| Age | Commit message (Collapse) | Author |
|---|
|
|
|
It adds a new operation, cmdAddToStoreNar, that does the same thing as
the corresponding nix-daemon operation, i.e. call addToStore(). This
replaces cmdImportPaths, which has the major issue that it sends the
NAR first and the store path second, thus requiring us to store the
incoming NAR either in memory or on disk until we decide what to do
with it.
For example, this reduces the memory usage of
$ nix copy --to 'ssh://localhost?remote-store=/tmp/nix' /nix/store/95cwv4q54dc6giaqv6q6p4r02ia2km35-blender-2.79
from 267 MiB to 12 MiB.
Probably fixes #1988.
|
|
|
|
|
|
|
|
This is primarily useful for testing since it removes the need to have
SSH working.
|
|
This is primarily useful for testing, e.g.
$ nix copy --to 'ssh://localhost?remote-store=/tmp/nix' ...
|
|
2.1 release notes: Add note about s3-compatible stores
|
|
|
|
|
|
Fix symlink leak in restricted eval mode
|
|
Allows selectively adding environment variables to pure shells.
|
|
In EvalState::checkSourcePath, the path is checked against the list of
allowed paths first and later it's checked again *after* resolving
symlinks.
The resolving of the symlinks is done via canonPath, which also strips
out "../" and "./". However after the canonicalisation the error message
pointing out that the path is not allowed prints the symlink target in
the error message.
Even if we'd suppress the message, symlink targets could still be leaked
if the symlink target doesn't exist (in this case the error is thrown in
canonPath).
So instead, we now do canonPath() without symlink resolving first before
even checking against the list of allowed paths and then later do the
symlink resolving and checking the allowed paths again.
The first call to canonPath() should get rid of all the "../" and "./",
so in theory the only way to leak a symlink if the attacker is able to
put a symlink in one of the paths allowed by restricted evaluation mode.
For the latter I don't think this is part of the threat model, because
if the attacker can write to that path, the attack vector is even
larger.
Signed-off-by: aszlig <aszlig@nix.build>
|
|
Includes documentation and test.
|
|
Works for uploading and not downloading.
|
|
Removes unused variable from `nix-build/nix-shell`
|
|
This particular `shell` variable wasn't used, since a new one was
declared in the only side of the `if` branch that used a `shell`
variable.
It could realistically confuse developers thinking it could use `$SHELL`
under some situations.
|
|
|
|
|
|
Fedora 27 provides an incompatible version of Boost (1.64.0).
|
|
This fixes 'error 10 while decompressing xz file'.
https://hydra.nixos.org/build/78308551
|
|
In some Boost versions, coroutines don't propagate exceptions
properly, causing Nix to fail with the exception 'coroutine has
finished'.
|
|
|
|
https://hydra.nixos.org/build/73991153
|
|
copyPathsToStore: honour keep-going
|
|
|
|
parser.y: fix assoc of -> and < > <= >=
|
|
|
|
prim_foldlStrict: call forceValue() before value is copied
|
|
The parser allowed senseless `a > b > c` but disallowed `a -> b -> c` which seems valid
It might be a typo
|
|
forceValue() were called after a value is copied effectively forcing only one of the copies keeping another copy not evaluated.
This resulted in its evaluation of the same lazy value more than once (the number of hits is not big though)
|
|
Before:
$ command time nix-prefetch-url https://cdn.kernel.org/pub/linux/kernel/v4.x/linux-4.17.6.tar.xz
1.19user 1.02system 0:41.96elapsed 5%CPU (0avgtext+0avgdata 182720maxresident)k
After:
1.38user 1.05system 0:39.73elapsed 6%CPU (0avgtext+0avgdata 16204maxresident)k
Note however that addToStore() can still take a lot of memory
(e.g. RemoteStore::addToStore() is constant space, but
LocalStore::addToStore() isn't; that's fixed by
https://github.com/edolstra/nix/commit/c94b4fc7ee0c7b322a5f3c7ee784063b47a11d98
though).
Fixes #1400.
|
|
Apparently, on macOS, 'long' != 'int64_t'.
https://hydra.nixos.org/build/77100756
|
|
|
|
Closes #2282.
|
|
stored in mkApp
|
|
|
|
repl: use `nix build` for building instead of `nix-store -r`
|
|
[bugfix] lib.concatMap and lib.mapAttrs to be builtins
|
|
|
|
|
|
[wip] lib.concatMap and lib.mapAttrs to be builtins
|
|
|
|
|
|
|
|
tests/search.sh: minor fix to unbreak tests after search ux merge
|
|
|
|
For example, this allows you to do run nix-daemon as a non-privileged
user:
eelco$ NIX_STATE_DIR=~/my-nix/nix/var nix-daemon --store ~/my-nix/
The NIX_STATE_DIR is still needed because settings.nixDaemonSocketFile
is not derived from settings.storeUri (and we can't derive it from the
store's state directory because we don't want to open the store in the
parent process).
|
|
|
|
This is primarily useful for processing Cargo.lock files.
|
