about summary refs log tree commit diff
path: root/scripts
AgeCommit message (Collapse)AuthorFilesLines
2016-04-14 install-nix-from-closure: Don't run nix-store --verifyEelco Dolstra1-5/+0
Verification is slow. Also, we really shouldn't advise users to nuke their store.
2016-04-12 Merge branch 'patch-2' of git://github.com/wmertens/nixShea Levy1-1/+9
install-nix-from-closure improvments
2016-04-11 Remove manifest supportEelco Dolstra6-574/+7
Manifests have been superseded by binary caches for years. This also gets rid of nix-pull, nix-generate-patches and bsdiff/bspatch.
2016-04-10 Bring nix-profile.sh in line with NixOSWout Mertens1-13/+63
Use the same logic as NixOS' profile and environment setup. Closes #414
2016-04-10 Remove information about nix-store --optimiseWout Mertens1-9/+0
2016-04-10 Always verify nix store on installwmertens1-1/+18
Just wasted a couple hours chasing shadows because the nix store got corrupted and there was no indication of that anywhere. Since an install is one-time only, might as well verify. Optimization showed that the copied files aren't read-only; fixed that as well. Also, use /bin/sh since there's a good chance that this script will be run on systems without /bin/bash
2016-02-19 Merge branch 'master' of git://github.com/stepcut/nixShea Levy1-1/+1
2016-02-16 Add C++ functions for .narinfo processing / signingEelco Dolstra1-6/+3
This is currently only used by the Hydra queue runner rework, but like eff5021eaa6dc69f65ea1a8abe8f3ab11ef5eb0a it presumably will be useful for the C++ rewrite of nix-push and download-from-binary-cache. (@shlevy)
2016-02-16 nix-profile.sh.in: find ca-bundle.pem on openSUSE Tumbleweed machinesPeter Simons1-0/+2
2016-02-12 nix-profile.sh.in: quote use of $HOME in shell argumentsPeter Simons1-2/+2
All other places in the script do this already, so let's be consistent.
2016-02-10 Check shell profile is writeable before modifyingAlex Cruice1-1/+1
The `set -e` at the top of the script causes the installation to fail to complete if the shell profile is not writeable. Checking file existence only is not enough.
2016-01-20 Fix broken call to shellwordsBrian McKenna1-1/+1
nix-shell shebangs were broken by 9018deab
2016-01-05 Verify TLS certificate before downloading binariesPhilip Potter2-3/+2
The --insecure flag to curl tells curl not to bother checking if the TLS certificate presented by the server actually matches the hostname requested, and actually is issued by a trusted CA chain. This almost entirely negates any benefit from using TLS in the first place. This removes the --insecure flag to ensure we actually have a secure connection to the intended hostname before downloading binaries. Manually tested locally within a dev-shell; was able to download binaries from https://cache.nixos.org without issue. [Note: --insecure was only used for fetching NARs, whose integrity is verified by Nix anyway using the hash from the .narinfo. But if we can fetch the .narinfo without --insecure, we can also fetch the .nar, so there is not much point to using --insecure. --Eelco]
2016-01-05 propagate NIX_BUILD_SHELL also in pure builds document NIX_BUILD_SHELL in ↵Fabian Schmitthenner1-1/+1
the nix-shell command documentation
2015-12-07 Use shellwords for nix-shell shebangBrian McKenna1-1/+2
Previously we can't have quoted arguments. This now allows us to use things like `ghcWithPackages`
2015-12-06 Clarify installation error message that is shown when /nix/store exists but ↵Jeremy Shaw1-1/+1
is not writable by the user
2015-11-25 Set default binary-caches-parallel-connections to 25Eelco Dolstra1-1/+1
Some benchmarking suggested this as a good value. Running $ benchmark -f ... -t 25 -- sh -c 'rm -f /nix/var/nix/binary-cache*; nix-store -r /nix/store/x5z8a2yvz8h6ccmhwrwrp9igg03575jg-nixos-15.09.git.5fd87e1M.drv --dry-run --option binary-caches-parallel-connections <N>' gave the following mean elapsed times for these values of N: N=10: 3.3541 N=20: 2.9320 N=25: 2.6690 N=30: 2.9417 N=50: 3.2021 N=100: 3.5718 N=150: 4.2079 Memory usage is also reduced (N=150 used 186 MB, N=25 only 68 MB). Closes #708.
2015-11-21 reintroduce host deps in tandem with sandbox profilesJude Taylor1-1/+1
2015-11-10 Fix bad characters in "copying 7 missing paths from ..."Eelco Dolstra1-0/+1
2015-10-21 resolve-system-dependencies.pl: Simplify union implShea Levy1-8/+2
Patch by @pikajude
2015-10-21 appropriately handle lock acquisition failures in resolve-system-dependencies.plJude Taylor1-2/+7
2015-10-21 Add resolve-system-dependencies.plJude Taylor2-0/+125
2015-10-01 nix-prefetch-url: Rewrite in C++Eelco Dolstra2-133/+0
2015-09-25 Also set CURLOPT_SSL_VERIFYHOST=0 when "verify-https-binary-caches" is falseUtku Demir1-1/+6
This makes that option even more insecure, by also not checking the SSL host. But without this parameter, one can still get SSL errors even when "verify-https-binary-caches" is false, which is unexpected IMO.
2015-08-07 Drop newline in error messageEelco Dolstra1-1/+1
2015-07-20 nix-copy-closure: Add -v flagEelco Dolstra2-2/+5
And make exportPath() less spammy by default.
2015-07-01 Revert "add the manpath to the installer"Eelco Dolstra1-1/+0
This reverts commit 76f985b92d95fef967c1f3193d05244ced15420b. We shouldn't mess with $MANPATH, because on some "man" implementations (like NixOS'), the default value on $MANPATH is derived from $PATH. So if you set $MANPATH, you lose the default locations.
2015-06-12 nix-channel: Fix bogus error message caused by ↵Eelco Dolstra1-3/+3
8a84bd8c8bda1e4c6764c10ecdef9d74e4884800
2015-06-08 nix-push: Support -jEelco Dolstra1-1/+6
Fixes #548.
2015-06-08 Update cacert locationsEelco Dolstra2-5/+9
2015-06-04 copy-from-other-stores: Use cpEelco Dolstra1-1/+1
2015-06-03 NamingEelco Dolstra1-2/+2
2015-06-01 nix-shell: Support multiple "#! nix-shell" linesEelco Dolstra1-1/+1
2015-05-21 nix-shell: Barf if -p and -E are both usedEelco Dolstra1-0/+2
Closes #454, #455.
2015-05-05 nix-shell: Fix uninitialized value warningEelco Dolstra1-1/+1
2015-04-27 Merge branch 'nix-channel-tarballs' of git://github.com/copumpkin/nixShea Levy1-35/+54
2015-04-22 nix-collect-garbage: translate to C++Luca Bruno2-66/+0
2015-04-20 Support tarballs in nix channel URLsDan Peebles1-35/+54
2015-04-12 add the manpath to the installerMichael Merickel1-0/+1
2015-03-04 Reduce verbosity in build-remote.plEelco Dolstra1-0/+2
2015-02-22 Merge branch 'gh-476-fix-install-script' of git://github.com/jramnani/nixShea Levy1-1/+1
sometimes cd prints to stdout
2015-02-19 FIXMEsEelco Dolstra1-0/+4
2015-02-18 Escape arguments to nix-shell #! scriptsEelco Dolstra1-2/+6
2015-02-18 Support passing command line arguments to nix-shell #! scriptsEelco Dolstra1-2/+5
2015-02-18 Fix nix-shell shebang scripts if -p is usedEelco Dolstra1-1/+1
2015-02-17 Include NAR size in fingerprint computationEelco Dolstra1-1/+1
This is not strictly needed for integrity (since we already include the NAR hash in the fingerprint) but it helps against endless data attacks [1]. (However, this will also require download-from-binary-cache.pl to bail out if it receives more than the specified number of bytes.) [1] https://isis.poly.edu/~jcappos/papers/cappos_mirror_ccs_08.pdf
2015-02-11 Nix install script failed when "cd" printed to stdout.Jeff Ramnani1-1/+1
In some cases the bash builtin command "cd" can print the variable $CWD to stdout. This caused the install script to fail while copying files because the source path was wrong. Fixes #476.
2015-02-08 nix-build: Respect -Q during evaluationShea Levy1-0/+5
Fixes #474
2015-02-04 Sign a subset of the .narinfoEelco Dolstra1-2/+3
We only need to sign the store path, NAR hash and references (the "fingerprint"). Everything else is irrelevant to security. For instance, the compression algorithm or the hash of the compressed NAR don't matter as long as the contents of the uncompressed NAR are correct. (Maybe we should include derivers in the fingerprint, but they're broken and nobody cares about them. Also, it might be nice in the future if .narinfos contained signatures from multiple independent signers. But that's impossible if the deriver is included in the fingerprint, since everybody will tend to have a different deriver for the same store path.) Also renamed the "Signature" field to "Sig" since the format changed in an incompatible way.
2015-02-04 Use libsodium instead of OpenSSL for binary cache signingEelco Dolstra1-13/+12
Sodium's Ed25519 signatures are much shorter than OpenSSL's RSA signatures. Public keys are also much shorter, so they're now specified directly in the nix.conf option ‘binary-cache-public-keys’. The new command ‘nix-store --generate-binary-cache-key’ generates and prints a public and secret key.
generated by cgit-pink 1.4.1 (git 2.44.2) at 2024-11-23T13·49+0000