compile all linux platforms for key agent (#156)

.github/workflows/build.yml

···
         with:
           concurrent_skipping: "same_content_newer"
           cancel_others: "true"
+  agent:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        system: ["x86_64-linux", "aarch64-linux"]
+    needs: pre-job
+    if: needs.pre-job.outputs.should_skip != 'true'
+    steps:
+      - uses: actions/checkout@v4
+      - run: sudo apt-get install -y qemu-user-static
+      - uses: cachix/install-nix-action@v31
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+          extra_nix_config: |
+            system = ${{ matrix.system }}
+      - uses: cachix/cachix-action@v16
+        with:
+          name: wires
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+      - run: nix build .#agent
   build:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         package: [wire, docs]
-    needs: pre-job
+    needs: agent
     if: needs.pre-job.outputs.should_skip != 'true'
     steps:
       - uses: actions/checkout@v4

CHANGELOG.md

···
 
 - Dependency Updates.
 
+### Fixed
+
+- Not bundling the key agent for all supported target platforms.
+
 ## [0.2.0] - 2025-04-21
 
 ### Added

doc/default.nix

···
       ...
     }:
     {
-      packages.docs = pkgs.callPackage ./package.nix { inherit (self'.packages) wire; };
+      packages.docs = pkgs.callPackage ./package.nix { inherit (self'.packages) wire-small; };
     };
 }

doc/package.nix

···
   lib,
   nixosOptionsDoc,
   runCommand,
-  wire,
+  wire-small,
   nix,
   nodejs,
   pnpm,
···
   inherit (pkg) version;
   pname = pkg.name;
   nativeBuildInputs = [
-    wire
+    wire-small
     nodejs
     pnpm.configHook
     nix

flake.lock

···
         "type": "github"
       }
     },
+    "linux-systems": {
+      "locked": {
+        "lastModified": 1689347949,
+        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
+        "owner": "nix-systems",
+        "repo": "default-linux",
+        "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default-linux",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1730768919,
···
         "flake-compat": "flake-compat",
         "flake-parts": "flake-parts",
         "git-hooks": "git-hooks",
+        "linux-systems": "linux-systems",
         "nixpkgs": "nixpkgs_2",
         "systems": "systems",
         "treefmt-nix": "treefmt-nix"

flake.nix

···
     fenix.url = "github:nix-community/fenix";
     fenix.inputs.nixpkgs.follows = "nixpkgs";
     treefmt-nix.url = "github:numtide/treefmt-nix";
+
+    # determines systems available for deployment
+    linux-systems.url = "github:nix-systems/default-linux";
   };
   outputs =
     {

runtime/module.nix

···
       readOnly = true;
     };
 
+    _hostPlatform = lib.mkOption {
+      internal = true;
+      readOnly = true;
+    };
+
     keys = lib.mkOption {
       type = types.attrsOf (
         types.submodule (
···
   };
 
   config = {
-    deployment._keys = lib.mapAttrsToList (
-      _: value:
-      value
-      // {
-        source = {
-          # Attach type to internally tag serde enum
-          t = builtins.replaceStrings [ "path" "string" "list" ] [ "Path" "String" "Command" ] (
-            builtins.typeOf value.source
-          );
-          c = value.source;
-        };
-      }
-    ) config.deployment.keys;
+    deployment = {
+      _keys = lib.mapAttrsToList (
+        _: value:
+        value
+        // {
+          source = {
+            # Attach type to internally tag serde enum
+            t = builtins.replaceStrings [ "path" "string" "list" ] [ "Path" "String" "Command" ] (
+              builtins.typeOf value.source
+            );
+            c = value.source;
+          };
+        }
+      ) config.deployment.keys;
+
+      _hostPlatform = config.nixpkgs.hostPlatform.system;
+    };
   };
 }

tests/nix/default.nix

···
             inherit testName;
             snakeOil = import "${pkgs.path}/nixos/tests/ssh-keys.nix" pkgs;
             inherit (opts) testDir;
-            inherit (self'.packages) wire;
+            inherit (self'.packages) wire-small;
           };
           # NOTE: there is surely a better way of doing this in a more
           # "controlled" manner, but until a need is asked for, this will remain

tests/nix/test-opts.nix

···
 {
   lib,
   snakeOil,
-  wire,
+  wire-small,
   config,
   ...
 }:
···
       systemd.tmpfiles.rules = [
         "C+ /root/.ssh/id_ed25519 600 - - - ${snakeOil.snakeOilEd25519PrivateKey}"
       ];
-      environment.systemPackages = [ wire ];
+      environment.systemPackages = [ wire-small ];
       # It's important to note that you should never ever use this configuration
       # for production. You are risking a MITM attack with this!
       programs.ssh.extraConfig = ''

wire/cli/default.nix

···
+{ getSystem, inputs, ... }:
 {
   perSystem =
     {
       pkgs,
+      lib,
       self',
       buildRustProgram,
+      system,
       ...
     }:
+    let
+      postBuild = ''
+        wrapProgram $out/bin/wire \
+                    --set WIRE_RUNTIME ${../../runtime} \
+                    --set WIRE_KEY_AGENT ${self'.packages.agent} \
+      '';
+      cleanSystem = system: lib.replaceStrings [ "-" ] [ "_" ] system;
+      agents = lib.strings.concatMapStrings (
+        system: "--set WIRE_KEY_AGENT_${cleanSystem system} ${(getSystem system).packages.agent} "
+      ) (import inputs.linux-systems);
+    in
     {
       packages = {
         default = self'.packages.wire;
···
             pkgs.makeWrapper
           ];
           postBuild = ''
-            wrapProgram $out/bin/wire \
-                --set WIRE_RUNTIME ${../../runtime} \
-                --set WIRE_KEY_AGENT ${self'.packages.agent}
+            ${postBuild} ${agents}
+          '';
+          meta.mainProgram = "wire";
+        };
+
+        wire-small = pkgs.symlinkJoin {
+          name = "wire";
+          paths = [ self'.packages.wire-unwrapped ];
+          nativeBuildInputs = [
+            pkgs.makeWrapper
+          ];
+          postBuild = ''
+            ${postBuild} --set WIRE_KEY_AGENT_${cleanSystem system} ${self'.packages.agent}
           '';
           meta.mainProgram = "wire";
         };

wire/lib/src/hive/key.rs

···
     }
 
     async fn execute(&self, ctx: &mut Context<'_>) -> Result<(), HiveLibError> {
-        let agent_directory = match env::var_os("WIRE_KEY_AGENT") {
+        let arg_name = format!(
+            "WIRE_KEY_AGENT_{platform}",
+            platform = ctx.node.host_platform.replace('-', "_")
+        );
+
+        let agent_directory = match env::var_os(&arg_name) {
             Some(agent) => agent.into_string().unwrap(),
-            None => panic!("WIRE_KEY_AGENT environment variable not set"),
+            None => panic!(
+                "{arg_name} environment variable not set! \n
+                Wire was not built with the ability to deploy keys to this platform. \n
+                Please create an issue: https://github.com/wires-org/wire/issues/new?template=bug_report.md"
+            ),
         };
 
         push(ctx.node, ctx.name, Push::Path(&agent_directory)).await?;

wire/lib/src/hive/node.rs

···
 
     #[serde(rename(deserialize = "_keys", serialize = "keys"))]
     pub keys: im::Vector<Key>,
+
+    #[serde(rename(deserialize = "_hostPlatform", serialize = "host_platform"))]
+    pub host_platform: Arc<str>,
 }
 
 #[cfg(test)]
···
             tags: im::HashSet::new(),
             allow_local_deployment: true,
             build_remotely: false,
+            host_platform: "x86_64-linux".into(),
         }
     }
 }