Skip to main content
  • Home
  • Development
  • Documentation
  • Donate
  • Operational login
  • Browse the archive

swh logo
SoftwareHeritage
Software
Heritage
Archive
Features
  • Search

  • Downloads

  • Save code now

  • Add forge now

  • Help

Revision df716c98d203ab64cdf05f9c17fdae565b7daa1c authored by Eelco Dolstra on 23 June 2012, 04:28:35 UTC, committed by Eelco Dolstra on 23 June 2012, 04:28:35 UTC
In chroot builds, use a private network namespace
On Linux it's possible to run a process in its own network namespace,
meaning that it gets its own set of network interfaces, disjunct from
the rest of the system.  We use this to completely remove network
access to chroot builds, except that they get a private loopback
interface.  This means that:

- Builders cannot connect to the outside network or to other processes
  on the same machine, except processes within the same build.

- Vice versa, other processes cannot connect to processes in a chroot
  build, and open ports/connections do not show up in "netstat".

- If two concurrent builders try to listen on the same port (e.g. as
  part of a test), they no longer conflict with each other.

This was inspired by the "PrivateNetwork" flag in systemd.
1 parent 2f3f413
  • Files
  • Changes
  • 517c173
  • /
  • nix.spec.in
Raw File Download

To reference or cite the objects present in the Software Heritage archive, permalinks based on SoftWare Hash IDentifiers (SWHIDs) must be used.
Select below a type of object currently browsed in order to display its associated SWHID and permalink.

  • revision
  • directory
  • content
revision badge
swh:1:rev:df716c98d203ab64cdf05f9c17fdae565b7daa1c
directory badge
swh:1:dir:517c173c82cb5e65df3fd3ff4044ca0fadd04097
content badge
swh:1:cnt:44ea8d7c9476f8a0af31804ba6b8d26970734a45

This interface enables to generate software citations, provided that the root directory of browsed objects contains a citation.cff or codemeta.json file.
Select below a type of object currently browsed in order to generate citations for them.

  • revision
  • directory
  • content
Generate software citation in BibTex format (requires biblatex-software package)
Generating citation ...
Generate software citation in BibTex format (requires biblatex-software package)
Generating citation ...
Generate software citation in BibTex format (requires biblatex-software package)
Generating citation ...
nix.spec.in
%global nixbld_user "nix-builder-"
%global nixbld_group "nix-builders"

Summary: The Nix software deployment system
Name: nix
Version: @version@
Release: 2%{?dist}
License: LGPLv2+
%if 0%{?rhel}
Group: Applications/System
%endif
URL: http://nixos.org/
Source0: %{name}-%{version}.tar.bz2
%if 0%{?el5}
BuildRoot: %(mktemp -ud %{_tmppath}/%{name}-%{version}-%{release}-XXXXXX)
%endif
BuildRequires: perl(DBD::SQLite)
BuildRequires: perl(DBI)
BuildRequires: perl(ExtUtils::ParseXS)
Requires: /usr/bin/perl
Requires: curl
Requires: perl-DBD-SQLite
Requires: bzip2
BuildRequires: bzip2-devel
BuildRequires: sqlite-devel

# Hack to make that shitty RPM scanning hack shut up.
Provides: perl(Nix::SSH)
                                                               
%description
Nix is a purely functional package manager. It allows multiple
versions of a package to be installed side-by-side, ensures that
dependency specifications are complete, supports atomic upgrades and
rollbacks, allows non-root users to install software, and has many
other features. It is the basis of the NixOS Linux distribution, but
it can be used equally well under other Unix systems.

%package        devel
Summary:        Development files for %{name}
%if 0%{?rhel}
Group:          Development/Libraries
%endif
Requires:       %{name}%{?_isa} = %{version}-%{release}

%description   devel
The %{name}-devel package contains libraries and header files for
developing applications that use %{name}.


%package doc
Summary:        Documentation files for %{name}
%if 0%{?rhel}
Group:          Documentation
%endif
BuildArch:      noarch
Requires:       %{name} = %{version}-%{release}

%description   doc
The %{name}-doc package contains documentation files for %{name}.


%package -n emacs-%{name}
Summary:        Nix mode for Emacs
%if 0%{?rhel}
Group:          Applications/Editors
%endif
BuildArch:      noarch
BuildRequires:  emacs
Requires:       emacs(bin) >= %{_emacs_version}

%description -n emacs-%{name}
This package provides a major mode for editing Nix expressions.

%package -n emacs-%{name}-el
Summary:        Elisp source files for emacs-%{name}
%if 0%{?rhel}
Group:          Applications/Editors
%endif
BuildArch:      noarch
Requires:       emacs-%{name} = %{version}-%{release}

%description -n emacs-%{name}-el
This package contains the elisp source file for the Nix major mode for
GNU Emacs. You do not need to install this package to run Nix. Install
the emacs-%{name} package to edit Nix expressions with GNU Emacs.


%prep
%setup -q
# Install Perl modules to vendor_perl
# configure.ac need to be changed to make this global; however, this will
# also affect NixOS. Use discretion.
%{__sed} -i 's|perl5/site_perl/$perlversion/$perlarchname|perl5/vendor_perl|' \
  configure


%build
extraFlags=
# - override docdir so large documentation files are owned by the
#   -doc subpackage
# - set localstatedir by hand to the preferred nix value
%configure --localstatedir=/nix/var \
           --docdir=%{_defaultdocdir}/%{name}-doc-%{version} \
           $extraFlags
make %{?_smp_flags}
%{_emacs_bytecompile} misc/emacs/nix-mode.el


%install
%if 0%{?el5}
rm -rf $RPM_BUILD_ROOT
%endif
make DESTDIR=$RPM_BUILD_ROOT install

find $RPM_BUILD_ROOT -name '*.la' -exec rm -f {} ';'

# Fix symlink: we want to link to the versioned soname, not to the
# unversioned one that'd be put in -devel
pushd $RPM_BUILD_ROOT%{perl_vendorarch}/auto/Nix/Store
ln -sf %{_libdir}/nix/libNixStore.so.0 Store.so
popd

# Specify build users group
sed -i "s|#build-users-group =$|build-users-group = %{nixbld_group}|" \
  $RPM_BUILD_ROOT%{_sysconfdir}/nix/nix.conf
# ... and delete the example configuration
rm $RPM_BUILD_ROOT%{_sysconfdir}/nix/nix.conf.example

# make per-user directories
for d in profiles gcroots;
do
  mkdir $RPM_BUILD_ROOT/nix/var/nix/$d/per-user
  chmod 1777 $RPM_BUILD_ROOT/nix/var/nix/$d/per-user
done

# fix permission of nix profile
# (until this is fixed in the relevant Makefile)
chmod -x $RPM_BUILD_ROOT%{_sysconfdir}/profile.d/nix.sh

# systemd not available on RHEL yet
%if ! 0%{?rhel} 
# install systemd service descriptor
mkdir -p $RPM_BUILD_ROOT%{_prefix}/lib/systemd/system
cp -p misc/systemd/nix-worker.service \
  $RPM_BUILD_ROOT%{_prefix}/lib/systemd/system/
%endif

# Copy the byte-compiled mode file by hand
cp -p misc/emacs/nix-mode.elc $RPM_BUILD_ROOT%{_emacs_sitelispdir}/

# we ship this file in the base package
rm $RPM_BUILD_ROOT%{_defaultdocdir}/%{name}-doc-%{version}/README


%check
make check


%clean
rm -rf $RPM_BUILD_ROOT


%pre
getent group %{nixbld_group} >/dev/null || groupadd -r %{nixbld_group}
for i in $(seq 10);
do
  getent passwd %{nixbld_user}$i >/dev/null || \
    useradd -r -g %{nixbld_group} -G %{nixbld_group} -d /var/empty \
      -s %{_sbindir}/nologin \
      -c "Nix build user $i" %{nixbld_user}$i
done

%post
chgrp %{nixbld_group} /nix/store
chmod 1775 /nix/store
%if ! 0%{?rhel}
# Enable and start Nix worker
systemctl enable nix-worker.service
systemctl start  nix-worker.service
%endif

%files
%doc COPYING AUTHORS README
%{_bindir}/nix-*
%dir %{_libdir}/nix
%{_libdir}/nix/*.so.*
%{perl_vendorarch}/*
%exclude %dir %{perl_vendorarch}/auto/
%{_prefix}/libexec/*
%if ! 0%{?rhel}
%{_prefix}/lib/systemd/system/nix-worker.service
%endif
%{_datadir}/emacs/site-lisp/nix-mode.el
%{_datadir}/nix
%{_mandir}/man1/nix-*.1*
%{_mandir}/man8/nix-*.8*
%config(noreplace) %{_sysconfdir}/profile.d/nix.sh
/nix
%dir %{_sysconfdir}/nix
%config(noreplace) %{_sysconfdir}/nix/nix.conf

%files devel
%{_includedir}/nix
%{_libdir}/nix/*.so

%files doc
%docdir %{_defaultdocdir}/%{name}-doc-%{version}
%{_defaultdocdir}/%{name}-doc-%{version}

%files -n emacs-%{name}
%{_emacs_sitelispdir}/*.elc
#{_emacs_sitestartdir}/*.el

%files -n emacs-%{name}-el
%{_emacs_sitelispdir}/*.el
The diff you're trying to view is too large. Only the first 1000 changed files have been loaded.
Showing with 0 additions and 0 deletions (0 / 0 diffs computed)
swh spinner

Computing file changes ...

back to top

Software Heritage — Copyright (C) 2015–2026, The Software Heritage developers. License: GNU AGPLv3+.
The source code of Software Heritage itself is available on our development forge.
The source code files archived by Software Heritage are available under their own copyright and licenses.
Terms of use: Archive access, API— Content policy— Contact— JavaScript license information— Web API