aboutsummaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)Author
2024-04-26ssh-ng: Set log-fd for ssh to `4` by defaultMaximilian Bosch
That's expected by `build-remote` and makes sure that errors are correctly forwarded to the user. For instance, let's say that the host-key of `example.org` is unknown and nix-build ../nixpkgs -A hello -j0 --builders 'ssh-ng://example.org' is issued, then you get the following output: cannot build on 'ssh-ng://example.org?&': error: failed to start SSH connection to 'example.org' Failed to find a machine for remote build! derivation: yh46gakxq3kchrbihwxvpn5bmadcw90b-hello-2.12.1.drv required (system, features): (x86_64-linux, []) 2 available machines: [...] The relevant information (`Host key verification failed`) ends up in the daemon's log, but that's not very obvious considering that the daemon isn't very chatty normally. This can be fixed - the same way as its done for legacy-ssh - by passing fd 4 to the SSH wrapper. Now you'd get the following error: cannot build on 'ssh-ng://example.org': error: failed to start SSH connection to 'example.org': Host key verification failed. Failed to find a machine for remote build! [...] ...and now it's clear what's wrong. Please note that this is won't end up in the derivation's log. For previous discussion about this change see https://github.com/NixOS/nix/pull/7659. Change-Id: I5790856dbf58e53ea3e63238b015ea06c347cf92
2024-04-18meson: correctly embed sandbox shell when askedQyriad
Change-Id: I2f6c0d42245204a516d2e424eea26a6391e975ad
2024-04-18meson: correctly set -DSANDBOX_SHELL if we have itQyriad
The statically embedded busybox is not required for Lix to work, but package.nix explicitly sets this, which was accidentally being ignored. Change-Id: Ieeff830ac7d1f5fabe84d1a6cfd82f13d79035bf
2024-04-16Merge "libstore/build: set NO_NEW_PRIVS for the sandbox" into mainIlya K
2024-04-15fix probable format bug in DerivationGoal::buildDoneQyriad
Either the contents of `line` could cause format errors, or this usage is Technically safe. However, I trust nothing, especially with boost::format. Change-Id: I07933b20bde3b305a6e5d61c2a7bab6ecb042ad9
2024-04-15abort with a descriptive message on bad HintFmt usageQyriad
Change-Id: Ic2f05572042343a8160fd971394372f5f2706fc4
2024-04-15libstore/build: set NO_NEW_PRIVS for the sandboxK900
Change-Id: I711f64e2b68495ed9c85c1a4bd5025405805e43a
2024-04-14don't throw an exception for the trivial case of isStorePath()...Qyriad
Previously if isStorePath() was called on anything other than a top-level /nix/store/some-path, it would throw a BadStorePath exception. This commit duplicates the absolutely trivial check, into maybeParseStorePath(), and leaves exception throwing to parseStorePath(), the function that assumes you're already giving a valid path instead of the one whose purpose is to check if its valid or not... Change-Id: I8dda548f0f88d14ca8c3ee927d64e0ec0681fc7b
2024-04-14Merge "don't boost::to_few_args when an eval cached string type errors" into ↵Qyriad
main
2024-04-13libstore/build: just copy the magic /etc files into the sandboxK900
Saves us a bunch of thinking about how to handle symlinks, and prevents the DNS config from changing on the fly under the build, which may or may not be a good thing? Change-Id: I071e6ae7e220884690b788d94f480866f428db71
2024-04-11Merge "Merge pull request #10456 from NixOS/fixpermdeniedbind" into mainIlya K
2024-04-11Merge changes Iedf46484,I76b51eac,I6a084827,I60193f9f into maineldritch horrors
* changes: meson: fix log-dir manual: build docs with dummy envs libcmd: install generated headers as well docs: redo content generation for mdbook and manual
2024-04-11Merge "Merge pull request #10362 from obsidiansystems/maybeLstat" into mainIlya K
2024-04-11libcmd: install generated headers as welleldritch horrors
these seem to have been forgotten. Change-Id: I6a084827d087f8098c19b62f2060a874d87202a1
2024-04-11docs: redo content generation for mdbook and manualeldritch horrors
manpages can be rendered using the markdown output of mdbook, the rest of the manual can generated out of the main doc/manual source tree. we still use lowdown to actually render manpages instead of eg mdbook-man because lowdown does generate reasonably good manpages (though that is also somewhat debatable, but they're a lot better than mdbook-man). doing this not only lets us drastically simplify the lowdown pipeline, but also remove all custom {{#include}} handling since now mdbook does all of it, even for the manpage builds. even the lowdown wrapper isn't entirely necessary because lowdown can take all wrapper arguments with command line flags rather than bits of input file content. This also implements running mdbook in Meson, in order to generate the manpages. The mdbook outputs are also installed in the usual location. Co-authored-by: Qyriad <qyriad@qyriad.me> Change-Id: I60193f9fd0f15d48872f071af35855cda2a0f40b
2024-04-11Merge pull request #10456 from NixOS/fixpermdeniedbindThéophane Hufschmitt
Fix adding symlink to the sandbox paths (cherry-picked from commit da1e977bf48cff2a635034c85e7c13878e38efc2) Change-Id: I221c85a38180800ec6552d2e86a88df48398fad8
2024-04-11Merge pull request #10362 from obsidiansystems/maybeLstatJohn Ericson
Factor out `nix::maybeLstat` (cherry-picked from commit 9b88e5284608116b7db0dbd3d5dd7a33b90d52d7) Change-Id: Id890525e847c890fad6593c594772826ac4d1d50
2024-04-11libstore: fix glossary link in documentationeldritch horrors
this should be a link, not an anchor. it should also point to the `gloss-store` element, not the `#gloss-store` element. Change-Id: I1f2803093179549637e10f917ad73399a419131b
2024-04-10don't boost::to_few_args when an eval cached string type errorsQyriad
Change-Id: Id3cb762622e156ceaf9d5bb95c2c704ffe474d0e
2024-04-10Merge "Print top-level errors normally in `nix repl`" into mainrebecca “wiggles” turner
2024-04-09Print top-level errors normally in `nix repl`Rebecca Turner
Previously, errors while printing values in `nix repl` would be printed in `«error: ...»` brackets rather than displayed normally: ``` nix-repl> legacyPackages.aarch64-darwin.pythonPackages.APScheduler «error: Package ‘python-2.7.18.7’ in /nix/store/6s0m1qc31zw3l3kq0q4wd5cp3lqpkq0q-source/pkgs/development/interpreters/python/cpython/2.7/default.nix:335 is marked as insecure, refusing to evaluate.» ``` Now, errors will be displayed normally if they're emitted at the top-level of an expression: ``` nix-repl> legacyPackages.aarch64-darwin.pythonPackages.APScheduler error: … in the condition of the assert statement at /nix/store/6s0m1qc31zw3l3kq0q4wd5cp3lqpkq0q-source/lib/customisation.nix:268:17: 267| in commonAttrs // { 268| drvPath = assert condition; drv.drvPath; | ^ 269| outPath = assert condition; drv.outPath; … in the left operand of the OR (||) operator at /nix/store/6s0m1qc31zw3l3kq0q4wd5cp3lqpkq0q-source/pkgs/development/interpreters/python/passthrufun.nix:28:45: 27| if lib.isDerivation value then 28| lib.extendDerivation (valid value || throw "${name} should use `buildPythonPackage` or `toPythonModule` if it is to be part of the Python packages set.") {} value | ^ 29| else (stack trace truncated; use '--show-trace' to show the full trace) error: Package ‘python-2.7.18.7’ in /nix/store/6s0m1qc31zw3l3kq0q4wd5cp3lqpkq0q-source/pkgs/development/interpreters/python/cpython/2.7/default.nix:335 is marked as insecure, refusing to evaluate. ``` Errors emitted in nested structures (like e.g. when printing `nixpkgs`) will still be printed in brackets. Change-Id: I25aeddf08c017582718cb9772a677bf51b9fc2ad
2024-04-09meson: correctly set NIX_CONF_DIR to $sysconfdir/nixQyriad
Instead of $sysconfdir. Fixes #231, but there's more to do in following commits to make Meson-built Lix actually look in /etc/nix. Change-Id: Ia8d627070f405843add46e05cff5134b76b8eb48
2024-04-09format repl-overlays.nix to fix pre-commit checksQyriad
Change-Id: I9487f5832160c1093d8752f883c1be85f8310e0f
2024-04-09Merge "Add `repl-overlays`" into mainrebecca “wiggles” turner
2024-04-08Add `repl-overlays`Rebecca Turner
Adds a `repl-overlays` option, which specifies files that can overlay and modify the top-level bindings in `nix repl`. For example, with the following contents in `~/.config/nix/repl.nix`: info: final: prev: let optionalAttrs = predicate: attrs: if predicate then attrs else {}; in optionalAttrs (prev ? legacyPackages && prev.legacyPackages ? ${info.currentSystem}) { pkgs = prev.legacyPackages.${info.currentSystem}; } We can run `nix repl` and use `pkgs` to refer to `legacyPackages.${currentSystem}`: $ nix repl --repl-overlays ~/.config/nix/repl.nix nixpkgs Lix 2.90.0 Type :? for help. Loading installable 'flake:nixpkgs#'... Added 5 variables. Loading 'repl-overlays'... Added 6 variables. nix-repl> pkgs.bash «derivation /nix/store/g08b5vkwwh0j8ic9rkmd8mpj878rk62z-bash-5.2p26.drv» Change-Id: Ic12e0f2f210b2f46e920c33088dfe1083f42391a
2024-04-08pragma once and ///@file everything missing itJade Lovelace
Change-Id: Ia1a72348336794b5fb9f2694dd750266089b904e
2024-04-08"but doctor, I AM the untrusted store": nix doctor had wrong trustednessJade Lovelace
This probably snuck in in a refactor using truthiness or so. The trustedness flag was having the optional fullness checked, rather than the actual contained trust level. Also adds some tests. ``` m1@6876551b-255d-4cb0-af02-8a4f17b27e2e ~ % nix store ping warning: 'nix store ping' is a deprecated alias for 'nix store info' Store URL: daemon Version: 2.20.4 Trusted: 0 m1@6876551b-255d-4cb0-af02-8a4f17b27e2e ~ % nix doctor warning: 'doctor' is a deprecated alias for 'config check' [PASS] PATH contains only one nix version. [PASS] All profiles are gcroots. [PASS] Client protocol matches store protocol. [INFO] You are trusted by store uri: daemon ``` Fixes: https://git.lix.systems/lix-project/lix/issues/232 Change-Id: I21576e2a0a755036edf8814133345987617ba3d0
2024-04-08Format Nix code with `nixfmt`Rebecca Turner
Change-Id: I61efeb666ff7481c05fcb247168290e86a250151
2024-04-08Merge "nix-doc -> lix-doc, make self-contained in package.nix" into mainjade
2024-04-08Merge "Add `PathsSetting`" into mainrebecca “wiggles” turner
2024-04-08nix-doc -> lix-doc, make self-contained in package.nixJade Lovelace
package.nix previously needed this callPackage'd externally, which didn't make a lot of sense to us since this is an internal dependency. Thus we changed it to make it more self contained. Change-Id: I4935bc0bc80e1a132bc9b1519e917791da95037c
2024-04-07Merge pull request #10208 from 9999years/print-strings-directlyRobert Hensing
`:print` strings directly in `nix repl` (cherry picked from commit 3539172fd2f7cee639ce46423c58beca4231f2db) Change-Id: I1972f3bf3b56312851f38288509d371d37f21677 Upstream-PR: https://github.com/NixOS/nix/pull/10208
2024-04-07Add `PathsSetting`Rebecca Turner
Change-Id: I1165f6ef033a5f757ca3716d3f8008ba36b01fd0
2024-04-06avoid markdown which the repl's :doc cannot handlestuebinm
code blocks, if not surrounded by empty lines, have the language tags (in these cases, always `nix`) show up in the output of :doc. for example: nix-repl> :doc builtins.parseFlakeRef Synopsis: builtins.parseFlakeRef flake-ref Parse a flake reference, and return its exploded form. For example: nix builtins.parseFlakeRef "github:NixOS/nixpkgs/23.05?dir=lib" evaluates to: nix { dir = "lib"; owner = "NixOS"; ref = "23.05"; repo = "nixpkgs"; type = "github"; } is now instead: nix-repl> :doc builtins.parseFlakeRef Synopsis: builtins.parseFlakeRef flake-ref Parse a flake reference, and return its exploded form. For example: | builtins.parseFlakeRef "github:NixOS/nixpkgs/23.05?dir=lib" evaluates to: | { dir = "lib"; owner = "NixOS"; ref = "23.05"; repo = "nixpkgs"; type = "github"; } (closes #225) Change-Id: I0741aeb1006a5376bb2f663d202c7a4da7e38cce
2024-04-06always re-eval cached failuresQyriad
This is terrible UX, and frankly an eval failure should be a cache invalidation anyway. This removes the CachedEvalError type entirely. Fixes #223. Change-Id: I91f8003eabd0ea45003024e96d1de3c7ae8e49d8
2024-04-05Revert "libutil: drop Pool resources on exceptional free"eldritch horrors
This reverts commit de2884b82b376d10de5c400d8e73bc7d98f195d2. Change-Id: I1fa301149d7c2ed3d266a40c15b2d010e12e44e6
2024-04-05Revert "libutil: remove Pool::Handle::bad"eldritch horrors
This reverts commit 792844fb861ea7367ac2316c78fec055363f2f9e. Change-Id: I3ca208b62edfd5cd1199478f75cd2edf19a364f6
2024-04-05Revert "libstore: remove one Resource::good flag"eldritch horrors
This reverts commit 87249eb579bf57f4f09e9fca100588a4d6b90b4c. Change-Id: Ide4c6e00c4155216a17e46671ff47151d7bb85b4
2024-04-05Revert "libstore: using throwing finally in withFramedSink"eldritch horrors
This reverts commit 491caad6f62c21ffbcdebe662e63ec0f72e6f3a2. this is not actually legal for nix! throwing exceptions in destructors is fine, but the way nix is set up we'll end up throwing the exception we received from the remote *twice* in some cases, and such cases will cause an immediate terminate without active exception. Change-Id: I74c46b9f26fd791086e4193ec60eb1deb9a5bb2a
2024-04-05Revert "libutil: allow graceful dropping of Pool::Handle"eldritch horrors
This reverts commit 8075541d82d05347321d35b9934ccee5f82142f4. Change-Id: I05fa6a9de1308a4827a6557cf2807eb47ca64da6
2024-04-05Revert "libutil: drop Fs{Source,Sink}::good"eldritch horrors
This reverts commit 1340807e30dba4b3972c31f02861bbaeaeb60e61. Change-Id: I34d2a80eb3c3e9d79cb02b92cd1189da32d18cb6
2024-04-05libutil: guard Finally against invalid exception throwseldritch horrors
throwing exceptions is fine, but throwing exceptions during exception handling is hard enough to do correctly that we should just forbid it entirely out of an overabundance of caution. in cases where terminate is the correct answer the users of Finally must call it manually now. Change-Id: Ia51a2cb4a0638500550bfabc89cf01a6d8098983
2024-04-04Merge "Add `EscapeStringOptions` and `escapeString` tests" into mainrebecca “wiggles” turner
2024-04-03repl: improve `:doc` builtin repl command to support lambdas.Lunaphied
For a long time `nix repl` has supported displaying documentation set on builtins, however, it has long been convention to use Markdown comments on Nix functions themselves for documentation. This exposes that information to `nix repl` users in a nice and formatted way. NixOS/rfcs#145 doc-comments are primarily what this feature is intended to consume, however, support for lambda documentation in the repl is experimental. We do our best effort to support the RFC here. These changes are based on [the nix-doc library](https://github.com/lf-/nix-doc) and are licensed under the terms described in the relevant source files. Change-Id: Ic6fe947d39a22540705d890737e336c4720b0a22
2024-04-03Add `EscapeStringOptions` and `escapeString` testsRebecca Turner
Change-Id: I86ead2f969c9e03c9edfa51bbc92ee06393fd7d6
2024-04-01libexpr/flake: don't purple the flake.lock diffK900
Change-Id: I6f9471fb0ddd51fadb209ad970abd215238ba5c4
2024-03-31Merge pull request #9920 from 9999years/forbid-nested-debuggersThéophane Hufschmitt
Forbid nested debuggers (cherry picked from commit e164b39ee90fd655dbb7f479fdd4fbe38cc883bd) Change-Id: Iff62f40fd251116516a63e2d3f9fb5b21480b16d
2024-03-31libutil: drop Fs{Source,Sink}::goodeldritch horrors
setting this only on exceptions caused by actual fd access is not sufficient to diagnose all errors (such as SerialisationError) in some cases. this usually does not have any negative effects since those errors will end up killing the process in another way. this is not a reliable assumption though and we should be using proper error handling (and closing connections more often, preferring to close over keeping something open that might be in a weird state) Change-Id: I1b792cd7ad8ba9ff0f6bd174945ab2575ff2208e
2024-03-31libutil: allow graceful dropping of Pool::Handleeldritch horrors
not needed yet, but returning a resource from the exception handling path that has ownership of a handle is currently not well-supported. we could also add a default constructor to Handle, but then we would also need to change the pool reference to a pointer. eventually that should be done since now resources can be swapped between pools with clever moves, but since that's not a problem yet we won't do it now. Change-Id: I26eb06581f7be34569e9e67a33da736128d167af
2024-03-31Merge changes Ib62d3d68,Ic3e7affe into mainjade
* changes: Make things that can throw not noexcept anymore Fix various clang-tidy lints