Commit graph

79 commits

Author SHA1 Message Date
Eelco Dolstra
0500fba56a builtins.fetchurl: Fix segfault on s3:// URLs
Also, add an activity to show that we're downloading an s3:// file.

Fixes #11674.
2024-10-11 14:32:34 +02:00
Jörg Thalheim
410853ddcf tests/nixos/fetchurl: drop unused variables 2024-09-28 17:08:18 +02:00
Puck Meerburg
c1ecf0bee9 fix passing CA files into builtins:fetchurl sandbox
This patch has been manually adapted from
14dc84ed03

Tested with:

$ NIX_SSL_CERT_FILE=$(nix-build '<nixpkgs>' -A cacert)/etc/ssl/certs/ca-bundle.crt nix-build --store $(mktemp -d) -E 'import <nix/fetchurl.nix> { url = https://google.com; }'
Finished at 16:57:50 after 1s
warning: found empty hash, assuming 'sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='
this derivation will be built:
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
  /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
google.com> building '/nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv'
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
google.com> error:
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
google.com>        … writing file '/nix/store/0zynn4n8yx59bczy1mgh1lq2rnprvvrc-google.com'
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
google.com>
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
google.com>        error: unable to download 'https://google.com': Problem with the SSL CA cert (path? access rights?) (77) error setting certificate file: /nix/store/nlgbippbbgn38hynjkp1ghiybcq1dqhx-nss-cacert-3.101.1/etc/ssl/certs/ca-bundle.crt
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
error: builder for '/nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv' failed with exit code 1

Now returns:

nix-env % NIX_SSL_CERT_FILE=$(nix-build '<nixpkgs>' -A cacert)/etc/ssl/certs/ca-bundle.crt nix-build --store $(mktemp -d) -E 'import <nix/fetchurl.nix> { url = https://google.com; }'
Finished at 17:05:48 after 0s
warning: found empty hash, assuming 'sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='
this derivation will be built:
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
  /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
google.com> building '/nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv'
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
nix-output-monitor error: DerivationReadError /nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv: openFile: does not exist (No such file or directory)
error: hash mismatch in fixed-output derivation '/nix/store/4qljhy0jj2b0abjzpsbyarpia1bqylwc-google.com.drv':
         specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
2024-09-28 17:08:16 +02:00
Eelco Dolstra
f2f47fa725 Add a test for builtin:fetchurl cert verification 2024-09-24 16:13:28 +02:00
Eelco Dolstra
3fbd71701a Add test 2024-09-11 17:27:39 +02:00
Parker Hoyes
4c88deef38 Add tests for daemon with cgroups 2024-09-03 17:27:56 +00:00
tomberek
440de80d34
Merge pull request #11021 from hercules-ci/issue-11010
Fix SSH invocation when local SHELL misbehaves
2024-08-26 10:40:51 -04:00
Eelco Dolstra
9ff0b55d4e Add a VM test for fsync-store-paths
Based on https://github.com/squalus/nix-durability-tests/blob/master/flake.nix.
2024-08-22 15:34:19 +02:00
Robert Hensing
d4aa7d5dc7 Use nixosTest.quickBuild behavior by default
This wasn't the default behaviour because:

> We don't enable this by default to avoid the mostly unnecessary work of
> performing an additional build of the package in cases where we build
> the package normally anyway, such as in our pre-merge CI.

Since we have a componentized build, we've solved the duplication.

In the new situation, building both with and without unit tests
isn't any slow than just a build with unit tests, so there's no
point in using the unit-tested build anymore.

By using the otherwise untested build, we reduce the minimum build
time towards the NixOS test, at no cost.

If you want to run all tests, build all attributes.
2024-08-16 21:25:48 -04:00
Robert Hensing
a03bb4455c Fix SSH invocation when local SHELL misbehaves
Setting it to /bin/sh will make it more predictable when users have
their favorite shell in SHELL, which might not behave as expected.
For instance, a bad rc file could send something to stdout before
our LocalCommand gets to write "started".

This may help https://github.com/NixOS/nix/issues/11010
2024-08-16 15:53:30 +02:00
John Ericson
b41cc1a755 Make wrapper derivation
This ensures just `nix build`-ing the flake doesn't forget to run all
tests. One can still specifiy specific attributes to just build one
thing.

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
2024-08-14 18:04:38 -04:00
Eelco Dolstra
2950f9e18a Add a VM test for S3BinaryCacheStore
Fixes #11238.
2024-08-05 11:48:50 +02:00
Robert Hensing
7c5a0b06a4 tests/nixos/remote-builds: Wait for multi-user
This should make the test more robust, considering the strange hang
in https://hydra.nixos.org/build/267517233/nixlog/8

`builder` seems to have reached `multi-user.target` before the
SSH connection was established, but this seems to be coincidental.
This does tell us that enforcing this has a minimal cost in terms
of runtime.

Waiting for `multi-user.target` on the client is honestly paranoid,
but flaky tests are very bad for productivity.
2024-07-27 13:08:30 +02:00
Robert Hensing
f4464873f5 tests/nixos/remote-builds: Print hello world to stderr
Trying to learn more about enigmatic spurious hang at
https://hydra.nixos.org/build/267517233/nixlog/8
- builder1 seems to have started properly
- ssh connection and session are established
- ssh client doesn't exit or client.succeed does not return
  for some reason.

Seeing the stdout on the console might give a tiny bit more info.
2024-07-27 13:01:56 +02:00
Eelco Dolstra
8f280d72ff
Merge pull request #11019 from DeterminateSystems/fix-failed-to-open-archive
Tarball fetcher: Fix handling of cached tarballs
2024-07-05 17:10:02 +02:00
Eelco Dolstra
e7e070d36b Document 2024-07-05 16:29:16 +02:00
Eelco Dolstra
1ff186fc6e nix flake metadata: Show flake fingerprint
This is useful for testing/debugging and maybe for sharing eval caches
(since it tells you what file in ~/.cache/nix/eval-cache-v5 to copy).
2024-07-03 17:00:30 +02:00
Eelco Dolstra
8bdd0ecd80 Add a test 2024-07-03 15:57:05 +02:00
John Ericson
8a420162ab Merge branch 'master' into fix-sandbox-escape 2024-06-26 18:11:39 -04:00
Théophane Hufschmitt
1d3696f0fb Run the builds in a daemon-controled directory
Instead of running the builds under
`$TMPDIR/{unique-build-directory-owned-by-the-build-user}`, run them
under `$TMPDIR/{unique-build-directory-owned-by-the-daemon}/{subdir-owned-by-the-build-user}`
where the build directory is only readable and traversable by the daemon user.

This achieves two things:

1. It prevents builders from making their build directory world-readable
   (or even writeable), which would allow the outside world to interact
   with them.
2. It prevents external processes running as the build user (either
   because that somehow leaked, maybe as a consequence of 1., or because
   `build-users` isn't in use) from gaining access to the build
   directory.
2024-06-21 17:06:19 +02:00
Théophane Hufschmitt
717f3eea39 Add a test for the user sandboxing 2024-06-21 17:06:18 +02:00
Robert Hensing
dcee46a0ef Apply suggestions from code review
Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
2024-06-20 14:54:11 +02:00
Robert Hensing
d208e9dd9f tests: Add quickBuild to all VM tests 2024-06-20 14:54:11 +02:00
Robert Hensing
439022c5ac tests: Add hydraJobs.tests.functional_* 2024-06-20 14:54:11 +02:00
John Ericson
b0283240a1
Merge pull request #10864 from Mic92/tarball-flakes-test
tests/nixos: make the tarball-flakes test better reflect real use cases
2024-06-05 18:40:16 -04:00
Pierre Bourdon
162d94d975 tests/nixos: make the tarball-flakes test better reflect real use cases
In most real world cases, the Link header is set on the redirect, not on
the final file. This regressed in Lix earlier and while new unit tests
were added to cover it, this integration test should probably have also
caught it.

Source: a3256a9375
2024-06-05 20:14:24 +02:00
Robert Hensing
5d460d563e TMP: Disable tests.setuid.i686-linux
Temporarily(?) blocked on https://github.com/NixOS/nixpkgs/pull/297475#issuecomment-2145589501
2024-06-03 18:47:53 +02:00
Robert Hensing
8a510f4ede Add tests.remoteBuilds_*_2_18 2024-06-03 17:34:55 +02:00
Robert Hensing
efc2508e8b Refactor hydraJobs.tests.remoteBuilds_*_2_18 2024-06-03 17:34:55 +02:00
Robert Hensing
6558025e77 Fix eval remoteBuilds_*_2_13 2024-06-03 17:34:55 +02:00
Robert Hensing
449e4b9232 Change checkOverrideNixVersion for NixOS 24.05 2024-06-03 17:34:55 +02:00
Eelco Dolstra
ac3e5d22e3
Merge pull request #10028 from DavHau/fetchTree-shallow-default
fetchTree: shallow git fetching by default
2024-06-03 16:02:34 +02:00
Eelco Dolstra
9a58d90c73 tests/nixos/containers/containers.nix: Remove superfluous -v 2024-05-14 14:27:09 +02:00
ramboman
b4950404ba
Honor the same set of proxy environment variables (#10611)
Different parts of the project honor different sets of proxy environment
variables. With this commit all parts of the project will honor the same
set of proxy environment variables.

---------

Co-authored-by: Your Name <you@example.com>
Co-authored-by: John Ericson <John.Ericson@Obsidian.Systems>
2024-05-06 15:39:22 -04:00
Bouke van der Bijl
1e4f902b28 Add gitSubmodules test to github actions 2024-04-11 15:55:09 +02:00
Bouke van der Bijl
cd06193d13 Add nixos test 2024-04-11 15:28:38 +02:00
Théophane Hufschmitt
29c3e4f580
Merge pull request #10340 from edolstra/trust-github
Add trust-tarballs-from-git-forges setting
2024-04-02 16:08:57 +02:00
Sergei Zimmerman
a66b5a1526
test(nixos): add integration test for doubly-compressed content
Add an integration test with a compressing proxy (nginx is used).
This test verifies that fetched archives do not get decompressed
excessively.
2024-03-30 01:29:34 +03:00
Eelco Dolstra
00ce36fafe Add test 2024-03-29 13:38:55 +01:00
Eelco Dolstra
c1811c1eba Fix GitHub test
Cherry-picked from 03618bb85f609a9b2f3cd6b82628a95b425e3b72.
2024-03-10 13:38:38 +01:00
Théophane Hufschmitt
65b79c52c6 Fix a typo in a test comment
Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
2024-03-01 09:31:28 +01:00
Théophane Hufschmitt
a55c6a0f47 Add a NixOS test for the sandbox escape
Test that we can't leverage abstract unix domain sockets to leak file
descriptors out of the sandbox and modify the path after it has been
registered.
2024-03-01 09:31:28 +01:00
DavHau
358c26fd13 fetchTree: shallow git fetching by default
Motivation:
make git fetching more efficient for most repos by default
2024-02-28 13:27:22 +07:00
Robert Hensing
c4d7c4a848 nixos/tests/remote-builds*: Format
nixpkgs-fmt
2024-01-22 18:47:59 +01:00
Robert Hensing
5167351efb tests/nixos/remote-builds*: Inline module + format 2024-01-22 18:44:16 +01:00
Robert Hensing
e502d1cf94 tests/nixos: Test remote build against older versions 2024-01-22 18:39:15 +01:00
DavHau
bc00fa4647 fetchTree/fetchGit: re-enable shallow fetching
Add several tests for git fetching:
- shallow-cache-separation: can fetch the same repo shallowly and non-shallowly
- shallow-ignore-ref: ensure that ref gets ignored when shallow=true is set
- ssh-shallow: can fetch a git repo via ssh using shallow=1
2024-01-19 20:30:47 +07:00
Robert Hensing
346d513d86 tests/nixos/fetch-git: Add http-auth test 2024-01-18 22:34:38 +01:00
Robert Hensing
ed975e953c tests/nixos/fetch-git: Testsupport for private repos 2024-01-18 22:29:26 +01:00
Robert Hensing
1254170405 tests/nixos/fetch-git: Make the store paths unique 2024-01-18 21:00:40 +01:00