nixpkgs/pkgs/applications/virtualization/runc/default.nix
2017-03-11 15:17:36 +01:00

75 lines
2.3 KiB
Nix

{ stdenv, lib, fetchFromGitHub, fetchpatch, removeReferencesTo, go-md2man
, go, pkgconfig, libapparmor, apparmor-parser, libseccomp }:
with lib;
stdenv.mkDerivation rec {
name = "runc-${version}";
version = "1.0.0-rc2";
src = fetchFromGitHub {
owner = "opencontainers";
repo = "runc";
rev = "v${version}";
sha256 = "06bxc4g3frh4i1lkzvwdcwmzmr0i52rz4a4pij39s15zaigm79wk";
};
patches = [
# Two patches to fix CVE-2016-9962
# From https://bugzilla.suse.com/show_bug.cgi?id=1012568
(fetchpatch {
name = "0001-libcontainer-nsenter-set-init-processes-as-non-dumpa.patch";
url = "https://bugzilla.suse.com/attachment.cgi?id=709048&action=diff&context=patch&collapsed=&headers=1&format=raw";
sha256 = "1cfsmsyhc45a2929825mdaql0mrhhbrgdm54ly0957j2f46072ck";
})
(fetchpatch {
name = "0002-libcontainer-init-only-pass-stateDirFd-when-creating.patch";
url = "https://bugzilla.suse.com/attachment.cgi?id=709049&action=diff&context=patch&collapsed=&headers=1&format=raw";
sha256 = "1ykwg1mbvsxsnsrk9a8i4iadma1g0rgdmaj19dvif457hsnn31wl";
})
];
outputs = [ "out" "man" ];
hardeningDisable = ["fortify"];
buildInputs = [ removeReferencesTo go-md2man go pkgconfig libseccomp libapparmor apparmor-parser ];
makeFlags = ''BUILDTAGS+=seccomp BUILDTAGS+=apparmor'';
preBuild = ''
patchShebangs .
substituteInPlace libcontainer/apparmor/apparmor.go \
--replace /sbin/apparmor_parser ${apparmor-parser}/bin/apparmor_parser
'';
installPhase = ''
install -Dm755 runc $out/bin/runc
# Include contributed man pages
man/md2man-all.sh -q
manRoot="$man/share/man"
mkdir -p "$manRoot"
for manDir in man/man?; do
manBase="$(basename "$manDir")" # "man1"
for manFile in "$manDir"/*; do
manName="$(basename "$manFile")" # "docker-build.1"
mkdir -p "$manRoot/$manBase"
gzip -c "$manFile" > "$manRoot/$manBase/$manName.gz"
done
done
'';
preFixup = ''
find $out/bin -type f -exec remove-references-to -t ${go} '{}' +
'';
meta = {
homepage = https://runc.io/;
description = "A CLI tool for spawning and running containers according to the OCI specification";
license = licenses.asl20;
maintainers = with maintainers; [ offline ];
platforms = platforms.linux;
};
}