`nix flake update` as non-trusted user emits warnings about `tarball-ttl` #680

New issue

Closed

opened 2025-02-17 07:36:27 +00:00 by cobaltcause · 4 comments

cobaltcause commented

2025-02-17 07:36:27 +00:00

Member

The first two lines printed after starting nix flake update are:

warning: Ignoring the client-specified setting 'tarball-ttl', because it is a restricted setting and you are not a trusted user
warning: Ignoring the client-specified setting 'tarball-ttl', because it is a restricted setting and you are not a trusted user

This confused me because I'm not setting that anywhere. Seems to me like Lix might be doing this internally somewhere. Maybe it should not try to do that if the current user isn't trusted?

The first two lines printed after starting `nix flake update` are: ``` warning: Ignoring the client-specified setting 'tarball-ttl', because it is a restricted setting and you are not a trusted user warning: Ignoring the client-specified setting 'tarball-ttl', because it is a restricted setting and you are not a trusted user ``` This confused me because I'm not setting that anywhere. Seems to me like Lix might be doing this internally somewhere. Maybe it should not try to do that if the current user isn't trusted?

👍 2

jade added the

bug

Area/store

Area/protocol

labels

2025-02-17 09:29:48 +00:00

sersorrel commented

2025-02-25 14:21:06 +00:00

I would very naively assume that this is related to this line in CmdFlakeUpdate (there is a similar one in CmdFlakeLock):

settings.tarballTtl.override(0);

Nix's equivalent (https://github.com/NixOS/nix/blame/8384e41b7608b5ff50306d3dec6171483cf2d4cd/src/nix/flake.cc#L131) is:

        settings.tarballTtl = 0;

It was changed in 4dbbd721eb, which suggests that "Only overridden settings are sent to the daemon" – so perhaps this is a latent Nix bug, hidden by the setting being silently ignored?

I would very naively assume that this is related to this line in `CmdFlakeUpdate` (there is a similar one in `CmdFlakeLock`): https://git.lix.systems/lix-project/lix/src/commit/42a8fb96567ef4ffae9494056da0c8ca5a7634df/lix/nix/flake.cc#L121 Nix's equivalent (https://github.com/NixOS/nix/blame/8384e41b7608b5ff50306d3dec6171483cf2d4cd/src/nix/flake.cc#L131) is: ```cpp settings.tarballTtl = 0; ``` It was changed in 4dbbd721eb9db75d4968a624b8cb9e75e979a144, which suggests that "Only overridden settings are sent to the daemon" – so perhaps this is a latent Nix bug, hidden by the setting being silently ignored?

pennae added this to the 2.93 milestone

2025-04-24 21:36:01 +00:00

pennae commented

2025-04-25 17:04:04 +00:00

Owner

@alois31 was this intentional?

alois31 commented

2025-04-25 17:26:46 +00:00

Member

Ugh, the error message was certainly not intentional fallout from that change. Really the ultimate goal was that settings like that should never be sent to the daemon, but that work has unfortunately stalled.

Ugh, the error message was certainly not intentional fallout from that change. Really the ultimate goal was that settings like that should *never* be sent to the daemon, but that work has unfortunately stalled.

lix-bot commented

2025-05-07 18:08:30 +00:00

Member

This issue was mentioned on Gerrit on the following CLs:

commit message in cl/3097 ("nix: don't send tarballTtl to the daemon")
commit message in cl/3117 ("nix: don't send tarballTtl to the daemon")

This issue was mentioned on Gerrit on the following CLs: * commit message in [cl/3097](https://gerrit.lix.systems/c/lix/+/3097) ("nix: don't send tarballTtl to the daemon") * commit message in [cl/3117](https://gerrit.lix.systems/c/lix/+/3117) ("nix: don't send tarballTtl to the daemon")