lix -

Age	Commit message (Collapse)	Author
2017-07-14	StorePathsCommand: Don't build installables	Eelco Dolstra
	On second though this was annoying. E.g. "nix log nixpkgs.hello" would build/download Hello first, even though the log can be fetched directly from the binary cache. May need to revisit this.
2017-07-14	nix: Show help when no arguments are given	Eelco Dolstra
	Fixes #1464.
2017-07-14	Shut up a memory leak warning	Eelco Dolstra

2017-07-11	replaceSymlink(): Handle the case where the temporary file already exists	Eelco Dolstra
	Not really necessary anymore for #849, but still nice to have.
2017-07-11	fetchTarball: Prevent concurrent downloads of the same file	Eelco Dolstra
	Fixes #849.
2017-07-10	Merge pull request #1422 from nh2/fix-potential-hash-comparison-crash	Eelco Dolstra
	Fix potential crash/wrong result two hashes of unequal length are compared
2017-07-10	Merge pull request #1428 from rimmington/clearer-regex-space-error	Eelco Dolstra
	Clearer error message when regex exceeds space limit
2017-07-10	Clearer error message when regex exceeds space limit	Rhys

2017-07-07	Merge pull request #1445 from matthewbauer/macos-skip-hardlink	Eelco Dolstra
	Don’t hardlink disallowed paths in OS X.
2017-07-06	Don’t hardlink disallowed paths in OS X.	Matthew Bauer
	Fixes #1443
2017-07-04	Add X32 to the seccomp filter	Eelco Dolstra
	Fixes #1432.
2017-07-04	Sort substituters by priority	Eelco Dolstra
	Fixes #1438.
2017-07-04	getDefaultSubstituters(): Simplify initialisation	Eelco Dolstra
	As shlevy pointed out, static variables in C++11 have thread-safe initialisation.
2017-07-04	Add allow-new-privileges option	Eelco Dolstra
	This allows builds to call setuid binaries. This was previously possible until we started using seccomp. Turns out that seccomp by default disallows processes from acquiring new privileges. Generally, any use of setuid binaries (except those created by the builder itself) is by definition impure, but some people were relying on this ability for certain tests. Example: $ nix build '(with import <nixpkgs> {}; runCommand "foo" {} "/run/wrappers/bin/ping -c 1 8.8.8.8; exit 1")' --no-allow-new-privileges builder for ‘/nix/store/j0nd8kv85hd6r4kxgnwzvr0k65ykf6fv-foo.drv’ failed with exit code 1; last 2 log lines: cannot raise the capability into the Ambient set : Operation not permitted $ nix build '(with import <nixpkgs> {}; runCommand "foo" {} "/run/wrappers/bin/ping -c 1 8.8.8.8; exit 1")' --allow-new-privileges builder for ‘/nix/store/j0nd8kv85hd6r4kxgnwzvr0k65ykf6fv-foo.drv’ failed with exit code 1; last 6 log lines: PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=46 time=15.2 ms Fixes #1429.
2017-07-04	Fix handling of expression installables with a / in them	Eelco Dolstra

2017-07-04	Support base-64 hashes	Eelco Dolstra
	Also simplify the Hash API. Fixes #1437.
2017-07-03	nix-shell: Respect --dry-run	Eelco Dolstra
	Fixes #824.
2017-07-03	Replace a few bool flags with enums	Eelco Dolstra
	Functions like copyClosure() had 3 bool arguments, which creates a severe risk of mixing up arguments. Also, implement copyClosure() using copyPaths().
2017-07-03	processGraph(): Call getEdges in parallel	Eelco Dolstra

2017-06-24	Fix potential crash/wrong result two hashes of unequal length are compared	Niklas Hambüchen

2017-06-20	Call SetDllDirectory("") after sqlite3 init on cygwin	David McFarland
	Cygwin sqlite3 is patched to call SetDllDirectory("/usr/bin") on init, which affects the current process and is inherited by child processes. It causes DLLs to be loaded from /usr/bin/ before $PATH, which breaks all sorts of things. A typical failures would be header/lib version mismatches (e.g. openssl when running checkPhase on openssh). We'll just set it back to the default value. Note that this is a problem with the cygwin version of sqlite3 (currently 3.18.0). nixpkgs doesn't have the problematic patch.
2017-06-20	Restore thunks on any exception	Eelco Dolstra
	There's no reason to restrict this to Error exceptions. This shouldn't matter to #1407 since the repl doesn't catch non-Error exceptions anyway, but you never know...
2017-06-19	Disable use of virtual hosting in aws-sdk-cpp	Eelco Dolstra
	Recently aws-sdk-cpp quietly switched to using S3 virtual host URIs (https://github.com/aws/aws-sdk-cpp/commit/69d9c53882), i.e. it sends requests to http://<bucket>.<region>.s3.amazonaws.com rather than http://<region>.s3.amazonaws.com/<bucket>. However this interacts badly with curl connection reuse. For example, if we do the following: 1) Check whether a bucket exists using GetBucketLocation. 2) If it doesn't, create it using CreateBucket. 3) Do operations on the bucket. then 3) will fail for a minute or so with a NoSuchBucket exception, presumably because the server being hit is a fallback for cases when buckets don't exist. Disabling the use of virtual hosts ensures that 3) succeeds immediately. (I don't know what S3's consistency guarantees are for bucket creation, but in practice buckets appear to be available immediately.)
2017-06-19	Support creating S3 caches in other regions than us-east-1	Eelco Dolstra

2017-06-19	Handle S3Errors::RESOURCE_NOT_FOUND from aws-sdk-cpp	Eelco Dolstra
	This is returned by recent versions. Also handle NO_SUCH_KEY even though the library doesn't actually return that at the moment.
2017-06-19	Suppress "will retry in N ms" for non-retriable errors	Eelco Dolstra
	Newer versions of aws-sdk-cpp call CalculateDelayBeforeNextRetry() even for non-retriable errors (like NoSuchKey) whih causes log spam in hydra-queue-runner.
2017-06-19	Show aws-sdk-cpp log messages	Eelco Dolstra

2017-06-19	macOS: Ugly hack to make the tests succeed	Eelco Dolstra
	Sandboxes cannot be nested, so if Nix's build runs inside a sandbox, it cannot use a sandbox itself. I don't see a clean way to detect whether we're in a sandbox, so use a test-specific hack. https://github.com/NixOS/nix/issues/1413
2017-06-19	macOS: Remove flags	Eelco Dolstra
	In particular, UF_IMMUTABLE (uchg) needs to be cleared to allow the path to be garbage-collected or optimised. See https://github.com/NixOS/nixpkgs/issues/25819. + the file from being garbage-collected.
2017-06-14	Remove redundant debug line	Eelco Dolstra

2017-06-14	canonicalisePathMetaData(): Ignore security.selinux attribute	Eelco Dolstra
	Untested, hopefully fixes #1406.
2017-06-12	Suppress spurious "killing process N: Operation not permitted" on macOS	Eelco Dolstra

2017-06-12	On macOS, don't use /var/folders for TMPDIR	Eelco Dolstra
	This broke "nix-store --serve".
2017-06-12	Provide a builtin default for $NIX_SSL_CERT_FILE	Eelco Dolstra
	This is mostly to ensure that when Nix is started on macOS via a launchd service or sshd (for a remote build), it gets a certificate bundle.
2017-06-12	Don't run pre-build-hook if we don't have a derivation	Eelco Dolstra
	This fixes a build failure on OS X when using Hydra or Nix 1.12's build-remote (since they don't copy the derivation to the build machine).
2017-06-07	Don't show flags from config settings in "nix --help"	Eelco Dolstra

2017-06-07	nix: Add --help-config flag	Eelco Dolstra

2017-06-07	nix: Make all options available as flags	Eelco Dolstra
	Thus, instead of ‘--option <name> <value>’, you can write ‘--<name> <value>’. So --option http-connections 100 becomes --http-connections 100 Apart from brevity, the difference is that it's not an error to set a non-existent option via --option, but unrecognized arguments are fatal. Boolean options have special treatment: they're mapped to the argument-less flags ‘--<name>’ and ‘--no-<name>’. E.g. --option auto-optimise-store false becomes --no-auto-optimise-store
2017-06-06	Disable the build user mechanism on all platforms except Linux and OS X	Eelco Dolstra

2017-06-06	Always use the Darwin sandbox	Eelco Dolstra
	Even with "build-use-sandbox = false", we now use sandboxing with a permissive profile that allows everything except the creation of setuid/setgid binaries.
2017-05-31	Remove listxattr assertion	Eelco Dolstra
	It appears that sometimes, listxattr() returns a different value for the query case (i.e. when the buffer size is 0).
2017-05-31	OS X sandbox: Improve builtin sandbox profile	Eelco Dolstra
	Also, add rules to allow fixed-output derivations to access the network. These rules are sufficient to build stdenvDarwin without any __sandboxProfile magic.
2017-05-31	resolve-system-dependencies: Misc fixes	Eelco Dolstra
	This fixes Could not find any mach64 blobs in file ‘/usr/lib/libSystem.B.dylib’, continuing...
2017-05-31	resolve-system-dependencies: Simplify	Eelco Dolstra

2017-05-31	OS X sandbox: Don't use a deterministic $TMPDIR	Eelco Dolstra
	This doesn't work because the OS X sandbox cannot bind-mount path to a different location.
2017-05-31	OS X sandbox: Store .sb file in $TMPDIR rather than the Nix store	Eelco Dolstra
	The filename used was not unique and owned by the build user, so builds could fail with error: while setting up the build environment: cannot unlink ‘/nix/store/99i210ihnsjacajaw8r33fmgjvzpg6nr-bison-3.0.4.drv.sb’: Permission denied
2017-05-30	resolve-system-dependencies: Fix another segfault	Eelco Dolstra
	runResolver() was barfing on directories like /System/Library/Frameworks/Security.framework/Versions/Current/PlugIns. It should probably do something sophisticated for frameworks, but let's ignore them for now.
2017-05-30	Darwin sandbox: Use sandbox-defaults.sb	Eelco Dolstra
	Issue #759. Also, remove nix.conf from the sandbox since I don't really see a legitimate reason for builders to access the Nix configuration.
2017-05-30	Darwin sandbox: Disallow creating setuid/setgid binaries	Eelco Dolstra
	Suggested by Daiderd Jordan.
2017-05-30	resolve-system-dependencies: Several fixes	Eelco Dolstra
	This fixes error: getting attributes of path ‘Versions/Current/CoreFoundation’: No such file or directory when /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation is a symlink. Also fixes a segfault when encounting a file that is not a MACH binary (such as /dev/null, which is included in __impureHostDeps in Nixpkgs). Possibly fixes #786.