release: 2.95.1 "Kakigōri"

Release produced with releng/create_release.xsh

Change-Id: I07101abfa767a38e61d693b4b3c8cb8493d9fe1e

doc/manual/src/release-notes/rl-2.95.md

@@ -1,4 +1,22 @@
 # Lix 2.95 "Kakigōri" (2026-03-13)
+# Lix 2.95.1 (2026-03-19)
+## Fixes
+
+- fix static builds [cl/5385](https://gerrit.lix.systems/c/lix/+/5385)
+
+  Static builds using musl were broken in 2.95.0 and should work again now.
+
+  Many thanks to [eldritch horrors](https://git.lix.systems/pennae) for this.
+
+- flake config warnings are now printed to stderr [lix#1155](https://git.lix.systems/lix-project/lix/issues/1155) [cl/5379](https://gerrit.lix.systems/c/lix/+/5379)
+
+  The settings listed in a flake-config confirmation prompt are now printed to stderr rather than stdout, which allows `nix print-dev-env` to emit valid bash again even in the presence of untrusted settings.
+
+  Many thanks to [lheckemann](https://git.lix.systems/lheckemann) for this.
+
+
+
+
 
 
 # Lix 2.95.0 (2026-03-13)

flake.nix

@@ -219,6 +219,9 @@
             inherit versionSuffix officialRelease;
             stdenv = currentStdenv;
             busybox-sandbox-shell = final.busybox-sandbox-shell or final.default-busybox-sandbox-shell;
+            # See below
+            lowdown = final.lowdown_3_0;
+            lowdown-unsandboxed = final.lowdown_3_0.override { enableDarwinSandbox = false; };
           };
 
           lix-clang-tidy = final.callPackage ./subprojects/lix-clang-tidy { };
@@ -245,9 +248,21 @@
           # And same thing for our build-release-notes package.
           build-release-notes = final.nix.passthru.build-release-notes;
 
-          lowdown =
-            assert lib.versionAtLeast prev.lowdown.version "2.0.0";
-            prev.lowdown;
+          # As soon as Nixpkgs updates to >= 3.0.0, change to lowdown_2_0!
+          # We don't change the default version in order to not change the hash
+          # of Nix/Lix from upstream Nixpkgs.
+          lowdown_3_0 =
+            assert lib.versionOlder prev.lowdown.version "3.0.0";
+            prev.lowdown.overrideAttrs (
+              finalAttrs: _prevAttrs: {
+                version = "3.0.0";
+
+                src = final.fetchurl {
+                  url = "https://kristaps.bsd.lv/lowdown/snapshots/lowdown-${finalAttrs.version}.tar.gz";
+                  sha512 = "94e97234d598382c3c3dc27f9bfdb3a3a2fcf7dbb6a8df3c85ee09f27f792449034a41d49d9cfd3d8450d2de01b8562c20c3d120e65c81af4d7d6c9454119e93";
+                };
+              }
+            );
 
           capnproto = prev.capnproto.overrideAttrs (old: {
             patches =
@@ -275,6 +290,15 @@
         # Binary package for various platforms.
         build = forAllSystems (system: self.packages.${system}.nix);
 
+        # Ensure support for lowdown < 3.0 doesn't regress for NixOS 25.11
+        build-lowdown_2_0.aarch64-linux = lib.genAttrs [ "aarch64-linux" ] (
+          system:
+          self.packages.${system}.nix.override {
+            lowdown = nixpkgsFor.${system}.native.lowdown;
+            lowdown-unsandboxed = nixpkgsFor.${system}.native.lowdown-unsandboxed;
+          }
+        );
+
         # Building Lix twice in CI is expensive, but we can catch a lot of static
         # build regressions by at least making sure it evals and configures.
         configure-static = lib.genAttrs linux64BitSystems (

lix/code-generation/build_builtins.py

@@ -52,7 +52,7 @@ class Builtin:
             </dt>
             <dd>
 
-            {indent(self.documentation, "    " * 3)}
+{indent(self.documentation, "    " * 3)}
 
             {
             f"This function is only available if the [{self.experimental_feature}](@docroot@/contributing/experimental-features.md#xp-feature-{self.experimental_feature}) experimental feature is enabled."

lix/code-generation/build_settings.py

@@ -90,7 +90,7 @@ class Setting:
         aliases = [f"`{item}`" for item in self.aliases]
         description = dedent(f"""
 
-            {indent(indentation, self.documentation)}
+{indent(indentation, self.documentation)}
 
             {indent(indentation, PLATFORM_WARNING.format(platforms=str(platforms)[1:-1])) if self.platforms else ""}
             {indent(indentation, XP_WARNING.format(feature=self.experimental_feature, name=self.name)) if self.experimental_feature is not None else ""}

lix/libcmd/markdown.cc

@@ -74,7 +74,11 @@ std::string renderMarkdownToTerminal(std::string_view markdown, StandardOutputSt
         .vmargin = 0,
 #endif /* LOWDOWN_SEPARATE_TERM_OPTS */
         .feat = LOWDOWN_COMMONMARK | LOWDOWN_FENCED | LOWDOWN_DEFLIST | LOWDOWN_TABLES,
+#ifdef LOWDOWN_CONSOLIDATED_OFLAGS
+        .oflags = LOWDOWN_NOLINK,
+#else
         .oflags = LOWDOWN_TERM_NOLINK,
+#endif /* LOWDOWN_CONSOLIDATED_OFLAGS */
     };
     if (!shouldANSI(fileno)) {
         opts.oflags |= LOWDOWN_TERM_NOANSI;

lix/libexec/launch-builder-linux.cc

@@ -3,6 +3,7 @@
 #include "lix/libutil/rpc.hh"
 #include <cassert>
 #include <csignal>
+#include <fcntl.h>
 #include <filesystem>
 #include <format>
 #include <kj/io.h>
@@ -224,7 +225,11 @@ bool prepareChildSetup(build::Request::Reader request)
                     };
             const fs::path dst = chrootRootDir / target.relative_path();
             fs::create_directories(dst.parent_path());
-            writeFile(dst, std::string_view((const char *) sh, sizeof(sh)));
+            kj::AutoCloseFd fd(open(dst.c_str(), O_RDWR | O_CREAT, 0755));
+            if (fd == nullptr) {
+                throw SysError("cannot create sandbox shell");
+            }
+            writeFull(fd.get(), std::string_view((const char *) sh, sizeof(sh)));
             fs::permissions(dst, fs::perms(0555));
         } else
 #endif

lix/libexpr/flake/config.cc

@@ -35,12 +35,14 @@ static bool batchAskForSetting(
     TrustedList & trustedList,
     std::map<std::string, std::string> & untrustedSettings)
 {
-    printWarning("The following settings require your decision:");
+    std::string warning("The following settings require your decision:");
     for (const auto & [name, valueS] : untrustedSettings) {
         // FIXME: filter ANSI escapes, newlines, \r, etc.
-        logger->cout("- %s = %s", name, valueS);
+        warning += fmt("\n- %s = %s", name, valueS);
     }
 
+    printWarning("%s", warning);
+
     auto reply = logger
                      ->ask(
                          fmt("Do you want to allow configuration settings to be applied?\nThis may allow the "

lix/libstore/platform/linux.cc

@@ -1348,7 +1348,10 @@ Pid LinuxLocalDerivationGoal::startChild(AutoCloseFD setupFD, AutoCloseFD logPTY
             (wantUserNS ? CLONE_NEWUSER : 0) | (wantNetNS ? CLONE_NEWNET : 0) | CLONE_VM | CLONE_FILES,
             []() -> int {
                 for (;;) {
-                    raise(SIGSTOP);
+                    // NOTE: musl apparently caches the pid of the process, which fucks with raise().
+                    // we must explicitly use getpid() to bypass this cache instead of using raise; a
+                    // raise(SIGSTOP) would stop the *daemon* process, and this breaks sandbox setup.
+                    kill(getpid(), SIGSTOP);
                 }
             }
         )};

lix/lix-doc/meson.build

@@ -20,8 +20,6 @@ lix_doc = static_library(
     rnix,
   ],
   rust_args : [
-    # Empty when default_library=static
-    rust_dynamic_args,
     lix_doc_rust_args,
   ],
 )

meson.build

@@ -383,6 +383,11 @@ if lowdown.version().version_compare('>= 1.4.0')
   add_project_arguments('-DLOWDOWN_SEPARATE_TERM_OPTS', language: 'cpp')
 endif
 
+# TODO(sterni): drop the corresponding #ifdef after NixOS 25.11 is EOL which still distributes lowdown < 3.0.0
+if lowdown.version().version_compare('>= 3.0.0')
+  add_project_arguments('-DLOWDOWN_CONSOLIDATED_OFLAGS', language: 'cpp')
+endif
+
 # HACK(Qyriad): rapidcheck's pkg-config doesn't include the libs lol
 # Note: technically we 'check' for rapidcheck twice, for the internal-api-docs handling above,
 # but Meson will cache the result of the first one, and the required : arguments are different.

package.nix

@@ -366,7 +366,10 @@ stdenv.mkDerivation (finalAttrs: {
       "-Dc_link_args=-fuse-ld=lld"
       "-Dcpp_link_args=-fuse-ld=lld"
     ]
-    ++ lib.optional hostPlatform.isStatic "-Denable-embedded-sandbox-shell=true"
+    ++ lib.optionals hostPlatform.isStatic [
+      "-Denable-embedded-sandbox-shell=true"
+      "-Denable-contrib-plugins=false"
+    ]
     ++ lib.optional ciBuildAndDeleteBothLibraries "-Ddefault_library=both"
     # musl doesn't support fibers, and we can't detect this with meson alone.
     ++ lib.optional hostPlatform.isMusl "-Ddisable-fibers=true"

version.json

@@ -1,5 +1,5 @@
 {
-    "version": "2.95.0",
-    "official_release": false,
+    "version": "2.95.1",
+    "official_release": true,
     "release_name": "Kakigōri"
 }