diff --git a/docker.nix b/docker.nix index 27616bcd8..851bd84bf 100644 --- a/docker.nix +++ b/docker.nix @@ -193,13 +193,11 @@ let in '' { - ${ - lib.concatStringsSep "\n" ( - builtins.map (output: '' - ${output} = { outPath = "${lib.getOutput output drv}"; }; - '') outputs - ) - } + ${lib.concatStringsSep "\n" ( + builtins.map (output: '' + ${output} = { outPath = "${lib.getOutput output drv}"; }; + '') outputs + )} outputs = [ ${lib.concatStringsSep " " (builtins.map (x: "\"${x}\"") outputs)} ]; name = "${drv.name}"; outPath = "${drv}"; @@ -361,7 +359,8 @@ let "org.opencontainers.image.source" = "https://git.lix.systems/lix-project/lix"; "org.opencontainers.image.vendor" = "Lix project"; "org.opencontainers.image.version" = pkgs.nix.version; - "org.opencontainers.image.description" = "Minimal Lix container image, with some batteries included."; + "org.opencontainers.image.description" = + "Minimal Lix container image, with some batteries included."; } // lib.optionalAttrs (lixRevision != null) { "org.opencontainers.image.revision" = lixRevision; }; }; diff --git a/flake.lock b/flake.lock index 2368467f5..2e6701d2b 100644 --- a/flake.lock +++ b/flake.lock @@ -16,6 +16,22 @@ "type": "github" } }, + "lowdown-src": { + "flake": false, + "locked": { + "lastModified": 1633514407, + "narHash": "sha256-Dw32tiMjdK9t3ETl5fzGrutQTzh2rufgZV4A/BbxuD4=", + "owner": "kristapsdz", + "repo": "lowdown", + "rev": "d2c2b44ff6c27b936ec27358a2653caaef8f73b8", + "type": "github" + }, + "original": { + "owner": "kristapsdz", + "repo": "lowdown", + "type": "github" + } + }, "nix2container": { "flake": false, "locked": { @@ -32,18 +48,44 @@ "type": "github" } }, - "nixpkgs": { + "nix_2_18": { + "inputs": { + "flake-compat": [ + "flake-compat" + ], + "lowdown-src": "lowdown-src", + "nixpkgs": "nixpkgs", + "nixpkgs-regression": [ + "nixpkgs-regression" + ] + }, "locked": { - "lastModified": 1733348545, - "narHash": "sha256-b4JrUmqT0vFNx42aEN9LTWOHomkTKL/ayLopflVf81U=", + "lastModified": 1730375271, + "narHash": "sha256-RrOFlDGmRXcVRV2p2HqHGqvzGNyWoD0Dado/BNlJ1SI=", "owner": "NixOS", - "repo": "nixpkgs", - "rev": "9ecb50d2fae8680be74c08bb0a995c5383747f89", + "repo": "nix", + "rev": "0f665ff6779454f2117dcc32e44380cda7f45523", "type": "github" }, "original": { "owner": "NixOS", - "ref": "nixos-24.11-small", + "ref": "2.18.9", + "repo": "nix", + "type": "github" + } + }, + "nixpkgs": { + "locked": { + "lastModified": 1705033721, + "narHash": "sha256-K5eJHmL1/kev6WuqyqqbS1cdNnSidIZ3jeqJ7GbrYnQ=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "a1982c92d8980a0114372973cbdfe0a307f1bdea", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-23.05-small", "repo": "nixpkgs", "type": "github" } @@ -64,6 +106,22 @@ "type": "github" } }, + "nixpkgs_2": { + "locked": { + "lastModified": 1749522908, + "narHash": "sha256-eWANkhWXFL1MmaxzsZ9bhLCNT8OVs7CC+OXaSDGlA8A=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "e5cb99555c45a13dcc5f1317462238530b0066b7", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-25.05-small", + "repo": "nixpkgs", + "type": "github" + } + }, "pre-commit-hooks": { "flake": false, "locked": { @@ -84,7 +142,8 @@ "inputs": { "flake-compat": "flake-compat", "nix2container": "nix2container", - "nixpkgs": "nixpkgs", + "nix_2_18": "nix_2_18", + "nixpkgs": "nixpkgs_2", "nixpkgs-regression": "nixpkgs-regression", "pre-commit-hooks": "pre-commit-hooks" } diff --git a/flake.nix b/flake.nix index 6fb909fa7..1366a697f 100644 --- a/flake.nix +++ b/flake.nix @@ -2,8 +2,19 @@ description = "Lix: A modern, delicious implementation of the Nix package manager"; inputs = { - nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11-small"; + nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05-small"; nixpkgs-regression.url = "github:NixOS/nixpkgs/215d4d0fd80ca5163643b03a33fde804a29cc1e2"; + + # Required because Nix 2.18 is not in Nixpkgs ≥ 25.05 anymore. + nix_2_18 = { + url = "github:NixOS/nix/2.18.9"; + # NOTE(Raito): this is not possible because patches on libseccomp does not apply anymore on this Nix. + # Let's keep the latest known nixpkgs useable with Nix 2.18 for our tests. + # inputs.nixpkgs.follows = "nixpkgs"; + inputs.nixpkgs-regression.follows = "nixpkgs-regression"; + inputs.flake-compat.follows = "flake-compat"; + }; + pre-commit-hooks = { url = "github:cachix/git-hooks.nix"; flake = false; @@ -25,6 +36,7 @@ nixpkgs-regression, pre-commit-hooks, nix2container, + nix_2_18, flake-compat, }: @@ -163,6 +175,11 @@ { nixStable = prev.nix; + # Nix 2.18 has been removed from Nixpkgs ≥ 25.05, so we need to reintroduce it ourselves for our tests. + nixVersions = prev.nixVersions // { + nix_2_18 = nix_2_18.outputs.packages.${currentStdenv.hostPlatform.system}.default; + }; + # Forward from the previous stage as we don’t want it to pick the lowdown override nixUnstable = prev.nixUnstable; @@ -383,10 +400,12 @@ name = "nixpkgs-lib-tests"; paths = [ testWithNix ] - # NOTE: nixpkgs 24.11 is being ... *creative*, and requires this dance to override + # NOTE: nixpkgs 25.05 is being ... *creative*, and requires this dance to override # the evaluator used for the test. it will break again in the future, don't worry. ++ lib.optionals pkgs.stdenv.isLinux [ - (pkgs.callPackage "${nixpkgs}/ci/eval" { nixVersions.nix_2_24 = nix; }).attrpathsSuperset + ((pkgs.callPackage "${nixpkgs}/ci/eval" { nixVersions.latest = nix; }).attrpathsSuperset { + evalSystem = system; + }) ]; } ); diff --git a/lix/libexpr/nixexpr.hh b/lix/libexpr/nixexpr.hh index 0adea91bb..d5637271c 100644 --- a/lix/libexpr/nixexpr.hh +++ b/lix/libexpr/nixexpr.hh @@ -312,7 +312,7 @@ struct ExprAttrs AttrDef() { }; template - const T & chooseByKind(const T & plain, const T & inherited, const T & inheritedFrom) const + T chooseByKind(const T & plain, const T & inherited, const T & inheritedFrom) const { switch (kind) { case Kind::Plain: diff --git a/lix/libexpr/parser/grammar.hh b/lix/libexpr/parser/grammar.hh index 75fa73f6e..21607c15b 100644 --- a/lix/libexpr/parser/grammar.hh +++ b/lix/libexpr/parser/grammar.hh @@ -686,10 +686,12 @@ struct nothing : p::nothing { static_assert(!std::is_base_of_v); }; - - template -struct operator_semantics { +struct operator_semantics +{ +private: + operator_semantics() = default; + friend Self; public: struct has_attr : grammar::v1::op::has_attr { AttrPathT path; @@ -775,5 +777,4 @@ public: return popExpr(); } }; - } diff --git a/lix/libstore/crypto.cc b/lix/libstore/crypto.cc index 650e05e06..accec4db0 100644 --- a/lix/libstore/crypto.cc +++ b/lix/libstore/crypto.cc @@ -45,8 +45,15 @@ std::string SecretKey::signDetached(std::string_view data) const { unsigned char sig[crypto_sign_BYTES]; unsigned long long sigLen; - crypto_sign_detached(sig, &sigLen, charptr_cast(data.data()), data.size(), - charptr_cast(key.data())); + crypto_sign_detached( + sig, + &sigLen, + // the following is not a string function so no null termination issues are possible here. + // NOLINTNEXTLINE(bugprone-suspicious-stringview-data-usage) + charptr_cast(data.data()), + data.size(), + charptr_cast(key.data()) + ); return name + ":" + base64Encode(std::string(reinterpret_cast(sig), sigLen)); } diff --git a/lix/libstore/sqlite.cc b/lix/libstore/sqlite.cc index 854420331..f90757d1f 100644 --- a/lix/libstore/sqlite.cc +++ b/lix/libstore/sqlite.cc @@ -179,8 +179,13 @@ SQLiteStmt::Use::~Use() SQLiteStmt::Use & SQLiteStmt::Use::operator () (std::string_view value, bool notNull) { if (notNull) { - if (sqlite3_bind_text(stmt.stmt.get(), curArg++, value.data(), -1, SQLITE_TRANSIENT) != SQLITE_OK) + if (sqlite3_bind_text( + stmt.stmt.get(), curArg++, value.data(), value.length(), SQLITE_TRANSIENT + ) + != SQLITE_OK) + { SQLiteError::throw_(stmt.db, "binding argument"); + } } else bind(); return *this; diff --git a/lix/libutil/archive.cc b/lix/libutil/archive.cc index bc81109c2..80e0c9781 100644 --- a/lix/libutil/archive.cc +++ b/lix/libutil/archive.cc @@ -632,7 +632,7 @@ struct AsyncCopier : AsyncInputStream co_yield Fragment{want->n, false}; } else if (auto f = std::get_if(&*i)) { co_yield Fragment{f->size, true}; - } else if (auto sl = std::get_if(&*i)) { + } else if (auto _ = std::get_if(&*i)) { // nothing to do } else if (auto dir = std::get_if(&*i)) { while (auto e = dir->content.next()) { diff --git a/lix/libutil/compression.cc b/lix/libutil/compression.cc index cf211bc48..a6bc8c0f9 100644 --- a/lix/libutil/compression.cc +++ b/lix/libutil/compression.cc @@ -259,6 +259,7 @@ struct BrotliCompressionSink : ChunkedCompressionSink void writeInternal(std::string_view data) override { + // NOLINTNEXTLINE(bugprone-suspicious-stringview-data-usage) auto next_in = charptr_cast(data.data()); size_t avail_in = data.size(); uint8_t * next_out = outbuf; diff --git a/lix/libutil/json-utils.cc b/lix/libutil/json-utils.cc index caa11a41e..84f2146bf 100644 --- a/lix/libutil/json-utils.cc +++ b/lix/libutil/json-utils.cc @@ -38,6 +38,6 @@ const JSON & ensureType( JSON(expectedType).type_name(), value.type_name()); - return value; + return value; // NOLINT(bugprone-return-const-ref-from-parameter) } } diff --git a/lix/libutil/logging.hh b/lix/libutil/logging.hh index c97acb399..787ac357d 100644 --- a/lix/libutil/logging.hh +++ b/lix/libutil/logging.hh @@ -282,12 +282,12 @@ extern Verbosity verbosity; * level. Note that this has to be implemented as a macro to ensure that the * arguments are evaluated lazily. */ -#define printMsgUsing(loggerParam, level, args...) \ - do { \ - auto __lvl = level; \ - if (__lvl <= nix::verbosity) { \ - loggerParam->log(__lvl, fmt(args)); \ - } \ +#define printMsgUsing(loggerParam, level, args...) \ + do { \ + auto _lix_logger_print_lvl = level; \ + if (_lix_logger_print_lvl <= nix::verbosity) { \ + loggerParam->log(_lix_logger_print_lvl, fmt(args)); \ + } \ } while (0) #define printMsg(level, args...) printMsgUsing(logger, level, args) diff --git a/lix/libutil/references.cc b/lix/libutil/references.cc index 952b14195..61122d370 100644 --- a/lix/libutil/references.cc +++ b/lix/libutil/references.cc @@ -53,7 +53,7 @@ void RefScanSink::operator () (std::string_view data) previous fragment and the start of the current fragment. */ auto s = tail; auto tailLen = std::min(data.size(), refLength); - s.append(data.data(), tailLen); + s.append(data.data(), tailLen); // NOLINT(bugprone-suspicious-stringview-data-usage) search(s, hashes, seen); search(data, hashes, seen); diff --git a/lix/libutil/types.hh b/lix/libutil/types.hh index dcc3705cc..38ddc6413 100644 --- a/lix/libutil/types.hh +++ b/lix/libutil/types.hh @@ -68,13 +68,19 @@ typename T::mapped_type * get(T & map, const typename T::key_type & key) /** * Get a value for the specified key from an associate container, or a default value if the key isn't present. */ -template -const typename T::mapped_type & getOr(T & map, +template +const typename T::mapped_type & getOr( + T & map [[clang::lifetimebound]], const typename T::key_type & key, - const typename T::mapped_type & defaultValue) + const typename T::mapped_type & defaultValue [[clang::lifetimebound]] +) { auto i = map.find(key); - if (i == map.end()) return defaultValue; + if (i == map.end()) { + /* FIXME(Raito): `[[clang::lifetimebound]]` has no effect on `defaultValue` warning. */ + // NOLINTNEXTLINE(bugprone-return-const-ref-from-parameter) + return defaultValue; + } return i->second; } diff --git a/releng/local/default.nix b/releng/local/default.nix index 64c617a57..aa5ae0341 100644 --- a/releng/local/default.nix +++ b/releng/local/default.nix @@ -65,6 +65,12 @@ in environment.sessionVariables = { GARAGE_ADMIN_TOKEN = "UkLeGWEvHnXBqnueR3ISEMWpOnm40jH2tM2HnnL/0F4="; }; + + # ≥ v6.12 kernel has a system wide corruption related to 9p. wait until + # https://lore.kernel.org/all/w5ap2zcsatkx4dmakrkjmaexwh3mnmgc5vhavb2miaj6grrzat@7kzr5vlsrmh5/ + # resolves. once this is resolved and the fix lands in a stable kernel + # in nixpkgs, this pin can be removed. + boot.kernelPackages = pkgs.linuxPackages_6_6; }; }; testScript = '' diff --git a/tests/functional2/testlib/fixtures/nix.py b/tests/functional2/testlib/fixtures/nix.py index a4e12f939..8e8ee3859 100644 --- a/tests/functional2/testlib/fixtures/nix.py +++ b/tests/functional2/testlib/fixtures/nix.py @@ -107,9 +107,9 @@ class NixSettings: field_may("experimental-features", self.experimental_features) field_may("store", self.store) - assert ( - self.store or self.nix_store_dir - ), "Failing to set either nix_store_dir or store will cause accidental use of the system store." + assert self.store or self.nix_store_dir, ( + "Failing to set either nix_store_dir or store will cause accidental use of the system store." + ) return config def to_env_overlay(self) -> dict[str, str]: @@ -215,13 +215,14 @@ class Nix: def nix(self, cmd: list[str], nix_exe: str = "nix", flake: bool = False) -> NixCommand: return self.nix_cmd([nix_exe, *cmd], flake=flake) - nix_build = partialmethod(nix, nix_exe="nix-build") - nix_shell = partialmethod(nix, nix_exe="nix-shell") - nix_store = partialmethod(nix, nix_exe="nix-store") - nix_env = partialmethod(nix, nix_exe="nix-env") - nix_instantiate = partialmethod(nix, nix_exe="nix-instantiate") - nix_channel = partialmethod(nix, nix_exe="nix-channel") - nix_prefetch_url = partialmethod(nix, nix_exe="nix-prefetch-url") + # Mark each of these as correct as they are not ClassVars, but we also don't want to turn off RUF045 + nix_build = partialmethod(nix, nix_exe="nix-build") # noqa: RUF045 + nix_shell = partialmethod(nix, nix_exe="nix-shell") # noqa: RUF045 + nix_store = partialmethod(nix, nix_exe="nix-store") # noqa: RUF045 + nix_env = partialmethod(nix, nix_exe="nix-env") # noqa: RUF045 + nix_instantiate = partialmethod(nix, nix_exe="nix-instantiate") # noqa: RUF045 + nix_channel = partialmethod(nix, nix_exe="nix-channel") # noqa: RUF045 + nix_prefetch_url = partialmethod(nix, nix_exe="nix-prefetch-url") # noqa: RUF045 def eval(self, expr: str, settings: NixSettings | None = None) -> CommandResult: if settings is None: diff --git a/tests/nixos/fetchurl.nix b/tests/nixos/fetchurl.nix index 8b6713b7f..719405be5 100644 --- a/tests/nixos/fetchurl.nix +++ b/tests/nixos/fetchurl.nix @@ -76,7 +76,7 @@ in # Fetching from a server with an untrusted cert should fail. err = machine.fail("nix build --no-substitute --expr 'import { url = \"https://bad/index.html\"; hash = \"sha256-rsBwZF/lPuOzdjBZN2E08FjMM3JHyXit0Xi2zN+wAZ8=\"; }' 2>&1") print(err) - assert "SSL peer certificate or SSH remote key was not OK" in err + assert "SSL certificate problem: self-signed certificate" in err # Fetching from a server with a trusted cert should work via environment variable override. machine.succeed("NIX_SSL_CERT_FILE=/tmp/cafile.pem nix build --no-substitute --expr 'import { url = \"https://bad/index.html\"; hash = \"sha256-rsBwZF/lPuOzdjBZN2E08FjMM3JHyXit0Xi2zN+wAZ8=\"; }'") diff --git a/tests/nixos/nix-copy-closure.nix b/tests/nixos/nix-copy-closure.nix index cd25fbbd0..d6d4ae4f3 100644 --- a/tests/nixos/nix-copy-closure.nix +++ b/tests/nixos/nix-copy-closure.nix @@ -45,12 +45,12 @@ in { server.wait_for_unit("network-online.target") client.wait_for_unit("network-online.target") - client.succeed("mkdir -m 700 /root/.ssh") + client.succeed("mkdir -m 700 /root/.ssh || [[ -d /root/.ssh ]]") client.copy_from_host("key", "/root/.ssh/id_ed25519") client.succeed("chmod 600 /root/.ssh/id_ed25519") # Install the SSH key on the server. - server.succeed("mkdir -m 700 /root/.ssh") + server.succeed("mkdir -m 700 /root/.ssh || [[ -d /root/.ssh ]]") server.copy_from_host("key.pub", "/root/.ssh/authorized_keys") server.wait_for_unit("sshd.service") client.succeed(f"ssh -o StrictHostKeyChecking=no {server.name} 'echo hello world' >&2")