gchristensen changed the topic of #nixos-borg to: https://www.patreon.com/ofborg https://monitoring.nix.ci/dashboard/db/ofborg?refresh=10s&orgId=1&from=now-1h&to=now "I get to skip reviewing the PHP code and just wait until it is rewritten in something sane, like POSIX shell. || https://logs.nix.samueldr.com/nixos-borg
orivej has quit [Ping timeout: 240 seconds]
evanjs has quit [Quit: ZNC 1.7.5 - https://znc.in]
evanjs has joined #nixos-borg
orivej has joined #nixos-borg
cole-h has quit [Quit: Goodbye]
<srk> github--
<srk> I wonder what to emit to create these statuses from ofborg
<srk> is it safe to assume tasks can access paths produced by builders?
<gchristensen> hm?
<{^_^}> [ofborg] @sorki opened pull request #459 → Cachix → https://git.io/JvjmA
<srk> ^
<gchristensen> oh cool
<srk> it might be completely wrong but it's start
<gchristensen> nicely done, srk! very cool
<gchristensen> but no, this won't work :x
<srk> hence the question if paths are accessible :D kind-of assumed hydra model with distributed builders
<gchristensen> the built paths are only on the build machines, and this message would arrive at a bunch of machines
<gchristensen> a single build job is handled by a single build machine -- no distributed building per nix-build job. but there are many builders
<srk> ok! will take closer look how the builds are distributed
<gchristensen> probably the thing to do would be have the builder call cachix upload after nix-build completes
<srk> can you point me to the right file?
<srk> tasks/build.rs I guess
<gchristensen> those lines are where the build is actually executing
<srk> yeah, missed that previously, thanks
<srk> should be easy to move cachix call there, now the question is should it run async?
<gchristensen> is the cachix upload slow? :)
<srk> depends on closure size :)
<srk> maybe call it after actions.build_finished(status, can_build, cannot_build_attrs); ?
<srk> so it won't block status report
<gchristensen> hmm we might want to include in the finished report "and uploaded to cachix"
<gchristensen> or "and the upload to cachix failed"
<gchristensen> yeah, I think that kind of status report would be useful
<srk> yup, that was my very first question ;) - how to report this
<gchristensen> let's block, and if cachix fails (or the cachix binary doesn't exist) just report the error and otherwise suceed
<srk> ok!
<gchristensen> I'd add your stuff right before here https://github.com/NixOS/ofborg/blob/released/ofborg/src/tasks/build.rs#L385
<gchristensen> and extend buidl_finished to include some info about cachix
<gchristensen> you'll need to edit some messages, make sure to add them as Optional fields otherwise we can't upgrade the system :)
<gchristensen> looking good so far!
<srk> ack, thanks for pointers
<gchristensen> thanks fo rthe code!
<tilpner> srk: I don't understand the whole amqp setup, but does this allow untrusted builders to upload anything?
<srk> tilpner: it has to run on a builder and yes
<tilpner> Is that a problem?
<srk> which part?
<srk> gchristensen: pushed builder PoC
<tilpner> For r13y, graham considered handing out upload tokens to builders, but that probably doesn't work with cachix
<tilpner> I have almost no context, so feel free to tell me to go away
<srk> cachix only has one token, not sure if it's a problem
<tilpner> But I assume this cachix cache is to be used by maintainers, to benefit from ofborg infrastructure while testing changes
<gchristensen> ofborg doesn't have any untrusted builders anymore :)
<tilpner> Oh, then nevermind
<srk> tilpner: yes but with big red warning :)
<tilpner> I remembered it having community-contributed machines
<gchristensen> yeah it used to
<srk> tilpner: to run only reviewed stuff and only virtualized
<gchristensen> at the time I didn't want to upload stuff to the cache because I didn't want anyone to be able to accidentally trick ofborg in to uploading their secret stuff
<tilpner> srk: If you make it convenient for people to compromise their workstation security, they will
<srk> yeah, good luck preventing people shooting themselves into their feet
<tilpner> But it's not as scary anymore, if it's only official builders
<srk> my plane was to make it convenient to run in qemu but not directly
<srk> *plan
cole-h has joined #nixos-borg
<cole-h> gchristensen: Since nix1 has been removed from nixpkgs, should it be removed from ofborg's CI and `shell.nix`?
<gchristensen> yep
<cole-h> Now we don't have to worry about how `useNix1 = true` always fails 13 tests on my machine :D
<gchristensen> nice
<gchristensen> good
<{^_^}> [ofborg] @cole-h opened pull request #460 → Nix1 removal → https://git.io/Jvjl0
<cole-h> ^ also fixes a failing test due to 2.3.4 changing the assertion message
<gchristensen> nice
<cole-h> (now shows the actual assertion that failed)
tilpner_ has joined #nixos-borg
tilpner has quit [Ping timeout: 240 seconds]
tilpner_ is now known as tilpner
tilpner_ has joined #nixos-borg
tilpner has quit [Ping timeout: 258 seconds]
tilpner_ is now known as tilpner
orivej has quit [Ping timeout: 265 seconds]
orivej has joined #nixos-borg
tilpner has quit [Remote host closed the connection]
tilpner has joined #nixos-borg
tilpner has quit [Remote host closed the connection]
tilpner_ has joined #nixos-borg
tilpner_ is now known as tilpner