From d1270ac85b811c476ae3bff22a60b11b1788b7db Mon Sep 17 00:00:00 2001 From: wucke13 Date: Mon, 21 Oct 2019 01:37:16 +0200 Subject: [PATCH 1/3] gnugp: adding option for minimal build Basically a flavour of gnugpg, which solely containts `bin/gnupg`. --- pkgs/tools/security/gnupg/22.nix | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/pkgs/tools/security/gnupg/22.nix b/pkgs/tools/security/gnupg/22.nix index f62f10c8cf9d..e54a1e1c5db9 100644 --- a/pkgs/tools/security/gnupg/22.nix +++ b/pkgs/tools/security/gnupg/22.nix @@ -1,17 +1,17 @@ { fetchurl, fetchpatch, stdenv, pkgconfig, libgcrypt, libassuan, libksba -, libgpgerror, libiconv, npth, gettext, texinfo, pcsclite, sqlite -, buildPackages +, libgpgerror, libiconv, npth, gettext, texinfo, buildPackages # Each of the dependencies below are optional. # Gnupg can be built without them at the cost of reduced functionality. -, pinentry ? null, guiSupport ? false -, adns ? null, gnutls ? null, libusb ? null, openldap ? null -, readline ? null, zlib ? null, bzip2 ? null +, guiSupport ? true, enableMinimal ? false +, adns ? null , bzip2 ? null , gnutls ? null , libusb ? null , openldap ? null +, pcsclite ? null , pinentry ? null , readline ? null , sqlite ? null , zlib ? +null }: with stdenv.lib; -assert guiSupport -> pinentry != null; +assert guiSupport -> pinentry != null && enableMinimal == false; stdenv.mkDerivation rec { pname = "gnupg"; @@ -37,7 +37,7 @@ stdenv.mkDerivation rec { postPatch = '' sed -i 's,hkps://hkps.pool.sks-keyservers.net,hkps://keys.openpgp.org,g' \ configure doc/dirmngr.texi doc/gnupg.info-1 - '' + stdenv.lib.optionalString stdenv.isLinux '' + '' + stdenv.lib.optionalString ( stdenv.isLinux && pcsclite != null) '' sed -i 's,"libpcsclite\.so[^"]*","${stdenv.lib.getLib pcsclite}/lib/libpcsclite.so",g' scd/scdaemon.c ''; #" fix Emacs syntax highlighting :-( @@ -50,7 +50,14 @@ stdenv.mkDerivation rec { "--with-npth-prefix=${npth}" ] ++ optional guiSupport "--with-pinentry-pgm=${pinentry}/${pinentryBinaryPath}"; - postInstall = '' + postInstall = if enableMinimal + then '' + rm -r $out/{libexec,sbin,share} + for f in `find $out/bin -type f -not -name gpg` + do + rm $f + done + '' else '' mkdir -p $out/lib/systemd/user for f in doc/examples/systemd-user/*.{service,socket} ; do substitute $f $out/lib/systemd/user/$(basename $f) \ From 29ac2262253cb2d1d330ed261353b98d3e03c706 Mon Sep 17 00:00:00 2001 From: wucke13 Date: Thu, 3 Oct 2019 22:24:15 +0200 Subject: [PATCH 2/3] systemd: adding support for systemd-importd Adding `systemd-importd` to the build, so that `machinectl`s `import-.*` may actually do anything. Currently they fail with ``` Failed to transfer image: The name org.freedesktop.import1 was not provided by any .service files ``` as `systemd-importd` is not built. Also registers the regarding dbus api and service in the systemd module. --- nixos/modules/system/boot/systemd.nix | 2 ++ pkgs/os-specific/linux/systemd/default.nix | 33 ++++++++++++++++++---- 2 files changed, 30 insertions(+), 5 deletions(-) diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix index 33b350902a1a..9e3c6149f922 100644 --- a/nixos/modules/system/boot/systemd.nix +++ b/nixos/modules/system/boot/systemd.nix @@ -63,6 +63,7 @@ let "systemd-logind.service" "autovt@.service" "systemd-user-sessions.service" + "dbus-org.freedesktop.import1.service" "dbus-org.freedesktop.machine1.service" "user@.service" "user-runtime-dir@.service" @@ -145,6 +146,7 @@ let "user.slice" "machine.slice" "machines.target" + "systemd-importd.service" "systemd-machined.service" "systemd-nspawn@.service" diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix index a9fc0c6f4b54..d14985d07edf 100644 --- a/pkgs/os-specific/linux/systemd/default.nix +++ b/pkgs/os-specific/linux/systemd/default.nix @@ -1,5 +1,5 @@ -{ stdenv, lib, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap, kmod -, xz, pam, acl, libuuid, m4, utillinux, libffi +{ stdenv, lib, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap +, curl, kmod, gnupg, gnutar, xz, pam, acl, libuuid, m4, utillinux, libffi , glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libidn2, libapparmor , audit, lz4, bzip2, libmicrohttpd, pcre2 , linuxHeaders ? stdenv.cc.libc.linuxHeaders @@ -15,7 +15,21 @@ , withKexectools ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) kexectools.meta.platforms, kexectools }: -stdenv.mkDerivation { +let gnupg-minimal = gnupg.override { + enableMinimal = true; + guiSupport = false; + pcsclite = null; + sqlite = null; + pinentry = null; + adns = null; + gnutls = null; + libusb = null; + openldap = null; + readline = null; + zlib = null; + bzip2 = null; +}; +in stdenv.mkDerivation { version = "243"; pname = "systemd"; @@ -41,7 +55,7 @@ stdenv.mkDerivation { (buildPackages.python3Packages.python.withPackages ( ps: with ps; [ python3Packages.lxml ])) ]; buildInputs = - [ linuxHeaders libcap kmod xz pam acl + [ linuxHeaders libcap curl.dev kmod xz pam acl /* cryptsetup */ libuuid glib libgcrypt libgpgerror libidn2 libmicrohttpd pcre2 ] ++ stdenv.lib.optional withKexectools kexectools ++ @@ -67,6 +81,7 @@ stdenv.mkDerivation { "-Ddebug-shell=${bashInteractive}/bin/bash" # while we do not run tests we should also not build them. Removes about 600 targets "-Dtests=false" + "-Dimportd=true" "-Dlz4=true" "-Dhostnamed=true" "-Dnetworkd=true" @@ -77,7 +92,7 @@ stdenv.mkDerivation { "-Dlocaled=true" "-Dresolve=true" "-Dsplit-usr=false" - "-Dlibcurl=false" + "-Dlibcurl=true" "-Dlibidn=false" "-Dlibidn2=true" "-Dquotacheck=false" @@ -144,6 +159,14 @@ stdenv.mkDerivation { patchShebangs $dir done + # absolute paths to gpg & tar + substituteInPlace src/import/pull-common.c \ + --replace '"gpg"' '"${gnupg-minimal}/bin/gpg"' + for file in src/import/{{export,import,pull}-tar,import-common}.c; do + substituteInPlace $file \ + --replace '"tar"' '"${gnutar}/bin/tar"' + done + substituteInPlace src/journal/catalog.c \ --replace /usr/lib/systemd/catalog/ $out/lib/systemd/catalog/ ''; From 52ed193ec7f167579b8acbb27d02283ae9e92eff Mon Sep 17 00:00:00 2001 From: Florian Klink Date: Sat, 2 Nov 2019 19:55:41 +0100 Subject: [PATCH 3/3] nixosTests.systemd-nspawn: add test This adds a test downloading an nspawn container via http, and ensures sha256sum verification and gpg signature verification work. --- nixos/tests/all-tests.nix | 1 + nixos/tests/systemd-nspawn.nix | 58 ++++++++++++++++++++++++++++++++++ 2 files changed, 59 insertions(+) create mode 100644 nixos/tests/systemd-nspawn.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 10564e063c69..67766cc1512d 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -269,6 +269,7 @@ in systemd-confinement = handleTest ./systemd-confinement.nix {}; systemd-timesyncd = handleTest ./systemd-timesyncd.nix {}; systemd-networkd-wireguard = handleTest ./systemd-networkd-wireguard.nix {}; + systemd-nspawn = handleTest ./systemd-nspawn.nix {}; pdns-recursor = handleTest ./pdns-recursor.nix {}; taskserver = handleTest ./taskserver.nix {}; telegraf = handleTest ./telegraf.nix {}; diff --git a/nixos/tests/systemd-nspawn.nix b/nixos/tests/systemd-nspawn.nix new file mode 100644 index 000000000000..c2039bb5980c --- /dev/null +++ b/nixos/tests/systemd-nspawn.nix @@ -0,0 +1,58 @@ +import ./make-test.nix ({pkgs, lib, ...}: +let + gpgKeyring = (pkgs.runCommand "gpg-keyring" { buildInputs = [ pkgs.gnupg ]; } '' + mkdir -p $out + export GNUPGHOME=$out + cat > foo < $out/pubkey.gpg + ''); + + nspawnImages = (pkgs.runCommand "localhost" { buildInputs = [ pkgs.coreutils pkgs.gnupg ]; } '' + mkdir -p $out + cd $out + dd if=/dev/urandom of=$out/testimage.raw bs=$((1024*1024+7)) count=5 + sha256sum testimage.raw > SHA256SUMS + export GNUPGHOME="$(mktemp -d)" + cp -R ${gpgKeyring}/* $GNUPGHOME + gpg --batch --sign --detach-sign --output SHA256SUMS.gpg SHA256SUMS + ''); +in { + name = "opensmtpd"; + + nodes = { + server = { pkgs, ... }: { + networking.firewall.allowedTCPPorts = [ 80 ]; + services.nginx = { + enable = true; + virtualHosts."server".root = nspawnImages; + }; + }; + client = { pkgs, ... }: { + environment.etc."systemd/import-pubring.gpg".source = "${gpgKeyring}/pubkey.gpg"; + }; + }; + + testScript = '' + startAll; + + $server->waitForUnit("nginx.service"); + $client->waitForUnit("network-online.target"); + $client->succeed("machinectl pull-raw --verify=signature http://server/testimage.raw"); + $client->succeed("cmp /var/lib/machines/testimage.raw ${nspawnImages}/testimage.raw"); + ''; +})