Skip to content

Comments

electron_32-bin: mark as insecure because it's EOL, electron-source.electron_32: remove as it's EOL#383660

Merged
emilylange merged 2 commits intoNixOS:masterfrom
emilylange:electron_32-EOL
Mar 7, 2025
Merged

electron_32-bin: mark as insecure because it's EOL, electron-source.electron_32: remove as it's EOL#383660
emilylange merged 2 commits intoNixOS:masterfrom
emilylange:electron_32-EOL

Conversation

@emilylange
Copy link
Member

@emilylange emilylange commented Feb 20, 2025

Previously:

electron_32 will be EOL in two weeks (2025-03-04).

https://www.electronjs.org/docs/latest/tutorial/electron-timelines (permalink)

This PR removes the source build on Linux for electron 32 and marks the binary variants for Darwin and Linux as insecure.
electron_32 will still be available for an undetermined while. Linux will simply use the binary package instead of the source build, just like Darwin.

After this PR has been merged, users will be able opt-into the EOL version of electron as outlined by this eval error message:

# nix-instantiate -A electron_32
error:
       … in the condition of the assert statement
         at ./lib/customisation.nix:419:9:
          418|       drvPath =
          419|         assert condition;
             |         ^
          420|         drv.drvPath;while evaluating the attribute 'handled'
         at ./pkgs/stdenv/generic/check-meta.nix:507:7:
          506|       # or, alternatively, just output a warning message.
          507|       handled =
             |       ^
          508|         (

       (stack trace truncated; use '--show-trace' to show the full trace)

       error: Package ‘electron-32.3.1’ in ./pkgs/development/tools/electron/binary/generic.nix:37 is marked as insecure, refusing to evaluate.


       Known issues:
        - Electron version 32.3.1 is EOL

       You can install it anyway by allowing this package, using the
       following methods:

       a) To temporarily allow all insecure packages, you can use an environment
          variable for a single invocation of the nix tools:

            $ export NIXPKGS_ALLOW_INSECURE=1

          Note: When using `nix shell`, `nix build`, `nix develop`, etc with a flake,
                then pass `--impure` in order to allow use of environment variables.

       b) for `nixos-rebuild` you can add ‘electron-32.3.1’ to
          `nixpkgs.config.permittedInsecurePackages` in the configuration.nix,
          like so:

            {
              nixpkgs.config.permittedInsecurePackages = [
                "electron-32.3.1"
              ];
            }

       c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
          ‘electron-32.3.1’ to `permittedInsecurePackages` in
          ~/.config/nixpkgs/config.nix, like so:

            {
              permittedInsecurePackages = [
                "electron-32.3.1"
              ];
            }

The following packages are affected by this. Note that those package will continue to work, but users will be presented with the eval error above and have to opt-in.
If you are pinged as one of the maintainers of such package, you can do one of the following:

  1. Check if upstream supports a newer electron version and open a PR in nixpkgs to use that instead OR
  2. Try using a newer electron version than upstream suggests and if that turns out to be stable, open a PR in nixpkgs to use that instead OR
  3. Do nothing in nixpkgs, and maybe make upstream aware that their electron version is EOL.

Things done

  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux
    • x86_64-darwin
    • aarch64-darwin
  • For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
    • sandbox = relaxed
    • sandbox = true
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
  • Fits CONTRIBUTING.md.

@emilylange emilylange added 1.severity: security Issues which raise a security issue, or PRs that fix one 9.needs: port to stable A PR needs a backport to the stable release. labels Feb 20, 2025
@github-actions github-actions bot added 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux. labels Feb 20, 2025
Copy link
Member

@teutat3s teutat3s left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@teutat3s teutat3s added 12.approvals: 1 This PR was reviewed and approved by one person. 12.approved-by: package-maintainer This PR was reviewed and approved by a maintainer listed in any of the changed packages. labels Mar 5, 2025
@emilylange emilylange force-pushed the electron_32-EOL branch 2 times, most recently from 20d0359 to b4561d0 Compare March 6, 2025 12:27
@emilylange emilylange merged commit 3995e03 into NixOS:master Mar 7, 2025
27 checks passed
@emilylange emilylange deleted the electron_32-EOL branch March 7, 2025 10:19
teutat3s added a commit to teutat3s/nixpkgs that referenced this pull request Mar 8, 2025
This patch is no longer needed, because we don't build electron 32 from
source anymore since NixOS#383660.
yuyuyureka pushed a commit that referenced this pull request Mar 12, 2025
This patch is no longer needed, because we don't build electron 32 from
source anymore since #383660.
sandptel pushed a commit to sandptel/nixpkgs that referenced this pull request Mar 13, 2025
This patch is no longer needed, because we don't build electron 32 from
source anymore since NixOS#383660.
@mdaniels5757 mdaniels5757 added 8.has: port to stable This PR already has a backport to the stable release. and removed 9.needs: port to stable A PR needs a backport to the stable release. labels Jun 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

1.severity: security Issues which raise a security issue, or PRs that fix one 8.has: port to stable This PR already has a backport to the stable release. 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin. 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux. 12.approvals: 1 This PR was reviewed and approved by one person. 12.approved-by: package-maintainer This PR was reviewed and approved by a maintainer listed in any of the changed packages.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants