Microslop Github might start tightening the noose it has around opensource and once authentication isn’t enough to stop the slop bots they have unleashed on us, paying for access could (maybe?) realiastically be the only way way forward. Docker Hub did it, maybe this is next.
Maybe it’s too early to ring the alarm bells, but maybe, just maybe, we should start thinking of a strategy?
Isn’t this something they’ve been doing for many years? I remember having problems with it at ZuriHac before the pandemic.
I don’t disagree with your broader point, but it’s not obvious what actually changed here. Tighter limits, just the error code changing, or something else?
IIRC NixOS org have enterprise contract with GitHub, maybe admin can request gh to allowlist build machine IP addresses to have a higher rate limit without authentication?
If NixOS ever needed a few blocks of IPs I’d be happy to lend them out for free ofc
For reasons like these, I’ve moved all my Nix projects away from GitHub into Codeberg, and I would invite others to do the same ( https://codeberg.org/viperML )
This isn’t about the Nix Hydra builders, but about end users. Everybody still needs a copy of Nixpkgs, and potentially many more flake inputs. fetchGitHub already uses the API, and updating a flake can prove impossible behind CGNAT. GitHub allows 60 API requests from a single public IPv4 address (they don’t support IPv6 at all); a rate limit which is easily hit behind NAT when updating multiple machines.
I personally am very much in favor of Nix moving its Git infrastructure to a separate Forgejo instance, maybe even providing semi-public signups for adjacent projects (mainly nix-community).
Unauthenticated… So just authenticate. access-tokens is a thing.
Alternatively, use the channel URL as the flake input. nixpkgs.url = "https://nixos.org/channels/nixpkgs-unstable" works for any modern nix (modern means not older than about 18 months!)
Nixpkgs consumption doesn’t depend on Github though. The tarballs can be fetched from channels.nixos.org. I’m aware the Github tarballs are the most common source for flake users, but they probably shouldn’t be (and I personally have replaced them with the zstd tarballs provided by nixos.org in all of my system configs).
I have pinned multipled nixpkgs versions because there is some software on there that I do not want updated (probably there are others too). Does channels.nixos.org keep every commit of nixpkgs?
