From 83c533e5576ccf19966da9d8f10a36afe28a8eb9 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Mon, 23 Dec 2024 22:02:21 +0100
Subject: [PATCH] nix: refactor derivation tests for static package

Instead of rolling our own, we can use some tooling from nix / nixpkgs.

We drop the "statically linked" check, because our goal is to compile
mostly-static executables to darwin, too. However, those will never be
fully static, because they always link to the platform's libc.
---
 .github/workflows/build.yaml |  2 +-
 nix/static.nix               | 37 ++++++++++++------------------------
 2 files changed, 13 insertions(+), 26 deletions(-)

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 71af5a0b1..1af2d3024 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -40,7 +40,7 @@ jobs:
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
 
       - name: Build static executable
-        run: nix-build -A postgrestStatic
+        run: nix-build -A postgrestStatic -A postgrestStatic.tests
       - name: Save built executable as artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
diff --git a/nix/static.nix b/nix/static.nix
index 0e626d141..be6b2f0b1 100644
--- a/nix/static.nix
+++ b/nix/static.nix
@@ -41,32 +41,19 @@ let
     lib.compose.justStaticExecutables
 
     # To successfully compile a redistributable, fully static executable we need to:
-    # 1. make executable really statically linked.
-    # 2. avoid any references to /nix/store to prevent blowing up the closure size.
-    # 3. be able to run the executable.
-    # When checking for references, we ignore the following:
-    # - eeee... are removed references which don't actually exist
-    # - openssl-etc references are purposely designed to be very small
-    (lib.compose.overrideCabal (drv: {
-      postFixup = drv.postFixup + ''
-        exe="$out/bin/postgrest"
+    # 1. avoid any references to /nix/store to prevent blowing up the closure size.
+    (drv: drv.overrideAttrs {
+      allowedReferences = [
+        pkgsStatic.openssl.etc
+      ];
+    })
 
-        if ! (file "$exe" | grep 'statically linked') then
-          echo "not a static executable, ldd output:"
-          ldd "$exe"
-          exit 1
-        fi
-
-        echo "Checking for references to /nix/store..."
-        (${pkgsStatic.binutils}/bin/strings "$exe" \
-          | grep -v /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee \
-          | grep -v -etc/etc/ssl \
-          | grep /nix/store || exit 0 && exit 1)
-        echo "No references to /nix/store found"
-
-        "$exe" --help
-      '';
-    }))
+    # 2. be able to run the executable.
+    (drv: drv.overrideAttrs {
+      passthru.tests.version = pkgsStatic.testers.testVersion {
+        package = drv;
+      };
+    })
   ];
 
 in