From 55c48627588220fff38aabdbd8f6f80a41ba2728 Mon Sep 17 00:00:00 2001 From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com> Date: Mon, 24 Nov 2025 13:05:30 -0500 Subject: [PATCH 1/4] cargo-auditable: Refactor to be use a fixed-point builder --- .../compilers/rust/cargo-auditable.nix | 125 ++++++++++-------- 1 file changed, 67 insertions(+), 58 deletions(-) diff --git a/pkgs/development/compilers/rust/cargo-auditable.nix b/pkgs/development/compilers/rust/cargo-auditable.nix index 2abda28c4d11..e1cf713e819a 100644 --- a/pkgs/development/compilers/rust/cargo-auditable.nix +++ b/pkgs/development/compilers/rust/cargo-auditable.nix @@ -8,41 +8,6 @@ }: let - args = rec { - pname = "cargo-auditable"; - version = "0.6.5"; - - src = fetchFromGitHub { - owner = "rust-secure-code"; - repo = "cargo-auditable"; - rev = "v${version}"; - sha256 = "sha256-zjv2/qZM0vRyz45DeKRtPHaamv2iLtjpSedVTEXeDr8="; - }; - - cargoDeps = rustPlatform.fetchCargoVendor { - inherit pname version src; - hash = "sha256-oTPGmoGlNfPVZ6qha/oXyPJp94fT2cNlVggbIGHf2bc="; - }; - - checkFlags = [ - # requires wasm32-unknown-unknown target - "--skip=test_wasm" - ]; - - meta = { - description = "Tool to make production Rust binaries auditable"; - mainProgram = "cargo-auditable"; - homepage = "https://github.com/rust-secure-code/cargo-auditable"; - changelog = "https://github.com/rust-secure-code/cargo-auditable/blob/v${version}/cargo-auditable/CHANGELOG.md"; - license = with lib.licenses; [ - mit # or - asl20 - ]; - maintainers = with lib.maintainers; [ RossSmyth ]; - broken = stdenv.hostPlatform != stdenv.buildPlatform; - }; - }; - rustPlatform = makeRustPlatform { inherit (buildPackages) rustc; cargo = buildPackages.cargo.override { @@ -50,27 +15,71 @@ let }; }; - bootstrap = rustPlatform.buildRustPackage ( - args - // { - auditable = false; - } - ); + auditableBuilder = lib.extendMkDerivation { + constructDrv = rustPlatform.buildRustPackage.override { cargo-auditable = bootstrap; }; + + extendDrvArgs = + finalAttrs: + { + pname ? "cargo-auditable", + auditable ? true, + ... + }: + { + inherit auditable pname; + version = "0.6.5"; + + src = fetchFromGitHub { + owner = "rust-secure-code"; + repo = "cargo-auditable"; + tag = "v${finalAttrs.version}"; + hash = "sha256-zjv2/qZM0vRyz45DeKRtPHaamv2iLtjpSedVTEXeDr8="; + }; + + cargoHash = "sha256-oTPGmoGlNfPVZ6qha/oXyPJp94fT2cNlVggbIGHf2bc="; + + nativeBuildInputs = [ + installShellFiles + ]; + + checkFlags = [ + # requires wasm32-unknown-unknown target + "--skip=test_wasm" + ] + ++ lib.optionals (!auditable) [ + "--skip=test_proc_macro" + "--skip=test_self_hosting" + ]; + + postInstall = '' + installManPage cargo-auditable/cargo-auditable.1 + ''; + + passthru = { + inherit bootstrap; + }; + + meta = { + description = "Tool to make production Rust binaries auditable"; + mainProgram = "cargo-auditable"; + homepage = "https://github.com/rust-secure-code/cargo-auditable"; + changelog = "https://github.com/rust-secure-code/cargo-auditable/blob/v${finalAttrs.version}/cargo-auditable/CHANGELOG.md"; + license = with lib.licenses; [ + mit # or + asl20 + ]; + maintainers = with lib.maintainers; [ RossSmyth ]; + broken = stdenv.hostPlatform != stdenv.buildPlatform; + }; + }; + }; + + # cargo-auditable cannot be built with cargo-auditable until cargo-auditable is built + bootstrap = auditableBuilder { + pname = "cargo-auditable-bootstrap"; + auditable = false; + }; in - -rustPlatform.buildRustPackage.override { cargo-auditable = bootstrap; } ( - args - // { - nativeBuildInputs = [ - installShellFiles - ]; - - postInstall = '' - installManPage cargo-auditable/cargo-auditable.1 - ''; - - passthru = { - inherit bootstrap; - }; - } -) +auditableBuilder { + auditable = true; +} From ed2d4c551b46d4b836369400690cb92f2e9a2350 Mon Sep 17 00:00:00 2001 From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com> Date: Mon, 24 Nov 2025 13:29:53 -0500 Subject: [PATCH 2/4] cargo-auditable: Move to by-name --- .../ca/cargo-auditable/package.nix} | 4 ++-- pkgs/development/compilers/rust/1_91.nix | 9 ++++++++- pkgs/development/compilers/rust/default.nix | 3 ++- pkgs/top-level/all-packages.nix | 1 - 4 files changed, 12 insertions(+), 5 deletions(-) rename pkgs/{development/compilers/rust/cargo-auditable.nix => by-name/ca/cargo-auditable/package.nix} (93%) diff --git a/pkgs/development/compilers/rust/cargo-auditable.nix b/pkgs/by-name/ca/cargo-auditable/package.nix similarity index 93% rename from pkgs/development/compilers/rust/cargo-auditable.nix rename to pkgs/by-name/ca/cargo-auditable/package.nix index e1cf713e819a..cd1ca12f3a9b 100644 --- a/pkgs/development/compilers/rust/cargo-auditable.nix +++ b/pkgs/by-name/ca/cargo-auditable/package.nix @@ -45,8 +45,8 @@ let checkFlags = [ # requires wasm32-unknown-unknown target "--skip=test_wasm" - ] - ++ lib.optionals (!auditable) [ + # Seems to be a bug in tests of locked vs. semver compatible packages + # https://github.com/rust-secure-code/cargo-auditable/issues/235 "--skip=test_proc_macro" "--skip=test_self_hosting" ]; diff --git a/pkgs/development/compilers/rust/1_91.nix b/pkgs/development/compilers/rust/1_91.nix index a5fee800afa4..c9d31d1899d4 100644 --- a/pkgs/development/compilers/rust/1_91.nix +++ b/pkgs/development/compilers/rust/1_91.nix @@ -8,6 +8,11 @@ # Check the version number in the src/llvm-project git submodule in: # https://github.com/rust-lang/rust/blob//.gitmodules +# Note: The way this is structured is: +# 1. Import default.nix, and apply arguments as needed for the file-defined function +# 2. Implicitly, all arguments to this file are applied to the function that is imported. +# if you want to add an argument to default.nix's top-level function, but not the function +# it instantiates, add it to the `removeAttrs` call below. { stdenv, lib, @@ -22,6 +27,7 @@ wrapRustcWith, llvmPackages, llvm, + cargo-auditable, wrapCCWith, overrideCC, fetchpatch, @@ -51,7 +57,7 @@ import ./default.nix llvmSharedForHost = llvmSharedFor pkgsBuildHost; llvmSharedForTarget = llvmSharedFor pkgsBuildTarget; - inherit llvmPackages; + inherit llvmPackages cargo-auditable; # For use at runtime llvmShared = llvmSharedFor pkgsHostTarget; @@ -93,5 +99,6 @@ import ./default.nix "overrideCC" "pkgsHostTarget" "fetchpatch" + "cargo-auditable" ] ) diff --git a/pkgs/development/compilers/rust/default.nix b/pkgs/development/compilers/rust/default.nix index 460c99ef5e17..5324a9f84020 100644 --- a/pkgs/development/compilers/rust/default.nix +++ b/pkgs/development/compilers/rust/default.nix @@ -11,6 +11,7 @@ llvmSharedForHost, llvmSharedForTarget, llvmPackages, # Exposed through rustc for LTO in Firefox + cargo-auditable, }: { stdenv, @@ -125,7 +126,7 @@ in } else self.callPackage ./cargo_cross.nix { }; - cargo-auditable = self.callPackage ./cargo-auditable.nix { }; + inherit cargo-auditable; cargo-auditable-cargo-wrapper = self.callPackage ./cargo-auditable-cargo-wrapper.nix { }; clippy-unwrapped = self.callPackage ./clippy.nix { }; clippy = if !fastCross then self.clippy-unwrapped else self.callPackage ./clippy-wrapper.nix { }; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index e58ef7dbc20f..7dbb20fc9c09 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -5205,7 +5205,6 @@ with pkgs; inherit (rustPackages) cargo - cargo-auditable cargo-auditable-cargo-wrapper clippy rustc From 78cab60536fc803cd2aecf6df1d54dfb99af3e76 Mon Sep 17 00:00:00 2001 From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com> Date: Mon, 24 Nov 2025 13:37:52 -0500 Subject: [PATCH 3/4] cargo-auditable: Move builder to seperate file --- pkgs/by-name/ca/cargo-auditable/builder.nix | 63 ++++++++++++++++++ pkgs/by-name/ca/cargo-auditable/package.nix | 74 ++++----------------- 2 files changed, 75 insertions(+), 62 deletions(-) create mode 100644 pkgs/by-name/ca/cargo-auditable/builder.nix diff --git a/pkgs/by-name/ca/cargo-auditable/builder.nix b/pkgs/by-name/ca/cargo-auditable/builder.nix new file mode 100644 index 000000000000..348ff29ef61a --- /dev/null +++ b/pkgs/by-name/ca/cargo-auditable/builder.nix @@ -0,0 +1,63 @@ +{ + lib, + stdenv, + rustPlatform, + fetchFromGitHub, + installShellFiles, + auditable-bootstrap, +}: +lib.extendMkDerivation { + constructDrv = rustPlatform.buildRustPackage.override { cargo-auditable = auditable-bootstrap; }; + + extendDrvArgs = + finalAttrs: + { + pname ? "cargo-auditable", + auditable ? true, + hash ? "", + cargoHash ? "", + ... + }: + { + inherit auditable pname; + + src = fetchFromGitHub { + owner = "rust-secure-code"; + repo = "cargo-auditable"; + tag = "v${finalAttrs.version}"; + inherit hash; + }; + + nativeBuildInputs = [ + installShellFiles + ]; + + checkFlags = [ + # requires wasm32-unknown-unknown target + "--skip=test_wasm" + # Seems to be a bug in tests of locked vs. semver compatible packages + # https://github.com/rust-secure-code/cargo-auditable/issues/235 + "--skip=test_proc_macro" + "--skip=test_self_hosting" + ]; + + postInstall = '' + installManPage cargo-auditable/cargo-auditable.1 + ''; + + passthru.bootstrap = auditable-bootstrap; + + meta = { + description = "Tool to make production Rust binaries auditable"; + mainProgram = "cargo-auditable"; + homepage = "https://github.com/rust-secure-code/cargo-auditable"; + changelog = "https://github.com/rust-secure-code/cargo-auditable/blob/v${finalAttrs.version}/cargo-auditable/CHANGELOG.md"; + license = with lib.licenses; [ + mit # or + asl20 + ]; + maintainers = with lib.maintainers; [ RossSmyth ]; + broken = stdenv.hostPlatform != stdenv.buildPlatform; + }; + }; +} diff --git a/pkgs/by-name/ca/cargo-auditable/package.nix b/pkgs/by-name/ca/cargo-auditable/package.nix index cd1ca12f3a9b..7e8e4e0810d4 100644 --- a/pkgs/by-name/ca/cargo-auditable/package.nix +++ b/pkgs/by-name/ca/cargo-auditable/package.nix @@ -1,13 +1,11 @@ { - lib, buildPackages, - fetchFromGitHub, + callPackage, makeRustPlatform, - installShellFiles, - stdenv, }: - let + # Need to use the build platform rustc and Cargo so that + # we don't infrec rustPlatform = makeRustPlatform { inherit (buildPackages) rustc; cargo = buildPackages.cargo.override { @@ -15,71 +13,23 @@ let }; }; - auditableBuilder = lib.extendMkDerivation { - constructDrv = rustPlatform.buildRustPackage.override { cargo-auditable = bootstrap; }; - - extendDrvArgs = - finalAttrs: - { - pname ? "cargo-auditable", - auditable ? true, - ... - }: - { - inherit auditable pname; - version = "0.6.5"; - - src = fetchFromGitHub { - owner = "rust-secure-code"; - repo = "cargo-auditable"; - tag = "v${finalAttrs.version}"; - hash = "sha256-zjv2/qZM0vRyz45DeKRtPHaamv2iLtjpSedVTEXeDr8="; - }; - - cargoHash = "sha256-oTPGmoGlNfPVZ6qha/oXyPJp94fT2cNlVggbIGHf2bc="; - - nativeBuildInputs = [ - installShellFiles - ]; - - checkFlags = [ - # requires wasm32-unknown-unknown target - "--skip=test_wasm" - # Seems to be a bug in tests of locked vs. semver compatible packages - # https://github.com/rust-secure-code/cargo-auditable/issues/235 - "--skip=test_proc_macro" - "--skip=test_self_hosting" - ]; - - postInstall = '' - installManPage cargo-auditable/cargo-auditable.1 - ''; - - passthru = { - inherit bootstrap; - }; - - meta = { - description = "Tool to make production Rust binaries auditable"; - mainProgram = "cargo-auditable"; - homepage = "https://github.com/rust-secure-code/cargo-auditable"; - changelog = "https://github.com/rust-secure-code/cargo-auditable/blob/v${finalAttrs.version}/cargo-auditable/CHANGELOG.md"; - license = with lib.licenses; [ - mit # or - asl20 - ]; - maintainers = with lib.maintainers; [ RossSmyth ]; - broken = stdenv.hostPlatform != stdenv.buildPlatform; - }; - }; + auditableBuilder = callPackage ./builder.nix { + inherit rustPlatform; + auditable-bootstrap = bootstrap; }; + hash = "sha256-zjv2/qZM0vRyz45DeKRtPHaamv2iLtjpSedVTEXeDr8="; + cargoHash = "sha256-oTPGmoGlNfPVZ6qha/oXyPJp94fT2cNlVggbIGHf2bc="; + version = "0.6.5"; + # cargo-auditable cannot be built with cargo-auditable until cargo-auditable is built bootstrap = auditableBuilder { + inherit version hash cargoHash; pname = "cargo-auditable-bootstrap"; auditable = false; }; in auditableBuilder { + inherit version hash cargoHash; auditable = true; } From 41a36d34dc0ea772d197dcbff0f877f5c8bac384 Mon Sep 17 00:00:00 2001 From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com> Date: Mon, 24 Nov 2025 13:43:55 -0500 Subject: [PATCH 4/4] cargo-auditable: 0.6.5 -> 0.7.2 --- pkgs/by-name/ca/cargo-auditable/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ca/cargo-auditable/package.nix b/pkgs/by-name/ca/cargo-auditable/package.nix index 7e8e4e0810d4..b74e0abbd515 100644 --- a/pkgs/by-name/ca/cargo-auditable/package.nix +++ b/pkgs/by-name/ca/cargo-auditable/package.nix @@ -18,9 +18,9 @@ let auditable-bootstrap = bootstrap; }; - hash = "sha256-zjv2/qZM0vRyz45DeKRtPHaamv2iLtjpSedVTEXeDr8="; - cargoHash = "sha256-oTPGmoGlNfPVZ6qha/oXyPJp94fT2cNlVggbIGHf2bc="; - version = "0.6.5"; + version = "0.7.2"; + hash = "sha256-hR6PjTOps8JSM7UbfGlCoZmmwtWExVqYwh4lxDiFWdc="; + cargoHash = "sha256-JEfnUJ9J6Xak3AOCwQCnu+v+3Wl3QbXX20qVFWB6040="; # cargo-auditable cannot be built with cargo-auditable until cargo-auditable is built bootstrap = auditableBuilder {