| 15 Nov 2024 |
 p14 | * I've come up with a possible use case for this abandoned PR https://github.com/NixOS/nixpkgs/pull/355000
Being able to put link-only flags in it for clang: warning: argument unused during compilation: '-pie' [-Wunused-command-line-argument] would be useful. Sensible?
An alternative route would be to bracket these flags in --start-no-unused-arguments and --end-no-unused-arguments.
| 11:14:38 |
 aleksana 🏳️⚧️ (force me to bed after 18:00 UTC) | In reply to @emilazy:matrix.org
btw, as a ca-derivations enjoyer you may enjoy this long but fruitful conversation I had with amjoseph on the Discourse about how we can achieve proper short-circuiting for shared libraries with stubs (like the macOS .tbds I was talking about) and splitting out linking into multiple steps https://discourse.nixos.org/t/why-does-the-nixos-infrastructure-have-to-be-hosted-in-a-centralized-way/46789/32 Btw the comment mentioned is not accurate | 11:14:41 |
| aleksana 🏳️⚧️ (force me to bed after 18:00 UTC) | Open Build System at least (optionally) rebuilds everything | 11:15:14 |
 emily | which comment? | 11:15:30 |
| emily | I don't see any mention of OBS there | 11:15:43 |
| aleksana 🏳️⚧️ (force me to bed after 18:00 UTC) | In reply to @emilazy:matrix.org
which comment? The comment you are linking to | 11:17:38 |
| emily | oh, "No other distro"? | 11:17:48 |
| emily | does openSUSE rebuild every downstream package for a one-byte security fix patch in OpenSSL that doesn't affect the headers or ABI? | 11:18:13 |
| p14 | Just because other distros may pay the cost doesn't mean nixpkgs must also. | 11:18:36 |
| aleksana 🏳️⚧️ (force me to bed after 18:00 UTC) | In reply to @p14:matrix.org
Just because other distros may pay the cost doesn't mean nixpkgs must also. Don't get me wrong; I mean it's not something specific to Nixpkgs or Guix | 11:19:12 |
| emily | the world rebuilds are generally more gradual with other distros, AIUI | 11:20:18 |
| emily | involving manual pkgrel bumps etc. | 11:20:25 |
| aleksana 🏳️⚧️ (force me to bed after 18:00 UTC) | In reply to @emilazy:matrix.org
does openSUSE rebuild every downstream package for a one-byte security fix patch in OpenSSL that doesn't affect the headers or ABI? I'm not sure if they added an automated function reference table or something similar when using the open build service. This process may be done manually, but based on my past experience with OBS, it should not be automatic | 11:20:49 |
| p14 | Can we come back to what it would take to actually try and start implementing this? Is there a prototype repo or effort to try some of these ideas somewhere? | 11:21:08 |
| emily | OpenSUSE is just like us (crazy rebuilds, fancy automated QA service) | 11:21:09 |
| emily | In reply to @p14:matrix.org
Can we come back to what it would take to actually try and start implementing this? Is there a prototype repo or effort to try some of these ideas somewhere? it's in my head :) | 11:21:20 |
| p14 | Want to collaborate and try and prove it can be done? :) | 11:21:33 |
| p14 | I would try and use it and break it. | 11:21:49 |
| p14 | (and fix it) | 11:21:57 |
| emily | here's the sketch: for every derivation producing a shared library, you want to use llvm-ifs to generate stubs from the libraries. you put those in dev, say | 11:22:08 |
| p14 | Makes sense. | 11:22:17 |
| emily | downstream derivations do not consume the library output at build time. they consume dev exclusively | 11:22:23 |
| emily | and dev is ca-derivations | 11:22:32 |
| emily | (can you have only some outputs be CA? probably not. so it's a pain with Nix already) | 11:22:39 |
| emily | (but you can split it up into a separate derivation, etc.) | 11:22:44 |
| p14 | For the prototype is there a reason you can't make whole derivations ca, even if they are not reproducible? | 11:23:20 |
| emily | you then, as part of the final package fixed-point-taking, join up every package that depends on a stub with the corresponding actual library output, and patch up the executables to point to the real paths. (optional: fancy static dynamic loading stuff goes here for perf) | 11:23:21 |
| emily | that's pretty much it. rebuilds of build tools still rebuild a lot | 11:23:34 |
| emily | but if you change the implementation of a function in OpenSSL without adding or removing any symbols, and don't touch the headers, then the only rebuilds are executables that use OpenSSL and things depending on them | 11:23:54 |
| p14 | Well, you could imagine trying to make the build tool that does the patching as small and reproducible as possible. | 11:24:02 |
