<MichaelRaskin>
Lisanna: an extra `unshare -m -r` lets you create an environment during the build where you can bind-mount anything to anything
<infinisil>
You do need to get your SSH key in the build somehow
<Lisanna>
MichaelRaskin what do you mean?
<infinisil>
so either it's in /tmp or as a build input aka in the store
<infinisil>
none of which is very secret
<Lisanna>
infinisil yeah, in this case it's coming in through the store... like I said, not very secret, but that's intentional
<infinisil>
Ohh I misread sorry
<Lisanna>
I'm enforcing security at the access to the build servers and nix code level... e.g., the channel is behind HTTP authentication
<MichaelRaskin>
unshare -m -r sh -c ' mount --bind /dev/null /etc/shadow ; wc /etc/shadow '
<Lisanna>
MichaelRaskin that goes in the derivation?
<infinisil>
Lisanna: Is sshfs an option for you? You could just mount your machine via ssh, then refer to the paths with nix directly
<MichaelRaskin>
That is a code sample to show how unshare works…
<MichaelRaskin>
unshare -m -r sh -c ' mount -t tmpfs tmpfs /etc; touch /etc/test; mount --bind /dev/null /etc/test ; wc /etc/test '
<MichaelRaskin>
Basically, inside unshare you will have a command that copies useful stuff from /etc, monuts tmpfs over /etc, creates whatever /etc/passwd you want, then runs scp
jrolfs has joined #nixos
<Lisanna>
MichaelRaskin sorry, I meant, is unshare something I would run as part of the derivation's build?
<MichaelRaskin>
Yes
<Lisanna>
oh, okay
<MichaelRaskin>
And inside unshare will be the fetching
<Lisanna>
Okay, I understand
alex_ has joined #nixos
<Lisanna>
so I could use unshare to create a fake /etc/passwd or whatever openssh is trying to get at
<MichaelRaskin>
Yes
<alex_>
hello, i want to use systemctl --user start resilio with services.resilio.enable but its dont work :(
<infinisil>
Why do you need a fake /etc/passwd though?
<clever>
Lisanna: if you lack root, you must create a user namespace at the same time as the mount namespace
<MichaelRaskin>
infinisil: because OpenSSH
<clever>
Lisanna: then the setuid binaries dont actually give you the uid your expecting
<infinisil>
huh
<MichaelRaskin>
clever: -m -r in my command takes care of it
<alex_>
I wanted to know if anyone's ever tried it before?
<MichaelRaskin>
clever: setuid stuff in build shouldn't work anyway
<Smithx10>
I think IM confused about what I am supposed to do for a BIOS firmware, partition wise.
<infinisil>
alex_: systemctl start resilio
<alex_>
infinisil: Yeah, but I'd like to boot it from a standard user.The doc says it should work but when I look at the. nix I don't see anything that fits.
<alex_>
s/boot/start/
<infinisil>
Which docs?
jrolfs has quit [Ping timeout: 260 seconds]
<infinisil>
I don't see anything in nixos that would create a user service for resilio
<Lisanna>
Here's the comment I made to myself: "SSH attempts to create '<home>/.ssh' if no config file is specified on the command-line. <home> is determined by querying the "pw_dir" attribute from the passwd database entry for the current user, which in the Nix sandbox resolves to "/" for some reason. Pass -F /dev/null to prevent this."
<MichaelRaskin>
You actually want to create ~/.ssh in advance with known_hosts
<MichaelRaskin>
You really don't want to play with interactive confirmations
<Lisanna>
I also pass flags to turn off the strict host key checking
<Lisanna>
to deal with that
<MichaelRaskin>
Maybe it needs nsswitch.conf
<Smithx10>
infinisil: and coconnor I got it to work
<Smithx10>
I was an idiot and forgot grub semantics :)
<Smithx10>
and bios boot partitions, read over the man pages again and was all g00d
<Smithx10>
thanks for trying!@!!
<tilpner>
ca8aa5dc877 (Use GCC 7 by default) broke fcgiwrap. gcc7 uses -Werror=implicit-fallthrough, which trips on a false-positive during error handling.
<tilpner>
It builds again after NIX_CFLAGS_COMPILE = "-Werror=implicit-fallthrough=0";. Should I PR this, or is there a better fix for this?
<Rusty1_>
+
<Lisanna>
MichaelRaskin is there an SSH option for configuring that?
<Lisanna>
something is really fishy here... I don't even see it loading an ssh config
<Dezgeg>
probably it doesn't like the home directory it gets from passwd
<elvishjerricco>
Can Hydra be told to put transitive build inputs in the cache? Seems to only copy closures in, which don't include build inputs like CMake.
<MichaelRaskin>
In general, I cannot really see anything from strace snippets
<Lisanna>
Dezgeg this is outside the sandbox
<Dezgeg>
when running what?
<Lisanna>
scp
<MichaelRaskin>
(I usually set -s 999 then search)
<Dezgeg>
you mean scp without any arguments?
<pjan>
Anybody here who managed creating a "live NixOS usb" - I want to install NixOS on a USB stick I can boot my MBP into. But happy to hear if somebody was successful (and how they did it) before investing time
xcmw has quit [Client Quit]
<infinisil>
primeos: that's pretty easy, just downnload the iso and dd that onto the usb
<Dezgeg>
but I guess even then the problem is that scp forks an ssh process, so you need to strace with -f
<MichaelRaskin>
Lisanna: ah wait your strace is useless
<Lisanna>
Dezgeg no, a basic scp to send a file
<MichaelRaskin>
You _have_ nscd
<infinisil>
pjan: I meant you
<clever>
Dezgeg: and then the logs get interleaved, i prefer `strace -ff -o logfiles -s 999` to solve that
<MichaelRaskin>
Could you please post the _full_ strace from inside sandbox with -s 9999 and -f?
Laboon3k has joined #nixos
<Dezgeg>
yeah, usually it doesn't matter too much unless the debugging gets too intensive
<Lisanna>
-f to strace?
<MichaelRaskin>
follow forks
<Lisanna>
Oh...
<Lisanna>
ffs
<infinisil>
pjan: Ask here if you have trouble with this
<clever>
Lisanna: -ff makes it append the pid to the output filenames
<MichaelRaskin>
clever: interleaving is a feature!
<clever>
which makes it a lot more readable
<MichaelRaskin>
Nope
<MichaelRaskin>
Please do not separate the traces
* deepfire
waves at clever
* clever
waves back
<MichaelRaskin>
I mean, we are looking at what-happens-first.
<Lisanna>
welp, even if this goes nowhere else, I've learned something today
<MichaelRaskin>
Interleaving is our only chance to see anything…
tomberek has joined #nixos
<Dezgeg>
I'm still wondering what is the exact problem that is being debugged
ryanartecona has quit [Quit: ryanartecona]
<pjan>
ininisil: just making sure. It's not he install I want on a USB drive, I want to install it on a USB drive.
<ottidmes>
Are there people here running Samba shares that are access not just locally, but over the internet? I would have thought the use case to have Samba over the internet with Windows clients and a Linux server to be quite common, but so far I have only found outdated articles on how to set such a thing up.
<MichaelRaskin>
OpenSSH wants a lot of stuff to be just right
<Dezgeg>
yes, I imagine inside sandbox it won't like the whatever home directory returned by passwd not being owned by the current uid
<clever>
pjan: ah, then just boot any nixos (or the installr), format the usb as normal, mount the partitions, and aim nixos-install at it, as normal
MP2E has quit [Remote host closed the connection]
jrolfs has joined #nixos
<infinisil>
pjan: Ah, well then i think the easiest way is to use the iso on one usb, boot into that, then install it to another usb
leotaku has joined #nixos
<pjan>
clever, infinisil: thanks. It'll inevitably be the last step before going full NixOS I reckon...
<Smithx10>
clever that didnt work :(
<Smithx10>
is there something I'm not setting on the pool?
<clever>
Smithx10: do you have lsblk and blkid?
<Smithx10>
of the drives before bouncing?
<clever>
Smithx10: try finding the device with the zfs pool, while in the initrd, where is it?
<dgpratt>
I've decided to install postgresql as a means to doing some database development, but I'm not sure what is the best way to set it up and run it in the context of nixos -- I've gotten as far as "nix-env -iA nixos.postgresql", I suppose the next thing is to decide where to put PGDATA...
<clever>
dgpratt: nixos has a postgres service that does that for you
<dgpratt>
for some reason I have this idea that user-based installs are better than machine-based installs, but I guess I can't see a significant downside here
<infinisil>
dgpratt: Well in theory a lot of nixos options would totally work on a per-user basis, and I plan to realize that eventually
<infinisil>
But currently they are only available for the nixos configuration
<clever>
infinisil: id also like to see them allow multiple configs
<infinisil>
clever: you mean multiple services?
<Dezgeg>
well, scp doesn't indeed like when the passwd lookup fails
<clever>
infinisil: why cant i just run 2 postgres's as different users, on different socket,s with different datadirs
<Dezgeg>
maybe try rsync and hope that works?
<clever>
infinisil: yep
<Lisanna>
Dezgeg but rsync just wraps ssh doesn't it?
<MichaelRaskin>
Lisanna: apparently it succeeds int connecting to the main system nscd.
<infinisil>
clever: yeah
<infinisil>
clever: Although I'm not sure how to best tackle this problem
<Dezgeg>
it seems _scp_ that doesn't like it, I don't think ssh cares (well, it could)
<clever>
Dezgeg: -ff and checking the execve tells you which process doesnt like it
<Lisanna>
Dezgeg I mean, I could try
<MichaelRaskin>
use -o to redirect the strace output to a file
alex`` has quit [Ping timeout: 265 seconds]
<Dezgeg>
I mean the only match for that error is: scp.c:fatal("unknown user %u", (u_int) userid);
<clever>
Dezgeg: ah, definitely scp then
<MichaelRaskin>
And try the same, but inside unshare, with a tmpfs over/var/run/nscd/
<Lisanna>
MichaelRaskin okay, hang on, never used unshare before, need to go back and look at your examples
leotaku has left #nixos ["WeeChat 2.0"]
<Lisanna>
MichaelRaskin unshare -m -r sh -c ' mount -t tmpfs tmpfs /var/run/nscd; scp ...'
<Lisanna>
like that?
<MichaelRaskin>
And strace -f -s 9999 -o scp.log
<Lisanna>
okay
<MichaelRaskin>
(Before unshare)
<Lisanna>
strace goes before unshare, okay
<dgpratt>
clever, infinisil installed and seems to be running fine, thanks -- but should I not be able to now "sudo su postgres" ? "This account is not currently available" is the response to that command
<dgpratt>
maybe I just need to reboot
<infinisil>
nah
pkill9 has quit [Ping timeout: 256 seconds]
<clever>
dgpratt: skip the su, its pointless
<clever>
dgpratt: also, bash isnt enabled on that user, so you have to "sudo -u postgres bash" to force a shell
<Lisanna>
MichaelRaskin oh my god I think that made it work
<Lisanna>
I got the motd from the remote server
<Lisanna>
....was not expecting that to just fix it
<Lisanna>
...and ssh is pulling 9337.572 KBps down
<MichaelRaskin>
Actually, sounds a bit of too-good-to-be-true.
shabius has quit [Quit: Leaving]
<Lisanna>
MichaelRaskin ...I know, but it's working
<Lisanna>
it's in the sandbox
ertes has quit [Ping timeout: 248 seconds]
infinisil has quit [Ping timeout: 252 seconds]
jrolfs has joined #nixos
<MichaelRaskin>
Ah right, the real real showstopper is the pty, and you don't need it at all
<dgpratt>
I've been getting by on a very weak understanding of the various sudo invocations, I guess I need to correct that
<Lisanna>
the pty? what's giving it a pty?
<Laboon3k>
Can someone help me (again)? Nix-env is not working...
<Laboon3k>
Something like "permission denied"
shabius has joined #nixos
<Lisanna>
oh, you mean for the interactive prompts?
<MichaelRaskin>
Pseudo-terminal
ertes has joined #nixos
<MichaelRaskin>
Yes, I wanted to enter password through a pipe.
<clever>
Laboon3k: are you on nixos or another distro?
<Laboon3k>
NixOS.
<MichaelRaskin>
When a kernel doesn't think having pts support is a good idea.
<MichaelRaskin>
(/dev/pts, the filesystem for handling pty
<Lisanna>
MichaelRaskin sshpass can do that I think
<Dezgeg>
there's a package called sshpass or something that allows entering the password from a file
<MichaelRaskin>
I would expect it uses pty's inside.
<Laboon3k>
clever : when I run "nix-shell -p nix-info --run nix-info" it says "error: getting status of /nix/var/nix/db/schema: Permission denied
<Laboon3k>
"
<clever>
Laboon3k: you need to set NIX_REMOTE=daemon
<Dezgeg>
I would expect it poses itself as the graphical password agent
amir has quit [Ping timeout: 265 seconds]
<Laboon3k>
18.03pre130932.cc4677c36ee (Impala)
<clever>
Laboon3k: oh, what does which nix-store say?
<Lisanna>
Okay, great, so now I have a working implementation of fetchScp, albeit with an assumed weak security model
jrolfs has quit [Ping timeout: 268 seconds]
<Laboon3k>
clever : $ which nix-store
<Laboon3k>
Hey, where I can set that variable, clever ?
<MichaelRaskin>
Lisanna: and then there is an obvious way to strictly improve it.
<Lisanna>
I'm sure this could be extended to also support the sshpass usecase (instead of just keys), and also the correct way to handle SSH auth in nix
<clever>
Laboon3k: what did which output? you may not need to set it
thc202 has quit [Ping timeout: 264 seconds]
<Lisanna>
that clever mentioned
<Laboon3k>
clever, it spits out '/home/atorres/.nix-profile/bin/nix-store'
<clever>
Laboon3k: yeah, thats the problem, you installed nix 1.11 with nix-env, and now nix 2.0 isnt setting NIX_REMOTE anymore
<MichaelRaskin>
I wonder just how much access to the outside FS you can get from a builder…
<Laboon3k>
clever, maybe in an update, you say?
<Laboon3k>
Now I need to install Nix 2?
<Lisanna>
MichaelRaskin well, you can specify mappings into the sandbox in nix.conf
<clever>
Laboon3k: you already have nix2 on the system
<MichaelRaskin>
That I know
<clever>
Laboon3k: but you installed the nix1 version in your profile, and that overrides the update
<MichaelRaskin>
I just have a feeling that access to the main nscd is a bit too much
<MichaelRaskin>
It looks like your default access is already too much.
<Lisanna>
MichaelRaskin is it even accessing the man nscd though, or a dummy one?
<Laboon3k>
clever : Yes, now you have said it, I tested the commands: nix-env is 1.11.16 and nix is 2.0
<clever>
Laboon3k: `NIX_REMOTE=daemon nix-env -e nix` will fix it
<Laboon3k>
I need to do it as my normal user? No root intervention required?
<Lisanna>
MichaelRaskin it was trying to access uid=1000 and complaining that the user doens't exist. I don't have a uid=1000 on my system, but I could create one temporarily and repeat the test
<clever>
Laboon3k: yeah, run it as the atorres user
<MichaelRaskin>
Could be funny
<Smithx10>
clever: I'm booted :)
<Smithx10>
thank you!@
<MichaelRaskin>
On my system fixed-output builders get no /var and no /run
<clever>
deepfire: does it make any difference if you compile the Setup.hs in the root dir and run ./Setup configure?
infinisil has joined #nixos
<Laboon3k>
A related question: how the hell I could know about that incompatibility? It is very strange, after all...
<infinisil>
Well damn, something is messed up badly with zfs on my nixos server
<infinisil>
It doesnt boot anymore, and nixos rollbacks don't do anything
<clever>
infinisil: what error does it fail with?
<clever>
Laboon3k: ive run into the same problem when using nix-repl (its still linked against 1.11) and have debugged it alredy
<Lisanna>
MichaelRaskin thanks for your help, I wouldn't have been able to get this working without your input, and I also learned a lot :)
<Lisanna>
Hopefully I can start work on an upstream fetchScp at some point :|
<infinisil>
clever: systemd says that a couple tasks can't be started/hang, some zfs services and then probably dependencies of those
<infinisil>
Well all of them hang, no error
<clever>
infinisil: try changing the init= on the grub cmdline to init=/bin/sh and then boot it, the initrd will claim file not found, tell it to continue
<clever>
Smithx10: this sets up a full netboot server, complete with nat, and it runs the systems from a ramdisk
acowley has quit [Ping timeout: 255 seconds]
<clever>
Smithx10: you can replace the boot.php on line 25-28 with your prefered server-side scripting, ti dynamicaly change the config based on the ?mac=XXXX sent in the URL
acowley has joined #nixos
<Smithx10>
nice.
<Smithx10>
Any higher level abstractions for managing them long term?
<cransom>
nic bonding? i know some things but it generally towards the knowing how as a network admin, they never do what the user desires and they should have figured for 10g instead of the cheap stuff
<Smithx10>
pretty much this
<Smithx10>
and just store everything in PG
d4g has joined #nixos
<Smithx10>
in particular sdcadm platform
<cransom>
(^^ re: gchristensen )
<gchristensen>
hah
<gchristensen>
cransom: I just rolled out a new image to a server of mine, and it boooted up with broken networking nd "bond0: Warning: No 802.3ad response from the link partner for any adapters in the bond". if I roll back to the prior version, it works fine. I'm not so experienced with bonding. any suggestions on where to look for the root cause? here is some info from dmesg:
<Smithx10>
clever: best place to query packages on the web?
<clever>
Smithx10: there is also `nix search`, nox, nix-repl, `nix repl` and some nix-env incantations
<Smithx10>
instead of nix-env?
<cransom>
(before i look at the link) if it's asking about 802.3ad, it means it's expecting to chat with the upstream switch(es) to form a link for the load sharing stuff.
xcmw has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<cransom>
gchristensen: what's the config look like for the nics? and for the upstream switch, are they expecting you to bond with LACP?
<gchristensen>
cransom: yep, this box 2x10Gbps , and 802.3ad should be the one...
<gchristensen>
yeah, LACP
jrolfs has joined #nixos
jrolfs has quit [Ping timeout: 240 seconds]
* clever
heads off to bed
<gchristensen>
night, clever
<cransom>
but as why it complains on the new version, either a) it was broken on older version but it didn't log it or b) software/behavior change on the updated deploy is broken. you could tcpdump on the box on either version to double check they are chatting if you don't believe logs
shiver has joined #nixos
shiver has quit [Changing host]
shiver has joined #nixos
Lisanna has quit [Quit: Lisanna]
<cransom>
tcpdump would tell also if the switch was holding off on lacp due to some kind of hold down and you just need to wait another 30 seconds for it to start negotiating
<infinisil>
Haha wow
<gchristensen>
so the weird thing is the old image / new image are PXE-booting, the firsts one works straight away and the second one doesn't
<gchristensen>
but based off the same version of nixpkgs even.
<infinisil>
clever: I just screwed up my kexec installation my doing `mount -t zfs tank/root/nix /nix`
<infinisil>
by*
<infinisil>
I can't run anything anymore
<cransom>
if lacp doesn't negotiate, iirc nothing breaks. it just doesn't distribute the incoming packets across the links it knows about.
<gchristensen>
interesting
<gchristensen>
networking is totally busted
throwup has quit [Remote host closed the connection]
<cransom>
well hrm. maybe. it could be broken. i forget that paret lacp interfaces are the right interface.
<kaychaks>
!!! Error in ./hack/generate-docs.sh:36
<kaychaks>
Error in ./hack/generate-docs.sh:36. 'make SHELL=/nix/store/pkjmwq7sqrvjg7cjiph6hq0khsmfl6p8-bash-4.4-p12/bin/bash -C "${KUBE_ROOT}" WHAT="${BINS[*]}"' exited with status 2
<ryantm>
Smithx10: Where are you expecting it to create the .vimrc file?
<Smithx10>
yes
<Smithx10>
guessing taht assumption is wrong "_"
hakujin has quit [Ping timeout: 255 seconds]
<boomshroom>
Does nixpkgs support using a custom libc? Ie, a non-standard one who's derivation you can provide manually?
hakujin has joined #nixos
schoppenhauer has quit [Ping timeout: 240 seconds]
<mduggie>
i know you can supply your own nixpkgs through `nixos-rebuild -I nixpkgs=/nix/pkgs/path`, not sure about individual packages. i would assume so
schoppenhauer has joined #nixos
<ryantm>
boomshroom: Search for libc in pkgs/top-leve/all-packages.nix it looks like it's part of the stdenv bintools, it might be complicated but I think you can provide your own stdenv using an overlay
<ryantm>
I don't know of some easy way to replace it.
<boomshroom>
ryantm: I ask because Redox got fed up with newlib and started their own libc and I was wondering if I could get nix to try to build GNU hello with it.
<boomshroom>
On a related note, hello was able to build for RISC-V.
ericsagnes has joined #nixos
vidbina has quit [Ping timeout: 240 seconds]
hakujin has quit [Ping timeout: 252 seconds]
hakujin has joined #nixos
jrolfs has joined #nixos
jrolfs has quit [Ping timeout: 240 seconds]
hakujin has quit [Ping timeout: 255 seconds]
fragamus has joined #nixos
hakujin has joined #nixos
<shlevy>
elvishjerricco: I have a solution to the hail restarting itself issue, but in general activation scripts should be made as atomic as possible
<shlevy>
boomshroom: On the staging branch we can cross-compile and boot an entire NixOS for RISC-V
b has quit [Quit: leaving]
<elvishjerricco>
shlevy: Actually I think the `activate` script may just continue running when Hail gets killed. Haven't tested this, but I think that's how `spawnProcess` works
<boomshroom>
shlevy: Sweet! I really want a RISC-V system and now I know what OS to put on it unless I end up with a complete one of my own.
andersk has joined #nixos
<shlevy>
boomshroom: I've had to set it aside the past week for some other work but my hope is to get native and cross toolchains fully working
<elvishjerricco>
shlevy: What other systems can we cross compile NixOS entirely to?
<shlevy>
I have a HiFive Unleashed all the way
<boomshroom>
Jelous.
<shlevy>
elvishjerricco: I don't know the full list, but I think bgamari- is doing it for aarch64 and some are doing it for armv7
<elvishjerricco>
That's so cool :)
<shlevy>
s/all the way/on the way
<elvishjerricco>
Can't wait to do RPi builds completely on my desktop
hakujin has quit [Ping timeout: 245 seconds]
<shlevy>
elvishjerricco: I'm pretty sure you need the systemd-run approach as systemd will otherwise kill everything in the cgroup (unless you explicitly configure it not to)
<shlevy>
I think cross-nixos rpi should work on staging too
<shlevy>
(staging has some general cross-nixos fixes)
<boomshroom>
S just checked and some of SailfishOS is open source, so it should be possible to build a touch friendly UI using Nix and get my Nexus 4 running a full NixOS installation... ON A PHONE!
<elvishjerricco>
shlevy: Ah. Makes sense
<shlevy>
:D nice
<elvishjerricco>
boomshroom: If you ever get that working, please let us know :) That would be my ideal phone
<shlevy>
It's interesting... I've been running Linux on all my personal computers since I was 13, but never once seen the appeal of getting it all set up on my phone :D
pie_ has joined #nixos
<elvishjerricco>
shlevy: I don't see the point unless it's NixOS :P
<boomshroom>
As a member of the Rust community I have seen "RIIR Everything" and even tried to to RiiR a couple things myself, but the philosophy feels way stronger with Nix where I won't be happy until I can build the whole world in a single Nix expression. XD
<Smithx10>
hmmm i can't get configuration.nix to update my ~/.vimrc
<TimePath>
Don't stop until you can declare your whole life with nix
<boomshroom>
Unfortunatly, today was the day my Nexus 4 decided to bootloop. It wasn't doing this yesterday.
<boomshroom>
There's still hope to get NixOS on my Switch once to bootrom exploit get's released.
b has joined #nixos
<boomshroom>
Quick derivation for relibc and lets so how it goes.
jensens has joined #nixos
ericsagnes has quit [Ping timeout: 264 seconds]
Laboon3k has quit [Quit: good bai]
troydm has quit [Ping timeout: 240 seconds]
<boomshroom>
On the one hand, I'm confused as to why it didn't abort when I used dummy hashes. On the other, I have the old problem of not being able to find the rust standard library.
jrolfs has joined #nixos
ericsagnes has joined #nixos
<Smithx10>
Hmmm so the vim configuration i am doing is working, but the vimrc is located at /nix/store/nlib8sk8h33k8f0wj9zy2b2q59zdvhq1-vimrc instead of ~/.vimrc ..... how come?
jrolfs has quit [Ping timeout: 268 seconds]
<boomshroom>
How do I build a rust package using the nightly compiler? It can't seem to find the rust standard library. I've run into the problem before.
<boomshroom>
How can I have nix build a derivation and then give its store path rather than linking a result symlink?
<Myrl-saki>
Has anyoone used Nix under Docker under Nix? I'm using Postgres, but I don't want to have Postgres running all the time, and Docker is currently the best-looking solution.
<Myrl-saki>
OTOH, I don't want to use Docker. So Nix under Docker is my idea.
justanotheruser has joined #nixos
<joepie91>
Myrl-saki: huh? can't you just stop the service?
<joepie91>
`systemctl stop postgresql`
<Myrl-saki>
joepie91: That's also one solution, but how about for deployment?
<joepie91>
well, 'deployment' is very vague :) what specific scenario are you thinking of?
jrolfs has quit [Ping timeout: 256 seconds]
Rusty1_ has quit [Quit: Konversation terminated!]
<Myrl-saki>
joepie91: Currently, I'm fine with a system with both the database and the program in a single machine, but I'm considering that I may have to scale.
<joepie91>
Myrl-saki: I don't really see how Docker relates to or changes that, though. either way it's going to be a case of deploying another system with PostgreSQL and transferring over the stateful data.
<Myrl-saki>
joepie91: Docker is probably the best way to test that, I can spawn multiple Docker instances that will communicate with each other rather than a mono system. That also allows me to test the deployment.
thefloweringash has joined #nixos
<Myrl-saki>
s/mono/monolithic/
<joepie91>
I mean, sure, you can? but what's the concrete benefit?
<joepie91>
it's just a container
<Myrl-saki>
joepie91: I can partially simulate multiple machines with a shared database.
<boomshroom>
On the topic of "Nix Everywhere," what are the chances of getting Nix running on RedoxOS?
<joepie91>
but why do you need to? it's not going to be an accurate simulation either way
<Myrl-saki>
joepie91: True.
<isHavvy>
boomshroom: I already tried convincing the Redox person when they first started out to use Nix natively for package management, and they wanted to do something different, so *shrug*.
<joepie91>
boomshroom: can't see a reason why it wouldn't be possible, but it's probably not going to work out of the box :)
<Myrl-saki>
joepie91: Thanks, I'll give it more though.
<Myrl-saki>
joepie91: Oh right, what's your suggested architecture? I guess this isn't really nix related anymore though.
<boomshroom>
isHavvy: Given "RiiR", they'd probably rather have a package manager in Rust. Kind of like how they're writing their own libc in rust. :P
<boomshroom>
But that doesn't mean we can't have a version of Redox using Nix, or even better: a version of Nix writen in Rust. \s
<Myrl-saki>
boomshroom: No \s. :P
<boomshroom>
(not that I wouldn't try anyways)
<Myrl-saki>
boomshroom: Imagine, fearless concurrency with Nix! (somewhat /s)
<joepie91>
Myrl-saki: suggested architecture for what specific scenario?
<joepie91>
also, Nix-in-Rust has been on my eventually-list for a while...
<joepie91>
it's the eventually-list though, so it could take a week or a decade
<joepie91>
:p
<Myrl-saki>
joepie91: Distributed HTTP servers and database.
<joepie91>
Myrl-saki: is there a specific reason for distributing your HTTP servers?
<boomshroom>
FACEPALM. The reason it wasn't failing was because it saw the hash matched the xargo sources, so it just built xargo instead.
<Myrl-saki>
joepie91: There's no specific reason for disributing my *database*, but distribute HTTP servers are useful for load balancing, right?
rosa has joined #nixos
<joepie91>
Myrl-saki: well, yes and no - that implies that you have a reason to be load-balancing in the first plac
<joepie91>
place*
<joepie91>
Myrl-saki: generally you want to prefer vertical scaling, because it just produces less headaches in terms of state consistency, and only move onto horizontal scaling when you've (nearly) exhausted your vertical scaling capabilities
<Myrl-saki>
joepie91: It's just an assumption.
<joepie91>
(note that this does not rule out having two redundant vertically scaled systems for availability reasons)
<joepie91>
so *ideally*, your scale is small enough that you can get away with one or two vertically scaled systems, and no distributed servers / load balancing at all
<Myrl-saki>
joepie91: I doubt my program will ever reach adoption, but I do want to learn good practices.
thefloweringash has quit [Quit: WeeChat 1.9.1]
<Myrl-saki>
(OTOH, YAGNI is also a good practice.)
<joepie91>
but if you must distribute things, then prefer distributing the stateless things (eg. your HTTP server, which likely depends on the DB for most or all of its state) and apply the same 'vertical-first' strategy to just the database
<joepie91>
once you outgrow that, start adding caching layers which can also be distributed, while keeping your primary data store central
<joepie91>
once you're big enough to have to distribute your *database*, you'll probably have gained enough experience to figure out the optimal scaling strategy for your specific usecase :P
<joepie91>
tl;dr vertical scaling first, when needing to scale horizontally always prefer the least stateful things, 'wing it' when you really have no other choice based on the data available to you then
<Myrl-saki>
joepie91: Thanks, that's good advice. Should I have a monolithic system as a start?
<Myrl-saki>
joepie91: Database and HTTP in the same server
<joepie91>
Myrl-saki: monolithic infrastructure, yes; monolithic code, no
jrolfs has joined #nixos
<joepie91>
so yes, database and HTTP server on the same system
<Myrl-saki>
joepie91: Thanks!
<joepie91>
(possibly two systems running in sync for failover, if you need high availability guarantees)
<joepie91>
(but that won't help your scale, as eg. all DB work has to be replicated on both systems anyway)
<Myrl-saki>
joepie91: How does one sync the database in such systems?
<Myrl-saki>
joepie91: Send a query to both databases?
<joepie91>
it's database-dependent, but most databases have some form of master-master replication that can be used for this scenario
<Myrl-saki>
joepie91: Ah.
<joepie91>
though application-level recovery logic may be needed
<joepie91>
(eg. "oh the database server that missed a few writes is back, let's make sure we don't get conflicts")
<joepie91>
basically, very carefully read the documentation of your database of choice :)
<Myrl-saki>
joepie91: Application-level means my code?
<joepie91>
and make sure you understand exactly what the guarantees and failure scenarios of each replication strategy are, because there's always going to be some sort of tradeoff
<joepie91>
yeah
<joepie91>
Myrl-saki: also, general warning against hype: anybody peddling a database that claims it can distribute or replicate without tradeoffs, is lying :P
<Myrl-saki>
joepie91: Thanks again! I really appreciate it.
<joepie91>
the tradeoffs may be irrelevant to specific scenarios, but there's always *some* sort of tradeoff
<joepie91>
np :)
Guanin has quit [Ping timeout: 264 seconds]
<joepie91>
Myrl-saki: oh, also, possibly obvious but I don't know your background: have monitoring in place, so you know when you need to start worrying about scaling
rogue_koder has quit [Ping timeout: 260 seconds]
jrolfs has quit [Ping timeout: 240 seconds]
<joepie91>
exact measurements will vary by technologies used and your application; RAM usage and CPU usage are obvious metrics, but eg. in Node.js you'd want to measure event loop latency as well
<joepie91>
in Python you might want to measure GIL congestion (if that's even possible)
<joepie91>
and so on, and so forth
<Myrl-saki>
joepie91: I'm using Haskell, I guess my first step is RTS logging?
<joepie91>
ah, I have absolutely zero idea about Haskell :)
<Myrl-saki>
joepie91: Oh. :P
<joepie91>
Myrl-saki: what's the tl;dr of what RTS does/is?
<boomshroom>
I've run into a problem trying to build relibc. One of its dependencies (compiler_builtins) is directly taken from its github repository. The lock file does specify a commit hash, but nix is still having trouble pulling the dependency.
thefloweringash has joined #nixos
notdaniel has joined #nixos
rosa has quit [Quit: rosa]
<Myrl-saki>
joepie91: I don't use Haskell for applications, so I haven't tinkered with the RTS, but basically, from what I understand, the RTS is what "manages" the Haskell program, something along the lines of the CLR with .NET applications, I think?
<joepie91>
so the runtime basically?
<Myrl-saki>
joepie91: Yeah, RTS stands for Runtime System.
<joepie91>
ahh, right.
<joepie91>
I'm not sure whether it exposes any meaningful metrics, but collecting runtime logs is always a good idea :)
<joepie91>
I think Haskell probably has concurrency down to a point where you don't need any equivalent of event loop latency / GIL congestion measurements
<joepie91>
from what little I know of it anyway
rosa has joined #nixos
asuryawanshi has joined #nixos
Guanin has joined #nixos
asuryawanshi has quit [Remote host closed the connection]
<Myrl-saki>
joepie91: Thanks, I'll go read up on how to write Haskell for applications. I know a few problems such as GC stalls and mem "leaks"
<joepie91>
Myrl-saki: ah, GC time might be a good measurement
pie_ has quit [Ping timeout: 240 seconds]
notdaniel has quit [Quit: Leaving]
Myrl-saki has quit [Read error: Connection reset by peer]
drakonis has quit [Read error: Connection reset by peer]
Myrl-sak1 has joined #nixos
asuryawanshi has joined #nixos
Myrl-saki has quit [Ping timeout: 268 seconds]
asuryawanshi has quit [Ping timeout: 260 seconds]
loonquawl has joined #nixos
fiddlerwoaroof has quit [Ping timeout: 240 seconds]
tghume has quit [Ping timeout: 265 seconds]
<boomshroom>
Thanks nix. That was a very helpful 10 lines. On an unrelated note, would you mind showing me what came before? Thank you very much.
blonkhart has quit [Quit: WeeChat 1.9.1]
Myrl-sak1 has quit [Read error: Connection reset by peer]
jrolfs has joined #nixos
Myrl-sak1 has joined #nixos
fiddlerwoaroof has joined #nixos
ericsagnes has quit [Ping timeout: 248 seconds]
Myrl-sak1 has quit [Read error: Connection reset by peer]
FRidh has joined #nixos
jrolfs has quit [Ping timeout: 256 seconds]
b has quit [Quit: Lost terminal]
fiddlerwoaroof has quit [Ping timeout: 265 seconds]
tghume has joined #nixos
rogue_koder has quit [Ping timeout: 240 seconds]
Myrl-sak1 has joined #nixos
Myrl-saki has joined #nixos
Myrl-sak1 has quit [Ping timeout: 276 seconds]
Arcaelyx has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
fiddlerwoaroof has joined #nixos
Myrl-sak1 has joined #nixos
ericsagnes has joined #nixos
<jack[m]>
TIL; acme cert renewals are awesome. But services may need restarting
Myrl-saki has quit [Ping timeout: 248 seconds]
fiddlerwoaroof has quit [Ping timeout: 264 seconds]
<TimePath>
jack: or just signalling with SIGUSR1 or similar
fuzzy-id has joined #nixos
<fuzzy-id>
i had to repartition, so i rsynced everything from the partition and back to it, the system is now up and running again; i did 'nix verify --all' and get a lot of entries like these:
<fuzzy-id>
path '/nix/store/zlqrv5r8wxfkhx09f4vdcip99w52lx7f-glibc-locales-2.26-131' was modified! expected hash 'sha256:0000000000000000000000000000000000000000000000000000', got 'sha256:0ylr9mxrwqvbn9cza230p9vjmjd0sjaai3f554s88ny3wj41rp6w'
<fuzzy-id>
i'm on a raspberry pi (aarch64) with nixos unstable…
<boomshroom>
fuzzy-id: If it expected a null hash, that might mean the file/folder itself may be empty. Can you check what's in it to make sure?
jrolfs has joined #nixos
jrolfs has quit [Ping timeout: 248 seconds]
marusich has joined #nixos
alex`` has joined #nixos
<boomshroom>
I've finally managed to build relibc as a derivation! 😓 Now to make an stdenv that builds using it.
<elvishjerricco>
boomshroom: There was a PR recently that added support for musl as a libc implementation. I think that was the first major alternate libc mainlined into nixpkgs. Might be a good inspiration for using relibc.
fiddlerwoaroof has joined #nixos
<elvishjerricco>
mainlined into stdenv, that is
<fuzzy-id>
boomshroom: most of them (236) are not empty
<fuzzy-id>
there are only 2 empty dirs: fc-cache and system-generators
<boomshroom>
elvishjerricco: The big differences that I can think of are 1. I have no plans of mainlining this in the near-term, 2. musl is a recognised triple component that gcc (probably) understands.
marusich has quit [Ping timeout: 240 seconds]
<boomshroom>
fuzzy-id: If you're fine waiting forever, `nix-store --verify --check-contents --repair` will usually fix most problems. If it doesn't fix it, we have big problems.
ertes has quit [Ping timeout: 268 seconds]
<boomshroom>
elvishjerricco: I'm actually looking into the 'custom' stdenv where the stdenv gets passed from the nixpkgs config, which I can set when importing.
ma27 has joined #nixos
rauno has quit [Remote host closed the connection]
jrolfs has joined #nixos
johnw has quit [Ping timeout: 256 seconds]
andersk has quit [Remote host closed the connection]
<ambro718>
oh it started, but now it's printing garbled download progress
cmollekopf has joined #nixos
<cmollekopf>
Hi, has anyone had any success with getting debug symbols installed into ~/.nix-profile/lib/debug? The debug symbols build just fine, but I can't get them installed for the life of me...
jrolfs has joined #nixos
jrolfs has quit [Ping timeout: 240 seconds]
loonquawl has quit [Quit: loonquawl]
<srk>
ambro718: happens only once during a rebuild due to nix2 switch
tomberek has quit [Ping timeout: 260 seconds]
<ambro718>
right, I suspected so :)
<srk>
further rebuilds are not garbled
<srk>
:)
<boomshroom>
Making a custom stdenv with a custom libc was a lot easier than I thought it would be. Easier than building the dang libc itself! The only problem is ld is looking for crt1.o which is build into libc.o.
ericsagnes has quit [Ping timeout: 264 seconds]
cfricke has joined #nixos
hakujin has joined #nixos
hakujin has quit [Ping timeout: 276 seconds]
ambro718 has quit [Quit: Konversation terminated!]
amir has quit [Read error: Connection reset by peer]
amir has joined #nixos
<pcarrier>
wow, nixos as a vmware guest works really well
schmittlauch_ has joined #nixos
<schmittlauch_>
ohai
<schmittlauch_>
I try to install nixos for the first time, but always get "could not download … from any binary cache". How can I wor around such errors?
rogue_koder has joined #nixos
jrolfs has joined #nixos
<boomshroom>
schmittlauch_: What's the output of `ping -c 3 8.8.8.8`?
mrkgnao has quit [Ping timeout: 252 seconds]
i-am-the-slime has joined #nixos
jrolfs has quit [Ping timeout: 240 seconds]
<i-am-the-slime>
Hello there! Can anybody help me to keep spacemacs from crashing when opening any haskell file?
<boomshroom>
i-am-the-slime: sorry. I don't know much about spacemacs.
rauno has joined #nixos
<boomshroom>
I'm not sure if I should still be here. It's 2 in the morning.
spion has quit [Ping timeout: 248 seconds]
<boomshroom>
I'm being kept awake though determination to make this work!
<i-am-the-slime>
It's 10 in the morning, you should get some sleep :D
<boomshroom>
10: is what my alarm is set for on weekends. When I didn't have an alarm, I slept clear through to 2 in the afternoon.
spion has joined #nixos
Zer000 has quit [Quit: Leaving]
vidbina has joined #nixos
<schmittlauch_>
boomshroom: I can connect to the internet if you mean that (pinging works). Some packages even get downloaded successfully until 1 fails
<schmittlauch_>
ah, looks like the nix rw store is full. My VM only has 1.5GiB RAM and it lies in a tmpfs
troydm has joined #nixos
<isHavvy>
This may be due to 16697 commits....
<schmittlauch_>
but I didn't plan to use swap, so if this is the reason for failure I should probably move the /nix/.rw-store somewhere else
boomshroom has quit [Ping timeout: 268 seconds]
<schmittlauch_>
why doesn't it write the nix stor onto the install target hard disk?
Fare has quit [Ping timeout: 248 seconds]
<gudea[m]>
Hey guys, I just received an email: The status of Hydra job ‘nixos:release-18.03:nixpkgs.qbs.x86_64-linux’ has changed from "Success" to "Failed". For details, see
<clever>
schmittlauch_: thats a bug that was recently introduced
<gudea[m]>
This arrived at an email address I use in commits but have no Github notifications sent to.
<gudea[m]>
There is no List-Id: or unsubscribe header which is rather unprofessional.
<clever>
gudea[m]: what is your github username?
<gudea[m]>
clever: phi-gamma
<clever>
email?
<gudea[m]>
clever: can I reach you through mail?
<clever>
you can PM me on irc
aarvar has quit [Quit: Leaving.]
jrolfs has joined #nixos
aarvar has joined #nixos
thc202 has joined #nixos
JosW has joined #nixos
aarvar has quit [Client Quit]
freeman42x]NixOS has joined #nixos
jrolfs has quit [Ping timeout: 264 seconds]
georges-duperon has joined #nixos
nix-noob has joined #nixos
<vidbina>
I am not being the brightest today... am reading through the buildFHSUserEnv files and can't figure out how to symlink a work directory into my FHS hierarchy in a nix-shell file that uses buildFHSUserEnv.env any pointers to help me figure this out?
nix-noob has quit [Client Quit]
<vidbina>
the shellHook is kind of "special" and appending or prepending to it doesn't seem to get my what I want. Considered extraInstallCommands but can't notice the output of a "ln -s target /here" in the FHS setup.
periklis has quit [Remote host closed the connection]
periklis has joined #nixos
rauno has quit [Ping timeout: 240 seconds]
coot has joined #nixos
<vidbina>
clever: thanks... the runHook is executed before the shellHook but I need to set up the symlink after the last line of shellHook which states `exec ${chroot-user} ${init "bash"} "$(pwd)"` otherwise I have no symlink permissions into root, right? Am I misunderstanding the setup or trying to do something that is bad practice?!?
<vidbina>
clever: problem is that after that exec the thing forks out, right?!?
<clever>
exec doesnt fork, it just hijacks the current process
<clever>
but if your using overrideDerivation, your able to replace or mutate shellHook however you want
<vidbina>
clever: oh yeah, just replaces the current process... by bad... okay... So I guess I'll have to do that. Was hoping that there would be smoother way into this. Thank you so much. You are all so quick to provide any tips when I'm getting stuck. Makes my Nix(OS) experience practically feasible :D
<vidbina>
and pleasant
<clever>
overrideDerivation also passes you the old attributes
<clever>
so you can do shellHook = "prefix\n" + drv.shellHook;
<vidbina>
clever: which I already had, but then I run into permission issues which led me to believe that I may have to symlink inside the chroot env.
<clever>
ah, yeah, the issue is that your destination is in the store
<clever>
so you need to override something sooner, not later
<clever>
it has to be done during the nix build
<clever>
why does it have to be an FHS env anyways?
jesuspc has joined #nixos
<vidbina>
clever: to (more) closely mirror a debian setup as a first attempt to rebuild some Yocto images on my setup and then slowly move towards a more Nix-ish solution.
<clever>
what is yocto?
<vidbina>
clever: used the CROPS containers before, but now I'm wanting to do some experiments in QEMU and want to run the VM's on my host rather than starting them inside a docker container (which intuitively doesn't make too much sense to me). Yocto = toolset for build linux distros for embedded applications.
<jesuspc>
Hello. I'm experimenting with nixos and I started writting my first derivation. As part of the build it uses curl, so I added curl to buildInputs. Even though when I run nix-build I get "curl: (77) error setting certificate verify locations". But when I open the nix-shell the same curl commands works properly. Is that normal?
<clever>
this is an embeded OS i wrote a year or 2 ago
asuryawanshi has joined #nixos
<clever>
vidbina: it uses nix to build everything, and ends with a kernel, initrd, and root.squashfs
<symphorien>
How comes I received a mail for a Hydra failure of a job whose I am even not a maintainer ?
<symphorien>
for a package* sorry
<clever>
symphorien: it also check the git log
<symphorien>
Ah ok
<symphorien>
So if I am pretty sure I didn't touch any dependency, I can safely ignore it
<vidbina>
clever: dope. lassulus mentioned not-os to me yesterday. I'll try to build it and if I have any questions, I'll know where to find you. Have you abandoned the project due to lack of time? Which hardware have you tested this on?
jrolfs has quit [Ping timeout: 240 seconds]
asuryawanshi has quit [Ping timeout: 245 seconds]
<clever>
vidbina: i think i ran it once on a raspberry pi, but i mostly just tested it under qemu
<clever>
vidbina: it was more as an example/base that others can build upon and i havent really done much else with it
ottidmes has joined #nixos
<snajpa->
vidbina: chmming in on not-os, it's really cool that nixos/nixpkgs let themselves be bent this way
<snajpa->
*chimming
aarvar has joined #nixos
<clever>
yeah, its surprising how easily i can just grab certain nixos modules whole, and recycle them
<manveru>
so... i'm looking for ways to make https://github.com/NixOS/nixpkgs/pull/35334 possible to merge without having to include thousands of lines of package.json and yarn.lock files...
<manveru>
the way it works right now is, that it gets the checksums for the npm packages from the yarn.lock, which is in the repo of the package i'm trying to build
<manveru>
but it seems like that's not pure enough for nix
<vidbina>
snajpa: have you used not-os on a production device? It's really cool indeed. It also looks like a more maintainable codebase. I just read commit one and I'm smiling at how maintainable this feels from a first impression.
davidlt_ is now known as davidlt
<snajpa->
vidbina: we are about to, in about 2-3 months from now
<snajpa->
there's still some work on the management backend
<snajpa->
aha, those were the series where IPMI was still a separate board :D
timokau has quit [Ping timeout: 260 seconds]
<clever>
snajpa-: i dont think i have that module
<manveru>
John882: there's a "reproduce locally" thing in the actions
<John882>
manveru: ok, thanks. Btw without the sig practically we risk that we are a hacker target
<John882>
I mean mint got hacked and they exchanged the iso and the sha256
<John882>
some years ago an a huge ammount of people got ....
<MichaelRaskin>
John882: ISOs are built automatically
<snajpa->
clever: there's a few things which differ significantly when compared to OpenWRT - it's got routing/network interfaces completely controllable through UCI (where in nixos, I still haven't managed to build a config which passes rebuild switch without network downtime, expecially if there's bridging involved)
<clever>
John882: nix does sign the iso store paths, with the hydra key, and everything is uploaded directly to https://cache.nixos.org
<MichaelRaskin>
An attack against the server can make it build ISO from a wrong source
michalrus has joined #nixos
<clever>
John882: if you go to the details page on hydra, find the store path, and run `nix-store -r <storepath>` it will download from https://cache.nixos.org, and check the signatures
<snajpa->
clever: and the other one would be that openwrt knows about all the different flash layouts of all the devices, so it produces correct uboot and kernel/initrd images to be loaded to correct adresses
<michalrus>
I’m experiencing a very weird issue. On an EC2 instance, when running nix-instantiate, disk IO goes up crazily and the instance freezes.
<manveru>
John882: the problem with automatic signatures is that they're automatic... so you can just change the nixpkgs source and it'll sign the output :P
noam has quit [Read error: Connection reset by peer]
<michalrus>
:o
<clever>
snajpa-: i dont have bridging at play in my config, i use an external switch to deal with that
noam has joined #nixos
<John882>
manveru: If you sign the file automatically with your gpg. If someone attacks the website needs to have access to your gpg
<John882>
or there is no way he can sign the iso
<clever>
snajpa-: recently, i upgraded my router from 16.03 to 17.09, with only ~30 seconds of downtime, not enough to break any tcp sessions
<MichaelRaskin>
John882: the ISOs are built on the site, on the server
<MichaelRaskin>
Automatically and without supervision
<clever>
snajpa-: and thats after converting it from nixos-rebuild to remotely controled via nixops
noqqe has joined #nixos
<noqqe>
hi
<manveru>
John882: so where do you put your gpg key/passphrase?
<John882>
MichaelRaskin: hmmm I understand but it's not a good thing for privacy
<snajpa->
clever: does it recreate ifaces like vlans from scratch? ie. if it exists, it destroys it and still creates a new one? because it looks to me like this is the heart of the problem
<noqqe>
i recieve all kinds of build mails for packages i was never participating in from hydra
<clever>
snajpa-: in my setup, it doesnt recreate any network interfaces
xeji has joined #nixos
<MichaelRaskin>
John882: then you need to find someone who is willing to hand-pick base revisions for the ISO.
<John882>
manveru: you put the gpg pgp.mit.edu and you sign the image with your gpg
<clever>
snajpa-: but i have noticed an anoyance with how it uses iptables
<clever>
snajpa-: its not using iptables-restore, and that causes performance and packet loss during reload
<manveru>
John882: the point is, the "build server" is the person that'd sign it, which means the pass phrase has to be on the build server
<manveru>
John882: which means, if you have access to change iso and hashes, you could just access that as well
<clever>
snajpa-: iptables uses read/copy/update lists, so every time you run an iptables command, it has to clone the entire list of rules, then update a pointer to them
<clever>
snajpa-: and that leads to non-atomic changes, so packets can be ran thru half your rules
<clever>
and each change requires more cpu then the last, due to the copying
<John882>
manveru: Yeah I have understood this but. It is really bad for security actually, would be better to make the iso 1 weekly tbh
<cocreature>
noqqe: if you figure it out let me know. it looks like it emails everyone that commited in some timeframe (probably since the last release)
<John882>
well I came here just for suggestions, since nixos seemed intresting and wanted to try it
<MichaelRaskin>
John882: you don't realy need the ISO
<John882>
but yeah downloading the unsigned isos...
<MichaelRaskin>
You can get the Nix from a fe wweeks ago
hiroshi has quit [Ping timeout: 260 seconds]
<John882>
uhm?
<noqqe>
cocreature: ah good.
<noqqe>
The status of Hydra job ‘nixos:release-18.03:nixpkgs.qbs.x86_64-linux’ has changed from "Success" to "Failed".
<MichaelRaskin>
Build it, use it to build nixos-install from a checkout from a few weeks ago
<noqqe>
"This may be due to 16697 commits by .... "
<noqqe>
yeah probably everyone gets those mails
<manveru>
noqqe: yeah :|
<MichaelRaskin>
install NixOS using the locally-built tools from weeks-old repositories
<clever>
MichaelRaskin: you could also just build the iso locally with nix
asymmetric has joined #nixos
<John882>
MichaelRaskin: Can you link me to the checkout from a few weeks ago, please?
<kini>
Anyone have any idea what's causing these emails? 16697 commits? What happened?
<xeji>
hydra seems to have mutated into a spambot
<clever>
kini: probably a merge commit of some kind
<asymmetric>
hey everyon
<asymmetric>
*e
<noqqe>
xeji: manveru cocreature im opening an issue at hydra atm.
<asymmetric>
is there a way to unsubscribe from hydra's emails? i don't remember signing up for them :)
<manveru>
Ideally hydra would bisect those and point to the actual failure ;)
<MichaelRaskin>
John882: I have the commit f6de73b4366754f7f1a064a4b7f948543a90d067 as Feb 28, and I hae made it more than a week ago according to my human memory
Itkovian has joined #nixos
<MichaelRaskin>
So if you clone nixpkgs and checkout that commit, it is highly unlikely that things mentioned in this commit, including packages source hashes, did not exist on March 1
<aristid>
i must've missed the release of nix 2.0 oO
i-am-the-slime has quit [Remote host closed the connection]
<manveru>
MichaelRaskin: well, before it sends out mails to thousands of people...
i-am-the-slime has joined #nixos
<MichaelRaskin>
John882: I don't understand your request. If you clone the fresh version from https://github.com/nixos/nixpkgs and check out the commit with that hash, you have it
<manveru>
even if you build from nixpkgs directly, you'll still have to trust all the committers, most of which don't sign their commits
<MichaelRaskin>
If you do not trust git (maybe you need git fsck for extra confidence) to give you the same content as me, I have bad news for you — the entire Nixpkgs development process can never produce anything that suits your needs.
<manveru>
or at least the maintainers that merge them
<manveru>
John882: once you have the repo, you can build your iso with `nix build -f ./nixos/release-combined.nix -A nixos.iso_minimal.x86_64-linux`
<MichaelRaskin>
manveru: that's why I gave a hash of my own week old commit: there doesn't seem to be a panic right now, so even if there is an attack, it is more likely to be more recent
<manveru>
yeah
<manveru>
i'm just wondering what an actual "secure release" of nixos would look like :)
John882 has quit [Ping timeout: 256 seconds]
<MichaelRaskin>
manveru: I think Hydra spam actually goes to way less than a hundred people per incident, but oh well
georges-duperon has quit [Quit: Leaving]
jrolfs has joined #nixos
<manveru>
752 people in this email
<michalrus>
Re: this EC2 freezing; what’s interesting, when I run it with --verbose, it doesn’t freeze…
<MichaelRaskin>
At some point I have explained why 1000 work hours + 3 months of wall-clock time is likely to be enough to compromise NixOS integrity for forseeable future.
scribbler has quit [Remote host closed the connection]
<michalrus>
=(
scribbler has joined #nixos
<MichaelRaskin>
manveru: hm, maybe there is also that increased build interval. Unfortunate.
kuznero has joined #nixos
<MichaelRaskin>
On the other hand, bisecting will mean that as a side-effect the channel will just never go forward.
<manveru>
it's not thousands, but it should at least be opt-in then
<manveru>
agreed
kuznero has quit [Client Quit]
<manveru>
the good news is, nixos is growing fast :D
<MichaelRaskin>
We should document maintainers.nix better, maybe
<MichaelRaskin>
(maybe create a human-only email attribute separate from the default email that is also for Hydra)
<cocreature>
these mails are not based on maintainers.nix, they are based on mailing addresses in git commit messages
<manveru>
maybe we could add a meta attribute to it for receivi... yeah
<manveru>
oh?
<clever>
MichaelRaskin: that doesnt help with the case of hydra pulling emails out of `git log`, the first user i saw complain wasnt even in maintainers-list.nix
<cocreature>
I’m not the maintainer of anything and I’m getting all those emails
<cocreature>
just because I made a PR at some point that got merged
<clever>
the biggest problem i think, is that hydra just went over 16k commits, and emailed every single user
<MichaelRaskin>
Ah, that does sound a bit too aggressive.
<clever>
it should abort if the commit log gets that big
jrolfs has quit [Ping timeout: 268 seconds]
<MichaelRaskin>
Yes, that's true
<gchristensen>
eh
<cocreature>
and it also emails every user for every failure, I hope it stops in the foreseeable future :)
<gchristensen>
it emailed ~16k but who cares, each person received only so many
<clever>
gchristensen: and at least one user has complained and asked for an unsubscribe link
<manveru>
i got at least 12 mails so far
<gchristensen>
it doesn't email users
John882 has joined #nixos
<cocreature>
I got 17 emails in the last hour so far
<clever>
ive got none!
<MichaelRaskin>
gchristensen: going over 16k commits and mailing all authors for every independent failure (we normally have hundreds)…
<John882>
MichaelRaskin: sorry got disconnected for the server can you re-link the signed checkout?
<MichaelRaskin>
It is not signed, I just say it existed before 1 March
Itkovian has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<John882>
uhm
<gchristensen>
it emails maintainers
<MichaelRaskin>
And signing commits gives you _nothing_ in the Nixpkgs development model
<MichaelRaskin>
gchristensen: no, commit authors
<John882>
ok so there is no way I can download a signed iso right?
<gchristensen>
ah
<MichaelRaskin>
_and_ maintainers, but that's realistically included when we are talking of thousands of commits
<gchristensen>
John882: tragically no :( I could sign one for you from a key you can trust
<MichaelRaskin>
Why tragically?
<John882>
because it is a big security flaw not signing isos
<gchristensen>
having the bootstrapping tools (ie: nixos iso) signed is probably a really good idea
<gchristensen>
since its the first step in to the ecosystem
<MichaelRaskin>
John882: once again, it is _easier_ to get a malicious patch into Nixpkgs than attack ISO generation
<John882>
all you need to do is enter the website and gg
<MichaelRaskin>
Yes, bootstrap tools are a good idea to sign, as they don't change too often, and they can be checked by multiple people, and so on
<gchristensen>
MichaelRaskin: not bootstrap-tools in nixpkgs, but the user-end bootstrapping tools
<John882>
MichaelRaskin: If someone changes the iso it can change everyithing inside
<gchristensen>
John882: MichaelRaskin surely understands that :)
<MichaelRaskin>
John882: if you care about security, you should not go for an ISO anyway
<gchristensen>
oh jeeze please
<gchristensen>
this isn't fruitful
pkill9 has joined #nixos
<MichaelRaskin>
There are components that we use _only_ in ISO
<MichaelRaskin>
nix-build of a nixos-install is way more inspectable.
<gchristensen>
John882: would you like me to sign an ISO for you? you'll be able to validate it from my key on https://nixos.org/nixos/security.html
<John882>
gchristensen: If you can ofc!
<Dezgeg>
if someone gains access to the website wouldn't they also change the pgp signature on the webpage?
<gchristensen>
which one, John882?
<MichaelRaskin>
gchristensen: wait, how are you going to find out the proper sha256 hash?
rauno has joined #nixos
<manveru>
Dezgeg: yeah, without an existing web of trust it's yet another bootstrapping problem
<John882>
I don't mind, the one you choose
schmittlauch_ has quit [Ping timeout: 240 seconds]
<manveru>
reminds me of this quote: "Satan offers to prove to you that his code is safe by presenting an Authenticode certificate which will certify that Satan signed the class. You could verify that the signature is truly Satan's, but proof that it came from Satan is not proof that it is safe."
<clever>
lol
vidbina has quit [Quit: Lost terminal]
<John882>
manveru: Actually we can see the key of satan hosted on the Hell website
asuryawanshi has joined #nixos
<shlevy>
I don't necessarily disagree with any of the claims being made, but I'd love to see some viable options. Not claiming there aren't any, I'm genuinely curious and this is not an issue I've personally spent a lot of time exploring.
jrolfs has joined #nixos
spear2 has quit [Remote host closed the connection]
<John882>
gchristensen: uhm, it is even newer than the one on the download page?
<gchristensen>
yeah, the channel bumped but the website hasn't updated yet
MP2E has quit [Remote host closed the connection]
<John882>
okok
jrolfs has quit [Ping timeout: 264 seconds]
<nioncode>
I'm debugging an issue with SpaceFM (https://github.com/NixOS/nixpkgs/issues/31797). when it is installed, XDG_DATA_DIRS is mostly empty and spacefm segfaults. when I open a nix-shell based on its default.nix and print XDG_DATA_DIRS there, a bunch of other directories are seen and running spacefm from there works fine. what is the proper way to export XDG_DATA_DIRS for spacefm? do I have to wrap it?
<gchristensen>
John882: a signature file is coming, my internet is slow. another option someone brought up is using nix, which has a gpg signature, to fetch the ISO and nix will automatically validate the signature
<nioncode>
manveru: thanks. how do I figure out which paths are actually needed in XDG_DATA_DIRS? and shouldn't all things already be symlinked in my .nix-profile so that they are available to all applications?
John882 has quit [Ping timeout: 264 seconds]
<manveru>
nioncode: there's a difference between build-time env vars and run-time env vars
John882 has joined #nixos
Itkovian has joined #nixos
<John882>
gchristensen: I don not know while I am disconnecting still... btw I found out the sha from the server just waiting for the sig
<pstn>
Am I the only one getting tons of hydra emails about packages he's got nothing to do with?
<gchristensen>
how many is tons? I've gotten 6
<Yaniel>
about 60
<gchristensen>
ouch
<Yaniel>
and no pstn is not the only one
<gchristensen>
unfortunately this seems to happen when new channels are made
<shlevy>
We should turn off emailresponsible on new jobsets
<gchristensen>
then re-enablee?
<shlevy>
Maaaaybe
<gchristensen>
lol
<shlevy>
Only if we're cherry-picking
<shlevy>
if we're ever merging master into that branch then no
<pstn>
```This may be due to 16697 commits by [...]```, thanks, Hydra!
<pstn>
I'm not bothered by the mails, just thougt I let you know that hydra has gotten a bit spammy.
<Yaniel>
also what's the policy wrt nix2.0 features?
<Yaniel>
because placeholders seem to be blocking #36761
<gchristensen>
thanks pstn it only happens when we make new channels, but we should update the new release runbook to avoid the emails
<symphorien>
Maybe hydra could be taught to aggregate these emails
<gchristensen>
much harder than updating a runbook
<symphorien>
Then it would be much less annoying
<symphorien>
True
jrolfs has joined #nixos
John882 has quit [Ping timeout: 276 seconds]
John882 has joined #nixos
jrolfs has quit [Ping timeout: 260 seconds]
John882 has quit [Client Quit]
rauno has quit [Ping timeout: 265 seconds]
nyuki has joined #nixos
periklis has quit [Ping timeout: 255 seconds]
tsmeets has joined #nixos
<nyuki>
gchristensen: john882 has network problem and asked me if you can send me the signature of the iso
<gchristensen>
PM'd
<tsmeets>
Why did I get around 21 mails today about failed hydra jobs? Did something big break?
<clever>
nyuki: why does this feel like a mitm attack aided by a ddos? lol
<gchristensen>
tsmeets: we made a new release channel, so hydra is seeing all the broken packages break for the first time
<MichaelRaskin>
There is Nix 2.0 release, then there is Nix 2.0 as defalt Nix in Nixpkgs.
<aristid>
manveru: i think ISO 8601 prefers dashes
<aristid>
so 2018-02-22
<manveru>
i'm austrian, sorry
<clever>
at least your not american, getting your day and month swapped :P
<aristid>
[insert bad joke conflating austrian and swiss people]
<manveru>
:D
<gchristensen>
if you want to stick with 8601 but don't like dashes you can just skip them 20180311T112203Z
<aristid>
clever: mixed endian is just more efficient
asymmetric has quit [Ping timeout: 248 seconds]
<gchristensen>
don't like americans mixing up day and month? skip that too! 2018-070
<clever>
lol
<gchristensen>
maybe you're more week-oriented: 2009-W53-7
<gchristensen>
(ISO8601 is a terrible spec!)
rauno has joined #nixos
<sphalerite>
aristid: s/swiss/australian/
scribbler has quit [Ping timeout: 260 seconds]
<aristid>
woe is me. i wanted to use weechat's /lua command to print the current time in seconds since the unix epoch
<aristid>
but my weechat is too old to have /lua eval
Itkovian has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<aristid>
1520772213
ottidmes has quit [Quit: WeeChat 1.9.1]
<aristid>
turns out i don't need lua: /eval ${date:%s}
<aristid>
Why would anybody care about ISO 8601 if they can be nice and precise and use seconds since the UNIX epoch 1520772363 (admittedly ignoring leap seconds)
<MichaelRaskin>
Why do you still think in leap seconds (which implies non-metric years) instead of proper TAI, citizen?
nyuki has quit [Quit: WeeChat 2.0]
<aristid>
MichaelRaskin: because POSIX seconds is not specified in terms of TAI /o\
<gchristensen>
even TAI is flaweed
<gchristensen>
I prefer the imprecision of the unix epoch ;)
<MichaelRaskin>
gchristensen: true, TAI second count is flawed, but you want live long enough to check
<MichaelRaskin>
If you succeed in that, the small annoyance of TAI being flawed won't bother you
<gchristensen>
well they don't agree with each other if they're at different heights
<gchristensen>
what even is time, man
<MichaelRaskin>
But that correction is actually a known calculation.
<gchristensen>
:)
<manveru>
time = trying to express the number of rotations of massive bodies in an arbitrary solar system around each other...
<gchristensen>
the golden age of time was before trains probably
<MichaelRaskin>
time = measure of which server your email can rech with a given timeout
<MichaelRaskin>
gchristensen: the bliss of nonexistence?
<gchristensen>
it existed but wasn't so rigid
xcmw has joined #nixos
<Li[m]>
is there documentation on setting up a nixpkgs channel?
<Li[m]>
how do people propagate their nixpkgs tree efficiently? must be a channel right?
<clever>
Li[m]: i just pointed nix-channel to a webserver i controlled, and looked at the access.log to see what 404'd
<Li[m]>
clever: thanks ... :S
<jluttine>
anyone using nixos + (spac)emacs + haskell? just wondering if someone has ideas to set this up properly.. i'd like emacs to find the packages when it's doing syntax/code checking assistance
jrolfs has joined #nixos
<clever>
Li[m]: for the most part, its just 2 files in a directory, nixexprs.tar.xz and binary-caches
<jluttine>
i'm now running emacs inside a pure nix-shell. if i launch ghci, the packages are found, but inside emacs they're not found
* aristid
wonders how long it will take to get used to the nix 2.0 commands
<aristid>
jluttine: yes, multiple people, but unfortunately not me /o\
<MichaelRaskin>
aristid: no less than it takes for them to settle.
aristid has quit [Quit: WeeChat 2.0]
jrolfs has quit [Ping timeout: 264 seconds]
aristid has joined #nixos
<aristid>
it seems there is something wrong with the nix in nixpkgs:
<aristid>
i don't get manpages
<aristid>
$ man nix
<aristid>
No manual entry for nix
pie_ has joined #nixos
rardiol1 has joined #nixos
nuncanada has joined #nixos
<teozkr>
aristid: are you using nixos or on top of another distro?
<aristid>
teozkr: nixos
<teozkr>
oh, okay :/
<aristid>
but bash completion works \o/
jrolfs has joined #nixos
<the-kenny>
I don't have a man page for nix either
va1entin has joined #nixos
jrolfs has quit [Ping timeout: 268 seconds]
<Ankhers>
Is there something wrong with hyrda notifications? I seem to be getting dependency failed notifications for packages I do not maintain.
<seanparsons>
That explains why my inbox has been carpet bombed.
cfricke has quit [Quit: WeeChat 2.0]
va1entin has quit [Quit: WeeChat 1.9.1]
<Yaniel>
and the emails just keep coming
xcmw has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
schmittlauch_ has joined #nixos
rogue_koder has quit [Ping timeout: 260 seconds]
alexteves has joined #nixos
asymmetric has joined #nixos
rogue_koder has joined #nixos
<gchristensen>
unfortunately there is probably nothing we can do :(
<gchristensen>
* for this one
<MichaelRaskin>
At least ofBorg is no longer the noisiest bot?
<gchristensen>
hydra will have to send more mail than this to keep up!
xcmw has joined #nixos
<schmittlauch_>
ohai, I have a weird issue installing nixos on a UEFI system (part bootloader installation): when run by nixos-install, systemd bootctl fails to install the bootloader. But when I run the command given in the python trace manually, it succeeds.
vD2Kap has joined #nixos
<clever>
schmittlauch_: what did you mount to /boot/ ?
<h30[m]>
I remember encountering something similar and the `dotspacemacs-excluded-packages '(exec-path-from-shell)` approach worked for me
psychon_ has joined #nixos
<psychon_>
hi, does anyone have some hints on how I can avoid getting spammed by Hydra?
<sphalerite>
psychon_: set up a filter rule :/
<psychon_>
I got like 40 mails informing me that some build failed; apparently Hydra just collected the authors of like 20k commits and spams everyone
<sphalerite>
properly avoiding it is not possible AFAIK
<gchristensen>
sorry psychon_, Hydra got a new set of NixOS release jobsets added to it. This means for the first time it is finding lots of failures and sending mail. This won't continue much past today, even though it really sucks for today.
<gchristensen>
we're going to find a way to avoid this for the next release.
<psychon_>
in case your goal is to punish people just because they contributed one commit, you are succeeding (sorry, consider this line a rant and feel free to ignore it)
<MichaelRaskin>
Or maybe 544 — there are links in both directions, though
orivej has quit [Ping timeout: 256 seconds]
* psychon_
wonders how long this continues until some spam filter "learns"...
<gchristensen>
oh no
<gchristensen>
is hydra going to send all this mail again when it is fixed
<srk>
someone should kill the mailserver before :D
<sphalerite>
let's not fix it xD
<MichaelRaskin>
Please do not backport fixes for ZHF from master to 18.03 until Hydra mailing gets fixed?
<h30[m]>
I guess this means 18.03 is close at least...
<gchristensen>
no, we must carry on
<sphalerite>
+1 for "kill the mailserver"
<psychon_>
<gchristensen> is hydra going to send all this mail again when it is fixed <- I already have one of those for something with "hardened" and "v4l2loopback" in its job name
<sphalerite>
I don't think these notifications are critical really?
rihards has joined #nixos
<cmollekopf>
Is anyone here that understands how separate debug symbols are supposed to be installed in the user profile (if at all)?
<psychon_>
since I just got a new one (which this time was already flagged by my spam filter): how many different jobs are there? O.o
<clever>
psychon_: currently, 1062 jobs are failing
<gchristensen>
psychon_: but about 40,000
<psychon_>
okay, so 41 mails means I'm "almost there"
tmplt_ has joined #nixos
<MichaelRaskin>
I am not sure: does Hydra send «newly succeeding» emails, too?
<sphalerit>
MichaelRaskin: to maintainers definitely
<sphalerit>
To committers I'm not sure
knupfer has joined #nixos
<psychon_>
I got one mail "... has changed from 'Failed' to 'Success'." so far
<MichaelRaskin>
Ouch.
<clever>
The status of Hydra job ‘nixos:release-18.03:nixpkgs.plasma5.plasma-nm.x86_64-linux’ has changed from "Success" to "Dependency failed". For details, see
mrkgnao has joined #nixos
<gchristensen>
psychon_: what jobs have you received email for?
<psychon_>
gchristensen: lots of random stuff, anything specific you are interested in?
<psychon_>
the common part seems to be nixos:release-18.03:
<gchristensen>
psychon_: the prefix, like "Hydra job nixos:release-18.03:"
<gchristensen>
ok cool
<gchristensen>
email has been disabled for that jobset, hopefully that'll stop it
<psychon_>
after there is e.g. nixos.tests.mysqlReplication.i686-linux, but also nixpkgs.haskellPackages.gl-capture.x86_64-linus
<clever>
The status of Hydra job ‘nixos:release-18.03:nixpkgs.haskellPackages.elerea-examples.x86_64-linux’ has changed from "Success" to "Dependency failed". For details, see
<clever>
gchristensen: i suspect it might be a post-build hook slowly working thru backlogs
asymmetric has joined #nixos
<psychon_>
yup, I just got that ^ mail, too
<gchristensen>
Eelco says it should work
<gchristensen>
some mail is definitely still going to be in the send queue, but hopefully no new mail will be added
rardiol1 has left #nixos [#nixos]
ottidmes has joined #nixos
jrolfs has joined #nixos
hiroshi has joined #nixos
dkao has quit [Ping timeout: 260 seconds]
pie__ has joined #nixos
<clever>
Created at:Sun, Mar 11, 2018 at 11:43 AM (Delivered after 5 seconds)
schmittlauch_ has quit [Ping timeout: 245 seconds]
schmittlauch_ has joined #nixos
<clever>
aminechikhaoui: neat, i was considering making a gdb plugin that could just fetch that stuff from the binary cache
<aristid>
sphalerite: i've noticed that there's no manpage for nix, but if you just run "nix" without arguments, it says: "For full documentation, run 'man nix' or 'man nix-<COMMAND>'."
<aristid>
so the bug is either that there is no manpage, or that this message exists :)
<MichaelRaskin>
The former, and it is work-in-progress
<aristid>
excellent
<MichaelRaskin>
No idea about ETA…
<aminechikhaoui>
clever: yeah it's really useful and super easy to add, just imports = [ (builtins.fetchGit https://github.com/edolstra/dwarffs + "/module.nix") ]
asuryawanshi has quit [Ping timeout: 264 seconds]
<aristid>
MichaelRaskin: maybe the message could tell you to go to https://nixos.org/nix/manual/ until the manpage is ready
Mateon1 has quit [Remote host closed the connection]
<clever>
aminechikhaoui: neat
jrolfs has joined #nixos
<aristid>
aminechikhaoui: haha that is almost too clever
tmplt_ has quit [Quit: leaving]
hakujin has joined #nixos
vidbina has quit [Ping timeout: 260 seconds]
Myrl-saki has joined #nixos
jrolfs has quit [Ping timeout: 240 seconds]
hakujin has quit [Ping timeout: 256 seconds]
<aminechikhaoui>
well niksnut is pretty clever+awesome :D
<monotux>
the port I am trying to forward is in the example 12345, which is listed in the tcp_accepted set
<monotux>
but if I try to access the port from outside of my network it simply times out
dottedmag has joined #nixos
<Myrl-saki>
Is there any update on mutually dependent build machines?
<Myrl-saki>
Last time I tried it, on nixos-16.09, it deadlocked.
vD2Kap has quit [Ping timeout: 248 seconds]
joachifm has joined #nixos
iyzsong has quit [Ping timeout: 260 seconds]
infinisil1 has joined #nixos
rihards has quit [Quit: rihards]
georges-duperon has quit [Ping timeout: 255 seconds]
<psychon_>
just for the statistics: 10 new mails, the last one a minute ago (and one of them was about haskellPackages.curl-runnings.x86_64-linux going Failed->Success)
<cmollekopf>
aminechikhaoui: thanks for the suggestions. All I really need is that the debug symbols from e.g. /nix/store/7jjmm9c79dm8gm10g94hzr84069yqrxs-kube-develop-debug/lib/debug/ appear in ~/.nix-profile/lib/debug though. I already have the symbols available locally, it's just that I have to manually point to them via debug-file-directory...
fendor has joined #nixos
<clever>
gchristensen: oh, the tail and -j hid the real error
<clever>
gchristensen: something i saw when i went to ase2017, is that the absolute value of tests isnt very meaningfull, the difference is
<clever>
gchristensen: so it would help if ofborg knew the previous state of rocksdb on aarch64, and told me if i made things worse, or had no effect on it
<gchristensen>
yea
<clever>
either query hydra some, or just build it again from the common ancestor of my branch and master
d4g has quit [Ping timeout: 260 seconds]
ryanartecona has quit [Quit: ryanartecona]
blonkhart has joined #nixos
<nckx>
Oh cool a mail from Hydra.
<MichaelRaskin>
«a» mail?
nuncanada has quit [Ping timeout: 260 seconds]
<nckx>
‘Several’.
<psychon_>
nckx: I got 81 so far, how's your number?
<nckx>
I've just deleted them, but that sounds about right.
<thefloweringash>
I'm also at 81
Itkovian has joined #nixos
<nckx>
Anyone here have SSH + sudo iptables access to Hydra?
silver_hook has quit [Quit: ZNC 1.6.5+deb1 - http://znc.in]
silver_hook has joined #nixos
silver_hook has quit [Changing host]
silver_hook has joined #nixos
<tilpner>
Uh oh. Failed to list units: Process org.freedesktop.systemd1 exited with status 1
<psychon_>
those mails list 750 people, so 82 * 750 = 61500 mails
<leons>
82? Thats nothing. I'm at ~150 ^^
jrolfs has joined #nixos
patrl has joined #nixos
thblt has joined #nixos
MarkusBarthlen has joined #nixos
<nckx>
leons: Yay! You win. Expect an e-mail soon.
georges-duperon has joined #nixos
<leons>
nckx: I'm excited! Got lots of space in my inbox
jrolfs has quit [Ping timeout: 255 seconds]
patrl has quit [Quit: WeeChat 1.9.1]
georges-duperon has quit [Ping timeout: 256 seconds]
<noqqe>
is there any ETA on the fix for Hydra?!
MarkusBarthlen has quit [Remote host closed the connection]
xcmw has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
Tobba has joined #nixos
<aminechikhaoui>
cmollekop: hm I think you just need environment.enableDebugInfo = true;
coot has joined #nixos
<ottidmes>
What should you do when you have a option with a submodule type that has both options and config, but you do not use the values of the submodule, the submodule itself only uses them in the config part. It seems that due the lazy evaluation, it simply ignores the submodule.
rihards has joined #nixos
lohfu has joined #nixos
bkchr has joined #nixos
<bkchr>
Hi, I can not update my Nixos anymore. I think that is a problem with the nix update. I'm still on the old nix and can not upgrade to the newest. I get the following output, when I run `nixos-rebuild switch`.: https://pastebin.com/xTGZPz4T
enick_697 has joined #nixos
<clever>
bkchr: can you gist your configuration.nix file?
<clever>
normally, nixos-rebuild will try to build nix first, then use the new nix to build nixos
<clever>
--fast skips that first step
<ottidmes>
I guess I will just have to use actual modules instead of submodule types, since submodule's config blocks only seem to work for options of that module. And just use setAttrByPath to set the path I wanted to use for the module option.
<bkchr>
clever: But will this update to the newest nix?
<clever>
bkchr: that depends on what the nixpkgs define
<clever>
bkchr: though, the warnings in your pastebin imply your already on nix2
<earldouglas>
Is Hydra unusually noisy today? I'm getting hundreds of emails.
<clever>
earldouglas: its being discussed in #nixos-dev
<psychon_>
earldouglas: I proposed a single fix for nixpkgs some months ago and that single commit got me 94 mails so far... "a little noisy" is something else :-(
<clever>
bkchr: what does `ulimit -s` say?
<bkchr>
clever: 8192
<clever>
same here
Itkovian has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<clever>
bkchr: what about `nix-build '<nixpkgs/nixos>' -A system -vvv` ?
<fendor>
magnetophon, ok, that works now way faster
<clever>
fendor: only if your not on nixos
<NickHu_>
More specifically, my problem with dfhack is that the version from the binary cache is version alpha1, rather than r2; even the source of the nix expression seems to indicate the version is r2 though; can anyone reproduce?
<gchristensen>
samueldr: maybe coalesce it down to just one message in all cases to avoid the spam problems we banned the github bot for
<samueldr>
oh, with a stray `, it seems
<samueldr>
yes, sure!
<fendor>
k, then something is weird, because i am on nixos
<fendor>
17.09
psychon_ has quit [Quit: leaving]
Arcaelyx has joined #nixos
boomshroom has joined #nixos
<boomshroom>
Good morning!
ixxie has joined #nixos
<magnetophon>
boomshroom: good evening! ;)
jrolfs has joined #nixos
ryanartecona has quit [Quit: ryanartecona]
<fendor>
clever, soooooo... why dont i have it preinstalled?
<boomshroom>
magnetophor: Fun with timezones. I'm on the North American west coast.
<clever>
fendor: if your on nixos, then you should set nix.package = pkgs.nixUnstable; to upgrade it
<fendor>
in my configuration.nix?
<clever>
yes
<fendor>
ok
<fendor>
clever, what does that do exactly? adding new tools and packages or something like that?
<clever>
fendor: that changes the version of nix system-wide, and updates a few config files for nix
<clever>
nix-env only changes it for 1 user, and doesnt change any configs
<boomshroom>
I beleive apt-get and pacman have something similar where apt-get --update and pacman -Sy update the repos and apt-get --upgrade and pacman -Su installs.
periklis has joined #nixos
<fendor>
boomshroom, yeah, they do
jrolfs has joined #nixos
<sphalerite>
fendor: nixos-rebuild with --upgrade actually runs nix-channel --update and then does a normal rebuild
<sphalerite>
note that it's affecting root's channels (which is very likely what you want, even to update user packages), not user channels
knupfer has joined #nixos
<fendor>
ok, but no user space upgrade, good to know. i have defined some user-channels, not sure how useful they are ^^
<{^_^}>
[nixpkgs] @NeQuissimus pushed to release-18.03 « rofi: Fix patche
<manveru>
Looks like the release is nigh
<sphalerite>
which release?
<rawtaz>
the new stable
asymmetric has quit [Ping timeout: 252 seconds]
<sphalerite>
nixos stable?
<sphalerite>
it's still a couple weeks away
<rawtaz>
sure
<rawtaz>
pretty close :P
<MichaelRaskin>
Well, people who say «the end is nigh» use even weaker definitions of nigh.
vD2Kap has quit [Ping timeout: 248 seconds]
<sphalerite>
hah
<rawtaz>
lol
<rawtaz>
question: when upgrading from a stable to a stable version, is there any chance that NixOS leaves cruft behind in the system (that is, excluding the home directories and data folders), or is it really clean?
<rawtaz>
by clean i mean that an upgrade leaves the system in the same state as if you had reinstalled it and restored all your data and settings, as opposed to there being some leftovers from the previous version or similar
<sphalerite>
rawtaz: state like the data in databases will still be there
<sphalerite>
oh yeah, especially your home will not be "clean"
<rawtaz>
are we talking about databases the system maintain itself, i.e. that i never created?
<sphalerite>
although given your question that's arguably part of what would have been restored
<rawtaz>
no, of course, the home dirs are excluded. im just talking about the things i never created myself, so to speak
<sphalerite>
rawtaz: no
<sphalerite>
there's some stuff that's also dictated by stateVersion, like database versions and stuff. But that's part of the config
<sphalerite>
it's largely up to the services you run as well. Some are more stateful than others.
mounty has quit [Ping timeout: 260 seconds]
ertes has joined #nixos
FRidh has quit [Quit: Konversation terminated!]
<sphalerite>
But just plain nixos without any badly-behaved services, yes it will be as if you'd done a fresh install
<sphalerite>
bar the old generations that will still be available for rolling back to until you delete and gc them :)
<hlolli>
I'm trying to compile with Emscripten compiler, and Emscripten provides all its own tools for compiling. Includeing their own node binary. But as I'm a newb on nixos I'm quite confused to why I can't run the binary ```[hlolli@localhost:/opt/emsdk-portable/node/8.9.1_64bit/bin]$ which node
<sphalerite>
rawtaz: not really, they have different use cases.
<sphalerite>
rawtaz: users.users.*.packages can't be managed by the user themselves. The user profile (managed through nix-env) can.
xcmw has joined #nixos
<rawtaz>
ok. so to install packages we have: environment.systemPackages, users.users.*.packages, nix-env -i, nix-shell, and i think some more
<rawtaz>
sphalerite: yes, indeed. but if you have complete control over the system, so installing as root isnt a problem, then perhaps the users.users.*.packages way is recommended for packages that do not need to be system-wide?
periklis has quit [Ping timeout: 260 seconds]
<sphalerite>
it's a matter of personal preference really.
<sphalerite>
Depends on whether you want the nixos and user package versions tied together as well, for instance.
vD2Kap has quit [Ping timeout: 256 seconds]
<rawtaz>
it would be highly useful if there was a chart with the various ways to install packages, as well as each ways' pros and cons, that newcomers could review to make a more educated decision
jrolfs has joined #nixos
<MichaelRaskin>
rawtaz: and then at the middle of the chart the newcomers stop understanding what exactly is the chart still talking about.
John882 has joined #nixos
<MichaelRaskin>
nix-shell -p or nix-shell with shell.nix?
Myrl-saki has joined #nixos
Myrl-sak1 has quit [Ping timeout: 260 seconds]
jrolfs has quit [Ping timeout: 256 seconds]
Myrl-saki has quit [Read error: Connection reset by peer]
<rawtaz>
MichaelRaskin: im sure a chart like that could be made without confusing them TOO much :P
<rawtaz>
if theyre weary about those details theyre expected to look them up. the key point is getting an overview/summary of the pros and cons for these different ways of managing packages
<{^_^}>
[nixpkgs] @dezgeg pushed to release-18.03 « nix: Fix build on ARMv
<gchristensen>
samueldr: ^
<Dezgeg>
is that notification missing the last byte?
<joepie91>
did I hear somebody needing a flowchart
<joepie91>
:P
<MichaelRaskin>
Before Nix I wasn't sure why Illuminati and Freemasons needed to have different dogmas for different levels.
<MichaelRaskin>
joepie91: worse, a comparison chart
<joepie91>
[20:26] <MichaelRaskin> Before Nix I wasn't sure why Illuminati and Freemasons needed to have different dogmas for different levels.
<joepie91>
this should go on the Nix site as a testimonial!
<joepie91>
:p
<Dezgeg>
ah I see that's not the only instance, this as well: linux-copperhead: 4.15.8.a -> 4.15.9.
<joepie91>
no, but more seriously, we have user packages? this is news to me
<MichaelRaskin>
What do you mean, user packages?
<John882>
I was wondering if nixos works with btrfs good, on the website I can see it's working with ZFS
<joepie91>
users.users.*.packages
<gchristensen>
joepie91: sure
<MichaelRaskin>
Ah that. Apparently, that appeared after I stopped using mainline NixOS
<gchristensen>
... John882 sure
<MichaelRaskin>
Oh maybe I didn't notice.
<John882>
gchristensen: ok ty
<MichaelRaskin>
John882: My /nix/store is BtrFS
<John882>
so do you guys suggest btrfs or zfs?
<gchristensen>
typically, I suggest ext4
thblt has quit [Ping timeout: 264 seconds]
<{^_^}>
[nixpkgs] @dupgit opened pull request #36824 → Remove myself as a maintainer → https://git.io/vxePh
JosW has quit [Quit: Konversation terminated!]
<rawtaz>
John882: can you point me to what you read about ZFS? im curious
<rawtaz>
John882: 20:27 < John882> I was wondering if nixos works with btrfs good, on the website I can see it's working with ZFS
infinisil has joined #nixos
<rawtaz>
John882: i'd say ZFS any day
<rawtaz>
but im somewhat biased by liking ZFS and not btrfs :-)
<LnL>
yeah, doesn't really matter unless you have a specific reason or usecase to prefer a specific filesystem
<rawtaz>
in the end it depends on your usecase
<MichaelRaskin>
Yeah, doesn't really matter, you do have backups, right?
<rawtaz>
do i run ZFS for my most important data? hell yes. do i run it at my clients/customers? nope.
<John882>
<rawtaz>
would i run btrfs at my clients, or for my own important data? nope. am i running btrfs on my temporary linux desktop just to see how it works? yes.
<rawtaz>
there's no simple answer, depends on what you want and need and what you are invested in etc
<John882>
since I am using zfs (bsd) usually, I was wondering witch one should I choose
<boomshroom>
I'm trying out BTRFS, but my store on my laptop is ZFS because macOS doesn't support most linux filesystems. I'm thinking of switching my laptop's NixOS partition to ZFS to keep things consistent on the one device.
<gchristensen>
boomshroom: it is so cool that ZFS is pretty much the "lingua franca" FS now
blankhart has joined #nixos
<rawtaz>
hmm, https://nixos.wiki/wiki/NixOS_on_ZFS#How_to_install_NixOS_on_a_ZFS_root_filesystem explains how to install nixos with zfs root from an already running system, rather than for a completely fresh install on e.g. a VPS or new server youre setting up. i think the latter would be needed as most people set up new servers
<MoreTea>
hi y'all. is there a way to do nix-store -qR from a nix build itself?
<MoreTea>
I ranted about docker + nix, and think that I can actually build all the tools already.
<MoreTea>
There is nothing in theeady with the current spec
<MoreTea>
*nothing in the current spec that prevents me from doing this IMHO.
<LnL>
MoreTea: exportReferencesGraph
<boomshroom>
If I call nixos-rebuild or nix-env with a profile argument, will it switch the default profile for future invokations to that profile series? If not, how can I change the default series?
<{^_^}>
[nixpkgs] @dupgit merged pull request #36824 → Remove myself as a maintainer → https://git.io/vxePh
<{^_^}>
→ 3abce29a by @dupgit: Remove myself as a maintainer
<{^_^}>
→ 880311a5 by @grahamc: Merge pull request #36824 from dupgit/patch-
<gchristensen>
samueldr: ^ hmm a bit weird
<boomshroom>
Unrelatedly, is it possible to wrap GCC in such a way that it provides default flags when called? I'd like to spoof it so it doesn't think it's using a libc since the libc is in a nonstandard format.
<mog>
gchristensen, can you address mailing list about the hydra emails, i saw your github comment about it being mistake and being fixed but i imagine others havent
<gchristensen>
a great idea!
<mog>
thank you
<symphorien>
boomshroom: there is NIX_CFLAGS_COMPILE and NIX_LDFLAGS_COMPILE if I understand what you want correctly
<samueldr>
gchristensen: I'll take a look later, early evening
<samueldr>
seems to split at numbers
asuryawanshi has joined #nixos
<samueldr>
uh no, otherwise PR # wouldn't be there
<boomshroom>
symphorien: And that will be applied whenever I call the wrapped GCC or binutils?
<gchristensen>
samueldr: I mean the 4 messages per PR merge
<symphorien>
I think so
<gchristensen>
samueldr: the issue Dezgeg pointed out is probably b/c you have a \n at the end of your message
<boomshroom>
symphorien: Alternatively I could have the flags be global to a stdenv.
<symphorien>
you can export NIX_DEBUG=1 to see what happens I think
<samueldr>
there shouldn't be a \n, afaiui
<rawtaz>
hmm. is there any specific reason other than "noone did it" that there's no installation program in nixos? i mean something that is graphical OR curses based and that can help the user with the basics, such as partitioning/disks/filesystems, perhaps networking, and of course the default/basic configuration before installation?
<gchristensen>
rawtaz: I think a big part is it is less important due to how NixOS works
<gchristensen>
rawtaz: so the driving need isn't quite there
<gchristensen>
but... that is exactly as you say, because nobody did it ;)
<MichaelRaskin>
I would say: there are improvements to make even for the current user base, that _had to_ read some documentation.
<rawtaz>
gchristensen: im not sure i understand really. a lot of newcomers are more or less afraid of the partitioning disks part, and some may have trouble with the networking part.
<samueldr>
ah, first, the PR author is used instead of who closed it (issue filed)
<MichaelRaskin>
So the improvements to attract the people who won't skim the manual in advance are not the most attractive areas of work.
<boomshroom>
I have never installed Linux on a laptop and not been frustrated with Wi-Fi.
<rawtaz>
MichaelRaskin: i agree. the docs are pretty okay once you just read them carefully, but there's some nuances that need improvement :)
<samueldr>
and then, there is the issue wherein I don't think I can safely coalesce push events from PR merge events
<samueldr>
I could, though, simply not show PR merge
<LnL>
rawtaz: I know clever and manveru have played with making a ui for the installer
<MichaelRaskin>
rawtaz: we have a horrible PR backlog and we have given up on the issue count
<{^_^}>
[nixpkgs] @dtzWill merged pull request #36810 → glibc: patch to fix building w/musl-based stdenv → https://git.io/vxeE4
<{^_^}>
→ 82644c15 by @dtzWill: glibc: patch to fix building w/musl-based stden
<{^_^}>
→ 54c4c183 by @dtzWill: glibc: make fetchpatch optional ("? null"), just in case.
<{^_^}>
→ 0edb8f7b by @dtzWill: Merge pull request #36810 from dtzWill/fix/glibc-with-mus
infinisil1 has quit [Quit: WeeChat 2.0]
<rawtaz>
MichaelRaskin: do you mean in the sense that focus is better put on those people that CAN/DO read the manual, than those who cant be arsed/are too lazy? or do you mean in the sense that making sure the docs are top-notch is simply feeling more important?
asuryawanshi has quit [Ping timeout: 255 seconds]
<rawtaz>
MichaelRaskin: aww ;/ how can people help you with those things (people that cant really just dig in and write the code)?
<samueldr>
(though, sure we can try and improve on that!)
<rawtaz>
LnL: i see, do you know if there's anything about it online?
<MichaelRaskin>
Unfortunately, some parts are complicated process questions. And it is very hard to be taken seriously there without having written a non-trivial amount of code for the project, if only as a proof of understanding of scope.
<gchristensen>
samueldr: :) let me know when I should pull / update
<MichaelRaskin>
Maybe we need a lot of lightweight tests, which are still code but might require less experience.
mounty has quit [Quit: Konversation terminated!]
<samueldr>
I need to go out for a while, so it will definitely be during the evening
<{^_^}>
[nixpkgs] @knedlsepp opened pull request #36825 → WIP: pythonPackages.macfsevents: init at 0.8.1 → https://git.io/vxeMk
i-am-the-slime has quit [Quit: Konversation terminated!]
<rawtaz>
MichaelRaskin: do you mean people asking about how things work? that this is the majority of the issues?
<MichaelRaskin>
rawtaz: If you can just dig in and write the docs, it is also very useful
<boomshroom>
I see there's a nix-env --switch-profile. Is there anything similar for nixos-rebuild?
infinisil1 has joined #nixos
<LnL>
rawtaz: don't know the status of those and/or if they are still actively being worked on
jrolfs has joined #nixos
<infinisil1>
Whew, glad the mailspam is over gchristensen :P
<srk>
drained my battery quite a bit :D
<MichaelRaskin>
rawtaz: well, there are process issues in the sense of how to review PRs to minimise the risk of truly bad changes ever getting in, reasonably manage the risk of breakage, and still Do Something about the backlog accumulation.
<rawtaz>
MichaelRaskin: let me cut straight to the chase. my thoughts are basically this; 1) what are the main reasons people create issues - bugs/problems, general questions, feature suggestions? 2) for the main reasons people create issues, what can we do to manage that more effectively AND perhaps more importantly what can we do so that people dont feel they need to create as much issues.
<MichaelRaskin>
rawtaz: A significant share of both issues and IRC questions _are_ documentation shortcomings.
das_j has joined #nixos
<rawtaz>
MichaelRaskin: hm ok. im afraid i dont entirely understand what you mean by "process issues" - do you have an example or two perhaps?
<MichaelRaskin>
There are also bugs, of course, and then there are real problems with triaging the bugs by «fixed by other changes/forgotten-but-shouldn't-be»
<das_j>
Hey everyone, I tried to install the Hydra for testing purposes, but the channel mentoined in the manual doesn't work. Is there a more up-to-date channel?
John882 has quit [Ping timeout: 256 seconds]
<rawtaz>
MichaelRaskin: right, makes sense. do you feel that people not knowing much about the state of things or the project's roadmap is also a big factor contributing to issues? perhaps a lot of issues are about the same thing, and having some other information resource where those things are addressed would give people answers before they create (redundant) issues about it
<MichaelRaskin>
rawtaz: basically, there is the one big question of deciding what is good enough for a PR.
jrolfs has quit [Ping timeout: 240 seconds]
<MichaelRaskin>
Project roadmap is about major tradeoffs, and it's complicated, and it's not about the things newcomers usually ask.
<rawtaz>
ok
slyfox has quit [Quit: :)]
<bgamari->
how does one convince `nix build` to be more verbose in its output?
<bgamari->
e.g. print the log like nix-build used to
vD2Kap has joined #nixos
John882 has joined #nixos
vD2Kap has quit [Client Quit]
<tilpner>
bgamari- - I don't know, but maybe "nix log" works too for you
<{^_^}>
→ 8e478f8f by @mogorman: gnuclad: init at 0.2.4
<{^_^}>
→ 9a68c569 by @7c6f434c: Merge pull request #34067 from mogorman/gnucla
<boomshroom>
I want to make sure there are no profile collisions between NixOS and macOS before merging their stores.
<manveru>
uhm, i don't think you can easily merge stores between architectures
<clever>
manveru: i once ran armv6 and x86-64 on the same rootfs
<manveru>
i mean, you can, it just won't be much use
<manveru>
but either way profiles won't cause collisions if you only copy over /nix/store and not /nix/var
<boomshroom>
manveru: the profile issue actually seems fairly easy to resolve by just renaming the profiles. It's just sharing the store that's hard because it wouldn't pick up all the GC roots.
<manveru>
yeah, if you run garbage collection
jrolfs has joined #nixos
thblt has joined #nixos
mahalel_ has left #nixos [#nixos]
<manveru>
what exactly would you want to do?
<boomshroom>
manveru: Have NixOS and macOS using the same /nix partition with separate profiles.
Fare has quit [Ping timeout: 240 seconds]
<boomshroom>
But first, I'll need to resolve the fact that Mac and Windows love making other OSes inaccessible after updates.
nullvoid8 has joined #nixos
jrolfs has quit [Ping timeout: 240 seconds]
<sphalerite>
!m shlevy
loonquawl has quit [Remote host closed the connection]
<sphalerite>
huh? Is botbot not doing that thing anymore?
Fare has joined #nixos
<sphalerite>
oh noes, botbot doesn't seem to be logging just now either
<gchristensen>
[0__0], {^_^}, and {`-`} must not get along
<gchristensen>
l
scribbler has joined #nixos
slyfox has joined #nixos
<sphalerite>
gchristensen: must be some pretty serious animosity between them to stop botbot from logging any channels at all
<gchristensen>
=)
<gchristensen>
botbot seems to be on barely on life support, afaict
<sphalerite>
oh yeah, I see the code was last updated in May :/
Mateon3 has joined #nixos
<gchristensen>
they haven't replied to any of my attempts to contact them, either
<gchristensen>
and I've made many
<sphalerite>
ah :/
lexokay has joined #nixos
<lexokay>
sup?!
Mateon1 has quit [Ping timeout: 256 seconds]
Mateon3 is now known as Mateon1
Itkovian has joined #nixos
<MichaelRaskin>
I guess for logging our current best bet is matrix.org…
<gchristensen>
yikes
<sphalerite>
^
<lexokay>
guys, i'm writing a program, and I would like to distribute \ invoke it with nix-shell --pure. And here goes problem. My program assumes user have UTF8 locale, but --pure makes locale equals to "POSIX" . and my program crashes on POSIX locale. How should I fix that?
<manveru>
lexokay: add `LC_ALL = "en-US.UTF-8";` in your shell.nix?
<sphalerite>
lexokay: make it not crash on POSIX ;)
<lexokay>
great! let me try that, 1 min
<manveru>
well, and that :)
<manveru>
what language are you using?
<sphalerite>
I think that should be an underscore, as in en_US.UTF-8 and not en-US.UTF-8?
<manveru>
true
<manveru>
i'm not fully awake anymore :P
tomberek has joined #nixos
<sphalerite>
MichaelRaskin: or maybe trying to collate multiple people's weechat logs?
<sphalerite>
gchristensen: you have logs going pretty far back, don't you?
<gchristensen>
2016
<gchristensen>
Jan
<tomberek>
Has anyone run into the "Guru Meditations" error in virtualbox using nixops?
<{^_^}>
→ c2c9d393 by @dtzWill: runc: 1.0.0rc4 -> 1.0.0rc
<{^_^}>
→ 3cfbc9e6 by @dtzWill: Merge pull request #36455 from dtzWill/update/runc-1.0.0rc
Havvy has joined #nixos
marusich has joined #nixos
<lexokay>
hmmm.... here is my shell.nix https://hastebin.com/liwenuqino.js how should I correctly specify env var locale? does it require any additional packages?
<lexokay>
manveru
<manveru>
lexokay: it should go into the derivation
<manveru>
i'm not sure if runCommand supports it, but i think it should
<lexokay>
errm? how to code that?
<manveru>
add it after your buildInputs in the same attrset
Itkovian has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<rvolosatovs>
hey everyone, I'm trying to set up a remote server with LUKS+LVM. I want to use Dropbear to start SSH in initrd to unlock the root partition. My problem is that network interface is not available in stage 1 by some reason. Only loopback device is at /sys/class/net and ipconfig returns 'eno2: SIOCGIFINDEX: No such device'. Any ideas how I can make my internet interface available at stage 1?
hamishmack has quit [Quit: hamishmack]
<rvolosatovs>
I also tried setting up internet myself(it's static IP) in boot.preLVMCommands using `ip ..` and I also get `ip: SIOCGIFFLAGS: No such device`
jrolfs has quit [Ping timeout: 248 seconds]
nullvoid8 has quit [Quit: Konversation terminated!]
hamishmack has joined #nixos
<manveru>
clever: ^
<manveru>
:)
vidbina has quit [Ping timeout: 264 seconds]
<manveru>
but sounds like you need to load your kernel modules first?
<gleber_>
Somehow I am unable to make `extra-socket` option of `gpg-agent` to work on my NixOS laptop :/ Anyone seen this before?
nullvoid8 has joined #nixos
<lexokay>
i'm bad adviser, but I would suggest to build manually initrd and write script manually for initrd, then get all networking drivers modules work, and then move up higher to nix option boot.initrd.preDeviceCommands and others to add your own config
civodul has joined #nixos
<boomshroom>
How well does NixOS play with having /nix on a separate partition?
<MichaelRaskin>
Perfectly, I think
hamishmack has quit [Ping timeout: 240 seconds]
<boomshroom>
I nearly have everything from mac and NixOS in the same store! Now I'm going to need to reconfigure NixOS so it points to the new store. (Though I'll probably just reinstall since I'd rather have one zfs pool than zfs and btrfs side by side)
<rvolosatovs>
Could it be related to the fact that the name of the interface is "eno2" and not "eth0" or similar?
scribbler has quit [Ping timeout: 264 seconds]
<rvolosatovs>
lexokay: can you give some pointers on how to do that? Can I something like `mkinitcpio`?
nullvoid8 has quit [Quit: Konversation terminated!]
simukis has quit [Remote host closed the connection]
<hyper_ch>
infinisil1: ?
<infinisil1>
hyper_ch: or not?
<infinisil1>
I thought you wrote this section anyways
<infinisil1>
the one i linked above
<hyper_ch>
infinisil1: what is this about?
<hyper_ch>
nah, original one was clever I think or gchristensen
<lexokay>
there are nix options like boot.initrd.preDeviceCommands and boot.initrd.postDeviceCommands and others https://nixos.org/nixos/options.html#initrd that let you override internal initrd shell script, but first you might want to read that shell script and fix the error for your case
<infinisil1>
hyper_ch: ah you wrote the one below about the zfs format change though :)
<hyper_ch>
infinisil1: also, he uses lvm/luks and not native zfs encryption
<infinisil1>
hyper_ch: yeah but the initrd network part should be the same
<hyper_ch>
infinisil1: no idea about that part
<boomshroom>
I was about to load the nixos installer onto my USB stick. Guess what I found on it when I checked its contents? :P
<lexokay>
i've tries my strategy for plain dm crypt , and it worked for me
<lexokay>
*tried
<hyper_ch>
he should just switch to native encrypted zfs
<lexokay>
boomshroom shrooms?
<boomshroom>
lexokay: The installer I was going to put on it.
<lexokay>
)
Itkovian has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
mkoenig_ has joined #nixos
<rvolosatovs>
infinisil1: after looking through that article I started to think that maybe it's the kernel module of internet device that is not getting loaded, trying to find out if that's the case...
mkoenig has quit [Ping timeout: 264 seconds]
<infinisil1>
hyper_ch: heh yeah
<shlevy>
sphalerite: What'd I do to earn that? :)
<infinisil1>
hyper_ch: I haven't yet..
<lexokay>
rvolosatovs makes sense
<hyper_ch>
infinisil1: you should as well
<lexokay>
maybe the driver not incuded to initrd by default, and you may try include ut
<sphalerit>
shlevy: your emails
<shlevy>
Ah :)
paraseba has quit [Disconnected by services]
<infinisil1>
hyper_ch: I keep thinking about switching after i implemented my zfs tool, which would allow super nice backing up and syncing between machines, but that might take a while until I'm done with that..
<MichaelRaskin>
Is «shlevy pushed commits» and «oxij merged PR» the same event ,actually?
<shlevy>
Ugh yes
<MichaelRaskin>
In a sense, it's the other way round
<shlevy>
Yeah
<boomshroom>
I do I make nix remove invalid GC roots?
<rvolosatovs>
It worked! I'm in! Had to add the igb module to boot.initrd.kernelModules. Thanks everyone!
orivej has joined #nixos
<Mic92>
/g/go 19
<rvolosatovs>
There are 2 issues I encountered though: the name of the interface differs from the one in OS(it's eth0 in initrd and eno2 in OS); Second, documentation of boot.initrd.network.enable is wrong: 'The network may be configured using the ip kernel parameter, as described in the kernel documentation' is not true, as the ipconfig in initrd(which turned out to be ported from Arch) does not support DNS server setting
jrolfs has joined #nixos
<gleber_>
The problem I had was due to `--supervisored` flag, which makes `gpg-agent` ignore `extra-socket` and instead expects systemd-style activation socket env-driven configuration.
jesuspc has quit [Remote host closed the connection]
pie__ has joined #nixos
<epta>
I was updating from 16.03 to 17.09, and 'sudo nixos-rebuild switch' failed with 'rm: cannot remove '/var/setuid-wrappers': Device or resource busy'
<epta>
Is there any known workaround?
jrolfs has quit [Ping timeout: 240 seconds]
<ottidmes>
rvolosatovs: With regards to your first issue, you can use networking.usePredictableInterfaceNames = false; to get the old naming scheme consistently between the initrd and the OS, just make sure to use udev rules to make them predictable again (fixed to the mac address)
mahalel_ has quit [Remote host closed the connection]
<clever>
epta: instead use `nixos-rebuild boot` and then reboot the machine
<Fare>
what's the process for a 18.03 (or .04) release?
mahalel_ has joined #nixos
epta has quit [Quit: WeeChat 1.4]
blankhart has quit [Ping timeout: 276 seconds]
hiratara has quit [Ping timeout: 276 seconds]
hiratara has joined #nixos
<MichaelRaskin>
People try to fix Hydra failures on 18.03 branch
jwynn6 has quit [Ping timeout: 245 seconds]
mahalel_ has quit [Remote host closed the connection]
mahalel_ has joined #nixos
das_j has quit [Quit: WeeChat 2.0.1]
Fare has quit [Read error: Connection reset by peer]
hamishmack has joined #nixos
scribbler has joined #nixos
vidbina has joined #nixos
Itkovian has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
mounty has joined #nixos
mahalel_ has quit [Remote host closed the connection]
<rawtaz>
MichaelRaskin: what do you think about: automate adding a comment to all open issues older than X days, something like "Is this issue still relevant? If it's been resolved, or is no longer relevant, please close it. This is part of an effort to clean up lingering issues."
<rawtaz>
MichaelRaskin: there's surely a lot that arent current anymore.. i dont think anyone minds a comment asking them to assess the status of their issue and asking them to close it if it's not relevant anymore.
<MichaelRaskin>
Well, if it is not done too often, then probably.
hakujin has quit [Ping timeout: 260 seconds]
coot has quit [Quit: coot]
blankhart has joined #nixos
<rawtaz>
perhaps it has eben done recently, i have no idea. i took a peek at issues and the second one i found that's a bit old was literally said to be resolved, it just hadnt been closed.
<boomshroom>
This was around since 2012? Wow. 6 years and very little progress towards it.
<rawtaz>
if it's done, the message should probably include something like "If unsure, please try to reproduce the issue again using the latest version." as well. and it should be done after the next stable release, of course
mahalel_ has quit [Quit: Leaving.]
<rawtaz>
it should be formulated in a way such that people are encouraged to close the issue if it's been resolved, but not to add a comment if the issue persists, as that would probably add too much noise
mahalel_ has joined #nixos
MP2E has joined #nixos
m has joined #nixos
hakujin has joined #nixos
<MichaelRaskin>
Well, a short current reproduction would be an improvement.
m is now known as Guest72347
Guest72347 is now known as epta
<MichaelRaskin>
Maybe the first step should be a fuzzy search for apparently-resolved issues to close.
<rawtaz>
yeah thats a good idea if it's doable
<rawtaz>
hard to search for though
<MichaelRaskin>
I guess this requires downloading the text of all issues, then gradually improving a script
<rawtaz>
worth nothing in general that there ARE issues that are many years old but still relevant. e.g. #2079
<MichaelRaskin>
Yes, sure
<rawtaz>
right, you dont know of any "issue maintenance tools" on github?
<rawtaz>
they should have that >_<
<boomshroom>
How can I use ZFS within the nixos installer? It's complaining that the modules aren't loaded.
xcmw has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<boomshroom>
I tried adding zfs to the configuration.nix, but the file is read-only when on the installer.
<rawtaz>
i guess to install it on zfs from the installer you need the kernel to have the zfs support loaded
xcmw has joined #nixos
simukis has joined #nixos
jrolfs has quit [Ping timeout: 264 seconds]
<boomshroom>
chmod +w seems to work.
Fare has joined #nixos
alex`` has quit [Ping timeout: 245 seconds]
simukis has quit [Ping timeout: 240 seconds]
mahalel_ has left #nixos [#nixos]
ma27 has quit [Ping timeout: 245 seconds]
<rawtaz>
boomshroom: which config file are you modifying? during what environment, an installer image?
lexokay has quit [Quit: Page closed]
<boomshroom>
rawtaz: I'm currently booted off a USB with the NixOS installer.
hakujin has quit [Ping timeout: 256 seconds]
hakujin has joined #nixos
<boomshroom>
the page linked earlier says to make the zfs partition use a legacy mountpoint. Can anyone here confirm that? Making it legacy might complicate things on the macOS side.
ma27 has joined #nixos
<rawtaz>
boomshroom: right, so youre modifying the configuration.nix on the installation image, then switching
<boomshroom>
Yes.
<boomshroom>
Not specific to NixOS: Do any of you know if it's possible to expand an existing zpool? I've deleted the BTRFS partition that used to hold NixOS as I want it to be a part of the same pool as the store.
<rawtaz>
you can always add disks to the pool if thats what you mean?
<rawtaz>
"disks"
<boomshroom>
So I can't resize the existing block, but I can add a new block and make it a part of the pool?
scribbler has joined #nixos
hakujin has quit [Ping timeout: 265 seconds]
hakujin has joined #nixos
jrolfs has joined #nixos
<MichaelRaskin>
rawtaz: by the way, if you start doing something nontrivial about triage of PRs and issues, you could want to start with old entries by Nixpkgs members.
Itkovian has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<rawtaz>
MichaelRaskin: such as?
ma27 has quit [Ping timeout: 256 seconds]
<MichaelRaskin>
Well, I did add some labels like «by:nixpkgs-member», but these are not always present
<MichaelRaskin>
Members are shown in the GitHub UI with a «Member» badge
Itkovian has joined #nixos
<rawtaz>
why would those be more relevant than other issues (to triage i mean)?
jrolfs has quit [Ping timeout: 260 seconds]
<MichaelRaskin>
Not more relevant, lower-risk
<MichaelRaskin>
PRs from nixpkgs members should ideally be a separate count from the non-member PRs (because the process implications are really different)
freeman42x]NixOS has quit [Ping timeout: 240 seconds]
hakujin has quit [Ping timeout: 245 seconds]
mahalel_ has joined #nixos
<rawtaz>
mm well i probably wont touch PRs. if i do something, it's likely going to be polishing some parts of the documentation as i go along and try to give some input in some issue(s), and if i were to do anything advanced it would just be with issues for starters. PRs is a different beast
<boomshroom>
It looks like zfs is capable of autoexpanding if there's room, but I can't seem to get it to use the space left behind by BTRFS.
<rawtaz>
boomshroom: i really dont know well enough, but i suggest you ask in #zfs - they should know :)
<MichaelRaskin>
Well, issues by members are also lower-risk, in terms of members have enough experience to hopefully have correct expectations about the level of effort required
<rawtaz>
MichaelRaskin: i fail to understand what risk you are talking about in that context, if what we're discussing is just bumping the issue to see if any of them can be closed :)
<MichaelRaskin>
We have seen outsiders having completely wrong impression about, well, many things. Including level of authoritativeness of people's statements and level of consensus inside the project.
<MichaelRaskin>
Well, whatever and however you say, people can get it wrong.
hakujin has joined #nixos
xcmw has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
ericsagnes has joined #nixos
asymmetric has joined #nixos
aarvar has quit [Ping timeout: 256 seconds]
civodul has quit [Quit: ERC (IRC client for Emacs 25.3.1)]
xcmw has joined #nixos
Itkovian has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<rawtaz>
right. you mean that if one were to provide some input, doing so on issues where people have a better understanding about the context might have less risk for misunderstandings etc.
mahalel_ has quit [Quit: Leaving.]
mahalel_ has joined #nixos
<MichaelRaskin>
Misunderstandings, out-of-context perceptions, implications of authority (a person with access shouldn't feel intimidated by a reasonable triage question)…
Itkovian has joined #nixos
scribbler has quit [Ping timeout: 245 seconds]
Itkovian has quit [Client Quit]
nuncanada has joined #nixos
xcmw has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<manveru>
rawtaz: you got some C++ experience? :)
infinisil1 has joined #nixos
genesis has quit [Read error: Connection reset by peer]
davidlt has quit [Ping timeout: 260 seconds]
genesis has joined #nixos
<gchristensen>
please check my latest email to the ML for some questions and feedback on ofborg's next feature!
chisui has quit [Ping timeout: 260 seconds]
mahalel_ has quit [Quit: Leaving.]
mahalel_ has joined #nixos
<infinisil1>
gchristensen: :O
hakujin has quit [Ping timeout: 265 seconds]
mahalel_ has left #nixos [#nixos]
mahalel_ has joined #nixos
hakujin has joined #nixos
<{^_^}>
[nixpkgs] @nixy opened pull request #36831 → [WIP] linux: Add options for deblobbed kernels → https://git.io/vxeAW
mahalel_ has left #nixos [#nixos]
<infinisil1>
gchristensen: Some feedback: Have it post a comment "All jobs succeeded, will merge in 1 hour", and then only merge in an hour without intervention
<gchristensen>
I'm stepping out, please send that to the ML or github isue :)
mahalel_ has joined #nixos
<infinisil1>
Ah yeah sure
<rawtaz>
manveru: not to any relevant degree im afraid. mostly c++ on arduino lately, and its not something i fancy at all :>
asuryawanshi has joined #nixos
<manveru>
damn, i'm still looking for someone to help me with the nixos-installer :|
<rawtaz>
MichaelRaskin: noted
<rawtaz>
MichaelRaskin: ooh ok
<rawtaz>
manveru: ooh ok*
<rawtaz>
manveru: did you ever touch base with clever?
<manveru>
i'm trying to use https://calamares.io/ and got it more or less working, just that the C++ parts need some modification to write to a configuration.nix instead of trying to modify the system themselves
<rawtaz>
you guys seem to be moving towards the same goal but in parallel
<rawtaz>
hm, your project page says "Combining the power of Nix, Guile & Elm to install NixOS" - did you scrap that for calamares, or is it not exclusive?
<manveru>
yeah, i gave up on that
<manveru>
built a simple installer with it, but partitioning is too hard
<rawtaz>
quite hairy, i imagine :) so you ditched that and now calamares is the main component
<manveru>
aye
asuryawanshi has quit [Ping timeout: 240 seconds]
jrolfs has joined #nixos
<rawtaz>
ah its the calamares branch
<boomshroom>
How do I set the nix builders within NixOS? Nothing comes up when I search "builder" in the NixOS options.
<manveru>
calamares uses the partitioning tool from the KDE Partition Manager
<rawtaz>
manveru: did you ever touch base with clever, the person who is/was working on the same type of thing?
orivej has quit [Ping timeout: 268 seconds]
<rawtaz>
aha. well that's fair enough.
<clever>
manveru: ive got some bash scripts to fully automate installing nixos, and have a gui installer i was working on at one point
<rawtaz>
clever: what's your take on using calamares?
<manveru>
clever: i don't think i ever got it to build
<boomshroom>
found it: nix.buildMachines
<rawtaz>
and in general what's your take on the status of your installer thing? :)
<clever>
havent tried it calamares
<clever>
rawtaz: the partition editor and configuration.nix editor still need work
<Guanin>
Can someone explain me how nixpkgs are organized? As I use 17.09-small, I guess I'm using the branch release-17.09. Let's say a PR gets merged into master. Does this eventually reach the release-17.09 branch?
<rawtaz>
is there anything with nixos that you feel require custom partitioning stuff or is it pretty much like any other distro you install?
<clever>
Guanin: the channels are all branches on the nixpkgs-channels repo
<rawtaz>
i dont know of anything that's out of the ordinary on that part
frem has quit [Quit: Connection closed for inactivity]
<clever>
rawtaz: i prefer using zfs for the filesystem, with /nix on its own dataset so it doesnt get snapshotted
Itkovian has joined #nixos
<clever>
rawtaz: and a 512mb /boot partition, plus some swap
jrolfs has quit [Ping timeout: 240 seconds]
<rawtaz>
clever: do you have a guide for the installation steps for that anywhere?
fendor has quit [Quit: Leaving]
<clever>
rawtaz: i have a bash script that automates the whole thing
<rawtaz>
clever: interesting, gonna try that some day. but for now i have more pressing things to investigate in the NixOS world :I
<{^_^}>
[nixpkgs] @knedlsepp opened pull request #36833 → petsc: fix darwin build → https://git.io/vxexC
<rawtaz>
so regarding installers, it seems to me that both clever's and manveru's installers are more or less equally evolved. both mostly work, just need that final piece of the puzzle
xcmw has joined #nixos
<manveru>
yeah... probably combining both would be a good step :)
<manveru>
use clevers logic with calamares UX
tertle||eltret has joined #nixos
<rawtaz>
which in a way is too bad, cuz then it's harder to establish which one should be focused on :) i think it's good to have it based on something like calamares as that's a good foundation. but surely clever's has some good sides too
<rawtaz>
yeah. and clever's is 50% c++, which is what the missing piece in manveru's is about :-)
<clever>
rawtaz: i couldnt fully make up my mind on what to make the UI in
<manveru>
unfortunately i don't plan on learning C++ anytime soon, so that's why i put it on ice
<clever>
rawtaz: it started out in QT
<clever>
but then i redid it in QX
<clever>
because i wanted it to be http based
<rawtaz>
i agree. combining efforts to finally produce an installer for NixOS is reasonably the most productive way forward
<clever>
so you could remotely control the installer
<rawtaz>
clever: thats not a bad idea at all, i like that
scribbler has joined #nixos
<clever>
so you could just run it on a remote server and then connect to it over http
<rawtaz>
manveru: could you update the readme in yours so people who find it can try it out?
<manveru>
i shall do that tomorrow night :)
<manveru>
gotta get some sleep first
<rawtaz>
clever: yeah exactly. heck, most times i install a server i dont have a monitor for it and am too lazy to fire up the virtual console, so that would be nice to be able to install it remotely
<rawtaz>
manveru: sleep well!
<clever>
rawtaz: yep
<rawtaz>
manveru: is there anything like remote install capabilities (e.g. over HTTP(S) in calamares afayk?
<clever>
rawtaz: the files in here generate a tarball
<clever>
scp that to practically any server, unpack to /, and run /kexec_nixos
<clever>
within 30-60 seconds, its running nixos from ram, reconnect ssh
<clever>
then run justdoit
<clever>
when thats done, reboot, it now runs nixos
<clever>
only issue, is that you have no way to recover from any mistakes, because you cant just plug in a usb stick and reboot it
<rawtaz>
wow. hmm. that's similar to the end goal of e.g. nixos-infect or nixos-assimilate..
<clever>
yep
<rawtaz>
man. the nixos world is one where there's a lot of redundant work being done
<clever>
but kexec allows you to repartition the machine as you infect it
jrolfs has joined #nixos
<clever>
the other tools reuse the existing partition layout
<rawtaz>
yeah, but cant you do that with the others too?
<rawtaz>
hmm ok
<clever>
one of them (i forget which) just does a single-user nix install on the host OS
<clever>
then upgrades it to full nixos
<clever>
so your stuck with whatever FS and partition layout the machine started with
<rawtaz>
it would be seriously kick-ass if there was support for hostile takeover like this in the regular installer :)
<rawtaz>
so it can eat up anything
<clever>
but kexec lets you change the fs, and even add luks
<rawtaz>
yeah thats great
mahalel_ has quit [Remote host closed the connection]
<rawtaz>
is kexec usually enabled though? is it something one can enable on an existing system without rebooting it or similar?
<clever>
its a kernel option that is enabled on most systems
mahalel_ has joined #nixos
<rawtaz>
well rebooting isnt a problem if youre going to reinstall it anyway, so scrap that :D
<rawtaz>
ok
<clever>
you can also manually edit the grub config, and do it without kexec
hakujin has quit [Ping timeout: 252 seconds]
mahalel_ has quit [Remote host closed the connection]
<clever>
just copy the kernel&initrd to /boot, and add it as the default in grub config
mahalel_ has joined #nixos
<clever>
then it will always boot into the installer
<clever>
until the installer overwrites /boot
<rawtaz>
yeah
<clever>
the initrd contains the entire rootfs
jrolfs has quit [Ping timeout: 245 seconds]
Lisanna has joined #nixos
<rawtaz>
not-os seems similar
hakujin has joined #nixos
<disasm>
is binaryCaches in 18.03 no longer additive? I have a custom binary cache listed in binaryCaches, and it's building everything from scratch. For example, this version of zziplib that hydra has showing as successful: https://hydra.nixos.org/build/70736283
<{^_^}>
[nixpkgs] @badi opened pull request #36834 → qtkeychain: 0.7.0 -> 0.8.0, fix darwin build → https://git.io/vxepU
rvolosatovs has quit [Quit: WeeChat 2.0]
scribbler has quit [Ping timeout: 256 seconds]
mahalel_ has quit [Quit: Leaving.]
mahalel_ has joined #nixos
<clever>
disasm: everything hydra builds is automatically uploaded to cache.nixos.org
freeman42x]NixOS has joined #nixos
<clever>
disasm: hydra no longer has the capability to store anything, it caused too many IO issues