Repository navigation
chore(deps): remove the awscli botocore/s3transfer pins once nixpkgs' awscli pairing is consistent again #4167
Description
Context
Found via #2715 (the 2026-10-30 nixpkgs update). awscli (home/common/default.nix, via the assigned pkgs from nixos/nixpkgs/default.nix) fails pythonRuntimeDepsCheck on the new pins:
Checking runtime dependencies for awscli-1.44.21-py3-none-any.whl
- botocore==1.42.31 not satisfied by version 1.43.79
- s3transfer<0.17.0,>=0.16.0 not satisfied by version 0.19.2
awscli 1.44.21 pins botocore exactly and s3transfer to the 0.16 line, but every current pin (master/unstable/stable/25 alike) ships botocore 1.43.79 and s3transfer 0.19.2 — the tree is mid-transition (libraries bumped, awscli not yet). The skew is in the raw sets too, not an artifact of this repo's overlays. awscli and botocore are developed in lockstep (awscli imports botocore internals), so relaxing awscli's pins (pythonRelaxDeps) risks shipping a subtly broken CLI; pinning the libraries back for awscli only is the conservative fix.
The temporary fix
An overlay in nixos/nixpkgs/default.nix (next to the patchelf override) overrides awscli to use dedicated botocore 1.42.31 and s3transfer 0.16.0 derivations (the set's own expressions with version/source rolled back), leaving the set's botocore/s3transfer at their current versions for all other consumers (boto3 etc.).
Removal condition
Remove once stock awscli passes pythonRuntimeDepsCheck on the assigned set's pin — i.e. upstream nixpkgs bumps awscli to a release whose botocore/s3transfer requirements match the tree (or restores the pairing some other way).
Removal test
Delete the overlay; build awscli from the assigned pkgs plus config.system.build.toplevel for amd; both must succeed, and aws --version in the system profile should report the tree's awscli.
Acceptance criteria
- The temporary awscli overlay in
nixos/nixpkgs/default.nix(dedicated botocore 1.42.31 / s3transfer 0.16.0 derivations) is removed once stock awscli passespythonRuntimeDepsCheckon the assigned set's pin. - With the overlay deleted,
awsclibuilds from the assigned pkgs andconfig.system.build.toplevelfor amd builds successfully. aws --versionin the system profile reports the tree's awscli version.
Activity
dezren39 commentedon Nov 2, 2026
Intake review
🤖 Fleet monitor (repo-fleet-monitor) intake pass, 2026-11-02.
nixos/nixpkgs/default.nix.pythonRuntimeDepsCheckagainst the tree's botocore/s3transfer pins); no merged PR references this issue.pythonRelaxDepsis the wrong fix (awscli imports botocore internals), the removal condition, and a concrete removal test. Acceptance criteria appended from its own Removal test section.dezren39 commentedon Nov 2, 2026
Implemented on the nixpkgs-update branch (commit d9ee24c), as an overlay in
nixos/nixpkgs/default.nixnext to the patchelf override:botocorerolled back to 1.42.31 ands3transferto 0.16.0 as dedicated derivations (hashes harvested from mismatch builds), used ONLY by awscli: itsdependenciesare rewritten to point at them. The set's botocore/s3transfer stay at 1.43.79/0.19.2 for all other consumers (aiobotocore etc.) — graph-verified.pythonCatchConflictsPhasefails the build.installCheckPhasegrep is retargeted from the set's botocore version to the pinned one (the expression grepsaws --versionfor the botocore it pairs with; same assertion, pairing in force).Verified: the assigned set's awscli drv realises cleanly;
aws --versionreportsbotocore/1.42.31. Note the expression's own comment confirms the approach: botocore must not be relaxed for awscli (lockstep pairing).Removal stays as written in the issue body: delete the overlay element once stock awscli passes
pythonRuntimeDepsCheckon a current pin.dezren39 commentedon Nov 3, 2026
🤖 Agent note · picked up + triage verdict: STILL LIVE — blocked upstream (no code change made)
mainateef89b983(fresh fetch, 2026-11-03T16:05Z)Removal condition is not met. The overlay is live on main (
nixos/nixpkgs/default.nix:23-88, landed as #4915, merged 2026-11-03T13:40Z), and the pin it targets still has the same skew:inputs.nixpkgs←nixpkgs-unstable←fleet/nixpkgs(flake.nix:99-108) → dezren39/fleet082bd9e78f9887a8a43(2026-11-02 tip)c61a74e1e2cfdb2236cfe7439b6b14aws-cli 1.44.21's own
setup.py(tag 1.44.21) pinsbotocore==1.42.31ands3transfer>=0.16.0,<0.17.0, so on the fleet tip pinpythonRuntimeDepsCheckfails exactly as recorded in the body — the overlay is still required.Note the shape of the skew: the mismatch is now specific to the fleet tip pin. The three older pins pair awscli 1.44.21 with botocore 1.42.31 / s3transfer 0.16.0 and would need no overlay; the tip bumped botocore/s3transfer to 1.43.79/0.19.2 ahead of awscli, which is the mid-transition the body describes. The overlay exists only because the fleet pin follows the tip.
Routing
nixos/nixpkgs/default.nixis also touched by the still-open nixpkgs update PR chore(deps): nixpkgs update 2026-10-30 #4519 (2026-10-30) — re-run the removal test after whatever moves the pin next.awsclifrom the assigned pkgs plusconfig.system.build.toplevelfor amd, and confirmaws --versionreports the tree's awscli.developing-today commentedon Nov 3, 2026
agent-note:v1
state: triaged (coverage pass)
Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 30 (priority/low). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
Found via: coverage pass 2026-11-03
dezren39 commentedon Nov 4, 2026
🤖 Agent note · handed off
opencodedezren39 commentedon Nov 4, 2026
🤖 Agent note · handed off
opencode, so this task is handed off — the laptop claimant launches the bound opencode session, which drives task 8740 to its terminal state. Fresh check this shift: issue chore(deps): remove the awscli botocore/s3transfer pins once nixpkgs' awscli pairing is consistent again #4167 is OPEN with no hard-stop labels. Task 8740 is at attempt 8 of 12 after repeated handoffs — claimant throughput remains the constraint.dezren39 commentedon Nov 4, 2026
🤖 Agent note · triaged (verdict: STILL LIVE — blocked upstream; follow-up task enqueued)
c8b9355e-319a-4640-8096-7ad19480d151Verified against:
mainatd45cf2bd4(fresh fetch, 2026-11-04T14:05Z).Removal condition still not met. The temporary overlay is live on main (
nixos/nixpkgs/default.nix:23-88, added by #4915, commitd23fa2b14), and the pin it targets has not moved since the 2026-11-03 triage:flake.locknixpkgsis still1925c603f17f…(unstable, last-modified epoch 1727348695 = 2024-09-26), on whichawscli1.44.21 failspythonRuntimeDepsCheckagainst botocore 1.43.79 / s3transfer 0.19.2. Thechore/nixpkgs-update-2026-11-04branch exists and still carries the overlay unchanged — the update pass has not yet shown a pairing that makes removal possible.Routing
repo-health-code-pilot,small_fix, priority 40) withnot_before = 2026-11-11T15:00Z, so the removal is re-checked after the next nixpkgs update pass instead of re-triaging this issue.awsclifrom the assigned pkgs plusconfig.system.build.toplevelfor amd, confirmaws --versionreports the tree's awscli.