;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2017, 2018, 2019, 2020, 2022 Ludovic Courtès <ludo@gnu.org>
;;; Copyright © 2020 Mathieu Othacehe <othacehe@gnu.org>
;;; Copyright © 2022 Leo Nikkilä <hello@lnikki.la>
;;;
;;; This file is part of GNU Guix.
;;;
;;; GNU Guix is free software; you can redistribute it and/or modify it
;;; under the terms of the GNU General Public License as published by
;;; the Free Software Foundation; either version 3 of the License, or (at
;;; your option) any later version.
;;;
;;; GNU Guix is distributed in the hope that it will be useful, but
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;;; GNU General Public License for more details.
;;;
;;; You should have received a copy of the GNU General Public License
;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.

(define-module (gnu build shepherd)
  #:use-module (gnu system file-systems)
  #:use-module (gnu build linux-container)
  #:use-module (guix build utils)
  #:us</td></tr></table>
<table class='tabs'><tr><td>
<a href='/guix/about/'>about</a><a href='/guix/'>summary</a><a href='/guix/refs/?id=ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2'>refs</a><a href='/guix/log/etc/substitutes/ci.guix.info.pub'>log</a><a href='/guix/tree/etc/substitutes/ci.guix.info.pub?id=ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2'>tree</a><a class='active' href='/guix/commit/etc/substitutes/ci.guix.info.pub?id=ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2'>commit</a><a href='/guix/diff/etc/substitutes/ci.guix.info.pub?id=ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/etc/substitutes/ci.guix.info.pub'>
<input type='hidden' name='id' value='ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/commit/?id=ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2'>root</a>/<a href='/guix/commit/etc?id=ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2'>etc</a>/<a href='/guix/commit/etc/substitutes?id=ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2'>substitutes</a>/<a href='/guix/commit/etc/substitutes/ci.guix.info.pub?id=ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2'>ci.guix.info.pub</a></div><div class='content'><div class='cgit-panel'><b>diff options</b><form method='get'><input type='hidden' name='id' value='ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2'/><table><tr><td colspan='2'/></tr><tr><td class='label'>context:</td><td class='ctrl'><select name='context' onchange='this.form.submit();'><option value='1'>1</option><option value='2'>2</option><option value='3' selected='selected'>3</option><option value='4'>4</option><option value='5'>5</option><option value='6'>6</option><option value='7'>7</option><option value='8'>8</option><option value='9'>9</option><option value='10'>10</option><option value='15'>15</option><option value='20'>20</option><option value='25'>25</option><option value='30'>30</option><option value='35'>35</option><option value='40'>40</option></select></td></tr><tr><td class='label'>space:</td><td class='ctrl'><select name='ignorews' onchange='this.form.submit();'><option value='0' selected='selected'>include</option><option value='1'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><table summary='commit info' class='commit-info'>
<tr><th>author</th><td>Tobias Geerinckx-Rice &lt;me@tobias.gr&gt;</td><td class='right'>2021-12-16 01:12:10 +0100</td></tr>
<tr><th>committer</th><td>Tobias Geerinckx-Rice &lt;me@tobias.gr&gt;</td><td class='right'>2021-12-16 01:55:34 +0100</td></tr>
<tr><th>commit</th><td colspan='2' class='oid'><a href='/guix/commit/etc/substitutes/ci.guix.info.pub?id=ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2'>ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2</a> (<a href='/guix/patch/etc/substitutes/ci.guix.info.pub?id=ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2'>patch</a>)</td></tr>
<tr><th>tree</th><td colspan='2' class='oid'><a href='/guix/tree/?id=ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2'>cc528b9e85f93b440f3318d33e97b5a4b1a295cd</a> /<a href='/guix/tree/etc/substitutes/ci.guix.info.pub?id=ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2'>etc/substitutes/ci.guix.info.pub</a></td></tr>
<tr><th>parent</th><td colspan='2' class='oid'><a href='/guix/commit/etc/substitutes/ci.guix.info.pub?id=18b1497673b92b6a0947839f9757a561a77d0d5f'>18b1497673b92b6a0947839f9757a561a77d0d5f</a> (<a href='/guix/diff/etc/substitutes/ci.guix.info.pub?id=ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2&amp;id2=18b1497673b92b6a0947839f9757a561a77d0d5f'>diff</a>)</td></tr><tr><th>download</th><td colspan='2' class='oid'><a href='/guix/snapshot/guix-ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2.tar.gz'>guix-ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2.tar.gz</a><br/><a href='/guix/snapshot/guix-ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2.zip'>guix-ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2.zip</a><br/></td></tr></table>
<div class='commit-subject'>gnu: nss-certs: Avoid top-level reference to NSS.</div><div class='commit-msg'>This is the only hammer I know for dealing with module cycles and
effectively fixes, for example, ‘guix show nss’ today.

It's also a very poor solution.

* gnu/packages/certs.scm (nss-certs)[version, source]: Copy verbatim
from the nss package rather than referring to it at the top level.

Reported by several users of #guix.
</div><div class='diffstat-header'><a href='/guix/diff/?id=ceb9c6c50ed2c0d127189bb5d28832b6538aa7a2'>Diffstat</a> (limited to 'etc/substitutes/ci.guix.info.pub')</div><table summary='diffstat' class='diffstat'></table><div class='diffstat-summary'>0 files changed, 0 insertions, 0 deletions</div><table summary='diff' class='diff'><tr><td></td></tr></table></div> <!-- class=content -->
                         <div class=footer>generated by
                             <a href="https://git.zx2c4.com/cgit/about/">
                                 cgit
                             </a>
                         </div>
                        </div> <!-- id=cgit -->
</body>
</html>
'(mnt ipc).  MAPPINGS is the
list of <file-system-mapping> to make in the case of a separate mount
namespace, in addition to essential bind-mounts such /proc."
  (define container-directory
    (match command
      ((program _  ...)
       (string-append "/var/run/containers/" (basename program)))))

  (define auto-mappings
    `(,@(if log-file
            (list (file-system-mapping
                   (source log-file)
                   (target source)
                   (writable? #t)))
            '())))

  (define mounts
    (append (map file-system-mapping->bind-mount
                 (append auto-mappings mappings))
            (default-mounts #:namespaces namespaces)))

  (lambda args
    (mkdir-p container-directory)

    (when log-file
      ;; Create LOG-FILE so we can map it in the container.
      (unless (file-exists? log-file)
        (call-with-output-file log-file (const #t))
        (when user
          (let ((pw (getpwnam user)))
            (chown log-file (passwd:uid pw) (passwd:gid pw))))))

    (let ((pid (run-container container-directory
                              mounts namespaces 1
                              (lambda ()
                                (exec-command* command
                                               #:user user
                                               #:group group
                                               #:supplementary-groups
                                               supplementary-groups
                                               #:pid-file pid-file
                                               #:log-file log-file
                                               #:directory directory
                                               #:environment-variables
                                               environment-variables)))))
      (if pid-file
          (if (or (memq 'mnt namespaces) (memq 'pid namespaces))
              (read-pid-file/container pid pid-file
                                       #:max-delay pid-file-timeout)
              (read-pid-file pid-file #:max-delay pid-file-timeout))
          pid))))

(define* (fork+exec-command/container command
                                      #:key pid
                                      #:allow-other-keys
                                      #:rest args)
  "This is a variant of 'fork+exec-command' procedure, that joins the
namespaces of process PID beforehand.  If there is no support for containers,
on Hurd systems for instance, fallback to direct forking."
  (define (strip-pid args)
    ;; TODO: Replace with 'strip-keyword-arguments' when that no longer pulls
    ;; in (guix config).
    (let loop ((args args)
               (result '()))
      (match args
        (()
         (reverse result))
        ((#:pid _ . rest)
         (loop rest result))
        ((head . rest)
         (loop rest (cons head result))))))

  (let ((container-support? (file-exists? "/proc/self/ns")))
    (if (and container-support?
             (not (and pid (= pid (getpid)))))
        (container-excursion* pid
          (lambda ()
            ;; Note: In the Shepherd 0.9, 'fork+exec-command' expects to be
            ;; called from the shepherd process (because it creates a pipe to
            ;; capture stdout/stderr and spawns a logging fiber) so we cannot
            ;; use it here.
            (match (primitive-fork)
              (0 (dynamic-wind
                   (const #t)
                   (lambda ()
                     (apply exec-command* command (strip-pid args)))
                   (lambda ()
                     (primitive-_exit 127))))
              (pid pid))))               ;XXX: assuming the same PID namespace
        (apply fork+exec-command command (strip-pid args)))))

;; Local Variables:
;; eval: (put 'container-excursion* 'scheme-indent-function 1)
;; End:

;;; shepherd.scm ends here