Commit Graph

15556 Commits

Author SHA1 Message Date
Théophane Hufschmitt
34611986f9 Fix permission denied when building symlink derivation which points to a symlink out of the store
Bind-mounting symlinks is apparently not possible, which is why the
thing was failing.

Fortunately, symlinks are small, so we can fallback to copy them at no cost.

Fix https://github.com/NixOS/nix/issues/9579

Co-authored-by: Artturin <Artturin@artturin.com>
(cherry picked from commit 913db9f738)
2024-04-11 12:08:19 +00:00
Théophane Hufschmitt
661e63a734 Add a test for depending on a symlink store path
Regression test for https://github.com/NixOS/nix/issues/9579

(cherry picked from commit 872d93eb13)
2024-04-11 12:08:18 +00:00
Eelco Dolstra
940586366e
Merge pull request #10460 from NixOS/backport-10413-to-2.19-maintenance
[Backport 2.19-maintenance] path-info: print correct path when using `nix path-info --store file://... --all --json`
2024-04-10 22:25:09 +02:00
Maximilian Bosch
df30b26066 path-info: print correct path when using nix path-info --store file://... --all --json
When querying all paths in a binary cache store, the path's representation
is `<hash>-x` (where `x` is the value of `MissingName`) because the .narinfo
filenames only contain the hash.

Before cc46ea1630 this worked correctly,
because the entire path info was read and the path from this
representation was printed, i.e. in the form `<hash>-<name>`. Since then
however, the direct result from `queryAllValidPaths()` was used as `path`.

Added a regression test to make sure the behavior remains correct.

(cherry picked from commit c80cd6bb06)
2024-04-10 17:37:34 +00:00
Valentin Gagarin
f79eb2c31f
show Nix logo in the manual (#10446)
the location of files is hard-coded by mdBook.
there is also seems to be no way to define custom templates, therefore
all styling has to be done in the CSS override.

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
2024-04-09 09:50:52 +00:00
Théophane Hufschmitt
82f44d8633
Merge pull request #10354 from NixOS/backport-10259-to-2.19-maintenance
[Backport 2.19-maintenance] doc: builtins.addDrvOutputDependencies: fix link target
2024-03-29 12:22:01 +01:00
Yueh-Shun Li
5d79af46dd builtins.addDrvOutputDependencies: fix commentary
(cherry picked from commit d2b512959c)
2024-03-29 10:56:43 +00:00
Yueh-Shun Li
a612b90505 doc: builtins.addDrvOutputDependencies: fix link target
(cherry picked from commit 39b0b8452f)
2024-03-29 10:56:43 +00:00
Eelco Dolstra
dd0ba589f4
Merge pull request #10169 from johnrichardrinehart/jrinehart/2_19-faster-flake-lock-parsing
[Backport 2.19-maintenance] Faster flake lock parsing
2024-03-07 17:31:05 +01:00
Eelco Dolstra
a2e3a07da4 Bump version 2024-03-07 15:43:55 +01:00
Eelco Dolstra
7794354a98 Fix sandbox escape patch 2024-03-07 13:16:15 +01:00
Eelco Dolstra
9179bc5a6e
Merge pull request from GHSA-2ffj-w4mj-pg37
Sandbox escape 2.19
2024-03-07 11:56:24 +01:00
Graham Dennis
89cadf5d64 Faster flake.lock parsing
This PR reduces the creation of short-lived basic_json objects while
parsing flake.lock files. For large flake.lock files (~1.5MB) I was
observing ~60s being spent for trivial nix build operations while
after this change it is now taking ~1.6s.

(cherry picked from commit 7fd0de38c6)
2024-03-06 17:56:26 -08:00
Théophane Hufschmitt
6566d3c565
Merge pull request #10159 from johnrichardrinehart/2.19-maintenance
feat: show status bar with 'store copy-sigs'
2024-03-06 07:20:23 +01:00
Théophane Hufschmitt
e77d3b805e
Don't print too loudly if a substituter is missing a path when copying signatures 2024-03-06 06:56:31 +01:00
Théophane Hufschmitt
9b40a46abe
Explicitly instantiate the progress-bar counter in copy-sigs 2024-03-06 06:56:03 +01:00
John Rinehart
5d534dc30f feat: show status bar with 'store copy-sigs' 2024-03-05 18:21:43 -08:00
Théophane Hufschmitt
157524874d
Merge pull request #10137 from fricklerhandwerk/fix-help-stores
fix `nix help-stores` for 2.19
2024-03-05 07:32:30 +01:00
Valentin Gagarin
c2122d0ebc add tests for showing help 2024-03-04 21:06:51 +01:00
Théophane Hufschmitt
f3c9656afd
Merge pull request #10141 from NixOS/backport-10073-to-2.19-maintenance
[Backport 2.19-maintenance] Accept multiple inputs in `nix flake update`
2024-03-04 10:31:16 +01:00
Olmo Kramer
bcdea81c96 Add test for nix flake update with multiple inputs
(cherry picked from commit b1ad729add)
2024-03-04 08:53:58 +00:00
Olmo Kramer
44ef603335 Accept multiple inputs in nix flake update
(cherry picked from commit 9f11b1b0c4)
2024-03-04 08:53:58 +00:00
Valentin Gagarin
ac5f147afc fix nix help-stores
the crash when calling `nix help-stores` was probably introduced an
artifact from a prior untangling of merge conflicts.
that said, `nix help-stores` should eventually cease to exist in favor
of dedicated `--help` outputs and `man` pages for the various store
types.
2024-03-03 22:38:00 +01:00
Théophane Hufschmitt
90f9a350fb Add release notes 2024-03-01 09:43:42 +01:00
Théophane Hufschmitt
e744fe293b Fix a typo in a test comment
Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
2024-03-01 09:43:42 +01:00
Théophane Hufschmitt
68b6f897e4 Copy the output of fixed-output derivations before registering them
It is possible to exfiltrate a file descriptor out of the build sandbox
of FODs, and use it to modify the store path after it has been
registered.
To avoid that issue, don't register the output of the build, but a copy
of it (that will be free of any leaked file descriptor).
2024-03-01 09:43:42 +01:00
Théophane Hufschmitt
ca05f6d203 Add a NixOS test for the sandbox escape
Test that we can't leverage abstract unix domain sockets to leak file
descriptors out of the sandbox and modify the path after it has been
registered.
2024-03-01 09:43:42 +01:00
github-actions[bot]
d829c21ef3
fix location of _redirects file (#9957) 2024-02-07 11:43:55 +01:00
John Ericson
2c4bb93ba5
Merge pull request #9851 from NixOS/backport-9848-to-2.19-maintenance
[Backport 2.19-maintenance] Make `StoreConfig::getDefaultSystemFeatures` a static method
2024-01-25 13:45:40 -05:00
John Ericson
5c1fa89f78 Make StoreConfig::getDefaultSystemFeatures a static method
This makes something in Hydra bit simpler. If someday the default
depends on the other config options, we can always change it back.

(cherry picked from commit a9e10a1dbd)
2024-01-25 16:58:00 +00:00
Eelco Dolstra
03e96b9dc0 Bump version 2024-01-19 13:07:31 +01:00
Eelco Dolstra
91e60868bd Use BackedStringView
(cherry picked from commit 1fe8f54bd3)
2024-01-19 10:14:17 +01:00
Eelco Dolstra
8bb4cb0565 Print a more helpful message if the daemon crashes
Instead of

   error: unexpected end-of-file

you now get

   error: Nix daemon disconnected unexpectedly (maybe it crashed?)

(cherry picked from commit a3cf27ca47)
2024-01-19 10:14:12 +01:00
Eelco Dolstra
f1788c425b
Merge pull request #9810 from NixOS/backport-9804-to-2.19-maintenance
[Backport 2.19-maintenance] Fix crash when NAR is missing from binary cache
2024-01-19 09:40:07 +01:00
Eelco Dolstra
fdf5313e7e copyStorePath(): Bail out early if the store path already exists
In rare cases (e.g. when using allowSubstitutes = false), it's
possible that we simultaneously have a DerivationGoal *and* a
SubstitutionGoal building the same path. So if a DerivationGoal
already built the path while the SubstitutionGoal was waiting for a
download slot, it saves us a superfluous download to exit early.

(cherry picked from commit dca0a80240)
2024-01-19 08:39:09 +00:00
Eelco Dolstra
cc94ea5a17 LocalStore::addToStore(): Ignore exceptions from parseDump()
In the "discard" case (i.e. when the store path already exists
locally), when we call parseDump() from a Finally and it throws an
exception (e.g. if the download of the NAR fails), Nix crashes:

   terminate called after throwing an instance of 'nix::SubstituteGone'
     what():  error: file 'nar/06br3254rx4gz4cvjzxlv028jrx80zg5i4jr62vjmn416dqihgr7.nar.xz' does not exist in binary cache 'http://localhost'
   Aborted (core dumped)

(cherry picked from commit a18d8d688a)
2024-01-19 08:39:09 +00:00
Eelco Dolstra
3cb2740721 Show what goal is waiting for a build slot
(cherry picked from commit ab786e22f1)
2024-01-19 08:39:09 +00:00
John Ericson
dc09e6193b
Merge pull request #9739 from shlevy/ifd-buildStore-2.19
(Backport #9661) Build IFD in the build store when using eval-store.
2024-01-11 10:06:09 -05:00
Shea Levy
2e4239f9e3
Merge branch '2.19-maintenance' into ifd-buildStore-2.19 2024-01-11 07:21:51 -05:00
Shea Levy
e7c2b35827
Build IFD in the build store when using eval-store.
Previously, IFDs would be built within the eval store, even though one
is typically using `--eval-store` precisely to *avoid* local builds.

Because the resulting Nix expression must be copied back to the eval
store in order to be imported, this requires the eval store to trust
the build store's signatures.

(cherry picked from commit c3942ef85f)
2024-01-11 06:34:27 -05:00
Shea Levy
be208d8e78
remote-store test: Break out IFD expression into a separate file
(cherry picked from commit 9cb287657b)
2024-01-11 06:30:02 -05:00
github-actions[bot]
958ecd81a8
fix an old lost direct (#9718)
this part must have been moved quite a while ago, but apparently so far
no one noticed

(cherry picked from commit 6db805b3d1)

Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
2024-01-08 20:57:50 +01:00
Eelco Dolstra
8ef5c1cc06
Merge pull request #9691 from NixOS/backport-9687-to-2.19-maintenance
[Backport 2.19-maintenance] withFramedSink(): Receive interrupts on the stderr thread
2024-01-08 13:27:42 +01:00
Eelco Dolstra
6af94c431b Make some more threads receive interrupts
Shouldn't hurt to do this. In particular, this should speed up
shutting down the PathSubstitutionGoal thread if it's copying from a
remote store.

(cherry picked from commit 295a2ff8bd)
2024-01-04 16:06:41 +00:00
Eelco Dolstra
4b38ebb009 withFramedSink(): Receive interrupts on the stderr thread
Otherwise Nix deadlocks when Ctrl-C is received in withFramedSink():
the parent thread will wait forever for the stderr thread to shut
down.

Fixes the hang reported in https://github.com/NixOS/nix/issues/7245#issuecomment-1770560923.

(cherry picked from commit 24e70489e5)
2024-01-04 16:06:41 +00:00
Robert Hensing
b38e5a665e
Merge pull request #9609 from NixOS/backport-9547-to-2.19-maintenance
[Backport 2.19-maintenance] `allowed-uris`: match whole schemes without slashes #9547
2023-12-14 00:38:30 +01:00
Robert Hensing
01cf57703a Revert "Add nix::isASCII*, locale-independent"
This reverts commit 79eb2920bb.

Not used at this time.

(cherry picked from commit 0b87ba50c0)
2023-12-13 21:09:33 +01:00
Robert Hensing
ebdb6926fd isValidSchemeName: Use regex
As requested by Eelco Dolstra. I think it used to be simpler.

(cherry picked from commit 4eaeda6604)
2023-12-13 21:09:31 +01:00
Robert Hensing
598b0e2317 schemeRegex -> schemeNameRegex
Scheme could be understood to include the typical `:` separator.

(cherry picked from commit 2e451a663e)
2023-12-13 21:09:22 +01:00
Robert Hensing
ffb6246650 allowed-uris: Match whole schemes also when scheme is not followed by slashes
(cherry picked from commit a05bc9eb92)
2023-12-13 21:09:20 +01:00