From 08c9937c232ed4275be46dde85059138c1be2a13 Mon Sep 17 00:00:00 2001 From: billow Date: Sun, 23 Aug 2026 13:28:53 +0800 Subject: [PATCH] nix: make Rizin dev build self-contained --- .github/workflows/nix.yaml | 3 + README.md | 29 +++++++- flake.lock | 57 +-------------- flake.nix | 9 +-- nix/rizin/checksum.json | 5 ++ nix/rizin/default.nix | 84 ++++++++++++++++++++++ nix/rizin/meson-deps-config-hook.sh | 14 ++++ nix/rizin/update.sh | 105 ++++++++++++++++++++++++++++ rz-tracetest/rzemu.cpp | 2 +- 9 files changed, 243 insertions(+), 65 deletions(-) create mode 100644 nix/rizin/checksum.json create mode 100644 nix/rizin/default.nix create mode 100644 nix/rizin/meson-deps-config-hook.sh create mode 100755 nix/rizin/update.sh diff --git a/.github/workflows/nix.yaml b/.github/workflows/nix.yaml index a62a75d..d56cbb2 100644 --- a/.github/workflows/nix.yaml +++ b/.github/workflows/nix.yaml @@ -35,6 +35,9 @@ jobs: - name: Check flake run: nix flake check --all-systems --show-trace + - name: Build Rizin + run: nix build .#rizin --no-link --print-build-logs + - name: Build rz-tracetest run: nix build .#rz-tracetest --print-build-logs diff --git a/README.md b/README.md index e66a7c0..3b81024 100644 --- a/README.md +++ b/README.md @@ -100,6 +100,12 @@ nix build The resulting executable will be available at `./result/bin/rz-tracetest`. +The pinned Rizin dependency can also be built independently: + +```bash +nix build .#rizin +``` + ### Running with Nix To run `rz-tracetest` directly with Nix: @@ -112,11 +118,32 @@ nix run . -- mytrace.frames The flake provides the following: +- **packages.rizin**: The pinned Rizin development revision - **packages.rz-tracetest**: The compiled `rz-tracetest` executable - **packages.default**: Alias for `rz-tracetest` - **devShells.default**: Development shell with all build dependencies - **formatter**: `nixfmt-tree` for Nix code formatting +### Updating Rizin + +The pinned revision and fixed-output hashes are stored together in +`nix/rizin/checksum.json`. From the repository root, update to the current +Rizin `dev` branch with: + +```bash +./nix/rizin/update.sh +``` + +To update to a specific full commit SHA instead: + +```bash +./nix/rizin/update.sh +``` + +The updater recalculates the source and Meson dependency hashes, then builds +both Rizin and `rz-tracetest`. It restores the previous checksum file if +validation fails and does not create a commit. + Adjustments to specific Archs/Sources/... ----------------------------------------- @@ -206,4 +233,4 @@ Stable releases of distros like Ubuntu or Debian pin older versions of Protobuf rm -rf build/ cmake -Bbuild -GNinja ninja -C build - ``` \ No newline at end of file + ``` diff --git a/flake.lock b/flake.lock index d04441c..20db77f 100644 --- a/flake.lock +++ b/flake.lock @@ -1,26 +1,5 @@ { "nodes": { - "b": { - "inputs": { - "flake-utils": "flake-utils", - "nixpkgs": [ - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1777378555, - "narHash": "sha256-eicFB1iNbr/4iVtU9yloqlGkDm0gj1aSoQid/raPNak=", - "owner": "b1llow", - "repo": "nix", - "rev": "c33a9f5ae003c2ad72587a5ae7ea475039adc2f2", - "type": "github" - }, - "original": { - "owner": "b1llow", - "repo": "nix", - "type": "github" - } - }, "flake-utils": { "inputs": { "systems": "systems" @@ -39,24 +18,6 @@ "type": "github" } }, - "flake-utils_2": { - "inputs": { - "systems": "systems_2" - }, - "locked": { - "lastModified": 1731533236, - "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", - "type": "github" - }, - "original": { - "owner": "numtide", - "repo": "flake-utils", - "type": "github" - } - }, "nixpkgs": { "locked": { "lastModified": 1776877367, @@ -75,8 +36,7 @@ }, "root": { "inputs": { - "b": "b", - "flake-utils": "flake-utils_2", + "flake-utils": "flake-utils", "nixpkgs": "nixpkgs" } }, @@ -94,21 +54,6 @@ "repo": "default", "type": "github" } - }, - "systems_2": { - "locked": { - "lastModified": 1681028828, - "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", - "owner": "nix-systems", - "repo": "default", - "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", - "type": "github" - }, - "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" - } } }, "root": "root", diff --git a/flake.nix b/flake.nix index 0ee39bf..02d578d 100644 --- a/flake.nix +++ b/flake.nix @@ -4,10 +4,6 @@ inputs = { nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; flake-utils.url = "github:numtide/flake-utils"; - b = { - url = "github:b1llow/nix"; - inputs.nixpkgs.follows = "nixpkgs"; - }; }; outputs = @@ -15,7 +11,6 @@ self, nixpkgs, flake-utils, - b, ... }: flake-utils.lib.eachDefaultSystem ( @@ -37,7 +32,7 @@ sha256 = "sha256-1f65TEIXncDD6N54Ton/VsoNYBoxEr1h0P2HIOSzI+o="; }; - rizin = b.packages.${system}.rizin; + rizin = pkgs.callPackage ./nix/rizin { }; rz-tracetest = pkgs.stdenv.mkDerivation { pname = "rz-tracetest"; @@ -82,7 +77,7 @@ }; packages = { - inherit rz-tracetest; + inherit rizin rz-tracetest; default = rz-tracetest; }; diff --git a/nix/rizin/checksum.json b/nix/rizin/checksum.json new file mode 100644 index 0000000..bf4c7ef --- /dev/null +++ b/nix/rizin/checksum.json @@ -0,0 +1,5 @@ +{ + "rev": "38c3bed6c98ac52d234cf6c7eb9af7b860ce8c03", + "srcHash": "sha256-BxHdtF4SekQjYTedOzt8hR24VRHBdmtwQ5FFx34MkYs=", + "mesonDepsHash": "sha256-MYRYrrhWbQRkHaYfSAxPMnhqxFFSb5xAHirqP8Zy2AY=" +} diff --git a/nix/rizin/default.nix b/nix/rizin/default.nix new file mode 100644 index 0000000..819865c --- /dev/null +++ b/nix/rizin/default.nix @@ -0,0 +1,84 @@ +{ + cacert, + fetchFromGitHub, + git, + lib, + makeSetupHook, + meson, + rizin, + stdenvNoCC, +}: + +let + checksums = builtins.fromJSON (builtins.readFile ./checksum.json); + + src = fetchFromGitHub { + owner = "rizinorg"; + repo = "rizin"; + rev = checksums.rev; + hash = checksums.srcHash; + }; + + mesonDeps = stdenvNoCC.mkDerivation { + pname = "rizin-meson-deps"; + version = builtins.substring 0 12 checksums.rev; + inherit src; + + postUnpack = '' + rm "$sourceRoot/subprojects/sigdb.wrap" + ''; + + nativeBuildInputs = [ + cacert + git + meson + ]; + + buildPhase = '' + runHook preBuild + + meson subprojects download + find subprojects -type d -name .git -prune -exec rm -rf {} + + cp -r subprojects "$out" + + runHook postBuild + ''; + + phases = [ + "unpackPhase" + "buildPhase" + ]; + + impureEnvVars = lib.fetchers.proxyImpureEnvVars; + outputHashMode = "recursive"; + outputHashAlgo = "sha256"; + outputHash = checksums.mesonDepsHash; + }; + + mesonDepsConfigHook = makeSetupHook { + name = "rizin-meson-deps-config-hook"; + } ./meson-deps-config-hook.sh; +in +rizin.overrideAttrs (prevAttrs: { + version = "unstable-${builtins.substring 0 12 checksums.rev}"; + inherit src mesonDeps; + + patches = builtins.filter ( + patch: builtins.baseNameOf patch != "0001-fix-compilation-with-clang.patch" + ) (prevAttrs.patches or [ ]); + + mesonFlags = [ + "-Dportable=true" + "-Dinstall_sigdb=false" + ]; + + nativeBuildInputs = (prevAttrs.nativeBuildInputs or [ ]) ++ [ mesonDepsConfigHook ]; + buildInputs = [ ]; + + # nixpkgs-update: no auto update + passthru = { + inherit mesonDeps; + updateScript = ./update.sh; + skipBulkUpdate = true; + }; +}) diff --git a/nix/rizin/meson-deps-config-hook.sh b/nix/rizin/meson-deps-config-hook.sh new file mode 100644 index 0000000..6ea429e --- /dev/null +++ b/nix/rizin/meson-deps-config-hook.sh @@ -0,0 +1,14 @@ +# shellcheck shell=bash + +mesonDepsConfigHook() { + if [[ -z ${mesonDeps-} ]]; then + echo "mesonDepsConfigHook: mesonDeps is not set" >&2 + return 1 + fi + + rm -rf subprojects + cp -r "$mesonDeps" subprojects + chmod -R u+w subprojects +} + +preConfigureHooks+=(mesonDepsConfigHook) diff --git a/nix/rizin/update.sh b/nix/rizin/update.sh new file mode 100755 index 0000000..ba5fe86 --- /dev/null +++ b/nix/rizin/update.sh @@ -0,0 +1,105 @@ +#!/usr/bin/env bash + +set -euo pipefail + +usage() { + echo "Usage: $0 [RIZIN_COMMIT]" >&2 +} + +if (( $# > 1 )); then + usage + exit 2 +fi + +if [[ ${1:-} == "-h" || ${1:-} == "--help" ]]; then + usage + exit 0 +fi + +repo_root=$(git rev-parse --show-toplevel) +checksum_file="$repo_root/nix/rizin/checksum.json" + +if [[ ! -f "$checksum_file" ]]; then + echo "Could not find $checksum_file; run this updater from the rz-tracetest checkout." >&2 + exit 1 +fi + +if (( $# == 1 )); then + rev=$1 +else + remote_ref=$(git ls-remote https://github.com/rizinorg/rizin.git refs/heads/dev) + rev=${remote_ref%%[[:space:]]*} +fi + +if [[ ! $rev =~ ^[0-9a-f]{40}$ ]]; then + echo "Expected a full 40-character Rizin commit SHA, got: $rev" >&2 + exit 1 +fi + +source_url="https://github.com/rizinorg/rizin/archive/$rev.tar.gz" +echo "Prefetching Rizin source at $rev" +prefetch_json=$(nix store prefetch-file --json --unpack "$source_url") +src_hash=$(printf '%s\n' "$prefetch_json" | sed -n 's/.*"hash"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p') + +if [[ $src_hash != sha256-* ]]; then + echo "Could not extract the Rizin source hash from: $prefetch_json" >&2 + exit 1 +fi + +backup=$(mktemp) +cp -- "$checksum_file" "$backup" + +restore_on_error() { + status=$? + if (( status != 0 )); then + cp -- "$backup" "$checksum_file" + echo "Update failed; restored $checksum_file" >&2 + fi + rm -f -- "$backup" + return "$status" +} +trap restore_on_error EXIT + +write_checksums() { + target_rev=$1 + target_src_hash=$2 + target_deps_hash=$3 + tmp=$(mktemp "${checksum_file}.tmp.XXXXXX") + + printf '{\n "rev": "%s",\n "srcHash": "%s",\n "mesonDepsHash": "%s"\n}\n' \ + "$target_rev" "$target_src_hash" "$target_deps_hash" >"$tmp" + mv -- "$tmp" "$checksum_file" +} + +fake_hash="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" +write_checksums "$rev" "$src_hash" "$fake_hash" + +echo "Calculating the Meson dependency hash" +set +e +deps_log=$(nix build '.#rizin.mesonDeps' --no-link --print-build-logs 2>&1) +deps_status=$? +set -e + +if (( deps_status == 0 )); then + echo "The fake Meson dependency hash unexpectedly succeeded." >&2 + exit 1 +fi + +meson_deps_hash=$(printf '%s\n' "$deps_log" | sed -n 's/.*got:[[:space:]]*\(sha256-[A-Za-z0-9+\/=]*\).*/\1/p' | tail -n 1) + +if [[ $meson_deps_hash != sha256-* ]]; then + printf '%s\n' "$deps_log" >&2 + echo "Could not extract the Meson dependency hash from the Nix build." >&2 + exit 1 +fi + +write_checksums "$rev" "$src_hash" "$meson_deps_hash" + +echo "Validating Rizin and rz-tracetest" +nix build .#rizin --no-link --print-build-logs +nix build .#rz-tracetest --no-link --print-build-logs + +echo "Updated nix/rizin/checksum.json" +echo " rev: $rev" +echo " srcHash: $src_hash" +echo " mesonDepsHash: $meson_deps_hash" diff --git a/rz-tracetest/rzemu.cpp b/rz-tracetest/rzemu.cpp index c39cece..509b841 100644 --- a/rz-tracetest/rzemu.cpp +++ b/rz-tracetest/rzemu.cpp @@ -619,7 +619,7 @@ bool RizinEmulator::TraceRegOverlapsILVar(const char *tracereg, const char *var) if (!ri) { return false; } - if (!RegIsBound(vm->reg_binding, var)) { + if (!RegIsBound(vm->ctx->reg_binding, var)) { return false; } if (rzreg == var) {