-
-
Notifications
You must be signed in to change notification settings - Fork 15.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Harden stdenv in two misc ways #27215
Conversation
Instead of eval, use a "nameref" to get the name of the array and iterate with that. Also, make the for-loop parameter a local variable, too.
If you can make it work on one platform, but not break anything on the others, that seems fine, but the way your PR is now formulated, this is not the case. If this PR requires a particular feature (the |
@0xABAB In that other PR I link, I need to use this a few more times. I could work around them all with eval, but numerous such fallbacks are annoying to maintain. Also, I recall you were also interested in Nix/nixpkgs eventually supporting store paths with special characters? The I think that given all that, asking MacOS users to |
Also, in a future with |
Why not just make nix-shell depend on a Nix version of bash then on MacOSX? In that case, you don't need to educate MacOSX users. |
AFAIK, stdenv already requires a newer bash than what macOS provides. (I think it's still stuck at 3.2.) So this seems fine to me. |
Namerefs were introduced in bash 4.3 BTW, which is more than 3 years old. |
This indeed breaks
However, this is indeed fixed by installing a newer bash, running, e.g., Maybe |
Right, stdenv could do that check and show better help. |
I strongly disagree. It feels very counter to the Nix philosophy to require manual user intervention and expect an implicit contextual dependency to be set up before really basic Nix functionality works. The reason Nix is so appealing to me (and many others I know) is that I don't have to do stuff like that to make things work, because Nix is setting up and reasoning about explicit dependencies all the way down. |
Also, it seems strange to me to merge this an hour after submitting with no explicit testing on macOS despite @Ericson2314 acknowledging that it could break macOS in the opening comment of the PR. As expected, this has now broken stdenv on master. The darwin maintainers already have a hard time being such a minority in the community, because Linux folks inadvertently break our stuff all the time. That's frustrating but understandable because inadvertent and we don't have a good way to test Darwin from Linux; what's more frustrating is seeing an explicit understanding that this will break us and merging it anyway. I get that you requested a review from me (presumably as a Darwin representative) but I was busy and didn't get to it (nor did any other Darwin folks) and you merged it anyway, thus knowingly breaking the entire platform... |
Well, as I wrote:
So it was not expected to cause additional breakage on macOS. Also "breaks nix-shell" != "breaking the entire platform". Such regressions can occur from time to time, that's why we have a stable branch after all. We can easily revert this change. |
long-term fix proposal: #27493 (comment) |
@edolstra I get it, but this also means that the default nix install on CentOS is now broken too (this change made it out into the nixpkgs-unstable channel). |
Motivation for this change
This is a few easy things pulled out of #26805 . The one downside is that a fairly new system bash will be required for impure
nix-shell
to work with these "namerefs"---this affects MacOS last I checked.Things done
Manually built part of the linux stdenv with the original PR.
CC @Dridus