nixpkgs/nixos
Bjørn Forsman fa8ace3618 nixos: don't implicitly map missing user groups to nogroup
Before: `users.users.user1.group = "group-not-defined-anywhere-else"`
would result in user1 having the primary group `nogroup`, assigned at
activation time and only with a (easy to miss) warning from the
activation script. This behaviour is a security issue becase no files
should be owned by `nogroup` and it allows for unrelated users (and
services) to accidentally have access to files they shouldn't have.

After: The configuration above results in this eval error:
  - The following users have a primary group that is undefined: user1
  Hint: Add this to your NixOS config:
    users.groups.group-not-defined-anywhere-else = {};
2023-10-06 19:33:01 +02:00
..
doc/manual kops: 1.27.1 -> 1.28.0 2023-10-04 19:27:49 -05:00
lib nixosTest: fix tests defined with pkgs.nixosTest 2023-10-06 16:33:15 +03:00
maintainers maintainers/scripts/oci: add missing parameter 2023-09-21 22:57:39 +01:00
modules nixos: don't implicitly map missing user groups to nogroup 2023-10-06 19:33:01 +02:00
tests Merge pull request #257828 from mbey-mw/nginx-tmpfiles-rules 2023-10-06 15:28:36 +02:00
COPYING
default.nix
README.md CONTRIBUTING.md: Move boot loader-specific sentence to pkgs/README.md 2023-08-14 19:50:02 +02:00
release-combined.nix nixos/release-combined.nix: Build pkgs/by-name tester 2023-08-29 16:35:07 +02:00
release-small.nix
release.nix Merge pull request #244093 from adamcstephens/lxd/vm 2023-09-03 22:02:54 -05:00

NixOS

NixOS is a Linux distribution based on the purely functional package management system Nix. More information can be found at https://nixos.org/nixos and in the manual in doc/manual.

Testing changes

You can add new module to your NixOS configuration file (usually its /etc/nixos/configuration.nix). And do sudo nixos-rebuild test -I nixpkgs=<path to your local nixpkgs folder> --fast.

Reviewing contributions

When changing the bootloader installation process, extra care must be taken. Grub installations cannot be rolled back, hence changes may break peoples installations forever. For any non-trivial change to the bootloader please file a PR asking for review, especially from @edolstra.

Module updates

Module updates are submissions changing modules in some ways. These often contains changes to the options or introduce new options.

Reviewing process:

  • Ensure that the module maintainers are notified.
    • CODEOWNERS will make GitHub notify users based on the submitted changes, but it can happen that it misses some of the package maintainers.
  • Ensure that the module tests, if any, are succeeding.
  • Ensure that the introduced options are correct.
    • Type should be appropriate (string related types differs in their merging capabilities, loaOf and string types are deprecated).
    • Description, default and example should be provided.
  • Ensure that option changes are backward compatible.
    • mkRenamedOptionModuleWith provides a way to make option changes backward compatible.
  • Ensure that removed options are declared with mkRemovedOptionModule
  • Ensure that changes that are not backward compatible are mentioned in release notes.
  • Ensure that documentations affected by the change is updated.

Sample template for a module update review is provided below.

##### Reviewed points

- [ ] changes are backward compatible
- [ ] removed options are declared with `mkRemovedOptionModule`
- [ ] changes that are not backward compatible are documented in release notes
- [ ] module tests succeed on ARCHITECTURE
- [ ] options types are appropriate
- [ ] options description is set
- [ ] options example is provided
- [ ] documentation affected by the changes is updated

##### Possible improvements

##### Comments

New modules

New modules submissions introduce a new module to NixOS.

Reviewing process:

  • Ensure that the module tests, if any, are succeeding.
  • Ensure that the introduced options are correct.
    • Type should be appropriate (string related types differs in their merging capabilities, loaOf and string types are deprecated).
    • Description, default and example should be provided.
  • Ensure that module meta field is present
    • Maintainers should be declared in meta.maintainers.
    • Module documentation should be declared with meta.doc.
  • Ensure that the module respect other modules functionality.
    • For example, enabling a module should not open firewall ports by default.

Sample template for a new module review is provided below.

##### Reviewed points

- [ ] module path fits the guidelines
- [ ] module tests succeed on ARCHITECTURE
- [ ] options have appropriate types
- [ ] options have default
- [ ] options have example
- [ ] options have descriptions
- [ ] No unneeded package is added to environment.systemPackages
- [ ] meta.maintainers is set
- [ ] module documentation is declared in meta.doc

##### Possible improvements

##### Comments