https://go.dev/doc/go1.27
fix: vet
The "nixpkgs-vet"[^0] CI job was failing before.
- Attribute `pkgs.go_1_27` is a new top-level package using `pkgs.callPackage ./pkgs/development/compilers/go/1.27.nix { /* ... */ }`.
Please define it in pkgs/by-name/go/go_1_27/package.nix instead.
See `pkgs/by-name/README.md` for more details.
Since the second `callPackage` argument is `{ }`, no manual `callPackage` in pkgs/top-level/all-packages.nix is needed anymore.
(https://github.com/NixOS/nixpkgs-vet/wiki/NPV-162)
This PR introduces additional instances of discouraged patterns as listed above. Please fix them before merging.
error: Cannot build '/nix/store/69y050xrdffqxils57mrqw43cf90i0xf-nixpkgs-vet.drv'.
Reason: builder failed with exit code 1.
Output paths:
/nix/store/kxrknx65q0abw9m5mhpcivwhggpwm7l3-nixpkgs-vet
Last 6 log lines:
> - Attribute `pkgs.go_1_27` is a new top-level package using `pkgs.callPackage ./pkgs/development/compilers/go/1.27.nix { /* ... */ }`.
> Please define it in pkgs/by-name/go/go_1_27/package.nix instead.
> See `pkgs/by-name/README.md` for more details.
> Since the second `callPackage` argument is `{ }`, no manual `callPackage` in pkgs/top-level/all-packages.nix is needed anymore.
> (https://github.com/NixOS/nixpkgs-vet/wiki/NPV-162)
> This PR introduces additional instances of discouraged patterns as listed above. Please fix them before merging.
For full logs, run:
nix log /nix/store/69y050xrdffqxils57mrqw43cf90i0xf-nixpkgs-vet.drv
To run locally: ./ci/nixpkgs-vet.sh master https://github.com/NixOS/nixpkgs.git
If you're having trouble, ping @NixOS/nixpkgs-vet
Moving 1.27.nix into `pkgs/by-name/go/go_1_27/package.nix` is impractical because
the file references many sibling files in `pkgs/development/compilers/go/` (patches,
bootstrap files, etc.)
Follow `pkgs/by-name/README.md` and use `inherit` to please the vet linter.
[^0]: https://github.com/NixOS/nixpkgs/actions/runs/27820342521/job/82331726385?pr=533254#step:6:210
This commit was created by a combination of scripts and tools:
- an ast-grep script to prefix things in meta with `lib.`,
- a modified nixf-diagnose / nixf combination to remove unused `with
lib;`, and
- regular nixfmt.
Co-authored-by: Wolfgang Walther <walther@technowledgy.de>
Reverts default PIE patch for go.
Does not reintroduce usages of removed "pie" hardening flag.
I've made a right mess 😿; we have to back go default PIE out late.
building with -race was just reported broken, there isn't time to investigate.
fixing is a mass rebuild.
People are using nixpkgs' go outside of nix derivations to produce
executables to copy into containers. buildGoModule currently sets
buildmode=exe when CGO_ENABLED=0 but this does nothing to maintain the
existing interface for external users.
We are fortunate that backing out the go PIE change in this manner
does not reintroduce breakage of pkgsMusl.rclone etc
that previously occurred when buildmode=pie *wasn't* set.
The gcc `--enable-default-pie` approach turns out to not cause problems
when mixed with a non-PIE go externally linked build. Historical issues
were due to our linker wrapper being less smart about enabling PIE.
Default PIE for go should be revisited post branch off.
Fixes: #456953Fixes: #461539
To avoid breaking previous documented[^1] behavior of CGO_ENABLED=0
producing fully static binaries we set buildmode=exe. Sadly go
does not support static-pie binaries so this means these packages
lose ASLR.
This is likely to be revisited after branch-off, as
go packages in the main package set with CGO_ENABLED=0 not having
ASLR is not good security posture in the long term and makes
go packages inconsistent with other languages.
[1]: See #var-go-CGO_ENABLED
Fixes: #456953
Fixes: 08aadbf8d4
