Official NixOS Wiki

FAQ/Pinning Nixpkgs: Difference between revisions

← Older edit
DHCP (talk | contribs)
104 edits
VisualWikitext
m FAQ Breadcrumb
DHCP (talk | contribs)
104 edits
m use '$' and lang=console for shell commands syntax highlighting; update links to channels.nixos.org
 
(2 intermediate revisions by 2 users not shown)
Line 9: Line 9:
Note: You can <code>sudo nix-channel --remove nixpkgs</code>, but you still need a nix-channel for nixos
Note: You can <code>sudo nix-channel --remove nixpkgs</code>, but you still need a nix-channel for nixos


<pre>
Be aware that this also pins all dependencies of the application which often causes issues for GUI applications and also brings in back outdated and potentially vulnerable dependencies.
sudo nix-channel --list
nixos https://nixos.org/channels/nixos-21.05
</pre>


== Nix 2.0 onwards ==
<syntaxhighlight lang="console">
$ sudo nix-channel --list
nixos https://channels.nixos.org/nixos-26.05
</syntaxhighlight>


Nix 2.0 introduces new builtins, <code>fetchTarball</code> and <code>fetchGit</code>, which make it possible to fetch a specific version of nixpkgs without depending on an existing one:
Nix 2.0 introduces new builtins, <code>fetchTarball</code> and <code>fetchGit</code>, which make it possible to fetch a specific version of nixpkgs without depending on an existing one:
Line 23: Line 23:
   name = "nixos-unstable-2018-09-12";
   name = "nixos-unstable-2018-09-12";
   # Commit hash for nixos-unstable as of 2018-09-12
   # Commit hash for nixos-unstable as of 2018-09-12
   url = "https://github.com/nixos/nixpkgs/archive/ca2ba44cab47767c8127d1c8633e2b581644eb8f.tar.gz";
   url = "https://github.com/NixOS/nixpkgs/archive/ca2ba44cab47767c8127d1c8633e2b581644eb8f.tar.gz";
   # Hash obtained using `nix-prefetch-url --unpack <url>`
   # Hash obtained using `nix-prefetch-url --unpack <url>`
   sha256 = "1jg7g6cfpw8qvma0y19kwyp549k1qyf11a5sg6hvn6awvmkny47v";
   sha256 = "1jg7g6cfpw8qvma0y19kwyp549k1qyf11a5sg6hvn6awvmkny47v";
}) {}
}) { }
</syntaxhighlight>
</syntaxhighlight>


Or, to use git for fetching<!-- (this has the advantage of being somewhat faster for updates, but is slower for the initial fetch) [not true anymore, the repository sharing mechanism has been disabled (https://github.com/NixOS/nix/pull/2358)]-->:
Or, to use git for fetching:


<syntaxhighlight lang="nix">
<syntaxhighlight lang="nix">
Line 35: Line 35:
   # Descriptive name to make the store path easier to identify
   # Descriptive name to make the store path easier to identify
   name = "nixos-unstable-2018-09-12";
   name = "nixos-unstable-2018-09-12";
   url = "https://github.com/nixos/nixpkgs/";
   url = "https://github.com/NixOS/nixpkgs/";
   # Commit hash for nixos-unstable as of 2018-09-12
   # Commit hash for nixos-unstable as of 2018-09-12
   # `git ls-remote https://github.com/nixos/nixpkgs nixos-unstable`
   # `git ls-remote https://github.com/NixOS/nixpkgs nixos-unstable`
   ref = "refs/heads/nixos-unstable";
   ref = "refs/heads/nixos-unstable";
   rev = "ca2ba44cab47767c8127d1c8633e2b581644eb8f";
   rev = "ca2ba44cab47767c8127d1c8633e2b581644eb8f";
}) {}
}) { }
</syntaxhighlight>
</syntaxhighlight>


Line 51: Line 51:
while evaluating anonymous function at /nix/store/b93cq865x6qxpn4dw9ivrk3yjcsm8r97-nixos-19.09/pkgs/stdenv/generic/make-derivation.nix:142:17, called from undefined position:
while evaluating anonymous function at /nix/store/b93cq865x6qxpn4dw9ivrk3yjcsm8r97-nixos-19.09/pkgs/stdenv/generic/make-derivation.nix:142:17, called from undefined position:
program 'git' failed with exit code 128
program 'git' failed with exit code 128
</syntaxhighlight>
== Before 2.0 ==
The following code uses the host's Nixpkgs as a
springboard to fetch and import a specific, pinned version of Nixpkgs.
This is safe because the specific code we're using from the variable
host Nixpkgs is using a very stable API, and will be thrown away as
soon as we are done importing the pinned version of Nixpkgs.
Where before you would use <code>pkgs = import <nixpkgs> {}</code>
(which uses the host's Nixpkgs version) you can pin to an exact
version of Nixpkgs by instead using:
<syntaxhighlight lang="nix">
pkgs = let
  hostPkgs = import <nixpkgs> {};
  pinnedPkgs = hostPkgs.fetchFromGitHub {
    owner = "NixOS";
    repo = "nixpkgs";
    # nixos-unstable as of 2017-11-13T08:53:10-00:00
    rev = "ac355040656de04f59406ba2380a96f4124ebdad";
    sha256 = "0frhc7mnx88sird6ipp6578k5badibsl0jfa22ab9w6qrb88j825";
  };
in import pinnedPkgs {}
</syntaxhighlight>
This can also be instead used to pull nixpkgs from an internal fork of
Nixpkgs, with your own changes on top. Note, however, as it stands
Nix 1.11 has difficulties fetching repositories which require
authentication, this is to be fixed in Nix 1.12.
The package <code>nix-prefetch-git</code> can be used to automatically
calculate the current version and hash of a branch, and output the
information to a file:
<syntaxhighlight>
$ nix-shell -p nix-prefetch-git
[nix-shell:~]$ nix-prefetch-git https://github.com/nixos/nixpkgs.git refs/heads/nixos-unstable > nixpkgs-version.json
...
[nix-shell:~]$ cat nixpkgs-version.json
{
  "url": "https://github.com/nixos/nixpkgs.git",
  "rev": "f607771d0f5e4fa905afff1c772febd9f3103e1a",
  "date": "2018-01-09T11:18:25-05:00",
  "sha256": "1icphqpdcl8akqhfij2pxkfr7wfn86z5sr3jdjh88p9vv1550dx7",
  "fetchSubmodules": true
}
</syntaxhighlight>
This file can then be used to specify the version of Nixpkgs:
<syntaxhighlight lang="nix">
pkgs = let
  hostPkgs = import <nixpkgs> {};
  pinnedVersion = hostPkgs.lib.importJSON ./nixpkgs-version.json;
  pinnedPkgs = hostPkgs.fetchFromGitHub {
    owner = "NixOS";
    repo = "nixpkgs";
    inherit (pinnedVersion) rev sha256;
  };
in import pinnedPkgs {};
</syntaxhighlight>
Finally, this can be taken a step further, and you can apply extra
patches to the pinned version of Nixpkgs, for perhaps PRs that are not
yet merged, or private internal changes that you need. If you take
this route, probably best to move the following in to its own file
that you then import.
<syntaxhighlight lang="nix">
pkgs = let
  hostPkgs = import <nixpkgs> {};
  pinnedVersion = hostPkgs.lib.importJSON ./nixpkgs-version.json;
  pinnedPkgs = hostPkgs.fetchFromGitHub {
    owner = "NixOS";
    repo = "nixpkgs";
    inherit (pinnedVersion) rev sha256;
  };
  patches = [
    ./patches/0001-my-nixpkgs-change.patch
  ];
  patchedPkgs = hostPkgs.runCommand "nixpkgs-${pinnedVersion.rev}"
    {
      inherit pinnedPkgs;
      inherit patches;
    }
    ''
      cp -r $pinnedPkgs $out
      chmod -R +w $out
      for p in $patches; do
        echo "Applying patch $p";
        patch -d $out -p1 < "$p";
      done
    '';
in import patchedPkgs {};
</syntaxhighlight>
</syntaxhighlight>


Line 162: Line 60:
add to configuration.nix a set allowing unstable packages.
add to configuration.nix a set allowing unstable packages.
This assumes a channel named <code>nixpkgs-unstable</code> exists, like so:
This assumes a channel named <code>nixpkgs-unstable</code> exists, like so:
<syntaxhighlight lang="bash">
<syntaxhighlight lang="console">
nix-channel --add https://nixos.org/channels/nixpkgs-unstable nixpkgs-unstable
$ nix-channel --add https://channels.nixos.org/nixpkgs-unstable nixpkgs-unstable
nix-channel --update
$ nix-channel --update
</syntaxhighlight>
</syntaxhighlight>


Line 235: Line 133:
== See also ==
== See also ==


- [https://nix.dev/reference/pinning-nixpkgs Pinning Nixpkgs]
* [https://nix.dev/reference/pinning-nixpkgs Pinning Nixpkgs]
 
* [https://nix.dev/tutorials/first-steps/towards-reproducibility-pinning-nixpkgs Towards Reproducibility: Pinning Nixpkgs]
- [https://nix.dev/tutorials/first-steps/towards-reproducibility-pinning-nixpkgs Towards Reproducibility: Pinning Nixpkgs]
* [https://nix.dev/guides/recipes/dependency-management.html Dependency Management]
 
- [https://nix.dev/guides/recipes/dependency-management.html Dependency Management]
Retrieved from "https://wiki.nixos.org/wiki/FAQ/Pinning_Nixpkgs"