From 3fee6b0be43abb932e3f55181c275e675d5d6ad1 Mon Sep 17 00:00:00 2001
From: Artem Sheremet <dot.doom@gmail.com>
Date: Fri, 10 Jul 2026 13:09:54 +0000
Subject: [PATCH] git-safe-sync package

---
 flake.nix                  | 10 +++++++++
 packages/git-safe-sync.nix | 42 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 packages/git-safe-sync.nix

diff --git a/flake.nix b/flake.nix
index 47e788b..c946b22 100644
--- a/flake.nix
+++ b/flake.nix
@@ -42,6 +42,16 @@
         };
       });
 
+      packages = eachSystem (
+        system:
+        let
+          pkgs = import nixpkgs { inherit system; };
+        in
+        {
+          git-safe-sync = pkgs.callPackage ./packages/git-safe-sync.nix { };
+        }
+      );
+
       devShells = eachSystem (
         system:
         let
diff --git a/packages/git-safe-sync.nix b/packages/git-safe-sync.nix
new file mode 100644
index 0000000..567b9e0
--- /dev/null
+++ b/packages/git-safe-sync.nix
@@ -0,0 +1,42 @@
+{
+  writeShellApplication,
+  git,
+  coreutils,
+}:
+
+writeShellApplication {
+  name = "git-safe-sync";
+  runtimeInputs = [
+    git
+    coreutils
+  ];
+  text = ''
+    set -euo pipefail
+
+    if [ "$#" -lt 2 ]; then
+      echo "Usage: git-safe-sync <repo_url> <target_dir> [clone flags...]" >&2
+      exit 1
+    fi
+
+    REPO_URL="$1"
+    TARGET_DIR="$2"
+    shift 2
+
+    if [ ! -d "$TARGET_DIR" ]; then
+      # Pass any extra flags (like --depth 1) to git clone
+      git clone "$@" "$REPO_URL" "$TARGET_DIR"
+      cd "$TARGET_DIR"
+      if ! git verify-commit HEAD; then
+        echo "Initial clone failed signature verification. Deleting unsafe clone." >&2
+        cd /
+        rm -rf "$TARGET_DIR"
+        exit 1
+      fi
+    else
+      cd "$TARGET_DIR"
+      git fetch origin
+      BRANCH=$(git rev-parse --abbrev-ref HEAD)
+      git merge --ff-only --verify-signatures origin/"$BRANCH"
+    fi
+  '';
+}