public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'upstream/staging' into strictDeps

Browse Source
This commit is contained in:
John Ericson
2018-05-14 23:33:03 -04:00
parent 330ca731e8 0fc21a364b
commit 5e17335bd7
4956 changed files with 139379 additions and 92174 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/build-support/bintools-wrapper/add-flags.sh
+4 -12
View File
@@ -5,28 +5,20 @@ var_templates_list=(
NIX+LDFLAGS_BEFORE
NIX+LDFLAGS_AFTER
NIX+LDFLAGS_HARDEN
NIX+HARDENING_ENABLE
)
var_templates_bool=(
NIX+SET_BUILD_ID
NIX+DONT_SET_RPATH
)
declare -a role_infixes=()
if [ "${NIX_BINTOOLS_WRAPPER_@infixSalt@_TARGET_BUILD:-}" ]; then
role_infixes+=(_BUILD_)
fi
if [ "${NIX_BINTOOLS_WRAPPER_@infixSalt@_TARGET_HOST:-}" ]; then
role_infixes+=(_)
fi
if [ "${NIX_BINTOOLS_WRAPPER_@infixSalt@_TARGET_TARGET:-}" ]; then
role_infixes+=(_TARGET_)
fi
accumulateRoles
for var in "${var_templates_list[@]}"; do
mangleVarList "$var" "${role_infixes[@]}"
mangleVarList "$var" ${role_infixes[@]+"${role_infixes[@]}"}
done
for var in "${var_templates_bool[@]}"; do
mangleVarBool "$var" "${role_infixes[@]}"
mangleVarBool "$var" ${role_infixes[@]+"${role_infixes[@]}"}
done
if [ -e @out@/nix-support/libc-ldflags ]; then
pkgs/build-support/bintools-wrapper/add-hardening.sh
+46 -41
View File
@@ -1,53 +1,58 @@
hardeningFlags=(relro bindnow)
# Intentionally word-split in case 'hardeningEnable' is defined in
# Nix. Also, our bootstrap tools version of bash is old enough that
# undefined arrays trip `set -u`.
if [[ -v hardeningEnable[@] ]]; then
hardeningFlags+=(${hardeningEnable[@]})
fi
hardeningLDFlags=()
declare -a hardeningLDFlags=()
declare -A hardeningDisableMap
declare -A hardeningEnableMap=()
# Intentionally word-split in case 'hardeningDisable' is defined in Nix.
for flag in ${hardeningDisable[@]:-IGNORED_KEY} @hardening_unsupported_flags@
do
hardeningDisableMap[$flag]=1
# Intentionally word-split in case 'NIX_HARDENING_ENABLE' is defined in Nix. The
# array expansion also prevents undefined variables from causing trouble with
# `set -u`.
for flag in ${NIX_@infixSalt@_HARDENING_ENABLE-}; do
hardeningEnableMap["$flag"]=1
done
# Remove unsupported flags.
for flag in @hardening_unsupported_flags@; do
unset -v "hardeningEnableMap[$flag]"
done
if (( "${NIX_DEBUG:-0}" >= 1 )); then
declare -a allHardeningFlags=(pie relro bindnow)
declare -A hardeningDisableMap=()
# Determine which flags were effectively disabled so we can report below.
for flag in "${allHardeningFlags[@]}"; do
if [[ -z "${hardeningEnableMap[$flag]-}" ]]; then
hardeningDisableMap[$flag]=1
fi
done
printf 'HARDENING: disabled flags:' >&2
(( "${#hardeningDisableMap[@]}" )) && printf ' %q' "${!hardeningDisableMap[@]}" >&2
echo >&2
fi
if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
if (( "${NIX_DEBUG:-0}" >= 1 )); then
if (( "${#hardeningEnableMap[@]}" )); then
echo 'HARDENING: Is active (not completely disabled with "all" flag)' >&2;
fi
for flag in "${hardeningFlags[@]}"
do
if [[ -z "${hardeningDisableMap[$flag]:-}" ]]; then
case $flag in
pie)
if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
hardeningLDFlags+=('-pie')
fi
;;
relro)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling relro >&2; fi
hardeningLDFlags+=('-z' 'relro')
;;
bindnow)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling bindnow >&2; fi
hardeningLDFlags+=('-z' 'now')
;;
*)
# Ignore unsupported. Checked in Nix that at least *some*
# tool supports each flag.
;;
esac
fi
done
fi
for flag in "${!hardeningEnableMap[@]}"; do
case $flag in
pie)
if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling LDFlags -pie >&2; fi
hardeningLDFlags+=('-pie')
fi
;;
relro)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling relro >&2; fi
hardeningLDFlags+=('-z' 'relro')
;;
bindnow)
if (( "${NIX_DEBUG:-0}" >= 1 )); then echo HARDENING: enabling bindnow >&2; fi
hardeningLDFlags+=('-z' 'now')
;;
*)
# Ignore unsupported. Checked in Nix that at least *some*
# tool supports each flag.
;;
esac
done
pkgs/build-support/bintools-wrapper/default.nix
+23 -17
View File
@@ -5,7 +5,8 @@
# script that sets up the right environment variables so that the
# compiler and the linker just "work".
{ name ? "", stdenvNoCC, nativeTools, noLibc ? false, nativeLibc, nativePrefix ? ""
{ name ? ""
, stdenvNoCC, nativeTools, propagateDoc ? !nativeTools, noLibc ? false, nativeLibc, nativePrefix ? ""
, bintools ? null, libc ? null
, coreutils ? null, shell ? stdenvNoCC.shell, gnugrep ? null
, extraPackages ? [], extraBuildCommands ? ""
@@ -15,7 +16,7 @@
with stdenvNoCC.lib;
assert nativeTools -> nativePrefix != "";
assert nativeTools -> !propagateDoc && nativePrefix != "";
assert !nativeTools ->
bintools != null && coreutils != null && gnugrep != null;
assert !(nativeLibc && noLibc);
@@ -52,6 +53,7 @@ let
dynamicLinker =
/**/ if libc == null then null
else if targetPlatform.libc == "musl" then "${libc_lib}/lib/ld-musl-*"
else if targetPlatform.libc == "bionic" then "/system/bin/linker"
else if targetPlatform.system == "i686-linux" then "${libc_lib}/lib/ld-linux.so.2"
else if targetPlatform.system == "x86_64-linux" then "${libc_lib}/lib/ld-linux-x86-64.so.2"
# ARM with a wildcard, which can be "" or "-armhf".
@@ -72,7 +74,7 @@ in
stdenv.mkDerivation {
name = targetPrefix
+ (if name != "" then name else "${bintoolsName}-wrapper")
+ (if name != "" then name else stdenv.lib.removePrefix targetPrefix "${bintoolsName}-wrapper")
+ (stdenv.lib.optionalString (bintools != null && bintoolsVersion != "") "-${bintoolsVersion}");
preferLocalBuild = true;
@@ -83,7 +85,7 @@ stdenv.mkDerivation {
inherit targetPrefix infixSalt;
outputs = [ "out" "info" "man" ];
outputs = [ "out" ] ++ optionals propagateDoc [ "man" "info" ];
passthru = {
inherit bintools libc nativeTools nativeLibc nativePrefix;
@@ -111,7 +113,7 @@ stdenv.mkDerivation {
''
set -u
mkdir -p $out/bin {$out,$info,$man}/nix-support
mkdir -p $out/bin $out/nix-support
wrap() {
local dst="$1"
@@ -189,7 +191,12 @@ stdenv.mkDerivation {
strictDeps = true;
depsTargetTargetPropagated = extraPackages;
setupHook = ./setup-hook.sh;
wrapperName = "BINTOOLS_WRAPPER";
setupHooks = [
../setup-hooks/role.bash
./setup-hook.sh
];
postFixup =
''
@@ -245,28 +252,27 @@ stdenv.mkDerivation {
'')
+ optionalString (!nativeTools) ''
##
## User env support
##
# Propagate the underling unwrapped bintools so that if you
# install the wrapper, you get tools like objdump, the manpages,
# etc. as well (same for any binaries of libc).
# install the wrapper, you get tools like objdump (same for any
# binaries of libc).
printWords ${bintools_bin} ${if libc == null then "" else libc_bin} > $out/nix-support/propagated-user-env-packages
''
+ optionalString propagateDoc ''
##
## Man page and info support
##
printWords ${bintools.info or ""} \
>> $info/nix-support/propagated-build-inputs
printWords ${bintools.man or ""} \
>> $man/nix-support/propagated-build-inputs
mkdir -p $man/nix-support $info/nix-support
printWords ${bintools.man or ""} >> $man/nix-support/propagated-build-inputs
printWords ${bintools.info or ""} >> $info/nix-support/propagated-build-inputs
''
+ ''
##
## Hardening support
##
@@ -289,18 +295,18 @@ stdenv.mkDerivation {
set +u
substituteAll ${./add-flags.sh} $out/nix-support/add-flags.sh
substituteAll ${./add-hardening.sh} $out/nix-support/add-hardening.sh
substituteAll ${../cc-wrapper/utils.sh} $out/nix-support/utils.sh
substituteAll ${../wrapper-common/utils.bash} $out/nix-support/utils.bash
##
## Extra custom steps
##
''
+ extraBuildCommands;
inherit dynamicLinker expand-response-params;
# for substitution in utils.sh
# for substitution in utils.bash
expandResponseParams = "${expand-response-params}/bin/expand-response-params";
meta =
pkgs/build-support/bintools-wrapper/ld-wrapper.sh
+3 -3
View File
@@ -14,7 +14,7 @@ if [ -n "@coreutils_bin@" ]; then
PATH="@coreutils_bin@/bin"
fi
source @out@/nix-support/utils.sh
source @out@/nix-support/utils.bash
if [ -z "${NIX_BINTOOLS_WRAPPER_@infixSalt@_FLAGS_SET:-}" ]; then
source @out@/nix-support/add-flags.sh
@@ -57,8 +57,8 @@ fi
source @out@/nix-support/add-hardening.sh
extraAfter=("${hardeningLDFlags[@]}")
extraBefore=()
extraAfter=()
extraBefore=(${hardeningLDFlags[@]+"${hardeningLDFlags[@]}"})
if [ -z "${NIX_@infixSalt@_LDFLAGS_SET:-}" ]; then
extraAfter+=($NIX_@infixSalt@_LDFLAGS)
pkgs/build-support/bintools-wrapper/setup-hook.sh
+12 -30
View File
@@ -11,44 +11,22 @@ set -u
[[ -z ${strictDeps-} ]] || (( "$hostOffset" < 0 )) || return 0
bintoolsWrapper_addLDVars () {
case $depHostOffset in
-1) local role='BUILD_' ;;
0) local role='' ;;
1) local role='TARGET_' ;;
*) echo "bintools-wrapper: Error: Cannot be used with $depHostOffset-offset deps" >2;
return 1 ;;
esac
# See ../setup-hooks/role.bash
local role_post role_pre
getTargetRoleEnvHook
if [[ -d "$1/lib64" && ! -L "$1/lib64" ]]; then
export NIX_${role}LDFLAGS+=" -L$1/lib64"
export NIX_${role_pre}LDFLAGS+=" -L$1/lib64"
fi
if [[ -d "$1/lib" ]]; then
export NIX_${role}LDFLAGS+=" -L$1/lib"
export NIX_${role_pre}LDFLAGS+=" -L$1/lib"
fi
}
case $targetOffset in
-1)
export NIX_BINTOOLS_WRAPPER_@infixSalt@_TARGET_BUILD=1
role_pre='BUILD_'
role_post='_FOR_BUILD'
;;
0)
export NIX_BINTOOLS_WRAPPER_@infixSalt@_TARGET_HOST=1
role_pre=''
role_post=''
;;
1)
export NIX_BINTOOLS_WRAPPER_@infixSalt@_TARGET_TARGET=1
role_pre='TARGET_'
role_post='_FOR_TARGET'
;;
*)
echo "cc-wrapper: used as improper sort of dependency" >2;
return 1
;;
esac
# See ../setup-hooks/role.bash
getTargetRole
getTargetRoleWrapper
addEnvHooks "$targetOffset" bintoolsWrapper_addLDVars
@@ -83,6 +61,10 @@ do
fi
done
# If unset, assume the default hardening flags.
: ${NIX_HARDENING_ENABLE="fortify stackprotector pic strictoverflow format relro bindnow"}
export NIX_HARDENING_ENABLE
# No local scope in sourced file
unset -v role_pre role_post cmd upper_case
set +u