Commit graph

20 commits

Author SHA1 Message Date
Nikodem Rabuliński f894cce79b
Always initialize curl in parent process on darwin
Because of an objc quirk[1], calling curl_global_init for the first time
after fork() will always result in a crash.
Up until now the solution has been to set
OBJC_DISABLE_INITIALIZE_FORK_SAFETY for every nix process to ignore
that error.
This is less than ideal because we were setting it in package.nix,
which meant that running nix tests locally would fail because
that variable was not set.
Instead of working around that error we address it at the core -
by calling curl_global_init inside initLibStore, which should mean
curl will already have been initialized by the time we try to do so in
a forked process.

[1] 01edf1705f/runtime/objc-initialize.mm (L614-L636)

Change-Id: Icf26010a8be655127cc130efb9c77b603a6660d0
2024-05-07 20:43:17 +02:00
Eelco Dolstra e53e5c38d4 Add a setting for configuring the SSL certificates file
This provides a platform-independent way to configure the SSL
certificates file in the Nix daemon. Previously we provided
instructions for overriding the environment variable in launchd, but
that obviously doesn't work with systemd. Now we can just tell users
to add

  ssl-cert-file = /etc/ssl/my-certificate-bundle.crt

to their nix.conf.
2023-03-17 18:32:18 +01:00
Artturin 2320a2f93e systemd,launchd match nixos open files limit
it was bumped in https://github.com/NixOS/nixpkgs/pull/176558
2022-11-04 19:40:16 +02:00
Zhong Jianxin d9b3adca75 launchd: Set NumberOfFiles to 4096
The default maxfiles on macOS 11 and macOS 12 is 256, which is too low
for nix to work:

```
$ launchctl limit maxfiles
	maxfiles    256            unlimited
```

Set NumberOfFiles of nix-daemon to 4096 to avoid `Too many open files`
error.
2021-12-04 20:46:29 +08:00
Alyssa Ross 4f80464645
Apply OS checks to host platform, not build
Previously, the build system used uname(1) output when it wanted to
check the operating system it was being built for, which meant that it
didn't take into-account cross-compilation when the build and host
operating systems were different.

To fix this, instead of consulting uname output, we consult the host
triple, specifically the third "kernel" part.

For "kernel"s with stable ABIs, like Linux or Cygwin, we can use a
simple ifeq to test whether we're compiling for that system, but for
other platforms, like Darwin, FreeBSD, or Solaris, we have to use a
more complicated check to take into account the version numbers at the
end of the "kernel"s.  I couldn't find a way to just strip these
version numbers in GNU Make without shelling out, which would be even
more ugly IMO.  Because these checks differ between kernels, and the
patsubst ones are quite fiddly, I've added variables for each host OS
we might want to check to make them easier to reuse.
2021-06-23 15:00:36 +00:00
Anders Kaseorg 4f493faf80 launchd: Use exec to avoid leaving the extra shell wrapper running
Before:

  UID   PID  PPID   C STIME   TTY           TIME CMD
    0  1737     1   0  2:28PM ??         0:00.00 /bin/sh -c /bin/wait4path /nix/var/nix/profiles/default/bin/nix-daemon && /nix/var/nix/profiles/default/bin/nix-daemon
    0  1739  1737   0  2:28PM ??         0:00.05 /nix/var/nix/profiles/default/bin/nix-daemon

After:

  UID   PID  PPID   C STIME   TTY           TIME CMD
    0  1763     1   0  2:29PM ??         0:00.05 /nix/var/nix/profiles/default/bin/nix-daemon

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
2021-05-04 14:33:47 -07:00
Marwan Aljubeh b7c02232b2
Fix the nix-daemon Mac OS SSL CA cert
Mac OS multi-user installations are currently broken because all requests
made by nix-daemon to the binary cache fail with:

```
unable to download ... Problem with the SSL CA cert (path? access rights?) (77).
```

This change ensures that the nix-daemon knows where to find the SSL CA cert file.

Fixes #2899 and #3261.
2020-09-16 17:56:43 +01:00
Dan Callahan 8c4a5e7ba1
Make nix-daemon.plist less fragile on macOS
We're calling `wait4path` on the full, resolved `@bindir@/nix-daemon` path.

That means we're hardcoding something like:

    /bin/wait4path /nix/store/zs9c5xhp3zv9p23qnjxp87nl5injsi1i-nix-2.3/bin/nix-daemon &amp;&amp; /nix/var/nix/profiles/default/bin/nix-daemon

That seems unnecessarily fragile.

It might be better to wait4path on the path we intend to call.
2019-10-09 12:52:01 +01:00
Matthew Bauer 0847f2f1b3 Copy instead of linking launch agent
On Catalina, the /nix filesystem might not be mounted at start time.
To avoid this service not starting, we need to keep the launch agent
outside of the Nix store. A wait4pid will hold for our /nix dir to be
mounted.

Fixes #3125.
2019-10-08 21:52:17 -04:00
Matthew Bauer 87c604c1f0 Fix launchd program args
launchd has some weird syntx. Apparently the program needs to be in
the ProgramArguments, as Program appears to be ignored.
2019-09-02 18:35:10 -04:00
Matthew Bauer 800fba1037 Use wait4path on org.nixos.nix-daemon.plist
When using a volume, the nix-daemon path may not exist. To avoid this
issue, we must use the wait4path tool. This should solve one of the
issues in multi-user on macOS Catalina.
2019-08-27 10:58:48 -04:00
Daiderd Jordan 8ac1130cc2
nix-daemon: add variable to disable fork safety
Since macOS 10.14 this has become an error, causing problems if the
nix-daemon loads nix during substitution (this is a forked process).

Workaround for #2523.
2019-02-09 20:35:30 +01:00
Daiderd Jordan 05cb8e5c5a
launchd: enable keepalive for the nix-daemon service
Without this the daemon won't be restarted if the process ever dies, for
example when sending a SIGHUP to reload nix.conf.
2018-02-28 19:58:48 +01:00
Eelco Dolstra 847f19a5f7
Provide a builtin default for $NIX_SSL_CERT_FILE
This is mostly to ensure that when Nix is started on macOS via a
launchd service or sshd (for a remote build), it gets a certificate
bundle.
2017-06-12 16:44:43 +02:00
Eelco Dolstra 465cb68244
Figure out the user's home directory if $HOME is not set 2017-05-05 17:08:23 +02:00
Shea Levy 689b825627 nix-daemon.plist: Set XDG_CACHE_HOME 2017-03-05 18:15:44 -05:00
Eelco Dolstra fb2dd32100 SSL_CERT_FILE -> NIX_SSL_CERT_FILE
This prevents collisions with the "native" OpenSSL, in particular on
OS X.

Fixes #921.
2016-10-13 17:09:10 +02:00
Eelco Dolstra eff80419c7 launchd: Set $SSL_CERT_FILE
Otherwise in particular https://cache.nixos.org won't work in the
daemon.
2016-08-12 15:00:51 +02:00
Eelco Dolstra 3cc9977118 Typo 2014-11-04 10:31:17 +01:00
Eelco Dolstra bbf294cceb Add a launchd configuration file to run nix-daemon 2014-11-04 10:30:22 +01:00