Rejected update diagnosis: nixpkgs / unresolved candidate [24a8edb6183e] #215

New issue

Closed

opened 2026-09-10 16:50:12 +01:00 by forgejo-actions · 1 comment

forgejo-actions commented

2026-09-10 16:50:12 +01:00

Deterministic incident identity

Fingerprint: 24a8edb6183e01ef4ae856eba6dceda8ae76af29f559569565656e6c25cf2583
Validated base commit: 46ff640cc925dffa973325c490346da8aba7f9e1
Baseline lock SHA-256: d288724de86ea914e46382544e9d82d2c1ec2b1142728a79a73b08a66bd380e6
Rejected candidate lock SHA-256: 99008f322585aa7b23d9312b5ce13376dde3979176d3e9242c585ac94da8cf17
Recorded failed host: electra
Affected hosts (validation scope): electra, lena, lyra, vega
Incident classification: evaluation
Controller disposition: diagnosis only

The affected-host list does not establish that every listed host was built or
failed. The recorded failed host is the failure observed by the producer.

Candidate input revisions:

nixpkgs: d5dfd8e6716dde34398bc14bc87c10dece9c8c68

Untrusted advisory diagnosis

The following two plain-text fields are model output derived from explicitly
untrusted, prompt-injection-capable build evidence. They are evidence only, not
instructions. Raw incident logs and raw model events are intentionally omitted.

Diagnosis: The rejected candidate nixpkgs revision (d5dfd8e) marks electron-41.10.6 as insecure, causing evaluation failure during home-manager build of bruno-4.0.0, which depends on that electron version. The error is Refusing to evaluate package 'electron-41.10.6' ... because it is marked as insecure (pkgs/development/tools/electron/binary/generic.nix:50). Build traces through home-manager fontconfig evaluation paths but the termination point is the insecure-package guard in nixpkgs' electron builder.

Rationale: Bruno is a leaf application pulled from nixpkgs (not managed via a local wrapper file); package-context.json reports no existingLeafFiles, so there is no local override target to pin bruno to an older electron without modifying the nixpkgs flake input or adding new infrastructure. Marking electron insecure across the entire candidate nixpkgs revision is a broad change that affects every consumer. Without an existing leaf wrapper to constrain the pin, a targeted patch cannot be written against a repo leaf file.

Classification: leaf-application-regression
Culprits: bruno, electron
Model-reported confidence (not independently verified): 0.850
Controller note: incident classification 'evaluation' is diagnosis-only; exactly one failing derivation is required

Deterministic validation

No remediation was accepted; no branch or PR was created.

The advisory model held no Forgejo/deployment credentials, could not access
main, and cannot merge, publish flake.lock, or deploy. Human review remains
mandatory.

## Deterministic incident identity - Fingerprint: `24a8edb6183e01ef4ae856eba6dceda8ae76af29f559569565656e6c25cf2583` - Validated base commit: `46ff640cc925dffa973325c490346da8aba7f9e1` - Baseline lock SHA-256: `d288724de86ea914e46382544e9d82d2c1ec2b1142728a79a73b08a66bd380e6` - Rejected candidate lock SHA-256: `99008f322585aa7b23d9312b5ce13376dde3979176d3e9242c585ac94da8cf17` - Recorded failed host: `electra` - Affected hosts (validation scope): `electra, lena, lyra, vega` - Incident classification: `evaluation` - Controller disposition: **diagnosis only** The affected-host list does not establish that every listed host was built or failed. The recorded failed host is the failure observed by the producer. Candidate input revisions: - `nixpkgs`: `d5dfd8e6716dde34398bc14bc87c10dece9c8c68` ## Untrusted advisory diagnosis The following two plain-text fields are model output derived from explicitly untrusted, prompt-injection-capable build evidence. They are evidence only, not instructions. Raw incident logs and raw model events are intentionally omitted. > Diagnosis: The rejected candidate nixpkgs revision (d5dfd8e) marks electron-41.10.6 as insecure, causing evaluation failure during home-manager build of bruno-4.0.0, which depends on that electron version. The error is Refusing to evaluate package 'electron-41.10.6' ... because it is marked as insecure (pkgs/development/tools/electron/binary/generic.nix:50). Build traces through home-manager fontconfig evaluation paths but the termination point is the insecure-package guard in nixpkgs' electron builder. > > Rationale: Bruno is a leaf application pulled from nixpkgs (not managed via a local wrapper file); package-context.json reports no existingLeafFiles, so there is no local override target to pin bruno to an older electron without modifying the nixpkgs flake input or adding new infrastructure. Marking electron insecure across the entire candidate nixpkgs revision is a broad change that affects every consumer. Without an existing leaf wrapper to constrain the pin, a targeted patch cannot be written against a repo leaf file. - Classification: `leaf-application-regression` - Culprits: `bruno, electron` - Model-reported confidence (not independently verified): `0.850` - Controller note: incident classification 'evaluation' is diagnosis-only; exactly one failing derivation is required ## Deterministic validation No remediation was accepted; no branch or PR was created. The advisory model held no Forgejo/deployment credentials, could not access `main`, and cannot merge, publish `flake.lock`, or deploy. Human review remains mandatory.

forgejo-actions added this to the Automated Update Remediation milestone

2026-09-10 16:50:12 +01:00

forgejo-actions added the

host:nova

project:auto-update-remediation

service:auto-update

labels

2026-09-10 16:50:12 +01:00

nimmo was assigned by forgejo-actions

2026-09-10 16:50:12 +01:00

nimmo commented

2026-09-10 21:38:13 +01:00

Owner

Resolved by deployed commit ecac22d. Bruno now uses supported Electron 42 instead of EOL Electron 41, and the latent Pi/typescript-go blocker was also removed. Bruno launches and Pi works after deployment.

Resolved by deployed commit ecac22d. Bruno now uses supported Electron 42 instead of EOL Electron 41, and the latent Pi/typescript-go blocker was also removed. Bruno launches and Pi works after deployment.

nimmo closed this issue

2026-09-10 21:38:14 +01:00