1
1
Fork 0
mirror of https://github.com/NixOS/nix.git synced 2025-11-20 09:19:36 +01:00
Commit graph

12550 commits

Author SHA1 Message Date
gustavderdrache
e2ef2cfcbc Address ifdef problem with macOS/BSD sandboxing 2025-07-11 18:09:07 -04:00
Sergei Zimmerman
6e78cc90d3
libexpr: Fix invalid handling of errors for imported functions
c39cc00404 has added assertions for
all Value accesses and the following case has started failing with
an `unreachable`:

(/tmp/fun.nix):

```nix
{a}: a
```

```
$ nix eval --impure --expr 'import /tmp/fun.nix {a="a";b="b";}'
```

This would crash:

```
terminating due to unexpected unrecoverable internal error: Unexpected condition in getStorage at ../include/nix/expr/value.hh:844
```

This is not a regression, but rather surfaces an existing problem, which previously
was left undiagnosed. In the case of an import `fun` is the `import` primOp, so that read is invalid
and previously this resulted in an access into an inactive union member, which is UB.
The correct thing to use is `vCur`. Identical problem also affected the case of a missing argument.

Add previously failing test cases to the functional/lang test suite.

Fixes #13448.
2025-07-11 20:20:48 +03:00
Eelco Dolstra
a783468333
Merge pull request #13444 from roberth/fix-lessThan-doc
Fix `builtins.lessThan` doc
2025-07-10 20:32:47 +02:00
Robert Hensing
fc03b89ff4 Fix lessThan doc 2025-07-10 17:50:43 +02:00
Eelco Dolstra
ca9f2028b0 Simplify SymbolTable::create() 2025-07-10 12:28:34 +02:00
Eelco Dolstra
74a144ce98 Require Boost 1.81.0 or higher
Note: this version of Boost was released in December 2022.
2025-07-10 11:53:36 +02:00
Eelco Dolstra
aa18dc54dc fetchClosure: Fix gcc warning
Fixes:

[261/394] Linking target src/libexpr/libnixexpr.so
In function ‘copy’,
    inlined from ‘__ct ’ at /nix/store/24sdvjs6rfqs69d21gdn437mb3vc0svh-gcc-14.2.1.20250322/include/c++/14.2.1.20250322/bits/basic_string.h:688:23,
    inlined from ‘operator+’ at /nix/store/24sdvjs6rfqs69d21gdn437mb3vc0svh-gcc-14.2.1.20250322/include/c++/14.2.1.20250322/bits/basic_string.h:3735:43,
    inlined from ‘operator()’ at ../src/libexpr/primops/fetchClosure.cc:127:58,
    inlined from ‘prim_fetchClosure’ at ../src/libexpr/primops/fetchClosure.cc:132:88:
/nix/store/24sdvjs6rfqs69d21gdn437mb3vc0svh-gcc-14.2.1.20250322/include/c++/14.2.1.20250322/bits/char_traits.h:427:56: warning: ‘__builtin_memcpy’ writing 74 bytes into a region of size 16 overflows the destination [-Wstringop-overflow=]
  427 |         return static_cast<char_type*>(__builtin_memcpy(__s1, __s2, __n));
      |                                                        ^
../src/libexpr/primops/fetchClosure.cc: In function ‘prim_fetchClosure’:
../src/libexpr/primops/fetchClosure.cc:132:88: note: at offset 16 into destination object ‘<anonymous>’ of size 32
  132 |             fromPath = state.coerceToStorePath(attr.pos, *attr.value, context, attrHint());
      |                                                                                        ^
2025-07-10 11:41:32 +02:00
tomberek
485cbfc7f1
Merge pull request #13437 from NixOS/respect-transitive-locks
lockFlake(): When updating a lock, respect the input's lock file
2025-07-10 00:28:55 -04:00
Sergei Zimmerman
b19e9acc03
Merge pull request #13402 from DavHau/build-cores
build-cores: detect cores automatically if set to 0
2025-07-09 23:06:55 +03:00
Eelco Dolstra
95437b90fc lockFlake(): When updating a lock, respect the input's lock file 2025-07-09 19:19:15 +02:00
Connor Baker
a16491375a
globals.hh: fix broken link to nspawn example
The substitution included the `.` at the end of the URL, breaking it.
2025-07-08 12:59:16 -07:00
John Ericson
cf0df2607d
Merge pull request #13240 from obsidiansystems/dyn-drv-take-3
Get rid of `addWantedOutputs`
2025-07-07 11:39:45 -04:00
Robert Hensing
9f8df6878f doc: Add more links
Mostly in the 2.30 release notes
2025-07-07 16:47:02 +02:00
Eelco Dolstra
864ccb6e63
Merge pull request #13356 from SimSaladin/sim/fix-erase-output-paths
fix throwing output paths out of sandbox paths
2025-07-07 12:15:23 +02:00
Robert Hensing
c512fd1a4b
Merge pull request #13420 from NixOS/query-missing
Introduce MissingPaths struct for queryMissing() / printMissing()
2025-07-07 11:48:06 +02:00
Eelco Dolstra
7781560724 libstore-tests: Fix impurity trying to access the Nix daemon
This failed on macOS:

  nix-store-tests-run> C++ exception with description "../nix_api_store.cc:33: nix_err_code(ctx) != NIX_OK, message: error: getting status of '/nix/var/nix/daemon-socket/socket': Operation not permitted" thrown in the test body.
2025-07-07 11:42:20 +02:00
Eelco Dolstra
f29acd5bbc Use writableTmpDirAsHomeHook 2025-07-07 11:12:55 +02:00
Eelco Dolstra
01388b3e78 Give unit tests access to a $HOME directory
Also, don't try to access cache.nixos.org in the libstore unit tests.
2025-07-07 11:02:51 +02:00
DavHau
fb5e22e318 build-cores: detect cores automatically if set to 0
This changes makes nix detect a machines available cores automatically whenever build-cores is set to 0.

So far, nix simply passed NIX_BUILD_CORES=0 whenever build-cores is set to 0. (only when build-cores is unset it was detecting cores automatically)

The behavior of passing NIX_BUILD_CORES=0 leads to a performance penalty when sourcing nixpkgs' generic builder's `setup.sh`, as setup.sh has to execute `nproc`. This significantly slows down sourcing of setup.sh
2025-07-07 10:33:42 +07:00
Eelco Dolstra
f039f6886a nix-build: Drop unnecessary call to queryMissing()
This is already done by Worker::run().
2025-07-04 16:34:34 +02:00
Eelco Dolstra
5d308ccca5 printMissing(): Take a MissingPaths argument 2025-07-04 16:34:30 +02:00
Eelco Dolstra
af05ce0f6d queryMissing(): Return a struct
...instead of having a bunch of pass-by-reference arguments.
2025-07-04 16:34:24 +02:00
Eelco Dolstra
eb97d8c170 Fix indentation of "Unable to start any build" error message
The use of R"(...)" added a bunch of unnecessary whitespace, e.g.

  error:
                             Unable to start any build;
                             either increase '--max-jobs' or enable remote builds.

                             For more information run 'man nix.conf' and search for '/machines'.

Now we get

  error: Unable to start any build; either increase '--max-jobs' or enable remote builds.

         For more information run 'man nix.conf' and search for '/machines'.
2025-07-04 15:21:31 +02:00
Eelco Dolstra
d4f67fd46d
Merge pull request #13369 from NixOS/null-revision-not-locked
Git fetcher: Do not consider a null revision (i.e. workdir) to be locked
2025-07-03 19:56:21 +02:00
Sergei Zimmerman
5a20a48f13
libexpr: Reduce the size of Value down to 16 bytes
This shaves off a very significand amount of memory used
for evaluation as well as reduces the GC-managed heap.

Previously the union discriminator (InternalType) was
stored as a separate field in the Value, which takes up
whole 8 bytes due to padding needed for member alignment.
This effectively wasted 7 whole bytes of memory. Instead
of doing that InternalType is instead packed into pointer
alignment niches. As it turns out, there's more than enough
unused bits there for the bit packing to be effective.

See the doxygen comment in the ValueStorage specialization
for more details.

This does not add any performance overhead, even though
we now consistently assert the InternalType in all getters.

This can also be made atomic with a double width compare-and-swap
instruction on x86_64 (CMPXCHG16B instruction) for parallel evaluation.
2025-07-02 22:27:37 +03:00
Sergei Zimmerman
e73fcf7b53
libexpr: Use proxy ListView for all Value list accesses
This also makes it possible to make `payload` field private
in the `ValueStorage` class template.
2025-07-02 21:57:02 +03:00
Sergei Zimmerman
c39cc00404
libexpr: Factor out Payload union to a default implementation of ValueStorage
This factors out most of the value representation into a mixin class.
`finishValue` is now gone for good and replaced with a simple template
function `setStorage` which derives the type information/disriminator from
the type of the argument. Likewise, reading of the value goes through function
template `getStorage`.

An empty type `Null` is introduced to make the bijection InternalType <-> C++ type
complete.
2025-07-02 21:51:15 +03:00
Sergei Zimmerman
810455f1b8
libexpr: Simplify Value::is* methods by introducing isa function template 2025-07-02 21:51:12 +03:00
Sergei Zimmerman
1a033ee4ee
libexpr: Use single tSmallList Value discriminator for small lists 2025-07-02 21:51:09 +03:00
Sergei Zimmerman
ea32580c9b
libexpr: Format value.hh
The following commits will touch this file significantly, so
it's better to get the formatting out of the way first.
2025-07-02 21:51:07 +03:00
Robert Hensing
04a731b4b9
Merge pull request #13387 from NaN-git/opt-listToAttrs
libexpr: don't allocate additional set in `builtins.listToAttrs`
2025-07-02 11:55:39 +02:00
Sergei Zimmerman
d16af1d099
libfetchers: Add missing include guard to git-lfs-fetch.hh
This is a publicly installed header without a header guard.
Doesn't seem right.
2025-07-02 00:57:35 +03:00
Eelco Dolstra
5879ab1577
Merge pull request #13400 from NixOS/fix-deep-overrides
Fix deep flake input overrides
2025-07-01 19:34:55 +02:00
Eelco Dolstra
4458a9061b
Merge pull request #13406 from xokdvium/libflake-dead-code
libflake: Remove unused maybeParseFlakeRef and maybeParseFlakeRefWith…
2025-07-01 17:03:00 +02:00
Sergei Zimmerman
8708e9a526
libutil: Use caching directory_entry API in PosixSourceAccessor::readDirectory
Previous use of symlink_status() always translated into a stat call, leading
to huge performance penalties for by-name-overlay in nixpkgs. The comment
below references the possible caching, but that seemed to be erroneous, since
the correct way to make use of the caching API is by calling a bunch of `is_*`
functions [1]. For example, here's how libstdc++ does that [2], [3].

This translates to great nixpkgs eval performance improvements:

```
Benchmark 1: GC_INITIAL_HEAP_SIZE=4G result/bin/nix-instantiate ../nixpkgs -A hello --readonly-mode
  Time (mean ± σ):     186.7 ms ±   6.7 ms    [User: 121.3 ms, System: 64.9 ms]
  Range (min … max):   179.4 ms … 201.6 ms    16 runs

Benchmark 2: GC_INITIAL_HEAP_SIZE=4G nix-instantiate ../nixpkgs -A hello --readonly-mode
  Time (mean ± σ):     230.6 ms ±   5.0 ms    [User: 126.9 ms, System: 103.1 ms]
  Range (min … max):   225.1 ms … 241.4 ms    13 runs
```

[1]: https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2016/p0317r1.html
[2]: 8ea555b7b4/libstdc%2B%2B-v3/include/bits/fs_dir.h (L341-L348)
[3]: 8ea555b7b4/libstdc%2B%2B-v3/include/bits/fs_dir.h (L161-L163)
2025-06-30 23:29:07 +03:00
Philipp Otterbein
fa3d7e6f68 libexpr: don't allocate additional set in builtins.listToAttrs 2025-06-29 01:41:16 +02:00
Sergei Zimmerman
75412ebc30
libflake: Remove unused maybeParseFlakeRef and maybeParseFlakeRefWithFragment
These wrappers don't seem to be used anywhere in and out of tree.
Also the declaration in the header has an incorrect function name `maybeParseFlake`.

Closes #11948
2025-06-27 23:33:54 +03:00
Eelco Dolstra
eaced1e0d2 Move FlakeCommand into a header, allow separate registration of subcommands
This allows us to start splitting up src/nix/flake.cc.
2025-06-26 17:14:32 +02:00
Eelco Dolstra
b415faceca Don't allow flake inputs to have both a flakeref and a follows
Having both doesn't make sense so it's best to disallow it. If this
causes issues we could turn into a warning.
2025-06-26 12:56:54 +02:00
Eelco Dolstra
7c0ea143d8 Fix deep overrides
An override like

  inputs.foo.inputs.bar.inputs.nixpkgs.follows = "nixpkgs";

implicitly set `inputs.foo.inputs.bar` to `flake:bar`, which led to an
unexpected error like

  error: cannot find flake 'flake:bar' in the flake registries

We now no longer create a parent override (like for `foo.bar` in the
example above) if it doesn't set an explicit ref or follows
attribute. We only recursively apply its child overrides.

Fixes https://github.com/NixOS/nix/issues/8325, https://github.com/DeterminateSystems/nix-src/issues/95, https://github.com/NixOS/nix/issues/12083, https://github.com/NixOS/nix/issues/5790.
2025-06-26 12:56:39 +02:00
Sergei Zimmerman
55d12dfc5d
libstore-tests: Don't leak memory in tests
We shouldn't leak memory in unit tests in order
to make enabling ASAN easier.
2025-06-25 00:07:58 +03:00
Eelco Dolstra
448cfb71ea Merge remote-tracking branch 'cve/fod-cves-master' 2025-06-24 16:02:58 +02:00
Robert Hensing
6a74590063
Merge pull request #13388 from NaN-git/opt-string_view
libexpr: further removal of `std::string` copies
2025-06-23 09:05:28 +02:00
Eelco Dolstra
37685b1c9c Fix Darwin test failure in repl.sh
Fixes

  error:
         … while processing sandbox path '/private/tmp/nix-shell.0MDgyx/nix-test/ca/repl/store/nix/var/nix/builds/nix-build-simple.drv-65916-3910734210' (/private/tmp/nix-shell.0MDgyx/nix-test/ca/repl/store)

         error: 'nix' is too short to be a valid store path

which happened because we were now putting the build directory
underneath the store directory.
2025-06-22 16:49:44 +02:00
Eelco Dolstra
2e2fe4cb07 Cleanup 2025-06-22 16:49:44 +02:00
Eelco Dolstra
5acf50a327 Disallow the build directory having world-writable parents 2025-06-22 16:49:44 +02:00
eldritch horrors
88b7db1ba4 libstore: Don't default build-dir to temp-dir, store setting
If a build directory is accessible to other users it is possible to
smuggle data in and out of build directories. Usually this is only
a build purity problem, but in combination with other issues it can
be used to break out of a build sandbox. to prevent this we default
to using a subdirectory of nixStateDir (which is more restrictive).

(cherry picked from pennae Lix commit 55b416f6897fb0d8a9315a530a9b7f0914458ded)
(store setting done by roberth)
2025-06-22 16:49:44 +02:00
Eelco Dolstra
9af4c267c6 Chown structured attr files safely 2025-06-22 16:48:34 +02:00
Eelco Dolstra
a4b5584fb1 Replace 'bool sync' with an enum for clarity
And drop writeFileAndSync().
2025-06-22 16:48:34 +02:00
Eelco Dolstra
479c356510 Drop guessOrInventPathFromFD()
No need to do hacky stuff like that when we already know the original path.
2025-06-22 16:48:34 +02:00