Since its superclass RemoteStore::Connection contains 'to' and 'from'
fields that refer to the file descriptor maintained in the subclass,
it was possible for the flush() call in Connection::~Connection() to
write to a closed file descriptor (or worse, a file descriptor now
referencing another file). So make sure that the file descriptor
survives 'to' and 'from'.

bump base nixpkgs used by default 18.03 -> 18.09

Fix overflow when verifying signatures of content addressable paths

Docs: update fixed output hashes

`fetchurl` will now throw if given an `md5`, and the hashes have generally
been upgraded to avoid it and use `sha256` as a default. This updates the
documentation examples in the manual accordingly.

manual: add XML IDs to all builtin list entries

Update docs to describe how s3:// URLS does in fact support endpoint, region, and profile for upload

nix-profile-daemon: remove cruft

This removes part of the PATH that were being added automatically in multi-user installs:

- $HOME/.nix-profile/lib/kde4/libexec - shouldn't be needed anymore, we are now using kde5
- @localstatedir@/nix/profiles/default/lib/kde4/libexec - same as above
- @localstatedir@/nix/profiles/default - shouldn't ever contain binaries

For example, this prevents a "kvm" build on machines that don't have
KVM.

Fixes #2012.

This is primarily because Derivation::{can,will}BuildLocally() depends
on attributes like preferLocalBuild and requiredSystemFeatures, but it
can't handle them properly because it doesn't have access to the
structured attributes.

E.g. __noChroot and allowedReferences now work correctly. We also now
check that the attribute type is correct. For instance, instead of

  allowedReferences = "out";

you have to write

  allowedReferences = [ "out" ];

Fixes #2453.

Update docs to describe how s3:// URLS does in fact support endpoint, region, and profile for upload

This meant that making a typo in an s3:// URI would cause a bucket to
be created. Also it didn't handle eventual consistency very well. Now
it's up to the user to create the bucket.

nix-shell: add bashInteractive to the start of the PATH, set SHELL

Tools which re-exec `$SHELL` or `$0` or `basename $SHELL` or even just
`bash` will otherwise  get the non-interactive bash, providing a
broken shell for the same reasons described in
https://github.com/NixOS/nixpkgs/issues/27493.

Extends c94f3d55

Presumably this refers to ./default.nix but the support for that in
'nix' is tenuous. Also folders are a Mac thing.

* Don't wait forever for the client to remove data from the
  buffer. This does mean that the buffer can grow without bounds
  (e.g. when downloading is faster than writing to disk), but meh.

* Don't hold the state lock while calling the sink. The sink could
  take any amount of time to process the data (in particular when it's
  actually a coroutine), so we don't want to block the download
  thread.

In particular this causes copyStorePath() from HttpBinaryCacheStore to
only start a download if needed. E.g. if the destination LocalStore
goes to sleep waiting for the path lock and another process creates
the path, then LocalStore::addToStore() will never read from the
source so we don't have to do the download.

Changes

  std::bad_alloc

into

  bad archive: input doesn't look like a Nix archive

nix-daemon: allow setting builders to "" by any user (untrusted)

(cherry picked from commit a94a2eb1cb1c81e90a7529be5fecac27899a3442)

search: include version for matches too!

Upgrade docs: improve the upgrade command

and make it more copy-pastable.

Document that nix-shell's shebang requires double quotes for expressions

Document Aliases

Fixes #2425.