Rongsong Shen
68bc86bc59
The Nix build previously fetched Go modules from goproxy.cn and Python build deps from PyPI during the build phase, relying on network leaking into the sandbox. This is non-reproducible and breaks whenever the sandbox resolver is unreachable (e.g. pc13v's loopback dnsmasq). Go: - Vendor all three modules (frontend/apiserver, frontend/xcecli, autoscaler/providers/baidu/src/bcctool) and commit vendor/ trees. - tools/go_build now builds with GOFLAGS=-mod=vendor and GOPROXY=off instead of GOPROXY=https://goproxy.cn. Python (xceadmin): - Add setuptools + wheel to xce.nix nativeBuildInputs. - meson-build.sh installs with pip --no-build-isolation --no-index --no-deps so no PyPI access happens at build time. xceadmin install script: - Invoke meson-install.sh via find_program('bash') instead of relying on its #!/usr/bin/env bash shebang, which fails in the Nix install sandbox (no /usr/bin/env -> 'could not be run'). Cleanup: - Drop now-unneeded cacert and impureEnvVars=[HOME] from xce.nix and xcecli.nix (they only existed to enable the impure network fetch). Docs: - README build guide: drop '--option sandbox false' from nix build / nix bundle commands, note the build is now hermetic, and document the go mod vendor + git add vendor/ maintenance workflow. Verified: nix build .#xcecore, .#xcecore_debug, .#xcecli, and .#xce all succeed with the sandbox enabled.
123 lines
2.8 KiB
Bash
Executable file
123 lines
2.8 KiB
Bash
Executable file
#!/bin/sh
|
|
|
|
if [ "x$DEBUG" = "x" ]; then
|
|
:
|
|
else
|
|
set -x
|
|
fi
|
|
|
|
if [ "x$BUILDTYPE" = "xdebug" ]; then
|
|
CGO_CFLAGS="$CGO_CFLAGS -DWITH_DEBUG=1 -Og -ggdb "
|
|
CGO_LDFLAGS="$CGO_LDFLAGS -Og -ggdb "
|
|
GO_FLAGS=' -gcflags "all=-N -l"'
|
|
|
|
export CGO_CFLAGS CGO_LDFLAGS GO_FLAGS
|
|
fi
|
|
|
|
fix_env() {
|
|
local _n _x _cmd _v
|
|
|
|
_n="$1"
|
|
shift
|
|
_cmd="sed "
|
|
for _x in $*; do
|
|
_v=$(eval $(echo "echo \$$_x") | sed -s 's@"@@g')
|
|
_cmd="$_cmd -e s|@$_x@|$_v|g "
|
|
done
|
|
_v=$(eval $(echo "echo \$$_n"))
|
|
_cmd="$_n=\"$(echo $_v | $_cmd)\"; export $_n"
|
|
eval "$_cmd"
|
|
}
|
|
|
|
# fix value of environment variable by realpath
|
|
# of it
|
|
fix_input_envs() {
|
|
local _n _v _cmd
|
|
|
|
for _n in CURRENT_SOURCE_DIR BUILD_ROOT; do
|
|
_v=$(eval $(echo "echo \$$_n") | sed -e 's@"@@g')
|
|
_v=$(realpath $_v)
|
|
_cmd="$_n=$_v; export $_n"
|
|
eval "$_cmd"
|
|
done
|
|
}
|
|
|
|
# fix dependencies, by:
|
|
# for math just add -lmath
|
|
# for thread by add -pthread
|
|
# otherwise using
|
|
# pkg-config --cflags/ pkg-config --libs
|
|
fix_dependencies() {
|
|
local _x _cflags _ldflags
|
|
|
|
for _x in $DEPENDENCIES; do
|
|
case "$_x" in
|
|
math)
|
|
_cflags=""
|
|
_ldflags="-lm"
|
|
;;
|
|
thread)
|
|
_cflags="-pthread"
|
|
_ldflags="-pthread"
|
|
;;
|
|
*)
|
|
_cflags=$(pkg-config --cflags "$_x")
|
|
_ldflags=$(pkg-config --libs "$_x")
|
|
;;
|
|
esac
|
|
|
|
CGO_CFLAGS="$CGO_CFLAGS $_cflags"
|
|
CGO_LDFLAGS="$CGO_LDFLAGS $_ldflags"
|
|
done
|
|
|
|
export CGO_CFLAGS CGO_LDFLAGS
|
|
}
|
|
|
|
if [ "$#" -ne 2 ]; then
|
|
echo go_build sfile dest
|
|
exit 1
|
|
fi
|
|
|
|
_sfile=$(realpath "$1")
|
|
_sdir=$(dirname "$_sfile")
|
|
_dfile=$(realpath "$2")
|
|
|
|
fix_input_envs
|
|
fix_dependencies
|
|
|
|
if [ -z "$HOME" -o ! -w "$HOME" ]; then
|
|
HOME=$TMPDIR
|
|
export HOME
|
|
fi
|
|
|
|
export GOCACHE=$TMPDIR/go-cache
|
|
export GOPATH="$TMPDIR/go"
|
|
|
|
for _n in $FIX_ENVARS; do
|
|
fix_env $_n $ENVARS;
|
|
done
|
|
|
|
# Build fully offline from the committed vendor/ tree in each module. This
|
|
# keeps the Go build hermetic inside the Nix sandbox (no network, no DNS) --
|
|
# see tools/go_build history / nixSupport notes. Run `go mod vendor` in the
|
|
# affected module (via `nix develop`) and commit vendor/ when deps change.
|
|
export GOFLAGS="-mod=vendor"
|
|
export GOPROXY=off
|
|
|
|
_git_commit="$XCE_GIT_COMMIT"
|
|
_build_time="$XCE_BUILD_TIME"
|
|
_dirty_fingerprint="$XCE_DIRTY_FINGERPRINT"
|
|
|
|
if [ -z "$_git_commit" ]; then
|
|
_git_commit=unknown
|
|
fi
|
|
|
|
if [ -z "$_build_time" ]; then
|
|
_build_time=unknown
|
|
fi
|
|
|
|
if [ -z "$_dirty_fingerprint" ]; then
|
|
_dirty_fingerprint=""
|
|
fi
|
|
|
|
(cd $_sdir; go build -gcflags "all=-N -l" -ldflags "-X main.GitCommit=$_git_commit -X main.BuildTime=$_build_time -X main.DirtyFingerprint=$_dirty_fingerprint" -o "$_dfile" "$_sfile")
|