Misc static improvements (mainly ocaml and a regression linked to b0b5ef7286dca098f40f5075175105c3c0dfbe05)

pkgs/build-support/ocaml/default.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, writeText, ocaml, findlib, ocamlbuild, camlp4 }:
 
-{ name, version, buildInputs ? [],
+{ name, version, nativeBuildInputs ? [],
   createFindlibDestdir ?  true,
   dontStrip ? true,
   minimumSupportedOcamlVersion ? null,
@@ -19,7 +19,7 @@ in
 stdenv.mkDerivation (args // {
   name = "ocaml-${name}-${version}";
 
-  buildInputs = [ ocaml findlib ocamlbuild camlp4 ] ++ buildInputs;
+  nativeBuildInputs = [ ocaml findlib ocamlbuild camlp4 ] ++ nativeBuildInputs;
 
   setupHook = if setupHook == null && hasSharedObjects
   then writeText "setupHook.sh" ''

pkgs/build-support/ocaml/dune.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, ocaml, findlib, dune_1, dune_2 }:
 
-{ pname, version, buildInputs ? [], enableParallelBuilding ? true, ... }@args:
+{ pname, version, nativeBuildInputs ? [], enableParallelBuilding ? true, ... }@args:
 
 let Dune = if args.useDune2 or false then dune_2 else dune_1; in
 
@@ -12,6 +12,8 @@ else
 stdenv.mkDerivation ({
 
   inherit enableParallelBuilding;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   buildPhase = ''
     runHook preBuild
@@ -33,7 +35,7 @@ stdenv.mkDerivation ({
 
   name = "ocaml${ocaml.version}-${pname}-${version}";
 
-  buildInputs = [ ocaml Dune findlib ] ++ buildInputs;
+  nativeBuildInputs = [ ocaml Dune findlib ] ++ nativeBuildInputs;
 
   meta = (args.meta or {}) // { platforms = args.meta.platforms or ocaml.meta.platforms; };
 

pkgs/development/compilers/ocaml/generic.nix

@@ -3,7 +3,7 @@
 let
   versionNoPatch = "${toString major_version}.${toString minor_version}";
   version = "${versionNoPatch}.${toString patch_version}";
-  safeX11 = stdenv: !(stdenv.isAarch32 || stdenv.isMips);
+  safeX11 = stdenv: !(stdenv.isAarch32 || stdenv.isMips || stdenv.hostPlatform.isStatic);
 in
 
 { lib, stdenv, fetchurl, ncurses, buildEnv, libunwind
@@ -13,7 +13,7 @@ in
 , spaceTimeSupport ? false
 }:
 
-assert useX11 -> !stdenv.isAarch32 && !stdenv.isMips;
+assert useX11 -> safeX11 stdenv;
 assert aflSupport -> lib.versionAtLeast version "4.05";
 assert flambdaSupport -> lib.versionAtLeast version "4.03";
 assert spaceTimeSupport -> lib.versionAtLeast version "4.04";
@@ -44,6 +44,8 @@ stdenv.mkDerivation (args // {
 
   inherit src;
 
+  strictDeps = true;
+
   prefixKey = "-prefix ";
   configureFlags =
     let flags = new: old:
@@ -56,7 +58,15 @@ stdenv.mkDerivation (args // {
   ++ optional aflSupport (flags "--with-afl" "-afl-instrument")
   ++ optional flambdaSupport (flags "--enable-flambda" "-flambda")
   ++ optional spaceTimeSupport (flags "--enable-spacetime" "-spacetime")
-  ;
+  ++ optional (stdenv.hostPlatform.isStatic && (lib.versionOlder version "4.08")) "-no-shared-libs"
+  ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform && lib.versionOlder version "4.08") [
+    "-host ${stdenv.hostPlatform.config}"
+    "-target ${stdenv.targetPlatform.config}"
+  ];
+  dontAddStaticConfigureFlags = lib.versionOlder version "4.08";
+  configurePlatforms = lib.optionals (lib.versionAtLeast version "4.08") [ "host" "target" ];
+  # x86_64-unknown-linux-musl-ld: -r and -pie may not be used together
+  hardeningDisable = lib.optional (lib.versionAtLeast version "4.09" && stdenv.hostPlatform.isMusl) "pie";
 
   buildFlags = [ "world" ] ++ optionals useNativeCompilers [ "bootstrap" "world.opt" ];
   buildInputs = optional (!lib.versionAtLeast version "4.07") ncurses
@@ -70,6 +80,8 @@ stdenv.mkDerivation (args // {
     # Do what upstream does by default now: https://github.com/ocaml/ocaml/pull/10176
     # This is required for aarch64-darwin, everything else works as is.
     AS="${stdenv.cc}/bin/cc -c" ASPP="${stdenv.cc}/bin/cc -c"
+  '' + optionalString (lib.versionOlder version "4.08" && stdenv.hostPlatform.isStatic) ''
+    configureFlagsArray+=("-cc" "$CC" "-as" "$AS" "-partialld" "$LD -r")
   '';
   postBuild = ''
     mkdir -p $out/include

pkgs/development/interpreters/python/cpython/2.7/default.nix

@@ -26,8 +26,8 @@
 , sourceVersion
 , sha256
 , passthruFun
-, static ? false
-, stripBytecode ? true
+, static ? stdenv.hostPlatform.isStatic
+, stripBytecode ? reproducibleBuild
 , rebuildBytecode ? true
 , reproducibleBuild ? false
 , enableOptimizations ? false
@@ -187,8 +187,9 @@ let
 
   configureFlags = optionals enableOptimizations [
     "--enable-optimizations"
-  ] ++ [
+  ] ++ optionals (!static) [
     "--enable-shared"
+  ] ++ [
     "--with-threads"
     "--enable-unicode=ucs${toString ucsEncoding}"
   ] ++ optionals (stdenv.hostPlatform.isCygwin || stdenv.hostPlatform.isAarch64) [
@@ -226,6 +227,7 @@ let
   ++ optional stdenv.hostPlatform.isLinux "ac_cv_func_lchmod=no"
   ++ optional static "LDFLAGS=-static";
 
+  strictDeps = true;
   buildInputs =
     optional (stdenv ? cc && stdenv.cc.libc != null) stdenv.cc.libc ++
     [ bzip2 openssl zlib ]

pkgs/development/interpreters/python/cpython/default.nix

@@ -101,6 +101,8 @@ let
 
   version = with sourceVersion; "${major}.${minor}.${patch}${suffix}";
 
+  strictDeps = true;
+
   nativeBuildInputs = optionals (!stdenv.isDarwin) [
     autoreconfHook
   ] ++ optionals (!stdenv.isDarwin && passthru.pythonAtLeast "3.10") [
@@ -287,10 +289,11 @@ in with passthru; stdenv.mkDerivation {
   PYTHONHASHSEED=0;
 
   configureFlags = [
-    "--enable-shared"
     "--without-ensurepip"
     "--with-system-expat"
     "--with-system-ffi"
+  ] ++ optionals (!static) [
+    "--enable-shared"
   ] ++ optionals enableOptimizations [
     "--enable-optimizations"
   ] ++ optionals enableLTO [

pkgs/development/libraries/boost/generic.nix

@@ -189,6 +189,8 @@ stdenv.mkDerivation {
 
   configureScript = "./bootstrap.sh";
   configurePlatforms = [];
+  dontDisableStatic = true;
+  dontAddStaticConfigureFlags = true;
   configureFlags = [
     "--includedir=$(dev)/include"
     "--libdir=$(out)/lib"

pkgs/development/libraries/libbfd/default.nix

@@ -30,16 +30,16 @@ stdenv.mkDerivation {
   # We update these ourselves
   dontUpdateAutotoolsGnuConfigScripts = true;
 
+  strictDeps = true;
   nativeBuildInputs = [ autoreconfHook bison ];
   buildInputs = [ libiberty zlib.dev ];
 
   configurePlatforms = [ "build" "host" ];
   configureFlags = [
     "--enable-targets=all" "--enable-64-bit-bfd"
     "--enable-install-libbfd"
-    "--enable-shared"
     "--with-system-zlib"
-  ];
+  ] ++ lib.optional (!stdenv.hostPlatform.isStatic) "--enable-shared";
 
   enableParallelBuilding = true;
 

pkgs/development/libraries/libxml2/default.nix

@@ -2,7 +2,7 @@
 , zlib, xz, libintl, python, gettext, ncurses, findXMLCatalogs
 , pythonSupport ? enableShared && stdenv.buildPlatform == stdenv.hostPlatform
 , icuSupport ? false, icu ? null
-, enableShared ? stdenv.hostPlatform.libc != "msvcrt"
+, enableShared ? stdenv.hostPlatform.libc != "msvcrt" && !stdenv.hostPlatform.isStatic
 , enableStatic ? !enableShared
 }:
 
@@ -40,6 +40,8 @@ stdenv.mkDerivation rec {
     ++ lib.optional pythonSupport "py"
     ++ lib.optional (enableStatic && enableShared) "static";
 
+  strictDeps = true;
+
   buildInputs = lib.optional pythonSupport python
     ++ lib.optional (pythonSupport && python?isPy2 && python.isPy2) gettext
     ++ lib.optional (pythonSupport && python?isPy3 && python.isPy3) ncurses

pkgs/development/libraries/lzo/default.nix

@@ -9,12 +9,14 @@ stdenv.mkDerivation rec {
     sha256 = "0wm04519pd3g8hqpjqhfr72q8qmbiwqaxcs3cndny9h86aa95y60";
   };
 
-  configureFlags = [ "--enable-shared" ];
+  configureFlags = lib.optional (!stdenv.hostPlatform.isStatic) "--enable-shared" ;
 
   enableParallelBuilding = true;
 
   doCheck = true; # not cross;
 
+  strictDeps = true;
+
   meta = with lib; {
     description = "Real-time data (de)compression library";
     longDescription = ''

pkgs/development/libraries/zlib/default.nix

@@ -57,11 +57,13 @@ stdenv.mkDerivation (rec {
   # and giving nothing builds both.
   # So we have 3 possible ways to build both:
   # `--static --shared`, `--shared` and giving nothing.
-  # Of these, we choose `--shared`, only because that's
-  # what we did in the past and we can avoid mass rebuilds this way.
-  # As a result, we pass `--static` only when we want just static.
-  configureFlags = lib.optional (static && !shared) "--static"
+  # Of these, we choose `--static --shared`, for clarity and simpler
+  # conditions.
+  configureFlags = lib.optional static "--static"
                    ++ lib.optional shared "--shared";
+  # We do the right thing manually, above, so don't need these.
+  dontDisableStatic = true;
+  dontAddStaticConfigureFlags = true;
 
   # Note we don't need to set `dontDisableStatic`, because static-disabling
   # works by grepping for `enable-static` in the `./configure` script

pkgs/development/ocaml-modules/bolt/default.nix

@@ -42,6 +42,8 @@ EOF
   # The custom `configure` script does not expect the --prefix
   # option. Installation is handled by ocamlfind.
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   createFindlibDestdir = true;
 

pkgs/development/ocaml-modules/easy-format/default.nix

@@ -12,7 +12,8 @@ stdenv.mkDerivation {
     sha256 = "00ga7mrlycjc99gzp3bgx6iwhf7i6j8856f8xzrf1yas7zwzgzm9";
   };
 
-  buildInputs = [ ocaml findlib ];
+  nativeBuildInputs = [ ocaml findlib ];
+  strictDeps = true;
 
   createFindlibDestdir = true;
 

pkgs/development/ocaml-modules/gen/default.nix

@@ -12,7 +12,9 @@ stdenv.mkDerivation {
     sha256 = "14b8vg914nb0yp1hgxzm29bg692m0gqncjj43b599s98s1cwl92h";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild qtest ounit ];
+  nativeBuildInputs = [ ocaml findlib ocamlbuild ];
+  buildInputs = [ qtest ounit ];
+  strictDeps = true;
 
   configureFlags = [
     "--enable-tests"

pkgs/development/ocaml-modules/hacl-star/raw.nix

@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
   installTargets = "install-hacl-star-raw";
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   buildInputs = [
     which

pkgs/development/ocaml-modules/janestreet/buildOcamlJane.nix

@@ -17,6 +17,8 @@ buildOcaml (args // {
   buildInputs = [ ocaml_oasis js_build_tools opaline ] ++ buildInputs;
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   configurePhase = "./configure --prefix $out";
 

pkgs/development/ocaml-modules/janestreet/js-build-tools.nix

@@ -16,6 +16,8 @@ buildOcaml rec {
   buildInputs = [ ocaml_oasis opaline ];
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
   configurePhase = "./configure --prefix $prefix";
   installPhase = "opaline -prefix $prefix -libdir $OCAMLFIND_DESTDIR ${name}.install";
 

pkgs/development/ocaml-modules/javalib/default.nix

@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
 
   configureScript = "./configure.sh";
   dontAddPrefix = "true";
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   propagatedBuildInputs = [ camlzip extlib ];
 

pkgs/development/ocaml-modules/labltk/default.nix

@@ -51,6 +51,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = [ "--use-findlib" "--installbindir" "$(out)/bin" ];
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   buildFlags = [ "all" "opt" ];
 

pkgs/development/ocaml-modules/ocamlnet/default.nix

@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
   createFindlibDestdir = true;
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   preConfigure = ''
     configureFlagsArray=(

pkgs/development/ocaml-modules/ocsigen-server/default.nix

@@ -40,6 +40,8 @@ buildDunePackage rec {
   configureFlags = [ "--root $(out)" "--prefix /" ];
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   postConfigure = ''
     make -C src confs

pkgs/development/ocaml-modules/process/default.nix

@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0m1ldah5r9gcq09d9jh8lhvr77910dygx5m309k1jm60ah9mdcab";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild ];
+  nativeBuildInputs = [ ocaml findlib ocamlbuild ];
+  strictDeps = true;
 
   createFindlibDestdir = true;
 

pkgs/development/ocaml-modules/sawja/default.nix

@@ -31,6 +31,8 @@ stdenv.mkDerivation {
 
   configureScript = "./configure.sh";
   dontAddPrefix = "true";
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
 
   propagatedBuildInputs = [ javalib ];
 

pkgs/development/ocaml-modules/seq/default.nix

@@ -20,7 +20,8 @@ stdenv.mkDerivation ({
     sha256 = "1cjpsc7q76yfgq9iyvswxgic4kfq2vcqdlmxjdjgd4lx87zvcwrv";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild ];
+  nativeBuildInputs = [ ocaml findlib ocamlbuild ];
+  strictDeps = true;
 
   createFindlibDestdir = true;
 

pkgs/development/ocaml-modules/syslog/default.nix

@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "1kqpc55ppzv9n555qgqpda49n7nvkqimzisyjx2a7338r7q4r5bw";
   };
 
-  buildInputs = [ ocaml findlib ];
+  nativeBuildInputs = [ ocaml findlib ];
+  strictDeps = true;
 
   buildFlags = [ "all" "opt" ];
 

pkgs/development/ocaml-modules/wasm/default.nix

@@ -15,7 +15,11 @@ stdenv.mkDerivation rec {
     sha256 = "1kp72yv4k176i94np0m09g10cviqp2pnpm7jmiq6ik7fmmbknk7c";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild ];
+  nativeBuildInputs = [ ocaml findlib ocamlbuild ];
+  strictDeps = true;
+
+  # x86_64-unknown-linux-musl-ld: -r and -pie may not be used together
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
   makeFlags = [ "-C" "interpreter" ];
 

pkgs/development/ocaml-modules/zarith/default.nix

@@ -17,11 +17,13 @@ stdenv.mkDerivation rec {
     sha256 = "1jslm1rv1j0ya818yh23wf3bb6hz7qqj9pn5fwl45y9mqyqa01s9";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ ocaml findlib ];
+  nativeBuildInputs = [ pkg-config ocaml findlib ];
   propagatedBuildInputs = [ gmp ];
+  strictDeps = true;
 
   dontAddPrefix = true;
+  dontAddStaticConfigureFlags = true;
+  configurePlatforms = [];
   configureFlags = [ "-installdir ${placeholder "out"}/lib/ocaml/${ocaml.version}/site-lib" ];
 
   preInstall = "mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/stublibs";