From bd458f9f89ec5203df8b7144ec2393202cff8387 Mon Sep 17 00:00:00 2001
From: eldritch horrors <pennae@lix.systems>
Date: Wed, 28 Jan 2026 12:41:26 +0100
Subject: [PATCH] libstore: make privateNetwork a function of
 LinuxLocalDerivationGoal

it's only used there, and this avoids using it uninitialized.

Change-Id: I6bd84e3c441dc6750e8ab07822f896136586cd66
---
 lix/libstore/build/local-derivation-goal.hh |  5 -----
 lix/libstore/platform/linux.cc              | 10 ++++------
 lix/libstore/platform/linux.hh              |  9 ++++++++-
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/lix/libstore/build/local-derivation-goal.hh b/lix/libstore/build/local-derivation-goal.hh
index cc810a441..6dc22651c 100644
--- a/lix/libstore/build/local-derivation-goal.hh
+++ b/lix/libstore/build/local-derivation-goal.hh
@@ -71,11 +71,6 @@ struct LocalDerivationGoal : public DerivationGoal
      */
     std::shared_ptr<AutoDelete> autoDelChroot;
 
-    /**
-     * Whether to run the build in a private network namespace.
-     */
-    bool privateNetwork = false;
-
     /**
      * Stuff we need to pass to initChild().
      */
diff --git a/lix/libstore/platform/linux.cc b/lix/libstore/platform/linux.cc
index aeb1af127..aa6966e3d 100644
--- a/lix/libstore/platform/linux.cc
+++ b/lix/libstore/platform/linux.cc
@@ -932,7 +932,7 @@ bool LinuxLocalDerivationGoal::prepareChildSetup()
 
     userNamespaceSync.readSide.reset();
 
-    if (privateNetwork) {
+    if (privateNetwork()) {
 
         /* Initialise the loopback interface. */
         AutoCloseFD fd(socket(PF_INET, SOCK_DGRAM, IPPROTO_IP));
@@ -1299,12 +1299,9 @@ Pid LinuxLocalDerivationGoal::startChild(
        us.
     */
 
-    if (derivationType->isSandboxed())
-        privateNetwork = true;
-
     // don't launch pasta unless we have a tun device. in a build sandbox we
     // commonly do not, and trying to run pasta anyway naturally won't work.
-    runPasta = !privateNetwork && settings.pastaPath != "" && pathExists("/dev/net/tun");
+    runPasta = !privateNetwork() && settings.pastaPath != "" && pathExists("/dev/net/tun");
 
     userNamespaceSync.create();
 
@@ -1334,8 +1331,9 @@ Pid LinuxLocalDerivationGoal::startChild(
         options.cloneFlags = CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWIPC | CLONE_NEWUTS | CLONE_PARENT | SIGCHLD;
         // we always want to create a new network namespace for pasta, even when
         // we can't actually run it. not doing so hides bugs and impairs purity.
-        if (settings.pastaPath != "" || privateNetwork)
+        if (settings.pastaPath != "" || privateNetwork()) {
             options.cloneFlags |= CLONE_NEWNET;
+        }
         if (worker.namespaces.user) {
             options.cloneFlags |= CLONE_NEWUSER;
         }
diff --git a/lix/libstore/platform/linux.hh b/lix/libstore/platform/linux.hh
index dd619df42..8976a7a8d 100644
--- a/lix/libstore/platform/linux.hh
+++ b/lix/libstore/platform/linux.hh
@@ -101,6 +101,13 @@ private:
      * Pipe for synchronising updates to the builder namespaces.
      */
     Pipe userNamespaceSync;
-};
 
+    /**
+     * Whether to run the build in a private network namespace.
+     */
+    bool privateNetwork() const
+    {
+        return derivationType.value().isSandboxed();
+    }
+};
 }