From 5a38f5bb8d2e50f994592893249fe6043c56eda1 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Tue, 10 Jun 2025 18:47:04 +0200 Subject: [PATCH] flake/inputs: 24.11-small -> 25.05-small We upgrade to 25.05 release, which contains the curl commit https://github.com/curl/curl/commit/5fbd78eb2dc4afbd8884e8eed27147fc3d4318f6 done in https://github.com/NixOS/nixpkgs/pull/396200#issuecomment-2795944006. This fixes HTTP transfers generating arbitrary errors and possibly failing unusually. Users who are already depending on 25.05-small or a recent unstable already had the fix. Special mention to the Linux kernel who gave me the opportunity to get on a 24 hours bisection side quest to fix the local release engineering test. Special thanks to everyone who had to endure me ranting. Change-Id: I866caf65d5ea103f1fa5eccd57df8031c9eacda0 Co-authored-by: eldritch horrors Co-authored-by: helle Co-authored-by: Alois Wohlschlager Signed-off-by: Raito Bezarius --- docker.nix | 15 +++-- flake.lock | 73 ++++++++++++++++++++--- flake.nix | 25 +++++++- src/libexpr/nixexpr.hh | 2 +- src/libexpr/parser/grammar.hh | 9 ++- src/libstore/crypto.cc | 11 +++- src/libstore/sqlite.cc | 2 +- src/libutil/compression.cc | 1 + src/libutil/file-system.cc | 2 +- src/libutil/json-utils.cc | 2 +- src/libutil/logging.hh | 12 ++-- src/libutil/references.cc | 2 +- src/libutil/types.hh | 12 +++- subprojects/lix-clang-tidy/FixIncludes.cc | 3 +- tests/nixos/nix-copy-closure.nix | 4 +- 15 files changed, 135 insertions(+), 40 deletions(-) diff --git a/docker.nix b/docker.nix index b23a9637f..a9489e5b0 100644 --- a/docker.nix +++ b/docker.nix @@ -193,13 +193,11 @@ let in '' { - ${ - lib.concatStringsSep "\n" ( - builtins.map (output: '' - ${output} = { outPath = "${lib.getOutput output drv}"; }; - '') outputs - ) - } + ${lib.concatStringsSep "\n" ( + builtins.map (output: '' + ${output} = { outPath = "${lib.getOutput output drv}"; }; + '') outputs + )} outputs = [ ${lib.concatStringsSep " " (builtins.map (x: "\"${x}\"") outputs)} ]; name = "${drv.name}"; outPath = "${drv}"; @@ -361,7 +359,8 @@ let "org.opencontainers.image.source" = "https://git.lix.systems/lix-project/lix"; "org.opencontainers.image.vendor" = "Lix project"; "org.opencontainers.image.version" = pkgs.nix.version; - "org.opencontainers.image.description" = "Minimal Lix container image, with some batteries included."; + "org.opencontainers.image.description" = + "Minimal Lix container image, with some batteries included."; } // lib.optionalAttrs (lixRevision != null) { "org.opencontainers.image.revision" = lixRevision; }; }; diff --git a/flake.lock b/flake.lock index 934f1f594..546b7dfc8 100644 --- a/flake.lock +++ b/flake.lock @@ -16,6 +16,22 @@ "type": "github" } }, + "lowdown-src": { + "flake": false, + "locked": { + "lastModified": 1633514407, + "narHash": "sha256-Dw32tiMjdK9t3ETl5fzGrutQTzh2rufgZV4A/BbxuD4=", + "owner": "kristapsdz", + "repo": "lowdown", + "rev": "d2c2b44ff6c27b936ec27358a2653caaef8f73b8", + "type": "github" + }, + "original": { + "owner": "kristapsdz", + "repo": "lowdown", + "type": "github" + } + }, "nix2container": { "flake": false, "locked": { @@ -32,18 +48,44 @@ "type": "github" } }, - "nixpkgs": { + "nix_2_18": { + "inputs": { + "flake-compat": [ + "flake-compat" + ], + "lowdown-src": "lowdown-src", + "nixpkgs": "nixpkgs", + "nixpkgs-regression": [ + "nixpkgs-regression" + ] + }, "locked": { - "lastModified": 1733348545, - "narHash": "sha256-b4JrUmqT0vFNx42aEN9LTWOHomkTKL/ayLopflVf81U=", + "lastModified": 1730375271, + "narHash": "sha256-RrOFlDGmRXcVRV2p2HqHGqvzGNyWoD0Dado/BNlJ1SI=", "owner": "NixOS", - "repo": "nixpkgs", - "rev": "9ecb50d2fae8680be74c08bb0a995c5383747f89", + "repo": "nix", + "rev": "0f665ff6779454f2117dcc32e44380cda7f45523", "type": "github" }, "original": { "owner": "NixOS", - "ref": "nixos-24.11-small", + "ref": "2.18.9", + "repo": "nix", + "type": "github" + } + }, + "nixpkgs": { + "locked": { + "lastModified": 1705033721, + "narHash": "sha256-K5eJHmL1/kev6WuqyqqbS1cdNnSidIZ3jeqJ7GbrYnQ=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "a1982c92d8980a0114372973cbdfe0a307f1bdea", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-23.05-small", "repo": "nixpkgs", "type": "github" } @@ -64,6 +106,22 @@ "type": "github" } }, + "nixpkgs_2": { + "locked": { + "lastModified": 1749522908, + "narHash": "sha256-eWANkhWXFL1MmaxzsZ9bhLCNT8OVs7CC+OXaSDGlA8A=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "e5cb99555c45a13dcc5f1317462238530b0066b7", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-25.05-small", + "repo": "nixpkgs", + "type": "github" + } + }, "pre-commit-hooks": { "flake": false, "locked": { @@ -84,7 +142,8 @@ "inputs": { "flake-compat": "flake-compat", "nix2container": "nix2container", - "nixpkgs": "nixpkgs", + "nix_2_18": "nix_2_18", + "nixpkgs": "nixpkgs_2", "nixpkgs-regression": "nixpkgs-regression", "pre-commit-hooks": "pre-commit-hooks" } diff --git a/flake.nix b/flake.nix index 67752b8b7..05d9fe117 100644 --- a/flake.nix +++ b/flake.nix @@ -2,8 +2,19 @@ description = "Lix: A modern, delicious implementation of the Nix package manager"; inputs = { - nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11-small"; + nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05-small"; nixpkgs-regression.url = "github:NixOS/nixpkgs/215d4d0fd80ca5163643b03a33fde804a29cc1e2"; + + # Required because Nix 2.18 is not in Nixpkgs ≥ 25.05 anymore. + nix_2_18 = { + url = "github:NixOS/nix/2.18.9"; + # NOTE(Raito): this is not possible because patches on libseccomp does not apply anymore on this Nix. + # Let's keep the latest known nixpkgs useable with Nix 2.18 for our tests. + # inputs.nixpkgs.follows = "nixpkgs"; + inputs.nixpkgs-regression.follows = "nixpkgs-regression"; + inputs.flake-compat.follows = "flake-compat"; + }; + pre-commit-hooks = { url = "github:cachix/git-hooks.nix"; flake = false; @@ -25,6 +36,7 @@ nixpkgs-regression, pre-commit-hooks, nix2container, + nix_2_18, flake-compat, }: @@ -161,6 +173,11 @@ { nixStable = prev.nix; + # Nix 2.18 has been removed from Nixpkgs ≥ 25.05, so we need to reintroduce it ourselves for our tests. + nixVersions = prev.nixVersions // { + nix_2_18 = nix_2_18.outputs.packages.${currentStdenv.hostPlatform.system}.default; + }; + # Forward from the previous stage as we don’t want it to pick the lowdown override nixUnstable = prev.nixUnstable; @@ -349,10 +366,12 @@ name = "nixpkgs-lib-tests"; paths = [ testWithNix ] - # NOTE: nixpkgs 24.11 is being ... *creative*, and requires this dance to override + # NOTE: nixpkgs 25.05 is being ... *creative*, and requires this dance to override # the evaluator used for the test. it will break again in the future, don't worry. ++ lib.optionals pkgs.stdenv.isLinux [ - (pkgs.callPackage "${nixpkgs}/ci/eval" { nixVersions.nix_2_24 = nix; }).attrpathsSuperset + ((pkgs.callPackage "${nixpkgs}/ci/eval" { nixVersions.latest = nix; }).attrpathsSuperset { + evalSystem = system; + }) ]; } ); diff --git a/src/libexpr/nixexpr.hh b/src/libexpr/nixexpr.hh index 49e2e4147..8d5662bb8 100644 --- a/src/libexpr/nixexpr.hh +++ b/src/libexpr/nixexpr.hh @@ -212,7 +212,7 @@ struct ExprAttrs : Expr AttrDef() { }; template - const T & chooseByKind(const T & plain, const T & inherited, const T & inheritedFrom) const + T chooseByKind(const T & plain, const T & inherited, const T & inheritedFrom) const { switch (kind) { case Kind::Plain: diff --git a/src/libexpr/parser/grammar.hh b/src/libexpr/parser/grammar.hh index 2c5a3d1be..398dcbd4a 100644 --- a/src/libexpr/parser/grammar.hh +++ b/src/libexpr/parser/grammar.hh @@ -624,10 +624,13 @@ struct nothing : p::nothing { static_assert(!std::is_base_of_v); }; - - template -struct operator_semantics { +struct operator_semantics +{ +private: + operator_semantics() = default; + friend Self; +public: struct has_attr : grammar::op::has_attr { AttrPathT path; }; diff --git a/src/libstore/crypto.cc b/src/libstore/crypto.cc index 6f4a36735..a6bb35669 100644 --- a/src/libstore/crypto.cc +++ b/src/libstore/crypto.cc @@ -45,8 +45,15 @@ std::string SecretKey::signDetached(std::string_view data) const { unsigned char sig[crypto_sign_BYTES]; unsigned long long sigLen; - crypto_sign_detached(sig, &sigLen, charptr_cast(data.data()), data.size(), - charptr_cast(key.data())); + crypto_sign_detached( + sig, + &sigLen, + // the following is not a string function so no null termination issues are possible here. + // NOLINTNEXTLINE(bugprone-suspicious-stringview-data-usage) + charptr_cast(data.data()), + data.size(), + charptr_cast(key.data()) + ); return name + ":" + base64Encode(std::string(reinterpret_cast(sig), sigLen)); } diff --git a/src/libstore/sqlite.cc b/src/libstore/sqlite.cc index 8d0bfcb11..23342d468 100644 --- a/src/libstore/sqlite.cc +++ b/src/libstore/sqlite.cc @@ -145,7 +145,7 @@ SQLiteStmt::Use::~Use() SQLiteStmt::Use & SQLiteStmt::Use::operator () (std::string_view value, bool notNull) { if (notNull) { - if (sqlite3_bind_text(stmt, curArg++, value.data(), -1, SQLITE_TRANSIENT) != SQLITE_OK) + if (sqlite3_bind_text(stmt, curArg++, value.data(), value.length(), SQLITE_TRANSIENT) != SQLITE_OK) SQLiteError::throw_(stmt.db, "binding argument"); } else bind(); diff --git a/src/libutil/compression.cc b/src/libutil/compression.cc index 5152a2146..3382aa3eb 100644 --- a/src/libutil/compression.cc +++ b/src/libutil/compression.cc @@ -239,6 +239,7 @@ struct BrotliCompressionSink : ChunkedCompressionSink void writeInternal(std::string_view data) override { + // NOLINTNEXTLINE(bugprone-suspicious-stringview-data-usage) auto next_in = charptr_cast(data.data()); size_t avail_in = data.size(); uint8_t * next_out = outbuf; diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc index c8a1cb8ad..8b2d04101 100644 --- a/src/libutil/file-system.cc +++ b/src/libutil/file-system.cc @@ -475,7 +475,7 @@ static void _deletePath(const Path & path, uint64_t & bytesFreed) throw SysError("opening directory '%1%'", path); } - _deletePath(dirfd.get(), baseNameOf(path).data(), bytesFreed); + _deletePath(dirfd.get(), std::string(baseNameOf(path)), bytesFreed); } diff --git a/src/libutil/json-utils.cc b/src/libutil/json-utils.cc index 61cef743d..a670c19ad 100644 --- a/src/libutil/json-utils.cc +++ b/src/libutil/json-utils.cc @@ -38,6 +38,6 @@ const nlohmann::json & ensureType( nlohmann::json(expectedType).type_name(), value.type_name()); - return value; + return value; // NOLINT(bugprone-return-const-ref-from-parameter) } } diff --git a/src/libutil/logging.hh b/src/libutil/logging.hh index b2d73d8ba..3a8533254 100644 --- a/src/libutil/logging.hh +++ b/src/libutil/logging.hh @@ -258,12 +258,12 @@ extern Verbosity verbosity; * level. Note that this has to be implemented as a macro to ensure that the * arguments are evaluated lazily. */ -#define printMsgUsing(loggerParam, level, args...) \ - do { \ - auto __lvl = level; \ - if (__lvl <= nix::verbosity) { \ - loggerParam->log(__lvl, fmt(args)); \ - } \ +#define printMsgUsing(loggerParam, level, args...) \ + do { \ + auto _lix_logger_print_lvl = level; \ + if (_lix_logger_print_lvl <= nix::verbosity) { \ + loggerParam->log(_lix_logger_print_lvl, fmt(args)); \ + } \ } while (0) #define printMsg(level, args...) printMsgUsing(logger, level, args) diff --git a/src/libutil/references.cc b/src/libutil/references.cc index 9f4ab0678..f9d1c5645 100644 --- a/src/libutil/references.cc +++ b/src/libutil/references.cc @@ -53,7 +53,7 @@ void RefScanSink::operator () (std::string_view data) previous fragment and the start of the current fragment. */ auto s = tail; auto tailLen = std::min(data.size(), refLength); - s.append(data.data(), tailLen); + s.append(data.data(), tailLen); // NOLINT(bugprone-suspicious-stringview-data-usage) search(s, hashes, seen); search(data, hashes, seen); diff --git a/src/libutil/types.hh b/src/libutil/types.hh index 13cb062fb..b96d6de3d 100644 --- a/src/libutil/types.hh +++ b/src/libutil/types.hh @@ -80,12 +80,18 @@ typename T::mapped_type * get(T & map, const typename T::key_type & key) * Get a value for the specified key from an associate container, or a default value if the key isn't present. */ template -const typename T::mapped_type & getOr(T & map, +const typename T::mapped_type & getOr( + T & map [[clang::lifetimebound]], const typename T::key_type & key, - const typename T::mapped_type & defaultValue) + const typename T::mapped_type & defaultValue [[clang::lifetimebound]] +) { auto i = map.find(key); - if (i == map.end()) return defaultValue; + if (i == map.end()) { + /* FIXME(Raito): `[[clang::lifetimebound]]` has no effect on `defaultValue` warning. */ + // NOLINTNEXTLINE(bugprone-return-const-ref-from-parameter) + return defaultValue; + } return i->second; } diff --git a/subprojects/lix-clang-tidy/FixIncludes.cc b/subprojects/lix-clang-tidy/FixIncludes.cc index 602d3d355..77d24ffbc 100644 --- a/subprojects/lix-clang-tidy/FixIncludes.cc +++ b/subprojects/lix-clang-tidy/FixIncludes.cc @@ -34,6 +34,7 @@ private: OptionalFileEntryRef File, StringRef SearchPath, StringRef RelativePath, const Module *Imported, + bool ModuleImported, SrcMgr::CharacteristicKind FileType) override; }; @@ -46,7 +47,7 @@ void FixIncludesCallbacks::LexedFileChanged(FileID, LexedFileChangeReason, void FixIncludesCallbacks::InclusionDirective( SourceLocation, const Token &, StringRef FileName, bool IsAngled, CharSourceRange FilenameRange, OptionalFileEntryRef File, StringRef, - StringRef, const Module *, SrcMgr::CharacteristicKind) { + StringRef, const Module *, bool, SrcMgr::CharacteristicKind) { if (Ignore) return; diff --git a/tests/nixos/nix-copy-closure.nix b/tests/nixos/nix-copy-closure.nix index cd25fbbd0..d6d4ae4f3 100644 --- a/tests/nixos/nix-copy-closure.nix +++ b/tests/nixos/nix-copy-closure.nix @@ -45,12 +45,12 @@ in { server.wait_for_unit("network-online.target") client.wait_for_unit("network-online.target") - client.succeed("mkdir -m 700 /root/.ssh") + client.succeed("mkdir -m 700 /root/.ssh || [[ -d /root/.ssh ]]") client.copy_from_host("key", "/root/.ssh/id_ed25519") client.succeed("chmod 600 /root/.ssh/id_ed25519") # Install the SSH key on the server. - server.succeed("mkdir -m 700 /root/.ssh") + server.succeed("mkdir -m 700 /root/.ssh || [[ -d /root/.ssh ]]") server.copy_from_host("key.pub", "/root/.ssh/authorized_keys") server.wait_for_unit("sshd.service") client.succeed(f"ssh -o StrictHostKeyChecking=no {server.name} 'echo hello world' >&2")