eldritch horrorsandRaito Bezarius
65c0ede1e9
although we only chown if the build was requested by a local daemon
user. daemonless invocations will not chown as they do not have to.
remote builds *can* chown to the remote builder user, but that does
not seem to happen (for some reason keep-failed is not propagated).
Change-Id: Ic0ead406b38b4ca0556fec42d84888efa25123bf
(cherry picked from commit ae3b8e58c3)
75 lines
2.6 KiB
Nix
75 lines
2.6 KiB
Nix
{ lib, config, pkgs, ... }:
|
|
|
|
let
|
|
failedNormal = config: pkgs.writeText "failed.nix" ''
|
|
let utils = builtins.storePath ${config.system.build.extraUtils}; in
|
|
derivation {
|
|
name = "failed";
|
|
system = builtins.currentSystem;
|
|
PATH = "''${utils}/bin";
|
|
builder = "''${utils}/bin/sh";
|
|
args = [ "-c" "mkdir dir; echo test > dir/file" ];
|
|
}
|
|
'';
|
|
|
|
failedBuiltin = pkgs.writeText "failed.nix" ''
|
|
derivation {
|
|
name = "failed";
|
|
system = builtins.currentSystem;
|
|
builder = "builtin:fetchurl";
|
|
url = "http://localhost/foo";
|
|
outputHashMode = "flat";
|
|
}
|
|
'';
|
|
in
|
|
{
|
|
name = "chown-to-user";
|
|
|
|
nodes = {
|
|
machine = { lib, pkgs, ... }: {
|
|
virtualisation.writableStore = true;
|
|
|
|
users.users.test = {
|
|
isNormalUser = true;
|
|
group = "test";
|
|
};
|
|
users.groups.test = {};
|
|
nix.nrBuildUsers = 1;
|
|
};
|
|
};
|
|
|
|
testScript = { nodes, ... }: ''
|
|
import re
|
|
|
|
machine.wait_for_unit("multi-user.target")
|
|
|
|
# builds using the daemon chown tempdirs
|
|
out = machine.fail("runuser -u test -- nix-build ${failedNormal nodes.machine} --keep-failed 2>&1")
|
|
dir = re.search("keeping build directory '(.+?)'", out)
|
|
assert dir
|
|
assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}").strip() == "root:nixbld:755"
|
|
assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}/b").strip() == "test:test:700"
|
|
assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}/b/dir").strip() == "test:test:755"
|
|
assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}/b/dir/file").strip() == "test:test:644"
|
|
|
|
# builds not using the daemon do not chown tempdirs
|
|
out = machine.fail("NIX_REMOTE=local nix-build ${failedNormal nodes.machine} --keep-failed 2>&1")
|
|
dir = re.search("keeping build directory '(.+?)'", out)
|
|
assert dir
|
|
assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}").strip() == "root:nixbld:755"
|
|
assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}/b").strip() == "nixbld1:nixbld:700"
|
|
assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}/b/dir").strip() == "nixbld1:nixbld:755"
|
|
assert machine.succeed(f"stat -c %U:%G:%a {dir[1]}/b/dir/file").strip() == "nixbld1:nixbld:644"
|
|
|
|
# builds using builtin builders using the daemon do not keep tempdirs
|
|
out = machine.fail("runuser -u test -- nix-build ${failedBuiltin} --keep-failed 2>&1")
|
|
dir = re.search("keeping build directory '(.+?)'", out)
|
|
assert not dir
|
|
|
|
# builds using builtin builders not using the daemon do not keep tempdirs
|
|
out = machine.fail("NIX_REMOTE=local nix-build ${failedBuiltin} --keep-failed 2>&1")
|
|
dir = re.search("keeping build directory '(.+?)'", out)
|
|
assert not dir
|
|
'';
|
|
}
|