nix: update by giuseppe · Pull Request #2057 · containers/crun

giuseppe · 2026-03-23T07:42:15Z

No description provided.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

gemini-code-assist · 2026-03-23T07:42:26Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on maintaining the project's dependency hygiene by upgrading the core Nix package collection (nixpkgs). This update ensures that the project benefits from the latest available packages, security patches, and features within the Nix ecosystem, while also introducing new configuration options for fetching the repository.

Highlights

Nixpkgs Update: The pinned version of nixpkgs has been updated to a more recent revision (9cf954d) from May 2025 to March 2026, reflecting newer dependencies and potentially bug fixes or features.
Nix Configuration Additions: Two new configuration fields, 'fetchTags' and 'rootDir', have been added to the nixpkgs.json file, enhancing the flexibility of how the nixpkgs repository is fetched and used.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request updates the pinned version of nixpkgs. The lock file nix/nixpkgs.json contains several unused fields and a date value that is unusually far in the future. I've suggested simplifying the file to include only the necessary fields for better clarity and maintainability.

nix/nixpkgs.json

packit-as-a-service · 2026-03-23T20:22:04Z

Ephemeral COPR build failed. @containers/packit-build please check.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

The Makefile rule for git-version.h requires .git or .tarball-git-version.h, neither of which exists in the Nix sandbox. Generate the header directly before compiling. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Replace the manual nixpkgs.json pin and 5 duplicate default-{arch}.nix files with a single flake.nix. Architecture configs are consolidated into one map, making it a one-line change to add a new target. The LIBS string in derivation.nix is refactored into a structured list for readability. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Use a bind mount to /nix (cacheable in CI) but seed it from the container image when /nix/store doesn't exist yet. The init container mounts the host's /nix at /host-nix and copies the container's /nix contents into it. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

The git+file: flake ref requires libgit2 to open the repo, which fails with safe.directory errors when the bind-mounted repo is owned by a different user. Previous workarounds (GIT_CONFIG env vars, mounting /etc/gitconfig) leaked configuration into nix build subprocesses and triggered the "/homeless-shelter" purity check. Switch to path: flake refs which read the filesystem directly, bypassing libgit2 entirely. Submodules are already checked out by autogen.sh before the nix builds start. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Move static library overrides out of the global nixpkgs overlay and into local variables in flake.nix. This prevents the massive rebuild cascade caused by globally overriding packages like systemdMinimal and libcap, allowing standard packages (gcc, python3, pkg-config, etc.) to be fetched from the Nix binary cache. Also removes 4 unused overrides (gpgme, libassuan, libgpgerror, zstd). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

giuseppe · 2026-03-24T20:53:57Z

@saschagrunert the build on s390x takes forever and causes the CI to timeout. Do you've any suggestions on what we can do? Should we just disable s390x for the artifacts?

packit-as-a-service · 2026-03-24T21:06:58Z

TMT tests failed. @containers/packit-build please check.

saschagrunert · 2026-03-25T07:27:09Z

@saschagrunert the build on s390x takes forever and causes the CI to timeout. Do you've any suggestions on what we can do? Should we just disable s390x for the artifacts?

I use cachix for such cases. When it takes too long I'd usually build and push the cache from my local computer and then let the CI pick it up. Updating the cache is then optional because the nixpkgs are pinned. Right now we only have a local cache as it seems.

See: https://github.com/cri-o/cri-o/blob/848f93a0d92411ce905755536a829de9a9219f61/.github/workflows/test.yml#L120-L127

zlib's configure script detects s390x vector extensions but fails to export VGFMAFLAG, causing the build to fail with '__builtin_s390_vec_*' requires '-mvx'. Apply the upstream fix (madler/zlib#1171) as a patch, gated behind an overlay that only activates for s390x builds. Upstream: madler/zlib#1200 Fix: NixOS/nixpkgs#502917 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

giuseppe · 2026-03-25T13:16:42Z

thanks to Claude finally they pass

@saschagrunert PTAL

giuseppe · 2026-03-25T13:41:19Z

thanks!

nix: update

094c97f

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

gemini-code-assist bot reviewed Mar 23, 2026

View reviewed changes

nix/nixpkgs.json Outdated Show resolved Hide resolved

giuseppe force-pushed the update-nixpkgs-23-march-2026 branch 3 times, most recently from e6b3ebb to 48ba22a Compare March 23, 2026 20:17

giuseppe and others added 3 commits March 23, 2026 21:33

nix: bump nixos/nix image from 2.24.9 to 2.34.2

3e9986b

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

giuseppe force-pushed the update-nixpkgs-23-march-2026 branch 2 times, most recently from 97c9941 to ca8cb8d Compare March 24, 2026 10:53

giuseppe and others added 3 commits March 24, 2026 14:45

giuseppe force-pushed the update-nixpkgs-23-march-2026 branch from 9022f22 to 70fc9e6 Compare March 24, 2026 14:01

giuseppe force-pushed the update-nixpkgs-23-march-2026 branch from 70fc9e6 to f11729b Compare March 24, 2026 20:57

giuseppe force-pushed the update-nixpkgs-23-march-2026 branch from f11729b to d02b8d1 Compare March 25, 2026 08:15

giuseppe force-pushed the update-nixpkgs-23-march-2026 branch from d02b8d1 to 5699da2 Compare March 25, 2026 11:05

saschagrunert approved these changes Mar 25, 2026

View reviewed changes

giuseppe merged commit 061d2bb into containers:main Mar 25, 2026
48 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

nix: update#2057

nix: update#2057
giuseppe merged 8 commits intocontainers:mainfrom
giuseppe:update-nixpkgs-23-march-2026

giuseppe commented Mar 23, 2026

Uh oh!

gemini-code-assist bot commented Mar 23, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

packit-as-a-service bot commented Mar 23, 2026

Uh oh!

giuseppe commented Mar 24, 2026

Uh oh!

packit-as-a-service bot commented Mar 24, 2026

Uh oh!

saschagrunert commented Mar 25, 2026 •

edited

Loading

Uh oh!

giuseppe commented Mar 25, 2026

Uh oh!

giuseppe commented Mar 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

giuseppe commented Mar 23, 2026

Uh oh!

gemini-code-assist bot commented Mar 23, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

packit-as-a-service bot commented Mar 23, 2026

Uh oh!

giuseppe commented Mar 24, 2026

Uh oh!

packit-as-a-service bot commented Mar 24, 2026

Uh oh!

saschagrunert commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giuseppe commented Mar 25, 2026

Uh oh!

giuseppe commented Mar 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

saschagrunert commented Mar 25, 2026 •

edited

Loading