1password unable to build

[rawkode]

Describe the bug

This only happens on unstable.

❯ nix log /nix/store/x4s8fbgb14l2jqx2hq1si98bnxsi7r0q-security-wrapper-1Password-BrowserSupport-x86_64-unknown-linux-musl.drv
warning: The interpretation of store paths arguments ending in `.drv` recently changed. If this command is now failing try again with '/nix/store/x4s8fbgb14l2jqx2hq1si98bnxsi7r0q-security-wrapper-1Password-BrowserSupport-x86_64-unknown-linux-musl.drv^*'
Running phase: patchPhase
@nix { "action": "setPhase", "phase": "patchPhase" }
Running phase: updateAutotoolsGnuConfigScriptsPhase
@nix { "action": "setPhase", "phase": "updateAutotoolsGnuConfigScriptsPhase" }
Running phase: updateAutotoolsGnuConfigScriptsPhase
@nix { "action": "setPhase", "phase": "updateAutotoolsGnuConfigScriptsPhase" }
Running phase: configurePhase
@nix { "action": "setPhase", "phase": "configurePhase" }
no configure script, doing nothing
Running phase: buildPhase
@nix { "action": "setPhase", "phase": "buildPhase" }
no Makefile or custom buildPhase, doing nothing
Running phase: installPhase
@nix { "action": "setPhase", "phase": "installPhase" }
/nix/store/kgc6yccw7qf063fyjjjql4qk4mnmscdd-x86_64-unknown-linux-musl-gcc-wrapper-13.3.0/bin/x86_64-unknown-linux-musl-gcc: line 182: NIX_LDFLAGS_BEFORE_x86_64_unknown_linux_musl: unbound variable

Steps To Reproduce

programs._1password.enable = true;
programs._1password-gui = {
  enable = true;
  package = pkgs._1password-gui;
  polkitPolicyOwners = [ cfg.username ];
};

[rawkode]

Debugging this, I've found that the unbound variable is here:

https://github.com/NixOS/nixpkgs/blob/9b9ca77050e3cff7a6c6b1210d3f1a3b5488070b/pkgs/build-support/cc-wrapper/cc-wrapper.sh#L182

Blame shows @pwaller worked on this. Any chance of an assist? As I don't understand what is happening :)

[pwaller]

A mysterious problem indeed. Happy to help if I can but there isn't enough information to reproduce - what's the nixpkgs hash? Ideally please provide a nix build nixpkgs/<hash>#package invocation that reproduces the failure.

Here's what I get:

$ NIXPKGS_ALLOW_UNFREE=1 nix build --impure nixpkgs/12228ff1752d7b7624a54e9c1af4b222b3c1073b#pkgsStatic._1password-gui --dry-run

error:
       … while calling the 'derivationStrict' builtin
         at <nix/derivation-internal.nix>:34:12:
           33|
           34|   strict = derivationStrict drvAttrs;
             |            ^
           35|

       … while evaluating derivation '1password-static-x86_64-unknown-linux-musl-8.10.36'
         whose name attribute is located at /nix/store/bd4fmzws6n5542khxbifbkr6nrygi232-source/pkgs/stdenv/generic/make-derivation.nix:336:7

       … while evaluating attribute 'installPhase' of derivation '1password-static-x86_64-unknown-linux-musl-8.10.36'
         at /nix/store/bd4fmzws6n5542khxbifbkr6nrygi232-source/pkgs/applications/misc/1password-gui/linux.nix:70:3:
           69|
           70|   installPhase =
             |   ^
           71|     let

       (stack trace truncated; use '--show-trace' to show the full, detailed trace)

       error: attribute 'sharedLibrary' missing
       at /nix/store/bd4fmzws6n5542khxbifbkr6nrygi232-source/pkgs/development/libraries/gobject-introspection/default.nix:146:33:
          145|   postCheck = ''
          146|     rm $out/lib/libregress-1.0${stdenv.targetPlatform.extensions.sharedLibrary}
             |                                 ^
          147|   '';

I've passed pkgsStatic because I see that your drv has musl in the name, but that's just me trying to guess your machine configuration.

[pwaller]

I see my ask is not so straightforward, that it's actually the security wrapper which is failing. I'll take another look when I get a chance.

[rawkode]

Yeah. It's the security wrapper.

Would sharing my flake.lock help?

I don't have or specify musl anywhere, I believe this is the security wrapper.

Though I'm using the same lockfile across machines and one machine is fine.

[pwaller]

For completeness, just need the nixpkgs rev from the lock file.

However, I'm still unable to reproduce, this builds on nixos-unstable and a commit from a 1st Sept, so I'm still missing something:

nix build -I nixpkgs=flake:nixpkgs/nixos-unstable --impure --expr '
with import <nixpkgs> {};
pkgsStatic.callPackage <nixpkgs/nixos/modules/security/wrappers/wrapper.nix> {
  sourceProg = "${pkgs.hello}/bin/hello";
  debug = true;
  unsecvars = lib.overrideDerivation (pkgs.srcOnly pkgs.glibc) ({ name, ... }: { name = "${name}-unsecvars"; installPhase = "mkdir $out; cp sysdeps/generic/unsecvars.h $out"; });
}'

[pwaller]

FWIW I was also able to put your repro into a nixos config and it builds fine for me on nixpkgs/9357f4f23713673f310988025d9dc261c20e70c6 (nixos-unstable today).

[rawkode]

As I have the same lock on two devices and only one has the error, I guess you're fortunate enough to be in the position of the former.

Do you know what would cause NIX_LDFLAGS_BEFORE_x86_64_unknown_linux_musl to be undefined?

Can I brute force this somehow?

Working Machine

❯ nix-shell -p nix-info --run "nix-info -m"
 - system: `"x86_64-linux"`
 - host os: `Linux 6.10.9-zen1, NixOS, 24.11 (Vicuna), 24.11.20240921.9357f4f`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.23.3`
 - nixpkgs: `/nix/store/y6205wq8hxvpqvl8l9d1n9xah01kg0lq-source`

❯ uname -a
Linux p4x-framework-13-nixos 6.10.9-zen1 #1-NixOS ZEN SMP PREEMPT_DYNAMIC Tue Jan  1 00:00:00 UTC 1980 x86_64 GNU/Linux

Failing Machine

❯ nix-shell -p nix-info --run "nix-info -m"
 - system: `"x86_64-linux"`
 - host os: `Linux 6.10.9-zen1, NixOS, 24.11 (Vicuna), 24.11.20240921.9357f4f`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.23.3`
 - nixpkgs: `/nix/store/y6205wq8hxvpqvl8l9d1n9xah01kg0lq-source`

Linux p4x-desktop-nixos 6.10.9-zen1 #1-NixOS ZEN SMP PREEMPT_DYNAMIC Tue Jan  1 00:00:00 UTC 1980 x86_64 GNU/Linux

[pwaller]

What your two host os revisions show is that they're both based on the same nixpkgs revision (9357f4f), which is also the one I tested. Therefore I conclude there is very likely something in your configuration on the broken side which is breaking the package.

I'm afraid I don't know the answer to your question of what would cause it to become undefined.

[pwaller]

In terms of brute forcing it, I would remove things from the broken configuration until it's equal to the working configuration.

[rawkode]

No problem. The only difference between the two machines is the hardware.nix, but I'll see if I can isolate this and report back.

Thank you for your help, I really appreciate it.