depot - monorepo for the virus lounge

Age	Commit message (Collapse)	Author	Files	Lines
2012-07-26	Set permissions on temporary build directories to 0700	Eelco Dolstra	1	-2/+2
	Fixes #39.
2012-06-25	When using chroots, use a private PID namespace	Eelco Dolstra	1	-2/+5
	In a private PID namespace, processes have PIDs that are separate from the rest of the system. The initial child gets PID 1. Processes in the chroot cannot see processes outside of the chroot. This improves isolation between builds. However, processes on the outside can see processes in the chroot and send signals to them (if they have appropriate rights). Since the builder gets PID 1, it serves as the reaper for zombies in the chroot. This might turn out to be a problem. In that case we'll need to have a small PID 1 process that sits in a loop calling wait().
2012-03-05	Set the close-on-exec flag on file descriptors	Eelco Dolstra	1	-0/+12

2012-02-15	On Linux, make the Nix store really read-only by using the immutable bit	Eelco Dolstra	1	-0/+3
	I was bitten one time too many by Python modifying the Nix store by creating *.pyc files when run as root. On Linux, we can prevent this by setting the immutable bit on files and directories (as in ‘chattr +i’). This isn't supported by all filesystems, so it's not an error if setting the bit fails. The immutable bit is cleared by the garbage collector before deleting a path. The only tricky aspect is in optimiseStore(), since it's forbidden to create hard links to an immutable file. Thus optimiseStore() temporarily clears the immutable bit before creating the link.
2012-02-09	Use data() instead of c_str() where appropriate	Eelco Dolstra	1	-3/+3

2011-12-22	* In the garbage collector, delete invalid paths before deleting	Eelco Dolstra	1	-1/+9
	unreachable paths. This matters when using --max-freed etc.: unreachable paths could become reachable again, so it's nicer to keep them if there is "real" garbage to be deleted. Also, don't use readDirectory() but read the Nix store and delete invalid paths in parallel. This reduces GC latency on very large Nix stores.
2010-12-13	* nix-instantiate: return exit status 100 to denote a permanent build	Eelco Dolstra	1	-1/+2
	failure. The build hook can use this to distinguish between transient and permanent failures on the remote side.
2010-12-13	* createDirs(path): if path already exists, make sure it's a	Eelco Dolstra	1	-20/+22
	directory. * Provide a C++ wrapper around lstat().
2010-10-04	* Sync with the trunk.	Eelco Dolstra	1	-1/+10

2010-10-04	* In printMsg(), ignore failing writes to stderr if we're in an	Eelco Dolstra	1	-1/+10
	exception handler, otherwise throw an exception. We need to ignore write errors in exception handlers to ensure that cleanup code runs to completion if the other side of stderr has been closed unexpectedly.
2010-08-27	* Experimental feature: allow a derivation to tell the build hook that	Eelco Dolstra	1	-0/+11
	it requires a certain feature on the build machine, e.g. requiredSystemFeatures = [ "kvm" ]; We need this in Hydra to make sure that builds that require KVM support are forwarded to machines that have KVM support. Probably this should also be enforced for local builds.
2010-08-04	* Sync with the trunk.	Eelco Dolstra	1	-0/+1

2010-06-24	src/libutil/util.cc: include <limit.h> to ensure that PATH_MAX is defined	Peter Simons	1	-0/+1

2010-05-12	* Sync with the trunk.	Eelco Dolstra	1	-47/+41

2010-04-20	* Sync with the trunk.	Eelco Dolstra	1	-4/+6

2010-04-19	* Don't use the ATerm library for parsing/printing .drv files.	Eelco Dolstra	1	-0/+41

2010-04-12	* Remove some obsolete functions.	Eelco Dolstra	1	-47/+0

2010-03-19	* Clean up error messages in killUser().	Eelco Dolstra	1	-4/+6

2010-02-24	* Don't use fdatasync since it doesn't work on Snow Leopard.	Eelco Dolstra	1	-1/+1
	* Don't refer to config.h in util.hh, because config.h is not installed (http://hydra.nixos.org/build/303053).
2010-02-24	* Remove the fdatasync check since it's no longer needed.	Eelco Dolstra	1	-2/+1

2010-02-10	Don't rely on `PATH_MAX' on GNU.	Ludovic Courtès	1	-0/+10

2010-02-02	* Remove most Cygwin-specific code. Cygwin 1.7 implements advisory	Eelco Dolstra	1	-12/+0
	POSIX locks, and simulates Unix-style file deletion semantics sufficiently. Note that this means that Nix won't work on Cygwin 1.5 anymore.
2010-01-29	* Added an option "fsync-metadata" to fsync() changes to	Eelco Dolstra	1	-11/+3
	/nix/var/nix/db. * Removed the function writeStringToFile since it does (almost) the same thing as writeFile.
2009-11-24	* Templatise getIntArg / string2Int.	Eelco Dolstra	1	-16/+0

2009-11-24	* In the garbage collector, don't count files with a link count > 1 in	Eelco Dolstra	1	-2/+4
	the "bytes/blocks freed" statistics.
2009-06-30	* Don't show trace information by default (`--show-trace' to enable).	Eelco Dolstra	1	-1/+1
	NixOS evaluation errors in particular look intimidating and generally aren't very useful. Ideally the builtins.throw messages should be self-contained.
2009-03-28	* Simplify communication with the hook a bit (don't use file	Eelco Dolstra	1	-0/+27
	descriptors 3/4, just use stdin/stderr).
2008-12-04	* Don't ignore errors from writing to stderr. That way, when	Eelco Dolstra	1	-5/+1
	nix-store -r (or some other operation) is started via ssh, it will at least have a chance of terminating quickly when the connection is killed. Right now it just runs to completion, because it never notices that stderr is no longer connected to anything. Of course it would be better if sshd would just send a SIGHUP, but it doesn't (https://bugzilla.mindrot.org/show_bug.cgi?id=396).
2008-08-25	* Strip off the `.nix' suffix from the attribute name for files in	Eelco Dolstra	1	-0/+6
	~/.nix-defexpr, otherwise the attribute cannot be selected with the `-A' option. Useful if you want to stick a Nix expression directly in ~/.nix-defexpr.
2008-08-02	* Make nix-env --dry-run print the paths to be substituted correctly	Eelco Dolstra	1	-2/+20
	again. (After the previous substituter mechanism refactoring I didn't update the code that obtains the references of substitutable paths.) This required some refactoring: the substituter programs are now kept running and receive/respond to info requests via stdin/stdout.
2008-06-18	* --max-freed: support values >= 4 GB.	Eelco Dolstra	1	-0/+8

2008-06-18	* Some refactoring: put the GC options / results in separate structs.	Eelco Dolstra	1	-12/+23
	* The garbage collector now also prints the number of blocks freed.
2008-06-09	* Merged the no-bdb branch (-r10900:HEAD	Eelco Dolstra	1	-2/+3
	https://svn.nixos.org/repos/nix/nix/branches/no-bdb).
2008-05-21	* GCC 4.3.0 (Fedora 9) compatibility fixes. Reported by Gour and	Eelco Dolstra	1	-1/+3
	Armijn Hemel.
2008-03-27	* Use /tmp/nix-build-<drvpath>-<counter> instead of	Eelco Dolstra	1	-6/+14
	/tmp/nix-<pid>-<counter> for temporary build directories. This increases purity a bit: many packages store the temporary build path in their output, causing (generally unimportant) binary differences.
2007-12-14	* Use strsignal if available to give better error messages for	Eelco Dolstra	1	-2/+10
	builders that fail due to a signal.
2007-11-29	* nix-env -e: support uninstalling by path, so that one can say	Eelco Dolstra	1	-2/+1
	$ nix-env -e $(which firefox) or $ nix-env -e /nix/store/nywzlygrkfcgz7dfmhm5xixlx1l0m60v-pan-0.132 * nix-env -i: if an argument contains a slash anywhere, treat it as a path and follow it through symlinks into the Nix store. This allows things like $ nix-build -A firefox $ nix-env -i ./result * nix-env -q/-i/-e: don't complain when the `' selector doesn't match anything. In particular, `nix-env -q \' doesn't fail anymore on an empty profile.
2007-10-27	* Delete the chroot directory automatically.	Eelco Dolstra	1	-4/+4
	* Removed some debug messages.
2007-10-27	* Support for doing builds in a chroot under Linux. The builder is	Eelco Dolstra	1	-9/+23
	executed in a chroot that contains just the Nix store, the temporary build directory, and a configurable set of additional directories (/dev and /proc by default). This allows a bit more purity enforcement: hidden build-time dependencies on directories such as /usr or /nix/var/nix/profiles are no longer possible. As an added benefit, accidental network downloads (cf. NIXPKGS-52) are prevented as well (because files such as /etc/resolv.conf are not available in the chroot). However the usefulness of chroots is diminished by the fact that many builders depend on /bin/sh, so you need /bin in the list of additional directories. (And then on non-NixOS you need /lib as well...)
2007-09-17	* nix-env: allow ~/.nix-defexpr to be a directory. If it is, then the	Eelco Dolstra	1	-0/+1
	Nix expressions in that directory are combined into an attribute set {file1 = import file1; file2 = import file2; ...}, i.e. each Nix expression is an attribute with the file name as the attribute name. Also recurses into directories. * nix-env: removed the "--import" (-I) option which set the ~/.nix-defexpr symlink. * nix-channel: don't use "nix-env --import", instead symlink ~/.nix-defexpr/channels. So finally nix-channel --update doesn't override any default Nix expressions but combines with them. This means that you can have (say) a local Nixpkgs SVN tree and use it as a default for nix-env: $ ln -s .../path-to-nixpkgs-tree ~/.nix-defexpr/nixpkgs_svn and be subscribed to channels (including Nixpkgs) at the same time. (If there is any ambiguity, the -A flag can be used to disambiguate, e.g. "nix-env -i -A nixpkgs_svn.pan".)
2007-08-12	* Get rid of the substitutes database table (NIX-47). Instead, if we	Eelco Dolstra	1	-2/+5
	need any info on substitutable paths, we just call the substituters (such as download-using-manifests.pl) directly. This means that it's no longer necessary for nix-pull to register substitutes or for nix-channel to clear them, which makes those operations much faster (NIX-95). Also, we don't have to worry about keeping nix-pull manifests (in /nix/var/nix/manifests) and the database in sync with each other. The downside is that there is some overhead in calling an external program to get the substitutes info. For instance, "nix-env -qas" takes a bit longer. Abolishing the substitutes table also makes the logic in local-store.cc simpler, as we don't need to store info for invalid paths. On the downside, you cannot do things like "nix-store -qR" on a substitutable but invalid path (but nobody did that anyway). * Never catch interrupts (the Interrupted exception).
2007-05-01	* Set a terminate() handler to ensure that we leave the BDB	Eelco Dolstra	1	-3/+17
	environment cleanly even when an exception is thrown from a destructor. We still crash, but we don't take all other Nix processes with us.
2007-03-19	* Terminate build hooks and substitutes with a TERM signal, not a KILL	Eelco Dolstra	1	-4/+12
	signal. This is necessary because those processes may have joined the BDB environment, so they have to be given a chance to clean up. (NIX-85)
2007-02-21	* `nix-store --import': import an archive created by `nix-store	Eelco Dolstra	1	-5/+5
	--export' into the Nix store, and optionally check the cryptographic signatures against /nix/etc/nix/signing-key.pub. (TODO: verify against a set of public keys.)
2007-02-21	* `nix-store --export --sign': sign the Nix archive using the RSA key	Eelco Dolstra	1	-3/+12
	in /nix/etc/nix/signing-key.sec
2006-12-07	* Move setuidCleanup() to libutil.	Eelco Dolstra	1	-0/+16

2006-12-07	* Change the ownership of store paths to the Nix account before	Eelco Dolstra	1	-1/+1
	deleting them using the setuid helper.
2006-12-07	* Move killUser() to libutil so that the setuid helper can use it.	Eelco Dolstra	1	-0/+47

2006-12-05	* The determination of the root set should be made by the privileged	Eelco Dolstra	1	-0/+1
	process, so forward the operation. * Spam the user about GC misconfigurations (NIX-71). * findRoots: skip all roots that are unreadable - the warnings with which we spam the user should be enough.
2006-12-04	* Daemon mode (`nix-worker --daemon'). Clients connect to the server	Eelco Dolstra	1	-14/+3
	via the Unix domain socket in /nix/var/nix/daemon.socket. The server forks a worker process per connection. * readString(): use the heap, not the stack. * Some protocol fixes.