Nix on CuSO4_Deposit

An alternative solution to direnv dropping aliases and functions

Sun, 12 Oct 2025 00:00:00 +0000

Direnv’s inability to export shell-specific aliases and functions, due to its shell-agnostic design, can be addressed in Nix by using pkgs.writeScriptBin to create executable scripts instead.

Use flakes within a git repo without commiting flake.nix

Fri, 12 Sep 2025 00:00:00 +0000

Doing the following allows you to use flakes to start a development environment without commit the flake.nix to the repo, for cases when your team does not use nix. ¹

[1:user@hostname:~/project-name on main]
$ nvim .envrc
direnv: error /home/user/project-name/.envrc is blocked. Run `direnv allow` to approve its content
[1:user@hostname:~/project-name on main]
$ direnv allow
direnv: loading ~/project-name/.envrc
direnv: using flake ~/flake-project
direnv: nix-direnv: Renewed cache
git-hooks.nix: updating /home/user/project-name repo
/home/user/project-name/.pre-commit-config.yaml
pre-commit installed at .git/hooks/pre-commit
direnv: export +CONFIG_SHELL +HOST_PATH +IN_NIX_SHELL +NIX_BUILD_CORES +NIX_CFLAGS_COMPILE +NIX_ENFORCE_NO_NATIVE +NIX_LDFLAGS +NIX_STORE +NODE_PATH +SOURCE_DATE_EPOCH +__structuredAttrs +buildInputs +buildPhase +builder +cmakeFlags +configureFlags +depsBuildBuild +depsBuildBuildPropagated +depsBuildTarget +depsBuildTargetPropagated +depsHostHost +depsHostHostPropagated +depsTargetTarget +depsTargetTargetPropagated +doCheck +doInstallCheck +dontAddDisableDepTrack +mesonFlags +name +nativeBuildInputs +out +outputs +patches +phases +preferLocalBuild +propagatedBuildInputs +propagatedNativeBuildInputs +shell +shellHook +stdenv +strictDeps +system ~PATH ~XDG_DATA_DIRS
[1:user@hostname:~/project-name on main]
$ gs
?? .direnv/
?? .envrc
?? .pre-commit-config.yaml
[1:user@hostname:~/project-name on main]
$ cat .envrc
use flake ~/flake-project
watch_file ~/flake-project/flake.nix
[1:user@hostname:~/project-name on main]
$ nvim ./.git/info/exclude
[1:user@hostname:~/project-name on main]
$ gs
[1:user@hostname:~/project-name on main]

https://discourse.nixos.org/t/can-i-use-flakes-within-a-git-repo-without-committing-flake-nix/18196 ↩︎

找出所有依赖于特定 nix 包的其他包 - 记录 Qt5 被 deprecate 的修复

Sat, 30 Aug 2025 00:00:00 +0000

TL;DR 使用以下命令可以找到所有依赖于特定包的其他 nix 包。

$ nix-store --query --referrers /nix/store/xxxxx

今天在执行 nixos-rebuild 时，出现了如下报错：

$ nrbt M A
warning: Git tree '/home/cuso4d/.nixos' is dirty
building the system configuration...
warning: Git tree '/home/cuso4d/.nixos' is dirty
error:
 … while calling the 'head' builtin
 at /nix/store/4hm8lf740i8qvyg5pzdqfm0rpshwb7vn-source/lib/attrsets.nix:1544:13:
 1543| if length values == 1 || pred here (elemAt values 1) (head values) then
 1544| head values
 | ^
 1545| else

 … while evaluating the attribute 'value'
 at /nix/store/4hm8lf740i8qvyg5pzdqfm0rpshwb7vn-source/lib/modules.nix:1118:7:
 1117| // {
 1118| value = addErrorContext "while evaluating the option `${showOption loc}':" value;
 | ^
 1119| inherit (res.defsFinal') highestPrio;

 … while evaluating the option `system.build.toplevel':

 … while evaluating definitions from `/nix/store/4hm8lf740i8qvyg5pzdqfm0rpshwb7vn-source/nixos/modules/system/activation/top-level.nix':

 … while evaluating the option `warnings':

 … while evaluating definitions from `/nix/store/4hm8lf740i8qvyg5pzdqfm0rpshwb7vn-source/nixos/modules/system/boot/systemd.nix':

 … while evaluating the option `systemd.services.home-manager-cuso4d.serviceConfig':

 … while evaluating definitions from `/nix/store/7wkrw49sgffqpd9vm7dfa4ngbh4n2fk5-source/nixos':

 … while evaluating the option `home-manager.users.cuso4d.home.file."/home/cuso4d/.config/fontconfig/conf.d/10-hm-fonts.conf".source':

 … while evaluating definitions from `/nix/store/7wkrw49sgffqpd9vm7dfa4ngbh4n2fk5-source/modules/files.nix':

 … while evaluating the option `home-manager.users.cuso4d.home.file."/home/cuso4d/.config/fontconfig/conf.d/10-hm-fonts.conf".text':

 … while evaluating definitions from `/nix/store/7wkrw49sgffqpd9vm7dfa4ngbh4n2fk5-source/modules/misc/xdg.nix':

 … while evaluating the option `home-manager.users.cuso4d.xdg.configFile."fontconfig/conf.d/10-hm-fonts.conf".text':

 … while evaluating definitions from `/nix/store/7wkrw49sgffqpd9vm7dfa4ngbh4n2fk5-source/modules/misc/fontconfig.nix':

 (stack trace truncated; use '--show-trace' to show the full, detailed trace)

 error: Package ‘qtwebengine-5.15.19’ in /nix/store/4hm8lf740i8qvyg5pzdqfm0rpshwb7vn-source/pkgs/development/libraries/qt-5/modules/qtwebengine.nix:442 is marked as insecure, refusing to evaluate.


 Known issues:
 - qt5 qtwebengine is unmaintained upstream since april 2025.
 It is based on chromium 87.0.4280.144, and supposedly patched up to 135.0.7049.95 which is outdated.

 Security issues are frequently discovered in chromium.
 The following list of CVEs was fixed in the life cycle of chromium 138 and likely also affects qtwebengine:
 - CVE-2025-8879
 - CVE-2025-8880
 - CVE-2025-8901
 - CVE-2025-8881
 - CVE-2025-8882
 - CVE-2025-8576
 - CVE-2025-8577
 - CVE-2025-8578
 - CVE-2025-8579
 - CVE-2025-8580
 - CVE-2025-8581
 - CVE-2025-8582
 - CVE-2025-8583
 - CVE-2025-8292
 - CVE-2025-8010
 - CVE-2025-8011
 - CVE-2025-7656
 - CVE-2025-6558 (known to be exploited in the wild)
 - CVE-2025-7657
 - CVE-2025-6554
 - CVE-2025-6555
 - CVE-2025-6556
 - CVE-2025-6557

 The actual list of CVEs affecting qtwebengine is likely much longer,
 as this list is missing issues fixed in chromium 136/137 and even more
 issues are continuously discovered and lack upstream fixes in qtwebengine.


 You can install it anyway by allowing this package, using the
 following methods:

 a) To temporarily allow all insecure packages, you can use an environment
 variable for a single invocation of the nix tools:

 $ export NIXPKGS_ALLOW_INSECURE=1

 Note: When using `nix shell`, `nix build`, `nix develop`, etc with a flake,
 then pass `--impure` in order to allow use of environment variables.

 b) for `nixos-rebuild` you can add ‘qtwebengine-5.15.19’ to
 `nixpkgs.config.permittedInsecurePackages` in the configuration.nix,
 like so:

 {
 nixpkgs.config.permittedInsecurePackages = [
 "qtwebengine-5.15.19"
 ];
 }

 c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
 ‘qtwebengine-5.15.19’ to `permittedInsecurePackages` in
 ~/.config/nixpkgs/config.nix, like so:

 {
 permittedInsecurePackages = [
 "qtwebengine-5.15.19"
 ];
 }
Command 'nix --extra-experimental-features 'nix-command flakes' build --print-out-paths '/home/cuso4d/.nixos#nixosConfigurations."nightcord-dynamica".config.system.build.toplevel' --no-link' returned non-zero exit status 1.

可以看出，在构建的过程中，qtwebengine-5.15.19 这个包阻碍了构建。我需要找到是哪些包依赖了这个，从而进行对系统配置相对应的调整。

NixOS 上 build loong64 docker 镜像

Fri, 20 Jun 2025 00:00:00 +0000

在 x86_64 平台上使用 docker buildx 尝试交叉编译 loong64 的镜像时，出现问题：

1 warning found (use docker --debug to expand):
- InvalidBaseImagePlatform: Base image lcr.loongnix.cn/library/node:22.15-alpine3.21 was pulled with platform "linux/loong64", expected "linux/amd64" for current build

ERROR: failed to solve: process "/bin/sh -c npm run build" did not complete successfully: exit code: 1

在尝试 build 其他平台上的镜像的时候，需要提供的 build arg 是 --build-arg BUILDPLATFORM=<arch>。docker buildx 使用的 builder 可以通过 docker buildx ls 来看到。找到正在使用的 builder 并 inspect：

# docker buildx ls
[sudo] password for cuso4d:
NAME/NODE DRIVER/ENDPOINT STATUS BUILDKIT PLATFORMS
default* docker
 \_ default \_ default running v0.22.0 linux/amd64, linux/arm64, linux/386
 
# docker buildx inspect default
ame: default
Driver: docker
Last Activity: 2025-06-20 09:43:16 +0000 UTC

Nodes:
Name: default
Endpoint: default
Status: running
BuildKit version: v0.22.0
Platforms: linux/amd64, linux/amd64/v2, linux/amd64/v3, linux/386
Labels:
 org.mobyproject.buildkit.worker.moby.host-gateway-ip: 172.17.0.1
...

可以看到 Platforms 里是没有 loong64 的。因此 build 会失败。对这个问题的解决方案，是 docker 将会跑一个 qemu 虚拟机来运行对应平台上的 build。这个 qemu 通常的注入的方式是跑一个容器。龙芯的在这里：

Basic Operations on Datatypes in Nix

Tue, 09 Jul 2024 00:00:00 +0000

Attribute sets

This is an example code, where ex0 to ex7 are evaluated to true.

with import <nixpkgs> { };
with lib;
let
 attr = {a="a"; b = 1; c = true;};
 s = "b";
in
{
 #replace all X, everything should evaluate to true
 ex0 = isAttrs attr;
 ex1 = attr.a == "a";
 ex2 = attr.${s} == 1;
 ex3 = attrVals ["c" "b"] attr == [ true 1 ];
 ex4 = attrValues attr == [ "a" 1 true ];
 ex5 = builtins.intersectAttrs attr {a="b"; d=234; c="";} 
 == { a = "b"; c = "";};
 ex6 = removeAttrs attr ["b" "c"] == { a="a"; };
 ex7 = ! attr ? a == false;
}

source: https://nixcloud.io/tour/?id=attrset/examples

Nix Language Basics

Sun, 30 Jun 2024 00:00:00 +0000

Nix is Functional, Lazy evaluated.

interactive interpreter: nix repl. Execute a file containing nix expression: nix-instantiate --eval file.nix.

let expression (let binding): specify binding scope

e.g. let a=1; b=2; in a+b -> 3

datatypes:

attribute set { name1 = ...; name2 = ...; }, where ... can be a string, number, list or attribute set.
- rec attribute set: rec { ... }, allow access to attributes within the set itself.