diff --git a/doc/manual/rl-next/aggressive-derivation-output-cleanups.md b/doc/manual/rl-next/aggressive-derivation-output-cleanups.md deleted file mode 100644 index 626a8fd94..000000000 --- a/doc/manual/rl-next/aggressive-derivation-output-cleanups.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -synopsis: "Always clean up scratch paths after derivations failed to build" -issues: [] -cls: [3444] -category: "Fixes" -credits: ["raito", "horrors"] ---- - -Previously, scratch paths created during builds were not always cleaned up if -the derivation failed, potentially leaving behind unnecessary temporary files -or directories in the Nix store. - -This fix ensures that such paths are consistently removed after a failed build, -improving Nix store hygiene, hardening Lix against mis-reuse of failed builds -scratch paths. diff --git a/doc/manual/rl-next/build-dir-mandatory.md b/doc/manual/rl-next/build-dir-mandatory.md deleted file mode 100644 index ca5e808d6..000000000 --- a/doc/manual/rl-next/build-dir-mandatory.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -synopsis: "`build-dir` no longer defaults to `temp-dir`" -cls: [3443] -category: "Fixes" -credits: [horrors] ---- - -The directory in which temporary build directories are created no longer defaults -to the value of the `temp-dir` setting to avoid builders making their directories -world-accessible. This behavior has been used to escape the build sandbox and can -cause build impurities even when not used maliciously. We now default to `builds` -in `NIX_STATE_DIR` (which is `/nix/var/nix/builds` in the default configuration). diff --git a/doc/manual/rl-next/deprecated-derivation-types.md b/doc/manual/rl-next/deprecated-derivation-types.md deleted file mode 100644 index 011c9e2bc..000000000 --- a/doc/manual/rl-next/deprecated-derivation-types.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -synopsis: Deprecation of CA derivations, dynamic derivations, and impure derivations -issues: [fj#815] -cls: [] -significance: significant -category: Miscellany -credits: [] ---- - -Content-addressed derivations are now deprecated and slated for removal in Lix 2.94. -We're doing this because the CA derivation system has been a known cause of problems -and inconsistencies, is unmaintained, habitually makes improving the store code very -difficult (or blocks such improvements outright), and is beset by a number of design -flaws that in our opinion cannot be fixed without a full reimplementation from zero. -Dynamic derivations and impure derivations are built on the CA derivation framework, -and owing to this they too are deprecated and slated for removal in another release. diff --git a/doc/manual/rl-next/pasta.md b/doc/manual/rl-next/pasta.md deleted file mode 100644 index 0928a8c85..000000000 --- a/doc/manual/rl-next/pasta.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -synopsis: "Fixed output derivations can be run using `pasta` network isolation" -cls: [3442] -issues: [fj#285] -category: "Breaking Changes" -credits: [horrors, puck] ---- - -Fixed output derivations traditionally run in the host network namespace. -On Linux this allows such derivations to communicate with other sandboxes -or the host using the abstract Unix domains socket namespace; this hasn't -been unproblematic in the past and has been used in two distinct exploits -to break out of the sandbox. For this reason fixed output derivations can -now run in a network namespace (provided by [`pasta`]), restricted to TCP -and UDP communication with the rest of the world. When enabled this could -be a breaking change and we classify it as such, even though we don't yet -enable or require such isolation by default. We may enforce this in later -releases of Lix once we have sufficient confidence that breakage is rare. - -[`pasta`]: https://passt.top/ diff --git a/doc/manual/rl-next/reliance-on-bash-for-ssh.md b/doc/manual/rl-next/reliance-on-bash-for-ssh.md deleted file mode 100644 index fa88545eb..000000000 --- a/doc/manual/rl-next/reliance-on-bash-for-ssh.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -synopsis: Remove reliance on Bash for remote stores via SSH -issues: [fj#830, fj#805, fj#304] -cls: [3159] -category: "Fixes" -credits: [raito] ---- - -The pre-flight `echo started` handshake -- added years ago to catch race conditions -- has been removed. - -After removal of connection sharing in Lix 2.93, it required a Bash-compatible shell and a standard `echo`, so it failed on: - - * builders protected by `ForceCommand` wrappers (e.g. `nix-remote-build`), - * BusyBox / initrd images with no Bash, - * hosts using non-POSIX shells such as Nushell. - -The race the probe once addressed was tied to SSH connection-sharing -- since connection-sharing code has already been removed, the probe is now pointless. - -Real connection or protocol errors are now left to SSH/Nix to report directly. - -This is technically a breaking change if you had scripts that relied on the literal "started" which needs to be updated to rely on other signals, e.g., exit codes. diff --git a/doc/manual/src/release-notes/rl-2.93.md b/doc/manual/src/release-notes/rl-2.93.md index 91d4d5b27..2c86f2a3e 100644 --- a/doc/manual/src/release-notes/rl-2.93.md +++ b/doc/manual/src/release-notes/rl-2.93.md @@ -1,4 +1,83 @@ # Lix 2.93 "Bici Bici" (2025-05-09) +# Lix 2.93.1 (2025-06-23) +## Breaking Changes + +- Fixed output derivations can be run using `pasta` network isolation [fj#285](https://git.lix.systems/lix-project/lix/issues/285) [cl/3442](https://gerrit.lix.systems/c/lix/+/3442) + + Fixed output derivations traditionally run in the host network namespace. + On Linux this allows such derivations to communicate with other sandboxes + or the host using the abstract Unix domains socket namespace; this hasn't + been unproblematic in the past and has been used in two distinct exploits + to break out of the sandbox. For this reason fixed output derivations can + now run in a network namespace (provided by [`pasta`]), restricted to TCP + and UDP communication with the rest of the world. When enabled this could + be a breaking change and we classify it as such, even though we don't yet + enable or require such isolation by default. We may enforce this in later + releases of Lix once we have sufficient confidence that breakage is rare. + + [`pasta`]: https://passt.top/ + + Many thanks to [eldritch horrors](https://git.lix.systems/pennae) and [puck](https://git.lix.systems/puck) for this. + + +## Fixes + +- Always clean up scratch paths after derivations failed to build [cl/3444](https://gerrit.lix.systems/c/lix/+/3444) + + Previously, scratch paths created during builds were not always cleaned up if + the derivation failed, potentially leaving behind unnecessary temporary files + or directories in the Nix store. + + This fix ensures that such paths are consistently removed after a failed build, + improving Nix store hygiene, hardening Lix against mis-reuse of failed builds + scratch paths. + + Many thanks to [Raito Bezarius](https://git.lix.systems/raito) and [eldritch horrors](https://git.lix.systems/pennae) for this. + +- `build-dir` no longer defaults to `temp-dir` [cl/3443](https://gerrit.lix.systems/c/lix/+/3443) + + The directory in which temporary build directories are created no longer defaults + to the value of the `temp-dir` setting to avoid builders making their directories + world-accessible. This behavior has been used to escape the build sandbox and can + cause build impurities even when not used maliciously. We now default to `builds` + in `NIX_STATE_DIR` (which is `/nix/var/nix/builds` in the default configuration). + + Many thanks to [eldritch horrors](https://git.lix.systems/pennae) for this. + +- Remove reliance on Bash for remote stores via SSH [fj#830](https://git.lix.systems/lix-project/lix/issues/830) [fj#805](https://git.lix.systems/lix-project/lix/issues/805) [fj#304](https://git.lix.systems/lix-project/lix/issues/304) [cl/3159](https://gerrit.lix.systems/c/lix/+/3159) + + The pre-flight `echo started` handshake -- added years ago to catch race conditions -- has been removed. + + After removal of connection sharing in Lix 2.93, it required a Bash-compatible shell and a standard `echo`, so it failed on: + + * builders protected by `ForceCommand` wrappers (e.g. `nix-remote-build`), + * BusyBox / initrd images with no Bash, + * hosts using non-POSIX shells such as Nushell. + + The race the probe once addressed was tied to SSH connection-sharing -- since connection-sharing code has already been removed, the probe is now pointless. + + Real connection or protocol errors are now left to SSH/Nix to report directly. + + This is technically a breaking change if you had scripts that relied on the literal "started" which needs to be updated to rely on other signals, e.g., exit codes. + + Many thanks to [Raito Bezarius](https://git.lix.systems/raito) for this. + + +## Miscellany + +- Deprecation of CA derivations, dynamic derivations, and impure derivations [fj#815](https://git.lix.systems/lix-project/lix/issues/815) + + Content-addressed derivations are now deprecated and slated for removal in Lix 2.94. + We're doing this because the CA derivation system has been a known cause of problems + and inconsistencies, is unmaintained, habitually makes improving the store code very + difficult (or blocks such improvements outright), and is beset by a number of design + flaws that in our opinion cannot be fixed without a full reimplementation from zero. + Dynamic derivations and impure derivations are built on the CA derivation framework, + and owing to this they too are deprecated and slated for removal in another release. + + + + # Lix 2.93.0 (2025-05-09)