Sonarpulse has quit [(Ping timeout: 268 seconds)]
markus1199 has quit [(Ping timeout: 268 seconds)]
markus1189 has quit [(Ping timeout: 260 seconds)]
CMCDragonkai has joined #nixos
CMCDragonkai is now known as Guest75137
<NixOS_GitHub> [nixpkgs] dezgeg closed pull request #25098: ephoto: init at 1.0 (master...new.ephoto) https://git.io/v9UsU
acowley_away is now known as acowley
[0x4A6F] has quit [(Ping timeout: 240 seconds)]
[0x4A6F] has joined #nixos
chakerbenhamed has quit [(Ping timeout: 260 seconds)]
newhoggy has quit [(Remote host closed the connection)]
<jophish> how does nix override uname when performing an i686 build on x86_64?
<jophish> I've noticed that uname -m returns i686
<jophish> sadly the same is not true for armv7 builds on aarch64
<Dezgeg> yep, there is a kernel option (personality()) for doing that on i686/x86_64 but no equivalent for arm/aarch64 and that majorly sucks
<jophish> Dezgeg: It's turning out to be quite an impediment to building armv7 things on aarch64
<Dezgeg> yes, I can believe
<Dezgeg> need to write a fake uname shell script one day that returns hardcoded values and put that into stdenv
<jophish> I might have to do that now, I can imagine that it might not be quite as easy as that
<NixOS_GitHub> [nixpkgs] Hodapp87 opened pull request #25103: cloud-print-connector: init at unstable-2017-01-19 (master...google_cloud_print) https://git.io/v9UK8
<hodapp> \o/
<hodapp> however many months it took me to write that PR
johnramsden has joined #nixos
newhoggy has joined #nixos
<johnramsden> I'm getting a message 'error while loading shared libraries: libgio-2.0.so.0: cannot open shared object file: No such file or directory' But I can't find out library in nix packages. Does anyone know what this is and what it might be called in nix?
acarrico has quit [(Ping timeout: 260 seconds)]
<jophish> johnramsden: it's in glib
mounty has quit [(Quit: Konversation terminated!)]
aminechikhaoui has quit [(Ping timeout: 240 seconds)]
<johnramsden> jophish, k, thanks
nicknovitski has joined #nixos
<johnramsden> Now I cant find libpangocairo. How do you track them down?
<jophish> johnramsden: pango
<jophish> find /nix/store | grep libpangocairo # for future reference :)
<johnramsden> Gotcha
<jophish> Dezgeg: #glibc suggested the setarch tool, however that has the same limitations as personalities
<jophish> there's also bennofs's nix-index
<jophish> announced today!
<Dezgeg> setarch isn't enough
<Dezgeg> you can't use it to turn to armv7l
<jophish> yeah, that's what I meant about the limitations
<jophish> I wonder what the minimal `uname` executable is
<jophish> actually, what does the uname in sandboxed builds do?
carlosda1 has joined #nixos
newhoggy has quit [(Remote host closed the connection)]
<jophish> ah, localhost
<jophish> I suppose the easiest way of replacing uname is to pipe the output through "sed 's/aarch64/armv7l/'"
mounty has joined #nixos
<jophish> Dezgeg: where's the correct place to add this uname wrapper
<jophish> the bootstrap tools are a little tricky to work out
<Dezgeg> I suppose in pkgs/stdenv/generic/default.nix
carlosda1 has quit [(Ping timeout: 252 seconds)]
eacameron has quit [(Remote host closed the connection)]
<jophish> thanks
eacameron has joined #nixos
<Dezgeg> or pkgs/stdenv/common-path.nix
filterfish has joined #nixos
<jophish> perhaps even in coreutils?
<jophish> oh, coreutils is too late by the looks of it
<jophish> similarly for common-path I think
filterfish_ has joined #nixos
filterfish has quit [(Read error: Connection reset by peer)]
<jophish> well, I suppose it'll have to change in bootstrap tools as well as common-path/coreutils
eacameron has quit [(Remote host closed the connection)]
eacameron has joined #nixos
eacameron has quit [(Remote host closed the connection)]
filterfish_ has quit [(Read error: Connection reset by peer)]
filterfish has joined #nixos
snikkers has quit [(Remote host closed the connection)]
filterfish has quit [(Read error: Connection reset by peer)]
ashkitten has quit [(Quit: http://quassel-irc.org - Chat comfortably. Anywhere.)]
eacameron has joined #nixos
darlan has quit [(Quit: Communi 3.5.0 - http://communi.github.com)]
<pie_> ughhh bash: cd: Tiled-0.18.2-x86_64.AppImage: Not a directory
<pie_> this sounds familiar
* pie_ facepalms and checks if theres a package
<pie_> of course there is :P
vaibhavsagar has joined #nixos
<johnramsden> I've added xorg.libxkbfile as a dependency but still get ' message: 'libxkbfile.so.1: cannot open shared object file: No such file or directory' any clue why?
eacameron has quit [(Remote host closed the connection)]
eacamero_ has joined #nixos
eacamero_ has quit [(Ping timeout: 255 seconds)]
eacameron has joined #nixos
eacamero_ has joined #nixos
<hodapp> hmm, does listing a parameter as "foo ? null" in a derivation in nixpkgs still leave it passed in by default?
mounty has quit [(Quit: Konversation terminated!)]
eacameron has quit [(Ping timeout: 255 seconds)]
eacameron has joined #nixos
mbrgm has quit [(Ping timeout: 260 seconds)]
eacamero_ has quit [(Ping timeout: 258 seconds)]
derjohn_mob has quit [(Ping timeout: 258 seconds)]
mbrgm has joined #nixos
mkoenig has quit [(Read error: Connection reset by peer)]
eacamero_ has joined #nixos
eacameron has quit [(Ping timeout: 260 seconds)]
Supersonic112 has quit [(Disconnected by services)]
aneeshusa has quit [(Ping timeout: 268 seconds)]
Supersonic112_ has joined #nixos
carlosda1 has joined #nixos
Supersonic112_ is now known as Supersonic112
mkoenig has joined #nixos
eacamero_ has quit [(Ping timeout: 240 seconds)]
eacameron has joined #nixos
carlosda1 has quit [(Ping timeout: 260 seconds)]
eacameron has quit [(Ping timeout: 240 seconds)]
bennofs1 has joined #nixos
derjohn_mob has joined #nixos
eacameron has joined #nixos
takle has quit [(Read error: Connection reset by peer)]
takle has joined #nixos
bennofs1 has quit [(Ping timeout: 240 seconds)]
bennofs has quit [(Ping timeout: 252 seconds)]
eacameron has quit [(Ping timeout: 260 seconds)]
eacameron has joined #nixos
batdog has quit [(Read error: Connection reset by peer)]
batdog has joined #nixos
newhoggy has joined #nixos
eacameron has quit [(Ping timeout: 258 seconds)]
statusbot has quit [(Remote host closed the connection)]
newhoggy has quit [(Remote host closed the connection)]
statusbot has joined #nixos
mkoenig has quit [(Ping timeout: 260 seconds)]
seagreen has joined #nixos
carlosda1 has joined #nixos
carlosda1 has quit [(Ping timeout: 260 seconds)]
batdog has quit [(Read error: Connection reset by peer)]
iyzsong has joined #nixos
sellout- has joined #nixos
batdog has joined #nixos
mounty has joined #nixos
hexagoxel has quit [(Ping timeout: 260 seconds)]
newhoggy has joined #nixos
hexagoxel has joined #nixos
eacameron has joined #nixos
eacamero_ has joined #nixos
eacameron has quit [(Ping timeout: 252 seconds)]
newhoggy has quit [(Remote host closed the connection)]
<johnramsden> I've added xorg.libxkbfile as a dependency to a package but still get ' message: 'libxkbfile.so.1: cannot open shared object file: No such file or directory' anyone had this before?
eacamero_ has quit [(Ping timeout: 260 seconds)]
ertes has joined #nixos
dbmikus has joined #nixos
schoppenhauer has quit [(Ping timeout: 240 seconds)]
schoppenhauer has joined #nixos
pie_ has quit [(Ping timeout: 240 seconds)]
carlosda1 has joined #nixos
takle has quit [(Remote host closed the connection)]
mkoenig has joined #nixos
carlosda1 has quit [(Ping timeout: 258 seconds)]
dbmikus has quit [(Ping timeout: 260 seconds)]
newhoggy has joined #nixos
newhoggy has quit [(Remote host closed the connection)]
systemfault has joined #nixos
joncfoo has quit [(Ping timeout: 240 seconds)]
davidak has quit [(Quit: Leaving.)]
newhoggy has joined #nixos
newhoggy has quit [(Remote host closed the connection)]
Wizek_ has quit [(Ping timeout: 255 seconds)]
ericsagnes has quit [(Ping timeout: 245 seconds)]
eacameron has joined #nixos
iyzsong has quit [(Ping timeout: 240 seconds)]
newhoggy has joined #nixos
mounty has quit [(Quit: Konversation terminated!)]
newhoggy has quit [(Ping timeout: 260 seconds)]
newhoggy has joined #nixos
sophiag has joined #nixos
<sophiag> does anyone here use petite chez scheme with emacs? i've installed both emacs and chez with nix and just want to use petite with xscheme so no emacs package is required, but scheme files still launch saying "Scheme/Guile" and run-scheme returns "cannot find chez." is it possible i need to launch emacs from inside a nix-shell? that would be very cumbersome...
ericsagnes has joined #nixos
<dmj`> peti: pong
<dmj`> peti: ping**
systemfault has quit [(Quit: Bye!)]
<dmj`> peti: the HaLVM derivation works fine on my NixOS machine with useSandbox = true; I’m not sure what Hydra is doing that could possibly be any different. I’ve disabled parallel builds as well, which is what I thought previously was causing the problem
<hodapp> people use HaLVM?
iyzsong has joined #nixos
<dmj`> hodapp: I do
<dmj`> :)))
<hodapp> I've yet to but it looks like some good work
takle has joined #nixos
<dmj`> hodapp: well you could use it just fine before it was marked as broken recently :)
* dmj` looks at peti
dbmikus has joined #nixos
<dmj`> hodapp: I’d show you slides of how to use it with nix
<dmj`> but nix-build ‘<nixpkgs>’ -A haskell.compiler.integer-simple.ghcHaLVM240 is marked as teh broke
<dmj`> it’s *very* nice with NixOS due to xen
<dmj`> and (** bonus **), libvirtd
takle has quit [(Ping timeout: 258 seconds)]
<dmj`> so like, if you restart NixOS, the unikernels will be restored onto Xen, if libvirtd is running
<dmj`> the unikernels live in the /nix/store
<dmj`> it’s pretty swag
<dmj`> hodapp: Also, libvirtd requires XML to describe the unikernel name, path and size. So, we can use nix’s toXML
carlosda1 has joined #nixos
<dmj`> so, put all of that into a NixOS module, and you have a real pizza
dbmikus has quit [(Ping timeout: 268 seconds)]
carlosda1 has quit [(Ping timeout: 260 seconds)]
mkoenig has quit [(Read error: Connection reset by peer)]
takle has joined #nixos
takle has quit [(Ping timeout: 260 seconds)]
newhoggy has quit [(Remote host closed the connection)]
newhoggy has joined #nixos
mkoenig has joined #nixos
vaibhavsagar has quit [(Ping timeout: 252 seconds)]
joncfoo has joined #nixos
endformationage has quit [(Quit: WeeChat 1.7)]
newhoggy has quit [(Remote host closed the connection)]
takle has joined #nixos
sellout- has quit [(Quit: Leaving.)]
takle has quit [(Ping timeout: 252 seconds)]
dmi3y has joined #nixos
ebzzry has joined #nixos
dmi3y has quit [(Ping timeout: 240 seconds)]
takle has joined #nixos
takle has quit [(Ping timeout: 260 seconds)]
jacob has joined #nixos
jacob is now known as Guest16659
takle has joined #nixos
Guest16659 has quit [(Client Quit)]
takle has quit [(Ping timeout: 258 seconds)]
jacob__ has joined #nixos
k2s has joined #nixos
k2s has quit [(Client Quit)]
carlosda1 has joined #nixos
carlosda1 has quit [(Ping timeout: 240 seconds)]
takle has joined #nixos
takle has quit [(Ping timeout: 240 seconds)]
newhoggy has joined #nixos
marsel has joined #nixos
newhoggy has quit [(Ping timeout: 258 seconds)]
mkoenig has quit [(Ping timeout: 258 seconds)]
filterfish has joined #nixos
griff_ has joined #nixos
filterfish has quit [(Read error: Connection reset by peer)]
newhoggy has joined #nixos
vaibhavsagar has joined #nixos
griff_ has quit [(Ping timeout: 258 seconds)]
takle has joined #nixos
newhoggy has quit [(Ping timeout: 268 seconds)]
takle has quit [(Ping timeout: 258 seconds)]
jacob__ has quit [(Quit: Lost terminal)]
takle has joined #nixos
takle has quit [(Ping timeout: 240 seconds)]
newhoggy has joined #nixos
simukis__ has joined #nixos
newhoggy has quit [(Ping timeout: 240 seconds)]
eacameron has quit [(Remote host closed the connection)]
lsyoyom has quit [(Ping timeout: 268 seconds)]
<NixOS_GitHub> [nixpkgs] cpages pushed 1 new commit to release-17.03: https://git.io/v9UQB
<NixOS_GitHub> nixpkgs/release-17.03 d5af2a6 Jean-Baptiste Giraudeau: Kodi: use kodi fork of libdvdnav/libdvdread. Fix #24153 (dvd playback)...
proteusguy has quit [(Ping timeout: 245 seconds)]
newhoggy has joined #nixos
takle has joined #nixos
marsel has quit [(Ping timeout: 240 seconds)]
carlosda1 has joined #nixos
takle has quit [(Ping timeout: 258 seconds)]
newhoggy has quit [(Ping timeout: 258 seconds)]
lsyoyom has joined #nixos
obadz has quit [(Ping timeout: 260 seconds)]
obadz has joined #nixos
carlosda1 has quit [(Ping timeout: 240 seconds)]
newhoggy has joined #nixos
nicknovitski has quit [(Ping timeout: 252 seconds)]
<joko> Hello, could anyone tell me how to copy a derivation from a remote machine's /nix/store to the local one? scp complaining that the local store is a read-only fs
<sphalerite> nix-copy-closure
newhoggy has quit [(Ping timeout: 240 seconds)]
<joko> thanks!
takle has joined #nixos
takle has quit [(Ping timeout: 240 seconds)]
<johnramsden> Could someone give me a hand. I'm having trouble separating a package into a separate file. Right now I keep getting error: undefined variable <package name>.
<johnramsden> Heres my package:
filterfish has joined #nixos
sophiag has quit [(Remote host closed the connection)]
wkennington has joined #nixos
<clever> johnramsden: if you put ${bash} into an expression, you need to add bash to the arguments on line 1
AllanEspinosa has quit [(Ping timeout: 260 seconds)]
filterfish has quit [(Ping timeout: 240 seconds)]
<clever> for every value you use, you must receive that as an argument, or create it somewhere nearby
<johnramsden> clever, ahh k
sophiag has joined #nixos
takle has joined #nixos
newhoggy has joined #nixos
<clever> johnramsden: you should generaly also remove the pkgs. on lines 20-36, and add them to the arguments
<infinisil> I am starting to believe that clever actually lives here
faffolter has joined #nixos
faffolter has quit [(Changing host)]
faffolter has joined #nixos
<johnramsden> clever, Yea, I was doing that before, I thought it was because I missed the pkgs
<johnramsden> clever, working now!
taktoa has joined #nixos
takle has quit [(Ping timeout: 260 seconds)]
newhoggy has quit [(Ping timeout: 260 seconds)]
<clever> you also dont need ... in the arguments of a package
<clever> that makes it harder to find mistakes
<Isorkin> Hi. how to create two php-fpm service with php56 and php71?
<johnramsden> clever, took em out now
Svarog has joined #nixos
newhoggy has joined #nixos
<Svarog> If I enable nix.sshServe, do I still need regular nix-serve configured? Do I still need nix-serve.secretKeyFile for the store, or is it enough to just configure nix.sshServe.keys for which users are allowed to connect?
filterfish has joined #nixos
<Svarog> I realize they're different things, but I'm a bit confused about how to configure nix-serve so it only works with SSH
<clever> Svarog: sshServe just configures an ssh user to only allow somebody to run nix-store --serve
<Svarog> oh ok
<clever> Svarog: so its just a more locked down user, that allows things like nix-copy-closure and remote nix builds
<Svarog> So then the normal nix-serve over HTTP is still active then?
<Svarog> Is there a way I can block that so only SSH is available?
<clever> Isorkin: the nixos module only allows a single php-fpm package, so you would need to make your own service to run the 2nd php-fpm on a different port/unix socket
<Svarog> I suppose I could block it by not opening the 5000 port
<clever> Svarog: yeah, you can just turn nix-serve off in the configuration.nix
<Svarog> ah, right. That's what I was confused about
<Svarog> I wasn't sure if I needed to have that on for nix-serve to work at all
<Isorkin> clever: ok
newhoggy has quit [(Ping timeout: 260 seconds)]
<clever> Svarog: something that can help a lot, click the enable option here, then the file its declared in: https://nixos.org/nixos/options.html#sshserve
takle has joined #nixos
<clever> Svarog: then scroll down to the config = { region
<clever> Svarog: setting sshServe.enable to true is identical to pasting lines 29-48 into configuration.nix
<Svarog> arghh - should have thought to look there first. Makes sense :)
Filystyn has joined #nixos
Filystyn has quit [(Changing host)]
Filystyn has joined #nixos
<Svarog> Thanks clever :)
justbeingglad has joined #nixos
justbeingglad has left #nixos []
<Svarog> what about the nix-serve store key? Does that still need to be set up?
takle has quit [(Ping timeout: 260 seconds)]
<clever> Svarog: sshServe wont use that key, so it wont help
<clever> Svarog: nix-daemon has its own config for that
<Svarog> But I won't get those messages saying binary cache ignored because file wasn't signed?
<clever> nix.extraOptions = "secret-key-files = /etc/nix/signing.sec";
<clever> Svarog: you will need this entry on the server to allow it to sign things, i believe
<Svarog> ah
griff_ has joined #nixos
mounty has joined #nixos
newhoggy has joined #nixos
Infinisil_ has joined #nixos
<Svarog> Out of curiosity is this documented anywhere? The part about setting the secret key file for nix-serve when using SSH?
<Isorkin> clever: config - http://nixpaste.lbr.uno/raw/ob59yP5Z error - http://nixpaste.lbr.uno/raw/O61Jjl80 How to fix the error?
<clever> Svarog: i had to dig thru the nix source for that
<clever> Isorkin: something you added to systemPackages is a set
newhoggy has quit [(Ping timeout: 260 seconds)]
<johnramsden> clever, So after all you're help with patchelf I was able to get my program building, and launching. Problem is now I'm getting a strange error that I have no idea about. I've added libxkb but it still seems to think it's missing.
<johnramsden> Here's the package:
<johnramsden> The error when I launch it is in the commit. But the important part is "message: 'libxkbfile.so.1: cannot open shared object file: No such file or directory' "
<clever> Isorkin: it may help to common out things in the systemPackages list and try "nixos-rebuild dry-run" and try to narrow down which one is the cause
filterfish_ has joined #nixos
<Isorkin> clever: If change php = mypkgs.php56-libressl to php = pkgs.php56 -no error
carlosda1 has joined #nixos
filterfish has quit [(Read error: Connection reset by peer)]
<NixOS_GitHub> [nixpkgs] edwtjo pushed 2 new commits to master: https://git.io/v9U5b
<NixOS_GitHub> nixpkgs/master ad84b1e Edward Tjörnhammar: jackett: 0.7.1197 -> 0.7.1308
<NixOS_GitHub> nixpkgs/master da2518f Edward Tjörnhammar: i2pd: 0.12.0 -> 0.13.0
<clever> Isorkin: what if you try to nix-build -A php56-libressl mypkgs/default.nix
griff_ has quit [(Ping timeout: 240 seconds)]
<clever> Isorkin: and also, what is the contents of pkgs/development/php/default_php56.nix?
carlosda1 has quit [(Ping timeout: 240 seconds)]
<NixOS_GitHub> [nixpkgs] rszibele opened pull request #25104: curlcpp: 20160901 -> 20170320 (master...master) https://git.io/v9U5j
<Isorkin> clever: normal build
filterfish has joined #nixos
filterfish_ has quit [(Ping timeout: 240 seconds)]
<clever> johnramsden: what if you run ldd on the file after it has been patched?
<johnramsden> clever, hmm, no libxkb
<johnramsden> clever, I must be doing something wrong
<clever> johnramsden: i cant see anything obviously wrong, so lets try just appending :${xorg.libxkbfile.out}/lib/ to the rpath
Infinisil_ has quit [(Ping timeout: 252 seconds)]
<johnramsden> clever still not there
infinisil has quit [(Ping timeout: 255 seconds)]
<Isorkin> clever: php = mypkgs.php56-test - working. php56-test min config - http://nixpaste.lbr.uno/raw/RWQC-F3E I do not know how to add configure flags
vaibhavsagar has quit [(Ping timeout: 268 seconds)]
newhoggy has joined #nixos
<clever> Isorkin: ok, and what if you run "nix-repl mypkgs/default.nix" then type in php56-libressl, what does it return?
pie_ has joined #nixos
filterfish has quit [(Ping timeout: 260 seconds)]
Filystyn has quit [(Ping timeout: 252 seconds)]
takle has joined #nixos
filterfish has joined #nixos
Filystyn has joined #nixos
newhoggy has quit [(Ping timeout: 240 seconds)]
filterfish_ has joined #nixos
<Isorkin> nix-repl> php56-libressl - { override = «lambda»; overrideDerivation = «lambda»; php56 = «derivation /nix/store/p3l48yfc3f5k4b2ph0q19b0mbd4m0p4r-php-5.6.30.drv»; }
<NixOS_GitHub> [nixpkgs] edwtjo opened pull request #25105: nixos: static ids for jackett, radarr, sonarr (master...jackett-radarr-sonarr-ids) https://git.io/v9Ud8
pie_ has quit [(Ping timeout: 260 seconds)]
takle has quit [(Ping timeout: 240 seconds)]
<Isorkin> nix-repl> php56-test - «derivation /nix/store/zksdr33l1j3qyw34403xpgbvzm8lzwfj-php-5.6.30.drv»
filterfish_ has quit [(Read error: Connection reset by peer)]
filterfish has quit [(Ping timeout: 240 seconds)]
<johnramsden> clever, thanks for your help, I have to go.
ambro718 has joined #nixos
<clever> Isorkin: yeah, i think i see the problem
<clever> Isorkin: you probably need this in services.nix: php = mypkgs.php56-libressl.php56;
<clever> Isorkin: i see you also have 2 different php56 files, pkgs/development/php/default_php56.nix and pkgs/development/php56/default.nix
<clever> Isorkin: that may explain why the files you gave me dont make sense with the data you gave me
iyzsong-x has joined #nixos
johnramsden has quit [(Remote host closed the connection)]
iyzsong has quit [(Ping timeout: 240 seconds)]
sivteck has joined #nixos
<Isorkin> clever: Trying to delete pkgs/development/php56/default.nix ?
Filystyn has quit [(Quit: Konversation terminated!)]
<sphalerite> I want to make a tiny change to nix, but based on other people's experiences I'm worried about running the latest master version, particularly because I need to test it as root. Is it safe now, or will I screw up my database?
newhoggy has joined #nixos
<clever> Isorkin: try just using php = mypkgs.php56-libressl.php56; first
<clever> sphalerite: one option, you can just make a backup copy of /nix/var/nix/db/db.sqlite
<sphalerite> oh, or I could do it in a VM
<clever> sphalerite: if you dont gc after the backup, then restoring will just cause nix to delete anything made after the backup
<clever> yeah, a vm is also an option
<clever> sphalerite: you could also just nix.package = pkgs.nixUnstable in configuration.nix
<clever> sphalerite: its less that it breaks the db, and more that it may be too new to be compatible with the old nix
<sphalerite> unstable sounds too scary for me :p
<Isorkin> clever: thanks, work
<clever> but if you use the new nix globally, it will keep working
newhoggy has quit [(Ping timeout: 240 seconds)]
<Isorkin> clever: but how to use new nix globally?
<clever> Isorkin: you probably dont need the new nix, that was stuff for sphalerite
elpea has joined #nixos
newhoggy has joined #nixos
filterfish has joined #nixos
takle has joined #nixos
filterfish_ has joined #nixos
newhoggy has quit [(Ping timeout: 245 seconds)]
takle has quit [(Ping timeout: 260 seconds)]
<NixOS_GitHub> [nixpkgs] emanueleperuffo opened pull request #25106: robomongo: refactor (master...master) https://git.io/v9UFN
filterfish has quit [(Read error: Connection reset by peer)]
<LnL> sphalerite: the latest version of nix is forward compatible with 1.12 now, so you don't have to worry about the db schema
<sphalerite> oh, neat
carlosda1 has joined #nixos
newhoggy has joined #nixos
carlosda1 has quit [(Ping timeout: 255 seconds)]
newhoggy has quit [(Ping timeout: 260 seconds)]
takle has joined #nixos
chakerbenhamed has joined #nixos
newhoggy has joined #nixos
takle has quit [(Ping timeout: 258 seconds)]
<steveeJ> is the derivation path already accessible within a derivation's phases?
<steveeJ> I'm talking about the drv file path that is printed e.g. when using nix-instantiate
<clever> i dont think it is
<clever> what are you thinking of?
revtintin has joined #nixos
roconnor has quit [(Ping timeout: 255 seconds)]
newhoggy has quit [(Ping timeout: 252 seconds)]
dbmikus has joined #nixos
<steveeJ> I want to use that path in a derivation that wraps nix-shell calls with that drv
filterfish has joined #nixos
<clever> steveeJ: it might be possible to set passthru.env = stdenv.mkDerivation { something = parent_deriv.drvPath; };
filterfish has quit [(Remote host closed the connection)]
<clever> steveeJ: it will need to be passthru it not affect the hash of its parent, but it may still trigger recusion, not sure
filterfish has joined #nixos
<clever> you may need to // it on afterwards
<clever> let foo = stdenv.mkDerivation { ... }; bar = stdenv.mkDerivation { something = foo.drvPath; } in foo // { env = bar; }
filterfish_ has quit [(Remote host closed the connection)]
<clever> steveeJ: does that help?
<steveeJ> clever: very interesting, thanks
<steveeJ> modifying the derivation after it is built
<clever> a derivation is just an attrset with a special type flag
<clever> nix-repl> hello.type
<clever> "derivation"
<steveeJ> nix-build will consider the changes, right?
dbmikus has quit [(Ping timeout: 260 seconds)]
<clever> adding attributes like .env wont have any impact on nix-build
newhoggy has joined #nixos
<steveeJ> clever: thanks very much! I didn't know of that
takle has joined #nixos
newhoggy has quit [(Ping timeout: 260 seconds)]
takle has quit [(Ping timeout: 255 seconds)]
newhoggy has joined #nixos
takle has joined #nixos
takle has quit [(Ping timeout: 240 seconds)]
kampfschlaefer has joined #nixos
newhoggy has quit [(Ping timeout: 240 seconds)]
michiel_l_ has quit [(Quit: No Ping reply in 180 seconds.)]
chakerbenhamed has quit [(Ping timeout: 252 seconds)]
michiel_l has joined #nixos
filterfish has quit [(Ping timeout: 260 seconds)]
thc202 has joined #nixos
takle has joined #nixos
Mateon2 is now known as Mateon1
Wizek_ has joined #nixos
takle has quit [(Ping timeout: 268 seconds)]
takle has joined #nixos
newhoggy has joined #nixos
newhoggy has quit [(Read error: Connection reset by peer)]
carlosda1 has joined #nixos
newhoggy has joined #nixos
xAFFE has joined #nixos
carlosda1 has quit [(Ping timeout: 240 seconds)]
xAFFE has quit [(Quit: Error from remote client)]
ebzzry has quit [(Ping timeout: 240 seconds)]
ebzzry has joined #nixos
newhoggy has quit [(Remote host closed the connection)]
newhoggy has joined #nixos
simukis__ has quit [(Quit: simukis__)]
<NixOS_GitHub> [nixpkgs] vcunat pushed 3 new commits to master: https://git.io/v9UxI
<NixOS_GitHub> nixpkgs/master cf1a925 taku0: firefox-bin: 52.0.2 -> 53.0
<NixOS_GitHub> nixpkgs/master acf1254 taku0: firefox-esr: 52.0.2esr -> 52.1.0esr
<NixOS_GitHub> nixpkgs/master 5cdf192 Vladimír Čunát: Merge #25043: firefox-{bin,esr}: critical security
<NixOS_GitHub> [nixpkgs] vcunat closed pull request #25043: firefox-bin: 52.0.2 -> 53.0, firefox-esr: 52.0.2esr -> 52.1.0esr [Critical security fixes] (master...firefox-bin-53.0) https://git.io/vSh9b
newhoggy has quit [(Ping timeout: 255 seconds)]
<Svarog> How would I test that nix-serve can connect to another computer on the LAN via SSH?
xAFFE has joined #nixos
<Svarog> Without SSH I can do curl http://<hostname>:5000/nix-cache-info, is there something similar I can do with nix-serve and SSH?
<ambro718> I get this error when running nix-collect-garbage: error: error getting outputs of ‘/nix/store/4bc2gyg68gj1lc3xkiaap1d1686i1nyp-libpulseaudio-9.0.drv’: database disk image is malformed
<Svarog> ambro718, try repairing the store
<Svarog> nix-store --verify --check-contents --repair
ebzzry has quit [(Ping timeout: 260 seconds)]
justbeingglad has joined #nixos
justbeingglad has left #nixos []
<steveeJ> Svarog: I recently installed nix-serve and it works for me, but I don't follow what you mean by SSH. are you not using the local nix store on the machine that runs nix-serve?
<Svarog> steveeJ, I have nix-serve working over HTTP, however I want to switch it over to use SSH instead
<Svarog> According to this it should be possible http://nixos.org/nix/manual/#ssec-ssh-substituter
<steveeJ> Svarog: interesting, I didn't know this option. this is unrelated to nix-serve though
<Svarog> It's under the section called serving the Nix store via SSH
<steveeJ> Svarog: I think you can use the nix-copy-closure command t otest
<Svarog> and looking at the nix code it uses nix-serve internally
<steveeJ> Svarog: do you have a link to the code?
<Svarog> just a sec
<steveeJ> from what I can see it uses "nix-store --serve", whatever that does
<Svarog> oh oops
<Svarog> yes you're right it does
<clever> and nix-copy-closure already uses that exact command
<clever> so you can just try a copy --from
<clever> with the user set right
<Svarog> ah right
<Svarog> So I don't need nix-serve at all?
<Svarog> For anything?
<clever> correct
<clever> it can also help to just look at the nix-serve source: https://github.com/edolstra/nix-serve/blob/master/nix-serve.psgi
<clever> if you try to download a .nar.bz2, it will literally just pipe "nix-store --dump $foo | bzip2" out the http port
<clever> thats all it does
agjacome has joined #nixos
<joko> Anyone running Hydra on NixOS 17.03? I still have issues :/ https://github.com/NixOS/hydra/issues/467
<Svarog> Can nix-copy-closure be used to pull everything across instead of individual packages?
<clever> joko: is there a reverse proxy in the mix?
<clever> Svarog: any built derivation or .drv file, and it will get the entire closure automatically
<clever> Svarog: and if you configure nix correctly, it will copy things on-demand
<joko> clever: yes, nginx
vaibhavsagar has joined #nixos
<clever> joko: you may also need to increase the body size in nginx
<clever> Svarog: i think its NIX_OTHER_STORES
<Svarog> By entire closure do you mean that package and its dependencies? But not everything else in the store that is present on both machines?
<clever> Svarog: yeah, if you copy package a, and it depends on b, both a&b will get copied
<Svarog> What if I want all packages updated?
<Svarog> Not just dependencies of a single package.
<clever> Svarog: either configure it to use sshServe as a binary cache, or copy/paste the list from "echo /nix/store/*/" into the nix-copy-closure commandline
<Svarog> Like in the example in the documentation they're pulling firefox across. What if I also want thunderbird and gcc and ghc and about a hundred other things?
<Svarog> Right, so that's what I'm trying to figure out, how to configure sshServe as a binary cache.
<clever> "echo /nix/store/*{thunderbird,gcc,ghc}*/"
<clever> i think you can use NIX_OTHER_STORES to set it up
<Svarog> Oh ok.
<Svarog> Where can I find out more about NIX_OTHER_STORES and how to set that up?
<Svarog> I am guessing looking through Nix code. Which is fine, I was just hoping there was something more describing how it's supposed to work.
<Svarog> Oh.
<clever> i think thats unrelated
<joko> clever: maybe that helped the output limit, currently the build is "Scheduled to be built" :/
* joko goes for lunch
<Svarog> Ah right, that's exactly the problem I'm having.
xadi has quit [(Quit: Leaving.)]
<clever> that user had mis-spelled the option, check the next message
xadi has joined #nixos
<Svarog> Yes, the reply says the user running the build has to be a root user or one of the trusted users. That might be my problem.
<Svarog> I was doing a nix-build as a normal user.
<clever> that implies signing isnt working
<clever> only root and other trusted users can import unsigned things
<Svarog> I don't know yet - need to add the user as a trusted user, according to the reply.
<Svarog> Oh.
<Svarog> Hmm
<Svarog> I see what you mean.
<Svarog> Although now I'm more confused. The other day when I was trying to get nix-serve to work, even with a root user I couldn't get it to download anything that was unsigned.
<clever> you also need to trust the public half of the key in nix.conf
carlosda1 has joined #nixos
<clever> Svarog: 2 different ways of doing it: https://gist.github.com/cleverca22/3a5cbf36d23070c046091ed40125478d
<Svarog> I think I have that set up. That's what the nix.sshServe.keys setting is for, right?
<clever> nix.sshServe.keys is for the PRIVATE key on the server
aminechikhaoui has joined #nixos
<clever> you also need to configure the PUBLIC key on the client
<clever> oh wait no
<Svarog> And I also added nix.extraOptions, secret-key-files, pointing to the nix store signing key like you said
<clever> nix.extraConfig = '' secret something''; is the private keys
<NixOS_GitHub> [nixpkgs] armijnhemel opened pull request #25107: guvcview: 2.0.4 -> 2.0.5 (master...guvcview) https://git.io/v9UhO
<clever> nix.sshServe.keys is the SSH PUBLIC to let them to get in
xadi has quit [(Quit: Leaving.)]
<clever> the client also needs some nix PUBLIC keys, to trust what is signed
<Svarog> yes
<clever> that is what my last gist does
<Svarog> nix.sshServe.keys has the public keys for the users allowed to connect
<clever> there are 3 different keypairs at play here
<Svarog> oh
<Svarog> sshServe.keys is for the private keys??
<Svarog> Ok
<clever> the first key to come into play, is the ssh server pair, the public lands in ~/.ssh/known-hosts and this pair prevents mitm (so you dont connect to a fake server)
<clever> the 2nd keypair to come into play, is the ssh auth keys (from ssh-keygen, and ~/.ssh/id_rsa), the public must go into nix.sshServe.keys to let you login on sshd
<Svarog> oh
<clever> the 3rd keypair, is the nix signing keys, the secret must go into nix.extraOptions, secret-key-files on the server, and the public must go into binary-cache-public-keys on the client
carlosda1 has quit [(Ping timeout: 260 seconds)]
<clever> nix-serve just skips the 1st and 2nd pair, and runs purely on the 3rd pair alone
dbmikus has joined #nixos
<Svarog> Hmm. Thanks for that. I'll try that!
<clever> but nix-serve behind an nginx reverse-proxy with https:// may add another keypair into the mix
<clever> https://cache.nixos.org is an example of that, the server has 2 keypairs
<clever> one for the https, and one for the pre-signed data on-disk, that it serves
<Svarog> So do I need a fourth key pair?
<clever> nope
<Svarog> Ok
<clever> you will either have 1 (nix-serve over http), 2 (nix-serve over https), or 3 (sshServe over sshd)
<clever> and for the sshServe case, the server has 2 keys, and the client has 1 key
<Svarog> How would I check to see if the connection is working, once it's set up?
<clever> and all parties need to trust the public of the other party
<clever> you can test 2 of the keys by just trying to ssh into the box
betaboon has joined #nixos
betaboon has quit [(Changing host)]
betaboon has joined #nixos
<clever> ssh nix-ssh@server
<clever> and then look at the error
<Svarog> Ah right.
dbmikus has quit [(Ping timeout: 260 seconds)]
<betaboon> hello everyone, can anyone point me into the right direction on the following problem: i need a systemd-service (for oneshot init of a packages statedirectory) to start AFTER the network is realy reachable (for tcp-database-access), but since I'm new to systemd i can't seem to figure out what I'm doing wrong. using 'after' 'network-online.target' doesn't seem to be sufficient. any thoughs or pointers here ?
cpennington has joined #nixos
<NixOS_GitHub> [nixpkgs] amiloradovsky opened pull request #25109: planner: 0.14.6 -> 20170422 (master...planner) https://git.io/v9Uhr
xadi has joined #nixos
hyphon81 has joined #nixos
<hyphon81> Hello.
xadi has quit [(Quit: Leaving.)]
<hyphon81> I built Hydra server in Tokyo Japan. https://hydra.nixos.tokyo/
<clever> nice
<hyphon81> Actually, I don't know detail how to use hydra. At the moment, I just check my code whether it pass to build.
<clever> hyphon81: what else do you want to do with it?
<Svarog> ssh nix-ssh@server returns PTY allocation request failed on channel 0 - seems that has something to do with nix-ssh user not having access to pseudo terminals
<clever> Svarog: ok, now try ssh nix-ssh@server "nix-store --serve"
<clever> Svarog: it sounds like those 2 keys are working
chakerbenhamed has joined #nixos
<Svarog> There is no error or any kind of message, looks like nix-serve is running.
<Svarog> err
<Svarog> nix-store
<clever> yeah, now try using nix-copy-closure --from nix-ssh@server -sign /nix/store/something
<Svarog> seems to have worked - well.. didn't copy anything cause everything is up to date but there was no error
<clever> Svarog: try finding something you dont have yet
<clever> Svarog: or use nix-store --delete to get rid of something, then copy --from it again
<Svarog> ok
<hyphon81> clever: Hmm, I don't know it very much. I wish it will be useful for downloading nix packages from Tokyo with ipfs?
<clever> hyphon81: one issue right now with running binary caches, is that they have to re-sign the data, and then users need to trust your keypair
<clever> hyphon81: you cant just forward the nixos.org signature and proove it is un-modified
<clever> hyphon81: i have also looked into using ipfs as a binary cache, and the issue is how do you map /nix/store/jl72gxms9rg3czv3wj1rskw6n0h3k6gm-hello-2.10 to an IPFS hash?
<clever> hyphon81: currently, it just maps to https://cache.nixos.org/jl72gxms9rg3czv3wj1rskw6n0h3k6gm.narinfo
wkennington has quit [(Remote host closed the connection)]
leat has quit [(Ping timeout: 255 seconds)]
kampfschlaefer has quit [(Ping timeout: 255 seconds)]
betaboon has quit [(Quit: This computer has gone to sleep)]
griff_ has joined #nixos
betaboon has joined #nixos
<Svarog> Which user should own the signing keys? I previously had nix-serve:root as the owner.
<clever> Svarog: root:root i think
<clever> Svarog: the signing will be done by nix-daemon
vaibhavsagar has quit [(Ping timeout: 240 seconds)]
* clever heads outside
<hyphon81> clever: Hmm, sorry, I didn't think it well. I'm just thinking the downloading nix packages from Tokyo is bit slow.... I heard at the Tokyo NixOS meetup, the nix store will use ipfs in the future, and, however there are some problems such as security. My knowlege is just a bit.
<Svarog> Ok so I just deleted something from one of the stores and after some fiddling with the keys (for some reason the signing key was ignored and was defaulting to /etc/nix/signing-key.sec which didn't exist), and now when doing a nix-copy-closure I get unexpected end of file.
<clever> hyphon81: the existing signing stuff can be improved to ensure you only ever get trusted code
<clever> hyphon81: oh, and there is a secondary problem with ipfs, if you share what you currently have, you are broadcasting to the world, "i have version x of program y"
<clever> hyphon81: and then somebody can look up any exploits for that version, and even test it, because nix lets them get an exact copy of it
<clever> hyphon81: and because of how ipfs works, i dont even have to portscan to find out who has an old version of y
leat has joined #nixos
<clever> hyphon81: i can just ask the ipfs network who has build z?, and i get a list of IP's i can freely exploit
<clever> hyphon81: heading out now, i'll be back in about 1 or 2 hours
<hyphon81> clever: OK, thanks!
newhoggy has joined #nixos
carlosda1 has joined #nixos
bennylb has joined #nixos
<NixOS_GitHub> [nixpkgs] iSma opened pull request #25110: Add Elantech ETPS/2 Trackpoint (ThinkPad Yoga 260) (master...fix/trackpoint-scrolling-etps-elantech) https://git.io/v9TeI
bennofs has joined #nixos
<bennylb> Am I the only on?
<hyphon81> Hello
<joko> Hey
<bennylb> Hey all
carlosda1 has quit [(Ping timeout: 245 seconds)]
xadi has joined #nixos
Filystyn has joined #nixos
<bennylb> So things have gotten a little quieter on channels/nixos-unstable after the release of 17.03
aminechikhaoui has quit [(Quit: leaving)]
<gchristensen> unstable sees a flurry before a stable branch
<bennylb> Being a noob I caught on to that gradually
<gchristensen> :) I think it is a good thing
<gchristensen> holy crap, we package RequestTracker :o
<hyphon81> If I will use NixOS's logo, who can give me authorization or can not? I built Hydra server at Japan, and I wondering to make a fan site for NixOS in Japan. So, I would like to use NixOS logo.
<NixOS_GitHub> [nixpkgs] bachp opened pull request #25111: Gitlab runner update (master...gitlab-runner-update) https://git.io/v9Tve
<NixOS_GitHub> [nixpkgs] vcunat pushed 2 new commits to release-17.03: https://git.io/v9Tvf
<NixOS_GitHub> nixpkgs/release-17.03 b294c8a Vladimír Čunát: nss: 3.28.3 -> 3.30 (close #24508)...
<NixOS_GitHub> nixpkgs/release-17.03 c99757b Vladimír Čunát: Merge #25043: firefox-{bin,esr}: critical security...
simukis__ has joined #nixos
vaibhavsagar has joined #nixos
<sphalerite> hyphon81: I am not a lawyer, but https://github.com/NixOS/nixos-homepage/blob/master/logo/COPYING suggests that you're free to use it
<sphalerite> There may be trademark requirements on top of the copyright, but I don't see anything to that effect
<bennylb> sphalerite: Haa good find
<hodapp> if putting "foo ? null" in a derivation's parameters still leads to foo being present by default (even if it's optional), does a way exist of having it be null by default?
newhoggy has quit [(Remote host closed the connection)]
<hyphon81> sphalerite: Thanks!
<sphalerite> hodapp: what do you mean?
griff_ has quit [(Quit: griff_)]
<sphalerite> I presume you mean a function, not a parameter?
<sphalerite> s/parameter/derivation/
<hodapp> sphalerite: I suppose it is technically a function, but what I'm observing is how it behaves in context in nixpkgs
<hyphon81> For example, there are strict guidline for using OpenStack logo. https://www.openstack.org/brand
<hodapp> perhaps it's because I'm not running with --pure
thebored has quit [(Ping timeout: 255 seconds)]
<hodapp> but, for instance, I added "sqlite ? null" to gdal, and then gdal's build magically started finding sqlite without anything being overridden
proteusguy has joined #nixos
derjohn_mob has quit [(Ping timeout: 240 seconds)]
FrozenCow has joined #nixos
<sphalerite> hodapp: The thing that you have in the file is a function. The derivation is the result of calling it, and that happens in pkgs/top-level/all-packages.nix or similar
<sphalerite> hodapp: so what you want to do is either put sqlite = null; in the set that the package function is called with
betaboon has quit [(Quit: This computer has gone to sleep)]
ambro718 has quit [(Remote host closed the connection)]
FrozenCow has quit [(Remote host closed the connection)]
newhoggy has joined #nixos
<hodapp> either that, or?
<hodapp> if I'm just passing in 'null' explicitly, then why does it even require "? null"?
<hodapp> and if null is the default value, then why must I pass it in explicitly?
<Guest75137> Can someone take a look at this PR and merge it if mergeable: https://github.com/NixOS/nixpkgs/pull/15353
<clever> gchristensen: did you hear of the sddm issue from yesterday?
thebored has joined #nixos
<bennofs> clever: have you seenhttps://github.com/NixOS/nixpkgs/issues/25068?
dbmikus has joined #nixos
<hodapp> part of the confusion is because the only example of this in context that I see is https://nixos.org/nix/manual/#idm140737318041088 and it's not really explained there
<clever> bennofs: ah, that looks like it
<hodapp> yet docs are telling me that what I'm writing means that "null" is the default value in this function
mudri has joined #nixos
<bennofs> hodapp: it may be that callPackage ignores ? null
<bennofs> hodapp: try something like callPackage ./...../your-pkg { sqlite = null; }
<hodapp> bennofs: I'm not trying to build without sqlite, I'm trying to make sqlite optional but disabled by default
<bennofs> hodapp: that's what that callPackage does
<hodapp> then why would I have to pass in sqlite = null explicitly?
<hodapp> oh, nevermind
<hodapp> I see you wrote 'that callPackage', not just 'callPackage'
<clever> hodapp: another option is to add a withSqlite ? false argument, and then override it to true later
<clever> then a callPackage with {} works
<jophish> Dezgeg[m]: I shouldn't have started speaking in #linux about patching uname. It's turned into a real shitshow
dbmikus has quit [(Ping timeout: 255 seconds)]
<hodapp> ugh, I should just ignore everything that was written in the comment on one PR where I wanted postgresql support to be optional and disabled by default, and someone recommended that I just replace with "postgresql ? null" and didn't say anything else
<hodapp> clever: does one method or another seem to be preferred more?
<clever> jophish: there is some stuff already in the kernel that can fake part of the uname data, and nix is using it
<Dezgeg> how so? :P
<bennofs> clever, hodapp: yeah the code does auto = builtins.intersectAttrs (builtins.functionArgs f) autoArgs;
<joepie91> hyphon81: fwiw, the "brand guidelines" that projects/companies have tend to be stricter than is even allowed by laws in many jurisdictions... for example, if there's no risk of confusion (ie. it's very clear that your site isn't an official site for $thing), you may use other people's brands to indicate the topic, compatibility, or whatever
<hodapp> joepie91: #linux or ##linux?
xadi has quit [(Remote host closed the connection)]
<jophish> clever: yeah, it doesn't work for armv7 on aarch64
<bennofs> clever, hodapp: builtins.functionArgs does not care if you write sqlite or sqlite ? null
<hodapp> bennofs: not sure what that "yeah" is in regards to
<jophish> I've patched uname to always return "armv7l" for an armv7l build
<jophish> It's working very well for me
<joepie91> hyphon81: dependent on jurisdiction ofc, but for example I'm completely free to build an online shop with a "Bose" logo in the header, so long as it's clear that that's just a brand I'm selling, and I'm not *representing* Bose... no matter what Bose says about brand guidelines
<bennofs> hodapp: i meant that callPackage will set sqlite, no matter if there is a default or not
<clever> bennofs: i think functionArgs returns a set of <argname> = <bool>;, with the bool saying if it has a default or not
<joepie91> hyphon81: so generally, just make it very clear that your site is not official and you will be fine :)
<clever> bennofs: but the intersectAttrs drops the bool's
<hodapp> sorry, that was to jophish, not joepie91 ^
<hodapp> bennofs: okay, I see
<clever> jophish: ah, that sounds very similiar to the nix code i have in mind
carlosda1 has joined #nixos
<hodapp> I'm still not sure then why "postgresql ? null" was recommended, though in that case there were multiple possible postgresql packages that could have been used
xadi has joined #nixos
<hodapp> whereas only one sqlite I'm aware of
<clever> jophish: this makes uname lie about 64/32bit support, so a 32bit build cant see 64bit support
<clever> jophish: i have also wanted to have an armv6l variant, because some packages put v7 opcodes into a v6 package, and poison the hydra
<jophish> clever: I was looking at that yesterday, can't be done for arm :(
<clever> jophish: the api around uname and personality would need to be modified to add arm support
<bennylb> Listed under https://nixos.org/nixpkgs/manual/#sec-tools-of-stdenv are tools provided by stdenv. During the configure phase are there any additional tools such as autotools available in the environment or do we explicitly add to nativeBuildInputs?
Filystyn has quit [(Remote host closed the connection)]
<clever> bennofs: you have to add them, and every phase runs in the same env
<clever> bennofs: there is also a package for exactly what your wanting to do
<bennofs> clever: meant bennylb probably ?
<clever> bennylb: if you add autoreconfHook to the nativeBuildInputs, it will run autoreconf for you
griff_ has joined #nixos
carlosda1 has quit [(Ping timeout: 240 seconds)]
<jophish> hodapp: ##linux
<jophish> sorry, missed taht
<hodapp> jophish: that channel is kind of a shitshow no matter what, to be fair
<bennylb> bennofs: clever: Ahh ok got it
newhoggy has quit [(Remote host closed the connection)]
<hodapp> soooo many ops who think they are the New Sheriff in Town
bennofs1 has joined #nixos
<unlmtd[m]> instead of doing customRC = '' stuff '', can I somehow import a non-nix file there?
<clever> unlmtd[m]: customRC = builtins.readFile ./foo.txt;
<unlmtd[m]> clever: thanks, you rick
<unlmtd[m]> lol rock*
cpennington has quit [(Remote host closed the connection)]
<unlmtd[m]> im still not perfect but I highly recommend switching keyboard layout to colemak. thats how typing should always have felt
iyzsong-x has quit [(Ping timeout: 240 seconds)]
seanz1 has quit [(Quit: Leaving.)]
iyzsong has joined #nixos
newhoggy has joined #nixos
<jophish> clever: If you're interested, here's what I've had to do. I'm currently building the bootstrap tarball https://github.com/expipiplus1/nixpkgs/commit/17c8652edbe164457e763d37cdaea03cd7251f91
<hyphon81> joepie91: OK.
<jophish> I'm building the bootstrap tarball for the second time natively (the first time was with a cross build bootstrap tarball) I'm hoping that this will result in the same hash
newhoggy has quit [(Ping timeout: 260 seconds)]
<jophish> It's going very smoothly so far, although I don't know what aspects of linux's personalities I'm not replicating
<jophish> hopefully it's just the uname patch and nothing interrogates the kernel directly
<clever> jophish: ah, looks like your patching it within coreutils
<clever> jophish: the LFS guides have done similiar, by wrapping coreutils with a script that just applies sed
<clever> but that will obviously miss anything using the uname syscall directly
<clever> and armv6 support is missing, it would need a 2nd patch
<clever> jophish: oh, and that build.cc patch for nix, i have something very similiar, https://github.com/cleverca22/nix-misc/blob/master/upgrade.patch
<jophish> yeah, that was an inspiration :)
<clever> jophish: my variant will make it a nix.conf entry, so you can change it after building
<jophish> I should have used that directly perhaps
<clever> jophish: gchristensen mentioned that the aarch64 build slaves for hydra dont have v6 or v7 support, no ability to run 32bit code
<Yaniel> oh come on, don't tell me that windows now actively destroys data on efi partitions
<clever> jophish: so your patch would break on the aarch64 build slaves
<bennofs1> jophish: that won't affect the syscall though :/ I wonder if it's possible with systemtap to patch the syscall
<jophish> clever: yeah, I know. I'd have to find out how to detect aarch32 mode support
<unlmtd[m]> is anyone using nixos on aarch64?
<jophish> oh
<jophish> that could be in nix.conf
newhoggy has joined #nixos
<jophish> unlmtd[m]: gchristensen is
<clever> jophish: yeah, make it a runtime config, and then the admin can just set it right
<unlmtd[m]> awesome, ill have to get a rpi
<jophish> bennofs1: that's beyond my expertise :)
<jophish> clever: do you have plans to open a PR to nix with that change in?
<clever> jophish: being runtime also opens up some more portable stuff, you could make an armv6 nix build, that works on v6, v7l and aarch64, and is capable of running builds for all 3
<clever> jophish: ive been wanting to make a pr with it for ages, but keep forgetting to do it
<unlmtd[m]> was gonna get my nephew his first computer, a 64bit rpi with nixos installed would be a pretty cool first unix workstation
<gchristensen> it is not an easy time right now
<jophish> clever: Once I've got everything chugging along I'll make a PR with my changes here (modified to use your patch instead). I hope that's OK with you (credit given of course!)
<clever> jophish: i also have a nix hook i have made before, that will help with the v6/v7 stuff: https://gist.github.com/cleverca22/333cc892ee345c8ccd3b98ff73abfa52
<unlmtd[m]> ok :P
<clever> jophish: this hook will use the arm builds of binutils (x86 build doesnt work) to read the arch specific elf headers, and check for armv7 opcodes
<unlmtd[m]> hes probably better starting on void anyhow
<clever> jophish: and if configured right, it will cause an armv6 build to fail if it makes v7 opcodes
<jophish> unlmtd[m]: that's cruel. He'll never be able to use other distros if he gets hooked on nixos first!
<clever> jophish: sure :)
<unlmtd[m]> nooo thats awesome
<jophish> :P
<unlmtd[m]> push him into the future
<unlmtd[m]> fuck this imperative bullshit
<clever> :D
takle has quit [(Remote host closed the connection)]
<NixOS_GitHub> [nixpkgs] romildo opened pull request #25112: all-the-icons: init at 2.5.0 (master...new.all-the-icons) https://git.io/v9TJX
newhoggy has quit [(Ping timeout: 252 seconds)]
<jophish> clever: how is enforce-arch used?
<clever> jophish: currently, its a setup hook you have to add to the buildInputs of a package
<jophish> I've not seen makeSetupHook before
<jophish> ah ok
<clever> jophish: makeSetupHook will just copy the script to $out/nix-support/setup.sh
<clever> jophish: and the stdenv will source that if its found in the buildInputs
<clever> jophish: this is how adding cmake to the inputs causes cmake to hijack the configurePhase
<clever> anything you add to the inputs can mutate the bash variables/functions in the environment, and change how the build is done
<jophish> ah, that's very cool. I didn't know about that
<clever> the autoreconfHook i gave someone a few minutes ago is another
<clever> it runs autoreconf before doing ./configure
<clever> jophish: there are also other neat things like that just hidden all over the place and undocumented
<clever> this adds unzip to an unpackCmdHook
<clever> jophish: and the unpackPhase will try each unpackCmdHook until one works
<Yaniel> so uh, does the nixos installer have some kind of nix-chroot like the arch one
<clever> so adding unzip to buildInputs will magicaly give the unpackPhase zip support
<jophish> there should be a page on the wiki/whatever with links to all the cool little things
newhoggy has joined #nixos
<Yaniel> that I could use to get "into" my nixos and rebuild the boot loader
takle has joined #nixos
<clever> Yaniel: yeah, nixos-install --root /mnt --chroot
<clever> Yaniel: also, nixos-install by default, will just nix-build the configuration, then install the bootloader again
<clever> Yaniel: so if the channel in the installer is reasonable, you can just do that directly
<Yaniel> ah, nice
<Yaniel> umm, except, do the channels of the installer and the installation have to match?
<clever> if you use --chroot, then it will obey the channels inside the install
<clever> if you dont use --chroot, it will use the channels on the installer, and might downgrade (or upgrade) the entire os
<Yaniel> nixos-rebuild fails in the chroot :(
<Yaniel> "Error in tempdir()"
<clever> Yaniel: what args did you run it with?
<Yaniel> `nixos-rebuild boot`
<clever> Yaniel: might be simpler to just redo the bootloader without nixos-rebuild then, one sec
newhoggy has quit [(Ping timeout: 240 seconds)]
takle has quit [(Ping timeout: 240 seconds)]
<clever> Yaniel: "/run/current-system/bin/switch-to-configuration boot", and make sure /boot and any efi things are mounted correctly inside the chroot
<jophish> gchristensen: What's the nixops support like for packet.net?
<jophish> You mentioned it in your mail in January
<clever> jophish: have you seen my ideas on how to give nixops support for any datacenter that allows root and an MBR?
<gchristensen> jophish: "not good yet"
<Yaniel> clever: thanks, now it boots
<NixOS_GitHub> [nixpkgs] LnL7 pushed 1 new commit to staging: https://git.io/v9TUG
<NixOS_GitHub> nixpkgs/staging 004ecac Daiderd Jordan: perl: add patch for sw_vers on darwin...
<Yaniel> on a related note, fuck windows
<Yaniel> in the latest update it stopped changing UEFI settings and instead opted to "manage" the efi partition by itself
<clever> Yaniel: i also found that my bios totally ignored the boot priority, until i turned efi off entirely
<clever> so it refused to boot legacy linux until i just shut off efi support
<jophish> clever: I've not seen them, but I would like to!
<Yaniel> I should really make a separate efi partition for nixos
<clever> luckily, win7 still boots if you chainload the MBR, but i havent actualy booted it in over a year
<clever> jophish: this nix expression will build a tarball, that contains the entire installer env, a kernel, an initrd, and kexec
<jophish> clever: ah, I think I saw something similar maybe a year ago
<clever> jophish: you just upload it to a server, unpack the tar to /, and then /kexec_nixos
<jophish> you were doing something terribly "clever" with kexec
takle has joined #nixos
<clever> jophish: and within 2 minutes, its running nixos 100% from ram, with sshd open
<clever> you can now ssh back in, fdisk the hdd away, and install like normal
newhoggy has joined #nixos
<jophish> hmm, I wonder if I could do that on this ubuntu server
<clever> jophish: git history says i only started that in dec of last year, so its only about ~5 months old
<jophish> hmm, perhaps it was someone else
<gchristensen> jophish: which ubuntu server? on packet you can boot to nixos
joelpet has joined #nixos
joelpet has quit [(Changing host)]
joelpet has joined #nixos
<clever> jophish: i have tested it against ubuntu in virtualbox, and have directly used it on 2 ubuntu servers in a racklodge datacenter
<bennofs1> clever: that sounds a lot like NIXOS_LUSTRATE ?
<clever> another major difference between kexec, and things like nixos-in-place or pre-built images, is the partition layout and filesystem choices
<LnL> gchristensen: do you have eval powers?
<clever> bennofs1: NIXOS_LUSTRATE forces you to keep the existing filesystem layout
<gchristensen> LnL: on hydra?
<bennofs1> clever: oh ok
<LnL> yes
<gchristensen> yeah
<clever> bennofs1: i recently did NIXOS_LUSTRATE on a netbook, and now / is always out of space, because /home has a decent chunk of the disk
acowley is now known as acowley_away
takle has quit [(Ping timeout: 240 seconds)]
<LnL> can you eval staging, I fixed the perl issue
<clever> LnL: is that also likely the issue i found in 17.03?
vaibhavsagar has quit [(Ping timeout: 260 seconds)]
<LnL> what was the error again? think it might be unrelated
newhoggy has quit [(Ping timeout: 268 seconds)]
<clever> LnL: something in binutils failing while building the stdenv
<gchristensen> LnL: link?
<clever> LnL: i was able to bisect it down to a perl upgrade, so it feels related
<gchristensen> to staging ;)
<gchristensen> no, to where I click "eval" on hydra lol, I don't like navigating if I can avoid it
<LnL> oh :)
<gchristensen> done
<gchristensen> it also clears up ambiguities of which staging
eacameron has joined #nixos
<jophish> Woo, my bootstrap generation has reached a fixed point
sellout- has joined #nixos
<LnL> clever: I think perl was updated on staging and 17.03 so it's possible, I'll see if I can reproduce it
<clever> 2017-04-21 14:12:18 < clever> LnL: bisect says it was a perl update, commit 4861ab9dbea148c01f8d1c17a926046dd7aa344b
carlosda1 has joined #nixos
<LnL> yeah I remember now, but the error looks different from the one on staging so I'm not sure
<gchristensen> how can I do bash variable substitution in a configureFlag? I need to do something like "--with-web-group=$UID"
<clever> ah
<clever> gchristensen: one option ive done is preConfigure = ''configureFlags="$configureFlags --with-web-group=$UID"'';
<clever> gchristensen: the preConfigure gets evaled later on, and it just works
<clever> gchristensen: and i believe all other options rely on a program making a "mistake" and evaluating some of its arguments in bash
m` has joined #nixos
m` is now known as mojjo
<clever> which can sometimes be a security hole
<gchristensen> dirty :P
<gchristensen> thank you
<clever> gchristensen: only other option is to elevate $UID to be a nix variable
<gchristensen> probably not desirablee
takle has joined #nixos
<Svarog> clever, I managed to get unsigned nix-copy-closure to work over ssh, but signing still fails. Would you have any idea off the top of your head why I might be getting host key verification failed when using --option ssh-substituter-hosts?
carlosda1 has quit [(Ping timeout: 260 seconds)]
<clever> Svarog: the ssh client is probably running as root, try re-running the ssh test as root to populate ~/.ssh/known-hosts
<Svarog> Ah.
<mojjo> hi.. I put the following line in the config, but it has no effect after rebuilding: `environment.variables = {"XYZ" = "abc";};`, in a fresh shell `echo $XYZ` returns nothing. Does somebody know the file in `/run/current-system` where it should have been written to?
<clever> mojjo: search for it on here, then click the declared-in file: https://nixos.org/nixos/options.html#environment.vari
newhoggy has joined #nixos
<mojjo> doing this for a while now... ;-)
<spacefrogg> gchristensen: The following also works: preConfigure = ''eval "configureFlags=$configureFlags"'';
<clever> mojjo: it winds upin a derivation at system.build.setEnvironment, that contains a bit of shell code with export statements
<spacefrogg> gchristensen: This gives you the opportunity to just assign the configureFlags as normal put an evaluation step at the end to "do the neccessary things".
takle has quit [(Ping timeout: 240 seconds)]
<clever> mojjo: bash then embeds that into its own shellInit config
<clever> mojjo: which eventualy lands in /etc/profile
GiGa|Laptop has joined #nixos
<Svarog> That seems to have done it. Thanks again :)
<GiGa|Laptop> Hello all
<GiGa|Laptop> I upgraded to 17.03 yesterday but on boot it crashes at the login terminal - doesn't seem to load X
<clever> GiGa|Laptop: one secibd
<mojjo> clever: ok, thanks for the walkthrough.. my definition did not land in /run/curr.../etc/profile.. I assume it might be bash related...
newhoggy has quit [(Ping timeout: 240 seconds)]
<gchristensen> is there a package that uses a sort of perl wrapper I can use, in my effort to make RequestTracker work? rt doesn't have a Makefile.PL
<clever> GiGa|Laptop: a recent change broke every display manager except sddm
<clever> gchristensen: oh god, that mess, lol
<bennofs1> gchristensen: you mean like perlWithPackages?
<clever> gchristensen: it took me about 12 hours to get that to work on ubuntu, lol
<gchristensen> yeah that sort of thing, bennofs1
<gchristensen> clever: :|
<bennofs1> gchristensen: I believe just buildEnv may work for this? not sure
takle has joined #nixos
<clever> gchristensen: it has a shell script in the root that will tell you what perl packages are missing, but the apt package name isnt always obvious, and i had to cpan at least a dozen modules
<bennofs1> gchristensen: didn't hydra use something like that?
<GiGa|Laptop> clever, not sure that's quite identical. I don't even get a display manager load and the system is hung (I can't even login at the terminal)
<GiGa|Laptop> clever: Although most of it fits
<clever> GiGa|Laptop: ah, that might be different, are you able to boot an older nixos via grub and then inspect the journal?
roconnor has joined #nixos
newhoggy has joined #nixos
takle has quit [(Ping timeout: 260 seconds)]
<GiGa|Laptop> clever: yep, I'm booted now. Looking for the logs but I've not done much troubleshooting with SystemD
<clever> GiGa|Laptop: "journalctl -b -1" will show the entire log from the previous boot until shutdown
<clever> GiGa|Laptop: then search thru that for things related to display-manager
newhoggy has quit [(Ping timeout: 252 seconds)]
<clever> GiGa|Laptop: or just "journalctl -b -1 | gist -p" to send the whole thing to a gist
drasich has quit [(Ping timeout: 258 seconds)]
<mojjo> clever: got it, I mixed up shellInit with interactiveShellInit
betaboon has joined #nixos
betaboon has quit [(Changing host)]
betaboon has joined #nixos
<GiGa|Laptop> clever: that journal only seems to have 1 second's worth of stuff in it
<clever> GiGa|Laptop: thats odd, how far along does the boot seem to get when you watch it?
<clever> mojjo: it looks like bash will put both of those into /etc/profile
<GiGa|Laptop> All the way up to where you'd expect to switch from text mode / TTY to GDM
<clever> mojjo: and an extra copy of the interactive in /etc/bashrc
<clever> GiGa|Laptop: did you click the power button once to recover it?, or hold the power button?
<GiGa|Laptop> clever: held
<GiGa|Laptop> never come across pressing once to recover it
<clever> GiGa|Laptop: try booting it back up, and then see if hdd activity starts when you just click the power button, it may still be able to do a clean shutdown
<GiGa|Laptop> I can reboot and try that
<clever> depends on how badly its locked up
<GiGa|Laptop> understood, be right back
GiGa|Laptop has quit [(Quit: Leaving)]
nicknovitski has joined #nixos
kampfschlaefer has joined #nixos
takle has joined #nixos
dmi3y has joined #nixos
mekeor has joined #nixos
<mojjo> clever: Actually, I see it's not quite working yet. ` environment.variables = {"A" = "1";}; programs.bash.shellInit = ''export B=2;'';` Considering the lines you pointed to, those two should behave the same. but I see only the second in /etc/profile
faffolter has quit [(Remote host closed the connection)]
takle has quit [(Ping timeout: 258 seconds)]
dmi3y has quit [(Ping timeout: 268 seconds)]
takle has joined #nixos
<clever> mojjo: checking some things...
sellout- has quit [(Quit: Leaving.)]
<mojjo> clever: ah, no.. there is cfg and cfge, i mixed them up
<clever> mojjo: yeah, some things are missing...
takle has quit [(Ping timeout: 260 seconds)]
<clever> mojjo: oh right, the 4 pixel glyph, lol
GiGa has joined #nixos
GiGa has quit [(Changing host)]
GiGa has joined #nixos
<clever> mojjo: its not embeding the A into profile, its sourcing a path
durham has joined #nixos
<clever> mojjo: updated the gist
dbmikus has joined #nixos
FRidh has joined #nixos
<clever> mojjo: yep, i can track down all 6 variable assignments
<GiGa> clever: OK, pressing the power button does nothing, no HDD activity either. I can't even use magic sysrq to reboot the box - it's totally hung. Network scan shows it isn't online either
<GiGa> I'll try switching to SDDM to see if that helps
<clever> GiGa: ah, sounds more like a video driver problem then, something the driver/GPU is doing breaks the entire system
<mojjo> clever: yeah, I can follow this. set-enviroment is included in /etc/profiles, and so it works!
newhoggy has joined #nixos
<GiGa> clever: oh dear, not again. This is using bumblbee
<gchristensen> clever: I'm finding it is probably not feasible to use rt on nixos via nix
dbmikus has quit [(Ping timeout: 240 seconds)]
<clever> gchristensen: i have thought that writting a nix expression would solve that entire mess for good, but have just not gotten around to it
GiGa|Laptop has joined #nixos
takle has joined #nixos
newhoggy has quit [(Ping timeout: 240 seconds)]
<jophish> Hmm, Now to figure out how to bootstrap GHC on aarch64 and armv7l
<GiGa|Laptop> Clever: I'll disable Bumblebee and force use of the intel card, see if it makes a difference
<clever> GiGa|Laptop: kk
<clever> jophish: i think all of the existing stuff in nixpkgs relies on downloading a pre-built ghc
GiGa|Laptop has quit [(Remote host closed the connection)]
<NixOS_GitHub> [nixpkgs] joachifm pushed 1 new commit to master: https://git.io/v9Tkj
<NixOS_GitHub> nixpkgs/master 9e6c96f Joachim Fasting: grsecurity: 4.9.24-201704210851 -> 4.9.24-2201704220732
aneeshusa has joined #nixos
<NixOS_GitHub> [nixpkgs] vcunat pushed 1 new commit to master: https://git.io/v9TIe
<NixOS_GitHub> nixpkgs/master b72d4e1 Vladimír Čunát: kdiff3: fixup patch hash after #25059...
takle has quit [(Ping timeout: 240 seconds)]
<NixOS_GitHub> [nixpkgs] vcunat pushed 1 new commit to release-17.03: https://git.io/v9TIU
<NixOS_GitHub> nixpkgs/release-17.03 4fe9cf7 Vladimír Čunát: kdiff3: fixup patch hash after #25059...
aneeshusa has quit [(Client Quit)]
<jophish> clever: yeah, there doesn't seem to be support for booting from a cross compiled stage1
<jophish> There is an armv7 binary for 8.0.2
<GiGa> Clever: looks like it's a problem with the bumblebee interaction
<clever> GiGa: ah
<GiGa> I take that bacj
<GiGa> I now get GDM, and can login
<GiGa> but then the system hangs again. I suppose that could be the problem you mentioned earlier of course
<clever> the problem i mentioned results in the display manager quiting to the text console
<clever> then systemd restarts the DM
eacameron has quit [(Remote host closed the connection)]
<jophish> clever: yeah, no love for aarch64 though. I think if I'm to get this working it would be best to set up a cross compiler to do it
<jophish> I already have an expression for an x86_64 -> armv7 cross compiler.
<jophish> I think that might have been added to nixpkgs too recently, I can't remember
<GiGa> OK, not an identical problem then. I'll have a bit more of a play around later
<GiGa> Got my daughter wanting to play with cars
xadi has quit [(Quit: Leaving.)]
xadi has joined #nixos
GiGa has quit [(Quit: Leaving)]
xadi has quit [(Client Quit)]
derjohn_mob has joined #nixos
marsel has joined #nixos
carlosda1 has joined #nixos
takle has joined #nixos
bennylb has quit [(Quit: rcirc on GNU Emacs 25.1.1)]
carlosda1 has quit [(Ping timeout: 260 seconds)]
<mog> my acme certs expired , and the systemctl says that the processes are active but still waiting to trigger
<mog> is there a way i can force it
<clever> mojjo: its possible that it already renewed, but nginx didnt reload, what happens if you manualy restart nginx?
<mog> i just restarted httpd and still getting error
<gchristensen> through force and hackery, I got rt working...! not good enough to send upstream, but it runs...
<mog> all the files havent been touched since jan 22
<mog> so it clearly is just not running or when it ran it had an error
<mog> i dont see anything in journal though
newhoggy has joined #nixos
kahiru has quit [(Ping timeout: 240 seconds)]
iyzsong has quit [(Ping timeout: 260 seconds)]
newhoggy has quit [(Ping timeout: 252 seconds)]
<mog> running simp_le by hand fixed problem
<clever> mog: which channel are you on?
<NixOS_GitHub> [nixpkgs] Hodapp87 opened pull request #25114: gdal: Add optional SQLite & Spatialite support (master...gdal_sqlite) https://git.io/v9TIh
kahiru has joined #nixos
eacameron has joined #nixos
<sphalerite> I'm having some difficulty compiling a piece of software because g++ doesn't like its use of printf https://paste.debian.net/928859/ . I tried adding -Wno-error=format-security to the compiler flags but it's still happening. Anyone have an idea of what this could be? I suspect that this is a nixpkgs-specific issue because I haven't seen any other people complaining about it
khebbie has quit [(Ping timeout: 245 seconds)]
<clever> sphalerite: you want hardeningDisable="format"; in the derivation
<sphalerite> aah right, awesome, thanks.
sellout- has joined #nixos
<NixOS_GitHub> [nixpkgs] joachifm pushed 1 new commit to master: https://git.io/v9TLL
<NixOS_GitHub> nixpkgs/master 5f9096a Richard Szibele: curlcpp: 20160901 -> 1.0 (#25104)
Guest75137 has quit [(Ping timeout: 245 seconds)]
<sphalerite> clever: yep that fixed it, thanks again
puffnfresh has quit [(Quit: http://brianmckenna.org/)]
ambro718 has joined #nixos
bennofs has quit [(Quit: WeeChat 1.7)]
newhoggy has joined #nixos
davidak has joined #nixos
<sphalerite> how do people using nixops manage state, e.g. database contents?
<sphalerite> I presume the answer is nixops ssh + putting stuff in place manually?
<sphalerite> For example, I want to migrate a mumble server from a really crappy docker container setup to a nixops-managed server. Would I just copy over /var/lib/mumble-server manually?
<clever> sphalerite: my plans are to modify the application so it can push/pull state backups from a central location
<simpson> sphalerite: I simply keep the DB up and trust my upstream vendors to not make it hard to roll forward. It's easier for me since I can lose any one node and still stay up.
<clever> then i can just sign into a gui over http, pick a recent backup, and click restore
<simpson> (Technically I can lose like any seven nodes, globally, and still stay 100% up.)
<clever> sphalerite: in the case of mumble, yeah, i would just manualy copy it over
puffnfresh has joined #nixos
<clever> sphalerite: stop the mumble daemon, delete the new dir it made, copy things over, and start it back up
<sphalerite> right
<LnL> clever: perl was updated to 5.22.3 for 17.03 while it's 5.24.1 on staging
<sphalerite> the previous advice sounds like it's on a bit of a different level than what I'm doing, this is just for personal use and on a small budget :D
stepcut has quit [(Remote host closed the connection)]
<clever> LnL: ah, so its still older
newhoggy has quit [(Ping timeout: 258 seconds)]
<LnL> that's why the error is different, my staging fix won't help with that
<clever> sphalerite: yeah, its more for software i'm writting, and i'm building all of the new changes around nix and nixops
<clever> LnL: 17.03 darwin isnt that important, so we can just ignore it
dmi3y has joined #nixos
<LnL> yeah, there's nothing on hydra built with perl 5.22.3 so it's not very useful
<sphalerite> clever: it's definitely what I'd do if I were writing any big important production software :D
<sphalerite> Although, what would you recommend for small-scale backup of data like that?
<sphalerite> Pretty much anything would be better than what I have now, which is nothing >_>
<clever> sphalerite: zfs snapshots if you want local archives of changes
<clever> maybe zfs send if you want offset copies
<sphalerite> Sounds good, I'll give all that a shot. Thanks!
<clever> offsite*
<eacameron> Anyone worked with Habitat?
<eacameron> It looks like it has a lot of overlap with Nix
<joepie91> eacameron: link? not the most googleable thing :)
<eacameron> joepie91: Sorry. ;) https://www.habitat.sh/
<eacameron> It's from Chef
<joepie91> eacameron: I'm not immediately spotting anything that overlaps with Nix, from a technical perspective
<joepie91> it just seems like Yet Another Docker Management Thing to me
dmi3y has quit [(Quit: dmi3y)]
<joepie91> except for what looks like limited declarative config capabilities
<eacameron> joepie91: It has immutable packages that are defined with templating system. It handles package management too.
<joepie91> eacameron: hm, this isn't clear from the site at all
<eacameron> joepie91: Yah...it's not.
<joepie91> eacameron: reading the site I get the impression that what they call a "package" is just "a disk image"
<eacameron> joepie91: That could be
<eacameron> joepie91: I've not actually worked with it.
<joepie91> which is very different from how Nix works
<joepie91> right
<joepie91> eacameron: anyway, based on what the site says - which may not be the most accurate, but that's what I have to go off from - it looks to me like yet another thing that builds on inherently stateful systems
<joepie91> as opposed to reorganizing things to not be stateful
<sphalerite> I see all these horrible things all the time. And every one makes me gladder that I can use NixOS.
<joepie91> eacameron: the issue is described here: http://gfxmonk.net/2015/01/03/nixos-and-stateless-deployment.html
<dmj`> As a general rule, the better looking the website, the inferior the tool
<joepie91> that, too :)
<eacameron> dmj`: Or if it's from Chef
<eacameron> dmj`: Aren't you at DockerCon now?
<dmj`> css3 transitions on the home page are inversely proportional to the amount of complexity the tool will allow to be managed
<dmj`> eacameron: no, it’s over
<joepie91> dmj`: you might enjoy http://www.tylervigen.com/
<joepie91> :)
<dmj`> eacameron: they brought up NixOS at DockerCon though
<eacameron> So how does Nix and Docker go together?
<dmj`> eacameron: services.docker.enable = true;
<dmj`> heh
<joepie91> I would personally say "NixOS removes the need for Docker", but people do seem to be using the two together
<dmj`> you can have nixos running docker containers that have nixos, running docker containers, etc.
<FRidh> LnL: you know how to fix it on staging, or should we let darwin use the older version of perl for now? (which is I think ugly to do)
<dmj`> eacameron: ^
<LnL> FRidh: I fixed it :)
<FRidh> LnL: ok, great :)
<joepie91> dmj`: hrm, one of the three does not quite belong... :P
<LnL> I'll close it when the stdenv is finished building
<dmj`> joepie91: hehe :)
<clever> dmj`: i can also see how not-os could be tweaked a bit to make a ~40mb docker container
<eacameron> dmj`: Sick
<clever> dmj`: that would combine bullet points 1 and 3
<eacameron> joepie91: Awesome link LOL
<joepie91> eacameron: which? the stateless deployment or the spurious correlations one? :P
<eacameron> joepie91: Spurious correlations...but the other looks juicy
<joepie91> hehe
<eacameron> So NixOS is awesome, granted, but what if I really do want a "micro-service" arch where I can fire up many instances of an app at the push of a button. It seems containerization is good for that.
<FRidh> LnL: if I am correct you've been working with the stdenv. What do you think is a good place to have an attribute that returns the extension of a shared library for the current arch? So .so on linux and .dylib on darwin? Its very trivial but useful to have when with Python we have to patch paths to libraries.
<joepie91> eacameron: see nixops / disnix
<simpson> eacameron: You probably don't want them all fired up near each other, so you need orchestration as well.
<eacameron> joepie91: I use Nixops already actually. It's great. But it's still creating full blown VMs
derjohn_mob has quit [(Ping timeout: 260 seconds)]
<joepie91> eacameron: doesn't necessarily.
<joepie91> it's fairly agnostic to the type of instance it creates
<joepie91> plus there's already declarative containers for less involved scenarios if you really need containers
<eacameron> joepie91: Can nixops deploy containers instead?
<joepie91> but I feel that 'containers' are massively overused
<eacameron> ekleog: Yah I mean you can manage containers on your NixOS instances manually.
<joepie91> eacameron: theoretically could, sure. in practice, I question whether there's a reason to do so given NixOS' declarative container support, and if you want it to, you might have to add a provider plugin for it yourself
sellout- has quit [(Quit: Leaving.)]
<simpson> eacameron: Honestly, I would *love* for somebody to add a container abstraction to nixops, so that containers on AWS or GCE were easier.
<joepie91> there's nothing that architecturally prevents you from doing it
<simpson> joepie91: There's an easy answer for "why", which is that the cloud providers have container subsystems now.
<joepie91> eacameron: but whenever anybody asks me "how do I <something about micro-services or containers>?", my first response is "consider very carefully whether what you're trying to do is actually desirable", because in the vast majority of cases I've seen it's not :)
<eacameron> simpson: joepie91: Yah I think that's what I'm getting at. I'd love to use something like AWS to manage the containers for me. I just want them running Nixos
<simpson> eacameron: Ah, well, you can't.
<simpson> Because putting systemd in a container is not really a thing AFAIK.
<eacameron> simpson: Oh I see...
<joepie91> hm, hold on
<joepie91> eacameron: I'm not sure I follow what you're trying to do
<joepie91> eacameron: NixOps already has AWS support, so what's the difference between what it does and what you want exactly?
<eacameron> joepie91: I'm not actually trying...haha...by brother in law is in love with containers and I'm in love with NixOS. I'm trying to figure out how they are related and if you can use both.
<joepie91> eacameron: I'd say that in 99.9% of cases, NixOS removes the need for containers
<simpson> joepie91: nixops currently can't do Elastic Containers on AWS or Container Engine on GCE.
<joepie91> eacameron: in the remaining 0.1% of cases, you probably just need local declarative containers, as opposed to container orchestration stuff
<simpson> joepie91: It's orthogonal. Containers are cheaper than VMs. Not by much, but maybe by enough to make it worthwhile.
<clever> eacameron: the only time i ever need a container, is when a service will collide with itself (fighting over a port or unix socket), and i need 2 instances of it running
<joepie91> I'm not counting invalid usecases here, like people building totally unnecessary complex microservice architectures :)
<clever> eacameron: or when i want to give potentialy untrust-worthy code shell access
<simpson> joepie91: I do microservices on VMs. Containers are orthogonal to that concern, just like they're orthogonal to the security concerns.
<dmj`> yea, also, docker is now called Moby, and everything is about linuxkit now, which isn’t in the moby or docker github groups
<eacameron> clever: joepie91: Interesting. So you think containers are a way of managing state, which nix handles better anyway?
<joepie91> simpson: you misunderstand my argument. I'm saying that in the bulk of cases where people try to use containers, they don't need _any_ kind of environment isolation _at all_ because the only problem they're really trying to solve is dependency management
mojjo has quit [(Ping timeout: 260 seconds)]
<joepie91> so they don't need VMs nor containers, because Nix already solves the dependency problem
<simpson> joepie91: Oh. That may be true, but I contend that environment isolation should be *mandatory*.
carlosda1 has joined #nixos
<clever> eacameron: yeah, an example of something that typicaly needs docker, messing around with musl, there can only be 1 /lib/libc.so, and you cant just swap glibc out for musl
<joepie91> eacameron: in *most* but not all cases, yes. people generally use containers as big bags to wrap around a ball of state, basically.
<joepie91> eacameron: to make the state hurt less :)
<clever> eacameron: but with nix, you can have as many libc's as you want, so there is no need for a second rootfs or docker
<clever> simpson: systemd is already capable of doing environment isolation on a per-service basis, https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/misc/locate.nix#L146-L151
<eacameron> clever: I see. I suspected that all along but it seems people are doing more with containers that *just* isolation. Something about scalability. But my complaint about microservices is that any time you have something "micro" you have to build up to the thing that's "macro". Having small pieces in and of itself isn't helpful.
<joepie91> eacameron: note that sometimes containers *are* desirable, either for security purposes (although neither declarative NixOS containers nor Docker currently support this), or because there's a need for a virtualized interface of some sort (eg. a server that demands to run on a specific port, so you need to give each server a virtual network interface if you want to run multiple on one system)
<clever> simpson: this heavily restricts what updatedb can read and/or write to
<clever> simpson: and i believe it could be configured to give isolation just as good as containers
<joepie91> eacameron: and in those cases they're not just used to wrap avoidable state, but rather for concrete technical reasons
<simpson> clever: Nice. As you may know, I am in favor of much more aggressive and structural isolation, so I am personally looking *beyond* cgroups and containers.
<simpson> But it is good to know that these features which many decried as unhelpful are indeed usable and used.
<bennofs1> simpson, clever: systemd even supports syscall filtering
<joepie91> eacameron: btw, to re-emphasize, because this is a very common misconception: none of the currently commonly used containerization tooling supports *secure* isolation against malicious users/code, that I am aware of.
<joepie91> and that includes Docker.
<joepie91> so if somebody is trying to use Docker to contain untrusted code, they're going to have a problem.
<bennofs1> joepie91: escaping Docker is quite hard
<joepie91> this is irrelevant
<bennofs1> joepie91: at least if you don't have root in the container
<simpson> bennofs1: Yeah, but that's not very helpful in the big scheme. Don't get me wrong, the seccomp-bpf stuff is cool, but it's expensive and inaccurate compared to more structural methods.
<joepie91> Docker is not being explicitly designed to defend against malicious code
newhoggy has joined #nixos
<joepie91> therefore it can not be relied upon to do so
carlosda1 has quit [(Ping timeout: 240 seconds)]
<ekleog> bennofs1: if you don't have root outside of a container it's also quite hard to escape
<joepie91> regardless of how hard any one individual at any given time believes it to be
<ekleog> (ie. become root)
<simpson> bennofs1: Containers do not provide security benefits, full stop.
<clever> ekleog: yeah, though systemd did have a related bug a few months ago
<simpson> It would be nice if they did, but they'd have to be designed less like they are.
<joepie91> simpson: they can, in theory, if explicitly designed as such :P
<simpson> And more like e.g. Capsicum.
<simpson> joepie91: Yeah, but e.g. Capsicum can be used *outside* of containers too~
<clever> ekleog: systemd was doing chmod -1 on a file, causing a state file to be both world writable (777), and setuid root
<joepie91> simpson: see eg. OpenVZ which, despite its questionable implementation quality, definitely provides secure isolation and is designed to do as such
<ekleog> I guess it's time for me to point out https://github.com/NixOS/rfcs/pull/12 and ask for comments :°
<simpson> joepie91: OpenVZ is virtualization, right? VMs are definitely capable of isolation.
<joepie91> ekleog: subscribed, this is relevant to my interests :P
<joepie91> simpson: nope, containers
<joepie91> simpson: shared kernel
<ekleog> clever: indeed, there are privescs, I'm just saying containers often don't change much from unix privilege separation (may be slightly better, I guess)
<joepie91> simpson: OpenVZ uses a custom kernel that provides a lot of the isolation features that have now made it into upstream kernel, which means that people can be 'root' in a container but their stuff actually just runs under a PID
<joepie91> and aren't really root
<LnL> FRidh: yeah that would be useful, the stdenv itself already has some attributes like shell and libc, ... that's probably the best place
<joepie91> it's more similar to LXC than to virtualization
<clever> ekleog: about the only thing ive seen containers have, that you cant already get via chroot and drop-root, is things like pid/uid/mount/network namespacing
<simpson> joepie91: Sure. I'll call this containers, but only with the understanding that the normal container-level failure modes apply; shared kernel is still risky for obvious reasons.
<joepie91> simpson: and it *does* provide some 'real' hardware virtualization, like virtual network interfaces, but these are optional and not commonly used, and typically people only use the kernel-based abstractions
<simpson> joepie91: Like, the kind of sandbox that is correct by construction no longer looks like a sandbox, and usually has the limitation that you can't just run ordinary code in it.
<clever> ekleog: pid namespacing blocks ps aux from seeing things outside of the container, uid namespacing can dynamicaly remap uid's, so the container may think it has 0, but it doesnt
<joepie91> simpson: right. that's why you can't eg. load custom kernel modules in OpenVZ
<simpson> joepie91: As a result, if you show me a tool and say "and it can run all your normal code without recompiling!" then I am instantly skeptical of its abilities.
<joepie91> or modify the kernel at all in any way
<clever> ekleog: network namespacing allows different services to all bind to the same port, and not collide
<joepie91> simpson: oh no, it definitely can't
newhoggy has quit [(Ping timeout: 260 seconds)]
<joepie91> simpson: it's just designed in such a way that *most* of what people want to do with a VM is possible in it
<joepie91> not all, just most
<ekleog> userns has had many issues in the kernel iirc (and has been disabled in grsec for this reason)
<clever> joepie91: i have helped somebody on an openvz guest with abnormaly low ram, i tried to show him how to make a swapfile
<clever> joepie91: turns out, root can be denied permission to swapon, lol
<joepie91> clever: yeah, this has to do with the memory management model that OpenVZ used to use
<joepie91> I believe it's possible now though
<joepie91> using swap files
<ekleog> netns is really great imo, just not for security purposes. things like putting a vpn-only netns, otoh, is wonderful :)
<joepie91> or partitions if you use ploop or w/e
<simpson> joepie91: Okay, see, that's what I mean. Capsicum will make it hard/impossible to run *any* existing userland code. Monte requires a total rewrite of all of your code into safe languages. The kind of isolation proofs I'm talking about are totally incompatible with existing systems.
<clever> joepie91: id still consider swap files to be a potential privledge esclation exploit, if any kernel side datastructures get swapped out, you can modify them
<clever> joepie91: and you need a way to enforce pages from container#1 only going into the swapfile made by container#1
<joepie91> simpson: right, that's a very different category of 'limited', though. you can grab an arbitrary userland application written in whatever language and it'll *probably* run under OpenVZ, you just can't touch anything in kernel-land and there are some limitations in what you can do with iptables, etc.
<steveeJ> can the path of the file that is called with nix-build be inferred within the nix expression?
<joepie91> clever: such things are enforced in OpenVZ
<simpson> joepie91: Sure, but that's frankly not interesting to me, because it means that porting from Linux to OpenVZ is as tough as porting from Linux to OpenBSD.
<joepie91> clever: like I said, it's a custom kernel, and it's hacked to pieces :)
<clever> ekleog: nix also uses all of those namespace features to implement its build sandboxes
<joepie91> there's little fences put up everywhere
<simpson> joepie91: Which is *good* for many people! It's just not good *enough* for what I desire.
<joepie91> and abstractions
<joepie91> simpson: oh yeah, sure, you're probably right on that
<clever> joepie91: and how well tested are such hacks?, might it actualy be worse then containers?
<joepie91> clever: OpenVZ *are* containers :)
<clever> joepie91: vs mainline linux containers
<joepie91> and predates LXC and cgroups and whatever by about two decades
<joepie91> and has been used in production, on massive scale, for those two decades
<clever> ah, so the age may have helped to fix all of the bugs
<joepie91> yeah
<joepie91> it's been around absolutely forever :P
* ekleog disagrees
<simpson> Doubtful.
<simpson> My example: OpenSSL.
<joepie91> well
<joepie91> s/all/most/
<ekleog> like 2 yrs ago, container escape in openvz
<joepie91> and a lot of the mainline LXC features are actually based on OpenVZ code
<clever> ekleog: oh, and nix can also use some namespace features to change the hostname inside a sandbox, and even claim the cpu is 32bit only
<simpson> "most" is an approximation. You can't claim that software is free of a class of bugs without a proof. It's nigh-impossible to generate useful proofs about C, certainly not on the scale of Linux.
<joepie91> sure
<bennofs1> but aren't quite a lot of people relying on docker for security? (well at least as far as escaping from the container goes)
<simpson> (This is why correct-by-construction languages are great; their safety guarantees *cannot* be invalidated, regardless of how much code is written in the language.)
<ekleog> an exploit published in exploit-db allowed people to reach other VPSs fs for some months before it got fixed (not naming the specific company I'm thinking of just because)
<joepie91> to define 'most' more clearly: it's very unlikely that a garden variety attacker will be able to escape from an OpenVZ container
<simpson> bennofs1: Many Docker users say this and they are wrong to rely on Docker this way.
<ekleog> clever: I'm feeling like namespaces are great, but not really jails like BSDs' jails
<ekleog> like, separation but no isolation, etc.
<bennofs1> simpson: but if many people rely on it, then there's probably quite some effort to make it secure
<joepie91> bennofs1: that's a very dangerous assumption.
<simpson> bennofs1: False. My example: Literally every piece of user-facing software sold or proffered to users today.
<joepie91> bennofs1: see also https://news.ycombinator.com/item?id=7910117
<ekleog> bennofs1: aren't quite a lot of people relying on C for security? does that mean C is an adequate language for secure software?
<joepie91> key takeaway: "When we feel comfortable saying that Docker out-of-the-box can safely contain untrusted uid0 programs, we will say so clearly."
<simpson> bennofs1: "quite some effort" does not denote any useful results.
<joepie91> I have not seen such a statement as of yet
<NixOS_GitHub> [nixpkgs] sifmelcara opened pull request #25115: crystal: 0.21.0 -> 0.22.0 (master...update/crystal-0.22.0) https://git.io/v9Tqa
<steveeJ> ekleog: you enforce isolation by tweaking capabilities, eg. forbid another namespace switch. and further use something like selinux to prevent file access
<bennofs1> joepie91: well what about non-uid0 programs?
<clever> bennofs1: or row-hammer?
dmi3y has joined #nixos
<hodapp> can someone try installing pypi2nix, putting "pypotrace" in requirements.txt, and running "pypi2nix -r requirements.txt -V 2.7" for me... and explaining what exactly it is complaining about because I can't make sense of it?
<ekleog> steveeJ: I'd say a selinux-only system is way more secure than a container-only system, intuitively (among other reasons because it can run along with grsec without issues)
<joepie91> bennofs1: thing is, non-uid0 programs already can't really do meaningful things
<joepie91> docker or no docker
<joepie91> (beyond their own fenced off bit of the system, that is)
<bennofs1> even safe by construction can only be safe by construction up to a point. at some point, you have to rely on necessarily not-100%-perfect models of how things work which will cause unforseen issues
<steveeJ> ekleog: this all depends on the definition of "container".
<simpson> hodapp: I don't have a working pypi2nix but I can read any trackback which you pastebin.
<joepie91> bennofs1: nor can you assume that just because something runs as non-uid0, it won't *become* uid0
<clever> joepie91: that reminds me of a fuse exploit
<bennofs1> joepie91: well, you should at least put a network namespace around your non-uid0 untrusted program
<clever> joepie91: when you try to mount something via fuse, it will use a setuid wrapper to do the actual mounting
<simpson> bennofs1: Well, yes, but we have security models which cover the entirety of distributed systems, including full modeling of humans as agents within the system.
<clever> joepie91: and that setuid program will "modprobe fuse" if fuse isnt loaded
<joepie91> bennofs1: therefore, it's reasonable to assume that any isolation system that cannot contain untrusted uid0 code, is not designed to provide secure isolation, and therefore cannot be trusted as a secure isolation solution
<clever> joepie91: and modprobe will obey an env variable as for what config to obey
<joepie91> clever: ...
<clever> joepie91: and that config can say "just run X instead of loading fuse.ko"
<simpson> bennofs1: So sure, we can be correct-by-construction up to theoretical results about information theory and guesses about which cryptographic algorithms are one-way. Which is a pretty good point to be secure up to!
* joepie91 facedesk
<clever> joepie91: modprobe was never designed to be used via setuid stuff, and fuse didnt sanitize the environment enough
<joepie91> clever: how do people not realize "oh this might not always be a good idea"
<joepie91> while implementing this setuff
<joepie91> stuff*
<clever> joepie91: id blame the fuse guys for not knowing about that edge-case in setuid
<ekleog> steveeJ: my definition of "container" is "what docker/openvz/lxc do out of the box", just like my definition for "VM" is "what qemu/xen do out of the box", adding security features to this would make it "hardened [previous name]" imo
<clever> joepie91: and also, by default, sudo on some distros will heavily sanitize the env
newhoggy has joined #nixos
<ryantrinkle> has anyone tried packaging kmail?
<bennofs1> simpson: hmm, in theory you are right. but what do you do if you cannot rewrite the world? you need a solution that can run existing programs
<joepie91> I generally define "container" as "managed in kernel space" whereas a "VM" involves "emulating the physical hardware in its entirety"
<simpson> hodapp: You need Cython in the build inputs.
<simpson> bennofs1: I am currently rewriting the world. It's a lot of work, but it is 100% possible.
<bennofs1> clever: execing another program in a setuid program.... always a good idea
<simpson> bennofs1: Solutions which run existing programs are able to do things like load OpenSSL into memory. This is unacceptable in 2017. Therefore, it is not only okay to not be able to run existing programs, but *desirable for security*.
<joepie91> clever: have a link for more reading about that, by any chance?
<joepie91> the vuln
<ekleog> joepie91: you can do VMs with eg. PCI passthrough (and I've heard of docker unikernels, but no idea what this exactly encompasses)
<simpson> ekleog: "VM" has a better definition that can help make it clear when something is definitely a VM; it's synoymous with "emulator".
batdog has quit [(Remote host closed the connection)]
<joepie91> ekleog: sure, but passthrough isn't the same as fencing things off
<joepie91> ekleog: once you passthrough something to a guest you can't use it on the host or another guest anymore
<joepie91> this is unlike containers, where resources are - by default - not allocated in their entirety
<clever> joepie91: part of the exploit, is that the setuid program will check /proc/filesystems to see if fuse.ko needs to be loaded or not
<ekleog> and if you don't have an IOMMU you're dead
<joepie91> but rather split up in some manner
<clever> joepie91: so you just open a crap-ton of files and make that fail
newhoggy has quit [(Ping timeout: 252 seconds)]
<bennofs1> hmm what happens when you modprobe in a container? surely that fails, right?
<hodapp> simpson: "pypi2nix -r requirements.txt -V 2.7 -E python2Packages.cython" is doing the same
<clever> bennofs1: i would expect that to have been disabled, along with /dev/mem
<NixOS_GitHub> [nixpkgs] rvl opened pull request #25116: Gogs service password handling improvements (master...gogs) https://git.io/v9Tms
sivteck has quit [(Quit: Leaving)]
dbmikus has joined #nixos
<joepie91> clever: thanks, will read
<ekleog> <simpson> ekleog: "VM" has a better definition that can help make it clear when something is definitely a VM; it's synoymous with "emulator". <-- then HVMs aren't VMs because they use VT-x for performance?
<clever> joepie91: i have also been interested in how nixos can possibly implement FHS user envs safely, it appears to be a setuid wrapper that just runs X under root Y
<clever> joepie91: and at that point, i can make my own /etc/shadow, pop in a copy of sudo, and i have root!
<bennofs1> clever: fhs user envs use user namespaces afaik
<joepie91> clever: not sure which functionality you're referring to there
<ekleog> (defining the words is hard work I think, then it's maybe not the one most important thing in this discussion)
<joepie91> ekleog: mind that defining things like "VM vs. container" is only useful so long as the concepts do not diverge too strongly, as an aid for making snap judgments
<joepie91> ekleog: you still need to care about the technical differences once you actually use them
<hodapp> definitions can be a bit weird when it comes to virtualization. processes, in the proper early form, were meant completely as "virtual machines".
<hodapp> virtualization encompasses a whole lot of things.
<ekleog> joepie91: my definition of VM vs container is one kernel vs many kernels, and it turns out it seems to work most of the time :)
<joepie91> ekleog: and just like how "editor vs. IDE" has become a meaningless distinction because the two have converged together, and how "programming language vs. scripting language" or "compiled vs. interpreted" have become meaningless for much the same reason, this is likely to eventually happen with "VM vs. container" as well :)
<clever> bennofs1: ah, but i did also hear about how selinux locks namespaces like that down to only root
<joepie91> though for now there's still a fairly clear line in the sand
<hodapp> they're not meaningless, but there is not really a clear distinction for a lot of those
<clever> bennofs1: that broke chromium security a while back
<joepie91> ekleog: yeah, that's a simplified version of what I'm describing I think
<bennofs1> clever: nixos does not use SELinux afaik
dbmikus has quit [(Ping timeout: 268 seconds)]
<clever> bennofs1: as for why selinux did it, to reduce the attack surface area, non-root rarely needs that code, turning it off is simpler then auditing
<joepie91> hodapp: they're meaningless in the sense that nothing is gained by using the term anymore, the lines have become too blurred for the words to become useful for snap judgments
<ekleog> clever: chromium has both a setuid-based sandbox and a userns-based sandbox, or they removed the setuid-based one already?
<bennofs1> clever: yeah user namespaces have a lot of tricky security implications
Svarog has quit [(Quit: Ex-Chat)]
<clever> bennofs1: oh correction, grsecurity, not selinux
<clever> ekleog: nix doesnt allow any setuid programs in /nix/store, and chromium expects the setuid program to be in $out
<joepie91> hodapp: add a debugger plugin to your editor and suddenly it's an IDE, according to one of the more popular definitions of "IDE", despite this obviously making no sense when you ask somebody "are you using an editor or an IDE?" or "is $thing an editor or an IDE?"
<clever> ekleog: it had to be patched to look in /run/wrappers/bin
<ekleog> oh true, that wouldn't work out well out-of-the-box
<bennofs1> clever: not /var/setuid-wrappers ?
<joepie91> hodapp: similarly, depending on runtime Python may be either compiled, interpreted, or something else entirely
<bennofs1> clever: oh, that was the old code perhaps
<joepie91> yet the code doesn't change
<clever> bennofs1: that was renamed recently
<joepie91> etc. etc.
<ekleog> there were talks about dropping support for non-userns at some point, so...
<ekleog> (in chromium*)
<joepie91> hodapp: in other words; they were words that once had meaning but have now lost their purpose because of technologies converging
<ekleog> nice :)
<bennofs1> clever: tbh, I think for desktop systems, there are much worse problems than kernel exploits. just look at how secure DBus is (dbus has support for authentication, but almost noone uses that)
systemfault has joined #nixos
<clever> ekleog: oh, and libredirect also was breaking chromium, that fix also made it into that commit
<clever> bennofs1: yeah, ive found dbus to just be a giant pain
<ekleog> bennofs1: for desktop systems, X11 is the source of most awful problems
<clever> bennofs1: for example, i cant even start pulseaudio in a sandbox, because it needs dbus, and dbus needs x11
<bennofs1> ekleog: wayland
derjohn_mob has joined #nixos
<joepie91> ekleog: don't forget the undocumented ball of 'stuff' that is freedesktop...
<bennofs1> clever: dbus does need x11?
<ekleog> like, get access to any program and you've got almost root
<clever> bennofs1: and the whole reason i was using the sandbox was to avoid needing an xorg server
<clever> bennofs1: to start in certain session modes
<ekleog> bennofs1: do people actually use it without a Xwayland server?
<bennofs1> ekleog: not yet probably
<joepie91> ekleog: for example: https://news.ycombinator.com/item?id=9725741
<clever> ekleog: oh yeah, and some GPU drivers are implemented by just mmap'ing chunks of physical ram into xorg, or possibly the opengl clients
<joepie91> ekleog: and that's about polkit, the thing supposed to manage authorization for system actions
* ekleog plans on switching to qubesos as a desktop system to mitigate xorg-based vulns
<clever> ekleog: want to place bets you can just tweak the address a bit, and get arb write to any memory address? lol
<ekleog> clever: yay xorg
<clever> ekleog: and before kms (kernel mode switchin) was a thing, xorg would just hijack the entire gpu and make destructive mode changes, such that the kernel cant recover if xorg ever quits un-cleanly
<bennofs1> clever: hmm. but isn't x11 in dbus just to register some properties?
<clever> ekleog: kms allows the kernel to restore text-mode in the event of xorg crashing, or a kernel panic needing to display the error
<clever> bennofs1: yeah, but i havent been able to find an option to just turn it off
<bennofs1> clever: isn't the user dbus instance nowadays managed by the systemd user daemon?
<bennofs1> clever: and the systemd user daemon definitely does not have access to Xorg
<bennofs1> clever:
<bennofs1> ├─dbus.service
<bennofs1> │ ├─ 1342 /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation
<bennofs1> (on arch linux)
dmi3y has quit [(Quit: dmi3y)]
<clever> bennofs1: i believe the systemd-user daemon gets started by pam, as a child of the process doing the login (your display-manager, after it dropped root to your user)
<bennofs1> clever: yes, but it also gets started if I login via tty
<bennofs1> clever: and systemd does not export DISPLAY or anything to identify the x server
<bennofs1> clever: and it will continue running even if I kill the x server as long as I still have any open session (for example a tty session)
<clever> 21755 ? Ss 5:38 /run/current-system/sw/bin/dbus-daemon --fork --print-pid 6 --print-address 8 --session
<clever> bennofs1: i see this on my nixos machine, the parent is pid1, so it has been cut off from its parent
<bennofs1> clever: systemctl --user status ?
batdog has joined #nixos
<clever> bennofs1: `strings /proc/18191/environ` reveals that it does not currently have $DISPLAY set
<bennofs1> clever: hmm let me start my nixos
<Dezgeg> but it's still running as your user, so it could just set DISPLAY=:0 and have fun, no?
<clever> Dezgeg: yep
<clever> Dezgeg: as long as it can guess $XAUTHORITY (which is just ~/.Xauthority)
<bennofs1> yeah but you could sandbox it perhaps by disallowing access to the xorg soccess
bennofs has joined #nixos
<bennofs1> s/soccess/socket
<clever> Dezgeg: that also reminds me, xauth was disabled on nixos for years, any user on nixos was able to access your X session
<spacefrogg> clever: I made sure that dbus is started as an explicit service of my systemd user session.
<bennofs1> clever: ah it seems nixos using dbus-launch to start dbus
<spacefrogg> clever: That prevents dangling dbus-daemons. (As they sometimes get killed and any program in need of dbus-daemon can launch a new one.)
<spacefrogg> bennofs1: Yeah, I got rid of that.
ambro718 has quit [(Ping timeout: 260 seconds)]
<spacefrogg> bennofs1: It is much cleaner to put it under control of systemd.
aKriJcz has joined #nixos
<bennofs1> spacefrogg: yeah that appears how it is set up on archlinux by default
ixxie has joined #nixos
newhoggy has joined #nixos
<unlmtd[m]> this looks nuts!
<unlmtd[m]> he does a signed boot to a static ro binary on musl system
<clever> unlmtd[m]: ah, ive done similiar, but without musl
<unlmtd[m]> hes working on sandboxing it all
<unlmtd[m]> clever: you made a display server?
<clever> unlmtd[m]: signed boot
<bennofs1> unlmtd[m]: does it use the wayland protocol?
<unlmtd[m]> i was planning on switching to wayland, but now I want to try this
<clever> unlmtd[m]: the kernel, initrd, and rootfs are all signed with a cert and keypair, and the cert is embeded into the ipxe binary
<unlmtd[m]> no its a full stack to egl
<unlmtd[m]> in makes wayland look like a joke
<bennofs1> unlmtd[m]: hmm wouldn't it make sense if it supported wayland? wayland is based on egl as well afaik
<unlmtd[m]> nonono, it doesnt want wayland
<clever> unlmtd[m]: ah, i just have signed boot with a read-only fs and sshd
<unlmtd[m]> clever: gotcha. so he signs is all the way up to the window manager
<clever> unlmtd[m]: my original goal was to have firmware like images for an embeded server cluster
newhoggy has quit [(Ping timeout: 240 seconds)]
<bennofs1> unlmtd[m]: i guess i don't really understand it. how's it better than wayland?
* bennofs1 needs to use wayland in every sentence
<clever> unlmtd[m]: i'm signing the rootfs image, but the binaries within are fully unsigned
<unlmtd[m]> bennofs1: if youre into security
<unlmtd[m]> the freaking display manager/windowmanager is signed!
<unlmtd[m]> lol
<unlmtd[m]> well thats what I read
<bennofs1> unlmtd[m]: well but would that not be possible if it implemented the wayland protocol as well?
<bennofs1> unlmtd[m]: after all, wayland is only a protocol, not a "server" as the x server was
<unlmtd[m]> bennofs1: he plans on supporting it but it would just be more overhead
<spacefrogg> hrhr, he said it again…
<clever> unlmtd[m]: in my mind, if you can sign the kernel and rootfs, and the os within never runs untrusted files, there is no need to sign the binaries inside the rootfs
<simpson> unlmtd[m]: Signatures only protect integrity of the binary; they make no promises about what the binary can do.
<bennofs1> unlmtd[m]: the advantage would be that you can automatically run many programs when they get ported
<unlmtd[m]> he must be doing it to make sure the login screen is authentic
zraexy has quit [(Ping timeout: 268 seconds)]
<unlmtd[m]> the display is the most privileged 'part' of our OS
<unlmtd[m]> thats where you punch in your password
<clever> unlmtd[m]: windows made it such that ctrl+alt+del cant be captured by normal programs, and always brings up a trustable gui
<clever> unlmtd[m]: linux has a similiar thing under sysrq, that will -9 everything in the current tty
<bennofs1> spacefrogg: what do I need to do on nixos to have dbus be managed by systemd? i can't figure out how that unit is disabled/enabled in systemd
zraexy has joined #nixos
<bennofs1> clever: sysrq+k
newhoggy has joined #nixos
<unlmtd[m]> bennofs1: no hes not making a wayland 'top-layer' bridge, but to run it 'on top' of wayland rather
<clever> bennofs1: yep
<clever> bennofs1: but if kms isnt working 100%, sysrq+k will bork the gpu state, and now you need to reboot
carlosda1 has joined #nixos
<bennofs1> clever: i'm using kmscon so kms should work or else everything is borked anyway .)
<unlmtd[m]> this is the most 'clean slate' display attempt iv seen
<spacefrogg> bennofs1: Write a user systemd unit and patch the xinitrc.
<clever> bennofs1: i also have kmscon, and have found that ctrl+alt+f1 from xorg->"tty1" breaks the gpu, i then have to alt+f2 to get kmscon to re-initialize it
<unlmtd[m]> ill try and bring it to nixos
<bennofs1> spacefrogg: hmm, but it appears that systemd ships with a dbus unit by default
<clever> bennofs1: but kmscon has internaly saved the broken state of tty1, so alt+f1 restores the breakage
<NixOS_GitHub> [nixpkgs] lucas8 opened pull request #25117: cubicle: init at 1.0.2 (master...cubicle) https://git.io/v9TOO
<bennofs> spacefrogg: any idea what causes this: Loaded: loaded (/nix/store/bghlifzi2lcajyr5wmvxxq0csyk3gv01-dbus-1.10.16/etc/systemd/user/dbus.socket; disabled; vendor preset: enabled)
<bennofs> spacefrogg: vendor present says enabled, but unit is disabled
<spacefrogg> Configure services.dbus.socketActivated = true
<spacefrogg> bennofs: ^
newhoggy has quit [(Ping timeout: 240 seconds)]
carlosda1 has quit [(Ping timeout: 240 seconds)]
<bennofs> spacefrogg: oh! so then I may not need to write an unit manually at all
<bennofs> let me try that
dbmikus has joined #nixos
<spacefrogg> bennofs: Seems so, didn't know that before. :) I set it up before this was included.
newhoggy has joined #nixos
<bennofs> clever: how did you plan to sandbox dbus
bennofs has quit [(Quit: WeeChat 1.7)]
bennofs has joined #nixos
<clever> bennofs: mainly by changing $HOME, and clearing all dbus related variables, so it forms a new session that is cut off from the rest
bennofs has quit [(Client Quit)]
bennofs has joined #nixos
dbmikus has quit [(Client Quit)]
<spacefrogg> clever: If you make a dbus.socket unit you can define the name of the socket file and need not change $HOME
<bennofs1> clever: do you want a per-session or per-user bus?
<clever> spacefrogg: i want to be able to spawn multiple instances of the program, without needing seperate users
<spacefrogg> clever: Then make dbus@.socket units and specify a some name for each unit.
<clever> bennofs1: multiple sessions in a single user, using different $HOME values to fake different users
<clever> spacefrogg: what was the argument for dbus, to tell it which socket to use?
<spacefrogg> Yes.
newhoggy has quit [(Ping timeout: 258 seconds)]
<spacefrogg> dbus@foo.socket -> /run/users/.../dbus-foo.s
bennofs has quit [(Client Quit)]
<clever> but how is the dbus.service file telling dbus to use that path?
bennofs has joined #nixos
bennofs has quit [(Client Quit)]
<spacefrogg> the dbus@foo.socket starts the dbus@foo.service which gets the socket handed over by systemd
alx741_ has joined #nixos
<clever> ah, so its actualy receiving a pre-opened socket as its started
<spacefrogg> you need to communicate the correct socket to the applications that ought to use dbus by setting DBUS_SESSION_BUS_ADDRESS
bennofs has joined #nixos
<clever> yeah
<bennofs1> does anyone here have an idea how to deal with shutdown errors? I.e. if a network FS cannot be unmounted when the system shuts down due to no network connection, it would be nice if there was a way to "recover"
<spacefrogg> yes, when you start dbus-daemon with --systemd-activation
<clever> bennofs1: ive been wanting that as well, every time the power goes out, it takes the network switch with it, and i have no way to do a clean shutdown
<Profpatsch> bennofs1: fyi, `ag(1)` can search through nixpkgs in less than 5s (even faster incrementally) on an SSD.
<bennofs1> Profpatsch: yes?
<bennofs1> Profpatsch: i use rg
<Profpatsch> I heard `ripgrep` is even up to five times faster than that.
<clever> spacefrogg: this is what i currently have, i'll need to play with the activation mode and see if i can coerce it into working without systemd: https://github.com/taktoa/pianoman/blob/master/pianoman/src/pianoman-start#L83
<bennofs1> Profpatsch: but it cannot find files inside packages if you're taling about that
alx741 has quit [(Ping timeout: 260 seconds)]
<Profpatsch> bennofs1: Why then the index file?
<Profpatsch> s/file/program/
<steveeJ> shouldn't makeWrapper support multiple --set arguments?
<bennofs1> Profpatsch: if you want to fid a package that provides include/foo-header.h, rg won't help you
<spacefrogg> clever: socket activation only works with systemd
<clever> spacefrogg: i cant see why it wouldnt work elsewhere, but it may need a custom c program to open the unix socket and pass it via the correct fd#
<Profpatsch> bennofs1: Oh, huh. I thought you meant searching through nixpkgs
<clever> spacefrogg: i have written systemd services before that are on the receiving side of it
<Profpatsch> So you mean the nix store?
<Profpatsch> Or can it find stuff that isn’t even installed?
<bennofs1> Profpatsch: look at the example here: https://github.com/bennofs/nix-index
<bennofs1> Profpatsch: it can find everything that is build by hydra
<spacefrogg> clever: You would have to do that. Should be easy as it is standardized.
<eacameron> Just a quick question: Do any of you all work on large scale systems? Like 1mil concurrent users globally?
<clever> bennofs1: ah, is it scanning the .ls files and making a programs.sqlite like db without any filter?
newhoggy has joined #nixos
<bennofs> clever: yes
<steveeJ> OH! you mustn't use `=` between the key and value
<bennofs> clever: it is just a plain zstd compressed locatedb-like file
<Profpatsch> bennofs: So it indexes hydra?
<bennofs> clever: ~15mb in size
<clever> bennofs: dang!
<bennofs> Profpatsch: it indexes all store paths that were build by hydra in a given channel
<clever> hydra has a url that will spit out every storepath in a given eval (built or not), and the binary cache has .ls files for every storepath in the cache
<clever> combine the 2, and you have every file in an eval, from all passing jobs
<bennofs> clever: it actually doesn't use store-paths, as that would not give use attributes
<clever> ah
<bennofs> clever: it'll use nix-env --query --available --out-path --xml and parse that, and then fetch the closure of all those paths
<clever> ahh, so it skips hydra and directly evals
<bennofs> clever: this has the advantage that we don't get darwin/x86/x86_64 versions of every path as well
<clever> you might also be able to use the json from one of the hydra utils
<bennofs> clever: i looked into that, but there is no way to get a store path -> attribute mapping from hydra (apart from fetching every single build in an evaluation, which would probably not be friendly to the hydra server as it won't be cached by cloudflare)
newhoggy has quit [(Ping timeout: 240 seconds)]
<clever> bennofs: this will return a list of job names (attrpath relative to release.nix) and .drv files
<clever> bennofs: this lets you perform the eval on your end
<clever> so you can just query the nixpkgs revision from hydra(or a channel), and then make your own eval
<bennofs> clever: yeah. but I think the current solution works just as well, and has the advantage of giving us the real attribute path and not just the job name
<clever> you can also change the value of system passed to release.nix, and omit platforms like darwin
<clever> yeah
<clever> things like foo."bar.baz" can be hard to deal with
<sphalerite> Are there any technical obstacles, besides there not being an implementation, to deploying to NixOS containers in NixOps?
<bennofs> clever: I also manually run nix-env again with -A haskellPackages and -A xlibs, if there's any other i have missed that are build by hydra I'd be interested to know
<clever> bennofs: xfce4, and pythonPackages are 2 i can think of right away
<bennofs> i guess parts of pythonPackages etc may be build as dependencies of other packages
<bennofs> clever: I don't think all of pythonPackages gets build by hydra?
<clever> bennofs: xfce.xfce4-screenshooter for example
<bennofs> clever: is xfce not recurseForDerivations?
<bennofs> clever: yeah looks like xfce is already included
dustmote has joined #nixos
<ryantrinkle> does anyone have an example of converting a nix-shell environment to a docker image?
<ryantrinkle> using dockerTools
<clever> bennofs: looks like the python stuff is disabled in hydra, but if you over-eval, you may catch python that was in the closure of other stuff, and built anyways
<ryantrinkle> i think i'm not quite familiar enough with docker to see all the stuff i need to do
<bennofs> clever: yeah I just realized that
<bennofs> clever: I mean, I already catch it since I fetch the closure, but I won't display an exact attribute path as a result
mudri has quit [(Ping timeout: 240 seconds)]
<clever> yeah
dustmote has quit [(Client Quit)]
ixxie has quit [(Ping timeout: 240 seconds)]
<bennofs> clever: I guess it won't hurt too much to add them
<clever> yeah
newhoggy has joined #nixos
mekeor has quit [(Ping timeout: 260 seconds)]
newhoggy has quit [(Ping timeout: 240 seconds)]
frankpf has joined #nixos
guillaum2 has joined #nixos
frankpf_ has joined #nixos
frankpf_ has quit [(Client Quit)]
newhoggy has joined #nixos
<NixOS_GitHub> [nixpkgs] dmjio opened pull request #25118: HaLVM: Shebang fix for Hydra (master...patch-1) https://git.io/v9T37
newhoggy has quit [(Ping timeout: 245 seconds)]
aKriJcz has quit [(Ping timeout: 240 seconds)]
shadow-x has joined #nixos
shadow-x has quit [(Remote host closed the connection)]
newhoggy has joined #nixos
<eacameron> Is Nix/NixOS used in any big web contexts? Like 1million concurrent users globally?
newhoggy has quit [(Ping timeout: 260 seconds)]
xadi has joined #nixos
<mdash> eacameron: let's say yes
<eacameron> mdash: That's an odd way of saying yes.
<mdash> eacameron: how would it change your life if the answer was yes?-)
newhoggy has joined #nixos
<joepie91> eacameron: Nix{,OS} just do system management, I don't really see how that relates to concurrent user activity?
<eacameron> mdash: It would help me know whether or not it's worth debating with my brother-in-law about nix's viability in large scale contexts.
<eacameron> joepie91: Yah but my brother-in-law argues that mass container orchestration is the way to go for large scale apps.
<joepie91> eacameron: I suspect your brother-in-law has drunk the hype-aid :)
<eacameron> And nixos community seems to disagree.
<eacameron> joepie91: Yah but how would I know? He does actually do that stuff IRL
<ryantrinkle> eacameron, joepie91: also, nixos can do container stuff pretty well :P
<spacefrogg> eacameron: Prove him wrong and hope for the best.
<ryantrinkle> in fact, i'm writing a nix expression to generate a docker container right now :P
<eacameron> spacefrogg: Haha I wish.
jophish has quit [(Quit: Lost terminal)]
<joepie91> eacameron: it's, uh, a tiring topic to discuss. because for any technical argument you make on how scalability doesn't really relate to the tooling used, you're likely to get a response that's 50% buzzwords and Docker-specific jargon
<eacameron> ryantrinkle: I think I know what for! Sweet! ;)
<joepie91> (I have this discussion with people regularly, not just in the context of Nix)
<ryantrinkle> eacameron: yep :)
<eacameron> joepie91: Hit the nail on the head.
<sphalerite> How do disnix and nixops relate to each other?
<joepie91> eacameron: and in the end... Nix{,OS} just puts things in the right place and patches some paths, so what does that really have to do with orchestration or scalability? you can build any abstraction you want on that, it doesn't really directly relate to it
newhoggy has quit [(Ping timeout: 240 seconds)]
jophish has joined #nixos
<joepie91> eacameron: it's akin to saying "yeah well apt-get can't scale for applications with 1 million concurrent users"
<joepie91> there's just no relation between the two concepts
<eacameron> joepie91: Yah that's what I thought. But it seems people around here (see above discussion which you and I had) don't really like container orchestration in the first place.
<eacameron> But maybe that's just a different discussion entirely.
myndzl has quit [(Ping timeout: 260 seconds)]
<eacameron> And largely unrelated to Nixos
<symphorien> hello, I have hardware.sane.extraBackends = [ pkgs.hplip ]; in my configuration.nix but nix-store --query --requisites $(readlink -f $(where scanimage)) doesn't list hplip as a dependency and strace scanimage -L suggests scanimage is opening the wrong /nix/store/sane-config.../etc/sane.d without hplip. Any idea why ?
<ryantrinkle> eacameron: well, container orchestration seems like a fine enough tool, but what's the problem it's solving?
<joepie91> eacameron: yeah, different discussion. that's more about people abusing containers to wrap up a bunch of state and pretend it's "stateless"
<joepie91> eacameron: but that doesn't really have anything to do with scalability either :)
<ryantrinkle> one of the big ones is: i've got a ton of stuff that's messy and assumes it's running as a system-level service on linux
<ryantrinkle> i need to treat that stuff as a purer, more self-contained thing
ambro718 has joined #nixos
pmade has quit [(Ping timeout: 252 seconds)]
<ryantrinkle> sometimes, that's really what you've got
bennofs1 has quit [(Ping timeout: 260 seconds)]
<ryantrinkle> e.g. if you have to run some horrible proprietary binary blob that you can't package in a nicer way
<ryantrinkle> but with nix, things are packaged very nicely already
<ryantrinkle> so you don't need to plaster over them quite so much to make them smooth
<joepie91> eacameron: btw, even if you leave NixOS out of the equation entirely, people *still* abuse containerization systems because of hype :) lots of people who believe that you can't run N = >1 deployments without containers for some reason
<joepie91> which uh, is misleading at best
<joepie91> like, sure, compared to no isolation, containers *do* have benefits
<eacameron> ryantrinkle: Ahhh yes that's a very good point.
<joepie91> they're just rarely the *optimal* solution, and people also ascribe a bunch of benefits to them that they simply don't have
<NixOS_GitHub> [nixpkgs] rlupton20 opened pull request #25119: emacs-all-the-icons-fonts: init at 2.5.0 (master...emacs-all-the-icons) https://git.io/v9TGs
<eacameron> ryantrinkle: And in a world without Nix and Haskell...that's basically the only experience to be had, so *of course* you need containers.
<ryantrinkle> eacameron: right
<ryantrinkle> there are *some* other decent package managers
<ryantrinkle> the one on solaris back in the day springs to mind
myndzi has joined #nixos
<ryantrinkle> (though i never used it heavily)
<eacameron> joepie91: I see. That's helpful.
<ryantrinkle> but largely you've got this sort of "do a crazy thing, then make a tarball" approach
<eacameron> ryantrinkle: Right...been there done that.
* joepie91 was having a discussion about Docker overuse *just now*
<joepie91> (elsewhere)
pmade has joined #nixos
newhoggy has joined #nixos
<joepie91> eacameron: anyway, to more directly answer the question that we started out with, even though the premise is false -- I cannot think of anything that would make Nix{,OS} *not* suitable for large-scale deployments
<joepie91> architecturally speaking
<joepie91> the stage of development is such that you'll probably need to roll some custom tooling, but you *can*
<eacameron> joepie91: I see. Well that's good news.
<joepie91> or well, custom abstractions *
<joepie91> eacameron: now whether I'd currently *recommend* using Nix{,OS} for a large-scale deployment is a separate matter :P and more dependent on circumstances
<joepie91> because then you start having to consider the cost of developing said custom abstractions, the knowledge within the organization, existing deployments, requirements, certifications, and the interoperability concerns that come with it, etc. etc.
<eacameron> joepie91: I see. Well I'm not in the need (yet!) so this is good for just general awareness.
<joepie91> there's just no general answer to that, but if the answer there were to be a "no", it'd likely be due to cost of switching, not inherently because of Nix{,OS}
<joepie91> :)
newhoggy has quit [(Ping timeout: 260 seconds)]
dupin has joined #nixos
<dupin> disk is full and I don´t know how to clean it to perform upgrade
<dupin> it is vbox but still...
<dupin> I trie with rollback but no joy
bennofs1 has joined #nixos
<NixOS_GitHub> [nixpkgs] domenkozar pushed 2 new commits to master: https://git.io/v9TGN
<NixOS_GitHub> nixpkgs/master bcd5865 David Johnson: HaLVM: Shebang fix for Hydra...
<NixOS_GitHub> nixpkgs/master e30b5c1 Domen Kožar: Merge pull request #25118 from dmjio/patch-1...
<clever> dupin: does this command help some?, "nix-collect-garbage --max-freed 10M"
<barrucadu> `nix-store --optimise` may also save a bit of space
<clever> ah, and optimize may work even with 0 bytes free, since its making hardlinks and deleting
<clever> though zfs still wont like that, it cant do in-place changes to dir metadata
* taktoa coincidentally started a `nix-store --optimise` about 10 minutes ago :^)
<spacefrogg> dupin: try cat /dev/null > /some/large/file. This frees up blocks without the need for meta data changes.
<clever> spacefrogg: the truncate command can also do that
<spacefrogg> clever: Sure, didn't want to get into details, here. :)
<clever> spacefrogg: truncate file -s 0
<spacefrogg> : > /some/file
<taktoa> ugh it feels like every damn haskell derivation depends on tasty-ant-xml
alx741_ has quit [(Quit: alx741_)]
alx741 has joined #nixos
<dupin> clever, nix-collect-garbage --max-freed 10M seams to clear something :)
xadi has quit [(Quit: Leaving.)]
<dupin> I will reboot now
<clever> dupin: you can also re-run it, with bigger numbers, to free up as much as you want
<dmj`> eacameron: that’s the thing, NixOS uses mainline linux kernel, the rest is just differences in packaging (and maybe a few other things ) If it were a different kernel, then maybe there would be some concern in using it for “large enterprise deployment"
<dmj`> maybe docker will fork NixOS to WhaleOS
<clever> dupin: i usualy try to limit how much it can free, because it will wreck the cached data from a partialy ran nixos-rebuild, forcing you to re-download it all
<joepie91> dmj`: I'd actually be quite happy with that.
<joepie91> :)
<dupin> clever, I run that command several times
durham has quit [(Ping timeout: 260 seconds)]
<joepie91> I'd like to see more Nix-based things pop up in different applications
<dupin> now I can not pass login screen :(
reinzelmann has joined #nixos
<steveeJ> is it possible to retrieve the string that was passed to "nix-build" from within the expression? e.g. if I have a $PWD/default.nix and I run "nix-build -f . $PWD", I want to access the string that contains the extended $PWD
<clever> steveeJ: you can get it by manipulating ./. in a nix expression
<spacefrogg> dupin: Try repairing your store. Did it fail during installing something?
<clever> steveeJ: that would be relative to the file its in, rather then the file on the cmdline
<steveeJ> clever: what if I pass a URL and the archive is downloaded and unpacked?
<dmj`> joepie91: heh, all the gravitation towards docker in a short amount of time shows how quickly everyone abandoned what they were doing for dev ops.
<steveeJ> it'll be the path on the filesystem?
<clever> steveeJ: yeah
newhoggy has joined #nixos
<joepie91> dmj`: well, to be fair, Docker *is* in various ways an improvement on what there was before it
<joepie91> in common use anyway
<clever> steveeJ: if you just directly use it (say like "${./.}") then nix will force a snapshot of that directory into /nix/store (if it isnt already there)
<clever> steveeJ: so you will get a copy of the directory, rather then the original path
<joepie91> dmj`: since it rules out a whole category of problems by way of just throwing away the disk image and starting over
<dupin> spacefrogg, it was during upgrade
<dmj`> joepie91: oh, for sure
<joepie91> which, while crude, is reasonably effective :p
<joepie91> so it's not _entirely_ surprising to me that Docker got so popular so fast
<steveeJ> clever: is there an impure alternative?
<clever> nix-repl> builtins.toString ./.
<clever> "/home/clever"
<spacefrogg> dupin: nix-store --verify --check-contents --repair
<clever> steveeJ: this forces it to not snapshot the path
<steveeJ> clever: awesome, thanks
<dupin> spacefrogg, but I already run upgrade again
<spacefrogg> dupin: Still, nix does not verify paths it assumes to be present.
<dupin> ok but I will do it after upgrade because i can not stop it now
<NixOS_GitHub> [nixpkgs] schneefux opened pull request #25120: wallabag: 2.1.6 -> 2.2.2 (master...pkg.wallabag) https://git.io/v9Tnt
newhoggy has quit [(Ping timeout: 240 seconds)]
mudri has joined #nixos
<joepie91> dmj`: I'm in the irritating position of considering containerization to be a useful and valid technology but simultaneously having a strong dislike of the way it's (mis-)applied in real-world deployments. this means that 99% of my conversations about it consist of either a) Docker fanboys accusing me that I'm "just hating" on it, or b) Docker/containerization "haters" accusing me of being a fanboy :|
<joepie91> the discussion in here today is actually the first discussion about containerization that I've had in a _long_ time that doesn't fall into those two categories :P
<systemfault> Moby fanboy? </troll>
andymandias has quit [(Ping timeout: 252 seconds)]
<joepie91> (I generally find discussions here to be technically sound, even if I don't always agree :) )
<gchristensen> joepie91: as we grow more, you'll likely find #nixos falls in line :P
newhoggy has joined #nixos
<clever> joepie91: one use-case of containers ive had recently, was spawning 3 nixos containers, each with identical custom modules, that had their own nginx:80, and mysql unix socket
<mitchty> slightly confused, if i do nix-env -i zlib, why would zlib.h not end up in ~/.nix-profile/include?
<clever> joepie91: and all on the same private lan, so they can emulate 3 real servers working together over the internet
stepcut has joined #nixos
<dmj`> joepie91: docker containers are useful for testing nix expressions on other linuxes besides NixOS :P
<joepie91> gchristensen: idk about that, I've been in channels with similar activity and similar community size/involvement, and they tend to be a lot less informed than #nixos -- I think it might be in part because NixOS' reason for existence is pretty much "let's fix <thing that is pretty crap>"
<joepie91> which naturally tends to attract the involvement of people who recognize the issues :)
<gchristensen> fair enough :)
<clever> mitchty: nix will skip development files when installing things, you want nix-shell -p zlib
<joepie91> clever: yep, that's a completely valid case for containers - might even want full-blown VMs depending on the type of networking (eg. for P2P stuff that uses raw sockets)
<clever> joepie91: its all http level stuff
<mitchty> ok, but what if i want zlib.h outside of nix-shell?
<joepie91> dmj`: I'd use a VM for that, not a container
<joepie91> dmj`: so that you're testing against a "true" system
<joepie91> clever: yeah, then containers are probably sufficient
stepcut has quit [(Read error: Connection reset by peer)]
<dmj`> joepie91: sure, but what is truth
<gchristensen> nobody knows
bennofs1 has quit [(Quit: WeeChat 1.7)]
newhoggy has quit [(Ping timeout: 258 seconds)]
stepcut has joined #nixos
<clever> mitchty: nix isnt really meant to be used like that, and there is also https://gist.github.com/cleverca22/0fab549b7fc3de49add8898990b0b6dd
<clever> mitchty: some things like pkgconfig, will only work right under nix-shell
stepcut_ has joined #nixos
<mitchty> clever: ok, so then how should i get emacs to be able to run intero, which will run stack, which will build ghc dependencies to be able to build ghc libraries that depend on zlib?
<mitchty> rather, are there examples of how other people use things like this together and their development workflows?
<mitchty> i feel like i'm mostly yak shaving with all this at this point
byteflame has joined #nixos
<clever> mitchty: either run emacs under the correct nix-shell, or use https://github.com/shlevy/nix-buffer/blob/master/nix-buffer.el
newhoggy has joined #nixos
eacameron has quit [(Remote host closed the connection)]
stepcut has quit [(Ping timeout: 255 seconds)]
<clever> mitchty: i think nix-buffer basicaly just runs nix-shell within one of emacs's terminals, but i still havent broken my vim addiction, lol
<mitchty> ok let me try it out, nix-shell in a terminal is... probably not going to help with intero
sellout- has joined #nixos
newhoggy has quit [(Ping timeout: 260 seconds)]
engblom has quit [(Read error: Connection reset by peer)]
byteflame has quit [(Ping timeout: 240 seconds)]
engblom has joined #nixos
carlosda1 has joined #nixos
eacameron has joined #nixos
sellout- has quit [(Ping timeout: 240 seconds)]
dupin has quit [(Quit: Leaving)]
endformationage has joined #nixos
carlosda1 has quit [(Ping timeout: 260 seconds)]
newhoggy has joined #nixos
byteflame has joined #nixos
newhoggy has quit [(Ping timeout: 268 seconds)]
Acou_Bass has quit [(Ping timeout: 240 seconds)]
<gchristensen> I've been reading the man pages for RT most of today, and it is truly impressive
<ryantrinkle> is there a list of "default packages" in nixos that I can grab for my docker build?
<ryantrinkle> currently, it doesn't have coreutils :P
<ryantrinkle> but it's not exposed
newhoggy has joined #nixos
Acou_Bass has joined #nixos
frankpf has quit [(Ping timeout: 240 seconds)]
<gchristensen> ryantrinkle: I think the current assumption is you only want the bare minimum for your docker containers
hotfuzz has quit [(Read error: Connection reset by peer)]
<ryantrinkle> gchristensen: that makes sense; and perhaps that's all i should provide
<ryantrinkle> i'll get it up there and let the folks using it give me feedback
<ryantrinkle> i've never made much use of docker personally
<ryantrinkle> so i definitely don't know what's expected
reinzelmann has quit [(Quit: Leaving)]
hotfuzz has joined #nixos
<gchristensen> yeah, and I don't really know
betaboon has quit [(Quit: This computer has gone to sleep)]
<NixOS_GitHub> [nixpkgs] simonvandel opened pull request #25121: tvheadend: 4.0.8 -> 4.2.1 (master...tvheadend-421) https://git.io/v9TC3
perebor has joined #nixos
newhoggy has quit [(Ping timeout: 240 seconds)]
sellout- has joined #nixos
<ekleog> gchristensen: RT?
<gchristensen> RequestTracker
<ekleog> thanks:)
<perebor> has anyone installed hmatrix with stack? I can't find a nix package that provides libgfortran
<gchristensen> :) it is a ticketing system I've heard much dissatisfaction about, but my impression is people don't like it for unfounded reasons
<perebor> the gfortran pkgs only come with a bin dir
<samae> How do I define a template service in NixOS?
newhoggy has joined #nixos
<gchristensen> samae: like a systemd template?
<samae> yes
<samae> ending the service name with '@' gets rejected
byteflame has quit [(Ping timeout: 240 seconds)]
<samae> oh, I see
<samae> There are "
<samae> thanks !
<gchristensen> yep!
<clever> nix also lets you do foo."bar.baz" = value;
<clever> which can lead to confusing errors
<samae> Does it create a service named bar.baz?
<ekleog> gchristensen: I guess the fact it's written in perl may make a no-go of it for some people
<gchristensen> I guess
<clever> it creates an attribute called bar.baz, which is different from foo.bar.baz = value;
<samae> right
<clever> samae: and if it was done in a systemd.services, it would probably make a bar.baz.service
<samae> So, confusing, but not surprising, which is good
<NixOS_GitHub> [nixpkgs] pmahoney opened pull request #25122: ocamlPackages.utop: fix environment variables (master...ocaml-utop) https://git.io/v9TW9
newhoggy has quit [(Ping timeout: 260 seconds)]
byteflame has joined #nixos
<NixOS_GitHub> [nixpkgs] edolstra pushed 1 new commit to release-17.03: https://git.io/v9Tlf
<NixOS_GitHub> nixpkgs/release-17.03 99dfb6d Eelco Dolstra: Revert "display-manager: fix argument handling of sddm"...
<jophish> hmm, nix is reluctant to fetch from a binary cache. How can I force it to use a particular cache
<jophish> I have a derivation with out=/nix/store/abc, and /nix/store/abc is present at a server listed in binary-caches
<jophish> however my machine still wants to build it
newhoggy has joined #nixos
FRidh has quit [(Remote host closed the connection)]
newhoggy has quit [(Ping timeout: 240 seconds)]
<jeaye> I was hoping this would override a python package for me, but I'm failing: https://gist.github.com/jeaye/7e87a770f8fb5039098d4570fe4aacab
<ryantrinkle> so, it looks like my docker image is ending up with two copies of each file
newhoggy has joined #nixos
roconnor has quit [(Ping timeout: 260 seconds)]
newhoggy has quit [(Ping timeout: 245 seconds)]
apostolis has joined #nixos
carlosda1 has joined #nixos
Itkovian has joined #nixos
pie_ has joined #nixos
<pie_> you guys know anything good for "keeping" tmux sessions if my machine crashes or something/
<pie_> so i can at least somewhat continue my work?
carlosda1 has quit [(Ping timeout: 258 seconds)]
apostolis has quit [(Quit: WeeChat 1.7)]
<NixOS_GitHub> [nixpkgs] vmchale opened pull request #25123: Init madlang at 2.3.0.3 (master...master) https://git.io/v9T41
newhoggy has joined #nixos
<NixOS_GitHub> [nixpkgs] sigma opened pull request #25124: emacs: 25.1 -> 25.2 (master...pr/emacs-25.2) https://git.io/v9T4Q
<gchristensen> shlevy: why did you package rt?
newhoggy has quit [(Ping timeout: 260 seconds)]
betaboon has joined #nixos
<NixOS_GitHub> [nixpkgs] ttuegel closed pull request #23922: mytetra: init at 1.42.2 (master...master) https://git.io/vyDww
vaibhavsagar has joined #nixos
newhoggy has joined #nixos
Sonarpulse has joined #nixos
Itkovian has quit [(Quit: My MacBook has gone to sleep. ZZZzzz…)]
Itkovian has joined #nixos
newhoggy has quit [(Ping timeout: 268 seconds)]
systemfault has quit [(Quit: Bye!)]
<jophish> peti: how is ghcCross intended to be used?
<jophish> I'm having trouble building it, and I'm not sure if that's because I'm instantiating it wrong, or the build is broken
<jophish> shlevy: ^
newhoggy has joined #nixos
<NixOS_GitHub> [nixpkgs] grahamc opened pull request #25126: RT: Improve Packaging (master...rt) https://git.io/v9TRe
<gchristensen> ^ the amount of pain in that PR lol
newhoggy has quit [(Ping timeout: 260 seconds)]
newhoggy has joined #nixos
<joepie91> gchristensen: the missing feature on GitHub: a "Painfulness" indicator under the "Labels" section...
<gchristensen> hehe
newhoggy has quit [(Ping timeout: 260 seconds)]
slyfox_ has joined #nixos
slyfox has quit [(Ping timeout: 240 seconds)]
newhoggy has joined #nixos
pie_ has quit [(Changing host)]
pie_ has joined #nixos
newhoggy has quit [(Ping timeout: 260 seconds)]
frankpf has joined #nixos
civodul has joined #nixos
revtintin has quit [(Quit: WeeChat 1.7)]
ambro718 has quit [(Ping timeout: 255 seconds)]
frankpf has quit [(Ping timeout: 255 seconds)]
carlosda1 has joined #nixos
nicknovitski has quit [(Ping timeout: 245 seconds)]
<MarcWeber> When does the outputs dev/out splitting happen?
<MarcWeber> Is it ok for out to refer to dev? php-config should return -I paths for the php.dev store paths
carlosda1 has quit [(Ping timeout: 240 seconds)]
<MarcWeber> So I guess it should be moved into dev as well.
<MarcWeber> then all php plugins build again
<MarcWeber> whith such patch: ${gnused}/bin/sed -i -e 's@^exec_prefix=.*@exec_prefix=${php.out}@' -e 's@^prefix=.*@prefix=${php.dev}@' $out/bin/php-config
<MarcWeber> @ niksnut can you help me? You broke it. The fix works, just don't know where / how is the best place to apply
newhoggy has joined #nixos
<MarcWeber> Also can I make nix-build ignore assertions on php71Packages to build all?
ertesx has joined #nixos
<MarcWeber> http://mawercer.de/tmp/php-fix.patch -> But I guess it would be better to run the sed command in the php derivation.
<MarcWeber> I verified 56 and 71 packages do all build
newhoggy has quit [(Ping timeout: 258 seconds)]
ertes has quit [(Ping timeout: 255 seconds)]
ertesx is now known as ertes
newhoggy has joined #nixos
praduca has joined #nixos
ryanartecona has joined #nixos
sellout- has quit [(Quit: Leaving.)]
newhoggy has quit [(Ping timeout: 255 seconds)]
<praduca> Hi, anyone knows how to solve this "Missing C library: GL" problem? tried a lot of things and I'm getting pretty sad now :)
<ericnoan> praduca: what are you trying to run or build?
<praduca> Hi, an example of game from hackage, and other simple apps
byteflame has quit [(Ping timeout: 255 seconds)]
<praduca> this particularly is called "boring-game"
<praduca> build the code,not running it
<praduca> I opened a shell, but only ghc with packages
<praduca> worked for a lot of things, but for the ones that need gl, it just dont go
newhoggy has joined #nixos
<ericnoan> praduca: did you add the GL library to your nix derivation?
<praduca> hm, no, I assumed it will find it
schoppenhauer has quit [(Ping timeout: 255 seconds)]
<praduca> let me try it
<praduca> tks!
<ericnoan> well... im just a noob helping a noob
newhoggy has quit [(Ping timeout: 255 seconds)]
<praduca> thats the way to do :)
<perebor> I'm trying to install hmatrix but it fails to find the libgfortran .so. The gfortran packages don't come with it, so I don't know what to add to the derivation. how do I find that out?
schoppenhauer has joined #nixos
<praduca> gfortran is installed? i ask because it is a package itself
<ericnoan> perebor: I find the best way is to look at an existing example, and try to imitate it: try looking at https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/science/math/jags/default.nix
vaibhavsagar has quit [(Ping timeout: 268 seconds)]
<perebor> yeah, ericnoan: thanks, that what I've been doing. using "packages: [ blas liblapack gfortran ]" does not work, so if I do:
<perebor> nix-build --no-out-link "<nixpkgs>" -A gfortran I see there is no lib/ directory
newhoggy has joined #nixos
<perebor> so I can't --extra-include-dirs= it
<perebor> (or --extra-lib-dirs=)
<gchristensen> woah, Pijul is using NixOS & NixOps https://twitter.com/pijul_org/status/854415299248107520
<ericnoan> also, nix-rust? that is amazing
<dash> gchristensen: niiiiiice
yumbox has joined #nixos
<yumbox> when will firefox 53 be available as binary?
<NixOS_GitHub> [nixpkgs] zx2c4 opened pull request #25127: wireguard: 0.0.20170409 -> 0.0.20170421 (master...patch-3) https://git.io/v9TuI
<gchristensen> yumbox: what channel are you on?
<yumbox> uh, unstable, i think?
<yumbox> how do i check?
newhoggy has quit [(Ping timeout: 240 seconds)]
<gchristensen> nixos-version
yumbox has quit [(Remote host closed the connection)]
yumbox has joined #nixos
nicknovitski has joined #nixos
<yumbox> "17.09pre105622.f0fac3b578 (Hummingbird)"
<ericnoan> it is funny, after learning about nix, i start seeing it everywhere
<yumbox> sorry, copy-pasting sometimes makes irssi freeze
aneeshusa has joined #nixos
<yumbox> does that mean unstable channel?
wkennington has joined #nixos
<dash> yumbox: what does 'nix-channel --list' say?
newhoggy has joined #nixos
<yumbox> nothing
sellout- has joined #nixos
darlan has joined #nixos
ryanartecona has quit [(Quit: ryanartecona)]
newhoggy has quit [(Ping timeout: 240 seconds)]
dmi3y has joined #nixos
hiratara has quit [(Ping timeout: 258 seconds)]
<perebor> the exact problem I'm having is that if I compile something with ghc that uses hmatrix and then execute it I get: ./test2: error while loading shared libraries: libgfortran.so.3: cannot open shared object [..]
<perebor> how do I find which nix package will have this library?
carlosda1 has joined #nixos
<yumbox> nix-env -qaP | less
<yumbox> then search for fortran
hiratara has joined #nixos
<praduca> you can use nox
<perebor> right. so if I install any of the gfortran packages from that none of them have it
newhoggy has joined #nixos
<perebor> in examples that other people have used, I see them using "nix-build --no-out-link "<nixpkgs>" -A gfortran" to pass the lib/ directory, but if I do that there is no lib directory. so I'm wondering if libgfortran comes in a package that can't be found by grepping nix-env -qaP
carlosda1 has quit [(Ping timeout: 258 seconds)]
FRidh has joined #nixos
<FRidh> perebor: $ nix-store -qR $(nix-build -A gfortran) | grep gfortran shows that gfortran is a wrapped package which depends on another derivation that contains the libraries
<FRidh> typically one shouldn't need to explicitly point to the library when adding gfortran as buildInput
newhoggy has quit [(Ping timeout: 255 seconds)]
<NixOS_GitHub> [nixpkgs] Mathnerd314 closed pull request #9312: overrideDerivation: fix meta handling (master...meta-fix) https://git.io/vsv8Q
<FRidh> $ nix-store -qR $(nix-build -A haskellPackages.hmatrix) | grep fortran shows it does somewhere keep a reference to the libraries
<perebor> FRidh: OK, I found this reddit post that describes my situation: https://www.reddit.com/r/NixOS/comments/45tqvc/duplicate_linking_on_library/
newhoggy has joined #nixos
<perebor> I would like not to explicitly pass the path of the library, but I don't know how else to get ghc to use it
<perebor> does it mean anything that there are 2 entries in the ldd output for gfortran?
JagaJaga has joined #nixos
<yumbox> what country are you from?
newhoggy has quit [(Ping timeout: 240 seconds)]
<perebor> me?
<yumbox> yeah
<perebor> canada, why?
<yumbox> just curious
Sonarpulse has quit [(Ping timeout: 258 seconds)]
<jophish> I think that ghcCross was broken with the cross compile redo in december. I'm using Sonarpulse's branch at the moment and it's going well
newhoggy has joined #nixos
dmi3y has quit [(Quit: dmi3y)]
Zer000 has joined #nixos
newhoggy has quit [(Ping timeout: 260 seconds)]
FRidh has quit [(Quit: Konversation terminated!)]
marsel has quit [(Ping timeout: 240 seconds)]
praduca has quit [(Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/)]
newhoggy has joined #nixos
ixxie has joined #nixos
newhoggy has quit [(Ping timeout: 240 seconds)]
andymandias has joined #nixos
hiratara has quit [(Quit: ZNC - http://znc.in)]
JagaJaga has quit [(Ping timeout: 260 seconds)]
JagaJaga has joined #nixos
hiratara has joined #nixos
newhoggy has joined #nixos
drasich has joined #nixos
newhoggy has quit [(Ping timeout: 255 seconds)]
Itkovian has quit [(Quit: My MacBook has gone to sleep. ZZZzzz…)]
roconnor has joined #nixos
ixxie has quit [(Ping timeout: 240 seconds)]
newhoggy has joined #nixos
elpea has quit [(Ping timeout: 260 seconds)]
newhoggy has quit [(Ping timeout: 260 seconds)]
carlosda1 has joined #nixos
steshaw_ has joined #nixos
newhoggy has joined #nixos
JagaJaga has quit [(Ping timeout: 255 seconds)]
carlosda1 has quit [(Ping timeout: 260 seconds)]
newhoggy has quit [(Ping timeout: 268 seconds)]
<NixOS_GitHub> [nixpkgs] bennofs closed pull request #21906: fetchBower: fold arg in all-packages into the nix file (master...fold) https://git.io/vMwDJ
<NixOS_GitHub> [nixpkgs] jb55 opened pull request #25128: plex: fix startup issue (master...fix/plex-startup) https://git.io/v9T2h
stepcut_ has quit [(Remote host closed the connection)]
freusque has joined #nixos
newhoggy has joined #nixos
newhoggy has quit [(Ping timeout: 240 seconds)]
taktoa has quit [(Ping timeout: 260 seconds)]
taktoa has joined #nixos
newhoggy has joined #nixos
<bennofs> perebor: wait, I remember something like that
thc202 has quit [(Ping timeout: 240 seconds)]
Sonarpulse has joined #nixos
<bennofs> perebor: hmmm... how did I fix it though...
<bennofs> perebor: ah, I think you have to use the dynamically linked BLAS lib
newhoggy has quit [(Ping timeout: 252 seconds)]
benzrf has left #nixos ["WeeChat 1.7"]
<bennofs> perebor: can you paste the output of lddtree (from pax-utils) on your executable?
newhoggy has joined #nixos
roconnor has quit [(Ping timeout: 260 seconds)]
xadi has joined #nixos
<dmj`> what even is cloud native
newhoggy has quit [(Ping timeout: 258 seconds)]
<dmj`> does that mean “cloud foreign” is a thing
aneeshusa has quit [(Quit: WeeChat 1.7)]
simukis__ has quit [(Ping timeout: 260 seconds)]
newhoggy has joined #nixos
freusque has quit [(Quit: WeeChat 1.7)]
takle has quit [(Remote host closed the connection)]
newhoggy has quit [(Ping timeout: 258 seconds)]
<dtz> lmao
civodul has quit [(Quit: ERC (IRC client for Emacs 25.1.1))]
MP2E has joined #nixos
roconnor has joined #nixos
newhoggy has joined #nixos
xadi has quit [(Remote host closed the connection)]
newhoggy has quit [(Ping timeout: 268 seconds)]
xadi has joined #nixos
newhoggy has joined #nixos
betaboon has quit [(Quit: This computer has gone to sleep)]
carlosda1 has joined #nixos
systemfault has joined #nixos
systemfault has quit [(Max SendQ exceeded)]
systemfault has joined #nixos
newhoggy has quit [(Ping timeout: 260 seconds)]
carlosda1 has quit [(Ping timeout: 240 seconds)]
markus1189 has joined #nixos
markus1199 has joined #nixos