nixpkgs/pkgs/stdenv/generic/check-meta.nix

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

493 lines
18 KiB
Nix
Raw Normal View History

stdenv: perform checks only when evaluating .drv and .out This pushes check-meta evaluation to derivation evaluation step, leaving all other attributes accessible. Before this commit: > $ HOME=/homeless-shelter NIX_PATH=nixpkgs=$(pwd) nix-instantiate --eval --strict ./default.nix -A xen --argstr system aarch64-linux > Package ‘xen-4.5.5’ in pkgs/applications/virtualization/xen/generic.nix:226 is not supported on ‘aarch64-linux’, refusing to evaluate. as expected > $ HOME=/homeless-shelter NIX_PATH=nixpkgs=$(pwd) nix-instantiate --eval --strict ./default.nix -A xen.name --argstr system aarch64-linux > Package ‘xen-4.5.5’ in pkgs/applications/virtualization/xen/generic.nix:226 is not supported on ‘aarch64-linux’, refusing to evaluate. > $ HOME=/homeless-shelter NIX_PATH=nixpkgs=$(pwd) nix-instantiate --eval --strict ./default.nix -A xen.meta.description --argstr system aarch64-linux > Package ‘xen-4.5.5’ in pkgs/applications/virtualization/xen/generic.nix:226 is not supported on ‘aarch64-linux’, refusing to evaluate. which is unfortunate since its impossible to use packages in autogenerated documentation on all platforms. After this commit: > $ HOME=/homeless-shelter NIX_PATH=nixpkgs=$(pwd) nix-instantiate --eval --strict ./default.nix -A xen --argstr system aarch64-linux still fails > $ HOME=/homeless-shelter NIX_PATH=nixpkgs=$(pwd) nix-instantiate --eval --strict ./default.nix -A xen.name --argstr system aarch64-linux > "xen-4.5.5" > $ HOME=/homeless-shelter NIX_PATH=nixpkgs=$(pwd) nix-instantiate --eval --strict ./default.nix -A xen.meta.description --argstr system aarch64-linux > "Xen hypervisor and related components (vanilla)"
2017-12-25 17:38:45 +00:00
# Checks derivation meta and attrs for problems (like brokenness,
# licenses, etc).
check-env: don't execute check-meta.nix 15,000 times Generated from https://github.com/NixOS/nix/pull/2761: ``` ns calls ns/call - /home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:22:5 591200 15026 39.3451 + /home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:22:5 8744 308 28.3896 ``` more, generated by: ``` $ NIX_SHOW_STATS=1 NIX_COUNT_CALLS=1 nix-instantiate ./pkgs/top-level/release.nix -A unstable > before 2>&1 $ jq -r '.functions | map((.name + ":" + .file + ":" + (.line|tostring) + ":" + (.column|tostring) + " " + (.count|tostring))) | .[]' before | sort > before.list ``` applying this patch, then: ``` $ NIX_SHOW_STATS=1 NIX_COUNT_CALLS=1 nix-instantiate ./pkgs/top-level/release.nix -A unstable > after 2>&1 $ jq -r '.functions | map((.name + ":" + .file + ":" + (.line|tostring) + ":" + (.column|tostring) + " " + (.count|tostring))) | .[]' after | sort > after.list ``` and then diffing before.list and after.list to get: ``` calls - :/home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:4:1 7513 + :/home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:4:1 154 - mutuallyExclusive:/home/grahamc/projects/github.com/NixOS/nixpkgs/lib/lists.nix:658:23 7513 + mutuallyExclusive:/home/grahamc/projects/github.com/NixOS/nixpkgs/lib/lists.nix:658:23 154 - mutuallyExclusive:/home/grahamc/projects/github.com/NixOS/nixpkgs/lib/lists.nix:658:26 7513 + mutuallyExclusive:/home/grahamc/projects/github.com/NixOS/nixpkgs/lib/lists.nix:658:26 154 - onlyLicenses:/home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:21:18 15026 + onlyLicenses:/home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:21:18 308 ``` The following information is from `NIX_SHOW_STATS=1 GC_INITIAL_HEAP_SIZE=4g nix-env -f ./outpaths.nix -qaP --no-name --out-path --arg checkMeta true`: | stat | before | after | Δ | Δ% | |:---------------------------|---------------:|---------------:|:----------------|--------:| | **cpuTime** | 179.915 | 145.543 | 🡖 34.372 | -19.10% | | **envs-bytes** | 3,900,878,824 | 3,599,483,208 | 🡖 301,395,616 | -7.73% | | **envs-elements** | 214,426,071 | 185,881,709 | 🡖 28,544,362 | -13.31% | | **envs-number** | 136,591,891 | 132,026,846 | 🡖 4,565,045 | -3.34% | | **gc-heapSize** | 11,400,048,640 | 12,314,890,240 | 🡕 914,841,600 | 8.02% | | **gc-totalBytes** | 25,976,902,560 | 24,510,740,176 | 🡖 1,466,162,384 | -5.64% | | **list-bytes** | 1,665,290,080 | 1,665,290,080 | 0 | | | **list-concats** | 7,264,417 | 7,264,417 | 0 | | | **list-elements** | 208,161,260 | 208,161,260 | 0 | | | **nrAvoided** | 191,359,386 | 179,693,661 | 🡖 11,665,725 | -6.10% | | **nrFunctionCalls** | 119,665,062 | 116,348,547 | 🡖 3,316,515 | -2.77% | | **nrLookups** | 80,996,257 | 76,069,825 | 🡖 4,926,432 | -6.08% | | **nrOpUpdateValuesCopied** | 213,930,649 | 213,930,649 | 0 | | | **nrOpUpdates** | 12,025,937 | 12,025,937 | 0 | | | **nrPrimOpCalls** | 88,105,604 | 86,451,598 | 🡖 1,654,006 | -1.88% | | **nrThunks** | 196,842,044 | 175,126,701 | 🡖 21,715,343 | -11.03% | | **sets-bytes** | 7,678,425,776 | 7,285,767,928 | 🡖 392,657,848 | -5.11% | | **sets-elements** | 310,241,340 | 294,373,227 | 🡖 15,868,113 | -5.11% | | **sets-number** | 29,079,202 | 27,601,310 | 🡖 1,477,892 | -5.08% | | **sizes-Attr** | 24 | 24 | 0 | | | **sizes-Bindings** | 8 | 8 | 0 | | | **sizes-Env** | 16 | 16 | 0 | | | **sizes-Value** | 24 | 24 | 0 | | | **symbols-bytes** | 16,474,666 | 16,474,676 | 🡕 10 | 0.00% | | **symbols-number** | 376,426 | 376,427 | 🡕 1 | 0.00% | | **values-bytes** | 6,856,506,288 | 6,316,585,560 | 🡖 539,920,728 | -7.87% | | **values-number** | 285,687,762 | 263,191,065 | 🡖 22,496,697 | -7.87% | The following information is from `NIX_SHOW_STATS=1 GC_INITIAL_HEAP_SIZE=4g nix-instantiate ./nixos/release-combined.nix -A tested`: | stat | before | after | Δ | Δ% | |:---------------------------|---------------:|---------------:|:----------------|-------:| | **cpuTime** | 256.071 | 237.531 | 🡖 18.54 | -7.24% | | **envs-bytes** | 7,111,004,192 | 7,041,478,520 | 🡖 69,525,672 | -0.98% | | **envs-elements** | 346,236,940 | 339,588,487 | 🡖 6,648,453 | -1.92% | | **envs-number** | 271,319,292 | 270,298,164 | 🡖 1,021,128 | -0.38% | | **gc-heapSize** | 8,995,291,136 | 10,110,009,344 | 🡕 1,114,718,208 | 12.39% | | **gc-totalBytes** | 37,172,737,408 | 36,878,391,888 | 🡖 294,345,520 | -0.79% | | **list-bytes** | 1,886,162,656 | 1,886,163,472 | 🡕 816 | 0.00% | | **list-concats** | 6,898,114 | 6,898,114 | 0 | | | **list-elements** | 235,770,332 | 235,770,434 | 🡕 102 | 0.00% | | **nrAvoided** | 328,829,821 | 326,618,157 | 🡖 2,211,664 | -0.67% | | **nrFunctionCalls** | 240,850,845 | 239,998,495 | 🡖 852,350 | -0.35% | | **nrLookups** | 144,849,632 | 142,126,339 | 🡖 2,723,293 | -1.88% | | **nrOpUpdateValuesCopied** | 251,032,504 | 251,032,504 | 0 | | | **nrOpUpdates** | 17,903,110 | 17,903,110 | 0 | | | **nrPrimOpCalls** | 140,674,913 | 139,485,975 | 🡖 1,188,938 | -0.85% | | **nrThunks** | 294,643,131 | 288,678,022 | 🡖 5,965,109 | -2.02% | | **sets-bytes** | 9,464,322,192 | 9,456,172,048 | 🡖 8,150,144 | -0.09% | | **sets-elements** | 377,474,889 | 377,134,877 | 🡖 340,012 | -0.09% | | **sets-number** | 50,615,607 | 50,616,875 | 🡕 1,268 | 0.00% | | **sizes-Attr** | 24 | 24 | 0 | | | **sizes-Bindings** | 8 | 8 | 0 | | | **sizes-Env** | 16 | 16 | 0 | | | **sizes-Value** | 24 | 24 | 0 | | | **symbols-bytes** | 3,147,102 | 3,147,064 | 🡖 38 | -0.00% | | **symbols-number** | 82,819 | 82,819 | 0 | | | **values-bytes** | 11,147,448,768 | 10,996,111,512 | 🡖 151,337,256 | -1.36% | | **values-number** | 464,477,032 | 458,171,313 | 🡖 6,305,719 | -1.36% |
2019-04-11 16:35:35 +00:00
{ lib, config, hostPlatform }:
let
inherit (lib)
all
attrNames
concatMapStrings
concatMapStringsSep
concatStrings
findFirst
2023-11-13 21:46:20 +00:00
isDerivation
length
mapAttrsToList
mergeDefinitions
mutuallyExclusive
optional
optionalAttrs
optionalString
optionals
remove
unknownModule
;
inherit (lib.lists)
any
toList
;
stdenv: shorten evaluation errors when in Hydra Hydra's page showing evaluation errors is about a mile long, showing buckets of user-friendly errors, like this: in job ‘seyren.aarch64-linux’: Package ‘oraclejre-8u191’ in /nix/store/fa9zzkbljkvdavwzirkrr5irg25ymbjl-source/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix:71 has an unfree license (‘unfree’), refusing to evaluate. a) For `nixos-rebuild` you can set { nixpkgs.config.allowUnfree = true; } in configuration.nix to override this. b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add { allowUnfree = true; } to ~/.config/nixpkgs/config.nix. in job ‘jetbrains.webstorm.x86_64-linux’: Package ‘webstorm-2018.3.1’ in /nix/store/fa9zzkbljkvdavwzirkrr5irg25ymbjl-source/pkgs/applications/editors/jetbrains/default.nix:230 has an unfree license (‘unfree’), refusing to evaluate. a) For `nixos-rebuild` you can set { nixpkgs.config.allowUnfree = true; } in configuration.nix to override this. b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add { allowUnfree = true; } to ~/.config/nixpkgs/config.nix. This makes it extremely hard to find actual issues in the output. This patch set makes the output much more condensed in Hydra: Failed to evaluate nifticlib-2.0.0: «unsupported»: is not supported on ‘x86_64-apple-darwin’ Failed to evaluate dmd-2.081.2: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate dmdBuild-2.081.2: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldc-1.11.0: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldcBuild-1.11.0: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldc-0.17.5: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldcBuild-0.17.5: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’
2018-12-18 15:50:53 +00:00
# If we're in hydra, we can dispense with the more verbose error
# messages and make problems easier to spot.
inHydra = config.inHydra or false;
# Allow the user to opt-into additional warnings, e.g.
# import <nixpkgs> { config = { showDerivationWarnings = [ "maintainerless" ]; }; }
showWarnings = config.showDerivationWarnings;
getName = attrs: attrs.name or ("${attrs.pname or "«name-missing»"}-${attrs.version or "«version-missing»"}");
stdenv: shorten evaluation errors when in Hydra Hydra's page showing evaluation errors is about a mile long, showing buckets of user-friendly errors, like this: in job ‘seyren.aarch64-linux’: Package ‘oraclejre-8u191’ in /nix/store/fa9zzkbljkvdavwzirkrr5irg25ymbjl-source/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix:71 has an unfree license (‘unfree’), refusing to evaluate. a) For `nixos-rebuild` you can set { nixpkgs.config.allowUnfree = true; } in configuration.nix to override this. b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add { allowUnfree = true; } to ~/.config/nixpkgs/config.nix. in job ‘jetbrains.webstorm.x86_64-linux’: Package ‘webstorm-2018.3.1’ in /nix/store/fa9zzkbljkvdavwzirkrr5irg25ymbjl-source/pkgs/applications/editors/jetbrains/default.nix:230 has an unfree license (‘unfree’), refusing to evaluate. a) For `nixos-rebuild` you can set { nixpkgs.config.allowUnfree = true; } in configuration.nix to override this. b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add { allowUnfree = true; } to ~/.config/nixpkgs/config.nix. This makes it extremely hard to find actual issues in the output. This patch set makes the output much more condensed in Hydra: Failed to evaluate nifticlib-2.0.0: «unsupported»: is not supported on ‘x86_64-apple-darwin’ Failed to evaluate dmd-2.081.2: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate dmdBuild-2.081.2: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldc-1.11.0: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldcBuild-1.11.0: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldc-0.17.5: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldcBuild-0.17.5: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’
2018-12-18 15:50:53 +00:00
2022-05-02 12:49:04 +00:00
allowUnfree = config.allowUnfree
|| builtins.getEnv "NIXPKGS_ALLOW_UNFREE" == "1";
allowNonSource = let
envVar = builtins.getEnv "NIXPKGS_ALLOW_NONSOURCE";
in if envVar != ""
then envVar != "0"
else config.allowNonSource or true;
allowlist = config.allowlistedLicenses or config.whitelistedLicenses or [];
blocklist = config.blocklistedLicenses or config.blacklistedLicenses or [];
areLicenseListsValid =
if mutuallyExclusive allowlist blocklist then
true
else
throw "allowlistedLicenses and blocklistedLicenses are not mutually exclusive.";
hasLicense = attrs:
attrs ? meta.license;
hasAllowlistedLicense = assert areLicenseListsValid; attrs:
hasLicense attrs && any (l: builtins.elem l allowlist) (toList attrs.meta.license);
hasBlocklistedLicense = assert areLicenseListsValid; attrs:
hasLicense attrs && any (l: builtins.elem l blocklist) (toList attrs.meta.license);
2022-05-02 14:20:44 +00:00
allowBroken = config.allowBroken
|| builtins.getEnv "NIXPKGS_ALLOW_BROKEN" == "1";
allowUnsupportedSystem = config.allowUnsupportedSystem
|| builtins.getEnv "NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM" == "1";
isUnfree = licenses: any (l: !l.free or true) licenses;
hasUnfreeLicense = attrs:
hasLicense attrs &&
isUnfree (toList attrs.meta.license);
hasNoMaintainers = attrs:
attrs ? meta.maintainers && (length attrs.meta.maintainers) == 0;
isMarkedBroken = attrs: attrs.meta.broken or false;
hasUnsupportedPlatform =
pkg: !(lib.meta.availableOn hostPlatform pkg);
isMarkedInsecure = attrs: (attrs.meta.knownVulnerabilities or []) != [];
# Alow granular checks to allow only some unfree packages
# Example:
# {pkgs, ...}:
# {
# allowUnfree = false;
# allowUnfreePredicate = (x: pkgs.lib.hasPrefix "vscode" x.name);
# }
allowUnfreePredicate = config.allowUnfreePredicate or (x: false);
# Check whether unfree packages are allowed and if not, whether the
2022-12-18 00:39:44 +00:00
# package has an unfree license and is not explicitly allowed by the
# `allowUnfreePredicate` function.
hasDeniedUnfreeLicense = attrs:
hasUnfreeLicense attrs &&
!allowUnfree &&
!allowUnfreePredicate attrs;
allowInsecureDefaultPredicate = x: builtins.elem (getName x) (config.permittedInsecurePackages or []);
allowInsecurePredicate = x: (config.allowInsecurePredicate or allowInsecureDefaultPredicate) x;
hasAllowedInsecure = attrs:
!(isMarkedInsecure attrs) ||
allowInsecurePredicate attrs ||
builtins.getEnv "NIXPKGS_ALLOW_INSECURE" == "1";
isNonSource = sourceTypes: any (t: !t.isSource) sourceTypes;
hasNonSourceProvenance = attrs:
(attrs ? meta.sourceProvenance) &&
isNonSource attrs.meta.sourceProvenance;
# Allow granular checks to allow only some non-source-built packages
# Example:
# { pkgs, ... }:
# {
# allowNonSource = false;
# allowNonSourcePredicate = with pkgs.lib.lists; pkg: !(any (p: !p.isSource && p != lib.sourceTypes.binaryFirmware) pkg.meta.sourceProvenance);
# }
allowNonSourcePredicate = config.allowNonSourcePredicate or (x: false);
# Check whether non-source packages are allowed and if not, whether the
# package has non-source provenance and is not explicitly allowed by the
# `allowNonSourcePredicate` function.
hasDeniedNonSourceProvenance = attrs:
hasNonSourceProvenance attrs &&
!allowNonSource &&
!allowNonSourcePredicate attrs;
showLicenseOrSourceType = value: toString (map (v: v.shortName or "unknown") (toList value));
showLicense = showLicenseOrSourceType;
showSourceType = showLicenseOrSourceType;
check-env: don't execute check-meta.nix 15,000 times Generated from https://github.com/NixOS/nix/pull/2761: ``` ns calls ns/call - /home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:22:5 591200 15026 39.3451 + /home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:22:5 8744 308 28.3896 ``` more, generated by: ``` $ NIX_SHOW_STATS=1 NIX_COUNT_CALLS=1 nix-instantiate ./pkgs/top-level/release.nix -A unstable > before 2>&1 $ jq -r '.functions | map((.name + ":" + .file + ":" + (.line|tostring) + ":" + (.column|tostring) + " " + (.count|tostring))) | .[]' before | sort > before.list ``` applying this patch, then: ``` $ NIX_SHOW_STATS=1 NIX_COUNT_CALLS=1 nix-instantiate ./pkgs/top-level/release.nix -A unstable > after 2>&1 $ jq -r '.functions | map((.name + ":" + .file + ":" + (.line|tostring) + ":" + (.column|tostring) + " " + (.count|tostring))) | .[]' after | sort > after.list ``` and then diffing before.list and after.list to get: ``` calls - :/home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:4:1 7513 + :/home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:4:1 154 - mutuallyExclusive:/home/grahamc/projects/github.com/NixOS/nixpkgs/lib/lists.nix:658:23 7513 + mutuallyExclusive:/home/grahamc/projects/github.com/NixOS/nixpkgs/lib/lists.nix:658:23 154 - mutuallyExclusive:/home/grahamc/projects/github.com/NixOS/nixpkgs/lib/lists.nix:658:26 7513 + mutuallyExclusive:/home/grahamc/projects/github.com/NixOS/nixpkgs/lib/lists.nix:658:26 154 - onlyLicenses:/home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:21:18 15026 + onlyLicenses:/home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:21:18 308 ``` The following information is from `NIX_SHOW_STATS=1 GC_INITIAL_HEAP_SIZE=4g nix-env -f ./outpaths.nix -qaP --no-name --out-path --arg checkMeta true`: | stat | before | after | Δ | Δ% | |:---------------------------|---------------:|---------------:|:----------------|--------:| | **cpuTime** | 179.915 | 145.543 | 🡖 34.372 | -19.10% | | **envs-bytes** | 3,900,878,824 | 3,599,483,208 | 🡖 301,395,616 | -7.73% | | **envs-elements** | 214,426,071 | 185,881,709 | 🡖 28,544,362 | -13.31% | | **envs-number** | 136,591,891 | 132,026,846 | 🡖 4,565,045 | -3.34% | | **gc-heapSize** | 11,400,048,640 | 12,314,890,240 | 🡕 914,841,600 | 8.02% | | **gc-totalBytes** | 25,976,902,560 | 24,510,740,176 | 🡖 1,466,162,384 | -5.64% | | **list-bytes** | 1,665,290,080 | 1,665,290,080 | 0 | | | **list-concats** | 7,264,417 | 7,264,417 | 0 | | | **list-elements** | 208,161,260 | 208,161,260 | 0 | | | **nrAvoided** | 191,359,386 | 179,693,661 | 🡖 11,665,725 | -6.10% | | **nrFunctionCalls** | 119,665,062 | 116,348,547 | 🡖 3,316,515 | -2.77% | | **nrLookups** | 80,996,257 | 76,069,825 | 🡖 4,926,432 | -6.08% | | **nrOpUpdateValuesCopied** | 213,930,649 | 213,930,649 | 0 | | | **nrOpUpdates** | 12,025,937 | 12,025,937 | 0 | | | **nrPrimOpCalls** | 88,105,604 | 86,451,598 | 🡖 1,654,006 | -1.88% | | **nrThunks** | 196,842,044 | 175,126,701 | 🡖 21,715,343 | -11.03% | | **sets-bytes** | 7,678,425,776 | 7,285,767,928 | 🡖 392,657,848 | -5.11% | | **sets-elements** | 310,241,340 | 294,373,227 | 🡖 15,868,113 | -5.11% | | **sets-number** | 29,079,202 | 27,601,310 | 🡖 1,477,892 | -5.08% | | **sizes-Attr** | 24 | 24 | 0 | | | **sizes-Bindings** | 8 | 8 | 0 | | | **sizes-Env** | 16 | 16 | 0 | | | **sizes-Value** | 24 | 24 | 0 | | | **symbols-bytes** | 16,474,666 | 16,474,676 | 🡕 10 | 0.00% | | **symbols-number** | 376,426 | 376,427 | 🡕 1 | 0.00% | | **values-bytes** | 6,856,506,288 | 6,316,585,560 | 🡖 539,920,728 | -7.87% | | **values-number** | 285,687,762 | 263,191,065 | 🡖 22,496,697 | -7.87% | The following information is from `NIX_SHOW_STATS=1 GC_INITIAL_HEAP_SIZE=4g nix-instantiate ./nixos/release-combined.nix -A tested`: | stat | before | after | Δ | Δ% | |:---------------------------|---------------:|---------------:|:----------------|-------:| | **cpuTime** | 256.071 | 237.531 | 🡖 18.54 | -7.24% | | **envs-bytes** | 7,111,004,192 | 7,041,478,520 | 🡖 69,525,672 | -0.98% | | **envs-elements** | 346,236,940 | 339,588,487 | 🡖 6,648,453 | -1.92% | | **envs-number** | 271,319,292 | 270,298,164 | 🡖 1,021,128 | -0.38% | | **gc-heapSize** | 8,995,291,136 | 10,110,009,344 | 🡕 1,114,718,208 | 12.39% | | **gc-totalBytes** | 37,172,737,408 | 36,878,391,888 | 🡖 294,345,520 | -0.79% | | **list-bytes** | 1,886,162,656 | 1,886,163,472 | 🡕 816 | 0.00% | | **list-concats** | 6,898,114 | 6,898,114 | 0 | | | **list-elements** | 235,770,332 | 235,770,434 | 🡕 102 | 0.00% | | **nrAvoided** | 328,829,821 | 326,618,157 | 🡖 2,211,664 | -0.67% | | **nrFunctionCalls** | 240,850,845 | 239,998,495 | 🡖 852,350 | -0.35% | | **nrLookups** | 144,849,632 | 142,126,339 | 🡖 2,723,293 | -1.88% | | **nrOpUpdateValuesCopied** | 251,032,504 | 251,032,504 | 0 | | | **nrOpUpdates** | 17,903,110 | 17,903,110 | 0 | | | **nrPrimOpCalls** | 140,674,913 | 139,485,975 | 🡖 1,188,938 | -0.85% | | **nrThunks** | 294,643,131 | 288,678,022 | 🡖 5,965,109 | -2.02% | | **sets-bytes** | 9,464,322,192 | 9,456,172,048 | 🡖 8,150,144 | -0.09% | | **sets-elements** | 377,474,889 | 377,134,877 | 🡖 340,012 | -0.09% | | **sets-number** | 50,615,607 | 50,616,875 | 🡕 1,268 | 0.00% | | **sizes-Attr** | 24 | 24 | 0 | | | **sizes-Bindings** | 8 | 8 | 0 | | | **sizes-Env** | 16 | 16 | 0 | | | **sizes-Value** | 24 | 24 | 0 | | | **symbols-bytes** | 3,147,102 | 3,147,064 | 🡖 38 | -0.00% | | **symbols-number** | 82,819 | 82,819 | 0 | | | **values-bytes** | 11,147,448,768 | 10,996,111,512 | 🡖 151,337,256 | -1.36% | | **values-number** | 464,477,032 | 458,171,313 | 🡖 6,305,719 | -1.36% |
2019-04-11 16:35:35 +00:00
pos_str = meta: meta.position or "«unknown-file»";
remediation = {
unfree = remediate_allowlist "Unfree" (remediate_predicate "allowUnfreePredicate");
non-source = remediate_allowlist "NonSource" (remediate_predicate "allowNonSourcePredicate");
broken = remediate_allowlist "Broken" (x: "");
unsupported = remediate_allowlist "UnsupportedSystem" (x: "");
blocklisted = x: "";
insecure = remediate_insecure;
broken-outputs = remediateOutputsToInstall;
unknown-meta = x: "";
maintainerless = x: "";
};
remediation_env_var = allow_attr: {
Unfree = "NIXPKGS_ALLOW_UNFREE";
Broken = "NIXPKGS_ALLOW_BROKEN";
UnsupportedSystem = "NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM";
NonSource = "NIXPKGS_ALLOW_NONSOURCE";
}.${allow_attr};
remediation_phrase = allow_attr: {
Unfree = "unfree packages";
Broken = "broken packages";
UnsupportedSystem = "packages that are unsupported for this system";
NonSource = "packages not built from source";
}.${allow_attr};
remediate_predicate = predicateConfigAttr: attrs:
''
Alternatively you can configure a predicate to allow specific packages:
{ nixpkgs.config.${predicateConfigAttr} = pkg: builtins.elem (lib.getName pkg) [
"${getName attrs}"
];
}
'';
# flakeNote will be printed in the remediation messages below.
flakeNote = "
Note: When using `nix shell`, `nix build`, `nix develop`, etc with a flake,
then pass `--impure` in order to allow use of environment variables.
";
remediate_allowlist = allow_attr: rebuild_amendment: attrs:
''
a) To temporarily allow ${remediation_phrase allow_attr}, you can use an environment variable
for a single invocation of the nix tools.
$ export ${remediation_env_var allow_attr}=1
${flakeNote}
b) For `nixos-rebuild` you can set
{ nixpkgs.config.allow${allow_attr} = true; }
in configuration.nix to override this.
${rebuild_amendment attrs}
c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
{ allow${allow_attr} = true; }
to ~/.config/nixpkgs/config.nix.
'';
remediate_insecure = attrs:
''
Known issues:
'' + (concatStrings (map (issue: " - ${issue}\n") attrs.meta.knownVulnerabilities)) + ''
You can install it anyway by allowing this package, using the
following methods:
2020-06-11 02:25:07 +00:00
a) To temporarily allow all insecure packages, you can use an environment
variable for a single invocation of the nix tools:
$ export NIXPKGS_ALLOW_INSECURE=1
${flakeNote}
b) for `nixos-rebuild` you can add ${getName attrs} to
`nixpkgs.config.permittedInsecurePackages` in the configuration.nix,
like so:
{
nixpkgs.config.permittedInsecurePackages = [
"${getName attrs}"
];
}
c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
2020-06-11 02:25:07 +00:00
${getName attrs} to `permittedInsecurePackages` in
~/.config/nixpkgs/config.nix, like so:
{
permittedInsecurePackages = [
"${getName attrs}"
];
}
'';
remediateOutputsToInstall = attrs: let
expectedOutputs = attrs.meta.outputsToInstall or [];
actualOutputs = attrs.outputs or [ "out" ];
missingOutputs = builtins.filter (output: ! builtins.elem output actualOutputs) expectedOutputs;
in ''
The package ${getName attrs} has set meta.outputsToInstall to: ${builtins.concatStringsSep ", " expectedOutputs}
however ${getName attrs} only has the outputs: ${builtins.concatStringsSep ", " actualOutputs}
and is missing the following ouputs:
${concatStrings (builtins.map (output: " - ${output}\n") missingOutputs)}
'';
check-env: don't execute check-meta.nix 15,000 times Generated from https://github.com/NixOS/nix/pull/2761: ``` ns calls ns/call - /home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:22:5 591200 15026 39.3451 + /home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:22:5 8744 308 28.3896 ``` more, generated by: ``` $ NIX_SHOW_STATS=1 NIX_COUNT_CALLS=1 nix-instantiate ./pkgs/top-level/release.nix -A unstable > before 2>&1 $ jq -r '.functions | map((.name + ":" + .file + ":" + (.line|tostring) + ":" + (.column|tostring) + " " + (.count|tostring))) | .[]' before | sort > before.list ``` applying this patch, then: ``` $ NIX_SHOW_STATS=1 NIX_COUNT_CALLS=1 nix-instantiate ./pkgs/top-level/release.nix -A unstable > after 2>&1 $ jq -r '.functions | map((.name + ":" + .file + ":" + (.line|tostring) + ":" + (.column|tostring) + " " + (.count|tostring))) | .[]' after | sort > after.list ``` and then diffing before.list and after.list to get: ``` calls - :/home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:4:1 7513 + :/home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:4:1 154 - mutuallyExclusive:/home/grahamc/projects/github.com/NixOS/nixpkgs/lib/lists.nix:658:23 7513 + mutuallyExclusive:/home/grahamc/projects/github.com/NixOS/nixpkgs/lib/lists.nix:658:23 154 - mutuallyExclusive:/home/grahamc/projects/github.com/NixOS/nixpkgs/lib/lists.nix:658:26 7513 + mutuallyExclusive:/home/grahamc/projects/github.com/NixOS/nixpkgs/lib/lists.nix:658:26 154 - onlyLicenses:/home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:21:18 15026 + onlyLicenses:/home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:21:18 308 ``` The following information is from `NIX_SHOW_STATS=1 GC_INITIAL_HEAP_SIZE=4g nix-env -f ./outpaths.nix -qaP --no-name --out-path --arg checkMeta true`: | stat | before | after | Δ | Δ% | |:---------------------------|---------------:|---------------:|:----------------|--------:| | **cpuTime** | 179.915 | 145.543 | 🡖 34.372 | -19.10% | | **envs-bytes** | 3,900,878,824 | 3,599,483,208 | 🡖 301,395,616 | -7.73% | | **envs-elements** | 214,426,071 | 185,881,709 | 🡖 28,544,362 | -13.31% | | **envs-number** | 136,591,891 | 132,026,846 | 🡖 4,565,045 | -3.34% | | **gc-heapSize** | 11,400,048,640 | 12,314,890,240 | 🡕 914,841,600 | 8.02% | | **gc-totalBytes** | 25,976,902,560 | 24,510,740,176 | 🡖 1,466,162,384 | -5.64% | | **list-bytes** | 1,665,290,080 | 1,665,290,080 | 0 | | | **list-concats** | 7,264,417 | 7,264,417 | 0 | | | **list-elements** | 208,161,260 | 208,161,260 | 0 | | | **nrAvoided** | 191,359,386 | 179,693,661 | 🡖 11,665,725 | -6.10% | | **nrFunctionCalls** | 119,665,062 | 116,348,547 | 🡖 3,316,515 | -2.77% | | **nrLookups** | 80,996,257 | 76,069,825 | 🡖 4,926,432 | -6.08% | | **nrOpUpdateValuesCopied** | 213,930,649 | 213,930,649 | 0 | | | **nrOpUpdates** | 12,025,937 | 12,025,937 | 0 | | | **nrPrimOpCalls** | 88,105,604 | 86,451,598 | 🡖 1,654,006 | -1.88% | | **nrThunks** | 196,842,044 | 175,126,701 | 🡖 21,715,343 | -11.03% | | **sets-bytes** | 7,678,425,776 | 7,285,767,928 | 🡖 392,657,848 | -5.11% | | **sets-elements** | 310,241,340 | 294,373,227 | 🡖 15,868,113 | -5.11% | | **sets-number** | 29,079,202 | 27,601,310 | 🡖 1,477,892 | -5.08% | | **sizes-Attr** | 24 | 24 | 0 | | | **sizes-Bindings** | 8 | 8 | 0 | | | **sizes-Env** | 16 | 16 | 0 | | | **sizes-Value** | 24 | 24 | 0 | | | **symbols-bytes** | 16,474,666 | 16,474,676 | 🡕 10 | 0.00% | | **symbols-number** | 376,426 | 376,427 | 🡕 1 | 0.00% | | **values-bytes** | 6,856,506,288 | 6,316,585,560 | 🡖 539,920,728 | -7.87% | | **values-number** | 285,687,762 | 263,191,065 | 🡖 22,496,697 | -7.87% | The following information is from `NIX_SHOW_STATS=1 GC_INITIAL_HEAP_SIZE=4g nix-instantiate ./nixos/release-combined.nix -A tested`: | stat | before | after | Δ | Δ% | |:---------------------------|---------------:|---------------:|:----------------|-------:| | **cpuTime** | 256.071 | 237.531 | 🡖 18.54 | -7.24% | | **envs-bytes** | 7,111,004,192 | 7,041,478,520 | 🡖 69,525,672 | -0.98% | | **envs-elements** | 346,236,940 | 339,588,487 | 🡖 6,648,453 | -1.92% | | **envs-number** | 271,319,292 | 270,298,164 | 🡖 1,021,128 | -0.38% | | **gc-heapSize** | 8,995,291,136 | 10,110,009,344 | 🡕 1,114,718,208 | 12.39% | | **gc-totalBytes** | 37,172,737,408 | 36,878,391,888 | 🡖 294,345,520 | -0.79% | | **list-bytes** | 1,886,162,656 | 1,886,163,472 | 🡕 816 | 0.00% | | **list-concats** | 6,898,114 | 6,898,114 | 0 | | | **list-elements** | 235,770,332 | 235,770,434 | 🡕 102 | 0.00% | | **nrAvoided** | 328,829,821 | 326,618,157 | 🡖 2,211,664 | -0.67% | | **nrFunctionCalls** | 240,850,845 | 239,998,495 | 🡖 852,350 | -0.35% | | **nrLookups** | 144,849,632 | 142,126,339 | 🡖 2,723,293 | -1.88% | | **nrOpUpdateValuesCopied** | 251,032,504 | 251,032,504 | 0 | | | **nrOpUpdates** | 17,903,110 | 17,903,110 | 0 | | | **nrPrimOpCalls** | 140,674,913 | 139,485,975 | 🡖 1,188,938 | -0.85% | | **nrThunks** | 294,643,131 | 288,678,022 | 🡖 5,965,109 | -2.02% | | **sets-bytes** | 9,464,322,192 | 9,456,172,048 | 🡖 8,150,144 | -0.09% | | **sets-elements** | 377,474,889 | 377,134,877 | 🡖 340,012 | -0.09% | | **sets-number** | 50,615,607 | 50,616,875 | 🡕 1,268 | 0.00% | | **sizes-Attr** | 24 | 24 | 0 | | | **sizes-Bindings** | 8 | 8 | 0 | | | **sizes-Env** | 16 | 16 | 0 | | | **sizes-Value** | 24 | 24 | 0 | | | **symbols-bytes** | 3,147,102 | 3,147,064 | 🡖 38 | -0.00% | | **symbols-number** | 82,819 | 82,819 | 0 | | | **values-bytes** | 11,147,448,768 | 10,996,111,512 | 🡖 151,337,256 | -1.36% | | **values-number** | 464,477,032 | 458,171,313 | 🡖 6,305,719 | -1.36% |
2019-04-11 16:35:35 +00:00
handleEvalIssue = { meta, attrs }: { reason , errormsg ? "" }:
let
stdenv: shorten evaluation errors when in Hydra Hydra's page showing evaluation errors is about a mile long, showing buckets of user-friendly errors, like this: in job ‘seyren.aarch64-linux’: Package ‘oraclejre-8u191’ in /nix/store/fa9zzkbljkvdavwzirkrr5irg25ymbjl-source/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix:71 has an unfree license (‘unfree’), refusing to evaluate. a) For `nixos-rebuild` you can set { nixpkgs.config.allowUnfree = true; } in configuration.nix to override this. b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add { allowUnfree = true; } to ~/.config/nixpkgs/config.nix. in job ‘jetbrains.webstorm.x86_64-linux’: Package ‘webstorm-2018.3.1’ in /nix/store/fa9zzkbljkvdavwzirkrr5irg25ymbjl-source/pkgs/applications/editors/jetbrains/default.nix:230 has an unfree license (‘unfree’), refusing to evaluate. a) For `nixos-rebuild` you can set { nixpkgs.config.allowUnfree = true; } in configuration.nix to override this. b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add { allowUnfree = true; } to ~/.config/nixpkgs/config.nix. This makes it extremely hard to find actual issues in the output. This patch set makes the output much more condensed in Hydra: Failed to evaluate nifticlib-2.0.0: «unsupported»: is not supported on ‘x86_64-apple-darwin’ Failed to evaluate dmd-2.081.2: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate dmdBuild-2.081.2: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldc-1.11.0: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldcBuild-1.11.0: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldc-0.17.5: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldcBuild-0.17.5: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’
2018-12-18 15:50:53 +00:00
msg = if inHydra
then "Failed to evaluate ${getName attrs}: «${reason}»: ${errormsg}"
stdenv: shorten evaluation errors when in Hydra Hydra's page showing evaluation errors is about a mile long, showing buckets of user-friendly errors, like this: in job ‘seyren.aarch64-linux’: Package ‘oraclejre-8u191’ in /nix/store/fa9zzkbljkvdavwzirkrr5irg25ymbjl-source/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix:71 has an unfree license (‘unfree’), refusing to evaluate. a) For `nixos-rebuild` you can set { nixpkgs.config.allowUnfree = true; } in configuration.nix to override this. b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add { allowUnfree = true; } to ~/.config/nixpkgs/config.nix. in job ‘jetbrains.webstorm.x86_64-linux’: Package ‘webstorm-2018.3.1’ in /nix/store/fa9zzkbljkvdavwzirkrr5irg25ymbjl-source/pkgs/applications/editors/jetbrains/default.nix:230 has an unfree license (‘unfree’), refusing to evaluate. a) For `nixos-rebuild` you can set { nixpkgs.config.allowUnfree = true; } in configuration.nix to override this. b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add { allowUnfree = true; } to ~/.config/nixpkgs/config.nix. This makes it extremely hard to find actual issues in the output. This patch set makes the output much more condensed in Hydra: Failed to evaluate nifticlib-2.0.0: «unsupported»: is not supported on ‘x86_64-apple-darwin’ Failed to evaluate dmd-2.081.2: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate dmdBuild-2.081.2: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldc-1.11.0: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldcBuild-1.11.0: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldc-0.17.5: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldcBuild-0.17.5: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’
2018-12-18 15:50:53 +00:00
else ''
Package ${getName attrs} in ${pos_str meta} ${errormsg}, refusing to evaluate.
stdenv: shorten evaluation errors when in Hydra Hydra's page showing evaluation errors is about a mile long, showing buckets of user-friendly errors, like this: in job ‘seyren.aarch64-linux’: Package ‘oraclejre-8u191’ in /nix/store/fa9zzkbljkvdavwzirkrr5irg25ymbjl-source/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix:71 has an unfree license (‘unfree’), refusing to evaluate. a) For `nixos-rebuild` you can set { nixpkgs.config.allowUnfree = true; } in configuration.nix to override this. b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add { allowUnfree = true; } to ~/.config/nixpkgs/config.nix. in job ‘jetbrains.webstorm.x86_64-linux’: Package ‘webstorm-2018.3.1’ in /nix/store/fa9zzkbljkvdavwzirkrr5irg25ymbjl-source/pkgs/applications/editors/jetbrains/default.nix:230 has an unfree license (‘unfree’), refusing to evaluate. a) For `nixos-rebuild` you can set { nixpkgs.config.allowUnfree = true; } in configuration.nix to override this. b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add { allowUnfree = true; } to ~/.config/nixpkgs/config.nix. This makes it extremely hard to find actual issues in the output. This patch set makes the output much more condensed in Hydra: Failed to evaluate nifticlib-2.0.0: «unsupported»: is not supported on ‘x86_64-apple-darwin’ Failed to evaluate dmd-2.081.2: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate dmdBuild-2.081.2: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldc-1.11.0: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldcBuild-1.11.0: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldc-0.17.5: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’ Failed to evaluate ldcBuild-0.17.5: «unsupported»: is not supported on ‘aarch64-unknown-linux-gnu’
2018-12-18 15:50:53 +00:00
'' + (builtins.getAttr reason remediation) attrs;
2019-08-13 21:52:01 +00:00
handler = if config ? handleEvalIssue
then config.handleEvalIssue reason
else throw;
in handler msg;
handleEvalWarning = { meta, attrs }: { reason , errormsg ? "" }:
let
remediationMsg = (builtins.getAttr reason remediation) attrs;
msg = if inHydra then "Warning while evaluating ${getName attrs}: «${reason}»: ${errormsg}"
else "Package ${getName attrs} in ${pos_str meta} ${errormsg}, continuing anyway."
+ (optionalString (remediationMsg != "") "\n${remediationMsg}");
isEnabled = findFirst (x: x == reason) null showWarnings;
in if isEnabled != null then builtins.trace msg true else true;
# Deep type-checking. Note that calling `type.check` is not enough: see `lib.mkOptionType`'s documentation.
# We don't include this in lib for now because this function is flawed: it accepts things like `mkIf true 42`.
typeCheck = type: value: let
merged = mergeDefinitions [ ] type [
{ file = unknownModule; inherit value; }
];
eval = builtins.tryEval (builtins.deepSeq merged.mergedValue null);
in eval.success;
# TODO make this into a proper module and use the generic option documentation generation?
2023-11-13 21:46:20 +00:00
metaTypes = let
inherit (lib.types)
anything
attrsOf
bool
either
int
listOf
mkOptionType
str
unspecified
;
in rec {
# These keys are documented
description = str;
mainProgram = str;
longDescription = str;
branch = str;
homepage = either (listOf str) str;
downloadPage = str;
changelog = either (listOf str) str;
license = let
licenseType = either (attrsOf anything) str; # TODO disallow `str` licenses, use a module
in either licenseType (listOf licenseType);
sourceProvenance = listOf lib.types.attrs;
maintainers = listOf (attrsOf anything); # TODO use the maintainer type from lib/tests/maintainer-module.nix
priority = int;
pkgConfigModules = listOf str;
platforms = listOf (either str (attrsOf anything)); # see lib.meta.platformMatch
hydraPlatforms = listOf str;
broken = bool;
unfree = bool;
unsupported = bool;
insecure = bool;
dovecot, opensmtpd: add link to test in `meta.tests` Rationale --------- Currently, tests are hard to discover. For instance, someone updating `dovecot` might not notice that the interaction of `dovecot` with `opensmtpd` is handled in the `opensmtpd.nix` test. And even for someone updating `opensmtpd`, it requires manual work to go check in `nixos/tests` whether there is actually a test, especially given not so many packages in `nixpkgs` have tests and this is thus most of the time useless. Finally, for the reviewer, it is much easier to check that the “Tested via one or more NixOS test(s)” has been checked if the file modified already includes the list of relevant tests. Implementation -------------- Currently, this commit only adds the metadata in the package. Each element of the `meta.tests` attribute is a derivation that, when it builds successfully, means the test has passed (ie. following the same convention as NixOS tests). Future Work ----------- In the future, the tools could be made aware of this `meta.tests` attribute, and for instance a `--with-tests` could be added to `nix-build` so that it also builds all the tests. Or a `--without-tests` to build without all the tests. @Profpatsch described in his NixCon talk such systems. Another thing that would help in the future would be the possibility to reasonably easily have cross-derivation nix tests without the whole NixOS VM stack. @7c6f434c already proposed such a system. This RFC currently handles none of these concerns. Only the addition of `meta.tests` as metadata to be used by maintainers to remember to run relevant tests.
2018-08-04 03:18:28 +00:00
# TODO: refactor once something like Profpatsch's types-simple will land
# This is currently dead code due to https://github.com/NixOS/nix/issues/2532
dovecot, opensmtpd: add link to test in `meta.tests` Rationale --------- Currently, tests are hard to discover. For instance, someone updating `dovecot` might not notice that the interaction of `dovecot` with `opensmtpd` is handled in the `opensmtpd.nix` test. And even for someone updating `opensmtpd`, it requires manual work to go check in `nixos/tests` whether there is actually a test, especially given not so many packages in `nixpkgs` have tests and this is thus most of the time useless. Finally, for the reviewer, it is much easier to check that the “Tested via one or more NixOS test(s)” has been checked if the file modified already includes the list of relevant tests. Implementation -------------- Currently, this commit only adds the metadata in the package. Each element of the `meta.tests` attribute is a derivation that, when it builds successfully, means the test has passed (ie. following the same convention as NixOS tests). Future Work ----------- In the future, the tools could be made aware of this `meta.tests` attribute, and for instance a `--with-tests` could be added to `nix-build` so that it also builds all the tests. Or a `--without-tests` to build without all the tests. @Profpatsch described in his NixCon talk such systems. Another thing that would help in the future would be the possibility to reasonably easily have cross-derivation nix tests without the whole NixOS VM stack. @7c6f434c already proposed such a system. This RFC currently handles none of these concerns. Only the addition of `meta.tests` as metadata to be used by maintainers to remember to run relevant tests.
2018-08-04 03:18:28 +00:00
tests = attrsOf (mkOptionType {
name = "test";
check = x: x == {} || ( # Accept {} for tests that are unsupported
isDerivation x &&
x ? meta.timeout
);
dovecot, opensmtpd: add link to test in `meta.tests` Rationale --------- Currently, tests are hard to discover. For instance, someone updating `dovecot` might not notice that the interaction of `dovecot` with `opensmtpd` is handled in the `opensmtpd.nix` test. And even for someone updating `opensmtpd`, it requires manual work to go check in `nixos/tests` whether there is actually a test, especially given not so many packages in `nixpkgs` have tests and this is thus most of the time useless. Finally, for the reviewer, it is much easier to check that the “Tested via one or more NixOS test(s)” has been checked if the file modified already includes the list of relevant tests. Implementation -------------- Currently, this commit only adds the metadata in the package. Each element of the `meta.tests` attribute is a derivation that, when it builds successfully, means the test has passed (ie. following the same convention as NixOS tests). Future Work ----------- In the future, the tools could be made aware of this `meta.tests` attribute, and for instance a `--with-tests` could be added to `nix-build` so that it also builds all the tests. Or a `--without-tests` to build without all the tests. @Profpatsch described in his NixCon talk such systems. Another thing that would help in the future would be the possibility to reasonably easily have cross-derivation nix tests without the whole NixOS VM stack. @7c6f434c already proposed such a system. This RFC currently handles none of these concerns. Only the addition of `meta.tests` as metadata to be used by maintainers to remember to run relevant tests.
2018-08-04 03:18:28 +00:00
merge = lib.options.mergeOneOption;
});
timeout = int;
# Needed for Hydra to expose channel tarballs:
# https://github.com/NixOS/hydra/blob/53335323ae79ca1a42643f58e520b376898ce641/doc/manual/src/jobs.md#meta-fields
isHydraChannel = bool;
# Weirder stuff that doesn't appear in the documentation?
maxSilent = int;
knownVulnerabilities = listOf str;
2018-01-03 15:22:35 +00:00
name = str;
version = str;
tag = str;
executables = listOf str;
outputsToInstall = listOf str;
position = str;
available = unspecified;
isBuildPythonPackage = platforms;
schedulingPriority = int;
isFcitxEngine = bool;
isIbusEngine = bool;
isGutenprint = bool;
badPlatforms = platforms;
};
checkMetaAttr = k: v:
if metaTypes?${k} then
if typeCheck metaTypes.${k} v then
null
else
"key 'meta.${k}' has invalid value; expected ${metaTypes.${k}.description}, got\n ${
lib.generators.toPretty { indent = " "; } v
}"
else
"key 'meta.${k}' is unrecognized; expected one of: \n [${concatMapStringsSep ", " (x: "'${x}'") (attrNames metaTypes)}]";
checkMeta = meta: optionals config.checkMeta (remove null (mapAttrsToList checkMetaAttr meta));
checkOutputsToInstall = attrs: let
expectedOutputs = attrs.meta.outputsToInstall or [];
actualOutputs = attrs.outputs or [ "out" ];
missingOutputs = builtins.filter (output: ! builtins.elem output actualOutputs) expectedOutputs;
in if config.checkMeta
then builtins.length missingOutputs > 0
else false;
# Check if a derivation is valid, that is whether it passes checks for
# e.g brokenness or license.
#
# Return { valid: "yes", "warn" or "no" } and additionally
# { reason: String; errormsg: String } if it is not valid, where
# reason is one of "unfree", "blocklisted", "broken", "insecure", ...
# !!! reason strings are hardcoded into OfBorg, make sure to keep them in sync
# Along with a boolean flag for each reason
checkValidity = attrs:
# Check meta attribute types first, to make sure it is always called even when there are other issues
# Note that this is not a full type check and functions below still need to by careful about their inputs!
let res = checkMeta (attrs.meta or {}); in if res != [] then
{ valid = "no"; reason = "unknown-meta"; errormsg = "has an invalid meta attrset:${concatMapStrings (x: "\n - " + x) res}\n";
unfree = false; nonSource = false; broken = false; unsupported = false; insecure = false;
}
else {
unfree = hasUnfreeLicense attrs;
nonSource = hasNonSourceProvenance attrs;
broken = isMarkedBroken attrs;
unsupported = hasUnsupportedPlatform attrs;
insecure = isMarkedInsecure attrs;
} // (
# --- Put checks that cannot be ignored here ---
if checkOutputsToInstall attrs then
{ valid = "no"; reason = "broken-outputs"; errormsg = "has invalid meta.outputsToInstall"; }
# --- Put checks that can be ignored here ---
else if hasDeniedUnfreeLicense attrs && !(hasAllowlistedLicense attrs) then
{ valid = "no"; reason = "unfree"; errormsg = "has an unfree license (${showLicense attrs.meta.license})"; }
else if hasBlocklistedLicense attrs then
{ valid = "no"; reason = "blocklisted"; errormsg = "has a blocklisted license (${showLicense attrs.meta.license})"; }
else if hasDeniedNonSourceProvenance attrs then
{ valid = "no"; reason = "non-source"; errormsg = "contains elements not built from source (${showSourceType attrs.meta.sourceProvenance})"; }
else if !allowBroken && attrs.meta.broken or false then
{ valid = "no"; reason = "broken"; errormsg = "is marked as broken"; }
else if !allowUnsupportedSystem && hasUnsupportedPlatform attrs then
let toPretty = lib.generators.toPretty {
allowPrettyValues = true;
indent = " ";
};
in { valid = "no"; reason = "unsupported";
errormsg = ''
is not available on the requested hostPlatform:
hostPlatform.config = "${hostPlatform.config}"
package.meta.platforms = ${toPretty (attrs.meta.platforms or [])}
package.meta.badPlatforms = ${toPretty (attrs.meta.badPlatforms or [])}
'';
}
else if !(hasAllowedInsecure attrs) then
{ valid = "no"; reason = "insecure"; errormsg = "is marked as insecure"; }
# --- warnings ---
# Please also update the type in /pkgs/top-level/config.nix alongside this.
else if hasNoMaintainers attrs then
{ valid = "warn"; reason = "maintainerless"; errormsg = "has no maintainers"; }
# -----
else { valid = "yes"; });
# The meta attribute is passed in the resulting attribute set,
# but it's not part of the actual derivation, i.e., it's not
# passed to the builder and is not a dependency. But since we
# include it in the result, it *is* available to nix-env for queries.
# Example:
# meta = checkMeta.commonMeta { inherit validity attrs pos references; };
# validity = checkMeta.assertValidity { inherit meta attrs; };
commonMeta = { validity, attrs, pos ? null, references ? [ ] }:
let
outputs = attrs.outputs or [ "out" ];
in
{
# `name` derivation attribute includes cross-compilation cruft,
# is under assert, and is sanitized.
# Let's have a clean always accessible version here.
name = attrs.name or "${attrs.pname}-${attrs.version}";
# If the packager hasn't specified `outputsToInstall`, choose a default,
# which is the name of `p.bin or p.out or p` along with `p.man` when
# present.
#
# If the packager has specified it, it will be overridden below in
# `// meta`.
#
# Note: This default probably shouldn't be globally configurable.
# Services and users should specify outputs explicitly,
# unless they are comfortable with this default.
outputsToInstall =
let
hasOutput = out: builtins.elem out outputs;
in
[ (findFirst hasOutput null ([ "bin" "out" ] ++ outputs)) ]
++ optional (hasOutput "man") "man";
}
// attrs.meta or { }
# Fill `meta.position` to identify the source location of the package.
// optionalAttrs (pos != null) {
position = pos.file + ":" + toString pos.line;
} // {
# Expose the result of the checks for everyone to see.
inherit (validity) unfree broken unsupported insecure;
available = validity.valid != "no"
&& (if config.checkMetaRecursively or false
then all (d: d.meta.available or true) references
else true);
};
check-env: don't execute check-meta.nix 15,000 times Generated from https://github.com/NixOS/nix/pull/2761: ``` ns calls ns/call - /home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:22:5 591200 15026 39.3451 + /home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:22:5 8744 308 28.3896 ``` more, generated by: ``` $ NIX_SHOW_STATS=1 NIX_COUNT_CALLS=1 nix-instantiate ./pkgs/top-level/release.nix -A unstable > before 2>&1 $ jq -r '.functions | map((.name + ":" + .file + ":" + (.line|tostring) + ":" + (.column|tostring) + " " + (.count|tostring))) | .[]' before | sort > before.list ``` applying this patch, then: ``` $ NIX_SHOW_STATS=1 NIX_COUNT_CALLS=1 nix-instantiate ./pkgs/top-level/release.nix -A unstable > after 2>&1 $ jq -r '.functions | map((.name + ":" + .file + ":" + (.line|tostring) + ":" + (.column|tostring) + " " + (.count|tostring))) | .[]' after | sort > after.list ``` and then diffing before.list and after.list to get: ``` calls - :/home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:4:1 7513 + :/home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:4:1 154 - mutuallyExclusive:/home/grahamc/projects/github.com/NixOS/nixpkgs/lib/lists.nix:658:23 7513 + mutuallyExclusive:/home/grahamc/projects/github.com/NixOS/nixpkgs/lib/lists.nix:658:23 154 - mutuallyExclusive:/home/grahamc/projects/github.com/NixOS/nixpkgs/lib/lists.nix:658:26 7513 + mutuallyExclusive:/home/grahamc/projects/github.com/NixOS/nixpkgs/lib/lists.nix:658:26 154 - onlyLicenses:/home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:21:18 15026 + onlyLicenses:/home/grahamc/projects/github.com/NixOS/nixpkgs/pkgs/stdenv/generic/check-meta.nix:21:18 308 ``` The following information is from `NIX_SHOW_STATS=1 GC_INITIAL_HEAP_SIZE=4g nix-env -f ./outpaths.nix -qaP --no-name --out-path --arg checkMeta true`: | stat | before | after | Δ | Δ% | |:---------------------------|---------------:|---------------:|:----------------|--------:| | **cpuTime** | 179.915 | 145.543 | 🡖 34.372 | -19.10% | | **envs-bytes** | 3,900,878,824 | 3,599,483,208 | 🡖 301,395,616 | -7.73% | | **envs-elements** | 214,426,071 | 185,881,709 | 🡖 28,544,362 | -13.31% | | **envs-number** | 136,591,891 | 132,026,846 | 🡖 4,565,045 | -3.34% | | **gc-heapSize** | 11,400,048,640 | 12,314,890,240 | 🡕 914,841,600 | 8.02% | | **gc-totalBytes** | 25,976,902,560 | 24,510,740,176 | 🡖 1,466,162,384 | -5.64% | | **list-bytes** | 1,665,290,080 | 1,665,290,080 | 0 | | | **list-concats** | 7,264,417 | 7,264,417 | 0 | | | **list-elements** | 208,161,260 | 208,161,260 | 0 | | | **nrAvoided** | 191,359,386 | 179,693,661 | 🡖 11,665,725 | -6.10% | | **nrFunctionCalls** | 119,665,062 | 116,348,547 | 🡖 3,316,515 | -2.77% | | **nrLookups** | 80,996,257 | 76,069,825 | 🡖 4,926,432 | -6.08% | | **nrOpUpdateValuesCopied** | 213,930,649 | 213,930,649 | 0 | | | **nrOpUpdates** | 12,025,937 | 12,025,937 | 0 | | | **nrPrimOpCalls** | 88,105,604 | 86,451,598 | 🡖 1,654,006 | -1.88% | | **nrThunks** | 196,842,044 | 175,126,701 | 🡖 21,715,343 | -11.03% | | **sets-bytes** | 7,678,425,776 | 7,285,767,928 | 🡖 392,657,848 | -5.11% | | **sets-elements** | 310,241,340 | 294,373,227 | 🡖 15,868,113 | -5.11% | | **sets-number** | 29,079,202 | 27,601,310 | 🡖 1,477,892 | -5.08% | | **sizes-Attr** | 24 | 24 | 0 | | | **sizes-Bindings** | 8 | 8 | 0 | | | **sizes-Env** | 16 | 16 | 0 | | | **sizes-Value** | 24 | 24 | 0 | | | **symbols-bytes** | 16,474,666 | 16,474,676 | 🡕 10 | 0.00% | | **symbols-number** | 376,426 | 376,427 | 🡕 1 | 0.00% | | **values-bytes** | 6,856,506,288 | 6,316,585,560 | 🡖 539,920,728 | -7.87% | | **values-number** | 285,687,762 | 263,191,065 | 🡖 22,496,697 | -7.87% | The following information is from `NIX_SHOW_STATS=1 GC_INITIAL_HEAP_SIZE=4g nix-instantiate ./nixos/release-combined.nix -A tested`: | stat | before | after | Δ | Δ% | |:---------------------------|---------------:|---------------:|:----------------|-------:| | **cpuTime** | 256.071 | 237.531 | 🡖 18.54 | -7.24% | | **envs-bytes** | 7,111,004,192 | 7,041,478,520 | 🡖 69,525,672 | -0.98% | | **envs-elements** | 346,236,940 | 339,588,487 | 🡖 6,648,453 | -1.92% | | **envs-number** | 271,319,292 | 270,298,164 | 🡖 1,021,128 | -0.38% | | **gc-heapSize** | 8,995,291,136 | 10,110,009,344 | 🡕 1,114,718,208 | 12.39% | | **gc-totalBytes** | 37,172,737,408 | 36,878,391,888 | 🡖 294,345,520 | -0.79% | | **list-bytes** | 1,886,162,656 | 1,886,163,472 | 🡕 816 | 0.00% | | **list-concats** | 6,898,114 | 6,898,114 | 0 | | | **list-elements** | 235,770,332 | 235,770,434 | 🡕 102 | 0.00% | | **nrAvoided** | 328,829,821 | 326,618,157 | 🡖 2,211,664 | -0.67% | | **nrFunctionCalls** | 240,850,845 | 239,998,495 | 🡖 852,350 | -0.35% | | **nrLookups** | 144,849,632 | 142,126,339 | 🡖 2,723,293 | -1.88% | | **nrOpUpdateValuesCopied** | 251,032,504 | 251,032,504 | 0 | | | **nrOpUpdates** | 17,903,110 | 17,903,110 | 0 | | | **nrPrimOpCalls** | 140,674,913 | 139,485,975 | 🡖 1,188,938 | -0.85% | | **nrThunks** | 294,643,131 | 288,678,022 | 🡖 5,965,109 | -2.02% | | **sets-bytes** | 9,464,322,192 | 9,456,172,048 | 🡖 8,150,144 | -0.09% | | **sets-elements** | 377,474,889 | 377,134,877 | 🡖 340,012 | -0.09% | | **sets-number** | 50,615,607 | 50,616,875 | 🡕 1,268 | 0.00% | | **sizes-Attr** | 24 | 24 | 0 | | | **sizes-Bindings** | 8 | 8 | 0 | | | **sizes-Env** | 16 | 16 | 0 | | | **sizes-Value** | 24 | 24 | 0 | | | **symbols-bytes** | 3,147,102 | 3,147,064 | 🡖 38 | -0.00% | | **symbols-number** | 82,819 | 82,819 | 0 | | | **values-bytes** | 11,147,448,768 | 10,996,111,512 | 🡖 151,337,256 | -1.36% | | **values-number** | 464,477,032 | 458,171,313 | 🡖 6,305,719 | -1.36% |
2019-04-11 16:35:35 +00:00
assertValidity = { meta, attrs }: let
2018-01-31 03:10:34 +00:00
validity = checkValidity attrs;
in validity // {
# Throw an error if trying to evaluate a non-valid derivation
# or, alternatively, just output a warning message.
handled =
{
no = handleEvalIssue { inherit meta attrs; } { inherit (validity) reason errormsg; };
warn = handleEvalWarning { inherit meta attrs; } { inherit (validity) reason errormsg; };
yes = true;
}.${validity.valid};
2018-01-31 03:10:34 +00:00
};
stdenv: perform checks only when evaluating .drv and .out This pushes check-meta evaluation to derivation evaluation step, leaving all other attributes accessible. Before this commit: > $ HOME=/homeless-shelter NIX_PATH=nixpkgs=$(pwd) nix-instantiate --eval --strict ./default.nix -A xen --argstr system aarch64-linux > Package ‘xen-4.5.5’ in pkgs/applications/virtualization/xen/generic.nix:226 is not supported on ‘aarch64-linux’, refusing to evaluate. as expected > $ HOME=/homeless-shelter NIX_PATH=nixpkgs=$(pwd) nix-instantiate --eval --strict ./default.nix -A xen.name --argstr system aarch64-linux > Package ‘xen-4.5.5’ in pkgs/applications/virtualization/xen/generic.nix:226 is not supported on ‘aarch64-linux’, refusing to evaluate. > $ HOME=/homeless-shelter NIX_PATH=nixpkgs=$(pwd) nix-instantiate --eval --strict ./default.nix -A xen.meta.description --argstr system aarch64-linux > Package ‘xen-4.5.5’ in pkgs/applications/virtualization/xen/generic.nix:226 is not supported on ‘aarch64-linux’, refusing to evaluate. which is unfortunate since its impossible to use packages in autogenerated documentation on all platforms. After this commit: > $ HOME=/homeless-shelter NIX_PATH=nixpkgs=$(pwd) nix-instantiate --eval --strict ./default.nix -A xen --argstr system aarch64-linux still fails > $ HOME=/homeless-shelter NIX_PATH=nixpkgs=$(pwd) nix-instantiate --eval --strict ./default.nix -A xen.name --argstr system aarch64-linux > "xen-4.5.5" > $ HOME=/homeless-shelter NIX_PATH=nixpkgs=$(pwd) nix-instantiate --eval --strict ./default.nix -A xen.meta.description --argstr system aarch64-linux > "Xen hypervisor and related components (vanilla)"
2017-12-25 17:38:45 +00:00
in { inherit assertValidity commonMeta; }