2 files changed, 7 insertions, 52 deletions
diff --git a/third_party/josh/0001-josh-proxy-Always-require-authentication-when-pushin.patch b/third_party/josh/0001-josh-proxy-Always-require-authentication-when-pushin.patch
deleted file mode 100644
index d3a2c0e99836..000000000000
--- a/third_party/josh/0001-josh-proxy-Always-require-authentication-when-pushin.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From a82ccf1fab187969544b638f6977d698a55dbb2f Mon Sep 17 00:00:00 2001
-From: Vincent Ambo <mail@tazj.in>
-Date: Fri, 11 Feb 2022 13:14:02 +0300
-Subject: [PATCH] josh-proxy: Always require authentication when pushing
-
-This supports the use-case where josh serves a public repo without
-auth, but requires auth for pushing back.
----
- josh-proxy/src/auth.rs           | 4 ++--
- josh-proxy/src/bin/josh-proxy.rs | 2 +-
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/josh-proxy/src/auth.rs b/josh-proxy/src/auth.rs
-index 96a8241..0a007f3 100644
---- a/josh-proxy/src/auth.rs
-+++ b/josh-proxy/src/auth.rs
-@@ -54,8 +54,8 @@ impl Handle {
-     }
- }
- 
--pub async fn check_auth(url: &str, auth: &Handle, required: bool) -> josh::JoshResult<bool> {
--    if required && auth.hash.is_empty() {
-+pub async fn check_auth(url: &str, pathinfo: &str, auth: &Handle, required: bool) -> josh::JoshResult<bool> {
-+    if auth.hash.is_empty() && (required || pathinfo == "/git-receive-pack") {
-         return Ok(false);
-     }
- 
-diff --git a/josh-proxy/src/bin/josh-proxy.rs b/josh-proxy/src/bin/josh-proxy.rs
-index 700f2da..a96da1c 100644
---- a/josh-proxy/src/bin/josh-proxy.rs
-+++ b/josh-proxy/src/bin/josh-proxy.rs
-@@ -449,7 +449,7 @@ async fn call_service(
-     ]
-     .join("");
- 
--    if !josh_proxy::auth::check_auth(&remote_url, &auth, ARGS.is_present("require-auth"))
-+    if !josh_proxy::auth::check_auth(&remote_url, &parsed_url.pathinfo, &auth, ARGS.is_present("require-auth"))
-         .in_current_span()
-         .await?
-     {
--- 
-2.34.1
-
diff --git a/third_party/josh/default.nix b/third_party/josh/default.nix
index 8900c6ad4572..bc8640a19bfd 100644
--- a/third_party/josh/default.nix
+++ b/third_party/josh/default.nix
@@ -1,16 +1,18 @@
-# https://github.com/esrlabs/josh
+# https://github.com/josh-project/josh
 { depot, pkgs, ... }:
 
 let
+  rev = "fc857afda2c1536234e3bb1983c518a1abf63d25";
   src = pkgs.fetchFromGitHub {
-    owner = "esrlabs";
+    owner = "josh-project";
     repo = "josh";
-    rev = "effe6290559136faba5591a115e56c2b30210329";
-    hash = "sha256:0kam9rqjk96brvh15wj3h3vm2sqnr5pckz91az2ida5617d5gp9v";
+    inherit rev;
+    hash = "sha256:16ch7al7xfyjipgqh2n7grj985fv713mhi8y5bixb736vsad9q3w";
   };
 in
 depot.third_party.naersk.buildPackage {
   inherit src;
+  JOSH_VERSION = "git-${builtins.substring 0 8 rev}";
 
   buildInputs = with pkgs; [
     libgit2
@@ -20,16 +22,12 @@ depot.third_party.naersk.buildPackage {
 
   cargoBuildOptions = x: x ++ [
     "-p"
-    "josh"
+    "josh-filter"
     "-p"
     "josh-proxy"
-    "-p"
-    "josh-ui"
   ];
 
   overrideMain = x: {
-    patches = [ ./0001-josh-proxy-Always-require-authentication-when-pushin.patch ];
-
     nativeBuildInputs = (x.nativeBuildInputs or [ ]) ++ [ pkgs.makeWrapper ];
     postInstall = ''
       wrapProgram $out/bin/josh-proxy --prefix PATH : "${pkgs.git}/bin"