingerprint = "MD5:01:6d:4f:ca:c9:ca:dc:f1:cb:a3:fc:74:8e:34:77:16"},SshPublicKey {_sshPublicKeyData = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILdd2ubdTn5LPsN0zaxylrpkQTW+1Vr/uWQaEQXoGkd3", _sshPublicKeyType = "ED25519", _sshPublicKeyLength = 256, _sshPublicKeyComment = "gh:vst", _sshPublicKeyFingerprint = "MD5:ec:4b:ff:8d:c7:43:a9:ab:16:9f:0d:fa:8f:e2:6f:6c"}]
--- >>> runExceptT $ parseSshPublicKeys "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILdd2ubdTn5LPsN0zaxylrpkQTW+1Vr/uWQaEQXoGkd3"
+-- > runExceptT $ parseSshPublicKeys "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILdd2ubdTn5LPsN0zaxylrpkQTW+1Vr/uWQaEQXoGkd3"
 -- Right [SshPublicKey {_sshPublicKeyData = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILdd2ubdTn5LPsN0zaxylrpkQTW+1Vr/uWQaEQXoGkd3", _sshPublicKeyType = "ED25519", _sshPublicKeyLength = 256, _sshPublicKeyComment = "no comment", _sshPublicKeyFingerprint = "MD5:ec:4b:ff:8d:c7:43:a9:ab:16:9f:0d:fa:8f:e2:6f:6c"}]
--- >>> runExceptT $ parseSshPublicKeys "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILdd2ubdTn5LPsN0zaxylrpkQTW+1Vr/uWQaEQXoGkd3 comment"
+-- > runExceptT $ parseSshPublicKeys "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILdd2ubdTn5LPsN0zaxylrpkQTW+1Vr/uWQaEQXoGkd3 comment"
 -- Right [SshPublicKey {_sshPublicKeyData = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILdd2ubdTn5LPsN0zaxylrpkQTW+1Vr/uWQaEQXoGkd3 comment", _sshPublicKeyType = "ED25519", _sshPublicKeyLength = 256, _sshPublicKeyComment = "comment", _sshPublicKeyFingerprint = "MD5:ec:4b:ff:8d:c7:43:a9:ab:16:9f:0d:fa:8f:e2:6f:6c"}]
--- >>> runExceptT $ parseSshPublicKeys "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILdd2ubdTn5LPsN0zaxylrpkQTW+1Vr/uWQaEQXoGkd3 some more comment"
+-- > runExceptT $ parseSshPublicKeys "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILdd2ubdTn5LPsN0zaxylrpkQTW+1Vr/uWQaEQXoGkd3 some more comment"
 -- Right [SshPublicKey {_sshPublicKeyData = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILdd2ubdTn5LPsN0zaxylrpkQTW+1Vr/uWQaEQXoGkd3 some more comment", _sshPublicKeyType = "ED25519", _sshPublicKeyLength = 256, _sshPublicKeyComment = "some more comment", _sshPublicKeyFingerprint = "MD5:ec:4b:ff:8d:c7:43:a9:ab:16:9f:0d:fa:8f:e2:6f:6c"}]
--- >>> runExceptT $ parseSshPublicKeys "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILdd2ubdTn5LPsN0zaxylrpkQTW+1Vr/uWQaEQXoGkd3 some more comment"
+-- > runExceptT $ parseSshPublicKeys "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILdd2ubdTn5LPsN0zaxylrpkQTW+1Vr/uWQaEQXoGkd3 some more comment"
 -- Right [SshPublicKey {_sshPublicKeyData = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILdd2ubdTn5LPsN0zaxylrpkQTW+1Vr/uWQaEQXoGkd3 some more comment", _sshPublicKeyType = "ED25519", _sshPublicKeyLength = 256, _sshPublicKeyComment = "some more comment", _sshPublicKeyFingerprint = "MD5:ec:4b:ff:8d:c7:43:a9:ab:16:9f:0d:fa:8f:e2:6f:6c"}]
 parseSshPublicKeys
   :: MonadError HostPatrolError m
@@ -498,9 +498,19 @@ listGitHubSshKeys
 listGitHubSshKeys u = do
   (ec, out, err) <- TP.readProcess process
   case ec of
-    ExitFailure _ -> throwUnknown (Z.Text.unsafeTextFromBL err)
+    ExitFailure _ ->
+      throwUnknown
+        ( "Error while retrieving SSH public keys from GitHub for "
+            <> u
+            <> ". Exit code: "
+            <> Z.Text.tshow ec
+            <> ". STDOUT: "
+            <> Z.Text.unsafeTextFromBL out
+            <> ". STDERR: "
+            <> Z.Text.unsafeTextFromBL err
+        )
     ExitSuccess -> pure (toKeys out)
   where
     throwUnknown = throwError . HostPatrolErrorUnknown
-    process = TP.proc "curl" ["-s", "https://github.com/" <> T.unpack u <> ".keys"]
+    process = TP.proc "curl" ["-sS", "https://github.com/" <> T.unpack u <> ".keys"]
     toKeys = filter (not . T.null) . T.lines . Z.Text.unsafeTextFromBL