Skip to content

Nixos 26.05#31

Open
hertrste wants to merge 24 commits into
mainfrom
nixos-26.05
Open

Nixos 26.05#31
hertrste wants to merge 24 commits into
mainfrom
nixos-26.05

Conversation

@hertrste

@hertrste hertrste commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

A lot of changes in the python package builds were required. Additionally, some patches to certain libs that had breaking changes.

Summary by CodeRabbit

  • New Features
    • Improved build/packaging compatibility across many components by switching Python builds to pyproject/PEP 517 workflows and standard build-system declarations.
    • Updated Horizon, Neutron, and Nova packaging wiring (including explicit OpenStack client/tooling integration).
  • Bug Fixes
    • Improved OpenStack integration test reliability by increasing VM/network retry timeouts for volume readiness and ping checks.
  • Documentation
    • Refreshed generated configuration comment wording and updated testing documentation/snippets.
  • Chores
    • Updated the underlying Nix package set and aligned related build/test configuration behavior.

@coderabbitai

coderabbitai Bot commented Jun 17, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 80f976a3-31fc-450d-b641-4fa38437db10

📥 Commits

Reviewing files that changed from the base of the PR and between 2c9c14b and 85c479e.

📒 Files selected for processing (24)
  • flake.nix
  • modules/default.nix
  • modules/testing/default.nix
  • packages/cinder.nix
  • packages/default.nix
  • packages/django-appconf.nix
  • packages/django-compressor.nix
  • packages/django-debreach.nix
  • packages/django-discover-runner.nix
  • packages/django-pyscss.nix
  • packages/django.nix
  • packages/enmerkar.nix
  • packages/horizon.nix
  • packages/keystone.nix
  • packages/neutron.nix
  • packages/nova.nix
  • packages/python-designateclient.nix
  • packages/python-glanceclient.nix
  • packages/python-novaclient.nix
  • packages/python-openstackclient.nix
  • packages/rcssmin.nix
  • packages/rjsmin.nix
  • tests/openstack-default-setup.nix
  • tests/openstack-live-migration.nix
🚧 Files skipped from review as they are similar to previous changes (22)
  • modules/default.nix
  • packages/rcssmin.nix
  • packages/django-appconf.nix
  • packages/rjsmin.nix
  • modules/testing/default.nix
  • packages/django.nix
  • tests/openstack-default-setup.nix
  • packages/python-glanceclient.nix
  • packages/django-debreach.nix
  • flake.nix
  • packages/python-novaclient.nix
  • packages/python-designateclient.nix
  • packages/python-openstackclient.nix
  • packages/django-pyscss.nix
  • packages/neutron.nix
  • packages/enmerkar.nix
  • tests/openstack-live-migration.nix
  • packages/cinder.nix
  • packages/nova.nix
  • packages/horizon.nix
  • packages/keystone.nix
  • packages/default.nix

📝 Walkthrough

Walkthrough

This PR updates nixpkgs, adds OpenStack and Django package expressions and wiring, migrates many Python derivations to explicit pyproject builds, renames dependencies, applies package-specific build fixes, and adjusts integration tests and generated text.

Changes

Nixpkgs upgrade and package build migration

Layer / File(s) Summary
Nixpkgs input and package import wiring
flake.nix
Updates nixpkgs to nixos-26.05, configures pysaml2 handling, and passes writeText and lib into the package module.
OpenStack client package and integration wiring
packages/python-openstackclient.nix, packages/default.nix, modules/default.nix, modules/testing/default.nix, packages/neutron.nix, packages/nova.nix
Adds python-openstackclient and wires it into package and testing definitions.
Django packages and Horizon wiring
packages/django*.nix, packages/rcssmin.nix, packages/rjsmin.nix, packages/default.nix, packages/horizon.nix
Adds Django-related derivations and updates Horizon dependencies and build settings.
Client package expressions
packages/python-glanceclient.nix, packages/python-novaclient.nix, packages/python-cinderclient.nix
Adds local client derivations with customized checks and excludes one cinderclient test.
Python build migration
packages/*.nix
Adds explicit pyproject and build-system configuration across many Python derivations.
Dependency renames and package fixes
packages/*.nix
Renames Python dependencies and applies targeted patches, test exclusions, import checks, and service-package build fixes.

Estimated code review effort: 4 (Complex) | ~60 minutes

Test infrastructure and documentation updates

Layer / File(s) Summary
NixOS test API and retry budgets
tests/openstack-default-setup.nix, tests/openstack-live-migration.nix, modules/testing/README.md
Switches test constructors to pkgs.testers.nixosTest and increases retry budgets.
Typo and generated-text corrections
checks/.typos.toml, lib/rootwrap-conf.nix, modules/controller/horizon.nix, modules/controller/neutron.nix
Adds a typo exception and updates generated comments, descriptions, and string syntax.

Estimated code review effort: 4 (Complex) | ~60 minutes

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title is concise and directly matches the PR’s main change: updating the project to NixOS 26.05.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch nixos-26.05

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

hertrste added 9 commits June 30, 2026 09:40
Signed-off-by: Stefan Kober <stefan.kober@cyberus-technology.de>
On-behalf-of: SAP stefan.kober@sap.com
Signed-off-by: Stefan Kober <stefan.kober@cyberus-technology.de>
On-behalf-of: SAP stefan.kober@sap.com
Signed-off-by: Stefan Kober <stefan.kober@cyberus-technology.de>
On-behalf-of: SAP stefan.kober@sap.com
Signed-off-by: Stefan Kober <stefan.kober@cyberus-technology.de>
On-behalf-of: SAP stefan.kober@sap.com
Signed-off-by: Stefan Kober <stefan.kober@cyberus-technology.de>
On-behalf-of: SAP stefan.kober@sap.com
Signed-off-by: Stefan Kober <stefan.kober@cyberus-technology.de>
On-behalf-of: SAP stefan.kober@sap.com
Signed-off-by: Stefan Kober <stefan.kober@cyberus-technology.de>
On-behalf-of: SAP stefan.kober@sap.com
Signed-off-by: Stefan Kober <stefan.kober@cyberus-technology.de>
On-behalf-of: SAP stefan.kober@sap.com
Due to newer packages in nixos 26.05 we need a small patch for the old
oslo-log to still work

Signed-off-by: Stefan Kober <stefan.kober@cyberus-technology.de>
On-behalf-of: SAP stefan.kober@sap.com
@pkr4711 pkr4711 force-pushed the nixos-26.05 branch 5 times, most recently from e96b715 to 729bf9c Compare July 2, 2026 14:34
@pkr4711

pkr4711 commented Jul 8, 2026

Copy link
Copy Markdown
Contributor

@hertrste I have continued with our work. The pipeline is 🟢 I had to add a few more nix packages in older versions than those currently available in nixos-26.05.

@pkr4711 pkr4711 marked this pull request as ready for review July 8, 2026 11:22
@pkr4711 pkr4711 requested a review from scholzp July 8, 2026 11:22

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 5

🧹 Nitpick comments (6)
packages/python-cinderclient.nix (1)

67-67: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add a comment explaining the test exclusion.

A brief inline comment (e.g., # test_load_versioned_actions_with_help is flaky on NixOS 26.05) would help future maintainers understand why this specific test is excluded and when it might be safe to remove the exclusion.

💡 Suggested addition
   checkPhase = ''
-    stestr run --exclude-regex test_load_versioned_actions_with_help
+    # Excluded: test_load_versioned_actions_with_help is flaky on NixOS 26.05
+    stestr run --exclude-regex test_load_versioned_actions_with_help
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/python-cinderclient.nix` at line 67, Add a brief inline comment near
the stestr invocation in the python-cinderclient.nix test step explaining why
test_load_versioned_actions_with_help is excluded; document that it is flaky on
NixOS 26.05 (or the specific platform issue) so future maintainers can
understand the exclusion and know when it may be safe to remove it.
packages/doc8.nix (1)

19-26: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Potential redundancy: setuptools-scm in both build-system and nativeBuildInputs.

With pyproject = true and build-system specified, the Nix Python build infrastructure already makes setuptools-scm available during the build. Having it also in nativeBuildInputs (line 26) may be redundant. If this is intentional for a transition period, consider adding a brief comment; otherwise, the nativeBuildInputs entry can likely be removed.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/doc8.nix` around lines 19 - 26, `setuptools-scm` is listed twice for
the doc8 derivation, once in `build-system` and again in `nativeBuildInputs`.
Update the `doc8` Nix expression to keep the dependency only in `build-system`
if that is sufficient under `pyproject = true`, and remove the duplicate
`nativeBuildInputs` entry unless you need it temporarily for a migration
comment. Use the `build-system` and `nativeBuildInputs` sections in
`packages/doc8.nix` to locate the change.
packages/enmerkar.nix (1)

2-21: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Consider using python3Packages.setuptools directly in build-system for consistency.

Other files in this PR (e.g., automaton.nix, castellan.nix, etcd3gw.nix, suds-community.nix) reference python3Packages.setuptools directly in build-system, while this file uses the local setuptools binding from the inherit list. Both are functionally equivalent, but aligning the style would improve cross-file consistency.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/enmerkar.nix` around lines 2 - 21, The build-system declaration in
the enmerkar package uses the locally inherited setuptools binding, which is
inconsistent with the style used in the other Nix package definitions. Update
the python3Packages.buildPythonPackage expression to reference
python3Packages.setuptools directly in build-system, keeping the rest of the
package definition unchanged and aligned with the other files.
packages/python-openstackclient.nix (1)

35-42: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Remove redundant dependency listings.

pbr in nativeBuildInputs (line 41) is already declared in build-system (line 36) — the nativeBuildInputs block is entirely redundant. Additionally, stestr appears in both checkInputs (line 61) and nativeCheckInputs (line 65). In modern Nixpkgs with pyproject = true, nativeCheckInputs is the preferred attribute; checkInputs is legacy. Consolidating all check dependencies into nativeCheckInputs and dropping nativeBuildInputs would align with current best practices.

♻️ Proposed cleanup
   build-system = [
     python3Packages.pbr
     python3Packages.setuptools
   ];

-  nativeBuildInputs = [
-    pbr
-  ];
-
   dependencies = [
     cliff
     cryptography
     iso8601
     openstacksdk
     osc-lib
     oslo-i18n
     pbr
     python-cinderclient
     python-keystoneclient
     requests
     stevedore
   ];

-  checkInputs = [
-    ddt
-    requests-mock
-    stestr
-  ];
-
   nativeCheckInputs = [
+    ddt
+    requests-mock
     stestr
   ];

Also applies to: 58-66

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/python-openstackclient.nix` around lines 35 - 42, The package
definition has redundant dependency declarations: remove the unnecessary pbr
entry from nativeBuildInputs since it is already covered by build-system, and
consolidate all test-time dependencies into nativeCheckInputs in the
python-openstackclient.nix derivation. Update the relevant dependency blocks
around build-system, nativeBuildInputs, checkInputs, and nativeCheckInputs so
that stestr is only listed once and checkInputs is no longer used for this
pyproject-based build.
packages/python-glanceclient.nix (1)

83-96: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Remove redundant checkInputs block.

Every entry in checkInputs is already available during the check phase via other attributes:

  • ddt, requests-mock, testscenarios → already in nativeCheckInputs (lines 75-81)
  • keystoneauth1, oslo-i18n, oslo-utils, pbr, prettytable, pyopenssl, requests, warlock, wrapt → already in propagatedBuildInputs (lines 63-73), which are available during check

The entire block is dead weight and makes it harder to maintain accurate dependency lists.

♻️ Proposed fix
   nativeCheckInputs = [
     ddt
     openstacksdk
     requests-mock
     stestr
     testscenarios
   ];

-  checkInputs = [
-    ddt
-    keystoneauth1
-    oslo-i18n
-    oslo-utils
-    pbr
-    prettytable
-    pyopenssl
-    requests
-    requests-mock
-    testscenarios
-    warlock
-    wrapt
-  ];
-
   checkPhase = ''
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/python-glanceclient.nix` around lines 83 - 96, Remove the redundant
checkInputs block from the python-glanceclient derivation, since the listed
packages are already covered by nativeCheckInputs and propagatedBuildInputs.
Update the package definition by deleting the checkInputs attribute entirely and
keep the dependency lists centralized in the existing nativeCheckInputs and
propagatedBuildInputs sections so the derivation stays accurate and easier to
maintain.
packages/horizon.nix (1)

91-96: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

doCheck = false disables all tests for horizon.

This may be necessary during the NixOS 26.05 migration, but tests should be re-enabled once dependencies stabilize. Consider adding a TODO or tracking issue to re-enable checks in a follow-up.

The pyproject = true, build-system = [pbr, setuptools], and pythonRelaxDeps = [ "django" ] configuration looks correct for the OpenStack/Django packaging migration.

Also applies to: 197-197

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/horizon.nix` around lines 91 - 96, The current horizon packaging
disables all checks with doCheck = false, so update the horizon derivation to
leave a clear TODO or tracking reference near the existing doCheck setting
indicating that tests must be re-enabled once dependencies stabilize. Keep the
pyproject, build-system, and pythonRelaxDeps configuration as-is, and make the
reminder easy to find alongside the horizon package definition so it can be
revisited during the NixOS 26.05 migration follow-up.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/django-compressor.nix`:
- Around line 17-28: `django-compressor` is declaring `rcssmin` and `rjsmin` in
`nativeBuildInputs`, but they are imported at runtime and need to be available
to downstream consumers. Update the `django-compressor` Nix expression to move
both dependencies into `propagatedBuildInputs` while keeping build-time-only
tools in `nativeBuildInputs`; use the `nativeBuildInputs` and
`propagatedBuildInputs` sections in this package definition to make the runtime
closure complete.

In `@packages/django.nix`:
- Around line 19-24: Move Django’s runtime dependencies out of the build-only
dependency list: in the django package definition, keep the build-system tools
in nativeBuildInputs and place asgiref and sqlparse in propagatedBuildInputs so
downstream packages receive them automatically. Use the existing package
expression around the build inputs in the Django derivation to separate
build-time tools from runtime dependencies, matching the pattern used in
django-pyscss.nix.

In `@packages/horizon.nix`:
- Around line 104-108: Horizon’s runtime closure is missing rcssmin for
django-compressor, since it is only declared as a nativeBuildInput in
packages/django-compressor.nix. Update the packaging so rcssmin is included in
propagatedBuildInputs for the django-compressor derivation, or add a direct
Horizon dependency if that is the only consumer, and verify the relevant package
definitions still reference django-compressor consistently.

In `@packages/nova.nix`:
- Around line 120-132: The replacement in postPatch for nova/virt/disk/api.py
changes the crypt shim but does not preserve crypt.crypt()’s None-on-error
behavior. Update the crypt class’ crypt() method to check the ctypes call result
from _libcrypt.crypt before decoding, and return None when the C function
returns NULL; only decode when a real pointer is present.

In `@packages/python-designateclient.nix`:
- Around line 31-32: The python-designateclient package is missing the explicit
PBR build-system dependencies even though pyproject is enabled. Update the
package definition to add the required build-system entries alongside pyproject
= true, using the same pattern as the other OpenStack package definitions in
this PR, so the build can resolve pbr and setuptools correctly.

---

Nitpick comments:
In `@packages/doc8.nix`:
- Around line 19-26: `setuptools-scm` is listed twice for the doc8 derivation,
once in `build-system` and again in `nativeBuildInputs`. Update the `doc8` Nix
expression to keep the dependency only in `build-system` if that is sufficient
under `pyproject = true`, and remove the duplicate `nativeBuildInputs` entry
unless you need it temporarily for a migration comment. Use the `build-system`
and `nativeBuildInputs` sections in `packages/doc8.nix` to locate the change.

In `@packages/enmerkar.nix`:
- Around line 2-21: The build-system declaration in the enmerkar package uses
the locally inherited setuptools binding, which is inconsistent with the style
used in the other Nix package definitions. Update the
python3Packages.buildPythonPackage expression to reference
python3Packages.setuptools directly in build-system, keeping the rest of the
package definition unchanged and aligned with the other files.

In `@packages/horizon.nix`:
- Around line 91-96: The current horizon packaging disables all checks with
doCheck = false, so update the horizon derivation to leave a clear TODO or
tracking reference near the existing doCheck setting indicating that tests must
be re-enabled once dependencies stabilize. Keep the pyproject, build-system, and
pythonRelaxDeps configuration as-is, and make the reminder easy to find
alongside the horizon package definition so it can be revisited during the NixOS
26.05 migration follow-up.

In `@packages/python-cinderclient.nix`:
- Line 67: Add a brief inline comment near the stestr invocation in the
python-cinderclient.nix test step explaining why
test_load_versioned_actions_with_help is excluded; document that it is flaky on
NixOS 26.05 (or the specific platform issue) so future maintainers can
understand the exclusion and know when it may be safe to remove it.

In `@packages/python-glanceclient.nix`:
- Around line 83-96: Remove the redundant checkInputs block from the
python-glanceclient derivation, since the listed packages are already covered by
nativeCheckInputs and propagatedBuildInputs. Update the package definition by
deleting the checkInputs attribute entirely and keep the dependency lists
centralized in the existing nativeCheckInputs and propagatedBuildInputs sections
so the derivation stays accurate and easier to maintain.

In `@packages/python-openstackclient.nix`:
- Around line 35-42: The package definition has redundant dependency
declarations: remove the unnecessary pbr entry from nativeBuildInputs since it
is already covered by build-system, and consolidate all test-time dependencies
into nativeCheckInputs in the python-openstackclient.nix derivation. Update the
relevant dependency blocks around build-system, nativeBuildInputs, checkInputs,
and nativeCheckInputs so that stestr is only listed once and checkInputs is no
longer used for this pyproject-based build.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 73f7b7dc-f764-4977-a33c-f9a23a23b90b

📥 Commits

Reviewing files that changed from the base of the PR and between ee82e3e and 729bf9c.

⛔ Files ignored due to path filters (1)
  • flake.lock is excluded by !**/*.lock
📒 Files selected for processing (117)
  • checks/.typos.toml
  • flake.nix
  • lib/rootwrap-conf.nix
  • modules/controller/horizon.nix
  • modules/controller/neutron.nix
  • modules/default.nix
  • modules/testing/README.md
  • modules/testing/default.nix
  • packages/automaton.nix
  • packages/castellan.nix
  • packages/cinder.nix
  • packages/cursive.nix
  • packages/default.nix
  • packages/django-appconf.nix
  • packages/django-compressor.nix
  • packages/django-debreach.nix
  • packages/django-discover-runner.nix
  • packages/django-pyscss.nix
  • packages/django.nix
  • packages/doc8.nix
  • packages/enmerkar.nix
  • packages/etcd3gw.nix
  • packages/futurist.nix
  • packages/gabbi.nix
  • packages/glance-store.nix
  • packages/glance.nix
  • packages/horizon.nix
  • packages/jsonpath-rw-ext.nix
  • packages/keystone.nix
  • packages/keystoneauth1.nix
  • packages/keystonemiddleware.nix
  • packages/microversion-parse.nix
  • packages/neutron-lib.nix
  • packages/neutron.nix
  • packages/nova.nix
  • packages/openstack-placement.nix
  • packages/os-brick.nix
  • packages/os-client-config.nix
  • packages/os-ken.nix
  • packages/os-resource-classes.nix
  • packages/os-traits.nix
  • packages/os-vif.nix
  • packages/os-win.nix
  • packages/osc-placement.nix
  • packages/oslo-cache.nix
  • packages/oslo-concurrency.nix
  • packages/oslo-config.nix
  • packages/oslo-context.nix
  • packages/oslo-db.nix
  • packages/oslo-i18n.nix
  • packages/oslo-limit.nix
  • packages/oslo-log.nix
  • packages/oslo-messaging.nix
  • packages/oslo-metrics.nix
  • packages/oslo-middleware.nix
  • packages/oslo-policy.nix
  • packages/oslo-privsep.nix
  • packages/oslo-reports.nix
  • packages/oslo-rootwrap.nix
  • packages/oslo-serialization.nix
  • packages/oslo-service.nix
  • packages/oslo-upgradecheck.nix
  • packages/oslo-utils.nix
  • packages/oslo-versionedobjects.nix
  • packages/oslo-vmware.nix
  • packages/oslotest.nix
  • packages/osprofiler.nix
  • packages/ovs.nix
  • packages/ovsdbapp.nix
  • packages/patches/oslo-log-pipe-mutex-context-manager.patch
  • packages/pre-commit.nix
  • packages/pycadf.nix
  • packages/python-barbicanclient.nix
  • packages/python-binary-memcached.nix
  • packages/python-cinderclient.nix
  • packages/python-designateclient.nix
  • packages/python-glanceclient.nix
  • packages/python-keystoneclient.nix
  • packages/python-neutronclient.nix
  • packages/python-novaclient.nix
  • packages/python-openstackclient.nix
  • packages/python-swiftclient.nix
  • packages/rcssmin.nix
  • packages/reno.nix
  • packages/rjsmin.nix
  • packages/sphinxcontrib-svg2pdfconverter.nix
  • packages/sqlalchemy.nix
  • packages/suds-community.nix
  • packages/taskflow.nix
  • packages/tooz.nix
  • packages/xstatic-angular-bootstrap.nix
  • packages/xstatic-angular-fileupload.nix
  • packages/xstatic-angular-gettext.nix
  • packages/xstatic-angular-lrdragndrop.nix
  • packages/xstatic-angular-schema-form.nix
  • packages/xstatic-angular.nix
  • packages/xstatic-bootstrap-datepicker.nix
  • packages/xstatic-bootstrap-scss.nix
  • packages/xstatic-bootswatch.nix
  • packages/xstatic-d3.nix
  • packages/xstatic-font-awesome.nix
  • packages/xstatic-hogan.nix
  • packages/xstatic-jasmine.nix
  • packages/xstatic-jquery-migrate.nix
  • packages/xstatic-jquery-quicksearch.nix
  • packages/xstatic-jquery-tablesorter.nix
  • packages/xstatic-jsencrypt.nix
  • packages/xstatic-mdi.nix
  • packages/xstatic-objectpath.nix
  • packages/xstatic-rickshaw.nix
  • packages/xstatic-roboto-fontface.nix
  • packages/xstatic-smart-table.nix
  • packages/xstatic-spin.nix
  • packages/xstatic-term-js.nix
  • packages/xstatic-tv4.nix
  • tests/openstack-default-setup.nix
  • tests/openstack-live-migration.nix

Comment thread packages/django-compressor.nix
Comment thread packages/django.nix
Comment thread packages/horizon.nix
Comment thread packages/nova.nix
Comment on lines +120 to +132
postPatch = ''
substituteInPlace nova/virt/disk/api.py \
--replace-fail " import crypt" ' import ctypes
_libcrypt = ctypes.CDLL("${lib.getLib libxcrypt-legacy}/lib/libcrypt.so.1")
_libcrypt.crypt.argtypes = [ctypes.c_char_p, ctypes.c_char_p]
_libcrypt.crypt.restype = ctypes.c_char_p

class crypt:
@staticmethod
def crypt(word, salt):
result = _libcrypt.crypt(word.encode("utf-8"), salt.encode("utf-8"))
return result.decode("utf-8")'
'';

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

sed -n '100,150p' packages/nova.nix

Repository: cobaltcore-dev/openstack-nix

Length of output: 1360


🏁 Script executed:

grep -RIn "class crypt" -n . || true

Repository: cobaltcore-dev/openstack-nix

Length of output: 207


🏁 Script executed:

python3 - <<'PY'
import ctypes

lib = ctypes.CDLL(None)
# probe semantics of c_char_p returning NULL
lib.malloc.restype = ctypes.c_void_p
PY

Repository: cobaltcore-dev/openstack-nix

Length of output: 166


🏁 Script executed:

rg -n "class crypt|_libcrypt\.crypt|import crypt" -S .

Repository: cobaltcore-dev/openstack-nix

Length of output: 555


🏁 Script executed:

python3 - <<'PY'
import ctypes

CALLBACK = ctypes.CFUNCTYPE(ctypes.c_char_p)

`@CALLBACK`
def returns_null():
    return None

result = returns_null()
print("result:", result, type(result))
try:
    print(result.decode("utf-8"))
except Exception as e:
    print(type(e).__name__, e)
PY

Repository: cobaltcore-dev/openstack-nix

Length of output: 257


Handle NULL from C crypt(). ctypes.c_char_p maps a NULL return to None, so result.decode("utf-8") raises AttributeError instead of preserving crypt.crypt()’s None-on-error behavior. Add a null guard before decoding.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/nova.nix` around lines 120 - 132, The replacement in postPatch for
nova/virt/disk/api.py changes the crypt shim but does not preserve
crypt.crypt()’s None-on-error behavior. Update the crypt class’ crypt() method
to check the ctypes call result from _libcrypt.crypt before decoding, and return
None when the C function returns NULL; only decode when a real pointer is
present.

Comment thread packages/python-designateclient.nix

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/django-compressor.nix`:
- Around line 21-26: Move the runtime Python dependencies from nativeBuildInputs
to propagatedBuildInputs in the django-compressor derivation so downstream users
receive them automatically. Specifically, keep build-only tools like pip and
setuptools in nativeBuildInputs, but add django and django-appconf to
propagatedBuildInputs in the django-compressor package definition. This ensures
the imports used by django-compressor at runtime are available to dependents
without requiring them to declare those packages separately.

In `@packages/django-discover-runner.nix`:
- Around line 18-21: Move django back from nativeBuildInputs to
propagatedBuildInputs in the django-discover-runner derivation, since it is
imported and extended at runtime by the plugin. Keep pip and setuptools in
nativeBuildInputs, and ensure the package expression for django-discover-runner
preserves django in the transitive runtime closure so downstream consumers
receive it automatically.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 806bd522-5ef8-4364-a6f2-a6183d6b946b

📥 Commits

Reviewing files that changed from the base of the PR and between 729bf9c and 2c9c14b.

📒 Files selected for processing (14)
  • flake.nix
  • packages/default.nix
  • packages/django-appconf.nix
  • packages/django-compressor.nix
  • packages/django-debreach.nix
  • packages/django-discover-runner.nix
  • packages/django-pyscss.nix
  • packages/django.nix
  • packages/enmerkar.nix
  • packages/horizon.nix
  • packages/python-designateclient.nix
  • packages/python-glanceclient.nix
  • packages/rcssmin.nix
  • packages/rjsmin.nix
✅ Files skipped from review due to trivial changes (2)
  • packages/django-appconf.nix
  • packages/rjsmin.nix
🚧 Files skipped from review as they are similar to previous changes (8)
  • packages/rcssmin.nix
  • packages/django-debreach.nix
  • packages/python-glanceclient.nix
  • packages/django-pyscss.nix
  • packages/python-designateclient.nix
  • packages/enmerkar.nix
  • packages/horizon.nix
  • packages/default.nix

Comment thread packages/django-compressor.nix
Comment thread packages/django-discover-runner.nix
pkr4711 added 8 commits July 10, 2026 08:37
Replace python-ldap package with renamed package ldap.

Signed-off-by: Paul Kroeher <paul.kroeher@cyberus-technology.de>
On-behalf-of: SAP paul.kroeher@sap.com
Create an older version of this package.
Nixos-2605 only contains newer packages
that are not compatible with this
OpenStack version.

Target versions are from our
OpenStack release:
https://releases.openstack.org/dalmatian/

Signed-off-by: Paul Kroeher <paul.kroeher@cyberus-technology.de>
On-behalf-of: SAP paul.kroeher@sap.com
Create an older version of this package.
Nixos-2605 only contains newer packages
that are not compatible with this
OpenStack version.

Signed-off-by: Paul Kroeher <paul.kroeher@cyberus-technology.de>
On-behalf-of: SAP paul.kroeher@sap.com
Use of the newly created packages.

Signed-off-by: Paul Kroeher <paul.kroeher@cyberus-technology.de>
On-behalf-of: SAP paul.kroeher@sap.com
Use of the newly created packages in our tests.

Signed-off-by: Paul Kroeher <paul.kroeher@cyberus-technology.de>
On-behalf-of: SAP paul.kroeher@sap.com
In github ci the test vm need >= 45 to boot.
It's longer than in a local test.

Signed-off-by: Paul Kroeher <paul.kroeher@cyberus-technology.de>
On-behalf-of: SAP paul.kroeher@sap.com
Create an older version of this package.
Nixos-2605 only contains newer packages
that are not compatible with this
OpenStack version.

Target versions are from our
OpenStack release:
https://releases.openstack.org/dalmatian/

This package is a dependency of
horizon dashbaord.

Signed-off-by: Paul Kroeher <paul.kroeher@cyberus-technology.de>
On-behalf-of: SAP paul.kroeher@sap.com
Create an older version of this package.
Nixos-2605 only contains newer packages
that are not compatible with this
OpenStack version.

Target versions are from our
OpenStack release:
https://releases.openstack.org/dalmatian/

This package is a dependency of
horizon dashbaord.

Signed-off-by: Paul Kroeher <paul.kroeher@cyberus-technology.de>
On-behalf-of: SAP paul.kroeher@sap.com
pkr4711 added 7 commits July 10, 2026 08:53
Create an older version of this package.
Nixos-2605 only contains newer packages
that are not compatible with this
OpenStack version.

Target versions are from our
OpenStack release:
https://releases.openstack.org/dalmatian/

This package is a dependency of
horizon dashbaord.

Signed-off-by: Paul Kroeher <paul.kroeher@cyberus-technology.de>
On-behalf-of: SAP paul.kroeher@sap.com
Create an older version of this package.
Nixos-2605 only contains newer packages
that are not compatible with this
OpenStack version.

Target versions are from our
OpenStack release:
https://releases.openstack.org/dalmatian/

This package is a dependency of
horizon dashbaord.

Signed-off-by: Paul Kroeher <paul.kroeher@cyberus-technology.de>
On-behalf-of: SAP paul.kroeher@sap.com
Create an older version of this package.
Nixos-2605 only contains newer packages
that are not compatible with this
OpenStack version.

Target versions are from our
OpenStack release:
https://releases.openstack.org/dalmatian/

This package is a dependency of
horizon dashbaord.

Signed-off-by: Paul Kroeher <paul.kroeher@cyberus-technology.de>
On-behalf-of: SAP paul.kroeher@sap.com
Create an older version of this package.
Nixos-2605 only contains newer packages
that are not compatible with this
OpenStack version.

Target versions are from our
OpenStack release:
https://releases.openstack.org/dalmatian/

Signed-off-by: Paul Kroeher <paul.kroeher@cyberus-technology.de>
On-behalf-of: SAP paul.kroeher@sap.com
Use newly created packages in horizon
and fix further python dependencies
of horizon.

Signed-off-by: Paul Kroeher <paul.kroeher@cyberus-technology.de>
On-behalf-of: SAP paul.kroeher@sap.com
Fix build inputs of this package.

Signed-off-by: Paul Kroeher <paul.kroeher@cyberus-technology.de>
On-behalf-of: SAP paul.kroeher@sap.com
Package django is a runtime dependency
of django-discover-runner and should be
included in the built package.

Signed-off-by: Paul Kroeher <paul.kroeher@cyberus-technology.de>
On-behalf-of: SAP paul.kroeher@sap.com
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants