Build failure: pkgsCross.armv7l-hf-multiplatform.fail2ban

[Siroj42]

Steps To Reproduce

Steps to reproduce the behavior:

1. nix-build <nixpkgs> -A pkgsCross.armv7l-hf-multiplatform.fail2ban (qemu binfmt emulation must be enabled for armv7l-linux, otherwise a different error occurs when cross-compiling)

Build log

(...)
error: output '/nix/store/7c0b10j95pcr7m0aq3f8c2jx3485m47m-fail2ban-1.0.2-armv7l-unknown-linux-gnueabihf' is not allowed to refer to the following paths:
         /nix/store/6jx4nc20v3cfphlbypqid30q41i5vh5x-python3-3.10.11

Additional context

I originally came upon this error when trying to build a NixOS SD card image with the fail2ban service enabled. The issue is related to cross-compilation. I'm not an expert, but it looks like the cross-compiled fail2ban package tries to interact in some way with the host's x86_64 python package, which understandably isn't allowed, as that wouldn't work on the target system.

Metadata

[user@system:~]$ nix-shell -p nix-info --run "nix-info -m"
 - system: `"x86_64-linux"`
 - host os: `Linux 6.1.30, NixOS, 23.11 (Tapir), 23.11.20230529.5e871d8`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.13.3`
 - channels(root): `"nixos"`
 - channels(siroj42): `""`
 - nixpkgs: `/nix/var/nix/profiles/per-user/root/channels/nixos`

[ius]

(qemu binfmt emulation must be enabled for armv7l-linux, otherwise a different error occurs when cross-compiling)

Shouldn't be necessary.

At least one issue is that the cross target python is invoked for 2to3 conversion instead of native python.

error: builder for '/nix/store/q64zvj2kvkznw7js6p22x7q8qlg9vnnk-fail2ban-1.0.2-armv7l-unknown-linux-gnueabihf.drv' failed with exit code 1;
       last 10 log lines:
       > updateAutotoolsGnuConfigScriptsPhase
       > configuring
       > patching script interpreter paths in fail2ban-2to3
       > fail2ban-2to3: interpreter directive changed from "#!/bin/bash" to "/nix/store/8fv91097mbh5049i9rglc73dx6kjg3qk-bash-5.2-p15/bin/bash"
       > /nix/store/gmp0lbjab6x4vsc3cc6fjb5j2d4772ga-python3-armv7l-unknown-linux-gnueabihf-3.10.12/bin/2to3: line 2: import: command not found
       > /nix/store/gmp0lbjab6x4vsc3cc6fjb5j2d4772ga-python3-armv7l-unknown-linux-gnueabihf-3.10.12/bin/2to3: line 3: from: command not found

I don't know how this should be fixed though.

Maybe related: #211340

[Artturin]

Fix in #228139

we also somehow get a correctly spliced python in nativeBuildInputs for free

[Artturin]

Even after applying

commit b7b911530adf8df23b8d323eb417fbef234a1a2e
Author: Artturin <[email protected]>
Date:   Tue Jul 25 00:33:24 2023 +0300

    fail2ban: Fix cross

diff --git a/pkgs/tools/security/fail2ban/default.nix b/pkgs/tools/security/fail2ban/default.nix
index 780f1b4dfb0c..a3ebec571e0d 100644
--- a/pkgs/tools/security/fail2ban/default.nix
+++ b/pkgs/tools/security/fail2ban/default.nix
@@ -25,7 +25,7 @@ python3.pkgs.buildPythonApplication rec {
     ];
 
   preConfigure = ''
-    patchShebangs fail2ban-2to3
+    patchShebangs --build fail2ban-2to3
     ./fail2ban-2to3
 
     for i in config/action.d/sendmail*.conf; do
@@ -43,7 +43,7 @@ python3.pkgs.buildPythonApplication rec {
     substituteInPlace setup.py --replace /usr/share/doc/ share/doc/
 
     # see https://github.com/NixOS/nixpkgs/issues/4968
-    ${python3.interpreter} setup.py install_data --install-dir=$out --root=$out
+    ${python3.pythonForBuild.interpreter} setup.py install_data --install-dir=$out --root=$out
   '';
 
   postInstall =

it fails with

error: output '/nix/store/pq9b4xfv5gaw236rw9qwzzrzjk84wvrj-fail2ban-1.0.2-aarch64-unknown-linux-gnu' is not allowed to refer to the following paths:

applying

diff --git a/pkgs/tools/security/fail2ban/default.nix b/pkgs/tools/security/fail2ban/default.nix
index 780f1b4dfb0c..c661e507e58f 100644
--- a/pkgs/tools/security/fail2ban/default.nix
+++ b/pkgs/tools/security/fail2ban/default.nix
@@ -25,7 +25,9 @@ python3.pkgs.buildPythonApplication rec {
     ];
 
   preConfigure = ''
-    patchShebangs fail2ban-2to3
+    substituteInPlace fail2ban-2to3 \
+      --replace "2to3" "${python3.pythonForBuild}/bin/2to3"
+    patchShebangs --build fail2ban-2to3
     ./fail2ban-2to3
 
     for i in config/action.d/sendmail*.conf; do
@@ -43,7 +45,7 @@ python3.pkgs.buildPythonApplication rec {
     substituteInPlace setup.py --replace /usr/share/doc/ share/doc/
 
     # see https://github.com/NixOS/nixpkgs/issues/4968
-    ${python3.interpreter} setup.py install_data --install-dir=$out --root=$out
+    ${python3.pythonForBuild.interpreter} setup.py install_data --install-dir=$out --root=$out
   '';
 
   postInstall =

Fails with the same error, So my PR does not cause it.

Building with nix build --impure --expr 'with import ./. {}; pkgsCross.aarch64-multiplatform.fail2ban.overrideAttrs { disallowedReferences = [ ]; }' allows us to debug

$ nix why-depends $(chase result) "/nix/store/9c03r86hcdn43dm3hsgjirifvyzfkhwh-python3-3.10.12" --all --precise
/nix/store/n63mh8r2afrwvznlb7wvkfi186bs9f3s-fail2ban-1.0.2-aarch64-unknown-linux-gnu
    → /nix/store/9c03r86hcdn43dm3hsgjirifvyzfkhwh-python3-3.10.12
└───bin/fail2ban-python: …nd._edata.GLIBC_2.34./nix/store/9c03r86hcdn43dm3hsgjirifvyzfkhwh-python3-3.10.12/lib:/nix/store/…

[Artturin]

#261584