Commit Graph

18199 Commits

Author SHA1 Message Date
Eelco Dolstra
3bfc35ba74 nix path-info: Don't write to std::cout directly
This interferes with the progress bar, resulting in output like

  evaluating derivation 'git+file:///home/eelco/Dev/nix-master#packages.x86_64-linux.default'/nix/store/zz8v96j5md952x0mxfix12xqnvq5qv5x-nix-2.26.0pre20241114_a95f6ea.drv

(cherry picked from commit 33a0fa882f)
2024-11-15 14:08:22 +00:00
Eelco Dolstra
aaeaa4e133
Merge pull request #11879 from NixOS/mergify/bp/2.24-maintenance/pr-11878
Remove warning that interpretation of .drv has changed (backport #11878)
2024-11-13 18:23:23 +01:00
Robert Hensing
22e1613814 Remove warning that interpretation of .drv has changed
This was first tagged as 2.15.0, 1½ years ago; plenty of time for
everyone to catch up.

By now, the warning is causing more confusion than that it is helpful,
because passing a `.drv` or `drvPath` has legitimate use cases.

(cherry picked from commit f534a7a524)
2024-11-13 16:12:58 +00:00
Jörg Thalheim
ef21dfa221
Merge pull request #11838 from NixOS/mergify/bp/2.24-maintenance/pr-11837
fix(libutil/posix-source-accessor.cc): get rid of use-after-move bug (backport #11837)
2024-11-08 16:02:45 +01:00
Sergei Zimmerman
c556c205a9 fix(libutil/posix-source-accessor.cc): get rid of use-after-move bug
Naming class member variables the same as constructor arguments is a very
slippery slope because of how member variable names get resolved. Compiler
is not very helpful here and we need static analysis to forbid this kind of
stuff.

The following example illustrates the cause quite well:

```cpp

struct B {
    B(int) {}
};

struct A {
    A(int b): b([&](){
        return b;
        static_assert(std::is_same_v<decltype(b), int>);
    }()) {
       static_assert(std::is_same_v<decltype(b), int>);
    }
    void member() {
        static_assert(std::is_same_v<decltype(b), B>);
    }
    B b;
};

int main() {
    A(1).member();
}
```

From N4861 6.5.1 Unqualified name lookup:

> In all the cases listed in [basic.lookup.unqual], the scopes are searched
> for a declaration in the order listed in each of the respective categories;
> name lookup ends as soon as a declaration is found for the name.
> If no declaration is found, the program is ill-formed.

In the affected code there was a use-after-move for all accesses in the constructor
body, but this UB wasn't triggered.

These types of errors are trivial to catch via clang-tidy's [clang-analyzer-cplusplus.Move].

(cherry picked from commit 3e0129ce3b)
2024-11-08 13:58:17 +00:00
Jörg Thalheim
6e095ddef9
Merge pull request #11823 from NixOS/mergify/bp/2.24-maintenance/pr-11821
initRepoAtomically: Catch directory_not_empty (backport #11821)
2024-11-07 08:03:52 +01:00
Robert Hensing
c3e2419e73 initRepoAtomically: Catch directory_not_empty
(cherry picked from commit 388271e8ec)
2024-11-07 06:23:15 +00:00
Eelco Dolstra
960c288fa0
Merge pull request #11777 from NixOS/mergify/bp/2.24-maintenance/pr-11759
fix: make sure directory exists before using `ln` (backport #11759)
2024-11-01 16:56:25 +01:00
Valentin Gagarin
d14b46f9ba
Merge pull request #11783 from NixOS/mergify/bp/2.24-maintenance/pr-11775
doc/rl-2.19: add entry for always-allow-substitutes option (backport #11775)
2024-11-01 13:12:58 +01:00
Bjørn Forsman
c9325fe343 doc/rl-2.19: add entry for always-allow-substitutes option (#11775)
* doc/rl-2.19: add entry for always-allow-substitutes option

Fixes https://github.com/NixOS/nix/issues/9427.

(cherry picked from commit 020dbac0e0)
2024-11-01 10:57:56 +00:00
Pol Dellaiera
2a2d484986 fix: make sure directory exists before using ln
(cherry picked from commit 5f71ebb956)
2024-11-01 10:19:42 +00:00
Eelco Dolstra
9728a4ac94 maintainers/upload-release.pl: Delete temporary directories when we're done
(cherry picked from commit 02bb633a58)
2024-10-31 12:12:17 +01:00
Eelco Dolstra
75b00e52ac 'build' is now 'build.nix'
(cherry picked from commit 617e711820)
2024-10-31 12:12:12 +01:00
Eelco Dolstra
6044907c13 Bump version 2024-10-31 12:11:43 +01:00
Eelco Dolstra
597fcc98e1 Merge remote-tracking branch 'nix-ghsa-wf4c-57rh-9pjg/advisory-fix-1-2.24' into 2.24-maintenance 2024-10-30 21:44:39 +01:00
Eelco Dolstra
82abed901f
Merge pull request #11769 from DeterminateSystems/fix-release-notes
Fix 2.24 release notes
2024-10-30 16:12:43 +01:00
Eelco Dolstra
f9180f12c4 release notes: 2.24.9 2024-10-30 15:32:37 +01:00
John Ericson
baa7565710
Merge pull request #11763 from NixOS/mergify/bp/2.24-maintenance/pr-11751
Add support for `utimensat` as an alternative to `lutimes` (backport #11751)
2024-10-28 15:27:39 +01:00
John Ericson
7e6e75fd48
Merge pull request #11762 from NixOS/mergify/bp/2.24-maintenance/pr-11750
Fix building on OpenBSD (backport #11750)
2024-10-28 15:27:23 +01:00
Artemis Tosini
803943fce4 Add support for utimensat as an alternative to lutimes
OpenBSD doesn't support `lutimes`, but does support `utimensat` which
subsumes it. In fact, all the BSDs, Linux, and newer macOS all support
it. So lets make this our first choice for the implementation.

In addition, let's get rid of the `lutimes` `ENOSYS` special case. The
Linux manpage says

> ENOSYS
>
> The kernel does not support this call; Linux 2.6.22 or later is
> required.

which I think is the origin of this check, but that's a very old version
of Linux at this point. The code can be simplified a lot of we drop
support for it here (as we've done elsewhere, anyways).

Co-Authored-By: John Ericson <John.Ericson@Obsidian.Systems>
(cherry picked from commit d023202811)
2024-10-28 10:27:39 +00:00
Artemis Tosini
0ae90918db package.nix: Disable GC on OpenBSD
Nix fails to build on OpenBSD with a linking error due to a non-found
symbol in boehm-gc. Just disable the GC until we can find a proper
workaround.

(cherry picked from commit fecc1ca205)
2024-10-28 10:27:37 +00:00
Artemis Tosini
d6ece7e94a Fix OpenBSD build with Makefiles
OpenBSD dynamic libraries never link to libc directly.
Instead, they have undefined symbols for all libc functions they use
that ld.so resolves to the libc referred to in the main executable.

Thus, disallowing undefined symbols will always fail

(cherry picked from commit c49bff2434)
2024-10-28 10:27:37 +00:00
Robert Hensing
50f83e4bbd local-derivation-goal: Move builder preparation to non-builtin code path 2024-10-22 17:56:06 +02:00
Robert Hensing
047ee50db2 local-derivation-goal: Refactor
This works because the `builder` and `args` variables are only used
in the non-builtin code path.

Co-Authored-By: Théophane Hufschmitt <theophane.hufschmitt@tweag.io>
2024-10-22 17:56:06 +02:00
Robert Hensing
ae7a2ea741 local-derivation-goal: Print sandbox error detail on darwin
Co-Authored-By: Théophane Hufschmitt <theophane.hufschmitt@tweag.io>
2024-10-22 17:56:06 +02:00
Robert Hensing
f8a1a149c7 packaging: Add darwin -lsandbox in meson 2024-10-22 17:56:06 +02:00
Puck Meerburg
170242cf0c fix: Run all derivation builders inside the sandbox on macOS 2024-10-22 17:56:06 +02:00
Eelco Dolstra
7718688f52
Merge pull request #11730 from NixOS/mergify/bp/2.24-maintenance/pr-11713
fix env-vars beeing written to `/tmp` (backport #11713)
2024-10-22 15:01:56 +02:00
Jörg Thalheim
0e9b04a66e fix env-vars beeing written to /tmp
This overall seems like insecure tmp file handling to me. Because other
users could replace files in /tmp with a symlink and make the nix-shell
override other files.

fixes https://github.com/NixOS/nix/issues/11470

(cherry picked from commit 2105574702)
2024-10-22 12:13:47 +00:00
Eelco Dolstra
411ec33db3
Merge pull request #11692 from NixOS/mergify/bp/2.24-maintenance/pr-11690
Handle tarballs where directory entries are not contiguous (backport #11690)
2024-10-14 16:01:43 +02:00
Eelco Dolstra
31df105f45
Merge pull request #11691 from NixOS/mergify/bp/2.24-maintenance/pr-11677
builtins.fetchurl: Fix segfault on s3:// URLs (backport #11677)
2024-10-14 15:23:49 +02:00
Eelco Dolstra
57ace600af Add a test
(cherry picked from commit a7b9877da9)
2024-10-14 12:51:03 +00:00
Eelco Dolstra
9da1300617 Handle tarballs where directory entries are not contiguous
I.e. when not all entries underneath a directory X follow eachother,
but there is some entry Y that isn't a child of X in between.

Fixes #11656.

(cherry picked from commit 4012954b59)
2024-10-14 12:51:03 +00:00
Eelco Dolstra
1294442c6c Add assert
(cherry picked from commit d2f4d07619)
2024-10-14 14:44:28 +02:00
Eelco Dolstra
339236d32e Make S3 downloads slightly more interruptable
(cherry picked from commit d38f62f64d)
2024-10-14 14:44:28 +02:00
Eelco Dolstra
4912a9e7fd builtins.fetchurl: Fix segfault on s3:// URLs
Also, add an activity to show that we're downloading an s3:// file.

Fixes #11674.

(cherry picked from commit 0500fba56a)
2024-10-14 14:44:28 +02:00
Eelco Dolstra
d80bf54e3b Add a VM test for S3BinaryCacheStore
Fixes #11238.

(cherry picked from commit 2950f9e18a)
2024-10-14 14:44:28 +02:00
Robert Hensing
f1dc3b7d55
Merge pull request #11649 from NixOS/mergify/bp/2.24-maintenance/pr-11610
fix passing CA files into builtins:fetchurl sandbox (backport #11610)
2024-10-13 12:43:33 +02:00
Jörg Thalheim
5f1b132187 tests/nixos/fetchurl: drop unused variables
(cherry picked from commit 410853ddcf)
2024-10-07 12:45:04 +00:00
Puck Meerburg
742eb0f815 fix passing CA files into builtins:fetchurl sandbox
This patch has been manually adapted from
14dc84ed03

Tested with:

$ NIX_SSL_CERT_FILE=$(nix-build '<nixpkgs>' -A cacert)/etc/ssl/certs/ca-bundle.crt nix-build --store $(mktemp -d) -E 'import <nix/fetchurl.nix> { url = https://google.com; }'
Finished at 16:57:50 after 1s
warning: found empty hash, assuming 'sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='
this derivation will be built:
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
  /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
google.com> building '/nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv'
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
google.com> error:
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
google.com>        … writing file '/nix/store/0zynn4n8yx59bczy1mgh1lq2rnprvvrc-google.com'
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
google.com>
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
google.com>        error: unable to download 'https://google.com': Problem with the SSL CA cert (path? access rights?) (77) error setting certificate file: /nix/store/nlgbippbbgn38hynjkp1ghiybcq1dqhx-nss-cacert-3.101.1/etc/ssl/certs/ca-bundle.crt
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
error: builder for '/nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv' failed with exit code 1

Now returns:

nix-env % NIX_SSL_CERT_FILE=$(nix-build '<nixpkgs>' -A cacert)/etc/ssl/certs/ca-bundle.crt nix-build --store $(mktemp -d) -E 'import <nix/fetchurl.nix> { url = https://google.com; }'
Finished at 17:05:48 after 0s
warning: found empty hash, assuming 'sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='
this derivation will be built:
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
  /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
google.com> building '/nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv'
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
error: hash mismatch in fixed-output derivation '/nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv':
         specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

(cherry picked from commit c1ecf0bee9)
2024-10-07 12:45:03 +00:00
Robert Hensing
13e200df45
Merge pull request #11601 from Mic92/git-cache-backport
[2.24] create git caches atomically
2024-09-30 13:11:22 +02:00
Eelco Dolstra
a1d841bf2c Bump version 2024-09-28 00:05:03 +02:00
Eelco Dolstra
048cfe51c9
Merge pull request #11604 from NixOS/mergify/bp/2.24-maintenance/pr-11600
HttpBinaryCacheStore::getFile(): Fix uncaught exception (backport #11600)
2024-09-27 13:26:21 +02:00
Eelco Dolstra
15a2b49115 HttpBinaryCacheStore::getFile(): Fix uncaught exception
This method is marked as `noexcept`, but `enqueueFileTransfer()` can
throw `Interrupted` if the user has hit Ctrl-C or if the `ThreadPool`
that the thread is a part of is shutting down.

(cherry picked from commit 4566854981)
2024-09-27 10:38:03 +00:00
Jörg Thalheim
34fd00accc create git caches atomically
When working on speeding up the CI,
I triggered a race condition in the creation of the tarball cache.
This code now instead will ensure that half-initialized repositories
are no longer visible to any other nix process.

This is the error message that I got before:

error: opening Git repository '"/Users/runner/.cache/nix/tarball-cache"': could not find repository at '/Users/runner/.cache/nix/tarball-cache'
(cherry picked from commit 12d5b2cfa1)
2024-09-27 10:06:58 +02:00
Eelco Dolstra
b23812a59c Bump version 2024-09-26 03:25:40 +02:00
Eelco Dolstra
618a0cc987
Merge pull request #11592 from NixOS/mergify/bp/2.24-maintenance/pr-11585
builtin:fetchurl: Enable TLS verification (backport #11585)
2024-09-26 01:04:39 +02:00
Eelco Dolstra
ba81598017 Resolve conflict 2024-09-26 00:17:03 +02:00
Eelco Dolstra
e87be60055 Typo
(cherry picked from commit ef8987955b)
2024-09-26 00:16:17 +02:00
Eelco Dolstra
345a264a39 Add release note
(cherry picked from commit 7b39cd631e)
2024-09-25 21:55:36 +00:00