Packaging for NixOS #676

spl3g · 2024-03-07T20:52:52Z

Desktop (please complete the following information):

OS: NixOS
Version 24.05

Additional context
I am trying to package amnezia-client for NixOS. But there's no cqtdeployer there so the build script wouldn't have worked.
I think i figured out the dependencies and i built the AmneziaVPN and AmneziaVPN-service binaries that kind of work but when i try to connect to the server i get this error:

2024-03-07 23:45:38 debug Amnezia "WireguardUtilsLinux" "Tunnel process encountered an error: QProcess::FailedToStart"
2024-03-07 23:45:38 debug Amnezia "WireguardUtilsLinux" "Unable to start tunnel process due to timeout"
2024-03-07 23:45:38 debug Amnezia "Daemon" "Interface creation failed."
2024-03-07 23:45:38 debug Amnezia "DaemonLocalServerConnection" "Failed to activate the interface"

There's my package so far:

{ stdenv
, lib
, fetchFromGitHub
, cmake
, pkg-config
, libsecret
, libgcrypt
, openssl
, openvpn
, tun2socks
, cloak
, shadowsocks-libev
, wireguard-go
, xray
, qtbase
, wrapQtAppsHook
, qtremoteobjects
, qtsvg
, qttools
, qt5compat
, qtkeychain
}:

stdenv.mkDerivation rec {
  pname = "amnezia-client";
  version = "4.4.0.0";
  
  src = fetchFromGitHub {
    repo = "${pname}";
    owner = "amnezia-vpn";

    rev = "${version}";
    sha256 = "0k0sjf1c8iqg9crq4sfzdg4cczaq5pbk5j2873yzsw88rps0awac";
    fetchSubmodules = true;
  };
  
  nativeBuildInputs = [
    cmake
    wrapQtAppsHook
    pkg-config
  ];

  buildInputs = [
    qtbase
    qtremoteobjects
    qtsvg
    qttools
    qt5compat
    qtkeychain
    libsecret
    libgcrypt
    openssl
    openvpn
    tun2socks
    cloak
    shadowsocks-libev
    wireguard-go
    xray
  ];

  installPhase = ''
  runHook preInstall
  make install
  mkdir $out/bin
  mkdir -p $out/usr/share/{pixmaps,applications}
  cp client/AmneziaVPN $out/bin/
  cp service/server/AmneziaVPN-service $out/bin/
  runHook postInstall
  '';
}

I am not very familiar with cmake, c++ and qt so i think i am doing something wrong.

The text was updated successfully, but these errors were encountered:

chekoopa · 2024-04-21T16:12:22Z

I'll bump this issue, as I am NixOS user and going to try Amnezia, so the client is cruical for me. Maybe I'll also look into it.

There also is a possible OS integration issue, as there are two components of the error message: fail to start tunnel process (due to some error yet to explore), and interface creation fail (which is also something to explore i.e. through dmesg).

pokamest · 2024-04-22T00:22:40Z

Hi!
Does AmneziaVPN-service has enough privileges to create tun devices in your package?
It's running with sudo privileges when installed by installer.

Askodon · 2024-07-19T04:51:34Z

any progress?

PRESFIL · 2024-07-29T10:53:10Z

Apparently the package names have changed since march, I updated default.nix so
that it builds on the current version of nixpkgs:

--- /tmp/default.nix
+++ /tmp/amnezia/default.nix
@@ -12,13 +12,8 @@
 , shadowsocks-libev
 , wireguard-go
 , xray
-, qtbase
-, wrapQtAppsHook
-, qtremoteobjects
-, qtsvg
-, qttools
-, qt5compat
-, qtkeychain
+, qt6
+, libsForQt5
 }:

 stdenv.mkDerivation rec {
@@ -36,17 +31,17 @@

   nativeBuildInputs = [
     cmake
-    wrapQtAppsHook
+    qt6.wrapQtAppsHook
     pkg-config
   ];

   buildInputs = [
-    qtbase
-    qtremoteobjects
-    qtsvg
-    qttools
-    qt5compat
-    qtkeychain
+    qt6.qtbase
+    qt6.qtremoteobjects
+    qt6.qtsvg
+    qt6.qttools
+    qt6.qt5compat
+    libsForQt5.qtkeychain
     libsecret
     libgcrypt
     openssl

`default.nix`

{ stdenv
, lib
, fetchFromGitHub
, cmake
, pkg-config
, libsecret
, libgcrypt
, openssl
, openvpn
, tun2socks
, cloak
, shadowsocks-libev
, wireguard-go
, xray
, qt6
, libsForQt5
}:

stdenv.mkDerivation rec {
  pname = "amnezia-client";
  version = "4.4.0.0";
  
  src = fetchFromGitHub {
    repo = "${pname}";
    owner = "amnezia-vpn";

    rev = "${version}";
    sha256 = "0k0sjf1c8iqg9crq4sfzdg4cczaq5pbk5j2873yzsw88rps0awac";
    fetchSubmodules = true;
  };
  
  nativeBuildInputs = [
    cmake
    qt6.wrapQtAppsHook
    pkg-config
  ];

  buildInputs = [
    qt6.qtbase
    qt6.qtremoteobjects
    qt6.qtsvg
    qt6.qttools
    qt6.qt5compat
    libsForQt5.qtkeychain
    libsecret
    libgcrypt
    openssl
    openvpn
    tun2socks
    cloak
    shadowsocks-libev
    wireguard-go
    xray
  ];

  installPhase = ''
  runHook preInstall
  make install
  mkdir $out/bin
  mkdir -p $out/usr/share/{pixmaps,applications}
  cp client/AmneziaVPN $out/bin/
  cp service/server/AmneziaVPN-service $out/bin/
  runHook postInstall
  '';
}

I noticed several obvious problems in the current version of default.nix,
which is why it will not be accepted in nixpkgs, (besides the fact that
tunnels are not being created), which I don't know how to fix yet:

Extra directories, at least /usr in NixOS were abandoned:

tree /nix/store/964sfqdd47k92yxjbaa924szjijxmby8-amnezia-client-4.4.0.0

/nix/store/964sfqdd47k92yxjbaa924szjijxmby8-amnezia-client-4.4.0.0
├── bin
│   ├── AmneziaVPN
│   └── AmneziaVPN-service
├── include                                             # maybe should be excluded (or linked)
│   └── qt6keychain
│       ├── keychain.h
│       └── qkeychain_export.h
├── lib                                                 # maybe should be excluded (or linked)
│   ├── cmake
│   │   └── Qt6Keychain
│   │       ├── Qt6KeychainConfig.cmake
│   │       ├── Qt6KeychainConfigVersion.cmake
│   │       ├── Qt6KeychainLibraryDepends.cmake
│   │       └── Qt6KeychainLibraryDepends-release.cmake
│   └── libqt6keychain.a
├── mkspecs                                             # maybe should be excluded (or linked)
│   └── modules
│       └── qt_Qt6Keychain.pri
└── usr                                                 # no /usr on NixOS
    └── share
        ├── applications                                # empty!
        └── pixmaps                                     # empty!

13 directories, 10 files

Apparently, bin/AmneziaVPN-service should be run with privileges, but there
is no systemd service-file in the assembled package

I ran the built package on user profile and regular Linux with the nix package
manager installed, not on a full-fledged NixOS installation, so I can't write a
definition of the systemd-service and check it's working as expected.

Command to build a package (default.nix in ${CWD}) with a specific version
of nixpkgs (for reproducibility):

nix-build -I nixpkgs=https://github.com/NixOS/nixpkgs/archive/6921160271c969939bdd82c46969ac9877ba9827.tar.gz  -E 'with import <nixpkgs> {}; callPackage ./default.nix {}'

PRESFIL · 2024-07-31T21:53:08Z

Made a few more changes:

cloak is not the same cloak for hide service, cbeuw/cloak isn't
packaged for NixOS, wireguard-go is not an Amnesia-WG (maybe in march yet
there was no Amnesia-WG). Both of these dependencies are removed and taken
from deploy-prebuilt (although it might be better if they were built as
separate packages)
Moved share/ from usr/ to the root
Added desktop file, icon, service-file and files from deploy-prebuilt/*/bin
The breakpointHook is convenient to use for debugging

The final diff:

diff -u a/default.nix b/default.nix
--- default.nix
+++ default.nix
@@ -8,17 +8,20 @@
 , openssl
 , openvpn
 , tun2socks
-, cloak
+# , cloak # not the same one
+# only packaged on AUR https://github.com/amnezia-vpn/amnezia-client/issues/120
+# usage of prebuilt binaries!
 , shadowsocks-libev
-, wireguard-go
+# , wireguard-go # not the same one
 , xray
 , qt6
 , libsForQt5
+, breakpointHook
 }:
 
 stdenv.mkDerivation rec {
   pname = "amnezia-client";
-  version = "4.4.0.0";
+  version = "4.6.0.3";
   
   src = fetchFromGitHub {
     repo = "${pname}";
@@ -33,6 +36,7 @@
     cmake
     qt6.wrapQtAppsHook
     pkg-config
+    breakpointHook
   ];
 
   buildInputs = [
@@ -47,9 +51,9 @@
     openssl
     openvpn
     tun2socks
-    cloak
+#    cloak # not the same one
     shadowsocks-libev
-    wireguard-go
+#    wireguard-go # not the same one
     xray
   ];
 
@@ -57,9 +61,18 @@
   runHook preInstall
   make install
   mkdir $out/bin
-  mkdir -p $out/usr/share/{pixmaps,applications}
+  mkdir -p $out/share/{pixmaps,applications}
+  mkdir -p $out/share/systemd/system/
   cp client/AmneziaVPN $out/bin/
   cp service/server/AmneziaVPN-service $out/bin/
+  cp ../deploy/data/linux/client/bin/update-resolv-conf.sh $out/bin/
+  cp ../deploy/data/linux/AmneziaVPN.png $out/share/pixmaps/
+  cp ../deploy/data/linux/AmneziaVPN.service $out/share/systemd/system/
+  cp ../deploy/data/deploy-prebuilt/linux/client/bin/ck-client $out/bin/
+  cp ../deploy/data/deploy-prebuilt/linux/client/bin/geoip.dat $out/bin/
+  cp ../deploy/data/deploy-prebuilt/linux/client/bin/geosite.dat $out/bin/
+  cp ../deploy/data/deploy-prebuilt/linux/client/bin/wireguard-go $out/bin/
+  cp ../AppDir/AmneziaVPN.desktop $out/share/applications/
   runHook postInstall
   '';
-}
\ No newline
+}

`default.nix`

{ stdenv
, lib
, fetchFromGitHub
, cmake
, pkg-config
, libsecret
, libgcrypt
, openssl
, openvpn
, tun2socks
# , cloak # not the same one
# only packaged on AUR https://github.com/amnezia-vpn/amnezia-client/issues/120
# usage of prebuilt binaries!
, shadowsocks-libev
# , wireguard-go # not the same one
, xray
, qt6
, libsForQt5
, breakpointHook
}:

stdenv.mkDerivation rec {
  pname = "amnezia-client";
  version = "4.6.0.3";
  
  src = fetchFromGitHub {
    repo = "${pname}";
    owner = "amnezia-vpn";

    rev = "${version}";
    sha256 = "0k0sjf1c8iqg9crq4sfzdg4cczaq5pbk5j2873yzsw88rps0awac";
    fetchSubmodules = true;
  };
  
  nativeBuildInputs = [
    cmake
    qt6.wrapQtAppsHook
    pkg-config
    breakpointHook
  ];

  buildInputs = [
    qt6.qtbase
    qt6.qtremoteobjects
    qt6.qtsvg
    qt6.qttools
    qt6.qt5compat
    libsForQt5.qtkeychain
    libsecret
    libgcrypt
    openssl
    openvpn
    tun2socks
#    cloak # not the same one
    shadowsocks-libev
#    wireguard-go # not the same one
    xray
  ];

  installPhase = ''
  runHook preInstall
  make install
  mkdir $out/bin
  mkdir -p $out/share/{pixmaps,applications}
  mkdir -p $out/share/systemd/system/
  cp client/AmneziaVPN $out/bin/
  cp service/server/AmneziaVPN-service $out/bin/
  cp ../deploy/data/linux/client/bin/update-resolv-conf.sh $out/bin/
  cp ../deploy/data/linux/AmneziaVPN.png $out/share/pixmaps/
  cp ../deploy/data/linux/AmneziaVPN.service $out/share/systemd/system/
  cp ../deploy/data/deploy-prebuilt/linux/client/bin/ck-client $out/bin/
  cp ../deploy/data/deploy-prebuilt/linux/client/bin/geoip.dat $out/bin/
  cp ../deploy/data/deploy-prebuilt/linux/client/bin/geosite.dat $out/bin/
  cp ../deploy/data/deploy-prebuilt/linux/client/bin/wireguard-go $out/bin/
  cp ../AppDir/AmneziaVPN.desktop $out/share/applications/
  runHook postInstall
  '';
}

But the connection still fails:smiley: Amnezia-client is too heavily tied to
/usr, /opt and its prebuilt dependencies in /opt (see
client/utilities.cpp, maybe other places).

I assume that update-resolv-conf.sh cannot be put in bin/, I'm not sure if
the Amnezia-client will find it, maybe this is the reason why nothing
works. Perhaps the best way to store all these files is in share/ or lib/
but with the current implementation, Amnezia will not find them.

A complete list of dependencies is needed to make it clear which of them are
optional and which are mandatory. The wide variety of ways to install Amnezia
without good documentation is confusing.

This issue cannot be fixed without the help of the main developers.

chekoopa · 2024-08-01T16:23:54Z

Considering executable dependencies, we may add a patch to replace these calls with /usr/bin/env <basename>. It probably would make some effect (and even start connecting). But it may be pretty unsafe, however, like for name squatting.

amnezia-client/client/utilities.cpp

Lines 117 to 123 in ffe2314

    
           QString Utils::usrExecutable(const QString &baseName) 
        
           { 
        
               if (QFileInfo::exists("/usr/sbin/" + baseName)) 
        
                   return ("/usr/sbin/" + baseName); 
        
               else 
        
                   return ("/usr/bin/" + baseName); 
        
           }

resolv.conf editing is nasty in NixOS, as it is almost always symlinked. However, I suppose it is needed for Amnezia VPN, which is useful, however is not on the critical path.

chekoopa · 2024-08-01T16:30:15Z

Yes, I've made a little research on Nixpkgs and found a few nice examples of path replacement patches:

https://github.com/NixOS/nixpkgs/tree/affeca17c005add89347d9bdfbc2c8bba4728aa9/pkgs/kde/plasma/plasma-nm

https://github.com/NixOS/nixpkgs/tree/affeca17c005add89347d9bdfbc2c8bba4728aa9/pkgs/tools/virtualization/google-guest-configs

averyanalex · 2024-09-16T08:39:08Z

If someone interested, I packaged kernel module, amneziawg-tools, amneziawg-go and updated wg-quick nixos module.

BANanaD3V · 2024-10-09T05:01:29Z

cloak is not the same cloak for hide service, cbeuw/cloak

If you're still interested, I've packaged cloak as cloak-pt. Already in nixpkgs for quite some time.

ritascarlet · 2024-11-25T08:03:59Z

Sorry, I would like to know about the promotion of AmneziaVPN-client. It still cannot be packaged for nixos?

adrianopol · 2024-11-25T21:45:13Z

Hello, @ritascarlet , I assume it is already in unstable branch: https://search.nixos.org/packages?channel=unstable&sort=relevance&type=packages&query=amnezia

averyanalex · 2024-11-25T21:46:55Z

Hello, @ritascarlet , I assume it is already in unstable branch: https://search.nixos.org/packages?channel=unstable&sort=relevance&type=packages&query=amnezia

Yes, but this is a CLI clients, the GUI client is not packaged yet

ritascarlet · 2024-11-25T21:51:35Z

Да, но это CLI-клиент, GUI-клиент еще не упакован

If it's not difficult for you, then can you tell me how to use the clients currently in the repository correctly? I'm completely new to NixOs, Therefore, I do not understand what packages to install for my kernel (linux nixos 6.6.62)

averyanalex · 2024-11-25T21:54:43Z

Да, но это CLI-клиент, GUI-клиент еще не упакован

If it's not difficult for you, then can you tell me how to use the clients currently in the repository correctly? I'm completely new to NixOs, Therefore, I do not understand what packages to install for my kernel (linux nixos 6.6.62)

I think you should wait for NixOS/nixpkgs#341663. Or, if you want to use it right now, you can switch to unstable branch, add amneziawg tools to system packages, and add amneziawg to kernel packages. Then just use awg-quick cli tool.

ritascarlet · 2024-11-25T21:58:03Z

I think you should wait for NixOS/nixpkgs#341663. Or, if you want to use it right now, you can switch to unstable branch, add amneziawg tools to system packages, and add amneziawg to kernel packages. Then just use awg-quick cli tool.

Great, I will try to do everything as you said, I will definitely wait for the client’s packaging. Thank you very much!

PRESFIL · 2024-12-19T20:15:44Z

There is also this PR NixOS/nixpkgs#360866 .

sund3RRR · 2024-12-23T18:55:09Z

I got it working NixOS/nixpkgs#338380 (comment)
I can start making a PR or help someone, who wants to maintain the package

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Packaging for NixOS #676

Packaging for NixOS #676

spl3g commented Mar 7, 2024 •

edited

Loading

chekoopa commented Apr 21, 2024

pokamest commented Apr 22, 2024

Askodon commented Jul 19, 2024

PRESFIL commented Jul 29, 2024 •

edited

Loading

PRESFIL commented Jul 31, 2024

chekoopa commented Aug 1, 2024 •

edited

Loading

chekoopa commented Aug 1, 2024

averyanalex commented Sep 16, 2024

BANanaD3V commented Oct 9, 2024

ritascarlet commented Nov 25, 2024

adrianopol commented Nov 25, 2024

averyanalex commented Nov 25, 2024

ritascarlet commented Nov 25, 2024

averyanalex commented Nov 25, 2024

ritascarlet commented Nov 25, 2024

PRESFIL commented Dec 19, 2024

sund3RRR commented Dec 23, 2024 •

edited

Loading

Packaging for NixOS #676

Packaging for NixOS #676

Comments

spl3g commented Mar 7, 2024 • edited Loading

chekoopa commented Apr 21, 2024

pokamest commented Apr 22, 2024

Askodon commented Jul 19, 2024

PRESFIL commented Jul 29, 2024 • edited Loading

PRESFIL commented Jul 31, 2024

chekoopa commented Aug 1, 2024 • edited Loading

chekoopa commented Aug 1, 2024

averyanalex commented Sep 16, 2024

BANanaD3V commented Oct 9, 2024

ritascarlet commented Nov 25, 2024

adrianopol commented Nov 25, 2024

averyanalex commented Nov 25, 2024

ritascarlet commented Nov 25, 2024

averyanalex commented Nov 25, 2024

ritascarlet commented Nov 25, 2024

PRESFIL commented Dec 19, 2024

sund3RRR commented Dec 23, 2024 • edited Loading

spl3g commented Mar 7, 2024 •

edited

Loading

PRESFIL commented Jul 29, 2024 •

edited

Loading

chekoopa commented Aug 1, 2024 •

edited

Loading

sund3RRR commented Dec 23, 2024 •

edited

Loading