macOS 15 Sequoia update clobbers _nixbld1-4 users

abathur · September 16, 2024, 3:29pm

Apple released macOS 15 Sequoia today–and beta users previously reported that this update breaks existing Nix installs by clobbering _nixbld1-4 (because macOS now includes system daemons that use the same UIDs).

On existing installs, this should manifest as an error when you run some Nix commands:

error: the user '_nixbld1' in the group 'nixbld' does not exist

We have a migration script to fix existing installs (before or after updating):

curl --proto '=https' --tlsv1.2 -sSf -L https://github.com/NixOS/nix/raw/master/scripts/sequoia-nixbld-user-migration.sh | bash -

I’m also keeping the first comment in the issue below up to date as a linkable resource:

github.com/NixOS/nix

macOS 15 Sequoia clobbers _nixbld1-4 users

opened 07:47PM - 11 Jun 24 UTC

abathur

installer macos

> ## **Note**: I keep this first comment up-to-date. It includes fixes. You do n…ot have to read the thread unless you are having trouble with its suggestions! The macOS 15 Sequoia update takes 4 UIDs in the range we've been using, clobbering any _nixbldN users in the way (typically _nixbld1-4). This manifests as: - On existing installs, build errors like: `error: the user '_nixbld1' in the group 'nixbld' does not exist` To fix this, run our migration script (which relocates/replaces _nixbld users) _before or after_ taking the macOS 15 Sequoia update: ``` curl --proto '=https' --tlsv1.2 -sSf -L https://github.com/NixOS/nix/raw/master/scripts/sequoia-nixbld-user-migration.sh | bash - ``` > *Caution*: If you installed Nix with a third-party installer, you should check with them for additional/different instructions. - On fresh installs (with unpatched installer versions), the following error creating user `_nixbld1`: ``` <main> attribute status: eDSRecordAlreadyExists <dscl_cmd> DS Error: -14135 (eDSRecordAlreadyExists) ``` While the 2.24.6+ installers are fixed, older installers don't all work at the moment. (The installer fixes for this _have_ been backported for every release back to the 2.18 series--but these aren't all quite released yet.) If you're trying to install versions from 2.20.0 and 2.24.5, you can explicitly override the starting UID: ``` NIX_FIRST_BUILD_UID="351" sh <(curl -L <whatever release-specific installer URL you need>) ``` If you run into this error with versions older than 2.18, you'll need to download the installer tarball for your platform, unpack it, and update the first UID in `install-darwin-multi-user.sh` to 351. <details><summary>More background/context on the issue</summary> Edit: As the macOS release is near, I'm tucking context away to focus the first comment on how users can fix broken installs. Reports are percolating about the upcoming macOS Sequoia 15 (from people trying the beta out) using 4 UIDs in the range we've been using: - https://github.com/NixOS/nix/issues/6153#issuecomment-2159403590 - https://github.com/NixOS/nix/issues/6153#issuecomment-2161284555 - https://mastodon.social/@ryanbooker/112597391954278800 History on our previous change and ID range selection is in: - #4532 - #4531 PRs to address: - installer fix: #10919 - migration script to fix existing installs w/o reinstalling: #11075 </details>

hexa · September 17, 2024, 1:41pm

Eveeifyeve · September 18, 2024, 11:20am

An update has been put out that tries to fix the solution for existing nix you should now get a warning in nix when you update saying you need to migrate. But yet it’s not yet fixed in nix install: Installing on MacOS fails when user UID is already in use · Issue #2242 · NixOS/nix · GitHub

ZeroDeth · September 21, 2024, 10:33am

My solution: curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix/tag/v0.26.0 | sh -s -- repair sequoia --move-existing-users

jjpe · September 21, 2024, 10:44am

That only works if one is willing to use the installer from determinate systems, which not everyone is.

hasrthur · September 22, 2024, 4:40pm

It worked for my existing installation

niklaskorz · September 25, 2024, 12:57pm

The repair tool works for any Nix installation afaik. You can also use the repair tool provided by Lix, which too is compatible with the current official Nix installer:

curl -sSf -L https://install.lix.systems/lix | sh -s -- repair sequoia

abathur · September 25, 2024, 3:18pm

For anyone following along, the ~official command picks up the migration script directly from the master branch of the Nix repo so that people get ongoing bugfixes to the migration procedure (if any are necessary) as soon as they’re merged.

It’s also fine to run the repair command implemented in the DetSys installer and/or Lix’s fork of the DetSys installer if you prefer (these roughly follow what we’ve learned about the problem in upstream Nix), though I don’t recommend using a command that hardcodes a version since it may lack future fixes (if any are necessary).