scriptis/lix
0
0
Fork 0
forked from lix-project/lix
Code Pull requests Activity
5647 commits 30 branches 6 tags 84 MiB
Commit graph

5647 commits

This branch
This branch
All branches
Author SHA1 Message Date
Eelco Dolstra d798349ede
canonicalisePathMetaData(): Remove extended attributes / ACLs 
EAs/ACLs are not part of the NAR canonicalisation. Worse, setting an
ACL allows a builder to create writable files in the Nix store. So get
rid of them.

Closes #185.
 2017-05-30 13:47:41 +02:00
Eelco Dolstra ff6becafa8
Require seccomp only in multi-user setups 2017-05-30 12:37:04 +02:00
Eelco Dolstra 1d9ab273ba
Add test for setuid seccomp filter 2017-05-29 16:14:10 +02:00
Eelco Dolstra cf93397d3f
Fix seccomp initialisation on i686-linux 2017-05-29 16:14:10 +02:00
Eelco Dolstra 6cc6c15a2d
Add a seccomp filter to prevent creating setuid/setgid binaries 
This prevents builders from setting the S_ISUID or S_ISGID bits,
preventing users from using a nixbld* user to create a setuid/setgid
binary to interfere with subsequent builds under the same nixbld* uid.

This is based on aszlig's seccomp code
(47f587700d).

Reported by Linus Heckemann.
 2017-05-29 16:14:10 +02:00
Eelco Dolstra 6e01ecd112
Fix nix-copy-closure test 
Fixes

  client# error: size mismatch importing path ‘/nix/store/ywf5fihjlxwijm6ygh6s0a353b5yvq4d-libidn2-0.16’; expected 0, got 120264

This is mostly an artifact of the NixOS VM test environment, where the
Nix database doesn't contain hashes/sizes.

http://hydra.nixos.org/build/53537471
 2017-05-29 16:08:56 +02:00
Eelco Dolstra 588dad4084
Fix build failure on Debian/Ubuntu 
http://hydra.nixos.org/build/53537463
 2017-05-29 15:59:18 +02:00
Eelco Dolstra 63145be2a5
Fix typo 2017-05-29 15:52:36 +02:00
Eelco Dolstra d6064dd19b Merge pull request #1393 from pyrtsa/patch-1 
Fix variable name typo in derivations doc
 2017-05-29 11:32:06 +02:00
Eelco Dolstra 2740a22d2c Merge pull request #1394 from pyrtsa/patch-2 
Remove stray `>` in builtins doc
 2017-05-29 11:31:40 +02:00
Pyry Jahkola 370428f86d Remove stray > in builtins doc 2017-05-28 20:47:35 +03:00
Pyry Jahkola 86ea7d1566 Fix variable name typo in derivations doc 2017-05-28 15:48:57 +03:00
Eelco Dolstra a7e55151a8
Fix #1314 
Also, make nix-shell respect --option. (Previously it only passed it
along to nix-instantiate and nix-build.)
 2017-05-24 11:33:42 +02:00
Eelco Dolstra fbe9fe0e75
Merge branch 'topic/cores-master' of https://github.com/neilmayhew/nix 2017-05-24 11:28:36 +02:00
Eelco Dolstra 9e43a4a041 Merge pull request #1376 from Mic92/patch-1 
nix-profile.sh: remove sbin from PATH
 2017-05-24 11:25:32 +02:00
Eelco Dolstra 9711524188
Fix #1380 
It lacked a backslash. Use a raw string and single quotes around PS1
to simplify this.
 2017-05-24 11:23:28 +02:00
Eelco Dolstra 01200d07d2
Merge branch 'prompt-terminator' of https://github.com/lheckemann/nix 2017-05-24 11:22:48 +02:00
Eelco Dolstra b303ad012c Merge pull request #1382 from FRidh/patch-1 
Document fetchTarball can take a sha256
 2017-05-24 11:07:36 +02:00
Eelco Dolstra edbb105e98
Merge branch 'nar-accessor-tree' of https://github.com/bennofs/nix 2017-05-24 11:04:43 +02:00
Eelco Dolstra f134fc4cbe
Document that builtins.match takes a POSIX extended RE 2017-05-17 12:18:18 +02:00
Eelco Dolstra e46090edb1
builtins.match: Improve error message for bad regular expression 
Issue #1331.
 2017-05-17 11:58:01 +02:00
Eelco Dolstra b01d62285c
Improve progress indicator 2017-05-16 16:09:57 +02:00
Benno Fünfstück a1f428b13b nar-accessor.cc: remove unused member NarIndexer::currentName 2017-05-15 19:41:59 +02:00
Benno Fünfstück 5ee06e612a nar-accessor: non-recursive NarMember::find 
This avoids a possible stack overflow if directories are very deeply nested.
 2017-05-15 19:34:18 +02:00
Eelco Dolstra e80257f122
Simplify fixed-output check 2017-05-15 18:50:54 +02:00
Eelco Dolstra c05d9ae7a5
Disallow outputHash being null or an empty string 
Fixes #1384.
 2017-05-15 18:47:13 +02:00
Eelco Dolstra a2d92bb20e
Add --with-sandbox-shell configure flag 
And add a 116 KiB ash shell from busybox to the release build. This
helps to make sandbox builds work out of the box on non-NixOS systems
and with diverted stores.
 2017-05-15 17:36:32 +02:00
Eelco Dolstra b30f5784d0
Linux sandbox: Don't barf on invalid paths 
This is useful when we're using a diverted store (e.g. "--store
local?root=/tmp/nix") in conjunction with a statically-linked sh from
the host store (e.g. "sandbox-paths =/bin/sh=/nix/store/.../bin/busybox").
 2017-05-15 17:36:32 +02:00
Eelco Dolstra 2b761d5f50
Make fmt() non-recursive 2017-05-15 17:36:32 +02:00
Benno Fünfstück 4412f7c083 nar-archive.cc: add tests for the nar index 2017-05-15 12:23:21 +02:00
Eelco Dolstra 0124d118ef Merge pull request #1387 from bennofs/nix-ls-slash 
nix ls: support '/' for the root directory
 2017-05-15 11:02:14 +02:00
Benno Fünfstück 06880d7ed8 nix ls: support '/' for the root directory 2017-05-15 10:25:55 +02:00
Benno Fünfstück 75a1d9849d nar-accessor: use tree, fixes readDirectory missing children 
Previously, if a directory `foo` existed and a file `foo-` (where `-` is any character that is sorted before `/`), then  `readDirectory` would return an empty list.

To fix this, we now use a tree where we can just access the children of the node, and do not need to rely on sorting behavior to list the contents of a directory.
 2017-05-15 10:23:16 +02:00
Eelco Dolstra 510bc1735b
Add an option for extending the user agent header 
This is useful e.g. for distinguishing traffic to a binary cache
(e.g. certain machines can use a different tag in the user agent).
 2017-05-11 15:10:22 +02:00
Eelco Dolstra 62d476c7ee
Fix typo 2017-05-11 14:02:03 +02:00
Eelco Dolstra ea65ae0f9c
Tweak error message 2017-05-11 13:59:47 +02:00
Eelco Dolstra 1a8e15053a
Don't allow untrusted users to set info.ultimate 
Note that a trusted signature was still required in this case so it
was not a huge deal.
 2017-05-11 13:58:09 +02:00
Frederik Rietdijk 2b2de5ef6a Document fetchTarball can take a sha256 
Note that I refer to `nix-prefetch-url`.
 2017-05-11 13:38:13 +02:00
Eelco Dolstra 6f245bf24a
Change the meaning of info.ultimate 
It now means "paths that were built locally". It no longer includes
paths that were added locally. For those we don't need info.ultimate,
since we have the content-addressability assertion (info.ca).
 2017-05-11 13:31:23 +02:00
Eelco Dolstra 45d7b1a9e9
LocalStore::addToStore(): Check info.narSize 
It allowed the client to specify bogus narSize values. In particular,
Downloader::downloadCached wasn't setting narSize at all.
 2017-05-11 13:26:03 +02:00
Eelco Dolstra 1fd59447d5
Typo 2017-05-10 18:38:17 +02:00
Eelco Dolstra c5f23f10a8
Replace readline by linenoise 
Using linenoise avoids a license compatibility issue (#1356), is a lot
smaller and doesn't pull in ncurses.
 2017-05-10 18:37:42 +02:00
Linus Heckemann d48edcc3a5 nix-shell: use appropriate prompt terminator 
If running nix-shell as root, the terminator should be # and not $.
 2017-05-10 12:03:45 +01:00
Domen Kožar 82a9c93c7f
doc: builtins.attrNames returns alphabetically sorted list 2017-05-10 11:23:12 +02:00
Eelco Dolstra 03ae5e6459
Add "nix edit" command 
This is a little convenience command that opens the Nix expression of
the specified package. For example,

  nix edit nixpkgs.perlPackages.Moose

opens <nixpkgs/pkgs/top-level/perl-packages.nix> in $EDITOR (at the
right line number for some editors).

This requires the package to have a meta.position attribute.
 2017-05-08 18:42:30 +02:00
Eelco Dolstra 7689181e4f
Minor cleanup 2017-05-08 15:56:52 +02:00
Eelco Dolstra 00b286275c
Linux sandbox: Fix compatibility with older kernels 2017-05-08 15:42:59 +02:00
Eelco Dolstra ebfceeb333
build-remote: Check remote build status 2017-05-08 14:27:12 +02:00
Eelco Dolstra 0a97eb6bd7
Remove superfluous #ifdef 2017-05-08 11:27:20 +02:00
Jörg Thalheim 542fe0d8f3 nix-profile.sh: remove sbin from PATH 
sbin is a symlink to bin. 
profiles only contains packages, which have this symlink. 
It is a subset of bin.

related to https://github.com/NixOS/nixpkgs/pull/25550
 2017-05-07 07:41:19 +01:00