pjan_ has joined #nix-darwin
pjan_ has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
pjan_ has joined #nix-darwin
pjan_ has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<dhess> anyone else getting this from qtwebkit from nixpkgs-unstable? https://gist.github.com/dhess/826c8abe4594d62f5b254be9b0af6edb
glenn_ has joined #nix-darwin
pjan_ has joined #nix-darwin
pjan_ has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<LnL> I suspect that's some kind of os version impurity
zzamboni has joined #nix-darwin
zzamboni has quit [Quit: Leaving.]
zzamboni has joined #nix-darwin
pjan_ has joined #nix-darwin
pjan_ has quit [Client Quit]
pjan_ has joined #nix-darwin
zzamboni has quit [Quit: Leaving.]
zzamboni has joined #nix-darwin
zzamboni has quit [Quit: Leaving.]
zzamboni has joined #nix-darwin
zzamboni has quit [Client Quit]
pjan_ has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
zzamboni has joined #nix-darwin
zzamboni has quit [Quit: Leaving.]
zzamboni has joined #nix-darwin
zzamboni has quit [Quit: Leaving.]
<dhess> LnL: weird. I'm seeing it on multiple Macs
<dhess> LnL: johnw and I were talking about macOS sandboxing the other day. In your lnl.nix example in the nix-darwin repo, it is enabled. Are you using that on your actual machine?
<LnL> yes
<dhess> does the nix.nixUnstable = true bit also install nix-1.12 then?
<LnL> that and enabling the nix-daemon service
<dhess> ok cool. I will try that today. I'm getting some weird behavior on 1 out of 3 Macs that seems to be some kind of local impurity (separate from that qtwebkit issue)
<dhess> I'm using the same nixpkgs and same overlay on all 3, and on 2 of them everything is identical; but on the 3rd, it's not.
<LnL> you don't need the systemPackages bit anymore for the client with my recent changes
<LnL> are they all running the same version of osx?
<dhess> yes
<dhess> the only difference as far as I can tell is that, when I did the initial nix-darwin install on each, the nix-darwin on the 3rd was a later channel update than the other 2
<dhess> but now that they're all running the same nix-darwin channel version, they're still producing different results.
<dhess> huh... only for qtwebkit now that you mention it!
<dhess> whoa
<LnL> that invalid instruction error or other stuff?
<dhess> I *think* it's a different error in this case
zzamboni has joined #nix-darwin
zzamboni has quit [Client Quit]
<dhess> oh nice, you have a module for making users now?
<dhess> that's awesome. I need to create more builders anyway
zzamboni has joined #nix-darwin
<dhess> does that work with 10.13.2?
<LnL> yep, it doesn't touch stuff that already exists like updating the homedir of a user etc.
<dhess> that is sweet
<dhess> so re: this qtwebkit thing and the possible impurity, any ideas on how to go about debugging that?
<LnL> is the hardware the same?
<LnL> could be that some dependency was built on a machine with newer instructions or something
<dhess> no.
<dhess> that's an interesting thought. However I don't think it applies here because the 2 machines that are sharing a config are an iMac Pro and a 13" MacBook Pro 2017. And then the one that keeps breaking on the illegal instruction issue is the one building the packages, a Mac Pro Late 2013.
<dhess> and the one that is trying to build qtwebkit rather than hitting the binary cache is a 2017 iMac 27"
<dhess> so the 3 machines that evaluate to the same derivations (iMac Pro, MacBook Pro, Mac Pro 2013) are quite different.
<dhess> when you turn on sandboxing in macOS, is there anything that still comes from the host OS?
<LnL> yes, a bunch of stuff
zzamboni has quit [Quit: Leaving.]
zzamboni has joined #nix-darwin
zzamboni has quit [Quit: Leaving.]
zzamboni has joined #nix-darwin
zzamboni has quit [Quit: Leaving.]
zzamboni has joined #nix-darwin
<johnw> LnL: hi
<johnw> LnL: I wasn't able to get sandboxing to work
<johnw> I run into a SIGABRT
<johnw> let me get a pastie for you
<johnw> LnL: well, first I get this: error: derivation '/nix/store/7qvxgsvgwg0bz645hhcd7a60kgj57hnm-user-environment.drv' specifies a sandbox profile, but this is only allowed when 'sandbox' is 'relaxed'
<johnw> then I set nix.useSandbox = "relaxed";
<LnL> when do you get that?
<johnw> the rebuild of darwin to switch to sandbox = true works
<johnw> the rebuild of home-manager does not work
<LnL> ah, yes nix-env doesn't work yet
<johnw> so how do you install things?
zzamboni has quit [Quit: Leaving.]
<LnL> nix-shell? :p
<johnw> huh?
<johnw> your user-environment is empty?
<LnL> yep, until I get annoyed an fix it :)
<johnw> wow, ok
<LnL> well and nix-darwin ofcorse
zzamboni has joined #nix-darwin
<LnL> I wonder how home-manager manages profiles then
<johnw> /nix/var/nix/profiles/per-user/johnw/home-manager-28
<LnL> well yes, but it must be using $nix/libexec/nix/buildenv somehow
zzamboni has quit [Client Quit]
<dhess> Oh I didn't realize nix-env doesn't work with sandboxing
<dhess> is that a nix-1.12 issue or is it a Darwin sandbox issue?
<LnL> but I ran into another problem last time I tried to fix it
<dhess> oh well, that makes it a no-go for me. I use nix-env
<LnL> we also noticed a frameworks related issue with ofborg builds
zzamboni has joined #nix-darwin
<dhess> I can turn it on on my remote builder though. I don't use nix-env there
<dhess> though I wonder if that will cause clients to miss the binary cache if they're not also using it
zzamboni has quit [Quit: Leaving.]
zzamboni has joined #nix-darwin
zzamboni has quit [Client Quit]
zzamboni has joined #nix-darwin
<dhess> LnL: getting this when I `darwin-rebuild switch` with 'nix.useSandbox = true' and 'nix.package = pkgs.nixUnstable': https://gist.github.com/dhess/1ef9d832bf7555e70021bde58b7efdb4
<dhess> I just updated the channel as well
<LnL> that has nothing to do with sandboxing
<LnL> works fine for me
<LnL> nix build -f channel:nixpkgs-unstable brotli
<dhess> this system uses the nixpkgs-17.09-darwin and darwin channels
<dhess> so I guess brotli is coming from the nixpkgs-17.09-darwin channel?
<LnL> oh! the multiple outputs stuff was backported to 17.09?
<dhess> I don't know
zzamboni has quit [Quit: Leaving.]
<dhess> I mean, nixUnstable isn't building so I guess not
<LnL> checking
<dhess> I'm trying to keep this remote builder as vanilla as possible
<LnL> nope
<LnL> you're using nixpkgs-unstable from ~1week ago AFAICS
<dhess> I don't know how that could be
<dhess> there's no nixpkgs in my NIX_PATH
<LnL> nix-instantiate --eval -E '<nixpkgs>'
<dhess> $ nix-channel --update
<dhess> downloading ‘file:///var/folders/5n/_g1y51cn5gv7z4s1hdlw606c0000gn/T/le6tP6GRBx/master.tar.gz’... [0/0 KiB, 0.0 KiB/s]
<dhess> /nix/store/gwzypmi62c54l221m1cqf241k194fqfq-darwin
<dhess> unpacking channels...
<dhess>
<dhess> /nix/var/nix/profiles/per-user/root/channels/nixpkgs
<dhess>
<dhess> $ readlink /nix/var/nix/profiles/per-user/root/channels/nixpkgs
<dhess> /nix/store/j6zbw1zl0nrwcyr2zg1k9zcimbffw2w1-nixpkgs-18.03pre124071.310ad4345bb/nixpkgs
<dhess> how did that happen, is that coming from the darwin channel?
<LnL> that's a nixpkgs-unstable
<LnL> nix-channel --list
<LnL> sudo -i nix-channel --list
<dhess> does the darwin channel pull in expressions for nixpkgs?
<dhess> $ nix-channel --list
<dhess>
<dhess> oh nix-channels for root are nixpkgs-unstable
<dhess> I guess because I installed nix before nix-darwin
<dhess> I guess the lesson here is only install nix or nix-darwin but not both?
<LnL> no, let me check
<LnL> I included user channels in NIX_PATH by default
<dhess> NIX_PATH=darwin-config=/Users/dhess/.config/nixpkgs/darwin-configuration.nix:/nix/var/nix/profiles/per-user/root/channels:/Users/dhess/.nix-defexpr/channels
<dhess> that's the account from which I darwin-switch
<dhess> darwin-rebuild
zzamboni has joined #nix-darwin
<LnL> yeah, so you could remove the root nixpkgs
<LnL> the installer/nixos doesn't have that last part by default
<dhess> so if I just installed nix-darwin only, would root's nix-channels look like mine? nixpkgs-17.09-darwin and darwin?
<dhess> oh I might have added nixpkgs-17.09-darwin.
<LnL> no I don't mess with nixpkgs
<dhess> yeah I think I did
<dhess> because I have an overlay and I want it to use stable on this machine
<LnL> don't you get collision warnings since you added it?
<dhess> not yet anyway
<LnL> maybe that's only for named paths
<dhess> I'm not installing anything in the env here. I use the overlay only to add some certs to my cacert bundle
<dhess> so it's still odd that `darwin-rebuild switch`, run from my account, wouldn't use my channels, is it not?
<dhess> assuming that is what you are saying is happening with brotli
<dhess> eh removing nixpkgs from root's channels broke everything
<dhess> hosed
<dhess> ughhhh
<johnw> LnL: can you have an option to add flags to the nix-build command that darwin-rebuild uses?
<johnw> not having -Q on my system can lead to hundreds of thousands of lines of output that I won't ever read
<LnL> don't most flags already work?
<johnw> do they? hadn't tried yet
<LnL> :D
<johnw> so, darwin-rebuild switch -Q?
<LnL> that should do what you expect
<johnw> sweet
<LnL> figuring out what flags go to what commands is the reason why it's not just a oneliner
<LnL> dhess: I could shuffle around the defaults again, just did what's closest to the original behaviour https://github.com/LnL7/nix-darwin/commit/d3941dc5ecbb1582fa6df90283f072bd8c1f2134
<dhess> LnL: I just hosed the remote builder machine so I'm going to rebuild it, this time installing only nix-darwin
<LnL> btw. do you guys have stateVersion set in your configs?
<dhess> I do
<dhess> I am also going to spend some time ridding my "regular" (i.e., interactive use, not a remote builder) macOS Nix setup of channels
<johnw> LnL: would this be good for nix-darwin too: https://github.com/rycee/home-manager/issues/18
<dhess> I hate them!
zzamboni has quit [Quit: Leaving.]
<johnw> LnL: system.stateVersion = 2;
<dhess> LnL: is nix-darwin master in good enough shape to install fresh?
<LnL> it should be
<dhess> ok thanks
<dhess> how many build users does it install by default btw?
<LnL> if you're feeling adventurous you could try the installer branch :)
<dhess> I am very much not feeling adventurous :) but what is the difference?
<johnw> I really like this nix-darwin+home-manager setup
<dhess> I might have another spare Mac soon to do some adventurous stuff
<johnw> replicating my environment between this machine and my laptop is now a lot more deterministic
<johnw> instead of having bizarre bits of state all over the place, and hoping I rsync them all
<dhess> johnw: how are you managing keeping the channels in sync?
<johnw> channels?
<johnw> I don't use channels
<johnw> what do you mean?
<LnL> lol
<dhess> ok, how are you keeping the git repos in sync? submodules?
<johnw> I have git checkouts of nix-darwin, home-manager and nixpkgs
<johnw> I follow the branches: master, master and nixpkgs-unstable
<johnw> they are submodules of my ~/src/nix project
<johnw> but I rsync this between machines
<johnw> so what I'm rebuilding from is always the same thing
<LnL> you could do something like this if you don't mind it redownloading
<LnL> darwin-rebuild switch -I darwin=https://github.com/LnL7/nix-darwin/archive/$darwin.tar.gz nixpkgs=https://github.com/NixOS/nixpkgs/archive/$nixpkgs.tar.gz
<dhess> LnL: what is the difference between master and installer, for nix-darwin?
* LnL just has a crazy idea for a module
<LnL> the installer branch bootstraps using nix-darwin
zzamboni has joined #nix-darwin
<dhess> oh, then I will try that
<dhess> that is what I was trying to accomplish with this fresh install. I didn't realize that nix-darwin master required an existing nix install, I thought it would just use it if it was already there
<dhess> LnL: so build that and then just `sh installer` on the target machine?
<LnL> yes, or use nix-shell that will start it automatically
<dhess> well the idea here is that the target machine will not have Nix already
<dhess> just a fresh macOS re-install
<LnL> oh, don't have anything for that at the moment
<dhess> oh I see.
<dhess> well then I will just inevitably run into the same issue, where I'm trying to use nixpkgs-17.09-darwin but the Nix installer sets up with nixpkgs-unstable
<dhess> it seems to me the Nix Darwin installer should probably be using nixpkgs-17.09-darwin in the first place
<dhess> LnL: so it seems I've run into some kind of bug then, no? Where the "admin user" sets a channel from which nixpkgs expressions come, and that is different than the one the actual root user is using, and then when the "admin user" runs `darwin-rebuild switch`, it is seeing expressions from the root user's channel rather than the admin user's?
<dhess> if that is in fact what was happening with this brotli issue
<LnL> what the installer does is closest to the nixos behaviour
<LnL> user channels don't do anything there either
<dhess> yeah I understand that. But I was under the impression that with nix-darwin, it would always use the channels (or paths etc) chosen by the user who runs it.
<LnL> yeah, not saying you're wrong
<dhess> LnL: ok, just wanted to clarify what was the expected behavior.
<LnL> another problem with root channels is that they will disappear after an os upgrade
<dhess> frankly I am worried about all kinds of system/multi-user/nix-darwin Nix-y things disappearing after an OS upgrade
<dhess> that's one of the reasons I opened that issue about installing nix-darwin somewhere other than /etc
<dhess> it makes me really uncomfortable. I don't like touching anything outside of /Applications or my home dir on Maccs.
<dhess> Macs.
<dhess> I don't get the impression that Apple is going to go out of their way to avoid clobbering things that you've put in /etc
<dhess> however I do like the fact that you're using /run/current-system in nix-darwin, so I think that is an improvement over what the vanilla multi-user Nix installer does.
<dhess> and not touching /etc/profile etc.
<dhess> LnL: anyway I'm a moron, and I'm pretty sure this is not a bug in nix-darwin but a problem with my config, which I just identified.
<dhess> so ... never mind, at least for now until I can test this with the new install
<gchristensen> I'm pretty sure you're not a moron
<dhess> in fact, I was able to rescue my existing install after fixing that
<dhess> oh you would be surprised :)
<dhess> ok let me try this brotli thing again
<dhess> yay! fixed!
<dhess> now this box is doing sandboxed builds
<dhess> LnL: so to confirm -- false alarm, darwin-rebuild *does* use the channels that the user has defined
<LnL> well yes, but only if there are no conflicts
<LnL> or am I missing something
<dhess> I am now using 17.09-darwin with mine and it looks good. And I am running sandboxed builds
<dhess> so now let me see if this helps with the qtwebkit issue
<dhess> haha
<dhess> well it actually got *worse* :)
<dhess> dyld: Library not loaded: /usr/lib/system/libcache.dylib
<dhess> Referenced from: /nix/store/zk0kw320dn3dq56lpk7rgmf4pgk06g4f-Libsystem-osx-10.11.6/lib/libSystem.B.dylib
<dhess> Reason: no suitable image found. Did find:
<dhess> /usr/lib/system/libcache.dylib: file system sandbox blocked stat()
<dhess> builder for '/nix/store/1ldm63h2ms2iynwy22hsiz4q1img3z22-qtwebkit-5.9.1.drv' failed due to signal 6 (Abort trap: 6)
<dhess>
<dhess> but at least the sandboxing is working! :D
<dhess> well so much for that
<LnL> that looks like the build-remote issue
<dhess> it is a remote builder
<dhess> is there something I need to change or is this just an open issue?
<LnL> yeah, that's the other thing that needs to be fixed in nix
<dhess> oh that buildenv bit you pointed me to earlier?
<LnL> resolve-system-dependencies doesn't run because the drv isn't available locally
<LnL> no this is specific to the build hook
<dhess> ahh
<dhess> well damn. I will have to disable sandboxing in that case
<dhess> back to square one
<LnL> but those are the 2 issues that we need to fix, that I know about
<dhess> damn, now I'm having this problem that johnw had
<dhess> with the 'relaxed' setting
<LnL> hmm?
<dhess> ok, I turned on sandbox builds and installed nixUnstable
<dhess> I tried to build on this machine from my Hydra, ran into the ld issue above
<dhess> so now I need to turn sandboxed builds off again
<dhess> so, comment out those bits from the config, run darwin-rebuild switch, and get this:
<LnL> huh
<dhess> johnw had a similar issue when he tried to enable sandboxed builds on one of his Macs
<dhess> he rolled back and was able to recover
<LnL> try nixos-rebuild switch --rollback
<dhess> yeah cool, all set
<dhess> thanks
<LnL> oh wait, the sandboxing stuff isn't backported yet
<dhess> but even if I switch this remote builder's channel to nixpkgs-unstable, I will run into that ld issue when trying to use it as a remote builder, correct?
<LnL> yeah
<dhess> ok I'll just keep it on the stable branch for now then
<dhess> this thing doesn't need to be bleeding edge, it just needs to be reliable
<dhess> until the sandboxing stuff is ready anywya
<LnL> yeah wouldn't worry about sandboxing for now
<johnw> grr
<johnw> every time I run load-env-anything now, it runs home-manager switch for some bizarre reason
<LnL> the myEnvFun things?
<johnw> dhess: ping
<johnw> LnL: I logged a bug
<LnL> what did I break?
<johnw> it wasn't you
<LnL> oh not me :)
<johnw> it was a long-standing bug in nixpkgs that apparently no one noticed
<johnw> actually, now that I think about it, I've been seeing the warnings for a LONG time
<johnw> i just ignored them
<johnw> warnings sayings that 'u' isn't a command
<johnw> uh oh
<johnw> when I nix build A B C I get "should be a set but is a function", but nix build A C B works
<johnw> hmm.. it now appears it happens with A B C D, but not if I delete any one of them
zzamboni has quit [Quit: Leaving.]