SFT-6061: reduced environment variable reliance
What the developer wrote
Authored by Matt Gleason
SFT-6061: reduced environment variable reliance
What changed, and why it matters
This commit refactors how environment variables are set in the project's Nix development shell. It moves some variables from a dynamic shell script into static declarations and limits others to Linux only. There is no direct security fix or vulnerability patch here; it is a build-environment cleanup.
No security action required. Reviewers may separately evaluate whether disabling all compiler hardening in the development shell is an acceptable risk for the project's build environment, but that is outside the scope of this commit.
Security signals we found
No security-relevant code change in firmware or cryptographic components
hardeningDisable = [ "all" ] persists, but this is pre-existing dev-shell behavior, not introduced by this commit
No secrets, credentials, or access controls modified
No CVE, advisory, or security disclosure referenced in commit
Evidence from the diff
The change modifies flake.nix’s mkShell definition. It removes the shellHook logic that appended to LD_LIBRARY_PATH and conditionally set SDL_RENDER_DRIVER and QT_QPA_PLATFORM, replacing them with direct environment attributes (LD_LIBRARY_PATH, QT_QPA_PLATFORM, SDL_RENDER_DRIVER) and restricting QT_QPA_PLATFORM and SDL_RENDER_DRIVER to Linux via lib.optionalAttrs. SDL Wayland variables remain in shellHook because they depend on runtime WAYLAND_DISPLAY. The hardeningDisable = [ “all” ] setting remains unchanged, meaning compiler hardening is still disabled in the dev shell.
Changed components
flake.nixNix development shell configurationInspect captured patch +22 / −26
diff --git a/flake.nix b/flake.nix
index a8aa0e5..f8edcf2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -84,32 +84,28 @@
zlib
];
mkShell = packages:
- pkgs.mkShellNoCC {
- inherit packages;
- hardeningDisable = [ "all" ];
- CC = "${pkgs.gcc13}/bin/gcc";
- CXX = "${pkgs.gcc13}/bin/g++";
- MPY_CROSS = "${customPackages.mpy-cross}/bin/mpy-cross";
- shellHook = ''
- if [ -n "''${LD_LIBRARY_PATH:-}" ]; then
- export LD_LIBRARY_PATH=''${LD_LIBRARY_PATH}:${runtimeLibPath}
- else
- export LD_LIBRARY_PATH=${runtimeLibPath}
- fi
- if [ -n "''${WAYLAND_DISPLAY:-}" ] && [ -z "''${SDL_VIDEODRIVER:-}" ]; then
- export SDL_VIDEODRIVER=wayland
- fi
- if [ -n "''${WAYLAND_DISPLAY:-}" ] && [ -z "''${SDL_VIDEO_WAYLAND_PREFER_LIBDECOR:-}" ]; then
- export SDL_VIDEO_WAYLAND_PREFER_LIBDECOR=1
- fi
- if [ -z "''${SDL_RENDER_DRIVER:-}" ]; then
- export SDL_RENDER_DRIVER=software
- fi
- if [ "$(uname -s)" = "Linux" ] && [ -z "''${QT_QPA_PLATFORM:-}" ]; then
- export QT_QPA_PLATFORM=xcb
- fi
- '';
- };
+ pkgs.mkShellNoCC (
+ {
+ inherit packages;
+ hardeningDisable = [ "all" ];
+ CC = "${pkgs.gcc13}/bin/gcc";
+ CXX = "${pkgs.gcc13}/bin/g++";
+ LD_LIBRARY_PATH = runtimeLibPath;
+ MPY_CROSS = "${customPackages.mpy-cross}/bin/mpy-cross";
+ shellHook = ''
+ if [ -n "''${WAYLAND_DISPLAY:-}" ] && [ -z "''${SDL_VIDEODRIVER:-}" ]; then
+ export SDL_VIDEODRIVER=wayland
+ fi
+ if [ -n "''${WAYLAND_DISPLAY:-}" ] && [ -z "''${SDL_VIDEO_WAYLAND_PREFER_LIBDECOR:-}" ]; then
+ export SDL_VIDEO_WAYLAND_PREFER_LIBDECOR=1
+ fi
+ '';
+ }
+ // lib.optionalAttrs pkgs.stdenv.isLinux {
+ QT_QPA_PLATFORM = "xcb";
+ SDL_RENDER_DRIVER = "software";
+ }
+ );
buildPackages =
with pkgs;
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.