Maximilian BoschandRobert Hensing
325e7e1824
Closes #334 Closes #626 This is loosely based on upstream PR#10877[1], but heavily changed to use the graph logic from `nix why-depends`. `precise` is `false` here since the out-path of the drv being built isn't registered yet, so the path accessor cannot scan through files yet. Example output (from an openssh build with `pcsclite.lib` & `glibc` in `disallowedRequisites`): error: output '/nix/store/hr8lmmjmd1jk6s3p5ymggyk4am7n2lmb-openssh-10.0p2' is not allowed to refer to the following paths: /nix/store/p6r5awz3ywrz66symnrn0xb85xzmcysf-pcsclite-2.3.0-lib /nix/store/q4wq65gl3r8fy746v9bbwgx4gzn0r2kl-glibc-2.40-66 Shown below are chains that lead to the forbidden path(s). /nix/store/hr8lmmjmd1jk6s3p5ymggyk4am7n2lmb-openssh-10.0p2 └───/nix/store/ys91ywnwikm14xznwk3cdbprapv2m37z-libfido2-1.16.0 └───/nix/store/p6r5awz3ywrz66symnrn0xb85xzmcysf-pcsclite-2.3.0-lib /nix/store/hr8lmmjmd1jk6s3p5ymggyk4am7n2lmb-openssh-10.0p2 ├───/nix/store/q4wq65gl3r8fy746v9bbwgx4gzn0r2kl-glibc-2.40-66 ├───/nix/store/6r4zqb04fq5l5l4zghq76wvcpz7dwd35-linux-pam-1.6.1 │ ├───/nix/store/q4wq65gl3r8fy746v9bbwgx4gzn0r2kl-glibc-2.40-66 [...] [1] https://github.com/NixOS/nix/pull/10877 Co-authored-by: Robert Hensing <robert@roberthensing.nl> Change-Id: Ib30024c0d9e45c1160bf0134f7d3ba17dbdeff47
86 lines
2.0 KiB
Nix
86 lines
2.0 KiB
Nix
with import ./config.nix;
|
|
|
|
rec {
|
|
dep1 = mkDerivation {
|
|
name = "check-reqs-dep1";
|
|
builder = builtins.toFile "builder.sh" "mkdir $out; touch $out/file1";
|
|
};
|
|
|
|
dep2 = mkDerivation {
|
|
name = "check-reqs-dep2";
|
|
builder = builtins.toFile "builder.sh" "mkdir $out; touch $out/file2";
|
|
};
|
|
|
|
deps = mkDerivation {
|
|
name = "check-reqs-deps";
|
|
dep1 = dep1;
|
|
dep2 = dep2;
|
|
builder = builtins.toFile "builder.sh" ''
|
|
mkdir $out
|
|
ln -s $dep1/file1 $out/file1
|
|
ln -s $dep2/file2 $out/file2
|
|
'';
|
|
};
|
|
|
|
makeTest = nr: allowreqs: mkDerivation {
|
|
name = "check-reqs-" + toString nr;
|
|
inherit deps;
|
|
builder = builtins.toFile "builder.sh" ''
|
|
mkdir $out
|
|
ln -s $deps $out/depdir1
|
|
'';
|
|
allowedRequisites = allowreqs;
|
|
};
|
|
|
|
# When specifying all the requisites, the build succeeds.
|
|
test1 = makeTest 1 [ dep1 dep2 deps ];
|
|
|
|
# But missing anything it fails.
|
|
test2 = makeTest 2 [ dep2 deps ];
|
|
test3 = makeTest 3 [ dep1 deps ];
|
|
test4 = makeTest 4 [ deps ];
|
|
test5 = makeTest 5 [];
|
|
|
|
test6 = mkDerivation {
|
|
name = "check-reqs";
|
|
inherit deps;
|
|
builder = builtins.toFile "builder.sh" "mkdir $out; ln -s $deps $out/depdir1";
|
|
disallowedRequisites = [ dep1 dep2 ];
|
|
};
|
|
|
|
test7 = mkDerivation {
|
|
name = "check-reqs";
|
|
inherit deps;
|
|
builder = builtins.toFile "builder.sh" "mkdir $out; ln -s $deps $out/depdir1";
|
|
disallowedRequisites = [test1];
|
|
};
|
|
|
|
test8 = mkDerivation {
|
|
name = "check-reqs-structured-attrs";
|
|
__structuredAttrs = true;
|
|
outputChecks.out = {
|
|
allowedRequisites = [dep2];
|
|
};
|
|
inherit dep2;
|
|
outputs = [ "out" ];
|
|
buildCommand = ''
|
|
set -x
|
|
out=''${outputs[out]}
|
|
mkdir $out
|
|
ln -s $dep2 $out/depdir1
|
|
ln -sf $out $out/self-reference
|
|
'';
|
|
};
|
|
|
|
test9 = mkDerivation {
|
|
name = "check-reqs-structured-attrs";
|
|
allowedRequisites = [dep2];
|
|
inherit dep2;
|
|
buildCommand = ''
|
|
mkdir $out
|
|
ln -s $dep2 $out/depdir1
|
|
ln -sf $out $out/self-reference
|
|
'';
|
|
};
|
|
}
|