depot - monorepo for the virus lounge

Age	Commit message (Collapse)	Author	Files	Lines
2015-12-10	Build sandbox support etc. unconditionally on Linux	Eelco Dolstra	1	-39/+17
	Also, use "#if __APPLE__" instead of "#if SANDBOX_ENABLED" to prevent ambiguity.
2015-12-08	Clarify error message for hash mismatches (again)	Bjørn Forsman	1	-2/+2
	This is arguably nitpicky, but I think this new formulation is even clearer. My thinking is that it's easier to comprehend when the calculated hash value is displayed close to the output path. (I think it is somewhat similar to eliminating double negatives in logic statements.) The formulation is inspired / copied from the OpenEmbedded build tool, bitbake.
2015-12-02	Use deterministic $TMPDIR in sandbox	Eelco Dolstra	1	-28/+36
	Rather than using $<host-TMPDIR>/nix-build-<drvname>-<number>, the temporary directory is now always /tmp/nix-build-<drvname>-0. This improves bitwise-exact reproducibility for builds that store $TMPDIR in their build output. (Of course, those should still be fixed...)
2015-11-25	Merge branch 'p/sandbox-rename-minimal' of https://github.com/vcunat/nix	Eelco Dolstra	1	-8/+15

2015-11-25	Fix build failure introduced by #704	Eelco Dolstra	1	-2/+3
	Also, make the FreeBSD checks conditional on FreeBSD.
2015-11-24	Merge pull request #704 from ysangkok/freebsd-support	Eelco Dolstra	1	-0/+2
	FreeBSD support with knowledge about Linux emulation
2015-11-21	reintroduce host deps in tandem with sandbox profiles	Jude Taylor	1	-2/+1

2015-11-19	re-fix permissions for GHC	Jude Taylor	1	-2/+5

2015-11-19	Merge branch 'sandbox-profiles' of git://github.com/pikajude/nix	Shea Levy	1	-20/+28
	Temporarily allow derivations to describe their full sandbox profile. This will be eventually scaled back to a more secure setup, see the discussion at #695
2015-11-19	src/libstore/build.cc: clarify error message for hash mismatches	Peter Simons	1	-1/+1
	Nix reports a hash mismatch saying: output path ‘foo’ should have sha256 hash ‘abc’, instead has ‘xyz’ That message is slightly ambiguous and some people read that statement to mean the exact opposite of what it is supposed to mean. After this patch, the message will be: Nix expects output path ‘foo’ to have sha256 hash ‘abc’, instead it has ‘xyz’
2015-11-17	FreeBSD can build Linux 32-bit binaries	janus	1	-0/+2

2015-11-16	AutoDelete: Add default constructor with deletion disabled	Shea Levy	1	-1/+1

2015-11-15	Use AutoDelete for sandbox profile file	Shea Levy	1	-5/+14

2015-11-14	simplify build.cc using modern C++ features	Jude Taylor	1	-33/+31

2015-11-14	simplify build permissions	Jude Taylor	1	-13/+3

2015-11-14	use per-derivation sandbox profiles	Jude Taylor	1	-28/+39

2015-11-10	rename `chroot` to `sandbox` (fixes #656, close #682)	Vladimír Čunát	1	-8/+15
	- rename options but leav old names as lower-priority aliases, also "-dirs" -> "-paths" to get closer to the meaning - update docs to reflect the new names (old aliases are not documented), including a new file with release notes - tests need an update after corresponding changes to nixpkgs - __noChroot is left as it is (after discussion on the PR)
2015-11-09	Add option to verify build determinism	Eelco Dolstra	1	-9/+53
	Passing "--option build-repeat <N>" will cause every build to be repeated N times. If the build output differs between any round, the build is rejected, and the output paths are not registered as valid. This is primarily useful to verify build determinism. (We already had a --check option to repeat a previously succeeded build. However, with --check, non-deterministic builds are registered in the DB. Preventing that is useful for Hydra to ensure that non-deterministic builds don't end up getting published at all.)
2015-11-09	Revert "Allow using /bin and /usr/bin as impure prefixes on non-darwin by ↵	Eelco Dolstra	1	-1/+1
	default" This reverts commit 79ca5033329053caa364bb2f7e50953f859cc97f. Ouch, never noticed this. We definitely don't want to allow builds to have arbitrary access to /bin and /usr/bin, because then they can (for instance) bring in a bunch of setuid programs. Also, we shouldn't be encouraging the use of impurities in the default configuration.
2015-10-29	int2String() -> std::to_string()	Eelco Dolstra	1	-2/+2

2015-10-21	use nixDataDir instead of appending /share to PREFIX	Jude Taylor	1	-1/+1

2015-10-21	clarifying comment	Jude Taylor	1	-1/+5

2015-10-21	move preBuildHook defaulting to globals.cc	Jude Taylor	1	-7/+0

2015-10-21	restore old DEFAULT_ALLOWED_IMPURE_PREFIXES	Jude Taylor	1	-1/+1

2015-10-21	Add resolve-system-dependencies.pl	Jude Taylor	1	-0/+7

2015-10-21	fix line reading in preBuildHook	Jude Taylor	1	-1/+1

2015-10-21	remove sandbox defaults into a new file	Jude Taylor	1	-65/+5

2015-10-21	restore allowed impure prefixes	Jude Taylor	1	-1/+1

2015-10-21	remove an unneeded default impure-dep	Jude Taylor	1	-1/+0

2015-10-21	make sandbox builds more permissive	Jude Taylor	1	-2/+2

2015-10-21	add a few more permissions	Jude Taylor	1	-3/+45

2015-10-21	Allow builtin fetchurl regardless of the derivation's system attribute	Eelco Dolstra	1	-12/+13

2015-10-21	Fix segfault in builtin fetchurl	Eelco Dolstra	1	-3/+7
	The stack allocated for the builder was way too small (32 KB). This is sufficient for normal derivations, because they just do some setup and then exec() the actual builder. But for the fetchurl builtin derivation it's not enough. Also, allocating the stack on the caller's stack was fishy business.
2015-10-08	Allow building ARMv6 stuff on ARMv7	Tuomas Tynkkynen	1	-0/+1
	This allows building a Raspberry Pi image on modern, faster boards.
2015-10-06	nix-store --serve: Implement log size limit	Eelco Dolstra	1	-1/+2

2015-09-18	Shut up clang warnings	Eelco Dolstra	1	-4/+4

2015-09-02	Filter build-chroot-dirs entries that conflict with derivation outputs	Eelco Dolstra	1	-4/+4
	Fixes https://github.com/NixOS/nixpkgs/issues/9504. Note that this means we may have a non-functional /bin/sh in the chroot while rebuilding Bash or one of its dependencies. Ideally those packages don't rely on /bin/sh though.
2015-09-02	Remove unused variable	Eelco Dolstra	1	-5/+0

2015-08-24	Prevent .chroot from being GC'ed when using LocalStore::buildDerivation()	Eelco Dolstra	1	-0/+4
	Fixes #616.
2015-08-19	Remove unneeded HAVE_UNSHARE.	Manolis Ragkousis	1	-1/+1
	* src/libstore/build.cc (CHROOT_ENABLED): Remove HAVE_UNSHARE.
2015-08-04	Don't include <iostream> before config.h	Eelco Dolstra	1	-2/+2
	This breaks the build on 32-bit systems. http://hydra.nixos.org/build/24373658
2015-08-03	Handle debug messages from runChild()	Eelco Dolstra	1	-10/+16
	Turns out that "nix-build -vvv" with chroots enabled has been broken for some time, because some debug message got interpreted as an error.
2015-07-26	Remove unnecessary parentheses	Eelco Dolstra	1	-2/+2

2015-07-21	Fix Darwin build	Eelco Dolstra	1	-1/+4
	Turns out getgrouplist() is not POSIX. http://hydra.nixos.org/build/23881243
2015-07-20	Make <nix/fetchurl.nix> a builtin builder	Eelco Dolstra	1	-3/+25
	This ensures that 1) the derivation doesn't change when Nix changes; 2) the derivation closure doesn't contain Nix and its dependencies; 3) we don't have to rely on ugly chroot hacks.
2015-07-20	Provide more detailed info about build status to hydra-queue-runner	Eelco Dolstra	1	-43/+61
	In particular, hydra-queue-runner can now distinguish between remote build / substitution / already-valid. For instance, if a path already existed on the remote side, we don't want to store a log file.
2015-07-17	OCD: foreach -> C++11 ranged for	Eelco Dolstra	1	-103/+101

2015-07-17	Allow remote builds without sending the derivation closure	Eelco Dolstra	1	-137/+206
	Previously, to build a derivation remotely, we had to copy the entire closure of the .drv file to the remote machine, even though we only need the top-level derivation. This is very wasteful: the closure can contain thousands of store paths, and in some Hydra use cases, include source paths that are very large (e.g. Git/Mercurial checkouts). So now there is a new operation, StoreAPI::buildDerivation(), that performs a build from an in-memory representation of a derivation (BasicDerivation) rather than from a on-disk .drv file. The only files that need to be in the Nix store are the sources of the derivation (drv.inputSrcs), and the needed output paths of the dependencies (as described by drv.inputDrvs). "nix-store --serve" exposes this interface. Note that this is a privileged operation, because you can construct a derivation that builds any store path whatsoever. Fixing this will require changing the hashing scheme (i.e., the output paths should be computed from the other fields in BasicDerivation, allowing them to be verified without access to other derivations). However, this would be quite nice because it would allow .drv-free building (e.g. "nix-env -i" wouldn't have to write any .drv files to disk). Fixes #173.
2015-07-02	Typo	Eelco Dolstra	1	-1/+1

2015-07-01	Preserve supplementary groups of build users	Ludovic Courtès	1	-2/+18
	The following patch is an attempt to address this bug (see <http://bugs.gnu.org/18994>) by preserving the supplementary groups of build users in the build environment. In practice, I would expect that supplementary groups would contain only one or two groups: the build users group, and possibly the “kvm” group. [Changed &at(0) to data() and removed tabs - Eelco]