Currently, you need to override `stdenv.hostPlatform` to request a
compressed kernel on AArch64, and the kernel configuration is split
between the central structured configuration and string snippets in
platform definitions. This has consequently made the latter bitrot
terribly. Since the platform‐specific logic is now very limited after
cleaning up the detritus, we can move it into the kernel derivation
and expose the relevant configuration there for anyone who wants to
customize it further or needs to read it out.
Co-authored-by: zowoq <59103226+zowoq@users.noreply.github.com>
The previous `if ! ( ... )` wrapper put the check body in a context
where bash ignores `set -e`, so a failing command in the middle of a
check would not abort it and the switch would proceed. Run the
subshell outside any conditional and capture $? explicitly instead.
stc-ng starts every active target (including default.target) and then
explicitly restarts nixos-activation.service. As a Type=oneshot without
RemainAfterExit the unit is inactive after login, so the default.target
start job re-runs it via Wants=, and the explicit restart runs it again
(or, depending on ordering, SIGTERMs the currently running script and re-runs it).
Set RemainAfterExit=yes so target starts are a no-op for an already-run
activation, and restartIfChanged=false so the unit-diff pass leaves it
alone when the script changes. The explicit restart in stc-ng remains
the single trigger per switch. Print that restart so it is visible in
the switch output, and drop it from the "NOT restarting" list.
Extend the user-activation-scripts test to assert the activation is
only run once, and never killed.
`pkgs.glibcLocales` is null for musl systems, so
`options.i18n.glibcLocales` needs to also be nullable.
otherwise, the `.override` and subsequence path interpolations
fail for non-gnu systems.
The check ran `realpath /run/current-system` under errexit, so a
missing current-system symlink aborted the script.
Drop the realpath calls (the -f test and jq already follow symlinks)
and use a static store path for the empty fallback instead of mktemp/trap.
Also exempt dry-activate, which makes no state changes and was being
blocked from showing its diff, and let jq fail loudly on malformed
inhibitor JSON instead of silently treating it as empty.
NixOS has traditionally enabled the `ext` family of file systems by
default. Originally, when switching to systemd initrd, we wanted to
transition to making this explicit so that initrds could be made
without `ext`. The problem is that anyone with `fsType = "auto";` for
an `ext` file system in initrd will fail to boot, which is not really
an acceptable regression as we switch to systemd initrd by default.
By removing `default = "auto"` from `fsType`, we rule out the vast
majority of these regressions as eval errors, since most users of
`fsType = "auto"` for ext file systems are using it because of the
default value.
In hindsight, this is probably what #225352 was really about.
This reduces our initrd script slightly, and we never made any clear
ordering guarantees about when these commands run anyway.
It also removes this as a blocker for nixos-init.
Improvements:
1. Turn the nix value into an attrset so that every inhibitor has a name
that we can match between generations
2. Write the attrset to a file as JSON
3. When checking, we load the JSON files from both the current and the
new generation into a jq pipeline and match up the keys.
We output a dict with a value for every key that is present in both
generations with a different value.
4. Build in error handling for different corner cases (missing files,
non-JSON content)
9bfd0d688d changed this line from
`substituteInPlace` to `sed`, but in the case of cross compilation
that would use the host's `sed`, which isn't necessarily executable by
the build machine.
Two improvements:
* use `writeShellApplication` (which uses `passAsFile` instead of
passing the activation script as an env var into the derivation.
We disable shellcheck and the bash options that this builder
usually adds to avoid issues with out-of-tree activation scripts.
* use `sed` instead of `substituteInPlace`, since the substitute
functions load the file content into a shell variable
This avoids issues when the activation is too long to fit in a shell variable.
Before this commit, a very large activation script, would cause build
failures because of different limits on the file content size, e.g.
```
➜ nix build -f . nixosTests.restartByActivationScript.nodes.machine.system.build.toplevel -vL
this derivation will be built:
/nix/store/xw6anpfjyamnycjg58cmj01sz3ididyl-nixos-system-machine-test.drv
building '/nix/store/xw6anpfjyamnycjg58cmj01sz3ididyl-nixos-system-machine-test.drv'...
nixos-system-machine-test> error: executing '/nix/store/rlq03x4cwf8zn73hxaxnx0zn5q9kifls-bash-5.3p3/bin/bash': Argument list too long
error: builder for '/nix/store/xw6anpfjyamnycjg58cmj01sz3ididyl-nixos-system-machine-test.drv' failed with exit code 1;
last 1 log lines:
> error: executing '/nix/store/rlq03x4cwf8zn73hxaxnx0zn5q9kifls-bash-5.3p3/bin/bash': Argument list too long
For full logs, run:
nix log /nix/store/xw6anpfjyamnycjg58cmj01sz3ididyl-nixos-system-machine-test.drv
```
This commit introduces "switch inhibitors" which are derivations that
prevent a switch of a system to a new configuration if those derivations
don't have the same hash in both configurations.
This means that we can for instance add the systemd and dbus derivations
such that users will be instructed to reboot their system when those
derivations have changed instead of switching.
This feature should be used sparingly, but it can make NixOS more robust
by avoiding users switching to a configuration that can make their
system unstable (like major updates of systemd, or new versions of dbus
since the dbus and dbus-broker daemons cannot be restarted).
The user can still force the switch by setting an env var.
Shuffle:
The definitions are now combined into a single option. Since they have
no interdependencies, that's ok, but you may notice this trivial change
by a changed hash, and analyzing with nix-diff.
Deprecation:
Use the option `system.systemBuilderCommands` instead.
In systems without initrd (e.g. containers) that also use system.replaceDependencies, we'd get:
error: attribute 'initialRamdisk' missing
at /nix/store/8vfhnwmmzqqzy97q9c5m4bzyaqqf63zy-source/nixos/modules/system/activation/top-level.nix:286:21:
285| cutoffPackages = mkOption {
286| default = [ config.system.build.initialRamdisk ];
| ^
Make that initialRamdisk reference conditional on the initrd being enabled.
Eventually we'd like to change our posture on this, and somehow ensure
that 'init' is always our systemd binary, but for now containers
require us to do it this way.
K900