Bundling binary caches into flakes

I’m wondering about the possibility of specifying in a flake.nix file the location of a binary cache that will house the outputs of that flake. That way if someone uses nix build github:foo/bar#package it will automatically check that cache (without the user adding it).

Of course, there may be issues with this model that I’m not thinking of. I imagine there might be security concerns? If I’m evaluating a flake I have to already trust that flake, but I guess it would make auditing more difficult (I can’t just check the contents of the flake and the source code, I would have to check the cache, and I don’t know if that’s even possible without compiling the whole thing yourself anyways)

Thoughts? Is this already possible somehow?

It is possible but broken for multi-user installs (which makes it’s userfulness fairly limited for now). Here’s the relevant commit#comment.

1 Like

@nrdxp this time, you beat me to it. :wink:

Oh wow! Thanks, I was hoping it was there and I just hadn’t found it. Three follow-up questions:

  1. Is multi-user install any install that has more than one user, and conversely, this works if you only have one user? I’ve somehow gotten the sense that you can have a multi-user install even if you only have one user (and that I probably do)
  2. Do you have a sense of what priority this fix is? How soon I might expect it to work?
  3. Is there some documentation about how to use the feature? Like what I actually have to put in my flake.nix to get it to work? Can I just put
    outputs = { ... }: {
      nixConfig.substituters = [ ... ];
      packages = ...;
    }
    

A “multi-user” install is an installation of nix done with the --deamon flag to the installer.

If you use non-nixos and just copy pasted the suggested install command without further reading, then you have a single user, if you appendended --daemon you got multi-user.

If you are on nixos, you are multi-user.

Ahhh okay. I understand the distinction now. I’m on NixOS, so multi-user.

Any option listed in man nix.conf can be set under the nixConfig attribute. Since the feature is still a wip, I don’t think there are any docs, but it’s fairly straight forward. Your example above is correct. In terms of completing the feature for the nix daemon, I’m not sure what the upstream priority is, but I’ve personally been hoping it will be fixed soon, as this feature would be a major improvement to flakes ux, just for the substituter definitions alone.

Okay great. Glad I’m not alone. I’m working on something else at the moment, but when I finish that maybe I’ll look into getting involved. I’m on a roll with nix right now.

2 Likes

I’d add a little correction: it would be:

{
  nixConfig.<...> = "";
  inputs = { };
  outputs = { };
}

And currently only the options in line 641 ff of that commit are supported, that is:

bash-prompt # wired pick, I guess. :-)
substituters
extra-substituters

I tried the substituters once for divnix/devos and indeed it had to be reverted due to this issue: incomplete substituters file · Issue #98 · divnix/digga · GitHub it might be the thing @nrdxp is referring to above.

Ah, that’s exactly what I was wondering. Thanks @blaggacao.

You’re welcome, if by chance, you’re jumping the hoops of the flake-based NixOS space, make sure to give devos and flake-utils-plus a spin. :wink:

Is it still broken for multi-user installs? I noticed Nix reports missing/corrupted NAR hashes when I have substituters set, but works fine when it’s not present.

The FIXME is still in the code last time I checked, so it just might be. I’ve gotten conflicting reports from people saying it works, but others who say it doesn’t. I haven’t really tested it thoroughly to know for myself just yet, but perhaps if you use the very latest nixUnstable version it will work?

I’m using the latest nixUnstable in Nixpkgs, 2.4pre20210707_02dd6bb. It’s still broken.

Update: it’s fixed in Make the flake options work when using the daemon by thufschmitt · Pull Request #5504 · NixOS/nix · GitHub

1 Like