!NBBFPbiuttRgTqbrcY:nixos.org

NixOS Security Discussions

366 Members
Discussions around Security | Triaging happens in #security:nixos.org128 Servers

Load older messages


SenderMessageTime
21 Oct 2024
@emilazy:matrix.orgemily
In reply to @hexa:lossy.network
aliases should warn immediately imo 😛
(is there any reason we don't do that other than nobody made the infrastructure for it? seems like it would be a "simple" mapAttrs)
11:27:38
@hexa:lossy.networkhexafeel free to give it a shot11:27:59
@sandro:supersandro.deSandro 🐧 * Debians poor depreciation processes hitting again 12:10:48
@sandro:supersandro.deSandro 🐧
In reply to @hexa:lossy.network
says distro who has an ever growing aliases file, no proper deprecation cycle and other failings
Those things are minor compared to Debian and you don't notice mid upgrade in an unstable state that some package is now missing.
12:12:12
@sandro:supersandro.deSandro 🐧
In reply to @emilazy:matrix.org
so the idea is that we have to go alias → alias with warning → throw → removal?
alias and alias with warning are the same thing, aren't they?
12:14:13
@sandro:supersandro.deSandro 🐧and between the other steps I think we had something like one release cycle12:14:24
@qyliss:fairydust.spaceAlyssa Rossno warning means nobody gets a chance to notice12:15:16
@emilazy:matrix.orgemily
In reply to @sandro:supersandro.de
alias and alias with warning are the same thing, aren't they?
howso?
12:15:18
@emilazy:matrix.orgemily
In reply to @qyliss:fairydust.space
no warning means nobody gets a chance to notice
I think allowAliases = false is meant to serve the purpose of giving notice to those it matters for
12:16:18
@emilazy:matrix.orgemily(though whether it is effective at that, idk)12:16:23
@sandro:supersandro.deSandro 🐧
In reply to @qyliss:fairydust.space
no warning means nobody gets a chance to notice
I may be confusing this with the module system which warns immediately. We should add that 🤔
12:16:34
@sandro:supersandro.deSandro 🐧like why don't we have that12:16:51
@qyliss:fairydust.spaceAlyssa RossYeah12:16:53
@emilazy:matrix.orgemilyhttps://github.com/NixOS/nixpkgs/issues/195702 has some discussion about the difficulties about making aliases warn.12:17:18
@emilazy:matrix.orgemilyI don't entirely understand the difficulties though.12:17:23
@sandro:supersandro.deSandro 🐧
In reply to @emilazy:matrix.org
I think allowAliases = false is meant to serve the purpose of giving notice to those it matters for
well, nay. It treats it like it is already gone and ignores the entire aliases file
12:17:34
@qyliss:fairydust.spaceAlyssa Ross
In reply to @emilazy:matrix.org
I think allowAliases = false is meant to serve the purpose of giving notice to those it matters for
I don't think that's the purpose of allowAliases. I think allowAliases is there for OfBorg, and to make it possible to process whole attrsets without encountering a bunch of throws.
12:17:47
@emilazy:matrix.orgemily
In reply to @sandro:supersandro.de
well, nay. It treats it like it is already gone and ignores the entire aliases file
yes, which means if you test in CI with allowAliases = false you get early warning of upcoming breaking changes without disrupting users
12:17:55
@emilazy:matrix.orgemilywhich is actually better than unconditional warnings12:18:00
@sandro:supersandro.deSandro 🐧yeah, warning as it breaks, not as a literal warning. I've been using that since forever to never use aliases.12:18:51
@sandro:supersandro.deSandro 🐧we just need to add a warn https://github.com/NixOS/nixpkgs/blob/master/pkgs/top-level/aliases.nix#L55 here, right?12:19:24
@qyliss:fairydust.spaceAlyssa Ross
In reply to @emilazy:matrix.org
yes, which means if you test in CI with allowAliases = false you get early warning of upcoming breaking changes without disrupting users
Right but people are not generally testing their NixOS configurations in CI
12:19:49
@emilazy:matrix.orgemilyI don't know if NixOS configurations are really the most relevant case here? since it's quite easy to just react to "hey, this alias X is now Y, please migrate to that" on updates there. not that it'd be nice to be able to be more proactive but the quoted justification for this kind of extended compatibility cycle I've seen has always been third-party modules that want to support multiple Nixpkgs versions at once, etc.12:20:59
@sandro:supersandro.deSandro 🐧third party can always check lib.version and do things conditional based on that12:22:04
@sandro:supersandro.deSandro 🐧we can't do reflection, so we probably should adapt the python script12:41:31
@fabianhjr:matrix.orgFabián Heredia
In reply to @emilazy:matrix.org
so the idea is that we have to go alias → alias with warning → throw → removal?
alias with warn (now that warn exists) -> throw -> removal
17:02:00
@emilazy:matrix.orgemilyhm, what do you mean "now that warn exists"?17:02:15
@fabianhjr:matrix.orgFabián Herediaskipping the first one17:02:16
@fabianhjr:matrix.orgFabián Herediaof only alias without warn17:02:22
@fabianhjr:matrix.orgFabián HerediaThere was a time when aliases couldn't warn not too long ago if I recall correctly17:02:50

Show newer messages


Back to Room ListRoom Version: 9