diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-01-17 22:56:16 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-01-17 22:56:16 +0900 |
| commit | c4de45021759e9c384485a451dfdf9c1d73f04ea (patch) | |
| tree | aeff30eccc26ae03374212dca610bd03f1cc58cc | |
| parent | b60c01f4405ec3b5cc4a740fe994c3b9f39cf01f (diff) | |
nix: do not force static linking on nix
In a typical Nix or NixOS-based setup, the entire /nix/store directory is available to the sandbox.
Signed-off-by: Ophestra <cat@gensokyo.uk>
| -rw-r--r-- | flake.nix | 24 | ||||
| -rw-r--r-- | package.nix | 13 |
2 files changed, 29 insertions, 8 deletions
@@ -166,8 +166,28 @@ go gcc ] - ++ fortify.buildInputs - ++ fortify.nativeBuildInputs; + # buildInputs + ++ ( + with pkgsStatic; + [ + musl + libffi + acl + wayland + wayland-protocols + ] + ++ (with xorg; [ + libxcb + libXau + libXdmcp + ]) + ) + # nativeBuildInputs + ++ [ + pkg-config + wayland-scanner + makeBinaryWrapper + ]; }; fhs = fhs.env; diff --git a/package.nix b/package.nix index 85a3859d..0141dda6 100644 --- a/package.nix +++ b/package.nix @@ -1,11 +1,16 @@ { lib, buildGoModule, + makeBinaryWrapper, xdg-dbus-proxy, bubblewrap, - pkgsStatic, pkg-config, + libffi, + acl, + wayland, + wayland-protocols, wayland-scanner, + xorg, }: buildGoModule rec { @@ -27,7 +32,6 @@ buildGoModule rec { ) [ "-s -w" - "-extldflags '-static'" "-X main.Fmain=${placeholder "out"}/libexec/fortify" "-X main.Fshim=${placeholder "out"}/libexec/fshim" ] @@ -42,10 +46,7 @@ buildGoModule rec { GO_TEST_SKIP_ACL = 1; buildInputs = - # cannot find a cleaner way to do this - with pkgsStatic; [ - musl libffi acl wayland @@ -60,7 +61,7 @@ buildGoModule rec { nativeBuildInputs = [ pkg-config wayland-scanner - pkgsStatic.makeBinaryWrapper + makeBinaryWrapper ]; preConfigure = '' |