default.nix

with import <nixpkgs> {};
with lib;

let

  toHex = elemAt (stringToCharacters "0123456789abcdef");

  base64Mapping = let
    charList = upperChars ++ lowerChars ++ genList toString 10 ++ [ "+" "/" ];
  in
    lib.listToAttrs (map (n: {
      name = lib.elemAt charList n;
      value = n;
    }) (lib.range 0 63)) // { "" = 0; };


  pairToHex = a: b:
  let
    av = base64Mapping.${a} or 0;
    bv = base64Mapping.${b} or 0;
  in map toHex [
    (av / 4)
    (lib.bitOr (lib.bitAnd av 3 * 4) (lib.bitAnd bv 48 / 16))
    (lib.bitAnd bv 15)
  ];

  base64ToHex = hash: lib.substring 0 64 (lib.concatStrings (lib.concatMap (n:
    pairToHex
      (lib.substring (2 * n) 1 hash)
      (lib.substring (2 * n + 1) 1 hash)
    ) (lib.range 0 (lib.stringLength hash / 2))));


  result = runCommandNoCC "github-key" {
    nativeBuildInputs = [ openssh ];
    outputHashAlgo = "sha256";
    outputHashMode = "flat";
    # From https://help.github.com/en/github/authenticating-to-github/githubs-ssh-key-fingerprints
    outputHash = base64ToHex "nThbg6kXUpJWGl7E1IGOCspRomTxdCARLviKw6E5SY8";
  } ''
    ssh-keyscan github.com | cut -d' ' -f3 | base64 -d > $out
  '';
in result