nixpkgs/pkgs/stdenv/darwin/make-bootstrap-tools.nix
Alyssa Ross fd78240ac8
treewide: use lib.getLib for OpenSSL libraries
At some point, I'd like to make another attempt at
71f1f4884b ("openssl: stop static binaries referencing libs"), which
was reverted in 195c7da07d.  One problem with my previous attempt is
that I moved OpenSSL's libraries to a lib output, but many dependent
packages were hardcoding the out output as the location of the
libraries.  This patch fixes every such case I could find in the tree.
It won't have any effect immediately, but will mean these packages
will automatically use an OpenSSL lib output if it is reintroduced in
future.

This patch should cause very few rebuilds, because it shouldn't make
any change at all to most packages I'm touching.  The few rebuilds
that are introduced come from when I've changed a package builder not
to use variable names like openssl.out in scripts / substitution
patterns, which would be confusing since they don't hardcode the
output any more.

I started by making the following global replacements:

    ${pkgs.openssl.out}/lib -> ${lib.getLib pkgs.openssl}/lib
    ${openssl.out}/lib -> ${lib.getLib openssl}/lib

Then I removed the ".out" suffix when part of the argument to
lib.makeLibraryPath, since that function uses lib.getLib internally.

Then I fixed up cases where openssl was part of the -L flag to the
compiler/linker, since that unambigously is referring to libraries.

Then I manually investigated and fixed the following packages:

 - pycurl
 - citrix-workspace
 - ppp
 - wraith
 - unbound
 - gambit
 - acl2

I'm reasonably confindent in my fixes for all of them.

For acl2, since the openssl library paths are manually provided above
anyway, I don't think openssl is required separately as a build input
at all.  Removing it doesn't make a difference to the output size, the
file list, or the closure.

I've tested evaluation with the OfBorg meta checks, to protect against
introducing evaluation failures.
2022-03-30 15:10:00 +00:00

374 lines
13 KiB
Nix

{ pkgspath ? ../../.., test-pkgspath ? pkgspath
, system ? builtins.currentSystem, crossSystem ? null, bootstrapFiles ? null
}:
let cross = if crossSystem != null
then { inherit crossSystem; }
else {};
custom-bootstrap = if bootstrapFiles != null
then { stdenvStages = args:
let args' = args // { bootstrapFiles = bootstrapFiles; };
in (import "${pkgspath}/pkgs/stdenv/darwin" args').stagesDarwin;
}
else {};
in with import pkgspath ({ inherit system; } // cross // custom-bootstrap);
let
llvmPackages = llvmPackages_11;
storePrefixLen = builtins.stringLength builtins.storeDir;
in rec {
coreutils_ = coreutils.override (args: {
# We want coreutils without ACL support.
aclSupport = false;
# Cannot use a single binary build, or it gets dynamically linked against gmp.
singleBinary = false;
});
cctools_ = darwin.cctools;
# Avoid debugging larger changes for now.
bzip2_ = bzip2.override (args: { linkStatic = true; });
# Avoid messing with libkrb5 and libnghttp2.
curl_ = curlMinimal.override (args: { gssSupport = false; http2Support = false; });
build = stdenv.mkDerivation {
name = "stdenv-bootstrap-tools";
nativeBuildInputs = [ buildPackages.nukeReferences buildPackages.cpio ]
++ lib.optionals targetPlatform.isAarch64 [ buildPackages.darwin.sigtool ];
buildCommand = ''
mkdir -p $out/bin $out/lib $out/lib/system $out/lib/darwin
${lib.optionalString stdenv.targetPlatform.isx86_64 ''
# Copy libSystem's .o files for various low-level boot stuff.
cp -d ${lib.getLib darwin.Libsystem}/lib/*.o $out/lib
# Resolv is actually a link to another package, so let's copy it properly
cp -L ${lib.getLib darwin.Libsystem}/lib/libresolv.9.dylib $out/lib
cp -rL ${darwin.Libsystem}/include $out
chmod -R u+w $out/include
cp -rL ${darwin.ICU}/include* $out/include
cp -rL ${libiconv}/include/* $out/include
cp -rL ${gnugrep.pcre.dev}/include/* $out/include
mv $out/include $out/include-Libsystem
''}
# Copy coreutils, bash, etc.
cp ${coreutils_}/bin/* $out/bin
(cd $out/bin && rm vdir dir sha*sum pinky factor pathchk runcon shuf who whoami shred users)
cp ${bash}/bin/bash $out/bin
cp ${findutils}/bin/find $out/bin
cp ${findutils}/bin/xargs $out/bin
cp -d ${diffutils}/bin/* $out/bin
cp -d ${gnused}/bin/* $out/bin
cp -d ${gnugrep}/bin/grep $out/bin
cp ${gawk}/bin/gawk $out/bin
cp -d ${gawk}/bin/awk $out/bin
cp ${gnutar}/bin/tar $out/bin
cp ${gzip}/bin/gzip $out/bin
cp ${bzip2_.bin}/bin/bzip2 $out/bin
cp -d ${gnumake}/bin/* $out/bin
cp -d ${patch}/bin/* $out/bin
cp -d ${xz.bin}/bin/xz $out/bin
# This used to be in-nixpkgs, but now is in the bundle
# because I can't be bothered to make it partially static
cp ${curl_.bin}/bin/curl $out/bin
cp -d ${curl_.out}/lib/libcurl*.dylib $out/lib
cp -d ${libssh2.out}/lib/libssh*.dylib $out/lib
cp -d ${lib.getLib openssl}/lib/*.dylib $out/lib
cp -d ${gnugrep.pcre.out}/lib/libpcre*.dylib $out/lib
cp -d ${lib.getLib libiconv}/lib/lib*.dylib $out/lib
cp -d ${lib.getLib gettext}/lib/libintl*.dylib $out/lib
chmod +x $out/lib/libintl*.dylib
cp -d ${ncurses.out}/lib/libncurses*.dylib $out/lib
cp -d ${libxml2.out}/lib/libxml2*.dylib $out/lib
# Copy what we need of clang
cp -d ${llvmPackages.clang-unwrapped}/bin/clang* $out/bin
cp -rd ${lib.getLib llvmPackages.clang-unwrapped}/lib/* $out/lib
cp -d ${lib.getLib llvmPackages.libcxx}/lib/libc++*.dylib $out/lib
cp -d ${lib.getLib llvmPackages.libcxxabi}/lib/libc++abi*.dylib $out/lib
cp -d ${lib.getLib llvmPackages.compiler-rt}/lib/darwin/libclang_rt* $out/lib/darwin
cp -d ${lib.getLib llvmPackages.compiler-rt}/lib/libclang_rt* $out/lib
cp -d ${lib.getLib llvmPackages.llvm.lib}/lib/libLLVM.dylib $out/lib
cp -d ${lib.getLib libffi}/lib/libffi*.dylib $out/lib
mkdir $out/include
cp -rd ${llvmPackages.libcxx.dev}/include/c++ $out/include
${lib.optionalString targetPlatform.isAarch64 ''
# copy .tbd assembly utils
cp -d ${pkgs.darwin.rewrite-tbd}/bin/rewrite-tbd $out/bin
cp -d ${lib.getLib pkgs.libyaml}/lib/libyaml*.dylib $out/lib
# copy package extraction tools
cp -d ${pkgs.pbzx}/bin/pbzx $out/bin
cp -d ${lib.getLib pkgs.xar}/lib/libxar*.dylib $out/lib
cp -d ${pkgs.bzip2.out}/lib/libbz2*.dylib $out/lib
# copy sigtool
cp -d ${pkgs.darwin.sigtool}/bin/sigtool $out/bin
cp -d ${pkgs.darwin.sigtool}/bin/codesign $out/bin
''}
cp -d ${lib.getLib darwin.ICU}/lib/libicu*.dylib $out/lib
cp -d ${zlib.out}/lib/libz.* $out/lib
cp -d ${gmpxx.out}/lib/libgmp*.* $out/lib
cp -d ${xz.out}/lib/liblzma*.* $out/lib
# Copy binutils.
for i in as ld ar ranlib nm strip otool install_name_tool lipo codesign_allocate; do
cp ${cctools_}/bin/$i $out/bin
done
cp -d ${lib.getLib darwin.libtapi}/lib/libtapi* $out/lib
${lib.optionalString targetPlatform.isx86_64 ''
cp -rd ${pkgs.darwin.CF}/Library $out
''}
chmod -R u+w $out
nuke-refs $out/bin/*
rpathify() {
local libs=$(${stdenv.cc.targetPrefix}otool -L "$1" | tail -n +2 | grep -o "$NIX_STORE.*-\S*") || true
local newlib
for lib in $libs; do
${stdenv.cc.targetPrefix}install_name_tool -change $lib "@rpath/$(basename "$lib")" "$1"
done
}
# Strip executables even further
for i in $out/bin/*; do
if test -x $i -a ! -L $i; then
chmod +w $i
${stdenv.cc.targetPrefix}strip $i || true
fi
done
for i in $out/bin/* $out/lib/*.dylib $out/lib/darwin/*.dylib $out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation; do
if test -x "$i" -a ! -L "$i"; then
echo "Adding rpath to $i"
rpathify $i
fi
done
for i in $out/bin/*; do
if test -x "$i" -a ! -L "$i"; then
echo "Adding @executable_path to rpath in $i"
${stdenv.cc.targetPrefix}install_name_tool -add_rpath '@executable_path/../lib' $i
fi
done
nuke-refs $out/lib/*
nuke-refs $out/lib/system/*
nuke-refs $out/lib/darwin/*
nuke-refs $out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
mkdir $out/.pack
mv $out/* $out/.pack
mv $out/.pack $out/pack
mkdir $out/on-server
cp ${stdenv.shell} $out/on-server/sh
cp ${cpio}/bin/cpio $out/on-server
cp ${coreutils_}/bin/mkdir $out/on-server
cp ${bzip2_.bin}/bin/bzip2 $out/on-server
chmod u+w $out/on-server/*
${stdenv.cc.targetPrefix}strip $out/on-server/*
nuke-refs $out/on-server/*
(cd $out/pack && (find | cpio -o -H newc)) | bzip2 > $out/on-server/bootstrap-tools.cpio.bz2
'';
allowedReferences = [];
meta = {
maintainers = [ lib.maintainers.copumpkin ];
};
};
dist = stdenv.mkDerivation {
name = "stdenv-bootstrap-tools";
buildCommand = ''
mkdir -p $out/nix-support
echo "file tarball ${build}/on-server/bootstrap-tools.cpio.bz2" >> $out/nix-support/hydra-build-products
echo "file sh ${build}/on-server/sh" >> $out/nix-support/hydra-build-products
echo "file cpio ${build}/on-server/cpio" >> $out/nix-support/hydra-build-products
echo "file mkdir ${build}/on-server/mkdir" >> $out/nix-support/hydra-build-products
echo "file bzip2 ${build}/on-server/bzip2" >> $out/nix-support/hydra-build-products
'';
};
bootstrapLlvmVersion = llvmPackages.llvm.version;
bootstrapFiles = {
sh = "${build}/on-server/sh";
bzip2 = "${build}/on-server/bzip2";
mkdir = "${build}/on-server/mkdir";
cpio = "${build}/on-server/cpio";
tarball = "${build}/on-server/bootstrap-tools.cpio.bz2";
};
unpack = stdenv.mkDerivation (bootstrapFiles // {
name = "unpack";
# This is by necessity a near-duplicate of unpack-bootstrap-tools.sh. If we refer to it directly,
# we can't make any changes to it due to our testing stdenv depending on it. Think of this as the
# unpack-bootstrap-tools.sh for the next round of bootstrap tools.
# TODO: think through alternate designs, such as hosting this script as an output of the process.
buildCommand = ''
# Unpack the bootstrap tools tarball.
echo Unpacking the bootstrap tools...
$mkdir $out
$bzip2 -d < $tarball | (cd $out && $cpio -i)
# Set the ELF interpreter / RPATH in the bootstrap binaries.
echo Patching the tools...
export PATH=$out/bin
for i in $out/bin/*; do
if ! test -L $i; then
echo patching $i
install_name_tool -add_rpath $out/lib $i || true
fi
done
ln -s libresolv.9.dylib $out/lib/libresolv.dylib
for i in $out/lib/*.dylib $out/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation; do
if test ! -L "$i" -a "$i" != "$out/lib/libSystem*.dylib"; then
echo "Patching $i"
id=$(otool -D "$i" | tail -n 1)
install_name_tool -id "$(dirname $i)/$(basename $id)" $i
libs=$(otool -L "$i" | tail -n +2 | grep -v libSystem | cat)
if [ -n "$libs" ]; then
install_name_tool -add_rpath $out/lib $i
fi
fi
done
ln -s bash $out/bin/sh
ln -s bzip2 $out/bin/bunzip2
# Provide a gunzip script.
cat > $out/bin/gunzip <<EOF
#!$out/bin/sh
exec $out/bin/gzip -d "\$@"
EOF
chmod +x $out/bin/gunzip
# Provide fgrep/egrep.
echo "#! $out/bin/sh" > $out/bin/egrep
echo "exec $out/bin/grep -E \"\$@\"" >> $out/bin/egrep
echo "#! $out/bin/sh" > $out/bin/fgrep
echo "exec $out/bin/grep -F \"\$@\"" >> $out/bin/fgrep
cat >$out/bin/dsymutil << EOF
#!$out/bin/sh
EOF
chmod +x $out/bin/egrep $out/bin/fgrep $out/bin/dsymutil
'';
allowedReferences = [ "out" ];
});
test = stdenv.mkDerivation {
name = "test";
realBuilder = "${unpack}/bin/bash";
buildCommand = ''
export PATH=${unpack}/bin
ls -l
mkdir $out
mkdir $out/bin
sed --version
find --version
diff --version
patch --version
make --version
awk --version
grep --version
clang --version
xz --version
# The grep will return a nonzero exit code if there is no match, and we want to assert that we have
# an SSL-capable curl
curl --version | grep SSL
${build}/on-server/sh -c 'echo Hello World'
# This approximates a bootstrap version of libSystem can that be
# assembled via fetchurl. Adapted from main libSystem expression.
mkdir libSystem-boot
cp -vr \
${darwin.darwin-stubs}/usr/lib/libSystem.B.tbd \
${darwin.darwin-stubs}/usr/lib/system \
libSystem-boot
substituteInPlace libSystem-boot/libSystem.B.tbd \
--replace "/usr/lib/system/" "$PWD/libSystem-boot/system/"
ln -s libSystem.B.tbd libSystem-boot/libSystem.tbd
# End of bootstrap libSystem
export flags="-idirafter ${unpack}/include-Libsystem --sysroot=${unpack} -L${unpack}/lib -L$PWD/libSystem-boot"
export CPP="clang -E $flags"
export CC="clang $flags -Wl,-rpath,${unpack}/lib -Wl,-v -Wl,-sdk_version,10.10"
export CXX="clang++ $flags --stdlib=libc++ -lc++abi -isystem${unpack}/include/c++/v1 -Wl,-rpath,${unpack}/lib -Wl,-v -Wl,-sdk_version,10.10"
echo '#include <stdio.h>' >> foo.c
echo '#include <float.h>' >> foo.c
echo '#include <limits.h>' >> foo.c
echo 'int main() { printf("Hello World\n"); return 0; }' >> foo.c
$CC -o $out/bin/foo foo.c
$out/bin/foo
echo '#include <CoreFoundation/CoreFoundation.h>' >> bar.c
echo 'int main() { CFShow(CFSTR("Hullo")); return 0; }' >> bar.c
$CC -F${unpack}/Library/Frameworks -framework CoreFoundation -o $out/bin/bar bar.c
$out/bin/bar
echo '#include <iostream>' >> bar.cc
echo 'int main() { std::cout << "Hello World\n"; }' >> bar.cc
$CXX -v -o $out/bin/bar bar.cc
$out/bin/bar
tar xvf ${hello.src}
cd hello-*
# stdenv bootstrap tools ship a broken libiconv.dylib https://github.com/NixOS/nixpkgs/issues/158331
am_cv_func_iconv=no ./configure --prefix=$out
make
make install
$out/bin/hello
'';
};
# The ultimate test: bootstrap a whole stdenv from the tools specified above and get a package set out of it
test-pkgs = import test-pkgspath {
# if the bootstrap tools are for another platform, we should be testing
# that platform.
system = if crossSystem != null then crossSystem else system;
stdenvStages = args: let
args' = args // { inherit bootstrapLlvmVersion bootstrapFiles; };
in (import (test-pkgspath + "/pkgs/stdenv/darwin") args').stagesDarwin;
};
}