From 87d67cce8b4367d21139282256d23f7f407aca49 Mon Sep 17 00:00:00 2001
From: Victor Moene <victor.moene@northern.tech>
Date: Wed, 2 Sep 2026 15:56:18 +0200
Subject: [PATCH] Added flake to build cfengine locally

Ticket: ENT-14460
Signed-off-by: Victor Moene <victor.moene@northern.tech>
---
 .gitignore             |  3 ++
 contrib/nix/core.nix   | 76 ++++++++++++++++++++++++++++++++++++++++++
 contrib/nix/flake.lock | 61 +++++++++++++++++++++++++++++++++
 contrib/nix/flake.nix  | 32 ++++++++++++++++++
 4 files changed, 172 insertions(+)
 create mode 100644 contrib/nix/core.nix
 create mode 100644 contrib/nix/flake.lock
 create mode 100644 contrib/nix/flake.nix

diff --git a/.gitignore b/.gitignore
index ff74fda4594..a2379da89ad 100644
--- a/.gitignore
+++ b/.gitignore
@@ -194,3 +194,6 @@ misc/selinux/cfengine-enterprise.pp
 misc/selinux/cfengine-enterprise.if
 misc/selinux/cfengine-enterprise.te
 misc/selinux/tmp
+
+# nix
+contrib/nix/result
diff --git a/contrib/nix/core.nix b/contrib/nix/core.nix
new file mode 100644
index 00000000000..1384556f65c
--- /dev/null
+++ b/contrib/nix/core.nix
@@ -0,0 +1,76 @@
+{ stdenv
+, pkg-config
+, autoreconfHook
+, bison
+, flex
+, diffutils
+, coreutils
+, acl
+, attr
+, curl
+, libxml2
+, libyaml
+, lmdb
+, openssl
+, pcre2
+, zlib
+, librsync
+, pam
+, perl
+, shadow
+, version
+}:
+
+stdenv.mkDerivation {
+  pname = "cfengine-core";
+  version = version;
+  src = ../../.;
+  outputs = [ "out" "buildTree" ];
+
+  postPatch = ''
+    echo "${version}" > CFVERSION
+  '';
+
+  preBuild = ''
+    patchShebangs .
+  '';
+
+  nativeBuildInputs = [
+    pkg-config
+    autoreconfHook
+    bison
+    flex
+    diffutils
+    perl
+    shadow
+  ];
+
+  buildInputs = [
+    acl
+    attr
+    curl
+    libxml2
+    libyaml
+    lmdb
+    openssl
+    pcre2
+    zlib
+    pam
+    librsync
+  ];
+
+  enableParallelBuilding = true;
+
+  configureFlags = [
+    "--with-lmdb"
+    "--enable-debug"
+  ];
+
+  postInstall = ''
+    cp ${coreutils}/bin/date $out/bin/date
+    cp ${diffutils}/bin/diff $out/bin/diffutils
+
+    mkdir -p "$buildTree"
+    cp -a . "$buildTree"/
+  '';
+}
diff --git a/contrib/nix/flake.lock b/contrib/nix/flake.lock
new file mode 100644
index 00000000000..4028206977f
--- /dev/null
+++ b/contrib/nix/flake.lock
@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1788179007,
+        "narHash": "sha256-hn1oU2rue2SYK8dAr8+WNZWtbsz1S2W5mnHlSEuh3bo=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "34ab99075ac4f7e40cf037eef32cb1c360bb85e9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/contrib/nix/flake.nix b/contrib/nix/flake.nix
new file mode 100644
index 00000000000..022e37c9617
--- /dev/null
+++ b/contrib/nix/flake.nix
@@ -0,0 +1,32 @@
+{
+  description = "CFEngine Core";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+    self.submodules = true;
+  };
+
+  outputs = { self, nixpkgs, flake-utils }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = nixpkgs.legacyPackages.${system};
+        lib = pkgs.lib;
+
+        baseVersion = lib.strings.trim (builtins.readFile ../../.CFVERSION);
+        shortSha =
+          if self ? rev then builtins.substring 0 9 self.rev
+          else if self ? dirtyRev then builtins.substring 0 9 self.dirtyRev
+          else "unknown0";
+        version = "${baseVersion}a.${shortSha}";
+
+        core = pkgs.callPackage ./core.nix { version = version; };
+      in
+      {
+        packages = {
+          default = core;
+          buildTree = core.buildTree;
+        };
+      }
+    );
+}