Permalink
4 comments
on commit
sign in to comment.
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Add --with-sandbox-shell configure flag
And add a 116 KiB ash shell from busybox to the release build. This helps to make sandbox builds work out of the box on non-NixOS systems and with diverted stores.
- Loading branch information
Showing
with
38 additions
and 12 deletions.
- +1 −0 Makefile.config.in
- +6 −0 configure.ac
- +21 −0 release-common.nix
- +4 −5 release.nix
- +3 −4 shell.nix
- +2 −2 src/libstore/globals.cc
- +1 −1 src/libstore/local.mk
@@ -0,0 +1,21 @@ | ||
{ pkgs }: | ||
|
||
rec { | ||
sh = pkgs.busybox.override { | ||
useMusl = true; | ||
enableStatic = true; | ||
enableMinimal = true; | ||
extraConfig = '' | ||
CONFIG_ASH y | ||
CONFIG_ASH_BUILTIN_ECHO y | ||
CONFIG_ASH_BUILTIN_TEST y | ||
CONFIG_ASH_OPTIMIZE_FOR_SIZE y | ||
''; | ||
}; | ||
|
||
configureFlags = | ||
[ "--disable-init-state" | ||
"--enable-gc" | ||
"--with-sandbox-shell=${sh}/bin/busybox" | ||
]; | ||
} |
This comment has been minimized.
Cool!
Perhaps this is a good time to think about stopping nixpkgs from assuming that /bin/sh is bash? AFAIK, ash is not bash compatible. For instance, ash doesn't understand [[ syntax. So we should stick with POSIX sh syntax, IMHO.
This comment has been minimized.
Where do we assume that /bin/sh is bash?
Stdenv does require bash, but I think that dependency is explicit. (There might be some issues during stdenv bootstrap on some platforms though.)
This comment has been minimized.
Just in general, I see bashisms in nixpkgs and it has been said (and perhaps even documented?) that on NixOS one can assume /bin/sh is bash. I just thought it'd be a problem if /bin/sh in sandbox builds was non-bash. But if it works, then no worries!
This comment has been minimized.
Does this still work on Darwin? I thought busybox didn't build...