mirror of
https://github.com/NixOS/nix
synced 2025-07-10 04:43:53 +02:00
Merge remote-tracking branch 'origin/master' into relative-flakes
This commit is contained in:
commit
8534c4222c
263 changed files with 2129 additions and 805 deletions
|
@ -8,6 +8,7 @@ TODO_NixOS
|
|||
restartDaemon
|
||||
|
||||
requireSandboxSupport
|
||||
requiresUnprivilegedUserNamespaces
|
||||
[[ $busybox =~ busybox ]] || skipTest "no busybox"
|
||||
|
||||
unset NIX_STORE_DIR
|
||||
|
|
|
@ -5,6 +5,7 @@
|
|||
# shellcheck disable=SC2154
|
||||
|
||||
requireSandboxSupport
|
||||
requiresUnprivilegedUserNamespaces
|
||||
[[ "$busybox" =~ busybox ]] || skipTest "no busybox"
|
||||
|
||||
unset NIX_STORE_DIR
|
||||
|
|
|
@ -3,6 +3,7 @@
|
|||
: "${file?must be defined by caller (remote building test case using this)}"
|
||||
|
||||
requireSandboxSupport
|
||||
requiresUnprivilegedUserNamespaces
|
||||
[[ "${busybox-}" =~ busybox ]] || skipTest "no busybox"
|
||||
|
||||
# Avoid store dir being inside sandbox build-dir
|
||||
|
@ -27,6 +28,7 @@ builders=(
|
|||
chmod -R +w "$TEST_ROOT/machine"* || true
|
||||
rm -rf "$TEST_ROOT/machine"* || true
|
||||
|
||||
|
||||
# Note: ssh://localhost bypasses ssh, directly invoking nix-store as a
|
||||
# child process. This allows us to test LegacySSHStore::buildDerivation().
|
||||
# ssh-ng://... likewise allows us to test RemoteStore::buildDerivation().
|
||||
|
|
|
@ -40,6 +40,7 @@ EOF
|
|||
cp simple.nix shell.nix simple.builder.sh "${config_nix}" "$flakeDir/"
|
||||
|
||||
TODO_NixOS
|
||||
requiresUnprivilegedUserNamespaces
|
||||
|
||||
outPath=$(nix build --print-out-paths --no-link --sandbox-paths '/nix? /bin? /lib? /lib64? /usr?' --store "$TEST_ROOT/x" path:"$flakeDir")
|
||||
|
||||
|
|
|
@ -345,4 +345,15 @@ count() {
|
|||
|
||||
trap onError ERR
|
||||
|
||||
requiresUnprivilegedUserNamespaces() {
|
||||
if [[ -f /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]] && [[ $(< /proc/sys/kernel/apparmor_restrict_unprivileged_userns) -eq 1 ]]; then
|
||||
skipTest "Unprivileged user namespaces are disabled. Run 'sudo sysctl -w /proc/sys/kernel/apparmor_restrict_unprivileged_userns=0' to allow, and run these tests."
|
||||
fi
|
||||
}
|
||||
|
||||
execUnshare () {
|
||||
requiresUnprivilegedUserNamespaces
|
||||
exec unshare --mount --map-root-user "$SHELL" "$@"
|
||||
}
|
||||
|
||||
fi # COMMON_FUNCTIONS_SH_SOURCED
|
||||
|
|
|
@ -1,7 +1,7 @@
|
|||
{ hashInvalidator ? "" }:
|
||||
with import ./config.nix;
|
||||
|
||||
let {
|
||||
let
|
||||
|
||||
input0 = mkDerivation {
|
||||
name = "dependencies-input-0";
|
||||
|
@ -33,16 +33,15 @@ let {
|
|||
outputHash = "1dq9p0hnm1y75q2x40fws5887bq1r840hzdxak0a9djbwvx0b16d";
|
||||
};
|
||||
|
||||
body = mkDerivation {
|
||||
name = "dependencies-top";
|
||||
builder = ./dependencies.builder0.sh + "/FOOBAR/../.";
|
||||
input1 = input1 + "/.";
|
||||
input2 = "${input2}/.";
|
||||
input1_drv = input1;
|
||||
input2_drv = input2;
|
||||
input0_drv = input0;
|
||||
fod_input_drv = fod_input;
|
||||
meta.description = "Random test package";
|
||||
};
|
||||
|
||||
in
|
||||
mkDerivation {
|
||||
name = "dependencies-top";
|
||||
builder = ./dependencies.builder0.sh + "/FOOBAR/../.";
|
||||
input1 = input1 + "/.";
|
||||
input2 = "${input2}/.";
|
||||
input1_drv = input1;
|
||||
input2_drv = input2;
|
||||
input0_drv = input0;
|
||||
fod_input_drv = fod_input;
|
||||
meta.description = "Random test package";
|
||||
}
|
||||
|
|
|
@ -13,7 +13,7 @@ badExitCode=0
|
|||
store="$TEST_ROOT/store"
|
||||
|
||||
for nixFile in derivation/*.nix; do
|
||||
drvPath=$(nix-instantiate --store "$store" --pure-eval --expr "$(< "$nixFile")")
|
||||
drvPath=$(env -u NIX_STORE nix-instantiate --store "$store" --pure-eval --expr "$(< "$nixFile")")
|
||||
testName=$(basename "$nixFile" .nix)
|
||||
got="${store}${drvPath}"
|
||||
expected="derivation/$testName.drv"
|
||||
|
|
|
@ -77,6 +77,7 @@ hash1=$(echo "$json" | jq -r .revision)
|
|||
echo foo > "$flake1Dir/foo"
|
||||
git -C "$flake1Dir" add $flake1Dir/foo
|
||||
[[ $(nix flake metadata flake1 --json --refresh | jq -r .dirtyRevision) == "$hash1-dirty" ]]
|
||||
[[ "$(nix flake metadata flake1 --json | jq -r .fingerprint)" != null ]]
|
||||
|
||||
echo -n '# foo' >> "$flake1Dir/flake.nix"
|
||||
flake1OriginalCommit=$(git -C "$flake1Dir" rev-parse HEAD)
|
||||
|
|
|
@ -30,3 +30,6 @@ git -C "$flake2Dir" add flake.nix
|
|||
echo 456 > "$flake1Dir"/x.nix
|
||||
|
||||
[[ $(nix eval --json "$flake2Dir#x" --override-input flake1 "$TEST_ROOT/flake1") = 456 ]]
|
||||
|
||||
expectStderr 1 nix flake lock "$flake2Dir" --override-input flake1 "$TEST_ROOT/flake1" |
|
||||
grepQuiet "cannot write lock file.*because it has an unlocked input"
|
||||
|
|
|
@ -93,15 +93,19 @@ try3() {
|
|||
# Asserting input format fails.
|
||||
#
|
||||
|
||||
fail=$(nix hash convert --hash-algo "$1" --from nix32 "$2" 2>&1 || echo "exit: $?")
|
||||
[[ "$fail" == *"error: input hash"*"exit: 1" ]]
|
||||
fail=$(nix hash convert --hash-algo "$1" --from base16 "$3" 2>&1 || echo "exit: $?")
|
||||
[[ "$fail" == *"error: input hash"*"exit: 1" ]]
|
||||
fail=$(nix hash convert --hash-algo "$1" --from nix32 "$4" 2>&1 || echo "exit: $?")
|
||||
[[ "$fail" == *"error: input hash"*"exit: 1" ]]
|
||||
expectStderr 1 nix hash convert --hash-algo "$1" --from sri "$2" | grepQuiet "is not SRI"
|
||||
expectStderr 1 nix hash convert --hash-algo "$1" --from nix32 "$2" | grepQuiet "input hash"
|
||||
expectStderr 1 nix hash convert --hash-algo "$1" --from base16 "$3" | grepQuiet "input hash"
|
||||
expectStderr 1 nix hash convert --hash-algo "$1" --from nix32 "$4" | grepQuiet "input hash"
|
||||
|
||||
# Base-16 hashes can be in uppercase.
|
||||
nix hash convert --hash-algo "$1" --from base16 "$(echo $2 | tr [a-z] [A-Z])"
|
||||
}
|
||||
|
||||
try3 sha1 "800d59cfcd3c05e900cb4e214be48f6b886a08df" "vw46m23bizj4n8afrc0fj19wrp7mj3c0" "gA1Zz808BekAy04hS+SPa4hqCN8="
|
||||
try3 sha256 "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad" "1b8m03r63zqhnjf7l5wnldhh7c134ap5vpj0850ymkq1iyzicy5s" "ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0="
|
||||
try3 sha512 "204a8fc6dda82f0a0ced7beb8e08a41657c16ef468b228a8279be331a703c33596fd15c13b1b07f9aa1d3bea57789ca031ad85c7a71dd70354ec631238ca3445" "12k9jiq29iyqm03swfsgiw5mlqs173qazm3n7daz43infy12pyrcdf30fkk3qwv4yl2ick8yipc2mqnlh48xsvvxl60lbx8vp38yji0" "IEqPxt2oLwoM7XvrjgikFlfBbvRosiioJ5vjMacDwzWW/RXBOxsH+aodO+pXeJygMa2Fx6cd1wNU7GMSOMo0RQ=="
|
||||
|
||||
# Test SRI hashes that lack trailing '=' characters. These are incorrect but we need to support them for backward compatibility.
|
||||
[[ $(nix hash convert --from sri "sha256-ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0") = sha256-ungWv48Bz+pBQUDeXa4iI7ADYaOWF3qctBD/YfIAFa0= ]]
|
||||
[[ $(nix hash convert --from sri "sha512-IEqPxt2oLwoM7XvrjgikFlfBbvRosiioJ5vjMacDwzWW/RXBOxsH+aodO+pXeJygMa2Fx6cd1wNU7GMSOMo0RQ") = sha512-IEqPxt2oLwoM7XvrjgikFlfBbvRosiioJ5vjMacDwzWW/RXBOxsH+aodO+pXeJygMa2Fx6cd1wNU7GMSOMo0RQ== ]]
|
||||
|
|
|
@ -1,4 +1,4 @@
|
|||
with import ./config.nix;
|
||||
with import <config>;
|
||||
|
||||
rec {
|
||||
bar = mkDerivation {
|
||||
|
@ -30,4 +30,23 @@ rec {
|
|||
echo -n BLA$(cat $src) > $out
|
||||
'';
|
||||
};
|
||||
|
||||
step1 = mkDerivation {
|
||||
name = "step1";
|
||||
buildCommand = ''
|
||||
mkdir -p $out
|
||||
echo 'foo' > $out/bla
|
||||
'';
|
||||
};
|
||||
|
||||
addPathExpr = mkDerivation {
|
||||
name = "add-path";
|
||||
inherit step1;
|
||||
buildCommand = ''
|
||||
mkdir -p $out
|
||||
echo "builtins.path { path = \"$step1\"; sha256 = \"7ptL+pnrZXnSa5hwwB+2SXTLkcSb5264WGGokN8OXto=\"; }" > $out/default.nix
|
||||
'';
|
||||
};
|
||||
|
||||
importAddPathExpr = import addPathExpr;
|
||||
}
|
||||
|
|
|
@ -6,6 +6,8 @@ TODO_NixOS
|
|||
|
||||
clearStoreIfPossible
|
||||
|
||||
export NIX_PATH=config="${config_nix}"
|
||||
|
||||
if nix-instantiate --readonly-mode ./import-from-derivation.nix -A result; then
|
||||
echo "read-only evaluation of an imported derivation unexpectedly failed"
|
||||
exit 1
|
||||
|
@ -15,6 +17,9 @@ outPath=$(nix-build ./import-from-derivation.nix -A result --no-out-link)
|
|||
|
||||
[ "$(cat "$outPath")" = FOO579 ]
|
||||
|
||||
# Check that we can have access to the entire closure of a derivation output.
|
||||
nix build --no-link --restrict-eval -I src=. -f ./import-from-derivation.nix importAddPathExpr -v
|
||||
|
||||
# FIXME: the next tests are broken on CA.
|
||||
if [[ -n "${NIX_TESTS_CA_BY_DEFAULT:-}" ]]; then
|
||||
exit 0
|
||||
|
|
|
@ -0,0 +1,5 @@
|
|||
error: undefined variable 'd'
|
||||
at /pwd/lang/eval-fail-attrset-merge-drops-later-rec.nix:1:26:
|
||||
1| { a.b = 1; a = rec { c = d + 2; d = 3; }; }.c
|
||||
| ^
|
||||
2|
|
|
@ -0,0 +1 @@
|
|||
{ a.b = 1; a = rec { c = d + 2; d = 3; }; }.c
|
|
@ -0,0 +1,8 @@
|
|||
error:
|
||||
… while calling the 'fromJSON' builtin
|
||||
at /pwd/lang/eval-fail-fromJSON-keyWithNullByte.nix:1:1:
|
||||
1| builtins.fromJSON ''{"a\u0000b": 1}''
|
||||
| ^
|
||||
2|
|
||||
|
||||
error: input string 'a␀b' cannot be represented as Nix string because it contains null bytes
|
|
@ -0,0 +1 @@
|
|||
builtins.fromJSON ''{"a\u0000b": 1}''
|
|
@ -0,0 +1,8 @@
|
|||
error:
|
||||
… while calling the 'fromJSON' builtin
|
||||
at /pwd/lang/eval-fail-fromJSON-valueWithNullByte.nix:1:1:
|
||||
1| builtins.fromJSON ''"a\u0000b"''
|
||||
| ^
|
||||
2|
|
||||
|
||||
error: input string 'a␀b' cannot be represented as Nix string because it contains null bytes
|
|
@ -0,0 +1 @@
|
|||
builtins.fromJSON ''"a\u0000b"''
|
|
@ -0,0 +1,8 @@
|
|||
error:
|
||||
… while calling the 'fromTOML' builtin
|
||||
at /pwd/lang/eval-fail-fromTOML-keyWithNullByte.nix:1:1:
|
||||
1| builtins.fromTOML ''"a\u0000b" = 1''
|
||||
| ^
|
||||
2|
|
||||
|
||||
error: while parsing TOML: error: input string 'a␀b' cannot be represented as Nix string because it contains null bytes
|
|
@ -0,0 +1 @@
|
|||
builtins.fromTOML ''"a\u0000b" = 1''
|
|
@ -0,0 +1,8 @@
|
|||
error:
|
||||
… while calling the 'fromTOML' builtin
|
||||
at /pwd/lang/eval-fail-fromTOML-valueWithNullByte.nix:1:1:
|
||||
1| builtins.fromTOML ''k = "a\u0000b"''
|
||||
| ^
|
||||
2|
|
||||
|
||||
error: while parsing TOML: error: input string 'a␀b' cannot be represented as Nix string because it contains null bytes
|
|
@ -0,0 +1 @@
|
|||
builtins.fromTOML ''k = "a\u0000b"''
|
|
@ -0,0 +1 @@
|
|||
6
|
|
@ -0,0 +1,3 @@
|
|||
# This is for backwards compatibility, not because we like it.
|
||||
# See https://github.com/NixOS/nix/issues/9020.
|
||||
{ a = rec { b = c + 1; d = 2; }; a.c = d + 3; }.a.b
|
|
@ -1,6 +1,6 @@
|
|||
error: attribute 'z' already defined at «stdin»:3:16
|
||||
at «stdin»:2:3:
|
||||
1| {
|
||||
error: attribute 'x.z' already defined at «stdin»:2:3
|
||||
at «stdin»:3:16:
|
||||
2| x.z = 3;
|
||||
| ^
|
||||
3| x = { y = 3; z = 3; };
|
||||
| ^
|
||||
4| }
|
||||
|
|
|
@ -1,6 +1,6 @@
|
|||
error: attribute 'y' already defined at «stdin»:3:9
|
||||
at «stdin»:2:3:
|
||||
1| {
|
||||
error: attribute 'x.y.y' already defined at «stdin»:2:3
|
||||
at «stdin»:3:9:
|
||||
2| x.y.y = 3;
|
||||
| ^
|
||||
3| x = { y.y= 3; z = 3; };
|
||||
| ^
|
||||
4| }
|
||||
|
|
|
@ -9,6 +9,7 @@ TODO_NixOS
|
|||
clearStore
|
||||
|
||||
requireSandboxSupport
|
||||
requiresUnprivilegedUserNamespaces
|
||||
|
||||
# Note: we need to bind-mount $SHELL into the chroot. Currently we
|
||||
# only support the case where $SHELL is in the Nix store, because
|
||||
|
|
|
@ -19,7 +19,7 @@ TODO_NixOS
|
|||
|
||||
for i in "${storesBad[@]}"; do
|
||||
echo $i
|
||||
unshare --mount --map-root-user bash <<EOF
|
||||
execUnshare <<EOF
|
||||
source common.sh
|
||||
setupStoreDirs
|
||||
mountOverlayfs
|
||||
|
|
|
@ -94,10 +94,6 @@ initLowerStore () {
|
|||
pathInLowerStore=$(nix-store --store "$storeA" --realise $drvPath)
|
||||
}
|
||||
|
||||
execUnshare () {
|
||||
exec unshare --mount --map-root-user "$SHELL" "$@"
|
||||
}
|
||||
|
||||
addTextToStore() {
|
||||
storeDir=$1; shift
|
||||
filename=$1; shift
|
||||
|
|
|
@ -28,3 +28,8 @@ outp="$(nix-build -E \
|
|||
test -d "$outp"
|
||||
|
||||
nix log "$outp"
|
||||
|
||||
if isDaemonNewer "2.26"; then
|
||||
# Build works despite ill-formed structured build log entries.
|
||||
expectStderr 0 nix build -f ./logging/unusual-logging.nix --no-link | grepQuiet 'warning: Unable to handle a JSON message from the derivation builder:'
|
||||
fi
|
||||
|
|
16
tests/functional/logging/unusual-logging.nix
Normal file
16
tests/functional/logging/unusual-logging.nix
Normal file
|
@ -0,0 +1,16 @@
|
|||
let
|
||||
inherit (import ../config.nix) mkDerivation;
|
||||
in
|
||||
mkDerivation {
|
||||
name = "unusual-logging";
|
||||
buildCommand = ''
|
||||
{
|
||||
echo "@nix 1"
|
||||
echo "@nix {}"
|
||||
echo '@nix {"action": null}'
|
||||
echo '@nix {"action": 123}'
|
||||
echo '@nix ]['
|
||||
} >&$NIX_LOG_FD
|
||||
touch $out
|
||||
'';
|
||||
}
|
|
@ -17,12 +17,10 @@ fs = import('fs')
|
|||
nix = find_program('nix')
|
||||
bash = find_program('bash', native : true)
|
||||
busybox = find_program('busybox', native : true, required : false)
|
||||
if host_machine.system() == 'windows'
|
||||
# Because of the state of symlinks on Windows, coreutils.exe doesn't usually exist, but things like ls.exe will
|
||||
coreutils = find_program('ls', native : true)
|
||||
else
|
||||
coreutils = find_program('coreutils', native : true)
|
||||
endif
|
||||
# Look up `coreutils` package by searching for `ls` binary.
|
||||
# Previously we looked up `coreutils` on `linux`, but that is not
|
||||
# guaranteed to exist either.
|
||||
coreutils = find_program('ls', native : true)
|
||||
dot = find_program('dot', native : true, required : false)
|
||||
|
||||
nix_bin_dir = fs.parent(nix.full_path())
|
||||
|
|
|
@ -7,6 +7,7 @@ source common.sh
|
|||
TODO_NixOS
|
||||
|
||||
requireSandboxSupport
|
||||
requiresUnprivilegedUserNamespaces
|
||||
|
||||
start="$TEST_ROOT/start"
|
||||
mkdir -p "$start"
|
||||
|
|
|
@ -18,6 +18,7 @@ goodStoreUrl () {
|
|||
# whether this test is being run in a derivation as part of the nix build or
|
||||
# being manually run by a developer outside a derivation
|
||||
runNixBuild () {
|
||||
|
||||
local storeFun=$1
|
||||
local altitude=$2
|
||||
nix-build \
|
||||
|
|
|
@ -309,7 +309,7 @@ runRepl () {
|
|||
for test in $(cd "$testDir/repl"; echo *.in); do
|
||||
test="$(basename "$test" .in)"
|
||||
in="$testDir/repl/$test.in"
|
||||
actual="$testDir/repl/$test.actual"
|
||||
actual="$TEST_ROOT/$test.actual"
|
||||
expected="$testDir/repl/$test.expected"
|
||||
(cd "$testDir/repl"; set +x; runRepl 2>&1) < "$in" > "$actual" || {
|
||||
echo "FAIL: $test (exit code $?)" >&2
|
||||
|
|
|
@ -52,6 +52,7 @@ if isDaemonNewer "2.20.0pre20231220"; then
|
|||
fi
|
||||
|
||||
requireSandboxSupport
|
||||
requiresUnprivilegedUserNamespaces
|
||||
|
||||
chmod -R u+w "$TEST_ROOT/store0" || true
|
||||
rm -rf "$TEST_ROOT/store0"
|
||||
|
|
|
@ -9,7 +9,7 @@ needLocalStore "The test uses --store always so we would just be bypassing the d
|
|||
|
||||
TODO_NixOS
|
||||
|
||||
unshare --mount --map-root-user -- bash -e -x <<EOF
|
||||
execUnshare <<EOF
|
||||
source common.sh
|
||||
|
||||
# Avoid store dir being inside sandbox build-dir
|
||||
|
|
|
@ -49,8 +49,8 @@ int main(int argc, char **argv) {
|
|||
msg.msg_controllen = CMSG_SPACE(sizeof(int));
|
||||
|
||||
// Write a single null byte too.
|
||||
msg.msg_iov = malloc(sizeof(struct iovec));
|
||||
msg.msg_iov[0].iov_base = "";
|
||||
msg.msg_iov = (struct iovec*) malloc(sizeof(struct iovec));
|
||||
msg.msg_iov[0].iov_base = (void*) "";
|
||||
msg.msg_iov[0].iov_len = 1;
|
||||
msg.msg_iovlen = 1;
|
||||
|
||||
|
|
|
@ -16,7 +16,7 @@ int main(int argc, char **argv) {
|
|||
struct sockaddr_un data;
|
||||
data.sun_family = AF_UNIX;
|
||||
data.sun_path[0] = 0;
|
||||
strcpy(data.sun_path + 1, argv[1]);
|
||||
strncpy(data.sun_path + 1, argv[1], sizeof(data.sun_path) - 1);
|
||||
int res = bind(sock, (const struct sockaddr *)&data,
|
||||
offsetof(struct sockaddr_un, sun_path)
|
||||
+ strlen(argv[1])
|
||||
|
@ -57,10 +57,11 @@ int main(int argc, char **argv) {
|
|||
// Wait for a second connection, which will tell us that the build is
|
||||
// done
|
||||
a = accept(sock, 0, 0);
|
||||
if (a < 0) perror("accept");
|
||||
fprintf(stderr, "%s\n", "Got a second connection, rewriting the file");
|
||||
// Write a new content to the file
|
||||
if (ftruncate(smuggling_fd, 0)) perror("ftruncate");
|
||||
char * new_content = "Pwned\n";
|
||||
const char * new_content = "Pwned\n";
|
||||
int written_bytes = write(smuggling_fd, new_content, strlen(new_content));
|
||||
if (written_bytes != strlen(new_content)) perror("write");
|
||||
}
|
||||
|
|
|
@ -23,6 +23,9 @@ let
|
|||
nix.checkAllErrors = false;
|
||||
# TODO: decide which packaging stage to use. `nix-cli` is efficient, but not the same as the user-facing `everything.nix` package (`default`). Perhaps a good compromise is `everything.nix` + `noTests` defined above?
|
||||
nix.package = nixpkgsFor.${system}.native.nixComponents.nix-cli;
|
||||
|
||||
# Evaluate VMs faster
|
||||
documentation.enable = false;
|
||||
};
|
||||
_module.args.nixpkgs = nixpkgs;
|
||||
_module.args.system = system;
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue