|
1 | 1 | # Release 2.34.0 (2026-02-27) |
2 | 2 |
|
| 3 | +## Highlights |
| 4 | + |
3 | 5 | - Rust nix-installer in beta |
4 | 6 |
|
5 | 7 | The Rust-based rewrite of the Nix installer is now in beta. |
|
22 | 24 | This installer is a modified version of the [Determinate Nix Installer](https://github.com/DeterminateSystems/nix-installer) by Determinate Systems. |
23 | 25 | Thanks to Determinate Systems for all the investment they've put into the installer. |
24 | 26 |
|
25 | | - Source for the installer is in https://github.com/NixOS/nix-installer. |
| 27 | + Source for the installer is in <https://github.com/NixOS/nix-installer>. |
26 | 28 | Report any issues in that repo. |
27 | 29 |
|
28 | | - For CI usage, a GitHub Action to install Nix using this installer is available at https://github.com/NixOS/nix-installer-action. |
29 | | - |
30 | | -- C API: New store API methods [#14766](https://github.com/NixOS/nix/pull/14766) |
31 | | - |
32 | | - The C API now includes additional methods: |
33 | | - |
34 | | - - `nix_store_query_path_from_hash_part()` - Get the full store path given its hash part |
35 | | - - `nix_store_copy_path()` - Copy a single store path between two stores, allows repairs and configuring signature checking |
36 | | - |
37 | | -- C API: Errors returned from your primops are not treated as recoverable by default [#13930](https://github.com/NixOS/nix/pull/13930) [#15286](https://github.com/NixOS/nix/pull/15286) |
38 | | - |
39 | | - Nix 2.34 by default remembers the error in the thunk that triggered it. |
40 | | - |
41 | | - Previously the following sequence of events worked: |
42 | | - |
43 | | - 1. Have a thunk that invokes a primop that's defined through the C API |
44 | | - 2. The primop returns an error |
45 | | - 3. Force the thunk again |
46 | | - 4. The primop returns a value |
47 | | - 5. The thunk evaluated successfully |
48 | | - |
49 | | - **Resolution** |
50 | | - |
51 | | - C API consumers that rely on this must change their recoverable error calls: |
52 | | - |
53 | | - ```diff |
54 | | - -nix_set_err_msg(context, NIX_ERR_*, msg); |
55 | | - +nix_set_err_msg(context, NIX_ERR_RECOVERABLE, msg); |
56 | | - ``` |
57 | | - |
58 | | -- New setting `ignore-gc-delete-failure` for local stores [#15054](https://github.com/NixOS/nix/pull/15054) |
59 | | - |
60 | | - A new local store setting [`ignore-gc-delete-failure`](@docroot@/store/types/local-store.md#store-local-store-ignore-gc-delete-failure) has been added. |
61 | | - When enabled, garbage collection will log warnings instead of failing when it cannot delete store paths. |
62 | | - This is useful when running Nix as an unprivileged user that may not have write access to all paths in the store. |
| 30 | + For CI usage, a GitHub Action to install Nix using this installer is available at <https://github.com/NixOS/nix-installer-action>. |
63 | 31 |
|
64 | | - This setting is experimental and requires the [`local-overlay-store`](@docroot@/development/experimental-features.md#xp-feature-local-overlay-store) experimental feature. |
| 32 | +- Stabilisation of `no-url-literals` experimental feature and new diagnostics infrastructure, with `lint-url-literals`, `lint-short-path-literals`, and `lint-absolute-path-literals` settings [#8738](https://github.com/NixOS/nix/issues/8738) [#10048](https://github.com/NixOS/nix/issues/10048) [#10281](https://github.com/NixOS/nix/issues/10281) [#15326](https://github.com/NixOS/nix/pull/15326) |
65 | 33 |
|
66 | | -- Content-Encoding decompression is now handled by libcurl [#14324](https://github.com/NixOS/nix/issues/14324) [#15336](https://github.com/NixOS/nix/pull/15336) |
| 34 | + Experimental feature `no-url-literals` has been stabilised and is now controlled by the `lint-url-literals` option. |
| 35 | + New diagnostics infrastructure has been added for linting discouraged language features. |
67 | 36 |
|
68 | | - Transparent decompression of HTTP downloads specifying `Content-Encoding` header now uses libcurl. This adds support for previously advertised, but not supported `deflate` encoding as well as deprecated `x-gzip` alias. |
69 | | - Non-standard `xz`, `bzip2` encodings that were previously advertised are no longer supported, as they do not commonly appear in the wild and should not be sent by compliant servers. |
| 37 | + ### [`lint-url-literals`](@docroot@/command-ref/conf-file.md#conf-lint-url-literals) |
70 | 38 |
|
71 | | - `br`, `zstd`, `gzip` continue to be supported. Distro packaging should ensure that the `libcurl` dependency is linked against required libraries to support these encodings. By default now the build system requires libcurl >= 8.17.0 which is not known to have issues around [pausing and decompression](https://github.com/curl/curl/issues/16280). |
72 | | - |
73 | | -- New diagnostics infrastructure, with `lint-url-literals`, `lint-short-path-literals`, and `lint-absolute-path-literals` settings [#8738](https://github.com/NixOS/nix/issues/8738) [#10048](https://github.com/NixOS/nix/issues/10048) [#10281](https://github.com/NixOS/nix/issues/10281) [#15326](https://github.com/NixOS/nix/pull/15326) |
74 | | - |
75 | | - A new diagnostics infrastructure has been added for controlling language features that we are considering deprecating. |
76 | | - |
77 | | - ## [`lint-url-literals`](@docroot@/command-ref/conf-file.md#conf-lint-url-literals) |
78 | | - |
79 | | - The `no-url-literals` experimental feature has been stabilized and replaced with a new [`lint-url-literals`](@docroot@/command-ref/conf-file.md#conf-lint-url-literals) setting. |
| 39 | + The `no-url-literals` experimental feature has been stabilised and replaced with a new [`lint-url-literals`](@docroot@/command-ref/conf-file.md#conf-lint-url-literals) setting. |
80 | 40 |
|
81 | 41 | To migrate from the experimental feature, replace: |
82 | 42 | ``` |
|
87 | 47 | lint-url-literals = fatal |
88 | 48 | ``` |
89 | 49 |
|
90 | | - ## [`lint-short-path-literals`](@docroot@/command-ref/conf-file.md#conf-lint-short-path-literals) |
| 50 | + ### [`lint-short-path-literals`](@docroot@/command-ref/conf-file.md#conf-lint-short-path-literals) |
91 | 51 |
|
92 | 52 | The [`warn-short-path-literals`](@docroot@/command-ref/conf-file.md#conf-warn-short-path-literals) boolean setting has been deprecated and replaced with [`lint-short-path-literals`](@docroot@/command-ref/conf-file.md#conf-lint-short-path-literals). |
93 | 53 |
|
|
100 | 60 | lint-short-path-literals = warn |
101 | 61 | ``` |
102 | 62 |
|
103 | | - ## [`lint-absolute-path-literals`](@docroot@/command-ref/conf-file.md#conf-lint-absolute-path-literals) |
| 63 | + ### [`lint-absolute-path-literals`](@docroot@/command-ref/conf-file.md#conf-lint-absolute-path-literals) |
104 | 64 |
|
105 | 65 | A new [`lint-absolute-path-literals`](@docroot@/command-ref/conf-file.md#conf-lint-absolute-path-literals) setting has been added to control handling of absolute path literals (paths starting with `/`) and home path literals (paths starting with `~/`). |
106 | 66 |
|
107 | | - ## Setting values |
| 67 | + ### Setting values |
108 | 68 |
|
109 | 69 | All three settings accept three values: |
110 | 70 | - `ignore`: Allow the feature without emitting any diagnostic (default) |
|
113 | 73 |
|
114 | 74 | The defaults may change in future versions. |
115 | 75 |
|
116 | | -- Support HTTPS binary caches using mTLS (client certificate) authentication [#13002](https://github.com/NixOS/nix/issues/13002) [#13030](https://github.com/NixOS/nix/pull/13030) |
117 | | - |
118 | | - Added support for `tls-certificate` and `tls-private-key` options in substituter URLs. |
119 | | - |
120 | | - Example: |
121 | | - |
122 | | - ``` |
123 | | - https://substituter.invalid?tls-certificate=/path/to/cert.pem&tls-private-key=/path/to/key.pem |
124 | | - ``` |
125 | | - |
126 | | - When these options are configured, Nix will use this certificate/private key pair to authenticate to the server. |
127 | | - |
128 | | -- New setting `narinfo-cache-meta-ttl` [#15287](https://github.com/NixOS/nix/pull/15287) |
129 | | - |
130 | | - The new setting `narinfo-cache-meta-ttl` controls how long binary cache metadata (i.e. `/nix-cache-info`) is cached locally, in seconds. This was previously hard-coded to 7 days, which is still the default. As a result, you can now use `nix store info --refresh` to check whether a binary cache is still valid. |
| 76 | +## New features |
131 | 77 |
|
132 | 78 | - `nix repl` now supports `inherit` and multiple bindings [#15082](https://github.com/NixOS/nix/pull/15082) |
133 | 79 |
|
|
157 | 103 |
|
158 | 104 | This feature requires the [`local-overlay-store` experimental feature](@docroot@/development/experimental-features.md#xp-feature-local-overlay-store). |
159 | 105 |
|
| 106 | +- New setting `ignore-gc-delete-failure` for local stores [#15054](https://github.com/NixOS/nix/pull/15054) |
| 107 | + |
| 108 | + A new local store setting [`ignore-gc-delete-failure`](@docroot@/store/types/local-store.md#store-local-store-ignore-gc-delete-failure) has been added. |
| 109 | + When enabled, garbage collection will log warnings instead of failing when it cannot delete store paths. |
| 110 | + This is useful when running Nix as an unprivileged user that may not have write access to all paths in the store. |
| 111 | + |
| 112 | + This setting is experimental and requires the [`local-overlay-store`](@docroot@/development/experimental-features.md#xp-feature-local-overlay-store) experimental feature. |
| 113 | + |
| 114 | +- New setting `narinfo-cache-meta-ttl` [#15287](https://github.com/NixOS/nix/pull/15287) |
| 115 | + |
| 116 | + The new setting `narinfo-cache-meta-ttl` controls how long binary cache metadata (i.e. `/nix-cache-info`) is cached locally, in seconds. This was previously hard-coded to 7 days, which is still the default. As a result, you can now use `nix store info --refresh` to check whether a binary cache is still valid. |
| 117 | + |
| 118 | +- Support HTTPS binary caches using mTLS (client certificate) authentication [#13002](https://github.com/NixOS/nix/issues/13002) [#13030](https://github.com/NixOS/nix/pull/13030) |
| 119 | + |
| 120 | + Added support for `tls-certificate` and `tls-private-key` options in substituter URLs. |
| 121 | + |
| 122 | + Example: |
| 123 | + |
| 124 | + ``` |
| 125 | + https://substituter.invalid?tls-certificate=/path/to/cert.pem&tls-private-key=/path/to/key.pem |
| 126 | + ``` |
| 127 | + |
| 128 | + When these options are configured, Nix will use this certificate/private key pair to authenticate to the server. |
| 129 | + |
| 130 | +## C API Changes |
| 131 | + |
| 132 | +- New store API methods [#14766](https://github.com/NixOS/nix/pull/14766) |
| 133 | + |
| 134 | + The C API now includes additional methods: |
| 135 | + |
| 136 | + - `nix_store_query_path_from_hash_part()` - Get the full store path given its hash part |
| 137 | + - `nix_store_copy_path()` - Copy a single store path between two stores, allows repairs and configuring signature checking |
| 138 | + |
| 139 | +- Errors returned from your primops are not treated as recoverable by default [#13930](https://github.com/NixOS/nix/pull/13930) [#15286](https://github.com/NixOS/nix/pull/15286) |
| 140 | + |
| 141 | + Nix 2.34 by default remembers the error in the thunk that triggered it. |
| 142 | + |
| 143 | + Previously the following sequence of events worked: |
| 144 | + |
| 145 | + 1. Have a thunk that invokes a primop that's defined through the C API |
| 146 | + 2. The primop returns an error |
| 147 | + 3. Force the thunk again |
| 148 | + 4. The primop returns a value |
| 149 | + 5. The thunk evaluated successfully |
| 150 | + |
| 151 | + **Resolution** |
| 152 | + |
| 153 | + C API consumers that rely on this must change their recoverable error calls: |
| 154 | + |
| 155 | + ```diff |
| 156 | + -nix_set_err_msg(context, NIX_ERR_*, msg); |
| 157 | + +nix_set_err_msg(context, NIX_ERR_RECOVERABLE, msg); |
| 158 | + ``` |
| 159 | + |
| 160 | +## Bug fixes |
| 161 | + |
160 | 162 | - S3 binary caches now use virtual-hosted-style addressing by default [#15208](https://github.com/NixOS/nix/issues/15208) |
161 | 163 |
|
162 | 164 | S3 binary caches now use virtual-hosted-style URLs |
|
187 | 189 | idle connections from being silently dropped by intermediate network devices |
188 | 190 | (NATs, firewalls, load balancers). |
189 | 191 |
|
| 192 | +## Miscellaneous changes |
190 | 193 |
|
191 | | -## Contributors |
| 194 | +- Content-Encoding decompression is now handled by libcurl [#14324](https://github.com/NixOS/nix/issues/14324) [#15336](https://github.com/NixOS/nix/pull/15336) |
192 | 195 |
|
| 196 | + Transparent decompression of HTTP downloads specifying `Content-Encoding` header now uses libcurl. This adds support for previously advertised, but not supported `deflate` encoding as well as deprecated `x-gzip` alias. |
| 197 | + Non-standard `xz`, `bzip2` encodings that were previously advertised are no longer supported, as they do not commonly appear in the wild and should not be sent by compliant servers. |
| 198 | + |
| 199 | + `br`, `zstd`, `gzip` continue to be supported. Distro packaging should ensure that the `libcurl` dependency is linked against required libraries to support these encodings. By default, the build system now requires libcurl >= 8.17.0, which is not known to have issues around [pausing and decompression](https://github.com/curl/curl/issues/16280). |
| 200 | + |
| 201 | +## Contributors |
193 | 202 |
|
194 | 203 | This release was made possible by the following 43 contributors: |
195 | 204 |
|
|
0 commit comments