Age | Commit message (Collapse) | Author | Files | Lines |
|
On Linux it's possible to run a process in its own network namespace,
meaning that it gets its own set of network interfaces, disjunct from
the rest of the system. We use this to completely remove network
access to chroot builds, except that they get a private loopback
interface. This means that:
- Builders cannot connect to the outside network or to other processes
on the same machine, except processes within the same build.
- Vice versa, other processes cannot connect to processes in a chroot
build, and open ports/connections do not show up in "netstat".
- If two concurrent builders try to listen on the same port (e.g. as
part of a test), they no longer conflict with each other.
This was inspired by the "PrivateNetwork" flag in systemd.
|
|
Systemd can start the Nix daemon on demand when the Nix daemon socket
is first accessed. This is signalled through the LISTEN_FDS
environment variable, so all we need to do is check for that and then
use file descriptor 3 as the listen socket instead of creating one
ourselves.
|
|
|
|
- register the file for distribution in Makefile.am
|
|
enable and start it
|
|
build dependencies - Configure users and groups for multi-user mode - Fix installation location of Perl modules
|
|
usable by normal users - install as a data file, not a program file
|
|
RPM versions - move tests to dedicated %check section - use standard build macros
|
|
|
|
|
|
|
|
We can't open a SQLite database if the disk is full. Since this
prevents the garbage collector from running when it's most needed, we
reserve some dummy space that we can free just before doing a garbage
collection. This actually revives some old code from the Berkeley DB
days.
Fixes #27.
|
|
Fixes #26.
|
|
|
|
|
|
For several platforms we don't currently have "native" Nix packages
(e.g. Mac OS X and FreeBSD). This provides the next best thing: a
tarball containing the closure of Nix, plus a simple script
"nix-finish-install" that initialises the Nix database, registers the
paths in the closure as valid, and runs "nix-env -i /path/to/nix" to
initialise the user profile.
The tarball must be unpacked in the root directory. It creates
/nix/store/... and /usr/bin/nix-finish-install. Typical installation
is as follows:
$ cd /
$ tar xvf /path/to/nix-1.1pre1234_abcdef-x86_64-linux.tar.bz2
$ nix-finish-install
(if necessary add ~/.nix-profile/etc/profile.d/nix.sh to the shell
login scripts)
After this, /usr/bin/nix-finish-install can be deleted, if desired.
The downside to the binary tarball is that it's pretty big (~55 MiB
for x86_64-linux).
|
|
It's no longer needed because Nixpkgs' fontconfig uses
/etc/fonts/fonts.conf as a default, just like other distributions.
|
|
To use it, just do (e.g.) "nix-build build.nix -A nix_env".
|
|
|
|
|
|
|
|
|
|
|
|
http://hydra.nixos.org/build/2602599
|
|
|
|
|
|
Since the Perl bindings require shared libraries, this is required on
platforms such as Cygwin where we do a static build.
|
|
|
|
|
|
The dependencies of the corepkgs are not necessarily in the chroot (or
in the Nix store), so don't build them in a chroot.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Perl on some 32-bit systems needs -D_FILE_OFFSET_BITS=64. See also commit
02f1363e19b7df7cccc3523805bbf4fafe429529.
|
|
This fixes the Darwin build (http://hydra.nixos.org/build/2517380).
Hopefully it doesn't break other builds.
|
|
new SQLite
|
|
|
|
Nix needs SQLite's foreign key constraint feature, which was
introduced in 3.6.19. Without it, the database won't be cleaned up
correctly when paths are deleted. See
e.g. http://hydra.nixos.org/build/2494142.
|
|
Perl <= 5.10 doesn't have make_path. See
e.g. http://hydra.nixos.org/build/2493981.
|
|
|
|
|
|
to disable use of substitutes; i.e., force building from source.
Fixes Nix/221.
|
|
Mandatory features are features that MUST be present in a derivation's
requiredSystemFeatures attribute. One application is performance
testing, where we have a dedicated machine to run performance tests
(and nothing else). Then we would add the label "perf" to the
machine's mandatory features and to the performance testing
derivations.
|
|
|
|
There is a race condition when doing parallel builds with chroots and
the immutable bit enabled. One process may call makeImmutable()
before the other has called link(), in which case link() will fail
with EPERM. We could retry or wrap the operation in a lock, but since
this condition is rare and I'm lazy, we just use the existing copy
fallback.
Fixes #9.
|
|
|
|
|