initrd: unsafeDiscardReferences.out = true (#489274)

pkgs/build-support/kernel/make-initrd-ng.nix

@@ -16,7 +16,6 @@ in
   pkgsBuildHost,
   makeInitrdNGTool,
   binutils,
-  runCommand,
   # Name of the derivation (not of the resulting file!)
   name ? "initrd",
 
@@ -74,47 +73,53 @@ in
     _compressorMeta.ubootName
       or (throw "Unrecognised compressor ${_compressorName}, please specify uInitrdCompression"),
 }:
-runCommand name
-  {
-    compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";
-    passthru = {
-      compressorExecutableFunction = _compressorFunction;
-      compressorArgs = _compressorArgsReal;
-    };
+stdenvNoCC.mkDerivation (finalAttrs: {
+  __structuredAttrs = true;
 
-    inherit
-      extension
-      makeUInitrd
-      uInitrdArch
-      prepend
-      ;
-    ${if makeUInitrd then "uInitrdCompression" else null} = uInitrdCompression;
+  # the initrd will be self-contained so we can drop references
+  # to the closure that was used to build it
+  unsafeDiscardReferences.out = true;
 
-    passAsFile = [ "contents" ];
-    contents = builtins.toJSON contents;
+  inherit
+    name
+    extension
+    makeUInitrd
+    uInitrdArch
+    prepend
+    ;
+  ${if makeUInitrd then "uInitrdCompression" else null} = uInitrdCompression;
 
-    nativeBuildInputs = [
-      makeInitrdNGTool
-      cpio
-    ]
-    ++ lib.optional makeUInitrd ubootTools;
-  }
-  ''
+  compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";
+  contentsJSON = builtins.toJSON contents;
+
+  nativeBuildInputs = [
+    makeInitrdNGTool
+    cpio
+  ]
+  ++ lib.optional makeUInitrd ubootTools;
+
+  buildCommand = ''
     mkdir -p ./root/{run,tmp,var/empty}
     ln -s ../run ./root/var/run
-    make-initrd-ng "$contentsPath" ./root
+    make-initrd-ng <(echo "$contentsJSON") ./root
     mkdir "$out"
     (cd root && find . -exec touch -h -d '@1' '{}' +)
-    for PREP in $prepend; do
+    for PREP in ''${prepend[@]}; do
       cat $PREP >> $out/initrd
     done
     (cd root && find . -print0 | sort -z | cpio --quiet -o -H newc -R +0:+0 --reproducible --null | eval -- $compress >> "$out/initrd")
 
     if [ -n "$makeUInitrd" ]; then
-        mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img
-        # Compatibility symlink
-        ln -sf "initrd.img" "$out/initrd"
+      mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img
+      # Compatibility symlink
+      ln -sf "initrd.img" "$out/initrd"
     else
-        ln -s "initrd" "$out/initrd$extension"
+      ln -s "initrd" "$out/initrd$extension"
     fi
-  ''
+  '';
+
+  passthru = {
+    compressorExecutableFunction = _compressorFunction;
+    compressorArgs = _compressorArgsReal;
+  };
+})

pkgs/build-support/kernel/make-initrd.nix

@@ -81,42 +81,44 @@ in
     _compressorMeta.ubootName
       or (throw "Unrecognised compressor ${_compressorName}, please specify uInitrdCompression"),
 }:
-stdenvNoCC.mkDerivation (
-  rec {
-    inherit
-      name
-      makeUInitrd
-      extension
-      uInitrdArch
-      prepend
-      ;
+stdenvNoCC.mkDerivation (finalAttrs: {
+  __structuredAttrs = true;
 
-    builder = ./make-initrd.sh;
+  # the initrd will be self-contained so we can drop references
+  # to the closure that was used to build it
+  unsafeDiscardReferences.out = true;
 
-    nativeBuildInputs = [
-      cpio
-    ]
-    ++ lib.optional makeUInitrd ubootTools;
+  inherit
+    name
+    extension
+    makeUInitrd
+    uInitrdArch
+    prepend
+    ;
+  ${if makeUInitrd then "uInitrdCompression" else null} = uInitrdCompression;
 
-    compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";
+  builder = ./make-initrd.sh;
 
-    # Pass the function through, for reuse in append-initrd-secrets. The
-    # function is used instead of the string, in order to support
-    # cross-compilation (append-initrd-secrets running on a different
-    # architecture than what the main initramfs is built on).
-    passthru = {
-      compressorExecutableFunction = _compressorFunction;
-      compressorArgs = _compressorArgsReal;
-    };
+  nativeBuildInputs = [
+    cpio
+  ]
+  ++ lib.optional makeUInitrd ubootTools;
 
-    # !!! should use XML.
-    objects = map (x: x.object) contents;
-    symlinks = map (x: x.symlink) contents;
-    suffices = map (x: if x ? suffix then x.suffix else "none") contents;
+  compress = "${_compressorExecutable} ${lib.escapeShellArgs _compressorArgsReal}";
 
-    closureInfo = "${pkgsBuildHost.closureInfo { rootPaths = objects; }}";
-  }
-  // lib.optionalAttrs makeUInitrd {
-    uInitrdCompression = uInitrdCompression;
-  }
-)
+  # !!! should use XML.
+  objects = map (x: x.object) contents;
+  symlinks = map (x: x.symlink) contents;
+  suffices = map (x: if x ? suffix then x.suffix else "none") contents;
+
+  closureInfo = "${pkgsBuildHost.closureInfo { rootPaths = finalAttrs.objects; }}";
+
+  # Pass the function through, for reuse in append-initrd-secrets. The
+  # function is used instead of the string, in order to support
+  # cross-compilation (append-initrd-secrets running on a different
+  # architecture than what the main initramfs is built on).
+  passthru = {
+    compressorExecutableFunction = _compressorFunction;
+    compressorArgs = _compressorArgsReal;
+  };
+})

pkgs/build-support/kernel/make-initrd.sh

@@ -1,9 +1,5 @@
 set -o pipefail
 
-objects=($objects)
-symlinks=($symlinks)
-suffices=($suffices)
-
 mkdir root
 
 # Needed for splash_helper, which gets run before init.
@@ -12,14 +8,14 @@ mkdir root/sys
 mkdir root/proc
 
 
-for ((n = 0; n < ${#objects[*]}; n++)); do
-    object=${objects[$n]}
-    symlink=${symlinks[$n]}
-    suffix=${suffices[$n]}
-    if test "$suffix" = none; then suffix=; fi
+for ((n = 0; n < ${#objects[@]}; n++)); do
+  object=${objects[n]}
+  symlink=${symlinks[n]}
+  suffix=${suffices[n]}
+  if test "$suffix" = none; then suffix=; fi
 
-    mkdir -p $(dirname root/$symlink)
-    ln -s $object$suffix root/$symlink
+  mkdir -p $(dirname root/$symlink)
+  ln -s $object$suffix root/$symlink
 done
 
 
@@ -34,16 +30,16 @@ storePaths="$(cat $closureInfo/store-paths)"
 
 # Put the closure in a gzipped cpio archive.
 mkdir -p $out
-for PREP in $prepend; do
+for PREP in ${prepend[@]}; do
   cat $PREP >> $out/initrd
 done
 (cd root && find * .[^.*] -exec touch -h -d '@1' '{}' +)
 (cd root && find * .[^.*] -print0 | sort -z | cpio --quiet -o -H newc -R +0:+0 --reproducible --null | eval -- $compress >> "$out/initrd")
 
 if [ -n "$makeUInitrd" ]; then
-    mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img
-    # Compatibility symlink
-    ln -sf "initrd.img" "$out/initrd"
+  mkimage -A "$uInitrdArch" -O linux -T ramdisk -C "$uInitrdCompression" -d "$out/initrd" $out/initrd.img
+  # Compatibility symlink
+  ln -sf "initrd.img" "$out/initrd"
 else
-    ln -s "initrd" "$out/initrd$extension"
+  ln -s "initrd" "$out/initrd$extension"
 fi