2025-06-11 Nix team meeting minutes #231

roberth · June 11, 2025, 8:23pm

2025-06-11 Nix team meeting minutes #231

Wednesday triage session

Attendees: @edolstra @roberth @Ericson2314 @xokdvium @tomberek @edef

Triage

github.com/NixOS/nix

nix 2.29.0 ignores "dir" field on registry.json

opened 02:50PM - 26 May 25 UTC

oux

bug flakes

## Describe the bug nix 2.29.0 doesn't takes into account dir parameter from ni…x registry ## Steps To Reproduce With nix 2.26.2 or 2.28.3: $ nix eval blender-bin «derivation /nix/store/g6sqfammi9j6qx4c2fn834r91a4f7b71-blender-bin-4.4.3.drv» but with nix 2.29.0: $ nix eval blender-bin error: path '«github:edolstra/nix-warez/85d76721132cc6631bbaa8c950d4d0f3aa4003fd»/flake.nix' does not exist $ nix eval github:edolstra/nix-warez?dir=blender «derivation /nix/store/g6sqfammi9j6qx4c2fn834r91a4f7b71-blender-bin-4.4.3.drv» ## Expected behavior $ nix eval blender-bin «derivation /nix/store/g6sqfammi9j6qx4c2fn834r91a4f7b71-blender-bin-4.4.3.drv» [latest Nix manual]: https://nixos.org/manual/nix/unstable/ [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source [open bug issues and pull requests]: https://github.com/NixOS/nix/labels/bug --- Add :+1: to [issues you find important](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc).

github.com/NixOS/nix

install failed on to copy the basic Nix files to the new store at /nix/store

opened 04:35PM - 28 May 25 UTC

AaronLinOops

installer macos

## Platform - [ ] Linux: - [x] macOS - [ ] WSL ## Additional information … ## Output <details><summary>Output</summary> ```log ~~> Installing Nix ---- sudo execution ------------------------------------------------------------ I am executing: $ sudo cp -RPp ./store/0aib3vrycbmh24ay14nwc3cidl2z7bif-aws-c-event-stream-0.5.0 ./store/0d94gkn5h7nn2hrv16ghy3ykd0yr2s3a-lowdown-1.3.2-lib ./store/0iw99qiqlmxrpxwyyw0351i8wd9272hz-libiconv-1.17 ./store/12w1gpnkq7gy91j8k4nid5862kph2yw4-aws-sdk-cpp-1.11.448 ./store/16qvmw6is4m528amxa8mwlq2mi5d0kj0-toml11-3.7.1 ./store/2qsrdx1g2vr6706gvj69fcs2y674h25k-aws-checksums-0.2.2 ./store/3076rc8fp7ib9w98s8m0ffahm5678ly2-aws-c-io-0.15.3 ./store/3j1afppmdainmflzh7j2231lrs77r1a2-s2n-tls-1.5.12 ./store/3yzl1ckl9s34gz7gsdisbzm3sn5i2l52-openssl-3.4.1 ./store/4983i2clmrpkdmidkdcpa8wbwn8pdm9j-nix-fetchers-2.29.0 ./store/49wnnf3mg5gad0cxyqglv095jhlpd3cs-nix-fetchers-2.29.0-dev ./store/4viarfh5y8bq5h9q0ibr652svyvlfylb-llhttp-9.2.1 ./store/54hk2jzk0aarrwc9lh6njr0wgcq3zb2l-nss-cacert-3.108 ./store/5s0xmjrx5fdakl3fa0g179hxfrz4nskn-tbb-2021.11.0-dev ./store/621gznka92jgygyyvmndhgh0wk786jb4-zstd-1.5.7 ./store/6blvjcka906rd5xbfdwpzmginf3rvaj2-nghttp2-1.65.0-lib ./store/6k1n9g1z4ljhcnclc4mz8js7kzrzn55d-krb5-1.21.3-lib ./store/6q1fgqxgp5bxk9qill5vmh0gb9yvg93q-aws-c-compression-0.3.0 ./store/78pyl46xkjwa3sgyg130cy38sr1nbsk6-aws-c-cal-0.8.0 ./store/89hqcg90npplmlk4pymsky8fjnp9rs5v-aws-c-s3-0.7.1 ./store/a8nvrdf92lppdfzycx8zv7mcn3i0vrnk-libsodium-1.0.20 ./store/afgspk4fcn7n8qd7djfyvk3naf9i2wzy-nlohmann_json-3.11.3 ./store/aypiwg77ql3sqb8an48zp8vqnaljlwvp-s2n-tls-1.5.12-dev ./store/az60dw6brz5qwck9mcz4gqd7y0gzvi9v-nix-main-2.29.0 ./store/b5gpclnpiiggaflkkpbcgx4qr4cxiq7c-gettext-0.22.5 ./store/bnq6sdbk3fpid44la2jcrx6rr6fz6ws2-sqlite-3.48.0 ./store/c3fgc2vz11fykfx0mf8f9ycnbz31ga95-nix-2.29.0 ./store/c6846y12ivpk61s996vwlf3yr4czlhpn-nix-store-2.29.0 ./store/c9pz8nr8pmc0sdv7kyff9cb241yqsal6-libarchive-3.7.8 ./store/d87xh0mfx0fxsdj49k7m5b25jg9an7hz-brotli-1.1.0-lib ./store/dd6i0721s2kwh0pa8fzkvnn6yfh09fbj-libxml2-2.13.8 ./store/dndfb20kk038rv9s9kp7wqf971z0da3g-nix-expr-2.29.0 ./store/f02cyb6qdyqy92ks7clr60fqbabh1nzy-openssl-3.4.1-dev ./store/f434qikmkzr4d65ygixbki9lq1aibgf2-boehm-gc-8.2.8-dev ./store/f9567rjsx192k5zzvq7daghafcay8m60-aws-c-sdkutils-0.2.1 ./store/fnb1scic2h237hyrla4zxkpisjd7dsjp-libarchive-3.7.8-dev ./store/fykc7y5iw7vl6c93i80d0maywd99c9b8-aws-c-auth-0.8.1 ./store/grskrvrxcpz36qgkmlsmzr6s8slrgabn-libunistring-1.3 ./store/gz47rzqvx9knfq7sv36pf9a8arcmz968-libcxx-19.1.7 ./store/hpcm5scq59h34hk2wngs85s7gm5c75f0-bash-5.2p37 ./store/j20pg933s7h5ah687gn1zni0da9yfn8z-nix-flake-2.29.0 ./store/jn61h3v1h50sdddga1cz5k9qw7x0j7ak-libpsl-0.21.5 ./store/kmzcp6fd8bzqn5w23yqxf9jixx7hlp6k-libresolv-83 ./store/l2g8yvadrp43c5mvm8zknmjhkibl28pa-nix-expr-2.29.0-dev ./store/l59pp0ndfz7sm6fzdj4saviq8sqkl23z-tbb-2021.11.0 ./store/lb660i1wqyv5ym27ixsn41lw0xa5j6dk-nix-util-2.29.0-dev ./store/lbc2r71sxdms7wzziw3ravj9arscrf2a-libarchive-3.7.8-lib ./store/m8al21x15n9b0rjbfc07l92mk6yky1y1-nix-cmd-2.29.0 ./store/mdmrm6c4scfrd2n9xgj2ismlkl69mqa7-editline-1.17.1 ./store/mgpz5fn22szzcim9x6p3f2k3xr9aqn7s-aws-c-mqtt-0.11.0 ./store/mn723pfrziv5xs9lnkvymg5d1n6rsnaj-libiconv-109 ./store/mp0zi8jdlqsxkkr99gfbr07rra69xb2w-libcpuid-0.7.1 ./store/mrz98bf6h6r02d300vhjz60vvzjxhbw2-xz-5.8.1 ./store/msz47gpx81sw1zr4kvw4mwcpg4qdhwp7-openssl-3.4.1-bin ./store/n55jybmhns1hfqw131bqss221932z8px-libidn2-2.3.8 ./store/nak4shkkdj0mmazapnl59hl21vjdap1m-bzip2-1.0.8 ./store/nb0iczpvvv2scr78r6cjnl4cw848g8ja-publicsuffix-list-0-unstable-2025-03-12 ./store/q7zsf0jr67hgsk1fwjwvjrdnr1ddim97-aws-crt-cpp-0.29.4 ./store/qjhbw2nm2ipr6p8d71phy34nyma77ikg-boehm-gc-8.2.8 ./store/qqvfpwviw0c0gal2phlsg8s3b1jlpgr8-boost-1.87.0-dev ./store/qw272vgpd9wcfbfdynsrnmb2icpzqyiw-libblake3-1.8.2 ./store/rjw4l7lyzgxc1gkialsj35h81n4q8x8m-aws-crt-cpp-0.29.4-dev ./store/rr2vnmkkgy3s2d9hifrnm2jy0m833fq8-libgit2-1.9.0-lib ./store/s36zhjg43zrpblybl8xyyylvycp3b8l5-curl-8.12.1 ./store/vh0nz87bba0gi9qdv5yrfjwryyrmh9jk-libssh2-1.11.1 ./store/vv065sp6lmb5qs3vky0v5f00zh1q0mfm-nix-store-2.29.0-dev ./store/wvlyd5z67m3zb2x4md5bkf7ffl1ijsld-boost-1.87.0 ./store/x9lsc77n69wfd57187p47az5syrnxpvc-aws-c-common-0.10.3 ./store/xgqx1hsmf2lplgv896v7ngri5mlpisf7-nix-util-2.29.0 ./store/yhf3rsa9fpm1qffzsf8qw4lphpagw10d-aws-c-http-0.9.2 ./store/z31nrcsd7yyimkp096qj6vmqhawdszbl-zlib-1.3.1 ./store/zlgk0jnvaa1g2xziyh0pgdww699gi1p2-pcre2-10.44 /nix/store/ to copy the basic Nix files to the new store at /nix/store cp: cannot overwrite directory /nix/store/6k1n9g1z4ljhcnclc4mz8js7kzrzn55d-krb5-1.21.3-lib/sbin with non-directory ./store/6k1n9g1z4ljhcnclc4mz8js7kzrzn55d-krb5-1.21.3-lib/sbin ---- oh no! -------------------------------------------------------------------- Oh no, something went wrong. If you can take all the output and open an issue, we'd love to fix the problem so nobody else has this issue. :( We'd love to help if you need it. You can open an issue at https://github.com/NixOS/nix/issues/new?labels=installer&template=installer.md ``` </details> ## Checklist - [x] checked [latest Nix manual] \([source]) - [x] checked [open installer issues and pull requests] for possible duplicates [latest Nix manual]: https://nixos.org/manual/nix/unstable/ [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source [open installer issues and pull requests]: https://github.com/NixOS/nix/labels/installer --- Add :+1: to [issues you find important](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc).

github.com/NixOS/nix

Advise against direct use of builtins in docs

opened 05:01PM - 28 May 25 UTC

roberth

documentation idea approved

## Problem Changing the behavior of builtins is risky to impossible, as we prom…ise to evaluate reproducibly over time. (that's without language versioning, which is hard to pull off in any kind of friendly, robust way EDIT: and which would be detrimental to the ecosystem due to opportunity cost) ## Proposal Nixpkgs `lib` and possibly alternative libraries extend _and improve_ the builtins. - Recommend to use those functions whenever possible. This also settles the question: should I use `builtins` or `lib`? Always `lib`. It's better. - Highlight known differences between builtins and Nixpkgs `lib`. A worthwhile layering violation. ## Checklist - [ ] checked [latest Nix manual] \([source]) - [ ] checked [open documentation issues and pull requests] for possible duplicates [latest Nix manual]: https://nixos.org/manual/nix/unstable/ [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source [open documentation issues and pull requests]: https://github.com/NixOS/nix/labels/documentation --- Add :+1: to [issues you find important](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc).

github.com/NixOS/nix

error: suspicious ownership or permission on '/nix/store'

opened 11:22PM - 28 May 25 UTC

RashiqAzhan

installer other-linux

## Platform - [x] Linux: Arch Linux ## Additional information Followed the …[arch wiki](https://wiki.archlinux.org/title/Nix) to install nix. ## Output I got the following when trying to follow the docs to `nix-channel --update`. ```log ❯ nix-channel --update this derivation will be built: /nix/store/667idzh6qlxswdvi3ap2vlzmz48nfqfk-nixgl.drv building '/nix/store/667idzh6qlxswdvi3ap2vlzmz48nfqfk-nixgl.drv'... error: suspicious ownership or permission on '/nix/store/667idzh6qlxswdvi3ap2vlzmz48nfqfk-nixgl.drv.chroot/root/nix/store/d5xzq5yl0lr6vz3kn59fjfgszq3zrd4a-nixgl' for output 'out'; rejecting this build output error: program '/usr/bin/nix-build' failed with exit code 1 ``` </details> ## Checklist Not sure if [this](https://github.com/NixOS/nix/issues/7170) is related but the solution there didn't work for me. - [x] checked [latest Nix manual] \([source]) - [x] checked [open installer issues and pull requests] for possible duplicates [latest Nix manual]: https://nixos.org/manual/nix/unstable/ [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source [open installer issues and pull requests]: https://github.com/NixOS/nix/labels/installer --- Add :+1: to [issues you find important](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc).

github.com/NixOS/nix

exportReferencesGraph doesn't work in `nix-shell`

opened 10:39AM - 31 May 25 UTC

arianvp

bug nix-shell

## Describe the bug I'd expect the references graph to be in `TMPDIR` but it's …not ## Steps To Reproduce ``` { cpio, runCommand, systemd, }: runCommand "initrd" { name = "initrd"; exportReferencesGraph = [ "systemd-graph" systemd ]; # unsafeDiscardReferences.out = true; } '' ls . '' ``` ## Expected behavior ``` ls $TMPDIR ``` shows a `systemd-graph` file but it doesn't ## Metadata ## Additional context ## Checklist - [ ] checked [latest Nix manual] \([source]) - [ ] checked [open bug issues and pull requests] for possible duplicates [latest Nix manual]: https://nixos.org/manual/nix/unstable/ [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source [open bug issues and pull requests]: https://github.com/NixOS/nix/labels/bug --- Add :+1: to [issues you find important](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc).

github.com/NixOS/nix

[Bug]: Backup file /etc/bashrc.backup-before-nix contains Nix remnants

opened 08:25AM - 01 Jun 25 UTC

aad19

installer other-linux

## Platform - **Linux Fedora 42** ## Additional information While attempting …to install **Nix** with **SELinux** enabled, I encountered multiple issues related to permission and daemon connectivity. Here's a summary of the steps taken to make the installation work. --- ### Problem Summary - **SELinux was blocking the installation**, and Nix's daemon socket was not accessible. - The error `cannot connect to socket at '/nix/var/nix/daemon-socket/socket': Connection refused` was persistent. - Even after using the official installation script with the `--daemon` flag, the daemon wouldn’t start unless SELinux was disabled or configured explicitly. --- ### Solution Outline 1. **Temporarily disable SELinux** to allow initial installation to proceed: ```bash sudo setenforce 0 ``` 2. **Set required environment variable before installation:** ```bash export NIX_BUILD_GROUP_ID=969 ``` 3. **Run the official Nix installer:** ```bash sh <(curl -L https://nixos.org/nix/install) --daemon ``` 4. **Add a custom SELinux policy module to allow Nix to function properly:** ```selinux module nix 1.0; require { type unconfined_t; type tmpfs_t; type user_home_t; class file { create open read write execute unlink }; class dir { add_name create remove_name write }; } # ===== Nix core rules ===== allow unconfined_t tmpfs_t:file { create open read write execute unlink }; allow unconfined_t tmpfs_t:dir { add_name create remove_name write }; allow unconfined_t user_home_t:file { create open read write execute unlink }; allow unconfined_t user_home_t:dir { add_name create remove_name write }; ``` Then compile and install the module: ```bash sudo make -f /usr/share/selinux/devel/Makefile nix.pp sudo semodule -i nix.pp ``` 5. **Attempt to run Nix commands:** ```bash nix-shell -p hello hello ``` This resulted in: ``` error: cannot connect to socket at '/nix/var/nix/daemon-socket/socket': Connection refused bash: hello: command not found... ``` 6. **Try starting the Nix daemon:** ```bash sudo systemctl start nix-daemon.service sudo systemctl enable nix-daemon.service ``` Output: ``` Failed to start nix-daemon.service: Unit nix-daemon.service not found. ``` 7. **Clean reinstall and environment reset:** ```bash sudo rm -rf /nix sudo rm -rf ~/.nix-* sudo setenforce 0 sh <(curl -L https://nixos.org/nix/install) --daemon ``` At this point, installation succeeded after resolving the `/etc/bashrc.backup-before-nix` conflict. --- ### 🔎 Verifying the Environment To check whether Nix-related profile scripts were properly added, I ran: ```bash sudo cat /etc/bashrc.backup-before-nix | grep -i nix ``` And saw: ```bash # Nix if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' # End Nix ``` --- ## Output Even after applying the SELinux policy and reinstalling Nix, the daemon unit file was still missing in `systemd`, and attempting to use `nix-shell` failed unless SELinux was fully disabled. This suggests the installation does not complete successfully under SELinux enforcing mode **without additional post-install steps or patches**. Further troubleshooting might involve verifying which systemd unit files are created by the installer and where. --- ## Checklist * [ ] Checked the [[latest Nix manual](https://nixos.org/manual/nix/unstable/)] * [ ] Searched [[open installer issues and pull requests](https://github.com/NixOS/nix/labels/installer)] [latest Nix manual]: https://nixos.org/manual/nix/unstable/ [open installer issues and pull requests]: https://github.com/NixOS/nix/labels/installer --- Add :+1: to [issues you find important](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc).

github.com/NixOS/nix

Markdown link targets are lost in `:doc`

opened 11:02AM - 02 Jun 25 UTC

roberth

bug idea approved repl

## Describe the bug `nix repl` renders markdownlinks as normal text in yellow. … ## Steps To Reproduce Load a flake with documented attributes, and use `:doc` on it. ``` nix repl nixpkgs :doc lib ``` ## Expected behavior Render OSC 8 codes to make the link work. Alternatively, links could be rendered as a list of references at the end. ## Metadata ## Additional context ## Checklist - [x] checked [latest Nix manual] \([source]) - [x] checked [open bug issues and pull requests] for possible duplicates [latest Nix manual]: https://nixos.org/manual/nix/unstable/ [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source [open bug issues and pull requests]: https://github.com/NixOS/nix/labels/bug --- Add :+1: to [issues you find important](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc).

github.com/NixOS/nix

rsync should be required in nix-manual meson.build

opened 12:32PM - 02 Jun 25 UTC

VaiTon

good first issue idea approved

### Description of the problem When building the `nix-manual` meson subproject …a custom target is defined using a shell script that invokes rsync. Despite that, rsync is never required by meson and configuration still succeeds if no rsync is on the system. https://github.com/NixOS/nix/blob/86767349d5fc09326801db96fa427511862ddf54/doc/manual/meson.build#L87 ### Suggested solution Add a `find_program('rsync', required: true, native: true)` to the meson.build

github.com/NixOS/nix

Undesired git fetch of path flake inputs that point at git submodules

opened 05:34AM - 05 Jun 25 UTC

mightyiam

bug

It seems that path inputs that happen to point at git submodules trigger git fet…ching. And I don't think that's desirable. ``` $ git clone https://github.com/mightyiam/infra.git repro $ git checkout --detach 5a46333c95a9238f1e0b376acf196cb2b7b76f2e` ``` Notice a flake input `home-manager` that has a url `"path:./forks/home-manager"`. At that path is a git submodule. From `.gitmodules`: ``` [submodule "forks/home-manager"] path = forks/home-manager url = ./. ``` What I expect Nix to do is treat that home-manager input as a local path only. For example, if that path is empty (pre submodule init) I expect Nix to complain that there is no flake at that path. Instead, Nix seems to *find out* that at that path is a git submodule and further find out the url for it and attempt to fetch from there 🤒 ``` $ nix flake show warning: could not read HEAD ref from repo at '/home/mightyiam/worktrees/repro', using 'master' error: … while fetching the input 'git+file:///home/mightyiam/worktrees/repro?rev=5a46333c95a9238f1e0b376acf196cb2b7b76f2e&submodules=1' … while fetching the input 'git+https://github.com/mightyiam/infra.git/?rev=babb4fa136adac892d9b2a300573d914cc2b6baf&submodules=1' error: Cannot find Git revision 'babb4fa136adac892d9b2a300573d914cc2b6baf' in ref 'refs/heads/main' of repository 'https://github.com/mightyiam/infra.git/'! Please make sure that the rev exists on the ref you've specified or add allRefs = true; to fetchGit. ``` Should the attempt to fetch `git+https://github.com/mightyiam/infra.git/?rev=babb4fa136adac892d9b2a300573d914cc2b6baf&submodules=1` be considered desired behavior? ## Metadata nix-env (Nix) 2.28.3 nix-env (Nix) 2.29.0 ## Checklist - [ ] checked [latest Nix manual] \([source]) - [x] checked [open bug issues and pull requests] for possible duplicates [latest Nix manual]: https://nixos.org/manual/nix/unstable/ [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source [open bug issues and pull requests]: https://github.com/NixOS/nix/labels/bug --- Add :+1: to [issues you find important](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc).

github.com/NixOS/nix

`unexpected fragment in flake reference` error when trying to use a git branch with a `#` in the name as a flake input

opened 10:35AM - 05 Jun 25 UTC

nothingnesses

bug

## Describe the bug The `unexpected fragment in flake reference` error is displ…ayed when building a flake that has a git input with a `#` in the name. ## Steps To Reproduce 1. Clone [this repository](https://github.com/nothingnesses/flake-pound-issue). 2. In the newly cloned repository, run `nix build`. ## Expected behavior The project builds. ## Metadata `nix-env (Nix) 2.24.14` ## Additional context ## Checklist - [x] checked [latest Nix manual] \([source]) - [x] checked [open bug issues and pull requests] for possible duplicates [latest Nix manual]: https://nixos.org/manual/nix/unstable/ [source]: https://github.com/NixOS/nix/tree/master/doc/manual/source [open bug issues and pull requests]: https://github.com/NixOS/nix/labels/bug --- Add :+1: to [issues you find important](https://github.com/NixOS/nix/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc).