Deuxfleurs/garage
42
39
Fork 55
Code Issues 73 Pull requests 7 Releases 29 Wiki Activity

Fix: compile aarch64+armv6 as static binaries
All checks were successful
continuous-integration/drone/push Build is passing
Details
continuous-integration/drone Build is passing
Details
continuous-integration/drone/pr Build is passing
Details

Browse source
This commit is contained in:
Quentin 2022-07-23 12:17:41 +02:00
parent e680efb361
commit fe053957e5
Signed by: quentin
GPG key ID: E9602264D639FF68
1 changed files with 29 additions and 27 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
default.nix
View file

@ -56,45 +56,47 @@ in let
*/ */
overrides = pkgs.rustBuilder.overrides.all ++ [ overrides = pkgs.rustBuilder.overrides.all ++ [
/* /*
[1] We need to alter Nix hardening to be able to statically compile: PIE, [1] We need to alter Nix hardening to make static binaries: PIE,
Position Independent Executables seems to be supported only on amd64. Having Position Independent Executables seems to be supported only on amd64. Having
this flags set either make our executables crash or compile as dynamic on many platforms. this flag set either 1. make our executables crash or 2. compile as dynamic on some platforms.
In the following section codegenOpts, we reactive it for the supported targets Here, we deactivate it. Later (find `codegenOpts`), we reactivate it for supported targets
(only amd64 curently) through the `-static-pie` flag. PIE is a feature used (only amd64 curently) through the `-static-pie` flag.
by ASLR, which helps mitigate security issues. PIE is a feature used by ASLR, which helps mitigate security issues.
Learn more about Nix Hardening: https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/cc-wrapper/add-hardening.sh Learn more about Nix Hardening at: https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/cc-wrapper/add-hardening.sh
*/
(pkgs.rustBuilder.rustLib.makeOverride {
name = "garage";
overrideAttrs = drv: { hardeningDisable = [ "pie" ]; };
})
(pkgs.rustBuilder.rustLib.makeOverride {
name = "garage_rpc";
/*
[2] We want to inject the git version while keeping the build deterministic. [2] We want to inject the git version while keeping the build deterministic.
As we do not want to consider the .git folder as part of the input source, As we do not want to consider the .git folder as part of the input source,
we ask the user (the CI often) to pass the value to Nix. we ask the user (the CI often) to pass the value to Nix.
*/ */
(pkgs.rustBuilder.rustLib.makeOverride {
name = "garage_rpc";
overrideAttrs = drv: overrideAttrs = drv:
/* [1] */ { hardeningDisable = [ "pie" ]; } (if git_version != null then {
//
/* [2] */ (if git_version != null then {
preConfigure = '' preConfigure = ''
${drv.preConfigure or ""} ${drv.preConfigure or ""}
export GIT_VERSION="${git_version}" export GIT_VERSION="${git_version}"
''; '';
} else {}); } else {});
})
/* /*
We ship some parts of the code disabled by default by putting them behind a flag. [3] We ship some parts of the code disabled by default by putting them behind a flag.
It speeds up the compilation (when the feature is not required) and released crates have less dependency by default (less attack surface, disk space, etc.). It speeds up the compilation (when the feature is not required) and released crates have less dependency by default (less attack surface, disk space, etc.).
But we want to ship these additional features when we release Garage. But we want to ship these additional features when we release Garage.
In the end, we chose to exclude all features from debug builds while putting (all of) them in the release builds. In the end, we chose to exclude all features from debug builds while putting (all of) them in the release builds.
Currently, the only feature of Garage is kubernetes-discovery from the garage_rpc crate. Currently, the only feature of Garage is kubernetes-discovery from the garage_rpc crate.
*/ */
(pkgs.rustBuilder.rustLib.makeOverride { overrideArgs = old: {
name = "garage_rpc";
overrideArgs = old:
{
features = if release then [ "kubernetes-discovery" ] else []; features = if release then [ "kubernetes-discovery" ] else [];
}; };
}) })
]; ];
packageFun = import ./Cargo.nix; packageFun = import ./Cargo.nix;