nix: do not force static linking on nix
Some checks failed
Build / Create distribution (push) Failing after 54s
Test / Run NixOS test (push) Successful in 4m22s

In a typical Nix or NixOS-based setup, the entire /nix/store directory is available to the sandbox.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra 2025-01-17 22:56:16 +09:00
parent 9b066e6088
commit 47932b3c8e
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q

View File

@ -1,11 +1,16 @@
{
lib,
buildGoModule,
makeBinaryWrapper,
xdg-dbus-proxy,
bubblewrap,
pkgsStatic,
pkg-config,
libffi,
acl,
wayland,
wayland-protocols,
wayland-scanner,
xorg,
}:
buildGoModule rec {
@ -27,7 +32,6 @@ buildGoModule rec {
)
[
"-s -w"
"-extldflags '-static'"
"-X main.Fmain=${placeholder "out"}/libexec/fortify"
"-X main.Fshim=${placeholder "out"}/libexec/fshim"
]
@ -42,10 +46,7 @@ buildGoModule rec {
GO_TEST_SKIP_ACL = 1;
buildInputs =
# cannot find a cleaner way to do this
with pkgsStatic;
[
musl
libffi
acl
wayland
@ -60,7 +61,7 @@ buildGoModule rec {
nativeBuildInputs = [
pkg-config
wayland-scanner
pkgsStatic.makeBinaryWrapper
makeBinaryWrapper
];
preConfigure = ''