From 2b6d0e01434b86f6000277ca30d110b002a6808d Mon Sep 17 00:00:00 2001 From: Roman Langolf Date: Sat, 12 Sep 2026 12:34:52 +0700 Subject: [PATCH 1/3] add nix flake --- .github/workflows/nix.yml | 50 ++++++++++++++++++ flake.lock | 61 ++++++++++++++++++++++ flake.nix | 103 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 214 insertions(+) create mode 100644 .github/workflows/nix.yml create mode 100644 flake.lock create mode 100644 flake.nix diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml new file mode 100644 index 0000000..a4573bc --- /dev/null +++ b/.github/workflows/nix.yml @@ -0,0 +1,50 @@ +name: Nix + +on: + pull_request: + branches: ['**', '!update/**', '!pr/**'] + paths: + - 'flake.nix' + - 'flake.lock' + - '.github/workflows/nix.yml' + push: + branches: ['**', '!update/**', '!pr/**'] + tags: [v*] + paths: + - 'flake.nix' + - 'flake.lock' + - '.github/workflows/nix.yml' + +concurrency: + group: nix @ ${{ github.workflow }} @ ${{ github.ref }} + cancel-in-progress: true + +jobs: + flake-check: + name: Build & smoke test + strategy: + fail-fast: false + matrix: + os: + - ubuntu-latest + - ubuntu-24.04-arm + - macos-latest + runs-on: ${{ matrix.os }} + steps: + - uses: actions/checkout@v4 + + - uses: cachix/install-nix-action@v27 + with: + extra_nix_config: | + experimental-features = nix-command flakes + + - name: Check flake + run: nix flake check -L + + - name: Build dumbo package + run: nix build .#dumbo -L + + - name: Smoke test binary + run: | + ./result/bin/dumbo -v + ./result/bin/dumbo help diff --git a/flake.lock b/flake.lock new file mode 100644 index 0000000..5998912 --- /dev/null +++ b/flake.lock @@ -0,0 +1,61 @@ +{ + "nodes": { + "flake-utils": { + "inputs": { + "systems": "systems" + }, + "locked": { + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "nixpkgs": { + "locked": { + "lastModified": 1788039129, + "narHash": "sha256-pa4Q0qErvCvzCaaUph7Sm37RhR4xvPrYI8Lgz6k85+A=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "d2f67949798825fe853f7c5d0492b8bf016d3f88", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "root": { + "inputs": { + "flake-utils": "flake-utils", + "nixpkgs": "nixpkgs" + } + }, + "systems": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..3665314 --- /dev/null +++ b/flake.nix @@ -0,0 +1,103 @@ +{ + description = "dumbo - a Flyway compatible database migration tool for Postgres"; + + inputs = { + nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; + flake-utils.url = "github:numtide/flake-utils"; + }; + + outputs = + { self, nixpkgs, flake-utils }: + flake-utils.lib.eachDefaultSystem ( + system: + let + pkgs = import nixpkgs { inherit system; }; + + version = "0.10.2"; + + # Release assets from https://github.com/rolang/dumbo/releases + # Update `version` and these hashes together when bumping. + # Get a hash with: nix-prefetch-url --type sha256 + assets = { + x86_64-linux = { + asset = "dumbo-cli-x86_64-linux"; + sha256 = "0pkligx760csm9mmbdl2mq3abhn1ib8jl6rilgh6x7hxa6j07m18"; + }; + aarch64-linux = { + asset = "dumbo-cli-aarch64-linux"; + sha256 = "0rgsg8a52h3q57d460kb6bzv1wm4v5rcb7y0qzxw1lh57qp96q5h"; + }; + aarch64-darwin = { + asset = "dumbo-cli-aarch64-macosx"; + sha256 = "1f2ns0glccw0zb2w21fwsl81xmqa4a7qdqv0adwypbpbxvkcx1r2"; + }; + }; + + asset = assets.${system} or (throw "dumbo: no release binary for system '${system}'"); + + dumbo = pkgs.stdenv.mkDerivation { + pname = "dumbo"; + inherit version; + + src = pkgs.fetchurl { + url = "https://github.com/rolang/dumbo/releases/download/v${version}/${asset.asset}"; + sha256 = asset.sha256; + }; + + dontUnpack = true; + dontBuild = true; + dontStrip = true; # scala-native binaries aren't stdenv-built ELF/Mach-O, avoid re-stripping surprises + + nativeBuildInputs = pkgs.lib.optionals pkgs.stdenv.hostPlatform.isLinux [ pkgs.autoPatchelfHook ]; + + buildInputs = pkgs.lib.optionals pkgs.stdenv.hostPlatform.isLinux [ + pkgs.s2n-tls + pkgs.utf8proc + pkgs.openssl + pkgs.zlib + pkgs.stdenv.cc.cc.lib + ]; + + installPhase = '' + runHook preInstall + install -Dm755 "$src" "$out/bin/dumbo" + runHook postInstall + ''; + + # The macOS release binary is dynamically linked against Homebrew's + # absolute install paths (/opt/homebrew/opt/...). Repoint those at + # the equivalent nixpkgs outputs. NOTE: untested on real Darwin — + # verify the exact dylib basenames/versions match before relying on this. + postFixup = pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isDarwin '' + install_name_tool -change \ + /opt/homebrew/opt/s2n/lib/libs2n.1.dylib \ + ${pkgs.s2n-tls}/lib/libs2n.1.dylib \ + "$out/bin/dumbo" + install_name_tool -change \ + /opt/homebrew/opt/utf8proc/lib/libutf8proc.3.dylib \ + ${pkgs.utf8proc}/lib/libutf8proc.3.dylib \ + "$out/bin/dumbo" + install_name_tool -change \ + /opt/homebrew/opt/openssl@3/lib/libcrypto.3.dylib \ + ${pkgs.openssl}/lib/libcrypto.3.dylib \ + "$out/bin/dumbo" + ''; + + meta = { + description = "Flyway compatible database migration tool for Postgres"; + homepage = "https://github.com/rolang/dumbo"; + license = pkgs.lib.licenses.mit; + platforms = builtins.attrNames assets; + mainProgram = "dumbo"; + sourceProvenance = [ pkgs.lib.sourceTypes.binaryNativeCode ]; + }; + }; + in + { + packages.default = dumbo; + packages.dumbo = dumbo; + + apps.default = flake-utils.lib.mkApp { drv = dumbo; }; + } + ); +} From 1bdedf7d87b2db83b7aae5e058e61ca1f7be5c52 Mon Sep 17 00:00:00 2001 From: Roman Langolf Date: Sat, 12 Sep 2026 13:37:27 +0700 Subject: [PATCH 2/3] bump cachix/install-nix-action --- .github/workflows/nix.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml index a4573bc..36a94ab 100644 --- a/.github/workflows/nix.yml +++ b/.github/workflows/nix.yml @@ -33,7 +33,7 @@ jobs: steps: - uses: actions/checkout@v4 - - uses: cachix/install-nix-action@v27 + - uses: cachix/install-nix-action@v31 with: extra_nix_config: | experimental-features = nix-command flakes From 82c02ca6ae34b37a6303ede37d05bca64a38cc02 Mon Sep 17 00:00:00 2001 From: Roman Langolf Date: Sat, 12 Sep 2026 13:53:06 +0700 Subject: [PATCH 3/3] fix macOS package: wrap binary instead of patching install names install_name_tool -change/-add_rpath fails on the release binary ("larger updated load commands do not fit") since it wasn't linked with -headerpad_max_install_names and nixpkgs store paths are longer than the original Homebrew ones. Wrap the binary to set DYLD_FALLBACK_LIBRARY_PATH instead, which avoids touching load commands (and avoids invalidating the binary's code signature). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01VCAcj78CqA1v1gmfYqjx7o --- flake.nix | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/flake.nix b/flake.nix index 3665314..f14b2a4 100644 --- a/flake.nix +++ b/flake.nix @@ -48,7 +48,8 @@ dontBuild = true; dontStrip = true; # scala-native binaries aren't stdenv-built ELF/Mach-O, avoid re-stripping surprises - nativeBuildInputs = pkgs.lib.optionals pkgs.stdenv.hostPlatform.isLinux [ pkgs.autoPatchelfHook ]; + nativeBuildInputs = pkgs.lib.optionals pkgs.stdenv.hostPlatform.isLinux [ pkgs.autoPatchelfHook ] + ++ pkgs.lib.optionals pkgs.stdenv.hostPlatform.isDarwin [ pkgs.makeWrapper ]; buildInputs = pkgs.lib.optionals pkgs.stdenv.hostPlatform.isLinux [ pkgs.s2n-tls @@ -65,22 +66,21 @@ ''; # The macOS release binary is dynamically linked against Homebrew's - # absolute install paths (/opt/homebrew/opt/...). Repoint those at - # the equivalent nixpkgs outputs. NOTE: untested on real Darwin — - # verify the exact dylib basenames/versions match before relying on this. + # absolute install paths (/opt/homebrew/opt/...), which don't exist + # in the Nix sandbox. It wasn't linked with -headerpad_max_install_names, + # so `install_name_tool -change`/`-add_rpath` fail ("larger updated + # load commands do not fit") since nixpkgs store paths are longer + # than the original Homebrew ones. Rather than rewriting load + # commands (which would also invalidate the binary's code + # signature), wrap it so dyld falls back to the nixpkgs libs when + # the hardcoded Homebrew paths can't be found. postFixup = pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isDarwin '' - install_name_tool -change \ - /opt/homebrew/opt/s2n/lib/libs2n.1.dylib \ - ${pkgs.s2n-tls}/lib/libs2n.1.dylib \ - "$out/bin/dumbo" - install_name_tool -change \ - /opt/homebrew/opt/utf8proc/lib/libutf8proc.3.dylib \ - ${pkgs.utf8proc}/lib/libutf8proc.3.dylib \ - "$out/bin/dumbo" - install_name_tool -change \ - /opt/homebrew/opt/openssl@3/lib/libcrypto.3.dylib \ - ${pkgs.openssl}/lib/libcrypto.3.dylib \ - "$out/bin/dumbo" + wrapProgram "$out/bin/dumbo" \ + --set DYLD_FALLBACK_LIBRARY_PATH "${pkgs.lib.makeLibraryPath [ + pkgs.s2n-tls + pkgs.utf8proc + pkgs.openssl + ]}" ''; meta = {