Re: [Nix-dev] Openssl and fast security updates

2014-06-06 Thread Ertugrul Söylemez
On Thu, 05 Jun 2014 23:39:34 +0200 Vladimír Čunát vcu...@gmail.com wrote: Hydra has and uses priorities. Anyway, building OpenSSL itself is very quick, but rebuilding all that (transitively) depends on it is worse. And there are CVE fixes for stdenv stuff sometimes (glibc)... Yes, and the

Re: [Nix-dev] Openssl and fast security updates

2014-06-06 Thread Vladimír Čunát
On 06/06/2014 08:59 AM, Ertugrul Söylemez wrote: When we use priorities generously we could avoid a lot of delay even in less critical cases. The main problem I see is that normally you don't want to release a channel until *all* parts have rebuilt. We do have meta.schedulingPriority, but

Re: [Nix-dev] Openssl and fast security updates

2014-06-06 Thread Alexander Kjeldaas
On Fri, Jun 6, 2014 at 10:20 AM, Vladimír Čunát vcu...@gmail.com wrote: On 06/06/2014 08:59 AM, Ertugrul Söylemez wrote: When we use priorities generously we could avoid a lot of delay even in less critical cases. The main problem I see is that normally you don't want to release a channel

Re: [Nix-dev] setfacl: /var/log/journal: Operation not supported

2014-06-06 Thread _1126
Hey Ricardo! On Wed, Jun 04, 2014 at 06:24:55PM +0200, Ricardo M. Correia wrote: If the problem is indeed the setfacl failure (as it appears to be), I think you need to enable ACLs in ZFS by doing: zfs set acltype=posixacl fs, where fs is the ZFS dataset/filesystem which contains your

Re: [Nix-dev] Openssl and fast security updates

2014-06-06 Thread Michael Raskin
When we use priorities generously we could avoid a lot of delay even in less critical cases. The main problem I see is that normally you don't want to release a channel until *all* parts have rebuilt. +1 Rebuilding for a server that runs, say ssh, apache, nginx, postfix and a few such

Re: [Nix-dev] Openssl and fast security updates

2014-06-06 Thread Mathijs Kwik
Alexander Kjeldaas a...@formalprivacy.com writes: On Fri, Jun 6, 2014 at 10:20 AM, Vladimír Čunát vcu...@gmail.com wrote: On 06/06/2014 08:59 AM, Ertugrul Söylemez wrote: When we use priorities generously we could avoid a lot of delay even in less critical cases. The main problem I see

Re: [Nix-dev] Openssl and fast security updates

2014-06-06 Thread Eelco Dolstra
Hi, On 06/06/14 13:13, Michael Raskin wrote: Maybe having a channel which is a subset of the main channel and includes at least ssh, apache, nginx, postgresql, mysql, and some ftp server would be a nice start? Yeah, that sounds like a good idea. -- Eelco Dolstra | LogicBlox, Inc. |

Re: [Nix-dev] Openssl and fast security updates

2014-06-06 Thread Mathijs Kwik
Michael Raskin 7c6f4...@mail.ru writes: When we use priorities generously we could avoid a lot of delay even in less critical cases. The main problem I see is that normally you don't want to release a channel until *all* parts have rebuilt. +1 Rebuilding for a server that runs, say ssh,

Re: [Nix-dev] Openssl and fast security updates

2014-06-06 Thread Michael Raskin
Calculating the transitive closure for all nixos modules / services run by systemd is one way to prioritize. A populatiry contest could be added to that. Maybe having a channel which is a subset of the main channel and includes at least ssh, apache, nginx, postgresql, mysql, and some ftp

Re: [Nix-dev] Openssl and fast security updates

2014-06-06 Thread Eelco Dolstra
Hi, On 06/06/14 13:29, Mathijs Kwik wrote: How are people supposed to use that channel? I don't think I can _add_ a secondary channel which provides a conflicting source (nixos). Switching back and forth doesn't sound easy. Switching to another channel is very easy: $ nix-channel --add

Re: [Nix-dev] Openssl and fast security updates

2014-06-06 Thread Eelco Dolstra
Hi, On 06/06/14 13:14, Mathijs Kwik wrote: That still doesn't solve the question how to do a half build. If there have been 5 commits since the last channel build, and you add an important security fix, there is no way to only build that fix without building the other stuff. Well, if it's

Re: [Nix-dev] Openssl and fast security updates

2014-06-06 Thread Mathijs Kwik
Michael Raskin 7c6f4...@mail.ru writes: Calculating the transitive closure for all nixos modules / services run by systemd is one way to prioritize. A populatiry contest could be added to that. Maybe having a channel which is a subset of the main channel and includes at least ssh, apache,

Re: [Nix-dev] Openssl and fast security updates

2014-06-06 Thread Mathijs Kwik
Eelco Dolstra eelco.dols...@logicblox.com writes: Hi, On 06/06/14 13:29, Mathijs Kwik wrote: How are people supposed to use that channel? I don't think I can _add_ a secondary channel which provides a conflicting source (nixos). Switching back and forth doesn't sound easy. Switching to

Re: [Nix-dev] Openssl and fast security updates

2014-06-06 Thread Thomas Strobel
On 06/06/2014 07:59 AM, Ertugrul Söylemez wrote: On Thu, 05 Jun 2014 23:39:34 +0200 Vladimír Čunát vcu...@gmail.com wrote: Hydra has and uses priorities. Anyway, building OpenSSL itself is very quick, but rebuilding all that (transitively) depends on it is worse. And there are CVE fixes

Re: [Nix-dev] Openssl and fast security updates

2014-06-06 Thread Eelco Dolstra
Hi, On 06/06/14 13:57, Mathijs Kwik wrote: So server systems need to start following a channel that does not run lengthy tests? The NixOS system tests actually aren't very lengthy (though they do suffer from non-deterministic failures). It's more the latency of having to wait for 20,000

[Nix-dev] Hydra not building a package, fetchSubmodules fault?

2014-06-06 Thread Mateusz Kowalczyk
Hi, I packaged the PSP emulator called PPSSPP a while ago and it has been in nixpkgs for little over a week[1]. When I try to nix-env -i PPSSPP however my system tells me that it will build it rather than fetch it. I thought that maybe I needed to explicitly specify platforms but the ‘vice’

Re: [Nix-dev] Hydra not building a package, fetchSubmodules fault?

2014-06-06 Thread Bjørn Forsman
On 7 June 2014 05:23, Mateusz Kowalczyk fuuze...@fuuzetsu.co.uk wrote: Hi, I packaged the PSP emulator called PPSSPP a while ago and it has been in nixpkgs for little over a week[1]. When I try to nix-env -i PPSSPP however my system tells me that it will build it rather than fetch it. I