From 21e8347bb6be09ae7f9afd0e3d93dc63c08315f8 Mon Sep 17 00:00:00 2001
From: eldritch horrors <pennae@lix.systems>
Date: Sun, 25 Jan 2026 15:34:59 +0100
Subject: [PATCH] libstore: make netrc/cafile child args plain strings again

not having the optionals set when the builder runs (e.g. because FOD
hashes were not configured correctly) could cause assertion failures
in the builder process. while this should usually not happen we *do*
want to print a useful error message here instead of a crash report.

Change-Id: I81fb1d45fcbf660d0d9a7f0c0a12c38379ecd4c6
---
 lix/libstore/build/local-derivation-goal.cc | 18 +++++++-----------
 lix/libstore/build/local-derivation-goal.hh |  8 ++++----
 lix/libstore/platform/linux.cc              |  4 ++--
 lix/libstore/platform/linux.hh              |  4 ++--
 4 files changed, 15 insertions(+), 19 deletions(-)

diff --git a/lix/libstore/build/local-derivation-goal.cc b/lix/libstore/build/local-derivation-goal.cc
index fe1b99861..0e16221f3 100644
--- a/lix/libstore/build/local-derivation-goal.cc
+++ b/lix/libstore/build/local-derivation-goal.cc
@@ -841,19 +841,17 @@ try {
     /* Make the contents of netrc and the CA certificate bundle
        available to builtin:fetchurl (which may run under a
        different uid and/or in a sandbox). */
-    std::optional<std::string> netrcData;
-    std::optional<std::string> caFileData;
+    std::string netrcData;
+    std::string caFileData;
     if (drv->isBuiltin() && drv->builder == "builtin:fetchurl" && !derivationType->isSandboxed()) {
         try {
             netrcData = readFile(settings.netrcFile);
         } catch (SysError &) {
-            netrcData = "";
         }
 
         try {
             caFileData = readFile(settings.caFile);
         } catch (SysError &) {
-            caFileData = "";
         }
     }
 
@@ -911,8 +909,8 @@ try {
 }
 
 Pid LocalDerivationGoal::startChild(
-    const std::optional<std::string> & netrcData,
-    const std::optional<std::string> & caFileData,
+    const std::string & netrcData,
+    const std::string & caFileData,
     const Strings & envStrs,
     const Strings & args,
     AutoCloseFD logPTY
@@ -1159,8 +1157,8 @@ void LocalDerivationGoal::chownToBuilder(const AutoCloseFD & fd)
 }
 
 void LocalDerivationGoal::runChild(
-    const std::optional<std::string> & netrcData,
-    const std::optional<std::string> & caFileData,
+    const std::string & netrcData,
+    const std::string & caFileData,
     const Strings & envStrs,
     const Strings & args
 )
@@ -1233,9 +1231,7 @@ void LocalDerivationGoal::runChild(
                     e.second = rewriteStrings(e.second, inputRewrites);
 
                 if (drv->builder == "builtin:fetchurl") {
-                    assert(netrcData.has_value());
-                    assert(caFileData.has_value());
-                    builtinFetchurl(drv2, netrcData.value(), caFileData.value());
+                    builtinFetchurl(drv2, netrcData, caFileData);
                 } else if (drv->builder == "builtin:buildenv") {
                     builtinBuildenv(drv2);
                 } else if (drv->builder == "builtin:unpack-channel") {
diff --git a/lix/libstore/build/local-derivation-goal.hh b/lix/libstore/build/local-derivation-goal.hh
index a76acbe56..1d34546a0 100644
--- a/lix/libstore/build/local-derivation-goal.hh
+++ b/lix/libstore/build/local-derivation-goal.hh
@@ -215,8 +215,8 @@ struct LocalDerivationGoal : public DerivationGoal
      * Run the builder's process.
      */
     void runChild(
-        const std::optional<std::string> & netrcData,
-        const std::optional<std::string> & caFileData,
+        const std::string & netrcData,
+        const std::string & caFileData,
         const Strings & envStrs,
         const Strings & args
     );
@@ -317,8 +317,8 @@ protected:
      * On some platforms this process is created with sandboxing flags.
      */
     virtual Pid startChild(
-        const std::optional<std::string> & netrcData,
-        const std::optional<std::string> & caFileData,
+        const std::string & netrcData,
+        const std::string & caFileData,
         const Strings & envStrs,
         const Strings & args,
         AutoCloseFD logPTY
diff --git a/lix/libstore/platform/linux.cc b/lix/libstore/platform/linux.cc
index 343e1d693..f69879698 100644
--- a/lix/libstore/platform/linux.cc
+++ b/lix/libstore/platform/linux.cc
@@ -1239,8 +1239,8 @@ bool LinuxLocalDerivationGoal::prepareChildSetup()
 }
 
 Pid LinuxLocalDerivationGoal::startChild(
-    const std::optional<std::string> & netrcData,
-    const std::optional<std::string> & caFileData,
+    const std::string & netrcData,
+    const std::string & caFileData,
     const Strings & envStrs,
     const Strings & args,
     AutoCloseFD logPTY
diff --git a/lix/libstore/platform/linux.hh b/lix/libstore/platform/linux.hh
index 29e44315c..dba85bca8 100644
--- a/lix/libstore/platform/linux.hh
+++ b/lix/libstore/platform/linux.hh
@@ -74,8 +74,8 @@ private:
      * create /etc/passwd and /etc/group based on discovered uid/gid
      */
     Pid startChild(
-        const std::optional<std::string> & netrcData,
-        const std::optional<std::string> & caFileData,
+        const std::string & netrcData,
+        const std::string & caFileData,
         const Strings & envStrs,
         const Strings & args,
         AutoCloseFD logPTY