From 5f430f56a341317f5c90329a0b44c0c900233863 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Tue, 25 Aug 2026 15:58:58 +0200 Subject: [PATCH 1/4] flake.lock: Update MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Flake lock file updates: • Updated input 'nixpkgs': 'https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2605.1009383%2Brev-4382ed2b7a6839d4280a9b386db49cbc5907414d/019f6c11-ad78-7500-a194-d18a5bad0fbe/source.tar.gz' (2026-07-16) → 'https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2605.1012930%2Brev-c5c4a43b0e8056328ec4529f735cabdb8f1942bb/01a053c0-7061-7382-b001-102e9148a5b5/source.tar.gz' (2026-08-29) --- flake.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/flake.lock b/flake.lock index 99e0a8ec1cce..f11f48a2aa6e 100644 --- a/flake.lock +++ b/flake.lock @@ -57,12 +57,12 @@ }, "nixpkgs": { "locked": { - "lastModified": 1784160687, - "narHash": "sha256-iYL/bixrb6FlHFu/gIuBYzq6c6lM5AAXsXNSWXtIgQc=", - "rev": "4382ed2b7a6839d4280a9b386db49cbc5907414d", - "revCount": 1009383, + "lastModified": 1787962033, + "narHash": "sha256-u6z9VTZA4Kf3RkHQo9sQI7NI4Ei/uiU9vrMqOiwWP1Y=", + "rev": "c5c4a43b0e8056328ec4529f735cabdb8f1942bb", + "revCount": 1012930, "type": "tarball", - "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2605.1009383%2Brev-4382ed2b7a6839d4280a9b386db49cbc5907414d/019f6c11-ad78-7500-a194-d18a5bad0fbe/source.tar.gz" + "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.2605.1012930%2Brev-c5c4a43b0e8056328ec4529f735cabdb8f1942bb/01a053c0-7061-7382-b001-102e9148a5b5/source.tar.gz" }, "original": { "type": "tarball", From 95af23df251cd95e49531372c250bc6b73046227 Mon Sep 17 00:00:00 2001 From: Emre Sahin Date: Tue, 25 Aug 2026 11:18:52 +0200 Subject: [PATCH 2/4] Remove backported boost patch See https://github.com/NixOS/nixpkgs/commit/b5e044308f120cbcaaeff4b5c9326c48739c3ff6 --- packaging/dependencies.nix | 3 - ...eptions-not-accounting-for-forced_un.patch | 102 ------------------ 2 files changed, 105 deletions(-) delete mode 100644 packaging/patches/0001-Fix-uncaught_exceptions-not-accounting-for-forced_un.patch diff --git a/packaging/dependencies.nix b/packaging/dependencies.nix index 180e19433929..183ec3fb6a60 100644 --- a/packaging/dependencies.nix +++ b/packaging/dependencies.nix @@ -203,9 +203,6 @@ scope: { "--with-url" "--with-thread" ]; - patches = [ - ./patches/0001-Fix-uncaught_exceptions-not-accounting-for-forced_un.patch - ]; enableIcu = false; inherit stdenv; }).overrideAttrs diff --git a/packaging/patches/0001-Fix-uncaught_exceptions-not-accounting-for-forced_un.patch b/packaging/patches/0001-Fix-uncaught_exceptions-not-accounting-for-forced_un.patch deleted file mode 100644 index 7ec13724c40b..000000000000 --- a/packaging/patches/0001-Fix-uncaught_exceptions-not-accounting-for-forced_un.patch +++ /dev/null @@ -1,102 +0,0 @@ -From 5883212311535a0046031d74d1568ae173c1e35b Mon Sep 17 00:00:00 2001 -From: Sergei Zimmerman -Date: Tue, 21 Jul 2026 21:15:51 +0000 -Subject: [PATCH] Fix uncaught_exceptions() not accounting for forced_unwind - -Unwound fibers would see std::uncaught_exceptions() == 0, while a -forced_unwind exception is in "flight". This goes against the contract -of std::uncaught_exceptions() that scope guards rely upon. Failing -to report the correct number of uncaught exceptions (especially -misreporting zero) will lead to scope guards to misbehave badly and skip -running cleanup code which branches on whether the destructor is called -during stack unwinding or not. - -This is because the "throw" would happen before the destructor is run on -the fiber stack being switched to, but the increment would be clobbered -by the destructor of manage_exception_state. - -I'm not sure what the contract of run ontop_fcontext is wrt to whether -the the caller provided function can throw or not, but in my best -understanding the forced_unwind mechanism is mostly internal and so is -throwing from ontop_fcontext in the switched-to fiber. Thus, I've kept -the catch block scoped to detail::forced_unwind. ---- - include/boost/context/fiber_fcontext.hpp | 37 +++++++++++++++++------- - test/test_fiber.cpp | 24 +++++++++++++++ - 2 files changed, 51 insertions(+), 10 deletions(-) - -diff --git a/include/boost/context/fiber_fcontext.hpp b/include/boost/context/fiber_fcontext.hpp -index 543ba6c..38476c9 100644 ---- a/boost/context/fiber_fcontext.hpp -+++ b/boost/context/fiber_fcontext.hpp -@@ -70,7 +70,9 @@ namespace context { - namespace detail { - - // manage_exception_state is a dummy struct unless we have specific support --struct manage_exception_state {}; -+struct manage_exception_state { -+ void from_forced_unwind() noexcept {} -+}; - - } // namespace detail - } // namespace context -@@ -90,6 +92,11 @@ public: - manage_exception_state() { - exception_state_ = *__cxa_get_globals(); - } -+ // Hack to account for the forced_unwind exception thrown in fiber_unwind -+ // that's run ontop before the destructor. -+ void from_forced_unwind() noexcept { -+ exception_state_.uncaughtExceptions += 1; -+ } - ~manage_exception_state() { - *__cxa_get_globals() = exception_state_; - } -@@ -376,13 +383,18 @@ public: - BOOST_ASSERT( nullptr != fctx_); - detail::manage_exception_state exstate; - boost::ignore_unused(exstate); -- return { detail::jump_fcontext( -+ try { -+ return { detail::jump_fcontext( - #if defined(BOOST_NO_CXX14_STD_EXCHANGE) -- detail::exchange( fctx_, nullptr), -+ detail::exchange( fctx_, nullptr), - #else -- std::exchange( fctx_, nullptr), -+ std::exchange( fctx_, nullptr), - #endif -- nullptr).fctx }; -+ nullptr).fctx }; -+ } catch ( detail::forced_unwind const& ) { -+ exstate.from_forced_unwind(); -+ throw; -+ } - } - - template< typename Fn > -@@ -391,14 +403,19 @@ public: - detail::manage_exception_state exstate; - boost::ignore_unused(exstate); - auto p = std::forward< Fn >( fn); -- return { detail::ontop_fcontext( -+ try { -+ return { detail::ontop_fcontext( - #if defined(BOOST_NO_CXX14_STD_EXCHANGE) -- detail::exchange( fctx_, nullptr), -+ detail::exchange( fctx_, nullptr), - #else -- std::exchange( fctx_, nullptr), -+ std::exchange( fctx_, nullptr), - #endif -- & p, -- detail::fiber_ontop< fiber, decltype(p) >).fctx }; -+ & p, -+ detail::fiber_ontop< fiber, decltype(p) >).fctx }; -+ } catch ( detail::forced_unwind const& ) { -+ exstate.from_forced_unwind(); -+ throw; -+ } - } - - explicit operator bool() const noexcept { From a76fcaac6867cd26ebd973649b889bd318eb8a41 Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Tue, 25 Aug 2026 16:11:37 +0200 Subject: [PATCH 3/4] packaging/secure-packages/flake.lock: Update MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Flake lock file updates: • Updated input 'nix/nixpkgs': 'https://api.flakehub.com/f/pinned/DeterminateSystems/secure-packages-26.05/0.1.1012125%2Brev-86c2aa5aa3e08175d183edb2581a7fd32c358115/01a01b96-88bb-7c70-84ca-1cbd5a037ecf/source.tar.gz' (2026-08-19) → 'https://api.flakehub.com/f/pinned/DeterminateSystems/secure-packages-26.05/0.1.1013487%2Brev-01649628bfcaf28024737daec63d559fe0463e6c/01a04eb4-9c90-76b3-a3fb-a92559e04618/source.tar.gz' (2026-08-29) --- packaging/secure-packages/flake.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/packaging/secure-packages/flake.lock b/packaging/secure-packages/flake.lock index 4a2f30abe4c4..ed100b9a765d 100644 --- a/packaging/secure-packages/flake.lock +++ b/packaging/secure-packages/flake.lock @@ -77,12 +77,12 @@ }, "nixpkgs": { "locked": { - "lastModified": 1787167317, - "narHash": "sha256-Ec5+Im+BNJ4tVuD5Em6bsvrSjIDX6lBDnGd64QEorAg=", - "rev": "86c2aa5aa3e08175d183edb2581a7fd32c358115", - "revCount": 1012125, + "lastModified": 1788025223, + "narHash": "sha256-TWYxqK6AnH3/AXPSowct3pxzafZ501CjVuJGu1kBUJw=", + "rev": "01649628bfcaf28024737daec63d559fe0463e6c", + "revCount": 1013487, "type": "tarball", - "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/secure-packages-26.05/0.1.1012125%2Brev-86c2aa5aa3e08175d183edb2581a7fd32c358115/01a01b96-88bb-7c70-84ca-1cbd5a037ecf/source.tar.gz" + "url": "https://api.flakehub.com/f/pinned/DeterminateSystems/secure-packages-26.05/0.1.1013487%2Brev-01649628bfcaf28024737daec63d559fe0463e6c/01a04eb4-9c90-76b3-a3fb-a92559e04618/source.tar.gz" }, "original": { "type": "tarball", From 02002da656041237503b74aae73481418327449e Mon Sep 17 00:00:00 2001 From: Eelco Dolstra Date: Mon, 31 Aug 2026 12:55:28 +0200 Subject: [PATCH 4/4] upload-debug-info-to-sentry.py: Support zstd-compressed NARs cache.nixos.org compresses newer NARs with zstd instead of xz, but the script unconditionally piped downloaded debuginfo NARs through `xz -d`. This broke after the Nixpkgs update pulled in glibc 2.42, whose debuginfo NAR is served as .nar.zst. Pick the decompressor based on the archive extension, and add xz/zstd to the nix shell shebang so both are guaranteed to be on PATH. Assisted-by: Claude Fable 5 --- maintainers/upload-debug-info-to-sentry.py | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/maintainers/upload-debug-info-to-sentry.py b/maintainers/upload-debug-info-to-sentry.py index 87804d32a519..d183311ea9f7 100755 --- a/maintainers/upload-debug-info-to-sentry.py +++ b/maintainers/upload-debug-info-to-sentry.py @@ -1,5 +1,5 @@ #!/usr/bin/env nix -#!nix shell --inputs-from . nixpkgs#sentry-cli nixpkgs#python3 nixpkgs#binutils --command python3 +#!nix shell --inputs-from . nixpkgs#sentry-cli nixpkgs#python3 nixpkgs#binutils nixpkgs#xz nixpkgs#zstd --command python3 import argparse import json @@ -65,21 +65,27 @@ def download_nar(build_id: str, archive: str) -> str: def extract_debug_symbols(nar_path: str, member: str, build_id: str) -> str: - """Extract a member from a .nar.xz into /tmp/debug-info/.debug. Returns the output path.""" + """Extract a member from a compressed NAR into /tmp/debug-info/.debug. Returns the output path.""" out_path = os.path.join(DEBUG_INFO_DIR, f"{build_id}.debug") if os.path.exists(out_path): print(f" already extracted {out_path}", file=sys.stderr) return out_path os.makedirs(DEBUG_INFO_DIR, exist_ok=True) print(f" extracting {member} -> {out_path} ...", file=sys.stderr) - xz = subprocess.Popen(["xz", "-d"], stdin=open(nar_path, "rb"), stdout=subprocess.PIPE) + if nar_path.endswith(".zst"): + decompress_cmd = ["zstd", "-d", "-c"] + elif nar_path.endswith(".xz"): + decompress_cmd = ["xz", "-d"] + else: + raise Exception(f"unknown NAR compression format: {nar_path}") + decompress = subprocess.Popen(decompress_cmd, stdin=open(nar_path, "rb"), stdout=subprocess.PIPE) nar_cat = subprocess.run( ["nix", "nar", "cat", "/dev/stdin", member], - stdin=xz.stdout, + stdin=decompress.stdout, capture_output=True, check=True, ) - xz.wait() + decompress.wait() with open(out_path, "wb") as f: f.write(nar_cat.stdout) return out_path