Is Nix really appropriate for building a complete rootfs? Could I start from scratch and write a nix build script or whatever and end up with a rootfs I could run on some aarch64 SBC or SoM?
And how is the Nix story for going from a rootfs to a bootable image? On e.g Rockchip you need to make an image where there's some firmware blob in one are of the flash which jumps to a uBoot in another area which loads the kernel/initramfs/devicetree, how does that look in Nix land?
How does it handle building vendor kernels or carrying kernel patches instead of mainline?
I don't really like Nix but it's probably fine for this - you have files that come in, a build step, and output files. Your derivations (build recipes) are functions that can take arguments to e.g. provide a set of patches to apply. There are recipes for building a kernel in nixpkgs already which you could fork.
The main annoyance I'd have in your case is probably the number of file copies of large images it may do to keep things isolated, but most hermetic build systems will do something similar.
I mean "input files, a build step, output files" is the trivial part of this. I've made my own build systems which work the same way, it's not especially hard. But if you wanted to use my build system to make a Linux rootfs you'd find that to be a monumental effort since you'd have to do everything yourself.
It's everything built around the build script language that's relevant. How easy is it to make a Nix config which produces a rootfs with systemd, glibc, coreutils, an OpenSSL server, pam, a dbus broker, the necessary getty services, etc etc etc which makes it a Linux system? That's the question I'm asking.
amelius · · focus · HN ↗
mort96 · · focus · HN ↗
And how is the Nix story for going from a rootfs to a bootable image? On e.g Rockchip you need to make an image where there's some firmware blob in one are of the flash which jumps to a uBoot in another area which loads the kernel/initramfs/devicetree, how does that look in Nix land?
How does it handle building vendor kernels or carrying kernel patches instead of mainline?
aidanhs · · focus · HN ↗
The main annoyance I'd have in your case is probably the number of file copies of large images it may do to keep things isolated, but most hermetic build systems will do something similar.
mort96 · · focus · HN ↗
It's everything built around the build script language that's relevant. How easy is it to make a Nix config which produces a rootfs with systemd, glibc, coreutils, an OpenSSL server, pam, a dbus broker, the necessary getty services, etc etc etc which makes it a Linux system? That's the question I'm asking.