mokhtar
22abcd9b7b
flake.nix fetches the release tarballs and carries their SRI hashes in a generated block. The cut tool builds the release locally with the toolchain gates.yml pins, in a normalized nine-variable environment, writes the hashes into flake.nix, and commits it with build.zig.zon as the single bump commit. The package job verifies the pins on the bump commit and the publish job verifies them again on the tag, before anything is uploaded. The tarballs are written by dist_stage (std.tar.Writer, flate gzip) instead of the runner's tar and gzip, and -ffile-prefix-map keeps checkout paths out of the C objects; two checkouts at different absolute paths produce byte-identical archives. nxdns version, /api/version and the admin footer report the version only: the bump commit cannot know its own sha.
115 lines
3.8 KiB
Nix
115 lines
3.8 KiB
Nix
{
|
|
description = "nxdns: DNS sinkhole with per-client policy groups";
|
|
|
|
inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
|
|
|
outputs =
|
|
{ nixpkgs, ... }:
|
|
let
|
|
# `zig build cut` rewrites the lines between the delimiters by text replacement.
|
|
# BEGIN GENERATED BY zig build cut
|
|
version = "0.0.16";
|
|
hashes = {
|
|
"aarch64-linux" = "sha256-C//3SW4mvRDNF1p+HpPizpTBosPvojNId2tiWPRKu38=";
|
|
"x86_64-linux" = "sha256-xoL2gBqs4+FSm5peGBq/wk+j9CE5W8wDruGfm8xskI4=";
|
|
};
|
|
# END GENERATED BY zig build cut
|
|
|
|
triples = {
|
|
"aarch64-linux" = "aarch64-linux-musl";
|
|
"x86_64-linux" = "x86_64-linux-musl";
|
|
};
|
|
|
|
systems = builtins.attrNames hashes;
|
|
|
|
package =
|
|
system:
|
|
let
|
|
pkgs = nixpkgs.legacyPackages.${system};
|
|
lib = pkgs.lib;
|
|
triple = triples.${system};
|
|
in
|
|
pkgs.stdenv.mkDerivation {
|
|
pname = "nxdns";
|
|
inherit version;
|
|
|
|
src = pkgs.fetchurl {
|
|
url = "https://git.mial.net/mokhtar/nxdns/releases/download/v${version}/nxdns-${version}-${triple}.tar.gz";
|
|
hash = hashes.${system};
|
|
};
|
|
|
|
# Static musl binary: the install check asserts that no interpreter was patched in.
|
|
dontPatchELF = true;
|
|
dontStrip = true;
|
|
|
|
installPhase = ''
|
|
runHook preInstall
|
|
|
|
install -Dm755 nxdns $out/bin/nxdns
|
|
install -Dm644 LICENSE $out/share/doc/nxdns/LICENSE
|
|
install -Dm644 THIRD-PARTY-NOTICES $out/share/doc/nxdns/THIRD-PARTY-NOTICES
|
|
|
|
runHook postInstall
|
|
'';
|
|
|
|
doInstallCheck = true;
|
|
|
|
# GNU readelf prints `INTERP`, not `PT_INTERP`; `${READELF:?}` keeps an unset variable from turning the grep into a pass.
|
|
installCheckPhase = ''
|
|
runHook preInstallCheck
|
|
|
|
# Captured first: piping readelf straight into grep hides its exit
|
|
# status, so a readelf that failed to read the file at all would
|
|
# print nothing, match nothing, and pass as "static".
|
|
if ! segments="$(''${READELF:?} -l "$out/bin/nxdns")"; then
|
|
echo "readelf -l failed on $out/bin/nxdns" >&2
|
|
exit 1
|
|
fi
|
|
if printf '%s' "$segments" | grep -q INTERP; then
|
|
echo "nxdns has an INTERP segment: it is dynamically linked, not static" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! dynamic="$(''${READELF:?} -d "$out/bin/nxdns")"; then
|
|
echo "readelf -d failed on $out/bin/nxdns" >&2
|
|
exit 1
|
|
fi
|
|
if printf '%s' "$dynamic" | grep -q NEEDED; then
|
|
echo "nxdns has DT_NEEDED entries: it links against shared libraries" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! reported="$($out/bin/nxdns version)"; then
|
|
echo "nxdns version exited non-zero: the binary does not run here" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Prefix match: releases before 0.0.17 print a commit sha after the version.
|
|
case "$reported" in
|
|
"nxdns ${version}"*) echo "nxdns version reports: $reported" ;;
|
|
*)
|
|
echo "nxdns version reports '$reported'; expected it to start with 'nxdns ${version}'" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
runHook postInstallCheck
|
|
'';
|
|
|
|
meta = {
|
|
description = "DNS sinkhole with per-client policy groups";
|
|
homepage = "https://git.mial.net/mokhtar/nxdns";
|
|
license = lib.licenses.eupl12;
|
|
mainProgram = "nxdns";
|
|
platforms = systems;
|
|
sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
|
|
};
|
|
};
|
|
in
|
|
{
|
|
packages = nixpkgs.lib.genAttrs systems (system: {
|
|
default = package system;
|
|
});
|
|
};
|
|
}
|