hercules-ci-agent 0.10.8 → 0.10.9
raw patch · 11 files changed
+339/−240 lines, 11 filesPVP ok
version bump matches the API change (PVP)
API changes (from Hackage documentation)
Files
- CHANGELOG.md +228/−222
- cbits/hercules-aliases.h +21/−0
- cbits/nix-2.4/hercules-store.cxx +22/−1
- cbits/nix-2.4/hercules-store.hh +11/−1
- hercules-ci-agent-worker/Hercules/Agent/Worker.hs +1/−2
- hercules-ci-agent-worker/Hercules/Agent/Worker/Build/Logger.hs +10/−0
- hercules-ci-agent-worker/Hercules/Agent/Worker/Build/Prefetched.hs +7/−2
- hercules-ci-agent-worker/Hercules/Agent/Worker/Evaluate.hs +6/−1
- hercules-ci-agent-worker/Hercules/Agent/Worker/HerculesStore.hs +24/−3
- hercules-ci-agent-worker/Hercules/Agent/Worker/HerculesStore/Context.hs +2/−1
- hercules-ci-agent.cabal +7/−7
CHANGELOG.md view
@@ -5,6 +5,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [0.10.9] - 2026-10-13++### Added++- Nix 2.34, 2.35 support+ ## [0.10.8] - 2026-01-06 ### Added@@ -31,39 +37,48 @@ ### Added - - Nix 2.24 support+- Nix 2.24 support ## [0.10.4] - 2024-06-12 ### Fixed - - Embed data file to make packaging easier.+- Embed data file to make packaging easier. ## [0.10.3] - 2024-05-19 ### Fixed - - Updates in the Nix bindings, improving stability.+- Updates in the Nix bindings, improving stability. ## [0.10.2] - 2024-05-03 ### Added - - Add `nixSettings` configuration item, to more easily configure Nix settings such as `substituters`, overriding the system Nix settings.- - Cachix 1.7.2 support+- Add `nixSettings` configuration item, to more easily configure Nix settings such as `substituters`, overriding the system Nix settings.+- Cachix 1.7.2 support ### Fixed - - Remove most uses of `c_str()`, of which at least one exhibited undefined behavior.- - `nix-darwin` module now reads `system` correctly from the configuration.+- Remove most uses of `c_str()`, of which at least one exhibited undefined behavior.+- `nix-darwin` module now reads `system` correctly from the configuration. ## [0.10.1] - 2024-02-12 +### Added++- Effect mounts. Specify [`effectMountables`](https://docs.hercules-ci.com/hercules-ci-agent/agent-config.html#effectMountables) in the agent configuration, deploy, and [mount](https://docs.hercules-ci.com/hercules-ci-agent/effects/declaration.html#__hci_effect_mounts) them into an effect. This can be used for instance to expose the host's `/etc/hosts`, or hardware devices such as GPUs. Access is [controlled](https://docs.hercules-ci.com/hercules-ci-agent/agent-config.html#effectMountables-condition) by the agent configuration.++- New configuration option `remotePlatformsWithSameFeatures`, allowing a remote build to be used before more elaborate remote builder support is implemented.+ The recommended method for running a cluster is still to install `hercules-ci-agent` on each machine, as that is more efficient and accurate.++- Agent [labels](https://docs.hercules-ci.com/hercules-ci-agent/agent-config.html#labels) can now be `null`, when using the JSON configuration format.+ ### Changed - - More work is performed concurrently during evaluation, including binary cache lookups and (more) build dispatch. This results in a speedup.+- More work is performed concurrently during evaluation, including binary cache lookups and (more) build dispatch. This results in a speedup. - - Dependencies of build dependencies are not scheduled eagerly anymore.+- Dependencies of build dependencies are not scheduled eagerly anymore. This reduces the scope of all jobs that are evaluated by agents since this release, resulting in a speedup. This resolves a noticable slowdown when first evaluating significant Nixpkgs updates when its `staging` branch is merged. @@ -73,49 +88,52 @@ CI setups based on the Nix command line interface (almost all CIs) also behave this way. - - The recommended configuration format is now **JSON**, preferably generated using a configuration manager such as NixOS or nix-darwin.+- The recommended configuration format is now **JSON**, preferably generated using a configuration manager such as NixOS or nix-darwin. TOML is still supported, but does not support `null` in labels, and due to library limitations, it requires that intermediate tables be specified. See [the config file documentation](https://docs.hercules-ci.com/hercules-ci-agent/agent-config). - - `services.hercules-ci-agent` is now an alias for `services.hercules-ci-agents.""`, which still provides the same behavior as the old module.-- - Hardening flags have been applied to the NixOS module.-- - The effect sandbox now use the `crun` container runtime instead of `runc`.-- - Attribute sets containing a `_type` attribute are not scanned for derivations in `herculesCI.<...>.outputs`. This prevents accidental scanning of large or failing attribute trees, such as NixOS configurations. `nixosConfigurations` in Flakes are still built as usual, as they are not (verbatim) in the `herculesCI.<...>.outputs` attributes.--### Added+- `services.hercules-ci-agent` is now an alias for `services.hercules-ci-agents.""`, which still provides the same behavior as the old module. - - Effect mounts. Specify [`effectMountables`](https://docs.hercules-ci.com/hercules-ci-agent/agent-config.html#effectMountables) in the agent configuration, deploy, and [mount](https://docs.hercules-ci.com/hercules-ci-agent/effects/declaration.html#__hci_effect_mounts) them into an effect. This can be used for instance to expose the host's `/etc/hosts`, or hardware devices such as GPUs. Access is [controlled](https://docs.hercules-ci.com/hercules-ci-agent/agent-config.html#effectMountables-condition) by the agent configuration.+- Hardening flags have been applied to the NixOS module. - - New configuration option `remotePlatformsWithSameFeatures`, allowing a remote build to be used before more elaborate remote builder support is implemented.- The recommended method for running a cluster is still to install `hercules-ci-agent` on each machine, as that is more efficient and accurate.+- The effect sandbox now use the `crun` container runtime instead of `runc`. - - Agent [labels](https://docs.hercules-ci.com/hercules-ci-agent/agent-config.html#labels) can now be `null`, when using the JSON configuration format.+- Attribute sets containing a `_type` attribute are not scanned for derivations in `herculesCI.<...>.outputs`. This prevents accidental scanning of large or failing attribute trees, such as NixOS configurations. `nixosConfigurations` in Flakes are still built as usual, as they are not (verbatim) in the `herculesCI.<...>.outputs` attributes. ### Fixed - - Low level crash details are now reported in the log as expected.+- Low level crash details are now reported in the log as expected. - - An interaction between the Nix GC and threads has been fixed, solving such a crash.+- An interaction between the Nix GC and threads has been fixed, solving such a crash. ## [0.9.12] - 2023-06-28 ### Added - - Nix 2.16 support+- Nix 2.16 support - - Nix 2.15 support+- Nix 2.15 support ### Fixed - - Do not `chdir` the build worker. This functionality of the `process` package appears unreliable, but is not needed.+- Do not `chdir` the build worker. This functionality of the `process` package appears unreliable, but is not needed. ## [0.9.11] - 2023-03-06 -### BREAKING+### Added - - The `nix-darwin` module uses new user id and group id numbers, to match the upstream `nix-darwin` module.+- Nix verbosity can now be specified in the config file under the+ new attribute `nixVerbosity`.++- Cachix 1.3 support++- Nix 2.14 support++- Nix 2.13 support+++### Changed++- **Breaking:** The `nix-darwin` module uses new user id and group id numbers, to match the upstream `nix-darwin` module. The main benefit of the upstream change is that the agent user will not appear as a normal (human) user on the system. To migrate, run:@@ -138,82 +156,70 @@ ### Fixed - - Non-builder build errors such as output cycles are now reported+- Non-builder build errors such as output cycles are now reported in the build log. - - `ciSystems` is now taken into account by the default `onPush.default`+- `ciSystems` is now taken into account by the default `onPush.default` job when the `herculesCI` attribute of a flake is a function. - - `darwinConfigurations` is now filtered in accordance with `ciSystems`.---### Added-- - Nix verbosity can now be specified in the config file under the- new attribute `nixVerbosity`.-- - Cachix 1.3 support-- - Nix 2.14 support-- - Nix 2.13 support+- `darwinConfigurations` is now filtered in accordance with `ciSystems`. ## [0.9.10] - 2022-12-29 -### Fixed+### Added - - Detect stack overflows correctly in Nix evaluation+- Cachix 1.1 compatibility - - Retry errors from Nix-native (non-cachix) caches+### Changed -### Added+- Unwrap some error messages for readability - - Cachix 1.1 compatibility+### Fixed -### Changed+- Detect stack overflows correctly in Nix evaluation - - Unwrap some error messages for readability+- Retry errors from Nix-native (non-cachix) caches ## [0.9.9] - 2022-12-02 ### Fixed - - The flake `templates` check now allows filtered sources.+- The flake `templates` check now allows filtered sources. - - Tweaks to diagnostic messages+- Tweaks to diagnostic messages ## [0.9.8] - 2022-11-15 ### Added - - `herculesCI.onSchedule` jobs, which a created at set times. These can be used+- `herculesCI.onSchedule` jobs, which a created at set times. These can be used to automate work that doesn't start with a code change, such as automatic updates or impure periodic deployments. - - Secret types and the `GitToken` type, to be provided by the Hercules CI GitHub+- Secret types and the `GitToken` type, to be provided by the Hercules CI GitHub App. As of writing this requires a permission approval in the GitHub UI. This has to be initiated on the Hercules CI side. More on that very soon. - - More repository metadata in the `herculesCI` attribute; see [evaluation docs](https://docs.hercules-ci.com/hercules-ci-agent/evaluation/#param-herculesCI-primaryRepo).+- More repository metadata in the `herculesCI` attribute; see [evaluation docs](https://docs.hercules-ci.com/hercules-ci-agent/evaluation/#param-herculesCI-primaryRepo). ### Fixed - - Work around excessive stack use by libstdc++ regex [issue](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86164)+- Work around excessive stack use by libstdc++ regex [issue](https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86164) The new limit of 256 MiB stack allows larger string inputs to be used. This bug was triggered by purs-nix and possibly other Nix expression libraries that parse substantial files. - - Lift the agent-side restriction on the number of derivations in a job.+- Lift the agent-side restriction on the number of derivations in a job. ## [0.9.7] - 2022-07-21 ### Added - - Nix 2.10 support+- Nix 2.10 support ### Removed - - `-nix_2_7` variants. Nixpkgs has stopped offering older versions of Nix. If+- `-nix_2_7` variants. Nixpkgs has stopped offering older versions of Nix. If you need an older version, you could inject an older Nixpkgs into this flake using `hercules-ci-agent.inputs.nixpkgs.follows = ...`. @@ -221,34 +227,34 @@ ### Added - - Nix 2.9 support+- Nix 2.9 support ### Fixed - - NixOS module: keep main process running when worker triggers system OOM killer.- - Missing file in hackage sdist+- NixOS module: keep main process running when worker triggers system OOM killer.+- Missing file in hackage sdist ## [0.9.5] - 2022-05-17 ### Added - - Concurrent IFD, reducing evaluation wall clock time- - Nix 2.8.0 support- - Improved log contexts+- Concurrent IFD, reducing evaluation wall clock time+- Nix 2.8.0 support+- Improved log contexts +### Removed++- `hercules-ci-agent-nix_2_5` variant: upgrade to plain `hercules-ci-agent` (2.8.0) or `_nix_2_7`.+ ### Fixed - - Workaround for cachix#406 (add `login` to `netrc`)- - A crash in `inline-c-cpp` exception handling (`inline-c-cpp` update)- - Towards the error "Could not push logs within 10 minutes after completion"+- Workaround for cachix#406 (add `login` to `netrc`)+- A crash in `inline-c-cpp` exception handling (`inline-c-cpp` update)+- Towards the error "Could not push logs within 10 minutes after completion" - Add a timeout to prevent hang in case of a stuck handshake - Enforce log limit on client side as well in case of excessive log spam and an upload bottleneck -### Removed-- - `hercules-ci-agent-nix_2_5` variant: upgrade to plain `hercules-ci-agent` (2.8.0) or `_nix_2_7`.--## 0.9.4 - 2022-05-17+## [0.9.4] - 2022-05-17 Bad release. See 0.9.5 for changes. @@ -256,31 +262,31 @@ ### Added - - The evaluator now caches build statuses and ignores redundant rebuild requests, giving a significant performance boost to IFD-heavy jobs.+- The evaluator now caches build statuses and ignores redundant rebuild requests, giving a significant performance boost to IFD-heavy jobs. ### Fixed - - The branch name in flake-based jobs is now handled correctly when special characters are present.+- The branch name in flake-based jobs is now handled correctly when special characters are present. ## [0.9.2] - 2022-03-30 ### Added - - Separate traces in the dashboard (as in `--show-trace`)+- Separate traces in the dashboard (as in `--show-trace`) ### Fixed - - Effects: `error: cannot open connection to remote store 'daemon': error: reading from file: Connection reset by peer`+- Effects: `error: cannot open connection to remote store 'daemon': error: reading from file: Connection reset by peer` ## [0.9.1] - 2022-03-18 ### Added - - The built-in flake support now has the `sourceInfo` attributes.+- The built-in flake support now has the `sourceInfo` attributes. ### Changed - - Flakes are checked out by Nix rather than custom local checkout.+- Flakes are checked out by Nix rather than custom local checkout. ## [0.9.0] - 2022-03-15 @@ -288,60 +294,60 @@ ### Added - - Flakes support!+- Flakes support! Instead of needing a `ci.nix`, the agent will pick up `flake.nix` and look for the [`herculesCI`](https://docs.hercules-ci.com/hercules-ci-agent/evaluation/#_herculesci_value) attribute in the flake. Only the `outputs.effects` sub-attributes may define effects, making attacks on secrets harder to conceal. - - Multiple jobs per commit+- Multiple jobs per commit - - Jobs that run with the latest successful dependency build+- Jobs that run with the latest successful dependency build - - Conditions on secrets, disallowing access to secrets except when the conditions are met. This enforces the four eyes principle when branch protection is set up to match the secrets' conditions.+- Conditions on secrets, disallowing access to secrets except when the conditions are met. This enforces the four eyes principle when branch protection is set up to match the secrets' conditions. A missing `condition` field does not give a great error message for security reasons, so follow the [upgrade guide](https://docs.hercules-ci.com/hercules-ci/guides/upgrade-to-agent-0.9/). - - Hardening against rogue contributors. Trivial attacks trying to read system paths or secrets are no longer possible. Similar to typical CIs, secrets _can_ be stolen under specific circumstances: either a misconfiguration of branch protection or by approval of a second maintainer. Note that issue was already largely addressed by only processing contributions from GitHub users with write access to the repository, which also still applies.+- Hardening against rogue contributors. Trivial attacks trying to read system paths or secrets are no longer possible. Similar to typical CIs, secrets _can_ be stolen under specific circumstances: either a misconfiguration of branch protection or by approval of a second maintainer. Note that issue was already largely addressed by only processing contributions from GitHub users with write access to the repository, which also still applies. - - Built-in support for fetching private repositories and tarballs.+- Built-in support for fetching private repositories and tarballs. ### Changed - - File lookup order has changed, to support flakes. `ci.nix` or `nix/ci.nix` still take top priority, followed by `flake.nix`, followed by `default.nix`.+- File lookup order has changed, to support flakes. `ci.nix` or `nix/ci.nix` still take top priority, followed by `flake.nix`, followed by `default.nix`. - - Installed private repositories can now be read by a collaborator. If you need to enforce confidentiality across repositories, contact us and use a personal access token with appropriate permissions in the meanwhile.+- Installed private repositories can now be read by a collaborator. If you need to enforce confidentiality across repositories, contact us and use a personal access token with appropriate permissions in the meanwhile. -### Fixed+### Removed - - When the root of a `ci.nix` is a list, an error message is returned.+- Nix 2.3 support -### Removed+### Fixed - - Nix 2.3 support+- When the root of a `ci.nix` is a list, an error message is returned. ## [0.8.7] - 2022-03-09 ### Added - - Nix 2.7 support- - Haskell `aeson` 2.0 support+- Nix 2.7 support+- Haskell `aeson` 2.0 support ## [0.8.6] - 2022-03-07 -### Fixed+### Added - - Build with newer Nix versions 2.5, 2.6+- Improved conditional code support with `cabal-pkg-config-version-hook` -### Added+### Fixed - - Improved conditional code support with `cabal-pkg-config-version-hook`+- Build with newer Nix versions 2.5, 2.6 -## [0.8.5]+## [0.8.5] - 2022-01-21 ### Added - - The flake now has `.nixosModules.multi-agent-service` allowing multiple agents+- The flake now has `.nixosModules.multi-agent-service` allowing multiple agents to run on the same system. An instance with default settings can be enabled with `services.hercules-ci-agents."some-name" = {}`. User name and file paths are like the regular module, except replacing `hercules-ci-agent` by `hci-${name}` if the chosen `name` is not `""`.@@ -349,76 +355,76 @@ ### Fixed - - Fix mounting `/etc/resolv.conf`, work around runc#1523. Fixed by @Mic92 in #357+- Fix mounting `/etc/resolv.conf`, work around runc#1523. Fixed by @Mic92 in #357 - - An issue where a Nix evaluator crash could lead to builds being triggered in+- An issue where a Nix evaluator crash could lead to builds being triggered in the backend for which the derivation hadn't been pushed to the cache yet, causing needless build failures. #314 - - A build error caused by a moved symbol in `cachix >= 0.7`. #363+- A build error caused by a moved symbol in `cachix >= 0.7`. #363 - - A test that relied on `aeson` field order, which isn't stable. #352+- A test that relied on `aeson` field order, which isn't stable. #352 -## [0.8.4]+## [0.8.4] - 2021-11-17 ### Added - - The path to `secrets.json` is now configurable in the module or config file,+- The path to `secrets.json` is now configurable in the module or config file, using the `secretsJsonPath` setting, analogous to `clusterJoinTokenPath`. - - `aarch64-darwin` is now officially supported.+- `aarch64-darwin` is now officially supported. - - All module settings options will be visible in the NixOS documentation.+- All module settings options will be visible in the NixOS documentation. Some less-used settings were hidden, specifically the file path options that default to `staticSecretsDirectory + "/cluster-join-token.key"`, etc. ### Changed - - The flake packages and modules now link with Nix 2.4.+- The flake packages and modules now link with Nix 2.4. Nix 2.3 support is still available via `packages.${system}.hercules-ci-agent-nix_2_3`, but will be removed in agent 0.9.x. - - No longer patch Boehm GC, staying closer to regular Nix and the Nixpkgs build of the `hercules-ci-agent`.+- No longer patch Boehm GC, staying closer to regular Nix and the Nixpkgs build of the `hercules-ci-agent`. ### Fixed - - Various fixes related to the upgrade to Nix 2.4.+- Various fixes related to the upgrade to Nix 2.4. -## [0.8.3]+## [0.8.3] - 2021-09-06 ### Added - - `hci` can now run in the effects sandbox+- `hci` can now run in the effects sandbox ### Fixed - - Interrupt handling has been improved+- Interrupt handling has been improved -## [0.8.2]+## [0.8.2] - 2021-06-22 ### Added - - Preparations for the next Nix version+- Preparations for the next Nix version ### Fixed - - #304, `message:epollControl: invalid argument (Bad file descriptor)` in effect task+- #304, `message:epollControl: invalid argument (Bad file descriptor)` in effect task -## [0.8.1]+## [0.8.1] - 2021-04-21 ### Added - - Attach user-defined labels to the agent, for retrieval via the API.+- Attach user-defined labels to the agent, for retrieval via the API. ### Fixed - - Fix an issue where long-runnin nix methods weren't interrupted- - Fix error `mkdir /run/runc: permission denied`+- Fix an issue where long-runnin nix methods weren't interrupted+- Fix error `mkdir /run/runc: permission denied` -## [0.8.0]+## [0.8.0] - 2021-03-07 ### Added - - Hercules CI Effects, a new feature for running programs that interact with+- Hercules CI Effects, a new feature for running programs that interact with the real world, with useful features for continous deployment. - Effects only run after the build completes successfully@@ -436,7 +442,7 @@ - Secrets are configured locally on your agents, so you don't have to trust a third party with your cloud credentials - - Hercules CI Agent is now a flake. The highlights are+- Hercules CI Agent is now a flake. The highlights are - `nixosModules` overriding the NixOS-distributed module to the in-repo version - `agent-profile` for agent machines, or - `agent-service` for just the service definition@@ -444,12 +450,12 @@ - `hercules-ci-cli` the user command line interface - `hercules-ci-agent` for custom installation methods, etc - - The `hci` command (flake: `defaultApp`)+- The `hci` command (flake: `defaultApp`) - `hci login` to authenticate yourself - `hci state` to work with Effects state files - `hci effect` to run effects locally - - Commit metadata as a `ci.nix` argument. Make your `ci.nix` a function:+- Commit metadata as a `ci.nix` argument. Make your `ci.nix` a function: ```nix { src ? { ref = null; rev = null; }}:@@ -459,68 +465,53 @@ `src.ref` will have e.g. `refs/heads/master` and `rev` will have the git commit SHA. - - Shell derivations will only be built for their dependencies. Add a+- Shell derivations will only be built for their dependencies. Add a `mkShell`-based expression like you would add a derivation. This behavior can be requested explicitly for shells and non-shell derivations alike by appending ` // { buildDependenciesOnly = true; }` to the attribute definition. - - Attributes can now be marked to require or ignore a build failure in the+- Attributes can now be marked to require or ignore a build failure in the derivation it references directly. (see [support#34](https://github.com/hercules-ci/support/issues/34)) - - `concurrentTasks` now has a default, `"auto"` for ease of setup and to help+- `concurrentTasks` now has a default, `"auto"` for ease of setup and to help avoid underutilization. -### Fixed-- - The parent directory name will match the repo name [support#40](https://github.com/hercules-ci/support/issues/40)-- - Previously, lines from Nix's configured netrc file were ignored. Now they are appended to Hercules CI's netrc lines.- ### Changed - - Cachix caches without `signingKeys` will be pushed to, as part of the recently+- Cachix caches without `signingKeys` will be pushed to, as part of the recently introduced write token feature (Cachix-managed signing keys) +### Fixed -## [0.7.5] - 2020-11-27+- The parent directory name will match the repo name [support#40](https://github.com/hercules-ci/support/issues/40) -### Fixed+- Previously, lines from Nix's configured netrc file were ignored. Now they are appended to Hercules CI's netrc lines. - - GHC 8.10.2 compatibility for NixOS unstable / NixOS 21.03 - - Build with cachix 0.5.1. Write token support is not included due to a break configuration semantics. It will be available in >= 0.8.+## [0.7.5] - 2020-11-27 ### Changed - - The in-repo expressions have upgraded their dependency to NixOS 20.09-- - Agent will now use `HERCULES_CI_API_BASE_URL` over `HERCULES_API_BASE_URL` if set.+- The in-repo expressions have upgraded their dependency to NixOS 20.09 - - Temporarily switch to cabal tooling due to breakage. `master` continues to be stack-based.+- Agent will now use `HERCULES_CI_API_BASE_URL` over `HERCULES_API_BASE_URL` if set. -## [0.7.4] - 2020-08-25+- Temporarily switch to cabal tooling due to breakage. `master` continues to be stack-based. ### Fixed - - Paths that are missing from the binary cache will be rebuilt. This affected- agent 0.7 - 0.7.3 users with trusted user optimizations turned on, which is- the default when using the NixOS or nix-darwin modules.-- - Prevent states where no progress can be made. One caused by a potential buildup- of batched messages that may not fit within the timeout interval; the other- a receive operation without a timeout during the initial socket handshake.+- GHC 8.10.2 compatibility for NixOS unstable / NixOS 21.03 - - The log socket will remain open instead of reconnecting unnecessarily.+- Build with cachix 0.5.1. Write token support is not included due to a break configuration semantics. It will be available in >= 0.8. - - Add a safety measure to prevent unintended increases in workload in case- Nix sees an opportunity for concurrency that was not intended by Hercules CI.+## [0.7.4] - 2020-08-25 ### Changed - - The NixOS module in the hercules-ci-agent repo now disables the upcoming+- The NixOS module in the hercules-ci-agent repo now disables the upcoming module that is packaged upstream with NixOS. The upstream module will configure fewer things for you, to be in line with@@ -530,150 +521,163 @@ The configuration interface in the hercules-ci-agent repo will remain unchanged for `0.7` but `0.8` will match the upstream interface. +### Fixed++- Paths that are missing from the binary cache will be rebuilt. This affected+ agent 0.7 - 0.7.3 users with trusted user optimizations turned on, which is+ the default when using the NixOS or nix-darwin modules.++- Prevent states where no progress can be made. One caused by a potential buildup+ of batched messages that may not fit within the timeout interval; the other+ a receive operation without a timeout during the initial socket handshake.++- The log socket will remain open instead of reconnecting unnecessarily.++- Add a safety measure to prevent unintended increases in workload in case+ Nix sees an opportunity for concurrency that was not intended by Hercules CI.+ ## [0.7.3] - 2020-07-18 ### Added - - Evaluation log+- Evaluation log - - Configurable log level via config file or `extraOptions`+- Configurable log level via config file or `extraOptions` ### Changed - - Default log level is `InfoS` rather than `DebugS`+- Default log level is `InfoS` rather than `DebugS` ## [0.7.2] - 2020-06-18 ### Changed - - cachix: 0.3.7 -> 0.3.8. Improves reliability through better retries and improves error reporting+- cachix: 0.3.7 -> 0.3.8. Improves reliability through better retries and improves error reporting ## [0.7.1] - 2020-06-17 ### Added - - Push to any nix store, including S3, using the `NixCache` kind in `binary-caches.json`+- Push to any nix store, including S3, using the `NixCache` kind in `binary-caches.json` ### Changed - - Switch to Nixpkgs 20.03+- Switch to Nixpkgs 20.03 - - Environment variables are now passed on to evaluation and build by default. This allows configuration to be passed to Nix without intervention from hercules-ci-agent.+- Environment variables are now passed on to evaluation and build by default. This allows configuration to be passed to Nix without intervention from hercules-ci-agent. - - `trusted-user` is not a requirement and is configured automatically when using the NixOS module or nix-darwin module.+- `trusted-user` is not a requirement and is configured automatically when using the NixOS module or nix-darwin module. ### Fixed - - Agent will now reset its connection with hercules-ci.com when pings are not acknowledged in time.+- Agent will now reset its connection with hercules-ci.com when pings are not acknowledged in time. - - Prevent running out of file descriptors by increasing the soft limit if possible.+- Prevent running out of file descriptors by increasing the soft limit if possible. ## [0.7.0] - 2020-05-05 -### Known issues-- - Agent process user must be in `trusted-users`. This is the case with the NixOS and nix-darwin module. Doing so is recommended for ease of use and performance but should not be a requirement.+**Known issue:** Agent process user must be in `trusted-users`. This is the case with the NixOS and nix-darwin module. Doing so is recommended for ease of use and performance but should not be a requirement. ### Added - - Jobs can be cancelled+- Jobs can be cancelled - - Build logs are streamed in realtime+- Build logs are streamed in realtime - - The build log now has timestamps and color+- The build log now has timestamps and color - - Distributed builds performance has improved by fetching fewer derivations+- Distributed builds performance has improved by fetching fewer derivations ### Fixed - - Extra nix options were not passed to the build process+- Extra nix options were not passed to the build process ## [0.6.6] - 2020-03-16 ### Fixed - - NixOS, nix-darwin modules: check the `nix-daemon` source and add option to patch an in-memory cache expiry issue+- NixOS, nix-darwin modules: check the `nix-daemon` source and add option to patch an in-memory cache expiry issue causing errors in build clusters (of more than 1 machine). The module asks for confirmation. - - **Manual action:** if you are not using the provided module and you run the agent on+- **Manual action:** if you are not using the provided module and you run the agent on more than one machine, and you use `nix-daemon`, to fix above issue, you need to: - either upgrade your system's Nix to a recent `master` or version 2.4.0 when released, - or apply this patch to your system's Nix installation: https://github.com/NixOS/nix/pull/3405 - - Cachix: 0.3.5 -> [0.3.7](https://github.com/cachix/cachix/blob/master/cachix/CHANGELOG.md#037---2020-03-12) to prevent uploading bad NARs in rare cases.+- Cachix: 0.3.5 -> [0.3.7](https://github.com/cachix/cachix/blob/master/cachix/CHANGELOG.md#037---2020-03-12) to prevent uploading bad NARs in rare cases. ## [0.6.5] - 2020-03-07 -### Fixed+### Added - - Work around a systemd behavior where it didn't restart the unit+- `--test-configuration` flag to validate the configuration without actually running the agent. -### Added+### Fixed - - `--test-configuration` flag to validate the configuration without actually running the agent.+- Work around a systemd behavior where it didn't restart the unit ## [0.6.4] - 2020-03-06 -### Fixed+### Added - - Fix a bug blocking evaluation when a store path is removed from cache or cache configuration is changed.+- Cached builds to speed up `aarch64-linux` agent deployments. -### Added+### Fixed - - Cached builds to speed up `aarch64-linux` agent deployments.+- Fix a bug blocking evaluation when a store path is removed from cache or cache configuration is changed. -### [0.6.3] - 2020-02-19+## [0.6.3] - 2020-02-19 ### Fixed - - Fix a concurrency problem causing not all evaluation events to be written to server when evaluation fails.+- Fix a concurrency problem causing not all evaluation events to be written to server when evaluation fails. - - Fix evaluation errors triggered by build outputs go missing from cache, by requesting a forced rebuild.+- Fix evaluation errors triggered by build outputs go missing from cache, by requesting a forced rebuild. - - Fix blocked shutdown on NixOS, fix agent status in dashboard, by stopping agent before network shutdown #195.+- Fix blocked shutdown on NixOS, fix agent status in dashboard, by stopping agent before network shutdown #195. - - Fix upload of large outputs by using the correct http client manager for Cachix, removing a timeout.+- Fix upload of large outputs by using the correct http client manager for Cachix, removing a timeout. ### Changed - - Agent will now try to verify that the nix-daemon has narinfo-cache-negative-ttl = 0. This is required for correct operation.+- Agent will now try to verify that the nix-daemon has narinfo-cache-negative-ttl = 0. This is required for correct operation. -### [0.6.2] - 2020-01-30+## [0.6.2] - 2020-01-30 ### Fixed - - Update cachix to support the API change for the new CDN. This update is+- Update cachix to support the API change for the new CDN. This update is required for uploading sources and compressed outputs over 100MB in size. Please update. -### [0.6.1] - 2019-11-06+## [0.6.1] - 2019-11-06 ### Fixed - - Fix token leak to system log when reporting an HTTP exception. This was introduced by a library upgrade.+- Fix token leak to system log when reporting an HTTP exception. This was introduced by a library upgrade. This was discovered after tagging 0.6.0 but before the release was announced and before moving of the `stable` branch. Only users of the `hercules-ci-agent` `master` branch and the unannounced tag were exposed to this leak. We recommend to follow the `stable` branch. - - Temporarily revert a Nix GC configuration change that might cause problems+- Temporarily revert a Nix GC configuration change that might cause problems until agent gc root behavior is improved. -### [0.6.0] - 2019-11-04+## [0.6.0] - 2019-11-04 ### Changed - - Switch to Nix 2.3 and NixOS 19.09. *You should update your deployment to reflect the NixOS upgrade*, unless you're using terraform or nix-darwin, where it's automatic.- - Increased parallellism during push to cachix- - Switch to NixOS 19.09- - Enable min-free/max-free Nix GC+- Switch to Nix 2.3 and NixOS 19.09. *You should update your deployment to reflect the NixOS upgrade*, unless you're using terraform or nix-darwin, where it's automatic.+- Increased parallellism during push to cachix+- Switch to NixOS 19.09+- Enable min-free/max-free Nix GC ### Fixed - - Transient errors during source code fetching are now retried- - Fixed a bug related to narinfo caching in the context of IFD- - Fixed an exception when the root of ci.nix is a list, although lists are unsupported+- Transient errors during source code fetching are now retried+- Fixed a bug related to narinfo caching in the context of IFD+- Fixed an exception when the root of ci.nix is a list, although lists are unsupported ## [0.5.0] - 2019-10-01 @@ -697,7 +701,7 @@ ### Fixed - - The agent will now actually auto-restart when the secrets files change.+- The agent will now actually auto-restart when the secrets files change. ## [0.4.0] - 2019-08-30@@ -721,7 +725,7 @@ - Bump Cachix to fix a few bugs (errors with too many derivations, performance fixes, etc.) - - Modern BoehmGC initial settings for Nix memory limits +- Modern BoehmGC initial settings for Nix memory limits ## [0.3.2] - 2019-08-11 @@ -755,6 +759,20 @@ ## [0.3.0] - 2019-07-05 +### Added++- Added Cachix support, for multi-agent and multi-platform support++- Report derivation outputs with their size and hashes++- Added Darwin support via nix-darwin++- Support `requiredFeatures` attribute on derivations++- Hello and hearthbeat protocol, which will allow the+ service to be aware of how the agent is configured and+ when it's online.+ ### Changed - Configuration of the agent is now done via `--config agent.toml`@@ -776,20 +794,6 @@ - Added retries to status reporting to fix potential inconsistencies on the service -### Added--- Added Cachix support, for multi-agent and multi-platform support--- Report derivation outputs with their size and hashes--- Added Darwin support via nix-darwin--- Support `requiredFeatures` attribute on derivations--- Hello and hearthbeat protocol, which will allow the- service to be aware of how the agent is configured and- when it's online.- ## [0.2] - 2019-05-14 - use [gitignore] instead of [nix-gitignore]@@ -806,7 +810,7 @@ - Support ci.nix or nix/ci.nix along with default.nix -## 0.1.0.0 - 2019-03-28+## [0.1.0.0] - 2019-03-28 - Initial release @@ -827,6 +831,7 @@ [0.9.6]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.9.5...hercules-ci-agent-0.9.6 [0.9.5]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.9.3...hercules-ci-agent-0.9.5 [0.9.3]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.9.2...hercules-ci-agent-0.9.3+[0.9.4]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.9.3...hercules-ci-agent-0.9.4 [0.9.2]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.9.1...hercules-ci-agent-0.9.2 [0.9.1]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.9.0...hercules-ci-agent-0.9.1 [0.9.0]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.8.7...hercules-ci-agent-0.9.0@@ -843,6 +848,7 @@ [0.7.3]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.7.2...hercules-ci-agent-0.7.3 [0.7.2]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.7.1...hercules-ci-agent-0.7.2 [0.7.1]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.6.6...hercules-ci-agent-0.7.1+[0.7.0]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.6.6...hercules-ci-agent-0.7.0 [0.6.6]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.6.5...hercules-ci-agent-0.6.6 [0.6.5]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.6.4...hercules-ci-agent-0.6.5 [0.6.4]: https://github.com/hercules-ci/hercules-ci-agent/compare/hercules-ci-agent-0.6.3...hercules-ci-agent-0.6.4
cbits/hercules-aliases.h view
@@ -22,4 +22,25 @@ typedef nix::DerivationOutputs::iterator DerivationOutputsIterator; typedef nix::StringPairs::iterator StringPairsIterator; +#if NIX_IS_AT_LEAST(2, 34, 0)+#include "HaskellException.hxx"+#include <nix/expr/eval-error.hh>++/* Exception thrown by the builder callback into the evaluator.+ *+ * Nix >= 2.34 caches evaluation failures in thunks ("tFailed"). Deriving+ * from nix::RecoverableEvalError gives the failed thunk a recovery value,+ * so that forcing it again re-evaluates it, re-entering the builder+ * callback, needed for resuming non-blocking IFD.+ */+class HerculesBuilderException : public HaskellException, public nix::RecoverableEvalError+{+public:+ HerculesBuilderException(nix::EvalState & state, const std::string & renderedException, void *stablePtr)+ : HaskellException(renderedException, stablePtr)+ , nix::RecoverableEvalError(state, "%s", renderedException)+ {}+};+#endif+ using namespace std;
cbits/nix-2.4/hercules-store.cxx view
@@ -15,6 +15,10 @@ using namespace nix; +#if NIX_IS_AT_LEAST(2, 35, 0)+void WrappingStore::anchor() {}+#endif+ #if NIX_IS_AT_LEAST(2, 29, 0) WrappingStore::WrappingStore(ref<Store> storeToWrap) : Store(storeToWrap->config), wrappedStore(storeToWrap) {}@@ -50,7 +54,13 @@ auto callbackPtr = std::make_shared<decltype(callback)>(std::move(callback)); wrappedStore->queryPathInfo(path, {[=](std::future<ref<const ValidPathInfo>> vpi){- (*callbackPtr)(vpi.get().get_ptr());+ try {+ (*callbackPtr)(vpi.get().get_ptr());+ } catch (...) {+ // Must not let exceptions (e.g. InvalidPath) escape this noexcept+ // context; pass them to the caller through the callback instead.+ callbackPtr->rethrow();+ } }}); } @@ -146,10 +156,17 @@ return wrappedStore->getFSAccessor(requireValidPath); } +#if NIX_IS_AT_LEAST(2, 34, 0) void WrappingStore::addSignatures(const StorePath& storePath,+ const std::set<Signature>& sigs) {+ wrappedStore->addSignatures(storePath, sigs);+};+#else+void WrappingStore::addSignatures(const StorePath& storePath, const StringSet& sigs) { wrappedStore->addSignatures(storePath, sigs); };+#endif void WrappingStore::computeFSClosure(const StorePathSet& paths, StorePathSet& out,@@ -267,6 +284,10 @@ #endif void HerculesStore::buildPaths(const std::vector<DerivedPath> & derivedPaths, BuildMode buildMode, std::shared_ptr<Store> evalStore) {+ if (builderCallback == nullptr) {+ throw nix::Error("HerculesStore: builder callback is not set; this is a bug in hercules-ci-agent");+ }+ std::exception_ptr exceptionToThrow(nullptr); // responsibility for delete is transferred to builderCallback
cbits/nix-2.4/hercules-store.hh view
@@ -15,6 +15,11 @@ using namespace nix; class WrappingStore : public Store {+#if NIX_IS_AT_LEAST(2, 35, 0)+ /* VTable anchor, required by nix::Store; see its declaration there. */+ void anchor() override;+#endif+ public: ref<Store> wrappedStore; @@ -105,7 +110,11 @@ virtual std::shared_ptr<SourceAccessor> getFSAccessor(const StorePath & path, bool requireValidPath = true) override; #endif +#if NIX_IS_AT_LEAST(2, 34, 0)+ virtual void addSignatures(const StorePath & storePath, const std::set<Signature> & sigs) override;+#else virtual void addSignatures(const StorePath & storePath, const StringSet & sigs) override;+#endif virtual void computeFSClosure(const StorePathSet & paths, StorePathSet & out, bool flipDirection = false,@@ -135,7 +144,8 @@ class HerculesStore final : public WrappingStore { public: StorePathSet ensuredPaths;- void (* builderCallback)(std::vector<nix::StorePathWithOutputs>*, std::exception_ptr *exceptionToThrow);+ // Set during evaluation; see setBuilderCallback.+ void (* builderCallback)(std::vector<nix::StorePathWithOutputs>*, std::exception_ptr *exceptionToThrow) = nullptr; HerculesStore(ref<Store> storeToWrap);
hercules-ci-agent-worker/Hercules/Agent/Worker.hs view
@@ -33,7 +33,7 @@ import Hercules.Agent.Worker.Env qualified import Hercules.Agent.Worker.Error (ExceptionText (exceptionTextMessage), exceptionTextMessage, renderException) import Hercules.Agent.Worker.Evaluate (runEval)-import Hercules.Agent.Worker.HerculesStore (setBuilderCallback, withHerculesStore)+import Hercules.Agent.Worker.HerculesStore (withHerculesStore) import Hercules.Agent.Worker.Logging (withKatip) import Hercules.Agent.WorkerProtocol.Command ( Command,@@ -147,7 +147,6 @@ drvOutputSubstituteAsyncs_ <- newTVarIO mempty drvsInProgress_ <- newIORef mempty withStore $ \wrappedStore_ -> withHerculesStore wrappedStore_ $ \herculesStore_ -> withKatip' do- liftIO $ setBuilderCallback herculesStore_ mempty let st = HerculesState { drvsCompleted = drvsCompleted_,
hercules-ci-agent-worker/Hercules/Agent/Worker/Build/Logger.hs view
@@ -3,6 +3,9 @@ {-# LANGUAGE NumericUnderscores #-} {-# LANGUAGE QuasiQuotes #-} {-# LANGUAGE TemplateHaskell #-}+#ifdef __GHCIDE__+# define NIX_IS_AT_LEAST(mm,m,p) 1+#endif module Hercules.Agent.Worker.Build.Logger ( initLogger,@@ -45,15 +48,22 @@ C.using "namespace hercules_ci_cnix" +{- ORMOLU_DISABLE -} initLogger :: IO () initLogger = [C.throwBlock| void {+#if NIX_IS_AT_LEAST(2, 35, 0)+ nix::logger = new HerculesLogger();+ herculesLogger = dynamic_cast<HerculesLogger *>(nix::logger);+#else nix::logger = std::make_unique<HerculesLogger>(); herculesLogger = dynamic_cast<HerculesLogger *>(nix::logger.get());+#endif if (herculesLogger == nullptr) { throw std::runtime_error("Failed to cast logger to HerculesLogger"); } }|]+{- ORMOLU_ENABLE -} popMany :: IO (Vector LogEntry) popMany =
hercules-ci-agent-worker/Hercules/Agent/Worker/Build/Prefetched.hs view
@@ -312,8 +312,13 @@ success = successPtr != nullptr; if (failurePtr) {- printError(failurePtr->errorMsg);- errorMessage = stringdup(failurePtr->errorMsg);+#if NIX_IS_AT_LEAST(2, 34, 0)+ const std::string & failureErrorMsg = failurePtr->msg();+#else+ const std::string & failureErrorMsg = failurePtr->errorMsg;+#endif+ printError(failureErrorMsg);+ errorMessage = stringdup(failureErrorMsg); } else { errorMessage = stringdup(""); }
hercules-ci-agent-worker/Hercules/Agent/Worker/Evaluate.hs view
@@ -177,7 +177,7 @@ isNonBlocking <- liftIO (newIORef False) - liftIO . setBuilderCallback hStore $+ builderCallback <- pure $ traverseSPWOs $ \storePathWithOutputs -> unlift $ do drvStorePath <- liftIO $ getStorePath storePathWithOutputs drvPath <- liftIO $ CNix.storePathToPath store drvStorePath@@ -232,6 +232,9 @@ maybeThrowBuildException result drvStorePath clearSubstituterCaches clearPathInfoCache store+ -- The wrapped store caches negative path info lookups+ -- independently; clear it so the built output is seen.+ clearPathInfoCache (wrappedStore st) ensurePath (wrappedStore st) outputPath `catch` \(_e1 :: SomeException) -> do st.sendEvents $ pure $ Event.Build drvPath (decode outputName) (Just attempt0) doBlock @@ -246,6 +249,7 @@ maybeThrowBuildException result' drvStorePath clearSubstituterCaches clearPathInfoCache store+ clearPathInfoCache (wrappedStore st) ensurePath (wrappedStore st) outputPath `catch` \e2 -> liftIO $ throwBuildError@@ -264,6 +268,7 @@ else void $ wait buildAsync withEvalStateConduit store $ \evalState -> do+ liftIO $ setBuilderCallback hStore evalState builderCallback let evalEnv :: EvalEnv evalEnv = EvalEnv
hercules-ci-agent-worker/Hercules/Agent/Worker/HerculesStore.hs view
@@ -1,6 +1,9 @@ {-# LANGUAGE CPP #-} {-# LANGUAGE QuasiQuotes #-} {-# LANGUAGE TemplateHaskell #-}+#ifdef __GHCIDE__+# define NIX_IS_AT_LEAST(mm,m,p) 1+#endif module Hercules.Agent.Worker.HerculesStore ( withHerculesStore,@@ -24,7 +27,7 @@ ) import Hercules.CNix.Encapsulation (moveToForeignPtrWrapper) import Hercules.CNix.Expr (Store (Store))-import Hercules.CNix.Expr.Context (NixStorePathWithOutputs)+import Hercules.CNix.Expr.Context (EvalState, NixStorePathWithOutputs) import Hercules.CNix.Std.Vector (CStdVector, StdVector) import Hercules.CNix.Store.Context (Ref) import Language.C.Inline.Cpp qualified as C@@ -64,20 +67,38 @@ (*$(refHerculesStore* s))->printDiagnostics(); }|] +{- ORMOLU_DISABLE -}+ -- TODO catch pure exceptions from displayException-setBuilderCallback :: Ptr (Ref HerculesStore) -> (StdVector NixStorePathWithOutputs -> IO ()) -> IO ()-setBuilderCallback s callback = do++-- | Set the callback that is invoked when the evaluator requests a build.+--+-- The 'EvalState' is referenced by the exception the callback throws into+-- the evaluator: on Nix >= 2.34 the exception must be recoverable, so that+-- the interrupted attribute can be re-evaluated after its realisation+-- completes. It must remain valid for as long as the callback can be+-- invoked, i.e. for the duration of the evaluation.+setBuilderCallback :: Ptr (Ref HerculesStore) -> Ptr EvalState -> (StdVector NixStorePathWithOutputs -> IO ()) -> IO ()+setBuilderCallback s evalState callback = do p <- mkBuilderCallback $ \sp exceptionToThrowPtr -> Control.Exception.catch (callback =<< moveToForeignPtrWrapper sp) $ \e -> withCString (displayException (e :: SomeException)) $ \renderedException -> do stablePtr <- castStablePtrToPtr <$> newStablePtr e [C.block| void {+#if NIX_IS_AT_LEAST(2, 34, 0)+ nix::EvalState *evalState = $(EvalState *evalState);+ assert(evalState);+ (*$(exception_ptr *exceptionToThrowPtr)) = std::make_exception_ptr(HerculesBuilderException(*evalState, std::string($(const char* renderedException)), $(void* stablePtr)));+#else+ (void) $(EvalState *evalState); (*$(exception_ptr *exceptionToThrowPtr)) = std::make_exception_ptr(HaskellException(std::string($(const char* renderedException)), $(void* stablePtr)));+#endif }|] [C.throwBlock| void { (*$(refHerculesStore* s))->setBuilderCallback($(void (*p)(std::vector<nix::StorePathWithOutputs>*, exception_ptr *))); }|]+{- ORMOLU_ENABLE -} type BuilderCallback = Ptr (CStdVector NixStorePathWithOutputs) -> Ptr ExceptionPtr -> IO ()
hercules-ci-agent-worker/Hercules/Agent/Worker/HerculesStore/Context.hs view
@@ -10,7 +10,7 @@ where import Data.Map qualified as M-import Hercules.CNix.Expr.Context (Ref)+import Hercules.CNix.Expr.Context (Ref, evalContext) import Hercules.CNix.Std.Vector (stdVectorCtx) import Hercules.CNix.Store.Context qualified as Store import Language.C.Inline.Context qualified as C@@ -29,6 +29,7 @@ <> C.bsCtx <> stdVectorCtx <> Store.context+ <> evalContext <> herculesStoreContext (=:) :: k -> a -> Map k a
hercules-ci-agent.cabal view
@@ -1,7 +1,7 @@ cabal-version: 2.4 name: hercules-ci-agent-version: 0.10.8+version: 0.10.9 synopsis: Runs Continuous Integration tasks on your machines category: Nix, CI, Testing, DevOps homepage: https://docs.hercules-ci.com@@ -398,11 +398,11 @@ , uuid , vector pkgconfig-depends:- nix-store >= 2.28 && < 2.34- , nix-expr >= 2.28 && < 2.34- , nix-flake >= 2.28 && < 2.34+ nix-store >= 2.28 && < 2.36+ , nix-expr >= 2.28 && < 2.36+ , nix-flake >= 2.28 && < 2.36 -- TODO: replace stack overflow detection and remove nix-main- , nix-main >= 2.28 && < 2.34+ , nix-main >= 2.28 && < 2.36 default-language: Haskell2010 test-suite hercules-ci-agent-unit-tests@@ -493,5 +493,5 @@ main-is: hercules-ci-nix-daemon/daemon.cxx default-language: Haskell2010 pkgconfig-depends:- nix-store >= 2.28 && < 2.34- , nix-main >= 2.28 && < 2.34+ nix-store >= 2.28 && < 2.36+ , nix-main >= 2.28 && < 2.36