ci: upgrade Nix from 2.3.12 to 2.6.1

Due to changes in how Nix handles Git refs we need to specify `refs/tags/` prefix in `package.json` to avoid the following error: ``` fatal: couldn't find remote ref refs/heads/v2.0.3-status-v6 error: program 'git' failed with exit code 128 ``` I also had to rewrite some logic in `nix/scripts/source.sh` in order to take account of single-user and multi-user installations. We default to multi-user for Darwin, but not for any other OS due to discovered issues with `nix-daemon` socket on Arch and open file limits. I also rewrote `nix/scripts/setup.sh` and `/nix/scripts/purge.sh` to support different types of installations. Both single-user and multi-user, as some operating systems have issues with multi-user installations. Resolves: #12832 Depends on: status-im/status-jenkins-lib#37 Related changes: * status-im/infra-ci@84947b9f * status-im/infra-ci@bb98f5f3 * status-im/infra-ci@f75d524d * status-im/infra-ci@d1fc92cd * status-im/infra-ci@87c4091e * status-im/infra-ci@8d6b6b3f * status-im/infra-ci@c4f13285 * status-im/infra-ci@38ac698d Signed-off-by: Jakub Sokołowski <[email protected]>
status-im · Apr 11, 2022 · a30541f · a30541f
1 parent da76200
commit a30541f
Show file tree

Hide file tree

Showing 16 changed files with 264 additions and 133 deletions.
diff --git a/ci/Jenkinsfile.android b/ci/Jenkinsfile.android
@@ -1,7 +1,7 @@
-library 'status-jenkins-lib@v1.3.5'
+library 'status-jenkins-lib@v1.4.0'
 
 pipeline {
-  agent { label 'linux && x86_64 && nix-2.3' }
+  agent { label 'linux && x86_64 && nix-2.6' }
 
   options {
     timestamps()

diff --git a/ci/Jenkinsfile.combined b/ci/Jenkinsfile.combined
@@ -1,4 +1,4 @@
-library 'status-jenkins-lib@v1.3.5'
+library 'status-jenkins-lib@v1.4.0'
 
 pipeline {
   agent { label 'linux' }

diff --git a/ci/Jenkinsfile.ios b/ci/Jenkinsfile.ios
@@ -1,7 +1,7 @@
-library 'status-jenkins-lib@v1.3.5'
+library 'status-jenkins-lib@v1.4.0'
 
 pipeline {
-  agent { label 'macos && x86_64 && nix-2.3 && xcode-12.5' }
+  agent { label 'macos && x86_64 && nix-2.6 && xcode-12.5' }
 
   parameters {
     string(

diff --git a/ci/Jenkinsfile.nix-cache b/ci/Jenkinsfile.nix-cache
@@ -1,4 +1,4 @@
-library 'status-jenkins-lib@v1.3.5'
+library 'status-jenkins-lib@v1.4.0'
 
 pipeline {
   agent { label params.AGENT_LABEL }

diff --git a/ci/tools/Jenkinsfile.fastlane-clean b/ci/tools/Jenkinsfile.fastlane-clean
@@ -1,4 +1,4 @@
-library 'status-jenkins-lib@v1.3.3'
+library 'status-jenkins-lib@v1.4.0'
 
 pipeline {
   agent { label 'macos' }

diff --git a/ci/tools/Jenkinsfile.playstore-meta b/ci/tools/Jenkinsfile.playstore-meta
@@ -1,4 +1,4 @@
-library 'status-jenkins-lib@v1.3.3'
+library 'status-jenkins-lib@v1.4.0'
 
 pipeline {
   agent { label 'linux' }

diff --git a/nix/KNOWN_ISSUES.md b/nix/KNOWN_ISSUES.md
@@ -1,35 +1,33 @@
 # Known Issues
 
-## MacOS 10.15 "Catalina"
+## Too many open files
 
-There is an unsolved issue with the root(`/`) file system in `10.15` being read-only:
-https://github.com/NixOS/nix/issues/2925
+### Single-User Installation
 
-Our current recommended workaround is putting `/nix` under `/opt/nix` and symlinking it via `/etc/synthetic.conf`:
-
-```bash
-sudo mkdir /opt/nix
-sudo chown ${USER} /opt/nix
-sudo sh -c "echo 'nix\t/opt/nix' >> /etc/synthetic.conf"
-reboot
+Nix can open a lot of files when fetching things for `/nix/store` which can cause
 ```
-
-After the system reboots you should see the `/nix` symlink in place:
-
-```bash
- % ls -l /nix
-lrwxr-xr-x  1 root  wheel  8 Oct 11 13:53 /nix -> /opt/nix
+Too many open files"
 ```
-
-In order to be able to use Nix with a symlinked `/nix` you need to include this in your shell:
-
-```bash
-export NIX_IGNORE_SYMLINK_STORE=1
+The temporary way to fix this is set a new limit for current session using `ulimit`:
+```sh
+ulimit -n 131072
+```
+To increase limit permanently system-wide edit `/etc/sysctl.conf`:
+```
+fs.file-max = 131072
 ```
+And use `sudo sysctl --system` to load these new settings.
 
-Add it to your `.bashrc` or any other shell config file.
+### Multi-User Installation
 
-__NOTE__: Your old `/nix` directory will end up in `/Users/Shared/Relocated Items/Security/nix` after OS upgrade.
+The other reason why this error could appear are limits fo `nix-daemon` service:
+https://github.com/NixOS/nix/issues/6007
+
+Since Systemd services ignore system-wide limits you will have to add the following line:
+```
+LimitNOFILE=4096:1048576
+```
+To the `/etc/systemd/system/nix-daemon.service` service definition.
 
 ## Cache Downloads Timing Out
 
@@ -69,3 +67,11 @@ Currently on NixOS `NIX_CONF_DIR` is being ignored in favor of the default `/etc
 This will be possible to fix once Nix `2.4` comes out with support for `NIX_USER_CONF_FILES`.
 
 For more details see https://github.com/NixOS/nix/issues/3723.
+
+## Extra Sandbox Files Not Available
+
+It's possible that on a multi-user installation files provided to the build sandbox using the `extra-sandbox-paths` option will ne be available, unless the current user is added to `trusted-users` in `nix.conf` file.
+
+Issues:
+* https://github.com/NixOS/nix/issues/6115
+* https://github.com/NixOS/nix/issues/6217
diff --git a/nix/scripts/build.sh b/nix/scripts/build.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-
+# This script is a wrapper around nix-build with some niceties.
 set -e
 
 GIT_ROOT=$(cd "${BASH_SOURCE%/*}" && git rev-parse --show-toplevel)
@@ -8,7 +8,7 @@ source "${GIT_ROOT}/scripts/colors.sh"
 source "${GIT_ROOT}/nix/scripts/source.sh"
 
 # cleanup for artifacts created during builds
-function cleanup() {
+cleanup() {
   # clear trapped signals
   trap - EXIT ERR INT QUIT
   # do the actual cleanup, ignore failure
@@ -29,7 +29,7 @@ if [[ -n "${_NIX_CLEAN}" ]]; then
 fi
 
 # build output will end up under /nix, we have to extract it
-function extractResults() {
+extractResults() {
   local nixResultPath="$1"
   mkdir -p "${resultPath}"
   cp -vfr ${nixResultPath}/* "${resultPath}" | sed 's#'${PWD}'#.#'

diff --git a/nix/scripts/clean.sh b/nix/scripts/clean.sh
@@ -5,16 +5,16 @@ set -e
 GIT_ROOT=$(cd "${BASH_SOURCE%/*}" && git rev-parse --show-toplevel)
 source "${GIT_ROOT}/nix/scripts/source.sh"
 
-function log() { echo "$@" 1>&2; }
+log() { echo "$@" 1>&2; }
 
 # helpers for getting related paths in Nix store
-function getSources()   { nix-store --query --binding src "${1}"; }
-function getOutputs()   { nix-store --query --outputs "${1}"; }
-function getDrvFiles()  { nix-store --query --deriver "${1}"; }
-function getReferrers() { nix-store --query --referrers "${1}"; }
-function getRoots()     { nix-store --query --roots "${1}"; }
+getSources()   { nix-store --query --binding src "${1}"; }
+getOutputs()   { nix-store --query --outputs "${1}"; }
+getDrvFiles()  { nix-store --query --deriver "${1}"; }
+getReferrers() { nix-store --query --referrers "${1}"; }
+getRoots()     { nix-store --query --roots "${1}"; }
 
-function findRelated() {
+findRelated() {
     path="${1}"
     found+=("${path}")
     if [[ "${path}" =~ .*.chroot ]]; then
@@ -51,7 +51,7 @@ function findRelated() {
 }
 
 # used to find things to delete based on a regex
-function findByRegex() {
+findByRegex() {
     regex="${1}"
 
     log "Searching by regex: '${regex}'"
@@ -70,7 +70,7 @@ function findByRegex() {
 }
 
 # used to find things to delete based on a given path
-function findByResult() {
+findByResult() {
     mainPath="${1}"
     log "Searching by result: '${mainPath}'"
 

diff --git a/nix/scripts/lib.sh b/nix/scripts/lib.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+# Checking group ownership to identify installation type.
+file_group() {
+    UNAME=$(uname -s)
+    if [[ "${UNAME}" == "Linux" ]]; then
+        stat -Lc "%G" "${1}" 2>/dev/null
+    elif [[ "${UNAME}" == "Darwin" ]]; then
+        stat -Lf "%Sg" "${1}" 2>/dev/null
+    fi
+}
+
+os_name() {
+    source /etc/os-release 2>/dev/null
+    echo "${NAME}"
+}
+
+is_arch_linux() {
+    [[ -f /etc/arch-release ]]
+}
+
+nix_install_type() {
+    NIX_STORE_DIR_GROUP=$(file_group /nix/store)
+    if [[ "$(os_name)" =~ NixOS ]]; then
+        echo "nixos"
+    elif [[ "${NIX_STORE_DIR_GROUP}" == "nixbld" ]]; then
+        echo "multi"
+    elif [[ "${NIX_STORE_DIR_GROUP}" == "${USER}" ]]; then
+        echo "single"
+    elif [[ "${NIX_STORE_DIR_GROUP}" == "" ]]; then
+        echo "No Nix installtion detected!" >&2
+        echo "none"
+    else
+        echo "Unknown Nix installtion type!" >&2
+        exit 1
+    fi
+}
diff --git a/nix/scripts/node_modules.sh b/nix/scripts/node_modules.sh
@@ -23,13 +23,13 @@ source "${GIT_ROOT}/scripts/colors.sh"
 # More concise output from 'time'
 export TIMEFORMAT="Done in: %Es"
 
-function removeDir() {
+removeDir() {
     [[ ! -d "${tmp}" ]] && return
     chmod -R u+w "${tmp}"
     rm -rf "${tmp}"
 }
 
-function copyNodeModules() {
+copyNodeModules() {
   local src="${1}"
   local dst="${2}"
   # WARNING: The ../ is there to avoid a Nix builtins.path bug:
@@ -51,7 +51,7 @@ function copyNodeModules() {
 
 # Find files that were modified and should cause a re-copying of node modules.
 # Some files are generated/modified by build processes and should be ignored.
-function findFilesNewerThan() {
+findFilesNewerThan() {
   local sentinel="${1}"
   local dir="${2}"
   find ${dir} -type f -writable \
@@ -63,7 +63,7 @@ function findFilesNewerThan() {
       -print 
 }
 
-function nodeModulesUnchanged() {
+nodeModulesUnchanged() {
   local src="$1"
   local dst="$2"
   local sentinelFile="${dst}/.copied~"
@@ -98,7 +98,7 @@ function nodeModulesUnchanged() {
   return 0
 }
 
-function replaceNodeModules() {
+replaceNodeModules() {
   local src="$1"
   local dst="$2"
   local sentinelFile="${dst}/.copied~"

diff --git a/nix/scripts/purge.sh b/nix/scripts/purge.sh
@@ -1,24 +1,82 @@
 #!/usr/bin/env bash
-
-set -e
+# This script removes all Nix files.
 
 GIT_ROOT=$(cd "${BASH_SOURCE%/*}" && git rev-parse --show-toplevel)
+source "${GIT_ROOT}/nix/scripts/lib.sh"
 source "${GIT_ROOT}/scripts/colors.sh"
 
-# Purging /nix on NixOS would be disasterous
-if [[ -f "/etc/os-release" ]]; then
-    OS_NAME=$(awk -F= '/^NAME/{print $2}' /etc/os-release)
-    if [[ "$OS_NAME" == "NixOS" ]]; then
-        echo -e "${RED}You should not purge Nix files on NixOS!${RST}" >&2
-        exit
+nix_purge_multi_user() {
+    sudo systemctl stop nix-daemon.socket
+    sudo systemctl stop nix-daemon.service
+    sudo systemctl disable nix-daemon.socket
+    sudo systemctl disable nix-daemon.service
+    sudo systemctl daemon-reload
+    sudo rm -fr /etc/nix
+    sudo rm -f /etc/profile.d/nix.sh*
+
+    # Remove nix build users and groups
+    for NIX_USER in $(awk -F: '/nixbld/{print $1}' /etc/passwd); do
+        sudo userdel "${NIX_USER}"
+    done
+    sudo groupdel nixbld
+
+    # Restore old shell profiles
+    NIX_PROFILE_FILES=(
+        /etc/bash.bashrc /etc/bashrc /etc/bash/bashrc
+        /etc/zsh.zshhrc /etc/zshrc /etc/zsh/zshrc
+    )
+    for NIX_FILE in "${NIX_PROFILE_FILES[@]}"; do
+        if [[ -f "${NIX_FILE}.backup-before-nix" ]]; then
+            sudo mv -f "${NIX_FILE}.backup-before-nix" "${NIX_FILE}"
+        fi
+    done
+}
+
+nix_purge_user_profile() {
+    sudo rm -rf \
+        ~/.nix-* \
+        ~/.cache/nix \
+        ~/.config/nixpkgs \
+        ${GIT_ROOT}/.nix-gcroots
+}
+
+nix_purge_root() {
+    NIX_ROOT="/nix"
+    if [[ $(uname -s) == "Darwin" ]]; then
+        # Special case due to read-only root on MacOS Catalina
+        NIX_ROOT="/opt/nix"
+    fi
+    if [[ -z "${NIX_ROOT}" ]]; then
+        echo -e "${RED}Unable to identify Nix root!${RST}" >&2
+        exit 1
     fi
+    sudo rm -fr "${NIX_ROOT}"
+}
+
+NIX_INSTALL_TYPE=$(nix_install_type)
+
+if [[ "${1}" == "--force" ]] && [[ "${NIX_INSTALL_TYPE}" != "nixos" ]]; then
+    echo -e "${YLW}Purge forced, no checks performed!${RST}" >&2
+    nix_purge_multi_user
+    nix_purge_user_profile
+    nix_purge_root
+    exit
 fi
 
-NIX_ROOT="/nix"
-if [[ $(uname -s) == "Darwin" ]]; then
-    # Special case due to read-only root on MacOS Catalina
-    NIX_ROOT="/opt/nix"
+# Purging /nix on NixOS would be disasterous
+if [[ "${NIX_INSTALL_TYPE}" == "nixos" ]]; then
+    echo -e "${RED}You should not purge Nix files on NixOS!${RST}" >&2
+    exit
+elif [[ "${NIX_INSTALL_TYPE}" == "none" ]]; then
+    echo -e "${YLW}Nothing to remove, Nix not installed.${RST}" >&2
+    exit
+elif [[ "${NIX_INSTALL_TYPE}" == "multi" ]]; then
+    echo -e "${YLW}Detected multi-user Nix installation.${RST}" >&2
+    nix_purge_multi_user
+elif [[ "${NIX_INSTALL_TYPE}" == "single" ]]; then
+    echo -e "${YLW}Detected single-user Nix installation.${RST}" >&2
+    nix_purge_user_profile
 fi
+nix_purge_root
 
-sudo rm -rf ${NIX_ROOT}/* ~/.nix-profile ~/.nix-defexpr ~/.nix-channels ~/.cache/nix ~/.status .nix-gcroots
 echo -e "${GRN}Purged all Nix files from your system.${RST}" >&2