1 files changed, 33 insertions, 40 deletions
diff --git a/pkgs/build-support/fetchrepoproject/default.nix b/pkgs/build-support/fetchrepoproject/default.nix
index 8c55db5372d..2e5fbe79435 100644
--- a/pkgs/build-support/fetchrepoproject/default.nix
+++ b/pkgs/build-support/fetchrepoproject/default.nix
@@ -1,6 +1,7 @@
-{ stdenv, git, gitRepo, gnupg ? null, cacert, copyPathsToStore }:
+{ stdenv, gitRepo, cacert, copyPathsToStore }:
 
-{ name, manifest, rev ? "HEAD", sha256, repoRepoURL ? "", repoRepoRev ? "", referenceDir ? ""
+{ name, manifest, rev ? "HEAD", sha256
+, repoRepoURL ? "", repoRepoRev ? "", referenceDir ? ""
 , localManifests ? [], createMirror ? false, useArchive ? !createMirror
 }:
 
@@ -10,64 +11,56 @@ assert createMirror -> !useArchive;
 with stdenv.lib;
 
 let
+  extraRepoInitFlags = [
+    (optionalString (repoRepoURL != "") "--repo-url=${repoRepoURL}")
+    (optionalString (repoRepoRev != "") "--repo-branch=${repoRepoRev}")
+    (optionalString (referenceDir != "") "--reference=${referenceDir}")
+  ];
+
   repoInitFlags = [
     "--manifest-url=${manifest}"
     "--manifest-branch=${rev}"
     "--depth=1"
-    #TODO: fetching clone.bundle seems to fail spectacularly inside a sandbox.
-    "--no-clone-bundle"
     (optionalString createMirror "--mirror")
     (optionalString useArchive "--archive")
-    (optionalString (repoRepoURL != "") "--repo-url=${repoRepoURL}")
-    (optionalString (repoRepoRev != "") "--repo-branch=${repoRepoRev}")
-    (optionalString (referenceDir != "") "--reference=${referenceDir}")
-  ];
+  ] ++ extraRepoInitFlags;
 
   local_manifests = copyPathsToStore localManifests;
 
-in
+in stdenv.mkDerivation {
+  inherit name;
 
-with stdenv.lib;
+  inherit cacert manifest rev repoRepoURL repoRepoRev referenceDir; # TODO
 
-let
-  extraRepoInitFlags = [
-    (optionalString (repoRepoURL != "") "--repo-url=${repoRepoURL}")
-    (optionalString (repoRepoRev != "") "--repo-branch=${repoRepoRev}")
-    (optionalString (referenceDir != "") "--reference=${referenceDir}")
+  outputHashAlgo = "sha256";
+  outputHashMode = "recursive";
+  outputHash = sha256;
+
+  preferLocalBuild = true;
+  enableParallelBuilding = true;
+
+  impureEnvVars = fetchers.proxyImpureEnvVars ++ [
+    "GIT_PROXY_COMMAND" "SOCKS_SERVER"
   ];
-in
 
-stdenv.mkDerivation {
+  buildInputs = [ gitRepo cacert ];
+
+  GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+
   buildCommand = ''
+    # Path must be absolute (e.g. for GnuPG: ~/.repoconfig/gnupg/pubring.kbx)
+    export HOME="$(pwd)"
+
     mkdir .repo
     ${optionalString (local_manifests != []) ''
-    mkdir ./.repo/local_manifests
-    for local_manifest in ${concatMapStringsSep " " toString local_manifests}
-
-    do
-      cp $local_manifest ./.repo/local_manifests/$(stripHash $local_manifest; echo $strippedName)
-    done
+      mkdir .repo/local_manifests
+      for local_manifest in ${concatMapStringsSep " " toString local_manifests}; do
+        cp $local_manifest .repo/local_manifests/$(stripHash $local_manifest; echo $strippedName)
+      done
     ''}
 
-    export HOME=.repo
     repo init ${concatStringsSep " " repoInitFlags}
-
     repo sync --jobs=$NIX_BUILD_CORES --current-branch
     ${optionalString (!createMirror) "rm -rf $out/.repo"}
   '';
-
-  GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-
-  impureEnvVars = stdenv.lib.fetchers.proxyImpureEnvVars ++ [
-    "GIT_PROXY_COMMAND" "SOCKS_SERVER"
-  ];
-
-  buildInputs = [git gitRepo cacert] ++ optional (gnupg != null) [gnupg] ;
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = sha256;
-
-  preferLocalBuild = true;
-  enableParallelBuilding = true;
-  inherit name cacert manifest rev repoRepoURL repoRepoRev referenceDir;
 }