tjh.dev
1{
2 lib,
3 fetchFromGitHub,
4 version,
5 suffix ? "",
6 hash ? null,
7 src ? fetchFromGitHub {
8 owner = "NixOS";
9 repo = "nix";
10 rev = version;
11 inherit hash;
12 },
13 patches ? [ ],
14 knownVulnerabilities ? [ ],
15 maintainers ? [
16 lib.maintainers.lovesegfault
17 lib.maintainers.artturin
18 ],
19 teams ? [ lib.teams.nix ],
20 self_attribute_name,
21}@args:
22assert (hash == null) -> (src != null);
23let
24 atLeast224 = lib.versionAtLeast version "2.24pre";
25 atLeast225 = lib.versionAtLeast version "2.25pre";
26in
27{
28 stdenv,
29 autoconf-archive,
30 autoreconfHook,
31 bash,
32 bison,
33 boehmgc,
34 boost,
35 brotli,
36 busybox-sandbox-shell,
37 bzip2,
38 callPackage,
39 coreutils,
40 curl,
41 docbook_xsl_ns,
42 docbook5,
43 editline,
44 flex,
45 git,
46 gnutar,
47 gtest,
48 gzip,
49 jq,
50 lib,
51 libarchive,
52 libcpuid,
53 libgit2,
54 libsodium,
55 libxml2,
56 libxslt,
57 lowdown,
58 lowdown-unsandboxed,
59 toml11,
60 man,
61 mdbook,
62 mdbook-linkcheck,
63 nlohmann_json,
64 nixosTests,
65 openssl,
66 perl,
67 python3,
68 pkg-config,
69 rapidcheck,
70 sqlite,
71 util-linuxMinimal,
72 xz,
73 enableDocumentation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
74 enableStatic ? stdenv.hostPlatform.isStatic,
75 withAWS ?
76 lib.meta.availableOn stdenv.hostPlatform aws-c-common
77 && !enableStatic
78 && (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isDarwin),
79 aws-c-common,
80 aws-sdk-cpp,
81 withLibseccomp ? lib.meta.availableOn stdenv.hostPlatform libseccomp,
82 libseccomp,
83
84 confDir,
85 stateDir,
86 storeDir,
87
88 # passthru tests
89 pkgsi686Linux,
90 pkgsStatic,
91 runCommand,
92 pkgs,
93}:
94let
95 self = stdenv.mkDerivation {
96 pname = "nix";
97
98 version = "${version}${suffix}";
99 VERSION_SUFFIX = suffix;
100
101 inherit src patches;
102
103 outputs = [
104 "out"
105 "dev"
106 ]
107 ++ lib.optionals enableDocumentation [
108 "man"
109 "doc"
110 ];
111
112 hardeningEnable = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "pie" ];
113
114 hardeningDisable = [
115 "shadowstack"
116 ]
117 ++ lib.optional stdenv.hostPlatform.isMusl "fortify";
118
119 nativeInstallCheckInputs = lib.optionals atLeast224 [
120 git
121 man
122 ];
123
124 nativeBuildInputs = [
125 pkg-config
126 autoconf-archive
127 autoreconfHook
128 bison
129 flex
130 jq
131 ]
132 ++ lib.optionals enableDocumentation (
133 if atLeast224 then
134 [
135 (lib.getBin lowdown-unsandboxed)
136 mdbook
137 mdbook-linkcheck
138 ]
139 else
140 [
141 libxslt
142 libxml2
143 docbook_xsl_ns
144 docbook5
145 ]
146 )
147 ++ lib.optionals stdenv.hostPlatform.isLinux [
148 util-linuxMinimal
149 ];
150
151 buildInputs = [
152 boost
153 brotli
154 bzip2
155 curl
156 editline
157 libsodium
158 openssl
159 sqlite
160 xz
161 gtest
162 libarchive
163 lowdown
164 ]
165 ++ lib.optionals atLeast224 [
166 libgit2
167 toml11
168 rapidcheck
169 ]
170 ++ lib.optionals (atLeast225 && enableDocumentation) [
171 python3
172 ]
173 ++ lib.optionals (stdenv.hostPlatform.isx86_64) [
174 libcpuid
175 ]
176 ++ lib.optionals withLibseccomp [
177 libseccomp
178 ]
179 ++ lib.optionals withAWS [
180 aws-sdk-cpp
181 ];
182
183 propagatedBuildInputs = [
184 boehmgc
185 ]
186 ++ lib.optionals atLeast224 [
187 nlohmann_json
188 ];
189
190 postPatch = ''
191 patchShebangs --build tests
192 '';
193
194 preConfigure =
195 # Copy libboost_context so we don't get all of Boost in our closure.
196 # https://github.com/NixOS/nixpkgs/issues/45462
197 lib.optionalString (!enableStatic) ''
198 mkdir -p $out/lib
199 cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib
200 rm -f $out/lib/*.a
201 ${lib.optionalString stdenv.hostPlatform.isLinux ''
202 chmod u+w $out/lib/*.so.*
203 patchelf --set-rpath $out/lib:${lib.getLib stdenv.cc.cc}/lib $out/lib/libboost_thread.so.*
204 ''}
205 ''
206 +
207 # On all versions before c9f51e87057652db0013289a95deffba495b35e7, which
208 # removes config.nix entirely and is not present in 2.3.x, we need to
209 # patch around an issue where the Nix configure step pulls in the build
210 # system's bash and other utilities when cross-compiling.
211 lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform && !atLeast224) ''
212 mkdir tmp/
213 substitute corepkgs/config.nix.in tmp/config.nix.in \
214 --subst-var-by bash ${bash}/bin/bash \
215 --subst-var-by coreutils ${coreutils}/bin \
216 --subst-var-by bzip2 ${bzip2}/bin/bzip2 \
217 --subst-var-by gzip ${gzip}/bin/gzip \
218 --subst-var-by xz ${xz}/bin/xz \
219 --subst-var-by tar ${gnutar}/bin/tar \
220 --subst-var-by tr ${coreutils}/bin/tr
221 mv tmp/config.nix.in corepkgs/config.nix.in
222 '';
223
224 configureFlags = [
225 "--with-store-dir=${storeDir}"
226 "--localstatedir=${stateDir}"
227 "--sysconfdir=${confDir}"
228 "--enable-gc"
229 ]
230 ++ lib.optionals (!enableDocumentation) [
231 "--disable-doc-gen"
232 ]
233 ++ lib.optionals stdenv.hostPlatform.isLinux [
234 "--with-sandbox-shell=${busybox-sandbox-shell}/bin/busybox"
235 ]
236 ++ lib.optionals (atLeast224 && stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isStatic) [
237 "--enable-embedded-sandbox-shell"
238 ]
239 ++
240 lib.optionals
241 (
242 stdenv.hostPlatform != stdenv.buildPlatform
243 && stdenv.hostPlatform ? nix
244 && stdenv.hostPlatform.nix ? system
245 )
246 [
247 "--with-system=${stdenv.hostPlatform.nix.system}"
248 ]
249 ++ lib.optionals (!withLibseccomp) [
250 # RISC-V support in progress https://github.com/seccomp/libseccomp/pull/50
251 "--disable-seccomp-sandboxing"
252 ]
253 ++ lib.optionals (atLeast224 && stdenv.cc.isGNU && !enableStatic) [
254 "--enable-lto"
255 ];
256
257 env.CXXFLAGS = toString (
258 lib.optionals (lib.versionAtLeast lowdown.version "1.4.0") [
259 # Autotools based build system wasn't updated with the backport of
260 # https://github.com/NixOS/nix/pull/12115, so set the define explicitly.
261 "-DHAVE_LOWDOWN_1_4"
262 ]
263 );
264
265 makeFlags = [
266 # gcc runs multi-threaded LTO using make and does not yet detect the new fifo:/path style
267 # of make jobserver. until gcc adds support for this we have to instruct make to use this
268 # old style or LTO builds will run their linking on only one thread, which takes forever.
269 "--jobserver-style=pipe"
270 "profiledir=$(out)/etc/profile.d"
271 ]
272 ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "PRECOMPILE_HEADERS=0"
273 ++ lib.optional (stdenv.hostPlatform.isDarwin) "PRECOMPILE_HEADERS=1";
274
275 installFlags = [ "sysconfdir=$(out)/etc" ];
276
277 doInstallCheck = true;
278 installCheckTarget = if atLeast224 then "installcheck" else null;
279
280 # socket path becomes too long otherwise
281 preInstallCheck =
282 lib.optionalString stdenv.hostPlatform.isDarwin ''
283 export TMPDIR=$NIX_BUILD_TOP
284 ''
285 # Prevent crashes in libcurl due to invoking Objective-C `+initialize` methods after `fork`.
286 # See http://sealiesoftware.com/blog/archive/2017/6/5/Objective-C_and_fork_in_macOS_1013.html.
287 + lib.optionalString stdenv.hostPlatform.isDarwin ''
288 export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES
289 ''
290 # See https://github.com/NixOS/nix/issues/5687
291 + lib.optionalString (atLeast224 && stdenv.hostPlatform.isDarwin) ''
292 echo "exit 99" > tests/gc-non-blocking.sh
293 '' # TODO: investigate why this broken
294 + lib.optionalString (atLeast224 && stdenv.hostPlatform.system == "aarch64-linux") ''
295 echo "exit 0" > tests/functional/flakes/show.sh
296 ''
297 + ''
298 # nixStatic otherwise does not find its man pages in tests.
299 export MANPATH=$man/share/man:$MANPATH
300 '';
301
302 separateDebugInfo = stdenv.hostPlatform.isLinux && (atLeast224 -> !enableStatic);
303
304 enableParallelBuilding = true;
305
306 passthru = {
307 inherit aws-sdk-cpp boehmgc;
308
309 perl-bindings = perl.pkgs.toPerlModule (
310 callPackage ./nix-perl.nix {
311 nix = self;
312 }
313 );
314
315 tests = import ./tests.nix {
316 inherit
317 runCommand
318 version
319 src
320 lib
321 stdenv
322 pkgs
323 pkgsi686Linux
324 pkgsStatic
325 nixosTests
326 self_attribute_name
327 ;
328 nix = self;
329 };
330 };
331
332 # point 'nix edit' and ofborg at the file that defines the attribute,
333 # not this common file.
334 pos = builtins.unsafeGetAttrPos "version" args;
335 meta = with lib; {
336 description = "Powerful package manager that makes package management reliable and reproducible";
337 longDescription = ''
338 Nix is a powerful package manager for Linux and other Unix systems that
339 makes package management reliable and reproducible. It provides atomic
340 upgrades and rollbacks, side-by-side installation of multiple versions of
341 a package, multi-user package management and easy setup of build
342 environments.
343 '';
344 homepage = "https://nixos.org/";
345 license = licenses.lgpl21Plus;
346 inherit knownVulnerabilities maintainers teams;
347 platforms = platforms.unix;
348 outputsToInstall = [ "out" ] ++ optional enableDocumentation "man";
349 mainProgram = "nix";
350 };
351 };
352in
353self