<Jmabsd>
Yaniel,Ralith: There are about 7 relevant CPU architectures.
<Jmabsd>
Finding only ONE available prebuilt, which is the CRAPPIEST of all of them, is a great surprise
<clever>
Jmabsd: 32bit x86 is also prebuilt
<Jmabsd>
The Linux kernel itself has crap problems enough, so running a fairly crap kernel on ultra-crap CPU:s only, well.
<Jmabsd>
Anyhow I see you're at another phase in the design process where CPU arch hasn't mattered so much so you just took commodity hardware, however, a grown up child knows more archs.
<Yaniel>
that's a lot of salt for someone who just joined the channel
<{^_^}>
[nixpkgs] @freepotion opened pull request #47381 → boohu: init at 0.10.0 → https://git.io/fAxVy
<Jmabsd>
Yaniel: yes sorry. i was looking around for any Linux distributions to migrate to.
<Jmabsd>
bbl.
Jmabsd has quit [Quit: Leaving]
<Yaniel>
...then mayyyybe you should also mention what special requirements you have
<samueldr>
!?
<emily>
gj feeding the troll
<samueldr>
anyone up for the Z80 with 68k co-processor port? (jk)
mizu_no_oto has joined #nixos
jasongrossman has joined #nixos
dozn has joined #nixos
mayhewluke has quit [Ping timeout: 245 seconds]
mkoenig has joined #nixos
mayhewluke has joined #nixos
mizu_no_oto has quit [Quit: Computer has gone to sleep.]
ADD_Sidekick has joined #nixos
<{^_^}>
[nixpkgs] @magnetophon opened pull request #47382 → zita-njbridge: init at 0.4.4 → https://git.io/fAxwo
<ADD_Sidekick>
So how is SElinux on NixOS these days? Still taking a back seat to apparmor and gsecurity?
sir_guy_carleton has joined #nixos
<hakujin>
what am I doing wrong here? I want to install `nix-prefetch-git`. I'm on macOS mojave. I had a multi-user install but axed it in favor of a single user reinstall due to the mojave nonsense. when I run `nix-shell -p nix-prefetch-git` I build like all of clang, cmake, and a zillion other things (hours) before failing during building nix itself
<hakujin>
error: `make: *** [mk/tests.mk:12: installcheck] Error 1` on `builder for '/nix/store/djlq3x3m31zaa4d5mcxm8qhijgfzgkna-nix-2.1.2.drv' failed with exit code 2`
<elvishjerricco>
hakujin: Sounds like you're not using cache.nixos.org for some reason
<elvishjerricco>
(also, I'm curious, what was wrong with multi-user on mojave?)]
<hakujin>
yep appears that way
<elvishjerricco>
hakujin: Does cache.nixos.org appear in `/etc/nix/nix.conf`?
<hakujin>
is their some combo of mojave + unstable leading to recompiling everything?
<hakujin>
s/their/there
<clever>
clang should still be in the cache
ADD_Sidekick has quit [Quit: ADD_Sidekick]
graphene has quit [Remote host closed the connection]
jperras has quit [Quit: WeeChat 2.2]
<hakujin>
clever: I'm happy to eradicate my (non-functional, ish) current install in favor of starting over. would lingering bits of multi-user interact strangely with a new single-user install?
<elvishjerricco>
hakujin: What happens when you run `nix ping-store --store https://cache.nixos.org`?
graphene has joined #nixos
<hakujin>
ah, hmm
<elvishjerricco>
hakujin: Also, check that there's no `~/.config/nix/nix.conf` file
<hakujin>
`error: executing SQLite statement 'delete from NARs where ((present = 0 and timestamp < ?) or (present = 1 and timestamp < ?))': attempt to write a readonly database (in '/Users/hakujin/.cache/nix/binary-cache-v5.sqlite')`
<elvishjerricco>
oh
<elvishjerricco>
hakujin: `rm -r ~/.cache/nix` :P
<clever>
it sounds like you ran something with sudo, and darwin was nice enough to leave $HOME unchanged
<clever>
so now root owns your cache!
<hakujin>
hah!
<hakujin>
yeah, immediate success
<hakujin>
thanks!
<{^_^}>
[nixpkgs] @jtojnar pushed 112 commits to gnome-3.30: https://git.io/fAxrH
slack1256 has quit [Ping timeout: 240 seconds]
acarrico has quit [Ping timeout: 252 seconds]
<{^_^}>
[nixpkgs] @dtzWill merged pull request #47365 → spectral: init at 2018-09-24; nheko: 0.5.0 -> 0.6.0 and bump dep mtxclient → https://git.io/fAxtM
andreabedini has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
lostman has quit [Quit: Connection closed for inactivity]
xok has joined #nixos
andreabedini has joined #nixos
<kandinski>
I just installed a vagrant plugin using `vagrant plugin install` and it doesn't work. Before I try debugging it another way, should I have done anything differently?
<kandinski>
To be clear: I followed instructions to create a nix-shell that would expose the right version of bundler, and installation of the plugin does work, the plugin installs. It's when I try to use it that I get an error.
sir_guy_carleton has quit [Quit: WeeChat 2.0]
Sonarpulse has quit [Quit: Leaving]
Rusty1 has quit [Quit: Konversation terminated!]
jasongrossman has quit [Ping timeout: 252 seconds]
jasongrossman has joined #nixos
jasongrossman has quit [Ping timeout: 252 seconds]
<teto>
kandinski: does it install plugins in your $HOME ? probably the plugin assumes sthg that doesn't work on nixos. What d oyou mean by "doesn't work"; do you have any error message. Set verbosity to max and looks for hints. Or wait for someone whoc actually uses vagrant :) (what plugin?)
<kandinski>
yeah, it's vagrant-lxd and I've already enabled verbosity, found it's trying to start a container but fails.
<kandinski>
I don't know why yet
<kandinski>
it appears lxc is failing to connect to the lxc command socket
<kandinski>
this is no longer a vagrant issue: I'm running the lxc-start command by hand
<teto>
kandinski: first thing would be to find the failing command (either in log or via strace) and try to do it manually. You might not have rights for the socket/ wrong location. Can you launch containers manually ?
endformationage has quit [Ping timeout: 252 seconds]
<kandinski>
teto, that's what I've done
<kandinski>
05:22 < kandinski> it appears lxc is failing to connect to the lxc command socket
<kandinski>
05:23 < kandinski> this is no longer a vagrant issue: I'm running the lxc-start
<kandinski>
command by hand
<kandinski>
yes, I think it may be a permissions/group issu
<kandinski>
e
jasongrossman has joined #nixos
hamishmack has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
mayhewluke has quit [Ping timeout: 240 seconds]
mayhewluke has joined #nixos
hyper_ch2 has joined #nixos
jasongrossman has quit [Ping timeout: 272 seconds]
<hyper_ch2>
sphalerite: I looked at that and gave up :)
<Phlogistique>
sphalerite: well, of course it does
<sphalerite>
Phlogistique: huh, I don't think I've ever seen them. Maybe it's because I was on debian before nixos and debian has the whole GFDL-does-not-comply-with-DFSG issues, and now I'm on nixos where they're not visible because of a bug x)
<Myrl-saki>
Yes, gcc does have man pages.
<Phlogistique>
indeed, the manpage for GCC is a GFDL document with invariant sections
<Myrl-saki>
NAME
<Myrl-saki>
gcc - GNU project C and C++ compiler
<jonge>
hi there, i have some integration tests (like the one in <nixpkgs>/nixos/tests/login.nix) in a project that is built by my local hydra instance. it does however build the project but does not schedule the actual tests. i _did_ add the following to my build machine config: supportedFeatures = ["kvm" "nixos-test" "big-parallel" "benchmark"]; but to no avail. any ideas?
<Phlogistique>
well, the manpage for GCC under Ubuntu mentions the titles of some invariant sections, but the invariant sections are just not there, so I wonder if Ubuntu is violating the GFDL
<Phlogistique>
whatever...
<srhb>
jonge: Can you gist /queue-runner-status from your hydra instance?
marusich has quit [Quit: Leaving]
<srhb>
jonge: And when you say it doesn't schedule them, do you mean they're queued but never run?
<LnL>
kvm is the only thing you need for nixos tests AFAIK
<srhb>
jonge: "supportedFeatures" : [],
<jonge>
wow, how can that be... it's in my nixos config.
<srhb>
jonge: Maybe you're getting a local builder instead of the distributed setup?
<srhb>
jonge: Might want to share the config :)
<LnL>
I don't see any machines tho, is this just a single machine setup?
<jonge>
oh right... the hydra config still says "buildMachinesFiles = [];", maybe that is a blocker? one moment, i will remove it.
<srhb>
jonge: I think you just need distributedBuilds enabled and to have it in buildMachines..
<jonge>
srhb: LnL: it does now work after i removed the buildMachinesFiles = [] item from the hydra config.
<srhb>
jonge: Great :)
<LnL>
ah, yeah you can make hydra use a different machines file
makefu has joined #nixos
<jonge>
ok this is a stupid mistake. i was the one who clarified the nixos wiki a bit writing down exactly this solution. *facepalm*
<srhb>
jonge: Haha. You win some, you lose some :-P
<Phlogistique>
When I do 'nix-env -iA nixos.gcc nixos.glibc.static', 'gcc -static' says 'cannot find -lc'; however inside 'nix-shell -p gcc glibc.static' it works. How can I understand why?
<symphorien>
,library Phlogistique
<{^_^}>
Phlogistique: Don't install libraries through nix-env or systemPackages, use nix-shell instead. See https://nixos.wiki/wiki/FAQ/Libraries for details.
jasongrossman has joined #nixos
<sphalerite>
anybody have any fancy tricks for working out why a binary contains a reference to some path (gcc in this case) when it's not in the dynamic section?
<srhb>
sphalerite: strings?
<sphalerite>
srhb: that only really helps me determine that there *is* a reference, not so much how it gets there :/
<srhb>
sphalerite: Well, once you have a binary that contains a string, don't you already know that the compiler did that?
<srhb>
inb4 compiler breakpoints during nix build.
<sphalerite>
I ran genericBuild in a nix-shell to try and trace it
<symphorien>
sphalerite: radare2 can probably answer that but it is not easy to use
<sphalerite>
all the binaries seem to contain references to /nix/store/vv4r320p5yd1k01kld62q1lppjxcswhb-gcc-7.3.0/lib/gcc/x86_64-unknown-linux-gnu/7.3.0/include but I can't find it any source files or configure script or makefiles
<symphorien>
if it is a store path in the cache, which one is it so that I can try ?
<sphalerite>
symphorien: nfs-utils
<sphalerite>
I want to remove its dependency on gcc to significantly improve the netboot image's closure size
<symphorien>
ok let's see
<sphalerite>
I suppose another way to achieve that would be to remove nfs-utils from netboot, but that feels like cheating. Especially since that sort of thing can be useful in a netboot environment!
trcc has quit [Remote host closed the connection]
<sphalerite>
oooooh stripping the files removes the references
<srhb>
Neat!
<sphalerite>
although the expression doesn't have dontStrip
<sphalerite>
I guess strip -s isn't sufficient?
<sphalerite>
oh wait
<sphalerite>
aaaaah okay! I've got it
<sphalerite>
It's because etc/systemd/system-generators isn't included in dontStrip
<sphalerite>
err rather the stripping hook
mojjoo has joined #nixos
<mojjoo>
hi! Since a while rebuilding takes a long time here, it's due to restarting the polkit service(more than a minute..)... Any ideas how to improve this?
<sphalerite>
symphorien: I've got it, thanks for helping!
<symphorien>
:)
<symphorien>
I can't even find the string with r2 for some reason :)
<sphalerite>
maybe you're using a different version of nfs-utils?
<symphorien>
no nix why-depends finds it
<symphorien>
I guess r2 does not search in debug symbols
<symphorien>
glad you found it
<symphorien>
indeed binaries in /etc/ are strange
<sphalerite>
symphorien: btw do you know about #nixos-fr?
<symphorien>
no
<sphalerite>
:) not the busiest of channels but hey, that's not going to be fixed by nobody joining it right? :D
<symphorien>
exactly :)
<sphalerite>
teto: you're francophone too right?
hamishmack has joined #nixos
<symphorien>
ah got it (for reference next time): izz | grep vv4r320p5yd1k01kld62q1lppjxcswhb
<symphorien>
gives result in sections .debug_line and .strtap
<symphorien>
*.strtab
<symphorien>
which confirms it is in debug symbols
<sphalerite>
symphorien: aw poo, someone got it before me xD
<sphalerite>
it's on master but not nixos-unstable yet
<sphalerite>
that timing though
<symphorien>
heh
<sphalerite>
1427c50cea8685daf8eb571301651cf347b27e23 by Matthew Bauer, Date: Mon Sep 24 15:05:39 2018 -0500
<hyper_ch2>
hmmm, it can find cups-config though but why does the script not find it
<{^_^}>
[nixos-weekly] @garbas pushed commit from NixOS Weekly Robot to gh-pages « Preview of 'c05401583ef31e18cb617e63f9936aac387b8427' commit built by Travis-CI \#433385820 »: https://git.io/fAxN6
<hyper_ch2>
sphalerite: adding cups.dev to the list of installed packages on nixos did help
mayhewluke has joined #nixos
troydm has joined #nixos
orivej has joined #nixos
jasongrossman has quit [Ping timeout: 246 seconds]
<{^_^}>
[nixos-weekly] @domenkozar pushed to master « More English »: https://git.io/fAxAs
<{^_^}>
[nixos-weekly] @garbas pushed commit from NixOS Weekly Robot to gh-pages « Preview of '9b9b5610afd1b43f2322c7776a97ac91dd1015c0' commit built by Travis-CI \#433390077 »: https://git.io/fAxAG
<srhb>
I'm puzzled, how does the user-runtime-dir@uid work? Do some things depend on it? I'm trying to find a minimal reproducing example of the switch failure, but I can't seem to find anything that needs that service.
<srhb>
Yet, my full system clearly does depend on it, somehow.
<symphorien>
from the name of it I'd say it creates /run/user/(id)
<{^_^}>
[nixos-weekly] @garbas pushed commit from NixOS Weekly Robot to gh-pages « Preview of '620de0016236dfec3bcb2aa530b4b6c984f79bc0' commit built by Travis-CI \#433390479 »: https://git.io/fAxAu
<{^_^}>
[nixpkgs] @globin pushed commit from @r-ryantm to master « arpack: 3.5.0 -> 3.6.3 »: https://git.io/fAxAa
<srhb>
symphorien: Yep.. And I do have that on my test system, and yet it's inactive (dead) vs my full system which is active (exited)
<srhb>
Mysterious...
<sphalerite>
maybe the type isn't right?
<{^_^}>
[nixos-weekly] @domenkozar pushed to master « 09: Add one more entry »: https://git.io/fAxAb
trcc has joined #nixos
<{^_^}>
[nixos-weekly] @garbas pushed commit from NixOS Weekly Robot to gh-pages « Preview of '7828681d935befde1792c23c96cbcf8adf31428a' commit built by Travis-CI \#433393185 »: https://git.io/fAxxk
globin has joined #nixos
<{^_^}>
[nixos-weekly] @domenkozar pushed to master « 09: remove extra line »: https://git.io/fAxxq
<{^_^}>
[nixpkgs] @globin pushed commit from @r-ryantm to master « libsigrokdecode: 0.5.1 -> 0.5.2 »: https://git.io/fAxxl
<{^_^}>
[nixos-weekly] @garbas pushed commit from NixOS Weekly Robot to gh-pages « Preview of '712a9c21138010387300496e832fa11b6fe646b3' commit built by Travis-CI \#433394429 »: https://git.io/fAxx4
<{^_^}>
[nixos-weekly] @domenkozar pushed 7 commits to production: https://git.io/fAxx2
Ridout has joined #nixos
<{^_^}>
[nixos-weekly] @domenkozar pushed to master « Call for Content: 2018/10 »: https://git.io/fAxxX
<{^_^}>
[nixos-weekly] @domenkozar opened pull request #65 → Call for Content: 2018/10 → https://git.io/fAxxH
<{^_^}>
[nixos-weekly] @garbas pushed commit from NixOS Weekly Robot to gh-pages « Release of (commit 'd6818ac0015fd85e28c0916a46e3e5138c2a60d0') built by Travis-CI \#433395965 »: https://git.io/fAxxd
<{^_^}>
[nix] @edolstra pushed to master « Make NAR header check more robust »: https://git.io/fAxhQ
trcc has joined #nixos
trcc has quit [Ping timeout: 245 seconds]
obadz has quit [Ping timeout: 246 seconds]
<azazel>
domenkozar: thanks
<jonge>
the nix newsletter says that nix 2.1 is compatible with macos mojave, so one should upgrade that before upgrading to mojave. the link just points to the nix installation page. does that mean that one should re-install basically?
<LnL>
no, there are upgrade instructions in the manual
<{^_^}>
nix#2410 (by Infinisil, 2 weeks ago, open): Bad darwin reinstallation experience
<jonge>
infinisil: oh yeah i had a similar experience some time ago, too...
<jonge>
one time i ran the nix installer on a company laptop where some remote administration policy was to turn off sudo's "memory" so i had to re-enter my pw every few seconds. during nix installation i gave up and aborted it at some point
<jonge>
then i fixed that sudo-memory thing, reran... and the problems began. :D
<jonge>
the workflow was: running installer --> installer asks me to tidy up a few things please. ok, tidied up... so next time it asked for _more_ things to tidy up... 5 repeats later it was installed, finally.
<jonge>
oh his channel was at some ancient nixpkgs??
<LnL>
yeah
<infinisil>
!!! Digitalocean added support for uploading custom images!
<azazel>
never used digitalocean, It always seemed costly to me
<tilpner>
They do offer nested virtualisation though
trcc has joined #nixos
MichaelRaskin has left #nixos [#nixos]
<rawtaz>
DO is known to be buggy as well
graphene has quit [Remote host closed the connection]
<infinisil>
rawtaz: The online console yeah, but other than that I haven't encountered any
<infinisil>
They have pretty good support
* etu
thinks they are ok most of the time
<rawtaz>
i mean things like their object storage and VPSs
<etu>
But I wouldn't praise them more than that
<rawtaz>
but i havent had first hand experience, just heard from others users
graphene has joined #nixos
<rawtaz>
i use tilaa.com :)
<infinisil>
Aw man, no iso's though
<rawtaz>
shameless plug perhaps, but i have no affiliation with them
<rawtaz>
infinisil: what instead?
<infinisil>
"Any Linux OS that supports ext3/4 file systems and has cloudinit 0.7.7, cloudbase-init, coreos-cloudinit, ignition, or bsd-cloudinit installed should work with the import tool. Currently, ISO files are planned to be supported towards the end of 2018."
<rawtaz>
oh
<infinisil>
At least we get iso's too soon
<azazel>
what's the story with nixos and cloudinit? I never used cloudinit
<LnL>
infinisil: I want to discuss and hack on ideas to improve the install/upgrade process during the hackathon
<infinisil>
LnL: Nice
trcc has quit [Ping timeout: 260 seconds]
<infinisil>
I really think the installer should have an interactive mode where it asks you some questions and then does the stuff
<infinisil>
This way it can also save the downloaded Nix and doesn't have to redownload it on every restart
<infinisil>
But I'm not sure if it's okay to require python for installation
<LnL>
azazel: you can deploy a nixos config using cloud-init with the aws images IIRC
<azazel>
It would be nice to build something on it (a friend of mine developed a scaffolding generation application https://pypi.org/project/metapensiero.tool.tinject/ ), unfortunately I will not be attending the conference...
<azazel>
LnL: ah I didn't know, thanks
jasongrossman has joined #nixos
fendor has joined #nixos
kiloreux has joined #nixos
simukis has quit [Quit: simukis]
<{^_^}>
[nixpkgs] @domenkozar pushed to master « postgresql: give postgres user a shell »: https://git.io/fApkV
<{^_^}>
[nixpkgs] @domenkozar pushed to release-18.09 « postgresql: give postgres user a shell »: https://git.io/fApkP
<domenkozar>
good, sanity.
trcc has joined #nixos
<srhb>
domenkozar: Why? :P
<domenkozar>
so that I can have psql history
<srhb>
Ah.
<srhb>
sudo -u postgres psql you mean
<domenkozar>
ye
<srhb>
I see, makes sense.
kim0 has joined #nixos
iyzsong has joined #nixos
periklis has joined #nixos
<etu>
domenkozar: Are you the one that publish the nixos weekly? If so I'm thankful for the note regarding nix on travis. I use nix on travis but installed it on every build, didn't know that they had nix :-)
trcc has quit [Ping timeout: 264 seconds]
<schmittlauch[m]>
Hi, I'm a newbee who just installed NixOS and has a question about package-specific configuration flags in nixpkg:
semihonest has joined #nixos
<domenkozar>
etu: you're welcome :)
<schmittlauch[m]>
I manage my user software with home-manager. When installing clementine, I don't want the proprietary spotify plugin. The clementine nix expression even has a config option, `config.clementine.spotify`, so I added `nixpkgs.config.clementine.spotify = false` to my `~/nixpkgs/home.nix` config file.
<schmittlauch[m]>
But the spotify plugin is still pulled in. What am I doing wrong?
<schmittlauch[m]>
symphorien: If I understand correctly, clementineFree also does not pull in certain patented codecs, but I want these. Additionally I'd like to understand how to customize and configure nixpkgs :D
<etu>
domenkozar++
<{^_^}>
domenkozar's karma got increased to 5
<symphorien>
schmittlauch[m]: does you customisation appear in` nix eval -f "<nixpkgs>" config ` ?
<hyper_ch2>
hmmmm, it seems I need to explicitely add xxx.dev packages sometimes
<infinisil>
symphorien: it shouldn't since they added it to the home manager config file
periklis has quit [Ping timeout: 264 seconds]
<symphorien>
ah.
<symphorien>
I missed the home-manager thing, sorry
<symphorien>
then I don't know :)
<schmittlauch[m]>
infinisil: symphorien but still it does
<symphorien>
I am surprised you don't have allowUnfree in there
<infinisil>
2 things are weird here: Is your home.nix file really in ~/nixpkgs/home.nix? I think it should be ~/.config/nixpkgs/home.nix. And: This setting shouldn't influence above command, did you put it in config.nix instead?
<schmittlauch[m]>
symphorien: I want to allow unfree only for specific packages :stallmanface:
<srhb>
schmittlauch[m]: Looking at nix edit clementine, it does not appear t use config.clementine.spotify for anything
<symphorien>
yes but I mean: nix should refuse to even evaluate libspotify without it
<etu>
schmittlauch[m]: I don't see any home-manager specific options for clementine at all.
<srhb>
Oh... Clearly I have a different version :-)
__monty__ has joined #nixos
<symphorien>
this should be 18.03
<symphorien>
(the link from the online package search)
<schmittlauch[m]>
infinisil: I put it into both files, just to make sure: `config.clementine.spotify 0 false;` in ~/.config/nixpkgs/config.nix` and `nixpkgs.config.clementine.spotify = false;` in ~/.config/nixpkgs/home.nix
<srhb>
yep, I see it in 18.03 indeed. Sorry for the noise.
<infinisil>
etu: That's to be expected
<infinisil>
config doesn't work like that
<symphorien>
schmittlauch[m]: do you use nix on nixos or on another distribution ?
<infinisil>
schmittlauch[m]: So, what's your nixpkgs version?
<schmittlauch[m]>
symphorien: nixos. And yes, `home-manager switch` complains about the unfree stuff
<etu>
infinisil: Oh?
<infinisil>
etu: grep for `config\.` in all-packages.nix
<symphorien>
can you run nix-info ? apparently the option you try to use has been removed between 18.03 and 18.09
<schmittlauch[m]>
infinisil: I don't know how to query the exact version. I'm on the 18.03 channel
<{^_^}>
[nixpkgs] @manveru opened pull request #47389 → ejson: init at 1.2.0 → https://git.io/fApL0
<{^_^}>
#47262 (by aminb, 2 days ago, open): alloy: add alloy5 and take maintainership
<hyper_ch2>
,locate pangocairo
<{^_^}>
Found in packages: lazarus
trcc has joined #nixos
iyzsong has quit [Read error: Connection reset by peer]
iyzsong has joined #nixos
duncan^ has joined #nixos
Xiro` has joined #nixos
trcc has quit [Ping timeout: 240 seconds]
<srhb>
aminb: fwiw 2 days is generally not a long time in the merge queue :)
<gchristensen>
anyone here know C++, Linux kernel stuff, and willing to mentor me through debugging a Nix problem?
Synthetica has joined #nixos
<Synthetica>
I'm trying to package a program that uses Meson as its build system, but the builder says it cannot find libraries I include in nativeBuildInputs (or buildInputs for that matter) any pointers?
<LnL>
don't know much about linux specific stuff, but I'm also somewhat familiar with the nix codebase
<symphorien>
Synthetica: add pkg-config ? sometimes it works
<teto>
gchristensen: what's the problem ?
<Synthetica>
symphorien: Already have that
<Synthetica>
(pkgsconfig as arg, pkgconfig in nativeBuildInputs)
<Synthetica>
s/pkgs/pkg/
wpcarro has joined #nixos
<gchristensen>
I have a remote builder. the remote builder finished many days ago but my system still thinks the remote is building. so the remote builder has been going for several days. I'd like to try and understand why. under strace, the nix-store --serve --write process says: select(21, [9 15 18 20], NULL, NULL, NULL
<hyper_ch2>
,locate libva
<{^_^}>
[nixpkgs] @Mic92 pushed commit from @vanzef to master « gitAndTools.pass-git-helper: init at 0.4 (#47056) »: https://git.io/fApGA
<Dezgeg>
I think via /proc/<pid>/fd/ you can determine which pipe is which
trcc has quit [Ping timeout: 252 seconds]
abueide has quit [Ping timeout: 252 seconds]
<gchristensen>
what do I do with that info then?
<gchristensen>
oh! lsof | grep the #?
patrl has quit [Ping timeout: 252 seconds]
<Dezgeg>
via /proc you can find the symlinks like 0 -> 'pipe:[62487671]' where you can presumably locate the other end of the pipe by looking for something with the same number in the brackets
<hyper_ch2>
wasn't there a command to fix shebang in scripts?
<srhb>
patchShebangs
<hyper_ch2>
thx
worldofpeace has joined #nixos
<azazel>
srhb: too fast
<hyper_ch2>
where to use it in a nix expression?
<hyper_ch2>
in the unpack phase? or patch phase?
<srhb>
It's a bash function
<srhb>
Probably neither of those
<srhb>
preBuild? preConfigure? Depends if it's the build script you're patching or the result
<manveru>
does anyone know, if i have sandbox disabled in nix, and have remote builders that have sandbox enabled, will the remote build be using sandbox?
elitak has joined #nixos
<gchristensen>
Dezgeg, sphalerite ^
<niksnut>
manveru: yes
<manveru>
awesome, thanks :)
<manveru>
is there a list of flags that carry over from the host nix?
<Dezgeg>
so no other process has pipes with the matching numbers open?
<elitak>
I'm trying to dump a nixos-config expression into a file, but this doesnt work: nix eval '((import <nixpkgs/nixos/lib/eval-config.nix>) { modules = [ <nixpkgs/nixos/modules/profiles/minimal.nix> ]; }).config'
<elitak>
what am i doing wrong?
<manveru>
elitak: try wrapping it in another ()
<gchristensen>
Dezgeg: I think so: for each fd listed in the original select call I looked at what the fd was linked to, ("/proc/34216/fd/18 -> 'pipe:[2729558909]") and ran `lsof | grep <number>`
<elitak>
manveru: doesnt change anything
<tilpner>
elitak - --json will get you farther
<tilpner>
elitak - But it will fail when trying to print pkgs
<elitak>
my real goal is to dump something into /etc/nixos/configuration.nix format
<elitak>
i dont think im on that path
<manveru>
i don't think there's a way to do that...
<elitak>
because it's going to spit out something like {_module=...}
<tilpner>
That's not going to work well, if at all
<Jetien>
Hi, does anybody know how to recreate Hydra's "Git checkout" derivation with nix? I'
<elitak>
i just want to pull in all the imports=[] into one file basically; it can be messy as long as it evaluates
<elitak>
"flatten" the expression, essentially
acarrico has joined #nixos
<tilpner>
Maybe you can use lib.module.closeModules somehow
<LnL>
gchristensen: so root?
<gchristensen>
yeah
<Dezgeg>
hmm, I wonder if the number can even be reliably used
<elitak>
tilpner: closeModules is called by eval-config.nix -> evalModules -> closeModules already i think
<tilpner>
I know
<elitak>
it's going to give me this internal representation {_module = {... rather than something you'd see in configuration.nix
<LnL>
gchristensen: ok so it's writing to the store directly, can't be communication with the daemon on the builder
<elitak>
i guess its not possible
<elitak>
i'd still like to know why nix-eval is trying to evaluate all the pkgs including broken ones
<tilpner>
elitak - _module.pkgs
<elitak>
oh
<tilpner>
Or _module.args.pkgs, not sure what the exact path is
<tilpner>
But it's in there
<elitak>
what are _module's siblings?
<tilpner>
Let's find out
<Dezgeg>
hm, yes 'yes | tac | tac > /dev/null' shows up properly in lsof
<tilpner>
elitak - assertions, boot, gnu, services, etc.
<infinisil>
elitak: not possible on the nix level in general
trcc has joined #nixos
<infinisil>
Because the nixos config can include functions as well
<infinisil>
If we ignore unserializible values, it might be possible
<Dezgeg>
gchristensen: I guess you need to gdb the process then (and hope you can locate the debug symbols) and figure out what the threads in nix-serve are doing
<gchristensen>
I was just preparing a paste :)
<infinisil>
elitak: if we ignore non-printable values, it might be possible, but will need some internal module system rewriting in regards with submodules
<LnL>
yeah figure out what pipe the select is waiting for
<LnL>
L57 looks a bit suspicious tho
<elitak>
ok, i think i will just write some script that pulls out the paths and recreates my import hierarchy then
<infinisil>
elitak: However iirc i think johnw_ has been experimenting with something to flatten Nix expressions using hnix, not sure how far that is
<elitak>
because yeah it makes sense that functions arent serializible after eval
<Dezgeg>
humm right, I wonder how strace shows activity for each thread
<symphorien>
johanot: and by the way: nix-store -qR path for transitive depes
<symphorien>
nix-store -q --references for direct deps
acarrico has joined #nixos
<johanot>
symphorien: great.. thanks! :)
wpcarro has joined #nixos
<{^_^}>
[nixpkgs] @aszlig pushed to master « fetchFromGitLab: Fix grouping issue for group arg »: https://git.io/fApRp
fuzzy_id has quit [Ping timeout: 276 seconds]
<infinisil>
aszlig++
<{^_^}>
aszlig's karma got increased to 2
<aszlig>
infinisil: actually that was my error, as i didn't look too close on the change during the review of the PR
<infinisil>
Karma for always writing such extensive commit messages <3
<aszlig>
ryantm: and sorry for the noise
fendor has quit [Ping timeout: 240 seconds]
<aszlig>
infinisil: would be good if a few more people would do that for more substantial changes
HalfWord has quit [Ping timeout: 240 seconds]
<aszlig>
infinisil: sometimes it's very hard to find out the rationale about a certain commit if it only contains a subject and no other description
wpcarro has quit [Remote host closed the connection]
<aszlig>
another thing is "some subject\n\nSee #1234" or even "Fix #1234", which makes it especially annoying when on the road with bad or no internet connectivity
<exarkun1>
services.tor.client.enable defaults to false but if you enable services.tor then you still get a tor daemon running a socks server for clients to use because it doesn't write a torrc that explicitly disables client-related features that default to enabled. nixos services.tor bug?
periklis has joined #nixos
pepesza has quit [Quit: ZNC 1.6.3+deb1 - http://znc.in]
<{^_^}>
[nixpkgs] @Synthetica9 opened pull request #47392 → lc0: init at 0.18.0-rc1 → https://git.io/fApuT
<infinisil>
aszlig: Will try next time :) (for non-trivial commits)
adamt has joined #nixos
<adamt>
Given a store path, how do I figure out the name of the corresponding nar-file?
* adamt
is debugging why his local binary store isn't working
<samrose__>
has anyone succeeded in using apparmor with nixos (systemd-nspawn) containers?
<adamt>
So apparently the .narinfo file name is based on the derivation hash, and contains the name of the nar file
<d1rewolf>
anyone here using Crossover Office on nixos?
<Dezgeg>
gchristensen: does some other nix process have /nix/store/vrcrv7v62f3wxlmlzph1ahgk822bs82c-hwdb.bin.lock
<sphalerite>
aszlig: good point! Will try to keep that in mind :)
<Dezgeg>
open?
<Dezgeg>
i.e. the path lock that thread 3 is waiting for
<srhb>
adamt: iirc nar files can be named anything.
<srhb>
adamt: I think the standard is just to rip off /nix/store/ from the path
<srhb>
adamt: At least, if the purpose is to serve them later
<srhb>
adamt: If you could just copy them to the store of your cache you could serve the nars up transparently.
<adamt>
srhb: I don't want to serve up files from /nix/store from the build host -- and that's not what cache.nixos.org is doing either
ekleog has quit [Quit: back soon]
<adamt>
We'll replace it with an S3 (ceph) target once we're ready for that.
<srhb>
adamt: ok :)
<sphalerite>
srhb: what's wrong with file:// :)
<srhb>
sphalerite: Nothing wrong with it, except it's usually easier to propagate a /nix/store :)
<sphalerite>
srhb: lets you just fire a regular webserver at them
<srhb>
Yup
<sphalerite>
probably more efficient than nix-serve as well :p
<adamt>
does nix pick a random cache from nix.binaryCaches, or does it try them all in order (doesn't look like the latter..)?!?
<srhb>
Definitely more efficient.
<srhb>
adamt: Pretty sure it's the latter.
<sphalerite>
adamt: I think it tries them in order and uses the first one that it finds it on
<srhb>
adamt: If you're experiencing confusion here, perhaps it's related to ~/.cache/nix/binary-cache* ? :)
<adamt>
It really can't be. Now we're running nix-build -vvvvv (vomit) for debugging, and it references hashes that it apparently tried, but doesn't show up in the access log
<adamt>
BUT says it tried to fetch them from cache.nixos.org
<sphalerite>
how did you configure the cache?
<srhb>
adamt: either the cache cache is the problem or the substituters isn't correctly configured, I'd say
astronavt_ is now known as astronavt
Ericson2314 has quit [Quit: Leaving]
<adamt>
srhb: the nix module calls it nix.binaryCaches, but man nix.conf calls it substituters. What's the difference?
<srhb>
adamt: Same thing, hysterical raisins.
<srhb>
adamt: substituters is new since 2.x
<adamt>
raisins?
<srhb>
Historical reasons :P
<johanot>
mmmmhhh hysterical raisins.. yum
<srhb>
Meaning: We should probably start deprecating binaryCaches for substituters
<srhb>
But I don't think `nix.substituters` even exists yet.
<sphalerite>
since you can substitute from any store, not just "binary caches" i.e. narinfo/nar sources
<srhb>
So someone needs to update the module to get the ball rolling.
<sphalerite>
adamt: have you rebuilt the system after adding it? Or is that what you're trying to do currently and having issues with it not using the substitutes?
<adamt>
nix.binaryCaches seem to create a substituters section in nix.conf
<srhb>
Yep.
<adamt>
So it's just the option that has to be renamed. I thought it was worse than that
<srhb>
No no. everything works, there's just a naming mismatch.
endformationage has joined #nixos
<adamt>
sphalerite: We have a build our gigantic derivation on a gitlab ci runner, and nix copy'ed the output to a dir served by nginx. Then we try to get johanot's laptop to use the cache, which fails in repeatedly weird ways, but does work for some paths.
<adamt>
s/a//
<srhb>
adamt: Can you try clearing the cache first and see if it's still weird?
<srhb>
Negative cache hits last one hour by default.
<srhb>
If that explains anything :)
<adamt>
srhb: It is. But I think the next step is reproducing with something less than all software required for 43 hosts.
<sphalerite>
does work for some paths? Yeah definitely sounds like a meta-cache issue
<adamt>
srhb: What cache?
<srhb>
adamt: ~/.cache/nix/binary-cache* as above :)
<adamt>
srhb: Local on the machine needing the derivation?
<sphalerite>
~/.cache/nix/binary-cache-v5.sqlite
<sphalerite>
both for root and for your user
<srhb>
adamt: Yes, locally on the machine.
<cransom>
when in doubt wipe, i wipe all my ~/.cache/nix directories completely
<sphalerite>
actually the more elegant way is probably passing --narinfo-cache-negative-ttl 1
<srhb>
or use --option narinfo-cache-negative-ttl 0
<adamt>
srhb: Ah, that's far up. We'll try clearing that.
<adamt>
Another question; I got the impression yesterday that to sign build outputs, it should be enough to set secret-key-files, but it doesn't seem like that causes nix to sign things on its own. Is `nix sign-paths` required as well?
<srhb>
adamt: The daemon will sign the things it builds iirc if you have the secret key file set.
<d1rewolf>
anyone been able to get office365 working with wine on nixos?
b1000101 has joined #nixos
ThatDocsLady has quit [Quit: Leaving]
<b1000101>
Hi there, could someone please tell me what needs to be done in order to see a package here https://nixos.org/nixos/packages.html#trezord (i.e. for the user to be able to install the package right away without tweaking). I've successfully got a new version merged to both master and 18.03 branches. Thanks!
<b1000101>
The version in the link is 2.0.12, the new/merged version is 2.0.19
<sphalerite>
b1000101: just wait
<sphalerite>
once the channel advances it iwll update
<manveru>
also got `error: unknown serve command 9`
<manveru>
hmm
<srhb>
manveru: Yes, that should be enough..
simukis has joined #nixos
<manveru>
service is `/nix/store/gfd3lq0fg9hnqbi77lp13vvwbhjd86h8-nix-2.1pre6338_45bcf541/bin/nix-daemon`
<manveru>
i have the same nix version across all machines, afaict
<{^_^}>
[nixpkgs] @rycee opened pull request #47396 → Backport the noti package to 18.09 → https://git.io/fApyL
Czen has quit [Remote host closed the connection]
Czen has joined #nixos
patrl has joined #nixos
jedahan has joined #nixos
<sphalerite>
infinisil: won't be much fun when suddenly you can't deploy your nixops hosts anymore because they're running an older nix :p
<manveru>
something is still referencing nix 2.0.4 on that system
<Mic92>
aminb: time
<{^_^}>
[nixpkgs] @Mic92 merged pull request #47262 → alloy: add alloy5 and take maintainership → https://git.io/fAFyk
<{^_^}>
[nixpkgs] @Mic92 pushed commit from @aminb to master « alloy: add alloy5 and take maintainership (#47262) »: https://git.io/fAp9k
Synthetica has quit [Quit: Connection closed for inactivity]
jperras has quit [Quit: WeeChat 2.2]
vaibhavsagar has joined #nixos
<manveru>
ah, damn nixops...
zgrep has quit [Quit: This is me *really* leaving.]
zgrep has joined #nixos
Kelppo has quit []
zgrep has quit [Client Quit]
zgrep has joined #nixos
Thra11 has joined #nixos
hlolli has joined #nixos
Ariakenom has quit [Ping timeout: 240 seconds]
vaibhavsagar__ has joined #nixos
<hlolli>
Shouldn't adding "docker" to users.extraUsers.[myusername].extraGroups be enough to be permitted to run a docker image? I'm getting permission denied errors, I've tried restarting the systemd service.
vaibhavsagar has quit [Ping timeout: 246 seconds]
<gchristensen>
you need to log out and log back in for your users' groups to be updated
<andi->
hlolli: did you login again since adding it?
<hlolli>
ah! No, didn't do that
<andi->
`newgrp docker`
<hlolli>
newbish question, how do you log out without restarting, I never ever log out :P
georges-duperon has joined #nixos
<gchristensen>
wow, I didn't know about newgrp!
<hlolli>
I did new group, the zsh shell did some strange stuff
hlolli has quit [Remote host closed the connection]
hlolli has joined #nixos
<hlolli>
logout in i3 Mod+shift+e and now I can run docker, thanks!
<jav>
Anyone use autojump here? The package used to have a autojump-share script which would output the install location, so one can source the init script from .bashrc like this: . $(autojump-share)/autojump.bash ... the latest version of the package has been reworked and does not have this anymore. How am I supposed to source the autojump script - I'm not sure I understand what the NixOS approach to this is.
vandenoever has joined #nixos
<sphalerite>
jav: I don't use it myself, but by the looks of it using `. ~/.nix-profile/etc/profile.d/autojump.sh` instead should work if you install it via nix-env, otherwise `. /run/current-system/sw/etc/profile.d/autojump.sh`
<jav>
sphalerite: thank you! I did install it as a system package and it does not appear in /run/current-system/sw/etc/profile.d
sigmundv has quit [Ping timeout: 252 seconds]
<exarkun1>
how do I use a variable value on the left hand side of =?
<jav>
or is environment.systemPackages = [ ... ] not the right place to put it? I kinda prefer having everything in configuration.nix and don't really install stuff via nix-env
Jetien has quit [Ping timeout: 252 seconds]
<{^_^}>
[nixpkgs] @Ericson2314 pushed 3 commits to staging: https://git.io/fApbi
<symphorien>
there must be an equivalent for any shell
<dtz[m]>
can probably install with users.users.will.packages = [ ... ];
<dtz[m]>
(with appropriate username instead of 'will' :))
<jav>
symphorien: aw, interesting - thank you, I'll look into that for bash
szicari has joined #nixos
<{^_^}>
[nixpkgs] @Ericson2314 opened pull request #47399 → paxctl: Fix darwin and cross and use for linux cross for 18.09 → https://git.io/fApbp
<infinisil>
exarkun1: Not sure what you mean?
<infinisil>
s/?//
<exarkun1>
nginx virtualHost configuration is a set with keys giving host names and values giving config. what if I want to read the hostname from a file?
<wucke13>
Hello. Has someone here tinkered arround with NixOS on arm? My serial console stops doing anything after `Starting kernel ...`. Is there a way to keep the console working?
<{^_^}>
[nixpkgs] @matthewbauer pushed 2 commits to master: https://git.io/fAppO
jperras has joined #nixos
<symphorien>
I am building something with pandoc as nativeBuildInput. It pulls ghc-doc and all sorts of doc outputs. isn't it wasteful ?
<samueldr>
wucke13: when using the usual nixos images, the /boot partition, the smaller FAT32 partition, will have a extlinux/extlinux.conf file generated by nixos; you can modify the options here and they'll stick until a rebuild
<samueldr>
for the rebuild to have the parameters you need, you would add them to the configuration
<infinisil>
There shouldn't be a lib directory in pkgs.pandoc
<wucke13>
samueldr: In the extlinux conf a lot of consoles is enable, but the console is silent on boot anyways? (`console=ttyS0,115200n8 console=ttyAMA0,115200n8 console=tty0`)
<tilpner>
infinisil - Right, I misinterpretred the output
<samueldr>
wucke13: first, just to help guide: which ARM platform?
philippD has joined #nixos
<samueldr>
though, what I think is happening, but am unsure how to confirm: the boot log won't show up on all of them, there is no service that outputs it to all console arguments, it default to the first (available?)
<samueldr>
I recall something along the lines
<samueldr>
though, once it is booted, it should give you a console on serial
<samueldr>
also note that the first boot will be MUCH longer as it resizes the partition to fit the whole media, and it also does house-keeping within the image for the nix store
<wucke13>
I added ttyS1 as the wiki states that might help. However, no bootlog
<Dezgeg>
raspberry probably needs enable_uart=1 in config.txt
<samueldr>
wucke13: you do have u-boot serial output or not?
vaibhavsagar__ has joined #nixos
<wucke13>
samueldr: yes, I do have uboot out. Which console should be the correct one on the pi 3 B?
ixxie has joined #nixos
<Dezgeg>
hm, if u-boot gives output it's not config.txt probably then...
<samueldr>
:)
<samueldr>
wucke13: if you were to try hdmi out, at least for my setup, I have no stage-1 output at all, so I had/have to give it time to do all the misc things before getting a console
vaibhavsagar has quit [Ping timeout: 252 seconds]
<wucke13>
Dezgeg: samueldr I reflashed the sd. config.txt says uart1=1. In extlinux ttyS0, ttyAMA0 and tty0 are enable. Am I guessing right that I should get no bootlog but a login console after a few minutes when booting now?
<Dezgeg>
maybe raspi3 was weird and needed ttyS1 instead of ttyS1
<Dezgeg>
er, ttyS1 instead of ttyS0
<ixxie>
what the difference between gnupg and gnupg1? The description mentions 'symbolic links for gpg and gpgv' but I don't know what that means
<samueldr>
(I should probably write an SD card with the image and test it in a zero-knowledge fashion to verify what bumps there may be on the road)
vaibhavsagar has joined #nixos
vaibhavsagar__ has quit [Ping timeout: 272 seconds]
jD91mZM2 has quit [Quit: WeeChat 2.0]
<exarkun1>
ixxie: my guess is gnupg is gnupg2 which is incompatible in various ways with gnupg1
<wucke13>
I added ttyS1 to the list. It is still booting since 4 minutes or so. I will report back later :) So far, many thanks samueldr and especially Dezgeg for putting effort into supporting arm boards!
rtjure has quit [Ping timeout: 246 seconds]
<ixxie>
exarkun1: they are both 2.1 but the latter has some extra symlinks; just trying to understand what for
hlolli has quit [Remote host closed the connection]
<philippD>
I always forget how to create open a nix-shell with for a specific ghc version with some packages I want to use in ghci. Is there a good website I could bookmark for that?
<philippD>
s/open //
<__monty__>
philippD: I think there's something in the nixpkgs manual for that? You could bookmark the appropriate section.
<philippD>
__monty__ Ah, yes. Thank you. I was just looking at the Nix language manual
IRCsum has quit [Ping timeout: 272 seconds]
<gchristensen>
if you pass buildEnv a single path it will optimize itself and create symlinks to directories, instead of making a directory and a symlink for every file inside. is there something like buildEnv which doesn't make that optimisation?
<tilpner>
Did you try symlinkJoin? Not sure if lndir does it
<gchristensen>
ohh!
<gchristensen>
you're the best!
<infinisil>
cransom: Works in the version I have :)
<infinisil>
Almost master that is
<cransom>
i didn't think iwas that far off master, but lets update and see.
<ixxie>
so... secret management & nixops: wat?
<ixxie>
well I guess I don't even know how to properly do it with NixOS
<ixxie>
I mean its no good putting them in the store
Kim has joined #nixos
<ixxie>
right?
<infinisil>
If nobody has access to your machine then it should be alright
<gchristensen>
I like deployment.keys
<infinisil>
Possibly also encrypt it
<ixxie>
whats that gchristensen ?
<samueldr>
or don't have secrets *ducks*
<infinisil>
Ah right, nixops has that
sir_guy_carleton has joined #nixos
<gchristensen>
ixxie: it is nixops' method of copying secrets to a host without using the nix store
<elvishjerricco>
gchristensen: deployment.keys could do with some improvements though; preferably something like the `static` thing we do for `/etc`, so that keys can be removed automatically when they're no longer in the deployment.
<elvishjerricco>
or at least become dead symlinks
<gchristensen>
for sure
semihonest has quit [Ping timeout: 240 seconds]
<ixxie>
but the deployer becomes a single point of failure still
<ixxie>
everything is there
<elvishjerricco>
I've been thinking about using user-owned chroot stores for key management
<{^_^}>
[nixpkgs] @Ericson2314 merged pull request #47401 → paxctl: Fix darwin and cross without mass-rebuild for 18.09 → https://git.io/fAphM
<{^_^}>
[nixpkgs] @Ericson2314 pushed 3 commits to release-18.09: https://git.io/fAhTa
<cransom>
i don't use nixops, but i did bogart the /run/keys for my own service that on deploy, builds a KMS encrypted bundle in the store where it sits until the machine runs and a start up service asks kms to decrypt the bundle and sticks it in /run/keys.
<gchristensen>
nice :D
<{^_^}>
[nixpkgs] @Ericson2314 pushed 8 commits to staging: https://git.io/fAhTd
<LnL>
ixxie: no, but I think the vault approach is much better then whatever supporting secret files in nix would be
<{^_^}>
[nixpkgs] @Ericson2314 pushed 8 commits to staging-18.09: https://git.io/fAhTA
mayhewluke has joined #nixos
<gchristensen>
+1
<ixxie>
makes sense of course
trcc has quit [Remote host closed the connection]
<vaibhavsagar>
is there a way to get Nix 2.1 on 18.03?
<vaibhavsagar>
like there was nixUnstable for 17.09?
<ixxie>
still nixUnstable?
<LnL>
treating secrets as something persistent inherently means that you loose access control
Ariakenom_ has joined #nixos
<elvishjerricco>
ixxie: nixUnstable points to some prerelease, not the actual release.
<elvishjerricco>
vaibhavsagar: I just import a nixpkgs-unstable checkout and set `nix.package = unstable.nix`
<elvishjerricco>
Works fine
<LnL>
and not knowing what might be compromised is worse then a secret that got compromised
<vaibhavsagar>
elvishjerricco: that makes sense, but I would still like it to be included in 18.03
<ixxie>
LnL so how does vault make it better?
<elvishjerricco>
vaibhavsagar: Agreed
<vaibhavsagar>
ideally something like nixStable21
trcc has joined #nixos
<vaibhavsagar>
LnL: so the keys live on some remote store and we access it with some other secret that can be revoked?
Ariakenom_ has quit [Ping timeout: 252 seconds]
<elvishjerricco>
Doesn't really sound inherently more secure. If that machine is compromised, the attacker still gets the same level of access. Except now you've got this single Vault that, if compromised, compromises everything
<LnL>
vault can't read it's own secrets and the code is reviewed by security people every nth release
<wucke13>
Dezgeg: samueldr I did not get an login until now. I think this way does not work. Any thoughts?
<{^_^}>
[nixpkgs] @kalbasit closed pull request #46864 → terraform: update all providers and move nixos provider under terraform.withPlugins → https://git.io/fAS0F
<elvishjerricco>
LnL: How does Vault have no access if it's the one doing all the issuing?
<LnL>
and it encourages accessing secrets dynamically making things like rotating secrets actually work
<ixxie>
it could give the keys back to the owner through its API
nDuff has joined #nixos
trcc has left #nixos [#nixos]
<elvishjerricco>
ixxie: What do you mean by that?
SitiSchu has joined #nixos
<ixxie>
I don't know for sure, I am just speculating - but if it encrypts something and knows microservice X owns it, it can send the private key to X through a networking service like Consul and then X can open the resource but Vault can't
<LnL>
if you restart vault you can't access anything until it's unlocked by an admin
<elvishjerricco>
LnL: But once it's unlocked, everything is for grabs?
<elvishjerricco>
If so, that's a pretty massive single point of failure. Maybe the encouraged rotation makes up for that though
<{^_^}>
[nixpkgs] @kalbasit opened pull request #47407 → terraform: update all providers and move nixos provider under terraform.withPlugins → https://git.io/fAhIQ
<nDuff>
Do we have tools for fixing up .la or .pc files that don't include -L directives for the directories from which library dependencies were imported? (For dynamically-linked libraries, the rpath links us to the right version of their dependencies; for statically-linked libraries, if we don't have an entry in the pkgtool or libtool metadata, the dependency seems to just get lost).
<elvishjerricco>
ixxie: If the vault is compromised, then sending a private key does no good, since the attacker can just retain the key
<LnL>
with root on the host accessed secrets can probably be retrieved
<LnL>
but that's no different from any other approach
georges-duperon has joined #nixos
<ixxie>
does NixOps encrypt the closure it sends?
<elvishjerricco>
LnL: The point is that it means only one machine has to be compromised to get *everything*, whereas otherwise you'd have to compromise *all* machines, which is presumably harder
<gchristensen>
it sends it over SSH, does that count?
Anton-Latukha has quit [Quit: Leaving.]
<elvishjerricco>
I'd hope SSH counts :)
<ixxie>
of course xD
* ixxie
facepalms
<{^_^}>
[nixpkgs] @bhipple opened pull request #47408 → abi-compliance-checker: init at 2.3 → https://git.io/fAhLR
<LnL>
elvishjerricco: that's not true, having secrets spread across machines means the weakest link is a vulnerability
<elvishjerricco>
LnL: True, but the damage is scoped to only what that machine has access to. And Vault doesn't prevent that; if the weakest link is compromised, the attacker has all the same access as without Vault.
<ixxie>
LnL I am not sure but I would guess it depends on the topology of such a network
<ixxie>
I imagine you can design a network topology which improves security
<elvishjerricco>
LnL: Hardening Vault doesn't make it invincible. I'm just saying it's adding a single point of failure where there previously may not have been one. But again, I'm willing to concede that key rotation might make up for it, especially since it's probably easy to make Vault insanely hard to penetrate.
Xiro` has quit [Read error: Connection reset by peer]
Xiro` has joined #nixos
<wucke13>
azazel: Yes, as `console=ttyS0,115200n8 console=ttyS1,115200n8 console=tty0` did neither put out bootlog (expected) nor give me a login shell, while `console=ttyS1,115200n8` does both.
yesbox has quit [Quit: Alwyzon, cloud-powered IRC client and bouncer - http://alwyzon.com/]
wpcarro has joined #nixos
<wucke13>
I would have expected the first one to not print the bootlog but still offer a login shell on the serial interface once the boot is done, which was not the case.
<schmittlauch[m]>
What are useful tools to inspect the packages installed on a system: list files, show dependency trees, find packages providing certain commands?
<{^_^}>
[nix] @dtzWill opened pull request #2454 → bump base nixpkgs used by default 18.03 -> 18.09 → https://git.io/fAhW3
<manveru>
gchristensen: that's like turning docker registry into a nix store :)
jasongrossman has joined #nixos
<gchristensen>
manveru: sure, why not? :)
<manveru>
not that i'll complain :D
brejoc has quit [Ping timeout: 240 seconds]
jasongrossman has quit [Client Quit]
georges-duperon has quit [Ping timeout: 252 seconds]
<gchristensen>
the more layers the faster it uploads and downloads
<sphalerite>
onions have layers, ogres have layers. Images have layers too!
<schmittlauch[m]>
(if someone knows Gentoo: I'm looking for something like equery)
<sphalerite>
schmittlauch[m]: ls, find and tree are good for listing package contents ;)
<sphalerite>
schmittlauch[m]: for dependencies, nix-store -q can do lots of things, have a look at the manpage
<schmittlauch[m]>
…
<schmittlauch[m]>
sphalerite: will do, thanks
<sphalerite>
schmittlauch[m]: that was a serious answer, since each package has its own path it's easy to find out what each package contians
nDuff has quit [Quit: zzz]
<sphalerite>
and finally for finding packages providing certain commands, nix-index and its nix-locate command. Currently still broken iirc but should hopefully start workign again soon
<schmittlauch[m]>
sphalerite: I know, but still the long hashes at the start will take me a while to get used to.
<sphalerite>
also available via infinisil's bot
<sphalerite>
,locate nethack
<{^_^}>
Found in packages: nethack, nethack-x11
<manveru>
gchristensen: i guess that's one way... so what's the limit of 42 about?
<sphalerite>
right time for me to sleep, gnight folks!
timon37 has quit []
<schmittlauch[m]>
`nix search` sometimes behaves a bit weird, but so far I'll use nox
astronavt has joined #nixos
<gchristensen>
manveru: AUFS used to hard-code a max of 42
<schmittlauch[m]>
seems like the nix 2.0 UX is still heavy WIP
<manveru>
until when?
<gchristensen>
I don't remember, maybe comment that in there as a question to look in to
<manveru>
either way it'd be nice to split the layers a bit more based on size as well, no clue how that'd work though :|
jackjennings has left #nixos [#nixos]
<gchristensen>
well and then you make the chance of a cache hit MUCH lower
sigmundv has joined #nixos
<gchristensen>
and you enter "Sufficiently magic" territory
<manveru>
sure, but i'd rather have a layer of like 150MB that never changes over one with 150KB :)
<manveru>
anyway, i think i'll use the fromImage approach and use your function for the base image
<gchristensen>
you can do that now with buildImage
<manveru>
yeah
<manveru>
that should give me the best of both worlds
<boomshroom>
Strangely, I had the same issue using the mozilla-nixpkgs and rustup.
<manveru>
gchristensen: fails like `standard_init_linux.go:190: exec user process caused "no such file or directory"`
<boomshroom>
On an unrelated note, any chance of getting nwjs-sdk into nixpkgs? If so, then I can probably make a derivation for a CrossCode modding environment without a custom nix derivation.
patrl has quit [Ping timeout: 250 seconds]
<gchristensen>
manveru: huh
<gchristensen>
but why :P
<manveru>
indeed :)
doyougnu has joined #nixos
<boomshroom>
It seems to only happen when compiling for a riscv target.
<manveru>
gchristensen: it's almost as if it's referencing the wrong layer as base?
<gchristensen>
hmmm manveru buildImage seems to make invalid assumptions
<rawtaz>
quite on the contrary, i used smileys to signal that i didnt mean it in a bad way
mayhewluke has quit [Ping timeout: 240 seconds]
<gchristensen>
ah, ok :)
mayhewluke has joined #nixos
sigmundv has quit [Ping timeout: 260 seconds]
Dedalo has joined #nixos
<rawtaz>
boomshroom: sorry if i offended you, didnt mean to
<gchristensen>
manveru: from the spec, "An optional Parent field references the imageID of the parent image. This parent must be part of the same manifest.json file."
<manveru>
yeah
graphene has quit [Remote host closed the connection]
<manveru>
also i think it's missing in `docker history`
sigmundv has joined #nixos
<gchristensen>
manveru: well so the bug is buildImage requires it, and the spec doesn't
<manveru>
but parent doesn't really make sense with your approach
graphene has joined #nixos
jperras has quit [Ping timeout: 244 seconds]
<manveru>
it'd be cool to have the contained packages listed there though :)
<gchristensen>
agreed! I tried to but it was very annoying
graphene has quit [Remote host closed the connection]
graphene has joined #nixos
hamishmack has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<gchristensen>
ok so `parent` is annoying, too
<gchristensen>
manveru: well so my solution for now is I don't say you can use it with buildImage :X anymore.