app-misc/flox-bin: new package, add 1.12.0

[vitaly-zdanevich]

No description provided.

[vitaly-zdanevich]

@tomberek is the upstream author, thanks.

[liangyongxiang]

The ebuild could use some cleanup to feel more idiomatic to Gentoo

[liuyujielol]

Does the software have to use path /nix, can it be some other pathes like /var/lib/flox/nix?

[vitaly-zdanevich]

The ebuild could use some cleanup to feel more idiomatic to Gentoo

Please clarify.

[vitaly-zdanevich]

Does the software have to use path /nix, can it be some other pathes like /var/lib/flox/nix?

Top-level path is hardcoded, right @tomberek ?

[vitaly-zdanevich]

@tomberek please review again.

[tomberek]

Double check: does your store end up as a read-only mount? (nix-daemon should re-mount it in a namespace to make actual changes)

[vitaly-zdanevich]

@tomberek not sure what you mean - I can install packages, so looks like not a read-only:

flox [flox-env] $ flox install nano
✔ 'nano' installed to environment 'flox-env'
ℹ 'nano' has additional outputs, use 'flox list -a' to see more

$ touch /nix/store/test
touch: cannot touch '/nix/store/test': Permission denied

but

$ findmnt -T /nix/store -o TARGET,SOURCE,FSTYPE,OPTIONS
TARGET SOURCE         FSTYPE OPTIONS
/      /dev/nvme0n1p2 ext4   rw,noatime

There is no separate mount. It is just a directory. Is that OK?

[tomberek]

Ideally it is a bind mount with ro,nosuid,nodev set. That protects it from accidental modification. Then only the daemon and it's children would recount it rw.

It would work without this, it is an extra layer of protection.