aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-06-19Show aws-sdk-cpp log messagesEelco Dolstra
2017-06-19macOS: Ugly hack to make the tests succeedEelco Dolstra
Sandboxes cannot be nested, so if Nix's build runs inside a sandbox, it cannot use a sandbox itself. I don't see a clean way to detect whether we're in a sandbox, so use a test-specific hack. https://github.com/NixOS/nix/issues/1413
2017-06-19macOS: Remove flagsEelco Dolstra
In particular, UF_IMMUTABLE (uchg) needs to be cleared to allow the path to be garbage-collected or optimised. See https://github.com/NixOS/nixpkgs/issues/25819. + the file from being garbage-collected.
2017-06-14OS X -> macOSEelco Dolstra
(cherry picked from commit c20641ce569dc1fdeaeaa147b0292f258667f53b)
2017-06-14Add 1.11.10 release notesEelco Dolstra
(cherry picked from commit 0fb60e4e0f66cc42c7c274acfcf00b51f6c829c4)
2017-06-14Remove redundant debug lineEelco Dolstra
2017-06-14canonicalisePathMetaData(): Ignore security.selinux attributeEelco Dolstra
Untested, hopefully fixes #1406.
2017-06-12Suppress spurious "killing process N: Operation not permitted" on macOSEelco Dolstra
2017-06-12On macOS, don't use /var/folders for TMPDIREelco Dolstra
This broke "nix-store --serve".
2017-06-12Provide a builtin default for $NIX_SSL_CERT_FILEEelco Dolstra
This is mostly to ensure that when Nix is started on macOS via a launchd service or sshd (for a remote build), it gets a certificate bundle.
2017-06-12Don't run pre-build-hook if we don't have a derivationEelco Dolstra
This fixes a build failure on OS X when using Hydra or Nix 1.12's build-remote (since they don't copy the derivation to the build machine).
2017-06-07Don't show flags from config settings in "nix --help"Eelco Dolstra
2017-06-07nix: Add --help-config flagEelco Dolstra
2017-06-07nix: Make all options available as flagsEelco Dolstra
Thus, instead of ‘--option <name> <value>’, you can write ‘--<name> <value>’. So --option http-connections 100 becomes --http-connections 100 Apart from brevity, the difference is that it's not an error to set a non-existent option via --option, but unrecognized arguments are fatal. Boolean options have special treatment: they're mapped to the argument-less flags ‘--<name>’ and ‘--no-<name>’. E.g. --option auto-optimise-store false becomes --no-auto-optimise-store
2017-06-06Disable the build user mechanism on all platforms except Linux and OS XEelco Dolstra
2017-06-06Always use the Darwin sandboxEelco Dolstra
Even with "build-use-sandbox = false", we now use sandboxing with a permissive profile that allows everything except the creation of setuid/setgid binaries.
2017-06-06Merge pull request #1399 from Mic92/masterEelco Dolstra
Add .editorconfig
2017-06-05Add .editorconfigJörg Thalheim
- Automatically adjust editor to nix coding style -> less nitpiks/styling issues in pull requests -> profit(!) see also nixpkgs' editorconfig: https://github.com/NixOS/nixpkgs/blob/master/.editorconfig
2017-06-01Fix coverage jobEelco Dolstra
2017-06-01RPM, Deb: Add dependency on libseccompEelco Dolstra
2017-05-31Remove listxattr assertionEelco Dolstra
It appears that sometimes, listxattr() returns a different value for the query case (i.e. when the buffer size is 0).
2017-05-31OS X sandbox: Improve builtin sandbox profileEelco Dolstra
Also, add rules to allow fixed-output derivations to access the network. These rules are sufficient to build stdenvDarwin without any __sandboxProfile magic.
2017-05-31resolve-system-dependencies: Misc fixesEelco Dolstra
This fixes Could not find any mach64 blobs in file ‘/usr/lib/libSystem.B.dylib’, continuing...
2017-05-31resolve-system-dependencies: SimplifyEelco Dolstra
2017-05-31OS X sandbox: Don't use a deterministic $TMPDIREelco Dolstra
This doesn't work because the OS X sandbox cannot bind-mount path to a different location.
2017-05-31OS X sandbox: Store .sb file in $TMPDIR rather than the Nix storeEelco Dolstra
The filename used was not unique and owned by the build user, so builds could fail with error: while setting up the build environment: cannot unlink ‘/nix/store/99i210ihnsjacajaw8r33fmgjvzpg6nr-bison-3.0.4.drv.sb’: Permission denied
2017-05-30resolve-system-dependencies: Fix another segfaultEelco Dolstra
runResolver() was barfing on directories like /System/Library/Frameworks/Security.framework/Versions/Current/PlugIns. It should probably do something sophisticated for frameworks, but let's ignore them for now.
2017-05-30Darwin sandbox: Use sandbox-defaults.sbEelco Dolstra
Issue #759. Also, remove nix.conf from the sandbox since I don't really see a legitimate reason for builders to access the Nix configuration.
2017-05-30Darwin sandbox: Disallow creating setuid/setgid binariesEelco Dolstra
Suggested by Daiderd Jordan.
2017-05-30resolve-system-dependencies: Several fixesEelco Dolstra
This fixes error: getting attributes of path ‘Versions/Current/CoreFoundation’: No such file or directory when /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation is a symlink. Also fixes a segfault when encounting a file that is not a MACH binary (such as /dev/null, which is included in __impureHostDeps in Nixpkgs). Possibly fixes #786.
2017-05-30Only pass --with-sandbox-shell on LinuxEelco Dolstra
2017-05-30Fix seccomp build failure on clangEelco Dolstra
Fixes src/libstore/build.cc:2321:45: error: non-constant-expression cannot be narrowed from type 'int' to 'scmp_datum_t' (aka 'unsigned long') in initializer list [-Wc++11-narrowing]
2017-05-30Shut up some clang warningsEelco Dolstra
2017-05-30Add a seccomp rule to disallow setxattr()Eelco Dolstra
2017-05-30canonicalisePathMetaData(): Remove extended attributes / ACLsEelco Dolstra
EAs/ACLs are not part of the NAR canonicalisation. Worse, setting an ACL allows a builder to create writable files in the Nix store. So get rid of them. Closes #185.
2017-05-30Require seccomp only in multi-user setupsEelco Dolstra
2017-05-29Add test for setuid seccomp filterEelco Dolstra
2017-05-29Fix seccomp initialisation on i686-linuxEelco Dolstra
2017-05-29Add a seccomp filter to prevent creating setuid/setgid binariesEelco Dolstra
This prevents builders from setting the S_ISUID or S_ISGID bits, preventing users from using a nixbld* user to create a setuid/setgid binary to interfere with subsequent builds under the same nixbld* uid. This is based on aszlig's seccomp code (47f587700d646f5b03a42f2fa57c28875a31efbe). Reported by Linus Heckemann.
2017-05-29Fix nix-copy-closure testEelco Dolstra
Fixes client# error: size mismatch importing path ‘/nix/store/ywf5fihjlxwijm6ygh6s0a353b5yvq4d-libidn2-0.16’; expected 0, got 120264 This is mostly an artifact of the NixOS VM test environment, where the Nix database doesn't contain hashes/sizes. http://hydra.nixos.org/build/53537471
2017-05-29Fix build failure on Debian/UbuntuEelco Dolstra
http://hydra.nixos.org/build/53537463
2017-05-29Fix typoEelco Dolstra
2017-05-29Merge pull request #1393 from pyrtsa/patch-1Eelco Dolstra
Fix variable name typo in derivations doc
2017-05-29Merge pull request #1394 from pyrtsa/patch-2Eelco Dolstra
Remove stray `>` in builtins doc
2017-05-28Remove stray `>` in builtins docPyry Jahkola
2017-05-28Fix variable name typo in derivations docPyry Jahkola
2017-05-24Fix #1314Eelco Dolstra
Also, make nix-shell respect --option. (Previously it only passed it along to nix-instantiate and nix-build.)
2017-05-24Merge branch 'topic/cores-master' of https://github.com/neilmayhew/nixEelco Dolstra
2017-05-24Merge pull request #1376 from Mic92/patch-1Eelco Dolstra
nix-profile.sh: remove sbin from PATH
2017-05-24Fix #1380Eelco Dolstra
It lacked a backslash. Use a raw string and single quotes around PS1 to simplify this.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 14:34:39 +0000