a19cd4ffb1
This reverts commit 65a333600d5c88a98d674f637d092807cfc12253. This wasn't tested for correctness with something like fodwatch [0], and should not have been (self-)merged so quickly, especially without further review. It also resulted in the breakage of at least one package [1] (and that's the one we know of and was caught). A few packages that were updated in between this commit and this revert were not reverted back to using `rev`, but other than that, this is a 1:1 revert. [0]: https://codeberg.org/raphaelr/fodwatch [1]: https://github.com/NixOS/nixpkgs/pull/396904 / 758551e4587d75882aebc21a04bee960418f8ce9
69 lines
1.6 KiB
Nix
69 lines
1.6 KiB
Nix
{
|
|
systemd,
|
|
stdenv,
|
|
makeWrapper,
|
|
binutils-unwrapped,
|
|
sbsigntool,
|
|
rustPlatform,
|
|
fetchFromGitHub,
|
|
lib,
|
|
}:
|
|
rustPlatform.buildRustPackage rec {
|
|
pname = "lanzaboote-tool";
|
|
version = "0.3.0";
|
|
|
|
src = fetchFromGitHub {
|
|
owner = "nix-community";
|
|
repo = "lanzaboote";
|
|
rev = "v${version}";
|
|
hash = "sha256-Fb5TeRTdvUlo/5Yi2d+FC8a6KoRLk2h1VE0/peMhWPs=";
|
|
};
|
|
|
|
sourceRoot = "${src.name}/rust/tool";
|
|
useFetchCargoVendor = true;
|
|
cargoHash = "sha256-HnTsu46P3HRYo2d1DeaP6hqn+pVW3J4IM+CneckSFoM=";
|
|
|
|
env.TEST_SYSTEMD = systemd;
|
|
doCheck = lib.meta.availableOn stdenv.hostPlatform systemd;
|
|
|
|
nativeBuildInputs = [
|
|
makeWrapper
|
|
];
|
|
|
|
postInstall = ''
|
|
# Clean PATH to only contain what we need to do objcopy.
|
|
# This is still an unwrapped lanzaboote tool lacking of the
|
|
# UEFI stub location.
|
|
mv $out/bin/lzbt $out/bin/lzbt-unwrapped
|
|
wrapProgram $out/bin/lzbt-unwrapped \
|
|
--set PATH ${
|
|
lib.makeBinPath [
|
|
binutils-unwrapped
|
|
sbsigntool
|
|
]
|
|
}
|
|
'';
|
|
|
|
nativeCheckInputs = [
|
|
binutils-unwrapped
|
|
sbsigntool
|
|
];
|
|
|
|
meta = with lib; {
|
|
description = "Lanzaboote UEFI tooling for SecureBoot enablement on NixOS systems (unwrapped; does not contain the required stub)";
|
|
homepage = "https://github.com/nix-community/lanzaboote";
|
|
license = licenses.gpl3Only;
|
|
mainProgram = "lzbt-unwrapped";
|
|
maintainers = with maintainers; [
|
|
raitobezarius
|
|
nikstur
|
|
];
|
|
# Broken on aarch64-linux and any other architecture for now.
|
|
# Wait for 0.4.0.
|
|
platforms = [
|
|
"x86_64-linux"
|
|
"i686-linux"
|
|
];
|
|
};
|
|
}
|