cmd/fpkg: call app in-process
All checks were successful
Test / Create distribution (push) Successful in 28s
Test / Fortify (push) Successful in 2m31s
Test / Data race detector (push) Successful in 3m25s
Test / Fpkg (push) Successful in 3m29s
Test / Flake checks (push) Successful in 55s

Wrapping fortify is slow, painful and error-prone. Start apps in-process instead.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
2025-02-26 19:46:43 +09:00
parent 45ad788c6d
commit 673b648bd3
10 changed files with 121 additions and 115 deletions

View File

@@ -44,18 +44,15 @@ buildGoModule rec {
ldflags ++ [ "-X git.gensokyo.uk/security/fortify/internal.${name}=${value}" ]
)
(
[
"-s -w"
]
[ "-s -w" ]
++ lib.optionals withStatic [
"-linkmode external"
"-extldflags \"-static\""
]
)
{
Version = "v${version}";
Fsu = "/run/wrappers/bin/fsu";
Fortify = "${placeholder "out"}/libexec/fortify";
version = "v${version}";
fsu = "/run/wrappers/bin/fsu";
};
# nix build environment does not allow acls