From da5e5cf2aa4ec06f6b493b3ea905304b9e3abab9 Mon Sep 17 00:00:00 2001 From: Bernardo Magri Date: Fri, 29 May 2026 22:01:46 +0100 Subject: [PATCH] ci: create nixbld build users for root single-user Nix install MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Empty group wasn't enough — this Nix version errors with "build users group 'nixbld' has no members". Create the nixbld group plus 10 build users (what a multi-user install does) before running the installer. Co-Authored-By: Claude Opus 4.8 --- .gitea/workflows/check.yml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/.gitea/workflows/check.yml b/.gitea/workflows/check.yml index bf4b933..83cc171 100644 --- a/.gitea/workflows/check.yml +++ b/.gitea/workflows/check.yml @@ -44,12 +44,16 @@ jobs: # node-runtime coupling. Single-user (--no-daemon) needs no systemd, # which the catthehacker container doesn't run as PID 1. # - # The installer runs as root here and validates build-users-group= - # nixbld from its bundled nix.conf even in single-user mode, aborting - # if the group is missing. Pre-create an empty nixbld group so that - # check passes — single-user builds run as root and never use it. + # The installer runs as root here and honours build-users-group= + # nixbld from its bundled nix.conf, aborting unless that group exists + # AND has members. Create the nixbld group + build users (what a + # multi-user install does) before running it. run: | - groupadd -r nixbld || true + groupadd -r nixbld 2>/dev/null || true + for i in $(seq 1 10); do + useradd -r -g nixbld -G nixbld -d /var/empty \ + -s /usr/sbin/nologin -c "Nix build user $i" "nixbld$i" 2>/dev/null || true + done curl -L https://nixos.org/nix/install | sh -s -- --no-daemon echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"