Static binaries, musl and glibc-contamination

[kpcyrd]

Hello!

I'm using nix together with naersk+fenix to build a statically linked binary using the following flake.nix (nix is used as build environment, and explicitly not meant to be a runtime dependency):

{
  inputs = {
    fenix.url = "github:nix-community/fenix";
    flake-utils.url = "github:numtide/flake-utils";
    naersk.url = "github:nix-community/naersk";
    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
  };

  outputs = { self, fenix, flake-utils, naersk, nixpkgs }:
    flake-utils.lib.eachDefaultSystem (
      system: let
        pkgs = (import nixpkgs) {
          inherit system;
        };

        toolchain = with fenix.packages.${system};
          combine [
            stable.rustc
            stable.cargo
            targets.x86_64-unknown-linux-musl.stable.rust-std
          ];

        naersk' = naersk.lib.${system}.override {
          cargo = toolchain;
          rustc = toolchain;
        };

      in rec {
        defaultPackage = naersk'.buildPackage {
          src = ./.;
          nativeBuildInputs = with pkgs; [ pkgsStatic.stdenv.cc ];
          CARGO_BUILD_TARGET = "x86_64-unknown-linux-musl";
          CARGO_BUILD_RUSTFLAGS = "-C target-feature=+crt-static -C strip=symbols";
        };
      }
    );
}

This worked for a few years, but recently broke when a Rust dependency update started pulling in aws-lc:

error: Cannot build '/nix/store/sz2ql05irqgsm59zxhnb4q48m0lnv86v-repro-env-0.4.3.drv'.
       Reason: builder failed with exit code 101.
       Output paths:
         /nix/store/9dk8x5z9vx8ss8vx9h7jamm7fll1j55i-repro-env-0.4.3
       Last 25 log lines:
       > /nix/store/z3za8hfc24wb117s50p8b10agjkgm039-binutils-2.44/bin/ld: bcm.c:(.text.pkey_rsa_ctrl_str+0x24d): undefined reference to `__isoc23_strtol'
       > /nix/store/z3za8hfc24wb117s50p8b10agjkgm039-binutils-2.44/bin/ld: /build/source/target/x86_64-unknown-linux-musl/release/deps/libaws_lc_sys-645044d4f78209d0.rlib(f8e4fd781484bd36-bcm.o): in function `aws_lc_0_40_0_Keccak1600_Absorb_once_x4.part.0':
       > bcm.c:(.text.aws_lc_0_40_0_Keccak1600_Absorb_once_x4.part.0+0x2b3): undefined reference to `__memcpy_chk'
       > /nix/store/z3za8hfc24wb117s50p8b10agjkgm039-binutils-2.44/bin/ld: bcm.c:(.text.aws_lc_0_40_0_Keccak1600_Absorb_once_x4.part.0+0x2cd): undefined reference to `__memcpy_chk'
       > /nix/store/z3za8hfc24wb117s50p8b10agjkgm039-binutils-2.44/bin/ld: bcm.c:(.text.aws_lc_0_40_0_Keccak1600_Absorb_once_x4.part.0+0x2e7): undefined reference to `__memcpy_chk'
       > /nix/store/z3za8hfc24wb117s50p8b10agjkgm039-binutils-2.44/bin/ld: bcm.c:(.text.aws_lc_0_40_0_Keccak1600_Absorb_once_x4.part.0+0x2fe): undefined reference to `__memcpy_chk'
       > /nix/store/z3za8hfc24wb117s50p8b10agjkgm039-binutils-2.44/bin/ld: /build/source/target/x86_64-unknown-linux-musl/release/deps/libaws_lc_sys-645044d4f78209d0.rlib(7bf3e571b6558a6b-urandom.o): in function `ensure_entropy_state_is_initd_once':
       >           urandom.c:(.text.ensure_entropy_state_is_initd_once+0x65): undefined reference to `__fprintf_chk'
       > /nix/store/z3za8hfc24wb117s50p8b10agjkgm039-binutils-2.44/bin/ld: urandom.c:(.text.ensure_entropy_state_is_initd_once+0x183): undefined reference to `__fprintf_chk'
       > /nix/store/z3za8hfc24wb117s50p8b10agjkgm039-binutils-2.44/bin/ld: urandom.c:(.text.ensure_entropy_state_is_initd_once+0x1fc): undefined reference to `__fprintf_chk'
       > /nix/store/z3za8hfc24wb117s50p8b10agjkgm039-binutils-2.44/bin/ld: /build/source/target/x86_64-unknown-linux-musl/release/deps/libaws_lc_sys-645044d4f78209d0.rlib(fb1f39df2ea6f08f-dsa.o): in function `aws_lc_0_40_0_dsa_internal_paramgen':
       >           dsa.c:(.text.aws_lc_0_40_0_dsa_internal_paramgen+0x20c): undefined reference to `__memcpy_chk'
       > /nix/store/z3za8hfc24wb117s50p8b10agjkgm039-binutils-2.44/bin/ld: dsa.c:(.text.aws_lc_0_40_0_dsa_internal_paramgen+0x220): undefined reference to `__memcpy_chk'
       > /nix/store/z3za8hfc24wb117s50p8b10agjkgm039-binutils-2.44/bin/ld: dsa.c:(.text.aws_lc_0_40_0_dsa_internal_paramgen+0x76f): undefined reference to `__memcpy_chk'
       > /nix/store/z3za8hfc24wb117s50p8b10agjkgm039-binutils-2.44/bin/ld: /build/source/target/x86_64-unknown-linux-musl/release/deps/libaws_lc_sys-645044d4f78209d0.rlib(30a9a10d3f98970e-mem.o): in function `aws_lc_0_40_0_OPENSSL_vasprintf_internal':
       >           mem.c:(.text.aws_lc_0_40_0_OPENSSL_vasprintf_internal+0x89): undefined reference to `__vsnprintf_chk'
       > /nix/store/z3za8hfc24wb117s50p8b10agjkgm039-binutils-2.44/bin/ld: mem.c:(.text.aws_lc_0_40_0_OPENSSL_vasprintf_internal+0xd1): undefined reference to `__vsnprintf_chk'
       >           collect2: error: ld returned 1 exit status
       >
       >   = note: some `extern` functions couldn't be found; some native libraries may need to be installed or have their path specified
       >   = note: use the `-l` flag to specify native libraries to link
       >   = note: use the `cargo:rustc-link-lib` directive to specify the native libraries to link with Cargo (see https://doc.rust-lang.org/cargo/reference/build-scripts.html#rustc-link-lib)
       >
       >
       > [naersk] cargo returned with exit code 101, exiting
       For full logs, run:
         nix log /nix/store/sz2ql05irqgsm59zxhnb4q48m0lnv86v-repro-env-0.4.3.drv

Everything builds correctly with x86_64-unknown-linux-musl on Arch Linux with musl-gcc, there was aws/aws-lc-rs#736 but the fix rust-lang/cc-rs#1443 is already present in my dependencies.

@raboof eventually figured out (thanks again!) that the follow configuration is necessary:

        defaultPackage = naersk'.buildPackage {
          src = ./.;
          nativeBuildInputs = with pkgs; [ pkgsStatic.stdenv.cc ];
          CARGO_BUILD_TARGET = "x86_64-unknown-linux-musl";
          CARGO_BUILD_RUSTFLAGS = "-C target-feature=+crt-static -C strip=symbols";
          CC_x86_64-unknown-linux-musl = "${pkgs.musl.dev}/bin/musl-gcc";
        };

I believe this is either a bug in fenix or naersk, it's hard for me to tell which one is responsible for the C integration side of things.

Thanks!

[definfo]

AFAIK crane + rust-overlay also require stdenv.cc and pkgsStatic.stdenv.cc to be listed in nativeBuildInputs, for aws-lc-rs cross compilation to musl.