2.3 installer fixes #3628
Merged
2.3 installer fixes #3628
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This is commonly the default behavior with -R, but POSIX leaves the default unspecified. (cherry picked from commit 10414d4) Signed-off-by: Domen Kožar <[email protected]>
This is not used anywhere. (cherry picked from commit 1c3ccba) Signed-off-by: Domen Kožar <[email protected]>
Some tar implementations can't auto-detect compression formats, so they must be specified explicitly. (cherry picked from commit 43eb7b6) Signed-off-by: Domen Kožar <[email protected]>
…n the system On a systemd-based Linux distribution: If the user has previously had multi-user Nix installed on the system, removed it and then reinstalled multi-user Nix again the old nix-daemon.service will still be running when `scripts/install-systemd-multi-user.sh` tries to start it which results in nothing being done and the old daemon continuing its run. When a normal user then tries to use Nix through the daemon the nix binary will fail to connect to the nix-daemon as it does not belong to the currently installed Nix system. See below for steps to reproduce the issue that motivated this change. $ sh <(curl https://nixos.org/nix/install) --daemon $ sudo rm -rf /etc/nix /nix /root/.nix-profile /root/.nix-defexpr /root/.nix-channels /home/nix-installer/.nix-profile /home/nix-installer/.nix-defexpr /home/nix-installer/.nix-channels ~/.nix-channels ~/.nix-defexpr/ ~/.nix-profile /etc/profile.d/nix.sh.backup-before-nix /etc/profile.d/nix.sh; sed -i '/added by Nix installer$/d' ~/.bash_profile $ unset NIX_REMOTE $ sh <(curl https://nixos.org/nix/install) --daemon └$ export NIX_REMOTE=daemon └$ nix-env -iA nixpkgs.hello installing 'hello-2.10' error: cannot connect to daemon at '/nix/var/nix/daemon-socket/socket': No such file or directory (use '--show-trace' to show detailed location information) └$ sudo systemctl restart nix-daemon.service └$ nix-env -iA nixpkgs.hello installing 'hello-2.10' these paths will be fetched (6.09 MiB download, 27.04 MiB unpacked): /nix/store/2g75chlbpxlrqn15zlby2dfh8hr9qwbk-hello-2.10 /nix/store/aag9d1y4wcddzzrpfmfp9lcmc7skd7jk-glibc-2.27 copying path '/nix/store/aag9d1y4wcddzzrpfmfp9lcmc7skd7jk-glibc-2.27' from 'https://cache.nixos.org'... copying path '/nix/store/2g75chlbpxlrqn15zlby2dfh8hr9qwbk-hello-2.10' from 'https://cache.nixos.org'... building '/nix/store/w9adagg6vlikr799nkkqc9la5hbbpgmi-user-environment.drv'... created 2 symlinks in user environment (cherry picked from commit a413594) Signed-off-by: Domen Kožar <[email protected]>
(cherry picked from commit e063c71) Signed-off-by: Domen Kožar <[email protected]>
(cherry picked from commit 9080d5d) Signed-off-by: Domen Kožar <[email protected]>
(cherry picked from commit 9450dec) Signed-off-by: Domen Kožar <[email protected]>
After installing Nix, I found that all the files and directories initially copied into the store were writable, with mode 644 or 755: drwxr-xr-x 9 root root 4096 Dec 31 1969 /nix/store/ddmmzn4ggz1f66lwxjy64n89864yj9w9-nix-2.3.3 The reason is that that's how they were in the unpacked tarball, and the install-multi-user script used `rsync -p` without doing anything else to affect the permissions. The plain `install` script for a single-user install takes care to do a `chmod -R a-w` on each store path copied. We could do the same here with one more command; or we can pass `--chmod` to rsync, to have it write the files with the desired modes in the first place. Tested the new `rsync` command on both a Linux machine with a reasonably-modern rsync (3.1.3) and a Mac with its default, ancient, rsync 2.6.9, and it works as expected on both. Thankfully the latter is just new enough to have `--chmod`, which dates to rsync 2.6.7. (cherry picked from commit 26851dd) Signed-off-by: Domen Kožar <[email protected]>
(cherry picked from commit 46be11b) Signed-off-by: Domen Kožar <[email protected]>
… flags (cherry picked from commit 9e12b2f) Signed-off-by: Domen Kožar <[email protected]>
Starting macOS 10.15 /nix can't be creasted directly anymore due to the readonly filesystem, but synthetic.conf was introduced to enable creating mountpoints or symlinks for special usecases like package managers. (cherry picked from commit 0726ad5) Signed-off-by: Domen Kožar <[email protected]>
The default login shell for users on macOS 10.15 changed from bash to zsh. So while generally nonstandard we need to configure it to make nix function out of the box on macOS. (cherry picked from commit 1020262) Signed-off-by: Domen Kožar <[email protected]>
(cherry picked from commit 083bb3b) Signed-off-by: Domen Kožar <[email protected]>
(cherry picked from commit caface1) Signed-off-by: Domen Kožar <[email protected]>
(cherry picked from commit ee89b77) Signed-off-by: Domen Kožar <[email protected]>
(cherry picked from commit 04f597c) Signed-off-by: Domen Kožar <[email protected]>
(cherry picked from commit 3386575) Signed-off-by: Domen Kožar <[email protected]>
(cherry picked from commit bc24c09) Signed-off-by: Domen Kožar <[email protected]>
(cherry picked from commit 477d7c2) Signed-off-by: Domen Kožar <[email protected]>
This should handle installation scenarios we can handle with anything resembling confidence. Goal is approximating the existing setup--not enforcing a best-practice... Approaches (+ installer-handled, - manual) and configs each covers: + no change needed; /nix OK on boot volume: All pre-Catalina (regardless of T2 or FileVault use) + create new unencrypted volume: Catalina, pre-T2, no FileVault + create new encrypted-at-rest volume: Catalina, pre-T2, FileVault Catalina, T2, no FileVault - require user to pre-create encrypted volume Catalina, T2, FileVault (cherry picked from commit 2b0a81d) Signed-off-by: Domen Kožar <[email protected]>
(cherry picked from commit d3df188) Signed-off-by: Domen Kožar <[email protected]>
(cherry picked from commit 2a7ea2e) Signed-off-by: Domen Kožar <[email protected]>
(cherry picked from commit 90b0c63) Signed-off-by: Domen Kožar <[email protected]>
(cherry picked from commit 573ff8d) Signed-off-by: Domen Kožar <[email protected]>
|
Would be great to create a clone of https://hydra.nixos.org/jobset/nix/maintenance-2.3 and target it to this branch. |
This is used to determine the dependency tree of impure libraries so nix knows what paths to open in the sandbox. With the less restrictive defaults it isn't needed anymore. (cherry picked from commit afb78eb) Signed-off-by: Domen Kožar <[email protected]>
(cherry picked from commit 7f2df90) Signed-off-by: Domen Kožar <[email protected]>
Nix now runs builds with a pseudo-terminal to enable colored build output. (cherry picked from commit f6c122a) Signed-off-by: Domen Kožar <[email protected]>
Sadly 10.15 changed /bin/sh to a shim which executes bash, this means it
can't be used anymore without also opening up the sandbox to allow bash.
Failed to exec /bin/bash as variant for /bin/sh (1: Operation not permitted).
(cherry picked from commit 2e9bc12)
Signed-off-by: Domen Kožar <[email protected]>
|
Also included https://github.com/NixOS/nix/pull/3429/commits as darwin sandbox doesn't work on Catalina otherwise. |
- --no-channel-add didn't have effect on multi-user installation - some new flags didn't work at all - document all installer flags (cherry picked from commit 1a5ac89) Signed-off-by: Domen Kožar <[email protected]>
(cherry picked from commit 3d3c219) Signed-off-by: Domen Kožar <[email protected]>
|
cachix/install-nix-action#33 confirms it works, ready to merge as far as I'm concerned. |
teoljungberg
added a commit
to teoljungberg/dotfiles
that referenced
this pull request
Jul 2, 2020
teoljungberg
added a commit
to teoljungberg/dotfiles
that referenced
this pull request
Jul 11, 2020
abathur
added a commit
to abathur/nix
that referenced
this pull request
Sep 10, 2020
The move from release.nix to flake.nix appears to have lost some changes from NixOS#3628 / 1c56f18, leaving create-darwin-volume.sh out of the release tarball. Under the assumption that this was just an accident/byproduct of when flake.nix split off and not intentional, I am restoring those edits.
abathur
added a commit
to abathur/nix
that referenced
this pull request
Sep 24, 2020
The move from release.nix to flake.nix appears to have lost some changes from NixOS#3628 / 1c56f18, leaving create-darwin-volume.sh out of the release tarball. Under the assumption that this was just an accident/byproduct of when flake.nix split off and not intentional, I am restoring those edits.
abathur
added a commit
to abathur/nix
that referenced
this pull request
Oct 19, 2020
The move from release.nix to flake.nix appears to have lost some changes from NixOS#3628 / 1c56f18, leaving create-darwin-volume.sh out of the release tarball. Under the assumption that this was just an accident/byproduct of when flake.nix split off and not intentional, I am restoring those edits.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This includes #2925 and many other small improvements to the installer.
The motivation to include Catalina is to fix a big headache for macOS users.
The motivation for the rest of the fixes is that if we're testing the installer, let's get all improvements in.