aboutsummaryrefslogtreecommitdiff
path: root/src
AgeCommit message (Collapse)Author
2017-01-16assign environ to a temp variable to ensure livenessJude Taylor
2017-01-16AutoCloseDir: Use std::unique_ptrEelco Dolstra
2017-01-16AutoDeleteArray -> std::unique_ptrEelco Dolstra
Also, switch to C++14 for std::make_unique.
2017-01-16nix-build: Use showManPage() and printVersion()Eelco Dolstra
2017-01-10builtins.readFile: Put the references of the file, not those needed to ↵Shea Levy
realize the file, into the context
2017-01-10build-remote: Don't use C++ streams to read the conf fileShea Levy
2017-01-10build-remote: Use std::set for feature setsShea Levy
2017-01-09Merge pull request #1139 from Mic92/masterEelco Dolstra
Simplify remouting with MS_PRIVATE in sandbox build
2017-01-07nix-shell: Fix 'nix-shell --command' doing nothing without TTYTuomas Tynkkynen
Regression from a5f2750e ("Fix early removal of rc-file for nix-shell"). The removal of BASH_ENV causes nothing to be executed by bash if it detects itself in a non-interactive context. Instead, just use the same condition used by bash to launch bash differently. According to bash sources, the condition (stdin and stder both must be TTYs) is specified by POSIX so this should be pretty safe to rely on. Fixes #1171 on master, needs a backport to the Perl code in 1.11.
2017-01-03nix-shell: In #! mode, pass the last argumentEelco Dolstra
"i < argc - 1" should be "i < argc".
2017-01-03nix-shell: Don't act interactive in shebangsTuomas Tynkkynen
I had observed that 'bash --rcfile' would do nothing in a non-interactive context and cause nothing to be executed if a script using nix-shell shebangs were run in a non-interactive context.
2017-01-03nix-shell: Fix 'nix-shell -i'Tuomas Tynkkynen
The 'args' variable here is shadowing one in the outer scope and its contents end up unused. This causes any '#! nix-shell' lines to effectively be ignored. The intention here was to clear the args vector, as far as I can tell (and it seems to work).
2017-01-02Provide /var/run/nscd/socket in the sandboxEelco Dolstra
Otherwise sandbox builds can fail, e.g. $ NIX_REMOTE=local?root=/tmp/nix nix-build '<nixpkgs>' -A hello --option build-use-substitutes false ... downloading ‘http://ftpmirror.gnu.org/bash/bash-4.3-patches/bash43-047’... error: unable to download ‘http://ftpmirror.gnu.org/bash/bash-4.3-patches/bash43-047’: Couldn't resolve host name (6)
2016-12-22Call Aws::InitAPIEelco Dolstra
This is required now.
2016-12-22Add commentEelco Dolstra
2016-12-19Revert "Merge branch 'seccomp' of https://github.com/aszlig/nix"Eelco Dolstra
This reverts commit 9f3f2e21edb17dbcd674539dff96efb6cceca10c, reversing changes made to 47f587700d646f5b03a42f2fa57c28875a31efbe.
2016-12-19Revert "Give root a valid home directory"Eelco Dolstra
This reverts commit ec7d498b72b0e283814c27cbc6c064496f95445d.
2016-12-15Give root a valid home directoryEelco Dolstra
Some programs barf if the current user has a non-writable home directory, e.g. http://hydra.nixos.org/build/44818144.
2016-12-15Merge branch 'master' of github.com:NixOS/nixEelco Dolstra
2016-12-15Merge branch 'seccomp' of https://github.com/aszlig/nixEelco Dolstra
2016-12-13Merge branch 'base32-overflow' of git://github.com/vcunat/nixShea Levy
2016-12-09Probably fix a segfault in PathLocksEelco Dolstra
2016-12-08Don't delete .check directories of running buildsEelco Dolstra
We need to keep them around for diffoscope.
2016-12-08Fix warning on 32-bit systemsEelco Dolstra
http://hydra.nixos.org/build/44628517
2016-12-08Fix buildEelco Dolstra
http://hydra.nixos.org/build/44628517
2016-12-08S3BinaryCacheStore: Ensure it only builds on LinuxEelco Dolstra
2016-12-08Fix S3BinaryCacheStoreEelco Dolstra
It failed with AWS error uploading ‘6gaxphsyhg66mz0a00qghf9nqf7majs2.ls.xz’: Unable to parse ExceptionName: MissingContentLength Message: You must provide the Content-Length HTTP header. possibly because the istringstream_nocopy introduced in 0d2ebb4373e509521f27a6e8f16bfd39d05b2188 doesn't supply the seek method that the AWS library expects. So bring back the old version, but only for S3BinaryCacheStore.
2016-12-07Add a hook to run diffoscope when non-determinism is detectedEelco Dolstra
2016-12-07Keep track of the exact build start/stop timesEelco Dolstra
2016-12-07Bail out early when non-determinism is detectedEelco Dolstra
2016-12-07Expose enforce-determinism and the result to HydraEelco Dolstra
2016-12-07Add an option to make non-determinism non-fatalEelco Dolstra
That is, when build-repeat > 0, and the output of two rounds differ, then print a warning rather than fail the build. This is primarily to let Hydra check reproducibility of all packages.
2016-12-06Use a steady clock for timeoutsEelco Dolstra
Fixes #1146.
2016-12-06nix-store --serve: Suppress log output on stderr when repeating a buildEelco Dolstra
2016-12-06nix-store --serve: Support setting build-repeatEelco Dolstra
This allows Hydra to test whether builds are reproducible.
2016-12-06Tweak error messageEelco Dolstra
2016-11-27Improve error message on trailing path slashesGuillaume Maudoux
2016-11-25Simplify remouting with MS_PRIVATE in sandbox buildJörg Thalheim
also fix race condition if mounts are added after mountinfo is read.
2016-11-21nix-channel: Fix --update <CHANNELS>Eelco Dolstra
This unbreaks "nixos-rebuild --upgrade".
2016-11-17TypoEelco Dolstra
2016-11-17Fix binary-cache-store buildShea Levy
2016-11-17istringstream_nocopy: Implement in a standards-compliant wayShea Levy
Fixes #1135.
2016-11-17nix-daemon: Fix splice faking on non-LinuxShea Levy
2016-11-17Update darwin build for optional sandbox pathsShea Levy
Fixes #1132
2016-11-16seccomp: Forge return values for *chown32aszlig
These syscalls are only available in 32bit architectures, but libseccomp should handle them correctly even if we're on native architectures that do not have these syscalls. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-16seccomp: Forge return codes for POSIX ACL syscallsaszlig
Commands such as "cp -p" also use fsetxattr() in addition to fchown(), so we need to make sure these syscalls always return successful as well in order to avoid nasty "Invalid value" errors. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-16libstore/build: Forge chown() to return successaszlig
What we basically want is a seccomp mode 2 BPF program like this but for every architecture: BPF_STMT(BPF_LD+BPF_W+BPF_ABS, offsetof(struct seccomp_data, nr)), BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_chown, 4, 0), BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_fchown, 3, 0), BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_fchownat, 2, 0), BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_lchown, 1, 0), BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW), BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO) However, on 32 bit architectures we do have chown32, lchown32 and fchown32, so we'd need to add all the architecture blurb which libseccomp handles for us. So we only need to make sure that we add the 32bit seccomp arch while we're on x86_64 and otherwise we just stay at the native architecture which was set during seccomp_init(), which more or less replicates setting 32bit personality during runChild(). The FORCE_SUCCESS() macro here could be a bit less ugly but I think repeating the seccomp_rule_add() all over the place is way uglier. Another way would have been to create a vector of syscalls to iterate over, but that would make error messages uglier because we can either only print the (libseccomp-internal) syscall number or use seccomp_syscall_resolve_num_arch() to get the name or even make the vector a pair number/name, essentially duplicating everything again. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-16Add build dependency for libseccompaszlig
We're going to use libseccomp instead of creating the raw BPF program, because we have different syscall numbers on different architectures. Although our initial seccomp rules will be quite small it really doesn't make sense to generate the raw BPF program because we need to duplicate it and/or make branches on every single architecture we want to suuport. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-16Run builds as root in user namespace againaszlig
This reverts commit ff0c0b645cc1448959126185bb2fafe41cf0bddf. We're going to use seccomp to allow "cp -p" and force chown-related syscalls to always return 0. Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2016-11-16S3BinaryCacheStore:: Eliminate a string copy while uploadingEelco Dolstra
This cuts hydra-queue-runner's peak memory usage by about a third.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 15:46:47 +0000