aboutsummaryrefslogtreecommitdiff
path: root/src/libstore/build.cc
AgeCommit message (Collapse)Author
2017-08-25SimplifyEelco Dolstra
2017-08-25Allow derivations to update the build phaseEelco Dolstra
So the progress bar can show [1/0/1 built, 0.0 MiB DL] building hello-2.10 (configuring): checking whether pread is declared without a macro... yes
2017-08-25Allow activities to be nestedEelco Dolstra
In particular, this allows more relevant activities ("substituting X") to supersede inferior ones ("downloading X").
2017-08-25Restore activity metadataEelco Dolstra
This allows the progress bar to display "building perl-5.22.3" instead of "building /nix/store/<hash>-perl-5.22.3.drv".
2017-08-21Clean up JSON constructionEelco Dolstra
2017-08-21Allow builders to create activitiesEelco Dolstra
Actually, currently they can only create download activities. Thus, downloads by builtins.fetchurl show up in the progress bar.
2017-08-16nix optimise-store: Show how much space has been freedEelco Dolstra
2017-08-16Progress indicator: CleanupEelco Dolstra
2017-08-16Progress indicator: More improvementsEelco Dolstra
2017-08-16Progress indicator: Show number of active itemsEelco Dolstra
2017-08-16Progress indicator: Unify "copying" and "substituting"Eelco Dolstra
They're the same thing after all. Example: $ nix build --store local?root=/tmp/nix nixpkgs.firefox-unwrapped [0/1 built, 49/98 copied, 16.3/92.8 MiB DL, 55.8/309.2 MiB copied] downloading 'https://cache.nixos.org/nar/0pl9li1jigcj2dany47hpmn0r3r48wc4nz48v5mqhh426lgz3bz6.nar.xz'
2017-08-16Improve substitution progress indicatorEelco Dolstra
E.g. $ nix build --store local?root=/tmp/nix nixpkgs.firefox-unwrapped [0/1 built, 1/97/98 fetched, 65.8/92.8 MiB DL, 203.2/309.2 MiB copied] downloading 'https://cache.nixos.org/nar/1czm9fk0svacy4h6a3fzkpafi4f7a9gml36kk8cq1igaghbspg3k.nar.xz'
2017-08-09Use /proc/self/fd to efficiently close all FDs on LinuxEelco Dolstra
Issue #1506.
2017-07-30Replace Unicode quotes in user-facing strings by ASCIIJörg Thalheim
Relevant RFC: NixOS/rfcs#4 $ ag -l | xargs sed -i -e "/\"/s/’/'/g;/\"/s/‘/'/g"
2017-07-20FD_SETSIZE check: BuildError -> ErrorEelco Dolstra
BuildError denotes a permanent build failure, which is not the case here.
2017-07-18Do not try to fill fd_set with fd>=FD_SETSIZEDmitry Kalinkin
This is UB and causes buffer overflow and crash on linux.
2017-07-04Add X32 to the seccomp filterEelco Dolstra
Fixes #1432.
2017-07-04Add allow-new-privileges optionEelco Dolstra
This allows builds to call setuid binaries. This was previously possible until we started using seccomp. Turns out that seccomp by default disallows processes from acquiring new privileges. Generally, any use of setuid binaries (except those created by the builder itself) is by definition impure, but some people were relying on this ability for certain tests. Example: $ nix build '(with import <nixpkgs> {}; runCommand "foo" {} "/run/wrappers/bin/ping -c 1 8.8.8.8; exit 1")' --no-allow-new-privileges builder for ‘/nix/store/j0nd8kv85hd6r4kxgnwzvr0k65ykf6fv-foo.drv’ failed with exit code 1; last 2 log lines: cannot raise the capability into the Ambient set : Operation not permitted $ nix build '(with import <nixpkgs> {}; runCommand "foo" {} "/run/wrappers/bin/ping -c 1 8.8.8.8; exit 1")' --allow-new-privileges builder for ‘/nix/store/j0nd8kv85hd6r4kxgnwzvr0k65ykf6fv-foo.drv’ failed with exit code 1; last 6 log lines: PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=46 time=15.2 ms Fixes #1429.
2017-07-04Support base-64 hashesEelco Dolstra
Also simplify the Hash API. Fixes #1437.
2017-07-03Replace a few bool flags with enumsEelco Dolstra
Functions like copyClosure() had 3 bool arguments, which creates a severe risk of mixing up arguments. Also, implement copyClosure() using copyPaths().
2017-06-19macOS: Ugly hack to make the tests succeedEelco Dolstra
Sandboxes cannot be nested, so if Nix's build runs inside a sandbox, it cannot use a sandbox itself. I don't see a clean way to detect whether we're in a sandbox, so use a test-specific hack. https://github.com/NixOS/nix/issues/1413
2017-06-12Don't run pre-build-hook if we don't have a derivationEelco Dolstra
This fixes a build failure on OS X when using Hydra or Nix 1.12's build-remote (since they don't copy the derivation to the build machine).
2017-06-06Disable the build user mechanism on all platforms except Linux and OS XEelco Dolstra
2017-06-06Always use the Darwin sandboxEelco Dolstra
Even with "build-use-sandbox = false", we now use sandboxing with a permissive profile that allows everything except the creation of setuid/setgid binaries.
2017-05-31OS X sandbox: Improve builtin sandbox profileEelco Dolstra
Also, add rules to allow fixed-output derivations to access the network. These rules are sufficient to build stdenvDarwin without any __sandboxProfile magic.
2017-05-31OS X sandbox: Don't use a deterministic $TMPDIREelco Dolstra
This doesn't work because the OS X sandbox cannot bind-mount path to a different location.
2017-05-31OS X sandbox: Store .sb file in $TMPDIR rather than the Nix storeEelco Dolstra
The filename used was not unique and owned by the build user, so builds could fail with error: while setting up the build environment: cannot unlink ‘/nix/store/99i210ihnsjacajaw8r33fmgjvzpg6nr-bison-3.0.4.drv.sb’: Permission denied
2017-05-30Darwin sandbox: Use sandbox-defaults.sbEelco Dolstra
Issue #759. Also, remove nix.conf from the sandbox since I don't really see a legitimate reason for builders to access the Nix configuration.
2017-05-30Darwin sandbox: Disallow creating setuid/setgid binariesEelco Dolstra
Suggested by Daiderd Jordan.
2017-05-30Fix seccomp build failure on clangEelco Dolstra
Fixes src/libstore/build.cc:2321:45: error: non-constant-expression cannot be narrowed from type 'int' to 'scmp_datum_t' (aka 'unsigned long') in initializer list [-Wc++11-narrowing]
2017-05-30Shut up some clang warningsEelco Dolstra
2017-05-30Add a seccomp rule to disallow setxattr()Eelco Dolstra
2017-05-30Require seccomp only in multi-user setupsEelco Dolstra
2017-05-29Fix seccomp initialisation on i686-linuxEelco Dolstra
2017-05-29Add a seccomp filter to prevent creating setuid/setgid binariesEelco Dolstra
This prevents builders from setting the S_ISUID or S_ISGID bits, preventing users from using a nixbld* user to create a setuid/setgid binary to interfere with subsequent builds under the same nixbld* uid. This is based on aszlig's seccomp code (47f587700d646f5b03a42f2fa57c28875a31efbe). Reported by Linus Heckemann.
2017-05-16Improve progress indicatorEelco Dolstra
2017-05-15Simplify fixed-output checkEelco Dolstra
2017-05-15Linux sandbox: Don't barf on invalid pathsEelco Dolstra
This is useful when we're using a diverted store (e.g. "--store local?root=/tmp/nix") in conjunction with a statically-linked sh from the host store (e.g. "sandbox-paths =/bin/sh=/nix/store/.../bin/busybox").
2017-05-08Linux sandbox: Fix compatibility with older kernelsEelco Dolstra
2017-05-08Remove superfluous #ifdefEelco Dolstra
2017-05-05Make the location of the build directory in the sandbox configurableEelco Dolstra
This is mostly for use in the sandbox tests, since if the Nix store is under /build, then we can't use /build as the build directory.
2017-05-04Linux sandbox: Use /build instead of /tmp as $TMPDIREelco Dolstra
There is a security issue when a build accidentally stores its $TMPDIR in some critical place, such as an RPATH. If TMPDIR=/tmp/nix-build-..., then any user on the system can recreate that directory and inject libraries into the RPATH of programs executed by other users. Since /build probably doesn't exist (or isn't world-writable), this mitigates the issue.
2017-05-02Add an option for specifying remote buildersEelco Dolstra
This is useful for one-off situations where you want to specify a builder on the command line instead of having to mess with nix.machines. E.g. $ nix-build -A hello --argstr system x86_64-darwin \ --option builders 'root@macstadium1 x86_64-darwin' will perform the specified build on "macstadium1". It also removes the need for a separate nix.machines file since you can specify builders in nix.conf directly. (In fact nix.machines is yet another hack that predates the general nix.conf configuration file, IIRC.) Note: this option is supported by the daemon for trusted users. The fact that this allows trusted users to specify paths to SSH keys to which they don't normally have access is maybe a bit too much trust...
2017-05-02build-hook: If there are no machines defined, quit permanentlyEelco Dolstra
2017-05-01Support arbitrary store URIs in nix.machinesEelco Dolstra
For backwards compatibility, if the URI is just a hostname, ssh:// (i.e. LegacySSHStore) is prepended automatically. Also, all fields except the URI are now optional. For example, this is a valid nix.machines file: local?root=/tmp/nix This is useful for testing the remote build machinery since you don't have to mess around with ssh.
2017-05-01Chomp log output from the build hookEelco Dolstra
2017-05-01Remove $NIX_BUILD_HOOK and $NIX_CURRENT_LOADEelco Dolstra
This is to simplify remote build configuration. These environment variables predate nix.conf. The build hook now has a sensible default (namely build-remote). The current load is kept in the Nix state directory now.
2017-05-01build-remote: Don't copy the .drv closureEelco Dolstra
Since build-remote uses buildDerivation() now, we don't need to copy the .drv file anymore. This greatly reduces the set of input paths copied to the remote side (e.g. from 392 to 51 store paths for GNU hello on x86_64-darwin).
2017-05-01Pass verbosity level to build hookEelco Dolstra
2017-04-28Fix brainfartEelco Dolstra
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 14:29:33 +0000