From 3306761905d5174e1ddd3b4b45609ff8598c54cc Mon Sep 17 00:00:00 2001 From: niftynei Date: Sat, 15 Aug 2026 15:09:27 -0500 Subject: [PATCH 1/3] configure: fallback to using local python when `uv` not present Builds on NixOS are failing due to lack of python configuration > PYTHONPATH=contrib/msggen contrib/msggen/msggen/__main__.py bundle doc/schemas > /nix/store/rlq03x4cwf8zn73hxaxnx0zn5q9kifls-bash-5.3p3/bin/bash: line 1: contrib/msggen/msggen/__main__.py: Permission denied > make: *** [contrib/msggen/Makefile:15: contrib/msggen/msggen/schema.json] Error 126 We can: fail if not configured and use the local python3 path if/when `uv` doesn't work. We also add an error when PYTHON isn't configured, and remove the local override for the nix setup (since it should be fixed now). Changelog-Fixed: nix-builds: correctly set PYTHON in case where `uv` is not present --- configure | 12 ++++++++++++ nix/pkgs/default.nix | 5 ----- 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/configure b/configure index 0cd88749dc92..cfdaa7360942 100755 --- a/configure +++ b/configure @@ -82,6 +82,12 @@ default_python() echo "$p" return fi + # uv may be unavailable or unable to reach the network + # (offline/sandboxed builds); fall back to the interpreter itself. + if $p --version 2>&1 | grep -q "Python 3."; then + echo "$p" + return + fi fi done } @@ -345,6 +351,12 @@ done # Now fill in any unset vars. set_defaults +if [ -z "$PYTHON" ]; then + echo "configure: no Python 3 interpreter found." >&2 + echo "Install python3, or set it explicitly: ./configure PYTHON=/path/to/python3" >&2 + exit 1 +fi + if [ "$ASAN" = "1" ]; then if [ "$VALGRIND" = "1" ]; then echo "Address sanitizer (ASAN) and valgrind cannot be enabled at the same time" diff --git a/nix/pkgs/default.nix b/nix/pkgs/default.nix index 1ac526d5604e..1c0684a3481a 100644 --- a/nix/pkgs/default.nix +++ b/nix/pkgs/default.nix @@ -77,11 +77,6 @@ stdenv.mkDerivation { configureFlags = [ "--disable-valgrind" ]; - # ./configure detects Python via `uv` (configure:default_python), which is not - # part of this derivation. Point it at the python3 we already provide so the - # codegen steps that call $(PYTHON) (e.g. devtools/blockreplace.py) work. - preConfigure = "export PYTHON=python3"; - enableParallelBuilding = true; # workaround for build issue, happens only x86_64-darwin, not aarch64-darwin From ded44467144f841a387f71793a9af4e46b0e0124 Mon Sep 17 00:00:00 2001 From: niftynei Date: Sat, 15 Aug 2026 16:17:23 -0500 Subject: [PATCH 2/3] rust: don't silently eat overflow errors in --release When running `nix build .#default -L` I came across two failures: > failures: > > ---- primitives::test::test_amount_add_overflow stdout ---- > note: test did not panic as expected at cln-rpc/src/primitives.rs:1064:8 > ---- primitives::test::test_amount_sub_overflow stdout ---- > note: test did not panic as expected at cln-rpc/src/primitives.rs:1057:8 > > failures: > primitives::test::test_amount_add_overflow > primitives::test::test_amount_sub_overflow > > test result: FAILED(B. 36 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s Rather than wrapping silently, we now error. Changelog-Fixed: rust: Amounts that overflow fail, don't silently ignore in release builds --- cln-rpc/src/primitives.rs | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/cln-rpc/src/primitives.rs b/cln-rpc/src/primitives.rs index 4e3ede37b8a9..f2f3f973a691 100644 --- a/cln-rpc/src/primitives.rs +++ b/cln-rpc/src/primitives.rs @@ -189,11 +189,13 @@ macro_rules! amount { self.$field } - fn checked_add(self, rhs: Self) -> Option { + /// Adds two amounts, returning `None` if the result overflows. + pub fn checked_add(self, rhs: Self) -> Option { self.$field.checked_add(rhs.$field).map($name::$from_fn) } - fn checked_sub(self, rhs: Self) -> Option { + /// Subtracts two amounts, returning `None` if the result underflows. + pub fn checked_sub(self, rhs: Self) -> Option { self.$field.checked_sub(rhs.$field).map($name::$from_fn) } } @@ -202,9 +204,8 @@ macro_rules! amount { type Output = Self; fn add(self, rhs: Self) -> Self { - Self { - $field: self.$field + rhs.$field, - } + self.checked_add(rhs) + .expect("attempt to add with overflow") } } @@ -212,9 +213,8 @@ macro_rules! amount { type Output = Self; fn sub(self, rhs: Self) -> Self::Output { - Self { - $field: self.$field - rhs.$field, - } + self.checked_sub(rhs) + .expect("attempt to subtract with overflow") } } From 0e05bc1a1a335df61619f262aa2d0bdc5568ed4f Mon Sep 17 00:00:00 2001 From: niftynei Date: Sat, 15 Aug 2026 16:50:42 -0500 Subject: [PATCH 3/3] nix-builds: on macos, dont attempt to start 2nd lowdown sandbox We're already in a sandbox when you're running `nix build`. MacOS explicitly disallows nested sandboxes. If on Darwin and running in a nix sandbox, we explicitly disable the `lowdown` sandbox Changelog-Fixed: macos: builds with lowdown succeed, as we no longer attempt to spawn a nested sandbox --- nix/pkgs/default.nix | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/nix/pkgs/default.nix b/nix/pkgs/default.nix index 1c0684a3481a..6a6d4de7784b 100644 --- a/nix/pkgs/default.nix +++ b/nix/pkgs/default.nix @@ -12,6 +12,19 @@ let p.grpcio-tools p.mako ]); + # lowdown uses sandbox_init(3) on Darwin, which fails when invoked from + # within Nix's existing build sandbox. Disable the redundant inner sandbox + # for this build-only lowdown dependency. + lowdownForBuild = + if stdenv.isDarwin then + lowdown.overrideAttrs (old: { + postPatch = (old.postPatch or "") + '' + substituteInPlace main.c \ + --replace-fail '#elif HAVE_SANDBOX_INIT' '#elif 0 /* Already sandboxed by Nix. */' + ''; + }) + else + lowdown; in stdenv.mkDerivation { name = "cln"; @@ -33,7 +46,7 @@ stdenv.mkDerivation { gettext gitMinimal libtool - lowdown + lowdownForBuild pkgconf py3 unzip