diff options
| author | tv <tv@krebsco.de> | 2026-11-13 21:10:04 +0000 |
|---|---|---|
| committer | tv <tv@krebsco.de> | 2026-11-13 22:16:47 +0100 |
| commit | 75f2fddb65c0d0b7659282a1e210bd2ddb3abefa (patch) | |
| tree | 980badaab53cad26907a3b4c04ac8ea9ae6de305 /pkgs | |
| parent | 8dfa3f18d42d852ece3f2d9cf1ae117acccc0b15 (diff) | |
populate: stop if a flake's URL can't be found
The URLs of flakes went into nix flake lock's and nix flake metadata's
arguments as command substitutions, whose failure doesn't stop a script
under set -e. After "error: source p is not a directory", nix flake
lock ran with an empty URL, which Nix takes for the current directory:
on a remote target, the login directory, which ended up in the
world-readable store, .ssh included. URLs get assigned first now, so
failing to find one stops populate.
A phase's unexpected lists what populate is expected not to print,
whether it succeeds or not; notdir expects populate not to go on
locking.
Diffstat (limited to 'pkgs')
| -rw-r--r-- | pkgs/populate/default.nix | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/pkgs/populate/default.nix b/pkgs/populate/default.nix index 7b22662..163f1de 100644 --- a/pkgs/populate/default.nix +++ b/pkgs/populate/default.nix @@ -383,18 +383,23 @@ let ++ inputChecks from (drop (length parent) path); # Sets the positional parameters to nix flake lock's arguments for # drawing the inputs of the flake in source name from other sources. + # URLs get assigned first, so failing to find one stops the script, + # which a command substitution in an argument wouldn't: Nix would take + # the empty URL for the current directory. overrideArgs = name: /* sh */ '' set -- ${concatMapStrings (x: /* sh */ '' - set -- "$@" --override-input ${quote (concatStringsSep "/" (drawnPath name x.path))} ${url (check name x.source)} + drawn_url=${url (check name x.source)} + set -- "$@" --override-input ${quote (concatStringsSep "/" (drawnPath name x.path))} "$drawn_url" '') (flakeFollows sources.${name})} ''; # Rewrites the lock file of the flake in a file or git source in place. rewrite = name: /* sh */ '' ( ${overrideArgs name} + own_url=$(flake_url ${quote name}) own_lock "$(readlink -f ${quote "${target.path}/${name}"})" - nix flake lock "$@" "$(flake_url ${quote name})" >&2 + nix flake lock "$@" "$own_url" >&2 ) ''; # Derives what the target path of a flake or flake-input source gets from @@ -489,8 +494,9 @@ let fi ${optionalString rewriteLock /* sh */ '' ${overrideArgs name} + own_url=$(flake_url ${quote name}) own_lock ${quote targetPath} - nix flake lock "$@" "$(flake_url ${quote name})" >&2 + nix flake lock "$@" "$own_url" >&2 ''} '' else /* sh */ '' if test -e ${quote "${dir}/key"} && @@ -674,8 +680,9 @@ let ${concatMapStrings (x: /* sh */ '' set -- "$@" --override-input ${quote (concatStringsSep "/" x.path)} "path:$locks_dir" '') follows} + own_url=$(own_flake_url ${quote name}) if ! nix flake metadata --json --no-write-lock-file "$@" \ - "$(own_flake_url ${quote name})" > "$locks_dir"/${quote name}.json; then + "$own_url" > "$locks_dir"/${quote name}.json; then >&2 printf 'error: source %s draws inputs from other sources, but its flake can'"'"'t be locked\n' \ ${quote name} exit 1 |