diff options
| -rw-r--r-- | flake.nix | 100 | ||||
| -rw-r--r-- | nixos.nix | 3 | ||||
| -rw-r--r-- | options.nix | 15 | ||||
| -rw-r--r-- | package.nix | 13 | ||||
| -rw-r--r-- | test/default.nix | 18 |
5 files changed, 55 insertions, 94 deletions
@@ -27,7 +27,7 @@ nixpkgsFor = forAllSystems (system: import nixpkgs { inherit system; }); in { - nixosModules.fortify = import ./nixos.nix; + nixosModules.fortify = import ./nixos.nix self.packages; buildPackage = forAllSystems ( system: @@ -105,9 +105,21 @@ default = fortify; fortify = pkgs.pkgsStatic.callPackage ./package.nix { inherit (pkgs) + # passthru.buildInputs + go + gcc + + # nativeBuildInputs + pkg-config + wayland-scanner + makeBinaryWrapper + + # appPackages + glibc bubblewrap xdg-dbus-proxy - glibc + + # fpkg zstd gnutar coreutils @@ -115,7 +127,7 @@ }; fsu = pkgs.callPackage ./cmd/fsu/package.nix { inherit (self.packages.${system}) fortify; }; - dist = pkgs.runCommand "${fortify.name}-dist" { inherit (self.devShells.${system}.default) buildInputs; } '' + dist = pkgs.runCommand "${fortify.name}-dist" { buildInputs = fortify.targetPkgs ++ [ pkgs.pkgsStatic.musl ]; } '' # go requires XDG_CACHE_HOME for the build cache export XDG_CACHE_HOME="$(mktemp -d)" @@ -128,93 +140,21 @@ export FORTIFY_VERSION="v${fortify.version}" ./dist/release.sh && mkdir $out && cp -v "dist/fortify-$FORTIFY_VERSION.tar.gz"* $out ''; - - fhs = pkgs.buildFHSEnv { - pname = "fortify-fhs"; - inherit (fortify) version; - targetPkgs = - pkgs: - with pkgs; - [ - go - gcc - pkg-config - wayland-scanner - ] - ++ ( - with pkgs.pkgsStatic; - [ - musl - libffi - libseccomp - acl - wayland - wayland-protocols - ] - ++ (with xorg; [ - libxcb - libXau - libXdmcp - - xorgproto - ]) - ); - extraOutputsToInstall = [ "dev" ]; - profile = '' - export PKG_CONFIG_PATH="/usr/share/pkgconfig:$PKG_CONFIG_PATH" - ''; - }; } ); devShells = forAllSystems ( system: let - inherit (self.packages.${system}) fortify fhs; + inherit (self.packages.${system}) fortify; pkgs = nixpkgsFor.${system}; in { - default = pkgs.mkShell { - buildInputs = - with pkgs; - [ - go - gcc - ] - # buildInputs - ++ ( - with pkgsStatic; - [ - musl - libffi - libseccomp - acl - wayland - wayland-protocols - ] - ++ (with xorg; [ - libxcb - libXau - libXdmcp - ]) - ) - # nativeBuildInputs - ++ [ - pkg-config - wayland-scanner - makeBinaryWrapper - ]; - }; - - fhs = fhs.env; - - withPackage = nixpkgsFor.${system}.mkShell { - buildInputs = [ self.packages.${system}.fortify ] ++ self.devShells.${system}.default.buildInputs; - }; + default = pkgs.mkShell { buildInputs = fortify.targetPkgs; }; + withPackage = pkgs.mkShell { buildInputs = [ fortify ] ++ fortify.targetPkgs; }; generateDoc = let - pkgs = nixpkgsFor.${system}; inherit (pkgs) lib; doc = @@ -223,7 +163,7 @@ specialArgs = { inherit pkgs; }; - modules = [ ./options.nix ]; + modules = [ (import ./options.nix self.packages) ]; }; cleanEval = lib.filterAttrsRecursive (n: _: n != "_module") eval; in @@ -233,7 +173,7 @@ sed -i '/*Declared by:*/,+1 d' $out ''; in - nixpkgsFor.${system}.mkShell { + pkgs.mkShell { shellHook = '' exec cat ${docText} > options.md ''; @@ -1,3 +1,4 @@ +packages: { lib, pkgs, @@ -26,7 +27,7 @@ let in { - imports = [ ./options.nix ]; + imports = [ (import ./options.nix packages) ]; config = mkIf cfg.enable { security.wrappers.fsu = { diff --git a/options.nix b/options.nix index 5bad55d7..d9ccfb7a 100644 --- a/options.nix +++ b/options.nix @@ -1,17 +1,8 @@ +packages: { lib, pkgs, ... }: let inherit (lib) types mkOption mkEnableOption; - fortify = pkgs.pkgsStatic.callPackage ./package.nix { - inherit (pkgs) - bubblewrap - xdg-dbus-proxy - glibc - zstd - gnutar - coreutils - ; - }; in { @@ -21,13 +12,13 @@ in package = mkOption { type = types.package; - default = fortify; + default = packages.${pkgs.system}.fortify; description = "The fortify package to use."; }; fsuPackage = mkOption { type = types.package; - default = pkgs.callPackage ./cmd/fsu/package.nix { inherit fortify; }; + default = packages.${pkgs.system}.fsu; description = "The fsu package to use."; }; diff --git a/package.nix b/package.nix index 3088ec3e..5169beaf 100644 --- a/package.nix +++ b/package.nix @@ -19,6 +19,10 @@ gnutar, coreutils, + # for passthru.buildInputs + go, + gcc, + glibc, # for ldd withStatic ? stdenv.hostPlatform.isStatic, }: @@ -108,4 +112,13 @@ buildGoModule rec { ) } ''; + + passthru.targetPkgs = + [ + go + gcc + xorg.xorgproto + ] + ++ buildInputs + ++ nativeBuildInputs; } diff --git a/test/default.nix b/test/default.nix index 068ca709..d53dcfca 100644 --- a/test/default.nix +++ b/test/default.nix @@ -1,6 +1,7 @@ { lib, nixosTest, + buildFHSEnv, writeShellScriptBin, system, @@ -12,6 +13,21 @@ nixosTest { name = "fortify" + (if withRace then "-race" else ""); nodes.machine = { options, pkgs, ... }: + let + fhs = + let + fortify = options.environment.fortify.package.default; + in + buildFHSEnv { + pname = "fortify-fhs"; + inherit (fortify) version; + targetPkgs = _: fortify.targetPkgs; + extraOutputsToInstall = [ "dev" ]; + profile = '' + export PKG_CONFIG_PATH="/usr/share/pkgconfig:$PKG_CONFIG_PATH" + ''; + }; + in { environment.systemPackages = [ # For go tests: @@ -21,7 +37,7 @@ nixosTest { cp -r "${self.packages.${system}.fortify.src}" "$WORK" chmod -R +w "$WORK" cd "$WORK" - ${self.packages.${system}.fhs}/bin/fortify-fhs -c \ + ${fhs}/bin/fortify-fhs -c \ 'go generate ./... && go test ${if withRace then "-race" else "-count 16"} ./... && touch /tmp/go-test-ok' '') ]; |