nix/develop: Don't ignore SSL_CERT_FILE when its value is meaningful

Change-Id: I31e85a5995edc40ed2e687077ffdf563e717abb4

doc/manual/rl-next/develop-ssl_cert_file.md

@@ -0,0 +1,8 @@
+---
+synopsis: "`nix develop` no longer ignores the env variable `SSL_CERT_FILE`"
+cls: [5042]
+category: "Improvements"
+credits: [thubrecht]
+---
+
+Running `nix develop` and `nix print-dev-env` on shells that define the environment variable `SSL_CERT_FILE` now works correctly by exporting that variable inside the built shell.

lix/nix/develop.cc

@@ -140,7 +140,19 @@ struct BuildEnvironment
     void toBash(std::ostream & out, const std::set<std::string> & ignoreVars) const
     {
         for (auto & [name, value] : vars) {
-            if (!ignoreVars.count(name)) {
+            // NOTE: Nixpkgs sets SSL_CERT_FILE to `/no-cert-file.crt` by default
+            //       which we want to filter out as it leads to broken shells
+            //       However, outright ignoring it means that it is impossible to
+            //       set a custom cert file using the env variable definition of a shell
+            //       which is stupid.
+            if (name == "SSL_CERT_FILE") {
+                if (auto str = std::get_if<String>(&value); str->value != "/no-cert-file.crt") {
+                    out << fmt("%s=%s\n", name, bashEscape(str->value));
+                    if (str->exported) {
+                        out << fmt("export %s\n", name);
+                    }
+                }
+            } else if (!ignoreVars.count(name)) {
                 if (auto str = std::get_if<String>(&value)) {
                     out << fmt("%s=%s\n", name, bashEscape(str->value));
                     if (str->exported)
@@ -305,7 +317,6 @@ struct Common : InstallableCommand, MixProfile
         "NIX_REMOTE",
         "PPID",
         "SHELLOPTS",
-        "SSL_CERT_FILE", // FIXME: only want to ignore /no-cert-file.crt
         "TEMP",
         "TEMPDIR",
         "TERM",

tests/functional/nix-shell/basic.sh

@@ -221,3 +221,7 @@ assert (!(args ? inNixShell));
 (import $shellDotNix { }).shellDrv
 EOF
 nix-shell $TEST_ROOT/shell-ellipsis.nix --run "true"
+
+# Test correct handling of SSL_CERT_FILE
+nix print-dev-env -f $shellDotNix shellWithCerts | grepQuiet "SSL_CERT_FILE='/path/to/a/real/cert.crt'"
+nix print-dev-env -f $shellDotNix shellWithNoCerts | grepInverse "SSL_CERT_FILE"

tests/functional/nix-shell/shell.nix

@@ -56,6 +56,18 @@ let pkgs = rec {
     outputs = ["dev" "out"];
   };
 
+  shellWithCerts = mkDerivation {
+    name = "shell-with-certs";
+    inherit stdenv;
+    SSL_CERT_FILE = "/path/to/a/real/cert.crt";
+  };
+
+  shellWithNoCerts = mkDerivation {
+    name = "shell-with-certs";
+    inherit stdenv;
+    SSL_CERT_FILE = "/no-cert-file.crt";
+  };
+
   # Used by nix-shell -p
   runCommand = name: args: buildCommand: mkDerivation (args // {
     inherit name buildCommand stdenv;