nixos-rebuild: use nix build and nix copy

[michaelpj]

Motivation for this change

Get the nice progress indicators when running nixos-rebuild. Mostly fixes #45595.

Things done

• Replace nix-copy-closure with nix copy.
  • As I understand it, this is a straight replacement, provided we have the commit for supporting copying drvs. However, I think that might not be in our current version?
• Replace nix-build with nix build.
  • Due to Nix 2.0: Print out path to stdout with nix build nix#1930 we put the output in a temporary directory.
  • We also switch to running the function in our process instead of a subshell, so Nix thinks it's in a TTY and gives us the progress output.

I haven't attempted to touch any of the uses of nix-instantiate, since as I understand it there isn't a good Nix 2.0 replacement for the stuff that's being done there.

This is obviously going to need pretty careful testing, but I'm putting this up to get things going. I've tested it on my own machine and it seems to work nicely!

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • x ] NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Fits CONTRIBUTING.md.

---

[xeji]

While I agree we should eventually do this, I don't think we should do it just yet.

• nix build/copy --help warns: Note: this program is EXPERIMENTAL and subject to change.
• the output is quite useless for debugging

[Mic92]

In nix-review I also switched back to nix-build because I needed the output. So the new nix 2.0 tools are more useful if one only downloads stuff.

[michaelpj]

What about gating it behind a flag or an env var? That way it's opt in, but people can start experimenting with it bug upstream if it's not usable enough.

[michaelpj]

I looked into gating it behind an env var, but it's awkward because the valid arguments are different for nix-build/nix build.

I also noticed that this is a behaviour change: because it's passing --out-link explicitly in order to get the result of the build and then cleaning it up, nixos-rebuild test etc. won't produce output links any more. This seems bad.

[xeji]

Yes, the different options are a pain. I recommend we heed the "EXPERIMENTAL" warning and keep things as they are for now.

Eventually, nix-build and nix build should converge. I don't know what the plan or timeline is, but that's a discussion for the nix repo, not nixpkgs...

[lukateras]

I agree with @xeji, it seems to be too early to make that switch.

[ElvishJerricco]

Any chance this could be packaged as an optional replacement? Either a separate package with a different command name, or a NixOS module option like programs.nixos-rebuild.enableExperimental = true;?

[michaelpj]

Yes, that's a nice idea, I hadn't thought of that. I'll look into it. I think a separate package makes sense - then you just install nixos-rebuild2 or something.

[michaelpj]

This won't work well as a separately packaged script, since it builds nixos-rebuild from the new nixpkgs and then re-execs it, so you'll just immediately delegate to the "real" nixos-rebuild.

I guess there's nothing really that can be done here unless there are some changes to the nix UI.