{ lib, fetchFromGitHub, version, suffix ? "", hash ? null, src ? fetchFromGitHub { owner = "NixOS"; repo = "nix"; rev = version; inherit hash; }, patches ? [ ], maintainers ? with lib.maintainers; [ eelco lovesegfault artturin ma27 ], }@args: assert (hash == null) -> (src != null); let atLeast24 = lib.versionAtLeast version "2.4pre"; atLeast25 = lib.versionAtLeast version "2.5pre"; atLeast27 = lib.versionAtLeast version "2.7pre"; atLeast210 = lib.versionAtLeast version "2.10pre"; atLeast213 = lib.versionAtLeast version "2.13pre"; atLeast214 = lib.versionAtLeast version "2.14pre"; atLeast219 = lib.versionAtLeast version "2.19pre"; atLeast220 = lib.versionAtLeast version "2.20pre"; atLeast221 = lib.versionAtLeast version "2.21pre"; # Major.minor versions unaffected by CVE-2024-27297 unaffectedByFodSandboxEscape = [ "2.3" "2.16" "2.18" "2.19" "2.20" ]; in { stdenv, autoconf-archive, autoreconfHook, bash, bison, boehmgc, boost, brotli, busybox-sandbox-shell, bzip2, callPackage, coreutils, curl, docbook_xsl_ns, docbook5, editline, flex, git, gnutar, gtest, gzip, jq, lib, libarchive, libcpuid, libgit2, libsodium, libxml2, libxslt, lowdown, man, mdbook, mdbook-linkcheck, nlohmann_json, openssl, perl, pkg-config, rapidcheck, Security, sqlite, util-linuxMinimal, xz, enableDocumentation ? !atLeast24 || stdenv.hostPlatform == stdenv.buildPlatform, enableStatic ? stdenv.hostPlatform.isStatic, withAWS ? !enableStatic && (stdenv.isLinux || stdenv.isDarwin), aws-sdk-cpp, withLibseccomp ? lib.meta.availableOn stdenv.hostPlatform libseccomp, libseccomp, confDir, stateDir, storeDir, # passthru tests pkgsi686Linux, }: let self = stdenv.mkDerivation { pname = "nix"; version = "${version}${suffix}"; VERSION_SUFFIX = suffix; inherit src patches; outputs = [ "out" "dev" ] ++ lib.optionals enableDocumentation [ "man" "doc" ]; hardeningEnable = lib.optionals (!stdenv.isDarwin) [ "pie" ]; hardeningDisable = lib.optional stdenv.hostPlatform.isMusl "fortify"; nativeBuildInputs = [ pkg-config autoconf-archive autoreconfHook bison flex jq ] ++ lib.optionals (enableDocumentation && !atLeast24) [ libxslt libxml2 docbook_xsl_ns docbook5 ] ++ lib.optionals (enableDocumentation && atLeast24) [ (lib.getBin lowdown) mdbook ] ++ lib.optionals (atLeast213 && enableDocumentation) [ mdbook-linkcheck ] ++ lib.optionals stdenv.isLinux [ util-linuxMinimal ]; buildInputs = [ boost brotli bzip2 curl editline libsodium openssl sqlite xz gtest libarchive lowdown ] ++ lib.optionals atLeast220 [ libgit2 ] ++ lib.optionals stdenv.isDarwin [ Security ] ++ lib.optionals (stdenv.isx86_64) [ libcpuid ] ++ lib.optionals atLeast214 [ rapidcheck ] ++ lib.optionals withLibseccomp [ libseccomp ] ++ lib.optionals withAWS [ aws-sdk-cpp ]; installCheckInputs = lib.optionals atLeast221 [ git ] ++ lib.optionals atLeast219 [ man ]; propagatedBuildInputs = [ boehmgc ] ++ lib.optionals (atLeast27) [ nlohmann_json ]; postPatch = '' patchShebangs --build tests ''; preConfigure = # Copy libboost_context so we don't get all of Boost in our closure. # https://github.com/NixOS/nixpkgs/issues/45462 lib.optionalString (!enableStatic) '' mkdir -p $out/lib cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib rm -f $out/lib/*.a ${lib.optionalString stdenv.isLinux '' chmod u+w $out/lib/*.so.* patchelf --set-rpath $out/lib:${stdenv.cc.cc.lib}/lib $out/lib/libboost_thread.so.* ''} '' + # On all versions before c9f51e87057652db0013289a95deffba495b35e7, which # removes config.nix entirely and is not present in 2.3.x, we need to # patch around an issue where the Nix configure step pulls in the build # system's bash and other utilities when cross-compiling. lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform && !atLeast24) '' mkdir tmp/ substitute corepkgs/config.nix.in tmp/config.nix.in \ --subst-var-by bash ${bash}/bin/bash \ --subst-var-by coreutils ${coreutils}/bin \ --subst-var-by bzip2 ${bzip2}/bin/bzip2 \ --subst-var-by gzip ${gzip}/bin/gzip \ --subst-var-by xz ${xz}/bin/xz \ --subst-var-by tar ${gnutar}/bin/tar \ --subst-var-by tr ${coreutils}/bin/tr mv tmp/config.nix.in corepkgs/config.nix.in ''; configureFlags = [ "--with-store-dir=${storeDir}" "--localstatedir=${stateDir}" "--sysconfdir=${confDir}" "--enable-gc" ] ++ lib.optionals (!enableDocumentation) [ "--disable-doc-gen" ] ++ lib.optionals stdenv.isLinux [ "--with-sandbox-shell=${busybox-sandbox-shell}/bin/busybox" ] ++ lib.optionals (atLeast210 && stdenv.isLinux && stdenv.hostPlatform.isStatic) [ "--enable-embedded-sandbox-shell" ] ++ lib.optionals ( stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform ? nix && stdenv.hostPlatform.nix ? system ) [ "--with-system=${stdenv.hostPlatform.nix.system}" ] ++ lib.optionals (!withLibseccomp) [ # RISC-V support in progress https://github.com/seccomp/libseccomp/pull/50 "--disable-seccomp-sandboxing" ] ++ lib.optionals (atLeast210 && stdenv.cc.isGNU && !enableStatic) [ "--enable-lto" ]; makeFlags = [ # gcc runs multi-threaded LTO using make and does not yet detect the new fifo:/path style # of make jobserver. until gcc adds support for this we have to instruct make to use this # old style or LTO builds will run their linking on only one thread, which takes forever. "--jobserver-style=pipe" "profiledir=$(out)/etc/profile.d" ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) "PRECOMPILE_HEADERS=0" ++ lib.optional (stdenv.hostPlatform.isDarwin) "PRECOMPILE_HEADERS=1"; installFlags = [ "sysconfdir=$(out)/etc" ]; doInstallCheck = true; installCheckTarget = if atLeast210 then "installcheck" else null; # socket path becomes too long otherwise preInstallCheck = lib.optionalString stdenv.isDarwin '' export TMPDIR=$NIX_BUILD_TOP '' # Prevent crashes in libcurl due to invoking Objective-C `+initialize` methods after `fork`. # See http://sealiesoftware.com/blog/archive/2017/6/5/Objective-C_and_fork_in_macOS_1013.html. + lib.optionalString stdenv.isDarwin '' export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES '' # See https://github.com/NixOS/nix/issues/5687 + lib.optionalString (atLeast25 && stdenv.isDarwin) '' echo "exit 99" > tests/gc-non-blocking.sh ''; separateDebugInfo = stdenv.isLinux && (atLeast24 -> !enableStatic); enableParallelBuilding = true; passthru = { inherit aws-sdk-cpp boehmgc; perl-bindings = perl.pkgs.toPerlModule ( callPackage ./nix-perl.nix { nix = self; inherit Security; } ); tests = { nixi686 = pkgsi686Linux.nixVersions.${"nix_${lib.versions.major version}_${lib.versions.minor version}"}; }; }; # point 'nix edit' and ofborg at the file that defines the attribute, # not this common file. pos = builtins.unsafeGetAttrPos "version" args; meta = with lib; { description = "Powerful package manager that makes package management reliable and reproducible"; longDescription = '' Nix is a powerful package manager for Linux and other Unix systems that makes package management reliable and reproducible. It provides atomic upgrades and rollbacks, side-by-side installation of multiple versions of a package, multi-user package management and easy setup of build environments. ''; homepage = "https://nixos.org/"; license = licenses.lgpl21Plus; inherit maintainers; platforms = platforms.unix; outputsToInstall = [ "out" ] ++ optional enableDocumentation "man"; mainProgram = "nix"; knownVulnerabilities = lib.optional ( !builtins.elem (lib.versions.majorMinor version) unaffectedByFodSandboxEscape && !atLeast221 ) "CVE-2024-27297"; }; }; in self