This fixes an unnecessary evaluation dependency that prevented the
custom and much appreciated primaryUser error from popping up.
Specifically:
… while evaluating the option `system.build':
… while evaluating definitions from `/nix/store/lc6n4bhxj9255kzfn9pnpx65583a8cgc-source/modules/environment':
… while evaluating definitions from `/nix/store/lc6n4bhxj9255kzfn9pnpx65583a8cgc-source/modules/nix':
… while evaluating the option `environment.darwinConfig':
… while evaluating the option `system.primaryUserHome':
error: expected a string but found null: null
at /nix/store/lc6n4bhxj9255kzfn9pnpx65583a8cgc-source/modules/system/primary-user.nix:26:30:
25| default =
26| config.users.users.${config.system.primaryUser}.home or "/Users/${config.system.primaryUser}";
| ^
27| };
While it did have some indication as to the cause, it lets the good
error message go to waste.
**Context**
`lazyAttrsOf` is the better choice when you use an attrset as individual
variables instead of in aggregate (e.g. `attrNames`, `toJSON`).
The reason is that an expression like `a.b` is strict in `a`, which
entails the evaluating the _whole_ set of attribute _names_ in `a`.
In the `attrsOf` this means evaluating all `mkIf` conditions, which
in turn also means evaluating all the regular definitions to the
smallest degree (WHNF) to determine that they're not `mkIf`s.
`lazyAttrsOf` simply assumes that all attributes aren't `mkIf false`,
and throws an error in the attribute value if necessary.
This would be a problem with `toJSON` and such, but is completely
fine when the attributes are treated as variables of a lazy program,
as is the case here.
**NixOS**
NixOS made `system.build` a submodule with a `freeformType`, allowing
the things inside of it to be declared, and for them to have niceties
like documentation and merging behavior.
nix-darwin could probably adopt this.
These can’t be relied upon in a post‐user‐activation
world. Technically a breaking change, if anyone has their home
directory outside of `/Users` or is using `root` for this, but, well,
I did my best and these are legacy defaults anyway.
I’m not *completely* certain that this handles user agents
correctly. There is a deprecated command, `launchctl asuser`, that
executes a command in the Mach bootstrap context of another user`.
<https://scriptingosx.com/2020/08/running-a-command-as-another-user/>
claims that this is required when loading and unloading user agents,
but I haven’t tested this. Our current launchd agent logic is pretty
weird and broken already anyway, so unless this actively regresses
things I’d lean towards keeping it like this until we can move
over entirely to `launchctl bootstrap`/`launchctl kickstart`, which
aren’t deprecated and can address individual users directly. Someone
should definitely test it more extensively than I have, though.
This adds an optional explicit `homebrew.user` option that allows users
to avoid setting `system.primaryUser`, partly as a proof of concept
of what the interfaces should look like in the future. Homebrew only
officially support one global installation, so a singleton matches
upstream’s expectations; in practice, it may be useful for us to
nest this into `users.users.*.homebrew` instead, at the expense of
being an unsupported setup if used to its full potential. Since
that would be a breaking change to the inteface anyway, I think
adding `homebrew.user` for now is acceptable. (I think one native
Apple Silicon and one Rosetta 2 Homebrew installation – under
`/opt/homebrew` and `/usr/local` respectively – may be exceptions
to this lack of upstream support, but that would be complicated to
support even with `users.users.*.homebrew`.)
I’m not entirely sure where in system activation this should
go. Probably after the user defaults and launch agents stuff, to match
the existing logic in user activation, and I lean towards doing it
as late as possible; too early and we might not have the users and
groups required to bootstrap a Homebrew installation set up, but
as Homebrew installations could be fiddly and fail, doing it in the
middle could leave a partially‐activated system.
Probably it should be done in a launch agent or something instead, but
this is my best guess as to the appropriate place for now. The downside
is that activation scripts generally won’t be able to assume that the
Homebrew prefix is populated according to the current configuration,
but they probably shouldn’t be depending on that anyway?
The previous command would fail because of datetimes not being
representable as JSON, wiping the config entirely because of the
`sponge` invocation that doesn't care whether the program piped in
fails.
When /nix/store internal directories get renamed, they just don't get
into the next version of your system closure and are thus no problem to
rename. But state in the system is a problem, as there is no process to
remov eit. Thus we need to do it ourselves.
(With some tweaks to handle `nix.enable` and order it at a more
sensible position in the `$PATH`.)
The installers actually install Nix into `root`’s profile for some
reason, which means that the path’s prioritization backfires when
the script runs as root and we’re managing the Nix installation. When
running `darwin-rebuild` as a normal user, this wasn’t a problem.
Maybe we should just have a check to make sure there’s no conflicting
Nix in `root`’s profile – it seems pretty bad for `root` to
get the wrong Nix – but it would trigger for almost everyone,
which seems kind of annoying. I guess we could automatically
remove it from `root`’s profile if it matches what’s in
`/nix/var/nix/profiles/default`…
This reverts commit 02232f71c5.
This backs out commit 3b738c765d.
Setting a `umask` made the parent directory have too conservative of
permissions making it so `_github-runner` couldn't access the child
directories.
