lix -

Age	Commit message (Collapse)	Author
2017-10-30	Merge pull request #1646 from copumpkin/optional-sandbox-local-network	Eelco Dolstra
	Allow optional localhost network access to sandboxed derivations
2017-10-30	Allow optional localhost network access to sandboxed derivations	Dan Peebles
	This will allow bind and connect to 127.0.0.1, which can reduce purity/ security (if you're running a vulnerable service on localhost) but is also needed for a ton of test suites, so I'm leaving it turned off by default but allowing certain derivations to turn it on as needed. It also allows DNS resolution of arbitrary hostnames but I haven't found a way to avoid that. In principle I'd just want to allow resolving localhost but that doesn't seem to be possible. I don't think this belongs under `build-use-sandbox = relaxed` because we want it on Hydra and I don't think it's the end of the world.
2017-10-25	Fix building on clang	Eelco Dolstra
	https://hydra.nixos.org/build/62945761
2017-10-25	exportReferencesGraph: Allow exporting a list of store paths	Eelco Dolstra

2017-10-25	Fix exportReferencesGraph in the structured attrs case	Eelco Dolstra

2017-10-25	Pass lists/attrsets to bash as (associative) arrays	Eelco Dolstra

2017-10-24	More progress indicator improvements	Eelco Dolstra
	In particular, don't show superfluous "fetching path" and "building path(s)" messages, and show the current round (with --repeat).
2017-10-24	More progress indicator improvements	Eelco Dolstra
	Fixes #1599.
2017-10-24	Progress indicator: Show on what machine we're building	Eelco Dolstra
	E.g. $ nix build nixpkgs.hello --builders 'root@wendy' [1/0/1 built] building hello-2.10 on ssh://root@wendy: checking for minix/config.h... no
2017-10-24	Handle log messages from build-remote	Eelco Dolstra
	This makes the progress indicator show statuses like "connecting to 'root@machine'".
2017-10-24	Remove the remote-builds option	Eelco Dolstra
	This is superfluous since you can now just set "builders" to empty, e.g. "--builders ''".
2017-10-23	Pass all settings to build-remote	Eelco Dolstra
	This ensures that command line flags such as --builders get passed correctly.
2017-10-17	Shift Darwin sandbox to separate installed files	Dan Peebles
	This makes it slightly more manageable to see at a glance what in a build's sandbox profile is unique to the build and what is standard. Also a first step to factoring more of our Darwin logic into scheme functions that will allow us a bit more flexibility. And of course less of that nasty codegen in C++! 😀
2017-10-12	Add option to disable the seccomp filter	Eelco Dolstra
	I needed this to test ACL/xattr removal in canonicalisePathMetaData(). Might also be useful if you need to build old Nixpkgs that doesn't have the required patches to remove setuid/setgid creation.
2017-09-08	Communicate the structured log FD to builders	Eelco Dolstra
	Since we may use a dedicated file descriptor in the future, this allows us to change it. So builders can do if [[ -n $NIX_LOG_FD ]]; then echo "@nix { message... }" >&$NIX_LOG_FD fi
2017-09-05	Add automatic garbage collection	Eelco Dolstra
	Nix can now automatically run the garbage collector during builds or while adding paths to the store. The option "min-free = <bytes>" specifies that Nix should run the garbage collector whenever free space in the Nix store drops below <bytes>. It will then delete garbage until "max-free" bytes are available. Garbage collection during builds is asynchronous; running builds are not paused and new builds are not blocked. However, there also is a synchronous GC run prior to the first build/substitution. Currently, no old GC roots are deleted (as in "nix-collect-garbage -d").
2017-08-31	Call queryMissing() prior to building	Eelco Dolstra
	Without this, substitute info is fetched sequentially, which is superslow. In the old UI (e.g. nix-build), we call printMissing(), which calls queryMissing(), thereby preheating the binary cache cache. But the new UI doesn't do that.
2017-08-31	Rename a few configuration options	Eelco Dolstra
	In particular, drop the "build-" and "gc-" prefixes which are pointless. So now you can say nix build --no-sandbox instead of nix build --no-build-use-sandbox
2017-08-28	Give activities a verbosity level again	Eelco Dolstra
	And print them (separately from the progress bar) given sufficient -v flags.
2017-08-25	Simplify	Eelco Dolstra

2017-08-25	Allow derivations to update the build phase	Eelco Dolstra
	So the progress bar can show [1/0/1 built, 0.0 MiB DL] building hello-2.10 (configuring): checking whether pread is declared without a macro... yes
2017-08-25	Allow activities to be nested	Eelco Dolstra
	In particular, this allows more relevant activities ("substituting X") to supersede inferior ones ("downloading X").
2017-08-25	Restore activity metadata	Eelco Dolstra
	This allows the progress bar to display "building perl-5.22.3" instead of "building /nix/store/<hash>-perl-5.22.3.drv".
2017-08-21	Clean up JSON construction	Eelco Dolstra

2017-08-21	Allow builders to create activities	Eelco Dolstra
	Actually, currently they can only create download activities. Thus, downloads by builtins.fetchurl show up in the progress bar.
2017-08-16	nix optimise-store: Show how much space has been freed	Eelco Dolstra

2017-08-16	Progress indicator: Cleanup	Eelco Dolstra

2017-08-16	Progress indicator: More improvements	Eelco Dolstra

2017-08-16	Progress indicator: Show number of active items	Eelco Dolstra

2017-08-16	Progress indicator: Unify "copying" and "substituting"	Eelco Dolstra
	They're the same thing after all. Example: $ nix build --store local?root=/tmp/nix nixpkgs.firefox-unwrapped [0/1 built, 49/98 copied, 16.3/92.8 MiB DL, 55.8/309.2 MiB copied] downloading 'https://cache.nixos.org/nar/0pl9li1jigcj2dany47hpmn0r3r48wc4nz48v5mqhh426lgz3bz6.nar.xz'
2017-08-16	Improve substitution progress indicator	Eelco Dolstra
	E.g. $ nix build --store local?root=/tmp/nix nixpkgs.firefox-unwrapped [0/1 built, 1/97/98 fetched, 65.8/92.8 MiB DL, 203.2/309.2 MiB copied] downloading 'https://cache.nixos.org/nar/1czm9fk0svacy4h6a3fzkpafi4f7a9gml36kk8cq1igaghbspg3k.nar.xz'
2017-08-09	Use /proc/self/fd to efficiently close all FDs on Linux	Eelco Dolstra
	Issue #1506.
2017-07-30	Replace Unicode quotes in user-facing strings by ASCII	Jörg Thalheim
	Relevant RFC: NixOS/rfcs#4 $ ag -l \| xargs sed -i -e "/\"/s/’/'/g;/\"/s/‘/'/g"
2017-07-20	FD_SETSIZE check: BuildError -> Error	Eelco Dolstra
	BuildError denotes a permanent build failure, which is not the case here.
2017-07-18	Do not try to fill fd_set with fd>=FD_SETSIZE	Dmitry Kalinkin
	This is UB and causes buffer overflow and crash on linux.
2017-07-04	Add X32 to the seccomp filter	Eelco Dolstra
	Fixes #1432.
2017-07-04	Add allow-new-privileges option	Eelco Dolstra
	This allows builds to call setuid binaries. This was previously possible until we started using seccomp. Turns out that seccomp by default disallows processes from acquiring new privileges. Generally, any use of setuid binaries (except those created by the builder itself) is by definition impure, but some people were relying on this ability for certain tests. Example: $ nix build '(with import <nixpkgs> {}; runCommand "foo" {} "/run/wrappers/bin/ping -c 1 8.8.8.8; exit 1")' --no-allow-new-privileges builder for ‘/nix/store/j0nd8kv85hd6r4kxgnwzvr0k65ykf6fv-foo.drv’ failed with exit code 1; last 2 log lines: cannot raise the capability into the Ambient set : Operation not permitted $ nix build '(with import <nixpkgs> {}; runCommand "foo" {} "/run/wrappers/bin/ping -c 1 8.8.8.8; exit 1")' --allow-new-privileges builder for ‘/nix/store/j0nd8kv85hd6r4kxgnwzvr0k65ykf6fv-foo.drv’ failed with exit code 1; last 6 log lines: PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=46 time=15.2 ms Fixes #1429.
2017-07-04	Support base-64 hashes	Eelco Dolstra
	Also simplify the Hash API. Fixes #1437.
2017-07-03	Replace a few bool flags with enums	Eelco Dolstra
	Functions like copyClosure() had 3 bool arguments, which creates a severe risk of mixing up arguments. Also, implement copyClosure() using copyPaths().
2017-06-19	macOS: Ugly hack to make the tests succeed	Eelco Dolstra
	Sandboxes cannot be nested, so if Nix's build runs inside a sandbox, it cannot use a sandbox itself. I don't see a clean way to detect whether we're in a sandbox, so use a test-specific hack. https://github.com/NixOS/nix/issues/1413
2017-06-12	Don't run pre-build-hook if we don't have a derivation	Eelco Dolstra
	This fixes a build failure on OS X when using Hydra or Nix 1.12's build-remote (since they don't copy the derivation to the build machine).
2017-06-06	Disable the build user mechanism on all platforms except Linux and OS X	Eelco Dolstra

2017-06-06	Always use the Darwin sandbox	Eelco Dolstra
	Even with "build-use-sandbox = false", we now use sandboxing with a permissive profile that allows everything except the creation of setuid/setgid binaries.
2017-05-31	OS X sandbox: Improve builtin sandbox profile	Eelco Dolstra
	Also, add rules to allow fixed-output derivations to access the network. These rules are sufficient to build stdenvDarwin without any __sandboxProfile magic.
2017-05-31	OS X sandbox: Don't use a deterministic $TMPDIR	Eelco Dolstra
	This doesn't work because the OS X sandbox cannot bind-mount path to a different location.
2017-05-31	OS X sandbox: Store .sb file in $TMPDIR rather than the Nix store	Eelco Dolstra
	The filename used was not unique and owned by the build user, so builds could fail with error: while setting up the build environment: cannot unlink ‘/nix/store/99i210ihnsjacajaw8r33fmgjvzpg6nr-bison-3.0.4.drv.sb’: Permission denied
2017-05-30	Darwin sandbox: Use sandbox-defaults.sb	Eelco Dolstra
	Issue #759. Also, remove nix.conf from the sandbox since I don't really see a legitimate reason for builders to access the Nix configuration.
2017-05-30	Darwin sandbox: Disallow creating setuid/setgid binaries	Eelco Dolstra
	Suggested by Daiderd Jordan.
2017-05-30	Fix seccomp build failure on clang	Eelco Dolstra
	Fixes src/libstore/build.cc:2321:45: error: non-constant-expression cannot be narrowed from type 'int' to 'scmp_datum_t' (aka 'unsigned long') in initializer list [-Wc++11-narrowing]
2017-05-30	Shut up some clang warnings	Eelco Dolstra