nix: add sharefs supplementary group

This works around vfs inode file attribute race.

Signed-off-by: Ophestra <cat@gensokyo.uk>

internal/rosa/hakurei.go

@@ -99,7 +99,7 @@ mkdir -p /work/system/bin/
 		f: func(t Toolchain) (pkg.Artifact, string) {
 			return t.newHakurei("-dist", `
 export HAKUREI_VERSION
-DESTDIR=/work /usr/src/hakurei/dist/release.sh
+DESTDIR=/work /usr/src/hakurei/all.sh
 `, true), hakureiVersion
 		},
 

internal/rosa/hakurei_release.go

@@ -4,13 +4,13 @@ package rosa
 
 import "hakurei.app/internal/pkg"
 
-const hakureiVersion = "0.3.7"
+const hakureiVersion = "0.4.0"
 
 // hakureiSource is the source code of a hakurei release.
 var hakureiSource = pkg.NewHTTPGetTar(
 	nil, "https://git.gensokyo.uk/rosa/hakurei/archive/"+
 		"v"+hakureiVersion+".tar.gz",
-	mustDecode("Xh_sdITOATEAQN5_UuaOyrWsgboxorqRO9bml3dGm8GAxF8NFpB7MqhSZgjJxAl2"),
+	mustDecode("wfQ9DqCW0Fw9o91wj-I55waoqzB-UqzzuC0_2h-P-1M78SgZ1WHSPCDJMth6EyC2"),
 	pkg.TarGzip,
 )
 

nixos.nix

@@ -136,11 +136,12 @@ in
 
                   conf = {
                     inherit id;
-                    inherit (app) identity groups enablements;
+                    inherit (app) identity enablements;
                     inherit (dbusConfig) session_bus system_bus;
                     direct_wayland = app.insecureWayland;
                     sched_policy = app.schedPolicy;
                     sched_priority = app.schedPriority;
+                    groups = app.groups ++ optional (cfg.sharefs.source != null) cfg.sharefs.group;
 
                     container = {
                       inherit (app)
@@ -357,29 +358,30 @@ in
         users = mkMerge (
           foldlAttrs
             (
-              acc: _: fid:
+              acc: username: fid:
               acc
-              ++ foldlAttrs (
-                acc': _: app:
-                acc' ++ [ { ${getsubname fid app.identity} = getuser fid app.identity; } ]
-              ) [ { ${getsubname fid 0} = getuser fid 0; } ] cfg.apps
-            )
-            (
-              if (cfg.sharefs.source != null) then
-                [
-                  {
-                    ${cfg.sharefs.user} = {
-                      uid = lib.mkDefault 1023;
-                      inherit (cfg.sharefs) group;
-                      isSystemUser = true;
-                      home = cfg.sharefs.source;
-                    };
-
-                  }
-                ]
-              else
-                [ ]
+              ++
+                foldlAttrs
+                  (
+                    acc': _: app:
+                    acc' ++ [ { ${getsubname fid app.identity} = getuser fid app.identity; } ]
+                  )
+                  [
+                    {
+                      ${getsubname fid 0} = getuser fid 0;
+                      ${username}.extraGroups = [ cfg.sharefs.group ];
+                    }
+                  ]
+                  cfg.apps
             )
+            (optional (cfg.sharefs.source != null) {
+              ${cfg.sharefs.user} = {
+                uid = lib.mkDefault 1023;
+                inherit (cfg.sharefs) group;
+                isSystemUser = true;
+                home = cfg.sharefs.source;
+              };
+            })
             cfg.users
         );
 
@@ -393,18 +395,11 @@ in
                 acc' ++ [ { ${getsubname fid app.identity} = getgroup fid app.identity; } ]
               ) [ { ${getsubname fid 0} = getgroup fid 0; } ] cfg.apps
             )
-            (
-              if (cfg.sharefs.source != null) then
-                [
-                  {
-                    ${cfg.sharefs.group} = {
-                      gid = lib.mkDefault 1023;
-                    };
-                  }
-                ]
-              else
-                [ ]
-            )
+            (optional (cfg.sharefs.source != null) {
+              ${cfg.sharefs.group} = {
+                gid = lib.mkDefault 1023;
+              };
+            })
             cfg.users
         );
       };

test/interactive/configuration.nix

@@ -8,10 +8,7 @@
       description = "Alice Foobar";
       password = "foobar";
       uid = 1000;
-      extraGroups = [
-        "wheel"
-        "sharefs"
-      ];
+      extraGroups = [ "wheel" ];
     };
     untrusted = {
       isNormalUser = true;