diff --git a/.coderabbit.yaml b/.coderabbit.yaml
deleted file mode 100644
index 2220649caa2..00000000000
--- a/.coderabbit.yaml
+++ /dev/null
@@ -1,18 +0,0 @@
-# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
-# Disable CodeRabbit auto-review to prevent verbose comments on PRs.
-# When enabled: false, CodeRabbit won't attempt reviews and won't post
-# "Review skipped" or other automated comments.
-reviews:
- auto_review:
- enabled: false
- review_status: false
- high_level_summary: false
- poem: false
- sequence_diagrams: false
- changed_files_summary: false
- tools:
- github-checks:
- enabled: false
-chat:
- art: false
- auto_reply: false
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
deleted file mode 100644
index 763c5f27ee6..00000000000
--- a/.github/CODEOWNERS
+++ /dev/null
@@ -1,17 +0,0 @@
-# Pull requests concerning the listed files will automatically invite the respective maintainers as reviewers.
-# This file is not used for denoting any kind of ownership, but is merely a tool for handling notifications.
-#
-# Merge permissions are required for maintaining an entry in this file.
-# For documentation on this mechanism, see https://help.github.com/articles/about-codeowners/
-
-# Default reviewers if nothing else matches
-* @edolstra
-
-# This file
-.github/CODEOWNERS @edolstra
-
-# Documentation of built-in functions
-src/libexpr/primops.cc @roberth
-
-# Libstore layer
-/src/libstore @ericson2314
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index af94c3e9e5b..08a5851748d 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -1,10 +1,9 @@
---
name: Bug report
about: Report unexpected or incorrect behaviour
-title: ''
+title: ""
labels: bug
-assignees: ''
-
+assignees: ""
---
## Describe the bug
@@ -32,7 +31,9 @@ assignees: ''
## Metadata
-
+
+
+
## Additional context
@@ -42,13 +43,9 @@ assignees: ''
-- [ ] checked [latest Nix manual] \([source])
+- [ ] checked [latest Determinate Nix manual] \([source])
- [ ] checked [open bug issues and pull requests] for possible duplicates
-[latest Nix manual]: https://nix.dev/manual/nix/development/
-[source]: https://github.com/NixOS/nix/tree/master/doc/manual/source
-[open bug issues and pull requests]: https://github.com/NixOS/nix/labels/bug
-
----
-
-Add :+1: to [issues you find important](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc).
+[latest Determinate Nix manual]: https://manual.determinate.systems/
+[source]: https://github.com/DeterminateSystems/nix-src/tree/main/doc/manual/source
+[open bug issues and pull requests]: https://github.com/DeterminateSystems/nix-src/labels/bug
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
index fe9f9dd209d..b88e1093798 100644
--- a/.github/ISSUE_TEMPLATE/feature_request.md
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -1,10 +1,9 @@
---
name: Feature request
about: Suggest a new feature
-title: ''
+title: ""
labels: feature
-assignees: ''
-
+assignees: ""
---
## Is your feature request related to a problem?
@@ -27,13 +26,9 @@ assignees: ''
-- [ ] checked [latest Nix manual] \([source])
-- [ ] checked [open feature issues and pull requests] for possible duplicates
-
-[latest Nix manual]: https://nix.dev/manual/nix/development/
-[source]: https://github.com/NixOS/nix/tree/master/doc/manual/source
-[open feature issues and pull requests]: https://github.com/NixOS/nix/labels/feature
-
----
+- [ ] checked [latest Determinate Nix manual] \([source])
+- [ ] checked [open bug issues and pull requests] for possible duplicates
-Add :+1: to [issues you find important](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc).
+[latest Determinate Nix manual]: https://manual.determinate.systems/
+[source]: https://github.com/DeterminateSystems/nix-src/tree/main/doc/manual/source
+[open bug issues and pull requests]: https://github.com/DeterminateSystems/nix-src/labels/bug
diff --git a/.github/ISSUE_TEMPLATE/installer.md b/.github/ISSUE_TEMPLATE/installer.md
index 070e0bd9b25..430bef971aa 100644
--- a/.github/ISSUE_TEMPLATE/installer.md
+++ b/.github/ISSUE_TEMPLATE/installer.md
@@ -1,18 +1,17 @@
---
name: Installer issue
about: Report problems with installation
-title: ''
+title: ""
labels: installer
-assignees: ''
-
+assignees: ""
---
## Platform
-
+
-- [ ] Linux:
- [ ] macOS
+- [ ] Linux:
- [ ] WSL
## Additional information
@@ -35,13 +34,9 @@ assignees: ''
-- [ ] checked [latest Nix manual] \([source])
-- [ ] checked [open installer issues and pull requests] for possible duplicates
-
-[latest Nix manual]: https://nix.dev/manual/nix/development/
-[source]: https://github.com/NixOS/nix/tree/master/doc/manual/source
-[open installer issues and pull requests]: https://github.com/NixOS/nix/labels/installer
-
----
+- [ ] checked [latest Determinate Nix manual] \([source])
+- [ ] checked [open bug issues and pull requests] for possible duplicates
-Add :+1: to [issues you find important](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc).
+[latest Determinate Nix manual]: https://manual.determinate.systems/
+[source]: https://github.com/DeterminateSystems/nix-src/tree/main/doc/manual/source
+[open bug issues and pull requests]: https://github.com/DeterminateSystems/nix-src/labels/bug
diff --git a/.github/ISSUE_TEMPLATE/missing_documentation.md b/.github/ISSUE_TEMPLATE/missing_documentation.md
index 4e05b626d39..fcdd0d20135 100644
--- a/.github/ISSUE_TEMPLATE/missing_documentation.md
+++ b/.github/ISSUE_TEMPLATE/missing_documentation.md
@@ -1,10 +1,9 @@
---
name: Missing or incorrect documentation
about: Help us improve the reference manual
-title: ''
+title: ""
labels: documentation
-assignees: ''
-
+assignees: ""
---
## Problem
@@ -19,13 +18,9 @@ assignees: ''
-- [ ] checked [latest Nix manual] \([source])
-- [ ] checked [open documentation issues and pull requests] for possible duplicates
-
-[latest Nix manual]: https://nix.dev/manual/nix/development/
-[source]: https://github.com/NixOS/nix/tree/master/doc/manual/source
-[open documentation issues and pull requests]: https://github.com/NixOS/nix/labels/documentation
-
----
+- [ ] checked [latest Determinate Nix manual] \([source])
+- [ ] checked [open bug issues and pull requests] for possible duplicates
-Add :+1: to [issues you find important](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc).
+[latest Determinate Nix manual]: https://manual.determinate.systems/
+[source]: https://github.com/DeterminateSystems/nix-src/tree/main/doc/manual/source
+[open bug issues and pull requests]: https://github.com/DeterminateSystems/nix-src/labels/bug
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index c155bf8bfa4..d3e1f817736 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -1,26 +1,3 @@
-
-
## Motivation
@@ -34,9 +11,3 @@ PR stuck in review? We have two Nix team meetings per week online that are open
-
----
-
-Add :+1: to [pull requests you find important](https://github.com/NixOS/nix/pulls?q=is%3Aopen+sort%3Areactions-%2B1-desc).
-
-The Nix maintainer team uses a [GitHub project board](https://github.com/orgs/NixOS/projects/19) to [schedule and track reviews](https://github.com/NixOS/nix/tree/master/maintainers#project-board-protocol).
diff --git a/.github/STALE-BOT.md b/.github/STALE-BOT.md
index bc0005413f1..281d0f79a8b 100644
--- a/.github/STALE-BOT.md
+++ b/.github/STALE-BOT.md
@@ -2,34 +2,21 @@
- Thanks for your contribution!
- To remove the stale label, just leave a new comment.
-- _How to find the right people to ping?_ → [`git blame`](https://git-scm.com/docs/git-blame) to the rescue! (or GitHub's history and blame buttons.)
-- You can always ask for help on [our Discourse Forum](https://discourse.nixos.org/) or on [Matrix - #users:nixos.org](https://matrix.to/#/#users:nixos.org).
+- You can always ask for help on [Discord](https://determinate.systems/discord).
## Suggestions for PRs
-1. GitHub sometimes doesn't notify people who commented / reviewed a PR previously, when you (force) push commits. If you have addressed the reviews you can [officially ask for a review](https://docs.github.com/en/free-pro-team@latest/github/collaborating-with-issues-and-pull-requests/requesting-a-pull-request-review) from those who commented to you or anyone else.
-2. If it is unfinished but you plan to finish it, please mark it as a draft.
-3. If you don't expect to work on it any time soon, closing it with a short comment may encourage someone else to pick up your work.
-4. To get things rolling again, rebase the PR against the target branch and address valid comments.
-5. If you need a review to move forward, ask in [the Discourse thread for PRs that need help](https://discourse.nixos.org/t/prs-in-distress/3604).
-6. If all you need is a merge, check the git history to find and [request reviews](https://docs.github.com/en/github/collaborating-with-issues-and-pull-requests/requesting-a-pull-request-review) from people who usually merge related contributions.
+1. If it is unfinished but you plan to finish it, please mark it as a draft.
+1. If you don't expect to work on it any time soon, closing it with a short comment may encourage someone else to pick up your work.
+1. To get things rolling again, rebase the PR against the target branch and address valid comments.
+1. If you need a review to move forward, ask in [Discord](https://determinate.systems/discord).
## Suggestions for issues
1. If it is resolved (either for you personally, or in general), please consider closing it.
2. If this might still be an issue, but you are not interested in promoting its resolution, please consider closing it while encouraging others to take over and reopen an issue if they care enough.
-3. If you still have interest in resolving it, try to ping somebody who you believe might have an interest in the topic. Consider discussing the problem in [our Discourse Forum](https://discourse.nixos.org/).
-4. As with all open source projects, your best option is to submit a Pull Request that addresses this issue. We :heart: this attitude!
+3. If you still have interest in resolving it, try to ping somebody who you believe might have an interest in the topic. Consider discussing the problem in [Discord](https://determinate.systems/discord).
**Memorandum on closing issues**
Don't be afraid to close an issue that holds valuable information. Closed issues stay in the system for people to search, read, cross-reference, or even reopen--nothing is lost! Closing obsolete issues is an important way to help maintainers focus their time and effort.
-
-## Useful GitHub search queries
-
-- [Open PRs with any stale-bot interaction](https://github.com/NixOS/nix/pulls?q=is%3Apr+is%3Aopen+commenter%3Aapp%2Fstale+)
-- [Open PRs with any stale-bot interaction and `stale`](https://github.com/NixOS/nix/pulls?q=is%3Apr+is%3Aopen+commenter%3Aapp%2Fstale+label%3A%22stale%22)
-- [Open PRs with any stale-bot interaction and NOT `stale`](https://github.com/NixOS/nix/pulls?q=is%3Apr+is%3Aopen+commenter%3Aapp%2Fstale+-label%3A%22stale%22+)
-- [Open Issues with any stale-bot interaction](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+commenter%3Aapp%2Fstale+)
-- [Open Issues with any stale-bot interaction and `stale`](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+commenter%3Aapp%2Fstale+label%3A%22stale%22+)
-- [Open Issues with any stale-bot interaction and NOT `stale`](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+commenter%3Aapp%2Fstale+-label%3A%22stale%22+)
diff --git a/.github/release-notes.sh b/.github/release-notes.sh
new file mode 100755
index 00000000000..f641e146d2e
--- /dev/null
+++ b/.github/release-notes.sh
@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+
+# SC2002 disables "useless cat" warnings.
+# I prefer pipelines that start with an explicit input, and go from there.
+# Overly fussy.
+# shellcheck disable=SC2002
+
+scratch=$(mktemp -d -t tmp.XXXXXXXXXX)
+finish() {
+ rm -rf "$scratch"
+}
+trap finish EXIT
+
+DATE=$(date +%Y-%m-%d)
+DETERMINATE_NIX_VERSION=$(cat .version-determinate)
+TAG_NAME="v${DETERMINATE_NIX_VERSION}"
+NIX_VERSION=$(cat .version)
+NIX_VERSION_MAJOR_MINOR=$(echo "$NIX_VERSION" | cut -d. -f1,2)
+GITHUB_REPOSITORY="${GITHUB_REPOSITORY:-DeterminateSystems/nix-src}"
+
+gh api "/repos/${GITHUB_REPOSITORY}/releases/generate-notes" \
+ -f "tag_name=${TAG_NAME}" > "$scratch/notes.json"
+
+trim_trailing_newlines() {
+ local text
+ text="$(cat)"
+ echo -n "${text}"
+}
+
+linkify_gh() {
+ sed \
+ -e 's!\(https://github.com/DeterminateSystems/nix-src/\(pull\|issue\)/\([[:digit:]]\+\)\)!' \
+ -e 's#\(https://github.com/DeterminateSystems/nix-src/compare/\([^ ]\+\)\)#[\2](\1)#'
+}
+
+(
+ cat doc/manual/source/release-notes-determinate/changes.md \
+ | sed 's/^.*\(\)$/This section lists the differences between upstream Nix '"$NIX_VERSION_MAJOR_MINOR"' and Determinate Nix '"$DETERMINATE_NIX_VERSION"'.\1/' \
+
+ printf "\n\n" "$DETERMINATE_NIX_VERSION"
+ cat "$scratch/notes.json" \
+ | jq -r .body \
+ | grep -v '^#' \
+ | grep -v "Full Changelog" \
+ | trim_trailing_newlines \
+ | sed -e 's/^\* /\n* /' \
+ | linkify_gh
+ echo "" # final newline
+) > "$scratch/changes.md"
+
+(
+ printf "# Release %s (%s)\n\n" \
+ "$DETERMINATE_NIX_VERSION" \
+ "$DATE"
+ printf "* Based on [upstream Nix %s](../release-notes/rl-%s.md).\n\n" \
+ "$NIX_VERSION" \
+ "$NIX_VERSION_MAJOR_MINOR"
+
+ cat "$scratch/notes.json" | jq -r .body | linkify_gh
+) > "$scratch/rl.md"
+
+(
+ cat doc/manual/source/SUMMARY.md.in \
+ | sed 's/\(\)$/\1\n - [Release '"$DETERMINATE_NIX_VERSION"' ('"$DATE"')](release-notes-determinate\/'"$TAG_NAME"'.md)/'
+) > "$scratch/summary.md"
+
+mv "$scratch/changes.md" doc/manual/source/release-notes-determinate/changes.md
+mv "$scratch/rl.md" "doc/manual/source/release-notes-determinate/v${DETERMINATE_NIX_VERSION}.md"
+mv "$scratch/summary.md" doc/manual/source/SUMMARY.md.in
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
deleted file mode 100644
index 5ad073785cd..00000000000
--- a/.github/workflows/backport.yml
+++ /dev/null
@@ -1,37 +0,0 @@
-name: Backport
-on:
- pull_request_target:
- types: [closed, labeled]
-permissions:
- contents: read
-jobs:
- backport:
- name: Backport Pull Request
- permissions:
- # for korthout/backport-action
- contents: write
- pull-requests: write
- if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
- runs-on: ubuntu-24.04-arm
- steps:
- - name: Generate GitHub App token
- id: generate-token
- uses: actions/create-github-app-token@v2
- with:
- app-id: ${{ vars.CI_APP_ID }}
- private-key: ${{ secrets.CI_APP_PRIVATE_KEY }}
- - uses: actions/checkout@v6
- with:
- ref: ${{ github.event.pull_request.head.sha }}
- # required to find all branches
- fetch-depth: 0
- - name: Create backport PRs
- uses: korthout/backport-action@d07416681cab29bf2661702f925f020aaa962997 # v3.4.1
- id: backport
- with:
- # Config README: https://github.com/korthout/backport-action#backport-action
- github_token: ${{ steps.generate-token.outputs.token }}
- github_workspace: ${{ github.workspace }}
- auto_merge_enabled: true
- pull_description: |-
- Automatic backport to `${target_branch}`, triggered by a label in #${pull_number}.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 00000000000..dd98d0d00f9
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,241 @@
+on:
+ workflow_call:
+ inputs:
+ system:
+ required: true
+ type: string
+ runner:
+ required: true
+ type: string
+ runner_for_virt:
+ required: true
+ type: string
+ runner_small:
+ required: true
+ type: string
+ if:
+ required: false
+ default: true
+ type: boolean
+ run_tests:
+ required: false
+ default: true
+ type: boolean
+ run_vm_tests:
+ required: false
+ default: false
+ type: boolean
+ run_regression_tests:
+ required: false
+ default: false
+ type: boolean
+ publish_manual:
+ required: false
+ default: false
+ type: boolean
+ secrets:
+ manual_netlify_auth_token:
+ required: false
+ manual_netlify_site_id:
+ required: false
+
+jobs:
+ build:
+ if: ${{ inputs.if }}
+ strategy:
+ fail-fast: false
+ runs-on: ${{ inputs.runner }}
+ timeout-minutes: 60
+ steps:
+ - uses: actions/checkout@v4
+ - uses: DeterminateSystems/determinate-nix-action@main
+ - uses: DeterminateSystems/flakehub-cache-action@main
+ - run: nix build .#packages.${{ inputs.system }}.default .#packages.${{ inputs.system }}.binaryTarball --no-link -L
+ - run: nix build .#packages.${{ inputs.system }}.binaryTarball --out-link tarball
+ - uses: actions/upload-artifact@v4
+ with:
+ name: ${{ inputs.system }}
+ path: ./tarball/*.xz
+
+ test:
+ if: ${{ inputs.if && inputs.run_tests}}
+ needs: build
+ strategy:
+ fail-fast: false
+ runs-on: ${{ inputs.runner }}
+ timeout-minutes: 60
+ steps:
+ - uses: actions/checkout@v4
+ - uses: DeterminateSystems/determinate-nix-action@main
+ - uses: DeterminateSystems/flakehub-cache-action@main
+ - run: nix flake check -L --system ${{ inputs.system }}
+
+ vm_tests_smoke:
+ if: inputs.run_vm_tests && github.event_name != 'merge_group'
+ needs: build
+ runs-on: ${{ inputs.runner_for_virt }}
+ steps:
+ - uses: actions/checkout@v4
+ - uses: DeterminateSystems/determinate-nix-action@main
+ - uses: DeterminateSystems/flakehub-cache-action@main
+ - run: |
+ nix build -L \
+ .#hydraJobs.tests.functional_user \
+ .#hydraJobs.tests.githubFlakes \
+ .#hydraJobs.tests.nix-docker \
+ .#hydraJobs.tests.tarballFlakes \
+ ;
+
+ vm_tests_all:
+ if: inputs.run_vm_tests && github.event_name == 'merge_group'
+ needs: build
+ runs-on: ${{ inputs.runner_for_virt }}
+ steps:
+ - uses: actions/checkout@v4
+ - uses: DeterminateSystems/determinate-nix-action@main
+ - uses: DeterminateSystems/flakehub-cache-action@main
+ - run: |
+ cmd() {
+ nix build -L --keep-going --timeout 600 \
+ $(nix flake show --json \
+ | jq -r '
+ .hydraJobs.tests
+ | with_entries(select(.value.type == "derivation"))
+ | keys[]
+ | ".#hydraJobs.tests." + .')
+ }
+
+ if ! cmd; then
+ echo "failed, retrying once ..."
+ printf "\n\n\n\n\n\n\n\n"
+ cmd
+ fi
+
+ flake_regressions:
+ if: |
+ (inputs.run_regression_tests && github.event_name == 'merge_group')
+ || (
+ inputs.run_regression_tests
+ && github.event.pull_request.head.repo.full_name == 'DeterminateSystems/nix-src'
+ && (
+ (github.event.action == 'labeled' && github.event.label.name == 'flake-regression-test')
+ || (github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'flake-regression-test'))
+ )
+ )
+ needs: build
+ runs-on: ${{ inputs.runner }}
+ strategy:
+ matrix:
+ nix_config:
+ - "lazy-trees = true"
+ - "lazy-trees = false"
+ - "eval-cores = 24"
+ glob:
+ - "[0-d]*"
+ - "[e-l]*"
+ - "[m]*"
+ - "[n-r]*"
+ - "[s-z]*"
+
+ steps:
+ - name: Checkout nix
+ uses: actions/checkout@v4
+ - name: Checkout flake-regressions
+ uses: actions/checkout@v4
+ with:
+ repository: DeterminateSystems/flake-regressions
+ path: flake-regressions
+ - name: Checkout flake-regressions-data
+ uses: actions/checkout@v4
+ with:
+ repository: DeterminateSystems/flake-regressions-data
+ path: flake-regressions/tests
+ - uses: DeterminateSystems/determinate-nix-action@main
+ - uses: DeterminateSystems/flakehub-cache-action@main
+ - name: Run flake regression tests
+ env:
+ #PARALLEL: ${{ !contains(matrix.nix_config, 'eval-cores') && '-P 50%' || '-P 1' }}
+ PARALLEL: '-P 1'
+ FLAKE_REGRESSION_GLOB: ${{ matrix.glob }}
+ NIX_CONFIG: ${{ matrix.nix_config }}
+ PREFETCH: "1"
+ run: |
+ set -x
+ echo "PARALLEL: $PARALLEL"
+ echo "NIX_CONFIG: $NIX_CONFIG"
+ if [ ! -z "${NSC_CACHE_PATH:-}" ]; then
+ mkdir -p "${NSC_CACHE_PATH}/nix/xdg-cache"
+ export XDG_CACHE_HOME="${NSC_CACHE_PATH}/nix/xdg-cache"
+ fi
+ nix build -L --out-link ./new-nix
+ export PATH=$(pwd)/new-nix/bin:$PATH
+ [[ $(type -p nix) = $(pwd)/new-nix/bin/nix ]]
+
+ nix config show lazy-trees
+ nix config show eval-cores
+ lscpu
+ nproc
+
+ if ! flake-regressions/eval-all.sh; then
+ echo "Some failed, trying again"
+ printf "\n\n\n\n\n\n\n\n"
+ NIX_REMOTE=/tmp/nix flake-regressions/eval-all.sh
+ fi
+
+ manual:
+ if: github.event_name != 'merge_group'
+ needs: build
+ runs-on: ${{ inputs.runner_small }}
+ permissions:
+ id-token: "write"
+ contents: "read"
+ pull-requests: "write"
+ statuses: "write"
+ deployments: "write"
+ steps:
+ - name: Checkout nix
+ uses: actions/checkout@v4
+ - uses: DeterminateSystems/determinate-nix-action@main
+ - uses: DeterminateSystems/flakehub-cache-action@main
+ - name: Build manual
+ if: inputs.system == 'x86_64-linux'
+ run: nix build .#hydraJobs.manual
+ - uses: nwtgck/actions-netlify@v3.0
+ if: inputs.publish_manual && inputs.system == 'x86_64-linux'
+ with:
+ publish-dir: "./result/share/doc/nix/manual"
+ production-branch: main
+ github-token: ${{ secrets.GITHUB_TOKEN }}
+ deploy-message: "Deploy from GitHub Actions"
+ # NOTE(cole-h): We have a perpetual PR displaying our changes against upstream open, but
+ # its conversation is locked, so this PR comment can never be posted.
+ # https://github.com/DeterminateSystems/nix-src/pull/165
+ enable-pull-request-comment: ${{ github.event.pull_request.number != 165 }}
+ enable-commit-comment: true
+ enable-commit-status: true
+ overwrites-pull-request-comment: true
+ env:
+ NETLIFY_AUTH_TOKEN: ${{ secrets.manual_netlify_auth_token }}
+ NETLIFY_SITE_ID: ${{ secrets.manual_netlify_site_id }}
+
+ success:
+ needs:
+ - build
+ - test
+ - vm_tests_smoke
+ - vm_tests_all
+ - flake_regressions
+ - manual
+ if: ${{ always() }}
+ runs-on: ubuntu-latest
+ steps:
+ - run: "true"
+ - run: |
+ echo "A dependent in the build matrix failed:"
+ echo "$needs"
+ exit 1
+ env:
+ needs: ${{ toJSON(needs) }}
+ if: |
+ contains(needs.*.result, 'failure') ||
+ contains(needs.*.result, 'cancelled')
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fe9d94248d1..08000ac4c87 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,317 +2,158 @@ name: "CI"
on:
pull_request:
- merge_group:
push:
branches:
+ # NOTE: make sure any branches here are also valid directory names,
+ # otherwise creating the directory and uploading to s3 will fail
+ - main
- master
- workflow_dispatch:
- inputs:
- dogfood:
- description: 'Use dogfood Nix build'
- required: false
- default: true
- type: boolean
-
-concurrency:
- group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
- cancel-in-progress: true
+ merge_group:
+ release:
+ types:
+ - published
-permissions: read-all
+permissions:
+ id-token: "write"
+ contents: "read"
+ pull-requests: "write"
+ statuses: "write"
+ deployments: "write"
jobs:
eval:
- runs-on: ubuntu-24.04
+ runs-on: UbuntuLatest32Cores128G
steps:
- - uses: actions/checkout@v6
- with:
- fetch-depth: 0
- - uses: ./.github/actions/install-nix-action
- with:
- dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
- extra_nix_config:
- experimental-features = nix-command flakes
- github_token: ${{ secrets.GITHUB_TOKEN }}
- use_cache: false
- - run: nix flake show --all-systems --json
-
- pre-commit-checks:
- name: pre-commit checks
- runs-on: ubuntu-24.04
- steps:
- - uses: actions/checkout@v6
- - uses: ./.github/actions/install-nix-action
+ - uses: actions/checkout@v4
with:
- dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
- extra_nix_config: experimental-features = nix-command flakes
- github_token: ${{ secrets.GITHUB_TOKEN }}
- - run: ./ci/gha/tests/pre-commit-checks
+ fetch-depth: 0
+ - uses: DeterminateSystems/determinate-nix-action@main
+ - run: nix flake show --all-systems --json
- basic-checks:
- name: aggregate basic checks
- if: ${{ always() }}
- runs-on: ubuntu-24.04
- needs: [pre-commit-checks, eval]
- steps:
- - name: Exit with any errors
- if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
- run: |
- exit 1
+ build_x86_64-linux:
+ uses: ./.github/workflows/build.yml
+ with:
+ system: x86_64-linux
+ runner: namespace-profile-linuxamd32c64g-cache
+ runner_for_virt: UbuntuLatest32Cores128G
+ runner_small: ubuntu-latest
+ run_tests: true
+ run_vm_tests: true
+ run_regression_tests: true
+ publish_manual: true
+ secrets:
+ manual_netlify_auth_token: ${{ secrets.NETLIFY_AUTH_TOKEN }}
+ manual_netlify_site_id: ${{ secrets.NETLIFY_SITE_ID }}
- tests:
- needs: basic-checks
- strategy:
- fail-fast: false
- matrix:
- include:
- - scenario: on ubuntu
- runs-on: ubuntu-24.04
- os: linux
- instrumented: false
- primary: true
- stdenv: stdenv
- - scenario: on macos
- runs-on: macos-14
- os: darwin
- instrumented: false
- primary: true
- stdenv: stdenv
- - scenario: on ubuntu (with sanitizers / coverage)
- runs-on: ubuntu-24.04
- os: linux
- instrumented: true
- primary: false
- stdenv: clangStdenv
- name: tests ${{ matrix.scenario }}
- runs-on: ${{ matrix.runs-on }}
- timeout-minutes: 60
- steps:
- - uses: actions/checkout@v6
- with:
- fetch-depth: 0
- - uses: ./.github/actions/install-nix-action
- with:
- github_token: ${{ secrets.GITHUB_TOKEN }}
- dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
- # The sandbox would otherwise be disabled by default on Darwin
- extra_nix_config: "sandbox = true"
- # Since ubuntu 22.30, unprivileged usernamespaces are no longer allowed to map to the root user:
- # https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces
- - run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
- if: matrix.os == 'linux'
- - name: Run component tests
- run: |
- nix build --file ci/gha/tests/wrapper.nix componentTests -L \
- --arg withInstrumentation ${{ matrix.instrumented }} \
- --argstr stdenv "${{ matrix.stdenv }}"
- - name: Run VM tests
- run: |
- nix build --file ci/gha/tests/wrapper.nix vmTests -L \
- --arg withInstrumentation ${{ matrix.instrumented }} \
- --argstr stdenv "${{ matrix.stdenv }}"
- if: ${{ matrix.os == 'linux' }}
- - name: Run flake checks and prepare the installer tarball
- run: |
- ci/gha/tests/build-checks
- ci/gha/tests/prepare-installer-for-github-actions
- if: ${{ matrix.primary }}
- - name: Collect code coverage
- run: |
- nix build --file ci/gha/tests/wrapper.nix codeCoverage.coverageReports -L \
- --arg withInstrumentation ${{ matrix.instrumented }} \
- --argstr stdenv "${{ matrix.stdenv }}" \
- --out-link coverage-reports
- cat coverage-reports/index.txt >> $GITHUB_STEP_SUMMARY
- if: ${{ matrix.instrumented }}
- - name: Upload coverage reports
- uses: actions/upload-artifact@v5
- with:
- name: coverage-reports
- path: coverage-reports/
- if: ${{ matrix.instrumented }}
- - name: Upload installer tarball
- uses: actions/upload-artifact@v5
- with:
- name: installer-${{matrix.os}}
- path: out/*
- if: ${{ matrix.primary }}
+ build_aarch64-linux:
+ uses: ./.github/workflows/build.yml
+ with:
+ if: ${{
+ github.event_name != 'pull_request'
+ || (
+ github.event.pull_request.head.repo.full_name == 'DeterminateSystems/nix-src'
+ && (
+ (github.event.action == 'labeled' && github.event.label.name == 'upload to s3')
+ || (github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'upload to s3'))
+ )
+ )
+ }}
+ system: aarch64-linux
+ runner: UbuntuLatest32Cores128GArm
+ runner_for_virt: UbuntuLatest32Cores128GArm
+ runner_small: UbuntuLatest32Cores128GArm
- installer_test:
- needs: [tests]
- strategy:
- fail-fast: false
- matrix:
- include:
- - scenario: on ubuntu
- runs-on: ubuntu-24.04
- os: linux
- experimental-installer: false
- - scenario: on macos
- runs-on: macos-14
- os: darwin
- experimental-installer: false
- - scenario: on ubuntu (experimental)
- runs-on: ubuntu-24.04
- os: linux
- experimental-installer: true
- - scenario: on macos (experimental)
- runs-on: macos-14
- os: darwin
- experimental-installer: true
- name: installer test ${{ matrix.scenario }}
- runs-on: ${{ matrix.runs-on }}
- steps:
- - uses: actions/checkout@v6
- - name: Download installer tarball
- uses: actions/download-artifact@v6
- with:
- name: installer-${{matrix.os}}
- path: out
- - name: Looking up the installer tarball URL
- id: installer-tarball-url
- run: |
- echo "installer-url=file://$GITHUB_WORKSPACE/out" >> "$GITHUB_OUTPUT"
- TARBALL_PATH="$(find "$GITHUB_WORKSPACE/out" -name 'nix*.tar.xz' -print | head -n 1)"
- echo "tarball-path=file://$TARBALL_PATH" >> "$GITHUB_OUTPUT"
- - uses: cachix/install-nix-action@0b0e072294b088b73964f1d72dfdac0951439dbd # v31.8.4
- if: ${{ !matrix.experimental-installer }}
- with:
- install_url: ${{ format('{0}/install', steps.installer-tarball-url.outputs.installer-url) }}
- install_options: ${{ format('--tarball-url-prefix {0}', steps.installer-tarball-url.outputs.installer-url) }}
- - uses: ./.github/actions/install-nix-action
- if: ${{ matrix.experimental-installer }}
- with:
- dogfood: false
- experimental-installer: true
- tarball_url: ${{ steps.installer-tarball-url.outputs.tarball-path }}
- github_token: ${{ secrets.GITHUB_TOKEN }}
- - run: sudo apt install fish zsh
- if: matrix.os == 'linux'
- - run: brew install fish
- if: matrix.os == 'darwin'
- - run: exec bash -c "nix-instantiate -E 'builtins.currentTime' --eval"
- - run: exec sh -c "nix-instantiate -E 'builtins.currentTime' --eval"
- - run: exec zsh -c "nix-instantiate -E 'builtins.currentTime' --eval"
- - run: exec fish -c "nix-instantiate -E 'builtins.currentTime' --eval"
- - run: exec bash -c "nix-channel --add https://releases.nixos.org/nixos/unstable/nixos-23.05pre466020.60c1d71f2ba nixpkgs"
- - run: exec bash -c "nix-channel --update && nix-env -iA nixpkgs.hello && hello"
+ build_aarch64-darwin:
+ uses: ./.github/workflows/build.yml
+ with:
+ system: aarch64-darwin
+ runner: namespace-profile-mac-m2-12c28g
+ runner_for_virt: namespace-profile-mac-m2-12c28g
+ runner_small: macos-latest-xlarge
- # Steps to test CI automation in your own fork.
- # 1. Sign-up for https://hub.docker.com/
- # 2. Store your dockerhub username as DOCKERHUB_USERNAME in "Repository secrets" of your fork repository settings (https://github.com/$githubuser/nix/settings/secrets/actions)
- # 3. Create an access token in https://hub.docker.com/settings/security and store it as DOCKERHUB_TOKEN in "Repository secrets" of your fork
- check_secrets:
- permissions:
- contents: none
- name: Check presence of secrets
- runs-on: ubuntu-24.04
- outputs:
- docker: ${{ steps.secret.outputs.docker }}
+ success:
+ runs-on: ubuntu-latest
+ needs:
+ - eval
+ - build_x86_64-linux
+ - build_aarch64-linux
+ - build_aarch64-darwin
+ if: ${{ always() }}
steps:
- - name: Check for DockerHub secrets
- id: secret
+ - run: "true"
+ - run: |
+ echo "A dependent in the build matrix failed:"
+ echo "$needs"
+ exit 1
env:
- _DOCKER_SECRETS: ${{ secrets.DOCKERHUB_USERNAME }}${{ secrets.DOCKERHUB_TOKEN }}
- run: |
- echo "docker=${{ env._DOCKER_SECRETS != '' }}" >> $GITHUB_OUTPUT
+ needs: ${{ toJSON(needs) }}
+ if: |
+ contains(needs.*.result, 'failure') ||
+ contains(needs.*.result, 'cancelled')
- docker_push_image:
- needs: [tests, check_secrets]
- permissions:
- contents: read
- packages: write
- if: >-
- needs.check_secrets.outputs.docker == 'true' &&
- github.event_name == 'push' &&
- github.ref_name == 'master'
- runs-on: ubuntu-24.04
- steps:
- - uses: actions/checkout@v6
- with:
- fetch-depth: 0
- - uses: ./.github/actions/install-nix-action
- with:
- dogfood: false
- extra_nix_config: |
- experimental-features = flakes nix-command
- - run: echo NIX_VERSION="$(nix eval .\#nix.version | tr -d \")" >> $GITHUB_ENV
- - run: nix build .#dockerImage -L
- - run: docker load -i ./result/image.tar.gz
- - run: docker tag nix:$NIX_VERSION ${{ secrets.DOCKERHUB_USERNAME }}/nix:$NIX_VERSION
- - run: docker tag nix:$NIX_VERSION ${{ secrets.DOCKERHUB_USERNAME }}/nix:master
- # We'll deploy the newly built image to both Docker Hub and Github Container Registry.
- #
- # Push to Docker Hub first
- - name: Login to Docker Hub
- uses: docker/login-action@v3
- with:
- username: ${{ secrets.DOCKERHUB_USERNAME }}
- password: ${{ secrets.DOCKERHUB_TOKEN }}
- - run: docker push ${{ secrets.DOCKERHUB_USERNAME }}/nix:$NIX_VERSION
- - run: docker push ${{ secrets.DOCKERHUB_USERNAME }}/nix:master
- # Push to GitHub Container Registry as well
- - name: Login to GitHub Container Registry
- uses: docker/login-action@v3
- with:
- registry: ghcr.io
- username: ${{ github.actor }}
- password: ${{ secrets.GITHUB_TOKEN }}
- - name: Push image
- run: |
- IMAGE_ID=ghcr.io/${{ github.repository_owner }}/nix
- # Change all uppercase to lowercase
- IMAGE_ID=$(echo $IMAGE_ID | tr '[A-Z]' '[a-z]')
+ - uses: actions/checkout@v4
+ - uses: DeterminateSystems/determinate-nix-action@main
- docker tag nix:$NIX_VERSION $IMAGE_ID:$NIX_VERSION
- docker tag nix:$NIX_VERSION $IMAGE_ID:latest
- docker push $IMAGE_ID:$NIX_VERSION
- docker push $IMAGE_ID:latest
- # deprecated 2024-02-24
- docker tag nix:$NIX_VERSION $IMAGE_ID:master
- docker push $IMAGE_ID:master
+ - name: Create artifacts directory
+ run: mkdir -p ./artifacts
- flake_regressions:
- needs: tests
- runs-on: ubuntu-24.04
- steps:
- - name: Checkout nix
- uses: actions/checkout@v6
- - name: Checkout flake-regressions
- uses: actions/checkout@v6
+ - name: Fetch artifacts
+ uses: actions/download-artifact@v4
with:
- repository: NixOS/flake-regressions
- path: flake-regressions
- - name: Checkout flake-regressions-data
- uses: actions/checkout@v6
- with:
- repository: NixOS/flake-regressions-data
- path: flake-regressions/tests
- - uses: ./.github/actions/install-nix-action
+ path: downloaded
+ - name: Move downloaded artifacts to artifacts directory
+ run: |
+ for dir in ./downloaded/*; do
+ arch="$(basename "$dir")"
+ mv "$dir"/*.xz ./artifacts/"${arch}"
+ done
+
+ - name: Build fallback-paths.nix
+ if: ${{
+ github.event_name != 'pull_request'
+ || (
+ github.event.pull_request.head.repo.full_name == 'DeterminateSystems/nix-src'
+ && (
+ (github.event.action == 'labeled' && github.event.label.name == 'upload to s3')
+ || (github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'upload to s3'))
+ )
+ )
+ }}
+ run: |
+ nix build .#fallbackPathsNix --out-link fallback
+ cat fallback > ./artifacts/fallback-paths.nix
+
+ - uses: DeterminateSystems/push-artifact-ids@main
with:
- dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
- extra_nix_config:
- experimental-features = nix-command flakes
- github_token: ${{ secrets.GITHUB_TOKEN }}
- - run: nix build -L --out-link ./new-nix && PATH=$(pwd)/new-nix/bin:$PATH MAX_FLAKES=25 flake-regressions/eval-all.sh
+ s3_upload_role: ${{ secrets.AWS_S3_UPLOAD_ROLE_ARN }}
+ bucket: ${{ secrets.AWS_S3_UPLOAD_BUCKET_NAME }}
+ directory: ./artifacts
+ ids_project_name: determinate-nix
+ ids_binary_prefix: determinate-nix
+ skip_acl: true
+ allowed_branches: '["main"]'
- profile_build:
- needs: tests
- runs-on: ubuntu-24.04
- timeout-minutes: 60
- if: >-
- github.event_name == 'push' &&
- github.ref_name == 'master'
+ publish:
+ needs:
+ - success
+ if: (!github.repository.fork && (github.ref == format('refs/heads/{0}', github.event.repository.default_branch) || startsWith(github.ref, 'refs/tags/')))
+ environment: ${{ github.event_name == 'release' && 'production' || '' }}
+ runs-on: ubuntu-latest
+ permissions:
+ contents: write
+ id-token: write
steps:
- - uses: actions/checkout@v6
- with:
- fetch-depth: 0
- - uses: ./.github/actions/install-nix-action
- with:
- github_token: ${{ secrets.GITHUB_TOKEN }}
- dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
- extra_nix_config: |
- experimental-features = flakes nix-command ca-derivations impure-derivations
- max-jobs = 1
- - run: |
- nix build -L --file ./ci/gha/profile-build buildTimeReport --out-link build-time-report.md
- cat build-time-report.md >> $GITHUB_STEP_SUMMARY
+ - uses: actions/checkout@v4
+ - uses: DeterminateSystems/determinate-nix-action@main
+ - uses: DeterminateSystems/flakehub-push@main
+ with:
+ rolling: ${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
+ visibility: "public"
+ tag: "${{ github.ref_name }}"
+ - name: Update the release notes
+ if: startsWith(github.ref, 'refs/tags/')
+ env:
+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ TAG_NAME: ${{ github.ref_name }}
+ run: |
+ gh release edit "$TAG_NAME" --notes-file doc/manual/source/release-notes-determinate/"$TAG_NAME".md || true
diff --git a/.github/workflows/propose-release.yml b/.github/workflows/propose-release.yml
new file mode 100644
index 00000000000..ea01e4b7afe
--- /dev/null
+++ b/.github/workflows/propose-release.yml
@@ -0,0 +1,32 @@
+on:
+ workflow_dispatch:
+ inputs:
+ reference-id:
+ type: string
+ required: true
+ version:
+ type: string
+ required: true
+
+concurrency:
+ group: ${{ github.workflow }}
+ cancel-in-progress: true
+
+jobs:
+ propose-release:
+ uses: DeterminateSystems/propose-release/.github/workflows/workflow.yml@main
+ permissions:
+ id-token: write
+ contents: write
+ pull-requests: write
+ with:
+ update-flake: false
+ reference-id: ${{ inputs.reference-id }}
+ version: ${{ inputs.version }}
+ extra-commands-early: |
+ echo ${{ inputs.version }} > .version-determinate
+ git add .version-determinate
+ git commit -m "Set .version-determinate to ${{ inputs.version }}" || true
+ ./.github/release-notes.sh
+ git add doc
+ git commit -m "Generate release notes for ${{ inputs.version }}" || true
diff --git a/.version b/.version
index 3afbaeb2b33..ba13d3caf21 100644
--- a/.version
+++ b/.version
@@ -1 +1 @@
-2.33.0
+2.33.1
diff --git a/.version-determinate b/.version-determinate
new file mode 100644
index 00000000000..c3df54c9b83
--- /dev/null
+++ b/.version-determinate
@@ -0,0 +1 @@
+3.15.1
diff --git a/README.md b/README.md
index 02498944cdb..c5cbcbed21b 100644
--- a/README.md
+++ b/README.md
@@ -1,38 +1,111 @@
-# Nix
+
+
+
+
+
+
+
+
+
+
-[](https://opencollective.com/nixos)
-[](https://github.com/NixOS/nix/actions/workflows/ci.yml)
+# The Determinate Nix CLI
-Nix is a powerful package manager for Linux and other Unix systems that makes package
-management reliable and reproducible. Please refer to the [Nix manual](https://nix.dev/reference/nix-manual)
-for more details.
+[](https://github.com/DeterminateSystems/nix-src/actions/workflows/ci.yml)
-## Installation and first steps
+**Nix** is a powerful [language], [package manager][package-management], and [build tool][cli] for [macOS](#macos), [Linux](#linux), and other Unix systems.
+It enables you to create fully reproducible [development environments][envs], to build [packages] in sandboxed environments, to build entire Linux systems using [NixOS], and much more.
-Visit [nix.dev](https://nix.dev) for [installation instructions](https://nix.dev/tutorials/install-nix) and [beginner tutorials](https://nix.dev/tutorials/first-steps).
+[**Determinate Nix**][det-nix] is a downstream distribution of [Nix][upstream] created and maintained by [Determinate Systems][detsys].
+It has two components:
-Full reference documentation can be found in the [Nix manual](https://nix.dev/reference/nix-manual).
+- The Determinate Nix CLI, a distribution of the Nix CLI built from this repository.
+ It's based on the [upstream Nix CLI][upstream] and continuously rebased against it, but adds a wide variety of [features] and [improvements][changelog].
+- [Determinate Nixd][dnixd] is a useful daemon for Linux and macOS that handles vital tasks like configuration and enterprise certificate management.
-## Building and developing
+Determinate Nix is built on SOC-2-Type-II-compliant infrastructure using [Determinate Secure Packages][secure-packages], released via a carefully orchestrated process, and, for Determinate Systems customers, backed by formal security response SLAs that meet stringent compliance standards.
-Follow instructions in the Nix reference manual to [set up a development environment and build Nix from source](https://nix.dev/manual/nix/development/development/building.html).
+> [!NOTE]
+> Determinate Nix, by definition, consists of _both_ the components listed above.
+> While it's possible to use the code in this repository to run just our downstream Nix CLI, we do _not_ officially support this experience and provide none of the guarantees or SLAs that we provide for Determinate Nix proper.
-## Contributing
+Determinate Nix is part of the [Determinate platform][determinate], which also includes [FlakeHub], a secure flake repository with features like [FlakeHub Cache][cache], [private flakes][private-flakes], and [semantic versioning][semver] (SemVer) for [flakes].
+
+## Installing Determinate Nix
+
+You can install Determinate Nix on [macOS](#macos), non-NixOS [Linux](#linux) and WSL, and [NixOS](#nixos).
+
+### macOS
+
+On macOS, we recommend using the graphical installer from Determinate Systems.
+Click [here][gui] to download and run it.
+
+### Linux
+
+On Linux, including Windows Subsystem for Linux (WSL), we recommend installing Determinate Nix using [Determinate Nix Installer][installer]:
+
+```shell
+curl -fsSL https://install.determinate.systems/nix | sh -s -- install
+```
-Check the [contributing guide](./CONTRIBUTING.md) if you want to get involved with developing Nix.
+### NixOS
-## Additional resources
+On [NixOS], we recommend following our [dedicated installation guide][nixos-install].
+We also provide both [Amazon Machine Images][amis] (AMIs) and [ISOs] for using Determinate on NixOS.
-Nix was created by Eelco Dolstra and developed as the subject of his PhD thesis [The Purely Functional Software Deployment Model](https://edolstra.github.io/pubs/phd-thesis.pdf), published 2006.
-Today, a world-wide developer community contributes to Nix and the ecosystem that has grown around it.
+## Other resources
-- [The Nix, Nixpkgs, NixOS Community on nixos.org](https://nixos.org/)
-- [Official documentation on nix.dev](https://nix.dev)
-- [Nixpkgs](https://github.com/NixOS/nixpkgs) is [the largest, most up-to-date free software repository in the world](https://repology.org/repositories/graphs)
-- [NixOS](https://github.com/NixOS/nixpkgs/tree/master/nixos) is a Linux distribution that can be configured fully declaratively
-- [Discourse](https://discourse.nixos.org/)
-- Matrix: [#users:nixos.org](https://matrix.to/#/#users:nixos.org) for user support and [#nix-dev:nixos.org](https://matrix.to/#/#nix-dev:nixos.org) for development
+Nix was created by [Eelco Dolstra][eelco] and developed as the subject of his 2006 PhD thesis, [The Purely Functional Software Deployment Model][thesis].
+Today, a worldwide developer community contributes to Nix and the ecosystem that has grown around it.
+
+- [Zero to Nix][z2n], Determinate Systems' guide to Nix and [flakes] for beginners
+- [Nixpkgs], a collection of well over 100,000 software packages that you can build and manage using Nix
+- [NixOS] is a Linux distribution that can be configured fully declaratively
+- The Nix, Nixpkgs, and NixOS community on [nixos.org][website]
+
+## Reference
+
+The primary documentation for Determinate and Determinate Nix is available at [docs.determinate.systems][determinate].
+For deeply technical reference material, see the [Determinate Nix manual][manual] which is based on the upstream Nix manual.
## License
-Nix is released under the [LGPL v2.1](./COPYING).
+[Upstream Nix][upstream] is released under the [LGPL v2.1][license] license.
+[Determinate Nix][det-nix] is also released under LGPL v2.1 in accordance with the terms of the upstream license.
+
+## Contributing
+
+Check the [contributing guide][contributing] if you want to get involved with developing Nix.
+
+[amis]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html
+[cache]: https://docs.determinate.systems/flakehub/cache
+[changelog]: https://determinate.systems/blog/categories/changelog
+[cli]: https://manual.determinate.systems/command-ref/new-cli/nix.html
+[contributing]: ./CONTRIBUTING.md
+[det-nix]: https://docs.determinate.systems/determinate-nix
+[determinate]: https://docs.determinate.systems
+[detsys]: https://determinate.systems
+[dnixd]: https://docs.determinate.systems/determinate-nix#determinate-nixd
+[eelco]: https://determinate.systems/people/eelco-dolstra
+[envs]: https://zero-to-nix.com/concepts/dev-env
+[features]: https://docs.determinate.systems/determinate-nix/#special-features
+[flakehub]: https://flakehub.com
+[flakes]: https://zero-to-nix.com/concepts/flakes
+[gui]: https://install.determinate.systems/determinate-pkg/stable/Universal
+[installer]: https://github.com/DeterminateSystems/nix-installer
+[isos]: https://github.com/DeterminateSystems/nixos-iso
+[language]: https://zero-to-nix.com/concepts/nix-language
+[license]: ./COPYING
+[manual]: https://manual.determinate.systems
+[nixpkgs]: https://github.com/NixOS/nixpkgs
+[nixos]: https://github.com/NixOS/nixpkgs/tree/master/nixos
+[nixos-install]: https://docs.determinate.systems/guides/advanced-installation#nixos
+[packages]: https://zero-to-nix.com/concepts/packages
+[package-management]: https://zero-to-nix.com/concepts/package-management
+[private-flakes]: https://docs.determinate.systems/flakehub/private-flakes
+[secure-packages]: https://determinate.systems/secure-packages
+[semver]: https://docs.determinate.systems/flakehub/concepts/semver
+[thesis]: https://edolstra.github.io/pubs/phd-thesis.pdf
+[upstream]: https://github.com/NixOS/nix
+[website]: https://nixos.org
+[z2n]: https://zero-to-nix.com
diff --git a/ci/gha/tests/default.nix b/ci/gha/tests/default.nix
index 6100f2f4172..c179174e6e2 100644
--- a/ci/gha/tests/default.nix
+++ b/ci/gha/tests/default.nix
@@ -76,7 +76,6 @@ rec {
*/
topLevel = {
installerScriptForGHA = hydraJobs.installerScriptForGHA.${system};
- installTests = hydraJobs.installTests.${system};
nixpkgsLibTests = hydraJobs.tests.nixpkgsLibTests.${system};
rl-next = pkgs.buildPackages.runCommand "test-rl-next-release-notes" { } ''
LANG=C.UTF-8 ${pkgs.changelog-d}/bin/changelog-d ${../../../doc/manual/rl-next} >$out
diff --git a/default.nix b/default.nix
deleted file mode 100644
index 6466507b714..00000000000
--- a/default.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-(import (
- let
- lock = builtins.fromJSON (builtins.readFile ./flake.lock);
- in
- fetchTarball {
- url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
- sha256 = lock.nodes.flake-compat.locked.narHash;
- }
-) { src = ./.; }).defaultNix
diff --git a/doc/manual/book.toml.in b/doc/manual/book.toml.in
index c798afc4a8c..11efca75f11 100644
--- a/doc/manual/book.toml.in
+++ b/doc/manual/book.toml.in
@@ -1,12 +1,12 @@
[book]
-title = "Nix @version@ Reference Manual"
+title = "Determinate Nix @version@ Reference Manual"
src = "source"
[output.html]
additional-css = ["custom.css"]
additional-js = ["redirects.js"]
-edit-url-template = "https://github.com/NixOS/nix/tree/master/doc/manual/{path}"
-git-repository-url = "https://github.com/NixOS/nix"
+edit-url-template = "https://github.com/DeterminateSystems/nix-src/tree/master/doc/manual/{path}"
+git-repository-url = "https://github.com/DeterminateSystems/nix-src"
mathjax-support = true
# Handles replacing @docroot@ with a path to ./source relative to that markdown file,
diff --git a/doc/manual/custom.css b/doc/manual/custom.css
index 7af150be391..119c6d12543 100644
--- a/doc/manual/custom.css
+++ b/doc/manual/custom.css
@@ -1,5 +1,5 @@
:root {
- --sidebar-width: 23em;
+ --sidebar-width: 23em;
}
h1.menu-title::before {
@@ -7,11 +7,10 @@ h1.menu-title::before {
background-image: url("./favicon.svg");
padding: 1.25em;
background-position: center center;
- background-size: 2em;
+ background-size: 1.5em;
background-repeat: no-repeat;
}
-
.menu-bar {
padding: 0.5em 0em;
}
@@ -21,13 +20,13 @@ h1.menu-title::before {
}
h1:not(:first-of-type) {
- margin-top: 1.3em;
+ margin-top: 1.3em;
}
h2 {
- margin-top: 1em;
+ margin-top: 1em;
}
.hljs-meta {
- user-select: none;
+ user-select: none;
}
diff --git a/doc/manual/generate-manpage.nix b/doc/manual/generate-manpage.nix
index 31e74e17d26..292cb283d3d 100644
--- a/doc/manual/generate-manpage.nix
+++ b/doc/manual/generate-manpage.nix
@@ -42,11 +42,6 @@ let
let
result = ''
- > **Warning** \
- > This program is
- > [**experimental**](@docroot@/development/experimental-features.md#xp-feature-nix-command)
- > and its interface is subject to change.
-
# Name
`${command}` - ${details.description}
diff --git a/doc/manual/meson.build b/doc/manual/meson.build
index 3c3e7954113..1b9a325df2a 100644
--- a/doc/manual/meson.build
+++ b/doc/manual/meson.build
@@ -5,19 +5,9 @@ project(
license : 'LGPL-2.1-or-later',
)
-# Compute documentation URL based on version and release type
-version = meson.project_version()
-official_release = get_option('official-release')
+fs = import('fs')
-if official_release
- # For official releases, use versioned URL (dropping patch version)
- version_parts = version.split('.')
- major_minor = '@0@.@1@'.format(version_parts[0], version_parts[1])
- doc_url = 'https://nix.dev/manual/nix/@0@'.format(major_minor)
-else
- # For development builds, use /latest
- doc_url = 'https://nix.dev/manual/nix/latest'
-endif
+doc_url = 'https://manual.determinate.systems/'
nix = find_program('nix', native : true)
@@ -40,7 +30,7 @@ nix_env_for_docs = {
'NIX_CONFIG' : 'cores = 0',
}
-nix_for_docs = [ nix, '--experimental-features', 'nix-command' ]
+nix_for_docs = [ nix ]
nix_eval_for_docs_common = nix_for_docs + [
'eval',
'-I',
@@ -137,7 +127,7 @@ if get_option('html-manual')
python.full_path(),
mdbook.full_path(),
meson.current_build_dir(),
- meson.project_version(),
+ fs.read('../../.version-determinate').strip(),
rsync.full_path(),
),
],
diff --git a/doc/manual/package.nix b/doc/manual/package.nix
index 3a90a0faf8a..0b3d8ca940a 100644
--- a/doc/manual/package.nix
+++ b/doc/manual/package.nix
@@ -34,7 +34,7 @@ let
in
mkMesonDerivation (finalAttrs: {
- pname = "nix-manual";
+ pname = "determinate-nix-manual";
inherit version;
workDir = ./.;
@@ -42,6 +42,7 @@ mkMesonDerivation (finalAttrs: {
fileset.difference
(fileset.unions [
../../.version
+ ../../.version-determinate
# For example JSON
../../src/libutil-tests/data/memory-source-accessor
../../src/libutil-tests/data/hash
diff --git a/doc/manual/redirects.json b/doc/manual/redirects.json
index 0a6c7150800..07a6f36627f 100644
--- a/doc/manual/redirects.json
+++ b/doc/manual/redirects.json
@@ -243,29 +243,11 @@
"gloss-validity": "glossary.html#gloss-validity",
"part-glossary": "glossary.html",
"sec-building-source": "installation/building-source.html",
- "ch-env-variables": "installation/env-variables.html",
- "sec-installer-proxy-settings": "installation/env-variables.html#proxy-environment-variables",
- "sec-nix-ssl-cert-file": "installation/env-variables.html#nix_ssl_cert_file",
- "sec-nix-ssl-cert-file-with-nix-daemon-and-macos": "installation/env-variables.html#nix_ssl_cert_file",
"chap-installation": "installation/index.html",
- "ch-installing-binary": "installation/installing-binary.html",
- "sect-macos-installation": "installation/installing-binary.html#macos-installation",
- "sect-macos-installation-change-store-prefix": "installation/installing-binary.html#macos-installation",
- "sect-macos-installation-encrypted-volume": "installation/installing-binary.html#macos-installation",
- "sect-macos-installation-recommended-notes": "installation/installing-binary.html#macos-installation",
- "sect-macos-installation-symlink": "installation/installing-binary.html#macos-installation",
- "sect-multi-user-installation": "installation/installing-binary.html#multi-user-installation",
- "sect-nix-install-binary-tarball": "installation/installing-binary.html#installing-from-a-binary-tarball",
- "sect-nix-install-pinned-version-url":
- "installation/installing-binary.html#installing-a-pinned-nix-version-from-a-url",
- "sect-single-user-installation": "installation/installing-binary.html#single-user-installation",
"ch-installing-source": "installation/installing-source.html",
- "ssec-multi-user": "installation/multi-user.html",
"ch-nix-security": "installation/nix-security.html",
"sec-obtaining-source": "installation/obtaining-source.html",
"sec-prerequisites-source": "installation/prerequisites-source.html",
- "sec-single-user": "installation/single-user.html",
- "ch-supported-platforms": "installation/supported-platforms.html",
"ch-upgrading-nix": "installation/upgrading.html",
"ch-about-nix": "introduction.html",
"chap-introduction": "introduction.html",
@@ -287,43 +269,7 @@
"sec-sharing-packages": "package-management/sharing-packages.html",
"ssec-ssh-substituter": "package-management/ssh-substituter.html",
"chap-quick-start": "quick-start.html",
- "sec-relnotes": "release-notes/index.html",
- "ch-relnotes-0.10.1": "release-notes/rl-0.10.1.html",
- "ch-relnotes-0.10": "release-notes/rl-0.10.html",
- "ssec-relnotes-0.11": "release-notes/rl-0.11.html",
- "ssec-relnotes-0.12": "release-notes/rl-0.12.html",
- "ssec-relnotes-0.13": "release-notes/rl-0.13.html",
- "ssec-relnotes-0.14": "release-notes/rl-0.14.html",
- "ssec-relnotes-0.15": "release-notes/rl-0.15.html",
- "ssec-relnotes-0.16": "release-notes/rl-0.16.html",
- "ch-relnotes-0.5": "release-notes/rl-0.5.html",
- "ch-relnotes-0.6": "release-notes/rl-0.6.html",
- "ch-relnotes-0.7": "release-notes/rl-0.7.html",
- "ch-relnotes-0.8.1": "release-notes/rl-0.8.1.html",
- "ch-relnotes-0.8": "release-notes/rl-0.8.html",
- "ch-relnotes-0.9.1": "release-notes/rl-0.9.1.html",
- "ch-relnotes-0.9.2": "release-notes/rl-0.9.2.html",
- "ch-relnotes-0.9": "release-notes/rl-0.9.html",
- "ssec-relnotes-1.0": "release-notes/rl-1.0.html",
- "ssec-relnotes-1.1": "release-notes/rl-1.1.html",
- "ssec-relnotes-1.10": "release-notes/rl-1.10.html",
- "ssec-relnotes-1.11.10": "release-notes/rl-1.11.10.html",
- "ssec-relnotes-1.11": "release-notes/rl-1.11.html",
- "ssec-relnotes-1.2": "release-notes/rl-1.2.html",
- "ssec-relnotes-1.3": "release-notes/rl-1.3.html",
- "ssec-relnotes-1.4": "release-notes/rl-1.4.html",
- "ssec-relnotes-1.5.1": "release-notes/rl-1.5.html",
- "ssec-relnotes-1.5.2": "release-notes/rl-1.5.2.html",
- "ssec-relnotes-1.5": "release-notes/rl-1.5.html",
- "ssec-relnotes-1.6.1": "release-notes/rl-1.6.1.html",
- "ssec-relnotes-1.6.0": "release-notes/rl-1.6.html",
- "ssec-relnotes-1.7": "release-notes/rl-1.7.html",
- "ssec-relnotes-1.8": "release-notes/rl-1.8.html",
- "ssec-relnotes-1.9": "release-notes/rl-1.9.html",
- "ssec-relnotes-2.0": "release-notes/rl-2.0.html",
- "ssec-relnotes-2.1": "release-notes/rl-2.1.html",
- "ssec-relnotes-2.2": "release-notes/rl-2.2.html",
- "ssec-relnotes-2.3": "release-notes/rl-2.3.html"
+ "sec-relnotes": "release-notes/index.html"
},
"language/types.html": {
"simple-values": "#primitives",
@@ -340,12 +286,10 @@
"builder-execution": "../store/building.html#builder-execution"
},
"installation/installing-binary.html": {
- "linux": "uninstall.html#linux",
- "macos": "uninstall.html#macos",
"uninstalling": "uninstall.html"
},
"development/building.html": {
- "nix-with-flakes": "#building-nix-with-flakes",
+ "nix-with-flakes": "#building-nix",
"classic-nix": "#building-nix",
"running-tests": "testing.html#running-tests",
"unit-tests": "testing.html#unit-tests",
diff --git a/doc/manual/rl-next/shorter-build-dir-names.md b/doc/manual/rl-next/shorter-build-dir-names.md
new file mode 100644
index 00000000000..e87fa5d04fb
--- /dev/null
+++ b/doc/manual/rl-next/shorter-build-dir-names.md
@@ -0,0 +1,6 @@
+---
+synopsis: "Temporary build directories no longer include derivation names"
+prs: [13839]
+---
+
+Temporary build directories created during derivation builds no longer include the derivation name in their path to avoid build failures when the derivation name is too long. This change ensures predictable prefix lengths for build directories under `/nix/var/nix/builds`.
\ No newline at end of file
diff --git a/doc/manual/source/SUMMARY.md.in b/doc/manual/source/SUMMARY.md.in
index 8b6b29f6a7f..2684ec3d633 100644
--- a/doc/manual/source/SUMMARY.md.in
+++ b/doc/manual/source/SUMMARY.md.in
@@ -3,17 +3,12 @@
- [Introduction](introduction.md)
- [Quick Start](quick-start.md)
- [Installation](installation/index.md)
- - [Supported Platforms](installation/supported-platforms.md)
- - [Installing a Binary Distribution](installation/installing-binary.md)
- [Installing Nix from Source](installation/installing-source.md)
- [Prerequisites](installation/prerequisites-source.md)
- [Obtaining a Source Distribution](installation/obtaining-source.md)
- [Building Nix from Source](installation/building-source.md)
- [Using Nix within Docker](installation/installing-docker.md)
- [Security](installation/nix-security.md)
- - [Single-User Mode](installation/single-user.md)
- - [Multi-User Mode](installation/multi-user.md)
- - [Environment Variables](installation/env-variables.md)
- [Upgrading Nix](installation/upgrading.md)
- [Uninstalling Nix](installation/uninstall.md)
- [Nix Store](store/index.md)
@@ -65,8 +60,11 @@
- [Command Reference](command-ref/index.md)
- [Common Options](command-ref/opt-common.md)
- [Common Environment Variables](command-ref/env-common.md)
- - [Main Commands](command-ref/main-commands.md)
+ - [Subcommands](command-ref/subcommands.md)
+{{#include ./command-ref/new-cli/SUMMARY.md}}
+ - [Deprecated Commands](command-ref/main-commands.md)
- [nix-build](command-ref/nix-build.md)
+ - [nix-channel](command-ref/nix-channel.md)
- [nix-shell](command-ref/nix-shell.md)
- [nix-store](command-ref/nix-store.md)
- [nix-store --add-fixed](command-ref/nix-store/add-fixed.md)
@@ -102,22 +100,17 @@
- [nix-env --uninstall](command-ref/nix-env/uninstall.md)
- [nix-env --upgrade](command-ref/nix-env/upgrade.md)
- [Utilities](command-ref/utilities.md)
- - [nix-channel](command-ref/nix-channel.md)
- [nix-collect-garbage](command-ref/nix-collect-garbage.md)
- [nix-copy-closure](command-ref/nix-copy-closure.md)
- [nix-daemon](command-ref/nix-daemon.md)
- [nix-hash](command-ref/nix-hash.md)
- [nix-instantiate](command-ref/nix-instantiate.md)
- [nix-prefetch-url](command-ref/nix-prefetch-url.md)
- - [Experimental Commands](command-ref/experimental-commands.md)
-{{#include ./command-ref/new-cli/SUMMARY.md}}
- [Files](command-ref/files.md)
- [nix.conf](command-ref/conf-file.md)
- [Profiles](command-ref/files/profiles.md)
- [manifest.nix](command-ref/files/manifest.nix.md)
- [manifest.json](command-ref/files/manifest.json.md)
- - [Channels](command-ref/files/channels.md)
- - [Default Nix expression](command-ref/files/default-nix-expression.md)
- [Architecture and Design](architecture/architecture.md)
- [Formats and Protocols](protocols/index.md)
- [JSON Formats](protocols/json/index.md)
@@ -149,7 +142,49 @@
- [C++ style guide](development/cxx.md)
- [Experimental Features](development/experimental-features.md)
- [Contributing](development/contributing.md)
-- [Releases](release-notes/index.md)
+- [Determinate Nix Release Notes](release-notes-determinate/index.md)
+ - [Changes between Nix and Determinate Nix](release-notes-determinate/changes.md)
+ - [Release 3.15.1 (2025-12-24)](release-notes-determinate/v3.15.1.md)
+ - [Release 3.15.0 (2025-12-19)](release-notes-determinate/v3.15.0.md)
+ - [Release 3.14.0 (2025-12-08)](release-notes-determinate/v3.14.0.md)
+ - [Release 3.13.2 (2025-11-19)](release-notes-determinate/v3.13.2.md)
+ - [Release 3.13.1 (2025-11-12)](release-notes-determinate/v3.13.1.md)
+ - [Release 3.13.0 (2025-11-09)](release-notes-determinate/v3.13.0.md)
+ - [Release 3.12.2 (2025-11-05)](release-notes-determinate/v3.12.2.md)
+ - [Release 3.12.1 (2025-11-04)](release-notes-determinate/v3.12.1.md)
+ - [Release 3.12.0 (2025-10-23)](release-notes-determinate/v3.12.0.md)
+ - [Release 3.11.3 (2025-10-09)](release-notes-determinate/v3.11.3.md)
+ - [Release 3.11.2 (2025-09-12)](release-notes-determinate/v3.11.2.md)
+ - [Release 3.11.1 (2025-09-04)](release-notes-determinate/v3.11.1.md)
+ - [Release 3.11.0 (2025-09-03)](release-notes-determinate/v3.11.0.md)
+ - [Release 3.10.1 (2025-09-02)](release-notes-determinate/v3.10.1.md)
+ - [Release 3.10.0 (2025-09-02)](release-notes-determinate/v3.10.0.md)
+ - [Release 3.9.1 (2025-08-28)](release-notes-determinate/v3.9.1.md)
+ - [Release 3.9.0 (2025-08-26)](release-notes-determinate/v3.9.0.md)
+ - [Release 3.8.6 (2025-08-19)](release-notes-determinate/v3.8.6.md)
+ - [Release 3.8.5 (2025-08-04)](release-notes-determinate/rl-3.8.5.md)
+ - [Release 3.8.4 (2025-07-21)](release-notes-determinate/rl-3.8.4.md)
+ - [Release 3.8.3 (2025-07-18)](release-notes-determinate/rl-3.8.3.md)
+ - [Release 3.8.2 (2025-07-12)](release-notes-determinate/rl-3.8.2.md)
+ - [Release 3.8.1 (2025-07-11)](release-notes-determinate/rl-3.8.1.md)
+ - [Release 3.8.0 (2025-07-10)](release-notes-determinate/rl-3.8.0.md)
+ - [Release 3.7.0 (2025-07-03)](release-notes-determinate/rl-3.7.0.md)
+ - [Release 3.6.8 (2025-06-25)](release-notes-determinate/rl-3.6.8.md)
+ - [Release 3.6.7 (2025-06-24)](release-notes-determinate/rl-3.6.7.md)
+ - [Release 3.6.6 (2025-06-17)](release-notes-determinate/rl-3.6.6.md)
+ - [Release 3.6.5 (2025-06-16)](release-notes-determinate/rl-3.6.5.md)
+ - [Release 3.6.2 (2025-06-02)](release-notes-determinate/rl-3.6.2.md)
+ - [Release 3.6.1 (2025-05-24)](release-notes-determinate/rl-3.6.1.md)
+ - [Release 3.6.0 (2025-05-22)](release-notes-determinate/rl-3.6.0.md)
+ - [Release 3.5.2 (2025-05-12)](release-notes-determinate/rl-3.5.2.md)
+ - [Release 3.5.1 (2025-05-09)](release-notes-determinate/rl-3.5.1.md)
+ - [~~Release 3.5.0 (2025-05-09)~~](release-notes-determinate/rl-3.5.0.md)
+ - [Release 3.4.2 (2025-05-05)](release-notes-determinate/rl-3.4.2.md)
+ - [Release 3.4.0 (2025-04-25)](release-notes-determinate/rl-3.4.0.md)
+ - [Release 3.3.0 (2025-04-11)](release-notes-determinate/rl-3.3.0.md)
+ - [Release 3.1.0 (2025-03-27)](release-notes-determinate/rl-3.1.0.md)
+ - [Release 3.0.0 (2025-03-04)](release-notes-determinate/rl-3.0.0.md)
+- [Nix Release Notes](release-notes/index.md)
{{#include ./SUMMARY-rl-next.md}}
- [Release 2.33 (2025-12-09)](release-notes/rl-2.33.md)
- [Release 2.32 (2025-10-06)](release-notes/rl-2.32.md)
@@ -159,60 +194,3 @@
- [Release 2.28 (2025-04-02)](release-notes/rl-2.28.md)
- [Release 2.27 (2025-03-03)](release-notes/rl-2.27.md)
- [Release 2.26 (2025-01-22)](release-notes/rl-2.26.md)
- - [Release 2.25 (2024-11-07)](release-notes/rl-2.25.md)
- - [Release 2.24 (2024-07-31)](release-notes/rl-2.24.md)
- - [Release 2.23 (2024-06-03)](release-notes/rl-2.23.md)
- - [Release 2.22 (2024-04-23)](release-notes/rl-2.22.md)
- - [Release 2.21 (2024-03-11)](release-notes/rl-2.21.md)
- - [Release 2.20 (2024-01-29)](release-notes/rl-2.20.md)
- - [Release 2.19 (2023-11-17)](release-notes/rl-2.19.md)
- - [Release 2.18 (2023-09-20)](release-notes/rl-2.18.md)
- - [Release 2.17 (2023-07-24)](release-notes/rl-2.17.md)
- - [Release 2.16 (2023-05-31)](release-notes/rl-2.16.md)
- - [Release 2.15 (2023-04-11)](release-notes/rl-2.15.md)
- - [Release 2.14 (2023-02-28)](release-notes/rl-2.14.md)
- - [Release 2.13 (2023-01-17)](release-notes/rl-2.13.md)
- - [Release 2.12 (2022-12-06)](release-notes/rl-2.12.md)
- - [Release 2.11 (2022-08-25)](release-notes/rl-2.11.md)
- - [Release 2.10 (2022-07-11)](release-notes/rl-2.10.md)
- - [Release 2.9 (2022-05-30)](release-notes/rl-2.9.md)
- - [Release 2.8 (2022-04-19)](release-notes/rl-2.8.md)
- - [Release 2.7 (2022-03-07)](release-notes/rl-2.7.md)
- - [Release 2.6 (2022-01-24)](release-notes/rl-2.6.md)
- - [Release 2.5 (2021-12-13)](release-notes/rl-2.5.md)
- - [Release 2.4 (2021-11-01)](release-notes/rl-2.4.md)
- - [Release 2.3 (2019-09-04)](release-notes/rl-2.3.md)
- - [Release 2.2 (2019-01-11)](release-notes/rl-2.2.md)
- - [Release 2.1 (2018-09-02)](release-notes/rl-2.1.md)
- - [Release 2.0 (2018-02-22)](release-notes/rl-2.0.md)
- - [Release 1.11.10 (2017-06-12)](release-notes/rl-1.11.10.md)
- - [Release 1.11 (2016-01-19)](release-notes/rl-1.11.md)
- - [Release 1.10 (2015-09-03)](release-notes/rl-1.10.md)
- - [Release 1.9 (2015-06-12)](release-notes/rl-1.9.md)
- - [Release 1.8 (2014-12-14)](release-notes/rl-1.8.md)
- - [Release 1.7 (2014-04-11)](release-notes/rl-1.7.md)
- - [Release 1.6.1 (2013-10-28)](release-notes/rl-1.6.1.md)
- - [Release 1.6 (2013-09-10)](release-notes/rl-1.6.md)
- - [Release 1.5.2 (2013-05-13)](release-notes/rl-1.5.2.md)
- - [Release 1.5 (2013-02-27)](release-notes/rl-1.5.md)
- - [Release 1.4 (2013-02-26)](release-notes/rl-1.4.md)
- - [Release 1.3 (2013-01-04)](release-notes/rl-1.3.md)
- - [Release 1.2 (2012-12-06)](release-notes/rl-1.2.md)
- - [Release 1.1 (2012-07-18)](release-notes/rl-1.1.md)
- - [Release 1.0 (2012-05-11)](release-notes/rl-1.0.md)
- - [Release 0.16 (2010-08-17)](release-notes/rl-0.16.md)
- - [Release 0.15 (2010-03-17)](release-notes/rl-0.15.md)
- - [Release 0.14 (2010-02-04)](release-notes/rl-0.14.md)
- - [Release 0.13 (2009-11-05)](release-notes/rl-0.13.md)
- - [Release 0.12 (2008-11-20)](release-notes/rl-0.12.md)
- - [Release 0.11 (2007-12-31)](release-notes/rl-0.11.md)
- - [Release 0.10.1 (2006-10-11)](release-notes/rl-0.10.1.md)
- - [Release 0.10 (2006-10-06)](release-notes/rl-0.10.md)
- - [Release 0.9.2 (2005-09-21)](release-notes/rl-0.9.2.md)
- - [Release 0.9.1 (2005-09-20)](release-notes/rl-0.9.1.md)
- - [Release 0.9 (2005-09-16)](release-notes/rl-0.9.md)
- - [Release 0.8.1 (2005-04-13)](release-notes/rl-0.8.1.md)
- - [Release 0.8 (2005-04-11)](release-notes/rl-0.8.md)
- - [Release 0.7 (2005-01-12)](release-notes/rl-0.7.md)
- - [Release 0.6 (2004-11-14)](release-notes/rl-0.6.md)
- - [Release 0.5 and earlier](release-notes/rl-0.5.md)
diff --git a/doc/manual/source/advanced-topics/distributed-builds.md b/doc/manual/source/advanced-topics/distributed-builds.md
index 08a980643e8..c39cf450079 100644
--- a/doc/manual/source/advanced-topics/distributed-builds.md
+++ b/doc/manual/source/advanced-topics/distributed-builds.md
@@ -5,8 +5,8 @@ this allows multiple builds to be performed in parallel.
Remote builds also allow Nix to perform multi-platform builds in a
semi-transparent way. For example, if you perform a build for a
-`x86_64-darwin` on an `i686-linux` machine, Nix can automatically
-forward the build to a `x86_64-darwin` machine, if one is available.
+`aarch64-darwin` on an `x86_64-linux` machine, Nix can automatically
+forward the build to a `aarch64-darwin` machine, if one is available.
## Requirements
@@ -59,7 +59,7 @@ then you need to ensure that the `PATH` of non-interactive login shells
contains Nix.
The [list of remote build machines](@docroot@/command-ref/conf-file.md#conf-builders) can be specified on the command line or in the Nix configuration file.
-For example, the following command allows you to build a derivation for `x86_64-darwin` on a Linux machine:
+For example, the following command allows you to build a derivation for `aarch64-darwin` on a Linux machine:
```console
uname
@@ -71,8 +71,8 @@ Linux
```console
nix build --impure \
- --expr '(with import { system = "x86_64-darwin"; }; runCommand "foo" {} "uname > $out")' \
- --builders 'ssh://mac x86_64-darwin'
+ --expr '(with import { system = "aarch64-darwin"; }; runCommand "foo" {} "uname > $out")' \
+ --builders 'ssh://mac aarch64-darwin'
```
```console
@@ -90,12 +90,12 @@ Darwin
It is possible to specify multiple build machines separated by a semicolon or a newline, e.g.
```console
- --builders 'ssh://mac x86_64-darwin ; ssh://beastie x86_64-freebsd'
+ --builders 'ssh://mac aarch64-darwin ; ssh://beastie x86_64-freebsd'
```
Remote build machines can also be configured in [`nix.conf`](@docroot@/command-ref/conf-file.md), e.g.
- builders = ssh://mac x86_64-darwin ; ssh://beastie x86_64-freebsd
+ builders = ssh://mac aarch64-darwin ; ssh://beastie x86_64-freebsd
After making changes to `nix.conf`, restart the Nix daemon for changes to take effect.
@@ -107,4 +107,4 @@ file included in `builders` via the syntax `@/path/to/file`. For example,
causes the list of machines in `/etc/nix/machines` to be included.
(This is the default.)
-[Nix instance]: @docroot@/glossary.md#gloss-nix-instance
\ No newline at end of file
+[Nix instance]: @docroot@/glossary.md#gloss-nix-instance
diff --git a/doc/manual/source/advanced-topics/eval-profiler.md b/doc/manual/source/advanced-topics/eval-profiler.md
index ed3848bb2db..2bc7ebb05e0 100644
--- a/doc/manual/source/advanced-topics/eval-profiler.md
+++ b/doc/manual/source/advanced-topics/eval-profiler.md
@@ -27,7 +27,7 @@ site](https://en.wikipedia.org/wiki/Call_site) position and the name of the
function being called (when available). For example:
```
-/nix/store/x9wnkly3k1gkq580m90jjn32q9f05q2v-source/pkgs/top-level/default.nix:167:5:primop import
+/nix/store/2q71fdvr4h33g9832hiriwnf20fn630l-source/pkgs/top-level/default.nix:167:5:primop import
```
-Here `import` primop is called at `/nix/store/x9wnkly3k1gkq580m90jjn32q9f05q2v-source/pkgs/top-level/default.nix:167:5`.
+Here `import` primop is called at `/nix/store/2q71fdvr4h33g9832hiriwnf20fn630l-source/pkgs/top-level/default.nix:167:5`.
diff --git a/doc/manual/source/command-ref/env-common.md b/doc/manual/source/command-ref/env-common.md
index e0fd2b00eec..fe6e822ff16 100644
--- a/doc/manual/source/command-ref/env-common.md
+++ b/doc/manual/source/command-ref/env-common.md
@@ -102,7 +102,7 @@ Most Nix commands interpret the following environment variables:
This variable should be set to `daemon` if you want to use the Nix
daemon to execute Nix operations. This is necessary in [multi-user
- Nix installations](@docroot@/installation/multi-user.md). If the Nix
+ Nix installations](@docroot@/installation/nix-security.md#multi-user-model). If the Nix
daemon's Unix socket is at some non-standard path, this variable
should be set to `unix://path/to/socket`. Otherwise, it should be
left unset.
diff --git a/doc/manual/source/command-ref/experimental-commands.md b/doc/manual/source/command-ref/experimental-commands.md
deleted file mode 100644
index 1190729a230..00000000000
--- a/doc/manual/source/command-ref/experimental-commands.md
+++ /dev/null
@@ -1,8 +0,0 @@
-# Experimental Commands
-
-This section lists [experimental commands](@docroot@/development/experimental-features.md#xp-feature-nix-command).
-
-> **Warning**
->
-> These commands may be removed in the future, or their syntax may
-> change in incompatible ways.
diff --git a/doc/manual/source/command-ref/files/default-nix-expression.md b/doc/manual/source/command-ref/files/default-nix-expression.md
index 2bd45ff5deb..e886e3ff499 100644
--- a/doc/manual/source/command-ref/files/default-nix-expression.md
+++ b/doc/manual/source/command-ref/files/default-nix-expression.md
@@ -31,12 +31,12 @@ Then, the resulting expression is interpreted like this:
The file [`manifest.nix`](@docroot@/command-ref/files/manifest.nix.md) is always ignored.
-The command [`nix-channel`] places a symlink to the current user's [channels] in this directory, the [user channel link](#user-channel-link).
+The command [`nix-channel`] places a symlink to the current user's channels in this directory, the [user channel link](#user-channel-link).
This makes all subscribed channels available as attributes in the default expression.
## User channel link
-A symlink that ensures that [`nix-env`] can find the current user's [channels]:
+A symlink that ensures that [`nix-env`] can find the current user's channels:
- `~/.nix-defexpr/channels`
- `$XDG_STATE_HOME/defexpr/channels` if [`use-xdg-base-directories`] is set to `true`.
@@ -51,4 +51,3 @@ In a multi-user installation, you may also have `~/.nix-defexpr/channels_root`,
[`nix-channel`]: @docroot@/command-ref/nix-channel.md
[`nix-env`]: @docroot@/command-ref/nix-env.md
[`use-xdg-base-directories`]: @docroot@/command-ref/conf-file.md#conf-use-xdg-base-directories
-[channels]: @docroot@/command-ref/files/channels.md
diff --git a/doc/manual/source/command-ref/files/manifest.nix.md b/doc/manual/source/command-ref/files/manifest.nix.md
index d7d1b605b54..78bfdc346ea 100644
--- a/doc/manual/source/command-ref/files/manifest.nix.md
+++ b/doc/manual/source/command-ref/files/manifest.nix.md
@@ -114,9 +114,9 @@ Here is an example of how this file might look like after installing `hello` fro
};
name = "hello-2.12.1";
out = {
- outPath = "/nix/store/260q5867crm1xjs4khgqpl6vr9kywql1-hello-2.12.1";
+ outPath = "/nix/store/src1vzij2z0slnakrsbpqpk20389z0k6-hello-2.12.1";
};
- outPath = "/nix/store/260q5867crm1xjs4khgqpl6vr9kywql1-hello-2.12.1";
+ outPath = "/nix/store/src1vzij2z0slnakrsbpqpk20389z0k6-hello-2.12.1";
outputs = [ "out" ];
system = "x86_64-linux";
type = "derivation";
diff --git a/doc/manual/source/command-ref/files/profiles.md b/doc/manual/source/command-ref/files/profiles.md
index b5c7378800f..f137336747f 100644
--- a/doc/manual/source/command-ref/files/profiles.md
+++ b/doc/manual/source/command-ref/files/profiles.md
@@ -37,13 +37,13 @@ dr-xr-xr-x 4 root root 4096 Jan 1 1970 share
/home/eelco/.local/state/nix/profiles/profile-7-link/bin:
total 20
-lrwxrwxrwx 5 root root 79 Jan 1 1970 chromium -> /nix/store/ijm5k0zqisvkdwjkc77mb9qzb35xfi4m-chromium-86.0.4240.111/bin/chromium
+lrwxrwxrwx 5 root root 79 Jan 1 1970 chromium -> /nix/store/cyxny9d1zjb9l9103fr6j6kavp3bqjxf-chromium-86.0.4240.111/bin/chromium
lrwxrwxrwx 7 root root 87 Jan 1 1970 spotify -> /nix/store/w9182874m1bl56smps3m5zjj36jhp3rn-spotify-1.1.26.501.gbe11e53b-15/bin/spotify
lrwxrwxrwx 3 root root 79 Jan 1 1970 zoom-us -> /nix/store/wbhg2ga8f3h87s9h5k0slxk0m81m4cxl-zoom-us-5.3.469451.0927/bin/zoom-us
/home/eelco/.local/state/nix/profiles/profile-7-link/share/applications:
total 12
-lrwxrwxrwx 4 root root 120 Jan 1 1970 chromium-browser.desktop -> /nix/store/4cf803y4vzfm3gyk3vzhzb2327v0kl8a-chromium-unwrapped-86.0.4240.111/share/applications/chromium-browser.desktop
+lrwxrwxrwx 4 root root 120 Jan 1 1970 chromium-browser.desktop -> /nix/store/sqzyx2l85i6j2a77pnyvglh3bvzwmjjp-chromium-unwrapped-86.0.4240.111/share/applications/chromium-browser.desktop
lrwxrwxrwx 7 root root 110 Jan 1 1970 spotify.desktop -> /nix/store/w9182874m1bl56smps3m5zjj36jhp3rn-spotify-1.1.26.501.gbe11e53b-15/share/applications/spotify.desktop
lrwxrwxrwx 3 root root 107 Jan 1 1970 us.zoom.Zoom.desktop -> /nix/store/wbhg2ga8f3h87s9h5k0slxk0m81m4cxl-zoom-us-5.3.469451.0927/share/applications/us.zoom.Zoom.desktop
@@ -67,7 +67,7 @@ By default, this symlink points to:
- `$NIX_STATE_DIR/profiles/per-user/root/profile` for `root`
The `PATH` environment variable should include `/bin` subdirectory of the profile link (e.g. `~/.nix-profile/bin`) for the user environment to be visible to the user.
-The [installer](@docroot@/installation/installing-binary.md) sets this up by default, unless you enable [`use-xdg-base-directories`].
+The installer sets this up by default, unless you enable [`use-xdg-base-directories`].
[`nix-env`]: @docroot@/command-ref/nix-env.md
[`nix profile`]: @docroot@/command-ref/new-cli/nix3-profile.md
diff --git a/doc/manual/source/command-ref/nix-channel.md b/doc/manual/source/command-ref/nix-channel.md
index 865f43ccce5..59817be974b 100644
--- a/doc/manual/source/command-ref/nix-channel.md
+++ b/doc/manual/source/command-ref/nix-channel.md
@@ -8,6 +8,12 @@
# Description
+> **Warning**
+>
+> nix-channel is deprecated in favor of flakes in Determinate Nix.
+> For a guide on Nix flakes, see: .
+> For details and to offer feedback on the deprecation process, see: .
+
Channels are a mechanism for referencing remote Nix expressions and conveniently retrieving their latest version.
The moving parts of channels are:
diff --git a/doc/manual/source/command-ref/nix-copy-closure.md b/doc/manual/source/command-ref/nix-copy-closure.md
index b7e31d93bfc..b34d57a5015 100644
--- a/doc/manual/source/command-ref/nix-copy-closure.md
+++ b/doc/manual/source/command-ref/nix-copy-closure.md
@@ -72,11 +72,11 @@ When using public key authentication, you can avoid typing the passphrase with `
> $ storePath="$(nix-build '' -I nixpkgs=channel:nixpkgs-unstable -A hello --no-out-link)"
> $ nix-copy-closure --to alice@itchy.example.org "$storePath"
> copying 5 paths...
-> copying path '/nix/store/nrwkk6ak3rgkrxbqhsscb01jpzmslf2r-xgcc-13.2.0-libgcc' to 'ssh://alice@itchy.example.org'...
-> copying path '/nix/store/gm61h1y42pqyl6178g90x8zm22n6pyy5-libunistring-1.1' to 'ssh://alice@itchy.example.org'...
-> copying path '/nix/store/ddfzjdykw67s20c35i7a6624by3iz5jv-libidn2-2.3.7' to 'ssh://alice@itchy.example.org'...
-> copying path '/nix/store/apab5i73dqa09wx0q27b6fbhd1r18ihl-glibc-2.39-31' to 'ssh://alice@itchy.example.org'...
-> copying path '/nix/store/g1n2vryg06amvcc1avb2mcq36faly0mh-hello-2.12.1' to 'ssh://alice@itchy.example.org'...
+> copying path '/nix/store/h6q8sqsqfbd3252f9gixqn3z282wds7m-xgcc-13.2.0-libgcc' to 'ssh://alice@itchy.example.org'...
+> copying path '/nix/store/imnwvn96lw355giswsk36hx105j4wnpj-libunistring-1.1' to 'ssh://alice@itchy.example.org'...
+> copying path '/nix/store/85301indj7scg34spnfczkz72jgv8wa9-libidn2-2.3.7' to 'ssh://alice@itchy.example.org'...
+> copying path '/nix/store/ypwfsaljwhzw9iffiysxmxnhjj8v7np0-glibc-2.39-31' to 'ssh://alice@itchy.example.org'...
+> copying path '/nix/store/0dklv59zppdsqdvgf0qdvjgzcs5wbwxa-hello-2.12.1' to 'ssh://alice@itchy.example.org'...
> ```
> **Example**
diff --git a/doc/manual/source/command-ref/nix-env.md b/doc/manual/source/command-ref/nix-env.md
index bda02149ed0..d01caaf7f78 100644
--- a/doc/manual/source/command-ref/nix-env.md
+++ b/doc/manual/source/command-ref/nix-env.md
@@ -52,7 +52,7 @@ These pages can be viewed offline:
`nix-env` can obtain packages from multiple sources:
- An attribute set of derivations from:
- - The [default Nix expression](@docroot@/command-ref/files/default-nix-expression.md) (by default)
+ - The default Nix expression (by default)
- A Nix file, specified via `--file`
- A [profile](@docroot@/command-ref/files/profiles.md), specified via `--from-profile`
- A Nix expression that is a function which takes default expression as argument, specified via `--from-expression`
diff --git a/doc/manual/source/command-ref/nix-env/install.md b/doc/manual/source/command-ref/nix-env/install.md
index 527fd8f90d8..320fa530fda 100644
--- a/doc/manual/source/command-ref/nix-env/install.md
+++ b/doc/manual/source/command-ref/nix-env/install.md
@@ -22,12 +22,11 @@ It is based on the current generation of the active [profile](@docroot@/command-
The arguments *args* map to store paths in a number of possible ways:
-- By default, *args* is a set of names denoting derivations in the [default Nix expression].
+- By default, *args* is a set of names denoting derivations in the default Nix expression.
These are [realised], and the resulting output paths are installed.
Currently installed derivations with a name equal to the name of a derivation being added are removed unless the option `--preserve-installed` is specified.
[derivation expression]: @docroot@/glossary.md#gloss-derivation-expression
- [default Nix expression]: @docroot@/command-ref/files/default-nix-expression.md
[realised]: @docroot@/glossary.md#gloss-realise
If there are multiple derivations matching a name in *args* that
@@ -45,7 +44,7 @@ The arguments *args* map to store paths in a number of possible ways:
gcc-3.3.6 gcc-4.1.1` will install both version of GCC (and will
probably cause a user environment conflict\!).
-- If [`--attr`](#opt-attr) / `-A` is specified, the arguments are *attribute paths* that select attributes from the [default Nix expression].
+- If [`--attr`](#opt-attr) / `-A` is specified, the arguments are *attribute paths* that select attributes from the default Nix expression.
This is faster than using derivation names and unambiguous.
Show the attribute paths of available packages with [`nix-env --query`](./query.md):
@@ -58,7 +57,7 @@ The arguments *args* map to store paths in a number of possible ways:
easy way to copy user environment elements from one profile to
another.
-- If `--from-expression` is given, *args* are [Nix language functions](@docroot@/language/syntax.md#functions) that are called with the [default Nix expression] as their single argument.
+- If `--from-expression` is given, *args* are [Nix language functions](@docroot@/language/syntax.md#functions) that are called with the default Nix expression as their single argument.
The derivations returned by those function calls are installed.
This allows derivations to be specified in an unambiguous way, which is necessary if there are multiple derivations with the same name.
@@ -204,7 +203,7 @@ To install a specific [store derivation] (typically created by
`nix-instantiate`):
```console
-$ nix-env --install /nix/store/fibjb1bfbpm5mrsxc4mh2d8n37sxh91i-gcc-3.4.3.drv
+$ nix-env --install /nix/store/8la6y31fmm6i4wfmby6avly1wf718xnj-gcc-3.4.3.drv
```
To install a specific output path:
@@ -232,7 +231,7 @@ $ nix-env --file '' --install --attr hello --dry-run
(dry run; not doing anything)
installing ‘hello-2.10’
this path will be fetched (0.04 MiB download, 0.19 MiB unpacked):
- /nix/store/wkhdf9jinag5750mqlax6z2zbwhqb76n-hello-2.10
+ /nix/store/ikwkxz4wwlp2g1428n7dy729cg1d9hin-hello-2.10
...
```
diff --git a/doc/manual/source/command-ref/nix-prefetch-url.md b/doc/manual/source/command-ref/nix-prefetch-url.md
index 19322ec8e04..8451778ad46 100644
--- a/doc/manual/source/command-ref/nix-prefetch-url.md
+++ b/doc/manual/source/command-ref/nix-prefetch-url.md
@@ -76,7 +76,7 @@ $ nix-prefetch-url ftp://ftp.gnu.org/pub/gnu/hello/hello-2.10.tar.gz
```console
$ nix-prefetch-url --print-path mirror://gnu/hello/hello-2.10.tar.gz
0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i
-/nix/store/3x7dwzq014bblazs7kq20p9hyzz0qh8g-hello-2.10.tar.gz
+/nix/store/8alrpdaasjd1x6g1fczchmzbpqm936a3-hello-2.10.tar.gz
```
```console
diff --git a/doc/manual/source/command-ref/nix-store/add-fixed.md b/doc/manual/source/command-ref/nix-store/add-fixed.md
index 2ea90a13592..511fe2050eb 100644
--- a/doc/manual/source/command-ref/nix-store/add-fixed.md
+++ b/doc/manual/source/command-ref/nix-store/add-fixed.md
@@ -34,6 +34,6 @@ This operation has the following options:
```console
$ nix-store --add-fixed sha256 ./hello-2.10.tar.gz
-/nix/store/3x7dwzq014bblazs7kq20p9hyzz0qh8g-hello-2.10.tar.gz
+/nix/store/8alrpdaasjd1x6g1fczchmzbpqm936a3-hello-2.10.tar.gz
```
diff --git a/doc/manual/source/command-ref/nix-store/delete.md b/doc/manual/source/command-ref/nix-store/delete.md
index 550c5ea2914..fcb2212d86d 100644
--- a/doc/manual/source/command-ref/nix-store/delete.md
+++ b/doc/manual/source/command-ref/nix-store/delete.md
@@ -27,7 +27,7 @@ paths in the store that refer to it (i.e., depend on it).
# Example
```console
-$ nix-store --delete /nix/store/zq0h41l75vlb4z45kzgjjmsjxvcv1qk7-mesa-6.4
+$ nix-store --delete /nix/store/gjak3al7lj61x4gj6rln4f5pc5v0f67n-mesa-6.4
0 bytes freed (0.00 MiB)
-error: cannot delete path `/nix/store/zq0h41l75vlb4z45kzgjjmsjxvcv1qk7-mesa-6.4' since it is still alive
+error: cannot delete path `/nix/store/gjak3al7lj61x4gj6rln4f5pc5v0f67n-mesa-6.4' since it is still alive
```
diff --git a/doc/manual/source/command-ref/nix-store/query.md b/doc/manual/source/command-ref/nix-store/query.md
index b5ba63adae2..cc45eeb74cf 100644
--- a/doc/manual/source/command-ref/nix-store/query.md
+++ b/doc/manual/source/command-ref/nix-store/query.md
@@ -103,6 +103,13 @@ symlink.
example when *paths* were substituted from a binary cache.
Use `--valid-derivers` instead to obtain valid paths only.
+ > **Note**
+ >
+ > `nix-store --query --deriver` is replaced with the following `nix` command:
+ >
+ > nix path-info --json ... | jq -r '.[].deriver'
+
+
[deriver]: @docroot@/glossary.md#gloss-deriver
- `--valid-derivers`
@@ -184,9 +191,9 @@ Print the build-time dependencies of `svn`:
```console
$ nix-store --query --requisites $(nix-store --query --deriver $(which svn))
-/nix/store/02iizgn86m42q905rddvg4ja975bk2i4-grep-2.5.1.tar.bz2.drv
-/nix/store/07a2bzxmzwz5hp58nf03pahrv2ygwgs3-gcc-wrapper.sh
-/nix/store/0ma7c9wsbaxahwwl04gbw3fcd806ski4-glibc-2.3.4.drv
+/nix/store/y6qa66l9h0pw161crnlk6y16rdrcljx4-grep-2.5.1.tar.bz2.drv
+/nix/store/z716h753s97jhnzvfank2srqbljswpgm-gcc-wrapper.sh
+/nix/store/f39x0q73rjdyvzm93y9wrkfr6x39lb7f-glibc-2.3.4.drv
... lots of other paths ...
```
@@ -199,10 +206,10 @@ Show the build-time dependencies as a tree:
```console
$ nix-store --query --tree $(nix-store --query --deriver $(which svn))
/nix/store/7i5082kfb6yjbqdbiwdhhza0am2xvh6c-subversion-1.1.4.drv
-+---/nix/store/d8afh10z72n8l1cr5w42366abiblgn54-builder.sh
-+---/nix/store/fmzxmpjx2lh849ph0l36snfj9zdibw67-bash-3.0.drv
-| +---/nix/store/570hmhmx3v57605cqg9yfvvyh0nnb8k8-bash
-| +---/nix/store/p3srsbd8dx44v2pg6nbnszab5mcwx03v-builder.sh
++---/nix/store/vxnmkc8l8d2ijjha4xwhkfgx9vvc3q4c-builder.sh
++---/nix/store/rn9776dy82n5qrgz7xbcl1iw4vfkcrkk-bash-3.0.drv
+| +---/nix/store/x9j20hz6bln1crzn55qifk0bbsm8v5ac-bash
+| +---/nix/store/ajnn1mcm45wjvn0rlc22gvx2cwhjnazx-builder.sh
...
```
diff --git a/doc/manual/source/command-ref/nix-store/realise.md b/doc/manual/source/command-ref/nix-store/realise.md
index 240685ce5c7..f5d203894e6 100644
--- a/doc/manual/source/command-ref/nix-store/realise.md
+++ b/doc/manual/source/command-ref/nix-store/realise.md
@@ -76,7 +76,7 @@ This operation is typically used to build [store derivation]s produced by
```console
$ nix-store --realise $(nix-instantiate ./test.nix)
-/nix/store/31axcgrlbfsxzmfff1gyj1bf62hvkby2-aterm-2.3.1
+/nix/store/6gwmy5jcnwdlz6aqqhksz863f1l8xc2w-aterm-2.3.1
```
This is essentially what [`nix-build`](@docroot@/command-ref/nix-build.md) does.
diff --git a/doc/manual/source/command-ref/subcommands.md b/doc/manual/source/command-ref/subcommands.md
new file mode 100644
index 00000000000..6a26732338d
--- /dev/null
+++ b/doc/manual/source/command-ref/subcommands.md
@@ -0,0 +1,3 @@
+# Subcommands
+
+This section lists all the subcommands of the `nix` CLI.
diff --git a/doc/manual/source/development/building.md b/doc/manual/source/development/building.md
index eb65a724757..da72204107c 100644
--- a/doc/manual/source/development/building.md
+++ b/doc/manual/source/development/building.md
@@ -1,73 +1,5 @@
# Building Nix
-This section provides some notes on how to start hacking on Nix.
-To get the latest version of Nix from GitHub:
-
-```console
-$ git clone https://github.com/NixOS/nix.git
-$ cd nix
-```
-
-> **Note**
->
-> The following instructions assume you already have some version of Nix installed locally, so that you can use it to set up the development environment.
-> If you don't have it installed, follow the [installation instructions](../installation/index.md).
-
-
-To build all dependencies and start a shell in which all environment variables are set up so that those dependencies can be found:
-
-```console
-$ nix-shell
-```
-
-To get a shell with one of the other [supported compilation environments](#compilation-environments):
-
-```console
-$ nix-shell --attr devShells.x86_64-linux.native-clangStdenv
-```
-
-> **Note**
->
-> You can use `native-ccacheStdenv` to drastically improve rebuild time.
-> By default, [ccache](https://ccache.dev) keeps artifacts in `~/.cache/ccache/`.
-
-To build Nix itself in this shell:
-
-```console
-[nix-shell]$ out="$(pwd)/outputs/out" dev=$out debug=$out mesonFlags+=" --prefix=${out}"
-[nix-shell]$ dontAddPrefix=1 configurePhase
-[nix-shell]$ buildPhase
-```
-
-To test it:
-
-```console
-[nix-shell]$ checkPhase
-```
-
-To install it in `$(pwd)/outputs`:
-
-```console
-[nix-shell]$ installPhase
-[nix-shell]$ ./outputs/out/bin/nix --version
-nix (Nix) 2.12
-```
-
-To build a release version of Nix for the current operating system and CPU architecture:
-
-```console
-$ nix-build
-```
-
-You can also build Nix for one of the [supported platforms](#platforms).
-
-## Building Nix with flakes
-
-This section assumes you are using Nix with the [`flakes`] and [`nix-command`] experimental features enabled.
-
-[`flakes`]: @docroot@/development/experimental-features.md#xp-feature-flakes
-[`nix-command`]: @docroot@/development/experimental-features.md#xp-feature-nix-command
-
To build all dependencies and start a shell in which all environment variables are set up so that those dependencies can be found:
```console
@@ -126,8 +58,6 @@ Nix can be built for various platforms, as specified in [`flake.nix`]:
[`flake.nix`]: https://github.com/nixos/nix/blob/master/flake.nix
- `x86_64-linux`
-- `x86_64-darwin`
-- `i686-linux`
- `aarch64-linux`
- `aarch64-darwin`
- `armv6l-linux`
@@ -145,12 +75,6 @@ platform. Common solutions include [remote build machines] and [binary format em
Given such a setup, executing the build only requires selecting the respective attribute.
For example, to compile for `aarch64-linux`:
-```console
-$ nix-build --attr packages.aarch64-linux.default
-```
-
-or for Nix with the [`flakes`] and [`nix-command`] experimental features enabled:
-
```console
$ nix build .#packages.aarch64-linux.default
```
@@ -243,20 +167,12 @@ To build with one of those environments, you can use
$ nix build .#nix-cli-ccacheStdenv
```
-for flake-enabled Nix, or
-
-```console
-$ nix-build --attr nix-cli-ccacheStdenv
-```
-
-for classic Nix.
-
You can use any of the other supported environments in place of `nix-cli-ccacheStdenv`.
## Editor integration
The `clangd` LSP server is installed by default on the `clang`-based `devShell`s.
-See [supported compilation environments](#compilation-environments) and instructions how to set up a shell [with flakes](#building-nix-with-flakes) or in [classic Nix](#building-nix).
+See [supported compilation environments](#compilation-environments) and instructions how to [set up a shell](#building-nix).
To use the LSP with your editor, you will want a `compile_commands.json` file telling `clangd` how we are compiling the code.
Meson's configure always produces this inside the build directory.
diff --git a/doc/manual/source/development/debugging.md b/doc/manual/source/development/debugging.md
index d2450495e50..6578632d991 100644
--- a/doc/manual/source/development/debugging.md
+++ b/doc/manual/source/development/debugging.md
@@ -6,14 +6,7 @@ Additionally, see [Testing Nix](./testing.md) for further instructions on how to
## Building Nix with Debug Symbols
-In the development shell, set the `mesonBuildType` environment variable to `debug` before configuring the build:
-
-```console
-[nix-shell]$ export mesonBuildType=debugoptimized
-```
-
-Then, proceed to build Nix as described in [Building Nix](./building.md).
-This will build Nix with debug symbols, which are essential for effective debugging.
+In the development shell, `mesonBuildType` is set automatically to `debugoptimized`. This builds Nix with debug symbols, which are essential for effective debugging.
It is also possible to build without optimization for faster build:
diff --git a/doc/manual/source/development/experimental-features.md b/doc/manual/source/development/experimental-features.md
index ad5cffa91ee..56a45b23890 100644
--- a/doc/manual/source/development/experimental-features.md
+++ b/doc/manual/source/development/experimental-features.md
@@ -6,7 +6,7 @@ Experimental features are considered unstable, which means that they can be chan
Users must explicitly enable them by toggling the associated [experimental feature flags](@docroot@/command-ref/conf-file.md#conf-experimental-features).
This allows accessing unstable functionality without unwittingly relying on it.
-Experimental feature flags were first introduced in [Nix 2.4](@docroot@/release-notes/rl-2.4.md).
+Experimental feature flags were first introduced in [Nix 2.4](https://nix.dev/manual/nix/latest/release-notes/rl-2.4).
Before that, Nix did have experimental features, but they were not guarded by flags and were merely documented as unstable.
This was a source of confusion and controversy.
diff --git a/doc/manual/source/development/testing.md b/doc/manual/source/development/testing.md
index dd965862a34..35654d16393 100644
--- a/doc/manual/source/development/testing.md
+++ b/doc/manual/source/development/testing.md
@@ -325,7 +325,6 @@ Creating a Cachix cache for your installer tests and adding its authorisation to
- `x86_64-linux`
- `armv6l-linux`
- `armv7l-linux`
- - `x86_64-darwin`
- The `installer_test` job (which runs on `ubuntu-24.04` and `macos-14`) will try to install Nix with the cached installer and run a trivial Nix command.
diff --git a/doc/manual/source/favicon.png b/doc/manual/source/favicon.png
deleted file mode 100644
index 1ed2b5fe0fd..00000000000
Binary files a/doc/manual/source/favicon.png and /dev/null differ
diff --git a/doc/manual/source/favicon.svg b/doc/manual/source/favicon.svg
index 1d2a6e835d5..55fb9479b06 100644
--- a/doc/manual/source/favicon.svg
+++ b/doc/manual/source/favicon.svg
@@ -1 +1,29 @@
-
\ No newline at end of file
+
diff --git a/doc/manual/source/glossary.md b/doc/manual/source/glossary.md
index 502e6d4de6b..64ca1cf5e16 100644
--- a/doc/manual/source/glossary.md
+++ b/doc/manual/source/glossary.md
@@ -136,7 +136,7 @@
> **Example**
>
- > `/nix/store/a040m110amc4h71lds2jmr8qrkj2jhxd-git-2.38.1`
+ > `/nix/store/jf6gn2dzna4nmsfbdxsd7kwhsk6gnnlr-git-2.38.1`
See [Store Path](@docroot@/store/store-path.md) for details.
@@ -353,14 +353,6 @@
See [Nix Archive](store/file-system-object/content-address.html#serial-nix-archive) for details.
-- [`∅`]{#gloss-empty-set}
-
- The empty set symbol. In the context of profile history, this denotes a package is not present in a particular version of the profile.
-
-- [`ε`]{#gloss-epsilon}
-
- The epsilon symbol. In the context of a package, this means the version is empty. More precisely, the derivation does not have a version attribute.
-
- [package]{#package}
A software package; files that belong together for a particular purpose, and metadata.
diff --git a/doc/manual/source/installation/env-variables.md b/doc/manual/source/installation/env-variables.md
deleted file mode 100644
index 0350904211a..00000000000
--- a/doc/manual/source/installation/env-variables.md
+++ /dev/null
@@ -1,62 +0,0 @@
-# Environment Variables
-
-To use Nix, some environment variables should be set. In particular,
-`PATH` should contain the directories `prefix/bin` and
-`~/.nix-profile/bin`. The first directory contains the Nix tools
-themselves, while `~/.nix-profile` is a symbolic link to the current
-*user environment* (an automatically generated package consisting of
-symlinks to installed packages). The simplest way to set the required
-environment variables is to include the file
-`prefix/etc/profile.d/nix.sh` in your `~/.profile` (or similar), like
-this:
-
-```bash
-source prefix/etc/profile.d/nix.sh
-```
-
-# `NIX_SSL_CERT_FILE`
-
-If you need to specify a custom certificate bundle to account for an
-HTTPS-intercepting man in the middle proxy, you must specify the path to
-the certificate bundle in the environment variable `NIX_SSL_CERT_FILE`.
-
-If you don't specify a `NIX_SSL_CERT_FILE` manually, Nix will install
-and use its own certificate bundle.
-
-Set the environment variable and install Nix
-
-```console
-$ export NIX_SSL_CERT_FILE=/etc/ssl/my-certificate-bundle.crt
-$ curl -L https://nixos.org/nix/install | sh
-```
-
-In the shell profile and rc files (for example, `/etc/bashrc`,
-`/etc/zshrc`), add the following line:
-
-```bash
-export NIX_SSL_CERT_FILE=/etc/ssl/my-certificate-bundle.crt
-```
-
-> **Note**
->
-> You must not add the export and then do the install, as the Nix
-> installer will detect the presence of Nix configuration, and abort.
-
-If you use the Nix daemon, you should also add the following to
-`/etc/nix/nix.conf`:
-
-```
-ssl-cert-file = /etc/ssl/my-certificate-bundle.crt
-```
-
-## Proxy Environment Variables
-
-The Nix installer has special handling for these proxy-related
-environment variables: `http_proxy`, `https_proxy`, `ftp_proxy`,
-`all_proxy`, `no_proxy`, `HTTP_PROXY`, `HTTPS_PROXY`, `FTP_PROXY`,
-`ALL_PROXY`, `NO_PROXY`.
-
-If any of these variables are set when running the Nix installer, then
-the installer will create an override file at
-`/etc/systemd/system/nix-daemon.service.d/override.conf` so `nix-daemon`
-will use them.
diff --git a/doc/manual/source/installation/index.md b/doc/manual/source/installation/index.md
index 3c09f103184..aded684b0b5 100644
--- a/doc/manual/source/installation/index.md
+++ b/doc/manual/source/installation/index.md
@@ -1,44 +1,11 @@
# Installation
-This section describes how to install and configure Nix for first-time use.
-
-The current recommended option on Linux and MacOS is [multi-user](#multi-user).
-
-## Multi-user
-
-This installation offers better sharing, improved isolation, and more security
-over a single user installation.
-
-This option requires either:
-
-* Linux running systemd, with SELinux disabled
-* MacOS
-
-> **Updating to macOS 15 Sequoia**
->
-> If you recently updated to macOS 15 Sequoia and are getting
-> ```console
-> error: the user '_nixbld1' in the group 'nixbld' does not exist
-> ```
-> when running Nix commands, refer to GitHub issue [NixOS/nix#10892](https://github.com/NixOS/nix/issues/10892) for instructions to fix your installation without reinstalling.
+We recommend that macOS users install Determinate Nix using our graphical installer, [Determinate.pkg][pkg].
+For Linux and Windows Subsystem for Linux (WSL) users:
```console
-$ curl -L https://nixos.org/nix/install | sh -s -- --daemon
-```
-
-## Single-user
-
-> Single-user is not supported on Mac.
-
-> `warning: installing Nix as root is not supported by this script!`
-
-This installation has less requirements than the multi-user install, however it
-cannot offer equivalent sharing, isolation, or security.
-
-This option is suitable for systems without systemd.
-
-```console
-$ curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
+curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | \
+ sh -s -- install
```
## Distributions
@@ -46,3 +13,5 @@ $ curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
The Nix community maintains installers for several distributions.
They can be found in the [`nix-community/nix-installers`](https://github.com/nix-community/nix-installers) repository.
+
+[pkg]: https://install.determinate.systems/determinate-pkg/stable/Universal
diff --git a/doc/manual/source/installation/installing-binary.md b/doc/manual/source/installation/installing-binary.md
deleted file mode 100644
index 21c15637437..00000000000
--- a/doc/manual/source/installation/installing-binary.md
+++ /dev/null
@@ -1,158 +0,0 @@
-# Installing a Binary Distribution
-
-> **Updating to macOS 15 Sequoia**
->
-> If you recently updated to macOS 15 Sequoia and are getting
-> ```console
-> error: the user '_nixbld1' in the group 'nixbld' does not exist
-> ```
-> when running Nix commands, refer to GitHub issue [NixOS/nix#10892](https://github.com/NixOS/nix/issues/10892) for instructions to fix your installation without reinstalling.
-
-To install the latest version Nix, run the following command:
-
-```console
-$ curl -L https://nixos.org/nix/install | sh
-```
-
-This performs the default type of installation for your platform:
-
-- [Multi-user](#multi-user-installation):
- - Linux with systemd and without SELinux
- - macOS
-- [Single-user](#single-user-installation):
- - Linux without systemd
- - Linux with SELinux
-
-We recommend the multi-user installation if it supports your platform and you can authenticate with `sudo`.
-
-The installer can be configured with various command line arguments and environment variables.
-To show available command line flags:
-
-```console
-$ curl -L https://nixos.org/nix/install | sh -s -- --help
-```
-
-To check what it does and how it can be customised further, [download and edit the second-stage installation script](#installing-from-a-binary-tarball).
-
-# Installing a pinned Nix version from a URL
-
-Version-specific installation URLs for all Nix versions since 1.11.16 can be found at [releases.nixos.org](https://releases.nixos.org/?prefix=nix/).
-The directory for each version contains the corresponding SHA-256 hash.
-
-All installation scripts are invoked the same way:
-
-```console
-$ export VERSION=2.19.2
-$ curl -L https://releases.nixos.org/nix/nix-$VERSION/install | sh
-```
-
-# Multi User Installation
-
-The multi-user Nix installation creates system users and a system service for the Nix daemon.
-
-Supported systems:
-
-- Linux running systemd, with SELinux disabled
-- macOS
-
-To explicitly instruct the installer to perform a multi-user installation on your system:
-
-```console
-$ bash <(curl -L https://nixos.org/nix/install) --daemon
-```
-
-You can run this under your usual user account or `root`.
-The script will invoke `sudo` as needed.
-
-# Single User Installation
-
-To explicitly select a single-user installation on your system:
-
-```console
-$ bash <(curl -L https://nixos.org/nix/install) --no-daemon
-```
-
-In a single-user installation, `/nix` is owned by the invoking user.
-The script will invoke `sudo` to create `/nix` if it doesn’t already exist.
-If you don’t have `sudo`, manually create `/nix` as `root`:
-
-```console
-$ su root
-# mkdir /nix
-# chown alice /nix
-```
-
-# Installing from a binary tarball
-
-You can also download a binary tarball that contains Nix and all its dependencies:
-- Choose a [version](https://releases.nixos.org/?prefix=nix/) and [system type](../development/building.md#platforms)
-- Download and unpack the tarball
-- Run the installer
-
-> **Example**
->
-> ```console
-> $ pushd $(mktemp -d)
-> $ export VERSION=2.19.2
-> $ export SYSTEM=x86_64-linux
-> $ curl -LO https://releases.nixos.org/nix/nix-$VERSION/nix-$VERSION-$SYSTEM.tar.xz
-> $ tar xfj nix-$VERSION-$SYSTEM.tar.xz
-> $ cd nix-$VERSION-$SYSTEM
-> $ ./install
-> $ popd
-> ```
-
-The installer can be customised with the environment variables declared in the file named `install-multi-user`.
-
-## Native packages for Linux distributions
-
-The Nix community maintains installers for some Linux distributions in their native packaging format(https://nix-community.github.io/nix-installers/).
-
-# macOS Installation
-
-
-[]{#sect-macos-installation-change-store-prefix}[]{#sect-macos-installation-encrypted-volume}[]{#sect-macos-installation-symlink}[]{#sect-macos-installation-recommended-notes}
-
-We believe we have ironed out how to cleanly support the read-only root file system
-on modern macOS. New installs will do this automatically.
-
-This section previously detailed the situation, options, and trade-offs,
-but it now only outlines what the installer does. You don't need to know
-this to run the installer, but it may help if you run into trouble:
-
-- create a new APFS volume for your Nix store
-- update `/etc/synthetic.conf` to direct macOS to create a "synthetic"
- empty root directory to mount your volume
-- specify mount options for the volume in `/etc/fstab`
- - `rw`: read-write
- - `noauto`: prevent the system from auto-mounting the volume (so the
- LaunchDaemon mentioned below can control mounting it, and to avoid
- masking problems with that mounting service).
- - `nobrowse`: prevent the Nix Store volume from showing up on your
- desktop; also keeps Spotlight from spending resources to index
- this volume
-
-- if you have FileVault enabled
- - generate an encryption password
- - put it in your system Keychain
- - use it to encrypt the volume
-- create a system LaunchDaemon to mount this volume early enough in the
- boot process to avoid problems loading or restoring any programs that
- need access to your Nix store
-
diff --git a/doc/manual/source/installation/nix-security.md b/doc/manual/source/installation/nix-security.md
index 1e9036b68b2..61cad24c2b3 100644
--- a/doc/manual/source/installation/nix-security.md
+++ b/doc/manual/source/installation/nix-security.md
@@ -1,15 +1,85 @@
# Security
-Nix has two basic security models. First, it can be used in “single-user
-mode”, which is similar to what most other package management tools do:
-there is a single user (typically root) who performs all package
-management operations. All other users can then use the installed
-packages, but they cannot perform package management operations
-themselves.
-
-Alternatively, you can configure Nix in “multi-user mode”. In this
-model, all users can perform package management operations — for
-instance, every user can install software without requiring root
-privileges. Nix ensures that this is secure. For instance, it’s not
-possible for one user to overwrite a package used by another user with a
-Trojan horse.
+Nix follows a [**multi-user**](#multi-user-model) security model in which all
+users can perform package management operations. Every user can, for example,
+install software without requiring root privileges, and Nix ensures that this
+is secure. It's *not* possible for one user to, for example, overwrite a
+package used by another user with a Trojan horse.
+
+## Multi-User model
+
+To allow a Nix store to be shared safely among multiple users, it is
+important that users are not able to run builders that modify the Nix
+store or database in arbitrary ways, or that interfere with builds
+started by other users. If they could do so, they could install a Trojan
+horse in some package and compromise the accounts of other users.
+
+To prevent this, the Nix store and database are owned by some privileged
+user (usually `root`) and builders are executed under special user
+accounts (usually named `nixbld1`, `nixbld2`, etc.). When a unprivileged
+user runs a Nix command, actions that operate on the Nix store (such as
+builds) are forwarded to a *Nix daemon* running under the owner of the
+Nix store/database that performs the operation.
+
+> **Note**
+>
+> Multi-user mode has one important limitation: only root and a set of
+> trusted users specified in `nix.conf` can specify arbitrary binary
+> caches. So while unprivileged users may install packages from
+> arbitrary Nix expressions, they may not get pre-built binaries.
+
+### Setting up the build users
+
+The *build users* are the special UIDs under which builds are performed.
+They should all be members of the *build users group* `nixbld`. This
+group should have no other members. The build users should not be
+members of any other group. On Linux, you can create the group and users
+as follows:
+
+```console
+$ groupadd -r nixbld
+$ for n in $(seq 1 10); do useradd -c "Nix build user $n" \
+ -d /var/empty -g nixbld -G nixbld -M -N -r -s "$(which nologin)" \
+ nixbld$n; done
+```
+
+This creates 10 build users. There can never be more concurrent builds
+than the number of build users, so you may want to increase this if you
+expect to do many builds at the same time.
+
+### Running the daemon
+
+The [Nix daemon](../command-ref/nix-daemon.md) should be started as
+follows (as `root`):
+
+```console
+$ nix-daemon
+```
+
+You’ll want to put that line somewhere in your system’s boot scripts.
+
+To let unprivileged users use the daemon, they should set the
+[`NIX_REMOTE` environment variable](../command-ref/env-common.md) to
+`daemon`. So you should put a line like
+
+```console
+export NIX_REMOTE=daemon
+```
+
+into the users’ login scripts.
+
+### Restricting access
+
+To limit which users can perform Nix operations, you can use the
+permissions on the directory `/nix/var/nix/daemon-socket`. For instance,
+if you want to restrict the use of Nix to the members of a group called
+`nix-users`, do
+
+```console
+$ chgrp nix-users /nix/var/nix/daemon-socket
+$ chmod ug=rwx,o= /nix/var/nix/daemon-socket
+```
+
+This way, users who are not in the `nix-users` group cannot connect to
+the Unix domain socket `/nix/var/nix/daemon-socket/socket`, so they
+cannot perform Nix operations.
diff --git a/doc/manual/source/installation/single-user.md b/doc/manual/source/installation/single-user.md
deleted file mode 100644
index f9a3b26edf4..00000000000
--- a/doc/manual/source/installation/single-user.md
+++ /dev/null
@@ -1,9 +0,0 @@
-# Single-User Mode
-
-In single-user mode, all Nix operations that access the database in
-`prefix/var/nix/db` or modify the Nix store in `prefix/store` must be
-performed under the user ID that owns those directories. This is
-typically root. (If you install from RPM packages, that’s in fact the
-default ownership.) However, on single-user machines, it is often
-convenient to `chown` those directories to your normal user account so
-that you don’t have to `su` to root all the time.
diff --git a/doc/manual/source/installation/supported-platforms.md b/doc/manual/source/installation/supported-platforms.md
deleted file mode 100644
index 8ca3ce8d445..00000000000
--- a/doc/manual/source/installation/supported-platforms.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# Supported Platforms
-
-Nix is currently supported on the following platforms:
-
- - Linux (i686, x86\_64, aarch64).
-
- - macOS (x86\_64, aarch64).
diff --git a/doc/manual/source/installation/uninstall.md b/doc/manual/source/installation/uninstall.md
index 69d59847b6f..e95634c213a 100644
--- a/doc/manual/source/installation/uninstall.md
+++ b/doc/manual/source/installation/uninstall.md
@@ -1,197 +1,15 @@
# Uninstalling Nix
-## Multi User
-
-Removing a [multi-user installation](./installing-binary.md#multi-user-installation) depends on the operating system.
-
-### Linux
-
-If you are on Linux with systemd:
-
-1. Remove the Nix daemon service:
-
- ```console
- sudo systemctl stop nix-daemon.service
- sudo systemctl disable nix-daemon.socket nix-daemon.service
- sudo systemctl daemon-reload
- ```
-
-Remove files created by Nix:
+To uninstall Determinate Nix, use the uninstallation utility built into the [Determinate Nix Installer][installer]:
```console
-sudo rm -rf /etc/nix /etc/profile.d/nix.sh /etc/tmpfiles.d/nix-daemon.conf /nix ~root/.nix-channels ~root/.nix-defexpr ~root/.nix-profile ~root/.cache/nix
+$ /nix/nix-installer uninstall
```
-Remove build users and their group:
+If you're certain that you want to uninstall, you can skip the confirmation step:
```console
-for i in $(seq 1 32); do
- sudo userdel nixbld$i
-done
-sudo groupdel nixbld
+$ /nix/nix-installer uninstall --no-confirm
```
-There may also be references to Nix in
-
-- `/etc/bash.bashrc`
-- `/etc/bashrc`
-- `/etc/profile`
-- `/etc/zsh/zshrc`
-- `/etc/zshrc`
-
-which you may remove.
-
-### FreeBSD
-
-1. Stop and remove the Nix daemon service:
-
- ```console
- sudo service nix-daemon stop
- sudo rm -f /usr/local/etc/rc.d/nix-daemon
- sudo sysrc -x nix_daemon_enable
- ```
-
-2. Remove files created by Nix:
-
- ```console
- sudo rm -rf /etc/nix /usr/local/etc/profile.d/nix.sh /nix ~root/.nix-channels ~root/.nix-defexpr ~root/.nix-profile ~root/.cache/nix
- ```
-
-3. Remove build users and their group:
-
- ```console
- for i in $(seq 1 32); do
- sudo pw userdel nixbld$i
- done
- sudo pw groupdel nixbld
- ```
-
-4. There may also be references to Nix in:
- - `/usr/local/etc/bashrc`
- - `/usr/local/etc/zshrc`
- - Shell configuration files in users' home directories
-
- which you may remove.
-
-### macOS
-
-> **Updating to macOS 15 Sequoia**
->
-> If you recently updated to macOS 15 Sequoia and are getting
-> ```console
-> error: the user '_nixbld1' in the group 'nixbld' does not exist
-> ```
-> when running Nix commands, refer to GitHub issue [NixOS/nix#10892](https://github.com/NixOS/nix/issues/10892) for instructions to fix your installation without reinstalling.
-
-1. If system-wide shell initialisation files haven't been altered since installing Nix, use the backups made by the installer:
-
- ```console
- sudo mv /etc/zshrc.backup-before-nix /etc/zshrc
- sudo mv /etc/bashrc.backup-before-nix /etc/bashrc
- sudo mv /etc/bash.bashrc.backup-before-nix /etc/bash.bashrc
- ```
-
- Otherwise, edit `/etc/zshrc`, `/etc/bashrc`, and `/etc/bash.bashrc` to remove the lines sourcing `nix-daemon.sh`, which should look like this:
-
- ```bash
- # Nix
- if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then
- . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
- fi
- # End Nix
- ```
-
-2. Stop and remove the Nix daemon services:
-
- ```console
- sudo launchctl unload /Library/LaunchDaemons/org.nixos.nix-daemon.plist
- sudo rm /Library/LaunchDaemons/org.nixos.nix-daemon.plist
- sudo launchctl unload /Library/LaunchDaemons/org.nixos.darwin-store.plist
- sudo rm /Library/LaunchDaemons/org.nixos.darwin-store.plist
- ```
-
- This stops the Nix daemon and prevents it from being started next time you boot the system.
-
-3. Remove the `nixbld` group and the `_nixbuildN` users:
-
- ```console
- sudo dscl . -delete /Groups/nixbld
- for u in $(sudo dscl . -list /Users | grep _nixbld); do sudo dscl . -delete /Users/$u; done
- ```
-
- This will remove all the build users that no longer serve a purpose.
-
-4. Edit fstab using `sudo vifs` to remove the line mounting the Nix Store volume on `/nix`, which looks like
-
- ```
- UUID= /nix apfs rw,noauto,nobrowse,suid,owners
- ```
- or
-
- ```
- LABEL=Nix\040Store /nix apfs rw,nobrowse
- ```
-
- by setting the cursor on the respective line using the arrow keys, and pressing `dd`, and then `:wq` to save the file.
-
- This will prevent automatic mounting of the Nix Store volume.
-
-5. Edit `/etc/synthetic.conf` to remove the `nix` line.
- If this is the only line in the file you can remove it entirely:
-
- ```bash
- if [ -f /etc/synthetic.conf ]; then
- if [ "$(cat /etc/synthetic.conf)" = "nix" ]; then
- sudo rm /etc/synthetic.conf
- else
- sudo vi /etc/synthetic.conf
- fi
- fi
- ```
-
- This will prevent the creation of the empty `/nix` directory.
-
-6. Remove the files Nix added to your system, except for the store:
-
- ```console
- sudo rm -rf /etc/nix /var/root/.nix-profile /var/root/.nix-defexpr /var/root/.nix-channels ~/.nix-profile ~/.nix-defexpr ~/.nix-channels
- ```
-
-
-7. Remove the Nix Store volume:
-
- ```console
- sudo diskutil apfs deleteVolume /nix
- ```
-
- This will remove the Nix Store volume and everything that was added to the store.
-
- If the output indicates that the command couldn't remove the volume, you should make sure you don't have an _unmounted_ Nix Store volume.
- Look for a "Nix Store" volume in the output of the following command:
-
- ```console
- diskutil list
- ```
-
- If you _do_ find a "Nix Store" volume, delete it by running `diskutil apfs deleteVolume` with the store volume's `diskXsY` identifier.
-
- If you get an error that the volume is in use by the kernel, reboot and immediately delete the volume before starting any other process.
-
-> **Note**
->
-> After you complete the steps here, you will still have an empty `/nix` directory.
-> This is an expected sign of a successful uninstall.
-> The empty `/nix` directory will disappear the next time you reboot.
->
-> You do not have to reboot to finish uninstalling Nix.
-> The uninstall is complete.
-> macOS (Catalina+) directly controls root directories, and its read-only root will prevent you from manually deleting the empty `/nix` mountpoint.
-
-## Single User
-
-To remove a [single-user installation](./installing-binary.md#single-user-installation) of Nix, run:
-
-```console
-rm -rf /nix ~/.nix-channels ~/.nix-defexpr ~/.nix-profile
-```
-You might also want to manually remove references to Nix from your `~/.profile`.
+[installer]: https://github.com/DeterminateSystems/nix-installer
diff --git a/doc/manual/source/installation/upgrading.md b/doc/manual/source/installation/upgrading.md
index a433f1d30e6..8fe342b09b7 100644
--- a/doc/manual/source/installation/upgrading.md
+++ b/doc/manual/source/installation/upgrading.md
@@ -1,40 +1,10 @@
# Upgrading Nix
-> **Note**
->
-> These upgrade instructions apply where Nix was installed following the [installation instructions in this manual](./index.md).
-
-Check which Nix version will be installed, for example from one of the [release channels](http://channels.nixos.org/) such as `nixpkgs-unstable`:
-
-```console
-$ nix-shell -p nix -I nixpkgs=channel:nixpkgs-unstable --run "nix --version"
-nix (Nix) 2.18.1
-```
-
-> **Warning**
->
-> Writing to the [local store](@docroot@/store/types/local-store.md) with a newer version of Nix, for example by building derivations with [`nix-build`](@docroot@/command-ref/nix-build.md) or [`nix-store --realise`](@docroot@/command-ref/nix-store/realise.md), may change the database schema!
-> Reverting to an older version of Nix may therefore require purging the store database before it can be used.
-
-## Linux multi-user
+You can upgrade Determinate Nix using Determinate Nixd:
```console
-$ sudo su
-# nix-env --install --file '' --attr nix cacert -I nixpkgs=channel:nixpkgs-unstable
-# systemctl daemon-reload
-# systemctl restart nix-daemon
+sudo determinate-nixd upgrade
```
-## macOS multi-user
+Note that the `sudo` is necessary here and upgrading fails without it.
-```console
-$ sudo nix-env --install --file '' --attr nix cacert -I nixpkgs=channel:nixpkgs-unstable
-$ sudo launchctl remove org.nixos.nix-daemon
-$ sudo launchctl load /Library/LaunchDaemons/org.nixos.nix-daemon.plist
-```
-
-## Single-user all platforms
-
-```console
-$ nix-env --install --file '' --attr nix cacert -I nixpkgs=channel:nixpkgs-unstable
-```
diff --git a/doc/manual/source/introduction.md b/doc/manual/source/introduction.md
index e70411c11f5..039ad6f30b1 100644
--- a/doc/manual/source/introduction.md
+++ b/doc/manual/source/introduction.md
@@ -1,4 +1,19 @@
-# Introduction
+# Determinate Nix
+
+**Determinate Nix** is a downstream distribution of [Nix], a purely functional language, CLI tool, and package management system.
+It's available on Linux, macOS, and Windows Subsystem for Linux (WSL).
+
+## Installing
+
+We recommend that macOS users install Determinate Nix using our graphical installer, [Determinate.pkg][pkg].
+For Linux and Windows Subsystem for Linux (WSL) users:
+
+```console
+curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | \
+ sh -s -- install
+```
+
+## How Nix works
Nix is a _purely functional package manager_. This means that it
treats packages like values in a purely functional programming language
@@ -8,7 +23,7 @@ stores packages in the _Nix store_, usually the directory
`/nix/store`, where each package has its own unique subdirectory such
as
- /nix/store/b6gvzjyb2pg0kjfwrjmg1vfhh54ad73z-firefox-33.1/
+ /nix/store/q06x3jll2yfzckz2bzqak089p43ixkkq-firefox-33.1/
where `b6gvzjyb2pg0…` is a unique identifier for the package that
captures all its dependencies (it’s a cryptographic hash of the
@@ -184,10 +199,14 @@ to build configuration files in `/etc`). This means, among other
things, that it is easy to roll back the entire configuration of the
system to an earlier state. Also, users can install software without
root privileges. For more information and downloads, see the [NixOS
-homepage](https://nixos.org/).
+homepage][nix].
## License
Nix is released under the terms of the [GNU LGPLv2.1 or (at your
option) any later
-version](http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html).
+version][license].
+
+[license]: http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html
+[pkg]: https://install.determinate.systems/determinate-pkg/stable/Universal
+[site]: https://nixos.org
diff --git a/doc/manual/source/language/string-context.md b/doc/manual/source/language/string-context.md
index 65c59d865f0..0968cc88b84 100644
--- a/doc/manual/source/language/string-context.md
+++ b/doc/manual/source/language/string-context.md
@@ -34,12 +34,12 @@ String context elements come in different forms:
> [`builtins.storePath`] creates a string with a single constant string context element:
>
> ```nix
- > builtins.getContext (builtins.storePath "/nix/store/wkhdf9jinag5750mqlax6z2zbwhqb76n-hello-2.10")
+ > builtins.getContext (builtins.storePath "/nix/store/ikwkxz4wwlp2g1428n7dy729cg1d9hin-hello-2.10")
> ```
> evaluates to
> ```nix
> {
- > "/nix/store/wkhdf9jinag5750mqlax6z2zbwhqb76n-hello-2.10" = {
+ > "/nix/store/ikwkxz4wwlp2g1428n7dy729cg1d9hin-hello-2.10" = {
> path = true;
> };
> }
diff --git a/doc/manual/source/language/string-interpolation.md b/doc/manual/source/language/string-interpolation.md
index 8e25d2b6311..3f6bf9b9f85 100644
--- a/doc/manual/source/language/string-interpolation.md
+++ b/doc/manual/source/language/string-interpolation.md
@@ -181,7 +181,7 @@ A derivation interpolates to the [store path] of its first [output](./derivation
> "${pkgs.hello}"
> ```
>
-> "/nix/store/4xpfqf29z4m8vbhrqcz064wfmb46w5r7-hello-2.12.1"
+> "/nix/store/qnlr7906z0mrl2syrkdbpicffq02nw07-hello-2.12.1"
An attribute set interpolates to the return value of the function in the `__toString` applied to the attribute set itself.
diff --git a/doc/manual/source/protocols/json/schema/derivation-options-v1.yaml b/doc/manual/source/protocols/json/schema/derivation-options-v1.yaml
index 58ff070882f..d247802cd6c 100644
--- a/doc/manual/source/protocols/json/schema/derivation-options-v1.yaml
+++ b/doc/manual/source/protocols/json/schema/derivation-options-v1.yaml
@@ -9,7 +9,7 @@ description: |
> **Warning**
>
> This JSON format is currently
- > [**experimental**](@docroot@/development/experimental-features.md#xp-feature-nix-command)
+ > [**experimental**](@docroot@/development/experimental-features.md)
> and subject to change.
type: object
diff --git a/doc/manual/source/protocols/json/schema/derivation-v4.yaml b/doc/manual/source/protocols/json/schema/derivation-v4.yaml
index 2528f7502e6..c1884769671 100644
--- a/doc/manual/source/protocols/json/schema/derivation-v4.yaml
+++ b/doc/manual/source/protocols/json/schema/derivation-v4.yaml
@@ -9,7 +9,7 @@ description: |
> **Warning**
>
> This JSON format is currently
- > [**experimental**](@docroot@/development/experimental-features.md#xp-feature-nix-command)
+ > [**experimental**](@docroot@/development/experimental-features.md)
> and subject to change.
type: object
@@ -94,8 +94,8 @@ properties:
>
> ```json
> "srcs": [
- > "47y241wqdhac3jm5l7nv0x4975mb1975-separate-debug-info.sh",
- > "56d0w71pjj9bdr363ym3wj1zkwyqq97j-fix-pop-var-context-error.patch"
+ > "b8nwz167km1yciqpwzjj24f8jcy8pq1h-separate-debug-info.sh",
+ > "ihzmilr413r8fb3ah30yjnhlb18c1laz-fix-pop-var-context-error.patch"
> ]
> ```
items:
@@ -140,7 +140,7 @@ properties:
description: |
Absolute path of the program used to perform the build.
Typically this is the `bash` shell
- (e.g. `/nix/store/r3j288vpmczbl500w6zz89gyfa4nr0b1-bash-4.4-p23/bin/bash`).
+ (e.g. `/nix/store/p4xlj4imjbnm4v0x5jf4qysvyjjlgq1d-bash-4.4-p23/bin/bash`).
args:
type: array
diff --git a/doc/manual/source/protocols/json/schema/store-object-info-v2.yaml b/doc/manual/source/protocols/json/schema/store-object-info-v2.yaml
index 3ed7e99e28d..6ebaa3b2422 100644
--- a/doc/manual/source/protocols/json/schema/store-object-info-v2.yaml
+++ b/doc/manual/source/protocols/json/schema/store-object-info-v2.yaml
@@ -6,12 +6,6 @@ description: |
This schema describes the JSON representation of store object metadata as returned by commands like [`nix path-info --json`](@docroot@/command-ref/new-cli/nix3-path-info.md).
- > **Warning**
- >
- > This JSON format is currently
- > [**experimental**](@docroot@/development/experimental-features.md#xp-feature-nix-command)
- > and subject to change.
-
### Field Categories
Store object information can come in a few different variations.
diff --git a/doc/manual/source/protocols/json/schema/store-path-v1.yaml b/doc/manual/source/protocols/json/schema/store-path-v1.yaml
index 2012aab9915..61653d60e21 100644
--- a/doc/manual/source/protocols/json/schema/store-path-v1.yaml
+++ b/doc/manual/source/protocols/json/schema/store-path-v1.yaml
@@ -6,12 +6,6 @@ description: |
This schema describes the JSON representation of store paths as used in various Nix JSON APIs.
- > **Warning**
- >
- > This JSON format is currently
- > [**experimental**](@docroot@/development/experimental-features.md#xp-feature-nix-command)
- > and subject to change.
-
## Format
Store paths in JSON are represented as strings containing just the hash and name portion, without the store directory prefix.
diff --git a/doc/manual/source/protocols/json/schema/store-v1.yaml b/doc/manual/source/protocols/json/schema/store-v1.yaml
index e0c6f8fed6c..31aa10c4147 100644
--- a/doc/manual/source/protocols/json/schema/store-v1.yaml
+++ b/doc/manual/source/protocols/json/schema/store-v1.yaml
@@ -10,7 +10,7 @@ description: |
> **Warning**
>
> This JSON format is currently
- > [**experimental**](@docroot@/development/experimental-features.md#xp-feature-nix-command)
+ > [**experimental**](@docroot@/development/experimental-features.md)
> and subject to change.
type: object
diff --git a/doc/manual/source/quick-start.md b/doc/manual/source/quick-start.md
index 9eb7a326590..42e4e9c0c24 100644
--- a/doc/manual/source/quick-start.md
+++ b/doc/manual/source/quick-start.md
@@ -3,10 +3,13 @@
This chapter is for impatient people who don't like reading documentation.
For more in-depth information you are kindly referred to subsequent chapters.
-1. Install Nix:
+1. Install Nix.
+ We recommend that macOS users install Determinate Nix using our graphical installer, [Determinate.pkg][pkg].
+ For Linux and Windows Subsystem for Linux (WSL) users:
```console
- $ curl -L https://nixos.org/nix/install | sh
+ $ curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | \
+ sh -s -- install
```
The install script will use `sudo`, so make sure you have sufficient rights.
@@ -41,3 +44,5 @@ For more in-depth information you are kindly referred to subsequent chapters.
```console
$ nix-collect-garbage
```
+
+[pkg]: https://install.determinate.systems/determinate-pkg/stable/Universal
diff --git a/doc/manual/source/release-notes-determinate/changes.md b/doc/manual/source/release-notes-determinate/changes.md
new file mode 100644
index 00000000000..478068f2d89
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/changes.md
@@ -0,0 +1,156 @@
+# Changes between Nix and Determinate Nix
+
+This section lists the differences between upstream Nix 2.33 and Determinate Nix 3.15.1.
+
+* In Determinate Nix, flakes are stable. You no longer need to enable the `flakes` experimental feature.
+
+* In Determinate Nix, the new Nix CLI (i.e. the `nix` command) is stable. You no longer need to enable the `nix-command` experimental feature.
+
+* Determinate Nix has a setting [`json-log-path`](@docroot@/command-ref/conf-file.md#conf-json-log-path) to send a copy of all Nix log messages (in JSON format) to a file or Unix domain socket.
+
+* Determinate Nix has made `nix profile install` an alias to `nix profile add`, a more symmetrical antonym of `nix profile remove`.
+
+* `nix-channel` and `channel:` url syntax (like `channel:nixos-24.11`) is deprecated, see: https://github.com/DeterminateSystems/nix-src/issues/34
+
+* Using indirect flake references and implicit inputs is deprecated, see: https://github.com/DeterminateSystems/nix-src/issues/37
+
+* Warnings around "dirty trees" are updated to reduce "dirty" jargon, and now refers to "uncommitted changes".
+
+
+
+
+
+
+
+* `nix upgrade-nix` is now inert, and suggests using `determinate-nixd upgrade`. [DeterminateSystems/nix-src#55](https://github.com/DeterminateSystems/nix-src/pull/55)
+
+* Determinate Nix has Lazy Trees, avoiding expensive copying of flake inputs to the Nix store. ([DeterminateSystems/nix-src#27](https://github.com/DeterminateSystems/nix-src/pull/27), [DeterminateSystems/nix-src#56](https://github.com/DeterminateSystems/nix-src/pull/56))
+
+
+
+
+
+
+
+
+
+* Documentation on how to replicate `nix-store --query --deriver` with the new `nix` cli. [DeterminateSystems/nix-src#82](https://github.com/DeterminateSystems/nix-src/pull/82)
+
+* In `nix profile`, the symbols `ε` and `∅` have been replaced with descriptive English words. [DeterminateSystems/nix-src#81](https://github.com/DeterminateSystems/nix-src/pull/81)
+
+
+
+
+
+
+
+* When remote building with `--keep-failed`, Determinate Nix shows "you can rerun" message if the derivation's platform is supported on this machine. [DeterminateSystems/nix-src#87](https://github.com/DeterminateSystems/nix-src/pull/87)
+
+* Improved error message when `sandbox-paths` specifies a missing file. [DeterminateSystems/nix-src#88](https://github.com/DeterminateSystems/nix-src/pull/88)
+
+
+
+
+
+
+
+
+
+* `nix store delete` now explains why deletion fails. [DeterminateSystems/nix-src#130](https://github.com/DeterminateSystems/nix-src/pull/130)
+
+
+
+
+
+
+
+
+
+
+
+
+
+* Tab completing arguments to Nix avoids network access. [DeterminateSystems/nix-src#161](https://github.com/DeterminateSystems/nix-src/pull/161)
+
+* Importing Nixpkgs and other tarballs to the cache is 2-4x faster. [DeterminateSystems/nix-src#149](https://github.com/DeterminateSystems/nix-src/pull/149)
+
+* Adding paths to the store is significantly faster. [DeterminateSystems/nix-src#162](https://github.com/DeterminateSystems/nix-src/pull/162)
+
+
+
+
+
+* Determinate Nix allows flake inputs to be fetched at build time. [DeterminateSystems/nix-src#49](https://github.com/DeterminateSystems/nix-src/pull/49)
+
+
+
+* The default `nix flake init` template is much more useful. [DeterminateSystems/nix-src#180](https://github.com/DeterminateSystems/nix-src/pull/180)
+
+
+
+
+
+
+
+
+* Multithreaded evaluation support. [DeterminateSystems/nix-src#125](https://github.com/DeterminateSystems/nix-src/pull/125)
+
+
+
+
+
+
+* Determinate Nix only tries to substitute inputs if fetching from its original location fails.[DeterminateSystems/nix-src#202](https://github.com/DeterminateSystems/nix-src/pull/202)
+
+
+
+
+
+
+* A new command `nix nario` that replaces `nix-store --export|--export`. It also has a new file format (`--format 2`) that supports store path attributes such as signatures, and that can be imported more efficiently. [DeterminateSystems/nix-src#215](https://github.com/DeterminateSystems/nix-src/pull/215)
+
+* Determinate Nix prints the Nix version when using `-vv` or higher verbosity. [DeterminateSystems/nix-src#237](https://github.com/DeterminateSystems/nix-src/pull/237)
+
+
+
+
+* During evaluation, you can read or import from the result of `builtins.fetchClosure`. [DeterminateSystems/nix-src#241](https://github.com/DeterminateSystems/nix-src/pull/241)
+
+
+
+* Flakerefs in error messages and lockfile diffs are abbreviated for readability. [DeterminateSystems/nix-src#243](https://github.com/DeterminateSystems/nix-src/pull/243), [DeterminateSystems/nix-src#264](https://github.com/DeterminateSystems/nix-src/pull/264)
+
+
+
+
+
+
+
+
+* The Git fetcher doesn't compute `revCount` or `lastModified` if they're already specified [DeterminateSystems./nix-src#269](https://github.com/DeterminateSystems/nix-src/pull/269)
+
+* The Git fetcher avoids doing a shallow Git fetch if it previously did a non-shallow fetch of the same repository. [DeterminateSystems/nix-src#270](https://github.com/DeterminateSystems/nix-src/pull/270)
+
+* Determinate Nix has a builtin copy of the flake registry, making it more resilient to network outages. [DeterminateSystems/nix-src#271](https://github.com/DeterminateSystems/nix-src/pull/271)
+
+
+
+* `nix build` and `nix profile` report failing or succeeding installables. [DeterminateSystems/nix-src#281](https://github.com/DeterminateSystems/nix-src/pull/281)
+
+* `nix flake check` shows which outputs failed or succeeded. [DeterminateSystems/nix-src#285](https://github.com/DeterminateSystems/nix-src/pull/285)
+
+* Determinate Nix has a `nix ps` command to show active builds. [DeterminateSystems/nix-src#282](https://github.com/DeterminateSystems/nix-src/pull/282)
+
+* Determinate Nix has improved backward compatibility with lock files created by Nix < 2.20. [DeterminateSystems/nix-src#278](https://github.com/DeterminateSystems/nix-src/pull/278)
+
+
+
+* Determinate Nix has a builtin function `builtins.filterAttrs`. [DeterminateSystems/nix-src#291](https://github.com/DeterminateSystems/nix-src/pull/291)
+
+* `builtins.fetchTree` implicitly sets `__final = true` when a `narHash` is supplied. This allows the tree to be substituted. [DeterminateSystems/nix-src#297](https://github.com/DeterminateSystems/nix-src/pull/297)
+
+
+
+* Bring back the free alpha by @grahamc in [DeterminateSystems/nix-src#305](https://github.com/DeterminateSystems/nix-src/pull/305)
+
+* Replace substitutable hashes with unlilkey to substitute hashes by @grahamc in [DeterminateSystems/nix-src#306](https://github.com/DeterminateSystems/nix-src/pull/306)
diff --git a/doc/manual/source/release-notes-determinate/index.md b/doc/manual/source/release-notes-determinate/index.md
new file mode 100644
index 00000000000..bba33084424
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/index.md
@@ -0,0 +1,3 @@
+# Determinate Nix Release Notes
+
+This chapter lists the differences between Nix and Determinate Nix, as well as the release history of Determinate Nix.
diff --git a/doc/manual/source/release-notes-determinate/rl-3.0.0.md b/doc/manual/source/release-notes-determinate/rl-3.0.0.md
new file mode 100644
index 00000000000..d60786e9a72
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.0.0.md
@@ -0,0 +1,5 @@
+# Release 3.0.0 (2025-03-04)
+
+* Initial release of Determinate Nix.
+
+* Based on [upstream Nix 2.26.2](../release-notes/rl-2.26.md).
diff --git a/doc/manual/source/release-notes-determinate/rl-3.1.0.md b/doc/manual/source/release-notes-determinate/rl-3.1.0.md
new file mode 100644
index 00000000000..96b7819d08d
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.1.0.md
@@ -0,0 +1,5 @@
+# Release 3.1.0 (2025-03-27)
+
+* Based on [upstream Nix 2.27.1](../release-notes/rl-2.27.md).
+
+* New setting `json-log-path` that sends a copy of all Nix log messages (in JSON format) to a file or Unix domain socket.
diff --git a/doc/manual/source/release-notes-determinate/rl-3.3.0.md b/doc/manual/source/release-notes-determinate/rl-3.3.0.md
new file mode 100644
index 00000000000..badf96415df
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.3.0.md
@@ -0,0 +1,5 @@
+# Release 3.3.0 (2025-04-11)
+
+* Based on [upstream Nix 2.28.1](../release-notes/rl-2.28.md).
+
+* The `nix profile install` command is now an alias to `nix profile add`, a more symmetrical antonym of `nix profile remove`.
diff --git a/doc/manual/source/release-notes-determinate/rl-3.4.0.md b/doc/manual/source/release-notes-determinate/rl-3.4.0.md
new file mode 100644
index 00000000000..24ae03ca554
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.4.0.md
@@ -0,0 +1,50 @@
+# Release 3.4.0 (2025-04-25)
+
+* Based on [upstream Nix 2.28.2](../release-notes/rl-2.28.md).
+
+* **Warn users that `nix-channel` is deprecated.**
+
+This is the first change accomplishing our roadmap item of deprecating Nix channels: https://github.com/DeterminateSystems/nix-src/issues/34
+
+This is due to user confusion and surprising behavior of channels, especially in the context of user vs. root channels.
+
+The goal of this change is to make the user experience of Nix more predictable.
+In particular, these changes are to support users with lower levels of experience who are following guides that focus on channels as the mechanism of distribution.
+
+Users will now see this message:
+
+> nix-channel is deprecated in favor of flakes in Determinate Nix. For a guide on Nix flakes, see: https://zero-to-nix.com/. or details and to offer feedback on the deprecation process, see: https://github.com/DeterminateSystems/nix-src/issues/34.
+
+
+* **Warn users that `channel:` URLs are deprecated.**
+
+This is the second change regarding our deprecation of Nix channels.
+Using a `channel:` URL (like `channel:nixos-24.11`) will yield a warning like this:
+
+> Channels are deprecated in favor of flakes in Determinate Nix. Instead of 'channel:nixos-24.11', use 'https://nixos.org/channels/nixos-24.11/nixexprs.tar.xz'. For a guide on Nix flakes, see: https://zero-to-nix.com/. For details and to offer feedback on the deprecation process, see: https://github.com/DeterminateSystems/nix-src/issues/34.
+
+* **Warn users against indirect flake references in `flake.nix` inputs**
+
+This is the first change accomplishing our roadmap item of deprecating implicit and indirect flake inputs: https://github.com/DeterminateSystems/nix-src/issues/37
+
+The flake registry provides an important UX affordance for using Nix flakes and remote sources in command line uses.
+For that reason, the registry is not being deprecated entirely and will still be used for command-line incantations, like nix run.
+
+This move will eliminate user confusion and surprising behavior around global and local registries during flake input resolution.
+
+The goal of this change is to make the user experience of Nix more predictable.
+We have seen a pattern of confusion when using automatic flake inputs and local registries.
+Specifically, users' flake inputs resolving and locking inconsistently depending on the configuration of the host system.
+
+Users will now see the following warning if their flake.nix uses an implicit or indirect Flake reference input:
+
+> Flake input 'nixpkgs' uses the flake registry. Using the registry in flake inputs is deprecated in Determinate Nix. To make your flake future-proof, add the following to 'xxx/flake.nix':
+>
+> inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+>
+> For more information, see: https://github.com/DeterminateSystems/nix-src/issues/37
+
+
+### Other updates:
+* Improve the "dirty tree" message. Determinate Nix will now say `Git tree '...' has uncommitted changes` instead of `Git tree '...' is dirty`
+* Stop warning about uncommitted changes in a Git repository when using `nix develop`
diff --git a/doc/manual/source/release-notes-determinate/rl-3.4.2.md b/doc/manual/source/release-notes-determinate/rl-3.4.2.md
new file mode 100644
index 00000000000..8acabd4425f
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.4.2.md
@@ -0,0 +1,4 @@
+# Release 3.4.2 (2025-05-05)
+
+* Based on [upstream Nix 2.28.3](../release-notes/rl-2.28.md).
+
diff --git a/doc/manual/source/release-notes-determinate/rl-3.5.0.md b/doc/manual/source/release-notes-determinate/rl-3.5.0.md
new file mode 100644
index 00000000000..d5b26b9419e
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.5.0.md
@@ -0,0 +1,4 @@
+# Release 3.5.0 (2025-05-09)
+
+* Based on [upstream Nix 2.28.3](../release-notes/rl-2.28.md).
+
diff --git a/doc/manual/source/release-notes-determinate/rl-3.5.1.md b/doc/manual/source/release-notes-determinate/rl-3.5.1.md
new file mode 100644
index 00000000000..b0813ca59c9
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.5.1.md
@@ -0,0 +1,57 @@
+# Release 3.5.1 (2025-05-09)
+
+* Based on [upstream Nix 2.28.3](../release-notes/rl-2.28.md).
+
+## What's Changed
+
+Most notably, Lazy Trees has merged in to Determinate Nix and is in Feature Preview status, but remains disabled by default.
+Lazy trees massively improves performance in virtually all scenarios because it enables Nix to avoid making unnecessary copies of files into the Nix store.
+In testing, we saw iteration times on Nixpkgs **drop from over 12 seconds to 3.5 seconds**.
+
+After upgrading to Determinate Nix 3.5.1 with `sudo determinate-nixd upgrade`, enable lazy trees by adding this to `/etc/nix/nix.custom.conf`:
+
+```
+lazy-trees = true
+```
+
+Please note that our full flake regression test suite passes with no changes with lazy trees, and please report compatibility issues.
+
+Read [this GitHub comment](https://github.com/DeterminateSystems/nix-src/pull/27#pullrequestreview-2822153088) for further details and next steps.
+We'll be publishing an update on the [Determinate Systems blog](https://determinate.systems/posts/) in the next few days with more information as well.
+
+Relevant PRs:
+* Lazy trees v2 by @edolstra in [DeterminateSystems/nix-src#27](https://github.com/DeterminateSystems/nix-src/pull/27)
+* Improve lazy trees backward compatibility by @edolstra in [DeterminateSystems/nix-src#56](https://github.com/DeterminateSystems/nix-src/pull/56)
+
+
+### Additional changes in this release:
+* Bug fix: Flake input URLs are canonicalized before checking flake.lock file staleness, avoiding needlessly regenerating flake.lock files with `dir` in URL-style flakerefs by @edolstra in [DeterminateSystems/nix-src#57](https://github.com/DeterminateSystems/nix-src/pull/57)
+* `nix upgrade-nix` is deprecated in favor of `determinate-nixd upgrade`, by @gustavderdrache in [DeterminateSystems/nix-src#55](https://github.com/DeterminateSystems/nix-src/pull/55)
+* UX: Improved build failure and dependency failure error messages to include needed output paths by @edolstra in [DeterminateSystems/nix-src#58](https://github.com/DeterminateSystems/nix-src/pull/58).
+
+Previously:
+
+```
+error: builder for '/nix/store/[...]-nested-failure-bottom.drv' failed with exit code 1
+error: 1 dependencies of derivation '/nix/store/[...]-nested-failure-middle.drv' failed to build
+error: 1 dependencies of derivation '/nix/store/[...]-nested-failure-top.drv' failed to build
+```
+
+Now:
+
+```
+error: Cannot build '/nix/store/w37gflm9wz9dcnsgy3sfrmnlvm8qigaj-nested-failure-bottom.drv'.
+ Reason: builder failed with exit code 1.
+ Output paths:
+ /nix/store/yzybs8kp35dfipbzdlqcc6lxz62hax04-nested-failure-bottom
+error: Cannot build '/nix/store/00gr5hlxfc03x2675w6nn3pwfrz2fr62-nested-failure-middle.drv'.
+ Reason: 1 dependency failed.
+ Output paths:
+ /nix/store/h781j5h4bdchmb4c2lvy8qzh8733azhz-nested-failure-middle
+error: Cannot build '/nix/store/8am0ng1gyx8sbzyr0yx6jd5ix3yy5szc-nested-failure-top.drv'.
+ Reason: 1 dependency failed.
+ Output paths:
+ /nix/store/fh12637kgvp906s9yhi9w2dc7ghfwxs1-nested-failure-top
+```
+
+**Full Changelog**: [v3.4.2...v3.5.1](https://github.com/DeterminateSystems/nix-src/compare/v3.4.2...v3.5.1)
diff --git a/doc/manual/source/release-notes-determinate/rl-3.5.2.md b/doc/manual/source/release-notes-determinate/rl-3.5.2.md
new file mode 100644
index 00000000000..bc5396c255b
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.5.2.md
@@ -0,0 +1,11 @@
+# Release 3.5.2 (2025-05-12)
+
+* Based on [upstream Nix 2.28.3](../release-notes/rl-2.28.md).
+
+## What's Changed
+* Fix a regression where narHash was not added to lock files when lazy trees were disabled by @edolstra in [DeterminateSystems/nix-src#63](https://github.com/DeterminateSystems/nix-src/pull/63)
+
+* Tell users a source is corrupted ("cannot read file from tarball: Truncated tar archive detected while reading data"), improving over the previous 'cannot read file from tarball' error by @edolstra in [DeterminateSystems/nix-src#64](https://github.com/DeterminateSystems/nix-src/pull/64)
+
+
+**Full Changelog**: [v3.5.1...v3.5.2](https://github.com/DeterminateSystems/nix-src/compare/v3.5.1...v3.5.2)
diff --git a/doc/manual/source/release-notes-determinate/rl-3.6.0.md b/doc/manual/source/release-notes-determinate/rl-3.6.0.md
new file mode 100644
index 00000000000..453ab6c301d
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.6.0.md
@@ -0,0 +1,11 @@
+# Release 3.6.0 (2025-05-22)
+
+* Based on [upstream Nix 2.29.0](../release-notes/rl-2.29.md).
+
+## What's Changed
+* Install 'nix profile add' manpage by @edolstra in [DeterminateSystems/nix-src#69](https://github.com/DeterminateSystems/nix-src/pull/69)
+* Sync with upstream 2.29.0 by @edolstra in [DeterminateSystems/nix-src#67](https://github.com/DeterminateSystems/nix-src/pull/67)
+* Emit warnings when using import-from-derivation by setting the `trace-import-from-derivation` option to `true` by @gustavderdrache in [DeterminateSystems/nix-src#70](https://github.com/DeterminateSystems/nix-src/pull/70)
+
+
+**Full Changelog**: [v3.5.2...v3.6.0](https://github.com/DeterminateSystems/nix-src/compare/v3.5.2...v3.6.0)
diff --git a/doc/manual/source/release-notes-determinate/rl-3.6.1.md b/doc/manual/source/release-notes-determinate/rl-3.6.1.md
new file mode 100644
index 00000000000..12505afee27
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.6.1.md
@@ -0,0 +1,9 @@
+# Release 3.6.1 (2025-05-24)
+
+* Based on [upstream Nix 2.29.0](../release-notes/rl-2.29.md).
+
+## What's Changed
+* Fix nlohmann error in fromStructuredAttrs() by @edolstra in [DeterminateSystems/nix-src#73](https://github.com/DeterminateSystems/nix-src/pull/73)
+
+
+**Full Changelog**: [v3.6.0...v3.6.1](https://github.com/DeterminateSystems/nix-src/compare/v3.6.0...v3.6.1)
diff --git a/doc/manual/source/release-notes-determinate/rl-3.6.2.md b/doc/manual/source/release-notes-determinate/rl-3.6.2.md
new file mode 100644
index 00000000000..882c142f00c
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.6.2.md
@@ -0,0 +1,15 @@
+# Release 3.6.2 (2025-06-02)
+
+* Based on [upstream Nix 2.29.0](../release-notes/rl-2.29.md).
+
+## What's Changed
+* Dramatically improve the performance of nix store copy-sigs: Use http-connections setting to control parallelism by @edolstra in [DeterminateSystems/nix-src#80](https://github.com/DeterminateSystems/nix-src/pull/80)
+* Document how to replicate nix-store --query --deriver with the nix cli by @grahamc in [DeterminateSystems/nix-src#82](https://github.com/DeterminateSystems/nix-src/pull/82)
+* The garbage collector no longer gives up if it encounters an undeletable file, by @edolstra in [DeterminateSystems/nix-src#83](https://github.com/DeterminateSystems/nix-src/pull/83)
+* nix profile: Replace ε and ∅ with descriptive English words by @grahamc in [DeterminateSystems/nix-src#81](https://github.com/DeterminateSystems/nix-src/pull/81)
+* Rework README to clarify that this distribution is our distribution, by @lucperkins in [DeterminateSystems/nix-src#84](https://github.com/DeterminateSystems/nix-src/pull/84)
+* Include the source location when warning about inefficient double copies by @edolstra in [DeterminateSystems/nix-src#79](https://github.com/DeterminateSystems/nix-src/pull/79)
+* Call out that `--keep-failed` with remote builders will keep the failed build directory on that builder by @cole-h in [DeterminateSystems/nix-src#85](https://github.com/DeterminateSystems/nix-src/pull/85)
+
+
+**Full Changelog**: [v3.6.1...v3.6.2](https://github.com/DeterminateSystems/nix-src/compare/v3.6.1...v3.6.2)
diff --git a/doc/manual/source/release-notes-determinate/rl-3.6.5.md b/doc/manual/source/release-notes-determinate/rl-3.6.5.md
new file mode 100644
index 00000000000..8ef5be0fd0d
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.6.5.md
@@ -0,0 +1,19 @@
+# Release 3.6.5 (2025-06-12)
+
+* Based on [upstream Nix 2.29.0](../release-notes/rl-2.29.md).
+
+## What's Changed
+* When remote building with --keep-failed, only show "you can rerun" message if the derivation's platform is supported on this machine by @cole-h in [DeterminateSystems/nix-src#87](https://github.com/DeterminateSystems/nix-src/pull/87)
+* Indicate that sandbox-paths specifies a missing file in the corresponding error message. by @cole-h in [DeterminateSystems/nix-src#88](https://github.com/DeterminateSystems/nix-src/pull/88)
+* Render lazy tree paths in messages withouth the/nix/store/hash... prefix in substituted source trees by @edolstra in [DeterminateSystems/nix-src#91](https://github.com/DeterminateSystems/nix-src/pull/91)
+* Use FlakeHub inputs by @lucperkins in [DeterminateSystems/nix-src#89](https://github.com/DeterminateSystems/nix-src/pull/89)
+* Proactively cache more flake inputs and fetches by @edolstra in [DeterminateSystems/nix-src#93](https://github.com/DeterminateSystems/nix-src/pull/93)
+* Fix: register extra builtins just once by @edolstra in [DeterminateSystems/nix-src#97](https://github.com/DeterminateSystems/nix-src/pull/97)
+* Fix the link to `builders-use-substitutes` documentation for `builders` by @lucperkins in [DeterminateSystems/nix-src#102](https://github.com/DeterminateSystems/nix-src/pull/102)
+* Improve error messages that use the hypothetical future tense of "will" by @lucperkins in [DeterminateSystems/nix-src#92](https://github.com/DeterminateSystems/nix-src/pull/92)
+* Make the `nix repl` test more stable by @edolstra in [DeterminateSystems/nix-src#103](https://github.com/DeterminateSystems/nix-src/pull/103)
+* Run nixpkgsLibTests against lazy trees by @edolstra in [DeterminateSystems/nix-src#100](https://github.com/DeterminateSystems/nix-src/pull/100)
+* Run the Nix test suite against lazy trees by @edolstra in [DeterminateSystems/nix-src#105](https://github.com/DeterminateSystems/nix-src/pull/105)
+* Improve caching of inputs by @edolstra in [DeterminateSystems/nix-src#98](https://github.com/DeterminateSystems/nix-src/pull/98), [DeterminateSystems/nix-src#110](https://github.com/DeterminateSystems/nix-src/pull/110), and [DeterminateSystems/nix-src#115](https://github.com/DeterminateSystems/nix-src/pull/115)
+
+**Full Changelog**: [v3.6.2...v3.6.5](https://github.com/DeterminateSystems/nix-src/compare/v3.6.2...v3.6.4)
diff --git a/doc/manual/source/release-notes-determinate/rl-3.6.6.md b/doc/manual/source/release-notes-determinate/rl-3.6.6.md
new file mode 100644
index 00000000000..bf4e3690afa
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.6.6.md
@@ -0,0 +1,7 @@
+# Release 3.6.6 (2025-06-17)
+
+* Based on [upstream Nix 2.29.0](../release-notes/rl-2.29.md).
+
+## What's Changed
+
+* No-op release on the nix-src side, due to a regression on nix-darwin in determinate-nixd.
diff --git a/doc/manual/source/release-notes-determinate/rl-3.6.7.md b/doc/manual/source/release-notes-determinate/rl-3.6.7.md
new file mode 100644
index 00000000000..197587f1b3a
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.6.7.md
@@ -0,0 +1,17 @@
+# Release 3.6.7 (2025-06-24)
+
+* Based on [upstream Nix 2.29.1](../release-notes/rl-2.29.md).
+
+## What's Changed
+
+### Security contents
+
+* Patched against GHSA-g948-229j-48j3
+
+### Lazy trees:
+
+* Lazy trees now produces `flake.lock` files with NAR hashes unless `lazy-locks` is set to `true` by @edolstra in [DeterminateSystems/nix-src#113](https://github.com/DeterminateSystems/nix-src/pull/113)
+* Improved caching with lazy-trees when using --impure, with enhanced testing by @edolstra in [DeterminateSystems/nix-src#117](https://github.com/DeterminateSystems/nix-src/pull/117)
+
+
+**Full Changelog**: [v3.6.6...v3.6.7](https://github.com/DeterminateSystems/nix-src/compare/v3.6.6...v3.6.7)
diff --git a/doc/manual/source/release-notes-determinate/rl-3.6.8.md b/doc/manual/source/release-notes-determinate/rl-3.6.8.md
new file mode 100644
index 00000000000..c4b4b96c9e7
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.6.8.md
@@ -0,0 +1,12 @@
+# Release 3.6.8 (2025-06-25)
+
+* Based on [upstream Nix 2.29.1](../release-notes/rl-2.29.md).
+
+## What's Changed
+* Fix fetchToStore() caching with --impure, improve testing by @edolstra in [DeterminateSystems/nix-src#117](https://github.com/DeterminateSystems/nix-src/pull/117)
+* Add lazy-locks setting by @edolstra in [DeterminateSystems/nix-src#113](https://github.com/DeterminateSystems/nix-src/pull/113)
+* Sync 2.29.1 by @edolstra in [DeterminateSystems/nix-src#124](https://github.com/DeterminateSystems/nix-src/pull/124)
+* Release v3.6.7 by @github-actions in [DeterminateSystems/nix-src#126](https://github.com/DeterminateSystems/nix-src/pull/126)
+
+
+**Full Changelog**: [v3.6.6...v3.6.8](https://github.com/DeterminateSystems/nix-src/compare/v3.6.6...v3.6.8)
diff --git a/doc/manual/source/release-notes-determinate/rl-3.7.0.md b/doc/manual/source/release-notes-determinate/rl-3.7.0.md
new file mode 100644
index 00000000000..615e858592e
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.7.0.md
@@ -0,0 +1,63 @@
+# Release 3.7.0 (2025-07-03)
+
+- Based on [upstream Nix 2.29.1](../release-notes/rl-2.29.md).
+
+## What's Changed
+
+### Prefetch flake inputs in parallel
+
+By @edolstra in [DeterminateSystems/nix-src#127](https://github.com/DeterminateSystems/nix-src/pull/127)
+
+This release brings the command `nix flake prefetch-inputs`.
+
+Flake inputs are typically fetched "just in time."
+That means Nix fetches a flake input when the evaluator needs it, and not before.
+When the evaluator needs an input, evaluation is paused until the source is available.
+
+This causes a significant slow-down on projects with lots of flake inputs.
+
+The new command `nix flake prefetch-inputs` fetches all flake inputs in parallel.
+We expect running this new command before building will dramatically improve evaluation performance for most projects, especially in CI.
+Note that projects which with many unused flake inputs may not benefit from this change, since the new command fetches every input whether they're used or not.
+
+### Deep flake input overrides now work as expected
+
+By @edolstra in [DeterminateSystems/nix-src#108](https://github.com/DeterminateSystems/nix-src/pull/108)
+
+An override like:
+
+```
+inputs.foo.inputs.bar.inputs.nixpkgs.follows = "nixpkgs";
+```
+
+implicitly set `inputs.foo.inputs.bar` to `flake:bar`, which led to an unexpected error like:
+
+```
+error: cannot find flake 'flake:bar' in the flake registries
+```
+
+We now no longer create a parent override (like for `foo.bar` in the example above) if it doesn't set an explicit ref or follows attribute.
+We only recursively apply its child overrides.
+
+### `nix store delete` now shows you why deletion was not possible
+
+By @edolstra in [DeterminateSystems/nix-src#130](https://github.com/DeterminateSystems/nix-src/pull/130)
+
+For example:
+
+```
+error: Cannot delete path '/nix/store/6fcrjgfjip2ww3sx51rrmmghfsf60jvi-patchelf-0.14.3'
+ because it's referenced by the GC root '/home/eelco/Dev/nix-master/build/result'.
+
+error: Cannot delete path '/nix/store/lf3lrf8bjfn8xvr0az9q96y989sxs5r9-cowsay-3.8.4'
+ because it's referenced by the GC root '/proc/3600568/environ'.
+
+error: Cannot delete path '/nix/store/klyng5rpdkwi5kbxkncy4gjwb490dlhb-foo.drv'
+ because it's in use by '{nix-process:3605324}'.
+```
+
+### Lazy-tree improvements
+
+- Improved lazy-tree evaluation caching for flakes accessed with a `path` flakeref by @edolstra in [DeterminateSystems/nix-src#131](https://github.com/DeterminateSystems/nix-src/pull/131)
+
+**Full Changelog**: [v3.6.8...v3.7.0](https://github.com/DeterminateSystems/nix-src/compare/v3.6.8...v3.7.0)
diff --git a/doc/manual/source/release-notes-determinate/rl-3.8.0.md b/doc/manual/source/release-notes-determinate/rl-3.8.0.md
new file mode 100644
index 00000000000..4103d6df94e
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.8.0.md
@@ -0,0 +1,29 @@
+# Release 3.8.0 (2025-07-10)
+
+* Based on [upstream Nix 2.30.0](../release-notes/rl-2.30.md).
+
+## What's Changed
+
+### Faster CI with `nix flake check`
+
+`nix flake check` no longer downloads flake outputs if no building is necessary.
+
+This command is intended to validate that a flake can fully evaluate and all outputs can build.
+If the outputs are available in a binary cache then both properties are confirmed to be true.
+Notably, downloading the output from the binary cache is not strictly necessary for the validation.
+
+Previously, `nix flake check` would download a flake output if the full build is available in a binary cache.
+
+Some users will find this change significantly reduces costly bandwidth and CI workflow time.
+
+PR: [DeterminateSystems/nix-src#134](https://github.com/DeterminateSystems/nix-src/pull/134)
+
+### Improved flake locking of transitive dependencies
+
+Determinate Nix now re-locks all transitive dependencies when changing a flake input's source URL.
+
+This fixes an issue where in some scenarios Nix would not re-lock those inputs and incorrectly use the old inputs' dependencies.
+
+PR: [DeterminateSystems/nix-src#137](https://github.com/DeterminateSystems/nix-src/pull/137)
+
+**Full Changelog**: [v3.7.0...v3.8.0](https://github.com/DeterminateSystems/nix-src/compare/v3.7.0...v3.8.0)
diff --git a/doc/manual/source/release-notes-determinate/rl-3.8.1.md b/doc/manual/source/release-notes-determinate/rl-3.8.1.md
new file mode 100644
index 00000000000..90dc328f6ec
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.8.1.md
@@ -0,0 +1,9 @@
+# Release 3.8.1 (2025-07-11)
+
+* Based on [upstream Nix 2.30.0](../release-notes/rl-2.30.md).
+
+## What's Changed
+* Address ifdef problem with macOS/BSD sandboxing by @gustavderdrache in [DeterminateSystems/nix-src#142](https://github.com/DeterminateSystems/nix-src/pull/142)
+
+
+**Full Changelog**: [v3.8.0...v3.8.1](https://github.com/DeterminateSystems/nix-src/compare/v3.8.0...v3.8.1)
diff --git a/doc/manual/source/release-notes-determinate/rl-3.8.2.md b/doc/manual/source/release-notes-determinate/rl-3.8.2.md
new file mode 100644
index 00000000000..638d90f6841
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.8.2.md
@@ -0,0 +1,10 @@
+# Release 3.8.2 (2025-07-12)
+
+* Based on [upstream Nix 2.30.0](../release-notes/rl-2.30.md).
+
+## What's Changed
+* ci: don't run the full test suite for x86_64-darwin by @grahamc in [DeterminateSystems/nix-src#144](https://github.com/DeterminateSystems/nix-src/pull/144)
+* Try publishing the manual again by @grahamc in [DeterminateSystems/nix-src#145](https://github.com/DeterminateSystems/nix-src/pull/145)
+
+
+**Full Changelog**: [v3.8.1...v3.8.2](https://github.com/DeterminateSystems/nix-src/compare/v3.8.1...v3.8.2)
diff --git a/doc/manual/source/release-notes-determinate/rl-3.8.3.md b/doc/manual/source/release-notes-determinate/rl-3.8.3.md
new file mode 100644
index 00000000000..d3eb02bc7ea
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.8.3.md
@@ -0,0 +1,26 @@
+# Release 3.8.3 (2025-07-18)
+
+* Based on [upstream Nix 2.30.1](../release-notes/rl-2.30.md).
+
+## What's Changed
+
+### Non-blocking evaluation caching
+
+Users reported evaluation would occasionally block other evaluation processes.
+
+The evaluation cache database is now opened in write-ahead mode to prevent delaying evaluations.
+
+PR: [DeterminateSystems/nix-src#150](https://github.com/DeterminateSystems/nix-src/pull/150)
+
+### New experimental feature: `external-builders`
+
+This experimental feature allows Nix to call an external program for the build environment.
+
+The interface and behavior of this feature may change at any moment without a correspondingly major semver version change.
+
+PRs:
+- [DeterminateSystems/nix-src#141](https://github.com/DeterminateSystems/nix-src/pull/141)
+- [DeterminateSystems/nix-src#152](https://github.com/DeterminateSystems/nix-src/pull/152)
+- [DeterminateSystems/nix-src#78](https://github.com/DeterminateSystems/nix-src/pull/78)
+
+**Full Changelog**: [v3.8.2...v3.8.3](https://github.com/DeterminateSystems/nix-src/compare/v3.8.2...v3.8.3)
diff --git a/doc/manual/source/release-notes-determinate/rl-3.8.4.md b/doc/manual/source/release-notes-determinate/rl-3.8.4.md
new file mode 100644
index 00000000000..7c73e75ca02
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.8.4.md
@@ -0,0 +1,9 @@
+# Release 3.8.4 (2025-07-21)
+
+* Based on [upstream Nix 2.30.1](../release-notes/rl-2.30.md).
+
+## What's Changed
+* Revert "Use WAL mode for SQLite cache databases" by @grahamc in [DeterminateSystems/nix-src#155](https://github.com/DeterminateSystems/nix-src/pull/155)
+
+
+**Full Changelog**: [v3.8.3...v3.8.4](https://github.com/DeterminateSystems/nix-src/compare/v3.8.3...v3.8.4)
diff --git a/doc/manual/source/release-notes-determinate/rl-3.8.5.md b/doc/manual/source/release-notes-determinate/rl-3.8.5.md
new file mode 100644
index 00000000000..0f1bbe6f99d
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/rl-3.8.5.md
@@ -0,0 +1,58 @@
+## What's Changed
+
+### Less time "unpacking into the Git cache"
+
+Unpacking sources into the user's cache is now takes 1/2 to 1/4 of the time it used to.
+Previously, Nix serially unpacked sources into the cache.
+This change takes better advantage of our users' hardware by parallelizing the import.
+Real life testing shows an initial Nixpkgs import takes 3.6s on Linux, when it used to take 11.7s.
+
+PR: [DeterminateSystems/nix-src#149](https://github.com/DeterminateSystems/nix-src/pull/149)
+
+### Copy paths to the daemon in parallel
+
+Determinate Nix's evaluator no longer blocks evaluation when copying paths to the store.
+Previously, Nix would pause evaluation when it needed to add files to the store.
+Now, the copying is performed in the background allowing evaluation to proceed.
+
+PR: [DeterminateSystems/nix-src#162](https://github.com/DeterminateSystems/nix-src/pull/162)
+
+### Faster Nix evaluation by reducing duplicate Nix daemon queries
+
+Determinate Nix more effectively caches store path validity data within a single evaluation.
+Previously, the Nix client would perform many thousands of exra Nix daemon requests.
+Each extra request takes real time, and this change reduced a sample evaluation by over 12,000 requests.
+
+PR: [DeterminateSystems/nix-src#157](https://github.com/DeterminateSystems/nix-src/pull/157)
+
+### More responsive tab completion
+
+Tab completion now implies the "--offline" flag, which disables most network requests.
+Previously, tab completing Nix arguments would attempt to fetch sources and access binary caches.
+Operating in offline mode improves the interactive experience of Nix when tab completing.
+
+PR: [DeterminateSystems/nix-src#161](https://github.com/DeterminateSystems/nix-src/pull/161)
+
+### ZFS users: we fixed the mysterious stall.
+
+Opening the Nix database is usually instantaneous but sometimes has a several second latency.
+Determinate Nix works around this issue, eliminating the frustrating random stall when running Nix commands.
+
+PR: [DeterminateSystems/nix-src#158](https://github.com/DeterminateSystems/nix-src/pull/158)
+
+### Other changes
+
+* Determinate Nix is now fully formatted by clang-format, making it easier than ever to contribute to the project.
+
+PR: [DeterminateSystems/nix-src#159](https://github.com/DeterminateSystems/nix-src/pull/159)
+
+* Determinate Nix is now based on upstream Nix 2.30.2.
+
+PR: [DeterminateSystems/nix-src#160](https://github.com/DeterminateSystems/nix-src/pull/160)
+
+* Determinate Nix now uses `main` as our development branch, moving away from `detsys-main`.
+
+PRs:
+* [DeterminateSystems/nix-src#164](https://github.com/DeterminateSystems/nix-src/pull/164)
+* [DeterminateSystems/nix-src#166](https://github.com/DeterminateSystems/nix-src/pull/166)
+
diff --git a/doc/manual/source/release-notes-determinate/v3.10.0.md b/doc/manual/source/release-notes-determinate/v3.10.0.md
new file mode 100644
index 00000000000..c644dd78744
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/v3.10.0.md
@@ -0,0 +1,10 @@
+# Release 3.10.0 (2025-09-02)
+
+* Based on [upstream Nix 2.31.0](../release-notes/rl-2.31.md).
+
+## What's Changed
+
+This release rebases Determinate Nix on upstream Nix 2.31.0.
+
+
+**Full Changelog**: [v3.9.1...v3.10.0](https://github.com/DeterminateSystems/nix-src/compare/v3.9.1...v3.10.0)
diff --git a/doc/manual/source/release-notes-determinate/v3.10.1.md b/doc/manual/source/release-notes-determinate/v3.10.1.md
new file mode 100644
index 00000000000..08cbe4fd058
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/v3.10.1.md
@@ -0,0 +1,9 @@
+# Release 3.10.1 (2025-09-02)
+
+* Based on [upstream Nix 2.31.1](../release-notes/rl-2.31.md).
+
+## What's Changed
+This release rebases Determinate Nix on upstream Nix 2.31.1.
+
+
+**Full Changelog**: [v3.10.0...v3.10.1](https://github.com/DeterminateSystems/nix-src/compare/v3.10.0...v3.10.1)
diff --git a/doc/manual/source/release-notes-determinate/v3.11.0.md b/doc/manual/source/release-notes-determinate/v3.11.0.md
new file mode 100644
index 00000000000..7abb665a5a9
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/v3.11.0.md
@@ -0,0 +1,36 @@
+# Release 3.11.0 (2025-09-03)
+
+- Based on [upstream Nix 2.31.1](../release-notes/rl-2.31.md).
+
+## What's Changed
+
+### Parallel evaluation
+
+The following commands are now able to evaluate Nix expressions in parallel:
+
+- `nix search`
+- `nix flake check`
+- `nix flake show`
+- `nix eval --json`
+
+This is currently in developer preview, and we'll be turning it on for more users in the coming weeks.
+If you would like to try it right away, specify `eval-cores` in your `/etc/nix/nix.custom.conf`:
+
+```ini
+eval-cores = 0 # Evaluate across all cores
+```
+
+Further, we introduced a new builtin: `builtins.parallel`.
+This new builtin allows users to explicitly parallelize evaluation within a Nix expression.
+
+Using this new builtin requires turning on an additional experimental feature:
+
+```ini
+extra-experimental-features = parallel-eval
+```
+
+Please note that this new builtin is subject to change semantics or even go away during the developer preview.
+
+PR: [DeterminateSystems/nix-src#125](https://github.com/DeterminateSystems/nix-src/pull/125)
+
+**Full Changelog**: [v3.10.1...v3.11.0](https://github.com/DeterminateSystems/nix-src/compare/v3.10.1...v3.11.0)
diff --git a/doc/manual/source/release-notes-determinate/v3.11.1.md b/doc/manual/source/release-notes-determinate/v3.11.1.md
new file mode 100644
index 00000000000..30597164333
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/v3.11.1.md
@@ -0,0 +1,9 @@
+# Release 3.11.1 (2025-09-04)
+
+* Based on [upstream Nix 2.31.1](../release-notes/rl-2.31.md).
+
+## What's Changed
+* Fix race condition in Value::isTrivial() by @edolstra in [DeterminateSystems/nix-src#192](https://github.com/DeterminateSystems/nix-src/pull/192)
+
+
+**Full Changelog**: [v3.11.0...v3.11.1](https://github.com/DeterminateSystems/nix-src/compare/v3.11.0...v3.11.1)
diff --git a/doc/manual/source/release-notes-determinate/v3.11.2.md b/doc/manual/source/release-notes-determinate/v3.11.2.md
new file mode 100644
index 00000000000..ac4fe569dff
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/v3.11.2.md
@@ -0,0 +1,24 @@
+# Release 3.11.2 (2025-09-12)
+
+* Based on [upstream Nix 2.31.1](../release-notes/rl-2.31.md).
+
+## What's Changed
+
+### Fix some interactions with the registry and flakes that include a `?dir=` parameter
+
+Some users were experiencing issues when their flake registry contained a flake that included a `?dir=` parameter, causing commands like `nix eval registry-with-flake-in-subdir#output` and those that used --inputs-from` to fail or behave incorrectly.
+
+This is now fixed, so use your flakes inside subdirs without fear!
+
+PRs: [DeterminateSystems/nix-src#196](https://github.com/DeterminateSystems/nix-src/pull/196), [DeterminateSystems/nix-src#199](https://github.com/DeterminateSystems/nix-src/pull/199)
+
+### Only substitute inputs if they haven't already been fetched
+
+When using `lazy-trees`, you might have noticed Nix fetching some source inputs from a cache, even though you could have sworn it already fetched those inputs!
+
+This fixes that behavior such that Nix will try to fetch inputs from their original location, and only if that fails fall back to fetching from a substituter.
+
+PR: [DeterminateSystems/nix-src#202](https://github.com/DeterminateSystems/nix-src/pull/202)
+
+
+**Full Changelog**: [v3.11.1...v3.11.2](https://github.com/DeterminateSystems/nix-src/compare/v3.11.1...v3.11.2)
diff --git a/doc/manual/source/release-notes-determinate/v3.11.3.md b/doc/manual/source/release-notes-determinate/v3.11.3.md
new file mode 100644
index 00000000000..fab5ed51a4b
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/v3.11.3.md
@@ -0,0 +1,34 @@
+# Release 3.11.3 (2025-10-09)
+
+* Based on [upstream Nix 2.31.2](../release-notes/rl-2.31.md).
+
+## What's Changed
+
+### Fix some bugs and interactions with parallel eval
+
+We received some reports of parallel eval having issues, such as not being able to be interrupted, infinite recursion hanging forever, and segfaults when using the experimental `builtins.parallel`.
+
+Those have now been fixed.
+
+Additionally, the debugger now disables parallel eval, because the two features are incompatible.
+
+PRs: [DeterminateSystems/nix-src#206](https://github.com/DeterminateSystems/nix-src/pull/206), [DeterminateSystems/nix-src#213](https://github.com/DeterminateSystems/nix-src/pull/213), [DeterminateSystems/nix-src#218](https://github.com/DeterminateSystems/nix-src/pull/218), [DeterminateSystems/nix-src#205](https://github.com/DeterminateSystems/nix-src/pull/205)
+
+### `NIX_SSHOPTS` + `ssh-ng://root@localhost` fix
+
+We noticed that specifying `NIX_SSHOPTS=-p2222` when using a command that uses SSH (such as `nix copy --to ssh-ng://root@localhost`) stopped respecting the `NIX_SSHOPTS` setting because of an incorrect comparison.
+
+This has been fixed, so `NIX_SSHOPTS` and SSH stores that are accessed like `user@localhost` work again.
+
+PR: [DeterminateSystems/nix-src#219](https://github.com/DeterminateSystems/nix-src/pull/219)
+
+### Fix `error: [json.exception.type_error.302] type must be string, but is array` when using `exportReferencesGraph`
+
+We received a report of a `nix build` failing on a specific flake due to its expression using `exportReferencesGraph` with a heterogeneous array of dependencies, causing this inscrutable error.
+
+This specific case has been broken since Nix 2.29.0, and is now fixed.
+
+PRs: [DeterminateSystems/nix-src#221](https://github.com/DeterminateSystems/nix-src/pull/221), [DeterminateSystems/nix-src#225](https://github.com/DeterminateSystems/nix-src/pull/225)
+
+
+**Full Changelog**: [v3.11.2...v3.11.3](https://github.com/DeterminateSystems/nix-src/compare/v3.11.2...v3.11.3)
diff --git a/doc/manual/source/release-notes-determinate/v3.12.0.md b/doc/manual/source/release-notes-determinate/v3.12.0.md
new file mode 100644
index 00000000000..55c1f10bf15
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/v3.12.0.md
@@ -0,0 +1,17 @@
+# Release 3.12.0 (2025-10-23)
+
+* Based on [upstream Nix 2.32.1](../release-notes/rl-2.32.md).
+
+## What's Changed
+
+### `nix nario`
+
+Determinate Nix has a new command, `nix nario`, that replaces the commands `nix-store --export` and `nix-store --import` from the old CLI. `nix nario` allows you to serialize store paths to a file that can be imported into another Nix store. It is backwards compatible with the file format generated by `nix-store --export`. It also provides a new format (selected by passing `--format 2`) that supports store path attributes such as signatures, and allows store paths to be imported more efficiently.
+
+### Other changes
+
+`nix flake clone` now supports arbitrary input types. In particular, this allows you to clone tarball flakes, such as flakes on FlakeHub.
+
+When using `-vv`, Determinate Nix now prints the Nix version. This is useful when diagnosing Nix problems from the debug output of a Nix run.
+
+**Full Changelog**: [v3.11.3...v3.12.0](https://github.com/DeterminateSystems/nix-src/compare/v3.11.3...v3.12.0)
diff --git a/doc/manual/source/release-notes-determinate/v3.12.1.md b/doc/manual/source/release-notes-determinate/v3.12.1.md
new file mode 100644
index 00000000000..1be2b48e26d
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/v3.12.1.md
@@ -0,0 +1,10 @@
+# Release 3.12.1 (2025-11-04)
+
+* Based on [upstream Nix 2.32.1](../release-notes/rl-2.32.md).
+
+## What's Changed
+* Allow access to the result of fetchClosure by @edolstra in [DeterminateSystems/nix-src#241](https://github.com/DeterminateSystems/nix-src/pull/241)
+* libstore/build: fixup JSON logger missing the resBuildResult result event by @cole-h in [DeterminateSystems/nix-src#246](https://github.com/DeterminateSystems/nix-src/pull/246)
+
+
+**Full Changelog**: [v3.12.0...v3.12.1](https://github.com/DeterminateSystems/nix-src/compare/v3.12.0...v3.12.1)
diff --git a/doc/manual/source/release-notes-determinate/v3.12.2.md b/doc/manual/source/release-notes-determinate/v3.12.2.md
new file mode 100644
index 00000000000..4c8c3169aa7
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/v3.12.2.md
@@ -0,0 +1,42 @@
+# Release 3.12.2 (2025-11-05)
+
+* Based on [upstream Nix 2.32.2](../release-notes/rl-2.32.md).
+
+## What's Changed
+
+### Faster `revCount` computation
+
+When using Git repositories with a long history, calculating the `revCount` attribute can take a long time. Determinate Nix now computes `revCount` using multiple threads, making it much faster.
+
+Note that if you don't need `revCount`, you can disable it altogether by setting the flake input attribute `shallow = true`.
+
+PR: [DeterminateSystems/nix-src#245](https://github.com/DeterminateSystems/nix-src/pull/245)
+
+### More readable error messages
+
+Previously, Nix showed full flakerefs in error messages such as stack traces, e.g.
+```
+ … from call site
+ at «github:NixOS/nixpkgs/3bea86e918d8b54aa49780505d2d4cd9261413be?narHash=sha256-Ica%2B%2BSXFuLyxX9Q7YxhfZulUif6/gwM8AEQYlUxqSgE%3D»/lib/customisation.nix:69:16:
+ 68| let
+ 69| result = f origArgs;
+ | ^
+ 70|
+```
+It now abbreviates these by leaving out `narHash` and shortening Git revisions:
+```
+ … from call site
+ at «github:NixOS/nixpkgs/3bea86e»/lib/customisation.nix:69:16:
+ 68| let
+ 69| result = f origArgs;
+ | ^
+ 70|
+```
+
+PR: [DeterminateSystems/nix-src#243](https://github.com/DeterminateSystems/nix-src/pull/243)
+
+### Other changes
+
+This release fixes an assertion failure in `nix flake check`. PR: [DeterminateSystems/nix-src#252](https://github.com/DeterminateSystems/nix-src/pull/252)
+
+**Full Changelog**: [v3.12.1...v3.12.2](https://github.com/DeterminateSystems/nix-src/compare/v3.12.1...v3.12.2)
diff --git a/doc/manual/source/release-notes-determinate/v3.13.0.md b/doc/manual/source/release-notes-determinate/v3.13.0.md
new file mode 100644
index 00000000000..09041c2acda
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/v3.13.0.md
@@ -0,0 +1,45 @@
+# Release 3.13.0 (2025-11-09)
+
+* Based on [upstream Nix 2.32.3](../release-notes/rl-2.32.md).
+
+## What's Changed
+
+
+### Git sources have a progress indicator again
+
+Nix used to feel "stuck" while it was cloning large repositories.
+Determinate Nix now shows git's native progress indicator while fetching.
+
+PR: [DeterminateSystems/nix-src#250](https://github.com/DeterminateSystems/nix-src/pull/250)
+
+### C API improvements
+
+We've invested in the C API to support our work on closure analysis for SBOM generation, and made a couple of changes:
+
+* C API: add nix_locked_flake_read_path for flake file reading
+* C API: make nix_store_get_fs_closure compatible with upstream
+
+PRs:
+* [DeterminateSystems/nix-src#244](https://github.com/DeterminateSystems/nix-src/pull/244)
+* [DeterminateSystems/nix-src#254](https://github.com/DeterminateSystems/nix-src/pull/254)
+
+### Dropping support for Intel Macs
+
+Determinate Nix no longer supports being installed on Intel Macs.
+Determinate Nix will continue to support building for Intel macOS targets, but only from an Apple Silicon host.
+
+From our intent-to-ship:
+> Over the past year, we’ve watched usage of Determinate on Intel macOS hosts dwindle to a minuscule fraction of total usage.
+> It currently stands at approximately 0.02% of all installations.
+> The vast majority are run in managed CI environments that, we anticipate, will be able to easily convert to using Apple Silicon runners.
+
+For more information: https://github.com/DeterminateSystems/nix-src/issues/224
+
+PR: [DeterminateSystems/nix-src#257](https://github.com/DeterminateSystems/nix-src/pull/257)
+
+### Bugs fixed
+
+* IPv6 Store URLs now handles zone ID references like it did in previous releases [NixOS/nix#14434](https://github.com/NixOS/nix/pull/14434)
+
+
+**Full Changelog**: [v3.12.2...v3.13.0](https://github.com/DeterminateSystems/nix-src/compare/v3.12.2...v3.13.0)
diff --git a/doc/manual/source/release-notes-determinate/v3.13.1.md b/doc/manual/source/release-notes-determinate/v3.13.1.md
new file mode 100644
index 00000000000..025a192c44e
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/v3.13.1.md
@@ -0,0 +1,10 @@
+# Release 3.13.1 (2025-11-12)
+
+* Based on [upstream Nix 2.32.4](../release-notes/rl-2.32.md).
+
+## What's Changed
+* nix bundle: Wait for async path writer by @edolstra in [DeterminateSystems/nix-src#260](https://github.com/DeterminateSystems/nix-src/pull/260)
+* Sync with upstream 2.32.4 by @edolstra in [DeterminateSystems/nix-src#261](https://github.com/DeterminateSystems/nix-src/pull/261)
+
+
+**Full Changelog**: [v3.13.0...v3.13.1](https://github.com/DeterminateSystems/nix-src/compare/v3.13.0...v3.13.1)
diff --git a/doc/manual/source/release-notes-determinate/v3.13.2.md b/doc/manual/source/release-notes-determinate/v3.13.2.md
new file mode 100644
index 00000000000..2490b865e6b
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/v3.13.2.md
@@ -0,0 +1,68 @@
+# Release 3.13.2 (2025-11-19)
+
+* Based on [upstream Nix 2.32.4](../release-notes/rl-2.32.md).
+
+## What's Changed
+
+### Abbreviate flakerefs in lockfile diffs and `nix flake metadata`
+
+Flake refs are now abbreviated when possible, to reduce visual clutter.
+
+For example, this changes
+
+```
+• Updated input 'blender-bin':
+ 'https://api.flakehub.com/f/pinned/edolstra/blender-bin/1.0.19/01993ca7-2aa8-746f-96f5-ca8d2c2b962d/source.tar.gz?narHash=sha256-ZqVhVl9UYVErF8HW8lcvqss005VWYjuX//rZ%2BOmXyHg%3D' (2025-09-12)
+ → 'https://api.flakehub.com/f/pinned/edolstra/blender-bin/1.0.20/019a8772-b044-7738-8c03-109bdc9f0a01/source.tar.gz?narHash=sha256-sVj9Gmx0kwTDQPJ5kgQYszE3Hdjevu0zx0b/bL2fyUc%3D' (2025-11-15)
+• Updated input 'nix':
+ 'github:DeterminateSystems/nix-src/236ebef6514f3a2a9765c8a1d80dd503b8e672be?narHash=sha256-s6/Err0yqOp5fM3OdCF1vhmEYpeElbPOWX88YrW2qj4%3D' (2025-10-23)
+ → 'github:DeterminateSystems/nix-src/ef054dc06e9701597bce0b0572af18cb4c7e7277?narHash=sha256-uqYmH0KA8caQqX5u4BMarZsuDlC%2B71HRsH3h4f3DPCA%3D' (2025-11-12)
+```
+
+to
+
+```
+• Updated input 'blender-bin':
+ 'https://api.flakehub.com/f/pinned/edolstra/blender-bin/1.0.19/01993ca7-2aa8-746f-96f5-ca8d2c2b962d/source.tar.gz' (2025-09-12)
+ → 'https://api.flakehub.com/f/pinned/edolstra/blender-bin/1.0.20/019a8772-b044-7738-8c03-109bdc9f0a01/source.tar.gz' (2025-11-15)
+• Updated input 'nix':
+ 'github:DeterminateSystems/nix-src/236ebef' (2025-10-23)
+ → 'github:DeterminateSystems/nix-src/ef054dc' (2025-11-12)
+```
+
+PR: [DeterminateSystems/nix-src#264](https://github.com/DeterminateSystems/nix-src/pull/264)
+
+### `nix flake prefetch-inputs` now skips build-time inputs
+
+Build-time inputs can already be fetched in parallel, so prefetching them is usually not what you want.
+
+This can be especially noticeable in projects that make extensive use of build-time flake inputs.
+
+PR: [DeterminateSystems/nix-src#263](https://github.com/DeterminateSystems/nix-src/pull/263)
+
+### Don't compute `revCount`/`lastModified` if they're already specified
+
+We don't care if the user (or more likely the lock file) specifies an incorrect value for these attributes, since it doesn't matter for security (unlike content hashes like `narHash`).
+
+This can save time when operating on large repos -- having to recalculate these attributes could slow things down greatly.
+
+PR: [DeterminateSystems/nix-src#269](https://github.com/DeterminateSystems/nix-src/pull/269)
+
+### Avoid unnecessary Git refetches
+
+This fixes the issue where updating a Git input does a non-shallow fetch, and then a subsequent eval does a shallow refetch because the `revCount` is already known.
+
+Now the subsequent eval will reuse the repo used in the first fetch.
+
+PR: [DeterminateSystems/nix-src#270](https://github.com/DeterminateSystems/nix-src/pull/270)
+
+### Use our mirrored flake registry
+
+The flake registry is security-critical and thus should have high availability.
+
+By mirroring the upstream Nix flake registry, we can make it less likely that a GitHub outage affects being able to resolve from the registry.
+
+PR: [DeterminateSystems/nix-src#271](https://github.com/DeterminateSystems/nix-src/pull/271)
+
+
+**Full Changelog**: [v3.13.1...v3.13.2](https://github.com/DeterminateSystems/nix-src/compare/v3.13.1...v3.13.2)
diff --git a/doc/manual/source/release-notes-determinate/v3.14.0.md b/doc/manual/source/release-notes-determinate/v3.14.0.md
new file mode 100644
index 00000000000..d72d5d21468
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/v3.14.0.md
@@ -0,0 +1,159 @@
+# Release 3.14.0 (2025-12-08)
+
+* Based on [upstream Nix 2.32.4](../release-notes/rl-2.32.md).
+
+## What is going on?! `nix ps` to the rescue
+
+Determinate Nix now features a `nix ps` command to summarize all of the active builds and child processes:
+
+```
+$ nix ps
+USER PID CPU DERIVATION/COMMAND
+_nixbld1 30167 0.4s /nix/store/h431bcfml83czhpyzljhp9mw4yrq95vs-determinate-nix-manual-3.14.0.drv (wall=9s)
+_nixbld1 30167 0.2s └───bash -e /nix/store/jwqf79v5p51x9mv8vx20fv9mzm2x7kig-source-stdenv.sh /nix/store/285whzixr5k1kfj6nidyj29mqqgv7n0b-default-builder.s
+_nixbld1 30278 0.0s └───ninja -j14
+_nixbld1 30279 0.0s ├───/nix/store/p7rag2cw99d7alp6749rjqp71qc0mnzl-python3-3.12.11/bin/python3.12 /nix/store/8k5fancbc5fjmxq6izn0z4inwnmpj09y-mes
+_nixbld1 30286 0.0s │ └───/nix/store/z59zm01pjwzil2qkvv0s4ibk54risy9a-determinate-nix-3.14.0/bin/nix config show --json
+_nixbld1 30280 0.0s ├───/nix/store/p7rag2cw99d7alp6749rjqp71qc0mnzl-python3-3.12.11/bin/python3.12 /nix/store/8k5fancbc5fjmxq6izn0z4inwnmpj09y-mes
+_nixbld1 30287 0.0s │ └───/nix/store/z59zm01pjwzil2qkvv0s4ibk54risy9a-determinate-nix-3.14.0/bin/nix __dump-language
+_nixbld1 30281 0.0s ├───/nix/store/p7rag2cw99d7alp6749rjqp71qc0mnzl-python3-3.12.11/bin/python3.12 /nix/store/8k5fancbc5fjmxq6izn0z4inwnmpj09y-mes
+_nixbld1 30288 0.0s │ └───/nix/store/z59zm01pjwzil2qkvv0s4ibk54risy9a-determinate-nix-3.14.0/bin/nix __dump-cli
+_nixbld1 30282 0.0s ├───/nix/store/p7rag2cw99d7alp6749rjqp71qc0mnzl-python3-3.12.11/bin/python3.12 /nix/store/8k5fancbc5fjmxq6izn0z4inwnmpj09y-mes
+_nixbld1 30284 0.0s │ └───/nix/store/z59zm01pjwzil2qkvv0s4ibk54risy9a-determinate-nix-3.14.0/bin/nix __dump-xp-features
+_nixbld1 30283 0.0s └───/nix/store/p7rag2cw99d7alp6749rjqp71qc0mnzl-python3-3.12.11/bin/python3.12 /nix/store/8k5fancbc5fjmxq6izn0z4inwnmpj09y-mes
+_nixbld1 30285 0.0s └───/nix/store/bs1pvy8margy5sj0jwahchxbjnqzi14i-bash-5.2p37/bin/bash -euo pipefail -c if type -p build-release-notes > /de
+_nixbld1 30289 0.0s └───changelog-d ../source/release-notes/../../rl-next
+```
+
+For the integrators out there, it also has a `--json` flag with all the raw data.
+
+PRs:
+* [DeterminateSystems/nix-src#282](https://github.com/DeterminateSystems/nix-src/pull/282)
+* [DeterminateSystems/nix-src#287](https://github.com/DeterminateSystems/nix-src/pull/287)
+
+
+## Nix `build`, `profile`, and `flake check` commands tell you what output failed
+
+These commands now tell you exactly what flake outputs failed to build.
+Previously, the error would indicate only what derivation failed to build -- but not which output.
+
+Now, `nix build` and `nix profile` commands provide the specific output:
+
+```
+$ nix build .#oneFakeHash .#badSystem --keep-going
+❌ git+file:///Users/grahamc/src/github.com/DeterminateSystems/samples#oneFakeHash
+error: hash mismatch in fixed-output derivation '/nix/store/58pp1y74j4f5zxfq50xncv2wvnxf7w3y-one-fake-hash.drv':
+ specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+ got: sha256-i7j83d71sibS/ssSjLJ5PMKmbhjAM+BHW0aElvkgEwY=
+❌ git+file:///Users/grahamc/src/github.com/DeterminateSystems/samples#badSystem
+error: Cannot build '/nix/store/5vsaxi730yl2icngkyvn8wiflik5wfmq-bad-system.drv'.
+ Reason: required system or feature not available
+ Required system: 'bogus' with features {}
+ Current system: 'aarch64-darwin' with features {apple-virt, benchmark, big-parallel, nixos-test}
+```
+
+And in a great change for CI, `nix flake check` users get improved summaries too:
+
+```
+$ nix flake check
+❓ checks.aarch64-darwin.twoFakeHashes (cancelled)
+❓ checks.aarch64-darwin.badSystemNested (cancelled)
+❓ checks.aarch64-darwin.oneFakeHash (cancelled)
+❓ checks.aarch64-darwin.failure (cancelled)
+❓ checks.aarch64-darwin.badSystem (cancelled)
+❓ checks.aarch64-darwin.weirdHash (cancelled)
+❓ checks.aarch64-darwin.all (cancelled)
+❓ checks.aarch64-darwin.fakeHashes (cancelled)
+❓ checks.aarch64-darwin.incorrectHashes (cancelled)
+❓ checks.aarch64-darwin.badFeaturesNested (cancelled)
+❓ checks.aarch64-darwin.failureNested (cancelled)
+❌ checks.aarch64-darwin.badFeatures
+error: Cannot build '/nix/store/sc1cyhrpsm9yjx55cl2zzyr5lypwigi6-bad-feature.drv'.
+ Reason: required system or feature not available
+ Required system: 'aarch64-darwin' with features {bogus}
+ Current system: 'aarch64-darwin' with features {apple-virt, benchmark, big-parallel, nixos-test}
+```
+
+PRs:
+* [DeterminateSystems/nix-src#281](https://github.com/DeterminateSystems/nix-src/pull/281)
+* [DeterminateSystems/nix-src#285](https://github.com/DeterminateSystems/nix-src/pull/285)
+
+
+## More seamless upgrades from Nix 2.18 and Nix 2.19
+
+We've heard from some users who are trying to upgrade from Nix 2.18.
+
+These users are primarily experiencing problems caused by Nix 2.20 switching from `git-archive` to `libgit2` for fetching repositories.
+This change caused some `git-archive` filters to stop executing, like autocrlf.
+Not running those filters is an improvement, and running those filters *can cause* instability in source hashes.
+However, this switch *did* cause previously valid hashes to become invalid.
+
+Determinate Nix now retries fetching an old archive with `git-archive` as a fallback when libgit2 fails to provide the correct source.
+
+Further, to support a progressive migration Determinate Nix has a new option: `nix-219-compat`.
+Set `nix-219-compat=true` to cause Nix to author new flake.nix files with a `git-archive` based source hash.
+
+Finally, a user identified `builtins.path` changed since 2.18 and stopped propagating references.
+We have corrected this regression.
+
+PRs:
+* [DeterminateSystems/nix-src#283](https://github.com/DeterminateSystems/nix-src/pull/283)
+* [DeterminateSystems/nix-src#278](https://github.com/DeterminateSystems/nix-src/pull/278)
+
+## Flake registry mirroring
+
+Determinate Nix now includes a fallback copy of the Nix Registry.
+This change builds on top of v3.13.2, where we changed from the upstream Nix registry to a mirrored copy hosted by `install.determinate.systems`.
+
+Combined, these changes increase the reliability of Nix in the face of network outages.
+
+> [!NOTE]
+> Flake registry URLs for `flake.nix` inputs is deprecated.
+> The flake registry should only be used for interactive use.
+> See: https://github.com/DeterminateSystems/nix-src/issues/37
+
+PR: [DeterminateSystems/nix-src#273](https://github.com/DeterminateSystems/nix-src/pull/273)
+
+## Flake registry resolution CLI
+
+We added the new command `nix registry resolve` to help debug issues with Flake registries.
+This command looks up a flake registry input name and returns the flakeref it resolves to.
+
+For example, looking up Nixpkgs:
+
+```
+$ nix registry resolve nixpkgs
+github:NixOS/nixpkgs/nixpkgs-unstable
+```
+
+Or looking up the 25.11 branch of Nixpkgs:
+```
+$ nix registry resolve nixpkgs/release-25.11
+github:NixOS/nixpkgs/release-25.11
+```
+
+> [!NOTE]
+> Flake registry URLs for `flake.nix` inputs is deprecated.
+> The flake registry should only be used for interactive use.
+> See: https://github.com/DeterminateSystems/nix-src/issues/37
+
+PR: [DeterminateSystems/nix-src#273](https://github.com/DeterminateSystems/nix-src/pull/273)
+
+## Improved Docker image packaging
+
+Thanks to `employee-64c7dcd530593118dcccc3fb`, the OCI / Docker images built by the Determinate Nix flake.nix can be further customized.
+
+Users can specify their own base image by specifying `fromImage`.
+
+Additionally, users can specify additional directories to include at the beginning or end of the PATH variable with `extraPrePaths` and `extraPostPaths`.
+
+PRs:
+* [DeterminateSystems/nix-src#277](https://github.com/DeterminateSystems/nix-src/pull/277)
+* [DeterminateSystems/nix-src#280](https://github.com/DeterminateSystems/nix-src/pull/280)
+
+## Bug fixes
+
+* Corrected an error with parallel evaluation which ([DeterminateSystems/nix-src#286](https://github.com/DeterminateSystems/nix-src/pull/286))
+* Fixed compatibility with updated Nixpkgs versions. Thank you SandaruKasa! ([DeterminateSystems/nix-src#284](https://github.com/DeterminateSystems/nix-src/pull/284))
+
+**Full Changelog**: [v3.13.2...v3.14.0](https://github.com/DeterminateSystems/nix-src/compare/v3.13.2...v3.14.0)
diff --git a/doc/manual/source/release-notes-determinate/v3.15.0.md b/doc/manual/source/release-notes-determinate/v3.15.0.md
new file mode 100644
index 00000000000..fb568374c3f
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/v3.15.0.md
@@ -0,0 +1,28 @@
+# Release 3.15.0 (2025-12-19)
+
+* Based on [upstream Nix 2.33.0](../release-notes/rl-2.33.md).
+
+## `fetchTree` improvement
+
+`builtins.fetchTree` now implicitly treats the fetched tree as "final" when a `narHash` is supplied, meaning that it will not return attributes like `lastModified` or `revCount` unless they were specified by the caller. This makes it possible to substitute the tree from a binary cache, which is often more efficient. Furthermore, for Git inputs, it allows Nix to perform a shallow fetch, which is much faster.
+
+This is primarily useful for users of `flake-compat`, since it uses `builtins.fetchTree` internally.
+
+PR: [DeterminateSystems/nix-src#297](https://github.com/DeterminateSystems/nix-src/pull/297)
+
+## New builtin function `builtins.filterAttrs`
+
+Nixpkgs heavily relies on this function to select attributes from an attribute set:
+
+```nix
+filterAttrs = pred: set: removeAttrs set (filter (name: !pred name set.${name}) (attrNames set));
+```
+
+Determinate Nix now has this function built-in, which makes it much faster.
+
+PR: [DeterminateSystems/nix-src#291](https://github.com/DeterminateSystems/nix-src/pull/291)
+
+## New Contributors
+* @not-ronjinger made their first contribution in [DeterminateSystems/nix-src#291](https://github.com/DeterminateSystems/nix-src/pull/291)
+
+**Full Changelog**: [v3.14.0...v3.15.0](https://github.com/DeterminateSystems/nix-src/compare/v3.14.0...v3.15.0)
diff --git a/doc/manual/source/release-notes-determinate/v3.15.1.md b/doc/manual/source/release-notes-determinate/v3.15.1.md
new file mode 100644
index 00000000000..9243962cf4b
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/v3.15.1.md
@@ -0,0 +1,15 @@
+# Release 3.15.1 (2025-12-24)
+
+* Based on [upstream Nix 2.33.0](../release-notes/rl-2.33.md).
+
+## What's Changed
+Users reported the v3.15.0 tarball could not be fetched in a fixed-output derivation due to current stdenv paths present in the documentation. This release eliminated those paths.
+
+PR: [DeterminateSystems/nix-src#306](https://github.com/DeterminateSystems/nix-src/pull/306)
+
+Additionally, this change re-enables CodeRabbit's code review on our changes. CodeRabit was disabled by the upstream project, and we inadvertently included that change.
+
+PR: [DeterminateSystems/nix-src#305](https://github.com/DeterminateSystems/nix-src/pull/305)
+
+
+**Full Changelog**: [v3.15.0...v3.15.1](https://github.com/DeterminateSystems/nix-src/compare/v3.15.0...v3.15.1)
diff --git a/doc/manual/source/release-notes-determinate/v3.8.6.md b/doc/manual/source/release-notes-determinate/v3.8.6.md
new file mode 100644
index 00000000000..8f917f2362f
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/v3.8.6.md
@@ -0,0 +1,14 @@
+# Release 3.8.6 (2025-08-19)
+
+* Based on [upstream Nix 2.30.2](../release-notes/rl-2.30.md).
+
+## What's Changed
+* Auto update release notes by @grahamc in [DeterminateSystems/nix-src#170](https://github.com/DeterminateSystems/nix-src/pull/170)
+* Use WAL mode for SQLite cache databases (2nd attempt) by @edolstra in [DeterminateSystems/nix-src#167](https://github.com/DeterminateSystems/nix-src/pull/167)
+* Enable parallel marking in boehm-gc by @edolstra in [DeterminateSystems/nix-src#168](https://github.com/DeterminateSystems/nix-src/pull/168)
+* BasicClientConnection::queryPathInfo(): Don't throw exception for invalid paths by @edolstra in [DeterminateSystems/nix-src#172](https://github.com/DeterminateSystems/nix-src/pull/172)
+* Fix queryPathInfo() negative caching by @edolstra in [DeterminateSystems/nix-src#173](https://github.com/DeterminateSystems/nix-src/pull/173)
+* forceDerivation(): Wait for async path write after forcing value by @edolstra in [DeterminateSystems/nix-src#176](https://github.com/DeterminateSystems/nix-src/pull/176)
+
+
+**Full Changelog**: [v3.8.5...v3.8.6](https://github.com/DeterminateSystems/nix-src/compare/v3.8.5...v3.8.6)
diff --git a/doc/manual/source/release-notes-determinate/v3.9.0.md b/doc/manual/source/release-notes-determinate/v3.9.0.md
new file mode 100644
index 00000000000..66deb69b619
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/v3.9.0.md
@@ -0,0 +1,45 @@
+# Release 3.9.0 (2025-08-26)
+
+* Based on [upstream Nix 2.30.2](../release-notes/rl-2.30.md).
+
+## What's Changed
+
+### Build-time flake inputs
+
+Some of our users have hundreds or thousands of flake inputs.
+In those cases, it is painfully slow for Nix to fetch all the inputs during evaluation of the flake.
+
+Determinate Nix has an experimental feature for deferring the fetching to build time of the dependent derivations.
+
+This is currently in developer preview.
+If you would like to try it, add the experimental feature to your `/etc/nix/nix.custom.conf`:
+
+```ini
+extra-experimental-features = build-time-fetch-tree
+```
+
+Then, mark an input to be fetched at build time:
+
+```nix
+inputs.example = {
+ type = "github";
+ owner = "DeterminateSystems";
+ repo = "example";
+ flake = false; # <-- currently required
+ buildTime = true;
+};
+```
+
+Let us know what you think!
+
+PR: [DeterminateSystems/nix-src#49](https://github.com/DeterminateSystems/nix-src/pull/49)
+
+### Corrected inconsistent behavior of `nix flake check`
+
+Users reported that `nix flake check` would not consistently validate the entire flake.
+
+We've fixed this issue and improved our testing around `nix flake check`.
+
+PR: [DeterminateSystems/nix-src#182](https://github.com/DeterminateSystems/nix-src/pull/182)
+
+**Full Changelog**: [v3.8.6...v3.9.0](https://github.com/DeterminateSystems/nix-src/compare/v3.8.6...v3.9.0)
diff --git a/doc/manual/source/release-notes-determinate/v3.9.1.md b/doc/manual/source/release-notes-determinate/v3.9.1.md
new file mode 100644
index 00000000000..38d17199c2c
--- /dev/null
+++ b/doc/manual/source/release-notes-determinate/v3.9.1.md
@@ -0,0 +1,20 @@
+# Release 3.9.1 (2025-08-28)
+
+- Based on [upstream Nix 2.30.2](../release-notes/rl-2.30.md).
+
+### A useful `nix flake init` template default
+
+Nix's default flake template is [extremely bare bones](https://github.com/NixOS/templates/blob/ad0e221dda33c4b564fad976281130ce34a20cb9/trivial/flake.nix), and not a useful starting point.
+
+Deteminate Nix now uses [a more fleshed out default template](https://github.com/DeterminateSystems/flake-templates/blob/8af99b99627da41f16897f60eb226db30c775e76/default/flake.nix), including targeting multiple systems.
+
+PR: [DeterminateSystems/nix-src#180](https://github.com/DeterminateSystems/nix-src/pull/180)
+
+### Build cancellation is repaired on macOS
+
+A recent macOS update changed how signals are handled by Nix and broke using Ctrl-C to stop a build.
+Determinate Nix on macOS correctly handles these signals and stops the build.
+
+PR: [DeterminateSystems/nix-src#184](https://github.com/DeterminateSystems/nix-src/pull/184)
+
+**Full Changelog**: [v3.9.0...v3.9.1](https://github.com/DeterminateSystems/nix-src/compare/v3.9.0...v3.9.1)
diff --git a/doc/manual/source/release-notes/rl-0.12.md b/doc/manual/source/release-notes/rl-0.12.md
index 3a4aba07d69..3541b6487e7 100644
--- a/doc/manual/source/release-notes/rl-0.12.md
+++ b/doc/manual/source/release-notes/rl-0.12.md
@@ -80,7 +80,7 @@
...
the following paths will be downloaded/copied (30.02 MiB):
/nix/store/4m8pvgy2dcjgppf5b4cj5l6wyshjhalj-samba-3.2.4
- /nix/store/7h1kwcj29ip8vk26rhmx6bfjraxp0g4l-libunwind-0.98.6
+ /nix/store/spc1m987vlibchdx369qwa391s738s7l-libunwind-0.98.6
...
- Language features:
diff --git a/doc/manual/source/release-notes/rl-0.8.md b/doc/manual/source/release-notes/rl-0.8.md
index 5ba6e0e7217..2bc6352c354 100644
--- a/doc/manual/source/release-notes/rl-0.8.md
+++ b/doc/manual/source/release-notes/rl-0.8.md
@@ -63,7 +63,7 @@ Nix 0.8 has the following improvements:
can query all paths that directly or indirectly use a certain Glibc:
$ nix-store -q --referrers-closure \
- /nix/store/8lz9yc6zgmc0vlqmn2ipcpkjlmbi51vv-glibc-2.3.4
+ /nix/store/1a6mdrjz4wn7b9sfmcw5ggbk1mi281mh-glibc-2.3.4
- The concept of fixed-output derivations has been formalised.
Previously, functions such as `fetchurl` in Nixpkgs used a hack
diff --git a/doc/manual/source/release-notes/rl-2.0.md b/doc/manual/source/release-notes/rl-2.0.md
index 25cc5e0a5f3..181940f616f 100644
--- a/doc/manual/source/release-notes/rl-2.0.md
+++ b/doc/manual/source/release-notes/rl-2.0.md
@@ -66,7 +66,7 @@ This release has the following new features:
nix copy --to ssh://machine nixpkgs.hello
- nix copy --to ssh://machine /nix/store/0i2jd68mp5g6h2sa5k9c85rb80sn8hi9-hello-2.10
+ nix copy --to ssh://machine /nix/store/qbhyj3blxpw2i6pb7c6grc9185nbnpvy-hello-2.10
nix copy --to ssh://machine '(with import {}; hello)'
@@ -187,7 +187,7 @@ This release has the following new features:
former is primarily useful in conjunction with remote stores,
e.g.
- nix ls-store --store https://cache.nixos.org/ -lR /nix/store/0i2jd68mp5g6h2sa5k9c85rb80sn8hi9-hello-2.10
+ nix ls-store --store https://cache.nixos.org/ -lR /nix/store/qbhyj3blxpw2i6pb7c6grc9185nbnpvy-hello-2.10
lists the contents of path in a binary cache.
diff --git a/doc/manual/source/release-notes/rl-2.13.md b/doc/manual/source/release-notes/rl-2.13.md
index 168708113ea..6976f91501b 100644
--- a/doc/manual/source/release-notes/rl-2.13.md
+++ b/doc/manual/source/release-notes/rl-2.13.md
@@ -25,7 +25,7 @@
* Allow explicitly selecting outputs in a store derivation installable, just like we can do with other sorts of installables.
For example,
```shell-session
- # nix build /nix/store/gzaflydcr6sb3567hap9q6srzx8ggdgg-glibc-2.33-78.drv^dev
+ # nix build /nix/store/fpq78s2h8ffh66v2iy0q1838mhff06y8-glibc-2.33-78.drv^dev
```
now works just as
```shell-session
diff --git a/doc/manual/source/release-notes/rl-2.15.md b/doc/manual/source/release-notes/rl-2.15.md
index e7e52631ba4..1d30c70a4c0 100644
--- a/doc/manual/source/release-notes/rl-2.15.md
+++ b/doc/manual/source/release-notes/rl-2.15.md
@@ -18,13 +18,13 @@
For example,
```shell-session
- $ nix path-info /nix/store/gzaflydcr6sb3567hap9q6srzx8ggdgg-glibc-2.33-78.drv
+ $ nix path-info /nix/store/fpq78s2h8ffh66v2iy0q1838mhff06y8-glibc-2.33-78.drv
```
now gives info about the derivation itself, while
```shell-session
- $ nix path-info /nix/store/gzaflydcr6sb3567hap9q6srzx8ggdgg-glibc-2.33-78.drv^*
+ $ nix path-info /nix/store/fpq78s2h8ffh66v2iy0q1838mhff06y8-glibc-2.33-78.drv^*
```
provides information about each of its outputs.
diff --git a/doc/manual/source/release-notes/rl-2.19.md b/doc/manual/source/release-notes/rl-2.19.md
index 04f8c9c28d2..0596ef90961 100644
--- a/doc/manual/source/release-notes/rl-2.19.md
+++ b/doc/manual/source/release-notes/rl-2.19.md
@@ -45,7 +45,7 @@
```json5
[
{
- "path": "/nix/store/8fv91097mbh5049i9rglc73dx6kjg3qk-bash-5.2-p15",
+ "path": "/nix/store/fvqsvk65d38p8qqir371ii0hyqxvjcw6-bash-5.2-p15",
"valid": true,
// ...
},
@@ -60,7 +60,7 @@
```json5
{
- "/nix/store/8fv91097mbh5049i9rglc73dx6kjg3qk-bash-5.2-p15": {
+ "/nix/store/fvqsvk65d38p8qqir371ii0hyqxvjcw6-bash-5.2-p15": {
// ...
},
"/nix/store/wffw7l0alvs3iw94cbgi1gmmbmw99sqb-home-manager-path": null,
@@ -69,7 +69,7 @@
This makes it match `nix derivation show`, which also maps store paths to information.
-- When Nix is installed using the [binary installer](@docroot@/installation/installing-binary.md), in supported shells (Bash, Zsh, Fish)
+- When Nix is installed using the binary installer, in supported shells (Bash, Zsh, Fish)
[`XDG_DATA_DIRS`](https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html#variables) is now populated with the path to the `/share` subdirectory of the current profile.
This means that command completion scripts, `.desktop` files, and similar artifacts installed via [`nix-env`](@docroot@/command-ref/nix-env.md) or [`nix profile`](@docroot@/command-ref/new-cli/nix3-profile.md)
(experimental) can be found by any program that follows the [XDG Base Directory Specification](https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html).
diff --git a/doc/manual/source/release-notes/rl-2.20.md b/doc/manual/source/release-notes/rl-2.20.md
index eb724f600aa..d54646379c8 100644
--- a/doc/manual/source/release-notes/rl-2.20.md
+++ b/doc/manual/source/release-notes/rl-2.20.md
@@ -182,7 +182,7 @@
«partially applied primop map»
nix-repl> builtins.trace lib.id "my-value"
- trace: «lambda id @ /nix/store/8rrzq23h2zq7sv5l2vhw44kls5w0f654-source/lib/trivial.nix:26:5»
+ trace: «lambda id @ /nix/store/kgr5lnaiiv08wb7k324yv1i1npjmrvjc-source/lib/trivial.nix:26:5»
"my-value"
```
diff --git a/doc/manual/source/release-notes/rl-2.24.md b/doc/manual/source/release-notes/rl-2.24.md
index e9b46bb22b7..f608fb54f7d 100644
--- a/doc/manual/source/release-notes/rl-2.24.md
+++ b/doc/manual/source/release-notes/rl-2.24.md
@@ -268,6 +268,21 @@
be configured using the `warn-large-path-threshold` setting,
e.g. `--warn-large-path-threshold 100M`.
+- Wrap filesystem exceptions more correctly [#11378](https://github.com/NixOS/nix/pull/11378)
+
+ With the switch to `std::filesystem` in different places, Nix started to throw `std::filesystem::filesystem_error` in many places instead of its own exceptions.
+
+ This led to no longer generating error traces, for example when listing a non-existing directory.
+
+ This version catches these types of exception correctly and wraps them into Nix's own exeception type.
+
+ Author: [**@Mic92**](https://github.com/Mic92)
+
+- `` uses TLS verification [#11585](https://github.com/NixOS/nix/pull/11585)
+
+ Previously `` did not do TLS verification. This was because the Nix sandbox in the past did not have access to TLS certificates, and Nix checks the hash of the fetched file anyway. However, this can expose authentication data from `netrc` and URLs to man-in-the-middle attackers. In addition, Nix now in some cases (such as when using impure derivations) does *not* check the hash. Therefore we have now enabled TLS verification. This means that downloads by `` will now fail if you're fetching from a HTTPS server that does not have a valid certificate.
+
+ `` is also known as the builtin derivation builder `builtin:fetchurl`. It's not to be confused with the evaluation-time function `builtins.fetchurl`, which was not affected by this issue.
## Contributors
diff --git a/doc/manual/source/store/store-path.md b/doc/manual/source/store/store-path.md
index 4061f3653f6..08b024e4a84 100644
--- a/doc/manual/source/store/store-path.md
+++ b/doc/manual/source/store/store-path.md
@@ -2,7 +2,7 @@
> **Example**
>
-> `/nix/store/a040m110amc4h71lds2jmr8qrkj2jhxd-git-2.38.1`
+> `/nix/store/jf6gn2dzna4nmsfbdxsd7kwhsk6gnnlr-git-2.38.1`
>
> A rendered store path
@@ -22,7 +22,7 @@ Store paths are pairs of
> **Example**
>
-> - Digest: `b6gvzjyb2pg0kjfwrjmg1vfhh54ad73z`
+> - Digest: `q06x3jll2yfzckz2bzqak089p43ixkkq`
> - Name: `firefox-33.1`
To make store objects accessible to operating system processes, stores have to expose store objects through the file system.
@@ -38,7 +38,7 @@ A store path is rendered to a file system path as the concatenation of
> **Example**
>
> ```
-> /nix/store/b6gvzjyb2pg0kjfwrjmg1vfhh54ad73z-firefox-33.1
+> /nix/store/q06x3jll2yfzckz2bzqak089p43ixkkq-firefox-33.1
> |--------| |------------------------------| |----------|
> store directory digest name
> ```
diff --git a/doc/manual/source/store/types/index.md.in b/doc/manual/source/store/types/index.md.in
index a35161ce8fa..b211ac98fe3 100644
--- a/doc/manual/source/store/types/index.md.in
+++ b/doc/manual/source/store/types/index.md.in
@@ -8,7 +8,7 @@ Stores are specified using a URL-like syntax. For example, the command
```console
# nix path-info --store https://cache.nixos.org/ --json \
- /nix/store/a7gvj343m05j2s32xcnwr35v31ynlypr-coreutils-9.1
+ /nix/store/1542dip9i7k4f24y6hqgd04hmvid9hr5-coreutils-9.1
```
fetches information about a store path in the HTTP binary cache
diff --git a/docker.nix b/docker.nix
index 32205224b73..72c13663488 100644
--- a/docker.nix
+++ b/docker.nix
@@ -8,6 +8,7 @@
# Image configuration
name ? "nix",
tag ? "latest",
+ fromImage ? null,
bundleNixpkgs ? true,
channelName ? "nixpkgs",
channelURL ? "https://channels.nixos.org/nixpkgs-unstable",
@@ -27,6 +28,8 @@
"org.opencontainers.image.description" = "Nix container image";
},
Cmd ? [ (lib.getExe bashInteractive) ],
+ extraPrePaths ? [ ],
+ extraPostPaths ? [ ],
# Default Packages
nix ? pkgs.nix,
bashInteractive ? pkgs.bashInteractive,
@@ -336,7 +339,7 @@ let
globalFlakeRegistryPath="$nixCacheDir/flake-registry.json"
ln -s ${flake-registry-path} $out$globalFlakeRegistryPath
mkdir -p $out/nix/var/nix/gcroots/auto
- rootName=$(${lib.getExe' nix "nix"} --extra-experimental-features nix-command hash file --type sha1 --base32 <(echo -n $globalFlakeRegistryPath))
+ rootName=$(${lib.getExe' nix "nix"} hash file --type sha1 --base32 <(echo -n $globalFlakeRegistryPath))
ln -s $globalFlakeRegistryPath $out/nix/var/nix/gcroots/auto/$rootName
'')
);
@@ -352,6 +355,7 @@ dockerTools.buildLayeredImageWithNixDb {
gid
uname
gname
+ fromImage
;
contents = [ baseSystem ];
@@ -373,11 +377,15 @@ dockerTools.buildLayeredImageWithNixDb {
Env = [
"USER=${uname}"
"PATH=${
- lib.concatStringsSep ":" [
- "${userHome}/.nix-profile/bin"
- "/nix/var/nix/profiles/default/bin"
- "/nix/var/nix/profiles/default/sbin"
- ]
+ lib.concatStringsSep ":" (
+ extraPrePaths
+ ++ [
+ "${userHome}/.nix-profile/bin"
+ "/nix/var/nix/profiles/default/bin"
+ "/nix/var/nix/profiles/default/sbin"
+ ]
+ ++ extraPostPaths
+ )
}"
"MANPATH=${
lib.concatStringsSep ":" [
diff --git a/flake.lock b/flake.lock
index 19f7b0c1c21..f56706ec761 100644
--- a/flake.lock
+++ b/flake.lock
@@ -3,11 +3,11 @@
"flake-compat": {
"flake": false,
"locked": {
- "lastModified": 1733328505,
- "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+ "lastModified": 1696426674,
+ "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
"owner": "edolstra",
"repo": "flake-compat",
- "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+ "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
"type": "github"
},
"original": {
@@ -23,55 +23,51 @@
]
},
"locked": {
- "lastModified": 1733312601,
- "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
- "owner": "hercules-ci",
- "repo": "flake-parts",
- "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
- "type": "github"
+ "lastModified": 1748821116,
+ "narHash": "sha256-F82+gS044J1APL0n4hH50GYdPRv/5JWm34oCJYmVKdE=",
+ "rev": "49f0870db23e8c1ca0b5259734a02cd9e1e371a1",
+ "revCount": 377,
+ "type": "tarball",
+ "url": "https://api.flakehub.com/f/pinned/hercules-ci/flake-parts/0.1.377%2Brev-49f0870db23e8c1ca0b5259734a02cd9e1e371a1/01972f28-554a-73f8-91f4-d488cc502f08/source.tar.gz"
},
"original": {
- "owner": "hercules-ci",
- "repo": "flake-parts",
- "type": "github"
+ "type": "tarball",
+ "url": "https://flakehub.com/f/hercules-ci/flake-parts/0.1"
}
},
"git-hooks-nix": {
"inputs": {
- "flake-compat": [],
+ "flake-compat": "flake-compat",
"gitignore": [],
"nixpkgs": [
"nixpkgs"
- ],
- "nixpkgs-stable": [
- "nixpkgs"
]
},
"locked": {
- "lastModified": 1734279981,
- "narHash": "sha256-NdaCraHPp8iYMWzdXAt5Nv6sA3MUzlCiGiR586TCwo0=",
- "owner": "cachix",
- "repo": "git-hooks.nix",
- "rev": "aa9f40c906904ebd83da78e7f328cd8aeaeae785",
- "type": "github"
+ "lastModified": 1747372754,
+ "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
+ "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
+ "revCount": 1026,
+ "type": "tarball",
+ "url": "https://api.flakehub.com/f/pinned/cachix/git-hooks.nix/0.1.1026%2Brev-80479b6ec16fefd9c1db3ea13aeb038c60530f46/0196d79a-1b35-7b8e-a021-c894fb62163d/source.tar.gz"
},
"original": {
- "owner": "cachix",
- "repo": "git-hooks.nix",
- "type": "github"
+ "type": "tarball",
+ "url": "https://flakehub.com/f/cachix/git-hooks.nix/0.1.941"
}
},
"nixpkgs": {
"locked": {
- "lastModified": 1763948260,
- "narHash": "sha256-zZk7fn2ARAqmLwaYTpxBJmj81KIdz11NiWt7ydHHD/M=",
- "rev": "1c8ba8d3f7634acac4a2094eef7c32ad9106532c",
+ "lastModified": 1761597516,
+ "narHash": "sha256-wxX7u6D2rpkJLWkZ2E932SIvDJW8+ON/0Yy8+a5vsDU=",
+ "rev": "daf6dc47aa4b44791372d6139ab7b25269184d55",
+ "revCount": 811874,
"type": "tarball",
- "url": "https://releases.nixos.org/nixos/25.05/nixos-25.05.813095.1c8ba8d3f763/nixexprs.tar.xz"
+ "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2505.811874%2Brev-daf6dc47aa4b44791372d6139ab7b25269184d55/019a3494-3498-707e-9086-1fb81badc7fe/source.tar.gz"
},
"original": {
"type": "tarball",
- "url": "https://channels.nixos.org/nixos-25.05/nixexprs.tar.xz"
+ "url": "https://flakehub.com/f/NixOS/nixpkgs/0.2505"
}
},
"nixpkgs-23-11": {
@@ -108,7 +104,6 @@
},
"root": {
"inputs": {
- "flake-compat": "flake-compat",
"flake-parts": "flake-parts",
"git-hooks-nix": "git-hooks-nix",
"nixpkgs": "nixpkgs",
diff --git a/flake.nix b/flake.nix
index d35363ab2e5..0d04d3b1825 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,24 +1,18 @@
{
description = "The purely functional package manager";
- inputs.nixpkgs.url = "https://channels.nixos.org/nixos-25.05/nixexprs.tar.xz";
+ inputs.nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0.2505";
inputs.nixpkgs-regression.url = "github:NixOS/nixpkgs/215d4d0fd80ca5163643b03a33fde804a29cc1e2";
inputs.nixpkgs-23-11.url = "github:NixOS/nixpkgs/a62e6edd6d5e1fa0329b8653c801147986f8d446";
- inputs.flake-compat = {
- url = "github:edolstra/flake-compat";
- flake = false;
- };
# dev tooling
- inputs.flake-parts.url = "github:hercules-ci/flake-parts";
- inputs.git-hooks-nix.url = "github:cachix/git-hooks.nix";
+ inputs.flake-parts.url = "https://flakehub.com/f/hercules-ci/flake-parts/0.1";
+ inputs.git-hooks-nix.url = "https://flakehub.com/f/cachix/git-hooks.nix/0.1.941";
# work around https://github.com/NixOS/nix/issues/7730
inputs.flake-parts.inputs.nixpkgs-lib.follows = "nixpkgs";
inputs.git-hooks-nix.inputs.nixpkgs.follows = "nixpkgs";
- inputs.git-hooks-nix.inputs.nixpkgs-stable.follows = "nixpkgs";
# work around 7730 and https://github.com/NixOS/nix/issues/7807
- inputs.git-hooks-nix.inputs.flake-compat.follows = "";
inputs.git-hooks-nix.inputs.gitignore.follows = "";
outputs =
@@ -34,26 +28,24 @@
officialRelease = true;
- linux32BitSystems = [ "i686-linux" ];
+ linux32BitSystems = [ ];
linux64BitSystems = [
"x86_64-linux"
"aarch64-linux"
];
linuxSystems = linux32BitSystems ++ linux64BitSystems;
darwinSystems = [
- "x86_64-darwin"
"aarch64-darwin"
];
systems = linuxSystems ++ darwinSystems;
crossSystems = [
- "armv6l-unknown-linux-gnueabihf"
- "armv7l-unknown-linux-gnueabihf"
- "riscv64-unknown-linux-gnu"
+ #"armv6l-unknown-linux-gnueabihf"
+ #"armv7l-unknown-linux-gnueabihf"
+ #"riscv64-unknown-linux-gnu"
# Disabled because of https://github.com/NixOS/nixpkgs/issues/344423
# "x86_64-unknown-netbsd"
- "x86_64-unknown-freebsd"
- "x86_64-w64-mingw32"
+ #"x86_64-unknown-freebsd"
];
stdenvs = [
@@ -372,6 +364,40 @@
nix-manual-manpages-only = nixpkgsFor.${system}.native.nixComponents2.nix-manual-manpages-only;
nix-internal-api-docs = nixpkgsFor.${system}.native.nixComponents2.nix-internal-api-docs;
nix-external-api-docs = nixpkgsFor.${system}.native.nixComponents2.nix-external-api-docs;
+
+ fallbackPathsNix =
+ let
+ pkgs = nixpkgsFor.${system}.native;
+
+ closures = forAllSystems (system: self.packages.${system}.default.outPath);
+
+ closures_json =
+ pkgs.runCommand "versions.json"
+ {
+ buildInputs = [ pkgs.jq ];
+ passAsFile = [ "json" ];
+ json = builtins.toJSON closures;
+ }
+ ''
+ cat "$jsonPath" | jq . > $out
+ '';
+
+ closures_nix =
+ pkgs.runCommand "versions.nix"
+ {
+ buildInputs = [ pkgs.jq ];
+ passAsFile = [ "template" ];
+ jsonPath = closures_json;
+ template = ''
+ builtins.fromJSON('''@closures@''')
+ '';
+ }
+ ''
+ export closures=$(cat "$jsonPath");
+ substituteAll "$templatePath" "$out"
+ '';
+ in
+ closures_nix;
}
# We need to flatten recursive attribute sets of derivations to pass `flake check`.
//
@@ -434,8 +460,6 @@
{
# These attributes go right into `packages.`.
"${pkgName}" = nixpkgsFor.${system}.native.nixComponents2.${pkgName};
- "${pkgName}-static" = nixpkgsFor.${system}.native.pkgsStatic.nixComponents2.${pkgName};
- "${pkgName}-llvm" = nixpkgsFor.${system}.native.pkgsLLVM.nixComponents2.${pkgName};
}
// lib.optionalAttrs supportsCross (
flatMapAttrs (lib.genAttrs crossSystems (_: { })) (
@@ -512,32 +536,6 @@
}
)
)
- // lib.optionalAttrs (!nixpkgsFor.${system}.native.stdenv.isDarwin) (
- prefixAttrs "static" (
- forAllStdenvs (
- stdenvName:
- makeShell {
- pkgs = nixpkgsFor.${system}.nativeForStdenv.${stdenvName}.pkgsStatic;
- }
- )
- )
- // prefixAttrs "llvm" (
- forAllStdenvs (
- stdenvName:
- makeShell {
- pkgs = nixpkgsFor.${system}.nativeForStdenv.${stdenvName}.pkgsLLVM;
- }
- )
- )
- // prefixAttrs "cross" (
- forAllCrossSystems (
- crossSystem:
- makeShell {
- pkgs = nixpkgsFor.${system}.cross.${crossSystem};
- }
- )
- )
- )
// {
native = self.devShells.${system}.native-stdenv;
default = self.devShells.${system}.native;
diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 414e6c570ab..7f7447b19e4 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -102,6 +102,7 @@
# Don't format vendored code
''^doc/manual/redirects\.js$''
''^doc/manual/theme/highlight\.js$''
+ ''^src/libfetchers/builtin-flake-registry\.json$''
];
};
shellcheck = {
diff --git a/maintainers/invalidate-store-paths.sh b/maintainers/invalidate-store-paths.sh
new file mode 100755
index 00000000000..a075e262183
--- /dev/null
+++ b/maintainers/invalidate-store-paths.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+set -x
+
+git ls-files -z \
+ | xargs -0 grep -o '[0123456789abcdfghijklmnpqrsvwxyz]\{32\}' 2> /dev/null \
+ | rev \
+ | cut -d: -f1 \
+ | rev \
+ | sort \
+ | uniq \
+ | while read -r oldhash; do
+ if ! curl --fail -I "https://cache.nixos.org/$oldhash.narinfo" > /dev/null 2>&1; then
+ continue
+ fi
+
+ newhash=$(
+ nix eval --expr "builtins.toFile \"006c6ssvddri1sg34wnw65mzd05pcp3qliylxlhv49binldajba5\" \"$oldhash\"" \
+ | cut -d- -f1 \
+ | cut -d/ -f4
+ )
+
+ msg=$(printf "bad: %s -> %s" "$oldhash" "$newhash")
+ echo "$msg"
+ git ls-files -z \
+ | xargs -0 grep -a -l "$oldhash" 2> /dev/null \
+ | while read -r file; do
+ [ -L "$file" ] && continue
+ perl -pi -e "s/$oldhash/$newhash/g" "$file" || true
+ done || true
+ git commit -am "$msg"
+ done
diff --git a/maintainers/keys/158A6F530EA202E5F651611314FAEA63448E1DF9.asc b/maintainers/keys/158A6F530EA202E5F651611314FAEA63448E1DF9.asc
new file mode 100644
index 00000000000..ea00c2c3d54
--- /dev/null
+++ b/maintainers/keys/158A6F530EA202E5F651611314FAEA63448E1DF9.asc
@@ -0,0 +1,110 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGPtMiwBEAC0sFZW2QW/OaDjKm5zGRpDvHXDsMIUtlHfoi5ce8pocC63W05o
+FSXbUZjZ1VfYO8lT8DFANCzTkiXYaZx0cPRG2pVY4AOQZDNFt5XrAyvw496XCAIM
+DTYGFLjCqgjPt9RUFEy4MyHPJTEpB0x3rXgT4ILNu9vsj9Q0vttps7SpbZ3Ldq5H
+o/BBbLW77q/vNjpYzCbBIXF7ycUGpnNv9Go/WuiDnrBMcyxh+8kjjIHB5cxZSnjJ
+DUv681+m83v+gLZQGX/jexQrrf5JpS0X9qEnhGLrNUDhtyv5ud3Je4EfamkjLVVC
+RlNLofgflOCsl/tP80i+K7S1QdKhUALxuJ6H0prYUflGBDxDyC8XYuJ62TT0OUpa
+vJvgwVlCq8/jq+ykYQXlbuBVOzi5wAuI4l3+HqreSQYPSiwe+6N590Zbafdv1fvN
+WFtZKCTGMqfyaaAnppioH9/+NWkI2AQxaYVasYM/JEYvY9pJgA7alh51jHW4JglP
+ErypKfBKPKJID0QENqYoa3bDDCihuNWhgQf9dxzPlj2ckd35Zb6w4DfuSmtjaa9D
+o0jZVY1JbFuxBqP09+saVPrxLHgmPxjcdzPGQQtAqdO2vyJXNEGLFMoVEZPNaLo3
+QmcIJnT7oSck+4vGfOYtWUHXQynu/Tnwsv2XkA/uyw8HNe+RRMqv/apnzQARAQAB
+tCdTZXJnZWkgWmltbWVybWFuIDxzZXJnZWlAemltbWVybWFuLmZvbz6JAlEEEwEK
+ADsCGwEFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AWIQQVim9TDqIC5fZRYRMU+upj
+RI4d+QUCaUbsaAIZAQAKCRAU+upjRI4d+VdDD/492HRaJ/8V7R7VUzkafmb2Hb28
+SLf7oiB8Uq9I7SukiDEaIT1fUhquYWQ9KWpPRNR1TX6ApXnIeuJRMGFoDVIRnmnr
+cKnYYXfqqc81VxIyKvaumB7KWbS7G4Nbor8AH1ouOOOMMS50OTJOWQA4A26inIuG
+n+7L8MeS5aT+3uNKDoTKsidC47vnaxNMcke1taPfbfo7vn69PsRCM/g9/7TQYU8b
+6xp+pM9Ao9nJneRk2YCpsGYRrWTpaik0DFKnfpPKJM/yunhtGLF2IYAp3l1mvHPK
+nnzo92zjpQuZwazEIK+23V1vRT4IjM2BewbJPAzf2/UuxEjjgNQm0tOtH2JhFNeB
+VM0BVrGxWrrwrsmv6lWghTtBc6zRWyHrj/rpjtVQNmeKYrHWJeXwVz1rqgGPmB2N
+k0MZD1UjHHhEs1Cntn7yLmxTPztRJCtR+euRu81Uo2NAvrMJ4xsDjaM0LeLTnzjV
+9AsPjD188dOFyz7VExZum4+XaaEJ41FIPLEqU3U0GAa6stEy0ylSlIN4x9aiXXVW
+xfzHHchS5jK6QAjuZxN8t01GRactNylINRf7uoTECFZTtXNqfeuk0HQxBH0LuKVE
+0PxJbcNI4mVWw1KgTJ8PUVC1IXP3sEpqPdJOYiRXgnpcS26fWOBu0aQ4mhxiaJhr
+/zBfrkLEqp20TdNDZLkCDQRj7TM1ARAAt73xO24curnHTTgXkkVMMRzcMLx3Mb1a
+2FuddxC5hzTpEpw01L91UBrXVJEg9K2KAwP5CtCLgPCqXr47Tm7krvHxWwBksgY/
+6aHRsoPQfCFUZHc0aiO+C4NCzR+aEeGKn66Oc1Hq9oUTpDgiBWhsuEPiyA1OSGF0
+4L0jeTCqfm68kWp4PIK9yuugkdDsoyj6TonuMsb3V5ctHLqop9KH+eHSkUTPo+Lk
++bxaeAOJ1UfbohgbRbrYKAfsaghhOMDH3R1w2pvtUJz+sDbuQsiPFTqbxsXDTFws
+H4N/AQCYnnvOhqEek2sOEZ19bJXt5UrAr10mX4PGmAkWqE1JWBxpOKG3BXSGOTu1
+3dFhQfPMK+PmvUrs0kcWQr53K/aRUdKKhIfTcMfkqYTGPK5HclHph24WjXj3QFFA
+SjksQTdm6486ZmLZK4CTbAFOPfTF/aWg8gu9v4ihdq6lqHNNXxv2xBAChcd59H7p
+D5zy9z8SpwWR9V5JDmlF6HWIIau1c6lSsQq1xHvYM8EuPe03vJvor+2u/cn5zYF1
+5ZxAuPI2i5vtavg1s8ZGAAogJ9dVcP36LdJfL9quXWvmovkd//qHIepBB+l/zQio
+ZRDZlIcfV3Xycaqsb5OqHGARHE0097koipMt5y/iXlqG4Ruue6Idb8bW96EKpaWj
+kKy/iNfQfQMAEQEAAYkEcgQYAQoAJgIbAhYhBBWKb1MOogLl9lFhExT66mNEjh35
+BQJpRuz3BQkJHCDCAkDBdCAEGQEKAB0WIQRK3hK0WyJ4BicGpcmpsLVXymMjJQUC
+Y+0zNQAKCRCpsLVXymMjJbdSD/9+f1FOOeGDAJI6Duo5fsWnf4xJJdtQtDbz6d2A
+SeDapxeJ3zWfKBD0wu5sISEa0uiWsYSmLtsa2SqVAKHlEaMGRR+tkBMPQ+rvgI4c
+62YjGTgm+IPd+NFIn+ixFU1hpinTh+KhUEoeOwWCvKs9nZfSG9vkienfiG0bBxo2
+zrvBzXA50x5hbUL+ghKu/AVfN9qZDwh30O4KZTwk4g4cM9SeaQa4YvHYIS3IEhDZ
+hGybwrrqV9cs92ln4IJw9WCy9QReBNrdeFgC4+3ziUp1QsG3RvqrtuMttwBVC1Z3
+bj5QjLLOREhhodfvk98t9yVkragObb4rGrLo1mWuF0c4mJGvXwnrqhCMvzv4M+0T
+Zdrmw6YpGkGOaOPghVuwoTtqSAkl+zFWIJS89jidvkYG3EqKAkgLKog/TQReCq13
+HWrF8cMck+Rf2K8k26q/RNZaA9ZUKjLExzz8lsWmd2C7rvkGLrlxnzxz0gGyNR3Q
+KK74vcPhqeABt2GSkHtEXZFFA9IVVzwlRWK3e0S+mVQnZVjNL+cBPn3/hZHMLesB
+CucyYZv+DxvT+JkYXBkGSw4s3hpABqGym7gdPUIa0q4rbBFG6xP5sLLBG4yru8vV
+2dyCMmFqRuxpT49uNfyQ6Vj+dobN6qHnP/9NwfzOixXYBHXR6LBqb/M+iCiJaaIn
+uiRLHwkQFPrqY0SOHfkQpA//W51vj8meuz7snRO+vZFcjLneFFzqfh1Jdz8IqDpO
+CkI5pBJmi8e0oSe6r68MkahiQLlYPwm7d+sjHvJhPWipNKWq/uwCgBs+Ac1lpPXR
+MwLbrZukcLMYlLmb2MrCKmjcMt0BZsZKBNYL3a3X9nHgwXdeqFYS4WQDMCCc09lz
+9YqfdoEsqRO4qN7D0hFqnwjOzb34ixZ6UO8a8ekY9QKxAgWc9fJWGMg6Pjdg4qsK
+nqymOIAdGVOJdoRM46wKGVBvbsF2gNfQU4XyzgJo5vHGFwJm6EoSnODlL5e2wsQh
+uN1oqBt/8ef/plloMEqVBweUBATqSqjRF6IhhYJvWVuQHQL1p1vnV9FebiVj34ir
+Z8ID+o0AnTJcclbUcDwannGJ0cuDcPhk/v/ahVuoMERCi12qnMBo5B/e6Omyh1yB
+4pbf4GATGGQipDQG75eC/kP2GQEqJP5WYN0Ar8Le/AA/2xyL7upW0yIByyXCwGEb
+JRwEgU3+bPyu58bFt8Pftit6J7rA3oBVVMOPrYH5eZwRaj5m2RptwKGL6BfHnhNv
+ZqmCq9EBGX6L1NI0xHMjEFfXJ8jU01XdfG8nCqkwqsHwslXLhqjJphfHcx89YwbV
+/15GCuURAv1cKe/7277sOhcvP/QpQqSWgvYExHw8PeFJcTYtF2NrRgNwcQsWS1Rj
+gXa5Ag0EY+0zcAEQANC5N6kSfezuucAgi+X3BD+MT37mxQyvICSggEJf1LDSmy0+
+bnvD7setL8CP9etTA2fcVNYKI1oboMyhoCnsRP2jDdv1iXOI/hZg4wSb/D1yUkae
+fUpxv3Wuci2QKavH2MfraDD7BFMbsQeMcHtn4Rk216T6jndZHnzT1Ih7iX0XeQPb
+li5fojOiZssgWAVT4HPXFCJB6lI35Hjp35oRYwrtMmu5INinZ79n9h1igGtt1ItZ
+b7rQKNd772Jxcn4UU71ovORSL/xT5i5sxZ+evQOxkpqUAokMOFaoHcOXLmA1NsFv
+yryXHK4Ioq9ap2jKlLTWkJWjua9JZ4AmKhbvT8X4ELxIKSCAdJKAWP8ZHbXNu5MD
+aznyzZQLxSO7uFvu356De75mI5iohZNj5wB5Wju71pBiorTKVj4+iJ4e+xVIzFdG
+hFC0DehNcl2t9w/y8qHwIQ1yUAjXHLXq0/2jsVeH6bU5q/MsgvUP1jcFe0eyOpxy
+CDvyFdzZFbI57TnB/fvcZTRZ5ewXMFpH8gzuoFzAjUAP95UjYKgaGdrNPNIy28Ii
+4zhvdghei2+n9jgiMfcGQg8lyfH5yF0vWWWynX0KcJsRwEZoL2EauVdwq4PcYOoU
+pQFhpcreCjD4LdZ4yRU4InbhcUogXjrQ9Dz01TbPmQD5b5iso21bCEFBXrhzABEB
+AAGJAjwEGAEKACYCGwwWIQQVim9TDqIC5fZRYRMU+upjRI4d+QUCaUbs9wUJCRwg
+hwAKCRAU+upjRI4d+X/XD/sH5xvHPfTJq52v8weFmB52up+DzqG2lyhGdoUQ1Muw
+dRDLTLXLJrFdfpoOo7/j4Scr0rdc7/dpCn0DLcPuCoPxu+SkjEnVehFmZrGSv7Ga
+x9dHr3DBh42fdlX/U/EnDuyosY0JU1gNF2/6FIA+bTTOFE3RxfN906RjslYQDjMZ
+UAlSeLYHOZofdltI0YIr32vrxgdWQGZXPxU4XusDUc0z163OO+TGg7iUNWFZP5Qj
+ubM7e0YbDX0NPIshk8us99YJmrWnhaix1/W5ryO3DXiGaQ7XFi9u7QofRqvRIctg
+QXavdepkzJow9V9qpMECAJePIuICq7rm+xy+njjbuF436W7390bfVBwRr+FPADsl
+jgQP4KvY5rykss30kheom8wNEbveWkhH5oTfH9b7O4KXJfpfJzrlgOWp2BD9JL8t
+/M4HvFXTr2a75H/QbHK5OFrZeGATuv9OTxv7EZvnrPXU+DYTFldpu7TrNNqKCoj3
+ZyXmc3Hhg5kskDhfHJppaeOayuhMOpT3ud1MFzROY5SLVIH8rBR12KUgsCUYQcGs
+Iy0+0QvEGkjb4cAH1NK3VlbqVNsy1RmqRt2B28R2ueewDfTOoqkzt4MmzLqTdnAx
+mTqmHmkEKhEf3K4MRNUPO2yieUg2COk5l6x9HhAnoxxeOZrTmcMsPY/UViG2HEPm
+ybkCDQRj7TRDARAA9DZuKdfKq4Bs2+NwxC0aplljWOl8VIsEVg+Q8agD7/HU6/b6
+Dry0njtWybn2x6Axf/nUdeOC01Fi1lmht/fpj6mRkgAvd/V6P10xnsUoykPSDSTh
+P25MFFGW3JAA82bwdJ4AJpEQvTZG2nTb3237vlBiI1qHQrac8GYkju2O4UfySRN6
+7cyi7bMf2pjWBBOEhaNy4b6CMDsb32P/N5J7sTE/TXgrS+u4ITIgjzSrkUkh5Z+B
+8QVRa7xPIDZJdvZWTEXWu5fgRPZvxbr154GIkWJkFzlDoB1UcO56/uzRUuKhEV6o
+HW3LMUuWdPMjpHpq8hrL0G2rDniJFUtbDFzHdZK1LUU3T2BJM8rjI3D/euph+IDT
+27vl5qo72zCYE/iKzx4FMLZcQvx1kUAxkPX8l+dzZEwKeRIIpFDxQvatRtl+z0bM
+jbkpDb+Yjv66sC4dYRpgTTGX6rok0PWHR3IxDNzyf2j8zQ4LFJ+rVBM1GjGSt6mG
+j9TeL8CVeiSp4SuJ7I/FJVPHsKb50m+BDzeB31qTydNqh2kKr0DVAUa+TUsCr7e0
+OYr8WE2adJcRXIW0qw50xXF+W7/05GqSCVD0dpeOUdBTQTsSkQmM3/0hcj9aVo9e
+UDCM9RF0WRqiDAoHzJFfg+ztamkQI5HO6CklC4Ok22qrHRf6HDNYSuT6QFkAEQEA
+AYkCPQQYAQoAJwMbIAQWIQQVim9TDqIC5fZRYRMU+upjRI4d+QUCaUbs9wUJCRwf
+tAAKCRAU+upjRI4d+Y+cD/9yllG6uo934pcHNsVppZBfREFwSc8ywlbosCuSVpay
+PjSqgrWwDrnqrsk0F2kUdC6rR3BIcXbn+lA9KqylH+cCXAJCkh8EDq6TlQ7Lt5EV
+w1U0MAMXOyxPwDymQ/BO+iDyjXWkRRYgbF5XiFhCfGeuKyhkhACisAgNZ1uA1P5k
+0SJYc14YfEhQkB46Y20SpfVHRsQ46FyNB6GHbmTmfoO8La8VTh++7GBdh85HfvkG
+VNQ3wpi5oXsOLN9+MJOezc0XsW2LQsKQj1/J7QKzGh+lxN5cemsA5aqPzh8dyxeT
+0lYRFp4AHkimqGUomVpRkbegMIPxXqOE+ZAmsddErw0UtmrKxcmMptOJwNgYzEgu
+++2vtqerL/NYp+wsdcWaBjCz2F3NiwHgNli7NSB/FPwucZZ5gN5C4SnmeFzrGdHg
+Oy+tQUN6ayQKljHeBO7CjMlsFNo/dcVrEMa1ShxBMqlj/6ivoEhktLz0Nru4FwNU
+xE5SJYDYfpjD7Ws8y4LoXgWXjFHrMO6N9GzqLN/e8LT7I+w4ps2MrgJ8QSrelmQ3
+rjkxp3uWp5v2lqy4rLfpi9iB6zIAeoN2eU1yOM9joxOYMxKYaYeYyP1Mm90wFol8
+LcTSaN+tVniPddBiL6zvsGBEMbCR9XN3EQ+mErbuw5ovWBOCrr+dvN3FxvD11y4J
+7w==
+=mXYP
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/maintainers/keys/B541D55301270E0BCF15CA5D8170B4726D7198DE.asc b/maintainers/keys/B541D55301270E0BCF15CA5D8170B4726D7198DE.asc
new file mode 100644
index 00000000000..dee0aef4cc6
--- /dev/null
+++ b/maintainers/keys/B541D55301270E0BCF15CA5D8170B4726D7198DE.asc
@@ -0,0 +1,51 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQENBFZu2zwBCADfatenjH3cvhlU6AeInvp4R0JmPBG942aghFj1Qh57smRcO5Bv
+y9mqrX3UDdmVvu58V3k1k9/GzPnAG1t+c7ohdymv/AMuNY4pE2sfxx7bX+mncTHX
+5wthipn8kTNm4WjREjCJM1Bm5sozzEZetED3+0/dWlnHl8b38evnLsD+WbSrDPVp
+o6M6Eg9IfMwTfcXzdmLmSnGolBWDQ9i1a0x0r3o+sDW5UTnr7jVP+zILcnOZ1Ewl
+Rn9OJ4Qg3ULM7WTMDYpKH4BO7RLR3aJgmsFAHp17vgUnzzFBZ10MCS3UOyUNoyph
+xo3belf7Q9nrHcSNbqSeQuBnW/vafAZUreAlABEBAAG0IkVlbGNvIERvbHN0cmEg
+PGVkb2xzdHJhQGdtYWlsLmNvbT6JATwEEwEIACYCGyMHCwkIBwMCAQYVCAIJCgsE
+FgIDAQIeAQIXgAUCVm7etAIZAQAKCRCBcLRybXGY3q51B/96qt41tmcDSzrj/UTl
+O6rErfW5zFvVsJTZ95Duwu87t/DVhw5lKBQcjALqVddufw1nMzyN/tSOMVDW8xe4
+wMEdcU4+QAMzNX80enuyinsw1glxfLcK0+VbTvqNIfw0sG3MjPqNs6cK2VRfMHK4
+paJjytBVICszNX9TfjLyIpKKoSSo1vqnT47LDZ5GIMy7l9Cs2sO/rqQHSPcR79yz
+8m8tbHpDDEMZmJeklckKP2QoiqnHiIvlisDxLclYnUmNaPdaN/f++qZz5Yqvu1n+
+sNUBA5eLaZH64Uy2SwtABxO3JPJ8nQ2+SFZ7ocFm4Gcdv4aM+Ura9S6fvM91tEJp
+yAQOiQE5BBMBCAAjBQJWbts8AhsjBwsJCAcDAgEGFQgCCQoLBBYCAwECHgECF4AA
+CgkQgXC0cm1xmN6sIAgAielxO8zJREqEkA2xudg/o4e9ZlNZ3X1NvY8OzJH/qlB2
+SmwKqwifhtbC1K0uavXA7eaxdtd2zrI+Yq7IooUyv7juMjHTZhLcFbR5iVkQ4Mfp
+JmeHXJ/ChYKxD5mMj/C3WbCZ91oCSNZ6Iyi5fvQj/691OC4q+y/2NEUcOI8D8cw8
+XKHbKtceFYc+nZmdOv3ZZrNTSN/kszGViNNLKgnpPdDVPtLp+vjXtbmitiFG2HL/
+WfbJ+3Gh2Yr1Vy3O9dWKH++e1AmIv7WWqmUjRFVpqC/wr7/BLaScWT8WKF5vkshU
+gq8Ez1/cuizsgs3wQIZWgXKQK5njvwnbKg+Zmh/uGbQmRWVsY28gRG9sc3RyYSA8
+ZWVsY28uZG9sc3RyYUB0d2VhZy5pbz6JAU4EEwEIADgWIQS1QdVTAScOC88Vyl2B
+cLRybXGY3gUCXELt4gIbIwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRCBcLRy
+bXGY3ujFCADfS5D1xHU8KH6TpqgssSggYVq62Wwn/Ga+4XPPetM+ajcXagyH6SwB
+mxlHICcnv9xC93ryiTI10P1ADJl+aBsI66wEdHBU+ty4RTDy4JZNUPtmRCk9LhSc
+mtUO3ry/wtWkRLdJxP49hg7BbQvWoU0M6WODp7SJjPKPWNX64mzHBeOuy+DqGCbM
+lpGNCvW8ahU/ewbm7+xwWmzqLDoWzXjHsdF4QdzMVM/vkAgWEP4y0wEqFASzIYaR
+GNEkBWU4OQVq5Bdm9+wWWAgsbM0FJAQl0GDqnz4QxWzxxCAAXdbh9F5ffafWYsA9
+bise4ZQLkvYo6iUnrcFm4dtZbT8iL3gptCtFZWxjbyBEb2xzdHJhIDxlZWxjby5k
+b2xzdHJhQGxvZ2ljYmxveC5jb20+iQE5BBMBCAAjBQJWbt6nAhsjBwsJCAcDAgEG
+FQgCCQoLBBYCAwECHgECF4AACgkQgXC0cm1xmN4b/wf8DApMV/jSPEpibekrUPQu
+Ye3Z8cxBQuRm/nOPowtPEH/ShAevrCdRiob2nuEZWNoqZ2e5/+6ud07Hs9bslvco
+cDv1jeY1dof1idxfKhH3kfSpuD2XJhuzQBxBqOrIlCS/rdnW+Y9wOGD7+bs9QpcA
+IyAeQGLLkfggAxaGYQ2Aev8pS7i3a/+lOWbFhcTe02I49KemCOJqBorG5FfILLNr
+DjO3EoutNGpuz6rZvc/BlymphWBoAdUmxgoObr7NYWgw9pI8WeE6C7bbSOO7p5aQ
+spWXU7Hm17DkzsVDpaJlyClllqK+DdKza5oWlBMe/P02jD3Y+0P/2rCCyQQwmH3D
+RbkBDQRWbts8AQgA0g556xc08dH5YNEjbCwEt1j+XoRnV4+GfbSJIXOl9joIgzRC
+4IaijvL8+4biWvX7HiybfvBKto0XB1AWLZRC3jWKX5p74I77UAcrD+VQ/roWQqlJ
+BKbiQMlRYEsj/5Xnf72G90IP4DAFKvNl+rLChe+jUySA91BCtrYoP75Sw1BE9Cyz
+xEtm4WUzKAJdXI+ZTBttA2Nbqy+GSuzBs7fSKDwREJaZmVrosvmns+pQVG4WPWf4
+0l4mPguDQmZ9wSWZvBDkpG7AgHYDRYRGkMbAGsVfc6cScN2VsSTa6cbeeAEowKxM
+qx9RbY3WOq6aKAm0qDvow1nl7WwXwe8K0wQxfQARAQABiQEfBBgBCAAJBQJWbts8
+AhsMAAoJEIFwtHJtcZjeuAAH/0YNz2Qe1IAEO5oqEZNFOccL4KxVPrBhWUen83/b
+C6PjOnOqv6q5ztAcms88WIKxBlfzIfq+dzJcbKVS/H7TEXgcaC+7EYW8sJVEsipN
+BtEZ3LQNJ5coDjm7WZygniah1lfXNuiritAXduK5FWNNndqGArEaeZ8Shzdo/Uyi
+b9lOsBIL6xc2ZcnX5f+rTu02LCEtEb0FwCycZLEWYf8hG4k8uttIOZOC+CLk/k8d
+kBmPikMwUVTTV0CdT1cemQKdTaoAaK+kurF6FYXwcnjhRlHrisSt/tVMEwTw4LUM
+3MYf6qfjjvE4HlDwZal8th7ccoQp/flfJIuRv85xCcKK+PI=
+=u5cX
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/maintainers/keys/README.md b/maintainers/keys/README.md
new file mode 100644
index 00000000000..ef473eada79
--- /dev/null
+++ b/maintainers/keys/README.md
@@ -0,0 +1,13 @@
+# Maintainer GPG Keys
+
+Release tags are signed by members of the [Nix maintainer team](https://nixos.org/community/teams/nix/) as part of the [release process](../release-process.md). This directory contains the public GPG keys used for signing.
+
+## Keys
+
+- **Eelco Dolstra**
+ GPG Fingerprint: `B541 D553 0127 0E0B CF15 CA5D 8170 B472 6D71 98DE`
+
+- **Sergei Zimmerman**
+ GPG Fingerprint: [`158A 6F53 0EA2 02E5 F651 6113 14FA EA63 448E 1DF9`](https://keys.openpgp.org/vks/v1/by-fingerprint/158A6F530EA202E5F651611314FAEA63448E1DF9)
+
+
diff --git a/maintainers/link-headers b/maintainers/link-headers
new file mode 100755
index 00000000000..2457a2dc829
--- /dev/null
+++ b/maintainers/link-headers
@@ -0,0 +1,83 @@
+#!/usr/bin/env python3
+
+# This script must be run from the root of the Nix repository.
+#
+# For include path hygiene, we need to put headers in a separate
+# directory than sources. But during development, it is nice to paths
+# that are similar for headers and source files, e.g.
+# `foo/bar/baz.{cc,hh}`, e.g. for less typing when opening one file, and
+# then opening the other file.
+#
+# This script symlinks the headers next to the source files to
+# facilitate such a development workflows. It also updates
+# `.git/info/exclude` so that the symlinks are not accidentally committed
+# by mistake.
+
+from pathlib import Path
+import subprocess
+import os
+
+
+def main() -> None:
+ # Path to the source directory
+ GIT_TOPLEVEL = Path(
+ subprocess.run(
+ ["git", "rev-parse", "--show-toplevel"],
+ text=True,
+ stdout=subprocess.PIPE,
+ check=True,
+ ).stdout.strip()
+ )
+
+ # Get header files from git
+ result = subprocess.run(
+ ["git", "-C", str(GIT_TOPLEVEL), "ls-files", "*/include/nix/**.hh"],
+ text=True,
+ stdout=subprocess.PIPE,
+ check=True,
+ )
+ header_files = result.stdout.strip().split("\n")
+ header_files.sort()
+
+ links = []
+ for file_str in header_files:
+ project_str, header_str = file_str.split("/include/nix/", 1)
+ project = Path(project_str)
+ header = Path(header_str)
+
+ # Reconstruct the full path (relative to SRC_DIR) to the header file.
+ file = project / "include" / "nix" / header
+
+ # The symlink should be created at "project/header", i.e. next to the project's sources.
+ link = project / header
+
+ # Compute a relative path from the symlink's parent directory to the actual header file.
+ relative_source = os.path.relpath(
+ GIT_TOPLEVEL / file, GIT_TOPLEVEL / link.parent
+ )
+
+ # Create the symbolic link.
+ full_link_path = GIT_TOPLEVEL / link
+ full_link_path.parent.mkdir(parents=True, exist_ok=True)
+ if full_link_path.is_symlink():
+ full_link_path.unlink()
+ full_link_path.symlink_to(relative_source)
+ links.append(link)
+
+ # Generate .gitignore file
+ gitignore_path = GIT_TOPLEVEL / ".git" / "info" / "exclude"
+ gitignore_path.parent.mkdir(parents=True, exist_ok=True)
+ with gitignore_path.open("w") as gitignore:
+ gitignore.write("# DO NOT EDIT! Autogenerated\n")
+ gitignore.write(
+ "# Symlinks for headers to be next to sources for development\n"
+ )
+ gitignore.write('# Run "maintainers/link-headers" to regenerate\n\n')
+ gitignore.write('# Run "maintainers/link-headers" to regenerate\n\n')
+
+ for link in links:
+ gitignore.write(f"/{link}\n")
+
+
+if __name__ == "__main__":
+ main()
diff --git a/maintainers/release-process.md b/maintainers/release-process.md
index 68de3b67778..f8b6b6bec57 100644
--- a/maintainers/release-process.md
+++ b/maintainers/release-process.md
@@ -5,11 +5,11 @@
The release process is intended to create the following for each
release:
-* A Git tag
+* A signed Git tag (public keys in `maintainers/keys/`)
* Binary tarballs in https://releases.nixos.org/?prefix=nix/
-* Docker images
+* Docker images (arm64 and amd64 variants, uploaded to DockerHub and GHCR)
* Closures in https://cache.nixos.org
@@ -104,21 +104,17 @@ release:
evaluation ID (e.g. `1780832` in
`https://hydra.nixos.org/eval/1780832`).
-* Tag the release and upload the release artifacts to
- [`releases.nixos.org`](https://releases.nixos.org/) and [Docker Hub](https://hub.docker.com/):
+* Tag the release:
```console
- $ IS_LATEST=1 ./maintainers/upload-release.pl
+ $ IS_LATEST=1 ./maintainers/upload-release.pl --skip-docker --skip-s3 --project-root $PWD
```
Note: `IS_LATEST=1` causes the `latest-release` branch to be
force-updated. This is used by the `nixos.org` website to get the
[latest Nix manual](https://nixos.org/manual/nixpkgs/unstable/).
- TODO: This script requires the right AWS credentials. Document.
-
- TODO: This script currently requires a
- `/home/eelco/Dev/nix-pristine`.
+* Trigger the [`upload-release.yml` workflow](https://github.com/NixOS/nix/actions/workflows/upload-release.yml) via `workflow_dispatch` trigger. At the top click `Run workflow` -> select the current release branch from `Use workflow from` -> fill in `Hydra evaluation ID` with `` value from previous steps -> click `Run workflow`. Wait for the run to be approved by `NixOS/nix-team` (or bypass checks if warranted). Wait for the workflow to succeed.
TODO: trigger nixos.org netlify: https://docs.netlify.com/configure-builds/build-hooks/
@@ -181,16 +177,18 @@ release:
* Wait for the desired evaluation of the maintenance jobset to finish
building.
-* Run
+* Tag the release
```console
- $ IS_LATEST=1 ./maintainers/upload-release.pl
+ $ IS_LATEST=1 ./maintainers/upload-release.pl --skip-docker --skip-s3 --project-root $PWD
```
Omit `IS_LATEST=1` when creating a point release that is not on the
most recent stable branch. This prevents `nixos.org` to going back
to an older release.
+* Trigger the [`upload-release.yml` workflow](https://github.com/NixOS/nix/actions/workflows/upload-release.yml) via `workflow_dispatch` trigger. At the top click `Run workflow` -> select the current release branch from `Use workflow from` -> fill in `Hydra evaluation ID` with `` value from previous steps -> click `Run workflow`. Wait for the run to be approved by `NixOS/nix-team` (or bypass checks if warranted). Wait for the workflow to succeed.
+
* Bump the version number of the release branch as above (e.g. to
`2.12.2`).
diff --git a/maintainers/upload-release.pl b/maintainers/upload-release.pl
index 31a9c71d543..f7678b7d1c0 100755
--- a/maintainers/upload-release.pl
+++ b/maintainers/upload-release.pl
@@ -1,7 +1,8 @@
#! /usr/bin/env nix-shell
-#! nix-shell -i perl -p perl perlPackages.LWPUserAgent perlPackages.LWPProtocolHttps perlPackages.FileSlurp perlPackages.NetAmazonS3 gnupg1
+#! nix-shell -i perl -p awscli2 perl perlPackages.LWPUserAgent perlPackages.LWPProtocolHttps perlPackages.FileSlurp perlPackages.NetAmazonS3 perlPackages.GetoptLongDescriptive gnupg1
use strict;
+use Getopt::Long::Descriptive;
use Data::Dumper;
use File::Basename;
use File::Path;
@@ -13,7 +14,30 @@
delete $ENV{'shell'}; # shut up a LWP::UserAgent.pm warning
-my $evalId = $ARGV[0] or die "Usage: $0 EVAL-ID\n";
+my ($opt, $usage) = describe_options(
+ '%c %o ',
+ [ 'skip-docker', 'Skip Docker image upload' ],
+ [ 'skip-git', 'Skip Git tagging' ],
+ [ 'skip-s3', 'Skip S3 upload' ],
+ [ 'docker-owner=s', 'Docker image owner', { default => 'nixos/nix' } ],
+ [ 'project-root=s', 'Pristine git repository path' ],
+ [ 's3-endpoint=s', 'Custom S3 endpoint' ],
+ [ 's3-host=s', 'S3 host', { default => 's3-eu-west-1.amazonaws.com' } ],
+ [],
+ [ 'help|h', 'Show this help message', { shortcircuit => 1 } ],
+ [],
+ [ 'Environment variables:' ],
+ [ 'AWS_ACCESS_KEY_ID' ],
+ [ 'AWS_SECRET_ACCESS_KEY' ],
+ [ 'AWS_SESSION_TOKEN For OIDC' ],
+ [ 'IS_LATEST Set to "1" to mark as latest release' ],
+);
+
+print($usage->text), exit if $opt->help;
+
+my $evalId = $ARGV[0] or do { print STDERR $usage->text; exit 1 };
+
+die "--project-root is required unless --skip-git is specified\n" unless $opt->skip_git || $opt->project_root;
my $releasesBucketName = "nix-releases";
my $channelsBucketName = "nix-channels";
@@ -62,25 +86,38 @@ sub fetch {
my $binaryCache = "https://cache.nixos.org/?local-nar-cache=$narCache";
# S3 setup.
-my $aws_access_key_id = $ENV{'AWS_ACCESS_KEY_ID'} or die "No AWS_ACCESS_KEY_ID given.";
-my $aws_secret_access_key = $ENV{'AWS_SECRET_ACCESS_KEY'} or die "No AWS_SECRET_ACCESS_KEY given.";
-
-my $s3 = Net::Amazon::S3->new(
- { aws_access_key_id => $aws_access_key_id,
- aws_secret_access_key => $aws_secret_access_key,
- retry => 1,
- host => "s3-eu-west-1.amazonaws.com",
- });
-
-my $releasesBucket = $s3->bucket($releasesBucketName) or die;
-
-my $s3_us = Net::Amazon::S3->new(
- { aws_access_key_id => $aws_access_key_id,
- aws_secret_access_key => $aws_secret_access_key,
- retry => 1,
- });
-
-my $channelsBucket = $s3_us->bucket($channelsBucketName) or die;
+my $aws_access_key_id = $ENV{'AWS_ACCESS_KEY_ID'};
+my $aws_secret_access_key = $ENV{'AWS_SECRET_ACCESS_KEY'};
+my $aws_session_token = $ENV{'AWS_SESSION_TOKEN'};
+
+my ($s3, $releasesBucket, $s3_channels, $channelsBucket);
+
+unless ($opt->skip_s3) {
+ $aws_access_key_id or die "No AWS_ACCESS_KEY_ID given.";
+ $aws_secret_access_key or die "No AWS_SECRET_ACCESS_KEY given.";
+
+ $s3 = Net::Amazon::S3->new(
+ { aws_access_key_id => $aws_access_key_id,
+ aws_secret_access_key => $aws_secret_access_key,
+ $aws_session_token ? (aws_session_token => $aws_session_token) : (),
+ retry => 1,
+ host => $opt->s3_host,
+ secure => ($opt->s3_endpoint && $opt->s3_endpoint =~ /^http:/) ? 0 : 1,
+ });
+
+ $releasesBucket = $s3->bucket($releasesBucketName) or die;
+
+ $s3_channels = Net::Amazon::S3->new(
+ { aws_access_key_id => $aws_access_key_id,
+ aws_secret_access_key => $aws_secret_access_key,
+ $aws_session_token ? (aws_session_token => $aws_session_token) : (),
+ retry => 1,
+ $opt->s3_endpoint ? (host => $opt->s3_host) : (),
+ $opt->s3_endpoint ? (secure => ($opt->s3_endpoint =~ /^http:/) ? 0 : 1) : (),
+ });
+
+ $channelsBucket = $s3_channels->bucket($channelsBucketName) or die;
+}
sub getStorePath {
my ($jobName, $output) = @_;
@@ -115,11 +152,12 @@ sub copyManual {
File::Path::remove_tree("$tmpDir/manual.tmp", {safe => 1});
}
- system("aws s3 sync '$tmpDir/manual' s3://$releasesBucketName/$releaseDir/manual") == 0
+ my $awsEndpoint = $opt->s3_endpoint ? "--endpoint-url " . $opt->s3_endpoint : "";
+ system("aws $awsEndpoint s3 sync '$tmpDir/manual' s3://$releasesBucketName/$releaseDir/manual") == 0
or die "syncing manual to S3\n";
}
-copyManual;
+copyManual unless $opt->skip_s3;
sub downloadFile {
my ($jobName, $productNr, $dstName) = @_;
@@ -158,30 +196,12 @@ sub downloadFile {
return $sha256_expected;
}
-downloadFile("binaryTarball.i686-linux", "1");
-downloadFile("binaryTarball.x86_64-linux", "1");
-downloadFile("binaryTarball.aarch64-linux", "1");
-downloadFile("binaryTarball.x86_64-darwin", "1");
-downloadFile("binaryTarball.aarch64-darwin", "1");
-eval {
- downloadFile("binaryTarballCross.x86_64-linux.armv6l-unknown-linux-gnueabihf", "1");
-};
-warn "$@" if $@;
-eval {
- downloadFile("binaryTarballCross.x86_64-linux.armv7l-unknown-linux-gnueabihf", "1");
-};
-warn "$@" if $@;
-eval {
- downloadFile("binaryTarballCross.x86_64-linux.riscv64-unknown-linux-gnu", "1");
-};
-warn "$@" if $@;
-downloadFile("installerScript", "1");
-
-# Upload docker images to dockerhub.
+# Upload docker images.
my $dockerManifest = "";
my $dockerManifestLatest = "";
my $haveDocker = 0;
+unless ($opt->skip_docker) {
for my $platforms (["x86_64-linux", "amd64"], ["aarch64-linux", "arm64"]) {
my $system = $platforms->[0];
my $dockerPlatform = $platforms->[1];
@@ -195,8 +215,8 @@ sub downloadFile {
print STDERR "loading docker image for $dockerPlatform...\n";
system("docker load -i $tmpDir/$fn") == 0 or die;
- my $tag = "nixos/nix:$version-$dockerPlatform";
- my $latestTag = "nixos/nix:latest-$dockerPlatform";
+ my $tag = $opt->docker_owner . ":$version-$dockerPlatform";
+ my $latestTag = $opt->docker_owner . ":latest-$dockerPlatform";
print STDERR "tagging $version docker image for $dockerPlatform...\n";
system("docker tag nix:$version $tag") == 0 or die;
@@ -219,68 +239,94 @@ sub downloadFile {
}
if ($haveDocker) {
+ my $dockerOwner = $opt->docker_owner;
print STDERR "creating multi-platform docker manifest...\n";
- system("docker manifest rm nixos/nix:$version");
- system("docker manifest create nixos/nix:$version $dockerManifest") == 0 or die;
+ system("docker manifest rm $dockerOwner:$version");
+ system("docker manifest create $dockerOwner:$version $dockerManifest") == 0 or die;
if ($isLatest) {
print STDERR "creating latest multi-platform docker manifest...\n";
- system("docker manifest rm nixos/nix:latest");
- system("docker manifest create nixos/nix:latest $dockerManifestLatest") == 0 or die;
+ system("docker manifest rm $dockerOwner:latest");
+ system("docker manifest create $dockerOwner:latest $dockerManifestLatest") == 0 or die;
}
print STDERR "pushing multi-platform docker manifest...\n";
- system("docker manifest push nixos/nix:$version") == 0 or die;
+ system("docker manifest push $dockerOwner:$version") == 0 or die;
if ($isLatest) {
print STDERR "pushing latest multi-platform docker manifest...\n";
- system("docker manifest push nixos/nix:latest") == 0 or die;
+ system("docker manifest push $dockerOwner:latest") == 0 or die;
}
}
+}
-# Upload nix-fallback-paths.nix.
-write_file("$tmpDir/fallback-paths.nix",
- "{\n" .
- " x86_64-linux = \"" . getStorePath("build.nix-everything.x86_64-linux") . "\";\n" .
- " i686-linux = \"" . getStorePath("build.nix-everything.i686-linux") . "\";\n" .
- " aarch64-linux = \"" . getStorePath("build.nix-everything.aarch64-linux") . "\";\n" .
- " riscv64-linux = \"" . getStorePath("buildCross.nix-everything.riscv64-unknown-linux-gnu.x86_64-linux") . "\";\n" .
- " x86_64-darwin = \"" . getStorePath("build.nix-everything.x86_64-darwin") . "\";\n" .
- " aarch64-darwin = \"" . getStorePath("build.nix-everything.aarch64-darwin") . "\";\n" .
- "}\n");
# Upload release files to S3.
-for my $fn (glob "$tmpDir/*") {
- my $name = basename($fn);
- next if $name eq "manual";
- my $dstKey = "$releaseDir/" . $name;
- unless (defined $releasesBucket->head_key($dstKey)) {
- print STDERR "uploading $fn to s3://$releasesBucketName/$dstKey...\n";
-
- my $configuration = ();
- $configuration->{content_type} = "application/octet-stream";
-
- if ($fn =~ /.sha256|install|\.nix$/) {
- $configuration->{content_type} = "text/plain";
+unless ($opt->skip_s3) {
+ downloadFile("binaryTarball.i686-linux", "1");
+ downloadFile("binaryTarball.x86_64-linux", "1");
+ downloadFile("binaryTarball.aarch64-linux", "1");
+ downloadFile("binaryTarball.x86_64-darwin", "1");
+ downloadFile("binaryTarball.aarch64-darwin", "1");
+ eval {
+ downloadFile("binaryTarballCross.x86_64-linux.armv6l-unknown-linux-gnueabihf", "1");
+ };
+ warn "$@" if $@;
+ eval {
+ downloadFile("binaryTarballCross.x86_64-linux.armv7l-unknown-linux-gnueabihf", "1");
+ };
+ warn "$@" if $@;
+ eval {
+ downloadFile("binaryTarballCross.x86_64-linux.riscv64-unknown-linux-gnu", "1");
+ };
+ warn "$@" if $@;
+ downloadFile("installerScript", "1");
+
+ # Upload nix-fallback-paths.nix.
+ write_file("$tmpDir/fallback-paths.nix",
+ "{\n" .
+ " x86_64-linux = \"" . getStorePath("build.nix-everything.x86_64-linux") . "\";\n" .
+ " i686-linux = \"" . getStorePath("build.nix-everything.i686-linux") . "\";\n" .
+ " aarch64-linux = \"" . getStorePath("build.nix-everything.aarch64-linux") . "\";\n" .
+ " riscv64-linux = \"" . getStorePath("buildCross.nix-everything.riscv64-unknown-linux-gnu.x86_64-linux") . "\";\n" .
+ " x86_64-darwin = \"" . getStorePath("build.nix-everything.x86_64-darwin") . "\";\n" .
+ " aarch64-darwin = \"" . getStorePath("build.nix-everything.aarch64-darwin") . "\";\n" .
+ "}\n");
+
+ for my $fn (glob "$tmpDir/*") {
+ my $name = basename($fn);
+ next if $name eq "manual";
+ my $dstKey = "$releaseDir/" . $name;
+ unless (defined $releasesBucket->head_key($dstKey)) {
+ print STDERR "uploading $fn to s3://$releasesBucketName/$dstKey...\n";
+
+ my $configuration = ();
+ $configuration->{content_type} = "application/octet-stream";
+
+ if ($fn =~ /.sha256|install|\.nix$/) {
+ $configuration->{content_type} = "text/plain";
+ }
+
+ $releasesBucket->add_key_filename($dstKey, $fn, $configuration)
+ or die $releasesBucket->err . ": " . $releasesBucket->errstr;
}
-
- $releasesBucket->add_key_filename($dstKey, $fn, $configuration)
- or die $releasesBucket->err . ": " . $releasesBucket->errstr;
}
-}
-# Update the "latest" symlink.
-$channelsBucket->add_key(
- "nix-latest/install", "",
- { "x-amz-website-redirect-location" => "https://releases.nixos.org/$releaseDir/install" })
- or die $channelsBucket->err . ": " . $channelsBucket->errstr
- if $isLatest;
+ # Update the "latest" symlink.
+ $channelsBucket->add_key(
+ "nix-latest/install", "",
+ { "x-amz-website-redirect-location" => "https://releases.nixos.org/$releaseDir/install" })
+ or die $channelsBucket->err . ": " . $channelsBucket->errstr
+ if $isLatest;
+}
# Tag the release in Git.
-chdir("/home/eelco/Dev/nix-pristine") or die;
-system("git remote update origin") == 0 or die;
-system("git tag --force --sign $version $nixRev -m 'Tagging release $version'") == 0 or die;
-system("git push --tags") == 0 or die;
-system("git push --force-with-lease origin $nixRev:refs/heads/latest-release") == 0 or die if $isLatest;
+unless ($opt->skip_git) {
+ chdir($opt->project_root) or die "Cannot chdir to " . $opt->project_root . ": $!";
+ system("git remote update origin") == 0 or die;
+ system("git tag --force --sign $version $nixRev -m 'Tagging release $version'") == 0 or die;
+ system("git push origin refs/tags/$version") == 0 or die;
+ system("git push --force-with-lease origin $nixRev:refs/heads/latest-release") == 0 or die if $isLatest;
+}
File::Path::remove_tree($narCache, {safe => 1});
File::Path::remove_tree($tmpDir, {safe => 1});
diff --git a/packaging/components.nix b/packaging/components.nix
index dbf2180e894..6402e8b7b2f 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -27,7 +27,7 @@ let
pkg-config
;
- baseVersion = lib.fileContents ../.version;
+ baseVersion = lib.fileContents ../.version-determinate;
versionSuffix = lib.optionalString (!officialRelease) "pre";
@@ -51,15 +51,6 @@ let
exts: userFn: stdenv.mkDerivation (lib.extends (lib.composeManyExtensions exts) userFn);
setVersionLayer = finalAttrs: prevAttrs: {
- preConfigure =
- prevAttrs.preConfigure or ""
- +
- # Update the repo-global .version file.
- # Symlink ./.version points there, but by default only workDir is writable.
- ''
- chmod u+w ./.version
- echo ${finalAttrs.version} > ./.version
- '';
};
localSourceLayer =
diff --git a/packaging/dependencies.nix b/packaging/dependencies.nix
index 7b7ee0ecf4d..16ded9c97c4 100644
--- a/packaging/dependencies.nix
+++ b/packaging/dependencies.nix
@@ -30,17 +30,22 @@ scope: {
NIX_CFLAGS_COMPILE = "-DINITIAL_MARK_STACK_SIZE=1048576";
});
- lowdown = pkgs.lowdown.overrideAttrs (prevAttrs: rec {
- version = "2.0.2";
- src = pkgs.fetchurl {
- url = "https://kristaps.bsd.lv/lowdown/snapshots/lowdown-${version}.tar.gz";
- hash = "sha512-cfzhuF4EnGmLJf5EGSIbWqJItY3npbRSALm+GarZ7SMU7Hr1xw0gtBFMpOdi5PBar4TgtvbnG4oRPh+COINGlA==";
- };
- nativeBuildInputs = prevAttrs.nativeBuildInputs ++ [ pkgs.buildPackages.bmake ];
- postInstall =
- lib.replaceStrings [ "lowdown.so.1" "lowdown.1.dylib" ] [ "lowdown.so.2" "lowdown.2.dylib" ]
- (prevAttrs.postInstall or "");
- });
+ lowdown =
+ if lib.versionAtLeast pkgs.lowdown.version "2.0.2" then
+ pkgs.lowdown
+ else
+ pkgs.lowdown.overrideAttrs (prevAttrs: rec {
+ version = "2.0.2";
+ src = pkgs.fetchurl {
+ url = "https://kristaps.bsd.lv/lowdown/snapshots/lowdown-${version}.tar.gz";
+ hash = "sha512-cfzhuF4EnGmLJf5EGSIbWqJItY3npbRSALm+GarZ7SMU7Hr1xw0gtBFMpOdi5PBar4TgtvbnG4oRPh+COINGlA==";
+ };
+ patches = [ ];
+ nativeBuildInputs = prevAttrs.nativeBuildInputs ++ [ pkgs.buildPackages.bmake ];
+ postInstall =
+ lib.replaceStrings [ "lowdown.so.1" "lowdown.1.dylib" ] [ "lowdown.so.2" "lowdown.2.dylib" ]
+ (prevAttrs.postInstall or "");
+ });
# TODO: Remove this when https://github.com/NixOS/nixpkgs/pull/442682 is included in a stable release
toml11 =
@@ -66,6 +71,7 @@ scope: {
"--with-coroutine"
"--with-iostreams"
"--with-url"
+ "--with-thread"
];
enableIcu = false;
}).overrideAttrs
diff --git a/packaging/dev-shell.nix b/packaging/dev-shell.nix
index 95cbc4a3623..8f963f961fb 100644
--- a/packaging/dev-shell.nix
+++ b/packaging/dev-shell.nix
@@ -148,6 +148,15 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
isInternal =
dep: internalDrvs ? ${builtins.unsafeDiscardStringContext dep.drvPath or "_non-existent_"};
+ activeComponentNames = lib.listToAttrs (
+ map (c: {
+ name = c.pname or c.name;
+ value = null;
+ }) activeComponents
+ );
+
+ isActiveComponent = name: activeComponentNames ? ${name};
+
in
{
pname = "shell-for-nix";
@@ -190,31 +199,23 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
}
);
- small =
- (finalAttrs.finalPackage.withActiveComponents (
- c:
- lib.intersectAttrs (lib.genAttrs [
- "nix-cli"
- "nix-util-tests"
- "nix-store-tests"
- "nix-expr-tests"
- "nix-fetchers-tests"
- "nix-flake-tests"
- "nix-functional-tests"
- "nix-perl-bindings"
- ] (_: null)) c
- )).overrideAttrs
- (o: {
- mesonFlags = o.mesonFlags ++ [
- # TODO: infer from activeComponents or vice versa
- "-Dkaitai-struct-checks=false"
- "-Djson-schema-checks=false"
- ];
- });
+ small = finalAttrs.finalPackage.withActiveComponents (
+ c:
+ lib.intersectAttrs (lib.genAttrs [
+ "nix-cli"
+ "nix-util-tests"
+ "nix-store-tests"
+ "nix-expr-tests"
+ "nix-fetchers-tests"
+ "nix-flake-tests"
+ "nix-functional-tests"
+ "nix-perl-bindings"
+ ] (_: null)) c
+ );
};
# Remove the version suffix to avoid unnecessary attempts to substitute in nix develop
- version = lib.fileContents ../.version;
+ version = lib.fileContents ../.version-determinate;
name = finalAttrs.pname;
installFlags = "sysconfdir=$(out)/etc";
@@ -258,10 +259,13 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
# We use this shell with the local checkout, not unpackPhase.
src = null;
+
# Workaround https://sourceware.org/pipermail/gdb-patches/2025-October/221398.html
# Remove when gdb fix is rolled out everywhere.
separateDebugInfo = false;
+ mesonBuildType = "debugoptimized";
+
env = {
# For `make format`, to work without installing pre-commit
_NIX_PRE_COMMIT_HOOKS_CONFIG = "${(pkgs.formats.yaml { }).generate "pre-commit-config.yaml"
@@ -275,21 +279,33 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
dontUseCmakeConfigure = true;
- mesonFlags =
- map (transformFlag "libutil") (ignoreCrossFile pkgs.nixComponents2.nix-util.mesonFlags)
- ++ map (transformFlag "libstore") (ignoreCrossFile pkgs.nixComponents2.nix-store.mesonFlags)
- ++ map (transformFlag "libfetchers") (ignoreCrossFile pkgs.nixComponents2.nix-fetchers.mesonFlags)
- ++ lib.optionals havePerl (
- map (transformFlag "perl") (ignoreCrossFile pkgs.nixComponents2.nix-perl-bindings.mesonFlags)
- )
- ++ map (transformFlag "libexpr") (ignoreCrossFile pkgs.nixComponents2.nix-expr.mesonFlags)
- ++ map (transformFlag "libcmd") (ignoreCrossFile pkgs.nixComponents2.nix-cmd.mesonFlags);
+ mesonFlags = [
+ (lib.mesonBool "kaitai-struct-checks" (isActiveComponent "nix-kaitai-struct-checks"))
+ (lib.mesonBool "json-schema-checks" (isActiveComponent "nix-json-schema-checks"))
+ ]
+ ++ map (transformFlag "libutil") (ignoreCrossFile pkgs.nixComponents2.nix-util.mesonFlags)
+ ++ map (transformFlag "libstore") (ignoreCrossFile pkgs.nixComponents2.nix-store.mesonFlags)
+ ++ map (transformFlag "libfetchers") (ignoreCrossFile pkgs.nixComponents2.nix-fetchers.mesonFlags)
+ ++ lib.optionals havePerl (
+ map (transformFlag "perl") (ignoreCrossFile pkgs.nixComponents2.nix-perl-bindings.mesonFlags)
+ )
+ ++ map (transformFlag "libexpr") (ignoreCrossFile pkgs.nixComponents2.nix-expr.mesonFlags)
+ ++ map (transformFlag "libcmd") (ignoreCrossFile pkgs.nixComponents2.nix-cmd.mesonFlags);
nativeBuildInputs =
let
inputs =
dedupByString (v: "${v}") (
- lib.filter (x: !isInternal x) (lib.lists.concatMap (c: c.nativeBuildInputs) activeComponents)
+ lib.filter (x: !isInternal x) (
+ lib.lists.concatMap (
+ # Nix manual has a build-time dependency on nix, but we
+ # don't want to do a native build just to enter the ross
+ # dev shell.
+ #
+ # TODO: think of a more principled fix for this.
+ c: lib.filter (f: f.pname or null != "nix") c.nativeBuildInputs
+ ) activeComponents
+ )
)
++ lib.optional (
!buildCanExecuteHost
@@ -305,8 +321,8 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
pkgs.buildPackages.nixfmt-rfc-style
pkgs.buildPackages.shellcheck
pkgs.buildPackages.include-what-you-use
- pkgs.buildPackages.gdb
]
+ ++ lib.optional pkgs.hostPlatform.isUnix pkgs.buildPackages.gdb
++ lib.optional (stdenv.cc.isClang && stdenv.hostPlatform == stdenv.buildPlatform) (
lib.hiPrio pkgs.buildPackages.clang-tools
)
@@ -322,13 +338,13 @@ pkgs.nixComponents2.nix-util.overrideAttrs (
)
);
- buildInputs = [
- pkgs.gbenchmark
- ]
- ++ dedupByString (v: "${v}") (
- lib.filter (x: !isInternal x) (lib.lists.concatMap (c: c.buildInputs) activeComponents)
- )
- ++ lib.optional havePerl pkgs.perl;
+ buildInputs =
+ # TODO change Nixpkgs to mark gbenchmark as building on Windows
+ lib.optional pkgs.hostPlatform.isUnix pkgs.gbenchmark
+ ++ dedupByString (v: "${v}") (
+ lib.filter (x: !isInternal x) (lib.lists.concatMap (c: c.buildInputs) activeComponents)
+ )
+ ++ lib.optional havePerl pkgs.perl;
propagatedBuildInputs = dedupByString (v: "${v}") (
lib.filter (x: !isInternal x) (lib.lists.concatMap (c: c.propagatedBuildInputs) activeComponents)
diff --git a/packaging/everything.nix b/packaging/everything.nix
index f6bdad4907b..3206b8ba423 100644
--- a/packaging/everything.nix
+++ b/packaging/everything.nix
@@ -75,7 +75,7 @@ let
};
devdoc = buildEnv {
- name = "nix-${nix-cli.version}-devdoc";
+ name = "determinate-nix-${nix-cli.version}-devdoc";
paths = [
nix-internal-api-docs
nix-external-api-docs
@@ -84,7 +84,7 @@ let
in
stdenv.mkDerivation (finalAttrs: {
- pname = "nix";
+ pname = "determinate-nix";
version = nix-cli.version;
/**
diff --git a/packaging/hydra.nix b/packaging/hydra.nix
index 3a31314f709..9839dd62163 100644
--- a/packaging/hydra.nix
+++ b/packaging/hydra.nix
@@ -122,77 +122,6 @@ rec {
system: self.devShells.${system}.default.inputDerivation
)) [ "i686-linux" ];
- buildStatic = forAllPackages (
- pkgName:
- lib.genAttrs linux64BitSystems (
- system: nixpkgsFor.${system}.native.pkgsStatic.nixComponents2.${pkgName}
- )
- );
-
- buildCross = forAllPackages (
- pkgName:
- # Hack to avoid non-evaling package
- (
- if pkgName == "nix-functional-tests" then
- lib.flip builtins.removeAttrs [ "x86_64-w64-mingw32" ]
- else
- lib.id
- )
- (
- forAllCrossSystems (
- crossSystem:
- lib.genAttrs [ "x86_64-linux" ] (
- system: nixpkgsFor.${system}.cross.${crossSystem}.nixComponents2.${pkgName}
- )
- )
- )
- );
-
- # Builds with sanitizers already have GC disabled, so this buildNoGc can just
- # point to buildWithSanitizers in order to reduce the load on hydra.
- buildNoGc = buildWithSanitizers;
-
- buildWithSanitizers =
- let
- components = forAllSystems (
- system:
- let
- pkgs = nixpkgsFor.${system}.native;
- in
- pkgs.nixComponents2.overrideScope (
- self: super: {
- # Boost coroutines fail with ASAN on darwin.
- withASan = !pkgs.stdenv.buildPlatform.isDarwin;
- withUBSan = true;
- nix-expr = super.nix-expr.override { enableGC = false; };
- # Unclear how to make Perl bindings work with a dynamically linked ASAN.
- nix-perl-bindings = null;
- }
- )
- );
- in
- forAllPackages (pkgName: forAllSystems (system: components.${system}.${pkgName}));
-
- buildNoTests = forAllSystems (system: nixpkgsFor.${system}.native.nixComponents2.nix-cli);
-
- # Toggles some settings for better coverage. Windows needs these
- # library combinations, and Debian build Nix with GNU readline too.
- buildReadlineNoMarkdown =
- let
- components = forAllSystems (
- system:
- nixpkgsFor.${system}.native.nixComponents2.overrideScope (
- self: super: {
- nix-cmd = super.nix-cmd.override {
- enableMarkdown = false;
- readlineFlavor = "readline";
- };
- }
- )
- );
- in
- forAllPackages (pkgName: forAllSystems (system: components.${system}.${pkgName}));
-
# Perl bindings for various platforms.
perlBindings = forAllSystems (system: nixpkgsFor.${system}.native.nixComponents2.nix-perl-bindings);
@@ -203,30 +132,6 @@ rec {
system: nixpkgsFor.${system}.native.callPackage ./binary-tarball.nix { }
);
- binaryTarballCross = lib.genAttrs [ "x86_64-linux" ] (
- system:
- forAllCrossSystems (
- crossSystem: nixpkgsFor.${system}.cross.${crossSystem}.callPackage ./binary-tarball.nix { }
- )
- );
-
- # The first half of the installation script. This is uploaded
- # to https://nixos.org/nix/install. It downloads the binary
- # tarball for the user's system and calls the second half of the
- # installation script.
- installerScript = installScriptFor [
- # Native
- self.hydraJobs.binaryTarball."x86_64-linux"
- self.hydraJobs.binaryTarball."i686-linux"
- self.hydraJobs.binaryTarball."aarch64-linux"
- self.hydraJobs.binaryTarball."x86_64-darwin"
- self.hydraJobs.binaryTarball."aarch64-darwin"
- # Cross
- self.hydraJobs.binaryTarballCross."x86_64-linux"."armv6l-unknown-linux-gnueabihf"
- self.hydraJobs.binaryTarballCross."x86_64-linux"."armv7l-unknown-linux-gnueabihf"
- self.hydraJobs.binaryTarballCross."x86_64-linux"."riscv64-unknown-linux-gnu"
- ];
-
installerScriptForGHA = forAllSystems (
system:
nixpkgsFor.${system}.native.callPackage ./installer {
@@ -294,6 +199,19 @@ rec {
pkgs = nixpkgsFor.${system}.native;
}
);
+
+ nixpkgsLibTestsLazy = forAllSystems (
+ system:
+ lib.overrideDerivation
+ (import (nixpkgs + "/lib/tests/test-with-nix.nix") {
+ lib = nixpkgsFor.${system}.native.lib;
+ nix = self.packages.${system}.nix-cli;
+ pkgs = nixpkgsFor.${system}.native;
+ })
+ (_: {
+ "NIX_CONFIG" = "lazy-trees = true";
+ })
+ );
};
metrics.nixpkgs = import "${nixpkgs-regression}/pkgs/top-level/metrics.nix" {
@@ -308,17 +226,12 @@ rec {
in
pkgs.runCommand "install-tests" {
againstSelf = testNixVersions pkgs pkgs.nix;
- againstCurrentLatest =
- # FIXME: temporarily disable this on macOS because of #3605.
- if system == "x86_64-linux" then testNixVersions pkgs pkgs.nixVersions.latest else null;
+ #againstCurrentLatest =
+ # # FIXME: temporarily disable this on macOS because of #3605.
+ # if system == "x86_64-linux" then testNixVersions pkgs pkgs.nixVersions.latest else null;
# Disabled because the latest stable version doesn't handle
# `NIX_DAEMON_SOCKET_PATH` which is required for the tests to work
# againstLatestStable = testNixVersions pkgs pkgs.nixStable;
} "touch $out"
);
-
- installerTests = import ../tests/installer {
- binaryTarballs = self.hydraJobs.binaryTarball;
- inherit nixpkgsFor;
- };
}
diff --git a/packaging/installer/default.nix b/packaging/installer/default.nix
index e171f36f99f..a8e344b496c 100644
--- a/packaging/installer/default.nix
+++ b/packaging/installer/default.nix
@@ -32,7 +32,7 @@ runCommand "installer-script"
in
''
\
- --replace '@tarballHash_${system}@' $(nix --experimental-features nix-command hash-file --base16 --type sha256 ${tarball}/*.tar.xz) \
+ --replace '@tarballHash_${system}@' $(nix hash-file --base16 --type sha256 ${tarball}/*.tar.xz) \
--replace '@tarballPath_${system}@' $(tarballPath ${tarball}/*.tar.xz) \
''
) tarballs
diff --git a/scripts/install-multi-user.sh b/scripts/install-multi-user.sh
index 5ff760a6143..683beca10fd 100644
--- a/scripts/install-multi-user.sh
+++ b/scripts/install-multi-user.sh
@@ -53,8 +53,8 @@ readonly PROFILE_NIX_FILE_FISH="$NIX_ROOT/var/nix/profiles/default/etc/profile.d
readonly NIX_INSTALLED_NIX="@nix@"
readonly NIX_INSTALLED_CACERT="@cacert@"
-#readonly NIX_INSTALLED_NIX="/nix/store/j8dbv5w6jl34caywh2ygdy88knx1mdf7-nix-2.3.6"
-#readonly NIX_INSTALLED_CACERT="/nix/store/7dxhzymvy330i28ii676fl1pqwcahv2f-nss-cacert-3.49.2"
+#readonly NIX_INSTALLED_NIX="/nix/store/byi37zv50wnfrpp4d81z3spswd5zva37-nix-2.3.6"
+#readonly NIX_INSTALLED_CACERT="/nix/store/7pi45g541xa8ahwgpbpy7ggsl0xj1jj6-nss-cacert-3.49.2"
EXTRACTED_NIX_PATH="$(dirname "$0")"
readonly EXTRACTED_NIX_PATH
diff --git a/shell.nix b/shell.nix
deleted file mode 100644
index 918f4bbd9e9..00000000000
--- a/shell.nix
+++ /dev/null
@@ -1,3 +0,0 @@
-(import (fetchTarball "https://github.com/edolstra/flake-compat/archive/master.tar.gz") {
- src = ./.;
-}).shellNix
diff --git a/src/external-api-docs/package.nix b/src/external-api-docs/package.nix
index b194e16d460..28cde8c09e6 100644
--- a/src/external-api-docs/package.nix
+++ b/src/external-api-docs/package.nix
@@ -14,7 +14,7 @@ let
in
mkMesonDerivation (finalAttrs: {
- pname = "nix-external-api-docs";
+ pname = "determinate-nix-external-api-docs";
inherit version;
workDir = ./.;
diff --git a/src/internal-api-docs/package.nix b/src/internal-api-docs/package.nix
index 6c4f354aee5..636c19653ea 100644
--- a/src/internal-api-docs/package.nix
+++ b/src/internal-api-docs/package.nix
@@ -14,7 +14,7 @@ let
in
mkMesonDerivation (finalAttrs: {
- pname = "nix-internal-api-docs";
+ pname = "determinate-nix-internal-api-docs";
inherit version;
workDir = ./.;
diff --git a/src/libcmd/command.cc b/src/libcmd/command.cc
index 798ef072eb1..226b65f4a7c 100644
--- a/src/libcmd/command.cc
+++ b/src/libcmd/command.cc
@@ -138,6 +138,13 @@ ref EvalCommand::getEvalStore()
ref EvalCommand::getEvalState()
{
if (!evalState) {
+ if (startReplOnEvalErrors && evalSettings.evalCores != 1U) {
+ // Disable parallel eval if the debugger is enabled, since
+ // they're incompatible at the moment.
+ warn("using the debugger disables multi-threaded evaluation");
+ evalSettings.evalCores = 1;
+ }
+
evalState = std::allocate_shared(
traceable_allocator(), lookupPath, getEvalStore(), fetchSettings, evalSettings, getStore());
diff --git a/src/libcmd/common-eval-args.cc b/src/libcmd/common-eval-args.cc
index 30e76b2455d..865901febf4 100644
--- a/src/libcmd/common-eval-args.cc
+++ b/src/libcmd/common-eval-args.cc
@@ -19,17 +19,12 @@
namespace nix {
-fetchers::Settings fetchSettings;
-
-static GlobalConfig::Register rFetchSettings(&fetchSettings);
-
EvalSettings evalSettings{
settings.readOnlyMode,
{
{
"flake",
[](EvalState & state, std::string_view rest) {
- experimentalFeatureSettings.require(Xp::Flakes);
// FIXME `parseFlakeRef` should take a `std::string_view`.
auto flakeRef = parseFlakeRef(fetchSettings, std::string{rest}, {}, true, false);
debug("fetching flake search path element '%s''", rest);
@@ -186,7 +181,6 @@ SourcePath lookupFileArg(EvalState & state, std::string_view s, const std::files
}
else if (hasPrefix(s, "flake:")) {
- experimentalFeatureSettings.require(Xp::Flakes);
auto flakeRef = parseFlakeRef(fetchSettings, std::string(s.substr(6)), {}, true, false);
auto [accessor, lockedRef] =
flakeRef.resolve(fetchSettings, *state.store).lazyFetch(fetchSettings, *state.store);
diff --git a/src/libcmd/include/nix/cmd/command.hh b/src/libcmd/include/nix/cmd/command.hh
index d1b528e2477..c860f019260 100644
--- a/src/libcmd/include/nix/cmd/command.hh
+++ b/src/libcmd/include/nix/cmd/command.hh
@@ -214,6 +214,8 @@ struct InstallableCommand : virtual Args, SourceExprCommand
{
InstallableCommand();
+ virtual void preRun(ref store);
+
virtual void run(ref store, ref installable) = 0;
void run(ref store) override;
diff --git a/src/libcmd/include/nix/cmd/common-eval-args.hh b/src/libcmd/include/nix/cmd/common-eval-args.hh
index 67cb0714827..4f9ebb83df5 100644
--- a/src/libcmd/include/nix/cmd/common-eval-args.hh
+++ b/src/libcmd/include/nix/cmd/common-eval-args.hh
@@ -25,9 +25,6 @@ namespace flake {
struct Settings;
}
-/**
- * @todo Get rid of global settings variables
- */
extern fetchers::Settings fetchSettings;
/**
diff --git a/src/libcmd/include/nix/cmd/installables.hh b/src/libcmd/include/nix/cmd/installables.hh
index 530334e037b..2ea35261c7f 100644
--- a/src/libcmd/include/nix/cmd/installables.hh
+++ b/src/libcmd/include/nix/cmd/installables.hh
@@ -96,6 +96,22 @@ typedef std::vector DerivedPathsWithInfo;
struct Installable;
+struct InstallableWithBuildResult
+{
+ ref installable;
+
+ using Success = BuiltPathWithResult;
+
+ using Failure = BuildResult; // must be a `BuildResult::Failure`
+
+ std::variant result;
+
+ /**
+ * Throw an exception if this represents a failure, otherwise returns a `BuiltPathWithResult`.
+ */
+ const BuiltPathWithResult & getSuccess() const;
+};
+
/**
* Shorthand, for less typing and helping us keep the choice of
* collection in sync.
@@ -160,13 +176,15 @@ struct Installable
const Installables & installables,
BuildMode bMode = bmNormal);
- static std::vector, BuiltPathWithResult>> build2(
+ static std::vector build2(
ref evalStore,
ref store,
Realise mode,
const Installables & installables,
BuildMode bMode = bmNormal);
+ static void throwBuildErrors(std::vector & buildResults, const Store & store);
+
static std::set toStorePathSet(
ref evalStore, ref store, Realise mode, OperateOn operateOn, const Installables & installables);
diff --git a/src/libcmd/installable-attr-path.cc b/src/libcmd/installable-attr-path.cc
index 28c3db3fc79..3a80aa384de 100644
--- a/src/libcmd/installable-attr-path.cc
+++ b/src/libcmd/installable-attr-path.cc
@@ -89,7 +89,8 @@ DerivedPathsWithInfo InstallableAttrPath::toDerivedPaths()
}
DerivedPathsWithInfo res;
- for (auto & [drvPath, outputs] : byDrvPath)
+ for (auto & [drvPath, outputs] : byDrvPath) {
+ state->waitForPath(drvPath);
res.push_back({
.path =
DerivedPath::Built{
@@ -102,6 +103,7 @@ DerivedPathsWithInfo InstallableAttrPath::toDerivedPaths()
so we can fill in this info. */
}),
});
+ }
return res;
}
diff --git a/src/libcmd/installable-flake.cc b/src/libcmd/installable-flake.cc
index 11bbdbf8429..70267a65c09 100644
--- a/src/libcmd/installable-flake.cc
+++ b/src/libcmd/installable-flake.cc
@@ -102,6 +102,7 @@ DerivedPathsWithInfo InstallableFlake::toDerivedPaths()
}
auto drvPath = attr->forceDerivation();
+ state->waitForPath(drvPath);
std::optional priority;
diff --git a/src/libcmd/installable-value.cc b/src/libcmd/installable-value.cc
index 3a167af3db4..ec53ee97c89 100644
--- a/src/libcmd/installable-value.cc
+++ b/src/libcmd/installable-value.cc
@@ -55,7 +55,7 @@ InstallableValue::trySinglePathToDerivedPaths(Value & v, const PosIdx pos, std::
else if (v.type() == nString) {
return {{
- .path = DerivedPath::fromSingle(state->coerceToSingleDerivedPath(pos, v, errorCtx)),
+ .path = DerivedPath::fromSingle(state->devirtualize(state->coerceToSingleDerivedPath(pos, v, errorCtx))),
.info = make_ref(),
}};
}
diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index 7e3861e2f1d..be64a429297 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -21,6 +21,7 @@
#include "nix/util/url.hh"
#include "nix/fetchers/registry.hh"
#include "nix/store/build-result.hh"
+#include "nix/util/exit.hh"
#include
#include
@@ -398,9 +399,6 @@ void completeFlakeRefWithFragment(
void completeFlakeRef(AddCompletions & completions, ref store, std::string_view prefix)
{
- if (!experimentalFeatureSettings.isEnabled(Xp::Flakes))
- return;
-
if (prefix == "")
completions.add(".");
@@ -554,46 +552,69 @@ static SingleBuiltPath getBuiltPath(ref evalStore, ref store, cons
b.raw());
}
-std::vector Installable::build(
- ref evalStore, ref store, Realise mode, const Installables & installables, BuildMode bMode)
+const BuiltPathWithResult & InstallableWithBuildResult::getSuccess() const
{
- std::vector res;
- for (auto & [_, builtPathWithResult] : build2(evalStore, store, mode, installables, bMode))
- res.push_back(builtPathWithResult);
- return res;
+ if (auto * failure = std::get_if(&result)) {
+ auto failure2 = failure->tryGetFailure();
+ assert(failure2);
+ failure2->rethrow();
+ } else
+ return *std::get_if(&result);
}
-static void throwBuildErrors(std::vector & buildResults, const Store & store)
+void Installable::throwBuildErrors(std::vector & buildResults, const Store & store)
{
- std::vector> failed;
for (auto & buildResult : buildResults) {
- if (auto * failure = buildResult.tryGetFailure()) {
- failed.push_back({&buildResult, failure});
- }
- }
+ if (std::get_if(&buildResult.result)) {
+ // Report success first.
+ for (auto & buildResult : buildResults) {
+ if (std::get_if(&buildResult.result))
+ notice("✅ " ANSI_BOLD "%s" ANSI_NORMAL, buildResult.installable->what());
+ }
- auto failedResult = failed.begin();
- if (failedResult != failed.end()) {
- if (failed.size() == 1) {
- failedResult->second->rethrow();
- } else {
- StringSet failedPaths;
- for (; failedResult != failed.end(); failedResult++) {
- if (!failedResult->second->errorMsg.empty()) {
- logError(
- ErrorInfo{
- .level = lvlError,
- .msg = failedResult->second->errorMsg,
- });
+ // Then cancelled builds.
+ for (auto & buildResult : buildResults) {
+ if (auto failure = std::get_if(&buildResult.result)) {
+ if (failure->isCancelled())
+ notice(
+ "❓ " ANSI_BOLD "%s" ANSI_NORMAL ANSI_FAINT " (cancelled)",
+ buildResult.installable->what());
+ }
+ }
+
+ // Then failures.
+ for (auto & buildResult : buildResults) {
+ if (auto failure = std::get_if(&buildResult.result)) {
+ if (failure->isCancelled())
+ continue;
+ auto failure2 = failure->tryGetFailure();
+ assert(failure2);
+ printError("❌ " ANSI_RED "%s" ANSI_NORMAL, buildResult.installable->what());
+ try {
+ failure2->rethrow();
+ } catch (Error & e) {
+ logError(e.info());
+ }
}
- failedPaths.insert(failedResult->first->path.to_string(store));
}
- throw Error("build of %s failed", concatStringsSep(", ", quoteStrings(failedPaths)));
+
+ throw Exit(1);
}
}
}
-std::vector, BuiltPathWithResult>> Installable::build2(
+std::vector Installable::build(
+ ref evalStore, ref store, Realise mode, const Installables & installables, BuildMode bMode)
+{
+ auto results = build2(evalStore, store, mode, installables, bMode);
+ throwBuildErrors(results, *store);
+ std::vector res;
+ for (auto & b : results)
+ res.push_back(b.getSuccess());
+ return res;
+}
+
+std::vector Installable::build2(
ref evalStore, ref store, Realise mode, const Installables & installables, BuildMode bMode)
{
if (mode == Realise::Nothing)
@@ -615,7 +636,7 @@ std::vector, BuiltPathWithResult>> Installable::build
}
}
- std::vector, BuiltPathWithResult>> res;
+ std::vector res;
switch (mode) {
@@ -630,17 +651,21 @@ std::vector, BuiltPathWithResult>> Installable::build
[&](const DerivedPath::Built & bfd) {
auto outputs = resolveDerivedPath(*store, bfd, &*evalStore);
res.push_back(
- {aux.installable,
- {.path =
- BuiltPath::Built{
- .drvPath =
- make_ref(getBuiltPath(evalStore, store, *bfd.drvPath)),
- .outputs = outputs,
- },
- .info = aux.info}});
+ {.installable = aux.installable,
+ .result = InstallableWithBuildResult::Success{
+ .path =
+ BuiltPath::Built{
+ .drvPath = make_ref(
+ getBuiltPath(evalStore, store, *bfd.drvPath)),
+ .outputs = outputs,
+ },
+ .info = aux.info}});
},
[&](const DerivedPath::Opaque & bo) {
- res.push_back({aux.installable, {.path = BuiltPath::Opaque{bo.path}, .info = aux.info}});
+ res.push_back(
+ {.installable = aux.installable,
+ .result = InstallableWithBuildResult::Success{
+ .path = BuiltPath::Opaque{bo.path}, .info = aux.info}});
},
},
path.raw());
@@ -654,9 +679,13 @@ std::vector, BuiltPathWithResult>> Installable::build
printMissing(store, pathsToBuild, lvlInfo);
auto buildResults = store->buildPathsWithResults(pathsToBuild, bMode, evalStore);
- throwBuildErrors(buildResults, *store);
for (auto & buildResult : buildResults) {
- // If we didn't throw, they must all be sucesses
+ if (buildResult.tryGetFailure()) {
+ for (auto & aux : backmap[buildResult.path]) {
+ res.push_back({.installable = aux.installable, .result = buildResult});
+ }
+ continue;
+ }
auto & success = std::get(buildResult.inner);
for (auto & aux : backmap[buildResult.path]) {
std::visit(
@@ -666,20 +695,22 @@ std::vector, BuiltPathWithResult>> Installable::build
for (auto & [outputName, realisation] : success.builtOutputs)
outputs.emplace(outputName, realisation.outPath);
res.push_back(
- {aux.installable,
- {.path =
- BuiltPath::Built{
- .drvPath =
- make_ref(getBuiltPath(evalStore, store, *bfd.drvPath)),
- .outputs = outputs,
- },
- .info = aux.info,
- .result = buildResult}});
+ {.installable = aux.installable,
+ .result = InstallableWithBuildResult::Success{
+ .path =
+ BuiltPath::Built{
+ .drvPath = make_ref(
+ getBuiltPath(evalStore, store, *bfd.drvPath)),
+ .outputs = outputs,
+ },
+ .info = aux.info,
+ .result = buildResult}});
},
[&](const DerivedPath::Opaque & bo) {
res.push_back(
- {aux.installable,
- {.path = BuiltPath::Opaque{bo.path}, .info = aux.info, .result = buildResult}});
+ {.installable = aux.installable,
+ .result = InstallableWithBuildResult::Success{
+ .path = BuiltPath::Opaque{bo.path}, .info = aux.info, .result = buildResult}});
},
},
buildResult.path.raw());
@@ -840,8 +871,11 @@ InstallableCommand::InstallableCommand()
});
}
+void InstallableCommand::preRun(ref store) {}
+
void InstallableCommand::run(ref store)
{
+ preRun(store);
auto installable = parseInstallable(store, _installable);
run(store, std::move(installable));
}
diff --git a/src/libcmd/package.nix b/src/libcmd/package.nix
index c382f0e5760..21d7586a321 100644
--- a/src/libcmd/package.nix
+++ b/src/libcmd/package.nix
@@ -35,7 +35,7 @@ let
in
mkMesonLibrary (finalAttrs: {
- pname = "nix-cmd";
+ pname = "determinate-nix-cmd";
inherit version;
workDir = ./.;
diff --git a/src/libcmd/repl.cc b/src/libcmd/repl.cc
index 8fbb54dd30d..d8e61b5b520 100644
--- a/src/libcmd/repl.cc
+++ b/src/libcmd/repl.cc
@@ -177,7 +177,7 @@ ReplExitStatus NixRepl::mainLoop()
if (state->debugRepl) {
debuggerNotice = " debugger";
}
- notice("Nix %1%%2%\nType :? for help.", nixVersion, debuggerNotice);
+ notice("Nix %s\nType :? for help.", version(), debuggerNotice);
}
isFirstRepl = false;
@@ -332,6 +332,7 @@ StorePath NixRepl::getDerivationPath(Value & v)
auto drvPath = packageInfo->queryDrvPath();
if (!drvPath)
throw Error("expression did not evaluate to a valid derivation (no 'drvPath' attribute)");
+ state->waitForPath(*drvPath);
if (!state->store->isValidPath(*drvPath))
throw Error("expression evaluated to invalid derivation '%s'", state->store->printStorePath(*drvPath));
return *drvPath;
diff --git a/src/libexpr-c/nix_api_expr.cc b/src/libexpr-c/nix_api_expr.cc
index 0dd9fa0a51d..bfbd0a9c361 100644
--- a/src/libexpr-c/nix_api_expr.cc
+++ b/src/libexpr-c/nix_api_expr.cc
@@ -71,6 +71,7 @@ nix_err nix_expr_eval_from_string(
nix::Expr * parsedExpr = state->state.parseExprFromString(expr, state->state.rootPath(nix::CanonPath(path)));
state->state.eval(parsedExpr, *value->value);
state->state.forceValue(*value->value, nix::noPos);
+ state->state.waitForAllPaths();
}
NIXC_CATCH_ERRS
}
@@ -82,6 +83,7 @@ nix_err nix_value_call(nix_c_context * context, EvalState * state, Value * fn, n
try {
state->state.callFunction(*fn->value, *arg->value, *value->value, nix::noPos);
state->state.forceValue(*value->value, nix::noPos);
+ state->state.waitForAllPaths();
}
NIXC_CATCH_ERRS
}
@@ -100,6 +102,7 @@ nix_err nix_value_call_multi(
try {
state->state.callFunction(*fn->value, {internal_args.data(), nargs}, *value->value, nix::noPos);
state->state.forceValue(*value->value, nix::noPos);
+ state->state.waitForAllPaths();
}
NIXC_CATCH_ERRS
}
@@ -110,6 +113,7 @@ nix_err nix_value_force(nix_c_context * context, EvalState * state, nix_value *
context->last_err_code = NIX_OK;
try {
state->state.forceValue(*value->value, nix::noPos);
+ state->state.waitForAllPaths();
}
NIXC_CATCH_ERRS
}
@@ -120,6 +124,7 @@ nix_err nix_value_force_deep(nix_c_context * context, EvalState * state, nix_val
context->last_err_code = NIX_OK;
try {
state->state.forceValueDeep(*value->value);
+ state->state.waitForAllPaths();
}
NIXC_CATCH_ERRS
}
diff --git a/src/libexpr-c/nix_api_value.cc b/src/libexpr-c/nix_api_value.cc
index 7fd8233adec..b6a838284ef 100644
--- a/src/libexpr-c/nix_api_value.cc
+++ b/src/libexpr-c/nix_api_value.cc
@@ -194,6 +194,8 @@ ValueType nix_get_type(nix_c_context * context, const nix_value * value)
switch (v.type()) {
case nThunk:
return NIX_TYPE_THUNK;
+ case nFailed:
+ return NIX_TYPE_FAILED;
case nInt:
return NIX_TYPE_INT;
case nFloat:
@@ -386,6 +388,7 @@ nix_value * nix_get_attr_byname(nix_c_context * context, const nix_value * value
auto attr = v.attrs()->get(s);
if (attr) {
state->state.forceValue(*attr->value, nix::noPos);
+ state->state.waitForAllPaths();
return new_nix_value(attr->value, state->state.mem);
}
nix_set_err_msg(context, NIX_ERR_KEY, "missing attribute");
diff --git a/src/libexpr-c/nix_api_value.h b/src/libexpr-c/nix_api_value.h
index 5bd45da9059..a01bfb28059 100644
--- a/src/libexpr-c/nix_api_value.h
+++ b/src/libexpr-c/nix_api_value.h
@@ -100,7 +100,10 @@ typedef enum {
/** @brief External value from C++ plugins or C API
* @see Externals
*/
- NIX_TYPE_EXTERNAL
+ NIX_TYPE_EXTERNAL,
+ /** @brief Failed value. Contains an exception that can be rethrown.
+ */
+ NIX_TYPE_FAILED,
} ValueType;
// forward declarations
diff --git a/src/libexpr-c/package.nix b/src/libexpr-c/package.nix
index 694fbc1fe78..ec92ecce105 100644
--- a/src/libexpr-c/package.nix
+++ b/src/libexpr-c/package.nix
@@ -15,7 +15,7 @@ let
in
mkMesonLibrary (finalAttrs: {
- pname = "nix-expr-c";
+ pname = "determinate-nix-expr-c";
inherit version;
workDir = ./.;
diff --git a/src/libexpr-test-support/include/nix/expr/tests/value/context.hh b/src/libexpr-test-support/include/nix/expr/tests/value/context.hh
index 68a0b8dea7d..2311f3941c1 100644
--- a/src/libexpr-test-support/include/nix/expr/tests/value/context.hh
+++ b/src/libexpr-test-support/include/nix/expr/tests/value/context.hh
@@ -26,6 +26,12 @@ struct Arbitrary
static Gen arbitrary();
};
+template<>
+struct Arbitrary
+{
+ static Gen arbitrary();
+};
+
template<>
struct Arbitrary
{
diff --git a/src/libexpr-test-support/package.nix b/src/libexpr-test-support/package.nix
index 5cb4adaa8c4..1879a571608 100644
--- a/src/libexpr-test-support/package.nix
+++ b/src/libexpr-test-support/package.nix
@@ -18,7 +18,7 @@ let
in
mkMesonLibrary (finalAttrs: {
- pname = "nix-util-test-support";
+ pname = "determinate-nix-util-test-support";
inherit version;
workDir = ./.;
diff --git a/src/libexpr-test-support/tests/value/context.cc b/src/libexpr-test-support/tests/value/context.cc
index d6036601a94..8ce84fb51f5 100644
--- a/src/libexpr-test-support/tests/value/context.cc
+++ b/src/libexpr-test-support/tests/value/context.cc
@@ -16,6 +16,15 @@ Gen Arbitrary::arb
});
}
+Gen Arbitrary::arbitrary()
+{
+ return gen::map(gen::arbitrary(), [](StorePath storePath) {
+ return NixStringContextElem::Path{
+ .storePath = storePath,
+ };
+ });
+}
+
Gen Arbitrary::arbitrary()
{
return gen::mapcat(
@@ -31,6 +40,8 @@ Gen Arbitrary::arbitrary()
case 2:
return gen::map(
gen::arbitrary(), [](NixStringContextElem a) { return a; });
+ case 3:
+ return gen::map(gen::arbitrary(), [](NixStringContextElem a) { return a; });
default:
assert(false);
}
diff --git a/src/libexpr-tests/value/value.cc b/src/libexpr-tests/value/value.cc
index 420db0f31b1..bd8f0da7121 100644
--- a/src/libexpr-tests/value/value.cc
+++ b/src/libexpr-tests/value/value.cc
@@ -13,7 +13,6 @@ TEST_F(ValueTest, unsetValue)
{
Value unsetValue;
ASSERT_EQ(false, unsetValue.isValid());
- ASSERT_EQ(nThunk, unsetValue.type(true));
ASSERT_DEATH(unsetValue.type(), "");
}
diff --git a/src/libexpr/eval-cache.cc b/src/libexpr/eval-cache.cc
index 43f10da6eac..0f892f9c320 100644
--- a/src/libexpr/eval-cache.cc
+++ b/src/libexpr/eval-cache.cc
@@ -554,16 +554,17 @@ string_t AttrCursor::getStringWithContext()
if (auto s = std::get_if(&cachedValue->second)) {
bool valid = true;
for (auto & c : s->second) {
- const StorePath & path = std::visit(
+ const StorePath * path = std::visit(
overloaded{
- [&](const NixStringContextElem::DrvDeep & d) -> const StorePath & { return d.drvPath; },
- [&](const NixStringContextElem::Built & b) -> const StorePath & {
- return b.drvPath->getBaseStorePath();
+ [&](const NixStringContextElem::DrvDeep & d) -> const StorePath * { return &d.drvPath; },
+ [&](const NixStringContextElem::Built & b) -> const StorePath * {
+ return &b.drvPath->getBaseStorePath();
},
- [&](const NixStringContextElem::Opaque & o) -> const StorePath & { return o.path; },
+ [&](const NixStringContextElem::Opaque & o) -> const StorePath * { return &o.path; },
+ [&](const NixStringContextElem::Path & p) -> const StorePath * { return nullptr; },
},
c.raw);
- if (!root->state.store->isValidPath(path)) {
+ if (!path || !root->state.store->isValidPath(*path)) {
valid = false;
break;
}
@@ -711,6 +712,7 @@ StorePath AttrCursor::forceDerivation()
/* The eval cache contains 'drvPath', but the actual path has
been garbage-collected. So force it to be regenerated. */
aDrvPath->forceValue();
+ root->state.waitForPath(drvPath);
if (!root->state.store->isValidPath(drvPath))
throw Error(
"don't know how to recreate store derivation '%s'!", root->state.store->printStorePath(drvPath));
diff --git a/src/libexpr/eval-gc.cc b/src/libexpr/eval-gc.cc
index 0d25f38f64d..c1e974e053b 100644
--- a/src/libexpr/eval-gc.cc
+++ b/src/libexpr/eval-gc.cc
@@ -46,6 +46,88 @@ static void * oomHandler(size_t requested)
throw std::bad_alloc();
}
+static size_t getFreeMem()
+{
+ /* On Linux, use the `MemAvailable` or `MemFree` fields from
+ /proc/cpuinfo. */
+# ifdef __linux__
+ {
+ std::unordered_map fields;
+ for (auto & line :
+ tokenizeString>(readFile(std::filesystem::path("/proc/meminfo")), "\n")) {
+ auto colon = line.find(':');
+ if (colon == line.npos)
+ continue;
+ fields.emplace(line.substr(0, colon), trim(line.substr(colon + 1)));
+ }
+
+ auto i = fields.find("MemAvailable");
+ if (i == fields.end())
+ i = fields.find("MemFree");
+ if (i != fields.end()) {
+ auto kb = tokenizeString>(i->second, " ");
+ if (kb.size() == 2 && kb[1] == "kB")
+ return string2Int(kb[0]).value_or(0) * 1024;
+ }
+ }
+# endif
+
+ /* On non-Linux systems, conservatively assume that 25% of memory is free. */
+ long pageSize = sysconf(_SC_PAGESIZE);
+ long pages = sysconf(_SC_PHYS_PAGES);
+ if (pageSize > 0 && pages > 0)
+ return (static_cast(pageSize) * static_cast(pages)) / 4;
+ return 0;
+}
+
+/**
+ * When a thread goes into a coroutine, we lose its original sp until
+ * control flow returns to the thread. This causes Boehm GC to crash
+ * since it will scan memory between the coroutine's sp and the
+ * original stack base of the thread. Therefore, we detect when the
+ * current sp is outside of the original thread stack and push the
+ * entire thread stack instead, as an approximation.
+ *
+ * This is not optimal, because it causes the stack below sp to be
+ * scanned. However, we usually we don't have active coroutines during
+ * evaluation, so this is acceptable.
+ *
+ * Note that we don't scan coroutine stacks. It's currently assumed
+ * that we don't have GC roots in coroutines.
+ */
+void fixupBoehmStackPointer(void ** sp_ptr, void * _pthread_id)
+{
+ void *& sp = *sp_ptr;
+ auto pthread_id = reinterpret_cast(_pthread_id);
+ size_t osStackSize;
+ char * osStackHi;
+ char * osStackLo;
+
+# ifdef __APPLE__
+ osStackSize = pthread_get_stacksize_np(pthread_id);
+ osStackHi = (char *) pthread_get_stackaddr_np(pthread_id);
+ osStackLo = osStackHi - osStackSize;
+# else
+ pthread_attr_t pattr;
+ if (pthread_attr_init(&pattr))
+ throw Error("fixupBoehmStackPointer: pthread_attr_init failed");
+# ifdef HAVE_PTHREAD_GETATTR_NP
+ if (pthread_getattr_np(pthread_id, &pattr))
+ throw Error("fixupBoehmStackPointer: pthread_getattr_np failed");
+# else
+# error "Need `pthread_attr_get_np`"
+# endif
+ if (pthread_attr_getstack(&pattr, (void **) &osStackLo, &osStackSize))
+ throw Error("fixupBoehmStackPointer: pthread_attr_getstack failed");
+ if (pthread_attr_destroy(&pattr))
+ throw Error("fixupBoehmStackPointer: pthread_attr_destroy failed");
+ osStackHi = osStackLo + osStackSize;
+# endif
+
+ if (sp >= osStackHi || sp < osStackLo) // sp is outside the os stack
+ sp = osStackLo;
+}
+
static inline void initGCReal()
{
/* Initialise the Boehm garbage collector. */
@@ -76,8 +158,11 @@ static inline void initGCReal()
GC_set_oom_fn(oomHandler);
- /* Set the initial heap size to something fairly big (25% of
- physical RAM, up to a maximum of 384 MiB) so that in most cases
+ GC_set_sp_corrector(&fixupBoehmStackPointer);
+ assert(GC_get_sp_corrector());
+
+ /* Set the initial heap size to something fairly big (80% of
+ free RAM, up to a maximum of 4 GiB) so that in most cases
we don't need to garbage collect at all. (Collection has a
fairly significant overhead.) The heap size can be overridden
through libgc's GC_INITIAL_HEAP_SIZE environment variable. We
@@ -88,15 +173,10 @@ static inline void initGCReal()
if (!getEnv("GC_INITIAL_HEAP_SIZE")) {
size_t size = 32 * 1024 * 1024;
# if HAVE_SYSCONF && defined(_SC_PAGESIZE) && defined(_SC_PHYS_PAGES)
- size_t maxSize = 384 * 1024 * 1024;
- long pageSize = sysconf(_SC_PAGESIZE);
- long pages = sysconf(_SC_PHYS_PAGES);
- if (pageSize != -1)
- size = (pageSize * pages) / 4; // 25% of RAM
- if (size > maxSize)
- size = maxSize;
+ size_t maxSize = 4ULL * 1024 * 1024 * 1024;
+ auto free = getFreeMem();
+ size = std::max(size, std::min((size_t) (free * 0.5), maxSize));
# endif
- debug("setting initial heap size to %1% bytes", size);
GC_expand_hp(size);
}
}
diff --git a/src/libexpr/eval-settings.cc b/src/libexpr/eval-settings.cc
index 04c6193885e..27205864b8b 100644
--- a/src/libexpr/eval-settings.cc
+++ b/src/libexpr/eval-settings.cc
@@ -91,9 +91,19 @@ bool EvalSettings::isPseudoUrl(std::string_view s)
std::string EvalSettings::resolvePseudoUrl(std::string_view url)
{
- if (hasPrefix(url, "channel:"))
- return "https://channels.nixos.org/" + std::string(url.substr(8)) + "/nixexprs.tar.xz";
- else
+ if (hasPrefix(url, "channel:")) {
+ auto realUrl = "https://channels.nixos.org/" + std::string(url.substr(8)) + "/nixexprs.tar.xz";
+ static bool haveWarned = false;
+ warnOnce(
+ haveWarned,
+ "Channels are deprecated in favor of flakes in Determinate Nix. "
+ "Instead of '%s', use '%s'. "
+ "See https://zero-to-nix.com for a guide to Nix flakes. "
+ "For details and to offer feedback on the deprecation process, see: https://github.com/DeterminateSystems/nix-src/issues/34.",
+ url,
+ realUrl);
+ return realUrl;
+ } else
return std::string(url);
}
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index ab3f7b3ff5d..46393b79c5e 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -25,6 +25,8 @@
#include "nix/fetchers/tarball.hh"
#include "nix/fetchers/input-cache.hh"
#include "nix/util/current-process.hh"
+#include "nix/store/async-path-writer.hh"
+#include "nix/expr/parallel-eval.hh"
#include "parser-tab.hh"
@@ -44,6 +46,11 @@
#include
#include
#include
+#include
+
+#ifndef _WIN32 // TODO use portable implementation
+# include
+#endif
#include "nix/util/strings-inline.hh"
@@ -155,6 +162,8 @@ std::string_view showType(ValueType type, bool withArticle)
return WA("a", "float");
case nThunk:
return WA("a", "thunk");
+ case nFailed:
+ return WA("a", "failure");
}
unreachable();
}
@@ -193,20 +202,36 @@ PosIdx Value::determinePos(const PosIdx pos) const
return attrs()->pos;
case tLambda:
return lambda().fun->pos;
+#if 0
+ // FIXME: disabled because reading from an app is racy.
case tApp:
return app().left->determinePos(pos);
+#endif
default:
return pos;
}
#pragma GCC diagnostic pop
}
-bool Value::isTrivial() const
+template<>
+bool ValueStorage::isTrivial() const
{
- return !isa()
- && (!isa()
- || (dynamic_cast(thunk().expr) && ((ExprAttrs *) thunk().expr)->dynamicAttrs->empty())
- || dynamic_cast(thunk().expr) || dynamic_cast(thunk().expr));
+ auto p1_ = p1; // must acquire before reading p0, since thunks can change
+ auto p0_ = p0.load(std::memory_order_acquire);
+
+ auto pd = static_cast(p0_ & discriminatorMask);
+
+ if (pd == pdThunk || pd == pdPending || pd == pdAwaited) {
+ bool isApp = p1_ & discriminatorMask;
+ if (isApp)
+ return false;
+ auto expr = untagPointer(p1_);
+ return (dynamic_cast(expr) && ((ExprAttrs *) expr)->dynamicAttrs->empty())
+ || dynamic_cast(expr) || dynamic_cast(expr);
+ }
+
+ else
+ return true;
}
static Symbol getName(const AttrName & name, EvalState & state, Env & env)
@@ -300,6 +325,7 @@ EvalState::EvalState(
, debugRepl(nullptr)
, debugStop(false)
, trylevel(0)
+ , asyncPathWriter(AsyncPathWriter::make(store))
, srcToStore(make_ref())
, importResolutionCache(make_ref())
, fileEvalCache(make_ref())
@@ -311,6 +337,7 @@ EvalState::EvalState(
, baseEnv(mem.allocEnv(BASE_ENV_SIZE))
#endif
, staticBaseEnv{std::make_shared(nullptr, nullptr)}
+ , executor{make_ref(settings)}
{
corepkgsFS->setPathDisplay("");
internalFS->setPathDisplay("«nix-internal»", "");
@@ -451,7 +478,8 @@ void EvalState::checkURI(const std::string & uri)
Value * EvalState::addConstant(const std::string & name, Value & v, Constant info)
{
Value * v2 = allocValue();
- *v2 = v;
+ // Do a raw copy since `operator =` barfs on thunks.
+ memcpy((char *) v2, (char *) &v, sizeof(Value));
addConstant(name, v2, info);
return v2;
}
@@ -467,8 +495,10 @@ void EvalState::addConstant(const std::string & name, Value * v, Constant info)
We might know the type of a thunk in advance, so be allowed
to just write it down in that case. */
- if (auto gotType = v->type(true); gotType != nThunk)
- assert(info.type == gotType);
+ if (v->isFinished()) {
+ if (auto gotType = v->type(); gotType != nThunk)
+ assert(info.type == gotType);
+ }
/* Install value the base environment. */
staticBaseEnv->vars.emplace_back(symbols.create(name), baseEnvDispl);
@@ -654,7 +684,7 @@ void printStaticEnvBindings(const SymbolTable & st, const StaticEnv & se)
// just for the current level of Env, not the whole chain.
void printWithBindings(const SymbolTable & st, const Env & env)
{
- if (!env.values[0]->isThunk()) {
+ if (env.values[0]->isFinished()) {
std::cout << "with: ";
std::cout << ANSI_MAGENTA;
auto j = env.values[0]->attrs()->begin();
@@ -709,7 +739,7 @@ void mapStaticEnvBindings(const SymbolTable & st, const StaticEnv & se, const En
if (env.up && se.up) {
mapStaticEnvBindings(st, *se.up, *env.up, vm);
- if (se.isWith && !env.values[0]->isThunk()) {
+ if (se.isWith && env.values[0]->isFinished()) {
// add 'with' bindings.
for (auto & j : *env.values[0]->attrs())
vm.insert_or_assign(std::string(st[j.name]), j.value);
@@ -943,7 +973,14 @@ void EvalState::mkPos(Value & v, PosIdx p)
auto origin = positions.originOf(p);
if (auto path = std::get_if(&origin)) {
auto attrs = buildBindings(3);
- attrs.alloc(s.file).mkString(path->path.abs(), mem);
+ if (path->accessor == rootFS && store->isInStore(path->path.abs()))
+ // FIXME: only do this for virtual store paths?
+ attrs.alloc(s.file).mkString(
+ path->path.abs(),
+ {NixStringContextElem::Path{.storePath = store->toStorePath(path->path.abs()).first}},
+ mem);
+ else
+ attrs.alloc(s.file).mkString(path->path.abs(), mem);
makePositionThunks(*this, p, attrs.alloc(s.line), attrs.alloc(s.column));
v.mkAttrs(attrs);
} else
@@ -991,6 +1028,7 @@ std::string EvalState::mkSingleDerivedPathStringRaw(const SingleDerivedPath & p)
auto optStaticOutputPath = std::visit(
overloaded{
[&](const SingleDerivedPath::Opaque & o) {
+ waitForPath(o.path);
auto drv = store->readDerivation(o.path);
auto i = drv.outputs.find(b.output);
if (i == drv.outputs.end())
@@ -1066,10 +1104,9 @@ Value * ExprPath::maybeThunk(EvalState & state, Env & env)
* from a thunk, ensuring that every file is parsed/evaluated only
* once (via the thunk stored in `EvalState::fileEvalCache`).
*/
-struct ExprParseFile : Expr, gc
+struct ExprParseFile : Expr
{
- // FIXME: make this a reference (see below).
- SourcePath path;
+ SourcePath & path;
bool mustBeTrivial;
ExprParseFile(SourcePath & path, bool mustBeTrivial)
@@ -1120,18 +1157,14 @@ void EvalState::evalFile(const SourcePath & path, Value & v, bool mustBeTrivial)
}
Value * vExpr;
- // FIXME: put ExprParseFile on the stack instead of the heap once
- // https://github.com/NixOS/nix/pull/13930 is merged. That will ensure
- // the post-condition that `expr` is unreachable after
- // `forceValue()` returns.
- auto expr = new ExprParseFile{*resolvedPath, mustBeTrivial};
+ ExprParseFile expr{*resolvedPath, mustBeTrivial};
fileEvalCache->try_emplace_and_cvisit(
*resolvedPath,
nullptr,
[&](auto & i) {
vExpr = allocValue();
- vExpr->mkThunk(&baseEnv, expr);
+ vExpr->mkThunk(&baseEnv, &expr);
i.second = vExpr;
},
[&](auto & i) { vExpr = i.second; });
@@ -1437,7 +1470,7 @@ void ExprSelect::eval(EvalState & state, Env & env, Value & v)
state.attrSelects[pos2]++;
}
- state.forceValue(*vAttrs, (pos2 ? pos2 : this->pos));
+ state.forceValue(*vAttrs, pos2 ? pos2 : this->pos);
} catch (Error & e) {
if (pos2) {
@@ -1496,6 +1529,8 @@ void ExprLambda::eval(EvalState & state, Env & env, Value & v)
v.mkLambda(&env, this);
}
+thread_local size_t EvalState::callDepth = 0;
+
void EvalState::callFunction(Value & fun, std::span args, Value & vRes, const PosIdx pos)
{
auto _level = addCallDepth(pos);
@@ -1511,15 +1546,16 @@ void EvalState::callFunction(Value & fun, std::span args, Value & vRes,
forceValue(fun, pos);
- Value vCur(fun);
+ Value vCur = fun;
auto makeAppChain = [&]() {
- vRes = vCur;
for (auto arg : args) {
auto fun2 = allocValue();
- *fun2 = vRes;
- vRes.mkPrimOpApp(fun2, arg);
+ *fun2 = vCur;
+ vCur.reset();
+ vCur.mkPrimOpApp(fun2, arg);
}
+ vRes = vCur;
};
const Attr * functor;
@@ -1615,6 +1651,7 @@ void EvalState::callFunction(Value & fun, std::span args, Value & vRes,
lambda.name ? concatStrings("'", symbols[lambda.name], "'") : "anonymous lambda")
: nullptr;
+ vCur.reset();
lambda.body->eval(*this, env2, vCur);
} catch (Error & e) {
if (loggerSettings.showTrace.get()) {
@@ -1649,7 +1686,9 @@ void EvalState::callFunction(Value & fun, std::span args, Value & vRes,
primOpCalls[fn->name]++;
try {
- fn->fun(*this, vCur.determinePos(noPos), args.data(), vCur);
+ auto pos = vCur.determinePos(noPos);
+ vCur.reset();
+ fn->fun(*this, pos, args.data(), vCur);
} catch (Error & e) {
if (fn->addTrace)
addErrorTrace(e, pos, "while calling the '%1%' builtin", fn->name);
@@ -1671,6 +1710,7 @@ void EvalState::callFunction(Value & fun, std::span args, Value & vRes,
assert(primOp->isPrimOp());
auto arity = primOp->primOp()->arity;
auto argsLeft = arity - argsDone;
+ assert(argsLeft);
if (args.size() < argsLeft) {
/* We still don't have enough arguments, so extend the tPrimOpApp chain. */
@@ -1699,7 +1739,9 @@ void EvalState::callFunction(Value & fun, std::span args, Value & vRes,
// 2. Create a fake env (arg1, arg2, etc.) and a fake expr (arg1: arg2: etc: builtins.name arg1 arg2
// etc)
// so the debugger allows to inspect the wrong parameters passed to the builtin.
- fn->fun(*this, vCur.determinePos(noPos), vArgs, vCur);
+ auto pos = vCur.determinePos(noPos);
+ vCur.reset();
+ fn->fun(*this, pos, vArgs, vCur);
} catch (Error & e) {
if (fn->addTrace)
addErrorTrace(e, pos, "while calling the '%1%' builtin", fn->name);
@@ -1716,6 +1758,7 @@ void EvalState::callFunction(Value & fun, std::span args, Value & vRes,
heap-allocate a copy and use that instead. */
Value * args2[] = {allocValue(), args[0]};
*args2[0] = vCur;
+ vCur.reset();
try {
callFunction(*functor->value, args2, vCur, functor->pos);
} catch (Error & e) {
@@ -1903,8 +1946,12 @@ void ExprOpImpl::eval(EvalState & state, Env & env, Value & v)
|| state.evalBool(env, e2, pos, "in the right operand of the IMPL (->) operator"));
}
-void ExprOpUpdate::eval(EvalState & state, Value & v, Value & v1, Value & v2)
+void ExprOpUpdate::eval(EvalState & state, Env & env, Value & v)
{
+ Value v1, v2;
+ state.evalAttrs(env, e1, v1, pos, "in the left operand of the update (//) operator");
+ state.evalAttrs(env, e2, v2, pos, "in the right operand of the update (//) operator");
+
state.nrOpUpdates++;
const Bindings & bindings1 = *v1.attrs();
@@ -1978,38 +2025,6 @@ void ExprOpUpdate::eval(EvalState & state, Value & v, Value & v1, Value & v2)
state.nrOpUpdateValuesCopied += v.attrs()->size();
}
-void ExprOpUpdate::eval(EvalState & state, Env & env, Value & v)
-{
- UpdateQueue q;
- evalForUpdate(state, env, q);
-
- v.mkAttrs(&Bindings::emptyBindings);
- for (auto & rhs : std::views::reverse(q)) {
- /* Remember that queue is sorted rightmost attrset first. */
- eval(state, /*v=*/v, /*v1=*/v, /*v2=*/rhs);
- }
-}
-
-void Expr::evalForUpdate(EvalState & state, Env & env, UpdateQueue & q, std::string_view errorCtx)
-{
- Value v;
- state.evalAttrs(env, this, v, getPos(), errorCtx);
- q.push_back(v);
-}
-
-void ExprOpUpdate::evalForUpdate(EvalState & state, Env & env, UpdateQueue & q)
-{
- /* Output rightmost attrset first to the merge queue as the one
- with the most priority. */
- e2->evalForUpdate(state, env, q, "in the right operand of the update (//) operator");
- e1->evalForUpdate(state, env, q, "in the left operand of the update (//) operator");
-}
-
-void ExprOpUpdate::evalForUpdate(EvalState & state, Env & env, UpdateQueue & q, std::string_view errorCtx)
-{
- evalForUpdate(state, env, q);
-}
-
void ExprOpConcatLists::eval(EvalState & state, Env & env, Value & v)
{
Value v1;
@@ -2129,7 +2144,7 @@ void ExprConcatStrings::eval(EvalState & state, Env & env, Value & v)
} else if (firstType == nFloat) {
v.mkFloat(nf);
} else if (firstType == nPath) {
- if (!context.empty())
+ if (hasContext(context))
state.error("a string that refers to a store path cannot be appended to a path")
.atPos(pos)
.withFrame(env, *this)
@@ -2157,16 +2172,6 @@ void ExprPos::eval(EvalState & state, Env & env, Value & v)
state.mkPos(v, pos);
}
-void ExprBlackHole::eval(EvalState & state, [[maybe_unused]] Env & env, Value & v)
-{
- throwInfiniteRecursionError(state, v);
-}
-
-[[gnu::noinline]] [[noreturn]] void ExprBlackHole::throwInfiniteRecursionError(EvalState & state, Value & v)
-{
- state.error("infinite recursion encountered").atPos(v.determinePos(noPos)).debugThrow();
-}
-
// always force this to be separate, otherwise forceValue may inline it and take
// a massive perf hit
[[gnu::noinline]]
@@ -2199,6 +2204,7 @@ void EvalState::forceValueDeep(Value & v)
for (auto & i : *v.attrs())
try {
// If the value is a thunk, we're evaling. Otherwise no trace necessary.
+ // FIXME: race, thunk might be updated by another thread
auto dts = state.debugRepl && i.value->isThunk() ? makeDebugTraceStacker(
state,
*i.value->thunk().expr,
@@ -2351,12 +2357,15 @@ std::string_view EvalState::forceStringNoCtx(Value & v, const PosIdx pos, std::s
{
auto s = forceString(v, pos, errorCtx);
if (v.context()) {
- error(
- "the string '%1%' is not allowed to refer to a store path (such as '%2%')",
- v.string_view(),
- (*v.context()->begin())->view())
- .withTrace(pos, errorCtx)
- .debugThrow();
+ NixStringContext context;
+ copyContext(v, context);
+ if (hasContext(context))
+ error(
+ "the string '%1%' is not allowed to refer to a store path (such as '%2%')",
+ v.string_view(),
+ (*v.context()->begin())->view())
+ .withTrace(pos, errorCtx)
+ .debugThrow();
}
return s;
}
@@ -2411,14 +2420,21 @@ BackedStringView EvalState::coerceToString(
}
if (v.type() == nPath) {
+ // FIXME: instead of copying the path to the store, we could
+ // return a virtual store path that lazily copies the path to
+ // the store in devirtualize().
if (!canonicalizePath && !copyToStore) {
// FIXME: hack to preserve path literals that end in a
// slash, as in /foo/${x}.
return v.pathStrView();
} else if (copyToStore) {
- return store->printStorePath(copyPathToStore(context, v.path()));
+ return store->printStorePath(copyPathToStore(context, v.path(), v.determinePos(pos)));
} else {
- return std::string{v.path().path.abs()};
+ auto path = v.path();
+ if (path.accessor == rootFS && store->isInStore(path.path.abs())) {
+ context.insert(NixStringContextElem::Path{.storePath = store->toStorePath(path.path.abs()).first});
+ }
+ return std::string(path.path.abs());
}
}
@@ -2490,7 +2506,7 @@ BackedStringView EvalState::coerceToString(
.debugThrow();
}
-StorePath EvalState::copyPathToStore(NixStringContext & context, const SourcePath & path)
+StorePath EvalState::copyPathToStore(NixStringContext & context, const SourcePath & path, PosIdx pos)
{
if (nix::isDerivation(path.path.abs()))
error("file names are not allowed to end in '%1%'", drvExtension).debugThrow();
@@ -2503,7 +2519,7 @@ StorePath EvalState::copyPathToStore(NixStringContext & context, const SourcePat
*store,
path.resolveSymlinks(SymlinkResolution::Ancestors),
settings.readOnlyMode ? FetchMode::DryRun : FetchMode::Copy,
- path.baseName(),
+ computeBaseName(path, pos),
ContentAddressMethod::Raw::NixArchive,
nullptr,
repair);
@@ -2555,7 +2571,9 @@ EvalState::coerceToStorePath(const PosIdx pos, Value & v, NixStringContext & con
auto path = coerceToString(pos, v, context, errorCtx, false, false, true).toOwned();
if (auto storePath = store->maybeParseStorePath(path))
return *storePath;
- error("path '%1%' is not in the Nix store", path).withTrace(pos, errorCtx).debugThrow();
+ error("cannot coerce '%s' to a store path because it is not a subpath of the Nix store", path)
+ .withTrace(pos, errorCtx)
+ .debugThrow();
}
std::pair EvalState::coerceToSingleDerivedPathUnchecked(
@@ -2579,6 +2597,9 @@ std::pair EvalState::coerceToSingleDerivedP
.debugThrow();
},
[&](NixStringContextElem::Built && b) -> SingleDerivedPath { return std::move(b); },
+ [&](NixStringContextElem::Path && p) -> SingleDerivedPath {
+ error("string '%s' has no context", s).withTrace(pos, errorCtx).debugThrow();
+ },
},
((NixStringContextElem &&) *context.begin()).raw);
return {
@@ -2813,8 +2834,11 @@ void EvalState::assertEqValues(Value & v1, Value & v2, const PosIdx pos, std::st
}
return;
- case nThunk: // Must not be left by forceValue
- assert(false);
+ // Cannot be returned by forceValue().
+ case nThunk:
+ case nFailed:
+ unreachable();
+
default: // Note that we pass compiler flags that should make `default:` unreachable.
// Also note that this probably ran after `eqValues`, which implements
// the same logic more efficiently (without having to unwind stacks),
@@ -2906,8 +2930,11 @@ bool EvalState::eqValues(Value & v1, Value & v2, const PosIdx pos, std::string_v
// !!!
return v1.fpoint() == v2.fpoint();
- case nThunk: // Must not be left by forceValue
- assert(false);
+ // Cannot be returned by forceValue().
+ case nThunk:
+ case nFailed:
+ unreachable();
+
default: // Note that we pass compiler flags that should make `default:` unreachable.
error("eqValues: cannot compare %1% with %2%", showType(v1), showType(v2))
.withTrace(pos, errorCtx)
@@ -3013,6 +3040,11 @@ void EvalState::printStatistics()
topObj["nrOpUpdates"] = nrOpUpdates.load();
topObj["nrOpUpdateValuesCopied"] = nrOpUpdateValuesCopied.load();
topObj["nrThunks"] = nrThunks.load();
+ topObj["nrThunksAwaited"] = nrThunksAwaited.load();
+ topObj["nrThunksAwaitedSlow"] = nrThunksAwaitedSlow.load();
+ topObj["nrSpuriousWakeups"] = nrSpuriousWakeups.load();
+ topObj["maxWaiting"] = maxWaiting.load();
+ topObj["waitingTime"] = microsecondsWaiting / (double) 1000000;
topObj["nrAvoided"] = nrAvoided.load();
topObj["nrLookups"] = nrLookups.load();
topObj["nrPrimOpCalls"] = nrPrimOpCalls.load();
@@ -3064,10 +3096,10 @@ void EvalState::printStatistics()
}
if (getEnv("NIX_SHOW_SYMBOLS").value_or("0") != "0") {
+ auto list = json::array();
+ symbols.dump([&](std::string_view s) { list.emplace_back(std::string(s)); });
// XXX: overrides earlier assignment
- topObj["symbols"] = json::array();
- auto & list = topObj["symbols"];
- symbols.dump([&](std::string_view s) { list.emplace_back(s); });
+ topObj["symbols"] = std::move(list);
}
if (outPath == "-") {
std::cerr << topObj.dump(2) << std::endl;
@@ -3254,11 +3286,11 @@ Expr * EvalState::parse(
const std::shared_ptr & staticEnv)
{
DocCommentMap tmpDocComments; // Only used when not origin is not a SourcePath
- DocCommentMap * docComments = &tmpDocComments;
+ auto * docComments = &tmpDocComments;
if (auto sourcePath = std::get_if(&origin)) {
- auto [it, _] = positionToDocComment.try_emplace(*sourcePath);
- docComments = &it->second;
+ auto [it, _] = positionToDocComment.lock()->try_emplace(*sourcePath, make_ref());
+ docComments = &*it->second;
}
auto result =
@@ -3276,12 +3308,14 @@ DocComment EvalState::getDocCommentForPos(PosIdx pos)
if (!path)
return {};
- auto table = positionToDocComment.find(*path);
- if (table == positionToDocComment.end())
+ auto positionToDocComment_ = positionToDocComment.readLock();
+
+ auto table = positionToDocComment_->find(*path);
+ if (table == positionToDocComment_->end())
return {};
- auto it = table->second.find(pos);
- if (it == table->second.end())
+ auto it = table->second->find(pos);
+ if (it == table->second->end())
return {};
return it->second;
}
@@ -3315,4 +3349,24 @@ void forceNoNullByte(std::string_view s, std::function pos)
}
}
+void EvalState::waitForPath(const StorePath & path)
+{
+ asyncPathWriter->waitForPath(path);
+}
+
+void EvalState::waitForPath(const SingleDerivedPath & path)
+{
+ std::visit(
+ overloaded{
+ [&](const DerivedPathOpaque & p) { waitForPath(p.path); },
+ [&](const SingleDerivedPathBuilt & p) { waitForPath(*p.drvPath); },
+ },
+ path.raw());
+}
+
+void EvalState::waitForAllPaths()
+{
+ asyncPathWriter->waitForAllPaths();
+}
+
} // namespace nix
diff --git a/src/libexpr/include/nix/expr/eval-inline.hh b/src/libexpr/include/nix/expr/eval-inline.hh
index e8aa380fdb0..35b54926157 100644
--- a/src/libexpr/include/nix/expr/eval-inline.hh
+++ b/src/libexpr/include/nix/expr/eval-inline.hh
@@ -33,6 +33,9 @@ Value * EvalMemory::allocValue()
GC_malloc_many returns a linked list of objects of the given size, where the first word
of each object is also the pointer to the next object in the list. This also means that we
have to explicitly clear the first word of every object we take. */
+ thread_local static std::shared_ptr valueAllocCache{
+ std::allocate_shared(traceable_allocator(), nullptr)};
+
if (!*valueAllocCache) {
*valueAllocCache = GC_malloc_many(sizeof(Value));
if (!*valueAllocCache)
@@ -63,6 +66,9 @@ Env & EvalMemory::allocEnv(size_t size)
#if NIX_USE_BOEHMGC
if (size == 1) {
/* see allocValue for explanations. */
+ thread_local static std::shared_ptr env1AllocCache{
+ std::allocate_shared(traceable_allocator(), nullptr)};
+
if (!*env1AllocCache) {
*env1AllocCache = GC_malloc_many(sizeof(Env) + sizeof(Value *));
if (!*env1AllocCache)
@@ -82,27 +88,68 @@ Env & EvalMemory::allocEnv(size_t size)
return *env;
}
-[[gnu::always_inline]]
-void EvalState::forceValue(Value & v, const PosIdx pos)
+/**
+ * An identifier of the current thread for deadlock detection, stored
+ * in p0 of pending/awaited thunks. We're not using std::thread::id
+ * because it's not guaranteed to fit.
+ */
+extern thread_local uint32_t myEvalThreadId;
+
+template
+void ValueStorage>>::force(
+ EvalState & state, PosIdx pos)
{
- if (v.isThunk()) {
- Env * env = v.thunk().env;
- assert(env || v.isBlackhole());
- Expr * expr = v.thunk().expr;
+ auto p0_ = p0.load(std::memory_order_acquire);
+
+ auto pd = static_cast(p0_ & discriminatorMask);
+
+ if (pd == pdThunk) {
try {
- v.mkBlackhole();
- // checkInterrupt();
- if (env) [[likely]]
- expr->eval(*this, *env, v);
- else
- ExprBlackHole::throwInfiniteRecursionError(*this, v);
+ // The value we get here is only valid if we can set the
+ // thunk to pending.
+ auto p1_ = p1;
+
+ // Atomically set the thunk to "pending".
+ if (!p0.compare_exchange_strong(
+ p0_,
+ pdPending | (myEvalThreadId << discriminatorBits),
+ std::memory_order_acquire,
+ std::memory_order_acquire)) {
+ pd = static_cast(p0_ & discriminatorMask);
+ if (pd == pdPending || pd == pdAwaited) {
+ // The thunk is already "pending" or "awaited", so
+ // we need to wait for it.
+ p0_ = waitOnThunk(state, p0_);
+ goto done;
+ }
+ assert(pd != pdThunk);
+ // Another thread finished this thunk, no need to wait.
+ goto done;
+ }
+
+ bool isApp = p1_ & discriminatorMask;
+ if (isApp) {
+ auto left = untagPointer(p0_);
+ auto right = untagPointer(p1_);
+ state.callFunction(*left, *right, (Value &) *this, pos);
+ } else {
+ auto env = untagPointer(p0_);
+ auto expr = untagPointer(p1_);
+ expr->eval(state, *env, (Value &) *this);
+ }
} catch (...) {
- v.mkThunk(env, expr);
- tryFixupBlackHolePos(v, pos);
+ state.tryFixupBlackHolePos((Value &) *this, pos);
+ setStorage(new Value::Failed{.ex = std::current_exception()});
throw;
}
- } else if (v.isApp())
- callFunction(*v.app().left, *v.app().right, v, pos);
+ }
+
+ else if (pd == pdPending || pd == pdAwaited)
+ p0_ = waitOnThunk(state, p0_);
+
+done:
+ if (InternalType(p0_ & 0xff) == tFailed)
+ std::rethrow_exception((std::bit_cast(p1))->ex);
}
[[gnu::always_inline]]
diff --git a/src/libexpr/include/nix/expr/eval-settings.hh b/src/libexpr/include/nix/expr/eval-settings.hh
index 5dbef9272b9..f367541ec2f 100644
--- a/src/libexpr/include/nix/expr/eval-settings.hh
+++ b/src/libexpr/include/nix/expr/eval-settings.hh
@@ -91,7 +91,7 @@ struct EvalSettings : Config
- `$HOME/.nix-defexpr/channels`
- The [user channel link](@docroot@/command-ref/files/default-nix-expression.md#user-channel-link), pointing to the current state of [channels](@docroot@/command-ref/files/channels.md) for the current user.
+ The user channel link pointing to the current state of channels for the current user.
- `nixpkgs=$NIX_STATE_DIR/profiles/per-user/root/channels/nixpkgs`
@@ -101,7 +101,7 @@ struct EvalSettings : Config
The current state of all channels for the `root` user.
- These files are set up by the [Nix installer](@docroot@/installation/installing-binary.md).
+ These files are set up by the Nix installer.
See [`NIX_STATE_DIR`](@docroot@/command-ref/env-common.md#env-NIX_STATE_DIR) for details on the environment variable.
> **Note**
@@ -142,7 +142,7 @@ struct EvalSettings : Config
R"(
If set to `true`, the Nix evaluator doesn't allow access to any
files outside of
- [`builtins.nixPath`](@docroot@/language/builtins.md#builtins-nixPath),
+ [`builtins.nixPath`](@docroot@/language/builtins.md#builtins-nixPath)
or to URIs outside of
[`allowed-uris`](@docroot@/command-ref/conf-file.md#conf-allowed-uris).
)"};
@@ -271,7 +271,7 @@ struct EvalSettings : Config
"ignore-try",
R"(
If set to true, ignore exceptions inside 'tryEval' calls when evaluating Nix expressions in
- debug mode (using the --debugger flag). By default the debugger pauses on all exceptions.
+ debug mode (using the --debugger flag). By default, the debugger pauses on all exceptions.
)"};
Setting traceVerbose{
@@ -289,7 +289,7 @@ struct EvalSettings : Config
"debugger-on-trace",
R"(
If set to true and the `--debugger` flag is given, the following functions
- enter the debugger like [`builtins.break`](@docroot@/language/builtins.md#builtins-break):
+ enter the debugger like [`builtins.break`](@docroot@/language/builtins.md#builtins-break).
* [`builtins.trace`](@docroot@/language/builtins.md#builtins-trace)
* [`builtins.traceVerbose`](@docroot@/language/builtins.md#builtins-traceVerbose)
@@ -305,7 +305,7 @@ struct EvalSettings : Config
"debugger-on-warn",
R"(
If set to true and the `--debugger` flag is given, [`builtins.warn`](@docroot@/language/builtins.md#builtins-warn)
- will enter the debugger like [`builtins.break`](@docroot@/language/builtins.md#builtins-break).
+ enter the debugger like [`builtins.break`](@docroot@/language/builtins.md#builtins-break).
This is useful for debugging warnings in third-party Nix code.
@@ -319,7 +319,7 @@ struct EvalSettings : Config
R"(
If set to true, [`builtins.warn`](@docroot@/language/builtins.md#builtins-warn) throws an error when logging a warning.
- This will give you a stack trace that leads to the location of the warning.
+ This gives you a stack trace that leads to the location of the warning.
This is useful for finding information about warnings in third-party Nix code when you can not start the interactive debugger, such as when Nix is called from a non-interactive script. See [`debugger-on-warn`](#conf-debugger-on-warn).
@@ -361,6 +361,44 @@ struct EvalSettings : Config
The default value is chosen to balance performance and memory usage. On 32 bit systems
where memory is scarce, the default is a large value to reduce the amount of allocations.
)"};
+
+ Setting lazyTrees{
+ this,
+ false,
+ "lazy-trees",
+ R"(
+ If set to true, flakes and trees fetched by [`builtins.fetchTree`](@docroot@/language/builtins.md#builtins-fetchTree) are only copied to the Nix store when they're used as a dependency of a derivation. This avoids copying (potentially large) source trees unnecessarily.
+ )"};
+
+ // FIXME: this setting should really be in libflake, but it's
+ // currently needed in mountInput().
+ Setting lazyLocks{
+ this,
+ false,
+ "lazy-locks",
+ R"(
+ If enabled, Nix only includes NAR hashes in lock file entries if they're necessary to lock the input (i.e. when there is no other attribute that allows the content to be verified, like a Git revision).
+ This is not backward compatible with older versions of Nix.
+ If disabled, lock file entries always contain a NAR hash.
+ )"};
+
+ Setting evalCores{
+ this,
+ 1,
+ "eval-cores",
+ R"(
+ The number of threads used to evaluate Nix expressions. This currently affects the following commands:
+
+ * `nix search`
+ * `nix flake check`
+ * `nix flake show`
+ * `nix eval --json`
+ * Any evaluation that uses `builtins.parallel`
+
+ The value `0` causes Nix to use all available CPU cores in the system.
+
+ Note that enabling the debugger (`--debugger`) disables multi-threaded evaluation.
+ )"};
};
/**
@@ -368,4 +406,10 @@ struct EvalSettings : Config
*/
std::filesystem::path getNixDefExpr();
+/**
+ * Stack size for evaluator threads. This used to be 64 MiB, but macOS as deployed on GitHub Actions has a
+ * hard limit slightly under that, so we round it down a bit.
+ */
+constexpr size_t evalStackSize = 60 * 1024 * 1024;
+
} // namespace nix
diff --git a/src/libexpr/include/nix/expr/eval.hh b/src/libexpr/include/nix/expr/eval.hh
index b70c9db789d..c9cfb1a573b 100644
--- a/src/libexpr/include/nix/expr/eval.hh
+++ b/src/libexpr/include/nix/expr/eval.hh
@@ -51,10 +51,12 @@ struct SingleDerivedPath;
enum RepairFlag : bool;
struct MemorySourceAccessor;
struct MountedSourceAccessor;
+struct AsyncPathWriter;
namespace eval_cache {
class EvalCache;
}
+struct Executor;
/**
* Increments a count on construction and decrements on destruction.
@@ -432,6 +434,8 @@ public:
std::list debugTraces;
boost::unordered_flat_map> exprEnvs;
+ ref asyncPathWriter;
+
const std::shared_ptr getStaticEnv(const Expr & expr) const
{
auto i = exprEnvs.find(&expr);
@@ -496,10 +500,11 @@ private:
* Associate source positions of certain AST nodes with their preceding doc comment, if they have one.
* Grouped by file.
*/
- boost::unordered_flat_map positionToDocComment;
+ SharedSync>> positionToDocComment;
LookupPath lookupPath;
+ // FIXME: make thread-safe.
boost::unordered_flat_map, StringViewHash, std::equal_to<>>
lookupPathResolved;
@@ -588,7 +593,12 @@ public:
/**
* Mount an input on the Nix store.
*/
- StorePath mountInput(fetchers::Input & input, const fetchers::Input & originalInput, ref accessor);
+ StorePath mountInput(
+ fetchers::Input & input,
+ const fetchers::Input & originalInput,
+ ref accessor,
+ bool requireLockable,
+ bool forceNarHash = false);
/**
* Parse a Nix expression from the specified file.
@@ -650,7 +660,10 @@ public:
* application, call the function and overwrite `v` with the
* result. Otherwise, this is a no-op.
*/
- inline void forceValue(Value & v, const PosIdx pos);
+ inline void forceValue(Value & v, const PosIdx pos)
+ {
+ v.force(*this, pos);
+ }
void tryFixupBlackHolePos(Value & v, PosIdx pos);
@@ -708,6 +721,12 @@ public:
std::optional tryAttrsToString(
const PosIdx pos, Value & v, NixStringContext & context, bool coerceMore = false, bool copyToStore = true);
+ StorePath devirtualize(const StorePath & path, StringMap * rewrites = nullptr);
+
+ SingleDerivedPath devirtualize(const SingleDerivedPath & path, StringMap * rewrites = nullptr);
+
+ std::string devirtualize(std::string_view s, const NixStringContext & context);
+
/**
* String coercion.
*
@@ -725,7 +744,19 @@ public:
bool copyToStore = true,
bool canonicalizePath = true);
- StorePath copyPathToStore(NixStringContext & context, const SourcePath & path);
+ StorePath copyPathToStore(NixStringContext & context, const SourcePath & path, PosIdx pos);
+
+ /**
+ * Compute the base name for a `SourcePath`. For non-store paths,
+ * this is just `SourcePath::baseName()`. But for store paths, for
+ * backwards compatibility, it needs to be `-source`,
+ * i.e. as if the path were copied to the Nix store. This results
+ * in a "double-copied" store path like
+ * `/nix/store/--source`. We don't need to
+ * materialize /nix/store/-source though. Still, this
+ * requires reading/hashing the path twice.
+ */
+ std::string computeBaseName(const SourcePath & path, PosIdx pos);
/**
* Path coercion.
@@ -868,10 +899,11 @@ private:
const std::shared_ptr & staticEnv);
/**
- * Current Nix call stack depth, used with `max-call-depth` setting to throw stack overflow hopefully before we run
- * out of system stack.
+ * Current Nix call stack depth, used with `max-call-depth`
+ * setting to throw stack overflow hopefully before we run out of
+ * system stack.
*/
- size_t callDepth = 0;
+ thread_local static size_t callDepth;
public:
@@ -1018,6 +1050,10 @@ public:
DocComment getDocCommentForPos(PosIdx pos);
+ void waitForPath(const StorePath & path);
+ void waitForPath(const SingleDerivedPath & path);
+ void waitForAllPaths();
+
private:
/**
@@ -1043,8 +1079,18 @@ private:
Counter nrPrimOpCalls;
Counter nrFunctionCalls;
+public:
+ Counter nrThunksAwaited;
+ Counter nrThunksAwaitedSlow;
+ Counter microsecondsWaiting;
+ Counter currentlyWaiting;
+ Counter maxWaiting;
+ Counter nrSpuriousWakeups;
+
+private:
bool countCalls;
+ // FIXME: make thread-safe.
typedef boost::unordered_flat_map> PrimOpCalls;
PrimOpCalls primOpCalls;
@@ -1056,6 +1102,7 @@ private:
void incrFunctionCall(ExprLambda * fun);
+ // FIXME: make thread-safe.
typedef boost::unordered_flat_map> AttrSelects;
AttrSelects attrSelects;
@@ -1073,6 +1120,17 @@ private:
friend struct Value;
friend class ListBuilder;
+
+public:
+ /**
+ * Worker threads manager.
+ *
+ * Note: keep this last to ensure that it's destroyed first, so we
+ * don't have any background work items (e.g. from
+ * `builtins.parallel`) referring to a partially destroyed
+ * `EvalState`.
+ */
+ ref executor;
};
struct DebugTraceStacker
diff --git a/src/libexpr/include/nix/expr/meson.build b/src/libexpr/include/nix/expr/meson.build
index 2b0fbc40603..9f676b230f1 100644
--- a/src/libexpr/include/nix/expr/meson.build
+++ b/src/libexpr/include/nix/expr/meson.build
@@ -24,6 +24,7 @@ headers = [ config_pub_h ] + files(
'get-drvs.hh',
'json-to-value.hh',
'nixexpr.hh',
+ 'parallel-eval.hh',
'parser-state.hh',
'primops.hh',
'print-ambiguous.hh',
diff --git a/src/libexpr/include/nix/expr/nixexpr.hh b/src/libexpr/include/nix/expr/nixexpr.hh
index df39ecdde91..9bce1a9b91a 100644
--- a/src/libexpr/include/nix/expr/nixexpr.hh
+++ b/src/libexpr/include/nix/expr/nixexpr.hh
@@ -8,7 +8,6 @@
#include
#include
-#include "nix/expr/gc-small-vector.hh"
#include "nix/expr/value.hh"
#include "nix/expr/symbol-table.hh"
#include "nix/expr/eval-error.hh"
@@ -91,8 +90,6 @@ typedef std::vector AttrSelectionPath;
std::string showAttrSelectionPath(const SymbolTable & symbols, std::span attrPath);
-using UpdateQueue = SmallTemporaryValueVector;
-
/* Abstract syntax of Nix expressions. */
struct Expr
@@ -123,14 +120,6 @@ struct Expr
* of thunks allocated.
*/
virtual Value * maybeThunk(EvalState & state, Env & env);
-
- /**
- * Only called when performing an attrset update: `//` or similar.
- * Instead of writing to a Value &, this function writes to an UpdateQueue.
- * This allows the expression to perform multiple updates in a delayed manner, gathering up all the updates before
- * applying them.
- */
- virtual void evalForUpdate(EvalState & state, Env & env, UpdateQueue & q, std::string_view errorCtx);
virtual void setName(Symbol name);
virtual void setDocComment(DocComment docComment) {};
@@ -738,7 +727,7 @@ struct ExprOpNot : Expr
struct name : Expr \
{ \
MakeBinOpMembers(name, s) \
- }
+ };
MakeBinOp(ExprOpEq, "==");
MakeBinOp(ExprOpNEq, "!=");
@@ -749,14 +738,7 @@ MakeBinOp(ExprOpConcatLists, "++");
struct ExprOpUpdate : Expr
{
-private:
- /** Special case for merging of two attrsets. */
- void eval(EvalState & state, Value & v, Value & v1, Value & v2);
- void evalForUpdate(EvalState & state, Env & env, UpdateQueue & q);
-
-public:
- MakeBinOpMembers(ExprOpUpdate, "//");
- virtual void evalForUpdate(EvalState & state, Env & env, UpdateQueue & q, std::string_view errorCtx) override;
+ MakeBinOpMembers(ExprOpUpdate, "//")
};
struct ExprConcatStrings : Expr
@@ -811,23 +793,11 @@ struct ExprPos : Expr
COMMON_METHODS
};
-/* only used to mark thunks as black holes. */
-struct ExprBlackHole : Expr
-{
- void show(const SymbolTable & symbols, std::ostream & str) const override {}
-
- void eval(EvalState & state, Env & env, Value & v) override;
-
- void bindVars(EvalState & es, const std::shared_ptr & env) override {}
-
- [[noreturn]] static void throwInfiniteRecursionError(EvalState & state, Value & v);
-};
-
-extern ExprBlackHole eBlackHole;
-
class Exprs
{
- std::pmr::monotonic_buffer_resource buffer;
+ // FIXME: use std::pmr::monotonic_buffer_resource when parallel
+ // eval is disabled?
+ std::pmr::synchronized_pool_resource buffer;
public:
std::pmr::polymorphic_allocator alloc{&buffer};
diff --git a/src/libexpr/include/nix/expr/parallel-eval.hh b/src/libexpr/include/nix/expr/parallel-eval.hh
new file mode 100644
index 00000000000..4ccb3cfb843
--- /dev/null
+++ b/src/libexpr/include/nix/expr/parallel-eval.hh
@@ -0,0 +1,90 @@
+#pragma once
+
+#include
+#include
+#include
+#include
+
+#include
+
+#include "nix/util/sync.hh"
+#include "nix/util/logging.hh"
+#include "nix/util/environment-variables.hh"
+#include "nix/util/util.hh"
+#include "nix/util/signals.hh"
+
+#if NIX_USE_BOEHMGC
+# include
+#endif
+
+namespace nix {
+
+struct Executor
+{
+ using work_t = std::function;
+
+ struct Item
+ {
+ std::promise promise;
+ work_t work;
+ };
+
+ struct State
+ {
+ std::multimap queue;
+ std::vector threads;
+ };
+
+ std::atomic_bool quit{false};
+
+ const unsigned int evalCores;
+
+ const bool enabled;
+
+ const std::unique_ptr interruptCallback;
+
+ Sync state_;
+
+ std::condition_variable wakeup;
+
+ static unsigned int getEvalCores(const EvalSettings & evalSettings);
+
+ Executor(const EvalSettings & evalSettings);
+
+ ~Executor();
+
+ void createWorker(State & state);
+
+ void worker();
+
+ std::vector> spawn(std::vector> && items);
+
+ static thread_local bool amWorkerThread;
+};
+
+struct FutureVector
+{
+ Executor & executor;
+
+ struct State
+ {
+ std::vector> futures;
+ };
+
+ Sync state_;
+
+ ~FutureVector();
+
+ // FIXME: add a destructor that cancels/waits for all futures.
+
+ void spawn(std::vector> && work);
+
+ void spawn(uint8_t prioPrefix, Executor::work_t && work)
+ {
+ spawn({{std::move(work), prioPrefix}});
+ }
+
+ void finishAll();
+};
+
+} // namespace nix
diff --git a/src/libexpr/include/nix/expr/print-ambiguous.hh b/src/libexpr/include/nix/expr/print-ambiguous.hh
index c0d811d4b93..e64f7f9bf8d 100644
--- a/src/libexpr/include/nix/expr/print-ambiguous.hh
+++ b/src/libexpr/include/nix/expr/print-ambiguous.hh
@@ -15,7 +15,6 @@ namespace nix {
*
* See: https://github.com/NixOS/nix/issues/9730
*/
-void printAmbiguous(
- Value & v, const SymbolTable & symbols, std::ostream & str, std::set * seen, int depth);
+void printAmbiguous(EvalState & state, Value & v, std::ostream & str, std::set * seen, int depth);
} // namespace nix
diff --git a/src/libexpr/include/nix/expr/symbol-table.hh b/src/libexpr/include/nix/expr/symbol-table.hh
index f0220376c53..23151082933 100644
--- a/src/libexpr/include/nix/expr/symbol-table.hh
+++ b/src/libexpr/include/nix/expr/symbol-table.hh
@@ -2,13 +2,14 @@
///@file
#include
+
#include "nix/expr/value.hh"
-#include "nix/expr/static-string-data.hh"
-#include "nix/util/chunked-vector.hh"
#include "nix/util/error.hh"
+#include "nix/util/sync.hh"
+#include "nix/util/alignment.hh"
#include
-#include
+#include
namespace nix {
@@ -17,17 +18,27 @@ class SymbolValue : protected Value
friend class SymbolStr;
friend class SymbolTable;
- uint32_t idx;
-
- SymbolValue() = default;
-
-public:
operator std::string_view() const noexcept
{
return string_view();
}
};
+struct ContiguousArena
+{
+ const char * data;
+ const size_t maxSize;
+
+ // Put this in a separate cache line to ensure that a thread
+ // adding a symbol doesn't slow down threads dereferencing symbols
+ // by invalidating the read-only `data` field.
+ alignas(64) std::atomic size{0};
+
+ ContiguousArena(size_t maxSize);
+
+ size_t allocate(size_t bytes);
+};
+
class StaticSymbolTable;
/**
@@ -42,6 +53,7 @@ class Symbol
friend class StaticSymbolTable;
private:
+ /// The offset of the symbol in `SymbolTable::arena`.
uint32_t id;
explicit constexpr Symbol(uint32_t id) noexcept
@@ -73,6 +85,8 @@ public:
constexpr auto operator<=>(const Symbol & other) const noexcept = default;
friend class std::hash;
+
+ constexpr static size_t alignment = alignof(SymbolValue);
};
/**
@@ -84,25 +98,20 @@ class SymbolStr
{
friend class SymbolTable;
- constexpr static size_t chunkSize{8192};
- using SymbolValueStore = ChunkedVector;
-
const SymbolValue * s;
struct Key
{
using HashType = boost::hash;
- SymbolValueStore & store;
std::string_view s;
std::size_t hash;
- std::pmr::memory_resource & resource;
+ ContiguousArena & arena;
- Key(SymbolValueStore & store, std::string_view s, std::pmr::memory_resource & stringMemory)
- : store(store)
- , s(s)
+ Key(std::string_view s, ContiguousArena & arena)
+ : s(s)
, hash(HashType{}(s))
- , resource(stringMemory)
+ , arena(arena)
{
}
};
@@ -113,22 +122,7 @@ public:
{
}
- SymbolStr(const Key & key)
- {
- auto size = key.s.size();
- if (size >= std::numeric_limits::max()) {
- throw Error("Size of symbol exceeds 4GiB and cannot be stored");
- }
- // for multi-threaded implementations: lock store and allocator here
- const auto & [v, idx] = key.store.add(SymbolValue{});
- if (size == 0) {
- v.mkStringNoCopy(""_sds, nullptr);
- } else {
- v.mkStringNoCopy(StringData::make(key.resource, key.s));
- }
- v.idx = idx;
- this->s = &v;
- }
+ SymbolStr(const Key & key);
bool operator==(std::string_view s2) const noexcept
{
@@ -157,11 +151,7 @@ public:
[[gnu::always_inline]]
bool empty() const noexcept
{
- auto * p = &s->string_data();
- // Save a dereference in the sentinel value case
- if (p == &""_sds)
- return true;
- return p->size() == 0;
+ return !s->string_data().size();
}
[[gnu::always_inline]]
@@ -176,11 +166,6 @@ public:
return s;
}
- explicit operator Symbol() const noexcept
- {
- return Symbol{s->idx + 1};
- }
-
struct Hash
{
using is_transparent = void;
@@ -218,6 +203,11 @@ public:
return operator()(b, a);
}
};
+
+ constexpr static size_t computeSize(std::string_view s)
+ {
+ return alignUp(sizeof(Value) + sizeof(StringData) + s.size() + 1, Symbol::alignment);
+ }
};
class SymbolTable;
@@ -237,6 +227,7 @@ class StaticSymbolTable
std::array symbols;
std::size_t size = 0;
+ std::size_t nextId = alignof(SymbolValue);
public:
constexpr StaticSymbolTable() = default;
@@ -245,8 +236,9 @@ public:
{
/* No need to check bounds because out of bounds access is
a compilation error. */
- auto sym = Symbol(size + 1); //< +1 because Symbol with id = 0 is reserved
+ auto sym = Symbol(nextId);
symbols[size++] = {str, sym};
+ nextId += SymbolStr::computeSize(str);
return sym;
}
@@ -264,61 +256,67 @@ private:
* SymbolTable is an append only data structure.
* During its lifetime the monotonic buffer holds all strings and nodes, if the symbol set is node based.
*/
- std::pmr::monotonic_buffer_resource buffer;
- SymbolStr::SymbolValueStore store{16};
+ ContiguousArena arena;
/**
- * Transparent lookup of string view for a pointer to a ChunkedVector entry -> return offset into the store.
- * ChunkedVector references are never invalidated.
+ * Transparent lookup of string view for a pointer to a
+ * SymbolValue in the arena.
*/
- boost::unordered_flat_set symbols{SymbolStr::chunkSize};
+ boost::concurrent_flat_set symbols;
public:
SymbolTable(const StaticSymbolTable & staticSymtab)
+ : arena(1 << 30)
{
+ // Reserve symbol ID 0 and ensure alignment of the first allocation.
+ arena.allocate(Symbol::alignment);
+
staticSymtab.copyIntoSymbolTable(*this);
}
/**
* Converts a string into a symbol.
*/
- Symbol create(std::string_view s)
- {
- // Most symbols are looked up more than once, so we trade off insertion performance
- // for lookup performance.
- // FIXME: make this thread-safe.
- return Symbol(*symbols.insert(SymbolStr::Key{store, s, buffer}).first);
- }
+ Symbol create(std::string_view s);
std::vector resolve(const std::span & symbols) const
{
std::vector result;
result.reserve(symbols.size());
- for (auto sym : symbols)
+ for (auto & sym : symbols)
result.push_back((*this)[sym]);
return result;
}
SymbolStr operator[](Symbol s) const
{
- uint32_t idx = s.id - uint32_t(1);
- if (idx >= store.size())
- unreachable();
- return store[idx];
+ assert(s.id);
+ // Note: we don't check arena.size here to avoid a dependency
+ // on other threads creating new symbols.
+ return SymbolStr(*reinterpret_cast(arena.data + s.id));
}
- [[gnu::always_inline]]
size_t size() const noexcept
{
- return store.size();
+ return symbols.size();
}
- size_t totalSize() const;
+ size_t totalSize() const
+ {
+ return arena.size;
+ }
template
void dump(T callback) const
{
- store.forEach(callback);
+ std::string_view left{arena.data, arena.size};
+ left = left.substr(Symbol::alignment);
+ while (!left.empty()) {
+ auto v = reinterpret_cast(left.data());
+ callback(v->string_view());
+ left = left.substr(
+ alignUp(sizeof(SymbolValue) + sizeof(StringData) + v->string_view().size() + 1, Symbol::alignment));
+ }
}
};
diff --git a/src/libexpr/include/nix/expr/value.hh b/src/libexpr/include/nix/expr/value.hh
index 004dcc43f0f..10893347bd6 100644
--- a/src/libexpr/include/nix/expr/value.hh
+++ b/src/libexpr/include/nix/expr/value.hh
@@ -1,6 +1,7 @@
#pragma once
///@file
+#include
#include
#include
#include
@@ -26,6 +27,19 @@ namespace nix {
struct Value;
class BindingsBuilder;
+static constexpr int discriminatorBits = 3;
+
+enum PrimaryDiscriminator : int {
+ pdSingleDWord = 0,
+ pdThunk = 1,
+ pdPending = 2,
+ pdAwaited = 3,
+ pdPairOfPointers = 4,
+ pdListN = 5, // FIXME: get rid of this by putting the size in the first word
+ pdString = 6,
+ pdPath = 7, // FIXME: get rid of this by ditching the `accessor` field
+};
+
/**
* Internal type discriminator, which is more detailed than `ValueType`, as
* it specifies the exact representation used (for types that have multiple
@@ -36,27 +50,50 @@ class BindingsBuilder;
* This also restricts the number of internal types represented with distinct memory layouts.
*/
typedef enum {
- tUninitialized = 0,
- /* layout: Single/zero field payload */
- tInt = 1,
- tBool,
- tNull,
- tFloat,
- tExternal,
- tPrimOp,
- tAttrs,
- /* layout: Pair of pointers payload */
- tListSmall,
- tPrimOpApp,
- tApp,
- tThunk,
- tLambda,
- /* layout: Single untaggable field */
- tListN,
- tString,
- tPath,
+ /* Values that have more type bits in the first word, and the
+ payload (a single word) in the second word. */
+ tUninitialized = PrimaryDiscriminator::pdSingleDWord | (0 << discriminatorBits),
+ tInt = PrimaryDiscriminator::pdSingleDWord | (1 << discriminatorBits),
+ tFloat = PrimaryDiscriminator::pdSingleDWord | (2 << discriminatorBits),
+ tBool = PrimaryDiscriminator::pdSingleDWord | (3 << discriminatorBits),
+ tNull = PrimaryDiscriminator::pdSingleDWord | (4 << discriminatorBits),
+ tAttrs = PrimaryDiscriminator::pdSingleDWord | (5 << discriminatorBits),
+ tPrimOp = PrimaryDiscriminator::pdSingleDWord | (6 << discriminatorBits),
+ tFailed = PrimaryDiscriminator::pdSingleDWord | (7 << discriminatorBits),
+ tExternal = PrimaryDiscriminator::pdSingleDWord | (8 << discriminatorBits),
+
+ /* Thunks. */
+ tThunk = PrimaryDiscriminator::pdThunk | (0 << discriminatorBits),
+ tApp = PrimaryDiscriminator::pdThunk | (1 << discriminatorBits),
+
+ tPending = PrimaryDiscriminator::pdPending,
+ tAwaited = PrimaryDiscriminator::pdAwaited,
+
+ /* Values that consist of two pointers. The second word contains
+ more type bits in its alignment niche. */
+ tListSmall = PrimaryDiscriminator::pdPairOfPointers | (0 << discriminatorBits),
+ tPrimOpApp = PrimaryDiscriminator::pdPairOfPointers | (1 << discriminatorBits),
+ tLambda = PrimaryDiscriminator::pdPairOfPointers | (2 << discriminatorBits),
+
+ /* Special values. */
+ tListN = PrimaryDiscriminator::pdListN,
+ tString = PrimaryDiscriminator::pdString,
+ tPath = PrimaryDiscriminator::pdPath,
} InternalType;
+/**
+ * Return true if `type` denotes a "finished" value, i.e. a weak-head
+ * normal form.
+ *
+ * Note that tPrimOpApp is considered "finished" because it represents
+ * a primop call with an incomplete number of arguments, and therefore
+ * cannot be evaluated further.
+ */
+inline bool isFinished(InternalType t)
+{
+ return t != tUninitialized && t != tThunk && t != tApp && t != tPending && t != tAwaited;
+}
+
/**
* This type abstracts over all actual value types in the language,
* grouping together implementation details like tList*, different function
@@ -64,6 +101,7 @@ typedef enum {
*/
typedef enum {
nThunk,
+ nFailed,
nInt,
nFloat,
nBool,
@@ -80,7 +118,6 @@ class Bindings;
struct Env;
struct Expr;
struct ExprLambda;
-struct ExprBlackHole;
struct PrimOp;
class Symbol;
class SymbolStr;
@@ -282,7 +319,7 @@ namespace detail {
/**
* Implementation mixin class for defining the public types
- * In can be inherited from by the actual ValueStorage implementations
+ * In can be inherited by the actual ValueStorage implementations
* for free due to Empty Base Class Optimization (EBCO).
*/
struct ValueBase
@@ -417,6 +454,11 @@ struct ValueBase
size_t size;
Value * const * elems;
};
+
+ struct Failed : gc
+ {
+ std::exception_ptr ex;
+ };
};
template
@@ -443,6 +485,7 @@ struct PayloadTypeToInternalType
MACRO(PrimOp *, primOp, tPrimOp) \
MACRO(ValueBase::PrimOpApplicationThunk, primOpApp, tPrimOpApp) \
MACRO(ExternalValueBase *, external, tExternal) \
+ MACRO(ValueBase::Failed *, failed, tFailed) \
MACRO(NixFloat, fpoint, tFloat)
#define NIX_VALUE_PAYLOAD_TYPE(T, FIELD_NAME, DISCRIMINATOR) \
@@ -546,12 +589,44 @@ class alignas(16) ValueStorage::type;
- using Payload = std::array;
- Payload payload = {};
- static constexpr int discriminatorBits = 3;
+ /**
+ * For multithreaded evaluation, we have to make sure that thunks/apps
+ * (the only mutable types of values) are updated in a safe way. A
+ * value can have the following states (see `force()`):
+ *
+ * * "thunk"/"app". When forced, this value transitions to
+ * "pending". The current thread will evaluate the
+ * thunk/app. When done, it will override the value with the
+ * result. If the value is at that point in the "awaited" state,
+ * the thread will wake up any waiting threads.
+ *
+ * * "pending". This means it's currently being evaluated. If
+ * another thread forces this value, it transitions to "awaited"
+ * and the thread will wait for the value to be updated (see
+ * `waitOnThunk()`).
+ *
+ * * "awaited". Like pending, only it means that there already are
+ * one or more threads waiting for this thunk.
+ *
+ * To ensure race-free access, the non-atomic word `p1` must
+ * always be updated before `p0`. Writes to `p0` should use
+ * *release* semantics (so that `p1` and any referenced values become
+ * visible to threads that read `p0`), and reads from `p0` should
+ * use `*acquire* semantics.
+ *
+ * Note: at some point, we may want to switch to 128-bit atomics
+ * so that `p0` and `p1` can be updated together
+ * atomically. However, 128-bit atomics are a bit problematic at
+ * present on x86_64 (see
+ * e.g. https://ibraheem.ca/posts/128-bit-atomics/).
+ */
+ std::atomic p0{0};
+ PackedPointer p1{0};
+
static constexpr PackedPointer discriminatorMask = (PackedPointer(1) << discriminatorBits) - 1;
+ // FIXME: move/update
/**
* The value is stored as a pair of 8-byte double words. All pointers are assumed
* to be 8-byte aligned. This gives us at most 6 bits of discriminator bits
@@ -581,15 +656,6 @@ class alignas(16) ValueStorage
requires std::is_pointer_v
@@ -600,7 +666,7 @@ class alignas(16) ValueStorage(payload[0] & discriminatorMask);
+ return static_cast(p0 & discriminatorMask);
}
static void assertAligned(PackedPointer val) noexcept
@@ -608,13 +674,30 @@ class alignas(16) ValueStorage(p0_ & discriminatorMask);
+ if (pd == pdPending)
+ // Nothing to do; no thread is waiting on this thunk.
+ ;
+ else if (pd == pdAwaited)
+ // Slow path: wake up the threads that are waiting on this
+ // thunk.
+ notifyWaiters();
+ else if (pd == pdThunk)
+ unreachable();
+ }
+
template
void setSingleDWordPayload(PackedPointer untaggedVal) noexcept
{
- /* There's plenty of free upper bits in the first dword, which is
- used only for the discriminator. */
- payload[0] = static_cast(pdSingleDWord) | (static_cast(type) << discriminatorBits);
- payload[1] = untaggedVal;
+ /* There's plenty of free upper bits in the first byte, which
+ is used only for the discriminator. */
+ finish(static_cast(type), untaggedVal);
}
template
@@ -623,32 +706,42 @@ class alignas(16) ValueStorage= pdListN && discriminator <= pdPath);
auto firstFieldPayload = std::bit_cast(firstPtrField);
assertAligned(firstFieldPayload);
- payload[0] = static_cast(discriminator) | firstFieldPayload;
- payload[1] = std::bit_cast(untaggableField);
+ finish(static_cast
+
