Commit Graph

1161 Commits

Author SHA1 Message Date
Graham Christensen
a9c875fc2e
nixpkgs: allow packages to be marked insecure
If a package's meta has `knownVulnerabilities`, like so:

    stdenv.mkDerivation {
      name = "foobar-1.2.3";

      ...

      meta.knownVulnerabilities = [
        "CVE-0000-00000: remote code execution"
        "CVE-0000-00001: local privilege escalation"
      ];
    }

and a user attempts to install the package, they will be greeted with
a warning indicating that maybe they don't want to install it:

    error: Package ‘foobar-1.2.3’ in ‘...default.nix:20’ is marked as insecure, refusing to evaluate.

    Known issues:

     - CVE-0000-00000: remote code execution
     - CVE-0000-00001: local privilege escalation

    You can install it anyway by whitelisting this package, using the
    following methods:

    a) for `nixos-rebuild` you can add ‘foobar-1.2.3’ to
       `nixpkgs.config.permittedInsecurePackages` in the configuration.nix,
       like so:

         {
           nixpkgs.config.permittedInsecurePackages = [
             "foobar-1.2.3"
           ];
         }

    b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
    ‘foobar-1.2.3’ to `permittedInsecurePackages` in
    ~/.config/nixpkgs/config.nix, like so:

         {
           permittedInsecurePackages = [
             "foobar-1.2.3"
           ];
         }

Adding either of these configurations will permit this specific
version to be installed. A third option also exists:

  NIXPKGS_ALLOW_INSECURE=1 nix-build ...

though I specifically avoided having a global file-based toggle to
disable this check. This way, users don't disable it once in order to
get a single package, and then don't realize future packages are
insecure.
2017-02-24 07:41:05 -05:00
Graham Christensen
59d61ef34a Revert "nixpkgs: allow packages to be marked insecure" 2017-02-23 09:41:42 -05:00
Graham Christensen
38771badd3
nixpkgs: allow packages to be marked insecure
If a package's meta has `knownVulnerabilities`, like so:

    stdenv.mkDerivation {
      name = "foobar-1.2.3";

      ...

      meta.knownVulnerabilities = [
        "CVE-0000-00000: remote code execution"
        "CVE-0000-00001: local privilege escalation"
      ];
    }

and a user attempts to install the package, they will be greeted with
a warning indicating that maybe they don't want to install it:

    error: Package ‘foobar-1.2.3’ in ‘...default.nix:20’ is marked as insecure, refusing to evaluate.

    Known issues:

     - CVE-0000-00000: remote code execution
     - CVE-0000-00001: local privilege escalation

    You can install it anyway by whitelisting this package, using the
    following methods:

    a) for `nixos-rebuild` you can add ‘foobar-1.2.3’ to
       `nixpkgs.config.permittedInsecurePackages` in the configuration.nix,
       like so:

         {
           nixpkgs.config.permittedInsecurePackages = [
             "foobar-1.2.3"
           ];
         }

    b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
    ‘foobar-1.2.3’ to `permittedInsecurePackages` in
    ~/.config/nixpkgs/config.nix, like so:

         {
           permittedInsecurePackages = [
             "foobar-1.2.3"
           ];
         }

Adding either of these configurations will permit this specific
version to be installed. A third option also exists:

  NIXPKGS_ALLOW_INSECURE=1 nix-build ...

though I specifically avoided having a global file-based toggle to
disable this check. This way, users don't disable it once in order to
get a single package, and then don't realize future packages are
insecure.
2017-02-17 20:49:49 -05:00
John Ericson
f6ef6b56fe Merge pull request #22387 from Ericson2314/cross-3-platforms
cross stdenv: let build package's build deps resolve to native packages
2017-02-05 17:41:31 -05:00
John Ericson
5eaea6cee0 cross stdenv: let build package's build deps resolve to native packages
This fixes the "sliding window" principle:
  0. Run packages:       build = native;  host = foreign; target = foreign;
  1. Build packages:     build = native;  host = native;  target = foreign;
  2. Vanilla packages:   build = native;  host = native;  target = native;
  3. Vanilla packages:   build = native;  host = native;  target = native;
  n+3. ...

Each stage's build dependencies are resolved against the previous stage,
and the "foreigns" are shifted accordingly. Vanilla packages alone are
built against themsevles, since there are no more "foreign"s to shift away.

Before, build packages' build dependencies were resolved against
themselves:
  0. Run packages:       build = native;  host = foreign; target = foreign;
  1. Build packages:     build = native;  host = native;  target = foreign;
  2. Build packages:     build = native;  host = native;  target = foreign;
  n+2. ...

This is wrong because that principle is violated by the target
platform staying foreign.

This will change the hashes of many build packages and run packages, but
that is OK. This is an unavoidable cost of fixing cross compiling.

The cross compilation docs have been updated to reflect this fix.
2017-02-05 12:01:53 -05:00
Tuomas Tynkkynen
b2343099ab make-bootstrap-tools{,-cross}.nix: Fix build after binutils changes
Broken after commit 17a344a ("binutils: Add lib output").
2017-02-04 23:39:25 +02:00
Eelco Dolstra
9d6a55aefd
~/.nixpkgs -> ~/.config/nixpkgs
The former is still respected as a fallback for config.nix for
backwards compatibility (but not for overlays because they're a new
feature).
2017-02-01 16:07:55 +01:00
Tuomas Tynkkynen
18599495c4 stdenv: make is64bit evaluate true on aarch64
This should fix the NSS build.
2017-01-29 20:28:14 +02:00
Tuomas Tynkkynen
d1d8ed21b6 stdenv: Aarch64 bootstrap: Update bootstrap tarballs to hydra-built ones
Picked from the following cross-trunk evaluation:
http://hydra.nixos.org/eval/1326772#tabs-still-succeed based on nixpkgs
commit 264d42b9cfc3edf16e945164a45b31185e47422a.

dist job: http://hydra.nixos.org/build/47094514
2017-01-29 01:34:02 +02:00
Tuomas Tynkkynen
e2a2f6d595 Merge pull request #22117 from dezgeg/aarch64-for-merge
Aarch64 (ARM64) support
2017-01-26 17:52:28 +02:00
John Ericson
c869fe022e top-level: no more need to expose splicedPackages
This was just done temporarily on the last cross-overhauling PR for
testing purposes.
2017-01-25 09:24:55 -05:00
Tuomas Tynkkynen
5c0a385e1c stdenv: Add aarch64 bootstrap files
These are temporary and will be switched to Hydra-build ones once all
the aarch4 changs are merged.
2017-01-25 00:01:53 +02:00
Tuomas Tynkkynen
de3cac0ece make-bootstrap-tools.nix test: Use busybox from store
Our bootstrap tools are actually broken right now due to busybox not
working when invoked directly from a store path. (It says e.g.
"0qqqw19y4gmknajw8vg4fvhx9gxdqlhz-busybox: applet not found").
Make this test actually fail in such case, the next commit will fix the
problem with busybox.
2017-01-25 00:01:52 +02:00
Tuomas Tynkkynen
c909f1b18e stdenv: Add updateAutoconfGnuConfigScriptsHook for aarch64
This is required for Aarch64 since a lot of source tarballs ship with
outdated configure scripts that don't recognize aarch64. Simply
replacing the config.guess and config.sub with new versions from
upstream makes them build again.

This same approach is used by at least Buildroot and Fedora. In
principle this could be enabled for all architectures but
conditionalizing this on aarch64 avoids a mass rebuild on x86.
2017-01-25 00:01:52 +02:00
Tuomas Tynkkynen
7c8a060c09 stdenv: Bringup aarch64 architecture support 2017-01-25 00:01:51 +02:00
John Ericson
bfb147b6a8 top-level: Only splice as needed for performance 2017-01-24 11:37:56 -05:00
John Ericson
a1a798f017 top-level: crossSystem is no longer exposed to packages. Use *Platform. 2017-01-24 11:37:56 -05:00
John Ericson
1c0365bd88 cross-stdenv: Inline useless bindings and reindent
Semantics should be unchanged
2017-01-24 11:37:56 -05:00
John Ericson
92edcb7ebb top-level: Lay the groundwork for {build,host,target}Platform
The long term goal is a big replace:
  { inherit system platform; } => buildPlatform
  crossSystem => hostPlatform
  stdenv.cross => targetPlatform
And additionally making sure each is defined even when not cross compiling.

This commit refactors the bootstrapping code along that vision, but leaves
the old identifiers with their null semantics in place so packages can be
modernized incrementally.
2017-01-24 11:37:56 -05:00
John Ericson
bf17d6dacf top-level: Introduce buildPackages for resolving build-time deps
[N.B., this package also applies to the commits that follow it in the same
PR.]

In most cases, buildPackages = pkgs so things work just as before. For
cross compiling, however, buildPackages is resolved as the previous
bootstrapping stage. This allows us to avoid the mkDerivation hacks cross
compiling currently uses today.

To avoid a massive refactor, callPackage will splice together both package
sets. Again to avoid churn, it uses the old `nativeDrv` vs `crossDrv` to do
so. So now, whether cross compiling or not, packages with get a `nativeDrv`
and `crossDrv`---in the non-cross-compiling case they are simply the same
derivation. This is good because it reduces the divergence between the
cross and non-cross dataflow. See `pkgs/top-level/splice.nix` for a comment
along the lines of the preceding paragraph, and the code that does this
splicing.

Also, `forceNativeDrv` is replaced with `forceNativePackages`. The latter
resolves `pkgs` unless the host platform is different from the build
platform, in which case it resolves to `buildPackages`. Note that the
target platform is not important here---it will not prevent
`forcedNativePackages` from resolving to `pkgs`.

--------

Temporarily, we make preserve some dubious decisions in the name of preserving
hashes:

Most importantly, we don't distinguish between "host" and "target" in the
autoconf sense. This leads to the proliferation of *Cross derivations
currently used. What we ought to is resolve native deps of the cross "build
packages" (build = host != target) package set against the "vanilla
packages" (build = host = target) package set. Instead, "build packages"
uses itself, with (informally) target != build in all cases.

This is wrong because it violates the "sliding window" principle of
bootstrapping stages that shifting the platform triple of one stage to the
left coincides with the next stage's platform triple. Only because we don't
explicitly distinguish between "host" and "target" does it appear that the
"sliding window" principle is preserved--indeed it is over the reductionary
"platform double" of just "build" and "host/target".

Additionally, we build libc, libgcc, etc in the same stage as the compilers
themselves, which is wrong because they are used at runtime, not build
time. Fixing this is somewhat subtle, and the solution and problem will be
better explained in the commit that does fix it.

Commits after this will solve both these issues, at the expense of breaking
cross hashes. Native hashes won't be broken, thankfully.

--------

Did the temporary ugliness pan out? Of the packages that currently build in
`release-cross.nix`, the only ones that have their hash changed are
`*.gcc.crossDrv` and `bootstrapTools.*.coreutilsMinimal`. In both cases I
think it doesn't matter.

 1. GCC when doing a `build = host = target = foreign` build (maximally
    cross), still defines environment variables like `CPATH`[1] with
    packages.  This seems assuredly wrong because whether gcc dynamically
    links those, or the programs built by gcc dynamically link those---I
    have no idea which case is reality---they should be foreign. Therefore,
    in all likelihood, I just made the gcc less broken.

 2. Coreutils (ab)used the old cross-compiling infrastructure to depend on
    a native version of itself. When coreutils was overwritten to be built
    with fewer features, the native version it used would also be
    overwritten because the binding was tight. Now it uses the much looser
    `BuildPackages.coreutils` which is just fine as a richer build dep
    doesn't cause any problems and avoids a rebuild.

So, in conclusion I'd say the conservatism payed off. Onward to actually
raking the muck in the next PR!

[1]: https://gcc.gnu.org/onlinedocs/gcc/Environment-Variables.html
2017-01-24 11:37:56 -05:00
Nicolas B. Pierron
da8cf2662a Fix missing overlays argument in stdenv/linux/default.nix 2017-01-16 01:17:33 +01:00
Nicolas B. Pierron
f5dfe78a1e Add overlays mechanism to Nixpkgs.
This patch add a new argument to Nixpkgs default expression named "overlays".

By default, the value of the argument is either taken from the environment variable `NIXPKGS_OVERLAYS`,
or from the directory `~/.nixpkgs/overlays/`.  If the environment variable does not name a valid directory
then this mechanism would fallback on the home directory.  If the home directory does not exists it will
fallback on an empty list of overlays.

The overlays directory should contain the list of extra Nixpkgs stages which would be used to extend the
content of Nixpkgs, with additional set of packages.  The overlays, i-e directory, files, symbolic links
are used in alphabetical order.

The simplest overlay which extends Nixpkgs with nothing looks like:

```nix
self: super: {
}
```

More refined overlays can use `super` as the basis for building new packages, and `self` as a way to query
the final result of the fix-point.

An example of overlay which extends Nixpkgs with a small set of packages can be found at:
  https://github.com/nbp/nixpkgs-mozilla/blob/nixpkgs-overlay/moz-overlay.nix

To use this file, checkout the repository and add a symbolic link to
the `moz-overlay.nix` file in `~/.nixpkgs/overlays` directory.
2017-01-16 01:17:33 +01:00
John Ericson
abaf790ea9 stdenv/booter.nix: Add longer note explaining indexing 2017-01-13 13:47:17 -05:00
John Ericson
ff35560460 linux stdenv: Inline stage funs to conform to new convention
Code is just moved around
2017-01-13 13:23:26 -05:00
John Ericson
b10f415c21 linux stdenv: Remove stray use of stage0 to bootstrap more elegantly 2017-01-13 13:23:26 -05:00
John Ericson
6a45e911c4 linux stdenv: Utilize overrides and prevStage better
`gcc-unwrapped` basically replaces `gccPlain`. It may seem like an ugly
polution to stick it in all-packages, but a future PR will enshrine this
`*-unwrapped` pattern. In any event, the long term goal is stdenvs might
need to tweak how compilers are booted and wrapped, but the code to build
the unwrapped compilers themselves should be generic.
2017-01-13 13:23:25 -05:00
David Grayson
0f33b9f7f1 top-level: Do stdenvOverrides in stage.nix even if crossSystem exists.
Instead, the cross stdenv will patch up the override field -- the complexity
is now confined to the one place it matters.
2017-01-13 13:23:25 -05:00
John Ericson
3e197f7d81 top-level: Normalize stdenv booting
Introduce new abstraction, `stdenv/booter.nix` for composing bootstraping
stages, and use it everywhere for consistency. See that file for more doc.

Stdenvs besides Linux and Darwin are completely refactored to utilize this.
Those two, due to their size and complexity, are minimally edited for
easier reviewing.

No hashes should be changed.
2017-01-13 13:23:23 -05:00
John Ericson
0ef8b69d12 top-level: Modernize stdenv.overrides giving it self and super
Document breaking change in 17.03 release notes
2017-01-13 10:36:11 -05:00
Tuomas Tynkkynen
bde8632106 coreutils: Build with libattr to support xattrs
Fixes #21649
2017-01-05 00:55:35 +02:00
John Ericson
19fbe80c3d top-level: avoid another assert false while we're at it 2016-12-15 17:09:46 -05:00
John Ericson
7960a1b1b8 linux stdenv: Avoid assert false
On one hand, don't want to pass garbage that affects hash, on the other
hand footguns are bad.

Now, factored out the derivation so only need to pass in what is used.
2016-12-15 17:09:29 -05:00
John Ericson
670256dc39 linux stdenv: Rename the bootstrap directory to bootstrap-files 2016-12-15 17:05:39 -05:00
John Ericson
a94af71da7 linux stdenv: Fix assert that broke tests...and hydra 2016-12-15 16:45:08 -05:00
John Ericson
5c6234a7d3 top-level: Allow manually specifying a stdenv, and fix stdenv tests
- The darwin test can now force the use of the freshly-booted darwin stdenv
 - The linux test now passes enough dummy arguments

This may make debugging harder, if so, check out #20889
2016-12-03 17:21:07 -08:00
John Ericson
4751d9e5ad top-level: turn the screw
- Non-cross stdenvs are honest and assert that `crossSystem` is null

 - `crossSystem` is a mandatory argument to top-level/stage.nix, just like
   `system` and `platform`

 - Broken default arguments on stdenvs for testing are gone.

 - All stdenvs (but little-used stdenvNix) take the same arguments for easy
   testing.
2016-12-01 11:24:33 -05:00
John Ericson
39753f5360 top-level: Close over fewer arguments for stdenv stages
This makes the flow of data easier to understand. There's little downside
because the args in question are already inspected by the stdenvs.

cross-compiling in particular is simpler because we don't need to worry
about overriding the config closed over by `allPackages`.
2016-11-30 19:11:03 -05:00
John Ericson
d240a0da1a top-level: Remove cycles: stdenv calls in top-level but not vice versa
This commit changes the dependencies of stdenv, and clean-up the stdenv
story by removing the `defaultStdenv` attribute as well as the `bootStdenv`
parameter.

Before, the final bootstrapping stage's stdenv was provided by
all-packages, which was iterating multiple times over the
top-level/default.nix expression, and non-final bootstrapping stages'
stdenvs were explicitly specified with the `bootStdenv` parameter.

Now, all stages' stdenvs are specified with the `stdenv` parameter.
For non-final bootstrapping stages, this is a small change---basically just
rename the parameter.
For the final stage, top-level/default.nix takes the chosen stdenv and
makes the final stage with it.

`allPackages` is used to make all bootstrapping stages, final and
non-final alike. It's basically the expression of `stage.nix` (along with a
few partially-applied default arguments)

Note, the make-bootstrap-tools scripts are temporarily broken
2016-11-30 19:10:59 -05:00
John Ericson
2df990967b Move up inherit binding for consistency 2016-11-30 19:03:22 -05:00
John Ericson
ddeb0d2d6b top-level: Stop exposing all stdenvs 2016-11-30 19:03:01 -05:00
Domen Kožar
45f579b9e7 allowUnfree: mention the solution that works for nix-shell as well 2016-11-16 15:14:19 +01:00
Shea Levy
7df3d7446f Add initial basic support for cross-compiling to iOS 2016-11-15 16:31:55 -05:00
John Ericson
f68e16f023 top-level: Make cross compiling slightly saner
Removes the weird stdenv cycle used to match the old infrastructure.
It turns out that matching it so precisely is not needed.
2016-11-12 20:20:44 +01:00
John Ericson
6bfe04277f top-level: Make config-overriden stdenv bootstrap more normally 2016-11-06 21:28:38 -08:00
John Ericson
e22346c35e top-level: Make stdenvCross which appears at first glance normal...
...but actually is weird just like the original
2016-11-06 21:27:38 -08:00
Domen Kožar
62edf873aa Merge pull request #18660 from aneeshusa/add-override-attrs
mkDerivation: add overrideAttrs function
2016-10-30 11:32:15 +01:00
John Ericson
d9bc6eb7f0 top-level: Make stdenv/default.nix more concise with inherit (expr) id; syntax 2016-10-27 21:47:46 -07:00
Frederik Rietdijk
7077a270bf Merge remote-tracking branch 'upstream/master' into HEAD 2016-10-26 13:06:43 +02:00
Joachim F
3d5630fac9 Merge pull request #19769 from groxxda/license
stdenv.hasLicense: ? supports nested lookup
2016-10-24 15:19:12 +02:00
Alexander Ried
a0ac2ae35e stdenv: throwEvalHelp performance (#19779) 2016-10-22 20:24:56 +02:00