Accessing private Git repositories in derivation

Help
1

Hi

I’m trying to migrate an existing project to use Nix.

The project is using the pnpm package manager. Ideally, there would be a pnpm2nix tool to be able to generate the node_moduels folders. The only one I found was GitHub - nix-community/pnpm2nix: Load pnpm lock files into nix :) [maintainer=@adisbladis], but that seems unmaintained, so that it does not support the pnpm-lock.yaml version I’m using.

I could of course try to modify or create a new pnpm2nix tool, but that is quite a bit of effort.

So now I’m trying to take a pragmatic approach, inspired by Nix packaging, the heretic way. The idea is to just run pnpm fetch inside a derivation where __noChroot = true. Then pnpm will still be able to access the internet.

I have create a minimum reproduction flake.nix repo here: GitHub - simonvandel/pnpmtest

If you run nix build inside that repo, you should end up with this error:

 ERROR  Command failed with exit code 128: git fetch --depth 1 origin f1ac32331df4bdb36a825096a56bf599022b1b40
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

pnpm: Command failed with exit code 128: git fetch --depth 1 origin f1ac32331df4bdb36a825096a56bf599022b1b40
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
    at makeError (/nix/store/33cvin6m5hlcs26an93a88bnz47cpc5b-pnpm-7.29.1/lib/node_modules/pnpm/dist/pnpm.cjs:23074:17)
    at handlePromise (/nix/store/33cvin6m5hlcs26an93a88bnz47cpc5b-pnpm-7.29.1/lib/node_modules/pnpm/dist/pnpm.cjs:23645:33)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async gitFetcher (/nix/store/33cvin6m5hlcs26an93a88bnz47cpc5b-pnpm-7.29.1/lib/node_modules/pnpm/dist/pnpm.cjs:110483:11)

I think this happens because the nix builder does not have access to read my ssh key.
Is there a way to give the nix builder access to it?

2

I actually found a solution myself.

The Host key verification failed. was due to ~/.ssh/known_hosts not existing when the nix builder user was running.

The following works:
In the derivation:
GIT_SSH_COMMAND="ssh -o UserKnownHostsFile=${<knownHosts>} -i ${<sshKey>}" pnpm fetch

Then populate the knownHosts and sshKey paths by doing this nix build --impure --print-build-logs -I knownHosts=~/.ssh/known_hosts -I sshKey=~/.ssh/id_ed25519.

The --impure is needed for manipulating the NIX_PATH using-I.

1 Like