maurice/snix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
9265 commits 1 branch 0 tags 188 MiB
Commit graph

9265 commits

This branch
This branch
All branches
Author SHA1 Message Date
Eelco Dolstra
197922ea4e
Merge pull request #1646 from copumpkin/optional-sandbox-local-network 
Allow optional localhost network access to sandboxed derivations
 2017-10-30 18:54:40 +01:00
Dan Peebles
4a4a009f78 Allow optional localhost network access to sandboxed derivations 
This will allow bind and connect to 127.0.0.1, which can reduce purity/
security (if you're running a vulnerable service on localhost) but is
also needed for a ton of test suites, so I'm leaving it turned off by
default but allowing certain derivations to turn it on as needed.

It also allows DNS resolution of arbitrary hostnames but I haven't found
a way to avoid that. In principle I'd just want to allow resolving
localhost but that doesn't seem to be possible.

I don't think this belongs under `build-use-sandbox = relaxed` because we
want it on Hydra and I don't think it's the end of the world.
 2017-10-30 17:59:12 +01:00
Eelco Dolstra
f90f660b24
Don't parse "x:x" as a URI 
URIs now have to contain "://" or start with "channel:".
 2017-10-30 17:58:01 +01:00
Tyson Whitehead
07d2c6d213
Fix (highly unlikely) race condition in readLink 
Used to determine symlink size with stat and value with readlink.
This could technically result in garbage if symlink changed between
calls.  Also gets around the broken stat implementation in our
network filesystem (returns size + 1 giving a byte of garbage).
 2017-10-30 11:49:55 -04:00
Eelco Dolstra
12991152be
nix-build: Fix --hash 2017-10-30 13:31:05 +01:00
Eelco Dolstra
63c80ae26f
Make "fetchGit /path" work 2017-10-30 13:18:28 +01:00
Eelco Dolstra
a5c392a80e
fetchGit: Fix broken assertion 
Different URIs can map to the same cache entry if they have the same
revision.
 2017-10-30 12:55:46 +01:00
Eelco Dolstra
812e027e1d
Add option allowed-uris 
This allows network access in restricted eval mode.
 2017-10-30 12:41:49 +01:00
Eelco Dolstra
f1c555cef8
fetchurl/fetchTarball are *not* allowed in restricted mode 
Accidentally committed this change as part of
f9686885be.

Restricted mode != pure mode.
 2017-10-30 12:41:48 +01:00
Domen Kožar
5cb78053f0
Merge pull request #1633 from orivej/doc 
Update the language documentation
 2017-10-30 12:21:54 +01:00
Eelco Dolstra
e38382895d
builtins.fetchGit: Return an attrset with revision info 
This adds rev, shortRev and revCount attributes, equal to what Hydra
provides. E.g.

  $ nix eval '(fetchGit https://github.com/NixOS/patchelf.git)'
  { outPath = "/nix/store/ghigrkw02l440g8vfxa9wj4c3zpfmw99-source"; rev = "29c085fd9d3fc972f75b3961905d6b4ecce7eb2b"; revCount = 303; shortRev = "29c085f"; }
 2017-10-30 11:49:03 +01:00
Eelco Dolstra
f9686885be
enable-http2 -> http2 2017-10-30 11:00:59 +01:00
Eelco Dolstra
049322702b
fetchgit -> fetchGit 
Almost all other primops are camelCase so no reason not to use that
here.
 2017-10-30 10:25:08 +01:00
Eelco Dolstra
23ce4b3393
fetchTarball: Use "source" as the default name 
This ensures that it produces the same output as fetchgit:

  $ nix eval --raw '(builtins.fetchgit https://github.com/NixOS/patchelf.git)'
  /nix/store/ghigrkw02l440g8vfxa9wj4c3zpfmw99-source

  $ nix eval --raw '(fetchTarball https://github.com/NixOS/patchelf/archive/master.tar.gz)'
  /nix/store/ghigrkw02l440g8vfxa9wj4c3zpfmw99-source
 2017-10-30 10:22:58 +01:00
Eelco Dolstra
66ddbef754
fetchurl/fetchTarball: Respect name changes 
The computation of urlHash didn't take the name into account, so
subsequent fetchurl calls with the same URL but a different name would
resolve to the same cached store path.
 2017-10-30 10:22:58 +01:00
Eelco Dolstra
f25791c196
builtins.fetchgit: Don't mess up the progress indicator 2017-10-30 10:22:58 +01:00
Eelco Dolstra
65b5f177b5
builtins.fetchgit: Support a "name" attribute 
The "name" attribute defaults to "source", which we should use for all
similar functions (e.g. fetchTarball and in Hydra) to ensure that we
get a consistent store path regardless of how the tree is fetched.

"source" is not necessarily a correct label, but using an empty name
is problematic: you get an ugly store path ending in a dash, and it's
impossible to have a fixed-output derivation that produces that path
because ".drv" is not a valid store name.

Fixes #904.
 2017-10-30 10:22:07 +01:00
Vincent Ambo
cd2f1fdabb feat(pkgs): Enable Evolution & GNOME key ring 2017-10-30 00:30:12 +01:00
Vincent Ambo
bc49e60663 feat(dns): Point MX record at Runbox 2017-10-29 23:11:23 +01:00
Eelco Dolstra
c1ae18941a
nix repl :t: Indicate strings that have a context 2017-10-29 17:11:22 +01:00
Vincent Ambo
197f33574e fix(adho): Use 5Ghz network at home 2017-10-29 16:47:22 +01:00
Vincent Ambo
d22510b15f feat(adho): Install Steam 2017-10-29 16:47:05 +01:00
Vincent Ambo
bd03e639bf refactor main: Reword empty/nonexistent resource set warning 2017-10-27 02:55:41 +02:00
Vincent Ambo
9cffd3d1d4 refactor templater: Add explicit note about empty-rs warnings 
Due to an interesting combination of an error not being handled and Go
initialising everything with what it thinks should be the default,
non-existent resource sets have been gracefully handled already.

This makes this accidental fix explicit.

Fixes #90
 2017-10-27 02:55:41 +02:00
Vincent Ambo
2574942338 fix main: Do not stop templater if a single resource set is empty 
This fixes #91
 2017-10-27 02:55:41 +02:00
Orivej Desh
842ce8bafd Clarify indented string escaping rules 2017-10-26 18:53:36 +00:00
Orivej Desh
15457c5673 Describe "with" scoping precedence 2017-10-26 18:53:36 +00:00
Orivej Desh
e5c499b833 Describe arithmetic operators 2017-10-26 18:53:35 +00:00
AmineChikhaoui
0f9a7225ab respect SIGINT in nix copy during the paths queries #1629 2017-10-25 16:51:45 +01:00
AmineChikhaoui
54a2cd9ce4 Merge branch 'master' of github.com:NixOS/nix into sigint-copy 2017-10-25 16:50:52 +01:00
Vincent Ambo
dfe1f191a9 docs: Update README with setup instructions 2017-10-25 17:22:29 +02:00
Eelco Dolstra
9971d875a4
Fix building on clang 
https://hydra.nixos.org/build/62945761
 2017-10-25 17:20:47 +02:00
Vincent Ambo
fa224c48d9 feat(pkgs): Install dnsutils 2017-10-25 17:20:24 +02:00
Vincent Ambo
52dffda4c0 feat(adho): Add phone-tethering network 2017-10-25 17:20:06 +02:00
AmineChikhaoui
9f01a3f0a8 attempt to fix #1630: make the queries of store paths run in parallel using a thread pool 2017-10-25 16:13:49 +01:00
Eelco Dolstra
82327e3cc4
exportReferencesGraph: Allow exporting a list of store paths 2017-10-25 15:18:49 +02:00
Eelco Dolstra
8191992c83
Bump language version 2017-10-25 15:18:37 +02:00
Eelco Dolstra
3395e3bbc4
Fix exportReferencesGraph in the structured attrs case 2017-10-25 14:08:29 +02:00
Eelco Dolstra
2d5b1b24bf
Pass lists/attrsets to bash as (associative) arrays 2017-10-25 13:01:50 +02:00
Eelco Dolstra
ac12517f3e
Fix RPM build 2017-10-24 15:44:29 +02:00
Eelco Dolstra
86aab6e9a0
Add --store argument to legacy commands 2017-10-24 15:41:11 +02:00
Eelco Dolstra
d16fd24973
Allow shorter syntax for chroot stores 
You can now say '--store /tmp/nix' instead of '--store local?root=/tmp/nix'.
 2017-10-24 15:32:38 +02:00
Eelco Dolstra
3460e4cf00
More progress indicator improvements 
In particular, don't show superfluous "fetching path" and "building
path(s)" messages, and show the current round (with --repeat).
 2017-10-24 15:32:38 +02:00
Eelco Dolstra
96051dd057
More progress indicator improvements 
Fixes #1599.
 2017-10-24 14:47:23 +02:00
Eelco Dolstra
be220702a7
Progress indicator: Show on what machine we're building 
E.g.

  $ nix build nixpkgs.hello --builders 'root@wendy'
  [1/0/1 built] building hello-2.10 on ssh://root@wendy: checking for minix/config.h... no
 2017-10-24 14:24:57 +02:00
Eelco Dolstra
f8624762ac
build-remote: Work properly on a chrooted store 2017-10-24 14:14:28 +02:00
Eelco Dolstra
fe9d2f974d
Handle log messages from build-remote 
This makes the progress indicator show statuses like "connecting to
'root@machine'".
 2017-10-24 14:05:22 +02:00
Eelco Dolstra
0d59f1ca49
nix: Respect -I, --arg, --argstr 
Also, random cleanup to argument handling.
 2017-10-24 12:58:34 +02:00
Eelco Dolstra
25f32625e2
Remove the remote-builds option 
This is superfluous since you can now just set "builders" to empty,
e.g. "--builders ''".
 2017-10-24 11:00:16 +02:00
Eelco Dolstra
af241ae7d3
Remove the builder-files option 
You can now include files via the "builders" option, using the syntax
"@<filename>". Having only one option makes it easier to override
builders completely.

For backward compatibility, the default is "@/etc/nix/machines", or
"@<filename>" for each file name in NIX_REMOTE_SYSTEMS.
 2017-10-24 10:54:43 +02:00