{ids,checks}: update for new builder UID/GID values

emilazy commented 3 weeks ago

See:

This is fairly subtle stuff, but also time‐critical; Apple has given us an unexpected gift by announcing that Sequoia will release on Monday, making it the earliest macOS release in over a decade. Currently, Nix users upgrading to Sequoia get a broken installation that outputs a useless error message, and users who have already migrated their users can’t activate their configuration if they manage Nix users with nix-darwin.

I wanted to do a “proper” migration based on our existing user management functionality, but we simply don’t have the time. The best thing we can do for users to reduce the support burden and reputation hit of everything breaking is to get the upstream migration script in front of them ASAP. Therefore, this adds support for the new values, and adds checks when the UIDs/GID aren’t as expected that tell the user what they can do to remediate. I want to get this merged within 24 hours if possible.

I had to do some ugly work to the CI to get it to pass, as Nix have not yet released fixed installers for versions other than 2.24. But it does pass, and I have verified that all the main code paths here seem to behave as expected.

Sorry for neglecting nix-darwin recently. Now that I’m slightly less busy with Nixpkgs work I hope to do more soon, but this is really urgent so I dropped everything to get it out.

Thanks to @mjm for helping test this.

cc @Enzime @Samasaur1 @malob @LnL7 for code review cc @abathur for feedback on error message wording

Closes: #970

emilazy commented 3 weeks ago

cc @cole-h too – I didn’t bother doing any special handling for the temporary Sequoia‐only values the Determinate Systems installer used for a bit and so it will probably recommend those users run the upstream migration script, which I think should just work, even though it’s not strictly required?

emilazy commented 3 weeks ago

Rebased to pick up the test fixes in https://github.com/LnL7/nix-darwin/pull/1068 so that hopefully CI will be all green.

emilazy commented 3 weeks ago

Rearranged the checks to fail with a more useful message if there are no build users.

mvillafuertem commented 1 week ago

Hi @emilazy , after a nix flake update, I hit with this error. I'm using home-manager as well. What am I supposed to change?

error:
       … while evaluating the attribute 'value'

         at /nix/store/nh98b9i03r9mq43bclkxvbk3n346jhqr-source/lib/modules.nix:821:9:

          820|     in warnDeprecation opt //
          821|       { value = addErrorContext "while evaluating the option `${showOption loc}':" value;
             |         ^
          822|         inherit (res.defsFinal') highestPrio;

       … while calling the 'addErrorContext' builtin

         at /nix/store/nh98b9i03r9mq43bclkxvbk3n346jhqr-source/lib/modules.nix:821:17:

          820|     in warnDeprecation opt //
          821|       { value = addErrorContext "while evaluating the option `${showOption loc}':" value;
             |                 ^
          822|         inherit (res.defsFinal') highestPrio;

       (stack trace truncated; use '--show-trace' to show the full trace)

       error:
       Failed assertions:
       - The `system.stateVersion` option is not defined in your
       nix-darwin configuration. The value is used to conditionalize
       backwards‐incompatible changes in default settings. You should
       usually set this once when installing nix-darwin on a new system
       and then never change it (at least without reading all the relevant
       entries in the changelog using `darwin-rebuild changelog`).

       You can use the current value for new installations as follows:

           system.stateVersion = 5;

$ nix-info -m
 - system: `"aarch64-darwin"`
 - host os: `Darwin 23.6.0, macOS 14.7`
 - version: `nix-env (Nix) 2.21.1`
 - nixpkgs: `/Users/user/.nix-defexpr/channels/nixpkgs`

$ nix config check
[FAIL] Multiple versions of nix found in PATH:
  /nix/store/ip0chiw6dkpz161mkkjvdsp8gb16wmf4-nix-2.21.1/bin
  /nix/store/ma0p24nzjcylflyn4bz4wj8kf28a7ida-nix-2.18.5/bin

[PASS] All profiles are gcroots.
[PASS] Client protocol matches store protocol.
[INFO] You are trusted by store uri: local

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
    home-manager = {
      url = "github:nix-community/home-manager";
      inputs.nixpkgs.follows = "nixpkgs";
    };
    darwin = {
      url = "github:LnL7/nix-darwin/master";
      inputs.nixpkgs.follows = "nixpkgs";
    };
  };

homeConfigurations.home.stateVersion = "24.05";

LnL7 / nix-darwin

{ids,checks}: update for new builder UID/GID values #1069