From 3b0b2872aa11ea724c93010880dc3af5e77f86f8 Mon Sep 17 00:00:00 2001 From: Bernardo Magri Date: Thu, 11 Jun 2026 08:02:52 +0100 Subject: [PATCH] fix(install): seed target store via nix copy --no-check-sigs `nix flake archive --to` rejects locally-evaluated source paths ("lacks a signature by a trusted key"); enumerate the archive tree as JSON and copy with --no-check-sigs instead. Co-Authored-By: Claude Fable 5 --- pkgs/nomarchy-install/nomarchy-install.sh | 24 +++++++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-) diff --git a/pkgs/nomarchy-install/nomarchy-install.sh b/pkgs/nomarchy-install/nomarchy-install.sh index 15a2627..ecab1ec 100644 --- a/pkgs/nomarchy-install/nomarchy-install.sh +++ b/pkgs/nomarchy-install/nomarchy-install.sh @@ -405,11 +405,27 @@ section "Installing (this takes a while)" # Seed the target store with the flake source + all inputs so the first # `nomarchy-theme-sync apply` (and the HM pre-activation below) work -# before the machine has ever seen a network. +# before the machine has ever seen a network. Two steps because +# `flake archive --to` enforces signatures and locally-evaluated source +# paths have none; plain `nix copy` accepts --no-check-sigs. info "Seeding flake inputs into the target store..." -nix --extra-experimental-features "nix-command flakes" \ - flake archive --to "local?root=/mnt" "$FLAKE_DIR" >/dev/null \ - || warn "flake archive failed — first rebuild will need network." +flake_paths=$(nix --extra-experimental-features "nix-command flakes" \ + flake archive --json "$FLAKE_DIR" 2>/dev/null \ + | python3 -c ' +import json, sys +def walk(node): + yield node["path"] + for child in node.get("inputs", {}).values(): + yield from walk(child) +print("\n".join(walk(json.load(sys.stdin))))') +if [[ -n "$flake_paths" ]]; then + # shellcheck disable=SC2086 + nix --extra-experimental-features "nix-command flakes" \ + copy --no-check-sigs --to "local?root=/mnt" $flake_paths \ + || warn "input seeding failed — first rebuild will need network." +else + warn "flake archive failed — first rebuild will need network." +fi nixos-install --no-root-passwd --flake "$FLAKE_DIR#default" success "System installed (bootloader in place)"