| Age | Commit message (Collapse) | Author |
|---|
|
This happens in the vfs permissions check only and stale data appears to never reach userspace.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This enables transparently degradable tests to be forced on in environments known to support them.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is much more robust than a shell script.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This proof-of-concept was abandoned long ago. Its test suite is flaky, heavy on I/O and does not increase test coverage. This change fully removes hpkg and supporting code.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This used to be impossible due to nix jank which has been addressed.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Turns out this did not work because in the vm test harness, virtualisation.fileSystems completely and silently overrides fileSystems, causing its contents to not even be evaluated anymore. This is not documented as far as I can tell, and is not obvious by any stretch of the imagination. The current hack is cargo culted from nix-community/impermanence and hopefully lasts until this project fully replaces nix.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is for passing files between applications, similar to android /sdcard.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This generates warnings when compiling without optimisation.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
NixOS 25.11 introduces a crash in cage and an intermittent crash in foot.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Clang is better than gcc in various ways. This also pulls in clang-format which is very helpful.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
While it is unlikely a use case for hakurei on i686 exists, it does not hurt to have this support.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
The vm state is discarded often, and it is quite cumbersome to set everything up again when the shell history is gone.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is useful for quickly spinning up an ephemeral hakurei environment for testing changes or reproducing vm test failures.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Planterette is now developed in another repository, so rename this proof of concept to avoid confusion.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This uses the Go map and is verified against libseccomp.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
The script is from Go source of same name. The result is checked against libseccomp.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Remove special case and invoke hakurei out of process.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Fortify makes little sense for a container tool.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This should eventually replace bwrap.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is usable on nixos now due to the static build.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Tests for fpkg is going to be in ./cmd/fpkg, so this central tests directory is no longer necessary.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This appears to be the only way to build them with different configuration. This enables static linking in the main package.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
For adding tests for fpkg.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Rulesets adapted from Flatpak for compatibility.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
In a typical Nix or NixOS-based setup, the entire /nix/store directory is available to the sandbox.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This takes some metadata, sandbox options, a launch script and a list of home-manager modules. The result needs to be executed in an environment with nix daemon access, and it produces the final package file.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Nix build environment does not support ACLs in any filesystem. This allows acl tests to run.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Adapted from nixos sway integration tests.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Reduce rebuilds during development on my system.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Contains path to fortify, set at compile time, authenticates based on a simple uid range assignment file which also acts as the allow list.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
This change makes it possible to start a devShell when tests aren't passing.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
