kat/hakurei
1
0
Fork 0
forked from rosa/hakurei
Code Pull Requests Activity
2,470 Commits 2 Branches 14 Tags
69908e5a41b76e065cb08734543994a17e2053d7
Commit Graph

60 Commits

Author SHA1 Message Date
cat 7eafc7b1e4 nix: update flake lock 
Was unfortunately not able to implement vm test suite before this release. Hopefully the last nixos update we have to follow.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2026-06-06 13:14:09 +09:00
cat 2a9aa3b400 cmd/dist: include version in release 
This makes HAKUREI_VERSION optional during build.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2026-05-21 23:37:08 +09:00
cat 351d6c5a35 cmd/sharefs: reproduce vfs inode file attribute race 
This happens in the vfs permissions check only and stale data appears to never reach userspace.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2026-04-08 15:51:36 +09:00
cat e4355279a1 all: optionally forbid degrading in tests 
This enables transparently degradable tests to be forced on in environments known to support them.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2026-04-07 15:22:52 +09:00
cat a69273ab2a cmd/dist: replace dist/release.sh 
This is much more robust than a shell script.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2026-04-05 23:58:08 +09:00
cat 48cdf8bf85 go: 1.26 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2026-03-10 03:29:19 +09:00
cat c5089cad78 cmd: remove hpkg 
This proof-of-concept was abandoned long ago. Its test suite is flaky, heavy on I/O and does not increase test coverage. This change fully removes hpkg and supporting code.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2026-03-02 13:42:49 +09:00
cat 67e453f5c4 dist: run tests 
This used to be impossible due to nix jank which has been addressed.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2026-01-27 07:00:39 +09:00
cat e42ea32dbe nix: configure sharefs via fileSystems 
Turns out this did not work because in the vm test harness, virtualisation.fileSystems completely and silently overrides fileSystems, causing its contents to not even be evaluated anymore. This is not documented as far as I can tell, and is not obvious by any stretch of the imagination. The current hack is cargo culted from nix-community/impermanence and hopefully lasts until this project fully replaces nix.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-12-27 23:14:08 +09:00
cat 7bfbd59810 cmd/sharefs: implement shared filesystem 
This is for passing files between applications, similar to android /sdcard.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-12-25 05:13:02 +09:00
cat ea815a59e8 nix: disable source fortification in devShell 
This generates warnings when compiling without optimisation.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-12-21 02:22:28 +09:00
cat ebc67bb8ad nix: update flake lock 
NixOS 25.11 introduces a crash in cage and an intermittent crash in foot.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-12-12 08:39:55 +09:00
cat c761e1de4d nix: build with clang 
Clang is better than gcc in various ways. This also pulls in clang-format which is very helpful.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-11-15 16:36:36 +09:00
cat 5c2b63a7f1 container: add 386 constants 
While it is unlikely a use case for hakurei on i686 exists, it does not hurt to have this support.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-11-05 20:21:14 +09:00
cat a4f7e92e1c test/interactive: helper scripts for tracing 
The vm state is discarded often, and it is quite cumbersome to set everything up again when the shell history is gone.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-08 00:56:25 +09:00
cat 72a931a71a nix: interactive nixos vm 
This is useful for quickly spinning up an ephemeral hakurei environment for testing changes or reproducing vm test failures.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-07 02:46:04 +09:00
cat a8a79a8664 cmd/hpkg: rename from planterette 
Planterette is now developed in another repository, so rename this proof of concept to avoid confusion.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-31 23:57:11 +09:00
cat 72c2b66fc0 nix: cross-platform syscall wrapper 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 04:22:55 +09:00
cat e03d702d08 sandbox/seccomp: implement syscall lookup 
This uses the Go map and is verified against libseccomp.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-01 00:35:27 +09:00
cat 9a8a047908 sandbox/seccomp: syscall name lookup table 
The script is from Go source of same name. The result is checked against libseccomp.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-26 03:49:07 +09:00
cat aa454b158f cmd/planterette: remove hsu special case 
Remove special case and invoke hakurei out of process.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 20:50:24 +09:00
cat 87e008d56d treewide: rename to hakurei 
Fortify makes little sense for a container tool.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 04:57:41 +09:00
cat b7e991de5b nix: update flake lock 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-05 04:05:39 +09:00
cat 297b444dfb test: separate app and sandbox 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-30 22:09:46 +09:00
cat b39f3aeb59 helper: remove bubblewrap wrapper 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-25 05:35:02 +09:00
cat 3385538142 nix: clean up flake outputs 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-17 12:26:19 +09:00
cat 4bb5d9780f ldd: run in native sandbox 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-14 17:55:55 +09:00
cat 9b1a60b5c9 sandbox: native container tooling 
This should eventually replace bwrap.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-13 21:36:26 +09:00
cat c8ed7aae6e nix: update flake lock 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-10 18:38:14 +09:00
cat 2d4cabe786 nix: increase nixfmt max width 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-28 14:43:46 +09:00
cat 12c6d66bfd cmd/fpkg/test: nixos test fpkg install/start 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-26 13:12:16 +09:00
cat c21a4cff14 nix: wrap fpkg 
This is usable on nixos now due to the static build.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-26 12:24:04 +09:00
cat 5a732d153e nix: include fsu sources in dist build 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-25 01:32:47 +09:00
cat b6af8caffe nix: clean up directory structure 
Tests for fpkg is going to be in ./cmd/fpkg, so this central tests directory is no longer necessary.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-23 18:48:01 +09:00
cat 8bf162820b nix: separate fsu from package 
This appears to be the only way to build them with different configuration. This enables static linking in the main package.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-23 18:13:37 +09:00
cat eb0c16dd8c cmd/fpkg: rename buildPackage file 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-21 18:13:34 +09:00
cat 64b6dc41ba nix: split integration test 
For adding tests for fpkg.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-21 17:05:17 +09:00
cat 60c10c3f4a nix: run integration tests with race detector 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-16 20:58:08 +09:00
cat 3df344828f proc/priv/shim: seccomp bpf filter via libseccomp 
Rulesets adapted from Flatpak for compatibility.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-20 23:39:47 +09:00
cat c4de450217 nix: do not force static linking on nix 
In a typical Nix or NixOS-based setup, the entire /nix/store directory is available to the sandbox.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-17 22:56:16 +09:00
cat b60c01f440 fortify: switch to static linking 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-16 17:32:52 +09:00
cat 5416b07daa nix: remove unused argument 'self' 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 14:49:55 +09:00
cat e57a0e9bf2 nix: rename fortifyBundle to buildPackage 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 14:35:37 +09:00
cat 5125e96ecf nix: generate application package build script 
This takes some metadata, sandbox options, a launch script and a list of home-manager modules. The result needs to be executed in an environment with nix daemon access, and it produces the final package file.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 00:42:21 +09:00
cat 7b6052a473 nix: run Go tests in nixos 
Nix build environment does not support ACLs in any filesystem. This allows acl tests to run.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 21:16:55 +09:00
cat 3f993021f8 nix: permissive defaults nixos test 
Adapted from nixos sway integration tests.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-16 22:56:10 +09:00
cat 4d3bd5338f nix: implement flake checks 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-16 20:54:28 +09:00
cat 6b8ddca7b4 nix: track nixos stable 24.11 
Reduce rebuilds during development on my system.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-06 00:44:04 +09:00
cat 0a546885e3 nix: update options doc 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 18:12:35 +09:00
cat d9cb2a9f2b fsu: implement simple setuid user switcher 
Contains path to fortify, set at compile time, authenticates based on a simple uid range assignment file which also acts as the allow list.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-10-28 00:02:34 +09:00