Samuli Thomasson
1d358ebb1c
handle buffer too small for getgrnam_r
...
Signed-off-by: Samuli Thomasson <samuli.thomasson@pm.me>
2025-06-05 21:29:12 +02:00
Samuli Thomasson
62cc737d19
linux: support supplementary groups with auto-allocate-uids
...
Add a new option "supplementary-groups" that allows specifying
additional groups to be mapped into the build sandbox and assigned as
supplementary groups for the build user.
This makes it possible to, for example, use the "kvm" group to provide
access to /dev/kvm even when auto-allocate-uids is enabled—something
that was not previously possible. It also enables use of supplementary
groups to grant sandboxed builds read-only access to secrets or other
shared resources.
Closes: https://github.com/NixOS/nix/issues/9276
Signed-off-by: Samuli Thomasson <samuli.thomasson@pm.me>
2025-06-01 09:22:24 +02:00
Eelco Dolstra
587b5f5361
Merge pull request #13297 from NixOS/split-linux-builder
...
Split LinuxDerivationBuilder
2025-05-30 12:35:01 +02:00
Eelco Dolstra
908129eb22
Cleanup
2025-05-30 11:54:54 +02:00
John Ericson
81f5d6763d
Merge pull request #13299 from xokdvium/restore-packaging-overriding
...
flake: Restore `packaging-overriding` check
2025-05-29 22:31:15 -04:00
John Ericson
1a73f7aa6d
Merge pull request #13298 from xokdvium/drop-pre-commit-override
...
flake: Drop `pre-commit` override
2025-05-29 22:22:57 -04:00
Sergei Zimmerman
4fa991a680
flake: Restore packaging-overriding check
...
The underlying bug seems to have been fixed in diffoscope 293 [1] [2].
Our nixpkgs input has 295.
[1]: https://github.com/NixOS/nixpkgs/pull/393381#issuecomment-2766703347
[2]: https://diffoscope.org/news/diffoscope-292-released/
2025-05-29 22:35:50 +00:00
Sergei Zimmerman
dd80f16376
flake: Drop pre-commit override
...
`pre-commit` builds fine with the flake's input nixpkgs
on i686-linux.
2025-05-29 21:57:08 +00:00
Eelco Dolstra
4dc419eaec
Split LinuxDerivationBuilder
...
This restores doing seccomp/personality initialization even when
sandboxing is disabled.
https://hydra.nixos.org/build/298482132
2025-05-29 21:57:25 +02:00
Eelco Dolstra
b7fd872147
Cleanup
2025-05-29 21:39:22 +02:00
John Ericson
ba96067535
Merge pull request #13290 from xokdvium/drop-pch
...
Drop precompiled-headers.h
2025-05-28 18:46:19 -04:00
Sergei Zimmerman
a653184926
Drop precompiled-headers.h
...
Since the migration to meson precompiled-headers.h isn't actually used
anymore and is just confusing. Meson can't handle shared pch across
subprojects [1] and without that there's no performances benefit of PCH
at all. Also rolling our own support for that isn't trivial. See [2] for
an example of how that would look like.
[1]: https://github.com/mesonbuild/meson/issues/4350
[2]: 22bc8b6473/plugins/meson.build
2025-05-28 21:42:33 +00:00
John Ericson
69603a1348
Merge pull request #13282 from xokdvium/prim-match-tests
...
tests/functional: Add more language tests for `builtins.match`
2025-05-28 17:11:44 -04:00
John Ericson
20226c85bc
Merge pull request #13273 from NixOS/deprecate-structured-attrs-hack
...
Deprecate hacky way of making structured attrs
2025-05-28 13:40:23 -04:00
John Ericson
5e9744c331
Merge pull request #13287 from NixOS/fix-freebsd-build
...
Fix FreeBSD builds
2025-05-28 13:37:29 -04:00
Eelco Dolstra
1c0ff5295b
Merge pull request #13286 from NixOS/fix-warning
...
Fix warning when `HAVE_EMBEDDED_SANDBOX_SHELL` is not set
2025-05-28 19:36:53 +02:00
John Ericson
7577d2d3ae
Deprecate hacky way of making structured attrs
...
The method tested for in the previous commit is now deprecated.
Co-authored-by: Eelco Dolstra <edolstra@gmail.com>
2025-05-28 12:59:04 -04:00
John Ericson
24f5d7a9c3
Fix warning when HAVE_EMBEDDED_SANDBOX_SHELL is not set
...
Clang doesn't like the double indent that is needed for the `if...else`
that is CPP'd away. Adding braces is fine in the `if...else...` case,
and fine as a naked block in the CPP'd away case, and properly-indented
both ways.
2025-05-28 12:49:13 -04:00
John Ericson
8d725fdcb0
Fix FreeBSD builds
2025-05-28 12:47:33 -04:00
John Ericson
cc926c332c
Merge pull request #13283 from NixOS/fix-mingw
...
Fix mingw build
2025-05-28 12:31:56 -04:00
John Ericson
a353b2f4b2
Test hacky way of making structured attrs
2025-05-28 11:52:17 -04:00
Eelco Dolstra
6686b54077
Fix mingw build
...
https://hydra.nixos.org/build/298331457
2025-05-28 00:48:10 +02:00
Sergei Zimmerman
d555d6b404
tests/functional: Add more language tests for builtins.match
...
These tests have been collected from nixpkgs f870c6ccc8951fc48aeb293cf3e98ade6ac42668
usage of builtins.match for x86_64-linux eval system. At most 2 matching and
non-matching cases are included for each encountered regex. This should
hopefully add more confidence when possibly trying to switch the regex implementation
in the future.
2025-05-27 22:28:13 +00:00
John Ericson
de71cebc3a
Merge pull request #13281 from NixOS/freebsd-utils
...
Prepare for FreeBSD sandboxing support
2025-05-27 15:37:18 -04:00
John Ericson
625dce659a
Prepare for FreeBSD sandboxing support
...
This is the utility changes from #9968 , which were easier to rebase
first.
I (@Ericson2314) didn't write this code; I just rebased it.
Co-Authored-By: Artemis Tosini <me@artem.ist>
Co-Authored-By: Audrey Dutcher <audrey@rhelmot.io>
2025-05-27 14:54:50 -04:00
John Ericson
653a93ac0f
Merge pull request #13276 from NixOS/split-derivation-builder
...
Move platform-specific code out of `DerivationBuilder`
2025-05-27 13:39:02 -04:00
Eelco Dolstra
cf9d962086
Remove unused variable
2025-05-27 17:54:02 +02:00
Jörg Thalheim
f7c94cd908
Merge pull request #13278 from DeterminateSystems/gustavderdrache/system-builderror
...
Make platform checks throw BuildError like other failures
2025-05-27 16:39:55 +02:00
Jörg Thalheim
9ddac1b516
Merge pull request #13277 from zimbatm/flake-archive-no-check-sigs
...
nix flake archive: add --no-check-sigs option
2025-05-27 16:38:42 +02:00
Jörg Thalheim
161bf86457
Merge pull request #13279 from DeterminateSystems/gustavderdrache/trace-import-from-derivation
...
Emit warnings for IFDs with new `trace-import-from-derivation` option
2025-05-27 16:37:29 +02:00
Eelco Dolstra
f9fdf94e12
Fix macOS build
2025-05-27 15:25:51 +02:00
gustavderdrache
d80f0fb15a
Add test for output warning to ensure stability
...
Co-authored-by: Eelco Dolstra <edolstra@gmail.com>
2025-05-27 09:18:51 -04:00
gustavderdrache
ce89c8c114
Log warnings on IFD with new option
...
Co-authored-by: Eelco Dolstra <edolstra@gmail.com>
2025-05-27 09:18:51 -04:00
gustavderdrache
b04962b33b
Make platform checks throw BuildError like other failures
...
Co-authored-by: Cole Helbling <cole.e.helbling@outlook.com>
2025-05-27 08:57:13 -04:00
Eelco Dolstra
352ca238a9
Move cgroup support
2025-05-27 14:06:32 +02:00
Eelco Dolstra
b27e684ca5
Inline initTmpDir()
2025-05-27 14:00:28 +02:00
Eelco Dolstra
774678b87f
Get rid of tmpDirInSandbox variable
2025-05-27 14:00:21 +02:00
Eelco Dolstra
c9b55fa3f0
Move autoDelChroot
2025-05-27 14:00:16 +02:00
Eelco Dolstra
9e2151d839
Move seccomp code
2025-05-27 14:00:12 +02:00
Eelco Dolstra
b623fe8d14
Move doBind()
2025-05-27 14:00:07 +02:00
Eelco Dolstra
9f8f3968e3
Eliminate useChroot
2025-05-27 13:59:40 +02:00
Eelco Dolstra
67408807d8
Move pathsInChroot
2025-05-27 13:57:41 +02:00
Eelco Dolstra
5653bf5e0a
DerivationBuilder: Move Linux/Darwin-specific code into subclasses
2025-05-27 13:42:22 +02:00
zimbatm
80a4293486
nix flake archive: add --no-check-sigs option
...
Allows to copy the archive to a remote host and not get
error: cannot add path '/nix/store/01x2k4nlxcpyd85nnr0b9gm89rm8ff4x-source' because it lacks a signature by a trusted key
2025-05-27 10:05:21 +00:00
John Ericson
74a107d364
Merge pull request #13270 from NixOS/no-optional-drv-type
...
DerivationBuilderImpl: Drop std::optional from derivationType
2025-05-27 03:46:06 -04:00
Eelco Dolstra
aaca9711fc
DerivationBuilderImpl: Drop std::optional from derivationType
...
No point in computing this lazily, since it's pretty much the first
thing the DerivationBuilder does.
2025-05-27 09:04:29 +02:00
Jörg Thalheim
6adee1145f
Merge pull request #13275 from RossComputerGuy/fix/static-deps-nix
...
Remove propagated-build-inputs when static
2025-05-27 09:01:12 +02:00
Tristan Ross
d07852b5f3
Remove propagated-build-inputs when static
2025-05-26 21:54:19 -07:00
John Ericson
a2f65dd43b
Merge pull request #13274 from NixOS/drop-magic-nix-cache
...
Drop magic-nix-cache
2025-05-26 20:44:10 -04:00
Eelco Dolstra
9cc8be2674
Drop magic-nix-cache
...
This no longer works, see https://determinate.systems/posts/magic-nix-cache-free-tier-eol/ .
2025-05-26 23:30:16 +02:00
