Commit Graph
19040 Commits
Author SHA1 Message Date
Raito Bezariusandeldritch horrors 37ccd28c3b libexpr/primops: allow storePath in pure evaluation mode
`builtins.storePath` allows you to use "external" knowledge of present
store paths in your store to be used in your expressions.

This is sometimes used to avoid double wrapping store paths, for example
when dealing with nixpkgs sources (`builtins.storePath pkgs.path` is a
frequent pattern).

Unfortunately, using your external knowledge of present store paths is
technically impure because Flakes is about not depending on the *STATE*
of your store, no matter what you know about it or what you do to ensure
that your knowledge is accurate.

That being said, `builtins.storePath` is already possible in the
fragment of "pure Nixlang" via a clever use of `builtins.appendContext`.

Precisely:

```
  storePath = path:
  let path' = builtins.unsafeDiscardStringContext path;
  in
  # NOTE: merging the context set in all generality is impossible
because getContext on a pure path doesn't work.
    builtins.appendContext path' { ${path'} = { path = true; }; };
```

works in pure contexts.

Because of this, we deem that storePath should be allowed in pure
contexts and users do not have to come up with a `storePath` polyfill.

Fixes #402.

Change-Id: I5fff750a4feed082745431835db451f945249cfb
Signed-off-by: Raito Bezarius <raito@lix.systems>
2026-03-04 11:33:30 +00:00
Raito Bezarius e8015836e3 libcmd/profiles: keep derivations if keep-env-derivations = true
nix3 CLI never honored that setting.

When we update a nix3 profile element with new built store paths for
which we know the deriver (the derivation path which built it), we add
the derivation paths to the profile element to prevent garbage
collection the same way the nix2 CLI logic does.

Fixes #1095.

Change-Id: Icc236d174c5ce5ffe042d1c8e1968f6cb5b50359
Signed-off-by: Raito Bezarius <raito@lix.systems>
2026-03-03 22:13:02 +00:00
isabelandRaito Bezarius fc649250ec libexpr/flake-config: collect untrusted settings into one prompt
Instead of showing untrusted configuration items one by one, collect all
of them into one batched ask with 4 options:

- apply the configuration wholesale **for now** (yes)
- apply the configuration wholesale and trust it permanently (allow
  permanently)
- selectively choose subset (no)
- rejecting the configuration wholesale (no to all)

Note that we do not offer options to reject permanently a configuration,
that's what `--no-accept-flake-config` is for.

Individual prompts gain a new option to distinguish "yes for now" and
"yes forever".

Fixes #682.

Change-Id: I2492717ac277af33ea4ac9b1a11bd7d6d1bfe0db
2026-03-03 21:57:03 +00:00
Raito Bezarius b28723c5b9 libexpr/eval: do not confuse path and string with contexts in messages
In messages printed by the evaluator, we use showType(.) to say things
like "expected X, got Y" where X, Y can be string, string with context,
etc.

After changes in the Lix data model (pointer tagging and friends), paths
got squished inside a internal string type.

We missed updating `showType` to take this fact into account which
caused an unfortunate:

`error: expected a string but found a string with context:
/nix/store/wjf8rdpp63rhyasbzc7zfms1agf7pwyd-source`

while using a path on `builtins.getContext`

A test is added.

Change-Id: Ifb0129ead2ea1973fc17dc0133f8a694995536b1
Signed-off-by: Raito Bezarius <raito@lix.systems>
2026-03-03 21:36:13 +00:00
Raito Bezarius da37164630 libutil/strings: add partitionString
This partitions a string into two parts based on the first occurrence of
the separator.

This function handles the case when the separator never occur in the
target string by returning an optional<T> in the second argument of the
pair.

Change-Id: I9ad44375dbaa137a4d21d2408bc2ffa34fab62a7
Signed-off-by: Raito Bezarius <raito@lix.systems>
2026-03-03 20:54:08 +00:00
Raito Bezarius 135c28be53 libcmd: introduce enum traits for CLI parsing
Parsing and completing enumerations on the CLI was usually done by hand.

With this enum trait, the parsing and completion is automated away.

Change-Id: Icd49729564355d4c79e2c8050ce7e8b9d8e7eda3
Signed-off-by: Raito Bezarius <raito@lix.systems>
2026-03-03 20:54:08 +00:00
Raito Bezarius a2f1369d18 libmain: drop categories for dry-run and json args
36c4d6f592 introduced it commented. Zero
explanation why.

horrors suggested to drop it entirely because it hide the options in
categories but they are pretty common and we should make as much visible
as possible.

Change-Id: I09894b5ba0f2b2cce5869136914289fed034fce3
Signed-off-by: Raito Bezarius <raito@lix.systems>
2026-03-03 20:54:08 +00:00
Raito Bezarius b55260ce4a package/devshell: add pkgs.tree
Fixes #823.

Required for releng scripts.

Change-Id: I876784ffc868541924c2bb957aec58b704fd7dd2
Signed-off-by: Raito Bezarius <raito@lix.systems>
2026-03-03 20:22:34 +00:00
eldritch horrors 7a0a85b543 libstore: recursively delete cgroups
fixes #1143

Change-Id: I9f5cf5c127ac23e60e3232d85f338e467ed4f170
2026-03-03 15:49:52 +01:00
Raito Bezarius 092064db4c libstore/build: allow preferLocalBuild = true to bypass max-jobs = 0
When `max-jobs = 0`, our async semaphores have null capacity and
therefore no slot token can be acquired.

In addition, a derivation with `preferLocalBuild = true` with `max-jobs
= 0` which is not a built-in derivation is not considered suitable for
being possible to build.

Our documentation in `max-jobs` writes:

> `0` is useful when using remote builders to prevent any local builds
(except for preferLocalBuild derivation attribute which executes locally
regardless).

A valid interpretation is that `preferLocalBuild` derivations (all of
them) will always execute even if `max-jobs = 0`.

This CL achieves this promise by enabling `preferLocalBuild = true`
derivations to draw in priority capacity from a `preferLocalBuild`-only
pool and then fall back to the build pool (`maxBuildJobs`).

If there's non-zero max-jobs, we make the `preferLocalBuild`-only pool
empty.

If there's zero max-jobs, we make the `preferLocalBuild`-only pool
non-empty (capacity: 1).

Remark 1: if `max-jobs = 0`, no non-`preferLocalBuild = true`
derivations can be built without a remote builder and `preferLocalBuild
= true` derivations can be built one at a time if `extra-local-jobs` is
not overridden.

Remark 2: if `max-jobs != 0`, no `preferLocalBuild = true` derivations
can bypass capacity limits, i.e. `max-jobs` unless `extra-local-jobs` is
overridden.

Fixes #855.

Change-Id: I00a0acac7375a881aec6281ebb13a4530b26e460
Signed-off-by: Raito Bezarius <raito@lix.systems>
2026-03-02 23:46:38 +01:00
Raito Bezarius bd108b7e61 libutil/config: support optional<uint32_t>
This is going to be used in the extra-local-job future setting.

Change-Id: Ied76f32b8fa97cb71691d76167103001aa14fa01
Signed-off-by: Raito Bezarius <raito@lix.systems>
2026-03-02 20:20:06 +01:00
Raito Bezarius ac6c9a9c0a libfetchers/github: distinguish ref/rev provenance
When ref/rev are very similar looking, e.g. a revision SHA1, the logic
to reconstruct whether we had a ref or rev initially cannot work.

This regression was introduced by
I2c72d5a32e406a7ca308e271730bd0af01c5d18b which passed the information
as an attribute field called `refOrRev`, instead, we pass `ref` or `rev`
but not `refOrRev`.

We apply the same post-processing logic to distinguish rev/ref in
path-style flake references: `github:owner/repo/$refOrRev`.

Fixes #520 #841.

Change-Id: I2b1985cd5f351f43fea84232c1972715e2408fb1
Signed-off-by: Raito Bezarius <raito@lix.systems>
2026-03-02 13:14:42 +00:00
eldritch horrors 6ddc59de47 launch-builder: don't limit sandbox setup data size
the channel we're using is fully trusted, we don't need the traversal limit.

fixes #1121

Change-Id: I2833a7459cec1e2392e8740d8cab213685d3e2b3
2026-03-02 12:10:12 +00:00
skye 9a408cbeb7 libexpr: Replace Value::mkPrimOp with constructor calls
Change-Id: I19b05e260945e237f7856b5d644a43076a6a6964
2026-03-01 18:02:58 -05:00
Raito Bezarius 74300fd0a7 libexpr/primops: reject __json in structured attrs derivations
In structured attrs derivations, __json is used to serialize the `env`
attribute into a JSON object.

If the derivation enables structured attributes AND specify its own
`__json`, one of the field will take precedence (the reader can have fun
by guessing which one).

To reduce underspecification, we disallow `__json` in structured
attributes derivations.

Fixes #380.

Change-Id: I51c3b2af1ff9449471ba81d4c72df6a7a263eef7
Signed-off-by: Raito Bezarius <raito@lix.systems>
2026-03-01 19:05:54 +00:00
skye 12cee5cb22 libcmd/repl: Migrate evalString to return a Value
Change-Id: I41cd79b71106474d048d447befac16676a6a6964
2026-03-01 01:01:47 -05:00
skye 8623dade34 libexpr: Migrate callFlake to return a Value
Change-Id: Ibdac6eb1c9dfda894d783a7b6e333f486a6a6964
2026-03-01 01:01:47 -05:00
skye 2be998eeb4 libexpr: Migrate Evaluator::evalLazily to return a Value
Change-Id: I9f778407d454e141cb9b7959bbc02ed26a6a6964
2026-03-01 01:01:47 -05:00
skye c6b4f30be9 libexpr: Migrate EvalState::autoCallFunction to return a Value
Change-Id: I426c3d413b18848090dd05674a08e5fb6a6a6964
2026-03-01 01:01:47 -05:00
skye 27bf276304 legacy/nix-env: Migrate loadSourceExpr to return a Value
Change-Id: Ia1e1ac6fe9fd00d7a2fa4a39a3ce21e86a6a6964
2026-03-01 00:04:28 -05:00
eldritch horrors 30e9387cf9 testing: migrate path-from-hash-part.sh
Change-Id: Ied00671595d82c6d446f117d6aa9c42a0c758cb6
2026-02-28 22:09:44 +00:00
eldritch horrors 8d389fcccf testing: migrate selfref-gc.sh
Change-Id: Ibead4030448fb9251be78b3c876c7f054154c83c
2026-02-28 22:09:44 +00:00
eldritch horrors f4c92f8872 testing: migrate function-trace.sh
Change-Id: I44bd28165070f55f21b052bc02ba6f2ea5787a1d
2026-02-28 22:09:44 +00:00
eldritch horrors fae0242f69 testing: migrate ssh-relay.sh
Change-Id: I520c8be1c30b4ee7660c8ceeba62a6d0757c337b
2026-02-28 22:09:44 +00:00
eldritch horrors e8cb30b11c testing: fix f2 NIX_BIN_DIR determination from meson
`nix.full_path()` is the *built* path, not the *installed* path. in the
sandbox this point to a location that contains *only* `nix`, not any of
the old-cli symlinks. any test that needs them in path would thus fail.

Change-Id: Ia651db8d1151a84f8d1b52e8993f6db61b0fe104
2026-02-28 22:09:44 +00:00
skye f856d4fd25 libexpr: Migrate EvalState::evalFile to return a Value
Change-Id: I19ce8623477dd96628476b3e3dd58cfd6a6a6964
2026-02-28 15:53:10 -05:00
skye debf5554e0 libexpr: Consolidate implementation between Value string constructors
Change-Id: I5bf8d58b534cd652d89f7b93019378b66a6a6964
2026-02-28 15:53:10 -05:00
skye be3a40e5dc libexpr: Replace Value::mkString with constructor calls
Change-Id: I55bba546eb090728a71734450a2a5f496a6a6964
2026-02-28 15:53:10 -05:00
Tom Hubrecht d52033fc77 nix/develop: Don't ignore SSL_CERT_FILE when its value is meaningful
Change-Id: I31e85a5995edc40ed2e687077ffdf563e717abb4
2026-02-28 12:32:45 +00:00
benaryorg 052d04512e libfetchers: Provide gitDir for rev-list operation
Without the `--git-dir` git will attempt to figure out which the git directory is on its own.
This causes issues when the `GIT_DIR` envvar is set in the environment for other reasons (such as being part of a `git rebase`).
Providing this parameter overrides the environment and thus makes sure the revs are always coming from the intended repository.

Fixes: #1135
Change-Id: Ibd43cfd8e0278463c0e1ccf86779982947a6038a
Signed-off-by: benaryorg <binary@benary.org>
2026-02-28 09:06:18 +00:00
eldritch horrors dda934965d testing: migrate build-jobless.sh
Change-Id: Ica9a0c5b8bea50d302ad633d3801431adcdba5e7
2026-02-27 17:43:07 +00:00
eldritch horrors 378c86eadf testing: migrate compute-levels.sh
this test wasn't even run

Change-Id: I735c8b2d2c63a65c665d6344a98ddb3bbbf94f43
2026-02-27 17:42:17 +00:00
eldritch horrors 298373615e testing: migrate impure-eval.sh
Change-Id: Ifd2b6c117511461ce08fa3f9e63635857cb5b015
2026-02-27 17:42:17 +00:00
eldritch horrors 14d8209198 testing: migrate output-normalization.sh
Change-Id: I51a021b27fa27b531bb49b8529bae2e9bf74641a
2026-02-27 17:42:17 +00:00
eldritch horrors b2ae7c3965 testing: migrate pass-as-file.sh
Change-Id: I9c3a940ede9353e977e60e0650eaa5a64cc6fa5e
2026-02-27 17:42:17 +00:00
eldritch horrors 32a96169d6 testing: migrate optimise-store.sh
Change-Id: I900183e11ba1405c9aa72028a8902ad8cf023e69
2026-02-27 17:42:17 +00:00
eldritch horrors 5fb0dd156d testing: migrate build.sh
Change-Id: I9d2da21cc226e0c1ef2dfa4d475c1989bbbfaf79
2026-02-27 17:42:17 +00:00
eldritch horrors 5f2c771b5a testing: migrate placeholders.sh
Change-Id: Iad6a6f53dac23cc5e49961571dd4c0545d616d7e
2026-02-27 17:42:17 +00:00
eldritch horrors b8b69dde05 testing: migrate local-store.sh
Change-Id: I5172fc2611a56b19f55d5c05dacdfef5cf330739
2026-02-27 17:42:17 +00:00
eldritch horrors 26f1397b75 testing: migrate suggestions.sh
Change-Id: Iad28262035aa96c5ef6fa33e2a830b5fa8a9ae50
2026-02-27 17:42:17 +00:00
eldritch horrors 8cf21fcf75 testing: migrate case-hack.sh
Change-Id: I552dd596764a779e1485a6326363d4f4283110f3
2026-02-27 17:42:17 +00:00
eldritch horrors 4caa622d78 testing: migrate fetchMercurial.sh
Change-Id: Iab81ea161e3be69bf7753b3ed9cd8f59cd8fe0ed
2026-02-27 17:42:17 +00:00
Qyriad f13566a3f6 repl: fix 'tokens-no-whitespace' in :use's Nix expression
Change-Id: Ifa2bc6b1204cc5a85422128c76b192296a6a6964
2026-02-27 08:51:40 +00:00
eldritch horrors 0bcdfe2c43 testing: migrate fmt.sh
Change-Id: Icc593b57a06c7fdf75762094982788f6351dcadc
2026-02-26 19:43:39 +00:00
Raito Bezarius bcab3d5da3 libstore/build: set impure environment variables only if they are set
To stop spurious warnings, we will stop this bizarre behavior of setting
empty values to impure environment variables.

On the warning side, we verify that the presence of the environment
variable.

The corresponding test is updated to "there is a warning" to "there is
no warning".

Change-Id: I12f5c6445ef00a83d269488d7aed0b0f61aeec12
2026-02-26 15:33:22 +00:00
Raito Bezarius 72a6d5ff48 tests/functional2: test spurious warnings for certificates
All impure environment variables are initialized as part of `initEnv()`
to an empty value if they are unset.

Whenever `NIX_SSL_CERT_FILE` is set, this cause a spurious warning.

Let's document it here as a test before we fix it.

Change-Id: Iccba8ccb487d9cc25490e940ff09c1c5a13ae097
Signed-off-by: Raito Bezarius <raito@lix.systems>
2026-02-26 15:33:22 +00:00
Raito Bezarius 0741e24266 tests/functional2: migrate (un|)sandboxed CA tests
CA tests have grown quite complicated and are hard to debug and
manoeuver for new needs.

They are a prime target for F2 migration and they were extremely
pleasant to write.

Most functionality is preserved or improved with additional behaviors
asserted on warnings and the full set of reports.

Change-Id: I70cd52abbe5ff13f56744b966ab00962ad3a49d6
Signed-off-by: Raito Bezarius <raito@lix.systems>
2026-02-26 15:33:22 +00:00
eldritch horrors dde7bddbd4 f2: fix Nix::add_[dx]p_feature type hints
Change-Id: I743b3ac821315465d1d22700ca9b06d8cc1985f0
2026-02-26 14:16:13 +00:00
eldritch horrors f2df62439c testing: migrate flakes/flakes.sh (part 18)
nonflake inputs

Change-Id: I5017ece5028652e3ae19c5e00e67358fc9c0253d
2026-02-26 13:11:25 +00:00
eldritch horrors 30ce32e2f6 testing: migrate flakes/flakes.sh (part 17)
symlinks in flake dirs, recursive lookups, update with override

Change-Id: I1491ca8e618ff5e06a06d3cc3648ae0750a1ffde
2026-02-26 13:11:25 +00:00