feat(packaging): hermetic Nix build + -DVMLINUX_H for reproducible BPF builds - #305
Merged
Conversation
…F builds Adds packaging/nix/ — a hermetic Nix build of the agent, the basis for a NixOS/nixpkgs submission. Verified end-to-end in a nixos/nix container (nix-build -> working `aegisbpf version`), no network, no /sys/kernel/btf. Build-system change enabling it: - CMake: new -DVMLINUX_H=<path> option supplies a pre-generated vmlinux.h instead of dumping the running kernel's BTF, so the BPF object builds in a sandbox. CO-RE keeps the object portable regardless of the header's source kernel. Default behaviour (generate from live BTF) is unchanged. packaging/nix/: - package.nix — the derivation. Unwrapped LLVM-18 clang for the BPF object (the stdenv cc-wrapper injects hardening flags the bpf target rejects; LLVM 18 matches the tested clang matrix and stays under the 512-byte BPF stack limit), linuxHeaders via CPATH for asm-generic/*, zstd for libelf's pkg-config, ENABLE_RUST_PARSER_LINK=OFF (no cargo needed). Absolute /etc install paths redirected under $out. - test-default.nix — pins nixpkgs; local `nix-build` entry point. - vmlinux.x86_64.h — checked-in CO-RE header (same approach as ebpf_exporter). - README.md — build instructions + rationale for each input. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Foundation for a
NixOS/nixpkgssubmission of AegisBPF, plus a reproducible-build improvement that stands on its own.Build-system change
-DVMLINUX_H=<path>— supply a pre-generatedvmlinux.hinstead of dumping the running kernel's BTF (/sys/kernel/btf/vmlinux). This makes the BPF object build hermetic — no kernel BTF at build time — which is required for sandboxed distro packaging (Nix, rpm/deb) and helps CI reproducibility. CO-RE relocates field offsets against the target kernel at load, so the object stays portable regardless of the header's source kernel. Default behaviour is unchanged (still generatesvmlinux.hfrom the live kernel BTF when-DVMLINUX_His not passed).packaging/nix/A hermetic Nix build, verified end-to-end in a
nixos/nixcontainer (nix-build→ workingaegisbpf version; no network, no/sys/kernel/btf):package.nix— the derivation. Notable choices (each one solved a real sandbox failure): unwrapped LLVM-18 clang for the BPF object (the stdenv cc-wrapper injects-fzero-call-used-regsetc. that-target bpfrejects; LLVM 18 matches the tested clang-15/17/18 matrix and stays under the 512-byte BPF stack limit),linuxHeadersviaCPATHforasm-generic/*,zstdfor elfutils'libelf.pc,ENABLE_RUST_PARSER_LINK=OFF(no cargo). Absolute/etcinstall paths redirected under$out.test-default.nix— pins nixpkgs; localnix-buildentry point.vmlinux.x86_64.h— checked-in CO-RE header (bpftool btf dump … format c), the same approach upstream CO-RE projects likecloudflare/ebpf_exporteruse for reproducible packaging. ~166k lines; it defines the kernel types the BPF program references so the sandbox build needs no BTF.README.md— build steps + rationale for each input.Why the checked-in header
There is no reliable BTF inside a hermetic sandbox, and generating one at build time would add a fragile network fetch. Shipping the header is the accepted CO-RE/nixpkgs pattern and keeps
nix-build packaging/nix/test-default.nixworking for anyone who clones the repo.Next
The
NixOS/nixpkgspackage (pkgs/by-name/ae/aegisbpf/) fetches a pinned commit of this repo viafetchFromGitHuband reuses this build logic; it goes up once this merges.🤖 Generated with Claude Code