Automatically generate cache for stackage projects

docs/user-guide/source-repository-hashes.md

@@ -0,0 +1,50 @@
+# Source Repository Hashes
+
+Both `stack.yaml` and `cabal.project` files can contain references
+to git repositories containing the version of a particular package
+that we wish to use.  This is mostly handled automatically by
+`nix-tools` and `haskell.nix` however when we want to use a nix
+system that is configured to use restricted mode (typically hydra)
+it will need an aditionaly hash.
+
+When using `cabalProject` or `stackProject` functions you can include
+the hash needed in a comment.
+
+To calculate the hash use `nix-prefetch-git`:
+
+```
+$ nix-prefetch-git https://github.com/input-output-hk/haskell.nix.git bc01ebc05a8105035c9449943046b46c8364b932
+...
+{
+  "url": "https://github.com/input-output-hk/haskell.nix.git",
+  "rev": "bc01ebc05a8105035c9449943046b46c8364b932",
+  "date": "2019-05-30T13:13:18+08:00",
+  "sha256": "003lm3pm024vhbfmii7xcdd9v2rczpflxf7gdl2pyxia7p014i8z",
+  "fetchSubmodules": false
+}
+```
+
+If you are using `cabalProject` add a `--sha256` comment to the
+`cabal.project` file:
+
+```
+source-repository-package
+  type: git
+  location: https://github.com/input-output-hk/haskell.nix.git
+  tag: bc01ebc05a8105035c9449943046b46c8364b932
+  subdir: test/cabal-simple
+  --sha256: 003lm3pm024vhbfmii7xcdd9v2rczpflxf7gdl2pyxia7p014i8z
+```
+
+If you are using `stackProject` add a `# nix-sha256` comment to the
+`stack.yaml` file:
+
+```
+extra-deps:
+- git: https://github.com/input-output-hk/haskell.nix.git
+  commit: bc01ebc05a8105035c9449943046b46c8364b932
+  subdirs:
+    - test/cabal-simple
+  # nix-sha256: 003lm3pm024vhbfmii7xcdd9v2rczpflxf7gdl2pyxia7p014i8z
+```
+

lib/stack-cache-generator.nix

@@ -0,0 +1,80 @@
+# Generate cache entries for dependencies of package defined in `src`
+
+{ pkgs, haskellLib, nix-tools }:
+{ src, stackYaml ? "stack.yaml" }:
+let
+    # We only care about the stackYaml file.  If src is a local directory
+    # we want to avoid recalculating the cache unless the stack.yaml file
+    # changes.
+
+    # Using origSrcSubDir bypasses any cleanSourceWith so that it will work when
+    # access to the store is restricted.  If origSrc was already in the store
+    # you can pass the project in as a string.
+    rawStackYaml = builtins.readFile ((src.origSrcSubDir or src) + ("/" + stackYaml));
+
+    # Determine the resolver as it may point to another file we need
+    # to look at.
+    resolver =
+      let
+        rs = pkgs.lib.lists.concatLists (
+          pkgs.lib.lists.filter (l: l != null)
+            (builtins.map (l: builtins.match "^resolver: *(.*)" l)
+              (pkgs.lib.splitString "\n" rawStackYaml)));
+      in
+        pkgs.lib.lists.head (rs ++ [ null ]);
+
+    # Filter just the stack yaml file and any reolver yaml file it points to.
+    maybeCleanedSource =
+      if haskellLib.canCleanSource src
+        then haskellLib.cleanSourceWith {
+          inherit src;
+          filter = path: type:
+               pkgs.lib.hasSuffix ("/" + stackYaml) path
+            || (resolver != null && pkgs.lib.hasSuffix ("/" + resolver) path);
+        }
+        else src;
+
+    # All repos served via ssh or git protocols are usually private
+    private = url: pkgs.lib.substring 0 4 url != "http";
+
+    repos = builtins.fromJSON (builtins.readFile (pkgs.runCommand "stack-repos" {
+        buildInputs = [ nix-tools ];
+      } ''
+        TMP=$(mktemp -d)
+        cd $TMP
+        cp -r "${maybeCleanedSource}/." $TMP
+        chmod -R +w $TMP
+        substituteInPlace ${stackYaml} --replace "# nix-sha256:" "nix-sha256:"
+        stack-repos --stack-yaml ${stackYaml}
+        cp repos.json $out
+      ''));
+
+    cabalName = path: builtins.readFile (pkgs.runCommand "cabal-name" {
+        buildInputs = [ nix-tools ];
+      } ''
+        cabal-name ${path} > $out
+      '');
+
+    hashPath = path:
+        builtins.readFile (pkgs.runCommand "hash-path" { preferLocalBuild = true; }
+            "echo -n $(${pkgs.nix}/bin/nix-hash --type sha256 --base32 ${path}) > $out");
+in with pkgs.lib;
+concatMap (dep:
+        let
+            is-private = private dep.url;
+            pkgsrc =
+              if !is-private && dep.sha256 != null
+                then pkgs.fetchgit {
+                  inherit (dep) url rev sha256;
+                }
+                else builtins.fetchGit {
+                  inherit (dep) url rev;
+                  ref = "*";
+                };
+        in map (subdir: {
+                name = cabalName "${pkgsrc}/${subdir}";
+                inherit (dep) url rev;
+                inherit is-private;
+                sha256 = if !is-private then hashPath pkgsrc else null;
+            } // (optionalAttrs (subdir != "") { inherit subdir; }))
+        (dep.subdirs or [ "" ])) repos