找出所有依赖于特定 nix 包的其他包 - 记录 Qt5 被 deprecate 的修复

Sat, 30 Aug 2025 00:00:00 +0000

TL;DR 使用以下命令可以找到所有依赖于特定包的其他 nix 包。

$ nix-store --query --referrers /nix/store/xxxxx

今天在执行 nixos-rebuild 时，出现了如下报错：

$ nrbt M A
warning: Git tree '/home/cuso4d/.nixos' is dirty
building the system configuration...
warning: Git tree '/home/cuso4d/.nixos' is dirty
error:
 … while calling the 'head' builtin
 at /nix/store/4hm8lf740i8qvyg5pzdqfm0rpshwb7vn-source/lib/attrsets.nix:1544:13:
 1543| if length values == 1 || pred here (elemAt values 1) (head values) then
 1544| head values
 | ^
 1545| else

 … while evaluating the attribute 'value'
 at /nix/store/4hm8lf740i8qvyg5pzdqfm0rpshwb7vn-source/lib/modules.nix:1118:7:
 1117| // {
 1118| value = addErrorContext "while evaluating the option `${showOption loc}':" value;
 | ^
 1119| inherit (res.defsFinal') highestPrio;

 … while evaluating the option `system.build.toplevel':

 … while evaluating definitions from `/nix/store/4hm8lf740i8qvyg5pzdqfm0rpshwb7vn-source/nixos/modules/system/activation/top-level.nix':

 … while evaluating the option `warnings':

 … while evaluating definitions from `/nix/store/4hm8lf740i8qvyg5pzdqfm0rpshwb7vn-source/nixos/modules/system/boot/systemd.nix':

 … while evaluating the option `systemd.services.home-manager-cuso4d.serviceConfig':

 … while evaluating definitions from `/nix/store/7wkrw49sgffqpd9vm7dfa4ngbh4n2fk5-source/nixos':

 … while evaluating the option `home-manager.users.cuso4d.home.file."/home/cuso4d/.config/fontconfig/conf.d/10-hm-fonts.conf".source':

 … while evaluating definitions from `/nix/store/7wkrw49sgffqpd9vm7dfa4ngbh4n2fk5-source/modules/files.nix':

 … while evaluating the option `home-manager.users.cuso4d.home.file."/home/cuso4d/.config/fontconfig/conf.d/10-hm-fonts.conf".text':

 … while evaluating definitions from `/nix/store/7wkrw49sgffqpd9vm7dfa4ngbh4n2fk5-source/modules/misc/xdg.nix':

 … while evaluating the option `home-manager.users.cuso4d.xdg.configFile."fontconfig/conf.d/10-hm-fonts.conf".text':

 … while evaluating definitions from `/nix/store/7wkrw49sgffqpd9vm7dfa4ngbh4n2fk5-source/modules/misc/fontconfig.nix':

 (stack trace truncated; use '--show-trace' to show the full, detailed trace)

 error: Package ‘qtwebengine-5.15.19’ in /nix/store/4hm8lf740i8qvyg5pzdqfm0rpshwb7vn-source/pkgs/development/libraries/qt-5/modules/qtwebengine.nix:442 is marked as insecure, refusing to evaluate.


 Known issues:
 - qt5 qtwebengine is unmaintained upstream since april 2025.
 It is based on chromium 87.0.4280.144, and supposedly patched up to 135.0.7049.95 which is outdated.

 Security issues are frequently discovered in chromium.
 The following list of CVEs was fixed in the life cycle of chromium 138 and likely also affects qtwebengine:
 - CVE-2025-8879
 - CVE-2025-8880
 - CVE-2025-8901
 - CVE-2025-8881
 - CVE-2025-8882
 - CVE-2025-8576
 - CVE-2025-8577
 - CVE-2025-8578
 - CVE-2025-8579
 - CVE-2025-8580
 - CVE-2025-8581
 - CVE-2025-8582
 - CVE-2025-8583
 - CVE-2025-8292
 - CVE-2025-8010
 - CVE-2025-8011
 - CVE-2025-7656
 - CVE-2025-6558 (known to be exploited in the wild)
 - CVE-2025-7657
 - CVE-2025-6554
 - CVE-2025-6555
 - CVE-2025-6556
 - CVE-2025-6557

 The actual list of CVEs affecting qtwebengine is likely much longer,
 as this list is missing issues fixed in chromium 136/137 and even more
 issues are continuously discovered and lack upstream fixes in qtwebengine.


 You can install it anyway by allowing this package, using the
 following methods:

 a) To temporarily allow all insecure packages, you can use an environment
 variable for a single invocation of the nix tools:

 $ export NIXPKGS_ALLOW_INSECURE=1

 Note: When using `nix shell`, `nix build`, `nix develop`, etc with a flake,
 then pass `--impure` in order to allow use of environment variables.

 b) for `nixos-rebuild` you can add ‘qtwebengine-5.15.19’ to
 `nixpkgs.config.permittedInsecurePackages` in the configuration.nix,
 like so:

 {
 nixpkgs.config.permittedInsecurePackages = [
 "qtwebengine-5.15.19"
 ];
 }

 c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
 ‘qtwebengine-5.15.19’ to `permittedInsecurePackages` in
 ~/.config/nixpkgs/config.nix, like so:

 {
 permittedInsecurePackages = [
 "qtwebengine-5.15.19"
 ];
 }
Command 'nix --extra-experimental-features 'nix-command flakes' build --print-out-paths '/home/cuso4d/.nixos#nixosConfigurations."nightcord-dynamica".config.system.build.toplevel' --no-link' returned non-zero exit status 1.

可以看出，在构建的过程中，qtwebengine-5.15.19 这个包阻碍了构建。我需要找到是哪些包依赖了这个，从而进行对系统配置相对应的调整。

NixOS 上 build loong64 docker 镜像

Fri, 20 Jun 2025 00:00:00 +0000

在 x86_64 平台上使用 docker buildx 尝试交叉编译 loong64 的镜像时，出现问题：

1 warning found (use docker --debug to expand):
- InvalidBaseImagePlatform: Base image lcr.loongnix.cn/library/node:22.15-alpine3.21 was pulled with platform "linux/loong64", expected "linux/amd64" for current build

ERROR: failed to solve: process "/bin/sh -c npm run build" did not complete successfully: exit code: 1

在尝试 build 其他平台上的镜像的时候，需要提供的 build arg 是 --build-arg BUILDPLATFORM=<arch>。docker buildx 使用的 builder 可以通过 docker buildx ls 来看到。找到正在使用的 builder 并 inspect：

# docker buildx ls
[sudo] password for cuso4d:
NAME/NODE DRIVER/ENDPOINT STATUS BUILDKIT PLATFORMS
default* docker
 \_ default \_ default running v0.22.0 linux/amd64, linux/arm64, linux/386
 
# docker buildx inspect default
ame: default
Driver: docker
Last Activity: 2025-06-20 09:43:16 +0000 UTC

Nodes:
Name: default
Endpoint: default
Status: running
BuildKit version: v0.22.0
Platforms: linux/amd64, linux/amd64/v2, linux/amd64/v3, linux/386
Labels:
 org.mobyproject.buildkit.worker.moby.host-gateway-ip: 172.17.0.1
...

可以看到 Platforms 里是没有 loong64 的。因此 build 会失败。对这个问题的解决方案，是 docker 将会跑一个 qemu 虚拟机来运行对应平台上的 build。这个 qemu 通常的注入的方式是跑一个容器。龙芯的在这里：

NixOS on CuSO4_Deposit

找出所有依赖于特定 nix 包的其他包 - 记录 Qt5 被 deprecate 的修复

NixOS 上 build loong64 docker 镜像