Use mach-nix instead of poetry2nix.

Signed-off-by: Rolf Schröder <rolf.schr@gmail.com>

Author: rolfschr

README.rst

@@ -149,29 +149,20 @@ There are several options to use the Nix version
     # Enter an interactive environment with all dependencies setup.
     cd etc/nix
     nix develop
-    > ./manage.py ... # invoke the local checkout
+    > ../../manage.py ... # invoke the local checkout
     > vulnerablecode-manage.py ... # invoke manage.py as installed in the nix store
 
     # Test the import prodecure using the Nix version.
-    ./test-import-using-nix.sh --all # import everything
+    etc/nix/test-import-using-nix.sh --all # import everything
     # Test the import using the local checkout.
-    INSTALL_DIR=. ./test-import-using-nix.sh ruby # import ruby only
+    INSTALL_DIR=. etc/nix/test-import-using-nix.sh ruby # import ruby only
 
 
 **Keeping the Nix setup in sync**
 
-The Nix installation uses `poetry2nix <https://github.com/nix-community/poetry2nix>`__ to handle Python dependencies because some dependencies are currently not available as Nix packages.
-The are some ``*.generated`` files in ``etc/nix`` that are created/updated using ``etc/nix/generate-poetry-files.sh``.
-These files need to be recreated whenever ``./requirements.txt`` changes.
-The ``expectedRequirementstxtMd5sum`` in ``etc/nix/flake.nix`` also needs to be updated in that case.
-The Nix installation uses the files to convert VulnerableCode into a `Poetry <https://python-poetry.org/>`__ project on the fly.
-
-::
-
-    # Update poetry-conversion.patch.
-    etc/nix/generate-poetry-files.sh
-    # Get new hash. See flake.nix.
-    md5sum requirements.txt
+The Nix installation uses `mach-nix <https://github.com/DavHau/mach-nix>`__ to handle Python dependencies because some dependencies are currently not available as Nix packages.
+All Python dependencies are automatically fetched from ``./requirements.txt``.
+Non-Python dependencies are curated in ``etc/nix/flake.nix:Vulnerablecode.propagatedBuildInputs``.
 
 
 Tests

etc/nix/default.nix

@@ -0,0 +1,4 @@
+(import (fetchTarball
+  "https://github.com/edolstra/flake-compat/archive/master.tar.gz") {
+    src = ./.;
+  }).defaultNix

etc/nix/flake.lock

@@ -2,15 +2,21 @@
   description =
     "Vulnerablecode - A free and open vulnerabilities database and the packages they impact.";
 
-  # Nixpkgs / NixOS version to use.
   inputs.nixpkgs = {
     type = "github";
     owner = "NixOS";
     repo = "nixpkgs";
     ref = "20.09";
   };
 
-  outputs = { self, nixpkgs }:
+  inputs.machnix = {
+    type = "github";
+    owner = "DavHau";
+    repo = "mach-nix";
+    ref = "3.1.1";
+  };
+
+  outputs = { self, nixpkgs, machnix }:
     let
 
       vulnerablecode-src = ./../..;
@@ -19,8 +25,7 @@
       version = builtins.head (builtins.match ''.*version=["']?([^"',]+).*''
         (builtins.readFile (vulnerablecode-src + "/setup.py")));
 
-      # From commit 7f8ae6399b02b1d508689b303f117e2f03f7854a
-      expectedRequirementstxtMd5sum = "7ea5fec4096b9c532450d68fad721017";
+      libSh = ./lib.sh;
 
       # System types to support.
       supportedSystems = [ "x86_64-linux" ];
@@ -36,72 +41,55 @@
           overlays = [ self.overlay ];
         });
 
+      # mach-nix instantiated for supported system types.
+      machnixFor = forAllSystems (system:
+        import machnix {
+          pkgs = (nixpkgsFor.${system}).pkgs;
+          python = "python38";
+        });
+
     in {
 
       # A Nixpkgs overlay.
       overlay = final: prev:
         with final.pkgs; {
 
-          # Create a mock project.
-          mockPoetryProject =
-            runCommand "mockPoetryProject" { buildInputs = [ rename ]; } ''
-              EXPECTED=${expectedRequirementstxtMd5sum}
-              ACTUAL=$(md5sum ${vulnerablecode-src}/requirements.txt | cut -d ' ' -f 1)
-              if [[ $EXPECTED != $ACTUAL ]] ; then
-                echo ""
-                echo "The requirements.txt has changed!"
-                echo "1) Run make-poetry-conversion-patch.sh."
-                echo "2) Update expectedRequirementstxtMd5sum in flake.nix."
-                exit 1
-              fi
-
-              mkdir $out
-              cd $out
-              cp ${vulnerablecode-src}/etc/nix/{pyproject.toml,poetry.lock}.generated .
-              rename 's/.generated$//' *.generated
-            '';
+          pythonEnv = with machnixFor.${system};
+            mkPython {
+              requirements =
+                builtins.readFile (vulnerablecode-src + "/requirements.txt");
+            };
 
-          vulnerablecode = poetry2nix.mkPoetryApplication rec {
-            projectDir = mockPoetryProject; # where to find {pyproject.toml,poetry.lock}
+          vulnerablecode = stdenv.mkDerivation {
+            inherit version;
+            name = "vulnerablecode-${version}";
             src = vulnerablecode-src;
-            python = python38;
-            overrides = poetry2nix.overrides.withDefaults (self: super: {
-              pygit2 = super.pygit2.overridePythonAttrs
-                (old: { buildInputs = old.buildInputs ++ [ libgit2-glib ]; });
-            });
-
-            patchPhase = ''
-              # Make sure "our" pycodestyle binary is used.
-              sed -i 's/join(bin_dir, "pycodestyle")/"pycodestyle"/' vulnerabilities/tests/test_basics.py
-              '';
-
-            propagatedBuildInputs = [ postgresql ];
-
             dontConfigure = true; # do not use ./configure
-            dontBuild = true;
+            propagatedBuildInputs = [ pythonEnv postgresql ];
+
+            postPatch = ''
+              # Make sure the pycodestyle binary in $PATH is used.
+              substituteInPlace vulnerabilities/tests/test_basics.py \
+                --replace 'join(bin_dir, "pycodestyle")' '"pycodestyle"'
+            '';
 
             installPhase = ''
               cp -r . $out
             '';
-
-            meta = {
-              homepage = "https://github.com/nexB/vulnerablecode";
-              license = lib.licenses.asl20;
-            };
           };
+
         };
 
       # Provide a nix-shell env to work with vulnerablecode.
       devShell = forAllSystems (system:
         with nixpkgsFor.${system};
-        mkShell rec {
-          # will be available as env var in `nix develop`
+        mkShell {
+          # will be available as env var in `nix develop` / `nix-shell`.
           VULNERABLECODE_INSTALL_DIR = vulnerablecode;
           buildInputs = [ vulnerablecode ];
           shellHook = ''
-            alias vulnerablecode-manage.py=${VULNERABLECODE_INSTALL_DIR}/manage.py
-          '';
-
+            alias vulnerablecode-manage.py=${vulnerablecode}/manage.py
+              '';
         });
 
       # Provide some packages for selected system types.
@@ -114,12 +102,12 @@
 
       # Tests run by 'nix flake check' and by Hydra.
       checks = forAllSystems (system: {
-        inherit (self.packages.${system}) vulnerablecode;
+        inherit (self.packages.${system})
+        ;
 
-        # Additional tests, if applicable.
-        vulnerablecode-pytest = with nixpkgsFor.${system};
+        vulnerablecode-test = with nixpkgsFor.${system};
           stdenv.mkDerivation {
-            name = "vulnerablecode-test-${version}";
+            name = "${vulnerablecode.name}-test";
 
             buildInputs = [ wget vulnerablecode ];
 
@@ -129,33 +117,28 @@
 
             unpackPhase = "true";
 
-            # Setup postgres, run migrations, run pytset and test-run the webserver.
-            # See ${vulnerablecode}/README.md for the original instructions.
-            # Notes:
-            # - $RUNDIR is used to prevent postgres from accessings its default run dir at /run/postgresql.
-            #   See also https://github.com/NixOS/nixpkgs/issues/83770#issuecomment-607992517.
-            # - pytest can only be run with an running postgres database server.
             buildPhase = ''
-              DATADIR=$(pwd)/pgdata
-              RUNDIR=$(pwd)/run
-              ENCODING="UTF-8"
-              mkdir -p $RUNDIR
-              initdb -D $DATADIR -E $ENCODING
-              pg_ctl -D $DATADIR -o "-k $RUNDIR" -l $DATADIR/logfile start
-              createuser --host $RUNDIR --no-createrole --no-superuser --login --inherit --createdb vulnerablecode
-              createdb   --host $RUNDIR -E $ENCODING --owner=vulnerablecode --user=vulnerablecode --port=5432 vulnerablecode
-              (
-                export DJANGO_DEV=1
-                ${vulnerablecode}/manage.py migrate
-                (cd ${vulnerablecode} && pytest)
-                ${vulnerablecode}/manage.py runserver &
-                sleep 5
-                ${wget}/bin/wget http://127.0.0.1:8000/api/
-                kill %1 # kill webserver
-              )
+              source ${libSh}
+              initPostgres $(pwd)
+              export DJANGO_DEV=1
+              ${vulnerablecode}/manage.py migrate
+            '';
+
+            doCheck = true;
+            checkPhase = ''
+              # Run pytest on the installed version. A running postgres
+              # database server is needed.
+              (cd ${vulnerablecode} && pytest)
+
+              # Launch the webserver and call the API.
+              ${vulnerablecode}/manage.py runserver &
+              sleep 2
+              wget http://127.0.0.1:8000/api/
+              kill %1 # kill background task (i.e. webserver)
             '';
 
-            installPhase = "mkdir -p $out";
+            installPhase =
+              "mkdir -p $out"; # make this derivation return success
           };
       });
     };