393bf674f5
NetSurf (GTK 3) now starts under X and loads pages over HTTPS. Every icon GTK draws goes gdk-pixbuf -> glycin -> a loader process -> a sealed memfd -> GMappedFile, and each hop found something missing: - mkaroot runs Alpine's package triggers in the root under bubblewrap. --no-scripts had skipped them, so there was no MIME cache, pixbuf loader list, compiled GSettings schemas, GIO module cache, font cache or busybox applet links. - /usr/bin/bwrap is a stand-in that parses bubblewrap's options and runs the program with no sandbox: glycin starts its loaders only through bwrap, and real bwrap needs namespaces. schos-base replaces bubblewrap for it. - ioctl: FIOCLEX, FIONCLEX, FIONBIO and FIOASYNC on any descriptor (Rust's std uses them; pipes and sockets answered ENOTTY). - capget/capset: root has every capability, others none. - socketpair accepts SOCK_DGRAM and SOCK_SEQPACKET, carried as a stream. - waitpid and setpgid match children against the thread group leader, so a thread can wait for the process it spawned (ECHILD before). - memfd: fstat reports the ftruncate length, not the page-rounded one; file seals (F_ADD_SEALS, F_GET_SEALS, MFD_ALLOW_SEALING) are recorded and enforced on later writes, truncation and writable mappings; MFD_CLOEXEC is honoured; read-only MAP_PRIVATE maps are allowed. - recvfrom honours O_NONBLOCK and MSG_DONTWAIT. musl's resolver reads its socket until EAGAIN and blocked for ever after the first DNS answer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S1giNvrHTrPMPw7V6x1kQ4
69 lines
2.8 KiB
Nix
69 lines
2.8 KiB
Nix
# A development shell with everything docs/guides/building.md asks for.
|
|
#
|
|
# nix-shell # then: make, make qemu, make iso
|
|
#
|
|
# Why this exists: the UEFI loader is the one part that genuinely cannot be
|
|
# built without clang and lld. `make` falls back to the GNU toolchain for the
|
|
# kernel, so a machine with only gcc gets a kernel that builds and a loader that
|
|
# silently stays whatever it was -- which is exactly the failure that left a
|
|
# stale boot splash on this tree for half a day.
|
|
#
|
|
# Pinned to whatever nixpkgs the host is on rather than to a flake input, on
|
|
# purpose: this is a convenience for one developer's machine, not a
|
|
# reproducibility claim. If it ever needs to be the latter it wants a flake.
|
|
{ pkgs ? import <nixpkgs> { } }:
|
|
|
|
pkgs.mkShell {
|
|
name = "schos";
|
|
|
|
# Off, all of it. Nix's compiler wrapper adds -fPIC, -fstack-protector,
|
|
# -D_FORTIFY_SOURCE and friends to every compile, which is right for Linux
|
|
# programs and wrong for everything here: the kernel is freestanding and
|
|
# linked at fixed addresses, and the UEFI loader targets PE/COFF, where clang
|
|
# refuses -fPIC outright ("unsupported option '-fPIC' for target
|
|
# 'x86_64-unknown-windows-msvc'") and `make` stops at BOOTX64.EFI.
|
|
hardeningDisable = [ "all" ];
|
|
|
|
nativeBuildInputs = with pkgs; [
|
|
# The cross-compiler, and the reason this file exists. clang targets
|
|
# bare-metal ELF, 16-bit code and PE/COFF from one install; lld-link is what
|
|
# produces BOOTX64.EFI.
|
|
clang
|
|
lld
|
|
llvm # llvm-objcopy, llvm-objdump
|
|
|
|
# The host compiler, for tools/ -- mkfs, mkschfs, the SchFS suites. Must be
|
|
# a real Unix compiler: those need <unistd.h> and <dirent.h>.
|
|
gcc
|
|
|
|
gnumake
|
|
perl # generates the interrupt vector table
|
|
python3 # boot logo, crash-screen QR, mklogo
|
|
|
|
qemu # make qemu, and every test harness
|
|
OVMF # firmware for the UEFI path; the Makefile searches for it
|
|
|
|
bubblewrap # mkaroot runs Alpine's triggers in the root as /
|
|
xorriso # make iso
|
|
mtools # ESP staging
|
|
curl gnutar # fetching ports
|
|
xz # ...some of which are .tar.xz
|
|
|
|
# The X ports (docs/plan/xorg.md): half of them configure with autotools
|
|
# and half with meson, and all of them ask pkg-config for each other.
|
|
# libxcb generates its protocol code with python; libX11 and xkbcomp need
|
|
# m4 and bison at build time.
|
|
pkg-config
|
|
meson
|
|
ninja
|
|
gnum4
|
|
bison
|
|
flex
|
|
];
|
|
|
|
shellHook = ''
|
|
echo "schos: clang $(clang --version | head -1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')," \
|
|
"$(qemu-system-x86_64 --version | head -1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')"
|
|
echo " make | make qemu | make schfs-check | make iso"
|
|
'';
|
|
}
|