Repository navigation
nix: add fixed-output package derivation - #13076
Ansh-Sonkusare wants to merge 9 commits into
Conversation
Add a Nix flake and derivation so Nix/NixOS users can install OmniRoute with `nix profile install github:diegosouzapw/OmniRoute`. Uses a fixed-output derivation instead of buildNpmPackage: upstream package-lock.json references workspace packages (@omniroute/browser-pool, open-sse, packages/browser-pool) that `npm ci --offline` cannot resolve inside the Nix build sandbox. The FOD runs `npm install -g omniroute@<v>` with network access and pins reproducibility via outputHash. Closes cheaper-inference#13075
|
Thanks — this is a clean, idiomatic fixed-output derivation for the workspace-lockfile |
diegosouzapw
added
the
hold-vps
Ran the real `nix build .#default` on x86_64-linux, which the original derivation would have failed: - The pinned outputHash was wrong (got sha256-FV/hBAt... vs the pinned value). - The FOD ran fixupPhase and wrapProgram, which patched shebangs to /nix/store bash paths. That made the hash depend on the nixpkgs bash version and adds store references a fixed-output derivation must not have. - The published tarball ships no lockfile, so transitive dependencies floated to whatever was newest at build time and would drift the hash. - The npm tree has platform-specific binaries (sharp, @next/swc, esbuild), so a single hash cannot be valid for the linux and darwin platforms that were advertised. Split into two stages: a network FOD that only runs `npm install -g` with fixup disabled and `--before=<publishedAt>` to pin resolution, and a normal derivation that wraps the bins with the matching Node.js without copying the multi-GB tree. Hashes are now per system; only x86_64-linux is listed. Verified on x86_64-linux: `nix build .#default` succeeds, `omniroute --version` and `--help` work, the server starts from the read-only store, login and password/settings changes work and persist across a restart, and `nix build --rebuild` reproduces the same hash. Stays on 3.8.50: omniroute@3.8.51 is not published to npm yet.
Restore the original flake.nix description and the whitespace line in shellHook so the flake.nix diff is only the new `packages` outputs. Replace the unverified "350+ providers, 1200+ models" package description with wording taken from AGENTS.md, and reduce the README note to the one user-facing fact (x86_64-linux only), matching the neighbouring install sections.
The npm version changes what `npm install -g` produces, so it is part of the fixed-output hash. Build the package with nodejs_24 (npm 11), matching the dev shell fix proposed in cheaper-inference#14613, and recompute the hash: the Node 22 hash no longer matches under npm 11. Only the package is pinned. The shared `nodejs` binding used by the dev shell is left untouched so this does not conflict with cheaper-inference#14613. Verified on x86_64-linux with Node 24.16.0: `nix build .#default` succeeds, the server starts from the store, and login plus password and settings changes work and persist across a restart.
8b4e3fc to
777e867
Compare
Replace the fixed-output `npm install -g` with `buildNpmPackage` and `importNpmLock`. A global install ignores the manifest's `overrides`, so the old package shipped adm-zip 0.5.18 against the ^0.6.0 pin. This build applies all 33 overrides. `nix/package.json` is the published manifest minus `workspaces` and `devDependencies`. The dev tools' nested overrides pin conflicting versions (undici, js-yaml), which makes npm ask the registry for metadata and fail offline. `nix/package-lock.json` is generated from it. There is no output hash to maintain: dependencies are fetched by their lockfile integrity and the tarball hash is npm's `dist.integrity`. `scripts/release/update-nix-package.mjs` updates all three after an npm release and needs only npm.
|
Ran the real build: On the bump: I also moved the package off the fixed-output Could the Nix bump go into each npm release? After publishing: It needs npm only, no Nix. It regenerates |
diegosouzapw
added
the
deferred-v3.8.52
diegosouzapw
changed the title
|
Re-homed to |
…in the updater npm 12 wraps `npm view --json` in an array even for an exact version and prints `npm pack --json` as an object keyed by package name, so the updater failed with 'has no sha512 integrity' before touching any file. Accept both shapes, then regenerate nix/package.json, nix/package-lock.json and the tarball hash for the now-published 3.8.51.
diegosouzapw
removed
the
deferred-v3.8.52
diegosouzapw
changed the title
…ckage structure The CLI's serve paths spawn a bare "node" and its runtime installer calls npm, neither of which a NixOS user has on PATH. Wrap every bin from buildNpmPackage with wrapProgram --prefix PATH so the pinned nodejs (node + npm) is always found, leaving the lib/node_modules layout untouched. Add a node:test structural guard for flake.nix, nix/* and the updater script: the buildNpmPackage + importNpmLock approach, the Node 24 pin, the PATH wrapper, manifest / lockfile / tarball-hash consistency, offline-resolvable lock entries, the better-sqlite3 prebuilt (no install script), the adm-zip override and the shell-free updater. nix build itself is not run by this test. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>
|
Hi @Ansh-Sonkusare — closing this pull request to clear the open queue. The branch |
|
Hi @Ansh-Sonkusare — reopening this pull request. The close was a mistake, and it is back in the merge queue. The branch |
|
Re-homed to |
|
Thanks @Ansh-Sonkusare, the move to buildNpmPackage + importNpmLock with a generated lockfile is the right call, and the structural tests (9/9 green on my side against the current release tip) pin the decisions that bit you earlier. Before we land it: (1) please run scripts/release/update-nix-package.mjs against the latest published version (3.8.52 on npm now, 3.8.53 soon), since nix/package.json is still pinned to 3.8.51; (2) please run |
Regenerated with scripts/release/update-nix-package.mjs 3.8.52 (npm 12.0.2): nix/package.json is the 3.8.52 manifest minus workspaces/devDependencies, nix/package-lock.json is re-resolved with --before=<publish time> and passes the offline npm ci dry run, and the tarball hash in nix/omniroute.nix is the registry sha512 integrity of omniroute@3.8.52. Adds the changelog fragment.
Summary
flake.nixandnix/omniroute.nixso Nix users can install OmniRoute reproducibly.package-lock.jsonreferences workspace packages (@omniroute/browser-pool,open-sse,packages/browser-pool) thatnpm ci --offlinecan't resolve inside the Nix sandbox. The FOD runsnpm install -g omniroute@<version>with network access and pins reproducibility viaoutputHash.Closes #13075.
Test plan
nix build .#defaultonx86_64-linuxnix run .#default -- --helpprints usagerm -rf ~/.cache/nix— should be a substitute hit or match on fresh build)Notes
This is an offer, not urgent — happy to move files around (
packaging/nix/, subdir naming, README placement) or drop the flake and keep just the callPackage file if you prefer. Version bumps require regeneratingoutputHash.🤖 Generated with Claude Code