如何在 nix 派生中複製私有 git 儲存庫

{
 nixpkgs ? import <nixpkgs> {}
}:nixpkgs.pkgs.fetchgitPrivate {
       url = "ssh://git@gitlab.com/trycatchchris/blog.git";
       rev = "0f5fe7ebf0724eb17aea4141e0cf3f1758a6d716";
       sha256 = "02951e82c1183aaf1ce4b9669bf9ae32e50c4c641550797eed37739cd4528b58";
     }

我有上面的 nix 表達式，其中 repo 是一個私有 git 儲存庫。

我確實可以通過我的使用者的公鑰訪問此儲存庫。

如果我嘗試正常nix-build：

nix-build
trace: Please set your nix-path such that ssh-config-file points to a file that will allow ssh to access private repositories. The builder will not be able to see any running ssh agent sessions unless ssh-auth-sock is also set in the nix-path.

Note that the config file and any keys it points to must be readable by the build user, which depending on your nix configuration means making it readable by the build-users-group, the user of the running nix-daemon, or the user calling the nix command which started the build. Similarly, if using an ssh agent ssh-auth-sock must point to a socket the build user can access.

You may need StrictHostKeyChecking=no in the config file. Since ssh will refuse to use a group-readable private key, if using build-users you will likely want to use something like IdentityFile /some/directory/%u/key and have a directory for each build user accessible to that user.

these derivations will be built:
 /nix/store/hlnshdb0ckckih46cv66xj8pyqds6w7y-blog-0f5fe7e.drv
building '/nix/store/hlnshdb0ckckih46cv66xj8pyqds6w7y-blog-0f5fe7e.drv'...
exporting ssh://git@gitlab.com/trycatchchris/blog.git (rev 0f5fe7ebf0724eb17aea4141e0cf3f1758a6d716) into /nix/store/mkinydhkdyg6dyw7fp399m90qw5bsbqd-blog-0f5fe7e
Initialized empty Git repository in /nix/store/mkinydhkdyg6dyw7fp399m90qw5bsbqd-blog-0f5fe7e/.git/
Can't open user config file /var/lib/empty/config: No such file or directory
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
Can't open user config file /var/lib/empty/config: No such file or directory
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
Unable to checkout 0f5fe7ebf0724eb17aea4141e0cf3f1758a6d716 from ssh://git@gitlab.com/trycatchchris/blog.git.
builder for '/nix/store/hlnshdb0ckckih46cv66xj8pyqds6w7y-blog-0f5fe7e.drv' failed with exit code 1
error: build of '/nix/store/hlnshdb0ckckih46cv66xj8pyqds6w7y-blog-0f5fe7e.drv' failed

我嘗試過使用 ssh 代理以及（來自https://github.com/NixOS/nixpkgs/issues/4004#issuecomment-236434045）：

創建一個ssh包含以下內容的文件：

Host gitlab.com
 StrictHostKeyChecking No
 UserKnownHostsFile /dev/null
 IdentityFile /home/chris/.ssh/id_rsa

並執行：

nix-build -I ssh-config-file=$PWD/ssh           
these derivations will be built:
 /nix/store/ng4qdayni3a69b57kfmrvf4ba03ryfv9-blog-0f5fe7e.drv
building '/nix/store/ng4qdayni3a69b57kfmrvf4ba03ryfv9-blog-0f5fe7e.drv'...
exporting ssh://git@gitlab.com/trycatchchris/blog.git (rev 0f5fe7ebf0724eb17aea4141e0cf3f1758a6d716) into /nix/store/mkinydhkdyg6dyw7fp399m90qw5bsbqd-blog-0f5fe7e
Initialized empty Git repository in /nix/store/mkinydhkdyg6dyw7fp399m90qw5bsbqd-blog-0f5fe7e/.git/
Can't open user config file /home/chris/temp/wiptemp/11/ssh: No such file or directory
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
Can't open user config file /home/chris/temp/wiptemp/11/ssh: No such file or directory
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
Unable to checkout 0f5fe7ebf0724eb17aea4141e0cf3f1758a6d716 from ssh://git@gitlab.com/trycatchchris/blog.git.
builder for '/nix/store/ng4qdayni3a69b57kfmrvf4ba03ryfv9-blog-0f5fe7e.drv' failed with exit code 1
error: build of '/nix/store/ng4qdayni3a69b57kfmrvf4ba03ryfv9-blog-0f5fe7e.drv' failed

然而這也失敗了……我如何使用上述方法或其他方法複製私人倉庫？

{
 nixpkgs ? import <nixpkgs> {}
}:(import (builtins.fetchGit {
       url = "ssh://git@gitlab.com/trycatchchris/blog.git";
       rev = "4d127272689a5bc172e82529132b91e5943bb16f";
     }) {})

上面的 ( builtins.fetchGit) 似乎可以完美地工作，而無需設置沙箱等（使用預設的 ~/.ssh/id_rsa 鍵）。

如果使用 Nix < v2.4 並獲取不在master分支上的送出，則需要添加ref帶有分支名稱的附加屬性，例如：

{
           url = "ssh://git@gitlab.com/trycatchchris/blog.git";
           rev = "4d127272689a5bc172e82529132b91e5943bb16f";
           ref = "branchNameGoesHere"; # here
         }

https://github.com/nix-community/naersk/pull/211

引用自：https://unix.stackexchange.com/questions/557977