update mastodon

nixos/pkgs/glitch-soc/default.nix

@@ -1,6 +1,6 @@
-{ stdenv, stdenvNoCC, nodejs-slim, bundlerEnv
-, yarn-berry, callPackage, ruby_3_4, writeShellScript
-, brotli, cacert
+{ stdenv, nodejs-slim, bundlerEnv
+, yarn-berry, callPackage, ruby, writeShellScript
+, brotli
 }:
 
 let
@@ -18,40 +18,16 @@ let
   mastodonGems = bundlerEnv {
     name = "glitch-soc-gems-${version}";  # bundlerEnv breaks when pname is set instead
     inherit version;
-    ruby = ruby_3_4;
+    ruby = ruby;
     gemset = ./gemset.nix;
     gemdir = src;
   };
 
   # fetches JS dependencies via yarn based on the lockfile in the source
-  mastodonYarnDeps = stdenvNoCC.mkDerivation {
-    pname = "glitch-soc-yarn-deps";
-    inherit version src;
-
-    nativeBuildInputs = [ yarn-berry cacert ];
-
-    dontInstall = true;
-
-    NODE_EXTRA_CA_CERTS = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-
-    buildPhase = ''
-      mkdir -p $out
-
-      export HOME=$(mktemp -d)
-      echo $HOME
-
-      export YARN_ENABLE_TELEMETRY=0
-      export YARN_COMPRESSION_LEVEL=0
-
-      cache="$(yarn config get cacheFolder)"
-      yarn install --immutable --mode skip-build
-
-      cp -r $cache/* $out/
-    '';
-
-    outputHashAlgo = "sha256";
-    outputHash = versionData.yarnHash;
-    outputHashMode = "recursive";
+  mastodonYarnDeps = yarn-berry.fetchYarnBerryDeps {
+    inherit src;
+    hash = versionData.yarnHash;
+    missingHashes = ./missing-hashes.json;
   };
 
   # builds the node modules for mastodon using the previously fetched yarn deps
@@ -60,8 +36,16 @@ let
     inherit version src;
 
     yarnOfflineCache = mastodonYarnDeps;
+    missingHashes = ./missing-hashes.json;
 
-    nativeBuildInputs = [ nodejs-slim yarn-berry brotli mastodonGems mastodonGems.wrappedRuby ];
+    nativeBuildInputs = [
+      nodejs-slim
+      yarn-berry
+      yarn-berry.yarnBerryConfigHook
+      brotli
+      mastodonGems
+      mastodonGems.wrappedRuby
+    ];
 
     RAILS_ENV = "production";
     NODE_ENV = "production";
@@ -80,42 +64,28 @@ let
     buildPhase = ''
       runHook preBuild
 
-      export HOME=$PWD
-      # This option is needed for openssl-3 compatibility
-      # Otherwise we encounter this upstream issue: https://github.com/mastodon/mastodon/issues/17924
-      export NODE_OPTIONS=--openssl-legacy-provider
+      export SECRET_KEY_BASE_DUMMY=1
 
-      export YARN_ENABLE_TELEMETRY=0
-      mkdir -p ~/.yarn/berry
-      ln -sf $yarnOfflineCache ~/.yarn/berry/cache
+      patchShebangs bin
 
-      # --inline-builds prints build logs inline so they can be inspected with nix log
-      yarn install --immutable --immutable-cache --inline-builds
+      bundle exec rails assets:precompile
 
-      patchShebangs ~/bin
-      patchShebangs ~/node_modules
+      rm -rf node_modules/.cache
 
-      # skip running yarn install
-      rm -rf ~/bin/yarn
+      # Remove workspace "package" as it contains broken symlinks
+      # See https://github.com/NixOS/nixpkgs/issues/380366
+      rm -rf node_modules/@mastodon
 
-      OTP_SECRET=precompile_placeholder \
-      SECRET_KEY_BASE=precompile_placeholder \
-      ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=precompile_placeholder \
-      ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=precompile_placeholder \
-      ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=precompile_placeholder \
-        rails assets:precompile
-
-      yarn cache clean
-      rm -rf ~/node_modules/.cache
+      # Remove execute permissions
+      find public/assets -type f ! -perm 0555 \
+        -exec chmod 0444 {} ';'
 
       # Create missing static gzip and brotli files
-      gzip --best --keep ~/public/assets/500.html
-      gzip --best --keep ~/public/packs/report.html
-      find ~/public/assets -maxdepth 1 -type f -name '.*.json' \
-        -exec gzip --best --keep --force {} ';'
-      brotli --best --keep ~/public/packs/report.html
-      find ~/public/assets -type f -regextype posix-extended -iregex '.*\.(css|js|json|html)' \
+      find public/assets -type f -regextype posix-extended -iregex '.*\.(css|html|js|json|svg)' \
+        -exec gzip --best --keep --force {} ';' \
         -exec brotli --best --keep {} ';'
+      gzip --best --keep public/packs/report.html
+      brotli --best --keep public/packs/report.html
 
       runHook postBuild
     '';