echidna-redistributable: alert if nix deps remain on binary

crytic · Jan 3, 2024 · c03f44b · c03f44b
1 parent b7f5e79
commit c03f44b
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/flake.nix b/flake.nix
@@ -113,6 +113,12 @@
           ${install_name_tool} -change "$cxx" /usr/lib/libc++.1.dylib $out/bin/echidna
           # fix TERMINFO path in ncurses
           ${perl} -i -pe 's#(${ncurses-static}/share/terminfo)#"/usr/share/terminfo" . "\x0" x (length($1) - 19)#e' $out/bin/echidna
+          # check that no nix deps remain
+          nixdeps=$(${otool} -L $out/bin/echidna | tail -n +2 | { ${grep} /nix/store -c || test $? = 1; })
+          if [ ! "$nixdeps" = "0" ]; then
+            echo "Nix deps remain in redistributable binary!"
+            exit 255
+          fi
           # re-sign binary
           CODESIGN_ALLOCATE=${codesign_allocate} ${codesign} -f -s - $out/bin/echidna
           chmod 555 $out/bin/echidna