forked from lix-project/lix
commit
3d15dbadc2
|
@ -519,7 +519,6 @@ EvalState::EvalState(
|
||||||
static_assert(sizeof(Env) <= 16, "environment must be <= 16 bytes");
|
static_assert(sizeof(Env) <= 16, "environment must be <= 16 bytes");
|
||||||
|
|
||||||
/* Initialise the Nix expression search path. */
|
/* Initialise the Nix expression search path. */
|
||||||
evalSettings.nixPath.setDefault(evalSettings.getDefaultNixPath());
|
|
||||||
if (!evalSettings.pureEval) {
|
if (!evalSettings.pureEval) {
|
||||||
for (auto & i : _searchPath) addToSearchPath(i);
|
for (auto & i : _searchPath) addToSearchPath(i);
|
||||||
for (auto & i : evalSettings.nixPath.get()) addToSearchPath(i);
|
for (auto & i : evalSettings.nixPath.get()) addToSearchPath(i);
|
||||||
|
@ -2473,35 +2472,30 @@ std::ostream & operator << (std::ostream & str, const ExternalValueBase & v) {
|
||||||
|
|
||||||
EvalSettings::EvalSettings()
|
EvalSettings::EvalSettings()
|
||||||
{
|
{
|
||||||
|
auto var = getEnv("NIX_PATH");
|
||||||
|
if (var) nixPath = parseNixPath(*var);
|
||||||
}
|
}
|
||||||
|
|
||||||
/* impure => NIX_PATH or a default path
|
|
||||||
* restrict-eval => NIX_PATH
|
|
||||||
* pure-eval => empty
|
|
||||||
*/
|
|
||||||
Strings EvalSettings::getDefaultNixPath()
|
Strings EvalSettings::getDefaultNixPath()
|
||||||
{
|
{
|
||||||
if (pureEval)
|
|
||||||
return {};
|
|
||||||
|
|
||||||
auto var = getEnv("NIX_PATH");
|
|
||||||
if (var) {
|
|
||||||
return parseNixPath(*var);
|
|
||||||
} else if (restrictEval) {
|
|
||||||
return {};
|
|
||||||
} else {
|
|
||||||
Strings res;
|
Strings res;
|
||||||
auto add = [&](const Path & p, const std::optional<std::string> & s = std::nullopt) {
|
auto add = [&](const Path & p, const std::string & s = std::string()) {
|
||||||
if (pathExists(p))
|
if (pathExists(p)) {
|
||||||
res.push_back(s ? *s + "=" + p : p);
|
if (s.empty()) {
|
||||||
|
res.push_back(p);
|
||||||
|
} else {
|
||||||
|
res.push_back(s + "=" + p);
|
||||||
|
}
|
||||||
|
}
|
||||||
};
|
};
|
||||||
|
|
||||||
|
if (!evalSettings.restrictEval && !evalSettings.pureEval) {
|
||||||
add(settings.useXDGBaseDirectories ? getStateDir() + "/nix/defexpr/channels" : getHome() + "/.nix-defexpr/channels");
|
add(settings.useXDGBaseDirectories ? getStateDir() + "/nix/defexpr/channels" : getHome() + "/.nix-defexpr/channels");
|
||||||
add(settings.nixStateDir + "/profiles/per-user/root/channels/nixpkgs", "nixpkgs");
|
add(settings.nixStateDir + "/profiles/per-user/root/channels/nixpkgs", "nixpkgs");
|
||||||
add(settings.nixStateDir + "/profiles/per-user/root/channels");
|
add(settings.nixStateDir + "/profiles/per-user/root/channels");
|
||||||
|
}
|
||||||
|
|
||||||
return res;
|
return res;
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
||||||
bool EvalSettings::isPseudoUrl(std::string_view s)
|
bool EvalSettings::isPseudoUrl(std::string_view s)
|
||||||
|
|
|
@ -570,7 +570,7 @@ struct EvalSettings : Config
|
||||||
{
|
{
|
||||||
EvalSettings();
|
EvalSettings();
|
||||||
|
|
||||||
Strings getDefaultNixPath();
|
static Strings getDefaultNixPath();
|
||||||
|
|
||||||
static bool isPseudoUrl(std::string_view s);
|
static bool isPseudoUrl(std::string_view s);
|
||||||
|
|
||||||
|
@ -580,15 +580,8 @@ struct EvalSettings : Config
|
||||||
"Whether builtin functions that allow executing native code should be enabled."};
|
"Whether builtin functions that allow executing native code should be enabled."};
|
||||||
|
|
||||||
Setting<Strings> nixPath{
|
Setting<Strings> nixPath{
|
||||||
this, {}, "nix-path",
|
this, getDefaultNixPath(), "nix-path",
|
||||||
R"(
|
"List of directories to be searched for `<...>` file references."};
|
||||||
List of directories to be searched for `<...>` file references.
|
|
||||||
|
|
||||||
If [pure evaluation](#conf-pure-eval) is disabled,
|
|
||||||
this is initialised using the [`NIX_PATH`](@docroot@/command-ref/env-common.md#env-NIX_PATH)
|
|
||||||
environment variable, or, if it is unset and [restricted evaluation](#conf-restrict-eval)
|
|
||||||
is disabled, a default search path including the user's and `root`'s channels.
|
|
||||||
)"};
|
|
||||||
|
|
||||||
Setting<bool> restrictEval{
|
Setting<bool> restrictEval{
|
||||||
this, false, "restrict-eval",
|
this, false, "restrict-eval",
|
||||||
|
|
|
@ -12,8 +12,3 @@ nix-instantiate --eval -E '<by-relative-path/simple.nix>' --restrict-eval
|
||||||
|
|
||||||
[[ $(nix-instantiate --find-file by-absolute-path/simple.nix) = $PWD/simple.nix ]]
|
[[ $(nix-instantiate --find-file by-absolute-path/simple.nix) = $PWD/simple.nix ]]
|
||||||
[[ $(nix-instantiate --find-file by-relative-path/simple.nix) = $PWD/simple.nix ]]
|
[[ $(nix-instantiate --find-file by-relative-path/simple.nix) = $PWD/simple.nix ]]
|
||||||
|
|
||||||
unset NIX_PATH
|
|
||||||
|
|
||||||
[[ $(nix-instantiate --option nix-path by-relative-path=. --find-file by-relative-path/simple.nix) = "$PWD/simple.nix" ]]
|
|
||||||
[[ $(NIX_PATH= nix-instantiate --option nix-path by-relative-path=. --find-file by-relative-path/simple.nix) = "$PWD/simple.nix" ]]
|
|
||||||
|
|
|
@ -17,9 +17,6 @@ nix-instantiate --restrict-eval --eval -E 'builtins.readDir ../src/nix-channel'
|
||||||
(! nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in <foo>')
|
(! nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in <foo>')
|
||||||
nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in <foo>' -I src=.
|
nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in <foo>' -I src=.
|
||||||
|
|
||||||
# no default NIX_PATH
|
|
||||||
(unset NIX_PATH; ! nix-instantiate --restrict-eval --find-file .)
|
|
||||||
|
|
||||||
p=$(nix eval --raw --expr "builtins.fetchurl file://$(pwd)/restricted.sh" --impure --restrict-eval --allowed-uris "file://$(pwd)")
|
p=$(nix eval --raw --expr "builtins.fetchurl file://$(pwd)/restricted.sh" --impure --restrict-eval --allowed-uris "file://$(pwd)")
|
||||||
cmp $p restricted.sh
|
cmp $p restricted.sh
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue