flake.nix

{
  description = "A Nix flake for Therp work";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
    nixpkgs-old.url = "github:NixOS/nixpkgs/nixos-23.05";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs = { self, nixpkgs, nixpkgs-old, flake-utils }:
    flake-utils.lib.eachDefaultSystem (system:
      let
        pkgs = nixpkgs.legacyPackages.${system};
        oldPkgs = nixpkgs-old.legacyPackages.${system};
        opensshPatch = pkgs.writers.writeText "checkperm.patch" ''
          diff --git a/readconf.h b/readconf.h
          index ded13c9..94f489e 100644
          --- a/readconf.h
          +++ b/readconf.h
          @@ -203,7 +203,7 @@ typedef struct {
           #define SESSION_TYPE_SUBSYSTEM	1
           #define SESSION_TYPE_DEFAULT	2
           
          -#define SSHCONF_CHECKPERM	1  /* check permissions on config file */
          +#define SSHCONF_CHECKPERM	0  /* check permissions on config file */
           #define SSHCONF_USERCONF	2  /* user provided config file not system */
           #define SSHCONF_FINAL		4  /* Final pass over config, after canon. */
           #define SSHCONF_NEVERMATCH	8  /* Match/Host never matches; internal only */
        '';
        patchedSsh = pkgs.openssh.overrideAttrs (old: {
          patches = (old.patches or []) ++ [ "${opensshPatch}" ];
          doCheck = false;
        });
        fhs = pkgs.buildFHSEnv {
          name = "run-pre-commit";
          targetPkgs = p: (with p; [
            gettext
            git
            patchedSsh
            oldPkgs.pre-commit
          ]);
          runScript = "pre-commit run -a";
        };
      in {
        devShells.default = fhs.env;
        apps.default = {
          type = "app";
          program = "${fhs}/bin/run-pre-commit";
        };
      }
    );
}