From 91bf54d726cddd74d6ca34c6c01de2c9461cbe32 Mon Sep 17 00:00:00 2001 From: Alois Wohlschlager Date: Sun, 7 Sep 2025 13:58:31 +0200 Subject: [PATCH] flake: update nixpkgs input Without https://github.com/NixOS/nixpkgs/pull/434761 evaluation of the `nixpkgsLibTests` will fail in CI with recent enough Lix, due to reliance on the TOML integer saturation bug. Reported-by: Sergei Zimmerman Change-Id: I6a6a6964838009d2c525f67035f84072fdfad988 --- docker.nix | 60 ++++----- flake.lock | 6 +- flake.nix | 26 ++-- misc/capnproto.nix | 3 +- package.nix | 182 +++++++++++++------------- perl/default.nix | 3 +- subprojects/nix-eval-jobs/default.nix | 3 +- tests/nixos/chown-to-user.nix | 3 +- tests/nixos/remote-builds-ssh-ng.nix | 1 + 9 files changed, 148 insertions(+), 139 deletions(-) diff --git a/docker.nix b/docker.nix index 851bd84bf..1f350f9bd 100644 --- a/docker.nix +++ b/docker.nix @@ -62,38 +62,37 @@ let ++ autoLayered ++ extraPkgs; - users = - { + users = { - root = { - uid = 0; - shell = "${pkgs.bashInteractive}/bin/bash"; - home = "/root"; - gid = 0; - groups = [ "root" ]; - description = "System administrator"; - }; + root = { + uid = 0; + shell = "${pkgs.bashInteractive}/bin/bash"; + home = "/root"; + gid = 0; + groups = [ "root" ]; + description = "System administrator"; + }; - nobody = { - uid = 65534; - shell = "${pkgs.shadow}/bin/nologin"; - home = "/var/empty"; - gid = 65534; - groups = [ "nobody" ]; - description = "Unprivileged account (don't use!)"; + nobody = { + uid = 65534; + shell = "${pkgs.shadow}/bin/nologin"; + home = "/var/empty"; + gid = 65534; + groups = [ "nobody" ]; + description = "Unprivileged account (don't use!)"; + }; + } + // lib.listToAttrs ( + map (n: { + name = "nixbld${toString n}"; + value = { + uid = 30000 + n; + gid = 30000; + groups = [ "nixbld" ]; + description = "Nix build user ${toString n}"; }; - } - // lib.listToAttrs ( - map (n: { - name = "nixbld${toString n}"; - value = { - uid = 30000 + n; - gid = 30000; - groups = [ "nixbld" ]; - description = "Nix build user ${toString n}"; - }; - }) (lib.lists.range 1 32) - ); + }) (lib.lists.range 1 32) + ); groups = { root.gid = 0; @@ -361,7 +360,8 @@ let "org.opencontainers.image.version" = pkgs.nix.version; "org.opencontainers.image.description" = "Minimal Lix container image, with some batteries included."; - } // lib.optionalAttrs (lixRevision != null) { "org.opencontainers.image.revision" = lixRevision; }; + } + // lib.optionalAttrs (lixRevision != null) { "org.opencontainers.image.revision" = lixRevision; }; }; meta = { diff --git a/flake.lock b/flake.lock index 2e6701d2b..848ce9d57 100644 --- a/flake.lock +++ b/flake.lock @@ -108,11 +108,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1749522908, - "narHash": "sha256-eWANkhWXFL1MmaxzsZ9bhLCNT8OVs7CC+OXaSDGlA8A=", + "lastModified": 1757198069, + "narHash": "sha256-m3VUcOD4rTs8J7S+3dOjWMrAjw6RcITC3XYQ98zhEFs=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "e5cb99555c45a13dcc5f1317462238530b0066b7", + "rev": "0747026fc57ecb9c28901c7f7a2b5dc40e8af43c", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index df4e609bd..9c83307b0 100644 --- a/flake.nix +++ b/flake.nix @@ -175,8 +175,13 @@ { nixStable = prev.nix; - # Nix 2.18 has been removed from Nixpkgs ≥ 25.05, so we need to reintroduce it ourselves for our tests. nixVersions = prev.nixVersions // { + nix_2_3 = prev.nixVersions.nix_2_3.overrideAttrs (old: { + meta = old.meta // { + knownVulnerabilities = [ ]; + }; + }); + # Nix 2.18 has been removed from Nixpkgs ≥ 25.05, so we need to reintroduce it ourselves for our tests. nix_2_18 = nix_2_18.outputs.packages.${currentStdenv.hostPlatform.system}.default; }; @@ -440,15 +445,16 @@ in pkgs.symlinkJoin { name = "nixpkgs-lib-tests"; - paths = - [ testWithNix ] - # NOTE: nixpkgs 25.05 is being ... *creative*, and requires this dance to override - # the evaluator used for the test. it will break again in the future, don't worry. - ++ lib.optionals pkgs.stdenv.isLinux [ - ((pkgs.callPackage "${nixpkgs}/ci/eval" { nixVersions.latest = nix; }).attrpathsSuperset { - evalSystem = system; - }) - ]; + paths = [ + testWithNix + ] + # NOTE: nixpkgs 25.05 is being ... *creative*, and requires this dance to override + # the evaluator used for the test. it will break again in the future, don't worry. + ++ lib.optionals pkgs.stdenv.isLinux [ + ((pkgs.callPackage "${nixpkgs}/ci/eval" { inherit nix; }).attrpathsSuperset { + evalSystem = system; + }) + ]; } ); }; diff --git a/misc/capnproto.nix b/misc/capnproto.nix index 252f3d547..16011716d 100644 --- a/misc/capnproto.nix +++ b/misc/capnproto.nix @@ -46,7 +46,8 @@ stdenv.mkDerivation rec { propagatedBuildInputs = [ openssl zlib - ] ++ lib.optional (stdenv.cc.isClang && stdenv.hostPlatform.isStatic) empty-libgcc_eh; + ] + ++ lib.optional (stdenv.cc.isClang && stdenv.hostPlatform.isStatic) empty-libgcc_eh; # FIXME: separate the binaries from the stuff that user systems actually use # This runs into a terrible UX issue in Lix and I just don't want to debug it diff --git a/package.nix b/package.nix index 029b926eb..a2dc3757f 100644 --- a/package.nix +++ b/package.nix @@ -238,12 +238,13 @@ stdenv.mkDerivation (finalAttrs: { ); }; - outputs = - [ "out" ] - ++ lib.optionals (!finalAttrs.dontBuild) [ - "dev" - "doc" - ]; + outputs = [ + "out" + ] + ++ lib.optionals (!finalAttrs.dontBuild) [ + "dev" + "doc" + ]; dontBuild = lintInsteadOfBuild; @@ -285,80 +286,78 @@ stdenv.mkDerivation (finalAttrs: { # We only include CMake so that Meson can locate toml11, which only ships CMake dependency metadata. dontUseCmakeConfigure = true; - nativeBuildInputs = - [ - finalAttrs.lixPythonForBuild - meson - ninja - cmake - rustc - capnproto - # Required for libstd++ assertions that leaks inside of the final binary. - removeReferencesTo - dtrace-generator - ] - ++ [ - (lib.getBin lowdown-unsandboxed) - mdbook - mdbook-linkcheck - ] - ++ [ - pkg-config + nativeBuildInputs = [ + finalAttrs.lixPythonForBuild + meson + ninja + cmake + rustc + capnproto + # Required for libstd++ assertions that leaks inside of the final binary. + removeReferencesTo + dtrace-generator + ] + ++ [ + (lib.getBin lowdown-unsandboxed) + mdbook + mdbook-linkcheck + ] + ++ [ + pkg-config - # Tests - git - mercurial - jq - yq - lsof - ] - ++ lib.optional hostPlatform.isLinux util-linuxMinimal - ++ lib.optional (!officialRelease && buildUnreleasedNotes) build-release-notes - ++ lib.optional internalApiDocs doxygen - ++ lib.optionals lintInsteadOfBuild [ - # required for a wrapped clang-tidy - llvmPackages.clang-tools - # load-bearing order (just as below); the actual stdenv wrapped clang - # needs to precede the unwrapped clang in PATH such that calling `clang` - # can compile things. - stdenv.cc - # required for run-clang-tidy - llvmPackages.clang-unwrapped - ]; + # Tests + git + mercurial + jq + yq + lsof + ] + ++ lib.optional hostPlatform.isLinux util-linuxMinimal + ++ lib.optional (!officialRelease && buildUnreleasedNotes) build-release-notes + ++ lib.optional internalApiDocs doxygen + ++ lib.optionals lintInsteadOfBuild [ + # required for a wrapped clang-tidy + llvmPackages.clang-tools + # load-bearing order (just as below); the actual stdenv wrapped clang + # needs to precede the unwrapped clang in PATH such that calling `clang` + # can compile things. + stdenv.cc + # required for run-clang-tidy + llvmPackages.clang-unwrapped + ]; - buildInputs = - [ - curl - bzip2 - xz - brotli - editline-lix - openssl - sqlite - libarchive - boost - lowdown - toml11-lix - pegtl - capnproto - dtrace-headers - ] - # NOTE(Raito): I'd have expected that the LLVM packaging would inject the - # libunwind library path directly in the wrappers, but it does inject - # -lunwind without injecting the library path... - ++ lib.optionals stdenv.hostPlatform.isStatic [ llvmPackages.libunwind ] - ++ lib.optionals hostPlatform.isLinux [ - libseccomp - passt-lix - ] - ++ lib.optional internalApiDocs rapidcheck - ++ lib.optional hostPlatform.isx86_64 libcpuid - # There have been issues building these dependencies - ++ lib.optional (hostPlatform.canExecute buildPlatform) aws-sdk-cpp-nix - ++ lib.optionals (finalAttrs.dontBuild) maybePropagatedInputs - # I am so sorry. This is because checkInputs are required to pass - # configure, but we don't actually want to *run* the checks here. - ++ lib.optionals lintInsteadOfBuild finalAttrs.checkInputs; + buildInputs = [ + curl + bzip2 + xz + brotli + editline-lix + openssl + sqlite + libarchive + boost + lowdown + toml11-lix + pegtl + capnproto + dtrace-headers + ] + # NOTE(Raito): I'd have expected that the LLVM packaging would inject the + # libunwind library path directly in the wrappers, but it does inject + # -lunwind without injecting the library path... + ++ lib.optionals stdenv.hostPlatform.isStatic [ llvmPackages.libunwind ] + ++ lib.optionals hostPlatform.isLinux [ + libseccomp + passt-lix + ] + ++ lib.optional internalApiDocs rapidcheck + ++ lib.optional hostPlatform.isx86_64 libcpuid + # There have been issues building these dependencies + ++ lib.optional (hostPlatform.canExecute buildPlatform) aws-sdk-cpp-nix + ++ lib.optionals (finalAttrs.dontBuild) maybePropagatedInputs + # I am so sorry. This is because checkInputs are required to pass + # configure, but we don't actually want to *run* the checks here. + ++ lib.optionals lintInsteadOfBuild finalAttrs.checkInputs; checkInputs = [ gtest @@ -373,21 +372,20 @@ stdenv.mkDerivation (finalAttrs: { finalAttrs.lixPythonForBuild ]; - env = - { - # Meson allows referencing a /usr/share/cargo/registry shaped thing for subproject sources. - # Turns out the Nix-generated Cargo dependencies are named the same as they - # would be in a Cargo registry cache. - MESON_PACKAGE_CACHE_DIR = finalAttrs.cargoDeps; + env = { + # Meson allows referencing a /usr/share/cargo/registry shaped thing for subproject sources. + # Turns out the Nix-generated Cargo dependencies are named the same as they + # would be in a Cargo registry cache. + MESON_PACKAGE_CACHE_DIR = finalAttrs.cargoDeps; - VERSION_SUFFIX = versionSuffix; - } - // lib.optionalAttrs hostPlatform.isLinux { - BUILD_TEST_SHELL = "${pkgsStatic.busybox}/bin"; - } - // lib.optionalAttrs hostPlatform.isStatic { - NIX_CFLAGS_COMPILE = " -static"; - }; + VERSION_SUFFIX = versionSuffix; + } + // lib.optionalAttrs hostPlatform.isLinux { + BUILD_TEST_SHELL = "${pkgsStatic.busybox}/bin"; + } + // lib.optionalAttrs hostPlatform.isStatic { + NIX_CFLAGS_COMPILE = " -static"; + }; cargoDeps = rustPlatform.importCargoLock { lockFile = ./Cargo.lock; }; diff --git a/perl/default.nix b/perl/default.nix index 26a6f8f1d..742263067 100644 --- a/perl/default.nix +++ b/perl/default.nix @@ -46,7 +46,8 @@ perl.pkgs.toPerlModule ( perlPackages.DBDSQLite # for kj-async capnproto - ] ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security; + ] + ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security; # Nixpkgs' Meson hook likes to set this to "plain". mesonBuildType = "debugoptimized"; diff --git a/subprojects/nix-eval-jobs/default.nix b/subprojects/nix-eval-jobs/default.nix index e1b74c411..e4f7c4da2 100644 --- a/subprojects/nix-eval-jobs/default.nix +++ b/subprojects/nix-eval-jobs/default.nix @@ -39,7 +39,8 @@ let # nlohmann_json can be only discovered via cmake files cmake capnproto - ] ++ (lib.optional stdenv.cc.isClang [ clang-tools ]); + ] + ++ (lib.optional stdenv.cc.isClang [ clang-tools ]); passthru = { inherit nix; diff --git a/tests/nixos/chown-to-user.nix b/tests/nixos/chown-to-user.nix index ae7ae3cd5..0c5b674dc 100644 --- a/tests/nixos/chown-to-user.nix +++ b/tests/nixos/chown-to-user.nix @@ -26,8 +26,9 @@ in name = "chown-to-user"; nodes = { - machine = { lib, pkgs, ... }: { + machine = { config, lib, pkgs, ... }: { virtualisation.writableStore = true; + virtualisation.additionalPaths = [ config.system.build.extraUtils ]; users.users.test = { isNormalUser = true; diff --git a/tests/nixos/remote-builds-ssh-ng.nix b/tests/nixos/remote-builds-ssh-ng.nix index d60446c7f..12bd0fce8 100644 --- a/tests/nixos/remote-builds-ssh-ng.nix +++ b/tests/nixos/remote-builds-ssh-ng.nix @@ -56,6 +56,7 @@ in imports = [ test.config.builders.config ]; services.openssh.enable = true; virtualisation.writableStore = true; + virtualisation.additionalPaths = [ config.system.build.extraUtils ]; nix.settings.sandbox = true; nix.settings.substituters = lib.mkForce [ ]; };