2024-02-19 Nix team meeting minutes #126

thufschmitt · February 26, 2024, 7:58am

Pluggable authentication by edolstra · Pull Request #9857 · NixOS/nix · GitHub

Comment by edolstra to Pluggable authentication

NixOS:master ← edolstra:pluggable-auth

Team meeting notes: - Needs more documentation. - Maybe the extra Unix domai…n socket can be replaced with a new STDERR_* message to have the daemon request auth from the client. Then it would work over ssh-ng as well. - Should be an experimental feature. - Currently auth tunneling is only supported for trusted users, but it might be okay to support it for all users. (Though we have to be careful with e.g. Attic since we don't want the client to override the user name used to connect to Attic, since then the server will return a different (possibly untrused) slice of the binary cache.) - Maybe the client should ask the user to approve sending credentials to the daemon, so that e.g. a remote SSH daemon cannot exfiltrate arbitrary secrets from the client.

Installables syntax

Extra proposal:

Allow arbitrary fetcher refs as argument to --tree
- --tree <fetchref>#attr.path, similar to --file $(nix flake prefetch <fetchref>) attr.path
- Does --tree /path copy /path into the Nix store? NO (as an exception/optimization)
- Does this imply --impure? YES
- Note: the CLI already supports something like this: nix build --file flake:github:NixOS/nix - we can remove support for this when we have --tree
Search for a default.nix if no flake.nix found (unless there’s an explicit --flake)
- Warn if not explicitly specified (at least for the time being)
For --expr
- --expr "Nix expression"
Decision:
- Have #2 right now (Stabilize the (non-flakes) installable syntax · Issue #10046 · NixOS/nix · GitHub)
- Also have --tree like the proposal above (Add a `--tree` cli flag for evaluating a Nix file from an arbitrary fetchTree URL · Issue #10047 · NixOS/nix · GitHub)
  - Remove the support for flake: in --file (right now you can do --file flake:github:NixOS/nix)

Cleaning up experimental features

@edolstra: We really should have tracking issues for all of these
@ericson3214: Yes we should, I had made All experimental feature flags should have a tracking issue, shown in docs, and enforced mechanically · Issue #9345 · NixOS/nix · GitHub for enforcing this. It should happen.
- post meeting: Marks that issue as a “good first issue” in hopes that someone picks this up

FetchTree

@thufschmitt: We committed to stabilize after the previous release. Should do it now

NoURlLiterals

Shouldn’t be an “experimental” feature, rather a deprecated one.
Need a mechanism for deprecated features

github.com/NixOS/nix

Remove the `no-url-literals` experimental feature

opened 02:29PM - 20 Feb 24 UTC

thufschmitt

feature idea approved

**Is your feature request related to a problem? Please describe.** Nix curren…tly has a [`no-url-literals`](https://nixos.org/manual/nix/stable/contributing/experimental-features.html?highlight=url%20literal#no-url-literals) experimental feature that disables the use of URL literals in the language. While the change by itself is something we agree we want to move towards, having it be an experimental feature isn't the right thing because it's unlikely that we'll ever flip the switch, and it isn't visible by default. **Describe the solution you'd like** What we should instead have is have it be (visibly) deprecated (through warnings), with a way to forbid it altogether, and a way to shut the warnings if needed. -- _End of the team discussion, the below is my own interpretation of the agreement we had and up to discussion_ -- Concretely, we should remove the experimental feature, and add an option `warn-url-literal = {yes|no|error}`, defaulting to `yes`, with the (long-term) plan of making it default to `error`. This could be later extended to a more generic mechanism able to handle more warning/errors. Tvix has [a few of them](https://code.tvl.fyi/tree/tvix/eval/src/warnings.rs?id=6b136dfd23c03cc61d189ad5d41dd881e45b677e#n9), and there are a number of things discussed here that are blocked on the lack of a deprecation path (https://github.com/NixOS/nix/issues/7578, https://github.com/NixOS/nix/issues/8738, https://github.com/NixOS/nix/issues/8613) **Priorities** Add :+1: to [issues you find important](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc).

FetchClosure

Already discussed in length. Recent behaviour change.

Depending on the feedback after that change, we could stabilize at leat part of it.
The pure CA part should (hopefully) be good to go

ReplFlake

Was here to provide a smooth transition for a breaking change.
Should flip the switch now.

@tomberek will take over.

AutoAllocateUids

Can remove the experimental flag (still won’t enable the option by default)
Doesn’t fully work on MacOS (because can’t fake /etc/passwd, so breaks whoami and friends)