diff --git a/flake.nix b/flake.nix
index 8fde05179..0597f25c9 100644
--- a/flake.nix
+++ b/flake.nix
@@ -74,40 +74,6 @@
cross = forAllCrossSystems (crossSystem: make-pkgs crossSystem "stdenv");
});
- installScriptFor = systems:
- with nixpkgsFor.x86_64-linux.native;
- runCommand "installer-script"
- { buildInputs = [ nix ];
- }
- ''
- mkdir -p $out/nix-support
-
- # Converts /nix/store/50p3qk8k...-nix-2.4pre20201102_550e11f/bin/nix to 50p3qk8k.../bin/nix.
- tarballPath() {
- # Remove the store prefix
- local path=''${1#${builtins.storeDir}/}
- # Get the path relative to the derivation root
- local rest=''${path#*/}
- # Get the derivation hash
- local drvHash=''${path%%-*}
- echo "$drvHash/$rest"
- }
-
- substitute ${./scripts/install.in} $out/install \
- ${pkgs.lib.concatMapStrings
- (system: let
- tarball = if builtins.elem system crossSystems then self.hydraJobs.binaryTarballCross.x86_64-linux.${system} else self.hydraJobs.binaryTarball.${system};
- in '' \
- --replace '@tarballHash_${system}@' $(nix --experimental-features nix-command hash-file --base16 --type sha256 ${tarball}/*.tar.xz) \
- --replace '@tarballPath_${system}@' $(tarballPath ${tarball}/*.tar.xz) \
- ''
- )
- systems
- } --replace '@nixVersion@' ${version}
-
- echo "file installer $out/install" >> $out/nix-support/hydra-build-products
- '';
-
testNixVersions = pkgs: client: daemon: let
nix = pkgs.callPackage ./package.nix {
pname =
@@ -146,8 +112,7 @@
binaryTarball = nix: pkgs:
let
inherit (pkgs) buildPackages;
- inherit (pkgs) cacert;
- installerClosureInfo = buildPackages.closureInfo { rootPaths = [ nix cacert ]; };
+ installerClosureInfo = buildPackages.closureInfo { rootPaths = [ nix ]; };
in
buildPackages.runCommand "nix-binary-tarball-${version}"
@@ -156,45 +121,7 @@
}
''
cp ${installerClosureInfo}/registration $TMPDIR/reginfo
- cp ${./scripts/create-darwin-volume.sh} $TMPDIR/create-darwin-volume.sh
- substitute ${./scripts/install-nix-from-closure.sh} $TMPDIR/install \
- --subst-var-by nix ${nix} \
- --subst-var-by cacert ${cacert}
- substitute ${./scripts/install-darwin-multi-user.sh} $TMPDIR/install-darwin-multi-user.sh \
- --subst-var-by nix ${nix} \
- --subst-var-by cacert ${cacert}
- substitute ${./scripts/install-systemd-multi-user.sh} $TMPDIR/install-systemd-multi-user.sh \
- --subst-var-by nix ${nix} \
- --subst-var-by cacert ${cacert}
- substitute ${./scripts/install-multi-user.sh} $TMPDIR/install-multi-user \
- --subst-var-by nix ${nix} \
- --subst-var-by cacert ${cacert}
-
- if type -p shellcheck; then
- # SC1090: Don't worry about not being able to find
- # $nix/etc/profile.d/nix.sh
- shellcheck --exclude SC1090 $TMPDIR/install
- shellcheck $TMPDIR/create-darwin-volume.sh
- shellcheck $TMPDIR/install-darwin-multi-user.sh
- shellcheck $TMPDIR/install-systemd-multi-user.sh
-
- # SC1091: Don't panic about not being able to source
- # /etc/profile
- # SC2002: Ignore "useless cat" "error", when loading
- # .reginfo, as the cat is a much cleaner
- # implementation, even though it is "useless"
- # SC2116: Allow ROOT_HOME=$(echo ~root) for resolving
- # root's home directory
- shellcheck --external-sources \
- --exclude SC1091,SC2002,SC2116 $TMPDIR/install-multi-user
- fi
-
- chmod +x $TMPDIR/install
- chmod +x $TMPDIR/create-darwin-volume.sh
- chmod +x $TMPDIR/install-darwin-multi-user.sh
- chmod +x $TMPDIR/install-systemd-multi-user.sh
- chmod +x $TMPDIR/install-multi-user
dir=nix-${version}-${pkgs.system}
fn=$out/$dir.tar.xz
mkdir -p $out/nix-support
@@ -204,15 +131,8 @@
--mtime='1970-01-01' \
--absolute-names \
--hard-dereference \
- --transform "s,$TMPDIR/install,$dir/install," \
- --transform "s,$TMPDIR/create-darwin-volume.sh,$dir/create-darwin-volume.sh," \
--transform "s,$TMPDIR/reginfo,$dir/.reginfo," \
--transform "s,$NIX_STORE,$dir/store,S" \
- $TMPDIR/install \
- $TMPDIR/create-darwin-volume.sh \
- $TMPDIR/install-darwin-multi-user.sh \
- $TMPDIR/install-systemd-multi-user.sh \
- $TMPDIR/install-multi-user \
$TMPDIR/reginfo \
$(cat ${installerClosureInfo}/store-paths)
'';
@@ -288,8 +208,7 @@
perlBindings = forAllSystems (system: nixpkgsFor.${system}.native.nix.perl-bindings);
# Binary tarball for various platforms, containing a Nix store
- # with the closure of 'nix' package, and the second half of
- # the installation script.
+ # with the closure of 'nix' package.
binaryTarball = forAllSystems (system: binaryTarball nixpkgsFor.${system}.native.nix nixpkgsFor.${system}.native);
# docker image with Nix inside
@@ -340,26 +259,11 @@
}
);
};
-
- installTests = forAllSystems (system:
- let pkgs = nixpkgsFor.${system}.native; in
- pkgs.runCommand "install-tests" {
- againstSelf = testNixVersions pkgs pkgs.nix pkgs.pkgs.nix;
- againstCurrentUnstable =
- # FIXME: temporarily disable this on macOS because of #3605.
- if system == "x86_64-linux"
- then testNixVersions pkgs pkgs.nix pkgs.nixUnstable
- else null;
- # Disabled because the latest stable version doesn't handle
- # `NIX_DAEMON_SOCKET_PATH` which is required for the tests to work
- # againstLatestStable = testNixVersions pkgs pkgs.nix pkgs.nixStable;
- } "touch $out");
};
checks = forAllSystems (system: {
binaryTarball = self.hydraJobs.binaryTarball.${system};
perlBindings = self.hydraJobs.perlBindings.${system};
- installTests = self.hydraJobs.installTests.${system};
nixpkgsLibTests = self.hydraJobs.tests.nixpkgsLibTests.${system};
rl-next =
let pkgs = nixpkgsFor.${system}.native;
diff --git a/scripts/bigsur-nixbld-user-migration.sh b/scripts/bigsur-nixbld-user-migration.sh
deleted file mode 100755
index f1619fd56..000000000
--- a/scripts/bigsur-nixbld-user-migration.sh
+++ /dev/null
@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-
-((NEW_NIX_FIRST_BUILD_UID=301))
-
-id_available(){
- dscl . list /Users UniqueID | grep -E '\b'$1'\b' >/dev/null
-}
-
-change_nixbld_names_and_ids(){
- local name uid next_id
- ((next_id=NEW_NIX_FIRST_BUILD_UID))
- echo "Attempting to migrate nixbld users."
- echo "Each user should change from nixbld# to _nixbld#"
- echo "and their IDs relocated to $next_id+"
- while read -r name uid; do
- echo " Checking $name (uid: $uid)"
- # iterate for a clean ID
- while id_available "$next_id"; do
- ((next_id++))
- if ((next_id >= 400)); then
- echo "We've hit UID 400 without placing all of your users :("
- echo "You should use the commands in this script as a starting"
- echo "point to review your UID-space and manually move the"
- echo "remaining users (or delete them, if you don't need them)."
- exit 1
- fi
- done
-
- if [[ $name == _* ]]; then
- echo " It looks like $name has already been renamed--skipping."
- else
- # first 3 are cleanup, it's OK if they aren't here
- sudo dscl . delete /Users/$name dsAttrTypeNative:_writers_passwd &>/dev/null || true
- sudo dscl . change /Users/$name NFSHomeDirectory "/private/var/empty 1" "/var/empty" &>/dev/null || true
- # remove existing user from group
- sudo dseditgroup -o edit -t user -d $name nixbld || true
- sudo dscl . change /Users/$name UniqueID $uid $next_id
- sudo dscl . change /Users/$name RecordName $name _$name
- # add renamed user to group
- sudo dseditgroup -o edit -t user -a _$name nixbld
- echo " $name migrated to _$name (uid: $next_id)"
- fi
- done < <(dscl . list /Users UniqueID | grep nixbld | sort -n -k2)
-}
-
-change_nixbld_names_and_ids
diff --git a/scripts/check-hydra-status.sh b/scripts/check-hydra-status.sh
deleted file mode 100644
index e62705e94..000000000
--- a/scripts/check-hydra-status.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-# set -x
-
-
-# mapfile BUILDS_FOR_LATEST_EVAL < <(
-# curl -H 'Accept: application/json' https://hydra.nixos.org/jobset/nix/master/evals | \
-# jq -r '.evals[0].builds[] | @sh')
-BUILDS_FOR_LATEST_EVAL=$(
-curl -sS -H 'Accept: application/json' https://hydra.nixos.org/jobset/nix/master/evals | \
- jq -r '.evals[0].builds[]')
-
-someBuildFailed=0
-
-for buildId in $BUILDS_FOR_LATEST_EVAL; do
- buildInfo=$(curl --fail -sS -H 'Accept: application/json' "https://hydra.nixos.org/build/$buildId")
-
- finished=$(echo "$buildInfo" | jq -r '.finished')
-
- if [[ $finished = 0 ]]; then
- continue
- fi
-
- buildStatus=$(echo "$buildInfo" | jq -r '.buildstatus')
-
- if [[ $buildStatus != 0 ]]; then
- someBuildFailed=1
- echo "Job “$(echo "$buildInfo" | jq -r '.job')” failed on hydra: $buildInfo"
- fi
-done
-
-exit "$someBuildFailed"
diff --git a/scripts/create-darwin-volume.sh b/scripts/create-darwin-volume.sh
deleted file mode 100755
index 103e1e391..000000000
--- a/scripts/create-darwin-volume.sh
+++ /dev/null
@@ -1,875 +0,0 @@
-#!/usr/bin/env bash
-set -eu
-set -o pipefail
-
-# I'm a little agnostic on the choices, but supporting a wide
-# slate of uses for now, including:
-# - import-only: `. create-darwin-volume.sh no-main[ ...]`
-# - legacy: `./create-darwin-volume.sh` or `. create-darwin-volume.sh`
-# (both will run main())
-# - external alt-routine: `./create-darwin-volume.sh no-main func[ ...]`
-if [ "${1-}" = "no-main" ]; then
- shift
- readonly _CREATE_VOLUME_NO_MAIN=1
-else
- readonly _CREATE_VOLUME_NO_MAIN=0
- # declare some things we expect to inherit from install-multi-user
- # I don't love this (because it's a bit of a kludge).
- #
- # CAUTION: (Dec 19 2020)
- # This is a stopgap. It doesn't cover the full slate of
- # identifiers we inherit--just those necessary to:
- # - avoid breaking direct invocations of this script (here/now)
- # - avoid hard-to-reverse structural changes before the call to rm
- # single-user support is verified
- #
- # In the near-mid term, I (personally) think we should:
- # - decide to deprecate the direct call and add a notice
- # - fold all of this into install-darwin-multi-user.sh
- # - intentionally remove the old direct-invocation form (kill the
- # routine, replace this script w/ deprecation notice and a note
- # on the remove-after date)
- #
- readonly NIX_ROOT="${NIX_ROOT:-/nix}"
-
- _sudo() {
- shift # throw away the 'explanation'
- /usr/bin/sudo "$@"
- }
- failure() {
- if [ "$*" = "" ]; then
- cat
- else
- echo "$@"
- fi
- exit 1
- }
- task() {
- echo "$@"
- }
-fi
-
-# usually "disk1"
-root_disk_identifier() {
- # For performance (~10ms vs 280ms) I'm parsing 'diskX' from stat output
- # (~diskXsY)--but I'm retaining the more-semantic approach since
- # it documents intent better.
- # /usr/sbin/diskutil info -plist / | xmllint --xpath "/plist/dict/key[text()='ParentWholeDisk']/following-sibling::string[1]/text()" -
- #
- local special_device
- special_device="$(/usr/bin/stat -f "%Sd" /)"
- echo "${special_device%s[0-9]*}"
-}
-
-# make it easy to play w/ 'Case-sensitive APFS'
-readonly NIX_VOLUME_FS="${NIX_VOLUME_FS:-APFS}"
-readonly NIX_VOLUME_LABEL="${NIX_VOLUME_LABEL:-Nix Store}"
-# Strongly assuming we'll make a volume on the device / is on
-# But you can override NIX_VOLUME_USE_DISK to create it on some other device
-readonly NIX_VOLUME_USE_DISK="${NIX_VOLUME_USE_DISK:-$(root_disk_identifier)}"
-NIX_VOLUME_USE_SPECIAL="${NIX_VOLUME_USE_SPECIAL:-}"
-NIX_VOLUME_USE_UUID="${NIX_VOLUME_USE_UUID:-}"
-readonly NIX_VOLUME_MOUNTD_DEST="${NIX_VOLUME_MOUNTD_DEST:-/Library/LaunchDaemons/org.nixos.darwin-store.plist}"
-
-if /usr/bin/fdesetup isactive >/dev/null; then
- test_filevault_in_use() { return 0; }
- # no readonly; we may modify if user refuses from cure_volume
- NIX_VOLUME_DO_ENCRYPT="${NIX_VOLUME_DO_ENCRYPT:-1}"
-else
- test_filevault_in_use() { return 1; }
- NIX_VOLUME_DO_ENCRYPT="${NIX_VOLUME_DO_ENCRYPT:-0}"
-fi
-
-should_encrypt_volume() {
- test_filevault_in_use && (( NIX_VOLUME_DO_ENCRYPT == 1 ))
-}
-
-substep() {
- printf " %s\n" "" "- $1" "" "${@:2}"
-}
-
-
-volumes_labeled() {
- local label="$1"
- xsltproc --novalid --stringparam label "$label" - <(/usr/sbin/ioreg -ra -c "AppleAPFSVolume") <<'EOF'
-
-
-
-
-
-
-
- =
-
-
-
-
-EOF
- # I cut label out of the extracted values, but here it is for reference:
- #
- # =
-}
-
-right_disk() {
- local volume_special="$1" # (i.e., disk1s7)
- [[ "$volume_special" == "$NIX_VOLUME_USE_DISK"s* ]]
-}
-
-right_volume() {
- local volume_special="$1" # (i.e., disk1s7)
- # if set, it must match; otherwise ensure it's on the right disk
- if [ -z "$NIX_VOLUME_USE_SPECIAL" ]; then
- if right_disk "$volume_special"; then
- NIX_VOLUME_USE_SPECIAL="$volume_special" # latch on
- return 0
- else
- return 1
- fi
- else
- [ "$volume_special" = "$NIX_VOLUME_USE_SPECIAL" ]
- fi
-}
-
-right_uuid() {
- local volume_uuid="$1"
- # if set, it must match; otherwise allow
- if [ -z "$NIX_VOLUME_USE_UUID" ]; then
- NIX_VOLUME_USE_UUID="$volume_uuid" # latch on
- return 0
- else
- [ "$volume_uuid" = "$NIX_VOLUME_USE_UUID" ]
- fi
-}
-
-cure_volumes() {
- local found volume special uuid
- # loop just in case they have more than one volume
- # (nothing stops you from doing this)
- for volume in $(volumes_labeled "$NIX_VOLUME_LABEL"); do
- # CAUTION: this could (maybe) be a more normal read
- # loop like:
- # while IFS== read -r special uuid; do
- # # ...
- # done <<<"$(volumes_labeled "$NIX_VOLUME_LABEL")"
- #
- # I did it with for to skirt a problem with the obvious
- # pattern replacing stdin and causing user prompts
- # inside (which also use read and access stdin) to skip
- #
- # If there's an existing encrypted volume we can't find
- # in keychain, the user never gets prompted to delete
- # the volume, and the install fails.
- #
- # If you change this, a human needs to test a very
- # specific scenario: you already have an encrypted
- # Nix Store volume, and have deleted its credential
- # from keychain. Ensure the script asks you if it can
- # delete the volume, and then prompts for your sudo
- # password to confirm.
- #
- # shellcheck disable=SC1097
- IFS== read -r special uuid <<< "$volume"
- # take the first one that's on the right disk
- if [ -z "${found:-}" ]; then
- if right_volume "$special" && right_uuid "$uuid"; then
- cure_volume "$special" "$uuid"
- found="${special} (${uuid})"
- else
- warning <
- # Cryptographic user for (1 found)
- # Cryptographic users for (2 found)
- /usr/sbin/diskutil apfs listCryptoUsers -plist "$volume_special" | /usr/bin/grep -q APFSCryptoUserUUID
-}
-
-test_fstab() {
- /usr/bin/grep -q "$NIX_ROOT apfs rw" /etc/fstab 2>/dev/null
-}
-
-test_nix_root_is_symlink() {
- [ -L "$NIX_ROOT" ]
-}
-
-test_synthetic_conf_either(){
- /usr/bin/grep -qE "^${NIX_ROOT:1}($|\t.{3,}$)" /etc/synthetic.conf 2>/dev/null
-}
-
-test_synthetic_conf_mountable() {
- /usr/bin/grep -q "^${NIX_ROOT:1}$" /etc/synthetic.conf 2>/dev/null
-}
-
-test_synthetic_conf_symlinked() {
- /usr/bin/grep -qE "^${NIX_ROOT:1}\t.{3,}$" /etc/synthetic.conf 2>/dev/null
-}
-
-test_nix_volume_mountd_installed() {
- test -e "$NIX_VOLUME_MOUNTD_DEST"
-}
-
-# current volume password
-test_keychain_by_uuid() {
- local volume_uuid="$1"
- # Note: doesn't need sudo just to check; doesn't output pw
- security find-generic-password -s "$volume_uuid" &>/dev/null
-}
-
-get_volume_pass() {
- local volume_uuid="$1"
- _sudo \
- "to confirm keychain has a password that unlocks this volume" \
- security find-generic-password -s "$volume_uuid" -w
-}
-
-verify_volume_pass() {
- local volume_special="$1" # (i.e., disk1s7)
- local volume_uuid="$2"
- _sudo "to confirm the password actually unlocks the volume" \
- /usr/sbin/diskutil apfs unlockVolume "$volume_special" -verify -stdinpassphrase -user "$volume_uuid"
-}
-
-volume_pass_works() {
- local volume_special="$1" # (i.e., disk1s7)
- local volume_uuid="$2"
- get_volume_pass "$volume_uuid" | verify_volume_pass "$volume_special" "$volume_uuid"
-}
-
-# Create the paths defined in synthetic.conf, saving us a reboot.
-create_synthetic_objects() {
- # Big Sur takes away the -B flag we were using and replaces it
- # with a -t flag that appears to do the same thing (but they
- # don't behave exactly the same way in terms of return values).
- # This feels a little dirty, but as far as I can tell the
- # simplest way to get the right one is to just throw away stderr
- # and call both... :]
- {
- /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs.util -t || true # Big Sur
- /System/Library/Filesystems/apfs.fs/Contents/Resources/apfs.util -B || true # Catalina
- } >/dev/null 2>&1
-}
-
-test_nix() {
- test -d "$NIX_ROOT"
-}
-
-test_voldaemon() {
- test -f "$NIX_VOLUME_MOUNTD_DEST"
-}
-
-generate_mount_command() {
- local cmd_type="$1" # encrypted|unencrypted
- local volume_uuid mountpoint cmd=()
- printf -v volume_uuid "%q" "$2"
- printf -v mountpoint "%q" "$NIX_ROOT"
-
- case "$cmd_type" in
- encrypted)
- cmd=(/bin/sh -c "/usr/bin/security find-generic-password -s '$volume_uuid' -w | /usr/sbin/diskutil apfs unlockVolume '$volume_uuid' -mountpoint '$mountpoint' -stdinpassphrase");;
- unencrypted)
- cmd=(/usr/sbin/diskutil mount -mountPoint "$mountpoint" "$volume_uuid");;
- *)
- failure "Invalid first arg $cmd_type to generate_mount_command";;
- esac
-
- printf " %s\n" "${cmd[@]}"
-}
-
-generate_mount_daemon() {
- local cmd_type="$1" # encrypted|unencrypted
- local volume_uuid="$2"
- cat <
-
-
-
- RunAtLoad
-
- Label
- org.nixos.darwin-store
- ProgramArguments
-
-$(generate_mount_command "$cmd_type" "$volume_uuid")
-
-
-
-EOF
-}
-
-_eat_bootout_err() {
- /usr/bin/grep -v "Boot-out failed: 36: Operation now in progress"
-}
-
-# TODO: remove with --uninstall?
-uninstall_launch_daemon_directions() {
- local daemon_label="$1" # i.e., org.nixos.blah-blah
- local daemon_plist="$2" # abspath
- substep "Uninstall LaunchDaemon $daemon_label" \
- " sudo launchctl bootout system/$daemon_label" \
- " sudo rm $daemon_plist"
-}
-
-uninstall_launch_daemon_prompt() {
- local daemon_label="$1" # i.e., org.nixos.blah-blah
- local daemon_plist="$2" # abspath
- local reason_for_daemon="$3"
- cat < >(_eat_bootout_err >&2) || true
- # this can "fail" with a message like:
- # Boot-out failed: 36: Operation now in progress
- _sudo "to remove the daemon definition" rm "$daemon_plist"
- fi
-}
-
-nix_volume_mountd_uninstall_directions() {
- uninstall_launch_daemon_directions "org.nixos.darwin-store" \
- "$NIX_VOLUME_MOUNTD_DEST"
-}
-
-nix_volume_mountd_uninstall_prompt() {
- uninstall_launch_daemon_prompt "org.nixos.darwin-store" \
- "$NIX_VOLUME_MOUNTD_DEST" \
- "mount your Nix volume"
-}
-
-# TODO: move nix_daemon to install-darwin-multi-user if/when uninstall_launch_daemon_prompt moves up to install-multi-user
-nix_daemon_uninstall_prompt() {
- uninstall_launch_daemon_prompt "org.nixos.nix-daemon" \
- "$NIX_DAEMON_DEST" \
- "run the nix-daemon"
-}
-
-# TODO: remove with --uninstall?
-nix_daemon_uninstall_directions() {
- uninstall_launch_daemon_directions "org.nixos.nix-daemon" \
- "$NIX_DAEMON_DEST"
-}
-
-
-# TODO: remove with --uninstall?
-synthetic_conf_uninstall_directions() {
- # :1 to strip leading slash
- substep "Remove ${NIX_ROOT:1} from /etc/synthetic.conf" \
- " If nix is the only entry: sudo rm /etc/synthetic.conf" \
- " Otherwise: sudo /usr/bin/sed -i '' -e '/^${NIX_ROOT:1}$/d' /etc/synthetic.conf"
-}
-
-synthetic_conf_uninstall_prompt() {
- cat < "$SCRATCH/synthetic.conf.edit"
-
- if test_synthetic_conf_symlinked; then
- warning </dev/null; then
- if confirm_rm "/etc/synthetic.conf"; then
- if test_nix_root_is_symlink; then
- failure >&2 < $(readlink "$NIX_ROOT")). The system should remove it when you reboot.
-Once you've rebooted, run the installer again.
-EOF
- fi
- return 0
- fi
- else
- if confirm_edit "$SCRATCH/synthetic.conf.edit" "/etc/synthetic.conf"; then
- if test_nix_root_is_symlink; then
- failure >&2 < $(readlink "$NIX_ROOT")). The system should remove it when you reboot.
-Once you've rebooted, run the installer again.
-EOF
- fi
- return 0
- fi
- fi
- # fallback instructions
- echo "Manually remove nix from /etc/synthetic.conf"
- return 1
-}
-
-add_nix_vol_fstab_line() {
- local uuid="$1"
- # shellcheck disable=SC1003,SC2026
- local escaped_mountpoint="${NIX_ROOT/ /'\\\'040}"
- shift
-
- # wrap `ex` to work around problems w/ vim features breaking exit codes
- # - plugins (see github.com/NixOS/nix/issues/5468): -u NONE
- # - swap file: -n
- #
- # the first draft used `--noplugin`, but github.com/NixOS/nix/issues/6462
- # suggests we need the less-semantic `-u NONE`
- #
- # we'd prefer EDITOR="/usr/bin/ex -u NONE" but vifs doesn't word-split
- # the EDITOR env.
- #
- # TODO: at some point we should switch to `--clean`, but it wasn't added
- # until https://github.com/vim/vim/releases/tag/v8.0.1554 while the macOS
- # minver 10.12.6 seems to have released with vim 7.4
- cat > "$SCRATCH/ex_cleanroom_wrapper" <multi-user reinstalls, which may cover this)
- #
- # I'm not sure if it's safe to approach this way?
- #
- # I think I think the most-proper way to test for it is:
- # diskutil info -plist "$NIX_VOLUME_LABEL" | xmllint --xpath "(/plist/dict/key[text()='GlobalPermissionsEnabled'])/following-sibling::*[1][name()='true']" -; echo $?
- #
- # There's also `sudo /usr/sbin/vsdbutil -c /path` (which is much faster, but is also
- # deprecated and needs minor parsing).
- #
- # If no one finds a problem with doing so, I think the simplest approach
- # is to just eagerly set this. I found a few imperative approaches:
- # (diskutil enableOwnership, ~100ms), a cheap one (/usr/sbin/vsdbutil -a, ~40-50ms),
- # a very cheap one (append the internal format to /var/db/volinfo.database).
- #
- # But vsdbutil's deprecation notice suggests using fstab, so I want to
- # give that a whirl first.
- #
- # TODO: when this is workable, poke infinisil about reproducing the issue
- # and confirming this fix?
-}
-
-delete_nix_vol_fstab_line() {
- # TODO: I'm scaffolding this to handle the new nix volumes
- # but it might be nice to generalize a smidge further to
- # go ahead and set up a pattern for curing "old" things
- # we no longer do?
- EDITOR="/usr/bin/patch" _sudo "to cut nix from fstab" "$@" < <(/usr/bin/diff /etc/fstab <(/usr/bin/grep -v "$NIX_ROOT apfs rw" /etc/fstab))
- # leaving some parts out of the grep; people may fiddle this a little?
-}
-
-# TODO: hope to remove with --uninstall
-fstab_uninstall_directions() {
- substep "Remove ${NIX_ROOT} from /etc/fstab" \
- " If nix is the only entry: sudo rm /etc/fstab" \
- " Otherwise, run 'sudo /usr/sbin/vifs' to remove the nix line"
-}
-
-fstab_uninstall_prompt() {
- cat </dev/null
-
- # if the patch test edit, minus comment lines, is equal to empty (:)
- if /usr/bin/diff -q <(:) <(/usr/bin/grep -v "^#" "$SCRATCH/fstab.edit") &>/dev/null; then
- # this edit would leave it empty; propose deleting it
- if confirm_rm "/etc/fstab"; then
- return 0
- else
- echo "Remove nix from /etc/fstab (or remove the file)"
- fi
- else
- echo "I might be able to help you make this edit. Here's the diff:"
- if ! _diff "/etc/fstab" "$SCRATCH/fstab.edit" && ui_confirm "Does the change above look right?"; then
- delete_nix_vol_fstab_line /usr/sbin/vifs
- else
- echo "Remove nix from /etc/fstab (or remove the file)"
- fi
- fi
-}
-
-remove_volume() {
- local volume_special="$1" # (i.e., disk1s7)
- _sudo "to unmount the Nix volume" \
- /usr/sbin/diskutil unmount force "$volume_special" || true # might not be mounted
- _sudo "to delete the Nix volume" \
- /usr/sbin/diskutil apfs deleteVolume "$volume_special"
-}
-
-# aspiration: robust enough to both fix problems
-# *and* update older darwin volumes
-cure_volume() {
- local volume_special="$1" # (i.e., disk1s7)
- local volume_uuid="$2"
- header "Found existing Nix volume"
- row " special" "$volume_special"
- row " uuid" "$volume_uuid"
-
- if volume_encrypted "$volume_special"; then
- row "encrypted" "yes"
- if volume_pass_works "$volume_special" "$volume_uuid"; then
- NIX_VOLUME_DO_ENCRYPT=0
- ok "Found a working decryption password in keychain :)"
- echo ""
- else
- # - this is a volume we made, and
- # - the user encrypted it on their own
- # - something deleted the credential
- # - this is an old or BYO volume and the pw
- # just isn't somewhere we can find it.
- #
- # We're going to explain why we're freaking out
- # and prompt them to either delete the volume
- # (requiring a sudo auth), or abort to fix
- warning <&2 < $(readlink "$NIX_ROOT")).
-Please remove it. If nix is in /etc/synthetic.conf, remove it and reboot.
-EOF
- fi
- fi
- if ! test_synthetic_conf_mountable; then
- task "Configuring /etc/synthetic.conf to make a mount-point at $NIX_ROOT" >&2
- # technically /etc/synthetic.d/nix is supported in Big Sur+
- # but handling both takes even more code...
- # See earlier note; `-u NONE` disables vim plugins/rc, `-n` skips swapfile
- _sudo "to add Nix to /etc/synthetic.conf" \
- /usr/bin/ex -u NONE -n /etc/synthetic.conf <&2
- fi
- create_synthetic_objects
- if ! test_nix; then
- failure >&2 <&2
- add_nix_vol_fstab_line "$volume_uuid" /usr/sbin/vifs
- fi
-}
-
-encrypt_volume() {
- local volume_uuid="$1"
- local volume_label="$2"
- local password
-
- task "Encrypt the Nix volume" >&2
-
- # Note: mount/unmount are late additions to support the right order
- # of operations for creating the volume and then baking its uuid into
- # other artifacts; not as well-trod wrt to potential errors, race
- # conditions, etc.
-
- _sudo "to mount your Nix volume for encrypting" \
- /usr/sbin/diskutil mount "$volume_label"
-
- password="$(/usr/bin/xxd -l 32 -p -c 256 /dev/random)"
- _sudo "to add your Nix volume's password to Keychain" \
- /usr/bin/security -i </dev/null; do
- :
- done
-}
-
-setup_volume() {
- local use_special use_uuid profile_packages
- task "Creating a Nix volume" >&2
-
- use_special="${NIX_VOLUME_USE_SPECIAL:-$(create_volume)}"
-
- _sudo "to ensure the Nix volume is not mounted" \
- /usr/sbin/diskutil unmount force "$use_special" || true # might not be mounted
-
- use_uuid=${NIX_VOLUME_USE_UUID:-$(volume_uuid_from_special "$use_special")}
-
- setup_fstab "$use_uuid"
-
- if should_encrypt_volume; then
- encrypt_volume "$use_uuid" "$NIX_VOLUME_LABEL"
- setup_volume_daemon "encrypted" "$use_uuid"
- # TODO: might be able to save ~60ms by caching or setting
- # this somewhere rather than re-checking here.
- elif volume_encrypted "$use_special"; then
- setup_volume_daemon "encrypted" "$use_uuid"
- else
- setup_volume_daemon "unencrypted" "$use_uuid"
- fi
-
- await_volume
-
- if [ "$(/usr/sbin/diskutil info -plist "$NIX_ROOT" | xmllint --xpath "(/plist/dict/key[text()='GlobalPermissionsEnabled'])/following-sibling::*[1]" -)" = "" ]; then
- _sudo "to set enableOwnership (enabling users to own files)" \
- /usr/sbin/diskutil enableOwnership "$NIX_ROOT"
- fi
-
- # TODO: below is a vague kludge for now; I just don't know
- # what if any safe action there is to take here. Also, the
- # reminder isn't very helpful.
- # I'm less sure where this belongs, but it also wants mounted, pre-install
- if type -p nix-env; then
- profile_packages="$(nix-env --query --installed)"
- # TODO: can probably do below faster w/ read
- # intentionally unquoted string to eat whitespace in wc output
- # shellcheck disable=SC2046,SC2059
- if ! [ $(printf "$profile_packages" | /usr/bin/wc -l) = "0" ]; then
- reminder <&2
- # See earlier note; `-u NONE` disables vim plugins/rc, `-n` skips swapfile
- _sudo "to install the Nix volume mounter" /usr/bin/ex -u NONE -n "$NIX_VOLUME_MOUNTD_DEST" <&2
-
- setup_darwin_volume
- }
-
- main "$@"
-fi
diff --git a/scripts/install-darwin-multi-user.sh b/scripts/install-darwin-multi-user.sh
deleted file mode 100644
index 24c9052f9..000000000
--- a/scripts/install-darwin-multi-user.sh
+++ /dev/null
@@ -1,226 +0,0 @@
-#!/usr/bin/env bash
-
-set -eu
-set -o pipefail
-
-# System specific settings
-export NIX_FIRST_BUILD_UID="${NIX_FIRST_BUILD_UID:-301}"
-export NIX_BUILD_USER_NAME_TEMPLATE="_nixbld%d"
-
-readonly NIX_DAEMON_DEST=/Library/LaunchDaemons/org.nixos.nix-daemon.plist
-# create by default; set 0 to DIY, use a symlink, etc.
-readonly NIX_VOLUME_CREATE=${NIX_VOLUME_CREATE:-1} # now default
-
-# caution: may update times on / if not run as normal non-root user
-read_only_root() {
- # this touch command ~should~ always produce an error
- # as of this change I confirmed /usr/bin/touch emits:
- # "touch: /: Operation not permitted" Monterey
- # "touch: /: Read-only file system" Catalina+ and Big Sur
- # "touch: /: Permission denied" Mojave
- # (not matching prefix for compat w/ coreutils touch in case using
- # an explicit path causes problems; its prefix differs)
- case "$(/usr/bin/touch / 2>&1)" in
- *"Read-only file system") # Catalina, Big Sur
- return 0
- ;;
- *"Operation not permitted") # Monterey
- return 0
- ;;
- *)
- return 1
- ;;
- esac
-
- # Avoiding the slow semantic way to get this information (~330ms vs ~8ms)
- # unless using touch causes problems. Just in case, that approach is:
- # diskutil info -plist / | , i.e.
- # diskutil info -plist / | xmllint --xpath "name(/plist/dict/key[text()='Writable']/following-sibling::*[1])" -
-}
-
-if read_only_root && [ "$NIX_VOLUME_CREATE" = 1 ]; then
- should_create_volume() { return 0; }
-else
- should_create_volume() { return 1; }
-fi
-
-# shellcheck source=./create-darwin-volume.sh
-. "$EXTRACTED_NIX_PATH/create-darwin-volume.sh" "no-main"
-
-dsclattr() {
- /usr/bin/dscl . -read "$1" \
- | /usr/bin/awk "/$2/ { print \$2 }"
-}
-
-test_nix_daemon_installed() {
- test -e "$NIX_DAEMON_DEST"
-}
-
-poly_cure_artifacts() {
- if should_create_volume; then
- task "Fixing any leftover Nix volume state"
- cat < /dev/null 2>&1
-}
-
-poly_group_id_get() {
- dsclattr "/Groups/$1" "PrimaryGroupID"
-}
-
-poly_create_build_group() {
- _sudo "Create the Nix build group, $NIX_BUILD_GROUP_NAME" \
- /usr/sbin/dseditgroup -o create \
- -r "Nix build group for nix-daemon" \
- -i "$NIX_BUILD_GROUP_ID" \
- "$NIX_BUILD_GROUP_NAME" >&2
-}
-
-poly_user_exists() {
- /usr/bin/dscl . -read "/Users/$1" > /dev/null 2>&1
-}
-
-poly_user_id_get() {
- dsclattr "/Users/$1" "UniqueID"
-}
-
-poly_user_hidden_get() {
- dsclattr "/Users/$1" "IsHidden"
-}
-
-poly_user_hidden_set() {
- _sudo "in order to make $1 a hidden user" \
- /usr/bin/dscl . -create "/Users/$1" "IsHidden" "1"
-}
-
-poly_user_home_get() {
- dsclattr "/Users/$1" "NFSHomeDirectory"
-}
-
-poly_user_home_set() {
- # This can trigger a permission prompt now:
- # "Terminal" would like to administer your computer. Administration can include modifying passwords, networking, and system settings.
- _sudo "in order to give $1 a safe home directory" \
- /usr/bin/dscl . -create "/Users/$1" "NFSHomeDirectory" "$2"
-}
-
-poly_user_note_get() {
- dsclattr "/Users/$1" "RealName"
-}
-
-poly_user_note_set() {
- _sudo "in order to give $username a useful note" \
- /usr/bin/dscl . -create "/Users/$1" "RealName" "$2"
-}
-
-poly_user_shell_get() {
- dsclattr "/Users/$1" "UserShell"
-}
-
-poly_user_shell_set() {
- _sudo "in order to give $1 a safe shell" \
- /usr/bin/dscl . -create "/Users/$1" "UserShell" "$2"
-}
-
-poly_user_in_group_check() {
- username=$1
- group=$2
- /usr/sbin/dseditgroup -o checkmember -m "$username" "$group" > /dev/null 2>&1
-}
-
-poly_user_in_group_set() {
- username=$1
- group=$2
-
- _sudo "Add $username to the $group group"\
- /usr/sbin/dseditgroup -o edit -t user \
- -a "$username" "$group"
-}
-
-poly_user_primary_group_get() {
- dsclattr "/Users/$1" "PrimaryGroupID"
-}
-
-poly_user_primary_group_set() {
- _sudo "to let the nix daemon use this user for builds (this might seem redundant, but there are two concepts of group membership)" \
- /usr/bin/dscl . -create "/Users/$1" "PrimaryGroupID" "$2"
-}
-
-poly_create_build_user() {
- username=$1
- uid=$2
- builder_num=$3
-
- _sudo "Creating the Nix build user (#$builder_num), $username" \
- /usr/bin/dscl . create "/Users/$username" \
- UniqueID "${uid}"
-}
-
-poly_prepare_to_install() {
- if should_create_volume; then
- header "Preparing a Nix volume"
- # intentional indent below to match task indent
- cat < $1"
-}
-
-bold() {
- echo "$BOLD$*$ESC"
-}
-
-ok() {
- _textout "$GREEN" "$@"
-}
-
-warning() {
- warningheader "warning!"
- cat
- echo ""
-}
-
-failure() {
- header "oh no!"
- _textout "$RED" "$@"
- echo ""
- _textout "$RED" "$(get_help)"
- trap finish_cleanup EXIT
- exit 1
-}
-
-ui_confirm() {
- _textout "$GREEN$GREEN_UL" "$1"
-
- if headless; then
- echo "No TTY, assuming you would say yes :)"
- return 0
- fi
-
- local prompt="[y/n] "
- echo -n "$prompt"
- while read -r y; do
- if [ "$y" = "y" ]; then
- echo ""
- return 0
- elif [ "$y" = "n" ]; then
- echo ""
- return 1
- else
- _textout "$RED" "Sorry, I didn't understand. I can only understand answers of y or n"
- echo -n "$prompt"
- fi
- done
- echo ""
- return 1
-}
-
-printf -v _UNCHANGED_GRP_FMT "%b" $'\033[2m%='"$ESC" # "dim"
-# bold+invert+red and bold+invert+green just for the +/- below
-# red/green foreground for rest of the line
-printf -v _OLD_LINE_FMT "%b" $'\033[1;7;31m-'"$ESC ${RED}%L${ESC}"
-printf -v _NEW_LINE_FMT "%b" $'\033[1;7;32m+'"$ESC ${GREEN}%L${ESC}"
-
-_diff() {
- # macOS Ventura doesn't ship with GNU diff. Print similar output except
- # without +/- markers or dimming
- if diff --version | grep -q "Apple diff"; then
- printf -v CHANGED_GROUP_FORMAT "%b" "${GREEN}%>${RED}%<${ESC}"
- diff --changed-group-format="$CHANGED_GROUP_FORMAT" "$@"
- else
- # simple colorized diff comatible w/ pre `--color` versions
- diff --unchanged-group-format="$_UNCHANGED_GRP_FMT" --old-line-format="$_OLD_LINE_FMT" --new-line-format="$_NEW_LINE_FMT" --unchanged-line-format=" %L" "$@"
- fi
-}
-
-confirm_rm() {
- local path="$1"
- if ui_confirm "Can I remove $path?"; then
- _sudo "to remove $path" rm "$path"
- fi
-}
-
-confirm_edit() {
- local path="$1"
- local edit_path="$2"
- cat < 1 )); then
- header "Reminders"
- for line in "${_reminders[@]}"; do
- echo "$line"
- if ! headless && [ "${#line}" = 0 ]; then
- if read -r -p "Press enter/return to acknowledge."; then
- printf $'\033[A\33[2K\r'
- fi
- fi
- done
- fi
-}
-
-reminder() {
- printf -v label "${BLUE}[ %d ]${ESC}" "$_remind_num"
- _reminders+=("$label")
- if [[ "$*" = "" ]]; then
- while read -r line; do
- _reminders+=("$line")
- done
- else
- # this expands each arg to an array entry (and each entry will
- # ultimately be a separate line in the output)
- _reminders+=("$@")
- fi
- _reminders+=("")
- ((_remind_num++))
-}
-
-__sudo() {
- local expl="$1"
- local cmd="$2"
- shift
- header "sudo execution"
-
- echo "I am executing:"
- echo ""
- printf " $ sudo %s\\n" "$cmd"
- echo ""
- echo "$expl"
- echo ""
-
- return 0
-}
-
-_sudo() {
- local expl="$1"
- shift
- if ! headless || is_root; then
- __sudo "$expl" "$*" >&2
- fi
-
- if is_root; then
- env "$@"
- else
- sudo "$@"
- fi
-}
-
-# Ensure that $TMPDIR exists if defined.
-if [[ -n "${TMPDIR:-}" ]] && [[ ! -d "${TMPDIR:-}" ]]; then
- mkdir -m 0700 -p "${TMPDIR:-}"
-fi
-
-readonly SCRATCH=$(mktemp -d)
-finish_cleanup() {
- rm -rf "$SCRATCH"
-}
-
-finish_fail() {
- finish_cleanup
-
- failure < /dev/null >&2; then
- warning </dev/null)" command -vp chown)"
- if [[ -z "$get_chr_own" ]]; then
- get_chr_own="$(command -v chown)"
- fi
-
- if [[ -z "$get_chr_own" ]]; then
- reminder < "$SCRATCH/.nix-channels"
- _sudo "to set up the default system channel (part 1)" \
- install -m 0664 "$SCRATCH/.nix-channels" "$ROOT_HOME/.nix-channels"
- fi
-}
-
-check_selinux() {
- if command -v getenforce > /dev/null 2>&1; then
- if [ "$(getenforce)" = "Enforcing" ]; then
- failure < "$SCRATCH/nix.conf"
-$NIX_EXTRA_CONF
-build-users-group = $NIX_BUILD_GROUP_NAME
-EOF
- _sudo "to place the default nix daemon configuration (part 2)" \
- install -m 0664 "$SCRATCH/nix.conf" /etc/nix/nix.conf
-}
-
-
-main() {
- check_selinux
-
- if is_os_darwin; then
- # shellcheck source=./install-darwin-multi-user.sh
- . "$EXTRACTED_NIX_PATH/install-darwin-multi-user.sh"
- check_required_system_specific_settings "install-darwin-multi-user.sh"
- elif is_os_linux; then
- # shellcheck source=./install-systemd-multi-user.sh
- . "$EXTRACTED_NIX_PATH/install-systemd-multi-user.sh" # most of this works on non-systemd distros also
- check_required_system_specific_settings "install-systemd-multi-user.sh"
- else
- failure "Sorry, I don't know what to do on $(uname)"
- fi
-
-
- welcome_to_nix
-
- if ! is_root; then
- chat_about_sudo
- fi
-
- cure_artifacts
- # TODO: there's a tension between cure and validate. I moved the
- # the sudo/root check out of validate to the head of this func.
- # Cure is *intended* to subsume the validate-and-abort approach,
- # so it may eventually obsolete it.
- validate_starting_assumptions
-
- setup_report
-
- if ! ui_confirm "Ready to continue?"; then
- ok "Alright, no changes have been made :)"
- get_help
- trap finish_cleanup EXIT
- exit 1
- fi
-
- poly_prepare_to_install
-
- create_build_group
- create_build_users
- create_directories
- place_channel_configuration
- install_from_extracted_nix
-
- configure_shell_profile
-
- set +eu
- # shellcheck disable=SC1091
- . /etc/profile
- set -eu
-
- setup_default_profile
- place_nix_configuration
-
- poly_configure_nix_daemon_service
-
- trap finish_success EXIT
-}
-
-# set an empty initial arg for bare invocations in case we need to
-# disambiguate someone directly invoking this later.
-if [ "${#@}" = 0 ]; then
- set ""
-fi
-
-# ACTION for override
-case "${1-}" in
- # uninstall)
- # shift
- # uninstall "$@";;
- # install == same as the no-arg condition for now (but, explicit)
- ""|install)
- main;;
- *) # holding space for future options (like uninstall + install?)
- failure "install-multi-user: invalid argument";;
-esac
diff --git a/scripts/install-nix-from-closure.sh b/scripts/install-nix-from-closure.sh
deleted file mode 100644
index 794622530..000000000
--- a/scripts/install-nix-from-closure.sh
+++ /dev/null
@@ -1,284 +0,0 @@
-#!/bin/sh
-
-set -e
-
-umask 0022
-
-dest="/nix"
-self="$(dirname "$0")"
-nix="@nix@"
-cacert="@cacert@"
-
-
-if ! [ -e "$self/.reginfo" ]; then
- echo "$0: incomplete installer (.reginfo is missing)" >&2
-fi
-
-if [ -z "$USER" ] && ! USER=$(id -u -n); then
- echo "$0: \$USER is not set" >&2
- exit 1
-fi
-
-if [ -z "$HOME" ]; then
- echo "$0: \$HOME is not set" >&2
- exit 1
-fi
-
-# macOS support for 10.12.6 or higher
-if [ "$(uname -s)" = "Darwin" ]; then
- IFS='.' read -r macos_major macos_minor macos_patch << EOF
-$(sw_vers -productVersion)
-EOF
- if [ "$macos_major" -lt 10 ] || { [ "$macos_major" -eq 10 ] && [ "$macos_minor" -lt 12 ]; } || { [ "$macos_minor" -eq 12 ] && [ "$macos_patch" -lt 6 ]; }; then
- # patch may not be present; command substitution for simplicity
- echo "$0: macOS $(sw_vers -productVersion) is not supported, upgrade to 10.12.6 or higher"
- exit 1
- fi
-fi
-
-# Determine if we could use the multi-user installer or not
-if [ "$(uname -s)" = "Linux" ]; then
- echo "Note: a multi-user installation is possible. See https://nixos.org/manual/nix/stable/installation/installing-binary.html#multi-user-installation" >&2
-fi
-
-case "$(uname -s)" in
- "Darwin")
- INSTALL_MODE=daemon;;
- *)
- INSTALL_MODE=no-daemon;;
-esac
-
-# space-separated string
-ACTIONS=
-
-# handle the command line flags
-while [ $# -gt 0 ]; do
- case $1 in
- --daemon)
- INSTALL_MODE=daemon
- ACTIONS="${ACTIONS}install "
- ;;
- --no-daemon)
- if [ "$(uname -s)" = "Darwin" ]; then
- printf '\e[1;31mError: --no-daemon installs are no-longer supported on Darwin/macOS!\e[0m\n' >&2
- exit 1
- fi
- INSTALL_MODE=no-daemon
- # intentional tail space
- ACTIONS="${ACTIONS}install "
- ;;
- # --uninstall)
- # # intentional tail space
- # ACTIONS="${ACTIONS}uninstall "
- # ;;
- --yes)
- export NIX_INSTALLER_YES=1;;
- --no-channel-add)
- export NIX_INSTALLER_NO_CHANNEL_ADD=1;;
- --daemon-user-count)
- export NIX_USER_COUNT=$2
- shift;;
- --no-modify-profile)
- NIX_INSTALLER_NO_MODIFY_PROFILE=1;;
- --darwin-use-unencrypted-nix-store-volume)
- {
- echo "Warning: the flag --darwin-use-unencrypted-nix-store-volume"
- echo " is no longer needed and will be removed in the future."
- echo ""
- } >&2;;
- --nix-extra-conf-file)
- # shellcheck disable=SC2155
- export NIX_EXTRA_CONF="$(cat "$2")"
- shift;;
- *)
- {
- echo "Nix Installer [--daemon|--no-daemon] [--daemon-user-count INT] [--yes] [--no-channel-add] [--no-modify-profile] [--nix-extra-conf-file FILE]"
-
- echo "Choose installation method."
- echo ""
- echo " --daemon: Installs and configures a background daemon that manages the store,"
- echo " providing multi-user support and better isolation for local builds."
- echo " Both for security and reproducibility, this method is recommended if"
- echo " supported on your platform."
- echo " See https://nixos.org/manual/nix/stable/installation/installing-binary.html#multi-user-installation"
- echo ""
- echo " --no-daemon: Simple, single-user installation that does not require root and is"
- echo " trivial to uninstall."
- echo " (default)"
- echo ""
- echo " --yes: Run the script non-interactively, accepting all prompts."
- echo ""
- echo " --no-channel-add: Don't add any channels. nixpkgs-unstable is installed by default."
- echo ""
- echo " --no-modify-profile: Don't modify the user profile to automatically load nix."
- echo ""
- echo " --daemon-user-count: Number of build users to create. Defaults to 32."
- echo ""
- echo " --nix-extra-conf-file: Path to nix.conf to prepend when installing /etc/nix/nix.conf"
- echo ""
- if [ -n "${INVOKED_FROM_INSTALL_IN:-}" ]; then
- echo " --tarball-url-prefix URL: Base URL to download the Nix tarball from."
- fi
- } >&2
-
- exit;;
- esac
- shift
-done
-
-if [ "$INSTALL_MODE" = "daemon" ]; then
- printf '\e[1;31mSwitching to the Multi-user Installer\e[0m\n'
- exec "$self/install-multi-user" $ACTIONS # let ACTIONS split
- exit 0
-fi
-
-if [ "$(id -u)" -eq 0 ]; then
- printf '\e[1;31mwarning: installing Nix as root is not supported by this script!\e[0m\n'
-fi
-
-echo "performing a single-user installation of Nix..." >&2
-
-if ! [ -e "$dest" ]; then
- cmd="mkdir -m 0755 $dest && chown $USER $dest"
- echo "directory $dest does not exist; creating it by running '$cmd' using sudo" >&2
- if ! sudo sh -c "$cmd"; then
- echo "$0: please manually run '$cmd' as root to create $dest" >&2
- exit 1
- fi
-fi
-
-if ! [ -w "$dest" ]; then
- echo "$0: directory $dest exists, but is not writable by you. This could indicate that another user has already performed a single-user installation of Nix on this system. If you wish to enable multi-user support see https://nixos.org/manual/nix/stable/installation/multi-user.html. If you wish to continue with a single-user install for $USER please run 'chown -R $USER $dest' as root." >&2
- exit 1
-fi
-
-# The auto-chroot code in openFromNonUri() checks for the
-# non-existence of /nix/var/nix, so we need to create it here.
-mkdir -p "$dest/store" "$dest/var/nix"
-
-printf "copying Nix to %s..." "${dest}/store" >&2
-# Insert a newline if no progress is shown.
-if [ ! -t 0 ]; then
- echo ""
-fi
-
-for i in $(cd "$self/store" >/dev/null && echo ./*); do
- if [ -t 0 ]; then
- printf "." >&2
- fi
- i_tmp="$dest/store/$i.$$"
- if [ -e "$i_tmp" ]; then
- rm -rf "$i_tmp"
- fi
- if ! [ -e "$dest/store/$i" ]; then
- cp -RPp "$self/store/$i" "$i_tmp"
- chmod -R a-w "$i_tmp"
- chmod +w "$i_tmp"
- mv "$i_tmp" "$dest/store/$i"
- chmod -w "$dest/store/$i"
- fi
-done
-echo "" >&2
-
-if ! "$nix/bin/nix-store" --load-db < "$self/.reginfo"; then
- echo "$0: unable to register valid paths" >&2
- exit 1
-fi
-
-# shellcheck source=./nix-profile.sh.in
-. "$nix/etc/profile.d/nix.sh"
-
-NIX_LINK="$HOME/.nix-profile"
-
-if ! "$nix/bin/nix-env" -i "$nix"; then
- echo "$0: unable to install Nix into your default profile" >&2
- exit 1
-fi
-
-# Install an SSL certificate bundle.
-if [ -z "$NIX_SSL_CERT_FILE" ] || ! [ -f "$NIX_SSL_CERT_FILE" ]; then
- "$nix/bin/nix-env" -i "$cacert"
- export NIX_SSL_CERT_FILE="$NIX_LINK/etc/ssl/certs/ca-bundle.crt"
-fi
-
-# Subscribe the user to the Nixpkgs channel and fetch it.
-if [ -z "$NIX_INSTALLER_NO_CHANNEL_ADD" ]; then
- if ! "$nix/bin/nix-channel" --list | grep -q "^nixpkgs "; then
- "$nix/bin/nix-channel" --add https://nixos.org/channels/nixpkgs-unstable
- fi
- if [ -z "$_NIX_INSTALLER_TEST" ]; then
- if ! "$nix/bin/nix-channel" --update nixpkgs; then
- echo "Fetching the nixpkgs channel failed. (Are you offline?)"
- echo "To try again later, run \"nix-channel --update nixpkgs\"."
- fi
- fi
-fi
-
-added=
-p=
-p_sh=$NIX_LINK/etc/profile.d/nix.sh
-p_fish=$NIX_LINK/etc/profile.d/nix.fish
-if [ -z "$NIX_INSTALLER_NO_MODIFY_PROFILE" ]; then
- # Make the shell source nix.sh during login.
- for i in .bash_profile .bash_login .profile; do
- fn="$HOME/$i"
- if [ -w "$fn" ]; then
- if ! grep -q "$p_sh" "$fn"; then
- echo "modifying $fn..." >&2
- printf '\nif [ -e %s ]; then . %s; fi # added by Nix installer\n' "$p_sh" "$p_sh" >> "$fn"
- fi
- added=1
- p=${p_sh}
- break
- fi
- done
- for i in .zshenv .zshrc; do
- fn="$HOME/$i"
- if [ -w "$fn" ]; then
- if ! grep -q "$p_sh" "$fn"; then
- echo "modifying $fn..." >&2
- printf '\nif [ -e %s ]; then . %s; fi # added by Nix installer\n' "$p_sh" "$p_sh" >> "$fn"
- fi
- added=1
- p=${p_sh}
- break
- fi
- done
-
- if [ -d "$HOME/.config/fish" ]; then
- fishdir=$HOME/.config/fish/conf.d
- if [ ! -d "$fishdir" ]; then
- mkdir -p "$fishdir"
- fi
-
- fn="$fishdir/nix.fish"
- echo "placing $fn..." >&2
- printf '\nif test -e %s; . %s; end # added by Nix installer\n' "$p_fish" "$p_fish" > "$fn"
- added=1
- p=${p_fish}
- fi
-else
- p=${p_sh}
-fi
-
-if [ -z "$added" ]; then
- cat >&2 <&2 < /dev/null 2>&1
-}
-
-poly_group_id_get() {
- getent group "$1" | cut -d: -f3
-}
-
-poly_create_build_group() {
- _sudo "Create the Nix build group, $NIX_BUILD_GROUP_NAME" \
- groupadd -g "$NIX_BUILD_GROUP_ID" --system \
- "$NIX_BUILD_GROUP_NAME" >&2
-}
-
-poly_user_exists() {
- getent passwd "$1" > /dev/null 2>&1
-}
-
-poly_user_id_get() {
- getent passwd "$1" | cut -d: -f3
-}
-
-poly_user_hidden_get() {
- echo "1"
-}
-
-poly_user_hidden_set() {
- true
-}
-
-poly_user_home_get() {
- getent passwd "$1" | cut -d: -f6
-}
-
-poly_user_home_set() {
- _sudo "in order to give $1 a safe home directory" \
- usermod --home "$2" "$1"
-}
-
-poly_user_note_get() {
- getent passwd "$1" | cut -d: -f5
-}
-
-poly_user_note_set() {
- _sudo "in order to give $1 a useful comment" \
- usermod --comment "$2" "$1"
-}
-
-poly_user_shell_get() {
- getent passwd "$1" | cut -d: -f7
-}
-
-poly_user_shell_set() {
- _sudo "in order to prevent $1 from logging in" \
- usermod --shell "$2" "$1"
-}
-
-poly_user_in_group_check() {
- groups "$1" | grep -q "$2" > /dev/null 2>&1
-}
-
-poly_user_in_group_set() {
- _sudo "Add $1 to the $2 group"\
- usermod --append --groups "$2" "$1"
-}
-
-poly_user_primary_group_get() {
- getent passwd "$1" | cut -d: -f4
-}
-
-poly_user_primary_group_set() {
- _sudo "to let the nix daemon use this user for builds (this might seem redundant, but there are two concepts of group membership)" \
- usermod --gid "$2" "$1"
-
-}
-
-poly_create_build_user() {
- username=$1
- uid=$2
- builder_num=$3
-
- _sudo "Creating the Nix build user, $username" \
- useradd \
- --home-dir /var/empty \
- --comment "Nix build user $builder_num" \
- --gid "$NIX_BUILD_GROUP_ID" \
- --groups "$NIX_BUILD_GROUP_NAME" \
- --no-user-group \
- --system \
- --shell /sbin/nologin \
- --uid "$uid" \
- --password "!" \
- "$username"
-}
-
-poly_prepare_to_install() {
- :
-}
diff --git a/scripts/install.in b/scripts/install.in
deleted file mode 100755
index 7d2e52b26..000000000
--- a/scripts/install.in
+++ /dev/null
@@ -1,119 +0,0 @@
-#!/bin/sh
-
-# This script installs the Nix package manager on your system by
-# downloading a binary distribution and running its installer script
-# (which in turn creates and populates /nix).
-
-{ # Prevent execution if this script was only partially downloaded
-oops() {
- echo "$0:" "$@" >&2
- exit 1
-}
-
-umask 0022
-
-tmpDir="$(mktemp -d -t nix-binary-tarball-unpack.XXXXXXXXXX || \
- oops "Can't create temporary directory for downloading the Nix binary tarball")"
-cleanup() {
- rm -rf "$tmpDir"
-}
-trap cleanup EXIT INT QUIT TERM
-
-require_util() {
- command -v "$1" > /dev/null 2>&1 ||
- oops "you do not have '$1' installed, which I need to $2"
-}
-
-case "$(uname -s).$(uname -m)" in
- Linux.x86_64)
- hash=@tarballHash_x86_64-linux@
- path=@tarballPath_x86_64-linux@
- system=x86_64-linux
- ;;
- Linux.i?86)
- hash=@tarballHash_i686-linux@
- path=@tarballPath_i686-linux@
- system=i686-linux
- ;;
- Linux.aarch64)
- hash=@tarballHash_aarch64-linux@
- path=@tarballPath_aarch64-linux@
- system=aarch64-linux
- ;;
- Linux.armv6l)
- hash=@tarballHash_armv6l-linux@
- path=@tarballPath_armv6l-linux@
- system=armv6l-linux
- ;;
- Linux.armv7l)
- hash=@tarballHash_armv7l-linux@
- path=@tarballPath_armv7l-linux@
- system=armv7l-linux
- ;;
- Darwin.x86_64)
- hash=@tarballHash_x86_64-darwin@
- path=@tarballPath_x86_64-darwin@
- system=x86_64-darwin
- ;;
- Darwin.arm64|Darwin.aarch64)
- hash=@tarballHash_aarch64-darwin@
- path=@tarballPath_aarch64-darwin@
- system=aarch64-darwin
- ;;
- *) oops "sorry, there is no binary distribution of Nix for your platform";;
-esac
-
-# Use this command-line option to fetch the tarballs using nar-serve or Cachix
-if [ "${1:-}" = "--tarball-url-prefix" ]; then
- if [ -z "${2:-}" ]; then
- oops "missing argument for --tarball-url-prefix"
- fi
- url=${2}/${path}
- shift 2
-else
- url=https://releases.nixos.org/nix/nix-@nixVersion@/nix-@nixVersion@-$system.tar.xz
-fi
-
-tarball=$tmpDir/nix-@nixVersion@-$system.tar.xz
-
-require_util tar "unpack the binary tarball"
-if [ "$(uname -s)" != "Darwin" ]; then
- require_util xz "unpack the binary tarball"
-fi
-
-if command -v curl > /dev/null 2>&1; then
- fetch() { curl --fail -L "$1" -o "$2"; }
-elif command -v wget > /dev/null 2>&1; then
- fetch() { wget "$1" -O "$2"; }
-else
- oops "you don't have wget or curl installed, which I need to download the binary tarball"
-fi
-
-echo "downloading Nix @nixVersion@ binary tarball for $system from '$url' to '$tmpDir'..."
-fetch "$url" "$tarball" || oops "failed to download '$url'"
-
-if command -v sha256sum > /dev/null 2>&1; then
- hash2="$(sha256sum -b "$tarball" | cut -c1-64)"
-elif command -v shasum > /dev/null 2>&1; then
- hash2="$(shasum -a 256 -b "$tarball" | cut -c1-64)"
-elif command -v openssl > /dev/null 2>&1; then
- hash2="$(openssl dgst -r -sha256 "$tarball" | cut -c1-64)"
-else
- oops "cannot verify the SHA-256 hash of '$url'; you need one of 'shasum', 'sha256sum', or 'openssl'"
-fi
-
-if [ "$hash" != "$hash2" ]; then
- oops "SHA-256 hash mismatch in '$url'; expected $hash, got $hash2"
-fi
-
-unpack=$tmpDir/unpack
-mkdir -p "$unpack"
-tar -xJf "$tarball" -C "$unpack" || oops "failed to unpack '$url'"
-
-script=$(echo "$unpack"/*/install)
-
-[ -e "$script" ] || oops "installation script is missing from the binary tarball!"
-export INVOKED_FROM_INSTALL_IN=1
-"$script" "$@"
-
-} # End of wrapping
diff --git a/scripts/local.mk b/scripts/local.mk
index 46255e432..cf2288bb6 100644
--- a/scripts/local.mk
+++ b/scripts/local.mk
@@ -7,7 +7,5 @@ profiledir = $(sysconfdir)/profile.d
$(eval $(call install-file-as, $(d)/nix-profile.sh, $(profiledir)/nix.sh, 0644))
$(eval $(call install-file-as, $(d)/nix-profile.fish, $(profiledir)/nix.fish, 0644))
-$(eval $(call install-file-as, $(d)/nix-profile-daemon.sh, $(profiledir)/nix-daemon.sh, 0644))
-$(eval $(call install-file-as, $(d)/nix-profile-daemon.fish, $(profiledir)/nix-daemon.fish, 0644))
clean-files += $(nix_noinst_scripts)
diff --git a/scripts/nix-profile-daemon.fish.in b/scripts/nix-profile-daemon.fish.in
deleted file mode 100644
index c23aa64f0..000000000
--- a/scripts/nix-profile-daemon.fish.in
+++ /dev/null
@@ -1,57 +0,0 @@
-function add_path --argument-names new_path
- if type -q fish_add_path
- # fish 3.2.0 or newer
- fish_add_path --prepend --global $new_path
- else
- # older versions of fish
- if not contains $new_path $fish_user_paths
- set --global fish_user_paths $new_path $fish_user_paths
- end
- end
-end
-
-# Only execute this file once per shell.
-if test -n "$__ETC_PROFILE_NIX_SOURCED"
- exit
-end
-
-set __ETC_PROFILE_NIX_SOURCED 1
-
-set --export NIX_PROFILES "@localstatedir@/nix/profiles/default $HOME/.nix-profile"
-
-# Populate bash completions, .desktop files, etc
-if test -z "$XDG_DATA_DIRS"
- # According to XDG spec the default is /usr/local/share:/usr/share, don't set something that prevents that default
- set --export XDG_DATA_DIRS "/usr/local/share:/usr/share:/nix/var/nix/profiles/default/share"
-else
- set --export XDG_DATA_DIRS "$XDG_DATA_DIRS:/nix/var/nix/profiles/default/share"
-end
-
-# Set $NIX_SSL_CERT_FILE so that Nixpkgs applications like curl work.
-if test -n "$NIX_SSH_CERT_FILE"
- : # Allow users to override the NIX_SSL_CERT_FILE
-else if test -e /etc/ssl/certs/ca-certificates.crt # NixOS, Ubuntu, Debian, Gentoo, Arch
- set --export NIX_SSL_CERT_FILE /etc/ssl/certs/ca-certificates.crt
-else if test -e /etc/ssl/ca-bundle.pem # openSUSE Tumbleweed
- set --export NIX_SSL_CERT_FILE /etc/ssl/ca-bundle.pem
-else if test -e /etc/ssl/certs/ca-bundle.crt # Old NixOS
- set --export NIX_SSL_CERT_FILE /etc/ssl/certs/ca-bundle.crt
-else if test -e /etc/pki/tls/certs/ca-bundle.crt # Fedora, CentOS
- set --export NIX_SSL_CERT_FILE /etc/pki/tls/certs/ca-bundle.crt
-else if test -e "$NIX_LINK/etc/ssl/certs/ca-bundle.crt" # fall back to cacert in Nix profile
- set --export NIX_SSL_CERT_FILE "$NIX_LINK/etc/ssl/certs/ca-bundle.crt"
-else if test -e "$NIX_LINK/etc/ca-bundle.crt" # old cacert in Nix profile
- set --export NIX_SSL_CERT_FILE "$NIX_LINK/etc/ca-bundle.crt"
-else
- # Fall back to what is in the nix profiles, favouring whatever is defined last.
- for i in $NIX_PROFILES
- if test -e "$i/etc/ssl/certs/ca-bundle.crt"
- set --export NIX_SSL_CERT_FILE "$i/etc/ssl/certs/ca-bundle.crt"
- end
- end
-end
-
-add_path "@localstatedir@/nix/profiles/default/bin"
-add_path "$HOME/.nix-profile/bin"
-
-functions -e add_path
diff --git a/scripts/nix-profile-daemon.sh.in b/scripts/nix-profile-daemon.sh.in
deleted file mode 100644
index d256b24ed..000000000
--- a/scripts/nix-profile-daemon.sh.in
+++ /dev/null
@@ -1,72 +0,0 @@
-# Only execute this file once per shell.
-if [ -n "${__ETC_PROFILE_NIX_SOURCED:-}" ]; then return; fi
-__ETC_PROFILE_NIX_SOURCED=1
-
-NIX_LINK=$HOME/.nix-profile
-if [ -n "${XDG_STATE_HOME-}" ]; then
- NIX_LINK_NEW="$XDG_STATE_HOME/nix/profile"
-else
- NIX_LINK_NEW=$HOME/.local/state/nix/profile
-fi
-if [ -e "$NIX_LINK_NEW" ]; then
- NIX_LINK="$NIX_LINK_NEW"
-else
- if [ -t 2 ] && [ -e "$NIX_LINK_NEW" ]; then
- warning="\033[1;35mwarning:\033[0m"
- printf "$warning Both %s and legacy %s exist; using the latter.\n" "$NIX_LINK_NEW" "$NIX_LINK" 1>&2
- if [ "$(realpath "$NIX_LINK")" = "$(realpath "$NIX_LINK_NEW")" ]; then
- printf " Since the profiles match, you can safely delete either of them.\n" 1>&2
- else
- # This should be an exceptionally rare occasion: the only way to get it would be to
- # 1. Update to newer Nix;
- # 2. Remove .nix-profile;
- # 3. Set the $NIX_LINK_NEW to something other than the default user profile;
- # 4. Roll back to older Nix.
- # If someone did all that, they can probably figure out how to migrate the profile.
- printf "$warning Profiles do not match. You should manually migrate from %s to %s.\n" "$NIX_LINK" "$NIX_LINK_NEW" 1>&2
- fi
- fi
-fi
-
-export NIX_PROFILES="@localstatedir@/nix/profiles/default $NIX_LINK"
-
-# Populate bash completions, .desktop files, etc
-if [ -z "${XDG_DATA_DIRS-}" ]; then
- # According to XDG spec the default is /usr/local/share:/usr/share, don't set something that prevents that default
- export XDG_DATA_DIRS="/usr/local/share:/usr/share:$NIX_LINK/share:/nix/var/nix/profiles/default/share"
-else
- export XDG_DATA_DIRS="$XDG_DATA_DIRS:$NIX_LINK/share:/nix/var/nix/profiles/default/share"
-fi
-
-# Set $NIX_SSL_CERT_FILE so that Nixpkgs applications like curl work.
-if [ -n "${NIX_SSL_CERT_FILE:-}" ]; then
- : # Allow users to override the NIX_SSL_CERT_FILE
-elif [ -e /etc/ssl/certs/ca-certificates.crt ]; then # NixOS, Ubuntu, Debian, Gentoo, Arch
- export NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
-elif [ -e /etc/ssl/ca-bundle.pem ]; then # openSUSE Tumbleweed
- export NIX_SSL_CERT_FILE=/etc/ssl/ca-bundle.pem
-elif [ -e /etc/ssl/certs/ca-bundle.crt ]; then # Old NixOS
- export NIX_SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
-elif [ -e /etc/pki/tls/certs/ca-bundle.crt ]; then # Fedora, CentOS
- export NIX_SSL_CERT_FILE=/etc/pki/tls/certs/ca-bundle.crt
-else
- # Fall back to what is in the nix profiles, favouring whatever is defined last.
- check_nix_profiles() {
- if [ -n "$ZSH_VERSION" ]; then
- # Zsh by default doesn't split words in unquoted parameter expansion.
- # Set local_options for these options to be reverted at the end of the function
- # and shwordsplit to force splitting words in $NIX_PROFILES below.
- setopt local_options shwordsplit
- fi
- for i in $NIX_PROFILES; do
- if [ -e "$i/etc/ssl/certs/ca-bundle.crt" ]; then
- export NIX_SSL_CERT_FILE=$i/etc/ssl/certs/ca-bundle.crt
- fi
- done
- }
- check_nix_profiles
- unset -f check_nix_profiles
-fi
-
-export PATH="$NIX_LINK/bin:@localstatedir@/nix/profiles/default/bin:$PATH"
-unset NIX_LINK
diff --git a/scripts/prepare-installer-for-github-actions b/scripts/prepare-installer-for-github-actions
deleted file mode 100755
index 4b994a753..000000000
--- a/scripts/prepare-installer-for-github-actions
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-script=$(nix-build -A outputs.hydraJobs.installerScriptForGHA --no-out-link)
-installerHash=$(echo "$script" | cut -b12-43 -)
-
-installerURL=https://$CACHIX_NAME.cachix.org/serve/$installerHash/install
-
-echo "::set-output name=installerURL::$installerURL"