Merged
Conversation
Contributor
Author
|
I suspect that Envoy's bazel build hashes won't be stable and I'll have to do some more surgery... |
ofborg
bot
requested review from
kalbasit,
matthewbauer,
primeos and
stesie
ofborg
bot
added
10.rebuild-darwin: 11-100
Contributor
Author
|
Result of 114 packages marked as broken and skipped:
45 packages failed to build:
144 packages built:
|
Contributor
Author
|
OK, this gn bump doesn't work with this v8 build... Taking a look. |
risicle
added
the
1.severity: security
Contributor
Contributor
Author
|
I'm going to fix this by importing a newer version of gn just for pomerium. |
Split into "current" version, as used by most things (aka gn), and "gn1924", which uses a more recent version of gn which is incompatible with the currently packaged version of v8 in nixpkgs. We can't win, but I need a newer version of gn for envoy. Note that the newer gn matches the version in Chromium's DEPS for v93.0.4577.82, the current Linux stable build as of September.
Contributor
Author
ofborg
bot
added
8.has: package (new)
This now uses gn1924 to allow v8 to build properly.
Contributor
Author
Contributor
Author
|
This is ready for review, but I don't know why OfBorg isn't happy with this; in particular, it's finding a link failure, which I can't reproduce locally building |
We can set an override path for Envoy's binary location now, so do that instead of the previous thing of embedding the binary. Note that we still need to include the SHA256/version of the binary we're referring to, but Through The Power Of Nix™ we can do that with relative ease.
Contributor
Author
|
@stesie @matthewbauer @primeos for changes to I tried to get things working, but between building Node and Chromium and Envoy's bundled V8 I couldn't make it work with just one gn version :( |
Contributor
|
Result of 3 packages built:
|
Contributor
|
Contributor
Author
You're gonna have to be more specific, I think? Your previous comment seemed to indicate you managed to build everything successfully. |
Contributor
|
@lukegb Honestly I was irritated myself. I was just quickly going over all security PRs and the second error came from |
This comment has been minimized.
This comment has been minimized.
Contributor
|
Full output: |
Contributor
|
build.nix contains { pkgs ? import ./nixpkgs { system = "x86_64-linux"; } }:
with pkgs;
let
paths = [
envoy
gn1924
pomerium
];
env = buildEnv {
name = "env";
inherit paths;
ignoreCollisions = true;
};
in stdenv.mkDerivation rec {
name = "review-shell";
preferLocalBuild = true;
allowSubstitutes = false;
buildInputs = if builtins.length paths > 50 then [ env ] else paths;
unpackPhase = ":";
installPhase = "touch $out";
} |
Contributor
|
I think it can be ignored |
Contributor
|
|
Contributor
Author
|
Ah right, I see the problem - because it includes gn as a dependency, the review shell inherited the gn build hook, which promptly failed because it couldn't actually find anything to actually build with gn. It's WAI but a little confusing. Thanks for the context. |
This was referenced Oct 5, 2022
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation for this change
Update Pomerium to latest version. Includes bumps to Envoy to match what upstream has done, and a bump to Gn because otherwise Envoy doesn't build.
Things done
sandbox = trueset innix.conf? (See Nix manual)nix-shell -p nixpkgs-review --run "nixpkgs-review wip"./result/bin/)