Implement VM-scoped restricted registry transport

2026-10-07 04:04:32 -07:00
parent 1f7aa80130
commit 47fcb47d5c
10 changed files with 1051 additions and 5 deletions
@@ -0,0 +1,45 @@
+# Pinned upstream engine. This binary supplies an import/capability boundary;
+# production execution additionally requires a workspace VM and OS limits.
+{ pkgs }:
+let
+  version = "1.20261005.1";
+  platforms = {
+    x86_64-linux = {
+      name = "linux-64";
+      hash = "sha256-zm0T3YLo49ORPwR4iwP+WkQBMkiZQYftc+ArBQEoNGY=";
+    };
+    aarch64-linux = {
+      name = "linux-arm64";
+      hash = "sha256-jkvHyexr8Sn2wyqmLJJEOOGfAkfaVPLI7llHOX+FbxU=";
+    };
+  };
+  platform =
+    platforms.${pkgs.stdenv.hostPlatform.system}
+      or (throw "Restricted execution requires Linux x86_64 or aarch64");
+in
+pkgs.stdenvNoCC.mkDerivation {
+  pname = "quixos-workerd";
+  inherit version;
+  src = pkgs.fetchurl {
+    url = "https://registry.npmjs.org/@cloudflare/workerd-${platform.name}/-/workerd-${platform.name}-${version}.tgz";
+    inherit (platform) hash;
+  };
+  nativeBuildInputs = [ pkgs.autoPatchelfHook ];
+  buildInputs = [ pkgs.stdenv.cc.cc.lib ];
+  sourceRoot = "package";
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 bin/workerd "$out/bin/workerd"
+    runHook postInstall
+  '';
+  doInstallCheck = true;
+  installCheckPhase = ''
+    "$out/bin/workerd" --version | grep -Fx 'workerd 2026-10-05'
+  '';
+  meta = {
+    description = "Pinned workerd engine for VM-scoped Quixos restricted execution";
+    homepage = "https://github.com/cloudflare/workerd";
+    license = pkgs.lib.licenses.asl20;
+    platforms = builtins.attrNames platforms;
+  };
+}