6edbb14e81
Previously unbound dev dependencies would leak into the unbound binary
through the embedded configure flags string in the binary.
Before this commit `unbound -V` would list something like this:
> Version 1.13.1
> Configure line: --disable-static --prefix=/nix/store/1892sms7ciiki99jra4qhmwysaipv1qz-unbound-1.13.1 --bindir=/nix/store/1892sms7ciiki99jra4qhmwysaipv1qz-unbound-1.13.1/bin --sbindir=/nix/store/1892sms7ciiki99jra4qhmwysaipv1qz-unbound-1.13.1/sbin --includedir=/nix/store/1892sms7ciiki99jra4qhmwysaipv1qz-unbound-1.13.1/include --oldincludedir=/nix/store/1892sms7ciiki99jra4qhmwysaipv1qz-unbound-1.13.1/include --mandir=/nix/store/n4kgsi87dxjm2ifpllh31grfcg7q3n8x-unbound-1.13.1-man/share/man --infodir=/nix/store/1892sms7ciiki99jra4qhmwysaipv1qz-unbound-1.13.1/share/info --docdir=/nix/store/1892sms7ciiki99jra4qhmwysaipv1qz-unbound-1.13.1/share/doc/unbound --libdir=/nix/store/ncpggv4bmdh22y6108qrdvnid6rqamlz-unbound-1.13.1-lib/lib --libexecdir=/nix/store/ncpggv4bmdh22y6108qrdvnid6rqamlz-unbound-1.13.1-lib/libexec --localedir=/nix/store/ncpggv4bmdh22y6108qrdvnid6rqamlz-unbound-1.13.1-lib/share/locale --with-ssl=/nix/store/dndqy1r8h0kcnd55895czs8lrpv8xqf4-openssl-1.1.1k-dev --with-libexpat=/nix/store/x5kjng6iha7kcdm3p12fxfvzg09wizwc-expat-2.2.10-dev --with-libevent=/nix/store/89i6mpzp1n866i86y07pxka1a58v4s1a-libevent-2.1.12-dev --localstatedir=/var --sysconfdir=/etc --sbindir=${out}/bin --with-rootkey-file=/nix/store/gyz4nxg9s1faqkhaqbasdxzldm8zial8-dns-root-data-2019-01-11/root.key --enable-pie --enable-relro-now
> Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 1.1.1k 25 Mar 2021
> Linked modules: dns64 respip validator iterator
After this commit:
> Version 1.13.1
> Configure line: --disable-static --prefix=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.13.1 --bindir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.13.1/bin --sbindir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.13.1/sbin --includedir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.13.1/include --oldincludedir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.13.1/include --mandir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.13.1-man/share/man --infodir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.13.1/share/info --docdir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.13.1/share/doc/unbound --libdir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.13.1-lib/lib --libexecdir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.13.1-lib/libexec --localedir=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-unbound-1.13.1-lib/share/locale --with-ssl=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-openssl-1.1.1k-dev --with-libexpat=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-expat-2.2.10-dev --with-libevent=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-libevent-2.1.12-dev --localstatedir=/var --sysconfdir=/etc --sbindir=${out}/bin --with-rootkey-file=/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-dns-root-data-2019-01-11/root.key --enable-pie --enable-relro-now
> Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 1.1.1k 25 Mar 2021
> Linked modules: dns64 respip validator iterator
Notice: All the paths are now invalid and thus do not produce a
reference in the output binaries.
This removes a total of 2MiB from the closure of unbound.
100 lines
3.2 KiB
Nix
100 lines
3.2 KiB
Nix
{ stdenv
|
|
, lib
|
|
, fetchurl
|
|
, openssl
|
|
, nettle
|
|
, expat
|
|
, libevent
|
|
, dns-root-data
|
|
, pkg-config
|
|
, makeWrapper
|
|
#
|
|
# By default unbound will not be built with systemd support. Unbound is a very
|
|
# commmon dependency. The transitive dependency closure of systemd also
|
|
# contains unbound.
|
|
# Since most (all?) (lib)unbound users outside of the unbound daemon usage do
|
|
# not need the systemd integration it is likely best to just default to no
|
|
# systemd integration.
|
|
# For the daemon use-case, that needs to notify systemd, use `unbound-with-systemd`.
|
|
#
|
|
, withSystemd ? false
|
|
, systemd ? null
|
|
# optionally support DNS-over-HTTPS as a server
|
|
, withDoH ? false
|
|
, libnghttp2
|
|
}:
|
|
|
|
stdenv.mkDerivation rec {
|
|
pname = "unbound";
|
|
version = "1.13.1";
|
|
|
|
src = fetchurl {
|
|
url = "https://unbound.net/downloads/${pname}-${version}.tar.gz";
|
|
sha256 = "sha256-hQTZe4/FvYlzRcldEW4O4N34yP+ZWQqytL0TJ4yfULg=";
|
|
};
|
|
|
|
outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
|
|
|
|
nativeBuildInputs = [ makeWrapper ];
|
|
|
|
buildInputs = [ openssl nettle expat libevent ]
|
|
++ lib.optionals withSystemd [ pkg-config systemd ]
|
|
++ lib.optionals withDoH [ libnghttp2 ];
|
|
|
|
configureFlags = [
|
|
"--with-ssl=${openssl.dev}"
|
|
"--with-libexpat=${expat.dev}"
|
|
"--with-libevent=${libevent.dev}"
|
|
"--localstatedir=/var"
|
|
"--sysconfdir=/etc"
|
|
"--sbindir=\${out}/bin"
|
|
"--with-rootkey-file=${dns-root-data}/root.key"
|
|
"--enable-pie"
|
|
"--enable-relro-now"
|
|
] ++ lib.optional stdenv.hostPlatform.isStatic [
|
|
"--disable-flto"
|
|
] ++ lib.optionals withSystemd [
|
|
"--enable-systemd"
|
|
] ++ lib.optionals withDoH [
|
|
"--with-libnghttp2=${libnghttp2.dev}"
|
|
];
|
|
|
|
# Remove references to compile-time dependencies that are included in the configure flags
|
|
postConfigure = let
|
|
inherit (builtins) storeDir;
|
|
in ''
|
|
sed -E '/CONFCMDLINE/ s;${storeDir}/[a-z0-9]{32}-;${storeDir}/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-;g' -i config.h
|
|
'';
|
|
|
|
installFlags = [ "configfile=\${out}/etc/unbound/unbound.conf" ];
|
|
|
|
postInstall = ''
|
|
make unbound-event-install
|
|
wrapProgram $out/bin/unbound-control-setup \
|
|
--prefix PATH : ${lib.makeBinPath [ openssl ]}
|
|
'';
|
|
|
|
preFixup = lib.optionalString (stdenv.isLinux && !stdenv.hostPlatform.isMusl) # XXX: revisit
|
|
# Build libunbound again, but only against nettle instead of openssl.
|
|
# This avoids gnutls.out -> unbound.lib -> openssl.out.
|
|
# There was some problem with this on Darwin; let's not complicate non-Linux.
|
|
''
|
|
configureFlags="$configureFlags --with-nettle=${nettle.dev} --with-libunbound-only"
|
|
configurePhase
|
|
buildPhase
|
|
installPhase
|
|
''
|
|
# get rid of runtime dependencies on $dev outputs
|
|
+ ''substituteInPlace "$lib/lib/libunbound.la" ''
|
|
+ lib.concatMapStrings
|
|
(pkg: lib.optionalString (pkg ? dev) " --replace '-L${pkg.dev}/lib' '-L${pkg.out}/lib' --replace '-R${pkg.dev}/lib' '-R${pkg.out}/lib'")
|
|
(builtins.filter (p: p != null) buildInputs);
|
|
|
|
meta = with lib; {
|
|
description = "Validating, recursive, and caching DNS resolver";
|
|
license = licenses.bsd3;
|
|
homepage = "https://www.unbound.net";
|
|
maintainers = with maintainers; [ ehmry fpletz globin ];
|
|
platforms = platforms.unix;
|
|
};
|
|
}
|