scripts/heimdall-shim-static.sh
#!/bin/sh
# SPDX-License-Identifier: AGPL-3.0-only
# Heimdall's shim for the OS-less appliance (lane HOL-HEIMDALL-03): heimdall-container-shim of
# nordisk-heimdall-container (crates.io, the version below, --features youki), built STATIC for
# x86_64-unknown-linux-musl with libseccomp linked in statically, so the medium carries one file
# and the box needs no C library. libseccomp is the pinned release tarball, built with musl-gcc.
#
# Usage: scripts/heimdall-shim-static.sh <out-file>
# Runs the build in the toolchain container as its root (apt installs make and gperf there,
# the build side; the secure side never builds). `cargo xtask scan-worker stage` calls it when
# no shim is given (--heimdall-shim, $HOLGER_HEIMDALL_SHIM) and none is cached.
set -eu
HEIMDALL_CONTAINER_VERSION=0.2.1
LIBSECCOMP_VERSION=2.6.0
LIBSECCOMP_SHA256=83b6085232d1588c379dc9b9cae47bb37407cf262e6e74993c61ba72d2a784dc
IMG=${TOOLCHAIN_IMAGE:-localhost/nordisk-cargo-toolchain:ci4-53fec13a5c1c7f2c}
if [ "${HOLGER_SHIM_INNER:-}" != 1 ]; then
out=$1
mkdir -p "$(dirname "$out")"
work=$(mktemp -d "${TMPDIR:-/tmp}/heimdall-shim.XXXXXX")
reg=""
if [ -d "$HOME/.cargo/registry" ]; then reg="-v $HOME/.cargo/registry:/usr/local/cargo/registry"; fi
# shellcheck disable=SC2086
podman run --rm $reg -v "$work":/out -v "$(cd "$(dirname "$0")" && pwd)":/scripts:ro \
-e HOLGER_SHIM_INNER=1 -e CARGO_BUILD_JOBS="${CARGO_BUILD_JOBS:-16}" \
"$IMG" sh /scripts/heimdall-shim-static.sh
cp "$work/heimdall-container-shim" "$out"
rm -rf "$work"
echo "heimdall-container-shim $HEIMDALL_CONTAINER_VERSION (static musl, libseccomp $LIBSECCOMP_VERSION) -> $out"
exit 0
fi
apt-get update -qq >/dev/null
apt-get install -y -qq --no-install-recommends make gperf curl ca-certificates >/dev/null
cd /tmp
curl -sSfL -o libseccomp.tar.gz \
"https://github.com/seccomp/libseccomp/releases/download/v$LIBSECCOMP_VERSION/libseccomp-$LIBSECCOMP_VERSION.tar.gz"
echo "$LIBSECCOMP_SHA256 libseccomp.tar.gz" | sha256sum -c
tar xzf libseccomp.tar.gz
cd "libseccomp-$LIBSECCOMP_VERSION"
# musl-gcc sees no kernel headers: only linux/, asm/ and asm-generic/ from the system's, never
# glibc's own headers.
mkdir -p /tmp/kh
ln -sf /usr/include/linux /tmp/kh/linux
ln -sf /usr/include/asm-generic /tmp/kh/asm-generic
ln -sf /usr/include/x86_64-linux-gnu/asm /tmp/kh/asm
CC=musl-gcc CFLAGS="-O2 -I/tmp/kh" ./configure --quiet --prefix=/tmp/seccomp-musl --enable-static --disable-shared >/dev/null
make -s -j"${CARGO_BUILD_JOBS:-8}" >/dev/null
make -s install >/dev/null
LIBSECCOMP_LINK_TYPE=static LIBSECCOMP_LIB_PATH=/tmp/seccomp-musl/lib \
cargo install --quiet --locked --root /tmp/shim nordisk-heimdall-container \
--version "=$HEIMDALL_CONTAINER_VERSION" --features youki --bin heimdall-container-shim \
--target x86_64-unknown-linux-musl
cp /tmp/shim/bin/heimdall-container-shim /out/