<section xmlns="http://docbook.org/ns/docbook"
xmlns:xlink="http://www.w3.org/1999/xlink"
xmlns:xi="http://www.w3.org/2001/XInclude"
version="5.0"
xml:id="ssec-relnotes-2.0">
<title>Release 2.0 (2018-02-22)</title>
<para>The following incompatible changes have been made:</para>
<itemizedlist>
<listitem>
<para>The manifest-based substituter mechanism
(<command>download-using-manifests</command>) has been <link
xlink:href="https://github.com/NixOS/nix/commit/867967265b80946dfe1db72d40324b4f9af988ed">removed</link>. It
has been superseded by the binary cache substituter mechanism
since several years. As a result, the following programs have been
removed:
<itemizedlist>
<listitem><para><command>nix-pull</command></para></listitem>
<listitem><para><command>nix-generate-patches</command></para></listitem>
<listitem><para><command>bsdiff</command></para></listitem>
<listitem><para><command>bspatch</command></para></listitem>
</itemizedlist>
</para>
</listitem>
<listitem>
<para>The “copy from other stores” substituter mechanism
(<command>copy-from-other-stores</command> and the
<envar>NIX_OTHER_STORES</envar> environment variable) has been
removed. It was primarily used by the NixOS installer to copy
available paths from the installation medium. The replacement is
to use a chroot store as a substituter
(e.g. <literal>--substituters /mnt</literal>), or to build into a
chroot store (e.g. <literal>--store /mnt --substituters /</literal>).</para>
</listitem>
<listitem>
<para>The command <command>nix-push</command> has been removed as
part of the effort to eliminate Nix's dependency on Perl. You can
use <command>nix copy</command> instead, e.g. <literal>nix copy
--to file:///tmp/my-binary-cache <replaceable>paths…</replaceable></literal></para>
</listitem>
<listitem>
<para>The “nested” log output feature (<option>--log-type
pretty</option>) has been removed. As a result,
<command>nix-log2xml</command> was also removed.</para>
</listitem>
<listitem>
<para>OpenSSL-based signing has been <link
xlink:href="https://github.com/NixOS/nix/commit/f435f8247553656774dd1b2c88e9de5d59cab203">removed</link>. This
feature was never well-supported. A better alternative is provided
by the <option>secret-key-files</option> and
<option>trusted-public-keys</option> options.</para>
</listitem>
<listitem>
<para>Failed build caching has been <link
xlink:href="https://github.com/NixOS/nix/commit/8cffec84859cec8b610a2a22ab0c4d462a9351ff">removed</link>. This
feature was introduced to support the Hydra continuous build
system, but Hydra no longer uses it.</para>
</listitem>
<listitem>
<para><filename>nix-mode.el</filename> has been removed from
Nix. It is now <link
xlink:href="https://github.com/NixOS/nix-mode">a separate
repository</link> and can be installed through the MELPA package
repository.</para>
</listitem>
</itemizedlist>
<para>This release has the following new features:</para>
<itemizedlist>
<listitem>
<para>It introduces a new command named <command>nix</command>,
which is intended to eventually replace all
<command>nix-*</command> commands with a more consistent and
better designed user interface. It currently provides replacements
for some (but not all) of the functionality provided by
<command>nix-store</command>, <command>nix-build</command>,
<command>nix-shell -p</command>, <command>nix-env -qa</command>,
<command>nix-instantiate --eval</command>,
<command>nix-push</command> and
<command>nix-copy-closure</command>. It has the following major
features:</para>
<itemizedlist>
<listitem>
<para>Unlike the legacy commands, it has a consistent way to
refer to packages and package-like arguments (like store
paths). For example, the following commands all copy the GNU
Hello package to a remote machine:
<screen>nix copy --to ssh://machine nixpkgs.hello</screen>
<screen>nix copy --to ssh://machine /nix/store/0i2jd68mp5g6h2sa5k9c85rb80sn8hi9-hello-2.10</screen>
<screen>nix copy --to ssh://machine '(with import <nixpkgs> {}; hello)'</screen>
By contrast, <command>nix-copy-closure</command> only accepted
store paths as arguments.</para>
</listitem>
<listitem>
<para>It is self-documenting: <option>--help</option> shows
all available command-line arguments. If
<option>--help</option> is given after a subcommand, it shows
examples for that subcommand. <command>nix
--help-config</command> shows all configuration
options.</para>
</listitem>
<listitem>
<para>It is much less verbose. By default, it displays a
single-line progress indicator that shows how many packages
are left to be built or downloaded, and (if there are running
builds) the most recent line of builder output. If a build
fails, it shows the last few lines of builder output. The full
build log can be retrieved using <command>nix
log</command>.</para>
</listitem>
<listitem>
<para>It <link
xlink:href="https://github.com/NixOS/nix/commit/b8283773bd64d7da6859ed520ee19867742a03ba">provides</link>
all <filename>nix.conf</filename> configuration options as
command line flags. For example, instead of <literal>--option
http-connections 100</literal> you can write
<literal>--http-connections 100</literal>. Boolean options can
be written as
<literal>--<replaceable>foo</replaceable></literal> or
<literal>--no-<replaceable>foo</replaceable></literal>
(e.g. <option>--no-auto-optimise-store</option>).</para>
</listitem>
<listitem>
<para>Many subcommands have a <option>--json</option> flag to
write results to stdout in JSON format.</para>
</listitem>
</itemizedlist>
<warning><para>Please note that the <command>nix</command> command
is a work in progress and the interface is subject to
change.</para></warning>
<para>It provides the following high-level (“porcelain”)
subcommands:</para>
<itemizedlist>
<listitem>
<para><command>nix build</command> is a replacement for
<command>nix-build</command>.</para>
</listitem>
<listitem>
<para><command>nix run</command> executes a command in an
environment in which the specified packages are available. It
is (roughly) a replacement for <command>nix-shell
-p</command>. Unlike that command, it does not execute the
command in a shell, and has a flag (<command>-c</command>)
that specifies the unquoted command line to be
executed.</para>
<para>It is particularly useful in conjunction with chroot
stores, allowing Linux users who do not have permission to
install Nix in <command>/nix/store</command> to still use
binary substitutes that assume
<command>/nix/store</command>. For example,
<screen>nix run --store ~/my-nix nixpkgs.hello -c hello --greeting 'Hi everybody!'</screen>
downloads (or if not substitutes are available, builds) the
GNU Hello package into
<filename>~/my-nix/nix/store</filename>, then runs
<command>hello</command> in a mount namespace where
<filename>~/my-nix/nix/store</filename> is mounted onto
<command>/nix/store</command>.</para>
</listitem>
<listitem>
<para><command>nix search</command> replaces <command>nix-env
-qa</command>. It searches the available packages for
occurrences of a search string in the attribute name, package
name or description. Unlike <command>nix-env -qa</command>, it
has a cache to speed up subsequent searches.</para>
</listitem>
<listitem>
<para><command>nix copy</command> copies paths between
arbitrary Nix stores, generalising
<command>nix-copy-closure</command> and
<command>nix-push</command>.</para>
</listitem>
<listitem>
<para><command>nix repl</command> replaces the external
program <command>nix-repl</command>. It provides an
interactive environment for evaluating and building Nix
expressions. Note that it uses <literal>linenoise-ng</literal>
instead of GNU Readline.</para>
</listitem>
<listitem>
<para><command>nix upgrade-nix</command> upgrades Nix to the
latest stable version. This requires that Nix is installed in
a profile. (Thus it won’t work on NixOS, or if it’s installed
outside of the Nix store.)</para>
</listitem>
<listitem>
<para><command>nix verify</command> checks whether store paths
are unmodified and/or “trusted” (see below). It replaces
<command>nix-store --verify</command> and <command>nix-store
--verify-path</command>.</para>
</listitem>
<listitem>
<para><command>nix log</command> shows the build log of a
package or path. If the build log is not available locally, it
will try to obtain it from the configured substituters (such
as <uri>cache.nixos.org</uri>, which now provides build
logs).</para>
</listitem>
<listitem>
<para><command>nix edit</command> opens the source code of a
package in your editor.</para>
</listitem>
<listitem>
<para><command>nix eval</command> replaces
<command>nix-instantiate --eval</command>.</para>
</listitem>
<listitem>
<para><command
xlink:href="https://github.com/NixOS/nix/commit/d41c5eb13f4f3a37d80dbc6d3888644170c3b44a">nix
why-depends</command> shows why one store path has another in
its closure. This is primarily useful to finding the causes of
closure bloat. For example,
<screen>nix why-depends nixpkgs.vlc nixpkgs.libdrm.dev</screen>
shows a chain of files and fragments of file contents that
cause the VLC package to have the “dev” output of
<literal>libdrm</literal> in its closure — an undesirable
situation.</para>
</listitem>
<listitem>
<para><command>nix path-info</command> shows information about
store paths, replacing <command>nix-store -q</command>. A
useful feature is the option <option>--closure-size</option>
(<option>-S</option>). For example, the following command show
the closure sizes of every path in the current NixOS system
closure, sorted by size:
<screen>nix path-info -rS /run/current-system | sort -nk2</screen>
</para>
</listitem>
<listitem>
<para><command>nix optimise-store</command> replaces
<command>nix-store --optimise</command>. The main difference
is that it has a progress indicator.</para>
</listitem>
</itemizedlist>
<para>A number of low-level (“plumbing”) commands are also
available:</para>
<itemizedlist>
<listitem>
<para><command>nix ls-store</command> and <command>nix
ls-nar</command> list the contents of a store path or NAR
file. The former is primarily useful in conjunction with
remote stores, e.g.
<screen>nix ls-store --store https://cache.nixos.org/ -lR /nix/store/0i2jd68mp5g6h2sa5k9c85rb80sn8hi9-hello-2.10</screen>
lists the contents of path in a binary cache.</para>
</listitem>
<listitem>
<para><command>nix cat-store</command> and <command>nix
cat-nar</command> allow extracting a file from a store path or
NAR file.</para>
</listitem>
<listitem>
<para><command>nix dump-path</command> writes the contents of
a store path to stdout in NAR format. This replaces
<command>nix-store --dump</command>.</para>
</listitem>
<listitem>
<para><command
xlink:href="https://github.com/NixOS/nix/commit/e8d6ee7c1b90a2fe6d824f1a875acc56799ae6e2">nix
show-derivation</command> displays a store derivation in JSON
format. This is an alternative to
<command>pp-aterm</command>.</para>
</listitem>
<listitem>
<para><command
xlink:href="https://github.com/NixOS/nix/commit/970366266b8df712f5f9cedb45af183ef5a8357f">nix
add-to-store</command> replaces <command>nix-store
--add</command>.</para>
</listitem>
<listitem>
<para><command>nix sign-paths</command> signs store
paths.</para>
</listitem>
<listitem>
<para><command>nix copy-sigs</command> copies signatures from
one store to another.</para>
</listitem>
<listitem>
<para><command>nix show-config</command> shows all
configuration options and their current values.</para>
</listitem>
</itemizedlist>
</listitem>
<listitem>
<para>The store abstraction that Nix has had for a long time to
support store access via the Nix daemon has been extended
significantly. In particular, substituters (which used to be
external programs such as
<command>download-from-binary-cache</command>) are now subclasses
of the abstract <classname>Store</classname> class. This allows
many Nix commands to operate on such store types. For example,
<command>nix path-info</command> shows information about paths in
your local Nix store, while <command>nix path-info --store
https://cache.nixos.org/</command> shows information about paths
in the specified binary cache. Similarly,
<command>nix-copy-closure</command>, <command>nix-push</command>
and substitution are all instances of the general notion of
copying paths between different kinds of Nix stores.</para>
<para>Stores are specified using an URI-like syntax,
e.g. <uri>https://cache.nixos.org/</uri> or
<uri>ssh://machine</uri>. The following store types are supported:
<itemizedlist>
<listitem>
<para><classname>LocalStore</classname> (stori URI
<literal>local</literal> or an absolute path) and the misnamed
<classname>RemoteStore</classname> (<literal>daemon</literal>)
provide access to a local Nix store, the latter via the Nix
daemon. You can use <literal>auto</literal> or the empty
string to auto-select a local or daemon store depending on
whether you have write permission to the Nix store. It is no
longer necessary to set the <envar>NIX_REMOTE</envar>
environment variable to use the Nix daemon.</para>
<para>As noted above, <classname>LocalStore</classname> now
supports chroot builds, allowing the “physical” location of
the Nix store
(e.g. <filename>/home/alice/nix/store</filename>) to differ
from its “logical” location (typically
<filename>/nix/store</filename>). This allows non-root users
to use Nix while still getting the benefits from prebuilt
binaries from <uri>cache.nixos.org</uri>.</para>
</listitem>
<listitem>
<para><classname>BinaryCacheStore</classname> is the abstract
superclass of all binary cache stores. It supports writing
build logs and NAR content listings in JSON format.</para>
</listitem>
<listitem>
<para><classname>HttpBinaryCacheStore</classname>
(<literal>http://</literal>, <literal>https://</literal>)
supports binary caches via HTTP or HTTPS. If the server
supports <literal>PUT</literal> requests, it supports
uploading store paths via commands such as <command>nix
copy</command>.</para>
</listitem>
<listitem>
<para><classname>LocalBinaryCacheStore</classname>
(<literal>file://</literal>) supports binary caches in the
local filesystem.</para>
</listitem>
<listitem>
<para><classname>S3BinaryCacheStore</classname>
(<literal>s3://</literal>) supports binary caches stored in
Amazon S3, if enabled at compile time.</para>
</listitem>
<listitem>
<para><classname>LegacySSHStore</classname> (<literal>ssh://</literal>)
is used to implement remote builds and
<command>nix-copy-closure</command>.</para>
</listitem>
<listitem>
<para><classname>SSHStore</classname>
(<literal>ssh-ng://</literal>) supports arbitrary Nix
operations on a remote machine via the same protocol used by
<command>nix-daemon</command>.</para>
</listitem>
</itemizedlist>
</para>
</listitem>
<listitem>
<para>Security has been improved in various ways:
<itemizedlist>
<listitem>
<para>Nix now stores signatures for local store
paths. When paths are copied between stores (e.g., copied from
a binary cache to a local store), signatures are
propagated.</para>
<para>Locally-built paths are signed automatically using the
secret keys specified by the <option>secret-key-files</option>
store option. Secret/public key pairs can be generated using
<command>nix-store
--generate-binary-cache-key</command>.</para>
<para>In addition, locally-built store paths are marked as
“ultimately trusted”, but this bit is not propagated when
paths are copied between stores.</para>
</listitem>
<listitem>
<para>Content-addressable store paths no longer require
signatures — they can be imported into a store by unprivileged
users even if they lack signatures.</para>
</listitem>
<listitem>
<para>The command <command>nix verify</command> checks whether
the specified paths are trusted, i.e., have a certain number
of trusted signatures, are ultimately trusted, or are
content-addressed.</para>
</listitem>
<listitem>
<para>Substitutions from binary caches <link
xlink:href="https://github.com/NixOS/nix/commit/ecbc3fedd3d5bdc5a0e1a0a51b29062f2874ac8b">now</link>
require signatures by default. This was already the case on
NixOS.</para>
</listitem>
<listitem>
<para>In Linux sandbox builds, we <link
xlink:href="https://github.com/NixOS/nix/commit/eba840c8a13b465ace90172ff76a0db2899ab11b">now</link>
use <filename>/build</filename> instead of
<filename>/tmp</filename> as the temporary build
directory. This fixes potential security problems when a build
accidentally stores its <envar>TMPDIR</envar> in some
security-sensitive place, such as an RPATH.</para>
</listitem>
</itemizedlist>
</para>
</listitem>
<listitem>
<para><emphasis>Pure evaluation mode</emphasis>. This is a variant
of the existing restricted evaluation mode. In pure mode, the Nix
evaluator forbids access to anything that could cause different
evaluations of the same command line arguments to produce a
different result. This includes builtin functions such as
<function>builtins.getEnv</function>, but more importantly,
<emphasis>all</emphasis> filesystem or network access unless a
content hash or commit hash is specified. For example, calls to
<function>builtins.fetchGit</function> are only allowed if a
<varname>rev</varname> attribute is specified.</para>
<para>The goal of this feature is to enable true reproducibility
and traceability of builds (including NixOS system configurations)
at the evaluation level. For example, in the future,
<command>nixos-rebuild</command> might build configurations from a
Nix expression in a Git repository in pure mode. That expression
might fetch other repositories such as Nixpkgs via
<function>builtins.fetchGit</function>. The commit hash of the
top-level repository then uniquely identifies a running system,
and, in conjunction with that repository, allows it to be
reproduced or modified.</para>
</listitem>
<listitem>
<para>There are several new features to support binary
reproducibility (i.e. to help ensure that multiple builds of the
same derivation produce exactly the same output). When
<option>enforce-determinism</option> is set to
<literal>false</literal>, it’s <link
xlink:href="https://github.com/NixOS/nix/commit/8bdf83f936adae6f2c907a6d2541e80d4120f051">no
longer</link> a fatal error if build rounds produce different
output. Also, a hook named <option>diff-hook</option> is <link
xlink:href="https://github.com/NixOS/nix/commit/9a313469a4bdea2d1e8df24d16289dc2a172a169">provided</link>
to allow you to run tools such as <command>diffoscope</command>
when build rounds produce different output.</para>
</listitem>
<listitem>
<para>Configuring remote builds is a lot easier now. Provided you
are not using the Nix daemon, you can now just specify a remote
build machine on the command line, e.g. <literal>--option builders
'ssh://my-mac x86_64-darwin'</literal>. The environment variable
<envar>NIX_BUILD_HOOK</envar> has been removed and is no longer
needed. The environment variable <envar>NIX_REMOTE_SYSTEMS</envar>
is still supported for compatibility, but it is also possible to
specify builders in <command>nix.conf</command> by setting the
option <literal>builders =
@<replaceable>path</replaceable></literal>.</para>
</listitem>
<listitem>
<para>If a fixed-output derivation produces a result with an
incorrect hash, the output path is moved to the location
corresponding to the actual hash and registered as valid. Thus, a
subsequent build of the fixed-output derivation with the correct
hash is unnecessary.</para>
</listitem>
<listitem>
<para><command>nix-shell</command> <link
xlink:href="https://github.com/NixOS/nix/commit/ea59f39326c8e9dc42dfed4bcbf597fbce58797c">now</link>
sets the <varname>IN_NIX_SHELL</varname> environment variable
during evaluation and in the shell itself. This can be used to
perform different actions depending on whether you’re in a Nix
shell or in a regular build. Nixpkgs provides
<varname>lib.inNixShell</varname> to check this variable during
evaluation.</para>
</listitem>
<listitem>
<para><envar>NIX_PATH</envar> is now lazy, so URIs in the path are
only downloaded if they are needed for evaluation.</para>
</listitem>
<listitem>
<para>You can now use
<uri>channel:<replaceable>channel-name</replaceable></uri> as a
short-hand for
<uri>https://nixos.org/channels/<replaceable>channel-name</replaceable>/nixexprs.tar.xz</uri>. For
example, <literal>nix-build channel:nixos-15.09 -A hello</literal>
will build the GNU Hello package from the
<literal>nixos-15.09</literal> channel. In the future, this may
use Git to fetch updates more efficiently.</para>
</listitem>
<listitem>
<para>When <option>--no-build-output</option> is given, the last
10 lines of the build log will be shown if a build
fails.</para>
</listitem>
<listitem>
<para>Networking has been improved:
<itemizedlist>
<listitem>
<para>HTTP/2 is now supported. This makes binary cache lookups
<link
xlink:href="https://github.com/NixOS/nix/commit/90ad02bf626b885a5dd8967894e2eafc953bdf92">much
more efficient</link>.</para>
</listitem>
<listitem>
<para>We now retry downloads on many HTTP errors, making
binary caches substituters more resilient to temporary
failures.</para>
</listitem>
<listitem>
<para>HTTP credentials can now be configured via the standard
<filename>netrc</filename> mechanism.</para>
</listitem>
<listitem>
<para>If S3 support is enabled at compile time,
<uri>s3://</uri> URIs are <link
xlink:href="https://github.com/NixOS/nix/commit/9ff9c3f2f80ba4108e9c945bbfda2c64735f987b">supported</link>
in all places where Nix allows URIs.</para>
</listitem>
<listitem>
<para>Brotli compression is now supported. In particular,
<uri>cache.nixos.org</uri> build logs are now compressed using
Brotli.</para>
</listitem>
</itemizedlist>
</para>
</listitem>
<listitem>
<para><command>nix-env</command> <link
xlink:href="https://github.com/NixOS/nix/commit/b0cb11722626e906a73f10dd9a0c9eea29faf43a">now</link>
ignores packages with bad derivation names (in particular those
starting with a digit or containing a dot).</para>
</listitem>
<listitem>
<para>Many configuration options have been renamed, either because
they were unnecessarily verbose
(e.g. <option>build-use-sandbox</option> is now just
<option>sandbox</option>) or to reflect generalised behaviour
(e.g. <option>binary-caches</option> is now
<option>substituters</option> because it allows arbitrary store
URIs). The old names are still supported for compatibility.</para>
</listitem>
<listitem>
<para>The <option>max-jobs</option> option can <link
xlink:href="https://github.com/NixOS/nix/commit/7251d048fa812d2551b7003bc9f13a8f5d4c95a5">now</link>
be set to <literal>auto</literal> to use the number of CPUs in the
system.</para>
</listitem>
<listitem>
<para>Hashes can <link
xlink:href="https://github.com/NixOS/nix/commit/c0015e87af70f539f24d2aa2bc224a9d8b84276b">now</link>
be specified in base-64 format, in addition to base-16 and the
non-standard base-32.</para>
</listitem>
<listitem>
<para><command>nix-shell</command> now uses
<varname>bashInteractive</varname> from Nixpkgs, rather than the
<command>bash</command> command that happens to be in the caller’s
<envar>PATH</envar>. This is especially important on macOS where
the <command>bash</command> provided by the system is seriously
outdated and cannot execute <literal>stdenv</literal>’s setup
script.</para>
</listitem>
<listitem>
<para>Nix can now automatically trigger a garbage collection if
free disk space drops below a certain level during a build. This
is configured using the <option>min-free</option> and
<option>max-free</option> options.</para>
</listitem>
<listitem>
<para><command>nix-store -q --roots</command> and
<command>nix-store --gc --print-roots</command> now show temporary
and in-memory roots.</para>
</listitem>
<listitem>
<para>
Nix can now be extended with plugins. See the documentation of
the <option>plugin-files</option> option for more details.
</para>
</listitem>
</itemizedlist>
<para>The Nix language has the following new features:
<itemizedlist>
<listitem>
<para>It supports floating point numbers. They are based on the
C++ <literal>float</literal> type and are supported by the
existing numerical operators. Export and import to and from JSON
and XML works, too.</para>
</listitem>
<listitem>
<para>Derivation attributes can now reference the outputs of the
derivation using the <function>placeholder</function> builtin
function. For example, the attribute
<programlisting>
configureFlags = "--prefix=${placeholder "out"} --includedir=${placeholder "dev"}";
</programlisting>
will cause the <envar>configureFlags</envar> environment variable
to contain the actual store paths corresponding to the
<literal>out</literal> and <literal>dev</literal> outputs.</para>
</listitem>
</itemizedlist>
</para>
<para>The following builtin functions are new or extended:
<itemizedlist>
<listitem>
<para><function
xlink:href="https://github.com/NixOS/nix/commit/38539b943a060d9cdfc24d6e5d997c0885b8aa2f">builtins.fetchGit</function>
allows Git repositories to be fetched at evaluation time. Thus it
differs from the <function>fetchgit</function> function in
Nixpkgs, which fetches at build time and cannot be used to fetch
Nix expressions during evaluation. A typical use case is to import
external NixOS modules from your configuration, e.g.
<programlisting>imports = [ (builtins.fetchGit https://github.com/edolstra/dwarffs + "/module.nix") ];</programlisting>
</para>
</listitem>
<listitem>
<para>Similarly, <function>builtins.fetchMercurial</function>
allows you to fetch Mercurial repositories.</para>
</listitem>
<listitem>
<para><function>builtins.path</function> generalises
<function>builtins.filterSource</function> and path literals
(e.g. <literal>./foo</literal>). It allows specifying a store path
name that differs from the source path name
(e.g. <literal>builtins.path { path = ./foo; name = "bar";
}</literal>) and also supports filtering out unwanted
files.</para>
</listitem>
<listitem>
<para><function>builtins.fetchurl</function> and
<function>builtins.fetchTarball</function> now support
<varname>sha256</varname> and <varname>name</varname>
attributes.</para>
</listitem>
<listitem>
<para><function
xlink:href="https://github.com/NixOS/nix/commit/b8867a0239b1930a16f9ef3f7f3e864b01416dff">builtins.split</function>
splits a string using a POSIX extended regular expression as the
separator.</para>
</listitem>
<listitem>
<para><function
xlink:href="https://github.com/NixOS/nix/commit/26d92017d3b36cff940dcb7d1611c42232edb81a">builtins.partition</function>
partitions the elements of a list into two lists, depending on a
Boolean predicate.</para>
</listitem>
<listitem>
<para><literal><nix/fetchurl.nix></literal> now uses the
content-addressable tarball cache at
<uri>http://tarballs.nixos.org/</uri>, just like
<function>fetchurl</function> in
Nixpkgs. (f2682e6e18a76ecbfb8a12c17e3a0ca15c084197)</para>
</listitem>
<listitem>
<para>In restricted and pure evaluation mode, builtin functions
that download from the network (such as
<function>fetchGit</function>) are permitted to fetch underneath a
list of URI prefixes specified in the option
<option>allowed-uris</option>.</para>
</listitem>
</itemizedlist>
</para>
<para>The Nix build environment has the following changes:
<itemizedlist>
<listitem>
<para>Values such as Booleans, integers, (nested) lists and
attribute sets can <link
xlink:href="https://github.com/NixOS/nix/commit/6de33a9c675b187437a2e1abbcb290981a89ecb1">now</link>
be passed to builders in a non-lossy way. If the special attribute
<varname>__structuredAttrs</varname> is set to
<literal>true</literal>, the other derivation attributes are
serialised in JSON format and made available to the builder via
the file <envar>.attrs.json</envar> in the builder’s temporary
directory. This obviates the need for
<varname>passAsFile</varname> since JSON files have no size
restrictions, unlike process environments.</para>
<para><link
xlink:href="https://github.com/NixOS/nix/commit/2d5b1b24bf70a498e4c0b378704cfdb6471cc699">As
a convenience to Bash builders</link>, Nix writes a script named
<envar>.attrs.sh</envar> to the builder’s directory that
initialises shell variables corresponding to all attributes that
are representable in Bash. This includes non-nested (associative)
arrays. For example, the attribute <literal>hardening.format =
true</literal> ends up as the Bash associative array element
<literal>${hardening[format]}</literal>.</para>
</listitem>
<listitem>
<para>Builders can <link
xlink:href="https://github.com/NixOS/nix/commit/88e6bb76de5564b3217be9688677d1c89101b2a3">now</link>
communicate what build phase they are in by writing messages to
the file descriptor specified in <envar>NIX_LOG_FD</envar>. The
current phase is shown by the <command>nix</command> progress
indicator.
</para>
</listitem>
<listitem>
<para>In Linux sandbox builds, we <link
xlink:href="https://github.com/NixOS/nix/commit/a2d92bb20e82a0957067ede60e91fab256948b41">now</link>
provide a default <filename>/bin/sh</filename> (namely
<filename>ash</filename> from BusyBox).</para>
</listitem>
<listitem>
<para>In structured attribute mode,
<varname>exportReferencesGraph</varname> <link
xlink:href="https://github.com/NixOS/nix/commit/c2b0d8749f7e77afc1c4b3e8dd36b7ee9720af4a">exports</link>
extended information about closures in JSON format. In particular,
it includes the sizes and hashes of paths. This is primarily
useful for NixOS image builders.</para>
</listitem>
<listitem>
<para>Builds are <link
xlink:href="https://github.com/NixOS/nix/commit/21948deed99a3295e4d5666e027a6ca42dc00b40">now</link>
killed as soon as Nix receives EOF on the builder’s stdout or
stderr. This fixes a bug that allowed builds to hang Nix
indefinitely, regardless of
timeouts.</para>
</listitem>
<listitem>
<para>The <option>sandbox-paths</option> configuration
option can now specify optional paths by appending a
<literal>?</literal>, e.g. <literal>/dev/nvidiactl?</literal> will
bind-mount <varname>/dev/nvidiactl</varname> only if it
exists.</para>
</listitem>
<listitem>
<para>On Linux, builds are now executed in a user
namespace with UID 1000 and GID 100.</para>
</listitem>
</itemizedlist>
</para>
<para>A number of significant internal changes were made:
<itemizedlist>
<listitem>
<para>Nix no longer depends on Perl and all Perl components have
been rewritten in C++ or removed. The Perl bindings that used to
be part of Nix have been moved to a separate package,
<literal>nix-perl</literal>.</para>
</listitem>
<listitem>
<para>All <classname>Store</classname> classes are now
thread-safe. <classname>RemoteStore</classname> supports multiple
concurrent connections to the daemon. This is primarily useful in
multi-threaded programs such as
<command>hydra-queue-runner</command>.</para>
</listitem>
</itemizedlist>
</para>
<para>This release has contributions from
Adrien Devresse,
Alexander Ried,
Alex Cruice,
Alexey Shmalko,
AmineChikhaoui,
Andy Wingo,
Aneesh Agrawal,
Anthony Cowley,
Armijn Hemel,
aszlig,
Ben Gamari,
Benjamin Hipple,
Benjamin Staffin,
Benno Fünfstück,
Bjørn Forsman,
Brian McKenna,
Charles Strahan,
Chase Adams,
Chris Martin,
Christian Theune,
Chris Warburton,
Daiderd Jordan,
Dan Connolly,
Daniel Peebles,
Dan Peebles,
davidak,
David McFarland,
Dmitry Kalinkin,
Domen Kožar,
Eelco Dolstra,
Emery Hemingway,
Eric Litak,
Eric Wolf,
Fabian Schmitthenner,
Frederik Rietdijk,
Gabriel Gonzalez,
Giorgio Gallo,
Graham Christensen,
Guillaume Maudoux,
Harmen,
Iavael,
James Broadhead,
James Earl Douglas,
Janus Troelsen,
Jeremy Shaw,
Joachim Schiele,
Joe Hermaszewski,
Joel Moberg,
Johannes 'fish' Ziemke,
Jörg Thalheim,
Jude Taylor,
kballou,
Keshav Kini,
Kjetil Orbekk,
Langston Barrett,
Linus Heckemann,
Ludovic Courtès,
Manav Rathi,
Marc Scholten,
Markus Hauck,
Matt Audesse,
Matthew Bauer,
Matthias Beyer,
Matthieu Coudron,
N1X,
Nathan Zadoks,
Neil Mayhew,
Nicolas B. Pierron,
Niklas Hambüchen,
Nikolay Amiantov,
Ole Jørgen Brønner,
Orivej Desh,
Peter Simons,
Peter Stuart,
Pyry Jahkola,
regnat,
Renzo Carbonara,
Rhys,
Robert Vollmert,
Scott Olson,
Scott R. Parish,
Sergei Trofimovich,
Shea Levy,
Sheena Artrip,
Spencer Baugh,
Stefan Junker,
Susan Potter,
Thomas Tuegel,
Timothy Allen,
Tristan Hume,
Tuomas Tynkkynen,
tv,
Tyson Whitehead,
Vladimír Čunát,
Will Dietz,
wmertens,
Wout Mertens,
zimbatm and
Zoran Plesivčak.
</para>
</section>
