Conversation
nixpkgs-ci
bot
added
10.rebuild-linux: 1-10
| "sec-profile-hardened": [ | ||
| "index.html#sec-profile-hardened" | ||
| ], |
There was a problem hiding this comment.
Let's have an anchor on the release notes entry and have this element moved into its list.
There was a problem hiding this comment.
I don't understand what you're asking for. If you want changes to the docs post the diff and I'll include it.
There was a problem hiding this comment.
Following in the release notes entry:
- []{#sec-release-26.05-incompatibilities-profiles-hardened-removed} `profiles/hardened` has been removed, because:And following in the redirects.json:
"sec-release-26.05-incompatibilities-profiles-hardened-removed": [
"release-notes.html#sec-release-26.05-incompatibilities-profiles-hardened-removed",
"index.html#sec-profile-hardened"
],It's the same as I linked in the previous comment.
r-vdp
left a comment
r-vdp
left a comment
There was a problem hiding this comment.
I'm in favour, I've seen several issues opened by people using this profile and running into random breakage.
nixpkgs-ci
bot
added
the
12.approvals: 1
|
Not opposed but would like to see it justified in the commit message. |
|
The justification in the release notes the commit adds is even better (because visible to users), right? |
nixpkgs-ci
bot
added
12.approvals: 2
|
Please do not merge until a redirect is added (#501199 (comment)). Request to committers in general while reviewing: Please avoid merging if appropriate redirects haven't been added wherever applicable. Dropping entries from |
- It lacks a consistent and transparent baseline or standard, - It may introduce unexpected breakage or degrade performance without clear benefit, - It is difficult to manage user expectations, especially since the implications of enabling it are not always obvious, - and as multiple contributors have noted, it is often more of a “grab bag” of settings than a cohesive security policy.
zowoq
force-pushed
the
rm-nixos-hardening
branch
from
e4a2f86 to
18a4528
Compare
There was a problem hiding this comment.
@fricklerhandwerk did we also care about ordering in redirects.json? IIRC we didn't enforce it per-se, and had the CLI not auto-sort keys.
nixpkgs-ci
bot
added
12.approvals: 3+
If it's not enforced by tooling, I'd say there's zero reason to push the work onto humans. |
|
We converged on not enforcing it because it would keep the minimum required diff smaller. Otherwise you may have situations where a rename would also be a moving, and that would make reviews more of a hassle. (Maybe worth noting in the design doc! @GetPsyched could you add a sentence there?) But yes, please don't just ditch old URLs. |
|
If this gets merged, I'll at least add explained profile options to new "NixOS Hardening" wiki page so users interested in hardening will still have some guide. |
9 participants
Things done
passthru.tests.nixpkgs-reviewon this PR. See nixpkgs-review usage../result/bin/.