FDS/OS 1.0

tools/in-frozen-build

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Run inside a restored tree with private Cargo/Rustup caches and no network.
+source "$(dirname -- "${BASH_SOURCE[0]}")/lib.sh"
+(( $# > 0 )) || die 'Usage: tools/in-frozen-build COMMAND [ARGUMENT...]'
+[[ -f $FDS_ROOT/.host/frozen/lock.json ]] || die 'Use tools/frozen-inputs restore first'
+(( EUID != 0 )) || die 'Run as an ordinary user'
+export CARGO_HOME="$FDS_ROOT/.host/repro-cargo"
+export RUSTUP_HOME="$FDS_ROOT/.host/repro-rustup"
+export FDS_OFFLINE=1
+export CARGO_NET_OFFLINE=true
+check_void_pin
+rust_bin=$(dirname -- "$(rustup which rustc)")
+# Keep the workstation read-only; all writable caches and output stay in the
+# restored tree. Network isolation covers xbps-src and every nested child too.
+exec bwrap --unshare-user --unshare-net --ro-bind / / --bind "$FDS_ROOT" "$FDS_ROOT" \
+    --tmpfs /tmp --dev /dev --proc /proc \
+    --setenv PATH "$rust_bin:$PATH" --chdir "$FDS_ROOT" "$@"