keybase, keybase-gui, kbfs: 4.6.0 -> 4.7.2, added dependencies

[judaew]

Motivation for this change

Adding:

• fuse or osxfuse as a dependency for kbfs (I rely on this kbfs README.md#status)
• gnupg as a dependency for keybase (for command $ keybase pgp gen)

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

Notify maintainers

cc @

[worldofpeace]

@judaew Are these used during the build, or are the executable/s needed in PATH during runtime?
If so we need to hardcode the paths in the source code.

[judaew]

@worldofpeace Yes, executables are needed at runtime. I analyzed the code and I came to the conclusion that Keybase already has GnuPG support for Nix (pinentry_nix.go).

I was a little skeptical about fuse. But the experiment showed that PATH is found automatically. I previously removed fuse from Ubuntu and verified that kbfs is not working properly because of this.

But I'm not sure about osxfuse, since it looks like the location is set within lines options.go#L295-L313. And within lines 285 to 290 the path to the native osxfuse, if another is not available. I think it should work both ways.

[worldofpeace]

Well what I meant by this was, if the program needs executables from fuse to be present at runtime like

result/bin
├── fusermount
├── mount.fuse
└── ulockmgr_server

they won't be there even if they're added to buildInputs. They'll just be in PATH during the build.

Nix doesn't really manage things in this way, though perhaps it should/could.
So what usually has to be done is substitute the calls to any of those executables with a hardcoded path within the nix store. Here's a precise example of what I usually request people to perform

• formatter: init at 0.3.0 #70512 (review)

Though I believe this approach would be rather difficult if they were to switch to go modules, or not vendor things.

---

There also seems to be some assumptions going for macos

• https://github.com/keybase/client/blob/master/go/vendor/bazil.org/fuse/options.go#L279-L293

Now if nix was sandboxed these wouldn't work because they're on the host system, but I believe with macos it would be on the safe side to just rely on these being present outside of nix.

[judaew]

Something just like this?

[worldofpeace]

It does appear you've performed the patch correctly. Will test.

[worldofpeace]

@judaew If you can squash your commits accordingly I can merge.

[judaew]

@worldofpeace Well, I did it.

[worldofpeace]

@GrahamcOfBorg build keybase kbfs keybase-gui

[worldofpeace]

Running checks for darwin. I had to update the keybase-gui expression because it 404'd for me.

[worldofpeace]

Thanks for your patience @judaew and the contributions ✨

[judaew]

Thanks for your help @worldofpeace