From f51090f3d14222602bcff10b76a3720d83ff7ddf Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Sun, 28 Jan 2024 18:48:00 +0100 Subject: [PATCH] nix: Check static executable for /nix/store references This makes the static build fail in case any references to the nix store are left over. Those will increase the closure size of the nix derivation massively and lead to a huge docker image. At the same time, those references will not be functional on non-nix systems, to which the static executable is distributed, anyway. --- nix/static.nix | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/nix/static.nix b/nix/static.nix index 410ff13cf..4a54f919a 100644 --- a/nix/static.nix +++ b/nix/static.nix @@ -49,14 +49,31 @@ let makeExecutableStatic = drv: pkgs.lib.pipe drv [ (lib.compose.appendConfigureFlags [ "--enable-executable-static" ]) lib.compose.justStaticExecutables + + # To successfully compile a redistributable, fully static executable we need to: + # 1. make executable really statically linked. + # 2. avoid any references to /nix/store to prevent blowing up the closure size. + # 3. be able to run the executable. + # When checking for references, we ignore the following: + # - eeee... are removed references which don't actually exist + # - openssl-etc references are purposely designed to be very small (lib.compose.overrideCabal (drv: { - postInstall = '' + postFixup = drv.postFixup + '' exe="$out/bin/postgrest" + if ! (file "$exe" | grep 'statically linked') then echo "not a static executable, ldd output:" ldd "$exe" exit 1 fi + + echo "Checking for references to /nix/store..." + (${pkgsStatic.binutils}/bin/strings "$exe" \ + | grep -v /nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee \ + | grep -v -etc/etc/ssl \ + | grep /nix/store || exit 0 && exit 1) + echo "No references to /nix/store found" + "$exe" --help ''; }))