{ids,checks}: update for new builder UID/GID values #1069
+120
−25
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,17 @@ | ||
| 2024-09-10 | ||
| - The default Nix build user group ID is now set to 350 when | ||
| `system.stateVersion` ≥ 5, to reflect the default for new Nix | ||
| installations. This only affects installations that enable | ||
| `nix.configureBuildUsers`, and any divergence will be detected on | ||
| system activation. To use `nix.configureBuildUsers` with a higher | ||
| `system.stateVersion` on installations using the old group ID, set: | ||
|
|
||
| ids.gids.nixbld = 30000; | ||
|
|
||
| We do not recommend trying to change the group ID with macOS user | ||
| management tools without a complete uninstallation and reinstallation | ||
| of Nix. | ||
|
|
||
| 2024-06-15 | ||
| - SECURITY NOTICE: The previous implementation of the | ||
| `users.users.<name>.openssh.authorizedKeys.*` options would not delete | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -32,7 +32,7 @@ | |
|
|
||
| # Used for backwards compatibility, please read the changelog before changing. | ||
| # $ darwin-rebuild changelog | ||
| system.stateVersion = 5; | ||
|
|
||
| # The platform the configuration will be used on. | ||
| nixpkgs.hostPlatform = "x86_64-darwin"; | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -25,5 +25,5 @@ with lib; | |
|
|
||
| # Used for backwards compatibility, please read the changelog before changing. | ||
| # $ darwin-rebuild changelog | ||
| system.stateVersion = 5; | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -21,5 +21,5 @@ | |
|
|
||
| # Used for backwards compatibility, please read the changelog before changing. | ||
| # $ darwin-rebuild changelog | ||
| system.stateVersion = 5; | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -8,7 +8,7 @@ | |
| # to change uids/gids on service start, in example a service with a lot of | ||
| # files. | ||
|
|
||
| { lib, config, ... }: | ||
|
|
||
| let | ||
| inherit (lib) types; | ||
|
|
@@ -34,15 +34,14 @@ in | |
|
|
||
| }; | ||
|
|
||
| config = { | ||
|
|
||
| ids.uids = { | ||
| nixbld = lib.mkDefault 350; | ||
| }; | ||
|
|
||
| ids.gids = { | ||
| nixbld = lib.mkDefault (if config.system.stateVersion < 5 then 30000 else 350); | ||
| }; | ||
|
|
||
| }; | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -46,13 +46,52 @@ let | |
|
|
||
| oldBuildUsers = '' | ||
| if dscl . -list /Users | grep -q '^nixbld'; then | ||
| echo "[1;31merror: Detected old style nixbld users, aborting activation[0m" >&2 | ||
| echo "These can cause migration problems when upgrading to certain macOS versions" >&2 | ||
| echo "You can enable the following option to migrate to new style nixbld users" >&2 | ||
| echo >&2 | ||
| echo " nix.configureBuildUsers = true;" >&2 | ||
| echo >&2 | ||
| echo "or disable this check with" >&2 | ||
| echo >&2 | ||
| echo " system.checks.verifyBuildUsers = false;" >&2 | ||
| echo >&2 | ||
| exit 2 | ||
| fi | ||
| ''; | ||
|
|
||
| preSequoiaBuildUsers = '' | ||
| ${lib.optionalString config.nix.configureBuildUsers '' | ||
| # Don’t complain when we’re about to migrate old‐style build users… | ||
| if ! dscl . -list /Users | grep -q '^nixbld'; then | ||
| ''} | ||
| firstBuildUserID=$(dscl . -read /Users/_nixbld1 UniqueID | awk '{print $2}') | ||
| if [[ $firstBuildUserID != ${toString (config.ids.uids.nixbld + 1)} ]]; then | ||
| printf >&2 '\e[1;31merror: Build users have unexpected UIDs, aborting activation\e[0m\n' | ||
| printf >&2 'The default Nix build user ID range has been adjusted for\n' | ||
| printf >&2 'compatibility with macOS Sequoia 15. Your _nixbld1 user currently has\n' | ||
| printf >&2 'UID %d rather than the new default of 351.\n' "$firstBuildUserID" | ||
| printf >&2 '\n' | ||
| printf >&2 'You can automatically migrate your users using the following script\n' | ||
| printf >&2 'from the Nix repository:\n' | ||
| printf >&2 '\n' | ||
| printf >&2 ' https://github.com/NixOS/nix/raw/master/scripts/sequoia-nixbld-user-migration.sh\n' | ||
| printf >&2 '\n' | ||
| printf >&2 'This should work even if you installed Nix with the Determinate\n' | ||
| printf >&2 'Systems installer or are using Lix. If you are comfortable using the\n' | ||
| printf >&2 'script without review, you can run:\n' | ||
| printf >&2 '\n' | ||
| printf >&2 " curl --proto '=https' --tlsv1.2 -sSf -L https://github.com/NixOS/nix/raw/master/scripts/sequoia-nixbld-user-migration.sh | bash -\n" | ||
| printf >&2 '\n' | ||
| printf >&2 'If you have no intention of upgrading to macOS Sequoia 15, or already\n' | ||
| printf >&2 'have a custom UID range that you know is compatible with Sequoia, you\n' | ||
| printf >&2 'can disable this check by setting:\n' | ||
| printf >&2 '\n' | ||
| printf >&2 ' ids.uids.nixbld = %d;\n' "$((firstBuildUserID - 1))" | ||
| printf >&2 '\n' | ||
| exit 2 | ||
| fi | ||
| ${lib.optionalString config.nix.configureBuildUsers "fi"} | ||
| ''; | ||
|
|
||
| buildUsers = '' | ||
|
|
@@ -70,6 +109,32 @@ let | |
| fi | ||
| ''; | ||
|
|
||
| buildGroupID = '' | ||
| buildGroupID=$(dscl . -read /Groups/nixbld PrimaryGroupID | awk '{print $2}') | ||
| expectedBuildGroupID=${toString config.ids.gids.nixbld} | ||
| if [[ $buildGroupID != $expectedBuildGroupID ]]; then | ||
| printf >&2 '\e[1;31merror: Build user group has mismatching GID, aborting activation\e[0m\n' | ||
| printf >&2 'The default Nix build user group ID was changed from 30000 to 350.\n' | ||
| printf >&2 'You are currently managing Nix build users with nix-darwin, but your\n' | ||
| printf >&2 'nixbld group has GID %d, whereas we expected %d.\n' \ | ||
| "$buildGroupID" "$expectedBuildGroupID" | ||
| printf >&2 '\n' | ||
| printf >&2 'Possible causes include setting up a new Nix installation with an\n' | ||
| printf >&2 'existing nix-darwin configuration, setting up a new nix-darwin\n' | ||
| printf >&2 'installation with an existing Nix installation, or manually increasing\n' | ||
| printf >&2 'your `system.stateVersion` setting.\n' | ||
| printf >&2 '\n' | ||
| printf >&2 'You can set the configured group ID to match the actual value:\n' | ||
| printf >&2 '\n' | ||
| printf >&2 ' ids.gids.nixbld = %d;\n' "$buildGroupID" | ||
| printf >&2 '\n' | ||
| printf >&2 'We do not recommend trying to change the group ID with macOS user\n' | ||
| printf >&2 'management tools without a complete uninstallation and reinstallation\n' | ||
| printf >&2 'of Nix.\n' | ||
| exit 2 | ||
| fi | ||
| ''; | ||
|
|
||
| singleUser = '' | ||
| if grep -q 'build-users-group =' /etc/nix/nix.conf; then | ||
| echo "[1;31merror: The daemon is not enabled but this is a multi-user install, aborting activation[0m" >&2 | ||
|
|
@@ -242,7 +307,9 @@ in | |
|
|
||
| system.checks.verifyBuildUsers = mkOption { | ||
| type = types.bool; | ||
| default = | ||
| (config.nix.useDaemon && !(config.nix.settings.auto-allocate-uids or false)) | ||
| || config.nix.configureBuildUsers; | ||
| description = "Whether to run the Nix build users validation checks."; | ||
| }; | ||
|
|
||
|
|
@@ -258,8 +325,10 @@ in | |
| system.checks.text = mkMerge [ | ||
| darwinChanges | ||
| runLink | ||
| (mkIf (cfg.verifyBuildUsers && !config.nix.configureBuildUsers) oldBuildUsers) | ||
| (mkIf cfg.verifyBuildUsers buildUsers) | ||
| (mkIf cfg.verifyBuildUsers preSequoiaBuildUsers) | ||
| (mkIf config.nix.configureBuildUsers buildGroupID) | ||
| (mkIf (!config.nix.useDaemon) singleUser) | ||
| nixStore | ||
| (mkIf (config.nix.gc.automatic && config.nix.gc.user == null) nixGarbageCollector) | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -35,7 +35,7 @@ in | |
| options = { | ||
| system.stateVersion = mkOption { | ||
| type = types.int; | ||
| default = 5; | ||
| description = '' | ||
| Every once in a while, a new NixOS release may change | ||
| configuration defaults in a way incompatible with stateful | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The manual should be updated to 24.05 as well
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It already was, I think.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
https://github.com/LnL7/nix-darwin/blob/master/.github/workflows/update-manual.yml#L24
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ah, I thought you meant the README. I can handle this but would prefer to do it in a separate PR given the urgency of this one.