47 lines
1.5 KiB
Nix
47 lines
1.5 KiB
Nix
# Pinned upstream engine. This binary supplies an import/capability boundary;
|
|
# production execution additionally requires OS limits and platform approval
|
|
# for shared placement, or a workspace VM for unreviewed application code.
|
|
{ pkgs }:
|
|
let
|
|
version = "1.20261005.1";
|
|
platforms = {
|
|
x86_64-linux = {
|
|
name = "linux-64";
|
|
hash = "sha256-zm0T3YLo49ORPwR4iwP+WkQBMkiZQYftc+ArBQEoNGY=";
|
|
};
|
|
aarch64-linux = {
|
|
name = "linux-arm64";
|
|
hash = "sha256-jkvHyexr8Sn2wyqmLJJEOOGfAkfaVPLI7llHOX+FbxU=";
|
|
};
|
|
};
|
|
platform =
|
|
platforms.${pkgs.stdenv.hostPlatform.system}
|
|
or (throw "Restricted execution requires Linux x86_64 or aarch64");
|
|
in
|
|
pkgs.stdenvNoCC.mkDerivation {
|
|
pname = "quixos-workerd";
|
|
inherit version;
|
|
src = pkgs.fetchurl {
|
|
url = "https://registry.npmjs.org/@cloudflare/workerd-${platform.name}/-/workerd-${platform.name}-${version}.tgz";
|
|
inherit (platform) hash;
|
|
};
|
|
nativeBuildInputs = [ pkgs.autoPatchelfHook ];
|
|
buildInputs = [ pkgs.stdenv.cc.cc.lib ];
|
|
sourceRoot = "package";
|
|
installPhase = ''
|
|
runHook preInstall
|
|
install -Dm755 bin/workerd "$out/bin/workerd"
|
|
runHook postInstall
|
|
'';
|
|
doInstallCheck = true;
|
|
installCheckPhase = ''
|
|
"$out/bin/workerd" --version | grep -Fx 'workerd 2026-10-05'
|
|
'';
|
|
meta = {
|
|
description = "Pinned workerd engine for Quixos restricted execution";
|
|
homepage = "https://github.com/cloudflare/workerd";
|
|
license = pkgs.lib.licenses.asl20;
|
|
platforms = builtins.attrNames platforms;
|
|
};
|
|
}
|