Cannot build flake with broken /etc/gitconfig #1086

New issue

Open

opened 2025-12-28 11:58:43 +00:00 by lordgrimmauld · 2 comments

lordgrimmauld commented

2025-12-28 11:58:43 +00:00

Member

Describe the bug

If /etc/gitconfig is invalid, nix will refuse to build any flake outputs, including a nixos system which would fix the gitconfig.

Steps To Reproduce

Create an invalid /etc/gitconfig (I accidentially added invalid git aliases by forgetting !, but other invalid configs should cause the same issue)
Build any local flake which is tracked as git repo
Build fails

Expected behavior

Nix/Lix should not consider /etc/gitconfig at all. gitconfig is a source for impurity, as aliases can drastically change the semantics of commands. This basically makes all of git.cc impure, as it just shells out to system git:

"git", true, {"-C", cacheDir, "--git-dir", ".", "symbolic-ref", "--", "HEAD", headRef}

Ignoring functional impurities, i wouldn't expect my system to fail rebuilds because of a malformed gitconfig.

`nix --version` output

nix (Lix, like Nix) 2.93.3
System type: x86_64-linux
Additional system types: i686-linux, x86_64-v1-linux, x86_64-v2-linux, x86_64-v3-linux
Features: gc, signed-caches
System configuration file: /etc/nix/nix.conf
User configuration files: /home/grimmauld/.config/nix/nix.conf:/etc/xdg/nix/nix.conf:/home/grimmauld/.nix-profile/etc/xdg/nix/nix.conf:/nix/profile/etc/xdg/nix/nix.conf:/home/grimmauld/.local/state/nix/profile/etc/xdg/nix/nix.conf:/etc/profiles/per-user/grimmauld/etc/xdg/nix/nix.conf:/nix/var/nix/profiles/default/etc/xdg/nix/nix.conf:/run/current-system/sw/etc/xdg/nix/nix.conf
Store directory: /nix/store
State directory: /nix/var/nix
Data directory: /nix/store/m7fmmz7p9c4v9vzr90blpncqbc1nc4zr-lix-2.93.3/share

Additional context

NixOS/nixpkgs should probably also validate the /etc/gitconfig to be valid, but that does not address the impurity concerns.

## Describe the bug If `/etc/gitconfig` is invalid, `nix` will refuse to build any flake outputs, including a nixos system which would fix the gitconfig. ## Steps To Reproduce 1. Create an invalid `/etc/gitconfig` (I accidentially added invalid git aliases by forgetting `!`, but other invalid configs should cause the same issue) 2. Build any local flake which is tracked as git repo 3. Build fails ## Expected behavior Nix/Lix should not consider `/etc/gitconfig` at all. `gitconfig` is a source for impurity, as aliases can drastically change the semantics of commands. This basically makes all of `git.cc` impure, as it just shells out to system git: https://git.lix.systems/lix-project/lix/src/commit/fa6210916403c83a6662c49b3f7204e87c62340e/lix/libfetchers/git.cc#L109 Ignoring functional impurities, i wouldn't expect my system to fail rebuilds because of a malformed `gitconfig`. ## `nix --version` output ``` nix (Lix, like Nix) 2.93.3 System type: x86_64-linux Additional system types: i686-linux, x86_64-v1-linux, x86_64-v2-linux, x86_64-v3-linux Features: gc, signed-caches System configuration file: /etc/nix/nix.conf User configuration files: /home/grimmauld/.config/nix/nix.conf:/etc/xdg/nix/nix.conf:/home/grimmauld/.nix-profile/etc/xdg/nix/nix.conf:/nix/profile/etc/xdg/nix/nix.conf:/home/grimmauld/.local/state/nix/profile/etc/xdg/nix/nix.conf:/etc/profiles/per-user/grimmauld/etc/xdg/nix/nix.conf:/nix/var/nix/profiles/default/etc/xdg/nix/nix.conf:/run/current-system/sw/etc/xdg/nix/nix.conf Store directory: /nix/store State directory: /nix/var/nix Data directory: /nix/store/m7fmmz7p9c4v9vzr90blpncqbc1nc4zr-lix-2.93.3/share ``` ## Additional context NixOS/nixpkgs should *probably* also validate the `/etc/gitconfig` to be valid, but that does not address the impurity concerns.

lordgrimmauld added the

labels

2025-12-28 11:58:43 +00:00

pennae commented

2025-12-28 12:26:37 +00:00

Owner

this is a bit tricky. the global and per-user git configs may contain things like credentials or credential helpers that can be mandatory to fetch some inputs at all, e.g. in closed environments that force authentication for all fetches. we also can't easily detect whether git failed due to a configuration error or something else because git doesn't communicate this in a machine-readable form. the best we could do here is to disable the global/per-user config via a setting, but without a user-local setting mechanism that is completely at odds with how the git config system works. maybe once the flake fissure is done we can come up with something good to do about this.

(we also do not consider this an impurity because it's not run during builds, but during eval. if we restricted all eval to be "fully pure" we'd lose the ability to fetch almost anything in settings that require authenticated fetches, which would be a bit of a disaster)

👍 1

pennae added

and removed

labels

2025-12-28 12:27:43 +00:00

commentatorforall commented

2025-12-28 12:36:23 +00:00

Member

i kinda agree with both sides; and imo a broken config should be a warning not an error (as the latter results in an un-fixable machine)

also fetcher issue, not exclusively flakes (hence not blocked(?))

i kinda agree with both sides; and imo a broken config should be a warning not an error (as the latter results in an un-fixable machine) also fetcher issue, not exclusively flakes (hence not blocked(?))