nixos/nix

Nix, the purely functional package manager

Nix

Nix is a powerful package manager for Linux and other Unix systems that makes package management reliable and reproducible. Please refer to the Nix manual for more details.

Installation and first steps

Visit nix.dev for installation instructions and beginner tutorials.

Full reference documentation can be found in the Nix manual.

Building And Developing

See our Hacking guide in our manual for instruction on how to set up a development environment and build Nix from source.

Contributing

Check the contributing guide if you want to get involved with developing Nix.

Additional Resources

• Nix manual
• Nix jobsets on hydra.nixos.org
• NixOS Discourse
• Matrix - #nix:nixos.org

License

Nix is released under the LGPL v2.1.

nix's Issues

`nix-env --dry-run --delete-generations old` deletes old generations

I was just experimenting to see what nix-env --dry-run --delete-generations old would do, and was very surprised when I found out that it had actually deleted all my old generations! The expected behaviour is either: tell me that --dry-run isn't supported for --delete-generations old, or implement --dry-run for this operation

boost-1.49.0 broken

I'm not sure where to file nixpkgs bugs, but, AFAICT, 9s8lhx5bkhrsbx39cddyff8fvfy2x6n6-boost-1.49.0 is broken and I have absolutely no idea how to fix it, please help. ;)

# I'm using http://nixos.org/releases/nixpkgs/channels/nixpkgs-unstable updated as of now
$ nix-env -i boost-1.49.0
...lots of output....
source root is boost_1_49_0
patching sources
applying patch /nix/store/bqhfm0k07wl2yr4blwql697xqabky31m-boost_filesystem_post_1_49_0.patch
patching file libs/filesystem/v2/src/v2_path.cpp
configuring
configure flags: --prefix=/nix/store/9s8lhx5bkhrsbx39cddyff8fvfy2x6n6-boost-1.49.0 --with  icu=/nix/store/59l0kdmcc7id6iw3dgcjxdchyqih76yq-icu4c-4.8.1 --with-python=/nix/store/3kkhaa73laglcl1vz15apivq89y5rfxi-python-2.7.2/bin/python -n Building Boost.Build engine with toolset darwin... 
configure flags: --prefix=/nix/store/9s8lhx5bkhrsbx39cddyff8fvfy2x6n6-boost-1.49.0 --with-icu=/nix/store/59l0kdmcc7id6iw3dgcjxdchyqih76yq-icu4c-4.8.1 --with-    python=/nix/store/3kkhaa73laglcl1vz15apivq89y5rfxi-python-2.7.2/bin/python 
-n Building Boost.Build engine with toolset darwin... 
tools/build/v2/engine/bin.macosxx86_64/b2
-n Detecting Python version... 
2.7
-n Detecting Python root... 
/nix/store/3kkhaa73laglcl1vz15apivq89y5rfxi-python-2.7.2
-n Unicode/ICU support for Boost.Regex?... 
/nix/store/59l0kdmcc7id6iw3dgcjxdchyqih76yq-icu4c-4.8.1
Generating Boost.Build configuration in project-config.jam...

...lots and lots of output, ending with:
common.copy /nix/store/9s8lhx5bkhrsbx39cddyff8fvfy2x6n6-boost-1.49.0/include/boost/tr1/tr1/type_traits
common.copy /nix/store/9s8lhx5bkhrsbx39cddyff8fvfy2x6n6-boost-1.49.0/include/boost/tr1/tr1/typeinfo
common.copy /nix/store/9s8lhx5bkhrsbx39cddyff8fvfy2x6n6-boost-1.49.0/include/boost/tr1/tr1/unordered_map
common.copy /nix/store/9s8lhx5bkhrsbx39cddyff8fvfy2x6n6-boost-1.49.0/include/boost/tr1/tr1/unordered_set
common.copy /nix/store/9s8lhx5bkhrsbx39cddyff8fvfy2x6n6-boost-1.49.0/include/boost/tr1/tr1/utility
common.copy /nix/store/9s8lhx5bkhrsbx39cddyff8fvfy2x6n6-boost-1.49.0/include/boost/tr1/tr1/valarray
common.copy /nix/store/9s8lhx5bkhrsbx39cddyff8fvfy2x6n6-boost-1.49.0/include/boost/tr1/tr1/vector
...failed updating 178 targets...
...skipped 120 targets...
...updated 9859 targets...
builder for `/nix/store/r4jc2naqpxiv340d8nynm7chrmc5w5xq-boost-1.49.0.drv' failed with exit code 1
error: build of `/nix/store/r4jc2naqpxiv340d8nynm7chrmc5w5xq-boost-1.49.0.drv' failed

as a side note - where's the best place to file nixpkgs bugs, and can someone provide a very simple triage guide? ;)

No way to use NIX_OTHER_STORES readonly

I think the LocalStore constructor can't open the sqlite db in read-only mode, when
the 'copy-from-other-stores.pl' script runs "nix-store --check-validity" there.

The LocalStore::openDB in any case opens the sqlite database readonly, for what I saw (19d9762).

I'd really like to be able to use NIX_OTHER_STORES without being required writing access, and with the security of not writing anything to those.

Realising a missing output of a derivation with another output already valid

If derivation foo has outputs bar and baz and foo.baz is valid in the store but foo.bar isn't, there is currently no way to build foo.bar without invalidating foo.baz first. When chroot builds are enabled, we can just rebuild everything in the chroot, but when they aren't possible some form of hash rewriting will be necessary.

Don't crash in the garbage collector if the disk is full

Bad:

[root@kyle:/nix/var/nix/db]# df /nix/store/
Filesystem     1K-blocks      Used Available Use% Mounted on
/dev/sda2      453794636 453794636         0 100% /

[root@kyle:/nix/var/nix/db]# nix-store --gc
Bus error

chroot builds should have a (fake) domain name

Builds that run in a chroot environment have a fake hostname, but they don't have a fake domain name (say, example.org). This causes failures in tools like Git, that try to guess some kind of e-mail address of the local user.

assertion error during nix-env -u * -b --always

I'm using 1.2pre2980_9de6bc5:

$ nix-env --option binary-cache http://hydra.nixos.org -u \* --always -b --dry-run
(dry run; not doing anything)
nix-env: nix-env.cc:217: bool isPrebuilt(nix::EvalState&, const nix::DrvInfo&): Assertion `false' failed.
Aborted

Build timeout not passed to nix daemon

When using nix-store --timeout 1 -r .... via nix daemon, the timeout function does not work. Setting NIX_REMOTE to empty does work, so something does not get passed in build hook.

In chroot builds, allow paths in chroot different than in /

With a syntax in nix.conf allowing lines like:
build-chroot-dirs = /bin=/mystatic/bin

this would allow to avoid having to include /bin and /lib into the chroot of the builds. I think most people expect the chroot builds to allow getting rid of /lib and /bin in the builds.

In that example, /mystatic/bin could include a single statically built 'sh', and that should be enough to run a build in a system where nixpkgs has a pure stdenv, without any base-system files in the chroot.

Provide a binary distribution for Mac OS X

Ideal would be a dmg, but even just a tarball of the closure of Nix would be nice.

Multiple outputs usable in nixpkgs

I'd like to use this as a meta-issue linking to all the blockers that will need to be fixed before we can safely use multiple outputs in nixpkgs. @edolstra: could you make a list of what needs to be fixed? Or better yet make a bunch of issues and link to them here?

Binary cache substituter: Handle disappeared binaries gracefully

Fix the Solaris build

The Solaris build has never worked: http://hydra.nixos.org/build/2517738

nix-store --add-root --indirect --realise doesn't work properly when passed an output path instead of a drv path

This realises the hello derivation and creates a 'hello' symlink to it:

$ nix-store --add-root hello --indirect -r $(nix-instantiate -A hello "<nixpkgs>")

This realises the hello derivation but does not create the hello symlink:

$ nix-store --add-root hello --indirect -r $(nix-store -q --outputs $(nix-instantiate -A hello "<nixpkgs>"))

nix cannot be removed

I had to install nix once to build a project. After I was done with the project I tried removing nix, but this proved to be virtually impossible. I think future users / experimenters would appreciate it if it was possible to remove nix without scanning their entire hard drive for the word "nix" and deleting nix without deleting anything called unix or something.

nix-store returns with exit code 1 on cached failed build

When cached builds are enabled in nix.conf, when running 'nix-store -r ...drv' on a previously failed build, it returns with exit code 1. This confuses Hydra.

writableStore=false still makes the host store writable in build-vm

I have a virtual machine, of nixos master, with writableStore=false.

I can't see any 'aufs' in "mount" listings, and it can write files to the host /nix/store.

I was just running "nix-channels --update" in the guest, and it complained unpacking the nixexprs.tar about some "utime: Operation not permitted". But the manifest got unpacked into the store, and that file is also in my host store, while "nix-store --check-validity" reports that it's not valid.

nix-collect-garbage Bus error

Assumptions:
-/nix is on the same file system as /
-the file system holding / has no space available

In this state, run nix-collect-garbage.

The result is:

Core was generated by `/usr/bin/nix-store --gc'.
Program terminated with signal 7, Bus error.
#0 0x00007fd87a46c939 in ?? ()

(gdb) bt
#0 0x00007fd87a46c939 in ?? ()
#1 0x0000000000d6b1f8 in ?? ()
#2 0x0000000000000000 in ?? ()

Add an option to disable writing build logs

On Hydra build machines, it's pointless to write build logs to /nix/var/log/nix/drvs, since they're also kept on the main Hydra server. And since logs are not garbage-collected, they will eventually fill up the disk. So it would be nice to have an option to disable writing logs.

Deadlock in nix 1.1 worker

A build just failed here, and it deadlocked.

The last log:

configure: error: in `/tmp/nix-build-fcih4a43j39ad9dap2qin0h9n5h5bjxq-sharutils-4.11.1-mipsel-unknown-linux.drv-0/sharutils-4.11.1':
configure: error: cannot run test program while cross compiling
See `config.log' for more details
builder for `/nix/store/fcih4a43j39ad9dap2qin0h9n5h5bjxq-sharutils-4.11.1-mipsel-unknown-linux.drv' failed with exit code 1
building path(s) `/nix/store/m67l4ni17zijgq9c5zs13dd8gg9w431z-alsa-utils-1.0.26-mipsel-unknown-linux'
cannot build derivation `/nix/store/dgk0x9hnmz08sphjvnv88d35kc4mln3x-libarchive-2.8.3-mipsel-unknown-linux.drv': 1 dependencies couldn't be built
cannot build derivation `/nix/store/07fhl9bqrcbizanyj05fdf1r2avg8q1k-cmake-2.8.9-mipsel-unknown-linux.drv': 1 dependencies couldn't be built
cannot build derivation `/nix/store/i0vbbgwjybnm4sfa4aqxwjvxv9kg5m19-taskwarrior-2.1.2-mipsel-unknown-linux.drv': 1 dependencies couldn't be built

Then, I look at processes: pstree -p

        ├─nix-worker(1501)───nix-worker(4216)─┬─bash(19837)
        │                                     ├─bash(27946)───make(30564)───sh(30565)───make(31140)───make(31141)───make(31142)
        │                                     ├─copy-from-other(4219)
        │                                     └─download-using-(4220

Looking at 31142:

# strace -p 31142
Process 31142 attached
write(1, "\33[3s\33[a/nix/store/mpnj4k2ijrgyfk"..., 189
(Ctrl-C)
# ls -l /proc/31142/fd/1
l-wx------ 1 nixbld10 nixbld 64 20 oct 10:58 /proc/31142/fd/1 -> pipe:[588762]

I expect it's nix-worker reading it:

#  ls -l /proc/4216/fd
...
lr-x------ 1 root root 64 20 oct 10:59 21 -> pipe:[588762]
...

But stracing nix-worker, it's blocked at a waitpid:

# strace -p 4216
Process 4216 attached
waitpid(27946, 

So, I think that nix-worker kills the children, and waits for the child PID to die. But if the children write to stdout/stderr, and they fill the buffer, it can deadlock.

User land nix packages support

For cluster computing where you don't get root it would be very useful to have nixpkgs in user space. It would be so very useful!

Also, if that facility existed - package managers for languages and browsers could be based on Nix packaging (think Ruby/rvm, Firefox plugins, etc).

Static type system

Nix won't be complete until it has static typing.

Recursive Nix

Nix builders should be able to call Nix to build things. This is essential if we want to use Nix as a "low-level" build tool (i.e. as a Make replacement), since then we need to support derivations that unpack a source distribution containing a Nix expression to do the rest of the build.

Support building without Perl bindings

The Perl bindings are a problem on some platforms (in particular Cygwin and cross-compiled environments), so it would be nice if there was a configure flag to disable building them.

However, the Perl bindings are now used all over the place (e.g. in download-using-manifests), so we'd need some fallback code to handle the absense of the bindings. For instance, functions such as isValidPath() and queryPathHash() can be emulated slowly by calling nix-store.

Implement TTL for negative binary cache lookups

The manual does not mention NIX_CURRENT_LOAD

The NIX_BUILD_HOOK distributed with nix, build-remote.pl, requires NIX_CURRENT_LOAD set to work. The manual does not mention NIX_CURRENT_LOAD.

Release-notes

Regularly updated release notes is a nice way of keeping track of what has happened with the code.
They are much easier to keep track of then commits. They should probably both be announced on the nix-dev list and stored in the repository.

Binary distributions on FreeBSD 9 fail to complete nix-final-setup.

Binary builds

Neither binary builds of 1.1 or 1.2 head work on the latest daily FreeBSD 9.1 RC1.

Cause: libutil.so.8 is not available on FreeBSD 9.x+. Symlinking libutil.so.8 -> libutil.so.9 is popular but not recommended.

nix-prefetch-url says "curl: (48) An unknown option was passed in to libcurl"

$ nix-prefetch-url 'http://releases.mozilla.org/pub/mozilla.org/firefox/releases/16.0.1/source/firefox-16.0.1.source.tar.bz2'
curl: (48) An unknown option was passed in to libcurl
/run/current-system/sw/bin/nix-prefetch-url: download of ‘http://releases.mozilla.org/pub/mozilla.org/firefox/releases/16.0.1/source/firefox-16.0.1.source.tar.bz2’ failed

If I run the same command as root, with a different set of environment variables, it seems to work, so it's probably something in my environment or in my path. Let me know if you have ideas for further debugging.

Version: I ran nix-channel --update and nixos-rebuild recently (a few hours into October 12, UTC). The store path is /nix/store/427fx3ca6fgydyby0bkh9bvqgrnbvgdv-nix-1.1/bin/nix-prefetch-url

Nix should print sha256 hashes in the same format as nix-prefetch-url

When Nix downloads a package and finds that the hash doesn't match what it was expecting, it prints the actual hash it found in the long, hexadecimal format. Nix-prefetch-url, however, will use a shorter, base26-encoded format for sha256 hashes. IHMO, that is the format Nix should print, too.

Handle corrupt manifests more gracefully

• Maybe Nix should warn about corrupt manifests rather than die.
• Maybe corrupt SQLite caches should be deleted/recreated automatically.

nix-1.1

Free evaluation memory one nix-env finished the evaluation

That would free up lots of useless memory for the realisation of the build paths, once all .drv files have been generated.

Otherwise, it's hard to run two nix-env at once in the sheevaplug, even if one is only realising derivations.

Support private files in the Nix store

Sometimes it's desirable to have files in the Nix store that are not world-readable, such as configuration files containing passwords. This could be implemented as follows:

• Private files are marked as such by giving them a certain magic prefix to the name, e.g. p:. When these are registered, Nix should make them readable only to root (permission 0700) and the calling user (using an ACL). (The Nix daemon knows the uid of the caller.)
• The permissions on a derivation should be propagated to the output paths. Also, private derivations should be run with a umask of 0077.
• If another user attempts to register an already valid private file, then its uid should be added to the ACL of the file. If it's a derivation, then the uid should also be added to the ACLs of any valid outputs.
• Store operations that read files from the store (such as exportPath()) should check that the caller is in the ACL of the file.

So, for instance, if the root user builds a NixOS configuration containing some private files, then those files are only readable as root. If Alice builds the same configuration, then those files will be readable by root and Alice. If Alice then uses Charon to copy the configuration to a remote machine (i.e. nix-copy-closure --to root@remote ...), then the files on the remote machine will only be readable by root.

This model only allows files that are private to the instantiating user and root. So it doesn't support specifying a file that is readable only to the sshd user. But that's probably not necessary.

mkdir: cannot create directory `/nix/var/nix/profiles/per-user': Permission denied

Installed the nix 1.1- .deb package on 10.04 Lucid.

After Nix has been installed, whenever I login as a user (or otherwise run /etc/profile.d/nix.sh), I get the above error. The fix suggested in http://yellowgrass.org/issue/NixOS/149, chmod go+wt, works just fine.

The chmod'ing must also be done for the per-user gcroots directory.

Cryptographically verify manifests

We should cryptographically sign channel manifests, and nix-pull should verify them against a set of allowed keys. This way even non-root users could be allowed to do a nix-pull.

Set permissions on temporary build directories to 0700?

The CVE-2012-3386 issue in libpng (unpacked source tarball was world-writable, allowing other users to interfere with the build) made me think that maybe we should change the permissions on /tmp/nix-build-* to 0700 to prevent this kind of scenario.

The downside is that you wouldn't be able to inspect what's going on in a build while it's running. (When -K is given, we should at least change the permissions back to 0755 after the build fails.)

nix-instantiate terminated by signal 11, --show-trace has no effect

Define the following attribute in ~/.nixpkgs/config.nix

{
  packageOverrides = pkgs:
  {
    crashNix = pkgs.haskellPackages.ghcWithPackages (self: [pkgs.haskellPackages.hledgerWeb]);
  };
}

and run:

$ nix-build ~/.nix-defexpr -A crashNix --show-trace
nix-instantiate killed by signal 11

This may very well be a bug in the ghtWithPackages expression, but I'm having a hard time finding out what the problem might be (since that wrapper works just fine for almost any other attribute set). Any suggestions how to remedy this issue are highly welcome.

Support for decentralization

Currently nix expressions can only refer to paths on the file system. It would be interesting if nix would also support fetching expressions from arbitrary (web) sources. With digital signatures it would be as secure as it currently is. Could the format be as simple as
aria2 = callPackage http://www.nixos.org/.../aria2 { };
in all-packages.nix instead of
aria2 = callPackage ../tools/networking/aria2 { };
?

0install is an example of how useful this is at least (http://0install.net/comparison.html).

nix 1.0 released source tried to build manual anyway

I haven't run bootstrap.sh but got the error as http://article.gmane.org/gmane.linux.distributions.nixos/6303/match=xmllint anyway
Does simply "make install" work?
You should fix the manual. This is confusing.

Failed to compile nix on cygwin

make[2]: 进入目录“/cygdrive/c/nix-1.0/doc”
Making all in manual
make[3]: 进入目录“/cygdrive/c/nix-1.0/doc/manual”
false --nonet --xinclude manual.xml -o manual.xmli.tmp
Makefile:558: recipe for target manual.xmli' failed make[3]: *** [manual.xmli] Error 1 make[3]: 离开目录“/cygdrive/c/nix-1.0/doc/manual” Makefile:295: recipe for targetall-recursive' failed
make[2]: *** [all-recursive] Error 1
make[2]: 离开目录“/cygdrive/c/nix-1.0/doc”
Makefile:392: recipe for target all-recursive' failed make[1]: *** [all-recursive] Error 1 make[1]: 离开目录“/cygdrive/c/nix-1.0” Makefile:304: recipe for targetall' failed
make: *** [all] Error 2

Looks like something is wrong with the manual.

Nix daemon should use seccomp filtering

The Nix daemon runs as root because it needs to do privileged operations like starting a builder under a different uid. This is bad because it presents a fairly big attack surface. We should investigate seccomp filtering for restricting what the daemon can do (e.g. only modify files in the Nix store, change uid to nixbld-*, and so on).

(There is nix-setuid-helper, but it's not currently used because it doesn't support things like chroot builds. And setuid programs are evil.)

Update nix-push manpage

zsh/bash/... completion for nix* commands

It would be great if there would be shell completion for all nix commands, like:

% git a<TAB>
add         -- add file contents to index
ai          -- alias for 'add -i'
am          -- apply patches from a mailbox
ap          -- alias for 'add -p'
apply       -- apply patch to files and/or to index
archimport  -- import an Arch repository into git
archive     -- create archive of files from named tree

Nix leaks fds to the builders

I imagine this is an important security threat.

Any builder process child I see, has these 3, 4 and 8 fds opened that look like coming from nix.
I've seen the 255 only in the 'bash' one. This example is building a sqlite expression using the worker.

lrwx------ 1 nixbld2 nixbld 64 14 abr 23:19 0 -> /nix/store/r1y7d0phrmz3dpm4ffhl92cr8pc433bl-sqlite-3.7.9-full.drv.chroot/dev/null
l-wx------ 1 nixbld2 nixbld 64 14 abr 23:19 1 -> pipe:[118866]
l-wx------ 1 nixbld2 nixbld 64 14 abr 23:19 2 -> pipe:[118866]
lr-x------ 1 nixbld2 nixbld 64 14 abr 23:19 255 -> /nix/store/r1y7d0phrmz3dpm4ffhl92cr8pc433bl-sqlite-3.7.9-full.drv.chroot/nix/store/9krlzvny65gdc8s7kpb6lkx8cd02c25b-default-builder.sh
lrwx------ 1 nixbld2 nixbld 64 14 abr 23:19 3 -> socket:[7864]
lrwx------ 1 nixbld2 nixbld 64 14 abr 23:19 4 -> socket:[118851]
lrwx------ 1 nixbld2 nixbld 64 14 abr 23:19 8 -> /nix/var/nix/db/db.sqlite-shm

nix-env -i haskell-haskell-platform-ghc7.6.1-2012.2.0.0 # assertion failed

[root@freebsd ~]# nix-env -i haskell-haskell-platform-ghc7.6.1-2012.2.0.0
installing `haskell-haskell-platform-ghc7.6.1-2012.2.0.0'
error: assertion failed at `/nix/store/rcwjawql0ck2nbrnpkqgrgxjm2k42z3q-nixpkgs-1.0pre21403_def0189/nixpkgs/pkgs/development/compilers/ghc/7.0.4-binary.nix:7:1'
(use `--show-trace' to show detailed location information)
[root@freebsd ~]# nix-env -i haskell-haskell-platform-ghc7.6.1-2012.2.0.0 --show-trace
installing `haskell-haskell-platform-ghc7.6.1-2012.2.0.0'
error: while evaluating the builtin function `derivationStrict':
while instantiating the derivation named `haskell-haskell-platform-ghc7.6.1-2012.2.0.0' at `/nix/store/rcwjawql0ck2nbrnpkqgrgxjm2k42z3q-nixpkgs-1.0pre21403_def0189/nixpkgs/pkgs/build-support/cabal/default.nix:36:13':
while evaluating the derivation attribute `buildNativeInputs' at `/nix/store/rcwjawql0ck2nbrnpkqgrgxjm2k42z3q-nixpkgs-1.0pre21403_def0189/nixpkgs/pkgs/stdenv/generic/default.nix:67:15':
while evaluating the builtin function `getAttr':
while evaluating the builtin function `derivationStrict':
while instantiating the derivation named `ghc-7.6.1-wrapper' at `/nix/store/rcwjawql0ck2nbrnpkqgrgxjm2k42z3q-nixpkgs-1.0pre21403_def0189/nixpkgs/pkgs/development/compilers/ghc/wrapper.nix:8:3':
while evaluating the derivation attribute `propagatedBuildNativeInputs' at `/nix/store/rcwjawql0ck2nbrnpkqgrgxjm2k42z3q-nixpkgs-1.0pre21403_def0189/nixpkgs/pkgs/stdenv/generic/default.nix:69:15':
while evaluating the builtin function `getAttr':
while evaluating the builtin function `derivationStrict':
while instantiating the derivation named `ghc-7.6.1' at `/nix/store/rcwjawql0ck2nbrnpkqgrgxjm2k42z3q-nixpkgs-1.0pre21403_def0189/nixpkgs/pkgs/development/compilers/ghc/7.6.1.nix:6:3':
while evaluating the derivation attribute `buildNativeInputs' at `/nix/store/rcwjawql0ck2nbrnpkqgrgxjm2k42z3q-nixpkgs-1.0pre21403_def0189/nixpkgs/pkgs/stdenv/generic/default.nix:67:15':
while evaluating the function at `/nix/store/rcwjawql0ck2nbrnpkqgrgxjm2k42z3q-nixpkgs-1.0pre21403_def0189/nixpkgs/pkgs/lib/meta.nix:41:13':
while evaluating the function at `/nix/store/rcwjawql0ck2nbrnpkqgrgxjm2k42z3q-nixpkgs-1.0pre21403_def0189/nixpkgs/pkgs/lib/meta.nix:13:28':
while evaluating the function at `/nix/store/rcwjawql0ck2nbrnpkqgrgxjm2k42z3q-nixpkgs-1.0pre21403_def0189/nixpkgs/pkgs/lib/customisation.nix:98:35':
while evaluating the function at `/nix/store/rcwjawql0ck2nbrnpkqgrgxjm2k42z3q-nixpkgs-1.0pre21403_def0189/nixpkgs/pkgs/lib/customisation.nix:59:24':
while evaluating the builtin function `isAttrs':
while evaluating the function at `/nix/store/rcwjawql0ck2nbrnpkqgrgxjm2k42z3q-nixpkgs-1.0pre21403_def0189/nixpkgs/pkgs/development/compilers/ghc/7.0.4-binary.nix:1:1':
assertion failed at `/nix/store/rcwjawql0ck2nbrnpkqgrgxjm2k42z3q-nixpkgs-1.0pre21403_def0189/nixpkgs/pkgs/development/compilers/ghc/7.0.4-binary.nix:7:1'

Sign released Nix tarballs

Official releases should be cryptographically signed off-site.

Building nix requires gnumake on FreeBSD

According to 'tt79' in the channel, building nix with BSD make fails with
make: don't know how to make schema.sql.hh. Stop

We should probably either document the requirement or make our makefiles more generic.

"Operation not permitted" errors due to race condition in clearing/setting the immutable bit

Example (http://hydra.nixos.org/build/2488954):

building path(s) `/nix/store/3ap0adrzz2xz5b6my1pfwrry7j08ar9r-nixos-test-driver'
error: linking `/nix/store/2z2ff51yskqm44kddd10hv4xg2mp40lp-nixos-test-driver.drv.chroot/nix/store/c1n81qbnpp98npc6idkkk4a4z8jnzw1s-upstart-udevtrigger.conf' to `/nix/store/c1n81qbnpp98npc6idkkk4a4z8jnzw1s-upstart-udevtrigger.conf': Operation not permitted

This is due to build.cc:

makeMutable(*i);
link(i->c_str(), ...);
makeImmutable(*i);

If two processes do this at the same time, one may call makeImmutable() before the other has called link().

Nix on Cygwin doesn't work because DBD::SQLite doesn't work

$ perl -e 'use DBD::SQLite;'
Can't load '/nix/store/nxy9c2s5443al8g601fjlg62idbzqh0w-perl-DBD-SQLite-1.35/lib/perl5/site_perl/5.10/i686-cygwin/auto/DBD/SQLite/SQLite.dll' for module DBD::SQLite: No such process at /usr/lib/perl5/5.10/i686-cygwin/DynaLoader.pm line 200.
 at -e line 1
Compilation failed in require at -e line 1.
BEGIN failed--compilation aborted at -e line 1.

The "No such process" error may be related to the base address of the DLL, but changing it using the "--image-base=..." linker flag didn't help. Running "rebaseall" didn't help either (but then it doesn't look in the Nix store so that's not surprising).