rktStage1Kvm.nix

{ pkgs, stdenv, lib, rkt, cacert, fakeroot, fakechroot, getopt, patchelf }:

let
  rktFetch = { name, sha256 }: stdenv.mkDerivation {
    name = "${lib.replaceStrings ["/" ":"] ["_" "_"] name}.tar";
    nativeBuildInputs = [ rkt cacert fakeroot fakechroot getopt ];

    PATH = lib.makeBinPath [ rkt ];
    buildCommand = ''
      SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
      IMAGE_ID="$(rkt --dir="$TMPDIR" \
        fetch "${name}" --insecure-options=image)"
      rkt --dir="$TMPDIR" image export "$IMAGE_ID" $out
    '';

    outputHash = sha256;
    outputHashAlgo = "sha256";
    outputHashMode = "flat";
  };

in stdenv.mkDerivation {
  name = "rkt-stage1-kvm.aci";

  src = rktFetch {
    name = "coreos.com/rkt/stage1-kvm:1.29.0";
    sha256 = "0m08qfxy6m9wicv7rqx2qb36qrfhwy08m2azckr1n4mgp9l9isy8";
  };

  libPath = with pkgs; lib.makeLibraryPath [
    systemd
    glibc
    readline
    libseccomp
    libaudit
    krb5Full
  ];

  nativeBuildInputs = [ patchelf ];
  
  postPatch = ''
    find . -type f -executable | while read f; do
      echo "$f"
      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$f" || true
      patchelf --set-rpath "$libPath" "$f" || true
    done
      
    #find . -type f -executable -print \
    #  -exec patchelf --print-needed "{}" \;
  '';

  installPhase = ''
    cd ..
    tar cf $out rootfs manifest
  '';
}