release: 2.93.1 "Bici Bici"

Release produced with releng/create_release.xsh

Change-Id: I64c89d0fba1e228136e50738e7a61d53306d14e6

doc/manual/src/release-notes/rl-2.93.md

@@ -1,80 +1,4 @@
 # Lix 2.93 "Bici Bici" (2025-05-09)
-# Lix 2.93.3 (2025-07-22)
-## Improvements
-
-- `--keep-failed` chowns the build directory to the user that request the build [cl/3678](https://gerrit.lix.systems/c/lix/+/3678)
-
-  Running a build with `--keep-failed` now chowns the temporary directory from the
-  builder user and group to the user that request the build if the build came from
-  a local user connected to the daemon. This makes inspecting failed derivations a
-  lot easier. On Linux the build directory made visible to the user will not be in
-  the same path as it was in the sandbox and continuing builds will usually break.
-
-  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) for this.
-
-
-
-
-# Lix 2.93.2 (2025-06-30)
-## Fixes
-
-- Revert CVE-2025-52992 failed mitigation [fj#883](https://git.lix.systems/lix-project/lix/issues/883) [fj#887](https://git.lix.systems/lix-project/lix/issues/887) [cl/3444](https://gerrit.lix.systems/c/lix/+/3444) [cl/3528](https://gerrit.lix.systems/c/lix/+/3528)
-
-  Following the initial mitigation of **CVE-2025-52992** in `cl/3444`, we
-  received reports of **unexpected deletion of in-use store paths**.
-
-  Upon investigation, we found that the patch did **not correctly cancel all
-  automatic deleters**, resulting in potentially critical path loss during normal
-  operation.
-
-  Given the severity and time-sensitive nature of the situation ([see incident
-  report](https://lix.systems/blog/2025-06-27-lix-critical-bug/)), we evaluated
-  possible options to repair the behavior safely. However, we concluded that a
-  rushed fix would either
-
-  * **Overdelete**, i.e. breaking running systems, or,
-  * **Underdelete**, effectively **reopening CVE-2025-52992** while leaving
-    orphaned paths behind.
-
-  As **CVE-2025-52992 has no known exploit vector**, and correctness is critical
-  in the Lix project, we have **fully reverted the previous mitigations**.
-
-  The affected patches (`cl/3444`) have been rolled back for the time being.
-
-  Moving forward, the Lix team will rework this code path in a **long-term,
-  correctness-first fix** on the main branch. We will explore backporting it to
-  stable channels once its safety is assured.
-
-  We are deeply sorry for the stability incident and the Lix team remain
-  available for assisting you in recovering your systems.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) and [eldritch horrors](https://git.lix.systems/pennae) for this.
-
-- Fallback to safe temp dir when build-dir is unwritable [fj#876](https://git.lix.systems/lix-project/lix/issues/876) [cl/3501](https://gerrit.lix.systems/c/lix/+/3501)
-
-  Non-daemon builds started failing with a permission error after introducing the `build-dir` option:
-
-  ```
-  $ nix build --store ~/scratch nixpkgs#hello --rebuild
-  error: creating directory '/nix/var/nix/builds/nix-build-hello-2.12.2.drv-0': Permission denied
-  ```
-
-  This happens because:
-
-  1. These builds are not run via the daemon, which owns `/nix/var/nix/builds`.
-  2. The user lacks permissions for that path.
-
-  We considered making `build-dir` a store-level option and defaulting it to `<chroot-root>/nix/var/nix/builds` for chroot stores, but opted instead for a fallback: if the default fails, Nix now creates a safe build directory under `/tmp`.
-
-  To avoid CVE-2025-52991, the fallback uses an extra path component between `/tmp` and the build dir.
-
-  **Note**: this fallback clutters `/tmp` with build directories that are not cleaned up. To prevent this, explicitly set `build-dir` to a path managed by Lix, even for local workloads.
-
-  Many thanks to [Raito Bezarius](https://git.lix.systems/raito) and [eldritch horrors](https://git.lix.systems/pennae) for this.
-
-
-
-
 # Lix 2.93.1 (2025-06-23)
 ## Breaking Changes
 

lix/libstore/build/local-derivation-goal.cc

@@ -30,13 +30,11 @@
 #include "platform/linux.hh"
 
 #include <cstddef>
-#include <dirent.h>
 #include <exception>
 #include <regex>
 #include <queue>
 
 #include <stdexcept>
-#include <sys/stat.h>
 #include <sys/un.h>
 #include <fcntl.h>
 #include <termios.h>
@@ -115,11 +113,7 @@ LocalDerivationGoal::~LocalDerivationGoal() noexcept(false)
     /* Careful: we should never ever throw an exception from a
        destructor. */
     try { killChild(); } catch (...) { ignoreExceptionInDestructor(); }
-    try {
-        finalizeTmpDir(false, true);
-    } catch (...) {
-        ignoreExceptionInDestructor();
-    }
+    try { deleteTmpDir(false, true); } catch (...) { ignoreExceptionInDestructor(); }
 }
 
 
@@ -369,14 +363,13 @@ bool LocalDerivationGoal::cleanupDecideWhetherDiskFull()
         if (statvfs(localStore.config().realStoreDir.get().c_str(), &st) == 0 &&
             (uint64_t) st.f_bavail * st.f_bsize < required)
             diskFull = true;
-        if (statvfs(tmpDirRoot.c_str(), &st) == 0 && (uint64_t) st.f_bavail * st.f_bsize < required)
-        {
+        if (statvfs(tmpDir.c_str(), &st) == 0 &&
+            (uint64_t) st.f_bavail * st.f_bsize < required)
             diskFull = true;
-        }
     }
 #endif
 
-    finalizeTmpDir(false);
+    deleteTmpDir(false);
 
     /* Move paths out of the chroot for easier debugging of
        build failures. */
@@ -395,15 +388,19 @@ bool LocalDerivationGoal::cleanupDecideWhetherDiskFull()
 
 void LocalDerivationGoal::cleanupPostOutputsRegisteredModeCheck()
 {
-    finalizeTmpDir(true);
+    deleteTmpDir(true);
 }
 
 
 void LocalDerivationGoal::cleanupPostOutputsRegisteredModeNonCheck()
 {
-    /* Delete unused redirected outputs (when doing hash rewriting). */
-    for (auto & i : redirectedOutputs)
-        deletePath(worker.store.Store::toRealPath(i.second));
+    /* In the past, redirected outputs were manually tracked for deletion.
+     * Now that we have the scratch outputs cleaner which are a superset of
+     * redirected outputs, we just fire all uncancelled automatic deleters now.
+     *
+     * This should clean up any paths that IS NOT registered in the database.
+     */
+    scratchOutputsCleaner.clear();
 
     /* Delete the chroot (if we were using one). */
     autoDelChroot.reset(); /* this runs the destructor */
@@ -490,87 +487,24 @@ try {
         });
     }
 
-    try {
-        auto buildDir = worker.buildDirOverride.value_or(settings.buildDir.get());
+    createDirs(settings.buildDir.get());
 
-        createDirs(buildDir);
-
-        /* Create a temporary directory where the build will take
-           place. */
-        tmpDirRoot =
-            createTempDir(buildDir, "nix-build-" + std::string(drvPath.name()), false, false, 0700);
-    } catch (SysError & e) {
-        /*
-         * Fallback to the global tmpdir and create a safe space there
-         * only if it's a permission error.
-         */
-        if (e.errNo != EACCES) {
-            throw;
-        }
-
-        auto globalTmp = defaultTempDir();
-        createDirs(globalTmp);
-#if __APPLE__
-        /* macOS filesystem namespacing does not exist, to avoid breaking builds, we need to weaken
-         * the mode bits on the top-level directory. This avoids issues like
-         * https://github.com/NixOS/nix/pull/11031. */
-        constexpr int toplevelDirMode = 0755;
-#else
-        constexpr int toplevelDirMode = 0700;
-#endif
-        auto nixBuildsTmp =
-            createTempDir(globalTmp, fmt("nix-builds-%s", geteuid()), false, false, toplevelDirMode);
-        warn(
-            "Failed to use the system-wide build directory '%s', falling back to a temporary "
-            "directory inside '%s'",
-            settings.buildDir.get(),
-            nixBuildsTmp
-        );
-        worker.buildDirOverride = nixBuildsTmp;
-        tmpDirRoot = createTempDir(
-            nixBuildsTmp, "nix-build-" + std::string(drvPath.name()), false, false, 0700
-        );
-    }
+    /* Create a temporary directory where the build will take
+       place. */
+    tmpDir = createTempDir(
+        settings.buildDir.get(),
+        "nix-build-" + std::string(drvPath.name()),
+        false,
+        false,
+        0700
+    );
     /* The TOCTOU between the previous mkdir call and this open call is unavoidable due to
      * POSIX semantics.*/
-    tmpDirRootFd = AutoCloseFD{open(tmpDirRoot.c_str(), O_RDONLY | O_NOFOLLOW | O_DIRECTORY)};
-    if (!tmpDirRootFd) {
-        throw SysError("failed to open the build temporary directory descriptor '%1%'", tmpDirRoot);
-    }
-
-    // place the actual build directory in a subdirectory of tmpDirRoot. if
-    // we do not do this a build can `chown 777` its build directory and so
-    // make it accessible to everyone in the system, breaking isolation. we
-    // also need the intermediate level to be inaccessible to others. build
-    // processes must be able to at least traverse to the directory though,
-    // without being able to chmod. this means either mode 0750 or 0710. we
-    // cannot use 0710 because the libarchive we link with is compiled with
-    // an old apple sdk that does not have O_SEARCH, which makes libarchive
-    // try to open tmpDirRoot for *read* and fail because g+r is not set. a
-    // future update to nixpkgs may fix this. until then we do not lose any
-    // security by setting mode 0750 because we use only a single subdir in
-    // tmpDirRoot, so being able to list its parent doesn't break anything.
-    //
-    // use a short name to not increase the path length too much on darwin.
-    // darwin has a severe sockaddr_un path length limitation, so this does
-    // make a difference over more evocative names. we use `b` for `build`.
-    tmpDir = tmpDirRoot + "/b";
-    if (mkdirat(tmpDirRootFd.get(), "b", 0700)) {
-        throw SysError("failed to create the build temporary directory '%1%'", tmpDir);
-    }
-    tmpDirFd = AutoCloseFD{openat(tmpDirRootFd.get(), "b", O_RDONLY | O_NOFOLLOW | O_DIRECTORY)};
+    tmpDirFd = AutoCloseFD{open(tmpDir.c_str(), O_RDONLY | O_NOFOLLOW | O_DIRECTORY)};
     if (!tmpDirFd)
         throw SysError("failed to open the build temporary directory descriptor '%1%'", tmpDir);
 
     chownToBuilder(tmpDirFd);
-    if (buildUser) {
-        if (fchown(tmpDirRootFd.get(), -1, buildUser->getGID()) == -1) {
-            throw SysError("cannot change ownership of '%1%'", tmpDirRoot);
-        }
-        if (fchmod(tmpDirRootFd.get(), 0750) == -1) {
-            throw SysError("cannot change mode of '%1%'", tmpDirRoot);
-        }
-    }
 
     for (auto & [outputName, status] : initialOutputs) {
         /* Set scratch path we'll actually use during the build.
@@ -601,6 +535,10 @@ try {
                    to use a temporary path */
                 makeFallbackPath(status.known->path);
         scratchOutputs.insert_or_assign(outputName, scratchPath);
+        /* Schedule this scratch output path for automatic deletion
+         * if we do not cancel it, e.g. when registering the outputs.
+         */
+        scratchOutputsCleaner.insert_or_assign(outputName, worker.store.printStorePath(scratchPath));
 
         /* Substitute output placeholders with the scratch output paths.
            We'll use during the build. */
@@ -623,8 +561,6 @@ try {
             std::string h2 { scratchPath.hashPart() };
             inputRewrites[h1] = h2;
         }
-
-        redirectedOutputs.insert_or_assign(std::move(fixedFinalPath), std::move(scratchPath));
     }
 
     /* Construct the environment passed to the builder. */
@@ -1551,8 +1487,6 @@ void LocalDerivationGoal::runChild()
 
         if (getEnv("_NIX_TEST_NO_SANDBOX") != "1") {
             Strings sandboxArgs;
-            sandboxArgs.push_back("_NIX_BUILD_TOP");
-            sandboxArgs.push_back(tmpDir);
             sandboxArgs.push_back("_GLOBAL_TMP_DIR");
             sandboxArgs.push_back(globalTmpDir);
             if (allowLocalNetworking) {
@@ -2101,7 +2035,9 @@ try {
             }
 
             /* Don't register anything, since we already have the
-               previous versions which we're comparing. */
+               previous versions which we're comparing.
+               NOTE: this means that the `.check` path will be automatically deleted.
+            */
             continue;
         }
 
@@ -2125,8 +2061,13 @@ try {
         /* If it's a CA path, register it right away. This is necessary if it
            isn't statically known so that we can safely unlock the path before
            the next iteration */
-        if (newInfo.ca)
+        if (newInfo.ca) {
             TRY_AWAIT(localStore.registerValidPaths({{newInfo.path, newInfo}}));
+            /* Cancel automatic deletion of that output if it was a scratch output. */
+            if (auto cleaner = scratchOutputsCleaner.extract(outputName)) {
+                cleaner.mapped().cancel();
+            }
+        }
 
         infos.emplace(outputName, std::move(newInfo));
     }
@@ -2166,6 +2107,13 @@ try {
             infos2.insert_or_assign(newInfo.path, newInfo);
         }
         TRY_AWAIT(localStore.registerValidPaths(infos2));
+
+        /* Cancel automatic deletion of that output if it was a scratch output that we just registered. */
+        for (auto & [outputName, _ ] : infos) {
+            if (auto cleaner = scratchOutputsCleaner.extract(outputName)) {
+                cleaner.mapped().cancel();
+            }
+        }
     }
 
     /* In case of a fixed-output derivation hash mismatch, throw an
@@ -2199,6 +2147,13 @@ try {
         builtOutputs.emplace(outputName, thisRealisation);
     }
 
+    /* NOTE: At this point, all outputs MAY NOT have been registered.
+     * Therefore, there may remains auto-deleters pending in the cleaner list (`scratchOutputsCleaner`).
+     *
+     * They will be finally deleted but we have no way to assert they all have been, e.g.
+     * `assert(scratchOutputsCleaner.size() == 0)` cannot be written.
+     */
+
     co_return builtOutputs;
 } catch (...) {
     co_return result::current_exception();
@@ -2426,78 +2381,21 @@ try {
     co_return result::current_exception();
 }
 
-// make `entry` in `parentFd` visible to the given user and group, preserving
-// inode modes as much as possible. if the builder sets the mode of any inode
-// to not be readable by the owner we keep this; not doing so could interfere
-// with error analysis. if the builder used multiple uids or gids we will not
-// keep them around and instead collapse them all onto the uid/gid given here
-// to not leave around inodes owned by unassigned uids/gids in the system. we
-// also clear setuid/setgid/sticky bits just to be safe even though a builder
-// should not be able to set them to begin, otherwise we may leave setuid/gid
-// executables in the tree even with user/group set to -1/-1. there have been
-// enough bugs of this kind in the past to warrant some extra attention here.
-static void makeVisible(int parentFd, const char * entry, uid_t user, gid_t group)
+
+void LocalDerivationGoal::deleteTmpDir(bool force, bool duringDestruction)
 {
-    struct stat st;
-    if (fstatat(parentFd, entry, &st, AT_SYMLINK_NOFOLLOW)) {
-        throw SysError("fstat(%s)", guessOrInventPathFromFD(parentFd));
-    }
-    if (S_ISDIR(st.st_mode)) {
-        int dirfd = openat(parentFd, entry, O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
-        if (dirfd < 0) {
-            throw SysError("openat(%s/%s)", guessOrInventPathFromFD(parentFd), entry);
-        }
-        AutoCloseDir dir(fdopendir(dirfd));
-        if (!dir) {
-            close(dirfd);
-            throw SysError("fdopendir(%s/%s)", guessOrInventPathFromFD(parentFd), entry);
-        }
-
-        struct dirent * dirent;
-        while (errno = 0, dirent = readdir(dir.get())) {
-            if (strcmp(dirent->d_name, ".") == 0 || strcmp(dirent->d_name, "..") == 0) {
-                continue;
-            }
-            makeVisible(dirfd, dirent->d_name, user, group);
-        }
-    }
-
-    // ignore permissions errors for symlinks. linux can't chmod them.
-    // clear special permission bits while we're here, just to be safe
-    if (fchmodat(parentFd, entry, st.st_mode & 0777, AT_SYMLINK_NOFOLLOW) && !S_ISLNK(st.st_mode)) {
-        throw SysError("fchmod(%s)", guessOrInventPathFromFD(parentFd));
-    }
-    if (user != uid_t(-1) && group != gid_t(-1)
-        && fchownat(parentFd, entry, user, group, AT_SYMLINK_NOFOLLOW))
-    {
-        throw SysError("fchown(%s)", guessOrInventPathFromFD(parentFd));
-    }
-}
-
-void LocalDerivationGoal::finalizeTmpDir(bool force, bool duringDestruction)
-{
-    if (tmpDirRoot != "") {
+    if (tmpDir != "") {
         /* Don't keep temporary directories for builtins because they
            might have privileged stuff (like a copy of netrc). */
         if (settings.keepFailed && !force && !drv->isBuiltin()) {
-            printError("note: keeping build directory '%s'", tmpDirRoot);
-            try {
-                // always make visible, but don't always chown. if we run as
-                // root we may not want to chown things to root:root so much
-                auto creds = worker.store.associatedCredentials();
-                makeVisible(
-                    tmpDirFd.get(), ".", creds ? creds->user : -1, creds ? creds->group : -1
-                );
-            } catch (SysError & e) {
-                printError("error making '%s' accessible: %s", tmpDir, e.what());
-            }
-            chmod(tmpDirRoot.c_str(), 0755);
+            printError("note: keeping build directory '%s'", tmpDir);
+            chmod(tmpDir.c_str(), 0755);
         }
         else if (duringDestruction)
-            deletePathUninterruptible(tmpDirRoot);
+            deletePathUninterruptible(tmpDir);
         else
-            deletePath(tmpDirRoot);
-        tmpDirRoot = "";
+            deletePath(tmpDir);
+        tmpDir = "";
     }
 }
 

lix/libstore/build/local-derivation-goal.hh

@@ -29,12 +29,12 @@ struct LocalDerivationGoal : public DerivationGoal
     /**
      * The temporary directory.
      */
-    Path tmpDirRoot, tmpDir;
+    Path tmpDir;
 
     /**
      * The temporary directory file descriptor
      */
-    AutoCloseFD tmpDirRootFd, tmpDirFd;
+    AutoCloseFD tmpDirFd;
 
     /**
      * The path of the temporary directory in the sandbox.
@@ -100,8 +100,6 @@ struct LocalDerivationGoal : public DerivationGoal
      * Hash rewriting.
      */
     StringMap inputRewrites, outputRewrites;
-    typedef map<StorePath, StorePath> RedirectedOutputs;
-    RedirectedOutputs redirectedOutputs;
 
     /**
      * The outputs paths used during the build.
@@ -118,6 +116,19 @@ struct LocalDerivationGoal : public DerivationGoal
      *   self-references.
      */
     OutputPathMap scratchOutputs;
+    /**
+     * Output paths used during the build are scheduled for
+     * automatic cleanup unless they have been successfully built.
+     *
+     * `registerOutputs` take care of cancelling the cleanups
+     * and clearing this vector.
+     *
+     * `startBuilder` take care of filling this vector
+     * as `scratchOutputs` gets filled.
+     *
+     * This is a map from output names to automatic delete handles.
+     */
+    std::map<std::string, AutoDelete> scratchOutputsCleaner;
 
     /**
      * Path registration info from the previous round, if we're
@@ -246,12 +257,9 @@ struct LocalDerivationGoal : public DerivationGoal
     void cleanupPostOutputsRegisteredModeNonCheck() override;
 
     /**
-     * Delete the temporary directory or make it visible to the user requesting
-     * this build, if a temporary directory was created at all. Temporary files
-     * of derivations using builtin builders are deleted even for `keep-failed`
-     * builds as otherwise we may expose secrets (e.g. from the system .netrc).
+     * Delete the temporary directory, if we have one.
      */
-    void finalizeTmpDir(bool force, bool duringDestruction = false);
+    void deleteTmpDir(bool force, bool duringDestruction = false);
 
     /**
      * Forcibly kill the child process, if any.

lix/libstore/build/sandbox-defaults.sb

@@ -26,14 +26,12 @@ R""(
 ; Allow getpwuid.
 (allow mach-lookup (global-name "com.apple.system.opendirectoryd.libinfo"))
 
-; Access to /tmp and the build directory.
+; Access to /tmp.
 ; The network-outbound/network-inbound ones are for unix domain sockets, which
 ; we allow access to in TMPDIR (but if we allow them more broadly, you could in
 ; theory escape the sandbox)
 (allow file* process-exec network-outbound network-inbound
-       (literal "/tmp")
-       (subpath TMPDIR)
-       (subpath (param "_NIX_BUILD_TOP")))
+       (literal "/tmp") (subpath TMPDIR))
 
 ; Some packages like to read the system version.
 (allow file-read*

lix/libstore/build/worker.hh

@@ -195,7 +195,6 @@ public:
     Store & store;
     Store & evalStore;
     AsyncSemaphore substitutions, localBuilds;
-    std::optional<Path> buildDirOverride;
 
 private:
     kj::TaskSet children;

lix/libstore/local-store.hh

@@ -135,8 +135,6 @@ private:
 
     Sync<GCState> _gcState;
 
-    std::optional<AssociatedCredentials> association;
-
 public:
 
     const Path dbDir;
@@ -150,16 +148,6 @@ public:
     LocalStoreConfig & config() override { return config_; }
     const LocalStoreConfig & config() const override { return config_; }
 
-    std::optional<AssociatedCredentials> associatedCredentials() const override
-    {
-        return association;
-    }
-
-    void associateWithCredentials(uid_t user, gid_t group)
-    {
-        association = {user, group};
-    }
-
 private:
 
     const PublicKeys & getPublicKeys();

lix/libstore/store-api.hh

@@ -234,22 +234,6 @@ protected:
     Store(const StoreConfig & config);
 
 public:
-    struct AssociatedCredentials
-    {
-        uid_t user;
-        gid_t group;
-    };
-
-    /**
-     * Credentials of the context using this store if this store is proxied
-     * to somewhere else and the peer context is known. Only the daemon can
-     * set this to values that make any sense, using unix peer credentials.
-     */
-    virtual std::optional<AssociatedCredentials> associatedCredentials() const
-    {
-        return {};
-    }
-
     /**
      * Perform any necessary effectful operation to make the store up and
      * running

lix/nix/daemon.cc

@@ -364,17 +364,11 @@ static void daemonLoopImpl(std::optional<TrustedFlag> forceTrustClientOpt)
                     strncpy(savedArgv[1], processName.c_str(), strlen(savedArgv[1]));
                 }
 
-                auto store = aio.blockOn(openUncachedStore());
-                if (auto local = dynamic_cast<LocalStore *>(&*store); local && peer.uidKnown && peer.gidKnown) {
-                    local->associateWithCredentials(peer.uid, peer.gid);
-                }
-
                 //  Handle the connection.
                 FdSource from(remote.get());
                 FdSink to(remote.get());
-
                 processConnection(
-                    aio, store, from, to, trusted
+                    aio, aio.blockOn(openUncachedStore()), from, to, trusted
                 );
 
                 exit(0);

package.nix

@@ -135,10 +135,10 @@ let
 
   # This could be the dtrace for macOS, etc, but I have no idea if it is
   # packaged or if it works.
-  dtrace-generator = if withDtrace then systemtap-lix else null;
+  dtrace-generator = lib.optional withDtrace systemtap-lix;
 
   # This is for sys/sdt.h
-  dtrace-headers = if withDtrace then libsystemtap else null;
+  dtrace-headers = lib.optional withDtrace libsystemtap;
 
   aws-sdk-cpp-nix =
     if aws-sdk-cpp == null then
@@ -209,8 +209,6 @@ assert (lintInsteadOfBuild -> lix-clang-tidy != null);
 stdenv.mkDerivation (finalAttrs: {
   inherit pname version;
 
-  __structuredAttrs = true;
-
   src = fileset.toSource {
     root = ./.;
     fileset = fileset.intersection baseFiles (
@@ -231,6 +229,8 @@ stdenv.mkDerivation (finalAttrs: {
     );
   };
 
+  VERSION_SUFFIX = versionSuffix;
+
   outputs =
     [ "out" ]
     ++ lib.optionals (!finalAttrs.dontBuild) [
@@ -364,9 +364,9 @@ stdenv.mkDerivation (finalAttrs: {
     lixPythonForBuild
   ];
 
+  # Needed for Meson to find Boost.
+  # https://github.com/NixOS/nixpkgs/issues/86131.
   env = {
-    # Needed for Meson to find Boost.
-    # https://github.com/NixOS/nixpkgs/issues/86131.
     BOOST_INCLUDEDIR = "${lib.getDev boost}/include";
     BOOST_LIBRARYDIR = "${lib.getLib boost}/lib";
 
@@ -374,8 +374,6 @@ stdenv.mkDerivation (finalAttrs: {
     # Turns out the Nix-generated Cargo dependencies are named the same as they
     # would be in a Cargo registry cache.
     MESON_PACKAGE_CACHE_DIR = finalAttrs.cargoDeps;
-
-    VERSION_SUFFIX = versionSuffix;
   };
 
   cargoDeps = rustPlatform.importCargoLock { lockFile = ./Cargo.lock; };

tests/functional/build-remote.sh

@@ -80,4 +80,4 @@ out="$(nix-build 2>&1 failing.nix \
 [[ "$out" =~ .*"note: keeping build directory".* ]]
 
 build_dir="$(grep "note: keeping build" <<< "$out" | sed -E "s/^(.*)note: keeping build directory '(.*)'(.*)$/\2/")"
-[[ "foo" = $(<"$build_dir"/b/bar) ]]
+[[ "foo" = $(<"$build_dir"/bar) ]]

tests/functional/build.sh

@@ -174,28 +174,3 @@ test "$(<<<"$out" grep -E '^error:' | wc -l)" = 3
 <<<"$out" grepQuiet -E "error: 2 dependencies of derivation '.*-x4\\.drv' failed to build"
 <<<"$out" grepQuiet -vE "hash mismatch in fixed-output derivation '.*-x3\\.drv'"
 <<<"$out" grepQuiet -vE "hash mismatch in fixed-output derivation '.*-x2\\.drv'"
-
-# Ensure when if the system build dir is inaccessible, we can still build things
-BUILD_DIR=$(mktemp -d)
-chmod 0000 "$BUILD_DIR"
-nix --build-dir "$BUILD_DIR" build -E 'with import ./config.nix; mkDerivation { name = "test"; buildCommand = "echo rawr > $out"; }' --impure --no-link
-
-# ensure that the build directory parent is not world-accessible
-chmod 0755 "$BUILD_DIR"
-FIFO="$BUILD_DIR/fifo"
-mkfifo "$FIFO"
-(
-  echo > "$FIFO"
-  trap 'echo > "$FIFO"' EXIT
-  mode=$(stat -c %a $BUILD_DIR/b/*)
-  [ "$mode" = "700" -o "$mode" = "710" ]
-) &
-nix build --build-dir "$BUILD_DIR/b" -E '
-  with import ./config.nix; mkDerivation {
-    name = "test";
-    buildCommand = "cat '"$FIFO"'; cat '"$FIFO"' > $out";
-  }' \
-  --extra-sandbox-paths "$FIFO" \
-  --impure \
-  --no-link
-wait

tests/functional/check.sh

@@ -45,7 +45,7 @@ test_custom_build_dir() {
   [ "$status" = "100" ]
   [[ 1 == "$(count "$customBuildDir/nix-build-"*)" ]]
   local buildDir="$customBuildDir/nix-build-"*
-  grep $checkBuildId $buildDir/b/checkBuildId
+  grep $checkBuildId $buildDir/checkBuildId
 }
 test_custom_build_dir
 

tests/nixos/chown-to-user.nix

@@ -1,74 +0,0 @@
-{ lib, config, pkgs, ... }:
-
-let
-  failedNormal = config: pkgs.writeText "failed.nix" ''
-    let utils = builtins.storePath ${config.system.build.extraUtils}; in
-    derivation {
-      name = "failed";
-      system = builtins.currentSystem;
-      PATH = "''${utils}/bin";
-      builder = "''${utils}/bin/sh";
-      args = [ "-c" "mkdir dir; echo test > dir/file" ];
-    }
-  '';
-
-  failedBuiltin = pkgs.writeText "failed.nix" ''
-    derivation {
-      name = "failed";
-      system = builtins.currentSystem;
-      builder = "builtin:fetchurl";
-      url = "http://localhost/foo";
-      outputHashMode = "flat";
-    }
-  '';
-in
-{
-  name = "chown-to-user";
-
-  nodes = {
-    machine = { lib, pkgs, ... }: {
-      virtualisation.writableStore = true;
-
-      users.users.test = {
-        isNormalUser = true;
-        group = "test";
-      };
-      users.groups.test = {};
-      nix.nrBuildUsers = 1;
-    };
-  };
-
-  testScript = { nodes, ... }: ''
-    import re
-
-    machine.wait_for_unit("multi-user.target")
-
-    # builds using the daemon chown tempdirs
-    out = machine.fail("runuser -u test -- nix-build ${failedNormal nodes.machine} --keep-failed 2>&1")
-    dir = re.search("keeping build directory '(.+?)'", out)
-    assert dir
-    assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}").strip() == "root:nixbld:755"
-    assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}/b").strip() == "test:test:700"
-    assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}/b/dir").strip() == "test:test:755"
-    assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}/b/dir/file").strip() == "test:test:644"
-
-    # builds not using the daemon do not chown tempdirs
-    out = machine.fail("NIX_REMOTE=local nix-build ${failedNormal nodes.machine} --keep-failed 2>&1")
-    dir = re.search("keeping build directory '(.+?)'", out)
-    assert dir
-    assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}").strip() == "root:nixbld:755"
-    assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}/b").strip() == "nixbld1:nixbld:700"
-    assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}/b/dir").strip() == "nixbld1:nixbld:755"
-    assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}/b/dir/file").strip() == "nixbld1:nixbld:644"
-
-    # builds using builtin builders using the daemon do not keep tempdirs
-    out = machine.fail("runuser -u test -- nix-build ${failedBuiltin} --keep-failed 2>&1")
-    dir = re.search("keeping build directory '(.+?)'", out)
-    assert not dir
-
-    # builds using builtin builders not using the daemon do not keep tempdirs
-    out = machine.fail("NIX_REMOTE=local nix-build ${failedBuiltin} --keep-failed 2>&1")
-    dir = re.search("keeping build directory '(.+?)'", out)
-    assert not dir
-  '';
-}

tests/nixos/default.nix

@@ -169,6 +169,9 @@ in
 
   symlinkResolvconf = runNixOSTestFor "x86_64-linux" ./symlink-resolvconf.nix;
 
+  # Use this test to test things that cannot easily be tested under chroot Nix stores in functional test suite.
+  non-chroot-misc = runNixOSTestFor "x86_64-linux" ./non-chroot-misc;
+
   noNewPrivilegesInSandbox = runNixOSTestFor "x86_64-linux" ./no-new-privileges/sandbox.nix;
 
   noNewPrivilegesOutsideSandbox = runNixOSTestFor "x86_64-linux" ./no-new-privileges/no-sandbox.nix;
@@ -180,6 +183,4 @@ in
   io_uring = runNixOSTestFor "x86_64-linux" ./io_uring;
 
   fetchurl = runNixOSTestFor "x86_64-linux" ./fetchurl.nix;
-
-  chown-to-user = runNixOSTestFor "x86_64-linux" ./chown-to-user.nix;
 }

tests/nixos/non-chroot-misc/default.nix

@@ -0,0 +1,34 @@
+{ ... }:
+# Misc things we want to test inside of a non redirected, non chroot Nix store.
+let
+  nonAutoCleaningFailingDerivationCode = ''
+    derivation {
+      name = "scratch-failing";
+      system = builtins.currentSystem;
+      builder = "/bin/sh";
+      args = [ (builtins.toFile "builder.sh" "echo bonjour > $out; echo out: $out; false") ];
+    }
+  '';
+in
+{
+  name = "non-chroot-sandbox-misc";
+
+  nodes.machine = {
+  };
+
+  testScript = { nodes }: ''
+    import re
+    start_all()
+
+    # You might ask yourself why write such a convoluted thing?
+    # The condition for fooling Nix into NOT cleaning up the output path are non trivial and unclear.
+    # This is one of those: create a derivation, mkdir or touch the $out path, communicate it back.
+    # Even with a sandboxed Lix, you will observe leftovers before 2.93.0. After this version, this test passes.
+    result = machine.fail("""nix-build --substituters "" -E '${nonAutoCleaningFailingDerivationCode}' 2>&1""")
+    match = re.search(r'out: (\S+)', result)
+    assert match is not None, "Did not find Nix store path in the result of the failing build"
+    outpath = match.group(1).strip()
+    print(f"Found Nix store path: {outpath}")
+    machine.fail(f'stat {outpath}')
+  '';
+}

version.json

@@ -1,5 +1,5 @@
 {
-    "version": "2.93.3",
+    "version": "2.93.1",
     "official_release": true,
     "release_name": "Bici Bici"
 }