Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Harden stdenv in two misc ways #27215

Merged
merged 2 commits into from
Jul 7, 2017

Conversation

Ericson2314
Copy link
Member

@Ericson2314 Ericson2314 commented Jul 7, 2017

Motivation for this change

This is a few easy things pulled out of #26805 . The one downside is that a fairly new system bash will be required for impure nix-shell to work with these "namerefs"---this affects MacOS last I checked.

Things done

Manually built part of the linux stdenv with the original PR.


CC @Dridus

Ericson2314 and others added 2 commits July 7, 2017 11:35
Instead of eval, use a "nameref" to get the name of the array and
iterate with that. Also, make the for-loop parameter a local variable,
too.
@Ericson2314 Ericson2314 requested review from edolstra and copumpkin July 7, 2017 15:46
@Ericson2314 Ericson2314 changed the base branch from master to staging July 7, 2017 15:48
@Ericson2314 Ericson2314 requested a review from pikajude July 7, 2017 15:57
@0xABAB
Copy link
Contributor

0xABAB commented Jul 7, 2017

If you can make it work on one platform, but not break anything on the others, that seems fine, but the way your PR is now formulated, this is not the case.

If this PR requires a particular feature (the -n-flag for local), why not just do a feature test and write two implementations?

@Ericson2314
Copy link
Member Author

Ericson2314 commented Jul 7, 2017

@0xABAB In that other PR I link, I need to use this a few more times. I could work around them all with eval, but numerous such fallbacks are annoying to maintain.

Also, I recall you were also interested in Nix/nixpkgs eventually supporting store paths with special characters? The eval fallbacks are usually broken with respect to that, but these aren't.

I think that given all that, asking MacOS users to nix-env -A nixpkgs.bash if they wish to use nix-shell is pretty lightweight.

@Ericson2314
Copy link
Member Author

Also, in a future with nix use, nix shell will become quite niche.

@0xABAB
Copy link
Contributor

0xABAB commented Jul 7, 2017

I think that given all that, asking MacOS users to nix-env -A nixpkgs.bash if they wish to use nix-shell is pretty lightweight.

Why not just make nix-shell depend on a Nix version of bash then on MacOSX? In that case, you don't need to educate MacOSX users.

@edolstra
Copy link
Member

edolstra commented Jul 7, 2017

AFAIK, stdenv already requires a newer bash than what macOS provides. (I think it's still stuck at 3.2.) So this seems fine to me.

@edolstra
Copy link
Member

edolstra commented Jul 7, 2017

Namerefs were introduced in bash 4.3 BTW, which is more than 3 years old.

@Ericson2314 Ericson2314 added the 1.severity: mass-rebuild This PR causes a large number of packages to rebuild label Jul 7, 2017
@Ericson2314 Ericson2314 merged commit f536412 into NixOS:staging Jul 7, 2017
@Ericson2314 Ericson2314 deleted the stdenv-harden branch July 7, 2017 16:49
@vbgl
Copy link
Contributor

vbgl commented Jul 15, 2017

This indeed breaks nix-shell on macOS X (version 10.11), which comes with bash-3.2. The following error messages appear:

bash: local: -n: invalid option
local: usage: local name[=value] ...
bash: local: -n: invalid option
local: usage: local name[=value] ...
bash: failureHooks: command not found

However, this is indeed fixed by installing a newer bash, running, e.g., nix-env -iA nixpkgs.bashInteractive. Installing plain nixpkgs.bash also solves the issue, but provides a rather unfriendly shell.

Maybe nix-shell itself could check the bash version and provide an error message a little bit more friendly.

@vcunat
Copy link
Member

vcunat commented Jul 15, 2017

Right, stdenv could do that check and show better help.

@copumpkin
Copy link
Member

copumpkin commented Jul 19, 2017

I think that given all that, asking MacOS users to nix-env -A nixpkgs.bash if they wish to use nix-shell is pretty lightweight.

I strongly disagree. It feels very counter to the Nix philosophy to require manual user intervention and expect an implicit contextual dependency to be set up before really basic Nix functionality works. The reason Nix is so appealing to me (and many others I know) is that I don't have to do stuff like that to make things work, because Nix is setting up and reasoning about explicit dependencies all the way down.

@copumpkin
Copy link
Member

copumpkin commented Jul 19, 2017

Also, it seems strange to me to merge this an hour after submitting with no explicit testing on macOS despite @Ericson2314 acknowledging that it could break macOS in the opening comment of the PR. As expected, this has now broken stdenv on master.

The darwin maintainers already have a hard time being such a minority in the community, because Linux folks inadvertently break our stuff all the time. That's frustrating but understandable because inadvertent and we don't have a good way to test Darwin from Linux; what's more frustrating is seeing an explicit understanding that this will break us and merging it anyway. I get that you requested a review from me (presumably as a Darwin representative) but I was busy and didn't get to it (nor did any other Darwin folks) and you merged it anyway, thus knowingly breaking the entire platform...

@edolstra
Copy link
Member

Well, as I wrote:

AFAIK, stdenv already requires a newer bash than what macOS provides. (I think it's still stuck at 3.2.) So this seems fine to me.

So it was not expected to cause additional breakage on macOS. Also "breaks nix-shell" != "breaking the entire platform".

Such regressions can occur from time to time, that's why we have a stable branch after all. We can easily revert this change.

@domenkozar
Copy link
Member

long-term fix proposal: #27493 (comment)

@copumpkin
Copy link
Member

copumpkin commented Jul 20, 2017

@edolstra I get it, but this also means that the default nix install on CentOS is now broken too (this change made it out into the nixpkgs-unstable channel). I'd bet Ubuntu is as well [just tested, it's fine, but CentOS is still b0rked].

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
1.severity: mass-rebuild This PR causes a large number of packages to rebuild
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

7 participants