Reapply "stdenv: Add CPE fields to meta" #439074
Conversation
nixpkgs-ci
bot
added
10.rebuild-linux: 1-10
|
Here's the performance comparison between the old approach and the new one:
(only |
|
A random quick thought: I suppose you did consider using e.g. the empty string instead of null, if placeholders are somehow preferable? |
|
@vcunat these parts can be empty, so empty string would not work as a placeholder. Anything other than null would be either much slower or less intuitive than just omitting them, I think. |
|
Ah, I didn't know they can be empty. Then it's clear, I guess. |
|
@YorikSar do you want that @infinisil approves this PR or what would be the next "step"? |
pkgs/stdenv/generic/check-meta.nix
Outdated
| makeCPE = | ||
| cpeParts: | ||
| "cpe:2.3:${cpeParts.part}:${cpeParts.vendor}:${cpeParts.product}:${cpeParts.version}:${cpeParts.update}:${cpeParts.edition}:${cpeParts.sw_edition}:${cpeParts.target_sw}:${cpeParts.target_hw}:${cpeParts.language}:${cpeParts.other}"; |
There was a problem hiding this comment.
| makeCPE = | |
| cpeParts: | |
| "cpe:2.3:${cpeParts.part}:${cpeParts.vendor}:${cpeParts.product}:${cpeParts.version}:${cpeParts.update}:${cpeParts.edition}:${cpeParts.sw_edition}:${cpeParts.target_sw}:${cpeParts.target_hw}:${cpeParts.language}:${cpeParts.other}"; | |
| makeCPE = flip pipe [ | |
| (attrVals [ | |
| "part" | |
| "vendor" | |
| "product" | |
| "version" | |
| "update" | |
| "edition" | |
| "sw_edition" | |
| "target_sw" | |
| "target_hw" | |
| "language" | |
| "other" | |
| ]) | |
| (concatStringsSep ":") | |
| ]; |
There was a problem hiding this comment.
Instead of doing the length check above, have you considered having makeCPE unpack the function arguments? That would ensure that both the length is correct and that the names are correct.
There was a problem hiding this comment.
Suggested change
That's just too many allocations and operations to add to each package evaluation.
having makeCPE unpack the function arguments
That's a nice idea. Will do. Although I would still check the length to avoid using exceptions as flow control.
nixpkgs-ci
bot
added
12.approvals: 1
nixpkgs-ci
bot
removed
the
2.status: merge conflict
There was a problem hiding this comment.
As far as I can tell the original issue that led to the revert has been fixed. Good to go from my end.
Thank you for the work @YorikSar! I think we will have to build some more experience to get the versions right, but this can only be done iteratively.
nixpkgs-ci
bot
added
12.approvals: 2
|
Any blockers preventing merging this? |
|
IMHO no |
|
@YorikSar if you fix the merge conflict and you’re happy with this, I’m more than glad to merge :) |
nixpkgs-ci
bot
added
the
2.status: merge conflict
This reverts commit de74f9c.
nix-env writes a warning for each derivation that has null in its meta values, so fields without known values are removed from the result. Fixes issue raised by @K900 in NixOS#409797 (comment)
|
@ConnorBaker Looks like you've caught this merge conflict as it was landing in master or smth. Rebased. |
nixpkgs-ci
bot
removed
the
2.status: merge conflict
|
Backport failed for Please cherry-pick the changes locally and resolve any conflicts. git fetch origin release-25.05
git worktree add -d .worktree/backport-439074-to-release-25.05 origin/release-25.05
cd .worktree/backport-439074-to-release-25.05
git switch --create backport-439074-to-release-25.05
git cherry-pick -x dd12290517ff6e57ab2ca384b101e0cdc617570c a178fd8c436915d233a1de37a2b211489aad5340 5e1eee582748866a51ca8f780829c3b2cf523fc3 |
|
Any chance you’d be able to do the backport? If not I’ll try to get around to it this weekend. |
|
Isn't this too intrusive for backporting? |
the backport can be set on hold, if you want to gather experience? The benefit of CPE's and pURL outweights the low-medium risk. The security tracker https://discourse.nixos.org/t/nixpkgs-supply-chain-security-project/34345/30 can benefit as well, because once a regular bump of software on master is done (without keeping a CVE in mind and determining "stable needs a fix as well"), nixpkgs stable fix is not triggered automatically. Example: #409300 libarchive was bumped without CVE reference (edit to the PR description was adjusted AFTER additional issue was created ONLY), just by coincidence it was backported as well - which would have been unpatched for some time. In addition CVE like this #411881 were not detected properly, therefore an additional reason for backporting / benefiting today |
|
I've updated the previous backport in #438385 with new commits. Please take a look. |
I agree that we should not backport this. Since the 25.11 release cycle is starting, let's get the experience with this over the few months until that happens, and have 25.11 be the release where this becomes a Nixpkgs staple. |
mdaniels5757
added
the
8.has: port to stable
7 participants
This reverts commit de74f9c from #438527 that reverted #409797.
Added a change that removes all
nullvalues frommeta.identifiersto satisfynix-env's XML and JSON outputs.Unfortunately, this means that our API will have "holes" for fields with unknown values.
Add a 👍 reaction to pull requests you find important.