guiwf/lix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

flake/inputs: 24.11-small -> 25.05-small

Browse Source 
We upgrade to 25.05 release, which contains the curl commit
https://github.com/curl/curl/commit/5fbd78eb2dc4afbd8884e8eed27147fc3d4318f6
done in
https://github.com/NixOS/nixpkgs/pull/396200#issuecomment-2795944006.

This fixes HTTP transfers generating arbitrary errors and possibly
failing unusually.

Users who are already depending on 25.05-small or a recent unstable
already had the fix.

Special mention to the Linux kernel who gave me the opportunity to get
on a 24 hours bisection side quest to fix the local release engineering
test.

Special thanks to everyone who had to endure me ranting.

Change-Id: I866caf65d5ea103f1fa5eccd57df8031c9eacda0
Co-authored-by: eldritch horrors <pennae@lix.systems>
Co-authored-by: helle <helle@h3l.li>
Signed-off-by: Raito Bezarius <raito@lix.systems>
(cherry picked from commit 1e34c37477)
This commit is contained in:
Raito Bezarius
2025-06-19 17:09:59 +02:00
parent 2387104452
commit fbd6a014ec
17 changed files with 156 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker.nix
+7 -8
View File
@@ -193,13 +193,11 @@ let
in
''
{
${
lib.concatStringsSep "\n" (
builtins.map (output: ''
${output} = { outPath = "${lib.getOutput output drv}"; };
'') outputs
)
}
${lib.concatStringsSep "\n" (
builtins.map (output: ''
${output} = { outPath = "${lib.getOutput output drv}"; };
'') outputs
)}
outputs = [ ${lib.concatStringsSep " " (builtins.map (x: "\"${x}\"") outputs)} ];
name = "${drv.name}";
outPath = "${drv}";
@@ -361,7 +359,8 @@ let
"org.opencontainers.image.source" = "https://git.lix.systems/lix-project/lix";
"org.opencontainers.image.vendor" = "Lix project";
"org.opencontainers.image.version" = pkgs.nix.version;
"org.opencontainers.image.description" = "Minimal Lix container image, with some batteries included.";
"org.opencontainers.image.description" =
"Minimal Lix container image, with some batteries included.";
} // lib.optionalAttrs (lixRevision != null) { "org.opencontainers.image.revision" = lixRevision; };
};
flake.lock
Generated
+66 -7
View File
@@ -16,6 +16,22 @@
"type": "github"
}
},
"lowdown-src": {
"flake": false,
"locked": {
"lastModified": 1633514407,
"narHash": "sha256-Dw32tiMjdK9t3ETl5fzGrutQTzh2rufgZV4A/BbxuD4=",
"owner": "kristapsdz",
"repo": "lowdown",
"rev": "d2c2b44ff6c27b936ec27358a2653caaef8f73b8",
"type": "github"
},
"original": {
"owner": "kristapsdz",
"repo": "lowdown",
"type": "github"
}
},
"nix2container": {
"flake": false,
"locked": {
@@ -32,18 +48,44 @@
"type": "github"
}
},
"nixpkgs": {
"nix_2_18": {
"inputs": {
"flake-compat": [
"flake-compat"
],
"lowdown-src": "lowdown-src",
"nixpkgs": "nixpkgs",
"nixpkgs-regression": [
"nixpkgs-regression"
]
},
"locked": {
"lastModified": 1733348545,
"narHash": "sha256-b4JrUmqT0vFNx42aEN9LTWOHomkTKL/ayLopflVf81U=",
"lastModified": 1730375271,
"narHash": "sha256-RrOFlDGmRXcVRV2p2HqHGqvzGNyWoD0Dado/BNlJ1SI=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "9ecb50d2fae8680be74c08bb0a995c5383747f89",
"repo": "nix",
"rev": "0f665ff6779454f2117dcc32e44380cda7f45523",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-24.11-small",
"ref": "2.18.9",
"repo": "nix",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1705033721,
"narHash": "sha256-K5eJHmL1/kev6WuqyqqbS1cdNnSidIZ3jeqJ7GbrYnQ=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "a1982c92d8980a0114372973cbdfe0a307f1bdea",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-23.05-small",
"repo": "nixpkgs",
"type": "github"
}
@@ -64,6 +106,22 @@
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1749522908,
"narHash": "sha256-eWANkhWXFL1MmaxzsZ9bhLCNT8OVs7CC+OXaSDGlA8A=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "e5cb99555c45a13dcc5f1317462238530b0066b7",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-25.05-small",
"repo": "nixpkgs",
"type": "github"
}
},
"pre-commit-hooks": {
"flake": false,
"locked": {
@@ -84,7 +142,8 @@
"inputs": {
"flake-compat": "flake-compat",
"nix2container": "nix2container",
"nixpkgs": "nixpkgs",
"nix_2_18": "nix_2_18",
"nixpkgs": "nixpkgs_2",
"nixpkgs-regression": "nixpkgs-regression",
"pre-commit-hooks": "pre-commit-hooks"
}
flake.nix
+22 -3
View File
@@ -2,8 +2,19 @@
description = "Lix: A modern, delicious implementation of the Nix package manager";
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11-small";
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05-small";
nixpkgs-regression.url = "github:NixOS/nixpkgs/215d4d0fd80ca5163643b03a33fde804a29cc1e2";
# Required because Nix 2.18 is not in Nixpkgs ≥ 25.05 anymore.
nix_2_18 = {
url = "github:NixOS/nix/2.18.9";
# NOTE(Raito): this is not possible because patches on libseccomp does not apply anymore on this Nix.
# Let's keep the latest known nixpkgs useable with Nix 2.18 for our tests.
# inputs.nixpkgs.follows = "nixpkgs";
inputs.nixpkgs-regression.follows = "nixpkgs-regression";
inputs.flake-compat.follows = "flake-compat";
};
pre-commit-hooks = {
url = "github:cachix/git-hooks.nix";
flake = false;
@@ -25,6 +36,7 @@
nixpkgs-regression,
pre-commit-hooks,
nix2container,
nix_2_18,
flake-compat,
}:
@@ -163,6 +175,11 @@
{
nixStable = prev.nix;
# Nix 2.18 has been removed from Nixpkgs ≥ 25.05, so we need to reintroduce it ourselves for our tests.
nixVersions = prev.nixVersions // {
nix_2_18 = nix_2_18.outputs.packages.${currentStdenv.hostPlatform.system}.default;
};
# Forward from the previous stage as we don’t want it to pick the lowdown override
nixUnstable = prev.nixUnstable;
@@ -383,10 +400,12 @@
name = "nixpkgs-lib-tests";
paths =
[ testWithNix ]
# NOTE: nixpkgs 24.11 is being ... *creative*, and requires this dance to override
# NOTE: nixpkgs 25.05 is being ... *creative*, and requires this dance to override
# the evaluator used for the test. it will break again in the future, don't worry.
++ lib.optionals pkgs.stdenv.isLinux [
(pkgs.callPackage "${nixpkgs}/ci/eval" { nixVersions.nix_2_24 = nix; }).attrpathsSuperset
((pkgs.callPackage "${nixpkgs}/ci/eval" { nixVersions.latest = nix; }).attrpathsSuperset {
evalSystem = system;
})
];
}
);
lix/libexpr/nixexpr.hh
+1 -1
View File
@@ -312,7 +312,7 @@ struct ExprAttrs
AttrDef() { };
template<typename T>
const T & chooseByKind(const T & plain, const T & inherited, const T & inheritedFrom) const
T chooseByKind(const T & plain, const T & inherited, const T & inheritedFrom) const
{
switch (kind) {
case Kind::Plain:
lix/libexpr/parser/grammar.hh
+5 -4
View File
@@ -686,10 +686,12 @@ struct nothing : p::nothing<Rule> {
static_assert(!std::is_base_of_v<semantic, Rule>);
};
template<typename Self, typename OpCtx, typename AttrPathT, typename ExprT>
struct operator_semantics {
struct operator_semantics
{
private:
operator_semantics() = default;
friend Self;
public:
struct has_attr : grammar::v1::op::has_attr {
AttrPathT path;
@@ -775,5 +777,4 @@ public:
return popExpr();
}
};
}
lix/libstore/crypto.cc
+9 -2
View File
@@ -45,8 +45,15 @@ std::string SecretKey::signDetached(std::string_view data) const
{
unsigned char sig[crypto_sign_BYTES];
unsigned long long sigLen;
crypto_sign_detached(sig, &sigLen, charptr_cast<const unsigned char *>(data.data()), data.size(),
charptr_cast<const unsigned char *>(key.data()));
crypto_sign_detached(
sig,
&sigLen,
// the following is not a string function so no null termination issues are possible here.
// NOLINTNEXTLINE(bugprone-suspicious-stringview-data-usage)
charptr_cast<const unsigned char *>(data.data()),
data.size(),
charptr_cast<const unsigned char *>(key.data())
);
return name + ":" + base64Encode(std::string(reinterpret_cast<char *>(sig), sigLen));
}
lix/libstore/sqlite.cc
+6 -1
View File
@@ -179,8 +179,13 @@ SQLiteStmt::Use::~Use()
SQLiteStmt::Use & SQLiteStmt::Use::operator () (std::string_view value, bool notNull)
{
if (notNull) {
if (sqlite3_bind_text(stmt.stmt.get(), curArg++, value.data(), -1, SQLITE_TRANSIENT) != SQLITE_OK)
if (sqlite3_bind_text(
stmt.stmt.get(), curArg++, value.data(), value.length(), SQLITE_TRANSIENT
)
!= SQLITE_OK)
{
SQLiteError::throw_(stmt.db, "binding argument");
}
} else
bind();
return *this;
lix/libutil/archive.cc
+1 -1
View File
@@ -632,7 +632,7 @@ struct AsyncCopier : AsyncInputStream
co_yield Fragment{want->n, false};
} else if (auto f = std::get_if<Parser::FileHeader>(&*i)) {
co_yield Fragment{f->size, true};
} else if (auto sl = std::get_if<Parser::Symlink>(&*i)) {
} else if (auto _ = std::get_if<Parser::Symlink>(&*i)) {
// nothing to do
} else if (auto dir = std::get_if<Parser::Directory>(&*i)) {
while (auto e = dir->content.next()) {
lix/libutil/compression.cc
+1
View File
@@ -259,6 +259,7 @@ struct BrotliCompressionSink : ChunkedCompressionSink
void writeInternal(std::string_view data) override
{
// NOLINTNEXTLINE(bugprone-suspicious-stringview-data-usage)
auto next_in = charptr_cast<const uint8_t *>(data.data());
size_t avail_in = data.size();
uint8_t * next_out = outbuf;
lix/libutil/json-utils.cc
+1 -1
View File
@@ -38,6 +38,6 @@ const JSON & ensureType(
JSON(expectedType).type_name(),
value.type_name());
return value;
return value; // NOLINT(bugprone-return-const-ref-from-parameter)
}
}
lix/libutil/logging.hh
+6 -6
View File
@@ -282,12 +282,12 @@ extern Verbosity verbosity;
* level. Note that this has to be implemented as a macro to ensure that the
* arguments are evaluated lazily.
*/
#define printMsgUsing(loggerParam, level, args...) \
do { \
auto __lvl = level; \
if (__lvl <= nix::verbosity) { \
loggerParam->log(__lvl, fmt(args)); \
} \
#define printMsgUsing(loggerParam, level, args...) \
do { \
auto _lix_logger_print_lvl = level; \
if (_lix_logger_print_lvl <= nix::verbosity) { \
loggerParam->log(_lix_logger_print_lvl, fmt(args)); \
} \
} while (0)
#define printMsg(level, args...) printMsgUsing(logger, level, args)
lix/libutil/references.cc
+1 -1
View File
@@ -53,7 +53,7 @@ void RefScanSink::operator () (std::string_view data)
previous fragment and the start of the current fragment. */
auto s = tail;
auto tailLen = std::min(data.size(), refLength);
s.append(data.data(), tailLen);
s.append(data.data(), tailLen); // NOLINT(bugprone-suspicious-stringview-data-usage)
search(s, hashes, seen);
search(data, hashes, seen);
lix/libutil/types.hh
+10 -4
View File
@@ -68,13 +68,19 @@ typename T::mapped_type * get(T & map, const typename T::key_type & key)
/**
* Get a value for the specified key from an associate container, or a default value if the key isn't present.
*/
template <class T>
const typename T::mapped_type & getOr(T & map,
template<class T>
const typename T::mapped_type & getOr(
T & map [[clang::lifetimebound]],
const typename T::key_type & key,
const typename T::mapped_type & defaultValue)
const typename T::mapped_type & defaultValue [[clang::lifetimebound]]
)
{
auto i = map.find(key);
if (i == map.end()) return defaultValue;
if (i == map.end()) {
/* FIXME(Raito): `[[clang::lifetimebound]]` has no effect on `defaultValue` warning. */
// NOLINTNEXTLINE(bugprone-return-const-ref-from-parameter)
return defaultValue;
}
return i->second;
}
releng/local/default.nix
+6
View File
@@ -65,6 +65,12 @@ in
environment.sessionVariables = {
GARAGE_ADMIN_TOKEN = "UkLeGWEvHnXBqnueR3ISEMWpOnm40jH2tM2HnnL/0F4=";
};
# ≥ v6.12 kernel has a system wide corruption related to 9p. wait until
# https://lore.kernel.org/all/w5ap2zcsatkx4dmakrkjmaexwh3mnmgc5vhavb2miaj6grrzat@7kzr5vlsrmh5/
# resolves. once this is resolved and the fix lands in a stable kernel
# in nixpkgs, this pin can be removed.
boot.kernelPackages = pkgs.linuxPackages_6_6;
};
};
testScript = ''
tests/functional2/testlib/fixtures/nix.py
+11 -10
View File
@@ -107,9 +107,9 @@ class NixSettings:
field_may("experimental-features", self.experimental_features)
field_may("store", self.store)
assert (
self.store or self.nix_store_dir
), "Failing to set either nix_store_dir or store will cause accidental use of the system store."
assert self.store or self.nix_store_dir, (
"Failing to set either nix_store_dir or store will cause accidental use of the system store."
)
return config
def to_env_overlay(self) -> dict[str, str]:
@@ -215,13 +215,14 @@ class Nix:
def nix(self, cmd: list[str], nix_exe: str = "nix", flake: bool = False) -> NixCommand:
return self.nix_cmd([nix_exe, *cmd], flake=flake)
nix_build = partialmethod(nix, nix_exe="nix-build")
nix_shell = partialmethod(nix, nix_exe="nix-shell")
nix_store = partialmethod(nix, nix_exe="nix-store")
nix_env = partialmethod(nix, nix_exe="nix-env")
nix_instantiate = partialmethod(nix, nix_exe="nix-instantiate")
nix_channel = partialmethod(nix, nix_exe="nix-channel")
nix_prefetch_url = partialmethod(nix, nix_exe="nix-prefetch-url")
# Mark each of these as correct as they are not ClassVars, but we also don't want to turn off RUF045
nix_build = partialmethod(nix, nix_exe="nix-build") # noqa: RUF045
nix_shell = partialmethod(nix, nix_exe="nix-shell") # noqa: RUF045
nix_store = partialmethod(nix, nix_exe="nix-store") # noqa: RUF045
nix_env = partialmethod(nix, nix_exe="nix-env") # noqa: RUF045
nix_instantiate = partialmethod(nix, nix_exe="nix-instantiate") # noqa: RUF045
nix_channel = partialmethod(nix, nix_exe="nix-channel") # noqa: RUF045
nix_prefetch_url = partialmethod(nix, nix_exe="nix-prefetch-url") # noqa: RUF045
def eval(self, expr: str, settings: NixSettings | None = None) -> CommandResult:
if settings is None:
tests/nixos/fetchurl.nix
+1 -1
View File
@@ -76,7 +76,7 @@ in
# Fetching from a server with an untrusted cert should fail.
err = machine.fail("nix build --no-substitute --expr 'import <nix/fetchurl.nix> { url = \"https://bad/index.html\"; hash = \"sha256-rsBwZF/lPuOzdjBZN2E08FjMM3JHyXit0Xi2zN+wAZ8=\"; }' 2>&1")
print(err)
assert "SSL peer certificate or SSH remote key was not OK" in err
assert "SSL certificate problem: self-signed certificate" in err
# Fetching from a server with a trusted cert should work via environment variable override.
machine.succeed("NIX_SSL_CERT_FILE=/tmp/cafile.pem nix build --no-substitute --expr 'import <nix/fetchurl.nix> { url = \"https://bad/index.html\"; hash = \"sha256-rsBwZF/lPuOzdjBZN2E08FjMM3JHyXit0Xi2zN+wAZ8=\"; }'")
tests/nixos/nix-copy-closure.nix
+2 -2
View File
@@ -45,12 +45,12 @@ in {
server.wait_for_unit("network-online.target")
client.wait_for_unit("network-online.target")
client.succeed("mkdir -m 700 /root/.ssh")
client.succeed("mkdir -m 700 /root/.ssh || [[ -d /root/.ssh ]]")
client.copy_from_host("key", "/root/.ssh/id_ed25519")
client.succeed("chmod 600 /root/.ssh/id_ed25519")
# Install the SSH key on the server.
server.succeed("mkdir -m 700 /root/.ssh")
server.succeed("mkdir -m 700 /root/.ssh || [[ -d /root/.ssh ]]")
server.copy_from_host("key.pub", "/root/.ssh/authorized_keys")
server.wait_for_unit("sshd.service")
client.succeed(f"ssh -o StrictHostKeyChecking=no {server.name} 'echo hello world' >&2")