1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
|
{
applyPatches,
lib,
bundlerEnv,
fetchFromGitHub,
fetchpatch,
ruby_3_4,
stdenv,
tailwindcss_4,
}:
let
sources = lib.importJSON ./sources.json;
inherit (sources) version;
src = applyPatches {
src = fetchFromGitHub {
inherit (sources)
owner
repo
hash
;
tag = sources.version;
};
patches = [
(fetchpatch {
name = "CVE-2026-66066.patch";
url = "https://github.com/we-promise/sure/commit/40a678fe8f774bb144e023c2abab1ac37f7c8d36.patch";
hash = "sha256-ocm4CZonT+J8jLw6Ftr36Fb/rguP0nATnW5aGSpUizY=";
})
];
postPatch = ''
cp -f ${./rubyEnv/Gemfile} ./Gemfile
cp -f ${./rubyEnv/Gemfile.lock} ./Gemfile.lock
'';
};
rubyEnv = bundlerEnv rec {
name = "sure-ruby-env-${version}";
ruby = ruby_3_4;
inherit version;
gemdir = src;
gemset = ./rubyEnv/gemset.nix;
};
in
stdenv.mkDerivation rec {
pname = "sure";
inherit src version;
strictDeps = true;
__structuredAttrs = true;
env = {
RAILS_ENV = "production";
TAILWINDCSS_INSTALL_DIR = "${tailwindcss_4}/bin";
};
nativeBuildInputs = [
rubyEnv
rubyEnv.wrappedRuby
];
buildInputs = [
rubyEnv.wrappedRuby
];
buildPhase = ''
runHook preBuild
patchShebangs bin/
bundle exec bootsnap precompile --gemfile -j 0
bundle exec bootsnap precompile -j 0 app/ lib/
SECRET_KEY_BASE_DUMMY=1 bundle exec rake assets:precompile
runHook postBuild
'';
installPhase = ''
runHook preInstall
mkdir -p $out
cp -r {public,bin,app,config,db,lib,vendor} $out/
cp -r {Rakefile,config.ru,.sure-version} $out/
ln -s /run/sure/tmp $out/tmp
ln -s /run/sure/log $out/log
ln -s /run/sure/storage $out/storage
runHook postInstall
'';
passthru = {
updateScript = ./update.sh;
};
meta = {
changelog = "https://github.com/we-promise/sure/releases/tag/v${version}";
description = "Personal finance app for everyone";
homepage = "https://sure.am/";
license = lib.licenses.agpl3Only;
maintainers = with lib.maintainers; [
_74k1
pjrm
];
platforms = lib.platforms.linux;
};
}
|
