* State components that get their state at runtime can now be (un)installed with nix-env

COPYING

@@ -1,221 +1,397 @@
-		    GNU GENERAL PUBLIC LICENSE
-		       Version 2, June 1991
+		  GNU LESSER GENERAL PUBLIC LICENSE
+		       Version 2.1, February 1999
 
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.
-     59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+ 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  Everyone is permitted to copy and distribute verbatim copies
  of this license document, but changing it is not allowed.
 
+[This is the first released version of the Lesser GPL.  It also counts
+ as the successor of the GNU Library Public License, version 2, hence
+ the version number 2.1.]
+
 			    Preamble
 
   The licenses for most software are designed to take away your
 freedom to share and change it.  By contrast, the GNU General Public
-License is intended to guarantee your freedom to share and change free
-software--to make sure the software is free for all its users.  This
-General Public License applies to most of the Free Software
-Foundation's software and to any other program whose authors commit to
-using it.  (Some other Free Software Foundation software is covered by
-the GNU Library General Public License instead.)  You can apply it to
-your programs, too.
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
 
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-this service if you wish), that you receive source code or can get it
-if you want it, that you can change the software or use pieces of it
-in new free programs; and that you know you can do these things.
+  This license, the Lesser General Public License, applies to some
+specially designated software packages--typically libraries--of the
+Free Software Foundation and other authors who decide to use it.  You
+can use it too, but we suggest you first think carefully about whether
+this license or the ordinary General Public License is the better
+strategy to use in any particular case, based on the explanations below.
+
+  When we speak of free software, we are referring to freedom of use,
+not price.  Our General Public Licenses are designed to make sure that
+you have the freedom to distribute copies of free software (and charge
+for this service if you wish); that you receive source code or can get
+it if you want it; that you can change the software and use pieces of
+it in new free programs; and that you are informed that you can do
+these things.
 
   To protect your rights, we need to make restrictions that forbid
-anyone to deny you these rights or to ask you to surrender the rights.
-These restrictions translate to certain responsibilities for you if you
-distribute copies of the software, or if you modify it.
+distributors to deny you these rights or to ask you to surrender these
+rights.  These restrictions translate to certain responsibilities for
+you if you distribute copies of the library or if you modify it.
 
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must give the recipients all the rights that
-you have.  You must make sure that they, too, receive or can get the
-source code.  And you must show them these terms so they know their
-rights.
+  For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you.  You must make sure that they, too, receive or can get the source
+code.  If you link other code with the library, you must provide
+complete object files to the recipients, so that they can relink them
+with the library after making changes to the library and recompiling
+it.  And you must show them these terms so they know their rights.
 
-  We protect your rights with two steps: (1) copyright the software, and
-(2) offer you this license which gives you legal permission to copy,
-distribute and/or modify the software.
+  We protect your rights with a two-step method: (1) we copyright the
+library, and (2) we offer you this license, which gives you legal
+permission to copy, distribute and/or modify the library.
 
-  Also, for each author's protection and ours, we want to make certain
-that everyone understands that there is no warranty for this free
-software.  If the software is modified by someone else and passed on, we
-want its recipients to know that what they have is not the original, so
-that any problems introduced by others will not reflect on the original
-authors' reputations.
+  To protect each distributor, we want to make it very clear that
+there is no warranty for the free library.  Also, if the library is
+modified by someone else and passed on, the recipients should know
+that what they have is not the original version, so that the original
+author's reputation will not be affected by problems that might be
+introduced by others.
+
+  Finally, software patents pose a constant threat to the existence of
+any free program.  We wish to make sure that a company cannot
+effectively restrict the users of a free program by obtaining a
+restrictive license from a patent holder.  Therefore, we insist that
+any patent license obtained for a version of the library must be
+consistent with the full freedom of use specified in this license.
 
-  Finally, any free program is threatened constantly by software
-patents.  We wish to avoid the danger that redistributors of a free
-program will individually obtain patent licenses, in effect making the
-program proprietary.  To prevent this, we have made it clear that any
-patent must be licensed for everyone's free use or not licensed at all.
+  Most GNU software, including some libraries, is covered by the
+ordinary GNU General Public License.  This license, the GNU Lesser
+General Public License, applies to certain designated libraries, and
+is quite different from the ordinary General Public License.  We use
+this license for certain libraries in order to permit linking those
+libraries into non-free programs.
+
+  When a program is linked with a library, whether statically or using
+a shared library, the combination of the two is legally speaking a
+combined work, a derivative of the original library.  The ordinary
+General Public License therefore permits such linking only if the
+entire combination fits its criteria of freedom.  The Lesser General
+Public License permits more lax criteria for linking other code with
+the library.
+
+  We call this license the "Lesser" General Public License because it
+does Less to protect the user's freedom than the ordinary General
+Public License.  It also provides other free software developers Less
+of an advantage over competing non-free programs.  These disadvantages
+are the reason we use the ordinary General Public License for many
+libraries.  However, the Lesser license provides advantages in certain
+special circumstances.
+
+  For example, on rare occasions, there may be a special need to
+encourage the widest possible use of a certain library, so that it becomes
+a de-facto standard.  To achieve this, non-free programs must be
+allowed to use the library.  A more frequent case is that a free
+library does the same job as widely used non-free libraries.  In this
+case, there is little to gain by limiting the free library to free
+software only, so we use the Lesser General Public License.
+
+  In other cases, permission to use a particular library in non-free
+programs enables a greater number of people to use a large body of
+free software.  For example, permission to use the GNU C Library in
+non-free programs enables many more people to use the whole GNU
+operating system, as well as its variant, the GNU/Linux operating
+system.
+
+  Although the Lesser General Public License is Less protective of the
+users' freedom, it does ensure that the user of a program that is
+linked with the Library has the freedom and the wherewithal to run
+that program using a modified version of the Library.
 
   The precise terms and conditions for copying, distribution and
-modification follow.
+modification follow.  Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library".  The
+former contains code derived from the library, whereas the latter must
+be combined with the library in order to run.
 
-		    GNU GENERAL PUBLIC LICENSE
+		  GNU LESSER GENERAL PUBLIC LICENSE
    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
 
-  0. This License applies to any program or other work which contains
-a notice placed by the copyright holder saying it may be distributed
-under the terms of this General Public License.  The "Program", below,
-refers to any such program or work, and a "work based on the Program"
-means either the Program or any derivative work under copyright law:
-that is to say, a work containing the Program or a portion of it,
-either verbatim or with modifications and/or translated into another
-language.  (Hereinafter, translation is included without limitation in
-the term "modification".)  Each licensee is addressed as "you".
+  0. This License Agreement applies to any software library or other
+program which contains a notice placed by the copyright holder or
+other authorized party saying it may be distributed under the terms of
+this Lesser General Public License (also called "this License").
+Each licensee is addressed as "you".
 
-Activities other than copying, distribution and modification are not
+  A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+  The "Library", below, refers to any such software library or work
+which has been distributed under these terms.  A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language.  (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+  "Source code" for a work means the preferred form of the work for
+making modifications to it.  For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+  Activities other than copying, distribution and modification are not
 covered by this License; they are outside its scope.  The act of
-running the Program is not restricted, and the output from the Program
-is covered only if its contents constitute a work based on the
-Program (independent of having been made by running the Program).
-Whether that is true depends on what the Program does.
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it).  Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+  
+  1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
 
-  1. You may copy and distribute verbatim copies of the Program's
-source code as you receive it, in any medium, provided that you
-conspicuously and appropriately publish on each copy an appropriate
-copyright notice and disclaimer of warranty; keep intact all the
-notices that refer to this License and to the absence of any warranty;
-and give any other recipients of the Program a copy of this License
-along with the Program.
-
-You may charge a fee for the physical act of transferring a copy, and
-you may at your option offer warranty protection in exchange for a fee.
-
-  2. You may modify your copy or copies of the Program or any portion
-of it, thus forming a work based on the Program, and copy and
+  You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+  2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
 distribute such modifications or work under the terms of Section 1
 above, provided that you also meet all of these conditions:
 
-    a) You must cause the modified files to carry prominent notices
+    a) The modified work must itself be a software library.
+
+    b) You must cause the files modified to carry prominent notices
     stating that you changed the files and the date of any change.
 
-    b) You must cause any work that you distribute or publish, that in
-    whole or in part contains or is derived from the Program or any
-    part thereof, to be licensed as a whole at no charge to all third
-    parties under the terms of this License.
+    c) You must cause the whole of the work to be licensed at no
+    charge to all third parties under the terms of this License.
+
+    d) If a facility in the modified Library refers to a function or a
+    table of data to be supplied by an application program that uses
+    the facility, other than as an argument passed when the facility
+    is invoked, then you must make a good faith effort to ensure that,
+    in the event an application does not supply such function or
+    table, the facility still operates, and performs whatever part of
+    its purpose remains meaningful.
+
+    (For example, a function in a library to compute square roots has
+    a purpose that is entirely well-defined independent of the
+    application.  Therefore, Subsection 2d requires that any
+    application-supplied function or table used by this function must
+    be optional: if the application does not supply it, the square
+    root function must still compute square roots.)
 
-    c) If the modified program normally reads commands interactively
-    when run, you must cause it, when started running for such
-    interactive use in the most ordinary way, to print or display an
-    announcement including an appropriate copyright notice and a
-    notice that there is no warranty (or else, saying that you provide
-    a warranty) and that users may redistribute the program under
-    these conditions, and telling the user how to view a copy of this
-    License.  (Exception: if the Program itself is interactive but
-    does not normally print such an announcement, your work based on
-    the Program is not required to print an announcement.)
-
 These requirements apply to the modified work as a whole.  If
-identifiable sections of that work are not derived from the Program,
+identifiable sections of that work are not derived from the Library,
 and can be reasonably considered independent and separate works in
 themselves, then this License, and its terms, do not apply to those
 sections when you distribute them as separate works.  But when you
 distribute the same sections as part of a whole which is a work based
-on the Program, the distribution of the whole must be on the terms of
+on the Library, the distribution of the whole must be on the terms of
 this License, whose permissions for other licensees extend to the
-entire whole, and thus to each and every part regardless of who wrote it.
+entire whole, and thus to each and every part regardless of who wrote
+it.
 
 Thus, it is not the intent of this section to claim rights or contest
 your rights to work written entirely by you; rather, the intent is to
 exercise the right to control the distribution of derivative or
-collective works based on the Program.
+collective works based on the Library.
 
-In addition, mere aggregation of another work not based on the Program
-with the Program (or with a work based on the Program) on a volume of
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
 a storage or distribution medium does not bring the other work under
 the scope of this License.
 
-  3. You may copy and distribute the Program (or a work based on it,
-under Section 2) in object code or executable form under the terms of
-Sections 1 and 2 above provided that you also do one of the following:
-
-    a) Accompany it with the complete corresponding machine-readable
-    source code, which must be distributed under the terms of Sections
-    1 and 2 above on a medium customarily used for software interchange; or,
-
-    b) Accompany it with a written offer, valid for at least three
-    years, to give any third party, for a charge no more than your
-    cost of physically performing source distribution, a complete
-    machine-readable copy of the corresponding source code, to be
-    distributed under the terms of Sections 1 and 2 above on a medium
-    customarily used for software interchange; or,
-
-    c) Accompany it with the information you received as to the offer
-    to distribute corresponding source code.  (This alternative is
-    allowed only for noncommercial distribution and only if you
-    received the program in object code or executable form with such
-    an offer, in accord with Subsection b above.)
-
-The source code for a work means the preferred form of the work for
-making modifications to it.  For an executable work, complete source
-code means all the source code for all modules it contains, plus any
-associated interface definition files, plus the scripts used to
-control compilation and installation of the executable.  However, as a
-special exception, the source code distributed need not include
-anything that is normally distributed (in either source or binary
-form) with the major components (compiler, kernel, and so on) of the
-operating system on which the executable runs, unless that component
-itself accompanies the executable.
-
-If distribution of executable or object code is made by offering
-access to copy from a designated place, then offering equivalent
-access to copy the source code from the same place counts as
-distribution of the source code, even though third parties are not
-compelled to copy the source along with the object code.
+  3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library.  To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License.  (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.)  Do not make any other change in
+these notices.
 
-  4. You may not copy, modify, sublicense, or distribute the Program
-except as expressly provided under this License.  Any attempt
-otherwise to copy, modify, sublicense or distribute the Program is
-void, and will automatically terminate your rights under this License.
-However, parties who have received copies, or rights, from you under
-this License will not have their licenses terminated so long as such
-parties remain in full compliance.
+  Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
 
-  5. You are not required to accept this License, since you have not
+  This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+  4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+  If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library".  Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+  However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library".  The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+  When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library.  The
+threshold for this to be true is not precisely defined by law.
+
+  If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work.  (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+  Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+  6. As an exception to the Sections above, you may also combine or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+  You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License.  You must supply a copy of this License.  If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License.  Also, you must do one
+of these things:
+
+    a) Accompany the work with the complete corresponding
+    machine-readable source code for the Library including whatever
+    changes were used in the work (which must be distributed under
+    Sections 1 and 2 above); and, if the work is an executable linked
+    with the Library, with the complete machine-readable "work that
+    uses the Library", as object code and/or source code, so that the
+    user can modify the Library and then relink to produce a modified
+    executable containing the modified Library.  (It is understood
+    that the user who changes the contents of definitions files in the
+    Library will not necessarily be able to recompile the application
+    to use the modified definitions.)
+
+    b) Use a suitable shared library mechanism for linking with the
+    Library.  A suitable mechanism is one that (1) uses at run time a
+    copy of the library already present on the user's computer system,
+    rather than copying library functions into the executable, and (2)
+    will operate properly with a modified version of the library, if
+    the user installs one, as long as the modified version is
+    interface-compatible with the version that the work was made with.
+
+    c) Accompany the work with a written offer, valid for at
+    least three years, to give the same user the materials
+    specified in Subsection 6a, above, for a charge no more
+    than the cost of performing this distribution.
+
+    d) If distribution of the work is made by offering access to copy
+    from a designated place, offer equivalent access to copy the above
+    specified materials from the same place.
+
+    e) Verify that the user has already received a copy of these
+    materials or that you have already sent this user a copy.
+
+  For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it.  However, as a special exception,
+the materials to be distributed need not include anything that is
+normally distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+  It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system.  Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+  7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+    a) Accompany the combined library with a copy of the same work
+    based on the Library, uncombined with any other library
+    facilities.  This must be distributed under the terms of the
+    Sections above.
+
+    b) Give prominent notice with the combined library of the fact
+    that part of it is a work based on the Library, and explaining
+    where to find the accompanying uncombined form of the same work.
+
+  8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License.  Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License.  However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+  9. You are not required to accept this License, since you have not
 signed it.  However, nothing else grants you permission to modify or
-distribute the Program or its derivative works.  These actions are
+distribute the Library or its derivative works.  These actions are
 prohibited by law if you do not accept this License.  Therefore, by
-modifying or distributing the Program (or any work based on the
-Program), you indicate your acceptance of this License to do so, and
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
 all its terms and conditions for copying, distributing or modifying
-the Program or works based on it.
+the Library or works based on it.
 
-  6. Each time you redistribute the Program (or any work based on the
-Program), the recipient automatically receives a license from the
-original licensor to copy, distribute or modify the Program subject to
-these terms and conditions.  You may not impose any further
+  10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions.  You may not impose any further
 restrictions on the recipients' exercise of the rights granted herein.
-You are not responsible for enforcing compliance by third parties to
+You are not responsible for enforcing compliance by third parties with
 this License.
-
-  7. If, as a consequence of a court judgment or allegation of patent
+
+  11. If, as a consequence of a court judgment or allegation of patent
 infringement or for any other reason (not limited to patent issues),
 conditions are imposed on you (whether by court order, agreement or
 otherwise) that contradict the conditions of this License, they do not
 excuse you from the conditions of this License.  If you cannot
 distribute so as to satisfy simultaneously your obligations under this
 License and any other pertinent obligations, then as a consequence you
-may not distribute the Program at all.  For example, if a patent
-license would not permit royalty-free redistribution of the Program by
+may not distribute the Library at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Library by
 all those who receive copies directly or indirectly through you, then
 the only way you could satisfy both it and this License would be to
-refrain entirely from distribution of the Program.
+refrain entirely from distribution of the Library.
 
-If any portion of this section is held invalid or unenforceable under
-any particular circumstance, the balance of the section is intended to
-apply and the section as a whole is intended to apply in other
-circumstances.
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply,
+and the section as a whole is intended to apply in other circumstances.
 
 It is not the purpose of this section to induce you to infringe any
 patents or other property right claims or to contest validity of any
 such claims; this section has the sole purpose of protecting the
-integrity of the free software distribution system, which is
+integrity of the free software distribution system which is
 implemented by public license practices.  Many people have made
 generous contributions to the wide range of software distributed
 through that system in reliance on consistent application of that
@@ -225,116 +401,104 @@ impose that choice.
 
 This section is intended to make thoroughly clear what is believed to
 be a consequence of the rest of this License.
-
-  8. If the distribution and/or use of the Program is restricted in
+
+  12. If the distribution and/or use of the Library is restricted in
 certain countries either by patents or by copyrighted interfaces, the
-original copyright holder who places the Program under this License
-may add an explicit geographical distribution limitation excluding
-those countries, so that distribution is permitted only in or among
-countries not thus excluded.  In such case, this License incorporates
-the limitation as if written in the body of this License.
+original copyright holder who places the Library under this License may add
+an explicit geographical distribution limitation excluding those countries,
+so that distribution is permitted only in or among countries not thus
+excluded.  In such case, this License incorporates the limitation as if
+written in the body of this License.
 
-  9. The Free Software Foundation may publish revised and/or new versions
-of the General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
+  13. The Free Software Foundation may publish revised and/or new
+versions of the Lesser General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
 
-Each version is given a distinguishing version number.  If the Program
-specifies a version number of this License which applies to it and "any
-later version", you have the option of following the terms and conditions
-either of that version or of any later version published by the Free
-Software Foundation.  If the Program does not specify a version number of
-this License, you may choose any version ever published by the Free Software
-Foundation.
-
-  10. If you wish to incorporate parts of the Program into other free
-programs whose distribution conditions are different, write to the author
-to ask for permission.  For software which is copyrighted by the Free
-Software Foundation, write to the Free Software Foundation; we sometimes
-make exceptions for this.  Our decision will be guided by the two goals
-of preserving the free status of all derivatives of our free software and
-of promoting the sharing and reuse of software generally.
+Each version is given a distinguishing version number.  If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation.  If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+  14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission.  For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this.  Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
 
 			    NO WARRANTY
 
-  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
-FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
-OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
-PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
-OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
-TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
-PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
-REPAIR OR CORRECTION.
+  15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU.  SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
 
-  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
-REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
-INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
-OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
-TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
-YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
-PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGES.
+  16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
 
 		     END OF TERMS AND CONDITIONS
 
-	    How to Apply These Terms to Your New Programs
+           How to Apply These Terms to Your New Libraries
 
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
+  If you develop a new library, and you want it to be of the greatest
+possible use to the public, we recommend making it free software that
+everyone can redistribute and change.  You can do so by permitting
+redistribution under these terms (or, alternatively, under the terms of the
+ordinary General Public License).
 
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-convey the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
+  To apply these terms, attach the following notices to the library.  It is
+safest to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least the
+"copyright" line and a pointer to where the full notice is found.
 
-    <one line to give the program's name and a brief idea of what it does.>
+    <one line to give the library's name and a brief idea of what it does.>
     Copyright (C) <year>  <name of author>
 
-    This program is free software; you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation; either version 2 of the License, or
-    (at your option) any later version.
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Lesser General Public
+    License as published by the Free Software Foundation; either
+    version 2.1 of the License, or (at your option) any later version.
 
-    This program is distributed in the hope that it will be useful,
+    This library is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Lesser General Public License for more details.
 
+    You should have received a copy of the GNU Lesser General Public
+    License along with this library; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 
 Also add information on how to contact you by electronic and paper mail.
 
-If the program is interactive, make it output a short notice like this
-when it starts in an interactive mode:
-
-    Gnomovision version 69, Copyright (C) year  name of author
-    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, the commands you use may
-be called something other than `show w' and `show c'; they could even be
-mouse-clicks or menu items--whatever suits your program.
-
 You should also get your employer (if you work as a programmer) or your
-school, if any, to sign a "copyright disclaimer" for the program, if
+school, if any, to sign a "copyright disclaimer" for the library, if
 necessary.  Here is a sample; alter the names:
 
-  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
-  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the
+  library `Frob' (a library for tweaking knobs) written by James Random Hacker.
 
-  <signature of Ty Coon>, 1 April 1989
+  <signature of Ty Coon>, 1 April 1990
   Ty Coon, President of Vice
 
-This General Public License does not permit incorporating your program into
-proprietary programs.  If your program is a subroutine library, you may
-consider it more useful to permit linking proprietary applications with the
-library.  If this is what you want to do, use the GNU Library General
-Public License instead of this License.
+That's all there is to it!
+
+

Makefile.am

@@ -1,6 +1,6 @@
 SUBDIRS = externals src scripts corepkgs doc misc tests
 EXTRA_DIST = substitute.mk nix.spec nix.spec.in bootstrap.sh \
-  svn-revision nix.conf.example
+  svn-revision nix.conf.example NEWS
 
 include ./substitute.mk
 
@@ -14,16 +14,17 @@ relname:
 
 install-data-local: init-state
 	$(INSTALL) -d $(DESTDIR)$(sysconfdir)/nix
-	$(INSTALL_DATA) nix.conf.example $(DESTDIR)$(sysconfdir)/nix
+	$(INSTALL_DATA) $(srcdir)/nix.conf.example $(DESTDIR)$(sysconfdir)/nix
 	if ! test -e $(DESTDIR)$(sysconfdir)/nix/nix.conf; then \
-		$(INSTALL_DATA) nix.conf.example $(DESTDIR)$(sysconfdir)/nix/nix.conf; \
+		$(INSTALL_DATA) $(srcdir)/nix.conf.example $(DESTDIR)$(sysconfdir)/nix/nix.conf; \
 	fi
 
 if INIT_STATE
-if SETUID_HACK
-INIT_FLAGS = -g @NIX_GROUP@ -o @NIX_USER@
-GROUP_WRITABLE = -m 775
-endif
+
+# For setuid operation, you can enable the following:
+# INIT_FLAGS = -g @NIX_GROUP@ -o @NIX_USER@
+# GROUP_WRITABLE = -m 775
+
 init-state:
 	$(INSTALL) $(INIT_FLAGS) -d $(DESTDIR)$(localstatedir)/nix
 	$(INSTALL) $(INIT_FLAGS) -d $(DESTDIR)$(localstatedir)/nix/db
@@ -34,14 +35,27 @@ init-state:
 	$(INSTALL) $(INIT_FLAGS) -d $(DESTDIR)$(localstatedir)/nix/temproots
 	$(INSTALL) $(INIT_FLAGS) $(GROUP_WRITABLE) -d $(DESTDIR)$(localstatedir)/nix/gcroots/tmp
 	$(INSTALL) $(INIT_FLAGS) $(GROUP_WRITABLE) -d $(DESTDIR)$(localstatedir)/nix/gcroots/channels
-	rm -f $(DESTDIR)$(localstatedir)/nix/gcroots/profiles
-	ln -s $(localstatedir)/nix/profiles $(DESTDIR)$(localstatedir)/nix/gcroots/profiles
-	$(INSTALL) $(INIT_FLAGS) -d $(DESTDIR)$(prefix)/store
+	ln -sfn $(localstatedir)/nix/profiles $(DESTDIR)$(localstatedir)/nix/gcroots/profiles
+	$(INSTALL) $(INIT_FLAGS) -d $(DESTDIR)$(localstatedir)/nix/userpool
+	$(INSTALL) $(INIT_FLAGS) -m 1777 -d $(DESTDIR)$(prefix)/store
 	$(INSTALL) $(INIT_FLAGS) $(GROUP_WRITABLE) -d $(DESTDIR)$(localstatedir)/nix/manifests
+	ln -sfn $(localstatedir)/nix/manifests $(DESTDIR)$(localstatedir)/nix/gcroots/manifests
 #	$(bindir)/nix-store --init
+
 else
 init-state:
 endif
 
+init-ext3cow-header-hack:
+	@echo "Symlinking ext3cow header file into src"
+	ln -sf $(ext3cowheader) src/libext3cow/
+
 svn-revision:
 	svnversion . > svn-revision
+
+all: init-ext3cow-header-hack
+
+all-local: NEWS
+
+NEWS: doc/manual/NEWS.txt
+	cp $(srcdir)/doc/manual/NEWS.txt NEWS

NEWS

@@ -1,261 +0,0 @@
-Version 0.9
-
-* Unpacking of patch sequences is much faster now by not doing
-  redundant unpacking and repacking of intermediate paths.
-
-
-Version 0.8 (April 11, 2005)
-
-NOTE: the hashing scheme in Nix 0.8 changed (as detailed below).  As a
-result, `nix-pull' manifests and channels built for Nix 0.7 and below
-will now work anymore.  However, the Nix expression language has not
-changed, so you can still build from source.  Also, existing user
-environments continue to work.  Nix 0.8 will automatically upgrade the
-database schema of previous installations when it is first run.
-
-If you get the error message
-
-  you have an old-style manifest `/nix/var/nix/manifests/[...]';
-  please delete it
-
-you should delete previously downloaded manifests:
-
-  $ rm /nix/var/nix/manifests/*
-
-If `nix-channel' gives the error message
-
-  manifest `http://catamaran.labs.cs.uu.nl/dist/nix/channels/[channel]/MANIFEST'
-  is too old (i.e., for Nix <= 0.7)
-
-then you should unsubscribe from the offending channel (`nix-channel
---remove URL'; leave out `/MANIFEST'), and subscribe to the same URL,
-with `channels' replaced by `channels-v3' (e.g.,
-http://catamaran.labs.cs.uu.nl/dist/nix/channels-v3/nixpkgs-unstable).
-
-Nix 0.8 has the following improvements:
-
-* The cryptographic hashes used in store paths are now 160 bits long,
-  but encoded in base-32 so that they are still only 32 characters
-  long (e.g., /nix/store/csw87wag8bqlqk7ipllbwypb14xainap-atk-1.9.0).
-  (This is actually a 160 bit truncation of a SHA-256 hash.)
-
-* Big cleanups and simplifications of the basic store semantics.  The
-  notion of "closure store expressions" is gone (and so is the notion
-  of "successors"); the file system references of a store path are now
-  just stored in the database.
-
-  For instance, given any store path, you can query its closure:
-
-    $ nix-store -qR $(which firefox)
-    ... lots of paths ...
-
-  Also, Nix now remembers for each store path the derivation that
-  built it (the "deriver"):
-
-    $ nix-store -qR $(which firefox)
-    /nix/store/4b0jx7vq80l9aqcnkszxhymsf1ffa5jd-firefox-1.0.1.drv
-
-  So to see the build-time dependencies, you can do
-  
-    $ nix-store -qR $(nix-store -qd $(which firefox))
-
-  or, in a nicer format:
-
-    $ nix-store -q --tree $(nix-store -qd $(which firefox))
-
-  File system references are also stored in reverse.  For instance,
-  you can query all paths that directly or indirectly use a certain
-  Glibc:
-
-    $ nix-store -q --referers-closure \
-        /nix/store/8lz9yc6zgmc0vlqmn2ipcpkjlmbi51vv-glibc-2.3.4
-
-* The concept of fixed-output derivations has been formalised.
-  Previously, functions such as `fetchurl' in Nixpkgs used a hack
-  (namely, explicitly specifying a store path hash) to prevent changes
-  to, say, the URL of the file from propagating upwards through the
-  dependency graph, causing rebuilds of everything.  This can now be
-  done cleanly by specifying the `outputHash' and `outputHashAlgo'
-  attributes.  Nix itself checks that the content of the output has
-  the specified hash.  (This is important for maintaining certain
-  invariants necessary for future work on secure shared stores.)
-
-* One-click installation :-)  It is now possible to install any
-  top-level component in Nixpkgs directly, through the web - see,
-  e.g., http://catamaran.labs.cs.uu.nl/dist/nixpkgs-0.8/.  All you
-  have to do is associate `/nix/bin/nix-install-package' with the MIME
-  type `application/nix-package' (or the extension `.nixpkg'), and
-  clicking on a package link will cause it to be installed, with all
-  appropriate dependencies.  If you just want to install some specific
-  application, this is easier than subscribing to a channel.
-
-* `nix-store -r PATHS' now builds all the derivations PATHS in
-  parallel.  Previously it did them sequentially (though exploiting
-  possible parallelism between subderivations).  This is nice for
-  build farms.
-
-* `nix-channel' has new operations `--list' and `--remove'.
-
-* New ways of installing components into user environments:
-
-  - Copy from another user environment:
-
-      $ nix-env -i --from-profile .../other-profile firefox
-
-  - Install a store derivation directly (bypassing the Nix expression
-    language entirely):
-
-      $ nix-env -i /nix/store/z58v41v21xd3...-aterm-2.3.1.drv
-
-    (This is used to implement `nix-install-package', which is
-    therefore immune to evolution in the Nix expression language.)
-
-  - Install an already built store path directly:
-
-      $ nix-env -i /nix/store/hsyj5pbn0d9i...-aterm-2.3.1
-
-  - Install the result of a Nix expression specified as a command-line
-    argument:
-
-      $ nix-env -f .../i686-linux.nix -i -E 'x: x.firefoxWrapper'
-
-    The difference with the normal installation mode is that `-E' does
-    not use the `name' attributes of derivations.  Therefore, this can
-    be used to disambiguate multiple derivations with the same name.
-
-* A hash of the contents of a store path is now stored in the database
-  after a succesful build.  This allows you to check whether store
-  paths have been tampered with: `nix-store --verify --check-contents'.
-    
-* Implemented a concurrent garbage collector.  It is now always safe
-  to run the garbage collector, even if other Nix operations are
-  happening simultaneously.
-
-  However, there can still be GC races if you use `nix-instantiate'
-  and `nix-store -r' directly to build things.  To prevent races, use
-  the `--add-root' flag of those commands.
-
-* The garbage collector now finally deletes paths in the right order
-  (i.e., topologically sorted under the `references' relation), thus
-  making it safe to interrupt the collector without risking a store
-  that violates the closure invariant.
-
-* Likewise, the substitute mechanism now downloads files in the right
-  order, thus preserving the closure invariant at all times.
-
-* The result of `nix-build' is now registered as a root of the garbage
-  collector.  If the `./result' link is deleted, the GC root
-  disappears automatically.
-
-* The behaviour of the garbage collector can be changed globally by
-  setting options in `/nix/etc/nix/nix.conf'.
-
-  - `gc-keep-derivations' specifies whether deriver links should be
-    followed when searching for live paths.
-
-  - `gc-keep-outputs' specifies whether outputs of derivations should
-    be followed when searching for live paths.
-  
-  - `env-keep-derivations' specifies whether user environments should
-    store the paths of derivations when they are added (thus keeping
-    the derivations alive).
-
-* New `nix-env' query flags `--drv-path' and `--out-path'.
-
-* `fetchurl' allows SHA-1 and SHA-256 in addition to MD5.  Just
-  specify the attribute `sha1' or `sha256' instead of `md5'.
-
-* Manual updates.
-
-  
-Version 0.7 (January 12, 2005)
-
-* Binary patching.  When upgrading components using pre-built binaries
-  (through nix-pull / nix-channel), Nix can automatically download and
-  apply binary patches to already installed components instead of full
-  downloads.  Patching is "smart": if there is a *sequence* of patches
-  to an installed component, Nix will use it.  Patches are currently
-  generated automatically between Nixpkgs (pre-)releases.
-
-* Simplifications to the substitute mechanism.
-
-* Nix-pull now stores downloaded manifests in /nix/var/nix/manifests.
-
-* Metadata on files in the Nix store is canonicalised after builds:
-  the last-modified timestamp is set to 0 (00:00:00 1/1/1970), the
-  mode is set to 0444 or 0555 (readable and possibly executable by
-  all; setuid/setgid bits are dropped), and the group is set to the
-  default.  This ensures that the result of a build and an
-  installation through a substitute is the same; and that timestamp
-  dependencies are revealed.
-
-
-Version 0.6 (November 14, 2004)
-
-Major changes include the following:
-
-* Rewrite of the normalisation engine.
-
-  * Multiple builds can now be performed in parallel (option `-j').
-
-  * Distributed builds.  Nix can now call a shell script to forward
-    builds to Nix installations on remote machines, which may or may
-    not be of the same platform type.
-
-  * Option `--fallback' allows recovery from broken substitutes.
-
-  * Option `--keep-going' causes building of other (unaffected)
-    derivations to continue if one failed.
-    
-* Improvements to the garbage collector (i.e., it should actually work
-  now).
-
-* Setuid Nix installations allow a Nix store to be shared among
-  multiple users.
-
-* Substitute registration is much faster now.
-
-* A utility `nix-build' to build a Nix expression and create a symlink
-  to the result int the current directory; useful for testing Nix
-  derivations.
-
-* Manual updates.
-
-* `nix-env' changes:
-
-  * Derivations for other platforms are filtered out (which can be
-    overriden using `--system-filter').
-
-  * `--install' by default now uninstall previous derivations with the
-    same name.
-
-  * `--upgrade' allows upgrading to a specific version.
-
-  * New operation `--delete-generations' to remove profile
-    generations (necessary for effective garbage collection).
-
-  * Nicer output (sorted, columnised).
-
-* More sensible verbosity levels all around (builder output is now
-  shown always, unless `-Q' is given).
-
-* Nix expression language changes:
-
-  * New language construct: `with E1; E2' brings all attributes
-    defined in the attribute set E1 in scope in E2.
-
-  * Added a `map' function.
-
-  * Various new operators (e.g., string concatenation).
-
-* Expression evaluation is much faster.
-
-* An Emacs mode for editing Nix expressions (with syntax highlighting
-  and indentation) has been added.
-
-* Many bug fixes.
-
-
-Version 0.5 and earlier
-
-Please refer to the Subversion commit log messages.

TODO

@@ -0,0 +1,3 @@
+- runtimeStateArgs now must be set to someting (or it will see it as a hardcoded path)
+- import and export of state paths
+- 

aterm-gc.supp

@@ -0,0 +1,184 @@
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Cond
+   fun:mark_memory_young
+   fun:mark_phase_young
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Cond
+   fun:AT_isValidSymbol
+   fun:mark_memory_young
+   fun:mark_phase_young
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Value4
+   fun:AT_isValidSymbol
+   fun:mark_memory_young
+   fun:mark_phase_young
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Value4
+   fun:mark_memory_young
+   fun:mark_phase_young
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Value4
+   fun:AT_isInsideValidTerm
+   fun:mark_memory_young
+   fun:mark_phase_young
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Cond
+   fun:AT_isInsideValidTerm
+   fun:mark_memory_young
+   fun:mark_phase_young
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Value4
+   fun:mark_memory_young
+   fun:mark_phase_young
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Value4
+   fun:AT_markTerm_young
+   fun:mark_memory_young
+   fun:mark_phase_young
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Cond
+   fun:AT_markTerm_young
+   fun:mark_memory_young
+   fun:mark_phase_young
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Cond
+   fun:mark_memory
+   fun:mark_phase
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Value4
+   fun:mark_memory
+   fun:mark_phase
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Cond
+   fun:AT_isValidSymbol
+   fun:mark_memory
+   fun:mark_phase
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Value4
+   fun:AT_isValidSymbol
+   fun:mark_memory
+   fun:mark_phase
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Value4
+   fun:AT_isInsideValidTerm
+   fun:mark_memory
+   fun:mark_phase
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Cond
+   fun:AT_isInsideValidTerm
+   fun:mark_memory
+   fun:mark_phase
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Cond
+   fun:AT_markTerm
+   fun:mark_memory
+   fun:mark_phase
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Value4
+   fun:AT_markTerm
+   fun:mark_memory
+   fun:mark_phase
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Value4
+   fun:AT_markTerm
+   fun:mark_memory
+   fun:mark_phase
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Cond
+   fun:mark_phase_young
+   fun:AT_collect_minor
+}
+
+{
+   ATerm library conservatively scans for GC roots
+   Memcheck:Value4
+   fun:mark_phase_young
+   fun:AT_collect_minor
+}
+
+{
+   <insert a suppression name here>
+   Memcheck:Cond
+   fun:AT_isValidSymbol
+   fun:mark_phase_young
+   fun:AT_collect_minor
+}
+
+{
+   <insert a suppression name here>
+   Memcheck:Value4
+   fun:AT_isValidSymbol
+   fun:mark_phase_young
+   fun:AT_collect_minor
+}
+
+{
+   <insert a suppression name here>
+   Memcheck:Value4
+   fun:AT_isInsideValidTerm
+   fun:mark_phase_young
+   fun:AT_collect_minor
+}
+
+{
+   <insert a suppression name here>
+   Memcheck:Cond
+   fun:AT_isInsideValidTerm
+   fun:mark_phase_young
+   fun:AT_collect_minor
+}

bootstrap.sh

@@ -1,4 +1,6 @@
 #! /bin/sh -e
+mkdir -p config
+libtoolize --force --copy
 aclocal
 autoheader
 automake --add-missing --copy

configure.ac

@@ -1,25 +1,28 @@
-AC_INIT(nix, "0.9")
+AC_INIT(nix, 0.12)
 AC_CONFIG_SRCDIR(README)
 AC_CONFIG_AUX_DIR(config)
-AM_INIT_AUTOMAKE([dist-bzip2])
-
+AM_INIT_AUTOMAKE([dist-bzip2 foreign])
+        
 # Change to `1' to produce a `stable' release (i.e., the `preREVISION'
 # suffix is not added).
 STABLE=0
 
 # Put the revision number in the version.
 if test "$STABLE" != "1"; then
-    if REVISION=`test -d $srcdir/.svn && svnversion $srcdir 2> /dev/null`; then
-        VERSION="${VERSION}pre${REVISION}"
+    if REVISION=`test -d $srcdir/.svn && svnversion -n $srcdir 2> /dev/null`; then
+        VERSION=${VERSION}pre${REVISION}
     elif REVISION=`cat $srcdir/svn-revision 2> /dev/null`; then
-        VERSION="${VERSION}pre${REVISION}"
+        VERSION=${VERSION}pre${REVISION}
     fi
 fi
 
+AC_DEFINE_UNQUOTED(NIX_VERSION, ["$VERSION"], [version])
+
 AC_PREFIX_DEFAULT(/nix)
 
 AC_CANONICAL_HOST
 
+
 # Construct a Nix system name (like "i686-linux").
 AC_MSG_CHECKING([for the canonical Nix system name])
 cpu_name=$(uname -p | tr 'A-Z ' 'a-z_')
@@ -29,6 +32,12 @@ case $machine_name in
     i*86)
         machine_name=i686
         ;;
+    x86_64)
+        machine_name=x86_64
+        ;;
+    ppc)
+        machine_name=powerpc
+        ;;
     *)
         if test "$cpu_name" != "unknown"; then
             machine_name=$cpu_name
@@ -37,6 +46,13 @@ case $machine_name in
 esac
 
 sys_name=$(uname -s | tr 'A-Z ' 'a-z_')
+
+case $sys_name in
+    cygwin*)
+        sys_name=cygwin
+        ;;
+esac
+
 AC_ARG_WITH(system, AC_HELP_STRING([--with-system=SYSTEM],
   [platform identifier (e.g., `i686-linux')]),
   system=$withval, system="${machine_name}-${sys_name}")
@@ -44,9 +60,32 @@ AC_MSG_RESULT($system)
 AC_SUBST(system)
 AC_DEFINE_UNQUOTED(SYSTEM, ["$system"], [platform identifier (`cpu-os')])
 
+
+# Windows-specific stuff.
+if test "$sys_name" = "cygwin"; then
+    # We cannot delete open files.
+    AC_DEFINE(CANNOT_DELETE_OPEN_FILES, 1, [Whether it is impossible to delete open files.])
+
+    # Shared libraries don't work, currently.
+    AC_DISABLE_SHARED
+    AC_ENABLE_STATIC
+fi
+
+
 AC_PROG_CC
 AC_PROG_CXX
-AC_PROG_RANLIB
+
+
+# We are going to use libtool.
+AC_DISABLE_STATIC
+AC_ENABLE_SHARED
+AC_PROG_LIBTOOL
+
+
+# Use 64-bit file system calls so that we can support files > 2 GiB.
+CFLAGS="-D_FILE_OFFSET_BITS=64 $CFLAGS"
+CXXFLAGS="-D_FILE_OFFSET_BITS=64 $CXXFLAGS"
+
 
 # Check for pubsetbuf.
 AC_MSG_CHECKING([for pubsetbuf])
@@ -59,11 +98,23 @@ static char buf[1024];]],
     AC_MSG_RESULT(no))
 AC_LANG_POP(C++)
 
+
+# Check for chroot support (requires chroot() and bind mounts).
+AC_CHECK_FUNCS([chroot])
+AC_CHECK_HEADERS([sys/param.h], [], [], [])
+AC_CHECK_HEADERS([sys/mount.h], [], [],
+[#ifdef HAVE_SYS_PARAM_H
+# include <sys/param.h>
+# endif
+])
+
+
 # Check for <locale>
 AC_LANG_PUSH(C++)
-AC_CHECK_HEADERS([locale])
+AC_CHECK_HEADERS([locale], [], [], [])
 AC_LANG_POP(C++)
 
+
 AC_DEFUN([NEED_PROG],
 [
 AC_PATH_PROG($1, $2)
@@ -73,26 +124,42 @@ fi
 ])
 
 NEED_PROG(curl, curl)
-NEED_PROG(bzip2, bzip2)
-NEED_PROG(bunzip2, bunzip2)
-NEED_PROG(shell, sh)
+NEED_PROG(shell, bash)
+NEED_PROG(patch, patch)
 AC_PATH_PROG(xmllint, xmllint, false)
 AC_PATH_PROG(xsltproc, xsltproc, false)
+AC_PATH_PROG(jing, jing, false) # needed because xmllint --relaxng seems broken
+AC_PATH_PROG(w3m, w3m, false)
 AC_PATH_PROG(flex, flex, false)
 AC_PATH_PROG(bison, bison, false)
 NEED_PROG(perl, perl)
 NEED_PROG(tar, tar)
-                
+AC_PATH_PROG(dot, dot)
+AC_PATH_PROG(dblatex, dblatex)
+
+AC_PATH_PROG(openssl_prog, openssl, openssl) # if not found, call openssl in $PATH
+AC_SUBST(openssl_prog)
+AC_DEFINE_UNQUOTED(OPENSSL_PATH, ["$openssl_prog"], [Path of the OpenSSL binary])
+
+# Test that Perl has the open/fork feature (Perl 5.8.0 and beyond).
+AC_MSG_CHECKING([whether Perl is recent enough])
+if ! $perl -e 'open(FOO, "-|", "true"); while (<FOO>) { print; }; close FOO or die;'; then
+    AC_MSG_RESULT(no)
+    AC_MSG_ERROR([Your Perl version is too old.  Nix requires Perl 5.8.0 or newer.])
+fi
+AC_MSG_RESULT(yes)
+
 NEED_PROG(cat, cat)
+NEED_PROG(tr, tr)
 AC_ARG_WITH(coreutils-bin, AC_HELP_STRING([--with-coreutils-bin=PATH],
   [path of cat, mkdir, etc.]),
   coreutils=$withval, coreutils=$(dirname $cat))
 AC_SUBST(coreutils)
 
-AC_ARG_WITH(docbook-catalog, AC_HELP_STRING([--with-docbook-catalog=PATH],
-  [path of the DocBook XML DTD]),
-  docbookcatalog=$withval, docbookcatalog=/docbook-dtd-missing)
-AC_SUBST(docbookcatalog)
+AC_ARG_WITH(docbook-rng, AC_HELP_STRING([--with-docbook-rng=PATH],
+  [path of the DocBook RelaxNG schema]),
+  docbookrng=$withval, docbookrng=/docbook-rng-missing)
+AC_SUBST(docbookrng)
 
 AC_ARG_WITH(docbook-xsl, AC_HELP_STRING([--with-docbook-xsl=PATH],
   [path of the DocBook XSL stylesheets]),
@@ -109,6 +176,11 @@ AC_ARG_WITH(store-dir, AC_HELP_STRING([--with-store-dir=PATH],
   storedir=$withval, storedir='${prefix}/store')
 AC_SUBST(storedir)
 
+AC_ARG_WITH(store-state-dir, AC_HELP_STRING([--with-store-state-dir=PATH],
+  [path of the Nix state store]),
+  storestatedir=$withval, storestatedir='${prefix}/state')
+AC_SUBST(storestatedir)
+
 AC_ARG_WITH(bdb, AC_HELP_STRING([--with-bdb=PATH],
   [prefix of Berkeley DB]),
   bdb=$withval, bdb=)
@@ -123,6 +195,18 @@ fi
 AC_SUBST(bdb_lib)
 AC_SUBST(bdb_include)
 
+AC_ARG_WITH(ext3cow-header, AC_HELP_STRING([--with-ext3cow-header=PATH],
+  [path of the ext3cow header ext3cow_fs.h]),
+  ext3cowheader=$withval, ext3cowheader=)
+AC_SUBST(ext3cowheader)
+AC_CHECK_HEADER(${ext3cowheader})
+
+NEED_PROG(rsync, rsync)
+AC_ARG_WITH(rsync, AC_HELP_STRING([--with-rsync=PATH],
+  [path to the rsync binary.]),
+  rsync=$withval)
+AC_SUBST(rsync)
+
 AC_ARG_WITH(aterm, AC_HELP_STRING([--with-aterm=PATH],
   [prefix of CWI ATerm library]),
   aterm=$withval, aterm=)
@@ -140,41 +224,66 @@ AC_SUBST(aterm_lib)
 AC_SUBST(aterm_include)
 AC_SUBST(aterm_bin)
 
+AC_ARG_WITH(openssl, AC_HELP_STRING([--with-openssl=PATH],
+  [prefix of the OpenSSL library]),
+  openssl=$withval, openssl=)
+AM_CONDITIONAL(HAVE_OPENSSL, test -n "$openssl")
+if test -n "$openssl"; then
+  LDFLAGS="-L$openssl/lib -lcrypto $LDFLAGS"
+  CFLAGS="-I$openssl/include $CFLAGS"
+  CXXFLAGS="-I$openssl/include $CXXFLAGS"
+  AC_DEFINE(HAVE_OPENSSL, 1, [whether to use OpenSSL])
+fi
+
+AC_ARG_WITH(bzip2, AC_HELP_STRING([--with-bzip2=PATH],
+  [prefix of bzip2]),
+  bzip2=$withval, bzip2=)
+AM_CONDITIONAL(HAVE_BZIP2, test -n "$bzip2")
+if test -z "$bzip2"; then
+  # Headers and libraries will be used from the temporary installation
+  # in externals/inst-bzip2.
+  bzip2_lib='-L${top_builddir}/externals/inst-bzip2/lib -lbz2'
+  bzip2_include='-I${top_builddir}/externals/inst-bzip2/include'
+  # The binary will be copied to $libexecdir.
+  bzip2_bin='${libexecdir}'
+  # But for testing, we have to use the temporary copy :-(
+  bzip2_bin_test='${top_builddir}/externals/inst-bzip2/bin'
+else
+  bzip2_lib="-L$bzip2/lib -lbz2"
+  bzip2_include="-I$bzip2/include"
+  bzip2_bin="$bzip2/bin"
+  bzip2_bin_test="$bzip2/bin"
+fi   
+AC_SUBST(bzip2_lib)
+AC_SUBST(bzip2_include)
+AC_SUBST(bzip2_bin)
+AC_SUBST(bzip2_bin_test)
+
+
 AC_CHECK_LIB(pthread, pthread_mutex_init)
 
+
 AC_ARG_ENABLE(init-state, AC_HELP_STRING([--disable-init-state],
   [do not initialise DB etc. in `make install']),
   init_state=$enableval, init_state=yes)
 AM_CONDITIONAL(INIT_STATE, test "$init_state" = "yes")
 
 
-AC_ARG_ENABLE(setuid, AC_HELP_STRING([--enable-setuid],
-  [install Nix setuid]),
-  setuid_hack=$enableval, setuid_hack=no)
-AM_CONDITIONAL(SETUID_HACK, test "$setuid_hack" = "yes")
-if test "$setuid_hack" = "yes"; then
-    AC_DEFINE(SETUID_HACK, 1, [whether to install Nix setuid])
+# Setuid installations.
+AC_CHECK_FUNCS([setresuid setreuid lchown])
+
+
+# Nice to have, but not essential.
+AC_CHECK_FUNCS([strsignal])
+
+
+# This is needed if ATerm, Berkeley DB or bzip2 are static libraries,
+# and the Nix libraries are dynamic.
+if test "$(uname)" = "Darwin"; then
+    LDFLAGS="-all_load $LDFLAGS"
 fi
 
-AC_CHECK_FUNC(setresuid, [HAVE_SETRESUID=1], [HAVE_SETRESUID=])
-AM_CONDITIONAL(HAVE_SETRESUID, test "$HAVE_SETRESUID" = "1")
-if test "$HAVE_SETRESUID" = "1"; then
-    AC_DEFINE(HAVE_SETRESUID, 1, [whether we have setresuid()])
-fi
 
-AC_ARG_WITH(nix-user, AC_HELP_STRING([--with-nix-user=USER],
-  [user for Nix setuid binaries]),
-  NIX_USER=$withval, NIX_USER=nix)
-AC_SUBST(NIX_USER)
-AC_DEFINE_UNQUOTED(NIX_USER, ["$NIX_USER"], [Nix user])
-                                                      
-AC_ARG_WITH(nix-group, AC_HELP_STRING([--with-nix-group=USER],
-  [group for Nix setuid binaries]),
-  NIX_GROUP=$withval, NIX_GROUP=nix)
-AC_SUBST(NIX_GROUP)
-AC_DEFINE_UNQUOTED(NIX_GROUP, ["$NIX_GROUP"], [Nix group])
-
-                                                                                                            
 AM_CONFIG_HEADER([config.h])
 AC_CONFIG_FILES([Makefile
    externals/Makefile
@@ -185,13 +294,17 @@ AC_CONFIG_FILES([Makefile
    src/libutil/Makefile
    src/libstore/Makefile
    src/libmain/Makefile
+   src/libext3cow/Makefile
    src/nix-store/Makefile
+   src/nix-state/Makefile
    src/nix-hash/Makefile
    src/libexpr/Makefile
    src/nix-instantiate/Makefile
    src/nix-env/Makefile
-   src/log2xml/Makefile
-   src/bsdiff-4.2/Makefile
+   src/nix-worker/Makefile
+   src/nix-setuid-helper/Makefile
+   src/nix-log2xml/Makefile
+   src/bsdiff-4.3/Makefile
    scripts/Makefile
    corepkgs/Makefile
    corepkgs/nar/Makefile

corepkgs/buildenv/Makefile.am

@@ -3,7 +3,7 @@ all-local: builder.pl
 install-exec-local:
 	$(INSTALL) -d $(DESTDIR)$(datadir)/nix/corepkgs
 	$(INSTALL) -d $(DESTDIR)$(datadir)/nix/corepkgs/buildenv
-	$(INSTALL_DATA) default.nix $(DESTDIR)$(datadir)/nix/corepkgs/buildenv
+	$(INSTALL_DATA) $(srcdir)/default.nix $(DESTDIR)$(datadir)/nix/corepkgs/buildenv
 	$(INSTALL_PROGRAM) builder.pl $(DESTDIR)$(datadir)/nix/corepkgs/buildenv
 
 include ../../substitute.mk

corepkgs/buildenv/builder.pl.in

@@ -3,18 +3,39 @@
 use strict;
 use Cwd;
 use IO::Handle;
+use Fcntl;
 
 STDOUT->autoflush(1);
 
 my $out = $ENV{"out"};
 mkdir "$out", 0755 || die "error creating $out";
 
+sub readlink_or_StateWrapper;
+
+my $symlinks = 0;
+my %path_state_identifier = ();
+
+my %priorities;
+
+my $nixBinDir = $ENV{"nixBinDir"};
+my $nixStore = $ENV{"nixStore"};
 
 # For each activated package, create symlinks.
 
 sub createLinks {
     my $srcDir = shift;
+    
+    #Lookup each $stateIdentifiers in $path_state_identifier
+    #we strip $srcDir to its rootdir e.g. /nix/store/......./
+    my @srcDirParts = split /\// , substr($srcDir, length ($nixStore), length ($srcDir));
+    my $srcDirRoot = $nixStore . "/" . $srcDirParts[1];
+	# print "srcDirRoot $srcDirRoot \n";
+    
     my $dstDir = shift;
+    my $priority = shift;
+	my $pkgStateIdentifier = $path_state_identifier{$srcDirRoot};		# We have to look it up each time since recursion can change the $srcDir, but not the identifier
+
+	#print "createLinks $srcDir to $dstDir with iden $pkgStateIdentifier \n";
 
     my @srcFiles = glob("$srcDir/*");
 
@@ -22,21 +43,24 @@ sub createLinks {
         my $baseName = $srcFile;
         $baseName =~ s/^.*\///g; # strip directory
         my $dstFile = "$dstDir/$baseName";
-        
-	if ($srcFile =~ /\/propagated-build-inputs$/ ||
+
+    	# Urgh, hacky...
+		if ($srcFile =~ /\/propagated-build-inputs$/ ||
             $srcFile =~ /\/nix-support$/ ||
             $srcFile =~ /\/perllocal.pod$/ ||
+            $srcFile =~ /\/info\/dir$/ ||
             $srcFile =~ /\/log$/)
         {
             # Do nothing.
-	}
+		}
 
         elsif (-d $srcFile) {
 
             lstat $dstFile;
             
+            #go recursive on directorys
             if (-d _) {
-                createLinks($srcFile, $dstFile);
+                createLinks($srcFile, $dstFile, $priority);
             }
 
             elsif (-l _) {
@@ -45,64 +69,183 @@ sub createLinks {
                     die "collission between directory `$srcFile' and non-directory `$target'";
                 }
                 unlink $dstFile or die "error unlinking `$dstFile': $!";
-                mkdir $dstFile, 0755 || 
-                    die "error creating directory `$dstFile': $!";
-                createLinks($target, $dstFile);
-                createLinks($srcFile, $dstFile);
+                mkdir $dstFile, 0755 || die "error creating directory `$dstFile': $!";
+                createLinks($target, $dstFile, $priorities{$dstFile});
+                createLinks($srcFile, $dstFile, $priority);
             }
 
             else {
+                
+                #print "1ST DIR LINK $srcFile to $dstFile with iden $pkgStateIdentifier \n";
+                
                 symlink($srcFile, $dstFile) ||
                     die "error creating link `$dstFile': $!";
+                $priorities{$dstFile} = $priority;
+                $symlinks++;
             }
         }
 
-        elsif (-l $dstFile) {
-            my $target = readlink $dstFile;
-            die "collission between `$srcFile' and `$target'";
-        }
-
         else {
-#            print "linking $dstFile to $srcFile\n";
-            symlink($srcFile, $dstFile) ||
-                die "error creating link `$dstFile': $!";
-        }
+
+			# print "ELSE LINK $srcFile to $dstFile with iden $pkgStateIdentifier \n";
+
+			# if we have a state component with a identifier different then ""
+			if($pkgStateIdentifier ne "__NOSTATE__" && $pkgStateIdentifier ne ""){
+	            
+	            my @pathparts = split /\// , $srcFile;
+	            my $parentDir = $pathparts[scalar(@pathparts) - 2];
+	            
+	            if( $parentDir eq "bin" || $parentDir eq "sbin"){		#hacky....
+		            
+		            print "STATELINK $srcFile to $dstFile - $pkgStateIdentifier \n";
+		            
+		            my $new_dstFile;
+		            my $new_stateIdentifier;		            
+		            if($pkgStateIdentifier eq "__EMTPY__"){
+		            	$new_dstFile = $dstFile;
+		            	$new_stateIdentifier = "";
+		            }
+		            else{
+		            	$new_dstFile = "$dstFile-$pkgStateIdentifier";
+		            	$new_stateIdentifier = $pkgStateIdentifier;
+		            }
+		            
+		            # We also check with -e if the wrapperscript-file exists, and if is it a symlink (with -l)
+		            if (-l $new_dstFile || -e $new_dstFile) {
+			                my $target = readlink_or_StateWrapper $new_dstFile;
+			                die "(state) collission between `$srcFile' and `$target' (over $new_dstFile)";
+			        }
+		            
+		            sysopen (DSTFILEHANDLE, $new_dstFile, O_RDWR|O_EXCL|O_CREAT, 0755);
+					printf DSTFILEHANDLE "#! @shell@ \n";
+					printf DSTFILEHANDLE "$nixBinDir/nix-state --run --identifier=$new_stateIdentifier $srcFile \"\$@\" \n"; 
+					close (DSTFILEHANDLE);
+	            }
+	            
+			}
+			elsif($pkgStateIdentifier ne "__NOSTATE__" && $pkgStateIdentifier eq ""){		#TODO we now dont create symlinks for state packages with a empty identifier
+																							#TODO but we must do it if there is no normal non-state pacakge
+			}
+			
+	        else {
+
+	            if (-l $dstFile || -e $dstFile) {
+	                my $target = readlink_or_StateWrapper $dstFile;
+	                my $prevPriority = $priorities{$dstFile};
+	                die ( "Collission between `$srcFile' and `$target'. "
+	                    . "Suggested solution: use `nix-env --set-flag "
+	                    . "priority NUMBER PKGNAME' to change the priority of "
+	                    . "one of the conflicting packages.\n" )
+	                    if $prevPriority == $priority;
+	                next if $prevPriority < $priority;
+	                unlink $dstFile or die;
+	            }
+	
+				# print "2ND LINK $srcFile to $dstFile with iden $pkgStateIdentifier \n";
+	            symlink($srcFile, $dstFile) ||
+	                die "error creating link `$dstFile': $!";
+	            $priorities{$dstFile} = $priority;
+	            $symlinks++;
+	        }
+		}
     }
 }
 
 
 my %done;
+my %postponed;
 
 sub addPkg;
 sub addPkg {
     my $pkgDir = shift;
+    my $priority = shift;
 
     return if (defined $done{$pkgDir});
     $done{$pkgDir} = 1;
 
-    print "adding $pkgDir\n";
-    createLinks("$pkgDir", "$out");
+#    print "symlinking $pkgDir\n";
+    createLinks("$pkgDir", "$out", $priority);
 
-    my $propagatedFN = "$pkgDir/nix-support/propagated-build-inputs";
+    my $propagatedFN = "$pkgDir/nix-support/propagated-user-env-packages";
     if (-e $propagatedFN) {
         open PROP, "<$propagatedFN" or die;
         my $propagated = <PROP>;
         close PROP;
         my @propagated = split ' ', $propagated;
         foreach my $p (@propagated) {
-            addPkg $p;
+            $postponed{$p} = 1 unless defined $done{$p};
         }
     }
+}
+
+sub readlink_or_StateWrapper {
+
+	my $src = shift;
+	my $target;
+
+    if (-l $src)
+    {   $target = readlink $src;    }
+    else{
+    	open(DAT, $src) || die("Could not open file!");
+        my @raw_data=<DAT>;
+        close(DAT);
+        $target = $raw_data[1];
+    }
+    return $target
+}
+
+my @stateIdentifiers = split ' ', $ENV{"stateIdentifiers"};
+my $si_counter = 0;
+
+# Convert the stuff we get from the environment back into a coherent
+# data type.
+my @paths = split ' ', $ENV{"paths"};
+my @active = split ' ', $ENV{"active"};
+my @priority = split ' ', $ENV{"priority"};
+
+die if scalar @paths != scalar @active;
+die if scalar @paths != scalar @priority;
+
+my %pkgs;
+
+for (my $n = 0; $n < scalar @paths; $n++) {
+    $pkgs{$paths[$n]} =
+        { active => $active[$n]
+        , priority => $priority[$n] 
+        , stateidentifier => $stateIdentifiers[$n]
+        };
         
+    $path_state_identifier{$paths[$n]} = $stateIdentifiers[$n];
+}
+
+# Symlink to the packages that have been installed explicitly by the
+# user.
+foreach my $pkg (sort (keys %pkgs)) {
+
+	#print "SP: $pkg \n";
+	#print "SI: $pkgs{$pkg}->{stateidentifier} \n";
+    #print "PR: $pkgs{$pkg}->{priority} \n";	
+    
+    addPkg($pkg, $pkgs{$pkg}->{priority}) if $pkgs{$pkg}->{active} ne "false";
+    $si_counter++;
 }
 
 
-my @args = split ' ', $ENV{"derivations"};
-
-while (scalar @args > 0) {
-    my $drvPath = shift @args;
-    addPkg($drvPath);
+# Symlink to the packages that have been "propagated" by packages
+# installed by the user (i.e., package X declares that it want Y
+# installed as well).  We do these later because they have a lower
+# priority in case of collisions.
+my $priorityCounter = 1000; # don't care about collisions
+while (scalar(keys %postponed) > 0) {
+    
+    my @pkgDirs = keys %postponed;
+    %postponed = ();
+    foreach my $pkgDir (sort @pkgDirs) {
+        addPkg($pkgDir, $priorityCounter++);
+    }
 }
 
+print STDERR "created $symlinks symlinks in user environment\n";
 
 symlink($ENV{"manifest"}, "$out/manifest") or die "cannot create manifest";
+

corepkgs/buildenv/default.nix

@@ -1,9 +1,16 @@
-{system, derivations, manifest}:
+{system, derivations, stateIdentifiers, manifest, nixBinDir, nixStore}:
 
 derivation { 
   name = "user-environment";
   system = system;
   builder = ./builder.pl;
-  derivations = derivations;
+  
+  stateIdentifiers = stateIdentifiers;
   manifest = manifest;
+  inherit nixBinDir nixStore;
+
+  # !!! grmbl, need structured data for passing this in a clean way.
+  paths = derivations;
+  active = map (x: if x ? meta && x.meta ? active then x.meta.active else "true") derivations;
+  priority = map (x: if x ? meta && x.meta ? priority then x.meta.priority else "5") derivations;
 }

corepkgs/channels/Makefile.am

@@ -3,7 +3,7 @@ all-local: unpack.sh
 install-exec-local:
 	$(INSTALL) -d $(DESTDIR)$(datadir)/nix/corepkgs
 	$(INSTALL) -d $(DESTDIR)$(datadir)/nix/corepkgs/channels
-	$(INSTALL_DATA) unpack.nix $(DESTDIR)$(datadir)/nix/corepkgs/channels
+	$(INSTALL_DATA) $(srcdir)/unpack.nix $(DESTDIR)$(datadir)/nix/corepkgs/channels
 	$(INSTALL_PROGRAM) unpack.sh $(DESTDIR)$(datadir)/nix/corepkgs/channels
 
 include ../../substitute.mk

corepkgs/channels/unpack.sh.in

@@ -4,19 +4,23 @@
 @coreutils@/mkdir $out/tmp
 cd $out/tmp
 
-expr=$out/default.nix
-echo '[' > $expr
+inputs=($inputs)
+for ((n = 0; n < ${#inputs[*]}; n += 2)); do
+    channelName=${inputs[n]}
+    channelTarball=${inputs[n+1]}
+    echo "unpacking channel $channelName"
+    @bunzip2@ < $channelTarball | @tar@ xf -
 
-nr=0
-for i in $inputs; do
-    echo "unpacking $i"
-    @bunzip2@ < $i | @tar@ xf -
-    @coreutils@/mv * ../$nr # !!! hacky
-    echo "(import ./$nr)" >> $expr
-    nr=$(($nr + 1))
+    nr=1
+    attrName=$(echo $channelName | @tr@ -- '- ' '__')
+    dirName=$attrName
+    while test -e ../$dirName; do
+        nr=$((nr+1))
+        dirName=$attrName-$nr
+    done
+
+    @coreutils@/mv * ../$dirName # !!! hacky
 done
 
-echo ']' >> $expr
-
 cd ..
 @coreutils@/rmdir tmp

corepkgs/nar/Makefile.am

@@ -3,7 +3,7 @@ all-local: nar.sh
 install-exec-local:
 	$(INSTALL) -d $(DESTDIR)$(datadir)/nix/corepkgs
 	$(INSTALL) -d $(DESTDIR)$(datadir)/nix/corepkgs/nar
-	$(INSTALL_DATA) nar.nix $(DESTDIR)$(datadir)/nix/corepkgs/nar
+	$(INSTALL_DATA) $(srcdir)/nar.nix $(DESTDIR)$(datadir)/nix/corepkgs/nar
 	$(INSTALL_PROGRAM) nar.sh $(DESTDIR)$(datadir)/nix/corepkgs/nar
 
 include ../../substitute.mk

corepkgs/nar/nar.nix

@@ -1,5 +1,7 @@
-{system, path, hashAlgo}: derivation {
+{system, storePath, hashAlgo}: 
+
+derivation {
   name = "nar";
   builder = ./nar.sh;
-  inherit system path hashAlgo;
+  inherit system storePath hashAlgo;
 }

corepkgs/nar/nar.sh.in

@@ -1,9 +1,9 @@
 #! @shell@ -e
 
-echo "packing $path into $out..."
+echo "packing $storePath into $out..."
 @coreutils@/mkdir $out
 dst=$out/tmp.nar.bz2
-@bindir@/nix-store --dump "$path" > tmp
+@bindir@/nix-store --dump "$storePath" > tmp
 
 @bzip2@ < tmp > $dst
 

createRelease.sh

@@ -0,0 +1,21 @@
+#! /bin/sh -e
+
+dir1=releases
+dir2=nix-state
+mkdir -p $dir1
+cd $dir1
+rm -rf $dir2
+mkdir -p $dir2
+cd $dir2
+svn co https://svn.cs.uu.nl:12443/repos/trace/nix/branches/state ./
+revision=`svn info | grep ^Revision | sed 's/Revision: //g'`
+cd ..
+date=`date +%Y%m%d`
+tarfile=snix-${date}-rev${revision}.tar.gz
+tar -cvf $tarfile \
+    --preserve-permissions \
+    --atime-preserve \
+    --gzip \
+    --verbose \
+    --no-ignore-command-error \
+    $dir2/

doc/Makefile.am

@@ -1 +1 @@
-SUBDIRS = manual
+SUBDIRS = 

doc/dev/release-procedures.txt

@@ -1,5 +1,8 @@
 To produce a `stable' release from the trunk:
 
+-1. Update the release notes; make sure that the release date is
+    correct.
+
 0. Make sure that the trunk builds in the release supervisor.
 
 1. Branch the trunk, e.g., `svn cp .../trunk
@@ -22,8 +25,8 @@ To produce a `stable' release from the trunk:
    branch (e.g., `.../branches/0.5') should be created from the
    original revision of the trunk (since maintenance releases should
    also be tested first; hence, we cannot have `STABLE=1').  The same
-   procedure can then be followed to produce maintenance release; just
-   substitute `.../branches/VERSION' for the trunk.
+   procedure can then be followed to produce maintenance releases;
+   just substitute `.../branches/VERSION' for the trunk.
 
 7. Switch back to the trunk.
 

doc/manual/Makefile.am

@@ -1,30 +1,40 @@
-ENV = SGML_CATALOG_FILES=$(docbookcatalog)
-
-XMLLINT = $(ENV) $(xmllint) $(xmlflags) --catalogs
-XSLTPROC = $(ENV) $(xsltproc) $(xmlflags) --catalogs \
+XMLLINT = $(xmllint) $(xmlflags)
+XSLTPROC = $(xsltproc) $(xmlflags) \
  --param section.autolabel 1 \
  --param section.label.includes.component.label 1 \
  --param html.stylesheet \'style.css\' \
  --param xref.with.number.and.title 1 \
- --param toc.section.depth 3
+ --param toc.section.depth 3 \
+ --param admon.style \'\' \
+ --param callout.graphics.extension \'.gif\'
+
+# Note: we use GIF for now, since the PNGs shipped with Docbook aren't
+# transparent.
 
 man1_MANS = nix-env.1 nix-build.1 nix-store.1 nix-instantiate.1 \
  nix-collect-garbage.1 nix-push.1 nix-pull.1 \
- nix-prefetch-url.1 nix-channel.1
+ nix-prefetch-url.1 nix-channel.1 \
+ nix-pack-closure.1 nix-unpack-closure.1 \
+ nix-install-package.1 nix-hash.1 nix-copy-closure.1
 
 FIGURES = figures/user-environments.png
 
 MANUAL_SRCS = manual.xml introduction.xml installation.xml \
- package-management.xml writing-nix-expressions.xml \
+ package-management.xml writing-nix-expressions.xml builtins.xml \
  build-farm.xml \
  $(man1_MANS:.1=.xml) \
  troubleshooting.xml bugs.xml opt-common.xml opt-common-syn.xml \
  env-common.xml quick-start.xml nix-lang-ref.xml glossary.xml \
- conf-file.xml \
+ conf-file.xml release-notes.xml \
  style.css images
 
 manual.is-valid: $(MANUAL_SRCS) version.txt
-	$(XMLLINT) --xinclude $< | $(XMLLINT) --noout --nonet --valid -
+#	$(XMLLINT) --xinclude $< | $(XMLLINT) --noout --nonet --relaxng $(docbookrng)/docbook.rng -
+	if test "$(jing)" != "false"; then \
+		$(XMLLINT) --xinclude $< | $(jing) $(docbookrng)/docbook.rng /dev/fd/0; \
+	else \
+		echo "Not validating."; \
+	fi
 	touch $@
 
 version.txt:
@@ -37,7 +47,33 @@ manual.html: $(MANUAL_SRCS) manual.is-valid images
 	$(XSLTPROC) --nonet --xinclude --output manual.html \
 	  $(docbookxsl)/html/docbook.xsl manual.xml
 
-all-local: manual.html
+manual.pdf: $(MANUAL_SRCS) manual.is-valid images
+	if test "$(dblatex)" != ""; then \
+		$(dblatex) manual.xml; \
+	else \
+		echo "Please install dblatex and rerun configure."; \
+		exit 1; \
+	fi
+
+
+NEWS_OPTS = \
+ --stringparam generate.toc "article nop" \
+ --stringparam section.autolabel.max.depth 0 \
+ --stringparam header.rule 0
+
+NEWS.html: release-notes.xml
+	$(XSLTPROC) --nonet --xinclude --output $@ $(NEWS_OPTS) \
+	  $(docbookxsl)/html/docbook.xsl release-notes.xml
+
+NEWS.txt: release-notes.xml
+	$(XSLTPROC) --nonet --xinclude quote-literals.xsl release-notes.xml | \
+	  $(XSLTPROC) --nonet --output $@.tmp.html $(NEWS_OPTS) \
+	  $(docbookxsl)/html/docbook.xsl -
+	LANG=en_US $(w3m) -dump $@.tmp.html > $@
+	rm $@.tmp.html
+
+
+all-local: manual.html NEWS.html NEWS.txt
 
 install-data-local: manual.html
 	$(INSTALL) -d $(DESTDIR)$(datadir)/nix/manual
@@ -49,12 +85,12 @@ install-data-local: manual.html
 
 images:
 	mkdir images
-	cp $(docbookxsl)/images/*.png images
+#	cp $(docbookxsl)/images/*.gif images
 	mkdir images/callouts
-	cp $(docbookxsl)/images/callouts/*.png images/callouts
-	chmod +w -R images
+	cp $(docbookxsl)/images/callouts/*.gif images/callouts
+	chmod -R +w images
 
-KEEP = manual.html manual.is-valid version.txt $(MANS)
+KEEP = manual.html manual.is-valid version.txt $(MANS) NEWS.html NEWS.txt
 
 EXTRA_DIST = $(MANUAL_SRCS) $(FIGURES) $(KEEP)
 

doc/manual/NEWS.txt

@@ -0,0 +1 @@
+New state nix version by wouter ...

doc/manual/bugs.xml

@@ -1,4 +1,8 @@
-<appendix><title>Bugs / To-Do</title>
+<appendix xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink">
+
+<title>Bugs / To-Do</title>
+
 
 <itemizedlist>
 
@@ -11,17 +15,6 @@ generation 43 is created which is a descendant of 39, not 42.  So a
 rollback from 43 ought to go back to 39.  This is not currently
 implemented; generations form a linear sequence.</para></listitem>
 
-<listitem><para><emphasis>Build management.</emphasis> In principle it
-is already possible to do build management using Nix (by writing
-builders that perform appropriate build steps), but the Nix expression
-language is not yet powerful enough to make this pleasant (?).  The
-language should be extended with features from the <ulink
-url='http://www.cs.uu.nl/~eelco/maak/'>Maak build manager</ulink>.
-Another interesting idea is to write a <command>make</command>
-implementation that uses Nix as a back-end to support <ulink
-url='http://www.research.att.com/~bs/bs_faq.html#legacy'>legacy</ulink>
-build files.</para></listitem>
-
 <listitem><para>For security, <command>nix-push</command> manifests
 should be digitally signed, and <command>nix-pull</command> should
 verify the signatures.  The actual NAR archives in the cache do not

doc/manual/build-farm.xml

@@ -1,4 +1,9 @@
-<chapter id='chap-build-farm'><title>Setting up a Build Farm</title>
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id='chap-build-farm'>
+
+<title>Setting up a Build Farm</title>
+
 
 <para>This chapter provides some sketchy information on how to set up
 a Nix-based build farm.  Nix is particularly suited as a basis for a
@@ -31,10 +36,10 @@ build farm, since:
   builds, and Nix expressions are self-contained.</para></listitem>
 
   <listitem><para>Nix will only rebuild things that have actually
-  changed.  For instance, if the sources of a component haven't
-  changed between runs of the build farm, the component won't be
-  rebuild (unless it was garbage-collected).  Also, dependencies
-  typically don't change very often, so they only need to be built
+  changed.  For instance, if the sources of a package haven't changed
+  between runs of the build farm, the package won't be rebuilt (unless
+  it was garbage-collected).  Also, dependencies typically don't
+  change very often, so they only need to be built
   once.</para></listitem>
 
   <listitem><para>The results of a Nix build farm can be made
@@ -50,13 +55,13 @@ build farm, since:
 
 <para>TODO</para>
 
-<para>The sources of the Nix build farm are at <ulink
-url='https://svn.cs.uu.nl:12443/repos/trace/release/trunk' />.</para>
+<para>The sources of the Nix build farm are at <link
+xlink:href='https://svn.cs.uu.nl:12443/repos/trace/release/trunk'/>.</para>
 
 </section>
 
 
-<section id='sec-distributed-builds'><title>Setting up distributed builds</title>
+<section xml:id='sec-distributed-builds'><title>Setting up distributed builds</title>
 
 <para>You can enable distributed builds by setting the environment
 variable <envar>NIX_BUILD_HOOK</envar> to point to a program that Nix
@@ -70,7 +75,7 @@ the documentation of the <link
 linkend="envar-build-hook"><envar>NIX_BUILD_HOOK</envar>
 variable</link>.</para>
 
-<example id='ex-remote-systems'><title>Remote machine configuration:
+<example xml:id='ex-remote-systems'><title>Remote machine configuration:
 <filename>remote-systems.conf</filename></title>
 <programlisting>
 nix@mcflurry.labs.cs.uu.nl  powerpc-darwin  /home/nix/.ssh/id_quarterpounder_auto  2
@@ -79,8 +84,8 @@ nix@scratchy.labs.cs.uu.nl  i686-linux      /home/nix/.ssh/id_scratchy_auto
 </example>
 
 <para>An example build hook can be found in the Nix build farm
-sources: <ulink
-url='https://svn.cs.uu.nl:12443/repos/trace/release/trunk/common/distributed/build-remote.pl'
+sources: <link
+xlink:href='https://svn.cs.uu.nl:12443/repos/trace/release/trunk/common/distributed/build-remote.pl'
 />.  It should be suitable for most purposes, with maybe some minor
 adjustments.  It uses <command>ssh</command> and
 <command>rsync</command> to copy the build inputs and outputs and

doc/manual/builtins.xml

@@ -0,0 +1,760 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id='ssec-builtins'>
+
+<title>Built-in functions</title>
+
+
+<para>This section lists the functions and constants built into the
+Nix expression evaluator.  (The built-in function
+<function>derivation</function> is discussed above.)  Some built-ins,
+such as <function>derivation</function>, are always in scope of every
+Nix expression; you can just access them right away.  But to prevent
+polluting the namespace too much, most built-ins are not in scope.
+Instead, you can access them through the <varname>builtins</varname>
+built-in value, which is an attribute set that contains all built-in
+functions and values.  For instance, <function>derivation</function>
+is also available as <function>builtins.derivation</function>.</para>
+
+
+<variablelist>
+
+  
+  <varlistentry><term><function>abort</function> <replaceable>s</replaceable></term>
+
+    <listitem><para>Abort Nix expression evaluation, print error
+    message <replaceable>s</replaceable>.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.add</function>
+  <replaceable>e1</replaceable> <replaceable>e2</replaceable></term>
+
+    <listitem><para>Return the sum of the integers
+    <replaceable>e1</replaceable> and
+    <replaceable>e2</replaceable>.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.attrNames</function>
+  <replaceable>attrs</replaceable></term>
+
+    <listitem><para>Return the names of the attributes in the
+    attribute set <replaceable>attrs</replaceable> in a sorted list.
+    For instance, <literal>builtins.attrNames {y = 1; x =
+    "foo";}</literal> evaluates to <literal>["x" "y"]</literal>.
+    There is no built-in function <function>attrValues</function>, but
+    you can easily define it yourself:
+
+<programlisting>
+attrValues = attrs: map (name: builtins.getAttr name attrs) (builtins.attrNames attrs);</programlisting>
+
+    </para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>baseNameOf</function> <replaceable>s</replaceable></term>
+
+    <listitem><para>Return the <emphasis>base name</emphasis> of the
+    string <replaceable>s</replaceable>, that is, everything following
+    the final slash in the string.  This is similar to the GNU
+    <command>basename</command> command.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><varname>builtins</varname></term>
+
+    <listitem><para>The attribute set <varname>builtins</varname>
+    contains all the built-in functions and values.  You can use
+    <varname>builtins</varname> to test for the availability of
+    features in the Nix installation, e.g.,
+
+<programlisting>
+if builtins ? getEnv then builtins.getEnv "PATH" else ""</programlisting>
+
+    This allows a Nix expression to fall back gracefully on older Nix
+    installations that don’t have the desired built-in function.
+    However, in that case you should not write
+
+<programlisting>
+if builtins ? getEnv then __getEnv "PATH" else ""</programlisting>
+
+    This Nix expression will trigger an “undefined variable” error on
+    older Nix versions since <function>__getEnv</function> doesn’t
+    exist.  <literal>builtins.getEnv</literal>, on the other hand, is
+    safe since <literal>builtins</literal> always exists and attribute
+    selection is lazy, so it’s only performed if the test
+    succeeds.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry
+  xml:id='builtin-currentSystem'><term><varname>builtins.currentSystem</varname></term>
+
+    <listitem><para>The built-in value <varname>currentSystem</varname>
+    evaluates to the Nix platform identifier for the Nix installation
+    on which the expression is being evaluated, such as
+    <literal>"i686-linux"</literal> or
+    <literal>"powerpc-darwin"</literal>.</para></listitem>
+
+  </varlistentry>
+
+
+  <!--
+  <varlistentry><term><function>currentTime</function></term>
+
+    <listitem><para>The built-in value <varname>currentTime</varname>
+    returns the current system time in seconds since 00:00:00 1/1/1970
+    UTC.  Due to the evaluation model of Nix expressions
+    (<emphasis>maximal laziness</emphasis>), it always yields the same
+    value within an execution of Nix.</para></listitem>
+
+  </varlistentry>
+  -->
+
+  
+  <!--
+  <varlistentry><term><function>dependencyClosure</function></term>
+
+    <listitem><para>TODO</para></listitem>
+
+  </varlistentry>
+  -->
+
+  
+  <varlistentry><term><function>derivation</function>
+  <replaceable>attrs</replaceable></term>
+
+    <listitem><para><function>derivation</function> is described in
+    <xref linkend='ssec-derivation' />.</para></listitem>
+
+  </varlistentry>
+
+
+  <varlistentry><term><function>dirOf</function> <replaceable>s</replaceable></term>
+
+    <listitem><para>Return the directory part of the string
+    <replaceable>s</replaceable>, that is, everything before the final
+    slash in the string.  This is similar to the GNU
+    <command>dirname</command> command.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.filterSource</function>
+  <replaceable>e1</replaceable> <replaceable>e2</replaceable></term>
+
+    <listitem>
+
+      <para>This function allows you to copy sources into the Nix
+      store while filtering certain files.  For instance, suppose that
+      you want to use the directory <filename>source-dir</filename> as
+      an input to a Nix expression, e.g.
+
+<programlisting>
+stdenv.mkDerivation {
+  ...
+  src = ./source-dir;
+}
+</programlisting>
+
+      However, if <filename>source-dir</filename> is a Subversion
+      working copy, then all those annoying <filename>.svn</filename>
+      subdirectories will also be copied to the store.  Worse, the
+      contents of those directories may change a lot, causing lots of
+      spurious rebuilds.  With <function>filterSource</function> you
+      can filter out the <filename>.svn</filename> directories:
+
+<programlisting>
+  src = builtins.filterSource
+    (path: type: type != "directory" || baseNameOf path != ".svn")
+    ./source-dir;
+</programlisting>
+
+      </para>
+
+      <para>Thus, the first argument <replaceable>e1</replaceable>
+      must be a predicate function that is called for each regular
+      file, directory or symlink in the source tree
+      <replaceable>e2</replaceable>.  If the function returns
+      <literal>true</literal>, the file is copied to the Nix store,
+      otherwise it is omitted.  The function is called with two
+      arguments.  The first is the full path of the file.  The second
+      is a string that identifies the type of the file, which is
+      either <literal>"regular"</literal>,
+      <literal>"directory"</literal>, <literal>"symlink"</literal> or
+      <literal>"unknown"</literal> (for other kinds of files such as
+      device nodes or fifos — but note that those cannot be copied to
+      the Nix store, so if the predicate returns
+      <literal>true</literal> for them, the copy will fail).</para>
+
+    </listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.getAttr</function>
+  <replaceable>s</replaceable> <replaceable>attrs</replaceable></term>
+
+    <listitem><para><function>getAttr</function> returns the attribute
+    named <replaceable>s</replaceable> from the attribute set
+    <replaceable>attrs</replaceable>.  Evaluation aborts if the
+    attribute doesn’t exist.  This is a dynamic version of the
+    <literal>.</literal> operator, since <replaceable>s</replaceable>
+    is an expression rather than an identifier.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.getEnv</function>
+  <replaceable>s</replaceable></term>
+
+    <listitem><para><function>getEnv</function> returns the value of
+    the environment variable <replaceable>s</replaceable>, or an empty
+    string if the variable doesn’t exist.  This function should be
+    used with care, as it can introduce all sorts of nasty environment
+    dependencies in your Nix expression.</para>
+
+    <para><function>getEnv</function> is used in Nix Packages to
+    locate the file <filename>~/.nixpkgs/config.nix</filename>, which
+    contains user-local settings for Nix Packages.  (That is, it does
+    a <literal>getEnv "HOME"</literal> to locate the user’s home
+    directory.)</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.hasAttr</function>
+  <replaceable>s</replaceable> <replaceable>attrs</replaceable></term>
+
+    <listitem><para><function>hasAttr</function> returns
+    <literal>true</literal> if the attribute set
+    <replaceable>attrs</replaceable> has an attribute named
+    <replaceable>s</replaceable>, and <literal>false</literal>
+    otherwise.  This is a dynamic version of the <literal>?</literal>
+    operator, since <replaceable>s</replaceable> is an expression
+    rather than an identifier.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.head</function>
+  <replaceable>list</replaceable></term>
+
+    <listitem><para>Return the first element of a list; abort
+    evaluation if the argument isn’t a list or is an empty list.  You
+    can test whether a list is empty by comparing it with
+    <literal>[]</literal>.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>import</function>
+  <replaceable>path</replaceable></term>
+
+    <listitem><para>Load, parse and return the Nix expression in the
+    file <replaceable>path</replaceable>.  Evaluation aborts if the
+    file doesn’t exist or contains an incorrect Nix
+    expression.  <function>import</function> implements Nix’s module
+    system: you can put any Nix expression (such as an attribute set
+    or a function) in a separate file, and use it from Nix expressions
+    in other files.</para>
+
+    <para>A Nix expression loaded by <function>import</function> must
+    not contain any <emphasis>free variables</emphasis> (identifiers
+    that are not defined in the Nix expression itself and are not
+    built-in).  Therefore, it cannot refer to variables that are in
+    scope at the call site.  For instance, if you have a calling
+    expression
+    
+<programlisting>
+rec {
+  x = 123;
+  y = import ./foo.nix;
+}</programlisting>
+
+    then the following <filename>foo.nix</filename> will give an
+    error:
+
+<programlisting>
+x + 456</programlisting>
+
+    since <varname>x</varname> is not in scope in
+    <filename>foo.nix</filename>.  If you want <varname>x</varname>
+    to be available in <filename>foo.nix</filename>, you should pass
+    it as a function argument:
+
+<programlisting>
+rec {
+  x = 123;
+  y = import ./foo.nix x;
+}</programlisting>
+
+    and
+
+<programlisting>
+x: x + 456</programlisting>
+
+    (The function argument doesn’t have to be called
+    <varname>x</varname> in <filename>foo.nix</filename>; any name
+    would work.)</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.isAttrs</function>
+  <replaceable>e</replaceable></term>
+
+    <listitem><para>Return <literal>true</literal> if
+    <replaceable>e</replaceable> evaluates to an attribute set, and
+    <literal>false</literal> otherwise.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.isList</function>
+  <replaceable>e</replaceable></term>
+
+    <listitem><para>Return <literal>true</literal> if
+    <replaceable>e</replaceable> evaluates to a list, and
+    <literal>false</literal> otherwise.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.isFunction</function>
+  <replaceable>e</replaceable></term>
+
+    <listitem><para>Return <literal>true</literal> if
+    <replaceable>e</replaceable> evaluates to a function, and
+    <literal>false</literal> otherwise.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>isNull</function>
+  <replaceable>e</replaceable></term>
+
+    <listitem><para>Return <literal>true</literal> if
+    <replaceable>e</replaceable> evaluates to <literal>null</literal>,
+    and <literal>false</literal> otherwise.</para>
+
+    <warning><para>This function is <emphasis>deprecated</emphasis>;
+    just write <literal>e == null</literal> instead.</para></warning>
+    
+    </listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.lessThan</function>
+  <replaceable>e1</replaceable> <replaceable>e2</replaceable></term>
+
+    <listitem><para>Return <literal>true</literal> if the integer
+    <replaceable>e1</replaceable> is less than the integer
+    <replaceable>e2</replaceable>, and <literal>false</literal>
+    otherwise.  Evaluation aborts if either
+    <replaceable>e1</replaceable> or <replaceable>e2</replaceable>
+    does not evaluate to an integer.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.listToAttrs</function>
+  <replaceable>e</replaceable></term>
+
+    <listitem><para>Construct an attribute set from a list specifying
+    the names and values of each attribute.  Each element of the list
+    should be an attribute set consisting of a string-valued attribute
+    <varname>name</varname> specifying the name of the attribute, and
+    an attribute <varname>value</varname> specifying its value.
+    Example:
+
+<programlisting>
+builtins.listToAttrs [
+  {name = "foo"; value = 123;}
+  {name = "bar"; value = 456;}
+]
+</programlisting>
+
+    evaluates to
+
+<programlisting>
+{ foo = 123; bar = 456; }
+</programlisting>
+
+    </para></listitem>
+
+  </varlistentry>
+  
+  <varlistentry><term><function>map</function>
+  <replaceable>f</replaceable> <replaceable>list</replaceable></term>
+
+    <listitem><para>Apply the function <replaceable>f</replaceable> to
+    each element in the list <replaceable>list</replaceable>.  For
+    example,
+
+<programlisting>
+map (x: "foo" + x) ["bar" "bla" "abc"]</programlisting>
+
+    evaluates to <literal>["foobar" "foobla"
+    "fooabc"]</literal>.</para></listitem>
+    
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.pathExists</function>
+  <replaceable>path</replaceable></term>
+
+    <listitem><para>Return <literal>true</literal> if the path
+    <replaceable>path</replaceable> exists, and
+    <literal>false</literal> otherwise.  One application of this
+    function is to conditionally include a Nix expression containing
+    user configuration:
+
+<programlisting>
+let
+  fileName = builtins.getEnv "CONFIG_FILE";
+  config =
+    if fileName != "" &amp;&amp; builtins.pathExists (builtins.toPath fileName)
+    then import (builtins.toPath fileName)
+    else { someSetting = false; }; <lineannotation># default configuration</lineannotation>
+in config.someSetting</programlisting>
+
+    (Note that <envar>CONFIG_FILE</envar> must be an absolute path for
+    this to work.)</para></listitem>
+
+  </varlistentry>
+
+
+  <!--
+  <varlistentry><term><function>relativise</function></term>
+
+    <listitem><para>TODO</para></listitem>
+
+  </varlistentry>
+  -->
+
+  
+  <varlistentry><term><function>builtins.readFile</function>
+  <replaceable>path</replaceable></term>
+
+    <listitem><para>Return the contents of the file
+    <replaceable>path</replaceable> as a string.</para></listitem>
+
+  </varlistentry>
+  
+  
+  <varlistentry><term><function>removeAttrs</function>
+  <replaceable>attrs</replaceable> <replaceable>list</replaceable></term>
+
+    <listitem><para>Remove the attributes listed in
+    <replaceable>list</replaceable> from the attribute set
+    <replaceable>attrs</replaceable>.  The attributes don’t have to
+    exist in <replaceable>attrs</replaceable>. For instance,
+
+<screen>
+removeAttrs { x = 1; y = 2; z = 3; } ["a" "x" "z"]</screen>
+
+    evaluates to <literal>{y = 2;}</literal>.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.stringLength</function>
+  <replaceable>e</replaceable></term>
+
+    <listitem><para>Return the length of the string
+    <replaceable>e</replaceable>.  If <replaceable>e</replaceable> is
+    not a string, evaluation is aborted.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.sub</function>
+  <replaceable>e1</replaceable> <replaceable>e2</replaceable></term>
+
+    <listitem><para>Return the difference between the integers
+    <replaceable>e1</replaceable> and
+    <replaceable>e2</replaceable>.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.substring</function>
+  <replaceable>start</replaceable> <replaceable>len</replaceable>
+  <replaceable>s</replaceable></term>
+
+    <listitem><para>Return the substring of
+    <replaceable>s</replaceable> from character position
+    <replaceable>start</replaceable> (zero-based) up to but not
+    including <replaceable>start + len</replaceable>.  If
+    <replaceable>start</replaceable> is greater than the length of the
+    string, an empty string is returned, and if <replaceable>start +
+    len</replaceable> lies beyond the end of the string, only the
+    substring up to the end of the string is returned.
+    <replaceable>start</replaceable> must be
+    non-negative.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.tail</function>
+  <replaceable>list</replaceable></term>
+
+    <listitem><para>Return the second to last elements of a list;
+    abort evaluation if the argument isn’t a list or is an empty
+    list.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>throw</function>
+  <replaceable>s</replaceable></term>
+
+    <listitem><para>Throw an error message
+    <replaceable>s</replaceable>.  This usually aborts Nix expression
+    evaluation, but in <command>nix-env -qa</command> and other
+    commands that try to evaluate a set of derivations to get
+    information about those derivations, a derivation that throws an
+    error is silently skipped (which is not the case for
+    <function>abort</function>).</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry
+  xml:id='builtin-toFile'><term><function>builtins.toFile</function>
+  <replaceable>name</replaceable> <replaceable>s</replaceable></term>
+
+    <listitem><para>Store the string <replaceable>s</replaceable> in a
+    file in the Nix store and return its path.  The file has suffix
+    <replaceable>name</replaceable>.  This file can be used as an
+    input to derivations.  One application is to write builders
+    “inline”.  For instance, the following Nix expression combines
+    <xref linkend='ex-hello-nix' /> and <xref
+    linkend='ex-hello-builder' /> into one file:
+
+<programlisting>
+{stdenv, fetchurl, perl}:
+
+stdenv.mkDerivation {
+  name = "hello-2.1.1";
+  
+  builder = builtins.toFile "builder.sh" "
+    source $stdenv/setup
+
+    PATH=$perl/bin:$PATH
+
+    tar xvfz $src
+    cd hello-*
+    ./configure --prefix=$out
+    make
+    make install
+  ";
+
+  src = fetchurl {
+    url = http://nix.cs.uu.nl/dist/tarballs/hello-2.1.1.tar.gz;
+    md5 = "70c9ccf9fac07f762c24f2df2290784d";
+  };
+  inherit perl;
+}</programlisting>
+  
+    </para>
+
+    <para>It is even possible for one file to refer to another, e.g.,
+
+<programlisting>
+  builder = let
+    configFile = builtins.toFile "foo.conf" "
+      # This is some dummy configuration file.
+      <replaceable>...</replaceable>
+    ";
+  in builtins.toFile "builder.sh" "
+    source $stdenv/setup
+    <replaceable>...</replaceable>
+    cp ${configFile} $out/etc/foo.conf
+  ";</programlisting>
+
+    Note that <literal>${configFile}</literal> is an antiquotation
+    (see <xref linkend='ssec-values' />), so the result of the
+    expression <literal>configFile</literal> (i.e., a path like
+    <filename>/nix/store/m7p7jfny445k...-foo.conf</filename>) will be
+    spliced into the resulting string.</para>
+
+    <para>It is however <emphasis>not</emphasis> allowed to have files
+    mutually referring to each other, like so:
+
+<programlisting>
+let
+  foo = builtins.toFile "foo" "...${bar}...";
+  bar = builtins.toFile "bar" "...${foo}...";
+in foo</programlisting>
+
+    This is not allowed because it would cause a cyclic dependency in
+    the computation of the cryptographic hashes for
+    <varname>foo</varname> and <varname>bar</varname>.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.toPath</function> <replaceable>s</replaceable></term>
+
+    <listitem><para>Convert the string value
+    <replaceable>s</replaceable> into a path value.  The string
+    <replaceable>s</replaceable> must represent an absolute path
+    (i.e., must start with <literal>/</literal>).  The path need not
+    exist.  The resulting path is canonicalised, e.g.,
+    <literal>builtins.toPath "//foo/xyzzy/../bar/"</literal> returns
+    <literal>/foo/bar</literal>.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>toString</function> <replaceable>e</replaceable></term>
+
+    <listitem><para>Convert the expression
+    <replaceable>e</replaceable> to a string.
+    <replaceable>e</replaceable> can be a string (in which case
+    <function>toString</function> is a no-op) or a path (e.g.,
+    <literal>toString /foo/bar</literal> yields
+    <literal>"/foo/bar"</literal>.</para></listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry xml:id='builtin-toXML'><term><function>builtins.toXML</function> <replaceable>e</replaceable></term>
+
+    <listitem><para>Return a string containing an XML representation
+    of <replaceable>e</replaceable>.  The main application for
+    <function>toXML</function> is to communicate information with the
+    builder in a more structured format than plain environment
+    variables.</para>
+
+    <!-- TODO: more formally describe the schema of the XML
+    representation -->
+
+    <para><xref linkend='ex-toxml' /> shows an example where this is
+    the case.  The builder is supposed to generate the configuration
+    file for a <link xlink:href='http://jetty.mortbay.org/'>Jetty
+    servlet container</link>.  A servlet container contains a number
+    of servlets (<filename>*.war</filename> files) each exported under
+    a specific URI prefix.  So the servlet configuration is a list of
+    attribute sets containing the <varname>path</varname> and
+    <varname>war</varname> of the servlet (<xref
+    linkend='ex-toxml-co-servlets' />).  This kind of information is
+    difficult to communicate with the normal method of passing
+    information through an environment variable, which just
+    concatenates everything together into a string (which might just
+    work in this case, but wouldn’t work if fields are optional or
+    contain lists themselves).  Instead the Nix expression is
+    converted to an XML representation with
+    <function>toXML</function>, which is unambiguous and can easily be
+    processed with the appropriate tools.  For instance, in the
+    example an XSLT stylesheet (<xref linkend='ex-toxml-co-stylesheet'
+    />) is applied to it (<xref linkend='ex-toxml-co-apply' />) to
+    generate the XML configuration file for the Jetty server.  The XML
+    representation produced from <xref linkend='ex-toxml-co-servlets'
+    /> by <function>toXML</function> is shown in <xref
+    linkend='ex-toxml-result' />.</para>
+
+    <para>Note that <xref linkend='ex-toxml' /> uses the <function
+    linkend='builtin-toFile'>toFile</function> built-in to write the
+    builder and the stylesheet “inline” in the Nix expression.  The
+    path of the stylesheet is spliced into the builder at
+    <literal>xsltproc ${stylesheet}
+    <replaceable>...</replaceable></literal>.</para>
+
+    <example xml:id='ex-toxml'><title>Passing information to a builder
+    using <function>toXML</function></title>
+    
+<programlisting><![CDATA[
+{stdenv, fetchurl, libxslt, jira, uberwiki}:
+
+stdenv.mkDerivation (rec {
+  name = "web-server";
+
+  buildInputs = [libxslt];
+  
+  builder = builtins.toFile "builder.sh" "
+    source $stdenv/setup
+    mkdir $out
+    echo $servlets | xsltproc ${stylesheet} - > $out/server-conf.xml]]> <co xml:id='ex-toxml-co-apply' /> <![CDATA[
+  ";
+
+  stylesheet = builtins.toFile "stylesheet.xsl"]]> <co xml:id='ex-toxml-co-stylesheet' /> <![CDATA[
+   "<?xml version='1.0' encoding='UTF-8'?>
+    <xsl:stylesheet xmlns:xsl='http://www.w3.org/1999/XSL/Transform' version='1.0'>
+      <xsl:template match='/'>
+        <Configure>
+          <xsl:for-each select='/expr/list/attrs'>
+            <Call name='addWebApplication'>
+              <Arg><xsl:value-of select=\"attr[@name = 'path']/string/@value\" /></Arg>
+              <Arg><xsl:value-of select=\"attr[@name = 'war']/path/@value\" /></Arg>
+            </Call>
+          </xsl:for-each>
+        </Configure>
+      </xsl:template>
+    </xsl:stylesheet>
+  ";
+
+  servlets = builtins.toXML []]> <co xml:id='ex-toxml-co-servlets' /> <![CDATA[
+    { path = "/bugtracker"; war = jira + "/lib/atlassian-jira.war"; }
+    { path = "/wiki"; war = uberwiki + "/uberwiki.war"; }
+  ];
+})]]></programlisting>
+
+    </example>
+
+    <example xml:id='ex-toxml-result'><title>XML representation produced by
+    <function>toXML</function></title>
+    
+<programlisting><![CDATA[<?xml version='1.0' encoding='utf-8'?>
+<expr>
+  <list>
+    <attrs>
+      <attr name="path">
+        <string value="/bugtracker" />
+      </attr>
+      <attr name="war">
+        <path value="/nix/store/d1jh9pasa7k2...-jira/lib/atlassian-jira.war" />
+      </attr>
+    </attrs>
+    <attrs>
+      <attr name="path">
+        <string value="/wiki" />
+      </attr>
+      <attr name="war">
+        <path value="/nix/store/y6423b1yi4sx...-uberwiki/uberwiki.war" />
+      </attr>
+    </attrs>
+  </list>
+</expr>]]></programlisting>
+
+    </example>
+
+    </listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><function>builtins.trace</function>
+  <replaceable>e1</replaceable> <replaceable>e2</replaceable></term>
+
+    <listitem><para>Evaluate <replaceable>e1</replaceable> and print its
+    abstract syntax representation on standard error.  Then return
+    <replaceable>e2</replaceable>.  This function is useful for
+    debugging.</para></listitem>
+
+  </varlistentry>
+
+  
+</variablelist>
+
+
+</section>

doc/manual/conf-file.xml

@@ -1,4 +1,9 @@
-<sect1 id="sec-conf-file"><title>Nix configuration file</title>
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="sec-conf-file">
+
+<title>Nix configuration file</title>
+
 
 <para>A number of persistent settings of Nix are stored in the file
 <filename><replaceable>prefix</replaceable>/etc/nix/nix.conf</filename>.
@@ -7,7 +12,7 @@ This file is a list of <literal><replaceable>name</replaceable> =
 Comments start with a <literal>#</literal> character.  An example
 configuration file is shown in <xref linkend="ex-nix-conf" />.</para>
 
-<example id='ex-nix-conf'><title>Nix configuration file</title>
+<example xml:id='ex-nix-conf'><title>Nix configuration file</title>
 
 <programlisting>
 gc-keep-outputs = true       # Nice for developers
@@ -20,7 +25,8 @@ env-keep-derivations = false
 
 <variablelist>
 
-  <varlistentry id="conf-gc-keep-outputs"><term><literal>gc-keep-outputs</literal></term>
+  
+  <varlistentry xml:id="conf-gc-keep-outputs"><term><literal>gc-keep-outputs</literal></term>
 
     <listitem><para>If <literal>true</literal>, the garbage collector
     will keep the outputs of non-garbage derivations.  If
@@ -35,8 +41,9 @@ env-keep-derivations = false
     this option to <literal>true</literal>.</para></listitem>
 
   </varlistentry>
+  
 
-  <varlistentry id="conf-gc-keep-derivations"><term><literal>gc-keep-derivations</literal></term>
+  <varlistentry xml:id="conf-gc-keep-derivations"><term><literal>gc-keep-derivations</literal></term>
 
     <listitem><para>If <literal>true</literal> (default), the garbage
     collector will keep the derivations from which non-garbage store
@@ -52,6 +59,28 @@ env-keep-derivations = false
 
   </varlistentry>
 
+  
+  <varlistentry xml:id="conf-gc-reserved-space"><term><literal>gc-reserved-space</literal></term>
+
+    <listitem><para>This option specifies how much space should be
+    reserved in normal use so that the garbage collector can run
+    succesfully.  Since the garbage collector must perform Berkeley DB
+    transactions, it needs some disk space for itself.  However, when
+    the disk is full, this space is not available, so the collector
+    would not be able to run precisely when it is most needed.</para>
+
+    <para>For this reason, when Nix is run, it allocates a file
+    <filename>/nix/var/nix/db/reserved</filename> of the size
+    specified by this option.  When the garbage collector is run, this
+    file is deleted before the Berkeley DB environment is opened.
+    This should give it enough room to proceed.</para>
+
+    <para>The default is <literal>1048576</literal> (1
+    MiB).</para></listitem>
+
+  </varlistentry>
+
+  
   <varlistentry><term><literal>env-keep-derivations</literal></term>
 
     <listitem><para>If <literal>false</literal> (default), derivations
@@ -75,8 +104,161 @@ env-keep-derivations = false
 
   </varlistentry>
 
+  
+  <varlistentry xml:id="conf-build-max-jobs"><term><literal>build-max-jobs</literal></term>
+
+    <listitem><para>This option defines the maximum number of jobs
+    that Nix will try to build in parallel.  The default is
+    <literal>1</literal>.  You should generally set it to the number
+    of CPUs in your system (e.g., <literal>2</literal> on a Athlon 64
+    X2).  It can be overriden using the <option
+    linkend='opt-max-jobs'>--max-jobs</option> (<option>-j</option>)
+    command line switch.</para></listitem>
+
+  </varlistentry>
+
+
+  <varlistentry xml:id="conf-build-max-silent-time"><term><literal>build-max-silent-time</literal></term>
+
+    <listitem>
+
+      <para>This option defines the maximum number of seconds that a
+      builder can go without producing any data on standard output or
+      standard error.  This is useful (for instance in a automated
+      build system) to catch builds that are stuck in an infinite
+      loop, or to catch remote builds that are hanging due to network
+      problems.  It can be overriden using the <option
+      linkend="opt-max-silent-time">--max-silent-time</option> command
+      line switch.</para>
+
+      <para>The value <literal>0</literal> means that there is no
+      timeout.  This is also the default.</para>
+
+    </listitem>
+
+  </varlistentry>
+
+
+  <varlistentry xml:id="conf-build-users-group"><term><literal>build-users-group</literal></term>
+
+    <listitem><para>This options specifies the Unix group containing
+    the Nix build user accounts.  In multi-user Nix installations,
+    builds should not be performed by the Nix account since that would
+    allow users to arbitrarily modify the Nix store and database by
+    supplying specially crafted builders; and they cannot be performed
+    by the calling user since that would allow him/her to influence
+    the build result.</para>
+
+    <para>Therefore, if this option is non-empty and specifies a valid
+    group, builds will be performed under the user accounts that are a
+    member of the group specified here (as listed in
+    <filename>/etc/group</filename>).  Those user accounts should not
+    be used for any other purpose!</para>
+
+    <para>Nix will never run two builds under the same user account at
+    the same time.  This is to prevent an obvious security hole: a
+    malicious user writing a Nix expression that modifies the build
+    result of a legitimate Nix expression being built by another user.
+    Therefore it is good to have as many Nix build user accounts as
+    you can spare.  (Remember: uids are cheap.)</para>
+
+    <para>The build users should have permission to create files in
+    the Nix store, but not delete them.  Therefore,
+    <filename>/nix/store</filename> should be owned by the Nix
+    account, its group should be the group specified here, and its
+    mode should be <literal>1775</literal>.</para>
+
+    <para>If the build users group is empty, builds will be performed
+    under the uid of the Nix process (that is, the uid of the caller
+    if <envar>NIX_REMOTE</envar> is empty, the uid under which the Nix
+    daemon runs if <envar>NIX_REMOTE</envar> is
+    <literal>daemon</literal>, or the uid that owns the setuid
+    <command>nix-worker</command> program if <envar>NIX_REMOTE</envar>
+    is <literal>slave</literal>).  Obviously, this should not be used
+    in multi-user settings with untrusted users.</para>
+
+    </listitem>
+
+  </varlistentry>
+
+
+  <varlistentry><term><literal>build-use-chroot</literal></term>
+
+    <listitem><para>If set to <literal>true</literal>, builds will be
+    performed in a <emphasis>chroot environment</emphasis>, i.e., the
+    build will be isolated from the normal file system hierarchy and
+    will only see the Nix store, the temporary build directory, and
+    the directories configured with the <link
+    linkend='conf-build-chroot-dirs'><literal>build-chroot-dirs</literal>
+    option</link> (such as <filename>/proc</filename> and
+    <filename>/dev</filename>).  This is useful to prevent undeclared
+    dependencies on files in directories such as
+    <filename>/usr/bin</filename>.</para>
+
+    <para>The use of a chroot requires that Nix is run as root (but
+    you can still use the <link
+    linkend='conf-build-users-group'>“build users” feature</link> to
+    perform builds under different users than root).  Currently,
+    chroot builds only work on Linux because Nix uses “bind mounts” to
+    make the Nix store and other directories available inside the
+    chroot.</para>
+
+    </listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry xml:id="conf-build-chroot-dirs"><term><literal>build-chroot-dirs</literal></term>
+
+    <listitem><para>When builds are performed in a chroot environment,
+    Nix will mount (using <command>mount --bind</command> on Linux)
+    some directories from the normal file system hierarchy inside the
+    chroot.  These are the Nix store, the temporary build directory
+    (usually
+    <filename>/tmp/nix-<replaceable>pid</replaceable>-<replaceable>number</replaceable></filename>)
+    and the directories listed here.  The default is <literal>dev
+    /proc</literal>.  Files in <filename>/dev</filename> (such as
+    <filename>/dev/null</filename>) are needed by many builds, and
+    some files in <filename>/proc</filename> may also be needed
+    occasionally.</para>
+
+    <para>The value used on NixOS is
+    
+<programlisting>
+build-use-chroot = /dev /proc /bin</programlisting>
+
+    to make the <filename>/bin/sh</filename> symlink available (which
+    is still needed by many builders).</para>
+
+    </listitem>
+
+  </varlistentry>
+
+  
+  <varlistentry><term><literal>system</literal></term>
+
+    <listitem><para>This option specifies the canonical Nix system
+    name of the current installation, such as
+    <literal>i686-linux</literal> or
+    <literal>powerpc-darwin</literal>.  Nix can only build derivations
+    whose <literal>system</literal> attribute equals the value
+    specified here.  In general, it never makes sense to modify this
+    value from its default, since you can use it to ‘lie’ about the
+    platform you are building on (e.g., perform a Mac OS build on a
+    Linux machine; the result would obviously be wrong).  It only
+    makes sense if the Nix binaries can run on multiple platforms,
+    e.g., ‘universal binaries’ that run on <literal>powerpc-darwin</literal> and
+    <literal>i686-darwin</literal>.</para>
+
+    <para>It defaults to the canonical Nix system name detected by
+    <filename>configure</filename> at build time.</para></listitem>
+
+  </varlistentry>
+  
+    
 </variablelist>
 
 </para>
 
-</sect1>
+
+</section>

doc/manual/env-common.xml

@@ -1,21 +1,15 @@
-<sect1 id="sec-common-env"><title>Common environment variables</title>
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="sec-common-env">
+
+<title>Common environment variables</title>
+
 
 <para>Most Nix commands interpret the following environment variables:</para>
 
 <variablelist>
 
   
-<varlistentry><term><envar>NIX_ROOT</envar></term>
-
-  <listitem><para>If <envar>NIX_ROOT</envar> is set, the Nix command
-  will on startup perform a <function>chroot()</function> to the
-  specified directory.  This is useful in certain bootstrapping
-  situations (e.g., when installing a Nix installation onto a hard
-  disk from CD-ROM).</para></listitem>
-
-</varlistentry>
-
-  
 <varlistentry><term><envar>NIX_IGNORE_SYMLINK_STORE</envar></term>
 
   <listitem>
@@ -118,7 +112,7 @@ $ mount -o bind /mnt/otherdisk/nix /nix</screen>
 </varlistentry>
 
 
-<varlistentry id="envar-build-hook"><term><envar>NIX_BUILD_HOOK</envar></term>
+<varlistentry xml:id="envar-build-hook"><term><envar>NIX_BUILD_HOOK</envar></term>
 
   <listitem>
 
@@ -269,6 +263,18 @@ $ mount -o bind /mnt/otherdisk/nix /nix</screen>
 </varlistentry>
 
 
+<varlistentry xml:id="envar-remote"><term><envar>NIX_REMOTE</envar></term>
+
+  <listitem><para>This variable should be set to
+  <literal>daemon</literal> if you want to use the Nix daemon to
+  executed Nix operations, which is necessary in <link
+  linkend="ssec-multi-user">multi-user Nix installations</link>.
+  Otherwise, it should be left unset.</para></listitem>
+
+</varlistentry>
+
+    
 </variablelist>
 
-</sect1>
+
+</section>

doc/manual/glossary.xml

@@ -1,9 +1,13 @@
-<appendix><title>Glossary</title>
+<appendix xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink">
+
+<title>Glossary</title>
+
 
 <glosslist>
 
 
-<glossentry id="gloss-derivation"><glossterm>derivation</glossterm>
+<glossentry xml:id="gloss-derivation"><glossterm>derivation</glossterm>
 
   <glossdef><para>A description of a build action.  The result of a
   derivation is a store object.  Derivations are typically specified
@@ -46,7 +50,7 @@
 </glossentry>
 
 
-<glossentry id="gloss-substitute"><glossterm>substitute</glossterm>
+<glossentry xml:id="gloss-substitute"><glossterm>substitute</glossterm>
 
   <glossdef><para>A substitute is a command invocation stored in the
   Nix database that describes how to build a store object, bypassing
@@ -70,16 +74,16 @@
 
 <glossentry><glossterm>Nix expression</glossterm>
 
-  <glossdef><para>A high-level description of software components and
+  <glossdef><para>A high-level description of software packages and
   compositions thereof.  Deploying software using Nix entails writing
-  Nix expressions for your components.  Nix expressions are translated
+  Nix expressions for your packages.  Nix expressions are translated
   to derivations that are stored in the Nix store.  These derivations
   can then be built.</para></glossdef>
 
 </glossentry>
 
 
-<glossentry id="gloss-reference"><glossterm>reference</glossterm>
+<glossentry xml:id="gloss-reference"><glossterm>reference</glossterm>
 
   <glossdef><para>A store path <varname>P</varname> is said to have a
   reference to a store path <varname>Q</varname> if the store object
@@ -92,7 +96,7 @@
 </glossentry>
 
 
-<glossentry id="gloss-closure"><glossterm>closure</glossterm>
+<glossentry xml:id="gloss-closure"><glossterm>closure</glossterm>
 
   <glossdef><para>The closure of a store path is the set of store
   paths that are directly or indirectly “reachable” from that store
@@ -108,14 +112,14 @@
 </glossentry>
 
 
-<glossentry id="gloss-output-path"><glossterm>output path</glossterm>
+<glossentry xml:id="gloss-output-path"><glossterm>output path</glossterm>
 
   <glossdef><para>A store path produced by a derivation.</para></glossdef>
 
 </glossentry>
 
 
-<glossentry id="gloss-deriver"><glossterm>deriver</glossterm>
+<glossentry xml:id="gloss-deriver"><glossterm>deriver</glossterm>
 
   <glossdef><para>The deriver of an <link
   linkend="gloss-output-path">output path</link> is the store
@@ -124,7 +128,7 @@
 </glossentry>
 
 
-<glossentry id="gloss-validity"><glossterm>validity</glossterm>
+<glossentry xml:id="gloss-validity"><glossterm>validity</glossterm>
 
   <glossdef><para>A store path is considered
   <emphasis>valid</emphasis> if it exists in the file system, is
@@ -134,7 +138,7 @@
 </glossentry>
 
 
-<glossentry id="gloss-user-env"><glossterm>user environment</glossterm>
+<glossentry xml:id="gloss-user-env"><glossterm>user environment</glossterm>
 
   <glossdef><para>An automatically generated store object that
   consists of a set of symlinks to “active” applications, i.e., other
@@ -147,7 +151,7 @@
 </glossentry>
 
 
-<glossentry id="gloss-profile"><glossterm>profile</glossterm>
+<glossentry xml:id="gloss-profile"><glossterm>profile</glossterm>
 
   <glossdef><para>A symlink to the current <link
   linkend="gloss-user-env">user environment</link> of a user, e.g.,

doc/manual/installation.xml

@@ -1,36 +1,75 @@
-<chapter id='chap-installation'><title>Installation</title>
+<?xml version="1.0" encoding="utf-8"?>
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="chap-installation">
+
+<title>Installation</title>
 
 
-<sect1><title>Obtaining Nix</title>
+<section><title>Supported platforms</title>
 
-<para>The easiest way to obtain Nix is to download a <ulink
-url='http://www.cs.uu.nl/groups/ST/Trace/Nix'>source
-distribution</ulink>.  RPMs for Red Hat, SuSE, and Fedore Core are
-also available.</para>
+<para>Nix is currently supported on the following platforms:
+
+<itemizedlist>
+
+  <listitem><para>Linux (particularly on x86, x86_64, and
+  PowerPC).</para></listitem>
+
+  <listitem><para>Mac OS X, both on Intel and
+  PowerPC.</para></listitem>
+
+  <listitem><para>FreeBSD (only tested on Intel).</para></listitem>
+
+  <listitem><para>Windows through <link
+  xlink:href="http://www.cygwin.com/">Cygwin</link>.</para>
+
+  <warning><para>On Cygwin, Nix <emphasis>must</emphasis> be installed
+  on an NTFS partition.  It will not work correctly on a FAT
+  partition.</para></warning>
+
+  </listitem>
+
+</itemizedlist>
+
+</para>
+
+<para>Nix is pretty portable, so it should work on most other Unix
+platforms as well.</para>
+
+</section>
+
+
+<section><title>Obtaining Nix</title>
+
+<para>The easiest way to obtain Nix is to download a <link
+xlink:href="http://nix.cs.uu.nl/">source distribution</link>.  RPMs
+for Red Hat, SuSE, and Fedora Core are also available.</para>
 
 <para>Alternatively, the most recent sources of Nix can be obtained
-from its <ulink
-url='https://svn.cs.uu.nl:12443/repos/trace/nix/trunk'>Subversion
-repository</ulink>.  For example, the following command will check out
-the latest revision into a directory called <filename>nix</filename>:</para>
+from its <link
+xlink:href="https://svn.cs.uu.nl:12443/repos/trace/nix/trunk">Subversion
+repository</link>.  For example, the following command will check out
+the latest revision into a directory called
+<filename>nix</filename>:</para>
 
 <screen>
 $ svn checkout https://svn.cs.uu.nl:12443/repos/trace/nix/trunk nix</screen>
 
-<para>Likewise, specific releases can be obtained from the <ulink
-url='https://svn.cs.uu.nl:12443/repos/trace/nix/tags'>tags
-directory</ulink> of the repository.  If you don't have Subversion,
-you can also download an automatically generated <ulink
-url='https://svn.cs.uu.nl:12443/dist/trace/'>compressed
-tar-file</ulink> of the head revision of the trunk.</para>
+<para>Likewise, specific releases can be obtained from the <link
+xlink:href="https://svn.cs.uu.nl:12443/repos/trace/nix/tags">tags
+directory</link> of the repository.  If you don't have Subversion, you
+can also download an automatically generated <link
+xlink:href="https://svn.cs.uu.nl:12443/dist/trace/">compressed
+tar-file</link> of the head revision of the trunk.</para>
 
-</sect1>
+</section>
 
 
-<sect1><title>Prerequisites</title>
+<section><title>Prerequisites</title>
 
-<para>The following prerequisites only apply when you build from
-source.  Binary releases (e.g., RPMs) have no prerequisites.</para>
+<para><emphasis>The following prerequisites only apply when you build
+from source</emphasis>.  Binary releases (e.g., RPMs) have no
+prerequisites.</para>
 
 <para>A fairly recent version of GCC/G++ is required.  Version 2.95
 and higher should work.</para>
@@ -39,56 +78,62 @@ and higher should work.</para>
 <command>xmllint</command> and <command>xsltproc</command> programs,
 which are part of the <literal>libxml2</literal> and
 <literal>libxslt</literal> packages, respectively.  You also need the
-<ulink url='http://docbook.sourceforge.net/projects/xsl/'>DocBook XSL
-stylesheets</ulink> and optionally the <ulink
-url='http://www.oasis-open.org/docbook/xml/4.2/docbook-xml-4.2.zip'>
-DocBook XML 4.2 DTD</ulink>.  Note that these are only required if you
-modify the manual sources or when you are building from the Subversion
+<link
+xlink:href="http://docbook.sourceforge.net/projects/xsl/">DocBook XSL
+stylesheets</link> and optionally the <link
+xlink:href="http://www.docbook.org/schemas/5x"> DocBook 5.0 RELAX NG
+schemas</link>.  Note that these are only required if you modify the
+manual sources or when you are building from the Subversion
 repository.</para>
 
 <para>To build the parser, very <emphasis>recent</emphasis> versions
 of Bison and Flex are required.  (This is because Nix needs GLR
 support in Bison and reentrancy support in Flex.)  For Bison, you need
-version 1.875c or higher (1.875 does <emphasis>not</emphasis> work),
-which can be obtained from the <ulink
-url='ftp://alpha.gnu.org/pub/gnu/bison'>GNU FTP server</ulink>.  For
-Flex, you need version 2.5.31, which is available on <ulink
-url='http://lex.sourceforge.net/'>SourceForge</ulink>.  Slightly older
-versions may also work, but ancient versions like the ubiquitous
-2.5.4a won't.  Note that these are only required if you modify the
-parser or when you are building from the Subversion repository.</para>
+version 2.3 or higher (1.875 does <emphasis>not</emphasis> work),
+which can be obtained from
+the <link xlink:href="ftp://alpha.gnu.org/pub/gnu/bison">GNU FTP
+server</link>.  For Flex, you need version 2.5.33, which is available
+on <link xlink:href="http://lex.sourceforge.net/">SourceForge</link>.
+Slightly older versions may also work, but ancient versions like the
+ubiquitous 2.5.4a won't.  Note that these are only required if you
+modify the parser or when you are building from the Subversion
+repository.</para>
 
-<para>Nix uses Sleepycat's Berkeley DB and CWI's ATerm library.  These
-are included in the Nix source distribution.  If you build from the
-Subversion repository, you must download them yourself and place them
-in the <filename>externals/</filename> directory.  See
+<para>Nix uses Sleepycat's Berkeley DB, CWI's ATerm library and the
+bzip2 compressor (including the bzip2 library).  These are included in
+the Nix source distribution.  If you build from the Subversion
+repository, you must download them yourself and place them in the
+<filename>externals/</filename> directory.  See
 <filename>externals/Makefile.am</filename> for the precise URLs of
 these packages.  Alternatively, if you already have them installed,
-you can use <command>configure</command>'s <option>--with-bdb</option>
-and <option>--with-aterm</option> options to point to their respective
+you can use <command>configure</command>'s
+<option>--with-bdb</option>, <option>--with-aterm</option> and
+<option>--with-bzip2</option> options to point to their respective
 locations.  Note that Berkeley DB <emphasis>must</emphasis> be version
-4.2; other versions may not have compatible database formats.</para>
+4.5; other versions may not have compatible database formats.</para>
 
-</sect1>
+</section>
 
 
-<sect1><title>Building Nix from source</title>
+<section><title>Building Nix from source</title>
 
 <para>After unpacking or checking out the Nix sources, issue the
 following commands:
-    </para>
 
 <screen>
 $ ./configure <replaceable>options...</replaceable>
 $ make
 $ make install</screen>
 
+</para>
+
 <para>When building from the Subversion repository, these should be
 preceded by the command:
-    </para>
 
 <screen>
-$ autoreconf -i</screen>
+$ ./bootstrap</screen>
+
+</para>
 
 <para>The installation path can be specified by passing the
 <option>--prefix=<replaceable>prefix</replaceable></option> to
@@ -97,99 +142,314 @@ $ autoreconf -i</screen>
 like.  You must have write permission to the
 <replaceable>prefix</replaceable> path.</para>
 
-<warning><para>It is advisable <emphasis>not</emphasis> to change the
-installation prefix from its default, since doing so will in all
-likelihood make it impossible to use derivations built on other
-systems.</para></warning>
+<warning><para>It is best <emphasis>not</emphasis> to change the
+installation prefix from its default, since doing so makes it
+impossible to use pre-built binaries from the standard Nixpkgs
+channels.</para></warning>
 
 <para>If you want to rebuilt the documentation, pass the full path to
-the DocBook XML catalog file (<filename>docbook.cat</filename>) and to
-the DocBook XSL stylesheets using the
-<option>--with-docbook-catalog=<replaceable>path</replaceable></option>
+the DocBook RELAX NG schemas and to the DocBook XSL stylesheets using
+the
+<option>--with-docbook-rng=<replaceable>path</replaceable></option>
 and
 <option>--with-docbook-xsl=<replaceable>path</replaceable></option>
 options.</para>
 
-</sect1>
+</section>
 
 
-<sect1><title>Installing from RPMs</title>
+<section><title>Installing from RPMs</title>
 
-<para>RPM packages of Nix can be downloaded from <ulink
-url='http://www.cs.uu.nl/groups/ST/Trace/Nix' />.  These RPMs should
-work for most fairly recent releases of SuSE and Red Hat Linux.  They
-have been known to work work on SuSE Linux 8.1 and 9.0, and Red Hat
-9.0.  In fact, it should work on any RPM-based Linux distribution
-based on <literal>glibc</literal> 2.3 or later.</para>
+<para>RPM packages of Nix can be downloaded from <link
+xlink:href="http://nix.cs.uu.nl/" />.  These RPMs should work for most
+fairly recent releases of SuSE and Red Hat Linux.  They have been
+known to work work on SuSE Linux 8.1 and 9.0, and Red Hat 9.0.  In
+fact, it should work on any RPM-based Linux distribution based on
+<literal>glibc</literal> 2.3 or later.</para>
 
 <para>Once downloaded, the RPMs can be installed or upgraded using
-<command>rpm -U</command>.  For example,</para>
+<command>rpm -U</command>.  For example,
 
 <screen>
 $ rpm -U nix-0.5pre664-1.i386.rpm</screen>
 
+</para>
+
 <para>The RPMs install into the directory <filename>/nix</filename>.
 Nix can be uninstalled using <command>rpm -e nix</command>.  After
 this it will be necessary to manually remove the Nix store and other
-auxiliary data:</para>
+auxiliary data:
 
 <screen>
 $ rm -rf /nix/store
 $ rm -rf /nix/var</screen>
 
-</sect1>
+</para>
+
+</section>
 
 
-<sect1><title>Permissions</title>
+<section><title>Upgrading Nix through Nix</title>
 
-<para>All Nix operations must be performed under the user ID that owns
-the Nix store and database
-(<filename><replaceable>prefix</replaceable>/store</filename> and
-<filename><replaceable>prefix</replaceable>/var/nix/db</filename>,
-respectively).  When installed from the RPM packages, these
-directories are owned by <systemitem
-class='username'>root</systemitem>.</para>
+<para>You can install the latest stable version of Nix through Nix
+itself by subscribing to the channel <link
+xlink:href="http://nix.cs.uu.nl/dist/nix/channels-v3/nix-stable" />,
+or the latest unstable version by subscribing to the channel <link
+xlink:href="http://nix.cs.uu.nl/dist/nix/channels-v3/nix-unstable" />.
+You can also do a <link linkend="sec-one-click">one-click
+installation</link> by clicking on the package links at <link
+xlink:href="http://nix.cs.uu.nl/dist/nix/" />.</para>
 
-<sect2><title>Setuid installation</title>
+</section>
 
-<para>As a somewhat <emphasis>ad hoc</emphasis> hack, you can also
-install the Nix binaries <quote>setuid</quote> so that a Nix store can
-be shared among several users.  To do this, configure Nix with the
-<emphasis>--enable-setuid</emphasis> option.  Nix will be installed as
-owned by a user and group specified by the
-<option>--with-nix-user=<parameter>user</parameter></option> and
-<option>--with-nix-group=<parameter>group</parameter></option>
-options.  E.g.,
 
-<screen>
-$ ./configure --enable-setuid --with-nix-user=my_nix_user --with-nix-group=my_nix_group</screen>
+<section><title>Security</title>
 
-The user and group default to <literal>nix</literal>.  You should make
-sure that both the user and the group exist.  Any <quote>real</quote>
-users that you want to allow access should be added to the Nix
+<para>Nix has two basic security models.  First, it can be used in
+“single-user mode”, which is similar to what most other package
+management tools do: there is a single user (typically <systemitem
+class="username">root</systemitem>) who performs all package
+management operations.  All other users can then use the installed
+packages, but they cannot perform package management operations
+themselves.</para>
+
+<para>Alternatively, you can configure Nix in “multi-user mode”.  In
+this model, all users can perform package management operations — for
+instance, every user can install software without requiring root
+privileges.  Nix ensures that this is secure.  For instance, it’s not
+possible for one user to overwrite a package used by another user with
+a Trojan horse.</para>
+
+
+<section><title>Single-user mode</title>
+  
+<para>In single-user mode, all Nix operations that access the database
+in <filename><replaceable>prefix</replaceable>/var/nix/db</filename>
+or modify the Nix store in
+<filename><replaceable>prefix</replaceable>/store</filename> must be
+performed under the user ID that owns those directories.  This is
+typically <systemitem class="username">root</systemitem>.  (If you
+install from RPM packages, that’s in fact the default ownership.)
+However, on single-user machines, it is often convenient to
+<command>chown</command> those directories to your normal user account
+so that you don’t have to <command>su</command> to <systemitem
+class="username">root</systemitem> all the time.</para>
+
+</section>
+
+
+<section xml:id="ssec-multi-user"><title>Multi-user mode</title>
+
+<para>To allow a Nix store to be shared safely among multiple users,
+it is important that users are not able to run builders that modify
+the Nix store or database in arbitrary ways, or that interfere with
+builds started by other users.  If they could do so, they could
+install a Trojan horse in some package and compromise the accounts of
+other users.</para>
+
+<para>To prevent this, the Nix store and database are owned by some
+privileged user (usually <literal>root</literal>) and builders are
+executed under special user accounts (usually named
+<literal>nixbld1</literal>, <literal>nixbld2</literal>, etc.).  When a
+unprivileged user runs a Nix command, actions that operate on the Nix
+store (such as builds) are forwarded to a <emphasis>Nix
+daemon</emphasis> running under the owner of the Nix store/database
+that performs the operation.</para>
+
+<note><para>Multi-user mode has one important limitation: only
+<systemitem class="username">root</systemitem> can run <command
+linkend="sec-nix-pull">nix-pull</command> to register the availability
+of pre-built binaries.  However, those registrations are shared by all
+users, so they still get the benefit from <command>nix-pull</command>s
+done by <systemitem class="username">root</systemitem>.</para></note>
+
+
+<section><title>Setting up the build users</title>
+
+<para>The <emphasis>build users</emphasis> are the special UIDs under
+which builds are performed.  They should all be members of the
+<emphasis>build users group</emphasis> (usually called
+<literal>nixbld</literal>).  This group should have no other members.
+The build users should not be members of any other group.</para>
+
+<para>Here is a typical <filename>/etc/group</filename> definition of
+the build users group with 10 build users:
+
+<programlisting>
+nixbld:!:30000:nixbld1,nixbld2,nixbld3,nixbld4,nixbld5,nixbld6,nixbld7,nixbld8,nixbld9,nixbld10
+</programlisting>
+
+In this example the <literal>nixbld</literal> group has UID 30000, but
+of course it can be anything that doesn’t collide with an existing
 group.</para>
 
-<warning><para>A setuid installation should only by used if the users
-in the Nix group are mutually trusted, since any user in that group
-has the ability to change anything in the Nix store or database.  For
-instance, they could install a trojan horse in executables used by
-other users.</para></warning>
+<para>Here is the corresponding part of
+<filename>/etc/passwd</filename>:
 
-<warning><para>On some platforms, the Nix binaries will be installed
-as setuid <literal>root</literal>.  They drop root privileges
-immediately after startup and switch to the Nix user.  The reason for
-this is that both the real and effective user must be set to the Nix
-user, and POSIX has no system call to do this.  This is not the case
-on systems that have the <function>setresuid()</function> system call
-(such as Linux and FreeBSD), so on those systems the binaries are
-simply owned by the Nix user.</para></warning>
+<programlisting>
+nixbld1:x:30001:65534:Nix build user 1:/var/empty:/noshell
+nixbld2:x:30002:65534:Nix build user 2:/var/empty:/noshell
+nixbld3:x:30003:65534:Nix build user 3:/var/empty:/noshell
+...
+nixbld10:x:30010:65534:Nix build user 10:/var/empty:/noshell
+</programlisting>
 
-</sect2>
+The home directory of the build users should not exist or should be an
+empty directory to which they do not have write access.</para>
 
-</sect1>
+<para>The build users should have write access to the Nix store, but
+they should not have the right to delete files.  Thus the Nix store’s
+group should be the build users group, and it should have the sticky
+bit turned on (like <filename>/tmp</filename>):
+
+<screen>
+$ chgrp nixbld /nix/store
+$ chmod 1777 /nix/store
+</screen>
+
+</para>
+
+<para>Finally, you should tell Nix to use the build users by
+specifying the build users group in the <link
+linkend="conf-build-users-group"><literal>build-users-group</literal>
+option</link> in the <link linkend="sec-conf-file">Nix configuration
+file</link> (<literal>/nix/etc/nix/nix.conf</literal>):
+
+<programlisting>
+build-users-group = nixbld
+</programlisting>
+
+</para>
+
+</section>
 
 
-<sect1><title>Using Nix</title>
+<section><title>Nix store/database owned by root</title>
+
+<para>The simplest setup is to let <literal>root</literal> own the Nix
+store and database.  I.e.,
+
+<screen>
+$ chown -R root /nix/store /nix/var/nix</screen>
+
+</para>
+
+<para>The Nix daemon should be started as follows (as
+<literal>root</literal>):
+
+<screen>
+$ nix-worker --daemon</screen>
+
+You’ll want to put that line somewhere in your system’s boot
+scripts.</para>
+
+<para>To let unprivileged users use the daemon, they should set the
+<link linkend="envar-remote"><envar>NIX_REMOTE</envar> environment
+variable</link> to <literal>daemon</literal>.  So you should put a
+line like
+
+<programlisting>
+export NIX_REMOTE=daemon</programlisting>
+
+into the users’ login scripts.</para>
+
+</section>
+
+
+<section><title>Nix store/database not owned by root</title>
+
+<para>It is also possible to let the Nix store and database be owned
+by a non-root user, which should be more secure<footnote><para>Note
+however that even when the Nix daemon runs as root, not
+<emphasis>that</emphasis> much code is executed as root: Nix
+expression evaluation is performed by the calling (unprivileged) user,
+and builds are performed under the special build user accounts.  So
+only the code that accesses the database and starts builds is executed
+as <literal>root</literal>.</para></footnote>.  Typically, this user
+is a special account called <literal>nix</literal>, but it can be
+named anything.  It should own the Nix store and database:
+
+<screen>
+$ chown -R root /nix/store /nix/var/nix</screen>
+
+and of course <command>nix-worker --daemon</command> should be started
+under that user, e.g.,
+
+<screen>
+$ su - nix -c "exec /nix/bin/nix-worker --daemon"</screen>
+
+</para>
+
+<para>There is a catch, though: non-<literal>root</literal> users
+cannot start builds under the build user accounts, since the
+<function>setuid</function> system call is obviously privileged.  To
+allow a non-<literal>root</literal> Nix daemon to use the build user
+feature, it calls a setuid-root helper program,
+<command>nix-setuid-helper</command>.  This program is installed in
+<filename><replaceable>prefix</replaceable>/libexec/nix-setuid-helper</filename>.
+To set the permissions properly (Nix’s <command>make install</command>
+doesn’t do this, since we don’t want to ship setuid-root programs
+out-of-the-box):
+
+<screen>
+$ chown root.root /nix/libexec/nix-setuid-helper
+$ chmod 4755 /nix/libexec/nix-setuid-helper
+</screen>
+
+(This example assumes that the Nix binaries are installed in
+<filename>/nix</filename>.)</para>
+
+<para>Of course, the <command>nix-setuid-helper</command> command
+should not be usable by just anybody, since then anybody could run
+commands under the Nix build user accounts.  For that reason there is
+a configuration file <filename>/etc/nix-setuid.conf</filename> that
+restricts the use of the helper.  This file should be a text file
+containing precisely two lines, the first being the Nix daemon user
+and the second being the build users group, e.g.,
+
+<programlisting>
+nix
+nixbld
+</programlisting>
+
+The setuid-helper barfs if it is called by a user other than the one
+specified on the first line, or if it is asked to execute a build
+under a user who is not a member of the group specified on the second
+line.  The file <filename>/etc/nix-setuid.conf</filename> must be
+owned by root, and must not be group- or world-writable.  The
+setuid-helper barfs if this is not the case.</para>
+
+</section>
+
+
+<section><title>Restricting access</title>
+
+<para>To limit which users can perform Nix operations, you can use the
+permissions on the directory
+<filename>/nix/var/nix/daemon-socket</filename>.  For instance, if you
+want to restrict the use of Nix to the members of a group called
+<literal>nix-users</literal>, do
+
+<screen>
+$ chgrp nix-users /nix/var/nix/daemon-socket
+$ chmod ug=rwx,o= /nix/var/nix/daemon-socket
+</screen>
+
+This way, users who are not in the <literal>nix-users</literal> group
+cannot connect to the Unix domain socket
+<filename>/nix/var/nix/daemon-socket/socket</filename>, so they cannot
+perform Nix operations.</para>
+
+</section>
+
+
+</section> <!-- end of multi-user -->
+
+
+</section> <!-- end of security -->
+
+
+<section><title>Using Nix</title>
 
 <para>To use Nix, some environment variables should be set.  In
 particular, <envar>PATH</envar> should contain the directories
@@ -206,7 +466,7 @@ in your <filename>~/.bashrc</filename> (or similar), like this:</para>
 <screen>
 source <replaceable>prefix</replaceable>/etc/profile.d/nix.sh</screen>
 
-</sect1>
+</section>
 
 
 </chapter>

doc/manual/introduction.xml

@@ -1,150 +1,336 @@
-<chapter><title>Introduction</title>
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="chap-introduction">
+
+<title>Introduction</title>
+
+
+<section><title>About Nix</title>
+
+<para>Nix is a <emphasis>purely functional package manager</emphasis>.
+This means that it treats packages like values in purely functional
+programming languages such as Haskell — they are built by functions
+that don’t have side-effects, and they never change after they have
+been built.  Nix stores packages in the <emphasis>Nix
+store</emphasis>, usually the directory
+<filename>/nix/store</filename>, where each package has its own unique
+subdirectory such as
+
+<programlisting>
+/nix/store/r8vvq9kq18pz08v249h8my6r9vs7s0n3-firefox-2.0.0.1/
+</programlisting>
+
+where <literal>r8vvq9kq…</literal> is a unique identifier for the
+package that captures all its dependencies (it’s a cryptographic hash
+of the package’s build dependency graph).  This enables many powerful
+features.</para>
+
+
+<simplesect><title>Multiple versions</title>
+
+<para>You can have multiple versions or variants of a package
+installed at the same time.  This is especially important when
+different applications have dependencies on different versions of the
+same package — it prevents the “DLL hell”.  Because of the hashing
+scheme, different versions of a package end up in different paths in
+the Nix store, so they don’t interfere with each other.</para>
+
+<para>An important consequence is that operations like upgrading or
+uninstalling an application cannot break other applications, since
+these operations never “destructively” update or delete files that are
+used by other packages.</para>
+
+</simplesect>
+
+
+<simplesect><title>Complete dependencies</title>
+
+<para>Nix helps you make sure that package dependency specifications
+are complete.  In general, when you’re making a package for a package
+management system like RPM, you have to specify for each package what
+its dependencies are, but there are no guarantees that this
+specification is complete.  If you forget a dependency, then the
+package will build and work correctly on <emphasis>your</emphasis>
+machine if you have the dependency installed, but not on the end
+user's machine if it's not there.</para>
+
+<para>Since Nix on the other hand doesn’t install packages in “global”
+locations like <filename>/usr/bin</filename> but in package-specific
+directories, the risk of incomplete dependencies is greatly reduced.
+This is because tools such as compilers don’t search in per-packages
+directories such as
+<filename>/nix/store/5lbfaxb722zp…-openssl-0.9.8d/include</filename>,
+so if a package builds correctly on your system, this is because you
+specified the dependency explicitly.</para>
+
+<para>Runtime dependencies are found by scanning binaries for the hash
+parts of Nix store paths (such as <literal>r8vvq9kq…</literal>).  This
+sounds risky, but it works extremely well.</para>
+
+</simplesect>
+
+
+<simplesect><title>Multi-user support</title>
+
+<para>Starting at version 0.11, Nix has multi-user support.  This
+means that non-privileged users can securely install software.  Each
+user can have a different <emphasis>profile</emphasis>, a set of
+packages in the Nix store that appear in the user’s
+<envar>PATH</envar>.  If a user installs a package that another user
+has already installed previously, the package won’t be built or
+downloaded a second time.  At the same time, it is not possible for
+one user to inject a Trojan horse into a package that might be used by
+another user.</para>
 
 <!--
-<epigraph><para><quote>The number of Nix installations in the world
-has grown to 5, with more expected.</quote></para></epigraph>
+<para>More details can be found in Section 3 of our <a
+href="docs/papers.html#securesharing">ASE 2005 paper</a>.</para>
 -->
 
-<para>Nix is a system for the deployment of software.  Software
-deployment is concerned with the creation, distribution, and
-management of software components (<quote>packages</quote>).  Its main
-features are:
+</simplesect>
 
-<itemizedlist>
 
-<listitem><para>It helps you make sure that dependency specifications
-are complete.  In general in a deployment system you have to specify
-for each component what its dependencies are, but there are no
-guarantees that this specification is complete.  If you forget a
-dependency, then the component will build and work correctly on
-<emphasis>your</emphasis> machine if you have the dependency
-installed, but not on the end user's machine if it's not
-there.</para></listitem>
+<simplesect><title>Atomic upgrades and rollbacks</title>
 
-<listitem><para>It is possible to have <emphasis>multiple versions or
-variants</emphasis> of a component installed at the same time.  In
-contrast, in systems such as RPM different versions of the same
-package tend to install to the same location in the file system, so
-installing one version will remove the other.  This is especially
-important if you want to use applications that have conflicting
-requirements on different versions of a component (e.g., application A
-requires version 1.0 of library X, while application B requires a
-non-backwards compatible version 1.1).</para></listitem>
+<para>Since package management operations never overwrite packages in
+the Nix store but just add new versions in different paths, they are
+<emphasis>atomic</emphasis>.  So during a package upgrade, there is no
+time window in which the package has some files from the old version
+and some files from the new version — which would be bad because a
+program might well crash if it’s started during that period.</para>
 
-<listitem><para>Users can have different <quote>views</quote>
-(<quote>profiles</quote> in Nix parlance) on the set of installed
-applications in a system.  For instance, one user can have version 1.0
-of some package visible, while another is using version 1.1, and a
-third doesn't use it at all.</para></listitem>
+<para>And since package aren’t overwritten, the old versions are still
+there after an upgrade.  This means that you can <emphasis>roll
+back</emphasis> to the old version:</para>
 
-<listitem><para>It is possible to atomically
-<emphasis>upgrade</emphasis> software.  I.e., there is no time window
-during an upgrade in which part of the old version and part of the new
-version are simultaneously visible (which might well cause the
-component to fail).</para></listitem>
+<screen>
+$ nix-env --upgrade <replaceable>some-packages</replaceable>
+$ nix-env --rollback
+</screen>
 
-<listitem><para>Likewise, it is possible to atomically roll back after
-an install, upgrade, or uninstall action.  That is, in a fast (O(1))
-operation the previous configuration of the system can be restored.
-This is because upgrade or uninstall actions don't actually remove
-components from the system.</para></listitem>
+</simplesect>
 
-<listitem><para>Unused components can be
-<emphasis>garbage-collected</emphasis> automatically and safely: when
-you remove an application from a profile, its dependencies will be
-deleted by the garbage collector only if there are no other active
-applications using them.</para></listitem>
 
-<listitem><para>Nix supports both source-based deployment models
-(where you distribute <emphasis>Nix expressions</emphasis> that tell
-Nix how to build software from source) and binary-based deployment
-models.  The latter is more-or-less transparent: installation of
-components is always based on Nix expressions, but if the expressions
-have been built before and Nix knows that the resulting binaries are
-available somewhere, it will use those instead.</para></listitem>
+<simplesect><title>Garbage collection</title>
 
-<listitem><para>Nix is flexible in the deployment policies that it
-supports.  There is a clear separation between the tools that
-implement basic Nix <emphasis>mechanisms</emphasis> (e.g., building
-Nix expressions), and the tools that implement various deployment
-<emphasis>policies</emphasis>.  For instance, there is a concept of
-<quote>Nix channels</quote> that can be used to keep software
-installations up-to-date automatically from a network source.  This is
-a policy that is implemented by a fairly short Perl script, which can
-be adapted easily to achieve similar policies.</para></listitem>
+<para>When you install a package like this…
 
-<listitem><para>Nix component builds aim to be <quote>pure</quote>;
-that is, unaffected by anything other than the declared dependencies.
-This means that if a component was built successfully once, it can be
-rebuilt again on another machine and the result will be the same.  We
-cannot <emphasis>guarantee</emphasis> this (e.g., if the build depends
-on the time-of-day), but Nix (and the tools in the Nix Packages
-collection) takes special care to help achieve this.</para></listitem>
+<screen>
+$ nix-env --uninstall firefox
+</screen>
 
-<listitem><para>Nix expressions (the things that tell Nix how to build
-components) are self-contained: they describe not just components but
-complete compositions.  In other words, Nix expressions also describe
-how to build all the dependencies.  This is in contrast to component
-specification languages like RPM spec files, which might say that a
-component X depends on some other component Y, but since it does not
-describe <emphasis>exactly</emphasis> what Y is, the result of
-building or running X might be different on different machines.
-Combined with purity, self-containedness ensures that a component that
-<quote>works</quote> on one machine also works on another, when
-deployed using Nix.</para></listitem>
+the package isn’t deleted from the system right away (after all, you
+might want to do a rollback, or it might be in the profiles of other
+users).  Instead, unused packages can be deleted safely by running the
+<emphasis>garbage collector</emphasis>:
 
-<listitem><para>The Nix expression language makes it easy to describe
-variability in components (e.g., optional features or
-dependencies).</para></listitem>
+<screen>
+$ nix-collect-garbage
+</screen>
 
-<listitem><para>Nix is ideal for building build farms that do
-continuous builds of software from a version management system, since
-it can take care of building all the dependencies as well.  Also, Nix
-only rebuilds components that have changed, so there are no
-unnecessary builds.  In addition, Nix can transparently distribute
-build jobs over different machines, including different
-platforms.</para></listitem>
+This deletes all packages that aren’t in use by any user profile or by
+a currently running program.</para>
 
-<listitem><para>Nix can be used not only for software deployment, but
-also for <emphasis>service deployment</emphasis>, such as the
-deployment of a complete web server with all its configuration files,
-static pages, software dependencies, and so on.  Nix's advantages for
-software deployment also apply here: for instance, the ability
-trivially to have multiple configurations at the same time, or the
-ability to do rollbacks.</para></listitem>
+</simplesect>
 
-<listitem><para>Nix can efficiently upgrade between different versions
-of a component through <emphasis>binary patching</emphasis>.  If
-patches are available on a server, and you try to install a new
-version of some component, Nix will automatically apply a patch (or
-sequence of patches), if available, to transform the installed
-component into the new version.</para></listitem> 
 
-</itemizedlist>
+<simplesect><title>Functional package language</title>
 
-</para>
+<para>Packages are built from <emphasis>Nix expressions</emphasis>,
+which is a simple functional language.  A Nix expression describes
+everything that goes into a package build action (a “derivation”):
+other packages, sources, the build script, environment variables for
+the build script, etc.  Nix tries very hard to ensure that Nix
+expressions are <emphasis>deterministic</emphasis>: building a Nix
+expression twice should yield the same result.</para>
+
+<para>Because it’s a functional language, it’s easy to support
+building variants of a package: turn the Nix expression into a
+function and call it any number of times with the appropriate
+arguments.  Due to the hashing scheme, variants don’t conflict with
+each other in the Nix store.</para>
+
+</simplesect>
+
+
+<simplesect><title>Transparent source/binary deployment</title>
+
+<para>Nix expressions generally describe how to build a package from
+source, so an installation action like
+
+<screen>
+$ nix-env --install firefox
+</screen>
+
+<emphasis>could</emphasis> cause quite a bit of build activity, as not
+only Firefox but also all its dependencies (all the way up to the C
+library and the compiler) would have to built, at least if they are
+not already in the Nix store.  This is a <emphasis>source deployment
+model</emphasis>.  For most users, building from source is not very
+pleasant as it takes far too long.  However, Nix can automatically
+skip building from source and download a pre-built binary instead if
+it knows about it.  <emphasis>Nix channels</emphasis> provide Nix
+expressions along with pre-built binaries.</para>
+
+<!--
+<para>source deployment model (like <a
+href="http://www.gentoo.org/">Gentoo</a>) and a binary model (like
+RPM)</para>
+-->
+
+</simplesect>
+
+
+<simplesect><title>Binary patching</title>
+
+<para>In addition to downloading binaries automatically if they’re
+available, Nix can download binary deltas that patch an existing
+package in the Nix store into a new version.  This speeds up
+upgrades.</para>
+
+</simplesect>
+
+
+<simplesect><title>Nix Packages collection</title>
+
+<para>We provide a large set of Nix expressions containing hundreds of
+existing Unix packages, the <emphasis>Nix Packages
+collection</emphasis> (Nixpkgs).</para>
+
+</simplesect>
+
+
+<simplesect><title>Service deployment</title>
+
+<para>Nix can be used not only for rolling out packages, but also
+complete <emphasis>configurations</emphasis> of services.  This is
+done by treating all the static bits of a service (such as software
+packages, configuration files, control scripts, static web pages,
+etc.) as “packages” that can be built by Nix expressions.  As a
+result, all the features above apply to services as well: for
+instance, you can roll back a web server configuration if a
+configuration change turns out to be undesirable, you can easily have
+multiple instances of a service (e.g., a test and production server),
+and because the whole service is built in a purely functional way from
+a Nix expression, it is repeatable so you can easily reproduce the
+service on another machine.</para>
+
+<!--
+<para>You can read more about this in our <a
+href="docs/papers.html#servicecm">SCM-12 paper</a>.</para>
+-->
+
+</simplesect>
+
+
+<simplesect><title>Portability</title>
+
+<para>Nix should run on most Unix systems, including Linux, FreeBSD and
+Mac OS X.  It is also supported on Windows using Cygwin.</para>
+
+</simplesect>
+
+
+<simplesect><title>NixOS</title>
+
+<para>NixOS is a Linux distribution based on Nix.  It uses Nix not
+just for package management but also to manage the system
+configuration (e.g., to build configuration files in
+<filename>/etc</filename>).  This means, among other things, that it’s
+possible to easily roll back the entire configuration of the system to
+an earlier state.  Also, users can install software without root
+privileges.  For more information and downloads, see the <link
+xlink:href="http://nix.cs.uu.nl/nixos/">NixOS homepage</link>.</para>
+
+</simplesect>
+
+
+<!-- other features:
+
+- build farms
+- reproducibility (Nix expressions allows whole configuration to be rebuilt)
+
+-->
+
+</section>
+
+
+<section><title>About us</title>
+
+<para>Nix was developed at the <link
+xlink:href="http://www.cs.uu.nl/">Department of Information and
+Computing Sciences</link>, Utrecht University by the <link
+xlink:href="http://www.cs.uu.nl/wiki/Trace/WebHome">TraCE
+project</link>.  The project is funded by the Software Engineering
+Research Program <link
+xlink:href="http://www.jacquard.nl/">Jacquard</link> to improve the
+support for variability in software systems.</para>
+
+</section>
+
+
+<section><title>About this manual</title>
 
 <para>This manual tells you how to install and use Nix and how to
 write Nix expressions for software not already in the Nix Packages
 collection.  It also discusses some advanced topics, such as setting
-up a Nix-based build farm, and doing service deployment using
-Nix.</para>
+up a Nix-based build farm.</para>
 
-<note><para>Some background information on Nix can be found in three
-papers.  The ICSE 2004 paper <ulink
-url='http://www.cs.uu.nl/~eelco/pubs/immdsd-icse2004-final.pdf'><citetitle>Imposing
-a Memory Management Discipline on Software
-Deployment</citetitle></ulink> discusses the hashing mechanism used to
-ensure reliable dependency identification and non-interference between
-different versions and variants of packages.  The LISA 2004 paper
-<ulink
-url='http://www.cs.uu.nl/~eelco/pubs/nspfssd-lisa2004-final.pdf'><citetitle>Nix:
-A Safe and Policy-Free System for Software
-Deployment</citetitle></ulink> gives a more general discussion of Nix
-from a system-administration perspective.  The CBSE 2005 paper <ulink
-url='http://www.cs.uu.nl/~eelco/pubs/eupfcdm-cbse2005-final.pdf'><citetitle>Efficient
+</section>
+
+
+<section><title>License</title>
+
+<para>Nix is free software; you can redistribute it and/or modify it
+under the terms of the <link
+xlink:href="http://www.gnu.org/licenses/lgpl.html">GNU Lesser General
+Public License</link> as published by the <link
+xlink:href="http://www.fsf.org/">Free Software Foundation</link>;
+either version 2.1 of the License, or (at your option) any later
+version.  Nix is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+Lesser General Public License for more details.</para>
+
+</section>
+
+
+<section><title>More information</title>
+
+<para>Some background information on Nix can be found in a number of
+papers.  The ICSE 2004 paper <citetitle
+xlink:href='http://www.cs.uu.nl/~eelco/pubs/immdsd-icse2004-final.pdf'>Imposing
+a Memory Management Discipline on Software Deployment</citetitle>
+discusses the hashing mechanism used to ensure reliable dependency
+identification and non-interference between different versions and
+variants of packages.  The LISA 2004 paper <citetitle
+xlink:href='http://www.cs.uu.nl/~eelco/pubs/nspfssd-lisa2004-final.pdf'>Nix:
+A Safe and Policy-Free System for Software Deployment</citetitle>
+gives a more general discussion of Nix from a system-administration
+perspective.  The CBSE 2005 paper <citetitle
+xlink:href='http://www.cs.uu.nl/~eelco/pubs/eupfcdm-cbse2005-final.pdf'>Efficient
 Upgrading in a Purely Functional Component Deployment Model
-</citetitle></ulink> is about transparent patch deployment in
-Nix.</para></note>
+</citetitle> is about transparent patch deployment in Nix.  The SCM-12
+paper <citetitle
+xlink:href='http://www.cs.uu.nl/~eelco/pubs/servicecm-scm12-final.pdf'>
+Service Configuration Management</citetitle> shows how services (e.g.,
+web servers) can be deployed and managed through Nix.  A short
+overview of NixOS is given in the HotOS XI paper <citetitle
+xlink:href="http://www.cs.uu.nl/~eelco/pubs/hotos-final.pdf">Purely
+Functional System Configuration Management</citetitle>.  The Nix
+homepage has <link
+xlink:href="http://nix.cs.uu.nl/docs/papers.html">an up-to-date list
+of Nix-related papers</link>.</para>
+
+<para>Nix is the subject of Eelco Dolstra’s PhD thesis <citetitle
+xlink:href="http://igitur-archive.library.uu.nl/dissertations/2006-0118-200031/index.htm">The
+Purely Functional Software Deployment Model</citetitle>, which
+contains most of the papers listed above.</para>
+
+<para>Nix has a homepage at <link
+xlink:href="http://nix.cs.uu.nl/"/>.</para>
+
+</section>
+
 
 </chapter>

doc/manual/manual.xml

@@ -1,83 +1,125 @@
-<?xml version="1.0"?>
-<!DOCTYPE book
-    PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN"
-    "http://www.docbook.org/xml/4.3/docbook-xml-4.3.zip"
-[
-]>
+<book xmlns="http://docbook.org/ns/docbook"
+      xmlns:xi="http://www.w3.org/2001/XInclude">
 
-<book>
-  <title>Nix User's Guide</title>
+  <info>
+
+    <title>Nix User's Guide</title>
+
+    <subtitle>Draft (Version <xi:include href="version.txt"
+    parse="text" />)</subtitle>
 
-  <subtitle>Draft (Version <xi:include
-  xmlns:xi="http://www.w3.org/2001/XInclude"
-  href="version.txt" parse="text" />)</subtitle>
-  
-  <bookinfo>
     <author>
-      <firstname>Eelco</firstname>
-      <surname>Dolstra</surname>
+      <personname>
+        <firstname>Eelco</firstname>
+        <surname>Dolstra</surname>
+      </personname>
+      <affiliation>
+        <orgname>Utrecht University</orgname>
+        <orgdiv>Faculty of Science, Department of Information and Computing Sciences</orgdiv>
+      </affiliation>
     </author>
+
     <copyright>
       <year>2004</year>
       <year>2005</year>
+      <year>2006</year>
+      <year>2007</year>
       <holder>Eelco Dolstra</holder>
     </copyright>
-  </bookinfo>
+
+    <date>September 2007</date>
+    
+  </info>
+
   
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="introduction.xml" />
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="quick-start.xml" />
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="installation.xml" />
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="package-management.xml" />
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="writing-nix-expressions.xml" />
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="build-farm.xml" />
+  <xi:include href="introduction.xml" />
+  <xi:include href="quick-start.xml" />
+  <xi:include href="installation.xml" />
+  <xi:include href="package-management.xml" />
+  <xi:include href="writing-nix-expressions.xml" />
+  <xi:include href="build-farm.xml" />
+
 
   <appendix>
     <title>Command Reference</title>
-    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="opt-common.xml" />
-    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="env-common.xml" />
-    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="conf-file.xml" />
-    <sect1 id="sec-nix-env">
-      <title>nix-env</title>
-      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="nix-env.xml" />
-    </sect1>
-    <sect1 id="sec-nix-build">
-      <title>nix-build</title>
-      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="nix-build.xml" />
-    </sect1>
-    <sect1>
-      <title>nix-store</title>
-      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="nix-store.xml" />
-    </sect1>
-    <sect1 id="sec-nix-instantiate">
-      <title>nix-instantiate</title>
-      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="nix-instantiate.xml" />
-    </sect1>
-    <sect1>
-      <title>nix-collect-garbage</title>
-      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="nix-collect-garbage.xml" />
-    </sect1>
-    <sect1 id="sec-nix-channel">
-      <title>nix-channel</title>
-      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="nix-channel.xml" />
-    </sect1>
-    <sect1>
-      <title>nix-push</title>
-      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="nix-push.xml" />
-    </sect1>
-    <sect1>
-      <title>nix-pull</title>
-      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="nix-pull.xml" />
-    </sect1>
-    <sect1>
-      <title>nix-prefetch-url</title>
-      <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="nix-prefetch-url.xml" />
-    </sect1>
+    <xi:include href="opt-common.xml" />
+    <xi:include href="env-common.xml" />
+    <xi:include href="conf-file.xml" />
+    
+    <section>
+      <title>Main commands</title>
+      <section xml:id="sec-nix-env">
+        <title>nix-env</title>
+        <xi:include href="nix-env.xml" />
+      </section>
+      <section xml:id="sec-nix-instantiate">
+        <title>nix-instantiate</title>
+        <xi:include href="nix-instantiate.xml" />
+      </section>
+      <section xml:id="sec-nix-store">
+        <title>nix-store</title>
+        <xi:include href="nix-store.xml" />
+      </section>
+    </section>
+    
+    <section>
+      <title>Utilities</title>
+      <section xml:id="sec-nix-build">
+        <title>nix-build</title>
+        <xi:include href="nix-build.xml" />
+      </section>
+      <section xml:id="sec-nix-channel">
+        <title>nix-channel</title>
+        <xi:include href="nix-channel.xml" />
+      </section>
+      <section xml:id="sec-nix-collect-garbage">
+        <title>nix-collect-garbage</title>
+        <xi:include href="nix-collect-garbage.xml" />
+      </section>
+      <section xml:id="sec-nix-copy-closure">
+        <title>nix-copy-closure</title>
+        <xi:include href="nix-copy-closure.xml" />
+      </section>
+      <section xml:id="sec-nix-hash">
+        <title>nix-hash</title>
+        <xi:include href="nix-hash.xml" />
+      </section>
+      <section xml:id="sec-nix-install-package">
+        <title>nix-install-package</title>
+        <xi:include href="nix-install-package.xml" />
+      </section>
+      <section xml:id="sec-nix-pack-closure">
+        <title>nix-pack-closure</title>
+        <xi:include href="nix-pack-closure.xml" />
+      </section>
+      <section xml:id="sec-nix-prefetch-url">
+        <title>nix-prefetch-url</title>
+        <xi:include href="nix-prefetch-url.xml" />
+      </section>
+      <section xml:id="sec-nix-pull">
+        <title>nix-pull</title>
+        <xi:include href="nix-pull.xml" />
+      </section>
+      <section xml:id="sec-nix-push">
+        <title>nix-push</title>
+        <xi:include href="nix-push.xml" />
+      </section>
+      <section xml:id="sec-nix-unpack-closure">
+        <title>nix-unpack-closure</title>
+        <xi:include href="nix-unpack-closure.xml" />
+      </section>
+    </section>
+    
   </appendix>
 
-  <!--  &nix-lang-ref; -->
-
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="troubleshooting.xml" />
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="bugs.xml" />
-  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="glossary.xml" />
+  <xi:include href="troubleshooting.xml" />
+  <xi:include href="bugs.xml" />
+  <xi:include href="glossary.xml" />
 
+  <appendix>
+    <title>Nix Release Notes</title>
+    <xi:include href="release-notes.xml"
+                xpointer="xmlns(x=http://docbook.org/ns/docbook)xpointer(x:article/x:section)" />
+  </appendix>
+    
 </book>

doc/manual/nix-build.xml

@@ -1,5 +1,14 @@
-<refentry>
-  
+<refentry xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink"
+          xmlns:xi="http://www.w3.org/2001/XInclude">
+
+<refmeta>
+  <refentrytitle>nix-build</refentrytitle>
+  <manvolnum>1</manvolnum>
+  <refmiscinfo class="source">Nix</refmiscinfo>
+  <refmiscinfo class="version"><xi:include href="version.txt" parse="text"/></refmiscinfo>
+</refmeta>
+
 <refnamediv>
   <refname>nix-build</refname>
   <refpurpose>build a Nix expression</refpurpose>
@@ -8,8 +17,26 @@
 <refsynopsisdiv>
   <cmdsynopsis>
     <command>nix-build</command>
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="opt-common-syn.xml#xmlns(db=http://docbook.org/ns/docbook)xpointer(/db:nop/*)" />
+    <arg><option>--arg</option> <replaceable>name</replaceable> <replaceable>value</replaceable></arg>
+    <arg><option>--argstr</option> <replaceable>name</replaceable> <replaceable>value</replaceable></arg>
+    <arg>
+      <group choice='req'>
+        <arg choice='plain'><option>--attr</option></arg>
+        <arg choice='plain'><option>-A</option></arg>
+      </group>
+      <replaceable>attrPath</replaceable>
+    </arg>
     <arg><option>--add-drv-link</option></arg>
-    <arg><option>--no-link</option></arg>
+    <arg><option>--drv-link </option><replaceable>drvlink</replaceable></arg>
+    <arg><option>--no-out-link</option></arg>
+    <arg>
+      <group choice='req'>
+        <arg choice='plain'><option>--out-link</option></arg>
+        <arg choice='plain'><option>-o</option></arg>
+      </group>
+      <replaceable>outlink</replaceable>
+    </arg>
     <arg choice='plain' rep='repeat'><replaceable>paths</replaceable></arg>
   </cmdsynopsis>
 </refsynopsisdiv>
@@ -25,14 +52,17 @@ to multiple derivations, multiple sequentially numbered symlinks are
 created (<filename>result</filename>, <filename>result-2</filename>,
 and so on).</para>
 
-<note><para><command>nix-build</command> is essentially a wrapper
-around <link
+<para>If no <replaceable>paths</replaceable> are specified, then
+<command>nix-build</command> will use <filename>default.nix</filename>
+in the current directory, if it exists.</para>
+
+<para><command>nix-build</command> is essentially a wrapper around
+<link
 linkend="sec-nix-instantiate"><command>nix-instantiate</command></link>
 (to translate a high-level Nix expression to a low-level store
 derivation) and <link
 linkend="rsec-nix-store-realise"><command>nix-store
---realise</command></link> (to build the store
-derivation).</para></note>
+--realise</command></link> (to build the store derivation).</para>
 
 <warning><para>The result of the build is automatically registered as
 a root of the Nix garbage collector.  This root disappears
@@ -44,6 +74,12 @@ or renamed.  So don’t rename the symlink.</para></warning>
 
 <refsection><title>Options</title>
 
+<para>See also <xref linkend="sec-common-options" />.  All options not
+listed here are passed to <command>nix-store --realise</command>,
+except for <option>--arg</option> and <option>--attr</option> /
+<option>-A</option> which are passed to
+<command>nix-instantiate</command>.</para>
+
 <variablelist>
 
   <varlistentry><term><option>--add-drv-link</option></term>
@@ -57,7 +93,16 @@ or renamed.  So don’t rename the symlink.</para></warning>
     
   </varlistentry>
 
-  <varlistentry><term><option>--no-link</option></term>
+  <varlistentry><term><option>--drv-link</option> <replaceable>drvlink</replaceable></term>
+  
+    <listitem><para>Change the name of the symlink to the derivation
+    created when <option>--add-drv-link</option> is used from
+    <filename>derivation</filename> to
+    <replaceable>drvlink</replaceable>.</para></listitem>
+
+  </varlistentry>
+
+  <varlistentry><term><option>--no-out-link</option></term>
   
     <listitem><para>Do not create a symlink to the output path.  Note
     that as a result the output does not become a root of the garbage
@@ -66,9 +111,35 @@ or renamed.  So don’t rename the symlink.</para></warning>
 
   </varlistentry>
 
+  <varlistentry xml:id='opt-out-link'><term><option>--out-link</option> /
+  <option>-o</option> <replaceable>outlink</replaceable></term>
+  
+    <listitem><para>Change the name of the symlink to the output path
+    created unless <option>--no-out-link</option> is used from
+    <filename>result</filename> to
+    <replaceable>outlink</replaceable>.</para></listitem>
+
+  </varlistentry>
+
 </variablelist>
 
 </refsection>
 
 
+<refsection><title>Examples</title>
+
+<screen>
+$ nix-build pkgs/top-level/all-packages.nix -A firefox
+store derivation is /nix/store/qybprl8sz2lc...-firefox-1.5.0.7.drv
+/nix/store/d18hyl92g30l...-firefox-1.5.0.7
+
+$ ls -l result
+lrwxrwxrwx  <replaceable>...</replaceable>  result -> /nix/store/d18hyl92g30l...-firefox-1.5.0.7
+
+$ ls ./result/bin/
+firefox  firefox-config</screen>
+
+</refsection>
+
+
 </refentry>

doc/manual/nix-channel.xml

@@ -1,5 +1,14 @@
-<refentry>
+<refentry xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink"
+          xmlns:xi="http://www.w3.org/2001/XInclude">
   
+<refmeta>
+  <refentrytitle>nix-channel</refentrytitle>
+  <manvolnum>1</manvolnum>
+  <refmiscinfo class="source">Nix</refmiscinfo>
+  <refmiscinfo class="version"><xi:include href="version.txt" parse="text"/></refmiscinfo>
+</refmeta>
+
 <refnamediv>
   <refname>nix-channel</refname>
   <refpurpose>manage Nix channels</refpurpose>
@@ -53,11 +62,11 @@ also <xref linkend="sec-channels" />.</para>
   <varlistentry><term><option>--update</option></term>
 
     <listitem><para>Downloads the Nix expressions of all subscribed
-    channels, makes the conjunction of these the default for
-    <command>nix-env</command> operations (by calling <command>nix-env
-    -I</command>), and performs a <command>nix-pull</command> on the
-    manifests of all channels to make pre-built binaries
-    available.</para></listitem>
+    channels, makes them the default for <command>nix-env</command>
+    operations (by symlinking them in the directory
+    <filename>~/.nix-defexpr</filename>), and performs a
+    <command>nix-pull</command> on the manifests of all channels to
+    make pre-built binaries available.</para></listitem>
 
   </varlistentry>
 

doc/manual/nix-collect-garbage.xml

@@ -1,5 +1,14 @@
-<refentry>
+<refentry xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink"
+          xmlns:xi="http://www.w3.org/2001/XInclude">
   
+<refmeta>
+  <refentrytitle>nix-collect-garbage</refentrytitle>
+  <manvolnum>1</manvolnum>
+  <refmiscinfo class="source">Nix</refmiscinfo>
+  <refmiscinfo class="version"><xi:include href="version.txt" parse="text"/></refmiscinfo>
+</refmeta>
+
 <refnamediv>
   <refname>nix-collect-garbage</refname>
   <refpurpose>delete unreachable store paths</refpurpose>
@@ -8,6 +17,8 @@
 <refsynopsisdiv>
   <cmdsynopsis>
     <command>nix-collect-garbage</command>
+    <arg><option>--delete-old</option></arg>
+    <arg><option>-d</option></arg>
     <group choice='opt'>
       <arg choice='plain'><option>--print-roots</option></arg>
       <arg choice='plain'><option>--print-live</option></arg>
@@ -19,10 +30,28 @@
 
 <refsection><title>Description</title>
 
-<para>The command <command>nix-collect-garbage</command> is an
-obsolete wrapper around <link
-linkend="rsec-nix-store-gc"><command>nix-store
---gc</command></link>.</para>
+<para>The command <command>nix-collect-garbage</command> is mostly an
+alias of <link linkend="rsec-nix-store-gc"><command>nix-store
+--gc</command></link>, that is, it deletes all unreachable paths in
+the Nix store to clean up your system.  However, it provides an
+additional option <option>-d</option> (<option>--delete-old</option>)
+that deletes all old generations of all profiles in
+<filename>/nix/var/nix/profiles</filename> by invoking
+<literal>nix-env --delete-generations old</literal> on all profiles.
+Of course, this makes rollbacks to previous configurations
+impossible.</para>
+
+</refsection>
+
+<refsection><title>Example</title>
+
+<para>To delete from the Nix store everything that is not used by the
+current generations of each profile, do
+
+<screen>
+$ nix-collect-garbage -d</screen>
+
+</para>
 
 </refsection>
 

doc/manual/nix-copy-closure.xml

@@ -0,0 +1,151 @@
+<refentry xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink"
+          xmlns:xi="http://www.w3.org/2001/XInclude">
+
+<refmeta>
+  <refentrytitle>nix-copy-closure</refentrytitle>
+  <manvolnum>1</manvolnum>
+  <refmiscinfo class="source">Nix</refmiscinfo>
+  <refmiscinfo class="version"><xi:include href="version.txt" parse="text"/></refmiscinfo>
+</refmeta>
+
+<refnamediv>
+  <refname>nix-copy-closure</refname>
+  <refpurpose>copy a closure to or from a remote machine via SSH</refpurpose>
+</refnamediv>
+
+<refsynopsisdiv>
+  <cmdsynopsis>
+    <command>nix-copy-closure</command>
+    <group>
+      <arg choice='plain'><option>--to</option></arg>
+      <arg choice='plain'><option>--from</option></arg>
+    </group>
+    <arg><option>--sign</option></arg>
+    <arg><option>--gzip</option></arg>
+    <arg choice='plain'>
+      <arg><replaceable>user@</replaceable></arg><replaceable>machine</replaceable>
+    </arg>
+    <arg choice='plain'><replaceable>paths</replaceable></arg>
+  </cmdsynopsis>
+</refsynopsisdiv>
+
+
+<refsection><title>Description</title>
+
+<para><command>nix-copy-closure</command> gives you an easy and
+efficient way to exchange software between machines.  Given one or
+more Nix store paths <replaceable>paths</replaceable> on the local
+machine, <command>nix-copy-closure</command> computes the closure of
+those paths (i.e. all their dependencies in the Nix store), and copies
+all paths in the closure to the remote machine via the
+<command>ssh</command> (Secure Shell) command.  With the
+<option>--from</option>, the direction is reversed:
+the closure of <replaceable>paths</replaceable> on a remote machine is
+copied to the Nix store on the local machine.</para>
+
+<para>This command is efficient because it only sends the store paths
+that are missing on the target machine.</para>
+
+<para>Since <command>nix-copy-closure</command> calls
+<command>ssh</command>, you may be asked to type in the appropriate
+password or passphrase.  In fact, you may be asked
+<emphasis>twice</emphasis> because <command>nix-copy-closure</command>
+currently connects twice to the remote machine, first to get the set
+of paths missing on the target machine, and second to send the dump of
+those paths.  If this bothers you, use
+<command>ssh-agent</command>.</para>
+
+
+<refsection><title>Options</title>
+
+<variablelist>
+  
+  <varlistentry><term><option>--to</option></term>
+
+    <listitem><para>Copy the closure of
+    <replaceable>paths</replaceable> from the local Nix store to the
+    Nix store on <replaceable>machine</replaceable>.  This is the
+    default.</para></listitem>
+
+  </varlistentry>
+
+  <varlistentry><term><option>--from</option></term>
+
+    <listitem><para>Copy the closure of
+    <replaceable>paths</replaceable> from the Nix store on
+    <replaceable>machine</replaceable> to the local Nix
+    store.</para></listitem>
+
+  </varlistentry>
+
+  <varlistentry><term><option>--sign</option></term>
+
+    <listitem><para>Let the sending machine cryptographically sign the
+    dump of each path with the key in
+    <filename>/nix/etc/nix/signing-key.sec</filename>.  If the user on
+    the target machine does not have direct access to the Nix store
+    (i.e., if the target machine has a multi-user Nix installation),
+    then the target machine will check the dump against
+    <filename>/nix/etc/nix/signing-key.pub</filename> before unpacking
+    it in its Nix store.  This allows secure sharing of store paths
+    between untrusted users on two machines, provided that there is a
+    trust relation between the Nix installations on both machines
+    (namely, they have matching public/secret keys).</para></listitem>
+
+  </varlistentry>
+
+  <varlistentry><term><option>--gzip</option></term>
+
+    <listitem><para>Compress the dump of each path with
+    <command>gzip</command> before sending it.</para></listitem>
+
+  </varlistentry>
+
+</variablelist>
+
+</refsection>
+
+
+<refsection><title>Environment variables</title>
+
+<variablelist>
+
+  <varlistentry><term><envar>NIX_SSHOPTS</envar></term>
+
+    <listitem><para>Additional options to be passed to
+    <command>ssh</command> on the command line.</para></listitem>
+
+  </varlistentry>
+  
+</variablelist>
+
+</refsection>
+
+
+<refsection><title>Examples</title>
+
+<para>Copy Firefox with all its dependencies to a remote machine:
+
+<screen>
+$ nix-copy-closure alice@itchy.labs $(type -tP firefox)</screen>
+
+</para>
+
+<para>Copy Subversion from a remote machine and then install it into a
+user environment:
+
+<screen>
+$ nix-copy-closure --from alice@itchy.labs \
+    /nix/store/0dj0503hjxy5mbwlafv1rsbdiyx1gkdy-subversion-1.4.4
+$ nix-env -i /nix/store/0dj0503hjxy5mbwlafv1rsbdiyx1gkdy-subversion-1.4.4
+</screen>
+
+</para>
+
+</refsection>
+
+
+</refsection>
+
+</refentry>

doc/manual/nix-env.xml

@@ -1,5 +1,14 @@
-<refentry>
+<refentry xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink"
+          xmlns:xi="http://www.w3.org/2001/XInclude">
   
+<refmeta>
+  <refentrytitle>nix-env</refentrytitle>
+  <manvolnum>1</manvolnum>
+  <refmiscinfo class="source">Nix</refmiscinfo>
+  <refmiscinfo class="version"><xi:include href="version.txt" parse="text"/></refmiscinfo>
+</refmeta>
+
 <refnamediv>
   <refname>nix-env</refname>
   <refpurpose>manipulate or query Nix user environments</refpurpose>
@@ -8,7 +17,9 @@
 <refsynopsisdiv>
   <cmdsynopsis>
     <command>nix-env</command>
-    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="opt-common-syn.xml#xpointer(/nop/*)" />
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="opt-common-syn.xml#xmlns(db=http://docbook.org/ns/docbook)xpointer(/db:nop/*)" />
+    <arg><option>--arg</option> <replaceable>name</replaceable> <replaceable>value</replaceable></arg>
+    <arg><option>--argstr</option> <replaceable>name</replaceable> <replaceable>value</replaceable></arg>
     <arg>
       <group choice='req'>
         <arg choice='plain'><option>--file</option></arg>
@@ -23,15 +34,11 @@
       </group>
       <replaceable>path</replaceable>
     </arg>
-    <arg><option>--preserve-installed</option></arg>
     <arg>
       <arg choice='plain'><option>--system-filter</option></arg>
       <replaceable>system</replaceable>
     </arg>
     <arg><option>--dry-run</option></arg>
-    <arg><option>--from-expression</option></arg>
-    <arg><option>-E</option></arg>
-    <arg><option>--from-profile</option> <replaceable>path</replaceable></arg>
     <arg choice='plain'><replaceable>operation</replaceable></arg>
     <arg rep='repeat'><replaceable>options</replaceable></arg>
     <arg rep='repeat'><replaceable>arguments</replaceable></arg>
@@ -42,7 +49,7 @@
 <refsection><title>Description</title>
 
 <para>The command <command>nix-env</command> is used to manipulate Nix
-user environments.  User environments are sets of software components
+user environments.  User environments are sets of software packages
 available to a user at some point in time.  In other words, they are a
 synthesised view of the programs available in the Nix store.  There
 may be many user environments: different users can have different
@@ -101,21 +108,13 @@ linkend="sec-common-options" />.</para>
     <option>--rollback</option> operations, this flag will cause
     <command>nix-env</command> to print what
     <emphasis>would</emphasis> be done if this flag had not been
-    specified, without actually doing it.</para></listitem>
-    
-  </varlistentry>
-      
-  <varlistentry><term><option>--preserve-installed</option></term>
-  
-    <listitem><para>By default, when you install a derivation with the
-    <option>--install</option> operation, it will replace previously
-    installed versions with the same derivation name (regardless of
-    the version number).  This option causes those previously
-    installed versions to be kept in the new generation of the
-    profile.  Note that this will generally cause conflicts in the
-    creation of the user environment (since multiple versions of a
-    package typically contain the same programs).</para></listitem>
-    
+    specified, without actually doing it.</para>
+
+    <para><option>--dry-run</option> also prints out which paths will
+    be <link linkend="gloss-substitute">substituted</link> (i.e.,
+    downloaded) and which paths will be built from source (because no
+    substitute is available).</para></listitem>
+
   </varlistentry>
       
   <varlistentry><term><option>--system-filter</option> <replaceable>system</replaceable></term>
@@ -142,14 +141,34 @@ linkend="sec-common-options" />.</para>
 <variablelist>
 
   <varlistentry><term><filename>~/.nix-defexpr</filename></term>
-  
-    <listitem><para>The default Nix expression used by the
-    <option>--install</option>, <option>--upgrade</option>, and
-    <option>--query --available</option> operations to obtain
-    derivations.  It is generally a symbolic link to some other
-    location set using the <option>--import</option> operation.  The
+
+    <listitem><para>A directory that contains the default Nix
+    expressions used by the <option>--install</option>,
+    <option>--upgrade</option>, and <option>--query
+    --available</option> operations to obtain derivations.  The
     <option>--file</option> option may be used to override this
-    default.</para></listitem>
+    default.</para>
+
+    <para>The Nix expressions in this directory are combined into a
+    single attribute set, with each file as an attribute that has the
+    name of the file.  Thus, if <filename>~/.nix-defexpr</filename>
+    contains two files, <filename>foo</filename> and
+    <filename>bar</filename>, then the default Nix expression will
+    essentially be
+
+<programlisting>
+{
+  foo = import ~/.nix-defexpr/foo;
+  bar = import ~/.nix-defexpr/bar;
+}</programlisting>
+
+    </para>
+
+    <para>The command <command>nix-channel</command> places symlinks
+    to the downloaded Nix expressions from each subscribed channel in
+    this directory.</para>
+
+    </listitem>
     
   </varlistentry>
 
@@ -172,7 +191,7 @@ linkend="sec-common-options" />.</para>
 
 <!--######################################################################-->
 
-<refsection id="rsec-nix-env-install"><title>Operation <option>--install</option></title>
+<refsection xml:id="rsec-nix-env-install"><title>Operation <option>--install</option></title>
 
 <refsection><title>Synopsis</title>
 
@@ -182,6 +201,7 @@ linkend="sec-common-options" />.</para>
     <arg choice='plain'><option>--install</option></arg>
     <arg choice='plain'><option>-i</option></arg>
   </group>
+  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="opt-inst-syn.xml#xmlns(db=http://docbook.org/ns/docbook)xpointer(/db:nop/*)" />
   <group choice='opt'>
     <arg choice='plain'><option>--preserve-installed</option></arg>
     <arg choice='plain'><option>-P</option></arg>
@@ -208,7 +228,34 @@ number of possible ways:
   installed.  Currently installed derivations with a name equal to the
   name of a derivation being added are removed unless the option
   <option>--preserve-installed</option> is
-  specified.</para></listitem>
+  specified.</para>
+
+  <para>If there are multiple derivations matching a name in
+  <replaceable>args</replaceable> that have the same name (e.g.,
+  <literal>gcc-3.3.6</literal> and <literal>gcc-4.1.1</literal>), then
+  the derivation with the highest <emphasis>priority</emphasis> is
+  used.  A derivation can define a priority by declaring the
+  <varname>meta.priority</varname> attribute.  This attribute should
+  be a number, with a higher value denoting a lower priority.  The
+  default priority is <literal>0</literal>.</para>
+
+  <para>If there are multiple matching derivations with the same
+  priority, then the derivation with the highest version will be
+  installed.</para>
+
+  <para>You can force the installation of multiple derivations with
+  the same name by being specific about the versions.  For instance,
+  <literal>nix-env -i gcc-3.3.6 gcc-4.1.1</literal> will install both
+  version of GCC (and will probably cause a user environment
+  conflict!).</para></listitem>
+
+  <listitem><para>If <link
+  linkend='opt-attr'><option>--attr</option></link>
+  (<option>-A</option>) is specified, the arguments are
+  <emphasis>attribute paths</emphasis> that select attributes from the
+  top-level Nix expression.  This is faster than using derivation
+  names and unambiguous.  To find out the attribute paths of available
+  packages, use <literal>nix-env -qaA '*'</literal>.</para></listitem>
 
   <listitem><para>If <option>--from-profile</option>
   <replaceable>path</replaceable> is given,
@@ -247,6 +294,15 @@ number of possible ways:
 
 <variablelist>
 
+  <varlistentry><term><option>--prebuild-only</option> / <option>-b</option></term>
+
+    <listitem><para>Use only derivations for which a substitute is
+    registered, i.e., there is a pre-built binary available that can
+    be downloaded in lieu of building the derivation.  Thus, no
+    packages will be built from source.</para></listitem>
+
+  </varlistentry>
+
   <varlistentry><term><option>--preserve-installed</option></term>
     <term><option>-P</option></term>
   
@@ -264,7 +320,7 @@ number of possible ways:
 </refsection>
             
 
-<refsection><title>Examples</title>
+<refsection xml:id='refsec-nix-env-install-examples'><title>Examples</title>
 
 <para>To install a specific version of <command>gcc</command> from the
 active Nix expression:
@@ -285,6 +341,14 @@ installing `gcc-3.3.2'</screen>
 
 </para>
 
+<para>To install using a specific attribute:
+
+<screen>
+$ nix-env -i -A gcc40mips
+$ nix-env -i -A xorg.xorgserver</screen>
+
+</para>
+
 <para>To install all derivations in the Nix expression <filename>foo.nix</filename>:
 
 <screen>
@@ -327,6 +391,25 @@ selecting the <literal>subversionWithJava</literal> attribute from the
 attribute set returned by calling the function defined in
 <filename>./foo.nix</filename>.</para>
 
+<para>A dry-run tells you which paths will be downloaded or built from
+source:
+
+<screen>
+$ nix-env -f pkgs/top-level/all-packages.nix -i f-spot --dry-run
+(dry run; not doing anything)
+installing `f-spot-0.0.10'
+the following derivations will be built:
+  /nix/store/0g63jv9aagwbgci4nnzs2dkxqz84kdja-libgnomeprintui-2.12.1.tar.bz2.drv
+  /nix/store/0gfarvxq6sannsdw8a1ir40j1ys2mqb4-ORBit2-2.14.2.tar.bz2.drv
+  /nix/store/0i9gs5zc04668qiy60ga2rc16abkj7g8-sqlite-2.8.17.drv
+  <replaceable>...</replaceable>
+the following paths will be substituted:
+  /nix/store/8zbipvm4gp9jfqh9nnk1n3bary1a37gs-perl-XML-Parser-2.34
+  /nix/store/b8a2bg7gnyvvvjjibp4axg9x1hzkw36c-mono-1.1.4
+  <replaceable>...</replaceable></screen>
+  
+</para>
+
 </refsection>
     
 </refsection>
@@ -335,7 +418,7 @@ attribute set returned by calling the function defined in
   
 <!--######################################################################-->
 
-<refsection><title>Operation <option>--upgrade</option></title>
+<refsection xml:id="rsec-nix-env-upgrade"><title>Operation <option>--upgrade</option></title>
 
 <refsection><title>Synopsis</title>
 
@@ -345,9 +428,11 @@ attribute set returned by calling the function defined in
     <arg choice='plain'><option>--upgrade</option></arg>
     <arg choice='plain'><option>-u</option></arg>
   </group>
+  <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="opt-inst-syn.xml#xmlns(db=http://docbook.org/ns/docbook)xpointer(/db:nop/*)" />
   <group choice='opt'>
     <arg choice='plain'><option>--lt</option></arg>
     <arg choice='plain'><option>--leq</option></arg>
+    <arg choice='plain'><option>--eq</option></arg>
     <arg choice='plain'><option>--always</option></arg>
   </group>
   <arg choice='plain' rep='repeat'><replaceable>args</replaceable></arg>
@@ -396,6 +481,17 @@ installed.</para>
     
   </varlistentry>
 
+  <varlistentry><term><option>--eq</option></term>
+  
+    <listitem><para><emphasis>Only</emphasis> “upgrade” to derivations
+    that have the same version.  This may not seem very useful, but it
+    actually is, e.g., when there is a new release of Nixpkgs and you
+    want to replace installed applications with the same versions
+    built against newer dependencies (to reduce the number of
+    dependencies floating around on your system).</para></listitem>
+    
+  </varlistentry>
+
   <varlistentry><term><option>--always</option></term>
   
     <listitem><para>In addition to upgrading to newer versions, also
@@ -407,6 +503,9 @@ installed.</para>
 
 </variablelist>
 
+<para>For the other flags, see <option
+linkend="rsec-nix-env-install">--install</option>.</para>
+
 </refsection>
 
 <refsection><title>Examples</title>
@@ -516,6 +615,111 @@ $ nix-env -e '*' <lineannotation>(remove everything)</lineannotation></screen>
 
 
   
+<!--######################################################################-->
+
+<refsection xml:id="rsec-nix-env-set-flag"><title>Operation <option>--set-flag</option></title>
+
+<refsection><title>Synopsis</title>
+
+<cmdsynopsis>
+  <command>nix-env</command>
+  <arg choice='plain'><option>--set-flag</option></arg>
+  <arg choice='plain'><replaceable>name</replaceable></arg>
+  <arg choice='plain'><replaceable>value</replaceable></arg>
+  <arg choice='plain' rep='repeat'><replaceable>drvnames</replaceable></arg>
+</cmdsynopsis>
+</refsection>
+
+<refsection><title>Description</title>
+            
+<para>The <option>--set-flag</option> operation allows meta attributes
+of installed packages to be modified.  There are several attributes
+that can be usefully modified, because they affect the behaviour of
+<command>nix-env</command> or the user environment build
+script:
+
+<itemizedlist>
+
+  <listitem><para><varname>priority</varname> can be changed to
+  resolve filename clashes.  The user environment build script uses
+  the <varname>meta.priority</varname> attribute of derivations to
+  resolve filename collisions between packages.  Lower priority values
+  denote a higher priority.  For instance, the GCC wrapper package and
+  the Binutils package in Nixpkgs both have a file
+  <filename>bin/ld</filename>, so previously if you tried to install
+  both you would get a collision.  Now, on the other hand, the GCC
+  wrapper declares a higher priority than Binutils, so the former’s
+  <filename>bin/ld</filename> is symlinked in the user
+  environment.</para></listitem>
+
+  <listitem><para><varname>keep</varname> can be set to
+  <literal>true</literal> to prevent the package from being upgraded
+  or replaced.  This is useful if you want to hang on to an older
+  version of a package.</para></listitem>
+
+  <listitem><para><varname>active</varname> can be set to
+  <literal>false</literal> to “disable” the package.  That is, no
+  symlinks will be generated to the files of the package, but it
+  remains part of the profile (so it won’t be garbage-collected).  It
+  can be set back to <literal>true</literal> to re-enable the
+  package.</para></listitem>
+
+</itemizedlist>
+
+</para>
+
+</refsection>
+            
+<refsection><title>Examples</title>
+
+<para>To prevent the currently installed Firefox from being upgraded:
+
+<screen>
+$ nix-env --set-flag keep true firefox</screen>
+
+After this, <command>nix-env -u</command> will ignore Firefox.</para>
+
+<para>To disable the currently installed Firefox, then install a new
+Firefox while the old remains part of the profile:
+
+<screen>
+$ nix-env -q \*
+firefox-2.0.0.9 <lineannotation>(the current one)</lineannotation>
+
+$ nix-env --preserve-installed -i firefox-2.0.0.11
+installing `firefox-2.0.0.11'
+building path(s) `/nix/store/myy0y59q3ig70dgq37jqwg1j0rsapzsl-user-environment'
+Collission between `/nix/store/<replaceable>...</replaceable>-firefox-2.0.0.11/bin/firefox'
+  and `/nix/store/<replaceable>...</replaceable>-firefox-2.0.0.9/bin/firefox'.
+<lineannotation>(i.e., can’t have two active at the same time)</lineannotation>
+
+$ nix-env --set-flag active false firefox
+setting flag on `firefox-2.0.0.9'
+
+$ nix-env --preserve-installed -i firefox-2.0.0.11
+installing `firefox-2.0.0.11'
+
+$ nix-env -q \*
+firefox-2.0.0.11 <lineannotation>(the enabled one)</lineannotation>
+firefox-2.0.0.9 <lineannotation>(the disabled one)</lineannotation></screen>
+
+</para>
+
+<para>To make files from <literal>binutils</literal> take precedence
+over files from <literal>gcc</literal>:
+
+<screen>
+$ nix-env --set-flag priority 5 binutils
+$ nix-env --set-flag priority 10 gcc</screen>
+
+</para>
+
+</refsection>
+    
+</refsection>
+
+
+  
 <!--######################################################################-->
   
 <refsection><title>Operation <option>--query</option></title>
@@ -533,12 +737,55 @@ $ nix-env -e '*' <lineannotation>(remove everything)</lineannotation></screen>
     <arg choice='plain'><option>--available</option></arg>
     <arg choice='plain'><option>-a</option></arg>
   </group>
-  <group choice='req'>
-    <arg choice='plain'><option>--name</option></arg>
-    <arg choice='plain'><option>--expr</option></arg>
-    <arg choice='plain'><option>--status</option></arg>
-    <arg choice='plain'><option>-s</option></arg>
-  </group>
+  
+  <sbr />
+  
+  <arg>
+    <group choice='req'>
+      <arg choice='plain'><option>--status</option></arg>
+      <arg choice='plain'><option>-s</option></arg>
+    </group>
+  </arg>
+  <arg>
+    <group choice='req'>
+      <arg choice='plain'><option>--attr-path</option></arg>
+      <arg choice='plain'><option>-P</option></arg>
+    </group>
+  </arg>
+  <arg><option>--no-name</option></arg>
+  <arg>
+    <group choice='req'>
+      <arg choice='plain'><option>--compare-versions</option></arg>
+      <arg choice='plain'><option>-c</option></arg>
+    </group>
+  </arg>
+  <arg><option>--system</option></arg>
+  <arg><option>--drv-path</option></arg>
+  <arg><option>--out-path</option></arg>
+  <arg><option>--description</option></arg>
+  <arg><option>--meta</option></arg>
+
+  <sbr />
+
+  <arg><option>--xml</option></arg>
+  <arg>
+    <group choice='req'>
+      <arg choice='plain'><option>--prebuilt-only</option></arg>
+      <arg choice='plain'><option>-b</option></arg>
+    </group>
+  </arg>
+
+  <arg>
+    <group choice='req'>
+      <arg choice='plain'><option>--attr</option></arg>
+      <arg choice='plain'><option>-A</option></arg>
+    </group>
+    <replaceable>attribute-path</replaceable>
+  </arg>
+
+  <sbr />
+  
+  <arg choice='plain' rep='repeat'><replaceable>names</replaceable></arg>
 </cmdsynopsis>
 
 </refsection>
@@ -550,7 +797,10 @@ $ nix-env -e '*' <lineannotation>(remove everything)</lineannotation></screen>
 paths that are installed in the current generation of the active
 profile (<option>--installed</option>), or the derivations that are
 available for installation in the active Nix expression
-(<option>--available</option>).</para>
+(<option>--available</option>).  It only prints information about
+derivations whose symbolic name matches one of
+<replaceable>names</replaceable>.  The wildcard <literal>*</literal>
+shows all derivations.</para>
 
 <para>The derivations are sorted by their <literal>name</literal>
 attributes.</para>
@@ -599,6 +849,28 @@ user environment elements, etc. -->
 
 <variablelist>
 
+  <varlistentry><term><option>--xml</option></term>
+
+    <listitem><para>Print the result in an XML representation suitable
+    for automatic processing by other tools.  The root element is
+    called <literal>items</literal>, which contains a
+    <literal>item</literal> element for each available or installed
+    derivation.  The fields discussed below are all stored in
+    attributes of the <literal>item</literal>
+    elements.</para></listitem>
+
+  </varlistentry>
+
+  <varlistentry><term><option>--prebuild-only</option> / <option>-b</option></term>
+
+    <listitem><para>Show only derivations for which a substitute is
+    registered, i.e., there is a pre-built binary available that can
+    be downloaded in lieu of building the derivation.  Thus, this
+    shows all packages that probably can be installed
+    quickly.</para></listitem>
+
+  </varlistentry>
+
   <varlistentry><term><option>--status</option></term>
     <term><option>-s</option></term>
   
@@ -618,6 +890,17 @@ user environment elements, etc. -->
     
   </varlistentry>
 
+  <varlistentry><term><option>--attr-path</option></term>
+    <term><option>-P</option></term>
+
+    <listitem><para>Print the <emphasis>attribute path</emphasis> of
+    the derivation, which can be used to unambiguously select it using
+    the <link linkend="opt-attr"><option>--attr</option> option</link>
+    available in commands that install derivations like
+    <literal>nix-env --install</literal>.</para></listitem>
+
+  </varlistentry>
+  
   <varlistentry><term><option>--no-name</option></term>
   
     <listitem><para>Suppress printing of the <literal>name</literal>
@@ -625,6 +908,51 @@ user environment elements, etc. -->
     
   </varlistentry>
 
+  <varlistentry><term><option>--compare-versions</option> /
+  <option>-c</option></term>
+  
+    <listitem><para>Compare installed versions to available versions,
+    or vice versa (if <option>--available</option> is given).  This is
+    useful for quickly seeing whether upgrades for installed
+    packages are available in a Nix expression.  A column is added
+    with the following meaning:
+
+    <variablelist>
+
+      <varlistentry><term><literal>&lt;</literal> <replaceable>version</replaceable></term>
+
+        <listitem><para>A newer version of the package is available
+        or installed.</para></listitem>
+
+      </varlistentry>
+      
+      <varlistentry><term><literal>=</literal> <replaceable>version</replaceable></term>
+
+        <listitem><para>At most the same version of the package is
+        available or installed.</para></listitem>
+
+      </varlistentry>
+      
+      <varlistentry><term><literal>></literal> <replaceable>version</replaceable></term>
+
+        <listitem><para>Only older versions of the package are
+        available or installed.</para></listitem>
+
+      </varlistentry>
+      
+      <varlistentry><term><literal>- ?</literal></term>
+
+        <listitem><para>No version of the package is available or
+        installed.</para></listitem>
+
+      </varlistentry>
+
+    </variablelist>
+
+    </para></listitem>
+    
+  </varlistentry>
+
   <varlistentry><term><option>--system</option></term>
   
     <listitem><para>Print the <literal>system</literal> attribute of
@@ -646,6 +974,23 @@ user environment elements, etc. -->
     
   </varlistentry>
 
+  <varlistentry><term><option>--description</option></term>
+  
+    <listitem><para>Print a short (one-line) description of the
+    derivation, if available.  The description is taken from the
+    <literal>meta.description</literal> attribute of the
+    derivation.</para></listitem>
+    
+  </varlistentry>
+
+  <varlistentry><term><option>--meta</option></term>
+  
+    <listitem><para>Print all of the meta-attributes of the
+    derivation.  This option is only available with
+    <option>--xml</option>.</para></listitem>
+    
+  </varlistentry>
+
 </variablelist>
 
 </refsection>
@@ -654,28 +999,47 @@ user environment elements, etc. -->
 <refsection><title>Examples</title>
 
 <screen>
-$ nix-env -q <lineannotation>(show installed derivations)</lineannotation>
-MozillaFirebird-0.7
+$ nix-env -q '*' <lineannotation>(show installed derivations)</lineannotation>
 bison-1.875c
 docbook-xml-4.2
-...
-
-$ nix-env -qa <lineannotation>(show available derivations)</lineannotation>
-GConf-2.4.0.1
-MPlayer-1.0pre3
-MozillaFirebird-0.7
+firefox-1.0.4
+MPlayer-1.0pre7
 ORBit2-2.8.3
 ...
 
-$ nix-env -qas <lineannotation>(show status of available derivations)</lineannotation>
--P- GConf-2.4.0.1 <lineannotation>(not installed but present)</lineannotation>
---S MPlayer-1.0pre3 <lineannotation>(not present, but there is a substitute for fast installation)</lineannotation>
---S MozillaFirebird-0.7 <lineannotation>(i.e., this is not the installed Firebird, even though the version is the same!)</lineannotation>
-IP- bison-1.875c <lineannotation>(installed and by definition present)</lineannotation>
+$ nix-env -qa '*' <lineannotation>(show available derivations)</lineannotation>
+firefox-1.0.7
+GConf-2.4.0.1
+MPlayer-1.0pre7
+ORBit2-2.8.3
 ...
 
-$ nix-env -f ./foo.nix -qa <lineannotation>(show available derivations in the Nix expression <filename>foo.nix</filename>)</lineannotation>
-foo-1.2.3</screen>
+$ nix-env -qas '*' <lineannotation>(show status of available derivations)</lineannotation>
+-P- firefox-1.0.7   <lineannotation>(not installed but present)</lineannotation>
+--S GConf-2.4.0.1   <lineannotation>(not present, but there is a substitute for fast installation)</lineannotation>
+--S MPlayer-1.0pre3 <lineannotation>(i.e., this is not the installed MPlayer, even though the version is the same!)</lineannotation>
+IP- ORBit2-2.8.3    <lineannotation>(installed and by definition present)</lineannotation>
+...
+
+<lineannotation>(show available derivations in the Nix expression <!-- !!! <filename>-->foo.nix<!-- </filename> -->)</lineannotation>
+$ nix-env -f ./foo.nix -qa '*' 
+foo-1.2.3
+
+$ nix-env -qc '*' <lineannotation>(compare installed versions to what’s available)</lineannotation>
+<replaceable>...</replaceable>
+acrobat-reader-7.0 - ?      <lineannotation>(package is not available at all)</lineannotation>
+autoconf-2.59      = 2.59   <lineannotation>(same version)</lineannotation>
+firefox-1.0.4      &lt; 1.0.7  <lineannotation>(a more recent version is available)</lineannotation>
+<replaceable>...</replaceable>
+
+<lineannotation>(show info about a specific package, in XML)</lineannotation>
+$ nix-env -qa --xml --description firefox 
+<![CDATA[<?xml version='1.0' encoding='utf-8'?>
+<items>
+  <item attrPath="0.0.firefoxWrapper"
+    description="Mozilla Firefox - the browser, reloaded (with various plugins)"
+    name="firefox-1.5.0.7" system="i686-linux" />
+</items>]]></screen>
 
 </refsection>
 
@@ -886,43 +1250,4 @@ error: no generation older than the current (91) exists</screen>
 
 
   
-<!--######################################################################-->
-
-<refsection><title>Operation <option>--import</option></title>
-
-<refsection><title>Synopsis</title>
-
-<cmdsynopsis>
-  <command>nix-env</command>
-  <group choice='req'>
-    <arg choice='plain'><option>--import</option></arg>
-    <arg choice='plain'><option>-I</option></arg>
-  </group>
-  <arg choice='req'><replaceable>path</replaceable></arg>
-</cmdsynopsis>
-
-</refsection>
-
-
-<refsection><title>Description</title>
-            
-<para>This operation makes <replaceable>path</replaceable> the default
-active Nix expression for the user.  That is, the symlink
-<filename>~/.nix-userenv</filename> is made to point to
-<replaceable>path</replaceable>.</para>
-
-</refsection>
-
-
-<refsection><title>Examples</title>
-
-<screen>
-$ nix-env -I ~/nixpkgs-0.5/</screen>
-
-</refsection>
-    
-</refsection>
-
-
-  
 </refentry>

doc/manual/nix-hash.xml

@@ -0,0 +1,162 @@
+<refentry xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink"
+          xmlns:xi="http://www.w3.org/2001/XInclude">
+  
+<refmeta>
+  <refentrytitle>nix-hash</refentrytitle>
+  <manvolnum>1</manvolnum>
+  <refmiscinfo class="source">Nix</refmiscinfo>
+  <refmiscinfo class="version"><xi:include href="version.txt" parse="text"/></refmiscinfo>
+</refmeta>
+
+<refnamediv>
+  <refname>nix-hash</refname>
+  <refpurpose>compute the cryptographic hash of a path</refpurpose>
+</refnamediv>
+
+<refsynopsisdiv>
+  <cmdsynopsis>
+    <command>nix-hash</command>
+    <arg><option>--flat</option></arg>
+    <arg><option>--base32</option></arg>
+    <arg><option>--truncate</option></arg>
+    <arg><option>--type</option> <replaceable>hashAlgo</replaceable></arg>
+    <arg choice='plain' rep='repeat'><replaceable>path</replaceable></arg>
+  </cmdsynopsis>
+  <cmdsynopsis>
+    <command>nix-hash</command>
+    <arg choice='plain'><option>--to-base16</option></arg>
+    <arg choice='plain' rep='repeat'><replaceable>hash</replaceable></arg>
+  </cmdsynopsis>
+  <cmdsynopsis>
+    <command>nix-hash</command>
+    <arg choice='plain'><option>--to-base32</option></arg>
+    <arg choice='plain' rep='repeat'><replaceable>hash</replaceable></arg>
+  </cmdsynopsis>
+</refsynopsisdiv>
+
+
+<refsection><title>Description</title>
+
+<para>The command <command>nix-hash</command> computes the
+cryptographic hash of the contents of each
+<replaceable>path</replaceable> and prints it on standard output.  By
+default, it computes an MD5 hash, but other hash algorithms are
+available as well.  The hash is printed in hexadecimal.</para>
+
+<para>The hash is computed over a <emphasis>serialisation</emphasis>
+of each path: a dump of the file system tree rooted at the path.  This
+allows directories and symlinks to be hashed as well as regular files.
+The dump is in the <emphasis>NAR format</emphasis> produced by <link
+linkend="refsec-nix-store-dump"><command>nix-store</command>
+<option>--dump</option></link>.  Thus, <literal>nix-hash
+<replaceable>path</replaceable></literal> yields the same
+cryptographic hash as <literal>nix-store --dump
+<replaceable>path</replaceable> | md5sum</literal>.</para>
+
+</refsection>
+
+
+<refsection><title>Options</title>
+
+<variablelist>
+  
+  <varlistentry><term><option>--flat</option></term>
+
+    <listitem><para>Print the cryptographic hash of the contents of
+    each regular file <replaceable>path</replaceable>.  That is, do
+    not compute the hash over the dump of
+    <replaceable>path</replaceable>.  The result is identical to that
+    produced by the GNU commands <command>md5sum</command> and
+    <command>sha1sum</command>.</para></listitem>
+
+  </varlistentry>
+
+  <varlistentry><term><option>--base32</option></term>
+
+    <listitem><para>Print the hash in a base-32 representation rather
+    than hexadecimal.  This base-32 representation is more compact and
+    can be used in Nix expressions (such as in calls to
+    <function>fetchurl</function>).</para></listitem>
+
+  </varlistentry>
+
+  <varlistentry><term><option>--truncate</option></term>
+
+    <listitem><para>Truncate hashes longer than 160 bits (such as
+    SHA-256) to 160 bits.</para></listitem>
+
+  </varlistentry>
+
+  <varlistentry><term><option>--type</option> <replaceable>hashAlgo</replaceable></term>
+
+    <listitem><para>Specify a cryptographic hash, which can be one of
+    <literal>md5</literal>, <literal>sha1</literal>, and
+    <literal>sha256</literal>.</para></listitem>
+
+  </varlistentry>
+
+  <varlistentry><term><option>--to-base16</option></term>
+
+    <listitem><para>Don’t hash anything, but convert the base-32 hash
+    representation <replaceable>hash</replaceable> to
+    hexadecimal.</para></listitem>
+
+  </varlistentry>
+
+  <varlistentry><term><option>--to-base32</option></term>
+
+    <listitem><para>Don’t hash anything, but convert the hexadecimal
+    hash representation <replaceable>hash</replaceable> to
+    base-32.</para></listitem>
+
+  </varlistentry>
+
+</variablelist>
+
+</refsection>
+
+
+<refsection><title>Examples</title>
+
+<para>Computing hashes:
+
+<screen>
+$ mkdir test
+$ echo "hello" > test/world
+
+$ nix-hash test/ <lineannotation>(MD5 hash; default)</lineannotation>
+8179d3caeff1869b5ba1744e5a245c04
+
+$ nix-store --dump test/ | md5sum <lineannotation>(for comparison)</lineannotation>
+8179d3caeff1869b5ba1744e5a245c04  -
+
+$ nix-hash --type sha1 test/
+e4fd8ba5f7bbeaea5ace89fe10255536cd60dab6
+
+$ nix-hash --type sha1 --base32 test/
+nvd61k9nalji1zl9rrdfmsmvyyjqpzg4
+
+$ nix-hash --type sha256 --flat test/
+error: reading file `test/': Is a directory
+
+$ nix-hash --type sha256 --flat test/world
+5891b5b522d5df086d0ff0b110fbd9d21bb4fc7163af34d08286a2e846f6be03</screen>
+
+</para>
+
+<para>Converting between hexadecimal and base-32:
+
+<screen>
+$ nix-hash --type sha1 --to-base32 e4fd8ba5f7bbeaea5ace89fe10255536cd60dab6
+nvd61k9nalji1zl9rrdfmsmvyyjqpzg4
+
+$ nix-hash --type sha1 --to-base16 nvd61k9nalji1zl9rrdfmsmvyyjqpzg4
+e4fd8ba5f7bbeaea5ace89fe10255536cd60dab6</screen>
+
+</para>
+
+</refsection>
+
+
+</refentry>

doc/manual/nix-install-package.xml

@@ -0,0 +1,197 @@
+<refentry xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink"
+          xmlns:xi="http://www.w3.org/2001/XInclude">
+  
+<refmeta>
+  <refentrytitle>nix-install-package</refentrytitle>
+  <manvolnum>1</manvolnum>
+  <refmiscinfo class="source">Nix</refmiscinfo>
+  <refmiscinfo class="version"><xi:include href="version.txt" parse="text"/></refmiscinfo>
+</refmeta>
+
+<refnamediv>
+  <refname>nix-install-package</refname>
+  <refpurpose>install a Nix Package file</refpurpose>
+</refnamediv>
+
+<refsynopsisdiv>
+  <cmdsynopsis>
+    <command>nix-install-package</command>
+    <arg><option>--non-interactive</option></arg>
+    <arg>
+      <group choice='req'>
+        <arg choice='plain'><option>--profile</option></arg>
+        <arg choice='plain'><option>-p</option></arg>
+      </group>
+      <replaceable>path</replaceable>
+    </arg>
+    <sbr />
+    <group choice='req'>
+      <arg choice='req'>
+        <option>--url</option>
+        <arg choice='plain'><replaceable>url</replaceable></arg>
+      </arg>
+      <arg choice='req'>
+        <arg choice='plain'><replaceable>file</replaceable></arg>
+      </arg>
+    </group>
+  </cmdsynopsis>
+</refsynopsisdiv>
+
+
+<refsection><title>Description</title>
+
+<para>The command <command>nix-install-package</command> interactively
+installs a Nix Package file (<filename>*.nixpkg</filename>), which is
+a small file that contains a store path to be installed along with the
+URL of a <link linkend="sec-nix-push"><command>nix-push</command>
+manifest</link>.  The Nix Package file is either
+<replaceable>file</replaceable>, or automatically downloaded from
+<replaceable>url</replaceable> if the <option>--url</option> switch is
+used.</para>
+
+<para><command>nix-install-package</command> is used in <link
+linkend="sec-one-click">one-click installs</link> to download and
+install pre-built binary packages with all necessary dependencies.
+<command>nix-install-package</command> is intended to be associated
+with the MIME type <literal>application/nix-package</literal> in a web
+browser so that it is invoked automatically when you click on
+<filename>*.nixpkg</filename> files.  When invoked, it restarts itself
+in a terminal window (since otherwise it would be invisible when run
+from a browser), asks the user to confirm whether to install the
+package, and if so downloads and installs the package into the user’s
+current profile.</para>
+
+<para>To obtain a window, <command>nix-install-package</command> tries
+to restart itself with <command>xterm</command>,
+<command>konsole</command> and
+<command>gnome-terminal</command>.</para>
+
+</refsection>
+
+
+<refsection><title>Options</title>
+
+<variablelist>
+  
+  <varlistentry><term><option>--non-interactive</option></term>
+
+    <listitem><para>Do not open a new terminal window and do not ask
+    for confirmation.</para></listitem>
+
+  </varlistentry>
+
+  <varlistentry><term><option>--profile</option></term>
+    <term><option>-p</option></term>
+
+    <listitem><para>Install the package into the specified profile
+    rather than the user’s current profile.</para></listitem>
+
+  </varlistentry>
+
+</variablelist>
+
+</refsection>
+
+
+<refsection><title>Examples</title>
+
+<para>To install <filename>subversion-1.4.0.nixpkg</filename> into the
+user’s current profile, without any prompting:
+
+<screen>
+$ nix-install-package --non-interactive subversion-1.4.0.nixpkg</screen>
+
+</para>
+
+<para>To install the same package from some URL into a different
+profile:
+
+<screen>
+$ nix-install-package --non-interactive -p /nix/var/nix/profiles/eelco \
+    --url http://nix.cs.uu.nl/dist/nix/nixpkgs-0.10pre6622/pkgs/subversion-1.4.0-i686-linux.nixpkg</screen>
+
+</para>
+
+</refsection>
+
+
+<refsection><title>Format of <literal>nixpkg</literal> files</title>
+
+<para>A Nix Package file consists of a single line with the following
+format:
+
+<screen>
+NIXPKG1 <replaceable>manifestURL</replaceable> <replaceable>name</replaceable> <replaceable>system</replaceable> <replaceable>drvPath</replaceable> <replaceable>outPath</replaceable></screen>
+
+The elemens are as follows:
+
+<variablelist>
+
+  <varlistentry><term><literal>NIXPKG1</literal></term>
+  
+    <listitem><para>The version of the Nix Package
+    file.</para></listitem>
+
+  </varlistentry>
+
+  <varlistentry><term><replaceable>manifestURL</replaceable></term>
+  
+    <listitem><para>The manifest to be pulled by
+    <command>nix-pull</command>.  The manifest must contain
+    <replaceable>outPath</replaceable>.</para></listitem>
+
+  </varlistentry>
+
+  <varlistentry><term><replaceable>name</replaceable></term>
+  
+    <listitem><para>The symbolic name and version of the
+    package.</para></listitem>
+
+  </varlistentry>
+
+  <varlistentry><term><replaceable>system</replaceable></term>
+  
+    <listitem><para>The platform identifier of the platform for which
+    this binary package is intended.</para></listitem>
+
+  </varlistentry>
+
+  <varlistentry><term><replaceable>drvPath</replaceable></term>
+  
+    <listitem><para>The path in the Nix store of the derivation from
+    which <replaceable>outPath</replaceable> was built.  Not currently
+    used.</para></listitem>
+
+  </varlistentry>
+
+  <varlistentry><term><replaceable>outPath</replaceable></term>
+  
+    <listitem><para>The path in the Nix store of the package.  After
+    <command>nix-install-package</command> has obtained the manifest
+    from <replaceable>manifestURL</replaceable>, it performs a
+    <literal>nix-env -i</literal> <replaceable>outPath</replaceable>
+    to install the binary package.</para></listitem>
+
+  </varlistentry>
+
+</variablelist>
+  
+</para>
+
+<para>An example follows:
+
+<screen>
+NIXPKG1 http://.../nixpkgs-0.10pre6622/MANIFEST subversion-1.4.0 i686-darwin \
+  /nix/store/4kh60jkp...-subversion-1.4.0.drv \
+  /nix/store/nkw7wpgb...-subversion-1.4.0</screen>
+
+(The line breaks (<literal>\</literal>) are for presentation purposes
+and not part of the actual file.)
+
+</para>
+
+</refsection>
+
+
+</refentry>

doc/manual/nix-instantiate.xml

@@ -1,5 +1,14 @@
-<refentry>
+<refentry xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink"
+          xmlns:xi="http://www.w3.org/2001/XInclude">
   
+<refmeta>
+  <refentrytitle>nix-instantiate</refentrytitle>
+  <manvolnum>1</manvolnum>
+  <refmiscinfo class="source">Nix</refmiscinfo>
+  <refmiscinfo class="version"><xi:include href="version.txt" parse="text"/></refmiscinfo>
+</refmeta>
+
 <refnamediv>
   <refname>nix-instantiate</refname>
   <refpurpose>instantiate store derivations from Nix expressions</refpurpose>
@@ -8,13 +17,27 @@
 <refsynopsisdiv>
   <cmdsynopsis>
     <command>nix-instantiate</command>
-    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="opt-common-syn.xml#xpointer(/nop/*)" />
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="opt-common-syn.xml#xmlns(db=http://docbook.org/ns/docbook)xpointer(/db:nop/*)" />
+    <arg><option>--arg</option> <replaceable>name</replaceable> <replaceable>value</replaceable></arg>
+    <arg>
+      <group choice='req'>
+        <arg choice='plain'><option>--attr</option></arg>
+        <arg choice='plain'><option>-A</option></arg>
+      </group>
+      <replaceable>attrPath</replaceable>
+    </arg>
     <arg><option>--add-root</option> <replaceable>path</replaceable></arg>
     <arg><option>--indirect</option></arg>
-    <group choice='opt'>
-      <arg choice='plain'><option>--parse-only</option></arg>
-      <arg choice='plain'><option>--eval-only</option></arg>
-    </group>
+    <arg>
+      <group choice='req'>
+        <arg choice='plain'><option>--parse-only</option></arg>
+        <arg choice='plain'>
+          <option>--eval-only</option>
+          <arg><option>--strict</option></arg>
+        </arg>
+      </group>
+      <arg><option>--xml</option></arg>
+    </arg>
     <arg choice='plain' rep='repeat'><replaceable>files</replaceable></arg>
   </cmdsynopsis>
 </refsynopsisdiv>
@@ -30,6 +53,10 @@ evaluate to a derivation, a list of derivations, or a set of
 derivations.  The paths of the resulting store derivations are printed
 on standard output.</para>
 
+<para>If <replaceable>files</replaceable> is the character
+<literal>-</literal>, then a Nix expression will be read from standard
+input.</para>
+
 <para>Most users and developers don’t need to use this command
 (<command>nix-env</command> and <command>nix-build</command> perform
 store derivation instantiation from Nix expressions automatically).
@@ -72,6 +99,31 @@ common options.</para>
     
   </varlistentry>
 
+  <varlistentry><term><option>--xml</option></term>
+
+    <listitem><para>When used with <option>--parse-only</option> and
+    <option>--eval-only</option>, print the resulting expression as an
+    XML representation of the abstract syntax tree rather than as an
+    ATerm.  The schema is the same as that used by the <link
+    linkend="builtin-toXML"><function>toXML</function>
+    built-in</link>.</para></listitem>
+
+  </varlistentry>
+
+  <varlistentry><term><option>--strict</option></term>
+
+    <listitem><para>When used with <option>--eval-only</option>,
+    recursively evaluate list elements and attributes.  Normally, such
+    sub-expressions are left unevaluated (since the Nix expression
+    language is lazy).</para>
+
+    <warning><para>This option can cause non-termination, because lazy
+    data structures can be infinitely large.</para></warning>
+
+    </listitem>
+
+  </varlistentry>
+
 </variablelist>
 
 </refsection>
@@ -79,6 +131,9 @@ common options.</para>
 
 <refsection><title>Examples</title>
 
+<para>Instantiating store derivations from a Nix expression, and
+building them using <command>nix-store</command>:
+
 <screen>
 $ nix-instantiate test.nix <lineannotation>(instantiate)</lineannotation>
 /nix/store/cigxbmvy6dzix98dxxh9b6shg7ar5bvs-perl-BerkeleyDB-0.26.drv
@@ -91,6 +146,54 @@ $ ls -l /nix/store/qhqk4n8ci095g3sdp93x7rgwyh9rdvgk-perl-BerkeleyDB-0.26
 dr-xr-xr-x    2 eelco    users        4096 1970-01-01 01:00 lib
 ...</screen>
 
+</para>
+
+<para>Parsing and evaluating Nix expressions:
+
+<screen>
+$ echo '"foo" + "bar"' | nix-instantiate --parse-only -
+OpPlus(Str("foo"),Str("bar"))
+
+$ echo '"foo" + "bar"' | nix-instantiate --eval-only -
+Str("foobar")
+
+$ echo '"foo" + "bar"' | nix-instantiate --eval-only --xml -
+<![CDATA[<?xml version='1.0' encoding='utf-8'?>
+<expr>
+  <string value="foobar" />
+</expr>]]></screen>
+
+</para>
+
+<para>The difference between non-strict and strict evaluation:
+
+<screen>
+$ echo 'rec { x = "foo"; y = x; }' | nix-instantiate --eval-only --xml -
+<replaceable>...</replaceable><![CDATA[
+    <attr name="x">
+      <string value="foo" />
+    </attr>
+    <attr name="y">
+      <unevaluated />
+    </attr>]]>
+<replaceable>...</replaceable></screen>
+
+Note that <varname>y</varname> is left unevaluated (the XML
+representation doesn’t attempt to show non-normal forms).
+
+<screen>
+$ echo 'rec { x = "foo"; y = x; }' | nix-instantiate --eval-only --xml --strict -
+<replaceable>...</replaceable><![CDATA[
+    <attr name="x">
+      <string value="foo" />
+    </attr>
+    <attr name="y">
+      <string value="foo" />
+    </attr>]]>
+<replaceable>...</replaceable></screen>
+
+</para>
+
 </refsection>
 
 

doc/manual/nix-pack-closure.xml

@@ -0,0 +1,82 @@
+<refentry xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink"
+          xmlns:xi="http://www.w3.org/2001/XInclude">
+
+<refmeta>
+  <refentrytitle>nix-pack-closure</refentrytitle>
+  <manvolnum>1</manvolnum>
+  <refmiscinfo class="source">Nix</refmiscinfo>
+  <refmiscinfo class="version"><xi:include href="version.txt" parse="text"/></refmiscinfo>
+</refmeta>
+
+<refnamediv>
+  <refname>nix-pack-closure</refname>
+  <refpurpose>pack the closure of a store path into a single file that
+  can be unpacked with
+  <command>nix-unpack-closure</command></refpurpose>
+</refnamediv>
+
+<refsynopsisdiv>
+  <cmdsynopsis>
+    <command>nix-pack-closure</command>
+    <arg choice='plain' rep='repeat'><replaceable>paths</replaceable></arg>
+  </cmdsynopsis>
+</refsynopsisdiv>
+
+
+<refsection><title>Description</title>
+
+<para>The command <command>nix-pack-closure</command> packs the
+contents of the store paths <replaceable>paths</replaceable> and
+<emphasis>all their dependencies</emphasis> into a single file, which
+is written to standard output.  (That is, it
+<emphasis>serialises</emphasis> <replaceable>paths</replaceable>.)
+The output can then be unpacked into the Nix store of another machine
+using <command>nix-unpack-closure</command>.</para>
+
+<para>Together, <command>nix-pack-closure</command> and
+<command>nix-unpack-closure</command> provide a quick and easy way to
+deploy a package to a different machine.  However, as the output of
+<command>nix-pack-closure</command> tends to be rather large (since it
+contains all dependencies), it’s not very efficient.
+<command>nix-push</command> and <command>nix-pull</command> are more
+efficient, but are also a bit more cumbersome to use.</para>
+
+</refsection>
+
+
+<refsection><title>Examples</title>
+
+<para>To copy some instance of Subversion with all its dependencies to
+another machine:
+
+<screen>
+$ nix-pack-closure /nix/store/hj232g1r...-subversion-1.3.0 > svn.closure
+
+<lineannotation>Copy <!-- !!! <filename> -->svn.closure to the remote machine, then on the remote machine do:</lineannotation>
+$ nix-unpack-closure &lt; svn.closure</screen>
+
+</para>
+
+<para>Copy the program <command>azureus</command> with all its
+dependencies to the machine <literal>scratchy</literal>:
+
+<screen>
+$ nix-pack-closure $(which azureus) | ssh scratchy nix-unpack-closure</screen>
+    
+</para>
+
+<para>As a variation on the previous example, copy
+<command>azureus</command>, and also install it in the user’s profile
+on the target machine:
+
+<screen>
+$ nix-pack-closure $(which azureus) | ssh scratchy 'nix-env -i $(nix-unpack-closure)'</screen>
+
+</para>
+ 
+
+</refsection>
+
+
+</refentry>

doc/manual/nix-prefetch-url.xml

@@ -1,5 +1,14 @@
-<refentry>
+<refentry xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink"
+          xmlns:xi="http://www.w3.org/2001/XInclude">
   
+<refmeta>
+  <refentrytitle>nix-prefetch-url</refentrytitle>
+  <manvolnum>1</manvolnum>
+  <refmiscinfo class="source">Nix</refmiscinfo>
+  <refmiscinfo class="version"><xi:include href="version.txt" parse="text"/></refmiscinfo>
+</refmeta>
+
 <refnamediv>
   <refname>nix-prefetch-url</refname>
   <refpurpose>copy a file from a URL into the store and print its MD5 hash</refpurpose>
@@ -38,7 +47,7 @@ avoided.</para>
 <para>The environment variable <envar>NIX_HASH_ALGO</envar> specifies
 which hash algorithm to use.  It can be either <literal>md5</literal>,
 <literal>sha1</literal>, or <literal>sha256</literal>.  The default is
-<literal>md5</literal>.</para>
+<literal>sha256</literal>.</para>
 
 <para>If <replaceable>hash</replaceable> is specified, then a download
 is not performed if the Nix store already contains a file with the

doc/manual/nix-pull.xml

@@ -1,43 +1,49 @@
-<refentry>
-  <refnamediv>
-    <refname>nix-pull</refname>
-    <refpurpose>pull substitutes from a network cache</refpurpose>
-  </refnamediv>
+<refentry xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink"
+          xmlns:xi="http://www.w3.org/2001/XInclude">
 
-  <refsynopsisdiv>
-    <cmdsynopsis>
-      <command>nix-pull</command>
-      <arg choice='plain'><replaceable>url</replaceable></arg>
-    </cmdsynopsis>
-  </refsynopsisdiv>
+<refmeta>
+  <refentrytitle>nix-pull</refentrytitle>
+  <manvolnum>1</manvolnum>
+  <refmiscinfo class="source">Nix</refmiscinfo>
+  <refmiscinfo class="version"><xi:include href="version.txt" parse="text"/></refmiscinfo>
+</refmeta>
 
-  <refsection>
-    <title>Description</title>
+<refnamediv>
+  <refname>nix-pull</refname>
+  <refpurpose>pull substitutes from a network cache</refpurpose>
+</refnamediv>
 
-    <para>
-      The command <command>nix-pull</command> obtains a list of
-      pre-built store paths from the URL
-      <replaceable>url</replaceable>, and for each of these store
-      paths, registers a substitute derivation that downloads and
-      unpacks it into the Nix store.  This is used to speed up
-      installations: if you attempt to install something that has
-      already been built and stored into the network cache, Nix can
-      transparently re-use the pre-built store paths.
-    </para>
+<refsynopsisdiv>
+  <cmdsynopsis>
+    <command>nix-pull</command>
+    <arg choice='plain'><replaceable>url</replaceable></arg>
+  </cmdsynopsis>
+</refsynopsisdiv>
 
-    <para>
-      The file at <replaceable>url</replaceable> must be compatible
-      with the files created by <replaceable>nix-push</replaceable>.
-    </para>
 
-  </refsection>
+<refsection><title>Description</title>
 
-  <refsection>
-    <title>Examples</title>
+<para>The command <command>nix-pull</command> obtains a list of
+pre-built store paths from the URL <replaceable>url</replaceable>, and
+for each of these store paths, registers a substitute derivation that
+downloads and unpacks it into the Nix store.  This is used to speed up
+installations: if you attempt to install something that has already
+been built and stored into the network cache, Nix can transparently
+re-use the pre-built store paths.</para>
+
+<para>The file at <replaceable>url</replaceable> must be compatible
+with the files created by <replaceable>nix-push</replaceable>.</para>
+
+</refsection>
+
+
+<refsection><title>Examples</title>
+
+<screen>
+$ nix-pull http://nix.cs.uu.nl/dist/nix/nixpkgs-0.5pre753/MANIFEST</screen>
+
+</refsection>
 
-    <screen>
-$ nix-pull http://catamaran.labs.cs.uu.nl/dist/nix/nixpkgs-0.5pre753/MANIFEST</screen>
 
-  </refsection>
-    
 </refentry>

doc/manual/nix-push.xml

@@ -1,4 +1,13 @@
-<refentry>
+<refentry xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink"
+          xmlns:xi="http://www.w3.org/2001/XInclude">
+
+<refmeta>
+  <refentrytitle>nix-push</refentrytitle>
+  <manvolnum>1</manvolnum>
+  <refmiscinfo class="source">Nix</refmiscinfo>
+  <refmiscinfo class="version"><xi:include href="version.txt" parse="text"/></refmiscinfo>
+</refmeta>
 
 <refnamediv>
   <refname>nix-push</refname>
@@ -62,14 +71,15 @@ machines using the <command>nix-pull</command> command.</para>
   specified by <replaceable>archivesPutURL</replaceable>.  HTTP PUT
   requests are used to do this.  However, before a file
   <varname>x</varname> is uploaded to
-  <literal><replaceable>archivesPutURL</replaceable>/<varname>x</varname></literal>,
+  <literal><replaceable>archivesPutURL</replaceable>/</literal><varname>x</varname>,
   <command>nix-push</command> first determines whether this upload is
   unnecessary by issuing a HTTP HEAD request on
-  <literal><replaceable>archivesGetURL</replaceable>/<varname>x</varname></literal>.
+  <literal><replaceable>archivesGetURL</replaceable>/</literal><varname>x</varname>.
   This allows a cache to be shared between many partially overlapping
   <command>nix-push</command> invocations.  (We use two URLs because
   the upload URL typically refers to a CGI script, while the download
-  URL just refers to a file system directory on the server.)</para></listitem>
+  URL just refers to a file system directory on the
+  server.)</para></listitem>
 
   <listitem><para>The manifest is uploaded using an HTTP PUT request
   to <replaceable>manifestPutURL</replaceable>.  The corresponding
@@ -80,7 +90,9 @@ machines using the <command>nix-pull</command> command.</para>
 
 </para>
 
-<para>TODO: <option>--copy</option></para>
+<!--
+<para>TODO:  <option>- -copy</option></para>
+-->
             
 </refsection>
 

doc/manual/nix-store.xml

@@ -1,4 +1,13 @@
-<refentry>
+<refentry xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink"
+          xmlns:xi="http://www.w3.org/2001/XInclude">
+
+<refmeta>
+  <refentrytitle>nix-store</refentrytitle>
+  <manvolnum>1</manvolnum>
+  <refmiscinfo class="source">Nix</refmiscinfo>
+  <refmiscinfo class="version"><xi:include href="version.txt" parse="text"/></refmiscinfo>
+</refmeta>
 
 <refnamediv>
   <refname>nix-store</refname>
@@ -8,7 +17,7 @@
 <refsynopsisdiv>
   <cmdsynopsis>
     <command>nix-store</command>
-    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="opt-common-syn.xml#xpointer(/nop/*)" />
+    <xi:include xmlns:xi="http://www.w3.org/2001/XInclude" href="opt-common-syn.xml#xmlns(db=http://docbook.org/ns/docbook)xpointer(/db:nop/*)" />
     <arg><option>--add-root</option> <replaceable>path</replaceable></arg>
     <arg><option>--indirect</option></arg>
     <arg choice='plain'><replaceable>operation</replaceable></arg>
@@ -43,7 +52,7 @@ linkend="sec-common-options" /> for a list of common options.</para>
 
 <variablelist>
 
-  <varlistentry id="opt-add-root"><term><option>--add-root</option> <replaceable>path</replaceable></term>
+  <varlistentry xml:id="opt-add-root"><term><option>--add-root</option> <replaceable>path</replaceable></term>
 
     <listitem><para>Causes the result of a realisation
     (<option>--realise</option> and <option>--force-realise</option>)
@@ -108,8 +117,7 @@ lrwxrwxrwx    1 ... 2005-03-13 21:10 /home/eelco/bla/result -> /nix/store/1r1134
 
 <!--######################################################################-->
 
-<refsection id='rsec-nix-store-realise'><title>Operation
-<option>--realise</option></title>
+<refsection xml:id='rsec-nix-store-realise'><title>Operation <option>--realise</option></title>
 
 <refsection><title>Synopsis</title>
 
@@ -183,7 +191,7 @@ linkend="sec-nix-build"><command>nix-build</command></link> does.</para>
 
 <!--######################################################################-->
 
-<refsection id='rsec-nix-store-gc'><title>Operation <option>--gc</option></title>
+<refsection xml:id='rsec-nix-store-gc'><title>Operation <option>--gc</option></title>
 
 <refsection><title>Synopsis</title>
 
@@ -256,6 +264,11 @@ and <link
 linkend="conf-gc-keep-derivations"><literal>gc-keep-derivations</literal></link>
 variables in the Nix configuration file.</para>
 
+<para>With <option>--delete</option>, the collector prints the total
+number of freed bytes when it finishes (or when it is interrupted).
+With <option>--print-dead</option>, it prints the number of bytes that
+would be freed.</para>
+
 </refsection>
 
 
@@ -264,7 +277,10 @@ variables in the Nix configuration file.</para>
 <para>To delete all unreachable paths, just do:
     
 <screen>
-$ nix-store --gc</screen>
+$ nix-store --gc
+deleting `/nix/store/kq82idx6g0nyzsp2s14gfsc38npai7lf-cairo-1.0.4.tar.gz.drv'
+<replaceable>...</replaceable>
+8825586 bytes freed (8.42 MiB)</screen>
 
 </para>
 
@@ -277,7 +293,52 @@ $ nix-store --gc</screen>
   
 <!--######################################################################-->
 
-<refsection><title>Operation <option>--query</option></title>
+<refsection><title>Operation <option>--delete</option></title>
+
+<refsection><title>Synopsis</title>
+
+<cmdsynopsis>
+  <command>nix-store</command>
+  <arg choice='plain'><option>--gc</option></arg>
+  <arg><option>--ignore-liveness</option></arg>
+  <arg choice='plain' rep='repeat'><replaceable>paths</replaceable></arg>
+</cmdsynopsis>
+
+</refsection>
+
+<refsection><title>Description</title>
+
+<para>The operation <option>--delete</option> deletes the store paths
+<replaceable>paths</replaceable> from the Nix store, but only if it is
+safe to do so; that is, when the path is not reachable from a root of
+the garbage collector.  This means that you can only delete paths that
+would also be deleted by <literal>nix-store --gc</literal>.  Thus,
+<literal>--delete</literal> is a more targeted version of
+<literal>--gc</literal>.</para>
+
+<para>With the option <option>--ignore-liveness</option>, reachability
+from the roots is ignored.  However, the path still won’t be deleted
+if there are other paths in the store that refer to it (i.e., depend
+on it).</para>
+
+</refsection>
+
+<refsection><title>Example</title>
+
+<screen>
+$ nix-store --delete /nix/store/zq0h41l75vlb4z45kzgjjmsjxvcv1qk7-mesa-6.4
+0 bytes freed (0.00 MiB)
+error: cannot delete path `/nix/store/zq0h41l75vlb4z45kzgjjmsjxvcv1qk7-mesa-6.4' since it is still alive</screen>
+
+</refsection>
+
+</refsection>
+
+
+
+<!--######################################################################-->
+
+<refsection xml:id='refsec-nix-store-query'><title>Operation <option>--query</option></title>
 
 <refsection><title>Synopsis</title>
 
@@ -292,8 +353,8 @@ $ nix-store --gc</screen>
     <arg choice='plain'><option>--requisites</option></arg>
     <arg choice='plain'><option>-R</option></arg>
     <arg choice='plain'><option>--references</option></arg>
-    <arg choice='plain'><option>--referers</option></arg>
-    <arg choice='plain'><option>--referers-closure</option></arg>
+    <arg choice='plain'><option>--referrers</option></arg>
+    <arg choice='plain'><option>--referrers-closure</option></arg>
     <arg choice='plain'><option>--deriver</option></arg>
     <arg choice='plain'><option>--deriver</option></arg>
     <arg choice='plain'><option>--graph</option></arg>
@@ -353,7 +414,7 @@ query is applied to the target of the symlink.</para>
 </refsection>
     
 
-<refsection id='nixref-queries'><title>Queries</title>
+<refsection xml:id='nixref-queries'><title>Queries</title>
             
 <variablelist>
 
@@ -411,21 +472,21 @@ query is applied to the target of the symlink.</para>
 
   </varlistentry>
   
-  <varlistentry><term><option>--referers</option></term>
+  <varlistentry><term><option>--referrers</option></term>
   
-    <listitem><para>Prints the set of <emphasis>referers</emphasis> of
+    <listitem><para>Prints the set of <emphasis>referrers</emphasis> of
     the store paths <replaceable>paths</replaceable>, that is, the
     store paths currently existing in the Nix store that refer to one
     of <replaceable>paths</replaceable>.  Note that contrary to the
-    references, the set of referers is not constant; it can change as
+    references, the set of referrers is not constant; it can change as
     store paths are added or removed.</para></listitem>
 
   </varlistentry>
   
-  <varlistentry><term><option>--referers-closure</option></term>
+  <varlistentry><term><option>--referrers-closure</option></term>
   
     <listitem><para>Prints the closure of the set of store paths
-    <replaceable>paths</replaceable> under the referers relation; that
+    <replaceable>paths</replaceable> under the referrers relation; that
     is, all store paths that directly or indirectly refer to one of
     <replaceable>paths</replaceable>.  These are all the path currently
     in the Nix store that are dependent on
@@ -448,11 +509,11 @@ query is applied to the target of the symlink.</para>
   
     <listitem><para>Prints the references graph of the store paths
     <replaceable>paths</replaceable> in the format of the
-    <command>dot</command> tool of AT&amp;T's <ulink
-    url="http://www.graphviz.org/">Graphviz package</ulink>.  This can
-    be used to visualise dependency graphs.  To obtain a build-time
-    dependency graph, apply this to a store derivation.  To obtain a
-    runtime dependency graph, apply it to an output
+    <command>dot</command> tool of AT&amp;T's <link
+    xlink:href="http://www.graphviz.org/">Graphviz package</link>.
+    This can be used to visualise dependency graphs.  To obtain a
+    build-time dependency graph, apply this to a store derivation.  To
+    obtain a runtime dependency graph, apply it to an output
     path.</para></listitem>
 
   </varlistentry>
@@ -536,7 +597,7 @@ $ nix-store -q --tree $(nix-store -qd $(which svn))
 <command>svn</command>:
 
 <screen>
-$ nix-store -q --referers $(nix-store -q --binding openssl $(nix-store -qd $(which svn)))
+$ nix-store -q --referrers $(nix-store -q --binding openssl $(nix-store -qd $(which svn)))
 /nix/store/23ny9l9wixx21632y2wi4p585qhva1q8-sylpheed-1.0.0
 /nix/store/5mbglq5ldqld8sj57273aljwkfvj22mc-subversion-1.1.4
 /nix/store/dpmvp969yhdqs7lm2r1a3gng7pyq6vy4-subversion-1.1.3
@@ -548,7 +609,7 @@ $ nix-store -q --referers $(nix-store -q --binding openssl $(nix-store -qd $(whi
 (C library) used by <command>svn</command>:
 
 <screen>
-$ nix-store -q --referers-closure $(ldd $(which svn) | grep /libc.so | awk '{print $3}')
+$ nix-store -q --referrers-closure $(ldd $(which svn) | grep /libc.so | awk '{print $3}')
 /nix/store/034a6h4vpz9kds5r6kzb9lhh81mscw43-libgnomeprintui-2.8.2
 /nix/store/15l3yi0d45prm7a82pcrknxdh6nzmxza-gawk-3.1.4
 <replaceable>...</replaceable></screen>
@@ -575,7 +636,7 @@ $ gv graph.ps</screen>
 <!--######################################################################-->
 
 <!--
-<refsection id="rsec-nix-store-reg-val"><title>Operation <option>-XXX-register-validity</option></title>
+<refsection xml:id="rsec-nix-store-reg-val"><title>Operation <option>-XXX-register-validity</option></title>
 
 <refsection><title>Synopsis</title>
 
@@ -598,37 +659,7 @@ $ gv graph.ps</screen>
 
 <!--######################################################################-->
 
-<!--
-<refsection><title>Operation <option>-XXX-substitute</option></title>
-
-<refsection><title>Synopsis</title>
-
-<cmdsynopsis>
-  <command>nix-store</command>
-  <arg choice='plain'><option>-XXX-substitute</option></arg>
-  <arg choice='plain'
-       rep='repeat'><replaceable>srcpath</replaceable> <replaceable>subpath</replaceable></arg>
-</cmdsynopsis>
-</refsection>
-
-<refsection><title>Description</title>
-            
-<para>The operation <option>-XXX-substitute</option> registers that the
-store path <replaceable>srcpath</replaceable> can be built by
-realising the derivation expression in
-<replaceable>subpath</replaceable>.  This is used to implement binary
-deployment.</para>
-
-</refsection>
-            
-</refsection>
--->
-
-
-
-<!--######################################################################-->
-
-<refsection><title>Operation <option>--verify</option></title>
+<refsection xml:id='refsec-nix-store-verify'><title>Operation <option>--verify</option></title>
 
 <refsection>
   <title>Synopsis</title>
@@ -669,8 +700,257 @@ in Nix itself.</para>
 
 </refsection>
             
+
 </refsection>
 
 
+<!--######################################################################-->
+
+<refsection xml:id='refsec-nix-store-dump'><title>Operation <option>--dump</option></title>
+
+<refsection>
+  <title>Synopsis</title>
+  <cmdsynopsis>
+    <command>nix-store</command>
+    <arg choice='plain'><option>--dump</option></arg>
+    <arg choice='plain'><replaceable>path</replaceable></arg>
+  </cmdsynopsis>
+</refsection>
+
+<refsection><title>Description</title>
+            
+<para>The operation <option>--dump</option> produces a NAR (Nix
+ARchive) file containing the contents of the file system tree rooted
+at <replaceable>path</replaceable>.  The archive is written to
+standard output.</para>
+
+<para>A NAR archive is like a TAR or Zip archive, but it contains only
+the information that Nix considers important.  For instance,
+timestamps are elided because all files in the Nix store have their
+timestamp set to 0 anyway.  Likewise, all permissions are left out
+except for the execute bit, because all files in the Nix store have
+644 or 755 permission.</para>
+
+<para>Also, a NAR archive is <emphasis>canonical</emphasis>, meaning
+that “equal” paths always produce the same NAR archive.  For instance,
+directory entries are always sorted so that the actual on-disk order
+doesn’t influence the result.  This means that the cryptographic hash
+of a NAR dump of a path is usable as a fingerprint of the contents of
+the path.  Indeed, the hashes of store paths stored in Nix’s database
+(see <link linkend="refsec-nix-store-query"><literal>nix-store -q
+--hash</literal></link>) are SHA-256 hashes of the NAR dump of each
+store path.</para>
+
+<para>NAR archives support filenames of unlimited length and 64-bit
+file sizes.  They can contain regular files, directories, and symbolic
+links, but not other types of files (such as device nodes).</para>
+
+<para>A Nix archive can be unpacked using <literal>nix-store
+--restore</literal>.</para>
+
+</refsection>
+            
+
+</refsection>
+
+
+<!--######################################################################-->
+
+<refsection><title>Operation <option>--restore</option></title>
+
+<refsection>
+  <title>Synopsis</title>
+  <cmdsynopsis>
+    <command>nix-store</command>
+    <arg choice='plain'><option>--restore</option></arg>
+    <arg choice='plain'><replaceable>path</replaceable></arg>
+  </cmdsynopsis>
+</refsection>
+
+<refsection><title>Description</title>
+            
+<para>The operation <option>--restore</option> unpacks a NAR archive
+to <replaceable>path</replaceable>, which must not already exist.  The
+archive is read from standard input.</para>
+
+</refsection>
+            
+
+</refsection>
+
+
+<!--######################################################################-->
+
+<refsection xml:id='refsec-nix-store-export'><title>Operation <option>--export</option></title>
+
+<refsection>
+  <title>Synopsis</title>
+  <cmdsynopsis>
+    <command>nix-store</command>
+    <arg choice='plain'><option>--export</option></arg>
+    <arg choice='plain' rep='repeat'><replaceable>paths</replaceable></arg>
+  </cmdsynopsis>
+</refsection>
+
+<refsection><title>Description</title>
+            
+<para>The operation <option>--export</option> writes a serialisation
+of the specified store paths to standard output in a format that can
+be imported into another Nix store with <command
+linkend="refsec-nix-store-import">nix-store --import</command>.  This
+is like <command linkend="refsec-nix-store-dump">nix-store
+--dump</command>, except that the NAR archive produced by that command
+doesn’t contain the necessary meta-information to allow it to be
+imported into another Nix store (namely, the set of references of the
+path).</para>
+
+<para>This command does not produce a <emphasis>closure</emphasis> of
+the specified paths, so if a store path references other store paths
+that are missing in the target Nix store, the import will fail.  To
+copy a whole closure, do something like
+
+<screen>
+$ nix-store --export $(nix-store -qR <replaceable>paths</replaceable>) > out</screen>
+
+</para>
+
+<para>For an example of how <option>--export</option> and
+<option>--import</option> can be used, see the source of the <command
+linkend="sec-nix-copy-closure">nix-copy-closure</command>
+command.</para>
+
+</refsection>
+            
+
+</refsection>
+
+
+<!--######################################################################-->
+
+<refsection xml:id='refsec-nix-store-import'><title>Operation <option>--import</option></title>
+
+<refsection>
+  <title>Synopsis</title>
+  <cmdsynopsis>
+    <command>nix-store</command>
+    <arg choice='plain'><option>--import</option></arg>
+  </cmdsynopsis>
+</refsection>
+
+<refsection><title>Description</title>
+            
+<para>The operation <option>--export</option> reads a serialisation of
+a set of store paths produced by <command
+linkend="refsec-nix-store-export">nix-store --import</command> from
+standard input and adds those store paths to the Nix store.  Paths
+that already exist in the Nix store are ignored.  If a path refers to
+another path that doesn’t exist in the Nix store, the import
+fails.</para>
+
+</refsection>
+            
+
+</refsection>
+
+
+<!--######################################################################-->
+
+<refsection><title>Operation <option>--optimise</option></title>
+
+<refsection>
+  <title>Synopsis</title>
+  <cmdsynopsis>
+    <command>nix-store</command>
+    <arg choice='plain'><option>--optimise</option></arg>
+  </cmdsynopsis>
+</refsection>
+
+<refsection><title>Description</title>
+            
+<para>The operation <option>--optimise</option> reduces Nix store disk
+space usage by finding identical files in the store and hard-linking
+them to each other.  It typically reduces the size of the store by
+something like 25-35%.  Only regular files and symlinks are
+hard-linked in this manner.  Files are considered identical when they
+have the same NAR archive serialisation: that is, regular files must
+have the same contents and permission (executable or non-executable),
+and symlinks must have the same contents.</para>
+
+<para>After completion, or when the command is interrupted, a report
+on the achieved savings is printed on standard error.</para>
+
+<para>Use <option>-vv</option> or <option>-vvv</option> to get some
+progress indication.</para>
+
+</refsection>
+            
+<refsection><title>Example</title>
+
+<screen>
+$ nix-store --optimise
+hashing files in `/nix/store/qhqx7l2f1kmwihc9bnxs7rc159hsxnf3-gcc-4.1.1'
+<replaceable>...</replaceable>
+541838819 bytes (516.74 MiB) freed by hard-linking 54143 files;
+there are 114486 files with equal contents out of 215894 files in total
+</screen>
+
+</refsection>
+
+
+</refsection>
+
+
+<!--######################################################################-->
+
+<refsection><title>Operation <option>--read-log</option></title>
+
+<refsection>
+  <title>Synopsis</title>
+  <cmdsynopsis>
+    <command>nix-store</command>
+    <group choice='req'>
+      <arg choice='plain'><option>--read-log</option></arg>
+      <arg choice='plain'><option>-l</option></arg>
+    </group>
+    <arg choice='plain' rep='repeat'><replaceable>paths</replaceable></arg>
+  </cmdsynopsis>
+</refsection>
+
+<refsection><title>Description</title>
+            
+<para>The operation <option>--read-log</option> prints the build log
+of the specified store paths on standard output.  The build log is
+whatever the builder of a derivation wrote to standard output and
+standard error.  If a store path is not a derivation, the deriver of
+the store path is used.</para>
+
+<para>Build logs are kept in
+<filename>/nix/var/log/nix/drvs</filename>.  However, there is no
+guarantee that a build log is available for any particular store
+path.  For instance, if the path was downloaded as a pre-built binary
+through a substitute, then the log is unavailable.</para>
+
+</refsection>
+            
+<refsection><title>Example</title>
+
+<screen>
+$ nix-store -l $(which ktorrent)
+building /nix/store/dhc73pvzpnzxhdgpimsd9sw39di66ph1-ktorrent-2.2.1
+unpacking sources
+unpacking source archive /nix/store/p8n1jpqs27mgkjw07pb5269717nzf5f8-ktorrent-2.2.1.tar.gz
+ktorrent-2.2.1/
+ktorrent-2.2.1/NEWS
+<replaceable>...</replaceable>
+</screen>
+
+</refsection>
+
+
+</refsection>
+
+
+<!-- TODO: export, import operations -->
+
 
 </refentry>

doc/manual/nix-unpack-closure.xml

@@ -0,0 +1,42 @@
+<refentry xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink"
+          xmlns:xi="http://www.w3.org/2001/XInclude">
+
+<refmeta>
+  <refentrytitle>nix-unpack-closure</refentrytitle>
+  <manvolnum>1</manvolnum>
+  <refmiscinfo class="source">Nix</refmiscinfo>
+  <refmiscinfo class="version"><xi:include href="version.txt" parse="text"/></refmiscinfo>
+</refmeta>
+
+<refnamediv>
+  <refname>nix-unpack-closure</refname>
+  <refpurpose>unpack the closure of a store path created by <command>nix-pack-closure</command> into the Nix store</refpurpose>
+</refnamediv>
+
+<refsynopsisdiv>
+  <cmdsynopsis>
+    <command>nix-unpack-closure</command>
+  </cmdsynopsis>
+</refsynopsisdiv>
+
+
+<refsection><title>Description</title>
+
+<para>The command <command>nix-unpack-closure</command> unpacks the
+closure of a set of store paths created by
+<command>nix-pack-closure</command> into the local Nix store.  The
+closure is a single file read from standard input.  See the
+description of <command>nix-pack-closure</command> for details and
+examples.</para>
+
+<para>The top-level paths in the closure (i.e., the paths passed to
+the original <command>nix-pack-closure</command> call that created the
+closure) are printed on standard output.  These paths can be passed,
+for instance, to <literal>nix-env -i</literal> to install them into a
+user environment on the target machine.</para>
+
+</refsection>
+
+
+</refentry>

doc/manual/opt-common-syn.xml

@@ -1,4 +1,4 @@
-<nop>
+<nop xmlns="http://docbook.org/ns/docbook">
   
 <arg><option>--help</option></arg>
 <arg><option>--version</option></arg>
@@ -13,6 +13,10 @@
   </group>
   <replaceable>number</replaceable>
 </arg>
+<arg>
+  <arg><option>--max-silent-time</option></arg>
+  <replaceable>number</replaceable>
+</arg>
 <arg><option>--keep-going</option></arg>
 <arg><option>-k</option></arg>
 <arg><option>--keep-failed</option></arg>
@@ -20,5 +24,6 @@
 <arg><option>--fallback</option></arg>
 <arg><option>--readonly-mode</option></arg>
 <arg><option>--log-type</option> <replaceable>type</replaceable></arg>
+<sbr />
 
 </nop>

doc/manual/opt-common.xml

@@ -1,4 +1,7 @@
-<sect1 id="sec-common-options"><title>Common options</title>
+<section xmlns="http://docbook.org/ns/docbook" xml:id="sec-common-options">
+
+<title>Common options</title>
+
 
 <para>Most Nix commands accept the following command-line options:</para>
 
@@ -86,16 +89,31 @@
 </varlistentry>
 
 
-<varlistentry id="opt-max-jobs"><term><option>--max-jobs</option></term>
+<varlistentry xml:id="opt-max-jobs"><term><option>--max-jobs</option></term>
   <term><option>-j</option></term>
 
   <listitem><para>Sets the maximum number of build jobs that Nix will
-  perform in parallel to the specified number.  The default is 1.  A
-  higher value is useful on SMP systems or to exploit I/O latency.</para></listitem>
+  perform in parallel to the specified number.  The default is
+  specified by the <link
+  linkend='conf-build-max-jobs'><literal>build-max-jobs</literal></link>
+  configuration setting, which itself defaults to
+  <literal>1</literal>.  A higher value is useful on SMP systems or to
+  exploit I/O latency.  </para></listitem>
   
 </varlistentry>
 
 
+<varlistentry xml:id="opt-max-silent-time"><term><option>--max-silent-time</option></term>
+
+  <listitem><para>Sets the maximum number of seconds that a builder
+  can go without producing any data on standard output or standard
+  error.  The default is specified by the <link
+  linkend='conf-build-max-silent-time'><literal>build-max-silent-time</literal></link>
+  configuration setting.  <literal>0</literal> means no
+  time-out.</para></listitem>
+
+</varlistentry>
+
 <varlistentry><term><option>--keep-going</option></term>
   <term><option>-k</option></term>
 
@@ -155,7 +173,7 @@
 </varlistentry>
 
 
-<varlistentry id="opt-log-type"><term><option>--log-type</option>
+<varlistentry xml:id="opt-log-type"><term><option>--log-type</option>
 <replaceable>type</replaceable></term>
 
   <listitem>
@@ -187,9 +205,9 @@
     <varlistentry><term><literal>escapes</literal></term>
 
       <listitem><para>Indicate nesting using escape codes that can be
-      interpreted by the <command>log2xml</command> tool in the Nix
-      source distribution.  The resulting XML file can be fed into the
-      <command>log2html.xsl</command> stylesheet to create an HTML
+      interpreted by the <command>nix-log2xml</command> tool in the
+      Nix source distribution.  The resulting XML file can be fed into
+      the <command>log2html.xsl</command> stylesheet to create an HTML
       file that can be browsed interactively, using Javascript to
       expand and collapse parts of the output.</para></listitem>
 
@@ -210,7 +228,84 @@
 </varlistentry>
 
 
+<varlistentry><term><option>--arg</option> <replaceable>name</replaceable> <replaceable>value</replaceable></term>
+
+  <listitem><para>This option is accepted by
+  <command>nix-env</command>, <command>nix-instantiate</command> and
+  <command>nix-build</command>.  When evaluating Nix expressions, the
+  expression evaluator will automatically try to call functions that
+  it encounters.  It can automatically call functions for which every
+  argument has a <link linkend='ss-functions'>default value</link>
+  (e.g., <literal>{<replaceable>argName</replaceable> ?
+  <replaceable>defaultValue</replaceable>}:
+  <replaceable>...</replaceable></literal>).  With
+  <option>--arg</option>, you can also call functions that have
+  arguments without a default value (or override a default value).
+  That is, if the evaluator encounters a function with an argument
+  named <replaceable>name</replaceable>, it will call it with value
+  <replaceable>value</replaceable>.</para>
+
+  <para>For instance, the file
+  <literal>pkgs/top-level/all-packages.nix</literal> in Nixpkgs is
+  actually a function:
+
+<programlisting>
+{ # The system (e.g., `i686-linux') for which to build the packages.
+  system ? __currentSystem
+  <replaceable>...</replaceable>
+}: <replaceable>...</replaceable></programlisting>
+
+  So if you call this Nix expression (e.g., when you do
+  <literal>nix-env -i <replaceable>pkgname</replaceable></literal>),
+  the function will be called automatically using the value <link
+  linkend='builtin-currentSystem'><literal>__currentSystem</literal></link>
+  for the <literal>system</literal> argument.  You can override this
+  using <option>--arg</option>, e.g., <literal>nix-env -i
+  <replaceable>pkgname</replaceable> --arg system
+  \"i686-freebsd\"</literal>.  (Note that since the argument is a Nix
+  string literal, you have to escape the quotes.)</para></listitem>
+
+</varlistentry>
+
+
+<varlistentry><term><option>--argstr</option> <replaceable>name</replaceable> <replaceable>value</replaceable></term>
+
+  <listitem><para>This option is like <option>--arg</option>, only the
+  value is not a Nix expression but a string.  So instead of
+  <literal>--arg system \"i686-linux\"</literal> (the outer quotes are
+  to keep the shell happy) you can say <literal>--argstr system
+  i686-linux</literal>.</para></listitem>
+
+</varlistentry>
+
+
+<varlistentry xml:id="opt-attr"><term><option>--attr</option> / <option>-A</option>
+<replaceable>attrPath</replaceable></term>
+
+  <listitem><para>In <command>nix-env</command>,
+  <command>nix-instantiate</command> and <command>nix-build</command>,
+  <option>--attr</option> allows you to select an attribute from the
+  top-level Nix expression being evaluated.  The <emphasis>attribute
+  path</emphasis> <replaceable>attrPath</replaceable> is a sequence of
+  attribute names separated by dots.  For instance, given a top-level
+  Nix expression <replaceable>e</replaceable>, the attribute path
+  <literal>xorg.xorgserver</literal> would cause the expression
+  <literal><replaceable>e</replaceable>.xorg.xorgserver</literal> to
+  be used.  See <link
+  linkend='refsec-nix-env-install-examples'><command>nix-env
+  --install</command></link> for some concrete examples.</para>
+
+  <para>In addition to attribute names, you can also specify array
+  indices.  For instance, the attribute path
+  <literal>foo.3.bar</literal> selects the <literal>bar</literal>
+  attribute of the fourth element of the array in the
+  <literal>foo</literal> attribute of the top-level
+  expression.</para></listitem>
+
+</varlistentry>
+
+
 </variablelist>
 
 
-</sect1>
+</section>

doc/manual/opt-inst-syn.xml

@@ -0,0 +1,22 @@
+<nop xmlns="http://docbook.org/ns/docbook">
+  
+  <arg>
+    <group choice='req'>
+      <arg choice='plain'><option>--prebuilt-only</option></arg>
+      <arg choice='plain'><option>-b</option></arg>
+    </group>
+  </arg>
+  
+  <arg>
+    <group choice='req'>
+      <arg choice='plain'><option>--attr</option></arg>
+      <arg choice='plain'><option>-A</option></arg>
+    </group>
+  </arg>
+
+  <arg><option>--from-expression</option></arg>
+  <arg><option>-E</option></arg>
+    
+  <arg><option>--from-profile</option> <replaceable>path</replaceable></arg>
+
+</nop>

doc/manual/package-management.xml

@@ -1,18 +1,23 @@
-<chapter id='chap-package-management'><title>Package Management</title>
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id='chap-package-management'>
+
+<title>Package Management</title>
+
 
 <para>This chapter discusses how to do package management with Nix,
-i.e., how to obtain, install, upgrade, and erase components.  This is
+i.e., how to obtain, install, upgrade, and erase packages.  This is
 the “user’s” perspective of the Nix system — people
-who want to <emphasis>create</emphasis> components should consult
+who want to <emphasis>create</emphasis> packages should consult
 <xref linkend='chap-writing-nix-expressions' />.</para>
 
 
-<sect1><title>Basic package management</title>
+<section><title>Basic package management</title>
 
 <para>The main command for package management is <link
 linkend="sec-nix-env"><command>nix-env</command></link>.  You can use
-it to install, upgrade, and erase components, and to query what
-components are installed or are available for installation.</para>
+it to install, upgrade, and erase packages, and to query what
+packages are installed or are available for installation.</para>
 
 <para>In Nix, different users can have different “views”
 on the set of installed applications.  That is, there might be lots of
@@ -25,21 +30,21 @@ environment</emphasis>, which is just a directory tree consisting of
 symlinks to the files of the active applications.  </para>
 
 <para>Components are installed from a set of <emphasis>Nix
-expressions</emphasis> that tell Nix how to build those components,
+expressions</emphasis> that tell Nix how to build those packages,
 including, if necessary, their dependencies.  There is a collection of
 Nix expressions called the Nix Package collection that contains
-components ranging from basic development stuff such as GCC and Glibc,
+packages ranging from basic development stuff such as GCC and Glibc,
 to end-user applications like Mozilla Firefox.  (Nix is however not
 tied to the Nix Package collection; you could write your own Nix
 expressions based on it, or completely new ones.)  You can download
-the latest version from <ulink
-url='http://catamaran.labs.cs.uu.nl/dist/nix' />.</para>
+the latest version from <link
+xlink:href='http://nix.cs.uu.nl/dist/nix' />.</para>
 
 <para>Assuming that you have downloaded and unpacked a release of Nix
-Packages, you can view the set of available components in the release:
+Packages, you can view the set of available packages in the release:
 
 <screen>
-$ nix-env -qaf nixpkgs-<replaceable>version</replaceable>
+$ nix-env -qaf nixpkgs-<replaceable>version</replaceable> '*'
 ant-blackdown-1.4.2
 aterm-2.2
 bash-3.0
@@ -50,14 +55,30 @@ bzip2-1.0.2
 ...</screen>
 
 where <literal>nixpkgs-<replaceable>version</replaceable></literal> is
-where you’ve unpacked the release.</para>
+where you’ve unpacked the release.  The flag <option>-q</option>
+specifies a query operation; <option>-a</option> means that you want
+to show the “available” (i.e., installable) packages, as opposed to
+the installed packages; and <option>-f</option>
+<filename>nixpkgs-<replaceable>version</replaceable></filename>
+specifies the source of the packages.  The argument
+<literal>'*'</literal> shows all installable packages. (The quotes are
+necessary to prevent shell expansion.)  You can also select specific
+packages by name:
+
+<screen>
+$ nix-env -qaf nixpkgs-<replaceable>version</replaceable> gcc
+gcc-3.4.6
+gcc-4.0.3
+gcc-4.1.1</screen>
+
+</para>
 
 <para>It is also possible to see the <emphasis>status</emphasis> of
-available components, i.e., whether they are installed into the user
+available packages, i.e., whether they are installed into the user
 environment and/or present in the system:
 
 <screen>
-$ nix-env -qasf nixpkgs-<replaceable>version</replaceable>
+$ nix-env -qasf nixpkgs-<replaceable>version</replaceable> '*'
 ...
 -PS bash-3.0
 --S binutils-2.15
@@ -65,49 +86,48 @@ IPS bison-1.875d
 ...</screen>
 
 The first character (<literal>I</literal>) indicates whether the
-component is installed in your current user environment.  The second
+package is installed in your current user environment.  The second
 (<literal>P</literal>) indicates whether it is present on your system
 (in which case installing it into your user environment would be a
 very quick operation).  The last one (<literal>S</literal>) indicates
 whether there is a so-called <emphasis>substitute</emphasis> for the
-component, which is Nix’s mechanism for doing binary deployment.  It
-just means that Nix know that it can fetch a pre-built component from
+package, which is Nix’s mechanism for doing binary deployment.  It
+just means that Nix knows that it can fetch a pre-built package from
 somewhere (typically a network server) instead of building it
 locally.</para>
 
 <para>So now that we have a set of Nix expressions we can build the
-components contained in them.  This is done using <literal>nix-env
+packages contained in them.  This is done using <literal>nix-env
 -i</literal>.  For instance,
 
 <screen>
 $ nix-env -f nixpkgs-<replaceable>version</replaceable> -i subversion</screen>
 
-will install the component called <literal>subversion</literal> (which
-is, of course, the <ulink
-url='http://subversion.tigris.org/'>Subversion version management
-system</ulink>).</para>
+will install the package called <literal>subversion</literal> (which
+is, of course, the <link
+xlink:href='http://subversion.tigris.org/'>Subversion version
+management system</link>).</para>
 
 <para>When you do this for the first time, Nix will start building
 Subversion and all its dependencies.  This will take quite a while —
 typically an hour or two on modern machines.  Fortunately, there is a
 faster way (so do a Ctrl-C on that install operation!): you just need
-to tell Nix that pre-built binaries of all those components are
+to tell Nix that pre-built binaries of all those packages are
 available somewhere.  This is done using the
 <command>nix-pull</command> command, which must be supplied with a URL
 containing a <emphasis>manifest</emphasis> describing what binaries
 are available.  This URL should correspond to the Nix Packages release
-that you’re using.  For instance, if you obtained a release from
-<ulink
-url='http://catamaran.labs.cs.uu.nl/dist/nix/nixpkgs-0.6pre1554/' />,
-then you should do:
+that you’re using.  For instance, if you obtained a release from <link
+xlink:href='http://nix.cs.uu.nl/dist/nix/nixpkgs-0.6pre1554/' />, then
+you should do:
 
 <screen>
-$ nix-pull http://catamaran.labs.cs.uu.nl/dist/nix/nixpkgs-0.6pre1554/MANIFEST</screen>
+$ nix-pull http://nix.cs.uu.nl/dist/nix/nixpkgs-0.6pre1554/MANIFEST</screen>
 
 If you then issue the installation command, it should start
 downloading binaries from <systemitem
-class='fqdomainname'>catamaran.labs.cs.uu.nl</systemitem>, instead of
-building them from source.  This might still take a while since all
+class='fqdomainname'>nix.cs.uu.nl</systemitem>, instead of building
+them from source.  This might still take a while since all
 dependencies must be downloaded, but on a reasonably fast connection
 such as an DSL line it’s on the order of a few minutes.</para>
 
@@ -133,7 +153,7 @@ expressions, use <parameter>-i</parameter> instead of
 <parameter>-u</parameter>; <parameter>-i</parameter> will remove
 whatever version is already installed.</para>
 
-<para>You can also upgrade all components for which there are newer
+<para>You can also upgrade all packages for which there are newer
 versions:
 
 <screen>
@@ -170,33 +190,33 @@ since <literal>nix-channel --update</literal> calls <literal>nix-env
 from the channel, replacing whatever default you had
 set.</para></footnote></para>
 
-</sect1>
+</section>
 
 
-<sect1 id="sec-profiles"><title>Profiles</title>
+<section xml:id="sec-profiles"><title>Profiles</title>
 
 <para>Profiles and user environments are Nix’s mechanism for
-implementing the ability to allow differens users to have different
+implementing the ability to allow different users to have different
 configurations, and to do atomic upgrades and rollbacks.  To
 understand how they work, it’s useful to know a bit about how Nix
-works.  In Nix, components are stored in unique locations in the
+works.  In Nix, packages are stored in unique locations in the
 <emphasis>Nix store</emphasis> (typically,
 <filename>/nix/store</filename>).  For instance, a particular version
-of the Subversion component might be stored in a directory
+of the Subversion package might be stored in a directory
 <filename>/nix/store/dpmvp969yhdqs7lm2r1a3gng7pyq6vy4-subversion-1.1.3/</filename>,
 while another version might be stored in
 <filename>/nix/store/5mq2jcn36ldlmh93yj1n8s9c95pj7c5s-subversion-1.1.2</filename>.
 The long strings prefixed to the directory names are cryptographic
 hashes<footnote><para>160-bit truncations of SHA-256 hashes encoded in
 a base-32 notation, to be precise.</para></footnote> of
-<emphasis>all</emphasis> inputs involved in building the component —
+<emphasis>all</emphasis> inputs involved in building the package —
 sources, dependencies, compiler flags, and so on.  So if two
-components differ in any way, they end up in different locations in
+packages differ in any way, they end up in different locations in
 the file system, so they don’t interfere with each other.  <xref
 linkend='fig-user-environments' /> shows a part of a typical Nix
 store.</para>
 
-<figure id='fig-user-environments'><title>User environments</title>
+<figure xml:id='fig-user-environments'><title>User environments</title>
   <mediaobject>
     <imageobject>
       <imagedata fileref='figures/user-environments.png' format='PNG' />
@@ -211,12 +231,12 @@ $ /nix/store/dpmvp969yhdq...-subversion-1.1.3/bin/svn</screen>
 
 every time you want to run Subversion.  Of course we could set up the
 <envar>PATH</envar> environment variable to include the
-<filename>bin</filename> directory of every component we want to use,
+<filename>bin</filename> directory of every package we want to use,
 but this is not very convenient since changing <envar>PATH</envar>
 doesn’t take effect for already existing processes.  The solution Nix
 uses is to create directory trees of symlinks to
-<emphasis>activated</emphasis> components.  These are called
-<emphasis>user environments</emphasis> and they are components
+<emphasis>activated</emphasis> packages.  These are called
+<emphasis>user environments</emphasis> and they are packages
 themselves (though automatically generated by
 <command>nix-env</command>), so they too reside in the Nix store.  For
 instance, in <xref linkend='fig-user-environments' /> the user
@@ -265,8 +285,8 @@ operation, a new user environment and generation link are created
 based on the current one, and finally the <filename>default</filename>
 symlink is made to point at the new generation.  This last step is
 atomic on Unix, which explains how we can do atomic upgrades.  (Note
-that the building/installing of new components doesn’t interfere in
-any way with old components, since they are stored in different
+that the building/installing of new packages doesn’t interfere in
+any way with old packages, since they are stored in different
 locations in the Nix store.)</para>
 
 <para>If you find that you want to undo a <command>nix-env</command>
@@ -325,25 +345,25 @@ $ nix-env -p /nix/var/nix/profiles/other-profile -i subversion</screen>
 This will <emphasis>not</emphasis> change the
 <command>~/.nix-profile</command> symlink.</para>
 
-</sect1>
+</section>
 
 
-<sect1 id='sec-garbage-collection'><title>Garbage collection</title>
+<section xml:id='sec-garbage-collection'><title>Garbage collection</title>
 
 <para><command>nix-env</command> operations such as upgrades
 (<option>-u</option>) and uninstall (<option>-e</option>) never
-actually delete components from the system.  All they do (as shown
+actually delete packages from the system.  All they do (as shown
 above) is to create a new user environment that no longer contains
-symlinks to the “deleted” components.</para>
+symlinks to the “deleted” packages.</para>
 
-<para>Of course, since disk space is not infinite, unused components
+<para>Of course, since disk space is not infinite, unused packages
 should be removed at some point.  You can do this by running the Nix
-garbage collector.  It will remove from the Nix store any component
+garbage collector.  It will remove from the Nix store any package
 not used (directly or indirectly) by any generation of any
 profile.</para>
 
 <para>Note however that as long as old generations reference a
-component, it will not be deleted.  After all, we wouldn’t be able to
+package, it will not be deleted.  After all, we wouldn’t be able to
 do a rollback otherwise.  So in order for garbage collection to be
 effective, you should also delete (some) old generations.  Of course,
 this should only be done if you are certain that you will not need to
@@ -378,8 +398,21 @@ $ nix-store --gc --print-dead</screen>
 Likewise, the option <option>--print-live</option> will show the paths
 that <emphasis>won’t</emphasis> be deleted.</para>
 
+<para>There is also a convenient little utility
+<command>nix-collect-garbage</command>, which when invoked with the
+<option>-d</option> (<option>--delete-old</option>) switch deletes all
+old generations of all profiles in
+<filename>/nix/var/nix/profiles</filename>.  So
 
-<sect2 id="ssec-gc-roots"><title>Garbage collector roots</title>
+<screen>
+$ nix-collect-garbage -d</screen>
+
+is a quick and easy way to clean up your system.</para>
+
+
+
+
+<section xml:id="ssec-gc-roots"><title>Garbage collector roots</title>
 
 <para>The roots of the garbage collector are all store paths to which
 there are symlinks in the directory
@@ -401,12 +434,12 @@ followed and searched for roots, but symlinks to non-store paths
 <emphasis>inside</emphasis> the paths reached in that way are not
 followed to prevent infinite recursion.</para>
 
-</sect2>
+</section>
 
-</sect1>
+</section>
 
 
-<sect1 id="sec-channels"><title>Channels</title>
+<section xml:id="sec-channels"><title>Channels</title>
 
 <para>If you want to stay up to date with a set of packages, it’s not
 very convenient to manually download the latest set of Nix expressions
@@ -425,7 +458,7 @@ URL.</para>
 <command>nix-channel --add</command>, e.g.,
 
 <screen>
-$ nix-channel --add http://catamaran.labs.cs.uu.nl/dist/nix/channels/nixpkgs-unstable</screen>
+$ nix-channel --add http://nix.cs.uu.nl/dist/nix/channels-v3/nixpkgs-unstable</screen>
 
 subscribes you to a channel that always contains that latest version
 of the Nix Packages collection.  (Instead of
@@ -453,10 +486,47 @@ makes the union of each channel’s Nix expressions the default for
 <screen>
 $ nix-env -u '*'</screen>
 
-to upgrade all components in your profile to the latest versions
+to upgrade all packages in your profile to the latest versions
 available in the subscribed channels.</para>
 
-</sect1>
+</section>
+
+
+<section xml:id="sec-one-click"><title>One-click installs</title>
+
+<para>Often, when you want to install a specific package (e.g., from
+the <link
+xlink:href="http://nix.cs.uu.nl/dist/nix/nixpkgs-unstable-latest/">Nix
+Packages collection</link> or from our <link
+xlink:href='http://nix.cs.uu.nl/dist/'>release server</link>),
+subscribing to a channel is a bit cumbersome.  And channels don’t help
+you at all if you want to install an older version of a package than
+the one provided by the current contents of the channel, or a package
+that has been removed from the channel.  That’s when
+<emphasis>one-click installs</emphasis> come in handy: you can just go
+to the web page that contains the package, click on it, and it will be
+installed with all the necessary dependencies.</para>
+
+<para>For instance, you can go to <link
+xlink:href="http://nix.cs.uu.nl/dist/nix/nixpkgs-unstable-latest/" />
+— or to any older release of Nix Packages — and click on any link for
+the individual packages for your platform (say, <link
+xlink:href='http://nix.cs.uu.nl/dist/nix/nixpkgs-0.10pre6622/pkgs/subversion-1.4.0-i686-linux.nixpkg'><literal>subversion-1.4.0</literal>
+for <literal>i686-linux</literal></link>).  The first time you do
+this, your browser will ask what to do with
+<literal>application/nix-package</literal> files.  You should open
+them with <filename>/nix/bin/nix-install-package</filename>.  This
+will open a window that asks you to confirm that you want to install
+the package.  When you answer <literal>Y</literal>, the package and
+all its dependencies will be installed.  This is a binary deployment
+mechanism — you get packages pre-compiled for the selected platform
+type.</para>
+
+<para>You can also install <literal>application/nix-package</literal>
+files from the command line directly.  See <xref
+linkend='sec-nix-install-package' /> for details.</para>
+
+</section>
 
 
 </chapter>

doc/manual/quick-start.xml

@@ -1,4 +1,8 @@
-<chapter><title>Quick Start</title>
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink">
+
+<title>Quick Start</title>
+
 
 <para>This chapter is for impatient people who don't like reading
 documentation.  For more in-depth information you are kindly referred
@@ -6,8 +10,8 @@ to the following chapters.</para>
 
 <orderedlist>
 
-<listitem><para>Download a source tarball or RPM from <ulink
-url='http://www.cs.uu.nl/groups/ST/Trace/Nix'/>.  Build source
+<listitem><para>Download a source tarball or RPM from <link
+xlink:href='http://nix.cs.uu.nl/'/>.  Build source
 distributions using the regular sequence:
         
 <screen>
@@ -18,8 +22,9 @@ $ make install <lineannotation>(as root)</lineannotation></screen>
 
 This will install Nix in <filename>/nix</filename>.  You shouldn't
 change the prefix if at all possible since that will make it
-impossible to use our pre-built components.  Alternatively, you could
-grab an RPM if you're on an RPM-based system.  You should also add
+impossible to use pre-built binaries from the Nixpkgs channel and
+other channels.  Alternatively, you could grab an RPM if you're on an
+RPM-based system.  You should also add
 <filename>/nix/etc/profile.d/nix.sh</filename> to your
 <filename>~/.bashrc</filename> (or some other login
 file).</para></listitem>
@@ -27,7 +32,8 @@ file).</para></listitem>
 <listitem><para>Subscribe to the Nix Packages channel.
 
 <screen>
-$ nix-channel --add http://catamaran.labs.cs.uu.nl/dist/nix/channels/nixpkgs-unstable</screen>
+$ nix-channel --add \
+    http://nix.cs.uu.nl/dist/nix/channels-v3/nixpkgs-unstable</screen>
 
 </para></listitem>
 
@@ -35,17 +41,17 @@ $ nix-channel --add http://catamaran.labs.cs.uu.nl/dist/nix/channels/nixpkgs-uns
 <screen>
 $ nix-channel --update</screen>
 
-Note that this in itself doesn't download any components, it just
+Note that this in itself doesn't download any packages, it just
 downloads the Nix expressions that build them and stores them
 somewhere (under <filename>~/.nix-defexpr</filename>, in case you're
 curious).  Also, it registers the fact that pre-built binaries are
 available remotely.</para></listitem>
 
-<listitem><para>See what installable components are currently
-available in the channel:
+<listitem><para>See what installable packages are currently available
+in the channel:
 
 <screen>
-$ nix-env -qa
+$ nix-env -qa ’*’ <lineannotation>(mind the quotes!)</lineannotation>
 docbook-xml-4.2
 firefox-1.0pre-PR-0.10.1
 hello-2.1.1
@@ -54,13 +60,13 @@ libxslt-1.1.0
 
 </para></listitem>
 
-<listitem><para>Install some components from the channel:
+<listitem><para>Install some packages from the channel:
         
 <screen>
 $ nix-env -i hello firefox <replaceable>...</replaceable> </screen>
 
-This should download the pre-built components; it should not build
-them locally (if it does, something went wrong).</para></listitem>
+This should download pre-built packages; it should not build them
+locally (if it does, something went wrong).</para></listitem>
 
 <listitem><para>Test that they work:
 
@@ -87,12 +93,22 @@ $ nix-env -e hello</screen>
 $ nix-channel --update
 $ nix-env -u '*'</screen>
 
-The latter command will upgrade each installed component for which
-there is a “newer” version (as determined by comparing the version
+The latter command will upgrade each installed package for which there
+is a “newer” version (as determined by comparing the version
 numbers).</para></listitem>
 
+<listitem><para>You can also install specific packages directly from
+your web browser.  For instance, you can go to <link
+xlink:href="http://nix.cs.uu.nl/dist/nix/nixpkgs-unstable-latest/" />
+and click on any link for the individual packages for your platform.
+Associate <literal>application/nix-package</literal> with the program
+<filename>/nix/bin/nix-install-package</filename>.  A window should
+appear asking you whether it’s okay to install the package.  Say
+<literal>Y</literal>.  The package and all its dependencies will be
+installed.</para></listitem>
+
 <listitem><para>If you're unhappy with the result of a
-<command>nix-env</command> action (e.g., an upgraded component turned
+<command>nix-env</command> action (e.g., an upgraded package turned
 out not to work properly), you can go back:
 
 <screen>
@@ -105,13 +121,15 @@ to get rid of unused packages, since uninstalls or upgrades don't
 actually delete them:
 
 <screen>
-$ nix-env --delete-generations old
-$ nix-store --gc</screen>
+$ nix-collect-garbage -d</screen>
 
+<!--
 The first command deletes old “generations” of your profile (making
-rollbacks impossible, but also making the components in those old
+rollbacks impossible, but also making the packages in those old
 generations available for garbage collection), while the second
-command actually deletes them.</para></listitem>
+command actually deletes them.-->
+
+</para></listitem>
 
 </orderedlist>
 

doc/manual/quote-literals.xsl

@@ -0,0 +1,44 @@
+<?xml version="1.0"?>
+
+<xsl:stylesheet
+  version="1.0"
+  xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+  xmlns:str="http://exslt.org/strings"
+  extension-element-prefixes="str">
+
+  <xsl:output method="xml"/>
+  
+  <xsl:template match="function|command|literal|varname|filename|option|quote">`<xsl:apply-templates/>'</xsl:template>
+  
+  <xsl:template match="token"><xsl:text>    </xsl:text><xsl:apply-templates /><xsl:text>
+</xsl:text></xsl:template>
+
+  <xsl:template match="screen|programlisting">
+    <screen><xsl:apply-templates select="str:split(., '&#xA;')" /></screen>
+  </xsl:template>
+
+  <xsl:template match="section[following::section]">
+    <section>
+      <xsl:apply-templates />
+      <screen><xsl:text>
+      </xsl:text></screen>        
+    </section>
+  </xsl:template>
+
+  <xsl:template match="*">
+    <xsl:element name="{name(.)}" namespace="{namespace-uri(.)}">
+      <xsl:copy-of select="namespace::*" />
+      <xsl:for-each select="@*">
+	<xsl:attribute name="{name(.)}" namespace="{namespace-uri(.)}">
+	  <xsl:value-of select="."/>
+	</xsl:attribute>
+      </xsl:for-each>
+      <xsl:apply-templates/>
+    </xsl:element>
+  </xsl:template>
+
+  <xsl:template match="text()">
+    <xsl:value-of select="translate(., '‘’“”—', concat(&quot;`'&quot;, '&quot;&quot;-'))" />
+  </xsl:template>
+  
+</xsl:stylesheet>

doc/manual/style.css

@@ -10,7 +10,6 @@ body
 {
     font-family: sans-serif;
     background: white;
-  
     margin: 2em 1em 2em 1em;
 }
 
@@ -34,16 +33,33 @@ h2 /* chapters, appendices, subtitle */
 div.chapter > div.titlepage h2, div.appendix > div.titlepage h2 
 { 
     margin-top: 1.5em;
-/*    border-top: solid #005aa0; */
 }
 
-div.sect1 h2 /* sections */
+div.section > div.titlepage h2 /* sections */
 {
     font-size: 150%;
+    margin-top: 1.5em;
+}
+
+h3 /* subsections */
+{
+    font-size: 125%;
+}
+
+div.simplesect h2
+{
+    font-size: 110%;
+}
+
+div.appendix h3
+{
+    font-size: 150%;
+    margin-top: 1.5em;
 }
 
 div.refnamediv h2, div.refsynopsisdiv h2, div.refsection h2 /* refentry parts */
 {
+    margin-top: 1.4em;
     font-size: 125%;
 }
 
@@ -52,30 +68,23 @@ div.refsection h3
     font-size: 110%;
 }
 
-h3 /* subsections */
-{
-    font-size: 125%;
-}
-
-
 
 /***************************************************************************
-                               Program listings:
+                               Examples:
  ***************************************************************************/
 
 div.example
 {
     border: 1px solid #6185a0;
     padding: 6px 6px;
-    margin-left: 3em;
-    margin-right: 3em;
-    background: #eeeeee;
+    margin-left: 1.5em;
+    margin-right: 1.5em;
+    background: #f4f4f8;
 }
 
-pre.programlisting
+div.example p.title
 {
-    color: #600000;
-    font-family: monospace;
+    margin-top: 0em;
 }
 
 
@@ -83,41 +92,63 @@ pre.programlisting
                             Screen dumps:
  ***************************************************************************/
 
-pre.screen
+pre.screen, pre.programlisting
 {
     border: 1px solid #6185a0;
-    padding: 6px 6px;
-    margin-left: 3em;
-    margin-right: 3em;
+    padding: 3px 3px;
+    margin-left: 1.5em;
+    margin-right: 1.5em;
     color: #600000;
-    background: #eeeeee;
+    background: #f4f4f8;
     font-family: monospace;
     /* font-size: 90%; */
 }
 
+div.example pre.programlisting
+{
+    border: 0px;
+    padding: 0 0;
+    margin: 0 0 0 0;
+}
+
 
 /***************************************************************************
                                Notes, warnings etc:
  ***************************************************************************/
 
-.note,.warning
+.note, .warning
 {
-    margin-top: 1em;
-    margin-bottom: 1em;
     border: 1px solid #6185a0;
-    padding: 0px 1em;
+    padding: 3px 3px;
+    margin-left: 1.5em;
+    margin-right: 1.5em;
+    margin-bottom: 1em;
+    padding: 0.3em 0.3em 0.3em 0.3em;
     background: #fffff5;
 }
 
-div.note,div.warning
+div.note, div.warning
 {
     font-style: italic;
 }
 
-div.warning h3
+div.note h3, div.warning h3
 {
     color: red;
     font-size: 100%;
+//    margin: 0 0 0 0;
+    padding-right: 0.5em;
+    display: inline;
+}
+
+div.note p, div.warning p
+{
+    margin-bottom: 0em;
+}
+
+div.note h3 + p, div.warning h3 + p
+{
+    display: inline;
 }
 
 div.note h3
@@ -167,9 +198,19 @@ tt, code
     
 }
 
-div.variablelist dd
+div.variablelist dd p, div.glosslist dd p
 {
-    margin-bottom: 1em;
+    margin-top: 0em;
+}
+
+div.variablelist dd, div.glosslist dd
+{
+    margin-left: 1.5em;
+}
+
+div.glosslist dt
+{
+    font-style: italic;
 }
 
 .default
@@ -232,3 +273,16 @@ table.productionset table.productionset
 {
     font-family: monospace;
 }
+
+strong.command
+{
+//    font-family: monospace;
+//    font-style: italic;
+//    font-weight: normal;
+    color: #400000;
+}
+
+div.calloutlist td
+{
+    padding-bottom: 1em;
+}

doc/manual/troubleshooting.xml

@@ -1,9 +1,15 @@
-<appendix><title>Troubleshooting</title>
+<appendix xmlns="http://docbook.org/ns/docbook"
+          xmlns:xlink="http://www.w3.org/1999/xlink">
 
-<para>This section provides solutions for some common problems.</para>
+<title>Troubleshooting</title>
 
 
-<sect1><title>Berkeley DB: <quote>Cannot allocate memory</quote></title>
+<para>This section provides solutions for some common problems.  See
+the <link xlink:href="https://bugs.cs.uu.nl/browse/NIX">Nix
+bug tracker</link> for a list of currently known issues.</para>
+
+
+<section><title>Berkeley DB: <quote>Cannot allocate memory</quote></title>
 
 <para>Symptom: Nix operations (in particular the
 <command>nix-store</command> operations <option>--gc</option>,
@@ -26,10 +32,95 @@ $ rm __db.00*</screen>
 
 </para>
 
-</sect1>
+</section>
 
 
-<sect1><title>Collisions in <command>nix-env</command></title>
+<section><title>Berkeley DB gives weird error messages</title>
+
+<para>Symptom: you get error messages such as
+
+<screen>
+Berkeley DB message: Finding last valid log LSN: file: 1 offset 28
+Berkeley DB error: file validpaths (meta pgno = 0) has LSN [483][34721].
+Berkeley DB error: end of log is [1][28]
+Berkeley DB error: /nix/var/nix/db/validpaths: unexpected file type or format</screen>
+
+or other weird Berkeley DB errors, and they don’t go away (i.e.,
+automatic recovery doesn’t work).  This may be the case after a system
+crash.</para>
+
+<para>Solution: first try to run <command>db_recover</command> and
+then <link linkend='refsec-nix-store-verify'><command>nix-store
+--verify</command></link>:
+
+<screen>
+$ db_recover -h /nix/var/nix/db
+$ nix-store --verify</screen>
+
+(Make sure that you have the right version of
+<command>db_recover</command>, namely, Berkeley DB 4.4 for Nix 0.10,
+and 4.5 for Nix 0.11.)</para>
+
+<para>If that doesn’t work, it’s time to bring out the big guns:
+
+<screen>
+$ cd /nix/var/nix
+$ cp -pr db db-backup  <lineannotation>(making a backup just in case)</lineannotation>
+$ cd db
+$ rm __db.* log*  <lineannotation>(removing the Berkeley DB environment)</lineannotation>
+$ mkdir tmp
+$ for i in *; do db_dump $i | (cd tmp &amp;&amp; db_load $i); done 
+<lineannotation>(ignore error messages about non-database files like “reserved”)</lineannotation>
+$ mv tmp/* .
+$ nix-store --verify</screen>
+
+</para>
+
+</section>
+
+
+<section><title>Berkeley DB out of locks</title>
+
+<para>It is possible, especially in <command>nix-store
+--verify</command> or when running the garbage collector, to run out
+of Berkeley DB locks, like this:
+
+<screen>
+$ nix-store --verify
+checking path existence
+checking path realisability
+checking the derivers table
+checking the references table
+Berkeley DB error: Lock table is out of available object entries
+error: Db::get: Cannot allocate memory</screen>
+
+</para>
+
+<para>A workaround is to increase the number of locks that Berkeley DB
+allocates.  (The real solution would be for Nix to not use so many
+locks.)  This can be done by putting the following in the file
+<filename>/nix/var/nix/db/<link
+xlink:href="http://www.oracle.com/technology/documentation/berkeley-db/db/ref/env/db_config.html">DB_CONFIG</link></filename>:
+
+<programlisting>
+set_lk_max_locks   100000
+set_lk_max_lockers 100000
+set_lk_max_objects 100000
+</programlisting>
+
+(Increase these numbers if necessary.)  Then make sure that there are
+no running Nix processes and delete the Berkeley DB environment:
+
+<screen>
+$ rm /nix/var/nix/db/__db.*</screen>
+
+The Berkeley DB environment is automatically recreated with the new
+limits when you run any Nix command.</para>
+
+</section>
+
+
+<section><title>Collisions in <command>nix-env</command></title>
 
 <para>Symptom: when installing or upgrading, you get an error message such as
 
@@ -55,7 +146,7 @@ so it just gives up.</para>
 
 <para>Solution: remove one of the offending packages from the user
 environment (if already installed) using <command>nix-env
--u</command>, or specify exactly which version should be installed
+-e</command>, or specify exactly which version should be installed
 (e.g., <literal>nix-env -i docbook-xml-4.2</literal>).</para>
 
 <para>Alternatively, you can modify the user environment builder
@@ -65,7 +156,47 @@ to implement some conflict resolution policy.  E.g., the script could
 be modified to rename conflicting file names, or to pick one over the
 other.</para>
 
-</sect1>
+</section>
+
+
+<section><title><quote>Too many links</quote> error in the Nix
+store</title>
+
+
+<para>Symptom: when building something, you get an error message such as
+
+<screen>
+...
+<literal>mkdir: cannot create directory `/nix/store/<replaceable>name</replaceable>': Too many links</literal></screen>
+
+</para>
+
+<para>This is usually because you have more than 32,000 subdirectories
+in <filename>/nix/store</filename>, as can be seen using <command>ls
+-l</command>:
+
+<screen>
+$ ls -l /nix/store
+drwxrwxrwt 32000 nix nix 4620288 Sep 8 15:08 store</screen>
+
+The <literal>ext2</literal> file system is limited to a inode link
+count of 32,000 (each subdirectory increasing the count by one).
+Furthermore, the <literal>st_nlink</literal> field of the
+<function>stat</function> system call is a 16-bit value.</para>
+
+<para>This only happens on very large Nix installations (such as build
+machines).</para>
+
+<para>Quick solution: run the garbage collector.</para>
+
+<para>Real solution: put the Nix store on a file system that supports
+more than 32,000 subdirectories per directory, such as ReiserFS.
+(This doesn’t solve the <literal>st_nlink</literal> limit, but
+ReiserFS lies to the kernel by reporting a link count of 1 if it
+exceeds the limit.)</para>
+
+</section>
+  
 
 
 </appendix>

doc/signing.txt

@@ -0,0 +1,24 @@
+Generate a private key:
+
+$ (umask 277 && openssl genrsa -out /nix/etc/nix/signing-key.sec 2048)
+
+The private key should be kept secret (only readable to the Nix daemon
+user).
+
+
+Generate the corresponding public key:
+
+$ openssl rsa -in /nix/etc/nix/signing-key.sec -pubout > /nix/etc/nix/signing-key.pub
+
+The public key should be copied to all machines to which you want to
+export store paths.
+
+
+Signing:
+
+$ nix-hash --type sha256 --flat svn.nar | openssl rsautl -sign -inkey mykey.sec > svn.nar.sign
+
+
+Verifying a signature:
+
+$ test "$(nix-hash --type sha256 --flat svn.nar)" = "$(openssl rsautl -verify -inkey mykey.pub -pubin -in svn.nar.sign)"

externals/Makefile.am

@@ -1,16 +1,17 @@
 # Berkeley DB
 
-DB = db-4.3.28.NC
+DB = db-4.5.20
 
 $(DB).tar.gz:
 	@echo "Nix requires Berkeley DB to build."
-	@echo "Please download version 4.3.28 from"
-	@echo "  http://downloads.sleepycat.com/db-4.3.28.NC.tar.gz"
+	@echo "Please download version 4.5.20 from"
+	@echo "  http://download-east.oracle.com/berkeley-db/db-4.5.20.tar.gz"
 	@echo "and place it in the externals/ directory."
 	false
 
 $(DB): $(DB).tar.gz
-	gunzip < $(DB).tar.gz | tar xvf -
+	gunzip < $(srcdir)/$(DB).tar.gz | tar xvf -
+	(cd $(DB) && $(patch) -p1) < $(srcdir)/bdb-cygwin.patch
 
 have-db:
 	$(MAKE) $(DB)
@@ -27,24 +28,24 @@ build-db: have-db
 	 --enable-cxx --disable-shared --disable-cryptography \
          --disable-replication --disable-verify && \
 	$(MAKE) && \
-	$(MAKE) install)
+	$(MAKE) install_include install_lib)
 	touch build-db
 endif
 
 
 # CWI ATerm
 
-ATERM = aterm-2.3.1
+ATERM = aterm-2.4.2-fixes-r2
 
-$(ATERM).tar.gz:
+$(ATERM).tar.bz2:
 	@echo "Nix requires the CWI ATerm library to build."
-	@echo "Please download version 2.3.1 from"
-	@echo "  http://www.cwi.nl/projects/MetaEnv/aterm/aterm-2.3.1.tar.gz"
+	@echo "Please download version 2.4.2-fixes-r2 from"
+	@echo "  http://losser.st-lab.cs.uu.nl/~eelco/dist/aterm-2.4.2-fixes-r2.tar.bz2"
 	@echo "and place it in the externals/ directory."
 	false
 
-$(ATERM): $(ATERM).tar.gz
-	gunzip < $(ATERM).tar.gz | tar xvf -
+$(ATERM): $(ATERM).tar.bz2
+	bunzip2 < $(srcdir)/$(ATERM).tar.bz2 | tar xvf -
 
 have-aterm:
 	$(MAKE) $(ATERM)
@@ -56,17 +57,53 @@ else
 build-aterm: have-aterm
 	(pfx=`pwd` && \
 	cd $(ATERM) && \
-	CC="$(CC)" ./configure --prefix=$$pfx/inst-aterm && \
+	CC="$(CC)" ./configure --prefix=$$pfx/inst-aterm \
+	  --disable-shared --enable-static && \
 	$(MAKE) && \
 	$(MAKE) install)
 	touch build-aterm
 endif
 
 
-all: build-db build-aterm
+# bzip2
 
-EXTRA_DIST = $(DB).tar.gz $(ATERM).tar.gz
+BZIP2 = bzip2-1.0.4
+
+$(BZIP2).tar.gz:
+	@echo "Nix requires bzip2 to build."
+	@echo "Please download version 1.0.4 from"
+	@echo "  http://www.bzip.org/1.0.4/bzip2-1.0.4.tar.gz"
+	@echo "and place it in the externals/ directory."
+	false
+
+$(BZIP2): $(BZIP2).tar.gz
+	gunzip < $(srcdir)/$(BZIP2).tar.gz | tar xvf -
+
+have-bzip2:
+	$(MAKE) $(BZIP2)
+	touch have-bzip2
+
+if HAVE_BZIP2
+build-bzip2:
+else
+build-bzip2: have-bzip2
+	(pfx=`pwd` && \
+	cd $(BZIP2) && \
+	$(MAKE) && \
+	$(MAKE) install PREFIX=$$pfx/inst-bzip2)
+	touch build-bzip2
+
+install:
+	mkdir -p $(DESTDIR)${bzip2_bin}
+	$(INSTALL_PROGRAM) $(bzip2_bin_test)/bzip2 $(bzip2_bin_test)/bunzip2 $(DESTDIR)${bzip2_bin}
+endif
+
+
+all: build-db build-aterm build-bzip2
+
+EXTRA_DIST = $(DB).tar.gz $(ATERM).tar.bz2 $(BZIP2).tar.gz \
+  bdb-cygwin.patch
 
 ext-clean:
 	$(RM) -f have-db build-db have-aterm build-aterm
-	$(RM) -rf $(DB) $(ATERM)
+	$(RM) -rf $(DB) $(ATERM) $(BZIP2)

externals/bdb-cygwin.patch

@@ -0,0 +1,22 @@
+diff -rc db-4.5.20-orig/os/os_flock.c db-4.5.20/os/os_flock.c
+*** db-4.5.20-orig/os/os_flock.c	2006-10-13 12:36:12.000000000 +0200
+--- db-4.5.20/os/os_flock.c	2006-10-13 12:40:11.000000000 +0200
+***************
+*** 30,35 ****
+--- 30,44 ----
+  
+  	DB_ASSERT(dbenv, F_ISSET(fhp, DB_FH_OPENED) && fhp->fd != -1);
+  
++ #ifdef __CYGWIN__
++ 	/*
++ 	 * Windows file locking interferes with read/write operations, so we
++ 	 * map the ranges to an area past the end of the file.
++ 	 */
++ 	DB_ASSERT(dbenv, offset < (off_t) 1 << 62);
++ 	offset += (off_t) 1 << 62;
++ #endif
++ 
+  	fl.l_start = offset;
+  	fl.l_len = 1;
+  	fl.l_type = acquire ? F_WRLCK : F_UNLCK;
+Only in db-4.5.20/os: os_flock.c~

install_full.sh

@@ -0,0 +1,67 @@
+#! /bin/sh -e
+
+make clean				# comment this out when needed !!!
+
+export nixstatepath=/nixstate2/nix
+export ACLOCAL_PATH=/home/wouterdb/.nix-profile/share/aclocal
+
+if [ "$1" = "full" ]; then
+  nix-env-all-pkgs.sh -i gcc
+  nix-env-all-pkgs.sh -i gnum4
+  nix-env-all-pkgs.sh -i autoconf
+  nix-env-all-pkgs.sh -i automake
+  nix-env-all-pkgs.sh -i gnused
+  nix-env-all-pkgs.sh -i db4
+  nix-env-all-pkgs.sh -i aterm
+  nix-env-all-pkgs.sh -i bzip2
+  nix-env-all-pkgs.sh -i flex
+  nix-env-all-pkgs.sh -i bsdiff
+  nix-env-all-pkgs.sh -i libtool
+  nix-env-all-pkgs.sh -i docbook5
+  nix-env-all-pkgs.sh -i docbook5-xsl
+  nix-env-all-pkgs.sh -i bison
+  nix-env-all-pkgs.sh -i gdb			#optional for debugging
+  nix-env-all-pkgs.sh -i gnupatch
+  nix-env-all-pkgs.sh -i gnumake
+  nix-env-all-pkgs.sh -i ext3cow-tools
+  nix-env-all-pkgs.sh -i e3cfsprogs
+  nix-env-all-pkgs.sh -i rsync  
+fi
+
+if [ "$1" = "full" ] || [ "$1" = "auto" ]; then
+  export AUTOCONF=autoconf
+  export AUTOHEADER=autoheader
+  export AUTOMAKE=automake
+  autoconf
+  autoreconf -f
+  aclocal
+  autoheader
+  automake
+fi
+
+./bootstrap.sh
+
+./configure --with-aterm=$HOME/.nix-profile \
+            --with-bzip2=$HOME/.nix-profile \
+            --with-bdb=$HOME/.nix-profile \
+            --with-docbook-xsl=$HOME/.nix-profile \
+            --with-docbook-rng=/home/wouterdb/.nix-profile/xml/rng/docbook \
+            --with-docbook-xsl=/home/wouterdb/.nix-profile/xml/xsl/docbook \
+            --prefix=$nixstatepath \
+            --with-store-dir=/nix/store \
+	    	--with-store-state-dir=/nix/state \
+            --with-ext3cow-header=/nix/store/2sm0h2xd1zsm5had53q1pvzmnsn8fy8k-linux-2.6.21/lib/modules/2.6.21-ck1-default/build/include/linux/ext3cow_fs.h \
+            --localstatedir=/nix/var
+
+#Options from the nix expr
+#--disable-init-state
+#--with-store-dir=/nix/store 
+#--localstatedir=/nix/var
+#--with-aterm=/nix/store/pkmzbb613wa8cwngx8jjb5jaic8yhyzs-aterm-2.4.2-fixes
+#--with-bdb=/nix/store/4yv4j1cd7i5j3mhs5wpc1kzlz1cj8n82-db4-4.5.20
+#--with-bzip2=/nix/store/dh0mdgkvhv3pwrf8zp58phpzn9rcm49r-bzip2-1.0.3
+#--disable-init-state
+
+
+echo "New state nix version by wouter ..." > doc/manual/NEWS.txt
+make

install_install_d.sh

@@ -0,0 +1,16 @@
+#! /bin/sh -e
+
+if [ $(whoami) = "root" ]
+then
+
+su - wouterdb -c "cd /home/wouterdb/dev/nix-state/; make"
+make install
+chown -R wouterdb.wouterdb /nixstate2/nix/
+
+./restartDaemon.sh
+
+else
+  echo "You must be ROOT to run this script."
+  exit 0
+fi
+

install_make.sh

@@ -0,0 +1,5 @@
+#! /bin/sh -e
+
+make
+
+

make/examples/aterm/aterm/default.nix

@@ -19,11 +19,7 @@ rec {
     ./version.c
   ];
 
-  compile = fn: compileC {
-    main = fn;
-    localIncludes = "auto";
-    forSharedLib = sharedLib;
-  };
+  compile = main: compileC {inherit main sharedLib;};
 
   libATerm = makeLibrary {
     libraryName = "ATerm";

make/examples/aterm/test/default.nix

@@ -1,18 +1,15 @@
+with (import ../../../lib);
+
 let {
-
-  inherit (import ../../../lib) compileC link;
-
   inherit (import ../aterm {}) libATerm;
 
-  compile = fn: compileC {
-    main = fn;
-    localIncludes = "auto";
-    cFlags = "-I../aterm";
+  compileTest = main: link {
+    objects = [(compileC {inherit main; localIncludePath = [ ../aterm ];})];
+    libraries = libATerm;
   };
 
-  fib = link {objects = compile ./fib.c; libraries = libATerm;};
-
-  primes = link {objects = compile ./primes.c; libraries = libATerm;};
-  
-  body = [fib primes];
+  body = [
+    (compileTest ./fib.c)
+    (compileTest ./primes.c)
+  ];
 }

make/examples/not-so-simple-header-auto/default.nix

@@ -1,11 +1,13 @@
-let {
+with import ../../lib;
 
-  inherit (import ../../lib) compileC findIncludes link;
+let {
 
   hello = link {programName = "hello"; objects = compileC {
     main = ./foo/hello.c;
     localIncludes = "auto";
   };};
 
+#  body = findIncludes {main = ./foo/hello.c;};
+
   body = [hello];
 }

make/lib/default.nix

@@ -8,46 +8,55 @@ rec {
   stdenv = pkgs.stdenv;
   
 
-  compileC = {main, localIncludes ? [], cFlags ? "", forSharedLib ? false}:
+  compileC =
+  { main
+  , localIncludes ? "auto"
+  , localIncludePath ? []
+  , cFlags ? ""
+  , sharedLib ? false
+  }:
   stdenv.mkDerivation {
     name = "compile-c";
     builder = ./compile-c.sh;
+    
     localIncludes =
       if localIncludes == "auto" then
-        import (findIncludes {
-          main = toString main;
-          hack = __currentTime;
-          inherit cFlags;
-        })
+        dependencyClosure {
+          scanner = main:
+            import (findIncludes {
+              inherit main;
+            });
+          searchPath = localIncludePath;
+          startSet = [main];
+        }
       else
         localIncludes;
+        
     inherit main;
+    
     cFlags = [
       cFlags
-      (if forSharedLib then ["-fpic"] else [])
+      (if sharedLib then ["-fpic"] else [])
+      (map (p: "-I" + (relativise (dirOf main) p)) localIncludePath)
     ];
   };
 
-  /*
-  runCommand = {command}: {
-    name = "run-command";
-    builder = ./run-command.sh;
-    inherit command;
-  };
-  */
-
-  findIncludes = {main, hack, cFlags ? ""}: stdenv.mkDerivation {
-    name = "find-includes";
-    builder = ./find-includes.sh;
-    inherit main hack cFlags;
-  };
   
+  findIncludes = {main}: stdenv.mkDerivation {
+    name = "find-includes";
+    realBuilder = pkgs.perl ~ "bin/perl";
+    args = [ ./find-includes.pl ];
+    inherit main;
+  };
+
+    
   link = {objects, programName ? "program", libraries ? []}: stdenv.mkDerivation {
     name = "link";
     builder = ./link.sh;
     inherit objects programName libraries;
   };
 
+  
   makeLibrary = {objects, libraryName ? [], sharedLib ? false}:
   # assert sharedLib -> fold (obj: x: assert obj.sharedLib && x) false objects
   stdenv.mkDerivation {
@@ -56,4 +65,5 @@ rec {
     inherit objects libraryName sharedLib;
   };
 
+  
 }

make/lib/find-includes.pl

@@ -0,0 +1,21 @@
+use strict;
+
+my $root = $ENV{"main"};
+my $out = $ENV{"out"};
+
+open OUT, ">$out" or die "$!";
+print OUT "[\n";
+
+open IN, "<$root" or die "$!";
+while (<IN>) {
+    if (/^\#include\s+\"(.*)\"/) {
+        print OUT "\"$1\"\n";
+    }
+    if (/^\#include\s+\<(.*)\>/) {
+        print OUT "\"$1\"\n";
+    }
+}
+close IN;
+
+print OUT "]\n";
+close OUT;

make/lib/find-includes.sh

@@ -1,20 +0,0 @@
-. $stdenv/setup
-
-echo "finding includes of \`$(basename $main)'..."
-
-makefile=$NIX_BUILD_TOP/makefile
-
-mainDir=$(dirname $main)
-(cd $mainDir && gcc $cFlags -MM $(basename $main) -MF $makefile) || false
-
-echo "[" >$out
-
-while read line; do
-    line=$(echo "$line" | sed 's/.*://')
-    for i in $line; do
-        fullPath=$(readlink -f $mainDir/$i)
-        echo "  [ $fullPath \"$i\" ]" >>$out
-    done
-done < $makefile
-
-echo "]" >>$out

mergeTrunkBackIn.sh

@@ -0,0 +1,36 @@
+svn merge -r 10855:10943 https://svn.cs.uu.nl:12443/repos/trace/nix/trunk
+
+#already done:
+# 8628 
+# 8632
+# 8634
+# 8636
+# 8655
+# 8691
+# 8698
+# 8711
+# 8864
+# 9063
+# 9105 
+# 9207
+# 9217
+# 9332
+# 9429
+# 9433
+# 9435
+# 9437
+# 9439
+# 9445
+# 9476
+# 9506
+# 9536
+# 9549
+# 9561
+# 9584
+# 9751
+# 10133
+# 10154
+# 10531
+# 10692
+# 10855
+# 10943

misc/emacs/Makefile.am

@@ -2,4 +2,4 @@ EXTRA_DIST = nix-mode.el
 
 install-data-local:
 	$(INSTALL) -d $(DESTDIR)$(datadir)/emacs/site-lisp
-	$(INSTALL_DATA) nix-mode.el $(DESTDIR)$(datadir)/emacs/site-lisp
+	$(INSTALL_DATA) $(srcdir)/nix-mode.el $(DESTDIR)$(datadir)/emacs/site-lisp

misc/emacs/nix-mode.el

@@ -66,8 +66,8 @@ The hook `nix-mode-hook' is run when Nix mode is started.
 
 
 (defvar nix-keywords
-  '("\\<if\\>" "\\<then\\>" "\\<else\\>" "\\<assert\\>"
-    "\\<let\\>" "\\<rec\\>" "\\<inherit\\>"
+  '("\\<if\\>" "\\<then\\>" "\\<else\\>" "\\<assert\\>" "\\<with\\>"
+    "\\<let\\>" "\\<in\\>" "\\<rec\\>" "\\<inherit\\>"
     ("\\<true\\>" . font-lock-builtin-face)
     ("\\<false\\>" . font-lock-builtin-face)
     ("\\<null\\>" . font-lock-builtin-face)

misc/vim/syntax/nix.vim

@@ -0,0 +1,35 @@
+" Vim syntax file
+" Language:	nix
+" Maintainer:	Marc Weber <marco-oweber@gmx.de>
+"               Modify and commit if you feel that way
+" Last Change:	2007 Dec
+
+" Quit when a (custom) syntax file was already loaded
+if exists("b:current_syntax")
+  finish
+endif
+
+syn keyword	nixKeyword	let throw inherit import true false null with
+syn keyword	nixConditional	if else then
+syn keyword     nixBrace        ( ) { } =
+syn keyword     nixBuiltin         __currentSystem __currentTime __isFunction __getEnv __trace __toPath __pathExists 
+  \ __readFile __toXML __toFile __filterSource __attrNames __getAttr __hasAttr __isAttrs __listToAttrs __isList 
+  \ __head __tail __add __sub __lessThan __substring __stringLength
+
+syn match nixAttr "\w\+\ze\s*="
+syn match nixFuncArg "\zs\w\+\ze\s*:"
+syn region nixStringParam start=+\${+ end=+}+
+syn region nixMultiLineComment start=+/\*+ skip=+\\"+ end=+\*/+
+syn match  nixEndOfLineComment "#.*$"
+syn region nixString      start=+"+ skip=+\\"+ end=+"+ contains=nixStringParam
+
+hi def link nixKeyword       Keyword
+hi def link nixConditional   Conditional
+hi def link nixBrace         Special
+hi def link nixString        String
+hi def link nixBuiltin       Special
+hi def link nixStringParam   Macro
+hi def link nixMultiLineComment Comment
+hi def link nixEndOfLineComment Comment
+hi def link nixAttr        Identifier
+hi def link nixFuncArg     Identifier

nix.conf.example

@@ -11,7 +11,7 @@
 # build time (e.g., the C compiler, or source tarballs downloaded from
 # the network).  To prevent it from doing so, set this option to
 # `true'.
-gc-keep-outputs = false
+#gc-keep-outputs = false
 
 
 ### Option `gc-keep-derivations'
@@ -26,7 +26,26 @@ gc-keep-outputs = false
 # store path was built), so by default this option is on.  Turn it off
 # to safe a bit of disk space (or a lot if `gc-keep-outputs' is also
 # turned on).
-gc-keep-derivations = true
+#gc-keep-derivations = true
+
+
+### Option `gc-reserved-space'
+#
+# This option specifies how much space should be reserved in normal
+# use so that the garbage collector can run succesfully.  Since the
+# garbage collector must perform Berkeley DB transactions, it needs
+# some disk space for itself.  However, when the disk is full, this
+# space is not available, so the collector would not be able to run
+# precisely when it is most needed.
+#
+# For this reason, when Nix is run, it allocates a file
+# /nix/var/nix/db/reserved of the size specified by this option.  When
+# the garbage collector is run, this file is deleted before the
+# Berkeley DB environment is opened.  This should give it enough room
+# to proceed.
+#
+# The default is "1048576" (1 MiB).
+#gc-reserved-space = 1048576
 
 
 ### Option `env-keep-derivations'
@@ -46,4 +65,129 @@ gc-keep-derivations = true
 # this one is `sticky': it applies to any user environment created
 # while this option was enabled, while `gc-keep-derivations' only
 # applies at the moment the garbage collector is run.
-env-keep-derivations = false
+#env-keep-derivations = false
+
+
+### Option `build-max-jobs'
+#
+# This option defines the maximum number of jobs that Nix will try to
+# build in parallel.  The default is 1.  You should generally set it
+# to the number of CPUs in your system (e.g., 2 on a Athlon 64 X2).
+# It can be overriden using the `--max-jobs' / `-j' command line
+# switch.
+#build-max-jobs = 1
+
+
+### Option `build-max-silent-time'
+#
+# This option defines the maximum number of seconds that a builder can
+# go without producing any data on standard output or standard error.
+# This is useful (for instance in a automated build system) to catch
+# builds that are stuck in an infinite loop, or to catch remote builds
+# that are hanging due to network problems.  It can be overriden using
+# the `--max-silent-time' command line switch.
+#
+# The value 0 means that there is no timeout.  This is also the
+# default.
+#
+# Example:
+#   build-max-silent-time = 600 # = 10 minutes
+#build-max-silent-time = 0
+
+
+### Option `build-users-group'
+#
+# This options specifies the Unix group containing the Nix build user
+# accounts.  In multi-user Nix installations, builds should not
+# be performed by the Nix account since that would allow users to
+# arbitrarily modify the Nix store and database by supplying specially
+# crafted builders; and they cannot be performed by the calling user
+# since that would allow him/her to influence the build result.
+#
+# Therefore, if this option is non-empty and specifies a valid group,
+# builds will be performed under the user accounts that are a member
+# of the group specified here (as listed in /etc/group).  Those user
+# accounts should not be used for any other purpose!
+#
+# Nix will never run two builds under the same user account at the
+# same time.  This is to prevent an obvious security hole: a malicious
+# user writing a Nix expression that modifies the build result of a
+# legitimate Nix expression being built by another user.  Therefore it
+# is good to have as many Nix build user accounts as you can spare.
+# (Remember: uids are cheap.)
+#
+# The build users should have permission to create files in the Nix
+# store, but not delete them.  Therefore, /nix/store should be owned
+# by the Nix account, its group should be the group specified here,
+# and its mode should be 1775.
+#
+# If the build users group is empty, builds will be performed under
+# the uid of the Nix process (that is, the uid of the caller if
+# $NIX_REMOTE is empty, the uid under which the Nix daemon runs if
+# $NIX_REMOTE is `daemon', or the uid that owns the setuid nix-worker
+# program if $NIX_REMOTE is `slave').  Obviously, this should not be
+# used in multi-user settings with untrusted users.
+#
+# The default is empty.
+#
+# Example:
+#   build-users-group = nix-builders
+#build-users-group =
+
+
+### Option `build-use-chroot'
+#
+# If set to `true', builds will be performed in a chroot environment,
+# i.e., the build will be isolated from the normal file system
+# hierarchy and will only see the Nix store, the temporary build
+# directory, and the directories configured with the
+# `build-chroot-dirs' option (such as /proc and /dev).  This is useful
+# to prevent undeclared dependencies on files in directories such as
+# /usr/bin.
+#
+# The use of a chroot requires that Nix is run as root (but you can
+# still use the "build users" feature to perform builds under
+# different users than root).  Currently, chroot builds only work on
+# Linux because Nix uses "bind mounts" to make the Nix store and other
+# directories available inside the chroot.
+#
+# The default is `false'.
+#
+# Example:
+#   build-use-chroot = true
+#build-use-chroot = false
+
+
+### Option `build-chroot-dirs'
+#
+# When builds are performed in a chroot environment, Nix will mount
+# (using `mount --bind' on Linux) some directories from the normal
+# file system hierarchy inside the chroot.  These are the Nix store,
+# the temporary build directory (usually /tmp/nix-<pid>-<number>) and
+# the directories listed here.  The default is "/dev /proc".  Files
+# in /dev (such as /dev/null) are needed by many builds, and some
+# files in /proc may also be needed occasionally.
+#
+# Example:
+#   build-use-chroot = /dev /proc /bin
+#build-chroot-dirs = /dev /proc
+
+
+### Option `system'
+#
+# This option specifies the canonical Nix system name of the current
+# installation, such as `i686-linux' or `powerpc-darwin'.  Nix can
+# only build derivations whose `system' attribute equals the value
+# specified here.  In general, it never makes sense to modify this
+# value from its default, since you can use it to `lie' about the
+# platform you are building on (e.g., perform a Mac OS build on a
+# Linux machine; the result would obviously be wrong).  It only makes
+# sense if the Nix binaries can run on multiple platforms, e.g.,
+# `universal binaries' that run on `powerpc-darwin' and `i686-darwin'.
+#
+# It defaults to the canonical Nix system name detected by `configure'
+# at build time.
+#
+# Example:
+#   system = i686-darwin
+#system =

nix.spec.in

@@ -13,19 +13,25 @@ Version: @version@
 Release: 1
 License: GPL
 Group: Software Deployment
-URL: http://www.cs.uu.nl/groups/ST/Trace/Nix
+URL: http://nix.cs.uu.nl/
 Source0: %{name}-@version@.tar.bz2
 BuildRoot: %{_tmppath}/%{name}-%{version}-buildroot
 %define _prefix /nix
 Prefix: %{_prefix}
 Requires: /usr/bin/perl
+Requires: curl
 
 # Hack to make that shitty RPM scanning hack shut up.
 Provides: perl(readmanifest)
                                                                
 %description
 
-Nix is a system for software deployment.
+Nix is a purely functional package manager. It allows multiple
+versions of a package to be installed side-by-side, ensures that
+dependency specifications are complete, supports atomic upgrades and
+rollbacks, allows non-root users to install software, and has many
+other features. It is the basis of the NixOS Linux distribution, but
+it can be used equally well under other Unix systems.
 
 %prep
 %setup -q
@@ -48,6 +54,7 @@ make check
 %install
 rm -rf $RPM_BUILD_ROOT
 make DESTDIR=$RPM_BUILD_ROOT install
+rm $RPM_BUILD_ROOT/%{_prefix}/etc/nix/nix.conf
 strip $RPM_BUILD_ROOT/%{_prefix}/bin/* || true
 
 %clean
@@ -66,10 +73,11 @@ fi
 %files
 #%defattr(-,root,root)
 %{_prefix}/bin
+%{_prefix}/lib
 %{_prefix}/libexec
+%{_prefix}/include
 %{_prefix}/var
 %{_prefix}/share
-%{_prefix}/man
 %{_prefix}/store
 %config
 %{_prefix}/etc

restartDaemon.sh

@@ -0,0 +1,9 @@
+#! /bin/sh
+
+initctl stop nix-daemon
+killproc.sh nix-worker
+sleep 2
+
+#/nixstate2/nix/bin/nix-worker --daemon > /dev/null 2>&1 &
+/nixstate2/nix/bin/nix-worker --daemon
+#gdb --args /nixstate2/nix/bin/nix-worker --daemon

scripts/Makefile.am

@@ -1,17 +1,24 @@
 bin_SCRIPTS = nix-collect-garbage \
   nix-pull nix-push nix-prefetch-url \
-  nix-install-package nix-channel nix-build
+  nix-install-package nix-channel nix-build \
+  nix-pack-closure nix-unpack-closure \
+  nix-copy-closure 
 
-noinst_SCRIPTS = nix-profile.sh generate-patches.pl
+noinst_SCRIPTS = nix-profile.sh generate-patches.pl \
+  find-runtime-roots.pl build-remote.pl nix-reduce-build
 
-nix-pull nix-push: readmanifest.pm download-using-manifests.pl
+nix-pull nix-push: readmanifest.pm readconfig.pm download-using-manifests.pl
 
-install-exec-local: readmanifest.pm download-using-manifests.pl
+install-exec-local: readmanifest.pm download-using-manifests.pl find-runtime-roots.pl
 	$(INSTALL) -d $(DESTDIR)$(sysconfdir)/profile.d
 	$(INSTALL_PROGRAM) nix-profile.sh $(DESTDIR)$(sysconfdir)/profile.d/nix.sh
 	$(INSTALL) -d $(DESTDIR)$(libexecdir)/nix
 	$(INSTALL_DATA) readmanifest.pm $(DESTDIR)$(libexecdir)/nix 
+	$(INSTALL_DATA) readconfig.pm $(DESTDIR)$(libexecdir)/nix 
 	$(INSTALL_PROGRAM) download-using-manifests.pl $(DESTDIR)$(libexecdir)/nix 
+	$(INSTALL_PROGRAM) find-runtime-roots.pl $(DESTDIR)$(libexecdir)/nix 
+	$(INSTALL_PROGRAM) generate-patches.pl $(DESTDIR)$(libexecdir)/nix 
+	$(INSTALL_PROGRAM) build-remote.pl $(DESTDIR)$(libexecdir)/nix 
 	$(INSTALL) -d $(DESTDIR)$(sysconfdir)/nix
 
 include ../substitute.mk
@@ -21,6 +28,12 @@ EXTRA_DIST = nix-collect-garbage.in \
   nix-prefetch-url.in nix-install-package.in \
   nix-channel.in \
   readmanifest.pm.in \
+  readconfig.pm.in \
   nix-build.in \
   download-using-manifests.pl.in \
-  generate-patches.pl.in
+  generate-patches.pl.in \
+  nix-pack-closure.in nix-unpack-closure.in \
+  nix-copy-closure.in \
+  find-runtime-roots.pl.in \
+  build-remote.pl.in \
+  nix-reduce-build.in

scripts/build-remote.pl.in

@@ -0,0 +1,208 @@
+#! @perl@ -w
+
+use strict;
+use Fcntl ':flock';
+use English '-no_match_vars';
+
+# General operation:
+#
+# Try to find a free machine of type $neededSystem.  We do this as
+# follows:
+# - We acquire an exclusive lock on $currentLoad/main-lock.
+# - For each machine $machine of type $neededSystem and for each $slot
+#   less than the maximum load for that machine, we try to get an
+#   exclusive lock on $currentLoad/$machine-$slot (without blocking).
+#   If we get such a lock, we send "accept" to the caller.  Otherwise,
+#   we send "postpone" and exit. 
+# - We release the exclusive lock on $currentLoad/main-lock.
+# - We perform the build on $neededSystem.
+# - We release the exclusive lock on $currentLoad/$machine-$slot.
+#
+# The nice thing about this scheme is that if we die prematurely, the
+# locks are released automatically.
+
+my $loadIncreased = 0;
+
+my $amWilling = shift @ARGV;
+my $localSystem = shift @ARGV;
+my $neededSystem = shift @ARGV;
+my $drvPath = shift @ARGV;
+
+sub sendReply {
+    my $reply = shift;
+    open OUT, ">&3" or die;
+    print OUT "$reply\n";
+    close OUT;
+}
+
+sub decline {
+    sendReply "decline";
+    exit 0;
+}
+
+my $currentLoad = $ENV{"NIX_CURRENT_LOAD"};
+decline unless defined $currentLoad;
+mkdir $currentLoad, 0777 or die unless -d $currentLoad;
+
+my $conf = $ENV{"NIX_REMOTE_SYSTEMS"};
+decline if !defined $conf || ! -e $conf;
+
+# Decline if the local system can do the build.
+decline if $amWilling && ($localSystem eq $neededSystem);
+
+
+# Otherwise find a willing remote machine.
+my %machines;
+my %systemTypes;
+my %sshKeys;
+my %maxJobs;
+my %curJobs;
+
+
+# Read the list of machines.
+open CONF, "< $conf" or die;
+
+while (<CONF>) {
+    chomp;
+    s/\#.*$//g;
+    next if /^\s*$/;
+    /^\s*(\S+)\s+(\S+)\s+(\S+)\s+(\d+)\s*$/ or die;
+    $machines{$1} = "";
+    $systemTypes{$1} = $2;
+    $sshKeys{$1} = $3;
+    $maxJobs{$1} = $4;
+}
+
+close CONF;
+
+
+# Acquire the exclusive lock on $currentLoad/main-lock.
+my $mainLock = "$currentLoad/main-lock";
+open MAINLOCK, ">>$mainLock" or die;
+flock(MAINLOCK, LOCK_EX) or die;
+
+
+# Find a suitable system.
+my $rightType = 0;
+my $machine;
+LOOP: foreach my $cur (keys %machines) {
+    if ($neededSystem eq $systemTypes{$cur}) {
+        $rightType = 1;
+
+        # We have a machine of the right type.  Try to get a lock on
+        # one of the machine's lock files.
+        my $slot = 0;
+        while ($slot < $maxJobs{$cur}) {
+            my $slotLock = "$currentLoad/$cur-$slot";
+            open SLOTLOCK, ">>$slotLock" or die;
+            if (flock(SLOTLOCK, LOCK_EX | LOCK_NB)) {
+                $machine = $cur;
+                last LOOP;
+            }                
+            close SLOTLOCK;
+            $slot++;
+        }
+    }
+}
+
+close MAINLOCK;
+
+
+# Didn't find one?
+if (!defined $machine) {
+    if ($rightType) {
+        sendReply "postpone";
+        exit 0;
+    } else {
+        decline;
+    }
+}
+
+# Yes we did, accept.
+sendReply "accept";
+open IN, "<&4" or die;
+my $x = <IN>;
+chomp $x;
+#print "got $x\n";  
+close IN;
+
+if ($x ne "okay") {
+    exit 0;
+}
+
+
+# Do the actual job.
+print "BUILDING REMOTE: $drvPath on $machine\n";
+
+# Make sure that we don't get any SSH passphrase or host key popups -
+# if there is any problem it should fail, not do something
+# interactive.
+$ENV{"DISPLAY"} = "";
+$ENV{"SSH_PASSWORD_FILE="} = "";
+$ENV{"SSH_ASKPASS="} = "";
+
+my $sshOpts = "-i $sshKeys{$machine} -x";
+
+# Hack to support Cygwin: if we login without a password, we don't
+# have exactly the same right as when we do.  This causes the
+# Microsoft C compiler to fail with certain flags:
+#
+#   http://connect.microsoft.com/VisualStudio/feedback/ViewFeedback.aspx?FeedbackID=99676
+#
+# So as a workaround, we pass a verbatim password.  ssh tries to makes
+# this very hard; the trick is to make it call SSH_ASKPASS to get the
+# password.  (It only calls this command when there is no controlling
+# terminal, but Nix ensures that is is the case.  When doing this
+# manually, use setsid(1).)
+if ($sshKeys{$machine} =~ /^password:/) {
+    my $passwordFile = $sshKeys{$machine};
+    $passwordFile =~ s/^password://;
+    $sshOpts = "ssh -x";
+    $ENV{"SSH_PASSWORD_FILE"} = $passwordFile;
+    $ENV{"SSH_ASKPASS"} = "/tmp/writepass";
+
+    open WRITEPASS, ">/tmp/writepass" or die;
+    print WRITEPASS "#! /bin/sh\ncat \"\$SSH_PASSWORD_FILE\"";
+    close WRITEPASS;
+    chmod 0755, "/tmp/writepass" or die;
+}
+
+my $inputs = `cat inputs`; die if ($? != 0);
+$inputs =~ s/\n/ /g;
+
+my $outputs = `cat outputs`; die if ($? != 0);
+$outputs =~ s/\n/ /g;
+
+print "COPYING INPUTS...\n";
+
+my $maybeSign = "";
+$maybeSign = "--sign" if -e "/nix/etc/nix/signing-key.sec";
+
+system("NIX_SSHOPTS=\"$sshOpts\" nix-copy-closure $machine $maybeSign $drvPath $inputs") == 0
+    or die "cannot copy inputs to $machine: $?";
+
+print "BUILDING...\n";
+
+system("ssh $sshOpts $machine 'nix-store -rvvK $drvPath'") == 0
+    or die "remote build on $machine failed: $?";
+
+print "REMOTE BUILD DONE: $drvPath on $machine\n";
+
+foreach my $output (split '\n', $outputs) {
+    my $maybeSignRemote = "";
+    $maybeSignRemote = "--sign" if $UID != 0;
+    
+    system("ssh $sshOpts $machine 'nix-store --export $maybeSignRemote $output' > dump") == 0
+	or die "cannot copy $output from $machine: $?";
+
+    # This doesn't work yet, since the caller has a lock on the output
+    # path.  We should move towards lock-free invocation of build
+    # hooks and substitutes.
+    #system("nix-store --import < dump") == 0
+    #    or die "cannot import $output: $?";
+
+    # Hack: skip the first 8 bytes (the nix-store --export next
+    # archive marker).  The archive follows.
+    system("(dd bs=1 count=8 of=/dev/null && cat) < dump | nix-store --restore $output") == 0
+	or die "cannot restore $output: $?";
+}

scripts/download-using-manifests.pl.in

@@ -2,34 +2,112 @@
 
 use strict;
 use readmanifest;
+use POSIX qw(strftime);
+use File::Temp qw(tempdir);
 
 my $manifestDir = "@localstatedir@/nix/manifests";
 my $logFile = "@localstatedir@/log/nix/downloads";
 
 open LOGFILE, ">>$logFile" or die "cannot open log file $logFile";
 
+# Create a temporary directory.
+my $tmpDir = tempdir("nix-download.XXXXXX", CLEANUP => 1, TMPDIR => 1)
+    or die "cannot create a temporary directory";
 
-# Check the arguments.
-die unless scalar @ARGV == 1;
-my $targetPath = $ARGV[0];
+chdir $tmpDir or die "cannot change to `$tmpDir': $!";
 
-my $date = `date` or die;
-chomp $date;
+my $tmpNar = "$tmpDir/nar";
+my $tmpNar2 = "$tmpDir/nar2";
+
+
+# Load all manifests.
+my %narFiles;
+my %localPaths;
+my %patches;
+
+for my $manifest (glob "$manifestDir/*.nixmanifest") {
+#    print STDERR "reading $manifest\n";
+    if (readManifest($manifest, \%narFiles, \%localPaths, \%patches) < 3) {
+        print STDERR "you have an old-style manifest `$manifest'; please delete it\n";
+        exit 1;
+    }
+}
+
+
+# Parse the arguments.
+
+if ($ARGV[0] eq "--query-paths") {
+    foreach my $storePath (keys %narFiles) { print "$storePath\n"; }
+    foreach my $storePath (keys %localPaths) { print "$storePath\n"; }
+    exit 0;
+}
+
+elsif ($ARGV[0] eq "--query-info") {
+    shift @ARGV;
+    foreach my $storePath (@ARGV) {
+        my $info;
+        if (defined $narFiles{$storePath}) {
+            $info = @{$narFiles{$storePath}}[0];
+        }
+        elsif (defined $localPaths{$storePath}) {
+            $info = @{$localPaths{$storePath}}[0];
+        }
+        else {
+            next; # not an error
+        }
+        print "$storePath\n";
+        print "$info->{deriver}\n";
+        
+        my @references = split " ", $info->{references};
+        my $count = scalar @references;
+        print "$count\n";
+        foreach my $reference (@references) {
+            print "$reference\n";
+		}
+	
+		my $isStateStorePath = `@bindir@/nix-state --is-state-store-path-download-using-manifests $storePath`;
+		if($isStateStorePath ne "true" && $isStateStorePath ne "false"){
+			die "The call for isStateStorePath must return true or false.....";
+		}
+	
+		if($isStateStorePath eq "true"){
+	        my @stateReferences = split " ", $info->{stateReferences};
+	        my $scount = scalar @stateReferences;
+	        print "$scount\n";
+	        foreach my $stateReference (@stateReferences) {
+	            print "$stateReference\n";
+	        }
+	        
+	    	print "$info->{revision}\n";
+	    }
+    }
+    exit 0;
+}
+
+elsif ($ARGV[0] ne "--substitute") {
+    die "syntax: $0 [--query-paths | --query-info PATHS... | --substitute PATH]\n";
+}
+
+
+die unless scalar @ARGV == 2;
+my $targetPath = $ARGV[1];
+
+
+my $date = strftime ("%F %H:%M:%S UTC", gmtime (time));
 print LOGFILE "$$ get $targetPath $date\n";
 
 print "\n*** Trying to download/patch `$targetPath'\n";
 
 
-# Load all manifests.
-my %narFiles;
-my %patches;
-my %successors;
-
-for my $manifest (glob "$manifestDir/*.nixmanifest") {
-#    print STDERR "reading $manifest\n";
-    if (readManifest($manifest, \%narFiles, \%patches, \%successors) < 3) {
-        print STDERR "you have an old-style manifest `$manifest'; please delete it\n";
-        exit 1;
+# If we can copy from a local path, do that.
+my $localPathList = $localPaths{$targetPath};
+foreach my $localPath (@{$localPathList}) {
+    my $sourcePath = $localPath->{copyFrom};
+    if (-e $sourcePath) {
+        print "\n*** Step 1/1: copying from $sourcePath\n";
+        system("@bindir@/nix-store --dump $sourcePath | @bindir@/nix-store --restore $targetPath") == 0
+            or die "cannot copy `$sourcePath' to `$targetPath'";
+        exit 0;
     }
 }
 
@@ -76,8 +154,7 @@ addToQueue $targetPath;
 
 sub isValidPath {
     my $p = shift;
-    system "@bindir@/nix-store --check-validity '$p' 2> /dev/null";
-    return $? == 0;
+    return system("@bindir@/nix-store --check-validity '$p' 2> /dev/null") == 0;
 }
 
 sub parseHash {
@@ -217,8 +294,8 @@ while (scalar @path > 0) {
             # as a base to one or more patches.  So turn the base path
             # into a NAR archive, to which we can apply the patch.
             print "  packing base path...\n";
-            system "@bindir@/nix-store --dump $v > /tmp/nar";
-            die "cannot dump `$v'" if ($? != 0);
+            system("@bindir@/nix-store --dump $v > $tmpNar") == 0
+                or die "cannot dump `$v'";
         }
     }
 
@@ -235,18 +312,18 @@ while (scalar @path > 0) {
         # Apply the patch to the NAR archive produced in step 1 (for
         # the already present path) or a later step (for patch sequences).
         print "  applying patch...\n";
-        system "@libexecdir@/bspatch /tmp/nar /tmp/nar2 $patchPath";
-        die "cannot apply patch `$patchPath' to /tmp/nar" if ($? != 0);
+        system("@libexecdir@/bspatch $tmpNar $tmpNar2 $patchPath") == 0
+            or die "cannot apply patch `$patchPath' to $tmpNar";
 
         if ($curStep < $maxStep) {
             # The archive will be used as the base of the next patch.
-            rename "/tmp/nar2", "/tmp/nar" or die "cannot rename NAR archive: $!";
+            rename "$tmpNar2", "$tmpNar" or die "cannot rename NAR archive: $!";
         } else {
             # This was the last patch.  Unpack the final NAR archive
             # into the target path.
             print "  unpacking patched archive...\n";
-            system "@bindir@/nix-store --restore $v < /tmp/nar2";
-            die "cannot unpack /tmp/nar2 into `$v'" if ($? != 0);
+            system("@bindir@/nix-store --restore $v < $tmpNar2") == 0
+                or die "cannot unpack $tmpNar2 into `$v'";
         }
     }
 
@@ -262,12 +339,13 @@ while (scalar @path > 0) {
 
         if ($curStep < $maxStep) {
             # The archive will be used a base to a patch.
-            system "@bunzip2@ < '$narFilePath' > /tmp/nar";
+            system("@bunzip2@ < '$narFilePath' > $tmpNar") == 0
+                or die "cannot unpack `$narFilePath' into `$v'";
         } else {
             # Unpack the archive into the target path.
             print "  unpacking archive...\n";
-            system "@bunzip2@ < '$narFilePath' | @bindir@/nix-store --restore '$v'";
-            die "cannot unpack `$narFilePath' into `$v'" if ($? != 0);
+            system("@bunzip2@ < '$narFilePath' | @bindir@/nix-store --restore '$v'") == 0
+                or die "cannot unpack `$narFilePath' into `$v'";
         }
     }
 

scripts/find-runtime-roots.pl.in

@@ -0,0 +1,75 @@
+#! @perl@ -w
+
+use strict;
+
+my $procDir = "/proc";
+
+
+sub readProc {
+    return unless -d $procDir;
+
+    opendir DIR, $procDir or return;
+    
+    foreach my $name (readdir DIR) {
+        next unless $name =~ /^\d+$/;
+
+        my $process = "$procDir/$name";
+
+        #print STDERR "=== $process\n";
+        
+        my $target;
+        print "$target\n" if $target = readlink "$process/exe";
+        print "$target\n" if $target = readlink "$process/cwd";
+
+        if (opendir FDS, "$process/fd") {
+            foreach my $name (readdir FDS) {
+                $target = readlink "$process/fd/$name";
+                print "$target\n" if $target && substr($target, 0, 1) eq "/";
+            }
+            closedir FDS;
+        }
+
+        if (open MAP, "<$process/maps") {
+            while (<MAP>) {
+                next unless /^ \s* \S+ \s+ \S+ \s+ \S+ \s+ \S+ \s+ \S+ \s+ (\/\S+) \s* $/x;
+                print "$1\n";
+            }
+            close MAP;
+        }
+    }
+
+    closedir DIR;
+}
+
+
+sub lsof {
+    return unless open LSOF, "lsof -n -w -F n 2> /dev/null |";
+
+    while (<LSOF>) {
+        next unless /^n (\/ .*)$/x;
+        print $1, "\n";
+    }
+
+    close LSOF;
+}
+
+
+readProc;
+lsof;
+
+
+sub readFile {
+    my $path = shift;
+    if (-e $path) {
+        if (open FILE, "$path") {
+            while (<FILE>) {
+                print;
+            }
+            close FILE;
+        }
+    }
+}
+
+# This is rather NixOS-specific, so it probably shouldn't be here.
+readFile "/proc/sys/kernel/modprobe";
+readFile "/proc/sys/kernel/fbsplash";

scripts/generate-patches.pl.in

@@ -1,9 +1,21 @@
 #! @perl@ -w -I@libexecdir@/nix
 
 use strict;
-use POSIX qw(tmpnam);
+use File::Temp qw(tempdir);
 use readmanifest;
 
+
+# Some patch generations options.
+
+# Max size of NAR archives to generate patches for.
+my $maxNarSize = $ENV{"NIX_MAX_NAR_SIZE"};
+$maxNarSize = 100 * 1024 * 1024 if !defined $maxNarSize;
+
+# If patch is bigger than this fraction of full archive, reject.
+my $maxPatchFraction = $ENV{"NIX_PATCH_FRACTION"};
+$maxPatchFraction = 0.60 if !defined $maxPatchFraction;
+
+
 die unless scalar @ARGV == 5;
 
 my $hashAlgo = "sha256";
@@ -14,32 +26,30 @@ my $patchesURL = $ARGV[2];
 my $srcDir = $ARGV[3];
 my $dstDir = $ARGV[4];
 
-my $tmpdir;
-do { $tmpdir = tmpnam(); }
-until mkdir $tmpdir, 0777;
+my $tmpDir = tempdir("nix-generate-patches.XXXXXX", CLEANUP => 1, TMPDIR => 1)
+    or die "cannot create a temporary directory";
 
-print "TEMP = $tmpdir\n";
+print "TEMP = $tmpDir\n";
 
-#END { rmdir $tmpdir; }
+#END { rmdir $tmpDir; }
 
 my %srcNarFiles;
+my %srcLocalPaths;
 my %srcPatches;
-my %srcSuccessors;
 
 my %dstNarFiles;
+my %dstLocalPaths;
 my %dstPatches;
-my %dstSuccessors;
 
 readManifest "$srcDir/MANIFEST",
-    \%srcNarFiles, \%srcPatches, \%srcSuccessors;
+    \%srcNarFiles, \%srcLocalPaths, \%srcPatches;
 
 readManifest "$dstDir/MANIFEST",
-    \%dstNarFiles, \%dstPatches, \%dstSuccessors;
+    \%dstNarFiles, \%dstLocalPaths, \%dstPatches;
 
 
 sub findOutputPaths {
     my $narFiles = shift;
-    my $successors = shift;
 
     my %outPaths;
     
@@ -64,10 +74,10 @@ sub findOutputPaths {
 }
 
 print "finding src output paths...\n";
-my %srcOutPaths = findOutputPaths \%srcNarFiles, \%srcSuccessors;
+my %srcOutPaths = findOutputPaths \%srcNarFiles;
 
 print "finding dst output paths...\n";
-my %dstOutPaths = findOutputPaths \%dstNarFiles, \%dstSuccessors;
+my %dstOutPaths = findOutputPaths \%dstNarFiles;
 
 
 sub getNameVersion {
@@ -140,19 +150,19 @@ sub computeUses {
 
 #    print "  DERIVER $deriver\n";
 
-    # Optimisation: build the referers graph from the references
+    # Optimisation: build the referrers graph from the references
     # graph.
-    my %referers;
+    my %referrers;
     foreach my $q (keys %{$narFiles}) {
         my @refs = split " ", @{$$narFiles{$q}}[0]->{references};
         foreach my $r (@refs) {
-            $referers{$r} = [] unless defined $referers{$r};
-            push @{$referers{$r}}, $q;
+            $referrers{$r} = [] unless defined $referrers{$r};
+            push @{$referrers{$r}}, $q;
         }
     }
 
     # Determine the shortest path from $deriver to all other reachable
-    # paths in the `referers' graph.
+    # paths in the `referrers' graph.
 
     my %dist;
     $dist{$deriver} = 0;
@@ -164,7 +174,7 @@ sub computeUses {
         my $p = $queue[$pos];
         $pos++;
 
-        foreach my $q (@{$referers{$p}}) {
+        foreach my $q (@{$referrers{$p}}) {
             if (!defined $dist{$q}) {
                 $dist{$q} = $dist{$p} + 1;
 #                print "    $q $dist{$q}\n";
@@ -277,45 +287,60 @@ foreach my $p (keys %dstOutPaths) {
         
         my $srcNarBz2 = getNarBz2 \%srcNarFiles, $closest;
         my $dstNarBz2 = getNarBz2 \%dstNarFiles, $p;
-        
-        system("@bunzip2@ < $srcNarBz2 > $tmpdir/A") == 0
+
+        system("@bunzip2@ < $srcNarBz2 > $tmpDir/A") == 0
             or die "cannot unpack $srcNarBz2";
 
-        system("@bunzip2@ < $dstNarBz2 > $tmpdir/B") == 0
+        if ((stat "$tmpDir/A")[7] >= $maxNarSize) {
+            print "    skipping, source is too large\n";
+            next;
+        }
+        
+        system("@bunzip2@ < $dstNarBz2 > $tmpDir/B") == 0
             or die "cannot unpack $dstNarBz2";
 
-        system("@libexecdir@/bsdiff $tmpdir/A $tmpdir/B $tmpdir/DIFF") == 0
+        if ((stat "$tmpDir/B")[7] >= $maxNarSize) {
+            print "    skipping, destination is too large\n";
+            next;
+        }
+        
+        system("@libexecdir@/bsdiff $tmpDir/A $tmpDir/B $tmpDir/DIFF") == 0
             or die "cannot compute binary diff";
 
-        my $baseHash = `@bindir@/nix-hash --flat --type $hashAlgo --base32 $tmpdir/A` or die;
+        my $baseHash = `@bindir@/nix-hash --flat --type $hashAlgo --base32 $tmpDir/A` or die;
         chomp $baseHash;
 
-        my $narHash = `@bindir@/nix-hash --flat --type $hashAlgo --base32 $tmpdir/B` or die;
+        my $narHash = `@bindir@/nix-hash --flat --type $hashAlgo --base32 $tmpDir/B` or die;
         chomp $narHash;
 
-        my $narDiffHash = `@bindir@/nix-hash --flat --type $hashAlgo --base32 $tmpdir/DIFF` or die;
+        my $narDiffHash = `@bindir@/nix-hash --flat --type $hashAlgo --base32 $tmpDir/DIFF` or die;
         chomp $narDiffHash;
 
-        my $narDiffSize = (stat "$tmpdir/DIFF")[7];
+        my $narDiffSize = (stat "$tmpDir/DIFF")[7];
         my $dstNarBz2Size = (stat $dstNarBz2)[7];
 
+        print "    size $narDiffSize; full size $dstNarBz2Size\n";
+        
         if ($narDiffSize >= $dstNarBz2Size) {
             print "    rejecting; patch bigger than full archive\n";
             next;
         }
     
+        if ($narDiffSize / $dstNarBz2Size >= $maxPatchFraction) {
+            print "    rejecting; patch too large relative to full archive\n";
+            next;
+        }
+    
         my $finalName =
             "$narDiffHash.nar-bsdiff";
 
-        print "    size $narDiffSize; full size $dstNarBz2Size\n";
-        
         if (-e "$patchesDir/$finalName") {
             print "    not copying, already exists\n";
         }
 
         else {
 
-            system("cp '$tmpdir/DIFF' '$patchesDir/$finalName.tmp'") == 0
+            system("cp '$tmpDir/DIFF' '$patchesDir/$finalName.tmp'") == 0
                 or die "cannot copy diff";
             
             rename("$patchesDir/$finalName.tmp", "$patchesDir/$finalName")
@@ -337,11 +362,22 @@ foreach my $p (keys %dstOutPaths) {
 # patches that produce either paths in the destination or paths that
 # can be used as the base for other useful patches).
 
+print "propagating patches...\n";
+
 my $changed;
 do {
     # !!! we repeat this to reach the transitive closure; inefficient
     $changed = 0;
 
+    print "loop\n";
+
+    my %dstBasePaths;
+    foreach my $q (keys %dstPatches) {
+	foreach my $patch (@{$dstPatches{$q}}) {
+	    $dstBasePaths{$patch->{basePath}} = 1;
+	}
+    }
+
     foreach my $p (keys %srcPatches) {
         my $patchList = $srcPatches{$p};
 
@@ -349,22 +385,18 @@ do {
 
         # Is path $p included in the destination?  If so, include
         # patches that produce it.
-        $include = 1 if (defined $dstNarFiles{$p});
+        $include = 1 if defined $dstNarFiles{$p};
 
         # Is path $p a path that serves as a base for paths in the
         # destination?  If so, include patches that produce it.
-        foreach my $q (keys %dstPatches) {
-            foreach my $patch (@{$dstPatches{$q}}) {
-                # !!! check baseHash
-                $include = 1 if ($p eq $patch->{basePath});
-            }
-        }
+	# !!! check baseHash
+        $include = 1 if defined $dstBasePaths{$p};
 
         if ($include) {
             foreach my $patch (@{$patchList}) {
                 $changed = 1 if addPatch \%dstPatches, $p, $patch;
             }
-        }            
+        }
         
     }
     
@@ -373,4 +405,4 @@ do {
 
 # Rewrite the manifest of the destination (with the new patches).
 writeManifest "$dstDir/MANIFEST",
-    \%dstNarFiles, \%dstPatches, \%dstSuccessors;
+    \%dstNarFiles, \%dstPatches;

scripts/maintenance/gc-commands

@@ -0,0 +1,2 @@
+./gc-releases.pl /data/webserver/dist/*/*/MANIFEST > dead
+cat dead | xargs mv --target-directory=/data/webserver/trash/

scripts/maintenance/gc-releases.pl

@@ -1,38 +1,18 @@
-#! /usr/bin/perl -w
+#! /usr/bin/perl -w -I. -I..
 
 use strict;
 use readmanifest;
-
-
-# Read the archive directories.
-my @archives = ();
-my %archives;
-
-sub readDir {
-    my $dir = shift;
-    opendir(DIR, "$dir") or die "cannot open `$dir': $!";
-    my @as = readdir DIR;
-    foreach my $archive (@as) {
-        push @archives, $archive;
-        $archives{$archive} = "$dir/$archive";
-    }
-    closedir DIR;
-}
-
-readDir "/mnt/scratchy/eelco/public_html/nix-cache";
-readDir "/mnt/scratchy/eelco/public_html/patches";
-
-print STDERR scalar @archives, "\n";
+use readcache;
 
 
 # Read the manifests.
 my %narFiles;
+my %localPaths;
 my %patches;
-my %successors;
 
 foreach my $manifest (@ARGV) {
     print STDERR "loading $manifest\n";
-    if (readManifest($manifest, \%narFiles, \%patches, \%successors, 1) < 3) {
+    if (readManifest($manifest, \%narFiles, \%localPaths, \%patches, 1) < 3) {
 #        die "manifest `$manifest' is too old (i.e., for Nix <= 0.7)\n";
     }
 }
@@ -48,8 +28,8 @@ foreach my $narFile (keys %narFiles) {
         die unless defined $basename;
 #        print $basename, "\n";
         $usedFiles{$basename} = 1;
-        die "missing archive `$basename'"
-            unless defined $archives{$basename};
+        print STDERR "missing archive `$basename'\n"
+            unless defined $readcache::archives{$basename};
     }
 }
 
@@ -61,15 +41,15 @@ foreach my $patch (keys %patches) {
 #        print $basename, "\n";
         $usedFiles{$basename} = 1;
         die "missing archive `$basename'"
-            unless defined $archives{$basename};
+            unless defined $readcache::archives{$basename};
     }
 }
 
 
 # Print out the dead archives.
-foreach my $archive (@archives) {
+foreach my $archive (keys %readcache::archives) {
     next if $archive eq "." || $archive eq "..";
     if (!defined $usedFiles{$archive}) {
-        print $archives{$archive}, "\n";
+        print $readcache::archives{$archive}, "\n";
     }
 }

scripts/maintenance/readcache.pm

@@ -0,0 +1,21 @@
+package readcache;
+use strict;
+
+# Read the archive directories.
+our %archives;
+
+sub readDir {
+    my $dir = shift;
+    opendir(DIR, "$dir") or die "cannot open `$dir': $!";
+    my @as = readdir DIR;
+    foreach my $archive (@as) {
+        $archives{$archive} = "$dir/$archive";
+    }
+    closedir DIR;
+}
+
+readDir "/data/webserver/dist/nix-cache";
+readDir "/data/webserver/dist/test-cache";
+readDir "/data/webserver/dist/patches";
+
+print STDERR scalar (keys %archives), "\n";

scripts/maintenance/shrink-manifest.pl

@@ -0,0 +1,76 @@
+#! /usr/bin/perl -w -I. -I..
+
+use strict;
+use readmanifest;
+use readcache;
+
+
+my %allNarFiles;
+my %allLocalPaths;
+my %allPatches;
+
+foreach my $manifest (glob "/data/webserver/dist/*/*/MANIFEST") {
+    print STDERR "loading $manifest\n";
+    readManifest($manifest, \%allNarFiles, \%allLocalPaths, \%allPatches, 1);
+}
+
+
+
+foreach my $manifest (@ARGV) {
+
+    print STDERR "shrinking manifest $manifest...\n";
+
+    my %narFiles;
+    my %patches;
+
+    if (readManifest($manifest, \%narFiles, \%patches, 1) < 3) {
+        print STDERR "manifest `$manifest' is too old (i.e., for Nix <= 0.7)\n";
+	next;
+    }
+
+    my %done;
+
+    sub traverse {
+	my $p = shift;
+	my $prefix = shift;
+	print "$prefix$p\n";
+
+	my $reachesNAR = 0;
+
+	foreach my $patch (@{$patches{$p}}) {
+	    next if defined $done{$patch->{url}};
+	    $done{$patch->{url}} = 1;
+	    $reachesNAR = 1 if traverse ($patch->{basePath}, $prefix . "  ");
+	}
+
+	$reachesNAR = 1 if defined $allNarFiles{$p};
+
+	print "  $prefix$reachesNAR\n";
+	return $reachesNAR;
+    }
+
+#    foreach my $p (keys %narFiles) {
+#	traverse ($p, "");
+#    }
+
+    my %newPatches;
+
+    foreach my $p (keys %patches) {
+	my $patchList = $patches{$p};
+	my @newList;
+	foreach my $patch (@{$patchList}) {
+	    if (! defined $allNarFiles{$patch->{basePath}} || 
+		! defined $allNarFiles{$p} ) 
+	    {
+#		print "REMOVING PATCH ", $patch->{basePath}, " -> ", $p, "\n";
+	    } else {
+#		print "KEEPING PATCH ", $patch->{basePath}, " -> ", $p, "\n";
+		push @newList, $patch;
+	    }
+	}
+	$newPatches{$p} = \@newList;
+    }
+
+    writeManifest ($manifest, \%narFiles, \%newPatches);
+}
+

scripts/nix-build.in

@@ -1,59 +1,140 @@
-#! @shell@ -e
+#! @perl@ -w -I@libexecdir@/nix
 
-nixExpr=$1
-
-if test -z "$nixExpr"; then
-    echo "syntax: $0 NIX-EXPR..." >&2
-    exit 1
-fi
-
-extraArgs=
-addDrvLink=0
-addOutLink=1
+use strict;
 
 
-trap 'rm -f ./.nix-build-tmp-*' EXIT
+my $addDrvLink = 0;
+my $addOutLink = 1;
+
+my $outLink;
+my $drvLink;
+
+my @instArgs = ();
+my @buildArgs = ();
+my @exprs = ();
 
 
-# Process the arguments.
-for i in "$@"; do
-    case "$i" in
-    
-        --add-drv-link)
-            addDrvLink=1
-            ;;
-            
-        --no-link)
-            addOutLink=0
-            ;;
-            
-        -*)
-            extraArgs="$extraArgs $i"
-            ;;
-            
-        *)
-            # Instantiate the Nix expression.
-            prefix=
-            if test "$addDrvLink" = 0; then prefix=.nix-build-tmp-; fi
-            storeExprs=$(@bindir@/nix-instantiate \
-                --add-root ./${prefix}derivation --indirect \
-                "$i")
-                
-            for j in $storeExprs; do
-                echo "store expression is $(readlink "$j")" >&2
-            done
+END {
+    foreach my $fn (glob ".nix-build-tmp-*") {
+        unlink $fn;
+    }
+}
 
-            # Build the resulting store derivation.
-            prefix=
-            if test "$addOutLink" = 0; then prefix=.nix-build-tmp-; fi
-            outPaths=$(@bindir@/nix-store \
-                --add-root ./${prefix}result --indirect \
-                -rv $extraArgs $storeExprs)
-                
-            for j in $outPaths; do
-                echo "$(readlink "$j")"
-            done
-            
-            ;;
-    esac
-done
+sub intHandler {
+    exit 1;
+}
+
+$SIG{'INT'} = 'intHandler';
+
+
+for (my $n = 0; $n < scalar @ARGV; $n++) {
+    my $arg = $ARGV[$n];
+
+    if ($arg eq "--help") {
+        print STDERR <<EOF;
+Usage: nix-build [OPTION]... [FILE]...
+
+`nix-build' builds the given Nix expressions (which
+default to ./default.nix if none are given).  A symlink called
+`result' is placed in the current directory.
+
+Flags:
+  --add-drv-link: create a symlink `derivation' to the store derivation
+  --drv-link NAME: create symlink NAME instead of `derivation'
+  --no-out-link: do not create the `result' symlink
+  --out-link / -o NAME: create symlink NAME instead of `result'
+  --attr ATTR: select a specific attribution from the Nix expression
+
+Any additional flags are passed to `nix-store'.
+EOF
+        exit 0;
+        # '` hack
+    }
+
+    elsif ($arg eq "--add-drv-link") {
+        $addDrvLink = 1;
+    }
+
+    elsif ($arg eq "--no-out-link" or $arg eq "--no-link") {
+        $addOutLink = 0;
+    }
+
+    elsif ($arg eq "--drv-link") {
+        $n++;
+        die "$0: `$arg' requires an argument\n" unless $n < scalar @ARGV;
+        $drvLink = $ARGV[$n];
+    }
+
+    elsif ($arg eq "--out-link" or $arg eq "-o") {
+        $n++;
+        die "$0: `$arg' requires an argument\n" unless $n < scalar @ARGV;
+        $outLink = $ARGV[$n];
+    }
+
+    elsif ($arg eq "--attr" or $arg eq "-A") {
+        $n++;
+        die "$0: `--attr' requires an argument\n" unless $n < scalar @ARGV;
+        push @instArgs, ("--attr", $ARGV[$n]);
+    }
+
+    elsif ($arg eq "--arg" || $arg eq "--argstr") {
+        die "$0: `$arg' requires two arguments\n" unless $n + 2 < scalar @ARGV;
+        push @instArgs, ($arg, $ARGV[$n + 1], $ARGV[$n + 2]);
+        $n += 2;
+    }
+
+    elsif ($arg eq "--max-jobs" or $arg eq "-j" or $arg eq "--max-silent-time") {
+        $n++;
+        die "$0: `$arg' requires an argument\n" unless $n < scalar @ARGV;
+        push @buildArgs, ($arg, $ARGV[$n]);
+    }
+
+    elsif (substr($arg, 0, 1) eq "-") {
+        push @buildArgs, $arg;
+    }
+
+    else {
+        push @exprs, $arg;
+    }
+}
+
+@exprs = ("./default.nix") if scalar @exprs == 0;
+
+
+if (!defined $drvLink) {
+    $drvLink = "derivation";
+    $drvLink = ".nix-build-tmp-" . $drvLink if !$addDrvLink;
+}
+
+if (!defined $outLink) {
+    $outLink = "result";
+    $outLink = ".nix-build-tmp-" . $outLink if !$addOutLink;
+}
+
+
+foreach my $expr (@exprs) {
+
+    # Instantiate.
+    my @drvPaths;
+    # !!! would prefer the perl 5.8.0 pipe open feature here.
+    my $pid = open(DRVPATHS, "-|") || exec "@bindir@/nix-instantiate", "--add-root", $drvLink, "--indirect", @instArgs, $expr;
+    while (<DRVPATHS>) {chomp; push @drvPaths, $_;}
+    close DRVPATHS or exit 1;
+
+    foreach my $drvPath (@drvPaths) {
+        my $target = readlink $drvPath or die "cannot read symlink `$drvPath'";
+        print STDERR "store derivation is $target\n";
+    }
+
+    # Build.
+    my @outPaths;
+    $pid = open(OUTPATHS, "-|") || exec "@bindir@/nix-store", "--add-root", $outLink, "--indirect", "-rv",
+        @buildArgs, @drvPaths;
+    while (<OUTPATHS>) {chomp; push @outPaths, $_;}
+    close OUTPATHS or exit 1;
+
+    foreach my $outPath (@outPaths) {
+        my $target = readlink $outPath or die "cannot read symlink `$outPath'";
+        print "$target\n";
+    }
+}

scripts/nix-channel.in

@@ -2,13 +2,24 @@
 
 use strict;
 
-my $rootsDir = "@localstatedir@/nix/gcroots/channels";
+my $rootsDir = "@localstatedir@/nix/gcroots";
+
+my $stateDir = $ENV{"NIX_STATE_DIR"};
+$stateDir = "@localstatedir@/nix" unless defined $stateDir;
+
+
+# Turn on caching in nix-prefetch-url.
+my $channelCache = "$stateDir/channel-cache";
+mkdir $channelCache, 0755 unless -e $channelCache;
+$ENV{'NIX_DOWNLOAD_CACHE'} = $channelCache if -W $channelCache;
 
 
 # Figure out the name of the `.nix-channels' file to use.
 my $home = $ENV{"HOME"};
 die '$HOME not set' unless defined $home;
 my $channelsList = "$home/.nix-channels";
+
+my $nixDefExpr = "$home/.nix-defexpr";
     
 
 my @channels;
@@ -20,6 +31,7 @@ sub readChannels {
     open CHANNELS, "<$channelsList" or die "cannot open `$channelsList': $!";
     while (<CHANNELS>) {
         chomp;
+        next if /^\s*\#/;
         push @channels, $_;
     }
     close CHANNELS;
@@ -66,56 +78,72 @@ sub removeChannel {
 sub update {
     readChannels;
 
-    # Get rid of all the old substitutes.
-    system "@bindir@/nix-store --clear-substitutes";
-    die "cannot clear substitutes" if ($? != 0);
+    # Do we have write permission to the manifests directory?  If not,
+    # then just skip pulling the manifest and just download the Nix
+    # expressions.  If the user is a non-privileged user in a
+    # multi-user Nix installation, he at least gets installation from
+    # source.
+    if (-W "$stateDir/manifests") {
+
+        # Remove all the old manifests.
+        for my $manifest (glob "$stateDir/manifests/*.nixmanifest") {
+            unlink $manifest or die "cannot remove `$manifest': $!";
+        }
+
+        # Pull cache manifests.
+        foreach my $url (@channels) {
+            #print "pulling cache manifest from `$url'\n";
+            system("@bindir@/nix-pull", "--skip-wrong-store", "$url/MANIFEST") == 0
+                or die "cannot pull cache manifest from `$url'";
+        }
 
-    # Pull cache manifests.
-    foreach my $url (@channels) {
-        print "pulling cache manifest from `$url'\n";
-        system "@bindir@/nix-pull '$url'/MANIFEST";
-        die "cannot pull cache manifest from `$url'" if ($? != 0);
     }
 
     # Create a Nix expression that fetches and unpacks the channel Nix
     # expressions.
 
-    my $nixExpr = "[";
+    my $inputs = "[";
     foreach my $url (@channels) {
+        $url =~ /\/([^\/]+)\/?$/;
+        my $channelName = $1;
+        $channelName = "unnamed" unless defined $channelName;
+
         my $fullURL = "$url/nixexprs.tar.bz2";
+        print "downloading Nix expressions from `$fullURL'...\n";
         $ENV{"PRINT_PATH"} = 1;
-        my ($hash, $path) = `@bindir@/nix-prefetch-url '$fullURL' 2> /dev/null`;
+        $ENV{"QUIET"} = 1;
+        my ($hash, $path) = `@bindir@/nix-prefetch-url '$fullURL'`;
         die "cannot fetch `$fullURL'" if $? != 0;
         chomp $path;
-        $nixExpr .= $path . " ";
+        $inputs .= '"' . $channelName . '"' . " " . $path . " ";
     }
-    $nixExpr .= "]";
-
-    $nixExpr =
-        "(import @datadir@/nix/corepkgs/channels/unpack.nix) " .
-        "{inputs = $nixExpr; system = \"@system@\";}";
+    $inputs .= "]";
 
     # Figure out a name for the GC root.
     my $userName = getpwuid($<);
     die "who ARE you? go away" unless defined $userName;
 
-    my $rootFile = "$rootsDir/$userName";
+    my $rootFile = "$rootsDir/per-user/$userName/channels";
     
     # Instantiate the Nix expression.
-    my $storeExpr = `echo '$nixExpr' | @bindir@/nix-instantiate --add-root '$rootFile'.tmp -`
+    print "unpacking channel Nix expressions...\n";
+    my $storeExpr = `@bindir@/nix-instantiate --add-root '$rootFile'.tmp @datadir@/nix/corepkgs/channels/unpack.nix --argstr system @system@ --arg inputs '$inputs'`
         or die "cannot instantiate Nix expression";
     chomp $storeExpr;
 
     # Build the resulting derivation.
-    my $outPath = `nix-store --add-root '$rootFile' -r '$storeExpr'`
+    my $outPath = `@bindir@/nix-store --add-root '$rootFile' -r '$storeExpr'`
         or die "cannot realise store expression";
     chomp $outPath;
 
     unlink "$rootFile.tmp";
 
-    # Make it the default Nix expression for `nix-env'.
-    system "@bindir@/nix-env --import '$outPath'";
-    die "cannot pull set default Nix expression to `$outPath'" if ($? != 0);
+    # Make the channels appear in nix-env.
+    unlink $nixDefExpr if -l $nixDefExpr; # old-skool ~/.nix-defexpr
+    mkdir $nixDefExpr or die "cannot create directory `$nixDefExpr'" if !-e $nixDefExpr;
+    my $channelLink = "$nixDefExpr/channels";
+    unlink $channelLink; # !!! not atomic
+    symlink($outPath, $channelLink) or die "cannot symlink `$channelLink' to `$outPath'";
 }
 
 

scripts/nix-collect-garbage.in

@@ -1,2 +1,51 @@
-#! @shell@ -e
-exec @bindir@/nix-store --gc "$@"
+#! @perl@ -w
+
+use strict;
+
+my $profilesDir = "@localstatedir@/nix/profiles";
+
+
+# Process the command line arguments.
+my @args = ();
+my $removeOld = 0;
+
+for my $arg (@ARGV) {
+    if ($arg eq "--delete-old" || $arg eq "-d") {
+        $removeOld = 1;
+    } else {
+        push @args, $arg;
+    }
+}
+
+
+# If `-d' was specified, remove all old generations of all profiles.
+# Of course, this makes rollbacks to before this point in time
+# impossible.
+
+sub removeOldGenerations;
+sub removeOldGenerations {
+    my $dir = shift;
+
+    my $dh;
+    opendir $dh, $dir or die;
+
+    foreach my $name (sort (readdir $dh)) {
+        next if $name eq "." || $name eq "..";
+        $name = $dir . "/" . $name;
+        if (-l $name && (readlink($name) =~ /link/)) {
+            print STDERR "removing old generations of profile $name\n";
+            system("@bindir@/nix-env", "-p", $name, "--delete-generations", "old");
+        }
+        elsif (! -l $name && -d $name) {
+            removeOldGenerations $name;
+        }
+    }
+    
+    closedir $dh or die;
+}
+
+removeOldGenerations $profilesDir if $removeOld;
+
+
+# Run the actual garbage collector.
+exec "@bindir@/nix-store", "--gc", @args;

scripts/nix-copy-closure.in

@@ -0,0 +1,148 @@
+#! @perl@ -w
+
+my $binDir = $ENV{"NIX_BIN_DIR"};
+$binDir = "@bindir@" unless defined $binDir;
+
+
+if (scalar @ARGV < 1) {
+    print STDERR <<EOF
+Usage: nix-copy-closure [--from | --to] HOSTNAME [--sign] [--gzip] PATHS...
+EOF
+    ;
+    exit 1;
+}
+
+
+# Get the target host.
+my $sshHost;
+my @sshOpts = split ' ', ($ENV{"NIX_SSHOPTS"} or "");
+
+my $sign = 0;
+
+my $compressor = "cat";
+my $decompressor = "cat";
+
+my $toMode = 1;
+
+
+# !!! Copied from nix-pack-closure, should put this in a module.
+my @storePaths = ();
+
+while (@ARGV) {
+    my $arg = shift @ARGV;
+    
+    if ($arg eq "--sign") {
+        $sign = 1;
+    }
+    elsif ($arg eq "--gzip") {
+        $compressor = "gzip";
+        $decompressor = "gunzip";
+    }
+    elsif ($arg eq "--from") {
+        $toMode = 0;
+    }
+    elsif ($arg eq "--to") {
+        $toMode = 1;
+    }
+    elsif (!defined $sshHost) {
+        $sshHost = $arg;
+    }
+    else {
+        push @storePaths, $arg;
+    }
+}
+
+
+if ($toMode) { # Copy TO the remote machine.
+
+    my @allStorePaths;
+    my %storePathsSeen;
+
+    foreach my $storePath (@storePaths) {
+        # $arg might be a symlink to the store, so resolve it.
+        my $storePath2 = (`$binDir/nix-store --query --resolve '$storePath'`
+            or die "cannot resolve `$storePath'");
+        chomp $storePath2;
+
+        # Get the closure of this path.
+        my $pid = open(READ,
+            "$binDir/nix-store --query --requisites '$storePath2'|") or die;
+    
+        while (<READ>) {
+            chomp;
+            die "bad: $_" unless /^\//;
+            if (!defined $storePathsSeen{$_}) {
+                push @allStorePaths, $_;
+                $storePathsSeen{$_} = 1;
+            }
+        }
+
+        close READ or die "nix-store failed: $?";
+    }
+
+
+    # Ask the remote host which paths are invalid.
+    open(READ, "ssh @sshOpts $sshHost nix-store --check-validity --print-invalid @allStorePaths|");
+    my @missing = ();
+    while (<READ>) {
+        chomp;
+        print STDERR "target machine needs $_\n";
+        push @missing, $_;
+    }
+    close READ or die;
+
+
+    # Export the store paths and import them on the remote machine.
+    if (scalar @missing > 0) {
+        my $extraOpts = "";
+        $extraOpts .= "--sign" if $sign == 1;
+        system("nix-store --export $extraOpts @missing | $compressor | ssh @sshOpts $sshHost '$decompressor | nix-store --import'") == 0
+            or die "copying store paths to remote machine `$sshHost' failed: $?";
+    }
+
+}
+
+
+else { # Copy FROM the remote machine.
+
+    # Query the closure of the given store paths on the remote
+    # machine.  Paths are assumed to be store paths; there is no
+    # resolution (following of symlinks).
+    my $pid = open(READ,
+        "ssh @sshOpts $sshHost nix-store --query --requisites @storePaths|") or die;
+    
+    my @allStorePaths;
+    my %storePathsSeen;
+
+    while (<READ>) {
+        chomp;
+        die "bad: $_" unless /^\//;
+        if (!defined $storePathsSeen{$_}) {
+            push @allStorePaths, $_;
+            $storePathsSeen{$_} = 1;
+        }
+    }
+
+    close READ or die "nix-store on remote machine `$sshHost' failed: $?";
+
+
+    # What paths are already valid locally?
+    open(READ, "@bindir@/nix-store --check-validity --print-invalid @allStorePaths|");
+    my @missing = ();
+    while (<READ>) {
+        chomp;
+        print STDERR "local machine needs $_\n";
+        push @missing, $_;
+    }
+    close READ or die;
+    
+
+    # Export the store paths on the remote machine and import them on locally.
+    if (scalar @missing > 0) {
+        my $extraOpts = "";
+        $extraOpts .= "--sign" if $sign == 1;
+        system("ssh @sshOpts $sshHost 'nix-store --export $extraOpts @missing | $compressor' | $decompressor | @bindir@/nix-store --import") == 0
+            or die "copying store paths to remote machine `$sshHost' failed: $?";
+    }
+
+}

scripts/nix-install-package.in

@@ -1,28 +1,107 @@
 #! @perl@ -w
 
 use strict;
-use POSIX qw(tmpnam);
+use File::Temp qw(tempdir);
 
-my $pkgFile = $ARGV[0];
-die unless defined $pkgFile;
+
+sub usageError {
+    print STDERR <<EOF;
+Usage: nix-install-package (FILE | --url URL)
+
+Install a Nix Package (.nixpkg) either directly from FILE or by
+downloading it from URL.
+
+Flags:
+  --profile / -p LINK: install into the specified profile
+  --non-interactive: don't run inside a new terminal
+EOF
+    ; # '
+    exit 1;
+}
+
+
+# Parse the command line arguments.
+my @args = @ARGV;
+usageError if scalar @args == 0;
+
+my $source;
+my $fromURL = 0;
+my @extraNixEnvArgs = ();
+my $interactive = 1;
+
+while (scalar @args) {
+    my $arg = shift @args;
+    if ($arg eq "--help") {
+        usageError;
+    }
+    elsif ($arg eq "--url") {
+        $fromURL = 1;
+    }
+    elsif ($arg eq "--profile" || $arg eq "-p") {
+        my $profile = shift @args;
+        usageError if !defined $profile;
+        push @extraNixEnvArgs, "-p", $profile;
+    }
+    elsif ($arg eq "--non-interactive") {
+        $interactive = 0;
+    }
+    else {
+        $source = $arg;
+    }
+}
+
+usageError unless defined $source;
 
 
 # Re-execute in a terminal, if necessary, so that if we're executed
 # from a web browser, the user gets to see us.
-if (!defined $ENV{"NIX_HAVE_TERMINAL"}) {
+if ($interactive && !defined $ENV{"NIX_HAVE_TERMINAL"}) {
     $ENV{"NIX_HAVE_TERMINAL"} = "1";
     $ENV{"LD_LIBRARY_PATH"} = "";
-    exec("xterm", "-e", "@shell@", "-c", "@bindir@/nix-install-package '$pkgFile' || read");
+    foreach my $term ("xterm", "konsole", "gnome-terminal", "xterm") {
+        exec($term, "-e", "@bindir@/nix-install-package", @ARGV);
+    }
     die "cannot execute `xterm'";
 }
 
 
+my $tmpDir = tempdir("nix-install-package.XXXXXX", CLEANUP => 1, TMPDIR => 1)
+    or die "cannot create a temporary directory";
+
+
+sub barf {
+    my $msg = shift;
+    print "$msg\n";
+    <STDIN> if $interactive;
+    exit 1;
+}
+
+
+# Download the package description, if necessary.
+my $pkgFile = $source;
+if ($fromURL) {
+    $pkgFile = "$tmpDir/tmp.nixpkg";
+    system("@curl@", "--silent", $source, "-o", $pkgFile) == 0
+        or barf "curl failed: $?";
+}
+
+
 # Read and parse the package file.
-open PKGFILE, "<$pkgFile" or die "cannot open `$pkgFile': $!";
+open PKGFILE, "<$pkgFile" or barf "cannot open `$pkgFile': $!";
 my $contents = <PKGFILE>;
 close PKGFILE;
 
-$contents =~ /^\s*(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)/ or die "invalid package contents";
+my $urlRE = "(?: [a-zA-Z][a-zA-Z0-9\+\-\.]*\:[a-zA-Z0-9\%\/\?\:\@\&\=\+\$\,\-\_\.\!\~\*\']+ )";
+my $nameRE = "(?: [A-Za-z0-9\+\-\.\_\?\=]+ )"; # see checkStoreName()
+my $systemRE = "(?: [A-Za-z0-9\+\-\_]+ )";
+my $pathRE = "(?: \/ [\/A-Za-z0-9\+\-\.\_\?\=]* )";
+
+# Note: $pathRE doesn't check that whether we're looking at a valid
+# store path.  We'll let nix-env do that.
+
+$contents =~
+    / ^ \s* (\S+) \s+ ($urlRE) \s+ ($nameRE) \s+ ($systemRE) \s+ ($pathRE) \s+ ($pathRE) /x
+    or barf "invalid package contents";
 my $version = $1;
 my $manifestURL = $2;
 my $drvName = $3;
@@ -30,22 +109,29 @@ my $system = $4;
 my $drvPath = $5;
 my $outPath = $6;
 
-die "invalid package version `$version'" unless $version eq "NIXPKG1";
+barf "invalid package version `$version'" unless $version eq "NIXPKG1";
 
 
-# Ask confirmation.
-print "Do you want to install `$drvName' (Y/N)? ";
-my $reply = <STDIN>;
-chomp $reply;
-exit if $reply ne "y" && $reply ne "Y";
+if ($interactive) {
+    # Ask confirmation.
+    print "Do you want to install `$drvName' (Y/N)? ";
+    my $reply = <STDIN>;
+    chomp $reply;
+    exit if $reply ne "y" && $reply ne "Y";
+}
+
 
 print "\nPulling manifests...\n";
-system "@bindir@/nix-pull '$manifestURL'";
-die if $? != 0;
+system("@bindir@/nix-pull", $manifestURL) == 0
+    or barf "nix-pull failed: $?";
+
 
 print "\nInstalling package...\n";
-system "@bindir@/nix-env -i '$outPath'";
-die if $? != 0;
+system("@bindir@/nix-env", "--install", $outPath, "--force-name", $drvName, @extraNixEnvArgs) == 0
+    or barf "nix-env failed: $?";
 
-print "\nInstallation succeeded! Press Enter to continue.\n";
-<STDIN>;
+
+if ($interactive) {
+    print "\nInstallation succeeded! Press Enter to continue.\n";
+    <STDIN>;
+}

scripts/nix-pack-closure.in

@@ -0,0 +1,75 @@
+#! @perl@ -w
+
+# This tool computes the closure of a path (using "nix-store --query
+# --requisites") and puts the contents of each path in the closure in
+# a big NAR archive that can be installed on another Nix installation
+# using "nix-unpack-closure".
+
+# TODO: make this program "streamy", i.e., don't use a temporary
+# directory.
+
+use strict;
+use File::Temp qw(tempdir);
+
+my $binDir = $ENV{"NIX_BIN_DIR"};
+$binDir = "@bindir@" unless defined $binDir;
+
+my $tmpDir = tempdir("nix-pack-closure.XXXXXX", CLEANUP => 1, TMPDIR => 1)
+    or die "cannot create a temporary directory";
+
+mkdir "$tmpDir/contents", 0755 or die;
+mkdir "$tmpDir/references", 0755 or die;
+mkdir "$tmpDir/derivers", 0755 or die;
+
+open TOPLEVEL, ">$tmpDir/top-level" or die;
+
+
+my %storePaths;
+
+
+while (@ARGV) {
+    my $storePath = shift @ARGV;
+
+    # $storePath might be a symlink to the store, so resolve it.
+    $storePath = (`$binDir/nix-store --query --resolve '$storePath'`
+        or die "cannot resolve `$storePath'");
+    chomp $storePath;
+    print TOPLEVEL $storePath, "\n";
+
+    # Get the closure of this path.
+    my $pid = open(READ,
+        "$binDir/nix-store --query --requisites '$storePath'|") or die;
+    
+    while (<READ>) {
+        chomp;
+        die "bad: $_" unless /^\//;
+        $storePaths{$_} = "";
+    }
+
+    close READ or die "nix-store failed: $?";
+}
+
+
+close TOPLEVEL or die;
+
+
+foreach my $storePath (sort(keys %storePaths)) {
+    print STDERR "packing `$storePath'...\n";
+
+    $storePath =~ /\/([^\/]+)$/;
+    my $name = $1;
+
+    system("$binDir/nix-store --dump '$storePath' > $tmpDir/contents/$name") == 0
+        or die "nix-store --dump failed on `$storePath': $?";
+
+    system("$binDir/nix-store --query --references '$storePath' > $tmpDir/references/$name") == 0
+        or die "nix-store --query --references failed on `$storePath': $?";
+
+    system("$binDir/nix-store --query --deriver '$storePath' > $tmpDir/derivers/$name") == 0
+        or die "nix-store --query --deriver failed on `$storePath': $?";
+}
+
+
+# Write a NAR archive of everything to standard output.
+system("nix-store --dump '$tmpDir'") == 0
+    or die "nix-store --dump failed";

scripts/nix-prefetch-url.in

@@ -3,9 +3,12 @@
 url=$1
 expHash=$2
 
+# needed to make it work on NixOS
+export PATH=$PATH:@coreutils@
+
 hashType=$NIX_HASH_ALGO
 if test -z "$hashType"; then
-    hashType=md5
+    hashType=sha256
 fi
 
 hashFormat=
@@ -33,29 +36,94 @@ if test -n "$expHash"; then
 fi
 
 
+mkTempDir() {
+    local i=0
+    while true; do
+        if test -z "$TMPDIR"; then TMPDIR=/tmp; fi
+        tmpPath=$TMPDIR/nix-prefetch-url-$$-$i
+        if mkdir "$tmpPath"; then break; fi
+        # !!! to bad we can't check for ENOENT in mkdir, so this check
+        # is slightly racy (it bombs out if somebody just removed
+        # $tmpPath...).
+        if ! test -e "$tmpPath"; then exit 1; fi
+        i=$((i + 1))
+    done
+    trap removeTempDir EXIT SIGINT SIGQUIT
+}
+
+removeTempDir() {
+    if test -n "$tmpPath"; then
+        rm -rf "$tmpPath" || true
+    fi
+}
+
+
+doDownload() {
+    @curl@ $cacheFlags --fail -# --location --max-redirs 20 --disable-epsv \
+        --cookie-jar $tmpPath/cookies "$url" -o $tmpFile
+}
+
+
 # If we don't know the hash or a file with that hash doesn't exist,
 # download the file and add it to the store.
 if test -z "$finalPath"; then
 
-    tmpPath=/tmp/nix-prefetch-url-$$ # !!! security?
+    mkTempDir
     tmpFile=$tmpPath/$name
-    mkdir $tmpPath
+
+    # Optionally do timestamp-based caching of the download.
+    # Actually, the only thing that we cache in $NIX_DOWNLOAD_CACHE is
+    # the hash and the timestamp of the file at $url.  The caching of
+    # the file *contents* is done in Nix store, where it can be
+    # garbage-collected independently.
+    if test -n "$NIX_DOWNLOAD_CACHE"; then
+        echo -n "$url" > $tmpPath/url
+        urlHash=$(nix-hash --type sha256 --base32 --flat $tmpPath/url)
+        echo "$url" > "$NIX_DOWNLOAD_CACHE/$urlHash.url"
+        cachedHashFN="$NIX_DOWNLOAD_CACHE/$urlHash.$hashType"
+        cachedTimestampFN="$NIX_DOWNLOAD_CACHE/$urlHash.stamp"
+        cacheFlags="--remote-time"
+        if test -e "$cachedTimestampFN" -a -e "$cachedHashFN"; then
+            # Only download the file if it is newer than the cached version.
+            cacheFlags="$cacheFlags --time-cond $cachedTimestampFN"
+        fi
+    fi
 
     # Perform the download.
-    @curl@ --fail --location --max-redirs 20 "$url" > $tmpFile
+    doDownload
 
-    # Compute the hash.
-    hash=$(@bindir@/nix-hash --type "$hashType" $hashFormat --flat $tmpFile)
-    if ! test -n "$QUIET"; then echo "hash is $hash" >&2; fi
+    if test -n "$NIX_DOWNLOAD_CACHE" -a ! -e $tmpFile; then
+        # Curl didn't create $tmpFile, so apparently there's no newer
+        # file on the server.
+        hash=$(cat $cachedHashFN)
+        finalPath=$(@bindir@/nix-store --print-fixed-path "$hashType" "$hash" "$name") 
+        if ! @bindir@/nix-store --check-validity "$finalPath" 2> /dev/null; then
+            echo "cached contents of \`$url' disappeared, redownloading..." >&2
+            finalPath=
+            cacheFlags="--remote-time"
+            doDownload
+        fi
+    fi
 
-    # Add the downloaded file to the Nix store.
-    finalPath=$(@bindir@/nix-store --add-fixed "$hashType" $tmpFile)
+    if test -z "$finalPath"; then
 
-    if test -n "$tmpPath"; then rm -rf $tmpPath || true; fi
+        # Compute the hash.
+        hash=$(@bindir@/nix-hash --type "$hashType" $hashFormat --flat $tmpFile)
+        if ! test -n "$QUIET"; then echo "hash is $hash" >&2; fi
 
-    if test -n "$expHash" -a "$expHash" != "$hash"; then
-        echo "hash mismatch for URL \`$url'"
-        exit 1
+        if test -n "$NIX_DOWNLOAD_CACHE"; then
+            echo $hash > $cachedHashFN
+            touch -r $tmpFile $cachedTimestampFN
+        fi
+
+        # Add the downloaded file to the Nix store.
+        finalPath=$(@bindir@/nix-store --add-fixed "$hashType" $tmpFile)
+
+        if test -n "$expHash" -a "$expHash" != "$hash"; then
+            echo "hash mismatch for URL \`$url'" >&2
+            exit 1
+        fi
+        
     fi
 fi
 

scripts/nix-profile.sh.in

@@ -2,9 +2,9 @@ if test -n "$HOME"; then
     NIX_LINK="$HOME/.nix-profile"
 
     if ! test -L "$NIX_LINK"; then
-        echo "creating $NIX_LINK"
+        echo "creating $NIX_LINK" >&2
         _NIX_DEF_LINK=@localstatedir@/nix/profiles/default
-        ln -s "$_NIX_DEF_LINK" "$NIX_LINK"
+        @coreutils@/ln -s "$_NIX_DEF_LINK" "$NIX_LINK"
     fi
 
     export PATH=$NIX_LINK/bin:@prefix@/bin:$PATH

scripts/nix-pull.in

@@ -1,17 +1,11 @@
 #! @perl@ -w -I@libexecdir@/nix
 
 use strict;
-use IPC::Open2;
-use POSIX qw(tmpnam);
+use File::Temp qw(tempdir);
 use readmanifest;
 
-my $tmpdir;
-do { $tmpdir = tmpnam(); }
-until mkdir $tmpdir, 0777;
-
-my $manifest = "$tmpdir/manifest";
-
-END { unlink $manifest; rmdir $tmpdir; }
+my $tmpDir = tempdir("nix-pull.XXXXXX", CLEANUP => 1, TMPDIR => 1)
+    or die "cannot create a temporary directory";
 
 my $binDir = $ENV{"NIX_BIN_DIR"};
 $binDir = "@bindir@" unless defined $binDir;
@@ -22,28 +16,76 @@ $libexecDir = "@libexecdir@" unless defined $libexecDir;
 my $stateDir = $ENV{"NIX_STATE_DIR"};
 $stateDir = "@localstatedir@/nix" unless defined $stateDir;
 
+my $storeDir = $ENV{"NIX_STORE_DIR"};
+$storeDir = "@storedir@" unless defined $storeDir;
+
+my $storeStateDir = $ENV{"NIX_STORE_STATE_DIR"};
+$storeStateDir = "@storestatedir@" unless defined $storeStateDir;
+
+my $ext3cowheader = $ENV{"NIX_EXT3_COW_HEADER"};
+$ext3cowheader = "@ext3cowheader@" unless defined $ext3cowheader;
 
 # Prevent access problems in shared-stored installations.
 umask 0022;
 
 
-# Obtain URLs either from the command line or from a configuration file.
+# Process the URLs specified on the command line.
 my %narFiles;
+my %localPaths;
 my %patches;
-my %successors;
+
+my $skipWrongStore = 0;
+
+sub downloadFile {
+    my $url = shift;
+    $ENV{"PRINT_PATH"} = 1;
+    $ENV{"QUIET"} = 1;
+    my ($dummy, $path) = `$binDir/nix-prefetch-url '$url'`;
+    die "cannot fetch `$url'" if $? != 0;
+    die "nix-prefetch-url did not return a path" unless defined $path;
+    chomp $path;
+    return $path;
+}
 
 sub processURL {
     my $url = shift;
 
     $url =~ s/\/$//;
-    print "obtaining list of Nix archives at $url...\n";
 
-    system("@curl@ --fail --silent --show-error --location --max-redirs 20 " .
-           "'$url' > '$manifest'") == 0
-           or die "curl failed: $?";
+    my $manifest;
 
-    if (readManifest($manifest, \%narFiles, \%patches, \%successors) < 3) {
-        die "manifest `$url' is too old (i.e., for Nix <= 0.7)\n";
+    # First see if a bzipped manifest is available.
+    if (system("@curl@ --fail --silent --head '$url'.bz2 > /dev/null") == 0) {
+        print "obtaining list of Nix archives at `$url.bz2'...\n";
+        my $bzipped = downloadFile "$url.bz2";
+
+        $manifest = "$tmpDir/MANIFEST";
+
+        system("@bunzip2@ < $bzipped > $manifest") == 0
+            or die "cannot decompress manifest";
+
+        $manifest = (`$binDir/nix-store --add $manifest`
+                     or die "cannot copy $manifest to the store");
+        chomp $manifest;
+    }
+
+    # Otherwise, just get the uncompressed manifest.
+    else {
+        print "obtaining list of Nix archives at `$url'...\n";
+        $manifest = downloadFile $url;
+    }
+    
+    if (readManifest($manifest, \%narFiles, \%localPaths, \%patches) < 3) {
+        die "`$url' is not manifest or it is too old (i.e., for Nix <= 0.7)\n";
+    }
+
+    if ($skipWrongStore) {
+        foreach my $path (keys %narFiles) {
+            if (substr($path, 0, length($storeDir) + 1) ne "$storeDir/") {
+                print STDERR "warning: manifest `$url' assumes a Nix store at a different location than $storeDir, skipping...\n";
+                exit 0;
+            }
+        }
     }
 
     my $baseName = "unnamed";
@@ -57,45 +99,19 @@ sub processURL {
     
     my $finalPath = "$stateDir/manifests/$baseName-$hash.nixmanifest";
     
-    system("mv -f '$manifest' '$finalPath'") == 0
-        or die "cannot move `$manifest' to `$finalPath";
+    system("@coreutils@/ln", "-sfn", "$manifest", "$finalPath") == 0
+        or die "cannot link `$finalPath to `$manifest'";
 }
 
 while (@ARGV) {
     my $url = shift @ARGV;
-    processURL $url;
-}
-
-
-my $size = scalar (keys %narFiles);
-print "$size store paths in manifest\n";
-
-
-# Register all substitutes.
-print STDERR "registering substitutes...\n";
-
-my $pid = open2(\*READ, \*WRITE, "$binDir/nix-store --register-substitutes")
-    or die "cannot run nix-store";
-
-close READ;
-
-foreach my $storePath (keys %narFiles) {
-    my $narFileList = $narFiles{$storePath};
-    foreach my $narFile (@{$narFileList}) {
-        print WRITE "$storePath\n";
-        print WRITE "$narFile->{deriver}\n";
-        print WRITE "$libexecDir/nix/download-using-manifests.pl\n";
-        print WRITE "0\n";
-        my @references = split " ", $narFile->{references};
-        my $count = scalar @references;
-        print WRITE "$count\n";
-        foreach my $reference (@references) {
-            print WRITE "$reference\n";
-        }
+    if ($url eq "--skip-wrong-store") {
+        $skipWrongStore = 1;
+    } else {
+        processURL $url;
     }
 }
 
-close WRITE;
 
-waitpid $pid, 0;
-$? == 0 or die "nix-store failed";
+my $size = scalar (keys %narFiles) + scalar (keys %localPaths);
+print "$size store paths in manifest\n";

scripts/nix-push.in

@@ -1,20 +1,16 @@
 #! @perl@ -w -I@libexecdir@/nix
 
 use strict;
-use IPC::Open2;
-use POSIX qw(tmpnam);
+use File::Temp qw(tempdir);
 use readmanifest;
 
 my $hashAlgo = "sha256";
 
-my $tmpdir;
-do { $tmpdir = tmpnam(); }
-until mkdir $tmpdir, 0777;
+my $tmpDir = tempdir("nix-push.XXXXXX", CLEANUP => 1, TMPDIR => 1)
+    or die "cannot create a temporary directory";
 
-my $nixfile = "$tmpdir/create-nars.nix";
-my $manifest = "$tmpdir/MANIFEST";
-
-END { unlink $manifest; unlink $nixfile; rmdir $tmpdir; }
+my $nixExpr = "$tmpDir/create-nars.nix";
+my $manifest = "$tmpDir/MANIFEST";
 
 my $curl = "@curl@ --fail --silent";
 my $extraCurlFlags = ${ENV{'CURL_FLAGS'}};
@@ -32,20 +28,42 @@ my $localCopy;
 my $localArchivesDir;
 my $localManifestFile;
 
+my $targetArchivesUrl;
+
 my $archivesPutURL;
 my $archivesGetURL;
 my $manifestPutURL;
 
+sub showSyntax {
+    print STDERR <<EOF
+Usage: nix-push --copy ARCHIVES_DIR MANIFEST_FILE PATHS...
+   or: nix-push ARCHIVES_PUT_URL ARCHIVES_GET_URL MANIFEST_PUT_URL PATHS...
+
+`nix-push' copies or uploads the closure of PATHS to the given
+destination.
+EOF
+    ; # `
+    exit 1;
+}
+
+showSyntax if scalar @ARGV < 1;
+
 if ($ARGV[0] eq "--copy") {
-    die "syntax: nix-push --copy ARCHIVES_DIR MANIFEST_FILE PATHS...\n" if scalar @ARGV < 3;
+    showSyntax if scalar @ARGV < 3;
     $localCopy = 1;
     shift @ARGV;
     $localArchivesDir = shift @ARGV;
     $localManifestFile = shift @ARGV;
+    if ($ARGV[0] eq "--target") {
+       shift @ARGV;
+       $targetArchivesUrl = shift @ARGV;
+    }
+    else {
+       $targetArchivesUrl = "file://$localArchivesDir";
+    }
 }
 else {
-    die "syntax: nix-push ARCHIVES_PUT_URL ARCHIVES_GET_URL " .
-        "MANIFEST_PUT_URL PATHS...\n" if scalar @ARGV < 3;
+    showSyntax if scalar @ARGV < 3;
     $localCopy = 0;
     $archivesPutURL = shift @ARGV;
     $archivesGetURL = shift @ARGV;
@@ -62,20 +80,17 @@ foreach my $path (@ARGV) {
 
     # Get all paths referenced by the normalisation of the given 
     # Nix expression.
-    my $pid = open2(\*READ, \*WRITE,
+    my $pid = open(READ,
         "$binDir/nix-store --query --requisites --force-realise " .
-        "--include-outputs '$path'") or die;
-    close WRITE;
+        "--include-outputs '$path'|") or die;
     
     while (<READ>) {
         chomp;
         die "bad: $_" unless /^\//;
         $storePaths{$_} = "";
     }
-    close READ;
-    
-    waitpid $pid, 0;
-    $? == 0 or die "nix-store failed";
+
+    close READ or die "nix-store failed: $?";
 }
 
 my @storePaths = keys %storePaths;
@@ -83,16 +98,16 @@ my @storePaths = keys %storePaths;
 
 # For each path, create a Nix expression that turns the path into
 # a Nix archive.
-open NIX, ">$nixfile";
+open NIX, ">$nixExpr";
 print NIX "[";
 
 foreach my $storePath (@storePaths) {
-    die unless ($storePath =~ /\/[0-9a-z]{32}.*$/);
+    die unless ($storePath =~ /\/[0-9a-z]{32}[^\"\\\$]*$/);
 
     # Construct a Nix expression that creates a Nix archive.
     my $nixexpr = 
         "((import $dataDir/nix/corepkgs/nar/nar.nix) " .
-        "{path = \"$storePath\"; system = \"@system@\"; hashAlgo = \"$hashAlgo\";}) ";
+        "{storePath = builtins.toPath \"$storePath\"; system = \"@system@\"; hashAlgo = \"$hashAlgo\";}) ";
     
     print NIX $nixexpr;
 }
@@ -101,21 +116,17 @@ print NIX "]";
 close NIX;
 
 
-# Instantiate store expressions from the Nix expression.
+# Instantiate store derivations from the Nix expression.
 my @storeExprs;
-print STDERR "instantiating store expressions...\n";
-my $pid = open2(\*READ, \*WRITE, "$binDir/nix-instantiate $nixfile")
+print STDERR "instantiating store derivations...\n";
+my $pid = open(READ, "$binDir/nix-instantiate $nixExpr|")
     or die "cannot run nix-instantiate";
-close WRITE;
 while (<READ>) {
     chomp;
     die unless /^\//;
     push @storeExprs, $_;
 }
-close READ;
-
-waitpid $pid, 0;
-$? == 0 or die "nix-instantiate failed";
+close READ or die "nix-instantiate failed: $?";
 
 
 # Realise the store expressions.
@@ -130,18 +141,19 @@ while (scalar @tmp > 0) {
     my @tmp2 = @tmp[0..$n - 1];
     @tmp = @tmp[$n..scalar @tmp - 1];
 
-    my $pid = open2(\*READ, \*WRITE, "$binDir/nix-store --realise @tmp2")
+    # Note: we disable build hooks because of the impure path
+    # reference (see above).  Even if that is fixed, using a hook
+    # probably wouldn't make that much sense; pumping lots of data
+    # around just to compress them won't gain that much.
+    $ENV{"NIX_BUILD_HOOK"} = "";
+    my $pid = open(READ, "$binDir/nix-store --no-build-hook --realise @tmp2|")
         or die "cannot run nix-store";
-    close WRITE;
     while (<READ>) {
         chomp;
         die unless (/^\//);
         push @narPaths, "$_";
     }
-    close READ;
-
-    waitpid $pid, 0;
-    $? == 0 or die "nix-store failed";
+    close READ or die "nix-store failed: $?";
 }
 
 
@@ -191,7 +203,7 @@ for (my $n = 0; $n < scalar @storePaths; $n++) {
 
     my $url;
     if ($localCopy) {
-        $url = "file://$localArchivesDir/$narName";
+        $url = "$targetArchivesUrl/$narName";
     } else {
         $url = "$archivesGetURL/$narName";
     }
@@ -212,7 +224,7 @@ writeManifest $manifest, \%narFiles, \%patches;
 sub copyFile {
     my $src = shift;
     my $dst = shift;
-    system("cp '$src' '$dst.tmp'") == 0 or die "cannot copy file";
+    system("@coreutils@/cp", $src, "$dst.tmp") == 0 or die "cannot copy file";
     rename("$dst.tmp", "$dst") or die "cannot rename file";
 }
 
@@ -252,8 +264,12 @@ foreach my $narArchive (@narArchives) {
 print STDERR "uploading manifest...\n";
 if ($localCopy) {
     copyFile $manifest, $localManifestFile;
+    copyFile "$manifest.bz2", "$localManifestFile.bz2";
 } else {
-    system("$curl  --show-error --upload-file " .
+    system("$curl --show-error --upload-file " .
            "'$manifest' '$manifestPutURL' > /dev/null") == 0 or
            die "curl failed on $manifest: $?";
+    system("$curl --show-error --upload-file " .
+           "'$manifest'.bz2 '$manifestPutURL'.bz2 > /dev/null") == 0 or
+           die "curl failed on $manifest: $?";
 }

scripts/nix-reduce-build.in

@@ -0,0 +1,68 @@
+#! @shell@
+
+WORKING_DIRECTORY=$(mktemp -d "${TMPDIR:-/tmp}"/nix-reduce-build-XXXXXX);
+cd "$WORKING_DIRECTORY";
+
+if test -z "$1" ; then
+	echo 'nix-reduce-build (paths or Nix expressions) -- (logins at remote computers)' >&2
+	echo As in: >&2
+	echo nix-reduce-build /etc/nixos/nixos -- user@somewhere.nowhere.example.org >&2
+	exit;
+fi;
+
+while ! test "$1" = "--" || test "$1" = "" ; do 
+	echo "$1" >> initial; >&2
+	shift;
+done
+shift;
+echo Will work on $(cat initial | wc -l) targets. >&2
+
+while read ; do
+	case "$REPLY" in 
+		${NIX_STORE_PATH:-/nix/store}/*)
+			echo "$REPLY" >> paths; >&2
+			;;
+		*)
+			nix-instantiate "$REPLY" >> paths;
+			;;
+	esac;
+done < initial;
+echo Proceeding $(cat paths | wc -l) paths. >&2
+
+while read; do
+	case "$REPLY" in
+		*.drv)
+			echo "$REPLY" >> derivers; >&2
+			;;
+		*)
+			nix-store --query --deriver "$REPLY" >>derivers;
+			;;
+	esac;
+done < paths;
+echo Found $(cat derivers | wc -l) derivers. >&2
+
+cat derivers | xargs nix-store --query -R > derivers-closure;
+echo Proceeding at most $(cat derivers-closure | wc -l) derivers. >&2
+
+cat derivers-closure | egrep '[.]drv$' | xargs nix-store --query --outputs > wanted-paths;
+cat derivers-closure | egrep -v '[.]drv$' >> wanted-paths;
+echo Prepared $(cat wanted-paths | wc -l) paths to get. >&2
+
+cat wanted-paths | xargs nix-store --check-validity --print-invalid > needed-paths;
+echo We need $(cat needed-paths | wc -l) paths. >&2
+
+if test -z "$1" ; then
+	cat needed-paths;	
+fi;
+
+for i in "$@"; do 
+	cat needed-paths | while read; do 
+		nix-copy-closure --from "$i" --gzip "$REPLY" </dev/null || true; 
+	done;
+	mv needed-paths wanted-paths;
+	cat wanted-paths | xargs nix-store --check-validity --print-invalid > needed-paths;
+	echo We still need $(cat needed-paths | wc -l) paths. >&2
+done;
+
+cd /
+rm -r "$WORKING_DIRECTORY"

scripts/nix-unpack-closure.in

@@ -0,0 +1,88 @@
+#! @perl@ -w
+
+# This tool unpacks the closures created by "nix-pack-closure" and
+# adds them to the Nix store.
+
+# TODO: make this program "streamy", i.e., don't use a temporary
+# directory.
+
+use strict;
+use File::Temp qw(tempdir);
+
+my $binDir = $ENV{"NIX_BIN_DIR"};
+$binDir = "@bindir@" unless defined $binDir;
+
+my $tmpDir = tempdir("nix-unpack-closure.XXXXXX", CLEANUP => 1, TMPDIR => 1)
+    or die "cannot create a temporary directory";
+
+
+# Unpack the NAR archive on standard input.
+system("nix-store --restore '$tmpDir/unpacked'") == 0
+    or die "nix-store --restore failed";
+
+
+open VALID, ">$tmpDir/validity" or die;
+
+
+# For each path in the closure that is not yet valid, add it to the
+# store.  TODO: use proper locking.  Or even better, let nix-store do
+# this.
+opendir(DIR, "$tmpDir/unpacked/contents") or die "cannot open directory: $!";
+
+foreach my $name (sort(readdir DIR)) {
+    next if $name eq "." or $name eq "..";
+
+    my $storePath = "@storedir@/$name"; # !!!
+
+    # !!! this really isn't a good validity check!
+    system "$binDir/nix-store --check-validity '$storePath' 2> /dev/null";
+    if ($? != 0) {
+        print STDERR "unpacking `$storePath'...\n";
+
+        # !!! race
+        system("@coreutils@/rm -rf '$storePath'") == 0
+            or die "cannot remove `$storePath': $?";
+
+        system("$binDir/nix-store --restore '$storePath' < '$tmpDir/unpacked/contents/$name'") == 0
+            or die "nix-store --dump failed on `$storePath': $?";
+        
+        print VALID "$storePath\n";
+
+        open DRV, "<$tmpDir/unpacked/derivers/$name" or die;
+        my $deriver = <DRV>;
+        chomp $deriver;
+        $deriver = "" if $deriver eq "unknown-deriver";
+        close DRV;
+
+        my @refs;
+        open REFS, "<$tmpDir/unpacked/references/$name" or die;
+        while (<REFS>) {
+            chomp;
+            push @refs, $_;
+        }
+        close REFS;
+
+        print VALID "$deriver\n";
+        
+        print VALID (scalar @refs), "\n";
+        foreach my $ref (@refs) {
+            print VALID "$ref\n";
+        }
+    }
+}
+
+closedir(DIR) or die;
+
+
+# Register the invalid paths as valid.
+system("nix-store --register-validity <'$tmpDir/validity'") == 0
+    or die "nix-store --register-validity failed";
+
+
+# Show the top-level paths so that something useful can be done with
+# them, e.g., passing them to `nix-env -i'.
+if (-e "$tmpDir/unpacked/top-level") {
+    open TOPLEVEL, "<$tmpDir/unpacked/top-level" or die;
+    while (<TOPLEVEL>) { print "$_"; }
+    close TOPLEVEL;
+}

scripts/optimise-store.pl

@@ -1,69 +0,0 @@
-#! /usr/bin/perl -w
-
-use strict;
-
-{ my $ofh = select STDOUT;
-  $| = 1;
-  select $ofh;
-}
-
-#my @paths = ("/nix/store/caef3a49150506d233f474322a824e50-glibc-2.3.3", "/nix/store/a8a9d585d1ad4b1bc911be7743b3b996-glibc-2.3.3");
-my @paths = ("/nix/store");
-
-my $tmpfile = "/tmp/nix-optimise-hash-list";
-#my $tmpfile = "/data/nix-optimise-hash-list";
-
-system("find @paths -type f -print0 | xargs -0 md5sum -- > $tmpfile") == 0
-    or die "cannot hash store files";
-
-system("sort $tmpfile > $tmpfile.sorted") == 0
-    or die "cannot sort list";
-
-open LIST, "<$tmpfile.sorted" or die;
-
-my $prevFile;
-my $prevHash;
-
-my $totalSpace = 0;
-my $savedSpace = 0;
-
-my $files = 0;
-
-while (<LIST>) {
-#    print "D";
-    /^([0-9a-f]*)\s+(.*)$/ or die;
-    my $curFile = $2;
-    my $curHash = $1;
-
-#    print "A";
-    my $fileSize = (stat $curFile)[7];
-#    print "B";
-#    my $fileSize = 1;
-    $totalSpace += $fileSize;
-
-    if (defined $prevHash && $curHash eq $prevHash) {
-        
-#        print "$curFile = $prevFile\n";
-
-        $savedSpace += $fileSize;
-        
-    } else {
-        $prevFile = $curFile;
-        $prevHash = $curHash;
-    }
-
-    print "." if ($files++ % 100 == 0);
-    #print ".";
-
-#    print "C";
-}
-
-print "\n";
-
-print "total space = $totalSpace\n";
-print "saved space = $savedSpace\n";
-my $savings = ($savedSpace / $totalSpace) * 100.0;
-print "savings = $savings %\n";
-
-
-close LIST;

scripts/prebuilts.conf

@@ -1,2 +0,0 @@
-# A list of URLs from where `nix-pull' obtain Nix archives if
-# no URL is specified on the command line.

scripts/readconfig.pm.in

@@ -0,0 +1,17 @@
+use strict;
+
+sub readConfig {
+    my %config;
+    my $config = "@sysconfdir@/nix/nix.conf";
+    return unless -f $config;
+    
+    open CONFIG, "<$config" or die "cannot open `$config'";
+    while (<CONFIG>) {
+        /^\s*([\w|-]+)\s*=\s*(.*)$/ or next;
+        $config{$1} = $2;
+        print "|$1| -> |$2|\n";
+    }
+    close CONFIG;
+}
+
+return 1;

scripts/readmanifest.pm.in

@@ -34,8 +34,8 @@ sub addPatch {
 sub readManifest {
     my $manifest = shift;
     my $narFiles = shift;
+    my $localPaths = shift;
     my $patches = shift;
-    my $successors = shift;
     my $allowConflicts = shift;
     $allowConflicts = 0 unless defined $allowConflicts;
 
@@ -51,7 +51,6 @@ sub readManifest {
     my $url;
     my $hash;
     my $size;
-    my @preds;
     my $basePath;
     my $baseHash;
     my $patchType;
@@ -59,6 +58,7 @@ sub readManifest {
     my $references;
     my $deriver;
     my $hashAlgo;
+    my $copyFrom;
 
     while (<MANIFEST>) {
         chomp;
@@ -75,7 +75,6 @@ sub readManifest {
                 undef $url;
                 undef $hash;
                 undef $size;
-                @preds = ();
                 undef $narHash;
                 undef $basePath;
                 undef $baseHash;
@@ -117,10 +116,6 @@ sub readManifest {
                             };
                     }
                 
-                    foreach my $p (@preds) {
-                        $$successors{$p} = $storePath;
-                    }
-
                 }
 
                 elsif ($type eq "patch") {
@@ -132,13 +127,29 @@ sub readManifest {
                         }, $allowConflicts;
                 }
 
+                elsif ($type eq "localPath") {
+
+                    $$localPaths{$storePath} = []
+                        unless defined $$localPaths{$storePath};
+
+                    my $localPathsList = $$localPaths{$storePath};
+
+                    # !!! remove duplicates
+                    
+                    push @{$localPathsList},
+                        { copyFrom => $copyFrom, references => $references
+                        , deriver => ""
+                        };
+                }
+
             }
             
             elsif (/^\s*StorePath:\s*(\/\S+)\s*$/) { $storePath = $1; }
+            elsif (/^\s*CopyFrom:\s*(\/\S+)\s*$/) { $copyFrom = $1; }
             elsif (/^\s*Hash:\s*(\S+)\s*$/) { $hash = $1; }
             elsif (/^\s*URL:\s*(\S+)\s*$/) { $url = $1; }
             elsif (/^\s*Size:\s*(\d+)\s*$/) { $size = $1; }
-            elsif (/^\s*SuccOf:\s*(\/\S+)\s*$/) { push @preds, $1; }
+            elsif (/^\s*SuccOf:\s*(\/\S+)\s*$/) { } # obsolete
             elsif (/^\s*BasePath:\s*(\/\S+)\s*$/) { $basePath = $1; }
             elsif (/^\s*BaseHash:\s*(\S+)\s*$/) { $baseHash = $1; }
             elsif (/^\s*Type:\s*(\S+)\s*$/) { $patchType = $1; }
@@ -165,6 +176,7 @@ sub writeManifest
     my $manifest = shift;
     my $narFiles = shift;
     my $patches = shift;
+    my $copySources = shift;
 
     open MANIFEST, ">$manifest.tmp"; # !!! check exclusive
 
@@ -172,7 +184,7 @@ sub writeManifest
     print MANIFEST "  ManifestVersion: 3\n";
     print MANIFEST "}\n";
 
-    foreach my $storePath (keys %{$narFiles}) {
+    foreach my $storePath (sort (keys %{$narFiles})) {
         my $narFileList = $$narFiles{$storePath};
         foreach my $narFile (@{$narFileList}) {
             print MANIFEST "{\n";
@@ -189,7 +201,7 @@ sub writeManifest
         }
     }
     
-    foreach my $storePath (keys %{$patches}) {
+    foreach my $storePath (sort (keys %{$patches})) {
         my $patchList = $$patches{$storePath};
         foreach my $patch (@{$patchList}) {
             print MANIFEST "patch {\n";
@@ -210,6 +222,14 @@ sub writeManifest
 
     rename("$manifest.tmp", $manifest)
         or die "cannot rename $manifest.tmp: $!";
+
+
+    # Create a bzipped manifest.
+    system("@bzip2@ < $manifest > $manifest.bz2.tmp") == 0
+        or die "cannot compress manifest";
+
+    rename("$manifest.bz2.tmp", "$manifest.bz2")
+        or die "cannot rename $manifest.bz2.tmp: $!";
 }
 
 

scripts/remove-patches.pl

@@ -6,14 +6,12 @@ use readmanifest;
 for my $p (@ARGV) {
 
     my %narFiles;
+    my %localPaths;
     my %patches;
-    my %successors;
 
-    readManifest $p,
-        \%narFiles, \%patches, \%successors;
+    readManifest $p, \%narFiles, \%localPaths, \%patches;
 
     %patches = ();
     
-    writeManifest $p,
-        \%narFiles, \%patches, \%successors;
+    writeManifest $p, \%narFiles, \%patches;
 }

scripts/show-duplication.pl

@@ -0,0 +1,73 @@
+#! /usr/bin/perl -w
+
+if (scalar @ARGV != 1) {
+    print "syntax: show-duplication.pl PATH\n";
+    exit 1;
+}
+
+my $root = $ARGV[0];
+
+
+my $nameRE = "(?:(?:[A-Za-z0-9\+\_]|(?:-[^0-9]))+)";
+my $versionRE = "(?:[A-Za-z0-9\.\-]+)";
+
+
+my %pkgInstances;
+
+
+my $pid = open(PATHS, "-|") || exec "nix-store", "-qR", $root;
+while (<PATHS>) {
+    chomp;
+    /^.*\/[0-9a-z]*-(.*)$/;
+    my $nameVersion = $1;
+    $nameVersion =~ /^($nameRE)(-($versionRE))?$/;
+    $name = $1;
+    $version = $3;
+    $version = "(unnumbered)" unless defined $version;
+#    print "$nameVersion $name $version\n";
+    push @{$pkgInstances{$name}}, {version => $version, path => $_};
+}
+close PATHS or exit 1;
+
+
+sub pathSize {
+    my $path = shift;
+    my @st = lstat $path or die;
+
+    my $size = $st[7];
+
+    if (-d $path) {
+        opendir DIR, $path or die;
+        foreach my $name (readdir DIR) {
+            next if $name eq "." || $name eq "..";
+            $size += pathSize("$path/$name");
+        }
+    }
+    
+    return $size;
+}
+
+
+my $totalPaths = 0;
+my $totalSize = 0, $totalWaste = 0;
+
+foreach my $name (sort {scalar @{$pkgInstances{$b}} <=> scalar @{$pkgInstances{$a}}} (keys %pkgInstances)) {
+    print "$name ", scalar @{$pkgInstances{$name}}, "\n";
+    my $allSize = 0;
+    foreach my $x (sort {$a->{version} cmp $b->{version}} @{$pkgInstances{$name}}) {
+        $totalPaths++;
+        my $size = pathSize $x->{path};
+        $allSize += $size;
+        print "    $x->{version} $size\n";
+    }
+    my $avgSize = int($allSize / scalar @{$pkgInstances{$name}});
+    my $waste = $allSize - $avgSize;
+    $totalSize += $allSize;
+    $totalWaste += $waste;
+    print "    average $avgSize, waste $waste\n";
+}
+
+
+my $avgDupl = $totalPaths / scalar (keys %pkgInstances);
+my $wasteFactor = ($totalWaste / $totalSize) * 100;
+print "average package duplication $avgDupl, total size $totalSize, total waste $totalWaste, $wasteFactor% wasted\n";

scripts/update-manifest.pl

@@ -8,10 +8,10 @@ die unless scalar @ARGV == 2;
 my $cache = $ARGV[0];
 my $manifest = $ARGV[1];
 my %narFiles;
+my %localPaths;
 my %patches;
-my %successors;
 
-readManifest $manifest, \%narFiles, \%patches, \%successors;
+readManifest $manifest, \%narFiles, \%localPaths, \%patches;
 
 foreach my $storePath (keys %narFiles) {
     my $narFileList = $narFiles{$storePath};
@@ -50,4 +50,4 @@ if (! -e "$manifest.backup") {
     system "mv --reply=no '$manifest' '$manifest.backup'";
 }
 
-writeManifest $manifest, \%narFiles, \%patches, \%successors;
+writeManifest $manifest, \%narFiles, \%patches;