1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-07-10 04:43:53 +02:00

Merge remote-tracking branch 'origin/master' into relative-flakes

This commit is contained in:
Eelco Dolstra 2024-12-18 21:09:27 +01:00
commit 8534c4222c
263 changed files with 2129 additions and 805 deletions

View file

@ -8,6 +8,7 @@ TODO_NixOS
restartDaemon
requireSandboxSupport
requiresUnprivilegedUserNamespaces
[[ $busybox =~ busybox ]] || skipTest "no busybox"
unset NIX_STORE_DIR

View file

@ -5,6 +5,7 @@
# shellcheck disable=SC2154
requireSandboxSupport
requiresUnprivilegedUserNamespaces
[[ "$busybox" =~ busybox ]] || skipTest "no busybox"
unset NIX_STORE_DIR

View file

@ -3,6 +3,7 @@
: "${file?must be defined by caller (remote building test case using this)}"
requireSandboxSupport
requiresUnprivilegedUserNamespaces
[[ "${busybox-}" =~ busybox ]] || skipTest "no busybox"
# Avoid store dir being inside sandbox build-dir
@ -27,6 +28,7 @@ builders=(
chmod -R +w "$TEST_ROOT/machine"* || true
rm -rf "$TEST_ROOT/machine"* || true
# Note: ssh://localhost bypasses ssh, directly invoking nix-store as a
# child process. This allows us to test LegacySSHStore::buildDerivation().
# ssh-ng://... likewise allows us to test RemoteStore::buildDerivation().

View file

@ -40,6 +40,7 @@ EOF
cp simple.nix shell.nix simple.builder.sh "${config_nix}" "$flakeDir/"
TODO_NixOS
requiresUnprivilegedUserNamespaces
outPath=$(nix build --print-out-paths --no-link --sandbox-paths '/nix? /bin? /lib? /lib64? /usr?' --store "$TEST_ROOT/x" path:"$flakeDir")

View file

@ -345,4 +345,15 @@ count() {
trap onError ERR
requiresUnprivilegedUserNamespaces() {
if [[ -f /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]] && [[ $(< /proc/sys/kernel/apparmor_restrict_unprivileged_userns) -eq 1 ]]; then
skipTest "Unprivileged user namespaces are disabled. Run 'sudo sysctl -w /proc/sys/kernel/apparmor_restrict_unprivileged_userns=0' to allow, and run these tests."
fi
}
execUnshare () {
requiresUnprivilegedUserNamespaces
exec unshare --mount --map-root-user "$SHELL" "$@"
}
fi # COMMON_FUNCTIONS_SH_SOURCED

View file

@ -1,7 +1,7 @@
{ hashInvalidator ? "" }:
with import ./config.nix;
let {
let
input0 = mkDerivation {
name = "dependencies-input-0";
@ -33,16 +33,15 @@ let {
outputHash = "1dq9p0hnm1y75q2x40fws5887bq1r840hzdxak0a9djbwvx0b16d";
};
body = mkDerivation {
name = "dependencies-top";
builder = ./dependencies.builder0.sh + "/FOOBAR/../.";
input1 = input1 + "/.";
input2 = "${input2}/.";
input1_drv = input1;
input2_drv = input2;
input0_drv = input0;
fod_input_drv = fod_input;
meta.description = "Random test package";
};
in
mkDerivation {
name = "dependencies-top";
builder = ./dependencies.builder0.sh + "/FOOBAR/../.";
input1 = input1 + "/.";
input2 = "${input2}/.";
input1_drv = input1;
input2_drv = input2;
input0_drv = input0;
fod_input_drv = fod_input;
meta.description = "Random test package";
}

View file

@ -13,7 +13,7 @@ badExitCode=0
store="$TEST_ROOT/store"
for nixFile in derivation/*.nix; do
drvPath=$(nix-instantiate --store "$store" --pure-eval --expr "$(< "$nixFile")")
drvPath=$(env -u NIX_STORE nix-instantiate --store "$store" --pure-eval --expr "$(< "$nixFile")")
testName=$(basename "$nixFile" .nix)
got="${store}${drvPath}"
expected="derivation/$testName.drv"

View file

@ -77,6 +77,7 @@ hash1=$(echo "$json" | jq -r .revision)
echo foo > "$flake1Dir/foo"
git -C "$flake1Dir" add $flake1Dir/foo
[[ $(nix flake metadata flake1 --json --refresh | jq -r .dirtyRevision) == "$hash1-dirty" ]]
[[ "$(nix flake metadata flake1 --json | jq -r .fingerprint)" != null ]]
echo -n '# foo' >> "$flake1Dir/flake.nix"
flake1OriginalCommit=$(git -C "$flake1Dir" rev-parse HEAD)

View file

@ -30,3 +30,6 @@ git -C "$flake2Dir" add flake.nix
echo 456 > "$flake1Dir"/x.nix
[[ $(nix eval --json "$flake2Dir#x" --override-input flake1 "$TEST_ROOT/flake1") = 456 ]]
expectStderr 1 nix flake lock "$flake2Dir" --override-input flake1 "$TEST_ROOT/flake1" |
grepQuiet "cannot write lock file.*because it has an unlocked input"

View file

@ -93,15 +93,19 @@ try3() {
# Asserting input format fails.
#
fail=$(nix hash convert --hash-algo "$1" --from nix32 "$2" 2>&1 || echo "exit: $?")
[[ "$fail" == *"error: input hash"*"exit: 1" ]]
fail=$(nix hash convert --hash-algo "$1" --from base16 "$3" 2>&1 || echo "exit: $?")
[[ "$fail" == *"error: input hash"*"exit: 1" ]]
fail=$(nix hash convert --hash-algo "$1" --from nix32 "$4" 2>&1 || echo "exit: $?")
[[ "$fail" == *"error: input hash"*"exit: 1" ]]
expectStderr 1 nix hash convert --hash-algo "$1" --from sri "$2" | grepQuiet "is not SRI"
expectStderr 1 nix hash convert --hash-algo "$1" --from nix32 "$2" | grepQuiet "input hash"
expectStderr 1 nix hash convert --hash-algo "$1" --from base16 "$3" | grepQuiet "input hash"
expectStderr 1 nix hash convert --hash-algo "$1" --from nix32 "$4" | grepQuiet "input hash"
# Base-16 hashes can be in uppercase.
nix hash convert --hash-algo "$1" --from base16 "$(echo $2 | tr [a-z] [A-Z])"
}
try3 sha1 "800d59cfcd3c05e900cb4e214be48f6b886a08df" "vw46m23bizj4n8afrc0fj19wrp7mj3c0" "gA1Zz808BekAy04hS+SPa4hqCN8="
try3 sha256 "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad" "1b8m03r63zqhnjf7l5wnldhh7c134ap5vpj0850ymkq1iyzicy5s" "ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0="
try3 sha512 "204a8fc6dda82f0a0ced7beb8e08a41657c16ef468b228a8279be331a703c33596fd15c13b1b07f9aa1d3bea57789ca031ad85c7a71dd70354ec631238ca3445" "12k9jiq29iyqm03swfsgiw5mlqs173qazm3n7daz43infy12pyrcdf30fkk3qwv4yl2ick8yipc2mqnlh48xsvvxl60lbx8vp38yji0" "IEqPxt2oLwoM7XvrjgikFlfBbvRosiioJ5vjMacDwzWW/RXBOxsH+aodO+pXeJygMa2Fx6cd1wNU7GMSOMo0RQ=="
# Test SRI hashes that lack trailing '=' characters. These are incorrect but we need to support them for backward compatibility.
[[ $(nix hash convert --from sri "sha256-ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0") = sha256-ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0= ]]
[[ $(nix hash convert --from sri "sha512-IEqPxt2oLwoM7XvrjgikFlfBbvRosiioJ5vjMacDwzWW/RXBOxsH+aodO+pXeJygMa2Fx6cd1wNU7GMSOMo0RQ") = sha512-IEqPxt2oLwoM7XvrjgikFlfBbvRosiioJ5vjMacDwzWW/RXBOxsH+aodO+pXeJygMa2Fx6cd1wNU7GMSOMo0RQ== ]]

View file

@ -1,4 +1,4 @@
with import ./config.nix;
with import <config>;
rec {
bar = mkDerivation {
@ -30,4 +30,23 @@ rec {
echo -n BLA$(cat $src) > $out
'';
};
step1 = mkDerivation {
name = "step1";
buildCommand = ''
mkdir -p $out
echo 'foo' > $out/bla
'';
};
addPathExpr = mkDerivation {
name = "add-path";
inherit step1;
buildCommand = ''
mkdir -p $out
echo "builtins.path { path = \"$step1\"; sha256 = \"7ptL+pnrZXnSa5hwwB+2SXTLkcSb5264WGGokN8OXto=\"; }" > $out/default.nix
'';
};
importAddPathExpr = import addPathExpr;
}

View file

@ -6,6 +6,8 @@ TODO_NixOS
clearStoreIfPossible
export NIX_PATH=config="${config_nix}"
if nix-instantiate --readonly-mode ./import-from-derivation.nix -A result; then
echo "read-only evaluation of an imported derivation unexpectedly failed"
exit 1
@ -15,6 +17,9 @@ outPath=$(nix-build ./import-from-derivation.nix -A result --no-out-link)
[ "$(cat "$outPath")" = FOO579 ]
# Check that we can have access to the entire closure of a derivation output.
nix build --no-link --restrict-eval -I src=. -f ./import-from-derivation.nix importAddPathExpr -v
# FIXME: the next tests are broken on CA.
if [[ -n "${NIX_TESTS_CA_BY_DEFAULT:-}" ]]; then
exit 0

View file

@ -0,0 +1,5 @@
error: undefined variable 'd'
at /pwd/lang/eval-fail-attrset-merge-drops-later-rec.nix:1:26:
1| { a.b = 1; a = rec { c = d + 2; d = 3; }; }.c
| ^
2|

View file

@ -0,0 +1 @@
{ a.b = 1; a = rec { c = d + 2; d = 3; }; }.c

View file

@ -0,0 +1,8 @@
error:
… while calling the 'fromJSON' builtin
at /pwd/lang/eval-fail-fromJSON-keyWithNullByte.nix:1:1:
1| builtins.fromJSON ''{"a\u0000b": 1}''
| ^
2|
error: input string 'a␀b' cannot be represented as Nix string because it contains null bytes

View file

@ -0,0 +1 @@
builtins.fromJSON ''{"a\u0000b": 1}''

View file

@ -0,0 +1,8 @@
error:
… while calling the 'fromJSON' builtin
at /pwd/lang/eval-fail-fromJSON-valueWithNullByte.nix:1:1:
1| builtins.fromJSON ''"a\u0000b"''
| ^
2|
error: input string 'a␀b' cannot be represented as Nix string because it contains null bytes

View file

@ -0,0 +1 @@
builtins.fromJSON ''"a\u0000b"''

View file

@ -0,0 +1,8 @@
error:
… while calling the 'fromTOML' builtin
at /pwd/lang/eval-fail-fromTOML-keyWithNullByte.nix:1:1:
1| builtins.fromTOML ''"a\u0000b" = 1''
| ^
2|
error: while parsing TOML: error: input string 'a␀b' cannot be represented as Nix string because it contains null bytes

View file

@ -0,0 +1 @@
builtins.fromTOML ''"a\u0000b" = 1''

View file

@ -0,0 +1,8 @@
error:
… while calling the 'fromTOML' builtin
at /pwd/lang/eval-fail-fromTOML-valueWithNullByte.nix:1:1:
1| builtins.fromTOML ''k = "a\u0000b"''
| ^
2|
error: while parsing TOML: error: input string 'a␀b' cannot be represented as Nix string because it contains null bytes

View file

@ -0,0 +1 @@
builtins.fromTOML ''k = "a\u0000b"''

View file

@ -0,0 +1,3 @@
# This is for backwards compatibility, not because we like it.
# See https://github.com/NixOS/nix/issues/9020.
{ a = rec { b = c + 1; d = 2; }; a.c = d + 3; }.a.b

View file

@ -1,6 +1,6 @@
error: attribute 'z' already defined at «stdin»:3:16
at «stdin»:2:3:
1| {
error: attribute 'x.z' already defined at «stdin»:2:3
at «stdin»:3:16:
2| x.z = 3;
| ^
3| x = { y = 3; z = 3; };
| ^
4| }

View file

@ -1,6 +1,6 @@
error: attribute 'y' already defined at «stdin»:3:9
at «stdin»:2:3:
1| {
error: attribute 'x.y.y' already defined at «stdin»:2:3
at «stdin»:3:9:
2| x.y.y = 3;
| ^
3| x = { y.y= 3; z = 3; };
| ^
4| }

View file

@ -9,6 +9,7 @@ TODO_NixOS
clearStore
requireSandboxSupport
requiresUnprivilegedUserNamespaces
# Note: we need to bind-mount $SHELL into the chroot. Currently we
# only support the case where $SHELL is in the Nix store, because

View file

@ -19,7 +19,7 @@ TODO_NixOS
for i in "${storesBad[@]}"; do
echo $i
unshare --mount --map-root-user bash <<EOF
execUnshare <<EOF
source common.sh
setupStoreDirs
mountOverlayfs

View file

@ -94,10 +94,6 @@ initLowerStore () {
pathInLowerStore=$(nix-store --store "$storeA" --realise $drvPath)
}
execUnshare () {
exec unshare --mount --map-root-user "$SHELL" "$@"
}
addTextToStore() {
storeDir=$1; shift
filename=$1; shift

View file

@ -28,3 +28,8 @@ outp="$(nix-build -E \
test -d "$outp"
nix log "$outp"
if isDaemonNewer "2.26"; then
# Build works despite ill-formed structured build log entries.
expectStderr 0 nix build -f ./logging/unusual-logging.nix --no-link | grepQuiet 'warning: Unable to handle a JSON message from the derivation builder:'
fi

View file

@ -0,0 +1,16 @@
let
inherit (import ../config.nix) mkDerivation;
in
mkDerivation {
name = "unusual-logging";
buildCommand = ''
{
echo "@nix 1"
echo "@nix {}"
echo '@nix {"action": null}'
echo '@nix {"action": 123}'
echo '@nix ]['
} >&$NIX_LOG_FD
touch $out
'';
}

View file

@ -17,12 +17,10 @@ fs = import('fs')
nix = find_program('nix')
bash = find_program('bash', native : true)
busybox = find_program('busybox', native : true, required : false)
if host_machine.system() == 'windows'
# Because of the state of symlinks on Windows, coreutils.exe doesn't usually exist, but things like ls.exe will
coreutils = find_program('ls', native : true)
else
coreutils = find_program('coreutils', native : true)
endif
# Look up `coreutils` package by searching for `ls` binary.
# Previously we looked up `coreutils` on `linux`, but that is not
# guaranteed to exist either.
coreutils = find_program('ls', native : true)
dot = find_program('dot', native : true, required : false)
nix_bin_dir = fs.parent(nix.full_path())

View file

@ -7,6 +7,7 @@ source common.sh
TODO_NixOS
requireSandboxSupport
requiresUnprivilegedUserNamespaces
start="$TEST_ROOT/start"
mkdir -p "$start"

View file

@ -18,6 +18,7 @@ goodStoreUrl () {
# whether this test is being run in a derivation as part of the nix build or
# being manually run by a developer outside a derivation
runNixBuild () {
local storeFun=$1
local altitude=$2
nix-build \

View file

@ -309,7 +309,7 @@ runRepl () {
for test in $(cd "$testDir/repl"; echo *.in); do
test="$(basename "$test" .in)"
in="$testDir/repl/$test.in"
actual="$testDir/repl/$test.actual"
actual="$TEST_ROOT/$test.actual"
expected="$testDir/repl/$test.expected"
(cd "$testDir/repl"; set +x; runRepl 2>&1) < "$in" > "$actual" || {
echo "FAIL: $test (exit code $?)" >&2

View file

@ -52,6 +52,7 @@ if isDaemonNewer "2.20.0pre20231220"; then
fi
requireSandboxSupport
requiresUnprivilegedUserNamespaces
chmod -R u+w "$TEST_ROOT/store0" || true
rm -rf "$TEST_ROOT/store0"

View file

@ -9,7 +9,7 @@ needLocalStore "The test uses --store always so we would just be bypassing the d
TODO_NixOS
unshare --mount --map-root-user -- bash -e -x <<EOF
execUnshare <<EOF
source common.sh
# Avoid store dir being inside sandbox build-dir

View file

@ -49,8 +49,8 @@ int main(int argc, char **argv) {
msg.msg_controllen = CMSG_SPACE(sizeof(int));
// Write a single null byte too.
msg.msg_iov = malloc(sizeof(struct iovec));
msg.msg_iov[0].iov_base = "";
msg.msg_iov = (struct iovec*) malloc(sizeof(struct iovec));
msg.msg_iov[0].iov_base = (void*) "";
msg.msg_iov[0].iov_len = 1;
msg.msg_iovlen = 1;

View file

@ -16,7 +16,7 @@ int main(int argc, char **argv) {
struct sockaddr_un data;
data.sun_family = AF_UNIX;
data.sun_path[0] = 0;
strcpy(data.sun_path + 1, argv[1]);
strncpy(data.sun_path + 1, argv[1], sizeof(data.sun_path) - 1);
int res = bind(sock, (const struct sockaddr *)&data,
offsetof(struct sockaddr_un, sun_path)
+ strlen(argv[1])
@ -57,10 +57,11 @@ int main(int argc, char **argv) {
// Wait for a second connection, which will tell us that the build is
// done
a = accept(sock, 0, 0);
if (a < 0) perror("accept");
fprintf(stderr, "%s\n", "Got a second connection, rewriting the file");
// Write a new content to the file
if (ftruncate(smuggling_fd, 0)) perror("ftruncate");
char * new_content = "Pwned\n";
const char * new_content = "Pwned\n";
int written_bytes = write(smuggling_fd, new_content, strlen(new_content));
if (written_bytes != strlen(new_content)) perror("write");
}

View file

@ -23,6 +23,9 @@ let
nix.checkAllErrors = false;
# TODO: decide which packaging stage to use. `nix-cli` is efficient, but not the same as the user-facing `everything.nix` package (`default`). Perhaps a good compromise is `everything.nix` + `noTests` defined above?
nix.package = nixpkgsFor.${system}.native.nixComponents.nix-cli;
# Evaluate VMs faster
documentation.enable = false;
};
_module.args.nixpkgs = nixpkgs;
_module.args.system = system;