fix(views/kit): communicate :unsign in the tvl-kit URL directly r/6064

Instead of prepending :unsign to all URLs in josh-proxy, and for all
calls to filteredGitPush, explicitly use it only in the filter we use
for the `export-kit` extraStep.

This means, people cloning tvl-kit via

> https://code.tvl.fyi/depot.git:workspace=views/kit.git

now need to update the URL to point to

> https://code.tvl.fyi/depot.git:unsign:workspace=views/kit.git

instead.

git@github.com:tvlfyi/kit.git will keep the same hashes, as it's updated
to export the unsigned workspace view of it.

This is less invasive than dooming every josh workspace to have to strip
signatures.

Change-Id: I6de05182fad4c3695081388c3bbf37306521d255
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8369
Autosubmit: flokli <flokli@flokli.de>
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI

5 files changed, 6 insertions, 6 deletions

diff --git a/ops/modules/josh.nix b/ops/modules/josh.nix
index c7256259d4ea..4591ebf0f078 100644
--- a/ops/modules/josh.nix
+++ b/ops/modules/josh.nix
@@ -26,7 +26,7 @@ in
         DynamicUser = true;
         StateDirectory = "josh";
         Restart = "always";
-        ExecStart = "${depot.third_party.josh}/bin/josh-proxy --no-background --local /var/lib/josh --port ${toString cfg.port} --remote https://cl.tvl.fyi/ --require-auth --filter-prefix ':unsign'";
+        ExecStart = "${depot.third_party.josh}/bin/josh-proxy --no-background --local /var/lib/josh --port ${toString cfg.port} --remote https://cl.tvl.fyi/ --require-auth";
       };
     };
   };
diff --git a/tools/releases/default.nix b/tools/releases/default.nix
index aedf396aeef1..d38ca0b5d8be 100644
--- a/tools/releases/default.nix
+++ b/tools/releases/default.nix
@@ -19,8 +19,8 @@ in
       set -e
       export PATH="${makeBinPath [ pkgs.git depot.third_party.josh ]}:$PATH"
 
-      echo 'Filtering depot through :unsign ${filter}'
-      josh-filter ':unsign ${filter}'
+      echo 'Filtering depot through ${filter}'
+      josh-filter '${filter}'
 
       echo 'Fetching remote to check if a push is needed'
       git fetch '${remote}' '${ref}'
diff --git a/views/README.md b/views/README.md
index 183e70bc5a5d..a6ebd93a7788 100644
--- a/views/README.md
+++ b/views/README.md
@@ -15,7 +15,7 @@ look like:
   - Commit your changes. This is required, as `josh-filter` operates on your
     `HEAD`, not working directory state.
   - Invoke `josh-filter` with the filter expression,
-    for example `josh-filter ':workspace=views/kit'`.
+    for example `josh-filter ':workspace=views/tvix'`.
   - Peek at the synthesized git history by looking at `FILTERED_HEAD`.
 
 Testing changes in Gerrit
diff --git a/views/default.nix b/views/default.nix
index 3583e4e849de..83c2782719ca 100644
--- a/views/default.nix
+++ b/views/default.nix
@@ -9,7 +9,7 @@ let
   };
 
   export-kit = depot.tools.releases.filteredGitPush {
-    filter = ":workspace=views/kit";
+    filter = ":unsign:workspace=views/kit";
     remote = "git@github.com:tvlfyi/kit.git";
     ref = "refs/heads/canon";
   };
diff --git a/views/kit/README.md b/views/kit/README.md
index 85c05ed8a1a7..95a38e738260 100644
--- a/views/kit/README.md
+++ b/views/kit/README.md
@@ -17,7 +17,7 @@ tooling, currently comprising of:
 
 It can be accessed via git by cloning it as such:
 
-    git clone https://code.tvl.fyi/depot.git:workspace=views/kit.git tvl-kit
+    git clone https://code.tvl.fyi/depot.git:unsign:workspace=views/kit.git tvl-kit
 
 If you are looking at this within the TVL depot, you can see the
 [josh][] configuration in `workspace.josh`. You will find the projects