Re: [Nix-dev] Bash CVE-2014-6271

2014-09-28 Thread roconnor
After studying pkgs/build-support/replace-dependency.nix I'm prepraring a preliminary patch for it that should make the computation a zillion times faster. The dry-run thing not being a dry run is still a bit of a mystery to me, but replace-dependency.nix does do things that are a little

Re: [Nix-dev] Bash CVE-2014-6271

2014-09-28 Thread Vladimír Čunát
On 09/25/2014 03:41 PM, Ricardo M. Correia wrote: Also, I'm not sure if this is expected, but when I first tried to run nixos-rebuild dry-run with this workaround applied, it started to download and compile bash even though the man page of nixos-rebuild specifically says: [...] IIRC there are

[Nix-dev] nix proposal for security fixes

2014-09-28 Thread Lluís Batlle i Rossell
Hello! It could be nice if we had a nix derivation attribute that allowed the determination of a store path, overriding the hash mechanisms for it. Imagine that we have a bash to fix; we could add a line in the bash derivation attribute set: forceOut = whatever store path out It'd be nice

Re: [Nix-dev] Grub2 install error on latest unstable channel

2014-09-28 Thread Bjørn Forsman
Hi, After some online searching I found the cause to this: $ sudo nixos-rebuild switch -I nixpkgs=. [...] installing the GRUB 2 boot loader on /dev/disk/by-label/240gb... Installing for i386-pc platform. /nix/store/3aj2bp2d9vxy2hrmh9q69n5ydxh9gzd3-grub-2.02-git-1de3a4/sbin/grub-install: warning:

Re: [Nix-dev] Grub2 install error on latest unstable channel

2014-09-28 Thread Bjørn Forsman
On 28 September 2014 13:44, Bjørn Forsman bjorn.fors...@gmail.com wrote: [...] For the last 1-2 years I've had boot.loader.grub.device = /dev/disk/by-label/240gb in my configuration.nix. ...but I probably never installed grub with that setting! A comment from install-grub.pl: FIXME: shouldn't

Re: [Nix-dev] nix proposal for security fixes

2014-09-28 Thread Lluís Batlle i Rossell
My 'forceOut' clearly will not work as easy as setting it in a stdenv.mkDerivation argument, because there may be multiple calls to mkDerivation for the same derivation name (with different inputs). The table of correspondences in nix.conf still looks good to me though. It'd be nice if there

Re: [Nix-dev] Grub2 install error on latest unstable channel

2014-09-28 Thread Vladimír Čunát
Hi. On 09/28/2014 01:59 PM, Bjørn Forsman wrote: On 28 September 2014 13:44, Bjørn Forsman bjorn.fors...@gmail.com wrote: [...] For the last 1-2 years I've had boot.loader.grub.device = /dev/disk/by-label/240gb in my configuration.nix. ...but I probably never installed grub with that

Re: [Nix-dev] Grub2 install error on latest unstable channel

2014-09-28 Thread Wout Mertens
On Sep 28, 2014 3:20 PM, Vladimír Čunát vcu...@gmail.com wrote: Hi. On 09/28/2014 01:59 PM, Bjørn Forsman wrote: On 28 September 2014 13:44, Bjørn Forsman bjorn.fors...@gmail.com wrote: [...] For the last 1-2 years I've had boot.loader.grub.device = /dev/disk/by-label/240gb in my

Re: [Nix-dev] Grub2 install error on latest unstable channel

2014-09-28 Thread Bjørn Forsman
On 28 September 2014 17:19, Wout Mertens wout.mert...@gmail.com wrote: ... But it would be cool to be able to say install on the boot sector/record of the disk containing the partition x My thoughts exactly: https://github.com/NixOS/nixpkgs/pull/4310

[Nix-dev] Announcing nix-exec

2014-09-28 Thread Shea Levy
Hi all, I've just added [1] nix-exec to nixpkgs. It provides a way to define and execute programs written in nix, for programs that need to interact with the nix store or expression language. Please see the home page [2] for more details. Please note that this was a quick project, and that there

Re: [Nix-dev] Bash CVE-2014-6271

2014-09-28 Thread roconnor
I've sent out PR#4313 to address the slowness issue: https://github.com/NixOS/nixpkgs/pull/4313 On Sun, 28 Sep 2014, rocon...@theorem.ca wrote: After studying pkgs/build-support/replace-dependency.nix I'm prepraring a preliminary patch for it that should make the computation a zillion times

Re: [Nix-dev] nix proposal for security fixes

2014-09-28 Thread roconnor
We already have shlevy's replaceDependency which, IMHO, solves this problem. In functional programming when we have an immutable tree structure that we want to update, we trace a path from the root of the tree to the node that we want to update and we update all the nodes along that path to

Re: [Nix-dev] Bash CVE-2014-6271

2014-09-28 Thread Ricardo M. Correia
On Sun, Sep 28, 2014 at 10:19 AM, Vladimír Čunát vcu...@gmail.com wrote: On 09/25/2014 03:41 PM, Ricardo M. Correia wrote: Also, I'm not sure if this is expected, but when I first tried to run nixos-rebuild dry-run with this workaround applied, it started to download and compile bash even

Re: [Nix-dev] nix proposal for security fixes

2014-09-28 Thread Shea Levy
Yes, this is exactly what replaceDependency is for. On Sun, Sep 28, 2014 at 02:58:03PM -0700, rocon...@theorem.ca wrote: We already have shlevy's replaceDependency which, IMHO, solves this problem. In functional programming when we have an immutable tree structure that we want to update, we

Re: [Nix-dev] Bash CVE-2014-6271

2014-09-28 Thread Shea Levy
The dry-run thing is likely due to replaceDependency doing an import from a derivation, which requires building at evaluation time. There's not really a good way to work around that, unfortunately. ~Shea On Mon, Sep 29, 2014 at 12:52:10AM +0200, Ricardo M. Correia wrote: On Sun, Sep 28, 2014 at

Re: [Nix-dev] Bash CVE-2014-6271

2014-09-28 Thread Ricardo M. Correia
Shea: I wasn't even using replaceDependency... and dry-run started compiling/downloading anyway, like if I had done a switch. Isn't this happening to anyone else who is using a recent commit from the unstable/master channel? On Mon, Sep 29, 2014 at 2:12 AM, Shea Levy s...@shealevy.com wrote: