Skip to content

Commit 56e88da

Browse files
drupoldrupol
authored
rebuilderd: init at 0.22.1 (#343334)
2 parents 624ad16 + 2c8bdd0 commit 56e88da

File tree

6 files changed

+217
-0
lines changed

6 files changed

+217
-0
lines changed

‎nixos/doc/manual/release-notes/rl-2505.section.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,8 @@
173173

174174
- [Recyclarr](https://github.com/recyclarr/recyclarr) a TRaSH Guides synchronizer for Sonarr and Radarr. Available as [services.recyclarr](#opt-services.recyclarr.enable).
175175

176+
- [Rebuilderd](https://github.com/kpcyrd/rebuilderd) an independent verification of binary packages - Reproducible Builds. Available as [services.rebuilderd](#opt-services.rebuilderd.enable).
177+
176178
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
177179

178180
## Backward Incompatibilities {#sec-release-25.05-incompatibilities}

‎nixos/modules/module-list.nix‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -868,6 +868,7 @@
868868
./services/misc/radicle.nix
869869
./services/misc/readarr.nix
870870
./services/misc/realmd.nix
871+
./services/misc/rebuilderd.nix
871872
./services/misc/recyclarr.nix
872873
./services/misc/redlib.nix
873874
./services/misc/redmine.nix

‎nixos/modules/services/misc/rebuilderd.nix‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
config,
3+
pkgs,
4+
lib,
5+
...
6+
}:
7+
8+
let
9+
inherit (lib) mkEnableOption mkIf mkPackageOption;
10+
cfg = config.services.rebuilderd;
11+
12+
format = pkgs.formats.toml { };
13+
settings = lib.attrsets.filterAttrs (n: v: v != null) cfg.settings;
14+
configFile = format.generate "rebuilderd.conf" settings;
15+
in
16+
{
17+
options.services.rebuilderd = {
18+
enable = mkEnableOption "rebuilderd service for independent verification of binary packages";
19+
package = mkPackageOption pkgs "rebuilderd" { };
20+
settings = lib.mkOption {
21+
type = lib.types.submodule {
22+
freeformType = format.type;
23+
};
24+
default = { };
25+
description = ''
26+
Configuration for rebuilderd (rebuilderd.conf)
27+
'';
28+
};
29+
};
30+
31+
config = mkIf cfg.enable {
32+
systemd.services.rebuilderd = {
33+
description = "Independent verification of binary packages";
34+
wantedBy = [ "multi-user.target" ];
35+
environment = {
36+
REBUILDERD_COOKIE_PATH = "/var/lib/rebuilderd/auth-cookie";
37+
};
38+
after = [
39+
"network.target"
40+
];
41+
serviceConfig = {
42+
ExecStart = "${cfg.package}/bin/rebuilderd --config ${configFile}";
43+
DynamicUser = true;
44+
StateDirectory = "rebuilderd";
45+
WorkingDirectory = "/var/lib/rebuilderd";
46+
};
47+
};
48+
};
49+
}

‎nixos/tests/all-tests.nix‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -956,6 +956,7 @@ in {
956956
readarr = handleTest ./readarr.nix {};
957957
realm = handleTest ./realm.nix {};
958958
readeck = runTest ./readeck.nix;
959+
rebuilderd = runTest ./rebuilderd.nix;
959960
redis = handleTest ./redis.nix {};
960961
redlib = handleTest ./redlib.nix {};
961962
redmine = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./redmine.nix {};

‎nixos/tests/rebuilderd.nix‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
{ lib, ... }:
2+
3+
{
4+
name = "rebuilderd";
5+
6+
nodes = {
7+
machine =
8+
{ pkgs, ... }:
9+
{
10+
services.rebuilderd = {
11+
enable = true;
12+
};
13+
};
14+
15+
machine_custom_config =
16+
{ pkgs, ... }:
17+
{
18+
services.rebuilderd = {
19+
enable = true;
20+
settings = {
21+
http.bind_addr = "0.0.0.0:1234";
22+
};
23+
};
24+
};
25+
};
26+
27+
testScript = ''
28+
machine.start()
29+
machine.wait_for_unit("rebuilderd.service")
30+
machine.wait_for_open_port(8484)
31+
32+
machine_custom_config.start()
33+
machine_custom_config.wait_for_unit("rebuilderd.service")
34+
machine_custom_config.wait_for_open_port(1234)
35+
'';
36+
37+
meta.maintainers = [ lib.maintainers.drupol ];
38+
}

‎pkgs/by-name/re/rebuilderd/package.nix‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
{
2+
lib,
3+
rustPlatform,
4+
fetchFromGitHub,
5+
pkg-config,
6+
shared-mime-info,
7+
installShellFiles,
8+
scdoc,
9+
bzip2,
10+
openssl,
11+
sqlite,
12+
xz,
13+
zstd,
14+
stdenv,
15+
darwin,
16+
buildPackages,
17+
versionCheckHook,
18+
nixosTests,
19+
nix-update-script,
20+
}:
21+
22+
rustPlatform.buildRustPackage (finalAttrs: {
23+
pname = "rebuilderd";
24+
version = "0.22.1";
25+
26+
src = fetchFromGitHub {
27+
owner = "kpcyrd";
28+
repo = "rebuilderd";
29+
tag = "v${finalAttrs.version}";
30+
hash = "sha256-YMBq+Z9yMQRXOM3U679g2lnBZlH/h0VLjoxySxi4SCo=";
31+
};
32+
33+
postPatch = ''
34+
substituteInPlace tools/src/args.rs \
35+
--replace-fail "/etc/rebuilderd-sync.conf" '${placeholder "out"}/etc/rebuilderd-sync.conf'
36+
37+
substituteInPlace worker/src/config.rs \
38+
--replace-fail 'from("/etc/rebuilderd-worker.conf")' 'from("${placeholder "out"}/etc/rebuilderd-worker.conf")'
39+
40+
substituteInPlace worker/src/proc.rs \
41+
--replace-fail '/bin/echo' 'echo'
42+
'';
43+
44+
useFetchCargoVendor = true;
45+
cargoHash = "sha256-MjFQ5d9VWHodjj+hIsKgAIUdaiarXIi5GCS+47n5MGU=";
46+
47+
nativeBuildInputs = [
48+
pkg-config
49+
installShellFiles
50+
scdoc
51+
];
52+
53+
buildInputs =
54+
[
55+
bzip2
56+
openssl
57+
shared-mime-info
58+
sqlite
59+
xz
60+
zstd
61+
]
62+
++ lib.optionals stdenv.hostPlatform.isDarwin [
63+
darwin.apple_sdk.frameworks.Security
64+
darwin.apple_sdk.frameworks.SystemConfiguration
65+
];
66+
67+
postInstall =
68+
let
69+
emulator = stdenv.hostPlatform.emulator buildPackages;
70+
in
71+
''
72+
mkdir -p $out/etc
73+
74+
# install config files
75+
install -Dm 644 -t "$out/etc" contrib/confs/rebuilderd-sync.conf
76+
install -Dm 640 -t "$out/etc" contrib/confs/rebuilderd-worker.conf contrib/confs/rebuilderd.conf
77+
78+
installShellCompletion --cmd rebuildctl \
79+
--bash <(${emulator} $out/bin/rebuildctl completions bash) \
80+
--fish <(${emulator} $out/bin/rebuildctl completions fish) \
81+
--zsh <(${emulator} $out/bin/rebuildctl completions zsh)
82+
83+
for f in contrib/docs/*.scd; do
84+
local page="contrib/docs/$(basename "$f" .scd)"
85+
scdoc < "$f" > "$page"
86+
installManPage "$page"
87+
done
88+
'';
89+
90+
checkFlags = [
91+
# Failing tests
92+
"--skip=decompress::tests::decompress_bzip2_compression"
93+
"--skip=decompress::tests::decompress_gzip_compression"
94+
"--skip=decompress::tests::decompress_xz_compression"
95+
"--skip=decompress::tests::decompress_zstd_compression"
96+
"--skip=decompress::tests::detect_bzip2_compression"
97+
"--skip=decompress::tests::detect_gzip_compression"
98+
"--skip=decompress::tests::detect_xz_compression"
99+
"--skip=decompress::tests::detect_zstd_compression"
100+
"--skip=proc::tests::hello_world"
101+
"--skip=proc::tests::size_limit_kill"
102+
"--skip=proc::tests::size_limit_no_kill"
103+
"--skip=proc::tests::size_limit_no_kill_but_timeout"
104+
"--skip=proc::tests::timeout"
105+
];
106+
107+
nativeInstallCheckInputs = [
108+
versionCheckHook
109+
];
110+
versionCheckProgramArg = [ "--version" ];
111+
doInstallCheck = true;
112+
113+
passthru.tests = {
114+
rebuilderd = nixosTests.rebuilderd;
115+
};
116+
117+
passthru.updateScript = nix-update-script { };
118+
119+
meta = {
120+
description = "Independent verification of binary packages - reproducible builds";
121+
homepage = "https://github.com/kpcyrd/rebuilderd";
122+
license = lib.licenses.gpl3Plus;
123+
maintainers = with lib.maintainers; [ drupol ];
124+
mainProgram = "rebuilderd";
125+
};
126+
})

0 commit comments

Comments
 (0)