nix-ca-example

#!/usr/bin/env bash

set -euo pipefail

go() {
  substituter='https://cache.nixos.org/'
  substituter='https://cache.ngi0.nixos.org/'

  store_path='/nix/store/39sy7704dswxk1sgr8sgwfm7p4cp23a4-vim-8.2.4186'
  store_path='/nix/store/apxk3sz6qb219w263rslm96jcsq5i4pq-git-2.34.1'

  store='/tmp/my-ca-nix'

  /nix/var/nix/profiles/default/bin/nix shell \
    --experimental-features 'nix-command' \
    --store "${store}" \
    --trusted-public-keys '' \
    --substituters "${substituter}" \
    "${store_path}" \
    --command bash -c 'realpath $(which git) && git --version'

  nix store verify \
    --experimental-features nix-command \
    --store "${store}" \
    --sigs-needed 10000 \
    "${store_path}"
}

if [[ $# -eq 1 && $1 == builds ]]; then
  curl https://hydra.ngi0.nixos.org/jobset/ca-test/nixpkgs/evals \
      -H 'Accept: application/json' |
    nix run 'nixpkgs#jq' -- '.evals[0].builds[]' |
    xargs -I{} sh -c 'curl -s https://hydra.ngi0.nixos.org/build/{} -H "Accept: application/json" | nix run nixpkgs#jq -- -r ".buildproducts[] | .path"'
else
  go
fi