shadow quic: patch lsquic in the nimble package cache

nimble c re-resolves and re-installs lsquic before compiling, wiping a patch
applied to the installed package: both previous builds shipped stock lsquic.
It installs by copying from the package cache, so patching there survives the
re-resolve.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
radiken
2026-07-23 08:45:35 +01:00
co-authored by Claude Opus 4.8
parent 0439fa5e4b
commit bec334bfd1
@@ -41,15 +41,16 @@ RUN nimble install -dy --verbose
COPY lsquic-tick-floor.patch /tmp/lsquic-tick-floor.patch
RUN set -eu; \
patched=0; \
for d in /root/.nimble/pkgs2/lsquic-*; do \
[ -f "$d/lsquic/context/context.nim" ] || continue; \
( cd "$d" && git apply -p1 --verbose /tmp/lsquic-tick-floor.patch \
&& grep -q tickFloorUs lsquic/context/context.nim ); \
for d in /root/.nimble/pkgcache/*lsquic*/ /root/.nimble/pkgs2/lsquic-*/; do \
[ -f "${d}lsquic/context/context.nim" ] || continue; \
if grep -q tickFloorUs "${d}lsquic/context/context.nim"; then echo "already patched $d"; continue; fi; \
( cd "$d" && git apply -p1 /tmp/lsquic-tick-floor.patch ); \
echo "patched $d"; patched=$((patched+1)); \
done; \
[ "$patched" -gt 0 ] || { echo "no lsquic package found to patch"; exit 1; }; \
echo "PATCH-STATE-BEFORE-COMPILE:"; \
grep -l tickFloorUs /root/.nimble/pkgs2/lsquic-*/lsquic/context/context.nim || echo " none patched"
grep -l tickFloorUs /root/.nimble/pkgcache/*lsquic*/lsquic/context/context.nim \
/root/.nimble/pkgs2/lsquic-*/lsquic/context/context.nim || echo " none patched"
# Dynamic link: no `-static`, no `-mmusl`, no `-static-libgcc/-libstdc++`.
RUN nimble c \
@@ -60,7 +61,8 @@ RUN nimble c \
&& chmod +x /node/main \
&& echo "PATCH-STATE-AFTER-COMPILE:" \
&& (grep -l tickFloorUs /root/.nimble/pkgs2/lsquic-*/lsquic/context/context.nim || echo " WIPED by nimble re-resolve") \
&& grep -qa LSQUIC_TICK_FLOOR_US /node/main
&& grep -qa LSQUIC_TICK_FLOOR_US /node/main \
&& echo "TICK-FLOOR VERIFIED IN BINARY"
# Tiny final stage: the binary + its runtime deps. The image's role is to hand
# off /node/main to an init container, not to run anything itself. We still