libkrunfw: 4.9.0 -> 4.10.0, libkrun: 1.11.2 -> 1.15.1, krunvm: 0.2.3 -> 0.2.4 (#439301)

pkgs/applications/virtualization/krunvm/default.nix

@@ -16,18 +16,18 @@
 
 stdenv.mkDerivation rec {
   pname = "krunvm";
-  version = "0.2.3";
+  version = "0.2.4";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-IXofYsOmbrjq8Zq9+a6pvBYsvZFcKzN5IvCuHaxwazI=";
+    hash = "sha256-YbK4DKw0nh9IO1F7QsJcbOMlHekEdeUBbDHwuQ2x1Ww=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    hash = "sha256-Vmb5IgGyKGekuL018/Xiz9QroWIwTIUxVB57fb0X7Kw=";
+    hash = "sha256-TMV9xCcqBQgPsUSzsTJAi4qsplTOSm3ilaUmtmdaGnE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/libkrun/package.nix

@@ -14,21 +14,31 @@
   libkrunfw,
   rustc,
   withBlk ? false,
+  withNet ? false,
   withGpu ? false,
   withSound ? false,
-  withNet ? false,
-  sevVariant ? false,
+  withTimesync ? false,
+  variant ? null,
 }:
 
+assert lib.elem variant [
+  null
+  "sev"
+  "tdx"
+];
+
+let
+  libkrunfw' = (libkrunfw.override { inherit variant; });
+in
 stdenv.mkDerivation (finalAttrs: {
-  pname = "libkrun";
-  version = "1.11.2";
+  pname = "libkrun" + lib.optionalString (variant != null) "-${variant}";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "libkrun";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-B11f7uG/oODwkME2rauCFbVysxUtUrUmd6RKeuBdnUU=";
+    hash = "sha256-VhlFyYJ/TH12I3dUq0JTus60rQEJq5H4Pm1puCnJV5A=";
   };
 
   outputs = [
@@ -38,15 +48,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-bcHy8AfO9nzSZKoFlEpPKvwupt3eMb+A2rHDaUzO3/U=";
+    hash = "sha256-dK3V7HCCvTqmQhB5Op2zmBPa9FO3h9gednU9tpQk+1U=";
   };
 
   # Make sure libkrunfw can be found by dlopen()
-  # FIXME: This wasn't needed previously. What changed?
   env.RUSTFLAGS = toString (
     map (flag: "-C link-arg=" + flag) [
       "-Wl,--push-state,--no-as-needed"
-      (if sevVariant then "-lkrunfw-sev" else "-lkrunfw")
+      ("-lkrunfw" + lib.optionalString (variant != null) "-${variant}")
       "-Wl,--pop-state"
     ]
   );
@@ -57,10 +66,10 @@ stdenv.mkDerivation (finalAttrs: {
     cargo
     rustc
   ]
-  ++ lib.optional (sevVariant || withGpu) pkg-config;
+  ++ lib.optional (variant == "sev" || variant == "tdx" || withGpu) pkg-config;
 
   buildInputs = [
-    (libkrunfw.override { inherit sevVariant; })
+    libkrunfw'
     glibc
     glibc.static
   ]
@@ -70,16 +79,18 @@ stdenv.mkDerivation (finalAttrs: {
     virglrenderer
   ]
   ++ lib.optional withSound pipewire
-  ++ lib.optional sevVariant openssl;
+  ++ lib.optional (variant == "sev" || variant == "tdx") openssl;
 
   makeFlags = [
     "PREFIX=${placeholder "out"}"
   ]
   ++ lib.optional withBlk "BLK=1"
+  ++ lib.optional withNet "NET=1"
   ++ lib.optional withGpu "GPU=1"
   ++ lib.optional withSound "SND=1"
-  ++ lib.optional withNet "NET=1"
-  ++ lib.optional sevVariant "SEV=1";
+  ++ lib.optional withTimesync "TIMESYNC=1"
+  ++ lib.optional (variant == "sev") "SEV=1"
+  ++ lib.optional (variant == "tdx") "TDX=1";
 
   postInstall = ''
     mkdir -p $dev/lib/pkgconfig
@@ -87,15 +98,17 @@ stdenv.mkDerivation (finalAttrs: {
     mv $out/include $dev/
   '';
 
-  meta = with lib; {
+  env.OPENSSL_NO_VENDOR = true;
+
+  meta = {
     description = "Dynamic library providing Virtualization-based process isolation capabilities";
     homepage = "https://github.com/containers/libkrun";
-    license = licenses.asl20;
-    maintainers = with maintainers; [
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
       nickcao
       RossComputerGuy
       nrabulinski
     ];
-    platforms = libkrunfw.meta.platforms;
+    platforms = libkrunfw'.meta.platforms;
   };
 })

pkgs/by-name/li/libkrunfw/package.nix

@@ -10,23 +10,29 @@
   perl,
   elfutils,
   python3,
-  sevVariant ? false,
+  variant ? null,
 }:
 
+assert lib.elem variant [
+  null
+  "sev"
+  "tdx"
+];
+
 stdenv.mkDerivation (finalAttrs: {
-  pname = "libkrunfw";
-  version = "4.9.0";
+  pname = "libkrunfw" + lib.optionalString (variant != null) "-${variant}";
+  version = "4.10.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "libkrunfw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wmvjex68Mh7qehA33WNBYHhV9Q/XWLixokuGWnqJ3n0=";
+    hash = "sha256-mq2gw0+xL6qUZE/fk0vLT3PEpzPV8p+iwRFJHXVOMnk=";
   };
 
   kernelSrc = fetchurl {
-    url = "mirror://kernel/linux/kernel/v6.x/linux-6.12.20.tar.xz";
-    hash = "sha256-Iw6JsHsKuC508H7MG+4xBdyoHQ70qX+QCSnEBySbasc=";
+    url = "mirror://kernel/linux/kernel/v6.x/linux-6.12.34.tar.xz";
+    hash = "sha256-p/P+OB9n7KQXLptj77YaFL1/nhJ44DYD0P9ak/Jwwk0=";
   };
 
   postPatch = ''
@@ -51,8 +57,11 @@ stdenv.mkDerivation (finalAttrs: {
   makeFlags = [
     "PREFIX=${placeholder "out"}"
   ]
-  ++ lib.optionals sevVariant [
+  ++ lib.optionals (variant == "sev") [
     "SEV=1"
+  ]
+  ++ lib.optionals (variant == "tdx") [
+    "TDX=1"
   ];
 
   # Fixes https://github.com/containers/libkrunfw/issues/55
@@ -60,18 +69,18 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  meta = with lib; {
+  meta = {
     description = "Dynamic library bundling the guest payload consumed by libkrun";
     homepage = "https://github.com/containers/libkrunfw";
-    license = with licenses; [
+    license = with lib.licenses; [
       lgpl2Only
       lgpl21Only
     ];
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       nickcao
       RossComputerGuy
       nrabulinski
     ];
-    platforms = [ "x86_64-linux" ] ++ lib.optionals (!sevVariant) [ "aarch64-linux" ];
+    platforms = [ "x86_64-linux" ] ++ lib.optionals (variant == null) [ "aarch64-linux" ];
   };
 })

pkgs/top-level/all-packages.nix

@@ -10492,7 +10492,8 @@ with pkgs;
 
   jool-cli = callPackage ../os-specific/linux/jool/cli.nix { };
 
-  libkrun-sev = libkrun.override { sevVariant = true; };
+  libkrun-sev = libkrun.override { variant = "sev"; };
+  libkrun-tdx = libkrun.override { variant = "tdx"; };
 
   linthesia = callPackage ../games/linthesia/default.nix { };