nix-community/nh v4.5.0

on GitHub

Added

• nh search accepts --fields to select package fields in normal output
  (#621).

• nh search prs and nh search issues accept --title (-t) to match the
  query against titles only, instead of titles, bodies and comments
  (#814).

• --elevation-strategy=empty-password for remote sudo setups where PAM
  authenticates out-of-band, such as pam_rssh with a security key. nh sends
  remote sudo an empty password instead of asking for one, and forwards the
  local SSH agent to the target host
  (#583).

• nh os dry-activate builds and previews activation without applying it.
  Existing --dry still builds without invoking activation.

• nh os build --dry now shows what Nix would build or fetch, without building.
  Previously --dry had no effect for nh os build. Remote hosts are not
  supported.

• nh os info now distinguishes the running generation from the selected boot
  profile; --json emits both statuses and generation metadata.

• Rollback now rejects an explicitly requested specialisation missing from the
  target generation before changing the selected system profile.

• Generation discovery now accepts only exact <profile>-<number>-link entries;
  similarly named profiles no longer leak into nh os info or rollback.

• nh os switch/nh os boot now accept --continue-on-activation-failure
  (NH_CONTINUE_ON_ACTIVATION_FAILURE). During a switch, activation runs before
  the new generation is added to the bootloader; a failed activation previously
  aborted before the bootloader step, leaving nothing new to boot into. With
  this flag set, nh warns and still adds the generation to the bootloader so it
  is available on the next reboot. Without it, nh now emits an explicit warning
  that the generation was not added to the bootloader.

• nix-installable now provides reusable parsing and argument rendering for
  flake references, Nix files, expressions, and store paths. The previous
  nh-installable crate reuses this public crate.

• nh os now falls back to the <nixos-system> lookup-path entry, then
  /etc/nixos/system.nix, then /etc/nixos/default.nix, before
  <nixpkgs/nixos> when no flake or installable is configured. Explicit OS
  Nix-file directories also resolve system.nix before default.nix
  (#745).

• nh os build-image's --image-variant flag is now optional. If the flag is
  not provided, the command will fallback to using
  config.system.build.isoImage.

• --diff takes full to also show packages whose version did not change, as
  in --diff full or --diff always,full. Like dix's --full, the diff now
  notes how many packages it hides.

Changed

Several dependencies have been replaced with smaller, lightweight, in-house
alternatives. This is a part of an effort to make nh compile faster, and use
less space. Help text, error reports, and generated shell completions now use
the replacement libraries. Please open an issue if you notice anything out of
the ordinary!

Boolean environment variables such as NH_ASK and NH_NO_SYSTEMD_RUN now
accept 1, true, yes, 0, false and no. Other spellings like on, y
or TRUE are rejected.

• nh search offline now reads spam-db 0.3.0 databases and searches package,
  option, and library-function scopes in a single file. The previous
  # spam-db-v3 format is not readable by spam-db 0.3.0.
• --json is no longer forwarded to nix build. nh reads the built output path
  from nix build --print-out-paths, which --json would replace. It is still
  forwarded to the other Nix commands nh runs.
• --build-host no longer copies the result from the build host when it is
  already present in the local store.
• --build-host with a different --target-host no longer copies the result to
  localhost when the build host can copy it to the target directly. The result
  is copied straight to the host that activates it, before the diff and --ask,
  and a local out-link is only created when it reaches the local store.
• Build progress is now shown by rom, which runs inside nh, instead of
  nix-output-monitor (nom), so nh no longer needs nom at runtime. --no-nom
  and NH_NOM are replaced by --no-rom and NH_ROM, which behave the same.
  --no-nom and NH_NOM still work as deprecated aliases that print a warning,
  and will be removed in 5.0. Unlike other boolean environment variables,
  NH_ROM also accepts on and off, as NH_NOM did. rom honours NO_COLOR
  and TERM=dumb, and NH_ROM_LOG=<file> records the build log stream so it
  can be replayed through rom.
• Activation output is always shown, and remote activation logs each step as it
  starts. Remote activation used to print nothing until it finished.
  --show-activation-logs and NH_SHOW_ACTIVATION_LOGS now do nothing and will
  be removed in 5.0. Passing the flag warns that it is deprecated.
• Local nh os switch/boot/test/rollback and nh darwin switch now
  elevate once and run all privileged steps in a single nh process, instead of
  elevating each step separately. Builds remain under the invoking user. Sudoers
  rules that grant NOPASSWD to individual activation commands no longer apply.
• nh os diffs against a --target-host now run dix snapshot on the target
  host instead of querying its store with nix path-info --store ssh-ng://....
  This requires dix >= 3.0.0 on the target host, unless both closures are
  already in the local store, which is checked first.
• With --diff auto, failing diffs now only warn instead of aborting the
  rebuild, both locally and remotely.
• --diff always now aborts on a failing diff for every command, including
  nh os rollback, nh home and nh darwin, which used to ignore it.

Fixed

• nh search no longer drops --limit, --channel, --platforms and
  --fields when they come before a subcommand, as in
  nh search --limit 5 packages hello. They now apply to every subcommand that
  uses them, and --limit and --fields are rejected for modes that don't.

• nh darwin switch --elevation-strategy none now sets the system profile and
  activates without elevation, like nh os. It previously failed to resolve an
  elevation program.

• A wrong sudo password for --target-host is asked for again, up to three
  times, before activation starts. It used to fail activation.

• --target-host sets the system profile with nix-env --set, as nixos-rebuild
  does. The previous nix build --profile could keep running on the target
  after Ctrl+C and hold its store locks.

• Ctrl+C now cancels remote builds. --build-host builds previously ran
  nix build on the build host through ssh, where an interrupt neither
  stopped nh (it waited for the build output to end) nor the remote build. nh
  now runs nix build --store <build-host> --eval-store auto locally, which
  copies the derivation, streams the build logs, and lets the remote daemon
  cancel the build when the connection drops, like a local build.

• nh os only infers the running system's specialisation when activating
  locally, rather than applying the local machine's specialisation to a
  --target-host.

• nh search packages and nh search options now query the newest
  search.nixos.org index available for the channel instead of the version
  bundled with nh. Outdated indices stay online, so nh previously kept showing
  stale package versions after search.nixos.org moved on
  (#813). The bundled version
  is still used if discovery fails.

• NixOS activation now runs in a transient systemd service when systemd is
  available, so switching the system does not terminate its own session. This
  requires systemd 261. Activation still runs directly on systems without
  systemd, or with --no-systemd-run (NH_NO_SYSTEMD_RUN).

• Specialisation activation now validates and activates the selected closure
  while installing the base closure as the boot profile.

• Rollback now chooses the predecessor of the selected system profile rather
  than the running system, and restores that selected profile on failure.

• Remote builds without nom now drain stdout and stderr while waiting,
  preventing deadlocks when either pipe fills.

• Remote-only results now clear an old local out-link, preventing subsequent
  activation from using an unrelated previous build.

• nh os build-vm --run now ignores --target-host, since the VM runs locally.

• When a direct copy between remote hosts fails, the local relay now copies the
  closure to the target as well as from the builder.

• Legacy image builds now use the same hostname or explicit configuration
  attribute selected during image-variant validation.

• nh os build-vm --specialisation now builds the VM derivation from the chosen
  specialisation instead of the base configuration.

• nh os build-image --update now updates flake inputs before discovering
  available image variants, rather than after validation.

• nh clean now preserves the generation selected by each profile symlink by
  default, even after a rollback when it is older than --keep-since and
  outside the newest --keep generations. Previously cleanup could leave the
  profile dangling (#805).

  • nh clean accepts --delete-current to let the selected profile generation
    expire under the normal --keep and --keep-since limits. This can leave
    the profile symlink dangling; without the flag, the selected generation is
    kept.

• nh darwin switch now invokes the built configuration's activate script
  directly instead of requiring darwin-rebuild in the target system
  (#801).

• Image variant discovery for Nix files now escapes backslashes, double quotes,
  and ${ in file paths before generating Nix source
  (#785).

• nh os, nh home, and nh darwin now preserve applicable Nix passthrough
  arguments across evaluation, updates, remote copying and builds, and profile
  installation. Multi-step and remote rebuilds no longer drop network
  restrictions such as --offline and --no-net, and flags such as
  --recreate-lock-file now affect the evaluation that selects the derivation
  (#768).

• nh os switch/nh os boot no longer fail at the bootloader step with "Failed
  to resolve base output path to store path" when activation applies a mount
  that shadows nh's temporary build directory (for example bind-mounting over
  /tmp). nh now resolves the base store path before activation runs, while the
  result symlink is still visible, instead of canonicalizing it afterwards
  (#659).

• Remote builds via --build-host no longer fail when the remote login shell is
  non-POSIX (e.g. xonsh). The <drv>^* extended-output selector was quoted as
  prefix'^*', which such shells pass through literally (and backslash escaping
  fares no better, as \* is forwarded verbatim and rejected by Nix as an
  invalid outputs specifier). nh now single-quotes the whole selector
  ('<drv>^*'), which survives both POSIX and non-POSIX shells.

• The .local domain suffix is now stripped from remote hostnames when
  selecting the NixOS configuration. When building a remote target (e.g.
  --target-host user@host.local), host is now used to select the correct
  nixosConfiguration, instead of host.local.

• nh os build-image now respects the attribute path supplied with a legacy Nix
  file or expression installable, so commands inspect the selected configuration
  instead of looking for config at the top level
  (#778).

• nh os build-image now respects the --dry flag.

Removed

• nh search no longer accepts --backend-version and
  --backend-version-fallbacks, nor reads NH_SEARCH_BACKEND_VERSION and
  NH_SEARCH_BACKEND_FALLBACKS. nh discovers the newest search.nixos.org index
  for the channel, and falls back to the bundled version plus two newer ones.
• NH_REMOTE_CLEANUP has been removed. Interrupted remote builds are now
  cancelled by the remote Nix daemon, so the pkill-based cleanup is no longer
  needed.
• The legacy ssh:// store scheme for --build-host and --target-host. nh
  always uses ssh-ng://; an ssh:// prefix is treated like ssh-ng://.