aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2016-12-07Keep track of the exact build start/stop timesEelco Dolstra
2016-12-07Bail out early when non-determinism is detectedEelco Dolstra
2016-12-07Expose enforce-determinism and the result to HydraEelco Dolstra
2016-12-07Add an option to make non-determinism non-fatalEelco Dolstra
That is, when build-repeat > 0, and the output of two rounds differ, then print a warning rather than fail the build. This is primarily to let Hydra check reproducibility of all packages.
2016-12-06Use a steady clock for timeoutsEelco Dolstra
Fixes #1146.
2016-12-06nix-store --serve: Suppress log output on stderr when repeating a buildEelco Dolstra
2016-12-06nix-store --serve: Support setting build-repeatEelco Dolstra
This allows Hydra to test whether builds are reproducible.
2016-12-06Tweak error messageEelco Dolstra
2016-12-06Add shell.nixEelco Dolstra
2016-12-06Drop unused WWW::Curl dependencyEelco Dolstra
2016-12-06Merge pull request #947 from layus/fix-path-slashEelco Dolstra
Improve error message on trailing path slashes
2016-11-27Improve error message on trailing path slashesGuillaume Maudoux
2016-11-26Revert "Get rid of unicode quotes (#1140)"Eelco Dolstra
This reverts commit f78126bfd6b6c8477fcdbc09b2f98772dbe9a1e7. There really is no need for such a massive change...
2016-11-25Get rid of unicode quotes (#1140)Guillaume Maudoux
2016-11-25Simplify remouting with MS_PRIVATE in sandbox buildJörg Thalheim
also fix race condition if mounts are added after mountinfo is read.
2016-11-21nix-channel: Fix --update <CHANNELS>Eelco Dolstra
This unbreaks "nixos-rebuild --upgrade".
2016-11-17TypoEelco Dolstra
2016-11-17Fix binary-cache-store buildShea Levy
2016-11-17istringstream_nocopy: Implement in a standards-compliant wayShea Levy
Fixes #1135.
2016-11-17nix-daemon: Fix splice faking on non-LinuxShea Levy
2016-11-17Update darwin build for optional sandbox pathsShea Levy
Fixes #1132
2016-11-16seccomp: Forge return values for *chown32aszlig
These syscalls are only available in 32bit architectures, but libseccomp should handle them correctly even if we're on native architectures that do not have these syscalls. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-16seccomp: Forge return codes for POSIX ACL syscallsaszlig
Commands such as "cp -p" also use fsetxattr() in addition to fchown(), so we need to make sure these syscalls always return successful as well in order to avoid nasty "Invalid value" errors. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-16release.nix: Add a test for sandboxingaszlig
Right now it only tests whether seccomp correctly forges the return value of chown, but the long-term goal is to test the full sandboxing functionality at some point in the future. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-16libstore/build: Forge chown() to return successaszlig
What we basically want is a seccomp mode 2 BPF program like this but for every architecture: BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, nr)), BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_chown, 4, 0), BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_fchown, 3, 0), BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_fchownat, 2, 0), BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_lchown, 1, 0), BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW), BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO) However, on 32 bit architectures we do have chown32, lchown32 and fchown32, so we'd need to add all the architecture blurb which libseccomp handles for us. So we only need to make sure that we add the 32bit seccomp arch while we're on x86_64 and otherwise we just stay at the native architecture which was set during seccomp_init(), which more or less replicates setting 32bit personality during runChild(). The FORCE_SUCCESS() macro here could be a bit less ugly but I think repeating the seccomp_rule_add() all over the place is way uglier. Another way would have been to create a vector of syscalls to iterate over, but that would make error messages uglier because we can either only print the (libseccomp-internal) syscall number or use seccomp_syscall_resolve_num_arch() to get the name or even make the vector a pair number/name, essentially duplicating everything again. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-16Add build dependency for libseccompaszlig
We're going to use libseccomp instead of creating the raw BPF program, because we have different syscall numbers on different architectures. Although our initial seccomp rules will be quite small it really doesn't make sense to generate the raw BPF program because we need to duplicate it and/or make branches on every single architecture we want to suuport. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-16Run builds as root in user namespace againaszlig
This reverts commit ff0c0b645cc1448959126185bb2fafe41cf0bddf. We're going to use seccomp to allow "cp -p" and force chown-related syscalls to always return 0. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-16S3BinaryCacheStore:: Eliminate a string copy while uploadingEelco Dolstra
This cuts hydra-queue-runner's peak memory usage by about a third.
2016-11-14buildPaths(): Handle ecIncompleteClosureEelco Dolstra
buildPaths() on a non-derivation would incorrectly not throw an error if the path didn't have a substitute.
2016-11-14Don't rely on %mEelco Dolstra
2016-11-14daemon: Do not error out when deduplication fails due to ENOSPC.Ludovic Courtès
This solves a problem whereby if /gnu/store/.links had enough entries, ext4's directory index would be full, leading to link(2) returning ENOSPC. * nix/libstore/optimise-store.cc (LocalStore::optimisePath_): Upon ENOSPC from link(2), print a message and return instead of throwing a 'SysError'.
2016-11-14Merge pull request #1129 from layus/fix-commentsEelco Dolstra
Fix comments parsing
2016-11-13Fix comments parsingGuillaume Maudoux
Fixed the parsing of multiline strings ending with an even number of stars, like /** this **/. Added test cases for comments.
2016-11-10Store::computeFSClosure(): Support a set of pathsEelco Dolstra
This way, callers can exploits the parallelism of computeFSClosure() when they have multiple paths that they need the (combined) closure of.
2016-11-10build-remote: replace strtoull with stoull to take advantage of C++ error ↵Shea Levy
handling
2016-11-10build-remote: Implement in C++Shea Levy
2016-11-09Merge branch 'master' of github.com:NixOS/nixEelco Dolstra
2016-11-09copyClosure() / copyStorePath(): Expose dontCheckSigsEelco Dolstra
Needed by Hydra.
2016-11-09Merge branch 'ssh-store' of https://github.com/shlevy/nixEelco Dolstra
2016-11-09Implement backwards-compatible RemoteStore::addToStore()Eelco Dolstra
The SSHStore PR adds this functionality to the daemon, but we have to handle the case where the Nix daemon is 1.11. Also, don't require signatures for trusted users. This restores 1.11 behaviour. Fixes https://github.com/NixOS/hydra/issues/398.
2016-11-08TypoEelco Dolstra
2016-11-07Add missing #includeEelco Dolstra
2016-11-06Detect and disallow base32 hash overflowVladimír Čunát
Example (before this commit): $ nix-hash --type sha256 --to-base16 4n0igfxbd3kqvvj2k2xgysrp63l4v2gd110fwkk4apfpm0hvzwh0 \ | xargs nix-hash --type sha256 --to-base32 0n0igfxbd3kqvvj2k2xgysrp63l4v2gd110fwkk4apfpm0hvzwh0 It's a real-life example: https://github.com/NixOS/nixpkgs/pull/20208/files#r86695567
2016-11-03installation: allow profile modification to be skipped (#1072)Manav Rathi
The current behaviour modifies the first writeable file from amongst .bash_profile, .bash_login and .profile. So .bash_profile (if it is writable) would be modified even if a user has already sourced nix.sh in, say, .profile. This commit introduces a new environment variable, NIX_INSTALLER_NO_MODIFY_PROFILE. If this is set during installation, then the modifications are unconditionally skipped. This is useful for users who have a manually curated set of dotfiles that they are porting to a new machine. In such scenarios, nix.sh is already sourced at a place where the user prefers. Without this change, the nix installer would insist on modifying .bash_profile if it exists. This commit also add documentations for both the current behaviour and the new override.
2016-10-31Support optional sandbox pathsEelco Dolstra
For example, you can now set build-sandbox-paths = /dev/nvidiactl? to specify that /dev/nvidiactl should only be mounted in the sandbox if it exists in the host filesystem. This is useful e.g. for EC2 images that should support both CUDA and non-CUDA instances.
2016-10-27Add nix.conf options for -k and -KShea Levy
Fixes #1084
2016-10-26Merge pull request #1108 from dezgeg/fix-sigfpeEelco Dolstra
Fix SIGFPE from integer overflow during division
2016-10-26Fix SIGFPE from integer overflow during divisionTuomas Tynkkynen
On some architectures (like x86_64 or i686, but not ARM for example) overflow during integer division causes a crash due to SIGFPE. Reproduces on a 64-bit system with: nix-instantiate --eval -E '(-9223372036854775807 - 1) / -1' The only way this can happen is when the smallest possible integer is divided by -1, so just special-case that.
2016-10-26Fix build log output in nix-store --serveEelco Dolstra
2016-10-26Restore the CachedFailure status codeEelco Dolstra
The removal of CachedFailure caused the value of TimedOut to change, which broke timed-out handling in Hydra (so timed-out builds would show up as "aborted" and would be retried, e.g. at http://hydra.nixos.org/build/42537427).
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 13:33:03 +0000