lix-project/lix-installer
16
4
Fork 4
Code Issues 23 Code Review (Gerrit) Projects Activity

Make our Nix installation immune to macOS upgrades (#672)

Browse source 
* Add cargo-watch

* clippy: the borrowed expression implements the required traits

* clippy: expression creates a reference which is immediately dereferenced by the compiler

* clippy: redundant closure

* clippy: this if-then-else expression returns a bool literal

* clippy: explicit call to .into_iter() in function argument accepting IntoIterator

* Clippy: an implementation of From is preferred since it gives you Into<_> for free where the reverse isn't true

* Support cargo building on a mac

* Create a nix-hook service on macos to inject the shell at startup

* Introduce nix-installe restore-shell to fix the init scripts, called by the nix-hook plist on every login

* Wait for /nix to be there, and restart the hook until it works

* Back to run-at-load hoping that works

* Revert "Back to run-at-load hoping that works"

This reverts commit cccb8bcd971e296fecc0a2dba4f1101795bcd5ba.

It starts too early, fails, and then aborts. When it fails,
launchd says the service failed to initialize and that the system
is read-only.

* nits

* rename to repair

* Handle --no-modify-profile

* fmt

---------

Co-authored-by: Ana Hobden <operator@hoverbear.org>
This commit is contained in:
Graham Christensen 2023-10-16 14:50:33 -04:00 committed by GitHub
parent 5e06d6fcd2
commit 32dcdb7550
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
8 changed files with 320 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
flake.nix
View file

@ -138,6 +138,7 @@
cargo-outdated
cacert
cargo-audit
cargo-watch
nixpkgs-fmt
check.check-rustfmt
check.check-spelling
@ -149,6 +150,7 @@
++ lib.optionals (pkgs.stdenv.isDarwin) (with pkgs; [
libiconv
darwin.apple_sdk.frameworks.Security
darwin.apple_sdk.frameworks.SystemConfiguration
])
++ lib.optionals (pkgs.stdenv.isLinux) (with pkgs; [
checkpolicy

6
src/action/common/configure_init_service.rs
View file

@ -182,7 +182,7 @@ impl Action for ConfigureInitService {
execute_command(
Command::new("launchctl")
.process_group(0)
.args(&["load", "-w"])
.args(["load", "-w"])
.arg(DARWIN_NIX_DAEMON_DEST)
.stdin(std::process::Stdio::null()),
)
@ -192,7 +192,7 @@ impl Action for ConfigureInitService {
let domain = "system";
let service = "org.nixos.nix-daemon";
let is_disabled = crate::action::macos::service_is_disabled(&domain, &service)
let is_disabled = crate::action::macos::service_is_disabled(domain, service)
.await
.map_err(Self::error)?;
if is_disabled {
@ -395,7 +395,7 @@ impl Action for ConfigureInitService {
.arg(DARWIN_NIX_DAEMON_DEST),
)
.await
.map_err(|e| Self::error(e))?;
.map_err(Self::error)?;
},
#[cfg(target_os = "linux")]
InitSystem::Systemd => {

226
src/action/macos/create_nix_hook_service.rs Normal file
View file

@ -0,0 +1,226 @@
use serde::{Deserialize, Serialize};
use tracing::{span, Span};
use std::path::PathBuf;
use tokio::{
fs::{remove_file, OpenOptions},
io::AsyncWriteExt,
process::Command,
};
use crate::{
action::{Action, ActionDescription, ActionError, ActionErrorKind, ActionTag, StatefulAction},
execute_command,
};
/** Create a plist for a `launchctl` service to re-add Nix to the zshrc after upgrades.
*/
#[derive(Debug, serde::Deserialize, serde::Serialize, Clone)]
pub struct CreateNixHookService {
path: PathBuf,
service_label: String,
needs_bootout: bool,
}
impl CreateNixHookService {
#[tracing::instrument(level = "debug", skip_all)]
pub async fn plan() -> Result<StatefulAction<Self>, ActionError> {
let mut this = Self {
path: PathBuf::from(
"/Library/LaunchDaemons/systems.determinate.nix-installer.nix-hook.plist",
),
service_label: "systems.determinate.nix-installer.nix-hook".into(),
needs_bootout: false,
};
// If the service is currently loaded or running, we need to unload it during execute (since we will then recreate it and reload it)
// This `launchctl` command may fail if the service isn't loaded
let mut check_loaded_command = Command::new("launchctl");
check_loaded_command.process_group(0);
check_loaded_command.arg("print");
check_loaded_command.arg(format!("system/{}", this.service_label));
tracing::trace!(
command = format!("{:?}", check_loaded_command.as_std()),
"Executing"
);
let check_loaded_output = check_loaded_command
.output()
.await
.map_err(|e| ActionErrorKind::command(&check_loaded_command, e))
.map_err(Self::error)?;
this.needs_bootout = check_loaded_output.status.success();
if this.needs_bootout {
tracing::debug!(
"Detected loaded service `{}` which needs unload before replacing `{}`",
this.service_label,
this.path.display(),
);
}
if this.path.exists() {
let discovered_plist: LaunchctlHookPlist =
plist::from_file(&this.path).map_err(Self::error)?;
let expected_plist = generate_plist(&this.service_label)
.await
.map_err(Self::error)?;
if discovered_plist != expected_plist {
tracing::trace!(
?discovered_plist,
?expected_plist,
"Parsed plists not equal"
);
return Err(Self::error(CreateNixHookServiceError::DifferentPlist {
expected: expected_plist,
discovered: discovered_plist,
path: this.path.clone(),
}));
}
tracing::debug!("Creating file `{}` already complete", this.path.display());
return Ok(StatefulAction::completed(this));
}
Ok(StatefulAction::uncompleted(this))
}
}
#[async_trait::async_trait]
#[typetag::serde(name = "create_nix_hook_service")]
impl Action for CreateNixHookService {
fn action_tag() -> ActionTag {
ActionTag("create_nix_hook_service")
}
fn tracing_synopsis(&self) -> String {
format!(
"{maybe_unload} a `launchctl` plist to put Nix into your PATH",
maybe_unload = if self.needs_bootout {
"Unload, then recreate"
} else {
"Create"
}
)
}
fn tracing_span(&self) -> Span {
let span = span!(
tracing::Level::DEBUG,
"create_nix_hook_service",
path = tracing::field::display(self.path.display()),
buf = tracing::field::Empty,
);
span
}
fn execute_description(&self) -> Vec<ActionDescription> {
vec![ActionDescription::new(self.tracing_synopsis(), vec![])]
}
#[tracing::instrument(level = "debug", skip_all)]
async fn execute(&mut self) -> Result<(), ActionError> {
let Self {
path,
service_label,
needs_bootout,
} = self;
if *needs_bootout {
execute_command(
Command::new("launchctl")
.process_group(0)
.arg("bootout")
.arg(format!("system/{service_label}")),
)
.await
.map_err(Self::error)?;
}
let generated_plist = generate_plist(service_label).await.map_err(Self::error)?;
let mut options = OpenOptions::new();
options.create(true).write(true).read(true);
let mut file = options
.open(&path)
.await
.map_err(|e| Self::error(ActionErrorKind::Open(path.to_owned(), e)))?;
let mut buf = Vec::new();
plist::to_writer_xml(&mut buf, &generated_plist).map_err(Self::error)?;
file.write_all(&buf)
.await
.map_err(|e| Self::error(ActionErrorKind::Write(path.to_owned(), e)))?;
Ok(())
}
fn revert_description(&self) -> Vec<ActionDescription> {
vec![ActionDescription::new(
format!("Delete file `{}`", self.path.display()),
vec![format!("Delete file `{}`", self.path.display())],
)]
}
#[tracing::instrument(level = "debug", skip_all)]
async fn revert(&mut self) -> Result<(), ActionError> {
remove_file(&self.path)
.await
.map_err(|e| Self::error(ActionErrorKind::Remove(self.path.to_owned(), e)))?;
Ok(())
}
}
/// This function must be able to operate at both plan and execute time.
async fn generate_plist(service_label: &str) -> Result<LaunchctlHookPlist, ActionErrorKind> {
let plist = LaunchctlHookPlist {
keep_alive: KeepAliveOpts {
successful_exit: false,
},
label: service_label.into(),
program_arguments: vec![
"/bin/sh".into(),
"-c".into(),
"/bin/wait4path /nix/nix-installer && /nix/nix-installer repair".into(),
],
standard_error_path: "/nix/.nix-installer-hook.err.log".into(),
standard_out_path: "/nix/.nix-installer-hook.out.log".into(),
};
Ok(plist)
}
#[derive(Deserialize, Clone, Debug, Serialize, PartialEq)]
#[serde(rename_all = "PascalCase")]
pub struct LaunchctlHookPlist {
label: String,
program_arguments: Vec<String>,
keep_alive: KeepAliveOpts,
standard_error_path: String,
standard_out_path: String,
}
#[derive(Deserialize, Clone, Debug, Serialize, PartialEq)]
#[serde(rename_all = "PascalCase")]
pub struct KeepAliveOpts {
successful_exit: bool,
}
#[non_exhaustive]
#[derive(Debug, thiserror::Error)]
pub enum CreateNixHookServiceError {
#[error(
"`{path}` exists and contains content different than expected. Consider removing the file."
)]
DifferentPlist {
expected: LaunchctlHookPlist,
discovered: LaunchctlHookPlist,
path: PathBuf,
},
}
impl From<CreateNixHookServiceError> for ActionErrorKind {
fn from(val: CreateNixHookServiceError) -> Self {
ActionErrorKind::Custom(Box::new(val))
}
}

2
src/action/macos/mod.rs
View file

@ -4,6 +4,7 @@
pub(crate) mod bootstrap_launchctl_service;
pub(crate) mod create_apfs_volume;
pub(crate) mod create_fstab_entry;
pub(crate) mod create_nix_hook_service;
pub(crate) mod create_nix_volume;
pub(crate) mod create_synthetic_objects;
pub(crate) mod create_volume_service;
@ -16,6 +17,7 @@ pub(crate) mod unmount_apfs_volume;
pub use bootstrap_launchctl_service::BootstrapLaunchctlService;
pub use create_apfs_volume::CreateApfsVolume;
pub use create_nix_hook_service::CreateNixHookService;
pub use create_nix_volume::{CreateNixVolume, NIX_VOLUME_MOUNTD_DEST};
pub use create_synthetic_objects::CreateSyntheticObjects;
pub use create_volume_service::CreateVolumeService;

1
src/cli/mod.rs
View file

@ -47,6 +47,7 @@ impl CommandExecute for NixInstallerCli {
NixInstallerSubcommand::Plan(plan) => plan.execute().await,
NixInstallerSubcommand::SelfTest(self_test) => self_test.execute().await,
NixInstallerSubcommand::Install(install) => install.execute().await,
NixInstallerSubcommand::Repair(restore_shell) => restore_shell.execute().await,
NixInstallerSubcommand::Uninstall(revert) => revert.execute().await,
}
}

3
src/cli/subcommand/mod.rs
View file

@ -2,6 +2,8 @@ mod plan;
use plan::Plan;
mod install;
use install::Install;
mod repair;
use repair::Repair;
mod uninstall;
use uninstall::Uninstall;
mod self_test;
@ -11,6 +13,7 @@ use self_test::SelfTest;
#[derive(Debug, clap::Subcommand)]
pub enum NixInstallerSubcommand {
Install(Install),
Repair(Repair),
Uninstall(Uninstall),
SelfTest(SelfTest),
Plan(Plan),

46
src/cli/subcommand/repair.rs Normal file
View file

@ -0,0 +1,46 @@
use std::process::ExitCode;
use crate::{
action::common::ConfigureShellProfile,
cli::{ensure_root, CommandExecute},
planner::{PlannerError, ShellProfileLocations},
};
use clap::{ArgAction, Parser};
/**
Update the shell profiles to make Nix usable after system upgrades.
*/
#[derive(Debug, Parser)]
#[command(args_conflicts_with_subcommands = true)]
pub struct Repair {
#[clap(
long,
env = "NIX_INSTALLER_NO_CONFIRM",
action(ArgAction::SetTrue),
default_value = "false",
global = true
)]
pub no_confirm: bool,
}
#[async_trait::async_trait]
impl CommandExecute for Repair {
#[tracing::instrument(level = "trace", skip_all)]
async fn execute(self) -> eyre::Result<ExitCode> {
let Self { no_confirm: _ } = self;
ensure_root()?;
let mut reconfigure = ConfigureShellProfile::plan(ShellProfileLocations::default())
.await
.map_err(PlannerError::Action)?
.boxed();
if let Err(err) = reconfigure.try_execute().await {
println!("{:#?}", err);
Ok(ExitCode::FAILURE)
} else {
Ok(ExitCode::SUCCESS)
}
}
}

51
src/planner/macos.rs
View file

@ -12,7 +12,7 @@ use crate::{
action::{
base::RemoveDirectory,
common::{ConfigureInitService, ConfigureNix, CreateUsersAndGroups, ProvisionNix},
macos::{CreateNixVolume, SetTmutilExclusions},
macos::{CreateNixHookService, CreateNixVolume, SetTmutilExclusions},
StatefulAction,
},
execute_command,
@ -122,15 +122,14 @@ impl Planner for Macos {
let stdout = String::from_utf8_lossy(&output.stdout);
let stdout_trimmed = stdout.trim();
if stdout_trimmed == "true" {
true
} else {
false
}
stdout_trimmed == "true"
},
};
Ok(vec![
let mut plan = vec![];
plan.push(
CreateNixVolume::plan(
root_disk.unwrap(), /* We just ensured it was populated */
self.volume_label.clone(),
@ -140,33 +139,57 @@ impl Planner for Macos {
.await
.map_err(PlannerError::Action)?
.boxed(),
);
plan.push(
ProvisionNix::plan(&self.settings)
.await
.map_err(PlannerError::Action)?
.boxed(),
// Auto-allocate uids is broken on Mac. Tools like `whoami` don't work.
// e.g. https://github.com/NixOS/nix/issues/8444
);
// Auto-allocate uids is broken on Mac. Tools like `whoami` don't work.
// e.g. https://github.com/NixOS/nix/issues/8444
plan.push(
CreateUsersAndGroups::plan(self.settings.clone())
.await
.map_err(PlannerError::Action)?
.boxed(),
);
plan.push(
SetTmutilExclusions::plan(vec![PathBuf::from("/nix/store"), PathBuf::from("/nix/var")])
.await
.map_err(PlannerError::Action)?
.boxed(),
);
plan.push(
ConfigureNix::plan(ShellProfileLocations::default(), &self.settings)
.await
.map_err(PlannerError::Action)?
.boxed(),
);
if self.settings.modify_profile {
plan.push(
CreateNixHookService::plan()
.await
.map_err(PlannerError::Action)?
.boxed(),
);
}
plan.push(
ConfigureInitService::plan(InitSystem::Launchd, true)
.await
.map_err(PlannerError::Action)?
.boxed(),
);
plan.push(
RemoveDirectory::plan(crate::settings::SCRATCH_DIR)
.await
.map_err(PlannerError::Action)?
.boxed(),
])
);
Ok(plan)
}
fn settings(&self) -> Result<HashMap<String, serde_json::Value>, InstallSettingsError> {
@ -179,7 +202,7 @@ impl Planner for Macos {
} = self;
let mut map = HashMap::default();
map.extend(settings.settings()?.into_iter());
map.extend(settings.settings()?);
map.insert("volume_encrypt".into(), serde_json::to_value(encrypt)?);
map.insert("volume_label".into(), serde_json::to_value(volume_label)?);
map.insert("root_disk".into(), serde_json::to_value(root_disk)?);
@ -234,9 +257,9 @@ impl Planner for Macos {
}
}
impl Into<BuiltinPlanner> for Macos {
fn into(self) -> BuiltinPlanner {
BuiltinPlanner::Macos(self)
impl From<Macos> for BuiltinPlanner {
fn from(val: Macos) -> Self {
BuiltinPlanner::Macos(val)
}
}