about summary refs log tree commit diff
path: root/src/libstore/globals.hh
AgeCommit message (Collapse)AuthorFilesLines
2019-08-27 Merge branch 'test-sandboxing' of https://github.com/matthewbauer/nixEelco Dolstra1-0/+3
2019-08-07 Merge pull request #2995 from tweag/post-build-hookEelco Dolstra1-0/+3
Add a post build hook
2019-08-02 Add a test for auto-GCEelco Dolstra1-0/+3
This currently fails because we're using POSIX file locks. So when the garbage collector opens and closes its own temproots file, it causes the lock to be released and then deleted by another GC instance.
2019-08-02 Add a post-build-hookregnat1-0/+3
Passing `--post-build-hook /foo/bar` to a nix-* command will cause `/foo/bar` to be executed after each build with the following environment variables set: DRV_PATH=/nix/store/drv-that-has-been-built.drv OUT_PATHS=/nix/store/...build /nix/store/...build-bin /nix/store/...build-dev This can be useful in particular to upload all the builded artifacts to the cache (including the ones that don't appear in the runtime closure of the final derivation or are built because of IFD). This new feature prints the stderr/stdout output to the `nix-build` and `nix build` client, and the output is printed in a Nix 2 compatible format: [nix]$ ./inst/bin/nix-build ./test.nix these derivations will be built: /nix/store/ishzj9ni17xq4hgrjvlyjkfvm00b0ch9-my-example-derivation.drv building '/nix/store/ishzj9ni17xq4hgrjvlyjkfvm00b0ch9-my-example-derivation.drv'... hello! bye! running post-build-hook '/home/grahamc/projects/github.com/NixOS/nix/post-hook.sh'... post-build-hook: + sleep 1 post-build-hook: + echo 'Signing paths' /nix/store/qr213vjmibrqwnyp5fw678y7whbkqyny-my-example-derivation post-build-hook: Signing paths /nix/store/qr213vjmibrqwnyp5fw678y7whbkqyny-my-example-derivation post-build-hook: + sleep 1 post-build-hook: + echo 'Uploading paths' /nix/store/qr213vjmibrqwnyp5fw678y7whbkqyny-my-example-derivation post-build-hook: Uploading paths /nix/store/qr213vjmibrqwnyp5fw678y7whbkqyny-my-example-derivation post-build-hook: + sleep 1 post-build-hook: + printf 'very important stuff' /nix/store/qr213vjmibrqwnyp5fw678y7whbkqyny-my-example-derivation [nix-shell:~/projects/github.com/NixOS/nix]$ ./inst/bin/nix build -L -f ./test.nix my-example-derivation> hello! my-example-derivation> bye! my-example-derivation (post)> + sleep 1 my-example-derivation (post)> + echo 'Signing paths' /nix/store/c263gzj2kb2609mz8wrbmh53l14wzmfs-my-example-derivation my-example-derivation (post)> Signing paths /nix/store/c263gzj2kb2609mz8wrbmh53l14wzmfs-my-example-derivation my-example-derivation (post)> + sleep 1 my-example-derivation (post)> + echo 'Uploading paths' /nix/store/c263gzj2kb2609mz8wrbmh53l14wzmfs-my-example-derivation my-example-derivation (post)> Uploading paths /nix/store/c263gzj2kb2609mz8wrbmh53l14wzmfs-my-example-derivation my-example-derivation (post)> + sleep 1 my-example-derivation (post)> + printf 'very important stuff' [1 built, 0.0 MiB DL] Co-authored-by: Graham Christensen <graham@grahamc.com> Co-authored-by: Eelco Dolstra <edolstra@gmail.com>
2019-07-25 Use sandbox fallback when cloning fails in builderMatthew Bauer1-0/+3
When sandbox-fallback = true (the default), the Nix builder will fall back to disabled sandbox mode when the kernel doesn’t allow users to set it up. This prevents hard errors from occuring in tricky places, especially the initial installer. To restore the previous behavior, users can set: sandbox-fallback = false in their /etc/nix/nix.conf configuration.
2019-06-24 Add '--no-net' convenience flagEelco Dolstra1-1/+1
This flag * Disables substituters. * Sets the tarball-ttl to infinity (ensuring e.g. that the flake registry and any downloaded flakes are considered current). * Disables retrying downloads and sets the connection timeout to the minimum. (So it doesn't completely disable downloads at the moment.) (cherry picked from commit 8ea842260b4fd93315d35c5ba94b1ff99ab391d8)
2018-11-07 Enable sandboxing by defaultEelco Dolstra1-1/+7
Closes #179.
2018-10-23 Promote log-lines to a fully-qualified optionLinus Heckemann1-3/+3
This allows commands like nix build --log-lines 30 nixpkgs.hello in order to obtain more information in case of a failure.
2018-09-28 Check requiredSystemFeatures for local buildsEelco Dolstra1-0/+6
For example, this prevents a "kvm" build on machines that don't have KVM. Fixes #2012.
2018-05-30 Move evaluator-specific settings out of libstoreEelco Dolstra1-16/+0
2018-05-30 Move some Download-specific settings to download.ccEelco Dolstra1-13/+0
2018-05-30 Modularize config settingsEelco Dolstra1-35/+1
Allow global config settings to be defined in multiple Config classes. For example, this means that libutil can have settings and evaluator settings can be moved out of libstore. The Config classes are registered in a new GlobalConfig class to which config files etc. are applied. Relevant to https://github.com/NixOS/nix/issues/2009 in that it removes the need for ad hoc handling of useCaseHack, which was the underlying cause of that issue.
2018-04-23 globals.hh: don't use '==' to compare string literalsWill Dietz1-1/+1
Saw this in logs, also reported here: https://github.com/NixOS/nix/commit/8e6108ff71caae180d764ab9e9bff5593724655c#r28707288
2018-04-23 Merge branch 'aarch64-armv7' of git://github.com/lheckemann/nixShea Levy1-0/+7
Support extra compatible architectures (#1916)
2018-04-06 rename the options to mention it's a narinfo TTL as disk cache is used all ↵AmineChikhaoui1-2/+2
over the place for other operations
2018-04-06 add documentation for the local disk cache TTL configAmineChikhaoui1-6/+8
2018-04-06 Make the TTL for disk cache configurable, we can now completely disableAmineChikhaoui1-0/+6
disk cache lookup for example by doing: nix copy --from <binary-cahe> <store-path> --option \ positive-disk-cache-ttl 0 Issues: #1885 #2035
2018-03-29 Process --option use-case-hack properlyEelco Dolstra1-1/+1
Fixes https://github.com/NixOS/nix/issues/2009.
2018-03-16 rename build-extra-platforms -> extra-platformsLinus Heckemann1-2/+6
also document it
2018-02-27 Add build-extra-platforms settingLinus Heckemann1-0/+3
This allows specifying additional systems that a machine is able to build for. This may apply on some armv7-capable aarch64 processors, or on systems using qemu-user with binfmt-misc to support transparent execution of foreign-arch programs. This removes the previous hard-coded assumptions about which systems are ABI-compatible with which other systems, and instead relies on the user to specify any additional platforms that they have ensured compatibility for and wish to build for locally. NixOS should probably add i686-linux on x86_64-linux systems for this setting by default.
2018-02-22 Revert "Enable sandbox builds on Linux by default"Eelco Dolstra1-7/+1
This reverts commit ddc58e789636e1b94149c342575d92583251fbf6. https://hydra.nixos.org/eval/1435322
2018-02-22 Enable sandbox builds on Linux by defaultEelco Dolstra1-1/+7
The overhead of sandbox builds is a problem on NixOS (since building a NixOS configuration involves a lot of small derivations) but not for typical non-NixOS use cases. So outside of NixOS we can enable it. Issue #179.
2018-02-19 Merge branch 'register-settings' of https://github.com/shlevy/nixEelco Dolstra1-0/+7
2018-02-15 Set backup MANPATH in case man path isn’t set correctly.Matthew Bauer1-0/+3
Previously, this would fail at startup for non-NixOS installs: nix-env --help The fix for this is to just use "nixManDir" as the value for MANPATH when spawning "man". To test this, I’m using the following: $ nix-build release.nix -A build $ MANPATH= ./result/bin/nix-env --help Fixes #1627
2018-02-13 Allow plugins to define new settings.Shea Levy1-0/+7
2018-02-08 Add plugins to make Nix more extensible.Shea Levy1-0/+7
All plugins in plugin-files will be dlopened, allowing them to statically construct instances of the various Register* types Nix supports.
2018-01-26 Remove signed-binary-caches as the default for require-sigsEelco Dolstra1-4/+1
This was for backward compatibility. However, with security-related configuration settings, it's best not to have any confusion. Issue #495.
2018-01-16 Make show-trace a config settingEelco Dolstra1-1/+2
2018-01-16 Add pure evaluation modeEelco Dolstra1-0/+3
In this mode, the following restrictions apply: * The builtins currentTime, currentSystem and storePath throw an error. * $NIX_PATH and -I are ignored. * fetchGit and fetchMercurial require a revision hash. * fetchurl and fetchTarball require a sha256 attribute. * No file system access is allowed outside of the paths returned by fetch{Git,Mercurial,url,Tarball}. Thus 'nix build -f ./foo.nix' is not allowed. Thus, the evaluation result is completely reproducible from the command line arguments. E.g. nix build --pure-eval '( let nix = fetchGit { url = https://github.com/NixOS/nixpkgs.git; rev = "9c927de4b179a6dd210dd88d34bda8af4b575680"; }; nixpkgs = fetchGit { url = https://github.com/NixOS/nixpkgs.git; ref = "release-17.09"; rev = "66b4de79e3841530e6d9c6baf98702aa1f7124e4"; }; in (import (nix + "/release.nix") { inherit nix nixpkgs; }).build.x86_64-linux )' The goal is to enable completely reproducible and traceable evaluation. For example, a NixOS configuration could be fully described by a single Git commit hash. 'nixos-rebuild' would do something like nix build --pure-eval '( (import (fetchGit { url = file:///my-nixos-config; rev = "..."; })).system ') where the Git repository /my-nixos-config would use further fetchGit calls or Git externals to fetch Nixpkgs and whatever other dependencies it has. Either way, the commit hash would uniquely identify the NixOS configuration and allow it to reproduced.
2018-01-09 nix.conf: builders-use-substitutesRenzo Carbonara1-0/+5
Fixes #937
2018-01-04 Rename "use-substitutes" to "substitute"Eelco Dolstra1-1/+1
Commit c2154d4c8422ddc1c201d503bb52edff854af2ad renamed "build-use-substitutes" to "use-substitutes", but that broke "nix-copy-closure --use-substitutes".
2017-11-20 signed-binary-caches -> require-sigsEelco Dolstra1-0/+5
Unlike signed-binary-caches (which could only be '*' or ''), require-sigs is a proper Boolean option. The default is true.
2017-11-20 binary-cache-public-keys -> trusted-public-keysEelco Dolstra1-3/+4
The name had become a misnomer since it's not only for substitution from binary caches, but when adding/copying any (non-content-addressed) path to a store.
2017-10-30 Add option allowed-urisEelco Dolstra1-1/+3
This allows network access in restricted eval mode.
2017-10-30 enable-http2 -> http2Eelco Dolstra1-1/+1
2017-10-24 Remove the remote-builds optionEelco Dolstra1-3/+0
This is superfluous since you can now just set "builders" to empty, e.g. "--builders ''".
2017-10-24 Remove the builder-files optionEelco Dolstra1-5/+1
You can now include files via the "builders" option, using the syntax "@<filename>". Having only one option makes it easier to override builders completely. For backward compatibility, the default is "@/etc/nix/machines", or "@<filename>" for each file name in NIX_REMOTE_SYSTEMS.
2017-10-23 Turn $NIX_REMOTE into a configuration optionEelco Dolstra1-0/+4
2017-10-12 Add option to disable the seccomp filterEelco Dolstra1-0/+6
I needed this to test ACL/xattr removal in canonicalisePathMetaData(). Might also be useful if you need to build old Nixpkgs that doesn't have the required patches to remove setuid/setgid creation.
2017-09-05 Add automatic garbage collectionEelco Dolstra1-1/+9
Nix can now automatically run the garbage collector during builds or while adding paths to the store. The option "min-free = <bytes>" specifies that Nix should run the garbage collector whenever free space in the Nix store drops below <bytes>. It will then delete garbage until "max-free" bytes are available. Garbage collection during builds is asynchronous; running builds are not paused and new builds are not blocked. However, there also is a synchronous GC run prior to the first build/substitution. Currently, no old GC roots are deleted (as in "nix-collect-garbage -d").
2017-08-31 Rename a few configuration optionsEelco Dolstra1-36/+48
In particular, drop the "build-" and "gc-" prefixes which are pointless. So now you can say nix build --no-sandbox instead of nix build --no-build-use-sandbox
2017-07-17 Make the hashes mirrors used by builtins.fetchurl configurableEelco Dolstra1-0/+3
In particular, this allows it to be disabled in our tests.
2017-07-04 Add allow-new-privileges optionEelco Dolstra1-0/+6
This allows builds to call setuid binaries. This was previously possible until we started using seccomp. Turns out that seccomp by default disallows processes from acquiring new privileges. Generally, any use of setuid binaries (except those created by the builder itself) is by definition impure, but some people were relying on this ability for certain tests. Example: $ nix build '(with import <nixpkgs> {}; runCommand "foo" {} "/run/wrappers/bin/ping -c 1 8.8.8.8; exit 1")' --no-allow-new-privileges builder for ‘/nix/store/j0nd8kv85hd6r4kxgnwzvr0k65ykf6fv-foo.drv’ failed with exit code 1; last 2 log lines: cannot raise the capability into the Ambient set : Operation not permitted $ nix build '(with import <nixpkgs> {}; runCommand "foo" {} "/run/wrappers/bin/ping -c 1 8.8.8.8; exit 1")' --allow-new-privileges builder for ‘/nix/store/j0nd8kv85hd6r4kxgnwzvr0k65ykf6fv-foo.drv’ failed with exit code 1; last 6 log lines: PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data. 64 bytes from 8.8.8.8: icmp_seq=1 ttl=46 time=15.2 ms Fixes #1429.
2017-05-11 Add an option for extending the user agent headerEelco Dolstra1-0/+3
This is useful e.g. for distinguishing traffic to a binary cache (e.g. certain machines can use a different tag in the user agent).
2017-05-05 Make the location of the build directory in the sandbox configurableEelco Dolstra1-0/+3
This is mostly for use in the sandbox tests, since if the Nix store is under /build, then we can't use /build as the build directory.
2017-05-02 Replace $NIX_REMOTE_SYSTEMS with an option "builder-files"Eelco Dolstra1-0/+4
Also, to unify with hydra-queue-runner, allow it to be a list of files.
2017-05-02 Add an option for specifying remote buildersEelco Dolstra1-0/+3
This is useful for one-off situations where you want to specify a builder on the command line instead of having to mess with nix.machines. E.g. $ nix-build -A hello --argstr system x86_64-darwin \ --option builders 'root@macstadium1 x86_64-darwin' will perform the specified build on "macstadium1". It also removes the need for a separate nix.machines file since you can specify builders in nix.conf directly. (In fact nix.machines is yet another hack that predates the general nix.conf configuration file, IIRC.) Note: this option is supported by the daemon for trusted users. The fact that this allows trusted users to specify paths to SSH keys to which they don't normally have access is maybe a bit too much trust...
2017-05-01 Remove $NIX_BUILD_HOOK and $NIX_CURRENT_LOADEelco Dolstra1-0/+3
This is to simplify remote build configuration. These environment variables predate nix.conf. The build hook now has a sensible default (namely build-remote). The current load is kept in the Nix state directory now.
2017-04-20 Setting: Remove "Tag" template argumentEelco Dolstra1-4/+35
2017-04-20 Read per-user settings from ~/.config/nix/nix.confEelco Dolstra1-4/+0
generated by cgit-pink 1.4.1 (git 2.44.2) at 2024-12-18T14·38+0000