chore(nix): bump the seed installer pin 2.28.3 → 2.35.1 - #139
Merged
Conversation
`#135` repaired `dev/bump-nix` (it resolves from /tags, since NixOS/nix publishes no releases) but repairing the resolver does not move the pin, and nothing in the tree notices a stale one: the coupling is `tool:`-guarded precisely because no hermetic test can verify an installer checksum, so a tool nobody runs is indistinguishable from a pin that is current. Run the tool. `NIX_VERSION` and `NIX_INSTALLER_SHA256` move together or not at all, so this is a two-line whole-pin rewrite, not a half-bump. Verified against the real build and runtime rather than the suite alone, since this is exactly the coupling no offline test can reach: - the checksum is the release's — a second independent download of nix-2.35.1/install hashes to the committed value; - `sha256sum -c` passes at the real build site, in a docker build running the same two lines every nix-seed overlay uses (`. nix-seed.sh; nix_build_install`) on the classic route's base image; - the seeded profile still lands on PATH per the `NIX_USER` invariant: seeding a fresh `/nix` volume from the new tarball leaves `nix (Nix) 2.35.1` on PATH at the exact `/home/vscode/.nix-profile/bin` literal the overlays repeat in `EXTRA_PATH`, with nix.conf's sandbox forced off as before; - `--no-daemon` is still a supported install mode and `scripts/nix-profile.sh.in` is byte-identical across the jump, so neither the flag nor profile resolution drifted over 7 minor versions; - `nix/base` is unaffected: it builds its store from nixpkgs and references the installer pin nowhere. Also drop the two prose copies of the old version this bump just made stale — a comment in `xorq-desktop/install-system.sh` and an example in `nix/base/README.md`, both naming 2.28.3. They get pointers to the single pin rather than a re-synced number: a restated value is a drift source, and these two are the "prose stood in for a guard" shape CLAUDE.md already records. No new guard comes with them because there is no longer a second copy to disagree — the fact is structural now, living in `lib/nix-seed.sh` alone. Closes #137 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#135repaireddev/bump-nix— it resolves versions from/tags, since NixOS/nix publishes no releases — but repairing the resolver does not move the pin, and nothing in the tree notices a stale one. The coupling istool:-guarded precisely because no hermetic test can verify an installer checksum, so a tool nobody runs is indistinguishable from a pin that is current.So: run the tool.
NIX_VERSIONandNIX_INSTALLER_SHA256move together or not at all, which makes this a two-line whole-pin rewrite rather than a half-bump.Verification
The suite cannot reach this coupling, so I checked the parts it can't — against a real build and a real seeded volume:
nix-2.35.1/installhashes to the committed34e0ef63…sha256sum -cpasses at the real build site. nix-seed.sh; nix_build_install) on the classic route's base imagePATH(theNIX_USERinvariant)/nixvolume from the new tarball leavesnix (Nix) 2.35.1onPATHat the exact/home/vscode/.nix-profile/binliteral the overlays repeat inEXTRA_PATH, withnix.conf's sandbox forced off as before--no-daemonis still a supported install mode, andscripts/nix-profile.sh.inis byte-identical between the two tags — neither the flag nor profile resolution movednix/baseunaffectedtests/run-all0 failed;pre-commit run --all-filescleanStale prose, dropped rather than re-synced
The bump made two copies of the old version stale: a comment in
projects/xorq-desktop/install-system.shand an example snippet innix/base/README.md, both naming 2.28.3. Both get pointers to the single pin instead of a refreshed number — a restated value is a drift source, and these two are exactly the "prose stood in for a guard" shape CLAUDE.md records.No new guard ships with them because there is no longer a second copy to disagree: the fact is structural now, living in
lib/nix-seed.shalone. The README also now namesdevcontainer bump-nixas the way to move the shared pin, which it previously did not.Out of scope, filed separately
While checking the
NIX_USERinvariant I found thatnix_seed_volume's fallback symlinks~/.nix-profile→/nix/var/nix/profiles/per-user/$NIX_USER/profile, but nix installs the single-user profile to$HOME/.local/state/nix/profiles/profile—per-user/is an empty directory in the seed tarball. This is identical at 2.28.3, so it is not a regression from this bump, and it is latent rather than live: the branch is gated on[ ! -e "$HOME/.nix-profile" ]and the installer's own compat symlink is baked into the image, so the guard never fires today. Deliberately untouched here to keep this PR a pin bump.Closes #137
🤖 Generated with Claude Code