Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

singularity: 2.6.0 -> 3.0.1 #50939

Merged
merged 5 commits into from Feb 17, 2019
Merged

singularity: 2.6.0 -> 3.0.1 #50939

merged 5 commits into from Feb 17, 2019

Conversation

jbedo
Copy link
Contributor

@jbedo jbedo commented Nov 23, 2018

Motivation for this change

Update singularity to 3.x branch. Resolves #49269.

Provide rootless use of singularity for nixos via module configuration. Resolves #49683.

Things done
  • [ x] Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
  • Built on platform(s)
    • [ x] NixOS
    • macOS
    • other Linux distributions
  • Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
  • [x ] Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
  • [ x] Tested execution of all binary files (usually in ./result/bin/)
  • Determined the impact on package closure size (by running nix path-info -S before and after)
  • Assured whether relevant documentation is up to date
  • [ x] Fits CONTRIBUTING.md.

@jbedo
Copy link
Contributor Author

jbedo commented Nov 23, 2018

Not sure why the python commits came up there...

@jbedo
Copy link
Contributor Author

jbedo commented Jan 9, 2019

I've updated up this pull request for a cleaner commit history and also fixed a typo. Could we re-review?

@jbedo
Copy link
Contributor Author

jbedo commented Jan 9, 2019

Actually I failed to get rid of the two extra commits in this pull request that aren't mine; not sure why they're there. Any suggestions?

@veprbl
Copy link
Member

veprbl commented Jan 9, 2019

@jbedo Can do git rebase -i HEAD~4 and remove foreign commits.

@jbedo
Copy link
Contributor Author

jbedo commented Jan 10, 2019

Hmm it just pushed the problem back to an earlier commit.

@veprbl
Copy link
Member

veprbl commented Jan 10, 2019

You can see in output of git log --pretty=fuller the offending commit has you as committer (somehow you re-committed it, probably during rebase). You should have been able to fix this with git rebase -i. The solution is still the same: GIT_SEQUENCE_EDITOR="sed -i -e 1d" git rebase -i HEAD~3 should do the trick right now.

@jbedo
Copy link
Contributor Author

jbedo commented Jan 10, 2019

Thanks!

@veprbl
Copy link
Member

veprbl commented Jan 10, 2019

Is there a reason why are you not using buildGoPackage? It contains all the trickery to correctly deal with go builds.

https://nixos.org/nixpkgs/manual/#sec-language-go

@jbedo
Copy link
Contributor Author

jbedo commented Jan 10, 2019

Singularity has it's own configuration and build process different from most go packages. A custom config script generates makefiles which eventually call go build and go run during the build. Their build process requires some patching to stop it trying to fetch dependencies itself, not use dependencies it ships with, and prevent the install process from installing SUID binaries. I initially started trying to use buildGoPackage but ended up using a standard builder because it mostly doesn't apply to the Singularity build process.

@veprbl
Copy link
Member

veprbl commented Jan 10, 2019

Your current derivation includes go compiler in the closure. It's not a huge deal, but buildGoPackage has a fix for that using removeReferencesTo:

removeReferences = [ ] ++ lib.optional (!allowGoReference) go;
removeExpr = refs: ''remove-references-to ${lib.concatMapStrings (ref: " -t ${ref}") refs}'';

disallowedReferences = lib.optional (!allowGoReference) go
++ lib.optional (!dontRenameImports) govers;

@jbedo
Copy link
Contributor Author

jbedo commented Jan 10, 2019

Good point, I'll rewrite with the go builder.

@jbedo
Copy link
Contributor Author

jbedo commented Jan 10, 2019

It really didn't fit the go package builder as the install tree layout is not a standard gopkg install tree. I have instead removed references to go in the fixup stage.

@veprbl
Copy link
Member

veprbl commented Jan 11, 2019

@GrahamcOfBorg build singularity

@Mic92
Copy link
Member

Mic92 commented Jan 11, 2019

@jbedo it is still a good idea to stick with buildGoPackage as this automatically makes cross-compiling works. Also see #52469 (comment) for further motivations.

@jbedo
Copy link
Contributor Author

jbedo commented Jan 15, 2019

Ok, however all three phases will be have to be overridden and multiple outputs disabled. It would be interesting to see if cross-compiling works, but since it only runs on x86_64-linux I'm not sure how much value this would be.

@jbedo
Copy link
Contributor Author

jbedo commented Jan 30, 2019

Updated to use buildGoPackage.

'';

postFixup = ''
find $out/ -type f -executable -exec remove-references-to -t ${go} '{}' + || true
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be no longer necessary when using buildGoPackage.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
find $out/ -type f -executable -exec remove-references-to -t ${go} '{}' + || true

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately it is required as there are binaries outside of the bin/ directory that are not found by the default fixup.

@Mic92
Copy link
Member

Mic92 commented Jan 31, 2019

I just the following vm.nix in nixos-shell:

{ pkgs, ... }: {
  boot.kernelPackages = pkgs.linuxPackages_latest;
  services.openssh.enable = true;
  programs.singularity.enable = true;
}

but got the following error:

mv: cannot stat '/nix/store/wh092jwszihcsn9q8ysjri0ww3gxic70-singularity-3.0.1/libexec/singularity/bin/starter-suid': No such file or directory
builder for '/nix/store/aj5hjc0yzys9r3h7y03q1py4lfqgbiwi-singularity-3.0.1.drv' failed with exit code 1
error: build of '/nix/store/aj5hjc0yzys9r3h7y03q1py4lfqgbiwi-singularity-3.0.1.drv' on 'ssh://nix@eve.thalheim.io' failed: builder for '/nix/store/aj5hjc0yzys9r3h7y03q1py4lfqgbiwi-singularity
-3.0.1.drv' failed with exit code 1

@Mic92
Copy link
Member

Mic92 commented Jan 31, 2019

Works! Thanks for your effort.

@ryantm
Copy link
Member

ryantm commented Feb 17, 2019

This has a merge conflict with master now.

@ryantm
Copy link
Member

ryantm commented Feb 17, 2019

@GrahamcOfBorg build singularity

@ryantm ryantm merged commit f2e0856 into NixOS:master Feb 17, 2019
@astrojhgu
Copy link

astrojhgu commented Feb 26, 2019

The updated version works.

Minutes ago, I have just switched to unstable and try to use singularity, but it complains about UID error.

Then I struggled for a while and find that maybe this is caused by I turned on program.singularity and simultaneously put singularity in pkgs. Then the /run/current-system/sw/bin/singularity points to the latter one.

Finally I removed singularity in pkgs, and keep only program.singulariy enabled, then it works.

@nixos-discourse
Copy link

This pull request has been mentioned on Nix community. There might be relevant details there:

https://discourse.nixos.org/t/how-to-create-setuid-wrapper-for-installed-program/2590/6

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

8 participants