Nix-Darwin compatible with Nix/Nixpkgs 23.05? fails evaluating 'buildCommand' of the derivation 'etc'

[andrewcrook]

I wanted to update a working system from nix from 22.11 to 23.05 I just updated my flakes, I normally pin them once everything is working

"github:nixos/nixpkgs/nixpkgs-23.05-darwin”
"github:nix-community/home-manager/release-23.05”
"github:lnl7/nix-darwin”

however, when I try build it always fails on evaluating darwin-system-23.05.20230618.572d269+darwin4.8a5af0d I have tried to change system state version to 23.05 but it didn’t help. The issue is it doesn’t really give me enough information to tell me if it’s an issue with my config files. I am not even sure if people using nix-darwin using 23.05 I guess they are because I cannot see the reports similar to this.

Any ideas how I can fix or debug this?

nix doctor passes

nix build .\#darwinConfigurations.Andrews-MBP.system --verbose  --show-trace
error:
       … while evaluating the attribute 'buildCommand' of the derivation 'darwin-system-23.05.20230618.572d269+darwin4.8a5af0d'

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/pkgs/stdenv/generic/make-derivation.nix:303:7:

          302|     // (lib.optionalAttrs (attrs ? name || (attrs ? pname && attrs ? version)) {
          303|       name =
             |       ^
          304|         let

       … while evaluating the attribute 'buildCommand' of the derivation 'etc'

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/pkgs/stdenv/generic/make-derivation.nix:303:7:

          302|     // (lib.optionalAttrs (attrs ? name || (attrs ? pname && attrs ? version)) {
          303|       name =
             |       ^
          304|         let

       … while evaluating call site

       at /nix/store/y57af6dfqf7mcn5vdizdggfkx27p6bgp-source/modules/system/etc.nix:41:11:

           40|         ${concatMapStringsSep "\n" (attr: "mkdir -p $(dirname '${attr.target}')") etc}
           41|         ${concatMapStringsSep "\n" (attr: "ln -s '${attr.source}' '${attr.target}'") etc}
             |           ^
           42|         ${concatMapStringsSep "\n" (attr: "touch '${attr.target}'.copy") etcCopy}

       … while calling 'concatMapStringsSep'

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/lib/strings.nix:116:5:

          115|     # List of input strings
          116|     list: concatStringsSep sep (map f list);
             |     ^
          117|

       … while evaluating call site

       at «none»:0: (source not available)

       … while calling anonymous lambda

       at /nix/store/y57af6dfqf7mcn5vdizdggfkx27p6bgp-source/modules/system/etc.nix:41:37:

           40|         ${concatMapStringsSep "\n" (attr: "mkdir -p $(dirname '${attr.target}')") etc}
           41|         ${concatMapStringsSep "\n" (attr: "ln -s '${attr.source}' '${attr.target}'") etc}
             |                                     ^
           42|         ${concatMapStringsSep "\n" (attr: "touch '${attr.target}'.copy") etcCopy}

       … while evaluating call site

       at «none»:0: (source not available)

       … while calling 'g'

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/lib/attrsets.nix:595:19:

          594|           g =
          595|             name: value:
             |                   ^
          596|             if isAttrs value && cond value

       … while evaluating call site

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/lib/attrsets.nix:598:20:

          597|               then recurse (path ++ [name]) value
          598|               else f (path ++ [name]) value;
             |                    ^
          599|         in mapAttrs g;

       … while calling anonymous lambda

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/lib/modules.nix:248:72:

          247|           # For definitions that have an associated option
          248|           declaredConfig = mapAttrsRecursiveCond (v: ! isOption v) (_: v: v.value) options;
             |                                                                        ^
          249|

       … while evaluating the attribute 'value'

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/lib/modules.nix:759:9:

          758|     in warnDeprecation opt //
          759|       { value = builtins.addErrorContext "while evaluating the option `${showOption loc}':" value;
             |         ^
          760|         inherit (res.defsFinal') highestPrio;

       … while evaluating the option `environment.etc."profiles/per-user/andrew".source':

       … while evaluating the attribute 'mergedValue'

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/lib/modules.nix:794:5:

          793|     # Type-check the remaining definitions, and merge them. Or throw if no definitions.
          794|     mergedValue =
             |     ^
          795|       if isDefined then

       … while evaluating call site

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/lib/modules.nix:796:12:

          795|       if isDefined then
          796|         if all (def: type.check def.value) defsFinal then type.merge loc defsFinal
             |            ^
          797|         else let allInvalid = filter (def: ! type.check def.value) defsFinal;

       … while calling anonymous lambda

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/lib/modules.nix:796:17:

          795|       if isDefined then
          796|         if all (def: type.check def.value) defsFinal then type.merge loc defsFinal
             |                 ^
          797|         else let allInvalid = filter (def: ! type.check def.value) defsFinal;

       … while evaluating call site

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/lib/modules.nix:796:22:

          795|       if isDefined then
          796|         if all (def: type.check def.value) defsFinal then type.merge loc defsFinal
             |                      ^
          797|         else let allInvalid = filter (def: ! type.check def.value) defsFinal;

       … while calling 'check'

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/lib/types.nix:490:15:

          489|       descriptionClass = "noun";
          490|       check = x: isStringLike x && builtins.substring 0 1 (toString x) == "/";
             |               ^
          491|       merge = mergeEqualOption;

       … while evaluating the attribute 'passAsFile' of the derivation 'user-environment'

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/pkgs/stdenv/generic/make-derivation.nix:303:7:

          302|     // (lib.optionalAttrs (attrs ? name || (attrs ? pname && attrs ? version)) {
          303|       name =
             |       ^
          304|         let

       … while evaluating the attribute 'passAsFile'

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/pkgs/build-support/buildenv/default.nix:77:5:

           76|     # XXX: The size is somewhat arbitrary
           77|     passAsFile = if builtins.stringLength pkgs >= 128*1024 then [ "pkgs" ] else [ ];
             |     ^
           78|   }

       … while evaluating call site

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/pkgs/stdenv/generic/make-derivation.nix:506:14:

          505|   meta = checkMeta.commonMeta { inherit validity attrs pos references; };
          506|   validity = checkMeta.assertValidity { inherit meta attrs; };
             |              ^
          507|

       … while calling 'assertValidity'

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/pkgs/stdenv/generic/check-meta.nix:442:20:

          441|
          442|   assertValidity = { meta, attrs }: let
             |                    ^
          443|       validity = checkValidity attrs;

       … while evaluating call site

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/pkgs/stdenv/generic/check-meta.nix:443:18:

          442|   assertValidity = { meta, attrs }: let
          443|       validity = checkValidity attrs;
             |                  ^
          444|     in validity // {

       … while calling 'checkValidity'

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/pkgs/stdenv/generic/check-meta.nix:343:19:

          342|   # Along with a boolean flag for each reason
          343|   checkValidity = attrs:
             |                   ^
          344|     # Check meta attribute types first, to make sure it is always called even when there are other issues

       … while evaluating call site

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/pkgs/stdenv/generic/check-meta.nix:383:15:

          382|          }
          383|     else if !(hasAllowedInsecure attrs) then
             |               ^
          384|       { valid = "no"; reason = "insecure"; errormsg = "is marked as insecure"; }

       … while calling 'hasAllowedInsecure'

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/pkgs/stdenv/generic/check-meta.nix:85:24:

           84|
           85|   hasAllowedInsecure = attrs:
             |                        ^
           86|     !(isMarkedInsecure attrs) ||

       … while evaluating call site

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/pkgs/stdenv/generic/check-meta.nix:87:5:

           86|     !(isMarkedInsecure attrs) ||
           87|     allowInsecurePredicate attrs ||
             |     ^
           88|     builtins.getEnv "NIXPKGS_ALLOW_INSECURE" == "1";

       … while calling 'allowInsecurePredicate'

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/pkgs/stdenv/generic/check-meta.nix:83:28:

           82|   allowInsecureDefaultPredicate = x: builtins.elem (getName x) (config.permittedInsecurePackages or []);
           83|   allowInsecurePredicate = x: (config.allowInsecurePredicate or allowInsecureDefaultPredicate) x;
             |                            ^
           84|

       … while evaluating call site

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/pkgs/stdenv/generic/check-meta.nix:83:31:

           82|   allowInsecureDefaultPredicate = x: builtins.elem (getName x) (config.permittedInsecurePackages or []);
           83|   allowInsecurePredicate = x: (config.allowInsecurePredicate or allowInsecureDefaultPredicate) x;
             |                               ^
           84|

       … while calling 'allowInsecureDefaultPredicate'

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/pkgs/stdenv/generic/check-meta.nix:82:35:

           81|
           82|   allowInsecureDefaultPredicate = x: builtins.elem (getName x) (config.permittedInsecurePackages or []);
             |                                   ^
           83|   allowInsecurePredicate = x: (config.allowInsecurePredicate or allowInsecureDefaultPredicate) x;

       error: value is a Boolean while a list was expected

       at /nix/store/7chim95y65lpps6j547gyy06wm5r2lbj-source/pkgs/stdenv/generic/check-meta.nix:82:38:

           81|
           82|   allowInsecureDefaultPredicate = x: builtins.elem (getName x) (config.permittedInsecurePackages or []);
             |                                      ^
           83|   allowInsecurePredicate = x: (config.allowInsecurePredicate or allowInsecureDefaultPredicate) x;

[ihgann]

I'm also failing quite a bit, with neovim-unwrapped. I'm not sure if it's related yet, but noticed 23.05 is definitely causing some issues. Following this thread.

[emilazy]

I'm not sure what's going on here but it looks like it might be an error in your configuration. Can you show your configuration, or at least your permittedInsecurePackages (if any) and list of installed packages?

[andrewcrook]

config is spread out into flak.nix, host, user and module files. I am starting to refract config heavy applications to modules (smaller ones were tests) so has its source , settings, config files etc. As you can see permittedInsecurePackages is set to false globally.

      nixpkgs = {
          config = {
            allowUnfree = true; # could change to a list of pkgs
            permittedInsecurePackages = false; # if needed add list of pkgs
            allowUnsupportedSystem = false; # darwin rossetta 86 and arm64 ???
            };
      };

List of applications

main list

 environment.systemPackages = with pkgs;
    # (if stdenv.isDarwin then [ openssl gawk gnused coreutils findutils ] else [ dwm dmenu xclip ]) ++
      [
        asdf-vm
        aria2
        ascii
        ##  asdf-vm # moved to a module
        # bash
        borgbackup
        boxes
        bzip2
        # cached-nix-shell # not on darwin  instant nix-shell
        cachix
        clamav
        coreutils-prefixed # gnu versions prefixed with g
        curl
        dateutils
        darwin.trash # darwin only
        diff-so-fancy
        direnv
        docker
        # docker-compose
        dockutil # mac darwin only
        duti # Select default apps for documents and URL schemes on macOS
        exa
        exiftool # exif
        fd
        ffmpeg # generic or ffmpeg_6-full??
        findutils
        fpart # Split file trees into bags (called "partitions")
        fzf
        gawk # gnu awk
        # ghostscript < enable when needed
        gh # or hub? gGitHubsupport
        git
        gnugrep
        gnused
        gnutar
        gping
        gzip
        html2text
        hyperfine # Command-line benchmarking tool
        htop
        jq
        lbzip2 # paralell bzip2
        mas # macOS app store cli darwinonly
        moreutils
        # nvim
        nmap
        multitail # Tail multiple files in one terminal simultaneously
        # nil # nix LSP
        nixpkgs-fmt # format nix files
        nix-direnv
        nix-zsh-completions
        nix-bash-completions
        num-utils
        openssl
        pandoc
        p7zip # 7 - Zip (high compression file archiver) implementation
        pigz
        plzip # A massively parallel lossless data compressor based on the lzlib compression library
        pv
        ranger # file manager
        readline
        # rnix-lsp # another nix LSP
        shfmt
        shellcheck # bashls
        symlinks
        tree
        tldr
        units
        urlview
        # usbutils no darwin version
        uutils-coreutils # rust versions pf coreutils prefixed "uutils-"
        wakeonlan
        wget
        youtube-dl
        yt-dlp
        # zinint
        zoxide
      ];

in a user module

  user = {
        packages = with pkgs; [
          bfs
          deadnix
          grex # regex patern generator and lib
          pv
          ngrok
          navi
          nil
          nix-tree
          nixfmt
          mat2 # A handy tool to trash your metadata
          pstree # ps as tree
          #rnix-lsp
          # showkey << not found
          statix
          symlinks
          starship
          xdg-ninja
}

the follow are spread out between modules ....

asdf-vm
bat
ripgrep
zellajs

[ vim
neovim-unwrapped
 tree-sitter
  ] ++ (lib.optionals (!pkgs.stdenv.isDarwin) [
          gcc # Requried for treesitter parsers
  ]);

and I still have a couple of homebrew formulas

    brews = [
        "tavianator/tap/bfs" # breath firet search
        "blueutil" # MacOS blutooth cli tool
        "displayplacer" # MacOS cli to control muliple displays
        "imagesnap"
        "tag" # cli tool for manipulating and querying finder tags.
        "zinit" # zsh plugin loader
        "dark-mode" # cli to change darkmode
        "terminal-notifier" # cli tool for making macos notifications
        "detox" # fixes filenames
        "fileicon" # cli custom file/folder icons in macOS
        "showkey" # shows keypresses
        "unxip" # A fast Xcode unarchiver xip files
        "yakitrak/yakitrak/obs" # obsidian cli
      ];

[emilazy]

permittedInsecurePackages must be a list, not a boolean. If you don't want to permit any then you can just leave it unset. So this is a user configuration issue, although I'm not sure what changed about 23.05 here.

[andrewcrook]

Ah thanks, I presume it also took false because I had seen other configs do it. It seemed to work upto now LOL. So documentation says this should work if explicit

allowUnfreePredicate = (pkg: false);

otherwise just leave out like you said. Off to try.

[emilazy]

Going to close this as it's hopefully resolved but comment if you're still having issues.

@ihgann I imagine your neovim issue is probably unrelated, but feel free to ask in #macos:matrix.org or maybe the NixOS Discourse/issue tracker unless it seems like it's a nix-darwin-specific issue.

[andrewcrook]

@emilazy

yes that worked with my current setup so I uninstalled nix, updated urls in my flake, install nix 2.16.1. however, when I when to nix build the flask I get the following error

error: unable to download 'https://cache.nixos.org/295gb0pm9mk5vvgyvjv601c86cxn80f8.narinfo': Problem with the SSL CA cert (path? access rights?) (77)

[emilazy]

I'm not sure what's going on there; it looks like it's probably a problem with an enterprise SSL CA you're using. Unless you're using our security.pki.* options it's unlikely to be related to nix-darwin.

[andrewcrook]

@emilazy

Thanks, finally got it working I am not sure if it was nix or nix-darwin because both mention /etc/static and /etc/ssl in their scripts. I think it was down to a symbolic link broken from the previous installation.

/etc/ssl/certs/ca-certificates  --> -/etc/static/ssl/certs/ca-certificates.crt 

-/etc/static is a symbolic link to the nix store

I backed up and removed /etc/ssl/certs/ca-certificates, rebuilt and it worked recreating the links. I wondered if part of the issue is that flakes don't have uninstall scripts.

I wonder if I should install nix-darwin and home-manager via channels from now on and leave flakes to the rest of my setup so I can add extras via a script and use the proper uninstall scripts?

[Enzime]

Support for installing nix-darwin via flakes recently got merged, the instructions are in the README.

darwin-uninstaller works the same on flake installs and non flake installs, however there are some issues with the uninstaller at the moment tracked at #730.