lix -

Age	Commit message (Collapse)	Author
2016-11-16	seccomp: Forge return codes for POSIX ACL syscalls	aszlig
	Commands such as "cp -p" also use fsetxattr() in addition to fchown(), so we need to make sure these syscalls always return successful as well in order to avoid nasty "Invalid value" errors. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-16	libstore/build: Forge chown() to return success	aszlig
	What we basically want is a seccomp mode 2 BPF program like this but for every architecture: BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, nr)), BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_chown, 4, 0), BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_fchown, 3, 0), BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_fchownat, 2, 0), BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_lchown, 1, 0), BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW), BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO) However, on 32 bit architectures we do have chown32, lchown32 and fchown32, so we'd need to add all the architecture blurb which libseccomp handles for us. So we only need to make sure that we add the 32bit seccomp arch while we're on x86_64 and otherwise we just stay at the native architecture which was set during seccomp_init(), which more or less replicates setting 32bit personality during runChild(). The FORCE_SUCCESS() macro here could be a bit less ugly but I think repeating the seccomp_rule_add() all over the place is way uglier. Another way would have been to create a vector of syscalls to iterate over, but that would make error messages uglier because we can either only print the (libseccomp-internal) syscall number or use seccomp_syscall_resolve_num_arch() to get the name or even make the vector a pair number/name, essentially duplicating everything again. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-16	Add build dependency for libseccomp	aszlig
	We're going to use libseccomp instead of creating the raw BPF program, because we have different syscall numbers on different architectures. Although our initial seccomp rules will be quite small it really doesn't make sense to generate the raw BPF program because we need to duplicate it and/or make branches on every single architecture we want to suuport. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-16	Run builds as root in user namespace again	aszlig
	This reverts commit ff0c0b645cc1448959126185bb2fafe41cf0bddf. We're going to use seccomp to allow "cp -p" and force chown-related syscalls to always return 0. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-14	Don't rely on %m	Eelco Dolstra

2016-11-14	daemon: Do not error out when deduplication fails due to ENOSPC.	Ludovic Courtès
	This solves a problem whereby if /gnu/store/.links had enough entries, ext4's directory index would be full, leading to link(2) returning ENOSPC. * nix/libstore/optimise-store.cc (LocalStore::optimisePath_): Upon ENOSPC from link(2), print a message and return instead of throwing a 'SysError'.
2016-11-13	Fix comments parsing	Guillaume Maudoux
	Fixed the parsing of multiline strings ending with an even number of stars, like / this /. Added test cases for comments.
2016-11-10	Store::computeFSClosure(): Support a set of paths	Eelco Dolstra
	This way, callers can exploits the parallelism of computeFSClosure() when they have multiple paths that they need the (combined) closure of.
2016-11-09	copyClosure() / copyStorePath(): Expose dontCheckSigs	Eelco Dolstra
	Needed by Hydra.
2016-11-09	Merge branch 'ssh-store' of https://github.com/shlevy/nix	Eelco Dolstra

2016-11-09	Implement backwards-compatible RemoteStore::addToStore()	Eelco Dolstra
	The SSHStore PR adds this functionality to the daemon, but we have to handle the case where the Nix daemon is 1.11. Also, don't require signatures for trusted users. This restores 1.11 behaviour. Fixes https://github.com/NixOS/hydra/issues/398.
2016-11-08	Typo	Eelco Dolstra

2016-11-07	Add missing #include	Eelco Dolstra

2016-10-31	Support optional sandbox paths	Eelco Dolstra
	For example, you can now set build-sandbox-paths = /dev/nvidiactl? to specify that /dev/nvidiactl should only be mounted in the sandbox if it exists in the host filesystem. This is useful e.g. for EC2 images that should support both CUDA and non-CUDA instances.
2016-10-27	Add nix.conf options for -k and -K	Shea Levy
	Fixes #1084
2016-10-26	Fix SIGFPE from integer overflow during division	Tuomas Tynkkynen
	On some architectures (like x86_64 or i686, but not ARM for example) overflow during integer division causes a crash due to SIGFPE. Reproduces on a 64-bit system with: nix-instantiate --eval -E '(-9223372036854775807 - 1) / -1' The only way this can happen is when the smallest possible integer is divided by -1, so just special-case that.
2016-10-26	Fix build log output in nix-store --serve	Eelco Dolstra

2016-10-26	Restore the CachedFailure status code	Eelco Dolstra
	The removal of CachedFailure caused the value of TimedOut to change, which broke timed-out handling in Hydra (so timed-out builds would show up as "aborted" and would be retried, e.g. at http://hydra.nixos.org/build/42537427).
2016-10-21	Remove addPathToAccessor	Eelco Dolstra

2016-10-21	BinaryCacheStore: Optionally write a NAR listing	Eelco Dolstra
	The store parameter "write-nar-listing=1" will cause BinaryCacheStore to write a file ‘<store-hash>.ls.xz’ for each ‘<store-hash>.narinfo’ added to the binary cache. This file contains an XZ-compressed JSON file describing the contents of the NAR, excluding the contents of regular files. E.g. { "version": 1, "root": { "type": "directory", "entries": { "lib": { "type": "directory", "entries": { "Mcrt1.o": { "type": "regular", "size": 1288 }, "Scrt1.o": { "type": "regular", "size": 3920 }, } } } ... } } (The actual file has no indentation.) This is intended to speed up the NixOS channels programs index generator [1], since fetching gazillions of large NARs from cache.nixos.org is currently a bottleneck for updating the regular (non-small) channel. [1] https://github.com/NixOS/nixos-channel-scripts/blob/master/generate-programs-index.cc
2016-10-19	Merge branch 'priorityqueue' of https://github.com/groxxda/nix	Eelco Dolstra

2016-10-19	Merge branch 'regex' of https://github.com/groxxda/nix	Eelco Dolstra

2016-10-19	fixup! replace own regex class with std::regex	Alexander Ried

2016-10-19	Fix Darwin build	Eelco Dolstra
	Done slightly differently from https://github.com/NixOS/nix/pull/1093.
2016-10-19	Shut up clang warning	Eelco Dolstra

2016-10-19	Fix uninitialised variable	Eelco Dolstra

2016-10-18	replace own regex class with std::regex	Alexander Ried

2016-10-18	downloader: use priority_queue	Alexander Ried

2016-10-14	Fix /dev/ptmx in sandboxes	Eelco Dolstra
	This was broken since ff0c0b645cc1448959126185bb2fafe41cf0bddf. Since I can't figure out how to mount a devpts instance in the sandbox, let's just bind-mount the host devpts.
2016-10-14	CURL_AT_LEAST_VERSION -> LIBCURL_VERSION_NUM	Eelco Dolstra
	http://hydra.nixos.org/build/42025230
2016-10-13	Fix HTTP/2 support	Eelco Dolstra
	Commit 86e8c67efc33cf756500a1dec7fd6313658f2664 broke it, because CURL_* are not actually #defines.
2016-10-13	SSL_CERT_FILE -> NIX_SSL_CERT_FILE	Eelco Dolstra
	This prevents collisions with the "native" OpenSSL, in particular on OS X. Fixes #921.
2016-10-12	Shut up some warnings	Eelco Dolstra

2016-10-12	Add some functions needed by hydra	Eelco Dolstra

2016-10-07	querySubstitutablePaths(): Don't query paths for which we already have a ↵	Eelco Dolstra
	substituter
2016-10-07	LocalStore::querySubstitutablePaths(): Implement using queryValidPaths()	Eelco Dolstra

2016-10-07	Store::queryValidPaths(): Use async queryPathInfo()	Eelco Dolstra
	This allows the binary cache substituter to pipeline requests.
2016-10-07	Implement generic Store::queryValidPaths()	Eelco Dolstra

2016-10-07	Add copyClosure utility function for Hydra	Eelco Dolstra

2016-10-07	importPaths(): Fix accessor support for Hydra	Eelco Dolstra

2016-10-06	toJSON(): Support some more types	Eelco Dolstra

2016-10-06	Fix getS3Stats()	Eelco Dolstra

2016-10-06	Merge pull request #998 from veprbl/rx_chmod_fix	Eelco Dolstra
	override rx directory permissions in deletePath()
2016-10-05	Use std::random_device	Eelco Dolstra

2016-10-04	Fix build with older versions of libcurl	Eelco Dolstra

2016-09-22	Handle the case where signed-binary-caches consists of whitespace	Eelco Dolstra

2016-09-21	Add sandbox-dev-shm-size option	Eelco Dolstra
	Fixes #1069.
2016-09-21	nix-build, nix-shell: Don't print error message if nix-store/nix-instantiate ↵	Eelco Dolstra
	fails
2016-09-21	printMsg(lvlError, ...) -> printError(...) etc.	Eelco Dolstra

2016-09-21	Some notational convenience for formatting strings	Eelco Dolstra
	We can now write throw Error("file '%s' not found", path); instead of throw Error(format("file '%s' not found") % path); and similarly printError("file '%s' not found", path); instead of printMsg(lvlError, format("file '%s' not found") % path);