nukeReferences: fix code signatures on aarch64-darwin

This commit is contained in:
Andrew Childs 2021-02-15 14:56:21 +09:00
parent f067102afe
commit 79e34294bd
5 changed files with 67 additions and 32 deletions

View file

@ -1,29 +0,0 @@
source $stdenv/setup
mkdir -p $out/bin
cat > $out/bin/nuke-refs <<EOF
#! $SHELL -e
excludes=""
while getopts e: o; do
case "\$o" in
e) storeId=\$(echo "\$OPTARG" | $perl/bin/perl -ne "print \"\\\$1\" if m|^\Q$NIX_STORE\E/([a-z0-9]{32})-.*|")
if [ -z "\$storeId" ]; then
echo "-e argument must be a Nix store path"
exit 1
fi
excludes="\$excludes(?!\$storeId)"
;;
esac
done
shift \$((\$OPTIND-1))
for i in "\$@"; do
if test ! -L "\$i" -a -f "\$i"; then
cat "\$i" | $perl/bin/perl -pe "s|\Q$NIX_STORE\E/\$excludes[a-z0-9]{32}-|$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" > "\$i.tmp"
if test -x "\$i"; then chmod +x "\$i.tmp"; fi
mv "\$i.tmp" "\$i"
fi
done
EOF
chmod +x $out/bin/nuke-refs

View file

@ -0,0 +1,5 @@
# Fixup hook for nukeReferences, not stdenv
source @signingUtils@
fixupHooks+=(signIfRequired)

View file

@ -3,11 +3,35 @@
# path (/nix/store/eeee...). This is useful for getting rid of
# dependencies that you know are not actually needed at runtime.
{ stdenvNoCC, perl }:
{ lib, stdenvNoCC, perl, signingUtils, shell ? stdenvNoCC.shell }:
let
stdenv = stdenvNoCC;
darwinCodeSign = stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64;
in
stdenvNoCC.mkDerivation {
name = "nuke-references";
builder = ./builder.sh;
dontUnpack = true;
dontConfigure = true;
dontBuild = true;
installPhase = ''
mkdir -p $out/bin
substituteAll ${./nuke-refs.sh} $out/bin/nuke-refs
chmod a+x $out/bin/nuke-refs
'';
postFixup = lib.optionalString darwinCodeSign ''
mkdir -p $out/nix-support
substituteAll ${./darwin-sign-fixup.sh} $out/nix-support/setup-hooks.sh
'';
# FIXME: get rid of perl dependency.
inherit perl;
inherit (builtins) storeDir;
shell = lib.getBin shell + (shell.shellPath or "");
signingUtils = if darwinCodeSign then signingUtils else null;
}

View file

@ -0,0 +1,33 @@
#! @shell@
fixupHooks=()
if [ -e @out@/nix-support/setup-hooks.sh ]; then
source @out@/nix-support/setup-hooks.sh
fi
excludes=""
while getopts e: o; do
case "$o" in
e) storeId=$(echo "$OPTARG" | @perl@/bin/perl -ne "print \"\$1\" if m|^\Q@storeDir@\E/([a-z0-9]{32})-.*|")
if [ -z "$storeId" ]; then
echo "-e argument must be a Nix store path"
exit 1
fi
excludes="$excludes(?!$storeId)"
;;
esac
done
shift $(($OPTIND-1))
for i in "$@"; do
if test ! -L "$i" -a -f "$i"; then
cat "$i" | @perl@/bin/perl -pe "s|\Q@storeDir@\E/$excludes[a-z0-9]{32}-|@storeDir@/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" > "$i.tmp"
if test -x "$i"; then chmod +x "$i.tmp"; fi
mv "$i.tmp" "$i"
for hook in "${fixupHooks[@]}"; do
eval "$hook" "$i"
done
fi
done

View file

@ -638,7 +638,9 @@ in
replaceDependency = callPackage ../build-support/replace-dependency.nix { };
nukeReferences = callPackage ../build-support/nuke-references { };
nukeReferences = callPackage ../build-support/nuke-references {
inherit (darwin) signingUtils;
};
referencesByPopularity = callPackage ../build-support/references-by-popularity { };