Merge pull request #101886 from flokli/systemd-more-optional

systemd: introduce more options for a more minimal build

pkgs/os-specific/linux/systemd/default.nix

···
-{ stdenv, lib, fetchFromGitHub
+{ stdenv
+, lib
+, fetchFromGitHub
 , buildPackages
-, ninja, meson, m4, pkgconfig, coreutils, gperf, getent
-, patchelf, perl, glibcLocales, glib, substituteAll
-, gettext, python3Packages
+, ninja
+, meson
+, m4
+, pkgconfig
+, coreutils
+, gperf
+, getent
+, patchelf
+, glibcLocales
+, glib
+, substituteAll
+, gettext
+, python3Packages
 
-# Mandatory dependencies
+  # Mandatory dependencies
 , libcap
 , utillinux
 , kbd
 , kmod
 
-# Optional dependencies
-, pam, cryptsetup, lvm2, audit, acl
-, lz4, libgcrypt, libgpgerror, libidn2
-, curl, gnutar, gnupg, zlib
-, xz, libuuid, libffi
-, libapparmor, intltool
-, bzip2, pcre2, e2fsprogs
+  # Optional dependencies
+, pam
+, cryptsetup
+, lvm2
+, audit
+, acl
+, lz4
+, libgcrypt
+, libgpgerror
+, libidn2
+, curl
+, gnutar
+, gnupg
+, zlib
+, xz
+, libuuid
+, libapparmor
+, intltool
+, bzip2
+, pcre2
+, e2fsprogs
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
 , gnu-efi
 , iptables
-, withSelinux ? false, libselinux
-, withLibseccomp ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) libseccomp.meta.platforms, libseccomp
-, withKexectools ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) kexectools.meta.platforms, kexectools
+, withSelinux ? false
+, libselinux
+, withLibseccomp ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) libseccomp.meta.platforms
+, libseccomp
+, withKexectools ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) kexectools.meta.platforms
+, kexectools
 , bashInteractive
 
-, withResolved ? true
-, withLogind ? true
+, withAnalyze ? true
+, withApparmor ? true
+, withCoredump ? true
+, withCompression ? true  # adds bzip2, lz4 and xz
+, withCryptsetup ? true
+, withDocumentation ? true
+, withEfi ? stdenv.hostPlatform.isEfi
 , withHostnamed ? true
+, withHwdb ? true
+, withImportd ? true
 , withLocaled ? true
+, withLogind ? true
+, withMachined ? true
 , withNetworkd ? true
+, withNss ? true
+, withPCRE2 ? true
+, withPolkit ? true
+, withRemote ? false  # has always been disabled on NixOS, upstream version appears broken anyway
+, withResolved ? true
+, withShellCompletions ? true
 , withTimedated ? true
 , withTimesyncd ? true
-, withHwdb ? true
-, withEfi ? stdenv.hostPlatform.isEfi
-, withImportd ? true
-, withCryptsetup ? true
+, withUserDb ? true
 
-# name argument
+  # name argument
 , pname ? "systemd"
 
 
-, libxslt, docbook_xsl, docbook_xml_dtd_42, docbook_xml_dtd_45
+, libxslt
+, docbook_xsl
+, docbook_xml_dtd_42
+, docbook_xml_dtd_45
 }:
 
 assert withResolved -> (libgcrypt != null && libgpgerror != null);
 assert withImportd ->
-  ( curl.dev != null && zlib != null && xz != null && libgcrypt != null
-  && gnutar != null && gnupg != null);
+(curl.dev != null && zlib != null && xz != null && libgcrypt != null
+  && gnutar != null && gnupg != null && withCompression );
+
+assert withEfi -> (gnu-efi != null);
+assert withRemote -> lib.getDev curl != null;
+assert withCoredump -> withCompression;
 
 assert withCryptsetup ->
-  ( cryptsetup != null );
-
+(cryptsetup != null);
 let
+  wantCurl = withRemote || withImportd;
+
   version = "246.6";
-in stdenv.mkDerivation {
+in
+stdenv.mkDerivation {
   inherit version pname;
 
   # We use systemd/systemd-stable for src, and ship NixOS-specific patches inside nixpkgs directly
···
   outputs = [ "out" "man" "dev" ];
 
   nativeBuildInputs =
-    [ pkgconfig gperf
-      ninja meson
+    [
+      pkgconfig
+      gperf
+      ninja
+      meson
       coreutils # meson calls date, stat etc.
       glibcLocales
-      patchelf getent m4
-      perl # to patch the libsystemd.so and remove dependencies on aarch64
+      patchelf
+      getent
+      m4
 
       intltool
       gettext
 
-      libxslt docbook_xsl docbook_xml_dtd_42 docbook_xml_dtd_45
-      (buildPackages.python3Packages.python.withPackages ( ps: with ps; [ python3Packages.lxml ]))
+      libxslt
+      docbook_xsl
+      docbook_xml_dtd_42
+      docbook_xml_dtd_45
+      (buildPackages.python3Packages.python.withPackages (ps: with ps; [ python3Packages.lxml ]))
     ];
+
   buildInputs =
-    [ linuxHeaders libcap curl.dev kmod xz pam acl
-      cryptsetup libuuid glib libgcrypt libgpgerror libidn2
-      pcre2 ] ++
-      stdenv.lib.optional withKexectools kexectools ++
-      stdenv.lib.optional withLibseccomp libseccomp ++
-      [ libffi audit lz4 bzip2 libapparmor iptables ] ++
-      stdenv.lib.optional withEfi gnu-efi ++
-      stdenv.lib.optional withSelinux libselinux ++
-      stdenv.lib.optional withCryptsetup cryptsetup.dev;
+    [
+      acl
+      audit
+      glib
+      kmod
+      libcap
+      libgcrypt
+      libidn2
+      libuuid
+      linuxHeaders
+      pam
+    ]
+
+    ++ lib.optional withApparmor libapparmor
+    ++ lib.optional wantCurl (lib.getDev curl)
+    ++ lib.optionals withCompression [ bzip2 lz4 xz ]
+    ++ lib.optional withCryptsetup (lib.getDev cryptsetup.dev)
+    ++ lib.optional withEfi gnu-efi
+    ++ lib.optional withKexectools kexectools
+    ++ lib.optional withLibseccomp libseccomp
+    ++ lib.optional withNetworkd iptables
+    ++ lib.optional withPCRE2 pcre2
+    ++ lib.optional withResolved libgpgerror
+    ++ lib.optional withSelinux libselinux
+    ;
 
   #dontAddPrefix = true;
 
···
     "-Dsetfont-path=${kbd}/bin/setfont"
     "-Dtty-gid=3" # tty in NixOS has gid 3
     "-Ddebug-shell=${bashInteractive}/bin/bash"
-    "-Dglib=${stdenv.lib.boolToString (glib != null)}"
+    "-Dglib=${lib.boolToString (glib != null)}"
     # while we do not run tests we should also not build them. Removes about 600 targets
     "-Dtests=false"
-    "-Dimportd=${stdenv.lib.boolToString withImportd}"
-    "-Dlz4=true"
+    "-Danalyze=${lib.boolToString withAnalyze}"
+    "-Dgcrypt=${lib.boolToString (libgcrypt != null)}"
+    "-Dimportd=${lib.boolToString withImportd}"
+    "-Dlz4=${lib.boolToString withCompression}"
     "-Dhomed=false"
-    "-Dlogind=${stdenv.lib.boolToString withLogind}"
-    "-Dlocaled=${stdenv.lib.boolToString withLocaled}"
-    "-Dhostnamed=${stdenv.lib.boolToString withHostnamed}"
-    "-Dnetworkd=${stdenv.lib.boolToString withNetworkd}"
-    "-Dcryptsetup=${stdenv.lib.boolToString withCryptsetup}"
+    "-Dlogind=${lib.boolToString withLogind}"
+    "-Dlocaled=${lib.boolToString withLocaled}"
+    "-Dhostnamed=${lib.boolToString withHostnamed}"
+    "-Dmachined=${lib.boolToString withMachined}"
+    "-Dnetworkd=${lib.boolToString withNetworkd}"
+    "-Dpolkit=${lib.boolToString withPolkit}"
+    "-Dcryptsetup=${lib.boolToString withCryptsetup}"
     "-Dportabled=false"
-    "-Dhwdb=${stdenv.lib.boolToString withHwdb}"
-    "-Dremote=false"
+    "-Dhwdb=${lib.boolToString withHwdb}"
+    "-Dremote=${lib.boolToString withRemote}"
     "-Dsysusers=false"
-    "-Dtimedated=${stdenv.lib.boolToString withTimedated}"
-    "-Dtimesyncd=${stdenv.lib.boolToString withTimesyncd}"
+    "-Dtimedated=${lib.boolToString withTimedated}"
+    "-Dtimesyncd=${lib.boolToString withTimesyncd}"
+    "-Duserdb=${lib.boolToString withUserDb}"
+    "-Dcoredump=${lib.boolToString withCoredump}"
     "-Dfirstboot=false"
-    "-Dlocaled=true"
-    "-Dresolve=${stdenv.lib.boolToString withResolved}"
+    "-Dresolve=${lib.boolToString withResolved}"
     "-Dsplit-usr=false"
-    "-Dlibcurl=true"
+    "-Dlibcurl=${lib.boolToString wantCurl}"
     "-Dlibidn=false"
     "-Dlibidn2=true"
     "-Dquotacheck=false"
···
     # more frequent development builds
     "-Dman=true"
 
-    "-Dgnu-efi=${stdenv.lib.boolToString (withEfi && gnu-efi != null)}"
-  ] ++ stdenv.lib.optionals (withEfi && gnu-efi != null) [
+    "-Defi=${lib.boolToString withEfi}"
+    "-Dgnu-efi=${lib.boolToString withEfi}"
+  ] ++ lib.optionals withEfi [
     "-Defi-libdir=${toString gnu-efi}/lib"
     "-Defi-includedir=${toString gnu-efi}/include/efi"
     "-Defi-ldsdir=${toString gnu-efi}/lib"
+  ] ++ lib.optionals (withShellCompletions == false) [
+    "-Dbashcompletiondir=no"
+    "-Dzshcompletiondir=no"
+  ] ++ lib.optionals (!withNss) [
+    "-Dnss-myhostname=false"
+    "-Dnss-mymachines=false"
+    "-Dnss-resolve=false"
+    "-Dnss-systemd=false"
   ];
 
   preConfigure = ''
···
       src/core/mount.c \
       src/core/swap.c \
       src/cryptsetup/cryptsetup-generator.c \
-      src/fsck/fsck.c \
       src/journal/cat.c \
       src/nspawn/nspawn.c \
       src/remount-fs/remount-fs.c \
···
         --replace /sbin/mkswap ${lib.getBin utillinux}/sbin/mkswap \
         --replace /sbin/swapon ${lib.getBin utillinux}/sbin/swapon \
         --replace /sbin/swapoff ${lib.getBin utillinux}/sbin/swapoff \
-        --replace /sbin/mke2fs ${lib.getBin e2fsprogs}/sbin/mke2fs \
-        --replace /sbin/fsck ${lib.getBin utillinux}/sbin/fsck \
         --replace /bin/echo ${coreutils}/bin/echo \
         --replace /bin/cat ${coreutils}/bin/cat \
         --replace /sbin/sulogin ${lib.getBin utillinux}/sbin/sulogin \
···
   NIX_CFLAGS_COMPILE = toString [
     # Can't say ${polkit.bin}/bin/pkttyagent here because that would
     # lead to a cyclic dependency.
-    "-UPOLKIT_AGENT_BINARY_PATH" "-DPOLKIT_AGENT_BINARY_PATH=\"/run/current-system/sw/bin/pkttyagent\""
+    "-UPOLKIT_AGENT_BINARY_PATH"
+    "-DPOLKIT_AGENT_BINARY_PATH=\"/run/current-system/sw/bin/pkttyagent\""
 
     # Set the release_agent on /sys/fs/cgroup/systemd to the
     # currently running systemd (/run/current-system/systemd) so
     # that we don't use an obsolete/garbage-collected release agent.
-    "-USYSTEMD_CGROUP_AGENT_PATH" "-DSYSTEMD_CGROUP_AGENT_PATH=\"/run/current-system/systemd/lib/systemd/systemd-cgroups-agent\""
+    "-USYSTEMD_CGROUP_AGENT_PATH"
+    "-DSYSTEMD_CGROUP_AGENT_PATH=\"/run/current-system/systemd/lib/systemd/systemd-cgroups-agent\""
 
-    "-USYSTEMD_BINARY_PATH" "-DSYSTEMD_BINARY_PATH=\"/run/current-system/systemd/lib/systemd/systemd\""
+    "-USYSTEMD_BINARY_PATH"
+    "-DSYSTEMD_BINARY_PATH=\"/run/current-system/systemd/lib/systemd/systemd\""
   ];
 
   doCheck = false; # fails a bunch of tests
···
 
     # "kernel-install" shouldn't be used on NixOS.
     find $out -name "*kernel-install*" -exec rm {} \;
-  ''; # */
+  '' + lib.optionalString (!withDocumentation) ''
+    rm -rf $out/share/doc
+  '';
 
   enableParallelBuilding = true;
 
···
   # runtime; otherwise we can't and we need to reboot.
   passthru.interfaceVersion = 2;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = "https://www.freedesktop.org/wiki/Software/systemd/";
     description = "A system and service manager for Linux";
     license = licenses.lgpl21Plus;

pkgs/top-level/all-packages.nix

···
   };
   systemdMinimal = systemd.override {
     pname = "systemd-minimal";
-    withResolved = false;
-    withLogind = false;
+    withAnalyze = false;
+    withApparmor = false;
+    withCompression = false;
+    withCoredump = false;
+    withCryptsetup = false;
+    withDocumentation = false;
+    withEfi = false;
     withHostnamed = false;
+    withHwdb = false;
+    withImportd = false;
     withLocaled = false;
+    withLogind = false;
+    withMachined = false;
+    withNetworkd = false;
+    withNss = false;
+    withPCRE2 = false;
+    withPolkit = false;
+    withResolved = false;
+    withShellCompletions = false;
     withTimedated = false;
-    withHwdb = false;
-    withEfi = false;
-    withImportd = false;
-    withCryptsetup = false;
-    cryptsetup = null;
+    withTimesyncd = false;
+    withUserDb = false;
     glib = null;
+    libgcrypt = null;
     lvm2 = null;
   };