build: support current Jerboa toolchain
ober
9ccd8fd30065e005b8549aa623f3632e75343043
--- a/Makefile +++ b/Makefile @@ -238,10 +238,10 @@ jerboa: ensure-jerboa-tools ensure-jerboa-shell cp "$(JERBOA_SHELL_DIR)/$$m.ss" "jsh-src/jsh/$$m.ss"; \ fi; \ done - $(JERBUILD) exec --libdirs "$(JH)/lib" support/jerbuild.ss jsh-src src --force - $(JERBUILD) exec --libdirs "$(JH)/lib" support/jerbuild.ss jerboa-src/src src --force - $(JERBUILD) exec --libdirs "$(JH)/lib" support/jerbuild.ss jerboa-src/lib lib --force - $(JERBUILD) exec --libdirs "$(JH)/lib" support/jerbuild.ss patches patches --force + $(JERBUILD) exec --unsafe-prelude --libdirs "$(JH)/lib" support/jerbuild.ss jsh-src src --force + $(JERBUILD) exec --unsafe-prelude --libdirs "$(JH)/lib" support/jerbuild.ss jerboa-src/src src --force + $(JERBUILD) exec --unsafe-prelude --libdirs "$(JH)/lib" support/jerbuild.ss jerboa-src/lib lib --force + $(JERBUILD) exec --unsafe-prelude --libdirs "$(JH)/lib" support/jerbuild.ss patches patches --force @# The local pure-Scheme base64 override is a distinct Chez library @# instance. Stage the tracked websocket override beside it so websocket @# is compiled against that same instance instead of a cached JH object. @@ -250,10 +250,10 @@ jerboa: ensure-jerboa-tools ensure-jerboa-shell @rm -f lib/std/net/websocket.so lib/std/net/websocket.wpo \ lib/std/net/websocket.tarm64osx lib/std/net/websocket.tx86_64osx \ lib/std/net/websocket.ta6le lib/std/net/websocket.ta6fb - $(JERBUILD) exec --libdirs "$(JH)/lib" support/jerbuild.ss test/fixtures test/fixtures --force - $(JERBUILD) exec --libdirs "$(JH)/lib" support/jerbuild.ss jerboa-src/vault-stage vault-stage --force + $(JERBUILD) exec --unsafe-prelude --libdirs "$(JH)/lib" support/jerbuild.ss test/fixtures test/fixtures --force + $(JERBUILD) exec --unsafe-prelude --libdirs "$(JH)/lib" support/jerbuild.ss jerboa-src/vault-stage vault-stage --force @echo "=== Patching /dev/fd/ for FreeBSD portability ===" - $(JERBUILD) exec --libdirs "$(JH)/lib" support/patch-devfd.ss + $(JERBUILD) exec --unsafe-prelude --libdirs "$(JH)/lib" support/patch-devfd.ss compile: ensure-jerboa-tools stage-jsqlite jerboa gen-embed @echo "=== Compiling .sls → .so ===" --- a/jerboa-src/lib/std/security/seccomp.ss +++ b/jerboa-src/lib/std/security/seccomp.ss @@ -25,6 +25,9 @@ ;; Pre-built filters compute-only-filter network-server-filter + http-server-filter + dns-server-filter + worker-eval-filter io-only-filter dangerous-syscalls safe-blocklist @@ -505,6 +508,25 @@ ;; File I/O 'openat 'newfstatat 'getdents 'access)) +(def http-server-filter network-server-filter) + +(def dns-server-filter + (make-seccomp-filter seccomp-kill + ;; Compute basics + 'read 'write 'close 'fstat 'mmap 'mprotect + 'munmap 'brk 'rt_sigaction 'rt_sigprocmask 'rt_sigreturn + 'clone 'exit_group 'futex 'nanosleep + 'getrandom 'arch_prctl 'set_tid_address + 'set_robust_list 'sched_yield 'sigaltstack + 'clock_gettime 'prctl 'prlimit64 'rseq 'close_range + ;; DNS server/client UDP and TCP fallback using known syscall-table names + 'socket 'connect 'sendto 'recvfrom + 'bind 'listen 'accept 'getsockname 'setsockopt + 'select 'ioctl 'fcntl + 'epoll_create1 'epoll_ctl 'epoll_wait)) + +(def worker-eval-filter compute-only-filter) + (def io-only-filter (make-seccomp-filter seccomp-kill 'read 'write 'close 'fstat 'mmap 'mprotect --- a/support/jerbuild.ss +++ b/support/jerbuild.ss @@ -103,7 +103,7 @@ (apply string-append (map (lambda (sym) (string-append (symbol->string sym) "/")) - (drop-last library-name))) + (drop-final-component library-name))) (symbol->string (last library-name)) ".sls"))) @@ -112,10 +112,10 @@ (car lst) (last (cdr lst)))) -(define (drop-last lst) +(define (drop-final-component lst) (if (null? (cdr lst)) '() - (cons (car lst) (drop-last (cdr lst))))) + (cons (car lst) (drop-final-component (cdr lst))))) (define (string-trim-left s) (let ([n (string-length s)]) @@ -1463,7 +1463,7 @@ (let ([parts (string-split-char output-path #\/)]) (apply string-append (map (lambda (p) (string-append p "/")) - (drop-last parts))))) + (drop-final-component parts))))) (call-with-output-file output-path (lambda (port) (display "#!chezscheme\n" port) --- a/support/stage-for-jerbuild.sh +++ b/support/stage-for-jerbuild.sh @@ -127,10 +127,10 @@ cat > "${GEN_DRIVER}" <<'SCHEME_EOF' (load "features.def") (load "feature-resolve.ss") (load "jsh-generate.ss") -(generate-jsh-program *enabled-features*) +(eval '(generate-jsh-program *enabled-features*) (interaction-environment)) (exit 0) SCHEME_EOF -"${JERBUILD}" exec --libdirs "${RUN_LIBDIRS}" "${GEN_DRIVER}" +"${JERBUILD}" exec --unsafe-prelude --libdirs "${RUN_LIBDIRS}" "${GEN_DRIVER}" # ── [4/4] Build + merge Rust archives ────────────────────────────────────── CARGO="${CARGO:-$(command -v cargo || true)}"