Remove proot from nix-portable

The pkgsStatic.proot is broken due to failed
dependencies. In upstream nix-portable they have
a custom derivation on top o proot gitlab. But
since we don't need it, we can remove it safely.

Reviewed-by: Rodrigo Arias Mallo <rodrigo.arias@bsc.es>

m/hut/gitlab-runner.nix

@@ -51,6 +51,7 @@
           "/nix/store:/nix/store:ro"
           "/nix/var/nix/db:/nix/var/nix/db:ro"
           "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
+          "/var/run/postgresql/:/var/run/postgresql/"
         ];
         dockerExtraHosts = [
           # Required to pass the proxy via hut

m/hut/monitoring.nix

@@ -5,7 +5,7 @@
     ../module/slurm-exporter.nix
     ../module/meteocat-exporter.nix
     ../module/upc-qaire-exporter.nix
-    ./gpfs-probe.nix
+    ./ssh-robot-probes.nix
     ../module/nix-daemon-exporter.nix
   ];
 
@@ -111,6 +111,7 @@
             "127.0.0.1:${toString config.services.prometheus.exporters.smartctl.port}"
             "127.0.0.1:9341" # Slurm exporter
             "127.0.0.1:9966" # GPFS custom exporter
+            "127.0.0.1:9967" # SLURM custom exporter
             "127.0.0.1:9999" # Nix-daemon custom exporter
             "127.0.0.1:9929" # Meteocat custom exporter
             "127.0.0.1:9928" # UPC Qaire custom exporter

m/hut/postgresql.nix

@@ -8,12 +8,14 @@
       { name = "anavarro"; ensureClauses.superuser = true; }
       { name = "rarias";   ensureClauses.superuser = true; }
       { name = "grafana"; }
+      { name = "gitlab-runner"; }
     ];
     authentication = ''
-      #type  database     DBuser    auth-method
-      local  perftestsdb  rarias    trust
-      local  perftestsdb  anavarro  trust
-      local  perftestsdb  grafana   trust
+      #type  database     DBuser         auth-method
+      local  perftestsdb  rarias         trust
+      local  perftestsdb  anavarro       trust
+      local  perftestsdb  grafana        trust
+      local  perftestsdb  gitlab-runner  trust
     '';
   };
 }

m/hut/sblame-probe.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+cat <<EOF
+HTTP/1.1 200 OK
+Content-Type: text/plain; version=0.0.4; charset=utf-8; escaping=values
+
+EOF
+ssh bsc015557@glogin2.bsc.es "timeout 3 command sblame -E"

m/hut/ssh-robot-probes.nix

@@ -6,6 +6,12 @@ let
       chmod +x $out
     ''
   ;
+  sblame-probe-script = pkgs.runCommand "sblame-probe.sh" { }
+    ''
+      cp ${./sblame-probe.sh} $out;
+      chmod +x $out
+    ''
+  ;
 in
 {
   # Use a new user to handle the SSH keys
@@ -28,4 +34,17 @@ in
       Group = "ssh-robot";
     };
   };
+
+  systemd.services.sblame-probe = {
+    description = "Daemon to report SLURM statistics via SSH";
+    path = [ pkgs.openssh pkgs.netcat ];
+    after = [ "network.target" ];
+    wantedBy = [ "default.target" ];
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "${pkgs.socat}/bin/socat TCP4-LISTEN:9967,fork EXEC:${sblame-probe-script}";
+      User = "ssh-robot";
+      Group = "ssh-robot";
+    };
+  };
 }

overlay.nix

@@ -19,11 +19,7 @@ let
     cudainfo = prev.callPackage ./pkgs/cudainfo/default.nix { };
     #extrae = callPackage ./pkgs/extrae/default.nix { }; # Broken and outdated
     gpi-2 = callPackage ./pkgs/gpi-2/default.nix { };
-    intel-apt = callPackage ./pkgs/intel-oneapi/packages.nix { };
     intelPackages_2023 = callPackage ./pkgs/intel-oneapi/2023.nix { };
-    intelPackages_2024 = final.intel-apt.hpckit_2024;
-    intelPackages_2025 = final.intel-apt.hpckit_2025;
-    intelPackages = final.intelPackages_2025;
     jemallocNanos6 = callPackage ./pkgs/nanos6/jemalloc.nix { };
     # FIXME: Extend this to all linuxPackages variants. Open problem, see:
     # https://discourse.nixos.org/t/whats-the-right-way-to-make-a-custom-kernel-module-available/4636
@@ -43,12 +39,10 @@ let
     nanos6Debug = final.nanos6.override { enableDebug = true; };
     nixtools = callPackage ./pkgs/nixtools/default.nix { };
     nixgen = callPackage ./pkgs/nixgen/default.nix { };
-    # Broken because of pkgsStatic.libcap
-    # See: https://github.com/NixOS/nixpkgs/pull/268791
-    #nix-wrap = callPackage ./pkgs/nix-wrap/default.nix { };
+    nix-portable = callPackage ./pkgs/nix-portable/default.nix { };
+    nix-wrap = callPackage ./pkgs/nix-wrap/default.nix { };
     nodes = callPackage ./pkgs/nodes/default.nix { };
     nosv = callPackage ./pkgs/nosv/default.nix { };
-    oneMath = callPackage ./pkgs/onemath/default.nix { };
     openmp = callPackage ./pkgs/llvm-ompss2/openmp.nix { monorepoSrc = final.clangOmpss2Unwrapped.src; version = final.clangOmpss2Unwrapped.version; };
     openmpv = final.openmp.override { enableNosv = true; enableOvni = true; };
     osumb = callPackage ./pkgs/osu/default.nix { };
@@ -66,8 +60,6 @@ let
     stdenvClangOmpss2NodesOmpv = final.stdenv.override { cc = final.clangOmpss2NodesOmpv; allowedRequisites = null; };
     tagaspi = callPackage ./pkgs/tagaspi/default.nix { };
     tampi = callPackage ./pkgs/tampi/default.nix { };
-    tasycl = callPackage ./pkgs/tasycl/default.nix { };
-    tasycl-acpp = callPackage ./pkgs/tasycl/default.nix { useIntel = false; };
     upc-qaire-exporter = prev.callPackage ./pkgs/upc-qaire-exporter/default.nix { };
     wxparaver = callPackage ./pkgs/paraver/default.nix { };
   };
@@ -77,8 +69,6 @@ let
     #sigsegv = callPackage ./test/reproducers/sigsegv.nix { };
     hello-c = callPackage ./test/compilers/hello-c.nix { };
     hello-cpp = callPackage ./test/compilers/hello-cpp.nix { };
-    hello-sycl = callPackage ./test/compilers/hello-sycl.nix { };
-    hello-syclompss = callPackage ./test/compilers/icpx-ompss2.nix { };
     lto = callPackage ./test/compilers/lto.nix { };
     asan = callPackage ./test/compilers/asan.nix { };
     intel2023-icx-c   = hello-c.override   { stdenv = final.intelPackages_2023.stdenv; };
@@ -88,13 +78,6 @@ let
     intel2023-ifort   = callPackage ./test/compilers/hello-f.nix {
       stdenv = final.intelPackages_2023.stdenv-ifort;
     };
-    intel2024-icx-c   = hello-c.override   { stdenv = final.intelPackages_2024.stdenv; };
-    intel2025-icx-c   = hello-c.override   { stdenv = final.intelPackages_2025.stdenv; };
-    intel2024-icx-cpp = hello-cpp.override { stdenv = final.intelPackages_2024.stdenv; };
-    intel2025-icx-cpp = hello-cpp.override { stdenv = final.intelPackages_2025.stdenv; };
-    # intel2023-sycl    = hello-sycl.override { intelPackages = final.intelPackages_2023; }; # broken
-    intel2024-sycl    = hello-sycl.override { intelPackages = final.intelPackages_2024; };
-    intel2025-sycl    = hello-sycl.override { intelPackages = final.intelPackages_2025; };
     clangOmpss2-lto   = lto.override       { stdenv = final.stdenvClangOmpss2Nanos6; };
     clangOmpss2-asan  = asan.override      { stdenv = final.stdenvClangOmpss2Nanos6; };
     clangOmpss2-task  = callPackage ./test/compilers/ompss2.nix {

pkgs/amd-uprof/default.nix

@@ -1,8 +1,6 @@
 { stdenv
 , lib
-, curl
-, cacert
-, runCommandLocal
+, fetchurl
 , autoPatchelfHook
 , elfutils
 , glib
@@ -26,26 +24,22 @@ let
   tarball = "AMDuProf_Linux_x64_${version}.tar.bz2";
 
   # NOTE: Remember to update the radare2 patch below if AMDuProfPcm changes.
-  uprofSrc = runCommandLocal tarball {
-    nativeBuildInputs = [ curl ];
-    outputHash = "sha256-j9gxcBcIg6Zhc5FglUXf/VV9bKSo+PAKeootbN7ggYk=";
-    SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt";
-  } ''
-    curl \
-    -o $out \
-    'https://download.amd.com/developer/eula/uprof/uprof-5-1/${tarball}' \
-    -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0' \
-    -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' \
-    -H 'Accept-Language: en-US,en;q=0.5' \
-    -H 'Accept-Encoding: gzip, deflate, br, zstd' \
-    -H 'Referer: https://www.amd.com/' 2>&1 | tr '\r' '\n'
-  '';
+  src = fetchurl {
+    url = "https://download.amd.com/developer/eula/uprof/uprof-5-1/${tarball}";
+    sha256 = "sha256-j9gxcBcIg6Zhc5FglUXf/VV9bKSo+PAKeootbN7ggYk=";
+    curlOptsList = [
+      "-H" "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0"
+      "-H" "'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'"
+      "-H" "Accept-Language: en-US,en;q=0.5"
+      "-H" "Accept-Encoding: gzip, deflate, br, zstd"
+      "-H" "Referer: https://www.amd.com/"
+    ];
+  };
 
 in
   stdenv.mkDerivation {
     pname = "AMD-uProf";
-    inherit version;
-    src = uprofSrc;
+    inherit src version;
     dontStrip = true;
     phases = [ "installPhase" "fixupPhase" ];
     nativeBuildInputs = [ autoPatchelfHook radare2 ];

pkgs/intel-oneapi/2023.nix

@@ -40,19 +40,45 @@ let
     mpi      = "2021.9.0";
   };
 
-  findMatch = name:
-  let
-    aptPackages = builtins.fromJSON (builtins.readFile ./packages.json);
-    matches = lib.filter (x: name == x.pname) aptPackages;
-    n = lib.length matches;
-    match = builtins.traceVerbose (name + " -- ${builtins.toString n}") (builtins.head matches);
+  aptPackageIndex = stdenv.mkDerivation {
+    name = "intel-oneapi-packages";
+    srcs = [
+      # Run update.sh to update the package lists
+      ./amd64-packages ./all-packages
+    ];
+    phases = [ "installPhase" ];
+    installPhase = ''
+      awk -F': ' '\
+        BEGIN   { print "[ {" } \
+        NR>1 && /^Package: / { print "} {"; } \
+        /: /    { printf "%s = \"%s\";\n", $1, $2 } \
+        END     { print "} ]" }' $srcs > $out
+    '';
+  };
 
-    apthost = "https://apt.repos.intel.com/oneapi/";
+  aptPackages = import aptPackageIndex;
+
+  apthost = "https://apt.repos.intel.com/oneapi/";
+
+  getSum = pkgList: name:
+  let
+    matches = lib.filter (x: name == x.Package) pkgList;
+    #n = lib.length matches;
+    #match = builtins.trace (name + " -- ${builtins.toString n}") (lib.elemAt matches 0);
+    match = lib.elemAt matches 0;
   in
-    {
-      url = apthost + match.filename;
-      sha256 = match.sha256;
-    };
+    match.SHA256;
+
+  getUrl = pkgList: name:
+  let
+    matches = lib.filter (x: name == x.Package) pkgList;
+    #match = assert lib.length matches == 1; lib.elemAt matches 0;
+    n = lib.length matches;
+    match =
+      #builtins.trace (name + " -- n=${builtins.toString n}")
+      (lib.elemAt matches 0);
+  in
+    apthost + match.Filename;
 
   uncompressDebs = debs: name: stdenv.mkDerivation {
     name = name;
@@ -72,7 +98,10 @@ let
 
   joinDebs = name: names:
   let
-    debs = builtins.map (x: builtins.fetchurl (findMatch x)) names;
+    urls = builtins.map (x: getUrl aptPackages x) names;
+    sums = builtins.map (x: getSum aptPackages x) names;
+    getsrc = url: sha256: builtins.fetchurl { inherit url sha256; };
+    debs = lib.zipListsWith getsrc urls sums;
   in
     uncompressDebs debs "${name}-source";
 
@@ -441,7 +470,7 @@ let
     '';
   };
 
-  ifort-wrapper = wrapIntel {
+  ifort-wrapper = wrapIntel rec {
     cc = intel-compiler-fortran;
     mygcc = gcc;
     extraBuild = ''

pkgs/intel-oneapi/packages.nix

@@ -1,297 +0,0 @@
-{
-  lib,
-  stdenv,
-  callPackage,
-  dpkg,
-  fetchurl,
-
-  sqlite,
-  elfutils,
-}:
-
-let
-  inherit (builtins)
-    attrNames
-    attrValues
-    concatMap
-    elem
-    filter
-    fromJSON
-    getAttr
-    groupBy
-    head
-    isNull
-    listToAttrs
-    map
-    mapAttrs
-    readFile
-    replaceStrings
-    splitVersion
-    ;
-  inherit (lib)
-    converge
-    findFirst
-    groupBy'
-    hasPrefix
-    optional
-    pipe
-    take
-    toInt
-    toList
-    versionAtLeast
-    versionOlder
-    ;
-
-  aptData = fromJSON (readFile ./packages.json);
-
-  # Compare versions in debian control file syntax
-  # See: https://www.debian.org/doc/debian-policy/ch-relationships.html#syntax-of-relationship-fields
-  #
-  # NOTE: this is not a proper version comparison
-  #
-  # A proper version solver, should aggregate dependencies with the same name
-  # and compute the constraint (e.g. a (>= 2) a (<< 5) -> 2 <= a << 5)
-  #
-  # But in the intel repo, there are no such "duplicated" dependencies to specify
-  # upper limits, which leads to issues when intel-hpckit-2021 depends on things
-  # like intel-basekit >= 2021.1.0-2403 and we end up installing the newest
-  # basekit instead of the one from 2021.
-  #
-  # To mitigate this, >= is set to take the latest version with matching major
-  # and minor (only revision and patch are allowed to change)
-  compareVersions =
-    got: kind: want:
-    let
-      g0 = take 2 (splitVersion got);
-      w0 = take 2 (splitVersion want);
-    in
-    if isNull want then
-      true
-    else if kind == "=" then
-      got == want
-    else if kind == "<<" then
-      versionOlder got want
-    else if kind == "<=" then
-      versionAtLeast want got
-    else if kind == ">>" then
-      versionOlder want got
-    else if kind == ">=" then
-      (g0 == w0) && versionAtLeast got want # always match major version
-    else
-      throw "unknown operation: ${kind}";
-
-  findMatching =
-    {
-      pname,
-      kind,
-      version,
-    }:
-    findFirst (x: pname == x.pname && compareVersions x.version kind version) null aptData;
-
-  isIntel = pkg: (hasPrefix "intel-" pkg.pname);
-
-  expandDeps =
-    pkg: (map findMatching (filter isIntel pkg.dependencies)) ++ (optional (pkg.size != 0) pkg);
-
-  # get the oldest by major version. If they have the same major version, take
-  # the newest. This prevents most issues with resolutions
-  # versionOlder b a -> true if b is older than a (b `older` a)
-  getNewerInMajor =
-    a: b:
-    let
-      va = a.version;
-      vb = b.version;
-      va0 = head (splitVersion va);
-      vb0 = head (splitVersion vb);
-    in
-    if isNull a then
-      b
-    else if va0 != vb0 then
-      if va0 > vb0 then b else a
-    else if versionOlder vb va then
-      a
-    else
-      b;
-  removeDups = l: attrValues (groupBy' getNewerInMajor null (getAttr "provides") l);
-
-  _resolveDeps = converge (l: removeDups (concatMap expandDeps l));
-  resolveDeps =
-    pkg:
-    let
-      deps = _resolveDeps (toList pkg);
-      namedDeps = (map (x: "${x.pname}-${x.version}") deps);
-    in
-    builtins.traceVerbose (builtins.deepSeq namedDeps namedDeps) deps;
-
-  blacklist = [
-    "intel-basekit-env"
-    "intel-basekit-getting-started"
-    "intel-hpckit-env"
-    "intel-hpckit-getting-started"
-    "intel-oneapi-advisor"
-    "intel-oneapi-common-licensing"
-    "intel-oneapi-common-oneapi-vars"
-    "intel-oneapi-common-vars"
-    "intel-oneapi-compiler-cpp-eclipse-cfg"
-    "intel-oneapi-compiler-dpcpp-eclipse-cfg"
-    "intel-oneapi-condaindex"
-    "intel-oneapi-dev-utilities-eclipse-cfg"
-    "intel-oneapi-dpcpp-ct-eclipse-cfg"
-    "intel-oneapi-eclipse-ide"
-    "intel-oneapi-hpc-toolkit-getting-started"
-    "intel-oneapi-icc-eclipse-plugin-cpp"
-    "intel-oneapi-vtune"
-    "intel-oneapi-vtune-eclipse-plugin-vtune"
-  ];
-
-  isInBlacklist = pkg: elem pkg.provides blacklist;
-  removeBlacklist = filter (e: !(isInBlacklist e));
-
-  dpkgExtractAll =
-    pname: version:
-    { srcs, deps }:
-    stdenv.mkDerivation {
-      inherit pname version srcs;
-
-      nativeBuildInputs = [ dpkg ];
-      phases = [ "installPhase" ];
-
-      passthru = { inherit deps; };
-
-      installPhase = ''
-        mkdir -p $out
-        for src in $srcs; do
-          echo "Unpacking $src"
-          dpkg -x $src $out
-        done
-      '';
-    };
-
-  apthost = "https://apt.repos.intel.com/oneapi/";
-  fetchDeb =
-    p:
-    fetchurl {
-      url = apthost + p.filename;
-      inherit (p) sha256;
-    };
-
-  buildIntel =
-    pkg:
-    pipe pkg [
-      resolveDeps
-      removeBlacklist
-      (l: {
-        srcs = map fetchDeb l;
-        deps = l;
-      })
-      (dpkgExtractAll "${pkg.provides}-extracted" pkg.version)
-    ];
-
-  findHpcKit =
-    year:
-    findMatching {
-      pname = "intel-hpckit";
-      kind = "<<";
-      version = toString (year + 1);
-    };
-  years = map toInt (attrNames components);
-
-  patchIntel = callPackage ./patch_intel.nix { };
-
-  # Version information for each hpckit. This is used to normalize the paths
-  # so that files are in $out/{bin,lib,include...} instead of all over the place
-  # in $out/opt/intel/oneapi/*/*/{...}.
-  #
-  # The most important is the compiler component, which is used to build the
-  # stdenv for the hpckit.
-  #
-  # NOTE: this have to be manually specified, so we can avoid IFD. To add a
-  # new version, add a new field with an empty attrset, (e.g. "2026" = {}; ),
-  # build hpckit_2026.unpatched and use the values from
-  # result/opt/intel/oneapi/* to populate the attrset.
-  #
-  # WARN: if there are more than one version in the folders of the unpatched
-  # components, our dependency resolution hacks have probably failed and the
-  # package set may be broken.
-  components = {
-    "2025" = {
-      ishmem = "1.4";
-      pti = "0.13";
-      tcm = "1.4";
-      umf = "0.11";
-
-      ccl = "2021.16";
-      compiler = "2025.2";
-      dal = "2025.8";
-      debugger = "2025.2";
-      dev-utilities = "2025.2";
-      dnnl = "2025.2";
-      dpcpp-ct = "2025.2";
-      dpl = "2022.9";
-      ipp = "2022.2";
-      ippcp = "2025.2";
-      mkl = "2025.2";
-      mpi = "2021.16";
-      tbb = "2022.2";
-    };
-    "2024" = {
-      tcm = "1.1";
-
-      ccl = "2021.13";
-      compiler = "2024.2";
-      dal = "2024.6";
-      debugger = "2024.2";
-      dev-utilities = "2024.2";
-      diagnostics = "2024.2";
-      dnnl = "2024.2";
-      dpcpp-ct = "2024.2";
-      dpl = "2022.6";
-      ipp = "2021.12";
-      ippcp = "2021.12";
-      mkl = "2024.2";
-      mpi = "2021.13";
-      tbb = "2021.13";
-
-      extraPackages = [
-        sqlite
-        elfutils
-      ];
-    };
-  };
-
-  replaceDots = replaceStrings [ "." ] [ "_" ];
-
-in
-lib.recurseIntoAttrs (
-  listToAttrs (
-    map (
-      year:
-      let
-        year_str = toString year;
-      in
-      {
-        name = "hpckit_${year_str}";
-        value = patchIntel {
-          unpatched = buildIntel (findHpcKit year);
-          components = components.${year_str};
-        };
-      }
-    ) years
-  )
-)
-// {
-  apt = pipe aptData [
-    (groupBy (p: replaceDots p.provides))
-    (mapAttrs (
-      _: l:
-      listToAttrs (
-        map (pkg: {
-          name = replaceDots ("v" + pkg.version);
-          value = pkg;
-        }) l
-      )
-    ))
-  ];
-
-  inherit resolveDeps patchIntel buildIntel;
-}

pkgs/intel-oneapi/patch_intel.nix

@@ -1,191 +0,0 @@
-{
-  stdenv,
-  stdenvNoCC,
-  lib,
-  symlinkJoin,
-  autoPatchelfHook,
-  wrapCCWith,
-  overrideCC,
-  gcc,
-  hwloc,
-  libelf,
-  libgcc,
-  libffi_3_3,
-  libpsm2,
-  libuuid,
-  libxml2,
-  numactl,
-  ocl-icd,
-  openssl,
-  python3,
-  rdma-core,
-  ucx,
-  zlib,
-}:
-
-lib.makeOverridable (
-  {
-    unpatched,
-    components ? { },
-    extraPackages ? components.extraPackages or [ ],
-  }:
-
-  let
-    inherit (builtins)
-      attrValues
-      filter
-      mapAttrs
-      removeAttrs
-      ;
-
-    __components = removeAttrs components [ "extraPackages" ];
-    _components = __components;
-    # _components = lib.traceSeqN 2 {
-    #   inherit unpatched __components;
-    #   deps = builtins.map (x: "${x.pname}-${x.version}") unpatched.deps;
-    # } __components;
-
-    wrapIntel =
-      cc:
-      let
-        targetConfig = stdenv.targetPlatform.config;
-      in
-      (wrapCCWith {
-        inherit cc;
-
-        nixSupport = {
-          cc-ldflags = [
-            "-L${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}"
-            "-L${gcc.cc.lib}/lib"
-            "-L${libgcc.out}/lib"
-            "-L${cc}/lib"
-          ];
-          cc-cflags = [
-            "--gcc-toolchain=${gcc.cc}"
-            "-isystem \"${cc.original}/lib/clang/*/include\""
-            "-isystem ${cc}/include"
-            "-isystem ${cc}/include/intel64"
-            "-isystem ${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}/include"
-          ];
-          libcxx-cxxflags = [
-            # "--gcc-toolchain=${gcc.cc}"
-            "-isystem ${gcc.cc}/include/c++/${gcc.version}"
-            "-isystem ${gcc.cc}/include/c++/${gcc.version}/${targetConfig}"
-          ];
-        };
-
-        extraBuildCommands = ''
-          # FIXME: We should find a better way to modify the PATH instead of using
-          # this ugly hack. See https://jungle.bsc.es/git/rarias/bscpkgs/issues/9
-          echo 'path_backup="${gcc.cc}/bin:$path_backup"' >>$out/nix-support/cc-wrapper-hook
-
-          # Disable hardening by default
-          echo "" > $out/nix-support/add-hardening.sh
-
-          wrap icx  $wrapper $ccPath/icx
-          wrap icpx $wrapper $ccPath/icpx
-          wrap ifx  $wrapper $ccPath/ifx
-
-          ln -s $out/bin/icpx $out/bin/c++
-          ln -s $out/bin/icx  $out/bin/cc
-
-          sed -i 's/.*isCxx=0/isCxx=1/' $out/bin/icpx
-
-          # Use this to detect when a compiler subprocess is called
-          # from icpx (--fsycl-host-compiler)
-          echo 'export NIX_CC_WRAPPER_INTEL=1' >>$out/nix-support/cc-wrapper-hook
-
-          # oneMath looks for sycl libraries in bin/../lib
-          ln -s ${cc}/lib $out/lib
-          ln -s ${cc}/include $out/include
-        '';
-      }).overrideAttrs
-        (old: {
-          installPhase = old.installPhase + ''
-            export named_cc="icx"
-            export named_cxx="icpx"
-            export named_fc="ifx"
-          '';
-        });
-
-  in
-  stdenvNoCC.mkDerivation (finalAttrs: {
-    pname = lib.removeSuffix "-extracted" unpatched.pname;
-    inherit (unpatched) version;
-    src = unpatched;
-
-    phases = [
-      "installPhase"
-      "fixupPhase"
-    ];
-    buildInputs = [
-      libffi_3_3
-      libelf
-      libxml2
-      hwloc
-      numactl
-      libuuid
-      libpsm2
-      zlib
-      ocl-icd
-      rdma-core
-      ucx
-      openssl
-      python3
-      stdenv.cc.cc.lib
-    ]
-    ++ extraPackages;
-
-    autoPatchelfIgnoreMissingDeps = [
-      "libhwloc.so.5"
-      "libcuda.so.1"
-      "libze_loader.so.1"
-    ];
-
-    # There are broken symlinks that go outside packages, ignore them
-    dontCheckForBrokenSymlinks = true;
-
-    nativeBuildInputs = [ autoPatchelfHook ];
-    installPhase = ''
-      cp -r $src/opt/intel/oneapi/ $out
-    '';
-
-    passthru =
-      let
-        pkgs = mapAttrs (
-          folder: version:
-          let
-            original = "${finalAttrs.finalPackage}/${folder}/${version}";
-          in
-          symlinkJoin {
-            pname = "intel-${folder}";
-            inherit version;
-            paths = [ original ];
-            passthru = { inherit original; };
-          }
-        ) _components;
-      in
-      pkgs
-      // {
-        inherit unpatched;
-        pkgs = lib.recurseIntoAttrs pkgs;
-        components = _components;
-
-        # This contains all packages properly symlinked into toplevel directories
-        # in $out.
-        #
-        # NOTE: there are clashes with packages that have symlinks outside their
-        # scope (libtcm and env/vars.sh)
-        all = symlinkJoin {
-          pname = finalAttrs.finalPackage.pname + "-symlinked";
-          inherit (finalAttrs.finalPackage) version;
-          paths = filter lib.isDerivation (attrValues finalAttrs.finalPackage.pkgs);
-        };
-
-        stdenv = overrideCC stdenv finalAttrs.finalPackage.cc;
-
-        cc = wrapIntel finalAttrs.finalPackage.pkgs.compiler;
-      };
-
-  })
-)

pkgs/intel-oneapi/process.jq

@@ -1,29 +0,0 @@
-#!/usr/bin/env -S jq -f
-
-def extract_fields: {
-        pname : .Package,
-        version : .Version,
-        provides : .Package | sub("[0-9.-]*$"; ""),
-        filename : .Filename,
-        size : ."Installed-Size" | tonumber,
-        sha256 : .SHA256,
-        dependencies : .Depends,
-    } ;
-
-# parses dependencies into a list of [{.pname, .kind, .version}]
-# some dependencies do not have a version specified, in which case, kind = version = null
-#
-# example dependencies:
-# intel-oneapi-common-vars (>= 2023.0.0-25325), intel-oneapi-common-licensing-2023.0.0
-
-def split_dependencies : map(try(.dependencies |= split(",\\s?"; "")) // .dependencies |= []) ;
-
-def match_version : capture("(?<pname>[a-zA-Z0-9_\\-.]*) *(\\((?<kind>[<>=]*) *(?<version>.*)\\))?"; "") ;
-
-def parse_dependencies : map_values(.dependencies.[] |= match_version) ;
-
-def sort_version_decreasing : sort_by(.version | split("[-.]"; "") | map(tonumber)) | reverse ;
-
-map(extract_fields) | split_dependencies | parse_dependencies | sort_version_decreasing
-
-# [.[] | select(.pname == "intel-hpckit") | .version]

pkgs/intel-oneapi/toJson.awk

@@ -1,29 +0,0 @@
-#!/usr/bin/env -S awk -f
-
-BEGIN   {
-    FS=": "
-
-    prev_empty=1
-    t="  "
-
-    print "[ {"
-}
-
-!NF { # empty line, update separator so next non empty line closes the dict
-    prev_empty=1
-    t="},\n{ "
-    next # skip line (we won't match anything else)
-}
-
-{
-    printf t "\"%s\" : \"%s\"\n", $1, $2
-
-    if (prev_empty) {
-        # we were the first after a group of empty lines, following ones have to
-        # have a comma
-        prev_empty=0
-        t=", "
-    }
-}
-
-END     { print "} ]" }

pkgs/intel-oneapi/update.sh

@@ -1,11 +1,4 @@
 #!/bin/sh
 
-out_64=$(mktemp intel-api.64.XXXXXX)
-out_all=$(mktemp intel-api.all.XXXXXX)
-trap 'rm -f "$out_64" "$out_all"' EXIT INT HUP
-
-curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-amd64/Packages -o "$out_64"
-curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-all/Packages -o "$out_all"
-
-# NOTE: we use `jq -r tostring` to minify the json (3.2Mb -> 2.3Mb)
-cat "$out_64" "$out_all" | ./toJson.awk | ./process.jq | jq -r tostring >packages.json
+curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-amd64/Packages -o amd64-packages
+curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-all/Packages -o all-packages

pkgs/llvm-ompss2/default.nix

@@ -3,7 +3,6 @@
 , lib
 , gcc
 , clangOmpss2Unwrapped
-, writeShellScript
 , openmp ? null
 , wrapCCWith
 , llvmPackages_latest
@@ -38,7 +37,10 @@ let
   inherit gcc;
   cc = clangOmpss2Unwrapped;
   gccVersion = with versions; let v = gcc.version; in concatStringsSep "." [(major v) (minor v) (patch v)];
-
+in wrapCCWith {
+  inherit cc bintools;
+  # extraPackages adds packages to depsTargetTargetPropagated
+  extraPackages = optional (openmp != null) openmp;
   extraBuildCommands = ''
     echo "-target ${targetConfig}" >> $out/nix-support/cc-cflags
     echo "-B${gcc.cc}/lib/gcc/${targetConfig}/${gccVersion}" >> $out/nix-support/cc-cflags
@@ -55,50 +57,14 @@ let
     echo "--gcc-toolchain=${gcc}" >> $out/nix-support/cc-cflags
 
     wrap clang++  $wrapper $ccPath/clang++
+
+  '' + optionalString (openmp != null) ''
+    echo "export OPENMP_RUNTIME=${ompname}" >> $out/nix-support/cc-wrapper-hook
+  '' + optionalString (ompss2rt != null) ''
+    echo "export OMPSS2_RUNTIME=${rtname}" >> $out/nix-support/cc-wrapper-hook
+    echo "export ${homevar}=${ompss2rt}"   >> $out/nix-support/cc-wrapper-hook
+  '' + optionalString (ompss2rt != null && ompss2rt.pname == "nodes") ''
+    echo "export NOSV_HOME=${ompss2rt.nosv}" >> $out/nix-support/cc-wrapper-hook
   '';
+}
 
-  envExports = lib.optionalString (openmp != null) ''
-      echo "export OPENMP_RUNTIME=${ompname}" >> $out/nix-support/cc-wrapper-hook
-    '' + optionalString (ompss2rt != null) ''
-      echo "export OMPSS2_RUNTIME=${rtname}" >> $out/nix-support/cc-wrapper-hook
-      echo "export ${homevar}=${ompss2rt}"   >> $out/nix-support/cc-wrapper-hook
-    '' + optionalString (ompss2rt != null && ompss2rt.pname == "nodes") ''
-      echo "export NOSV_HOME=${ompss2rt.nosv}" >> $out/nix-support/cc-wrapper-hook
-    '';
-
-  extraPackages = optional (openmp != null) openmp;
-
-  wrappedCC = wrapCCWith {
-    # extraPackages adds packages to depsTargetTargetPropagated
-    inherit cc bintools extraPackages;
-    extraBuildCommands = extraBuildCommands + envExports;
-  };
-
-  resetIntelCCFlags = let tconf = builtins.replaceStrings ["-"] ["_"] targetConfig;
-  in writeShellScript "remove-intel.sh" ''
-    if [ "''${NIX_CC_WRAPPER_INTEL:-0}" = 1 ]; then
-      unset NIX_CFLAGS_COMPILE_${tconf}
-      unset NIX_CC_WRAPPER_FLAGS_SET_${tconf}
-
-      if (( "''${NIX_DEBUG:-0}" >= 1 )); then
-        echo "ompss2: cleaned NIX_CFLAGS_COMPILE_${tconf} (invokation from intel compiler detected)"
-      fi
-    fi
-  '';
-
-  intelExtraBuildCommands = ''
-    sed -i 's|# Flirting.*|source ${resetIntelCCFlags}\n\n&|' $out/bin/clang
-    sed -i 's|# Flirting.*|source ${resetIntelCCFlags}\n\n&|' $out/bin/clang++
-  '';
-
-  wrappedCCIntel = wrapCCWith {
-    inherit cc bintools extraPackages;
-    # extraPackages adds packages to depsTargetTargetPropagated
-    extraBuildCommands = intelExtraBuildCommands + envExports;
-  };
-
-in wrappedCC.overrideAttrs (oldAttrs: {
-    passthru = oldAttrs.passthru // {
-      forIcpx = wrappedCCIntel;
-    };
-  })

pkgs/nanos6/jemalloc.nix

@@ -5,6 +5,7 @@ jemalloc.overrideAttrs (old: {
     "--with-jemalloc-prefix=nanos6_je_"
     "--enable-stats"
   ];
+  enableParallelBuilding = true;
   hardeningDisable = [ "all" ];
   meta = old.meta // {
     description = old.meta.description + " (for Nanos6)";

pkgs/nix-portable/default.nix

@@ -0,0 +1,650 @@
+with builtins;
+{
+  nix,
+  unzip,
+  zip,
+  unixtools,
+  stdenv,
+  buildPackages,
+  upx,
+
+  bootstrapPrograms ? [
+    "gitMinimal"
+    "netcat-openbsd"
+    "openssh"
+    "bashInteractive"
+  ],
+
+  cacert ? pkgs.cacert,
+  compression ? "zstd -19 -T0",
+  lib ? pkgs.lib,
+  pkgs ? import <nixpkgs> {},
+  # hardcode executable to run. Useful when creating a bundle.
+  bundledPackage ? null,
+
+  nixStatic,
+  busyboxStatic ? pkgs.pkgsStatic.busybox,
+  bwrapStatic ? pkgs.pkgsStatic.bubblewrap,
+  zstdStatic ? pkgs.pkgsStatic.zstd,
+
+  perlBuildBuild ? pkgs.pkgsBuildBuild.perl,
+}@inp:
+with lib;
+let
+
+  perl = perlBuildBuild;
+
+  pname =
+    if bundledPackage == null
+    then "nix-portable"
+    else lib.getName bundledPackage;
+
+  bundledExe = lib.getExe bundledPackage;
+
+  nixpkgsSrc = pkgs.path;
+
+  maketar = targets:
+    let
+      closureInfo = buildPackages.closureInfo { rootPaths = targets; };
+    in
+    stdenv.mkDerivation {
+      name = "nix-portable-store-tarball";
+      nativeBuildInputs = [ perl zstd ];
+      exportReferencesGraph = map (x: [("closure-" + baseNameOf x) x]) targets;
+      buildCommand = ''
+        storePaths=$(cat ${closureInfo}/store-paths)
+        mkdir $out
+        echo $storePaths > $out/index
+        cp -r ${closureInfo} $out/closureInfo
+
+        tar -cf - \
+          --owner=0 --group=0 --mode=u+rw,uga+r \
+          --hard-dereference \
+          $storePaths | ${compression} > $out/tar
+      '';
+    };
+
+  packStaticBin = binPath: let
+      binName = (last (splitString "/" binPath)); in
+    pkgs.runCommand
+    binName
+    { nativeBuildInputs = [ upx ]; }
+    ''
+      mkdir -p $out/bin
+      theBinPath=${binPath}
+
+      if [[ -L "$theBinPath" ]]; then
+        theBinPath=$(readlink -f "$theBinPath")
+      fi
+
+      upx -9 -o $out/bin/${binName} $theBinPath
+    '';
+
+  installBin = pkg: bin: ''
+    unzip -qqoj "\$self" ${ lib.removePrefix "/" "${pkg}/bin/${bin}"} -d \$dir/bin
+    chmod +wx \$dir/bin/${bin};
+  '';
+
+  installDynamic = pkgname: let
+    out = pkgs.${pkgname}.out;
+  in ''
+    if [ ! -e \$store${lib.removePrefix "/nix/store" pkgs.${pkgname}.out} ] ; then
+      debug "Installing ${pkgname}"
+      \$run \$store${lib.removePrefix "/nix/store" nix}/bin/nix build --impure --no-link --expr "
+        (import ${nixpkgsSrc} {}).${pkgname}.out
+      "
+    else
+      debug "${pkgname} already installed"
+    fi
+
+    export PATH="${out}/bin:\$PATH"
+  '';
+
+  caBundleZstd = pkgs.runCommand "cacerts" {} "cat ${cacert}/etc/ssl/certs/ca-bundle.crt | ${zstd}/bin/zstd -19 > $out";
+
+  bwrap = packStaticBin "${bwrapStatic}/bin/bwrap";
+  nixStatic = packStaticBin "${inp.nixStatic}/bin/nix";
+  zstd = packStaticBin "${zstdStatic}/bin/zstd";
+
+  # the default nix store contents to extract when first used
+  storeTar = maketar ([ cacert nix nixpkgsSrc ] ++ lib.optional (bundledPackage != null) bundledPackage);
+
+
+  # The runtime script which unpacks the necessary files to $HOME/.nix-portable
+  # and then executes nix via bwrap
+  # Some shell expressions will be evaluated at build time and some at run time.
+  # Variables/expressions escaped via `\$` will be evaluated at run time
+  runtimeScript = ''
+    #!/usr/bin/env bash
+
+    set -eo pipefail
+
+    start=\$(date +%s%N)  # start time in nanoseconds
+
+    # dump environment on exit if debug is enabled
+    if [ -n "\$NP_DEBUG" ] && [ "\$NP_DEBUG" -ge 1 ]; then
+      trap "declare -p > \''${TMPDIR:-/tmp}/np_env" EXIT
+    fi
+
+    set -e
+    if [ -n "\$NP_DEBUG" ] && [ "\$NP_DEBUG" -ge 2 ]; then
+      set -x
+    fi
+
+    # &3 is our error out which we either forward to &2 or to /dev/null
+    # depending on the setting
+    if [ -n "\$NP_DEBUG" ] && [ "\$NP_DEBUG" -ge 1 ]; then
+      debug(){
+        echo \$@ || true
+      }
+      exec 3>&2
+    else
+      debug(){
+        true
+      }
+      exec 3>/dev/null
+    fi
+
+    # to reference this script's file
+    self="\$(realpath \''${BASH_SOURCE[0]})"
+
+    # fingerprint will be inserted by builder
+    fingerprint="_FINGERPRINT_PLACEHOLDER_"
+
+    # user specified location for program files and nix store
+    [ -z "\$NP_LOCATION" ] && NP_LOCATION="\$HOME"
+    NP_LOCATION="\$(readlink -f "\$NP_LOCATION")"
+    dir="\$NP_LOCATION/.nix-portable"
+
+    # Create NP_LOCATION and remove sgid bit
+    mkdir -p \$dir
+    if [ ! -z "\$BSC_MACHINE" ]; then
+      # Attempt to avoid issues with sgid folders
+      chmod g-s \$dir
+      chgrp bsc \$dir
+    fi
+
+    store="\$dir/nix/store"
+    # create /nix/var/nix to prevent nix from falling back to chroot store.
+    mkdir -p \$dir/{bin,nix/var/nix,nix/store}
+
+    # create minimal drv file for nix to spawn a nix shell
+    echo 'builtins.derivation {name="foo"; builder="/bin/sh"; args = ["-c" "echo hello \> \\\$out"]; system=builtins.currentSystem;}' > "\$dir/mini-drv.nix"
+
+    # the fingerprint being present inside a file indicates that
+    # this version of nix-portable has already been initialized
+    if test -e \$dir/conf/fingerprint && [ "\$(cat \$dir/conf/fingerprint)" == "\$fingerprint" ]; then
+      newNPVersion=false
+    else
+      newNPVersion=true
+    fi
+
+    # Nix portable ships its own nix.conf
+    export NIX_CONF_DIR=\$dir/conf/
+
+    NP_CONF_SANDBOX=\''${NP_CONF_SANDBOX:-false}
+    NP_CONF_STORE=\''${NP_CONF_STORE:-auto}
+
+
+    recreate_nix_conf(){
+      mkdir -p "\$NIX_CONF_DIR"
+      rm -f "\$NIX_CONF_DIR/nix.conf"
+
+      # static config
+      echo "build-users-group = " >> \$dir/conf/nix.conf
+      echo "experimental-features = nix-command flakes" >> \$dir/conf/nix.conf
+      echo "ignored-acls = security.selinux system.nfs4_acl" >> \$dir/conf/nix.conf
+      echo "sandbox-paths = /bin/sh=\$dir/busybox/bin/busybox" >> \$dir/conf/nix.conf
+      echo "extra-substituters = https://jungle.bsc.es/cache">> \$dir/conf/nix.conf
+      echo "extra-trusted-public-keys = jungle.bsc.es:pEc7MlAT0HEwLQYPtpkPLwRsGf80ZI26aj29zMw/HH0=" >> \$dir/conf/nix.conf
+
+      echo "extra-system-features = sys-devices" >> \$dir/conf/nix.conf
+      echo "extra-sandbox-paths = /sys/devices/system/cpu=/sys/devices/system/cpu /sys/devices/system/node=/sys/devices/system/node" >> \$dir/conf/nix.conf
+      echo "extra-trusted-users = @bsc" >> \$dir/conf/nix.conf
+
+
+      # configurable config
+      echo "sandbox = \$NP_CONF_SANDBOX" >> \$dir/conf/nix.conf
+      echo "store = \$NP_CONF_STORE" >> \$dir/conf/nix.conf
+    }
+
+
+    ### install files
+
+    PATH_OLD="\$PATH"
+
+    # as soon as busybox is unpacked, restrict PATH to busybox to ensure reproducibility of this script
+    # only unpack binaries if necessary
+    if [ "\$newNPVersion" == "false" ]; then
+
+      debug "binaries already installed"
+      # our busybox does not run on termux, therefore we suffix the PATH only on termux
+      export PATH="\''${TERMUX_VERSION:+\$PATH:}\$dir/busybox/bin"
+
+    else
+
+      debug "installing files"
+
+      mkdir -p \$dir/emptyroot
+
+      # install busybox
+      mkdir -p \$dir/busybox/bin
+      (base64 -d> "\$dir/busybox/bin/busybox" && chmod +x "\$dir/busybox/bin/busybox") << END
+    $(cat ${busyboxStatic}/bin/busybox | base64)
+    END
+      busyBins="${toString (attrNames (filterAttrs (d: type: type == "symlink") (readDir "${busyboxStatic}/bin")))}"
+      for bin in \$busyBins; do
+        [ ! -e "\$dir/busybox/bin/\$bin" ] && ln -s busybox "\$dir/busybox/bin/\$bin"
+      done
+
+      # our busybox does not run on termux, therefore we suffix the PATH only on termux
+      export PATH="\''${TERMUX_VERSION:+\$PATH:}\$dir/busybox/bin"
+
+      # install other binaries
+      ${installBin zstd "zstd"}
+      ${installBin bwrap "bwrap"}
+      ${installBin nixStatic "nix"}
+
+      # install ssl cert bundle
+      unzip -poj "\$self" ${ lib.removePrefix "/" "${caBundleZstd}"} | \$dir/bin/zstd -d > \$dir/ca-bundle.crt
+
+      recreate_nix_conf
+    fi
+
+    # Override $SHELL with nix bashInteractive
+    export SHELL="${pkgs.bashInteractive.out}/bin/bash"
+    export PS1="\n\[\033[1;32m\][\[\e]0;\u@\h: \w\a\]\u@\h:\w]\$\[\033[0m\] "
+
+    # unset bash function aliases
+    unset -f which ml module
+
+    ### setup SSL
+    # find ssl certs or use from nixpkgs
+    debug "figuring out ssl certs"
+    if [ -z "\$SSL_CERT_FILE" ]; then
+      debug "SSL_CERT_FILE not defined. trying to find certs automatically"
+      if [ -e /etc/ssl/certs/ca-bundle.crt ]; then
+        export SSL_CERT_FILE=\$(realpath /etc/ssl/certs/ca-bundle.crt)
+        debug "found /etc/ssl/certs/ca-bundle.crt with real path \$SSL_CERT_FILE"
+      elif [ -e /etc/ssl/certs/ca-certificates.crt ]; then
+        export SSL_CERT_FILE=\$(realpath /etc/ssl/certs/ca-certificates.crt)
+        debug "found /etc/ssl/certs/ca-certificates.crt with real path \$SSL_CERT_FILE"
+      elif [ ! -e /etc/ssl/certs ]; then
+        debug "/etc/ssl/certs does not exist. Will use certs from nixpkgs."
+        export SSL_CERT_FILE=\$dir/ca-bundle.crt
+      else
+        debug "certs seem to reside in /etc/ssl/certs. No need to set up anything"
+      fi
+    fi
+    if [ -n "\$SSL_CERT_FILE" ]; then
+      sslBind="\$(realpath \$SSL_CERT_FILE) \$dir/ca-bundle.crt"
+      export SSL_CERT_FILE="\$dir/ca-bundle.crt"
+    else
+      sslBind="/etc/ssl /etc/ssl"
+    fi
+
+    if [ -n "\$NP_GIT" ]; then
+      echo "WARN: NP_GIT is not supported, using nix version instead"
+    fi
+
+
+
+    storePathOfFile(){
+      file=\$(realpath \$1)
+      sPath="\$(echo \$file | awk -F "/" 'BEGIN{OFS="/";}{print \$2,\$3,\$4}')"
+      echo "/\$sPath"
+    }
+
+
+    collectBinds(){
+      pathsTopLevel="/boot /run /sys \$PWD /gpfs /tmp /scratch"
+
+      toBind=""
+      for p in \$pathsTopLevel; do
+        if [ -e "\$p" ]; then
+          real=\$(realpath \$p)
+          if [ -e "\$real" ]; then
+            if [[ "\$real" == /nix/store/* ]]; then
+              storePath=\$(storePathOfFile \$real)
+              toBind="\$toBind \$storePath \$storePath"
+            else
+              toBind="\$toBind \$real \$p"
+            fi
+          fi
+        fi
+      done
+
+
+      # TODO: add /var/run/dbus/system_bus_socket
+      paths="/etc/host.conf /etc/hosts /etc/hosts.equiv /etc/mtab /etc/netgroup /etc/networks /etc/passwd /etc/group /etc/nsswitch.conf /etc/resolv.conf /etc/localtime \$HOME"
+
+      for p in \$paths; do
+        if [ -e "\$p" ]; then
+          real=\$(realpath \$p)
+          if [ -e "\$real" ]; then
+            if [[ "\$real" == /nix/store/* ]]; then
+              storePath=\$(storePathOfFile \$real)
+              toBind="\$toBind \$storePath \$storePath"
+            else
+              toBind="\$toBind \$real \$real"
+            fi
+          fi
+        fi
+      done
+
+      # provide /bin/sh via the shipped busybox
+      toBind="\$toBind \$dir/busybox/bin/busybox /bin/sh"
+      toBind="\$toBind \$dir/busybox/bin/busybox /usr/bin/env"
+
+      # on termux, make sure termux packages still work inside the nix-portable environment
+      if [ -n "\$TERMUX_VERSION" ]; then
+        # binds required so termux native packages still run inside the nix-portable sandbox
+        # TODO: this doesn't quite work yet. debug and fix
+        toBind="\$toBind /system/lib64/libc.so /system/lib64/libc.so"
+        toBind="\$toBind /system/lib64/ld-android.so /system/lib64/ld-android.so"
+        toBind="\$toBind /system/lib64/libdl.so /system/lib64/libdl.so"
+        toBind="\$toBind /system/bin /system/bin"
+        toBind="\$toBind /system/lib64 /system/lib64"
+        toBind="\$toBind /apex/com.android.runtime/bin /apex/com.android.runtime/bin"
+        toBind="\$toBind /linkerconfig/ld.config.txt /linkerconfig/ld.config.txt"
+        toBind="\$toBind \$dir/ca-bundle.crt /etc/ssl/certs/ca-certificates.crt"
+        toBind="\$toBind \$(realpath \$HOME/../usr/etc/resolv.conf) /etc/resolv.conf"
+      fi
+
+    }
+
+
+    makeBindArgs(){
+      arg=\$1; shift
+      sep=\$1; shift
+      binds=""
+      while :; do
+        if [ -n "\$1" ]; then
+          from="\$1"; shift
+          to="\$1"; shift || { echo "no bind destination provided for \$from!"; exit 3; }
+          binds="\$binds \$arg \$from\$sep\$to";
+        else
+          break
+        fi
+      done
+    }
+
+
+
+    ### select container runtime
+    debug "figuring out which runtime to use"
+    [ -z "\$NP_BWRAP" ] && NP_BWRAP=\$dir/bin/bwrap
+    debug "bwrap executable: \$NP_BWRAP"
+    [ -z "\$NP_NIX" ] && NP_NIX=\$dir/bin/nix
+    debug "nix executable: \$NP_NIX"
+    debug "testing all available runtimes..."
+    if [ -z "\$NP_RUNTIME" ]; then
+      # read last automatic selected runtime from disk
+      if [ "\$newNPVersion" == "true" ]; then
+        debug "removing cached auto selected runtime"
+        rm -f "\$dir/conf/last_auto_runtime"
+      fi
+      if [ -f "\$dir/conf/last_auto_runtime" ]; then
+        last_auto_runtime="\$(cat "\$dir/conf/last_auto_runtime")"
+      else
+        last_auto_runtime=
+      fi
+      debug "last auto selected runtime: \$last_auto_runtime"
+      if [ "\$last_auto_runtime" != "" ]; then
+        NP_RUNTIME="\$last_auto_runtime"
+      # check if nix --store works
+      elif \\
+          debug "testing nix --store" \\
+          && mkdir -p \$dir/tmp/ \\
+          && touch \$dir/tmp/testfile \\
+          && "\$NP_NIX" --store "\$dir/tmp/__store" shell -f "\$dir/mini-drv.nix" -c "\$dir/bin/nix" store add-file --store "\$dir/tmp/__store" "\$dir/tmp/testfile" >/dev/null 2>&3; then
+        chmod -R +w \$dir/tmp/__store
+        rm -r \$dir/tmp/__store
+        debug "nix --store works on this system -> will use nix as runtime"
+        NP_RUNTIME=nix
+      # check if bwrap works properly
+      elif \\
+          debug "nix --store failed -> testing bwrap" \\
+          && \$NP_BWRAP --bind \$dir/emptyroot / --bind \$dir/ /nix --bind \$dir/busybox/bin/busybox "\$dir/true" "\$dir/true" 2>&3 ; then
+        debug "bwrap seems to work on this system -> will use bwrap"
+        NP_RUNTIME=bwrap
+      else
+        debug "bwrap doesn't work on this system -> will use proot"
+        NP_RUNTIME=proot
+      fi
+      echo -n "\$NP_RUNTIME" > "\$dir/conf/last_auto_runtime"
+    else
+      debug "runtime selected via NP_RUNTIME: \$NP_RUNTIME"
+    fi
+    debug "NP_RUNTIME: \$NP_RUNTIME"
+    if [ "\$NP_RUNTIME" == "nix" ]; then
+      run="\$NP_NIX shell -f \$dir/mini-drv.nix -c"
+      export PATH="\$PATH:\$store${lib.removePrefix "/nix/store" nix}/bin"
+      NP_CONF_STORE="\$dir"
+      recreate_nix_conf
+    elif [ "\$NP_RUNTIME" == "bwrap" ]; then
+      collectBinds
+      makeBindArgs --bind " " \$toBind \$sslBind
+      run="\$NP_BWRAP \$BWRAP_ARGS \\
+        --bind \$dir/emptyroot /\\
+        --dev-bind /dev /dev\\
+        --proc /proc\\
+        --bind \$dir/nix /nix\\
+        \$binds"
+        # --bind \$dir/busybox/bin/busybox /bin/sh\\
+    else
+      # proot
+      echo Unsupported runtime: $NP_RUNTIME
+      exit 1
+    fi
+    debug "base command will be: \$run"
+
+
+
+    ### setup environment
+    export NIX_PATH="\$dir/channels:nixpkgs=\$dir/channels/nixpkgs"
+    mkdir -p \$dir/channels
+    [ -h \$dir/channels/nixpkgs ] || ln -s ${nixpkgsSrc} \$dir/channels/nixpkgs
+
+
+    ### install nix store
+    # Install all the nix store paths necessary for the current nix-portable version
+    # We only unpack missing store paths from the tar archive.
+    index="$(cat ${storeTar}/index)"
+
+    export missing=\$(
+      for path in \$index; do
+        basepath=\$(basename \$path)
+        if [ ! -e \$store/\$basepath ]; then
+          echo "nix/store/\$basepath"
+        fi
+      done
+    )
+
+    if [ -n "\$missing" ]; then
+      debug "extracting missing store paths"
+      (
+        mkdir -p \$dir/tmp \$store/
+        rm -rf \$dir/tmp/*
+        cd \$dir/tmp
+        unzip -qqp "\$self" ${ lib.removePrefix "/" "${storeTar}/tar"} \
+          | \$dir/bin/zstd -d \
+          | tar -x \$missing --strip-components 2
+        mv \$dir/tmp/* \$store/
+      )
+      rm -rf \$dir/tmp
+    fi
+
+    if [ -n "\$missing" ]; then
+      debug "registering new store paths to DB"
+      reg="$(cat ${storeTar}/closureInfo/registration)"
+      cmd="\$run \$store${lib.removePrefix "/nix/store" nix}/bin/nix-store --load-db"
+      debug "running command: \$cmd"
+      echo "\$reg" | \$cmd
+    fi
+
+
+    ### select executable
+    # the executable can either be selected by
+    # - executing './nix-portable BIN_NAME',
+    # - symlinking to nix-portable, in which case the name of the symlink selects the nix executable
+    # Alternatively the executable can be hardcoded by specifying the argument 'executable' of nix-portable's default.nix file.
+    executable="${if bundledPackage == null then "" else bundledExe}"
+    if [ "\$executable" != "" ]; then
+      bin="\$executable"
+      debug "executable is hardcoded to: \$bin"
+
+    elif [[ "\$(basename \$0)" == nix-portable* ]]; then\
+      if [ -z "\$1" ]; then
+        echo "Error: please specify the nix binary to execute"
+        echo "Alternatively symlink against \$0"
+        exit 1
+      elif [ "\$1" == "debug" ]; then
+        bin="\$(which \$2)"
+        shift; shift
+      else
+        bin="\$store${lib.removePrefix "/nix/store" nix}/bin/\$1"
+        shift
+      fi
+    # for binary selection via symlink
+    else
+      bin="\$store${lib.removePrefix "/nix/store" nix}/bin/\$(basename \$0)"
+    fi
+
+
+
+    ### check which runtime has been used previously
+    if [ -f "\$dir/conf/last_runtime" ]; then
+      lastRuntime=\$(cat "\$dir/conf/last_runtime")
+    else
+      lastRuntime=
+    fi
+
+
+
+    ### check if nix is functional with or without sandbox
+    # sandbox-fallback is not reliable: https://github.com/NixOS/nix/issues/4719
+    if [ "\$newNPVersion" == "true" ] || [ "\$lastRuntime" != "\$NP_RUNTIME" ]; then
+      nixBin="\$(dirname \$bin)/nix"
+      debug "Testing if nix can build stuff without sandbox"
+      if ! \$run "\$nixBin" build --no-link -f "\$dir/mini-drv.nix" --option sandbox false >&3 2>&3; then
+        echo "Fatal error: nix is unable to build packages"
+        exit 1
+      fi
+
+      debug "Testing if nix sandbox is functional"
+      if ! \$run "\$nixBin" build --no-link -f "\$dir/mini-drv.nix" --option sandbox true >&3 2>&3; then
+        debug "Sandbox doesn't work -> disabling sandbox"
+        NP_CONF_SANDBOX=false
+        recreate_nix_conf
+      else
+        debug "Sandboxed builds work -> enabling sandbox"
+        NP_CONF_SANDBOX=true
+        recreate_nix_conf
+      fi
+
+    fi
+
+
+    ### save fingerprint and lastRuntime
+    if [ "\$newNPVersion" == "true" ]; then
+      echo -n "\$fingerprint" > "\$dir/conf/fingerprint"
+    fi
+    if [ "\$lastRuntime" != \$NP_RUNTIME ]; then
+      echo -n \$NP_RUNTIME > "\$dir/conf/last_runtime"
+    fi
+
+
+
+    ### set PATH
+    export PATH="\$dir/busybox/bin"
+    export PATH="\$PATH:\$store${lib.removePrefix "/nix/store" nix}/bin"
+
+    ### install programs via nix
+    ${concatMapStringsSep "\n" installDynamic bootstrapPrograms}
+
+    ### print elapsed time
+    end=\$(date +%s%N)  # end time in nanoseconds
+    # time elapsed in millis with two decimal places
+
+    # print stats about initialization time of nix-portable
+    # skipt for termux, as it doesn't have bc installed
+    if [ -z "\$TERMUX_VERSION" ]; then
+      elapsed=\$(echo "scale=2; (\$end - \$start)/1000000" | bc)
+      debug "Time to initialize nix-portable: \$elapsed millis"
+    fi
+
+
+    ### run commands
+    [ -z "\$NP_RUN" ] && NP_RUN="\$run"
+    if [ "\$NP_RUNTIME" == "proot" ]; then
+      debug "running command: \$NP_RUN \$bin \$@"
+      exec \$NP_RUN \$bin "\$@"
+    else
+      cmd="\$NP_RUN \$bin \$@"
+      debug "running command: \$cmd"
+      exec \$NP_RUN \$bin "\$@"
+    fi
+    exit
+  '';
+
+  runtimeScriptEscaped = replaceStrings ["\""] ["\\\""] runtimeScript;
+
+  nixPortable = pkgs.runCommand pname {
+    nativeBuildInputs = [unixtools.xxd unzip];
+
+    meta = {
+      homepage = "https://github.com/DavHau/nix-portable";
+      description = "Nix - Static, Permissionless, Installation-free, Pre-configured for mn5";
+      maintainers = with lib.maintainers.bsc; [ abonerib ];
+      platforms = lib.platforms.linux;
+      license = lib.licenses.mit;
+    };
+  } ''
+    mkdir -p $out/bin
+    echo "${runtimeScriptEscaped}" > $out/bin/nix-portable.zip
+    xxd $out/bin/nix-portable.zip | tail
+
+    sizeA=$(printf "%08x" `stat -c "%s" $out/bin/nix-portable.zip` | tac -rs ..)
+    echo 504b 0304 0000 0000 0000 0000 0000 0000 | xxd -r -p >> $out/bin/nix-portable.zip
+    echo 0000 0000 0000 0000 0000 0200 0000 4242 | xxd -r -p >> $out/bin/nix-portable.zip
+
+    sizeB=$(printf "%08x" `stat -c "%s" $out/bin/nix-portable.zip` | tac -rs ..)
+    echo 504b 0102 0000 0000 0000 0000 0000 0000 | xxd -r -p >> $out/bin/nix-portable.zip
+    echo 0000 0000 0000 0000 0000 0000 0200 0000 | xxd -r -p >> $out/bin/nix-portable.zip
+    echo 0000 0000 0000 0000 0000 $sizeA 4242 | xxd -r -p >> $out/bin/nix-portable.zip
+
+    echo 504b 0506 0000 0000 0000 0100 3000 0000 | xxd -r -p >> $out/bin/nix-portable.zip
+    echo $sizeB 0000 0000 0000 0000 0000 0000 | xxd -r -p >> $out/bin/nix-portable.zip
+
+    unzip -vl $out/bin/nix-portable.zip
+
+    zip="${zip}/bin/zip -0"
+    $zip $out/bin/nix-portable.zip ${bwrap}/bin/bwrap
+    $zip $out/bin/nix-portable.zip ${nixStatic}/bin/nix
+    $zip $out/bin/nix-portable.zip ${zstd}/bin/zstd
+    $zip $out/bin/nix-portable.zip ${storeTar}/tar
+    $zip $out/bin/nix-portable.zip ${caBundleZstd}
+
+    # create fingerprint
+    fp=$(sha256sum $out/bin/nix-portable.zip | cut -d " "  -f 1)
+    sed -i "s/_FINGERPRINT_PLACEHOLDER_/$fp/g" $out/bin/nix-portable.zip
+    # fix broken zip header due to manual modification
+    ${zip}/bin/zip -F $out/bin/nix-portable.zip --out $out/bin/nix-portable-fixed.zip
+
+    rm $out/bin/nix-portable.zip
+    executable=${if bundledPackage == null then "" else bundledExe}
+    if [ "$executable" == "" ]; then
+      target="$out/bin/nix-portable"
+    else
+      target="$out/bin/$(basename "$executable")"
+    fi
+    mv $out/bin/nix-portable-fixed.zip "$target"
+    chmod +x "$target"
+  '';
+in
+nixPortable.overrideAttrs (prev: {
+  passthru = (prev.passthru or {}) // {
+    inherit bwrap;
+  };
+})

pkgs/nix-wrap/default.nix

@@ -14,7 +14,7 @@ let
   nixConfDir = "share";
   nix_wrap_sh = writeText "nix-wrap.sh" ''
     #!/usr/bin/env bash
-    #
+
     busybox_bin="${nixPrefix}${busybox}/bin"
     bubblewrap_bin="${nixPrefix}/${bubblewrap}/bin"
 
@@ -69,7 +69,6 @@ stdenv.mkDerivation rec {
   name = "nix-wrap";
   buildInputs = [
     bashInteractive
-    busybox
     nix
   ];
   src = null;
@@ -92,7 +91,6 @@ stdenv.mkDerivation rec {
     homepage = null;
     description = "nix bubblewrap wrapper";
     maintainers = [ ];
-    broken = true;
     platforms = lib.platforms.linux;
     license = lib.licenses.mit;
   };

pkgs/onemath/default.nix

@@ -1,91 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  cmake,
-  withCFlags,
-  intelPackages,
-
-  mklSupport ? true,
-
-  config,
-
-  cudaSupport ? config.cudaSupport,
-  cudaPackages ? { },
-
-  rocmSupport ? config.rocmSupport,
-  hipTargets ? null, # only one target at a time supported
-  rocmPackages ? { },
-}:
-
-let
-  # rocmSupport is not enough, we need a specific target
-  enableHip = rocmSupport && hipTargets != null;
-
-  stdenv = withCFlags (lib.optionals cudaSupport [
-    "--cuda-path=${cudaPackages.cudatoolkit}"
-  ]) intelPackages.stdenv;
-in
-
-# at least one backend has to be enabled
-assert mklSupport || cudaSupport || enableHip;
-
-stdenv.mkDerivation rec {
-  pname = "oneMath";
-  version = "0.8";
-
-  src = fetchFromGitHub {
-    owner = "uxlfoundation";
-    repo = "oneMath";
-    rev = "v${version}";
-    sha256 = "sha256-xK8lKI3oqKlx3xtvdScpMq+HXAuoYCP0BZdkEqnJP5o=";
-  };
-
-  cmakeFlags = [
-    (lib.cmakeBool "ENABLE_MKLCPU_BACKEND" mklSupport)
-    (lib.cmakeBool "ENABLE_MKLGPU_BACKEND" mklSupport)
-
-    (lib.cmakeBool "ENABLE_CUBLAS_BACKEND" cudaSupport)
-    (lib.cmakeBool "ENABLE_CUFFT_BACKEND" cudaSupport)
-    (lib.cmakeBool "ENABLE_CURAND_BACKEND" cudaSupport)
-    (lib.cmakeBool "ENABLE_CUSOLVER_BACKEND" cudaSupport)
-    (lib.cmakeBool "ENABLE_CUSPARSE_BACKEND" cudaSupport)
-
-    (lib.cmakeBool "ENABLE_ROCBLAS_BACKEND" enableHip)
-    (lib.cmakeBool "ENABLE_ROCFFT_BACKEND" enableHip)
-    (lib.cmakeBool "ENABLE_ROCSOLVER_BACKEND" enableHip)
-    (lib.cmakeBool "ENABLE_ROCRAND_BACKEND" enableHip)
-    (lib.cmakeBool "ENABLE_ROCSPARSE_BACKEND" enableHip)
-
-    (lib.cmakeBool "BUILD_FUNCTIONAL_TESTS" false)
-    (lib.cmakeBool "BUILD_EXAMPLES" false)
-  ]
-  ++ lib.optionals enableHip [
-    (lib.cmakeFeature "HIP_TARGETS" hipTargets)
-  ];
-
-  nativeBuildInputs = [ cmake ];
-  buildInputs =
-    lib.optionals (mklSupport) [
-      intelPackages.mkl
-      intelPackages.tbb
-    ]
-    ++ lib.optionals (enableHip) [
-      rocmPackages.rocmPath
-      rocmPackages.rocblas
-      rocmPackages.rocfft
-      rocmPackages.rocsolver
-      rocmPackages.rocrand
-      rocmPackages.rocsparse
-    ]
-    ++ lib.optionals (cudaSupport) [
-      (lib.getDev cudaPackages.cuda_cudart)
-      cudaPackages.cudatoolkit
-
-      cudaPackages.libcublas
-      cudaPackages.libcurand
-      cudaPackages.libcufft
-      cudaPackages.libcusparse
-      cudaPackages.libcusolver
-    ];
-
-}

pkgs/tasycl/default.nix

@@ -1,87 +0,0 @@
-{
-  lib,
-  stdenv,
-  autoconf,
-  automake,
-  autoreconfHook,
-  boost,
-  fetchFromGitHub,
-  gnumake,
-  libtool,
-  withCFlags,
-
-  useIntel ? true,
-  adaptivecpp ? null,
-  intelPackages ? null,
-
-  useGit ? false,
-  gitUrl ? "git@gitlab-internal.bsc.es:task-awareness/tasycl/tasycl.git",
-  gitBranch ? "main",
-  gitCommit ? "78f98dcf60a66e0eaa3b4ebcf55be076bec64825",
-}:
-
-assert !useIntel -> adaptivecpp != null;
-assert useIntel -> intelPackages != null;
-
-let
-  variant = if useIntel then "intel" else "acpp";
-
-  syclStdenv = withCFlags [ "-O3" ] (if useIntel then intelPackages.stdenv else stdenv);
-
-  release = rec {
-    version = "2.1.0";
-    src = fetchFromGitHub {
-      owner = "bsc-pm";
-      repo = "tasycl";
-      rev = version;
-      hash = "sha256-0kXnb0lHeQNHR27GTLbJ8xbiICLU8k2+FqEnnFSrzzo=";
-    };
-  };
-
-  git = rec {
-    version = src.shortRev;
-    src = builtins.fetchGit {
-      url = gitUrl;
-      ref = gitBranch;
-      rev = gitCommit;
-    };
-  };
-
-  source = if (useGit) then git else release;
-
-in
-
-syclStdenv.mkDerivation {
-  pname = "tasycl-${variant}";
-  inherit (source) src version;
-
-  enableParallelBuilding = true;
-  separateDebugInfo = true;
-
-  nativeBuildInputs = [
-    autoreconfHook
-    automake
-    autoconf
-    libtool
-    gnumake
-  ];
-
-  buildInputs = [
-    boost
-  ];
-
-  configureFlags = lib.optionals (!useIntel) [
-    "CXX=${lib.getExe adaptivecpp}"
-  ];
-
-  # add symlinks so we can explicitly link with tasycl-intel / tasycl-acpp
-  postInstall = ''
-    pushd $out/lib
-    for i in libtasycl* ; do
-      ln -s "$i" "''\${i/tasycl/tasycl-${variant}}"
-    done
-    popd
-  '';
-
-  hardeningDisable = [ "all" ];
-}

test/compilers/hello-sycl.nix

@@ -1,62 +0,0 @@
-{
-  intelPackages,
-  writeText,
-  strace,
-}:
-
-let
-  stdenv = intelPackages.stdenv;
-  hello_sycl = writeText "hello.cpp" ''
-    #include <sycl/sycl.hpp>
-
-    class hello_world;
-
-    int main(int argc, char** argv) try {
-        auto device_selector = sycl::default_selector_v;
-
-        sycl::queue queue(device_selector);
-
-        std::cout << "Running on: "
-                  << queue.get_device().get_info<sycl::info::device::name>()
-                  << std::endl;
-
-        queue.submit([&] (sycl::handler& cgh) {
-            auto os = sycl::stream{128, 128, cgh};
-            cgh.single_task<hello_world>([=]() {
-                os << "Hello World! (on device)\n";
-            });
-        });
-
-        return 0;
-    } catch (sycl::exception &e) {
-        std::cout << "SYCL exception: " << e.what() << std::endl;
-        return 0; // we expect to fail since no devices should be available;
-    }
-  '';
-in
-
-stdenv.mkDerivation {
-  version = "0.0.1";
-  name = "hello-sycl";
-  buildInputs = [
-    stdenv
-    strace
-  ];
-  src = hello_sycl;
-  dontUnpack = true;
-  dontConfigure = true;
-  NIX_DEBUG = 0;
-  buildPhase = ''
-    cp $src hello.cpp
-    set -x
-    echo CXX=$CXX
-    command -v $CXX
-    $CXX -fsycl hello.cpp -o hello
-    ./hello
-    set +x
-  '';
-
-  installPhase = ''
-    touch $out
-  '';
-}

test/compilers/icpx-ompss2.nix

@@ -1,81 +0,0 @@
-{
-  writeText,
-  intelPackages,
-  nodes,
-  nosv,
-  clangOmpss2Nodes,
-  strace,
-}:
-
-let
-  hello_cpp = writeText "hello.cpp" ''
-    #include <cstdio>
-    #include <sycl/sycl.hpp>
-
-    int main(int argc, char** argv) try {
-        sycl::queue queue;
-
-        std::cout << "Running on: "
-                  << queue.get_device().get_info<sycl::info::device::name>()
-                  << std::endl;
-
-        #pragma oss task
-        queue.submit([&] (sycl::handler& cgh) {
-            auto os = sycl::stream{128, 128, cgh};
-            cgh.single_task<class hello_world>([=]() {
-                os << "Hello World! (on device)\n";
-            });
-        }).wait();
-
-        return 0;
-    } catch (sycl::exception &e) {
-        std::cout << "SYCL exception: " << e.what() << std::endl;
-        return 0; // we expect to fail since no devices should be available;
-    }
-
-  '';
-in
-
-intelPackages.stdenv.mkDerivation {
-  version = "0.0.1";
-  name = "hello-syclompss";
-
-  src = hello_cpp;
-
-  nativeBuildInputs = [
-    strace
-    nodes
-    nosv
-  ];
-
-  dontUnpack = true;
-  dontConfigure = true;
-
-  # NODES requires access to /sys/devices to request NUMA information
-  requiredSystemFeatures = [ "sys-devices" ];
-
-  env.NODES_HOME = nodes;
-
-  NIX_DEBUG = 1;
-  buildPhase = ''
-    cp $src hello.cpp
-    set -x
-    echo CXX=$CXX
-    echo NODES_HOME=$NODES_HOME
-    command -v $CXX
-
-    icpx -Wno-deprecated-declarations -fsycl \
-        -fsycl-host-compiler=${clangOmpss2Nodes.forIcpx}/bin/clang++ \
-        -fsycl-host-compiler-options='-Wno-deprecated-declarations -fompss-2=libnodes' \
-        -lnodes -lnosv \
-        $NODES_HOME/lib/nodes-main-wrapper.o \
-        hello.cpp -o hello
-
-    ./hello
-    set +x
-  '';
-
-  installPhase = ''
-    touch $out
-  '';
-}