matrix-tuwunel: fix gcc & rustc leaking into closure

[42LoCo42]

Something in matrix-tuwunel causes Rust to write crate compilation commands into the tuwunel executable, leading to Nix picking up rustc-unwrapped as a runtime dependency. This bloats the closure by about 1.5GB. Simply replacing the path with an invalid one fixes this without affecting the functionality of tuwunel.

Things done

• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• Tested, as applicable:
  • NixOS tests in nixos/tests.
  • Package tests at passthru.tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Ran nixpkgs-review on this PR. See nixpkgs-review usage.
• Tested basic functionality of all binary files, usually in ./result/bin/.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.

---

Add a 👍 reaction to pull requests you find important.

[symphorien]

what about patching the source instead of doing binary replacement?

[42LoCo42]

what about patching the source instead of doing binary replacement?

That's definitely a more proper way of doing it, however it requires more time than I currently have. The replacement hack is intended as a workaround until a proper fix can be developed.

[42LoCo42]

Ok, I've queued up a nixpkgs-review for good measure, should be done in maybe an hour and a half. Thanks @symphorien for helping me with this!

[scvalex]

Thanks for catching and fixing this.

Looking at the output of strings, the rustc path seems to be in some sort of compiled-in stacktraces:

$ strings /nix/store/mbh1n9r82iax4gklrmw7p3lbalracwvi-matrix-tuwunel-1.4.6/bin/tuwunel | grep z8khp5wg7vfqd01h0qwaqbb1bizxyp3i
...
tuwunel_core::infomessageevent src/core/error/log.rs:80tuwunel_core::error::logsrc/core/error/log.rsevent src/core/error/log.rs:81event src/core/error/log.rs:82sha256contentroom_idsenderstate_keyredactsprev_eventsauth_eventsdepthhashesoriginsignaturesstruct RoomJoinRulesContentJoinRulepublicinviteknockrestrictedtuwunel_core::matrix::state_res::resolve::iterative_auth_checksrc/core/matrix/state_res/resolve/iterative_auth_check.rsevent src/core/matrix/state_res/resolve/iterative_auth_check.rs:110/nix/store/z8khp5wg7vfqd01h0qwaqbb1bizxyp3i-rustc-1.89.0/bin/rustc--crate-nametuwunel_core--edition=2024src/core/mod.rs--error-format=json--json=diagnostic-rendered-ansi,artifacts,future-incompat--crate-type--emit=dep-info,metadata,link-Copt-level=3linker-plugin-lto--warn=clippy::suspicious--warn=clippy::style--warn=clippy::perf--warn=clippy::pedantic--warn=clippy::nursery--warn=clippy::correctness--warn=clippy::complexity--warn=clippy::cargo--warn=clippy::verbose_file_reads--allow=unused_crate_dependencies--allow=unused_braces--warn=unused-qualifications--warn=unused-macro-rules--warn=unused-lifetimes--warn=unused-import-braces--warn=unused-extern-crates--warn=unstable-features--warn=clippy::unseparated_literal_suffix--allow=unsafe_code--warn=unsafe-op-in-unsafe-fn--warn=unreachable-pub--warn=clippy::unneeded_field_pattern--warn=clippy::unnecessary_self_imports--warn=clippy::unnecessary_safety_doc--warn=clippy::unnecessary_safety_comment--allow=unknown_lints--warn=unit-bindings--allow=unexpected_cfgs--warn=clippy::undocumented_unsafe_blocks--warn=clippy::try_err--warn=trivial-numeric-casts--warn=trivial-casts--warn=clippy::tests_outside_test_module--warn=clippy::suspicious_xor_used_as_pow--warn=clippy::string_slice--warn=clippy::string_lit_chars_any--warn=clippy::str_to_string--warn=single-use-lifetimes--warn=clippy::semicolon_outside_block--warn=rust-2021-prelude-collisions--warn=rust-2021-prefixes-incompatible-syntax--warn=rust-2021-incompatible-or-patterns--warn=rust-2021-incompatible-closure-captures--allow=renamed_and_removed_lints--warn=clippy::redundant_type_annotations--warn=clippy::rc_mutex--warn=clippy::rc_buffer--warn=clippy::pub_without_shorthand--warn=non-ascii-idents--warn=clippy::mutex_atomic--allow=missing_docs--warn=clippy::missing_assert_message--warn=missing-abi--allow=mismatched_lifetime_syntaxes--warn=meta-variable-misuse--warn=clippy::mem_forget--warn=macro-use-extern-crate--warn=clippy::lossy_float_literal--warn=clippy::let_underscore_untyped--allow=let_underscore_drop--warn=keyword-idents--warn=clippy::implicit_clone--warn=clippy::impl_trait_in_params--warn=clippy::get_unwrap--warn=clippy::format_push_string--warn=clippy::fn_to_numeric_cast_any--warn=clippy::float_cmp_const--warn=clippy::filetype_is_file--warn=ffi-unwind-calls--warn=explicit-outlives-requirements--warn=clippy::exit--warn=clippy::empty_structs_with_brackets--warn=clippy::empty_drop--allow=elided_named_lifetimes--warn=clippy::deref_by_slicing--warn=deprecated-in-future--warn=clippy::default_union_representation--warn=clippy::dbg_macro--warn=clippy::assertions_on_result_states--warn=clippy::as_underscore--warn=clippy::as_conversions--warn=clippy::arithmetic_side_effects--warn=absolute-paths-not-starting-with-crate--allow=clippy::unused_async--allow=clippy::unnecessary_wraps--allow=clippy::tuple_array_conversions--allow=clippy::too_long_first_doc_paragraph--allow=clippy::struct_field_names--allow=clippy::struct_excessive_bools--allow=clippy::single_match_else--allow=clippy::similar_names--allow=clippy::significant_drop_tightening--allow=clippy::significant_drop_in_scrutinee--allow=clippy::redundant_pub_crate--allow=clippy::option_if_let_else--allow=clippy::obfuscated_if_else--allow=clippy::no_effect_underscore_binding--allow=clippy::needless_update--allow=clippy::needless_continue--allow=clippy::multiple_crate_versions--allow=clippy::module_name_repetitions--allow=clippy::missing_panics_doc--allow=clippy::missing_errors_doc--allow=clippy::missing_docs_in_private_items--allow=clippy::missing_const_for_fn--allow=clippy::match_same_arms--allow=clippy::match_bool--allow=clippy::map_unwrap_or--allow=clippy::literal_string_with_formatting_args--allow=clippy::let_underscore_future--allow=clippy::inline_always--allow=clippy::if_then_some_else_none--allow=clippy::i
...

The top few source references are all logging macros in tuwunel. I don't understand what exactly they're doing, but masking the paths sounds fine.

My plan is to wait for the tests to pass in hydra and to deploy it to my server. Once I see nothing unexpected broke, I'll approve.

[scvalex]

Looking at the output of strings ./result/bin/tuwunel | grep nix/store more closely, I see references to some other closures. Most like zstd are expected since they're in buildInputs.

However, I also see /nix/store/x8mydcgbry214s802nzvy7fdljx404ym-gcc-wrapper-14.3.0/bin/cc in there. Does it make sense to remove-references-to this as well?

[42LoCo42]

nixpkgs-review result

Generated using nixpkgs-review-gha

Command: nixpkgs-review pr 462394
Commit: 2d9f905dacbf4e4860e5022e82c9c86bbfd2f30f (subsequent changes)
Merge: f68dc9e2c414f7aee1dcd5bac7151d4dd238ff8f

Logs: https://github.com/42LoCo42/nixpkgs-review-gha/actions/runs/19413666050

---

x86_64-linux

✅ 1 package built:

• matrix-tuwunel

---

aarch64-linux

✅ 1 package built:

• matrix-tuwunel

---

x86_64-darwin (sandbox = relaxed)

✅ 1 package built:

• matrix-tuwunel

---

aarch64-darwin (sandbox = relaxed)

✅ 1 package built:

• matrix-tuwunel

[42LoCo42]

However, I also see /nix/store/x8mydcgbry214s802nzvy7fdljx404ym-gcc-wrapper-14.3.0/bin/cc in there. Does it make sense to remove-references-to this as well?

Good catch, that should work too.

[scvalex]

tuwunel writes crate compilation commands into the executable,
leading to Nix picking up rustc & gcc as runtime dependencies
https://github.com/matrix-construct/tuwunel/blob/728085bd1b5f7bfd7d3f87108eaa4b4d4d51f3e6/src/core/info/rustc.rs#L20
https://github.com/matrix-construct/tuwunel/blob/728085bd1b5f7bfd7d3f87108eaa4b4d4d51f3e6/src/macros/mod.rs#L42

You're right about it being compilation commands. Never mind what I said earlier about logging.

And the reason we see gcc in there is because gcc seems to still be the linker. I expected this to have changed in 1.90 on x86-64, but it doesn't seem to have happened in nixpkgs. So, I've added a todo item for myself in a couple of months to check that LLVM hasn't snuck into the closure.

Sizes measured with nix path-info -Sh:
Before: 1.9 GiB on both x86-64 and aarch64,
After: 199.6 MiB on x86-64 and 208.5 MiB on aarch64.

NixOS tests passed locally. I manually checked the strings output on x86-64 and aarch64. I also upgraded my server and everything seems in order.

[symphorien]

how about #462712 instead?

[scvalex]

Let's do the rustc patch in #462712 since it's small enough. If it turns out to be hard to maintain across version bumps, we'll switch back to the approach in this PR.