From 7b0d8fb23d9c71f1efb119c1f267124349c82742 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Tue, 17 Dec 2013 18:16:04 +0100 Subject: nix-shell --pure: Keep $TERM --- scripts/nix-build.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'scripts') diff --git a/scripts/nix-build.in b/scripts/nix-build.in index 8ac95e90e..aaab0ce4d 100755 --- a/scripts/nix-build.in +++ b/scripts/nix-build.in @@ -183,7 +183,7 @@ foreach my $expr (@exprs) { # Set the environment. if ($pure) { foreach my $name (keys %ENV) { - next if $name eq "HOME" || $name eq "USER" || $name eq "LOGNAME" || $name eq "DISPLAY" || $name eq "PATH"; + next if $name eq "HOME" || $name eq "USER" || $name eq "LOGNAME" || $name eq "DISPLAY" || $name eq "PATH" || $name eq "TERM"; delete $ENV{$name}; } # NixOS hack: prevent /etc/bashrc from sourcing /etc/profile. -- cgit v1.2.3 From 65a64522403f353880a501b02aca10fb96ea1c26 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Fri, 20 Dec 2013 13:10:14 +0100 Subject: nix-shell: Handle --option correctly Fixes #181. --- scripts/nix-build.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'scripts') diff --git a/scripts/nix-build.in b/scripts/nix-build.in index aaab0ce4d..b3f12b706 100755 --- a/scripts/nix-build.in +++ b/scripts/nix-build.in @@ -177,7 +177,7 @@ foreach my $expr (@exprs) { # Build or fetch all dependencies of the derivation. my @inputDrvs = grep { my $x = $_; (grep { $x =~ $_ } @envExclude) == 0 } @{$drv->{inputDrvs}}; - system("$Nix::Config::binDir/nix-store -r @buildArgs @inputDrvs @{$drv->{inputSrcs}} > /dev/null") == 0 + system("$Nix::Config::binDir/nix-store", "-r", "--no-output", @buildArgs, @inputDrvs, @{$drv->{inputSrcs}}) == 0 or die "$0: failed to build all dependencies\n"; # Set the environment. -- cgit v1.2.3 From 0c1198cf08576f16633b2344dc6513cefb567cfc Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Fri, 20 Dec 2013 13:11:41 +0100 Subject: nix-shell: Set $IN_NIX_SHELL before evaluation This has some hacky applications. --- scripts/nix-build.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'scripts') diff --git a/scripts/nix-build.in b/scripts/nix-build.in index b3f12b706..60e8afec8 100755 --- a/scripts/nix-build.in +++ b/scripts/nix-build.in @@ -175,6 +175,8 @@ foreach my $expr (@exprs) { $drvPath = readlink $drvPath or die "cannot read symlink `$drvPath'" if -l $drvPath; my $drv = derivationFromPath($drvPath); + $ENV{'IN_NIX_SHELL'} = 1; + # Build or fetch all dependencies of the derivation. my @inputDrvs = grep { my $x = $_; (grep { $x =~ $_ } @envExclude) == 0 } @{$drv->{inputDrvs}}; system("$Nix::Config::binDir/nix-store", "-r", "--no-output", @buildArgs, @inputDrvs, @{$drv->{inputSrcs}}) == 0 @@ -193,8 +195,6 @@ foreach my $expr (@exprs) { $ENV{'NIX_STORE'} = $Nix::Config::storeDir; $ENV{$_} = $drv->{env}->{$_} foreach keys %{$drv->{env}}; - $ENV{'IN_NIX_SHELL'} = 1; - # Run a shell using the derivation's environment. For # convenience, source $stdenv/setup to setup additional # environment variables and shell functions. Also don't lose -- cgit v1.2.3 From 769f66216504cd882ac7b6bdfa0dd1ff26f3efe5 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Fri, 20 Dec 2013 12:19:10 +0000 Subject: nix-shell: Don't warn about the lack of a GC root --- scripts/nix-build.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'scripts') diff --git a/scripts/nix-build.in b/scripts/nix-build.in index 60e8afec8..fe22058f6 100755 --- a/scripts/nix-build.in +++ b/scripts/nix-build.in @@ -179,7 +179,7 @@ foreach my $expr (@exprs) { # Build or fetch all dependencies of the derivation. my @inputDrvs = grep { my $x = $_; (grep { $x =~ $_ } @envExclude) == 0 } @{$drv->{inputDrvs}}; - system("$Nix::Config::binDir/nix-store", "-r", "--no-output", @buildArgs, @inputDrvs, @{$drv->{inputSrcs}}) == 0 + system("$Nix::Config::binDir/nix-store", "-r", "--no-output", "--no-gc-warning", @buildArgs, @inputDrvs, @{$drv->{inputSrcs}}) == 0 or die "$0: failed to build all dependencies\n"; # Set the environment. -- cgit v1.2.3 From 194e3374b89b8b2dec6296923877304bdb5c6ae2 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Fri, 20 Dec 2013 13:31:31 +0100 Subject: Scan /proc//cmdline for GC roots --- scripts/find-runtime-roots.pl.in | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to 'scripts') diff --git a/scripts/find-runtime-roots.pl.in b/scripts/find-runtime-roots.pl.in index e1a2dde55..2e04a635e 100755 --- a/scripts/find-runtime-roots.pl.in +++ b/scripts/find-runtime-roots.pl.in @@ -15,8 +15,6 @@ sub readProc { my $process = "/proc/$name"; - #print STDERR "=== $process\n"; - my $target; print "$target\n" if $target = readlink "$process/exe"; print "$target\n" if $target = readlink "$process/cwd"; @@ -38,11 +36,17 @@ sub readProc { } # Get all store paths that appear in the environment of this process. + my $re = "\Q$Nix::Config::storeDir\E\/[0-9a-z]+[0-9a-zA-Z\+\-\._\?=]*"; eval { my $env = Nix::Utils::readFile "$process/environ"; - my @matches = $env =~ /\Q$Nix::Config::storeDir\E\/[0-9a-z]+[0-9a-zA-Z\+\-\._\?=]*/g; + my @matches = $env =~ /$re/g; print "$_\n" foreach @matches; - } + }; + eval { + my $cmdline = Nix::Utils::readFile "$process/cmdline"; + my @matches = $cmdline =~ /$re/g; + print "$_\n" foreach @matches; + }; } closedir DIR; -- cgit v1.2.3 From b352fe2775d09993add893ebff8c0c4c8369182a Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Fri, 20 Dec 2013 14:18:24 +0100 Subject: Revert "Scan /proc//cmdline for GC roots" This reverts commit 194e3374b89b8b2dec6296923877304bdb5c6ae2. Checking the command line for GC roots means that $ nix-store --delete $path will fail because $path is now a root because it's mentioned on the command line. --- scripts/find-runtime-roots.pl.in | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) (limited to 'scripts') diff --git a/scripts/find-runtime-roots.pl.in b/scripts/find-runtime-roots.pl.in index 2e04a635e..e1a2dde55 100755 --- a/scripts/find-runtime-roots.pl.in +++ b/scripts/find-runtime-roots.pl.in @@ -15,6 +15,8 @@ sub readProc { my $process = "/proc/$name"; + #print STDERR "=== $process\n"; + my $target; print "$target\n" if $target = readlink "$process/exe"; print "$target\n" if $target = readlink "$process/cwd"; @@ -36,17 +38,11 @@ sub readProc { } # Get all store paths that appear in the environment of this process. - my $re = "\Q$Nix::Config::storeDir\E\/[0-9a-z]+[0-9a-zA-Z\+\-\._\?=]*"; eval { my $env = Nix::Utils::readFile "$process/environ"; - my @matches = $env =~ /$re/g; - print "$_\n" foreach @matches; - }; - eval { - my $cmdline = Nix::Utils::readFile "$process/cmdline"; - my @matches = $cmdline =~ /$re/g; + my @matches = $env =~ /\Q$Nix::Config::storeDir\E\/[0-9a-z]+[0-9a-zA-Z\+\-\._\?=]*/g; print "$_\n" foreach @matches; - }; + } } closedir DIR; -- cgit v1.2.3 From 5ba5993470a6ad532fc8e842084a574a88876b0a Mon Sep 17 00:00:00 2001 From: Shea Levy Date: Mon, 30 Dec 2013 07:58:14 -0500 Subject: nix-shell --pure: Don't clear IN_NIX_SHELL Signed-off-by: Shea Levy --- scripts/nix-build.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'scripts') diff --git a/scripts/nix-build.in b/scripts/nix-build.in index fe22058f6..8b66e38a9 100755 --- a/scripts/nix-build.in +++ b/scripts/nix-build.in @@ -185,7 +185,7 @@ foreach my $expr (@exprs) { # Set the environment. if ($pure) { foreach my $name (keys %ENV) { - next if $name eq "HOME" || $name eq "USER" || $name eq "LOGNAME" || $name eq "DISPLAY" || $name eq "PATH" || $name eq "TERM"; + next if $name eq "HOME" || $name eq "USER" || $name eq "LOGNAME" || $name eq "DISPLAY" || $name eq "PATH" || $name eq "TERM" || $name eq "IN_NIX_SHELL"; delete $ENV{$name}; } # NixOS hack: prevent /etc/bashrc from sourcing /etc/profile. -- cgit v1.2.3 From 405434e084fa994cc957249db7787731e9311fa8 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Mon, 6 Jan 2014 17:38:04 +0100 Subject: Revert "nix-shell: Set $IN_NIX_SHELL before evaluation" This reverts commit 0c1198cf08576f16633b2344dc6513cefb567cfc. --- scripts/nix-build.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'scripts') diff --git a/scripts/nix-build.in b/scripts/nix-build.in index 8b66e38a9..8e6f43a37 100755 --- a/scripts/nix-build.in +++ b/scripts/nix-build.in @@ -175,8 +175,6 @@ foreach my $expr (@exprs) { $drvPath = readlink $drvPath or die "cannot read symlink `$drvPath'" if -l $drvPath; my $drv = derivationFromPath($drvPath); - $ENV{'IN_NIX_SHELL'} = 1; - # Build or fetch all dependencies of the derivation. my @inputDrvs = grep { my $x = $_; (grep { $x =~ $_ } @envExclude) == 0 } @{$drv->{inputDrvs}}; system("$Nix::Config::binDir/nix-store", "-r", "--no-output", "--no-gc-warning", @buildArgs, @inputDrvs, @{$drv->{inputSrcs}}) == 0 @@ -195,6 +193,8 @@ foreach my $expr (@exprs) { $ENV{'NIX_STORE'} = $Nix::Config::storeDir; $ENV{$_} = $drv->{env}->{$_} foreach keys %{$drv->{env}}; + $ENV{'IN_NIX_SHELL'} = 1; + # Run a shell using the derivation's environment. For # convenience, source $stdenv/setup to setup additional # environment variables and shell functions. Also don't lose -- cgit v1.2.3 From 0fdf4da0e979f992db75cc17376e455ddc5a96d8 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Wed, 8 Jan 2014 15:23:41 +0100 Subject: Support cryptographically signed binary caches MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit NAR info files in binary caches can now have a cryptographic signature that Nix will verify before using the corresponding NAR file. To create a private/public key pair for signing and verifying a binary cache, do: $ openssl genrsa -out ./cache-key.sec 2048 $ openssl rsa -in ./cache-key.sec -pubout > ./cache-key.pub You should also come up with a symbolic name for the key, such as "cache.example.org-1". This will be used by clients to look up the public key. (It's a good idea to number keys, in case you ever need to revoke/replace one.) To create a binary cache signed with the private key: $ nix-push --dest /path/to/binary-cache --key ./cache-key.sec --key-name cache.example.org-1 The public key (cache-key.pub) should be distributed to the clients. They should have a nix.conf should contain something like: signed-binary-caches = * binary-cache-public-key-cache.example.org-1 = /path/to/cache-key.pub If all works well, then if Nix fetches something from the signed binary cache, you will see a message like: *** Downloading ‘http://cache.example.org/nar/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’ (signed by ‘cache.example.org-1’) to ‘/nix/store/7dppcj5sc1nda7l54rjc0g5l1hamj09j-subversion-1.7.11’... On the other hand, if the signature is wrong, you get a message like NAR info file `http://cache.example.org/7dppcj5sc1nda7l54rjc0g5l1hamj09j.narinfo' has an invalid signature; ignoring Signatures are implemented as a single line appended to the NAR info file, which looks like this: Signature: 1;cache.example.org-1;HQ9Xzyanq9iV...muQ== Thus the signature has 3 fields: a version (currently "1"), the ID of key, and the base64-encoded signature of the SHA-256 hash of the contents of the NAR info file up to but not including the Signature line. Issue #75. --- scripts/download-from-binary-cache.pl.in | 24 ++++++++++++++++++------ scripts/nix-push.in | 18 +++++++++++++++++- 2 files changed, 35 insertions(+), 7 deletions(-) (limited to 'scripts') diff --git a/scripts/download-from-binary-cache.pl.in b/scripts/download-from-binary-cache.pl.in index 950bcd178..e6925d731 100644 --- a/scripts/download-from-binary-cache.pl.in +++ b/scripts/download-from-binary-cache.pl.in @@ -42,6 +42,8 @@ my $caBundle = $ENV{"CURL_CA_BUNDLE"} // $ENV{"OPENSSL_X509_CERT_FILE"}; my $userName = getpwuid($<) or die "cannot figure out user name"; +my $requireSignedBinaryCaches = ($Nix::Config::config{"signed-binary-caches"} // "0") ne "0"; + sub addRequest { my ($storePath, $url, $head) = @_; @@ -120,9 +122,10 @@ sub processRequests { sub initCache { - my $dbPath = "$Nix::Config::stateDir/binary-cache-v2.sqlite"; + my $dbPath = "$Nix::Config::stateDir/binary-cache-v3.sqlite"; unlink "$Nix::Config::stateDir/binary-cache-v1.sqlite"; + unlink "$Nix::Config::stateDir/binary-cache-v2.sqlite"; # Open/create the database. $dbh = DBI->connect("dbi:SQLite:dbname=$dbPath", "", "") @@ -159,7 +162,7 @@ EOF narSize integer, refs text, deriver text, - system text, + signedBy text, timestamp integer not null, primary key (cache, storePath), foreign key (cache) references BinaryCaches(id) on delete cascade @@ -183,7 +186,7 @@ EOF $insertNAR = $dbh->prepare( "insert or replace into NARs(cache, storePath, url, compression, fileHash, fileSize, narHash, " . - "narSize, refs, deriver, system, timestamp) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)") or die; + "narSize, refs, deriver, signedBy, timestamp) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)") or die; $queryNAR = $dbh->prepare("select * from NARs where cache = ? and storePath = ?") or die; @@ -309,14 +312,16 @@ sub processNARInfo { return undef; } - my $narInfo = parseNARInfo($storePath, $request->{content}); + my $narInfo = parseNARInfo($storePath, $request->{content}, $requireSignedBinaryCaches, $request->{url}); return undef unless defined $narInfo; + die if $requireSignedBinaryCaches && !defined $narInfo->{signedBy}; + # Cache the result. $insertNAR->execute( $cache->{id}, basename($storePath), $narInfo->{url}, $narInfo->{compression}, $narInfo->{fileHash}, $narInfo->{fileSize}, $narInfo->{narHash}, $narInfo->{narSize}, - join(" ", @{$narInfo->{refs}}), $narInfo->{deriver}, $narInfo->{system}, time()) + join(" ", @{$narInfo->{refs}}), $narInfo->{deriver}, $narInfo->{signedBy}, time()) if shouldCache $request->{url}; return $narInfo; @@ -330,6 +335,10 @@ sub getCachedInfoFrom { my $res = $queryNAR->fetchrow_hashref(); return undef unless defined $res; + # We may previously have cached this info when signature checking + # was disabled. In that case, ignore the cached info. + return undef if $requireSignedBinaryCaches && !defined $res->{signedBy}; + return { url => $res->{url} , compression => $res->{compression} @@ -339,6 +348,7 @@ sub getCachedInfoFrom { , narSize => $res->{narSize} , refs => [ split " ", $res->{refs} ] , deriver => $res->{deriver} + , signedBy => $res->{signedBy} } if defined $res; } @@ -522,7 +532,8 @@ sub downloadBinary { next; } my $url = "$cache->{url}/$info->{url}"; # FIXME: handle non-relative URLs - print STDERR "\n*** Downloading ‘$url’ to ‘$storePath’...\n"; + die if $requireSignedBinaryCaches && !defined $info->{signedBy}; + print STDERR "\n*** Downloading ‘$url’ ", ($requireSignedBinaryCaches ? "(signed by ‘$info->{signedBy}’) " : ""), "to ‘$storePath’...\n"; checkURL $url; if (system("$Nix::Config::curl --fail --location --insecure '$url' $decompressor | $Nix::Config::binDir/nix-store --restore $destPath") != 0) { warn "download of `$url' failed" . ($! ? ": $!" : "") . "\n"; @@ -530,6 +541,7 @@ sub downloadBinary { } # Tell Nix about the expected hash so it can verify it. + die unless defined $info->{narHash} && $info->{narHash} ne ""; print "$info->{narHash}\n"; print STDERR "\n"; diff --git a/scripts/nix-push.in b/scripts/nix-push.in index 2c392c415..bdd128a6f 100755 --- a/scripts/nix-push.in +++ b/scripts/nix-push.in @@ -10,6 +10,7 @@ use Nix::Config; use Nix::Store; use Nix::Manifest; use Nix::Utils; +use Nix::Crypto; my $tmpDir = tempdir("nix-push.XXXXXX", CLEANUP => 1, TMPDIR => 1) or die "cannot create a temporary directory"; @@ -25,6 +26,8 @@ my $writeManifest = 0; my $manifestPath; my $archivesURL; my $link = 0; +my $privateKeyFile; +my $keyName; my @roots; for (my $n = 0; $n < scalar @ARGV; $n++) { @@ -57,6 +60,14 @@ for (my $n = 0; $n < scalar @ARGV; $n++) { $archivesURL = $ARGV[$n]; } elsif ($arg eq "--link") { $link = 1; + } elsif ($arg eq "--key") { + $n++; + die "$0: `$arg' requires an argument\n" unless $n < scalar @ARGV; + $privateKeyFile = $ARGV[$n]; + } elsif ($arg eq "--key-name") { + $n++; + die "$0: `$arg' requires an argument\n" unless $n < scalar @ARGV; + $keyName = $ARGV[$n]; } elsif (substr($arg, 0, 1) eq "-") { die "$0: unknown flag `$arg'\n"; } else { @@ -99,7 +110,7 @@ foreach my $storePath (@storePaths) { my $pathHash = substr(basename($storePath), 0, 32); my $narInfoFile = "$destDir/$pathHash.narinfo"; if (-e $narInfoFile) { - my $narInfo = parseNARInfo($storePath, readFile($narInfoFile)); + my $narInfo = parseNARInfo($storePath, readFile($narInfoFile), 0, $narInfoFile) or die "cannot read `$narInfoFile'\n"; my $narFile = "$destDir/$narInfo->{url}"; if (-e $narFile) { print STDERR "skipping existing $storePath\n"; @@ -245,6 +256,11 @@ for (my $n = 0; $n < scalar @storePaths2; $n++) { } } + if (defined $privateKeyFile && defined $keyName) { + my $sig = signString($privateKeyFile, $info); + $info .= "Signature: 1;$keyName;$sig\n"; + } + my $pathHash = substr(basename($storePath), 0, 32); $dst = "$destDir/$pathHash.narinfo"; -- cgit v1.2.3 From ea59f39326c8e9dc42dfed4bcbf597fbce58797c Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Mon, 13 Jan 2014 13:42:29 +0100 Subject: nix-shell: Set $IN_NIX_SHELL before evaluating --- scripts/nix-build.in | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'scripts') diff --git a/scripts/nix-build.in b/scripts/nix-build.in index 8e6f43a37..5d5769246 100755 --- a/scripts/nix-build.in +++ b/scripts/nix-build.in @@ -152,6 +152,8 @@ for (my $n = 0; $n < scalar @ARGV; $n++) { @exprs = ("./default.nix") if scalar @exprs == 0; +$ENV{'IN_NIX_SHELL'} = 1 if $runEnv; + foreach my $expr (@exprs) { @@ -193,8 +195,6 @@ foreach my $expr (@exprs) { $ENV{'NIX_STORE'} = $Nix::Config::storeDir; $ENV{$_} = $drv->{env}->{$_} foreach keys %{$drv->{env}}; - $ENV{'IN_NIX_SHELL'} = 1; - # Run a shell using the derivation's environment. For # convenience, source $stdenv/setup to setup additional # environment variables and shell functions. Also don't lose -- cgit v1.2.3 From f1357059a441a588b9a2b78d3500d7068238b478 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Mon, 13 Jan 2014 13:46:44 +0100 Subject: nix-shell: Don't set NIX_INDENT_MAKE It generally is not useful in interactive environments (and messes up some non-ANSI-compliant terminals). --- scripts/nix-build.in | 1 + 1 file changed, 1 insertion(+) (limited to 'scripts') diff --git a/scripts/nix-build.in b/scripts/nix-build.in index 5d5769246..07752f144 100755 --- a/scripts/nix-build.in +++ b/scripts/nix-build.in @@ -211,6 +211,7 @@ foreach my $expr (@exprs) { 'set +e; ' . '[ -n "$PS1" ] && PS1="\n\[\033[1;32m\][nix-shell:\w]$\[\033[0m\] "; ' . 'unset NIX_ENFORCE_PURITY; ' . + 'unset NIX_INDENT_MAKE; ' . 'shopt -u nullglob; ' . $envCommand); $ENV{BASH_ENV} = $rcfile; -- cgit v1.2.3 From bf0ad8aabca67b4faabe3a1ac3c57884ae9924f4 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Wed, 15 Jan 2014 14:34:49 +0100 Subject: nix-profile.sh: Add the Nixpkgs channel to $NIX_PATH --- scripts/nix-profile.sh.in | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'scripts') diff --git a/scripts/nix-profile.sh.in b/scripts/nix-profile.sh.in index 16eb754c5..06e7bdb7b 100644 --- a/scripts/nix-profile.sh.in +++ b/scripts/nix-profile.sh.in @@ -8,10 +8,15 @@ if test -n "$HOME"; then @coreutils@/ln -s "$_NIX_DEF_LINK" "$NIX_LINK" fi + export PATH=$NIX_LINK/bin:$PATH + # Subscribe the root user to the Nixpkgs channel by default. if [ ! -e $HOME/.nix-channels ]; then echo "http://nixos.org/channels/nixpkgs-unstable nixpkgs" > $HOME/.nix-channels fi - export PATH=$NIX_LINK/bin:$PATH + # Append ~/.nix-defexpr/channels/nixpkgs to $NIX_PATH so that + # paths work when the user has fetched the Nixpkgs + # channel. + export NIX_PATH=${NIX_PATH:+$NIX_PATH:}nixpkgs=$HOME/.nix-defexpr/channels/nixpkgs fi -- cgit v1.2.3