depot - monorepo for the virus lounge

Age	Commit message (Collapse)	Author	Files	Lines
2013-03-08	Revert "Prevent config.h from being clobbered"	Eelco Dolstra	1	-5/+13
	This reverts commit 28bba8c44f484eae38e8a15dcec73cfa999156f6.
2013-03-07	Prevent config.h from being clobbered	Eelco Dolstra	1	-13/+5

2013-02-26	Security: Don't allow builders to change permissions on files they don't own	Eelco Dolstra	1	-2/+2
	It turns out that in multi-user Nix, a builder may be able to do ln /etc/shadow $out/foo Afterwards, canonicalisePathMetaData() will be applied to $out/foo, causing /etc/shadow's mode to be set to 444 (readable by everybody but writable by nobody). That's obviously Very Bad. Fortunately, this fails in NixOS's default configuration because /nix/store is a bind mount, so "ln" will fail with "Invalid cross-device link". It also fails if hard-link restrictions are enabled, so a workaround is: echo 1 > /proc/sys/fs/protected_hardlinks The solution is to check that all files in $out are owned by the build user. This means that innocuous operations like "ln ${pkgs.foo}/some-file $out/" are now rejected, but that already failed in chroot builds anyway.
2013-02-19	Enable chroot support on old glibc versions.	Ludovic Courtès	1	-0/+6

2013-01-17	Store build logs in /nix/var/log/nix/drvs/<XX>	Eelco Dolstra	1	-3/+5
	...where <XX> is the first two characters of the derivation. Otherwise /nix/var/log/nix/drvs may become so large that we run into all sorts of weird filesystem limits/inefficiences. For instance, ext3/ext4 filesystems will barf with "ext4_dx_add_entry:1551: Directory index full!" once you hit a few million files.
2013-01-03	Clear any immutable bits in the Nix store	Eelco Dolstra	1	-8/+1
	Doing this once makes subsequent operations like garbage collecting more efficient since we don't have to call makeMutable() first.
2013-01-02	If a substitute closure is incomplete, build dependencies, then retry the ↵	Eelco Dolstra	1	-7/+28
	substituter Issue #77.
2013-01-02	Automatically fall back if the references of a substitute are not substitutable	Eelco Dolstra	1	-1/+1
	Fixes #77.
2012-12-29	Allow mounting a path in a different location in the chroot	Eelco Dolstra	1	-7/+14
	Fixes #24.
2012-12-19	Kill the build hook rather than shutting it down cleanly	Eelco Dolstra	1	-7/+1
	Waiting for the hook to shut down cleanly sometimes seems to lead to hangs.
2012-12-18	Revert brain fart	Eelco Dolstra	1	-2/+0
	This reverts commit cc511fd65b7b6de9e87e72fb4bed16fc7efeb8b7.
2012-12-18	Check for potential infinite select() loops when building	Eelco Dolstra	1	-0/+2

2012-11-26	Only substitute wanted outputs of a derivation	Eelco Dolstra	1	-9/+50
	If a derivation has multiple outputs, then we only want to download those outputs that are actuallty needed. So if we do "nix-build -A openssl.man", then only the "man" output should be downloaded. Likewise if another package depends on ${openssl.man}. The tricky part is that different derivations can depend on different outputs of a given derivation, so we may need to restart the corresponding derivation goal if that happens.
2012-11-26	Make "nix-build -A <derivation>.<output>" do the right thing	Eelco Dolstra	1	-3/+5
	For example, given a derivation with outputs "out", "man" and "bin": $ nix-build -A pkg produces ./result pointing to the "out" output; $ nix-build -A pkg.man produces ./result-man pointing to the "man" output; $ nix-build -A pkg.all produces ./result, ./result-man and ./result-bin; $ nix-build -A pkg.all -A pkg2 produces ./result, ./result-man, ./result-bin and ./result-2.
2012-11-15	Disable use of vfork()	Eelco Dolstra	1	-1/+1
	vfork() is just too weird. For instance, in this build: http://hydra.nixos.org/build/3330487 the value fromHook.writeSide becomes corrupted in the parent, even though the child only reads from it. At -O0 the problem goes away. Probably the child is overriding some spilled temporary variable. If I get bored I may implement using posix_spawn() instead.
2012-11-15	Don't use std::cerr in a few places	Eelco Dolstra	1	-10/+8
	Slightly scared of using std::cerr in a vforked process...
2012-11-09	Use vfork() instead of fork() if available	Eelco Dolstra	1	-14/+13
	Hopefully this reduces the chance of hitting ‘unable to fork: Cannot allocate memory’ errors. vfork() is used for everything except starting builders.
2012-11-09	Remove some redundant close() calls	Eelco Dolstra	1	-6/+0
	They are unnecessary because we set the close-on-exec flag.
2012-11-09	Remove the quickExit function	Eelco Dolstra	1	-4/+4

2012-10-23	If hashes do not match, print them in base-32 for SHA-1/SHA-256	Eelco Dolstra	1	-1/+1
	Fixes #57.
2012-10-11	Shorten the names of temporary build directories	Eelco Dolstra	1	-1/+1

2012-10-03	nix-env: Support ‘--repair’ flag	Eelco Dolstra	1	-2/+4

2012-10-03	Handle repairing paths that are in build-chroot-dirs	Eelco Dolstra	1	-0/+7

2012-10-03	When repairing a derivation, check and repair the entire output closure	Eelco Dolstra	1	-2/+66
	If we find a corrupted path in the output closure, we rebuild the derivation that produced that particular path.
2012-10-02	Add a --repair flag to ‘nix-store -r’ to repair derivation outputs	Eelco Dolstra	1	-59/+94
	With this flag, if any valid derivation output is missing or corrupt, it will be recreated by using a substitute if available, or by rebuilding the derivation. The latter may use hash rewriting if chroots are not available.
2012-10-02	Add operation ‘nix-store --repair-path’	Eelco Dolstra	1	-28/+67
	This operation allows fixing corrupted or accidentally deleted store paths by redownloading them using substituters, if available. Since the corrupted path cannot be replaced atomically, there is a very small time window (one system call) during which neither the old (corrupted) nor the new (repaired) contents are available. So repairing should be used with some care on critical packages like Glibc.
2012-09-28	Handle octal escapes in /proc/self/mountinfo	Eelco Dolstra	1	-2/+3

2012-09-28	Print a more descriptive error message if setting up the build environment fails	Eelco Dolstra	1	-3/+14

2012-09-19	Remove setting of the immutable bit	Eelco Dolstra	1	-11/+2
	Using the immutable bit is problematic, especially in conjunction with store optimisation. For instance, if the garbage collector deletes a file, it has to clear its immutable bit, but if the file has additional hard links, we can't set the bit afterwards because we don't know the remaining paths. So now that we support having the entire Nix store as a read-only mount, we may as well drop the immutable bit. Unfortunately, we have to keep the code to clear the immutable bit for backwards compatibility.
2012-09-19	Templatise tokenizeString()	Eelco Dolstra	1	-11/+8

2012-09-18	Keep build directory if not all expected outputs were produced	Eelco Dolstra	1	-3/+3
	Fixes issue #123 in Nixpkgs.
2012-09-13	In startBuilder(), only print the new paths we're building	Eelco Dolstra	1	-2/+3

2012-09-12	Build hook: Pass the timeout to the remote builder	Eelco Dolstra	1	-1/+1
	Note that this will only work if the client has a very recent Nix version (post 15e1b2c223494ecb5efefc3ea0e3b926a6b1d7dc), otherwise the --option flag will just be ignored. Fixes #50.
2012-09-11	Fix "non-zero padding" error	Eelco Dolstra	1	-1/+2
	Probably it's not a good idea to pass a temporary object to StringSource.
2012-09-11	Support building a derivation if some outputs are already valid (non-chroot ↵	Eelco Dolstra	1	-11/+67
	case) This uses scary hash rewriting. Fixes #21.
2012-09-11	Remove debug line	Eelco Dolstra	1	-3/+1

2012-09-11	Support building a derivation if some outputs are already valid	Eelco Dolstra	1	-12/+16
	This handles the chroot and build hook cases, which are easy. Supporting the non-chroot-build case will require more work (hash rewriting!). Issue #21.
2012-08-27	Fix stupid type error in calling std::max	Eelco Dolstra	1	-1/+1

2012-08-27	Merge branch 'master' into no-manifests	Eelco Dolstra	1	-13/+30

2012-08-20	Check if MS_PRIVATE is defined	Eelco Dolstra	1	-1/+1
	http://hydra.nixos.org/build/2955671
2012-08-20	In the chroot, make all mounted filesystems private	Eelco Dolstra	1	-0/+18
	This is required on systemd, which mounts filesystems as "shared" subtrees. Changes to shared trees in a private mount namespace are propagated to the outside world, which is bad.
2012-08-20	Don't bind-mount /proc since we mount our own	Eelco Dolstra	1	-2/+2

2012-08-19	Fix 1755 permission on temporary directories left behind by ‘-K’	Eelco Dolstra	1	-4/+4

2012-08-01	Drop the block count in the garbage collector	Eelco Dolstra	1	-6/+5

2012-07-30	Refactor settings processing	Eelco Dolstra	1	-99/+77
	Put all Nix configuration flags in a Settings object.
2012-07-30	Pass configuration settings to the substituters	Eelco Dolstra	1	-0/+4
	Previously substituters could read nix.conf themselves, but this didn't take --option flags into account.
2012-07-27	Let build.cc verify the expected hash of a substituter's output	Eelco Dolstra	1	-6/+33
	Since SubstitutionGoal::finished() in build.cc computes the hash anyway, we can prevent the inefficiency of computing the hash twice by letting the substituter tell Nix about the expected hash, which can then verify it.
2012-07-27	Remove more tabs	Eelco Dolstra	1	-9/+9

2012-07-27	Remove trailing whitespace / tabs	Eelco Dolstra	1	-130/+130

2012-07-26	Merge branch 'master' into no-manifests	Eelco Dolstra	1	-1/+6