From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id 4EE24D30C; Thu, 02 Jul 2026 23:41:00 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id 21B65D271; Thu, 02 Jul 2026 23:40:58 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H5, RCVD_IN_MSPIKE_WL,SPF_HELO_PASS autolearn=unavailable autolearn_force=no version=4.0.1 Received: from mail-4317.protonmail.ch (mail-4317.protonmail.ch [185.70.43.17]) by atuin.qyliss.net (Postfix) with ESMTPS id C0C22D26E for ; Thu, 02 Jul 2026 23:40:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=colbyt.com; s=protonmail; t=1783035655; x=1783294855; bh=MQTsJdkIKEnMC8lO0jqySdzJ0EJ4s2PR9W22LCt+1vc=; h=Date:To:From:Cc:Subject:Message-ID:In-Reply-To:References: Feedback-ID:From:To:Cc:Date:Subject:Reply-To:Feedback-ID: Message-ID:BIMI-Selector; b=X4+bI+/O0Z+VBkZh1Er7qFGzs/OYp0ukFKppru0d6RGDIP3MHgsGxmU0X/k2Dh3NO suDZDA3k4Ur4/4y57BEazDndshfHcHlO3+2Z2qnyx5rFG9UiUiSWmKkRMiDWrUgKb7 cBsPSNt5syqE08ud7eEV2RxaefYNnhMxXOKi2BtJx5njE/mo+8wDxnSSHuJp1rHANA jRsdgtUPOsqHi044+vg3CKWZwXt+c/EYPaGjDYWj1hx+QuzDQ4nR2OL4VJNDQqyjZG 4GJaMw8Sa6/hcaDUOSz4qNdu5fW9uNbsfM5dBY4xy/rz5tM2gjGIm4Em4uF5IhvgzX ZbCdXrOEsUAqQ== Date: Thu, 02 Jul 2026 23:40:53 +0000 To: Alyssa Ross From: colby@colbyt.com Subject: Re: [PATCH 8/8] vm-lib: allow app VMs to name closure roots Message-ID: In-Reply-To: <87echlwlyt.fsf@alyssa.is> References: <20260626185509.3715326-1-colby@colbyt.com> <20260626185509.3715326-9-colby@colbyt.com> <87echlwlyt.fsf@alyssa.is> Feedback-ID: 70977973:user:proton X-Pm-Message-ID: e5e359b6daca647cf03d292cda9088ef99d62f12 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Message-ID-Hash: J3JQXISB2RWJ5O3YVIXAFYVJZQ2BLYTP X-Message-ID-Hash: J3JQXISB2RWJ5O3YVIXAFYVJZQ2BLYTP X-MailFrom: colby@colbyt.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: devel@spectrum-os.org X-Mailman-Version: 3.3.10 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: =E2=80=9CMiss files=E2=80=9D was imprecise. The issue I hit was not a store path depending on something outside its c= losure. It was that `run` can be an executable subpath from `lib.getExe`, e= .g. /nix/store/...-firefox-.../bin/firefox and `writeClosure`/`exportReferencesGraph` wants store paths, not arbitrary= subpaths. In that case the graph root should be the package output path (`= /nix/store/...-firefox-...`) while `fs/run` should still point at the execu= table. So the intent of `runClosure` is to decouple =E2=80=9Cwhat should be execut= ed=E2=80=9D from =E2=80=9Cwhich store path(s) should seed the image closure= .=E2=80=9D For the current app VMs, `run =3D lib.getExe firefox` / `lib.getExe foot`, while `runClosure =3D [= firefox ]` keeps the closure root as a store output. The current patches were pragmatic unblockers for the Asahi/nix-portable bu= ild environment where I was running with `--option sandbox false`. The fail= ures I saw, especially the Python bootstrap `usr/` output shape, GnuTLS pro= bing `/usr/bin/socat`, the mypy test observing the unsandboxed build root, = and the libfyaml `.pc` `none required` tokens, are better treated as Nixpkg= s issues or temporary overlay workarounds for this pin. I=E2=80=99ll try to split them mentally that way: - keep only the Spectrum-specific build/runtime changes in the Spectrum s= eries; - either upstream the package fixes to Nixpkgs or carry them as clearly m= arked temporary pin workarounds; I'll also try to get the builder onto sandboxed builds so I stop finding th= e uncommon unsandboxed-only failures first. Thanks for your patience. On Thursday, July 2nd, 2026 at 7:27 AM, Alyssa Ross wrote: > colbyt writes: >=20 > > make-vm copies the closure of the run path into the image. > > > > For app VMs that use lib.getExe, that can miss files from the package > > output that owns the executable. Allow callers to pass explicit closure > > roots, and use the package derivations for the foot and Firefox app VMs= . > > > > Signed-off-by: colbyt >=20 > Can you give an example of something it misses? If a store path depends > on paths not in its closure, that's likely a packaging bug (outside of > specific exceptions like /run/opengl-driver). >