diff options
Diffstat (limited to 'INSTALL.md')
| -rw-r--r-- | INSTALL.md | 44 |
1 files changed, 33 insertions, 11 deletions
@@ -34,15 +34,11 @@ Installing plain upstream Nix here leaves the daemon unmanaged. Open a new shell afterwards so `nix` is on `PATH`. -### 3. Install Homebrew +### 3. Homebrew -nix-darwin declares Homebrew packages but does **not** install Homebrew itself. -The first switch fails without it. - -```shell -/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" -eval "$(/opt/homebrew/bin/brew shellenv)" -``` +Nothing to do: nix-homebrew installs Homebrew during the first switch, and its +taps are pinned in `flake.lock` like every other input. Brew installs from those +pinned taps, not from its JSON API. ### 4. Clone the repository @@ -230,15 +226,41 @@ Aliases defined in `modules/home/zsh.nix` (macOS): | Alias | Does | | --------- | ------------------------------------------------- | | `rebuild` | `darwin-rebuild switch` against this flake | -| `update` | `nix flake update`, then rebuild | +| `update` | Vetted input update, build, diff, switch, commit | | `nix-gc` | Garbage-collect store paths older than 14 days | `scripts/cleanup.sh` is a separate macOS cleanup utility (caches, logs, trash). +### Updating + +`update` runs `vet` (`pkgs/vet`) before anything is switched: + +1. `vet lock` moves flake inputs and skills to the newest revisions at least + `cooldownDays` (`vet.json`) old. nixpkgs moves to a channel release, so it + stays in the binary cache. Own sources go to their newest revision, and + inputs pinned to a commit in `flake.nix` are left alone. +2. `vet check` compares the locks with `HEAD`. Changes inside the cooldown are + blocked. Third-party sources (anything not listed as own or trusted in + `vet.json`) have their diff reviewed by Claude, which runs with no tools. + A `review` verdict asks before continuing; a `block` stops the update. +3. The new system is built and compared with `nvd diff`, and `vet cves` lists + the CVEs it adds and fixes (vulnix against the NVD; the first run downloads + the whole NVD and takes a while). Add known false positives to `vulnix.toml`. +4. After you confirm, it switches and commits both locks with the vet report. + +Set `VET_COOLDOWN_DAYS=0` to let an urgent fix through. Run `vet check` by hand +after adding a new input or skill source to have it reviewed before committing. + +npm and pnpm get matching defaults in `modules/home/supply-chain.nix`: a +seven-day minimum release age, no trust downgrades and no exotic transitive +dependencies for pnpm, and no install scripts for npm. Scan a project's +lockfiles for known vulnerabilities with `osv-scanner scan -r .`. + ## Troubleshooting -**`error: Homebrew is not installed`** — step 3 was skipped, or `brew` is not on -`PATH` for the shell running the switch. Run `eval "$(/opt/homebrew/bin/brew shellenv)"`. +**`An existing /opt/homebrew/Library/Taps is in the way`** — Homebrew was +installed before nix-homebrew took over. Move the old taps aside and switch +again: `sudo mv /opt/homebrew/Library/Taps /opt/homebrew/Library/Taps.old`. **Mac App Store apps fail to install** — sign in to the App Store, then re-run the switch. `mas` cannot authenticate on its own. |