nordisk/heimdall

bench/znippy-unpack/measure.sh

#!/bin/sh
# SPDX-License-Identifier: AGPL-3.0-only
# Heimdall is a defensive sandbox. Probe `znippy` unpacking (learning mode, seccomp
# USER_NOTIF) over profiles/znippy-unpack/workload.toml, then generate the profile.
# Privileged rootless podman (heim-m0); the runs' {tmp} (several GB) under TMPDIR on /home.
set -eu
D=$(cd "$(dirname "$0")" && pwd)
H=${HEIMDALL_BIN:-$HOME/tgt/heim-prof/release/heimdall}
mkdir -p "$D/tmp"
exec podman run --rm --privileged -v "$D":"$D" -v "$H":/heimdall:ro -e TMPDIR="$D/tmp" \
  -w "$D" localhost/nordisk-cargo-toolchain:heim-m0 sh -c "
set -e
/heimdall profile probe znippy-unpack --profiles $D/profiles --libc glibc
/heimdall profile gen znippy-unpack --profiles $D/profiles --libc glibc
sha256sum $D/profiles/znippy-unpack/x86_64-glibc.oci.json"