lix -

Age	Commit message (Collapse)	Author
2014-12-12	Ensure we're writing to stderr in the builder	Eelco Dolstra
	http://hydra.nixos.org/build/17862041
2014-10-14	nix-store -q: Check for conflicting flags	Eelco Dolstra
	Fixes #364.
2014-09-01	Add an 'optimiseStore' remote procedure call.	Ludovic Courtès

2014-08-20	Use pager for more commands	Eelco Dolstra

2014-08-20	Use proper quotes everywhere	Eelco Dolstra

2014-08-20	nix-store -l: Automatically pipe output into $PAGER	Eelco Dolstra

2014-08-13	Refactor option handling	Eelco Dolstra

2014-07-24	nix-copy-closure: Drop --bzip2, --xz, --show-progress	Eelco Dolstra
	These are too difficult to implement via nix-store --serve. ‘--show-progress’ could be re-implemented fairly easily via a sink/source wrapper class.
2014-07-24	Implement nix-copy-closure --from via nix-store --serve	Eelco Dolstra

2014-07-24	build-remote.pl: Be less verbose on failing builds	Eelco Dolstra

2014-07-24	nix-store --serve: Only monitor stdin during builds	Eelco Dolstra
	Other operations cannot hang indefinitely (except when we're reading from stdin, in which case we'll notice a client disconnect). But monitoring works badly during compressed imports, since there the client can close the connection before we've sent an ack. http://hydra.nixos.org/build/12711638
2014-07-23	Pass -pthread only for programs that need it	Eelco Dolstra

2014-07-23	nix-store --serve: Monitor for client disconnects	Eelco Dolstra
	This is necessary because build-remote.pl now builds via ‘nix-store --serve’. So if a build hangs without writing to stdout/stderr, and the client disconnects, then we need to detect that.
2014-07-14	build-remote.pl: Fix building multiple output derivations	Eelco Dolstra
	We were importing paths without sorting them topologically, leading to "path is not valid" errors. See e.g. http://hydra.nixos.org/build/12451761
2014-07-11	build-remote.pl: Use ‘nix-store --serve’ on the remote side	Eelco Dolstra
	This makes things more efficient (we don't need to use an SSH master connection, and we only start a single remote process) and gets rid of locking issues (the remote nix-store process will keep inputs and outputs locked as long as they're needed). It also makes it more or less secure to connect directly to the root account on the build machine, using a forced command (e.g. ‘command="nix-store --serve --write"’). This bypasses the Nix daemon and is therefore more efficient. Also, don't call nix-store to import the output paths.
2014-07-10	nix-copy-closure -s: Do substitutions via ‘nix-store --serve’	Eelco Dolstra
	This means we no longer need an SSH master connection, since we only execute a single command on the remote host.
2014-07-10	Refactoring: Move all fork handling into a higher-order function	Eelco Dolstra
	C++11 lambdas ftw.
2014-07-10	nix-copy-closure: Restore compression and the progress viewer	Eelco Dolstra

2014-07-10	nix-copy-closure: Fix race condition	Eelco Dolstra
	There is a long-standing race condition when copying a closure to a remote machine, particularly affecting build-remote.pl: the client first asks the remote machine which paths it already has, then copies over the missing paths. If the garbage collector kicks in on the remote machine between the first and second step, the already-present paths may be deleted. The missing paths may then refer to deleted paths, causing nix-copy-closure to fail. The client now performs both steps using a single remote Nix call (using ‘nix-store --serve’), locking all paths in the closure while querying. I changed the --serve protocol a bit (getting rid of QueryCommand), so this breaks the SSH substituter from older versions. But it was marked experimental anyway. Fixes #141.
2014-07-10	Fix security hole in ‘nix-store --serve’	Eelco Dolstra
	Since it didn't check that the path received from the client is a store path, the client could dump any path in the file system.
2014-05-21	nix-store -l: Fetch build logs from the Internet	Eelco Dolstra
	If a build log is not available locally, then ‘nix-store -l’ will now try to download it from the servers listed in the ‘log-servers’ option in nix.conf. For instance, if you have: log-servers = http://hydra.nixos.org/log then it will try to get logs from http://hydra.nixos.org/log/<base name of the store path>. So you can do things like: $ nix-store -l $(which xterm) and get a log even if xterm wasn't built locally.
2014-05-15	nix-store --optimise: Remove bogus statistics	Eelco Dolstra

2014-02-26	nix-store -r: Respect --add-root for non-derivations	Eelco Dolstra
	Fixes #68. Fixes #117.
2014-02-18	Add a flag ‘--check’ to verify build determinism	Eelco Dolstra
	The flag ‘--check’ to ‘nix-store -r’ or ‘nix-build’ will cause Nix to redo the build of a derivation whose output paths are already valid. If the new output differs from the original output, an error is printed. This makes it easier to test if a build is deterministic. (Obviously this cannot catch all sources of non-determinism, but it catches the most common one, namely the current time.) For example: $ nix-build '<nixpkgs>' -A patchelf ... $ nix-build '<nixpkgs>' -A patchelf --check error: derivation `/nix/store/1ipvxsdnbhl1rw6siz6x92s7sc8nwkkb-patchelf-0.6' may not be deterministic: hash mismatch in output `/nix/store/4pc1dmw5xkwmc6q3gdc9i5nbjl4dkjpp-patchelf-0.6.drv' The --check build fails if not all outputs are valid. Thus the first call to nix-build is necessary to ensure that all outputs are valid. The current outputs are left untouched: the new outputs are either put in a chroot or diverted to a different location in the store using hash rewriting.
2014-02-17	nix-store --gc --max-freed: Support a unit specifier	Eelco Dolstra
	E.g. "--max-freed 10G" means "free ten gigabytes".
2014-02-14	download-via-ssh: Use readStorePath	Eelco Dolstra

2014-02-14	Minor style fixes	Eelco Dolstra

2014-02-12	Indendation fix	Shea Levy
	Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-12	error messages start in lowercase	Shea Levy
	Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-10	nix-store --serve: Use a versioned protocol	Shea Levy
	Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-10	Move StoreApi::serve into opServe	Shea Levy
	Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-08	nix-store --serve: Use dump instead of export	Shea Levy
	Also remove signing support Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-08	Add the nix-store --serve command	Shea Levy
	This is essentially the substituter API operating on the local store, which will be used by the ssh substituter. It runs in a loop rather than just taking one command so that in the future nix will be able to keep one connection open for multiple instances of the substituter. Signed-off-by: Shea Levy <shea@shealevy.com>
2014-02-01	Remove Automakefiles	Eelco Dolstra

2014-02-01	Update Makefile variable names	Eelco Dolstra

2014-01-30	Rename Makefile -> local.mk	Eelco Dolstra

2014-01-21	Merge branch 'master' into make	Eelco Dolstra
	Conflicts: src/libexpr/eval.cc
2014-01-09	Update Makefiles	Eelco Dolstra

2013-12-20	Doh	Eelco Dolstra

2013-12-20	nix-shell: Handle --option correctly	Eelco Dolstra
	Fixes #181.
2013-11-25	Rename Makefile.new -> Makefile	Eelco Dolstra

2013-11-22	Support building dynamic libraries	Eelco Dolstra

2013-11-22	Rename $(here) to $(d) for brevity, and remove trailing slash	Eelco Dolstra

2013-11-22	New non-recursive, plain Make-based build system	Eelco Dolstra

2013-05-23	nix-store --export: Export paths in topologically sorted order	Eelco Dolstra
	Fixes #118.
2013-03-08	Revert "Prevent config.h from being clobbered"	Eelco Dolstra
	This reverts commit 28bba8c44f484eae38e8a15dcec73cfa999156f6.
2013-03-07	Prevent config.h from being clobbered	Eelco Dolstra

2013-02-26	Security: Don't allow builders to change permissions on files they don't own	Eelco Dolstra
	It turns out that in multi-user Nix, a builder may be able to do ln /etc/shadow $out/foo Afterwards, canonicalisePathMetaData() will be applied to $out/foo, causing /etc/shadow's mode to be set to 444 (readable by everybody but writable by nobody). That's obviously Very Bad. Fortunately, this fails in NixOS's default configuration because /nix/store is a bind mount, so "ln" will fail with "Invalid cross-device link". It also fails if hard-link restrictions are enabled, so a workaround is: echo 1 > /proc/sys/fs/protected_hardlinks The solution is to check that all files in $out are owned by the build user. This means that innocuous operations like "ln ${pkgs.foo}/some-file $out/" are now rejected, but that already failed in chroot builds anyway.
2013-01-30	Support the colonies	Eelco Dolstra

2013-01-22	Correctly handle missing logs	Eelco Dolstra