commit 7030f11620d2fe75deec9fcfba2ac18d32a7f63d · pyrox.dev/nixpkgs

-51

pkgs/applications/virtualization/xen/README.md

···

       30
       30
        
       

     

       31
       31
        
       ## Updating

     

       32
       32
        
       

     

       33
       33
       -
       ### Automatically

     

       34
       34
       -
       

     

       35
       35
       -
       An automated update script is available in this directory. To produce up-to-date

     

       36
       36
       -
       files for all supported Xen branches, simply run `./update.sh`, and follow the

     

       37
       37
       -
       instructions given to you by the script. Notably, it will request that you verify

     

       38
       38
       -
       the Xen Project code signing PGP key. This README understands that the fingerprint

     

       39
       39
       -
       of that key is [`23E3 222C 145F 4475 FA80 60A7 83FE 14C9 57E8 2BD9`](https://keys.openpgp.org/search?q=pgp%40xen.org),

     

       40
       40
       -
       but you should verify this information by seeking the fingerprint from other trusted

     

       41
       41
       -
       sources, as this document may be compromised. Once the PGP key is verified, it will

     

       42
       42
       -
       use `git verify-tag` to ascertain the validity of the cloned Xen sources.

     

       43
       43
       -
       

     

       44
       44
       -
       After the script is done, follow the steps in

     

       45
       45
       -
       [**For Both Update Methods**](#for-both-update-methods) below.

     

       46
       46
       -
       

     

       47
       47
       -
       #### Downstream Patch Names

     

       48
       48
       -
       

     

       49
       49
       -
       The script expects local patch names to follow a certain specification.

     

       50
       50
       -
       Please name any required patches using the template below:

     

       51
       51
       -
       

     

       52
       52
       -
       ```console

     

       53
       53
       -
       0000-project-description-branch.patch

     

       54
       54
       -
       ```

     

       55
       55
       -
       

     

       56
       56
       -
       Where:

     

       57
       57
       -
       

     

       58
       58
       -
       1. The first four numbers define the patch order.

     

       59
       59
       -
          **0001** will be applied after **0000**, and so on.

     

       60
       60
       -
       1. `project` means the name of the source the patch should be applied to.

     

       61
       61
       -
          - If you are applying patches to the main Xen sources, use `xen`.

     

       62
       62
       -
          - For the pre-fetched QEMU, use `qemu`.

     

       63
       63
       -
          - For SeaBIOS, use `seabios`.

     

       64
       64
       -
          - For OVMF, use `ovmf`.

     

       65
       65
       -
          - For iPXE, use `ipxe`.

     

       66
       66
       -
       1. `description` is a string with uppercase and lowercase letters, numbers and

     

       67
       67
       -
          dashes. It describes the patch name and what it does to the upstream code.

     

       68
       68
       -
       1. `branch` is the branch for which this patch is supposed to patch.

     

       69
       69
       -
          It should match the name of the directory it is in.

     

       70
       70
       -
       

     

       71
       71
       -
       For example, a patch fixing `xentop`'s output in the 4.15 branch should have

     

       72
       72
       -
       the following name: `0000-xen-xentop-output-4.15.patch`, and it should be added

     

       73
       73
       -
       to the `4.15/` directory.

     

       74
       74
       -
       

     

       75
       33
        
       ### Manually

     

       76
       34
        
       

     

       77
       77
       -
       The script is not infallible, and it may break in the future. If that happens,

     

       78
       78
       -
       open a PR fixing the script, and update Xen manually:

     

       79
       79
       -
       

     

       80
       80
       -
       1. Check the support matrix to see which branches are security-supported.

     

       81
       35
        
       1. Create one directory per branch.

     

       82
       36
        
       1. [Update](https://xenbits.xenproject.org/gitweb/) the `default.nix` files for

     

       83
       37
        
          the branches that already exist and copy a new one to any branches that do

     
···

       86
       40
        
            each of the `default.nix` files.

     

       87
       41
        
          - The revisions are preferably commit hashes, but tag names are acceptable

     

       88
       42
        
            as well.

     

       89
       89
       -
       

     

       90
       90
       -
       ### For Both Update Methods

     

       91
       91
       -
       

     

       92
       92
       -
       1. Update `packages.nix` and `../../../top-level/all-packages.nix` with the new

     

       93
       93
       -
          versions. Don't forget the `slim` packages!

     

       94
       43
        
       1. Make sure all branches build. (Both the `standard` and `slim` versions)

     

       95
       44
        
       1. Use the NixOS module to test if dom0 boots successfully on all new versions.

     

       96
       45
        
       1. Make sure the `meta` attributes evaluate to something that makes sense. The

-202

pkgs/applications/virtualization/xen/update.sh

···

       1
       1
       -
       #!/usr/bin/env nix-shell

     

       2
       2
       -
       #!nix-shell -i bash -p gitMinimal curl gnupg nix-prefetch-git nixfmt-rfc-style

     

       3
       3
       -
       # shellcheck disable=SC2206,SC2207 shell=bash

     

       4
       4
       -
       set -o errexit

     

       5
       5
       -
       set -o pipefail

     

       6
       6
       -
       set -o nounset

     

       7
       7
       -
       

     

       8
       8
       -
       #TODO: Use `jq` instead of `sed`.

     

       9
       9
       -
       #TODO: Accept the small security drawback and make this script runnable by r-ryantm.

     

       10
       10
       -
       

     

       11
       11
       -
       # This script expects to be called in an interactive terminal somewhere inside Nixpkgs.

     

       12
       12
       -
       echo "Preparing..."

     

       13
       13
       -
       nixpkgs=$(git rev-parse --show-toplevel)

     

       14
       14
       -
       xenPath="$nixpkgs/pkgs/applications/virtualization/xen"

     

       15
       15
       -
       rm -rf /tmp/xenUpdateScript

     

       16
       16
       -
       mkdir /tmp/xenUpdateScript

     

       17
       17
       -
       

     

       18
       18
       -
       # Import and verify PGP key.

     

       19
       19
       -
       curl --silent --output /tmp/xenUpdateScript/xen.asc https://keys.openpgp.org/vks/v1/by-fingerprint/23E3222C145F4475FA8060A783FE14C957E82BD9

     

       20
       20
       -
       gpg --homedir /tmp/xenUpdateScript/.gnupg --quiet --import /tmp/xenUpdateScript/xen.asc

     

       21
       21
       -
       fingerprint="$(gpg --homedir /tmp/xenUpdateScript/.gnupg --with-colons --fingerprint "pgp@xen.org" 2>/dev/null | awk -F: '/^pub:.*/ { getline; print $10}')"

     

       22
       22
       -
       echo -e "Please ascertain through multiple external sources that the \e[1;32mXen Project PGP Key Fingerprint\e[0m is indeed \e[1;33m$fingerprint\e[0m. If that is not the case, \e[1;31mexit immediately\e[0m."

     

       23
       23
       -
       read -r -p $'Press \e[1;34menter\e[0m to continue with a pre-filled expected fingerprint, or input an arbitrary PGP fingerprint to match with the key\'s fingerprint: ' userInputFingerprint

     

       24
       24
       -
       userInputFingerprint=${userInputFingerprint:-"23E3222C145F4475FA8060A783FE14C957E82BD9"}

     

       25
       25
       -
       

     

       26
       26
       -
       # Clone xen.git.

     

       27
       27
       -
       echo -e "Cloning \e[1;34mxen.git\e[0m..."

     

       28
       28
       -
       git clone --quiet https://xenbits.xenproject.org/git-http/xen.git /tmp/xenUpdateScript/xen

     

       29
       29
       -
       cd /tmp/xenUpdateScript/xen

     

       30
       30
       -
       

     

       31
       31
       -
       # Get list of versions and branches.

     

       32
       32
       -
       versionList="$(git tag --list "RELEASE-*" | sed s/RELEASE-//g | sed s/4.1.6.1//g | sort --numeric-sort)"

     

       33
       33
       -
       latestVersion=$(echo "$versionList" | tr ' ' '\n' | tail --lines=1)

     

       34
       34
       -
       branchList=($(echo "$versionList" | tr ' ' '\n' | sed s/\.[0-9]*$//g | awk '!seen[$0]++'))

     

       35
       35
       -
       

     

       36
       36
       -
       # Figure out which versions we're actually going to install.

     

       37
       37
       -
       minSupportedBranch="$(grep "  minSupportedVersion = " "$xenPath"/generic/default.nix | sed s/'  minSupportedVersion = "'//g | sed s/'";'//g)"

     

       38
       38
       -
       supportedBranches=($(for version in "${branchList[@]}"; do if [ "$(printf '%s\n' "$minSupportedBranch" "$version" | sort -V | head -n1)" = "$minSupportedBranch" ]; then echo "$version"; fi; done))

     

       39
       39
       -
       supportedVersions=($(for version in "${supportedBranches[@]}"; do echo "$versionList" | tr ' ' '\n' | grep "$version" | tail --lines=1; done))

     

       40
       40
       -
       

     

       41
       41
       -
       echo -e "\e[1mNOTE\e[0m: As we're also pre-fetching the submodules, QEMU and OVMF may take a very long time to fetch."

     

       42
       42
       -
       

     

       43
       43
       -
       # Main loop that installs every supportedVersion.

     

       44
       44
       -
       for version in "${supportedVersions[@]}"; do

     

       45
       45
       -
           echo -e "\n------------------------------------------------"

     

       46
       46
       -
           branch=${version/%.[0-9]/}

     

       47
       47
       -
           if [[ "$version" == "$latestVersion" ]]; then

     

       48
       48
       -
               latest=true

     

       49
       49
       -
               echo -e "\nFound \e[1;34mlatest\e[0m release: \e[1;32mXen $version\e[0m in branch \e[1;36m$branch\e[0m."

     

       50
       50
       -
           else

     

       51
       51
       -
               latest=false

     

       52
       52
       -
               echo -e "\nFound \e[1;33msecurity-supported\e[0m release: \e[1;32mXen $version\e[0m in branch \e[1;36m$branch\e[0m."

     

       53
       53
       -
           fi

     

       54
       54
       -
       

     

       55
       55
       -
           # Verify PGP key automatically. If the fingerprint matches what the user specified, or the default fingerprint, then we consider it trusted.

     

       56
       56
       -
           cd /tmp/xenUpdateScript/xen

     

       57
       57
       -
           if [[ "$fingerprint" = "$userInputFingerprint" ]]; then

     

       58
       58
       -
               echo "$fingerprint:6:" | gpg --homedir /tmp/xenUpdateScript/.gnupg --quiet --import-ownertrust

     

       59
       59
       -
               (git verify-tag RELEASE-"$version" 2>/dev/null && echo -e "\n\e[1;32mSuccessfully authenticated Xen $version.\e[0m") || (echo -e "\e[1;31merror:\e[0m Unable to verify tag \e[1;32mRELEASE-$version\e[0m.\n- It is possible that \e[1;33mthis script has broken\e[0m, the Xen Project has \e[1;33mcycled their PGP keys\e[0m, or a \e[1;31msupply chain attack is in progress\e[0m.\n\n\e[1;31mPlease update manually.\e[0m" && exit 1)

     

       60
       60
       -
           else

     

       61
       61
       -
               echo -e "\e[1;31merror:\e[0m Unable to verify \e[1;34mpgp@xen.org\e[0m's fingerprint.\n- It is possible that \e[1;33mthis script has broken\e[0m, the Xen Project has \e[1;33mcycled their PGP keys\e[0m, or an \e[1;31mimpersonation attack is in progress\e[0m.\n\n\e[1;31mPlease update manually.\e[0m" && exit 1

     

       62
       62
       -
           fi

     

       63
       63
       -
       

     

       64
       64
       -
           git switch --quiet --detach RELEASE-"$version"

     

       65
       65
       -
       

     

       66
       66
       -
           # Originally we told people to go check the Makefile themselves.

     

       67
       67
       -
           echo -e -n "\nDetermining source versions from Xen Makefiles..."

     

       68
       68
       -
           qemuVersion="$(grep "QEMU_UPSTREAM_REVISION ?=" /tmp/xenUpdateScript/xen/Config.mk | sed s/"QEMU_UPSTREAM_REVISION ?= "//g)"

     

       69
       69
       -
           seaBIOSVersion="$(grep "SEABIOS_UPSTREAM_REVISION ?= rel-" /tmp/xenUpdateScript/xen/Config.mk | sed s/"SEABIOS_UPSTREAM_REVISION ?= "//g)"

     

       70
       70
       -
           ovmfVersion="$(grep "OVMF_UPSTREAM_REVISION ?=" /tmp/xenUpdateScript/xen/Config.mk | sed s/"OVMF_UPSTREAM_REVISION ?= "//g)"

     

       71
       71
       -
           miniOSVersion="$(grep "MINIOS_UPSTREAM_REVISION ?=" /tmp/xenUpdateScript/xen/Config.mk | sed s/"MINIOS_UPSTREAM_REVISION ?= "//g)"

     

       72
       72
       -
           ipxeVersion="$(grep "IPXE_GIT_TAG :=" /tmp/xenUpdateScript/xen/tools/firmware/etherboot/Makefile | sed s/"IPXE_GIT_TAG := "//g)"

     

       73
       73
       -
           echo "done!"

     

       74
       74
       -
       

     

       75
       75
       -
           # Use `nix-prefetch-git` to fetch `rev`s and `hash`es.

     

       76
       76
       -
           echo "Pre-fetching sources and determining hashes..."

     

       77
       77
       -
           echo -e -n "  \e[1;32mXen\e[0m..."

     

       78
       78
       -
           fetchXen=$(nix-prefetch-git --url https://xenbits.xenproject.org/git-http/xen.git --rev RELEASE-"$version" --quiet)

     

       79
       79
       -
           finalVersion="$(echo "$fetchXen" | tr ', ' '\n ' | grep -ie rev | sed s/'  "rev": "'//g | sed s/'"'//g)"

     

       80
       80
       -
           hash="$(echo "$fetchXen" | tr ', ' '\n ' | grep -ie hash | sed s/'  "hash": "'//g | sed s/'"'//g)"

     

       81
       81
       -
           echo "done!"

     

       82
       82
       -
           echo -e -n "  \e[1;36mQEMU\e[0m..."

     

       83
       83
       -
           fetchQEMU=$(nix-prefetch-git --url https://xenbits.xenproject.org/git-http/qemu-xen.git --rev "$qemuVersion" --quiet --fetch-submodules)

     

       84
       84
       -
           finalQEMUVersion="$(echo "$fetchQEMU" | tr ', ' '\n ' | grep -ie rev | sed s/'  "rev": "'//g | sed s/'"'//g)"

     

       85
       85
       -
           qemuHash="$(echo "$fetchQEMU" | tr ', ' '\n ' | grep -ie hash | sed s/'  "hash": "'//g | sed s/'"'//g)"

     

       86
       86
       -
           echo "done!"

     

       87
       87
       -
           echo -e -n "  \e[1;36mSeaBIOS\e[0m..."

     

       88
       88
       -
           fetchSeaBIOS=$(nix-prefetch-git --url https://xenbits.xenproject.org/git-http/seabios.git --rev "$seaBIOSVersion" --quiet)

     

       89
       89
       -
           finalSeaBIOSVersion="$(echo "$fetchSeaBIOS" | tr ', ' '\n ' | grep -ie rev | sed s/'  "rev": "'//g | sed s/'"'//g)"

     

       90
       90
       -
           seaBIOSHash="$(echo "$fetchSeaBIOS" | tr ', ' '\n ' | grep -ie hash | sed s/'  "hash": "'//g | sed s/'"'//g)"

     

       91
       91
       -
           echo "done!"

     

       92
       92
       -
           echo -e -n "  \e[1;36mOVMF\e[0m..."

     

       93
       93
       -
           ovmfHash="$(nix-prefetch-git --url https://xenbits.xenproject.org/git-http/ovmf.git --rev "$ovmfVersion" --quiet --fetch-submodules | grep -ie hash | sed s/'  "hash": "'//g | sed s/'",'//g)"

     

       94
       94
       -
           echo "done!"

     

       95
       95
       -
           echo -e -n "  \e[1;36miPXE\e[0m..."

     

       96
       96
       -
           ipxeHash="$(nix-prefetch-git --url https://github.com/ipxe/ipxe.git --rev "$ipxeVersion" --quiet | grep -ie hash | sed s/'  "hash": "'//g | sed s/'",'//g)"

     

       97
       97
       -
           echo "done!"

     

       98
       98
       -
       

     

       99
       99
       -
           cd "$xenPath"

     

       100
       100
       -
       

     

       101
       101
       -
           echo -e "\nFound the following revisions:\n  \e[1;32mXen\e[0m:     \e[1;33m$finalVersion\e[0m (\e[1;33m$hash\e[0m)\n  \e[1;36mQEMU\e[0m:    \e[1;33m$finalQEMUVersion\e[0m (\e[1;33m$qemuHash\e[0m)\n  \e[1;36mSeaBIOS\e[0m: \e[1;33m$finalSeaBIOSVersion\e[0m (\e[1;33m$seaBIOSHash\e[0m)\n  \e[1;36mOVMF\e[0m:    \e[1;33m$ovmfVersion\e[0m (\e[1;33m$ovmfHash\e[0m)\n  \e[1;36miPXE\e[0m:    \e[1;33m$ipxeVersion\e[0m (\e[1;33m$ipxeHash\e[0m)"

     

       102
       102
       -
       

     

       103
       103
       -
           # Set OCaml Version

     

       104
       104
       -
           read -r -p $'\nEnter the corresponding \e[1;33mOCaml\e[0m version for \e[1;32mXen '"$version"$'\e[0m, or press \e[1;34menter\e[0m for the default value of \e[1;32m4_14\e[0m: ' ocamlVersion

     

       105
       105
       -
           ocamlVersion=${ocamlVersion:-"4_14"}

     

       106
       106
       -
       

     

       107
       107
       -
           mkdir -p "$branch"/

     

       108
       108
       -
           rm -f "$branch"/default.nix

     

       109
       109
       -
       

     

       110
       110
       -
           # Prepare any .patch files that are called by Nix through a path value.

     

       111
       111
       -
           echo -e "\nPlease add any required patches to version \e[1;32m$branch\e[0m in \e[1;34m$branch/\e[0m, and press \e[1;34menter\e[0m when done."

     

       112
       112
       -
           read -r -p $'Remember to follow the naming specification as defined in \e[1;34m./README.md\e[0m.'

     

       113
       113
       -
       

     

       114
       114
       -
           echo -e "\nDiscovering patches..."

     

       115
       115
       -
           discoveredXenPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-xen-*-$branch.patch" -printf "./%f ")"

     

       116
       116
       -
           discoveredQEMUPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-qemu-*-$branch.patch" -printf "./%f ")"

     

       117
       117
       -
           discoveredSeaBIOSPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-seabios-*-$branch.patch" -printf "./%f ")"

     

       118
       118
       -
           discoveredOVMFPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-ovmf-*-$branch.patch" -printf "./%f ")"

     

       119
       119
       -
           discoveredIPXEPatches="$(find "$branch"/ -type f -name "[0-9][0-9][0-9][0-9]-ipxe-*-$branch.patch" -printf "./%f ")"

     

       120
       120
       -
       

     

       121
       121
       -
           discoveredXenPatchesEcho=${discoveredXenPatches:-"\e[1;31mNone found!\e[0m"}

     

       122
       122
       -
           discoveredQEMUPatchesEcho=${discoveredQEMUPatches:-"\e[1;31mNone found!\e[0m"}

     

       123
       123
       -
           discoveredSeaBIOSPatchesEcho=${discoveredSeaBIOSPatches:-"\e[1;31mNone found!\e[0m"}

     

       124
       124
       -
           discoveredOVMFPatchesEcho=${discoveredOVMFPatches:-"\e[1;31mNone found!\e[0m"}

     

       125
       125
       -
           discoveredIPXEPatchesEcho=${discoveredIPXEPatches:-"\e[1;31mNone found!\e[0m"}

     

       126
       126
       -
       

     

       127
       127
       -
           echo -e "Found the following patches:\n  \e[1;32mXen\e[0m:     \e[1;33m$discoveredXenPatchesEcho\e[0m\n  \e[1;36mQEMU\e[0m:    \e[1;33m$discoveredQEMUPatchesEcho\e[0m\n  \e[1;36mSeaBIOS\e[0m: \e[1;33m$discoveredSeaBIOSPatchesEcho\e[0m\n  \e[1;36mOVMF\e[0m:    \e[1;33m$discoveredOVMFPatchesEcho\e[0m\n  \e[1;36miPXE\e[0m:    \e[1;33m$discoveredIPXEPatchesEcho\e[0m"

     

       128
       128
       -
       

     

       129
       129
       -
           # Prepare patches that are called in ./patches.nix.

     

       130
       130
       -
           defaultPatchListInit=("QUBES_REPRODUCIBLE_BUILDS" "XSA_460" "XSA_461" )

     

       131
       131
       -
           read -r -a defaultPatchList -p $'\nWould you like to override the \e[1;34mupstreamPatches\e[0m list for \e[1;32mXen '"$version"$'\e[0m? If no, press \e[1;34menter\e[0m to use the default patch list: [ \e[1;34m'"${defaultPatchListInit[*]}"$' \e[0m]: '

     

       132
       132
       -
           defaultPatchList=(${defaultPatchList[@]:-${defaultPatchListInit[@]}})

     

       133
       133
       -
           upstreamPatches=${defaultPatchList[*]}

     

       134
       134
       -
       

     

       135
       135
       -
           # Write and format default.nix file.

     

       136
       136
       -
           echo -e -n "\nWriting updated \e[1;34mversionDefinition\e[0m..."

     

       137
       137
       -
           cat >"$branch"/default.nix <<EOF

     

       138
       138
       -
       {

     

       139
       139
       -
         lib,

     

       140
       140
       -
         fetchpatch,

     

       141
       141
       -
         callPackage,

     

       142
       142
       -
         ocaml-ng,

     

       143
       143
       -
         ...

     

       144
       144
       -
       }@genericDefinition:

     

       145
       145
       -
       

     

       146
       146
       -
       let

     

       147
       147
       -
         upstreamPatches = import ../generic/patches.nix {

     

       148
       148
       -
           inherit lib;

     

       149
       149
       -
           inherit fetchpatch;

     

       150
       150
       -
         };

     

       151
       151
       -
       

     

       152
       152
       -
         upstreamPatchList = lib.lists.flatten (with upstreamPatches; [

     

       153
       153
       -
           $upstreamPatches

     

       154
       154
       -
         ]);

     

       155
       155
       -
       in

     

       156
       156
       -
       

     

       157
       157
       -
       callPackage (import ../generic/default.nix {

     

       158
       158
       -
         pname = "xen";

     

       159
       159
       -
         branch = "$branch";

     

       160
       160
       -
         version = "$version";

     

       161
       161
       -
         latest = $latest;

     

       162
       162
       -
         pkg = {

     

       163
       163
       -
           xen = {

     

       164
       164
       -
             rev = "$finalVersion";

     

       165
       165
       -
             hash = "$hash";

     

       166
       166
       -
             patches = [ $discoveredXenPatches ] ++ upstreamPatchList;

     

       167
       167
       -
           };

     

       168
       168
       -
           qemu = {

     

       169
       169
       -
             rev = "$finalQEMUVersion";

     

       170
       170
       -
             hash = "$qemuHash";

     

       171
       171
       -
             patches = [ $discoveredQEMUPatches ];

     

       172
       172
       -
           };

     

       173
       173
       -
           seaBIOS = {

     

       174
       174
       -
             rev = "$finalSeaBIOSVersion";

     

       175
       175
       -
             hash = "$seaBIOSHash";

     

       176
       176
       -
             patches = [ $discoveredSeaBIOSPatches ];

     

       177
       177
       -
           };

     

       178
       178
       -
           ovmf = {

     

       179
       179
       -
             rev = "$ovmfVersion";

     

       180
       180
       -
             hash = "$ovmfHash";

     

       181
       181
       -
             patches = [ $discoveredOVMFPatches ];

     

       182
       182
       -
           };

     

       183
       183
       -
           ipxe = {

     

       184
       184
       -
             rev = "$ipxeVersion";

     

       185
       185
       -
             hash = "$ipxeHash";

     

       186
       186
       -
             patches = [ $discoveredIPXEPatches ];

     

       187
       187
       -
           };

     

       188
       188
       -
         };

     

       189
       189
       -
       }) ({ ocamlPackages = ocaml-ng.ocamlPackages_$ocamlVersion; } // genericDefinition)

     

       190
       190
       -
       EOF

     

       191
       191
       -
       echo done!

     

       192
       192
       -
       

     

       193
       193
       -
           echo -n "Formatting..."

     

       194
       194
       -
           nixfmt "$branch"/default.nix

     

       195
       195
       -
           echo done!

     

       196
       196
       -
       

     

       197
       197
       -
           echo -e "\n\e[1;32mSuccessfully produced $branch/default.nix.\e[0m"

     

       198
       198
       -
       done

     

       199
       199
       -
       

     

       200
       200
       -
       echo -e -n "\nCleaning up..."

     

       201
       201
       -
       rm -rf /tmp/xenUpdateScript

     

       202
       202
       -
       echo done!