Skip to content

Minimal nix update #5912

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Oct 2, 2025
Merged

Minimal nix update #5912

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
16bea67
Update link to Stack docs
sellout Jul 4, 2025
90127b2
Don’t sandbox `unison-cli:test:cli-tests` in Nix
sellout Jul 7, 2025
99627c4
Set up hpack as a haskell.nix tool
sellout Jul 6, 2025
ae22f71
Remove obsolete Nix workaround
sellout Jul 4, 2025
3dac265
Adopt nix-systems pattern
sellout Oct 1, 2025
1f6d098
Use common name for dominant Nixpkgs
sellout Oct 1, 2025
a013b02
Update nix-dev-cache workflow
sellout Oct 2, 2025
7deaa24
Merge branch 'trunk' into minimal-nix-update
sellout Oct 2, 2025
5702e0f
Add reference to Nixpkgs issue
sellout Oct 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/nix-dev-cache.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:
- ubuntu-24.04
# - ubuntu-24.04-arm https://github.com/unisonweb/unison/issues/5789
- macos-13
- macos-14
- macos-15
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
- name: mount Nix store on larger partition
Expand All @@ -33,13 +33,13 @@ jobs:
run: |
sudo mkdir /nix /mnt/nix
sudo mount --bind /mnt/nix /nix
- uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
- uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31.7
if: runner.os == 'Linux'
with:
extra_nix_config: |
extra-trusted-public-keys = hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=
extra-substituters = https://cache.iog.io
- uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
- uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31.7
if: runner.os != 'Linux'
- uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
with:
Expand Down
2 changes: 1 addition & 1 deletion codebase2/codebase-sqlite/unison-codebase-sqlite.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.37.0.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
2 changes: 1 addition & 1 deletion codebase2/codebase-sync/unison-codebase-sync.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.35.0.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
2 changes: 1 addition & 1 deletion codebase2/util-serialization/unison-util-serialization.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.35.0.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
2 changes: 1 addition & 1 deletion codebase2/util-term/unison-util-term.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.35.0.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
8 changes: 6 additions & 2 deletions flake.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

36 changes: 17 additions & 19 deletions flake.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,54 +5,52 @@
allow-import-from-derivation = true;
extra-substituters = ["https://unison.cachix.org"];
extra-trusted-public-keys = ["unison.cachix.org-1:i1DUFkisRPVOyLp/vblDsbsObmyCviq/zs6eRuzth3k="];
## This allows derivations with `__noChroot` set to run outside the sandbox.
sandbox = "relaxed";
Copy link
Contributor

@ceedubs ceedubs Oct 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a place where we aren't able to do a check that would limit this to darwin, isn't it?

Copy link
Contributor Author

@sellout sellout Oct 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, NixOS/nix#4945. This spot is particularly annoying, because the defaults are different on Linux and Darwin, but there’s no way to tighten Darwin from false to "relaxed" without simultaneously weakening Linux from true to "relaxed". But … I prefer "relaxed" as my default anyway, since it lets me control it at the derivation level, and individual environments can still be sandboxed, and thus disallow unsandboxed derivations.

};

inputs = {
flake-utils.url = "github:numtide/flake-utils";
haskellNix.url = "github:input-output-hk/haskell.nix";
nixpkgs-haskellNix.follows = "haskellNix/nixpkgs-unstable";
nixpkgs.follows = "haskellNix/nixpkgs-unstable";
nixpkgs-release.url = "github:NixOS/nixpkgs/release-24.05";
flake-utils.url = "github:numtide/flake-utils";
systems.follows = "flake-utils/systems";
};

outputs = {
self,
flake-utils,
haskellNix,
nixpkgs-haskellNix,
nixpkgs,
nixpkgs-release,
flake-utils,
self,
systems,
}:
flake-utils.lib.eachSystem [
"x86_64-linux"
"x86_64-darwin"
"aarch64-darwin"
"aarch64-linux"
]
flake-utils.lib.eachSystem (import systems)
(system: let
versions = import ./nix/versions.nix {inherit (nixpkgs-haskellNix) lib;};
pkgs = import nixpkgs-haskellNix {
versions = import ./nix/versions.nix {inherit (nixpkgs) lib;};
pkgs = import nixpkgs {
inherit system;
inherit (haskellNix) config;
overlays = [
haskellNix.overlay
(import ./nix/dependencies.nix {inherit nixpkgs-release;})
(import ./nix/dependencies.nix {nixpkgs = nixpkgs-release;})
];
};
unison-project = import ./nix/unison-project.nix {
inherit (nixpkgs-haskellNix) lib;
inherit (nixpkgs) lib;
inherit (pkgs) haskell-nix;
};
haskell-nix-flake = import ./nix/haskell-nix-flake.nix {
inherit pkgs unison-project versions;
inherit (nixpkgs-haskellNix) lib;
inherit (nixpkgs) lib;
};
renameAttrs = fn:
nixpkgs-haskellNix.lib.mapAttrs' (name: value: {
nixpkgs.lib.mapAttrs' (name: value: {
inherit value;
name = fn name;
});
in
assert pkgs.stack.version == versions.stack;
assert pkgs.hpack.version == versions.hpack; {
assert pkgs.stack.version == versions.stack; {
packages =
renameAttrs (name: "component-${name}") haskell-nix-flake.packages
// renameAttrs (name: "docker-${name}") (import ./nix/docker.nix {
Expand Down
2 changes: 1 addition & 1 deletion lib/orphans/network-uri-orphans-sqlite/network-uri-orphans-sqlite.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.35.2.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
2 changes: 1 addition & 1 deletion lib/orphans/unison-core-orphans-sqlite/unison-core-orphans-sqlite.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.35.2.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
2 changes: 1 addition & 1 deletion lib/orphans/unison-hash-orphans-aeson/unison-hash-orphans-aeson.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.35.2.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
2 changes: 1 addition & 1 deletion lib/orphans/unison-hash-orphans-sqlite/unison-hash-orphans-sqlite.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.35.2.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
2 changes: 1 addition & 1 deletion lib/orphans/uuid-orphans-sqlite/uuid-orphans-sqlite.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.35.2.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
2 changes: 1 addition & 1 deletion lib/unison-hashing/unison-hashing.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.37.0.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
2 changes: 1 addition & 1 deletion lib/unison-pretty-printer/unison-pretty-printer.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.37.0.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
2 changes: 1 addition & 1 deletion lib/unison-sqlite/unison-sqlite.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.37.0.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
2 changes: 1 addition & 1 deletion lib/unison-util-file-embed/unison-util-file-embed.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.35.2.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
2 changes: 1 addition & 1 deletion lib/unison-util-rope/unison-util-rope.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.35.2.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
8 changes: 4 additions & 4 deletions nix/dependencies.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
{nixpkgs-release}: final: prev: let
pinned-pkgs = import nixpkgs-release {inherit (final) system;};
{nixpkgs}: final: prev: let
pinned-pkgs = nixpkgs.legacyPackages.${final.system};
in {
stack = pinned-pkgs.stack;

## See https://docs.haskellstack.org/en/stable/nix_integration/#supporting-both-nix-and-non-nix-developers for an
## explanation of this package.
## See https://docs.haskellstack.org/en/stable/topics/nix_integration/#supporting-both-nix-and-non-nix-developers for
## an explanation of this package.
stack-wrapped = final.symlinkJoin {
name = "stack"; # will be available as the usual `stack` in terminal
paths = [final.stack];
Expand Down
16 changes: 8 additions & 8 deletions nix/haskell-nix-flake.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,20 +33,14 @@
++ [
pkgs.cachix
pkgs.gettext # for envsubst, used by unison-src/builtin-tests/interpreter-tests.sh
pkgs.hpack
pkgs.jq # helpful when pushing to Cachix
pkgs.pkg-config
pkgs.stack-wrapped
];
# workaround for https://gitlab.haskell.org/ghc/ghc/-/issues/11042
shellHook = ''
export LD_LIBRARY_PATH=${pkgs.zlib}/lib:$LD_LIBRARY_PATH
'';
tools =
(args.tools or {})
// {
cabal = {version = versions.cabal;};
ormolu = {version = versions.ormolu;};
cabal.version = versions.cabal;
haskell-language-server = {
version = versions.hls;
modules = [
Expand All @@ -65,7 +59,9 @@
constraints: ormolu == ${versions.ormolu}
'';
};
weeder = {version = versions.weeder;};
hpack.version = versions.hpack;
ormolu.version = versions.ormolu;
weeder.version = versions.weeder;
};
};

Expand All @@ -80,6 +76,10 @@ in
// {
## This check has a test that tries to write to $HOME, so we give it a fake one.
"unison-cli:test:cli-tests" = haskell-nix-flake.checks."unison-cli:test:cli-tests".overrideAttrs (old: {
## On macOS, this derivation requires access to `security`, which is outside the sandbox, so we tell Nix that
## it doesn’t work in the sandbox. There is a lot of discussion, but no fix, with NixOS/nixpkgs#297775 maybe
## being the best starting point.
__noChroot = pkgs.stdenv.isDarwin;
Copy link
Contributor

@ceedubs ceedubs Oct 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does adding a dependency on darwin.apple_sdk.frameworks.Security instead work? I don't have a good way to test that.

Copy link
Contributor Author

@sellout sellout Oct 2, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It doesn’t, unfortunately. I just updated the comment to at least link to some Nixpkgs discussion. This is the same reason you have https://github.com/ceedubs/unison-nix/blob/trunk/nix/darwin-security-hack.nix (that’s also unsandboxed, but implicitly since you don’t have sandbox = "relaxed").

It might be worth bringing darwin-security-hack over here as a smaller unsandboxed derivation, where we can add more commentary, and then this can be a sandboxed one that depends on that one.

Copy link
Contributor Author

@sellout sellout Oct 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actually, I don’t think darwin-security-hack would work here. Nixpkgs has already patched the offending Haskell packages to look at the absolute path for security, so copying it to the store doesn’t do anything.

https://github.com/matthewbauer/nixpkgs/blob/master/pkgs/development/haskell-modules/configuration-nix.nix#L151-L167

## The builder here doesn’t `runHook preBuild`, so we just prepend onto `buildPhase`.
buildPhase =
''
Expand Down
2 changes: 1 addition & 1 deletion nix/versions.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ in
vscodeSettings."haskell.toolchain"
## There are some things we want to pin that the VS Code Haskell extension doesn’t let us control.
// {
hpack = "0.35.2";
hpack = "0.36.0"; # This needs to match the version returned by `nix develop --command stack --version`.
ormolu = "0.7.2.0";
weeder = "2.8.0";
}
2 changes: 1 addition & 1 deletion parser-typechecker/unison-parser-typechecker.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.37.0.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
2 changes: 1 addition & 1 deletion unison-cli-integration/unison-cli-integration.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.37.0.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
2 changes: 1 addition & 1 deletion unison-cli-main/unison-cli-main.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.37.0.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
2 changes: 1 addition & 1 deletion unison-runtime/unison-runtime.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.37.0.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
2 changes: 1 addition & 1 deletion unison-share-api/unison-share-api.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.37.0.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
2 changes: 1 addition & 1 deletion unison-share-projects-api/unison-share-projects-api.cabal
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
cabal-version: 1.12

-- This file has been generated from package.yaml by hpack version 0.37.0.
-- This file has been generated from package.yaml by hpack version 0.36.0.
--
-- see: https://github.com/sol/hpack

Expand Down
Loading