Add arm64 static build binary

[saschagrunert]

This adds an arm64 derivation to the static binary build.

Manual test

> nix-build nix/arm64.nix
> file result/bin/conmon
result/bin/conmon: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, for GNU/Linux 2.6.32, stripped

Test build: conmon.tar.gz
Refers to cri-o/cri-o#4552

[saschagrunert]

The cache is 2131Mb large and the build took ~2 hours. I think if the cache only invalidates when updating the pinned nixpkgs then we're probably fine with that change, right?

PTAL @cevich

[cevich]

cache only invalidates when updating the pinned nixpkgs then we're probably fine with that change, right?

I'm nearly always amazed by how deceptively complex caching can be. A 2-hour build puts us right up there against a hard-coded Cirrus-CI max job runtime (no setting can override it). Considering our experience on the podman repo, would it make sense to go straight to the cachix solution here as well?

[cevich]

Good first-draft, I made a few comments/questions for discussion. Bonous points for getting it working on your own!

[saschagrunert]

Considering our experience on the podman repo, would it make sense to go straight to the cachix solution here as well?

Yeah I think using cachix is a good move forward here. I'll pre-populate the conmon cache and come back to the CI if that is done. 👍

[saschagrunert]

The job is down to 3 minutes with the cache, and the binary artifacts looks fine, too:

> file conmon
conmon: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, for GNU/Linux 2.6.32, stripped
> qemu-aarch64 ./conmon --version
conmon version 2.0.27-dev
commit: 70b68113db9745369071c9d1e4f876cb31259abb-dirty

[cevich]

Great! Thanks for all your work on this. Do you want to e-mail me so I can create an encrypted $CACHIX_AUTH_TOKEN?

(apologies if you already did and I didn't see it yet for some reason)

[saschagrunert]

(apologies if you already did and I didn't see it yet for some reason)

Yes, I already did it :)

[cevich]

Well go figure, now that I go looking for it...there it is! 🤣

Use ENCRYPTED[4c3b8d82b0333abf048c56a71f2559ddb1c9ed38f0c28916eca13f79affa5904cf90c76a5bd8686680c89f41079ef341]

[cevich]

It looks to me like there's a lot of duplication between static_binary_task and static_binary_arm64_task. Just by eyeball, is the only difference default.nix vs default-arm64.nix?

Assuming so, we can easily simplify this to one task, using an env. var. and a matrix...

[saschagrunert]

It looks to me like there's a lot of duplication between static_binary_task and static_binary_arm64_task. Just by eyeball, is the only difference default.nix vs default-arm64.nix?

Assuming so, we can easily simplify this to one task, using an env. var. and a matrix...

Alright changed to a matrix, let's see how that works.

[cevich]

Lol, I was just about to post a proposed diff but you posted almost the exact same change 😄

I think the only secret-sauce (it's not obvious) in the task is alias: static_binary (that will cause the name: value to work properly)

[saschagrunert]

Lol, I was just about to post a proposed diff but you posted almost the exact same change

I think the only secret-sauce (it's not obvious) in the task is alias: static_binary (that will cause the name: value to work properly)

Ah thank you for the hint, are those names fine now? Both binaries are looking good, the cache works as intended.

[TomSweeneyRedHat]

I'm not at all an expert in this arena, but the changes LGTM.
@cevich and @saschagrunert thank you both for your great work here!

[cevich]

Ah thank you for the hint, are those names fine now?

Hmmm, something is still wrong...oh, you removed the 'name' attr. from matrix, that's why. No matter, I think it's probably fine as-is...it's a small detail not worth fretting over. Important thing is you got it all working 😀

/lgtm

[cevich]

Woops...no bot here.