···7788---
991010-Building this package twice does not produce the bit-by-bit identical result each time, making it harder to detect CI breaches. You can read more about this at https://reproducible-builds.org/ .
1010+<!--
1111+Hello dear reporter,
11121212-Fixing bit-by-bit reproducibility also has additional advantages, such as avoiding hard-to-reproduce bugs, making content-addressed storage more effective and reducing rebuilds in such systems.
1313+Thank you for bringing attention to this issue. Your insights are valuable to
1414+us, and we appreciate the time you took to document the problem.
1515+1616+I wanted to kindly point out that in this issue template, it would be beneficial
1717+to replace the placeholder `<package>` with the actual, canonical name of the
1818+package you're reporting the issue for. Doing so will provide better context and
1919+facilitate quicker troubleshooting for anyone who reads this issue in the
2020+future.
2121+2222+Best regards
2323+-->
2424+2525+Building this package multiple times does not yield bit-by-bit identical
2626+results, complicating the detection of Continuous Integration (CI) breaches. For
2727+more information on this issue, visit
2828+[reproducible-builds.org](https://reproducible-builds.org/).
2929+3030+Fixing bit-by-bit reproducibility also has additional advantages, such as
3131+avoiding hard-to-reproduce bugs, making content-addressed storage more effective
3232+and reducing rebuilds in such systems.
13331434### Steps To Reproduce
15353636+In the following steps, replace `<package>` with the canonical name of the
3737+package.
3838+3939+#### 1. Build the package
4040+4141+This step will build the package. Specific arguments are passed to the command
4242+to keep the build artifacts so we can compare them in case of differences.
4343+4444+Execute the following command:
4545+1646```
1717-nix-build '<nixpkgs>' -A ... && nix-build '<nixpkgs>' -A ... --check --keep-failed
4747+nix-build '<nixpkgs>' -A <package> && nix-build '<nixpkgs>' -A <package> --check --keep-failed
1848```
19492020-If this command completes successfully, no differences where found. However, when it ends in `error: derivation '<X>' may not be deterministic: output '<Y>' differs from '<Z>'`, you can use `diffoscope <Y> <Z>` to analyze the differences in the output of the two builds.
5050+Or using the new command line style:
5151+5252+```
5353+nix build nixpkgs#<package> && nix build nixpkgs#<package> --rebuild --keep-failed
5454+```
21552222-To view the build log of the build that produced the artifact in the binary cache:
5656+#### 2. Compare the build artifacts
5757+5858+If the previous command completes successfully, no differences were found and
5959+there's nothing to do, builds are reproducible.
6060+If it terminates with the error message `error: derivation '<X>' may not be
6161+deterministic: output '<Y>' differs from '<Z>'`, use `diffoscope` to investigate
6262+the discrepancies between the two build outputs. You may need to add the
6363+`--exclude-directory-metadata recursive` option to ignore files and directories
6464+metadata (*e.g. timestamp*) differences.
23652466```
2525-nix-store --read-log $(nix-instantiate '<nixpkgs>' -A ...)
6767+nix run nixpkgs#diffoscopeMinimal -- --exclude-directory-metadata recursive <Y> <Z>
6868+```
6969+7070+#### 3. Examine the build log
7171+7272+To examine the build log, use:
7373+7474+```
7575+nix-store --read-log $(nix-instantiate '<nixpkgs>' -A <package>)
7676+```
7777+7878+Or with the new command line style:
7979+8080+```
8181+nix log $(nix path-info --derivation nixpkgs#<package>)
2682```
27832884### Additional context
29853030-(please share the relevant fragment of the diffoscope output here,
3131-and any additional analysis you may have done)
8686+(please share the relevant fragment of the diffoscope output here, and any
8787+additional analysis you may have done)
+8-1
lib/meta.nix
···162162 getExe' pkgs.imagemagick "convert"
163163 => "/nix/store/5rs48jamq7k6sal98ymj9l4k2bnwq515-imagemagick-7.1.1-15/bin/convert"
164164 */
165165- getExe' = x: y: "${lib.getBin x}/bin/${y}";
165165+ getExe' = x: y:
166166+ assert lib.assertMsg (lib.isDerivation x)
167167+ "lib.meta.getExe': The first argument is of type ${builtins.typeOf x}, but it should be a derivation instead.";
168168+ assert lib.assertMsg (lib.isString y)
169169+ "lib.meta.getExe': The second argument is of type ${builtins.typeOf y}, but it should be a string instead.";
170170+ assert lib.assertMsg (builtins.length (lib.splitString "/" y) == 1)
171171+ "lib.meta.getExe': The second argument \"${y}\" is a nested path with a \"/\" character, but it should just be the name of the executable instead.";
172172+ "${lib.getBin x}/bin/${y}";
166173}
+28
lib/tests/misc.nix
···19061906 expr = (with types; either int (listOf (either bool str))).description;
19071907 expected = "signed integer or list of (boolean or string)";
19081908 };
19091909+19101910+# Meta
19111911+ testGetExe'Output = {
19121912+ expr = getExe' {
19131913+ type = "derivation";
19141914+ out = "somelonghash";
19151915+ bin = "somelonghash";
19161916+ } "executable";
19171917+ expected = "somelonghash/bin/executable";
19181918+ };
19191919+19201920+ testGetExeOutput = {
19211921+ expr = getExe {
19221922+ type = "derivation";
19231923+ out = "somelonghash";
19241924+ bin = "somelonghash";
19251925+ meta.mainProgram = "mainProgram";
19261926+ };
19271927+ expected = "somelonghash/bin/mainProgram";
19281928+ };
19291929+19301930+ testGetExe'FailureFirstArg = testingThrow (
19311931+ getExe' "not a derivation" "executable"
19321932+ );
19331933+19341934+ testGetExe'FailureSecondArg = testingThrow (
19351935+ getExe' { type = "derivation"; } "dir/executable"
19361936+ );
19091937}
···3838 true`. This is generally safe behavior, but for anyone needing to opt out from
3939 the check `users.users.${USERNAME}.ignoreShellProgramCheck = true` will do the job.
40404141+- Cassandra now defaults to 4.x, updated from 3.11.x.
4242+4143## New Services {#sec-release-23.11-new-services}
42444345- [MCHPRS](https://github.com/MCHPR/MCHPRS), a multithreaded Minecraft server built for redstone. Available as [services.mchprs](#opt-services.mchprs.enable).
···351353352354- `service.borgmatic.settings.location` and `services.borgmatic.configurations.<name>.location` are deprecated, please move your options out of sections to the global scope.
353355356356+- `privacyidea` (and the corresponding `privacyidea-ldap-proxy`) has been removed from nixpkgs because it has severely outdated dependencies that became unmaintainable with nixpkgs' python package-set.
357357+354358- `dagger` was removed because using a package called `dagger` and packaging it from source violates their trademark policy.
355359356360- `win-virtio` package was renamed to `virtio-win` to be consistent with the upstream package name.
···507511- `ffmpeg` default upgraded from `ffmpeg_5` to `ffmpeg_6`.
508512509513- `fusuma` now enables the following plugins: [appmatcher](https://github.com/iberianpig/fusuma-plugin-appmatcher), [keypress](https://github.com/iberianpig/fusuma-plugin-keypress), [sendkey](https://github.com/iberianpig/fusuma-plugin-sendkey), [tap](https://github.com/iberianpig/fusuma-plugin-tap) and [wmctrl](https://github.com/iberianpig/fusuma-plugin-wmctrl).
514514+515515+- `services.bitcoind` now properly respects the `enable` option.
510516511517## Nixpkgs internals {#sec-release-23.11-nixpkgs-internals}
512518
···5454 };
55555656 imports = [
5757- (lib.mkRemovedOptionModule ["programs" "direnv" "persistDerivations"] "persistDerivations was removed as it is on longer necessary")
5757+ (lib.mkRemovedOptionModule ["programs" "direnv" "persistDerivations"] "persistDerivations was removed as it is no longer necessary")
5858 ];
59596060 config = lib.mkIf cfg.enable {
···8484 "-e"
8585 (builtins.toFile "bash-builder.sh" ''
8686 export CONFIG_SHELL=$SHELL
8787+8888+ # Normalize the NIX_BUILD_CORES variable. The value might be 0, which
8989+ # means that we're supposed to try and auto-detect the number of
9090+ # available CPU cores at run-time. We don't have nproc to detect the
9191+ # number of available CPU cores so default to 1 if not set.
9292+ NIX_BUILD_CORES="''${NIX_BUILD_CORES:-1}"
9393+ if [ $NIX_BUILD_CORES -le 0 ]; then
9494+ NIX_BUILD_CORES=1
9595+ fi
9696+ export NIX_BUILD_CORES
9797+8798 bash -eux $buildCommandPath
8899 '')
89100 ];
···5454 "-e"
5555 (builtins.toFile "bash-builder.sh" ''
5656 export CONFIG_SHELL=$SHELL
5757+5858+ # Normalize the NIX_BUILD_CORES variable. The value might be 0, which
5959+ # means that we're supposed to try and auto-detect the number of
6060+ # available CPU cores at run-time.
6161+ NIX_BUILD_CORES="''${NIX_BUILD_CORES:-1}"
6262+ if ((NIX_BUILD_CORES <= 0)); then
6363+ guess=$(nproc 2>/dev/null || true)
6464+ ((NIX_BUILD_CORES = guess <= 0 ? 1 : guess))
6565+ fi
6666+ export NIX_BUILD_CORES
6767+5768 bash -eux $buildCommandPath
5869 '')
5970 ];
···711711 pinentry_qt = throw "'pinentry_qt' has been renamed to/replaced by 'pinentry-qt'"; # Converted to throw 2023-09-10
712712 pinentry_qt5 = pinentry-qt; # Added 2020-02-11
713713 poetry2nix = throw "poetry2nix is now maintained out-of-tree. Please use https://github.com/nix-community/poetry2nix/"; # Added 2023-10-26
714714+ privacyidea = throw "privacyidea has been removed from nixpkgs"; # Added 2023-10-31
714715 probe-rs-cli = throw "probe-rs-cli is now part of the probe-rs package"; # Added 2023-07-03
715716 processing3 = throw "'processing3' has been renamed to/replaced by 'processing'"; # Converted to throw 2023-09-10
716717 prometheus-dmarc-exporter = dmarc-metrics-exporter; # added 2022-05-31