How to clone a private git repository in a nix derivation

Question

{
  nixpkgs ? import <nixpkgs> {}
}:nixpkgs.pkgs.fetchgitPrivate {
        url = "ssh://git@gitlab.com/trycatchchris/blog.git";
        rev = "0f5fe7ebf0724eb17aea4141e0cf3f1758a6d716";
        sha256 = "02951e82c1183aaf1ce4b9669bf9ae32e50c4c641550797eed37739cd4528b58";
      }

I've got the above nix expression, where the repo is a private git repository.

I do have access to this repository via a public key for my user.

If I try a regular nix-build:

nix-build
trace: Please set your nix-path such that ssh-config-file points to a file that will allow ssh to access private repositories. The builder will not be able to see any running ssh agent sessions unless ssh-auth-sock is also set in the nix-path.

Note that the config file and any keys it points to must be readable by the build user, which depending on your nix configuration means making it readable by the build-users-group, the user of the running nix-daemon, or the user calling the nix command which started the build. Similarly, if using an ssh agent ssh-auth-sock must point to a socket the build user can access.

You may need StrictHostKeyChecking=no in the config file. Since ssh will refuse to use a group-readable private key, if using build-users you will likely want to use something like IdentityFile /some/directory/%u/key and have a directory for each build user accessible to that user.

these derivations will be built:
  /nix/store/hlnshdb0ckckih46cv66xj8pyqds6w7y-blog-0f5fe7e.drv
building '/nix/store/hlnshdb0ckckih46cv66xj8pyqds6w7y-blog-0f5fe7e.drv'...
exporting ssh://git@gitlab.com/trycatchchris/blog.git (rev 0f5fe7ebf0724eb17aea4141e0cf3f1758a6d716) into /nix/store/mkinydhkdyg6dyw7fp399m90qw5bsbqd-blog-0f5fe7e
Initialized empty Git repository in /nix/store/mkinydhkdyg6dyw7fp399m90qw5bsbqd-blog-0f5fe7e/.git/
Can't open user config file /var/lib/empty/config: No such file or directory
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
Can't open user config file /var/lib/empty/config: No such file or directory
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
Unable to checkout 0f5fe7ebf0724eb17aea4141e0cf3f1758a6d716 from ssh://git@gitlab.com/trycatchchris/blog.git.
builder for '/nix/store/hlnshdb0ckckih46cv66xj8pyqds6w7y-blog-0f5fe7e.drv' failed with exit code 1
error: build of '/nix/store/hlnshdb0ckckih46cv66xj8pyqds6w7y-blog-0f5fe7e.drv' failed

I've tried using the ssh agent as well as (from https://github.com/NixOS/nixpkgs/issues/4004#issuecomment-236434045):

creating a ssh file with contents of:

Host gitlab.com
  StrictHostKeyChecking No
  UserKnownHostsFile /dev/null
  IdentityFile /home/chris/.ssh/id_rsa

And running:

nix-build -I ssh-config-file=$PWD/ssh           
these derivations will be built:
  /nix/store/ng4qdayni3a69b57kfmrvf4ba03ryfv9-blog-0f5fe7e.drv
building '/nix/store/ng4qdayni3a69b57kfmrvf4ba03ryfv9-blog-0f5fe7e.drv'...
exporting ssh://git@gitlab.com/trycatchchris/blog.git (rev 0f5fe7ebf0724eb17aea4141e0cf3f1758a6d716) into /nix/store/mkinydhkdyg6dyw7fp399m90qw5bsbqd-blog-0f5fe7e
Initialized empty Git repository in /nix/store/mkinydhkdyg6dyw7fp399m90qw5bsbqd-blog-0f5fe7e/.git/
Can't open user config file /home/chris/temp/wiptemp/11/ssh: No such file or directory
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
Can't open user config file /home/chris/temp/wiptemp/11/ssh: No such file or directory
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
Unable to checkout 0f5fe7ebf0724eb17aea4141e0cf3f1758a6d716 from ssh://git@gitlab.com/trycatchchris/blog.git.
builder for '/nix/store/ng4qdayni3a69b57kfmrvf4ba03ryfv9-blog-0f5fe7e.drv' failed with exit code 1
error: build of '/nix/store/ng4qdayni3a69b57kfmrvf4ba03ryfv9-blog-0f5fe7e.drv' failed

However this also fails... How can I clone down the private repo using the above approach or some other approach?

Chris Stryczynski · Accepted Answer · 2022-05-15T11:14:19.957

{
  nixpkgs ? import <nixpkgs> {}
}:(import (builtins.fetchGit {
        url = "ssh://git@gitlab.com/trycatchchris/blog.git";
        rev = "4d127272689a5bc172e82529132b91e5943bb16f";
      }) {})

The above (builtins.fetchGit) seems to work perfectly without needing to setup a sandbox etc (uses the default ~/.ssh/id_rsa key).

If using Nix < v2.4 and fetching a commit that is not on the master branch you will need to add an additional ref attribute with the branch name for example:

{
            url = "ssh://git@gitlab.com/trycatchchris/blog.git";
            rev = "4d127272689a5bc172e82529132b91e5943bb16f";
            ref = "branchNameGoesHere"; # here
          }

https://github.com/nix-community/naersk/pull/211

How to clone a private git repository in a nix derivation

1 Answers1