Commit graph

7939 commits

Author SHA1 Message Date
Eelco Dolstra
7614a127a0
Fix binaryTarball test 2019-11-06 10:35:50 +01:00
Eelco Dolstra
69326f3637
Recursive Nix: Handle concurrent client connections 2019-11-06 00:55:03 +01:00
Eelco Dolstra
c119ab9db0
Enable recursive Nix using a feature
Derivations that want to use recursion should now set

  requiredSystemFeatures = [ "recursive-nix" ];

to make the daemon socket appear.

Also, Nix should be configured with "experimental-features =
recursive-nix".
2019-11-06 00:55:03 +01:00
Eelco Dolstra
2af9561316
Add a test for recursive Nix 2019-11-06 00:55:03 +01:00
Eelco Dolstra
c921074c19
RestrictedStore: Implement addToStore() 2019-11-06 00:55:03 +01:00
Eelco Dolstra
c4d7c76b64
Recursive Nix support
This allows Nix builders to call Nix to build derivations, with some
limitations.

Example:

  let nixpkgs = fetchTarball channel:nixos-18.03; in

  with import <nixpkgs> {};

  runCommand "foo"
    {
      buildInputs = [ nix jq ];
      NIX_PATH = "nixpkgs=${nixpkgs}";
    }
    ''
      hello=$(nix-build -E '(import <nixpkgs> {}).hello.overrideDerivation (args: { name = "hello-3.5"; })')

      $hello/bin/hello

      mkdir -p $out/bin
      ln -s $hello/bin/hello $out/bin/hello

      nix path-info -r --json $hello | jq .
    ''

This derivation makes a recursive Nix call to build GNU Hello and
symlinks it from its $out, i.e.

  # ll ./result/bin/
  lrwxrwxrwx 1 root root 63 Jan  1  1970 hello -> /nix/store/s0awxrs71gickhaqdwxl506hzccb30y5-hello-3.5/bin/hello

  # nix-store -qR ./result
  /nix/store/hwwqshlmazzjzj7yhrkyjydxamvvkfd3-glibc-2.26-131
  /nix/store/s0awxrs71gickhaqdwxl506hzccb30y5-hello-3.5
  /nix/store/sgmvvyw8vhfqdqb619bxkcpfn9lvd8ss-foo

This is implemented as follows:

* Before running the outer builder, Nix creates a Unix domain socket
  '.nix-socket' in the builder's temporary directory and sets
  $NIX_REMOTE to point to it. It starts a thread to process
  connections to this socket. (Thus you don't need to have nix-daemon
  running.)

* The daemon thread uses a wrapper store (RestrictedStore) to keep
  track of paths added through recursive Nix calls, to implement some
  restrictions (see below), and to do some censorship (e.g. for
  purity, queryPathInfo() won't return impure information such as
  signatures and timestamps).

* After the build finishes, the output paths are scanned for
  references to the paths added through recursive Nix calls (in
  addition to the inputs closure). Thus, in the example above, $out
  has a reference to $hello.

The main restriction on recursive Nix calls is that they cannot do
arbitrary substitutions. For example, doing

  nix-store -r /nix/store/kmwd1hq55akdb9sc7l3finr175dajlby-hello-2.10

is forbidden unless /nix/store/kmwd... is in the inputs closure or
previously built by a recursive Nix call. This is to prevent
irreproducible derivations that have hidden dependencies on
substituters or the current store contents. Building a derivation is
fine, however, and Nix will use substitutes if available. In other
words, the builder has to present proof that it knows how to build a
desired store path from scratch by constructing a derivation graph for
that path.

Probably we should also disallow instantiating/building fixed-output
derivations (specifically, those that access the network, but
currently we have no way to mark fixed-output derivations that don't
access the network). Otherwise sandboxed derivations can bypass
sandbox restrictions and access the network.

When sandboxing is enabled, we make paths appear in the sandbox of the
builder by entering the mount namespace of the builder and
bind-mounting each path. This is tricky because we do a pivot_root()
in the builder to change the root directory of its mount namespace,
and thus the host /nix/store is not visible in the mount namespace of
the builder. To get around this, just before doing pivot_root(), we
branch a second mount namespace that shares its /nix/store mountpoint
with the parent.

Recursive Nix currently doesn't work on macOS in sandboxed mode
(because we can't change the sandbox policy of a running build) and in
non-root mode (because setns() barfs).
2019-11-06 00:52:38 +01:00
Eelco Dolstra
b874272f7a
Make --enable-gc the default 2019-11-06 00:46:37 +01:00
Eelco Dolstra
d823381c0a
Merge branch 'fix/nix-doctor-output' of https://github.com/bhipple/nix 2019-11-05 16:04:40 +01:00
Eelco Dolstra
b4e260d887
Disable shellcheck
It's broken at the moment: https://hydra.nixos.org/build/105746055

Also it pulls in GHC which is a pretty big dependency.
2019-11-05 16:00:30 +01:00
Eelco Dolstra
81a9b93689
Fix manual build 2019-11-05 11:21:32 +01:00
Eelco Dolstra
852554bb16
Merge branch 'nix-repl-e' of https://github.com/zimbatm/nix 2019-11-05 11:20:53 +01:00
Eelco Dolstra
7876027071
Merge pull request #3193 from matthewbauer/patch-11
Update man to show that nix-shell allows --arg
2019-11-05 11:18:24 +01:00
Eelco Dolstra
9ff4060d26
Merge pull request #3190 from mkenigs/examples
change deprecated attribute syntax in run examples
2019-11-05 11:17:54 +01:00
Eelco Dolstra
72748b4088
Merge pull request #3173 from mkenigs/typo
fix typo
2019-11-05 11:17:26 +01:00
Eelco Dolstra
78b8203e50
Merge pull request #3180 from kevinastock/patch-1
docs: fix upper bound on number of consumed cores
2019-11-05 11:17:02 +01:00
Eelco Dolstra
376802c9b8
Merge pull request #3199 from kevinastock/patch-2
docs: xref doesn't render in title
2019-11-05 11:16:15 +01:00
Eelco Dolstra
e1725ba946
Fix VM tests 2019-11-05 11:12:25 +01:00
Eelco Dolstra
6b708711f5
Merge branch 'switch-to-19.09' of https://github.com/Ericson2314/nix 2019-11-05 10:32:11 +01:00
Eelco Dolstra
1b600ecd14
Don't use SOCK_CLOEXEC on macOS
https://hydra.nixos.org/build/105428308
2019-11-05 10:25:09 +01:00
Eelco Dolstra
3770f5c944
Merge pull request #3206 from kevinastock/patch-3
docs: correct default location of log directory
2019-11-04 22:30:07 +01:00
Eelco Dolstra
b81d9d26f5
Merge remote-tracking branch 'origin/master' into flakes 2019-11-04 22:29:31 +01:00
Kevin Stock
cea05e5ee7
docs: correct default location of log directory 2019-11-04 16:23:03 -05:00
Eelco Dolstra
f5a46ef0b1
Merge pull request #3202 from kraem/master
Update nix eval --help msg to not include deprecated command
2019-11-04 09:34:30 +01:00
Eelco Dolstra
8ec1b1e7b8
Merge pull request #3203 from hvdijk/prefetch-progress
Fix progress bar when nix-prefetch-url is piped.
2019-11-04 09:28:17 +01:00
Harald van Dijk
c935ad3f02
Fix progress bar when nix-prefetch-url is piped.
The intent of the code was that if the window size cannot be determined,
it would be treated as having the maximum possible size. Because of a
missing assignment, it was actually treated as having a width of 0.

The reason the width could not be determined was because it was obtained
from stdout, not stderr, even though the printing was done to stderr.

This commit addresses both issues.
2019-11-03 21:46:59 +00:00
kraem
dcd7a26063
Update nix eval --help msg to not include deprecated command 2019-11-03 18:47:28 +01:00
Kevin Stock
808cb6444e
docs: xref doesn't render in title
The `post-build-hook` text currently appears in the index, but not on the actual title line of the section, this follows the pattern used in a previous section to get a reference into a title.
2019-11-02 17:55:53 -04:00
Matthew Bauer
3e85c57a6c Pass --static flag to pkg-config when necessary 2019-11-01 13:27:40 -04:00
Matthew Bauer
f1d4ba2afd
Update man to show that nix-shell allows --arg 2019-11-01 13:25:15 -04:00
Eelco Dolstra
06f9364e5f
Merge pull request #3192 from ng-0/ng0/issue3186
include netinet/in.h in src/nix/main.cc
2019-11-01 16:17:30 +01:00
ng0
b811bd2172 include netinet/in.h in src/nix/main.cc
Fixes #3186
2019-11-01 14:09:42 +00:00
matthew
d865085c7e change deprecated attribute syntax in run examples 2019-10-31 23:13:08 -05:00
Eelco Dolstra
6c8d0133ef
Merge pull request #3187 from Mic92/travis
travis: enable linux builds
2019-10-31 17:40:57 +01:00
Jörg Thalheim
f1782642d3
travis: enable linux builds
Also disable email to not notify the whole NixOS community about build failures
2019-10-31 16:37:33 +00:00
Eelco Dolstra
6bff1aa46d
Merge pull request #3182 from bhipple/fixup/comments
Minor updates to inline comments
2019-10-31 14:14:35 +01:00
Eelco Dolstra
4e840fc541
Merge pull request #3179 from dtzWill/fix/struct-class-mismatch-minor
minor: fix mismatch of struct/class forward decl of 'Source'
2019-10-31 14:03:04 +01:00
Benjamin Hipple
80d5ec6ff4 Minor updates to inline comments
Add missing docstring on InstallableCommand. Also, some of these were wrapped
when they're right next to a line longer than the unwrapped line, so we can just
unwrap them to save vertical space.
2019-10-31 05:56:37 -04:00
Kevin Stock
99aac72a16
docs: fix upper bound on number of consumed cores 2019-10-30 16:53:04 -04:00
Will Dietz
0e9b72e097 minor: fix mismatch of struct/class forward decl of 'Source'
Fixes the following warning and the indicate potential issue:

src/libstore/worker-protocol.hh:66:1: warning: class 'Source' was previously declared as a struct; this is valid, but may result in linker errors
under the Microsoft C++ ABI [-Wmismatched-tags]

(cherry picked from commit 6e1bb04870b1b723282d32182af286646f13bf3c)
2019-10-30 14:39:01 -05:00
Eelco Dolstra
e34b317bbf
Merge pull request #3178 from helsinki-systems/flakes-git-log
[flakes] Replace git show with git log
2019-10-30 17:20:13 +01:00
Janne Heß
2d1d1e3083 Replace git show with git log
git show seems to print the entire tag message when being called on a tag
instead of a commit. git log instead always prints the correct timestamp
in my tests.
The error nix prints is: `error: stoull`.
2019-10-30 17:15:38 +01:00
Eelco Dolstra
e5319a87ce
queryPathInfoUncached(): Return const ValidPathInfo 2019-10-29 13:53:04 +01:00
Eelco Dolstra
992a2ad475
Move addToStoreFromDump to Store 2019-10-29 13:38:24 +01:00
Eelco Dolstra
05819d013f
Don't create a Store in processConnection() 2019-10-29 13:36:19 +01:00
Eelco Dolstra
63b99af85a
Move Unix domain socket creation to libutil
Also drop multithread-unfriendly hacks like doing a temporary
chmod/umask.
2019-10-29 13:30:51 +01:00
Eelco Dolstra
2d37e88319
Move most of the daemon implementation to libstore 2019-10-29 13:25:33 +01:00
Eelco Dolstra
95c727caef
Remove the check against concurrent builds in the same process 2019-10-29 12:43:20 +01:00
matthew
e0bcacf79f fix typo 2019-10-28 18:02:47 -05:00
zimbatm
9a25059656
findDerivationFilename: add FIXME 2019-10-28 21:40:02 +01:00
zimbatm
d407f4d15f
nix repl: also handle lambda edit 2019-10-28 21:37:22 +01:00