{linyaps-box, linyaps}: init (#442883)

nixos/modules/module-list.nix

@@ -568,6 +568,7 @@
   ./services/desktops/gnome/sushi.nix
   ./services/desktops/gnome/tinysparql.nix
   ./services/desktops/gvfs.nix
+  ./services/desktops/linyaps.nix
   ./services/desktops/malcontent.nix
   ./services/desktops/neard.nix
   ./services/desktops/pipewire/pipewire.nix

nixos/modules/services/desktops/linyaps.nix

@@ -0,0 +1,60 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.linyaps;
+in
+
+{
+  meta = {
+    maintainers = pkgs.linyaps.meta.maintainers;
+  };
+
+  ###### interface
+  options = {
+    services.linyaps = {
+      enable = lib.mkEnableOption "linyaps, a cross-distribution package manager with sandboxed apps and shared runtime";
+
+      package = lib.mkPackageOption pkgs "linyaps" { };
+
+      boxPackage = lib.mkPackageOption pkgs "linyaps-box" { };
+    };
+  };
+
+  ###### implementation
+  config = lib.mkIf cfg.enable {
+
+    environment = {
+      profiles = [ "/var/lib/linglong/entries" ];
+      systemPackages = [
+        cfg.package
+        cfg.boxPackage
+      ];
+    };
+
+    security.polkit.enable = true;
+
+    fonts.fontDir.enable = true;
+
+    services.dbus.packages = [ cfg.package ];
+
+    systemd = {
+      packages = [ cfg.package ];
+      tmpfiles.packages = [ cfg.package ];
+    };
+
+    # Create system user and group for linyaps/linglong
+    users = {
+      groups.deepin-linglong = { };
+      users.deepin-linglong = {
+        group = "deepin-linglong";
+        isSystemUser = true;
+        description = "Linyaps/Linglong system helper";
+      };
+    };
+  };
+}

pkgs/by-name/li/linyaps-box/package.nix

@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  cli11,
+  gtest,
+  libcap,
+  libseccomp,
+  nlohmann_json,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "linyaps-box";
+  version = "2.1.0";
+
+  src = fetchFromGitHub {
+    owner = "OpenAtom-Linyaps";
+    repo = "linyaps-box";
+    rev = finalAttrs.version;
+    hash = "sha256-Pdhb7dwAabDfhxmEifZblxEi9F4OUIDPx1X07f2AwPE=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    cli11
+    gtest
+    libcap
+    libseccomp
+    nlohmann_json
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "linyaps-box_ENABLE_SECCOMP" true)
+  ];
+
+  meta = {
+    description = "Simple OCI runtime mainly used by linyaps";
+    homepage = "https://github.com/OpenAtom-Linyaps/linyaps-box";
+    license = lib.licenses.lgpl3Plus;
+    platforms = lib.platforms.linux;
+    mainProgram = "ll-box";
+    maintainers = with lib.maintainers; [ wineee ];
+  };
+})

pkgs/by-name/li/linyaps/fix-host-path.patch

@@ -0,0 +1,91 @@
+diff --git a/libs/oci-cfg-generators/src/linglong/oci-cfg-generators/container_cfg_builder.cpp b/libs/oci-cfg-generators/src/linglong/oci-cfg-generators/container_cfg_builder.cpp
+index 787e70cb..a71df46a 100644
+--- a/libs/oci-cfg-generators/src/linglong/oci-cfg-generators/container_cfg_builder.cpp
++++ b/libs/oci-cfg-generators/src/linglong/oci-cfg-generators/container_cfg_builder.cpp
+@@ -19,6 +19,8 @@
+ #include <iomanip>
+ #include <iostream>
+ #include <vector>
++#include <unordered_map>
++#include <unordered_set>
+ 
+ #include <sys/stat.h>
+ #include <sys/types.h>
+@@ -432,19 +434,67 @@ ContainerCfgBuilder &ContainerCfgBuilder::bindHostRoot() noexcept
+ 
+ ContainerCfgBuilder &ContainerCfgBuilder::bindHostStatics() noexcept
+ {
+-    std::vector<std::filesystem::path> statics{
+-        "/etc/machine-id",
+-        // FIXME: support for host /etc/ssl, ref https://github.com/p11-glue/p11-kit
+-        "/usr/lib/locale",
+-        "/usr/share/fonts",
+-        "/usr/share/icons",
+-        "/usr/share/themes",
+-        "/var/cache/fontconfig",
++    std::unordered_map<std::filesystem::path, std::string> statics{
++        { "/etc/machine-id", "" },
++        { "/usr/lib/locale", "" },
++        { "/var/cache/fontconfig", "" },
++
++        { "/run/current-system/sw/share/X11/fonts", "/usr/share/fonts" },
++        { "/run/current-system/sw/share/icons", "/usr/share/icons" },
++        { "/run/current-system/sw/share/themes", "/usr/share/themes" },
+     };
+ 
+     hostStaticsMount = std::vector<Mount>{};
+-    for (const auto &loc : statics) {
+-        bindIfExist(*hostStaticsMount, loc);
++    auto nixStorePaths = std::unordered_set<std::string>{};
++    for (const auto &[source, destination] : statics) {
++        if (!std::filesystem::exists(source)) {
++            std::cerr << "[bindHostStatics] Skipping non-existent path: " << source << std::endl;
++            continue;
++        }
++
++        bindIfExist(*hostStaticsMount, source, destination);
++
++        std::string sourcePathPrefix = "/run/current-system/sw/share/";
++        std::string nixStorePrefix = "/nix/store/";
++
++        if (source.string().rfind(sourcePathPrefix, 0) != 0)
++            continue;
++
++        std::error_code ec;
++        for (const std::filesystem::directory_entry &dir_entry :
++             std::filesystem::recursive_directory_iterator(source, std::filesystem::directory_options::skip_permission_denied, ec)) 
++        {
++            if (ec) {
++                std::cerr << "[bindHostStatics] Failed to iterate directory: " << source << ", error: " << ec.message() << std::endl;
++                break;
++            }
++
++            if (!dir_entry.is_symlink(ec) || ec) {
++                if (ec)
++                    std::cerr << "[bindHostStatics] Failed to check symlink: " << dir_entry.path() << ", error: " << ec.message() << std::endl;
++                continue;
++            }
++
++            std::filesystem::path targetPath = std::filesystem::canonical(dir_entry.path(), ec);
++            if (ec) {
++                std::cerr << "[bindHostStatics] Failed to resolve symlink: " << dir_entry.path() << ", error: " << ec.message() << std::endl;
++                continue;
++            }
++
++            std::string target = targetPath.string();
++            if (target.rfind(nixStorePrefix, 0) != 0)
++                continue;
++
++            auto endPos = target.find('/', nixStorePrefix.length());
++            if (endPos != std::string::npos)
++                nixStorePaths.insert(target.substr(0, endPos));
++            else
++                nixStorePaths.insert(target);
++        }
++    }
++
++    for (const std::string &path : nixStorePaths) {
++        bindIfExist(*hostStaticsMount, path);
+     }
+ 
+     return *this;

pkgs/by-name/li/linyaps/package.nix

@@ -0,0 +1,144 @@
+{
+  fetchFromGitHub,
+  fetchpatch,
+  lib,
+  stdenv,
+  cmake,
+  copyDesktopItems,
+  pkg-config,
+  qt6Packages,
+  linyaps-box,
+  cli11,
+  curl,
+  gpgme,
+  gtest,
+  libarchive,
+  libelf,
+  libsodium,
+  libsysprof-capture,
+  nlohmann_json,
+  openssl,
+  ostree,
+  systemdLibs,
+  tl-expected,
+  uncrustify,
+  xz,
+  yaml-cpp,
+  replaceVars,
+  bash,
+  binutils,
+  coreutils,
+  desktop-file-utils,
+  erofs-utils,
+  fuse3,
+  fuse-overlayfs,
+  gnutar,
+  glib,
+  shared-mime-info,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "linyaps";
+  version = "1.9.12";
+
+  src = fetchFromGitHub {
+    owner = "OpenAtom-Linyaps";
+    repo = finalAttrs.pname;
+    tag = finalAttrs.version;
+    hash = "sha256-BNP/CenPXMuEixEleil9zB08qLn/SZ9Ur/Im4MQy5nE=";
+  };
+
+  patches = [
+    ./fix-host-path.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace apps/ll-init/CMakeLists.txt \
+      --replace-fail "target_link_options(\''${LL_INIT_TARGET} PRIVATE -static -static-libgcc" \
+                     "target_link_options(\''${LL_INIT_TARGET} PRIVATE -static -static-libgcc -L${stdenv.cc.libc.static}/lib"
+
+    substituteInPlace misc/share/applications/linyaps.desktop \
+      --replace-fail "/usr/bin/ll-cli" "$out/bin/ll-cli"
+
+    # Don't use hardcoded paths in the application's desktop file, as it would become invalid when the old linyaps gets removed.
+    substituteInPlace libs/linglong/src/linglong/repo/ostree_repo.cpp \
+      --replace-fail 'LINGLONG_CLIENT_PATH' 'LINGLONG_CLIENT_NAME'
+  '';
+
+  buildInputs = [
+    cli11
+    curl
+    gpgme
+    gtest
+    libarchive
+    libelf
+    libsodium
+    libsysprof-capture
+    nlohmann_json
+    openssl
+    ostree
+    qt6Packages.qtbase
+    systemdLibs
+    tl-expected
+    uncrustify
+    xz
+    yaml-cpp
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    copyDesktopItems
+    pkg-config
+    qt6Packages.wrapQtAppsNoGuiHook
+  ];
+
+  postInstall = ''
+    # move to the right location for systemd.packages option
+    # https://github.com/NixOS/nixpkgs/blob/85dbfc7aaf52ecb755f87e577ddbe6dbbdbc1054/nixos/modules/system/boot/systemd.nix#L605
+    mv $out/lib/systemd/system-environment-generators $out/lib/systemd/system-generators
+  '';
+
+  # Disable automatic Qt wrapping to handle it manually
+  dontWrapQtApps = true;
+
+  # Add runtime dependencies to PATH for all wrapped binaries
+  qtWrapperArgs = [
+    "--prefix PATH : ${
+      lib.makeBinPath [
+        bash
+        binutils
+        coreutils
+        desktop-file-utils
+        erofs-utils
+        fuse3
+        fuse-overlayfs
+        glib
+        gnutar
+        shared-mime-info
+        linyaps-box
+      ]
+    }"
+  ];
+
+  # Note: ll-init must be statically linked and should not be wrapped
+  postFixup = ''
+    # Wrap all executables except ll-init
+    find "$out" -type f -executable \
+      \( -path "$out/bin/*" -o -path "$out/libexec/*" \) \
+      ! -name "ll-init" \
+      -print0 | while IFS= read -r -d "" f; do
+      wrapQtApp "$f"
+    done
+  '';
+
+  meta = {
+    description = "Cross-distribution package manager with sandboxed apps and shared runtime";
+    homepage = "https://linyaps.org.cn";
+    downloadPage = "https://github.com/OpenAtom-Linyaps/linyaps";
+    changelog = "https://github.com/OpenAtom-Linyaps/linyaps/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.lgpl3Plus;
+    platforms = lib.platforms.linux;
+    mainProgram = "ll-cli";
+    maintainers = with lib.maintainers; [ wineee ];
+  };
+})