5 files changed, 49 insertions, 0 deletions
diff --git a/users/edef/OWNERS b/users/edef/OWNERS
new file mode 100644
index 000000000000..05f7639c8947
--- /dev/null
+++ b/users/edef/OWNERS
@@ -0,0 +1,3 @@
+inherited: false
+owners:
+  - edef
diff --git a/users/edef/depot-scan/default.nix b/users/edef/depot-scan/default.nix
new file mode 100644
index 000000000000..a9c0f382ff45
--- /dev/null
+++ b/users/edef/depot-scan/default.nix
@@ -0,0 +1,12 @@
+{ pkgs, ... }:
+
+pkgs.writeShellScriptBin "depot-scan" ''
+  set -euo pipefail
+
+  path="''${1:-$(git rev-parse --show-prefix)}"
+  path="''${path%%/}"
+  attr="''${path//\//.}"
+  root="$(git rev-parse --show-toplevel)"
+  echo "scanning //$path" >&2
+  nix-instantiate -E "import ${./wrap.nix} $root" -A "$attr" -vv 2> >(${pkgs.perl}/bin/perl ${./depot-scan.pl}) >&2
+''
diff --git a/users/edef/depot-scan/depot-scan.pl b/users/edef/depot-scan/depot-scan.pl
new file mode 100755
index 000000000000..8808e2eb0023
--- /dev/null
+++ b/users/edef/depot-scan/depot-scan.pl
@@ -0,0 +1,11 @@
+#! /usr/bin/env -S perl -ln
+use strict;
+
+if (/^evaluating file '(.*)'$/ or
+    /^copied source '(.*)' -> '.*'$/ or
+    /^trace: depot-scan '(.*)'$/) {
+    print $1;
+    next;
+}
+
+print STDERR unless /^instantiated '.*' -> '.*'$/;
diff --git a/users/edef/depot-scan/wrap.nix b/users/edef/depot-scan/wrap.nix
new file mode 100644
index 000000000000..77362b3f61f9
--- /dev/null
+++ b/users/edef/depot-scan/wrap.nix
@@ -0,0 +1,16 @@
+# this wraps import to override readFile and readDir to trace the files it touches
+# technique inspired by lorri
+let
+
+  global = {
+    import = global.scopedImport { };
+    scopedImport = x: builtins.scopedImport (global // x);
+    builtins = builtins // {
+      inherit (global) import scopedImport;
+      readFile = path: builtins.trace "depot-scan '${toString path}'" (builtins.readFile path);
+      readDir = path: builtins.trace "depot-scan '${toString path}'" (builtins.readDir path);
+    };
+  };
+
+in
+global.import
diff --git a/users/edef/keys.nix b/users/edef/keys.nix
new file mode 100644
index 000000000000..53e88c9e7345
--- /dev/null
+++ b/users/edef/keys.nix
@@ -0,0 +1,7 @@
+{ ... }:
+
+{
+  all = [
+    "cert-authority ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCvb/7ojfcbKvHIyjnrNUOOgzy44tCkgXY9HLuyFta1jQOE9pFIK19B4dR9bOglPKf145CCL0mSFJNNqmNwwavU2uRn+TQrW+U1dQAk8Gt+gh3O49YE854hwwyMU+xD6bIuUdfxPr+r5al/Ov5Km28ZMlHOs3FoAP0hInK+eAibioxL5rVJOtgicrOVCkGoXEgnuG+LRbOYTwzdClhRUxiPjK8alCbcJQ53AeZHO4G6w9wTr+W5ILCfvW4OmUXCX01sKzaBiQuuFCF6M/H4LlnsPWLMra2twXxkOIhZblwC+lncps9lQaUgiD4koZeOCORvHW00G0L39ilFbbnVcL6Itp/m8RRWm/xRxS4RMnsdV/AhvpRLrhL3lfQ7E2oCeSM36v1S9rdg6a47zcnpL+ahG76Gz39Y7KmVRQciNx7ezbwxj3Q5lZtFykgdfGIAN+bT8ijXMO6m68g60i9Bz4IoMZGkiJGqMYLTxMQ+oRgR3Ro5lbj7E11YBHyeimoBYXYGHMkiuxopQZ7lIj3plxIzhmUlXJBA4jMw9KGHdYaLhaicIYhvQmCTAjrkt2HvxEe6lU8iws2Qv+pB6tAGundN36RVVWAckeQPZ4ZsgDP8V2FfibZ1nsrQ+zBKqaslYMAHs01Cf0Hm0PnCqagf230xaobu0iooNuXx44QKoDnB+w== openpgp:0x803010E7"
+  ];
+}