2018-10-09

<clever> booglewoogle: my first guess is that you need to enable a winewow build
<clever> it may be simpler to just load the modified nix file with callPackage
<clever> and you would need to remove wine64 from the middle of the string
<clever> booglewoogle: you would need to be altering the postInstall attribute with overrideAttrs
<clever> jabranham: doesnt matter that much, nixos-unstable updates a little less often, because it waits for the nixos tests to pass, but nixpkgs-unstable can also hang because it waits for darwin things to pass
<clever> booglewoogle: i notice that the commit is not in any branch
<clever> the above hook will run strip on all binaries, if dontStrip = true; is absent
<clever> yeah, that
<clever> jluttine: one sec
<clever> and the router config, allows the 2nd laptop to leech the wifi over the cat5 that did netbooting
<clever> the original use-case was to turn my laptop into a router, to spread nixos to more laptops
<clever> my netboot_server.nix is meant to be ran on a machine that has 2 NIC's, and will fully configure that box to behave as a router
<clever> gchristensen: i think yours lacks the server? since packet.net runs that and just boots the files you give it?
<clever> roflik: justdoit.nix itself is a nixos module, so you can just add it to the imports section of any nixos, live or normal
<clever> nix can also be used to generate a disk image with a full install, rather then a live env
<clever> roflik: also, rather then using a liveusb, you could do a proper nixos install to the usb, then you can just edit whatever you want, nixos-rebuild, and the changes will persist
<clever> roflik: it can be overcome by just tweaking justdoit.nix to accept the file as a param
<clever> roflik: if you control the network, then ipxe is also an option
<clever> which was giving a full gui for installing, along with an editor for configuration.nix, that could show option descriptions
<clever> https://github.com/cleverca22/nixos-installer is another project i started but never finished
<clever> its main limitation right now, is that you have to remake the entire iso and usb if you want to change the initial configuration.nix
<clever> roflik: so you literally boot the machine, and type justdoit on a shell, and your done
<clever> roflik: that is similar to justdoit, the current version of justdoit has a minimal configuration.nix baked into it, and then the whole justdoit is baked into the iso you dd to something
<clever> Taneb: the bar @ { .. }: doesnt include the defaults within bar
<clever> retroArchCores is a list, containing all cores enabled, acording to config.retroarch
<clever> Moredread: id say this is bad-form, its poluting the top-level pkgs with random internal variables
<clever> > pkgs.retroArchCores
<clever> Moredread: heh, github is truncating all-packages.nix, cant find retroarch
<clever> Moredread: depends on if its a common flag that a lot of packages have or not
<clever> Moredread: conky does the same, but defaults to false
<clever> so you can just nixpkgs.config.pulseaudio = true or =false;
<clever> but, the default is the value of config.pulseaudio, and it defaults to true when absent
<clever> Moredread: for example, the blueman package has a withPulseAudio flag, that you set via .override
<clever> Moredread: it generally has to be done with overlays, but you can sometimes use nixpkgs.config.feature = true;
<clever> tilpner: sounds like a problem fairly low-level within the keyboard drivers
<clever> tilpner: oh, and does ctrl+alt+f1 give a working console?
<clever> headphone jacks give insert/remove events, my wireless headset has volume events for the knob, keyboard/mouse do what you would expect
<clever> tilpner: if you run `evtest` as root, you can select any event source, and then see the raw events coming from it
<clever> evtest would be one of the next steps then
<clever> then youll have a "usable" keyboard to open logs and debug it further
<clever> tilpner: in theory, you can steal letters from random open apps, to assemble `nix-env -i onboard` and `onboard`, though enter is harder (or just do it fast after bootup?)
<clever> tilpner: using left mouse, you can select text, and middle mouse to paste text
<clever> > onboard.meta.description
<clever> tilpner: one min, i have a crazy idea...
<clever> tilpner: got a usb keyboard?
<clever> tilpner: oh, the keyboard stops, not the whole pc
<clever> tilpner: does the cpu feel abnormally hot?
<clever> tilpner: is the cpu fan spinning?
<clever> things have probably improved since i last ran into this issue
<clever> yeah, just noticed that in its --help
<clever> maybe it was objdump that couldnt
<clever> oh, interesting, the x86-64 readelf can also see that field now
<clever> this is what happens if i run the armv6 readelf against itself, under qemu-user
<clever> Tag_CPU_arch: v6
<clever> /nix/store/4snh8f34408x61x6lpwqcri86cq829jw-binutils-2.30/bin/readelf -A /nix/store/4snh8f34408x61x6lpwqcri86cq829jw-binutils-2.30/bin/readelf
<clever> yeah, it is fairly slow
<clever> and then your machine can magically run aarch64 binaries
<clever> this nixos module allows you to just qemu-user.aarch64 = true;
<clever> you can also cheat with qemu-user if you want to
<clever> Guillaum: of note, armv6/v7 binaries have special flags to say if its 6 or 7, and x86 binutils cant read them

2018-10-08

<clever> kiloreux_: can you pastebin the entire nix-build output?
<clever> how exactly is it not working?
<clever> that should be working
<clever> kiloreux_: and how is local_dependency defined?
<clever> kiloreux_: how did you add it to buildInputs?
<clever> NickHu: its already pretty minimal
<clever> you will also want to umount nixos before you run the kexec step
<clever> then you can just use nixos-enter or nixos-install
<clever> it will have a full nixos, running in a ramdisk
<clever> NickHu: if you run these commands, upload the tar to the rescue system, and then run 2 more commands
<clever> id say to try out my kexec util next
<clever> anything in dmesg?
<clever> does current-system exist?
<clever> NickHu: how did you chroot?
<clever> try -vvvv
<clever> --show-trace only helps for nix expression level bugs
<clever> NickHu: did the disk get mounted with noexec?

2018-10-07

<clever> bgamari: /nix/store doesnt allow setuid bits
<clever> bgamari: you need the sudo in /run/wrappers/bin
<clever> yeah
<clever> pareidolia: adding cache.nixos.org to that may prevent the issue
<clever> pareidolia: grep subs /etc/nix/nix.conf
<clever> pareidolia: it looks like some stray text after the patch, and its not a commited file but rather a commit being rendered as a patch
<clever> why is it even there? lol
<clever> that looks like some stray text at the end of the patch
<clever> elvishjerricco: if you can get it from both the cache, and the failed path, try to diff them, confirm what has changed
<clever> nix-prefetch-url cant normalize the patch
<clever> fetchpatch will normalize the patch to prevent this kind of issue from occuring again
<clever> the hash will also need to be updated, and then it should build
<clever> yeah, thats likely it
<clever> it should be using fetchpatch, not fetchurl
<clever> pkgs/tools/networking/network-manager/default.nix: sha256 = "af1717f7c6fdd6dadb4082dd847f4bbc42cf1574833299f3e47024e785533f2e";
<clever> af1717f7c6fdd6dadb4082dd847f4bbc42cf1574833299f3e47024e785533f2e
<clever> $ nix-hash --to-base16 --type sha256 0bizaf2yf93hwkrrjcl3fhawyhmw9dzq9pc283dxmmpxqvvif5xg
<clever> probably sha256 or 512
<clever> nix will normallize the hash when display, so it may not display what was in the nix file
<clever> use the nix-hash util to convert it
<clever> elvishjerricco: base16 vs base32 hash
<clever> elvishjerricco: another solution is to compile the TH with a different ghc
<clever> hmmm, but ghc may still have trouble targeting 2 arm at once
<clever> elvishjerricco: yeah, you would need a non-ios arm os, to run iserv under
<clever> elvishjerricco: if your TH is touching ios objects, your probably doing something wrong
<clever> elvishjerricco: yeah, you would need to use qemu-user-arm, and not a real ios device
<clever> dhess: i think angerman has done x86->ios cross-compiles with TH
<clever> dhess: running iserv-proxy under nodejs solves it for ghcjs, and under wine solves it for linux->windows
<clever> dhess: iserv-proxy can help with TH
<clever> pareidolia: can you pastebin the whole output of nixos-rebuild when it fails?
<clever> elvishjerricco: only for valid outputs
<clever> the rpi doesnt have pci or sata
<clever> pareidolia: that allows you to inspect it and see why its wrong
<clever> pareidolia: it leaves it in the store, but doesnt register it as valid
<clever> then its not a 404 page
<clever> pareidolia: try just less then, is it binary?
<clever> pareidolia: what does `file /nix/store/b532v0f48jbhw151h7v8v6ab8vshlj4z-autoconf-2.69.tar.xz` output?
<clever> elvishjerricco: nice
<clever> yeah
<clever> 19.03 is the name of nixos-unstable, which will eventually become 19.03 next march
<clever> git checkout ca2ba44cab4
<clever> pareidolia: you may also want to `git checkout` the rev shown by `nixos-version`
<clever> pareidolia: nix-env -iA nixos.git ?
<clever> pareidolia: `nixos-rebuild -I nixpkgs=/path/to/nixpkgs test` i believe
<clever> pareidolia: edit it in a `git clone` of nixpkgs
<clever> elvishjerricco: but grub itself wont be encrypted, and is still a weak point
<clever> elvishjerricco: another factor of secureboot, is that the kernel should probably confirm signatures on all loadable modules
<clever> typetetris: edit the config on /boot
<clever> elvishjerricco: ah, that might be it, i was expecting it to just load it as a file, and then pass control over without using the efi specs
<clever> typetetris: ah, that implies systemd-boot does support secureboot
<clever> typetetris: step 4 sounds like the chicken in the egg problem i mentioned
<clever> so systemd-boot is probably running unsigned code
<clever> a quick google implies that systemd-boot also doesnt support secureboot by itelf
<clever> which means grub is not verifying the next stage (linux) and is running unsigned code
<clever> in my case, i was able to whitelist only grub, and then it booted
<clever> yeah, my laptop gives me that
<clever> and custom has zero options
<clever> secureboot is either microsoft, or custom
<clever> my desktop doesnt even give me the option to whitelist a file
<clever> typetetris: many bios also horribly mislabel things in the options
<clever> typetetris: wasnt aware that actually worked
<clever> typetetris: oh, your in nixos, with secureboot and systemd-boot?
<clever> pareidolia: usually /tmp
<clever> and /boot needs to be a fat32 partition, flagged as the efi system partition, in the gpt tables
<clever> boot.loader.grub.efiInstallAsRemovable = true; gets around it, by claiming your on a removable disk
<clever> chicken in the egg problem
<clever> you need to boot with efi to config the efivars, to be able to boot with efi
<clever> and if they revoked those keys, every single install disk would become invalid
<clever> so the M$ keys are basically useless now
<clever> typetetris: oh, the bootloader M$ signed with those keys, they forgot to disable a debug option that leads to executing unsigned code
<clever> you can still use uefi without secureboot
<clever> apple too
<clever> typetetris: yeah, M$ gets away with it being easy, because the kernels are compiled and signed in a secure place, and the end-user never has the keys
<clever> and ensure systemd-boot validates the kernel before booting it
<clever> typetetris: if using public/private keys, then you just need to add the public to the bios once, and then sign everything with the private
<clever> uefi also suffers from that, if secureboot is off
<clever> typetetris: and then its basically imposible to detect what its doing
<clever> typetetris: when booting in legacy, a virus can in theory replace your bootloader, and then boot your OS inside a VM
<clever> Acou_Bass: when downloading a .nar and unpacking it, the entire nar was held in a std::string
<clever> it barely had room for 2 nixos generations
<clever> ive ran nixos on a machine with 4gig of SSD, and thats it
<clever> cant shrink zfs*
<clever> and you cant resize a zfs device either, so you need a new disk
<clever> you need a real partition if you have zfs
<clever> zfs and swap dont play nicely
<clever> hyper_ch: fallocate /swap -l 3g ; mkswap /swap ; swapon /swap
<clever> ah
<clever> rawtaz: it handles the challenge/response stuff thru nginx
<clever> rawtaz: the nginx stuff in nixos automatically handles LE for you, and you dont have to stop the daemon
<clever> depends on if the compile depends on the prefix or not
<clever> symphorien: there is also installFlags
<clever> hyper_ch: 5 may also benefit from sudo, it cant delete nixos generations without root
<clever> yep
<clever> hyper_ch: which deletes all old generations
<clever> hyper_ch: 5 is `nix-collect-garbage -d`
<clever> hyper_ch: and cut line 3, it also does the same thing as 5
<clever> it will do a normal gc after -d has ran
<clever> hyper_ch: lines 4 and 5 together are pointless
<clever> hyper_ch: sure
<clever> when your low on disk space or want to mass-delete all garbage
<clever> without
<clever> which will also include most of the corrupt paths
<clever> you can also just `nix-collect-garbage` to delete anything that can be safely deleted
<clever> ext4 tends to do that
<clever> sounds like it was truncated by an improper shutdown
<clever> how big is the file?
<clever> next time, run `ls -lh` on a corrupt one before you delete it
<clever> GiGa: did you improperly shutdown?
<clever> things like your nix-env and nixos-rebuild profiles
<clever> and it obeys GC roots, so nothing important can be lost
<clever> that deleted all paths refering to the corrupt Xrender.drv
<clever> yep
<clever> yes
<clever> nix thinks sudo is using that path, so it cant be deleted
<clever> GiGa: try again without sudo
<clever> GiGa: did you use sudo?
<clever> GiGa: nix-store --query --roots <thatpath>
<clever> GiGa: try running `nix-store --delete` on that path, then try again
<clever> typetetris: if you re-run `nixos-rebuild boot`, it will create any files it needs to boot
<clever> the last-mod times as a decent hint
<clever> oops
<clever> magnetophon: you may need to pass it thru fetchFromGithub first
<clever> elvishjerricco: yeah
<clever> GiGa, magnetophon: though you can also just nix-channel --add + --update before you nixos-install
<clever> so the firmware it loads from the flash chip is modified slightly
<clever> from what i can gather, that chip sits between the motherboard and the bios flash
<clever> elvishjerricco: did you hear about the supermicro stuff going around?
<clever> lingeeal: the attrpath is probably yesod.bin
<clever> elvishjerricco: then they can give grub the pw they just set
<clever> elvishjerricco: oh, but what if an attacker just wipes /boot and makes their own custom /boot with luks, and they know the pw?
<clever> elvishjerricco: yeah, that could work, as long as you ensure the verified grub.efi loads from the luks device
<clever> elvishjerricco: efi requires a plaintext fat32
<clever> elvishjerricco: and how do you verify that your grub.cfg hasnt been tampered with?
<clever> elvishjerricco: you could, but then its not really secureboot anymore, and something custom
<clever> elvishjerricco: it looks like grub doesnt support secureboot, and needs a shim to help out
<clever> elvishjerricco: secureboot has to be enabled within grub, to verify the hashes of the next binary with the uefi firmware
<clever> magnetophon: just dont run ldconfig
<clever> so you can just hit E at the grub screen, and boot a malicious linux, or edit grub.cfg
<clever> but the major problem right now with secureboot in my laptop, is that grub doesnt verify the next stage (linux)
<clever> magnetophon: ldconfig doesnt work on nixos
<clever> the desktop only has an on/off switch, and i cant even load custom public keys
<clever> as for secureboot and nixos, my laptop allows me to whitelist a binary by its hash
<clever> and then your in a vm and dont even know it
<clever> secureboot is more to protect against malware that replaces your bootloader with a hypervisor
<clever> depends on the motherboard
<clever> you may need to desolder the chip that the config is stored on
<clever> elvishjerricco: if you can wipe the bios config by force, yes
<clever> but, if you had used TPM and measured boot, i would need to crack the TPM itself, which is designed to be resistant to such things
<clever> and i can modify that
<clever> there must be a plaintext binary somewhere on the hdd, to decrypt /boot
<clever> and next time you login, your screwed
<clever> but also, if i have physical access, i could do a bios reset to disable secureboot, and then mess with your /boot to save the luks password to the disk in plaintext
<clever> elvishjerricco: yeah, you need to go into some kind of special configure mode, and then play a sequence of hashes to it, by actually booting
<clever> but then anybody can just shove in a bootable usb, and use it
<clever> i think the tpm can also work without measured boot
<clever> yeah, they can both be used seperately
<clever> (which includes a maliciously modified bootloader/kernel)
<clever> secure boot is different, in that the bios will refuse to even run an unauthorized os
<clever> sphalerite: so if somebody boots an unauthorized os, the tpm just doenst unlock
<clever> and if you replay the same sequence of hashes, the TPM unlocks, and you can use it to do things like decrypt the hdd
<clever> measured boot is reporting the hash of the next binary to the TPM, before you execute it
<clever> entirely seperate things
<clever> sphalerite: nope
<clever> rawtaz: thats seperate, measured boot stuff
<clever> so you can just skip the entire mess that is keypair management
<clever> for my laptop, i can register any .efi binary, and i believe it whitelists the hash
<clever> ah
<clever> obadz: open the pdf in chrome!
<clever> neat, but chrome supports it without even running cups, so ive never had to really deal with it directly
<clever> there is a certain upgrade path that tends to break sudo, and that then makes it difficult to actually shutdown/reboot
<clever> `nixos-rebuild boot`
<clever> and will create a /dev/mapper/data that has the plaintext version of the block device
<clever> it inserts that label into the cryptsetup luksOpen command
<clever> try with label = "data";
<clever> but label handles that for you
<clever> actually, different uuid, so it will probably search for the real device
<clever> 30 tells it to mount the luks device without opening the luks
<clever> and 30 is wrong
<clever> line 34
<clever> sphalerite: that pretty much makes my lvm on luks thing pointless
<clever> sphalerite: oh, interesting, i see stage-1 now remembers the passphrase, and can reuse it on several devices
<clever> samueldr: that would allow for multiple breaking changes within a 6 month period, and still be compatible with things
<clever> so it was put back at the old location
<clever> Ashy: stateVersion did recently get moved, but that broke nixops and a few other things
<clever> Ashy: thats one of the few things that cant be done declaratively, you need to use `nix-channel` to change the channel, check its man page
<clever> jasongrossman: thats why nixos-generate-config puts a giant-ass warning on it now, in the comments
<clever> Ashy: stateVersion has no impact on what channel your using, and changing it breaks the very thing its meant to fix
<clever> Ashy: did you change your channel first?
<clever> if your planning on rebooting, then `nixos-rebuild boot` would be better then switch

2018-10-06

<clever> nDuff: you can also just ignore the search path and directly `import ~/VC/nixpkgs`
<clever> nDuff: nix has a -I nixpkgs=/path to help with things
<clever> think of it like #include <foo.h> and -I/usr/include in c/c++
<clever> nDuff: -I ~/VC/nixpkgs and <nixpkgs> makes it look for ~/VC/nixpkgs/nixpkgs, which doesnt exist
<clever> so you would instead just renice the current nix-daemon process
<clever> on nixos, it will run the builds under the nix-daemon, so even if you renice nix-build, it wont have any effect
<clever> if you try to treat a set as a string, it will return the .outPath attribute
<clever> > "${ {outPath = "foo";} }"
<clever> Mateon1: all derivations are technically sets
<clever> and that can silently ignore all functions
<clever> python might do the same thing
<clever> Mateon1: haskell packages runs a filter function over the entire list, to restrict it to just haskell libraries
<clever> you receive the old values as an argument
<clever> .overrideAttrs (oldDrv: { buildInputs = oldDrv.buildInputs ++ [ newlib ]; })
<clever> kiloreux: append it to buildInputs

2018-10-05

<clever> the official iso has MBR tables and works on a usb stick
<clever> gleber_: probably
<clever> glasserc: if you have the .drv for each generation (nix-store --query --deriver) you can use nix-diff to see how the compile directions differed
<clever> that should allow you to change profiles while it is playing audio
<clever> and then you regain the built-in audio, and it switches back
<clever> then when you change profiles, it will loose the built-in audio sink, switch to the null
<clever> `pactl load-module module-null-sink` to temporarily load one