!UNVBThoJtlIiVwiDjU:nixos.org

Staging

347 Members
Staging merges | Running staging cycles: https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+head%3Astaging-next+head%3Astaging-next-25.11 | Review Reports: https://malob.github.io/nix-review-tools-reports/115 Servers

Load older messages


SenderMessageTime
15 Feb 2026
@emilazy:matrix.orgemilyit seems like the same kind of reproducibility-load-bearing logic that makes us reject new complex FOD dep fetchers... maintaining an old zlib forever doesn't sound fun15:54:14
@emilazy:matrix.orgemilywe've had to patch Chromium vendored zlibs for new compilers15:54:37
@emilazy:matrix.orgemilythe fetchCargoVendor solution is to split the fetcher FOD and the input-addressed derivation that arranges it into the format Cargo accepts, is that not viable here?15:57:02
@emilazy:matrix.orgemilyI guess we still might need the old zlib in that drv15:57:19
@emilazy:matrix.orgemilyit's sort of only "nice to have" to check downloads against the lock file though if we have our own hash in Nixpkgs pinning it though right?15:58:24
@emilazy:matrix.orgemily(but admittedly introduces another TOFU step)15:58:37
@reckenrode:matrix.orgRandy EckenrodeI have a fix: https://github.com/NixOS/nixpkgs/pull/490757.17:16:24
@reckenrode:matrix.orgRandy EckenrodeDo I need to target staging-next?17:16:59
@vcunat:matrix.orgVladimír ČunátYes, please.17:17:41
@vcunat:matrix.orgVladimír Čunát The issue plagues staging-next already. 17:17:51
@reckenrode:matrix.orgRandy EckenrodeI retargeted staging-next.17:20:12
@reckenrode:matrix.orgRandy EckenrodeThe only issue is Linux. I didn’t do the patches conditionally. Are we okay on Linux rebuilds currently, or do I need to make these conditional?17:20:42
@emilazy:matrix.orgemilyshould probably conditionalize and revert on staging17:28:34
@emilazy:matrix.orgemily(maybe I should put up my radical proposal to eliminate master-staging merge conflicts and get rid of the "guarded change + revert on staging" medium...)17:35:32
@emilazy:matrix.orgemily * 17:35:38
@vcunat:matrix.orgVladimír ČunátHow would you get rid of that?17:40:50
@vcunat:matrix.orgVladimír Čunát(without increasing rebuild amount in situations like we have with git now)17:41:07
@matthewcroughan:defenestrate.itmatthewcroughan changed their display name from matthewcroughan @fosdem to matthewcroughan.17:55:53
@emilazy:matrix.orgemily

well, I have ideas that are varying degrees of radical 😅 there are lots of ways we could get rid of the manual merge conflict resolution dance but the one that would streamline the -next rebuild avoidance dance looks like:

we only have one true branch (per release), master, and we conditionalize big rebuilds with feature flags conditionals like version = if ... stage... then "3.0" else "2.1";. preparing a new -next is just increasing the "epoch" past all currently staged changes. (could also make it a bit easier for us to say "uh, big security fix, let's roll a cycle without this risky stuff")

to do clean-up and reduce the tedium of authoring changes, we have a script that automatically adds these conditionals in a separate commit on top of your "staging-based" commit. merge queue checks you didn't break eval on any epoch and that the staging commits don't cause rebuilds at the relevant epoch. then -next/staging branches just undo those staging commits so you have base for changes and we merge them in for clean-up once a cycle completes. you only have to do manual "conflict resolution" when there's a genuine divergence between the branches and the script can't automatically do it, and it happens in the relevant PRs.

so here you'd add the patch, the script would add the conditionals, and staging vs. -next would just be a question of what epoch you assign it to. you can always see from master when there's changes in-flight, and clean-up happens automatically

18:02:03
@emilazy:matrix.orgemilythis is also a lot more auditable than our current manual merges because we can treat the staging commits like the cherry-pick CI and flag them up when they're doing something non-automatic18:04:34
@vcunat:matrix.orgVladimír Čunát

should probably conditionalize and revert on staging

Conditionalized.

18:07:43
@vcunat:matrix.orgVladimír Čunát *

[git PR] should probably conditionalize and revert on staging

Conditionalized.

18:07:56
@vcunat:matrix.orgVladimír Čunát[radical] I see (on a very high level at least). At a glance I'm a bit worried that some changes would be more difficult to write. And adding conditionals can cause unpleasant diffs because of force-formatting.18:12:53
@vcunat:matrix.orgVladimír ČunátNice for simple version bumps probably, though.18:13:48
@grimmauld:m.grimmauld.deGrimmauld (any/all) compression libs do get quite some CVEs for random shit. We call our package sources "trusted", because they are pinned by a hash - a luxury we can not afford before calculating the hash. If hashing itself is an unsafe operation, then things are wrong. And thus i have my doubts about pinned zlib... 18:15:40
@k900:0upti.meK900I mean18:16:19
@k900:0upti.meK900This is what Yarn upstream does18:16:22
@k900:0upti.meK900The only other option is regenerate all lockfiles18:16:28
@k900:0upti.meK900But sigh18:16:32
@vcunat:matrix.orgVladimír ČunátAt that point we just mark these fetches as insecure? 😅18:17:37

Show newer messages


Back to Room ListRoom Version: 6