aboutsummaryrefslogtreecommitdiff
path: root/scripts
diff options
context:
space:
mode:
Diffstat (limited to 'scripts')
-rw-r--r--scripts/check-hydra-status.sh33
-rwxr-xr-xscripts/create-darwin-volume.sh54
-rw-r--r--scripts/install-darwin-multi-user.sh21
-rw-r--r--scripts/install-multi-user.sh176
-rw-r--r--scripts/install-nix-from-closure.sh31
-rwxr-xr-xscripts/install-systemd-multi-user.sh11
-rwxr-xr-xscripts/install.in23
-rw-r--r--scripts/local.mk4
-rwxr-xr-xscripts/nix-http-export.cgi.in51
-rw-r--r--scripts/nix-profile-daemon.sh.in6
-rw-r--r--scripts/nix-profile.sh.in3
-rwxr-xr-xscripts/nix-reduce-build.in171
-rwxr-xr-xscripts/prepare-installer-for-github-actions2
13 files changed, 284 insertions, 302 deletions
diff --git a/scripts/check-hydra-status.sh b/scripts/check-hydra-status.sh
new file mode 100644
index 000000000..e62705e94
--- /dev/null
+++ b/scripts/check-hydra-status.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+# set -x
+
+
+# mapfile BUILDS_FOR_LATEST_EVAL < <(
+# curl -H 'Accept: application/json' https://hydra.nixos.org/jobset/nix/master/evals | \
+# jq -r '.evals[0].builds[] | @sh')
+BUILDS_FOR_LATEST_EVAL=$(
+curl -sS -H 'Accept: application/json' https://hydra.nixos.org/jobset/nix/master/evals | \
+ jq -r '.evals[0].builds[]')
+
+someBuildFailed=0
+
+for buildId in $BUILDS_FOR_LATEST_EVAL; do
+ buildInfo=$(curl --fail -sS -H 'Accept: application/json' "https://hydra.nixos.org/build/$buildId")
+
+ finished=$(echo "$buildInfo" | jq -r '.finished')
+
+ if [[ $finished = 0 ]]; then
+ continue
+ fi
+
+ buildStatus=$(echo "$buildInfo" | jq -r '.buildstatus')
+
+ if [[ $buildStatus != 0 ]]; then
+ someBuildFailed=1
+ echo "Job “$(echo "$buildInfo" | jq -r '.job')” failed on hydra: $buildInfo"
+ fi
+done
+
+exit "$someBuildFailed"
diff --git a/scripts/create-darwin-volume.sh b/scripts/create-darwin-volume.sh
index 8aff03199..103e1e391 100755
--- a/scripts/create-darwin-volume.sh
+++ b/scripts/create-darwin-volume.sh
@@ -246,7 +246,8 @@ get_volume_pass() {
verify_volume_pass() {
local volume_special="$1" # (i.e., disk1s7)
local volume_uuid="$2"
- /usr/sbin/diskutil apfs unlockVolume "$volume_special" -verify -stdinpassphrase -user "$volume_uuid"
+ _sudo "to confirm the password actually unlocks the volume" \
+ /usr/sbin/diskutil apfs unlockVolume "$volume_special" -verify -stdinpassphrase -user "$volume_uuid"
}
volume_pass_works() {
@@ -440,7 +441,27 @@ add_nix_vol_fstab_line() {
# shellcheck disable=SC1003,SC2026
local escaped_mountpoint="${NIX_ROOT/ /'\\\'040}"
shift
- EDITOR="/usr/bin/ex" _sudo "to add nix to fstab" "$@" <<EOF
+
+ # wrap `ex` to work around problems w/ vim features breaking exit codes
+ # - plugins (see github.com/NixOS/nix/issues/5468): -u NONE
+ # - swap file: -n
+ #
+ # the first draft used `--noplugin`, but github.com/NixOS/nix/issues/6462
+ # suggests we need the less-semantic `-u NONE`
+ #
+ # we'd prefer EDITOR="/usr/bin/ex -u NONE" but vifs doesn't word-split
+ # the EDITOR env.
+ #
+ # TODO: at some point we should switch to `--clean`, but it wasn't added
+ # until https://github.com/vim/vim/releases/tag/v8.0.1554 while the macOS
+ # minver 10.12.6 seems to have released with vim 7.4
+ cat > "$SCRATCH/ex_cleanroom_wrapper" <<EOF
+#!/bin/sh
+/usr/bin/ex -u NONE -n "\$@"
+EOF
+ chmod 755 "$SCRATCH/ex_cleanroom_wrapper"
+
+ EDITOR="$SCRATCH/ex_cleanroom_wrapper" _sudo "to add nix to fstab" "$@" <<EOF
:a
UUID=$uuid $escaped_mountpoint apfs rw,noauto,nobrowse,suid,owners
.
@@ -630,8 +651,9 @@ EOF
task "Configuring /etc/synthetic.conf to make a mount-point at $NIX_ROOT" >&2
# technically /etc/synthetic.d/nix is supported in Big Sur+
# but handling both takes even more code...
+ # See earlier note; `-u NONE` disables vim plugins/rc, `-n` skips swapfile
_sudo "to add Nix to /etc/synthetic.conf" \
- /usr/bin/ex /etc/synthetic.conf <<EOF
+ /usr/bin/ex -u NONE -n /etc/synthetic.conf <<EOF
:a
${NIX_ROOT:1}
.
@@ -670,22 +692,27 @@ encrypt_volume() {
local volume_uuid="$1"
local volume_label="$2"
local password
+
+ task "Encrypt the Nix volume" >&2
+
# Note: mount/unmount are late additions to support the right order
# of operations for creating the volume and then baking its uuid into
# other artifacts; not as well-trod wrt to potential errors, race
# conditions, etc.
- /usr/sbin/diskutil mount "$volume_label"
+ _sudo "to mount your Nix volume for encrypting" \
+ /usr/sbin/diskutil mount "$volume_label"
password="$(/usr/bin/xxd -l 32 -p -c 256 /dev/random)"
_sudo "to add your Nix volume's password to Keychain" \
/usr/bin/security -i <<EOF
add-generic-password -a "$volume_label" -s "$volume_uuid" -l "$volume_label encryption password" -D "Encrypted volume password" -j "Added automatically by the Nix installer for use by $NIX_VOLUME_MOUNTD_DEST" -w "$password" -T /System/Library/CoreServices/APFSUserAgent -T /System/Library/CoreServices/CSUserAgent -T /usr/bin/security "/Library/Keychains/System.keychain"
EOF
- builtin printf "%s" "$password" | _sudo "to encrypt your Nix volume" \
+ builtin printf "%s" "$password" | _sudo "to actually encrypt your Nix volume" \
/usr/sbin/diskutil apfs encryptVolume "$volume_label" -user disk -stdinpassphrase
- /usr/sbin/diskutil unmount force "$volume_label"
+ _sudo "to unmount the encrypted volume" \
+ /usr/sbin/diskutil unmount force "$volume_label"
}
create_volume() {
@@ -715,7 +742,8 @@ create_volume() {
# 6) getting special w/ awk may be fragile, but doing it to:
# - save time over running slow diskutil commands
# - skirt risk we grab wrong volume if multiple match
- /usr/sbin/diskutil apfs addVolume "$NIX_VOLUME_USE_DISK" "$NIX_VOLUME_FS" "$NIX_VOLUME_LABEL" -nomount | /usr/bin/awk '/Created new APFS Volume/ {print $5}'
+ _sudo "to create a new APFS volume '$NIX_VOLUME_LABEL' on $NIX_VOLUME_USE_DISK" \
+ /usr/sbin/diskutil apfs addVolume "$NIX_VOLUME_USE_DISK" "$NIX_VOLUME_FS" "$NIX_VOLUME_LABEL" -nomount | /usr/bin/awk '/Created new APFS Volume/ {print $5}'
}
volume_uuid_from_special() {
@@ -738,10 +766,12 @@ await_volume() {
setup_volume() {
local use_special use_uuid profile_packages
task "Creating a Nix volume" >&2
- # DOING: I'm tempted to wrap this call in a grep to get the new disk special without doing anything too complex, but this sudo wrapper *is* a little complex, so it'll be a PITA unless maybe we can skip sudo on this. Let's just try it without.
use_special="${NIX_VOLUME_USE_SPECIAL:-$(create_volume)}"
+ _sudo "to ensure the Nix volume is not mounted" \
+ /usr/sbin/diskutil unmount force "$use_special" || true # might not be mounted
+
use_uuid=${NIX_VOLUME_USE_UUID:-$(volume_uuid_from_special "$use_special")}
setup_fstab "$use_uuid"
@@ -759,6 +789,11 @@ setup_volume() {
await_volume
+ if [ "$(/usr/sbin/diskutil info -plist "$NIX_ROOT" | xmllint --xpath "(/plist/dict/key[text()='GlobalPermissionsEnabled'])/following-sibling::*[1]" -)" = "<false/>" ]; then
+ _sudo "to set enableOwnership (enabling users to own files)" \
+ /usr/sbin/diskutil enableOwnership "$NIX_ROOT"
+ fi
+
# TODO: below is a vague kludge for now; I just don't know
# what if any safe action there is to take here. Also, the
# reminder isn't very helpful.
@@ -786,7 +821,8 @@ setup_volume_daemon() {
local volume_uuid="$2"
if ! test_voldaemon; then
task "Configuring LaunchDaemon to mount '$NIX_VOLUME_LABEL'" >&2
- _sudo "to install the Nix volume mounter" /usr/bin/ex "$NIX_VOLUME_MOUNTD_DEST" <<EOF
+ # See earlier note; `-u NONE` disables vim plugins/rc, `-n` skips swapfile
+ _sudo "to install the Nix volume mounter" /usr/bin/ex -u NONE -n "$NIX_VOLUME_MOUNTD_DEST" <<EOF
:a
$(generate_mount_daemon "$cmd_type" "$volume_uuid")
.
diff --git a/scripts/install-darwin-multi-user.sh b/scripts/install-darwin-multi-user.sh
index f8d6c5e8f..5111a5dde 100644
--- a/scripts/install-darwin-multi-user.sh
+++ b/scripts/install-darwin-multi-user.sh
@@ -13,11 +13,22 @@ NIX_BUILD_USER_NAME_TEMPLATE="_nixbld%d"
read_only_root() {
# this touch command ~should~ always produce an error
# as of this change I confirmed /usr/bin/touch emits:
+ # "touch: /: Operation not permitted" Monterey
# "touch: /: Read-only file system" Catalina+ and Big Sur
# "touch: /: Permission denied" Mojave
# (not matching prefix for compat w/ coreutils touch in case using
# an explicit path causes problems; its prefix differs)
- [[ "$(/usr/bin/touch / 2>&1)" = *"Read-only file system" ]]
+ case "$(/usr/bin/touch / 2>&1)" in
+ *"Read-only file system") # Catalina, Big Sur
+ return 0
+ ;;
+ *"Operation not permitted") # Monterey
+ return 0
+ ;;
+ *)
+ return 1
+ ;;
+ esac
# Avoiding the slow semantic way to get this information (~330ms vs ~8ms)
# unless using touch causes problems. Just in case, that approach is:
@@ -67,7 +78,7 @@ poly_service_installed_check() {
poly_service_uninstall_directions() {
echo "$1. Remove macOS-specific components:"
if should_create_volume && test_nix_volume_mountd_installed; then
- darwin_volume_uninstall_directions
+ nix_volume_mountd_uninstall_directions
fi
if test_nix_daemon_installed; then
nix_daemon_uninstall_directions
@@ -156,7 +167,7 @@ poly_user_shell_get() {
}
poly_user_shell_set() {
- _sudo "in order to give $1 a safe home directory" \
+ _sudo "in order to give $1 a safe shell" \
/usr/bin/dscl . -create "/Users/$1" "UserShell" "$2"
}
@@ -206,4 +217,8 @@ poly_prepare_to_install() {
EOF
setup_darwin_volume
fi
+
+ if [ "$(/usr/sbin/diskutil info -plist /nix | xmllint --xpath "(/plist/dict/key[text()='GlobalPermissionsEnabled'])/following-sibling::*[1]" -)" = "<false/>" ]; then
+ failure "This script needs a /nix volume with global permissions! This may require running sudo /usr/sbin/diskutil enableOwnership /nix."
+ fi
}
diff --git a/scripts/install-multi-user.sh b/scripts/install-multi-user.sh
index b06847ffe..9a990275c 100644
--- a/scripts/install-multi-user.sh
+++ b/scripts/install-multi-user.sh
@@ -23,17 +23,17 @@ readonly RED='\033[31m'
# installer allows overriding build user count to speed up installation
# as creating each user takes non-trivial amount of time on macos
readonly NIX_USER_COUNT=${NIX_USER_COUNT:-32}
-readonly NIX_BUILD_GROUP_ID="30000"
+readonly NIX_BUILD_GROUP_ID="${NIX_BUILD_GROUP_ID:-30000}"
readonly NIX_BUILD_GROUP_NAME="nixbld"
# darwin installer needs to override these
-NIX_FIRST_BUILD_UID="30001"
+NIX_FIRST_BUILD_UID="${NIX_FIRST_BUILD_UID:-30001}"
NIX_BUILD_USER_NAME_TEMPLATE="nixbld%d"
# Please don't change this. We don't support it, because the
# default shell profile that comes with Nix doesn't support it.
readonly NIX_ROOT="/nix"
readonly NIX_EXTRA_CONF=${NIX_EXTRA_CONF:-}
-readonly PROFILE_TARGETS=("/etc/bashrc" "/etc/profile.d/nix.sh" "/etc/zshenv" "/etc/bash.bashrc" "/etc/zsh/zshenv")
+readonly PROFILE_TARGETS=("/etc/bashrc" "/etc/profile.d/nix.sh" "/etc/zshrc" "/etc/bash.bashrc" "/etc/zsh/zshrc")
readonly PROFILE_BACKUP_SUFFIX=".backup-before-nix"
readonly PROFILE_NIX_FILE="$NIX_ROOT/var/nix/profiles/default/etc/profile.d/nix-daemon.sh"
@@ -59,6 +59,30 @@ headless() {
fi
}
+is_root() {
+ if [ "$EUID" -eq 0 ]; then
+ return 0
+ else
+ return 1
+ fi
+}
+
+is_os_linux() {
+ if [ "$(uname -s)" = "Linux" ]; then
+ return 0
+ else
+ return 1
+ fi
+}
+
+is_os_darwin() {
+ if [ "$(uname -s)" = "Darwin" ]; then
+ return 0
+ else
+ return 1
+ fi
+}
+
contact_us() {
echo "You can open an issue at https://github.com/nixos/nix/issues"
echo ""
@@ -313,14 +337,23 @@ __sudo() {
_sudo() {
local expl="$1"
shift
- if ! headless; then
+ if ! headless || is_root; then
__sudo "$expl" "$*" >&2
fi
- sudo "$@"
+
+ if is_root; then
+ env "$@"
+ else
+ sudo "$@"
+ fi
}
+# Ensure that $TMPDIR exists if defined.
+if [[ -n "${TMPDIR:-}" ]] && [[ ! -d "${TMPDIR:-}" ]]; then
+ mkdir -m 0700 -p "${TMPDIR:-}"
+fi
-readonly SCRATCH=$(mktemp -d "${TMPDIR:-/tmp/}tmp.XXXXXXXXXX")
+readonly SCRATCH=$(mktemp -d)
finish_cleanup() {
rm -rf "$SCRATCH"
}
@@ -377,6 +410,11 @@ cure_artifacts() {
}
validate_starting_assumptions() {
+ task "Checking for artifacts of previous installs"
+ cat <<EOF
+Before I try to install, I'll check for signs Nix already is or has
+been installed on this system.
+EOF
if type nix-env 2> /dev/null >&2; then
warning <<EOF
Nix already appears to be installed. This installer may run into issues.
@@ -386,24 +424,50 @@ $(uninstall_directions)
EOF
fi
+ # TODO: I think it would be good for this step to accumulate more
+ # knowledge of older obsolete artifacts, if there are any.
+ # We could issue a "reminder" here that the user might want
+ # to clean them up?
+
for profile_target in "${PROFILE_TARGETS[@]}"; do
+ # TODO: I think it would be good to accumulate a list of all
+ # of the copies so that people don't hit this 2 or 3x in
+ # a row for different files.
if [ -e "$profile_target$PROFILE_BACKUP_SUFFIX" ]; then
+ # this backup process first released in Nix 2.1
failure <<EOF
-When this script runs, it backs up the current $profile_target to
-$profile_target$PROFILE_BACKUP_SUFFIX. This backup file already exists, though.
+I back up shell profile/rc scripts before I add Nix to them.
+I need to back up $profile_target to $profile_target$PROFILE_BACKUP_SUFFIX,
+but the latter already exists.
+
+Here's how to clean up the old backup file:
-Please follow these instructions to clean up the old backup file:
+1. Back up (copy) $profile_target and $profile_target$PROFILE_BACKUP_SUFFIX
+ to another location, just in case.
-1. Copy $profile_target and $profile_target$PROFILE_BACKUP_SUFFIX to another place, just
-in case.
+2. Ensure $profile_target$PROFILE_BACKUP_SUFFIX does not have anything
+ Nix-related in it. If it does, something is probably quite
+ wrong. Please open an issue or get in touch immediately.
-2. Take care to make sure that $profile_target$PROFILE_BACKUP_SUFFIX doesn't look like
-it has anything nix-related in it. If it does, something is probably
-quite wrong. Please open an issue or get in touch immediately.
+3. Once you confirm $profile_target is backed up and
+ $profile_target$PROFILE_BACKUP_SUFFIX doesn't mention Nix, run:
+ mv $profile_target$PROFILE_BACKUP_SUFFIX $profile_target
EOF
fi
done
+ if is_os_linux && [ ! -e /run/systemd/system ]; then
+ warning <<EOF
+We did not detect systemd on your system. With a multi-user install
+without systemd you will have to manually configure your init system to
+launch the Nix daemon after installation.
+EOF
+ if ! ui_confirm "Do you want to proceed with a multi-user installation?"; then
+ failure <<EOF
+You have aborted the installation.
+EOF
+ fi
+ fi
}
setup_report() {
@@ -557,21 +621,40 @@ create_directories() {
# since this bit is cross-platform:
# - first try with `command -vp` to try and find
# chown in the usual places
+ # * to work around some sort of deficiency in
+ # `command -p` in macOS bash 3.2, we also add
+ # PATH="$(getconf PATH 2>/dev/null)". As long as
+ # getconf is found, this should set a sane PATH
+ # which `command -p` in bash 3.2 appears to use.
+ # A bash with a properly-working `command -p`
+ # should ignore this hard-set PATH in favor of
+ # whatever it obtains internally. See
+ # github.com/NixOS/nix/issues/5768
# - fall back on `command -v` which would find
# any chown on path
# if we don't find one, the command is already
# hiding behind || true, and the general state
# should be one the user can repair once they
# figure out where chown is...
- local get_chr_own="$(command -vp chown)"
+ local get_chr_own="$(PATH="$(getconf PATH 2>/dev/null)" command -vp chown)"
if [[ -z "$get_chr_own" ]]; then
get_chr_own="$(command -v chown)"
fi
- _sudo "to take root ownership of existing Nix store files" \
- "$get_chr_own" -R "root:$NIX_BUILD_GROUP_NAME" "$NIX_ROOT" || true
+
+ if [[ -z "$get_chr_own" ]]; then
+ reminder <<EOF
+I wanted to take root ownership of existing Nix store files,
+but I couldn't locate 'chown'. (You may need to fix your PATH.)
+To manually change file ownership, you can run:
+ sudo chown -R 'root:$NIX_BUILD_GROUP_NAME' '$NIX_ROOT'
+EOF
+ else
+ _sudo "to take root ownership of existing Nix store files" \
+ "$get_chr_own" -R "root:$NIX_BUILD_GROUP_NAME" "$NIX_ROOT" || true
+ fi
fi
_sudo "to make the basic directory structure of Nix (part 1)" \
- install -dv -m 0755 /nix /nix/var /nix/var/log /nix/var/log/nix /nix/var/log/nix/drvs /nix/var/nix{,/db,/gcroots,/profiles,/temproots,/userpool} /nix/var/nix/{gcroots,profiles}/per-user
+ install -dv -m 0755 /nix /nix/var /nix/var/log /nix/var/log/nix /nix/var/log/nix/drvs /nix/var/nix{,/db,/gcroots,/profiles,/temproots,/userpool,/daemon-socket} /nix/var/nix/{gcroots,profiles}/per-user
_sudo "to make the basic directory structure of Nix (part 2)" \
install -dv -g "$NIX_BUILD_GROUP_NAME" -m 1775 /nix/store
@@ -588,6 +671,17 @@ place_channel_configuration() {
fi
}
+check_selinux() {
+ if command -v getenforce > /dev/null 2>&1; then
+ if [ "$(getenforce)" = "Enforcing" ]; then
+ failure <<EOF
+Nix does not work with selinux enabled yet!
+see https://github.com/NixOS/nix/issues/2374
+EOF
+ fi
+ fi
+}
+
welcome_to_nix() {
ok "Welcome to the Multi-User Nix Installation"
@@ -599,7 +693,7 @@ manager. This will happen in a few stages:
1. Make sure your computer doesn't already have Nix. If it does, I
will show you instructions on how to clean up your old install.
-2. Show you what we are going to install and where. Then we will ask
+2. Show you what I am going to install and where. Then I will ask
if you are ready to continue.
3. Create the system users and groups that the Nix daemon uses to run
@@ -614,14 +708,14 @@ manager. This will happen in a few stages:
EOF
- if ui_confirm "Would you like to see a more detailed list of what we will do?"; then
+ if ui_confirm "Would you like to see a more detailed list of what I will do?"; then
cat <<EOF
-We will:
+I will:
- make sure your computer doesn't already have Nix files
(if it does, I will tell you how to clean them up.)
- - create local users (see the list above for the users we'll make)
+ - create local users (see the list above for the users I'll make)
- create a local group ($NIX_BUILD_GROUP_NAME)
- install Nix in to $NIX_ROOT
- create a configuration file in /etc/nix
@@ -656,7 +750,7 @@ run in a headless fashion, like this:
$ curl -L https://nixos.org/nix/install | sh
-or maybe in a CI pipeline. Because of that, we're going to skip the
+or maybe in a CI pipeline. Because of that, I'm going to skip the
verbose output in the interest of brevity.
If you would like to
@@ -670,7 +764,7 @@ EOF
fi
cat <<EOF
-This script is going to call sudo a lot. Every time we do, it'll
+This script is going to call sudo a lot. Every time I do, it'll
output exactly what it'll do, and why.
Just like this:
@@ -682,15 +776,15 @@ EOF
cat <<EOF
This might look scary, but everything can be undone by running just a
-few commands. We used to ask you to confirm each time sudo ran, but it
+few commands. I used to ask you to confirm each time sudo ran, but it
was too many times. Instead, I'll just ask you this one time:
EOF
- if ui_confirm "Can we use sudo?"; then
+ if ui_confirm "Can I use sudo?"; then
ok "Yay! Thanks! Let's get going!"
else
failure <<EOF
-That is okay, but we can't install.
+That is okay, but I can't install.
EOF
fi
}
@@ -701,7 +795,10 @@ install_from_extracted_nix() {
cd "$EXTRACTED_NIX_PATH"
_sudo "to copy the basic Nix files to the new store at $NIX_ROOT/store" \
- rsync -rlpt --chmod=-w ./store/* "$NIX_ROOT/store/"
+ cp -RPp ./store/* "$NIX_ROOT/store/"
+
+ _sudo "to make the new store non-writable at $NIX_ROOT/store" \
+ chmod -R ugo-w "$NIX_ROOT/store/"
if [ -d "$NIX_INSTALLED_NIX" ]; then
echo " Alright! We have our first nix at $NIX_INSTALLED_NIX"
@@ -713,7 +810,7 @@ EOF
fi
_sudo "to load data for the first time in to the Nix Database" \
- "$NIX_INSTALLED_NIX/bin/nix-store" --load-db < ./.reginfo
+ HOME="$ROOT_HOME" "$NIX_INSTALLED_NIX/bin/nix-store" --load-db < ./.reginfo
echo " Just finished getting the nix database ready."
)
@@ -801,22 +898,14 @@ EOF
install -m 0664 "$SCRATCH/nix.conf" /etc/nix/nix.conf
}
+
main() {
- # TODO: I've moved this out of validate_starting_assumptions so we
- # can fail faster in this case. Sourcing install-darwin... now runs
- # `touch /` to detect Read-only root, but it could update times on
- # pre-Catalina macOS if run as root user.
- if [ $EUID -eq 0 ]; then
- failure <<EOF
-Please do not run this script with root privileges. We will call sudo
-when we need to.
-EOF
- fi
+ check_selinux
- if [ "$(uname -s)" = "Darwin" ]; then
+ if is_os_darwin; then
# shellcheck source=./install-darwin-multi-user.sh
. "$EXTRACTED_NIX_PATH/install-darwin-multi-user.sh"
- elif [ "$(uname -s)" = "Linux" ]; then
+ elif is_os_linux; then
# shellcheck source=./install-systemd-multi-user.sh
. "$EXTRACTED_NIX_PATH/install-systemd-multi-user.sh" # most of this works on non-systemd distros also
else
@@ -824,7 +913,10 @@ EOF
fi
welcome_to_nix
- chat_about_sudo
+
+ if ! is_root; then
+ chat_about_sudo
+ fi
cure_artifacts
# TODO: there's a tension between cure and validate. I moved the
diff --git a/scripts/install-nix-from-closure.sh b/scripts/install-nix-from-closure.sh
index 734f0c800..cd3cf6670 100644
--- a/scripts/install-nix-from-closure.sh
+++ b/scripts/install-nix-from-closure.sh
@@ -38,7 +38,7 @@ fi
# Determine if we could use the multi-user installer or not
if [ "$(uname -s)" = "Linux" ]; then
- echo "Note: a multi-user installation is possible. See https://nixos.org/nix/manual/#sect-multi-user-installation" >&2
+ echo "Note: a multi-user installation is possible. See https://nixos.org/manual/nix/stable/installation/installing-binary.html#multi-user-installation" >&2
fi
case "$(uname -s)" in
@@ -98,7 +98,7 @@ while [ $# -gt 0 ]; do
echo " providing multi-user support and better isolation for local builds."
echo " Both for security and reproducibility, this method is recommended if"
echo " supported on your platform."
- echo " See https://nixos.org/nix/manual/#sect-multi-user-installation"
+ echo " See https://nixos.org/manual/nix/stable/installation/installing-binary.html#multi-user-installation"
echo ""
echo " --no-daemon: Simple, single-user installation that does not require root and is"
echo " trivial to uninstall."
@@ -106,12 +106,11 @@ while [ $# -gt 0 ]; do
echo ""
echo " --no-channel-add: Don't add any channels. nixpkgs-unstable is installed by default."
echo ""
- echo " --no-modify-profile: Skip channel installation. When not provided nixpkgs-unstable"
- echo " is installed by default."
+ echo " --no-modify-profile: Don't modify the user profile to automatically load nix."
echo ""
echo " --daemon-user-count: Number of build users to create. Defaults to 32."
echo ""
- echo " --nix-extra-conf-file: Path to nix.conf to prepend when installing /etc/nix.conf"
+ echo " --nix-extra-conf-file: Path to nix.conf to prepend when installing /etc/nix/nix.conf"
echo ""
if [ -n "${INVOKED_FROM_INSTALL_IN:-}" ]; then
echo " --tarball-url-prefix URL: Base URL to download the Nix tarball from."
@@ -135,7 +134,7 @@ fi
echo "performing a single-user installation of Nix..." >&2
-if ! [ -e $dest ]; then
+if ! [ -e "$dest" ]; then
cmd="mkdir -m 0755 $dest && chown $USER $dest"
echo "directory $dest does not exist; creating it by running '$cmd' using sudo" >&2
if ! sudo sh -c "$cmd"; then
@@ -144,12 +143,14 @@ if ! [ -e $dest ]; then
fi
fi
-if ! [ -w $dest ]; then
- echo "$0: directory $dest exists, but is not writable by you. This could indicate that another user has already performed a single-user installation of Nix on this system. If you wish to enable multi-user support see https://nixos.org/nix/manual/#ssec-multi-user. If you wish to continue with a single-user install for $USER please run 'chown -R $USER $dest' as root." >&2
+if ! [ -w "$dest" ]; then
+ echo "$0: directory $dest exists, but is not writable by you. This could indicate that another user has already performed a single-user installation of Nix on this system. If you wish to enable multi-user support see https://nixos.org/manual/nix/stable/installation/multi-user.html. If you wish to continue with a single-user install for $USER please run 'chown -R $USER $dest' as root." >&2
exit 1
fi
-mkdir -p $dest/store
+# The auto-chroot code in openFromNonUri() checks for the
+# non-existence of /nix/var/nix, so we need to create it here.
+mkdir -p "$dest/store" "$dest/var/nix"
printf "copying Nix to %s..." "${dest}/store" >&2
# Insert a newline if no progress is shown.
@@ -190,17 +191,17 @@ fi
# Install an SSL certificate bundle.
if [ -z "$NIX_SSL_CERT_FILE" ] || ! [ -f "$NIX_SSL_CERT_FILE" ]; then
- $nix/bin/nix-env -i "$cacert"
+ "$nix/bin/nix-env" -i "$cacert"
export NIX_SSL_CERT_FILE="$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt"
fi
# Subscribe the user to the Nixpkgs channel and fetch it.
if [ -z "$NIX_INSTALLER_NO_CHANNEL_ADD" ]; then
- if ! $nix/bin/nix-channel --list | grep -q "^nixpkgs "; then
- $nix/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable
+ if ! "$nix/bin/nix-channel" --list | grep -q "^nixpkgs "; then
+ "$nix/bin/nix-channel" --add https://nixos.org/channels/nixpkgs-unstable
fi
if [ -z "$_NIX_INSTALLER_TEST" ]; then
- if ! $nix/bin/nix-channel --update nixpkgs; then
+ if ! "$nix/bin/nix-channel" --update nixpkgs; then
echo "Fetching the nixpkgs channel failed. (Are you offline?)"
echo "To try again later, run \"nix-channel --update nixpkgs\"."
fi
@@ -216,7 +217,7 @@ if [ -z "$NIX_INSTALLER_NO_MODIFY_PROFILE" ]; then
if [ -w "$fn" ]; then
if ! grep -q "$p" "$fn"; then
echo "modifying $fn..." >&2
- echo -e "\nif [ -e $p ]; then . $p; fi # added by Nix installer" >> "$fn"
+ printf '\nif [ -e %s ]; then . %s; fi # added by Nix installer\n' "$p" "$p" >> "$fn"
fi
added=1
break
@@ -227,7 +228,7 @@ if [ -z "$NIX_INSTALLER_NO_MODIFY_PROFILE" ]; then
if [ -w "$fn" ]; then
if ! grep -q "$p" "$fn"; then
echo "modifying $fn..." >&2
- echo -e "\nif [ -e $p ]; then . $p; fi # added by Nix installer" >> "$fn"
+ printf '\nif [ -e %s ]; then . %s; fi # added by Nix installer\n' "$p" "$p" >> "$fn"
fi
added=1
break
diff --git a/scripts/install-systemd-multi-user.sh b/scripts/install-systemd-multi-user.sh
index 81c61b2a0..62397127a 100755
--- a/scripts/install-systemd-multi-user.sh
+++ b/scripts/install-systemd-multi-user.sh
@@ -9,13 +9,15 @@ readonly SERVICE_DEST=/etc/systemd/system/nix-daemon.service
readonly SOCKET_SRC=/lib/systemd/system/nix-daemon.socket
readonly SOCKET_DEST=/etc/systemd/system/nix-daemon.socket
+readonly TMPFILES_SRC=/lib/tmpfiles.d/nix-daemon.conf
+readonly TMPFILES_DEST=/etc/tmpfiles.d/nix-daemon.conf
# Path for the systemd override unit file to contain the proxy settings
readonly SERVICE_OVERRIDE=${SERVICE_DEST}.d/override.conf
create_systemd_override() {
header "Configuring proxy for the nix-daemon service"
- _sudo "create directory for systemd unit override" mkdir -p "$(dirname $SERVICE_OVERRIDE)"
+ _sudo "create directory for systemd unit override" mkdir -p "$(dirname "$SERVICE_OVERRIDE")"
cat <<EOF | _sudo "create systemd unit override" tee "$SERVICE_OVERRIDE"
[Service]
$1
@@ -83,6 +85,13 @@ EOF
poly_configure_nix_daemon_service() {
if [ -e /run/systemd/system ]; then
task "Setting up the nix-daemon systemd service"
+
+ _sudo "to create the nix-daemon tmpfiles config" \
+ ln -sfn /nix/var/nix/profiles/default/$TMPFILES_SRC $TMPFILES_DEST
+
+ _sudo "to run systemd-tmpfiles once to pick that path up" \
+ systemd-tmpfiles --create --prefix=/nix/var/nix
+
_sudo "to set up the nix-daemon service" \
systemctl link "/nix/var/nix/profiles/default$SERVICE_SRC"
diff --git a/scripts/install.in b/scripts/install.in
index 39016d161..af5f71080 100755
--- a/scripts/install.in
+++ b/scripts/install.in
@@ -40,13 +40,23 @@ case "$(uname -s).$(uname -m)" in
path=@tarballPath_aarch64-linux@
system=aarch64-linux
;;
+ Linux.armv6l_linux)
+ hash=@tarballHash_armv6l-linux@
+ path=@tarballPath_armv6l-linux@
+ system=armv6l-linux
+ ;;
+ Linux.armv7l_linux)
+ hash=@tarballHash_armv7l-linux@
+ path=@tarballPath_armv7l-linux@
+ system=armv7l-linux
+ ;;
Darwin.x86_64)
hash=@tarballHash_x86_64-darwin@
path=@tarballPath_x86_64-darwin@
system=x86_64-darwin
;;
Darwin.arm64|Darwin.aarch64)
- hash=@binaryTarball_aarch64-darwin@
+ hash=@tarballHash_aarch64-darwin@
path=@tarballPath_aarch64-darwin@
system=aarch64-darwin
;;
@@ -66,14 +76,21 @@ fi
tarball=$tmpDir/nix-@nixVersion@-$system.tar.xz
-require_util curl "download the binary tarball"
require_util tar "unpack the binary tarball"
if [ "$(uname -s)" != "Darwin" ]; then
require_util xz "unpack the binary tarball"
fi
+if command -v curl > /dev/null 2>&1; then
+ fetch() { curl --fail -L "$1" -o "$2"; }
+elif command -v wget > /dev/null 2>&1; then
+ fetch() { wget "$1" -O "$2"; }
+else
+ oops "you don't have wget or curl installed, which I need to download the binary tarball"
+fi
+
echo "downloading Nix @nixVersion@ binary tarball for $system from '$url' to '$tmpDir'..."
-curl -L "$url" -o "$tarball" || oops "failed to download '$url'"
+fetch "$url" "$tarball" || oops "failed to download '$url'"
if command -v sha256sum > /dev/null 2>&1; then
hash2="$(sha256sum -b "$tarball" | cut -c1-64)"
diff --git a/scripts/local.mk b/scripts/local.mk
index 2a0055852..b8477178e 100644
--- a/scripts/local.mk
+++ b/scripts/local.mk
@@ -1,7 +1,5 @@
nix_noinst_scripts := \
- $(d)/nix-http-export.cgi \
- $(d)/nix-profile.sh \
- $(d)/nix-reduce-build
+ $(d)/nix-profile.sh
noinst-scripts += $(nix_noinst_scripts)
diff --git a/scripts/nix-http-export.cgi.in b/scripts/nix-http-export.cgi.in
deleted file mode 100755
index 19a505af1..000000000
--- a/scripts/nix-http-export.cgi.in
+++ /dev/null
@@ -1,51 +0,0 @@
-#! /bin/sh
-
-export HOME=/tmp
-export NIX_REMOTE=daemon
-
-TMP_DIR="${TMP_DIR:-/tmp/nix-export}"
-
-@coreutils@/mkdir -p "$TMP_DIR" || true
-@coreutils@/chmod a+r "$TMP_DIR"
-
-needed_path="?$QUERY_STRING"
-needed_path="${needed_path#*[?&]needed_path=}"
-needed_path="${needed_path%%&*}"
-#needed_path="$(echo $needed_path | ./unhttp)"
-needed_path="${needed_path//%2B/+}"
-needed_path="${needed_path//%3D/=}"
-
-echo needed_path: "$needed_path" >&2
-
-NIX_STORE="${NIX_STORE_DIR:-/nix/store}"
-
-echo NIX_STORE: "${NIX_STORE}" >&2
-
-full_path="${NIX_STORE}"/"$needed_path"
-
-if [ "$needed_path" != "${needed_path%.drv}" ]; then
- echo "Status: 403 You should create the derivation file yourself"
- echo "Content-Type: text/plain"
- echo
- echo "Refusing to disclose derivation contents"
- exit
-fi
-
-if @bindir@/nix-store --check-validity "$full_path"; then
- if ! [ -e nix-export/"$needed_path".nar.gz ]; then
- @bindir@/nix-store --export "$full_path" | @gzip@ > "$TMP_DIR"/"$needed_path".nar.gz
- @coreutils@/ln -fs "$TMP_DIR"/"$needed_path".nar.gz nix-export/"$needed_path".nar.gz
- fi;
- echo "Status: 301 Moved"
- echo "Location: nix-export/"$needed_path".nar.gz"
- echo
-else
- echo "Status: 404 No such path found"
- echo "Content-Type: text/plain"
- echo
- echo "Path not found:"
- echo "$needed_path"
- echo "checked:"
- echo "$full_path"
-fi
-
diff --git a/scripts/nix-profile-daemon.sh.in b/scripts/nix-profile-daemon.sh.in
index 500a98992..0a47571ac 100644
--- a/scripts/nix-profile-daemon.sh.in
+++ b/scripts/nix-profile-daemon.sh.in
@@ -5,7 +5,7 @@ __ETC_PROFILE_NIX_SOURCED=1
export NIX_PROFILES="@localstatedir@/nix/profiles/default $HOME/.nix-profile"
# Set $NIX_SSL_CERT_FILE so that Nixpkgs applications like curl work.
-if [ ! -z "${NIX_SSL_CERT_FILE:-}" ]; then
+if [ -n "${NIX_SSL_CERT_FILE:-}" ]; then
: # Allow users to override the NIX_SSL_CERT_FILE
elif [ -e /etc/ssl/certs/ca-certificates.crt ]; then # NixOS, Ubuntu, Debian, Gentoo, Arch
export NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
@@ -18,14 +18,14 @@ elif [ -e /etc/pki/tls/certs/ca-bundle.crt ]; then # Fedora, CentOS
else
# Fall back to what is in the nix profiles, favouring whatever is defined last.
check_nix_profiles() {
- if [ "$ZSH_VERSION" ]; then
+ if [ -n "$ZSH_VERSION" ]; then
# Zsh by default doesn't split words in unquoted parameter expansion.
# Set local_options for these options to be reverted at the end of the function
# and shwordsplit to force splitting words in $NIX_PROFILES below.
setopt local_options shwordsplit
fi
for i in $NIX_PROFILES; do
- if [ -e $i/etc/ssl/certs/ca-bundle.crt ]; then
+ if [ -e "$i/etc/ssl/certs/ca-bundle.crt" ]; then
export NIX_SSL_CERT_FILE=$i/etc/ssl/certs/ca-bundle.crt
fi
done
diff --git a/scripts/nix-profile.sh.in b/scripts/nix-profile.sh.in
index 8cba1c522..45cbcbe74 100644
--- a/scripts/nix-profile.sh.in
+++ b/scripts/nix-profile.sh.in
@@ -24,6 +24,9 @@ if [ -n "$HOME" ] && [ -n "$USER" ]; then
export NIX_SSL_CERT_FILE="$NIX_LINK/etc/ca-bundle.crt"
fi
+ # Only use MANPATH if it is already set. In general `man` will just simply
+ # pick up `.nix-profile/share/man` because is it close to `.nix-profile/bin`
+ # which is in the $PATH. For more info, run `manpath -d`.
if [ -n "${MANPATH-}" ]; then
export MANPATH="$NIX_LINK/share/man:$MANPATH"
fi
diff --git a/scripts/nix-reduce-build.in b/scripts/nix-reduce-build.in
deleted file mode 100755
index 50beb9d10..000000000
--- a/scripts/nix-reduce-build.in
+++ /dev/null
@@ -1,171 +0,0 @@
-#! @bash@
-
-WORKING_DIRECTORY=$(mktemp -d "${TMPDIR:-/tmp}"/nix-reduce-build-XXXXXX);
-cd "$WORKING_DIRECTORY";
-
-if test -z "$1" || test "a--help" = "a$1" ; then
- echo 'nix-reduce-build (paths or Nix expressions) -- (package sources)' >&2
- echo As in: >&2
- echo nix-reduce-build /etc/nixos/nixos -- ssh://user@somewhere.nowhere.example.org >&2
- echo nix-reduce-build /etc/nixos/nixos -- \\
- echo " " \''http://somewhere.nowhere.example.org/nix/nix-http-export.cgi?needed_path='\' >&2
- echo " store path name will be added into the end of the URL" >&2
- echo nix-reduce-build /etc/nixos/nixos -- file://home/user/nar/ >&2
- echo " that should be a directory where gzipped 'nix-store --export' ">&2
- echo " files are located (they should have .nar.gz extension)" >&2
- echo " Or all together: " >&2
- echo -e nix-reduce-build /expr.nix /e2.nix -- \\\\\\\n\
- " ssh://a@b.example.com http://n.example.com/get-nar?q= file://nar/" >&2
- echo " Also supports best-effort local builds of failing expression set:" >&2
- echo "nix-reduce-build /e.nix -- nix-daemon:// nix-self://" >&2
- echo " nix-daemon:// builds using daemon"
- echo " nix-self:// builds directly using nix-store from current installation" >&2
- echo " nix-daemon-fixed:// and nix-self-fixed:// do the same, but only for" >&2;
- echo "derivations with specified output hash (sha256, sha1 or md5)." >&2
- echo " nix-daemon-substitute:// and nix-self-substitute:// try to substitute" >&2;
- echo "maximum amount of paths" >&2;
- echo " nix-daemon-build:// and nix-self-build:// try to build (not substitute)" >&2;
- echo "maximum amount of paths" >&2;
- echo " If no package sources are specified, required paths are listed." >&2;
- exit;
-fi;
-
-while ! test "$1" = "--" || test "$1" = "" ; do
- echo "$1" >> initial; >&2
- shift;
-done
-shift;
-echo Will work on $(cat initial | wc -l) targets. >&2
-
-while read ; do
- case "$REPLY" in
- ${NIX_STORE_DIR:-/nix/store}/*)
- echo "$REPLY" >> paths; >&2
- ;;
- *)
- (
- IFS=: ;
- nix-instantiate $REPLY >> paths;
- );
- ;;
- esac;
-done < initial;
-echo Proceeding $(cat paths | wc -l) paths. >&2
-
-while read; do
- case "$REPLY" in
- *.drv)
- echo "$REPLY" >> derivers; >&2
- ;;
- *)
- nix-store --query --deriver "$REPLY" >>derivers;
- ;;
- esac;
-done < paths;
-echo Found $(cat derivers | wc -l) derivers. >&2
-
-cat derivers | xargs nix-store --query -R > derivers-closure;
-echo Proceeding at most $(cat derivers-closure | wc -l) derivers. >&2
-
-cat derivers-closure | egrep '[.]drv$' | xargs nix-store --query --outputs > wanted-paths;
-cat derivers-closure | egrep -v '[.]drv$' >> wanted-paths;
-echo Prepared $(cat wanted-paths | wc -l) paths to get. >&2
-
-cat wanted-paths | xargs nix-store --check-validity --print-invalid > needed-paths;
-echo We need $(cat needed-paths | wc -l) paths. >&2
-
-egrep '[.]drv$' derivers-closure > critical-derivers;
-
-if test -z "$1" ; then
- cat needed-paths;
-fi;
-
-refresh_critical_derivers() {
- echo "Finding needed derivers..." >&2;
- cat critical-derivers | while read; do
- if ! (nix-store --query --outputs "$REPLY" | xargs nix-store --check-validity &> /dev/null;); then
- echo "$REPLY";
- fi;
- done > new-critical-derivers;
- mv new-critical-derivers critical-derivers;
- echo The needed paths are realized by $(cat critical-derivers | wc -l) derivers. >&2
-}
-
-build_here() {
- cat critical-derivers | while read; do
- echo "Realising $REPLY using nix-daemon" >&2
- @bindir@/nix-store -r "${REPLY}"
- done;
-}
-
-try_to_substitute(){
- cat needed-paths | while read ; do
- echo "Building $REPLY using nix-daemon" >&2
- @bindir@/nix-store -r "${NIX_STORE_DIR:-/nix/store}/${REPLY##*/}"
- done;
-}
-
-for i in "$@"; do
- sshHost="${i#ssh://}";
- httpHost="${i#http://}";
- httpsHost="${i#https://}";
- filePath="${i#file:/}";
- if [ "$i" != "$sshHost" ]; then
- cat needed-paths | while read; do
- echo "Getting $REPLY and its closure over ssh" >&2
- nix-copy-closure --from "$sshHost" --gzip "$REPLY" </dev/null || true;
- done;
- elif [ "$i" != "$httpHost" ] || [ "$i" != "$httpsHost" ]; then
- cat needed-paths | while read; do
- echo "Getting $REPLY over http/https" >&2
- curl ${BAD_CERTIFICATE:+-k} -L "$i${REPLY##*/}" | gunzip | nix-store --import;
- done;
- elif [ "$i" != "$filePath" ] ; then
- cat needed-paths | while read; do
- echo "Installing $REPLY from file" >&2
- gunzip < "$filePath/${REPLY##*/}".nar.gz | nix-store --import;
- done;
- elif [ "$i" = "nix-daemon://" ] ; then
- NIX_REMOTE=daemon try_to_substitute;
- refresh_critical_derivers;
- NIX_REMOTE=daemon build_here;
- elif [ "$i" = "nix-self://" ] ; then
- NIX_REMOTE= try_to_substitute;
- refresh_critical_derivers;
- NIX_REMOTE= build_here;
- elif [ "$i" = "nix-daemon-fixed://" ] ; then
- refresh_critical_derivers;
-
- cat critical-derivers | while read; do
- if egrep '"(md5|sha1|sha256)"' "$REPLY" &>/dev/null; then
- echo "Realising $REPLY using nix-daemon" >&2
- NIX_REMOTE=daemon @bindir@/nix-store -r "${REPLY}"
- fi;
- done;
- elif [ "$i" = "nix-self-fixed://" ] ; then
- refresh_critical_derivers;
-
- cat critical-derivers | while read; do
- if egrep '"(md5|sha1|sha256)"' "$REPLY" &>/dev/null; then
- echo "Realising $REPLY using direct Nix build" >&2
- NIX_REMOTE= @bindir@/nix-store -r "${REPLY}"
- fi;
- done;
- elif [ "$i" = "nix-daemon-substitute://" ] ; then
- NIX_REMOTE=daemon try_to_substitute;
- elif [ "$i" = "nix-self-substitute://" ] ; then
- NIX_REMOTE= try_to_substitute;
- elif [ "$i" = "nix-daemon-build://" ] ; then
- refresh_critical_derivers;
- NIX_REMOTE=daemon build_here;
- elif [ "$i" = "nix-self-build://" ] ; then
- refresh_critical_derivers;
- NIX_REMOTE= build_here;
- fi;
- mv needed-paths wanted-paths;
- cat wanted-paths | xargs nix-store --check-validity --print-invalid > needed-paths;
- echo We still need $(cat needed-paths | wc -l) paths. >&2
-done;
-
-cd /
-rm -r "$WORKING_DIRECTORY"
diff --git a/scripts/prepare-installer-for-github-actions b/scripts/prepare-installer-for-github-actions
index 92d930384..4b994a753 100755
--- a/scripts/prepare-installer-for-github-actions
+++ b/scripts/prepare-installer-for-github-actions
@@ -3,7 +3,7 @@
set -e
script=$(nix-build -A outputs.hydraJobs.installerScriptForGHA --no-out-link)
-installerHash=$(echo $script | cut -b12-43 -)
+installerHash=$(echo "$script" | cut -b12-43 -)
installerURL=https://$CACHIX_NAME.cachix.org/serve/$installerHash/install
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 02:16:59 +0000