the `patchShebangs` in `postPatch` is for tools that are invoked at
build-time. we don't want to patch the shebangs this early in the
derivation for anything that would later be installed, so scope it more
narrowly.
also be more hygienic with the shell-related `buildInputs`/`nativeBuildInputs`.
This should be a more general fix than the original windows one. This
is needed because upstream uses `EXEEXT` for build stuff:
# FIXME: Build file natively as well so that it can be used to compile
# the target's magic file; for now we bail if the local version does not
match
if IS_CROSS_COMPILE
FILE_COMPILE = file${EXEEXT}
FILE_COMPILE_DEP =
else
FILE_COMPILE = $(top_builddir)/src/file${EXEEXT}
FILE_COMPILE_DEP = $(FILE_COMPILE)
endif
The new export check mechanic introduced in #475112 does check whether or not the `strict-export` setting is set for *cgit* to catch configurations with lacking or superfluous options.
This change ensures that the assert statements do not cause evaluation errors when the setting is absent.
Instead the absense is handled appropriately for each assert.
When the option is required to be set to a specific value it will cause the assertion to fail, thereby displaying the assertion message rather than an evaluation error.
In case the option is required to be unset it may now be either null or unset, instead of failing the evaluation.
As an example, prior to this commit having `checkExportOkFiles` set to false, and `strict-export` entirely unset did fail the evaluation of the assert.
Now this is a valid pattern, meaning users who want to allow access to all repositories need only specify `checkExportOkFiles = false`, and can leave `strict-export` unset.
Signed-off-by: benaryorg <binary@benary.org>
# Changelog: Nix 2.32.5
## Bug Fixes
### Critical Crashes Fixed
- **Fix heap-use-after-free crash under high build load** ([#14772](https://github.com/NixOS/nix/pull/14772))
Fixed a daemon segfault that could occur under high build load. The issue was caused by the `initialOutputs` field referencing data from an activation frame that had gone out of scope during coroutine tail-call optimization in the build scheduler.
- **Fix segfault when querying non-existent derivation files** ([#14571](https://github.com/NixOS/nix/issues/14571), [#14572](https://github.com/NixOS/nix/pull/14572))
Running `nix derivation show /nix/store/...-doesnotexist.drv` would crash with a segfault. Now properly returns an "invalid store path" error.
- **Fix RestrictedStore::addDependency crash** ([#14729](https://github.com/NixOS/nix/pull/14729))
Fixed a crash caused by incorrect non-virtual interface pattern implementation that led to bad recursion/UB in `addDependencyPrep`.
### Regressions Fixed
- **Fix "dynamic attributes not allowed in let" regression** ([#14642](https://github.com/NixOS/nix/issues/14642), [#14646](https://github.com/NixOS/nix/pull/14646))
Expressions like `let a = 1; "b" = 2; ${"c"} = 3; in [ a b c ]` that worked in 2.30 would incorrectly fail in 2.32.x. This was caused by the ExprString arena optimization, which has been reverted.
- **Fix fetchGit with `ref = "HEAD"` regression** ([#13948](https://github.com/NixOS/nix/issues/13948), [#14672](https://github.com/NixOS/nix/pull/14672))
`fetchGit { url = "..."; ref = "HEAD"; }` was broken and returned "revspec 'HEAD' not found".
- **Fix unnecessary substituter queries** ([#14836](https://github.com/NixOS/nix/issues/14836), [#14837](https://github.com/NixOS/nix/pull/14837))
Fixed a regression where Nix would query all substituters (including `cache.nixos.org`) even when a higher-priority local substituter already had the path. This caused unnecessary network traffic.
### Platform-Specific Fixes
- **Fix curl with c-ares failing DNS resolution in macOS sandbox** ([#14792](https://github.com/NixOS/nix/pull/14792))
When curl is built with c-ares (as in recent nixpkgs), DNS resolution would fail inside the Nix build sandbox on macOS with "Could not contact DNS servers".
### Store & File System Fixes
- **Fix file system race conditions in store optimization** ([#14676](https://github.com/NixOS/nix/pull/14676), [#7273](https://github.com/NixOS/nix/issues/7273))
Multiple fixes to `optimizePath_`:
- Actually call `remove()` when `rename()` fails
- Propagate error codes in `createSymlink()`
- Make `AutoDelete` non-copyable and non-movable to prevent use-after-free
## Improvements
- **Include path in world-writable error messages** ([#14785](https://github.com/NixOS/nix/pull/14785))
The error message for world-writable directory checks now includes the specific path that failed, making debugging easier.
- **Documentation: correct `build-dir` error information** ([#14745](https://github.com/NixOS/nix/pull/14745))
Fixed out-of-date information in the manual about `build-dir` errors and added links to relevant settings.
## Maintenance
- CI improvements: added `upload-release.yml` workflow, improved Docker push workflow configurability, updated magic-nix-cache with post-build-hook fix
- Documented maintainer git tag signing process
- Fixed lowdown override compatibility with newer nixpkgs
- Removed mdbook-linkcheck and added support for mdbook 0.5.x
- Remove static data from headers to fix compilation issues
- **Fix heap-use-after-free crash under high build load** ([#14772](https://github.com/NixOS/nix/pull/14772))
---
Diff: https://github.com/NixOS/nix/compare/2.32.4...2.32.5
Philip Taron