thunderbottom/flakes
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

chore: pin nix to 2.23

Browse Source 
A security issue currently plagues nix_git package, along with some other issues cropping up
in the newer versions. So we'll stick to the last stable, bug-free nix version for a while.

Signed-off-by: Chinmay D. Pai <chinmaydpai@gmail.com>
This commit is contained in:
Chinmay D. Pai 2024-09-22 14:56:53 +05:30
parent 11b0bf7522
commit 25ecb1c367
Signed by: thunderbottom
GPG Key ID: 75507BE256F40CED
1 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
modules/nixos/core/nix/default.nix
View File

@ -4,8 +4,7 @@
lib, lib,
pkgs, pkgs,
... ...
}: }: {
{
options.snowflake.core.nix = { options.snowflake.core.nix = {
enable = lib.mkEnableOption "Enable core nix configuration"; enable = lib.mkEnableOption "Enable core nix configuration";
}; };
@ -22,13 +21,16 @@
# Add each flake input as a registry to make nix3 commands # Add each flake input as a registry to make nix3 commands
# consistent with nix flakes. # consistent with nix flakes.
registry = lib.mapAttrs (_: value: { flake = value; }) inputs; registry = lib.mapAttrs (_: value: {flake = value;}) inputs;
# Add inputs to system's legacy channels. # Add inputs to system's legacy channels.
nixPath = lib.mapAttrsToList (key: value: "${key}=${value.to.path}") config.nix.registry; nixPath = lib.mapAttrsToList (key: value: "${key}=${value.to.path}") config.nix.registry;
# Use the latest, unstable version of nix. # Use the latest, unstable version of nix.
package = pkgs.nixVersions.git; package = pkgs.nixVersions.nix_2_23;
# TODO: switch back to nix git. Current version has a security issue that allows
# remote code execution.
# package = pkgs.nixVersions.git;
settings = { settings = {
# Accept flake configuration without prompting. # Accept flake configuration without prompting.
@ -65,8 +67,8 @@
warn-dirty = false; warn-dirty = false;
# Add cache substituters to allow fetching cached builds. # Add cache substituters to allow fetching cached builds.
trusted-substituters = [ "https://nix-community.cachix.org" ]; trusted-substituters = ["https://nix-community.cachix.org"];
trusted-public-keys = [ "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" ]; trusted-public-keys = ["nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="];
}; };
}; };
}; };