···89 => "usr/local/bin"
90 */
91 concatStringsSep = builtins.concatStringsSep or (separator: list:
92- concatStrings (intersperse separator list));
9394 /* Maps a function over a list of strings and then concatenates the
95 result with the specified separator interspersed between
···89 => "usr/local/bin"
90 */
91 concatStringsSep = builtins.concatStringsSep or (separator: list:
92+ lib.foldl' (x: y: x + y) "" (intersperse separator list));
9394 /* Maps a function over a list of strings and then concatenates the
95 result with the specified separator interspersed between
+3
nixos/modules/services/misc/paperless-ng.nix
···284 PATH = mkForce cfg.package.path;
285 PYTHONPATH = "${cfg.package.pythonPath}:${cfg.package}/lib/paperless-ng/src";
286 };
000287 # Bind to `paperless-ng-server` so that the web server never runs
288 # during migrations
289 bindsTo = [ "paperless-ng-server.service" ];
···284 PATH = mkForce cfg.package.path;
285 PYTHONPATH = "${cfg.package.pythonPath}:${cfg.package}/lib/paperless-ng/src";
286 };
287+ # Allow the web interface to access the private /tmp directory of the server.
288+ # This is required to support uploading files via the web interface.
289+ unitConfig.JoinsNamespaceOf = "paperless-ng-server.service";
290 # Bind to `paperless-ng-server` so that the web server never runs
291 # during migrations
292 bindsTo = [ "paperless-ng-server.service" ];
···1+{ lib, stdenv
2+, fetchurl, perl, gcc
3+, ncurses5
4+, ncurses6, gmp, libiconv, numactl
5+, llvmPackages
6+7+ # minimal = true; will remove files that aren't strictly necessary for
8+ # regular builds and GHC bootstrapping.
9+ # This is "useful" for staying within hydra's output limits for at least the
10+ # aarch64-linux architecture.
11+, minimal ? false
12+}:
13+14+# Prebuilt only does native
15+assert stdenv.targetPlatform == stdenv.hostPlatform;
16+17+let
18+ downloadsUrl = "https://downloads.haskell.org/ghc";
19+20+ version = "8.10.5";
21+22+ # Information about available bindists that we use in the build.
23+ #
24+ # # Bindist library checking
25+ #
26+ # The field `archSpecificLibraries` also provides a way for us get notified
27+ # early when the upstream bindist changes its dependencies (e.g. because a
28+ # newer Debian version is used that uses a new `ncurses` version).
29+ #
30+ # Usage:
31+ #
32+ # * You can find the `fileToCheckFor` of libraries by running `readelf -d`
33+ # on the compiler binary (`exePathForLibraryCheck`).
34+ # * To skip library checking for an architecture,
35+ # set `exePathForLibraryCheck = null`.
36+ # * To skip file checking for a specific arch specfic library,
37+ # set `fileToCheckFor = null`.
38+ ghcBinDists = {
39+ # Binary distributions for the default libc (e.g. glibc, or libSystem on Darwin)
40+ # nixpkgs uses for the respective system.
41+ defaultLibc = {
42+ i686-linux = {
43+ src = {
44+ url = "${downloadsUrl}/${version}/ghc-${version}-i386-deb9-linux.tar.xz";
45+ sha256 = "17cwmhhyz952psmp4j3pkdj0yrfxah3l2dawg5s4hdr228n5pjqc";
46+ };
47+ exePathForLibraryCheck = "ghc/stage2/build/tmp/ghc-stage2";
48+ archSpecificLibraries = [
49+ # The i686-linux bindist provided by GHC HQ is currently built on Debian 9,
50+ # which link it against `libtinfo.so.5` (ncurses 5).
51+ # Other bindists are linked `libtinfo.so.6` (ncurses 6).
52+ { nixPackage = ncurses5; fileToCheckFor = "libtinfo.so.5"; }
53+ ];
54+ };
55+ x86_64-linux = {
56+ src = {
57+ url = "${downloadsUrl}/${version}/ghc-${version}-x86_64-deb10-linux.tar.xz";
58+ sha256 = "11v76wgljyszc6mgz6r16i6wkifgl15a26q7ablihp2cr8h3qqmw";
59+ };
60+ exePathForLibraryCheck = "ghc/stage2/build/tmp/ghc-stage2";
61+ archSpecificLibraries = [
62+ { nixPackage = ncurses6; fileToCheckFor = "libtinfo.so.6"; }
63+ ];
64+ };
65+ armv7l-linux = {
66+ src = {
67+ url = "${downloadsUrl}/${version}/ghc-${version}-armv7-deb10-linux.tar.xz";
68+ sha256 = "0v5bvhb2z9j26yr0n9gc4xdq2lm37mr98g62p5z8pqahhhd0s5sn";
69+ };
70+ exePathForLibraryCheck = "ghc/stage2/build/tmp/ghc-stage2";
71+ archSpecificLibraries = [
72+ { nixPackage = ncurses6; fileToCheckFor = "libtinfo.so.6"; }
73+ ];
74+ };
75+ aarch64-linux = {
76+ src = {
77+ url = "${downloadsUrl}/${version}/ghc-${version}-aarch64-deb10-linux.tar.xz";
78+ sha256 = "1p0dgyn1m2nd8ax1g25lchaz9z2nk9jvyzf63biarq7qlzc5q24s";
79+ };
80+ exePathForLibraryCheck = "ghc/stage2/build/tmp/ghc-stage2";
81+ archSpecificLibraries = [
82+ { nixPackage = ncurses6; fileToCheckFor = "libtinfo.so.6"; }
83+ { nixPackage = numactl; fileToCheckFor = null; }
84+ ];
85+ };
86+ x86_64-darwin = {
87+ src = {
88+ url = "${downloadsUrl}/${version}/ghc-${version}-x86_64-apple-darwin.tar.xz";
89+ sha256 = "08javwfqd21kglbr1bnhnbjw2cggz1n668vi8kx5hbcnz3plf3zg";
90+ };
91+ exePathForLibraryCheck = null; # we don't have a library check for darwin yet
92+ archSpecificLibraries = [
93+ { nixPackage = ncurses6; fileToCheckFor = null; }
94+ { nixPackage = libiconv; fileToCheckFor = null; }
95+ ];
96+ };
97+ aarch64-darwin = {
98+ src = {
99+ url = "${downloadsUrl}/${version}/ghc-${version}-aarch64-apple-darwin.tar.xz";
100+ sha256 = "02fbcrzcc6m25z3ji867isml38jkg4blry70ljwl3l03zxq4ws03";
101+ };
102+ exePathForLibraryCheck = null; # we don't have a library check for darwin yet
103+ archSpecificLibraries = [
104+ { nixPackage = ncurses6; fileToCheckFor = null; }
105+ { nixPackage = libiconv; fileToCheckFor = null; }
106+ ];
107+ };
108+ };
109+ # Binary distributions for the musl libc for the respective system.
110+ musl = {
111+ x86_64-linux = {
112+ src = {
113+ url = "${downloadsUrl}/${version}/ghc-${version}-x86_64-alpine3.10-linux-integer-simple.tar.xz";
114+ sha256 = "1ql2qxywbbv0b9syvrm9kyh5d8midnl676lw4698ajras6gcvmzl";
115+ };
116+ exePathForLibraryCheck = "bin/ghc";
117+ archSpecificLibraries = [
118+ # In contrast to glibc builds, the musl-bindist uses `libncursesw.so.*`
119+ # instead of `libtinfo.so.*.`
120+ { nixPackage = ncurses6; fileToCheckFor = "libncursesw.so.6"; }
121+ ];
122+ };
123+ };
124+ };
125+126+ distSetName = if stdenv.hostPlatform.isMusl then "musl" else "defaultLibc";
127+128+ binDistUsed = ghcBinDists.${distSetName}.${stdenv.hostPlatform.system}
129+ or (throw "cannot bootstrap GHC on this platform ('${stdenv.hostPlatform.system}' with libc '${distSetName}')");
130+131+ useLLVM = !stdenv.targetPlatform.isx86;
132+133+ libPath =
134+ lib.makeLibraryPath (
135+ [
136+ gmp
137+ ]
138+ # Add arch-specific libraries.
139+ ++ map ({ nixPackage, ... }: nixPackage) binDistUsed.archSpecificLibraries
140+ );
141+142+ libEnvVar = lib.optionalString stdenv.hostPlatform.isDarwin "DY"
143+ + "LD_LIBRARY_PATH";
144+145+in
146+147+stdenv.mkDerivation rec {
148+ inherit version;
149+150+ name = "ghc-${version}-binary";
151+152+ src = fetchurl binDistUsed.src;
153+154+ nativeBuildInputs = [ perl ];
155+ propagatedBuildInputs =
156+ lib.optionals useLLVM [ llvmPackages.llvm ]
157+ # Because musl bindists currently provide no way to tell where
158+ # libgmp is (see not [musl bindists have no .buildinfo]), we need
159+ # to propagate `gmp`, otherwise programs built by this ghc will
160+ # fail linking with `cannot find -lgmp` errors.
161+ # Also, as of writing, the release pages of musl bindists claim
162+ # that they use `integer-simple` and do not require `gmp`; however
163+ # that is incorrect, so `gmp` is required until a release has been
164+ # made that includes https://gitlab.haskell.org/ghc/ghc/-/issues/20059.
165+ # (Note that for packaging the `-binary` compiler, nixpkgs does not care
166+ # about whether or not `gmp` is used; this comment is just here to explain
167+ # why the `gmp` dependency exists despite what the release page says.)
168+ ++ lib.optionals stdenv.hostPlatform.isMusl [ gmp ]; # musl bindist needs this
169+170+ # Set LD_LIBRARY_PATH or equivalent so that the programs running as part
171+ # of the bindist installer can find the libraries they expect.
172+ # Cannot patchelf beforehand due to relative RPATHs that anticipate
173+ # the final install location.
174+ ${libEnvVar} = libPath;
175+176+ postUnpack =
177+ # Verify our assumptions of which `libtinfo.so` (ncurses) version is used,
178+ # so that we know when ghc bindists upgrade that and we need to update the
179+ # version used in `libPath`.
180+ lib.optionalString
181+ (binDistUsed.exePathForLibraryCheck != null)
182+ # Note the `*` glob because some GHCs have a suffix when unpacked, e.g.
183+ # the musl bindist has dir `ghc-VERSION-x86_64-unknown-linux/`.
184+ # As a result, don't shell-quote this glob when splicing the string.
185+ (let buildExeGlob = ''ghc-${version}*/"${binDistUsed.exePathForLibraryCheck}"''; in
186+ lib.concatStringsSep "\n" [
187+ (''
188+ echo "Checking that ghc binary exists in bindist at ${buildExeGlob}"
189+ if ! test -e ${buildExeGlob}; then
190+ echo >&2 "GHC binary ${binDistUsed.exePathForLibraryCheck} could not be found in the bindist build directory (at ${buildExeGlob}) for arch ${stdenv.hostPlatform.system}, please check that ghcBinDists correctly reflect the bindist dependencies!"; exit 1;
191+ fi
192+ '')
193+ (lib.concatMapStringsSep
194+ "\n"
195+ ({ fileToCheckFor, nixPackage }:
196+ lib.optionalString (fileToCheckFor != null) ''
197+ echo "Checking bindist for ${fileToCheckFor} to ensure that is still used"
198+ if ! readelf -d ${buildExeGlob} | grep "${fileToCheckFor}"; then
199+ echo >&2 "File ${fileToCheckFor} could not be found in ${binDistUsed.exePathForLibraryCheck} for arch ${stdenv.hostPlatform.system}, please check that ghcBinDists correctly reflect the bindist dependencies!"; exit 1;
200+ fi
201+202+ echo "Checking that the nix package ${nixPackage} contains ${fileToCheckFor}"
203+ if ! test -e "${lib.getLib nixPackage}/lib/${fileToCheckFor}"; then
204+ echo >&2 "Nix package ${nixPackage} did not contain ${fileToCheckFor} for arch ${stdenv.hostPlatform.system}, please check that ghcBinDists correctly reflect the bindist dependencies!"; exit 1;
205+ fi
206+ ''
207+ )
208+ binDistUsed.archSpecificLibraries
209+ )
210+ ])
211+ # GHC has dtrace probes, which causes ld to try to open /usr/lib/libdtrace.dylib
212+ # during linking
213+ + lib.optionalString stdenv.isDarwin ''
214+ export NIX_LDFLAGS+=" -no_dtrace_dof"
215+ # not enough room in the object files for the full path to libiconv :(
216+ for exe in $(find . -type f -executable); do
217+ isScript $exe && continue
218+ ln -fs ${libiconv}/lib/libiconv.dylib $(dirname $exe)/libiconv.dylib
219+ install_name_tool -change /usr/lib/libiconv.2.dylib @executable_path/libiconv.dylib -change /usr/local/lib/gcc/6/libgcc_s.1.dylib ${gcc.cc.lib}/lib/libgcc_s.1.dylib $exe
220+ done
221+ '' +
222+223+ # Some scripts used during the build need to have their shebangs patched
224+ ''
225+ patchShebangs ghc-${version}/utils/
226+ patchShebangs ghc-${version}/configure
227+ '' +
228+ # We have to patch the GMP paths for the integer-gmp package.
229+ # Note [musl bindists have no .buildinfo]
230+ # Note that musl bindists do not contain them; unclear if that's intended;
231+ # see: https://gitlab.haskell.org/ghc/ghc/-/issues/20073#note_363231
232+ ''
233+ find . -name integer-gmp.buildinfo \
234+ -exec sed -i "s@extra-lib-dirs: @extra-lib-dirs: ${gmp.out}/lib@" {} \;
235+ '' + lib.optionalString stdenv.isDarwin ''
236+ find . -name base.buildinfo \
237+ -exec sed -i "s@extra-lib-dirs: @extra-lib-dirs: ${libiconv}/lib@" {} \;
238+ '' +
239+ # aarch64 does HAVE_NUMA so -lnuma requires it in library-dirs in rts/package.conf.in
240+ # FFI_LIB_DIR is a good indication of places it must be needed.
241+ lib.optionalString (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) ''
242+ find . -name package.conf.in \
243+ -exec sed -i "s@FFI_LIB_DIR@FFI_LIB_DIR ${numactl.out}/lib@g" {} \;
244+ '' +
245+ # Rename needed libraries and binaries, fix interpreter
246+ lib.optionalString stdenv.isLinux ''
247+ find . -type f -executable -exec patchelf \
248+ --interpreter ${stdenv.cc.bintools.dynamicLinker} {} \;
249+ '';
250+251+ # fix for `configure: error: Your linker is affected by binutils #16177`
252+ preConfigure = lib.optionalString
253+ stdenv.targetPlatform.isAarch32
254+ "LD=ld.gold";
255+256+ configurePlatforms = [ ];
257+ configureFlags = [
258+ "--with-gmp-includes=${lib.getDev gmp}/include"
259+ # Note `--with-gmp-libraries` does nothing for GHC bindists:
260+ # https://gitlab.haskell.org/ghc/ghc/-/merge_requests/6124
261+ ] ++ lib.optional stdenv.isDarwin "--with-gcc=${./gcc-clang-wrapper.sh}"
262+ # From: https://github.com/NixOS/nixpkgs/pull/43369/commits
263+ ++ lib.optional stdenv.hostPlatform.isMusl "--disable-ld-override";
264+265+ # No building is necessary, but calling make without flags ironically
266+ # calls install-strip ...
267+ dontBuild = true;
268+269+ # Apparently necessary for the ghc Alpine (musl) bindist:
270+ # When we strip, and then run the
271+ # patchelf --set-rpath "${libPath}:$(patchelf --print-rpath $p)" $p
272+ # below, running ghc (e.g. during `installCheckPhase)` gives some apparently
273+ # corrupted rpath or whatever makes the loader work on nonsensical strings:
274+ # running install tests
275+ # Error relocating /nix/store/...-ghc-8.10.2-binary/lib/ghc-8.10.5/bin/ghc: : symbol not found
276+ # Error relocating /nix/store/...-ghc-8.10.2-binary/lib/ghc-8.10.5/bin/ghc: ir6zf6c9f86pfx8sr30n2vjy-ghc-8.10.2-binary/lib/ghc-8.10.5/bin/../lib/x86_64-linux-ghc-8.10.5/libHSexceptions-0.10.4-ghc8.10.5.so: symbol not found
277+ # Error relocating /nix/store/...-ghc-8.10.2-binary/lib/ghc-8.10.5/bin/ghc: y/lib/ghc-8.10.5/bin/../lib/x86_64-linux-ghc-8.10.5/libHStemplate-haskell-2.16.0.0-ghc8.10.5.so: symbol not found
278+ # Error relocating /nix/store/...-ghc-8.10.2-binary/lib/ghc-8.10.5/bin/ghc: 8.10.5/libHStemplate-haskell-2.16.0.0-ghc8.10.5.so: symbol not found
279+ # Error relocating /nix/store/...-ghc-8.10.2-binary/lib/ghc-8.10.5/bin/ghc: �: symbol not found
280+ # Error relocating /nix/store/...-ghc-8.10.2-binary/lib/ghc-8.10.5/bin/ghc: �?: symbol not found
281+ # Error relocating /nix/store/...-ghc-8.10.2-binary/lib/ghc-8.10.5/bin/ghc: 64-linux-ghc-8.10.5/libHSexceptions-0.10.4-ghc8.10.5.so: symbol not found
282+ # This is extremely bogus and should be investigated.
283+ dontStrip = if stdenv.hostPlatform.isMusl then true else false; # `if` for explicitness
284+285+ # On Linux, use patchelf to modify the executables so that they can
286+ # find editline/gmp.
287+ postFixup = lib.optionalString stdenv.isLinux
288+ (if stdenv.hostPlatform.isAarch64 then
289+ # Keep rpath as small as possible on aarch64 for patchelf#244. All Elfs
290+ # are 2 directories deep from $out/lib, so pooling symlinks there makes
291+ # a short rpath.
292+ ''
293+ (cd $out/lib; ln -s ${ncurses6.out}/lib/libtinfo.so.6)
294+ (cd $out/lib; ln -s ${gmp.out}/lib/libgmp.so.10)
295+ (cd $out/lib; ln -s ${numactl.out}/lib/libnuma.so.1)
296+ for p in $(find "$out/lib" -type f -name "*\.so*"); do
297+ (cd $out/lib; ln -s $p)
298+ done
299+300+ for p in $(find "$out/lib" -type f -executable); do
301+ if isELF "$p"; then
302+ echo "Patchelfing $p"
303+ patchelf --set-rpath "\$ORIGIN:\$ORIGIN/../.." $p
304+ fi
305+ done
306+ ''
307+ else
308+ ''
309+ for p in $(find "$out" -type f -executable); do
310+ if isELF "$p"; then
311+ echo "Patchelfing $p"
312+ patchelf --set-rpath "${libPath}:$(patchelf --print-rpath $p)" $p
313+ fi
314+ done
315+ '') + lib.optionalString stdenv.isDarwin ''
316+ # not enough room in the object files for the full path to libiconv :(
317+ for exe in $(find "$out" -type f -executable); do
318+ isScript $exe && continue
319+ ln -fs ${libiconv}/lib/libiconv.dylib $(dirname $exe)/libiconv.dylib
320+ install_name_tool -change /usr/lib/libiconv.2.dylib @executable_path/libiconv.dylib -change /usr/local/lib/gcc/6/libgcc_s.1.dylib ${gcc.cc.lib}/lib/libgcc_s.1.dylib $exe
321+ done
322+323+ for file in $(find "$out" -name setup-config); do
324+ substituteInPlace $file --replace /usr/bin/ranlib "$(type -P ranlib)"
325+ done
326+ '' +
327+ lib.optionalString minimal ''
328+ # Remove profiling files
329+ find $out -type f -name '*.p_o' -delete
330+ find $out -type f -name '*.p_hi' -delete
331+ find $out -type f -name '*_p.a' -delete
332+ # `-f` because e.g. musl bindist does not have this file.
333+ rm -f $out/lib/ghc-*/bin/ghc-iserv-prof
334+ # Hydra will redistribute this derivation, so we have to keep the docs for
335+ # legal reasons (retaining the legal notices etc)
336+ # As a last resort we could unpack the docs separately and symlink them in.
337+ # They're in $out/share/{doc,man}.
338+ '';
339+340+ # In nixpkgs, musl based builds currently enable `pie` hardening by default
341+ # (see `defaultHardeningFlags` in `make-derivation.nix`).
342+ # But GHC cannot currently produce outputs that are ready for `-pie` linking.
343+ # Thus, disable `pie` hardening, otherwise `recompile with -fPIE` errors appear.
344+ # See:
345+ # * https://github.com/NixOS/nixpkgs/issues/129247
346+ # * https://gitlab.haskell.org/ghc/ghc/-/issues/19580
347+ hardeningDisable = lib.optional stdenv.targetPlatform.isMusl "pie";
348+349+ doInstallCheck = true;
350+ installCheckPhase = ''
351+ unset ${libEnvVar}
352+ # Sanity check, can ghc create executables?
353+ cd $TMP
354+ mkdir test-ghc; cd test-ghc
355+ cat > main.hs << EOF
356+ {-# LANGUAGE TemplateHaskell #-}
357+ module Main where
358+ main = putStrLn \$([|"yes"|])
359+ EOF
360+ $out/bin/ghc --make main.hs || exit 1
361+ echo compilation ok
362+ [ $(./main) == "yes" ]
363+ '';
364+365+ passthru = {
366+ targetPrefix = "";
367+ enableShared = true;
368+369+ # Our Cabal compiler name
370+ haskellCompilerName = "ghc-${version}";
371+ };
372+373+ meta = rec {
374+ homepage = "http://haskell.org/ghc";
375+ description = "The Glasgow Haskell Compiler";
376+ license = lib.licenses.bsd3;
377+ # HACK: since we can't encode the libc / abi in platforms, we need
378+ # to make the platform list dependent on the evaluation platform
379+ # in order to avoid eval errors with musl which supports less
380+ # platforms than the default libcs (i. e. glibc / libSystem).
381+ # This is done for the benefit of Hydra, so `packagePlatforms`
382+ # won't return any platforms that would cause an evaluation
383+ # failure for `pkgsMusl.haskell.compiler.ghc8102Binary`, as
384+ # long as the evaluator runs on a platform that supports
385+ # `pkgsMusl`.
386+ platforms = builtins.attrNames ghcBinDists.${distSetName};
387+ hydraPlatforms = builtins.filter (p: minimal || p != "aarch64-linux") platforms;
388+ maintainers = with lib.maintainers; [ lostnet ];
389+ };
390+}
···1-fixupOutputHooks+=('signDarwinBinariesIn $prefix')
23# Uses signingUtils, see definition of autoSignDarwinBinariesHook in
4# darwin-packages.nix
···14 return 0
15 fi
160017 while IFS= read -r -d $'\0' f; do
18 signIfRequired "$f"
19 done < <(find "$dir" -type f -print0)
20}
000000000
···1+postFixupHooks+=(signDarwinBinariesInAllOutputs)
23# Uses signingUtils, see definition of autoSignDarwinBinariesHook in
4# darwin-packages.nix
···14 return 0
15 fi
1617+ echo "signing $dir"
18+19 while IFS= read -r -d $'\0' f; do
20 signIfRequired "$f"
21 done < <(find "$dir" -type f -print0)
22}
23+24+# Apply fixup to each output.
25+signDarwinBinariesInAllOutputs() {
26+ local output
27+28+ for output in $outputs; do
29+ signDarwinBinariesIn "${!output}"
30+ done
31+}