investigate CI failure on macos

[marienz]

Tests have been failing on macos for a while now, with two (presumably) different problems:

• Timeouts (GitHub cancels the test after 6 hours). I'm not sure whether this is a real issue or a GitHub infrastructure problem.
• Test failures like

equal-contents-name> --- /nix/store/pab7cbfqzymhbxld1fv6hga8pm2ylrxw-interactive
equal-contents-name> +++ /nix/store/kkwwsc553616kw0lk911w499ynpnwdrb-doom-expected
equal-contents-name> ├── stat {}
equal-contents-name> │ @@ -1,7 +1,7 @@
equal-contents-name> │
equal-contents-name> │    Size: 14              Blocks: 8          IO Block: 4096   regular file
equal-contents-name> │ -Device: 1,20    Access: (0444/-r--r--r--)  Uid: (    0/    root)   Gid: (    0/   wheel)
equal-contents-name> │ +Device: 1,20    Access: (0444/-r--r--r--)  Uid: (    0/    root)   Gid: (  350/  nixbld)
equal-contents-name> │
equal-contents-name> │  Modify: 1970-01-01 00:00:01.000000000 +0000
...
equal-contents-name> Contents must be equal, but were not!
equal-contents-name> +: expected,   at /nix/store/kkwwsc553616kw0lk911w499ynpnwdrb-doom-expected
equal-contents-name> -: unexpected, at /nix/store/pab7cbfqzymhbxld1fv6hga8pm2ylrxw-interactive

I do not understand this failure (unless it's either a MacOS or Nix bug): on Linux, everything in the store is root-owned, and I'd expect everything on MacOS to also be owned by some consistent group... at first glance this looks like something is still owned by a group used by the builder user that I'd really expect to have had its (user and group) ownership changed to root before this next build step can see it. Instead it's owned by the root user (which hopefully it wasn't built as) but the nixbld group...

I may end up disabling tests on MacOS (and ask users to file issues if things are actually broken on MacOS) as I don't have a dev environment set up in which I can reproduce and test this, and troubleshooting this in CI is likely to be cumbersome.

[joelmccracken]

This would appear to be the difference between nix single user and multi user mode. IIRC MUM is the only possible way to use it on macos.

I see that you're setting this up with the determinate systems stuff. I wonder if that behaves any differently than otherwise?

Will probably poke at this soonish. Installing doom emacs via nix has again come up tothe top of my personal hackery stack. And since I personally parimarily use macos, I'd love to see the macos tests running.

[marienz]

When I said "on Linux" I meant "on my NixOS dev system" (also multi-user). On that system, /nix/store is owned by root:nixbld, but everything in it is root:root (uid/gid both 0). I don't know off the top of my head what my Linux CI does, but multi-user should work.

Any poking you can do would be much appreciated. Happy to trigger test runs in CI if you have suggestions on what to test... (Also happy to retry CI without further changes if you can confirm nix flake check works fine on a "normal" system.)

[marienz]

I've re-enabled CI on macOS a few weeks ago, and so far it's been working... Closing this (somewhat tentatively, if it starts failing again I may have to drop it from CI again if I still can't easily debug).