aboutsummaryrefslogtreecommitdiffhomepage
path: root/flake.nix
AgeCommit message (Collapse)Author
2025-11-05container: add 386 constantsOphestra
While it is unlikely a use case for hakurei on i686 exists, it does not hurt to have this support. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-08-08test/interactive: helper scripts for tracingOphestra
The vm state is discarded often, and it is quite cumbersome to set everything up again when the shell history is gone. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-08-07nix: interactive nixos vmOphestra
This is useful for quickly spinning up an ephemeral hakurei environment for testing changes or reproducing vm test failures. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-07-31cmd/hpkg: rename from planteretteOphestra
Planterette is now developed in another repository, so rename this proof of concept to avoid confusion. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-07-07nix: cross-platform syscall wrapperOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-07-01sandbox/seccomp: implement syscall lookupOphestra
This uses the Go map and is verified against libseccomp. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-06-26sandbox/seccomp: syscall name lookup tableOphestra
The script is from Go source of same name. The result is checked against libseccomp. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-06-25cmd/planterette: remove hsu special caseOphestra
Remove special case and invoke hakurei out of process. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-06-25treewide: rename to hakureiOphestra
Fortify makes little sense for a container tool. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-06-05nix: update flake lockOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-30test: separate app and sandboxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-25helper: remove bubblewrap wrapperOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17nix: clean up flake outputsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14ldd: run in native sandboxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-13sandbox: native container toolingOphestra
This should eventually replace bwrap. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-10nix: update flake lockOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-28nix: increase nixfmt max widthOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26cmd/fpkg/test: nixos test fpkg install/startOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26nix: wrap fpkgOphestra
This is usable on nixos now due to the static build. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-25nix: include fsu sources in dist buildOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-23nix: clean up directory structureOphestra
Tests for fpkg is going to be in ./cmd/fpkg, so this central tests directory is no longer necessary. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-23nix: separate fsu from packageOphestra
This appears to be the only way to build them with different configuration. This enables static linking in the main package. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-21cmd/fpkg: rename buildPackage fileOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-21nix: split integration testOphestra
For adding tests for fpkg. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-16nix: run integration tests with race detectorOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-20proc/priv/shim: seccomp bpf filter via libseccompOphestra
Rulesets adapted from Flatpak for compatibility. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-17nix: do not force static linking on nixOphestra
In a typical Nix or NixOS-based setup, the entire /nix/store directory is available to the sandbox. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-16fortify: switch to static linkingOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-29nix: remove unused argument 'self'Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-29nix: rename fortifyBundle to buildPackageOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-29nix: generate application package build scriptOphestra
This takes some metadata, sandbox options, a launch script and a list of home-manager modules. The result needs to be executed in an environment with nix daemon access, and it produces the final package file. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-17nix: run Go tests in nixosOphestra Umiker
Nix build environment does not support ACLs in any filesystem. This allows acl tests to run. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-16nix: permissive defaults nixos testOphestra Umiker
Adapted from nixos sway integration tests. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-16nix: implement flake checksOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-06nix: track nixos stable 24.11Ophestra Umiker
Reduce rebuilds during development on my system. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-19nix: update options docOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-28fsu: implement simple setuid user switcherOphestra Umiker
Contains path to fortify, set at compile time, authenticates based on a simple uid range assignment file which also acts as the allow list. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-17nix: remove fortify package from default devShellOphestra Umiker
This change makes it possible to start a devShell when tests aren't passing. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-09-28dbus: add testsOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-09-22nix: remove obnoxious shell hookOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-09-17nix: include package buildInputs in devShellsOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-09-04nix: implement nixos moduleOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-09-04rename to fortify and restructureOphestra Umiker
More sandbox features will be added and this will no longer track ego's features and behaviour. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-07-16license: embed license in executableOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-07-16nix: build directly with buildGoModulesOphestra Umiker
Since we have no dependencies, we don't need a vendor hash, so doing this actually makes sense. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-07-15nix: add libxcb package to dev shellOphestra Umiker
Since we link libxcb as well now this is needed in the dev shell for it to build properly without impure. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-07-11nix: set up devShellOphestra Umiker
Since we're using cgo to call into libacl a few dependencies other than go are required to build. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-29 23:50:42 +0000