7a7c745...master · nix-bundle

AppRun.cnew file+280

since splitsnapshots

unifiedsplit

@@ -0,0 +1,280 @@

1+/**************************************************************************

2+

5+

7+

8+Permission is hereby granted, free of charge, to any person obtaining a copy

9+of this software and associated documentation files (the "Software"), to deal

10+in the Software without restriction, including without limitation the rights

11+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell

12+copies of the Software, and to permit persons to whom the Software is

13+furnished to do so, subject to the following conditions:

14+

15+The above copyright notice and this permission notice shall be included in

16+all copies or substantial portions of the Software.

17+

18+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

19+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

20+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

21+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

22+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

23+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN

24+THE SOFTWARE.

25+

26+**************************************************************************/

27+

28+#define _GNU_SOURCE

29+#include <stdio.h>

30+#include <stdlib.h>

31+#include <unistd.h>

32+#include <libgen.h>

33+#include <dirent.h>

34+#include <string.h>

35+#include <sys/stat.h>

36+#include <sched.h>

37+#include <fcntl.h>

38+#include <sys/mount.h>

39+#include <errno.h>

40+

41+#define die(...) \

42+ do { \

43+ fprintf(stderr, "Error: " __VA_ARGS__); \

44+ exit(1); \

45+ } while (0);

46+

47+#define PATH_MAX 4096

48+

49+#define LINE_SIZE 255

50+

51+#define err_exit(format, ...) { fprintf(stderr, format ": %s\n", ##__VA_ARGS__, strerror(errno)); exit(EXIT_FAILURE); }

52+

53+int filter (const struct dirent *dir) {

54+ char *p = (char*) &dir->d_name;

55+ p = strrchr(p, '.');

56+ return p && !strcmp(p, ".desktop");

57+}

58+

59+static void update_map(char *mapping, char *map_file) {

60+ int fd;

61+

62+ fd = open(map_file, O_WRONLY);

63+ if (fd < 0) {

64+ err_exit("map open");

65+ }

66+

67+ int map_len = strlen(mapping);

68+ if (write(fd, mapping, map_len) != map_len) {

69+ err_exit("map write");

70+ }

71+

72+ close(fd);

73+}

74+

75+static void add_path(const char* name, const char* rootdir) {

76+ char path_buf[PATH_MAX];

77+ snprintf(path_buf, sizeof(path_buf), "/%s", name);

78+

79+ struct stat statbuf;

80+ if (stat(path_buf, &statbuf) < 0) {

81+ fprintf(stderr, "Cannot stat %s: %s\n", path_buf, strerror(errno));

82+ return;

83+ }

84+

85+ char path_buf2[PATH_MAX];

86+ snprintf(path_buf2, sizeof(path_buf2), "%s/%s", rootdir, name);

87+

88+ mkdir(path_buf2, statbuf.st_mode & ~S_IFMT);

89+ if (mount(path_buf, path_buf2, "none", MS_BIND | MS_REC, NULL) < 0) {

90+ fprintf(stderr, "Cannot bind mount %s to %s: %s\n", path_buf, path_buf2, strerror(errno));

91+ }

92+}

93+

94+#define SAVE_ENV_VAR(x) char *x = getenv(#x)

95+#define LOAD_ENV_VAR(x) do { if (x != NULL) setenv(#x, x, 1); } while(0)

96+

97+int main(int argc, char *argv[]) {

98+ char *appdir = dirname(realpath("/proc/self/exe", NULL));

99+ if (!appdir)

100+ die("Could not access /proc/self/exe\n");

101+

102+ char *tmpdir = getenv("TMPDIR");

103+ if (!tmpdir) {

104+ tmpdir = "/tmp";

105+ }

106+

107+ char template[PATH_MAX];

108+ int needed = snprintf(template, PATH_MAX, "%s/nixXXXXXX", tmpdir);

109+ if (needed < 0) {

110+ err_exit("TMPDIR too long: '%s'", tmpdir);

111+ }

112+

113+ char *rootdir = mkdtemp(template);

114+ if (!rootdir) {

115+ err_exit("mkdtemp(%s)", template);

116+ }

117+

118+ int ret;

119+

120+ struct dirent **namelist;

121+

122+ ret = scandir(appdir, &namelist, filter, NULL);

123+

124+ if (ret == 0) {

125+ die("No .desktop files found\n");

126+ } else if(ret == -1) {

127+ die("Could not scan directory %s\n", appdir);

128+ }

129+

130+ /* Extract executable from .desktop file */

131+

132+ FILE *f;

133+ char *desktop_file = malloc(LINE_SIZE);

134+ snprintf(desktop_file, LINE_SIZE-1, "%s/%s", appdir, namelist[0]->d_name);

135+ f = fopen(desktop_file, "r");

136+

137+ char *line = malloc(LINE_SIZE);

138+ size_t n = LINE_SIZE;

139+ int found = 0;

140+

141+ while (getline(&line, &n, f) != -1)

142+ {

143+ if (!strncmp(line,"Exec=",5))

144+ {

145+ char *p = line+5;

146+ while (*++p && *p != ' ' && *p != '%' && *p != '\n');

147+ *p = 0;

148+ found = 1;

149+ break;

150+ }

151+ }

152+

153+ fclose(f);

154+

155+ if (!found)

156+ die("Executable not found, make sure there is a line starting with 'Exec='\n");

157+

158+ /* Execution */

159+ char *executable = basename(line+5);

160+

161+ char full_exec[PATH_MAX];

162+ snprintf(full_exec, sizeof(full_exec), "/usr/bin/%s", executable);

163+

164+ // get uid, gid before going to new namespace

165+ uid_t uid = getuid();

166+ gid_t gid = getgid();

167+

168+ // "unshare" into new namespace

169+ if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0) {

170+ err_exit("unshare()");

171+ }

172+

173+ // add necessary system stuff to rootdir namespace

174+ add_path("dev", rootdir);

175+ add_path("proc", rootdir);

176+ add_path("sys", rootdir);

177+ add_path("run", rootdir);

178+ add_path("etc", rootdir);

179+ add_path("home", rootdir);

180+

181+ // setup skeleton

182+ char path_buf[PATH_MAX];

183+ snprintf(path_buf, sizeof(path_buf), "%s/tmp", rootdir);

184+ mkdir(path_buf, ~0);

185+ snprintf(path_buf, sizeof(path_buf), "%s/var", rootdir);

186+ mkdir(path_buf, ~0);

187+

188+ // make sure nixdir exists

189+ struct stat statbuf2;

190+ if (stat(appdir, &statbuf2) < 0) {

191+ err_exit("stat(%s)", appdir);

192+ }

193+

194+ char nixdir[PATH_MAX];

195+ snprintf(nixdir, sizeof(nixdir), "%s/nix", appdir);

196+ snprintf(path_buf, sizeof(path_buf), "%s/nix", rootdir);

197+ mkdir(path_buf, statbuf2.st_mode & ~S_IFMT);

198+ if (mount(nixdir, path_buf, "none", MS_BIND | MS_REC, NULL) < 0) {

199+ err_exit("mount(%s, %s)", nixdir, path_buf);

200+ }

201+

202+ char usrdir[PATH_MAX];

203+ snprintf(usrdir, sizeof(usrdir), "%s/usr", appdir);

204+ snprintf(path_buf, sizeof(path_buf), "%s/usr", rootdir);

205+ mkdir(path_buf, statbuf2.st_mode & ~S_IFMT);

206+ if (mount(usrdir, path_buf, "none", MS_BIND | MS_REC, NULL) < 0) {

207+ err_exit("mount(%s, %s)", usrdir, path_buf);

208+ }

209+

210+ snprintf(path_buf, sizeof(path_buf), "%s/bin", rootdir);

211+ if (symlink("/usr/bin", path_buf) < 0) {

212+ err_exit("symlink(/usr/bin, %s)", path_buf);

213+ }

214+

215+ // fixes issue #1 where writing to /proc/self/gid_map fails

216+ // see user_namespaces(7) for more documentation

217+ int fd_setgroups = open("/proc/self/setgroups", O_WRONLY);

218+ if (fd_setgroups > 0) {

219+ write(fd_setgroups, "deny", 4);

220+ }

221+

222+ // map the original uid/gid in the new ns

223+ char map_buf[1024];

224+ snprintf(map_buf, sizeof(map_buf), "%d %d 1", uid, uid);

225+ update_map(map_buf, "/proc/self/uid_map");

226+ snprintf(map_buf, sizeof(map_buf), "%d %d 1", gid, gid);

227+ update_map(map_buf, "/proc/self/gid_map");

228+

229+ // chroot to rootdir

230+ if (chroot(rootdir) < 0) {

231+ err_exit("chroot(%s)", rootdir);

232+ }

233+

234+ char *pwddir = getenv("PWD");

235+ chdir(pwddir);

236+

237+ SAVE_ENV_VAR(PWD);

238+ SAVE_ENV_VAR(DBUS_SESSION_BUS_ADDRESS);

239+ SAVE_ENV_VAR(USER);

240+ SAVE_ENV_VAR(HOSTNAME);

241+ SAVE_ENV_VAR(LANG);

242+ SAVE_ENV_VAR(LC_ALL);

243+ SAVE_ENV_VAR(TERM);

244+ SAVE_ENV_VAR(DISPLAY);

245+ SAVE_ENV_VAR(XDG_RUNTIME_DIR);

246+ SAVE_ENV_VAR(XAUTHORITY);

247+ SAVE_ENV_VAR(XDG_SESSION_ID);

248+ SAVE_ENV_VAR(XDG_SEAT);

249+ SAVE_ENV_VAR(HOME);

250+

251+ clearenv();

252+

253+ LOAD_ENV_VAR(PWD);

254+ LOAD_ENV_VAR(DBUS_SESSION_BUS_ADDRESS);

255+ LOAD_ENV_VAR(USER);

256+ LOAD_ENV_VAR(HOSTNAME);

257+ LOAD_ENV_VAR(LANG);

258+ LOAD_ENV_VAR(LC_ALL);

259+ LOAD_ENV_VAR(TERM);

260+ LOAD_ENV_VAR(DISPLAY);

261+ LOAD_ENV_VAR(XDG_RUNTIME_DIR);

262+ LOAD_ENV_VAR(XAUTHORITY);

263+ LOAD_ENV_VAR(XDG_SESSION_ID);

264+ LOAD_ENV_VAR(XDG_SEAT);

265+ LOAD_ENV_VAR(HOME);

266+

267+ setenv("PATH", ENV_PATH, 1);

268+ setenv("TMPDIR", "/tmp", 1);

269+

270+ /* Run */

271+ // FIXME: What about arguments in the Exec= line of the desktop file?

272+ ret = execvp(full_exec, argv);

273+

274+ if (ret == -1)

275+ die("Error executing '%s'; return code: %d\n", full_exec, ret);

276+

277+ free(line);

278+ free(desktop_file);

279+ return 0;

280+}

Makefile+2−2

@@ -1,5 +1,5 @@

1PREFIX ?= /usr

2

3−install: nix-bundle.sh default.nix

3+install: nix-bundle.sh nix-run.sh appdir.nix appimagetool.nix appimage.nix AppRun.c appimage-top.nix default.nix appdir.sh nix2appimage.sh nix-user-chroot/

4 mkdir -p ${PREFIX}/share/nix-bundle/

5− install $^ ${PREFIX}/share/nix-bundle/

5+ cp -r $^ ${PREFIX}/share/nix-bundle/

README.md+26−4

@@ -8,7 +8,6 @@ nix-bundle is a way to package Nix attributes into single-file executables.

8* Can be run by non-root users

9* No runtime

10* Distro agnostic

11−* Completely portable

12* No installation

11* No installation

13

12

14## Getting started

13## Getting started

@@ -28,7 +27,7 @@ $ ./hello

28Hello, world!

27Hello, world!

29```

28```

30

29

31−This is a standalone file that is completely portable! As long as you are running a same architecture Linux kernel and have a shell interpreter it will run. No external dependencies are required besides a compatible Linux kernel and a shell interpreter.

30+This is a standalone file that is completely portable! As long as you are running the same architecture Linux kernel and have a shell interpreter available it will run.

32

31

33Some others to try:

32Some others to try:

34

33

@@ -36,17 +35,38 @@ Some others to try:

36./nix-bundle.sh nano /bin/nano

35./nix-bundle.sh nano /bin/nano

37```

36```

38

37

38+```sh

39+./nix-bundle.sh emacs /bin/emacs

40+```

41+

42+Or if you want to try graphical applications:

43+

44+```sh

45+# Simple X game. Very few dependencies. Quick to build and load. ~13MB

46+./nix-bundle.sh xskat /bin/xskat

47+```

48+

39```sh

49```sh

40./nix-bundle.sh firefox /bin/firefox

50./nix-bundle.sh firefox /bin/firefox

41```

51```

42

52

43```sh

53```sh

54+# SDL-based game. ~228MB

44−./nix-bundle.sh emacs /bin/emacs

55+./nix-bundle.sh ivan /bin/ivan

56+```

57+

58+

59+## Self-bundling (meta)

60+

61+Starting with v0.1.3, you can bundle nix-bundle! To do this, just use nix-bundle normally:

62+

63+```sh

64+NIX_PATH="nixpkgs=https://github.com/matthewbauer/nixpkgs/archive/nix-bundle.tar.gz" ./nix-bundle.sh nix-bundle /bin/nix-bundle

45```

65```

46

66

47## [Experimental] Create AppImage executables from Nix expressions

67## [Experimental] Create AppImage executables from Nix expressions

48

68

49−"nix-bundle.sh" tends to create fairly large outputs. This is largely because nix-bundle.sh uses gzip compression and AppImage uses lzma compression. Anyway, you can create a compliant "AppImage" using the "nix2appimage.sh" script:

69+"nix-bundle.sh" tends to create fairly large outputs. This is largely because nix-bundle.sh "extracts" its payload up front. AppImage uses a different method where extraction only takes place when the file is accessed (through FUSE and SquashFS). You can now create a compliant "AppImage" using the "nix2appimage.sh" script:

50

70

51```sh

71```sh

52./nix2appimage.sh emacs

72./nix2appimage.sh emacs

@@ -76,6 +96,8 @@ Some other examples to try:

76

96

77These may take a while because of the large closure size.

97These may take a while because of the large closure size.

78

98

99+Note that these do not currently work out of the box with NixOS. Other Linux distros should work.

100+

79## Comparison with AppImage, FlatPak, Snappy

101## Comparison with AppImage, FlatPak, Snappy

80

102

appdir.nix+24−12

@@ -1,16 +1,28 @@

1−{ stdenv, fetchurl, perl, pathsFromGraph }:

1+{ stdenv, lib, fetchurl, muslPkgs, perl, pathsFromGraph, fetchFromGitHub, coreutils, bash }:

2

3let

4− AppRun = fetchurl {

4+ AppRun = targets: muslPkgs.stdenv.mkDerivation {

5− url = "https://github.com/probonopd/AppImageKit/releases/download/7/AppRun-x86_64";

5+ name = "AppRun";

6− sha256 = "1k2jlyrrbzdmxv832a5vin4nzs3rh9r9vs7a8jzrl1v5bbh16nqf";

6+

7+ phases = [ "buildPhase" "installPhase" "fixupPhase" ];

8+

9+ buildPhase = ''

10+ CC="$CC -O2 -Wall -Wno-deprecated-declarations -Wno-unused-result -static"

11+ $CC ${./AppRun.c} -o AppRun -DENV_PATH='"${lib.makeBinPath targets}"'

12+ '';

13+

14+ installPhase = ''

15+ mkdir -p $out/bin

16+ cp AppRun $out/bin/AppRun

17+ '';

7 };

18 };

8

19

9in

20in

10

21

22+ { target, name, extraTargets ? [ coreutils bash ] }: let targets = ([ target ] ++ extraTargets);

11− { target, name }: stdenv.mkDerivation {

23+ in stdenv.mkDerivation {

12 name = "${name}.AppDir";

24 name = "${name}.AppDir";

13− exportReferencesGraph = map (x: [("closure-" + baseNameOf x) x]) [ target ];

25+ exportReferencesGraph = map (x: [("closure-" + baseNameOf x) x]) targets;

14 nativeBuildInputs = [ perl ];

26 nativeBuildInputs = [ perl ];

15 buildCommand = ''

27 buildCommand = ''

16 # TODO use symlinks to shrink output size

28 # TODO use symlinks to shrink output size

@@ -38,24 +50,25 @@ in

38 chmod a+w usr/share

50 chmod a+w usr/share

39 mkdir -p usr/share/metainfo

51 mkdir -p usr/share/metainfo

40 for f in ${target}/share/appdata/*.xml; do

52 for f in ${target}/share/appdata/*.xml; do

41− ln -s .$f usr/share/metainfo

53+ ln -s ../appdata/$(basename $f) usr/share/metainfo/$(basename $f)

42 done

54 done

43 fi

55 fi

44

56

45 # .desktop

57 # .desktop

46 desktop=$(find ${target}/share/applications -name "*.desktop" | head -n1)

58 desktop=$(find ${target}/share/applications -name "*.desktop" | head -n1)

47 if ! [ -z "$desktop" ]; then

59 if ! [ -z "$desktop" ]; then

48− ln -s .$desktop

60+ cp .$desktop .

49 fi

61 fi

50

62

63+

51 # icons

64 # icons

52 if [ -d ${target}/share/icons ]; then

65 if [ -d ${target}/share/icons ]; then

53− icon=$(find ${target}/share/icons -name "${name}.png" -or -name "*.png" | head -n1)

66+ icon=$(find ${target}/share/icons -name "${name}*.png" | head -n1)

54 if ! [ -z "$icon" ]; then

67 if ! [ -z "$icon" ]; then

55 ln -s .$icon

68 ln -s .$icon

56 ln -s .$icon .DirIcon

69 ln -s .$icon .DirIcon

57 else

70 else

58− icon=$(find ${target}/share/icons -name "${name}.svg" -or -name "*.svg" | head -n1)

71+ icon=$(find ${target}/share/icons -name "${name}*.svg" | head -n1)

59 if ! [ -z "$icon" ]; then

72 if ! [ -z "$icon" ]; then

60 ln -s .$icon

73 ln -s .$icon

61 ln -s .$icon .DirIcon

74 ln -s .$icon .DirIcon

@@ -63,7 +76,6 @@ in

63 fi

76 fi

64 fi

77 fi

65

78

66− cp ${AppRun} AppRun

79+ cp ${AppRun targets}/bin/AppRun AppRun

67− chmod a+x AppRun

68 '';

80 '';

69 }

81 }

appdir.sh+1−1

@@ -13,7 +13,7 @@ fi

13

14target="$1"

15

16−expr="with import <nixpkgs> {}; with import ./. {}; appdir { name = \"$target\"; target = $target; }"

16+expr="with import <nixpkgs> {}; with import ./appimage-top.nix {}; appdir { name = \"$target\"; target = $target; }"

17

18out=$(nix-store --no-gc-warning -r $(nix-instantiate --no-gc-warning -E "$expr"))

19

appimage-bundle.nixnew file+61

@@ -0,0 +1,61 @@

1+# use like this:

2+# nix-build appimage-bundle.nix --argstr package hello --argstr exec hello

3+# nix-build appimage-bundle.nix --arg package 'with import <nixpkgs>{}; writers.writePython3Bin "helloThere.py" {} "print(1)\n"' --argstr exec helloThere.py

4+

5+

6+{nixpkgs ? import <nixpkgs>{},

7+package,

8+exec,

9+... }:

10+let

11+ appimage_src = drv : exec : with nixpkgs;

12+ self.stdenv.mkDerivation rec {

13+ name = drv.name + "-appdir";

14+ env = buildEnv {

15+ inherit name;

16+ paths = buildInputs;

17+ };

18+ src = env;

19+ inherit exec;

20+ buildInputs = [ drv ];

21+ buildCommand = ''

22+ mkdir -p $out/share/icons/hicolor/256x256/apps

23+ mkdir -p $out/share/applications

24+

25+ shopt -s extglob

26+ ln -s ${env}/!(share) $out/

27+ ln -s ${env}/share/* $out/share/

28+

29+ touch $out/share/icons/hicolor/256x256/apps/${drv.name}.png

30+ touch $out/share/icons/${drv.name}.png

31+

32+ cat <<EOF > $out/share/applications/${drv.name}.desktop

33+ [Desktop Entry]

34+ Type=Application

35+ Version=1.0

36+ Name=${drv.name}

37+ Path=${env}

38+ Icon=${drv.name}

39+ Exec=$exec

40+ Terminal=true

41+ EOF

42+ '';

43+ system = builtins.currentSystem;

44+ };

45+

46+in

47+ let results =

48+ if (nixpkgs.lib.isDerivation package && !(nixpkgs.lib.isString package))

49+ then {

50+ name = package.name;

51+ target = appimage_src package "${exec}";

52+ extraTargets = [];

53+ }

54+ else {

55+ name = nixpkgs."${package}".name;

56+ target = appimage_src (nixpkgs."${package}") "${exec}";

57+ extraTargets = [];

58+ };

59+ in

60+ with (import (./appimage-top.nix){nixpkgs' = nixpkgs.path;});

61+ (appimage (appdir results )).overrideAttrs (old: {name = results.name;})

appimage-top.nixnew file+17

@@ -0,0 +1,17 @@

1+{ nixpkgs' ? <nixpkgs> }:

2+

3+let

4+ pkgs = import nixpkgs' { };

5+ muslPkgs = import nixpkgs' {

6+ localSystem.config = "x86_64-unknown-linux-musl";

7+ };

8+

9+in rec {

10+ appimagetool = pkgs.callPackage ./appimagetool.nix {};

11+

12+ appimage = pkgs.callPackage ./appimage.nix {

13+ inherit appimagetool;

14+ };

15+

16+ appdir = pkgs.callPackage ./appdir.nix { inherit muslPkgs; };

17+}

appimage.nix+1−1

@@ -5,7 +5,7 @@ stdenv.mkDerivation {

5 name = "appimage";

6 buildInputs = [ appimagetool ];

7 buildCommand = ''

8− appimagetool ${dir}/*.AppDir

8+ ARCH=x86_64 appimagetool ${dir}/*.AppDir

9 mkdir $out

10 cp *.AppImage $out

11 '';

appimagetool.nix+19−5

@@ -1,24 +1,30 @@

1−{ stdenv, fetchurl, fuse, zlib }:

1+{ stdenv, lib, fetchurl, fuse, zlib, squashfsTools, glib }:

2

3# This is from some binaries.

4

5# Ideally, this should be source based,

6# but I can't get it to build from GitHub

7

8+let

9+ inherit (stdenv.cc.bintools) dynamicLinker;

8−stdenv.mkDerivation rec {

10+in stdenv.mkDerivation rec {

9 name = "appimagekit";

11 name = "appimagekit";

10

12

11 src = fetchurl {

13 src = fetchurl {

12− url = "https://github.com/probonopd/AppImageKit/releases/download/7/appimagetool-x86_64.AppImage";

14+ url = "https://github.com/AppImage/AppImageKit/releases/download/10/appimagetool-x86_64.AppImage";

13− sha256 = "1irvbf0xnya16cyzpvr43jviq5ly3wl7b9753rji7d1hhxwb7b9r";

15+ sha256 = "03zbiblj8a1yk1xsb5snxi4ckwn3diyldg1jh5hdjjhsmpw652ig";

14 };

16 };

15

17

18+ buildInputs = [

19+ squashfsTools

20+ ];

21+

16 sourceRoot = "squashfs-root";

22 sourceRoot = "squashfs-root";

17

23

18 unpackPhase = ''

24 unpackPhase = ''

19 cp $src appimagetool-x86_64.AppImage

25 cp $src appimagetool-x86_64.AppImage

20 chmod u+wx appimagetool-x86_64.AppImage

26 chmod u+wx appimagetool-x86_64.AppImage

21− patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \

27+ patchelf --set-interpreter ${dynamicLinker} \

22 --set-rpath ${fuse}/lib:${zlib}/lib \

28 --set-rpath ${fuse}/lib:${zlib}/lib \

23 appimagetool-x86_64.AppImage

29 appimagetool-x86_64.AppImage

24 ./appimagetool-x86_64.AppImage --appimage-extract

30 ./appimagetool-x86_64.AppImage --appimage-extract

@@ -27,7 +33,15 @@ stdenv.mkDerivation rec {

27 installPhase = ''

33 installPhase = ''

28 mkdir -p $out

34 mkdir -p $out

29 cp -r usr/* $out

35 cp -r usr/* $out

36+

37+ for x in $out/bin/*; do

38+ patchelf \

39+ --set-interpreter ${dynamicLinker} \

40+ --set-rpath ${lib.makeLibraryPath [ zlib stdenv.glibc.out fuse glib ]} \

41+ $x

42+ done

30 '';

43 '';

31

44

45+ dontStrip = true;

32 dontPatchELF = true;

46 dontPatchELF = true;

33}

47}

closure.nixdeleted−16

@@ -1,16 +0,0 @@

1−{ stdenv, perl, pathsFromGraph }:

2−{ targets }:

3−

4−# everything in the closure linked together for inspection

5−

6−stdenv.mkDerivation {

7− name = "closure";

8− exportReferencesGraph = map (x: [("closure-" + baseNameOf x) x]) targets;

9− nativeBuildInputs = [ perl ];

10− buildCommand = ''

11− storePaths=$(${perl}/bin/perl ${pathsFromGraph} ./closure-*)

12−

13− mkdir $out

14− ln -s $storePaths $out

15− '';

16−}

closure.shdeleted−7

@@ -1,7 +0,0 @@

1−#!/usr/bin/env sh

2−

3−target="$1"

4−

5−expr="with import <nixpkgs> {}; with import ./. {}; closure { targets = [$target]; }"

6−

7−nix-store --no-gc-warning -r $(nix-instantiate --no-gc-warning -E "$expr")

default.nix+56−33

@@ -2,12 +2,29 @@

2

3with nixpkgs;

4

5+let

6+ arx' = haskellPackages.arx.overrideAttrs (o: {

7+ patchPhase = (o.patchPhase or "") + ''

8+ substituteInPlace model-scripts/tmpx.sh \

9+ --replace /tmp/ \$HOME/.cache/

10+ '';

11+ });

5−rec {

12+in rec {

13+ toStorePath = target:

14+ # If a store path has been given but is not a derivation, add the missing context

15+ # to it so it will be propagated properly as a build input.

16+ if !(lib.isDerivation target) && lib.isStorePath target then

17+ let path = toString target; in

18+ builtins.appendContext path { "${path}" = { path = true; }; }

19+ # Otherwise, add to the store. This takes care of appending the store path

20+ # in the context automatically.

21+ else "${target}";

22+

6 arx = { archive, startup}:

23 arx = { archive, startup}:

7 stdenv.mkDerivation {

24 stdenv.mkDerivation {

8 name = "arx";

25 name = "arx";

9 buildCommand = ''

26 buildCommand = ''

10− ${haskellPackages.arx}/bin/arx tmpx ${archive} -rm! -o $out // ${startup}

27+ ${arx'}/bin/arx tmpx --shared -rm! ${archive} -o $out // ${startup}

11 chmod +x $out

28 chmod +x $out

12 '';

29 '';

13 };

30 };

@@ -20,22 +37,19 @@ rec {

20 buildCommand = ''

37 buildCommand = ''

21 storePaths=$(perl ${pathsFromGraph} ./closure-*)

38 storePaths=$(perl ${pathsFromGraph} ./closure-*)

22

39

23− tar cfj $out \

40+ tar -cf - \

24 --owner=0 --group=0 --mode=u+rw,uga+r \

41 --owner=0 --group=0 --mode=u+rw,uga+r \

25 --hard-dereference \

42 --hard-dereference \

26− $storePaths

43+ $storePaths | bzip2 -z > $out

27 '';

44 '';

28 };

45 };

29

46

30 # TODO: eventually should this go in nixpkgs?

47 # TODO: eventually should this go in nixpkgs?

31− nix-user-chroot = stdenv.lib.makeOverridable stdenv.mkDerivation {

48+ nix-user-chroot = lib.makeOverridable stdenv.mkDerivation {

32− name = "nix-user-chroot-2b144e";

49+ name = "nix-user-chroot-2c52b5f";

33− src = fetchFromGitHub {

34− owner = "matthewbauer";

35− repo = "nix-user-chroot";

50+ src = ./nix-user-chroot;

36− rev = "b0c8f81f85487b0f9eb8ed8e6d33445423bfb3e4";

51+

37− sha256 = "1x15jxdx9kka1nx3nmz6xkjfyb9mj3i02bhwy0zhj8z2hi1kyc9l";

52+ makeFlags = [];

38− };

39

53

40 # hack to use when /nix/store is not available

54 # hack to use when /nix/store is not available

41 postFixup = ''

55 postFixup = ''

@@ -54,6 +68,8 @@ rec {

54

68

55 runHook postInstall

69 runHook postInstall

56 '';

70 '';

71+

72+ meta.platforms = lib.platforms.linux;

57 };

73 };

58

74

59 makebootstrap = { targets, startup }:

75 makebootstrap = { targets, startup }:

@@ -64,33 +80,40 @@ rec {

64 };

80 };

65 };

81 };

66

82

83+ makeStartup = { target, nixUserChrootFlags, nix-user-chroot', run, initScript }:

84+ let

85+ # Avoid re-adding a store path into the store

86+ path = toStorePath target;

87+ in

88+ writeScript "startup" ''

89+ #!/bin/sh

90+ ${initScript}

91+ .${nix-user-chroot'}/bin/nix-user-chroot -n ./nix ${nixUserChrootFlags} -- ${path}${run} "$@"

92+ '';

93+

67− nix-bootstrap = { target, extraTargets ? [], run, nix-user-chroot' ? nix-user-chroot }:

94+ nix-bootstrap = { target, extraTargets ? [], run, nix-user-chroot' ? nix-user-chroot, nixUserChrootFlags ? "", initScript ? "" }:

95+ let

96+ script = makeStartup { inherit target nixUserChrootFlags nix-user-chroot' run initScript; };

68− makebootstrap {

97+ in makebootstrap {

69− startup = ''.${nix-user-chroot'}/bin/nix-user-chroot ./nix ${target}${run} \$@'';

98+ startup = ".${script} '\"$@\"'";

70− targets = [ nix-user-chroot' target ] ++ extraTargets;

99+ targets = [ "${script}" ] ++ extraTargets;

71 };

100 };

72

101

73− # special case handling because of impurities in nix bootstrap

74− # anything that needs Nix will have to have these setup before they can be run

75− nix-bootstrap-nix = let

102+ nix-bootstrap-nix = {target, run, extraTargets ? []}:

76− nix-user-chroot' = nix-user-chroot.override {

103+ nix-bootstrap-path {

77− buildInputs = [ cacert gnutar bzip2 gzip coreutils ];

104+ inherit target run;

78− makeFlags = [

105+ extraTargets = [ gnutar bzip2 xz gzip coreutils bash ];

79− ''NIX_SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt"''

106+ };

80− ''NIX_PATH="nixpkgs=https://github.com/matthewbauer/nixpkgs/archive/nix-bundle.tar.gz"''

81− ''ENV_PATH="${stdenv.lib.makeBinPath [ coreutils gnutar bzip2 gzip bash ]}"''

82− ];

83− }; in { target, extraTargets ? [], run }: nix-bootstrap { inherit target extraTargets run nix-user-chroot'; };

84

107

85 # special case adding path to the environment before launch

108 # special case adding path to the environment before launch

86 nix-bootstrap-path = let

109 nix-bootstrap-path = let

87− nix-user-chroot'' = targets: nix-user-chroot.override {

110+ nix-user-chroot'' = targets: nix-user-chroot.overrideDerivation (o: {

88− buildInputs = targets;

111+ buildInputs = o.buildInputs ++ targets;

89− makeFlags = [

112+ makeFlags = o.makeFlags ++ [

90− ''ENV_PATH="${stdenv.lib.makeBinPath targets}"''

113+ ''ENV_PATH="${lib.makeBinPath targets}"''

91 ];

114 ];

92− }; in { target, extraTargets ? [], run }: nix-bootstrap {

115+ }); in { target, extraTargets ? [], run, initScript ? "" }: nix-bootstrap {

93− inherit target extraTargets run;

116+ inherit target extraTargets run initScript;

94 nix-user-chroot' = nix-user-chroot'' extraTargets;

117 nix-user-chroot' = nix-user-chroot'' extraTargets;

95 };

118 };

96}

119}

flake.nixnew file+26

@@ -0,0 +1,26 @@

1+{

2+ description = "The purely functional package manager";

3+

4+ inputs.nixpkgs.url = "nixpkgs/nixos-20.03-small";

5+

6+ outputs = { self, nixpkgs }: let

7+ systems = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];

8+ forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f system);

9+ in {

10+ bundlers = {

11+ nix-bundle = { program, system }: let

12+ nixpkgs' = nixpkgs.legacyPackages.${system};

13+ nix-bundle = import self { nixpkgs = nixpkgs'; };

14+ script = nixpkgs'.writeScript "startup" ''

15+ #!/bin/sh

16+ .${nix-bundle.nix-user-chroot}/bin/nix-user-chroot -n ./nix -- ${program} "$@"

17+ '';

18+ in nix-bundle.makebootstrap {

19+ targets = [ script ];

20+ startup = ".${builtins.unsafeDiscardStringContext script} '\"$@\"'";

21+ };

22+ };

23+

24+ defaultBundler = self.bundlers.nix-bundle;

25+ };

26+}

nix-bootstrap.shnew file+35

@@ -0,0 +1,35 @@

1+#!/bin/sh

2+

3+if [ $# -gt 0 ]; then

4+ set -- sh

5+fi

6+

7+# should download this in the future

8+# but the mirror is down

9+proot=$(dirname "$0")/proot-$(uname -p)

10+export PROOT_NO_SECCOMP=1

11+

12+nixdir=$HOME/.nix

13+

14+OLD_NIX_PATH=$NIX_PATH

15+# shellcheck disable=SC1090

16+if [ -e "$HOME/.nix-profile/etc/profile.d/nix.sh" ]; then . "$HOME/.nix-profile/etc/profile.d/nix.sh"; fi

17+if [ -n "$OLD_NIX_PATH" ]; then NIX_PATH="$OLD_NIX_PATH"; fi

18+

19+if [ -z "$IN_PROOT" ]; then

20+ export IN_PROOT=1

21+

22+ if ! [ -d "$nixdir" ]; then

23+ mkdir -p "$nixdir"

24+ s=$(mktemp)

25+ curl https://nixos.org/nix/install -o "$s"

26+ $proot -b "$nixdir:/nix" "$0" sh "$s"

27+ fi

28+

29+ $proot -b "$nixdir:/nix" "$0" "$@"

30+

31+ export IN_PROOT=

32+ exit

33+elif [ $# -gt 0 ]; then

34+ exec "$@"

35+fi

nix-bundle.sh+12−7

@@ -8,6 +8,9 @@ Usage: $0 TARGET EXECUTABLE

8Create a single-file bundle from the nixpkgs attribute "TARGET".

9EXECUTABLE should be relative to the TARGET's output path.

10

11+The TARGET is either an attribute in nixpkgs, or an absolute path to the

12+store.

13+

11For example:

14For example:

12

15

13$ $0 hello /bin/hello

16$ $0 hello /bin/hello

@@ -19,7 +22,7 @@ EOF

19 exit 1

22 exit 1

20fi

23fi

21

24

22−nix_file=`dirname $0`/default.nix

25+nix_file=$(dirname "$0")/default.nix

23

26

24target="$1"

27target="$1"

25shift

28shift

@@ -36,23 +39,25 @@ exec="$1"

36shift

39shift

37

40

38bootstrap=nix-bootstrap

41bootstrap=nix-bootstrap

39−if [ "$target" = "nix-bundle" ] || [ "$target" = "nixStable" ] || [ "$target" = "nixUnstable" ]; then

42+if [ "$target" = "nix-bundle" ] || [ "$target" = "nixStable" ] || [ "$target" = "nixUnstable" ] || [ "$target" = "nix" ]; then

40 bootstrap=nix-bootstrap-nix

43 bootstrap=nix-bootstrap-nix

41−elif ! [ -z "$extraTargets" ]; then

44+elif [ -n "$extraTargets" ]; then

42 bootstrap=nix-bootstrap-path

45 bootstrap=nix-bootstrap-path

43fi

46fi

44

47

45expr="with import <nixpkgs> {}; with import $nix_file {}; $bootstrap { target = $target; extraTargets = [ $extraTargets ]; run = \"$exec\"; }"

48expr="with import <nixpkgs> {}; with import $nix_file {}; $bootstrap { target = $target; extraTargets = [ $extraTargets ]; run = \"$exec\"; }"

46

49

47−out=$(nix-store --no-gc-warning -r $(nix-instantiate --no-gc-warning -E "$expr"))

50+drv=$(nix-instantiate --no-gc-warning -E "$expr")

51+

52+out=$(nix-store --no-gc-warning --realize "$drv")

48

53

49if [ -z "$out" ]; then

54if [ -z "$out" ]; then

50 >&2 echo "$0 failed. Exiting."

55 >&2 echo "$0 failed. Exiting."

51 exit 1

56 exit 1

52elif [ -t 1 ]; then

57elif [ -t 1 ]; then

53− filename=$(basename $exec)

58+ filename=$(basename "$exec")

54 echo "Nix bundle created at $filename."

59 echo "Nix bundle created at $filename."

55− cp -f $out $filename

60+ cp -f "$out" "$filename"

56else

61else

57− cat $out

62+ echo "$out"

58fi

63fi

nix-run.shnew file+101

@@ -0,0 +1,101 @@

1+#!/bin/sh

2+

3+# nix-run.sh provides an easy way to run executables from Nix derivations

4+# without installing them. It will try to determine how to run the application

5+# based on what files are installable. Currently, macOS apps, Freedesktop apps,

6+# and ordinary binaries are handled.

7+

8+# Usage

9+

10+if [ -z "$1" ]; then

11+ >&2 echo "Need more than one argument."

12+ >&2 echo

13+ >&2 echo "Try:"

14+ >&2 echo "$ nix-run hello"

15+ >&2 echo

16+ >&2 echo "To run the hello program"

17+ >&2 echo "or substitute hello with another package in Nixpkgs"

18+ exit 1

19+fi

20+

21+pkg="$1"

22+shift

23+

24+# A second argument will provide a hint to run

25+if [ -n "$1" ]; then

26+ name="$1"

27+ shift

28+else

29+ name="$pkg"

30+fi

31+

32+expr="with import <nixpkgs> {}; let x = ($pkg); in x"

33+path=$(nix-instantiate --no-gc-warning -E "$expr")

34+out=$(nix-store --no-gc-warning -r "$path")

35+

36+if [ -z "$out" ]; then

37+ >&2 echo "Could not evaluate $pkg to a Nix drv."

38+ exit 1

39+fi

40+

41+# Run DIR as a Darwin application

42+run_darwin_app () {

43+ dir="$1"

44+ shift

45+

46+ open -a "$dir" --args "$@"

47+}

48+

49+# Run FILE as a Freedesktop application

50+# taken from:

51+# https://askubuntu.com/questions/5172/running-a-desktop-file-in-the-terminal/5174

52+run_linux_desktop_app () {

53+ file="$1"

54+ shift

55+

56+ cmd=$(grep '^Exec' "$file" | tail -1 | \

57+ sed 's/Exec=//;s/^"//;s/" *$//')

58+

59+ if [ "$#" -gt 0 ]; then

60+ cmd=$(echo "$cmd" | sed "s/%[fu]/$1/;s/%[FU]/$*/")

61+ fi

62+

63+ cmd=$(echo "$cmd" | sed "s/%k/$desktop/;s/%.//")

64+

65+ "$cmd" "$@"

66+}

67+

68+# Run FILE as an ordinary binary

69+run_bin () {

70+ file="$1"

71+ shift

72+

73+ "$file" "$@"

74+}

75+

76+if [ -x "$out/nix-support/run" ]; then

77+ run_bin "$out/nix-support/run" "$@"

78+elif [ -x "$out/bin/run" ]; then

79+ run_bin "$out/bin/run" "$@"

80+elif [ "$(uname)" = Darwin ] && [ -d "$out/Applications/$name.app" ]; then

81+ run_darwin_app "$out/Applications/$name.app" "$@"

82+elif [ "$(uname)" = Darwin ] && [ -d "$out"/Applications/*.app ]; then

83+ for f in "$out"/Applications/*.app; do

84+ run_darwin_app "$f" "$@"

85+ done

86+elif [ -f "$out/share/applications/$name.desktop" ]; then

87+ run_linux_desktop_app "$out/share/applications/$name.desktop" "$@"

88+elif [ -d "$out"/share/applications ]; then

89+ for f in "$out"/share/applications/*.desktop; do

90+ run_linux_desktop_app "$f"

91+ done

92+elif [ -x "$out/bin/$name" ]; then

93+ run_bin "$out/bin/$name" "$@"

94+elif [ -d "$out/bin" ]; then

95+ for bin in "$out"/bin/*; do

96+ run_bin "$bin" "$@"

97+ done

98+else

99+ >&2 echo "Cannot find a way to run path $out."

100+ exit 1

101+fi

nix-user-chroot/Makefilenew file+4

@@ -0,0 +1,4 @@

1+ENV_PATH ?= ""

2+

3+nix-user-chroot: main.cpp

4+ g++ -o nix-user-chroot -DENV_PATH='$(ENV_PATH)' main.cpp

nix-user-chroot/main.cppnew file+307

@@ -0,0 +1,307 @@

1+/*

2+ * This file is based on @lethalman's nix-user-chroot. This file has

3+ * diverged from it though.

4+ *

5+ * Usage: nix-user-chroot <nixpath> <command>

6+ */

7+

8+#include <sched.h>

9+#include <unistd.h>

10+#include <stdlib.h>

11+#include <sys/wait.h>

12+#include <signal.h>

13+#include <fcntl.h>

14+#include <stdio.h>

15+#include <string.h>

16+#include <limits.h>

17+#include <errno.h>

18+#include <sys/mount.h>

19+#include <sys/types.h>

20+#include <dirent.h>

21+#include <sys/stat.h>

22+#include <stdint.h>

23+#include <list>

24+#include <string>

25+

26+using namespace std;

27+

28+#define err_exit(format, ...) { fprintf(stderr, format ": %s\n", ##__VA_ARGS__, strerror(errno)); exit(EXIT_FAILURE); }

29+static int child_proc(const char *rootdir, const char *nixdir, uint8_t clear_env, list<struct DirMapping> dirMappings, list<struct SetEnv> envMappings, const char *executable, char * const new_argv[]);

30+

31+volatile uint8_t child_died = 0;

32+int child_pid = 0;

33+

34+static void usage(const char *pname) {

35+ fprintf(stderr, "Usage: %s -n <nixpath> -- <command>\n", pname);

36+ fprintf(stderr, "\t-c\tclear all env vars\n");

37+ fprintf(stderr, "\t-m <src>:<src>\tmap src on the host to dest in the sandbox\n");

38+ fprintf(stderr, "\t-d\tdelete all default dir mappings, may break things\n");

39+ fprintf(stderr, "\t-p <var>\tpreserve the value of a variable across the -c clear\n");

40+ fprintf(stderr, "\t-e\tadd an /escape-hatch to the sandbox, and run (outside the sandbox) any strings written to it\n");

41+

42+ exit(EXIT_FAILURE);

43+}

44+

45+static void update_map(const char *mapping, const char *map_file) {

46+ int fd;

47+

48+ fd = open(map_file, O_WRONLY);

49+ if (fd < 0) {

50+ err_exit("map open");

51+ }

52+

53+ int map_len = strlen(mapping);

54+ if (write(fd, mapping, map_len) != map_len) {

55+ err_exit("map write");

56+ }

57+

58+ close(fd);

59+}

60+

61+static void add_path(string src, string dest, string rootdir) {

62+ string path_buf2;

63+

64+ struct stat statbuf;

65+ if (stat(src.c_str(), &statbuf) < 0) {

66+ fprintf(stderr, "Cannot stat %s: %s\n", src.c_str(), strerror(errno));

67+ return;

68+ }

69+

70+ path_buf2 = rootdir + "/" + dest;

71+

72+ if (S_ISDIR(statbuf.st_mode)) {

73+ mkdir(path_buf2.c_str(), statbuf.st_mode & ~S_IFMT);

74+ if (mount(src.c_str(), path_buf2.c_str(), "none", MS_BIND | MS_REC, NULL) < 0) {

75+ fprintf(stderr, "Cannot bind mount %s to %s: %s\n", src.c_str(), path_buf2.c_str(), strerror(errno));

76+ }

77+ } else if (S_ISREG(statbuf.st_mode)) {

78+ printf("bind-mounting file %s not supported", src.c_str());

79+ }

80+}

81+

82+struct DirMapping {

83+ string src;

84+ string dest;

85+};

86+

87+struct SetEnv {

88+ string key;

89+ string value;

90+};

91+

92+struct DirMapping parseMapping(string input) {

93+ auto pos = input.find(":");

94+ string src = input.substr(0, pos);

95+ string dest = input.substr(pos + 1);

96+ return (struct DirMapping){ src, dest };

97+}

98+

99+static void handle_child_death(int signo, siginfo_t *info, void *context) {

100+ if ( (child_pid == 0) || (info->si_pid == child_pid) ) {

101+ child_died = 1;

102+ }

103+}

104+

105+int main(int argc, char *argv[]) {

106+ uint8_t clear_env = 0;

107+ uint8_t enable_escape_hatch = 0;

108+ char *nixdir = NULL;

109+ list<struct DirMapping> dirMappings;

110+ list<struct SetEnv> envMappings;

111+ const char *t;

112+

113+#define x(y) dirMappings.push_back({ "/" y, y })

114+ x("dev");

115+ x("proc");

116+ x("sys");

117+ x("run");

118+ x("tmp");

119+ x("var");

120+ x("etc");

121+ x("usr");

122+ x("home");

123+ x("root");

124+#undef x

125+

126+ int opt;

127+ while ((opt = getopt(argc, argv, "cen:m:dp:")) != -1) {

128+ switch (opt) {

129+ case 'c':

130+ clear_env = 1;

131+ break;

132+ case 'e':

133+ enable_escape_hatch = 1;

134+ break;

135+ case 'n':

136+ // determine absolute directory for nix dir

137+ nixdir = realpath(optarg, NULL);

138+ if (!nixdir) {

139+ err_exit("realpath(%s)", optarg);

140+ }

141+ break;

142+ case 'm':

143+ dirMappings.push_back(parseMapping(optarg));

144+ break;

145+ case 'd':

146+ dirMappings.clear();

147+ break;

148+ case 'p':

149+ t = getenv(optarg);

150+ if (t) {

151+ envMappings.push_back({ optarg, t });

152+ }

153+ break;

154+ }

155+ }

156+

157+ if (!nixdir) {

158+ fprintf(stderr, "-n <nixdir> is required\n");

159+ exit(EXIT_FAILURE);

160+ }

161+

162+ if (argc <= optind) {

163+ usage(argv[0]);

164+ }

165+

166+ const char *tmpdir = getenv("TMPDIR");

167+ if (!tmpdir) {

168+ tmpdir = "/tmp";

169+ }

170+

171+ char template_[PATH_MAX];

172+ int needed = snprintf(template_, PATH_MAX, "%s/nixXXXXXX", tmpdir);

173+ if (needed < 0) {

174+ err_exit("TMPDIR too long: '%s'", tmpdir);

175+ }

176+

177+ char *rootdir = mkdtemp(template_);

178+ if (!rootdir) {

179+ err_exit("mkdtemp(%s)", template_);

180+ }

181+

182+ int unrace[2];

183+

184+ if (pipe(unrace)) {

185+ err_exit("pipe()");

186+ }

187+

188+ struct sigaction handle_child;

189+ handle_child.sa_sigaction = handle_child_death;

190+ handle_child.sa_flags = SA_SIGINFO;

191+

192+ struct sigaction old_handler;

193+ if (sigaction(SIGCHLD, &handle_child, &old_handler)) {

194+ err_exit("sigaction()");

195+ }

196+

197+ int child;

198+ child = child_pid = fork();

199+ if (child < 0) {

200+ err_exit("fork()");

201+ } else if (child == 0) {

202+ sigaction(SIGCHLD, &old_handler, NULL);

203+ close(unrace[1]);

204+ char buf[10];

205+ read(unrace[0], buf, 10);

206+ close(unrace[0]);

207+ return child_proc(rootdir, nixdir, clear_env, dirMappings, envMappings, argv[optind], argv + optind);

208+ } else {

209+ close(unrace[0]);

210+ char fifopath[PATH_MAX];

211+ if (enable_escape_hatch) {

212+ snprintf(fifopath, PATH_MAX, "%s/escape-hatch", rootdir);

213+ mkfifo(fifopath, 0600);

214+ }

215+ close(unrace[1]);

216+ if (enable_escape_hatch) {

217+ char buffer[1024];

218+ while (!child_died) {

219+ int fd = open(fifopath, O_RDONLY);

220+ if (fd < 0) {

221+ if (errno == EINTR) continue;

222+ fprintf(stderr, "error opening escape-hatch: %s\n", strerror(errno));

223+ continue;

224+ }

225+ int size = read(fd, buffer, 1024);

226+ buffer[size] = 0;

227+ system(buffer);

228+ close(fd);

229+ }

230+ }

231+ int status;

232+ int ret = waitpid(child, &status, 0);

233+ return WEXITSTATUS(status);

234+ }

235+}

236+

237+static int child_proc(const char *rootdir, const char *nixdir, uint8_t clear_env, list<struct DirMapping> dirMappings, list<struct SetEnv> envMappings, const char *executable, char * const new_argv[]) {

238+ // get uid, gid before going to new namespace

239+ uid_t uid = getuid();

240+ gid_t gid = getgid();

241+

242+ // "unshare" into new namespace

243+ if (unshare(CLONE_NEWNS | CLONE_NEWUSER) < 0) {

244+ if (errno == EPERM) {

245+ fputs("Run the following to enable unprivileged namespace use:\nsudo bash -c \"sysctl -w kernel.unprivileged_userns_clone=1 ; echo kernel.unprivileged_userns_clone=1 > /etc/sysctl.d/nix-user-chroot.conf\"\n\n", stderr);

246+ exit(EXIT_FAILURE);

247+ } else {

248+ err_exit("unshare()");

249+ }

250+ }

251+

252+ // add necessary system stuff to rootdir namespace

253+ for (list<struct DirMapping>::iterator it = dirMappings.begin();

254+ it != dirMappings.end(); ++it) {

255+ struct DirMapping m = *it;

256+ add_path(m.src, m.dest, rootdir);

257+ }

258+

259+ // make sure nixdir exists

260+ struct stat statbuf2;

261+ if (stat(nixdir, &statbuf2) < 0) {

262+ err_exit("stat(%s)", nixdir);

263+ }

264+

265+ char path_buf[PATH_MAX];

266+ // mount /nix to new namespace

267+ snprintf(path_buf, sizeof(path_buf), "%s/nix", rootdir);

268+ mkdir(path_buf, statbuf2.st_mode & ~S_IFMT);

269+ if (mount(nixdir, path_buf, "none", MS_BIND | MS_REC, NULL) < 0) {

270+ err_exit("mount(%s, %s)", nixdir, path_buf);

271+ }

272+

273+ // fixes issue #1 where writing to /proc/self/gid_map fails

274+ // see user_namespaces(7) for more documentation

275+ int fd_setgroups = open("/proc/self/setgroups", O_WRONLY);

276+ if (fd_setgroups > 0) {

277+ write(fd_setgroups, "deny", 4);

278+ close(fd_setgroups);

279+ }

280+

281+ // map the original uid/gid in the new ns

282+ char map_buf[1024];

283+ snprintf(map_buf, sizeof(map_buf), "%d %d 1", uid, uid);

284+ update_map(map_buf, "/proc/self/uid_map");

285+ snprintf(map_buf, sizeof(map_buf), "%d %d 1", gid, gid);

286+ update_map(map_buf, "/proc/self/gid_map");

287+

288+ // chroot to rootdir

289+ if (chroot(rootdir) < 0) {

290+ err_exit("chroot(%s)", rootdir);

291+ }

292+

293+ chdir("/");

294+

295+ if (clear_env) clearenv();

296+ setenv("PATH", ENV_PATH, 1);

297+

298+ for (list<struct SetEnv>::iterator it = envMappings.begin();

299+ it != envMappings.end(); ++it) {

300+ struct SetEnv e = *it;

301+ setenv(e.key.c_str(), e.value.c_str(), 1);

302+ }

303+

304+ // execute the command

305+ execvp(executable, new_argv);

306+ err_exit("execvp(%s)", executable);

307+}

nix2appimage.sh+1−1

@@ -19,7 +19,7 @@ fi

19

20target="$1"

21

22−expr="with import <nixpkgs> {}; with import ./. {}; appimage (appdir { name = \"$target\"; target = $target; })"

22+expr="with import <nixpkgs> {}; with import ./appimage-top.nix {}; appimage (appdir { name = \"$target\"; target = $target; })"

23

24out=$(nix-store --no-gc-warning -r $(nix-instantiate --no-gc-warning -E "$expr"))

25

proot-x86_64new file

Binary file not shown.

release.nixnew file+34

@@ -0,0 +1,34 @@

1+{ nixpkgs ? <nixpkgs>

2+, nixpkgs' ? import nixpkgs {}}: with nixpkgs';

3+

4+stdenv.mkDerivation rec {

5+ pname = "nix-bundle";

6+ name = "${pname}-${version}";

7+ version = "0.4.0";

8+

9+ src = ./.;

10+

11+ # coreutils, gnutar is actually needed by nix for bootstrap

12+ buildInputs = [ nix coreutils makeWrapper gnutar gzip bzip2 ];

13+

14+ nixBundlePath = lib.makeBinPath [ nix coreutils gnutar gzip bzip2 ];

15+ nixRunPath = lib.makeBinPath [ nix coreutils ];

16+

17+ makeFlags = [ "PREFIX=$(out)" ];

18+

19+ postInstall = ''

20+ mkdir -p $out/bin

21+ makeWrapper $out/share/nix-bundle/nix-bundle.sh $out/bin/nix-bundle \

22+ --prefix PATH : ${nixBundlePath}

23+ makeWrapper $out/share/nix-bundle/nix-run.sh $out/bin/nix-run \

24+ --prefix PATH : ${nixRunPath}

25+ '';

26+

27+ meta = with lib; {

28+ maintainers = [ maintainers.matthewbauer ];

29+ platforms = platforms.all;

30+ description = "Create bundles from Nixpkgs attributes";

31+ license = licenses.mit;

32+ homepage = https://github.com/matthewbauer/nix-bundle;

33+ };

34+}

test-appimage.nixnew file+14

@@ -0,0 +1,14 @@

1+{ appimagefile, nixpkgs' ? <nixpkgs> }:

2+

3+# nix build -f test-appimage.nix --arg appimagefile ./VLC*AppImage

4+

5+with import nixpkgs' {};

6+

7+runCommand "patchelf" {} ''

8+ cp ${appimagefile} $out

9+ chmod +w $out

10+ patchelf \

11+ --set-interpreter ${stdenv.cc.bintools.dynamicLinker} \

12+ --set-rpath ${stdenv.glibc.out}/lib:${fuse}/lib:${zlib}/lib:${glib}/lib \

13+ $out

14+''

test.shnew file+10

@@ -0,0 +1,10 @@

1+#!/usr/bin/env bash

2+set -euo pipefail

3+export NIX_PATH=channel:nixos-20.09

4+

5+echo "Test with attribute name"

6+./nix-bundle.sh hello /bin/hello

7+

8+echo "Test with store path"

9+out=$(nix-build --no-out-link --expr '(import <nixpkgs> {})' -A hello)

10+./nix-bundle.sh "$out" /bin/hello