From f5e9941dc727f86f820752df76d27d7e0fc52ef2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Aleix=20Bon=C3=A9?= <aleix.boneribo@bsc.es>
Date: Mon, 9 Mar 2026 15:41:57 +0100
Subject: [PATCH] Remove proot support

---
 pkgs/nix-portable/default.nix | 44 ++++++-----------------------------
 1 file changed, 7 insertions(+), 37 deletions(-)

diff --git a/pkgs/nix-portable/default.nix b/pkgs/nix-portable/default.nix
index 232547ab..47c63aae 100644
--- a/pkgs/nix-portable/default.nix
+++ b/pkgs/nix-portable/default.nix
@@ -2,7 +2,6 @@ with builtins;
 {
   bwrap,
   nix,
-  proot,
   unzip,
   zip,
   unixtools,
@@ -106,7 +105,6 @@ let
 
   bwrap = packStaticBin "${inp.bwrap}/bin/bwrap";
   nixStatic = packStaticBin "${inp.nixStatic}/bin/nix";
-  proot = packStaticBin "${inp.proot}/bin/proot";
   zstd = packStaticBin "${inp.zstd}/bin/zstd";
 
   # the default nix store contents to extract when first used
@@ -114,7 +112,7 @@ let
 
 
   # The runtime script which unpacks the necessary files to $HOME/.nix-portable
-  # and then executes nix via proot or bwrap
+  # and then executes nix via bwrap
   # Some shell expressions will be evaluated at build time and some at run time.
   # Variables/expressions escaped via `\$` will be evaluated at run time
   runtimeScript = ''
@@ -129,17 +127,6 @@ let
       trap "declare -p > \''${TMPDIR:-/tmp}/np_env" EXIT
     fi
 
-    # there seem to be less issues with proot when disabling seccomp
-    # though on android it is needed
-    if [ -n "\$TERMUX_VERSION" ]; then
-      unset LD_PRELOAD
-      NP_RUNTIME=\''${NP_RUNTIME:-proot}
-      export PROOT_TMP_DIR="\$TMPDIR/proot"
-      mkdir -p "\$PROOT_TMP_DIR"
-    else
-      export PROOT_NO_SECCOMP=\''${PROOT_NO_SECCOMP:-1}
-    fi
-
     set -e
     if [ -n "\$NP_DEBUG" ] && [ "\$NP_DEBUG" -ge 2 ]; then
       set -x
@@ -256,7 +243,6 @@ let
 
       # install other binaries
       ${installBin zstd "zstd"}
-      ${installBin proot "proot"}
       ${installBin bwrap "bwrap"}
       ${installBin nixStatic "nix"}
 
@@ -392,9 +378,6 @@ let
     debug "bwrap executable: \$NP_BWRAP"
     [ -z "\$NP_NIX" ] && NP_NIX=\$dir/bin/nix
     debug "nix executable: \$NP_NIX"
-    [ -z "\$NP_PROOT" ] && NP_PROOT=\$(PATH="\$PATH_OLD:\$PATH" which proot 2>/dev/null) || true
-    [ -z "\$NP_PROOT" ] && NP_PROOT=\$dir/bin/proot
-    debug "proot executable: \$NP_PROOT"
     debug "testing all available runtimes..."
     if [ -z "\$NP_RUNTIME" ]; then
       # read last automatic selected runtime from disk
@@ -451,15 +434,8 @@ let
         \$binds"
         # --bind \$dir/busybox/bin/busybox /bin/sh\\
     else
-      # proot
-      collectBinds
-      makeBindArgs -b ":" \$toBind \$sslBind
-      run="\$NP_PROOT \$PROOT_ARGS\\
-        -r \$dir/emptyroot\\
-        -b /dev:/dev\\
-        -b \$dir/nix:/nix\\
-        \$binds"
-        # -b \$dir/busybox/bin/busybox:/bin/sh\\
+      echo "\$NP_RUNTIME not available"
+      exit 1
     fi
     debug "base command will be: \$run"
 
@@ -601,14 +577,9 @@ let
 
     ### run commands
     [ -z "\$NP_RUN" ] && NP_RUN="\$run"
-    if [ "\$NP_RUNTIME" == "proot" ]; then
-      debug "running command: \$NP_RUN \$bin \$@"
-      exec \$NP_RUN \$bin "\$@"
-    else
-      cmd="\$NP_RUN \$bin \$@"
-      debug "running command: \$cmd"
-      exec \$NP_RUN \$bin "\$@"
-    fi
+    cmd="\$NP_RUN \$bin \$@"
+    debug "running command: \$cmd"
+    exec \$NP_RUN \$bin "\$@"
     exit
   '';
 
@@ -646,7 +617,6 @@ let
     zip="${zip}/bin/zip -0"
     $zip $out/bin/nix-portable.zip ${bwrap}/bin/bwrap
     $zip $out/bin/nix-portable.zip ${nixStatic}/bin/nix
-    $zip $out/bin/nix-portable.zip ${proot}/bin/proot
     $zip $out/bin/nix-portable.zip ${zstd}/bin/zstd
     $zip $out/bin/nix-portable.zip ${storeTar}/tar
     $zip $out/bin/nix-portable.zip ${caBundleZstd}
@@ -670,6 +640,6 @@ let
 in
 nixPortable.overrideAttrs (prev: {
   passthru = (prev.passthru or {}) // {
-    inherit bwrap proot;
+    inherit bwrap;
   };
 })