Always use the the same nix shell for buildconfig verification

jblebrun · jblebrun · commit 83d02bd237ac · 2025-01-29T14:01:06.000Z
We may as well just initialize the most capable shell needed and use
that for everything. Once it's initialized once, starting it up again is
fast.

Change-Id: I0c3ae004309b82d057f50ab066a4930c43b0be99
diff --git a/buildconfigs/key_xor_test_app.sh b/buildconfigs/key_xor_test_app.sh
@@ -7,7 +7,7 @@ export PACKAGE_NAME=key_xor_test_app
 export BUILD_COMMAND=(
   nix
   develop
-  .#bazelRustShell
+  .#githubBuildShell
   --command
   just
   build_key_xor_test_app
diff --git a/buildconfigs/oak_client_android_app.sh b/buildconfigs/oak_client_android_app.sh
@@ -7,6 +7,7 @@ export PACKAGE_NAME=oak_client_android_app
 export BUILD_COMMAND=(
   nix
   develop
+  .#githubBuildShell
   --command
   just
   oak_client_android_app
diff --git a/buildconfigs/oak_containers_agent.sh b/buildconfigs/oak_containers_agent.sh
@@ -7,7 +7,7 @@ export PACKAGE_NAME=oak_containers_agent
 export BUILD_COMMAND=(
   nix
   develop
-  .#systemImageShell
+  .#githubBuildShell
   --command
   just
   oak_containers_agent
diff --git a/buildconfigs/oak_containers_kernel.sh b/buildconfigs/oak_containers_kernel.sh
@@ -7,7 +7,7 @@ export PACKAGE_NAME=oak_containers_kernel
 export BUILD_COMMAND=(
   nix
   develop
-  .#linuxKernelShell
+  .#githubBuildShell
   --command
   just
   oak_containers_kernel
diff --git a/buildconfigs/oak_containers_nvidia_system_image.sh b/buildconfigs/oak_containers_nvidia_system_image.sh
@@ -7,7 +7,7 @@ export PACKAGE_NAME=oak_containers_nvidia_system_image
 export BUILD_COMMAND=(
   nix
   develop
-  .#systemImageShell
+  .#githubBuildShell
   --command
   just
   oak_containers_nvidia_system_image
diff --git a/buildconfigs/oak_containers_orchestrator.sh b/buildconfigs/oak_containers_orchestrator.sh
@@ -7,7 +7,7 @@ export PACKAGE_NAME=oak_containers_orchestrator
 export BUILD_COMMAND=(
   nix
   develop
-  .#systemImageShell
+  .#githubBuildShell
   --command
   just
   oak_containers_orchestrator
diff --git a/buildconfigs/oak_containers_stage1.sh b/buildconfigs/oak_containers_stage1.sh
@@ -7,7 +7,7 @@ export PACKAGE_NAME=oak_containers_stage1
 export BUILD_COMMAND=(
   nix
   develop
-  .#stage1Shell
+  .#githubBuildShell
   --command
   just
   stage1_cpio
diff --git a/buildconfigs/oak_containers_syslogd.sh b/buildconfigs/oak_containers_syslogd.sh
@@ -7,7 +7,7 @@ export PACKAGE_NAME=oak_containers_syslogd
 export BUILD_COMMAND=(
   nix
   develop
-  .#systemImageShell
+  .#githubBuildShell
   --command
   just
   oak_containers_syslogd
diff --git a/buildconfigs/oak_containers_system_image.sh b/buildconfigs/oak_containers_system_image.sh
@@ -7,7 +7,7 @@ export PACKAGE_NAME=oak_containers_system_image
 export BUILD_COMMAND=(
   nix
   develop
-  .#systemImageShell
+  .#githubBuildShell
   --command
   just
   oak_containers_system_image
diff --git a/buildconfigs/oak_echo_enclave_app.sh b/buildconfigs/oak_echo_enclave_app.sh
@@ -7,7 +7,7 @@ export PACKAGE_NAME=oak_echo_enclave_app
 export BUILD_COMMAND=(
   nix
   develop
-  .#bazelRustShell
+  .#githubBuildShell
   --command
   just
   build_enclave_app
diff --git a/buildconfigs/oak_echo_raw_enclave_app.sh b/buildconfigs/oak_echo_raw_enclave_app.sh
@@ -7,7 +7,7 @@ export PACKAGE_NAME=oak_echo_raw_enclave_app
 export BUILD_COMMAND=(
   nix
   develop
-  .#bazelRustShell
+  .#githubBuildShell
   --command
   just
   build_enclave_app
diff --git a/buildconfigs/oak_functions_enclave_app.sh b/buildconfigs/oak_functions_enclave_app.sh
@@ -7,7 +7,7 @@ export PACKAGE_NAME=oak_functions_enclave_app
 export BUILD_COMMAND=(
   nix
   develop
-  .#bazelRustShell
+  .#githubBuildShell
   --command
   just
   build_enclave_app
diff --git a/buildconfigs/oak_functions_insecure_enclave_app.sh b/buildconfigs/oak_functions_insecure_enclave_app.sh
@@ -7,7 +7,7 @@ export PACKAGE_NAME=oak_functions_insecure_enclave_app
 export BUILD_COMMAND=(
   nix
   develop
-  .#bazelRustShell
+  .#githubBuildShell
   --command
   just
   build_oak_functions_insecure_enclave_app
diff --git a/buildconfigs/oak_orchestrator.sh b/buildconfigs/oak_orchestrator.sh
@@ -7,7 +7,7 @@ export PACKAGE_NAME=oak_orchestrator
 export BUILD_COMMAND=(
   nix
   develop
-  .#bazelRustShell
+  .#githubBuildShell
   --command
   just
   build_enclave_app
diff --git a/buildconfigs/oak_restricted_kernel_simple_io_init_rd_wrapper_bin.sh b/buildconfigs/oak_restricted_kernel_simple_io_init_rd_wrapper_bin.sh
@@ -10,7 +10,7 @@ export PACKAGE_NAME=oak_restricted_kernel_simple_io_init_rd_wrapper_bin
 export BUILD_COMMAND=(
   nix
   develop
-  .#ci
+  .#githubBuildShell
   --command
   just
   oak_restricted_kernel_wrapper_simple_io_channel
diff --git a/buildconfigs/stage0_bin.sh b/buildconfigs/stage0_bin.sh
@@ -7,6 +7,7 @@ export PACKAGE_NAME=stage0_bin
 export BUILD_COMMAND=(
   nix
   develop
+  .#githubBuildShell
   --command
   just
   stage0_bin
diff --git a/buildconfigs/stage0_bin_tdx.sh b/buildconfigs/stage0_bin_tdx.sh
@@ -7,6 +7,7 @@ export PACKAGE_NAME=stage0_bin_tdx
 export BUILD_COMMAND=(
   nix
   develop
+  .#githubBuildShell
   --command
   just
   stage0_bin_tdx
diff --git a/flake.nix b/flake.nix
@@ -177,13 +177,6 @@
                 bazel-buildtools
               ];
             };
-            # Generic shell to build Rust binaries with bazel.
-            bazelRustShell = with pkgs; mkShell {
-              inputsFrom = [
-                rust
-                bazelShell
-              ];
-            };
             # Shell for building Oak Containers kernel and system image. This is not included in the
             # default shell because it is not needed as part of the CI.
             containers = with pkgs; mkShell {
@@ -242,29 +235,6 @@
                 libelf
               ];
             };
-            # Shell for oak_containers_stage1.
-            stage1Shell = with pkgs; mkShell {
-              inputsFrom = [
-                rust
-                bazelShell
-              ];
-              packages = [
-                cpio
-                glibc
-                glibc.static
-                strip-nondeterminism
-              ];
-            };
-            # Shell for Oak Containers system images.
-            systemImageShell = with pkgs; mkShell {
-              inputsFrom = [
-                rust
-                bazelShell
-              ];
-              packages = [
-                elfutils
-              ];
-            };
             # Shell for most CI steps (i.e. without containers support).
             ci = pkgs.mkShell {
              shellHook = ''
@@ -280,6 +250,15 @@
                 lint
               ];
             };
+            # This is the shell used by the build scripts executed by GitHub jobs.
+            githubBuildShell = pkgs.mkShell {
+              packages = [ ];
+              inputsFrom = [
+                containers
+                rust
+                bazelShell
+              ];
+            };
             # By default create a shell with all the inputs.
             default = pkgs.mkShell {
               packages = [ ];
diff --git a/kokoro/verify_buildconfigs.sh b/kokoro/verify_buildconfigs.sh
@@ -13,7 +13,6 @@ cd "$(dirname "$0")/.."
 source kokoro/helpers/common.sh
 
 ./scripts/docker_pull
-./scripts/docker_run nix develop .#ci --command just kokoro_verify_buildconfigs
-./scripts/git_check_diff
+./scripts/docker_run nix develop .#githubBuildShell --command just kokoro_verify_buildconfigs
 
 kokoro_cleanup
