sphalerite changed the topic of #nixos-dev to: NixOS Development (#nixos for questions) | NixOS 19.03 released! https://discourse.nixos.org/t/nixos-19-03-release/2652 | https://hydra.nixos.org/jobset/nixos/trunk-combined https://channels.nix.gsc.io/graph.html https://r13y.com | 19.03 RMs: samueldr,sphalerite | https://logs.nix.samueldr.com/nixos-dev
lassulus has quit [Read error: Connection reset by peer]
hedning__ has left #nixos-dev [#nixos-dev]
lassulus has joined #nixos-dev
Synthetica has quit [Quit: Connection closed for inactivity]
orivej has quit [Ping timeout: 245 seconds]
justan0theruser has joined #nixos-dev
justanotheruser has quit [Disconnected by services]
justan0theruser is now known as justanotheruser
justanotheruser has quit [Ping timeout: 258 seconds]
justanotheruser has joined #nixos-dev
infinisil has quit [Quit: Configuring ZNC, sorry for the joins/quits!]
infinisil has joined #nixos-dev
infinisil has quit [Remote host closed the connection]
infinisil has joined #nixos-dev
justanotheruser has quit [Ping timeout: 255 seconds]
justanotheruser has joined #nixos-dev
justanotheruser has quit [Ping timeout: 246 seconds]
phreedom has joined #nixos-dev
phreedom_ has quit [Ping timeout: 256 seconds]
ckauhaus has joined #nixos-dev
Synthetica has joined #nixos-dev
alp has quit [Quit: ZNC - http://znc.in]
ben has quit [Ping timeout: 258 seconds]
alp has joined #nixos-dev
infinisil is now known as duh
duh is now known as infinisil
ckauhaus has quit [Quit: WeeChat 2.4]
ckauhaus has joined #nixos-dev
psyanticy has joined #nixos-dev
LnL7 is now known as LnL
<arianvp> gchristensen:you around? have a question about path units
<gchristensen> sort of, go for it :
<gchristensen> )
<arianvp> I was wondering why you have a RequiredBy on the wireguard path unit, as a path unit already implicitly activates the service unit of the same name
<arianvp> is it to enforce that it is _not_ activated before a change occurs?
<arianvp> it referring to the wireguard _service_
<gchristensen> ah
<gchristensen> I'm not sure I can give you a super good answer there ... it could maybe not even have the RequiredBy
<gchristensen> you could try deleting that directive and building the "generated" nixos test
colemickens has quit [Ping timeout: 240 seconds]
Synthetica has quit [Ping timeout: 258 seconds]
sorear has quit [Read error: Connection reset by peer]
Synthetica has joined #nixos-dev
colemickens has joined #nixos-dev
sorear has joined #nixos-dev
<arianvp> hmm I think path units aren't gonna help me here
<arianvp> I misunderstood them. I though the path unit would be active iff the file exists
<arianvp> but that's not the case. the path unit is always active, and starts another unit when state changes
<arianvp> gchristensen:so I think actually in the wireguard module it also does something different than we think
<gchristensen> yikes :
<gchristensen> :?
<arianvp> what it does now, is start "wireguard-${name}.service" any time the keyfile is touched
<arianvp> think of path units as .timer units. they activate another unit when some condition is met
<arianvp> which is something different than what we're trying to describe =)
<arianvp> (right?)
<gchristensen> yeah I think so
<gchristensen> maybe a ConditionPathExists + the .path unitis what I wanted
<arianvp> the idea is that you activate a path unit on boot, by doing WantedBy=paths.target just like you activate a timer at boot
<arianvp> and then each time the "blah.path" unit changes, it activates the corresponding "blah.service"
<arianvp> maybe i should start a systemd consultancy or something. hehe
<gchristensen> :
<gchristensen> )
justanotheruser has joined #nixos-dev
orivej has joined #nixos-dev
Synthetica_ has joined #nixos-dev
Synthetica has quit [Ping timeout: 258 seconds]
Synthetica_ is now known as Synthetica
Synthetica has quit [Quit: Connection closed for inactivity]
<Taneb> When people talk about content-addressable stores, what does that actually mean?
<gchristensen> ah
<gchristensen> http://gsc.io/graph.unstable.post.svg this file's identity is graph.unstable.post.svg
<gchristensen> someone gave it that name, and if you fetch it and it arrives corrupted you have no idea
<arianvp> Taneb: that the hash in the path in nix store is the hash of the contents stored at that path
<arianvp> For example. Source files in the nix store are addressed by content
<gchristensen> if it was content-addressed, it would be named ea7daa44f385c253753a3726628d611f678e53a1b78c2bb64037bfcc14870e65 (the hash of the file's contents)
<arianvp> But produced files and bin (like output fromC)
<arianvp> Accidentally pressed enter there. Ooos
<arianvp> Build outputs are not content addressed in nix, the path of builds outputs is the hash of all _inputs_ instead.
<yorick> gchristensen: how do you make those graphs?
<gchristensen> (1) have a lot of memory (2) https://github.com/NixOS/nix/pull/2782
<{^_^}> nix#2782 (by grahamc, 2 days ago, open): Track function start and end
<yorick> oh, cool
<yorick> define "lot of memory"
<Taneb> arianvp: OK, this makes sense
<gchristensen> yorick: I use nearly all of my RAM + swap space, which totals 32G
<arianvp> So for now. Only source files are content addressed (they have no build inputs)
<yorick> gchristensen: but this is all of nixpkgs
<arianvp> But there is a plan to also rewrite build outputs to be content addressed. This is useful when for example you change the source code of glibc, but the output doesn't change becauss of it
<arianvp> It avoids mass rebuilds
<gchristensen> yorick: right, so the output from the trace is quite large (a few hundred mb)
<arianvp> There's an RFC that explains the rationale why this is useful.
<gchristensen> yorick: the part which requires like 32gb of RAM is running flamegraph.pl
<Taneb> Doesn't that have the cost of making it so you need to build something to know where in the nix store you'd find it?
<arianvp> There's also an entire chapter in Eelco's thesis
<gchristensen> it does, Taneb
<arianvp> Iirc there is a mapping stored between input hashes and output hashes, right?
<gchristensen> that is maintained in the result derivations themselves I think
<gchristensen> definitely check the RFC for specifics :)
<yorick> gchristensen: what causes this to use that much memory?
<arianvp> Also what it brings is ability to trust builds without them being signed. Because if builds are reproducibility multiple untrusted builders will produce the same output
<yorick> oh, I see
<gchristensen> ~~> https://r13y.com/ <~~
<Profpatsch> Taneb: Yeah, InputHash->OutputHash mapping.
<Profpatsch> Of course this brings up the trust issue again.
<arianvp> Well you could solve the trust issue with consensus
<Profpatsch> What happens if different substitutors announce different output hashes for the same input hash
<arianvp> Profpatsch: and the tricky part is. That might either be because of malice. Or just because the build was non-reproducible
<arianvp> And you can't really distinguish the two :)
<yorick> gchristensen: thanks!
<gchristensen> yorick: gladly!
<ekleog> arianvp: except if the input hash already includes whether the build is supposed to be reproducible
<yorick> gchristensen: what do you think of something like dtrace instrumentation?
<gchristensen> I have no idea :)
<gchristensen> I have no idea what I'm doing when it comes to C++/C/debugging tools
<Profpatsch> arianvp: You just told the main reason why we need reproducible builds :)
<arianvp> Wh
<arianvp> Saying whether a build is reproducible apriori is hard though
<arianvp> Mumbles something about halting problem
<arianvp> Unless you know your build system is total of course
<ekleog> OTOH we don't need to solve the “is my build reproducible?” problem
<ekleog> so long as all our actual builds fall into the domain where we can answer “yes”
<ekleog> (just like I very much hope all our current builds fall into the domain where we can answer “yes” to “does it halt?”)
<arianvp> so who decides if a build is reproducible in a trusted fashion?
<ekleog> the one who writes the derivation?
<ekleog> they're trusted already for not making it malicious, can as well say whether it's reproducible
<LnL> gchristensen: wait, you wrote the flamegraph stuff in perl?
<ekleog> (hence my “except if the input hash already includes whether the build is supposed to be reproducible” :p)
<arianvp> LnL: No, flamegraph is an existing perl application
<LnL> oh interesting
<ekleog> implementation would basically add a `meta.reproducible = true;` argument and hopefully some mechanism to automatically check it
<matthewbauer> gchristensen: https://hydra.nixos.org/machines don't seem to be processing
<gchristensen> ...hmm
<gchristensen> thanks
<gchristensen> on calls for the next ~1hr but I'll get to it
<gchristensen> I think it should be starting now
<gchristensen> something is wrong though. looking in to it. probably related to 18.09 -> 19.03 upgrade I did this morning
jtojnar has joined #nixos-dev
drakonis1 has quit [Quit: WeeChat 2.4]
drakonis_ has joined #nixos-dev
drakonis has quit [Ping timeout: 258 seconds]
drakonis_ has quit [Read error: Connection reset by peer]
drakonis_ has joined #nixos-dev
drakonis_ has quit [Read error: Connection reset by peer]
drakonis has joined #nixos-dev
drakonis has quit [Read error: Connection reset by peer]
drakonis has joined #nixos-dev
<gchristensen> https://github.com/NixOS/nixos-org-configurations/commit/b2942d8c9644229527c4ce57f431b06652af9393 this seems to have solved it for some reason, and I don't honestly know why
<LnL> didn't the default of openssh change?
<gchristensen> did it?
drakonis has quit [Ping timeout: 258 seconds]
MichaelRaskin has joined #nixos-dev
drakonis has joined #nixos-dev
drakonis has quit [Ping timeout: 276 seconds]
<LnL> I think so yes, wasn't one of the older algorithms disabled for security reasons?
<LnL> huh, the first commit pickaxe finds is mine :p
<{^_^}> #40686 (by Izorkin, 49 weeks ago, merged): ssh: custom config key types
<LnL> not what I was thinking of tho
<gchristensen> yeah
<gchristensen> and a bit mysterious that 18.09 wasn't a problem
<LnL> thought there was something with a fallback based on stateVersion
psyanticy has quit [Quit: Connection closed for inactivity]
ckauhaus has quit [Quit: WeeChat 2.4]
jtojnar_ has joined #nixos-dev
jtojnar has quit [Ping timeout: 245 seconds]
n_db has quit [Remote host closed the connection]
jtojnar_ is now known as jtojnar
n_db has joined #nixos-dev
justanotheruser has quit [Ping timeout: 246 seconds]
justanotheruser has joined #nixos-dev
justanotheruser has quit [Quit: WeeChat 2.4]
justanotheruser has joined #nixos-dev
<gchristensen> for people operating a Hydra who could also use Packet (hem, fpletz, globin, sphalerite) I've made a packet.net spot instance instance importer for Hydra -- https://github.com/NixOS/nixos-org-configurations/pull/85
<{^_^}> nixos-org-configurations#85 (by grahamc, 3 minutes ago, open): Automatically import Packet.net spot instances to Hydra
<andi-> nice
justanotheruser has quit [Ping timeout: 258 seconds]
<sphalerite> ooh :D
justanotheruser has joined #nixos-dev
justanotheruser has quit [Client Quit]
justanotheruser has joined #nixos-dev
colemickens is now known as colemickens[m]1
colemickens[m]1 is now known as colemickens[m]3
colemickens[m]3 is now known as colemickens[m]2
colemickens[m]2 is now known as colemickens
jtojnar_ has joined #nixos-dev
jtojnar has quit [Ping timeout: 246 seconds]
<worldofpeace> gchristensen: the expression for the python script doesn't look right to me (buildPython* does some magic) maybe this would be better https://gist.github.com/worldofpeace/f50572293212fa64287cbff378d798a7
jtojnar_ is now known as jtojnar
colemickens has quit []
<gchristensen> oh sure, cool, want to PR that to my branch :)
Ericson2314 has joined #nixos-dev
drakonis has joined #nixos-dev
justanotheruser has quit [Ping timeout: 255 seconds]
justanotheruser has joined #nixos-dev
justanotheruser has quit [Ping timeout: 258 seconds]