summaryrefslogtreecommitdiff
path: root/doc
AgeCommit message (Collapse)Author
2025-08-25home: Add home-oci-service-type.Giacomo Leidi
* gnu/home/service/containers.scm: New file; * gnu/local.mk (GNU_SYSTEM_MODULES): Add it. * doc/guix.texi (OCI backed services): Document it. Change-Id: I8ce5b301e8032d0a7b2a9ca46752738cdee1f030 Signed-off-by: Maxim Cournoyer <maxim@guixotic.coop>
2025-08-25services: Add oci-service-type.Giacomo Leidi
This patch implements a generalization of the oci-container-service-type, which consequently is made deprecated. The oci-service-type, in addition to all the features from the oci-container-service-type, can now provision OCI networks and volumes. It only handles OCI objects creation, the user is supposed to handle state once the objects are provsioned. It currently supports two different OCI runtimes: Docker and rootless Podman. Both runtimes are tested to make sure provisioned containers can connect to each other through provisioned networks and can read/write data with provisioned volumes. At last the Scheme API is thought to facilitate the implementation of a Guix Home service in the future. * gnu/build/oci-containers.scm: New file containg OCI runtime business logic used in OCI backed Shepherd services. oci-read-lines (oci-system*,oci-object-exists?,oci-object-service-available? oci-image-load,oci-log-verbose,oci-container-execlp,oci-object-create): New procedures. * gnu/local.mk: Add it. * gnu/services/containers.scm (list-of-oci-containers?, list-of-oci-networks?,list-of-oci-volumes?,%oci-supported-runtimes, oci-runtime?,oci-runtime-system-environment,oci-runtime-system-extra-arguments, oci-runtime-system-requirement,oci-runtime-cli,oci-runtime-system-cli, oci-runtime-home-cli,oci-runtime-name,oci-runtime-group, oci-container-shepherd-name,oci-networks-shepherd-name, oci-networks-home-shepherd-name,oci-volumes-shepherd-name, oci-volumes-home-shepherd-name,oci-container-configuration->options, oci-network-configuration->options,oci-volume-configuration->options, oci-container-shepherd-service,oci-objects-merge-lst,oci-extension-merge, oci-service-accounts,oci-service-profile,oci-service-subids, oci-configuration->shepherd-services,oci-configuration-extend): New procedures. (image-reference): Implement unambiguous naming convention, that paired with the new implementation for listing caches images with docker ls or podman ls, allows for more efficient image caching. (oci-container-configuration)[user,group]: Change default-type to maybe-string, since by default containers will run under the user and group declared in oci-configuration records. When unset the oci-service-type will derive their value from the OCI runtime state. [runtime,host-environment,environment,shepherd-actions,ports,extra-arguments]: define a predicate and use it as a type in the configuration. This way errors are reported with source location information. (lower-manifest): Defer to caller the logic of setting up an image tag. (lower-oci-image): Rename to load-oci-image-state. (oci-runtime-state): Intermediate representation of the OCI runtime details. It is supposed to be an internal API. (oci-state): Intermediate representation of the OCI provisioning state, such as containers and networks. It is supposed to be an internal API. (oci-container-invocation): Intermediate representation of the OCI runtime run command to start a container. It is supposed to be an internal API. (%oci-image-loader): Rename to oci-image-loader and use oci-runtime-state and (gnu build oci-containers). (oci-container-shepherd-service): Use oci-state and oci-runtime-state, add command-line action. (oci-network-configuration,oci-volume-configuration,oci-configuration, oci-extension): New record types. (oci-service-type): New service-type. * doc/guix.texi: Document it. * gnu/tests/containers.scm: Test it. * gnu/services/docker.scm: Deprecate the oci-container-service-type. Change-Id: I656b3db85832e42d53072fcbfb91d1226f39ef38 Modified-by: Maxim Cournoyer <maxim@guixotic.coop> Signed-off-by: Maxim Cournoyer <maxim@guixotic.coop>
2025-08-23doc: Increase minimum Guile-Git version.Morgan Arnold
* doc/contributing.text: bump minimum required version of guile-git from 0.5.0 to 0.10.0, required by 86022e994e. * po/doc/guix-manual.*: update translations as well. Change-Id: I8cc8fd720cc71fbe17e2e530f7411b9c888ba0f6 Signed-off-by: Ludovic Courtès <ludo@gnu.org>
2025-08-23services: system-log: Allow ‘max-silent-time’ to be #f.Ludovic Courtès
* gnu/services/shepherd.scm (gexp-or-integer-or-false?): New procedure. (system-log-configuration)[max-silent-time]: Change to ‘gexp-or-integer-or-false’. * doc/guix.texi (Shepherd Services): Regenerate documentation with ‘configuration->documentation’. Change-Id: I75228cd19ca892c26347a64cbb952668fc893669
2025-08-21doc: Document lockfile importer based Rust packaging workflow.Hilton Chain
* doc/guix.texi (Build Systems) [cargo-build-system]: Add cross-reference for the term "Cargo workspaces". * doc/contributing.texi (Packaging Guidelines)[Rust Crates]: Update documentation. * doc/guix-cookbook.texi (Packaging)[Packaging Workflow]: New section. * gnu/packages/rust-crates.scm, * gnu/packages/rust-sources.scm: Stop mentioning guix-rust-registry for now, we may remove the repository if future merges are managed well. Change-Id: Ic0c6378cf5f5df97d6f8bdd040b486be62c7bddc
2025-08-21import: crate: Stop importing dependencies from crates.io.Hilton Chain
* guix/scripts/import/crate.scm (show-help, %options, guix-import-crate) [--recursive, --recursive-dev-dependencies, --mark-missing]: Remove options. * doc/guix.texi (Invoking guix import)[crate]: Adjust accordingly. Mention packaging workflow. * guix/import/crate.scm (make-crate-sexp): Don't use "rust-" prefix and semver suffix for package name. [#:cargo-inputs, #:cargo-development-inputs, #:build?]: Remove arguments. (crate->guix-package)[#:include-dev-deps?, #:mark-missing?]: Remove arguments. (<crate-dependency>): Remove data type. (make-crate-dependency, crate-dependency?, json->crate-dependency) (crate-version-dependencies, package-names->package-inputs) (maybe-cargo-inputs, maybe-cargo-development-inputs, maybe-arguments) (version->semver-prefix, find-package-version, crate-recursive-import): Remove procedures. * tests/crate.scm (test-foo-crate, test-bar-crate): Adjust for modified tests. (test-foo-dependencies, test-bar-dependencies, test-root-crate) (test-root-dependencies, test-intermediate-a-crate) (test-intermediate-a-dependencies, test-intermediate-b-crate) (test-intermediate-b-dependencies, test-intermediate-c-crate) (test-intermediate-c-dependencies, test-leaf-alice-crate) (test-leaf-alice-dependencies, test-leaf-bob-crate) (test-leaf-bob-dependencies, rust-leaf-bob-3, rust-leaf-bob-3.0.2-yanked): Remove variables. ("crate->guix-package yanked", "crate->guix-package only yanked available"): New tests. ("crate->guix-package"): Adjust accordingly. ("crate->guix-package-marks-missing-packages", "crate-recursive-import") ("crate-recursive-import-honors-existing-packages") ("crate-import-only-yanked-available"): Remove tests. Change-Id: Ib1d24511ed0ea1a2373f53de12e06afa7950a7d7
2025-08-21build-system: cargo: Deprecate #:cargo-inputs and #:cargo-development-inputs.Hilton Chain
* guix/build-system/cargo.scm (lower): Emit warning when using #:cargo-inputs or #:cargo-development-inputs. * doc/guix.texi (Build Systems)[cargo-build-system]: Deprecate #:cargo-inputs and #:cargo-development-inputs. Change-Id: I43ed66e04c55368159aed309367c4ac278d8cc58
2025-08-21import: crate: Add ‘--lockfile’ option.Hilton Chain
* guix/import/crate.scm (cargo-inputs-from-lockfile) find-cargo-inputs-location, extract-cargo-inputs): New procedures. * guix/scripts/import/crate.scm (%options): Add ‘--lockfile’ option. (show-help): Add it. (guix-import-crate): Use it. * doc/guix.texi (Invoking guix import): Document it. Change-Id: I291478e04adf9f2df0bf216425a5e8aeba0bedd9
2025-08-21build-system: cargo: Support installing Cargo workspace.Hilton Chain
*guix/build-system/cargo.scm (cargo-build, cargo-cross-build) [#:cargo-install-paths]: New argument. * guix/build/cargo-build-system.scm (install): Use it. * doc/guix.texi (Build Systems)[cargo-build-system]: Document it. Change-Id: I74ed1972a5716da05afeac8edb2b0e4b6834bf40
2025-08-21build-system: cargo: Support packaging Cargo workspace.Hilton Chain
* guix/build-system/cargo.scm (cargo-build, cargo-cross-build) [#:cargo-package-crates]: New argument. * guix/build/cargo-build-system.scm (package): Use it. * doc/guix.texi (Build Systems)[cargo-build-system]: Document it. Change-Id: I45ccd95e90827d47127015cb0bda2d41f792335b
2025-08-20doc: Upgrading Guix: Add instructions for distro packages.Denis 'GNUtoo' Carikli
This makes sure that, prior to the upgrade commands, the guix-daemon is run from /var/guix/profiles/per-user/root/current-guix/bin/guix-daemon instead of /usr/bin/guix-daemon. * doc/guix.texi (Upgrading Guix): Add instructions for distro packages. Change-Id: I71df3603cffc5d20b6a77241b0c384872b54ec83 Signed-off-by: Maxim Cournoyer <maxim@guixotic.coop>
2025-08-20doc: Upgrading Guix: Constraint update command to guix-install.sh.Denis 'GNUtoo' Carikli
At least on distributions based on Arch Linux and Debian, the given command to update the daemon doesn't work because the systemd service runs /usr/bin/guix-daemon instead of @localstatedir@/guix/profiles/per-user/root/current-guix/bin/guix-daemon. * doc/guix.texi (Upgrading Guix): Tell that the command works if Guix was installed with guix-install.sh. Change-Id: I2360a9dc9a5b23f28e25402b92724f51d9ed3937 Signed-off-by: Maxim Cournoyer <maxim@guixotic.coop>
2025-08-06doc: Fix some typos.Efraim Flashner
* doc/contributing.texi (Bulk Updates): Fix typo. * doc/guix.texi (Networking Services, Power Management Services, Guix Services, Backup Home Services): Same. Change-Id: I4ebde33ad628e35ea2c1888b8247707ab3763cf1
2025-08-04gnu: cmake-build: Retry failed tests.Greg Hogan
* guix/build-system/cmake.scm (cmake-build, cmake-cross-build), * guix/build-system/qt.scm (qt-build, qt-cross-build): Add test-repeat-until-pass? and test-repeat-until-pass-count fields. * guix/build/cmake-build-system.scm (check): Add and use new fields. * doc/guix.texi: Document new parameters. Change-Id: I046dfc86a18fb2a2be4ae362c1226c2f8cab129c
2025-08-03build-system/cmake: Use CMake.Greg Hogan
* guix/build/cmake-build-system.scm (configure): Add and use generator field to configure the build system. Create and use CMake variable cache file. Set the CMake variable BUILD_TESTING to the value of TESTS? so that a package can optionally build tests. Set CMAKE_COLOR_DIAGNOSTICS to ON. Set max load for parallel builds. (build, install): New function. (check): Replace call to gnu-build's non-parallelizable check with function using cmake's ctest. (%standard-phase): Add new build and install functions as phases. * guix/build-system/cmake.scm (cmake-build, cmake-cross-build), * guix/build-system/qt.scm (qt-build, qt-cross-build): Add generator and test-exclude fields and remove unused test-target field. * doc/guix.texi: Document new parameters. * guix/build-system/cmake.scm (cmake-build), * guix/build-system/qt.scm (qt-build): Add ninja to build-inputs. Change-Id: Ifa8174c91f0fdc030ac5813e98f7c21cba1a7725
2025-08-03doc: Correct tor-onion-service-configuration mapping documentation.Zacchaeus
* doc/guix.texi (Networking Services): Fix tor-onion-service-configuration description which was broken in commit 9be1ee6a49 when documentation was changed to indicated that port-location mappings should be provided as cons cells when the code always expected lists Change-Id: Ib12d273cbd37976f9507a60a6d088078f71d4e7a Signed-off-by: Danny Milosavljevic <dannym@friendly-machines.com>
2025-08-03doc: Fix rootless-podman-service-type example.Gabriel Wicki
Fixes: guix/guix#1308. * doc/guix.texi (Miscellaneous Services): Fix the rootless-podman-service-type example. Change-Id: I3ff484df7088fe8e0994c71b81ee474c81a3070a Signed-off-by: Danny Milosavljevic <dannym@friendly-machines.com>
2025-07-28guix: lint: Check for misplaced argument flags.Efraim Flashner
* guix/lint.scm (check-misplaced-flags): New procedure. (%local-checkers): Register new lint-checker. * doc/guix.texi (Invoking guix lint): Add entry for misplaced-flags. * tests/lint.scm (misplaced-flags: make-flag is incorrect, misplaced-flags: configure-flag is incorrect, misplaced-flags: cargo feature flags, misplaced-flags: flags without g-exp is incorrect, misplaced-flags: build-type set correctly): New tests. Change-Id: Ia8abbe787e26bffc65ee5c763326c7e271c189a4
2025-07-27services: tor: add auto-start?Zacchaeus
* gnu/services/networking.scm (tor-configuration): Add `auto-start?' field. Fix indent. * doc/guix.texi (tor-configuration): Document this. Change-Id: I9339291e3329d615550f97e9cc0f0d773f0d1c51 Reviewed-by: André Batista <nandre@riseup.net> Signed-off-by: Sharlatan Hellseher <sharlatanus@gmail.com>
2025-07-25services: Add shared-cache-service-type.Edouard Klein
* gnu/services/guix.scm (shared-cache-service-type) (shared-cache-configuration, user-cache): New variables. * doc/guix.texi (Shared Cache Service): New subsubsection under "Guix Services". Change-Id: I73a8db228d9a892c8bb93c6cdfef12d0d06e25a6 Signed-off-by: Maxim Cournoyer <maxim@guixotic.coop> Modified-by: Maxim Cournoyer <maxim@guixotic.coop>
2025-07-25services: Add vfs-mapping-service-type.Edouard Klein
* gnu/services/linux.scm (vfs-mapping-service-type, vfs-mapping-configuration, vfs-mapping-binding): New variables. * doc/guix.texi: (Vfs Mapping Service): New subsubsection under "Linux Services". Change-Id: I7ebd48afb809ded9fa6fe9eb80c618accb856716 Signed-off-by: Maxim Cournoyer <maxim@guixotic.coop>
2025-07-19doc: Adjust guix-install.sh URL.Maxim Cournoyer
A new alias as been added to the nginx configuration to improve consistency. * doc/guix.texi (Binary Installation): Replace https://guix.gnu.org/install.sh with https://guix.gnu.org/guix-install.sh. Closes: #573 Change-Id: Iaf1da338b5d6433e9e7b1459db3587bf7a44ad79 Reported-by: Artyom V. Poptsov <poptsov.artyom@gmail.com>
2025-07-19services: Add rabbitmq service.wrobell
* gnu/services/high-availability.scm (<rabbitmq-configuration>): New record. (rabbitmq-shepherd-service): New procedure. (rabbitmq-service-type): New variable. * gnu/tests/high-availability.scm (run-rabbitmq-test): New procedure. (%rabbitmq-os, %tests-rabbitmq): New variables. * doc/gnu.texi (High Availability Services): Document it. Change-Id: I53e9f2881b6340e1ed314785e4c5529b81381a3b Co-authored-by: Christopher Baines <mail@cbaines.net> Reviewed-by: Ludovic Courtès <ludo@gnu.org> Signed-off-by: Sharlatan Hellseher <sharlatanus@gmail.com>
2025-07-18doc: Update arguments for gexp procedures.Tomas Volf
Some keyword arguments were missing, some had wrong default values. This commit updates the documentation to match the code. * doc/guix.texi (G-Expressions)[computed-file]: Use @var. Document #:guile. [gexp->script]: Fix default value for #:target. [gexp->file]: Document #:system and #:target. Change-Id: Ie92a57fe1c3b45d1c7a5e8865fcf291c5f590c11 Signed-off-by: Janneke Nieuwenhuizen <janneke@gnu.org>
2025-07-18mapped-devices: luks: Adjust to support extra arguments.Ludovic Courtès
Fixes <https://issues.guix.gnu.org/70826>. When using ‘luks-device-mapping-with-options’, procedures such as ‘operating-system-boot-mapped-devices’ would fail to identify LUKS mapped devices because they would check whether the mapped device type is ‘eq?’ to ‘luks-device-mapping’. This addresses that by ensuring mapped devices are always of the ‘luks-device-mapping’ type, even when different options are used. * gnu/system/mapped-devices.scm (close-luks-device): Add #:rest. (luks-device-mapping-with-options): Deprecate. * gnu/tests/install.scm (%encrypted-home-os-key-file): Update accordingly. * doc/guix.texi (Mapped Devices): Document use of the ‘arguments’ field of ‘luks-device-mapping’. Remove ‘luks-device-mapping-with-options’ documentation. (Bootloader Configuration): Update example with key file in extra initrd. Change-Id: I5442908cb8ef4e3891dbb053cccf5e42b895486f Reported-by: Tadhg McDonald-Jensen <tadhgmister@gmail.com>
2025-07-18mapped-devices: Add ‘arguments’ field.Ludovic Courtès
Fixes <https://issues.guix.gnu.org/70826>. This allows users to specify extra arguments specific to the underlying mapped device type. * gnu/system/mapped-devices.scm (<mapped-device>)[arguments]: New field. (device-mapping-service-type): Honor it. * guix/scripts/system.scm (check-mapped-devices): Likewise. * gnu/system/linux-initrd.scm (raw-initrd): Likewise. * doc/guix.texi (Mapped Devices): Document it. Reported-by: 45mg <45mg.writes@gmail.com> Change-Id: Idef5a3e68535c412f13bae9a92c81c49053d4f4a
2025-07-12doc: Fix some grammar.cdr-shdr-wdr
* doc/contributing.texi (Alternative Setups): Fix grammar, add double space. (Sending a Patch Series): Add missing word. * doc/guix.texi (Daemon Offload Setup, Invoking guix repl): Fix grammar. (Bootloader Configuration): Fix grammar, capitalize "RAM". Change-Id: I459c8343b28b2b3474c7a54372f75c61c8111a10 Signed-off-by: Danny Milosavljevic <dannym@friendly-machines.com>
2025-07-12services: greetd: Support initial-session.Danny Milosavljevic
* gnu/services/base.scm (<greetd-terminal-configuration>): Add initial-session-user, initial-session-command. * doc/guix.texi (Base Services): Document them. Change-Id: Iaf7a8203f34794bc36b031166e1ff7005d7a7104
2025-07-10nls: Update translations.Florian Pelz
* po/doc/guix-cookbook.it.po: New file. * po/doc/guix-manual.it.po: New file. * po/doc/local.mk: Add 'it' manual, cookbook. * po/doc/po4a.cfg (po4a_langs): Add 'it'. * po/guix/el.po: New file. * po/guix/LINGUAS: Add 'el'. * doc/local.mk: Add 'it' manual, cookbook. * doc/htmlxref.cnf: Update URLs for manual, cookbook. * doc/build.scm (%cookbook-languages, %manual-languages): Add 'it'. * doc/guix.texi (Top): Mention 'it' manual. * doc/guix-cookbook.texi (Top): Mention 'it' cookbook. Change-Id: I46023fa4b2dbe9db5227292823b4df9e41c3cee0
2025-07-10doc: Replace www.gnu.org broken links.Florian Pelz
See <https://bugs.gnu.org/78319>. * doc/guix-cookbook.texi (Packaging Tutorial): Fix links. Change-Id: Ib13b77a8248f6a1b91c05079c457bc4e96d847f3
2025-07-09doc: Update weblate URL.Julien Lepiller
* doc/build.scm (stylized-html): Update URL from fedora to codeberg's Weblate. * doc/contributing.texi: idem. * doc/guix-cookbook.texi: idem. * doc/guix.texi: idem. Change-Id: I13729a73f94738c9c336a067058020549f2640d6
2025-07-09doc: Fix URL of ‘language-picker.svg’.Ludovic Courtès
Fixes a regression introduced in 824d46a2fee18111a2a80f7805404a1ea58134c7. * doc/build.scm (stylized-html)[build]: Avoid double leading slash for ‘language-picker.svg’. Change-Id: I0817949862f061dbbe04352bda1e479347015c84
2025-07-09doc: Add links to versions and variants as a drop-down menu.Ludovic Courtès
* doc/build.scm (%latest-guix-version): New variable. (stylized-html): Add #:latest-version. [build](menu-item-separator): New variable. (version-menu-items, input-file-language): New procedures. (stylized-html, process-html): Add ‘language’ parameter. Update callers. Change-Id: If7cea2410802eec5af1d3c0407d5569250eb15ef
2025-07-09doc: Really honor ‘GUIX_WEB_SITE_URL’.Ludovic Courtès
This is useful when testing changes locally, so that CSS links point to the right place. * doc/build.scm (%web-site-url): Default to /. (%manual-css-url): Honor ‘%web-site-url’. Change-Id: I8d885eba0fb8560dd7da7f21629c716a06c16b1f
2025-07-09doc: Add missing paren in example.Ludovic Courtès
* doc/guix.texi (Messaging Home Services): Add missing parent in ‘home-snuik-service-type’ example. Change-Id: I97014da939f548000c45177f38387543c9200fc4
2025-07-08doc: Update letsencrypt URL for retrieving ACME subscriber agreement.Maxim Cournoyer
* doc/guix.texi (Certificate Services): Update URL. Change-Id: Ie32dcbc8198b70f1362b42c652542e3cc5654938
2025-07-08services: certbot: Add dry-run? certificate option.Pierre Langlois
* gnu/services/certbot.scm (certificate-configuration): Add dry-run? field. (certbot-command): Use it to pass --dry-run to certbot. * doc/guix.texi (Certificate Services): Document dry-run? option. Change-Id: I26b0dc06e2b7e5fb34305deee09e311d085f8a4b Signed-off-by: Maxim Cournoyer <maxim@guixotic.coop> Modified-by: Maxim Cournoyer <maxim@guixotic.coop>
2025-07-08services: certbot: Refer to authentication-hook in documentation.Pierre Langlois
* doc/guix.texi (Cerfiticate Services): Refer to non-abbreviated authentication-hook instead of auth-hook. Signed-off-by: Maxim Cournoyer <maxim@guixotic.coop>
2025-07-04services: ci: Add Forgejo Runner service.Ludovic Courtès
* gnu/services/ci.scm (<forgejo-runner-configuration>): New record type. (create-forgejo-runner-account, forgejo-runner-activation) (write-yaml, yaml-file, forgejo-runner-shepherd-service): New procedures. (forgejo-runner-service-type): New variable. * doc/guix.texi (Continuous Integration): Add “Forgejo Runner” heading. Co-authored-by: David Thompson <davet@gnu.org> Change-Id: Iba42d84da35812afa60e94773fbbadd68eca9813
2025-07-01doc: More typographical tweaks for “Bulk Updates” section.Ludovic Courtès
* doc/contributing.texi (Bulk Updates): Capitalize title. Leave two spaces after end-of-sentence period. Use @dots{} instead of showing full store file names, as per ‘assert-no-store-file-names’ target. Fix typo. Change-Id: Iceb0079ec35fda95280afff1c0d4b2cd84717b96
2025-07-01doc: contributing: Correct typos in Bulk updates.Sergey Trofimov
* doc/contributing.texi (Bulk updates): Correct typos. Change-Id: I660520b64139537e6ca9186c06810f5053d4368e Signed-off-by: Ludovic Courtès <ludo@gnu.org> Modified-by: Ludovic Courtès <ludo@gnu.org>
2025-06-30doc: Update CVE documentation.Nicolas Graves
* doc/guix.texi (Invoking guix lint): Document ‘cpe-vendor’ and ‘lint-hidden-cpe-vendors’. Change-Id: I5f3054c9f6e2d1e85a1ccb293a2471439f5e5f44 Signed-off-by: Ludovic Courtès <ludo@gnu.org>
2025-06-28gnu: bffe: Update to 0-15.2f9b1cb.Christopher Baines
* gnu/packages/package-management.scm (bffe): Update to 0-15.2f9b1cb. * doc/guix.texi (Guix Services): Remove build-priority option from example. Change-Id: Ib6444dabef5bae4976d2ff9e3e4956873e49f0bc
2025-06-25doc: Add copyright.jgart
* doc/guix.texi: Add copyright. Change-Id: I4bc634a8ae5341e664988cd062155d67bd265e90
2025-06-25doc: Mention asdf-build-system/clasp.jgart
* doc/guix.texi: Mention asdf-build-system/clasp. Change-Id: I571c1ac455473ae999a5d35470813b3c4e5fd06e Signed-off-by: jgart <jgart@dismail.de>
2025-06-24daemon: Use slirp4netns to provide networking to fixed-output derivations.Reepca Russelstein
Previously, the builder of a fixed-output derivation could communicate with an external process via an abstract Unix-domain socket. In particular, it could send an open file descriptor to the store, granting write access to some of its output files in the store provided the derivation build fails—the fix for CVE-2024-27297 did not address this specific case. It could also send an open file descriptor to a setuid program, which could then be executed using execveat to gain the privileges of the build user. With this change, fixed-output derivations other than “builtin:download” and “builtin:git-download” always run in a separate network namespace and have network access provided by a TAP device backed by slirp4netns, thereby closing the abstract Unix-domain socket channel. * nix/libstore/globals.hh (Settings)[useHostLoopback, slirp4netns]: new fields. * config-daemon.ac (SLIRP4NETNS): new C preprocessor definition. * nix/libstore/globals.cc (Settings::Settings): initialize them to defaults. * nix/nix-daemon/guix-daemon.cc (options): add --isolate-host-loopback option. * doc/guix.texi: document it. * nix/libstore/build.cc (DerivationGoal)[slirp]: New field. (setupTap, setupTapAction, waitForSlirpReadyAction, enableRouteLocalnetAction, prepareSlirpChrootAction, spawnSlirp4netns, haveGlobalIPv6Address, remapIdsTo0Action): New functions. (initializeUserNamespace): allow the guest UID and GID to be specified. (DerivationGoal::killChild): When ‘slirp’ is not -1, call ‘kill’. (DerivationGoal::startBuilder): Unconditionally add CLONE_NEWNET to FLAGS. When ‘fixedOutput’ is true, spawn ‘slirp4netns’. When ‘fixedOutput’ and ‘useChroot’ are true, add setupTapAction, waitForSlirpReadyAction, and enableRouteLocalnetAction to builder setup phases. Create a /etc/resolv.conf for fixed-output derivations that directs them to slirp4netns's dns address. When settings.useHostLoopback is true, supply fixed-output derivations with a /etc/hosts that resolves "localhost" to slirp4netns's address for accessing the host loopback. * nix/libutil/util.cc (keepOnExec, decodeOctalEscaped, sendFD, receiveFD, findProgram): New functions. * nix/libutil/util.hh (keepOnExec, decodeOctalEscaped, sendFD, receiveFD, findProgram): New declarations. * gnu/packages/package-management.scm (guix): add slirp4netns input for linux targets. * tests/derivations.scm (builder-network-isolated?): new variable. ("fixed-output derivation, network access, localhost", "fixed-output derivation, network access, external host"): skip test case if fixed output derivations are isolated from the network. Change-Id: Ia3fea2ab7add56df66800071cf15cdafe7bfab96 Signed-off-by: John Kehayias <john.kehayias@protonmail.com>
2025-06-23doc: contributing: Fix broken example.Jelle Licht
* doc/contributing.texi (Bulk updates): Properly escape special characters. Change-Id: I9aa4d88f19904056546717cd80ca89ab2f5924fe
2025-06-23doc: Document bulk updates.Sharlatan Hellseher
* doc/contributing.texi (Bulk updates): New section describing update technique for collection of packages. Change-Id: Ic67978a6c8e0140980a0ede968f7e411faf23a1d Signed-off-by: jgart <jgart@dismail.de>
2025-06-16doc: Replace ftp.gnu.org with ftpmirror.gnu.orgJonas Meeuws
* doc/guix.texi: Change BASE-URL. Closes: #408 Change-Id: Id71b413d55019d900ead71e690c2c8fe407f5a3e Signed-off-by: Ludovic Courtès <ludo@gnu.org>
2025-06-12doc: Fix typo.Ludovic Courtès
* doc/contributing.texi (The Issue Tracker): Fix typo. Change-Id: Ibcc93fa13bcb8a5bc902e6ce743b43b7973608e4
generated by cgit v1.3 (git 2.53.0) at 2026-05-29 18:40:18 +0000