nix: make Rizin dev build self-contained

.github/workflows/nix.yaml

@@ -35,6 +35,9 @@ jobs:
       - name: Check flake
         run: nix flake check --all-systems --show-trace
 
+      - name: Build Rizin
+        run: nix build .#rizin --no-link --print-build-logs
+
       - name: Build rz-tracetest
         run: nix build .#rz-tracetest --print-build-logs
 

README.md

@@ -100,6 +100,12 @@ nix build
 
 The resulting executable will be available at `./result/bin/rz-tracetest`.
 
+The pinned Rizin dependency can also be built independently:
+
+```bash
+nix build .#rizin
+```
+
 ### Running with Nix
 
 To run `rz-tracetest` directly with Nix:
@@ -112,11 +118,32 @@ nix run . -- mytrace.frames
 
 The flake provides the following:
 
+- **packages.rizin**: The pinned Rizin development revision
 - **packages.rz-tracetest**: The compiled `rz-tracetest` executable
 - **packages.default**: Alias for `rz-tracetest`
 - **devShells.default**: Development shell with all build dependencies
 - **formatter**: `nixfmt-tree` for Nix code formatting
 
+### Updating Rizin
+
+The pinned revision and fixed-output hashes are stored together in
+`nix/rizin/checksum.json`. From the repository root, update to the current
+Rizin `dev` branch with:
+
+```bash
+./nix/rizin/update.sh
+```
+
+To update to a specific full commit SHA instead:
+
+```bash
+./nix/rizin/update.sh <commit>
+```
+
+The updater recalculates the source and Meson dependency hashes, then builds
+both Rizin and `rz-tracetest`. It restores the previous checksum file if
+validation fails and does not create a commit.
+
 Adjustments to specific Archs/Sources/...
 -----------------------------------------
 
@@ -206,4 +233,4 @@ Stable releases of distros like Ubuntu or Debian pin older versions of Protobuf
       rm -rf build/
       cmake -Bbuild -GNinja
       ninja -C build
-      ```
+      ```

flake.nix

@@ -4,18 +4,13 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     flake-utils.url = "github:numtide/flake-utils";
-    b = {
-      url = "github:b1llow/nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
   };
 
   outputs =
     {
       self,
       nixpkgs,
       flake-utils,
-      b,
       ...
     }:
     flake-utils.lib.eachDefaultSystem (
@@ -37,7 +32,7 @@
           sha256 = "sha256-1f65TEIXncDD6N54Ton/VsoNYBoxEr1h0P2HIOSzI+o=";
         };
 
-        rizin = b.packages.${system}.rizin;
+        rizin = pkgs.callPackage ./nix/rizin { };
 
         rz-tracetest = pkgs.stdenv.mkDerivation {
           pname = "rz-tracetest";
@@ -82,7 +77,7 @@
         };
 
         packages = {
-          inherit rz-tracetest;
+          inherit rizin rz-tracetest;
           default = rz-tracetest;
         };
 

nix/rizin/checksum.json

@@ -0,0 +1,5 @@
+{
+  "rev": "38c3bed6c98ac52d234cf6c7eb9af7b860ce8c03",
+  "srcHash": "sha256-BxHdtF4SekQjYTedOzt8hR24VRHBdmtwQ5FFx34MkYs=",
+  "mesonDepsHash": "sha256-MYRYrrhWbQRkHaYfSAxPMnhqxFFSb5xAHirqP8Zy2AY="
+}

nix/rizin/default.nix

@@ -0,0 +1,84 @@
+{
+  cacert,
+  fetchFromGitHub,
+  git,
+  lib,
+  makeSetupHook,
+  meson,
+  rizin,
+  stdenvNoCC,
+}:
+
+let
+  checksums = builtins.fromJSON (builtins.readFile ./checksum.json);
+
+  src = fetchFromGitHub {
+    owner = "rizinorg";
+    repo = "rizin";
+    rev = checksums.rev;
+    hash = checksums.srcHash;
+  };
+
+  mesonDeps = stdenvNoCC.mkDerivation {
+    pname = "rizin-meson-deps";
+    version = builtins.substring 0 12 checksums.rev;
+    inherit src;
+
+    postUnpack = ''
+      rm "$sourceRoot/subprojects/sigdb.wrap"
+    '';
+
+    nativeBuildInputs = [
+      cacert
+      git
+      meson
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      meson subprojects download
+      find subprojects -type d -name .git -prune -exec rm -rf {} +
+      cp -r subprojects "$out"
+
+      runHook postBuild
+    '';
+
+    phases = [
+      "unpackPhase"
+      "buildPhase"
+    ];
+
+    impureEnvVars = lib.fetchers.proxyImpureEnvVars;
+    outputHashMode = "recursive";
+    outputHashAlgo = "sha256";
+    outputHash = checksums.mesonDepsHash;
+  };
+
+  mesonDepsConfigHook = makeSetupHook {
+    name = "rizin-meson-deps-config-hook";
+  } ./meson-deps-config-hook.sh;
+in
+rizin.overrideAttrs (prevAttrs: {
+  version = "unstable-${builtins.substring 0 12 checksums.rev}";
+  inherit src mesonDeps;
+
+  patches = builtins.filter (
+    patch: builtins.baseNameOf patch != "0001-fix-compilation-with-clang.patch"
+  ) (prevAttrs.patches or [ ]);
+
+  mesonFlags = [
+    "-Dportable=true"
+    "-Dinstall_sigdb=false"
+  ];
+
+  nativeBuildInputs = (prevAttrs.nativeBuildInputs or [ ]) ++ [ mesonDepsConfigHook ];
+  buildInputs = [ ];
+
+  # nixpkgs-update: no auto update
+  passthru = {
+    inherit mesonDeps;
+    updateScript = ./update.sh;
+    skipBulkUpdate = true;
+  };
+})

nix/rizin/meson-deps-config-hook.sh

@@ -0,0 +1,14 @@
+# shellcheck shell=bash
+
+mesonDepsConfigHook() {
+    if [[ -z ${mesonDeps-} ]]; then
+        echo "mesonDepsConfigHook: mesonDeps is not set" >&2
+        return 1
+    fi
+
+    rm -rf subprojects
+    cp -r "$mesonDeps" subprojects
+    chmod -R u+w subprojects
+}
+
+preConfigureHooks+=(mesonDepsConfigHook)

nix/rizin/update.sh

@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+usage() {
+    echo "Usage: $0 [RIZIN_COMMIT]" >&2
+}
+
+if (( $# > 1 )); then
+    usage
+    exit 2
+fi
+
+if [[ ${1:-} == "-h" || ${1:-} == "--help" ]]; then
+    usage
+    exit 0
+fi
+
+repo_root=$(git rev-parse --show-toplevel)
+checksum_file="$repo_root/nix/rizin/checksum.json"
+
+if [[ ! -f "$checksum_file" ]]; then
+    echo "Could not find $checksum_file; run this updater from the rz-tracetest checkout." >&2
+    exit 1
+fi
+
+if (( $# == 1 )); then
+    rev=$1
+else
+    remote_ref=$(git ls-remote https://github.com/rizinorg/rizin.git refs/heads/dev)
+    rev=${remote_ref%%[[:space:]]*}
+fi
+
+if [[ ! $rev =~ ^[0-9a-f]{40}$ ]]; then
+    echo "Expected a full 40-character Rizin commit SHA, got: $rev" >&2
+    exit 1
+fi
+
+source_url="https://github.com/rizinorg/rizin/archive/$rev.tar.gz"
+echo "Prefetching Rizin source at $rev"
+prefetch_json=$(nix store prefetch-file --json --unpack "$source_url")
+src_hash=$(printf '%s\n' "$prefetch_json" | sed -n 's/.*"hash"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
+
+if [[ $src_hash != sha256-* ]]; then
+    echo "Could not extract the Rizin source hash from: $prefetch_json" >&2
+    exit 1
+fi
+
+backup=$(mktemp)
+cp -- "$checksum_file" "$backup"
+
+restore_on_error() {
+    status=$?
+    if (( status != 0 )); then
+        cp -- "$backup" "$checksum_file"
+        echo "Update failed; restored $checksum_file" >&2
+    fi
+    rm -f -- "$backup"
+    return "$status"
+}
+trap restore_on_error EXIT
+
+write_checksums() {
+    target_rev=$1
+    target_src_hash=$2
+    target_deps_hash=$3
+    tmp=$(mktemp "${checksum_file}.tmp.XXXXXX")
+
+    printf '{\n  "rev": "%s",\n  "srcHash": "%s",\n  "mesonDepsHash": "%s"\n}\n' \
+        "$target_rev" "$target_src_hash" "$target_deps_hash" >"$tmp"
+    mv -- "$tmp" "$checksum_file"
+}
+
+fake_hash="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+write_checksums "$rev" "$src_hash" "$fake_hash"
+
+echo "Calculating the Meson dependency hash"
+set +e
+deps_log=$(nix build '.#rizin.mesonDeps' --no-link --print-build-logs 2>&1)
+deps_status=$?
+set -e
+
+if (( deps_status == 0 )); then
+    echo "The fake Meson dependency hash unexpectedly succeeded." >&2
+    exit 1
+fi
+
+meson_deps_hash=$(printf '%s\n' "$deps_log" | sed -n 's/.*got:[[:space:]]*\(sha256-[A-Za-z0-9+\/=]*\).*/\1/p' | tail -n 1)
+
+if [[ $meson_deps_hash != sha256-* ]]; then
+    printf '%s\n' "$deps_log" >&2
+    echo "Could not extract the Meson dependency hash from the Nix build." >&2
+    exit 1
+fi
+
+write_checksums "$rev" "$src_hash" "$meson_deps_hash"
+
+echo "Validating Rizin and rz-tracetest"
+nix build .#rizin --no-link --print-build-logs
+nix build .#rz-tracetest --no-link --print-build-logs
+
+echo "Updated nix/rizin/checksum.json"
+echo "  rev: $rev"
+echo "  srcHash: $src_hash"
+echo "  mesonDepsHash: $meson_deps_hash"