nix(darwin): run activation scan + first-enable sweep via postActivation - #22
Merged
Conversation
nix-darwin's `activate` splices only a fixed, enumerated set of activationScripts names (preActivation … postActivation), with no generic dag like NixOS. The module's custom `system.activationScripts.machokeeper` therefore evaluated fine but was silently never run on darwin: the post-build hook worked, but the activation scan and the one-time first-enable full-store sweep did not fire at all. Append the repair snippet into `system.activationScripts.postActivation` via lib.mkAfter — a slot nix-darwin actually runs, still before the current-system symlink flips. Add a darwin-only eval check (nix/module-darwin-test.nix) that greps the assembled activate script for the scan and sweep and fails if a future change drops them again; wire in nix-darwin as a check-only flake input.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
nix-darwin, unlike NixOS, has no generic activation-script dag: its
activatescript splices only a fixed, enumerated set of script names (preActivation…postActivation). A customsystem.activationScripts.<name>evaluates fine but is silently never run.The darwin module registered
system.activationScripts.machokeeper.text, so on darwin:scan-generationof the generation delta) never rani.e. two of the module's three darwin doors were inert. (NixOS was unaffected — its
system.activationScripts.<name>is generic, which is also why the NixOS VM test passed and this slipped through.)Found while adopting machokeeper on a real nix-darwin host (retiring the NixOS/nix#15638 patched daemon): the
/nix/var/machokeeper/.sweptmarker never appeared andmachokeeperwas absent from/run/current-system/activate. A subsequent read-onlydoctor --scanfound 46 pre-existing broken files, confirming the sweep genuinely wasn't running.Fix
Append the repair snippet into
system.activationScripts.postActivation.textvialib.mkAfter— a slot nix-darwin actually runs, still before thecurrent-systemsymlink flips, with$systemConfigalready in scope.Test
New darwin-only eval check
nix/module-darwin-test.nix: builds adarwinSystemwith the module and greps the assembled activate script (config.system.activationScripts.script.text) for the scan + sweep, failing if a future change drops them again. Wires innix-darwinas a check-only flake input.Verified red-before-green (fails on the pre-fix custom-key module) and green after. Full gate on aarch64-darwin:
nix flake checkall-pass (incl. the new check),nix build .#default,go vet+go test -race ./....