···204204205205In Nixpkgs, there are generally three different names associated with a package:
206206207207-- The `name` attribute of the derivation (excluding the version part). This is what most users see, in particular when using `nix-env`.
207207+- The `pname` attribute of the derivation. This is what most users see, in particular when using `nix-env`.
208208209209- The variable name used for the instantiated package in `all-packages.nix`, and when passing it as a dependency to other functions. Typically this is called the _package attribute name_. This is what Nix expression authors see. It can also be used when installing using `nix-env -iA`.
210210211211- The filename for (the directory containing) the Nix expression.
212212213213-Most of the time, these are the same. For instance, the package `e2fsprogs` has a `name` attribute `"e2fsprogs-version"`, is bound to the variable name `e2fsprogs` in `all-packages.nix`, and the Nix expression is in `pkgs/os-specific/linux/e2fsprogs/default.nix`.
213213+Most of the time, these are the same. For instance, the package `e2fsprogs` has a `pname` attribute `"e2fsprogs"`, is bound to the variable name `e2fsprogs` in `all-packages.nix`, and the Nix expression is in `pkgs/os-specific/linux/e2fsprogs/default.nix`.
214214215215There are a few naming guidelines:
216216
···137137 - `services.openssh.logLevel` to `services.openssh.settings.LogLevel`
138138 - `services.openssh.kexAlgorithms` to `services.openssh.settings.KexAlgorithms`
139139 - `services.openssh.macs` to `services.openssh.settings.Macs`
140140- - `services.openssh.cyphers` to `services.openssh.settings.Cyphers`
140140+ - `services.openssh.ciphers` to `services.openssh.settings.Ciphers`
141141 - `services.openssh.gatewayPorts` to `services.openssh.settings.GatewayPorts`
142142143143- `services.mastodon` gained a tootctl wrapped named `mastodon-tootctl` similar to `nextcloud-occ` which can be executed from any user and switches to the configured mastodon user with sudo and sources the environment variables.
+1-1
nixos/lib/make-options-doc/default.nix
···7878 title = args.title or null;
7979 name = args.name or (lib.concatStringsSep "." args.path);
8080 in ''
8181- - [`${lib.optionalString (title != null) "${title} aka "}pkgs.${name}`](
8181+ - [${lib.optionalString (title != null) "${title} aka "}`pkgs.${name}`](
8282 https://search.nixos.org/packages?show=${name}&sort=relevance&query=${name}
8383 )${
8484 lib.optionalString (args ? comment) "\n\n ${args.comment}"
···8686 description = lib.mdDoc "Proxy DNS requests - no leak for DNS data.";
8787 };
88888989- quietMode = mkEnableOption (lib.mdDoc "Quiet mode (no output from the library).");
8989+ quietMode = mkEnableOption (lib.mdDoc "Quiet mode (no output from the library)");
90909191 remoteDNSSubnet = mkOption {
9292 type = types.enum [ 10 127 224 ];
+1-1
nixos/modules/security/polkit.nix
···14141515 security.polkit.enable = mkEnableOption (lib.mdDoc "polkit");
16161717- security.polkit.debug = mkEnableOption (lib.mdDoc "debug logs from polkit. This is required in order to see log messages from rule definitions.");
1717+ security.polkit.debug = mkEnableOption (lib.mdDoc "debug logs from polkit. This is required in order to see log messages from rule definitions");
18181919 security.polkit.extraConfig = mkOption {
2020 type = types.lines;
···2727 options = {
28282929 services.gnome.evolution-data-server = {
3030- enable = mkEnableOption (lib.mdDoc "Evolution Data Server, a collection of services for storing addressbooks and calendars.");
3030+ enable = mkEnableOption (lib.mdDoc "Evolution Data Server, a collection of services for storing addressbooks and calendars");
3131 plugins = mkOption {
3232 type = types.listOf types.package;
3333 default = [ ];
···3535 };
3636 };
3737 programs.evolution = {
3838- enable = mkEnableOption (lib.mdDoc "Evolution, a Personal information management application that provides integrated mail, calendaring and address book functionality.");
3838+ enable = mkEnableOption (lib.mdDoc "Evolution, a Personal information management application that provides integrated mail, calendaring and address book functionality");
3939 plugins = mkOption {
4040 type = types.listOf types.package;
4141 default = [ ];
+1-1
nixos/modules/services/development/zammad.nix
···28282929 options = {
3030 services.zammad = {
3131- enable = mkEnableOption (lib.mdDoc "Zammad, a web-based, open source user support/ticketing solution.");
3131+ enable = mkEnableOption (lib.mdDoc "Zammad, a web-based, open source user support/ticketing solution");
32323333 package = mkOption {
3434 type = types.package;
+1-1
nixos/modules/services/games/freeciv.nix
···5454 default = 0;
5555 description = lib.mdDoc "Set debug log level.";
5656 };
5757- options.exit-on-end = mkEnableOption (lib.mdDoc "exit instead of restarting when a game ends.");
5757+ options.exit-on-end = mkEnableOption (lib.mdDoc "exit instead of restarting when a game ends");
5858 options.Guests = mkEnableOption (lib.mdDoc "guests to login if auth is enabled");
5959 options.Newusers = mkEnableOption (lib.mdDoc "new users to login if auth is enabled");
6060 options.port = mkOption {
+1-1
nixos/modules/services/hardware/udisks2.nix
···19192020 services.udisks2 = {
21212222- enable = mkEnableOption (lib.mdDoc "udisks2, a DBus service that allows applications to query and manipulate storage devices.");
2222+ enable = mkEnableOption (lib.mdDoc "udisks2, a DBus service that allows applications to query and manipulate storage devices");
23232424 settings = mkOption rec {
2525 type = types.attrsOf settingsFormat.type;
+7-7
nixos/modules/services/mail/dovecot.nix
···171171 options.services.dovecot2 = {
172172 enable = mkEnableOption (lib.mdDoc "the dovecot 2.x POP3/IMAP server");
173173174174- enablePop3 = mkEnableOption (lib.mdDoc "starting the POP3 listener (when Dovecot is enabled).");
174174+ enablePop3 = mkEnableOption (lib.mdDoc "starting the POP3 listener (when Dovecot is enabled)");
175175176176- enableImap = mkEnableOption (lib.mdDoc "starting the IMAP listener (when Dovecot is enabled).") // { default = true; };
176176+ enableImap = mkEnableOption (lib.mdDoc "starting the IMAP listener (when Dovecot is enabled)") // { default = true; };
177177178178- enableLmtp = mkEnableOption (lib.mdDoc "starting the LMTP listener (when Dovecot is enabled).");
178178+ enableLmtp = mkEnableOption (lib.mdDoc "starting the LMTP listener (when Dovecot is enabled)");
179179180180 protocols = mkOption {
181181 type = types.listOf types.str;
···300300 description = lib.mdDoc "Path to the server's private key.";
301301 };
302302303303- enablePAM = mkEnableOption (lib.mdDoc "creating a own Dovecot PAM service and configure PAM user logins.") // { default = true; };
303303+ enablePAM = mkEnableOption (lib.mdDoc "creating a own Dovecot PAM service and configure PAM user logins") // { default = true; };
304304305305- enableDHE = mkEnableOption (lib.mdDoc "enable ssl_dh and generation of primes for the key exchange.") // { default = true; };
305305+ enableDHE = mkEnableOption (lib.mdDoc "enable ssl_dh and generation of primes for the key exchange") // { default = true; };
306306307307 sieveScripts = mkOption {
308308 type = types.attrsOf types.path;
···310310 description = lib.mdDoc "Sieve scripts to be executed. Key is a sequence, e.g. 'before2', 'after' etc.";
311311 };
312312313313- showPAMFailure = mkEnableOption (lib.mdDoc "showing the PAM failure message on authentication error (useful for OTPW).");
313313+ showPAMFailure = mkEnableOption (lib.mdDoc "showing the PAM failure message on authentication error (useful for OTPW)");
314314315315 mailboxes = mkOption {
316316 type = with types; coercedTo
···326326 description = lib.mdDoc "Configure mailboxes and auto create or subscribe them.";
327327 };
328328329329- enableQuota = mkEnableOption (lib.mdDoc "the dovecot quota service.");
329329+ enableQuota = mkEnableOption (lib.mdDoc "the dovecot quota service");
330330331331 quotaPort = mkOption {
332332 type = types.str;
+1-1
nixos/modules/services/misc/atuin.nix
···88{
99 options = {
1010 services.atuin = {
1111- enable = mkEnableOption (mdDoc "Enable server for shell history sync with atuin.");
1111+ enable = mkEnableOption (mdDoc "Enable server for shell history sync with atuin");
12121313 openRegistration = mkOption {
1414 type = types.bool;
+1-1
nixos/modules/services/misc/input-remapper.nix
···66{
77 options = {
88 services.input-remapper = {
99- enable = mkEnableOption (lib.mdDoc "input-remapper, an easy to use tool to change the mapping of your input device buttons.");
99+ enable = mkEnableOption (lib.mdDoc "input-remapper, an easy to use tool to change the mapping of your input device buttons");
1010 package = mkPackageOptionMD pkgs "input-remapper" { };
1111 enableUdevRules = mkEnableOption (lib.mdDoc "udev rules added by input-remapper to handle hotplugged devices. Currently disabled by default due to https://github.com/sezanzeb/input-remapper/issues/140");
1212 serviceWantedBy = mkOption {
+1-1
nixos/modules/services/misc/sourcehut/default.nix
···438438 };
439439440440 options."lists.sr.ht" = commonServiceSettings "lists" // {
441441- allow-new-lists = mkEnableOption (lib.mdDoc "Allow creation of new lists.");
441441+ allow-new-lists = mkEnableOption (lib.mdDoc "Allow creation of new lists");
442442 notify-from = mkOption {
443443 description = lib.mdDoc "Outgoing email for notifications generated by users.";
444444 type = types.str;
···11111212 # the upstream package runs as root, but doesn't seem to be strictly
1313 # necessary for basic functionality
1414- runAsRoot = mkEnableOption (lib.mdDoc "Whether to run as root.");
1414+ runAsRoot = mkEnableOption (lib.mdDoc "Whether to run as root");
15151616 autoRetirement = mkEnableOption (lib.mdDoc ''
1717 Whether to automatically retire the host upon OS shutdown.
···7788 enable = mkEnableOption (lib.mdDoc "hledger-web service");
991010- serveApi = mkEnableOption (lib.mdDoc "Serve only the JSON web API, without the web UI.");
1010+ serveApi = mkEnableOption (lib.mdDoc "Serve only the JSON web API, without the web UI");
11111212 host = mkOption {
1313 type = types.str;
···106106 description = lib.mdDoc ''
107107 Extra custom layouts that will be included in the xkb configuration.
108108 Information on how to create a new layout can be found here:
109109- [](https://www.x.org/releases/current/doc/xorg-docs/input/XKB-Enhancing.html#Defining_New_Layouts).
109109+ <https://www.x.org/releases/current/doc/xorg-docs/input/XKB-Enhancing.html#Defining_New_Layouts>.
110110 For more examples see
111111- [](https://wiki.archlinux.org/index.php/X_KeyBoard_extension#Basic_examples)
111111+ <https://wiki.archlinux.org/index.php/X_KeyBoard_extension#Basic_examples>
112112 '';
113113 };
114114
···2020 ###### interface
21212222 options = {
2323- boot.kernel.enable = mkEnableOption (lib.mdDoc "the Linux kernel. This is useful for systemd-like containers which do not require a kernel.") // {
2323+ boot.kernel.enable = mkEnableOption (lib.mdDoc "the Linux kernel. This is useful for systemd-like containers which do not require a kernel") // {
2424 default = true;
2525 };
2626
···11+{ stdenv
22+, lib
33+, makeWrapper
44+, socat
55+, iptables
66+, iproute2
77+, bridge-utils
88+, btrfs-progs
99+, conntrack-tools
1010+, buildGoModule
1111+, runc
1212+, rsync
1313+, kmod
1414+, libseccomp
1515+, pkg-config
1616+, ethtool
1717+, util-linux
1818+, fetchFromGitHub
1919+, fetchurl
2020+, fetchzip
2121+, fetchgit
2222+, zstd
2323+, yq-go
2424+, nixosTests
2525+, k3s
2626+, pkgsBuildBuild
2727+}:
2828+2929+with lib;
3030+3131+# k3s is a kinda weird derivation. One of the main points of k3s is the
3232+# simplicity of it being one binary that can perform several tasks.
3333+# However, when you have a good package manager (like nix), that doesn't
3434+# actually make much of a difference; you don't really care if it's one binary
3535+# or 10 since with a good package manager, installing and running it is
3636+# identical.
3737+# Since upstream k3s packages itself as one large binary with several
3838+# "personalities" (in the form of subcommands like 'k3s agent' and 'k3s
3939+# kubectl'), it ends up being easiest to mostly mimic upstream packaging, with
4040+# some exceptions.
4141+# K3s also carries patches to some packages (such as containerd and cni
4242+# plugins), so we intentionally use the k3s versions of those binaries for k3s,
4343+# even if the upstream version of those binaries exist in nixpkgs already. In
4444+# the end, that means we have a thick k3s binary that behaves like the upstream
4545+# one for the most part.
4646+# However, k3s also bundles several pieces of unpatched software, from the
4747+# strongswan vpn software, to iptables, to socat, conntrack, busybox, etc.
4848+# Those pieces of software we entirely ignore upstream's handling of, and just
4949+# make sure they're in the path if desired.
5050+let
5151+ k3sVersion = "1.23.6+k3s1"; # k3s git tag
5252+ k3sCommit = "418c3fa858b69b12b9cefbcff0526f666a6236b9"; # k3s git commit at the above version
5353+ k3sRepoSha256 = "0fmw491dn5mpi058mr7sij51i5m4qg2grx30cnl3h2v4s0sdkx2i";
5454+ k3sVendorSha256 = "sha256-iHg5ySMaiSWXs98YGmxPwdZr4zdBIFma12dNEuf30Hs=";
5555+5656+ # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
5757+ # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
5858+ traefikChartVersion = "10.19.3";
5959+ traefikChartSha256 = "04zg5li957svgscdmkzmzjkwljaljyav68rzxmhakkwgav6q9058";
6060+6161+ # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L47
6262+ k3sRootVersion = "0.11.0";
6363+ k3sRootSha256 = "016n56vi09xkvjph7wgzb2m86mhd5x65fs4d11pmh20hl249r620";
6464+6565+ # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L45
6666+ k3sCNIVersion = "1.0.1-k3s1";
6767+ k3sCNISha256 = "11ihlzzdnqf9p21y0a4ckpbxac016nm7746dcykhj26ym9zxyv92";
6868+6969+ # taken from go.mod, the 'github.com/containerd/containerd' line
7070+ # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
7171+ containerdVersion = "1.5.11-k3s2";
7272+ containerdSha256 = "16132snvrg8r0vwm6c0lz0q6fx686s2ix53nm3aka9a83xs75vf2";
7373+7474+ # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
7575+ criCtlVersion = "1.22.0-k3s1";
7676+7777+ baseMeta = k3s.meta;
7878+7979+ # https://github.com/k3s-io/k3s/blob/5fb370e53e0014dc96183b8ecb2c25a61e891e76/scripts/build#L19-L40
8080+ versionldflags = [
8181+ "-X github.com/rancher/k3s/pkg/version.Version=v${k3sVersion}"
8282+ "-X github.com/rancher/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
8383+ "-X k8s.io/client-go/pkg/version.gitVersion=v${k3sVersion}"
8484+ "-X k8s.io/client-go/pkg/version.gitCommit=${k3sCommit}"
8585+ "-X k8s.io/client-go/pkg/version.gitTreeState=clean"
8686+ "-X k8s.io/client-go/pkg/version.buildDate=1970-01-01T01:01:01Z"
8787+ "-X k8s.io/component-base/version.gitVersion=v${k3sVersion}"
8888+ "-X k8s.io/component-base/version.gitCommit=${k3sCommit}"
8989+ "-X k8s.io/component-base/version.gitTreeState=clean"
9090+ "-X k8s.io/component-base/version.buildDate=1970-01-01T01:01:01Z"
9191+ "-X github.com/kubernetes-sigs/cri-tools/pkg/version.Version=v${criCtlVersion}"
9292+ "-X github.com/containerd/containerd/version.Version=v${containerdVersion}"
9393+ "-X github.com/containerd/containerd/version.Package=github.com/k3s-io/containerd"
9494+ ];
9595+9696+ # bundled into the k3s binary
9797+ traefikChart = fetchurl {
9898+ url = "https://helm.traefik.io/traefik/traefik-${traefikChartVersion}.tgz";
9999+ sha256 = traefikChartSha256;
100100+ };
101101+ # so, k3s is a complicated thing to package
102102+ # This derivation attempts to avoid including any random binaries from the
103103+ # internet. k3s-root is _mostly_ binaries built to be bundled in k3s (which
104104+ # we don't care about doing, we can add those as build or runtime
105105+ # dependencies using a real package manager).
106106+ # In addition to those binaries, it's also configuration though (right now
107107+ # mostly strongswan configuration), and k3s does use those files.
108108+ # As such, we download it in order to grab 'etc' and bundle it into the final
109109+ # k3s binary.
110110+ k3sRoot = fetchzip {
111111+ # Note: marked as apache 2.0 license
112112+ url = "https://github.com/k3s-io/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
113113+ sha256 = k3sRootSha256;
114114+ stripRoot = false;
115115+ };
116116+ k3sCNIPlugins = buildGoModule rec {
117117+ pname = "k3s-cni-plugins";
118118+ version = k3sCNIVersion;
119119+ vendorSha256 = null;
120120+121121+ subPackages = [ "." ];
122122+123123+ src = fetchFromGitHub {
124124+ owner = "rancher";
125125+ repo = "plugins";
126126+ rev = "v${version}";
127127+ sha256 = k3sCNISha256;
128128+ };
129129+130130+ postInstall = ''
131131+ mv $out/bin/plugins $out/bin/cni
132132+ '';
133133+134134+ meta = baseMeta // {
135135+ description = "CNI plugins, as patched by rancher for k3s";
136136+ };
137137+ };
138138+ # Grab this separately from a build because it's used by both stages of the
139139+ # k3s build.
140140+ k3sRepo = fetchgit {
141141+ url = "https://github.com/k3s-io/k3s";
142142+ rev = "v${k3sVersion}";
143143+ sha256 = k3sRepoSha256;
144144+ };
145145+ # Stage 1 of the k3s build:
146146+ # Let's talk about how k3s is structured.
147147+ # One of the ideas of k3s is that there's the single "k3s" binary which can
148148+ # do everything you need, from running a k3s server, to being a worker node,
149149+ # to running kubectl.
150150+ # The way that actually works is that k3s is a single go binary that contains
151151+ # a bunch of bindata that it unpacks at runtime into directories (either the
152152+ # user's home directory or /var/lib/rancher if run as root).
153153+ # This bindata includes both binaries and configuration.
154154+ # In order to let nixpkgs do all its autostripping/patching/etc, we split this into two derivations.
155155+ # First, we build all the binaries that get packed into the thick k3s binary
156156+ # (and output them from one derivation so they'll all be suitably patched up).
157157+ # Then, we bundle those binaries into our thick k3s binary and use that as
158158+ # the final single output.
159159+ # This approach was chosen because it ensures the bundled binaries all are
160160+ # correctly built to run with nix (we can lean on the existing buildGoModule
161161+ # stuff), and we can again lean on that tooling for the final k3s binary too.
162162+ # Other alternatives would be to manually run the
163163+ # strip/patchelf/remove-references step ourselves in the installPhase of the
164164+ # derivation when we've built all the binaries, but haven't bundled them in
165165+ # with generated bindata yet.
166166+167167+ k3sServer = buildGoModule rec {
168168+ pname = "k3s-server";
169169+ version = k3sVersion;
170170+171171+ src = k3sRepo;
172172+ vendorSha256 = k3sVendorSha256;
173173+174174+ nativeBuildInputs = [ pkg-config ];
175175+ buildInputs = [ libseccomp ];
176176+177177+ subPackages = [ "cmd/server" ];
178178+ ldflags = versionldflags;
179179+180180+ # create the multicall symlinks for k3s
181181+ postInstall = ''
182182+ mv $out/bin/server $out/bin/k3s
183183+ pushd $out
184184+ # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113
185185+ ln -s k3s ./bin/k3s-agent
186186+ ln -s k3s ./bin/k3s-server
187187+ ln -s k3s ./bin/k3s-etcd-snapshot
188188+ ln -s k3s ./bin/k3s-secrets-encrypt
189189+ ln -s k3s ./bin/k3s-certificate
190190+ ln -s k3s ./bin/kubectl
191191+ ln -s k3s ./bin/crictl
192192+ ln -s k3s ./bin/ctr
193193+ popd
194194+ '';
195195+196196+ meta = baseMeta // {
197197+ description = "The various binaries that get packaged into the final k3s binary";
198198+ };
199199+ };
200200+ k3sContainerd = buildGoModule {
201201+ pname = "k3s-containerd";
202202+ version = containerdVersion;
203203+ src = fetchFromGitHub {
204204+ owner = "k3s-io";
205205+ repo = "containerd";
206206+ rev = "v${containerdVersion}";
207207+ sha256 = containerdSha256;
208208+ };
209209+ vendorSha256 = null;
210210+ buildInputs = [ btrfs-progs ];
211211+ subPackages = [ "cmd/containerd" "cmd/containerd-shim-runc-v2" ];
212212+ ldflags = versionldflags;
213213+ };
214214+in
215215+buildGoModule rec {
216216+ pname = "k3s";
217217+ version = k3sVersion;
218218+219219+ src = k3sRepo;
220220+ vendorSha256 = k3sVendorSha256;
221221+222222+ patches = [
223223+ ./0001-script-download-strip-downloading-just-package-CRD.patch
224224+ ];
225225+226226+ postPatch = ''
227227+ # Nix prefers dynamically linked binaries over static binary.
228228+229229+ substituteInPlace scripts/package-cli \
230230+ --replace '"$LDFLAGS $STATIC" -o' \
231231+ '"$LDFLAGS" -o' \
232232+ --replace "STATIC=\"-extldflags \'-static\'\"" \
233233+ ""
234234+235235+ # Upstream codegen fails with trimpath set. Removes "trimpath" for 'go generate':
236236+237237+ substituteInPlace scripts/package-cli \
238238+ --replace '"''${GO}" generate' \
239239+ 'GOFLAGS="" \
240240+ GOOS="${pkgsBuildBuild.go.GOOS}" \
241241+ GOARCH="${pkgsBuildBuild.go.GOARCH}" \
242242+ CC="${pkgsBuildBuild.stdenv.cc}/bin/cc" \
243243+ "''${GO}" generate'
244244+ '';
245245+246246+ # Important utilities used by the kubelet, see
247247+ # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
248248+ # Note the list in that issue is stale and some aren't relevant for k3s.
249249+ k3sRuntimeDeps = [
250250+ kmod
251251+ socat
252252+ iptables
253253+ iproute2
254254+ bridge-utils
255255+ ethtool
256256+ util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
257257+ conntrack-tools
258258+ ];
259259+260260+ buildInputs = k3sRuntimeDeps;
261261+262262+ nativeBuildInputs = [
263263+ makeWrapper
264264+ rsync
265265+ yq-go
266266+ zstd
267267+ ];
268268+269269+ # embedded in the final k3s cli
270270+ propagatedBuildInputs = [
271271+ k3sCNIPlugins
272272+ k3sContainerd
273273+ k3sServer
274274+ runc
275275+ ];
276276+277277+ # We override most of buildPhase due to peculiarities in k3s's build.
278278+ # Specifically, it has a 'go generate' which runs part of the package. See
279279+ # this comment:
280280+ # https://github.com/NixOS/nixpkgs/pull/158089#discussion_r799965694
281281+ # So, why do we use buildGoModule at all? For the `vendorSha256` / `go mod download` stuff primarily.
282282+ buildPhase = ''
283283+ patchShebangs ./scripts/package-cli ./scripts/download ./scripts/build-upload
284284+285285+ # copy needed 'go generate' inputs into place
286286+ mkdir -p ./bin/aux
287287+ rsync -a --no-perms ${k3sServer}/bin/ ./bin/
288288+ ln -vsf ${runc}/bin/runc ./bin/runc
289289+ ln -vsf ${k3sCNIPlugins}/bin/cni ./bin/cni
290290+ ln -vsf ${k3sContainerd}/bin/* ./bin/
291291+ rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
292292+ mkdir -p ./build/static/charts
293293+ # Note, upstream's chart has a 00 suffix. This seems to not matter though, so we're ignoring that naming detail.
294294+ export TRAEFIK_CHART_FILE=${traefikChart}
295295+ # place the traefik chart using their code since it's complicated
296296+ # We trim the actual download, see patches
297297+ ./scripts/download
298298+299299+ export ARCH=$GOARCH
300300+ export DRONE_TAG="v${k3sVersion}"
301301+ export DRONE_COMMIT="${k3sCommit}"
302302+ # use ./scripts/package-cli to run 'go generate' + 'go build'
303303+304304+ ./scripts/package-cli
305305+ mkdir -p $out/bin
306306+ '';
307307+308308+ # Otherwise it depends on 'getGoDirs', which is normally set in buildPhase
309309+ doCheck = false;
310310+311311+ installPhase = ''
312312+ # wildcard to match the arm64 build too
313313+ install -m 0755 dist/artifacts/k3s* -D $out/bin/k3s
314314+ wrapProgram $out/bin/k3s \
315315+ --prefix PATH : ${lib.makeBinPath k3sRuntimeDeps} \
316316+ --prefix PATH : "$out/bin"
317317+ '';
318318+319319+ doInstallCheck = true;
320320+ installCheckPhase = ''
321321+ $out/bin/k3s --version | grep -F "v${k3sVersion}" >/dev/null
322322+ '';
323323+324324+ # Fix-Me: Needs to be adapted specifically for 1.23
325325+ # passthru.updateScript = ./update.sh;
326326+327327+ # Fix-Me: Needs to be adapted specifically for 1.23
328328+ # passthru.tests = { inherit (nixosTests) k3s-single-node k3s-single-node-docker; };
329329+330330+ meta = baseMeta;
331331+}
···11+{ stdenv
22+, lib
33+, makeWrapper
44+, socat
55+, iptables
66+, iproute2
77+, bridge-utils
88+, btrfs-progs
99+, conntrack-tools
1010+, buildGoModule
1111+, runc
1212+, rsync
1313+, kmod
1414+, libseccomp
1515+, pkg-config
1616+, ethtool
1717+, util-linux
1818+, fetchFromGitHub
1919+, fetchurl
2020+, fetchzip
2121+, fetchgit
2222+, zstd
2323+, yq-go
2424+, nixosTests
2525+, k3s
2626+, pkgsBuildBuild
2727+}:
2828+2929+# k3s is a kinda weird derivation. One of the main points of k3s is the
3030+# simplicity of it being one binary that can perform several tasks.
3131+# However, when you have a good package manager (like nix), that doesn't
3232+# actually make much of a difference; you don't really care if it's one binary
3333+# or 10 since with a good package manager, installing and running it is
3434+# identical.
3535+# Since upstream k3s packages itself as one large binary with several
3636+# "personalities" (in the form of subcommands like 'k3s agent' and 'k3s
3737+# kubectl'), it ends up being easiest to mostly mimic upstream packaging, with
3838+# some exceptions.
3939+# K3s also carries patches to some packages (such as containerd and cni
4040+# plugins), so we intentionally use the k3s versions of those binaries for k3s,
4141+# even if the upstream version of those binaries exist in nixpkgs already. In
4242+# the end, that means we have a thick k3s binary that behaves like the upstream
4343+# one for the most part.
4444+# However, k3s also bundles several pieces of unpatched software, from the
4545+# strongswan vpn software, to iptables, to socat, conntrack, busybox, etc.
4646+# Those pieces of software we entirely ignore upstream's handling of, and just
4747+# make sure they're in the path if desired.
4848+let
4949+ k3sVersion = "1.24.4+k3s1"; # k3s git tag
5050+ k3sCommit = "c3f830e9b9ed8a4d9d0e2aa663b4591b923a296e"; # k3s git commit at the above version
5151+ k3sRepoSha256 = "00ns6n7jxnacah8ahndhgdb160prgsqhswbb5809kkgvig7k8b27";
5252+ k3sVendorSha256 = "sha256-ReZvJCgxqffG2H39JlynGPUBSV5ngPkRtAoZ++OQZZI=";
5353+5454+ # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
5555+ # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
5656+ traefikChartVersion = "10.19.3";
5757+ traefikChartSha256 = "04zg5li957svgscdmkzmzjkwljaljyav68rzxmhakkwgav6q9058";
5858+5959+ # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L47
6060+ k3sRootVersion = "0.11.0";
6161+ k3sRootSha256 = "016n56vi09xkvjph7wgzb2m86mhd5x65fs4d11pmh20hl249r620";
6262+6363+ # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L45
6464+ k3sCNIVersion = "1.1.1-k3s1";
6565+ k3sCNISha256 = "14mb3zsqibj1sn338gjmsyksbm0mxv9p016dij7zidccx2rzn6nl";
6666+6767+ # taken from go.mod, the 'github.com/containerd/containerd' line
6868+ # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
6969+ containerdVersion = "1.5.13-k3s1";
7070+ containerdSha256 = "09bj4ghwbsj9whkv1d5icqs52k64m449j8b73dmak2wz62fbzbvp";
7171+7272+ # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
7373+ criCtlVersion = "1.24.0-k3s1";
7474+7575+ baseMeta = k3s.meta;
7676+7777+ # https://github.com/k3s-io/k3s/blob/5fb370e53e0014dc96183b8ecb2c25a61e891e76/scripts/build#L19-L40
7878+ versionldflags = [
7979+ "-X github.com/rancher/k3s/pkg/version.Version=v${k3sVersion}"
8080+ "-X github.com/rancher/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
8181+ "-X k8s.io/client-go/pkg/version.gitVersion=v${k3sVersion}"
8282+ "-X k8s.io/client-go/pkg/version.gitCommit=${k3sCommit}"
8383+ "-X k8s.io/client-go/pkg/version.gitTreeState=clean"
8484+ "-X k8s.io/client-go/pkg/version.buildDate=1970-01-01T01:01:01Z"
8585+ "-X k8s.io/component-base/version.gitVersion=v${k3sVersion}"
8686+ "-X k8s.io/component-base/version.gitCommit=${k3sCommit}"
8787+ "-X k8s.io/component-base/version.gitTreeState=clean"
8888+ "-X k8s.io/component-base/version.buildDate=1970-01-01T01:01:01Z"
8989+ "-X github.com/kubernetes-sigs/cri-tools/pkg/version.Version=v${criCtlVersion}"
9090+ "-X github.com/containerd/containerd/version.Version=v${containerdVersion}"
9191+ "-X github.com/containerd/containerd/version.Package=github.com/k3s-io/containerd"
9292+ ];
9393+9494+ # bundled into the k3s binary
9595+ traefikChart = fetchurl {
9696+ url = "https://helm.traefik.io/traefik/traefik-${traefikChartVersion}.tgz";
9797+ sha256 = traefikChartSha256;
9898+ };
9999+ # so, k3s is a complicated thing to package
100100+ # This derivation attempts to avoid including any random binaries from the
101101+ # internet. k3s-root is _mostly_ binaries built to be bundled in k3s (which
102102+ # we don't care about doing, we can add those as build or runtime
103103+ # dependencies using a real package manager).
104104+ # In addition to those binaries, it's also configuration though (right now
105105+ # mostly strongswan configuration), and k3s does use those files.
106106+ # As such, we download it in order to grab 'etc' and bundle it into the final
107107+ # k3s binary.
108108+ k3sRoot = fetchzip {
109109+ # Note: marked as apache 2.0 license
110110+ url = "https://github.com/k3s-io/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
111111+ sha256 = k3sRootSha256;
112112+ stripRoot = false;
113113+ };
114114+ k3sCNIPlugins = buildGoModule rec {
115115+ pname = "k3s-cni-plugins";
116116+ version = k3sCNIVersion;
117117+ vendorSha256 = null;
118118+119119+ subPackages = [ "." ];
120120+121121+ src = fetchFromGitHub {
122122+ owner = "rancher";
123123+ repo = "plugins";
124124+ rev = "v${version}";
125125+ sha256 = k3sCNISha256;
126126+ };
127127+128128+ postInstall = ''
129129+ mv $out/bin/plugins $out/bin/cni
130130+ '';
131131+132132+ meta = baseMeta // {
133133+ description = "CNI plugins, as patched by rancher for k3s";
134134+ };
135135+ };
136136+ # Grab this separately from a build because it's used by both stages of the
137137+ # k3s build.
138138+ k3sRepo = fetchgit {
139139+ url = "https://github.com/k3s-io/k3s";
140140+ rev = "v${k3sVersion}";
141141+ sha256 = k3sRepoSha256;
142142+ };
143143+ # Stage 1 of the k3s build:
144144+ # Let's talk about how k3s is structured.
145145+ # One of the ideas of k3s is that there's the single "k3s" binary which can
146146+ # do everything you need, from running a k3s server, to being a worker node,
147147+ # to running kubectl.
148148+ # The way that actually works is that k3s is a single go binary that contains
149149+ # a bunch of bindata that it unpacks at runtime into directories (either the
150150+ # user's home directory or /var/lib/rancher if run as root).
151151+ # This bindata includes both binaries and configuration.
152152+ # In order to let nixpkgs do all its autostripping/patching/etc, we split this into two derivations.
153153+ # First, we build all the binaries that get packed into the thick k3s binary
154154+ # (and output them from one derivation so they'll all be suitably patched up).
155155+ # Then, we bundle those binaries into our thick k3s binary and use that as
156156+ # the final single output.
157157+ # This approach was chosen because it ensures the bundled binaries all are
158158+ # correctly built to run with nix (we can lean on the existing buildGoModule
159159+ # stuff), and we can again lean on that tooling for the final k3s binary too.
160160+ # Other alternatives would be to manually run the
161161+ # strip/patchelf/remove-references step ourselves in the installPhase of the
162162+ # derivation when we've built all the binaries, but haven't bundled them in
163163+ # with generated bindata yet.
164164+165165+ k3sServer = buildGoModule rec {
166166+ pname = "k3s-server";
167167+ version = k3sVersion;
168168+169169+ src = k3sRepo;
170170+ vendorSha256 = k3sVendorSha256;
171171+172172+ nativeBuildInputs = [ pkg-config ];
173173+ buildInputs = [ libseccomp ];
174174+175175+ subPackages = [ "cmd/server" ];
176176+ ldflags = versionldflags;
177177+178178+ # create the multicall symlinks for k3s
179179+ postInstall = ''
180180+ mv $out/bin/server $out/bin/k3s
181181+ pushd $out
182182+ # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113
183183+ ln -s k3s ./bin/k3s-agent
184184+ ln -s k3s ./bin/k3s-server
185185+ ln -s k3s ./bin/k3s-etcd-snapshot
186186+ ln -s k3s ./bin/k3s-secrets-encrypt
187187+ ln -s k3s ./bin/k3s-certificate
188188+ ln -s k3s ./bin/kubectl
189189+ ln -s k3s ./bin/crictl
190190+ ln -s k3s ./bin/ctr
191191+ popd
192192+ '';
193193+194194+ meta = baseMeta // {
195195+ description = "The various binaries that get packaged into the final k3s binary";
196196+ };
197197+ };
198198+ k3sContainerd = buildGoModule {
199199+ pname = "k3s-containerd";
200200+ version = containerdVersion;
201201+ src = fetchFromGitHub {
202202+ owner = "k3s-io";
203203+ repo = "containerd";
204204+ rev = "v${containerdVersion}";
205205+ sha256 = containerdSha256;
206206+ };
207207+ vendorSha256 = null;
208208+ buildInputs = [ btrfs-progs ];
209209+ subPackages = [ "cmd/containerd" "cmd/containerd-shim-runc-v2" ];
210210+ ldflags = versionldflags;
211211+ };
212212+in
213213+buildGoModule rec {
214214+ pname = "k3s";
215215+ version = k3sVersion;
216216+217217+ src = k3sRepo;
218218+ vendorSha256 = k3sVendorSha256;
219219+220220+ patches = [
221221+ ./0001-script-download-strip-downloading-just-package-CRD.patch
222222+ ];
223223+224224+ postPatch = ''
225225+ # Nix prefers dynamically linked binaries over static binary.
226226+227227+ substituteInPlace scripts/package-cli \
228228+ --replace '"$LDFLAGS $STATIC" -o' \
229229+ '"$LDFLAGS" -o' \
230230+ --replace "STATIC=\"-extldflags \'-static\'\"" \
231231+ ""
232232+233233+ # Upstream codegen fails with trimpath set. Removes "trimpath" for 'go generate':
234234+235235+ substituteInPlace scripts/package-cli \
236236+ --replace '"''${GO}" generate' \
237237+ 'GOFLAGS="" \
238238+ GOOS="${pkgsBuildBuild.go.GOOS}" \
239239+ GOARCH="${pkgsBuildBuild.go.GOARCH}" \
240240+ CC="${pkgsBuildBuild.stdenv.cc}/bin/cc" \
241241+ "''${GO}" generate'
242242+ '';
243243+244244+ # Important utilities used by the kubelet, see
245245+ # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
246246+ # Note the list in that issue is stale and some aren't relevant for k3s.
247247+ k3sRuntimeDeps = [
248248+ kmod
249249+ socat
250250+ iptables
251251+ iproute2
252252+ bridge-utils
253253+ ethtool
254254+ util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
255255+ conntrack-tools
256256+ ];
257257+258258+ buildInputs = k3sRuntimeDeps;
259259+260260+ nativeBuildInputs = [
261261+ makeWrapper
262262+ rsync
263263+ yq-go
264264+ zstd
265265+ ];
266266+267267+ # embedded in the final k3s cli
268268+ propagatedBuildInputs = [
269269+ k3sCNIPlugins
270270+ k3sContainerd
271271+ k3sServer
272272+ runc
273273+ ];
274274+275275+ # We override most of buildPhase due to peculiarities in k3s's build.
276276+ # Specifically, it has a 'go generate' which runs part of the package. See
277277+ # this comment:
278278+ # https://github.com/NixOS/nixpkgs/pull/158089#discussion_r799965694
279279+ # So, why do we use buildGoModule at all? For the `vendorSha256` / `go mod download` stuff primarily.
280280+ buildPhase = ''
281281+ patchShebangs ./scripts/package-cli ./scripts/download ./scripts/build-upload
282282+283283+ # copy needed 'go generate' inputs into place
284284+ mkdir -p ./bin/aux
285285+ rsync -a --no-perms ${k3sServer}/bin/ ./bin/
286286+ ln -vsf ${runc}/bin/runc ./bin/runc
287287+ ln -vsf ${k3sCNIPlugins}/bin/cni ./bin/cni
288288+ ln -vsf ${k3sContainerd}/bin/* ./bin/
289289+ rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
290290+ mkdir -p ./build/static/charts
291291+ # Note, upstream's chart has a 00 suffix. This seems to not matter though, so we're ignoring that naming detail.
292292+ export TRAEFIK_CHART_FILE=${traefikChart}
293293+ # place the traefik chart using their code since it's complicated
294294+ # We trim the actual download, see patches
295295+ ./scripts/download
296296+297297+ export ARCH=$GOARCH
298298+ export DRONE_TAG="v${k3sVersion}"
299299+ export DRONE_COMMIT="${k3sCommit}"
300300+ # use ./scripts/package-cli to run 'go generate' + 'go build'
301301+302302+ ./scripts/package-cli
303303+ mkdir -p $out/bin
304304+ '';
305305+306306+ # Otherwise it depends on 'getGoDirs', which is normally set in buildPhase
307307+ doCheck = false;
308308+309309+ installPhase = ''
310310+ # wildcard to match the arm64 build too
311311+ install -m 0755 dist/artifacts/k3s* -D $out/bin/k3s
312312+ wrapProgram $out/bin/k3s \
313313+ --prefix PATH : ${lib.makeBinPath k3sRuntimeDeps} \
314314+ --prefix PATH : "$out/bin"
315315+ '';
316316+317317+ doInstallCheck = true;
318318+ installCheckPhase = ''
319319+ $out/bin/k3s --version | grep -F "v${k3sVersion}" >/dev/null
320320+ '';
321321+322322+ # Fix-Me: Needs to be adapted specifically for 1.24
323323+ # passthru.updateScript = ./update.sh;
324324+325325+ # Fix-Me: Needs to be adapted specifically for 1.24
326326+ # passthru.tests = nixosTests.k3s;
327327+328328+ meta = baseMeta;
329329+}
···11+{ stdenv
22+, lib
33+, makeWrapper
44+, socat
55+, iptables
66+, iproute2
77+, bridge-utils
88+, btrfs-progs
99+, conntrack-tools
1010+, buildGoModule
1111+, runc
1212+, rsync
1313+, kmod
1414+, libseccomp
1515+, pkg-config
1616+, ethtool
1717+, util-linux
1818+, fetchFromGitHub
1919+, fetchurl
2020+, fetchzip
2121+, fetchgit
2222+, zstd
2323+, yq-go
2424+, nixosTests
2525+, pkgsBuildBuild
2626+, k3s
2727+}:
2828+2929+# k3s is a kinda weird derivation. One of the main points of k3s is the
3030+# simplicity of it being one binary that can perform several tasks.
3131+# However, when you have a good package manager (like nix), that doesn't
3232+# actually make much of a difference; you don't really care if it's one binary
3333+# or 10 since with a good package manager, installing and running it is
3434+# identical.
3535+# Since upstream k3s packages itself as one large binary with several
3636+# "personalities" (in the form of subcommands like 'k3s agent' and 'k3s
3737+# kubectl'), it ends up being easiest to mostly mimic upstream packaging, with
3838+# some exceptions.
3939+# K3s also carries patches to some packages (such as containerd and cni
4040+# plugins), so we intentionally use the k3s versions of those binaries for k3s,
4141+# even if the upstream version of those binaries exist in nixpkgs already. In
4242+# the end, that means we have a thick k3s binary that behaves like the upstream
4343+# one for the most part.
4444+# However, k3s also bundles several pieces of unpatched software, from the
4545+# strongswan vpn software, to iptables, to socat, conntrack, busybox, etc.
4646+# Those pieces of software we entirely ignore upstream's handling of, and just
4747+# make sure they're in the path if desired.
4848+let
4949+ k3sVersion = "1.25.3+k3s1"; # k3s git tag
5050+ k3sCommit = "f2585c1671b31b4b34bddbb3bf4e7d69662b0821"; # k3s git commit at the above version
5151+ k3sRepoSha256 = "0zwf3iwjcidx14zw36s1hr0q8wmmbfc0rfqwd7fmpjq597h8zkms";
5252+ k3sVendorSha256 = "sha256-U67tJRGqPFk5AfRe7I50zKGC9HJ2oh+iI/C7qF/76BQ=";
5353+5454+ # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
5555+ # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
5656+ traefikChartVersion = "12.0.0";
5757+ traefikChartSha256 = "1sqmi71fi3ad5dh5fmsp9mv80x6pkgqwi4r9fr8l6i9sdnai6f1a";
5858+5959+ # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L47
6060+ k3sRootVersion = "0.11.0";
6161+ k3sRootSha256 = "016n56vi09xkvjph7wgzb2m86mhd5x65fs4d11pmh20hl249r620";
6262+6363+ # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L45
6464+ k3sCNIVersion = "1.1.1-k3s1";
6565+ k3sCNISha256 = "14mb3zsqibj1sn338gjmsyksbm0mxv9p016dij7zidccx2rzn6nl";
6666+6767+ # taken from go.mod, the 'github.com/containerd/containerd' line
6868+ # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
6969+ containerdVersion = "1.5.13-k3s2";
7070+ containerdSha256 = "1pfr2ji4aij9js90gf4a3hqnhyw5hshcjdccm62l700j68gs5z97";
7171+7272+ # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
7373+ criCtlVersion = "1.25.0-k3s1";
7474+7575+ baseMeta = k3s.meta;
7676+7777+ # https://github.com/k3s-io/k3s/blob/5fb370e53e0014dc96183b8ecb2c25a61e891e76/scripts/build#L19-L40
7878+ versionldflags = [
7979+ "-X github.com/rancher/k3s/pkg/version.Version=v${k3sVersion}"
8080+ "-X github.com/rancher/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
8181+ "-X k8s.io/client-go/pkg/version.gitVersion=v${k3sVersion}"
8282+ "-X k8s.io/client-go/pkg/version.gitCommit=${k3sCommit}"
8383+ "-X k8s.io/client-go/pkg/version.gitTreeState=clean"
8484+ "-X k8s.io/client-go/pkg/version.buildDate=1970-01-01T01:01:01Z"
8585+ "-X k8s.io/component-base/version.gitVersion=v${k3sVersion}"
8686+ "-X k8s.io/component-base/version.gitCommit=${k3sCommit}"
8787+ "-X k8s.io/component-base/version.gitTreeState=clean"
8888+ "-X k8s.io/component-base/version.buildDate=1970-01-01T01:01:01Z"
8989+ "-X github.com/kubernetes-sigs/cri-tools/pkg/version.Version=v${criCtlVersion}"
9090+ "-X github.com/containerd/containerd/version.Version=v${containerdVersion}"
9191+ "-X github.com/containerd/containerd/version.Package=github.com/k3s-io/containerd"
9292+ ];
9393+9494+ # bundled into the k3s binary
9595+ traefikChart = fetchurl {
9696+ url = "https://helm.traefik.io/traefik/traefik-${traefikChartVersion}.tgz";
9797+ sha256 = traefikChartSha256;
9898+ };
9999+ # so, k3s is a complicated thing to package
100100+ # This derivation attempts to avoid including any random binaries from the
101101+ # internet. k3s-root is _mostly_ binaries built to be bundled in k3s (which
102102+ # we don't care about doing, we can add those as build or runtime
103103+ # dependencies using a real package manager).
104104+ # In addition to those binaries, it's also configuration though (right now
105105+ # mostly strongswan configuration), and k3s does use those files.
106106+ # As such, we download it in order to grab 'etc' and bundle it into the final
107107+ # k3s binary.
108108+ k3sRoot = fetchzip {
109109+ # Note: marked as apache 2.0 license
110110+ url = "https://github.com/k3s-io/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
111111+ sha256 = k3sRootSha256;
112112+ stripRoot = false;
113113+ };
114114+ k3sCNIPlugins = buildGoModule rec {
115115+ pname = "k3s-cni-plugins";
116116+ version = k3sCNIVersion;
117117+ vendorSha256 = null;
118118+119119+ subPackages = [ "." ];
120120+121121+ src = fetchFromGitHub {
122122+ owner = "rancher";
123123+ repo = "plugins";
124124+ rev = "v${version}";
125125+ sha256 = k3sCNISha256;
126126+ };
127127+128128+ postInstall = ''
129129+ mv $out/bin/plugins $out/bin/cni
130130+ '';
131131+132132+ meta = baseMeta // {
133133+ description = "CNI plugins, as patched by rancher for k3s";
134134+ };
135135+ };
136136+ # Grab this separately from a build because it's used by both stages of the
137137+ # k3s build.
138138+ k3sRepo = fetchgit {
139139+ url = "https://github.com/k3s-io/k3s";
140140+ rev = "v${k3sVersion}";
141141+ sha256 = k3sRepoSha256;
142142+ };
143143+ # Stage 1 of the k3s build:
144144+ # Let's talk about how k3s is structured.
145145+ # One of the ideas of k3s is that there's the single "k3s" binary which can
146146+ # do everything you need, from running a k3s server, to being a worker node,
147147+ # to running kubectl.
148148+ # The way that actually works is that k3s is a single go binary that contains
149149+ # a bunch of bindata that it unpacks at runtime into directories (either the
150150+ # user's home directory or /var/lib/rancher if run as root).
151151+ # This bindata includes both binaries and configuration.
152152+ # In order to let nixpkgs do all its autostripping/patching/etc, we split this into two derivations.
153153+ # First, we build all the binaries that get packed into the thick k3s binary
154154+ # (and output them from one derivation so they'll all be suitably patched up).
155155+ # Then, we bundle those binaries into our thick k3s binary and use that as
156156+ # the final single output.
157157+ # This approach was chosen because it ensures the bundled binaries all are
158158+ # correctly built to run with nix (we can lean on the existing buildGoModule
159159+ # stuff), and we can again lean on that tooling for the final k3s binary too.
160160+ # Other alternatives would be to manually run the
161161+ # strip/patchelf/remove-references step ourselves in the installPhase of the
162162+ # derivation when we've built all the binaries, but haven't bundled them in
163163+ # with generated bindata yet.
164164+165165+ k3sServer = buildGoModule rec {
166166+ pname = "k3s-server";
167167+ version = k3sVersion;
168168+169169+ src = k3sRepo;
170170+ vendorSha256 = k3sVendorSha256;
171171+172172+ nativeBuildInputs = [ pkg-config ];
173173+ buildInputs = [ libseccomp ];
174174+175175+ subPackages = [ "cmd/server" ];
176176+ ldflags = versionldflags;
177177+178178+ # create the multicall symlinks for k3s
179179+ postInstall = ''
180180+ mv $out/bin/server $out/bin/k3s
181181+ pushd $out
182182+ # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113
183183+ ln -s k3s ./bin/k3s-agent
184184+ ln -s k3s ./bin/k3s-server
185185+ ln -s k3s ./bin/k3s-etcd-snapshot
186186+ ln -s k3s ./bin/k3s-secrets-encrypt
187187+ ln -s k3s ./bin/k3s-certificate
188188+ ln -s k3s ./bin/kubectl
189189+ ln -s k3s ./bin/crictl
190190+ ln -s k3s ./bin/ctr
191191+ popd
192192+ '';
193193+194194+ meta = baseMeta // {
195195+ description = "The various binaries that get packaged into the final k3s binary";
196196+ };
197197+ };
198198+ k3sContainerd = buildGoModule {
199199+ pname = "k3s-containerd";
200200+ version = containerdVersion;
201201+ src = fetchFromGitHub {
202202+ owner = "k3s-io";
203203+ repo = "containerd";
204204+ rev = "v${containerdVersion}";
205205+ sha256 = containerdSha256;
206206+ };
207207+ vendorSha256 = null;
208208+ buildInputs = [ btrfs-progs ];
209209+ subPackages = [ "cmd/containerd" "cmd/containerd-shim-runc-v2" ];
210210+ ldflags = versionldflags;
211211+ };
212212+in
213213+buildGoModule rec {
214214+ pname = "k3s";
215215+ version = k3sVersion;
216216+217217+ src = k3sRepo;
218218+ vendorSha256 = k3sVendorSha256;
219219+220220+ patches = [
221221+ ./0001-script-download-strip-downloading-just-package-CRD.patch
222222+ ];
223223+224224+ postPatch = ''
225225+ # Nix prefers dynamically linked binaries over static binary.
226226+227227+ substituteInPlace scripts/package-cli \
228228+ --replace '"$LDFLAGS $STATIC" -o' \
229229+ '"$LDFLAGS" -o' \
230230+ --replace "STATIC=\"-extldflags \'-static\'\"" \
231231+ ""
232232+233233+ # Upstream codegen fails with trimpath set. Removes "trimpath" for 'go generate':
234234+235235+ substituteInPlace scripts/package-cli \
236236+ --replace '"''${GO}" generate' \
237237+ 'GOFLAGS="" \
238238+ GOOS="${pkgsBuildBuild.go.GOOS}" \
239239+ GOARCH="${pkgsBuildBuild.go.GOARCH}" \
240240+ CC="${pkgsBuildBuild.stdenv.cc}/bin/cc" \
241241+ "''${GO}" generate'
242242+ '';
243243+244244+ # Important utilities used by the kubelet, see
245245+ # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
246246+ # Note the list in that issue is stale and some aren't relevant for k3s.
247247+ k3sRuntimeDeps = [
248248+ kmod
249249+ socat
250250+ iptables
251251+ iproute2
252252+ bridge-utils
253253+ ethtool
254254+ util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
255255+ conntrack-tools
256256+ ];
257257+258258+ buildInputs = k3sRuntimeDeps;
259259+260260+ nativeBuildInputs = [
261261+ makeWrapper
262262+ rsync
263263+ yq-go
264264+ zstd
265265+ ];
266266+267267+ # embedded in the final k3s cli
268268+ propagatedBuildInputs = [
269269+ k3sCNIPlugins
270270+ k3sContainerd
271271+ k3sServer
272272+ runc
273273+ ];
274274+275275+ # We override most of buildPhase due to peculiarities in k3s's build.
276276+ # Specifically, it has a 'go generate' which runs part of the package. See
277277+ # this comment:
278278+ # https://github.com/NixOS/nixpkgs/pull/158089#discussion_r799965694
279279+ # So, why do we use buildGoModule at all? For the `vendorSha256` / `go mod download` stuff primarily.
280280+ buildPhase = ''
281281+ patchShebangs ./scripts/package-cli ./scripts/download ./scripts/build-upload
282282+283283+ # copy needed 'go generate' inputs into place
284284+ mkdir -p ./bin/aux
285285+ rsync -a --no-perms ${k3sServer}/bin/ ./bin/
286286+ ln -vsf ${runc}/bin/runc ./bin/runc
287287+ ln -vsf ${k3sCNIPlugins}/bin/cni ./bin/cni
288288+ ln -vsf ${k3sContainerd}/bin/* ./bin/
289289+ rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
290290+ mkdir -p ./build/static/charts
291291+ # Note, upstream's chart has a 00 suffix. This seems to not matter though, so we're ignoring that naming detail.
292292+ export TRAEFIK_CHART_FILE=${traefikChart}
293293+ # place the traefik chart using their code since it's complicated
294294+ # We trim the actual download, see patches
295295+ ./scripts/download
296296+297297+ export ARCH=$GOARCH
298298+ export DRONE_TAG="v${k3sVersion}"
299299+ export DRONE_COMMIT="${k3sCommit}"
300300+ # use ./scripts/package-cli to run 'go generate' + 'go build'
301301+302302+ ./scripts/package-cli
303303+ mkdir -p $out/bin
304304+ '';
305305+306306+ # Otherwise it depends on 'getGoDirs', which is normally set in buildPhase
307307+ doCheck = false;
308308+309309+ installPhase = ''
310310+ # wildcard to match the arm64 build too
311311+ install -m 0755 dist/artifacts/k3s* -D $out/bin/k3s
312312+ wrapProgram $out/bin/k3s \
313313+ --prefix PATH : ${lib.makeBinPath k3sRuntimeDeps} \
314314+ --prefix PATH : "$out/bin"
315315+ '';
316316+317317+ doInstallCheck = true;
318318+ installCheckPhase = ''
319319+ $out/bin/k3s --version | grep -F "v${k3sVersion}" >/dev/null
320320+ '';
321321+322322+ # Fix-Me: Needs to be adapted specifically for 1.25
323323+ # passthru.updateScript = ./update.sh;
324324+325325+ # Fix-Me: Needs to be adapted specifically for 1.25
326326+ # passthru.tests = nixosTests.k3s;
327327+328328+ meta = baseMeta;
329329+}
···3232 description = "An open source tool for computing automorphism groups and canonical forms of graphs. It has both a command line user interface as well as C++ and C programming language APIs";
3333 homepage = "http://www.tcs.hut.fi/Software/bliss/";
3434 license = licenses.lgpl3;
3535- platforms = [ "i686-linux" "x86_64-linux" ];
3535+ platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" ];
3636 };
3737}
···11+From 64de7911d2938fc3601fec39c08008465b9d4f6f Mon Sep 17 00:00:00 2001
22+From: Nick Cao <nickcao@nichi.co>
33+Date: Tue, 7 Feb 2023 17:12:50 +0800
44+Subject: [PATCH] python: enum: fix build for Python 3.11
55+MIME-Version: 1.0
66+Content-Type: text/plain; charset=UTF-8
77+Content-Transfer-Encoding: 8bit
88+99+Python 3.9 introduced Py_SET_SIZE function to set size instead of
1010+relying on Py_SIZE() as a macro [3.9].
1111+1212+Python 3.10 started to encourage to use Py_SET_SIZE instead of
1313+assigning into return value of Py_SIZE [3.10].
1414+1515+Python 3.11 flips the switch, turn Py_SIZE into a function [3.11],
1616+thus Py_SIZE(obj) will be a rvalue. We need to use Py_SET_SIZE
1717+to set size now.
1818+1919+[3.9]: https://docs.python.org/3.9/c-api/structures.html#c.Py_SET_SIZE
2020+[3.10]: https://docs.python.org/3.10/c-api/structures.html#c.Py_SIZE
2121+[3.11]: https://docs.python.org/3.11/c-api/structures.html#c.Py_SIZE
2222+2323+Adapted from https://github.com/mchehab/zbar/pull/231
2424+2525+Signed-off-by: Đoàn Trần Công Danh <congdanhqx@gmail.com>
2626+Signed-off-by: Nick Cao <nickcao@nichi.co>
2727+---
2828+ python/enum.c | 8 ++++++++
2929+ 1 file changed, 8 insertions(+)
3030+3131+diff --git a/python/enum.c b/python/enum.c
3232+index dfe1b1e..4833a20 100644
3333+--- a/python/enum.c
3434++++ b/python/enum.c
3535+@@ -52,7 +52,11 @@ enumitem_new (PyTypeObject *type,
3636+3737+ /* we assume the "fast path" for a single-digit ints (see longobject.c) */
3838+ /* this also holds if we get a small_int preallocated long */
3939++#if PY_VERSION_HEX >= 0x030900A4
4040++ Py_SET_SIZE(&self->val, Py_SIZE(longval));
4141++#else
4242+ Py_SIZE(&self->val) = Py_SIZE(longval);
4343++#endif
4444+ self->val.ob_digit[0] = longval->ob_digit[0];
4545+ Py_DECREF(longval);
4646+ #else
4747+@@ -143,7 +147,11 @@ zbarEnumItem_New (PyObject *byname,
4848+4949+ /* we assume the "fast path" for a single-digit ints (see longobject.c) */
5050+ /* this also holds if we get a small_int preallocated long */
5151++#if PY_VERSION_HEX >= 0x030900A4
5252++ Py_SET_SIZE(&self->val, Py_SIZE(longval));
5353++#else
5454+ Py_SIZE(&self->val) = Py_SIZE(longval);
5555++#endif
5656+ self->val.ob_digit[0] = longval->ob_digit[0];
5757+ Py_DECREF(longval);
5858+5959+--
6060+2.39.1
6161+