nix: allow static compilation

[domenkozar]

Continuation of #56281

Nix compiles statically, but not everything is included:

$ nix-store -qR /nix/store/51sl3macs7bjrx8lfck8pmlcnq01hpyd-nix-2.3-x86_64-unknown-linux-musl
/nix/store/6yaj6n8l925xxfbcd65gzqx3dz7idrnn-glibc-2.27
/nix/store/kn9w6k46qmzrv3hgzs1csrrs3dcad7h6-attr-2.4.48
/nix/store/08al8hwj0hvqahb0yibslsmsvj50b1qz-acl-2.2.53
/nix/store/11kmi14g34nfb54d2bnv7q8mg17vn98h-nix-2.3-x86_64-unknown-linux-musl-man
/nix/store/5dn03xfw3wimm78nfpg67p1zj1025sbc-bzip2-1.0.6.0.1
/nix/store/440vkrx6mf7v4j4z88vjcp6pavk05lig-bzip2-1.0.6.0.1-bin
/nix/store/a66s8hzy6w34dlh6ahgfdwaiglpcny65-gnutar-1.32
/nix/store/yk8lp0x7sml42gaf9gfkr6cwx99glz7b-xz-5.2.4
/nix/store/jryr8hdk55jrmmicyz5j9shyvzqydfk8-xz-5.2.4-bin
/nix/store/kq5axl0hwrnxm1ri3dc7dgmnx7pwn9xc-busybox-1.30.1-x86_64-unknown-linux-musl
/nix/store/kx56d14p0qm2awn0qrqrv4rb8xdhvhpi-coreutils-8.31
/nix/store/l6h4ya0wzb4b8mr0y58k2gh2nhfql4sn-bash-4.4-p23
/nix/store/sgganmpm2bbnqmgz35hrgp4d0cvml6ir-gzip-1.10
/nix/store/k99c3nzlhg3znrjj5h3s03ckbb898rn0-musl-1.1.22-x86_64-unknown-linux-musl
/nix/store/xrkb0djwxjqciyk7ikgk2fxrk1dj0226-openssl-1.0.2t-x86_64-unknown-linux-musl
/nix/store/51sl3macs7bjrx8lfck8pmlcnq01hpyd-nix-2.3-x86_64-unknown-linux-musl

• openssl builds also shared libs and those are linked instead of static
• nix config depends on some binaries (gnutar, ...)
• support https based stores

[matthewbauer]

Probably best to keep these options separate. There’s no reason for aws to not work statically, but it is broken currently.

[domenkozar]

Since it can't compile it seems better to do it in the package rather than at call time.

[matthewbauer]

Unfortunately, without NixOS/nix#2698, you can’t use https-based stores.

[tomberek]

Just a comment: static nix by @matthewbauer has been very helpful. Having this built by nixpkgs would be great.

[roberth]

Patch size has shrunk a bit. This builds and was useful to me, doing evaluation-only on terraform cloud (no root, no namespaces). https://github.com/NixOS/nixpkgs/compare/master...roberth:static-nix-2020-03-04?expand=1

[roberth]

https://github.com/NixOS/nixpkgs/compare/master...roberth:static-nix-2020-03-04?expand=1

That said, this should be supported through in the Nix release itself and not tacked on later. A patch like this helps: NixOS/nix#2698.
I don't know exactly why the NIX_LDFLAGS override is necessary, but it seems like something that should be handled in the Nix build files instead.

[matthewbauer]

NIX_LDFLAGS shouldn't be necessary with NixOS/nix#3194. I'm a bit behind on updating this PR. Feel free to open one with yours. We may just have to check in that .patch.

[domenkozar]

IIRC Nix master also now compiles rust, which doesn't compile statically. Maybe that was fixed since I looked.

[Mic92]

IIRC Nix master also now compiles rust, which doesn't compile statically. Maybe that was fixed since I looked.

It certainly possible to compile static rust binaries, not sure if we can make ours do so.

[domenkozar]

I think probably the first step would be to add static compilation to github actions on nix repo.

[bqv]

Are there actions for this? Current nixUnstable does not even build with pkgsMusl, let alone pkgsStatic

[roberth]

The upstream flake defines a nix-static package https://github.com/NixOS/nix/blob/02a1facbdc89c5041ba55387645484ad785cba7a/flake.nix#L455

[bqv]

I guess I'm blind! Thanks Rob.

[roberth]

It's not obvious at all. It just so happened that I've seen it there and I was subscribed to this thread.

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/where-can-i-get-a-statically-built-nix/34253/1