fix(modules): repair x86_64 host builds after flake update - #401
Open
github-actions[bot] wants to merge 1 commit into
Open
fix(modules): repair x86_64 host builds after flake update#401github-actions[bot] wants to merge 1 commit into
github-actions[bot] wants to merge 1 commit into
Conversation
The weekly flake update broke the x86_64 host builds: - raider (via constellation/desktop): gst_all_1.gst-vaapi was removed in GStreamer 1.28; its VA-API support now lives in gst-plugins-bad, which is already in the multimedia package list, so just drop the dead attr. - galactica: opencloud-idp-web builds with pnpm 9.15.9, which nixpkgs now marks insecure. pnpm is a build-time-only tool here, so permit it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What broke
The weekly flake update (commit 9fd7fb3) bumped nixpkgs, breaking the Build & Cache workflow for both x86_64 hosts. Both are genuine code failures, not transient CI noise.
raider —
gst_all_1.gst-vaapiremovedgst-vaapiwas removed in GStreamer 1.28 (modules/constellation/desktop.nix, multimedia package list). Its VA-API functionality now ships insidegst-plugins-bad, which is already in the same list, so the fix is to drop the dead attribute. This module is shared, so it also unblocks blackbird.galactica —
pnpm-9.15.9marked insecureTriggered by
opencloud-idp-web-7.0.0, whosenativeBuildInputspull in pnpm 9.15.9 (now flagged for several CVEs). pnpm is a build-time-only tool here, so it is added to galactica's existingnixpkgs.config.permittedInsecurePackageslist.Fix
gst_all_1.gst-vaapifrommodules/constellation/desktop.nix."pnpm-9.15.9"tohosts/galactica/configuration.nixpermittedInsecurePackages.The aarch64 hosts (basestar, r2s, raspi3, octopi) were not present in the failure log.
Verification
Local Nix toolchain isn't available in this environment; changes are minimal, targeted line edits matching existing alejandra formatting. CI will build the affected closures.