Devenv.sh, python and cachix questions

[banderlog]

Hi, I must state that I am new to the NixOS. Currently I am using 26.05 channel.

Recently I watched some videos and read some articles on devenv, how cool that is for Python development on NixOS. So I tried it myself, via nix shell nixpkgs#devenv

And what I’ve seen — 1/2 of keywords does not work at all, like I was unable to just set the Python version via languages.python.version = “3.12“ on devenv.nix or call it directly with devenv shell --option language.python.version:string “3.12”

I’ve got the same error:
Failed to get attribute 'config.cachix.enable' from devenv configuration: warning: ignoring the client-specified setting 'system', because it is a restricted setting and you are not a trusted user

I’ve googled and found cachix.enable = false;, which did not work for me — same error.

The only workaround I found is using standard syntax:

  languages.python = {
    enable = true;
    # package = pkgs.python314;  # work but you will not be able to reuse `package`
    # WORKS: versioning AND packages
    package = pkgs.python314.withPackages (ps: [
      ps.numpy
    ]);
  };

As far as I am able to understand, the only way to use devenv now is to add my USER to the trusted group, basically giving root privileges to it in the Nix context, or to add cachix binaries in some Nix config as trusted.

Both options make me concerned with security. This thing basically wants to use root access to get and run some binaries from God knows where.

The official repo is under the NixOS Security Team and general community. Who looks after cachix?

Cachix is a profit organization. Are there any guarantees that it will not close behind a paywall the whole devenv thing?

Is there a way to run devenv without a trusted user or adding a cachix repo and still be able to get all features from it?

[TLATER]

Can you share your full code? I suspect you just need to remove the characters config. from somewhere.

@banderlog

Both options make me concerned with security. This thing basically wants to use root access to get and run some binaries from God knows where.

Not exactly. Cachix is a substituter and nix’ substitution inherently means trusting the given cache not to lie about the binary contents it has.

Yes, this means that if cachix decided to serve viruses instead of the actual binaries you’re expecting, and you used your flake with a trusted user, that would be very bad.

It’s not strictly expecting root permissions, though.

---

That said, this warning:

@banderlog

warning: ignoring the client-specified setting ‘system’, because it is a restricted setting and you are not a trusted user

Is completely unrelated to the error:

@banderlog

Failed to get attribute ‘config.cachix.enable’ from devenv configuration

You can add a substituter to your config and not use it, and use devenv just fine without the cachix substituter.

You just have a configuration mistake somewhere, the warning about substitution is a red herring.

@banderlog

Who looks after cachix?

A fairly well-trusted community member. You need to make the call whether you trust them personally.

I don’t think there’s a real reason to consider them less trustworthy than the security team, though.

[banderlog]

@TLATER

Can you share your full code? I suspect you just need to remove the characters config. from somewhere.

Sure:

# minimal devenv.nix (not working)
{ pkgs, lib, config, inputs, ... }:

{
  cachix.enable = false;
  languages.python = {
    enable = true;
    version = "3.12"; 
}

# the whole "test" devenv.nix
{ pkgs, lib, config, inputs, ... }:
{
  cachix.enable = false;
  languages.python = {
    enable = true;

    # version = "3.12";  # DOES NOT WORK

    # DOES NOT work
    # devenv shell --option language.python.version:string "3.13"
    # package = pkgs.python314;  # work but you will not be able to reuse `package`

    # WORKS: versioning AND packages
    package = pkgs.python314.withPackages (ps: [
      ps.numpy
    ]);
  };

  # https://devenv.sh/packages/
  # packages = [pkgs.python314Packages.numpy];  # works but have no sense

  # packages = [pkgs.cowsay pkgs.lolcat];  # works

  # DOES NOT work
  # foo = [pkgs.cowsay];
  # packages = foo ++ [pkgs.lolcat];

  # with below run as devenv shell --option packages:pkgs "lolcat"
  # you will see both packages
  #packages = [pkgs.cowsay];  # works

  # PROFILES ALSO DOES NOT WORK
}

[TLATER]

Right, your syntax is wrong, so you’re running into this issue.

Use this minimal example:

# minimal devenv.nix (should work)
{ pkgs, lib, config, inputs, ... }:

{
  cachix.enable = false;
  languages.python = {
    enable = true;
    version = "3.12"; 
  };
}

[banderlog]

Alas, it is not just my typo:

mkdir XXX                                                                                                                                                                                                                                                                                                                                                                
cd XXX

# copypaste above example                                                                                                                                                              
vim devenv.nix                                                                                                                                                         
                                                                                                                                                                                                 nix shell nixpkgs#devenv                                                                                                                                               

# select NO on rewrite                                                                                                                                                                                                 
devenv init   

devenv shell

Output:

$ devenv shell
  │ evaluating file '<nix/fetchurl.nix>'
  │ evaluating file '<nix/fetchurl.nix>'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/by-name/li/libssh2/package.nix'
  │ evaluating file '<nix/fetchurl.nix>'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/by-name/kr/krb5/package.nix'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/by-name/ke/keyutils/package.nix'
  │ evaluating file '<nix/fetchurl.nix>'
  │ evaluating file '<nix/fetchurl.nix>'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/by-name/by/byacc/package.nix'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/build-support/pkg-config-wrapper/default.nix'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/by-name/pk/pkg-config-unwrapped/package.nix'
  │ evaluating file '<nix/fetchurl.nix>'
  │ evaluating file '<nix/fetchurl.nix>'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/build-support/replace-vars/replace-vars.nix'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/build-support/replace-vars/replace-vars-with.nix'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/by-name/ex/expand-response-params/package.nix'
  │ evaluating file '<nix/fetchurl.nix>'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/by-name/ng/nghttp2/package.nix'
  │ evaluating file '<nix/fetchurl.nix>'
  │ evaluating file '<nix/fetchurl.nix>'

 1 of 1 downloads                                                                                                                                                                    ↑↓ navigate
✓ Configuring shell                                                                                                                                                                         1.2s
  └ ✗ Evaluating shell 1220 files                                                                                                                                                           1.2s
  │ evaluating file '<nix/fetchurl.nix>'
  │ evaluating file '<nix/fetchurl.nix>'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/by-name/li/libssh2/package.nix'
  │ evaluating file '<nix/fetchurl.nix>'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/by-name/kr/krb5/package.nix'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/by-name/ke/keyutils/package.nix'
  │ evaluating file '<nix/fetchurl.nix>'
  │ evaluating file '<nix/fetchurl.nix>'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/by-name/by/byacc/package.nix'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/build-support/pkg-config-wrapper/default.nix'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/by-name/pk/pkg-config-unwrapped/package.nix'
  │ evaluating file '<nix/fetchurl.nix>'
  │ evaluating file '<nix/fetchurl.nix>'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/build-support/replace-vars/replace-vars.nix'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/build-support/replace-vars/replace-vars-with.nix'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/by-name/ex/expand-response-params/package.nix'
  │ evaluating file '<nix/fetchurl.nix>'
  │ evaluating file '/nix/store/klzydr6a4fwr1vbg734dppjg8cy9hgy9-source/pkgs/by-name/ng/nghttp2/package.nix'
  │ evaluating file '<nix/fetchurl.nix>'
  │ evaluating file '<nix/fetchurl.nix>'
  × Failed to get drvPath from shell derivation: warning: ignoring the client-specified setting 'system', because it is a restricted setting and you are not a trusted user

If I just comment out version, like this:

# minimal devenv.nix (should work)
{ pkgs, lib, config, inputs, ... }:

{
  cachix.enable = false;
  languages.python = {
    enable = true;
    # version = "3.12"; 
  };
}

It works, but still go to cachix, as far as I can see:

]$ devenv shell
✓ Validating lock                                                                          16ms
✓ Configuring shell                                                                        5.4s
  └ ✓ Evaluating shell 1626 files                                                          5.3s
    └ ✓ Building  python3-3.13.12-env 2 lines                                              2.3s
    └ ✓ Building  devenv-profile 2 lines                                                   89ms
    └ ✓ Building  devenv-shell 1 lines                                                     87ms
    └ ✓ Querying  devenv-shell-env from cache.nixos.org                                   184ms
    └ ✓ Building  devenv-shell-env                                                        191ms
✓ Evaluating bash                                                                           1ms
✓ Loading tasks                                                                             2ms
  └ ✓ Evaluating devenv.config.task.config                                                  2ms
✓ Running tasks                                                                            10ms
  └ ✓ devenv:enterShell                                                                     6ms
    └ ✓ devenv:files:cleanup                                                                0ms
  └ ✓ devenv:enterTest skipped                                                              0ms

[banderlog]

I ran devenv shell --nix-debugger and it provided me with some meaningful error:

error: To use 'languages.python.version', run the following command:

         $ devenv inputs add nixpkgs-python github:cachix/nixpkgs-python --follows nixpkgs

I followed instruction, it added strings to devenv.yaml:

  nixpkgs-python:
    url: github:cachix/nixpkgs-python
    inputs:
      nixpkgs:
        follows: nixpkgs

Now devenv shell works, but it builds python from source

Is there a way to read building logs via nix log at this moment?

UPD: it built successfully
UPD: it builds python even with cachix.enable = true;

[banderlog]

@banderlog

Is there a way to read building logs via nix log at this moment?

Yes, use arrow key DOWN few times

[banderlog]

OK, this shit is very wierd

That part is x100 faster than just “pure devenv” with or without cachix

    package = pkgs.python314.withPackages (ps: [
      ps.numpy
    ]);

[banderlog]

If you are python dev and reading this: just use buildFHSEnv

In that way you will have your old venv way of managing things

Fix-python: make Python "just run" on NixOS

didn’t mean to impose “my way” in any manner, sorry. I’ve myself started using nixos relatively recently and tried out some different ways of making python development environments. When I finally discovered buildFHSEnv - it just felt like one of those “aha!” moments. It solved 2 problems straight away: using python “the usual venv way”, and isolating dev env from the rest of the system, since buildFHSEnv uses bwrap, so you can straight away unshare pid, mount and other namespaces, and bind ne…

it is also recommended by Python - Official NixOS Wiki way

[banderlog]

Examples without devenv

# good old venv
# no CXX packages
python -m venv venv --copies

# shell with python CXX packages
{pkgs ? import <nixpkgs> {}}:
pkgs.mkShell {
  packages = [
    (pkgs.python3.withPackages (python-pkgs: with python-pkgs; [
        numpy
        pandas
        matplotlib
     ]))
    ];

  shellHook = ''
    echo "Python environment activated!"
    export PS1="\[\e[1;34m\](python-shell) \w \$\[\e[0m\] "
  '';

}

# buildFHSEnv
{ pkgs ? import <nixpkgs> {} }:

(pkgs.buildFHSEnv {
  name = "python-fhs-env";

  targetPkgs = pkgs: with pkgs; [
    # Core python interpreter
    python3
    python3Packages.pip
    python3Packages.virtualenv

    # System libraries required by numpy and other wheels
    glibc
    zlib
    stdenv.cc.cc.lib
    gccNGPackages_15.libgfortran
    libffi
    openssl
  ];

  profile = ''
    echo -e "\n\nPython FHS activated!\n"
    export PROMPT='\e[34mpython-fhs-env: \w \$ \e[0m'
  '';

  runScript = ''bash --rcfile <(echo "PS1='$PROMPT'") -i '';
}).env

[sandydoo]

devenv dev here! We’re aware of a bug where evaluation errors are not being shown correctly in certain situations.
This is a very frustrating type of bug for users to run into. It’s getting fixed in the next release, with additional tests to catch regressions in error messages.

Is there a way to run devenv without a trusted user or adding a cachix repo and still be able to get all features from it?

Yes, of course. The incomplete error generated by Nix here makes it sound like this is a requirement. It is not.

Both options make me concerned with security. This thing basically wants to use root access to get and run some binaries from God knows where.

devenv will always tell you which caches it adds to the project. They can be configured and disabled.
trusted-users is just one way to allow devenv to auto-configure caches per project. It’s optional.

Now devenv shell works, but it builds python from source

Different nixpkgs follows produce different hashes, leading to rebuilds. We need to adjust the recommendation to not include the follows.

Cachix is a profit organization. Are there any guarantees that it will not close behind a paywall the whole devenv thing?

devenv is open-source. Like any healthy project, we’d like to see it eventually support itself financially. We’d prefer to accomplish that by offering compelling—and entirely optional—hosted services, like a devenv-native CI.