aboutsummaryrefslogtreecommitdiff
path: root/src/libstore/globals.hh
AgeCommit message (Collapse)Author
2019-12-21Disable use-sqlite-wal under WSLBrian McKenna
Before: $ nix-channel --update unpacking channels... warning: SQLite database '/nix/var/nix/db/db.sqlite' is busy (SQLITE_PROTOCOL) warning: SQLite database '/nix/var/nix/db/db.sqlite' is busy (SQLITE_PROTOCOL) warning: SQLite database '/nix/var/nix/db/db.sqlite' is busy (SQLITE_PROTOCOL) warning: SQLite database '/nix/var/nix/db/db.sqlite' is busy (SQLITE_PROTOCOL) warning: SQLite database '/nix/var/nix/db/db.sqlite' is busy (SQLITE_PROTOCOL) After: $ inst/bin/nix-channel --update unpacking channels... created 1 symlinks in user environment I've seen complaints that "sandbox" caused problems under WSL but I'm having no problems. I think recent changes could have fixed the issue.
2019-11-30Fix typosBrian Wignall
2019-11-26Add feature to disable URL literalsEelco Dolstra
E.g. $ nix-build '<nixpkgs>' -A hello --experimental-features no-url-literals error: URL literals are disabled, at /nix/store/vsjamkzh15r3c779q2711az826hqgvzr-nixpkgs-20.03pre194957.bef773ed53f/nixpkgs/pkgs/top-level/all-packages.nix:1236:11 Helps with implementing https://github.com/NixOS/rfcs/pull/45.
2019-11-22getEnv(): Return std::optionalEelco Dolstra
This allows distinguishing between an empty value and no value.
2019-10-21Add experimental-features settingEelco Dolstra
Experimental features are now opt-in. There is currently one experimental feature: "nix-command" (which enables the "nix" command. This will allow us to merge experimental features more quickly, without committing to supporting them indefinitely. Typical usage: $ nix build --experimental-features 'nix-command flakes' nixpkgs#hello (cherry picked from commit 8e478c234100cf03ea1b777d4bd42a9be7be9e8c, without the "flakes" feature)
2019-08-27Merge branch 'test-sandboxing' of https://github.com/matthewbauer/nixEelco Dolstra
2019-08-07Merge pull request #2995 from tweag/post-build-hookEelco Dolstra
Add a post build hook
2019-08-02Add a test for auto-GCEelco Dolstra
This currently fails because we're using POSIX file locks. So when the garbage collector opens and closes its own temproots file, it causes the lock to be released and then deleted by another GC instance.
2019-08-02Add a post-build-hookregnat
Passing `--post-build-hook /foo/bar` to a nix-* command will cause `/foo/bar` to be executed after each build with the following environment variables set: DRV_PATH=/nix/store/drv-that-has-been-built.drv OUT_PATHS=/nix/store/...build /nix/store/...build-bin /nix/store/...build-dev This can be useful in particular to upload all the builded artifacts to the cache (including the ones that don't appear in the runtime closure of the final derivation or are built because of IFD). This new feature prints the stderr/stdout output to the `nix-build` and `nix build` client, and the output is printed in a Nix 2 compatible format: [nix]$ ./inst/bin/nix-build ./test.nix these derivations will be built: /nix/store/ishzj9ni17xq4hgrjvlyjkfvm00b0ch9-my-example-derivation.drv building '/nix/store/ishzj9ni17xq4hgrjvlyjkfvm00b0ch9-my-example-derivation.drv'... hello! bye! running post-build-hook '/home/grahamc/projects/github.com/NixOS/nix/post-hook.sh'... post-build-hook: + sleep 1 post-build-hook: + echo 'Signing paths' /nix/store/qr213vjmibrqwnyp5fw678y7whbkqyny-my-example-derivation post-build-hook: Signing paths /nix/store/qr213vjmibrqwnyp5fw678y7whbkqyny-my-example-derivation post-build-hook: + sleep 1 post-build-hook: + echo 'Uploading paths' /nix/store/qr213vjmibrqwnyp5fw678y7whbkqyny-my-example-derivation post-build-hook: Uploading paths /nix/store/qr213vjmibrqwnyp5fw678y7whbkqyny-my-example-derivation post-build-hook: + sleep 1 post-build-hook: + printf 'very important stuff' /nix/store/qr213vjmibrqwnyp5fw678y7whbkqyny-my-example-derivation [nix-shell:~/projects/github.com/NixOS/nix]$ ./inst/bin/nix build -L -f ./test.nix my-example-derivation> hello! my-example-derivation> bye! my-example-derivation (post)> + sleep 1 my-example-derivation (post)> + echo 'Signing paths' /nix/store/c263gzj2kb2609mz8wrbmh53l14wzmfs-my-example-derivation my-example-derivation (post)> Signing paths /nix/store/c263gzj2kb2609mz8wrbmh53l14wzmfs-my-example-derivation my-example-derivation (post)> + sleep 1 my-example-derivation (post)> + echo 'Uploading paths' /nix/store/c263gzj2kb2609mz8wrbmh53l14wzmfs-my-example-derivation my-example-derivation (post)> Uploading paths /nix/store/c263gzj2kb2609mz8wrbmh53l14wzmfs-my-example-derivation my-example-derivation (post)> + sleep 1 my-example-derivation (post)> + printf 'very important stuff' [1 built, 0.0 MiB DL] Co-authored-by: Graham Christensen <graham@grahamc.com> Co-authored-by: Eelco Dolstra <edolstra@gmail.com>
2019-07-25Use sandbox fallback when cloning fails in builderMatthew Bauer
When sandbox-fallback = true (the default), the Nix builder will fall back to disabled sandbox mode when the kernel doesn’t allow users to set it up. This prevents hard errors from occuring in tricky places, especially the initial installer. To restore the previous behavior, users can set: sandbox-fallback = false in their /etc/nix/nix.conf configuration.
2019-06-24Add '--no-net' convenience flagEelco Dolstra
This flag * Disables substituters. * Sets the tarball-ttl to infinity (ensuring e.g. that the flake registry and any downloaded flakes are considered current). * Disables retrying downloads and sets the connection timeout to the minimum. (So it doesn't completely disable downloads at the moment.) (cherry picked from commit 8ea842260b4fd93315d35c5ba94b1ff99ab391d8)
2018-11-07Enable sandboxing by defaultEelco Dolstra
Closes #179.
2018-10-23Promote log-lines to a fully-qualified optionLinus Heckemann
This allows commands like nix build --log-lines 30 nixpkgs.hello in order to obtain more information in case of a failure.
2018-09-28Check requiredSystemFeatures for local buildsEelco Dolstra
For example, this prevents a "kvm" build on machines that don't have KVM. Fixes #2012.
2018-05-30Move evaluator-specific settings out of libstoreEelco Dolstra
2018-05-30Move some Download-specific settings to download.ccEelco Dolstra
2018-05-30Modularize config settingsEelco Dolstra
Allow global config settings to be defined in multiple Config classes. For example, this means that libutil can have settings and evaluator settings can be moved out of libstore. The Config classes are registered in a new GlobalConfig class to which config files etc. are applied. Relevant to https://github.com/NixOS/nix/issues/2009 in that it removes the need for ad hoc handling of useCaseHack, which was the underlying cause of that issue.
2018-04-23globals.hh: don't use '==' to compare string literalsWill Dietz
Saw this in logs, also reported here: https://github.com/NixOS/nix/commit/8e6108ff71caae180d764ab9e9bff5593724655c#r28707288
2018-04-23Merge branch 'aarch64-armv7' of git://github.com/lheckemann/nixShea Levy
Support extra compatible architectures (#1916)
2018-04-06rename the options to mention it's a narinfo TTL as disk cache is used all ↵AmineChikhaoui
over the place for other operations
2018-04-06add documentation for the local disk cache TTL configAmineChikhaoui
2018-04-06Make the TTL for disk cache configurable, we can now completely disableAmineChikhaoui
disk cache lookup for example by doing: nix copy --from <binary-cahe> <store-path> --option \ positive-disk-cache-ttl 0 Issues: #1885 #2035
2018-03-29Process --option use-case-hack properlyEelco Dolstra
Fixes https://github.com/NixOS/nix/issues/2009.
2018-03-16rename build-extra-platforms -> extra-platformsLinus Heckemann
also document it
2018-02-27Add build-extra-platforms settingLinus Heckemann
This allows specifying additional systems that a machine is able to build for. This may apply on some armv7-capable aarch64 processors, or on systems using qemu-user with binfmt-misc to support transparent execution of foreign-arch programs. This removes the previous hard-coded assumptions about which systems are ABI-compatible with which other systems, and instead relies on the user to specify any additional platforms that they have ensured compatibility for and wish to build for locally. NixOS should probably add i686-linux on x86_64-linux systems for this setting by default.
2018-02-22Revert "Enable sandbox builds on Linux by default"Eelco Dolstra
This reverts commit ddc58e789636e1b94149c342575d92583251fbf6. https://hydra.nixos.org/eval/1435322
2018-02-22Enable sandbox builds on Linux by defaultEelco Dolstra
The overhead of sandbox builds is a problem on NixOS (since building a NixOS configuration involves a lot of small derivations) but not for typical non-NixOS use cases. So outside of NixOS we can enable it. Issue #179.
2018-02-19Merge branch 'register-settings' of https://github.com/shlevy/nixEelco Dolstra
2018-02-15Set backup MANPATH in case man path isn’t set correctly.Matthew Bauer
Previously, this would fail at startup for non-NixOS installs: nix-env --help The fix for this is to just use "nixManDir" as the value for MANPATH when spawning "man". To test this, I’m using the following: $ nix-build release.nix -A build $ MANPATH= ./result/bin/nix-env --help Fixes #1627
2018-02-13Allow plugins to define new settings.Shea Levy
2018-02-08Add plugins to make Nix more extensible.Shea Levy
All plugins in plugin-files will be dlopened, allowing them to statically construct instances of the various Register* types Nix supports.
2018-01-26Remove signed-binary-caches as the default for require-sigsEelco Dolstra
This was for backward compatibility. However, with security-related configuration settings, it's best not to have any confusion. Issue #495.
2018-01-16Make show-trace a config settingEelco Dolstra
2018-01-16Add pure evaluation modeEelco Dolstra
In this mode, the following restrictions apply: * The builtins currentTime, currentSystem and storePath throw an error. * $NIX_PATH and -I are ignored. * fetchGit and fetchMercurial require a revision hash. * fetchurl and fetchTarball require a sha256 attribute. * No file system access is allowed outside of the paths returned by fetch{Git,Mercurial,url,Tarball}. Thus 'nix build -f ./foo.nix' is not allowed. Thus, the evaluation result is completely reproducible from the command line arguments. E.g. nix build --pure-eval '( let nix = fetchGit { url = https://github.com/NixOS/nixpkgs.git; rev = "9c927de4b179a6dd210dd88d34bda8af4b575680"; }; nixpkgs = fetchGit { url = https://github.com/NixOS/nixpkgs.git; ref = "release-17.09"; rev = "66b4de79e3841530e6d9c6baf98702aa1f7124e4"; }; in (import (nix + "/release.nix") { inherit nix nixpkgs; }).build.x86_64-linux )' The goal is to enable completely reproducible and traceable evaluation. For example, a NixOS configuration could be fully described by a single Git commit hash. 'nixos-rebuild' would do something like nix build --pure-eval '( (import (fetchGit { url = file:///my-nixos-config; rev = "..."; })).system ') where the Git repository /my-nixos-config would use further fetchGit calls or Git externals to fetch Nixpkgs and whatever other dependencies it has. Either way, the commit hash would uniquely identify the NixOS configuration and allow it to reproduced.
2018-01-09nix.conf: builders-use-substitutesRenzo Carbonara
Fixes #937
2018-01-04Rename "use-substitutes" to "substitute"Eelco Dolstra
Commit c2154d4c8422ddc1c201d503bb52edff854af2ad renamed "build-use-substitutes" to "use-substitutes", but that broke "nix-copy-closure --use-substitutes".
2017-11-20signed-binary-caches -> require-sigsEelco Dolstra
Unlike signed-binary-caches (which could only be '*' or ''), require-sigs is a proper Boolean option. The default is true.
2017-11-20binary-cache-public-keys -> trusted-public-keysEelco Dolstra
The name had become a misnomer since it's not only for substitution from binary caches, but when adding/copying any (non-content-addressed) path to a store.
2017-10-30Add option allowed-urisEelco Dolstra
This allows network access in restricted eval mode.
2017-10-30enable-http2 -> http2Eelco Dolstra
2017-10-24Remove the remote-builds optionEelco Dolstra
This is superfluous since you can now just set "builders" to empty, e.g. "--builders ''".
2017-10-24Remove the builder-files optionEelco Dolstra
You can now include files via the "builders" option, using the syntax "@<filename>". Having only one option makes it easier to override builders completely. For backward compatibility, the default is "@/etc/nix/machines", or "@<filename>" for each file name in NIX_REMOTE_SYSTEMS.
2017-10-23Turn $NIX_REMOTE into a configuration optionEelco Dolstra
2017-10-12Add option to disable the seccomp filterEelco Dolstra
I needed this to test ACL/xattr removal in canonicalisePathMetaData(). Might also be useful if you need to build old Nixpkgs that doesn't have the required patches to remove setuid/setgid creation.
2017-09-05Add automatic garbage collectionEelco Dolstra
Nix can now automatically run the garbage collector during builds or while adding paths to the store. The option "min-free = <bytes>" specifies that Nix should run the garbage collector whenever free space in the Nix store drops below <bytes>. It will then delete garbage until "max-free" bytes are available. Garbage collection during builds is asynchronous; running builds are not paused and new builds are not blocked. However, there also is a synchronous GC run prior to the first build/substitution. Currently, no old GC roots are deleted (as in "nix-collect-garbage -d").
2017-08-31Rename a few configuration optionsEelco Dolstra
In particular, drop the "build-" and "gc-" prefixes which are pointless. So now you can say nix build --no-sandbox instead of nix build --no-build-use-sandbox
2017-07-17Make the hashes mirrors used by builtins.fetchurl configurableEelco Dolstra
In particular, this allows it to be disabled in our tests.
2017-07-04Add allow-new-privileges optionEelco Dolstra
This allows builds to call setuid binaries. This was previously possible until we started using seccomp. Turns out that seccomp by default disallows processes from acquiring new privileges. Generally, any use of setuid binaries (except those created by the builder itself) is by definition impure, but some people were relying on this ability for certain tests. Example: $ nix build '(with import <nixpkgs> {}; runCommand "foo" {} "/run/wrappers/bin/ping -c 1 8.8.8.8; exit 1")' --no-allow-new-privileges builder for ‘/nix/store/j0nd8kv85hd6r4kxgnwzvr0k65ykf6fv-foo.drv’ failed with exit code 1; last 2 log lines: cannot raise the capability into the Ambient set : Operation not permitted $ nix build '(with import <nixpkgs> {}; runCommand "foo" {} "/run/wrappers/bin/ping -c 1 8.8.8.8; exit 1")' --allow-new-privileges builder for ‘/nix/store/j0nd8kv85hd6r4kxgnwzvr0k65ykf6fv-foo.drv’ failed with exit code 1; last 6 log lines: PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=46 time=15.2 ms Fixes #1429.
2017-05-11Add an option for extending the user agent headerEelco Dolstra
This is useful e.g. for distinguishing traffic to a binary cache (e.g. certain machines can use a different tag in the user agent).
2017-05-05Make the location of the build directory in the sandbox configurableEelco Dolstra
This is mostly for use in the sandbox tests, since if the Nix store is under /build, then we can't use /build as the build directory.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 05:16:01 +0000