From 337380ea1de122c74d4dfaf7709a34f2448896f5 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Sat, 16 Sep 2017 21:53:16 +0200
Subject: [PATCH] gitRepo: Fix an error due to missing TLS certificates

This was a problem when run inside a sandbox, e.g. via
"fetchRepoProject". The error message from repo seems unrelated:

fatal: Cannot get https://gerrit.googlesource.com/git-repo/clone.bundle
fatal: error no host given

But the exception is actually thrown due to missing certificates
(/etc/ssl/certs). It should be possible to provide another location via
environment variables (e.g. SSL_CERT_FILE, REQUESTS_CA_BUNDLE or
CURL_CA_BUNDLE) but apparently that doesn't actually work for some
reason (would have to study our Python packaging).

Now "fetchRepoProject" works without the "--no-clone-bundle" option.
---
 .../version-management/git-repo/default.nix      | 16 ++++++++++++----
 pkgs/build-support/fetchrepoproject/default.nix  |  2 --
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/version-management/git-repo/default.nix b/pkgs/applications/version-management/git-repo/default.nix
index 808e7b1850d..e0aed206b75 100644
--- a/pkgs/applications/version-management/git-repo/default.nix
+++ b/pkgs/applications/version-management/git-repo/default.nix
@@ -1,5 +1,6 @@
 { stdenv, fetchFromGitHub, makeWrapper
-, python, git, gnupg1compat, less }:
+, python, git, gnupg, less, cacert
+}:
 
 stdenv.mkDerivation rec {
   name = "git-repo-${version}";
@@ -13,16 +14,23 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ python git gnupg1compat less ];
+  buildInputs = [ python ];
+
+  # TODO: Cleanup
+  patchPhase = ''
+    CA_PATH="$(echo '${cacert}/etc/ssl/certs/ca-bundle.crt' | sed 's/\//\\\//g')" # / -> \/
+    sed -i -E 's/urlopen\(url\)/urlopen(url, cafile="'$CA_PATH'")/' repo
+  '';
 
   installPhase = ''
     mkdir -p $out/bin
-    cp $src/repo $out/bin/repo
+    cp repo $out/bin/repo
   '';
 
+  # Important runtime dependencies
   postFixup = ''
     wrapProgram $out/bin/repo --prefix PATH ":" \
-      "${stdenv.lib.makeBinPath [ git gnupg1compat less ]}"
+      "${stdenv.lib.makeBinPath [ git gnupg less ]}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/build-support/fetchrepoproject/default.nix b/pkgs/build-support/fetchrepoproject/default.nix
index b16552be310..2e5fbe79435 100644
--- a/pkgs/build-support/fetchrepoproject/default.nix
+++ b/pkgs/build-support/fetchrepoproject/default.nix
@@ -21,8 +21,6 @@ let
     "--manifest-url=${manifest}"
     "--manifest-branch=${rev}"
     "--depth=1"
-    #TODO: fetching clone.bundle seems to fail spectacularly inside a sandbox.
-    "--no-clone-bundle"
     (optionalString createMirror "--mirror")
     (optionalString useArchive "--archive")
   ] ++ extraRepoInitFlags;