Skip to content

Commit 9af2905

Browse files
0x77dev0x77dev
committed
refactor: decompose flake and improve code quality
Flake structure: - Split flake.nix into modular nix/{package,checks,shell,git-hooks}.nix - Use rec attrset in package.nix to avoid let overuse - Extract e2e test to scripts/e2e.sh with optional $out handling Git hooks: - Add git-hooks.nix integration with pre-commit checks - Enable nixfmt, shellcheck, rustfmt, and clippy hooks - Auto-install hooks in devShell via shellHook CI and tooling: - Update GitHub Actions workflow matrix configuration - Add rustfmt.toml configuration file - Ignore auto-generated .pre-commit-config.yaml Code improvements: - Improve error handling in keybox.rs with better fallback logic - Add CRLF line ending preservation in PDF signature extraction - Add tests for signature extraction with different line endings - Improve default output path handling in sign.rs - Remove unused fields from JSON output - Clean up trailing whitespace and formatting - Use ExitCode instead of Result<()> in main
1 parent 594ac9d commit 9af2905

20 files changed

Lines changed: 451 additions & 154 deletions

‎.github/workflows/ci.yml‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,22 @@ on:
44
push:
55
branches: [main]
66
pull_request:
7-
types: [ready_for_review]
7+
types: [opened, synchronize, reopened, ready_for_review]
88

99
jobs:
1010
build:
11-
name: Build (${{ matrix.os }})
12-
runs-on: ${{ matrix.os }}
11+
name: Build (${{ matrix.name }})
12+
runs-on: ${{ matrix.runs_on }}
1313
strategy:
1414
fail-fast: false
1515
matrix:
16-
os: [ubuntu-latest, macos-latest]
16+
include:
17+
- name: linux-amd64
18+
runs_on: ubuntu-24.04
19+
- name: linux-arm64
20+
runs_on: ubuntu-24.04-arm
21+
- name: macos-arm64
22+
runs_on: macos-26
1723

1824
steps:
1925
- name: Checkout
@@ -48,7 +54,7 @@ jobs:
4854
- name: Upload artifact
4955
uses: actions/upload-artifact@v4
5056
with:
51-
name: pdf-sign-${{ runner.os }}-${{ matrix.os }}
57+
name: pdf-sign-${{ matrix.name }}
5258
path: dist/*
5359

5460

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,4 @@ target
33
result
44
result-*
55
.direnv/
6+
/.pre-commit-config.yaml

‎flake.lock‎

Lines changed: 75 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎flake.nix‎

Lines changed: 33 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -14,101 +14,56 @@
1414
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
1515
flake-utils.url = "github:numtide/flake-utils";
1616
crane.url = "github:ipetkov/crane";
17+
git-hooks.url = "github:cachix/git-hooks.nix";
1718
};
1819

19-
outputs = { self, nixpkgs, flake-utils, crane, ... }:
20-
flake-utils.lib.eachDefaultSystem (system:
20+
outputs =
21+
{
22+
self,
23+
nixpkgs,
24+
flake-utils,
25+
crane,
26+
git-hooks,
27+
...
28+
}:
29+
flake-utils.lib.eachDefaultSystem (
30+
system:
2131
let
2232
pkgs = import nixpkgs {
2333
inherit system;
2434
};
2535

2636
craneLib = crane.mkLib pkgs;
27-
lib = pkgs.lib;
2837

29-
commonArgs = {
30-
src = craneLib.cleanCargoSource ./.;
31-
strictDeps = true;
32-
33-
nativeBuildInputs = with pkgs; [
34-
pkg-config
35-
capnproto
36-
];
37-
};
38-
39-
cargoArtifacts = craneLib.buildDepsOnly commonArgs;
40-
41-
meta = with lib; {
42-
description = "Lightweight PDF signing tool that appends detached OpenPGP signatures (delegates signing to gpg-agent)";
43-
homepage = "https://github.com/0x77dev/pdf-sign";
44-
license = licenses.gpl3Only;
45-
mainProgram = "pdf-sign";
46-
platforms = platforms.unix;
38+
package = import ./nix/package.nix {
39+
inherit pkgs craneLib;
40+
lib = pkgs.lib;
4741
};
48-
49-
pdfSign = craneLib.buildPackage (commonArgs // {
50-
inherit cargoArtifacts;
51-
meta = meta;
52-
});
5342
in
5443
{
55-
checks = {
56-
pdf-sign-e2e = pkgs.runCommand "pdf-sign-e2e" {
57-
nativeBuildInputs = with pkgs; [ gnupg ];
58-
} ''
59-
set -euo pipefail
60-
61-
export GNUPGHOME="$(mktemp -d)"
62-
chmod 700 "$GNUPGHOME"
63-
64-
# Non-interactive agent defaults: sequoia-gpg-agent sends OPTION values,
65-
# keep them non-empty even in CI.
66-
export GPG_TTY=/dev/null
67-
export LANG=C
68-
69-
gpgconf --launch gpg-agent
70-
71-
gpg --batch --pinentry-mode loopback --passphrase "" \
72-
--quick-generate-key "CI Test <ci@example.invalid>" default default never
73-
74-
gpg --batch --armor --export "ci@example.invalid" > cert.asc
75-
76-
cat > input.pdf <<'EOF'
77-
%PDF-1.1
78-
1 0 obj
79-
<<>>
80-
endobj
81-
trailer
82-
<<>>
83-
%%EOF
84-
EOF
85-
86-
signed="$(${pdfSign}/bin/pdf-sign sign input.pdf --key cert.asc)"
87-
${pdfSign}/bin/pdf-sign verify "$signed" --cert cert.asc | grep -x OK >/dev/null
44+
checks = import ./nix/checks.nix {
45+
inherit
46+
pkgs
47+
craneLib
48+
package
49+
git-hooks
50+
system
51+
;
52+
};
8853

89-
touch "$out"
90-
'';
54+
packages = {
55+
default = package.pdfSign;
56+
pdf-sign = package.pdfSign;
9157
};
9258

93-
packages =
94-
{
95-
default = pdfSign;
96-
pdf-sign = pdfSign;
59+
devShells.default = import ./nix/shell.nix {
60+
inherit pkgs;
61+
pdfSign = package.pdfSign;
62+
pre-commit-check = import ./nix/git-hooks.nix {
63+
inherit git-hooks system pkgs;
64+
src = ./.;
9765
};
98-
99-
devShells.default = pkgs.mkShell {
100-
inputsFrom = [ pdfSign ];
101-
packages = with pkgs; [
102-
rustc
103-
cargo
104-
rustfmt
105-
clippy
106-
pkg-config
107-
capnproto
108-
];
10966
};
11067
}
11168
);
11269
}
113-
114-

‎nix/checks.nix‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
{
2+
pkgs,
3+
craneLib,
4+
package,
5+
git-hooks,
6+
system,
7+
}:
8+
{
9+
pre-commit-check = import ./git-hooks.nix {
10+
inherit git-hooks system pkgs;
11+
src = ../.;
12+
};
13+
14+
cargo-test = craneLib.cargoTest (
15+
package.commonArgs
16+
// {
17+
cargoArtifacts = package.cargoArtifacts;
18+
}
19+
);
20+
21+
pdf-sign-e2e =
22+
pkgs.runCommand "pdf-sign-e2e"
23+
{
24+
nativeBuildInputs = with pkgs; [ gnupg ];
25+
}
26+
''
27+
export PDF_SIGN="${package.pdfSign}/bin/pdf-sign"
28+
${builtins.readFile ../scripts/e2e.sh}
29+
'';
30+
}

‎nix/git-hooks.nix‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
git-hooks,
3+
system,
4+
pkgs,
5+
src ? ../.,
6+
}:
7+
8+
git-hooks.lib.${system}.run {
9+
inherit src;
10+
11+
hooks = {
12+
nixfmt.enable = true;
13+
shellcheck.enable = true;
14+
rustfmt.enable = true;
15+
};
16+
}

‎nix/package.nix‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
pkgs,
3+
craneLib,
4+
lib,
5+
}:
6+
rec {
7+
commonArgs = {
8+
src = craneLib.cleanCargoSource ../.;
9+
strictDeps = true;
10+
11+
nativeBuildInputs = with pkgs; [
12+
pkg-config
13+
capnproto
14+
];
15+
};
16+
17+
cargoArtifacts = craneLib.buildDepsOnly commonArgs;
18+
19+
pdfSign = craneLib.buildPackage (
20+
commonArgs
21+
// {
22+
inherit cargoArtifacts;
23+
meta = with lib; {
24+
description = "Lightweight PDF signing tool that appends detached OpenPGP signatures (delegates signing to gpg-agent)";
25+
homepage = "https://github.com/0x77dev/pdf-sign";
26+
license = licenses.gpl3Only;
27+
mainProgram = "pdf-sign";
28+
platforms = platforms.unix;
29+
};
30+
}
31+
);
32+
}

‎nix/shell.nix‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
{
2+
pkgs,
3+
pdfSign,
4+
pre-commit-check,
5+
}:
6+
pkgs.mkShell {
7+
inputsFrom = [ pdfSign ];
8+
9+
shellHook = pre-commit-check.shellHook;
10+
11+
packages =
12+
with pkgs;
13+
[
14+
rustc
15+
cargo
16+
rustfmt
17+
clippy
18+
pkg-config
19+
capnproto
20+
]
21+
++ pre-commit-check.enabledPackages;
22+
}

‎rustfmt.toml‎

Whitespace-only changes.

0 commit comments

Comments
 (0)