vestigia

Detect where execution depends on secrets.
git clone git://git.ppad.tech/vestigia.git
Log | Files | Refs | README | LICENSE

probe.nix (638B)

      1 # memcheck's XML for a known program, captured on x86_64-linux
      2 let
      3   f = builtins.getFlake "git+file:///Users/jtobin/src/ppad/censor";
      4   pkgs = import f.inputs.nixpkgs { system = "x86_64-linux"; };
      5 in
      6 pkgs.runCommandCC "vestigia-probe" {
      7   nativeBuildInputs = [ pkgs.valgrind ];
      8   buildInputs = [ pkgs.valgrind.dev ];
      9 } ''
     10   mkdir -p $out
     11   cc -O2 -g -o probe ${./probe.c}
     12   valgrind --tool=memcheck --xml=yes --xml-file=$out/memcheck.xml \
     13     --track-origins=yes --error-limit=no --num-callers=12 \
     14     --expensive-definedness-checks=yes ./probe > $out/stdout 2> $out/stderr
     15   echo $? > $out/exit
     16   objdump -d probe > $out/probe.dis
     17 ''