hyprland: drop nixpkgs follows, consume flake packages, substitute from hyprland.cachix.org - #39
Merged
Merged
Conversation
Three coupled changes so the hypr* stack substitutes instead of source-
building:
* flake.nix: hyprland input no longer follows our nixpkgs, and nixConfig
advertises hyprland.cachix.org (+ trusted key). nix flake lock resolves
the un-followed dep fresh from nixos-unstable (NOT upstream's own lock),
so cache hits are still drv-equivalence with upstream's lock rather than
a structural guarantee — this week they are byte-identical.
* nebula: programs.hyprland.{package,portalPackage} now come from
inputs.hyprland.packages (the drvs upstream CI actually pushes) instead
of the hyprland-packages/hyprland-extras overlays (dropped), which
rebuilt the whole stack against our nixpkgs and could never hit any
cache. nix.settings adds the substituter/key pair for the daemon.
* dotfiles-stow: hyprctl comes from config.programs.hyprland.package so
the reload helper tracks the configured compositor instead of
re-introducing a second pkgs.hyprland into the closure.
Side effect verified: hyprpolkitagent de-taints back to the pure nixpkgs
drv (Hydra-cached; the overlay's hyprutils previously forced it to source-
build with no cache anywhere). rose-pine-hyprcursor was never tainted.
Verified: nebula toplevel + darwin k eval green; hyprland AND xdph
outPaths return HTTP 200 from hyprland.cachix.org (hyprland's outPath is
literally identical to the overlay build this week — same nixpkgs rev);
full drv-graph hypr inventory shows only the flake stack (cachix) and
pure-nixpkgs deps (Hydra).
…llows claims The runner ignores the flake's nixConfig as untrusted, so the substituter/ key pair goes to determinate-nix-action via extra-conf — nebula job only; the darwin closures never contain the hypr* stack. Documentation catch-up for the un-follow: * new decision record knowledge/decisions/hyprland-unfollow-cachix.md (the probabilistic-hit reality, the overlay taint findings, the three wiring points, watch items) * ci.yml header + ci-github-actions accepted-cost bullet rewritten (the "upstream caches can never hit" claim is dead; noctalia still follows — it has no upstream cache) * docs/hyprland.md: install paragraph + xdph entry corrected, dated learned-behaviours entry added, old hyprutils-breakage entry annotated * knowledge: hyprland module + nebula host + cross-os-module-twins pattern corrected; log.md; okf index + validate green (172 files, 0 errors)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Converts the hypr* stack from source-built-every-bump to cache-substituted:
nixConfigadvertiseshyprland.cachix.org+ key for trusted interactive callers.programs.hyprland.{package,portalPackage}come frominputs.hyprland.packages.*(the exact drvs upstream CI pushes) instead of thehyprland-packages/hyprland-extrasoverlays, which are removed.nix.settingsadds the substituter/key pair for nebula's daemon.determinate-nix-action'sextra-conf(runners ignore flakenixConfigas untrusted). darwin job untouched — its closures never contain the stack.hyprctlnow referencesconfig.programs.hyprland.package, notpkgs.hyprland, so the closure doesn't regain a second hyprland from nixpkgs.Key findings (machine-verified, full detail in
knowledge/decisions/hyprland-unfollow-cachix.md)nix flake lockresolves the un-followed nixpkgs fresh from nixos-unstable HEAD, not from hyprland's own lock — so hits are probabilistic (most weeks), not structural. Miss weeks source-build once; FlakeHub serves it on, same as today.hyprutilsbump taintedhyprpolkitagentinto a drv cached nowhere (404 both caches); it reverts to the Hydra-cached nixpkgs drv (200). Same mechanism as the historical hyprlock breakage — that class is closed.Verification
okf validate172 files / 0 errors;actionlintclean; statix/deadnix clean;nix fmtappliedWhat CI on this PR should show
The nebula job substituting the hypr* stack instead of building it. (This week hyprland's paths are also in FlakeHub from PR #36, so the cachix proof is partly masked — the de-tainted hyprpolkitagent coming from cache.nixos.org is the visible delta.)
After merge, nebula needs a regular
nrs; the daemon picks up the new substituter from the same activation.