From dd66d652e6aaa397619c0f41925124f5cdf05815 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Thu, 12 Nov 2026 16:03:07 -0500 Subject: [PATCH 1/2] use nixpkgs-oldstable better We only import nixpkgs-oldstable to take v8 from it, and never use its flake outputs. Mark it flake = false so Nix treats it as a source snapshot and skips its flake.nix. The locked source and its hash do not change. Not a big deal in the end but a nice signal imo. Also drop config.allowUnfree from that import. v8 is BSD-3-Clause, and it and its build inputs evaluate without it on every system. Also drop permittedInsecurePackages from the main nixpkgs import. It sat next to config instead of inside it, so nixpkgs ignored it. It named the v8 we now take from nixpkgs-oldstable, which the main nixpkgs no longer has and which has no known vulnerabilities. Assisted-by: Claude --- flake.lock | 1 + flake.nix | 1 + nix/nixpkgs.nix | 6 +----- 3 files changed, 3 insertions(+), 5 deletions(-) diff --git a/flake.lock b/flake.lock index 836d098524..2482e10b88 100644 --- a/flake.lock +++ b/flake.lock @@ -264,6 +264,7 @@ } }, "nixpkgs-oldstable": { + "flake": false, "locked": { "lastModified": 1712666087, "narHash": "sha256-WwjUkWsjlU8iUImbivlYxNyMB1L5YVqE8QotQdL9jWc=", diff --git a/flake.nix b/flake.nix index b952a57089..aec0beda89 100644 --- a/flake.nix +++ b/flake.nix @@ -26,6 +26,7 @@ # Pin to a specific nixpkgs version that has compatible v8 and curl versions # for extensions that require older package versions nixpkgs-oldstable.url = "github:NixOS/nixpkgs/a76c4553d7e741e17f289224eda135423de0491d"; + nixpkgs-oldstable.flake = false; nixpkgs.url = "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"; rust-overlay.inputs.nixpkgs.follows = "nixpkgs"; rust-overlay.url = "github:oxalica/rust-overlay"; diff --git a/nix/nixpkgs.nix b/nix/nixpkgs.nix index c4622d4606..12b42a8237 100644 --- a/nix/nixpkgs.nix +++ b/nix/nixpkgs.nix @@ -6,7 +6,6 @@ _module.args.pkgs = import inputs.nixpkgs { inherit system; config.allowUnfree = true; - permittedInsecurePackages = [ "v8-9.7.106.18" ]; overlays = [ # Patch tzdata to 2026f until nixpkgs catches up. # Drop once the pinned nixpkgs ships >= 2026f (the assertion below trips): @@ -97,10 +96,7 @@ ( let # Provide older versions of packages required by some extensions - oldstable = import inputs.nixpkgs-oldstable { - inherit system; - config.allowUnfree = true; - }; + oldstable = import inputs.nixpkgs-oldstable { inherit system; }; in _final: _prev: { v8_oldstable = oldstable.v8; From ae6db0883ee47e011ec90d22bcf0a32e909303c2 Mon Sep 17 00:00:00 2001 From: Manuel Mendez Date: Tue, 10 Nov 2026 21:41:22 -0500 Subject: [PATCH 2/2] get clang for old pgrx builds from a nixos-22.11 flake input Old pgrx versions (before 0.11.3) need clang and glibc headers from nixos-22.11 to build. We got them by downloading the whole nixos-22.11 tarball with fetchTarball during every eval. That was slow and could not use the flake lock or eval cache. Add nixos-22.11 as a non-flake input instead and take clang from it. It locks to the final 22.11 release, so the build outputs are the same as before and still come from the binary cache. Keep using it on every platform, so each extension version builds with the same clang everywhere. Newer clang and glibc break the old bindgen versions these pgrx releases use: bindgen 0.60.x panics on how clang 16 and later name anonymous structs, which glibc and macOS SDK headers contain. On aarch64-linux, bindgen also fails on the ARM NEON vector functions that newer glibc headers declare, even with clang 12. Assisted-by: Claude --- flake.lock | 14 ++++++++++++++ flake.nix | 3 +++ nix/cargo-pgrx/mkPgrxExtension.nix | 26 +++++++++++--------------- nix/nixpkgs.nix | 2 ++ 4 files changed, 30 insertions(+), 15 deletions(-) diff --git a/flake.lock b/flake.lock index 2482e10b88..e381b678b3 100644 --- a/flake.lock +++ b/flake.lock @@ -248,6 +248,19 @@ "url": "https://nixos.org/channels/nixpkgs-unstable/nixexprs.tar.xz" } }, + "nixpkgs-2211": { + "flake": false, + "locked": { + "lastModified": 1690939524, + "narHash": "sha256-wZ8ktcD7KUPzOMSQXbbuvM2/YS5+sihPqnNymFQ58Mg=", + "type": "tarball", + "url": "https://releases.nixos.org/nixos/22.11/nixos-22.11.4773.ea4c80b39be4/nixexprs.tar.xz" + }, + "original": { + "type": "tarball", + "url": "https://channels.nixos.org/nixos-22.11/nixexprs.tar.xz" + } + }, "nixpkgs-lib": { "locked": { "lastModified": 1761765539, @@ -305,6 +318,7 @@ "nix-eval-jobs": "nix-eval-jobs", "nix2container": "nix2container", "nixpkgs": "nixpkgs_2", + "nixpkgs-2211": "nixpkgs-2211", "nixpkgs-oldstable": "nixpkgs-oldstable", "rust-overlay": "rust-overlay", "treefmt-nix": "treefmt-nix" diff --git a/flake.nix b/flake.nix index aec0beda89..afbb66cd11 100644 --- a/flake.nix +++ b/flake.nix @@ -27,6 +27,9 @@ # for extensions that require older package versions nixpkgs-oldstable.url = "github:NixOS/nixpkgs/a76c4553d7e741e17f289224eda135423de0491d"; nixpkgs-oldstable.flake = false; + # Older clang and glibc for building extensions on old pgrx versions (before 0.11.3) + nixpkgs-2211.url = "https://channels.nixos.org/nixos-22.11/nixexprs.tar.xz"; + nixpkgs-2211.flake = false; nixpkgs.url = "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"; rust-overlay.inputs.nixpkgs.follows = "nixpkgs"; rust-overlay.url = "github:oxalica/rust-overlay"; diff --git a/nix/cargo-pgrx/mkPgrxExtension.nix b/nix/cargo-pgrx/mkPgrxExtension.nix index d1190817ed..7d540bb712 100644 --- a/nix/cargo-pgrx/mkPgrxExtension.nix +++ b/nix/cargo-pgrx/mkPgrxExtension.nix @@ -1,11 +1,12 @@ { - callPackage, + lib, pkgs, + callPackage, + clang11, rustVersion, pgrxVersion, makeRustPlatform, rust-bin, - stdenv, }: let inherit ((callPackage ./default.nix { inherit rustVersion rust-bin; })) mkCargoPgrx; @@ -38,20 +39,15 @@ let }; bindgenHook = - # Fix bindgen error on aarch64-linux for versions using pgrx with bindgen 0.68.1 - # This affects pgrx 0.6.1 through 0.11.2 which have issues with ARM NEON vector ABI - if (builtins.compareVersions "0.11.3" pgrxVersion > 0) then - let - nixos2211 = ( - import (builtins.fetchTarball { - url = "https://channels.nixos.org/nixos-22.11/nixexprs.tar.xz"; - sha256 = "1j7h75a9hwkkm97jicky5rhvzkdwxsv5v46473rl6agvq2sj97y1"; - }) { inherit (stdenv.hostPlatform) system; } - ); - in + # pgrx 0.6.1 through 0.11.2 use old bindgen versions that break with current clang and glibc: + # - bindgen 0.60.x panics on how clang 16+ names anonymous structs + # ("(unnamed at /path/file.h:N:M)"), which glibc and macOS SDK headers contain. + # - on aarch64-linux, bindgen fails on the ARM NEON vector functions that newer glibc headers declare. + # So build them with clang and glibc headers from nixos-22.11, on every platform. + if lib.versionOlder pgrxVersion "0.11.3" then rustPlatform.bindgenHook.overrideAttrs { - libclang = nixos2211.clang.cc.lib; - clang = nixos2211.clang; + libclang = clang11.cc.lib; + clang = clang11; } else rustPlatform.bindgenHook; diff --git a/nix/nixpkgs.nix b/nix/nixpkgs.nix index 12b42a8237..39ab3e67d7 100644 --- a/nix/nixpkgs.nix +++ b/nix/nixpkgs.nix @@ -97,9 +97,11 @@ let # Provide older versions of packages required by some extensions oldstable = import inputs.nixpkgs-oldstable { inherit system; }; + nixos2211 = import inputs.nixpkgs-2211 { inherit system; }; in _final: _prev: { v8_oldstable = oldstable.v8; + clang11 = nixos2211.clang; } ) ];