[21.05][PL-133165] pkgs/overlay: nix: 2.3.16 -> 2.3.18

[Ma27]

Step one for PL-133165.

Motivation here is to be able to substitute zstd-compressed paths to increase the total throughput of our Hydra.

The entire diff from 2.3.16 to 2.3.18 can be reviewed at NixOS/nix@2.3.16...2.3.18

I went through the changes and didn't notice any notable changes that I'd expect to be an issue.

@flyingcircusio/release-managers

Release process

• Created changelog entry using ./changelog.sh

PR release workflow (internal)

• PR has internal ticket
• internal issue ID (PL-…) part of branch name
• internal issue ID mentioned in PR description text
• ticket is on Platform agile board
• ticket state set to Pull request ready
• if ticket is more urgent than within the next few days, directly contact a member of the Platform team

Design notes

• Provide a feature toggle if the change might need to be adjusted/reverted quickly depending on context. Consider whether the default should be on or off. Example: rate limiting.
  • Hydra will switcht to zstd for new paths unconditionally. Hence a feature-toggle is not applicable.
• All customer-facing features and (NixOS) options need to be discoverable from documentation. Add or update relevant documentation such that hosted and guided customers can understand it as well.

Security implications

• Security requirements defined? (WHERE)
  • Be able to download and unpack new store-paths on system updates.
• Security requirements tested? (EVIDENCE): I verified the functionality in two ways:
  • Local check (done by hand on hydra01):

  $ nix --version
  nix (Nix) 2.18.5
  $ nix-build '<nixpkgs>' -A hello
  /nix/store/fshn3i2vaarsdwjgrrp7i0ywaic1jkqy-hello-2.12.1
  $ nix copy /nix/store/fshn3i2vaarsdwjgrrp7i0ywaic1jkqy-hello-2.12.1 --to file://$(pwd)/tmp-store?compression=zstd # put store-path into a "local" binary cache
  $ nix shell github:nixos/nixpkgs/nixos-21.05#nix_2_3 # Make sure we're testing the right thing (i.e. 2.3.16 cannot substitute)
  $ nix --version
  nix (Nix) 2.3.16
  $ nix-store -r /nix/store/fshn3i2vaarsdwjgrrp7i0ywaic1jkqy-hello-2.12.1 --option substituters file://$(pwd)/tmp-store --store $(pwd)/nix # substitute hello in a local chroot-store
  [...]
  unknown compression method 'zstd'
  error: build of '/nix/store/fshn3i2vaarsdwjgrrp7i0ywaic1jkqy-hello-2.12.1' failed
  $ exit
  $ nix-build -A nix # build Nix from this branch
  /nix/store/iba9cd7zxbfj8pm44kxcn2p88y56x8f0-nix-2.3.18
  $ ./result/bin/nix-store -r /nix/store/fshn3i2vaarsdwjgrrp7i0ywaic1jkqy-hello-2.12.1 --option substituters file://$(pwd)/tmp-store --store $(pwd)/nix # Call with our 2.3.18 should succeed.

  • End-to-end check (using my personal, zstd-compressed binary cache into a local chroot store: please note that this is GCed and operated on a best-effort basis, so this check will probably not be repeatble in a few months):

  $ ./result/bin/nix-store -r /nix/store/46z46rrwd4qck4cd129d0zpj9fqc9kwb-neovim-0.10.2 --substituters https://hydra.ist.nicht-so.sexy --store $(pwd)/nix --option require-sigs false
  

suggested changes are implemented