Commit graph

17010 commits

Author SHA1 Message Date
John Ericson
b973cd494f Enable the unix:// store on Windows
Windows now has some basic Unix Domain Socket support, see
https://devblogs.microsoft.com/commandline/af_unix-comes-to-windows/

Building `nix daemon` on Windows I've left for later, because the daemon
currently forks per connection but this is not an option on Windows. But
we can get the client part working right away.
2024-04-18 16:58:32 -04:00
John Ericson
3a3c205fa7 Use rand not random for creating GC root indirect links
I don't think fewer bits matters for this, and `rand` but not `random`
is available on Windows.
2024-04-18 16:57:11 -04:00
Robert Hensing
538eb2617a
Merge pull request #10537 from hercules-ci/c-api-nix-value-init-apply
C API: Add nix_init_apply
2024-04-18 20:09:24 +02:00
Robert Hensing
ad643cde58 C API: Add nix_init_apply
Thunks are relevant when initializing attrsets and lists, passing
arguments. This is an important way to produce them.
2024-04-18 19:13:38 +02:00
Eelco Dolstra
f00b3b37b5
Merge pull request #10554 from 0x4A6F/master-scripts/upload-release
scripts/upload-release: fix riscv64 call
2024-04-18 19:12:22 +02:00
Eelco Dolstra
40499bca99
Merge pull request #10549 from alyssais/exportReferencesGraph
Fix exportReferencesGraph when given store subpath
2024-04-18 17:23:12 +02:00
0x4A6F
f8a67d7e26
scripts/upload-release: fix riscv64 call 2024-04-18 17:18:48 +02:00
John Ericson
b2b776da4f
Merge pull request #10501 from Ma27/seccomp-fchmodat2
libstore/local-derivation-goal: prohibit creating setuid/setgid binaries
2024-04-18 10:07:05 -04:00
0x4A6F
e3fa7c38d7
system: build for riscv64-unknown-linux-gnu (#10228)
* system: add support for riscv64-unknown-linux-gnu

* maintainers: upload riscv64-linux-gnu

* doc: add riscv64-linux to supported platforms
2024-04-18 11:10:52 +00:00
John Ericson
fb9f4208ed
Don't include linux/ in #include
The linux dirs are conditionally added to the `-I` path.
2024-04-18 12:20:20 +02:00
Maximilian Bosch
ba68045187
libstore/local-derivation-goal: prohibit creating setuid/setgid binaries
With Linux kernel >=6.6 & glibc 2.39 a `fchmodat2(2)` is available that
isn't filtered away by the libseccomp sandbox.

Being able to use this to bypass that restriction has surprising results
for some builds such as lxc[1]:

> With kernel ≥6.6 and glibc 2.39, lxc's install phase uses fchmodat2,
> which slips through 9b88e52846/src/libstore/build/local-derivation-goal.cc (L1650-L1663).
> The fixupPhase then uses fchmodat, which fails.
> With older kernel or glibc, setting the suid bit fails in the
> install phase, which is not treated as fatal, and then the
> fixup phase does not try to set it again.

Please note that there are still ways to bypass this sandbox[2] and this is
mostly a fix for the breaking builds.

This change works by creating a syscall filter for the `fchmodat2`
syscall (number 452 on most systems). The problem is that glibc 2.39
and seccomp 2.5.5 are needed to have the correct syscall number available
via `__NR_fchmodat2` / `__SNR_fchmodat2`, but this flake is still on
nixpkgs 23.11. To have this change everywhere and not dependent on the
glibc this package is built against, I added a header
"fchmodat2-compat.hh" that sets the syscall number based on the
architecture. On most platforms its 452 according to glibc with a few
exceptions:

    $ rg --pcre2 'define __NR_fchmodat2 (?!452)'
    sysdeps/unix/sysv/linux/x86_64/x32/arch-syscall.h
    58:#define __NR_fchmodat2 1073742276

    sysdeps/unix/sysv/linux/mips/mips64/n32/arch-syscall.h
    67:#define __NR_fchmodat2 6452

    sysdeps/unix/sysv/linux/mips/mips64/n64/arch-syscall.h
    62:#define __NR_fchmodat2 5452

    sysdeps/unix/sysv/linux/mips/mips32/arch-syscall.h
    70:#define __NR_fchmodat2 4452

    sysdeps/unix/sysv/linux/alpha/arch-syscall.h
    59:#define __NR_fchmodat2 562

I tested the change by adding the diff below as patch to
`pkgs/tools/package-management/nix/common.nix` & then built a VM from
the following config using my dirty nixpkgs master:

    {
      vm = { pkgs, ... }: {
        virtualisation.writableStore = true;
        virtualisation.memorySize = 8192;
        virtualisation.diskSize = 12 * 1024;
        nix.package = pkgs.nixVersions.nix_2_21;
      };
    }

The original issue can be triggered via

    nix build -L github:nixos/nixpkgs/d6dc19adbda4fd92fe9a332327a8113eaa843894#lxc \
      --extra-experimental-features 'nix-command flakes'

however the problem disappears with this patch applied.

Closes #10424

[1] https://github.com/NixOS/nixpkgs/issues/300635#issuecomment-2031073804
[2] https://github.com/NixOS/nixpkgs/issues/300635#issuecomment-2030844251
2024-04-18 12:20:20 +02:00
Eelco Dolstra
731c389d32
Merge pull request #10552 from obsidiansystems/tiny-cpp-style-cleanup
`file-descriptor.hh`: Avoid some C-isms for better C++-isms
2024-04-18 10:25:33 +02:00
John Ericson
9c815db366 file-descriptor.hh: Avoid some Cism for better C++isms
- `reinterpret_cast` not C-style cast
- `using` not `typedef`
2024-04-17 19:55:40 -04:00
John Ericson
c16fc2c1bd
Merge pull request #10550 from obsidiansystems/less-cli-unix-only
Make a few commands that were Unix-only no longer
2024-04-17 17:22:06 -04:00
John Ericson
6fa3656a32 Make a few commands that were Unix-only no longer
Also clean up some more linux-specific (`setPersonality`) code in
alignment with recent best practices.
2024-04-17 16:20:56 -04:00
John Ericson
cde0fae7d9
Merge pull request #10502 from obsidiansystems/local-overlay-doc-improvements
Improve `local-overlay` docs in a few ways
2024-04-17 15:52:14 -04:00
Alyssa Ross
0774e8ba33
Fix exportReferencesGraph when given store subpath
With Nix 2.3, it was possible to pass a subpath of a store path to
exportReferencesGraph:

	with import <nixpkgs> {};

	let
	  hello = writeShellScriptBin "hello" ''
	    echo ${toString builtins.currentTime}
	  '';
	in

	writeClosure [ "${hello}/bin/hello" ]

This regressed with Nix 2.4, with a very confusing error message, that
presumably indicates it was unintentional:

	error: path '/nix/store/3gl7kgjr4pwf03f0x70dgx9ln3bhl7zc-hello/bin/hello' is not in the Nix store
2024-04-17 21:51:59 +02:00
John Ericson
21d9412ddc Improve local-overlay docs in a few ways
In response to https://discourse.nixos.org/t/super-colliding-nix-stores/28462/24
2024-04-17 15:28:19 -04:00
Eelco Dolstra
582c7f32e8
Merge pull request #10548 from a-kenji/wiki/link
docs: fix wiki link
2024-04-17 21:04:54 +02:00
a-kenji
5fd28eeba4 docs: fix wiki link
Link to the official wiki.
2024-04-17 19:34:22 +02:00
John Ericson
ac253fb99e
Merge pull request #8901 from nix-windows/mingw
Build a minimized Nix with MinGW
2024-04-17 12:52:47 -04:00
John Ericson
1063aa502a Relax store path canonicalization 2024-04-17 12:26:10 -04:00
John Ericson
b529d91902 Prefix -DNIX_ paths to be windows-complient for windows
This is a hacky solution, but it will do for now.
2024-04-17 12:26:10 -04:00
John Ericson
98691b46e3 Get rid of shellCrossSystems
We don't need it now that our (minimized) Windows build of Nix succeeds!
2024-04-17 12:26:10 -04:00
John Ericson
8433027e35 Build a minimized Nix with MinGW
At this point many features are stripped out, but this works:

- Can run libnix{util,store,expr} unit tests
- Can run some Nix commands

Co-Authored-By volth <volth@volth.com>
Co-Authored-By Brian McKenna <brian@brianmckenna.org>
2024-04-17 12:26:10 -04:00
John Ericson
2248a3f545 Create no-op Window pathlocks implementation
This keeps the call sites simple, eventually this should be filled in.
2024-04-17 11:48:14 -04:00
John Ericson
05b9dac754
Fix friend struct/class mismatch warning 2024-04-17 15:47:07 +00:00
Eelco Dolstra
c40e2afd33
Merge pull request #10530 from hercules-ci/solve-make-warnings
local.mk: Solve warnings
2024-04-17 16:51:56 +02:00
Robert Hensing
062d3b339b
Merge pull request #10533 from jlesquembre/jl/c-api_labeler
Auto label C API PRs
2024-04-17 16:50:21 +02:00
Eelco Dolstra
4638ddd855
Merge pull request #10322 from edolstra/finish-value
Ensure immutability of non-thunk values
2024-04-17 16:42:17 +02:00
José Luis Lafuente
d42a2643b0
Auto label C API PRs 2024-04-17 16:20:37 +02:00
Eelco Dolstra
6a3ecdaa39 Merge remote-tracking branch 'origin/master' into finish-value 2024-04-17 16:02:44 +02:00
Robert Hensing
7a1135901d local.mk: Solve warnings
local.mk:5: warning: overriding recipe for target 'outputs/dev/include/nix/nix_api_expr.h'
local.mk:5: warning: ignoring old recipe for target 'outputs/dev/include/nix/nix_api_expr.h'
local.mk:5: warning: overriding recipe for target 'outputs/dev/include/nix/nix_api_external.h'
local.mk:5: warning: ignoring old recipe for target 'outputs/dev/include/nix/nix_api_external.h'
local.mk:5: warning: overriding recipe for target 'outputs/dev/include/nix/nix_api_value.h'
local.mk:5: warning: ignoring old recipe for target 'outputs/dev/include/nix/nix_api_value.h'
local.mk:5: warning: overriding recipe for target 'outputs/dev/include/nix/nix_api_store.h'
local.mk:5: warning: ignoring old recipe for target 'outputs/dev/include/nix/nix_api_store.h'
local.mk:5: warning: overriding recipe for target 'outputs/dev/include/nix/nix_api_util.h'
local.mk:5: warning: ignoring old recipe for target 'outputs/dev/include/nix/nix_api_util.h'
2024-04-17 15:37:14 +02:00
Eelco Dolstra
d53ad516e8
Merge pull request #10517 from edolstra/path-display
Add missing setPathDisplay() calls
2024-04-17 15:36:08 +02:00
Eelco Dolstra
e0a8d38dad
Merge pull request #10527 from hercules-ci/devShell-api-docs
devShell: enable API docs
2024-04-17 15:35:35 +02:00
Eelco Dolstra
d4860c8f17
Merge pull request #10528 from NixOS/thufschmitt-patch-1
Remove the git-submodule test from Github actions
2024-04-17 15:34:13 +02:00
Robert Hensing
db948397ff
Merge pull request #10523 from tweag/jl/c-api_nix_get_string
C API: nix_get_string now accepts a callback to return the value
2024-04-17 15:22:06 +02:00
José Luis Lafuente
1f1cd97c71
C API: Add section in Nix manual (#10519) 2024-04-17 15:21:17 +02:00
Théophane Hufschmitt
deb71e5044
Merge pull request #10526 from hercules-ci/labeler-contributing
Auto-label contributor-experience in PRs
2024-04-17 15:20:49 +02:00
Théophane Hufschmitt
a863a75f0b
Remove the giy-submodule test from Github actions
It causes the CI to time out, so let's just run it on Hydra
2024-04-17 14:34:53 +02:00
Robert Hensing
45a1142a8e devShell: enable API docs
Affects both the deps and the configure flags in configurePhase.
2024-04-17 13:12:46 +02:00
Robert Hensing
94c861bebf labeler.yml: Add contributor-experience
Not exhaustive perhaps, but a good start.
2024-04-17 12:50:55 +02:00
José Luis Lafuente
c75b143b6c
C API: nix_get_string now accepts a callback to return the value 2024-04-16 22:36:39 +02:00
Eelco Dolstra
74e4bc9b1d
Merge pull request #10486 from tweag/jl/c-api_function-pointer
C API: Safer function pointer casting
2024-04-16 18:56:08 +02:00
Eelco Dolstra
75687844e1
Merge pull request #10518 from crayor1/patch-1
Double word is superfluous
2024-04-16 18:07:57 +02:00
Eelco Dolstra
84572e7198
Merge pull request #10520 from crayor1/patch-2
Fix typo in hacking.md
2024-04-16 17:47:18 +02:00
Eelco Dolstra
28e0f0a04c
Fix another typo 2024-04-16 17:43:17 +02:00
Eelco Dolstra
6892c9803c GitInputScheme: Fix path display for workdirs and submodules 2024-04-16 16:42:47 +02:00
Eelco Dolstra
79363b2273 MountedInputAccessor, FilteringInputAccessor: Respect the path display prefix/suffix
This was causing Git paths not to be rendered correctly.
2024-04-16 16:42:41 +02:00
crayor1
548a12c1fe
Fix typo in hacking.md 2024-04-16 15:54:45 +02:00