From 50a2b8f9628bacdc8f13848e98b909e7be44c640 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Fri, 13 Nov 2026 16:23:34 +0100
Subject: populate: add a Rust implementation, selectable for the tests

pkgs.populate takes implementation: "shell", the default, generates a
script from populate's arguments, and "rust" passes them as JSON to the
program in pkgs/populate, built from the crate there by program.nix.
The program checks the spec as checks.nix does during evaluation, with the
same messages, and reports that delivering sources isn't implemented yet.
rustProgram replaces the program, e.g. with one built some other way.

checks.nix holds the checks of populate's arguments during evaluation.
Both implementations check the names of sources and the target path with
it, and the Rust one's wrapper also checks drawing inputs, which the shell
implementation checks where it draws them.

nix-build tests --argstr implementation rust runs the scenarios with the
Rust implementation.  They expect it to refuse copying flakes to targets
using sudo when it runs, not during evaluation, because only then it
decides whether the target is local.
---
 pkgs/populate/rust.nix | 43 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 pkgs/populate/rust.nix

(limited to 'pkgs/populate/rust.nix')

diff --git a/pkgs/populate/rust.nix b/pkgs/populate/rust.nix
new file mode 100644
index 0000000..cbf6fad
--- /dev/null
+++ b/pkgs/populate/rust.nix
@@ -0,0 +1,43 @@
+# Populate's arguments, checked and as JSON, for the program in this
+# directory, which delivers the sources.
+{ coreutils, findutils, git, jq, nix, openssh, pass, passage, program, rsync
+, writers
+}:
+
+with import ../../lib;
+
+let
+  checks = import ./checks.nix;
+in
+
+{ backup ? false, force ? false, prune ? false, source, target }:
+assert checks.checkTargetPath target.path;
+assert all checks.checkSourceName (attrNames source);
+assert checks.checkInputs source;
+let
+  # Store paths in the arguments stay dependencies of the script, so
+  # building it builds them.
+  spec = toJSON {
+    version = 1;
+    inherit backup force prune source;
+    target = {
+      inherit (target) host path;
+      user = target.user or null;
+      port = if target.port or null == null then null else toString target.port;
+      sudo = target.sudo or false;
+      extraOptions = target.extraOptions or [];
+    };
+  };
+in
+writers.writeDash "populate.${target.host}" /* sh */ ''
+  set -efu
+  echo + "$0" >&2
+  PATH=${makeBinPath [
+    coreutils findutils git jq nix openssh pass passage rsync
+  ]}''${PATH:+:$PATH}
+  export PATH
+  # The JSON is a single line, which can't be the delimiter.
+  exec ${program}/bin/populate - <<'EOF'
+  ${spec}
+  EOF
+''
-- 
cgit v1.3.1