This is amazing news!
It would be great to have more detailed instructions how to do it. Right now it’s like a quiz without a way to see if you have the correct answer.
This is what i did:
Before anything, make sure that you have a recent-enough Nix
using nixUnstable
from a nixos-unstable
nix.package = pkgs.nixUnstable;
Level 0 — Remote adventurer : Try using some CA closures in a sandbox:
[davidak@gaming:~]$ nix shell \
> --experimental-features 'ca-references nix-command' \
> --store /tmp/my-ca-nix \
> --trusted-public-keys '' \
> --substituters https://cache.ngi0.nixos.org/ \
> /nix/store/yvk5yl9fid0zlxqk1xvvzn787d8gbh00-emacs-27.2 \
> -c emacs --version
GNU Emacs 27.2
Copyright (C) 2021 Free Software Foundation, Inc.
GNU Emacs comes with ABSOLUTELY NO WARRANTY.
You may redistribute copies of GNU Emacs
under the terms of the GNU General Public License.
For more information about these matters, see the file named COPYING.
It starts. How do i see that it’s actually content-addressed?
[davidak@gaming:~]$ nix store verify \
> --experimental-features nix-command \
> --store /tmp/my-ca-nix \
> --sigs-needed 10000 \
> /nix/store/yvk5yl9fid0zlxqk1xvvzn787d8gbh00-emacs-27.2
See that content-addressed paths don’t need signatures, because they are self-authenticating!
How do i see that here? I get no output.
Level 1 — Visitor of the garden : Add the ca-derivations
and ca-references
experimental Nix features to your /etc/nix/nix.conf
.
I did it like this:
nix.extraOptions = ''
experimental-features = nix-command ca-derivations ca-references
'';
I did a system rebuild, the nix daemon was restarted. Nothing else happened. I didn’t test anything else here.
Level 2 — Explorer of the world : Mark some individual derivations as “content addressed”.
I naively added __contentAddressed
to the hello package and build it. The output hash was different. I guess this is correct.
https://github.com/davidak/nixpkgs/commit/f35e1ad15ec5b3ce0997321df401b96bb853d56c
[davidak@gaming:~/code/nixpkgs]$ nix build -f . hello
[davidak@gaming:~/code/nixpkgs]$ ll result
lrwxrwxrwx 1 davidak users 54 May 20 16:35 result -> /nix/store/fx0d44m03659dw46ch99aln9c3fsliaj-hello-2.10
How can i see if it works as content-addressed? That the build does not throw an error?
Level 3 — Raider of the unknown : Switch to a fully content-addressed system.
My configuration.nix
now has this added lines:
nix.package = pkgs.nixUnstable;
nixpkgs.config.contentAddressedByDefault = true;
nix.extraOptions = ''
experimental-features = nix-command ca-derivations ca-references
substituters = https://cache.ngi0.nixos.org/
trusted-public-keys = cache.ngi0.nixos.org-1:KqH5CBLNSyX184S9BKZJo1LxrxJ9ltnY2uAs5c/f1MA=
'';
I’m rebuilding the system now from latest unstable.
I guess lines like these mean that the content-addressing works.
warning: rewriting hashes in '/nix/store/yq3birl9c5plpa3vgkmrwmz7vx0kbb29-libxslt-1.1.34.drv.chroot/nix/store/3ag9sb8s65x9070pdzapbjr85cl1jr4k-libxslt-1.1.34-py'; cross fingers
...
Resolved derivation: '/nix/store/qqja4mcv2n6s9mrl379ds2f3jvr665sa-extra-hosts.drv' -> '/nix/store/hjanz73r8m9sd3qmwd3w9zpgd3z1x3gn-extra-hosts.drv'...
Resolved derivation: '/nix/store/jjvlwr36rcddlhdklznc4fbiblam4qav-fix-paths.patch.drv' -> '/nix/store/yx7c7vi1f80zkppzdqvycpirxx625187-fix-paths.patch.drv'...
Resolved derivation: '/nix/store/ag5zb08r5zns32d190dh4mnnpf26s6sw-fuse-3.10.3.drv' -> '/nix/store/zyiapkl5p15dkndzb1ggngsb649qx4i2-fuse-3.10.3.drv'...