Upstream tracking - #165
Draft
grahamc wants to merge 4164 commits into
Draft
Conversation
Sync with upstream 2.35.2
Make ExprLet::eval a tail call
…lock" This reverts commits 41e2fab, 9934b5f. If multiple processes start the migration at the same time, and one of them holds the global lock open indefinitely (e.g. magic-nix-cache or a `nix repl`), then the other processes will hang indefinitly waiting for an exclusive lock that isn't actually needed anymore.
…ma migration We should never use SQLite::exec() inside a transaction, because it catches SQLiteBusy exceptions and retries the statement, which will just fail again. It's the entire transaction that must be retried. In addition, we now check inside the transaction whether the migration has already been done. Thus, on a retry, we will notice that another process has already done the migration.
Fix "waiting for exclusive access" hangs during schema migrations
Fix NixOS#16307 `hashDerivationModulo` built the intermediate `inputs2` map with `insert_or_assign`, so on such a collision the second entry silently dropped the first entry's output names. Merge the output-name sets instead. This changes computed store path of any derivation that hits the collision. But that's good, we're undoing the bug. Two *distinct* input derivations can share a hash modulo --- that is the whole point of the modulo, e.g. they differ only in the provenance of a fixed-output input. Usually this comes up *temporally*, e.g. between two different versions of Nixpkgs that have different curls used in `fetchurl` derivations, but it can also arise *spatially*. Assisted-by: Claude Code (Claude Opus 5) (cherry picked from commit b26204b) (cherry picked from commit 76c15a2)
Upstream fixes
Flake lock file updates:
• Updated input 'nix':
'path:../..'
→ 'path:../..'
• Updated input 'nix/nixpkgs':
'https://api.flakehub.com/f/pinned/DeterminateSystems/secure-packages-26.05/0.1.1011423%2Brev-11bcae4108b62d9423d6eebc4b2bde45286d9fd2/019fd38f-01a2-7781-872d-a64af7252926/source.tar.gz' (2026-08-05)
→ 'https://api.flakehub.com/f/pinned/DeterminateSystems/secure-packages-26.05/0.1.1012116%2Brev-b5d2789f4c19edaa14cc30a9aed6b15605ced159/01a002f6-c976-7971-ae43-841e5c7df492/source.tar.gz' (2026-08-15)
…542-0260-436f-a7e1-c6905130b0ed Release v3.22.1
…ions This creates GC-rooted symlinks for the store paths in the string context of the result of `nix eval` (with --raw or --json). Unlike `nix build --out-link`, derivations are linked to their .drv files rather than their outputs, since nothing was built. Assisted-by: Claude Fable 5 <noreply@anthropic.com>
upgradeDBSchema(): Don't show "executing migration" messages on a new store
The cache in CachingFilteringSourceAccessor was a plain std::map mutated on every cache miss. With parallel evaluation, multiple eval threads can call isAllowed() on the same accessor concurrently (e.g. via builtins.readDir on a Git input fetched with exportIgnore), racing find() against emplace() and corrupting the tree. This caused segfaults like DETERMINATE-NIX-8W (a SEGV_MAPERR at offset 0x10, i.e. reading _M_left of a null red-black tree node). Use boost::concurrent_flat_map instead, following the same pattern as CachingSourceAccessor. Assisted-by: Claude Fable 5 <noreply@anthropic.com>
Remove fallback behaviour for RemoteStore::addTempRoots()
…g-source-accessor CachingFilteringSourceAccessor: Make the isAllowed() cache thread-safe
nix eval: Add --drv-link flag to create symlinks to top-level derivations
Flake lock file updates:
• Updated input 'nix':
'path:../..'
→ 'path:../..'
• Updated input 'nix/nixpkgs':
'https://api.flakehub.com/f/pinned/DeterminateSystems/secure-packages-26.05/0.1.1012116%2Brev-b5d2789f4c19edaa14cc30a9aed6b15605ced159/01a002f6-c976-7971-ae43-841e5c7df492/source.tar.gz' (2026-08-15)
→ 'https://api.flakehub.com/f/pinned/DeterminateSystems/secure-packages-26.05/0.1.1012125%2Brev-86c2aa5aa3e08175d183edb2581a7fd32c358115/01a01b96-88bb-7c70-84ca-1cbd5a037ecf/source.tar.gz' (2026-08-19)
…d52-93b9-4419-9060-8a0e0eb8c8c1 Release v3.22.2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Not intended to be merged directly. This PR is a convenience to show the diff between upstream Nix and Determinate Nix (the
mainbranch).Continuation of #4.