32
flake.nix
32
flake.nix
@@ -95,34 +95,34 @@
|
||||
# harden env
|
||||
unset LD_PRELOAD LD_LIBRARY_PATH LD_AUDIT LD_DEBUG LD_PROFILE LD_USE_LOAD_BIAS LD_ORIGIN_PATH LD_ASSUME_KERNEL
|
||||
|
||||
: "${TMPDIR:=/tmp}"
|
||||
EXTRACT_DIR="$(mktemp -d "${TMPDIR%/}/nxbdl.XXXXXX")"
|
||||
cleanup() { [ -n "${KEEP_BUNDLE:-}" ] || rm -rf "$EXTRACT_DIR"; }
|
||||
: "''${TMPDIR:=/tmp}"
|
||||
EXTRACT_DIR="$(mktemp -d "''${TMPDIR%/}/nxbdl.XXXXXX")"
|
||||
cleanup() { [ -n "''${KEEP_BUNDLE:-}" ] || rm -rf "$EXTRACT_DIR"; }
|
||||
trap cleanup EXIT INT TERM
|
||||
|
||||
ARCHIVE_LINE=$(awk '/^__ARCHIVE_BELOW__/ {print NR+1; exit 0}' "$0")
|
||||
# portable vs tail -n +N
|
||||
sed -n "${ARCHIVE_LINE},\$p" "$0" | tar -xzf - -C "$EXTRACT_DIR"
|
||||
sed -n "''${ARCHIVE_LINE},\$p" "$0" | tar -xzf - -C "$EXTRACT_DIR"
|
||||
|
||||
BUNDLE_PWD="${BUNDLE_PWD:-$PWD}"
|
||||
BUNDLE_PWD="''${BUNDLE_PWD:-$PWD}"
|
||||
|
||||
cd "$EXTRACT_DIR"
|
||||
APP_REL='__APP_REL__'
|
||||
PROOT_REL='__PROOT_REL__'
|
||||
|
||||
# choose proot: env -> host -> bundled
|
||||
if [ -n "${BUNDLE_PROOT:-}" ] && command -v "${BUNDLE_PROOT}" >/dev/null 2>&1; then
|
||||
PROOT_BIN="${BUNDLE_PROOT}"
|
||||
if [ -n "''${BUNDLE_PROOT:-}" ] && command -v "''${BUNDLE_PROOT}" >/dev/null 2>&1; then
|
||||
PROOT_BIN="''${BUNDLE_PROOT}"
|
||||
elif command -v proot >/dev/null 2>&1; then
|
||||
PROOT_BIN="$(command -v proot)"
|
||||
else
|
||||
PROOT_BIN="$EXTRACT_DIR${PROOT_REL}"
|
||||
PROOT_BIN="$EXTRACT_DIR''${PROOT_REL}"
|
||||
fi
|
||||
[ "${BUNDLE_FORCE_BUNDLED_PROOT:-0}" = 1 ] && PROOT_BIN="$EXTRACT_DIR${PROOT_REL}"
|
||||
[ "''${BUNDLE_FORCE_BUNDLED_PROOT:-0}" = 1 ] && PROOT_BIN="$EXTRACT_DIR''${PROOT_REL}"
|
||||
|
||||
# sanity
|
||||
[ -x "$PROOT_BIN" ] || { echo "proot not found/executable: $PROOT_BIN" >&2; exit 127; }
|
||||
[ -x "$EXTRACT_DIR${APP_REL}" ] || { echo "app not found/executable: $EXTRACT_DIR${APP_REL}" >&2; exit 127; }
|
||||
[ -x "$EXTRACT_DIR''${APP_REL}" ] || { echo "app not found/executable: $EXTRACT_DIR''${APP_REL}" >&2; exit 127; }
|
||||
|
||||
# DNS for Android/termux (no /etc/resolv.conf in root)
|
||||
mkdir -p "$EXTRACT_DIR/etc"
|
||||
@@ -134,22 +134,22 @@
|
||||
EOF
|
||||
|
||||
# run proot (no exec so trap can clean). Set BUNDLE_EXEC=1 to exec instead.
|
||||
if [ "${BUNDLE_EXEC:-0}" = 1 ]; then
|
||||
exec "${PROOT_BIN}" \
|
||||
if [ "''${BUNDLE_EXEC:-0}" = 1 ]; then
|
||||
exec "''${PROOT_BIN}" \
|
||||
-R / \
|
||||
-b "$EXTRACT_DIR/nix:/nix" \
|
||||
-b "$EXTRACT_DIR/etc/resolv.conf:/etc/resolv.conf" \
|
||||
-b /dev -b /proc -b /sys \
|
||||
-w "$BUNDLE_PWD" \
|
||||
"$EXTRACT_DIR${APP_REL}" "$@"
|
||||
"$EXTRACT_DIR''${APP_REL}" "$@"
|
||||
else
|
||||
"${PROOT_BIN}" \
|
||||
"''${PROOT_BIN}" \
|
||||
-R / \
|
||||
-b "$EXTRACT_DIR/nix:/nix" \
|
||||
-b "$EXTRACT_DIR/etc/resolv.conf:/etc/resolv.conf" \
|
||||
-b /dev -b /proc -b /sys \
|
||||
-w "$BUNDLE_PWD" \
|
||||
"$EXTRACT_DIR${APP_REL}" "$@"
|
||||
"$EXTRACT_DIR''${APP_REL}" "$@"
|
||||
fi
|
||||
|
||||
__ARCHIVE_BELOW__
|
||||
@@ -158,7 +158,7 @@
|
||||
# 5) inject paths, chmod, and append payload
|
||||
sed -i \
|
||||
-e "s|__APP_REL__|$APP_REL|g" \
|
||||
-e "s|__PROOT_REL__|${PROOT_REL}|g" \
|
||||
-e "s|__PROOT_REL__|''${PROOT_REL}|g" \
|
||||
"$out"
|
||||
chmod +x "$out"
|
||||
cat "$_TMP/payload.tar.gz" >> "$out"
|
||||
|
||||
Reference in New Issue
Block a user