Enable nixpkgsLibTests again

The required nixpkgs bumps have now been performed. Change-Id: I6a6a6964316f8434c355405c52b0a7b7f70b4332
flake: update nixpkgs input
2025-09-08 20:26:44 +02:00 · 2025-09-08 20:26:44 +02:00 · 2025-09-08 20:26:44 +02:00 · 2025-09-08 19:18:09 +02:00 · 2025-09-08 19:18:09 +02:00 · 2025-09-08 19:17:29 +02:00
48 changed files with 372 additions and 222 deletions
@@ -16,6 +16,8 @@ Checks:
  - -bugprone-unchecked-optional-access
    # many warnings, seems like a questionable lint
  - -bugprone-branch-clone
+    # extremely noisy before clang 19: https://github.com/llvm/llvm-project/issues/93959
+  - -bugprone-multi-level-implicit-pointer-conversion
    # all thrown exceptions must derive from std::exception
  - hicpp-exception-baseclass
    # capturing async lambdas are dangerous
@@ -33,3 +35,4 @@ Checks:

 CheckOptions:
  bugprone-reserved-identifier.AllowedIdentifiers: '__asan_default_options'
+  bugprone-unused-return-value.AllowCastToVoid: true
@@ -62,38 +62,37 @@ let
    ++ autoLayered
    ++ extraPkgs;

-  users =
-    {
+  users = {

-      root = {
-        uid = 0;
-        shell = "${pkgs.bashInteractive}/bin/bash";
-        home = "/root";
-        gid = 0;
-        groups = [ "root" ];
-        description = "System administrator";
-      };
+    root = {
+      uid = 0;
+      shell = "${pkgs.bashInteractive}/bin/bash";
+      home = "/root";
+      gid = 0;
+      groups = [ "root" ];
+      description = "System administrator";
+    };

-      nobody = {
-        uid = 65534;
-        shell = "${pkgs.shadow}/bin/nologin";
-        home = "/var/empty";
-        gid = 65534;
-        groups = [ "nobody" ];
-        description = "Unprivileged account (don't use!)";
+    nobody = {
+      uid = 65534;
+      shell = "${pkgs.shadow}/bin/nologin";
+      home = "/var/empty";
+      gid = 65534;
+      groups = [ "nobody" ];
+      description = "Unprivileged account (don't use!)";
+    };
+  }
+  // lib.listToAttrs (
+    map (n: {
+      name = "nixbld${toString n}";
+      value = {
+        uid = 30000 + n;
+        gid = 30000;
+        groups = [ "nixbld" ];
+        description = "Nix build user ${toString n}";
      };
-    }
-    // lib.listToAttrs (
-      map (n: {
-        name = "nixbld${toString n}";
-        value = {
-          uid = 30000 + n;
-          gid = 30000;
-          groups = [ "nixbld" ];
-          description = "Nix build user ${toString n}";
-        };
-      }) (lib.lists.range 1 32)
-    );
+    }) (lib.lists.range 1 32)
+  );

  groups = {
    root.gid = 0;
@@ -193,13 +192,11 @@ let
            in
            ''
              {
-                ${
-                  lib.concatStringsSep "\n" (
-                    builtins.map (output: ''
-                      ${output} = { outPath = "${lib.getOutput output drv}"; };
-                    '') outputs
-                  )
-                }
+                ${lib.concatStringsSep "\n" (
+                  builtins.map (output: ''
+                    ${output} = { outPath = "${lib.getOutput output drv}"; };
+                  '') outputs
+                )}
                outputs = [ ${lib.concatStringsSep " " (builtins.map (x: "\"${x}\"") outputs)} ];
                name = "${drv.name}";
                outPath = "${drv}";
@@ -361,8 +358,10 @@ let
        "org.opencontainers.image.source" = "https://git.lix.systems/lix-project/lix";
        "org.opencontainers.image.vendor" = "Lix project";
        "org.opencontainers.image.version" = pkgs.nix.version;
-        "org.opencontainers.image.description" = "Minimal Lix container image, with some batteries included.";
-      } // lib.optionalAttrs (lixRevision != null) { "org.opencontainers.image.revision" = lixRevision; };
+        "org.opencontainers.image.description" =
+          "Minimal Lix container image, with some batteries included.";
+      }
+      // lib.optionalAttrs (lixRevision != null) { "org.opencontainers.image.revision" = lixRevision; };
    };

    meta = {
@@ -16,6 +16,22 @@
        "type": "github"
      }
    },
+    "lowdown-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1633514407,
+        "narHash": "sha256-Dw32tiMjdK9t3ETl5fzGrutQTzh2rufgZV4A/BbxuD4=",
+        "owner": "kristapsdz",
+        "repo": "lowdown",
+        "rev": "d2c2b44ff6c27b936ec27358a2653caaef8f73b8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "kristapsdz",
+        "repo": "lowdown",
+        "type": "github"
+      }
+    },
    "nix2container": {
      "flake": false,
      "locked": {
@@ -32,18 +48,44 @@
        "type": "github"
      }
    },
-    "nixpkgs": {
+    "nix_2_18": {
+      "inputs": {
+        "flake-compat": [
+          "flake-compat"
+        ],
+        "lowdown-src": "lowdown-src",
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-regression": [
+          "nixpkgs-regression"
+        ]
+      },
      "locked": {
-        "lastModified": 1735651292,
-        "narHash": "sha256-YLbzcBtYo1/FEzFsB3AnM16qFc6fWPMIoOuSoDwvg9g=",
+        "lastModified": 1730375271,
+        "narHash": "sha256-RrOFlDGmRXcVRV2p2HqHGqvzGNyWoD0Dado/BNlJ1SI=",
        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "0da3c44a9460a26d2025ec3ed2ec60a895eb1114",
+        "repo": "nix",
+        "rev": "0f665ff6779454f2117dcc32e44380cda7f45523",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-24.05-small",
+        "ref": "2.18.9",
+        "repo": "nix",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1705033721,
+        "narHash": "sha256-K5eJHmL1/kev6WuqyqqbS1cdNnSidIZ3jeqJ7GbrYnQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a1982c92d8980a0114372973cbdfe0a307f1bdea",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-23.05-small",
        "repo": "nixpkgs",
        "type": "github"
      }
@@ -64,14 +106,30 @@
        "type": "github"
      }
    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1757198069,
+        "narHash": "sha256-m3VUcOD4rTs8J7S+3dOjWMrAjw6RcITC3XYQ98zhEFs=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "0747026fc57ecb9c28901c7f7a2b5dc40e8af43c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.05-small",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
    "pre-commit-hooks": {
      "flake": false,
      "locked": {
-        "lastModified": 1721042469,
-        "narHash": "sha256-6FPUl7HVtvRHCCBQne7Ylp4p+dpP3P/OYuzjztZ4s70=",
+        "lastModified": 1733318908,
+        "narHash": "sha256-SVQVsbafSM1dJ4fpgyBqLZ+Lft+jcQuMtEL3lQWx2Sk=",
        "owner": "cachix",
        "repo": "git-hooks.nix",
-        "rev": "f451c19376071a90d8c58ab1a953c6e9840527fd",
+        "rev": "6f4e2a2112050951a314d2733a994fbab94864c6",
        "type": "github"
      },
      "original": {
@@ -84,7 +142,8 @@
      "inputs": {
        "flake-compat": "flake-compat",
        "nix2container": "nix2container",
-        "nixpkgs": "nixpkgs",
+        "nix_2_18": "nix_2_18",
+        "nixpkgs": "nixpkgs_2",
        "nixpkgs-regression": "nixpkgs-regression",
        "pre-commit-hooks": "pre-commit-hooks"
      }
@@ -2,8 +2,19 @@
  description = "Lix: A modern, delicious implementation of the Nix package manager";

  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05-small";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05-small";
    nixpkgs-regression.url = "github:NixOS/nixpkgs/215d4d0fd80ca5163643b03a33fde804a29cc1e2";
+
+    # Required because Nix 2.18 is not in Nixpkgs ≥ 25.05 anymore.
+    nix_2_18 = {
+      url = "github:NixOS/nix/2.18.9";
+      # NOTE(Raito): this is not possible because patches on libseccomp does not apply anymore on this Nix.
+      # Let's keep the latest known nixpkgs useable with Nix 2.18 for our tests.
+      # inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nixpkgs-regression.follows = "nixpkgs-regression";
+      inputs.flake-compat.follows = "flake-compat";
+    };
+
    pre-commit-hooks = {
      url = "github:cachix/git-hooks.nix";
      flake = false;
@@ -25,6 +36,7 @@
      nixpkgs-regression,
      pre-commit-hooks,
      nix2container,
+      nix_2_18,
      flake-compat,
    }:

@@ -161,6 +173,16 @@
        {
          nixStable = prev.nix;

+          nixVersions = prev.nixVersions // {
+            nix_2_3 = prev.nixVersions.nix_2_3.overrideAttrs (old: {
+              meta = old.meta // {
+                knownVulnerabilities = [ ];
+              };
+            });
+            # Nix 2.18 has been removed from Nixpkgs ≥ 25.05, so we need to reintroduce it ourselves for our tests.
+            nix_2_18 = nix_2_18.outputs.packages.${currentStdenv.hostPlatform.system}.default;
+          };
+
          # Forward from the previous stage as we don’t want it to pick the lowdown override
          nixUnstable = prev.nixUnstable;

@@ -346,13 +368,16 @@
            in
            pkgs.symlinkJoin {
              name = "nixpkgs-lib-tests";
-              paths =
-                [ testWithNix ]
-                # FIXME: This is disabled on darwin due to a nixpkgs bug https://github.com/NixOS/nixpkgs/issues/319147
-                # After that is fixed, it should be restored to use lib/tests/release.nix as before, rather than this reimplementation.
-                ++ lib.optionals pkgs.stdenv.isLinux [
-                  (import (nixpkgs + "/pkgs/test/release") { inherit pkgs lib nix; })
-                ];
+              paths = [
+                testWithNix
+              ]
+              # NOTE: nixpkgs 25.05 is being ... *creative*, and requires this dance to override
+              # the evaluator used for the test. it will break again in the future, don't worry.
+              ++ lib.optionals pkgs.stdenv.isLinux [
+                ((pkgs.callPackage "${nixpkgs}/ci/eval" { inherit nix; }).attrpathsSuperset {
+                  evalSystem = system;
+                })
+              ];
            }
          );
        };
@@ -301,6 +301,11 @@ editline = dependency('libeditline', 'editline', version : '>=1.14', required :

 lowdown = dependency('lowdown', version : '>=0.9.0', required : true, include_type : 'system')

+# TODO(sterni): drop the corresponding #ifdef after NixOS 25.05 is EOL which still distributes lowdown < 1.4.0
+if lowdown.version().version_compare('>= 1.4.0')
+  add_project_arguments('-DLOWDOWN_SEPARATE_TERM_OPTS', language: 'cpp')
+endif
+
 # HACK(Qyriad): rapidcheck's pkg-config doesn't include the libs lol
 # Note: technically we 'check' for rapidcheck twice, for the internal-api-docs handling above,
 # but Meson will cache the result of the first one, and the required : arguments are different.
@@ -475,6 +480,7 @@ add_project_arguments(
  # It would be nice for our headers to be idempotent instead.
  '-include', 'config.h',
  '-Wno-deprecated-declarations',
+  '-Wno-missing-field-initializers',
  '-Wimplicit-fallthrough',
  '-Werror=switch',
  '-Werror=switch-enum',
@@ -179,12 +179,13 @@ stdenv.mkDerivation (finalAttrs: {

  VERSION_SUFFIX = versionSuffix;

-  outputs =
-    [ "out" ]
-    ++ lib.optionals (!finalAttrs.dontBuild) [
-      "dev"
-      "doc"
-    ];
+  outputs = [
+    "out"
+  ]
+  ++ lib.optionals (!finalAttrs.dontBuild) [
+    "dev"
+    "doc"
+  ];

  dontBuild = lintInsteadOfBuild;

@@ -220,67 +221,65 @@ stdenv.mkDerivation (finalAttrs: {
  # We only include CMake so that Meson can locate toml11, which only ships CMake dependency metadata.
  dontUseCmakeConfigure = true;

-  nativeBuildInputs =
-    [
-      python3
-      meson
-      ninja
-      cmake
-    ]
-    ++ [
-      (lib.getBin lowdown-unsandboxed)
-      mdbook
-      mdbook-linkcheck
-    ]
-    ++ [
-      pkg-config
+  nativeBuildInputs = [
+    python3
+    meson
+    ninja
+    cmake
+  ]
+  ++ [
+    (lib.getBin lowdown-unsandboxed)
+    mdbook
+    mdbook-linkcheck
+  ]
+  ++ [
+    pkg-config

-      # Tests
-      git
-      mercurial
-      jq
-      lsof
-    ]
-    ++ lib.optional hostPlatform.isLinux util-linuxMinimal
-    ++ lib.optional (!officialRelease && buildUnreleasedNotes) build-release-notes
-    ++ lib.optional internalApiDocs doxygen
-    ++ lib.optionals lintInsteadOfBuild [
-      # required for a wrapped clang-tidy
-      llvmPackages.clang-tools
-      # required for run-clang-tidy
-      llvmPackages.clang-unwrapped
-    ];
+    # Tests
+    git
+    mercurial
+    jq
+    lsof
+  ]
+  ++ lib.optional hostPlatform.isLinux util-linuxMinimal
+  ++ lib.optional (!officialRelease && buildUnreleasedNotes) build-release-notes
+  ++ lib.optional internalApiDocs doxygen
+  ++ lib.optionals lintInsteadOfBuild [
+    # required for a wrapped clang-tidy
+    llvmPackages.clang-tools
+    # required for run-clang-tidy
+    llvmPackages.clang-unwrapped
+  ];

-  buildInputs =
-    [
-      curl
-      bzip2
-      xz
-      brotli
-      editline-lix
-      openssl
-      sqlite
-      libarchive
-      boost
-      lowdown
-      libsodium
-      toml11
-      lix-doc
-      pegtl
-    ]
-    ++ lib.optionals hostPlatform.isLinux [
-      libseccomp
-      busybox-sandbox-shell
-      passt-lix
-    ]
-    ++ lib.optional internalApiDocs rapidcheck
-    ++ lib.optional hostPlatform.isx86_64 libcpuid
-    # There have been issues building these dependencies
-    ++ lib.optional (hostPlatform.canExecute buildPlatform) aws-sdk-cpp-nix
-    ++ lib.optionals (finalAttrs.dontBuild) maybePropagatedInputs
-    # I am so sorry. This is because checkInputs are required to pass
-    # configure, but we don't actually want to *run* the checks here.
-    ++ lib.optionals lintInsteadOfBuild finalAttrs.checkInputs;
+  buildInputs = [
+    curl
+    bzip2
+    xz
+    brotli
+    editline-lix
+    openssl
+    sqlite
+    libarchive
+    boost
+    lowdown
+    libsodium
+    toml11
+    lix-doc
+    pegtl
+  ]
+  ++ lib.optionals hostPlatform.isLinux [
+    libseccomp
+    busybox-sandbox-shell
+    passt-lix
+  ]
+  ++ lib.optional internalApiDocs rapidcheck
+  ++ lib.optional hostPlatform.isx86_64 libcpuid
+  # There have been issues building these dependencies
+  ++ lib.optional (hostPlatform.canExecute buildPlatform) aws-sdk-cpp-nix
+  ++ lib.optionals (finalAttrs.dontBuild) maybePropagatedInputs
+  # I am so sorry. This is because checkInputs are required to pass
+  # configure, but we don't actually want to *run* the checks here.
+  ++ lib.optionals lintInsteadOfBuild finalAttrs.checkInputs;

  checkInputs = [
    gtest
@@ -427,7 +426,6 @@ stdenv.mkDerivation (finalAttrs: {
        just,
        nixfmt-rfc-style,
        skopeo,
-        xonsh,

        # Lix specific packages
        pre-commit-checks,
@@ -447,7 +445,7 @@ stdenv.mkDerivation (finalAttrs: {
            p.requests
            p.xdg-base-dirs
            p.packaging
-            (p.toPythonModule xonsh.passthru.unwrapped)
+            p.xonsh
          ]
        );
        pythonEnv = python3.withPackages pythonPackages;
@@ -35,19 +35,18 @@ perl.pkgs.toPerlModule (
      ninja
    ];

-    buildInputs =
-      [
-        nix
-        curl
-        bzip2
-        xz
-        perl
-        boost
-        perlPackages.DBI
-        perlPackages.DBDSQLite
-      ]
-      ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
-      ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
+    buildInputs = [
+      nix
+      curl
+      bzip2
+      xz
+      perl
+      boost
+      perlPackages.DBI
+      perlPackages.DBDSQLite
+    ]
+    ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
+    ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;

    # Nixpkgs' Meson hook likes to set this to "plain".
    mesonBuildType = "debugoptimized";
@@ -19,10 +19,7 @@ endif

 cxx = meson.get_compiler('cpp')

-# Really version 5.8.0, but Perl's version string is of the form
-# "This is perl 5, version 38, subversion 2", for 5.38.2, so as far
-# as Meson is concerned, the version of Perl we need is 8 or greater.
-perl = find_program('perl', version : '>=8')
+perl = find_program('perl')

 # "compiler to convert Perl XS code into C code"
 xsubpp = find_program('xsubpp')
@@ -11,13 +11,28 @@ namespace nix {
 std::string renderMarkdownToTerminal(std::string_view markdown)
 {
    int windowWidth = getWindowSize().second;
+    size_t lowdown_cols = std::max(windowWidth - 5, 60);

-    struct lowdown_opts opts {
+    struct lowdown_opts opts{
        .type = LOWDOWN_TERM,
+#ifdef LOWDOWN_SEPARATE_TERM_OPTS
+        .term =
+            {
+                .cols = lowdown_cols,
+                .width = 0,
+                .hmargin = 0,
+                .hpadding = 4,
+                .vmargin = 0,
+                .centre = 0,
+            },
+        // maxdepth needs to be part of the ifdefs to match declaration order
        .maxdepth = 20,
-        .cols = (size_t) std::max(windowWidth - 5, 60),
+#else
+        .maxdepth = 20,
+        .cols = lowdown_cols,
        .hmargin = 0,
        .vmargin = 0,
+#endif /* LOWDOWN_SEPARATE_TERM_OPTS */
        .feat = LOWDOWN_COMMONMARK | LOWDOWN_FENCED | LOWDOWN_DEFLIST | LOWDOWN_TABLES,
        .oflags = LOWDOWN_TERM_NOLINK,
    };
@@ -129,7 +129,6 @@ std::pair<SourcePath, uint32_t> findPackageFilename(EvalState & state, Value & v
    try {
        auto colon = fn.rfind(':');
        if (colon == std::string::npos) fail();
-        std::string filename(fn, 0, colon);
        auto lineno = std::stoi(std::string(fn, colon + 1, std::string::npos));
        return {CanonPath(fn.substr(0, colon)), lineno};
    } catch (std::invalid_argument & e) {
@@ -212,7 +212,7 @@ struct ExprAttrs : Expr
        AttrDef() { };

        template<typename T>
-        const T & chooseByKind(const T & plain, const T & inherited, const T & inheritedFrom) const
+        T chooseByKind(const T & plain, const T & inherited, const T & inheritedFrom) const
        {
            switch (kind) {
            case Kind::Plain:
@@ -624,10 +624,13 @@ struct nothing : p::nothing<Rule> {
    static_assert(!std::is_base_of_v<semantic, Rule>);
 };

-
-
 template<typename Self, typename OpCtx, typename AttrPathT, typename ExprT>
-struct operator_semantics {
+struct operator_semantics
+{
+private:
+    operator_semantics() = default;
+    friend Self;
+public:
    struct has_attr : grammar::op::has_attr {
        AttrPathT path;
    };
@@ -250,9 +250,7 @@ std::optional<Hash> Input::getNarHash() const

 std::optional<std::string> Input::getRef() const
 {
-    if (auto s = maybeGetStrAttr(attrs, "ref"))
-        return *s;
-    return {};
+    return maybeGetStrAttr(attrs, "ref");
 }

 std::optional<Hash> Input::getRev() const
@@ -273,16 +271,12 @@ std::optional<Hash> Input::getRev() const

 std::optional<uint64_t> Input::getRevCount() const
 {
-    if (auto n = maybeGetIntAttr(attrs, "revCount"))
-        return *n;
-    return {};
+    return maybeGetIntAttr(attrs, "revCount");
 }

 std::optional<time_t> Input::getLastModified() const
 {
-    if (auto n = maybeGetIntAttr(attrs, "lastModified"))
-        return *n;
-    return {};
+    return maybeGetIntAttr(attrs, "lastModified");
 }

 ParsedURL InputScheme::toURL(const Input & input) const
@@ -130,7 +130,7 @@ std::optional<std::string> readHeadCached(const std::string & actualUrl)
        // This function must behave the same way, so we return the expired
        // cached ref here.
        warn("could not get HEAD ref for repository '%s'; using expired cached ref '%s'", actualUrl, *cachedRef);
-        return *cachedRef;
+        return cachedRef;
    }

    return std::nullopt;
@@ -1212,7 +1212,7 @@ HookReply DerivationGoal::tryBuildHook()
    hook->toHook.writeSide.reset();

    /* Create the log file and pipe. */
-    Path logFile = openLogFile();
+    openLogFile();

    std::set<int> fds;
    fds.insert(hook->fromHook.readSide.get());
@@ -332,7 +332,7 @@ bool LocalDerivationGoal::cleanupDecideWhetherDiskFull()
        if (statvfs(localStore.realStoreDir.get().c_str(), &st) == 0 &&
            (uint64_t) st.f_bavail * st.f_bsize < required)
            diskFull = true;
-        if (statvfs(tmpDir.c_str(), &st) == 0 &&
+        if (statvfs(tmpDirRoot.c_str(), &st) == 0 &&
            (uint64_t) st.f_bavail * st.f_bsize < required)
            diskFull = true;
    }
@@ -482,7 +482,7 @@ void LocalDerivationGoal::startBuilder()

        /* Create a temporary directory where the build will take
           place. */
-        tmpDir =
+        tmpDirRoot =
            createTempDir(buildDir, "nix-build-" + std::string(drvPath.name()), false, false, 0700);
    } catch (SysError & e) {
        /*
@@ -512,18 +512,51 @@ void LocalDerivationGoal::startBuilder()
            nixBuildsTmp
        );
        worker.buildDirOverride = nixBuildsTmp;
-        tmpDir = createTempDir(
+        tmpDirRoot = createTempDir(
            nixBuildsTmp, "nix-build-" + std::string(drvPath.name()), false, false, 0700
        );
    }
    /* The TOCTOU between the previous mkdir call and this open call is unavoidable due to
     * POSIX semantics.*/
-    tmpDirFd = AutoCloseFD{open(tmpDir.c_str(), O_RDONLY | O_NOFOLLOW | O_DIRECTORY)};
+    tmpDirRootFd = AutoCloseFD{open(tmpDirRoot.c_str(), O_RDONLY | O_NOFOLLOW | O_DIRECTORY)};
+    if (!tmpDirRootFd)
+        throw SysError("failed to open the build temporary directory descriptor '%1%'", tmpDirRoot);
+
+    // place the actual build directory in a subdirectory of tmpDirRoot. if
+    // we do not do this a build can `chown 777` its build directory and so
+    // make it accessible to everyone in the system, breaking isolation. we
+    // also need the intermediate level to be inaccessible to others. build
+    // processes must be able to at least traverse to the directory though,
+    // without being able to chmod. this means either mode 0750 or 0710. we
+    // cannot use 0710 because the libarchive we link with is compiled with
+    // an old apple sdk that does not have O_SEARCH, which makes libarchive
+    // try to open tmpDirRoot for *read* and fail because g+r is not set. a
+    // future update to nixpkgs may fix this. until then we do not lose any
+    // security by setting mode 0750 because we use only a single subdir in
+    // tmpDirRoot, so being able to list its parent doesn't break anything.
+    //
+    // use a short name to not increase the path length too much on darwin.
+    // darwin has a severe sockaddr_un path length limitation, so this does
+    // make a difference over more evocative names. we use `b` for `build`.
+    tmpDir = tmpDirRoot + "/b";
+    if (mkdirat(tmpDirRootFd.get(), "b", 0700)) {
+        throw SysError("failed to create the build temporary directory '%1%'", tmpDir);
+    }
+    tmpDirFd = AutoCloseFD{openat(tmpDirRootFd.get(), "b", O_RDONLY | O_NOFOLLOW | O_DIRECTORY)};
    if (!tmpDirFd)
        throw SysError("failed to open the build temporary directory descriptor '%1%'", tmpDir);

    chownToBuilder(tmpDirFd);

+    if (buildUser) {
+        if (fchown(tmpDirRootFd.get(), -1, buildUser->getGID()) == -1) {
+            throw SysError("cannot change ownership of '%1%'", tmpDirRoot);
+        }
+        if (fchmod(tmpDirRootFd.get(), 0750) == -1) {
+            throw SysError("cannot change mode of '%1%'", tmpDirRoot);
+        }
+    }
+
    for (auto & [outputName, status] : initialOutputs) {
        /* Set scratch path we'll actually use during the build.

@@ -745,7 +778,7 @@ void LocalDerivationGoal::startBuilder()
        printMsg(lvlVomit, "setting builder env variable '%1%'='%2%'", i.first, i.second);

    /* Create the log file. */
-    Path logFile = openLogFile();
+    openLogFile();

    /* Create a pseudoterminal to get the output of the builder. */
    builderOut = AutoCloseFD{posix_openpt(O_RDWR | O_NOCTTY)};
@@ -2682,16 +2715,16 @@ void LocalDerivationGoal::checkOutputs(const std::map<std::string, ValidPathInfo

 void LocalDerivationGoal::deleteTmpDir(bool force)
 {
-    if (tmpDir != "") {
+    if (tmpDirRoot != "") {
        /* Don't keep temporary directories for builtins because they
           might have privileged stuff (like a copy of netrc). */
        if (settings.keepFailed && !force && !drv->isBuiltin()) {
-            printError("note: keeping build directory '%s'", tmpDir);
-            chmod(tmpDir.c_str(), 0755);
+            printError("note: keeping build directory '%s'", tmpDirRoot);
+            chmod(tmpDirRoot.c_str(), 0755);
        }
        else
-            deletePath(tmpDir);
-        tmpDir = "";
+            deletePath(tmpDirRoot);
+        tmpDirRoot = "";
    }
 }

@@ -29,12 +29,12 @@ struct LocalDerivationGoal : public DerivationGoal
    /**
     * The temporary directory.
     */
-    Path tmpDir;
+    Path tmpDirRoot, tmpDir;

    /**
     * The temporary directory file descriptor
     */
-    AutoCloseFD tmpDirFd;
+    AutoCloseFD tmpDirRootFd, tmpDirFd;

    /**
     * The path of the temporary directory in the sandbox.
@@ -93,7 +93,7 @@ WireFormatGenerator CommonProto::Serialise<std::optional<ContentAddress>>::write
 {
    return [](std::string s) -> WireFormatGenerator {
        co_yield s;
-    }(caOpt ? renderContentAddress(*caOpt) : "");
+    }(caOpt ? renderContentAddress(caOpt) : "");
 }

 }
@@ -45,8 +45,15 @@ std::string SecretKey::signDetached(std::string_view data) const
 {
    unsigned char sig[crypto_sign_BYTES];
    unsigned long long sigLen;
-    crypto_sign_detached(sig, &sigLen, charptr_cast<const unsigned char *>(data.data()), data.size(),
-        charptr_cast<const unsigned char *>(key.data()));
+    crypto_sign_detached(
+        sig,
+        &sigLen,
+        // the following is not a string function so no null termination issues are possible here.
+        // NOLINTNEXTLINE(bugprone-suspicious-stringview-data-usage)
+        charptr_cast<const unsigned char *>(data.data()),
+        data.size(),
+        charptr_cast<const unsigned char *>(key.data())
+    );
    return name + ":" + base64Encode(std::string(reinterpret_cast<char *>(sig), sigLen));
 }

@@ -13,14 +13,9 @@ void Store::exportPaths(const StorePathSet & paths, Sink & sink)
    auto sorted = topoSortPaths(paths);
    std::reverse(sorted.begin(), sorted.end());

-    std::string doneLabel("paths exported");
-    //logger->incExpected(doneLabel, sorted.size());
-
    for (auto & path : sorted) {
-        //Activity act(*logger, lvlInfo, "exporting path '%s'", path);
        sink << 1;
        exportPath(path, sink);
-        //logger->incProgress(doneLabel);
    }

    sink << 0;
@@ -152,7 +152,6 @@ struct NarAccessor : public FSAccessor

    NarMember * find(const Path & path)
    {
-        Path canon = path == "" ? "" : canonPath(path);
        NarMember * current = &root;
        auto end = path.end();
        for (auto it = path.begin(); it != end; ) {
@@ -120,7 +120,7 @@ std::string NarInfo::to_string(const Store & store) const
        res += "Sig: " + sig + "\n";

    if (ca)
-        res += "CA: " + renderContentAddress(*ca) + "\n";
+        res += "CA: " + renderContentAddress(ca) + "\n";

    return res;
 }
@@ -145,7 +145,7 @@ SQLiteStmt::Use::~Use()
 SQLiteStmt::Use & SQLiteStmt::Use::operator () (std::string_view value, bool notNull)
 {
    if (notNull) {
-        if (sqlite3_bind_text(stmt, curArg++, value.data(), -1, SQLITE_TRANSIENT) != SQLITE_OK)
+        if (sqlite3_bind_text(stmt, curArg++, value.data(), value.length(), SQLITE_TRANSIENT) != SQLITE_OK)
            SQLiteError::throw_(stmt.db, "binding argument");
    } else
        bind();
@@ -1322,8 +1322,7 @@ std::optional<StorePath> Store::getBuildDerivationPath(const StorePath & path)
    if (!path.isDerivation()) {
        try {
            auto info = queryPathInfo(path);
-            if (!info->deriver) return std::nullopt;
-            return *info->deriver;
+            return info->deriver;
        } catch (InvalidPath &) {
            return std::nullopt;
        }
@@ -239,6 +239,7 @@ struct BrotliCompressionSink : ChunkedCompressionSink

    void writeInternal(std::string_view data) override
    {
+        // NOLINTNEXTLINE(bugprone-suspicious-stringview-data-usage)
        auto next_in = charptr_cast<const uint8_t *>(data.data());
        size_t avail_in = data.size();
        uint8_t * next_out = outbuf;
@@ -475,7 +475,7 @@ static void _deletePath(const Path & path, uint64_t & bytesFreed)
        throw SysError("opening directory '%1%'", path);
    }

-    _deletePath(dirfd.get(), baseNameOf(path).data(), bytesFreed);
+    _deletePath(dirfd.get(), std::string(baseNameOf(path)), bytesFreed);
 }


@@ -25,7 +25,7 @@ std::string hiliteMatches(
        out.append(s.substr(last_end, m.position() - last_end));
        // Merge continous matches
        ssize_t end = start + m.length();
-        while (++it != matches.end() && (*it).position() <= end) {
+        for (++it; it != matches.end() && (*it).position() <= end; ++it) {
            auto n = *it;
            ssize_t nend = start + (n.position() - start + n.length());
            if (nend > end)
@@ -38,6 +38,6 @@ const nlohmann::json & ensureType(
            nlohmann::json(expectedType).type_name(),
            value.type_name());

-    return value;
+    return value; // NOLINT(bugprone-return-const-ref-from-parameter)
 }
 }
@@ -258,12 +258,12 @@ extern Verbosity verbosity;
 * level. Note that this has to be implemented as a macro to ensure that the
 * arguments are evaluated lazily.
 */
-#define printMsgUsing(loggerParam, level, args...) \
-    do { \
-        auto __lvl = level; \
-        if (__lvl <= nix::verbosity) { \
-            loggerParam->log(__lvl, fmt(args)); \
-        } \
+#define printMsgUsing(loggerParam, level, args...)              \
+    do {                                                        \
+        auto _lix_logger_print_lvl = level;                     \
+        if (_lix_logger_print_lvl <= nix::verbosity) {          \
+            loggerParam->log(_lix_logger_print_lvl, fmt(args)); \
+        }                                                       \
    } while (0)
 #define printMsg(level, args...) printMsgUsing(logger, level, args)

@@ -53,7 +53,7 @@ void RefScanSink::operator () (std::string_view data)
       previous fragment and the start of the current fragment. */
    auto s = tail;
    auto tailLen = std::min(data.size(), refLength);
-    s.append(data.data(), tailLen);
+    s.append(data.data(), tailLen); // NOLINT(bugprone-suspicious-stringview-data-usage)
    search(s, hashes, seen);

    search(data, hashes, seen);
@@ -75,7 +75,6 @@ void Source::operator () (char * data, size_t len)

 void Source::drainInto(Sink & sink)
 {
-    std::string s;
    std::array<char, 8192> buf;
    while (true) {
        size_t n;
@@ -251,7 +250,7 @@ Error readError(Source & source)
    auto type = readString(source);
    assert(type == "Error");
    auto level = (Verbosity) readInt(source);
-    auto name = readString(source); // removed
+    readString(source); // removed (name)
    auto msg = readString(source);
    ErrorInfo info {
        .level = level,
@@ -34,7 +34,7 @@ bool shouldANSI(StandardOutputStream fileno)
 // FIXME(jade): replace with TerminalCodeEater. wowie this is evil code.
 std::string filterANSIEscapes(std::string_view s, bool filterAll, unsigned int width, bool eatTabs)
 {
-    std::string t, e;
+    std::string t;
    size_t w = 0;
    auto i = s.begin();

@@ -80,12 +80,18 @@ typename T::mapped_type * get(T & map, const typename T::key_type & key)
 * Get a value for the specified key from an associate container, or a default value if the key isn't present.
 */
 template <class T>
-const typename T::mapped_type & getOr(T & map,
+const typename T::mapped_type & getOr(
+    T & map [[clang::lifetimebound]],
    const typename T::key_type & key,
-    const typename T::mapped_type & defaultValue)
+    const typename T::mapped_type & defaultValue [[clang::lifetimebound]]
+)
 {
    auto i = map.find(key);
-    if (i == map.end()) return defaultValue;
+    if (i == map.end()) {
+        /* FIXME(Raito): `[[clang::lifetimebound]]` has no effect on `defaultValue` warning. */
+        // NOLINTNEXTLINE(bugprone-return-const-ref-from-parameter)
+        return defaultValue;
+    }
    return i->second;
 }

@@ -1313,7 +1313,7 @@ static void opSwitchGeneration(Globals & globals, Strings opFlags, Strings opArg
        throw UsageError("exactly one argument expected");

    if (auto dstGen = string2Int<GenerationNumber>(opArgs.front()))
-        switchGeneration(globals.profile, *dstGen, globals.dryRun);
+        switchGeneration(globals.profile, dstGen, globals.dryRun);
    else
        throw UsageError("expected a generation number");
 }
@@ -116,8 +116,6 @@ struct CmdBundle : InstallableCommand
            },
        });

-        auto outPathS = store->printStorePath(outPath);
-
        if (!outLink) {
            auto * attr = vRes->attrs->get(evalState->sName);
            if (!attr)
@@ -114,7 +114,7 @@ struct CmdPathInfo : StorePathsCommand, MixJSON
                    std::cout << '\t';
                    Strings ss;
                    if (info->ultimate) ss.push_back("ultimate");
-                    if (info->ca) ss.push_back("ca:" + renderContentAddress(*info->ca));
+                    if (info->ca) ss.push_back("ca:" + renderContentAddress(info->ca));
                    for (auto & sig : info->sigs) ss.push_back(sig);
                    std::cout << concatStringsSep(" ", ss);
                }
@@ -160,7 +160,6 @@ struct CmdSearch : InstallableCommand, MixJSON
                                {"description", description},
                            };
                        } else {
-                            auto name2 = hiliteMatches(name.name, nameMatches, ANSI_GREEN, "\e[0;2m");
                            if (results > 1) logger->cout("");
                            logger->cout(
                                "* %s%s",
@@ -40,13 +40,9 @@ struct CmdCopySigs : StorePathsCommand

        ThreadPool pool;

-        std::string doneLabel = "done";
        std::atomic<size_t> added{0};

-        //logger->setExpected(doneLabel, storePaths.size());
-
        auto doPath = [&](const Path & storePathS) {
-            //Activity act(*logger, lvlInfo, "getting signatures for '%s'", storePath);

            checkInterrupt();

@@ -78,8 +74,6 @@ struct CmdCopySigs : StorePathsCommand
                store->addSignatures(storePath, newSigs);
                added += newSigs.size();
            }
-
-            //logger->incProgress(doneLabel);
        };

        for (auto & storePath : storePaths)
@@ -34,6 +34,7 @@ private:
                                  OptionalFileEntryRef File,
                                  StringRef SearchPath, StringRef RelativePath,
                                  const Module *Imported,
+                                  bool ModuleImported,
                                  SrcMgr::CharacteristicKind FileType) override;
 };

@@ -46,7 +47,7 @@ void FixIncludesCallbacks::LexedFileChanged(FileID, LexedFileChangeReason,
 void FixIncludesCallbacks::InclusionDirective(
    SourceLocation, const Token &, StringRef FileName, bool IsAngled,
    CharSourceRange FilenameRange, OptionalFileEntryRef File, StringRef,
-    StringRef, const Module *, SrcMgr::CharacteristicKind) {
+    StringRef, const Module *, bool, SrcMgr::CharacteristicKind) {
  if (Ignore)
    return;

@@ -80,4 +80,4 @@ out="$(nix-build 2>&1 failing.nix \
 [[ "$out" =~ .*"note: keeping build directory".* ]]

 build_dir="$(grep "note: keeping build" <<< "$out" | sed -E "s/^(.*)note: keeping build directory '(.*)'(.*)$/\2/")"
-[[ "foo" = $(<"$build_dir"/bar) ]]
+[[ "foo" = $(<"$build_dir"/b/bar) ]]
@@ -175,3 +175,23 @@ test "$(<<<"$out" grep -E '^error:' | wc -l)" = 3
 BUILD_DIR=$(mktemp -d)
 chmod 0000 "$BUILD_DIR"
 nix --build-dir "$BUILD_DIR" build -E 'with import ./config.nix; mkDerivation { name = "test"; buildCommand = "echo rawr > $out"; }' --impure --no-link
+
+# ensure that the build directory parent is not world-accessible
+chmod 0755 "$BUILD_DIR"
+FIFO="$BUILD_DIR/fifo"
+mkfifo "$FIFO"
+(
+  echo > "$FIFO"
+  trap 'echo > "$FIFO"' EXIT
+  mode=$(stat -c %a $BUILD_DIR/b/*)
+  [ "$mode" = "700" -o "$mode" = "710" ]
+) &
+nix build --build-dir "$BUILD_DIR/b" -E '
+  with import ./config.nix; mkDerivation {
+    name = "test";
+    buildCommand = "cat '"$FIFO"'; cat '"$FIFO"' > $out";
+  }' \
+  --extra-sandbox-paths "$FIFO" \
+  --impure \
+  --no-link
+wait
@@ -45,7 +45,7 @@ test_custom_build_dir() {
  [ "$status" = "100" ]
  [[ 1 == "$(count "$customBuildDir/nix-build-"*)" ]]
  local buildDir="$customBuildDir/nix-build-"*
-  grep $checkBuildId $buildDir/checkBuildId
+  grep $checkBuildId $buildDir/b/checkBuildId
 }
 test_custom_build_dir

@@ -1,12 +1,11 @@
  nix-repl> 1 + 1
  2

-  nix-repl> :doc builtins.head
-  Synopsis: builtins.head list
+  nix-repl> :doc builtins.add
+  Synopsis: builtins.add e1 e2
+
+      Return the sum of the numbers e1 and e2.

-      Return the first element of a list; abort evaluation if
-      the argument isn’t a list or is an empty list. You can
-      test whether a list is empty by comparing it with [].

  nix-repl> f = a: "" + a

@@ -12,6 +12,8 @@ let
      defaults = {
        nixpkgs.pkgs = nixpkgsFor.${system}.native;
        nix.checkAllErrors = false;
+        # nixos-option fails to build with lix and no tests use any of the tools
+        system.disableInstallerTools = true;
      };
      _module.args.nixpkgs = nixpkgs;
      _module.args.system = system;
@@ -76,7 +76,7 @@ in
    # Fetching from a server with an untrusted cert should fail.
    err = machine.fail("nix build --no-substitute --expr 'import <nix/fetchurl.nix> { url = \"https://bad/index.html\"; hash = \"sha256-rsBwZF/lPuOzdjBZN2E08FjMM3JHyXit0Xi2zN+wAZ8=\"; }' 2>&1")
    print(err)
-    assert "SSL certificate problem: self-signed certificate" in err or "SSL peer certificate or SSH remote key was not OK" in err
+    assert "SSL peer certificate or SSH remote key was not OK" in err

    # Fetching from a server with a trusted cert should work via environment variable override.
    machine.succeed("NIX_SSL_CERT_FILE=/tmp/cafile.pem nix build --no-substitute --expr 'import <nix/fetchurl.nix> { url = \"https://bad/index.html\"; hash = \"sha256-rsBwZF/lPuOzdjBZN2E08FjMM3JHyXit0Xi2zN+wAZ8=\"; }'")
@@ -45,12 +45,12 @@ in {
    server.wait_for_unit("network-online.target")
    client.wait_for_unit("network-online.target")

-    client.succeed("mkdir -m 700 /root/.ssh")
+    client.succeed("mkdir -m 700 /root/.ssh || [[ -d /root/.ssh ]]")
    client.copy_from_host("key", "/root/.ssh/id_ed25519")
    client.succeed("chmod 600 /root/.ssh/id_ed25519")

    # Install the SSH key on the server.
-    server.succeed("mkdir -m 700 /root/.ssh")
+    server.succeed("mkdir -m 700 /root/.ssh || [[ -d /root/.ssh ]]")
    server.copy_from_host("key.pub", "/root/.ssh/authorized_keys")
    server.wait_for_unit("sshd.service")
    client.succeed(f"ssh -o StrictHostKeyChecking=no {server.name} 'echo hello world' >&2")
@@ -48,6 +48,7 @@ in
          imports = [ test.config.builders.config ];
          services.openssh.enable = true;
          virtualisation.writableStore = true;
+          virtualisation.additionalPaths = [ config.system.build.extraUtils ];
          nix.settings.sandbox = true;
          nix.settings.substituters = lib.mkForce [ ];
        };
@@ -1,5 +1,5 @@
 {
    "version": "2.91.3",
-    "official_release": true,
+    "official_release": false,
    "release_name": "Dragon's Breath"
 }
Author	SHA1	Message	Date
Alois Wohlschlager	528a66807d	Enable nixpkgsLibTests again The required nixpkgs bumps have now been performed. Change-Id: I6a6a6964316f8434c355405c52b0a7b7f70b4332	2025-09-08 20:26:44 +02:00
Alois Wohlschlager	88412da7a9	flake: update nixpkgs input Without https://github.com/NixOS/nixpkgs/pull/434761 evaluation of the `nixpkgsLibTests` will fail in CI with recent enough Lix, due to reliance on the TOML integer saturation bug. Reported-by: Sergei Zimmerman <sergei@zimmerman.foo> Change-Id: I6a6a6964838009d2c525f67035f84072fdfad988	2025-09-08 20:26:44 +02:00
Raito Bezarius Alois Wohlschlager eldritch horrors helle	5a38f5bb8d	flake/inputs: 24.11-small -> 25.05-small We upgrade to 25.05 release, which contains the curl commit https://github.com/curl/curl/commit/5fbd78eb2dc4afbd8884e8eed27147fc3d4318f6 done in https://github.com/NixOS/nixpkgs/pull/396200#issuecomment-2795944006. This fixes HTTP transfers generating arbitrary errors and possibly failing unusually. Users who are already depending on 25.05-small or a recent unstable already had the fix. Special mention to the Linux kernel who gave me the opportunity to get on a 24 hours bisection side quest to fix the local release engineering test. Special thanks to everyone who had to endure me ranting. Change-Id: I866caf65d5ea103f1fa5eccd57df8031c9eacda0 Co-authored-by: eldritch horrors <pennae@lix.systems> Co-authored-by: helle <helle@h3l.li> Co-authored-by: Alois Wohlschlager <alois1@gmx-topmail.de> Signed-off-by: Raito Bezarius <raito@lix.systems>	2025-09-08 20:26:44 +02:00
K900andAlois Wohlschlager	4caa5bac31	perl: drop version check Meson started handling those differently[0], and Perl 5.8 is old enough that anyone running an even older Perl is honestly asking for it. [0]: https://github.com/mesonbuild/meson/commit/a3679a64eec7c312c81d657880f34f015426c7db Change-Id: Ifba22e38a82abf4b6965dda0eed43a3064533d25	2025-09-08 19:18:09 +02:00
Artemis TosiniandAlois Wohlschlager	fc16b50d37	flake: Use nixpkgs 24.11 nixpkgs 24.11 changes how we access xonsh yet again and updates clang. Unfortunately, clang 18 produces significantly more warnings on existing code that is challenging to fix. Make sure that doesn't error when we're running `-Werror` builds. n.b. I had to change the "SSL certificate problem: self-signed certificate" to the old error prior to the improved libcurl errors, since what is presumably a difference in which TLS library is used has cropped up between releases? Either way the curl error buffer is empty. Seems like we aggressively cannot do anything about this. Co-authored-by: eldritch horrors <pennae@lix.systems> Change-Id: If0141a46a8b445a0e7d6f86f939e8c8e03569bf5	2025-09-08 19:18:09 +02:00
Jade LovelaceandAlois Wohlschlager	6163dea01c	tree-wide: fix a pile of lints Mostly these are bugprone-unused-local-non-trivial-variable. Also fix instances of: - bugprone-optional-value-conversion - bugprone-inc-dec-in-conditions (please check this loop is correct, it is the only non trivial code change in here) - bugprone-unused-return-value (well, by fixing the lint config) There are three notable changes relating to undefined vars: - openLogFile ignoring the result. This is because openLogFile does a whole bunch of mutation of member variables - hiliteMatches: i am guessing this is because showing the derivation name was unhelpful and it just got changed - canonPath in NarAccessor: canonPath inside of a thing that is supposed to be vfs based cannot possibly be correct, so let's delete it given it is unused. Fixes: https://git.lix.systems/lix-project/lix/issues/584 Change-Id: I887adc9ff28b61f726dcfed197e6796b414c2fcf	2025-09-08 19:17:29 +02:00
Alois Wohlschlager	03dbf4a74b	Disable nixpkgsLibTests temporarily Several nixpkgs bumps up to https://github.com/NixOS/nixpkgs/pull/434761 will be required to fix them. Disable the tests temporarily to avoid having to squash all the backports, which would lose history. Change-Id: I6a6a6964029a3442c4691e74a52923e3f59d6448	2025-09-08 18:17:48 +02:00
sternenseemann	ecff59d773	libcmd: add support for lowdown >= 1.4 lowdown 1.4.0 changed the lowdown_opts to include a new and separate lowdown_opts_term which allows for configuring values specific to -Tterm (which we're using). This version should have been called 2.0.0 according to semver, hence 2.0.0 was released later without any actual breaking changes to sort of migitate the problem. We need to support lowdown >= 1.3 && < 1.4 since the ship has sailed for updating lowdown in NixOS 25.05 as well as lowdown >= 1.4 or we'll be stuck in Nixpkgs forever. Support for < 1.4 can be dropped as soon as NixOS 25.05 is EOL, assuming this change lands before NixOS 25.11 branch-off. We detect the changed API based on the lowdown version from pkg-config and define LOWDOWN_SEPARATE_TERM_OPTS based on that. The ifdef is named according to the specific API change that impacts us, so that it's hopefully a little simpler to maintain going forward. In the new API, all newly configurable settings use what would have been the (implicit) default before. Changing some of these values, especially hpadding, could be interesting in future changes. Compared to cl/3081, this change makes sure to initialize all new fields of lowdown_opts_term explicitly. It seems that, while making -Tterm more configurable, lowdown's word wrapping behavior changed slightly which broke basic_repl.test. I've chosen to work around this by using builtins.add as an example which has a very short documentation string, so wrapping doesn't matter. Change-Id: Id73be4c0e43d7eb4f56e10a261b4254402698ff8 (cherry picked from commit `858de5f47a`)	2025-07-23 21:42:40 +00:00
eldritch horrors	fc9f7096d3	libstore: weaken tmpdir root access mode libarchive should not break with 0710 on the tmpdir root on darwin, just like it doesn't break on linux, but for some reason it does. the restriction to 0710 can be weakened to 0750 with causing any trouble. fixes #921 Change-Id: Ia9fc2f8eb9695fc19cefae9857368d5a4e58c8b9	2025-07-20 16:58:24 +00:00
eldritch horrorsandRaito Bezarius	aa9739caa7	libstore: add intermediate directory to build-dirs this makes the actual build directories used by builders invisible and inaccessible to other processes on the system, avoiding another vector for outside processes to interfere with builds or pass credentials the build sandbox should not have access to into the build sandbox anyway. fixes #919 Change-Id: Ifaa4d8e3940cfde1406e925f75c1375d2e86d81a (cherry picked from commit `9d5a5c4dc0`)	2025-07-18 03:57:34 +02:00
Raito Bezarius	47fb192fee	release: merge release 2.91.3 back to mainline This merge commit returns to the previous state prior to the release but leaves the tag in the branch history. Release created with releng/create_release.xsh Change-Id: I486210640ffcdddc2c2b1ee066bf6850d4fb93fa	2025-06-30 00:03:53 +02:00