Upstream tracking - #165
Draft
grahamc wants to merge 4233 commits into
Draft
Conversation
Move the mi_register_error() call before initLibUtil() so that allocation failures during initialization also invoke outOfMemory() instead of mimalloc's silent abort. Also handle EFAULT (heap corruption detected in secure mode) by calling panic(), preserving fatal behavior but with a proper error message. Assisted-by: Claude Fable 5 <noreply@anthropic.com>
Handle out-of-memory crashes better
getDefaultRef() guessed 'master' (with a warning) when a local repo had a detached HEAD, e.g. a CI worktree fetched as git+file:///wt?rev=.... That branch may not even exist. libgit2 resolves 'HEAD' just fine, so use it instead of guessing. Co-authored-by: Gaetan Lepage <gaetan@glepage.com> (cherry picked from commit c34d30c)
With submodules=false, getAccessorFromCommit() renders a gitlink as an empty directory (like `git archive`), but getAccessorFromWorkdir() omitted the path entirely. Fetching git+file:///repo and git+file:///repo?rev=HEAD thus gave different narHashes for the same rev, and since both share a fingerprint, one poisoned the fetchToStore cache for the other. This breaks nix-eval-jobs on repos with submodules: the flake is locked from the workdir, workers re-fetch the __final input by rev and fail with a narHash mismatch. Enumerate submodules in the workdir from gitlinks in the index instead of from .gitmodules (which only supplies URLs), and mount an empty directory over each one that is not fetched, so the workdir accessor matches the commit accessor in all cases, including gitlinks without a .gitmodules entry. Fixes NixOS#13698. Addresses NixOS#15423 for the workdir case. Supersedes NixOS#14779. Co-authored-by: Jörg Thalheim <joerg@thalheim.io> Co-authored-by: Julian Kuners <julian.kuners@gmail.com> Assisted-by: OpenCode (GPT-5.6 Sol) (cherry picked from commit 52546ba)
…tenance [Backport 2.35-maintenance] git fetcher: avoid resolving HEAD for pinned revisions
…tenance [Backport 2.35-maintenance] libfetchers/git: render submodules as empty dirs in workdir accessor
(cherry picked from commit fa4f255)
…tenance [Backport 2.35-maintenance] Convert stdenv.isLinux to stdenv.hostPlatform.isLinux
This was introduced by a bad merge. Fixes #591.
Fix forwarding netrc-file to the daemon
sentry_init() spawns worker threads. When it ran before initNix() (and thus before startSignalHandlerThread() blocks SIGINT etc. in the calling thread), those threads inherited a signal mask with SIGINT unblocked, so the kernel could deliver a Ctrl-C's SIGINT to one of them. Its default disposition then killed the process immediately, without printing "error: interrupted by the user" or restoring the terminal cursor hidden by the progress bar. Initializing Sentry after initNix() makes its threads inherit the blocked mask, so SIGINT is only received by the signal handler thread via sigwait(), as intended. The SIGQUIT reset that undoes Sentry's crash handler for it moves along, since it must run after sentry_init(). Assisted-by: Claude Fable 5 <noreply@anthropic.com>
Sync with upstream 2.35-maintenance
Fix Ctrl-C handling when Sentry is enabled
The in-memory cached value was created with an empty context `{}` instead
of copying the actual context from the value. This caused string contexts
to be lost even though they were correctly written to the database.
When setAttrs "seals" an attrset (transitions from Placeholder to FullAttrs), the previous INSERT OR REPLACE would delete and recreate the row with a new rowid. This orphaned any children cached under the old rowid, causing cache misses on subsequent builds. This explains the "third time's a charm" behavior: on the 2nd build, orphaned children are re-cached under the new parent rowid. With deeper nesting, even more evaluations could be required as each level of sealing orphans the next level's children. Fix by using INSERT ... ON CONFLICT DO UPDATE (upsert) to preserve the rowid, and INSERT OR IGNORE for children to preserve existing cached values. Also delete redundant Missing entries since we now know the complete set. This requires SQLite >= 3.35 for the RETURNING clause, now declared as an explicit dependency of libexpr.
Verify that evaluation caching works on the second build by checking that builtins.trace output only appears on the first evaluation.
Eval cache: make the second evaluation hit the cache
Fixes #589. Assisted-by: Claude Fable 5 <noreply@anthropic.com>
doc: mention that flake metadata's `Path` field is absent with lazy-trees
With duplicate installables (e.g. 'nix build nixpkgs#hello nixpkgs#hello nixpkgs#hello'), Installable::build2() pushed the same DerivedPath into pathsToBuild once per installable, while also recording each installable in backmap. Since buildPathsWithResults() returns one result per request, fanning each of the n results out to all n backmap entries produced n² results — printing every output path n² times with --print-out-paths, and likewise duplicating --json entries and --out-link symlinks. Instead, record all requests in a vector in command-line order and deduplicate pathsToBuild separately, then produce results by looking up each request's build result. This yields exactly one result per installable while preserving command-line order even when duplicates are interleaved (e.g. 'nix build A B A' yields results for A, B, A rather than grouping the duplicates). Assisted-by: Claude Fable 5 <noreply@anthropic.com>
Deduplicate `nix build --print-out-paths` output
Flake lock file updates:
• Updated input 'nix':
'path:../..'
→ 'path:../..'
• Updated input 'nix/nixpkgs':
'https://api.flakehub.com/f/pinned/DeterminateSystems/secure-packages-26.05/0.1.1013487%2Brev-01649628bfcaf28024737daec63d559fe0463e6c/01a04eb4-9c90-76b3-a3fb-a92559e04618/source.tar.gz' (2026-08-29)
→ 'https://api.flakehub.com/f/pinned/DeterminateSystems/secure-packages-26.05/0.1.1013502%2Brev-88369aab48f8d2b0f69126d306c5af06e997849b/01a05deb-f862-7c32-a065-599b037b2e53/source.tar.gz' (2026-09-01)
Also drop the Nix version number down to 2.35.2 since there is no 2.35.3 yet.
…155-5448-44f2-91c4-896668aef46a Release v3.22.3
The crashpad handler writes a crash's minidump by ptrace-attaching to the crashing process. With kernel.yama.ptrace_scope >= 2 ptrace is reserved for CAP_SYS_PTRACE, which an unprivileged test run does not have (PR_SET_PTRACER only helps at scope 1), so no dump can ever be captured and every crash type fails with 'No crash dump found'. Skip the test on such kernels, matching the existing per-platform skips. Observed as a deterministic nix-functional-tests:sentry failure when building determinate-nix inside an unprivileged CI sandbox on a hardened host (Talos Linux, ptrace_scope=2), while the same derivation builds clean on a workstation with ptrace_scope=1.
…der-yama tests/functional: skip the sentry test when Yama restricts ptrace
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
14 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Not intended to be merged directly. This PR is a convenience to show the diff between upstream Nix and Determinate Nix (the
mainbranch).Continuation of #4.