We at the Lix team are proud to announce our seventh major release, version 2.96 “Bingsu”.

This release focuses on security, debugger support, quality-of-life improvements, and continues the work towards both the new Cap’n’Proto RPC protocol and Rust support.

Bingsu is a milk-based Korean shaved ice dessert with sweet toppings that may include chopped fruit, condensed milk, fruit syrup, tteok, and red beans.

Lix is a Nix implementation focused on reliability, predictability, friendliness, developed by a community of people from around the world. We have long term plans to incrementally evolve Nix to work in more places, to make it more reliable and secure, and to update the language and semantics to correct past mistakes and reduce errors, all the while providing an amazing tooling experience.

Upgrading from CppNix or previous Lix versions

WARNING: We do not recommend to use nix upgrade-nix, please follow the instructions in https://lix.systems/install/ with the Lix’s upgrade shell script.

The upgrade procedure depends on how you installed Lix or CppNix, and is fully described in the Lix installation guide.

If you are using Lix from nixpkgs on NixOS, you just need to upgrade your nixpkgs once the upgrade pull request has passed through the build farm into your channel; no other action is required.

If you want to help us test the next version of Lix, consider running main by following the beta guide.

Changes

Lix 2.96 builds on the work of previous releases to improve the daemon, the protocols spoken with the daemon (both on a single machine and the ones used for remote builds), and brings many much-needed improvements to the debugger infrastructure.

Here’s a short list of the most exciting changes in Lix 2.96. This list is not as exhaustive as the full release notes.

REPL and debugger support

Thanks to the tireless work of blokyk the REPL and debugger are much improved in Lix 2.96. The debugger is now more stable, navigating within the debugger is much easier, and the information printed by the debugger is more readable.

eldritch horrors have also switched the REPL backend from editline to rustyline, finally bringing proper UTF-8 support to the REPL.

News from RPC

The experimental RPC protocol is now shipping under the rpc-sockets experimental feature. As one may guess this is still highly experimental and must be enabled not only with the experimental feature flag in your Lix config, but also requires system setup that is not yet done by the NixOS module. You can find an example configuration in the NixOS module in the Lix repo.

In future releases we plan to stabilize the RPC protocol and remove support for the legacy protocols we’ve been using to date to allow further evolution of Lix.

ssh:// store URIs are now deprecated

To enable further RPC work and resolve some long-standing security inconsistencies we must remove ssh:// store URIs. Lix 2.96 deprecates ssh:// store URIs, but retains support for them without deprecation warnings. ssh:// store URI support will be removed in Lix 2.97, ssh-ng:// URIs will remain supported.

If you are using ssh:// store URIs because ssh-ng:// is missing features you need please get in touch so we can figure something out together. Note that ssh-ng has stricter security checks than ssh and no longer allows untrusted users to copy unsigned outputs to remote stores, this is intentional.

Breaking changes

Once again Lix must break sharp corners to make improvements possible and excise surprising behavior in user code.

• flake.nix validation no longer relies on poorly documented triviality checks. Instead Lix now has only one rule for flake.nix: no function calls are allowed outside of outputs. This means that Lix now accepts let blocks and string interpolation in flake inputs, among other things. We consider this a breaking change because other Nix implementations may no longer be able to evaluate Flakes that were written using Lix.

  Many thanks to piegames, Qyriad and eldritch horrors.

• The floor and ceil builtins now throw errors if their operation wouldhave resulted in precision loss during the conversion from floating point to integers. Precision loss does not sound dramatic, but with numbers of sufficient magnitude this could result in positive floats being converted to negative integers.

  Many thanks to jade, NaN-git and rootile.

• Many nix3 CLI commands no longer build their arguments. This surprising behavior was commonly seen when nix store delete was called with a path that was not present in the store, causing the path to be downloaded just so that it could be deleted.

  Many thanks to eldritch horrors.

• Shadowing internal files via Nix search paths is now considered an error. Lix 2.95 already deprecated overriding the nix search path entry due to surprising effects that could have, Lix 2.96 now considers this an error if not explicitly configured otherwise.

  Many thanks to thubrecht, jade and eldritch horrors.

New features

• Nested arguments can be set with --arg and --argstr.

  Previously Lix would turn --arg foo.bar.baz 1 into the set { "foo.bar.baz" = 1; }, now it turns it into { foo.bar.baz = 1; }. Attribute set merging rules are applied to these sets, making it much easier to use function that expect sets as arguments (such as nixpkgs, which expects a config set). The old behavior can be recovered by quoting the name, e.g. --arg '"foo.bar.baz" 1'.

  Many thanks to ma27.

• Inputs are now only fetched by one process at a time. This can be significant in CI situations where many processes may attempt to download the same input set concurrently. Previously all of them would download the set, now only one of them does and signals the others to wait for it to finish.

  Many thanks to lheckemann.

• Use mimalloc for faster evaluation. We’ve seen 5-12% eval time improvements due to this

  Many thanks to getchoo and lovesegfault.

• nix doctor has been extended greatly, including general system information and remote builder configuration in its report. It can now also automatically connect to configured remote builders and check their state as well.

  Many thanks to rootile and raito.

• ssh-ng store URIs are now considered stable. The long-awaited feature parity between ssh and ssh-ng URIs has arrived, although only Lix 2.96 and newer will be able to take full advantage of this. Connecting to or from older Lixes or other Nix implementations will not see feature parity and silently fall back to the previous behavior.

  Many thanks to eldritch horrors.

• Channel references now support zst-compressed tarballs. This can greatly improve unpacking speed when using channels.

  Many thanks to raito and eldritch horrors.

Improvements

• The ssl-cert-file and netrc-file settings now report errors when set to files that don’t exist instead of being silently ignored.

  Many thanks to Astreaprtcl.

• Moving between stack frames in the debugger is now easier using offset instead of absolute numbers. While moving up or down some number of frames previously required remembering the frame number you were on you can now directly supply offsets, using :st +l to go from frame n to n+k and :st -k to go from n to n-k.

  Many thanks to blokyk.

• addErrorContext frames are always printed in backtraces now, even without --show-trace. This makes explicit report locations, for example in the NixOS module system, much more useful.

  Many thanks to blokyk.

Fixes

• nix-copy-closure --include-outputs now actually works.

  Many thanks to rkjnsn.

• Hash mismatch diagnostics now work with structuredAttrs. This fixes hash mismatch diagnostics with fetchers from modern nixpkgs.

  Many thanks to keysmashes.

• Subdaemons receive overridden settings from their parent daemon rather than using the system-wide configuration. This was broken by the switch to explicitly launched subdaemons in 2.95, making it impossible to configure subdaemons by providing command line arguments to the main daemon.

  Many thanks to raito.

Miscellanea

• ssh and ssh-ng store URIs no longer honor the max-connections parameter. This parameter complicated the code immensely for no benefit to the average user and had many sharp corners when set explicitly.

  Many thanks to eldritch horrors.

• The daemon-trust-override experimental feature has been removed. It can still be emulated by e.g. setting the NIX_CONFIG environment variable appropriately.

  Many thanks to eldritch horrors.

And so much more

Many more changes have gone into Lix 2.96, most of them internal. We hope to ship a stable RPC-based daemon in one of the upcoming releases, including remote build support using this new protocol.

What is planned for the future?

Lix 2.96.1

We are releasing 2.96 together with security releases on stable branches. A few things we wanted to finish for 2.96 have been delayed somewhat, and we expect to release 2.96.1 with a few more improvements soon:

• proper --keep-going support when using --store ssh-ng://..., not just when using ssh-ng remotes as remote builders
• SHA256 support for Git fetchers for both Flakes and other users
• better diagnostics on MacOS for garbage collection failures caused by TCC permissions
• .narinfo cache soundness improvements to enable key rollovers for binary caches
• allow pass more settings to the daemon and remote builders, e.g. log-lines

News from Rust integration

Rust integration has moved along apace, and it is now possible to write significant portions of new features without touching too much C++ code. We’ve decided to use zngur for interop due to its great flexibility and active maintenance, and we’ve already ported a number of features to Rust like this. The REPL is now backed by Rust, as is remote builder configuration and much of the hash conversion code.

Want to help Lix? Consider donating to Lix!

Following Lix integration in AFNix, Lix now has an Open Collective and can receive donations.

We run infrastructure across x86_64-linux, aarch64-linux, and aarch64-darwin. Some of it is in-kind and sponsored. Current costs are around 100€/month.

If you value self-hosting and benefit from Lix, please consider donating. Every contribution helps sustain the project.

Credits

Thanks, as always, to the following groups:

• The large community who beta tested the upcoming release by running main in production since the 2.95 branch-off. We really appreciate having immediate feedback on our work and the trust of running main alongside us means a lot to us. We know we tested the patience of some of you, we thank you for that.

  If you want to run Lix main yourself, see the beta guide for details.

• Everyone who contributed by filing bugs and giving us feedback on Matrix.

• All the first time contributors who made their first contributions to a Nix implementation in Lix. We are eternally grateful to everyone who helped us out on the numerous important but tedious issues.

• All the contributors who have helped us with the backlog of bugs.

• The CppNix contributors and CppNix team, without whom we would not have this software, and who wrote some of the improvements ported into this release.

Onwards and upwards for the next release. We look forward to continuing to work together with everyone to build a better foundation for the evolution of Nix.