https://hydra.nixos.org/build/102803093

https://hydra.nixos.org/build/102803044

Remove world-writability from {profiles,gcroots}/per-user 

700 is pointless since the store is world-readable anyway. And
per-user/root/channels must be world-readable.

This is already done by the installer, so no need to do it again.

'nix-daemon' now creates subdirectories for users when they first
connect.

Fixes #509 (CVE-2019-17365).
Should also fix #3127.

Otherwise, builds like NixOS VM tests may leave the terminal in a
weird state and do resets.

Fixes #1892.
Fixes #1865.
Fixes #3119.

Handle empty sandbox_shell

Make nix-daemon.plist less fragile on macOS

We're calling `wait4path` on the full, resolved `@bindir@/nix-daemon` path.

That means we're hardcoding something like:

    /bin/wait4path /nix/store/zs9c5xhp3zv9p23qnjxp87nl5injsi1i-nix-2.3/bin/nix-daemon && /nix/var/nix/profiles/default/bin/nix-daemon

That seems unnecessarily fragile.

It might be better to wait4path on the path we intend to call.

Don't symlink org.nixos.nix-daemon.plist in installer

Don’t source bashrc in pure mode

Previously, SANDBOX_SHELL was set to empty when unavailable. This
caused issues when actually generating the sandbox. Instead, just set
SANDBOX_SHELL when --with-sandbox-shell= is non-empty. Alternative
implementation to https://github.com/NixOS/nix/pull/3038.

Pure mode should not try to source the user’s bashrc file. These may
have many impurities that the user does not expect to get into their
shell.

Fixes #3090

In the multi-user install script, we originally made sure no previous
references to Nix existed. This prevented any previous installs from
contaminating the new install. However, some users need the ability to
repair their existing Nix installation without uninstalling all
references to Nix. This change allows users with existing Nix
installations to use the installer, while still outputing a warning
message on the dangers of this. As a result, the multi-user install
script work much more like the single-user install script has worked
in the past.

This is a requirement for macOS Catalina users now that
/Library/LaunchDaemons/org.nixos.nix-daemon.plisg is not managed by
the Nix store. If there is ever a change to the .plist, all users will
need to rerun this install script to get the new changes. Otherwise,
changes to the launch daemon will require manual interventions.

On Catalina, the /nix filesystem might not be mounted at start time.
To avoid this service not starting, we need to keep the launch agent
outside of the Nix store. A wait4pid will hold for our /nix dir to be
mounted.

Fixes #3125.

Fix typos in the Nix Manual.

nix search: remove verbose example

This reverts commit 6b83174f because
it doesn't work on macOS yet.

https://hydra.nixos.org/build/102617587

Fix fetchTarball with chroot stores

Fixes #2405.

mention `nix-store --query --roots` when a path cannot be deleted

docs: Note that tryEval doesn't do deep evaluation

Update garbage-collection.xml readability