Security fixes should bypass staging — unbound CVE batch as a case study

Development Nixpkgs Architecture
11

I believe we can improve some things, though. A few relevant points:

  1. unbound in particular. I suspect that if we removed it from gnutls (default) build inputs, we would significantly reduce the amount of rebuilds which it’s causing. There it’s only used for ${gnutls.out}/lib/libgnutls-dane.so* which I suspect to be very niche (would be nice to really confirm) so we could avoid building it in the default version (and e.g. provide a gnutls-dane derivation instead).

  2. x86_64-darwin is being dropped since 26.11 (current unstable/master/staging-next). That will decrease the load on the infra.

  3. in infra chat we recently seem to have a consensus that we wouldn’t build nixosTests anymore. Of course we’d keep those which are chosen to be channel blockers, and perhaps there would be some other aspect to compromise, but currently the costs/benefits of building all of them all the time doesn’t seem favorable. (they take a large fraction of total Hydra’s time)

9 Likes