Onboarding script for Nix + Xcode

devenv-init.sh

#!/bin/zsh
echo "To prepare for later steps, download https://developer.apple.com/services-account/download?path=/Developer_Tools/Xcode_15/Xcode_15.xip to ~/Downloads"
echo "Press enter once you've initiated this download."
vared -c dummy_var

if [ "$RESIZE_VM" = true ]; then
  echo Y | diskutil repairDisk disk0
  diskutil apfs resizeContainer disk0s2 0
fi

if [ ! -f "$HOME/.ssh/id_rsa.pub" ]; then
  HOSTNAME=`hostname` ssh-keygen -t rsa -C "$HOSTNAME" -f "$HOME/.ssh/id_rsa" -P "" > /dev/null
  echo
  echo
  cat "$HOME/.ssh/id_rsa.pub"
  cat "$HOME/.ssh/id_rsa.pub" | pbcopy
  echo
  echo
  echo "Copy the newly-generated public SSH key above (already in paste buffer) and add it to appropriate accounts, e.g.:"
else
  echo
  echo
  cat "$HOME/.ssh/id_rsa.pub"
  cat "$HOME/.ssh/id_rsa.pub" | pbcopy
  echo
  echo
  echo "Found an existing public key. If you want to generate a new one for Bitbucket, please go do so now per Bitbucket instructions."
  echo "If you haven't already, copy the newly-generated public key above (already in paste buffer) and add it to appropriate accounts, e.g.:"
fi
echo " - https://bitbucket.org/account/settings/ssh-keys/"
echo " - https://github.com/settings/keys"
echo
echo "Press enter once your local SSH key has been registered wherever you need it."
vared -c dummy_var
echo

if [ -f "/nix/receipt.json" ]; then
  echo "Nix already appears to be installed."
  echo "Press enter to confirm and continue. Ctrl-C otherwise."
  vared -c dummy_var
  echo
else
  curl -L https://raw.githubusercontent.com/NixOS/experimental-nix-installer/main/nix-installer.sh | sh -s install
  echo "Adding $USER as a trusted nix user."
  echo "trusted-users = root $USER" | sudo tee -a /etc/nix/nix.conf
fi

source /etc/zshrc

if ! command -v direnv &> /dev/null; then
  echo "Installing devenv and supporting packages..."
  nix-env -iA git -f https://github.com/NixOS/nixpkgs/tarball/nixpkgs-unstable
  nix-env -iA devenv -f https://github.com/NixOS/nixpkgs/tarball/nixpkgs-unstable
  nix-env -iA direnv -f https://github.com/NixOS/nixpkgs/tarball/nixpkgs-unstable
  echo 'eval "$(direnv hook zsh)"' >> "$HOME/.zshrc"
fi
echo "Devenv installed."

source "$HOME/.zshrc"

if [ -d "/nix/store/xxc5h3979wq9cm9xwd4hskwi2r3h5qh4-Xcode.app" ]; then
  echo "Xcode already in nix store"
else
  echo
  echo "Due to licensing and authentication issues, Xcode must be downloaded manually."
  echo "Download https://developer.apple.com/services-account/download?path=/Developer_Tools/Xcode_15/Xcode_15.xip to ~/Downloads"
  echo "This script will resume once Xcode is downloaded to the proper directory."
  while [ ! -f "$HOME/Downloads/Xcode_15.xip" ]; do
    sleep 1
  done
  cd "$HOME/Downloads"
  echo "Extracting Xcode..."
  open -W Xcode_15.xip
  rm -rf Xcode_15.xip
  echo
  echo "Adding Xcode to nix store. This will take several minutes..."
  nixXcodeAppPath="$(nix-store --add-fixed --recursive sha256 Xcode.app)"
  echo "Done adding Xcode to nix store"
  rm -rf Xcode.app
  echo "Using Xcode path: ${nixXcodeAppPath}"
  sudo xcode-select --switch "${nixXcodeAppPath}"
  sudo xcodebuild -license accept
  xcodebuild -downloadAllPlatforms
  xcodebuild -runFirstLaunch
  curl -o AppleWWDRCAG3.cer https://www.apple.com/certificateauthority/AppleWWDRCAG3.cer
  curl -o DeveloperIDG2CA.cer https://www.apple.com/certificateauthority/DeveloperIDG2CA.cer
  curl -o add-certificate.swift https://raw.githubusercontent.com/actions/runner-images/fb3b6fd69957772c1596848e2daaec69eabca1bb/images/macos/provision/configuration/add-certificate.swift
  swiftc -suppress-warnings add-certificate.swift
  sudo ./add-certificate AppleWWDRCAG3.cer
  sudo ./add-certificate DeveloperIDG2CA.cer
  rm add-certificate* *.cer
fi
echo "Done! Before building for iOS, please make sure you: "
echo " 1) Download all necessary provisioning profiles from the developer portal"
echo " 2) Generate and/or load into the keychain any applicable development or distribution keypairs"

Installation instructions:
If in tart VM:

export RESIZE_VM=true

then:

curl -L https://gist.githubusercontent.com/kiltyj/e8801f5c0be2e2718f4a2a5d3d3b5087/raw | zsh