sphalerite changed the topic of #nixos-dev to: NixOS Development (#nixos for questions) | NixOS 19.03 released! https://discourse.nixos.org/t/nixos-19-03-release/2652 | https://hydra.nixos.org/jobset/nixos/trunk-combined https://channels.nix.gsc.io/graph.html https://r13y.com | 19.03 RMs: samueldr,sphalerite | https://logs.nix.samueldr.com/nixos-dev
<worldofpeace> yay, thanks to ttuegel #65399
<{^_^}> https://github.com/NixOS/nixpkgs/issues/65399 (by ttuegel, 4 minutes ago, open): Tracking issue for wrapQtAppsHook
<delroth> samueldr: yeah, hydra has eval'd and tons of things are broken
<delroth> hard to know how much is unzip vs. other staging-next issues
<delroth> but 1035 new failing builds
<samueldr> thanks for the eval link
<delroth> as a user I really wonder why there is staging / staging-next if it just gets merged with huge regressions like this :/ every single time there's a staging-next merge I end up having to send 2-3 PRs to unbreak stuff, and my infra isn't really that big
<samueldr> I haven't checked; was the unzip patch sent to staging or staging-next first?
* samueldr checks
<delroth> staging
<{^_^}> #64909 (by mmahut, 1 week ago, merged): unzip: CVE-2019-13232
<samueldr> though, a bunch are newly failed deps
* samueldr searches for the js snippet
<samueldr> $('img.build-status[alt^="Dependency"]').parent().parent().hide()
<samueldr> $("#tabs-now-fail .table tr").length // 1036
<samueldr> so still a bunch
<samueldr> oh duh, it still counts the hidden ones :/
<samueldr> 297
<samueldr> 20 out of 22 (from the bottom) are from zip bomb detection
<samueldr> #65393 delroth if you want to chime in
<{^_^}> https://github.com/NixOS/nixpkgs/pull/65393 (by adisbladis, 3 hours ago, open): Revert "unzip: CVE-2019-13232"
<delroth> done
<delroth> what's the process for considering a staging-next merge as acceptable btw?
<samueldr> gchristensen: should we just press the green button?
<samueldr> delroth: not entirely positive, the staging/staging-next process is a bit personal and internalized by a few devs watching it I think
<delroth> as I was mentioning earlier, every single time there's a staging-next merge it's a day or two of pain trying to get fix PRs merged in because half of my system doesn't build anymore
<delroth> and here we have clearly a case where running any of the "big" nixos tests would have clearly caught the regression
<samueldr> I thin an issue might be the lack of tooling / reporting on hydra evals
<samueldr> I think*
<delroth> there are continuous builds on staging though, correct?
<worldofpeace> staging-next is hard :)
<delroth> I understand it's a hard problem, and that defining a perfect bulletproof process is tricky
<samueldr> while there are hydra jobsets, for both, since there's no notification, I guess it's easy just to not really check it
<samueldr> no reporting either
<samueldr> and yeah, in addition to having the branch merge back into master handled "by feel", it may need some thinking
<samueldr> like I just saw it might have broken qt
<delroth> ghostscript is broken too
<delroth> afaict
<samueldr> not related to the zip bomb for qt
<delroth> the ghostscript failure happens to be bad luck with parallel builds afaict
<samueldr> hmm, another thing for staging-next
<samueldr> there seems to have been compounding failures being stabilized
<samueldr> within the -21077 count there is the unzip patch
<samueldr> but that doesn't account for that much I think
<delroth> yeah there was a darwin regression
<delroth> that's what got fixed in the +16K
<samueldr> hmm
<samueldr> wondering what could help in those situations
<samueldr> maybe having diffs from any two points in hydra?
<samueldr> so you can diff for new fixes/failures from the last merge with master, to now, instead of only one eval to the next
<samueldr> oh, you already can
<delroth> yeah, I was going to say :)
<samueldr> though only in time
<samueldr> or against another jobset
<samueldr> not a specific job
<samueldr> (set)
<samueldr> sorry, not against a specific eval*
<delroth> if you url-edit you can
<samueldr> hm, I assumed since it was minus a timestamp it wouldn't; though great
<delroth> for staging-next you could also just compare with trunk-combined
<delroth> hmmm except they're not in the same jobset
<delroth> sorry, same project*
<delroth> nixos vs. nixpkgs
<samueldr> and if you try it anywya?
<delroth> it thinks they're all new/removed jobs
<samueldr> right because in one it's hello, in the other nixpkgs.hello
<samueldr> anyway there's trunk in nixpkgs
<samueldr> I need to write the filter interface for the evaluation page I think
<samueldr> so it's easier to pick e.g. only failures, remove dependency failures
<samueldr> (or pick only timeouts)
<samueldr> I guess it would help better pin pointing the issues in those situations
<samueldr> another thing that would help, but we *may* not be entirely ready to handle the load, is to pick those big honking changes into a one time eval+build on hydra
<samueldr> (if there was some tooling to better express "eval before the change, then eval after the change")
<samueldr> such tooling could also realistically be used to better fast track security updates I guess
_e has quit [Quit: WeeChat 2.4]
_e has joined #nixos-dev
phreedom has quit [Remote host closed the connection]
<alunduil> is there any guideline around how modules are organized? I'm looking to add a small module for automatically replicating zfs snapshots (nothing fancy to start with) but I don't know if I should co-locate it with the current zfs module or create a new one in a better location. Let me know if this question belongs in #nixos as well.
<gchristensen> should be a separate module. for example, there is already one for znapzend
<alunduil> nice. I didn't see that one. I'll check that as an example. Thanks!
phreedom has joined #nixos-dev
puck has quit [Quit: nya]
puck has joined #nixos-dev
tv has quit [Ping timeout: 246 seconds]
lassulus has quit [Ping timeout: 268 seconds]
tv has joined #nixos-dev
lassulus has joined #nixos-dev
orivej has quit [Ping timeout: 272 seconds]
das_j has quit [Ping timeout: 250 seconds]
FRidh has quit [Ping timeout: 245 seconds]
Drakonis has quit [Quit: WeeChat 2.4]
FRidh has joined #nixos-dev
FRidh has quit [Ping timeout: 246 seconds]
FRidh has joined #nixos-dev
johanot has joined #nixos-dev
justanotheruser has quit [Ping timeout: 244 seconds]
das_j has joined #nixos-dev
justanotheruser has joined #nixos-dev
psyanticy has joined #nixos-dev
noonien has joined #nixos-dev
puck has quit [Ping timeout: 244 seconds]
puckipedia has joined #nixos-dev
puckipedia is now known as puck
johanot has quit [Quit: WeeChat 2.4]
avn has quit [Ping timeout: 245 seconds]
FRidh has quit [Quit: Konversation terminated!]
orivej has joined #nixos-dev
__monty__ has joined #nixos-dev
Drakonis has joined #nixos-dev
johanot has joined #nixos-dev
justanotheruser has quit [Ping timeout: 248 seconds]
justanotheruser has joined #nixos-dev
<yorick> gchristensen: is there some arm community builder? I'm trying to debug armv7l not building on aarch64 anymore
<samueldr> there's no armv7l community builder*, the community builder is aarch64
<yorick> *?
<samueldr> * (in practice it's able to use a KVM accelerated armv7l system)
<yorick> samueldr: why can't we just add it to extraPlatforms and call it a day?
<yorick> alternatively, how does that work?
<samueldr> oh, that doesn't generally works
<samueldr> because of impurities
<samueldr> it looks like it works for a while
<yorick> and then it fails on libffi or something? ;)
<samueldr> but there's things that ends up looking at impure things like the cpu features, or trying to run things
<samueldr> there's no personality in the kernel like for i686 vs. x86_64 for armv7 vs. aarch64
<samueldr> (I think it's called personality, right?)
<samueldr> so, as of right now, the only sane way to build armv7l on aarch64 is to boot in 32 bit (armv7) mode or use kvm
<yorick> our current armv7l builder is an r-pi3 with an armv7l system, it seems to work
<yorick> okay, how does kvm work?
<samueldr> erm, can't help much more than "it just works, like on x86_64" lol
<samueldr> but it did work for me on an rpi3b
<samueldr> as long as /dev/kvm is there, qemu with kvm will work
* samueldr checks for a post
<yorick> I mean, how do I set it up?
<samueldr> for best results, using the EFI iso image for armv7l is likely easier
<andi-> I think sphalerite was working on that during ZuriHac?
<yorick> I can't really boot that on a 128GB packet instance :D
<samueldr> oops
<samueldr> yorick is gone!
<samueldr> (from my tab completion)
<yegortimoshenko> sec!
<samueldr> sorry yegortimoshenko, you weren't the one I wanted to ping
samueldr has left #nixos-dev [#nixos-dev]
samueldr has joined #nixos-dev
<sphalerite> leaving out of shame?
<samueldr> no, refreshing the nicknames list
<yegortimoshenko> ah, ok :-)
<sphalerite> :p
<yorick> I'm still here
<samueldr> yeah, seems like my client didn't believe you were
<yorick> oh, I thought it was userspace kvm instead of user kvm
<yorick> system&
<samueldr> just bog standard qemu with kvm :)
<yorick> or maybe we should fix the impurities
<samueldr> though, the trick is to still boot using qemu-system-aarch64, but passing -enable-kvm -cpu host,aarch64=off
<samueldr> the impurities are things like "being able to execute code"
<samueldr> they are not AFAIUI nix's, but system impurities
<sphalerite> andi-: yes I was trying… had some weird issues
<samueldr> of note: there are limitations with kvm; first I think it's limited to 8 (or was it 6, or 12?) core with qemu; though that may have been fixed
<samueldr> though you could spin up more builder vms
<samueldr> and for memory, LPAE has to be enabled in the kernel
<samueldr> which isn't in the default config set for armv7l, but I *think* we could; IIRC all armv7 platforms we intend to target should have it
<samueldr> and as far as getting an initial armv7 image, you could cross-compile an armv7 system, https://github.com/samueldr/cross-system
<samueldr> I should implement the iso_image one there
<samueldr> right now it only does sd_image and that requires u-boot, which didn't work with kvm the last time I tried (a couple months back)
<samueldr> oh, though I just remembered that EFI + grub + armv7 didn't work without some patches in grub :/
<samueldr> dang it
<yorick> samueldr: we have uboot, at least
<yorick> but these boards are cortex a9's
<samueldr> I was still going on about booting armv7 on kvm
johanot has quit [Quit: WeeChat 2.4]
<yorick> samueldr: I think most of these impurities could be fixed with configureFlags = [ "--target=armv7l-unknown-linux-gnueabihf" ]
<yorick> pkgsCross.armv7l-hf-multiplatform hmmmmm
<samueldr> at that point it crosses through the cross-compilation realm, which is different than native compilation of 32 bit arm on 64 bit arm
<samueldr> not saying it wouldn't work, it's just a different way to go
<yorick> all of the problems are just autoconf using uname to see the wrong arch
<samueldr> all of the currently easy to see issues, I guess
<samueldr> because even on aarch64, there are issues on different cortex-* architectures :/
<samueldr> e.g. building on one, makes the lib fail to run on another due to missing features
webster23 has joined #nixos-dev
phreedom has quit [Ping timeout: 260 seconds]
__monty__ has quit [Ping timeout: 258 seconds]
__monty__ has joined #nixos-dev
Jackneill has quit [Remote host closed the connection]
johnny101m has joined #nixos-dev
phreedom has joined #nixos-dev
psyanticy has quit [Quit: Connection closed for inactivity]
ixxie has joined #nixos-dev
ixxie has quit [Ping timeout: 245 seconds]
andi- has quit [Quit: WeeChat 2.5]
andi- has joined #nixos-dev
infinisil has quit [Quit: Configuring ZNC, sorry for the joins/quits!]
infinisil has joined #nixos-dev
__monty__ has quit [Ping timeout: 245 seconds]
__monty__ has joined #nixos-dev
__monty__ has quit [Quit: leaving]
phreedom has quit [Quit: No Ping reply in 180 seconds.]
phreedom has joined #nixos-dev