only a single caller uses flat fetching at all. it still makes sense to
not inline that single caller for now, mostly due to activity reporting
Change-Id: I1a6420868443c3a684deafc7a4f567d4d4b1bd53
the two variants compute their store path hashes very differently, and
the flat version ignores the filter passed in by the user entirely. in
a future change we want to move filters out of store methods entirely,
splitting them now will make that task a lot easier when we are ready.
Change-Id: I5f23a26ca08e81923f33adf687056d0d464c2cb8
it's only used once at all, only with SHA256, and the hash it returned
was always ignored. probably a relic of a bygone age, but today is not
the time to clean this up. not before addToStore is rewritten, anyway.
Change-Id: I20e0b5a9bc85ccd05db79bf44f3e972fbd174902
Starting with commit 0dbfa7b26e access would also
be allowed to ancestors of allowed paths. This is (ironically) a significant
purity regression, since several users of the purity checks will themselves
assume that arbitrary descent is allowed. For example, `builtins.readDir` and
`builtins.path` could now refer to the filesystem root, breaking purity
entirely in the latter case by allowing to read arbitrary files. Restore the
previous behaviour of only allowing access to explicitly allowed paths.
Change-Id: Ie64180733ab735da9873255e1ccbf95ba7c9161c
`writeLogsToStderr` uses a static mutex in order to prevent log output
from being interleaved. On macOS, it was possible for a logger in a
non-main thread to call this function after the static mutex was
destructed, leading to strange errors. Deliberately leaking the mutex
prevents the destructor from being called, fixing the issue.
Closes#702
Co-Authored-By: Jade Lovelace <jadel@mercury.com>
Co-Authored-By: eldritch horrors <pennae@lix.systems>
Change-Id: I14c80134cc493972752fad56b7f15fad8e4d5a5b
Hydra used to support aggregate jobs that only succeeded when their
constituents succeed. This is still used by e.g. nixpkgs[1].
Prior art:
* https://git.lix.systems/lix-project/nix-eval-jobs/pulls/17: got ported
into the CppNix implementation[2]
* https://github.com/nix-community/nix-eval-jobs/pull/349: implements
glob expressions for constituents - something we needed at work. This
also restructures the code a bit which is what I re-used here. The
globbing is not part of this patch.
Essentially, the following things happen here (assuming `--constituents`
is set):
* Derivations with `_hydraAggregate = true;` are considered aggregates.
These are not written to stdout when received by a worker, but stored
until the end.
* Constituents can be drv paths or strings (that must be the `attr` of
another job). In that case, the derivation of the aggregate job is
rewritten so that it depends on the drv of the constituent job.
* At the very end the aggregate jobs are also written to stdout.
Additionally, this fixes one bug, the old `hydra-eval-jobs`
implementation had (and we actually hit at work):
Given the leaf jobs `packages.foo` & `packages.bar`, an aggregate job
`aggregate0` with
_hydraAggregate = true;
constituents = [ "packages.bar" "packages.foo" ];
and an aggregate job `aggregate1` with
constituents = [ "aggregate0" ];
then it may happen depending on the order of evaluation that `aggregate1`
depends on the old derivation of `aggregate0` (i.e. the one without
rewritten constituents) and doesn't depend on `packages.foo` and
`packages.bar` because it was rewritten before `aggregate0` was
rewritten.
This is done in here correctly, but topologically sorting the aggregate
jobs before rewriting those.
[1] https://github.com/NixOS/nixpkgs/blob/bba6b37c9d0898867a7d9c38a1b5b77efcfb07b9/nixos/release-combined.nix#L69
[2] https://github.com/nix-community/nix-eval-jobs/pull/340
Change-Id: I5baad5e57336b4985ef8595e903814de83eb01c1
I've always been annoyed that it just silently succeeded without any
feedback, but now with the upcoming improvements on defining variables
this is more necessary than ever.
Change-Id: I565897fa2f97cf6f567d4449dcc8d4ad4eb73fce
- `pos` is not used anymore and can be removed
- `path` and `value` are more correctly placed in their own sub state,
to mirror `InheritState`
Change-Id: Ie7c8a3aea3fe4af0f9c5c15ab5897a59d1b3f7b0
I absolutely want to go back to allowing them, I am strongly of the
opinion that nothing should be special about NUL in a string, but this
will have to wait until at least the GC rewrite, so for now the least I
can do is to disarm this gun.
Change-Id: Id14b6037bc8b274c6c60ad970b1c74d436fb62a7
They are broken beyond repair, and barring a language version revision
this is our only option besides doing nothing about it.
Change-Id: I25fa4f032ca9b5ca67356946bcd889289583592e
macOS uses opendirectory for users and groups, which supports nested
groups and groups with synthesized membership. This means that asking
for a group's users isn't sufficient to test for group membership.
With this change, groups like `@localaccounts` or `@_developer` will
work in `trusted-users` and `allowed-users`.
Fixes https://github.com/NixOS/nix/issues/5885
Change-Id: I3b0783ce7cec303de5aba32c8e5ac0f976112c72
now we can feed the nar parser from something that isn't a Source, such
as a kj async stream. we will not be able to wrap the nar members quite
as nicely in that case since async generators are not a thing yet. once
we need that we can come up with some async generator mechanism though.
Change-Id: If9f5d7865c18e4293aa037b9acd29718e080b3e4
with copyNAR no longer using it it doesn't have to be public any more,
and since parseDump does not need to pass through its input data we'll
also turn restore() into a plain function instead of a wire generator.
Change-Id: Idd3a0270089ff47a7dc8ca96eb03b002fa5ea37e
this will let us reuse the dumping code to implement copyNAR using parse
and dump, making both parseAndCopyDump and the DiscardVisitor redundant.
Change-Id: I21e86d1c0c016a6e005f718cd695eee7ea885273
we now fully mirror the structure of the nar in the structure and
function arguments of nar parse visitors. this avoids allocations
and baseNameOf calls, and it's altogether cleaner than previously
Change-Id: I86ca14be0382c83206d45dbba0f043dade1c338c
this is where they should've been from the start, but during the first
rewrite it made little sense to move them. we have bigger plans today,
so we'll finally clean that up too. note the `Map` transform type that
is needed to make the current macros work. it shall be only temporary.
Change-Id: I928d197dbfe27b68cf8634d149c3259e86fbf123
this is an unfortunate but necessary intermediate state in which we can
mirror nar structure from the visitor side, but not yet from the parser
side. to move from paths to entry names we must first relocate names of
entries out of the entries themselves, and into their parent directory.
Change-Id: I2ea898230952a4f631eea67c66ac8dcbdfb19636
Interrupted is thrown once *per thread* (or more!). don't rethrow a copy
from another thread while we are already handling FramedSink exceptions.
fixes#706
Change-Id: I21b2c9afd10f09919f4dbaf3c6cfbf7fa0156fa1
* changes:
libstore: extract source implementation from NarIndexer
libstore: don't use parseDump to discard nars
libutil: add some c++ nar parser tests
this is conflating concerns (position tracking in the input stream and
actually unpacking its contents) in an unhelpful way and is preventing
us removing full-path access requirements from the visitor concept. we
want to move from reconstructing and then deconstructing paths to only
passing individual entry names to nar parsers, who can then build full
paths from the nar root only if the need those to function. not all of
our implementations need this; only one of the three does, one ignores
the paths entirely, and the third even takes the reconstruction apart.
Change-Id: If249f13c5b9ae5b9e4e4a3777875ef8364ee6229
this is a step towards using nar parser visitors only where we need nar
parser visitors. the performance impact of this should be insignificant
and perhaps slightly positive since we no longer allocate anything when
discarding a file member. mostly it is a step towards a NARParseVisitor
that has no default behavior; we have only three implementations total,
and most of them don ot even *use* most of the default implementations.
Change-Id: I3466d2a77500778eb152f56ebd441cf1be223dc6
This is necessary to cleanly and unambiguously transition to using
forgejo issues, since we now control our own destiny.
If we ban unprefixed numbers for a couple of releases, we ensure there
are no releases in active support with the wrong unprefixed number
semantics that could receive backports.
Change-Id: I1c94541dcb3f071399f439870b48cd76557b70d2
* Point `meta.homepage` to the correct location
* Remove `meta.maintainers` field: the folks listed in there maintain
the upstream package. I decided to remove it since we don't use
`meta.maintainers` in this repository to indicate maintainership of a
component.
Change-Id: Iec7b0eb463bc8f41907909e87ec9280c19dc86f5
Backport of https://github.com/NixOS/nix/pull/12275
nix-env can read priorities from a derivations meta attributes, but this
only works when installing a nix expression.
nix-env can also install bare store paths, however meta attributes are
not readable in that case. This means that a store path can not be
installed with a specific priority.
Some cases where it is advantageous to install a store path: a remote
host following a `nix copy`, or any time you want to save some
evaluation time and happen to already know the store path.
This PR addresses this shortcoming by adding a --priority flag to
nix-env --install.
Change-Id: Ibd9365d0058820a9c2aeecc909b81a0410d5764b
Under chroot or diverted store setups, the filtering logic of
`builtins.filterSource` and `builtins.path` (which shares the same filtering
logic as `filterSource`) would incorrectly pass physical paths to the
filter function instead of logical store paths.
This caused actual breakage in nixpkgs when the `lib.fileset` library was
introduced. Due to this unresolved bug in Nix, the library was forbidden
from use: <https://github.com/NixOS/nixpkgs/pull/369694>.
To the best of our knowledge, this bug has existed since CppNix 2.3.
The existing tests were strengthened to cover these cases, but
additional testing may be required, particularly regarding symlink
handling.
References: https://github.com/NixOS/nix/pull/12512 (CppNix fix to the
problem using "union" abstractions).
Co-authored-by: Raito Bezarius <raito@lix.systems>
Co-authored-by: Alois Wohlschlager <alois1@gmx-topmail.de>
Co-authored-by: eldritch horrors <pennae@lix.systems>
Signed-off-by: Raito Bezarius <raito@lix.systems>
Change-Id: Iaf6ca8c506eeca145393ce100c64db12178daa62
deletePath checks for interruption, and when interrupted simply exits
without doing anything of note. this may be useful in some instances,
but in the case of a user interrupting a build running on a daemon it
leaves temporary directories sitting around until they are deleted by
the user or by some automated mechanism. we simply shouldn't do this.
note the this means that large build directories now cause the daemon
(and single-user processes) to not be interruptible during cleanup of
cancelled builds. we plan to address this by getting rid of this very
haphazard mechanism once asyncification is completed (hopefully soon)
fixes#678 (again)
Change-Id: Ifff3769620bc9ef7684bc84354aed6c7f932bd87
eldritch horrors