fix(views/kit): communicate :unsign in the tvl-kit URL directly r/6064

Instead of prepending :unsign to all URLs in josh-proxy, and for all
calls to filteredGitPush, explicitly use it only in the filter we use
for the `export-kit` extraStep.

This means, people cloning tvl-kit via

> https://code.tvl.fyi/depot.git:workspace=views/kit.git

now need to update the URL to point to

> https://code.tvl.fyi/depot.git:unsign:workspace=views/kit.git

instead.

git@github.com:tvlfyi/kit.git will keep the same hashes, as it's updated
to export the unsigned workspace view of it.

This is less invasive than dooming every josh workspace to have to strip
signatures.

Change-Id: I6de05182fad4c3695081388c3bbf37306521d255
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8369
Autosubmit: flokli <flokli@flokli.de>
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI

5 files changed, 6 insertions, 6 deletions

diff --git a/ops/modules/josh.nix b/ops/modules/josh.nix
index c7256259d4..4591ebf0f0 100644
--- a/ops/modules/josh.nix
+++ b/ops/modules/josh.nix
@@ -26,7 +26,7 @@ in
         DynamicUser = true;
         StateDirectory = "josh";
         Restart = "always";
-        ExecStart = "${depot.third_party.josh}/bin/josh-proxy --no-background --local /var/lib/josh --port ${toString cfg.port} --remote https://cl.tvl.fyi/ --require-auth --filter-prefix ':unsign'";
+        ExecStart = "${depot.third_party.josh}/bin/josh-proxy --no-background --local /var/lib/josh --port ${toString cfg.port} --remote https://cl.tvl.fyi/ --require-auth";
       };
     };
   };
diff --git a/tools/releases/default.nix b/tools/releases/default.nix
index aedf396aee..d38ca0b5d8 100644
--- a/tools/releases/default.nix
+++ b/tools/releases/default.nix
@@ -19,8 +19,8 @@ in
       set -e
       export PATH="${makeBinPath [ pkgs.git depot.third_party.josh ]}:$PATH"
 
-      echo 'Filtering depot through :unsign ${filter}'
-      josh-filter ':unsign ${filter}'
+      echo 'Filtering depot through ${filter}'
+      josh-filter '${filter}'
 
       echo 'Fetching remote to check if a push is needed'
       git fetch '${remote}' '${ref}'
diff --git a/views/README.md b/views/README.md
index 183e70bc5a..a6ebd93a77 100644
--- a/views/README.md
+++ b/views/README.md
@@ -15,7 +15,7 @@ look like:
   - Commit your changes. This is required, as `josh-filter` operates on your
     `HEAD`, not working directory state.
   - Invoke `josh-filter` with the filter expression,
-    for example `josh-filter ':workspace=views/kit'`.
+    for example `josh-filter ':workspace=views/tvix'`.
   - Peek at the synthesized git history by looking at `FILTERED_HEAD`.
 
 Testing changes in Gerrit
diff --git a/views/default.nix b/views/default.nix
index 3583e4e849..83c2782719 100644
--- a/views/default.nix
+++ b/views/default.nix
@@ -9,7 +9,7 @@ let
   };
 
   export-kit = depot.tools.releases.filteredGitPush {
-    filter = ":workspace=views/kit";
+    filter = ":unsign:workspace=views/kit";
     remote = "git@github.com:tvlfyi/kit.git";
     ref = "refs/heads/canon";
   };
diff --git a/views/kit/README.md b/views/kit/README.md
index 85c05ed8a1..95a38e7382 100644
--- a/views/kit/README.md
+++ b/views/kit/README.md
@@ -17,7 +17,7 @@ tooling, currently comprising of:
 
 It can be accessed via git by cloning it as such:
 
-    git clone https://code.tvl.fyi/depot.git:workspace=views/kit.git tvl-kit
+    git clone https://code.tvl.fyi/depot.git:unsign:workspace=views/kit.git tvl-kit
 
 If you are looking at this within the TVL depot, you can see the
 [josh][] configuration in `workspace.josh`. You will find the projects