Content-addressed derivation fails to build on aarch64-darwin #6065
Assignees
Labels
Comments
|
I would like to add that I ran into the same issue with nix 2.7.0 on aarch64-darwin (macOS 12.3.1). |
|
I was able to reproduce with this minimal example by running both {
description = "A flake for building Hello World";
inputs.nixpkgs.url = github:NixOS/nixpkgs/nixpkgs-unstable;
outputs = { self, nixpkgs }:
let
system = "aarch64-darwin";
in
with import nixpkgs { inherit system; config.contentAddressedByDefault = true; };
{ packages.${system}.default = stdenv.mkDerivation { name = "hello"; buildInputs = [hello]; }; };
}Console log: |
|
After looking a bit at this (as much as possible given that I don’t have a relevant machine handy, I’d say that the issue is that
I’m not sure what the correct solution would be. A solution could be to change
That’s not really pretty nor efficient, but that would keep most of the benefits of CA derivations (at least early-cutoff would still work as expected), and work |
|
Alternatively, this could be handled internally by Nix, with a hook to sign the binaries after the hash rewriting. This has a couple of potential issues − a mac user could confirm whether they are actual issues or not:
|
|
This issue has been mentioned on NixOS Discourse. There might be relevant details there: https://discourse.nixos.org/t/tweag-nix-dev-update-29/18903/1 |
12 tasks
|
Gentle ping. I'd love to start using CA for my project but this issue is blocking me. Can I do anything to help? |
|
@eliasnaur if you have the time and skills for that, trying out the solution from #6065 (comment) could be very helpful. Outside of that, my macOS knowledge is unfortunately too thin to really see a path |
|
I really wanted content-addressed derivations while working on NixOS/nixpkgs#240433. 😭 Fortunately, I have a solution. It’s similar to @thufschmitt’s first option. However, I want to address the second before I discuss how to handle signatures. The detached signatures DB is just a SQLite, so Nix could update it every time a path is added or removed. However, it’s undocumented, so I would be wary of relying on the schema not to change. It’s owned and only writeable by root. While the daemon does run as root today, that could change if a solution to #789 is implemented). According to the documentation, there are four different ways a file can be signed on macOS.
I’m only going to focus on the first one because I don’t think we generate The approach I’m suggesting is similar to how Nix handles self-references. Before it calculates a content hash, it would check if the file is a Mach-O binary with a The following is a series of shell commands manually demonstrating these steps. I don’t know that this is the way it would be implemented in Nix, but this is done using open source tools. The |
|
This issue has been mentioned on NixOS Discourse. There might be relevant details there: https://discourse.nixos.org/t/ca-derivations-is-disabled-regardless-of-config-on-mac-os/33550/2 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Content-addressed derivations fail to build on aarch64-darwin. If I build for
--system x86_64-darwin, it gets past this point and fails in another place (which I suspect is not a Nix issue but possibly a nixpkgs one). The error message indicates thatmkdirwas killed. The system logs indicate that it was due to invalid codesigning.Steps To Reproduce
nix developin a terminal; andThe following error should occur eventually.
This is what shows up in the system logs when
mkdiris killed.Expected behavior
The expectation is that the build should succeed (or at least fail in the same place that it does on x86_64-darwin).
nix-env --versionoutputnix-env (Nix) 2.6.0
Additional context
n/a
The text was updated successfully, but these errors were encountered: