quantenzitrone
9380e05c3c
this shouldn't create any rebuilds
the following script was used to generate this:
```fish
#!/usr/bin/env fish
# nix shell .#nixfmt nixpkgs#{nixf-diagnose,ripgrep,sd}
set base (git rev-parse HEAD)
set scope pkgs/by-name
set builder buildGoModule
set files (rg --files-with-matches -F "$builder rec {" $scope | sort -u)
for file in $files
echo $file
sd -F "$builder rec {" "$builder (finalAttrs: {" $file
# version
sd -F 'version}' 'finalAttrs.version}' $file
sd -F '${version' '${finalAttrs.version' $file
sd -F '= version' '= finalAttrs.version' $file
sd -F 'inherit version;' 'inherit (finalAttrs) version;' $file
sd -F ' + version;' ' + finalAttrs.version;' $file
sd 'replaceStrings (.*) version' 'replaceStrings $1 finalAttrs.version' $file
sd -F 'splitVersion version' 'splitVersion finalAttrs.version' $file
sd -F 'versionAtLeast version' 'versionAtLeast finalAttrs.version' $file
sd 'versions\.([a-z]+) version' 'versions.$1 finalAttrs.version' $file
# src
sd -F 'src}' 'finalAttrs.src}' $file
sd -F '${src' '${finalAttrs.src' $file
sd -F '= src' '= finalAttrs.src' $file
sd -F 'inherit src;' 'inherit (finalAttrs) src;' $file
sd -F 'inherit (src' 'inherit (finalAttrs.src' $file
# meta
sd -F '${meta' '${finalAttrs.meta' $file
sd -F '= meta' '= finalAttrs.meta' $file
sd -F 'inherit (meta' 'inherit (finalAttrs.meta' $file
# other
sd -F 'inherit version src;' 'inherit (finalAttrs) version src;' $file
sd -F 'inherit src version;' 'inherit (finalAttrs) src version;' $file
sd -F 'makeLibraryPath buildInputs' 'makeLibraryPath finalAttrs.buildInputs' $file
sd -F 'buildInputs}' 'finalAttrs.buildInputs}' $file
sd -F 'desktopItem}' 'finalAttrs.desktopItem}' $file
sd -F 'runtimeLibs}' 'finalAttrs.runtimeLibs}' $file
sd -F 'libPath}' 'finalAttrs.libPath}' $file
sd -F 'runtimeDependencies}' 'finalAttrs.runtimeDependencies}' $file
sd -F 'nativeRuntimeInputs}' 'finalAttrs.nativeRuntimeInputs}' $file
sd -F '(!doCheck)' '(!finalAttrs.doCheck)' $file
sd -F 'optional doCheck' 'optional finalAttrs.doCheck' $file
sd -F 'optionals doCheck' 'optionals finalAttrs.doCheck' $file
sd -F '++ runtimeDependencies' '++ finalAttrs.runtimeDependencies' $file
# pname (restored afterwards)
sd -F 'pname}' 'finalAttrs.pname}' $file
sd -F '${pname' '${finalAttrs.pname' $file
sd -F '= pname' '= finalAttrs.pname' $file
# close finalAttrs lambda
echo ')' >>$file
# catch some errors early
if ! nixfmt $file
git restore $file
continue
end
if ! nixf-diagnose -i sema-primop-overridden $file
git restore $file
continue
end
end
set torestore (rg -F .finalAttrs --files-with-matches $scope)
if test (count $torestore) -gt 0
git restore $torestore
end
set torestore (rg -F finalAttrs.pname --files-with-matches $scope)
if test (count $torestore) -gt 0
git restore $torestore
end
# commit for faster eval times
git add pkgs
git commit --no-gpg-sign -m temp
set torestore
for file in $files
# file hasn't changed
if git diff --quiet $base $file
continue
end
# try to eval the package to definitely catch all errors
echo $file
set pname (string split / $file -f 4)
if ! nix eval .#$pname
set torestore $torestore $file
end
end
# restore files that don't eval
git reset --soft $base
git restore --staged .
if test (count $torestore) -gt 0
git restore $torestore
end
```
after that some manual cleanup was done:
- restoring files that cause changes in the number of lines
- restoring files that cause rebuilds
- restoring files that cause merge conflicts with staging
132 lines
2.9 KiB
Nix
132 lines
2.9 KiB
Nix
{
|
|
lib,
|
|
buildGoModule,
|
|
fetchFromGitHub,
|
|
|
|
clang,
|
|
pkg-config,
|
|
|
|
elfutils,
|
|
libbpf,
|
|
zlib,
|
|
zstd,
|
|
|
|
nixosTests,
|
|
testers,
|
|
tracee,
|
|
makeWrapper,
|
|
}:
|
|
|
|
buildGoModule (finalAttrs: {
|
|
pname = "tracee";
|
|
version = "0.23.2";
|
|
|
|
# src = /home/tim/repos/tracee;
|
|
src = fetchFromGitHub {
|
|
owner = "aquasecurity";
|
|
repo = "tracee";
|
|
# project has branches and tags of the same name
|
|
tag = "v${finalAttrs.version}";
|
|
hash = "sha256-Rf1pa9e6t002ltg40xZZVpE5OL9Vl02Xcn2Ux0To408=";
|
|
};
|
|
vendorHash = "sha256-2+4UN9WB6eGzedogy5dMvhHj1x5VeUUkDM0Z28wKQgM=";
|
|
|
|
patches = [
|
|
./0001-fix-do-not-build-libbpf.patch
|
|
];
|
|
|
|
enableParallelBuilding = true;
|
|
# needed to build bpf libs
|
|
hardeningDisable = [
|
|
"stackprotector"
|
|
"zerocallusedregs"
|
|
];
|
|
|
|
nativeBuildInputs = [
|
|
clang
|
|
pkg-config
|
|
];
|
|
buildInputs = [
|
|
elfutils
|
|
libbpf
|
|
zlib.dev
|
|
zstd.dev
|
|
];
|
|
|
|
makeFlags = [
|
|
"RELEASE_VERSION=v${finalAttrs.version}"
|
|
"GO_DEBUG_FLAG=-s -w"
|
|
# don't actually need git but the Makefile checks for it
|
|
"CMD_GIT=echo"
|
|
];
|
|
|
|
buildPhase = ''
|
|
runHook preBuild
|
|
mkdir -p ./dist
|
|
make $makeFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES} bpf all
|
|
runHook postBuild
|
|
'';
|
|
|
|
# tests require a separate go module
|
|
# integration tests are ran within a nixos vm
|
|
# see passthru.tests.integration
|
|
doCheck = false;
|
|
|
|
outputs = [
|
|
"out"
|
|
"lib"
|
|
"share"
|
|
];
|
|
|
|
installPhase = ''
|
|
runHook preInstall
|
|
|
|
mkdir -p $out/bin $lib/lib/tracee $share/share/tracee
|
|
|
|
mv ./dist/{tracee,signatures} $out/bin/
|
|
mv ./dist/tracee.bpf.o $lib/lib/tracee/
|
|
mv ./cmd/tracee-rules/templates $share/share/tracee/
|
|
|
|
runHook postInstall
|
|
'';
|
|
|
|
passthru.tests = {
|
|
integration = nixosTests.tracee;
|
|
integration-test-cli = import ./integration-tests.nix { inherit lib tracee makeWrapper; };
|
|
version = testers.testVersion {
|
|
package = tracee;
|
|
version = "v${finalAttrs.version}";
|
|
command = "tracee version";
|
|
};
|
|
};
|
|
|
|
meta = {
|
|
homepage = "https://aquasecurity.github.io/tracee/latest/";
|
|
changelog = "https://github.com/aquasecurity/tracee/releases/tag/v${finalAttrs.version}";
|
|
description = "Linux Runtime Security and Forensics using eBPF";
|
|
mainProgram = "tracee";
|
|
longDescription = ''
|
|
Tracee is a Runtime Security and forensics tool for Linux. It is using
|
|
Linux eBPF technology to trace your system and applications at runtime,
|
|
and analyze collected events to detect suspicious behavioral patterns. It
|
|
is delivered as a Docker image that monitors the OS and detects suspicious
|
|
behavior based on a pre-defined set of behavioral patterns.
|
|
'';
|
|
license = with lib.licenses; [
|
|
# general license
|
|
asl20
|
|
# pkg/ebpf/c/*
|
|
gpl2Plus
|
|
];
|
|
maintainers = with lib.maintainers; [ jk ];
|
|
platforms = [
|
|
"x86_64-linux"
|
|
"aarch64-linux"
|
|
];
|
|
outputsToInstall = [
|
|
"out"
|
|
"share"
|
|
];
|
|
};
|
|
})
|