feat: diffutils build

.github/workflows/diffutils.yml

@@ -0,0 +1,30 @@
+name: Build diffutils
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version of diffutils"
+        required: true
+        default: 3.8
+        type: string
+jobs:
+  gpg:
+    name: Build
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+      - name: Init Hermit
+        run: ./bin/hermit env --raw >> $GITHUB_ENV
+      - name: Build
+        run: make VERSION=${{ inputs.version }} -C diffutils
+      - name: Upload Release
+        uses: ncipollo/release-action@v1
+        with:
+          tag: diffutils
+          allowUpdates: true
+          artifacts: "diffutils/diffutils-*.tar.xz"
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/go-tools.yml

@@ -1,3 +1,4 @@
+name: Build Go tools
 on:
   workflow_dispatch:
   push:

.github/workflows/gotip.yml

@@ -1,3 +1,4 @@
+name: Build Go tip
 on:
   workflow_dispatch:
   push:

.github/workflows/gpg.yml

@@ -1,3 +1,4 @@
+name: Build gpg
 on:
   workflow_dispatch:
 jobs:

.github/workflows/mysql-client.yml

@@ -1,4 +1,4 @@
-name: mysql client binaries lightweight packages
+name: MySQL client binaries lightweight packages
 on:
   workflow_dispatch:
   push:

.github/workflows/protoc-gen-swift.yml

@@ -1,4 +1,4 @@
-name: protoc-gen-swift
+name: Build protoc-gen-swift
 on:
   workflow_dispatch:
     inputs:

.gitignore

@@ -1,3 +1,5 @@
 /gotip/goroot
 /gotip/go-*
 /go-tools/*.bz2
+*/build/*
+*/dist/*

bin/hermit.hcl

@@ -0,0 +1,3 @@
+env = {
+  "PATH": "${HERMIT_ENV}/scripts:${PATH}",
+}

diffutils/Makefile

@@ -0,0 +1,22 @@
+VERSION ?= 3.8
+DESTDIR ?= $(CURDIR)/dist
+OS = $(shell go env GOOS)
+ARCH = $(shell go env GOARCH)
+
+.PHONY: all
+all: diffutils.tar.xz
+	rm -rf build
+	mkdir build
+	tar -C build --strip-components 1 -xvf diffutils.tar.xz 
+	sandbox $(MAKE) -C build -f ../Makefile build
+	mv build/dist diffutils-$(VERSION)
+	tar cfJv diffutils-$(VERSION)-$(OS)-$(ARCH).tar.xz diffutils-$(VERSION)
+
+.PHONY: build
+build:
+	./configure --prefix=/ --disable-rpath
+	$(MAKE) -j8
+	$(MAKE) DESTDIR=$(DESTDIR) install
+
+diffutils.tar.xz:
+	curl -L https://ftpmirror.gnu.org/diffutils/diffutils-$(VERSION).tar.xz -o diffutils.tar.xz

sandbox.sb

@@ -0,0 +1,36 @@
+(version 1)
+(deny default)
+(import "/System/Library/Sandbox/Profiles/bsd.sb")
+
+;(allow network* (local ip "localhost:*"))
+;(allow network* (remote ip "localhost:*"))
+(allow network* (remote unix-socket))
+
+(system-network)
+
+(allow mach-lookup
+  (global-name "com.apple.diagnosticd")
+  (global-name "com.apple.system.logger"))
+
+(allow file-read*)
+(deny file-read*
+  (subpath "/opt/")
+  (subpath "/usr/local/")
+)
+
+(deny file-write*)
+(allow file-write*
+  (subpath "/dev/")
+  (subpath "/tmp/")
+  (subpath (param "HERMIT_STATE_DIR"))
+  (subpath (param "TMPDIR"))
+  (subpath (param "BUILD_DIR"))
+)
+
+(allow process-exec*)
+(deny process-exec*
+  (subpath "/opt/")
+  (subpath "/usr/local/")
+)
+
+(allow process-fork)

scripts/sandbox

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+root="$( cd "$( dirname "${BASH_SOURCE[0]}" )"/.. && pwd )"
+
+case "$(uname -s)" in
+Darwin)
+  # This is to prevent builds using dependencies from /opt and /usr/local.
+  sandbox-exec -D TMPDIR="/private$TMPDIR" -D BUILD_DIR="${root}" -D HERMIT_STATE_DIR="${HOME}/Library/Caches/hermit" -f "${root}/sandbox.sb" "$@"
+  ;;
+*)
+  # Not ideal, in that we still might end up with extra dependencies, but at least they will be static.
+  export CFLAGS="-static"
+  export CXXFLAGS="-static"
+  export LDFLAGS="-static"
+  exec "$@"
+  ;;
+esac