<lucus16>
ugh, fetchgit is somehow failing to do a recursive clone
elgoosy has quit [Remote host closed the connection]
kvda has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<{^_^}>
[nixpkgs] @matthewbauer pushed to staging-next « libvdpau: add -lX11 on darwin »: https://git.io/fh9BH
goibhniu has quit [Ping timeout: 250 seconds]
jluttine has joined #nixos
sicklorkin has joined #nixos
<lucus16>
because nix-prefetch-git failed D:
<sicklorkin>
gchristensen: I was never able to run a successful set of tests on my laptop or server https://github.com/NixOS/nix/pull/2643 i did make some note and am happy to continue trying - may need a little guidence tho
<{^_^}>
nix#2643 (by buecking, 2 weeks ago, open): install: Check for a valid umask before running multi-user installer.
<{^_^}>
[nixpkgs] @matthewbauer closed pull request #53760 → [WIP] Build nixpkgs with gcc 8 by default → https://git.io/fhZXt
<{^_^}>
[nixpkgs] @matthewbauer reopened pull request #53760 → [WIP] Build nixpkgs with gcc 8 by default → https://git.io/fhZXt
<jonreeve>
Can anyone else manage to install the Python library word2vec? I tried this: `nix-shell -p 'python37.withPackages(ps: with ps; [ word2vec ])'` but I keep getting this: ` Could not find a version that satisfies the requirement scikit-learn (from word2vec==0.10.2) (from versions: )`
xkapastel has quit [Quit: Connection closed for inactivity]
<simpson>
jonreeve: Anyway, https://bpaste.net/show/a0d874d9426d seems to fix the build, at least. Not sure whether the resulting package is usable; I don't know how to word2vec.
<jonreeve>
simpson: Do you know where I can put those changes?
<jonreeve>
simpson: And/or how to get around this issue by doing something with that file?
<simpson>
Not offhand, no. Just patch your local nixpkgs.
<simpson>
Maybe .override would work? I'm not exactly sure how callPackage interacts with .override.
abbafei[m] has joined #nixos
ebzzry has joined #nixos
Guest39518 has quit [Ping timeout: 240 seconds]
<ebzzry>
Does flatpak need root to install apps?
<simpson>
Ha, actually, the fix isn't upstream at all, so you're gonna need a patch like this, and applying it directly is going to be *much* faster than waiting for me to make a PR and then waiting for the merge. (And then, optionally, waiting for the channel update.)
<jonreeve>
simpson: Do you know how I'd go about patching it?
<jonreeve>
simpson: I have no idea what I'm doing; I'm new to nixos.
<simpson>
ebzzry: That's what their docs say. Personally I'm skeptical.
<{^_^}>
[nixpkgs] @peti pushed to haskell-updates « hackage-packages.nix: automatic Haskell package set update »: https://git.io/fh9R5
<simpson>
jonreeve: Piles of options and opinions, from overlays to local git checkouts. Personally I have a local git clone of nixpkgs, because it facilitates contributing back upstream.
kyren has quit [Ping timeout: 250 seconds]
<jonreeve>
simpson: What's the easiest? I'm just trying to get a Python environment up quickly with these packages, since I have to do something tonight with it
<simpson>
My workflow on this patch was to go into my local nixpkgs, change the file, use $(nix repl ~/nixpkgs) to confirm.
<simpson>
jonreeve: Use tools that you know if you're on a deadline.
<jonreeve>
simpson: Yeah I might as well install an Ubuntu virtualbox or something. Switching to NixOS on my laptop has not been great for deadlines
jasongrossman has quit [Ping timeout: 268 seconds]
<simpson>
jonreeve: Sounds good. Best of luck.
<jonreeve>
simpson: What's frustrating is that everything works except word2vec, though. I was hoping there's just be something I could add to that project file
<simpson>
jonreeve: There's probably a hacky way to do it. I'm trying to prod you to be not dependent on the multi-day-long turnaround of the Python maintainers in order to have unbroken packages.
<ebzzry>
simpson: thanks
DrLambda has joined #nixos
<jonreeve>
simpson: I'll take any hack I can get, since it'd probably be faster than installing Ubuntu
<simpson>
ebzzry: Note that I don't recommend any of this. Non-Nix tools that do Nix-like things are highly suspect to me, and anything that only works with sudo like that is *very* suspect.
<simpson>
Something like that. Think before doing; don't run any command I give you verbatim.
<abbafei[m]>
Hi, having a little problem here: `actkbd` is not running the `light` command when run declaratively (from nixos config), as seen [on the nixos wiki](https://nixos.wiki/wiki/Backlight#Key_mapping). However, running the same command that the declarative config runs (sudo nix/store/1f7vq0jcdcszr8p2qih2jkfr610dphi6-actkbd-0.2.8/bin/actkbd -D -c /nix/store/kh3azgrgi1gv6v41kxxn90332qh174vi-actkbd.conf -d /dev/input/event9)
<abbafei[m]>
works! It seems that since the `light` command uses special permissions (see [here](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/programs/light.nix#L11) ), when systemd runs the `light` command it somehow restricts the environment, and although the systemd processes run as root (e.g. <code>root 5312 1 0 18:57 ? 00:00:00 /nix/store/1f7vq0jcdcszr8p2qih2jkfr610dphi6-actkbd-0.2.8/bin/actkbd -D -c
<abbafei[m]>
/nix/store/kh3azgrgi1gv6v41kxxn90332qh174vi-actkbd.conf -d /dev/input/event9</code>), they must run restricted in some way. Is there any way I can make this work declaratively, instead of having to run the command every time the computer starts up?
<justanotheruser>
I'm trying to update my python development environment upon which I call `nix-shell`, and I am getting the error "variable $src or $srcs should point to the source
<justanotheruser>
development environment default.nix*
<lucus16>
justanotheruser: Looks to me like it needs to be in the other derivation
ebzzry has quit [Quit: WeeChat 2.3]
<lucus16>
justanotheruser: the final derivation will not be built, just used for nix-shell, but the other one needs to be built, so it either wants srcs or unpackPhase = true
<justanotheruser>
yep, thanks!
<lucus16>
justanotheruser: What is the first package for though?
<justanotheruser>
the first package is to get the python packages defined ~/.nixpkgs
Supersonic has quit [Disconnected by services]
Supersonic112 has joined #nixos
Supersonic112 is now known as Supersonic
<lucus16>
justanotheruser: When you run nix-shell on a derivation, it doesn't try to build it. unpackPhase is never executed, just set as an environment variable
<lucus16>
So it doesn't fail until you'd manually run unpackPhase inside the nix-shell
<lucus16>
In that case you have two derivations, the last one which is the result won't be built
phry has quit [Read error: Connection reset by peer]
<lucus16>
but the first one is a dependency, so it needs to be built before it can be used by the last one
<lucus16>
Building a package is probably not what you intended to do there though
<justanotheruser>
mhm
<justanotheruser>
I don't quite understand the logic around the rule, but I can understand that if I make two derivations, it won't accept the "outermost' derivation
<justanotheruser>
as my shell without a src
<lucus16>
nix-shell is a tool to give you a shell with all the inputs you need for your build. If you put bigPackage in the buildInputs, it becomes a package you need to build, so it will be available in your shell
<lucus16>
nix-shell allows you to try building a derivation manually, which is why it doesn't build the derivation you give it. It builds all the dependencies because you'll need them to build
drakonis has quit [Quit: WeeChat 2.3]
<{^_^}>
[nixpkgs] @grahamc opened pull request #55296 → efi-image_eltorito: make reproducible → https://git.io/fh90c
<justanotheruser>
right, being designed around builds and not for general development makes the limitation make sense
petersjt014_ has quit [Remote host closed the connection]
zachmane has joined #nixos
zachmane has left #nixos [#nixos]
zachmane has joined #nixos
petersjt014 has joined #nixos
LeshaInc has quit [Ping timeout: 245 seconds]
LeshaInc has joined #nixos
maximiliantagher has quit [Remote host closed the connection]
maximiliantagher has joined #nixos
andreabedini has joined #nixos
<zachmane>
Hello looking for some help here. Currently my computer has a nvidia graphics card. The xserver has problems starting up. It starts and stops even after trying a combination of intel, nvidia drivers. The driver specific to my OS is nvidia-390. My partitioned ubuntu can start with the desktopManager after installing the above driver. Would be grateful to anyone who can point me in the right direction
<zachmane>
Actually it installs that driver even with nvidia specified. I saw it in the install log
<zachmane>
But thanks :)
<jackdk>
then I've got nothing, sorry. (I specifically buy non-nvidia for my machines running GNU)
maximiliantagher has quit [Remote host closed the connection]
maximiliantagher has joined #nixos
eadwu has quit [Quit: WeeChat 2.3]
<lfish>
Hello, I'm following a tutorial in Ruby on Rails and trying to make a shell.nix for it. This is what I got https://pastebin.com/sWcDKFDz . Problem is, as far as I can tell, that ruby, or the gems installer has to be aware of libxml2 and curl to be able to build one of the gems used. And I don't know how to do that, help please.
maximiliantagher has quit [Ping timeout: 250 seconds]
mmlb has joined #nixos
brejoc has joined #nixos
andersk has quit [Read error: Connection reset by peer]
o1lo01ol1o has quit [Remote host closed the connection]
attente[m] has left #nixos ["User left"]
fusion809 has quit [Remote host closed the connection]
<iqubic>
jackdk: Do you know how I can specify that my haskell project depends on an external binary? I'd like to also be able to keep using cabal2nix as well.
andersk has joined #nixos
<jackdk>
iqubic: did you read my paste on #haskell?
<colemickens>
Hi, I booted an old nixos image and am trying to upgrade in place. If I add the nixos-18.09 channel as "nixos" adn then try to nixos-rebuild switch, I get errors like this:
<colemickens>
error: syntax error, unexpected $undefined, expecting IND_STR or DOLLAR_CURLY or IND_STRING_CLOSE, at /nix/store/gf653a6gsdr32akf8cknp8y8gacr1fws-nixos-18.09.2104.addb7f23ebc/nixos/pkgs/build-support/fetchpatch/default.nix:42:40
<colemickens>
Did I do something wrong?
maximiliantagher has quit [Ping timeout: 240 seconds]
<lfish>
hello, I'm runinng into issues trying to set up an environment to develop with rails. I need a gem that in turn requires curl, libxml2 and gcc to be built. This is what I have now https://pastebin.com/sWcDKFDz . How do I make the libraries available in the building environment of the gems themselves?
nschoe has joined #nixos
dermetfan has quit [Ping timeout: 245 seconds]
zupo has joined #nixos
wigust has quit [Ping timeout: 245 seconds]
zupo_ has joined #nixos
nschoe has quit [Client Quit]
wigust has joined #nixos
nD5Xjz has joined #nixos
tzemanovic has joined #nixos
zupo has quit [Ping timeout: 240 seconds]
rauno has joined #nixos
tzemanov_ has joined #nixos
Ariakenom has joined #nixos
jmeredith has quit [Quit: Connection closed for inactivity]
<srhb>
colemickens: iirc that's an actual syntax change in Nix lang, you'll need to go stepwise to get a newer nix that is able to interpret the newer nixpkgs
ckauhaus has joined #nixos
<srhb>
colemickens: (Try cutting the upgrade path in half)
ottidmes has joined #nixos
<colemickens>
srhb: turns out it was easier to just be patient and build/upload a new image. I think you're right about the problem though.
<srhb>
colemickens: Yeah, okay. :) Either way works.
reinhardt has joined #nixos
<clever>
srhb: the modern nixos-rebuild will download a pre-built nix from the binary cache, to deal with that
<srhb>
clever: Yep, but you need to get that first :P
<clever>
in the past, i have manually done nix-store -r, and then jammed it into PATH and set a magic var
<srhb>
Yeah, me too.
<colemickens>
it'd be cool to have that documented, if it's not.
<srhb>
colemickens: I prefer recommending the stepwise upgrade normally, since it uses mechanisms people are already mostly comfortable with.
<srhb>
When you start documenting "you can hack this and that using Nix" you're in for a wild ride due to the hackability. :-P
<srhb>
Re-reading the db dump with an older nix is fun too...
<clever>
infinee: one sec
<clever>
srhb: i read what the upgrade did, and then manually downgraded
<colemickens>
srhb: oh nothing serious :) I think I understand what you're saying. I was more having a reaction to "hack"-iness and my feelings around the nix clis in general
<infinee>
clever, total n00b. Have used other linux dists but new to both nix and zfs. Need a doc that reallly holds my hand
* colemickens
has been imagining a NIX_PATH-less nixos :)
<clever>
infinee: that bash script will wipe the disk, and then setup a zfs pool, optionally inside luks
<srhb>
colemickens: fwiw maye we should document nix-store -r better because of its immense utility.
<srhb>
colemickens: It's extremely useful to get something that you know works somewhere else.
<clever>
srhb: its also usefull for fetching whatever somebody is using when they have an error, and comparing their version against yours
<srhb>
colemickens: I would like that too. Also ~/.config-less nix, etc.
<srhb>
colemickens: It's doable, but.. Nasty in general
<srhb>
clever: Yeah. Now if only we had a good model for realizing broken builds.
<srhb>
clever: I've sometimes split up builds from tests in a commercial setting to support this.
<srhb>
to better* support this. Sharing broken builds is useful too...
<clever>
srhb: there is also the flag to make the build "pass" upon failure
<srhb>
I think I only know about --keep-failed
<clever>
succeedOnFailure = true;
<srhb>
Oh, interesting.
<clever>
this makes the nix-level build "succed" even on failure
<clever>
it will write the real exit code to $out/nix-support/failed
<srhb>
Cool.
<clever>
hydra will then still treat it as a failure
<srhb>
I can definitely use this.
<clever>
but, its in the binary cache, hydra-build-products still work
<clever>
so you can download logs from a failing test
<colemickens>
I think I have something close. What I have now unsets NIX_PATH and can rebuild my system configuration closure exactly, whether with a local checkout, or a tarball url+shortGitHash. I should be able to use the `result/.../switch-to-configuration` to activate a new generation, and thus be able to upgrade my nixos install without having NIX_PATH set or relying on `nixos-*` tooling.
<clever>
srhb: i had a derivation that would generate tcpdump captures of every node, along with log files, for the whole test run
<srhb>
colemickens: Someone in this channel actually has something extremely environment-agnostic, but I forget their name...
<colemickens>
I think it would go through a bloody code review by a nix expert, but it works, just need to document it and see what some other people think.
<wacke>
as my script-mysql-pre-start looks like: ... /nix/store/1sw2a14xp6an3hd7358z23r04f2zlrl8-mysql-5.7.23/bin/mysql_install_db --user=mysql --datadir=/var/mysql --basedir=/nix/store/1sw2a14xp6an3hd7358z23r04f2zlrl8-mysql-5.7.23 --pid-file=/tmp/mysqld.pid ...
<teto>
is there a page where one can see the last (known) commit a package built ? Or rather how to get haskell packages to build on nixos-unstable, should I just install packages from a stable release ? almost always they fail on unstable
dramforever has joined #nixos
<srhb>
teto: Hydra is your best bet.
<srhb>
teto: I have no problems using Haskell packages on unstable, really. Of course, there's a lot of breakage with every GHC bump.
<infinee>
If I chose to use EFI on my system. I'm supposed to uncomment boot.loader.grub.device and change it to "nodev"?
<srhb>
teto: If you have a specific package that's problematic, ask about that. :)
<srhb>
infinee: Generally we use systemd-boot for efi, not grub.
<srhb>
infinee: But yes, that's one of the necessary grub settings on efi.
<clever>
i prefer grub, since it has far more options
<infinee>
srhb, oh b/c boot.loader.grub.enable is true by default
<ivegotasthma>
I'm looking to deploy a project with nix. I want to use nix as a docker replacement. Is it possible to do service startup / shutdown with nix? I have a web server and I want a postgres db running alongside it.
<srhb>
teto: The easiest way to go is through the nixpkgs project, trunk (master) jobset
<teto>
I've removed every haskell package from my config since they were always preventing me from upgrading. Also they pull lots of stuff.
dermetfan has joined #nixos
Czen has joined #nixos
<srhb>
teto: I'm not sure why mdcat doesn't show up in that set on Hydra, but yes, it's broken.
<Taneb>
How do multiple output packages and hydra-build-products/hydra-metrics interact?
<ivegotasthma>
what should I use to deploy a python webserver with a postgresql instance? I'd like to replace docker with nix for deployment
<srhb>
ivegotasthma: NixOS :)
<ivegotasthma>
I have a debian vps
<srhb>
ivegotasthma: That makes it a bit harder.
<ivegotasthma>
would like to use nixos on it though :)
<srhb>
ivegotasthma: We have a great infrastructure for creating systemd units for whatever arbitrary service you like in NixOS, but not so much Nix-on-other-OS
sigmundv_ has joined #nixos
civodul has joined #nixos
perohig has joined #nixos
<ivegotasthma>
srhb: how would that work on nixos? perhaps I can port some of the things to nix-on-other-os-with-systemd
<ivegotasthma>
srhb: I assume nixops would be used with nixos?
<clever>
srhb: if you buildEnv several .service files together, you could then "install" them on any machine, and point systemd towards that dir
regulus- has quit [Ping timeout: 250 seconds]
<clever>
and that will allow running nixos services no non-nixos
__Sander__ has joined #nixos
kvda has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<ivegotasthma>
clever: cool stuff, thanks
<clever>
ivegotasthma: some services may run into problems, such as hard-coded /run/current-system, or assuming users.users actually made a user, but youll just need to find such things and fix them as they occur
<nodyn>
Hi everyone! I need to use `nix path-info` with the result of calling `srcOnly` on a package. What's the proper syntax for that? Do I need to define an overlay or something like that?
<dramforever>
Does `nix path-info nixpkgs.yourPackage.srcOnly` do what you want?
<ottidmes>
I am running into the following error when trying to build some static assets with nodejs as a fixed-output derivation: sh: /build/web/node_modules/.bin/opencollective: /usr/bin/env: bad interpreter: No such file or directory, I want to shadow/replace that opencollective bin by `return 0`, which worked in previous attempts with node2nix, not sure how to do it with a fixed-output derivation though. I doubt I
<ottidmes>
can define the missing /usr/bin/env, because that assumes sandboxing, I am going to try and write it before it gets installed as readonly
Guest60340 has quit [Ping timeout: 250 seconds]
<clever>
ottidmes: you have to run patchShebangs over the script (or the scripts dir)
<clever>
ottidmes: that will replace every /usr/bin/env foo, with $(which foo)
<nodyn>
dramforever: No, the attribute doesn't exist :\ (By the way, the package on which I'm trying to do that is kerberos)
<{^_^}>
[nixpkgs] @Mic92 opened pull request #55323 → flameshot: fix executable path in dbus service → https://git.io/fh92z
<ottidmes>
clever: I would, if I could, but its fetching and calling in the same npm command
<ottidmes>
clever: yeah, all the tools I could find, none work for this use case
<nodyn>
That works, thanks dramforever!
<dramforever>
I think something says that 'nix' recognizes nix expressions when passed like '(this)', but I have absolutely no idea
<ottidmes>
clever: and they are all more messy than I would like, in the sense that its non trivial to then put it into nixpkgs (the whole purpose of the packaging)
<clever>
ottidmes: yarn2nix should be able to patch the things in node_modules before running the scripts
<clever>
ottidmes: ah, yeah, yarn2nix involves IFD, but i have seen signs that it can work without IFD as well
<ottidmes>
clever: yeah, but then I run into other stuff, I tried multiple times, I have given up on that approach
<ottidmes>
clever: but if I wanted to make sure a file would not be overwritten, how would I go about that, or is that not viable in the build sandbox?
<clever>
in your case, you would want something like /usr/bin/env=${pkgs.coreutils}/bin/env
<{^_^}>
[nixpkgs] @Moredread opened pull request #55324 → crawl: A few improvements → https://git.io/fh92y
<ottidmes>
clever: would that work for packaging, I mean, the whole purpose is to contribute it to nixpkgs, I already have it build through other means myself
nodyn has quit [Ping timeout: 244 seconds]
<clever>
ottidmes: oh, yeah, hydra, and all end-users, would fail to build it, without that change
<clever>
and i think /usr/bin/ is read-only from within the sandbox
<clever>
so your only choice is to patchshebangs, before the script gets ran
<ottidmes>
clever: which is not possible, so its not an option I am afraid
infinee has quit [Ping timeout: 246 seconds]
<clever>
why is it not possible?
<clever>
patchPhase? postUnpack? replace the tar with a patched tar before nix gets it?
<ottidmes>
clever: like I said, the one npm call does the downloading and calls that bin at the same time: npm install --cache ../npm-cache
nodyn has joined #nixos
<clever>
its running the bash script inside the fixed-output derivation?
rprije has joined #nixos
<clever>
s/bash//
<ottidmes>
clever: its running npm install --cache ../npm-cache inside the fixed-output derivation, thats kinda the point
<clever>
if its running scripts at that phase, then its both a security problem, and a purity problem that can break the hash at any time
<{^_^}>
#54880 (by dramforever, 1 week ago, open): pulseaudio-dlna: downgrade dep zeroconf to 0.19.1
<ottidmes>
clever: hence me trying to ignore those scripts
<ottidmes>
clever: its just the one
<clever>
ottidmes: you might want to look at how yarn2nix is doing the download, i believe its entirely pkgs.fetchurl calls, so no scripts can run at that time
<dramforever>
pulseaudio-dlna is a python 2 application that depends on pythonPackages.zeroconf, which dropped python2 support and got disabled. That means pulseaudio-dlna fails to evaluate.
<ottidmes>
clever: already found an actual option "--ignore-scripts" so exactly what I was looking for
<dramforever>
But I'm not quite sure how I'm supposed to put zeroconf-0.19.1 in Nixpkgs so that pulseaudio-dlna can use it
<goibhniu>
hi dramforever, python2 support is coming to an end at the start of next year anyway. Is there a branch that supports python 3, or an alternative project?
<moredrea8>
Spend days packaging crawl because I didn't find in nixpkgs. XD Atleast I learned a bit about packaging quirks...
<ottidmes>
clever: BTW, node2nix, does run those scripts, so I am not sure if so safe either
<dramforever>
goibhniu: I think there *is* a python 3 branch. I'll try to see if it works.
<dramforever>
Oh, and it isn't an official release yet.
<dramforever>
goibhniu: So you mean we should wait for upstream to migrate to py3 instead?
<infinee_>
clever, small issue. my nixos-install was chugging away and then failed on grub install. error about failure to resolve canonical path to /boot/efi. I tried to look at /mnt/nixos/configuration.nix again but it's gone as the installation seems to have removed /mnt/etc/nixos directory
Avaq has quit [Quit: Lost terminal]
<clever>
infinee_: the installation should never remove /mnt/etc/nixos/
<dramforever>
Typo at /mnt/nixos/configuration.nix ?
<clever>
infinee_: what does `mount` output?
Avaq1 has joined #nixos
<infinee_>
no typo
<clever>
infinee_: there is a /etc/ missing in that string
Jetien has quit [Ping timeout: 244 seconds]
<infinee_>
mount shows all my zfs mount points
<dramforever>
I mean, were you looking at /mnt/nixos when you meant to look at /mnt/etc/nixos?
<infinee_>
oops ur right
<clever>
infinee_: can you pastebin the whole mount output?
<infinee_>
clever, mnt issue is my bad. any idea why my grub failed to install?
<ottidmes>
clever: I ran `patchShebangs node_modules/.bin` and checked it indeed is `/build/web/node_modules/.bin` yet it patches nothing and I still get `sh: /build/web/node_modules/.bin/gulp: /usr/bin/env: bad interpreter: No such file or directory` (which seems to indicate a shebang, I am going to --keep-build and see what that file looks like)
<{^_^}>
[nixpkgs] @Profpatsch pushed commit from @r-ryantm to master « rabbitmq-server: 3.7.10 -> 3.7.11 »: https://git.io/fh9aK
Glider_IRC has quit [Remote host closed the connection]
Glider_IRC has joined #nixos
Glider_IRC has quit [Remote host closed the connection]
<infinee_>
ok, kind of worked. rebooting gave me invalid boot media error. I tried every device in boot options with no success. I stuck in live usb again, selected some refifind thing, it gave me an error and then somehow I was able to boot my hdd installation of nixos (via live usb). What do I need to fix?
<clever>
infinee_: you can just `zpool import tank` and then re-mount everything to the old spot, edit the config, and re-run nixos-install
<infinee_>
I'm already in the booted system. I edited configuration.nix. what's the zpool import for? everything is mounted and working (all except the grub booting part)
Glider_IRC has joined #nixos
<clever>
infinee_: oh, if its booted into the real install, then its already imported and mounted
Glider_IRC has quit [Remote host closed the connection]
<infinee_>
yeah zfs is working fine
<infinee_>
just grub failed when I boot
<infinee_>
just change config and nixos-install again?
<infinee_>
or do I use nixos-rebuild?
<srhb>
nixos-rebuild boot --install-bootloader (depending on the failure mode, I guess)
Glider_IRC has joined #nixos
Glider_IRC has quit [Remote host closed the connection]
<clever>
infinee_: if your booted into the final install, then its nixos-rebuild
<Taneb>
I'm getting an error "_assignFirst found no valid variant!" when I try to build a derivation I'm working on and I don't know what it means
<infinee_>
I've only ever used full desktop dists like ubuntu, kde, gentoo, arch. went to macos for a few years and felt like getting back into this but with a more spartan environment. so I'm trying i3 with no desktopmanager :)
<srhb>
infinee_: I'm on something similar.
<srhb>
It's a bit more fiddly that going the full desktop environment route, but my workflow is so specialized these days I can hardly imagine going back..
<infinee_>
srhb, this machine is for dev. was so sick of dealing with git-bash and cygwin on my gaming pc
<clever>
infinee_: my primary desktop dual-boots nixos and win7
<clever>
but i almost never boot into windows (maybe once a month or less)
maximiliantagher has quit [Ping timeout: 240 seconds]
<infinee_>
win7 doesn't even get updates anymore does it?
<clever>
i think it still does
<infinee_>
my last company was forced to upgrade 3yrs ago because MSFT were saying w7 was end of life and would receive no more support
erictapen has joined #nixos
DrLambda has joined #nixos
<{^_^}>
[nixpkgs] @ilikeavocadoes opened pull request #55329 → mdlt: init at 0.0.4 → https://git.io/fh9VI
Soo_Slow has quit [Remote host closed the connection]
knupfer has quit [Read error: Connection reset by peer]
joehh has quit [Ping timeout: 250 seconds]
knupfer1 is now known as knupfer
<wedens>
dramforever: wrapProgram is the same as makeWrapper. it just doesn't need output path to be specified
joehh has joined #nixos
<mupf>
Hey guys, I'm currently trying to adjust the default.nix for my SDL development projects. can anyone tell me how to adjust it to use OpenGL? I tried but all I'm getting is:
<mupf>
fatal error: GL\GLU.h: No such file or directory
<wedens>
mupf: wait. you don't have libGL anywhere in you expression
zupo_ has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<mupf>
Yes, not on GitHub. Just locally like the others libxml2, etc
zupo has joined #nixos
<dramforever>
mupf: They release bugfixes and security updates every now and the
<dramforever>
*then
<dramforever>
To get them: sudo nixos-rebuild switch --upgrade
<ottidmes>
I am getting "tls-alpn-01 was not recognized" with the acme NixOS module, it used to work before without any problems, I checked, dont have any AAAA records for the domain either, not sure how to fix this, I guess I will try a different ACME client on NixOS
<mupf>
wedens: "-I${getDev libGL}/include" etc
orivej has quit [Ping timeout: 252 seconds]
<mupf>
dramforever: thanks
<gchristensen>
sphalerite: hey how do you feel about meetings?
<srhb>
yayforj: My very, uh, opinionated opinion is that that's the most powerful choice.
<srhb>
There's also stackage2nix and stack2nix, which people tend to bring up at this point, but I can't do anything but mention their names and let you judge if they are useful to you.
<yayforj>
srhb: i just have this very stack heavy project atm
<srhb>
yayforj: If it has a abal file it's probably almost good to go with the nix infra already.
<srhb>
cabal file*
reinhardt has joined #nixos
<yayforj>
srhb: whit if you have a cabal file with bounds on practically everything that cant be jail braked btw
<yayforj>
what*
<srhb>
yayforj: That might be bothersome.
<srhb>
yayforj: We generally only supply one version of each library, everything else is up to the user to fetch (using eg. callHackage "somepackage" "someversion" {} and friends)
<srhb>
I'd say it's still worth it, but there's a learning curve.
<yayforj>
srhb: it is. I tried stack2nix magic on it, but it generates the whole new `haskellPackages` set for you to build from scratch
<srhb>
Indeed.
<srhb>
One time cost though.
<srhb>
Once everything's built once, it's built.
iqubic` has joined #nixos
<yayforj>
It's fine when you have some kind of a build server, or at least a decent machine
<Taneb>
Do you think a PR to add dontCheck to a whole load of GHCJS libraries would get accepted?
<srhb>
yayforj: Yeah, haskell builds can be heavy. You might want to use fewer cores, fewer parallel builds, and go for the strategic overrides rather than a full blown new package set.
<yayforj>
just curious, are there non haskell people here?
<srhb>
Taneb: Yes.
<srhb>
yayforj: Yes.
<srhb>
yayforj: But fwiw there's a rather large overlap of Nix and Haskell users.
<gchristensen>
whats haskell?
<srhb>
gchristensen: :trollface:
<Taneb>
srhb: OK, once I can get lens to build I'll make the PR
knupfer has quit [Ping timeout: 268 seconds]
<mpickering>
Taneb: Do you know why there is still a `ghcjs` and `ghcjs-ng` compiler defined?
<gchristensen>
less trolly, Nix was my first functional programming language, and is still the only one I actually use :P
<Taneb>
mpickering: no idea, honestly
<srhb>
gchristensen: We still love you though. One day we'll drag you screaming into the bright future. :-)
<Taneb>
mpickering: I was just curious if lens builds on GHCJS and got the answer "no for a reason I might be able to fix"
<mpickering>
I'm sure it does build on ghcjs as I'm sure reflex applications will use it
<gchristensen>
srhb: ^_^ thanks, I love you all, too
agander has joined #nixos
<srhb>
mpickering: Hmm, I'm not sure ghcjs-ng still exists, where is it?
<mpickering>
In `compilers`
<srhb>
I see
<srhb>
Oh, it's the other way around then
simukis has joined #nixos
tzemanovic has quit [Remote host closed the connection]
<srhb>
I'm not sure ghcjs is used anymore. elvishjerricco?
<srhb>
All the current attrs point to -ng
maximiliantagher has quit [Ping timeout: 245 seconds]
<Taneb>
srhb: haskell.compiler.ghcjs ends up pointing to -ng
<srhb>
Yeah, exactly.
<srhb>
I think the ghcjs dir might be dead code entirely.
<ottidmes>
gchristensen: saw that comment too, when it was just posted, do you know where this remark is coming from "IIRC Nix’s are significantly worse than Debian’s or Alpine’s.", does it have any merit, or is just a needless attack? I know that some important pieces are written as somewhat big scripts, but is that truly "significantly worse" than other distros?
<clever>
gchristensen: oh, it was sphalerite i was helping with oil!
<Taneb>
We're hiring for a IT manager/sysadmin/devops-y role that'll involve a decent amount of Nix if anyone would be interested (Cambridge UK)
<betaboon>
Taneb: remote or onsite ?
<gchristensen>
Taneb: do you have a link to go with it?
<Taneb>
betaboon: onsite, it involves maintaining physical servers
sicklorkin has joined #nixos
<Taneb>
gchristensen: I'm afraid not, the company is myrtle.ai but our website is being redone, which apparently means we're not updating the "open positions" webpage
<Taneb>
I'll ask if the full role description is posted anywhere public (it ought to be if it's not)
<sicklorkin>
i've got a multi-user envrionemnet set up and someone is asking me to set up nix-serve. this presumably hosts whatever bincaches that are on disk. Is there a way to run this globally?
<gchristensen>
Taneb: if you do, I'll share it around
<Ankhers>
Is there a preferred way a foo2nix tool should work? For example, should it just everything to a default.nix file, or maybe keep deps separate in a deps.nix that the default.nix can pull in, or something else entirely?
Jetien has joined #nixos
<gchristensen>
my only "requirement" is they print at the top of every generated file "Generated by foo2nix (https://github.com/foo/2nix) version x.x.x via: foo2nix --the --exact --arguments --they --called it with"
<Ankhers>
Even if the generated file is not meant to go into the nixpkgs repo?
<gchristensen>
yes
<Ankhers>
I can deal with that. It makes a lot of sense.
thatuser has joined #nixos
<gchristensen>
too many times I have seen "#generate by foo2nix" at the top (or not at all) and had to spelunk through history to figure out which foo2nix it was, then what version it was, and then how to use the thing
<infinee_>
What's the difference between adding pkgs to configuration.nix and running nixos-rebuild vs using 'nix-env -i ...' ?
<Ankhers>
You add the pkgs to configuration.nix then would need to run nixos-rebuild.
<Ankhers>
That would make it available to everyone on the system.
<Ankhers>
using nix-env -i ... makes it only available to you I believe.
<symphorien>
infinee_: nix-env is usable by unprivileged users
<infinee_>
so for system wide stuff (i.e. parted), I should use the nixos-rebuild?
<{^_^}>
[nixpkgs] @jabranham closed pull request #54480 → redshift: Install systemd user unit files → https://git.io/fh2Sp
<thatuser>
hey guys i'm trying to use flutter for app development, when building using nix-build i need to accept the SDK license by setting nixpkgs config option 'android_sdk.accept_license = true;'. However even after setting this in my /etc/nixos/configuration.nix it doesnt work. Is there something that I'm overlooking?
<symphorien>
you must also set this config in ~/.config/nixpkgs/config.nix
<sicklorkin>
are there any guides to can help me migrate from stack to cabal-v2 and nix? the version i have right now is using stack2nix and it appears to I cannot take advantage of any nix package cache, instead it's building everything from source which is suboptimal
<pie_>
jtojnar: I havent been able to find anything on what the value of shellpath is supposed to be set to?
<{^_^}>
[nixpkgs] @matthewbauer closed pull request #53327 → stdenv: assert whether `name` or (`pname` and `version`) are given → https://git.io/fhYqr
<jtojnar>
pie_: it should be set to the shell executable location inside the package
<jtojnar>
something like /bin/ion
zupo has joined #nixos
<pie_>
jtojnar: oh!
<pie_>
jtojnar: do you know if this is documented in a comment somewhere or something?
<jtojnar>
I do not think so
hyper_ch2_ has quit [Quit: Page closed]
<pie_>
:I
<pie_>
ok thanks
<jtojnar>
also can ion be used as a default shell? I thought they wanted to discard backwards compatibility
<pie_>
jtojnar: kind of, isnt that fine though? shouldnt anythign that requres bash or whatever use a shebang?
warbo has quit [Read error: Connection reset by peer]
iqubic` has left #nixos ["ERC (IRC client for Emacs 26.1)"]
<srhb>
Oh, I see Mic92 already discovered this problem..
<jtojnar>
pie_: I think /etc/profile is heavily used for desktop environments (GNOME) and it only supports bash, zsh & fish
<jtojnar>
but feel free to try and report back
<pie_>
jtojnar: huh. what does that do
<pie_>
but yeahhhh it looks like it
<gchristensen>
non-posix login shell is probably going to be a nightmare of bug reports (pretty sure the collective noun for "bug report" is "nightmare")
<ghostyy>
i accidentally did nix-rebuild switch; nix-store --gc; reboot on a machine that had hardware.enableRedistributableFirmware set but then rebuilt into a configuration that didnt
hph^ has quit [Ping timeout: 268 seconds]
<ghostyy>
how do i fix this? i cant access the internet on it...
<ghostyy>
if i could somehow put the necessary parts of the store onto a usb or something
<infinisil>
ghostyy: No other machine available?
<pie_>
jtojnar: i just realized you said it supports fish ???
<ghostyy>
infinisil, well obviously i have this one :P
<gchristensen>
ghostyy: you should still have the previous generation
<ghostyy>
hm
<jtojnar>
pie_: yup, I use it
<ghostyy>
so if i rebuild into a previous generation, the firmware should be there?
<gchristensen>
should be!
<gchristensen>
ghostyy: just reboot, and at the bootloader select the prior system version
<ghostyy>
ah... ill try that
fusion809 has joined #nixos
<infinisil>
Ah right, nix-store --gc doesn't do anything bad. I somehow thought that would remove prior generations
<ottidmes>
is there some easy diff out there that is not line based (I am diffing compressed js files, making line based diffs pointless). I am trying to figure how I can make the compressed js files give me consistently the same output, but webpack seems to generate stuff that differs per build
<gchristensen>
ottidmes: diffoscope is a nice tool
<gchristensen>
another thing I've done with compressed / uglified JS is to run it through a JS formatter and then diff it
hedning has joined #nixos
o1lo01ol1o has joined #nixos
knupfer has joined #nixos
<ottidmes>
gchristensen: thanks! I will look into diffoscope and pretty printing the JS is a good plan B indeed :)
hph^ has joined #nixos
maximiliantagher has joined #nixos
Avaq has quit [Ping timeout: 250 seconds]
dbmikus_ has quit [Read error: Connection reset by peer]
dbmikus_ has joined #nixos
<ottidmes>
gchristensen: diffoscope works great, that is definitely a tool to keep :)
<ghostyy>
bless you gchristensen that worked perfectly
<gchristensen>
ghostyy: yay nixos :)
<ottidmes>
managed to find the issue immediately, cache tag was different in both files, so I checked the webpack config and voila: 'CACHE_TAG': JSON.stringify(Math.random().toString(36).substring(7))
<ghostyy>
i thought since i did a garbage collect then all the firmware would be gone and id have to dig out a sufficiently long cat5 cable
<gchristensen>
nooo random please
maximiliantagher has quit [Remote host closed the connection]
maximiliantagher has joined #nixos
<gchristensen>
ghostyy: nixos won't let you (unless you go around its protections) garbage collect the nixos generation you booted from :)
maximiliantagher has quit [Ping timeout: 272 seconds]
<{^_^}>
[nixpkgs] @timor opened pull request #55351 → kio-extras: enable man protocol → https://git.io/fh9iR
maximiliantagher has joined #nixos
<yayforj>
nix-env -iA nixpkgs.haskellPackages.stackage2nix fails with
<yayforj>
builder for '/nix/store/sz8zjfhnyb6dx2sm7h66zlls3vxa81vs-gitlib-test-3.1.1.drv' failed with exit code 1builder for '/nix/store/sz8zjfhnyb6dx2sm7h66zlls3vxa81vs-gitlib-test-3.1.1.drv' failed with exit code 1
<yayforj>
how, why, por que?
drakonis has quit [Quit: Leaving]
<clever>
yayforj: there should be an error above that line
<yayforj>
ghc fails to deduce MonadFail somewhere in sourcess
<{^_^}>
[nixpkgs] @veprbl pushed commit from @tadeokondrak to master « fff: 2.0 -> 2.1 »: https://git.io/fh9iP
nD5Xjz has joined #nixos
__Sander__ has quit [Quit: Konversation terminated!]
regulus_ has quit [Ping timeout: 272 seconds]
regulus_ has joined #nixos
maximiliantagher has joined #nixos
<dhess>
Stupid question time: if my local Nix host's system type is "foo", and I have remote builders of type "foo" in /etc/nix/machines, but I want nix-build and friends to use my local Nix host as well as the remote builders, should I add a localhost line to my /etc/nix/machines, or is there an easier way?
<dckc>
are there norms / conventions for managing database-backed services? where I want to be able to upgrade the config without wiping out the db
zupo has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
maximiliantagher has quit [Ping timeout: 246 seconds]
<dckc>
hmmm... `nixos-container create xxx` gives permission denied (mkdir /etc/containers) but adding sudo gives version `CURL_OPENSSL_3' not found (required by /usr/lib/libnixstore.so)
<Twey>
clever: Neat, thanks!
<Taneb>
On my "get haskell.packages.ghcjs.reflex" building sidequest, I've hit something I can't solve with dontCheck
<{^_^}>
[nixpkgs] @worldofpeace pushed commit from @Synthetica9 to master « albert: 0.15.0 -> 0.16.1 »: https://git.io/fh9PS
periklis has quit [Ping timeout: 272 seconds]
sinner is now known as Guest34677
<gchristensen>
lol
<gchristensen>
yikes
o1lo01ol1o has quit [Remote host closed the connection]
<dckc>
oh... right... "Setuid and setgid programs are not currently supported by Nix."
<ottidmes>
how do I deal with a Rust package no longer building on Rust 1.31 (the rustc version on nixos-unstable at the moment), if I want to publish it to Nixpkgs?
maximiliantagher has quit [Ping timeout: 268 seconds]
<dckc>
trying `nix-env -i sudo` ...
ikitat has quit [Ping timeout: 240 seconds]
<symphorien>
ottidmes: 1.32 is in staging so wait a few days ?
<clever>
dckc: the sudo made by nix-env cant be used, ever
zupo has joined #nixos
reinhardt has joined #nixos
<clever>
it must be setuid root to function, and /nix/store/ doesnt support the setuid bit
<hodapp>
doing your builds inside nix-shell, with dependencies declared there, is also good practice for if you eventually want the result of that build put into a derivation of its own
<infinee_>
cuz when I did a `which make` it wasn't found, I assumed it wasn't installed anywhere
<clever>
infinee_: nix allows things to be downloaded, but not "installed"
fusion809 has quit [Remote host closed the connection]
<infinee_>
hodapp, yeah but golang has it's own way of downloading deps so I'm not sure if the nix way of doing things translates well to go projects. I'll see as I get more experience with this. brb switching to my nix machine :)
infinee_ has quit [Quit: Leaving]
<{^_^}>
[nixpkgs] @NeQuissimus pushed 3 commits to release-18.09: https://git.io/fh9X1
<Twey>
infinee: Lots of things have their own ways of downloading deps, but there's no stopping nixpkgs ;) You can auto-generate expressions for Go (dep) packages using https://github.com/nixcloud/dep2nix
<infinee>
but one advantage of Go is that it's cross platform so I can build it on another machine easily. If I relied on nixpkgs, that other system would need nix
<hodapp>
you don't need to have it be the sole source of your build
<srhb>
infinee: Conversely, with nix, you only need Nix, not even go!
<infinee>
what's screenshot tool do you recommend that provides auto upload ? just tried flameshot but it's not working and there's an open issue on their github reporting same problems
Judson has joined #nixos
DrLambda has quit [Ping timeout: 250 seconds]
<gchristensen>
srhb: not to mention the part where that remains true for *EVERY* project
Judson is now known as Guest54897
<srhb>
infinee: And that argument scales to more than just go. :-)
<srhb>
Dammit
<infinee>
wait a minute. Nix is a pkg management tool right? how are we replacing a programming language such as Go with it?
<srhb>
gchristensen: Stealing muh thunder
<gchristensen>
srhb: I'm so sorryw!
<srhb>
infinee: The recipient of yourpackage need not care about a go toolchain if it's nixified. Nix will take care of that.
<srhb>
infinee: Likewise for a rust project, a haskell project, a ... project
<infinee>
damn it. your nick is yellow on my default irssi+term and totally illegible. I don't even know who I'm chatting with :(
<srhb>
You can pronounce it "shrub" :-P
<infinee>
oh you're talking about the packaging aspect of Go. Ok, not the programming part. gotcha
<clever>
infinee: first thing i always do is set the background color to black
<srhb>
infinee: Indeed.
yayforj has joined #nixos
Mateon3 has joined #nixos
<srhb>
infinee: It might seem a small argument, but keeping a toolchain version intact across various developers' machines is... In my experience really crucial, and something no people really do well outside of Nix land. :)
<srhb>
Even Go runs into "works for me"
Mateon1 has quit [Ping timeout: 244 seconds]
Mateon3 is now known as Mateon1
jabranham has joined #nixos
<elvishjerricco>
srhb: hear hear!
<gchristensen>
nix: works for you
<gchristensen>
(if we did ads, could be a cute ad here)
<srhb>
gchristensen: Hey, are we actually using that? That's really good
<srhb>
Pompous, but good.
<gchristensen>
no, just came up with it :)
<infinee>
No, I agree. That's why I'm here. one of my development teams use nix and when I was able to build on my local machine with ease I told myself I needed to give this a try
<infinee>
...build the project they'd been working on for months
mkoenig has quit [Ping timeout: 268 seconds]
<sicklorkin>
I see two tools for converting a stack project to nix pkgs, 1) stackage2nix 2) stack2nix. My understanding is that I should run stackage2nix to create a nix w/those packages build w/the resolver and for all other dependencies I should use stack2nix.. or is there a canonical way of doing this?
<srhb>
gchristensen++
<{^_^}>
gchristensen's karma got increased to 71
<srhb>
infinee: yay :)
<clever>
sicklorkin: i think stackage2nix is just for converting an entire stackage snapshot, and has nothing to do with stack.yaml
PLPD-Bot has quit [Remote host closed the connection]
<sicklorkin>
clever: so stack2nix worked but i was forced to build all the haskell sources and I'm not quite sure why.. i was under the impression that it would *just* ffetch from whatever blob was used in that paticular lts
<clever>
sicklorkin: it needs versions built by nix, but stackage isnt building with nix
<infinee>
srhb: lol it took me this long to figure out copy/paste just to copy your replies to me and figure out I was talking with you :)
maximiliantagher has joined #nixos
<infinee>
now to change this damn bgcolor
<srhb>
infinee: Sorry :-P
srl295 has joined #nixos
Jetien has joined #nixos
<sicklorkin>
clever: is there a way to get versions built by nix? Or does everyone just built them locally?
<clever>
sicklorkin: when using stack2nix or nix-tools, your overriding the version of every single package, so hydra.nixos.org wont have things covered anymore
<clever>
sicklorkin: the only way to get coverage from the cache, is to change the minimal subset you need, and to stay as close to nixpkgs as you can
<sicklorkin>
clever: right, so i don't want this then
<sicklorkin>
i think i want to try to do the latter
<sicklorkin>
in which case, how does this set-up ivolve? just a make-deps section?
<clever>
sicklorkin: ivolve?
fusion809 has quit [Remote host closed the connection]
<sicklorkin>
clever: not sure what ivolve is, no duckduckgo love there
<sicklorkin>
clever: i just realized my typo above .. s/ivolve/involve/
<clever>
oh, lol
<clever>
sicklorkin: what are you trying to build?
<sicklorkin>
haskell projects (using stack) i'm using lts 12.18 and (ghc 8.4.4) and have 3 packages which i've copied and modified to fix various things, and finally I have 20 or so packages that aren't in the resolver.. What i want to accomplish is. use nix to fetch lts binaries, and build the remaining packages (which I can then share w/bincache or something)
<{^_^}>
input-output-hk/iohk-ops#352 (by cleverca22, 34 weeks ago, merged): [DEVOPS-836] configure hydra to upload everything to S3
<LnL>
err, joko ^
<lfish>
hello! I'm following a tutorial on rails and I'm trying to set up an expression for developing the pages. I'm having trouble to get a project that uses the gem fog working. It (fog) needs libxml2 and libcurl to be built, and bundler can't find it. I've used bundix -m where the Gemfile is and have this expression so far https://pastebin.com/sWcDKFDz . Help please
<joko>
Cool!
fusion809 has joined #nixos
o1lo01ol1o has joined #nixos
<joko>
And does anyone know if it is possible to periodically clean this cache? I was thinking of setting up something like minio for mine
<sicklorkin>
clever: thanks, that'll keep us busy for a little while
<srhb>
joko: Not out of the box.
<dckc>
so... what's the norm for invoking root privilege if there's no sudo?
<clever>
dckc: su, ssh root@localhost, installing sudo
<srhb>
dckc: su? NixOS does have sudo by default though.
<LnL>
joko: not in a nice way, and nix might freak out if nars disappear
<gchristensen>
srhb: my coworker suggested “Wenn nichts mehr geht hilft *Nix*”
<srhb>
gchristensen: I like that too :P
<dckc>
it has sudo_which_does_not_work, right?
<srhb>
dckc: What?
<gchristensen>
dckc: nixos does have a working sudo, but it is not directly installed by nix
<dckc>
su involves a root password, right? (it's been so long since I used it...)
<srhb>
dckc: Yes, normally.
<dckc>
not directly... how, then?
<gchristensen>
dckc: what is your question actually about? (nixos creates a capability wrapper to setuid prior to executing sudo)
<dckc>
my question is: how do I use nix-container on Ubuntu?
<gchristensen>
oh dear
<srhb>
nixos-container or nix-container literally?
o1lo01ol1o has quit [Ping timeout: 268 seconds]
<dckc>
`nixos-container create funfun` gives me Permission denied
maximiliantagher has quit [Ping timeout: 246 seconds]
<dckc>
nix-container? I didn't realize there was such a thing. I wonder where I went wrong
<srhb>
You.. Probably will need to pull a few weeks out of your schedule to get that working.
<gchristensen>
yeah, I feel pretty confident using that on anything but nixos hasn't really been considered
<clever>
dckc: nixos-container needs root, and assumes its being used on nixos
<dckc>
`nix search nix-container` no results
<srhb>
It's made for executing containers using existing NixOS infrastructure, not executing NixOS containers on (otherthing)
<dckc>
clever: ok, that's clear: you don't.
<srhb>
dckc: I don't know of it either, just wanted to check if you were talking about something I didn't know of
<clever>
this will just spit out systemd .service files, for any nixos service
<srhb>
Yes, essentially that :)
<dckc>
that sounds pretty good.
<clever>
then you just need to deal with getting the users and dirs to exist, since users.users wont do it
<dckc>
yeah... but maybe only a short trip into chmod hell
doyougnu has quit [Quit: WeeChat 2.0]
<dckc>
do the nixos folks and the cloudabi folks talk? (I wish for capability security uber alles)
<clever>
dckc: i dont see any existing modules for trac or rstudio
<dckc>
I got trac to build in ~20min
<dckc>
(and that was mostly about missing semi-colons and whatnot as I learn the nix language)
<srhb>
dckc: Pull request? :-P
<dckc>
oh. um.
<srhb>
No pressure. (ok a little pressure. But only a little)
fusion809 has quit [Remote host closed the connection]
<clever>
dckc: if you are making a simple trac module (like the snmpd.nix in the above gist) then youll know what it relies on the host to provide (users, dirs, and such)
<dckc>
well... there's this weird thing where the things that seem to be useful start with `with import <nixpkgs>` but that's not how the stuff in the tree starts
<clever>
,callPackage dckc
<{^_^}>
dckc: If a Nix file foo.nix starts with something like `{ stdenv, cmake }:`, you can build it with `nix-build -E '(import <nixpkgs> {}).callPackage ./foo.nix {}'`
<srhb>
dckc: Right, packages in-tree list their actual dependencies as argset arguments, and rely on callPackage to provide each of them
<clever>
with import <nixpkgs> {}; is a way to cheat around having to load it with callPackage
fusion809 has joined #nixos
_fusion809 has joined #nixos
_fusion809 has quit [Remote host closed the connection]
<srhb>
dckc: Usually, that part is trivial, and the actual build is where you poured brain power that we want to ste^H^Hhare in
<dckc>
yeah... I sorta knew that... I'm just saying that's between me and a PR
<srhb>
ok :)
<srhb>
Again, it was just a tiny reminder that it's possible, sometimes people forget that their 20 minutes of work may be actually useful :-)
<srhb>
(to others, I mean!)
<dckc>
so... do folks put `nix-build -E '(import <nixpkgs> {}).callPackage ./foo.nix {}'` in shell.nix or something?
<srhb>
dckc: I often do.
<srhb>
dckc: default.nix like the in-tree defs, then devel.nix (or shell.nix) with: { pkgs ? import <nixpkgs> {} }: pkgs.callPackage ./default.nix {}
<dckc>
a down-side of nix is that it's under-constrained. norms aren't very strongly established.
<clever>
dckc: you can also make default.nix do foo = callPackage ./foo.nix {};, and then foo.nix is the real package
<srhb>
dckc: That should make default.nix equivalent to the in-tree version.
<srhb>
dckc: Yeah, with great power etc...
<srhb>
This happens a lot when you have a programming language instead of say a yaml file with some necessary fields or whatever.
<dckc>
another downside is that lots of data is trapped in a turing-complete format. I think I saw somebody talking about re-shuffling a bit in a conference talk.
<gchristensen>
srhb: eh, yaml has the same problem
maximiliantagher has joined #nixos
<srhb>
True.
<gchristensen>
srhb: unless the yaml parser is carefully constructed, it'll oftfen just execute whatever shell program you give it
<srhb>
dckc: You're probably referring to "flakes"
<srhb>
(I do hope we don't go with that name)
<dckc>
yaml has the opposite problem: what the heck is the semantics of this? how many different forms of scary action-at-a-distance are in play here?
<gchristensen>
srhb: me too
<clever>
dckc: :D
<clever>
dckc: i recently corrupted a yaml file, by doing yaml2json | jq | json2yaml
<clever>
one of the fields was 2^64, but jq stores everything as floats
<gchristensen>
just *clap* use *clap* json
<joko>
clever and LnL: so if I purge my S3 and re-evaluate the Hydra jobs, don't the necessary derivations get re-built and copied there?
<dckc>
that's pretty orthogonal to toothpaste-back-in-the-tube issues of tables vs code
<dckc>
(JSON float interop is pretty orthogonal...)
<clever>
joko: i think hydra will get very upset, and not rebuild things it thinks are already built
<LnL>
joko: yeah, but you also need to purge the narinfo cache of all the clients
<simpson>
gchristensen: That's not the problem clever had. I have this problem too, with JSON files generated in Python. How horrible it is that they don't load correctly in JS~
<dckc>
`nix search` probably addresses 80% of my "how to run the code backwards" issues.
<joko>
Ah, because of the DB persistence, I guess
<gchristensen>
aye
maximiliantagher has quit [Ping timeout: 240 seconds]
drakonis has joined #nixos
drakonis has quit [Client Quit]
<thoughtpolice>
So I finally released my RISC-V emulator and if anyone wants to use Nix with GitHub Actions, I've got a decent amount of stuff to lift/start with: https://github.com/thoughtpolice/rv32-sail/blob/master/.github/main.workflow -- in particular, I got Cachix uploads working nicely :) (cc domenkozar)
napping has joined #nixos
orivej has quit [Ping timeout: 246 seconds]
zupo_ has quit [Ping timeout: 272 seconds]
<dckc>
at the risk of beating a dead horse... I ran vulnix on this trac package and it finds 2 CVEs on glibc (along with the dozen or so on binutils, etc. ...). Let's see where in the process these are...
<thoughtpolice>
I don't really know what a generic action for nix-build might look like (hard to imagine since Nix is more expressive than most) but the Cachix stuff should at least be pretty reusable
<thoughtpolice>
I think.
<simpson>
dckc: Nobody chooses Trac because of their security record~
<napping>
I'm confused by the nixpkgs packaging of coq - The coq repository on github includes a default.nix for 8.9.0 that takes a buildDoc option, while the nixpkgs d
<dckc>
I have negative spare time. about the best I can do is tune in every few months to see if nix's security story has gotten to the point where I might be able to sell it to $IT_DEPT
<napping>
the nixpkg description doesn't build the documentation or seem to provide a way to pass that flag. Both were last touched by the same account, vbgl
<attente[m]>
i've tried running it in a `nix-shell -p lua53Packages.cjson lua` with `LD_LIBRARY_PATH` including the location of `liblua.so`, but lua-cjson still doesn't resolve those symbols
<srhb>
napping: What's the confusion? The discrepancy?
<dckc>
I don't need 32 bit support, though, so I could sell them on that one CVE...
<dckc>
anyway... I don't think spacewalk supports nixos / nix / nixpkgs. And I don't think nexpose actually tests vulnerabilities; I think it just looks up package versions in a database and sends nastygrams.
<gchristensen>
yeah
<gchristensen>
a big problem with _most_ systems is just knowing what you even have
rcshm has joined #nixos
<dckc>
meanwhile, we build apps on top of these packages, and the scanners are utterly unaware of that stuff.
<gchristensen>
this is why security teams I've worked with like Nix so much, it is crystal clear what you have
<dckc>
our apps often borrow code from hither and yon
o1lo01ol1o has joined #nixos
<dckc>
our security team spends ~95% of its time answering "I forgot my voicemail password" issues for 7000 people on campus. My group (medical informatics) is about 3 standard deviations outside the norm. So I can't justify pushing them too far.
gagbo has quit [Quit: I'm out !]
<dckc>
in the 7 years I've been here, we moved from SLES 10 to SLES 11 to CentOS 6 and just recently to CentOS 7 and some version of redhat.
<dckc>
if there's anything you can tell me about the security teams you've worked with, I'm interested to know.
o1lo01ol1o has quit [Ping timeout: 244 seconds]
<gchristensen>
the main thing they wanted to know is what we had, and the opportunity to vet package changes
zupo has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<gchristensen>
being able to say "we updated from nixpkgs A to B and this is a diff of everything that changed" was golden to them
<gchristensen>
security team like controls (not to control, but to have process controls)
<{^_^}>
[nixpkgs] @srhb merged pull request #55356 → Add optional ceph support for libvirt and qemu → https://git.io/fh912
xkapastel has quit [Quit: Connection closed for inactivity]
<gchristensen>
having everything built reproducibly from a single file really thrilled them, and they were willing to collaborate on making it an acceptable tool in the company
<dckc>
python 2.7 CVE-2018-14647 is quite new... a Jan 25 patch is still under review in bugs.python.org
fusion809 has quit [Remote host closed the connection]
<gchristensen>
security teams like being able to patch stuff. patching stuff is scary because undoing patches is hard. nix makes this easy. security teams are happy.
infinee has quit [Quit: leaving]
fusion809 has joined #nixos
<dckc>
I am yet to play with rollback in nix.
<gchristensen>
sometimes, security teams like to apply custom patches themselves. this sucks, because nobody knows how to make an rpm (not literally) and the last person who did quit three months ago. nix makes this trivial
<dckc>
by the way... are there norms for upgrading running services? let alone rollback?
alex`` has quit [Quit: WeeChat 2.3]
<srhb>
dckc: Data is usually ignored completely.
<srhb>
Well, aside from a few kill switches that prevent you from doing Known Bad Stuff (stateVersion)
zupo has joined #nixos
yayforj has quit [Ping timeout: 245 seconds]
<gchristensen>
my experience has been: I've never met a security team who wasn't willing to collaborate with me, once they understood I was trying to work with them, not around them
<dckc>
packaging packages with nix is "trivial" compared to making an rpm? surely that's a matter of familiarity and lots more people are familiar with building RPMs than nix exprs
<srhb>
dckc: I would say no..
xkapastel has joined #nixos
<srhb>
(I don't actually know rpm, but I know deb packaging quite well)
* dckc
struggles to find the source for the glibc package
<srhb>
Nix packages is usually just a "replay" of what you'd do if you built the thing by hand.
<dckc>
I did rpm once or twice. ugly, but made of known parts: shell, sed, colon-delimited-files
<dhess>
I also know deb pretty well. I prefer Nix packaging by a country mile.
<gchristensen>
sure, but it is a lot harder to add a patch to an RPM than
teehemka_ has joined #nixos
<srhb>
And changing a package is way, way more trivial.
<srhb>
gchristensen: You just nuked all the old patches :'(
<dckc>
sure! everybody knows that! (not)
yayforj has joined #nixos
<gchristensen>
once you know how to do it with an rpm, this is still far far far easier
<srhb>
dckc: Actually overrideAttrs is something people get to know pretty early in their packaging experience :)
<dhess>
In fact, I just turned off my last Debian system a few weeks ago. And I'd been running Debian since... about 1997
<srhb>
dckc: It's really not that facetious.
<gchristensen>
this patch is in-line to your Nix deployment, a patched RPM is not in-line with your Chef / Puppet deployment
<gchristensen>
a patched RPM means setting up a custom RPM server
<gchristensen>
and a jenkins job, and signing keys, and publish infra
<dckc>
"in-line to your Nix deployment" <- _that_ is the killer feature. And the fact that nix subsumes all of rpm, pypi, etc. (sort of)
acarrico has quit [Ping timeout: 240 seconds]
<gchristensen>
or it means building right on the server, and you describe the build process in your puppet / chef files, and now you're just in hell
<dhess>
Does NixOS have anything like nix-darwin's <darwin-config> path component? i.e., a part of NIX_PATH that points to the system's configuration.nix file?
<gchristensen>
security teams love this stuff
<srhb>
dhess: nixos-config
<dhess>
I've only ever used the one in /etc/nix/configuration
<dhess>
srhb: oh ok interesting.
<{^_^}>
[nixpkgs] @jbaum98 opened pull request #55361 → Mark merlin and flycheck-ocaml as not borken → https://git.io/fh9DV
<dhess>
srhb: I've got something like that already but as soon as I do "import ./foo.nix" it doesn't put foo.nix into the store either
<dhess>
so it seems liek it just has to be all in one file?
<dckc>
thanks.
<srhb>
dhess: No? Maybe I explained myself poorly. Include myConfigSource derivation in your systemPackages, make it use src = /path/to/your/config/dir
<srhb>
dhess: I know it's hacky, but it certainly grabs all the contents.
<dhess>
srhb: oh I see
<dhess>
srhb: sorry, I'm dense. So when myConfigSource gets put into the store, does it replace src = /path/to/your/config/dir with /nix/store/<hash>-path-to-your-config-dir?
<dhess>
or does the derivation in the store still point to /path/to/your/config/dir
<yayforj>
can i use `fetchGit` on monorepo?
<srhb>
dhess: Well, however you want to define the derivation. The cheap version is to literally copy the source tree into a store path
<dhess>
srhb: ahh so you're basically doing a mkDerivation for your config dir
<srhb>
dhess: Yes.
<dhess>
is that right
<dhess>
ok thanks. I'll pursue that option.
<srhb>
dhess: Like I said, hacky, but it works :)
<dhess>
works for me
<dhess>
thanks!
<yayforj>
i want a specific version of gogol-core
<dhess>
srhb: so if you point nixos-config to /path/to/your/config/dir and there's a /path/to/your/config/dir/default.nix, it will know what to do ?
<yayforj>
which is a submodule on gogol.git
erictapen has joined #nixos
<srhb>
dhess: No, you have to add an actual package for it (somehow, eg. via overlay)
<dhess>
I guess what I'm asking is, what do you set nixos-config to in the NIX_PATH ?
<srhb>
dhess: I never touch that frankly.
<srhb>
dhess: The package will just be a snapshot of the config source as it were when that config generation got built.
<dhess>
srhb: ok let me rephrase. When you do, `nixos-rebuild switch` how do you point it to your derivation?
<srhb>
dhess: I don't. In my configuration I have environment.systemPackages which refers to itself. Consider eg: environment.systemPackages = [ (pkgs.mkDerivation { ... copy ./. to $out }) ... ];
<srhb>
dhess: Operative component being ./.
rcshm has quit []
<srhb>
dhess: Since this source file (my config) lives in the directory I care to snapshot, ./. contains it.
<dhess>
so that's in /etc/nix/configuration.nix
<srhb>
dhess: /etc/nixos/configuration.nix, yes, for instance.
<srhb>
(In reality that file is a symlink to /home/sarah/conf/nixos/p51.nix on my system, but that means /home/sarah/conf/nixos is the containing directory that I snapshot)
rcshm has joined #nixos
zupo has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<dhess>
OK I think you've given me enough to go on here. I'll try to figure this out.
<dhess>
What I'm trying to accomplish is to remove all of my non-Nix-store paths from NIX_PATH. So for macOS, the <darwin-config> portion of the NIX_PATH should be something like darwin-config=/nix/store/...-config.nix
<gchristensen>
hmm... why, though?
<srhb>
dhess: Hmm, that won't help you here...
<dhess>
I've got that working, but it's just pointing to a single .nix file, and so anything that it includes is missing
<dhess>
gchristensen: I'm trying to eliminate any sources of impurities
<dhess>
things pointing into my home dir, or /etc/nix/X, etc.
<gchristensen>
oh!
rcshm_ has joined #nixos
<gchristensen>
you want nix's --pure flag!
<dhess>
oh what's that
<gchristensen>
No Impurities Mode
<dhess>
is that in nix stable?
<gchristensen>
nix-build --pure-eval -E 'let r = (builtins.fetchGit { rev = "'$(git rev-parse HEAD)'"; url = ./.; }); in import "${r}/pure.nix"' -A system --show-trace
<dhess>
I'd rather not have to rely on passing that flag around all the time though
<gchristensen>
well you'll have to pass around a lot more than a flag
<gchristensen>
because you can't even say nix-build --pure-eval ./default.nix, because that is impure.
rcshm_ has quit [Remote host closed the connection]
<dhess>
I want the default to be no impurities. Seemed like the easiest way to do that was just to clean up my NIX_PATH
rcshm_ has joined #nixos
teehemka_ is now known as teehemkay[away]
<dhess>
I of course point to impure stuff when I run "rebuild switch"
<gchristensen>
you said no impurities! :)
fusion809 has quit [Remote host closed the connection]
<dhess>
yeah that should be the default :)
<gchristensen>
I did this with nixos for a bit
<dhess>
you should have to work harder when you want impurities :)
<dhess>
not the other way around
rcshm has quit [Ping timeout: 246 seconds]
<gchristensen>
it'd be pretty annoying to have to have to specify all that for every nix-build you want to run
<dhess>
yeah
<dhess>
or nix-shell etc.
Glider_IRC_ has joined #nixos
<gchristensen>
from --pure-eval, you cannot access anything without declaring how to fetch it
<dhess>
Too hard to keep my ~/git/nixpkgs in sync all the time on all my boxes
maximiliantagher has quit [Ping timeout: 244 seconds]
bpa has quit [Remote host closed the connection]
<simpson>
Ah, okay. Then no, I don't think that there's anything extra needed. Maybe some docs.
ryantrinkle has quit [Ping timeout: 250 seconds]
<kisik21>
clever: any lightweight browsers that actually build on i686? I need one for my grandma real quick before she starts complaining that I'm doing maintenance on her computer too long (i broke her OS four times trying to connect her to WiFi)
<kisik21>
the lighter on resources the better, her system is constantly overheating
<__monty__>
kisik21: Midori?
<Ankhers>
clever: Thanks.
<Ankhers>
sorry. That was meant for simpson.
<__monty__>
Don't know any user friendly lightweight browsers tbh.
Jetien has quit [Ping timeout: 272 seconds]
kvda has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<kisik21>
__monty__: trying to build now
<kisik21>
the --build-host option is very nice btw for an overheating 800MHz single core machine
<clever>
kisik21: you can also use nix-copy-closure to just copy something you already have to another machine
<__monty__>
I'd definitely set up remote builds and configure max-jobs to 0.
<__monty__>
Nix is not fun with too few resources.
<clever>
kisik21: or just go ham, and control the box with nixops
<kisik21>
clever: nix-copy-closure is nice but the 3 times as powerful machine is used headlessly...
<clever>
so you pre-build the entire thing, and deploy it to the box
jackdk has joined #nixos
<__monty__>
kisik21: Why does headlessness matter? It doesn't affect copy-closure.
<kisik21>
--build-host allows me to launch builds from local machine and building on remote... it handles copying dependencies and configuration seamlessly
<kisik21>
and while copy-closure may be more efficient since it evaluates configuration.nix only one time, I'm ok with what I have now
<__monty__>
Yeah but it downloads everything to the client, uploads it to the server, then downloads the products again.
<__monty__>
If it works well enough for you though.
zupo has joined #nixos
<bbarker>
I've got this call to patchelf: --set-interpreter "exec $(cat $NIX_CC/nix-support/dynamic-linker) $exfi $@"; when I run patchelf --print-interpreter $exfi I just get /lib64/ld-linux-x86-64.so.2. Is this expected? Cause it doesn't execute when I run it this way
tzemanovic has joined #nixos
halfbit has quit [Quit: WeeChat 2.3]
<clever>
bbarker: the exec shouldnt be in there
<clever>
bbarker: and the " is too far at the end
<clever>
bbarker: you are telling it to set the interpreter to "exec $(cat $NIX_CC/nix-support/dynamic-linker) $exfi $@"
<clever>
bbarker: and you are not telling it what file to edit
<clever>
bbarker: and are you running that before or after the file gets copied to $out, and what is $exfi?
perique has joined #nixos
<bbarker>
clever, this would be after it is copied to $out
<bbarker>
but during installPhase
<bbarker>
$exfi is just an executable in $out/bin
<clever>
bbarker: what does it output if you just run `cat $NIX_CC/nix-support/dynamic-linker` in the installPhase?
simukis has quit [Quit: simukis]
kvda has joined #nixos
Sophos[m] has left #nixos ["User left"]
rfold has quit [Quit: leaving]
<attente[m]>
how do i get the correct path of `/nix/store/*-gcc-*-lib/lib` for the `gcc` package? globbing isn't good enough since there are multiple matches
zupo has quit [Quit: My MacBook has gone to sleep. ZZZzzz…]
<clever>
bbarker: can you pastebin the entire nix file?
<attente[m]>
is there a way to do it in `sh` outside of a `nix repl`?
<attente[m]>
like with a `nix-env` query or something?
<clever>
,libraries attente[m]
<{^_^}>
attente[m]: Don't install libraries through nix-env or systemPackages, use nix-shell instead. See https://nixos.wiki/wiki/FAQ/Libraries for details.
<attente[m]>
clever: but `nix-shell -p gcc` doesn't fix `LD_LIBRARY_PATH` correctly
<simpson>
attente[m]: What are you building? You might get to write some Nix today.
<bbarker>
clever, i'll note that if I do `exec $(cat $NIX_CC/nix-support/dynamic-linker) $file args` on the command line it works, where $file is one of the binaries
<clever>
attente[m]: gcc is in the env by default, so just `nix-shell -p` will give it to you
o1lo01ol1o has quit [Remote host closed the connection]
<clever>
bbarker: line 23, your for loop isnt looping over files
<clever>
bbarker: add an `echo $exfi` and youll see the problem
<dhess>
srhb: hmm interesting idea
rcshm has quit [Remote host closed the connection]
rcshm has joined #nixos
vk3wtf has joined #nixos
<attente[m]>
for some reason i recall having to explicitly adding it to `LD_LIBRARY_PATH` in order for something i was building to find `libstdc++.so`, but tbh i really don't remember what it was any more...
o1lo01ol1o has joined #nixos
hexo_ is now known as plytkejsie
rcshm has quit [Remote host closed the connection]
<attente[m]>
it was just something i hard-coded into my `.zshrc` but now i don't even remember why...
<plytkejsie>
hi, please can you help with? gument 'wxPython', at /nix/store/7vzvgmg9h9bqqp7sc7ili7kw62sfnimn-nixos-18.09.1898.001b34abcb4/nixos/lib/customisation.nix:69:12
<attente[m]>
oh! it was for `rustup`!
<plytkejsie>
i'm trying to build my own kicad from git sources
<attente[m]>
i was trying to install the nightly toolchain and that couldn't find `libstdc++.so` which was why i needed to add it to my `LD_LIBRARY_PATH`
<plytkejsie>
i got the error after calling nix build -f .
<plytkejsie>
in directory with nix file
<clever>
attente[m]: you need to patchelf the file, so you want to write a nix expression for that, which has "${gcc.cc.lib}/lib" in it somewhere
maximiliantagher has joined #nixos
<bbarker>
clever, thanks, i'll see if i can fix it - one of these days, i should properly learn bash. Doing `for exfi in $out/bin/*` is closer but seem to get errors despite the conditional check: https://pastebin.com/sPTtyhrg
<bbarker>
hmm, i guess -x doesn't check that it is an *ELF* executable though
<clever>
bbarker: throw in an `set -x` and it will show every cmd as it runs it
<attente[m]>
clever: is that necessary for the rust toolchain though? it installs in the user's home directory outside of the nix store
<clever>
bbarker: there is a function called isELF in the stdenv
<attente[m]>
feels out of the scope of nix
<clever>
attente[m]: anything that downloads pre-built ELF files will fail hard on nixos, because /lib doesnt exist
<clever>
attente[m]: all binaries must be installed using nix
<clever>
attente[m]: rust is also already in nixpkgs
<attente[m]>
does `nixpkgs` have the nightly rust toolchain though?
<clever>
the mozilla overlay has it
<attente[m]>
i thought rustup was building the toolchain locally but i might be mistaken
Synthetica has quit [Quit: Connection closed for inactivity]
<bbarker>
clever, sweet, isElf did the trick! working now
<bbarker>
*isELF
civodul has quit [Quit: ERC (IRC client for Emacs 26.1)]
endformationage has quit [Ping timeout: 250 seconds]
<attente[m]>
^ this was from doing a `home-manager switch --upgrade`, not sure how to resolve it since both `gcc-wrapper` and `bin-utils` seem to provide `ld`
<simpson>
Why are you installing gcc-wrapper and binutils at all?
Jetien has quit [Ping timeout: 240 seconds]
<attente[m]>
simpson: i thought i needed them to build things from source, are they unnecessary?
<simpson>
attente[m]: You probably don't need them in your user environment. Also, get used to writing Nix instead.
hedning has quit [Quit: hedning]
slack1256 has quit [Remote host closed the connection]
Widdershin has joined #nixos
<symphorien>
attente[m]: with nix, if what you want to do involves a compiler it must be done inside nix-shell
slack1256 has joined #nixos
<Widdershin>
Hi everyone! I'm trying to install Anki on MacOS with Nix, but the tests are failing (too many files open apparently). I'm trying to figure out how I can disable the check phase.
<symphorien>
installing compilation tools in with nix-env or configuration.nix will rarely work
<suzu>
allegedly this should work around it, but it does not:
<clever>
suzu: what does `nix-channel --list` say?
<suzu>
A workaround is to install busybox (it’s important to have a statically linked version of sh) and add: sandbox-paths = /bin/sh=/usr/bin/busybox to /etc/nix/nix.conf
<suzu>
> nix-channel --list
<{^_^}>
undefined variable 'nix-channel' at (string):218:1
tzemanovic has quit [Remote host closed the connection]
<suzu>
sandbox-paths is showing properly in `nix show-config`
<suzu>
ok
<suzu>
do i append it to my current value, space separated?
<clever>
i think so
<clever>
yeah, space seperated
<suzu>
ok
<ottidmes>
clever: I always thought /bin/sh on NixOS used that of bash, but I got: sandbox-paths = /bin/sh=/nix/store/3jh2d752bf78b9j9f72qcq952azj2ffb-busybox-1.29.3/bin/busybox
<suzu>
/nix/store/r997gyj1j189ifvbgszcyjnypk9i4701-unpack-channel.sh: line 1: mkdir: command not found
<suzu>
new error
vk3wtf has quit [Ping timeout: 240 seconds]
<clever>
suzu: oh, i think i know whats wrong
fusion809 has quit [Quit: Leaving]
tzemanov_ has quit [Ping timeout: 245 seconds]
<clever>
suzu: normally, mkdir and friends, come from /nix/store/, via a config.nix file
<clever>
suzu: because nix itself was not built with nix, its pointing to the arch binaries
<clever>
suzu: and the sandbox is keeping those dirty arch binaries out of sight :P
<clever>
so basically, the nix sandbox cant work, if nix was not built with nix
<suzu>
the sandbox is to be isolated from all the system packages, yeah?
<clever>
suzu: sandbox = false
<clever>
that will fix everything
<suzu>
is that safe?
<clever>
it will still use build users, but it wont be putting them into dedicated containers
<suzu>
sandbox = false worked. ( i tried that before but didnt think to restart the daemon )
<suzu>
why doesn't stitching in arch busybox into nix's sandbox work?
<suzu>
surely that can handle mkdir, sh, etc.
maximiliantagher has joined #nixos
<clever>
that only gives you /bin/sh
<clever>
it doesnt give you /bin/mkdir
o1lo01ol1o has joined #nixos
<suzu>
hmm
<clever>
you would need to add every binary that fails, and map them to something
<suzu>
how is that a workaround that worked for anybody, then