lanzaboote-{tool,uefi-stub}: init at 1.2.0

[ThinkChaos]

Now that we have UEFI platform support via #477645, we can build the Lanzaboote CLI (previously packaged and removed) and UEFI stub (PR'ed but never merged).
I've only included x86_64 support because that's what I've built and tested.

I also applied the changes proposed by #368246

Since these were packaged/proposed, pinging previous maintainers: @blitz @nikstur @RaitoBezarius.
Let me know if you'd like to be added as maintainers.

Supersedes: #353052 (@baloo).

Thank you to everyone who has worked on this before me. I definitely couldn't have gotten UEFI to build without all your work!

Things done

• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• Tested, as applicable:
  • NixOS tests in nixos/tests.
  • Package tests at passthru.tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Ran nixpkgs-review on this PR. See nixpkgs-review usage.
• Tested basic functionality of all binary files, usually in ./result/bin/.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.

[RaitoBezarius]

Thanks for the PR, can you add me as a maintainer as well? Thanks.

[RaitoBezarius]

Note (this is not a proper review tool so I cannot do the review where it should be): there's a typo in a commit message where lanzaboot-uefi-stub: ... is written, it should be lanzabooteE-uefi-stub: ....

[RaitoBezarius]

During compilation, this is full of warnings like this:

warning: compiler_builtins@0.1.160: Warning: supplying the --target x86_64-unknown-windows-gnu != x86_64-uefi argument to a nix-wrapped compiler may not work correctly - cc-wrapper is currently not designed with multi-target compilers in mind. You may want to use an un-wrapped compiler instead.

Why are they safe to ignore?

[ThinkChaos]

During compilation, this is full of warnings like this:

For which derivation do you see those?
For both packages I get clean cargo logs.

Edit: found it /nix/store/3d9y36sfj45mqw3hnd7smqmrdi37lr64-x86_64-unknown-uefi-rustc-1.93.0.drv

[ThinkChaos]

Why are they safe to ignore?

This is more of an educated guess at this point, but I believe --target x86_64-unknown-windows-gnu is what rustc uses internally to cross compile its compiler builtins when building a UEFI compiler, so it's expected to see it there.
I'll have to dig into it more to be sure, but this issue seems to confirm it: rust-lang/rust#118184

I believe this is where we tell rustc to use the wrapped compiler:

nixpkgs/pkgs/development/compilers/rust/rustc.nix

Line 183 in 107512e

"${setTarget}.cc=${ccForTarget}"

We could potentially change that to the unwrapped version, or conditionally silence the warning via NIX_CC_WRAPPER_SUPPRESS_TARGET_WARNING=1, but I definitely don't understand all the repercussions that would have.

[azahi]

Any plans to add a NixOS module for this? #263713?

[ThinkChaos]

Any plans to add a NixOS module for this? #263713?

What annoyed me enough to work on this was having crane & rust-overlay in my system closure.
So I don't personally care that much about porting the module over.

[Mic92]

Any plans to add a NixOS module for this? #263713?

What annoyed me enough to work on this was having crane & rust-overlay in my system closure. So I don't personally care that much about porting the module over.

In any case having the package would is the harder part the module can be also ported by someone else.

[nixpkgs-ci]

Thanks for contributing to the documentation

Make sure you follow the documentation style guide, most notably:

• Show, don't tell: lead with a minimal working example; explanation follows the code.
• No meta-commentary: don't write "This section explains how to…", just do it.
• Imperative mood and active voice: "Run the command", not "The user should run the following command".
• Present tense: "This creates a folder", not "This will create a folder".
• Be confident: no hedging with "should", "might", "typically", "usually".
• Cut filler words: "simply", "just", "easily", "basically"; "to", not "in order to".

For larger changes, like adding or removing whole sections, ask the NixOS documentation team for a review.

[ThinkChaos]

I updated the packages to 1.2.0, the latest release ATM.

And after bouncing off it a bunch of times, figured out the only, AFAIK, blocker:

During compilation, this is full of warnings like this:

warning: compiler_builtins@0.1.160: Warning: supplying the --target x86_64-unknown-windows-gnu != x86_64-uefi argument to a nix-wrapped compiler may not work correctly - cc-wrapper is currently not designed with multi-target compilers in mind. You may want to use an un-wrapped compiler instead.

Why are they safe to ignore?

Rust UEFI target predates LLVM's so cc-rs has a workaround that rewrites x86_64-unknown-uefi to x86_64-unknown-windows-gnu when calling clang.
See rust-lang/cc-rs#623 and rust-lang/cc-rs#1264

There's a PR open to fix it in cc-rs but it has been pending for a while: rust-lang/rust#132570
I added a workaround in pkgs/development/compilers/rust/rustc.nix