lix-project/lix

Fork 55

Cannot use `pkgs.fetchgit` (and other fetchers) through proxy #986

New issue

Open

opened 2025-09-04 11:10:05 +00:00 by inmaldrerah · 8 comments

inmaldrerah commented

2025-09-04 11:10:05 +00:00

Describe the bug

I set up global proxy on my NixOS and tried to build a derivation using pkgs.fetchgit in it, but it failed because it was unable to connect to the proxy server.

Steps To Reproduce

Set global proxy in NixOS configuration.nix with networking.proxy.default = "http://127.0.0.1:1081"; and rebuild system
Build any derivation with pkgs.fetchgit, e.g.

{ pkgs ? import <nixpkgs> {} }:
pkgs.fetchgit {
  url = "https://github.com/nixos/nixpkgs";
  rev = "aaff8c16d7fc04991cac6245bee1baa31f72b1e1";
}

(I know it's incorrect without a hash, but that doesn't matter here)
3. nix-build fails with error:

error: builder for '/nix/store/h4qay1zvygagyqp272pv8ndjgdh3f6v8-nixpkgs-aaff8c1.drv' failed with exit code 1;
       last 6 log lines:
       > exporting https://github.com/nixos/nixpkgs (rev aaff8c16d7fc04991cac6245bee1baa31f72b1e1) into /nix/store/0vjpfqcw8zlxwx5i3f23msi0bf19x7g9-nixpkgs-aaff8c1
       > Initialized empty Git repository in /nix/store/0vjpfqcw8zlxwx5i3f23msi0bf19x7g9-nixpkgs-aaff8c1/.git/
       > fatal: unable to access 'https://github.com/nixos/nixpkgs/': Failed to connect to 127.0.0.1 port 1081 after 0 ms: Could not connect to server
       > fatal: unable to access 'https://github.com/nixos/nixpkgs/': Failed to connect to 127.0.0.1 port 1081 after 0 ms: Could not connect to server
       > fatal: unable to access 'https://github.com/nixos/nixpkgs/': Failed to connect to 127.0.0.1 port 1081 after 0 ms: Could not connect to server
       > Unable to checkout aaff8c16d7fc04991cac6245bee1baa31f72b1e1 from https://github.com/nixos/nixpkgs.
       For full logs, run 'nix log /nix/store/h4qay1zvygagyqp272pv8ndjgdh3f6v8-nixpkgs-aaff8c1.drv'.

Expected behavior

Fetch the repository and tell me the hash is wrong.

`nix --version` output

nix (Lix, like Nix) 2.93.3
System type: x86_64-linux
Additional system types: i686-linux, x86_64-v1-linux, x86_64-v2-linux, x86_64-v3-linux, x86_64-v4-linux
Features: gc, signed-caches
System configuration file: /etc/nix/nix.conf
User configuration files: /home/inme/.config/nix/nix.conf:/etc/xdg/nix/nix.conf:/home/inme/.nix-profile/etc/xdg/nix/nix.conf:/nix/profile/etc/xdg/nix/nix.conf:/home/inme/.local/state/nix/profile/etc/xdg/nix/nix.conf:/etc/profiles/per-user/inme/etc/xdg/nix/nix.conf:/nix/var/nix/profiles/default/etc/xdg/nix/nix.conf:/run/current-system/sw/etc/xdg/nix/nix.conf
Store directory: /nix/store
State directory: /nix/var/nix
Data directory: /nix/store/s7izz6akz2q6wilmbll41nrwnfrgfl68-lix-2.93.3/share

Additional context

The same derivation builds with official Nix, so it should be a Lix-specific problem, I think.

Using other fetchers, e.g. fetchurl, also fails similarly.

## Describe the bug I set up global proxy on my NixOS and tried to build a derivation using pkgs.fetchgit in it, but it failed because it was unable to connect to the proxy server. ## Steps To Reproduce 1. Set global proxy in NixOS configuration.nix with `networking.proxy.default = "http://127.0.0.1:1081";` and rebuild system 2. Build any derivation with `pkgs.fetchgit`, e.g. ```nix { pkgs ? import <nixpkgs> {} }: pkgs.fetchgit { url = "https://github.com/nixos/nixpkgs"; rev = "aaff8c16d7fc04991cac6245bee1baa31f72b1e1"; } ``` (I know it's incorrect without a hash, but that doesn't matter here) 3. `nix-build` fails with error: ```log error: builder for '/nix/store/h4qay1zvygagyqp272pv8ndjgdh3f6v8-nixpkgs-aaff8c1.drv' failed with exit code 1; last 6 log lines: > exporting https://github.com/nixos/nixpkgs (rev aaff8c16d7fc04991cac6245bee1baa31f72b1e1) into /nix/store/0vjpfqcw8zlxwx5i3f23msi0bf19x7g9-nixpkgs-aaff8c1 > Initialized empty Git repository in /nix/store/0vjpfqcw8zlxwx5i3f23msi0bf19x7g9-nixpkgs-aaff8c1/.git/ > fatal: unable to access 'https://github.com/nixos/nixpkgs/': Failed to connect to 127.0.0.1 port 1081 after 0 ms: Could not connect to server > fatal: unable to access 'https://github.com/nixos/nixpkgs/': Failed to connect to 127.0.0.1 port 1081 after 0 ms: Could not connect to server > fatal: unable to access 'https://github.com/nixos/nixpkgs/': Failed to connect to 127.0.0.1 port 1081 after 0 ms: Could not connect to server > Unable to checkout aaff8c16d7fc04991cac6245bee1baa31f72b1e1 from https://github.com/nixos/nixpkgs. For full logs, run 'nix log /nix/store/h4qay1zvygagyqp272pv8ndjgdh3f6v8-nixpkgs-aaff8c1.drv'. ``` ## Expected behavior Fetch the repository and tell me the hash is wrong. ## `nix --version` output ```log nix (Lix, like Nix) 2.93.3 System type: x86_64-linux Additional system types: i686-linux, x86_64-v1-linux, x86_64-v2-linux, x86_64-v3-linux, x86_64-v4-linux Features: gc, signed-caches System configuration file: /etc/nix/nix.conf User configuration files: /home/inme/.config/nix/nix.conf:/etc/xdg/nix/nix.conf:/home/inme/.nix-profile/etc/xdg/nix/nix.conf:/nix/profile/etc/xdg/nix/nix.conf:/home/inme/.local/state/nix/profile/etc/xdg/nix/nix.conf:/etc/profiles/per-user/inme/etc/xdg/nix/nix.conf:/nix/var/nix/profiles/default/etc/xdg/nix/nix.conf:/run/current-system/sw/etc/xdg/nix/nix.conf Store directory: /nix/store State directory: /nix/var/nix Data directory: /nix/store/s7izz6akz2q6wilmbll41nrwnfrgfl68-lix-2.93.3/share ``` ## Additional context The same derivation builds with official Nix, so it should be a Lix-specific problem, I think. Using other fetchers, e.g. fetchurl, also fails similarly.

inmaldrerah added the

bug

label

2025-09-04 11:10:05 +00:00

pennae commented

2025-09-04 14:13:10 +00:00

Owner

can you retry with nix.settings.pasta-path = "" in your config?

can you retry with `nix.settings.pasta-path = ""` in your config?

jade commented

2025-09-04 16:27:34 +00:00

Owner

we didn't turn pasta on by default right? ~~i suspect this is just dns resolution shenanigans and /etc/resolv.conf. though pasta surely should be necessary to make the resolver unreachable from fod sandbox right? overall, weird.~~

~~another possibility is a straight up broken entry in resolv.conf.~~

~~OR is this a busted proxy config? port 1081 is a weird port and I'm really wondering why it's being used.~~

wow oops. very curious what causes that proxy to be unreachable. pasta seems like a good candidate tbh!

we didn't turn pasta on by default right? ~~i suspect this is just dns resolution shenanigans and /etc/resolv.conf. though pasta surely should be necessary to make the resolver unreachable from fod sandbox right? overall, weird.~~ ~~another possibility is a straight up broken entry in resolv.conf.~~ ~~OR is this a busted proxy config? port 1081 is a weird port and I'm really wondering why it's being used.~~ wow oops. very curious what causes that proxy to be unreachable. pasta seems like a good candidate tbh!

jade added the

Area/store

label

2025-09-04 16:27:55 +00:00

raito commented

2025-09-04 16:45:20 +00:00

Owner

We turned Pasta on by default on NixOS unstable, not on NixOS stable.
Pasta is also turned on by default on HEAD builds.

We turned Pasta on by default on NixOS unstable, not on NixOS stable. Pasta is also turned on by default on HEAD builds.

inmaldrerah commented

2025-09-05 06:15:54 +00:00

Author

@pennae wrote in #986 (comment):

can you retry with nix.settings.pasta-path = "" in your config?

It seems to build correctly without pasta (i.e. with this line), asking me to correct the hash.

@pennae wrote in https://git.lix.systems/lix-project/lix/issues/986#issuecomment-14825: > can you retry with `nix.settings.pasta-path = ""` in your config? It seems to build correctly without pasta (i.e. with this line), asking me to correct the hash.

pennae commented

2025-09-05 09:43:46 +00:00

Owner

had feared as much. interestingly we cannot reproduce this behavior, when we add a proxy that rejects all connections we instead get

building '/nix/store/grjv3m4a0jwmqksj5pgh5qa81iwk6gr7-nixpkgs-aaff8c1.drv'...
exporting https://github.com/nixos/nixpkgs (rev aaff8c16d7fc04991cac6245bee1baa31f72b1e1) into /nix/store/0vjpfqcw8zlxwx5i3f23msi0bf19x7g9-nixpkgs-aaff8c1
Initialized empty Git repository in /nix/store/0vjpfqcw8zlxwx5i3f23msi0bf19x7g9-nixpkgs-aaff8c1/.git/
fatal: unable to access 'https://github.com/nixos/nixpkgs/': Proxy CONNECT aborted
fatal: unable to access 'https://github.com/nixos/nixpkgs/': Proxy CONNECT aborted
fatal: unable to access 'https://github.com/nixos/nixpkgs/': Proxy CONNECT aborted
Unable to checkout aaff8c16d7fc04991cac6245bee1baa31f72b1e1 from https://github.com/nixos/nixpkgs.

had feared as much. interestingly we cannot reproduce this behavior, when we add a proxy that rejects all connections we instead get ``` building '/nix/store/grjv3m4a0jwmqksj5pgh5qa81iwk6gr7-nixpkgs-aaff8c1.drv'... exporting https://github.com/nixos/nixpkgs (rev aaff8c16d7fc04991cac6245bee1baa31f72b1e1) into /nix/store/0vjpfqcw8zlxwx5i3f23msi0bf19x7g9-nixpkgs-aaff8c1 Initialized empty Git repository in /nix/store/0vjpfqcw8zlxwx5i3f23msi0bf19x7g9-nixpkgs-aaff8c1/.git/ fatal: unable to access 'https://github.com/nixos/nixpkgs/': Proxy CONNECT aborted fatal: unable to access 'https://github.com/nixos/nixpkgs/': Proxy CONNECT aborted fatal: unable to access 'https://github.com/nixos/nixpkgs/': Proxy CONNECT aborted Unable to checkout aaff8c16d7fc04991cac6245bee1baa31f72b1e1 from https://github.com/nixos/nixpkgs. ```

inmaldrerah commented

2025-09-06 10:44:55 +00:00

Author

I made a demo config based on my current nixos config, and it encounters the problem in the vm built by nixos-rebuild build-vm:

https://github.com/inmaldrerah/nixos-config/tree/demo

I made a demo config based on my current nixos config, and it encounters the problem in the vm built by `nixos-rebuild build-vm`: https://github.com/inmaldrerah/nixos-config/tree/demo Log in with user `inme` and password `passwd`.

pennae commented

2025-09-06 12:06:51 +00:00

Owner

alright, that helps a lot!

unfortunately it's a kernel bug. the next kernel updates nixos gets should fix it, until then all you can do is disable pasta.

alright, that helps a lot! unfortunately it's a [kernel bug](https://lore.kernel.org/all/20250822172335.3187858-1-sbrivio@redhat.com/). the next kernel updates nixos gets should fix it, until then all you can do is disable pasta.

pennae commented

2025-09-10 12:28:19 +00:00

Owner

the most recent crop of stable releases (6.16.6, 6.12.46, 6.6.105, 6.1.151) have the fix, the bug should resolve itself once nixpkgs picks these up.