forked from lix-project/lix
This was found when `logrotate.conf` failed to build in a NixOS system
with:
/nix/store/26zdl4pyw5qazppj8if5lm8bjzxlc07l-coreutils-9.3/bin/id: cannot find name for group ID 30000
This was surprising because it seemed to mean that /etc/group was busted
in the sandbox. Indeed it was:
root❌0:
nixbld:!💯
nogroup❌65534:
We diagnosed this to sandboxUid() being called before
usingUserNamespace() was called, in setting up /etc/group inside the
sandbox. This code desperately needs refactoring.
We also moved the /etc/group code to be with the /etc/passwd code, but
honestly this code is all spaghetti'd all over the place and needs some
more serious tidying than we did here.
We also moved some checks to be earlier to improve locality with where
the things they are checking come from.
Change-Id: Ie29798771f3593c46ec313a32960fa955054aceb
170 lines
5.6 KiB
Nix
170 lines
5.6 KiB
Nix
{ lib, nixpkgs, nixpkgsFor }:
|
|
|
|
let
|
|
|
|
nixos-lib = import (nixpkgs + "/nixos/lib") { };
|
|
|
|
# https://nixos.org/manual/nixos/unstable/index.html#sec-calling-nixos-tests
|
|
runNixOSTestFor = system: test:
|
|
(nixos-lib.runTest {
|
|
imports = [ test ];
|
|
hostPkgs = nixpkgsFor.${system}.native;
|
|
defaults = {
|
|
nixpkgs.pkgs = nixpkgsFor.${system}.native;
|
|
nix.checkAllErrors = false;
|
|
};
|
|
_module.args.nixpkgs = nixpkgs;
|
|
_module.args.system = system;
|
|
})
|
|
// {
|
|
# allow running tests against older nix versions via `nix eval --apply`
|
|
# Example:
|
|
# nix build "$(nix eval --raw --impure .#hydraJobs.tests.fetch-git --apply 't: (t.forNix "2.19.2").drvPath')^*"
|
|
forNix = nixVersion: runNixOSTestFor system {
|
|
imports = [test];
|
|
defaults.nixpkgs.overlays = [(curr: prev: {
|
|
nix = (builtins.getFlake "nix/${nixVersion}").packages.${system}.nix;
|
|
})];
|
|
};
|
|
};
|
|
|
|
# Checks that a NixOS configuration does not contain any references to our
|
|
# locally defined Nix version.
|
|
checkOverrideNixVersion = { pkgs, lib, ... }: {
|
|
# pkgs.nix: The new Nix in this repo
|
|
# We disallow it, to make sure we don't accidentally use it.
|
|
system.forbiddenDependenciesRegex = lib.strings.escapeRegex "nix-${pkgs.nix.version}";
|
|
};
|
|
in
|
|
|
|
{
|
|
authorization = runNixOSTestFor "x86_64-linux" ./authorization.nix;
|
|
|
|
remoteBuilds = runNixOSTestFor "x86_64-linux" ./remote-builds.nix;
|
|
|
|
# Test our Nix as a client against remotes that are older
|
|
|
|
remoteBuilds_remote_2_3 = runNixOSTestFor "x86_64-linux" {
|
|
name = "remoteBuilds_remote_2_3";
|
|
imports = [ ./remote-builds.nix ];
|
|
builders.config = { lib, pkgs, ... }: {
|
|
imports = [ checkOverrideNixVersion ];
|
|
nix.package = lib.mkForce pkgs.nixVersions.nix_2_3;
|
|
};
|
|
};
|
|
|
|
remoteBuilds_remote_2_13 = runNixOSTestFor "x86_64-linux" ({ lib, pkgs, ... }: {
|
|
name = "remoteBuilds_remote_2_13";
|
|
imports = [ ./remote-builds.nix ];
|
|
builders.config = { lib, pkgs, ... }: {
|
|
imports = [ checkOverrideNixVersion ];
|
|
nix.package = lib.mkForce pkgs.nixVersions.nix_2_13;
|
|
};
|
|
});
|
|
|
|
# TODO: (nixpkgs update) remoteBuilds_remote_2_18 = ...
|
|
|
|
# Test our Nix as a builder for clients that are older
|
|
|
|
remoteBuilds_local_2_3 = runNixOSTestFor "x86_64-linux" ({ lib, pkgs, ... }: {
|
|
name = "remoteBuilds_local_2_3";
|
|
imports = [ ./remote-builds.nix ];
|
|
nodes.client = { lib, pkgs, ... }: {
|
|
imports = [ checkOverrideNixVersion ];
|
|
nix.package = lib.mkForce pkgs.nixVersions.nix_2_3;
|
|
};
|
|
});
|
|
|
|
remoteBuilds_local_2_13 = runNixOSTestFor "x86_64-linux" ({ lib, pkgs, ... }: {
|
|
name = "remoteBuilds_local_2_13";
|
|
imports = [ ./remote-builds.nix ];
|
|
nodes.client = { lib, pkgs, ... }: {
|
|
imports = [ checkOverrideNixVersion ];
|
|
nix.package = lib.mkForce pkgs.nixVersions.nix_2_13;
|
|
};
|
|
});
|
|
|
|
# TODO: (nixpkgs update) remoteBuilds_local_2_18 = ...
|
|
|
|
# End remoteBuilds tests
|
|
|
|
remoteBuildsSshNg = runNixOSTestFor "x86_64-linux" ./remote-builds-ssh-ng.nix;
|
|
|
|
# Test our Nix as a client against remotes that are older
|
|
|
|
remoteBuildsSshNg_remote_2_3 = runNixOSTestFor "x86_64-linux" {
|
|
name = "remoteBuildsSshNg_remote_2_3";
|
|
imports = [ ./remote-builds-ssh-ng.nix ];
|
|
builders.config = { lib, pkgs, ... }: {
|
|
imports = [ checkOverrideNixVersion ];
|
|
nix.package = lib.mkForce pkgs.nixVersions.nix_2_3;
|
|
};
|
|
};
|
|
|
|
remoteBuildsSshNg_remote_2_13 = runNixOSTestFor "x86_64-linux" {
|
|
name = "remoteBuildsSshNg_remote_2_13";
|
|
imports = [ ./remote-builds-ssh-ng.nix ];
|
|
builders.config = { lib, pkgs, ... }: {
|
|
imports = [ checkOverrideNixVersion ];
|
|
nix.package = lib.mkForce pkgs.nixVersions.nix_2_13;
|
|
};
|
|
};
|
|
|
|
# TODO: (nixpkgs update) remoteBuildsSshNg_remote_2_18 = ...
|
|
|
|
# Test our Nix as a builder for clients that are older
|
|
|
|
# FIXME: these tests don't work yet
|
|
/*
|
|
remoteBuildsSshNg_local_2_3 = runNixOSTestFor "x86_64-linux" ({ lib, pkgs, ... }: {
|
|
name = "remoteBuildsSshNg_local_2_3";
|
|
imports = [ ./remote-builds-ssh-ng.nix ];
|
|
nodes.client = { lib, pkgs, ... }: {
|
|
imports = [ checkOverrideNixVersion ];
|
|
nix.package = lib.mkForce pkgs.nixVersions.nix_2_3;
|
|
};
|
|
});
|
|
|
|
remoteBuildsSshNg_local_2_13 = runNixOSTestFor "x86_64-linux" ({ lib, pkgs, ... }: {
|
|
name = "remoteBuildsSshNg_local_2_13";
|
|
imports = [ ./remote-builds-ssh-ng.nix ];
|
|
nodes.client = { lib, pkgs, ... }: {
|
|
imports = [ checkOverrideNixVersion ];
|
|
nix.package = lib.mkForce pkgs.nixVersions.nix_2_13;
|
|
};
|
|
});
|
|
|
|
# TODO: (nixpkgs update) remoteBuildsSshNg_local_2_18 = ...
|
|
*/
|
|
|
|
nix-copy-closure = runNixOSTestFor "x86_64-linux" ./nix-copy-closure.nix;
|
|
|
|
nix-copy = runNixOSTestFor "x86_64-linux" ./nix-copy.nix;
|
|
|
|
nix-upgrade-nix = runNixOSTestFor "x86_64-linux" ./nix-upgrade-nix.nix;
|
|
|
|
nssPreload = runNixOSTestFor "x86_64-linux" ./nss-preload.nix;
|
|
|
|
githubFlakes = runNixOSTestFor "x86_64-linux" ./github-flakes.nix;
|
|
|
|
sourcehutFlakes = runNixOSTestFor "x86_64-linux" ./sourcehut-flakes.nix;
|
|
|
|
tarballFlakes = runNixOSTestFor "x86_64-linux" ./tarball-flakes.nix;
|
|
|
|
containers = runNixOSTestFor "x86_64-linux" ./containers/containers.nix;
|
|
|
|
setuid = lib.genAttrs
|
|
["i686-linux" "x86_64-linux"]
|
|
(system: runNixOSTestFor system ./setuid/setuid.nix);
|
|
|
|
ca-fd-leak = runNixOSTestFor "x86_64-linux" ./ca-fd-leak;
|
|
|
|
fetch-git = runNixOSTestFor "x86_64-linux" ./fetch-git;
|
|
|
|
symlinkResolvconf = runNixOSTestFor "x86_64-linux" ./symlink-resolvconf.nix;
|
|
|
|
rootInSandbox = runNixOSTestFor "x86_64-linux" ./root-in-sandbox;
|
|
|
|
broken-userns = runNixOSTestFor "x86_64-linux" ./broken-userns.nix;
|
|
}
|