fix(siri): add venv to the siril installation

Reviewed-on: #76

flake.lock

@@ -8,11 +8,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1788450739,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-glZLQlzIn1fXH6PazR2iUmTo7kzzyYSshrWhLS9TqCU=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "31729ca8cbdb4fa927b34e5f4353e6a83f39e993",
         "type": "github"
       },
       "original": {
@@ -28,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785958398,
+        "lastModified": 1789430117,
-        "narHash": "sha256-5r/JgsoNMTx+qIh83WkxpujEKBR7PF5ssnh5vYCuSAw=",
+        "narHash": "sha256-t+U1mijItLJ64xZOifpfQ17kpAL73nU7pDI48ScacVc=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a7c70cc290290f373f50cd820403833d250459ac",
+        "rev": "cda90fd8838825c689fde9d3f3b4e937937790df",
         "type": "github"
       },
       "original": {
@@ -43,11 +43,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1785967620,
+        "lastModified": 1789286504,
-        "narHash": "sha256-IItrdb7Puk05RqOBWZYFC5X6Wl1sJmCfh5MWVHw5iMM=",
+        "narHash": "sha256-eiEK7cKZORNEvX0GeF3RtNEF/JXhgf2RqSp3230q13E=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b7c2ada94fe99c15b0dbcf4d11fd7850b957a436",
+        "rev": "ef34387ddd751e1ab8857adf4676492d32eb24ec",
         "type": "github"
       },
       "original": {
@@ -66,11 +66,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1785763201,
+        "lastModified": 1789344271,
-        "narHash": "sha256-wA373y/B9orM3HatLu9oS+Ke5lmdZyBl/bdjd2gLMq4=",
+        "narHash": "sha256-ezmg5oQSZWYdmomx6K1J+/6w7dRc7bquDMggc8eAE28=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "c7be49306b23a952c0151cf4bbeacd944ed82f2a",
+        "rev": "afcfb8c1dc075881bbaa6fa5745aebbdb179f8b8",
         "type": "github"
       },
       "original": {
@@ -86,11 +86,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786013897,
+        "lastModified": 1789436433,
-        "narHash": "sha256-u14Iaus6ROW6IWQUNGZ/IZJ3TcIUs1ngxn5sUMNnwMM=",
+        "narHash": "sha256-/Dy5P/7nCIss+uAhdF+8I59ww5WQUF4EBs1QJCB1aec=",
         "owner": "noctalia-dev",
         "repo": "noctalia-shell",
-        "rev": "0247e4c5e5268f8c2a5658b60b97cb5f2eca7766",
+        "rev": "e4eb0ff97743c1d07d0f5a0d5770b277b6485b03",
         "type": "github"
       },
       "original": {
@@ -108,6 +108,7 @@
       }
     },
     "systems": {
+      "flake": false,
       "locked": {
         "lastModified": 1774449309,
         "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",

modules/home-manager/git.nix

@@ -1,17 +1,38 @@
-{ config, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, ... }:
 
+let
+  email = "aaron@0x29a.ch";
+
+  # public half of every machine's ~/.ssh/id_ed25519, each one verified as a
+  # signing key in gitea. the key a host signs with is picked up from the key
+  # file itself, this list only tells the local git which machines to trust
+  signingKeys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDkhvvTUcBSQdtXjX+Mw2Bp8HHhtiBm8aJi4ZxiBgZR aaron@neon"
+  ];
+in
 {
+  # gitea verifies signatures against the account keys, this teaches the local
+  # git the same trust so `git log --show-signature` resolves as well
+  xdg.configFile."git/allowed_signers".text =
+    lib.concatMapStrings (key: "${email} ${key}\n") signingKeys;
+
   programs.git = {
     enable = true;
     settings = {
       push = { autoSetupRemote = true; };
       user = {
         name  = "aaron";
-        email = "aaron@0x29a.ch";
+        email = email;
       };
+      gpg.ssh.allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
     };
     signing = {
-      key = "7A830180A05DAC59CDE43B0677D2F5DB48184456";
+      format = "ssh";
+      # point at the *public* key so ssh-keygen signs through the ssh agent
+      # instead of reading the passphrase protected private key from disk
+      key = "${config.home.homeDirectory}/.ssh/id_ed25519.pub";
+      signer = "${pkgs.openssh}/bin/ssh-keygen";
       signByDefault = true;
     };
   };

modules/home-manager/shell.nix

@@ -23,6 +23,35 @@
         fi
       '';
     };
+
+    # Unlike oh-my-zsh.extraConfig above, this lands *after*
+    # `source $ZSH/oh-my-zsh.sh`, which is where the theme's prompt functions
+    # come into existence.
+    initContent = lib.mkAfter ''
+      # Keep the prompt on one line in deeply nested trees.
+      #
+      # Both themes render the working directory as `%~`, the full path with
+      # $HOME collapsed to `~`. Somewhere like
+      # ~/git/bfh/cas-pml-sem/documents/bericht that is 39 columns on its own,
+      # and together with user@host and a long branch name the line wraps.
+      #
+      # `%(4~|…/%2~|%~)` is a prompt ternary: at four or more components show
+      # an ellipsis and the last two, otherwise show the path whole. Short
+      # paths like ~/git/nixconfig are left alone.
+      if [[ "$ZSH_THEME" == "agnoster" ]]; then
+        # agnoster calls prompt_dir on every render, so redefining it is
+        # enough. AGNOSTER_DIR_* keep the segment's own colours.
+        prompt_dir() {
+          prompt_segment "$AGNOSTER_DIR_BG" "$AGNOSTER_DIR_FG" '%(4~|…/%2~|%~)'
+        }
+      else
+        # gentoo builds PROMPT once at load time, so patch the string. Its
+        # `%~` is the non-root branch of `%(!.%1~.%~)`, and it is the first
+        # literal `%~` in there, so the root branch is untouched. ASCII `...`
+        # because this branch is the Linux console, whose font may lack U+2026.
+        PROMPT="''${PROMPT/\%~/%(4~|.../%2~|%~)}"
+      fi
+    '';
   };
 
   # set important env vars

modules/nixos/astro.nix

@@ -15,7 +15,15 @@ let
     # on PATH. nixpkgs only *propagates* python3 from the siril derivation (it
     # isn't on the runtime PATH), so without the --prefix PATH below the GUI
     # fails with "Python not found in system PATH" and never creates
-    # ~/.local/share/siril/venv. We add the same interpreter siril references.
+    # ~/.local/share/siril/venv.
+    #
+    # We deliberately do NOT put ${pkgs.python3}/bin on PATH directly: `venv`
+    # symlinks bin/python3 to whatever sys.executable was, so the venv would
+    # hard-link a /nix/store hash that gets garbage-collected after the next
+    # python bump, leaving a dangling symlink ("Error finding venv python
+    # path, unable to spawn python"). Instead we go through the stable
+    # /etc/siril/bin/python3 symlink (see environment.etc below), which NixOS
+    # re-points at the current python on every rebuild.
     #
     # The VeraLux PyQt6 wheel ships only the built-in Windows/Fusion styles, so
     # the global QT_STYLE_OVERRIDE=adwaita-dark (inherited from the session) is
@@ -26,7 +34,7 @@ let
     # ignored again (harmless warning + Fusion fallback, no loss of function).
     postBuild = ''
       wrapProgram $out/bin/siril \
-        --prefix PATH : ${lib.makeBinPath [ pkgs.python3 ]} \
+        --prefix PATH : /etc/siril/bin \
         --prefix QT_PLUGIN_PATH : ${pkgs.adwaita-qt6}/lib/qt-6/plugins \
         --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath (with pkgs; [
           stdenv.cc.cc.lib   # libstdc++ / libgcc_s / libgomp  (numpy etc.)
@@ -62,6 +70,10 @@ in
     sirilWithPlugins
   ];
 
+  # Stable, GC-safe interpreter path for Siril's venv (see sirilWithPlugins).
+  # Same python as siril itself propagates, so sirilpy's ABI matches.
+  environment.etc."siril/bin/python3".source = "${pkgs.python3}/bin/python3";
+
   # StarNet++ has no nixpkgs package. Download the StarNet v2 ORT CLI build
   # (starnet2_linux_*_ORT_x64_cli) from https://www.starnetastro.com/download/
   # and unzip it to ~/.local/share/siril/starnet/. Then in Siril set

modules/nixos/gnupg.nix

@@ -4,12 +4,28 @@
   # enable gnupg agent
   programs.gnupg.agent = {
     enable = true;
-    enableSSHSupport = true;
+    # a graphical pinentry never grabs the tty, so a passphrase prompt can no
-    pinentryPackage = pkgs.pinentry-curses;
+    # longer take over a terminal that a coding agent is driving
+    pinentryPackage = pkgs.pinentry-qt;
+    settings = {
+      # keep the key unlocked for a full working day instead of 10 minutes,
+      # so signing commits asks at most once per session
+      default-cache-ttl = 86400;
+      max-cache-ttl = 86400;
+      # fail an unattended signature instead of blocking on a prompt forever
+      pinentry-timeout = 120;
+    };
   };
 
   environment.systemPackages = with pkgs; [
     gnupg
+    pinentry-qt
+    # fallback for sessions without a display, switch pinentryPackage to use it
     pinentry-curses
+    # prime the passphrase cache on demand, e.g. before an agent session
+    (writeShellScriptBin "gpg-unlock" ''
+      echo | ${config.programs.gnupg.package}/bin/gpg --clearsign --output /dev/null
+      echo "gpg key unlocked"
+    '')
   ];
 }