mirror of
https://github.com/elwrcl/heliux.git
synced 2026-10-31 06:38:02 +03:00
first commit
This commit is contained in:
15 files changed
+1017
No files matched your search
@@ -0,0 +1,114 @@
|
|||||||
|
name: update-helium
|
||||||
|
|
||||||
|
on:
|
||||||
|
schedule:
|
||||||
|
- cron: "0 6 * * *"
|
||||||
|
workflow_dispatch:
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: write
|
||||||
|
|
||||||
|
concurrency:
|
||||||
|
group: update-helium
|
||||||
|
cancel-in-progress: false
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
update-helium:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v4
|
||||||
|
|
||||||
|
- uses: cachix/install-nix-action@v31
|
||||||
|
with:
|
||||||
|
extra_nix_config: |
|
||||||
|
experimental-features = nix-command flakes
|
||||||
|
|
||||||
|
- name: Bump sources.nix to the latest upstream release
|
||||||
|
env:
|
||||||
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
run: |
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
SOURCES_FILE="modules/sources.nix"
|
||||||
|
|
||||||
|
# Anchor on the leading whitespace and the opening quote so this only
|
||||||
|
# matches the `versions` block and never the `x86_64-linux = versions:`
|
||||||
|
# attribute names further down the file.
|
||||||
|
get_current_version() {
|
||||||
|
grep -E "^[[:space:]]+$1 = \"" "$SOURCES_FILE" | head -1 | sed 's/.*= "\(.*\)";/\1/'
|
||||||
|
}
|
||||||
|
|
||||||
|
get_latest_release() {
|
||||||
|
curl -fsSL -H "Authorization: Bearer $GH_TOKEN" \
|
||||||
|
"https://api.github.com/repos/$1/releases/latest" | jq -r .tag_name
|
||||||
|
}
|
||||||
|
|
||||||
|
# prefetch-file reports an SRI hash directly, so there is no separate
|
||||||
|
# `nix hash convert` step that could drift out of sync.
|
||||||
|
fetch_sri_hash() {
|
||||||
|
nix store prefetch-file --json "$1" | jq -r .hash
|
||||||
|
}
|
||||||
|
|
||||||
|
update_version() {
|
||||||
|
sed -i "s|$1 = \"$2\";|$1 = \"$3\";|" "$SOURCES_FILE"
|
||||||
|
}
|
||||||
|
|
||||||
|
# Every hash sits on the line directly below the url it belongs to.
|
||||||
|
update_hash() {
|
||||||
|
sed -i "/$1/{n; s|hash = \"[^\"]*\";|hash = \"$2\";|}" "$SOURCES_FILE"
|
||||||
|
}
|
||||||
|
|
||||||
|
echo "--- Linux ---"
|
||||||
|
CURRENT_LINUX=$(get_current_version linux)
|
||||||
|
LATEST_LINUX=$(get_latest_release imputnet/helium-linux)
|
||||||
|
|
||||||
|
if [ "$LATEST_LINUX" != "$CURRENT_LINUX" ]; then
|
||||||
|
echo "$CURRENT_LINUX -> $LATEST_LINUX"
|
||||||
|
BASE="https://github.com/imputnet/helium-linux/releases/download/$LATEST_LINUX"
|
||||||
|
X86_HASH=$(fetch_sri_hash "$BASE/helium-$LATEST_LINUX-x86_64_linux.tar.xz")
|
||||||
|
ARM_HASH=$(fetch_sri_hash "$BASE/helium-$LATEST_LINUX-arm64_linux.tar.xz")
|
||||||
|
update_version linux "$CURRENT_LINUX" "$LATEST_LINUX"
|
||||||
|
update_hash "x86_64_linux\.tar\.xz" "$X86_HASH"
|
||||||
|
update_hash "arm64_linux\.tar\.xz" "$ARM_HASH"
|
||||||
|
else
|
||||||
|
echo "already at $LATEST_LINUX"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "--- macOS ---"
|
||||||
|
CURRENT_DARWIN=$(get_current_version darwin)
|
||||||
|
LATEST_DARWIN=$(get_latest_release imputnet/helium-macos)
|
||||||
|
|
||||||
|
if [ "$LATEST_DARWIN" != "$CURRENT_DARWIN" ]; then
|
||||||
|
echo "$CURRENT_DARWIN -> $LATEST_DARWIN"
|
||||||
|
BASE="https://github.com/imputnet/helium-macos/releases/download/$LATEST_DARWIN"
|
||||||
|
X86_HASH=$(fetch_sri_hash "$BASE/helium_${LATEST_DARWIN}_x86_64-macos.dmg")
|
||||||
|
ARM_HASH=$(fetch_sri_hash "$BASE/helium_${LATEST_DARWIN}_arm64-macos.dmg")
|
||||||
|
update_version darwin "$CURRENT_DARWIN" "$LATEST_DARWIN"
|
||||||
|
update_hash "x86_64-macos\.dmg" "$X86_HASH"
|
||||||
|
update_hash "arm64-macos\.dmg" "$ARM_HASH"
|
||||||
|
else
|
||||||
|
echo "already at $LATEST_DARWIN"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "HELIUM_LINUX=$(get_current_version linux)" >> "$GITHUB_ENV"
|
||||||
|
echo "HELIUM_DARWIN=$(get_current_version darwin)" >> "$GITHUB_ENV"
|
||||||
|
|
||||||
|
# A bad hash or a reshuffled upstream tarball should fail here rather than
|
||||||
|
# land on main and break everyone who tracks this flake.
|
||||||
|
- name: Verify the flake still builds
|
||||||
|
run: nix build --no-link --print-build-logs .#helium
|
||||||
|
|
||||||
|
- name: Commit and push
|
||||||
|
run: |
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
if [ -z "$(git status --porcelain)" ]; then
|
||||||
|
echo "No changes to commit."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
git config user.name "github-actions[bot]"
|
||||||
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
||||||
|
git add modules/sources.nix
|
||||||
|
git commit -m "chore: update helium (linux: $HELIUM_LINUX, darwin: $HELIUM_DARWIN)"
|
||||||
|
git push
|
||||||
@@ -0,0 +1 @@
|
|||||||
|
.direnv
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
MIT License
|
||||||
|
|
||||||
|
Copyright (c) 2026 ntgn
|
||||||
|
|
||||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
of this software and associated documentation files (the "Software"), to deal
|
||||||
|
in the Software without restriction, including without limitation the rights
|
||||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
copies of the Software, and to permit persons to whom the Software is
|
||||||
|
furnished to do so, subject to the following conditions:
|
||||||
|
|
||||||
|
The above copyright notice and this permission notice shall be included in all
|
||||||
|
copies or substantial portions of the Software.
|
||||||
|
|
||||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||||
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||||
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||||
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||||
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||||
|
SOFTWARE.
|
||||||
@@ -0,0 +1,211 @@
|
|||||||
|
# heliux
|
||||||
|
|
||||||
|
Nix flake for the [Helium browser](https://helium.computer/), with NixOS and
|
||||||
|
home-manager modules for declarative extension, policy and settings management —
|
||||||
|
plus an optional bundled Widevine CDM so DRM-protected streaming works.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> Only `x86_64-linux` is actively tested.
|
||||||
|
>
|
||||||
|
> Also this started as a copy of [gitlab.com/ntgn/helium-flake](https://gitlab.com/ntgn/helium-flake),
|
||||||
|
> which in turn was based on [schembriaiden/helium-browser-nix-flake](https://github.com/schembriaiden/helium-browser-nix-flake).
|
||||||
|
> All credit for the original packaging work goes to them. :3
|
||||||
|
|
||||||
|
## What this adds on top of upstream
|
||||||
|
|
||||||
|
- Tracks current Helium releases, updated daily by GitHub Actions.
|
||||||
|
- An `enableWidevine` build flag and a ready-made `helium-widevine` package, so
|
||||||
|
Netflix, HBO and other DRM sites play.
|
||||||
|
|
||||||
|
## Quick start
|
||||||
|
|
||||||
|
```sh
|
||||||
|
nix run github:elwrcl/heliux
|
||||||
|
```
|
||||||
|
|
||||||
|
## DRM / Widevine
|
||||||
|
|
||||||
|
Helium is compiled with ***Widevine*** support, but upstream ships no CDM library and
|
||||||
|
the wrapper passes `--disable-component-update`, so the component updater can
|
||||||
|
never fetch one at runtime. The result is that DRM playback silently fails.
|
||||||
|
|
||||||
|
The `helium-widevine` package bundles the CDM next to the binary, which fixes
|
||||||
|
playback without re-enabling the update machinery:
|
||||||
|
|
||||||
|
```nix
|
||||||
|
programs.helium.package = helium.packages.${system}.helium-widevine;
|
||||||
|
```
|
||||||
|
|
||||||
|
The CDM is proprietary, so this output requires `allowUnfree`. Plain `helium` is
|
||||||
|
unchanged and stays free-software only.
|
||||||
|
|
||||||
|
## NixOS + home-manager
|
||||||
|
|
||||||
|
> [!IMPORTANT]
|
||||||
|
> You need **both** modules. Policies only apply when they are written to
|
||||||
|
> `/etc/chromium/policies/managed/`, which is what the NixOS module does; the
|
||||||
|
> home-manager module handles extensions, preferences and the wrapper.
|
||||||
|
|
||||||
|
Add the flake to your inputs:
|
||||||
|
|
||||||
|
```nix
|
||||||
|
# flake.nix
|
||||||
|
{
|
||||||
|
inputs = {
|
||||||
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||||
|
home-manager.url = "github:nix-community/home-manager";
|
||||||
|
helium.url = "github:elwrcl/helium-flake";
|
||||||
|
};
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
Then configure it:
|
||||||
|
|
||||||
|
```nix
|
||||||
|
{ config, pkgs, helium, ... }:
|
||||||
|
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
# Writes policies to /etc/chromium/policies/managed/
|
||||||
|
helium.nixosModules.helium
|
||||||
|
];
|
||||||
|
|
||||||
|
home-manager.users.${YOUR_USERNAME} = {
|
||||||
|
imports = [ helium.homeModules.helium ];
|
||||||
|
|
||||||
|
programs.helium = {
|
||||||
|
enable = true;
|
||||||
|
defaultBrowser = true;
|
||||||
|
|
||||||
|
# Bundled Widevine CDM, for DRM streaming
|
||||||
|
package = helium.packages.${pkgs.system}.helium-widevine;
|
||||||
|
|
||||||
|
extensions = [
|
||||||
|
# uBlock Origin — see "Obtaining extensions" below
|
||||||
|
{
|
||||||
|
id = "cjpalhdlnbpafiamejdnhcphjbkeiagm";
|
||||||
|
hash = "sha256-FIbmYVj8cmXce7Vq4h7d2nOjmk4RkCnABmC4y5NDyGk=";
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
# Added to the wrapper
|
||||||
|
extraFlags = [
|
||||||
|
"--force-dark-mode"
|
||||||
|
];
|
||||||
|
|
||||||
|
# Merged into the policy file in /etc
|
||||||
|
extraPolicies = {
|
||||||
|
HomepageLocation = "https://start.duckduckgo.com";
|
||||||
|
PasswordManagerEnabled = false;
|
||||||
|
MetricsReportingEnabled = false;
|
||||||
|
};
|
||||||
|
|
||||||
|
# See "Preferences" below
|
||||||
|
preferences = {
|
||||||
|
browser.show_home_button = true;
|
||||||
|
bookmark_bar.show_on_all_tabs = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
## Options Reference
|
||||||
|
|
||||||
|
The following options are available under `programs.helium`:
|
||||||
|
|
||||||
|
| Option | Type | Default | Description |
|
||||||
|
| :--------------- | :----------------- | :--------------------- | :------------------------------------------------- |
|
||||||
|
| `enable` | boolean | `false` | Whether to enable the Helium browser module. |
|
||||||
|
| `package` | package | `self.packages.helium` | The helium package to use. |
|
||||||
|
| `extensions` | list of submodules | `[]` | List of extensions to install `{ id, hash }`. |
|
||||||
|
| `extraFlags` | list of strings | `[]` | Command line arguments passed to the wrapper. |
|
||||||
|
| `extraPolicies` | attribute set | `{}` | Raw Chromium policies to apply. |
|
||||||
|
| `preferences` | attribute set | `{}` | Json that will be merged into XDG Config. |
|
||||||
|
| `defaultBrowser` | boolean | `false` | Set Helium as the default browser in XDG mimeapps. |
|
||||||
|
|
||||||
|
## Policies
|
||||||
|
|
||||||
|
Since Helium is based on Chromium, you can use any of the standard Chromium
|
||||||
|
policies in the `extraPolicies` block. You can find a full list of available
|
||||||
|
names and values at the [Chrome Enterprise Policy List](https://chromeenterprise.google/policies/).
|
||||||
|
|
||||||
|
Common useful policies:
|
||||||
|
|
||||||
|
- `BrowserSignin`: Set to `0` to disable account sign-in.
|
||||||
|
- `BookmarkBarEnabled`: Set to `true` to force the bookmark bar to show.
|
||||||
|
- `URLBlocklist`: A list of URL patterns to block.
|
||||||
|
|
||||||
|
## Preferences
|
||||||
|
|
||||||
|
These are usually what you imperatively choose in the `Settings` menu. You can
|
||||||
|
find all the json keys and values inside the helium browser by typing
|
||||||
|
`helium://prefs-internals/` and searching for the values.
|
||||||
|
|
||||||
|
```nix
|
||||||
|
{
|
||||||
|
programs.helium.preferences = {
|
||||||
|
browser.show_home_button = false;
|
||||||
|
bookmark_bar = {
|
||||||
|
show_apps_shortcut = false;
|
||||||
|
show_managed_bookmarks = false;
|
||||||
|
show_on_all_tabs = false;
|
||||||
|
show_tab_groups = false;
|
||||||
|
};
|
||||||
|
helium.browser.layout = 1;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
## Obtaining extensions
|
||||||
|
|
||||||
|
> [!WARNING]
|
||||||
|
> Be wary that if you are rate-limited that the file will be empty and the build will fail
|
||||||
|
|
||||||
|
Use the provided binary `prefetch-nix-extension` to obtain the nix code you need.
|
||||||
|
|
||||||
|
You can copy the IDs from the URL in the chrome web store:
|
||||||
|
|
||||||
|
```ascii
|
||||||
|
https://chromewebstore.google.com/detail/bitwarden-password-manage/nngceckbapebfimnlniiiahkandclblb
|
||||||
|
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ THIS PART
|
||||||
|
```
|
||||||
|
|
||||||
|
Example Usage:
|
||||||
|
|
||||||
|
```console
|
||||||
|
./prefetch-nix-extension.sh nngceckbapebfimnlniiiahkandclblb cjpalhdlnbpafiamejdnhcphjbkeiagm
|
||||||
|
|
||||||
|
# OUTPUT:
|
||||||
|
extensions = [
|
||||||
|
{ id = "nngceckbapebfimnlniiiahkandclblb"; hash = "sha256-XOVs2Tvay8hQ13SHz+728BDu2mMyQ0JxUuUI6FZ1NaM="; }
|
||||||
|
{ id = "cjpalhdlnbpafiamejdnhcphjbkeiagm"; hash = "sha256-FIbmYVj8cmXce7Vq4h7d2nOjmk4RkCnABmC4y5NDyGk="; }
|
||||||
|
];
|
||||||
|
```
|
||||||
|
|
||||||
|
## Updating Helium
|
||||||
|
|
||||||
|
The `update-helium` GitHub Actions workflow checks upstream once a day, rewrites
|
||||||
|
`modules/sources.nix` with the new version and hashes, verifies the flake still
|
||||||
|
builds, and commits the bump. You can also trigger it by hand from the Actions
|
||||||
|
tab.
|
||||||
|
|
||||||
|
Note that this keeps *the flake* current — to pull an update into your system
|
||||||
|
you still run `nix flake update helium` and rebuild.
|
||||||
|
|
||||||
|
> [!NOTE]
|
||||||
|
> GitHub disables scheduled workflows in repositories with no activity for 60
|
||||||
|
> days. If updates stop arriving, re-enable the workflow in the Actions tab.
|
||||||
|
|
||||||
|
## Flake outputs
|
||||||
|
|
||||||
|
| Output | Description |
|
||||||
|
| ----------------------------------- | ------------------------------------ |
|
||||||
|
| `packages.<system>.helium` | Helium browser package |
|
||||||
|
| `packages.<system>.helium-widevine` | Helium with the Widevine CDM bundled |
|
||||||
|
| `apps.<system>.helium` | `nix run` entry point |
|
||||||
|
| `homeModules.helium` | home-manager module |
|
||||||
|
| `nixosModules.helium` | nixos module |
|
||||||
|
| `devShells.<system>.default` | Shell with Helium available |
|
||||||
|
| `formatter.<system>` | `nixfmt-tree` (`nix fmt`) |
|
||||||
|
| `checks.<system>.build` | Build check (`nix flake check`) |
|
||||||
Generated
+61
@@ -0,0 +1,61 @@
|
|||||||
|
{
|
||||||
|
"nodes": {
|
||||||
|
"flake-parts": {
|
||||||
|
"inputs": {
|
||||||
|
"nixpkgs-lib": "nixpkgs-lib"
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1775087534,
|
||||||
|
"narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
|
||||||
|
"owner": "hercules-ci",
|
||||||
|
"repo": "flake-parts",
|
||||||
|
"rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "hercules-ci",
|
||||||
|
"repo": "flake-parts",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"nixpkgs": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1775710090,
|
||||||
|
"narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
|
||||||
|
"owner": "NixOS",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"rev": "4c1018dae018162ec878d42fec712642d214fdfa",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "NixOS",
|
||||||
|
"ref": "nixos-unstable",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"nixpkgs-lib": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1774748309,
|
||||||
|
"narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=",
|
||||||
|
"owner": "nix-community",
|
||||||
|
"repo": "nixpkgs.lib",
|
||||||
|
"rev": "333c4e0545a6da976206c74db8773a1645b5870a",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "nix-community",
|
||||||
|
"repo": "nixpkgs.lib",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"root": {
|
||||||
|
"inputs": {
|
||||||
|
"flake-parts": "flake-parts",
|
||||||
|
"nixpkgs": "nixpkgs"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"root": "root",
|
||||||
|
"version": 7
|
||||||
|
}
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
{
|
||||||
|
description = "A Nix flake for the Helium browser";
|
||||||
|
|
||||||
|
inputs = {
|
||||||
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||||
|
flake-parts.url = "github:hercules-ci/flake-parts";
|
||||||
|
};
|
||||||
|
|
||||||
|
outputs =
|
||||||
|
inputs:
|
||||||
|
inputs.flake-parts.lib.mkFlake { inherit inputs; } {
|
||||||
|
systems = [
|
||||||
|
"x86_64-linux"
|
||||||
|
"aarch64-linux"
|
||||||
|
"x86_64-darwin"
|
||||||
|
"aarch64-darwin"
|
||||||
|
];
|
||||||
|
|
||||||
|
imports = [
|
||||||
|
./modules/nixpkgs.nix
|
||||||
|
./modules/outputs.nix
|
||||||
|
./modules/flake-module.nix
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,7 @@
|
|||||||
|
{ self, ... }:
|
||||||
|
{
|
||||||
|
flake = {
|
||||||
|
homeModules.helium = import ./home-manager.nix { inherit self; };
|
||||||
|
nixosModules.helium = import ./nixos.nix;
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,183 @@
|
|||||||
|
{ self }:
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
let
|
||||||
|
cfg = config.programs.helium;
|
||||||
|
|
||||||
|
fetchExtension =
|
||||||
|
{ id, hash }:
|
||||||
|
let
|
||||||
|
os = if pkgs.stdenv.isDarwin then "mac" else "linux";
|
||||||
|
arch = if pkgs.stdenv.isAarch64 then "arm64" else "x64";
|
||||||
|
os_arch = if pkgs.stdenv.isDarwin then "arm64" else "x86_64";
|
||||||
|
in
|
||||||
|
pkgs.fetchurl {
|
||||||
|
name = "${id}.crx";
|
||||||
|
url = "https://clients2.google.com/service/update2/crx?response=redirect&os=${os}&arch=${arch}&os_arch=${os_arch}&nacl_arch=x86-64&prod=chromiumcrx&prodchannel=stable&prodversion=120.0.0.0&acceptformat=crx3&x=id%3D${id}%26installsource%3Dondemand%26uc";
|
||||||
|
inherit hash;
|
||||||
|
};
|
||||||
|
|
||||||
|
unpackExtension =
|
||||||
|
{ id, hash }:
|
||||||
|
pkgs.runCommand "helium-ext-${id}"
|
||||||
|
{
|
||||||
|
nativeBuildInputs = [ pkgs.unzip ];
|
||||||
|
src = fetchExtension { inherit id hash; };
|
||||||
|
}
|
||||||
|
''
|
||||||
|
mkdir -p $out
|
||||||
|
unzip -q $src -d $out || true
|
||||||
|
|
||||||
|
# Remove the system-reserved metadata folder that causes the load error
|
||||||
|
rm -rf $out/_metadata
|
||||||
|
'';
|
||||||
|
|
||||||
|
resolvedExtensions = map (spec: {
|
||||||
|
inherit (spec) id;
|
||||||
|
unpacked = unpackExtension { inherit (spec) id hash; };
|
||||||
|
}) cfg.extensions;
|
||||||
|
|
||||||
|
# We add the IDs to the Allowlist policy so Helium doesn't disable them for being "unverified"
|
||||||
|
policyAttrs = {
|
||||||
|
ExtensionInstallAllowlist = map (ext: ext.id) cfg.extensions;
|
||||||
|
}
|
||||||
|
// cfg.extraPolicies;
|
||||||
|
|
||||||
|
loadExtensionFlag =
|
||||||
|
if resolvedExtensions != [ ] then
|
||||||
|
[ "--load-extension=${lib.concatStringsSep "," (map (ext: "${ext.unpacked}") resolvedExtensions)}" ]
|
||||||
|
else
|
||||||
|
[ ];
|
||||||
|
|
||||||
|
heliumWithFlags = pkgs.symlinkJoin {
|
||||||
|
name = "helium-configured";
|
||||||
|
paths = [ cfg.package ];
|
||||||
|
nativeBuildInputs = [ pkgs.makeWrapper ];
|
||||||
|
postBuild = ''
|
||||||
|
wrapProgram $out/bin/helium \
|
||||||
|
${lib.concatMapStringsSep " \\\n " (f: "--add-flags ${lib.escapeShellArg f}") (
|
||||||
|
[
|
||||||
|
"--disable-component-update"
|
||||||
|
"--allow-file-access-from-files"
|
||||||
|
]
|
||||||
|
++ loadExtensionFlag
|
||||||
|
++ lib.optionals pkgs.stdenv.isLinux [
|
||||||
|
"--ozone-platform-hint=auto"
|
||||||
|
"--enable-features=WaylandWindowDecorations,NativeNotifications,SystemNotifications"
|
||||||
|
]
|
||||||
|
++ cfg.extraFlags
|
||||||
|
)}
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
in
|
||||||
|
{
|
||||||
|
options.programs.helium = {
|
||||||
|
enable = lib.mkEnableOption "Helium browser";
|
||||||
|
package = lib.mkOption {
|
||||||
|
type = lib.types.package;
|
||||||
|
default = self.packages.${pkgs.stdenv.hostPlatform.system}.helium;
|
||||||
|
};
|
||||||
|
extensions = lib.mkOption {
|
||||||
|
type = lib.types.listOf (
|
||||||
|
lib.types.submodule {
|
||||||
|
options = {
|
||||||
|
id = lib.mkOption { type = lib.types.str; };
|
||||||
|
hash = lib.mkOption { type = lib.types.str; };
|
||||||
|
};
|
||||||
|
}
|
||||||
|
);
|
||||||
|
default = [ ];
|
||||||
|
};
|
||||||
|
extraFlags = lib.mkOption {
|
||||||
|
type = lib.types.listOf lib.types.str;
|
||||||
|
default = [ ];
|
||||||
|
};
|
||||||
|
extraPolicies = lib.mkOption {
|
||||||
|
type = lib.types.attrsOf lib.types.anything;
|
||||||
|
default = { };
|
||||||
|
};
|
||||||
|
defaultBrowser = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
|
default = false;
|
||||||
|
};
|
||||||
|
|
||||||
|
finalPolicyJson = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
internal = true;
|
||||||
|
default = builtins.toJSON policyAttrs;
|
||||||
|
};
|
||||||
|
|
||||||
|
preferences = lib.mkOption {
|
||||||
|
type = lib.types.attrsOf lib.types.anything;
|
||||||
|
default = { };
|
||||||
|
description = ''
|
||||||
|
Chromium preferences to set in the Default profile.
|
||||||
|
These are merged into ~/.config/net.imput.helium/Default/Preferences.
|
||||||
|
Type: 'helium://prefs-internals/' to search for the json keys and values
|
||||||
|
'';
|
||||||
|
example = lib.literalExpression ''
|
||||||
|
{
|
||||||
|
"browser"."show_home_button" = true;
|
||||||
|
}
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = lib.mkIf cfg.enable {
|
||||||
|
home = {
|
||||||
|
packages = [
|
||||||
|
heliumWithFlags
|
||||||
|
pkgs.jq
|
||||||
|
pkgs.coreutils
|
||||||
|
];
|
||||||
|
|
||||||
|
activation = lib.mkIf (cfg.preferences != { }) {
|
||||||
|
heliumPreferences = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
|
||||||
|
prefs_dir="$HOME/.config/net.imput.helium/Default"
|
||||||
|
prefs_file="$prefs_dir/Preferences"
|
||||||
|
nix_prefs='${builtins.toJSON cfg.preferences}'
|
||||||
|
|
||||||
|
run mkdir -p "$prefs_dir"
|
||||||
|
|
||||||
|
if [ -f "$prefs_file" ]; then
|
||||||
|
merged=$(${pkgs.jq}/bin/jq -s '.[0] * .[1]' "$prefs_file" - <<< "$nix_prefs")
|
||||||
|
if [ -n "$merged" ]; then
|
||||||
|
printf '%s\n' "$merged" > "$prefs_file"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
printf '%s\n' "$nix_prefs" > "$prefs_file"
|
||||||
|
fi
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
xdg.mimeApps = lib.mkIf cfg.defaultBrowser {
|
||||||
|
enable = true;
|
||||||
|
defaultApplications = {
|
||||||
|
"text/html" = "helium.desktop";
|
||||||
|
"x-scheme-handler/http" = "helium.desktop";
|
||||||
|
"x-scheme-handler/https" = "helium.desktop";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
xdg.desktopEntries.helium = lib.mkIf cfg.defaultBrowser {
|
||||||
|
name = "Helium";
|
||||||
|
exec = "${heliumWithFlags}/bin/helium %U";
|
||||||
|
icon = "helium";
|
||||||
|
terminal = false;
|
||||||
|
categories = [
|
||||||
|
"Network"
|
||||||
|
"WebBrowser"
|
||||||
|
];
|
||||||
|
mimeType = [
|
||||||
|
"text/html"
|
||||||
|
"x-scheme-handler/http"
|
||||||
|
"x-scheme-handler/https"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,21 @@
|
|||||||
|
{ config, lib, ... }:
|
||||||
|
let
|
||||||
|
# finding all home-manager users that have helium enabled
|
||||||
|
enabledUsers = lib.filterAttrs (_: user: user.programs.helium.enable or false) (
|
||||||
|
config.home-manager.users or { }
|
||||||
|
);
|
||||||
|
|
||||||
|
# generate etc files per user to support multi-user systems
|
||||||
|
policyFiles = lib.mapAttrs' (
|
||||||
|
name: user:
|
||||||
|
lib.nameValuePair "chromium/policies/managed/helium-${name}.json" {
|
||||||
|
text = user.programs.helium.finalPolicyJson;
|
||||||
|
mode = "0644";
|
||||||
|
}
|
||||||
|
) enabledUsers;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
config = lib.mkIf (enabledUsers != { }) {
|
||||||
|
environment.etc = policyFiles;
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,11 @@
|
|||||||
|
{ inputs, ... }:
|
||||||
|
{
|
||||||
|
perSystem =
|
||||||
|
{ system, ... }:
|
||||||
|
{
|
||||||
|
_module.args.pkgs = import inputs.nixpkgs {
|
||||||
|
inherit system;
|
||||||
|
config.allowUnfree = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,60 @@
|
|||||||
|
{ ... }:
|
||||||
|
{
|
||||||
|
perSystem =
|
||||||
|
{ pkgs, system, ... }:
|
||||||
|
let
|
||||||
|
sources = import ./sources.nix;
|
||||||
|
|
||||||
|
version = if pkgs.stdenv.isDarwin then sources.versions.darwin else sources.versions.linux;
|
||||||
|
|
||||||
|
src = pkgs.fetchurl (
|
||||||
|
(sources.srcs.${system} or (throw "Unsupported system: ${system}")) sources.versions
|
||||||
|
);
|
||||||
|
|
||||||
|
helium = pkgs.callPackage ./package.nix { inherit version src; };
|
||||||
|
|
||||||
|
# same build with the proprietary Widevine CDM bundled, so DRM-protected
|
||||||
|
# streaming works out of the box. Kept as a separate output rather than a
|
||||||
|
# default so the plain `helium` package stays free-software only.
|
||||||
|
helium-widevine = helium.override { enableWidevine = true; };
|
||||||
|
|
||||||
|
app = {
|
||||||
|
type = "app";
|
||||||
|
program = "${helium}/bin/helium";
|
||||||
|
meta = {
|
||||||
|
inherit (helium.meta)
|
||||||
|
description
|
||||||
|
homepage
|
||||||
|
license
|
||||||
|
platforms
|
||||||
|
;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
in
|
||||||
|
{
|
||||||
|
packages = {
|
||||||
|
default = helium;
|
||||||
|
inherit helium;
|
||||||
|
}
|
||||||
|
// pkgs.lib.optionalAttrs pkgs.stdenv.isLinux { inherit helium-widevine; };
|
||||||
|
|
||||||
|
apps = {
|
||||||
|
default = app;
|
||||||
|
helium = app;
|
||||||
|
};
|
||||||
|
|
||||||
|
devShells.default = pkgs.mkShell {
|
||||||
|
packages = [
|
||||||
|
helium
|
||||||
|
pkgs.nix-update
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
formatter = pkgs.nixfmt-tree;
|
||||||
|
|
||||||
|
checks = {
|
||||||
|
build = helium;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
}
|
||||||
@@ -0,0 +1,232 @@
|
|||||||
|
{
|
||||||
|
stdenv,
|
||||||
|
lib,
|
||||||
|
makeWrapper,
|
||||||
|
autoPatchelfHook,
|
||||||
|
copyDesktopItems,
|
||||||
|
makeDesktopItem,
|
||||||
|
_7zz,
|
||||||
|
# runtime/build deps
|
||||||
|
alsa-lib,
|
||||||
|
at-spi2-atk,
|
||||||
|
at-spi2-core,
|
||||||
|
atk,
|
||||||
|
cairo,
|
||||||
|
cups,
|
||||||
|
dbus,
|
||||||
|
expat,
|
||||||
|
fontconfig,
|
||||||
|
freetype,
|
||||||
|
gdk-pixbuf,
|
||||||
|
glib,
|
||||||
|
gtk3,
|
||||||
|
kdePackages,
|
||||||
|
libdrm,
|
||||||
|
libgbm,
|
||||||
|
libGL,
|
||||||
|
libpulseaudio,
|
||||||
|
libva,
|
||||||
|
libvdpau,
|
||||||
|
libx11,
|
||||||
|
libxcb,
|
||||||
|
libxcomposite,
|
||||||
|
libxcursor,
|
||||||
|
libxdamage,
|
||||||
|
libxext,
|
||||||
|
libxfixes,
|
||||||
|
libxi,
|
||||||
|
libxkbcommon,
|
||||||
|
libxrandr,
|
||||||
|
libxrender,
|
||||||
|
libxscrnsaver,
|
||||||
|
libxshmfence,
|
||||||
|
libxtst,
|
||||||
|
libuuid,
|
||||||
|
mesa,
|
||||||
|
nspr,
|
||||||
|
nss,
|
||||||
|
pango,
|
||||||
|
pipewire,
|
||||||
|
systemd,
|
||||||
|
vulkan-loader,
|
||||||
|
wayland,
|
||||||
|
widevine-cdm,
|
||||||
|
# bundle the "proprietary" Widevine CDM so DRM streaming ( Netflix, HBO, ..)
|
||||||
|
# Requires `nixpkgs.config.allowUnfree = true` in the consuming config.
|
||||||
|
enableWidevine ? false,
|
||||||
|
version,
|
||||||
|
src,
|
||||||
|
}:
|
||||||
|
let
|
||||||
|
# Chromium flags applied on all platforms to disable update machinery.
|
||||||
|
commonFlags = [
|
||||||
|
"--disable-component-update"
|
||||||
|
"--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'"
|
||||||
|
"--check-for-update-interval=0"
|
||||||
|
"--no-first-run"
|
||||||
|
"--enable-features=StorageAccessAPI"
|
||||||
|
"--restore-last-session"
|
||||||
|
];
|
||||||
|
|
||||||
|
addFlags = lib.concatMapStringsSep " \\\n " (f: "--add-flags \"${f}\"");
|
||||||
|
|
||||||
|
# Libraries that must appear on LD_LIBRARY_PATH at runtime on Linux.
|
||||||
|
linuxRuntimeLibs = [
|
||||||
|
libGL
|
||||||
|
libvdpau
|
||||||
|
libva
|
||||||
|
pipewire
|
||||||
|
alsa-lib
|
||||||
|
libpulseaudio
|
||||||
|
];
|
||||||
|
in
|
||||||
|
stdenv.mkDerivation {
|
||||||
|
pname = "helium";
|
||||||
|
inherit version src;
|
||||||
|
|
||||||
|
nativeBuildInputs = [
|
||||||
|
makeWrapper
|
||||||
|
]
|
||||||
|
++ lib.optionals stdenv.isLinux [
|
||||||
|
autoPatchelfHook
|
||||||
|
copyDesktopItems
|
||||||
|
]
|
||||||
|
++ lib.optionals stdenv.isDarwin [ _7zz ];
|
||||||
|
|
||||||
|
buildInputs = lib.optionals stdenv.isLinux [
|
||||||
|
alsa-lib
|
||||||
|
at-spi2-atk
|
||||||
|
at-spi2-core
|
||||||
|
atk
|
||||||
|
cairo
|
||||||
|
cups
|
||||||
|
dbus
|
||||||
|
expat
|
||||||
|
fontconfig
|
||||||
|
freetype
|
||||||
|
gdk-pixbuf
|
||||||
|
glib
|
||||||
|
gtk3
|
||||||
|
libdrm
|
||||||
|
libgbm
|
||||||
|
libGL
|
||||||
|
libpulseaudio
|
||||||
|
libx11
|
||||||
|
libxcb
|
||||||
|
libxcomposite
|
||||||
|
libxcursor
|
||||||
|
libxdamage
|
||||||
|
libxext
|
||||||
|
libxfixes
|
||||||
|
libxi
|
||||||
|
libxkbcommon
|
||||||
|
libxrandr
|
||||||
|
libxrender
|
||||||
|
libxscrnsaver
|
||||||
|
libxshmfence
|
||||||
|
libxtst
|
||||||
|
libuuid
|
||||||
|
mesa
|
||||||
|
nspr
|
||||||
|
nss
|
||||||
|
pango
|
||||||
|
pipewire
|
||||||
|
systemd
|
||||||
|
vulkan-loader
|
||||||
|
wayland
|
||||||
|
kdePackages.qtbase
|
||||||
|
];
|
||||||
|
|
||||||
|
# QT libraries are bundled; suppress autoPatchelf warnings for them.
|
||||||
|
autoPatchelfIgnoreMissingDeps = lib.optionals stdenv.isLinux [
|
||||||
|
"libQt6Core.so.6"
|
||||||
|
"libQt6Gui.so.6"
|
||||||
|
"libQt6Widgets.so.6"
|
||||||
|
"libQt5Core.so.5"
|
||||||
|
"libQt5Gui.so.5"
|
||||||
|
"libQt5Widgets.so.5"
|
||||||
|
];
|
||||||
|
|
||||||
|
dontWrapQtApps = stdenv.isLinux;
|
||||||
|
|
||||||
|
unpackCmd = lib.optionalString stdenv.isDarwin "7zz x $src";
|
||||||
|
|
||||||
|
installPhase =
|
||||||
|
if stdenv.isDarwin then
|
||||||
|
''
|
||||||
|
runHook preInstall
|
||||||
|
|
||||||
|
mkdir -p $out/Applications/Helium.app
|
||||||
|
cp -r . $out/Applications/Helium.app
|
||||||
|
|
||||||
|
mkdir -p $out/bin
|
||||||
|
makeWrapper $out/Applications/Helium.app/Contents/MacOS/Helium $out/bin/helium \
|
||||||
|
${addFlags commonFlags}
|
||||||
|
|
||||||
|
runHook postInstall
|
||||||
|
''
|
||||||
|
else
|
||||||
|
''
|
||||||
|
runHook preInstall
|
||||||
|
|
||||||
|
mkdir -p $out/bin $out/opt/helium
|
||||||
|
cp -r * $out/opt/helium
|
||||||
|
${lib.optionalString enableWidevine ''
|
||||||
|
cp -r ${widevine-cdm}/share/google/chrome/WidevineCdm $out/opt/helium/WidevineCdm
|
||||||
|
''}
|
||||||
|
|
||||||
|
makeWrapper $out/opt/helium/helium $out/bin/helium \
|
||||||
|
--prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath linuxRuntimeLibs}" \
|
||||||
|
--add-flags "--ozone-platform-hint=auto" \
|
||||||
|
--add-flags "--enable-features=WaylandWindowDecorations" \
|
||||||
|
${addFlags commonFlags}
|
||||||
|
|
||||||
|
mkdir -p $out/share/icons/hicolor/256x256/apps
|
||||||
|
cp $out/opt/helium/product_logo_256.png \
|
||||||
|
$out/share/icons/hicolor/256x256/apps/helium.png
|
||||||
|
|
||||||
|
runHook postInstall
|
||||||
|
'';
|
||||||
|
|
||||||
|
# helper utility for getting extensions
|
||||||
|
postInstall = ''
|
||||||
|
mkdir -p $out/bin
|
||||||
|
cp ${../scripts/prefetch-nix-extension.sh} $out/bin/prefetch-nix
|
||||||
|
chmod +x $out/bin/prefetch-nix
|
||||||
|
'';
|
||||||
|
|
||||||
|
desktopItems = lib.optionals stdenv.isLinux [
|
||||||
|
(makeDesktopItem {
|
||||||
|
name = "helium";
|
||||||
|
exec = "helium %U";
|
||||||
|
icon = "helium";
|
||||||
|
desktopName = "Helium";
|
||||||
|
genericName = "Web Browser";
|
||||||
|
categories = [
|
||||||
|
"Network"
|
||||||
|
"WebBrowser"
|
||||||
|
];
|
||||||
|
terminal = false;
|
||||||
|
mimeTypes = [
|
||||||
|
"text/html"
|
||||||
|
"text/xml"
|
||||||
|
"application/xhtml+xml"
|
||||||
|
"x-scheme-handler/http"
|
||||||
|
"x-scheme-handler/https"
|
||||||
|
];
|
||||||
|
})
|
||||||
|
];
|
||||||
|
|
||||||
|
meta = {
|
||||||
|
description = "Private, fast, and honest web browser based on ungoogled-chromium";
|
||||||
|
homepage = "https://helium.computer/";
|
||||||
|
license = lib.licenses.gpl3Only;
|
||||||
|
platforms = [
|
||||||
|
"x86_64-linux"
|
||||||
|
"aarch64-linux"
|
||||||
|
"x86_64-darwin"
|
||||||
|
"aarch64-darwin"
|
||||||
|
];
|
||||||
|
mainProgram = "helium";
|
||||||
|
};
|
||||||
|
}
|
||||||
@@ -0,0 +1,25 @@
|
|||||||
|
{
|
||||||
|
versions = {
|
||||||
|
linux = "0.15.7.1";
|
||||||
|
darwin = "0.15.7.1";
|
||||||
|
};
|
||||||
|
|
||||||
|
srcs = {
|
||||||
|
x86_64-linux = versions: {
|
||||||
|
url = "https://github.com/imputnet/helium-linux/releases/download/${versions.linux}/helium-${versions.linux}-x86_64_linux.tar.xz";
|
||||||
|
hash = "sha256-MQKJLN69/g1R46Y44ADo1UvKAXxS2vKsq/XlAwBO+58=";
|
||||||
|
};
|
||||||
|
aarch64-linux = versions: {
|
||||||
|
url = "https://github.com/imputnet/helium-linux/releases/download/${versions.linux}/helium-${versions.linux}-arm64_linux.tar.xz";
|
||||||
|
hash = "sha256-CYHUDYEMwe+2//4cDPMS2VqcRfbRJD0USDxDJ7kKu6Q=";
|
||||||
|
};
|
||||||
|
x86_64-darwin = versions: {
|
||||||
|
url = "https://github.com/imputnet/helium-macos/releases/download/${versions.darwin}/helium_${versions.darwin}_x86_64-macos.dmg";
|
||||||
|
hash = "sha256-vQ3CkgEQHCPDvlxW24zNVkFM42OkfHIHHgmvcehU0ic=";
|
||||||
|
};
|
||||||
|
aarch64-darwin = versions: {
|
||||||
|
url = "https://github.com/imputnet/helium-macos/releases/download/${versions.darwin}/helium_${versions.darwin}_arm64-macos.dmg";
|
||||||
|
hash = "sha256-QQT3dtBKQvnGi3ySsgaVeXGqKIJ/iys5fDApZnDlt5E=";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
Executable
+44
@@ -0,0 +1,44 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# check if at least one ID was provided
|
||||||
|
if [ $# -eq 0 ]; then
|
||||||
|
echo "Usage: fetchext <ID> [<ID> ...]"
|
||||||
|
echo "Example: fetchext nngceckbapebfimnlniiiahkandclblb"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
|
||||||
|
|
||||||
|
# print opening for easy copy-pasting
|
||||||
|
echo "extensions = ["
|
||||||
|
|
||||||
|
for id in "$@"; do
|
||||||
|
# fetch CRX to calculate the hash
|
||||||
|
url="https://clients2.google.com/service/update2/crx?response=redirect&os=linux&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromiumcrx&prodchannel=stable&prodversion=120.0.0.0&acceptformat=crx3&x=id%3D${id}%26installsource%3Dondemand%26uc"
|
||||||
|
|
||||||
|
tmpfile=$(mktemp)
|
||||||
|
|
||||||
|
# -L follows the redirect from Google's service to the actual .crx file
|
||||||
|
if curl -fsSL -A "$UA" "$url" -o "$tmpfile"; then
|
||||||
|
size=$(stat -c%s "$tmpfile")
|
||||||
|
|
||||||
|
if [ "$size" -gt 1000 ]; then
|
||||||
|
# generate SRI hash
|
||||||
|
hash=$(nix-hash --type sha256 --flat --base32 "$tmpfile")
|
||||||
|
sri=$(nix hash convert --to sri --hash-algo sha256 "$hash")
|
||||||
|
|
||||||
|
# output the Nix code block
|
||||||
|
echo " { id = \"$id\"; hash = \"$sri\"; }"
|
||||||
|
else
|
||||||
|
echo " # FAILED: ID $id returned an empty or invalid file (check ID)."
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
echo " # FAILED: Could not reach Google Update servers for ID $id."
|
||||||
|
fi
|
||||||
|
|
||||||
|
rm -f "$tmpfile"
|
||||||
|
# sleep to avoid rate limiting if fetching many at once
|
||||||
|
sleep 0.5
|
||||||
|
done
|
||||||
|
|
||||||
|
echo "];"
|
||||||
Reference in new issue
Block a user