From 4fe0dfd1ea244116d4b08b7e67fd61e718bf1ccf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ga=C3=ABl=20Reyrol?= <me@gaelreyrol.dev>
Date: Sat, 15 Jul 2023 16:02:18 +0200
Subject: [PATCH] ebpf-verifier: init at 2023-07-15

---
 .../networking/ebpf-verifier/default.nix      | 60 +++++++++++++++++++
 .../remove-fetchcontent-usage.patch           | 14 +++++
 pkgs/top-level/all-packages.nix               | 11 ++++
 3 files changed, 85 insertions(+)
 create mode 100644 pkgs/tools/networking/ebpf-verifier/default.nix
 create mode 100644 pkgs/tools/networking/ebpf-verifier/remove-fetchcontent-usage.patch

diff --git a/pkgs/tools/networking/ebpf-verifier/default.nix b/pkgs/tools/networking/ebpf-verifier/default.nix
new file mode 100644
index 000000000000..63af32ce1a20
--- /dev/null
+++ b/pkgs/tools/networking/ebpf-verifier/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, boost
+, cmake
+, catch2
+, pkg-config
+, substituteAll
+, yaml-cpp
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ebpf-verifier";
+  version = "unstable-2023-07-15";
+
+  src = fetchFromGitHub {
+    owner = "vbpf";
+    repo = "ebpf-verifier";
+    rev = "de14d3aa3cd2845b621faf32b599766a66e158cf";
+    fetchSubmodules = true;
+    hash = "sha256-gnxB8ZLbTyIYpd61T57LPKFm1MHufeVEq/qN9pu2Vpk=";
+  };
+
+  patches = [
+    (substituteAll {
+      # We will download them instead of cmake's fetchContent
+      src = ./remove-fetchcontent-usage.patch;
+      catch2Src = catch2.src;
+    })
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+  ];
+
+  buildInputs = [
+    boost
+    yaml-cpp
+  ];
+
+  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp ../check $out/bin/ebpf-verifier
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "eBPF verifier based on abstract interpretation";
+    homepage = "https://github.com/vbpf/ebpf-verifier";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ gaelreyrol ];
+  };
+})
diff --git a/pkgs/tools/networking/ebpf-verifier/remove-fetchcontent-usage.patch b/pkgs/tools/networking/ebpf-verifier/remove-fetchcontent-usage.patch
new file mode 100644
index 000000000000..8a4af1bee19a
--- /dev/null
+++ b/pkgs/tools/networking/ebpf-verifier/remove-fetchcontent-usage.patch
@@ -0,0 +1,14 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index d7cf256..cb94e5a 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -6,8 +6,7 @@ project(ebpf_verifier)
+ include(FetchContent)
+ FetchContent_Declare(
+   Catch2
+-  GIT_REPOSITORY https://github.com/catchorg/Catch2.git
+-  GIT_TAG        ac93f1943762f6fc92f0dc5bac0d720a33a27530
++  SOURCE_DIR @catch2Src@
+ )
+ FetchContent_MakeAvailable(Catch2)
+ 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ec68372a5cb6..e5c79b1b54b3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -591,6 +591,17 @@ with pkgs;
 
   eclipse-mat = callPackage ../development/tools/eclipse-mat { };
 
+  ebpf-verifier = callPackage ../tools/networking/ebpf-verifier {
+    # Replace this to `catch2 = catch2_3` when catch2 3.4.0 is merged
+    # https://github.com/NixOS/nixpkgs/pull/243485
+    catch2.src = fetchFromGitHub {
+      owner = "catchorg";
+      repo = "Catch2";
+      rev = "v3.4.0";
+      hash = "sha256-DqGGfNjKPW9HFJrX9arFHyNYjB61uoL6NabZatTWrr0=";
+    };
+  };
+
   edgedb = callPackage ../tools/networking/edgedb {
     inherit (darwin.apple_sdk.frameworks) CoreServices Security;
   };