Commit graph

12435 commits

Author SHA1 Message Date
Adam Joseph
8d35f387dc local-derivation-goal.cc: warn if failing and /proc/self/ns/user missing
This commit causes nix to `warn()` if sandbox setup has failed and
`/proc/self/ns/user` does not exist.  This is usually a sign that the
kernel was compiled without `CONFIG_USER_NS=y`, which is required for
sandboxing.
2022-07-16 19:37:27 -07:00
Adam Joseph
90830b1074 local-derivation-goal.cc: warn if failing due to max_user_namespaces==0
This commit uses `warn()` to notify the user if sandbox setup fails
with errno==EPERM and /proc/sys/user/max_user_namespaces is missing or
zero, since that is at least part of the reason why sandbox setup
failed.

Note that `echo -n 0 > /proc/sys/user/max_user_namespaces` or
equivalent at boot time has been the recommended mitigation for
several Linux LPE vulnerabilities over the past few years.  Many users
have applied this mitigation and then forgotten that they have done
so.
2022-07-16 19:30:53 -07:00
Adam Joseph
8ea3a911aa local-derivation-goal.cc: improve error messages when sandboxing fails
The failure modes for nix's sandboxing setup are pretty complicated.
When nix is unable to set up the sandbox, let's provide more detail
about what went wrong.  Specifically:

* Make sure the error message includes the word "sandbox" so the user
  knows that the failure was related to sandboxing.

* If `--option sandbox-fallback false` was provided, and removing it
  would have allowed further attempts to make progress, let the user
  know.
2022-07-16 14:56:24 -07:00
Eelco Dolstra
59764eb842
Merge pull request #6810 from jfly/jfly/do-not-assume-savedvars-exist
nix develop: do not assume that saved vars are set
2022-07-15 13:59:25 +02:00
Eelco Dolstra
0621e99414
Merge pull request #6811 from edolstra/fix-auto-chroot
Disable auto-chroot if $NIX_STATE_DIR is set
2022-07-15 13:11:08 +02:00
Eelco Dolstra
3bcd7a5474 Disable auto-chroot if $NIX_STATE_DIR is set
Issue #6732.
2022-07-15 12:32:29 +02:00
Jeremy Fleischman
04386f7d69
nix develop: do not assume that saved vars are set
This fixes https://github.com/NixOS/nix/issues/6809
2022-07-14 23:25:39 -07:00
Domen Kožar
de287964d5
Merge pull request #6807 from NixOS/curl-patch
curl: patch for netrc regression in Nix
2022-07-14 19:30:14 -05:00
Domen Kožar
99208bb8cc curl: patch for netrc regression in Nix 2022-07-14 17:45:02 -05:00
Eelco Dolstra
ca4d5bee09
Merge pull request #6804 from edolstra/fix-auto-chroot
Disable auto-chroot if $NIX_STORE_DIR is set
2022-07-14 18:24:08 +02:00
Eelco Dolstra
ff49c75502 Disable auto-chroot if $NIX_STORE_DIR is set
Fixes #6732.
2022-07-14 17:47:09 +02:00
Eelco Dolstra
73ff9b863c
Merge pull request #6803 from edolstra/test-stack-trace
On test failures, print a bash stack trace
2022-07-14 15:56:06 +02:00
Eelco Dolstra
2532fee157 On test failures, print a bash stack trace
This makes it easier to identify what command failed. It looks like:

  follow-paths.sh: test failed at:
    main in follow-paths.sh:54
2022-07-14 15:07:19 +02:00
Eelco Dolstra
819615c7f4
Merge pull request #6802 from edolstra/split-flakes-tests
Split flakes tests
2022-07-14 09:15:58 +02:00
Eelco Dolstra
b15c4fdbde Split off 'nix flake check' tests 2022-07-13 21:01:16 +02:00
Eelco Dolstra
752158a8ef Move flake-searching.sh and make it less dependent on git 2022-07-13 20:55:17 +02:00
Eelco Dolstra
6ba45f81a8 Move flake-local-settings.sh 2022-07-13 20:51:28 +02:00
Eelco Dolstra
7abcafcfea Move the 'nix bundle' tests
Note: these were previously not actually called.
2022-07-13 20:49:07 +02:00
Eelco Dolstra
d16f1070f4 Split off following paths tests 2022-07-13 20:46:22 +02:00
Eelco Dolstra
a094259d35 Split off 'nix flake init' tests 2022-07-13 20:37:40 +02:00
Eelco Dolstra
f011c269c9 Split off the circular flake import tests 2022-07-13 20:37:32 +02:00
Eelco Dolstra
c591efafd3 Split off the Mercurial flake tests 2022-07-13 15:06:57 +02:00
Eelco Dolstra
420957e149 Move flakes tests to a subdirectory 2022-07-13 15:06:54 +02:00
Eelco Dolstra
e1153069bd
Merge pull request #6797 from edolstra/overrides-check
Simplify the check for overrides on non-existent inputs
2022-07-13 14:45:07 +02:00
Eelco Dolstra
19190c2346 tests/flakes.sh: Make sure flake7 is clean
Cherry-picked from the lazy-trees branch, where we no longer write a
lock file if any of the inputs is dirty.
2022-07-13 13:46:33 +02:00
Eelco Dolstra
12df8885cc Simplify the check for overrides on non-existent inputs 2022-07-13 13:40:40 +02:00
Théophane Hufschmitt
438776cce7
Merge pull request #6794 from eltociear/patch-1
Fix typo in flake.cc
2022-07-13 10:55:25 +02:00
Ikko Ashimine
694a9dc282
Fix typo in flake.cc
non-existant -> non-existent
2022-07-13 01:10:32 +09:00
Eelco Dolstra
a9fab18a91
Merge pull request #6791 from edolstra/fix-installer
Fix --no-daemon installation
2022-07-12 17:00:38 +02:00
Théophane Hufschmitt
2dbd5ed0b4
Merge pull request #6663 from Ma27/follows-invalid-input
flakes: throw an error if `follows`-declaration for an input is invalid
2022-07-12 16:44:22 +02:00
Eelco Dolstra
c9d406ba04 Fix --no-daemon installation
It was accidentally triggering the auto-chroot code path because
/nix/var/nix didn't exist.

Fixes #6790.
2022-07-12 16:15:21 +02:00
Eelco Dolstra
f6a434c8a4 Fix debug message 2022-07-12 11:53:34 +02:00
Maximilian Bosch
1f771065f1
Move follows-check into its own function 2022-07-12 11:25:33 +02:00
Maximilian Bosch
411111a3bc
Turn error for non-existant follows into a warning 2022-07-12 11:22:35 +02:00
Eelco Dolstra
6260040b9d
Merge pull request #6781 from ryantm/stale
update stale bot per RFC 0124
2022-07-12 10:32:56 +02:00
Maximilian Bosch
c1c37f3200
flakes: throw an error if follows-declaration for an input is invalid
I recently got fairly confused why the following expression didn't have
any effect

    {
      description = "Foobar";
      inputs.sops-nix = {
        url = github:mic92/sops-nix;
        inputs.nixpkgs_22_05.follows = "nixpkgs";
      };
    }

until I found out that the input was called `nixpkgs-22_05` (please note
the dash vs. underscore).

IMHO it's not a good idea to not throw an error in that case and
probably leave end-users rather confused, so I implemented a small check
for that which basically checks whether `follows`-declaration from
overrides actually have corresponding inputs in the transitive flake.

In fact this was done by accident already in our own test-suite where
the removal of a `follows` was apparently forgotten[1].

Since the key of the `std::map` that holds the `overrides` is a vector
and we have to find the last element of each vector (i.e. the override)
this has to be done with a for loop in O(n) complexity with `n` being
the total amount of overrides (which shouldn't be that large though).

Please note that this doesn't work with nested expressions, i.e.

    inputs.fenix.inputs.nixpkgs.follows = "...";

which is a known problem[2].

For the expression demonstrated above, an error like this will be
thrown:

    error: sops-nix has a `follows'-declaration for a non-existant input nixpkgs_22_05!

[1] 2664a216e5
[2] https://github.com/NixOS/nix/issues/5790
2022-07-12 10:18:38 +02:00
Théophane Hufschmitt
f071eb3702
Merge pull request #6693 from ncfavier/complete-flake-inputs
Improve shell completion of flake inputs
2022-07-12 09:12:00 +02:00
Eelco Dolstra
7e23039b7f
Merge pull request #6786 from edolstra/fix-aarch64-static
Fix buildStatic.aarch64-linux
2022-07-11 21:42:53 +02:00
Eelco Dolstra
28e913c605 Branch 2.10 release notes 2022-07-11 21:10:23 +02:00
Eelco Dolstra
c364e0b098 Fix buildStatic.aarch64-linux
Commit 925b975224 accidentally enabled
use of the gold linker on aarch64-linux, which apparently doesn't work.

https://hydra.nixos.org/build/183500621
2022-07-11 20:57:29 +02:00
Eelco Dolstra
b6e90de0aa
Merge pull request #6608 from bburdette/ignore-try
--ignore-try flag for debugger mode
2022-07-11 20:17:11 +02:00
Ben Burdette
cdcc349072
Merge branch 'master' into ignore-try 2022-07-11 11:29:22 -06:00
Ben Burdette
a3629ab0cc move ignore-try to EvalSettings 2022-07-11 10:47:09 -06:00
Ben Burdette
6ac8200ff5 use util.hh class instead of local 2022-07-11 10:21:40 -06:00
Ben Burdette
69ea265fd2 'tryEval' not 'try clause' 2022-07-11 10:21:12 -06:00
Naïm Favier
711b2e1f48
Fix flake input completion for InstallablesCommands
Defers completion of flake inputs until the whole command line is parsed
so that we know what flakes we need to complete the inputs of.

Previously, `nix build flake --update-input <Tab>` always behaved like
`nix build . --update-input <Tab>`.
2022-07-11 15:13:51 +02:00
Eelco Dolstra
545383208e
Merge pull request #6777 from laalsaas/master
Fix logical and typographical errors in nix-env man page
2022-07-11 13:52:40 +02:00
Eelco Dolstra
517ce38dad Update release notes 2022-07-11 11:17:19 +02:00
Ryan Mulligan
5022a71305 update stale bot per RFC 0124 2022-07-10 16:50:49 -07:00
laalsaas
eac211a171 Fix logical and typographical errors in nix-env man page 2022-07-10 12:30:17 +02:00