security-profiles-operator/flake.nix at main · kubernetes-sigs/security-profiles-operator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
{
  description = "Security Profiles Operator";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
  };

  outputs =
    { self, nixpkgs }:
    let
      supportedSystems = [ "x86_64-linux" "aarch64-linux" ];

      forAllSystems = nixpkgs.lib.genAttrs supportedSystems;

      crossTargets = {
        amd64 = null;
        arm64 = {
          config = "aarch64-unknown-linux-gnu";
        };
        ppc64le = {
          config = "powerpc64le-unknown-linux-gnu";
        };
        s390x = {
          config = "s390x-unknown-linux-musl";
        };
      };

      bpfArchMap = {
        amd64 = "x86";
        arm64 = "arm64";
        ppc64le = "ppc64le";
        s390x = "s390x";
      };

      mkPkgs =
        system: crossSystem:
        import nixpkgs {
          inherit system;
          crossSystem = crossSystem;
          overlays = [ (import ./nix/overlay.nix) ];
        };

      mkSPO =
        system: crossSystem:
        let
          pkgs = mkPkgs system crossSystem;
        in
        pkgs.callPackage ./nix/derivation.nix { };

      mkBPF =
        system: crossSystem: arch:
        let
          pkgs = mkPkgs system crossSystem;
        in
        pkgs.callPackage ./nix/derivation-bpf.nix { inherit arch; };

      mkSPOC =
        system: crossSystem:
        (mkSPO system crossSystem).overrideAttrs (_: {
          buildPhase = ''
            make build/spoc
          '';
          installPhase = ''
            install -Dm755 -t $out build/spoc
          '';
        });

      # Map target config to native nix system string
      configToSystem = {
        "x86_64-unknown-linux-gnu" = "x86_64-linux";
        "aarch64-unknown-linux-gnu" = "aarch64-linux";
      };
    in
    {
      packages = forAllSystems (
        system:
        let
          native = mkSPO system null;
        in
        {
          default = native;
        }
        // nixpkgs.lib.mapAttrs' (
          arch: crossSystem:
          nixpkgs.lib.nameValuePair "spo-${arch}" (
            if crossSystem == null || (configToSystem.${crossSystem.config} or null) == system then
              native
            else
              mkSPO system crossSystem
          )
        ) crossTargets
        // nixpkgs.lib.mapAttrs' (
          arch: crossSystem:
          nixpkgs.lib.nameValuePair "bpf-${arch}" (
            mkBPF system crossSystem bpfArchMap.${arch}
          )
        ) crossTargets
        // nixpkgs.lib.mapAttrs' (
          arch: crossSystem:
          let
            # spoc s390x uses gnu, not musl
            spocCrossSystem =
              if arch == "s390x" then { config = "s390x-unknown-linux-gnu"; }
              else crossSystem;
          in
          nixpkgs.lib.nameValuePair "spoc-${arch}" (
            if spocCrossSystem == null || (configToSystem.${spocCrossSystem.config} or null) == system then
              mkSPOC system null
            else
              mkSPOC system spocCrossSystem
          )
        ) crossTargets
      );
    };
}