Visitar URL original
libstore: Pair Darwin sandbox hash prefixes (+tests for large profiles) by booxter · Pull Request #16733 · NixOS/nix · GitHub
Skip to content

libstore: Pair Darwin sandbox hash prefixes (+tests for large profiles) - #16733

Draft
booxter wants to merge 2 commits into
NixOS:masterfrom
booxter:darwin-sandbox-pairs
Draft

booxter wants to merge 2 commits into
NixOS:masterfrom
booxter:darwin-sandbox-pairs

Conversation

@booxter

@booxter booxter commented Oct 31, 2026

Copy link
Copy Markdown
Contributor

Motivation

Bucketing performance is sensitive to the number of guards.

With the change, on macOS 27, median profile compilation reduced from 762 to 118 ms (6.46x) for a 1,403-input build. Compiled size increased by 0.36%.

Repeated trivial build probes showed a small per-operation cost, most clearly about 2-3% slower stat on Python/Nix profiles. Ten runs of hello, Git, and Python build-phase replays found no detectable total-time change.

Implementation

Pair adjacent first hash characters to reduce prefix guards from 32 to 16.

Also, added some functional tests to verify profile compilation and guard behavior for large profiles. (This piece is logically independent from the optimization but establishes the baseline as the first commit in the PR to avoid any size-sensitive regressions.)


Add 👍 to pull requests you find important.

The Nix maintainer team uses a GitHub project board to schedule and track reviews.

@github-actions github-actions Bot added the with-tests Issues related to testing. PRs with tests have some priority label Oct 31, 2026
Exercise concentrated prefixes and an 8,000-input capacity target.
Check allowed and denied reads with actual sandbox enforcement.

Assisted-by: Codex, GPT-6-Astra medium
Pair adjacent first hash characters to reduce prefix guards from 32 to
16, which results in some compute time savings, esp. for large profiles.

On macOS 27, median profile compilation reduced from 762 to 118 ms
(6.46x) for a 1,403-input build. Compiled size increased by 0.36%.

Repeated trivial build probes showed a small per-operation cost, most
clearly about 2-3% slower stat on Python/Nix profiles. Ten runs of
hello, Git, and Python build-phase replays found no detectable
total-time change.

Assisted-by: Codex, GPT-6-Astra medium
@booxter
booxter force-pushed the darwin-sandbox-pairs branch from 418058b to 2dca02a Compare October 31, 2026 00:40
@booxter

booxter commented Oct 31, 2026 •

Copy link
Copy Markdown
Contributor Author

For the record, I am not entirely convinced that shaving off 0.5 to a few seconds per darwinConfiguration build justifies this (even if mild) complexity. I will let maintainers to assess.

Regardless, I think we should consider including the tests for large profiles to establish some regression baseline for future changes.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

with-tests Issues related to testing. PRs with tests have some priority

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant