Nix: Bad darwin reinstallation experience

[Infinisil]

Having a mac I thought of using it to fix some darwin failures, so I went to install Nix. Turns out that I had an older version of Nix installed already, but this should work just fine, optimally. Here I describe all the problems that I happen to encounter.

1. I go to https://nixos.org/nix/ and copy the command to install Nix curl https://nixos.org/nix/install | sh
2. Paste it into my terminal and run it (some line breaks inserted for readability):

$ curl https://nixos.org/nix/install | sh
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  2472  100  2472    0     0  11644      0 --:--:-- --:--:-- --:--:-- 11660
downloading Nix 2.1.1 binary tarball for x86_64-darwin from 'https://nixos.org/releases/nix/nix-2.1.1/nix-2.1.1-x86_64-darwin.tar.bz2' to '/var/folders/pv/g5wjzg293v50gg59wmjz0fdw0000gn/T/nix-binary-tarball-unpack.XXXXXXXXXX.014RNLvf'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 28.8M  100 28.8M    0     0  1644k      0  0:00:17  0:00:17 --:--:-- 1553k
Note: a multi-user installation is possible. See https://nixos.org/nix/manual/#sect-multi-user-installation
performing a single-user installation of Nix...
/var/folders/pv/g5wjzg293v50gg59wmjz0fdw0000gn/T/nix-binary-tarball-unpack.XXXXXXXXXX.014RNLvf/unpack/nix-2.1.1-x86_64-darwin/install:
directory /nix exists, but is not writable by you.
This could indicate that another user has already performed a single-user installation of Nix on this system.
If you wish to enable multi-user support see http://nixos.org/nix/manual/#ssec-multi-user.
If you wish to continue with a single-user install for infinisil please run 'chown -R infinisil /nix' as root.

1. Being interested in a multi-user installation, I go to https://nixos.org/nix/manual/#ssec-multi-user, hoping I could easily have it be properly installed with a flag. That page however says something about having to run some script to add build users, and to run nix-daemon in my system start scripts, which I have no idea how to do (okay I have a tiny idea, but this launchctl stuff is so annoying to do). So I give up on that idea, I just want a quick installation.
2. So I'll run the recommended command, changing /nix's owner and try to run the installer again

$ sudo chown -R infinisil /nix
$ curl https://nixos.org/nix/install | sh

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  2472  100  2472    0     0   9688      0 --:--:-- --:--:-- --:--:--  9694
downloading Nix 2.1.1 binary tarball for x86_64-darwin from 'https://nixos.org/releases/nix/nix-2.1.1/nix-2.1.1-x86_64-darwin.tar.bz2' to '/var/folders/pv/g5wjzg293v50gg59wmjz0fdw0000gn/T/nix-binary-tarball-unpack.XXXXXXXXXX.OYxnlHUy'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 28.8M  100 28.8M    0     0  1532k      0  0:00:19  0:00:19 --:--:-- 1658k
Note: a multi-user installation is possible. See https://nixos.org/nix/manual/#sect-multi-user-installation
performing a single-user installation of Nix...
copying Nix to /nix/store...................................
initialising Nix database...
warning: unknown setting 'signed-binary-caches'
warning: unknown setting 'signed-binary-caches'
error: you don't have sufficient rights to use this command
/var/folders/pv/g5wjzg293v50gg59wmjz0fdw0000gn/T/nix-binary-tarball-unpack.XXXXXXXXXX.OYxnlHUy/unpack/nix-2.1.1-x86_64-darwin/install:
unable to register valid paths

1. Huh, 2 times the same warning and an error. Because I happen to know that Nix has its settings in /etc/nix/nix.conf, I know that deleting this file would probably get me a new one with the "correct" settings. However, it's only a warning, so I'll carry on with the only reasonably response to the error, running with sudo:

$ curl https://nixos.org/nix/install | sudo sh
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  2472  100  2472    0     0  10103      0 --:--:-- --:--:-- --:--:-- 10089
downloading Nix 2.1.1 binary tarball for x86_64-darwin from 'https://nixos.org/releases/nix/nix-2.1.1/nix-2.1.1-x86_64-darwin.tar.bz2' to '/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/nix-binary-tarball-unpack.XXXXXXXXXX.uGYUTfeP'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 28.8M  100 28.8M    0     0  1633k      0  0:00:18  0:00:18 --:--:-- 1567k
Note: a multi-user installation is possible. See https://nixos.org/nix/manual/#sect-multi-user-installation
warning: installing Nix as root is not supported by this script!
performing a single-user installation of Nix...
copying Nix to /nix/store...................................
initialising Nix database...
warning: unknown setting 'signed-binary-caches'
warning: unknown setting 'signed-binary-caches'
Nix: WARNING: bad ownership on /nix/var/nix/profiles/per-user/root, should be 0
Nix: WARNING: bad ownership on /nix/var/nix/gcroots/per-user/root, should be 0
warning: unknown setting 'signed-binary-caches'
installing 'nix-2.1.1'
building '/nix/store/wq1a2gs9vzscmivi7p00gncy127qy4fh-user-environment.drv'...
created 104 symlinks in user environment
warning: unknown setting 'signed-binary-caches'
installing 'nss-cacert-3.38'
building '/nix/store/mk13yxiwf5p0c1sp02bm21p60pjxpv7s-user-environment.drv'...
created 105 symlinks in user environment
warning: unknown setting 'signed-binary-caches'
warning: unknown setting 'signed-binary-caches'
unpacking channels...
created 2 symlinks in user environment

Installation finished!  To ensure that the necessary environment
variables are set, please add the line

  . /Users/infinisil/.nix-profile/etc/profile.d/nix.sh

to your shell profile (e.g. ~/.profile).

1. Huh, a bold message that root isn't supported, but it's only a warning? Followed by another 2 same warnings of the previous kind, followed by another 2 new warnings I have no idea about, followed by a third time the same warning, followed by the same warning another couple times. But the installation did finish! I am surprised. I do what the script recommends and source the command to get Nix available in my current terminal, I'll then try to build something

$ . /Users/infinisil/.nix-profile/etc/profile.d/nix.sh
$ nix-build '<nixpkgs>' -A hello
warning: unknown setting 'signed-binary-caches'
these paths will be fetched (3.70 MiB download, 23.85 MiB unpacked):
  /nix/store/1j81scbyzgxsv7dnq6naxvi4lb5q8ln9-ICU-osx-10.10.5
  /nix/store/2cf0hbdgyixp2jl3k6l5mdg15pvkn8ah-CF-osx-10.10.5
  /nix/store/7zcsy4dhx1zcibmqjjnghcmd296bp4ii-Libsystem-osx-10.11.6
  /nix/store/h1zb1padqbbb7jicsvkmrym3r6snphxg-hello-2.10
  /nix/store/jd065p28z3ar0q6nljz479f9mm35v5qn-libc++abi-5.0.2
  /nix/store/qjmqrzk8nhn5maa093fhl3finczz72lw-libc++-5.0.2
fetching path ‘/nix/store/7zcsy4dhx1zcibmqjjnghcmd296bp4ii-Libsystem-osx-10.11.6’...

*** Downloading ‘https://cache.nixos.org/nar/1lvkhijk1h38n9xzdbqq7c5r9d76cyaags981hj28c5ks8fgzfnh.nar.xz’ (signed by ‘cache.nixos.org-1’) to ‘/nix/store/7zcsy4dhx1zcibmqjjnghcmd296bp4ii-Libsystem-osx-10.11.6’...
  % Total    % Received % Xfer
d  Average S
peed
   Time    Time     Time  Cu
rrent

      Dl
oad  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0
     0 --:--:-- --:--:-- --
:--:--     0
 61  922k   61  569k    0     0   876k      0  0:00:0
1 --:--:--  0:00:01  878k
100  922k  100  922k    0
 0  1053k      0 --:--:-- --
:--:-- --:--:-- 1055k

fetching path ‘/nix/store/jd065p28z3ar0q6nljz479f9mm35v5qn-libc++abi-5.0.2’...

*** Downloading ‘https://cache.nixos.org/nar/0a89kwmlj1x194a8fiwc84rfdr7c2f2fqvqfzphpi40923qk4izb.nar.xz’ (signed by ‘cache.nixos.org-1’) to ‘/nix/store/jd065p28z3ar0q6nljz479f9mm35v5qn-libc++abi-5.0.2’...
  % Total    % Receive
d % Xferd  Average Speed   Time    Time     Time  Current



 Dload  Upload   Total   Spe
nt    Left  Speed
  0     0    0
   0    0     0      0      0 --:--:-
- --:--:-- --:--:--     0
100  100k  100  100k
 0     0   224k      0 -
-
:--:--
--:--:-- --:--:--  225k

fetching path ‘/nix/store/qjmqrzk8nhn5maa093fhl3finczz72lw-libc++-5.0.2’...

*** Downloading ‘https://cache.nixos.org/nar/16dpvnn8cwwyzny4hm6f03j961g3dcj75014pwqajy0cdpkvzim3.nar.xz’ (signed by ‘cache.nixos.org-1’) to ‘/nix/store/qjmqrzk8nhn5maa093fhl3finczz72lw-libc++-5.0.2’...
  % Total    % Receiv
ed % Xferd  Average Speed   Time    Time     Time  Current


                Dload  Upload
 Total   Spent    Left  Speed
  0     0
 0     0    0     0      0
      0 --:--:-- --:--:--
--:--:--     0
100  666k  100  666k    0     0   958k      0 --:--:-- --:--:-- --:--:--  961k

fetching path ‘/nix/store/1j81scbyzgxsv7dnq6naxvi4lb5q8ln9-ICU-osx-10.10.5’...

*** Downloading ‘https://cache.nixos.org/nar/0j8hfirw6phpikpl37vnp1gflvifg4vvi1x0ypzfq2zn38b8hf0v.nar.xz’ (signed by ‘cache.nixos.org-1’) to ‘/nix/store/1j81scbyzgxsv7dnq6naxvi4lb5q8ln9-ICU-osx-10.10.5’...
  % Total    % Received
% Xferd  Average Speed   Time    Time
Time
  Curren
t


            Dload  Up
load   Total   Spent
 Left  Speed
  0     0    0     0    0     0      0
     0 --:--
:-- --:-
-:-- --:--:--     0
  0     0    0     0    0     0      0      0 --:
--:--
--:
--:-- --:--
:--     0
100 1520k  100 1520k    0     0  1471k      0  0:00:01  0:00:01 --:--:-- 1474k

fetching path ‘/nix/store/2cf0hbdgyixp2jl3k6l5mdg15pvkn8ah-CF-osx-10.10.5’...

*** Downloading ‘https://cache.nixos.org/nar/0n59ld5clza0x7sr43d60hpj1pfkri2clac262aj5igdbbqjywsn.nar.xz’ (signed by ‘cache.nixos.org-1’) to ‘/nix/store/2cf0hbdgyixp2jl3k6l5mdg15pvkn8ah-CF-osx-10.10.5’...
  % Total    % Received % Xferd  Average Spe
ed   T
ime    Time
   Time  Current
     Dload  Upload   Total   Spent    Left  S
peed
  0     0
 0     0
    0     0      0      0
--:--:-
- --:--:
-- --:--:
--     0
100  554k  100  554k
 0     0  1
090k      0 --:--:
-- --:--:-- --:--:-- 1096k

fetching path ‘/nix/store/h1zb1padqbbb7jicsvkmrym3r6snphxg-hello-2.10’...

*** Downloading ‘https://cache.nixos.org/nar/1102rw9b9rf8qv1h3g9cwph4z06ixs7dh65ialhbggb0bya2vq9b.nar.xz’ (signed by ‘cache.nixos.org-1’) to ‘/nix/store/h1zb1padqbbb7jicsvkmrym3r6snphxg-hello-2.10’...
  % Total    % Received %
 Xfer
d
Average Speed   Time    Time     Time  Current

         Dload  Upload   Total
   Spent    Left  Speed
  0     0    0     0    0
 0      0      0 --:--:-- --:--:-- --:--:--     0
  0     0    0     0
 0     0      0      0 --:--:-- --:--:-- --:--:-
-     0
100 23392  100 23392    0     0  28506      0 --:--:-- --:--:-- --:--:-- 28561

/nix/store/h1zb1padqbbb7jicsvkmrym3r6snphxg-hello-2.10

1. So it really did work. I happen to know that such garbled output comes from a mismatched nix-daemon running. I check whether I have a daemon running

$ pgrep nix-daemon
82
$ ps -p82
  PID TTY           TIME CMD
   82 ??         0:00.03 /nix/store/z21lvakv1l7lhasmv5fvaz8mlzxia8k9-nix-1.11.13/bin/nix-daemon

So indeed, I seem to be running a 1.11.13 nix-daemon, didn't even notice. I don't feel like fixing this now.

1. Wanting to fix this annoying warning: unknown setting 'signed-binary-caches' warning, I remove Nix' config file and install again to get a "fresh" one

$ sudo rm /etc/nix/nix.conf
$ curl https://nixos.org/nix/install | sudo sh
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  2472  100  2472    0     0   8401      0 --:--:-- --:--:-- --:--:--  8379
downloading Nix 2.1.1 binary tarball for x86_64-darwin from 'https://nixos.org/releases/nix/nix-2.1.1/nix-2.1.1-x86_64-darwin.tar.bz2' to '/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/nix-binary-tarball-unpack.XXXXXXXXXX.v3xkln1d'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 28.8M  100 28.8M    0     0  1315k      0  0:00:22  0:00:22 --:--:-- 1302k
Note: a multi-user installation is possible. See https://nixos.org/nix/manual/#sect-multi-user-installation
warning: installing Nix as root is not supported by this script!
performing a single-user installation of Nix...
copying Nix to /nix/store...................................
initialising Nix database...
Nix: WARNING: bad ownership on /nix/var/nix/profiles/per-user/root, should be 0
Nix: WARNING: bad ownership on /nix/var/nix/gcroots/per-user/root, should be 0
replacing old 'nix-2.1.1'
installing 'nix-2.1.1'
building '/nix/store/2rm765zycqsjr4w5264rzci9fbfjk6hd-user-environment.drv'...
created 105 symlinks in user environment
unpacking channels...

Installation finished!  To ensure that the necessary environment
variables are set, either log in again, or type

  . /Users/infinisil/.nix-profile/etc/profile.d/nix.sh

in your shell.

Only three different warnings this time, yay

Note that in this process I downloaded Nix a total of 4 times.

There are so many things to improve here.

Ping @grahamc @LnL7

Relevant for https://github.com/NixOS/nixpkgs/pull/46401

[LnL7]

Firstly upgrade instructions are available here https://nixos.org/nix/manual/#ch-upgrading-nix.

1. That's definitively possible, https://nixos.org/nix/manual/#sect-multi-user-installation includes instructions for multi-user, maybe we should link to that instead?
2. A root single-user install isn't supported, but that doesn't mean it's not possible to get that working with some extra steps. I've used this before on systems where a daemon install isn't officially supported. The fact that you're not seeing more problems is because of the previous install.
3. That also explains the issues seen in 4.

[ariutta]

To get rid of warning: unknown setting 'signed-binary-caches', I replaced signed-binary-caches = * with require-sigs = true in /etc/nix/nix.conf.

Related IRC logs.

[ariutta]

Should the upgrade change files like /etc/nix/nix.conf? If it doesn't change files, it could at least suggest changes.

[ento]

error: you don't have sufficient rights to use this command
/var/folders/pv/g5wjzg293v50gg59wmjz0fdw0000gn/T/nix-binary-tarball-unpack.XXXXXXXXXX.OYxnlHUy/unpack/nix-2.1.1-x86_64-darwin/install:
unable to register valid paths

I encountered the same error while trying to install nix in single-user mode on top of an existing multi-user installation. ls -l /nix showed that the owner of /nix/store had reverted to root. Doing unset NIX_REMOTE before running the install script fixed it.

The nix-daemon plist file was still there so I followed the multi-user uninstallation instructions about the nix-daemon.plist.

Edit: also removed these lines from /etc/bashrc

# Nix
if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then
  . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
fi
# End Nix

[steve-chavez]

Using NixOS 17.09. To get rid of warning: unknown setting 'signed-binary-caches', I added the following to my /etc/configuration.nix:

nix.package = pkgs.nixStable2;

After a nixos-rebuild switch the /etc/nix/nix.conf got rewritten to not include signed-binary-caches = * and includes require-sigs = true instead.