about summary refs log tree commit diff
path: root/doc/manual/release-notes/rl-2.0.xml
blob: 0ad17373ef4ff35ab3ef8f7c005d56d3bb6fb55d (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
<section xmlns="http://docbook.org/ns/docbook"
      xmlns:xlink="http://www.w3.org/1999/xlink"
      xmlns:xi="http://www.w3.org/2001/XInclude"
      version="5.0"
      xml:id="ssec-relnotes-2.0">

<title>Release 2.0 (2018-02-??)</title>

<para>The following incompatible changes have been made:</para>

<itemizedlist>

  <listitem>
    <para>The manifest-based substituter mechanism
    (<command>download-using-manifests</command>) has been <link
    xlink:href="https://github.com/NixOS/nix/commit/867967265b80946dfe1db72d40324b4f9af988ed">removed</link>. It
    has been superseded by the binary cache substituter mechanism
    since several years. As a result, the following programs have been
    removed:

    <itemizedlist>
      <listitem><para><command>nix-pull</command></para></listitem>
      <listitem><para><command>nix-generate-patches</command></para></listitem>
      <listitem><para><command>bsdiff</command></para></listitem>
      <listitem><para><command>bspatch</command></para></listitem>
    </itemizedlist>
    </para>
  </listitem>

  <listitem>
    <para>The “copy from other stores” substituter mechanism
    (<command>copy-from-other-stores</command> and the
    <envar>NIX_OTHER_STORES</envar> environment variable) has been
    removed. It was primarily used by the NixOS installer to copy
    available paths from the installation medium. The replacement is
    to use a chroot store as a substituter
    (e.g. <literal>--substituters /mnt</literal>), or to build into a
    chroot store (e.g. <literal>--store /mnt --substituter /</literal>).</para>
  </listitem>

  <listitem>
    <para>The command <command>nix-push</command> has been removed as
    part of the effort to eliminate Nix's dependency on Perl. You can
    use <command>nix copy</command> instead, e.g. <literal>nix copy
    --to /tmp/my-binary-cache <replaceable>paths…</replaceable></literal></para>
  </listitem>

  <listitem>
    <para>The “nested” log output feature (<option>--log-type
    pretty</option>) has been removed. As a result,
    <command>nix-log2xml</command> was also removed.</para>
  </listitem>

  <listitem>
    <para>OpenSSL-based signing has been <link
    xlink:href="https://github.com/NixOS/nix/commit/f435f8247553656774dd1b2c88e9de5d59cab203">removed</link>. This
    feature was never well-supported. A better alternative is provided
    by the <option>secret-key-files</option> and
    <option>trusted-public-keys</option> options.</para>
  </listitem>

  <listitem>
    <para>Failed build caching has been <link
    xlink:href="https://github.com/NixOS/nix/commit/8cffec84859cec8b610a2a22ab0c4d462a9351ff">removed</link>. This
    feature was introduced to support the Hydra continuous build
    system, but Hydra no longer uses it.</para>
  </listitem>

  <listitem>
    <para><filename>nix-mode.el</filename> has been removed from
    Nix. It is now <link
    xlink:href="https://github.com/NixOS/nix-mode">a separate
    repository</link> and can be installed through the MELPA package
    repository.</para>
  </listitem>

</itemizedlist>

<para>This release has the following new features:</para>

<itemizedlist>

  <listitem>
    <para>It introduces a new command named <command>nix</command>,
    which is intended to eventually replace all
    <command>nix-*</command> commands with a more consistent and
    better designed user interface. It currently provides replacements
    for some (but not all) of the functionality provided by
    <command>nix-store</command>, <command>nix-build</command>,
    <command>nix-shell -p</command>, <command>nix-env -qa</command>,
    <command>nix-instantiate --eval</command>,
    <command>nix-push</command> and
    <command>nix-copy-closure</command>. It has the following major
    features:</para>

    <itemizedlist>

      <listitem>
        <para>Unlike the legacy commands, it has a consistent way to
        refer to packages and package-like argumements (like store
        paths). For example, the following commands all copy the GNU
        Hello package to a remote machine:

        <screen>nix copy --to ssh://machine nixpkgs.hello</screen>
        <screen>nix copy --to ssh://machine /nix/store/0i2jd68mp5g6h2sa5k9c85rb80sn8hi9-hello-2.10</screen>
        <screen>nix copy --to ssh://machine '(with import &lt;nixpkgs> {}; hello)'</screen>

        By contrast, <command>nix-copy-closure</command> only accepted
        store paths as arguments.</para>
      </listitem>

      <listitem>
        <para>It is self-documenting: <option>--help</option> shows
        all available command-line arguments. If
        <option>--help</option> is given after a subcommand, it shows
        examples for that subcommand. <command>nix
        --help-config</command> shows all configuration
        options.</para>
      </listitem>

      <listitem>
        <para>It is much less verbose. By default, it displays a
        single-line progress indicator that shows how many packages
        are left to be built or downloaded, and (if there are running
        builds) the most recent line of builder output. If a build
        fails, it shows the last few lines of builder output. The full
        build log can be retrieved using <command>nix
        log</command>.</para>
      </listitem>

      <listitem>
        <para>It <link
        xlink:href="https://github.com/NixOS/nix/commit/b8283773bd64d7da6859ed520ee19867742a03ba">provides</link>
        all <filename>nix.conf</filename> configuration options as
        command line flags. For example, instead of <literal>--option
        http-connections 100</literal> you can write
        <literal>--http-connections 100</literal>. Boolean options can
        be written as
        <literal>--<replaceable>foo</replaceable></literal> or
        <literal>--no-<replaceable>foo</replaceable></literal>
        (e.g. <option>--no-auto-optimise-store</option>).</para>
      </listitem>

      <listitem>
        <para>Many subcommands have a <option>--json</option> flag to
        write results to stdout in JSON format.</para>
      </listitem>

    </itemizedlist>

    <warning><para>Please note that the <command>nix</command> command
    is a work in progress and the interface is subject to
    change.</para></warning>

    <para>It provides the following high-level (“porcelain”)
    subcommands:</para>

    <itemizedlist>

      <listitem>
        <para><command>nix build</command> is a replacement for
        <command>nix-build</command>.</para>
      </listitem>

      <listitem>
        <para><command>nix run</command> executes a command in an
        environment in which the specified packages are available. It
        is (roughly) a replacement for <command>nix-shell
        -p</command>. Unlike that command, it does not execute the
        command in a shell, and has a flag (<command>-c</command>)
        that specifies the unquoted command line to be
        executed.</para>

        <para>It is particularly useful in conjunction with chroot
        stores, allowing Linux users who do not have permission to
        install Nix in <command>/nix/store</command> to still use
        binary substitutes that assume
        <command>/nix/store</command>. For example,

        <screen>nix run --store ~/my-nix nixpkgs.hello -c hello --greeting 'Hi everybody!'</screen>

        downloads (or if not substitutes are available, builds) the
        GNU Hello package into
        <filename>~/my-nix/nix/store</filename>, then runs
        <command>hello</command> in a mount namespace where
        <filename>~/my-nix/nix/store</filename> is mounted onto
        <command>/nix/store</command>.</para>
      </listitem>

      <listitem>
        <para><command>nix search</command> replaces <command>nix-env
        -qa</command>. It searches the available packages for
        occurences of a search string in the attribute name, package
        name or description. Unlike <command>nix-env -qa</command>, it
        has a cache to speed up subsequent searches.</para>
      </listitem>

      <listitem>
        <para><command>nix copy</command> copies paths between
        arbitrary Nix stores, generalising
        <command>nix-copy-closure</command> and
        <command>nix-push</command>.</para>
      </listitem>

      <listitem>
        <para><command>nix repl</command> replaces the external
        program <command>nix-repl</command>. It provides an
        interactive environment for evaluating and building Nix
        expressions. Note that it uses <literal>linenoise-ng</literal>
        instead of GNU Readline.</para>
      </listitem>

      <listitem>
        <para><command>nix upgrade-nix</command> upgrades Nix to the
        latest stable version. This requires that Nix is installed in
        a profile. (Thus it won’t work on NixOS, or if it’s installed
        outside of the Nix store.)</para>
      </listitem>

      <listitem>
        <para><command>nix verify</command> checks whether store paths
        are unmodified and/or “trusted” (see below). It replaces
        <command>nix-store --verify</command> and <command>nix-store
        --verify-path</command>.</para>
      </listitem>

      <listitem>
        <para><command>nix log</command> shows the build log of a
        package or path. If the build log is not available locally, it
        will try to obtain it from the configured substituters (such
        as <uri>cache.nixos.org</uri>, which now provides build
        logs).</para>
      </listitem>

      <listitem>
        <para><command>nix edit</command> opens the source code of a
        package in your editor.</para>
      </listitem>

      <listitem>
        <para><command>nix eval</command> replaces
        <command>nix-instantiate --eval</command>.</para>
      </listitem>

      <listitem>
        <para><command
        xlink:href="https://github.com/NixOS/nix/commit/d41c5eb13f4f3a37d80dbc6d3888644170c3b44a">nix
        why-depends</command> shows why one store path has another in
        its closure. This is primarily useful to finding the causes of
        closure bloat. For example,

        <screen>nix why-depends nixpkgs.vlc nixpkgs.libdrm.dev</screen>

        shows a chain of files and fragments of file contents that
        cause the VLC package to have the “dev” output of
        <literal>libdrm</literal> in its closure — an undesirable
        situation.</para>
      </listitem>

      <listitem>
        <para><command>nix path-info</command> shows information about
        store paths, replacing <command>nix-store -q</command>. A
        useful feature is the option <option>--closure-size</option>
        (<option>-S</option>). For example, the following command show
        the closure sizes of every path in the current NixOS system
        closure, sorted by size:

        <screen>nix path-info -rS /run/current-system | sort -nk2</screen>

        </para>
      </listitem>

      <listitem>
        <para><command>nix optimise-store</command> replaces
        <command>nix-store --optimise</command>. The main difference
        is that it has a progress indicator.</para>
      </listitem>

    </itemizedlist>

    <para>A number of low-level (“plumbing”) commands are also
    available:</para>

    <itemizedlist>

      <listitem>
        <para><command>nix ls-store</command> and <command>nix
        ls-nar</command> list the contents of a store path or NAR
        file. The former is primarily useful in conjunction with
        remote stores, e.g.

        <screen>nix ls-store --store https://cache.nixos.org/ -lR /nix/store/0i2jd68mp5g6h2sa5k9c85rb80sn8hi9-hello-2.10</screen>

        lists the contents of path in a binary cache.</para>
      </listitem>

      <listitem>
        <para><command>nix cat-store</command> and <command>nix
        cat-nar</command> allow extracting a file from a store path or
        NAR file.</para>
      </listitem>

      <listitem>
        <para><command>nix dump-path</command> writes the contents of
        a store path to stdout in NAR format. This replaces
        <command>nix-store --dump</command>.</para>
      </listitem>

      <listitem>
        <para><command
        xlink:href="https://github.com/NixOS/nix/commit/e8d6ee7c1b90a2fe6d824f1a875acc56799ae6e2">nix
        show-derivation</command> displays a store derivation in JSON
        format. This is an alternative to
        <command>pp-aterm</command>.</para>
      </listitem>

      <listitem>
        <para><command
        xlink:href="https://github.com/NixOS/nix/commit/970366266b8df712f5f9cedb45af183ef5a8357f">nix
        add-to-store</command> replaces <command>nix-store
        --add</command>.</para>
      </listitem>

      <listitem>
        <para><command>nix sign-paths</command> signs store
        paths. (TODO: add examples)</para>
      </listitem>

      <listitem>
        <para><command>nix copy-sigs</command> copies signatures from
        one store to another. (TODO: add examples and
        tests)</para>
      </listitem>

      <listitem>
        <para><command>nix show-config</command> shows all
        configuration options and their current values.</para>
      </listitem>

    </itemizedlist>

  </listitem>

  <listitem>
    <para>The store abstraction that Nix has had for a long time to
    support store access via the Nix daemon has been extended
    significantly. In particular, substituters (which used to be
    external programs such as
    <command>download-from-binary-cache</command>) are now subclasses
    of the abstract <classname>Store</classname> class. This allows
    many Nix commands to operate on such store types. For example,
    <command>nix path-info</command> shows information about paths in
    your local Nix store, while <command>nix path-info --store
    https://cache.nixos.org/</command> shows information about paths
    in the specified binary cache. Similarly,
    <command>nix-copy-closure</command>, <command>nix-push</command>
    and substitution are all instances of the general notion of
    copying paths between different kinds of Nix stores.</para>

    <para>Stores are specified using an URI-like syntax,
    e.g. <uri>https://cache.nixos.org/</uri> or
    <uri>ssh://machine</uri>. The following store types are supported:

    <itemizedlist>

      <listitem>

        <para><classname>LocalStore</classname> (stori URI
        <literal>local</literal> or an absolute path) and the misnamed
        <classname>RemoteStore</classname> (<literal>daemon</literal>)
        provide access to a local Nix store, the latter via the Nix
        daemon. You can use <literal>auto</literal> or the empty
        string to auto-select a local or daemon store depending on
        whether you have write permission to the Nix store. It is no
        longer necessary to set the <envar>NIX_REMOTE</envar>
        environment variable to use the Nix daemon.</para>

        <para>As noted above, <classname>LocalStore</classname> now
        supports chroot builds, allowing the “physical” location of
        the Nix store
        (e.g. <filename>/home/alice/nix/store</filename>) to differ
        from its “logical” location (typically
        <filename>/nix/store</filename>). This allows non-root users
        to use Nix while still getting the benefits from prebuilt
        binaries from <uri>cache.nixos.org</uri>.</para>

      </listitem>

      <listitem>

        <para><classname>BinaryCacheStore</classname> is the abstract
        superclass of all binary cache stores. It supports writing
        build logs and NAR content listings in JSON format.</para>

      </listitem>

      <listitem>

        <para><classname>HttpBinaryCacheStore</classname>
        (<literal>http://</literal>, <literal>https://</literal>)
        supports binary caches via HTTP or HTTPS. If the server
        supports <literal>PUT</literal> requests, it supports
        uploading store paths via commands such as <command>nix
        copy</command>.</para>

      </listitem>

      <listitem>

        <para><classname>LocalBinaryCacheStore</classname>
        (<literal>file://</literal>) supports binary caches in the
        local filesystem.</para>

      </listitem>

      <listitem>

        <para><classname>S3BinaryCacheStore</classname>
        (<literal>s3://</literal>) supports binary caches stored in
        Amazon S3, if enabled at compile time.</para>

      </listitem>

      <listitem>

        <para><classname>LegacySSHStore</classname> (<literal>ssh://</literal>)
        is used to implement remote builds and
        <command>nix-copy-closure</command>.</para>

      </listitem>

      <listitem>

        <para><classname>SSHStore</classname>
        (<literal>ssh-ng://</literal>) supports arbitrary Nix
        operations on a remote machine via the same protocol used by
        <command>nix-daemon</command>.</para>

      </listitem>

    </itemizedlist>

    </para>

  </listitem>

  <listitem>

    <para>Security has been improved in various ways:

    <itemizedlist>

      <listitem>
        <para>Nix now stores signatures for local store
        paths. When paths are copied between stores (e.g., copied from
        a binary cache to a local store), signatures are
        propagated.</para>

        <para>Locally-built paths are signed automatically using the
        secret keys specified by the <option>secret-key-files</option>
        store option. Secret/public key pairs can be generated using
        <command>nix-store
        --generate-binary-cache-key</command>. (TODO: rename)</para>

        <para>In addition, locally-built store paths are marked as
        “ultimately trusted”, but this bit is not propagated when
        paths are copied between stores.</para>
      </listitem>

      <listitem>
        <para>Content-addressable store paths no longer require
        signatures — they can be imported into a store by unprivileged
        users even if they lack signatures.</para>
      </listitem>

      <listitem>
        <para>The command <command>nix verify</command> checks whether
        the specified paths are trusted, i.e., have a certain number
        of trusted signatures, are ultimately trusted, or are
        content-addressed.</para>
      </listitem>

      <listitem>
        <para>Substitutions from binary caches <link
        xlink:href="https://github.com/NixOS/nix/commit/ecbc3fedd3d5bdc5a0e1a0a51b29062f2874ac8b">now</link>
        require signatures by default. This was already the case on
        NixOS.</para>
      </listitem>

      <listitem>
        <para>In Linux sandbox builds, we <link
        xlink:href="https://github.com/NixOS/nix/commit/eba840c8a13b465ace90172ff76a0db2899ab11b">now</link>
        use <filename>/build</filename> instead of
        <filename>/tmp</filename> as the temporary build
        directory. This fixes potential security problems when a build
        accidentally stores its <envar>TMPDIR</envar> in some
        security-sensitive place, such as an RPATH.</para>
      </listitem>

    </itemizedlist>

    </para>

  </listitem>

  <listitem>
    <para><emphasis>Pure evaluation mode</emphasis>. This is a variant
    of the existing restricted evaluation mode. In pure mode, the Nix
    evaluator forbids access to anything that could cause different
    evaluations of the same command line arguments to produce a
    different result. This includes builtin functions such as
    <function>builtins.getEnv</function>, but more importantly,
    <emphasis>all</emphasis> filesystem or network access unless a
    content hash or commit hash is specified. For example, calls to
    <function>builtins.fetchGit</function> are only allowed if a
    <varname>rev</varname> attribute is specified.</para>

    <para>The goal of this feature is to enable true reproducibility
    and traceability of builds (including NixOS system configurations)
    at the evaluation level. For example, in the future,
    <command>nixos-rebuild</command> might build configurations from a
    Nix expression in a Git repository in pure mode. That expression
    might fetch other repositories such as Nixpkgs via
    <function>builtins.fetchGit</function>. The commit hash of the
    top-level repository then uniquely identifies a running system,
    and, in conjunction with that repository, allows it to be
    reproduced or modified.</para>

  </listitem>

  <listitem>
    <para>There are several new features to support binary
    reproducibility (i.e. to help ensure that multiple builds of the
    same derivation produce exactly the same output). When
    <option>enforce-determinism</option> is set to
    <literal>false</literal>, it’s <link
    xlink:href="https://github.com/NixOS/nix/commit/8bdf83f936adae6f2c907a6d2541e80d4120f051">no
    longer</link> a fatal error if build rounds produce different
    output. Also, a hook named <option>diff-hook</option> is <link
    xlink:href="https://github.com/NixOS/nix/commit/9a313469a4bdea2d1e8df24d16289dc2a172a169w">provided</link>
    to allow you to run tools such as <command>diffoscope</command>
    when build rounds produce different output.</para>
  </listitem>

  <listitem>
    <para>Configuring remote builds is a lot easier now. Provided you
    are not using the Nix daemon, you can now just specify a remote
    build machine on the command line, e.g. <literal>--option builders
    'ssh://my-mac x86_64-darwin'</literal>. The environment variable
    <envar>NIX_BUILD_HOOK</envar> has been removed and is no longer
    needed. The environment variable <envar>NIX_REMOTE_SYSTEMS</envar>
    is still supported for compatibility, but it is also possible to
    specify builders in <command>nix.conf</command> by setting the
    option <literal>builders =
    @<replaceable>path</replaceable></literal>.</para>
  </listitem>

  <listitem>
    <para>If a fixed-output derivation produces a result with an
    incorrect hash, the output path is moved to the location
    corresponding to the actual hash and registered as valid. Thus, a
    subsequent build of the fixed-output derivation with the correct
    hash is unnecessary.</para>
  </listitem>

  <listitem>
    <para><command>nix-shell</command> <link
    xlink:href="https://github.com/NixOS/nix/commit/ea59f39326c8e9dc42dfed4bcbf597fbce58797c">now</link>
    sets the <varname>IN_NIX_SHELL</varname> environment variable
    during evaluation and in the shell itself. This can be used to
    perform different actions depending on whether you’re in a Nix
    shell or in a regular build. Nixpkgs provides
    <varname>lib.inNixShell</varname> to check this variable during
    evaluation.</para>
  </listitem>

  <listitem>
    <para><envar>NIX_PATH</envar> is now lazy, so URIs in the path are
    only downloaded if they are needed for evaluation.</para>
  </listitem>

  <listitem>
    <para>You can now use
    <uri>channel:<replaceable>channel-name</replaceable></uri> as a
    short-hand for
    <uri>https://nixos.org/channels/<replaceable>channel-name</replaceable>/nixexprs.tar.xz</uri>. For
    example, <literal>nix-build channel:nixos-15.09 -A hello</literal>
    will build the GNU Hello package from the
    <literal>nixos-15.09</literal> channel. In the future, this may
    use Git to fetch updates more efficiently.</para>
  </listitem>

  <listitem>
    <para>When <option>--no-build-output</option> is given, the last
    10 lines of the build log will be shown if a build
    fails.</para>
  </listitem>

  <listitem>
    <para>Networking has been improved:

    <itemizedlist>

      <listitem>
        <para>HTTP/2 is now supported. This makes binary cache lookups
        <link
        xlink:href="https://github.com/NixOS/nix/commit/90ad02bf626b885a5dd8967894e2eafc953bdf92">much
        more efficient</link>.</para>
      </listitem>

      <listitem>
        <para>We now retry downloads on many HTTP errors, making
        binary caches substituters more resilient to temporary
        failures.</para>
      </listitem>

      <listitem>
        <para>HTTP credentials can now be configured via the standard
        <filename>netrc</filename> mechanism.</para>
      </listitem>

      <listitem>
        <para>If S3 support is enabled at compile time,
        <uri>s3://</uri> URIs are <link
        xlink:href="https://github.com/NixOS/nix/commit/9ff9c3f2f80ba4108e9c945bbfda2c64735f987b">supported</link>
        in all places where Nix allows URIs.</para>
      </listitem>

      <listitem>
        <para>Brotli compression is now supported. In particular,
        <uri>cache.nixos.org</uri> build logs are now compressed using
        Brotli.</para>
      </listitem>

    </itemizedlist>

    </para>

  </listitem>

  <listitem>
    <para><command>nix-env</command> <link
    xlink:href="https://github.com/NixOS/nix/commit/b0cb11722626e906a73f10dd9a0c9eea29faf43a">now</link>
    ignores packages with bad derivation names (in particular those
    starting with a digit or containing a dot).</para>
  </listitem>

  <listitem>
    <para>Many configuration options have been renamed, either because
    they were unnecessarily verbose
    (e.g. <option>build-use-sandbox</option> is now just
    <option>sandbox</option>) or to reflect generalised behaviour
    (e.g. <option>binary-caches</option> is now
    <option>substituters</option> because it allows arbitrary store
    URIs). The old names are still supported for compatibility.</para>
  </listitem>

  <listitem>
    <para>The <option>max-jobs</option> option can <link
    xlink:href="https://github.com/NixOS/nix/commit/7251d048fa812d2551b7003bc9f13a8f5d4c95a5">now</link>
    be set to <literal>auto</literal> to use the number of CPUs in the
    system.</para>
  </listitem>

  <listitem>
    <para>Hashes can <link
    xlink:href="https://github.com/NixOS/nix/commit/c0015e87af70f539f24d2aa2bc224a9d8b84276b">now</link>
    be specified in base-64 format, in addition to base-16 and the
    non-standard base-32.</para>
  </listitem>

  <listitem>
    <para><command>nix-shell</command> now uses
    <varname>bashInteractive</varname> from Nixpkgs, rather than the
    <command>bash</command> command that happens to be in the caller’s
    <envar>PATH</envar>. This is especially important on macOS where
    the <command>bash</command> provided by the system is seriously
    outdated and cannot execute <literal>stdenv</literal>’s setup
    script.</para>
  </listitem>

  <listitem>
    <para>Nix can now automatically trigger a garbage collection if
    free disk space drops below a certain level during a build. This
    is configured using the <option>min-free</option> and
    <option>max-free</option> options.</para>
  </listitem>

  <listitem>
    <para><command>nix-store -q --roots</command> and
    <command>nix-store --gc --print-roots</command> now show temporary
    and in-memory roots.</para>
  </listitem>

  <listitem>
    <para>
      Nix can now be extended with plugins. See the documentation of
      the <option>plugin-files</option> option for more details.
    </para>
  </listitem>

</itemizedlist>

<para>The Nix language has the following new features:

<itemizedlist>

  <listitem>
    <para>It supports floating point numbers. They are based on the
    C++ <literal>float</literal> type and are supported by the
    existing numerical operators. Export and import to and from JSON
    and XML works, too.</para>
  </listitem>

  <listitem>
    <para>Derivation attributes can now reference the outputs of the
    derivation using the <function>placeholder</function> builtin
    function. For example, the attribute

<programlisting>
configureFlags = "--prefix=${placeholder "out"} --includedir=${placeholder "dev"}";
</programlisting>

    will cause the <envar>configureFlags</envar> environment variable
    to contain the actual store paths corresponding to the
    <literal>out</literal> and <literal>dev</literal> outputs. TODO:
    add docs.</para>
  </listitem>

</itemizedlist>

</para>

<para>The following builtin functions are new or extended:

<itemizedlist>

  <listitem>
    <para><function
    xlink:href="https://github.com/NixOS/nix/commit/38539b943a060d9cdfc24d6e5d997c0885b8aa2f">builtins.fetchGit</function>
    allows Git repositories to be fetched at evaluation time. Thus it
    differs from the <function>fetchgit</function> function in
    Nixpkgs, which fetches at build time and cannot be used to fetch
    Nix expressions during evaluation. A typical use case is to import
    external NixOS modules from your configuration, e.g.

    <programlisting>imports = [ (builtins.fetchGit https://github.com/edolstra/dwarffs + "/module.nix") ];</programlisting>

    </para>
  </listitem>

  <listitem>
    <para>Similarly, <function>builtins.fetchMercurial</function>
    allows you to fetch Mercurial repositories.</para>
  </listitem>

  <listitem>
    <para><function>builtins.path</function> generalises
    <function>builtins.filterSource</function> and path literals
    (e.g. <literal>./foo</literal>). It allows specifying a store path
    name that differs from the source path name
    (e.g. <literal>builtins.path { path = ./foo; name = "bar";
    }</literal>) and also supports filtering out unwanted
    files.</para>
  </listitem>

  <listitem>
    <para><function>builtins.fetchurl</function> and
    <function>builtins.fetchTarball</function> now support
    <varname>sha256</varname> and <varname>name</varname>
    attributes.</para>
  </listitem>

  <listitem>
    <para><function
    xlink:href="https://github.com/NixOS/nix/commit/b8867a0239b1930a16f9ef3f7f3e864b01416dff">builtins.split</function>
    splits a string using a POSIX extended regular expression as the
    separator.</para>
  </listitem>

  <listitem>
    <para><function
    xlink:href="https://github.com/NixOS/nix/commit/26d92017d3b36cff940dcb7d1611c42232edb81a">builtins.partition</function>
    partitions the elements of a list into two lists, depending on a
    Boolean predicate.</para>
  </listitem>

  <listitem>
    <para><literal>&lt;nix/fetchurl.nix&gt;</literal> now uses the
    content-addressable tarball cache at
    <uri>http://tarballs.nixos.org/</uri>, just like
    <function>fetchurl</function> in
    Nixpkgs. (f2682e6e18a76ecbfb8a12c17e3a0ca15c084197)</para>
  </listitem>

  <listitem>
    <para>In restricted and pure evaluation mode, builtin functions
    that download from the network (such as
    <function>fetchGit</function>) are permitted to fetch underneath a
    list of URI prefixes specified in the option
    <option>allowed-uris</option>.</para>
  </listitem>

</itemizedlist>

</para>

<para>The Nix build environment has the following changes:

<itemizedlist>

  <listitem>
    <para>Values such as Booleans, integers, (nested) lists and
    attribute sets can <link
    xlink:href="https://github.com/NixOS/nix/commit/6de33a9c675b187437a2e1abbcb290981a89ecb1">now</link>
    be passed to builders in a non-lossy way. If the special attribute
    <varname>__structuredAttrs</varname> is set to
    <literal>true</literal>, the other derivation attributes are
    serialised in JSON format and made available to the builder via
    the file <envar>.attrs.json</envar> in the builder’s temporary
    directory. This obviates the need for
    <varname>passAsFile</varname> since JSON files have no size
    restrictions, unlike process environments.</para>

    <para><link
    xlink:href="https://github.com/NixOS/nix/commit/2d5b1b24bf70a498e4c0b378704cfdb6471cc699">As
    a convenience to Bash builders</link>, Nix writes a script named
    <envar>.attrs.sh</envar> to the builder’s directory that
    initialises shell variables corresponding to all attributes that
    are representable in Bash. This includes non-nested (associative)
    arrays. For example, the attribute <literal>hardening.format =
    true</literal> ends up as the Bash associative array element
    <literal>${hardening[format]}</literal>.</para>
  </listitem>

  <listitem>
    <para>Builders can <link
    xlink:href="https://github.com/NixOS/nix/commit/88e6bb76de5564b3217be9688677d1c89101b2a3">now</link>
    communicate what build phase they are in by writing messages to
    the file descriptor specified in <envar>NIX_LOG_FD</envar>. The
    current phase is shown by the <command>nix</command> progress
    indicator.
    </para>
  </listitem>

  <listitem>
    <para>In Linux sandbox builds, we <link
    xlink:href="https://github.com/NixOS/nix/commit/a2d92bb20e82a0957067ede60e91fab256948b41">now</link>
    provide a default <filename>/bin/sh</filename> (namely
    <filename>ash</filename> from BusyBox).</para>
  </listitem>

  <listitem>
    <para>In structured attribute mode,
    <varname>exportReferencesGraph</varname> <link
    xlink:href="https://github.com/NixOS/nix/commit/c2b0d8749f7e77afc1c4b3e8dd36b7ee9720af4a">exports</link>
    extended information about closures in JSON format. In particular,
    it includes the sizes and hashes of paths. This is primarily
    useful for NixOS image builders.</para>
  </listitem>

  <listitem>
    <para>Builds are <link
    xlink:href="https://github.com/NixOS/nix/commit/21948deed99a3295e4d5666e027a6ca42dc00b40">now</link>
    killed as soon as Nix receives EOF on the builder’s stdout or
    stderr. This fixes a bug that allowed builds to hang Nix
    indefinitely, regardless of
    timeouts.</para>
  </listitem>

  <listitem>
    <para>The <option>sandbox-paths</option> configuration
    option can now specify optional paths by appending a
    <literal>?</literal>, e.g. <literal>/dev/nvidiactl?</literal> will
    bind-mount <varname>/dev/nvidiactl</varname> only if it
    exists.</para>
  </listitem>

  <listitem>
    <para>On Linux, builds are now executed in a user
    namespace with uid 1000 and gid 100.</para>
  </listitem>

</itemizedlist>

</para>

<para>A number of significant internal changes were made:

<itemizedlist>

  <listitem>
    <para>Nix no longer depends on Perl and all Perl components have
    been rewritten in C++ or removed. The Perl bindings that used to
    be part of Nix have been moved to a separate package,
    <literal>nix-perl</literal>.</para>
  </listitem>

  <listitem>
    <para>All <classname>Store</classname> classes are now
    thread-safe. <classname>RemoteStore</classname> supports multiple
    concurrent connections to the daemon. This is primarily useful in
    multi-threaded programs such as
    <command>hydra-queue-runner</command>.</para>
  </listitem>

</itemizedlist>

</para>

<para>This release has contributions from TBD.</para>

</section>