From ce141e72be64bfae5f878e2905d49beb6e35cdd1 Mon Sep 17 00:00:00 2001 From: Leona Maroni Date: Tue, 11 Nov 2025 13:05:48 +0100 Subject: [PATCH] knot-resolver{,-manager}_6: init at 6.0.17 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Vladimír Čunát --- .../kn/knot-resolver-manager_6/package.nix | 56 ++++++ .../rewrap-supervisor.patch | 14 ++ pkgs/by-name/kn/knot-resolver_6/package.nix | 188 ++++++++++++++++++ 3 files changed, 258 insertions(+) create mode 100644 pkgs/by-name/kn/knot-resolver-manager_6/package.nix create mode 100644 pkgs/by-name/kn/knot-resolver-manager_6/rewrap-supervisor.patch create mode 100644 pkgs/by-name/kn/knot-resolver_6/package.nix diff --git a/pkgs/by-name/kn/knot-resolver-manager_6/package.nix b/pkgs/by-name/kn/knot-resolver-manager_6/package.nix new file mode 100644 index 000000000000..851dec44dfa1 --- /dev/null +++ b/pkgs/by-name/kn/knot-resolver-manager_6/package.nix @@ -0,0 +1,56 @@ +{ + knot-resolver_6, + writeText, + python3Packages, +}: + +python3Packages.buildPythonPackage { + pname = "knot-resolver-manager_6"; + inherit (knot-resolver_6) version src; + pyproject = true; + + patches = [ + # Rewrap the two supervisor's binaries, so that they obtain access to python modules + # defined in the manager. Those are then used as extensions of supervisord. + # Manager needs this fixed bin/supervisord on its $PATH. + ./rewrap-supervisor.patch + ]; + + # Propagate meson config from the C part to the python part. + # But the install-time etc differs from a sensible run-time etc. + postPatch = '' + substitute '${knot-resolver_6.config_py}'/knot_resolver/constants.py ./python/knot_resolver/constants.py \ + --replace-fail '${knot-resolver_6.out}/etc' '/etc' + ''; + + build-system = with python3Packages; [ + poetry-core + setuptools + ]; + + # Deps can be seen in ${src}/pyproject.toml + propagatedBuildInputs = with python3Packages; [ + aiohttp + jinja2 + pyyaml + prometheus-client + supervisor + typing-extensions + ]; + + doCheck = false; # FIXME + checkInputs = with python3Packages; [ + python3Packages.augeas + dnspython + lief + pytestCheckHook + pytest-asyncio + pyroute2 + pyparsing + toml + ]; + + meta = knot-resolver_6.meta // { + mainProgram = "knot-resolver"; + }; +} diff --git a/pkgs/by-name/kn/knot-resolver-manager_6/rewrap-supervisor.patch b/pkgs/by-name/kn/knot-resolver-manager_6/rewrap-supervisor.patch new file mode 100644 index 000000000000..5569059cefec --- /dev/null +++ b/pkgs/by-name/kn/knot-resolver-manager_6/rewrap-supervisor.patch @@ -0,0 +1,14 @@ +diff --git a/pyproject.toml b/pyproject.toml +index 22d6ca5b0d..15acfb3c6c 100644 +--- a/pyproject.toml ++++ b/pyproject.toml +@@ -71,6 +71,9 @@ + [tool.poetry.scripts] + kresctl = 'knot_resolver.client.main:main' + knot-resolver = 'knot_resolver.manager.main:main' ++supervisord = 'supervisor.supervisord:main' ++supervisorctl = 'supervisor.supervisorctl:main' ++ + + [tool.poe.tasks] + # tasks runed through scripts located in 'scripts/poe-tasks/' diff --git a/pkgs/by-name/kn/knot-resolver_6/package.nix b/pkgs/by-name/kn/knot-resolver_6/package.nix new file mode 100644 index 000000000000..2215d7a597fc --- /dev/null +++ b/pkgs/by-name/kn/knot-resolver_6/package.nix @@ -0,0 +1,188 @@ +{ + lib, + stdenv, + fetchurl, + # native deps. + runCommand, + pkg-config, + meson, + ninja, + makeWrapper, + # build+runtime deps. + knot-dns, + luajitPackages, + libuv, + gnutls, + lmdb, + jemalloc, + systemdMinimal, + libcap_ng, + dns-root-data, + nghttp2, # optionals, in principle + fstrm, + protobufc, # more optionals + # test-only deps. + cmocka, + which, + cacert, + extraFeatures ? false, # catch-all if defaults aren't enough +}: +let + result = if extraFeatures then wrapped-full else unwrapped; + + inherit (lib) optional optionals optionalString; + lua = luajitPackages; + + unwrapped = stdenv.mkDerivation (finalAttrs: { + pname = "knot-resolver_6"; + version = "6.0.17"; + + src = fetchurl { + url = "https://secure.nic.cz/files/knot-resolver/knot-resolver-${finalAttrs.version}.tar.xz"; + hash = "sha256-E9RJbvh66y+9OwBX4iEdRYUgUkHlCaDNQ0Hb5ejLXBw="; + }; + + outputs = [ + "out" + "dev" + "config_py" + ]; + + # Path fixups for the NixOS service. + # systemd Exec* options are difficult to override in NixOS *if present*, so we drop them. + postPatch = '' + patch meson.build < daemon/lua/trust_anchors.test/bootstrap.test.lua + sed -E '/^[[:blank:]]*test_(dstaddr|headers),?$/d' -i \ + tests/config/doh2.test.lua modules/http/http_doh.test.lua + ''; + + preConfigure = '' + patchShebangs scripts/ + ''; + + nativeBuildInputs = [ + pkg-config + meson + ninja + ]; + + # http://knot-resolver.readthedocs.io/en/latest/build.html#requirements + buildInputs = [ + knot-dns + lua.lua + libuv + gnutls + lmdb + ] + ## the rest are optional dependencies + ++ optionals stdenv.hostPlatform.isLinux [ + # lib + systemdMinimal + libcap_ng + ] + ++ [ + jemalloc + nghttp2 + ] + ++ [ + fstrm + protobufc + ] # dnstap support + ; + + mesonFlags = [ + "-Dkeyfile_default=${dns-root-data}/root.ds" + "-Droot_hints=${dns-root-data}/root.hints" + "-Dinstall_kresd_conf=disabled" # not really useful; examples are inside share/doc/ + "-Dmalloc=jemalloc" + "--default-library=static" # not used by anyone + ] + ++ optional finalAttrs.doInstallCheck "-Dunit_tests=enabled" + ++ optional finalAttrs.doInstallCheck "-Dconfig_tests=enabled" + ++ optional stdenv.hostPlatform.isLinux "-Dsystemd_files=enabled" # used by NixOS service + #"-Dextra_tests=enabled" # not suitable as in-distro tests; many deps, too. + ; + + postInstall = '' + cp -r ./python "$config_py" + rm "$out"/lib/libkres.a + '' + + optionalString stdenv.hostPlatform.isLinux '' + rm -r "$out"/lib/sysusers.d/ # ATM more likely to harm than help + ''; + + doInstallCheck = with stdenv; hostPlatform == buildPlatform; + nativeInstallCheckInputs = [ + cmocka + which + cacert + lua.cqueues + lua.basexx + lua.http + ]; + installCheckPhase = '' + meson test --print-errorlogs --no-suite snowflake + ''; + + meta = with lib; { + description = "Caching validating DNS resolver, from .cz domain registry"; + homepage = "https://knot-resolver.cz"; + license = licenses.gpl3Plus; + platforms = platforms.unix; + maintainers = [ + maintainers.vcunat # upstream developer + ]; + mainProgram = "kresd"; + }; + }); + + wrapped-full = + runCommand unwrapped.name + { + nativeBuildInputs = [ makeWrapper ]; + buildInputs = with luajitPackages; [ + # For http module, prefill module, trust anchor bootstrap. + # It brings lots of deps; some are useful elsewhere (e.g. cqueues). + http + # used by policy.slice_randomize_psl() + psl + ]; + preferLocalBuild = true; + allowSubstitutes = false; + inherit (unwrapped) meta; + } + ( + '' + mkdir -p "$out"/bin + makeWrapper '${unwrapped}/bin/kresd' "$out"/bin/kresd \ + --set LUA_PATH "$LUA_PATH" \ + --set LUA_CPATH "$LUA_CPATH" + + ln -sr '${unwrapped}/bin/kres-cache-gc' "$out"/bin/ + ln -sr '${unwrapped}/share' "$out"/ + ln -sr '${unwrapped}/lib' "$out"/ # useful in NixOS service + ln -sr "$out"/{bin,sbin} + '' + + lib.optionalString unwrapped.doInstallCheck '' + echo "Checking that 'http' module loads, i.e. lua search paths work:" + echo "modules.load('http')" > test-http.lua + echo -e 'quit()' | env -i "$out"/bin/kresd -a 127.0.0.1#53535 -c test-http.lua + '' + ); + +in +result