coreboot-toolchain: remove hardcoded hash of 21.11's x86_64-linux.stdenv

[ghost]

(@felixsinger, thank you so much for writing the coreboot-toolchain expression!)

The problem

The following line is found in tools/misc/coreboot-toolchain/default.nix:

  sha256 = "073n8yid3v0l9wgwnrdqrlgzaj9mnhs33a007dgr7xq3z0iw3i52"

This hash matches the output of the fetchgit invocation in the same file; however that fetchgit invocation uses a postFetch block with patchShebangs, so the nix store-path of stdenv.shell is now hardwired into the hash above.

This means that this derivation will fail to build for any user whose stdenv store-path does not exactly match the one used at the time the derivation was first built by hydra. For example:

• Anybody building on a platform other than x86_64-linux, since they have a different boostrap-files.

• Anybody with an overlay which adds -march=...

• Any future nixpkgs users, if nixpkgs commits a change which influences the store-path of stdenv.

See for yourself

To reproduce the problem, check out this PR, revert the last commit, and:

nix-build \
  --option substituters "" \
  --option extra-substituters "" \
  --option trusted-substituters "" \
  --option extra-trusted-substituters "" \
  --option trusted-public-keys "" \
  -A coreboot-toolchain.aarch64

Some of those --options are probably redundant, but I can never seem to get nix's rules for substituters straight.

Assuming you didn't already have the outpath in your store (if you did, delete it, start over), you'll see:

error: output '/nix/store/nvswbzyl39ifpwswfvx132j2mys80ifr-coreboot' is not allowed to refer to the following paths:
         /nix/store/8ngciqnw8jzvyvbx00arkp05gvn5q6sq-libunistring-1.0
         /nix/store/p2r9ynirymj47x5m6y9pnq0lpssn4ahm-bash-5.1-p16
         /nix/store/rflgyvwcnmrql5wf8kchynmmq7raggvj-libidn2-2.3.2
         /nix/store/rszg7d581z3v3fwrak68ba2wv5lrckx7-glibc-2.34-115

The fix

A three-patch series:

• fetchgit: allow passing allowedRequisites through to stdenv.mkDerivation (this commit is fetchgit: inherit allowedRequisites in mkDerivation #177326).

• coreboot-toolchain: add allowedRequisites=[]

• coreboot-toolchain: move patchShebangs out of fetchgit, update the sha256.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 22.05 Release Notes (or backporting 21.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
  • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
• Fits CONTRIBUTING.md.

[felixsinger]

Commit messages missing and problem statement needs to be improved.

[ghost]

Commit messages missing and problem statement needs to be improved.

Done.

Mainly the middle commit; the first commit is a straightforward one-line code change. The last commit fixes the issue described in the middle commit, so the last commit's message refers the reader to the previous commit's message.

[ghost]

Ping...

[ghost]

Force-push resolves merge conflict with 7aae279, no other changes.

[ghost]

Ping...

[ghost]

Ping...

[ghost]

Rebased since #177326 has merged.

[ghost]

Ping...

[vcunat]

To reproduce the issue I recommend simply

nix-build -QA coreboot-toolchain.x64.src --check