From 1eac5a6bd0352ff2366e1feedd01abbd83d59546 Mon Sep 17 00:00:00 2001
From: Rok Garbas <rok@garbas.si>
Date: Wed, 26 Jan 2022 09:22:51 +0100
Subject: [PATCH 001/251] Script to push docker image for releases

---
 maintainers/push-docker.sh | 69 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)
 create mode 100755 maintainers/push-docker.sh

diff --git a/maintainers/push-docker.sh b/maintainers/push-docker.sh
new file mode 100755
index 000000000..a705f0738
--- /dev/null
+++ b/maintainers/push-docker.sh
@@ -0,0 +1,69 @@
+#/usr/bin/env bash
+
+# TODO: parse from .version
+MAINTENANCE_VERSION="2.6"
+VERSION="$MAINTENANCE_VERSION.0"
+
+# Should be override `latest` tag, default true
+PUSH_AS_LATEST=1
+
+PLATFORMS="x86_64-linux aarch64-linux"
+
+# ensure we are logged to docker hub
+docker login
+
+DOCKER_MANIFEST=""
+DOCKER_MANIFEST_LATEST=""
+
+for PLATFORM in $PLATFORMS;
+do
+  echo "=> Loading docker image for $PLATFORM platform ..."
+
+  DOCKER_IMAGE_TMP_FILE="$PWD/image-$PLATFORM.tar.gz"
+  if [ ! -f "$DOCKER_IMAGE_TMP_FILE" ]; then
+    curl -L https://hydra.nixos.org/job/nix/maintenance-$MAINTENANCE_VERSION/dockerImage.$PLATFORM/latest/download/1 > $DOCKER_IMAGE_TMP_FILE
+  fi
+  docker load -i $DOCKER_IMAGE_TMP_FILE
+
+  if   [ "$PLATFORM" = "x86_64-linux" ];  then DOCKER_PLATFORM="amd64"
+  elif [ "$PLATFORM" = "aarch64-linux" ]; then DOCKER_PLATFORM="arm64"
+  else
+    echo "EROROR: No docker platform found for $PLATFORM platform"
+    exit 1
+  fi
+
+  echo "=> Tagging docker image of version $VERSION for $PLATFORM platform ..."
+
+  docker tag nix:$VERSION nixos/nix:$VERSION-$DOCKER_PLATFORM
+  if [ $PUSH_AS_LATEST -eq 1 ]; then
+    echo "=> Tagging docker image of version latest for $PLATFORM platform ..."
+    docker tag nix:$VERSION nixos/nix:latest
+  fi
+
+  echo "=> Pushing docker image of version $VERSION for $PLATFORM platform ..."
+
+  docker push nixos/nix:$VERSION-$DOCKER_PLATFORM
+  if [ $PUSH_AS_LATEST -eq 1 ]; then
+    echo "=> Pushing docker image of version latest for $PLATFORM platform ..."
+    docker push nixos/nix:latest
+  fi
+
+  DOCKER_MANIFEST="$DOCKER_MANIFEST --amend nixos/nix:$VERSION-$DOCKER_PLATFORM"
+  DOCKER_MANIFEST_LATEST="$DOCKER_MANIFEST_LATEST --amend nixos/nix:latest-$DOCKER_PLATFORM"
+
+  echo
+done
+
+echo "=> Creating $VERSION multi platform docker manifest for the following platforms: $PLATFORMS ..."
+docker manifest create nixos/nix:$VERSION $DOCKER_MANIFEST
+if [ $PUSH_AS_LATEST -eq 1 ]; then
+  echo "=> Creating latest multi platform docker manifest for the following platforms: $PLATFORMS ..."
+  docker manifest create nixos/nix:latest $DOCKER_MANIFEST_LATEST
+fi
+
+echo "=> Pushing $VERSION multi platform docker manifest ..."
+docker manifest push nixos/nix:$VERSION
+if [ $PUSH_AS_LATEST -eq 1 ]; then
+  echo "=> Pushing latest multi platform docker manifest ..."
+  docker manifest push nixos/nix:latest
+fi

From 4fc3c4da7ba81a69c17063950933b45b39646949 Mon Sep 17 00:00:00 2001
From: Rok Garbas <rok@garbas.si>
Date: Wed, 26 Jan 2022 10:01:58 +0100
Subject: [PATCH 002/251] typo

---
 maintainers/push-docker.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/maintainers/push-docker.sh b/maintainers/push-docker.sh
index a705f0738..fe8fe174e 100755
--- a/maintainers/push-docker.sh
+++ b/maintainers/push-docker.sh
@@ -37,7 +37,7 @@ do
   docker tag nix:$VERSION nixos/nix:$VERSION-$DOCKER_PLATFORM
   if [ $PUSH_AS_LATEST -eq 1 ]; then
     echo "=> Tagging docker image of version latest for $PLATFORM platform ..."
-    docker tag nix:$VERSION nixos/nix:latest
+    docker tag nix:$VERSION nixos/nix:latest-$DOCKER_PLATFORM
   fi
 
   echo "=> Pushing docker image of version $VERSION for $PLATFORM platform ..."
@@ -45,7 +45,7 @@ do
   docker push nixos/nix:$VERSION-$DOCKER_PLATFORM
   if [ $PUSH_AS_LATEST -eq 1 ]; then
     echo "=> Pushing docker image of version latest for $PLATFORM platform ..."
-    docker push nixos/nix:latest
+    docker push nixos/nix:latest-$DOCKER_PLATFORM
   fi
 
   DOCKER_MANIFEST="$DOCKER_MANIFEST --amend nixos/nix:$VERSION-$DOCKER_PLATFORM"

From 50a9c48db4dddd6ba4c81dae74aa60f8ff10bfe5 Mon Sep 17 00:00:00 2001
From: Rok Garbas <rok@garbas.si>
Date: Wed, 26 Jan 2022 10:05:33 +0100
Subject: [PATCH 003/251] fail early

---
 maintainers/push-docker.sh | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/maintainers/push-docker.sh b/maintainers/push-docker.sh
index fe8fe174e..f9c5a6b18 100755
--- a/maintainers/push-docker.sh
+++ b/maintainers/push-docker.sh
@@ -17,6 +17,13 @@ DOCKER_MANIFEST_LATEST=""
 
 for PLATFORM in $PLATFORMS;
 do
+  if   [ "$PLATFORM" = "x86_64-linux" ];  then DOCKER_PLATFORM="amd64"
+  elif [ "$PLATFORM" = "aarch64-linux" ]; then DOCKER_PLATFORM="arm64"
+  else
+    echo "EROROR: No docker platform found for $PLATFORM platform"
+    exit 1
+  fi
+
   echo "=> Loading docker image for $PLATFORM platform ..."
 
   DOCKER_IMAGE_TMP_FILE="$PWD/image-$PLATFORM.tar.gz"
@@ -25,13 +32,6 @@ do
   fi
   docker load -i $DOCKER_IMAGE_TMP_FILE
 
-  if   [ "$PLATFORM" = "x86_64-linux" ];  then DOCKER_PLATFORM="amd64"
-  elif [ "$PLATFORM" = "aarch64-linux" ]; then DOCKER_PLATFORM="arm64"
-  else
-    echo "EROROR: No docker platform found for $PLATFORM platform"
-    exit 1
-  fi
-
   echo "=> Tagging docker image of version $VERSION for $PLATFORM platform ..."
 
   docker tag nix:$VERSION nixos/nix:$VERSION-$DOCKER_PLATFORM

From f222fba4dca69919d28468467e6e5c4c859cfc13 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Thu, 3 Feb 2022 20:51:47 -0600
Subject: [PATCH 004/251] Allow missing flake.nix for --override-input target
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

At this point, we don’t know if the input is a flake or not. So, we
should allow the user to override the input with a directory without a
flake.nix.

Ideally, we could figure whether the input was originally a flake or
not, but that would require instantiating the whole flake. So just
allow it to be missing here, and rely on checks later on to verify the
input for us.
---
 src/libcmd/installables.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index 38a177f80..5e8b62e1a 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -97,7 +97,7 @@ MixFlakeOptions::MixFlakeOptions()
             lockFlags.writeLockFile = false;
             lockFlags.inputOverrides.insert_or_assign(
                 flake::parseInputPath(inputPath),
-                parseFlakeRef(flakeRef, absPath(".")));
+                parseFlakeRef(flakeRef, absPath("."), true));
         }}
     });
 

From 1daf1babf956cab98857db92de8829a1e7f2ae3e Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Fri, 4 Feb 2022 07:36:56 +0100
Subject: [PATCH 005/251] fix nix repl not overriding existing bindings in :a

previously :a would override old bindings of a name with new values if the added
set contained names that were already bound. in nix 2.6 this doesn't happen any
more, which is potentially confusing.

fixes #6041
---
 src/libexpr/nixexpr.hh | 12 ++++++++----
 tests/repl.sh          | 23 +++++++++++++++++++++++
 2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/src/libexpr/nixexpr.hh b/src/libexpr/nixexpr.hh
index 4e923ac89..6f6acb074 100644
--- a/src/libexpr/nixexpr.hh
+++ b/src/libexpr/nixexpr.hh
@@ -367,15 +367,19 @@ struct StaticEnv
 
     void sort()
     {
-        std::sort(vars.begin(), vars.end(),
+        std::stable_sort(vars.begin(), vars.end(),
             [](const Vars::value_type & a, const Vars::value_type & b) { return a.first < b.first; });
     }
 
     void deduplicate()
     {
-        const auto last = std::unique(vars.begin(), vars.end(),
-            [] (const Vars::value_type & a, const Vars::value_type & b) { return a.first == b.first; });
-        vars.erase(last, vars.end());
+        auto it = vars.begin(), jt = it, end = vars.end();
+        while (jt != end) {
+            *it = *jt++;
+            while (jt != end && it->first == jt->first) *it = *jt++;
+            it++;
+        }
+        vars.erase(it, end);
     }
 
     Vars::const_iterator find(const Symbol & name) const
diff --git a/tests/repl.sh b/tests/repl.sh
index 0e23a98db..6505f1741 100644
--- a/tests/repl.sh
+++ b/tests/repl.sh
@@ -40,3 +40,26 @@ testRepl () {
 testRepl
 # Same thing (kind-of), but with a remote store.
 testRepl --store "$TEST_ROOT/store?real=$NIX_STORE_DIR"
+
+testReplResponse () {
+    local response="$(nix repl <<< "$1")"
+    echo "$response" | grep -qs "$2" \
+      || fail "repl command set:
+
+$1
+
+does not respond with:
+
+$2
+
+but with:
+
+$response"
+}
+
+# :a uses the newest version of a symbol
+testReplResponse '
+:a { a = "1"; }
+:a { a = "2"; }
+"result: ${a}"
+' "result: 2"

From 9d840758a8d195e52e8b7d08cd9c15f6b8259724 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 4 Feb 2022 22:43:16 +0100
Subject: [PATCH 006/251] completions: pipe stderr to /dev/null

This fixes weird issues where e.g.

    nix build -L .#<tab>

deletes the current line from the prompt.
---
 misc/bash/completion.sh | 2 +-
 misc/zsh/completion.zsh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/misc/bash/completion.sh b/misc/bash/completion.sh
index 8fc224792..045053dee 100644
--- a/misc/bash/completion.sh
+++ b/misc/bash/completion.sh
@@ -15,7 +15,7 @@ function _complete_nix {
         else
             COMPREPLY+=("$completion")
         fi
-    done < <(NIX_GET_COMPLETIONS=$cword "${words[@]/#\~/$HOME}")
+    done < <(NIX_GET_COMPLETIONS=$cword "${words[@]/#\~/$HOME}" 2>/dev/null)
     __ltrim_colon_completions "$cur"
 }
 
diff --git a/misc/zsh/completion.zsh b/misc/zsh/completion.zsh
index a902e37dc..e702c721e 100644
--- a/misc/zsh/completion.zsh
+++ b/misc/zsh/completion.zsh
@@ -4,7 +4,7 @@ function _nix() {
   local ifs_bk="$IFS"
   local input=("${(Q)words[@]}")
   IFS=$'\n'
-  local res=($(NIX_GET_COMPLETIONS=$((CURRENT - 1)) "$input[@]"))
+  local res=($(NIX_GET_COMPLETIONS=$((CURRENT - 1)) "$input[@]" 2>/dev/null))
   IFS="$ifs_bk"
   local tpe="${${res[1]}%%>	*}"
   local -a suggestions

From 45eeb2fd6ade832d045884b9a18decb4cddaceb1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@sap.com>
Date: Sat, 5 Feb 2022 17:56:51 +0100
Subject: [PATCH 007/251] nix-shell: set BASH variable to correct shell

---
 src/nix-build/nix-build.cc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/nix-build/nix-build.cc b/src/nix-build/nix-build.cc
index ae4746955..aeabdcdd4 100755
--- a/src/nix-build/nix-build.cc
+++ b/src/nix-build/nix-build.cc
@@ -500,6 +500,7 @@ static void main_nix_build(int argc, char * * argv)
                 "%3%"
                 "PATH=%4%:\"$PATH\"; "
                 "SHELL=%5%; "
+                "BASH=%5%; "
                 "set +e; "
                 R"s([ -n "$PS1" -a -z "$NIX_SHELL_PRESERVE_PROMPT" ] && PS1='\n\[\033[1;32m\][nix-shell:\w]\$\[\033[0m\] '; )s"
                 "if [ \"$(type -t runHook)\" = function ]; then runHook shellHook; fi; "

From c3b942e0fc4777f9033f614b6b1f462c0f8c473e Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 6 Feb 2022 13:25:56 +0100
Subject: [PATCH 008/251] Don't hold interruptCallbacks lock during interrupt
 handling

This changes the representation of the interrupt callback list to
be safe to use during interrupt handling.

Holding a lock while executing arbitrary functions is something to
avoid in general, because of the risk of deadlock.

Such a deadlock occurs in https://github.com/NixOS/nix/issues/3294
where ~CurlDownloader tries to deregister its interrupt callback.

This happens during what seems to be a triggerInterrupt() by the
daemon connection's MonitorFdHup thread. This bit I can not confirm
based on the stack trace though; it's based on reading the code,
so no absolute certainty, but a smoking gun nonetheless.
---
 src/libutil/util.cc | 55 +++++++++++++++++++++++++++++++++++----------
 1 file changed, 43 insertions(+), 12 deletions(-)

diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index cd359cfee..03cbd7765 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1561,7 +1561,22 @@ std::pair<unsigned short, unsigned short> getWindowSize()
 }
 
 
-static Sync<std::list<std::function<void()>>> _interruptCallbacks;
+/* We keep track of interrupt callbacks using integer tokens, so we can iterate
+   safely without having to lock the data structure while executing arbitrary
+   functions.
+ */
+struct InterruptCallbacks {
+    typedef int64_t Token;
+
+    /* We use unique tokens so that we can't accidentally delete the wrong
+       handler because of an erroneous double delete. */
+    Token nextToken = 0;
+
+    /* Used as a list, see InterruptCallbacks comment. */
+    std::map<Token, std::function<void()>> callbacks;
+};
+
+static Sync<InterruptCallbacks> _interruptCallbacks;
 
 static void signalHandlerThread(sigset_t set)
 {
@@ -1583,14 +1598,29 @@ void triggerInterrupt()
     _isInterrupted = true;
 
     {
-        auto interruptCallbacks(_interruptCallbacks.lock());
-        for (auto & callback : *interruptCallbacks) {
-            try {
-                callback();
-            } catch (...) {
-                ignoreException();
+        InterruptCallbacks::Token i = 0;
+        std::function<void()> callback;
+        do {
+            {
+                auto interruptCallbacks(_interruptCallbacks.lock());
+                auto lb = interruptCallbacks->callbacks.lower_bound(i);
+                if (lb != interruptCallbacks->callbacks.end()) {
+                    callback = lb->second;
+                    i = lb->first + 1;
+                } else {
+                    callback = nullptr;
+                }
+            }
+
+            if (callback) {
+                try {
+                    callback();
+                } catch (...) {
+                    ignoreException();
+                }
             }
         }
+        while (callback);
     }
 }
 
@@ -1694,21 +1724,22 @@ void restoreProcessContext(bool restoreMounts)
 /* RAII helper to automatically deregister a callback. */
 struct InterruptCallbackImpl : InterruptCallback
 {
-    std::list<std::function<void()>>::iterator it;
+    InterruptCallbacks::Token token;
     ~InterruptCallbackImpl() override
     {
-        _interruptCallbacks.lock()->erase(it);
+        auto interruptCallbacks(_interruptCallbacks.lock());
+        interruptCallbacks->callbacks.erase(token);
     }
 };
 
 std::unique_ptr<InterruptCallback> createInterruptCallback(std::function<void()> callback)
 {
     auto interruptCallbacks(_interruptCallbacks.lock());
-    interruptCallbacks->push_back(callback);
+    auto token = interruptCallbacks->nextToken++;
+    interruptCallbacks->callbacks.emplace(token, callback);
 
     auto res = std::make_unique<InterruptCallbackImpl>();
-    res->it = interruptCallbacks->end();
-    res->it--;
+    res->token = token;
 
     return std::unique_ptr<InterruptCallback>(res.release());
 }

From c23501a3b24d84376086179756fefd399c2a7cbb Mon Sep 17 00:00:00 2001
From: "lincoln auster [they/them]" <lincolnauster@gmail.com>
Date: Sun, 6 Feb 2022 16:28:21 -0700
Subject: [PATCH 009/251] repl/load-flake: throw error if path isn't specified

---
 src/nix/repl.cc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/nix/repl.cc b/src/nix/repl.cc
index e9bebff17..97ca39145 100644
--- a/src/nix/repl.cc
+++ b/src/nix/repl.cc
@@ -623,6 +623,9 @@ void NixRepl::loadFile(const Path & path)
 
 void NixRepl::loadFlake(const std::string & flakeRefS)
 {
+    if (flakeRefS.empty())
+        throw Error("cannot use `:load-flake` without a path specified. (Use . for the current working directory.)");
+
     auto flakeRef = parseFlakeRef(flakeRefS, absPath("."), true);
     if (evalSettings.pureEval && !flakeRef.input.isImmutable())
         throw Error("cannot use ':load-flake' on mutable flake reference '%s' (use --impure to override)", flakeRefS);

From 97e02c23bde0515540c63081824f85ff1cebd86f Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 7 Feb 2022 10:48:57 +0100
Subject: [PATCH 010/251] Fix 'basic_string::_M_construct null not valid' in
 interrupted download

Fixes #5985.
---
 src/libstore/filetransfer.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/libstore/filetransfer.cc b/src/libstore/filetransfer.cc
index 6b62311cf..76fed11db 100644
--- a/src/libstore/filetransfer.cc
+++ b/src/libstore/filetransfer.cc
@@ -128,7 +128,7 @@ struct curlFileTransfer : public FileTransfer
             if (requestHeaders) curl_slist_free_all(requestHeaders);
             try {
                 if (!done)
-                    fail(FileTransferError(Interrupted, nullptr, "download of '%s' was interrupted", request.uri));
+                    fail(FileTransferError(Interrupted, {}, "download of '%s' was interrupted", request.uri));
             } catch (...) {
                 ignoreException();
             }
@@ -704,7 +704,7 @@ struct curlFileTransfer : public FileTransfer
                 auto s3Res = s3Helper.getObject(bucketName, key);
                 FileTransferResult res;
                 if (!s3Res.data)
-                    throw FileTransferError(NotFound, nullptr, "S3 object '%s' does not exist", request.uri);
+                    throw FileTransferError(NotFound, {}, "S3 object '%s' does not exist", request.uri);
                 res.data = std::move(*s3Res.data);
                 callback(std::move(res));
 #else

From b1abfcd0c247df7dc269ba8cb6b1e23d287c20ad Mon Sep 17 00:00:00 2001
From: lincoln auster <lincolnauster@gmail.com>
Date: Mon, 7 Feb 2022 08:35:50 -0700
Subject: [PATCH 011/251] fix markup

Co-authored-by: Eelco Dolstra <edolstra@gmail.com>
---
 src/nix/repl.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/nix/repl.cc b/src/nix/repl.cc
index 97ca39145..2c39fac91 100644
--- a/src/nix/repl.cc
+++ b/src/nix/repl.cc
@@ -624,7 +624,7 @@ void NixRepl::loadFile(const Path & path)
 void NixRepl::loadFlake(const std::string & flakeRefS)
 {
     if (flakeRefS.empty())
-        throw Error("cannot use `:load-flake` without a path specified. (Use . for the current working directory.)");
+        throw Error("cannot use ':load-flake' without a path specified. (Use '.' for the current working directory.)");
 
     auto flakeRef = parseFlakeRef(flakeRefS, absPath("."), true);
     if (evalSettings.pureEval && !flakeRef.input.isImmutable())

From 3ec02deb20b52bd2c23fbf3c98026898857a4def Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 7 Feb 2022 16:14:57 +0000
Subject: [PATCH 012/251] Make sure no exceptions leave ignoreException()

I noticed that occasional Ctrl-C leaves *.lock files around.
`nix-daemon`'s journal logs contained crashes like:

    nix-daemon[30416]: terminate called after throwing an instance of 'nix::SysError'
    nix-daemon[30416]:   what():  error: writing to file: Broken pipe

And core dump backtraces pointed at `teriminate()` call from
destructors:

    ...
    _Unwind_Resume ()
    nix::ignoreException() ()
    nix::LocalDerivationGoal::~LocalDerivationGoal()
    ...

    void ignoreException()
    {
        try {
            throw;
        } catch (std::exception & e) {
            printError("error (ignored): %1%", e.what());
        }
    }

The crashes happen when client side closes early and printError() throws
an IO error.

The change wraps `ignoreException()` into blanket `try { ... } catch (...) {}`.

Closes: https://github.com/NixOS/nix/issues/6046
---
 src/libutil/util.cc | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index cd359cfee..8b317f6a8 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1358,11 +1358,15 @@ std::string shellEscape(const std::string_view s)
 
 void ignoreException()
 {
+    /* Make sure no exceptions leave this function.
+       printError() also throws when remote is closed. */
     try {
-        throw;
-    } catch (std::exception & e) {
-        printError("error (ignored): %1%", e.what());
-    }
+        try {
+            throw;
+        } catch (std::exception & e) {
+            printError("error (ignored): %1%", e.what());
+        }
+    } catch (...) { }
 }
 
 bool shouldANSI()

From 579dcbabd55d5c565ee9769efb6d4377f3022284 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Mon, 7 Feb 2022 23:35:34 +0000
Subject: [PATCH 013/251] mk: prefert inplace library paths to system ones
 (take 2)

It's a second attempt to merge the change. Previous attempt
was reverted in b976b34a5b05ba303904cc7b8e0a2579bdb52807.
Since then underlying failure exposed by original change was
fixed by https://github.com/NixOS/nix/pull/5354.

Below goes description of original change:

The link failure happens on a system with stable nix-2.3.15
installed in /usr/lib64 (it's libutil.so API differs from master):

```
LANG=C make V=1
g++ -o /home/slyfox/dev/git/nix/src/libstore/libnixstore.so \
    -shared -L/usr/lib64 -Wl,--no-copy-dt-needed-entries \
    src/libstore/binary-cache-store.o ... src/libstore/uds-remote-store.o \
    -lsqlite3 -lcurl -lsodium -pthread -ldl -lseccomp -Wl,-z,defs -Wl,-soname=libnixstore.so
      -Wl,-rpath,/home/slyfox/dev/git/nix/src/libutil -Lsrc/libutil -lnixutil
ld: src/libstore/binary-cache-store.o: in function `nix::BinaryCacheStore::BinaryCacheStore(
    std::map<std::__cxx11::basic_string<char, std::char_traits<char>, ...
nix/src/libstore/binary-cache-store.cc:30: undefined reference to `nix::readFile(
    std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&)' ...
...
```

This happens due to `-L/usr/lib64 -Lsrc/libutil` search path ordering.
The change turns it into `-Lsrc/libutil -L/usr/lib64`.

Closes: https://github.com/NixOS/nix/issues/3087
---
 mk/libraries.mk | 4 ++--
 mk/programs.mk  | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/mk/libraries.mk b/mk/libraries.mk
index ffd7b5610..2a86565c9 100644
--- a/mk/libraries.mk
+++ b/mk/libraries.mk
@@ -91,7 +91,7 @@ define build-library
     $(1)_PATH := $$(_d)/$$($(1)_NAME).$(SO_EXT)
 
     $$($(1)_PATH): $$($(1)_OBJS) $$(_libs) | $$(_d)/
-	$$(trace-ld) $(CXX) -o $$(abspath $$@) -shared $$(LDFLAGS) $$(GLOBAL_LDFLAGS) $$($(1)_OBJS) $$($(1)_LDFLAGS) $$($(1)_LDFLAGS_PROPAGATED) $$(foreach lib, $$($(1)_LIBS), $$($$(lib)_LDFLAGS_USE)) $$($(1)_LDFLAGS_UNINSTALLED)
+	$$(trace-ld) $(CXX) -o $$(abspath $$@) -shared $$(foreach lib, $$($(1)_LIBS), $$($$(lib)_LDFLAGS_USE)) $$($(1)_LDFLAGS_UNINSTALLED) $$(LDFLAGS) $$(GLOBAL_LDFLAGS) $$($(1)_OBJS) $$($(1)_LDFLAGS) $$($(1)_LDFLAGS_PROPAGATED)
 
     ifndef HOST_DARWIN
       $(1)_LDFLAGS_USE += -Wl,-rpath,$$(abspath $$(_d))
@@ -105,7 +105,7 @@ define build-library
     $$(eval $$(call create-dir, $$($(1)_INSTALL_DIR)))
 
     $$($(1)_INSTALL_PATH): $$($(1)_OBJS) $$(_libs_final) | $(DESTDIR)$$($(1)_INSTALL_DIR)/
-	$$(trace-ld) $(CXX) -o $$@ -shared $$(LDFLAGS) $$(GLOBAL_LDFLAGS) $$($(1)_OBJS) $$($(1)_LDFLAGS) $$($(1)_LDFLAGS_PROPAGATED) $$(foreach lib, $$($(1)_LIBS), $$($$(lib)_LDFLAGS_USE_INSTALLED))
+	$$(trace-ld) $(CXX) -o $$@ -shared $$(foreach lib, $$($(1)_LIBS), $$($$(lib)_LDFLAGS_USE_INSTALLED)) $$(LDFLAGS) $$(GLOBAL_LDFLAGS) $$($(1)_OBJS) $$($(1)_LDFLAGS) $$($(1)_LDFLAGS_PROPAGATED)
 
     $(1)_LDFLAGS_USE_INSTALLED += -L$$(DESTDIR)$$($(1)_INSTALL_DIR) -l$$(patsubst lib%,%,$$(strip $$($(1)_NAME)))
     ifndef HOST_DARWIN
diff --git a/mk/programs.mk b/mk/programs.mk
index d0cf5baf0..70b09f0dd 100644
--- a/mk/programs.mk
+++ b/mk/programs.mk
@@ -32,7 +32,7 @@ define build-program
   $$(eval $$(call create-dir, $$(_d)))
 
   $$($(1)_PATH): $$($(1)_OBJS) $$(_libs) | $$(_d)/
-	$$(trace-ld) $(CXX) -o $$@ $$(LDFLAGS) $$(GLOBAL_LDFLAGS) $$($(1)_OBJS) $$($(1)_LDFLAGS) $$(foreach lib, $$($(1)_LIBS), $$($$(lib)_LDFLAGS_USE))
+	$$(trace-ld) $(CXX) -o $$@ $$(foreach lib, $$($(1)_LIBS), $$($$(lib)_LDFLAGS_USE)) $$(LDFLAGS) $$(GLOBAL_LDFLAGS) $$($(1)_OBJS) $$($(1)_LDFLAGS)
 
   $(1)_INSTALL_DIR ?= $$(bindir)
 
@@ -49,7 +49,7 @@ define build-program
       _libs_final := $$(foreach lib, $$($(1)_LIBS), $$($$(lib)_INSTALL_PATH))
 
       $(DESTDIR)$$($(1)_INSTALL_PATH): $$($(1)_OBJS) $$(_libs_final) | $(DESTDIR)$$($(1)_INSTALL_DIR)/
-	$$(trace-ld) $(CXX) -o $$@ $$(LDFLAGS) $$(GLOBAL_LDFLAGS) $$($(1)_OBJS) $$($(1)_LDFLAGS) $$(foreach lib, $$($(1)_LIBS), $$($$(lib)_LDFLAGS_USE_INSTALLED))
+	$$(trace-ld) $(CXX) -o $$@ $$(foreach lib, $$($(1)_LIBS), $$($$(lib)_LDFLAGS_USE_INSTALLED)) $$(LDFLAGS) $$(GLOBAL_LDFLAGS) $$($(1)_OBJS) $$($(1)_LDFLAGS)
 
     else
 

From 28b9bd784ca8c7234693b7bca1ab393ed56f52d3 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 9 Feb 2022 13:00:53 +0000
Subject: [PATCH 014/251] Revert "mk: prefert inplace library paths to system
 ones (take 2)"

---
 mk/libraries.mk | 4 ++--
 mk/programs.mk  | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/mk/libraries.mk b/mk/libraries.mk
index 2a86565c9..ffd7b5610 100644
--- a/mk/libraries.mk
+++ b/mk/libraries.mk
@@ -91,7 +91,7 @@ define build-library
     $(1)_PATH := $$(_d)/$$($(1)_NAME).$(SO_EXT)
 
     $$($(1)_PATH): $$($(1)_OBJS) $$(_libs) | $$(_d)/
-	$$(trace-ld) $(CXX) -o $$(abspath $$@) -shared $$(foreach lib, $$($(1)_LIBS), $$($$(lib)_LDFLAGS_USE)) $$($(1)_LDFLAGS_UNINSTALLED) $$(LDFLAGS) $$(GLOBAL_LDFLAGS) $$($(1)_OBJS) $$($(1)_LDFLAGS) $$($(1)_LDFLAGS_PROPAGATED)
+	$$(trace-ld) $(CXX) -o $$(abspath $$@) -shared $$(LDFLAGS) $$(GLOBAL_LDFLAGS) $$($(1)_OBJS) $$($(1)_LDFLAGS) $$($(1)_LDFLAGS_PROPAGATED) $$(foreach lib, $$($(1)_LIBS), $$($$(lib)_LDFLAGS_USE)) $$($(1)_LDFLAGS_UNINSTALLED)
 
     ifndef HOST_DARWIN
       $(1)_LDFLAGS_USE += -Wl,-rpath,$$(abspath $$(_d))
@@ -105,7 +105,7 @@ define build-library
     $$(eval $$(call create-dir, $$($(1)_INSTALL_DIR)))
 
     $$($(1)_INSTALL_PATH): $$($(1)_OBJS) $$(_libs_final) | $(DESTDIR)$$($(1)_INSTALL_DIR)/
-	$$(trace-ld) $(CXX) -o $$@ -shared $$(foreach lib, $$($(1)_LIBS), $$($$(lib)_LDFLAGS_USE_INSTALLED)) $$(LDFLAGS) $$(GLOBAL_LDFLAGS) $$($(1)_OBJS) $$($(1)_LDFLAGS) $$($(1)_LDFLAGS_PROPAGATED)
+	$$(trace-ld) $(CXX) -o $$@ -shared $$(LDFLAGS) $$(GLOBAL_LDFLAGS) $$($(1)_OBJS) $$($(1)_LDFLAGS) $$($(1)_LDFLAGS_PROPAGATED) $$(foreach lib, $$($(1)_LIBS), $$($$(lib)_LDFLAGS_USE_INSTALLED))
 
     $(1)_LDFLAGS_USE_INSTALLED += -L$$(DESTDIR)$$($(1)_INSTALL_DIR) -l$$(patsubst lib%,%,$$(strip $$($(1)_NAME)))
     ifndef HOST_DARWIN
diff --git a/mk/programs.mk b/mk/programs.mk
index 70b09f0dd..d0cf5baf0 100644
--- a/mk/programs.mk
+++ b/mk/programs.mk
@@ -32,7 +32,7 @@ define build-program
   $$(eval $$(call create-dir, $$(_d)))
 
   $$($(1)_PATH): $$($(1)_OBJS) $$(_libs) | $$(_d)/
-	$$(trace-ld) $(CXX) -o $$@ $$(foreach lib, $$($(1)_LIBS), $$($$(lib)_LDFLAGS_USE)) $$(LDFLAGS) $$(GLOBAL_LDFLAGS) $$($(1)_OBJS) $$($(1)_LDFLAGS)
+	$$(trace-ld) $(CXX) -o $$@ $$(LDFLAGS) $$(GLOBAL_LDFLAGS) $$($(1)_OBJS) $$($(1)_LDFLAGS) $$(foreach lib, $$($(1)_LIBS), $$($$(lib)_LDFLAGS_USE))
 
   $(1)_INSTALL_DIR ?= $$(bindir)
 
@@ -49,7 +49,7 @@ define build-program
       _libs_final := $$(foreach lib, $$($(1)_LIBS), $$($$(lib)_INSTALL_PATH))
 
       $(DESTDIR)$$($(1)_INSTALL_PATH): $$($(1)_OBJS) $$(_libs_final) | $(DESTDIR)$$($(1)_INSTALL_DIR)/
-	$$(trace-ld) $(CXX) -o $$@ $$(foreach lib, $$($(1)_LIBS), $$($$(lib)_LDFLAGS_USE_INSTALLED)) $$(LDFLAGS) $$(GLOBAL_LDFLAGS) $$($(1)_OBJS) $$($(1)_LDFLAGS)
+	$$(trace-ld) $(CXX) -o $$@ $$(LDFLAGS) $$(GLOBAL_LDFLAGS) $$($(1)_OBJS) $$($(1)_LDFLAGS) $$(foreach lib, $$($(1)_LIBS), $$($$(lib)_LDFLAGS_USE_INSTALLED))
 
     else
 

From b8d57e28839587832109f6607eb28819559fc30c Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 10 Feb 2022 11:10:29 +0100
Subject: [PATCH 015/251] check-hydra-status.sh: Improve error behaviour

---
 scripts/check-hydra-status.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/check-hydra-status.sh b/scripts/check-hydra-status.sh
index c1d2d7c40..7efe9cf97 100644
--- a/scripts/check-hydra-status.sh
+++ b/scripts/check-hydra-status.sh
@@ -19,9 +19,9 @@ for buildId in $BUILDS_FOR_LATEST_EVAL; do
   buildStatus=$(echo "$buildInfo" | \
     jq -r '.buildstatus')
 
-  if [[ "$buildStatus" -ne 0 ]]; then
+  if [[ $buildStatus != 0 ]]; then
     someBuildFailed=1
-    echo "Job “$(echo "$buildInfo" | jq -r '.job')” failed on hydra"
+    echo "Job “$(echo "$buildInfo" | jq -r '.job')” failed on hydra: $buildInfo"
   fi
 done
 

From 5b586575ac5ecb013be56135ecbcb091c8ad419d Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 10 Feb 2022 14:12:06 +0100
Subject: [PATCH 016/251] nix/why-depends: fix output when not using
 `--precise`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On Nix 2.6 the output of `nix why-depends --all` seems to be somewhat
off:

    $ nix why-depends /nix/store/kn47hayxab8gc01jhr98dwyywbx561aq-nixos-system-roflmayr-21.11.20220207.6c202a9.drv /nix/store/srn5jbs1q30jpybdmxqrwskyny659qgc-nix-2.6.drv --derivation  --extra-experimental-features nix-command  --all
    /nix/store/kn47hayxab8gc01jhr98dwyywbx561aq-nixos-system-roflmayr-21.11.20220207.6c202a9.drv
        └───/nix/store/g8bpgfjhh5vxrdq0w6r6s64f9kkm9z6c-etc.drv
        │   └───/nix/store/hm0jmhp8shbf3cl846a685nv4f5cp3fy-nspawn-inst.drv
        | [...]
            └───/nix/store/2d6q3ygiim9ijl5d4h0qqx6vnjgxywyr-system-units.drv
                └───/nix/store/dil014y1b8qyjhhhf5fpaah5fzdf0bzs-unit-systemd-nspawn-hydra.service.drv
                    └───/nix/store/a9r72wwx8qrxyp7hjydyg0gsrwnn26zb-activate.drv
                        └───/nix/store/99hlc7i4gl77wq087lbhag4hkf3kvssj-nixos-system-hydra-21.11pre-git.drv

Please note that `[...]-system-units.drv` is supposed to be a direct
child of `[...]-etc.drv`.

The reason for that is that each new level printed by `printNode` is
four spaces off in comparison to `nix why-depends --precise` because the
recursive `printNode()` only prints the path and not the `tree*`-chars in
the case of `--precise` and in this format the path is four spaces further
indented, i.e. on a newline, but on the same level as the path's children, i.e.

    /nix/store/kn47hayxab8gc01jhr98dwyywbx561aq-nixos-system-roflmayr-21.11.20220207.6c202a9.drv
    └───/: …1-p8.drv",["out"]),("/nix/store/g8bpgfjhh5vxrdq0w6r6s64f9kkm9z6c-etc.drv",["out"]),("/nix/store/…
        → /nix/store/g8bpgfjhh5vxrdq0w6r6s64f9kkm9z6c-etc.drv

As you can see `[...]-etc.drv` is a direct child of the root, but four
spaces indented. This logic was directly applied to the code-path with
`precise=false` which resulted in `tree*` being printed four spaces too
deep.

In case of no `--precise`, `hits[hash]` is empty and the path itself
should be printed rather than hits using the same logic as for `hits[hash]`.

With this fix, the output looks correct now:

    /nix/store/kn47hayxab8gc01jhr98dwyywbx561aq-nixos-system-roflmayr-21.11.20220207.6c202a9.drv
    └───/nix/store/g8bpgfjhh5vxrdq0w6r6s64f9kkm9z6c-etc.drv
        ├───/nix/store/hm0jmhp8shbf3cl846a685nv4f5cp3fy-nspawn-inst.drv
        | [...]
        └───/nix/store/2d6q3ygiim9ijl5d4h0qqx6vnjgxywyr-system-units.drv
            └───/nix/store/dil014y1b8qyjhhhf5fpaah5fzdf0bzs-unit-systemd-nspawn-hydra.service.drv
                └───/nix/store/a9r72wwx8qrxyp7hjydyg0gsrwnn26zb-activate.drv
                    └───/nix/store/99hlc7i4gl77wq087lbhag4hkf3kvssj-nixos-system-hydra-21.11pre-git.drv
---
 src/nix/why-depends.cc | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/src/nix/why-depends.cc b/src/nix/why-depends.cc
index 657df30d7..bc8cfb1c5 100644
--- a/src/nix/why-depends.cc
+++ b/src/nix/why-depends.cc
@@ -171,12 +171,6 @@ struct CmdWhyDepends : SourceExprCommand
                     node.visited ? "\e[38;5;244m" : "",
                     firstPad != "" ? "→ " : "",
                     pathS);
-            } else {
-                logger->cout("%s%s%s%s" ANSI_NORMAL,
-                    firstPad,
-                    node.visited ? "\e[38;5;244m" : "",
-                    firstPad != "" ? treeLast : "",
-                    pathS);
             }
 
             if (node.path == dependencyPath && !all
@@ -184,7 +178,7 @@ struct CmdWhyDepends : SourceExprCommand
                 throw BailOut();
 
             if (node.visited) return;
-            node.visited = true;
+            if (precise) node.visited = true;
 
             /* Sort the references by distance to `dependency` to
                ensure that the shortest path is printed first. */
@@ -267,6 +261,16 @@ struct CmdWhyDepends : SourceExprCommand
                     if (!all) break;
                 }
 
+                if (!precise) {
+                    auto pathS = store->printStorePath(ref.second->path);
+                    logger->cout("%s%s%s%s" ANSI_NORMAL,
+                        firstPad,
+                        ref.second->visited ? "\e[38;5;244m" : "",
+                        last ? treeLast : treeConn,
+                        pathS);
+                    node.visited = true;
+                }
+
                 printNode(*ref.second,
                     tailPad + (last ? treeNull : treeLine),
                     tailPad + (last ? treeNull : treeLine));
@@ -275,6 +279,9 @@ struct CmdWhyDepends : SourceExprCommand
 
         RunPager pager;
         try {
+            if (!precise) {
+                logger->cout("%s", store->printStorePath(graph.at(packagePath).path));
+            }
             printNode(graph.at(packagePath), "", "");
         } catch (BailOut & ) { }
     }

From 5b809f9e0e0fe84304c2ae0f5f7b2d4db02565ad Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 10 Feb 2022 21:15:07 +0100
Subject: [PATCH 017/251] check-hydra-status.sh: Ignore unfinished builds

---
 scripts/check-hydra-status.sh | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/scripts/check-hydra-status.sh b/scripts/check-hydra-status.sh
index 7efe9cf97..5e2f03429 100644
--- a/scripts/check-hydra-status.sh
+++ b/scripts/check-hydra-status.sh
@@ -16,8 +16,13 @@ someBuildFailed=0
 for buildId in $BUILDS_FOR_LATEST_EVAL; do
   buildInfo=$(curl -sS -H 'Accept: application/json' "https://hydra.nixos.org/build/$buildId")
 
-  buildStatus=$(echo "$buildInfo" | \
-    jq -r '.buildstatus')
+  finished=$(echo "$buildInfo" | jq -r '.finished')
+
+  if [[ $finished = 0 ]]; then
+    continue
+  fi
+
+  buildStatus=$(echo "$buildInfo" | jq -r '.buildstatus')
 
   if [[ $buildStatus != 0 ]]; then
     someBuildFailed=1

From d2f9a081b81ae0c4ef194fc66b94a31fb8ed6d73 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 11 Feb 2022 14:45:46 +0100
Subject: [PATCH 018/251] flake.nix: Fix indent

---
 flake.nix | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/flake.nix b/flake.nix
index 5b1e13a16..ae9305144 100644
--- a/flake.nix
+++ b/flake.nix
@@ -648,11 +648,10 @@
           installCheckFlags = "sysconfdir=$(out)/etc";
         };
       }) crossSystems)) // (builtins.listToAttrs (map (stdenvName:
-      nixpkgsFor.${system}.lib.nameValuePair
-        "nix-${stdenvName}"
-        nixpkgsFor.${system}."${stdenvName}Packages".nix
-      ) stdenvs))
-      );
+        nixpkgsFor.${system}.lib.nameValuePair
+          "nix-${stdenvName}"
+          nixpkgsFor.${system}."${stdenvName}Packages".nix
+      ) stdenvs)));
 
       defaultPackage = forAllSystems (system: self.packages.${system}.nix);
 

From cdc90c2776ee5542fd4d4e1aaa06d1d826daecb0 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 11 Feb 2022 15:50:12 +0100
Subject: [PATCH 019/251] parseInstallables(): Don't try the flake attr path
 prefixes when no fragment is specified

Fixes #5880.
---
 src/libcmd/installables.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index 5e8b62e1a..9f138b420 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -709,7 +709,7 @@ std::vector<std::shared_ptr<Installable>> SourceExprCommand::parseInstallables(
                         getEvalState(),
                         std::move(flakeRef),
                         fragment == "" ? getDefaultFlakeAttrPaths() : Strings{fragment},
-                        getDefaultFlakeAttrPathPrefixes(),
+                        fragment == "" ? Strings{} : getDefaultFlakeAttrPathPrefixes(),
                         lockFlags));
                 continue;
             } catch (...) {

From 270fb5f192c91977efd45e52ceac7f6002bc1422 Mon Sep 17 00:00:00 2001
From: Tom Bereknyei <tomberek@gmail.com>
Date: Fri, 11 Feb 2022 10:23:19 -0500
Subject: [PATCH 020/251] profile: add verbosity

warn if there are no matches and give notice of removing packages as
they are found
---
 src/nix/profile.cc | 34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index 9b7c999af..b9279414d 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -295,7 +295,11 @@ public:
         expectArgs("elements", &_matchers);
     }
 
-    typedef std::variant<size_t, Path, std::regex> Matcher;
+    struct RegexPattern {
+        std::string pattern;
+        std::regex  reg;
+    };
+    typedef std::variant<size_t, Path, RegexPattern> Matcher;
 
     std::vector<Matcher> getMatchers(ref<Store> store)
     {
@@ -307,7 +311,7 @@ public:
             else if (store->isStorePath(s))
                 res.push_back(s);
             else
-                res.push_back(std::regex(s, std::regex::extended | std::regex::icase));
+                res.push_back(RegexPattern{s,std::regex(s, std::regex::extended | std::regex::icase)});
         }
 
         return res;
@@ -320,9 +324,9 @@ public:
                 if (*n == pos) return true;
             } else if (auto path = std::get_if<Path>(&matcher)) {
                 if (element.storePaths.count(store.parseStorePath(*path))) return true;
-            } else if (auto regex = std::get_if<std::regex>(&matcher)) {
+            } else if (auto regex = std::get_if<RegexPattern>(&matcher)) {
                 if (element.source
-                    && std::regex_match(element.source->attrPath, *regex))
+                    && std::regex_match(element.source->attrPath, regex->reg))
                     return true;
             }
         }
@@ -355,16 +359,30 @@ struct CmdProfileRemove : virtual EvalCommand, MixDefaultProfile, MixProfileElem
 
         for (size_t i = 0; i < oldManifest.elements.size(); ++i) {
             auto & element(oldManifest.elements[i]);
-            if (!matches(*store, element, i, matchers))
+            if (!matches(*store, element, i, matchers)) {
                 newManifest.elements.push_back(std::move(element));
+            } else {
+                notice("removing '%s'", element.describe());
+            }
         }
 
-        // FIXME: warn about unused matchers?
-
+        auto removedCount = oldManifest.elements.size() - newManifest.elements.size();
         printInfo("removed %d packages, kept %d packages",
-            oldManifest.elements.size() - newManifest.elements.size(),
+            removedCount,
             newManifest.elements.size());
 
+        if (removedCount == 0) {
+            for (auto matcher: matchers) {
+                if (const size_t* index = std::get_if<size_t>(&matcher)){
+                    warn("'%d' is not a valid index in profile", *index);
+                } else if (const Path* path = std::get_if<Path>(&matcher)){
+                    warn("'%s' does not match any paths in profile", *path);
+                } else if (const RegexPattern* regex = std::get_if<RegexPattern>(&matcher)){
+                    warn("'%s' does not match any packages in profile", regex->pattern);
+                }
+            }
+            warn ("Try `nix profile list` to see the current profile.");
+        }
         updateProfile(newManifest.build(store));
     }
 };

From c437e1326d900e2563c5859489f3be2cb557a3d3 Mon Sep 17 00:00:00 2001
From: Sebastian Ullrich <sebasti@nullri.ch>
Date: Sat, 12 Feb 2022 16:28:36 +0100
Subject: [PATCH 021/251] Fix using sandbox without user namespaces

---
 src/libstore/build/local-derivation-goal.cc | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index 0d0afea2d..b76ad702b 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -912,9 +912,12 @@ void LocalDerivationGoal::startBuilder()
         sandboxMountNamespace = open(fmt("/proc/%d/ns/mnt", (pid_t) pid).c_str(), O_RDONLY);
         if (sandboxMountNamespace.get() == -1)
             throw SysError("getting sandbox mount namespace");
-        sandboxUserNamespace = open(fmt("/proc/%d/ns/user", (pid_t) pid).c_str(), O_RDONLY);
-        if (sandboxUserNamespace.get() == -1)
-            throw SysError("getting sandbox user namespace");
+
+        if (usingUserNamespace) {
+            sandboxUserNamespace = open(fmt("/proc/%d/ns/user", (pid_t) pid).c_str(), O_RDONLY);
+            if (sandboxUserNamespace.get() == -1)
+                throw SysError("getting sandbox user namespace");
+        }
 
         /* Signal the builder that we've updated its user namespace. */
         writeFull(userNamespaceSync.writeSide.get(), "1");

From 023e45977745ffd6c16eec299a00affd65176669 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 14 Feb 2022 20:39:44 +0100
Subject: [PATCH 022/251] InstallableFlake: Default attr paths cleanup

This removes some duplicated logic, and fixes "nix bundle" parsing its
installable twice.
---
 src/libcmd/installables.cc | 16 ++++++++++------
 src/libcmd/installables.hh |  5 +++--
 src/nix/bundle.cc          | 19 +++++++------------
 src/nix/develop.cc         |  3 ++-
 src/nix/flake.cc           | 15 +++++++++------
 src/nix/profile.cc         |  1 +
 6 files changed, 32 insertions(+), 27 deletions(-)

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index 9f138b420..644954977 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -545,13 +545,14 @@ InstallableFlake::InstallableFlake(
     SourceExprCommand * cmd,
     ref<EvalState> state,
     FlakeRef && flakeRef,
-    Strings && attrPaths,
-    Strings && prefixes,
+    std::string_view fragment,
+    Strings attrPaths,
+    Strings prefixes,
     const flake::LockFlags & lockFlags)
     : InstallableValue(state),
       flakeRef(flakeRef),
-      attrPaths(attrPaths),
-      prefixes(prefixes),
+      attrPaths(fragment == "" ? attrPaths : Strings{(std::string) fragment}),
+      prefixes(fragment == "" ? Strings{} : prefixes),
       lockFlags(lockFlags)
 {
     if (cmd && cmd->getAutoArgs(*state)->size())
@@ -566,6 +567,8 @@ std::tuple<std::string, FlakeRef, InstallableValue::DerivationInfo> InstallableF
     auto root = cache->getRoot();
 
     for (auto & attrPath : getActualAttrPaths()) {
+        debug("trying flake output attribute '%s'", attrPath);
+
         auto attr = root->findAlongAttrPath(
             parseAttrPath(*state, attrPath),
             true
@@ -708,8 +711,9 @@ std::vector<std::shared_ptr<Installable>> SourceExprCommand::parseInstallables(
                         this,
                         getEvalState(),
                         std::move(flakeRef),
-                        fragment == "" ? getDefaultFlakeAttrPaths() : Strings{fragment},
-                        fragment == "" ? Strings{} : getDefaultFlakeAttrPathPrefixes(),
+                        fragment,
+                        getDefaultFlakeAttrPaths(),
+                        getDefaultFlakeAttrPathPrefixes(),
                         lockFlags));
                 continue;
             } catch (...) {
diff --git a/src/libcmd/installables.hh b/src/libcmd/installables.hh
index ced6b3f10..3d2563e4b 100644
--- a/src/libcmd/installables.hh
+++ b/src/libcmd/installables.hh
@@ -102,8 +102,9 @@ struct InstallableFlake : InstallableValue
         SourceExprCommand * cmd,
         ref<EvalState> state,
         FlakeRef && flakeRef,
-        Strings && attrPaths,
-        Strings && prefixes,
+        std::string_view fragment,
+        Strings attrPaths,
+        Strings prefixes,
         const flake::LockFlags & lockFlags);
 
     std::string what() const override { return flakeRef.to_string() + "#" + *attrPaths.begin(); }
diff --git a/src/nix/bundle.cc b/src/nix/bundle.cc
index 113ceca33..c13018328 100644
--- a/src/nix/bundle.cc
+++ b/src/nix/bundle.cc
@@ -74,21 +74,16 @@ struct CmdBundle : InstallableCommand
     {
         auto evalState = getEvalState();
 
-        auto [progFlakeRef, progName] = parseFlakeRefWithFragment(installable->what(), absPath("."));
-        const flake::LockFlags lockFlagsProg{ .writeLockFile = false };
-        auto programInstallable = InstallableFlake(this,
-            evalState, std::move(progFlakeRef),
-            Strings{progName == "" ? "defaultApp" : progName},
-            Strings(this->getDefaultFlakeAttrPathPrefixes()),
-            lockFlagsProg);
-        auto val = programInstallable.toValue(*evalState).first;
+        auto val = installable->toValue(*evalState).first;
 
         auto [bundlerFlakeRef, bundlerName] = parseFlakeRefWithFragment(bundler, absPath("."));
         const flake::LockFlags lockFlags{ .writeLockFile = false };
-        auto bundler = InstallableFlake(this,
-            evalState, std::move(bundlerFlakeRef),
-            Strings{bundlerName == "" ? "defaultBundler." + settings.thisSystem.get() : settings.thisSystem.get() + "." + bundlerName, bundlerName},
-            Strings({"","bundlers."}), lockFlags);
+        InstallableFlake bundler{this,
+            evalState, std::move(bundlerFlakeRef), bundlerName,
+            {"defaultBundler." + settings.thisSystem.get()},
+            {"bundlers." + settings.thisSystem.get() + "."},
+            lockFlags
+        };
 
         auto vRes = evalState->allocValue();
         evalState->callFunction(*bundler.toValue(*evalState).first, *val, *vRes, noPos);
diff --git a/src/nix/develop.cc b/src/nix/develop.cc
index 42e13436a..f88f5909c 100644
--- a/src/nix/develop.cc
+++ b/src/nix/develop.cc
@@ -498,7 +498,8 @@ struct CmdDevelop : Common, MixEnvironment
                 this,
                 state,
                 installable->nixpkgsFlakeRef(),
-                Strings{"bashInteractive"},
+                "bashInteractive",
+                Strings{},
                 Strings{"legacyPackages." + settings.thisSystem.get() + "."},
                 nixpkgsLockFlags);
 
diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 4bc79820c..3effce2c1 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -649,12 +649,14 @@ struct CmdFlakeCheck : FlakeCommand
     }
 };
 
+static Strings defaultTemplateAttrPathsPrefixes{"templates."};
+static Strings defaultTemplateAttrPaths = {"defaultTemplate"};
+
 struct CmdFlakeInitCommon : virtual Args, EvalCommand
 {
     std::string templateUrl = "templates";
     Path destDir;
 
-    const Strings attrsPathPrefixes{"templates."};
     const LockFlags lockFlags{ .writeLockFile = false };
 
     CmdFlakeInitCommon()
@@ -669,8 +671,8 @@ struct CmdFlakeInitCommon : virtual Args, EvalCommand
                 completeFlakeRefWithFragment(
                     getEvalState(),
                     lockFlags,
-                    attrsPathPrefixes,
-                    {"defaultTemplate"},
+                    defaultTemplateAttrPathsPrefixes,
+                    defaultTemplateAttrPaths,
                     prefix);
             }}
         });
@@ -685,9 +687,10 @@ struct CmdFlakeInitCommon : virtual Args, EvalCommand
         auto [templateFlakeRef, templateName] = parseFlakeRefWithFragment(templateUrl, absPath("."));
 
         auto installable = InstallableFlake(nullptr,
-            evalState, std::move(templateFlakeRef),
-            Strings{templateName == "" ? "defaultTemplate" : templateName},
-            Strings(attrsPathPrefixes), lockFlags);
+            evalState, std::move(templateFlakeRef), templateName,
+            defaultTemplateAttrPaths,
+            defaultTemplateAttrPathsPrefixes,
+            lockFlags);
 
         auto [cursor, attrPath] = installable.getCursor(*evalState);
 
diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index b9279414d..55b5ff736 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -423,6 +423,7 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
                     this,
                     getEvalState(),
                     FlakeRef(element.source->originalRef),
+                    "",
                     {element.source->attrPath},
                     {},
                     lockFlags);

From 72e8f94081290784e2d115cfbf09375b53d8cbe9 Mon Sep 17 00:00:00 2001
From: Gabriel Fontes <eu@misterio.me>
Date: Wed, 6 Oct 2021 13:32:46 -0300
Subject: [PATCH 023/251] add sourcehut input scheme

---
 src/libfetchers/github.cc | 91 ++++++++++++++++++++++++++++++++++++++-
 src/nix/flake.md          | 32 ++++++++++++++
 2 files changed, 122 insertions(+), 1 deletion(-)

diff --git a/src/libfetchers/github.cc b/src/libfetchers/github.cc
index 1c539b80e..e101aa3d6 100644
--- a/src/libfetchers/github.cc
+++ b/src/libfetchers/github.cc
@@ -8,6 +8,7 @@
 
 #include <optional>
 #include <nlohmann/json.hpp>
+#include <fstream>
 
 namespace nix::fetchers {
 
@@ -17,7 +18,7 @@ struct DownloadUrl
     Headers headers;
 };
 
-// A github or gitlab host
+// A github, gitlab, or sourcehut host
 const static std::string hostRegexS = "[a-zA-Z0-9.]*"; // FIXME: check
 std::regex hostRegex(hostRegexS, std::regex::ECMAScript);
 
@@ -348,7 +349,95 @@ struct GitLabInputScheme : GitArchiveInputScheme
     }
 };
 
+struct SourceHutInputScheme : GitArchiveInputScheme
+{
+    std::string type() override { return "sourcehut"; }
+
+    std::optional<std::pair<std::string, std::string>> accessHeaderFromToken(const std::string & token) const override
+    {
+        // SourceHut supports both PAT and OAuth2. See
+        // https://man.sr.ht/meta.sr.ht/oauth.md
+        return std::pair<std::string, std::string>("Authorization", fmt("Bearer %s", token));
+        // Note: This currently serves no purpose, as this kind of authorization
+        // does not allow for downloading tarballs on sourcehut private repos.
+        // Once it is implemented, however, should work as expected.
+    }
+
+    Hash getRevFromRef(nix::ref<Store> store, const Input & input) const override
+    {
+        // TODO: In the future, when the sourcehut graphql API is implemented for mercurial
+        // and with anonymous access, this method should use it instead.
+
+        auto ref = *input.getRef();
+
+        auto host = maybeGetStrAttr(input.attrs, "host").value_or("git.sr.ht");
+        auto base_url = fmt("https://%s/%s/%s",
+            host, getStrAttr(input.attrs, "owner"), getStrAttr(input.attrs, "repo"));
+
+        Headers headers = makeHeadersWithAuthTokens(host);
+
+        std::string ref_uri;
+        if (ref == "HEAD") {
+            auto file = store->toRealPath(
+                downloadFile(store, fmt("%s/HEAD", base_url), "source", false, headers).storePath);
+            std::ifstream is(file);
+            std::string line;
+            getline(is, line);
+
+            auto ref_index = line.find("ref: ");
+            if (ref_index == std::string::npos) {
+                throw BadURL("in '%d', couldn't resolve HEAD ref '%d'", input.to_string(), ref);
+            }
+
+            ref_uri = line.substr(ref_index+5, line.length()-1);
+        } else
+            ref_uri = fmt("refs/heads/%s", ref);
+
+        auto file = store->toRealPath(
+            downloadFile(store, fmt("%s/info/refs", base_url), "source", false, headers).storePath);
+        std::ifstream is(file);
+
+        std::string line;
+        std::string id;
+        while(getline(is, line)) {
+            auto index = line.find(ref_uri);
+            if (index != std::string::npos) {
+                id = line.substr(0, index-1);
+                break;
+            }
+        }
+
+        if(id.empty())
+            throw BadURL("in '%d', couldn't find ref '%d'", input.to_string(), ref);
+
+        auto rev = Hash::parseAny(id, htSHA1);
+        debug("HEAD revision for '%s' is %s", fmt("%s/%s", base_url, ref), rev.gitRev());
+        return rev;
+    }
+
+    DownloadUrl getDownloadUrl(const Input & input) const override
+    {
+        auto host = maybeGetStrAttr(input.attrs, "host").value_or("git.sr.ht");
+        auto url = fmt("https://%s/%s/%s/archive/%s.tar.gz",
+            host, getStrAttr(input.attrs, "owner"), getStrAttr(input.attrs, "repo"),
+            input.getRev()->to_string(Base16, false));
+
+        Headers headers = makeHeadersWithAuthTokens(host);
+        return DownloadUrl { url, headers };
+    }
+
+    void clone(const Input & input, const Path & destDir) override
+    {
+        auto host = maybeGetStrAttr(input.attrs, "host").value_or("git.sr.ht");
+        Input::fromURL(fmt("git+https://%s/%s/%s",
+                host, getStrAttr(input.attrs, "owner"), getStrAttr(input.attrs, "repo")))
+            .applyOverrides(input.getRef(), input.getRev())
+            .clone(destDir);
+    }
+};
+
 static auto rGitHubInputScheme = OnStartup([] { registerInputScheme(std::make_unique<GitHubInputScheme>()); });
 static auto rGitLabInputScheme = OnStartup([] { registerInputScheme(std::make_unique<GitLabInputScheme>()); });
+static auto rSourceHutInputScheme = OnStartup([] { registerInputScheme(std::make_unique<SourceHutInputScheme>()); });
 
 }
diff --git a/src/nix/flake.md b/src/nix/flake.md
index accddd436..f539a7c28 100644
--- a/src/nix/flake.md
+++ b/src/nix/flake.md
@@ -209,6 +209,38 @@ Currently the `type` attribute can be one of the following:
   * `github:edolstra/dwarffs/unstable`
   * `github:edolstra/dwarffs/d3f2baba8f425779026c6ec04021b2e927f61e31`
 
+* `sourcehut`: Similar to `github`, is a more efficient way to fetch
+  SourceHut repositories. The following attributes are required:
+
+  * `owner`: The owner of the repository (including leading `~`).
+
+  * `repo`: The name of the repository.
+
+  Like `github`, these are downloaded as tarball archives.
+
+  The URL syntax for `sourcehut` flakes is:
+
+  `sourcehut:<owner>/<repo>(/<rev-or-ref>)?(\?<params>)?`
+
+  `<rev-or-ref>` works the same as `github`. Either a branch or tag name
+  (`ref`), or a commit hash (`rev`) can be specified.
+
+  Since SourceHut allows for self-hosting, you can specify `host` as
+  a parameter, to point to any instances other than `git.sr.ht`.
+
+  Currently, `ref` name resolution only works for Git repositories.
+  You can refer to Mercurial repositories by simply changing `host` to
+  `hg.sr.ht` (or any other Mercurial instance). With the caveat
+  that you must explicitly specify a commit hash (`rev`).
+
+  Some examples:
+
+  * `sourcehut:~misterio/nix-colors`
+  * `sourcehut:~misterio/nix-colors/main`
+  * `sourcehut:~misterio/nix-colors?host=git.example.org`
+  * `sourcehut:~misterio/nix-colors/182b4b8709b8ffe4e9774a4c5d6877bf6bb9a21c`
+  * `sourcehut:~misterio/nix-colors/21c1a380a6915d890d408e9f22203436a35bb2de?host=hg.sr.ht`
+
 * `indirect`: Indirections through the flake registry. These have the
   form
 

From f3a2940e70dea2c35dcae3fca019e94bf8758b4d Mon Sep 17 00:00:00 2001
From: Taeer Bar-Yam <taeer@bar-yam.me>
Date: Tue, 15 Feb 2022 11:50:14 -0500
Subject: [PATCH 024/251] add descriptive output when creating templates

this includes a `welcomeText` attribute which can be set in the
template, as well as outputing which files were created.
---
 src/nix/flake-init.md | 8 ++++++++
 src/nix/flake.cc      | 6 ++++++
 2 files changed, 14 insertions(+)

diff --git a/src/nix/flake-init.md b/src/nix/flake-init.md
index 890038016..c8bcee375 100644
--- a/src/nix/flake-init.md
+++ b/src/nix/flake-init.md
@@ -37,6 +37,10 @@ A flake can declare templates through its `templates` and
 
 * `path`: The path of the directory to be copied.
 
+* `welcomeText`: A block of text to display when a user initializes a new flake
+  based on this template.
+
+
 Here is an example:
 
 ```
@@ -45,6 +49,10 @@ outputs = { self }: {
   templates.rust = {
     path = ./rust;
     description = "A simple Rust/Cargo project";
+    welcomeText = ''
+      You've created a simple Rust/Cargo template.
+      Visit https://www.rust-lang.org/ for more info.
+    '';
   };
 
   templates.defaultTemplate = self.templates.rust;
diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 4bc79820c..f5d34c10f 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -728,6 +728,7 @@ struct CmdFlakeInitCommon : virtual Args, EvalCommand
                 else
                     throw Error("file '%s' has unsupported type", from2);
                 files.push_back(to2);
+                notice("wrote: %s", to2);
             }
         };
 
@@ -738,6 +739,11 @@ struct CmdFlakeInitCommon : virtual Args, EvalCommand
             for (auto & s : files) args.push_back(s);
             runProgram("git", true, args);
         }
+        auto welcomeText = cursor->maybeGetAttr("welcomeText");
+        if (welcomeText) {
+            notice("\n----------\n");
+            notice(welcomeText->getString());
+        }
     }
 };
 

From d82cf4a016aa0ee136ff62635e909607de78e02a Mon Sep 17 00:00:00 2001
From: Rahul Butani <rrbutani@users.noreply.github.com>
Date: Tue, 15 Feb 2022 15:44:05 -0600
Subject: [PATCH 025/251] manual: fix formatting for options with
 "machine-specific" defaults

---
 doc/manual/generate-options.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/manual/generate-options.nix b/doc/manual/generate-options.nix
index 9a77f4d36..84d90beb6 100644
--- a/doc/manual/generate-options.nix
+++ b/doc/manual/generate-options.nix
@@ -20,7 +20,7 @@ concatStrings (map
          # JSON, but that converts to "{ }" here.
          (if isAttrs option.value then "`\"\"`"
           else "`" + toString option.value + "`")) + "\n\n"
-       else "    **Default:** *machine-specific*")
+       else "    **Default:** *machine-specific*\n")
     + (if option.aliases != []
        then "    **Deprecated alias:** " + (concatStringsSep ", " (map (s: "`${s}`") option.aliases)) + "\n\n"
        else "")

From 2d6d9a28ebb17b1ba1fe0dc4d56b6aa311f94d39 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 15 Feb 2022 15:08:06 +0100
Subject: [PATCH 026/251] addToStoreFromDump(): Take std::string_view

---
 src/libstore/binary-cache-store.cc          | 2 +-
 src/libstore/binary-cache-store.hh          | 4 ++--
 src/libstore/build/local-derivation-goal.cc | 2 +-
 src/libstore/local-store.cc                 | 2 +-
 src/libstore/local-store.hh                 | 2 +-
 src/libstore/remote-store.cc                | 4 ++--
 src/libstore/remote-store.hh                | 4 ++--
 src/libstore/store-api.hh                   | 2 +-
 8 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/src/libstore/binary-cache-store.cc b/src/libstore/binary-cache-store.cc
index 6e4458f7a..b3fd991a1 100644
--- a/src/libstore/binary-cache-store.cc
+++ b/src/libstore/binary-cache-store.cc
@@ -307,7 +307,7 @@ void BinaryCacheStore::addToStore(const ValidPathInfo & info, Source & narSource
     }});
 }
 
-StorePath BinaryCacheStore::addToStoreFromDump(Source & dump, const string & name,
+StorePath BinaryCacheStore::addToStoreFromDump(Source & dump, std::string_view name,
     FileIngestionMethod method, HashType hashAlgo, RepairFlag repair, const StorePathSet & references)
 {
     if (method != FileIngestionMethod::Recursive || hashAlgo != htSHA256)
diff --git a/src/libstore/binary-cache-store.hh b/src/libstore/binary-cache-store.hh
index 7599230d9..5b5d064f3 100644
--- a/src/libstore/binary-cache-store.hh
+++ b/src/libstore/binary-cache-store.hh
@@ -98,8 +98,8 @@ public:
     void addToStore(const ValidPathInfo & info, Source & narSource,
         RepairFlag repair, CheckSigsFlag checkSigs) override;
 
-    StorePath addToStoreFromDump(Source & dump, const string & name,
-        FileIngestionMethod method, HashType hashAlgo, RepairFlag repair, const StorePathSet & references ) override;
+    StorePath addToStoreFromDump(Source & dump, std::string_view name,
+        FileIngestionMethod method, HashType hashAlgo, RepairFlag repair, const StorePathSet & references) override;
 
     StorePath addToStore(const string & name, const Path & srcPath,
         FileIngestionMethod method, HashType hashAlgo,
diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index b76ad702b..8861d2c7b 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -1208,7 +1208,7 @@ struct RestrictedStore : public virtual RestrictedStoreConfig, public virtual Lo
         return path;
     }
 
-    StorePath addToStoreFromDump(Source & dump, const string & name,
+    StorePath addToStoreFromDump(Source & dump, std::string_view name,
         FileIngestionMethod method = FileIngestionMethod::Recursive, HashType hashAlgo = htSHA256, RepairFlag repair = NoRepair,
         const StorePathSet & references = StorePathSet()) override
     {
diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index 284e385e6..1a02b916a 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -1318,7 +1318,7 @@ void LocalStore::addToStore(const ValidPathInfo & info, Source & source,
 }
 
 
-StorePath LocalStore::addToStoreFromDump(Source & source0, const string & name,
+StorePath LocalStore::addToStoreFromDump(Source & source0, std::string_view name,
     FileIngestionMethod method, HashType hashAlgo, RepairFlag repair, const StorePathSet & references)
 {
     /* For computing the store path. */
diff --git a/src/libstore/local-store.hh b/src/libstore/local-store.hh
index 8cf9c68b3..46aed9bcb 100644
--- a/src/libstore/local-store.hh
+++ b/src/libstore/local-store.hh
@@ -144,7 +144,7 @@ public:
     void addToStore(const ValidPathInfo & info, Source & source,
         RepairFlag repair, CheckSigsFlag checkSigs) override;
 
-    StorePath addToStoreFromDump(Source & dump, const string & name,
+    StorePath addToStoreFromDump(Source & dump, std::string_view name,
         FileIngestionMethod method, HashType hashAlgo, RepairFlag repair, const StorePathSet & references) override;
 
     StorePath addTextToStore(const string & name, const string & s,
diff --git a/src/libstore/remote-store.cc b/src/libstore/remote-store.cc
index 573becfbd..c6f083dea 100644
--- a/src/libstore/remote-store.cc
+++ b/src/libstore/remote-store.cc
@@ -500,7 +500,7 @@ std::optional<StorePath> RemoteStore::queryPathFromHashPart(const std::string &
 
 ref<const ValidPathInfo> RemoteStore::addCAToStore(
     Source & dump,
-    const string & name,
+    std::string_view name,
     ContentAddressMethod caMethod,
     const StorePathSet & references,
     RepairFlag repair)
@@ -582,7 +582,7 @@ ref<const ValidPathInfo> RemoteStore::addCAToStore(
 }
 
 
-StorePath RemoteStore::addToStoreFromDump(Source & dump, const string & name,
+StorePath RemoteStore::addToStoreFromDump(Source & dump, std::string_view name,
       FileIngestionMethod method, HashType hashType, RepairFlag repair, const StorePathSet & references)
 {
     return addCAToStore(dump, name, FixedOutputHashMethod{ .fileIngestionMethod = method, .hashType = hashType }, references, repair)->path;
diff --git a/src/libstore/remote-store.hh b/src/libstore/remote-store.hh
index b91d25fa9..55cfd5cc6 100644
--- a/src/libstore/remote-store.hh
+++ b/src/libstore/remote-store.hh
@@ -66,13 +66,13 @@ public:
     /* Add a content-addressable store path. `dump` will be drained. */
     ref<const ValidPathInfo> addCAToStore(
         Source & dump,
-        const string & name,
+        std::string_view name,
         ContentAddressMethod caMethod,
         const StorePathSet & references,
         RepairFlag repair);
 
     /* Add a content-addressable store path. Does not support references. `dump` will be drained. */
-    StorePath addToStoreFromDump(Source & dump, const string & name,
+    StorePath addToStoreFromDump(Source & dump, std::string_view name,
         FileIngestionMethod method = FileIngestionMethod::Recursive, HashType hashAlgo = htSHA256, RepairFlag repair = NoRepair, const StorePathSet & references = StorePathSet()) override;
 
     void addToStore(const ValidPathInfo & info, Source & nar,
diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
index 4068f8f35..90d2e93ed 100644
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@@ -499,7 +499,7 @@ public:
        false).
        `dump` may be drained */
     // FIXME: remove?
-    virtual StorePath addToStoreFromDump(Source & dump, const string & name,
+    virtual StorePath addToStoreFromDump(Source & dump, std::string_view name,
         FileIngestionMethod method = FileIngestionMethod::Recursive, HashType hashAlgo = htSHA256, RepairFlag repair = NoRepair,
         const StorePathSet & references = StorePathSet())
     { unsupported("addToStoreFromDump"); }

From aa5b83d93ce1b7bb67bf81ceda7ebf7706b1efa0 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 15 Feb 2022 14:33:31 +0100
Subject: [PATCH 027/251] InputScheme::fetch(): Return a StorePath instead of a
 Tree

---
 src/libfetchers/fetchers.cc  | 12 ++++++------
 src/libfetchers/fetchers.hh  |  3 +--
 src/libfetchers/git.cc       | 14 ++++----------
 src/libfetchers/github.cc    |  9 +++------
 src/libfetchers/indirect.cc  |  2 +-
 src/libfetchers/mercurial.cc | 14 ++++----------
 src/libfetchers/path.cc      |  7 ++-----
 src/libfetchers/tarball.cc   |  8 ++++----
 8 files changed, 25 insertions(+), 44 deletions(-)

diff --git a/src/libfetchers/fetchers.cc b/src/libfetchers/fetchers.cc
index e158d914b..c06ccb929 100644
--- a/src/libfetchers/fetchers.cc
+++ b/src/libfetchers/fetchers.cc
@@ -124,15 +124,13 @@ std::pair<Tree, Input> Input::fetch(ref<Store> store) const
             debug("using substituted/cached input '%s' in '%s'",
                 to_string(), store->printStorePath(storePath));
 
-            auto actualPath = store->toRealPath(storePath);
-
-            return {fetchers::Tree(std::move(actualPath), std::move(storePath)), *this};
+            return {Tree { .actualPath = store->toRealPath(storePath), .storePath = std::move(storePath) }, *this};
         } catch (Error & e) {
             debug("substitution of input '%s' failed: %s", to_string(), e.what());
         }
     }
 
-    auto [tree, input] = [&]() -> std::pair<Tree, Input> {
+    auto [storePath, input] = [&]() -> std::pair<StorePath, Input> {
         try {
             return scheme->fetch(store, *this);
         } catch (Error & e) {
@@ -141,8 +139,10 @@ std::pair<Tree, Input> Input::fetch(ref<Store> store) const
         }
     }();
 
-    if (tree.actualPath == "")
-        tree.actualPath = store->toRealPath(tree.storePath);
+    Tree tree {
+        .actualPath = store->toRealPath(storePath),
+        .storePath = storePath,
+    };
 
     auto narHash = store->queryPathInfo(tree.storePath)->narHash;
     input.attrs.insert_or_assign("narHash", narHash.to_string(SRI, true));
diff --git a/src/libfetchers/fetchers.hh b/src/libfetchers/fetchers.hh
index c43b047a7..2836af5fa 100644
--- a/src/libfetchers/fetchers.hh
+++ b/src/libfetchers/fetchers.hh
@@ -16,7 +16,6 @@ struct Tree
 {
     Path actualPath;
     StorePath storePath;
-    Tree(Path && actualPath, StorePath && storePath) : actualPath(actualPath), storePath(std::move(storePath)) {}
 };
 
 struct InputScheme;
@@ -131,7 +130,7 @@ struct InputScheme
 
     virtual void markChangedFile(const Input & input, std::string_view file, std::optional<std::string> commitMsg);
 
-    virtual std::pair<Tree, Input> fetch(ref<Store> store, const Input & input) = 0;
+    virtual std::pair<StorePath, Input> fetch(ref<Store> store, const Input & input) = 0;
 };
 
 void registerInputScheme(std::shared_ptr<InputScheme> && fetcher);
diff --git a/src/libfetchers/git.cc b/src/libfetchers/git.cc
index 544d2ffbf..c3f0f8c8f 100644
--- a/src/libfetchers/git.cc
+++ b/src/libfetchers/git.cc
@@ -172,7 +172,7 @@ struct GitInputScheme : InputScheme
         return {isLocal, isLocal ? url.path : url.base};
     }
 
-    std::pair<Tree, Input> fetch(ref<Store> store, const Input & _input) override
+    std::pair<StorePath, Input> fetch(ref<Store> store, const Input & _input) override
     {
         Input input(_input);
 
@@ -197,17 +197,14 @@ struct GitInputScheme : InputScheme
         };
 
         auto makeResult = [&](const Attrs & infoAttrs, StorePath && storePath)
-            -> std::pair<Tree, Input>
+            -> std::pair<StorePath, Input>
         {
             assert(input.getRev());
             assert(!_input.getRev() || _input.getRev() == input.getRev());
             if (!shallow)
                 input.attrs.insert_or_assign("revCount", getIntAttr(infoAttrs, "revCount"));
             input.attrs.insert_or_assign("lastModified", getIntAttr(infoAttrs, "lastModified"));
-            return {
-                Tree(store->toRealPath(storePath), std::move(storePath)),
-                input
-            };
+            return {std::move(storePath), input};
         };
 
         if (input.getRev()) {
@@ -285,10 +282,7 @@ struct GitInputScheme : InputScheme
                     "lastModified",
                     haveCommits ? std::stoull(runProgram("git", true, { "-C", actualUrl, "log", "-1", "--format=%ct", "--no-show-signature", "HEAD" })) : 0);
 
-                return {
-                    Tree(store->toRealPath(storePath), std::move(storePath)),
-                    input
-                };
+                return {std::move(storePath), input};
             }
         }
 
diff --git a/src/libfetchers/github.cc b/src/libfetchers/github.cc
index 1c539b80e..8ba6935f9 100644
--- a/src/libfetchers/github.cc
+++ b/src/libfetchers/github.cc
@@ -180,7 +180,7 @@ struct GitArchiveInputScheme : InputScheme
 
     virtual DownloadUrl getDownloadUrl(const Input & input) const = 0;
 
-    std::pair<Tree, Input> fetch(ref<Store> store, const Input & _input) override
+    std::pair<StorePath, Input> fetch(ref<Store> store, const Input & _input) override
     {
         Input input(_input);
 
@@ -199,10 +199,7 @@ struct GitArchiveInputScheme : InputScheme
 
         if (auto res = getCache()->lookup(store, immutableAttrs)) {
             input.attrs.insert_or_assign("lastModified", getIntAttr(res->first, "lastModified"));
-            return {
-                Tree(store->toRealPath(res->second), std::move(res->second)),
-                input
-            };
+            return {std::move(res->second), input};
         }
 
         auto url = getDownloadUrl(input);
@@ -221,7 +218,7 @@ struct GitArchiveInputScheme : InputScheme
             tree.storePath,
             true);
 
-        return {std::move(tree), input};
+        return {std::move(tree.storePath), input};
     }
 };
 
diff --git a/src/libfetchers/indirect.cc b/src/libfetchers/indirect.cc
index 10e59919a..9288fc6cf 100644
--- a/src/libfetchers/indirect.cc
+++ b/src/libfetchers/indirect.cc
@@ -94,7 +94,7 @@ struct IndirectInputScheme : InputScheme
         return input;
     }
 
-    std::pair<Tree, Input> fetch(ref<Store> store, const Input & input) override
+    std::pair<StorePath, Input> fetch(ref<Store> store, const Input & input) override
     {
         throw Error("indirect input '%s' cannot be fetched directly", input.to_string());
     }
diff --git a/src/libfetchers/mercurial.cc b/src/libfetchers/mercurial.cc
index d52d4641b..5123bcda4 100644
--- a/src/libfetchers/mercurial.cc
+++ b/src/libfetchers/mercurial.cc
@@ -143,7 +143,7 @@ struct MercurialInputScheme : InputScheme
         return {isLocal, isLocal ? url.path : url.base};
     }
 
-    std::pair<Tree, Input> fetch(ref<Store> store, const Input & _input) override
+    std::pair<StorePath, Input> fetch(ref<Store> store, const Input & _input) override
     {
         Input input(_input);
 
@@ -193,10 +193,7 @@ struct MercurialInputScheme : InputScheme
 
                 auto storePath = store->addToStore(input.getName(), actualUrl, FileIngestionMethod::Recursive, htSHA256, filter);
 
-                return {
-                    Tree(store->toRealPath(storePath), std::move(storePath)),
-                    input
-                };
+                return {std::move(storePath), input};
             }
         }
 
@@ -212,15 +209,12 @@ struct MercurialInputScheme : InputScheme
         };
 
         auto makeResult = [&](const Attrs & infoAttrs, StorePath && storePath)
-            -> std::pair<Tree, Input>
+            -> std::pair<StorePath, Input>
         {
             assert(input.getRev());
             assert(!_input.getRev() || _input.getRev() == input.getRev());
             input.attrs.insert_or_assign("revCount", getIntAttr(infoAttrs, "revCount"));
-            return {
-                Tree(store->toRealPath(storePath), std::move(storePath)),
-                input
-            };
+            return {std::move(storePath), input};
         };
 
         if (input.getRev()) {
diff --git a/src/libfetchers/path.cc b/src/libfetchers/path.cc
index 07e543c53..59e228e97 100644
--- a/src/libfetchers/path.cc
+++ b/src/libfetchers/path.cc
@@ -80,7 +80,7 @@ struct PathInputScheme : InputScheme
         // nothing to do
     }
 
-    std::pair<Tree, Input> fetch(ref<Store> store, const Input & input) override
+    std::pair<StorePath, Input> fetch(ref<Store> store, const Input & input) override
     {
         std::string absPath;
         auto path = getStrAttr(input.attrs, "path");
@@ -115,10 +115,7 @@ struct PathInputScheme : InputScheme
             // FIXME: try to substitute storePath.
             storePath = store->addToStore("source", absPath);
 
-        return {
-            Tree(store->toRealPath(*storePath), std::move(*storePath)),
-            input
-        };
+        return {std::move(*storePath), input};
     }
 };
 
diff --git a/src/libfetchers/tarball.cc b/src/libfetchers/tarball.cc
index c933475ca..74c8097ff 100644
--- a/src/libfetchers/tarball.cc
+++ b/src/libfetchers/tarball.cc
@@ -126,7 +126,7 @@ std::pair<Tree, time_t> downloadTarball(
 
     if (cached && !cached->expired)
         return {
-            Tree(store->toRealPath(cached->storePath), std::move(cached->storePath)),
+            Tree { .actualPath = store->toRealPath(cached->storePath), .storePath = std::move(cached->storePath) },
             getIntAttr(cached->infoAttrs, "lastModified")
         };
 
@@ -163,7 +163,7 @@ std::pair<Tree, time_t> downloadTarball(
         immutable);
 
     return {
-        Tree(store->toRealPath(*unpackedStorePath), std::move(*unpackedStorePath)),
+        Tree { .actualPath = store->toRealPath(*unpackedStorePath), .storePath = std::move(*unpackedStorePath) },
         lastModified,
     };
 }
@@ -225,10 +225,10 @@ struct TarballInputScheme : InputScheme
         return true;
     }
 
-    std::pair<Tree, Input> fetch(ref<Store> store, const Input & input) override
+    std::pair<StorePath, Input> fetch(ref<Store> store, const Input & input) override
     {
         auto tree = downloadTarball(store, getStrAttr(input.attrs, "url"), input.getName(), false).first;
-        return {std::move(tree), input};
+        return {std::move(tree.storePath), input};
     }
 };
 

From 1bec333788df9b1c9d9c68a428cfc79568d87cf2 Mon Sep 17 00:00:00 2001
From: Guillaume Maudoux <layus.on@gmail.com>
Date: Thu, 17 Feb 2022 09:32:15 +0100
Subject: [PATCH 028/251] Create to daemon-socket folder during install

---
 scripts/install-multi-user.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/install-multi-user.sh b/scripts/install-multi-user.sh
index 33e4eaa14..d3ed53d09 100644
--- a/scripts/install-multi-user.sh
+++ b/scripts/install-multi-user.sh
@@ -609,7 +609,7 @@ EOF
         fi
     fi
     _sudo "to make the basic directory structure of Nix (part 1)" \
-          install -dv -m 0755 /nix /nix/var /nix/var/log /nix/var/log/nix /nix/var/log/nix/drvs /nix/var/nix{,/db,/gcroots,/profiles,/temproots,/userpool} /nix/var/nix/{gcroots,profiles}/per-user
+          install -dv -m 0755 /nix /nix/var /nix/var/log /nix/var/log/nix /nix/var/log/nix/drvs /nix/var/nix{,/db,/gcroots,/profiles,/temproots,/userpool,/daemon-socket} /nix/var/nix/{gcroots,profiles}/per-user
 
     _sudo "to make the basic directory structure of Nix (part 2)" \
           install -dv -g "$NIX_BUILD_GROUP_NAME" -m 1775 /nix/store

From f56dd3a36bc8a325028588fd5500cbc33fa48a26 Mon Sep 17 00:00:00 2001
From: Taeer Bar-Yam <taeer@bar-yam.me>
Date: Thu, 17 Feb 2022 13:59:32 -0500
Subject: [PATCH 029/251] make flake template welcomeText markdown

---
 src/nix/flake-init.md | 14 ++++++++++----
 src/nix/flake.cc      |  5 +++--
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/src/nix/flake-init.md b/src/nix/flake-init.md
index c8bcee375..c13b22248 100644
--- a/src/nix/flake-init.md
+++ b/src/nix/flake-init.md
@@ -37,8 +37,8 @@ A flake can declare templates through its `templates` and
 
 * `path`: The path of the directory to be copied.
 
-* `welcomeText`: A block of text to display when a user initializes a new flake
-  based on this template.
+* `welcomeText`: A block of markdown text to display when a user initializes a
+  new flake based on this template.
 
 
 Here is an example:
@@ -50,8 +50,14 @@ outputs = { self }: {
     path = ./rust;
     description = "A simple Rust/Cargo project";
     welcomeText = ''
-      You've created a simple Rust/Cargo template.
-      Visit https://www.rust-lang.org/ for more info.
+      # Simple Rust/Cargo Template
+      ## Intended usage
+      The intended usage of this flake is...
+
+      ## More info
+      - [Rust language](https://www.rust-lang.org/)
+      - [Rust on the NixOS Wiki](https://nixos.wiki/wiki/Rust)
+      - ...
     '';
   };
 
diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index f5d34c10f..ac14bed74 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -13,6 +13,7 @@
 #include "registry.hh"
 #include "json.hh"
 #include "eval-cache.hh"
+#include "markdown.hh"
 
 #include <nlohmann/json.hpp>
 #include <queue>
@@ -741,8 +742,8 @@ struct CmdFlakeInitCommon : virtual Args, EvalCommand
         }
         auto welcomeText = cursor->maybeGetAttr("welcomeText");
         if (welcomeText) {
-            notice("\n----------\n");
-            notice(welcomeText->getString());
+            notice("\n");
+            notice(renderMarkdownToTerminal(welcomeText->getString()));
         }
     }
 };

From 219fa2e43dedbbc7589474f1644da88974690baa Mon Sep 17 00:00:00 2001
From: Taeer Bar-Yam <taeer@bar-yam.me>
Date: Thu, 17 Feb 2022 15:17:20 -0500
Subject: [PATCH 030/251] add release notes for welcomeText

---
 doc/manual/src/release-notes/rl-next.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/doc/manual/src/release-notes/rl-next.md b/doc/manual/src/release-notes/rl-next.md
index ad8c27dbc..80eed9397 100644
--- a/doc/manual/src/release-notes/rl-next.md
+++ b/doc/manual/src/release-notes/rl-next.md
@@ -7,3 +7,9 @@
   implemented.
 
 * `nix store ping` now reports the version of the remote Nix daemon.
+
+* `nix flake {init,new}` now display information about which files have been
+  created.
+
+* Templates can now define a `welcomeText` attribute, which is printed out by
+  `nix flake {init,new} --template <template>`.

From f0de5fb8e733e45f1d96fdf842eab7cdfc598c60 Mon Sep 17 00:00:00 2001
From: Rok Garbas <rok@garbas.si>
Date: Fri, 18 Feb 2022 00:32:38 +0100
Subject: [PATCH 031/251] remove the manifest before creating them

---
 maintainers/push-docker.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/maintainers/push-docker.sh b/maintainers/push-docker.sh
index f9c5a6b18..2aa953a78 100755
--- a/maintainers/push-docker.sh
+++ b/maintainers/push-docker.sh
@@ -2,7 +2,7 @@
 
 # TODO: parse from .version
 MAINTENANCE_VERSION="2.6"
-VERSION="$MAINTENANCE_VERSION.0"
+VERSION="$MAINTENANCE_VERSION.1"
 
 # Should be override `latest` tag, default true
 PUSH_AS_LATEST=1
@@ -55,9 +55,11 @@ do
 done
 
 echo "=> Creating $VERSION multi platform docker manifest for the following platforms: $PLATFORMS ..."
+docker manifest rm nixos/nix:$VERSION $DOCKER_MANIFEST
 docker manifest create nixos/nix:$VERSION $DOCKER_MANIFEST
 if [ $PUSH_AS_LATEST -eq 1 ]; then
   echo "=> Creating latest multi platform docker manifest for the following platforms: $PLATFORMS ..."
+  docker manifest rm nixos/nix:latest $DOCKER_MANIFEST_LATEST
   docker manifest create nixos/nix:latest $DOCKER_MANIFEST_LATEST
 fi
 

From 9bc03adbba5334663901c1136203bc07e4776be9 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 18 Feb 2022 13:57:38 +0100
Subject: [PATCH 032/251] Integrate push-docker.sh into the release script

This also makes sure that we get the Docker images from the same Hydra
eval, rather than the latest build from job/nix/.../dockerImage, which
may not be the same.
---
 maintainers/push-docker.sh    | 71 --------------------------------
 maintainers/upload-release.pl | 76 +++++++++++++++++++++++++++++++++--
 2 files changed, 72 insertions(+), 75 deletions(-)
 delete mode 100755 maintainers/push-docker.sh

diff --git a/maintainers/push-docker.sh b/maintainers/push-docker.sh
deleted file mode 100755
index 2aa953a78..000000000
--- a/maintainers/push-docker.sh
+++ /dev/null
@@ -1,71 +0,0 @@
-#/usr/bin/env bash
-
-# TODO: parse from .version
-MAINTENANCE_VERSION="2.6"
-VERSION="$MAINTENANCE_VERSION.1"
-
-# Should be override `latest` tag, default true
-PUSH_AS_LATEST=1
-
-PLATFORMS="x86_64-linux aarch64-linux"
-
-# ensure we are logged to docker hub
-docker login
-
-DOCKER_MANIFEST=""
-DOCKER_MANIFEST_LATEST=""
-
-for PLATFORM in $PLATFORMS;
-do
-  if   [ "$PLATFORM" = "x86_64-linux" ];  then DOCKER_PLATFORM="amd64"
-  elif [ "$PLATFORM" = "aarch64-linux" ]; then DOCKER_PLATFORM="arm64"
-  else
-    echo "EROROR: No docker platform found for $PLATFORM platform"
-    exit 1
-  fi
-
-  echo "=> Loading docker image for $PLATFORM platform ..."
-
-  DOCKER_IMAGE_TMP_FILE="$PWD/image-$PLATFORM.tar.gz"
-  if [ ! -f "$DOCKER_IMAGE_TMP_FILE" ]; then
-    curl -L https://hydra.nixos.org/job/nix/maintenance-$MAINTENANCE_VERSION/dockerImage.$PLATFORM/latest/download/1 > $DOCKER_IMAGE_TMP_FILE
-  fi
-  docker load -i $DOCKER_IMAGE_TMP_FILE
-
-  echo "=> Tagging docker image of version $VERSION for $PLATFORM platform ..."
-
-  docker tag nix:$VERSION nixos/nix:$VERSION-$DOCKER_PLATFORM
-  if [ $PUSH_AS_LATEST -eq 1 ]; then
-    echo "=> Tagging docker image of version latest for $PLATFORM platform ..."
-    docker tag nix:$VERSION nixos/nix:latest-$DOCKER_PLATFORM
-  fi
-
-  echo "=> Pushing docker image of version $VERSION for $PLATFORM platform ..."
-
-  docker push nixos/nix:$VERSION-$DOCKER_PLATFORM
-  if [ $PUSH_AS_LATEST -eq 1 ]; then
-    echo "=> Pushing docker image of version latest for $PLATFORM platform ..."
-    docker push nixos/nix:latest-$DOCKER_PLATFORM
-  fi
-
-  DOCKER_MANIFEST="$DOCKER_MANIFEST --amend nixos/nix:$VERSION-$DOCKER_PLATFORM"
-  DOCKER_MANIFEST_LATEST="$DOCKER_MANIFEST_LATEST --amend nixos/nix:latest-$DOCKER_PLATFORM"
-
-  echo
-done
-
-echo "=> Creating $VERSION multi platform docker manifest for the following platforms: $PLATFORMS ..."
-docker manifest rm nixos/nix:$VERSION $DOCKER_MANIFEST
-docker manifest create nixos/nix:$VERSION $DOCKER_MANIFEST
-if [ $PUSH_AS_LATEST -eq 1 ]; then
-  echo "=> Creating latest multi platform docker manifest for the following platforms: $PLATFORMS ..."
-  docker manifest rm nixos/nix:latest $DOCKER_MANIFEST_LATEST
-  docker manifest create nixos/nix:latest $DOCKER_MANIFEST_LATEST
-fi
-
-echo "=> Pushing $VERSION multi platform docker manifest ..."
-docker manifest push nixos/nix:$VERSION
-if [ $PUSH_AS_LATEST -eq 1 ]; then
-  echo "=> Pushing latest multi platform docker manifest ..."
-  docker manifest push nixos/nix:latest
-fi
diff --git a/maintainers/upload-release.pl b/maintainers/upload-release.pl
index 18ab33424..d3ef63db8 100755
--- a/maintainers/upload-release.pl
+++ b/maintainers/upload-release.pl
@@ -55,6 +55,11 @@ my $releaseDir = "nix/$releaseName";
 my $tmpDir = "$TMPDIR/nix-release/$releaseName";
 File::Path::make_path($tmpDir);
 
+my $narCache = "$TMPDIR/nar-cache";
+File::Path::make_path($narCache);
+
+my $binaryCache = "https://cache.nixos.org/?local-nar-cache=$narCache";
+
 # S3 setup.
 my $aws_access_key_id = $ENV{'AWS_ACCESS_KEY_ID'} or die "No AWS_ACCESS_KEY_ID given.";
 my $aws_secret_access_key = $ENV{'AWS_SECRET_ACCESS_KEY'} or die "No AWS_SECRET_ACCESS_KEY given.";
@@ -80,6 +85,7 @@ sub downloadFile {
     my ($jobName, $productNr, $dstName) = @_;
 
     my $buildInfo = decode_json(fetch("$evalUrl/job/$jobName", 'application/json'));
+    #print STDERR "$jobName: ", Dumper($buildInfo), "\n";
 
     my $srcFile = $buildInfo->{buildproducts}->{$productNr}->{path} or die "job '$jobName' lacks product $productNr\n";
     $dstName //= basename($srcFile);
@@ -87,19 +93,27 @@ sub downloadFile {
 
     if (!-e $tmpFile) {
         print STDERR "downloading $srcFile to $tmpFile...\n";
-        system("NIX_REMOTE=https://cache.nixos.org/ nix store cat '$srcFile' > '$tmpFile'") == 0
+
+        my $fileInfo = decode_json(`NIX_REMOTE=$binaryCache nix store ls --json '$srcFile'`);
+
+        $srcFile = $fileInfo->{target} if $fileInfo->{type} eq 'symlink';
+
+        #print STDERR $srcFile, " ", Dumper($fileInfo), "\n";
+
+        system("NIX_REMOTE=$binaryCache nix store cat '$srcFile' > '$tmpFile'.tmp") == 0
             or die "unable to fetch $srcFile\n";
+        rename("$tmpFile.tmp", $tmpFile) or die;
     }
 
-    my $sha256_expected = $buildInfo->{buildproducts}->{$productNr}->{sha256hash} or die;
+    my $sha256_expected = $buildInfo->{buildproducts}->{$productNr}->{sha256hash};
     my $sha256_actual = `nix hash file --base16 --type sha256 '$tmpFile'`;
     chomp $sha256_actual;
-    if ($sha256_expected ne $sha256_actual) {
+    if (defined($sha256_expected) && $sha256_expected ne $sha256_actual) {
         print STDERR "file $tmpFile is corrupt, got $sha256_actual, expected $sha256_expected\n";
         exit 1;
     }
 
-    write_file("$tmpFile.sha256", $sha256_expected);
+    write_file("$tmpFile.sha256", $sha256_actual);
 
     if (! -e "$tmpFile.asc") {
         system("gpg2 --detach-sign --armor $tmpFile") == 0 or die "unable to sign $tmpFile\n";
@@ -117,6 +131,60 @@ downloadFile("binaryTarballCross.x86_64-linux.armv6l-linux", "1");
 downloadFile("binaryTarballCross.x86_64-linux.armv7l-linux", "1");
 downloadFile("installerScript", "1");
 
+# Upload docker images to dockerhub.
+my $dockerManifest = "";
+my $dockerManifestLatest = "";
+
+for my $platforms (["x86_64-linux", "amd64"], ["aarch64-linux", "arm64"]) {
+    my $system = $platforms->[0];
+    my $dockerPlatform = $platforms->[1];
+    my $fn = "nix-$version-docker-image-$dockerPlatform.tar.gz";
+    downloadFile("dockerImage.$system", "1", $fn);
+
+    print STDERR "loading docker image for $dockerPlatform...\n";
+    system("docker load -i $tmpDir/$fn") == 0 or die;
+
+    my $tag = "nixos/nix:$version-$dockerPlatform";
+    my $latestTag = "nixos/nix:latest-$dockerPlatform";
+
+    print STDERR "tagging $version docker image for $dockerPlatform...\n";
+    system("docker tag nix:$version $tag") == 0 or die;
+
+    if ($isLatest) {
+        print STDERR "tagging latest docker image for $dockerPlatform...\n";
+        system("docker tag nix:$version $latestTag") == 0 or die;
+    }
+
+    print STDERR "pushing $version docker image for $dockerPlatform...\n";
+    system("docker push -q $tag") == 0 or die;
+
+    if ($isLatest) {
+        print STDERR "pushing latest docker image for $dockerPlatform...\n";
+        system("docker push -q $latestTag") == 0 or die;
+    }
+
+    $dockerManifest .= " --amend $tag";
+    $dockerManifestLatest .= " --amend $latestTag"
+}
+
+print STDERR "creating multi-platform docker manifest...\n";
+system("docker manifest rm nixos/nix:$version");
+system("docker manifest create nixos/nix:$version $dockerManifest") == 0 or die;
+if ($isLatest) {
+    print STDERR "creating latest multi-platform docker manifest...\n";
+    system("docker manifest rm nixos/nix:latest");
+    system("docker manifest create nixos/nix:latest $dockerManifestLatest") == 0 or die;
+}
+
+print STDERR "pushing multi-platform docker manifest...\n";
+system("docker manifest push nixos/nix:$version") == 0 or die;
+
+if ($isLatest) {
+    print STDERR "pushing latest multi-platform docker manifest...\n";
+    system("docker manifest push nixos/nix:latest") == 0 or die;
+}
+
+# Upload release files to S3.
 for my $fn (glob "$tmpDir/*") {
     my $name = basename($fn);
     my $dstKey = "$releaseDir/" . $name;

From dbdc63bc41d33a33e75d5fc8efa8e6520f9e6494 Mon Sep 17 00:00:00 2001
From: Linus Heckemann <git@sphalerite.org>
Date: Fri, 18 Feb 2022 23:43:33 +0100
Subject: [PATCH 033/251] path-info: use full store paths when we have them

Fixes #5645
---
 src/libstore/store-api.cc | 3 ++-
 src/nix/path-info.cc      | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index 84767e917..8fcdc8b57 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -761,11 +761,11 @@ void Store::pathInfoToJSON(JSONPlaceholder & jsonOut, const StorePathSet & store
 
     for (auto & storePath : storePaths) {
         auto jsonPath = jsonList.object();
-        jsonPath.attr("path", printStorePath(storePath));
 
         try {
             auto info = queryPathInfo(storePath);
 
+            jsonPath.attr("path", printStorePath(info->path));
             jsonPath
                 .attr("narHash", info->narHash.to_string(hashBase, true))
                 .attr("narSize", info->narSize);
@@ -819,6 +819,7 @@ void Store::pathInfoToJSON(JSONPlaceholder & jsonOut, const StorePathSet & store
             }
 
         } catch (InvalidPath &) {
+            jsonPath.attr("path", printStorePath(storePath));
             jsonPath.attr("valid", false);
         }
     }
diff --git a/src/nix/path-info.cc b/src/nix/path-info.cc
index 3743d7504..d690fe594 100644
--- a/src/nix/path-info.cc
+++ b/src/nix/path-info.cc
@@ -97,7 +97,7 @@ struct CmdPathInfo : StorePathsCommand, MixJSON
 
             for (auto & storePath : storePaths) {
                 auto info = store->queryPathInfo(storePath);
-                auto storePathS = store->printStorePath(storePath);
+                auto storePathS = store->printStorePath(info->path);
 
                 std::cout << storePathS;
 

From 1fd127a06833c19a5a2965bd41cf4f695773cca6 Mon Sep 17 00:00:00 2001
From: "Travis A. Everett" <travis.a.everett@gmail.com>
Date: Fri, 18 Feb 2022 23:15:37 -0600
Subject: [PATCH 034/251] install-darwin: fix mount permission edge-case

Fixes #6122, which reports a problem with trying to run the installer
under another user (probably: user is not the disk "owner" and thus
can't mount the volume).
---
 scripts/create-darwin-volume.sh | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/scripts/create-darwin-volume.sh b/scripts/create-darwin-volume.sh
index bd8a7ee3a..ece4f29bb 100755
--- a/scripts/create-darwin-volume.sh
+++ b/scripts/create-darwin-volume.sh
@@ -685,22 +685,27 @@ encrypt_volume() {
     local volume_uuid="$1"
     local volume_label="$2"
     local password
+
+    task "Encrypt the Nix volume" >&2
+
     # Note: mount/unmount are late additions to support the right order
     # of operations for creating the volume and then baking its uuid into
     # other artifacts; not as well-trod wrt to potential errors, race
     # conditions, etc.
 
-    /usr/sbin/diskutil mount "$volume_label"
+    _sudo "to mount your Nix volume for encrypting" \
+        /usr/sbin/diskutil mount "$volume_label"
 
     password="$(/usr/bin/xxd -l 32 -p -c 256 /dev/random)"
     _sudo "to add your Nix volume's password to Keychain" \
         /usr/bin/security -i <<EOF
 add-generic-password -a "$volume_label" -s "$volume_uuid" -l "$volume_label encryption password" -D "Encrypted volume password" -j "Added automatically by the Nix installer for use by $NIX_VOLUME_MOUNTD_DEST" -w "$password" -T /System/Library/CoreServices/APFSUserAgent -T /System/Library/CoreServices/CSUserAgent -T /usr/bin/security "/Library/Keychains/System.keychain"
 EOF
-    builtin printf "%s" "$password" | _sudo "to encrypt your Nix volume" \
+    builtin printf "%s" "$password" | _sudo "to actually encrypt your Nix volume" \
         /usr/sbin/diskutil apfs encryptVolume "$volume_label" -user disk -stdinpassphrase
 
-    /usr/sbin/diskutil unmount force "$volume_label"
+    _sudo "to unmount the encrypted volume" \
+        /usr/sbin/diskutil unmount force "$volume_label"
 }
 
 create_volume() {

From 0bfa0cdea1b4eb09405e35b338887c91a041d28c Mon Sep 17 00:00:00 2001
From: Martin Schwaighofer <mschwaig@users.noreply.github.com>
Date: Mon, 13 Dec 2021 21:31:15 +0100
Subject: [PATCH 035/251] git fetcher: improve check for valid repository

The .git/refs/heads directory might be empty for a valid
usable git repository. This often happens in CI environments,
which might only fetch commits, not branches.
Therefore instead we let git itself check if HEAD points to
something that looks like a commit.

fixes #5302
---
 src/libfetchers/git.cc | 28 ++++++++++++++--------------
 tests/fetchGit.sh      |  8 ++++++++
 2 files changed, 22 insertions(+), 14 deletions(-)

diff --git a/src/libfetchers/git.cc b/src/libfetchers/git.cc
index c3f0f8c8f..7479318e3 100644
--- a/src/libfetchers/git.cc
+++ b/src/libfetchers/git.cc
@@ -220,21 +220,21 @@ struct GitInputScheme : InputScheme
         if (!input.getRef() && !input.getRev() && isLocal) {
             bool clean = false;
 
-            /* Check whether this repo has any commits. There are
-               probably better ways to do this. */
-            auto gitDir = actualUrl + "/.git";
-            auto commonGitDir = chomp(runProgram(
-                "git",
-                true,
-                { "-C", actualUrl, "rev-parse", "--git-common-dir" }
-            ));
-            if (commonGitDir != ".git")
-                    gitDir = commonGitDir;
-
-            bool haveCommits = !readDirectory(gitDir + "/refs/heads").empty();
+            /* Check whether HEAD points to something that looks like a commit,
+               since that is the refrence we want to use later on. */
+            bool hasHead = false;
+            try {
+                runProgram("git", true, { "-C", actualUrl, "rev-parse", "--verify", "--no-revs", "HEAD^{commit}" });
+                hasHead = true;
+            } catch (ExecError & e) {
+                // git exits with status 128 here if it does not detect a repository.
+                if (!WIFEXITED(e.status) || WEXITSTATUS(e.status) != 128) {
+                    throw Error("Git tree '%s' is broken.\n'git rev-parse --verify HEAD' failed with exit code %d.", actualUrl, WEXITSTATUS(e.status));
+                }
+            }
 
             try {
-                if (haveCommits) {
+                if (hasHead) {
                     runProgram("git", true, { "-C", actualUrl, "diff-index", "--quiet", "HEAD", "--" });
                     clean = true;
                 }
@@ -280,7 +280,7 @@ struct GitInputScheme : InputScheme
                 // modified dirty file?
                 input.attrs.insert_or_assign(
                     "lastModified",
-                    haveCommits ? std::stoull(runProgram("git", true, { "-C", actualUrl, "log", "-1", "--format=%ct", "--no-show-signature", "HEAD" })) : 0);
+                    hasHead ? std::stoull(runProgram("git", true, { "-C", actualUrl, "log", "-1", "--format=%ct", "--no-show-signature", "HEAD" })) : 0);
 
                 return {std::move(storePath), input};
             }
diff --git a/tests/fetchGit.sh b/tests/fetchGit.sh
index 89294d8d2..dd0d98956 100644
--- a/tests/fetchGit.sh
+++ b/tests/fetchGit.sh
@@ -170,6 +170,14 @@ NIX=$(command -v nix)
 path5=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = $repo; ref = \"dev\"; }).outPath")
 [[ $path3 = $path5 ]]
 
+# Fetching from a repo with only a specific revision and no branches should
+# not fall back to copying files and record correct revision information. See: #5302
+mkdir $TEST_ROOT/minimal
+git -C $TEST_ROOT/minimal init
+git -C $TEST_ROOT/minimal fetch $repo $rev2
+git -C $TEST_ROOT/minimal checkout $rev2
+[[ $(nix eval --impure --raw --expr "(builtins.fetchGit { url = $TEST_ROOT/minimal; }).rev") = $rev2 ]]
+
 # Fetching a shallow repo shouldn't work by default, because we can't
 # return a revCount.
 git clone --depth 1 file://$repo $TEST_ROOT/shallow

From c7e527b82b3dafed5f0da2ec0e14a47cf8e65def Mon Sep 17 00:00:00 2001
From: Martin Schwaighofer <mschwaig@users.noreply.github.com>
Date: Mon, 13 Dec 2021 21:31:20 +0100
Subject: [PATCH 036/251] git fetcher: invoke diff instead of diff-index

diff-index operates on the view that git has of the working tree,
which might be outdated. The higher-level diff command does this
automatically. This change also adds handling for submodules.

fixes #4140

Alternative fixes would be invoking update-index before diff-index or
matching more closely what require_clean_work_tree from git-sh-setup.sh
does, but both those options make it more difficult to reason about
correctness.
---
 src/libfetchers/git.cc | 12 +++++++++++-
 tests/fetchGit.sh      |  7 ++++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/libfetchers/git.cc b/src/libfetchers/git.cc
index 7479318e3..d241eb67a 100644
--- a/src/libfetchers/git.cc
+++ b/src/libfetchers/git.cc
@@ -235,7 +235,17 @@ struct GitInputScheme : InputScheme
 
             try {
                 if (hasHead) {
-                    runProgram("git", true, { "-C", actualUrl, "diff-index", "--quiet", "HEAD", "--" });
+                    // Using git diff is preferrable over lower-level operations here,
+                    // because its conceptually simpler and we only need the exit code anyways.
+                    auto gitDiffOpts = Strings({ "-C", actualUrl, "diff", "HEAD", "--quiet"});
+                    if (!submodules) {
+                        // Changes in submodules should only make the tree dirty
+                        // when those submodules will be copied as well.
+                        gitDiffOpts.emplace_back("--ignore-submodules");
+                    }
+                    gitDiffOpts.emplace_back("--");
+                    runProgram("git", true, gitDiffOpts);
+
                     clean = true;
                 }
             } catch (ExecError & e) {
diff --git a/tests/fetchGit.sh b/tests/fetchGit.sh
index dd0d98956..628d96924 100644
--- a/tests/fetchGit.sh
+++ b/tests/fetchGit.sh
@@ -11,7 +11,7 @@ repo=$TEST_ROOT/git
 
 export _NIX_FORCE_HTTP=1
 
-rm -rf $repo ${repo}-tmp $TEST_HOME/.cache/nix $TEST_ROOT/worktree $TEST_ROOT/shallow
+rm -rf $repo ${repo}-tmp $TEST_HOME/.cache/nix $TEST_ROOT/worktree $TEST_ROOT/shallow $TEST_ROOT/minimal
 
 git init $repo
 git -C $repo config user.email "foobar@example.com"
@@ -147,8 +147,13 @@ path3=$(nix eval --impure --raw --expr "(builtins.fetchGit $repo).outPath")
 # (check dirty-tree handling was used)
 [[ $(nix eval --impure --raw --expr "(builtins.fetchGit $repo).rev") = 0000000000000000000000000000000000000000 ]]
 [[ $(nix eval --impure --raw --expr "(builtins.fetchGit $repo).shortRev") = 0000000 ]]
+# Making a dirty tree clean again and fetching it should
+# record correct revision information. See: #4140
+echo world > $repo/hello
+[[ $(nix eval --impure --raw --expr "(builtins.fetchGit $repo).rev") = $rev2 ]]
 
 # Committing shouldn't change store path, or switch to using 'master'
+echo dev > $repo/hello
 git -C $repo commit -m 'Bla5' -a
 path4=$(nix eval --impure --raw --expr "(builtins.fetchGit $repo).outPath")
 [[ $(cat $path4/hello) = dev ]]

From 9504445cab095fe3869c5a68342fb2cf23ac0f28 Mon Sep 17 00:00:00 2001
From: Martin Schwaighofer <mschwaig@users.noreply.github.com>
Date: Sat, 1 Jan 2022 21:26:41 +0100
Subject: [PATCH 037/251] git fetcher: distinguish errors more precisely

---
 src/libfetchers/git.cc | 26 +++++++++++++++++---------
 tests/fetchGit.sh      |  8 ++++++++
 2 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/src/libfetchers/git.cc b/src/libfetchers/git.cc
index d241eb67a..ad877eacc 100644
--- a/src/libfetchers/git.cc
+++ b/src/libfetchers/git.cc
@@ -222,17 +222,25 @@ struct GitInputScheme : InputScheme
 
             /* Check whether HEAD points to something that looks like a commit,
                since that is the refrence we want to use later on. */
-            bool hasHead = false;
-            try {
-                runProgram("git", true, { "-C", actualUrl, "rev-parse", "--verify", "--no-revs", "HEAD^{commit}" });
-                hasHead = true;
-            } catch (ExecError & e) {
-                // git exits with status 128 here if it does not detect a repository.
-                if (!WIFEXITED(e.status) || WEXITSTATUS(e.status) != 128) {
-                    throw Error("Git tree '%s' is broken.\n'git rev-parse --verify HEAD' failed with exit code %d.", actualUrl, WEXITSTATUS(e.status));
-                }
+            auto result = runProgram(RunOptions {
+                .program = "git",
+                .args = { "-C", actualUrl, "--git-dir=.git", "rev-parse", "--verify", "--no-revs", "HEAD^{commit}" },
+                .mergeStderrToStdout = true
+            });
+            auto exitCode = WEXITSTATUS(result.first);
+            auto errorMessage = result.second;
+
+            if (errorMessage.find("fatal: not a git repository") != std::string::npos) {
+                throw Error("'%s' is not a git repository.", actualUrl);
+            } else if (errorMessage.find("fatal: Needed a single revision") != std::string::npos) {
+                // indicates that the repo does not have any commits
+                // we want to proceed and will consider it dirty later
+            } else if (exitCode != 0) {
+                // any other errors should lead to a failure
+                throw Error("Getting the HEAD of the git tree '%s' failed with exit code %d:\n%s", actualUrl, exitCode, errorMessage);
             }
 
+            bool hasHead = exitCode == 0;
             try {
                 if (hasHead) {
                     // Using git diff is preferrable over lower-level operations here,
diff --git a/tests/fetchGit.sh b/tests/fetchGit.sh
index 628d96924..ac23be5c0 100644
--- a/tests/fetchGit.sh
+++ b/tests/fetchGit.sh
@@ -206,3 +206,11 @@ rev4_nix=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = \"file://$
 # The name argument should be handled
 path9=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = \"file://$repo\"; ref = \"HEAD\"; name = \"foo\"; }).outPath")
 [[ $path9 =~ -foo$ ]]
+
+# should fail if there is no repo
+rm -rf $repo/.git
+(! nix eval --impure --raw --expr "(builtins.fetchGit \"file://$repo\").outPath")
+
+# should succeed for a repo without commits
+git init $repo
+path10=$(nix eval --impure --raw --expr "(builtins.fetchGit \"file://$repo\").outPath")

From 53523c0ab834416e38a15cf7be6f71d8f68d1c99 Mon Sep 17 00:00:00 2001
From: Martin Schwaighofer <mschwaig@users.noreply.github.com>
Date: Mon, 7 Feb 2022 20:36:39 +0100
Subject: [PATCH 038/251] git fetcher: set locale for rev-parse

---
 src/libfetchers/git.cc | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/libfetchers/git.cc b/src/libfetchers/git.cc
index ad877eacc..6571a9d02 100644
--- a/src/libfetchers/git.cc
+++ b/src/libfetchers/git.cc
@@ -220,11 +220,17 @@ struct GitInputScheme : InputScheme
         if (!input.getRef() && !input.getRev() && isLocal) {
             bool clean = false;
 
+            auto env = getEnv();
+            // Set LC_ALL to C: because we rely on the error messages from git rev-parse to determine what went wrong
+            // that way unknown errors can lead to a failure instead of continuing through the wrong code path
+            env["LC_ALL"] = "C";
+
             /* Check whether HEAD points to something that looks like a commit,
                since that is the refrence we want to use later on. */
             auto result = runProgram(RunOptions {
                 .program = "git",
                 .args = { "-C", actualUrl, "--git-dir=.git", "rev-parse", "--verify", "--no-revs", "HEAD^{commit}" },
+                .environment = env,
                 .mergeStderrToStdout = true
             });
             auto exitCode = WEXITSTATUS(result.first);

From 61295b910f2f2a6f2b0d288248c946713977ff1e Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Sun, 20 Feb 2022 23:46:11 -0600
Subject: [PATCH 039/251] Add verbosity to nix profile upgrade

Followup of https://github.com/NixOS/nix/pull/6086. This time adding a
warning if no packages are upgraded.
---
 src/nix/profile.cc | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index 55b5ff736..f0ce7eba8 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -410,12 +410,16 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
         // FIXME: code duplication
         std::vector<DerivedPath> pathsToBuild;
 
+        auto upgradedCount = 0;
+
         for (size_t i = 0; i < manifest.elements.size(); ++i) {
             auto & element(manifest.elements[i]);
             if (element.source
                 && !element.source->originalRef.input.isImmutable()
                 && matches(*store, element, i, matchers))
             {
+                upgradedCount++;
+
                 Activity act(*logger, lvlChatty, actUnknown,
                     fmt("checking '%s' for updates", element.source->attrPath));
 
@@ -448,6 +452,19 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
             }
         }
 
+        if (upgradedCount == 0) {
+            for (auto matcher: matchers) {
+                if (const size_t* index = std::get_if<size_t>(&matcher)){
+                    warn("'%d' is not a valid index in profile", *index);
+                } else if (const Path* path = std::get_if<Path>(&matcher)){
+                    warn("'%s' does not match any paths in profile", *path);
+                } else if (const RegexPattern* regex = std::get_if<RegexPattern>(&matcher)){
+                    warn("'%s' does not match any packages in profile", regex->pattern);
+                }
+            }
+            warn ("Try `nix profile list` to see the current profile.");
+        }
+
         store->buildPaths(pathsToBuild);
 
         updateProfile(manifest.build(store));

From 44b7d104b403062bf9ad57363f76464e355bc9a2 Mon Sep 17 00:00:00 2001
From: Nicolas Mattia <nicolas@nmattia.com>
Date: Mon, 21 Feb 2022 13:35:51 +0100
Subject: [PATCH 040/251] Document usage of MANPATH in nix-profile.sh

While trying to figure out how `nix-env`/`nix profile` work I had a hard
time understand how man pages were being installed.

Took me quite some time to figure this out, thought it might be useful
to others too!
---
 scripts/nix-profile.sh.in | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/scripts/nix-profile.sh.in b/scripts/nix-profile.sh.in
index 8cba1c522..45cbcbe74 100644
--- a/scripts/nix-profile.sh.in
+++ b/scripts/nix-profile.sh.in
@@ -24,6 +24,9 @@ if [ -n "$HOME" ] && [ -n "$USER" ]; then
         export NIX_SSL_CERT_FILE="$NIX_LINK/etc/ca-bundle.crt"
     fi
 
+    # Only use MANPATH if it is already set. In general `man` will just simply
+    # pick up `.nix-profile/share/man` because is it close to `.nix-profile/bin`
+    # which is in the $PATH. For more info, run `manpath -d`.
     if [ -n "${MANPATH-}" ]; then
         export MANPATH="$NIX_LINK/share/man:$MANPATH"
     fi

From ddb6740e7da2ec0cc6ad71ac7e40f8513a1103c2 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 21 Feb 2022 15:43:43 +0100
Subject: [PATCH 041/251] triggerInterrupt: Refactor to use break

---
 src/libutil/util.cc | 26 +++++++++++---------------
 1 file changed, 11 insertions(+), 15 deletions(-)

diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 03cbd7765..44463161f 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1599,28 +1599,24 @@ void triggerInterrupt()
 
     {
         InterruptCallbacks::Token i = 0;
-        std::function<void()> callback;
-        do {
+        while (true) {
+            std::function<void()> callback;
             {
                 auto interruptCallbacks(_interruptCallbacks.lock());
                 auto lb = interruptCallbacks->callbacks.lower_bound(i);
-                if (lb != interruptCallbacks->callbacks.end()) {
-                    callback = lb->second;
-                    i = lb->first + 1;
-                } else {
-                    callback = nullptr;
-                }
+                if (lb == interruptCallbacks->callbacks.end())
+                    break;
+
+                callback = lb->second;
+                i = lb->first + 1;
             }
 
-            if (callback) {
-                try {
-                    callback();
-                } catch (...) {
-                    ignoreException();
-                }
+            try {
+                callback();
+            } catch (...) {
+                ignoreException();
             }
         }
-        while (callback);
     }
 }
 

From afcdc7606cb9c1a1603a3a51b08ac411f82795db Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 21 Feb 2022 16:25:12 +0100
Subject: [PATCH 042/251] Remove std::list alias

---
 src/libexpr/get-drvs.hh   | 4 ++--
 src/libexpr/primops.cc    | 4 ++--
 src/libstore/names.hh     | 2 +-
 src/libstore/pathlocks.hh | 2 +-
 src/libutil/types.hh      | 5 ++---
 5 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/src/libexpr/get-drvs.hh b/src/libexpr/get-drvs.hh
index 29bb6a660..128354682 100644
--- a/src/libexpr/get-drvs.hh
+++ b/src/libexpr/get-drvs.hh
@@ -70,9 +70,9 @@ public:
 
 
 #if HAVE_BOEHMGC
-typedef list<DrvInfo, traceable_allocator<DrvInfo> > DrvInfos;
+typedef std::list<DrvInfo, traceable_allocator<DrvInfo> > DrvInfos;
 #else
-typedef list<DrvInfo> DrvInfos;
+typedef std::list<DrvInfo> DrvInfos;
 #endif
 
 
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index defb861e6..6f79fc49d 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -574,9 +574,9 @@ struct CompareValues
 
 
 #if HAVE_BOEHMGC
-typedef list<Value *, gc_allocator<Value *> > ValueList;
+typedef std::list<Value *, gc_allocator<Value *> > ValueList;
 #else
-typedef list<Value *> ValueList;
+typedef std::list<Value *> ValueList;
 #endif
 
 
diff --git a/src/libstore/names.hh b/src/libstore/names.hh
index 6f01fe2a1..ecbad10b3 100644
--- a/src/libstore/names.hh
+++ b/src/libstore/names.hh
@@ -25,7 +25,7 @@ private:
     std::unique_ptr<Regex> regex;
 };
 
-typedef list<DrvName> DrvNames;
+typedef std::list<DrvName> DrvNames;
 
 std::string_view nextComponent(std::string_view::const_iterator & p,
     const std::string_view::const_iterator end);
diff --git a/src/libstore/pathlocks.hh b/src/libstore/pathlocks.hh
index 919c8904c..759b9a584 100644
--- a/src/libstore/pathlocks.hh
+++ b/src/libstore/pathlocks.hh
@@ -20,7 +20,7 @@ class PathLocks
 {
 private:
     typedef std::pair<int, Path> FDPair;
-    list<FDPair> fds;
+    std::list<FDPair> fds;
     bool deletePaths;
 
 public:
diff --git a/src/libutil/types.hh b/src/libutil/types.hh
index e3aca20c9..130c04451 100644
--- a/src/libutil/types.hh
+++ b/src/libutil/types.hh
@@ -11,12 +11,11 @@
 
 namespace nix {
 
-using std::list;
 using std::set;
 using std::vector;
 using std::string;
 
-typedef list<string> Strings;
+typedef std::list<string> Strings;
 typedef set<string> StringSet;
 typedef std::map<string, string> StringMap;
 
@@ -24,7 +23,7 @@ typedef std::map<string, string> StringMap;
 
 typedef string Path;
 typedef std::string_view PathView;
-typedef list<Path> Paths;
+typedef std::list<Path> Paths;
 typedef set<Path> PathSet;
 
 typedef vector<std::pair<string, string>> Headers;

From fe9afb65bb35737a144acd612170b2e284298a2f Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 21 Feb 2022 16:28:23 +0100
Subject: [PATCH 043/251] Remove std::set alias

---
 src/libexpr/get-drvs.cc               | 2 +-
 src/libexpr/primops.cc                | 2 +-
 src/libstore/build/derivation-goal.cc | 2 +-
 src/libstore/build/goal.hh            | 4 ++--
 src/libstore/build/worker.cc          | 4 ++--
 src/libstore/build/worker.hh          | 4 ++--
 src/libstore/local-store.hh           | 2 +-
 src/libutil/types.hh                  | 5 ++---
 src/libutil/util.cc                   | 2 +-
 src/libutil/util.hh                   | 2 +-
 src/nix/repl.cc                       | 2 +-
 11 files changed, 15 insertions(+), 16 deletions(-)

diff --git a/src/libexpr/get-drvs.cc b/src/libexpr/get-drvs.cc
index 5995a857b..167fb5fa9 100644
--- a/src/libexpr/get-drvs.cc
+++ b/src/libexpr/get-drvs.cc
@@ -266,7 +266,7 @@ void DrvInfo::setMeta(const string & name, Value * v)
 
 
 /* Cache for already considered attrsets. */
-typedef set<Bindings *> Done;
+typedef std::set<Bindings *> Done;
 
 
 /* Evaluate value `v'.  If it evaluates to a set of type `derivation',
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 6f79fc49d..44f0b19bc 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -654,7 +654,7 @@ static void prim_genericClosure(EvalState & state, const Pos & pos, Value * * ar
     // `doneKeys' doesn't need to be a GC root, because its values are
     // reachable from res.
     auto cmp = CompareValues(state);
-    set<Value *, decltype(cmp)> doneKeys(cmp);
+    std::set<Value *, decltype(cmp)> doneKeys(cmp);
     while (!workSet.empty()) {
         Value * e = *(workSet.begin());
         workSet.pop_front();
diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index 151217b8b..27f8c6257 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -1091,7 +1091,7 @@ HookReply DerivationGoal::tryBuildHook()
     /* Create the log file and pipe. */
     Path logFile = openLogFile();
 
-    set<int> fds;
+    std::set<int> fds;
     fds.insert(hook->fromHook.readSide.get());
     fds.insert(hook->builderOut.readSide.get());
     worker.childStarted(shared_from_this(), fds, false, false);
diff --git a/src/libstore/build/goal.hh b/src/libstore/build/goal.hh
index 192e416d2..0db0c1938 100644
--- a/src/libstore/build/goal.hh
+++ b/src/libstore/build/goal.hh
@@ -18,8 +18,8 @@ struct CompareGoalPtrs {
 };
 
 /* Set of goals. */
-typedef set<GoalPtr, CompareGoalPtrs> Goals;
-typedef set<WeakGoalPtr, std::owner_less<WeakGoalPtr>> WeakGoals;
+typedef std::set<GoalPtr, CompareGoalPtrs> Goals;
+typedef std::set<WeakGoalPtr, std::owner_less<WeakGoalPtr>> WeakGoals;
 
 /* A map of paths to goals (and the other way around). */
 typedef std::map<StorePath, WeakGoalPtr> WeakGoalMap;
diff --git a/src/libstore/build/worker.cc b/src/libstore/build/worker.cc
index f11c5ce68..0a6108233 100644
--- a/src/libstore/build/worker.cc
+++ b/src/libstore/build/worker.cc
@@ -161,7 +161,7 @@ unsigned Worker::getNrLocalBuilds()
 }
 
 
-void Worker::childStarted(GoalPtr goal, const set<int> & fds,
+void Worker::childStarted(GoalPtr goal, const std::set<int> & fds,
     bool inBuildSlot, bool respectTimeouts)
 {
     Child child;
@@ -377,7 +377,7 @@ void Worker::waitForInput()
         GoalPtr goal = j->goal.lock();
         assert(goal);
 
-        set<int> fds2(j->fds);
+        std::set<int> fds2(j->fds);
         std::vector<unsigned char> buffer(4096);
         for (auto & k : fds2) {
             if (pollStatus.at(fdToPollStatus.at(k)).revents) {
diff --git a/src/libstore/build/worker.hh b/src/libstore/build/worker.hh
index 6a3b99c02..a1e036a96 100644
--- a/src/libstore/build/worker.hh
+++ b/src/libstore/build/worker.hh
@@ -38,7 +38,7 @@ struct Child
 {
     WeakGoalPtr goal;
     Goal * goal2; // ugly hackery
-    set<int> fds;
+    std::set<int> fds;
     bool respectTimeouts;
     bool inBuildSlot;
     steady_time_point lastOutput; /* time we last got output on stdout/stderr */
@@ -167,7 +167,7 @@ public:
 
     /* Registers a running child process.  `inBuildSlot' means that
        the process counts towards the jobs limit. */
-    void childStarted(GoalPtr goal, const set<int> & fds,
+    void childStarted(GoalPtr goal, const std::set<int> & fds,
         bool inBuildSlot, bool respectTimeouts);
 
     /* Unregisters a running child process.  `wakeSleepers' should be
diff --git a/src/libstore/local-store.hh b/src/libstore/local-store.hh
index 46aed9bcb..a9c7475ac 100644
--- a/src/libstore/local-store.hh
+++ b/src/libstore/local-store.hh
@@ -292,7 +292,7 @@ private:
 
 
 typedef std::pair<dev_t, ino_t> Inode;
-typedef set<Inode> InodesSeen;
+typedef std::set<Inode> InodesSeen;
 
 
 /* "Fix", or canonicalise, the meta-data of the files in a store path
diff --git a/src/libutil/types.hh b/src/libutil/types.hh
index 130c04451..057c9021c 100644
--- a/src/libutil/types.hh
+++ b/src/libutil/types.hh
@@ -11,12 +11,11 @@
 
 namespace nix {
 
-using std::set;
 using std::vector;
 using std::string;
 
 typedef std::list<string> Strings;
-typedef set<string> StringSet;
+typedef std::set<string> StringSet;
 typedef std::map<string, string> StringMap;
 
 /* Paths are just strings. */
@@ -24,7 +23,7 @@ typedef std::map<string, string> StringMap;
 typedef string Path;
 typedef std::string_view PathView;
 typedef std::list<Path> Paths;
-typedef set<Path> PathSet;
+typedef std::set<Path> PathSet;
 
 typedef vector<std::pair<string, string>> Headers;
 
diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 9c2e43cdd..b6041264e 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1174,7 +1174,7 @@ void runProgram2(const RunOptions & options)
 }
 
 
-void closeMostFDs(const set<int> & exceptions)
+void closeMostFDs(const std::set<int> & exceptions)
 {
 #if __linux__
     try {
diff --git a/src/libutil/util.hh b/src/libutil/util.hh
index 579a42785..319442210 100644
--- a/src/libutil/util.hh
+++ b/src/libutil/util.hh
@@ -343,7 +343,7 @@ std::vector<char *> stringsToCharPtrs(const Strings & ss);
 
 /* Close all file descriptors except those listed in the given set.
    Good practice in child processes. */
-void closeMostFDs(const set<int> & exceptions);
+void closeMostFDs(const std::set<int> & exceptions);
 
 /* Set the close-on-exec flag for the given file descriptor. */
 void closeOnExec(int fd);
diff --git a/src/nix/repl.cc b/src/nix/repl.cc
index 2c39fac91..60454471d 100644
--- a/src/nix/repl.cc
+++ b/src/nix/repl.cc
@@ -75,7 +75,7 @@ struct NixRepl
     Expr * parseString(string s);
     void evalString(string s, Value & v);
 
-    typedef set<Value *> ValuesSeen;
+    typedef std::set<Value *> ValuesSeen;
     std::ostream &  printValue(std::ostream & str, Value & v, unsigned int maxDepth);
     std::ostream &  printValue(std::ostream & str, Value & v, unsigned int maxDepth, ValuesSeen & seen);
 };

From 1ac2664472d0135503e54f0d924a802023855003 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 21 Feb 2022 16:32:34 +0100
Subject: [PATCH 044/251] Remove std::vector alias

---
 src/build-remote/build-remote.cc |  2 +-
 src/libexpr/nixexpr.hh           |  4 ++--
 src/libexpr/parser.y             | 16 ++++++++--------
 src/libexpr/primops.cc           |  4 ++--
 src/libutil/config.cc            |  4 ++--
 src/libutil/types.hh             |  3 +--
 src/libutil/util.cc              |  2 +-
 src/libutil/util.hh              |  2 +-
 src/nix-env/nix-env.cc           |  6 +++---
 9 files changed, 21 insertions(+), 22 deletions(-)

diff --git a/src/build-remote/build-remote.cc b/src/build-remote/build-remote.cc
index 9d541b45d..4d7b602d8 100644
--- a/src/build-remote/build-remote.cc
+++ b/src/build-remote/build-remote.cc
@@ -208,7 +208,7 @@ static int main_build_remote(int argc, char * * argv)
 
                         for (auto & m : machines)
                             error
-                                % concatStringsSep<vector<string>>(", ", m.systemTypes)
+                                % concatStringsSep<std::vector<string>>(", ", m.systemTypes)
                                 % m.maxJobs
                                 % concatStringsSep<StringSet>(", ", m.supportedFeatures)
                                 % concatStringsSep<StringSet>(", ", m.mandatoryFeatures);
diff --git a/src/libexpr/nixexpr.hh b/src/libexpr/nixexpr.hh
index 6f6acb074..e7f717eba 100644
--- a/src/libexpr/nixexpr.hh
+++ b/src/libexpr/nixexpr.hh
@@ -335,8 +335,8 @@ struct ExprConcatStrings : Expr
 {
     Pos pos;
     bool forceString;
-    vector<std::pair<Pos, Expr *> > * es;
-    ExprConcatStrings(const Pos & pos, bool forceString, vector<std::pair<Pos, Expr *> > * es)
+    std::vector<std::pair<Pos, Expr *> > * es;
+    ExprConcatStrings(const Pos & pos, bool forceString, std::vector<std::pair<Pos, Expr *> > * es)
         : pos(pos), forceString(forceString), es(es) { };
     COMMON_METHODS
 };
diff --git a/src/libexpr/parser.y b/src/libexpr/parser.y
index f0c80ebd5..e1d177c1f 100644
--- a/src/libexpr/parser.y
+++ b/src/libexpr/parser.y
@@ -193,7 +193,7 @@ static Formals * toFormals(ParseData & data, ParserFormals * formals,
 
 
 static Expr * stripIndentation(const Pos & pos, SymbolTable & symbols,
-    vector<std::pair<Pos, std::variant<Expr *, StringToken> > > & es)
+    std::vector<std::pair<Pos, std::variant<Expr *, StringToken> > > & es)
 {
     if (es.empty()) return new ExprString("");
 
@@ -233,7 +233,7 @@ static Expr * stripIndentation(const Pos & pos, SymbolTable & symbols,
     }
 
     /* Strip spaces from each line. */
-    vector<std::pair<Pos, Expr *> > * es2 = new vector<std::pair<Pos, Expr *> >;
+    std::vector<std::pair<Pos, Expr *> > * es2 = new std::vector<std::pair<Pos, Expr *> >;
     atStartOfLine = true;
     size_t curDropped = 0;
     size_t n = es.size();
@@ -415,7 +415,7 @@ expr_op
   | expr_op UPDATE expr_op { $$ = new ExprOpUpdate(CUR_POS, $1, $3); }
   | expr_op '?' attrpath { $$ = new ExprOpHasAttr($1, *$3); }
   | expr_op '+' expr_op
-    { $$ = new ExprConcatStrings(CUR_POS, false, new vector<std::pair<Pos, Expr *> >({{makeCurPos(@1, data), $1}, {makeCurPos(@3, data), $3}})); }
+    { $$ = new ExprConcatStrings(CUR_POS, false, new std::vector<std::pair<Pos, Expr *> >({{makeCurPos(@1, data), $1}, {makeCurPos(@3, data), $3}})); }
   | expr_op '-' expr_op { $$ = new ExprCall(CUR_POS, new ExprVar(data->symbols.create("__sub")), {$1, $3}); }
   | expr_op '*' expr_op { $$ = new ExprCall(CUR_POS, new ExprVar(data->symbols.create("__mul")), {$1, $3}); }
   | expr_op '/' expr_op { $$ = new ExprCall(CUR_POS, new ExprVar(data->symbols.create("__div")), {$1, $3}); }
@@ -503,9 +503,9 @@ string_parts_interpolated
   : string_parts_interpolated STR
   { $$ = $1; $1->emplace_back(makeCurPos(@2, data), new ExprString(string($2))); }
   | string_parts_interpolated DOLLAR_CURLY expr '}' { $$ = $1; $1->emplace_back(makeCurPos(@2, data), $3); }
-  | DOLLAR_CURLY expr '}' { $$ = new vector<std::pair<Pos, Expr *> >; $$->emplace_back(makeCurPos(@1, data), $2); }
+  | DOLLAR_CURLY expr '}' { $$ = new std::vector<std::pair<Pos, Expr *> >; $$->emplace_back(makeCurPos(@1, data), $2); }
   | STR DOLLAR_CURLY expr '}' {
-      $$ = new vector<std::pair<Pos, Expr *> >;
+      $$ = new std::vector<std::pair<Pos, Expr *> >;
       $$->emplace_back(makeCurPos(@1, data), new ExprString(string($1)));
       $$->emplace_back(makeCurPos(@2, data), $3);
     }
@@ -528,7 +528,7 @@ path_start
 ind_string_parts
   : ind_string_parts IND_STR { $$ = $1; $1->emplace_back(makeCurPos(@2, data), $2); }
   | ind_string_parts DOLLAR_CURLY expr '}' { $$ = $1; $1->emplace_back(makeCurPos(@2, data), $3); }
-  | { $$ = new vector<std::pair<Pos, std::variant<Expr *, StringToken> > >; }
+  | { $$ = new std::vector<std::pair<Pos, std::variant<Expr *, StringToken> > >; }
   ;
 
 binds
@@ -582,9 +582,9 @@ attrpath
       } else
           $$->push_back(AttrName($3));
     }
-  | attr { $$ = new vector<AttrName>; $$->push_back(AttrName(data->symbols.create($1))); }
+  | attr { $$ = new std::vector<AttrName>; $$->push_back(AttrName(data->symbols.create($1))); }
   | string_attr
-    { $$ = new vector<AttrName>;
+    { $$ = new std::vector<AttrName>;
       ExprString *str = dynamic_cast<ExprString *>($1);
       if (str) {
           $$->push_back(AttrName(data->symbols.create(str->s)));
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 44f0b19bc..daf679a5a 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -3649,12 +3649,12 @@ static void prim_replaceStrings(EvalState & state, const Pos & pos, Value * * ar
             .errPos = pos
         });
 
-    vector<string> from;
+    std::vector<string> from;
     from.reserve(args[0]->listSize());
     for (auto elem : args[0]->listItems())
         from.emplace_back(state.forceString(*elem, pos));
 
-    vector<std::pair<string, PathSet>> to;
+    std::vector<std::pair<string, PathSet>> to;
     to.reserve(args[1]->listSize());
     for (auto elem : args[1]->listItems()) {
         PathSet ctx;
diff --git a/src/libutil/config.cc b/src/libutil/config.cc
index 92ab265d3..8e05f1765 100644
--- a/src/libutil/config.cc
+++ b/src/libutil/config.cc
@@ -90,7 +90,7 @@ void AbstractConfig::applyConfig(const std::string & contents, const std::string
         if (hash != string::npos)
             line = string(line, 0, hash);
 
-        vector<string> tokens = tokenizeString<vector<string> >(line);
+        auto tokens = tokenizeString<std::vector<string>>(line);
         if (tokens.empty()) continue;
 
         if (tokens.size() < 2)
@@ -122,7 +122,7 @@ void AbstractConfig::applyConfig(const std::string & contents, const std::string
 
         string name = tokens[0];
 
-        vector<string>::iterator i = tokens.begin();
+        auto i = tokens.begin();
         advance(i, 2);
 
         set(name, concatStringsSep(" ", Strings(i, tokens.end()))); // FIXME: slow
diff --git a/src/libutil/types.hh b/src/libutil/types.hh
index 057c9021c..a26c9a966 100644
--- a/src/libutil/types.hh
+++ b/src/libutil/types.hh
@@ -11,7 +11,6 @@
 
 namespace nix {
 
-using std::vector;
 using std::string;
 
 typedef std::list<string> Strings;
@@ -25,7 +24,7 @@ typedef std::string_view PathView;
 typedef std::list<Path> Paths;
 typedef std::set<Path> PathSet;
 
-typedef vector<std::pair<string, string>> Headers;
+typedef std::vector<std::pair<string, string>> Headers;
 
 /* Helper class to run code at startup. */
 template<typename T>
diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index b6041264e..b172e0554 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1250,7 +1250,7 @@ template<class C> C tokenizeString(std::string_view s, std::string_view separato
 
 template Strings tokenizeString(std::string_view s, std::string_view separators);
 template StringSet tokenizeString(std::string_view s, std::string_view separators);
-template vector<string> tokenizeString(std::string_view s, std::string_view separators);
+template std::vector<string> tokenizeString(std::string_view s, std::string_view separators);
 
 
 string chomp(std::string_view s)
diff --git a/src/libutil/util.hh b/src/libutil/util.hh
index 319442210..a949e6424 100644
--- a/src/libutil/util.hh
+++ b/src/libutil/util.hh
@@ -99,7 +99,7 @@ struct DirEntry
         : name(name), ino(ino), type(type) { }
 };
 
-typedef vector<DirEntry> DirEntries;
+typedef std::vector<DirEntry> DirEntries;
 
 DirEntries readDirectory(const Path & path);
 
diff --git a/src/nix-env/nix-env.cc b/src/nix-env/nix-env.cc
index d2636abf7..52d07e3df 100644
--- a/src/nix-env/nix-env.cc
+++ b/src/nix-env/nix-env.cc
@@ -840,7 +840,7 @@ void printTable(Table & table)
 {
     auto nrColumns = table.size() > 0 ? table.front().size() : 0;
 
-    vector<size_t> widths;
+    std::vector<size_t> widths;
     widths.resize(nrColumns);
 
     for (auto & i : table) {
@@ -907,7 +907,7 @@ static VersionDiff compareVersionAgainstSet(
 }
 
 
-static void queryJSON(Globals & globals, vector<DrvInfo> & elems, bool printOutPath, bool printMeta)
+static void queryJSON(Globals & globals, std::vector<DrvInfo> & elems, bool printOutPath, bool printMeta)
 {
     JSONObject topObj(cout, true);
     for (auto & i : elems) {
@@ -1020,7 +1020,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
 
     /* Sort them by name. */
     /* !!! */
-    vector<DrvInfo> elems;
+    std::vector<DrvInfo> elems;
     for (auto & i : elems_) elems.push_back(i);
     sort(elems.begin(), elems.end(), cmpElemByName);
 

From 36c7b12f3354606a50808197f6695c185fd02893 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 21 Feb 2022 16:37:25 +0100
Subject: [PATCH 045/251] Remove std::string alias

---
 src/libexpr/symbol-table.hh |  8 ++++----
 src/libexpr/value.hh        | 10 +++++-----
 src/libstore/machines.hh    | 14 +++++++-------
 src/libstore/names.hh       |  6 +++---
 src/libutil/types.hh        | 13 +++++--------
 5 files changed, 24 insertions(+), 27 deletions(-)

diff --git a/src/libexpr/symbol-table.hh b/src/libexpr/symbol-table.hh
index a090ebae5..48d20c29d 100644
--- a/src/libexpr/symbol-table.hh
+++ b/src/libexpr/symbol-table.hh
@@ -17,8 +17,8 @@ namespace nix {
 class Symbol
 {
 private:
-    const string * s; // pointer into SymbolTable
-    Symbol(const string * s) : s(s) { };
+    const std::string * s; // pointer into SymbolTable
+    Symbol(const std::string * s) : s(s) { };
     friend class SymbolTable;
 
 public:
@@ -72,7 +72,7 @@ class SymbolTable
 {
 private:
     std::unordered_map<std::string_view, Symbol> symbols;
-    std::list<string> store;
+    std::list<std::string> store;
 
 public:
     Symbol create(std::string_view s)
@@ -84,7 +84,7 @@ public:
         auto it = symbols.find(s);
         if (it != symbols.end()) return it->second;
 
-        const string & rawSym = store.emplace_back(s);
+        auto & rawSym = store.emplace_back(s);
         return symbols.emplace(rawSym, Symbol(&rawSym)).first->second;
     }
 
diff --git a/src/libexpr/value.hh b/src/libexpr/value.hh
index bef5cd6bd..3fdff71a5 100644
--- a/src/libexpr/value.hh
+++ b/src/libexpr/value.hh
@@ -77,20 +77,20 @@ class ExternalValueBase
 
     public:
     /* Return a simple string describing the type */
-    virtual string showType() const = 0;
+    virtual std::string showType() const = 0;
 
     /* Return a string to be used in builtins.typeOf */
-    virtual string typeOf() const = 0;
+    virtual std::string typeOf() const = 0;
 
     /* Coerce the value to a string. Defaults to uncoercable, i.e. throws an
-     * error
+     * error.
      */
-    virtual string coerceToString(const Pos & pos, PathSet & context, bool copyMore, bool copyToStore) const;
+    virtual std::string coerceToString(const Pos & pos, PathSet & context, bool copyMore, bool copyToStore) const;
 
     /* Compare to another value of the same type. Defaults to uncomparable,
      * i.e. always false.
      */
-    virtual bool operator==(const ExternalValueBase & b) const;
+    virtual bool operator ==(const ExternalValueBase & b) const;
 
     /* Print the value as JSON. Defaults to unconvertable, i.e. throws an error */
     virtual void printValueAsJSON(EvalState & state, bool strict,
diff --git a/src/libstore/machines.hh b/src/libstore/machines.hh
index 341d9bd97..834626de9 100644
--- a/src/libstore/machines.hh
+++ b/src/libstore/machines.hh
@@ -8,19 +8,19 @@ class Store;
 
 struct Machine {
 
-    const string storeUri;
-    const std::vector<string> systemTypes;
-    const string sshKey;
+    const std::string storeUri;
+    const std::vector<std::string> systemTypes;
+    const std::string sshKey;
     const unsigned int maxJobs;
     const unsigned int speedFactor;
-    const std::set<string> supportedFeatures;
-    const std::set<string> mandatoryFeatures;
+    const std::set<std::string> supportedFeatures;
+    const std::set<std::string> mandatoryFeatures;
     const std::string sshPublicHostKey;
     bool enabled = true;
 
-    bool allSupported(const std::set<string> & features) const;
+    bool allSupported(const std::set<std::string> & features) const;
 
-    bool mandatoryMet(const std::set<string> & features) const;
+    bool mandatoryMet(const std::set<std::string> & features) const;
 
     Machine(decltype(storeUri) storeUri,
         decltype(systemTypes) systemTypes,
diff --git a/src/libstore/names.hh b/src/libstore/names.hh
index ecbad10b3..3977fc6cc 100644
--- a/src/libstore/names.hh
+++ b/src/libstore/names.hh
@@ -10,9 +10,9 @@ struct Regex;
 
 struct DrvName
 {
-    string fullName;
-    string name;
-    string version;
+    std::string fullName;
+    std::string name;
+    std::string version;
     unsigned int hits;
 
     DrvName();
diff --git a/src/libutil/types.hh b/src/libutil/types.hh
index a26c9a966..bea2673ca 100644
--- a/src/libutil/types.hh
+++ b/src/libutil/types.hh
@@ -11,20 +11,17 @@
 
 namespace nix {
 
-using std::string;
-
-typedef std::list<string> Strings;
-typedef std::set<string> StringSet;
-typedef std::map<string, string> StringMap;
+typedef std::list<std::string> Strings;
+typedef std::set<std::string> StringSet;
+typedef std::map<std::string, std::string> StringMap;
 
 /* Paths are just strings. */
-
-typedef string Path;
+typedef std::string Path;
 typedef std::string_view PathView;
 typedef std::list<Path> Paths;
 typedef std::set<Path> PathSet;
 
-typedef std::vector<std::pair<string, string>> Headers;
+typedef std::vector<std::pair<std::string, std::string>> Headers;
 
 /* Helper class to run code at startup. */
 template<typename T>

From 3cd958849b820ba6ec80965afa6268f59c9bb650 Mon Sep 17 00:00:00 2001
From: Matthew Bauer <mjbauer95@gmail.com>
Date: Mon, 21 Feb 2022 10:04:04 -0600
Subject: [PATCH 046/251] Apply suggestions from code review

Co-authored-by: Eelco Dolstra <edolstra@gmail.com>
---
 src/nix/profile.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index f0ce7eba8..508cbd336 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -453,7 +453,7 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
         }
 
         if (upgradedCount == 0) {
-            for (auto matcher: matchers) {
+            for (auto & matcher : matchers) {
                 if (const size_t* index = std::get_if<size_t>(&matcher)){
                     warn("'%d' is not a valid index in profile", *index);
                 } else if (const Path* path = std::get_if<Path>(&matcher)){
@@ -462,7 +462,7 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
                     warn("'%s' does not match any packages in profile", regex->pattern);
                 }
             }
-            warn ("Try `nix profile list` to see the current profile.");
+            warn ("Use 'nix profile list' to see the current profile.");
         }
 
         store->buildPaths(pathsToBuild);

From 8ffb09a08a375e19208bbe65ba532ce1e462b74e Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 21 Feb 2022 17:14:22 +0100
Subject: [PATCH 047/251] Fix macOS build

---
 .../resolve-system-dependencies.cc               | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/resolve-system-dependencies/resolve-system-dependencies.cc b/src/resolve-system-dependencies/resolve-system-dependencies.cc
index 98c969437..4dd691981 100644
--- a/src/resolve-system-dependencies/resolve-system-dependencies.cc
+++ b/src/resolve-system-dependencies/resolve-system-dependencies.cc
@@ -23,9 +23,9 @@ Path resolveCacheFile(Path lib)
     return cacheDir + "/" + lib;
 }
 
-std::set<string> readCacheFile(const Path & file)
+std::set<std::string> readCacheFile(const Path & file)
 {
-    return tokenizeString<set<string>>(readFile(file), "\n");
+    return tokenizeString<std::set<std::string>>(readFile(file), "\n");
 }
 
 std::set<std::string> runResolver(const Path & filename)
@@ -81,7 +81,7 @@ std::set<std::string> runResolver(const Path & filename)
     bool should_swap = magic == MH_CIGAM_64;
     ptrdiff_t cmd_offset = mach64_offset + sizeof(mach_header_64);
 
-    std::set<string> libs;
+    std::set<std::string> libs;
     for (uint32_t i = 0; i < DO_SWAP(should_swap, m_header->ncmds); i++) {
         load_command * cmd = (load_command *) (obj + cmd_offset);
         switch(DO_SWAP(should_swap, cmd->cmd)) {
@@ -110,9 +110,9 @@ Path resolveSymlink(const Path & path)
         : concatStrings(dirOf(path), "/", target);
 }
 
-std::set<string> resolveTree(const Path & path, PathSet & deps)
+std::set<std::string> resolveTree(const Path & path, PathSet & deps)
 {
-    std::set<string> results;
+    std::set<std::string> results;
     if (!deps.insert(path).second) return {};
     for (auto & lib : runResolver(path)) {
         results.insert(lib);
@@ -123,7 +123,7 @@ std::set<string> resolveTree(const Path & path, PathSet & deps)
     return results;
 }
 
-std::set<string> getPath(const Path & path)
+std::set<std::string> getPath(const Path & path)
 {
     if (hasPrefix(path, "/dev")) return {};
 
@@ -131,7 +131,7 @@ std::set<string> getPath(const Path & path)
     if (pathExists(cacheFile))
         return readCacheFile(cacheFile);
 
-    std::set<string> deps, paths;
+    std::set<std::string> deps, paths;
     paths.insert(path);
 
     Path nextPath(path);
@@ -180,7 +180,7 @@ int main(int argc, char ** argv)
             impurePaths.insert("/usr/lib/libSystem.dylib");
         }
 
-        std::set<string> allPaths;
+        std::set<std::string> allPaths;
 
         for (auto & path : impurePaths)
             for (auto & p : getPath(path))

From 162fbe31ffe4c2b2d7648e5df2d5a0c9b4a44996 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 11 Feb 2022 18:11:08 +0100
Subject: [PATCH 048/251] Replace defaultBla.$system with bla.$system.default

This also simplifies some InstallableFlake logic and fixes 'nix
bundle' parsing its installable twice.

Fixes #5532.
---
 src/libcmd/installables.cc    |  5 ++++-
 src/nix/bundle.cc             | 11 ++++++-----
 src/nix/develop.cc            |  9 ++++++++-
 src/nix/flake.cc              |  2 +-
 src/nix/run.cc                |  5 ++++-
 tests/flake-bundler.sh        | 26 +++++++++++++------------
 tests/flake-local-settings.sh |  2 +-
 tests/flake-searching.sh      |  6 ++++--
 tests/flakes.sh               | 36 ++++++++++++++++++-----------------
 9 files changed, 61 insertions(+), 41 deletions(-)

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index 644954977..c07e39628 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -158,7 +158,10 @@ SourceExprCommand::SourceExprCommand()
 
 Strings SourceExprCommand::getDefaultFlakeAttrPaths()
 {
-    return {"defaultPackage." + settings.thisSystem.get()};
+    return {
+        "packages." + settings.thisSystem.get() + ".default",
+        "defaultPackage." + settings.thisSystem.get()
+    };
 }
 
 Strings SourceExprCommand::getDefaultFlakeAttrPathPrefixes()
diff --git a/src/nix/bundle.cc b/src/nix/bundle.cc
index c13018328..6b891a6ee 100644
--- a/src/nix/bundle.cc
+++ b/src/nix/bundle.cc
@@ -49,9 +49,11 @@ struct CmdBundle : InstallableCommand
 
     Category category() override { return catSecondary; }
 
+    // FIXME: cut&paste from CmdRun.
     Strings getDefaultFlakeAttrPaths() override
     {
         Strings res{
+            "apps." + settings.thisSystem.get() + ".default",
             "defaultApp." + settings.thisSystem.get()
         };
         for (auto & s : SourceExprCommand::getDefaultFlakeAttrPaths())
@@ -61,10 +63,7 @@ struct CmdBundle : InstallableCommand
 
     Strings getDefaultFlakeAttrPathPrefixes() override
     {
-        Strings res{
-            "apps." + settings.thisSystem.get() + "."
-
-        };
+        Strings res{"apps." + settings.thisSystem.get() + "."};
         for (auto & s : SourceExprCommand::getDefaultFlakeAttrPathPrefixes())
             res.push_back(s);
         return res;
@@ -80,7 +79,9 @@ struct CmdBundle : InstallableCommand
         const flake::LockFlags lockFlags{ .writeLockFile = false };
         InstallableFlake bundler{this,
             evalState, std::move(bundlerFlakeRef), bundlerName,
-            {"defaultBundler." + settings.thisSystem.get()},
+            {"bundlers." + settings.thisSystem.get() + ".default",
+             "defaultBundler." + settings.thisSystem.get()
+            },
             {"bundlers." + settings.thisSystem.get() + "."},
             lockFlags
         };
diff --git a/src/nix/develop.cc b/src/nix/develop.cc
index f88f5909c..92e31599a 100644
--- a/src/nix/develop.cc
+++ b/src/nix/develop.cc
@@ -325,8 +325,15 @@ struct Common : InstallableCommand, MixProfile
 
     Strings getDefaultFlakeAttrPaths() override
     {
-        return {"devShell." + settings.thisSystem.get(), "defaultPackage." + settings.thisSystem.get()};
+        Strings paths{
+            "devShells." + settings.thisSystem.get() + ".default",
+            "devShell." + settings.thisSystem.get(),
+        };
+        for (auto & p : SourceExprCommand::getDefaultFlakeAttrPaths())
+            paths.push_back(p);
+        return paths;
     }
+
     Strings getDefaultFlakeAttrPathPrefixes() override
     {
         auto res = SourceExprCommand::getDefaultFlakeAttrPathPrefixes();
diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index cd85bcea6..303edb9fe 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -651,7 +651,7 @@ struct CmdFlakeCheck : FlakeCommand
 };
 
 static Strings defaultTemplateAttrPathsPrefixes{"templates."};
-static Strings defaultTemplateAttrPaths = {"defaultTemplate"};
+static Strings defaultTemplateAttrPaths = {"templates.default", "defaultTemplate"};
 
 struct CmdFlakeInitCommon : virtual Args, EvalCommand
 {
diff --git a/src/nix/run.cc b/src/nix/run.cc
index bae64ed39..a67c23bcb 100644
--- a/src/nix/run.cc
+++ b/src/nix/run.cc
@@ -158,7 +158,10 @@ struct CmdRun : InstallableCommand
 
     Strings getDefaultFlakeAttrPaths() override
     {
-        Strings res{"defaultApp." + settings.thisSystem.get()};
+        Strings res{
+            "apps." + settings.thisSystem.get() + ".default",
+            "defaultApp." + settings.thisSystem.get(),
+        };
         for (auto & s : SourceExprCommand::getDefaultFlakeAttrPaths())
             res.push_back(s);
         return res;
diff --git a/tests/flake-bundler.sh b/tests/flake-bundler.sh
index 699920f60..9496b8f92 100644
--- a/tests/flake-bundler.sh
+++ b/tests/flake-bundler.sh
@@ -10,26 +10,28 @@ cd $TEST_HOME
 cat <<EOF > flake.nix
 {
     outputs = {self}: {
-       bundlers.$system.simple = drv:
+      bundlers.$system = rec {
+        simple = drv:
           if drv?type && drv.type == "derivation"
           then drv
-          else self.defaultPackage.$system;
-       defaultBundler.$system = self.bundlers.$system.simple;
-       defaultPackage.$system = import ./simple.nix;
-       defaultApp.$system = {
-         type = "app";
-         program = "\${import ./simple.nix}/hello";
-       };
+          else self.packages.$system.default;
+        default = simple;
+      };
+      packages.$system.default = import ./simple.nix;
+      apps.$system.default = {
+        type = "app";
+        program = "\${import ./simple.nix}/hello";
+      };
     };
 }
 EOF
 nix build .#
 nix bundle --bundler .# .#
-nix bundle --bundler .#defaultBundler.$system  .#defaultPackage.$system
-nix bundle --bundler .#bundlers.$system.simple .#defaultPackage.$system
+nix bundle --bundler .#bundlers.$system.default .#packages.$system.default
+nix bundle --bundler .#bundlers.$system.simple  .#packages.$system.default
 
-nix bundle --bundler .#defaultBundler.$system  .#defaultApp.$system
-nix bundle --bundler .#bundlers.$system.simple .#defaultApp.$system
+nix bundle --bundler .#bundlers.$system.default .#apps.$system.default
+nix bundle --bundler .#bundlers.$system.simple  .#apps.$system.default
 
 clearStore
 
diff --git a/tests/flake-local-settings.sh b/tests/flake-local-settings.sh
index 7765fe379..e92c16f87 100644
--- a/tests/flake-local-settings.sh
+++ b/tests/flake-local-settings.sh
@@ -21,7 +21,7 @@ cat <<EOF > flake.nix
     nixConfig.allow-dirty = false; # See #5621
 
     outputs = a: {
-       defaultPackage.$system = import ./simple.nix;
+       packages.$system.default = import ./simple.nix;
     };
 }
 EOF
diff --git a/tests/flake-searching.sh b/tests/flake-searching.sh
index bc55f2bdc..db241f6d2 100644
--- a/tests/flake-searching.sh
+++ b/tests/flake-searching.sh
@@ -15,8 +15,10 @@ cat <<EOF > flake.nix
 {
     inputs.foo.url = "$PWD/foo";
     outputs = a: {
-       defaultPackage.$system = import ./simple.nix;
-       packages.$system.test = import ./simple.nix;
+       packages.$system = rec {
+         test = import ./simple.nix;
+         default = test;
+       };
     };
 }
 EOF
diff --git a/tests/flakes.sh b/tests/flakes.sh
index db178967f..ea629ae70 100644
--- a/tests/flakes.sh
+++ b/tests/flakes.sh
@@ -41,8 +41,10 @@ cat > $flake1Dir/flake.nix <<EOF
   description = "Bla bla";
 
   outputs = inputs: rec {
-    packages.$system.foo = import ./simple.nix;
-    defaultPackage.$system = packages.$system.foo;
+    packages.$system = rec {
+      foo = import ./simple.nix;
+      default = foo;
+    };
 
     # To test "nix flake init".
     legacyPackages.x86_64-linux.hello = import ./simple.nix;
@@ -128,7 +130,7 @@ hash2=$(nix flake metadata flake1 --json --refresh | jq -r .revision)
 nix build -o $TEST_ROOT/result flake1#foo
 [[ -e $TEST_ROOT/result/hello ]]
 
-# Test defaultPackage.
+# Test packages.default.
 nix build -o $TEST_ROOT/result flake1
 [[ -e $TEST_ROOT/result/hello ]]
 
@@ -140,11 +142,11 @@ nix build -o $flake1Dir/result git+file://$flake1Dir
 nix path-info $flake1Dir/result
 
 # 'getFlake' on a mutable flakeref should fail in pure mode, but succeed in impure mode.
-(! nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"$flake1Dir\").defaultPackage.$system")
-nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"$flake1Dir\").defaultPackage.$system" --impure
+(! nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"$flake1Dir\").packages.$system.default")
+nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"$flake1Dir\").packages.$system.default" --impure
 
 # 'getFlake' on an immutable flakeref should succeed even in pure mode.
-nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"git+file://$flake1Dir?rev=$hash2\").defaultPackage.$system"
+nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"git+file://$flake1Dir?rev=$hash2\").packages.$system.default"
 
 # Building a flake with an unlocked dependency should fail in pure mode.
 (! nix build -o $TEST_ROOT/result flake2#bar --no-registries)
@@ -370,13 +372,13 @@ cat > $templatesDir/flake.nix <<EOF
   description = "Some templates";
 
   outputs = { self }: {
-    templates = {
+    templates = rec {
       trivial = {
         path = ./trivial;
         description = "A trivial flake";
       };
+      default = trivial;
     };
-    defaultTemplate = self.templates.trivial;
   };
 }
 EOF
@@ -388,8 +390,10 @@ cat > $templatesDir/trivial/flake.nix <<EOF
   description = "A flake for building Hello World";
 
   outputs = { self, nixpkgs }: {
-    packages.x86_64-linux.hello = nixpkgs.legacyPackages.x86_64-linux.hello;
-    defaultPackage.x86_64-linux = self.packages.x86_64-linux.hello;
+    packages.x86_64-linux = rec {
+      hello = nixpkgs.legacyPackages.x86_64-linux.hello;
+      default = hello;
+    };
   };
 }
 EOF
@@ -496,17 +500,15 @@ EOF
 cat > $flake3Dir/flake.nix <<EOF
 {
   outputs = { flake1, self }: {
-    defaultPackage = {
-        system-1 = "foo";
-        system-2 = "bar";
-    };
+    packages.system-1.default = "foo";
+    packages.system-2.default = "bar";
   };
 }
 EOF
 
 checkRes=$(nix flake check --keep-going $flake3Dir 2>&1 && fail "nix flake check should have failed" || true)
-echo "$checkRes" | grep -q "defaultPackage.system-1"
-echo "$checkRes" | grep -q "defaultPackage.system-2"
+echo "$checkRes" | grep -q "packages.system-1.default"
+echo "$checkRes" | grep -q "packages.system-2.default"
 
 # Test 'follows' inputs.
 cat > $flake3Dir/flake.nix <<EOF
@@ -591,7 +593,7 @@ mkdir $flake5Dir
 cat > $flake5Dir/flake.nix <<EOF
 {
   outputs = { self, flake1 }: {
-    defaultPackage.$system = flake1.defaultPackage.$system;
+    packages.$system.default = flake1.packages.$system.default;
     expr = assert builtins.pathExists ./flake.lock; 123;
   };
 }

From d4428d00ae05cd21c256f9490c7f089ec04fd962 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 22 Feb 2022 14:19:39 +0100
Subject: [PATCH 049/251] nix flake check: Warn about deprecated flake outputs

---
 src/nix/flake.cc | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 303edb9fe..14a235501 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -501,6 +501,17 @@ struct CmdFlakeCheck : FlakeCommand
 
                         state->forceValue(vOutput, pos);
 
+                        std::string_view replacement =
+                            name == "defaultPackage" ? "packages.<system>.default" :
+                            name == "defaultApps" ? "apps.<system>.default" :
+                            name == "defaultTemplate" ? "templates.default" :
+                            name == "defaultBundler" ? "bundlers.<system>.default" :
+                            name == "overlay" ? "overlays.default" :
+                            name == "devShell" ? "devShells.<system>.default" :
+                            "";
+                        if (replacement != "")
+                            warn("flake output attribute '%s' is deprecated; use '%s' instead", name, replacement);
+
                         if (name == "checks") {
                             state->forceAttrs(vOutput, pos);
                             for (auto & attr : *vOutput.attrs) {

From 38eea2c503a70e32dd6110937d49705976d5fc7a Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 22 Feb 2022 14:23:39 +0100
Subject: [PATCH 050/251] Update release notes

---
 doc/manual/src/release-notes/rl-next.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/doc/manual/src/release-notes/rl-next.md b/doc/manual/src/release-notes/rl-next.md
index 80eed9397..7dd8387d8 100644
--- a/doc/manual/src/release-notes/rl-next.md
+++ b/doc/manual/src/release-notes/rl-next.md
@@ -1,5 +1,18 @@
 # Release X.Y (202?-??-??)
 
+* A number of "default" flake output attributes have been
+  renamed. These are:
+
+  * `defaultPackage.<system>` → `packages.<system>.default`
+  * `defaultApps.<system>` → `apps.<system>.default`
+  * `defaultTemplate` → `templates.default`
+  * `defaultBundler.<system>` → `bundlers.<system>.default`
+  * `overlay` → `overlays.default`
+  * `devShell.<system>` → `devShells.<system>.default`
+
+  The old flake output attributes still work, but `nix flake check`
+  will warn about them.
+
 * `nix bundle` breaking API change now supports bundlers of the form
   `bundler.<system>.<name>= derivation: another-derivation;`. This supports
   additional functionality to inspect evaluation information during bundling. A

From 1a6548ca757f81594f5b54d8dada4c5ba65821de Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 22 Feb 2022 14:32:56 +0100
Subject: [PATCH 051/251] Update docs

---
 src/nix/bundle.md       | 14 ++++++++------
 src/nix/develop.md      |  4 ++--
 src/nix/flake-init.md   |  8 ++++----
 src/nix/flake-show.md   | 11 +++++++----
 src/nix/flake.md        |  2 +-
 src/nix/nix.md          |  6 ++----
 src/nix/profile-list.md |  2 +-
 src/nix/profile.md      |  2 +-
 src/nix/run.md          |  6 +++---
 9 files changed, 29 insertions(+), 26 deletions(-)

diff --git a/src/nix/bundle.md b/src/nix/bundle.md
index a5186a996..2bb70711f 100644
--- a/src/nix/bundle.md
+++ b/src/nix/bundle.md
@@ -42,24 +42,26 @@ homepage](https://github.com/NixOS/bundlers) for more details.
 If no flake output attribute is given, `nix bundle` tries the following
 flake output attributes:
 
-* `defaultBundler.<system>`
+* `bundlers.<system>.default`
 
 If an attribute *name* is given, `nix run` tries the following flake
 output attributes:
 
-* `bundler.<system>.<name>`
+* `bundlers.<system>.<name>`
 
 # Bundlers
 
 A bundler is specified by a flake output attribute named
-`bundlers.<system>.<name>` or `defaultBundler.<system>`. It looks like this:
+`bundlers.<system>.<name>`. It looks like this:
 
 ```nix
-bundlers.x86_64-linux.identity = drv: drv;
+bundlers.x86_64-linux = rec {
+  identity = drv: drv;
 
-bundlers.x86_64-linux.blender_2_79 = drv: self.packages.x86_64-linux.blender_2_79;
+  blender_2_79 = drv: self.packages.x86_64-linux.blender_2_79;
 
-defaultBundler.x86_64-linux = drv: drv;
+  default = identity;
+};
 ```
 
 A bundler must be a function that accepts an arbitrary value (typically a
diff --git a/src/nix/develop.md b/src/nix/develop.md
index 3e7e339d5..8bcff66c9 100644
--- a/src/nix/develop.md
+++ b/src/nix/develop.md
@@ -88,9 +88,9 @@ the flake's `nixConfig` attribute.
 If no flake output attribute is given, `nix develop` tries the following
 flake output attributes:
 
-* `devShell.<system>`
+* `devShells.<system>.default`
 
-* `defaultPackage.<system>`
+* `packages.<system>.default`
 
 If a flake output *name* is given, `nix develop` tries the following flake
 output attributes:
diff --git a/src/nix/flake-init.md b/src/nix/flake-init.md
index c13b22248..fc1f4f805 100644
--- a/src/nix/flake-init.md
+++ b/src/nix/flake-init.md
@@ -24,13 +24,13 @@ R""(
 
 This command creates a flake in the current directory by copying the
 files of a template. It will not overwrite existing files. The default
-template is `templates#defaultTemplate`, but this can be overridden
+template is `templates#templates.default`, but this can be overridden
 using `-t`.
 
 # Template definitions
 
-A flake can declare templates through its `templates` and
-`defaultTemplate` output attributes. A template has two attributes:
+A flake can declare templates through its `templates` output
+attribute. A template has two attributes:
 
 * `description`: A one-line description of the template, in CommonMark
   syntax.
@@ -61,7 +61,7 @@ outputs = { self }: {
     '';
   };
 
-  templates.defaultTemplate = self.templates.rust;
+  templates.default = self.templates.rust;
 }
 ```
 
diff --git a/src/nix/flake-show.md b/src/nix/flake-show.md
index e484cf47e..f3b74285d 100644
--- a/src/nix/flake-show.md
+++ b/src/nix/flake-show.md
@@ -13,10 +13,13 @@ R""(
   │   │   └───build: derivation 'patchelf-0.12.20201207.f34751b'
   │   └───x86_64-linux
   │       └───build: derivation 'patchelf-0.12.20201207.f34751b'
-  ├───defaultPackage
-  │   ├───aarch64-linux: package 'patchelf-0.12.20201207.f34751b'
-  │   ├───i686-linux: package 'patchelf-0.12.20201207.f34751b'
-  │   └───x86_64-linux: package 'patchelf-0.12.20201207.f34751b'
+  ├───packages
+  │   ├───aarch64-linux
+  │   │   └───default: package 'patchelf-0.12.20201207.f34751b'
+  │   ├───i686-linux
+  │   │   └───default: package 'patchelf-0.12.20201207.f34751b'
+  │   └───x86_64-linux
+  │       └───default: package 'patchelf-0.12.20201207.f34751b'
   ├───hydraJobs
   │   ├───build
   │   │   ├───aarch64-linux: derivation 'patchelf-0.12.20201207.f34751b'
diff --git a/src/nix/flake.md b/src/nix/flake.md
index accddd436..48c12d30f 100644
--- a/src/nix/flake.md
+++ b/src/nix/flake.md
@@ -236,7 +236,7 @@ derivation):
 
   outputs = { self, nixpkgs }: {
 
-    defaultPackage.x86_64-linux =
+    packages.x86_64-linux.default =
       # Notice the reference to nixpkgs here.
       with import nixpkgs { system = "x86_64-linux"; };
       stdenv.mkDerivation {
diff --git a/src/nix/nix.md b/src/nix/nix.md
index 1dc59362d..0dacadee6 100644
--- a/src/nix/nix.md
+++ b/src/nix/nix.md
@@ -97,11 +97,9 @@ the Nix store. Here are the recognised types of installables:
     For example, if `/foo/bar/flake.nix` exists, then `/foo/bar/baz/` will resolve to
    `path:/foo/bar`
 
-
-
   If *attrpath* is omitted, Nix tries some default values; for most
-  subcommands, the default is `defaultPackage.`*system*
-  (e.g. `defaultPackage.x86_64-linux`), but some subcommands have
+  subcommands, the default is `packages.`*system*`.default`
+  (e.g. `packages.x86_64-linux.default`), but some subcommands have
   other defaults. If *attrpath* *is* specified, *attrpath* is
   interpreted as relative to one or more prefixes; for most
   subcommands, these are `packages.`*system*,
diff --git a/src/nix/profile-list.md b/src/nix/profile-list.md
index 5c29c0b02..bdab9a208 100644
--- a/src/nix/profile-list.md
+++ b/src/nix/profile-list.md
@@ -8,7 +8,7 @@ R""(
   # nix profile list
   0 flake:nixpkgs#legacyPackages.x86_64-linux.spotify github:NixOS/nixpkgs/c23db78bbd474c4d0c5c3c551877523b4a50db06#legacyPackages.x86_64-linux.spotify /nix/store/akpdsid105phbbvknjsdh7hl4v3fhjkr-spotify-1.1.46.916.g416cacf1
   1 flake:nixpkgs#legacyPackages.x86_64-linux.zoom-us github:NixOS/nixpkgs/c23db78bbd474c4d0c5c3c551877523b4a50db06#legacyPackages.x86_64-linux.zoom-us /nix/store/89pmjmbih5qpi7accgacd17ybpgp4xfm-zoom-us-5.4.53350.1027
-  2 flake:blender-bin#defaultPackage.x86_64-linux github:edolstra/nix-warez/d09d7eea893dcb162e89bc67f6dc1ced14abfc27?dir=blender#defaultPackage.x86_64-linux /nix/store/zfgralhqjnam662kqsgq6isjw8lhrflz-blender-bin-2.91.0
+  2 flake:blender-bin#packages.x86_64-linux.default github:edolstra/nix-warez/d09d7eea893dcb162e89bc67f6dc1ced14abfc27?dir=blender#packages.x86_64-linux.default /nix/store/zfgralhqjnam662kqsgq6isjw8lhrflz-blender-bin-2.91.0
   ```
 
 # Description
diff --git a/src/nix/profile.md b/src/nix/profile.md
index d3ddcd3d1..0a4ff2fa9 100644
--- a/src/nix/profile.md
+++ b/src/nix/profile.md
@@ -96,7 +96,7 @@ has the following fields:
   user specified, but the one resulting from applying the default
   attribute paths and prefixes; for instance, `hello` might resolve to
   `packages.x86_64-linux.hello` and the empty string to
-  `defaultPackage.x86_64-linux`.
+  `packages.x86_64-linux.default`.
 
 * `storePath`: The paths in the Nix store containing the package.
 
diff --git a/src/nix/run.md b/src/nix/run.md
index cd3b978c0..a0f362076 100644
--- a/src/nix/run.md
+++ b/src/nix/run.md
@@ -58,9 +58,9 @@ For instance, if `name` is set to `hello-1.10`, `nix run` will run
 If no flake output attribute is given, `nix run` tries the following
 flake output attributes:
 
-* `defaultApp.<system>`
+* `apps.<system>.default`
 
-* `defaultPackage.<system>`
+* `packages.<system>.default`
 
 If an attribute *name* is given, `nix run` tries the following flake
 output attributes:
@@ -74,7 +74,7 @@ output attributes:
 # Apps
 
 An app is specified by a flake output attribute named
-`apps.<system>.<name>` or `defaultApp.<system>`. It looks like this:
+`apps.<system>.<name>`. It looks like this:
 
 ```nix
 apps.x86_64-linux.blender_2_79 = {

From 400d70a3a9ab494b2eebf5522789f89d16d000b2 Mon Sep 17 00:00:00 2001
From: toonn <toonn@toonn.io>
Date: Tue, 22 Feb 2022 16:28:24 +0100
Subject: [PATCH 052/251] doc: Add detailed uninstall section for macOS

The multi-user installation on macOS, which is now the only option, has
gotten complicated enough that it discourages some users from checking
Nix out for fear of being left with a "dirty" system. Detailed
uninstallation instructions should make this less of an issue.
---
 .../src/installation/installing-binary.md     | 84 +++++++++++++++++--
 1 file changed, 79 insertions(+), 5 deletions(-)

diff --git a/doc/manual/src/installation/installing-binary.md b/doc/manual/src/installation/installing-binary.md
index 4367654a2..ba90ce280 100644
--- a/doc/manual/src/installation/installing-binary.md
+++ b/doc/manual/src/installation/installing-binary.md
@@ -84,7 +84,9 @@ The installer will modify `/etc/bashrc`, and `/etc/zshrc` if they exist.
 The installer will first back up these files with a `.backup-before-nix`
 extension. The installer will also create `/etc/profile.d/nix.sh`.
 
-You can uninstall Nix with the following commands:
+## Uninstalling
+
+### Linux
 
 ```console
 sudo rm -rf /etc/profile/nix.sh /etc/nix /nix ~root/.nix-profile ~root/.nix-defexpr ~root/.nix-channels ~/.nix-profile ~/.nix-defexpr ~/.nix-channels
@@ -95,15 +97,87 @@ sudo systemctl stop nix-daemon.service
 sudo systemctl disable nix-daemon.socket
 sudo systemctl disable nix-daemon.service
 sudo systemctl daemon-reload
-
-# If you are on macOS, you will need to run:
-sudo launchctl unload /Library/LaunchDaemons/org.nixos.nix-daemon.plist
-sudo rm /Library/LaunchDaemons/org.nixos.nix-daemon.plist
 ```
 
 There may also be references to Nix in `/etc/profile`, `/etc/bashrc`,
 and `/etc/zshrc` which you may remove.
 
+### macOS
+
+1. Edit `/etc/zshrc` and `/etc/bashrc` to remove the lines sourcing
+   `nix-daemon.sh`, which should look like this:
+
+   ```bash
+   # Nix
+   if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then
+     . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
+   fi
+   # End Nix
+   ```
+
+   If these files haven't been altered since installing Nix you can simply put
+   the backups back in place:
+
+   ```console
+   sudo mv /etc/zshrc.backup-before-nix /etc/zshrc
+   sudo mv /etc/bashrc.backup-before-nix /etc/bashrc
+   ```
+
+   This will stop shells from sourcing the file and bringing everything you
+   installed using Nix in scope.
+
+2. Stop and remove the Nix daemon services:
+
+   ```console
+   sudo launchctl unload /Library/LaunchDaemons/org.nixos.nix-daemon.plist
+   sudo rm /Library/LaunchDaemons/org.nixos.nix-daemon.plist
+   sudo launchctl unload /Library/LaunchDaemons/org.nixos.activate-system.plist
+   sudo rm /Library/LaunchDaemons/org.nixos.activate-system.plist
+   ```
+
+   This stops the Nix daemon and prevents it from being started next time you
+   boot the system.
+
+3. Remove the `nixbld` group and the `_nixbuildN` users:
+
+   ```console
+   sudo dscl . -delete /Groups/nixbld
+   for u in $(sudo dscl . -list /Users | grep _nixbld); do sudo dscl . -delete /Users/$u; done
+   ```
+
+   This will remove all the build users that no longer serve a purpose.
+
+4. Edit fstab using `sudo vifs` to remove the line mounting the Nix Store
+   volume on `/nix`, which looks like this,
+   `LABEL=Nix\040Store /nix apfs rw,nobrowse`. This will prevent automatic
+   mounting of the Nix Store volume.
+
+5. Edit `/etc/synthetic.conf` to remove the `nix` line. If this is the only
+   line in the file you can remove it entirely, `sudo rm /etc/synthetic.conf`.
+   This will prevent the creation of the empty `/nix` directory to provide a
+   mountpoint for the Nix Store volume.
+
+6. Remove the files Nix added to your system:
+
+   ```console
+   sudo rm -rf /etc/nix /var/root/.nix-profile /var/root/.nix-defexpr /var/root/.nix-channels ~/.nix-profile ~/.nix-defexpr ~/.nix-channels
+   ```
+
+   This gets rid of any data Nix may have created except for the store which is
+   removed next.
+
+7. Remove the Nix Store volume:
+   
+   ```console
+   sudo diskutil apfs deleteVolume /nix
+   ```
+
+   This will remove the Nix Store volume and everything that was added to the
+   store.
+
+The change to `/etc/synthetic.conf` will only take effect after a reboot but
+you shouldn't have any traces of Nix left on your system.
+
 # macOS Installation <a name="sect-macos-installation-change-store-prefix"></a><a name="sect-macos-installation-encrypted-volume"></a><a name="sect-macos-installation-symlink"></a><a name="sect-macos-installation-recommended-notes"></a>
 <!-- Note: anchors above to catch permalinks to old explanations -->
 

From ba9a8c4b3d0f8f008a2067e26e89d6165d14c814 Mon Sep 17 00:00:00 2001
From: "Travis A. Everett" <travis.a.everett@gmail.com>
Date: Tue, 22 Feb 2022 12:44:15 -0600
Subject: [PATCH 053/251] install-darwin: track mount permission edge-case fix

Same as 1fd127a06833c19a5a2965bd41cf4f695773cca6, but applied to a
code path (volume_pass_works -> verify_volume_pass) that the reporting
user didn't hit and wasn't able to trigger manually. I am not certain
but I suspect it will be easier to add prophylactically than to debug
if its absence causes trouble some day.
---
 scripts/create-darwin-volume.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/create-darwin-volume.sh b/scripts/create-darwin-volume.sh
index ece4f29bb..4bac4b7ba 100755
--- a/scripts/create-darwin-volume.sh
+++ b/scripts/create-darwin-volume.sh
@@ -246,7 +246,8 @@ get_volume_pass() {
 verify_volume_pass() {
     local volume_special="$1" # (i.e., disk1s7)
     local volume_uuid="$2"
-    /usr/sbin/diskutil apfs unlockVolume "$volume_special" -verify -stdinpassphrase -user "$volume_uuid"
+    _sudo "to confirm the password actually unlocks the volume" \
+        /usr/sbin/diskutil apfs unlockVolume "$volume_special" -verify -stdinpassphrase -user "$volume_uuid"
 }
 
 volume_pass_works() {

From 54f07b66c87fd749f7ecfaeb89d878557b625d78 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9ophane=20Hufschmitt?=
 <7226587+thufschmitt@users.noreply.github.com>
Date: Wed, 23 Feb 2022 09:17:08 +0100
Subject: [PATCH 054/251] Precise the doc for `--include-outputs`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Make it explicit that it only includes the existing outputs and not the ones that haven’t been realised
---
 doc/manual/src/command-ref/nix-store.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/manual/src/command-ref/nix-store.md b/doc/manual/src/command-ref/nix-store.md
index 26292f1bb..7db9f0c1c 100644
--- a/doc/manual/src/command-ref/nix-store.md
+++ b/doc/manual/src/command-ref/nix-store.md
@@ -321,8 +321,8 @@ symlink.
     This query has one option:
 
       - `--include-outputs`
-        Also include the output path of store derivations, and their
-        closures.
+        Also include the existing output paths of store derivations,
+        and their closures.
 
     This query can be used to implement various kinds of deployment. A
     *source deployment* is obtained by distributing the closure of a

From 2cc645a91a07458fd23e0aacd6ccdf63cad199b9 Mon Sep 17 00:00:00 2001
From: Guillaume Desforges <guillaume.desforges.pro@gmail.com>
Date: Wed, 23 Feb 2022 15:06:13 +0100
Subject: [PATCH 055/251] Add html make target

---
 doc/manual/local.mk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/manual/local.mk b/doc/manual/local.mk
index 6b232a736..c1ce8aaeb 100644
--- a/doc/manual/local.mk
+++ b/doc/manual/local.mk
@@ -72,6 +72,7 @@ $(d)/builtins.json: $(bindir)/nix
 	@mv $@.tmp $@
 
 # Generate the HTML manual.
+html: $(docdir)/manual/index.html
 install: $(docdir)/manual/index.html
 
 # Generate 'nix' manpages.

From 6462ee61c7c6ea7a93c01c89bf311fe8f454f35f Mon Sep 17 00:00:00 2001
From: Guillaume Desforges <guillaume.desforges.pro@gmail.com>
Date: Wed, 23 Feb 2022 15:07:01 +0100
Subject: [PATCH 056/251] Anchor link for builtin functions in HTML doc

---
 doc/manual/generate-builtins.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/manual/generate-builtins.nix b/doc/manual/generate-builtins.nix
index 92c7b1a31..b481beecd 100644
--- a/doc/manual/generate-builtins.nix
+++ b/doc/manual/generate-builtins.nix
@@ -6,9 +6,9 @@ builtins:
 concatStrings (map
   (name:
     let builtin = builtins.${name}; in
-    "<dt><code>${name} "
+    "<dt id=\"${name}\"><a href=\"#${name}\"><code>${name} "
     + concatStringsSep " " (map (s: "<var>${s}</var>") builtin.args)
-    + "</code></dt>"
+    + "</code></a></dt>"
     + "<dd>\n\n"
     + builtin.doc
     + "\n\n</dd>"

From 770f3af31df552c47ac6bc38d386d10f8ff1c856 Mon Sep 17 00:00:00 2001
From: Gabriel Fontes <eu@misterio.me>
Date: Wed, 23 Feb 2022 11:58:09 -0300
Subject: [PATCH 057/251] add sourcehut integration test

---
 flake.nix                  |   6 ++
 tests/sourcehut-flakes.nix | 156 +++++++++++++++++++++++++++++++++++++
 2 files changed, 162 insertions(+)
 create mode 100644 tests/sourcehut-flakes.nix

diff --git a/flake.nix b/flake.nix
index ae9305144..87b00edf4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -501,6 +501,12 @@
           inherit (self) overlay;
         });
 
+        tests.sourcehutFlakes = (import ./tests/sourcehut-flakes.nix rec {
+          system = "x86_64-linux";
+          inherit nixpkgs;
+          inherit (self) overlay;
+        });
+
         tests.setuid = nixpkgs.lib.genAttrs
           ["i686-linux" "x86_64-linux"]
           (system:
diff --git a/tests/sourcehut-flakes.nix b/tests/sourcehut-flakes.nix
new file mode 100644
index 000000000..d1d89d149
--- /dev/null
+++ b/tests/sourcehut-flakes.nix
@@ -0,0 +1,156 @@
+{ nixpkgs, system, overlay }:
+
+with import (nixpkgs + "/nixos/lib/testing-python.nix")
+{
+  inherit system;
+  extraConfigurations = [{ nixpkgs.overlays = [ overlay ]; }];
+};
+
+let
+  # Generate a fake root CA and a fake git.sr.ht certificate.
+  cert = pkgs.runCommand "cert" { buildInputs = [ pkgs.openssl ]; }
+    ''
+      mkdir -p $out
+
+      openssl genrsa -out ca.key 2048
+      openssl req -new -x509 -days 36500 -key ca.key \
+        -subj "/C=NL/ST=Denial/L=Springfield/O=Dis/CN=Root CA" -out $out/ca.crt
+
+      openssl req -newkey rsa:2048 -nodes -keyout $out/server.key \
+        -subj "/C=CN/ST=Denial/L=Springfield/O=Dis/CN=git.sr.ht" -out server.csr
+      openssl x509 -req -extfile <(printf "subjectAltName=DNS:git.sr.ht") \
+        -days 36500 -in server.csr -CA $out/ca.crt -CAkey ca.key -CAcreateserial -out $out/server.crt
+    '';
+
+  registry = pkgs.writeTextFile {
+    name = "registry";
+    text = ''
+      {
+        "flakes": [
+          {
+            "from": {
+              "type": "indirect",
+              "id": "nixpkgs"
+            },
+            "to": {
+              "type": "sourcehut",
+              "owner": "~NixOS",
+              "repo": "nixpkgs"
+            }
+          }
+        ],
+        "version": 2
+      }
+    '';
+    destination = "/flake-registry.json";
+  };
+
+  nixpkgs-repo = pkgs.runCommand "nixpkgs-flake" { }
+    ''
+      dir=NixOS-nixpkgs-${nixpkgs.shortRev}
+      cp -prd ${nixpkgs} $dir
+
+      # Set the correct timestamp in the tarball.
+      find $dir -print0 | xargs -0 touch -t ${builtins.substring 0 12 nixpkgs.lastModifiedDate}.${builtins.substring 12 2 nixpkgs.lastModifiedDate} --
+
+      mkdir -p $out/archive
+      tar cfz $out/archive/${nixpkgs.rev}.tar.gz $dir --hard-dereference
+
+      echo 'ref: refs/heads/master' > $out/HEAD
+
+      mkdir -p $out/info
+      echo '${nixpkgs.rev} refs/heads/master' > $out/info/refs
+    '';
+
+in
+
+makeTest (
+
+  {
+    name = "sourcehut-flakes";
+
+    nodes =
+      {
+        # Impersonate git.sr.ht
+        sourcehut =
+          { config, pkgs, ... }:
+          {
+            networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+            services.httpd.enable = true;
+            services.httpd.adminAddr = "foo@example.org";
+            services.httpd.extraConfig = ''
+              ErrorLog syslog:local6
+            '';
+            services.httpd.virtualHosts."git.sr.ht" =
+              {
+                forceSSL = true;
+                sslServerKey = "${cert}/server.key";
+                sslServerCert = "${cert}/server.crt";
+                servedDirs =
+                  [
+                    {
+                      urlPath = "/~NixOS/nixpkgs";
+                      dir = nixpkgs-repo;
+                    }
+                    {
+                      urlPath = "/~NixOS/flake-registry/blob/master";
+                      dir = registry;
+                    }
+                  ];
+              };
+          };
+
+        client =
+          { config, lib, pkgs, nodes, ... }:
+          {
+            virtualisation.writableStore = true;
+            virtualisation.diskSize = 2048;
+            virtualisation.pathsInNixDB = [ pkgs.hello pkgs.fuse ];
+            virtualisation.memorySize = 4096;
+            nix.binaryCaches = lib.mkForce [ ];
+            nix.extraOptions = ''
+              experimental-features = nix-command flakes
+              flake-registry = https://git.sr.ht/~NixOS/flake-registry/blob/master/flake-registry.json
+            '';
+            environment.systemPackages = [ pkgs.jq ];
+            networking.hosts.${(builtins.head nodes.sourcehut.config.networking.interfaces.eth1.ipv4.addresses).address} =
+              [ "git.sr.ht" ];
+            security.pki.certificateFiles = [ "${cert}/ca.crt" ];
+          };
+      };
+
+    testScript = { nodes }: ''
+      # fmt: off
+      import json
+      import time
+
+      start_all()
+
+      sourcehut.wait_for_unit("httpd.service")
+
+      client.succeed("curl -v https://git.sr.ht/ >&2")
+      client.succeed("nix registry list | grep nixpkgs")
+
+      rev = client.succeed("nix flake info nixpkgs --json | jq -r .revision")
+      assert rev.strip() == "${nixpkgs.rev}", "revision mismatch"
+
+      client.succeed("nix registry pin nixpkgs")
+
+      client.succeed("nix flake info nixpkgs --tarball-ttl 0 >&2")
+
+      # Shut down the web server. The flake should be cached on the client.
+      sourcehut.succeed("systemctl stop httpd.service")
+
+      info = json.loads(client.succeed("nix flake info nixpkgs --json"))
+      date = time.strftime("%Y%m%d%H%M%S", time.gmtime(info['lastModified']))
+      assert date == "${nixpkgs.lastModifiedDate}", "time mismatch"
+
+      client.succeed("nix build nixpkgs#hello")
+
+      # The build shouldn't fail even with --tarball-ttl 0 (the server
+      # being down should not be a fatal error).
+      client.succeed("nix build nixpkgs#fuse --tarball-ttl 0")
+    '';
+
+  })

From cfbf9ee2ce35b64ced1822c132bd46bd4fd848b2 Mon Sep 17 00:00:00 2001
From: Guillaume Desforges <guillaume.desforges.pro@gmail.com>
Date: Thu, 24 Feb 2022 13:50:50 +0100
Subject: [PATCH 058/251] Anchor with prefix

---
 doc/manual/generate-builtins.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/manual/generate-builtins.nix b/doc/manual/generate-builtins.nix
index b481beecd..6c8b88da2 100644
--- a/doc/manual/generate-builtins.nix
+++ b/doc/manual/generate-builtins.nix
@@ -6,7 +6,7 @@ builtins:
 concatStrings (map
   (name:
     let builtin = builtins.${name}; in
-    "<dt id=\"${name}\"><a href=\"#${name}\"><code>${name} "
+    "<dt id=\"builtins-${name}\"><a href=\"#builtins-${name}\"><code>${name} "
     + concatStringsSep " " (map (s: "<var>${s}</var>") builtin.args)
     + "</code></a></dt>"
     + "<dd>\n\n"

From 42766f89246ded45d80bdf62061cbafc42540c54 Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Thu, 24 Feb 2022 14:15:27 +0100
Subject: [PATCH 059/251] Sort the tests by wall time

The tests are scheduled in the order they appear, so running the long
ones first slightly improves the scheduling.

On my machine, this decreases the time of `make install` from 40s to 36s
---
 tests/local.mk | 124 ++++++++++++++++++++++++++++++-------------------
 1 file changed, 75 insertions(+), 49 deletions(-)

diff --git a/tests/local.mk b/tests/local.mk
index 47717fa67..53a9179a3 100644
--- a/tests/local.mk
+++ b/tests/local.mk
@@ -1,72 +1,98 @@
 nix_tests = \
-  hash.sh lang.sh add.sh simple.sh dependencies.sh \
-  config.sh \
-  gc.sh \
+  flakes.sh \
   ca/gc.sh \
-  gc-concurrent.sh \
-  gc-non-blocking.sh \
+  gc.sh \
+  remote-store.sh \
+  lang.sh \
+  fetchMercurial.sh \
   gc-auto.sh \
-  referrers.sh user-envs.sh logging.sh nix-build.sh misc.sh fixed.sh \
-  gc-runtime.sh check-refs.sh filter-source.sh \
-  local-store.sh remote-store.sh export.sh export-graph.sh \
-  db-migration.sh \
-  timeout.sh secure-drv-outputs.sh nix-channel.sh \
-  multiple-outputs.sh import-derivation.sh ca/import-derivation.sh fetchurl.sh optimise-store.sh \
+  user-envs.sh \
   binary-cache.sh \
+  multiple-outputs.sh \
+  ca/build.sh \
+  nix-build.sh \
+  gc-concurrent.sh \
+  repair.sh \
+  fixed.sh \
+  export-graph.sh \
+  timeout.sh \
+  fetchGitRefs.sh \
+  gc-runtime.sh \
+  tarball.sh \
+  fetchGit.sh \
+  fetchurl.sh \
+  simple.sh \
+  referrers.sh \
+  optimise-store.sh \
   substitute-with-invalid-ca.sh \
-  binary-cache-build-remote.sh \
-  nix-profile.sh repair.sh dump-db.sh case-hack.sh \
-  check-reqs.sh pass-as-file.sh tarball.sh restricted.sh \
-  placeholders.sh nix-shell.sh \
-  linux-sandbox.sh \
-  build-dry.sh \
+  ca/concurrent-builds.sh \
+  signing.sh \
+  ca/build-with-garbage-path.sh \
+  hash.sh \
+  gc-non-blocking.sh \
+  check.sh \
+  ca/substitute.sh \
+  nix-shell.sh \
+  ca/signatures.sh \
+  ca/nix-shell.sh \
+  ca/nix-copy.sh \
+  check-refs.sh \
   build-remote-input-addressed.sh \
+  secure-drv-outputs.sh \
+  restricted.sh \
+  fetchGitSubmodules.sh \
+  flake-searching.sh \
+  ca/duplicate-realisation-in-closure.sh \
+  readfile-context.sh \
+  nix-channel.sh \
+  recursive.sh \
+  dependencies.sh \
+  check-reqs.sh \
   build-remote-content-addressed-fixed.sh \
   build-remote-content-addressed-floating.sh \
-  ssh-relay.sh \
   nar-access.sh \
+  pure-eval.sh \
+  ca/post-hook.sh \
+  repl.sh \
+  ca/repl.sh \
+  ca/recursive.sh \
+  binary-cache-build-remote.sh \
+  search.sh \
+  logging.sh \
+  export.sh \
+  config.sh \
+  add.sh \
+  local-store.sh \
+  filter-source.sh \
+  misc.sh \
+  dump-db.sh \
+  linux-sandbox.sh \
+  build-dry.sh \
   structured-attrs.sh \
-  fetchGit.sh \
-  fetchGitRefs.sh \
-  fetchGitSubmodules.sh \
-  fetchMercurial.sh \
-  signing.sh \
   shell.sh \
   brotli.sh \
   zstd.sh \
   compression-levels.sh \
-  pure-eval.sh \
-  check.sh \
-  plugins.sh \
-  search.sh \
   nix-copy-ssh.sh \
   post-hook.sh \
-  ca/post-hook.sh \
   function-trace.sh \
-  recursive.sh \
-  describe-stores.sh \
-  flakes.sh \
   flake-local-settings.sh \
-  flake-searching.sh \
-  flake-bundler.sh \
-  build.sh \
-  repl.sh ca/repl.sh \
-  ca/build.sh \
-  ca/build-with-garbage-path.sh \
-  ca/duplicate-realisation-in-closure.sh \
-  ca/substitute.sh \
-  ca/signatures.sh \
-  ca/nix-shell.sh \
-  ca/nix-run.sh \
-  ca/recursive.sh \
-  ca/concurrent-builds.sh \
-  ca/nix-copy.sh \
   eval-store.sh \
-  readfile-context.sh \
-  store-ping.sh \
+  why-depends.sh \
+  import-derivation.sh \
+  ca/import-derivation.sh \
   nix_path.sh \
-  why-depends.sh
-  # parallel.sh
+  case-hack.sh \
+  placeholders.sh \
+  ssh-relay.sh \
+  plugins.sh \
+  build.sh \
+  ca/nix-run.sh \
+  db-migration.sh \
+  nix-profile.sh \
+  pass-as-file.sh \
+  describe-stores.sh \
+  store-ping.sh
 
 ifeq ($(HAVE_LIBCPUID), 1)
 	nix_tests += compute-levels.sh

From 9c470cb9694408078fa2c289b9b776820e611923 Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Thu, 24 Feb 2022 14:57:27 +0100
Subject: [PATCH 060/251] testS: poll more eagerly for the daemon start/stop

Polling every 1 second means that even the simplest test takes at least
2 seconds. We can reasonably poll 1/10 of that to make things much
  quicker (esp. given that most of the time 0.1s is enough for the
  daemon to be started or stopped)
---
 tests/common.sh.in | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/common.sh.in b/tests/common.sh.in
index 61abab1d7..49068f1c3 100644
--- a/tests/common.sh.in
+++ b/tests/common.sh.in
@@ -91,9 +91,9 @@ startDaemon() {
     # ‘nix-daemon’ should have an option to fork into the background.
     rm -f $NIX_DAEMON_SOCKET_PATH
     PATH=$DAEMON_PATH nix daemon &
-    for ((i = 0; i < 30; i++)); do
+    for ((i = 0; i < 300; i++)); do
         if [[ -S $NIX_DAEMON_SOCKET_PATH ]]; then break; fi
-        sleep 1
+        sleep 0.1
     done
     pidDaemon=$!
     trap "killDaemon" EXIT
@@ -102,9 +102,9 @@ startDaemon() {
 
 killDaemon() {
     kill $pidDaemon
-    for i in {0.10}; do
+    for i in {0..100}; do
         kill -0 $pidDaemon || break
-        sleep 1
+        sleep 0.1
     done
     kill -9 $pidDaemon || true
     wait $pidDaemon || true

From 8518cebfceb36f3744c276cc8dbf432b1275f53f Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 24 Feb 2022 18:09:00 +0100
Subject: [PATCH 061/251] libfetchers: Rename immutable -> locked

This is more consistent with flake terminology.
---
 src/libexpr/flake/flake.cc       |  8 ++++----
 src/libexpr/flake/lockfile.cc    |  4 ++--
 src/libexpr/primops/fetchTree.cc |  6 +++---
 src/libfetchers/cache.cc         |  8 ++++----
 src/libfetchers/cache.hh         |  2 +-
 src/libfetchers/fetchers.cc      |  8 ++++----
 src/libfetchers/fetchers.hh      | 12 +++++++-----
 src/libfetchers/git.cc           | 14 +++++++-------
 src/libfetchers/github.cc        |  6 +++---
 src/libfetchers/mercurial.cc     | 14 +++++++-------
 src/libfetchers/tarball.cc       | 14 +++++++-------
 src/nix/profile.cc               |  2 +-
 src/nix/repl.cc                  |  4 ++--
 13 files changed, 52 insertions(+), 50 deletions(-)

diff --git a/src/libexpr/flake/flake.cc b/src/libexpr/flake/flake.cc
index 9f3b58909..6e3fa41f7 100644
--- a/src/libexpr/flake/flake.cc
+++ b/src/libexpr/flake/flake.cc
@@ -501,7 +501,7 @@ LockedFlake lockFlake(
                            this input. */
                         debug("creating new input '%s'", inputPathS);
 
-                        if (!lockFlags.allowMutable && !input.ref->input.isImmutable())
+                        if (!lockFlags.allowMutable && !input.ref->input.isLocked())
                             throw Error("cannot update flake input '%s' in pure mode", inputPathS);
 
                         if (input.isFlake) {
@@ -650,7 +650,7 @@ LockedFlake lockFlake(
                            now. Corner case: we could have reverted from a
                            dirty to a clean tree! */
                         if (flake.lockedRef.input == prevLockedRef.input
-                            && !flake.lockedRef.input.isImmutable())
+                            && !flake.lockedRef.input.isLocked())
                             throw Error("'%s' did not change after I updated its 'flake.lock' file; is 'flake.lock' under version control?", flake.originalRef);
                     }
                 } else
@@ -709,8 +709,8 @@ static void prim_getFlake(EvalState & state, const Pos & pos, Value * * args, Va
 
     string flakeRefS(state.forceStringNoCtx(*args[0], pos));
     auto flakeRef = parseFlakeRef(flakeRefS, {}, true);
-    if (evalSettings.pureEval && !flakeRef.input.isImmutable())
-        throw Error("cannot call 'getFlake' on mutable flake reference '%s', at %s (use --impure to override)", flakeRefS, pos);
+    if (evalSettings.pureEval && !flakeRef.input.isLocked())
+        throw Error("cannot call 'getFlake' on unlocked flake reference '%s', at %s (use --impure to override)", flakeRefS, pos);
 
     callFlake(state,
         lockFlake(state, flakeRef,
diff --git a/src/libexpr/flake/lockfile.cc b/src/libexpr/flake/lockfile.cc
index fda340789..60b52d578 100644
--- a/src/libexpr/flake/lockfile.cc
+++ b/src/libexpr/flake/lockfile.cc
@@ -35,7 +35,7 @@ LockedNode::LockedNode(const nlohmann::json & json)
     , originalRef(getFlakeRef(json, "original", nullptr))
     , isFlake(json.find("flake") != json.end() ? (bool) json["flake"] : true)
 {
-    if (!lockedRef.input.isImmutable())
+    if (!lockedRef.input.isLocked())
         throw Error("lockfile contains mutable lock '%s'",
             fetchers::attrsToJSON(lockedRef.input.toAttrs()));
 }
@@ -220,7 +220,7 @@ bool LockFile::isImmutable() const
     for (auto & i : nodes) {
         if (i == root) continue;
         auto lockedNode = std::dynamic_pointer_cast<const LockedNode>(i);
-        if (lockedNode && !lockedNode->lockedRef.input.isImmutable()) return false;
+        if (lockedNode && !lockedNode->lockedRef.input.isLocked()) return false;
     }
 
     return true;
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index d09e2d9e1..7496104b6 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -19,7 +19,7 @@ void emitTreeAttrs(
     bool emptyRevFallback,
     bool forceDirty)
 {
-    assert(input.isImmutable());
+    assert(input.isLocked());
 
     auto attrs = state.buildBindings(8);
 
@@ -166,8 +166,8 @@ static void fetchTree(
     if (!evalSettings.pureEval && !input.isDirect())
         input = lookupInRegistries(state.store, input).first;
 
-    if (evalSettings.pureEval && !input.isImmutable())
-        throw Error("in pure evaluation mode, 'fetchTree' requires an immutable input, at %s", pos);
+    if (evalSettings.pureEval && !input.isLocked())
+        throw Error("in pure evaluation mode, 'fetchTree' requires a locked input, at %s", pos);
 
     auto [tree, input2] = input.fetch(state.store);
 
diff --git a/src/libfetchers/cache.cc b/src/libfetchers/cache.cc
index 34ff6f85b..0c8ecac9d 100644
--- a/src/libfetchers/cache.cc
+++ b/src/libfetchers/cache.cc
@@ -52,13 +52,13 @@ struct CacheImpl : Cache
         const Attrs & inAttrs,
         const Attrs & infoAttrs,
         const StorePath & storePath,
-        bool immutable) override
+        bool locked) override
     {
         _state.lock()->add.use()
             (attrsToJSON(inAttrs).dump())
             (attrsToJSON(infoAttrs).dump())
             (store->printStorePath(storePath))
-            (immutable)
+            (locked)
             (time(0)).exec();
     }
 
@@ -91,7 +91,7 @@ struct CacheImpl : Cache
 
         auto infoJSON = stmt.getStr(0);
         auto storePath = store->parseStorePath(stmt.getStr(1));
-        auto immutable = stmt.getInt(2) != 0;
+        auto locked = stmt.getInt(2) != 0;
         auto timestamp = stmt.getInt(3);
 
         store->addTempRoot(storePath);
@@ -105,7 +105,7 @@ struct CacheImpl : Cache
             inAttrsJSON, infoJSON, store->printStorePath(storePath));
 
         return Result {
-            .expired = !immutable && (settings.tarballTtl.get() == 0 || timestamp + settings.tarballTtl < time(0)),
+            .expired = !locked && (settings.tarballTtl.get() == 0 || timestamp + settings.tarballTtl < time(0)),
             .infoAttrs = jsonToAttrs(nlohmann::json::parse(infoJSON)),
             .storePath = std::move(storePath)
         };
diff --git a/src/libfetchers/cache.hh b/src/libfetchers/cache.hh
index 3db4f081c..3763ee2a6 100644
--- a/src/libfetchers/cache.hh
+++ b/src/libfetchers/cache.hh
@@ -13,7 +13,7 @@ struct Cache
         const Attrs & inAttrs,
         const Attrs & infoAttrs,
         const StorePath & storePath,
-        bool immutable) = 0;
+        bool locked) = 0;
 
     virtual std::optional<std::pair<Attrs, StorePath>> lookup(
         ref<Store> store,
diff --git a/src/libfetchers/fetchers.cc b/src/libfetchers/fetchers.cc
index c06ccb929..976f40d3b 100644
--- a/src/libfetchers/fetchers.cc
+++ b/src/libfetchers/fetchers.cc
@@ -24,11 +24,11 @@ static void fixupInput(Input & input)
     input.getType();
     input.getRef();
     if (input.getRev())
-        input.immutable = true;
+        input.locked = true;
     input.getRevCount();
     input.getLastModified();
     if (input.getNarHash())
-        input.immutable = true;
+        input.locked = true;
 }
 
 Input Input::fromURL(const ParsedURL & url)
@@ -165,7 +165,7 @@ std::pair<Tree, Input> Input::fetch(ref<Store> store) const
                 input.to_string(), *prevRevCount);
     }
 
-    input.immutable = true;
+    input.locked = true;
 
     assert(input.hasAllInfo());
 
@@ -209,7 +209,7 @@ StorePath Input::computeStorePath(Store & store) const
 {
     auto narHash = getNarHash();
     if (!narHash)
-        throw Error("cannot compute store path for mutable input '%s'", to_string());
+        throw Error("cannot compute store path for unlocked input '%s'", to_string());
     return store.makeFixedOutputPath(FileIngestionMethod::Recursive, *narHash, getName());
 }
 
diff --git a/src/libfetchers/fetchers.hh b/src/libfetchers/fetchers.hh
index 2836af5fa..bc9a76b0b 100644
--- a/src/libfetchers/fetchers.hh
+++ b/src/libfetchers/fetchers.hh
@@ -34,7 +34,7 @@ struct Input
 
     std::shared_ptr<InputScheme> scheme; // note: can be null
     Attrs attrs;
-    bool immutable = false;
+    bool locked = false;
     bool direct = true;
 
     /* path of the parent of this input, used for relative path resolution */
@@ -59,9 +59,9 @@ public:
        one that goes through a registry. */
     bool isDirect() const { return direct; }
 
-    /* Check whether this is an "immutable" input, that is,
+    /* Check whether this is a "locked" input, that is,
        one that contains a commit hash or content hash. */
-    bool isImmutable() const { return immutable; }
+    bool isLocked() const { return locked; }
 
     bool hasAllInfo() const;
 
@@ -69,6 +69,8 @@ public:
 
     bool contains(const Input & other) const;
 
+    /* Fetch the input into the Nix store, returning the location in
+       the Nix store and the locked input. */
     std::pair<Tree, Input> fetch(ref<Store> store) const;
 
     Input applyOverrides(
@@ -146,14 +148,14 @@ DownloadFileResult downloadFile(
     ref<Store> store,
     const std::string & url,
     const std::string & name,
-    bool immutable,
+    bool locked,
     const Headers & headers = {});
 
 std::pair<Tree, time_t> downloadTarball(
     ref<Store> store,
     const std::string & url,
     const std::string & name,
-    bool immutable,
+    bool locked,
     const Headers & headers = {});
 
 }
diff --git a/src/libfetchers/git.cc b/src/libfetchers/git.cc
index c3f0f8c8f..7f65c1533 100644
--- a/src/libfetchers/git.cc
+++ b/src/libfetchers/git.cc
@@ -187,7 +187,7 @@ struct GitInputScheme : InputScheme
         if (submodules) cacheType += "-submodules";
         if (allRefs) cacheType += "-all-refs";
 
-        auto getImmutableAttrs = [&]()
+        auto getLockedAttrs = [&]()
         {
             return Attrs({
                 {"type", cacheType},
@@ -208,7 +208,7 @@ struct GitInputScheme : InputScheme
         };
 
         if (input.getRev()) {
-            if (auto res = getCache()->lookup(store, getImmutableAttrs()))
+            if (auto res = getCache()->lookup(store, getLockedAttrs()))
                 return makeResult(res->first, std::move(res->second));
         }
 
@@ -288,7 +288,7 @@ struct GitInputScheme : InputScheme
 
         if (!input.getRef()) input.attrs.insert_or_assign("ref", isLocal ? readHead(actualUrl) : "master");
 
-        Attrs mutableAttrs({
+        Attrs unlockedAttrs({
             {"type", cacheType},
             {"name", name},
             {"url", actualUrl},
@@ -307,7 +307,7 @@ struct GitInputScheme : InputScheme
 
         } else {
 
-            if (auto res = getCache()->lookup(store, mutableAttrs)) {
+            if (auto res = getCache()->lookup(store, unlockedAttrs)) {
                 auto rev2 = Hash::parseAny(getStrAttr(res->first, "rev"), htSHA1);
                 if (!input.getRev() || input.getRev() == rev2) {
                     input.attrs.insert_or_assign("rev", rev2.gitRev());
@@ -404,7 +404,7 @@ struct GitInputScheme : InputScheme
 
         /* Now that we know the ref, check again whether we have it in
            the store. */
-        if (auto res = getCache()->lookup(store, getImmutableAttrs()))
+        if (auto res = getCache()->lookup(store, getLockedAttrs()))
             return makeResult(res->first, std::move(res->second));
 
         Path tmpDir = createTempDir();
@@ -476,14 +476,14 @@ struct GitInputScheme : InputScheme
         if (!_input.getRev())
             getCache()->add(
                 store,
-                mutableAttrs,
+                unlockedAttrs,
                 infoAttrs,
                 storePath,
                 false);
 
         getCache()->add(
             store,
-            getImmutableAttrs(),
+            getLockedAttrs(),
             infoAttrs,
             storePath,
             true);
diff --git a/src/libfetchers/github.cc b/src/libfetchers/github.cc
index 2b3705b1b..70622bf79 100644
--- a/src/libfetchers/github.cc
+++ b/src/libfetchers/github.cc
@@ -193,12 +193,12 @@ struct GitArchiveInputScheme : InputScheme
         input.attrs.erase("ref");
         input.attrs.insert_or_assign("rev", rev->gitRev());
 
-        Attrs immutableAttrs({
+        Attrs lockedAttrs({
             {"type", "git-tarball"},
             {"rev", rev->gitRev()},
         });
 
-        if (auto res = getCache()->lookup(store, immutableAttrs)) {
+        if (auto res = getCache()->lookup(store, lockedAttrs)) {
             input.attrs.insert_or_assign("lastModified", getIntAttr(res->first, "lastModified"));
             return {std::move(res->second), input};
         }
@@ -211,7 +211,7 @@ struct GitArchiveInputScheme : InputScheme
 
         getCache()->add(
             store,
-            immutableAttrs,
+            lockedAttrs,
             {
                 {"rev", rev->gitRev()},
                 {"lastModified", uint64_t(lastModified)}
diff --git a/src/libfetchers/mercurial.cc b/src/libfetchers/mercurial.cc
index 5123bcda4..798369c7a 100644
--- a/src/libfetchers/mercurial.cc
+++ b/src/libfetchers/mercurial.cc
@@ -199,7 +199,7 @@ struct MercurialInputScheme : InputScheme
 
         if (!input.getRef()) input.attrs.insert_or_assign("ref", "default");
 
-        auto getImmutableAttrs = [&]()
+        auto getLockedAttrs = [&]()
         {
             return Attrs({
                 {"type", "hg"},
@@ -218,20 +218,20 @@ struct MercurialInputScheme : InputScheme
         };
 
         if (input.getRev()) {
-            if (auto res = getCache()->lookup(store, getImmutableAttrs()))
+            if (auto res = getCache()->lookup(store, getLockedAttrs()))
                 return makeResult(res->first, std::move(res->second));
         }
 
         auto revOrRef = input.getRev() ? input.getRev()->gitRev() : *input.getRef();
 
-        Attrs mutableAttrs({
+        Attrs unlockedAttrs({
             {"type", "hg"},
             {"name", name},
             {"url", actualUrl},
             {"ref", *input.getRef()},
         });
 
-        if (auto res = getCache()->lookup(store, mutableAttrs)) {
+        if (auto res = getCache()->lookup(store, unlockedAttrs)) {
             auto rev2 = Hash::parseAny(getStrAttr(res->first, "rev"), htSHA1);
             if (!input.getRev() || input.getRev() == rev2) {
                 input.attrs.insert_or_assign("rev", rev2.gitRev());
@@ -277,7 +277,7 @@ struct MercurialInputScheme : InputScheme
         auto revCount = std::stoull(tokens[1]);
         input.attrs.insert_or_assign("ref", tokens[2]);
 
-        if (auto res = getCache()->lookup(store, getImmutableAttrs()))
+        if (auto res = getCache()->lookup(store, getLockedAttrs()))
             return makeResult(res->first, std::move(res->second));
 
         Path tmpDir = createTempDir();
@@ -297,14 +297,14 @@ struct MercurialInputScheme : InputScheme
         if (!_input.getRev())
             getCache()->add(
                 store,
-                mutableAttrs,
+                unlockedAttrs,
                 infoAttrs,
                 storePath,
                 false);
 
         getCache()->add(
             store,
-            getImmutableAttrs(),
+            getLockedAttrs(),
             infoAttrs,
             storePath,
             true);
diff --git a/src/libfetchers/tarball.cc b/src/libfetchers/tarball.cc
index 74c8097ff..dde0ad761 100644
--- a/src/libfetchers/tarball.cc
+++ b/src/libfetchers/tarball.cc
@@ -13,7 +13,7 @@ DownloadFileResult downloadFile(
     ref<Store> store,
     const std::string & url,
     const std::string & name,
-    bool immutable,
+    bool locked,
     const Headers & headers)
 {
     // FIXME: check store
@@ -88,7 +88,7 @@ DownloadFileResult downloadFile(
         inAttrs,
         infoAttrs,
         *storePath,
-        immutable);
+        locked);
 
     if (url != res.effectiveUri)
         getCache()->add(
@@ -100,7 +100,7 @@ DownloadFileResult downloadFile(
             },
             infoAttrs,
             *storePath,
-            immutable);
+            locked);
 
     return {
         .storePath = std::move(*storePath),
@@ -113,7 +113,7 @@ std::pair<Tree, time_t> downloadTarball(
     ref<Store> store,
     const std::string & url,
     const std::string & name,
-    bool immutable,
+    bool locked,
     const Headers & headers)
 {
     Attrs inAttrs({
@@ -130,7 +130,7 @@ std::pair<Tree, time_t> downloadTarball(
             getIntAttr(cached->infoAttrs, "lastModified")
         };
 
-    auto res = downloadFile(store, url, name, immutable, headers);
+    auto res = downloadFile(store, url, name, locked, headers);
 
     std::optional<StorePath> unpackedStorePath;
     time_t lastModified;
@@ -160,7 +160,7 @@ std::pair<Tree, time_t> downloadTarball(
         inAttrs,
         infoAttrs,
         *unpackedStorePath,
-        immutable);
+        locked);
 
     return {
         Tree { .actualPath = store->toRealPath(*unpackedStorePath), .storePath = std::move(*unpackedStorePath) },
@@ -202,7 +202,7 @@ struct TarballInputScheme : InputScheme
 
         Input input;
         input.attrs = attrs;
-        //input.immutable = (bool) maybeGetStrAttr(input.attrs, "hash");
+        //input.locked = (bool) maybeGetStrAttr(input.attrs, "hash");
         return input;
     }
 
diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index 508cbd336..0e8dc4380 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -415,7 +415,7 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
         for (size_t i = 0; i < manifest.elements.size(); ++i) {
             auto & element(manifest.elements[i]);
             if (element.source
-                && !element.source->originalRef.input.isImmutable()
+                && !element.source->originalRef.input.isLocked()
                 && matches(*store, element, i, matchers))
             {
                 upgradedCount++;
diff --git a/src/nix/repl.cc b/src/nix/repl.cc
index 60454471d..575eb0c4c 100644
--- a/src/nix/repl.cc
+++ b/src/nix/repl.cc
@@ -627,8 +627,8 @@ void NixRepl::loadFlake(const std::string & flakeRefS)
         throw Error("cannot use ':load-flake' without a path specified. (Use '.' for the current working directory.)");
 
     auto flakeRef = parseFlakeRef(flakeRefS, absPath("."), true);
-    if (evalSettings.pureEval && !flakeRef.input.isImmutable())
-        throw Error("cannot use ':load-flake' on mutable flake reference '%s' (use --impure to override)", flakeRefS);
+    if (evalSettings.pureEval && !flakeRef.input.isLocked())
+        throw Error("cannot use ':load-flake' on locked flake reference '%s' (use --impure to override)", flakeRefS);
 
     Value v;
 

From 9d4697453fc760597befa2e3eb887d2d6d375492 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 25 Feb 2022 09:21:04 +0100
Subject: [PATCH 062/251] ExprAttrs::show(): Show attrs in sorted order

Issue #6160.
---
 src/libexpr/nixexpr.cc | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/src/libexpr/nixexpr.cc b/src/libexpr/nixexpr.cc
index 2d2cd96cd..27ea0f2ad 100644
--- a/src/libexpr/nixexpr.cc
+++ b/src/libexpr/nixexpr.cc
@@ -103,11 +103,18 @@ void ExprAttrs::show(std::ostream & str) const
 {
     if (recursive) str << "rec ";
     str << "{ ";
-    for (auto & i : attrs)
-        if (i.second.inherited)
-            str << "inherit " << i.first << " " << "; ";
+    typedef const decltype(attrs)::value_type * Attr;
+    std::vector<Attr> sorted;
+    for (auto & i : attrs) sorted.push_back(&i);
+        std::sort(sorted.begin(), sorted.end(), [](Attr a, Attr b) {
+            return (const std::string &) a->first < (const std::string &) b->first;
+        });
+    for (auto & i : sorted) {
+        if (i->second.inherited)
+            str << "inherit " << i->first << " " << "; ";
         else
-            str << i.first << " = " << *i.second.e << "; ";
+            str << i->first << " = " << *i->second.e << "; ";
+    }
     for (auto & i : dynamicAttrs)
         str << "\"${" << *i.nameExpr << "}\" = " << *i.valueExpr << "; ";
     str << "}";

From 064cad7e9fec88a2906dd0f87084278ec119f3af Mon Sep 17 00:00:00 2001
From: toonn <toonn@toonn.io>
Date: Fri, 25 Feb 2022 10:32:45 +0100
Subject: [PATCH 063/251] doc: Add macOS uninstall note about /nix

Clarify that `/nix` being present after the uninstall is normal and it
will only disappear after a reboot.

Co-authored-by: Travis A. Everett <travis.a.everett@gmail.com>
---
 doc/manual/src/installation/installing-binary.md | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/doc/manual/src/installation/installing-binary.md b/doc/manual/src/installation/installing-binary.md
index ba90ce280..ea5c9febe 100644
--- a/doc/manual/src/installation/installing-binary.md
+++ b/doc/manual/src/installation/installing-binary.md
@@ -175,8 +175,16 @@ and `/etc/zshrc` which you may remove.
    This will remove the Nix Store volume and everything that was added to the
    store.
 
-The change to `/etc/synthetic.conf` will only take effect after a reboot but
-you shouldn't have any traces of Nix left on your system.
+> **Note**
+> 
+> After you complete the steps here, you will still have an empty `/nix`
+> directory. This is an expected sign of a successful uninstall. The empty
+> `/nix` directory will disappear the next time you reboot.
+>
+> You do not have to reboot to finish uninstalling Nix. The uninstall is
+> complete. macOS (Catalina+) directly controls root directories and its
+> read-only root will prevent you from manually deleting the empty `/nix`
+> mountpoint.
 
 # macOS Installation <a name="sect-macos-installation-change-store-prefix"></a><a name="sect-macos-installation-encrypted-volume"></a><a name="sect-macos-installation-symlink"></a><a name="sect-macos-installation-recommended-notes"></a>
 <!-- Note: anchors above to catch permalinks to old explanations -->

From 2df23e2b3e9dd456a42b93264ccd5390e88d8542 Mon Sep 17 00:00:00 2001
From: toonn <toonn@toonn.io>
Date: Fri, 25 Feb 2022 10:50:01 +0100
Subject: [PATCH 064/251] doc: Drop nix-darwin service from macOS uninstall

---
 doc/manual/src/installation/installing-binary.md | 2 --
 1 file changed, 2 deletions(-)

diff --git a/doc/manual/src/installation/installing-binary.md b/doc/manual/src/installation/installing-binary.md
index ea5c9febe..eb184c07b 100644
--- a/doc/manual/src/installation/installing-binary.md
+++ b/doc/manual/src/installation/installing-binary.md
@@ -131,8 +131,6 @@ and `/etc/zshrc` which you may remove.
    ```console
    sudo launchctl unload /Library/LaunchDaemons/org.nixos.nix-daemon.plist
    sudo rm /Library/LaunchDaemons/org.nixos.nix-daemon.plist
-   sudo launchctl unload /Library/LaunchDaemons/org.nixos.activate-system.plist
-   sudo rm /Library/LaunchDaemons/org.nixos.activate-system.plist
    ```
 
    This stops the Nix daemon and prevents it from being started next time you

From b312d4d09699fc7681b20a956a95c6964cef73e3 Mon Sep 17 00:00:00 2001
From: Kevin Amado <kamadorueda@gmail.com>
Date: Fri, 25 Feb 2022 09:16:16 -0500
Subject: [PATCH 065/251] refactor: remove verbose-build from docs

- From what I see it is an implementation detail
  but is no longer configurable from the settings
---
 src/libstore/globals.hh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libstore/globals.hh b/src/libstore/globals.hh
index 893c95bd6..4a78729e9 100644
--- a/src/libstore/globals.hh
+++ b/src/libstore/globals.hh
@@ -113,7 +113,7 @@ public:
     bool verboseBuild = true;
 
     Setting<size_t> logLines{this, 10, "log-lines",
-        "If `verbose-build` is false, the number of lines of the tail of "
+        "The number of lines of the tail of "
         "the log to show if a build fails."};
 
     MaxBuildJobsSetting maxBuildJobs{

From 14b38d0887f8a8d6b75039113eface57cfb19d06 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 25 Feb 2022 13:39:38 +0100
Subject: [PATCH 066/251] xml-writer: Remove std aliases

---
 src/libutil/xml-writer.cc | 10 ++++++----
 src/libutil/xml-writer.hh | 14 +++++---------
 src/nix-env/nix-env.cc    |  2 +-
 3 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/src/libutil/xml-writer.cc b/src/libutil/xml-writer.cc
index 68857e34d..7993bee9a 100644
--- a/src/libutil/xml-writer.cc
+++ b/src/libutil/xml-writer.cc
@@ -31,11 +31,12 @@ void XMLWriter::close()
 void XMLWriter::indent_(size_t depth)
 {
     if (!indent) return;
-    output << string(depth * 2, ' ');
+    output << std::string(depth * 2, ' ');
 }
 
 
-void XMLWriter::openElement(const string & name,
+void XMLWriter::openElement(
+    std::string_view name,
     const XMLAttrs & attrs)
 {
     assert(!closed);
@@ -44,7 +45,7 @@ void XMLWriter::openElement(const string & name,
     writeAttrs(attrs);
     output << ">";
     if (indent) output << std::endl;
-    pendingElems.push_back(name);
+    pendingElems.push_back(std::string(name));
 }
 
 
@@ -59,7 +60,8 @@ void XMLWriter::closeElement()
 }
 
 
-void XMLWriter::writeEmptyElement(const string & name,
+void XMLWriter::writeEmptyElement(
+    std::string_view name,
     const XMLAttrs & attrs)
 {
     assert(!closed);
diff --git a/src/libutil/xml-writer.hh b/src/libutil/xml-writer.hh
index b98b44526..4c91adee6 100644
--- a/src/libutil/xml-writer.hh
+++ b/src/libutil/xml-writer.hh
@@ -8,12 +8,8 @@
 
 namespace nix {
 
-using std::string;
-using std::map;
-using std::list;
 
-
-typedef map<string, string> XMLAttrs;
+typedef std::map<std::string, std::string> XMLAttrs;
 
 
 class XMLWriter
@@ -25,7 +21,7 @@ private:
     bool indent;
     bool closed;
 
-    list<string> pendingElems;
+    std::list<std::string> pendingElems;
 
 public:
 
@@ -34,11 +30,11 @@ public:
 
     void close();
 
-    void openElement(const string & name,
+    void openElement(std::string_view name,
         const XMLAttrs & attrs = XMLAttrs());
     void closeElement();
 
-    void writeEmptyElement(const string & name,
+    void writeEmptyElement(std::string_view name,
         const XMLAttrs & attrs = XMLAttrs());
 
 private:
@@ -53,7 +49,7 @@ class XMLOpenElement
 private:
     XMLWriter & writer;
 public:
-    XMLOpenElement(XMLWriter & writer, const string & name,
+    XMLOpenElement(XMLWriter & writer, std::string_view name,
         const XMLAttrs & attrs = XMLAttrs())
         : writer(writer)
     {
diff --git a/src/nix-env/nix-env.cc b/src/nix-env/nix-env.cc
index 52d07e3df..f83edb6a1 100644
--- a/src/nix-env/nix-env.cc
+++ b/src/nix-env/nix-env.cc
@@ -833,7 +833,7 @@ static bool cmpElemByName(const DrvInfo & a, const DrvInfo & b)
 }
 
 
-typedef list<Strings> Table;
+typedef std::list<Strings> Table;
 
 
 void printTable(Table & table)

From df552ff53e68dff8ca360adbdbea214ece1d08ee Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 25 Feb 2022 16:00:00 +0100
Subject: [PATCH 067/251] Remove std::string alias (for real this time)

Also use std::string_view in a few more places.
---
 perl/lib/Nix/Store.xs                         |  2 +-
 src/build-remote/build-remote.cc              | 10 +--
 src/libexpr/attr-path.cc                      |  6 +-
 src/libexpr/attr-path.hh                      |  7 +-
 src/libexpr/attr-set.hh                       |  2 +-
 src/libexpr/common-eval-args.cc               |  8 +-
 src/libexpr/common-eval-args.hh               |  2 +-
 src/libexpr/eval-cache.cc                     |  2 +-
 src/libexpr/eval.cc                           | 66 +++++++--------
 src/libexpr/eval.hh                           | 20 ++---
 src/libexpr/flake/flake.cc                    |  4 +-
 src/libexpr/get-drvs.cc                       | 40 ++++-----
 src/libexpr/get-drvs.hh                       | 46 +++++-----
 src/libexpr/nixexpr.cc                        | 14 ++--
 src/libexpr/nixexpr.hh                        | 19 +++--
 src/libexpr/parser.y                          | 30 +++----
 src/libexpr/primops.cc                        | 46 +++++-----
 src/libexpr/primops/context.cc                | 10 +--
 src/libexpr/primops/fetchMercurial.cc         |  2 +-
 src/libexpr/primops/fetchTree.cc              |  4 +-
 src/libexpr/primops/fromTOML.cc               |  2 +-
 src/libexpr/value-to-xml.cc                   |  2 +-
 src/libfetchers/mercurial.cc                  |  4 +-
 src/libmain/common-args.cc                    |  2 +-
 src/libmain/common-args.hh                    |  4 +-
 src/libmain/shared.cc                         | 16 ++--
 src/libmain/shared.hh                         | 14 ++--
 src/libstore/binary-cache-store.cc            | 17 +++-
 src/libstore/binary-cache-store.hh            | 18 ++--
 src/libstore/build/derivation-goal.cc         | 14 ++--
 src/libstore/build/derivation-goal.hh         |  4 +-
 .../build/drv-output-substitution-goal.cc     |  2 +-
 .../build/drv-output-substitution-goal.hh     |  2 +-
 src/libstore/build/goal.cc                    |  4 +-
 src/libstore/build/goal.hh                    |  8 +-
 src/libstore/build/local-derivation-goal.cc   | 64 ++++++++------
 src/libstore/build/local-derivation-goal.hh   |  2 +-
 src/libstore/build/substitution-goal.cc       |  2 +-
 src/libstore/build/substitution-goal.hh       |  4 +-
 src/libstore/build/worker.cc                  |  2 +-
 src/libstore/builtins/buildenv.cc             |  4 +-
 src/libstore/builtins/fetchurl.cc             |  2 +-
 src/libstore/builtins/unpack-channel.cc       |  2 +-
 src/libstore/daemon.cc                        |  8 +-
 src/libstore/derivations.cc                   | 32 +++----
 src/libstore/derivations.hh                   | 12 ++-
 src/libstore/derived-path.cc                  |  4 +-
 src/libstore/dummy-store.cc                   |  9 +-
 src/libstore/filetransfer.cc                  | 26 +++---
 src/libstore/filetransfer.hh                  |  8 +-
 src/libstore/gc.cc                            | 23 +++--
 src/libstore/globals.cc                       |  4 +-
 src/libstore/globals.hh                       |  2 +-
 src/libstore/legacy-ssh-store.cc              | 22 +++--
 src/libstore/local-fs-store.cc                |  2 +-
 src/libstore/local-fs-store.hh                |  2 +-
 src/libstore/local-store.cc                   | 29 ++++---
 src/libstore/local-store.hh                   | 13 ++-
 src/libstore/lock.hh                          |  4 +-
 src/libstore/machines.cc                      | 21 ++---
 src/libstore/nar-accessor.cc                  |  2 +-
 src/libstore/nar-info.cc                      |  2 +-
 src/libstore/optimise-store.cc                |  2 +-
 src/libstore/path-with-outputs.cc             |  4 +-
 src/libstore/path.hh                          |  2 +-
 src/libstore/pathlocks.cc                     |  4 +-
 src/libstore/pathlocks.hh                     |  4 +-
 src/libstore/profiles.cc                      | 16 ++--
 src/libstore/profiles.hh                      |  4 +-
 src/libstore/references.cc                    |  4 +-
 src/libstore/remote-store.cc                  | 11 ++-
 src/libstore/remote-store.hh                  |  7 +-
 src/libstore/s3-binary-cache-store.cc         | 11 ++-
 src/libstore/sqlite.cc                        |  2 +-
 src/libstore/ssh.cc                           |  2 +-
 src/libstore/store-api.cc                     | 32 ++++---
 src/libstore/store-api.hh                     | 26 ++++--
 src/libutil/archive.cc                        | 28 +++----
 src/libutil/archive.hh                        |  6 +-
 src/libutil/args.cc                           | 12 +--
 src/libutil/args.hh                           |  2 +-
 src/libutil/config.cc                         | 14 ++--
 src/libutil/error.cc                          | 12 +--
 src/libutil/error.hh                          | 26 +++---
 src/libutil/fmt.hh                            |  7 +-
 src/libutil/hash.cc                           | 19 +++--
 src/libutil/hash.hh                           |  6 +-
 src/libutil/logging.cc                        |  2 +-
 src/libutil/logging.hh                        |  2 +-
 src/libutil/serialise.cc                      |  4 +-
 src/libutil/serialise.hh                      |  4 +-
 src/libutil/tests/url.cc                      | 18 ++--
 src/libutil/types.hh                          |  1 +
 src/libutil/util.cc                           | 84 +++++++++----------
 src/libutil/util.hh                           | 44 +++++-----
 src/nix-build/nix-build.cc                    | 16 ++--
 src/nix-channel/nix-channel.cc                | 14 ++--
 .../nix-collect-garbage.cc                    |  2 +-
 src/nix-env/nix-env.cc                        | 82 +++++++++---------
 src/nix-env/user-env.cc                       |  2 +-
 src/nix-env/user-env.hh                       |  2 +-
 src/nix-instantiate/nix-instantiate.cc        |  2 +-
 src/nix-store/dotgraph.cc                     | 26 +++---
 src/nix-store/graphml.cc                      |  8 +-
 src/nix-store/nix-store.cc                    | 16 ++--
 src/nix/daemon.cc                             | 16 ++--
 src/nix/hash.cc                               |  2 +-
 src/nix/prefetch.cc                           | 14 ++--
 src/nix/repl.cc                               | 66 +++++++--------
 src/nix/why-depends.cc                        |  4 +-
 110 files changed, 773 insertions(+), 681 deletions(-)

diff --git a/perl/lib/Nix/Store.xs b/perl/lib/Nix/Store.xs
index edbf12f7c..54ad1680c 100644
--- a/perl/lib/Nix/Store.xs
+++ b/perl/lib/Nix/Store.xs
@@ -240,7 +240,7 @@ SV * convertHash(char * algo, char * s, int toBase32)
     PPCODE:
         try {
             auto h = Hash::parseAny(s, parseHashType(algo));
-            string s = h.to_string(toBase32 ? Base32 : Base16, false);
+            auto s = h.to_string(toBase32 ? Base32 : Base16, false);
             XPUSHs(sv_2mortal(newSVpv(s.c_str(), 0)));
         } catch (Error & e) {
             croak("%s", e.what());
diff --git a/src/build-remote/build-remote.cc b/src/build-remote/build-remote.cc
index 4d7b602d8..9d2eacb54 100644
--- a/src/build-remote/build-remote.cc
+++ b/src/build-remote/build-remote.cc
@@ -32,7 +32,7 @@ std::string escapeUri(std::string uri)
     return uri;
 }
 
-static string currentLoad;
+static std::string currentLoad;
 
 static AutoCloseFD openSlotLock(const Machine & m, uint64_t slot)
 {
@@ -97,7 +97,7 @@ static int main_build_remote(int argc, char * * argv)
         }
 
         std::optional<StorePath> drvPath;
-        string storeUri;
+        std::string storeUri;
 
         while (true) {
 
@@ -183,7 +183,7 @@ static int main_build_remote(int argc, char * * argv)
                     else
                     {
                         // build the hint template.
-                        string errorText =
+                        std::string errorText =
                             "Failed to find a machine for remote build!\n"
                             "derivation: %s\nrequired (system, features): (%s, %s)";
                         errorText += "\n%s available machines:";
@@ -193,7 +193,7 @@ static int main_build_remote(int argc, char * * argv)
                             errorText += "\n(%s, %s, %s, %s)";
 
                         // add the template values.
-                        string drvstr;
+                        std::string drvstr;
                         if (drvPath.has_value())
                             drvstr = drvPath->to_string();
                         else
@@ -208,7 +208,7 @@ static int main_build_remote(int argc, char * * argv)
 
                         for (auto & m : machines)
                             error
-                                % concatStringsSep<std::vector<string>>(", ", m.systemTypes)
+                                % concatStringsSep<std::vector<std::string>>(", ", m.systemTypes)
                                 % m.maxJobs
                                 % concatStringsSep<StringSet>(", ", m.supportedFeatures)
                                 % concatStringsSep<StringSet>(", ", m.mandatoryFeatures);
diff --git a/src/libexpr/attr-path.cc b/src/libexpr/attr-path.cc
index bf0c1dabc..eb0e706c7 100644
--- a/src/libexpr/attr-path.cc
+++ b/src/libexpr/attr-path.cc
@@ -9,7 +9,7 @@ namespace nix {
 static Strings parseAttrPath(std::string_view s)
 {
     Strings res;
-    string cur;
+    std::string cur;
     auto i = s.begin();
     while (i != s.end()) {
         if (*i == '.') {
@@ -41,7 +41,7 @@ std::vector<Symbol> parseAttrPath(EvalState & state, std::string_view s)
 }
 
 
-std::pair<Value *, Pos> findAlongAttrPath(EvalState & state, const string & attrPath,
+std::pair<Value *, Pos> findAlongAttrPath(EvalState & state, const std::string & attrPath,
     Bindings & autoArgs, Value & vIn)
 {
     Strings tokens = parseAttrPath(attrPath);
@@ -121,7 +121,7 @@ Pos findPackageFilename(EvalState & state, Value & v, std::string what)
     std::string filename(pos, 0, colon);
     unsigned int lineno;
     try {
-        lineno = std::stoi(std::string(pos, colon + 1, string::npos));
+        lineno = std::stoi(std::string(pos, colon + 1, std::string::npos));
     } catch (std::invalid_argument & e) {
         throw ParseError("cannot parse line number '%s'", pos);
     }
diff --git a/src/libexpr/attr-path.hh b/src/libexpr/attr-path.hh
index 2ee3ea089..ff1135a06 100644
--- a/src/libexpr/attr-path.hh
+++ b/src/libexpr/attr-path.hh
@@ -10,8 +10,11 @@ namespace nix {
 MakeError(AttrPathNotFound, Error);
 MakeError(NoPositionInfo, Error);
 
-std::pair<Value *, Pos> findAlongAttrPath(EvalState & state, const string & attrPath,
-    Bindings & autoArgs, Value & vIn);
+std::pair<Value *, Pos> findAlongAttrPath(
+    EvalState & state,
+    const std::string & attrPath,
+    Bindings & autoArgs,
+    Value & vIn);
 
 /* Heuristic to find the filename and lineno or a nix value. */
 Pos findPackageFilename(EvalState & state, Value & v, std::string what);
diff --git a/src/libexpr/attr-set.hh b/src/libexpr/attr-set.hh
index 3e4899efc..cad9743ea 100644
--- a/src/libexpr/attr-set.hh
+++ b/src/libexpr/attr-set.hh
@@ -105,7 +105,7 @@ public:
         for (size_t n = 0; n < size_; n++)
             res.emplace_back(&attrs[n]);
         std::sort(res.begin(), res.end(), [](const Attr * a, const Attr * b) {
-            return (const string &) a->name < (const string &) b->name;
+            return (const std::string &) a->name < (const std::string &) b->name;
         });
         return res;
     }
diff --git a/src/libexpr/common-eval-args.cc b/src/libexpr/common-eval-args.cc
index fffca4ac5..e50ff244c 100644
--- a/src/libexpr/common-eval-args.cc
+++ b/src/libexpr/common-eval-args.cc
@@ -77,7 +77,7 @@ Bindings * MixEvalArgs::getAutoArgs(EvalState & state)
     for (auto & i : autoArgs) {
         auto v = state.allocValue();
         if (i.second[0] == 'E')
-            state.mkThunk_(*v, state.parseExprFromString(string(i.second, 1), absPath(".")));
+            state.mkThunk_(*v, state.parseExprFromString(i.second.substr(1), absPath(".")));
         else
             v->mkString(((std::string_view) i.second).substr(1));
         res.insert(state.symbols.create(i.first), v);
@@ -85,17 +85,17 @@ Bindings * MixEvalArgs::getAutoArgs(EvalState & state)
     return res.finish();
 }
 
-Path lookupFileArg(EvalState & state, string s)
+Path lookupFileArg(EvalState & state, std::string_view s)
 {
     if (isUri(s)) {
         return state.store->toRealPath(
             fetchers::downloadTarball(
                 state.store, resolveUri(s), "source", false).first.storePath);
     } else if (s.size() > 2 && s.at(0) == '<' && s.at(s.size() - 1) == '>') {
-        Path p = s.substr(1, s.size() - 2);
+        Path p(s.substr(1, s.size() - 2));
         return state.findFile(p);
     } else
-        return absPath(s);
+        return absPath(std::string(s));
 }
 
 }
diff --git a/src/libexpr/common-eval-args.hh b/src/libexpr/common-eval-args.hh
index 0e113fff1..03fa226aa 100644
--- a/src/libexpr/common-eval-args.hh
+++ b/src/libexpr/common-eval-args.hh
@@ -22,6 +22,6 @@ private:
     std::map<std::string, std::string> autoArgs;
 };
 
-Path lookupFileArg(EvalState & state, string s);
+Path lookupFileArg(EvalState & state, std::string_view s);
 
 }
diff --git a/src/libexpr/eval-cache.cc b/src/libexpr/eval-cache.cc
index d6b9ea29b..00d0749f9 100644
--- a/src/libexpr/eval-cache.cc
+++ b/src/libexpr/eval-cache.cc
@@ -596,7 +596,7 @@ std::vector<Symbol> AttrCursor::getAttrs()
     for (auto & attr : *getValue().attrs)
         attrs.push_back(attr.name);
     std::sort(attrs.begin(), attrs.end(), [](const Symbol & a, const Symbol & b) {
-        return (const string &) a < (const string &) b;
+        return (const std::string &) a < (const std::string &) b;
     });
 
     if (root->db)
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 2d4eb57fc..60f0bf08c 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -174,7 +174,7 @@ std::ostream & operator << (std::ostream & str, const Value & v)
 }
 
 
-const Value *getPrimOp(const Value &v) {
+const Value * getPrimOp(const Value &v) {
     const Value * primOp = &v;
     while (primOp->isPrimOpApp()) {
         primOp = primOp->primOpApp.left;
@@ -183,7 +183,7 @@ const Value *getPrimOp(const Value &v) {
     return primOp;
 }
 
-string showType(ValueType type)
+std::string_view showType(ValueType type)
 {
     switch (type) {
         case nInt: return "an integer";
@@ -202,20 +202,20 @@ string showType(ValueType type)
 }
 
 
-string showType(const Value & v)
+std::string showType(const Value & v)
 {
     switch (v.internalType) {
         case tString: return v.string.context ? "a string with context" : "a string";
         case tPrimOp:
-            return fmt("the built-in function '%s'", string(v.primOp->name));
+            return fmt("the built-in function '%s'", std::string(v.primOp->name));
         case tPrimOpApp:
-            return fmt("the partially applied built-in function '%s'", string(getPrimOp(v)->primOp->name));
+            return fmt("the partially applied built-in function '%s'", std::string(getPrimOp(v)->primOp->name));
         case tExternal: return v.external->showType();
         case tThunk: return "a thunk";
         case tApp: return "a function application";
         case tBlackhole: return "a black hole";
     default:
-        return showType(v.type());
+        return std::string(showType(v.type()));
     }
 }
 
@@ -356,7 +356,7 @@ void initGC()
 
 /* Very hacky way to parse $NIX_PATH, which is colon-separated, but
    can contain URLs (e.g. "nixpkgs=https://bla...:foo=https://"). */
-static Strings parseNixPath(const string & s)
+static Strings parseNixPath(const std::string & s)
 {
     Strings res;
 
@@ -606,7 +606,7 @@ Path EvalState::toRealPath(const Path & path, const PathSet & context)
 }
 
 
-Value * EvalState::addConstant(const string & name, Value & v)
+Value * EvalState::addConstant(const std::string & name, Value & v)
 {
     Value * v2 = allocValue();
     *v2 = v;
@@ -615,19 +615,19 @@ Value * EvalState::addConstant(const string & name, Value & v)
 }
 
 
-void EvalState::addConstant(const string & name, Value * v)
+void EvalState::addConstant(const std::string & name, Value * v)
 {
     staticBaseEnv.vars.emplace_back(symbols.create(name), baseEnvDispl);
     baseEnv.values[baseEnvDispl++] = v;
-    string name2 = string(name, 0, 2) == "__" ? string(name, 2) : name;
+    auto name2 = name.substr(0, 2) == "__" ? name.substr(2) : name;
     baseEnv.values[0]->attrs->push_back(Attr(symbols.create(name2), v));
 }
 
 
-Value * EvalState::addPrimOp(const string & name,
+Value * EvalState::addPrimOp(const std::string & name,
     size_t arity, PrimOpFun primOp)
 {
-    auto name2 = string(name, 0, 2) == "__" ? string(name, 2) : name;
+    auto name2 = name.substr(0, 2) == "__" ? name.substr(2) : name;
     Symbol sym = symbols.create(name2);
 
     /* Hack to make constants lazy: turn them into a application of
@@ -675,7 +675,7 @@ Value * EvalState::addPrimOp(PrimOp && primOp)
 }
 
 
-Value & EvalState::getBuiltin(const string & name)
+Value & EvalState::getBuiltin(const std::string & name)
 {
     return *baseEnv.values[0]->attrs->find(symbols.create(name))->value;
 }
@@ -703,12 +703,12 @@ std::optional<EvalState::Doc> EvalState::getDoc(Value & v)
    evaluator.  So here are some helper functions for throwing
    exceptions. */
 
-LocalNoInlineNoReturn(void throwEvalError(const char * s, const string & s2))
+LocalNoInlineNoReturn(void throwEvalError(const char * s, const std::string & s2))
 {
     throw EvalError(s, s2);
 }
 
-LocalNoInlineNoReturn(void throwEvalError(const Pos & pos, const char * s, const string & s2))
+LocalNoInlineNoReturn(void throwEvalError(const Pos & pos, const char * s, const std::string & s2))
 {
     throw EvalError({
         .msg = hintfmt(s, s2),
@@ -716,12 +716,12 @@ LocalNoInlineNoReturn(void throwEvalError(const Pos & pos, const char * s, const
     });
 }
 
-LocalNoInlineNoReturn(void throwEvalError(const char * s, const string & s2, const string & s3))
+LocalNoInlineNoReturn(void throwEvalError(const char * s, const std::string & s2, const std::string & s3))
 {
     throw EvalError(s, s2, s3);
 }
 
-LocalNoInlineNoReturn(void throwEvalError(const Pos & pos, const char * s, const string & s2, const string & s3))
+LocalNoInlineNoReturn(void throwEvalError(const Pos & pos, const char * s, const std::string & s2, const std::string & s3))
 {
     throw EvalError({
         .msg = hintfmt(s, s2, s3),
@@ -759,7 +759,7 @@ LocalNoInlineNoReturn(void throwTypeError(const char * s, const Value & v))
     throw TypeError(s, showType(v));
 }
 
-LocalNoInlineNoReturn(void throwAssertionError(const Pos & pos, const char * s, const string & s1))
+LocalNoInlineNoReturn(void throwAssertionError(const Pos & pos, const char * s, const std::string & s1))
 {
     throw AssertionError({
         .msg = hintfmt(s, s1),
@@ -767,7 +767,7 @@ LocalNoInlineNoReturn(void throwAssertionError(const Pos & pos, const char * s,
     });
 }
 
-LocalNoInlineNoReturn(void throwUndefinedVarError(const Pos & pos, const char * s, const string & s1))
+LocalNoInlineNoReturn(void throwUndefinedVarError(const Pos & pos, const char * s, const std::string & s1))
 {
     throw UndefinedVarError({
         .msg = hintfmt(s, s1),
@@ -775,7 +775,7 @@ LocalNoInlineNoReturn(void throwUndefinedVarError(const Pos & pos, const char *
     });
 }
 
-LocalNoInlineNoReturn(void throwMissingArgumentError(const Pos & pos, const char * s, const string & s1))
+LocalNoInlineNoReturn(void throwMissingArgumentError(const Pos & pos, const char * s, const std::string & s1))
 {
     throw MissingArgumentError({
         .msg = hintfmt(s, s1),
@@ -783,12 +783,12 @@ LocalNoInlineNoReturn(void throwMissingArgumentError(const Pos & pos, const char
     });
 }
 
-LocalNoInline(void addErrorTrace(Error & e, const char * s, const string & s2))
+LocalNoInline(void addErrorTrace(Error & e, const char * s, const std::string & s2))
 {
     e.addTrace(std::nullopt, s, s2);
 }
 
-LocalNoInline(void addErrorTrace(Error & e, const Pos & pos, const char * s, const string & s2))
+LocalNoInline(void addErrorTrace(Error & e, const Pos & pos, const char * s, const std::string & s2))
 {
     e.addTrace(pos, s, s2);
 }
@@ -1221,7 +1221,7 @@ void ExprVar::eval(EvalState & state, Env & env, Value & v)
 }
 
 
-static string showAttrPath(EvalState & state, Env & env, const AttrPath & attrPath)
+static std::string showAttrPath(EvalState & state, Env & env, const AttrPath & attrPath)
 {
     std::ostringstream out;
     bool first = true;
@@ -1395,7 +1395,7 @@ void EvalState::callFunction(Value & fun, size_t nrArgs, Value * * args, Value &
                 if (loggerSettings.showTrace.get()) {
                     addErrorTrace(e, lambda.pos, "while evaluating %s",
                         (lambda.name.set()
-                            ? "'" + (string) lambda.name + "'"
+                            ? "'" + (const std::string &) lambda.name + "'"
                             : "anonymous lambda"));
                     addErrorTrace(e, pos, "from call site%s", "");
                 }
@@ -1883,7 +1883,7 @@ std::string_view EvalState::forceString(Value & v, const Pos & pos)
 
 /* Decode a context string ‘!<name>!<path>’ into a pair <path,
    name>. */
-std::pair<string, string> decodeContext(std::string_view s)
+std::pair<std::string, std::string> decodeContext(std::string_view s)
 {
     if (s.at(0) == '!') {
         size_t index = s.find("!", 1);
@@ -1946,7 +1946,7 @@ bool EvalState::isDerivation(Value & v)
 }
 
 
-std::optional<string> EvalState::tryAttrsToString(const Pos & pos, Value & v,
+std::optional<std::string> EvalState::tryAttrsToString(const Pos & pos, Value & v,
     PathSet & context, bool coerceMore, bool copyToStore)
 {
     auto i = v.attrs->find(sToString);
@@ -2001,7 +2001,7 @@ BackedStringView EvalState::coerceToString(const Pos & pos, Value & v, PathSet &
         if (v.type() == nNull) return "";
 
         if (v.isList()) {
-            string result;
+            std::string result;
             for (auto [n, v2] : enumerate(v.listItems())) {
                 result += *coerceToString(pos, *v2, context, coerceMore, copyToStore);
                 if (n < v.listSize() - 1
@@ -2017,7 +2017,7 @@ BackedStringView EvalState::coerceToString(const Pos & pos, Value & v, PathSet &
 }
 
 
-string EvalState::copyPathToStore(PathSet & context, const Path & path)
+std::string EvalState::copyPathToStore(PathSet & context, const Path & path)
 {
     if (nix::isDerivation(path))
         throwEvalError("file names are not allowed to end in '%1%'", drvExtension);
@@ -2043,7 +2043,7 @@ string EvalState::copyPathToStore(PathSet & context, const Path & path)
 
 Path EvalState::coerceToPath(const Pos & pos, Value & v, PathSet & context)
 {
-    string path = coerceToString(pos, v, context, false, false).toOwned();
+    auto path = coerceToString(pos, v, context, false, false).toOwned();
     if (path == "" || path[0] != '/')
         throwEvalError(pos, "string '%1%' doesn't represent an absolute path", path);
     return path;
@@ -2213,11 +2213,11 @@ void EvalState::printStats()
                 for (auto & i : functionCalls) {
                     auto obj = list.object();
                     if (i.first->name.set())
-                        obj.attr("name", (const string &) i.first->name);
+                        obj.attr("name", (const std::string &) i.first->name);
                     else
                         obj.attr("name", nullptr);
                     if (i.first->pos) {
-                        obj.attr("file", (const string &) i.first->pos.file);
+                        obj.attr("file", (const std::string &) i.first->pos.file);
                         obj.attr("line", i.first->pos.line);
                         obj.attr("column", i.first->pos.column);
                     }
@@ -2229,7 +2229,7 @@ void EvalState::printStats()
                 for (auto & i : attrSelects) {
                     auto obj = list.object();
                     if (i.first) {
-                        obj.attr("file", (const string &) i.first.file);
+                        obj.attr("file", (const std::string &) i.first.file);
                         obj.attr("line", i.first.line);
                         obj.attr("column", i.first.column);
                     }
@@ -2246,7 +2246,7 @@ void EvalState::printStats()
 }
 
 
-string ExternalValueBase::coerceToString(const Pos & pos, PathSet & context, bool copyMore, bool copyToStore) const
+std::string ExternalValueBase::coerceToString(const Pos & pos, PathSet & context, bool copyMore, bool copyToStore) const
 {
     throw TypeError({
         .msg = hintfmt("cannot coerce %1% to a string", showType()),
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index ce5a16e11..1f0e97b2e 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -150,7 +150,7 @@ public:
         const Pos & pos
     );
 
-    void addToSearchPath(const string & s);
+    void addToSearchPath(const std::string & s);
 
     SearchPath getSearchPath() { return searchPath; }
 
@@ -251,7 +251,7 @@ public:
        set with attribute `type = "derivation"'). */
     bool isDerivation(Value & v);
 
-    std::optional<string> tryAttrsToString(const Pos & pos, Value & v,
+    std::optional<std::string> tryAttrsToString(const Pos & pos, Value & v,
         PathSet & context, bool coerceMore = false, bool copyToStore = true);
 
     /* String coercion.  Converts strings, paths and derivations to a
@@ -262,7 +262,7 @@ public:
         bool coerceMore = false, bool copyToStore = true,
         bool canonicalizePath = true);
 
-    string copyPathToStore(PathSet & context, const Path & path);
+    std::string copyPathToStore(PathSet & context, const Path & path);
 
     /* Path coercion.  Converts strings, paths and derivations to a
        path.  The result is guaranteed to be a canonicalised, absolute
@@ -284,18 +284,18 @@ private:
 
     void createBaseEnv();
 
-    Value * addConstant(const string & name, Value & v);
+    Value * addConstant(const std::string & name, Value & v);
 
-    void addConstant(const string & name, Value * v);
+    void addConstant(const std::string & name, Value * v);
 
-    Value * addPrimOp(const string & name,
+    Value * addPrimOp(const std::string & name,
         size_t arity, PrimOpFun primOp);
 
     Value * addPrimOp(PrimOp && primOp);
 
 public:
 
-    Value & getBuiltin(const string & name);
+    Value & getBuiltin(const std::string & name);
 
     struct Doc
     {
@@ -414,12 +414,12 @@ private:
 
 
 /* Return a string representing the type of the value `v'. */
-string showType(ValueType type);
-string showType(const Value & v);
+std::string_view showType(ValueType type);
+std::string showType(const Value & v);
 
 /* Decode a context string ‘!<name>!<path>’ into a pair <path,
    name>. */
-std::pair<string, string> decodeContext(std::string_view s);
+std::pair<std::string, std::string> decodeContext(std::string_view s);
 
 /* If `path' refers to a directory, then append "/default.nix". */
 Path resolveExprPath(Path path);
diff --git a/src/libexpr/flake/flake.cc b/src/libexpr/flake/flake.cc
index 6e3fa41f7..ad0881641 100644
--- a/src/libexpr/flake/flake.cc
+++ b/src/libexpr/flake/flake.cc
@@ -254,7 +254,7 @@ static Flake getFlake(
         for (auto & setting : *nixConfig->value->attrs) {
             forceTrivialValue(state, *setting.value, *setting.pos);
             if (setting.value->type() == nString)
-                flake.config.settings.insert({setting.name, string(state.forceStringNoCtx(*setting.value, *setting.pos))});
+                flake.config.settings.insert({setting.name, std::string(state.forceStringNoCtx(*setting.value, *setting.pos))});
             else if (setting.value->type() == nPath) {
                 PathSet emptyContext = {};
                 flake.config.settings.emplace(
@@ -707,7 +707,7 @@ static void prim_getFlake(EvalState & state, const Pos & pos, Value * * args, Va
 {
     state.requireExperimentalFeatureOnEvaluation(Xp::Flakes, "builtins.getFlake", pos);
 
-    string flakeRefS(state.forceStringNoCtx(*args[0], pos));
+    std::string flakeRefS(state.forceStringNoCtx(*args[0], pos));
     auto flakeRef = parseFlakeRef(flakeRefS, {}, true);
     if (evalSettings.pureEval && !flakeRef.input.isLocked())
         throw Error("cannot call 'getFlake' on unlocked flake reference '%s', at %s (use --impure to override)", flakeRefS, pos);
diff --git a/src/libexpr/get-drvs.cc b/src/libexpr/get-drvs.cc
index 167fb5fa9..8393e4225 100644
--- a/src/libexpr/get-drvs.cc
+++ b/src/libexpr/get-drvs.cc
@@ -11,8 +11,8 @@
 namespace nix {
 
 
-DrvInfo::DrvInfo(EvalState & state, const string & attrPath, Bindings * attrs)
-    : state(&state), attrs(attrs), attrPath(attrPath)
+DrvInfo::DrvInfo(EvalState & state, std::string attrPath, Bindings * attrs)
+    : state(&state), attrs(attrs), attrPath(std::move(attrPath))
 {
 }
 
@@ -47,7 +47,7 @@ DrvInfo::DrvInfo(EvalState & state, ref<Store> store, const std::string & drvPat
 }
 
 
-string DrvInfo::queryName() const
+std::string DrvInfo::queryName() const
 {
     if (name == "" && attrs) {
         auto i = attrs->find(state->sName);
@@ -58,7 +58,7 @@ string DrvInfo::queryName() const
 }
 
 
-string DrvInfo::querySystem() const
+std::string DrvInfo::querySystem() const
 {
     if (system == "" && attrs) {
         auto i = attrs->find(state->sSystem);
@@ -68,7 +68,7 @@ string DrvInfo::querySystem() const
 }
 
 
-string DrvInfo::queryDrvPath() const
+std::string DrvInfo::queryDrvPath() const
 {
     if (drvPath == "" && attrs) {
         Bindings::iterator i = attrs->find(state->sDrvPath);
@@ -79,7 +79,7 @@ string DrvInfo::queryDrvPath() const
 }
 
 
-string DrvInfo::queryOutPath() const
+std::string DrvInfo::queryOutPath() const
 {
     if (!outPath && attrs) {
         Bindings::iterator i = attrs->find(state->sOutPath);
@@ -104,7 +104,7 @@ DrvInfo::Outputs DrvInfo::queryOutputs(bool onlyOutputsToInstall)
             /* For each output... */
             for (auto elem : i->value->listItems()) {
                 /* Evaluate the corresponding set. */
-                string name(state->forceStringNoCtx(*elem, *i->pos));
+                std::string name(state->forceStringNoCtx(*elem, *i->pos));
                 Bindings::iterator out = attrs->find(state->symbols.create(name));
                 if (out == attrs->end()) continue; // FIXME: throw error?
                 state->forceAttrs(*out->value, *i->pos);
@@ -138,7 +138,7 @@ DrvInfo::Outputs DrvInfo::queryOutputs(bool onlyOutputsToInstall)
 }
 
 
-string DrvInfo::queryOutputName() const
+std::string DrvInfo::queryOutputName() const
 {
     if (outputName == "" && attrs) {
         Bindings::iterator i = attrs->find(state->sOutputName);
@@ -190,7 +190,7 @@ bool DrvInfo::checkMeta(Value & v)
 }
 
 
-Value * DrvInfo::queryMeta(const string & name)
+Value * DrvInfo::queryMeta(const std::string & name)
 {
     if (!getMeta()) return 0;
     Bindings::iterator a = meta->find(state->symbols.create(name));
@@ -199,7 +199,7 @@ Value * DrvInfo::queryMeta(const string & name)
 }
 
 
-string DrvInfo::queryMetaString(const string & name)
+std::string DrvInfo::queryMetaString(const std::string & name)
 {
     Value * v = queryMeta(name);
     if (!v || v->type() != nString) return "";
@@ -207,7 +207,7 @@ string DrvInfo::queryMetaString(const string & name)
 }
 
 
-NixInt DrvInfo::queryMetaInt(const string & name, NixInt def)
+NixInt DrvInfo::queryMetaInt(const std::string & name, NixInt def)
 {
     Value * v = queryMeta(name);
     if (!v) return def;
@@ -221,7 +221,7 @@ NixInt DrvInfo::queryMetaInt(const string & name, NixInt def)
     return def;
 }
 
-NixFloat DrvInfo::queryMetaFloat(const string & name, NixFloat def)
+NixFloat DrvInfo::queryMetaFloat(const std::string & name, NixFloat def)
 {
     Value * v = queryMeta(name);
     if (!v) return def;
@@ -236,7 +236,7 @@ NixFloat DrvInfo::queryMetaFloat(const string & name, NixFloat def)
 }
 
 
-bool DrvInfo::queryMetaBool(const string & name, bool def)
+bool DrvInfo::queryMetaBool(const std::string & name, bool def)
 {
     Value * v = queryMeta(name);
     if (!v) return def;
@@ -251,7 +251,7 @@ bool DrvInfo::queryMetaBool(const string & name, bool def)
 }
 
 
-void DrvInfo::setMeta(const string & name, Value * v)
+void DrvInfo::setMeta(const std::string & name, Value * v)
 {
     getMeta();
     auto attrs = state->buildBindings(1 + (meta ? meta->size() : 0));
@@ -274,7 +274,7 @@ typedef std::set<Bindings *> Done;
    The result boolean indicates whether it makes sense
    for the caller to recursively search for derivations in `v'. */
 static bool getDerivation(EvalState & state, Value & v,
-    const string & attrPath, DrvInfos & drvs, Done & done,
+    const std::string & attrPath, DrvInfos & drvs, Done & done,
     bool ignoreAssertionFailures)
 {
     try {
@@ -311,7 +311,7 @@ std::optional<DrvInfo> getDerivation(EvalState & state, Value & v,
 }
 
 
-static string addToPath(const string & s1, const string & s2)
+static std::string addToPath(const std::string & s1, const std::string & s2)
 {
     return s1.empty() ? s2 : s1 + "." + s2;
 }
@@ -321,7 +321,7 @@ static std::regex attrRegex("[A-Za-z_][A-Za-z0-9-_+]*");
 
 
 static void getDerivations(EvalState & state, Value & vIn,
-    const string & pathPrefix, Bindings & autoArgs,
+    const std::string & pathPrefix, Bindings & autoArgs,
     DrvInfos & drvs, Done & done,
     bool ignoreAssertionFailures)
 {
@@ -346,7 +346,7 @@ static void getDerivations(EvalState & state, Value & vIn,
             debug("evaluating attribute '%1%'", i->name);
             if (!std::regex_match(std::string(i->name), attrRegex))
                 continue;
-            string pathPrefix2 = addToPath(pathPrefix, i->name);
+            std::string pathPrefix2 = addToPath(pathPrefix, i->name);
             if (combineChannels)
                 getDerivations(state, *i->value, pathPrefix2, autoArgs, drvs, done, ignoreAssertionFailures);
             else if (getDerivation(state, *i->value, pathPrefix2, drvs, done, ignoreAssertionFailures)) {
@@ -364,7 +364,7 @@ static void getDerivations(EvalState & state, Value & vIn,
 
     else if (v.type() == nList) {
         for (auto [n, elem] : enumerate(v.listItems())) {
-            string pathPrefix2 = addToPath(pathPrefix, fmt("%d", n));
+            std::string pathPrefix2 = addToPath(pathPrefix, fmt("%d", n));
             if (getDerivation(state, *elem, pathPrefix2, drvs, done, ignoreAssertionFailures))
                 getDerivations(state, *elem, pathPrefix2, autoArgs, drvs, done, ignoreAssertionFailures);
         }
@@ -374,7 +374,7 @@ static void getDerivations(EvalState & state, Value & vIn,
 }
 
 
-void getDerivations(EvalState & state, Value & v, const string & pathPrefix,
+void getDerivations(EvalState & state, Value & v, const std::string & pathPrefix,
     Bindings & autoArgs, DrvInfos & drvs, bool ignoreAssertionFailures)
 {
     Done done;
diff --git a/src/libexpr/get-drvs.hh b/src/libexpr/get-drvs.hh
index 128354682..d13847785 100644
--- a/src/libexpr/get-drvs.hh
+++ b/src/libexpr/get-drvs.hh
@@ -12,16 +12,16 @@ namespace nix {
 struct DrvInfo
 {
 public:
-    typedef std::map<string, Path> Outputs;
+    typedef std::map<std::string, Path> Outputs;
 
 private:
     EvalState * state;
 
-    mutable string name;
-    mutable string system;
-    mutable string drvPath;
-    mutable std::optional<string> outPath;
-    mutable string outputName;
+    mutable std::string name;
+    mutable std::string system;
+    mutable std::string drvPath;
+    mutable std::optional<std::string> outPath;
+    mutable std::string outputName;
     Outputs outputs;
 
     bool failed = false; // set if we get an AssertionError
@@ -33,36 +33,36 @@ private:
     bool checkMeta(Value & v);
 
 public:
-    string attrPath; /* path towards the derivation */
+    std::string attrPath; /* path towards the derivation */
 
     DrvInfo(EvalState & state) : state(&state) { };
-    DrvInfo(EvalState & state, const string & attrPath, Bindings * attrs);
+    DrvInfo(EvalState & state, std::string attrPath, Bindings * attrs);
     DrvInfo(EvalState & state, ref<Store> store, const std::string & drvPathWithOutputs);
 
-    string queryName() const;
-    string querySystem() const;
-    string queryDrvPath() const;
-    string queryOutPath() const;
-    string queryOutputName() const;
+    std::string queryName() const;
+    std::string querySystem() const;
+    std::string queryDrvPath() const;
+    std::string queryOutPath() const;
+    std::string queryOutputName() const;
     /** Return the list of outputs. The "outputs to install" are determined by `meta.outputsToInstall`. */
     Outputs queryOutputs(bool onlyOutputsToInstall = false);
 
     StringSet queryMetaNames();
-    Value * queryMeta(const string & name);
-    string queryMetaString(const string & name);
-    NixInt queryMetaInt(const string & name, NixInt def);
-    NixFloat queryMetaFloat(const string & name, NixFloat def);
-    bool queryMetaBool(const string & name, bool def);
-    void setMeta(const string & name, Value * v);
+    Value * queryMeta(const std::string & name);
+    std::string queryMetaString(const std::string & name);
+    NixInt queryMetaInt(const std::string & name, NixInt def);
+    NixFloat queryMetaFloat(const std::string & name, NixFloat def);
+    bool queryMetaBool(const std::string & name, bool def);
+    void setMeta(const std::string & name, Value * v);
 
     /*
     MetaInfo queryMetaInfo(EvalState & state) const;
     MetaValue queryMetaInfo(EvalState & state, const string & name) const;
     */
 
-    void setName(const string & s) { name = s; }
-    void setDrvPath(const string & s) { drvPath = s; }
-    void setOutPath(const string & s) { outPath = s; }
+    void setName(const std::string & s) { name = s; }
+    void setDrvPath(const std::string & s) { drvPath = s; }
+    void setOutPath(const std::string & s) { outPath = s; }
 
     void setFailed() { failed = true; };
     bool hasFailed() { return failed; };
@@ -81,7 +81,7 @@ typedef std::list<DrvInfo> DrvInfos;
 std::optional<DrvInfo> getDerivation(EvalState & state,
     Value & v, bool ignoreAssertionFailures);
 
-void getDerivations(EvalState & state, Value & v, const string & pathPrefix,
+void getDerivations(EvalState & state, Value & v, const std::string & pathPrefix,
     Bindings & autoArgs, DrvInfos & drvs,
     bool ignoreAssertionFailures);
 
diff --git a/src/libexpr/nixexpr.cc b/src/libexpr/nixexpr.cc
index 27ea0f2ad..a2def65a6 100644
--- a/src/libexpr/nixexpr.cc
+++ b/src/libexpr/nixexpr.cc
@@ -16,10 +16,10 @@ std::ostream & operator << (std::ostream & str, const Expr & e)
     return str;
 }
 
-static void showString(std::ostream & str, const string & s)
+static void showString(std::ostream & str, std::string_view s)
 {
     str << '"';
-    for (auto c : (string) s)
+    for (auto c : s)
         if (c == '"' || c == '\\' || c == '$') str << "\\" << c;
         else if (c == '\n') str << "\\n";
         else if (c == '\r') str << "\\r";
@@ -28,7 +28,7 @@ static void showString(std::ostream & str, const string & s)
     str << '"';
 }
 
-static void showId(std::ostream & str, const string & s)
+static void showId(std::ostream & str, std::string_view s)
 {
     if (s.empty())
         str << "\"\"";
@@ -218,7 +218,7 @@ std::ostream & operator << (std::ostream & str, const Pos & pos)
         auto f = format(ANSI_BOLD "%1%" ANSI_NORMAL ":%2%:%3%");
         switch (pos.origin) {
             case foFile:
-                f % (string) pos.file;
+                f % (const std::string &) pos.file;
                 break;
             case foStdin:
             case foString:
@@ -234,7 +234,7 @@ std::ostream & operator << (std::ostream & str, const Pos & pos)
 }
 
 
-string showAttrPath(const AttrPath & attrPath)
+std::string showAttrPath(const AttrPath & attrPath)
 {
     std::ostringstream out;
     bool first = true;
@@ -468,9 +468,9 @@ void ExprLambda::setName(Symbol & name)
 }
 
 
-string ExprLambda::showNamePos() const
+std::string ExprLambda::showNamePos() const
 {
-    return (format("%1% at %2%") % (name.set() ? "'" + (string) name + "'" : "anonymous function") % pos).str();
+    return fmt("%1% at %2%", name.set() ? "'" + (std::string) name + "'" : "anonymous function", pos);
 }
 
 
diff --git a/src/libexpr/nixexpr.hh b/src/libexpr/nixexpr.hh
index e7f717eba..12b54b8eb 100644
--- a/src/libexpr/nixexpr.hh
+++ b/src/libexpr/nixexpr.hh
@@ -26,18 +26,21 @@ struct Pos
     FileOrigin origin;
     Symbol file;
     unsigned int line, column;
-    Pos() : origin(foString), line(0), column(0) { };
+
+    Pos() : origin(foString), line(0), column(0) { }
     Pos(FileOrigin origin, const Symbol & file, unsigned int line, unsigned int column)
-        : origin(origin), file(file), line(line), column(column) { };
+        : origin(origin), file(file), line(line), column(column) { }
+
     operator bool() const
     {
         return line != 0;
     }
+
     bool operator < (const Pos & p2) const
     {
         if (!line) return p2.line;
         if (!p2.line) return false;
-        int d = ((string) file).compare((string) p2.file);
+        int d = ((const std::string &) file).compare((const std::string &) p2.file);
         if (d < 0) return true;
         if (d > 0) return false;
         if (line < p2.line) return true;
@@ -68,7 +71,7 @@ struct AttrName
 
 typedef std::vector<AttrName> AttrPath;
 
-string showAttrPath(const AttrPath & attrPath);
+std::string showAttrPath(const AttrPath & attrPath);
 
 
 /* Abstract syntax of Nix expressions. */
@@ -110,7 +113,7 @@ struct ExprFloat : Expr
 
 struct ExprString : Expr
 {
-    string s;
+    std::string s;
     Value v;
     ExprString(std::string s) : s(std::move(s)) { v.mkString(this->s.data()); };
     COMMON_METHODS
@@ -119,9 +122,9 @@ struct ExprString : Expr
 
 struct ExprPath : Expr
 {
-    string s;
+    std::string s;
     Value v;
-    ExprPath(const string & s) : s(s) { v.mkPath(this->s.c_str()); };
+    ExprPath(std::string s) : s(std::move(s)) { v.mkPath(this->s.c_str()); };
     COMMON_METHODS
     Value * maybeThunk(EvalState & state, Env & env);
 };
@@ -249,7 +252,7 @@ struct ExprLambda : Expr
     {
     };
     void setName(Symbol & name);
-    string showNamePos() const;
+    std::string showNamePos() const;
     inline bool hasFormals() const { return formals != nullptr; }
     COMMON_METHODS
 };
diff --git a/src/libexpr/parser.y b/src/libexpr/parser.y
index e1d177c1f..919b9cfae 100644
--- a/src/libexpr/parser.y
+++ b/src/libexpr/parser.y
@@ -244,7 +244,7 @@ static Expr * stripIndentation(const Pos & pos, SymbolTable & symbols,
         es2->emplace_back(i->first, e);
     };
     const auto trimString = [&] (const StringToken & t) {
-        string s2;
+        std::string s2;
         for (size_t j = 0; j < t.l; ++j) {
             if (atStartOfLine) {
                 if (t.p[j] == ' ') {
@@ -268,9 +268,9 @@ static Expr * stripIndentation(const Pos & pos, SymbolTable & symbols,
         /* Remove the last line if it is empty and consists only of
            spaces. */
         if (n == 1) {
-            string::size_type p = s2.find_last_of('\n');
-            if (p != string::npos && s2.find_first_not_of(' ', p + 1) == string::npos)
-                s2 = string(s2, 0, p + 1);
+            std::string::size_type p = s2.find_last_of('\n');
+            if (p != std::string::npos && s2.find_first_not_of(' ', p + 1) == std::string::npos)
+                s2 = std::string(s2, 0, p + 1);
         }
 
         es2->emplace_back(i->first, new ExprString(s2));
@@ -466,7 +466,7 @@ expr_simple
       $$ = new ExprConcatStrings(CUR_POS, false, $2);
   }
   | SPATH {
-      string path($1.p + 1, $1.l - 2);
+      std::string path($1.p + 1, $1.l - 2);
       $$ = new ExprCall(CUR_POS,
           new ExprVar(data->symbols.create("__findFile")),
           {new ExprVar(data->symbols.create("__nixPath")),
@@ -479,7 +479,7 @@ expr_simple
               .msg = hintfmt("URL literals are disabled"),
               .errPos = CUR_POS
           });
-      $$ = new ExprString(string($1));
+      $$ = new ExprString(std::string($1));
   }
   | '(' expr ')' { $$ = $2; }
   /* Let expressions `let {..., body = ...}' are just desugared
@@ -494,19 +494,19 @@ expr_simple
   ;
 
 string_parts
-  : STR { $$ = new ExprString(string($1)); }
+  : STR { $$ = new ExprString(std::string($1)); }
   | string_parts_interpolated { $$ = new ExprConcatStrings(CUR_POS, true, $1); }
   | { $$ = new ExprString(""); }
   ;
 
 string_parts_interpolated
   : string_parts_interpolated STR
-  { $$ = $1; $1->emplace_back(makeCurPos(@2, data), new ExprString(string($2))); }
+  { $$ = $1; $1->emplace_back(makeCurPos(@2, data), new ExprString(std::string($2))); }
   | string_parts_interpolated DOLLAR_CURLY expr '}' { $$ = $1; $1->emplace_back(makeCurPos(@2, data), $3); }
   | DOLLAR_CURLY expr '}' { $$ = new std::vector<std::pair<Pos, Expr *> >; $$->emplace_back(makeCurPos(@1, data), $2); }
   | STR DOLLAR_CURLY expr '}' {
       $$ = new std::vector<std::pair<Pos, Expr *> >;
-      $$->emplace_back(makeCurPos(@1, data), new ExprString(string($1)));
+      $$->emplace_back(makeCurPos(@1, data), new ExprString(std::string($1)));
       $$->emplace_back(makeCurPos(@2, data), $3);
     }
   ;
@@ -520,7 +520,7 @@ path_start
     $$ = new ExprPath(path);
   }
   | HPATH {
-    Path path(getHome() + string($1.p + 1, $1.l - 1));
+    Path path(getHome() + std::string($1.p + 1, $1.l - 1));
     $$ = new ExprPath(path);
   }
   ;
@@ -738,16 +738,16 @@ Expr * EvalState::parseStdin()
 }
 
 
-void EvalState::addToSearchPath(const string & s)
+void EvalState::addToSearchPath(const std::string & s)
 {
     size_t pos = s.find('=');
-    string prefix;
+    std::string prefix;
     Path path;
-    if (pos == string::npos) {
+    if (pos == std::string::npos) {
         path = s;
     } else {
-        prefix = string(s, 0, pos);
-        path = string(s, pos + 1);
+        prefix = std::string(s, 0, pos);
+        path = std::string(s, pos + 1);
     }
 
     searchPath.emplace_back(prefix, path);
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index daf679a5a..aa22c3b61 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -141,7 +141,7 @@ static void mkOutputString(
     BindingsBuilder & attrs,
     const StorePath & drvPath,
     const BasicDerivation & drv,
-    const std::pair<string, DerivationOutput> & o)
+    const std::pair<std::string, DerivationOutput> & o)
 {
     auto optOutputPath = o.second.path(*state.store, drv.name, o.first);
     attrs.alloc(o.first).mkString(
@@ -314,7 +314,7 @@ void prim_importNative(EvalState & state, const Pos & pos, Value * * args, Value
 {
     auto path = realisePath(state, pos, *args[0]);
 
-    string sym(state.forceStringNoCtx(*args[1], pos));
+    std::string sym(state.forceStringNoCtx(*args[1], pos));
 
     void *handle = dlopen(path.c_str(), RTLD_LAZY | RTLD_LOCAL);
     if (!handle)
@@ -386,7 +386,7 @@ void prim_exec(EvalState & state, const Pos & pos, Value * * args, Value & v)
 static void prim_typeOf(EvalState & state, const Pos & pos, Value * * args, Value & v)
 {
     state.forceValue(*args[0], pos);
-    string t;
+    std::string t;
     switch (args[0]->type()) {
         case nInt: t = "int"; break;
         case nBool: t = "bool"; break;
@@ -707,7 +707,7 @@ static RegisterPrimOp primop_abort({
     .fun = [](EvalState & state, const Pos & pos, Value * * args, Value & v)
     {
         PathSet context;
-        string s = state.coerceToString(pos, *args[0], context).toOwned();
+        auto s = state.coerceToString(pos, *args[0], context).toOwned();
         throw Abort("evaluation aborted with the following error message: '%1%'", s);
     }
 });
@@ -725,7 +725,7 @@ static RegisterPrimOp primop_throw({
     .fun = [](EvalState & state, const Pos & pos, Value * * args, Value & v)
     {
       PathSet context;
-      string s = state.coerceToString(pos, *args[0], context).toOwned();
+      auto s = state.coerceToString(pos, *args[0], context).toOwned();
       throw ThrownError(s);
     }
 });
@@ -826,7 +826,7 @@ static RegisterPrimOp primop_tryEval({
 /* Return an environment variable.  Use with care. */
 static void prim_getEnv(EvalState & state, const Pos & pos, Value * * args, Value & v)
 {
-    string name(state.forceStringNoCtx(*args[0], pos));
+    std::string name(state.forceStringNoCtx(*args[0], pos));
     v.mkString(evalSettings.restrictEval || evalSettings.pureEval ? "" : getEnv(name).value_or(""));
 }
 
@@ -935,7 +935,7 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
         pos
     );
 
-    string drvName;
+    std::string drvName;
     Pos & posDrvName(*attr->pos);
     try {
         drvName = state.forceStringNoCtx(*attr->value, pos);
@@ -973,7 +973,7 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
 
     for (auto & i : args[0]->attrs->lexicographicOrder()) {
         if (i->name == state.sIgnoreNulls) continue;
-        const string & key = i->name;
+        const std::string & key = i->name;
         vomit("processing attribute '%1%'", key);
 
         auto handleHashMode = [&](const std::string_view s) {
@@ -1031,7 +1031,7 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
             else if (i->name == state.sArgs) {
                 state.forceList(*i->value, pos);
                 for (auto elem : i->value->listItems()) {
-                    string s = state.coerceToString(posDrvName, *elem, context, true).toOwned();
+                    auto s = state.coerceToString(posDrvName, *elem, context, true).toOwned();
                     drv.args.push_back(s);
                 }
             }
@@ -1118,7 +1118,7 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
 
         /* Handle derivation outputs of the form ‘!<name>!<path>’. */
         else if (path.at(0) == '!') {
-            std::pair<string, string> ctx = decodeContext(path);
+            auto ctx = decodeContext(path);
             drv.inputDrvs[state.store->parseStorePath(ctx.first)].insert(ctx.second);
         }
 
@@ -1440,8 +1440,8 @@ static RegisterPrimOp primop_dirOf({
 static void prim_readFile(EvalState & state, const Pos & pos, Value * * args, Value & v)
 {
     auto path = realisePath(state, pos, *args[0]);
-    string s = readFile(path);
-    if (s.find((char) 0) != string::npos)
+    auto s = readFile(path);
+    if (s.find((char) 0) != std::string::npos)
         throw Error("the contents of the file '%1%' cannot be represented as a Nix string", path);
     StorePathSet refs;
     if (state.store->isInStore(path)) {
@@ -1474,7 +1474,7 @@ static void prim_findFile(EvalState & state, const Pos & pos, Value * * args, Va
     for (auto v2 : args[0]->listItems()) {
         state.forceAttrs(*v2, pos);
 
-        string prefix;
+        std::string prefix;
         Bindings::iterator i = v2->attrs->find(state.sPrefix);
         if (i != v2->attrs->end())
             prefix = state.forceStringNoCtx(*i->value, pos);
@@ -1488,7 +1488,7 @@ static void prim_findFile(EvalState & state, const Pos & pos, Value * * args, Va
         );
 
         PathSet context;
-        string path = state.coerceToString(pos, *i->value, context, false, false).toOwned();
+        auto path = state.coerceToString(pos, *i->value, context, false, false).toOwned();
 
         try {
             auto rewrites = state.realiseContext(context);
@@ -1754,8 +1754,8 @@ static RegisterPrimOp primop_fromJSON({
 static void prim_toFile(EvalState & state, const Pos & pos, Value * * args, Value & v)
 {
     PathSet context;
-    string name(state.forceStringNoCtx(*args[0], pos));
-    string contents(state.forceString(*args[1], context, pos));
+    std::string name(state.forceStringNoCtx(*args[0], pos));
+    std::string contents(state.forceString(*args[1], context, pos));
 
     StorePathSet refs;
 
@@ -1863,7 +1863,7 @@ static RegisterPrimOp primop_toFile({
 static void addPath(
     EvalState & state,
     const Pos & pos,
-    const string & name,
+    const std::string & name,
     Path path,
     Value * filterFun,
     FileIngestionMethod method,
@@ -2016,14 +2016,14 @@ static void prim_path(EvalState & state, const Pos & pos, Value * * args, Value
 {
     state.forceAttrs(*args[0], pos);
     Path path;
-    string name;
+    std::string name;
     Value * filterFun = nullptr;
     auto method = FileIngestionMethod::Recursive;
     std::optional<Hash> expectedHash;
     PathSet context;
 
     for (auto & attr : *args[0]->attrs) {
-        const string & n(attr.name);
+        auto & n(attr.name);
         if (n == "path")
             path = state.coerceToPath(*attr.pos, *attr.value, context);
         else if (attr.name == state.sName)
@@ -3616,7 +3616,7 @@ static void prim_concatStringsSep(EvalState & state, const Pos & pos, Value * *
     auto sep = state.forceString(*args[0], context, pos);
     state.forceList(*args[1], pos);
 
-    string res;
+    std::string res;
     res.reserve((args[1]->listSize() + 32) * sep.size());
     bool first = true;
 
@@ -3649,12 +3649,12 @@ static void prim_replaceStrings(EvalState & state, const Pos & pos, Value * * ar
             .errPos = pos
         });
 
-    std::vector<string> from;
+    std::vector<std::string> from;
     from.reserve(args[0]->listSize());
     for (auto elem : args[0]->listItems())
         from.emplace_back(state.forceString(*elem, pos));
 
-    std::vector<std::pair<string, PathSet>> to;
+    std::vector<std::pair<std::string, PathSet>> to;
     to.reserve(args[1]->listSize());
     for (auto elem : args[1]->listItems()) {
         PathSet ctx;
@@ -3665,7 +3665,7 @@ static void prim_replaceStrings(EvalState & state, const Pos & pos, Value * * ar
     PathSet context;
     auto s = state.forceString(*args[2], context, pos);
 
-    string res;
+    std::string res;
     // Loops one past last character to handle the case where 'from' contains an empty string.
     for (size_t p = 0; p <= s.size(); ) {
         bool found = false;
diff --git a/src/libexpr/primops/context.cc b/src/libexpr/primops/context.cc
index 654251c23..3701bd442 100644
--- a/src/libexpr/primops/context.cc
+++ b/src/libexpr/primops/context.cc
@@ -37,7 +37,7 @@ static void prim_unsafeDiscardOutputDependency(EvalState & state, const Pos & po
 
     PathSet context2;
     for (auto & p : context)
-        context2.insert(p.at(0) == '=' ? string(p, 1) : p);
+        context2.insert(p.at(0) == '=' ? std::string(p, 1) : p);
 
     v.mkString(*s, context2);
 }
@@ -76,13 +76,13 @@ static void prim_getContext(EvalState & state, const Pos & pos, Value * * args,
     auto contextInfos = std::map<Path, ContextInfo>();
     for (const auto & p : context) {
         Path drv;
-        string output;
+        std::string output;
         const Path * path = &p;
         if (p.at(0) == '=') {
-            drv = string(p, 1);
+            drv = std::string(p, 1);
             path = &drv;
         } else if (p.at(0) == '!') {
-            std::pair<string, string> ctx = decodeContext(p);
+            std::pair<std::string, std::string> ctx = decodeContext(p);
             drv = ctx.first;
             output = ctx.second;
             path = &drv;
@@ -166,7 +166,7 @@ static void prim_appendContext(EvalState & state, const Pos & pos, Value * * arg
                         .errPos = *i.pos
                     });
                 }
-                context.insert("=" + string(i.name));
+                context.insert("=" + std::string(i.name));
             }
         }
 
diff --git a/src/libexpr/primops/fetchMercurial.cc b/src/libexpr/primops/fetchMercurial.cc
index c4e1a7bf0..b7f715859 100644
--- a/src/libexpr/primops/fetchMercurial.cc
+++ b/src/libexpr/primops/fetchMercurial.cc
@@ -62,7 +62,7 @@ static void prim_fetchMercurial(EvalState & state, const Pos & pos, Value * * ar
     fetchers::Attrs attrs;
     attrs.insert_or_assign("type", "hg");
     attrs.insert_or_assign("url", url.find("://") != std::string::npos ? url : "file://" + url);
-    attrs.insert_or_assign("name", string(name));
+    attrs.insert_or_assign("name", std::string(name));
     if (ref) attrs.insert_or_assign("ref", *ref);
     if (rev) attrs.insert_or_assign("rev", rev->gitRev());
     auto input = fetchers::Input::fromAttrs(std::move(attrs));
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index 7496104b6..f3e3e70d8 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -186,7 +186,7 @@ static void prim_fetchTree(EvalState & state, const Pos & pos, Value * * args, V
 static RegisterPrimOp primop_fetchTree("fetchTree", 1, prim_fetchTree);
 
 static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
-    const string & who, bool unpack, std::string name)
+    const std::string & who, bool unpack, std::string name)
 {
     std::optional<std::string> url;
     std::optional<Hash> expectedHash;
@@ -198,7 +198,7 @@ static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
         state.forceAttrs(*args[0], pos);
 
         for (auto & attr : *args[0]->attrs) {
-            string n(attr.name);
+            std::string n(attr.name);
             if (n == "url")
                 url = state.forceStringNoCtx(*attr.value, *attr.pos);
             else if (n == "sha256")
diff --git a/src/libexpr/primops/fromTOML.cc b/src/libexpr/primops/fromTOML.cc
index c0e858b61..dd4280030 100644
--- a/src/libexpr/primops/fromTOML.cc
+++ b/src/libexpr/primops/fromTOML.cc
@@ -9,7 +9,7 @@ static void prim_fromTOML(EvalState & state, const Pos & pos, Value * * args, Va
 {
     auto toml = state.forceStringNoCtx(*args[0], pos);
 
-    std::istringstream tomlStream(string{toml});
+    std::istringstream tomlStream(std::string{toml});
 
     std::function<void(Value &, toml::value)> visit;
 
diff --git a/src/libexpr/value-to-xml.cc b/src/libexpr/value-to-xml.cc
index a9fb60b0e..afeaf5694 100644
--- a/src/libexpr/value-to-xml.cc
+++ b/src/libexpr/value-to-xml.cc
@@ -9,7 +9,7 @@
 namespace nix {
 
 
-static XMLAttrs singletonAttrs(const string & name, const string & value)
+static XMLAttrs singletonAttrs(const std::string & name, const std::string & value)
 {
     XMLAttrs attrs;
     attrs[name] = value;
diff --git a/src/libfetchers/mercurial.cc b/src/libfetchers/mercurial.cc
index 798369c7a..12cdecbc1 100644
--- a/src/libfetchers/mercurial.cc
+++ b/src/libfetchers/mercurial.cc
@@ -26,7 +26,7 @@ static RunOptions hgOptions(const Strings & args)
 }
 
 // runProgram wrapper that uses hgOptions instead of stock RunOptions.
-static string runHg(const Strings & args, const std::optional<std::string> & input = {})
+static std::string runHg(const Strings & args, const std::optional<std::string> & input = {})
 {
     RunOptions opts = hgOptions(args);
     opts.input = input;
@@ -254,7 +254,7 @@ struct MercurialInputScheme : InputScheme
                     runHg({ "pull", "-R", cacheDir, "--", actualUrl });
                 }
                 catch (ExecError & e) {
-                    string transJournal = cacheDir + "/.hg/store/journal";
+                    auto transJournal = cacheDir + "/.hg/store/journal";
                     /* hg throws "abandoned transaction" error only if this file exists */
                     if (pathExists(transJournal)) {
                         runHg({ "recover", "-R", cacheDir });
diff --git a/src/libmain/common-args.cc b/src/libmain/common-args.cc
index c43e9ebd2..12f5403ea 100644
--- a/src/libmain/common-args.cc
+++ b/src/libmain/common-args.cc
@@ -4,7 +4,7 @@
 
 namespace nix {
 
-MixCommonArgs::MixCommonArgs(const string & programName)
+MixCommonArgs::MixCommonArgs(const std::string & programName)
     : programName(programName)
 {
     addFlag({
diff --git a/src/libmain/common-args.hh b/src/libmain/common-args.hh
index 31bdf527a..25453b8c6 100644
--- a/src/libmain/common-args.hh
+++ b/src/libmain/common-args.hh
@@ -11,8 +11,8 @@ class MixCommonArgs : public virtual Args
 {
     void initialFlagsProcessed() override;
 public:
-    string programName;
-    MixCommonArgs(const string & programName);
+    std::string programName;
+    MixCommonArgs(const std::string & programName);
 protected:
     virtual void pluginsInited() {}
 };
diff --git a/src/libmain/shared.cc b/src/libmain/shared.cc
index f605184bb..47fc7ab2e 100644
--- a/src/libmain/shared.cc
+++ b/src/libmain/shared.cc
@@ -94,7 +94,7 @@ void printMissing(ref<Store> store, const StorePathSet & willBuild,
 }
 
 
-string getArg(const string & opt,
+std::string getArg(const std::string & opt,
     Strings::iterator & i, const Strings::iterator & end)
 {
     ++i;
@@ -227,6 +227,8 @@ LegacyArgs::LegacyArgs(const std::string & programName,
     std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg)
     : MixCommonArgs(programName), parseArg(parseArg)
 {
+    printError("FOO %s", programName);
+    
     addFlag({
         .longName = "no-build-output",
         .shortName = 'Q',
@@ -322,14 +324,14 @@ void parseCmdLine(int argc, char * * argv,
 }
 
 
-void parseCmdLine(const string & programName, const Strings & args,
+void parseCmdLine(const std::string & programName, const Strings & args,
     std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg)
 {
     LegacyArgs(programName, parseArg).parseCmdline(args);
 }
 
 
-void printVersion(const string & programName)
+void printVersion(const std::string & programName)
 {
     std::cout << format("%1% (Nix) %2%") % programName % nixVersion << std::endl;
     if (verbosity > lvlInfo) {
@@ -352,7 +354,7 @@ void printVersion(const string & programName)
 }
 
 
-void showManPage(const string & name)
+void showManPage(const std::string & name)
 {
     restoreProcessContext();
     setenv("MANPATH", settings.nixManDir.c_str(), 1);
@@ -361,13 +363,13 @@ void showManPage(const string & name)
 }
 
 
-int handleExceptions(const string & programName, std::function<void()> fun)
+int handleExceptions(const std::string & programName, std::function<void()> fun)
 {
     ReceiveInterrupts receiveInterrupts; // FIXME: need better place for this
 
     ErrorInfo::programName = baseNameOf(programName);
 
-    string error = ANSI_RED "error:" ANSI_NORMAL " ";
+    std::string error = ANSI_RED "error:" ANSI_NORMAL " ";
     try {
         try {
             fun();
@@ -407,7 +409,7 @@ RunPager::RunPager()
     if (!isatty(STDOUT_FILENO)) return;
     char * pager = getenv("NIX_PAGER");
     if (!pager) pager = getenv("PAGER");
-    if (pager && ((string) pager == "" || (string) pager == "cat")) return;
+    if (pager && ((std::string) pager == "" || (std::string) pager == "cat")) return;
 
     Pipe toPager;
     toPager.create();
diff --git a/src/libmain/shared.hh b/src/libmain/shared.hh
index ed012959b..0cc56d47d 100644
--- a/src/libmain/shared.hh
+++ b/src/libmain/shared.hh
@@ -22,7 +22,7 @@ public:
     virtual ~Exit();
 };
 
-int handleExceptions(const string & programName, std::function<void()> fun);
+int handleExceptions(const std::string & programName, std::function<void()> fun);
 
 /* Don't forget to call initPlugins() after settings are initialized! */
 void initNix();
@@ -30,10 +30,10 @@ void initNix();
 void parseCmdLine(int argc, char * * argv,
     std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg);
 
-void parseCmdLine(const string & programName, const Strings & args,
+void parseCmdLine(const std::string & programName, const Strings & args,
     std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg);
 
-void printVersion(const string & programName);
+void printVersion(const std::string & programName);
 
 /* Ugh.  No better place to put this. */
 void printGCWarning();
@@ -50,10 +50,10 @@ void printMissing(ref<Store> store, const StorePathSet & willBuild,
     const StorePathSet & willSubstitute, const StorePathSet & unknown,
     uint64_t downloadSize, uint64_t narSize, Verbosity lvl = lvlInfo);
 
-string getArg(const string & opt,
+std::string getArg(const std::string & opt,
     Strings::iterator & i, const Strings::iterator & end);
 
-template<class N> N getIntArg(const string & opt,
+template<class N> N getIntArg(const std::string & opt,
     Strings::iterator & i, const Strings::iterator & end, bool allowUnit)
 {
     ++i;
@@ -76,7 +76,7 @@ struct LegacyArgs : public MixCommonArgs
 
 
 /* Show the manual page for the specified program. */
-void showManPage(const string & name);
+void showManPage(const std::string & name);
 
 /* The constructor of this class starts a pager if stdout is a
    terminal and $PAGER is set. Stdout is redirected to the pager. */
@@ -96,7 +96,7 @@ extern volatile ::sig_atomic_t blockInt;
 
 /* GC helpers. */
 
-string showBytes(uint64_t bytes);
+std::string showBytes(uint64_t bytes);
 
 struct GCResults;
 
diff --git a/src/libstore/binary-cache-store.cc b/src/libstore/binary-cache-store.cc
index b3fd991a1..9226c4e19 100644
--- a/src/libstore/binary-cache-store.cc
+++ b/src/libstore/binary-cache-store.cc
@@ -385,8 +385,14 @@ void BinaryCacheStore::queryPathInfoUncached(const StorePath & storePath,
         }});
 }
 
-StorePath BinaryCacheStore::addToStore(const string & name, const Path & srcPath,
-    FileIngestionMethod method, HashType hashAlgo, PathFilter & filter, RepairFlag repair, const StorePathSet & references)
+StorePath BinaryCacheStore::addToStore(
+    std::string_view name,
+    const Path & srcPath,
+    FileIngestionMethod method,
+    HashType hashAlgo,
+    PathFilter & filter,
+    RepairFlag repair,
+    const StorePathSet & references)
 {
     /* FIXME: Make BinaryCacheStore::addToStoreCommon support
        non-recursive+sha256 so we can just use the default
@@ -418,8 +424,11 @@ StorePath BinaryCacheStore::addToStore(const string & name, const Path & srcPath
     })->path;
 }
 
-StorePath BinaryCacheStore::addTextToStore(const string & name, const string & s,
-    const StorePathSet & references, RepairFlag repair)
+StorePath BinaryCacheStore::addTextToStore(
+    std::string_view name,
+    std::string_view s,
+    const StorePathSet & references,
+    RepairFlag repair)
 {
     auto textHash = hashString(htSHA256, s);
     auto path = makeTextPath(name, textHash, references);
diff --git a/src/libstore/binary-cache-store.hh b/src/libstore/binary-cache-store.hh
index 5b5d064f3..9603a8caa 100644
--- a/src/libstore/binary-cache-store.hh
+++ b/src/libstore/binary-cache-store.hh
@@ -101,12 +101,20 @@ public:
     StorePath addToStoreFromDump(Source & dump, std::string_view name,
         FileIngestionMethod method, HashType hashAlgo, RepairFlag repair, const StorePathSet & references) override;
 
-    StorePath addToStore(const string & name, const Path & srcPath,
-        FileIngestionMethod method, HashType hashAlgo,
-        PathFilter & filter, RepairFlag repair, const StorePathSet & references) override;
+    StorePath addToStore(
+        std::string_view name,
+        const Path & srcPath,
+        FileIngestionMethod method,
+        HashType hashAlgo,
+        PathFilter & filter,
+        RepairFlag repair,
+        const StorePathSet & references) override;
 
-    StorePath addTextToStore(const string & name, const string & s,
-        const StorePathSet & references, RepairFlag repair) override;
+    StorePath addTextToStore(
+        std::string_view name,
+        std::string_view s,
+        const StorePathSet & references,
+        RepairFlag repair) override;
 
     void registerDrvOutput(const Realisation & info) override;
 
diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index 27f8c6257..95da1841d 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -116,7 +116,7 @@ DerivationGoal::~DerivationGoal()
 }
 
 
-string DerivationGoal::key()
+std::string DerivationGoal::key()
 {
     /* Ensure that derivations get built in order of their name,
        i.e. a derivation named "aardvark" always comes before
@@ -1013,7 +1013,7 @@ HookReply DerivationGoal::tryBuildHook()
 
         /* Read the first line of input, which should be a word indicating
            whether the hook wishes to perform the build. */
-        string reply;
+        std::string reply;
         while (true) {
             auto s = [&]() {
                 try {
@@ -1025,8 +1025,8 @@ HookReply DerivationGoal::tryBuildHook()
             }();
             if (handleJSONLogMessage(s, worker.act, worker.hook->activities, true))
                 ;
-            else if (string(s, 0, 2) == "# ") {
-                reply = string(s, 2);
+            else if (s.substr(0, 2) == "# ") {
+                reply = s.substr(2);
                 break;
             }
             else {
@@ -1140,10 +1140,10 @@ Path DerivationGoal::openLogFile()
         logDir = localStore->logDir;
     else
         logDir = settings.nixLogDir;
-    Path dir = fmt("%s/%s/%s/", logDir, LocalFSStore::drvsLogDir, string(baseName, 0, 2));
+    Path dir = fmt("%s/%s/%s/", logDir, LocalFSStore::drvsLogDir, baseName.substr(0, 2));
     createDirs(dir);
 
-    Path logFileName = fmt("%s/%s%s", dir, string(baseName, 2),
+    Path logFileName = fmt("%s/%s%s", dir, baseName.substr(2),
         settings.compressLog ? ".bz2" : "");
 
     fdLogFile = open(logFileName.c_str(), O_CREAT | O_WRONLY | O_TRUNC | O_CLOEXEC, 0666);
@@ -1176,7 +1176,7 @@ bool DerivationGoal::isReadDesc(int fd)
 }
 
 
-void DerivationGoal::handleChildOutput(int fd, const string & data)
+void DerivationGoal::handleChildOutput(int fd, std::string_view data)
 {
     if (isReadDesc(fd))
     {
diff --git a/src/libstore/build/derivation-goal.hh b/src/libstore/build/derivation-goal.hh
index e112542c7..d947482ef 100644
--- a/src/libstore/build/derivation-goal.hh
+++ b/src/libstore/build/derivation-goal.hh
@@ -145,7 +145,7 @@ struct DerivationGoal : public Goal
 
     void timedOut(Error && ex) override;
 
-    string key() override;
+    std::string key() override;
 
     void work() override;
 
@@ -200,7 +200,7 @@ struct DerivationGoal : public Goal
     virtual bool isReadDesc(int fd);
 
     /* Callback used by the worker to write to the log. */
-    void handleChildOutput(int fd, const string & data) override;
+    void handleChildOutput(int fd, std::string_view data) override;
     void handleEOF(int fd) override;
     void flushLine();
 
diff --git a/src/libstore/build/drv-output-substitution-goal.cc b/src/libstore/build/drv-output-substitution-goal.cc
index b9602e696..e6e810cdd 100644
--- a/src/libstore/build/drv-output-substitution-goal.cc
+++ b/src/libstore/build/drv-output-substitution-goal.cc
@@ -137,7 +137,7 @@ void DrvOutputSubstitutionGoal::finished()
     amDone(ecSuccess);
 }
 
-string DrvOutputSubstitutionGoal::key()
+std::string DrvOutputSubstitutionGoal::key()
 {
     /* "a$" ensures substitution goals happen before derivation
        goals. */
diff --git a/src/libstore/build/drv-output-substitution-goal.hh b/src/libstore/build/drv-output-substitution-goal.hh
index 67ae2624a..948dbda8f 100644
--- a/src/libstore/build/drv-output-substitution-goal.hh
+++ b/src/libstore/build/drv-output-substitution-goal.hh
@@ -51,7 +51,7 @@ public:
 
     void timedOut(Error && ex) override { abort(); };
 
-    string key() override;
+    std::string key() override;
 
     void work() override;
     void handleEOF(int fd) override;
diff --git a/src/libstore/build/goal.cc b/src/libstore/build/goal.cc
index 7c985128b..d2420b107 100644
--- a/src/libstore/build/goal.cc
+++ b/src/libstore/build/goal.cc
@@ -5,8 +5,8 @@ namespace nix {
 
 
 bool CompareGoalPtrs::operator() (const GoalPtr & a, const GoalPtr & b) const {
-    string s1 = a->key();
-    string s2 = b->key();
+    std::string s1 = a->key();
+    std::string s2 = b->key();
     return s1 < s2;
 }
 
diff --git a/src/libstore/build/goal.hh b/src/libstore/build/goal.hh
index 0db0c1938..68e08bdf9 100644
--- a/src/libstore/build/goal.hh
+++ b/src/libstore/build/goal.hh
@@ -50,7 +50,7 @@ struct Goal : public std::enable_shared_from_this<Goal>
     unsigned int nrIncompleteClosure;
 
     /* Name of this goal for debugging purposes. */
-    string name;
+    std::string name;
 
     /* Whether the goal is finished. */
     ExitCode exitCode;
@@ -75,7 +75,7 @@ struct Goal : public std::enable_shared_from_this<Goal>
 
     virtual void waiteeDone(GoalPtr waitee, ExitCode result);
 
-    virtual void handleChildOutput(int fd, const string & data)
+    virtual void handleChildOutput(int fd, std::string_view data)
     {
         abort();
     }
@@ -87,7 +87,7 @@ struct Goal : public std::enable_shared_from_this<Goal>
 
     void trace(const FormatOrString & fs);
 
-    string getName()
+    std::string getName()
     {
         return name;
     }
@@ -97,7 +97,7 @@ struct Goal : public std::enable_shared_from_this<Goal>
        by the worker (important!), etc. */
     virtual void timedOut(Error && ex) = 0;
 
-    virtual string key() = 0;
+    virtual std::string key() = 0;
 
     void amDone(ExitCode result, std::optional<Error> ex = {});
 
diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index 8861d2c7b..220f80602 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -481,12 +481,12 @@ void LocalDerivationGoal::startBuilder()
            temporary build directory.  The text files have the format used
            by `nix-store --register-validity'.  However, the deriver
            fields are left empty. */
-        string s = get(drv->env, "exportReferencesGraph").value_or("");
+        auto s = get(drv->env, "exportReferencesGraph").value_or("");
         Strings ss = tokenizeString<Strings>(s);
         if (ss.size() % 2 != 0)
             throw BuildError("odd number of tokens in 'exportReferencesGraph': '%1%'", s);
         for (Strings::iterator i = ss.begin(); i != ss.end(); ) {
-            string fileName = *i++;
+            auto fileName = *i++;
             static std::regex regex("[A-Za-z_][A-Za-z0-9_.-]*");
             if (!std::regex_match(fileName, regex))
                 throw Error("invalid file name '%s' in 'exportReferencesGraph'", fileName);
@@ -517,10 +517,10 @@ void LocalDerivationGoal::startBuilder()
                 i.pop_back();
             }
             size_t p = i.find('=');
-            if (p == string::npos)
+            if (p == std::string::npos)
                 dirsInChroot[i] = {i, optional};
             else
-                dirsInChroot[string(i, 0, p)] = {string(i, p + 1), optional};
+                dirsInChroot[i.substr(0, p)] = {i.substr(p + 1), optional};
         }
         dirsInChroot[tmpDirInSandbox] = tmpDir;
 
@@ -671,9 +671,10 @@ void LocalDerivationGoal::startBuilder()
         auto state = stBegin;
         auto lines = runProgram(settings.preBuildHook, false, args);
         auto lastPos = std::string::size_type{0};
-        for (auto nlPos = lines.find('\n'); nlPos != string::npos;
-                nlPos = lines.find('\n', lastPos)) {
-            auto line = std::string{lines, lastPos, nlPos - lastPos};
+        for (auto nlPos = lines.find('\n'); nlPos != std::string::npos;
+                nlPos = lines.find('\n', lastPos))
+        {
+            auto line = lines.substr(lastPos, nlPos - lastPos);
             lastPos = nlPos + 1;
             if (state == stBegin) {
                 if (line == "extra-sandbox-paths" || line == "extra-chroot-dirs") {
@@ -686,10 +687,10 @@ void LocalDerivationGoal::startBuilder()
                     state = stBegin;
                 } else {
                     auto p = line.find('=');
-                    if (p == string::npos)
+                    if (p == std::string::npos)
                         dirsInChroot[line] = line;
                     else
-                        dirsInChroot[string(line, 0, p)] = string(line, p + 1);
+                        dirsInChroot[line.substr(0, p)] = line.substr(p + 1);
                 }
             }
         }
@@ -941,7 +942,7 @@ void LocalDerivationGoal::startBuilder()
     /* Check if setting up the build environment failed. */
     std::vector<std::string> msgs;
     while (true) {
-        string msg = [&]() {
+        std::string msg = [&]() {
             try {
                 return readLine(builderOut.readSide.get());
             } catch (Error & e) {
@@ -953,8 +954,8 @@ void LocalDerivationGoal::startBuilder()
                 throw;
             }
         }();
-        if (string(msg, 0, 1) == "\2") break;
-        if (string(msg, 0, 1) == "\1") {
+        if (msg.substr(0, 1) == "\2") break;
+        if (msg.substr(0, 1) == "\1") {
             FdSource source(builderOut.readSide.get());
             auto ex = readError(source);
             ex.addTrace({}, "while setting up the build environment");
@@ -990,7 +991,7 @@ void LocalDerivationGoal::initTmpDir() {
                 env[i.first] = i.second;
             } else {
                 auto hash = hashString(htSHA256, i.first);
-                string fn = ".attr-" + hash.to_string(Base32, false);
+                std::string fn = ".attr-" + hash.to_string(Base32, false);
                 Path p = tmpDir + "/" + fn;
                 writeFile(p, rewriteStrings(i.second, inputRewrites));
                 chownToBuilder(p);
@@ -1081,7 +1082,7 @@ void LocalDerivationGoal::writeStructuredAttrs()
         for (auto & [i, v] : json["outputs"].get<nlohmann::json::object_t>()) {
             /* The placeholder must have a rewrite, so we use it to cover both the
                cases where we know or don't know the output path ahead of time. */
-            rewritten[i] = rewriteStrings(v, inputRewrites);
+            rewritten[i] = rewriteStrings((std::string) v, inputRewrites);
         }
 
         json["outputs"] = rewritten;
@@ -1187,10 +1188,14 @@ struct RestrictedStore : public virtual RestrictedStoreConfig, public virtual Lo
     std::optional<StorePath> queryPathFromHashPart(const std::string & hashPart) override
     { throw Error("queryPathFromHashPart"); }
 
-    StorePath addToStore(const string & name, const Path & srcPath,
-        FileIngestionMethod method = FileIngestionMethod::Recursive, HashType hashAlgo = htSHA256,
-        PathFilter & filter = defaultPathFilter, RepairFlag repair = NoRepair,
-        const StorePathSet & references = StorePathSet()) override
+    StorePath addToStore(
+        std::string_view name,
+        const Path & srcPath,
+        FileIngestionMethod method,
+        HashType hashAlgo,
+        PathFilter & filter,
+        RepairFlag repair,
+        const StorePathSet & references) override
     { throw Error("addToStore"); }
 
     void addToStore(const ValidPathInfo & info, Source & narSource,
@@ -1200,17 +1205,24 @@ struct RestrictedStore : public virtual RestrictedStoreConfig, public virtual Lo
         goal.addDependency(info.path);
     }
 
-    StorePath addTextToStore(const string & name, const string & s,
-        const StorePathSet & references, RepairFlag repair = NoRepair) override
+    StorePath addTextToStore(
+        std::string_view name,
+        std::string_view s,
+        const StorePathSet & references,
+        RepairFlag repair = NoRepair) override
     {
         auto path = next->addTextToStore(name, s, references, repair);
         goal.addDependency(path);
         return path;
     }
 
-    StorePath addToStoreFromDump(Source & dump, std::string_view name,
-        FileIngestionMethod method = FileIngestionMethod::Recursive, HashType hashAlgo = htSHA256, RepairFlag repair = NoRepair,
-        const StorePathSet & references = StorePathSet()) override
+    StorePath addToStoreFromDump(
+        Source & dump,
+        std::string_view name,
+        FileIngestionMethod method,
+        HashType hashAlgo,
+        RepairFlag repair,
+        const StorePathSet & references) override
     {
         auto path = next->addToStoreFromDump(dump, name, method, hashAlgo, repair, references);
         goal.addDependency(path);
@@ -1992,7 +2004,7 @@ void LocalDerivationGoal::runChild()
             args.push_back(rewriteStrings(i, inputRewrites));
 
         /* Indicate that we managed to set up the build environment. */
-        writeFull(STDERR_FILENO, string("\2\n"));
+        writeFull(STDERR_FILENO, std::string("\2\n"));
 
         /* Execute the program.  This should not return. */
         if (drv->isBuiltin()) {
@@ -2010,7 +2022,7 @@ void LocalDerivationGoal::runChild()
                 else if (drv->builder == "builtin:unpack-channel")
                     builtinUnpackChannel(drv2);
                 else
-                    throw Error("unsupported builtin builder '%1%'", string(drv->builder, 8));
+                    throw Error("unsupported builtin builder '%1%'", drv->builder.substr(8));
                 _exit(0);
             } catch (std::exception & e) {
                 writeFull(STDERR_FILENO, e.what() + std::string("\n"));
@@ -2694,7 +2706,7 @@ void LocalDerivationGoal::checkOutputs(const std::map<Path, ValidPathInfo> & out
                     }
 
                 if (!badPaths.empty()) {
-                    string badPathsStr;
+                    std::string badPathsStr;
                     for (auto & i : badPaths) {
                         badPathsStr += "\n  ";
                         badPathsStr += worker.store.printStorePath(i);
diff --git a/src/libstore/build/local-derivation-goal.hh b/src/libstore/build/local-derivation-goal.hh
index bfdf91d89..2d1222d2f 100644
--- a/src/libstore/build/local-derivation-goal.hh
+++ b/src/libstore/build/local-derivation-goal.hh
@@ -58,7 +58,7 @@ struct LocalDerivationGoal : public DerivationGoal
     typedef map<Path, ChrootPath> DirsInChroot; // maps target path to source path
     DirsInChroot dirsInChroot;
 
-    typedef map<string, string> Environment;
+    typedef map<std::string, std::string> Environment;
     Environment env;
 
 #if __APPLE__
diff --git a/src/libstore/build/substitution-goal.cc b/src/libstore/build/substitution-goal.cc
index 5ecf1da7e..c1bb1941d 100644
--- a/src/libstore/build/substitution-goal.cc
+++ b/src/libstore/build/substitution-goal.cc
@@ -272,7 +272,7 @@ void PathSubstitutionGoal::finished()
 }
 
 
-void PathSubstitutionGoal::handleChildOutput(int fd, const string & data)
+void PathSubstitutionGoal::handleChildOutput(int fd, std::string_view data)
 {
 }
 
diff --git a/src/libstore/build/substitution-goal.hh b/src/libstore/build/substitution-goal.hh
index 70c806d23..d8399d2a8 100644
--- a/src/libstore/build/substitution-goal.hh
+++ b/src/libstore/build/substitution-goal.hh
@@ -59,7 +59,7 @@ public:
 
     void timedOut(Error && ex) override { abort(); };
 
-    string key() override
+    std::string key() override
     {
         /* "a$" ensures substitution goals happen before derivation
            goals. */
@@ -77,7 +77,7 @@ public:
     void finished();
 
     /* Callback used by the worker to write to the log. */
-    void handleChildOutput(int fd, const string & data) override;
+    void handleChildOutput(int fd, std::string_view data) override;
     void handleEOF(int fd) override;
 
     void cleanup() override;
diff --git a/src/libstore/build/worker.cc b/src/libstore/build/worker.cc
index 0a6108233..f72c1cc9c 100644
--- a/src/libstore/build/worker.cc
+++ b/src/libstore/build/worker.cc
@@ -394,7 +394,7 @@ void Worker::waitForInput()
                 } else {
                     printMsg(lvlVomit, "%1%: read %2% bytes",
                         goal->getName(), rd);
-                    string data((char *) buffer.data(), rd);
+                    std::string data((char *) buffer.data(), rd);
                     j->lastOutput = after;
                     goal->handleChildOutput(k, data);
                 }
diff --git a/src/libstore/builtins/buildenv.cc b/src/libstore/builtins/buildenv.cc
index e88fc687a..25d015cb9 100644
--- a/src/libstore/builtins/buildenv.cc
+++ b/src/libstore/builtins/buildenv.cc
@@ -123,7 +123,7 @@ void buildProfile(const Path & out, Packages && pkgs)
         createLinks(state, pkgDir, out, priority);
 
         try {
-            for (const auto & p : tokenizeString<std::vector<string>>(
+            for (const auto & p : tokenizeString<std::vector<std::string>>(
                     readFile(pkgDir + "/nix-support/propagated-user-env-packages"), " \n"))
                 if (!done.count(p))
                     postponed.insert(p);
@@ -161,7 +161,7 @@ void buildProfile(const Path & out, Packages && pkgs)
 
 void builtinBuildenv(const BasicDerivation & drv)
 {
-    auto getAttr = [&](const string & name) {
+    auto getAttr = [&](const std::string & name) {
         auto i = drv.env.find(name);
         if (i == drv.env.end()) throw Error("attribute '%s' missing", name);
         return i->second;
diff --git a/src/libstore/builtins/fetchurl.cc b/src/libstore/builtins/fetchurl.cc
index 4fb5d8a06..af3dfc409 100644
--- a/src/libstore/builtins/fetchurl.cc
+++ b/src/libstore/builtins/fetchurl.cc
@@ -16,7 +16,7 @@ void builtinFetchurl(const BasicDerivation & drv, const std::string & netrcData)
         writeFile(settings.netrcFile, netrcData, 0600);
     }
 
-    auto getAttr = [&](const string & name) {
+    auto getAttr = [&](const std::string & name) {
         auto i = drv.env.find(name);
         if (i == drv.env.end()) throw Error("attribute '%s' missing", name);
         return i->second;
diff --git a/src/libstore/builtins/unpack-channel.cc b/src/libstore/builtins/unpack-channel.cc
index d18e3ddaf..426d58a53 100644
--- a/src/libstore/builtins/unpack-channel.cc
+++ b/src/libstore/builtins/unpack-channel.cc
@@ -5,7 +5,7 @@ namespace nix {
 
 void builtinUnpackChannel(const BasicDerivation & drv)
 {
-    auto getAttr = [&](const string & name) {
+    auto getAttr = [&](const std::string & name) {
         auto i = drv.env.find(name);
         if (i == drv.env.end()) throw Error("attribute '%s' missing", name);
         return i->second;
diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index 1ddd1a4d5..2ba03f0dd 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -479,8 +479,8 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
     }
 
     case wopAddTextToStore: {
-        string suffix = readString(from);
-        string s = readString(from);
+        std::string suffix = readString(from);
+        std::string s = readString(from);
         auto refs = worker_proto::read(*store, from, Phantom<StorePathSet> {});
         logger->startWork();
         auto path = store->addTextToStore(suffix, s, refs, NoRepair);
@@ -698,8 +698,8 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         if (GET_PROTOCOL_MINOR(clientVersion) >= 12) {
             unsigned int n = readInt(from);
             for (unsigned int i = 0; i < n; i++) {
-                string name = readString(from);
-                string value = readString(from);
+                auto name = readString(from);
+                auto value = readString(from);
                 clientSettings.overrides.emplace(name, value);
             }
         }
diff --git a/src/libstore/derivations.cc b/src/libstore/derivations.cc
index 40af6a775..a49be0057 100644
--- a/src/libstore/derivations.cc
+++ b/src/libstore/derivations.cc
@@ -82,7 +82,7 @@ bool derivationIsImpure(DerivationType dt) {
 
 bool BasicDerivation::isBuiltin() const
 {
-    return string(builder, 0, 8) == "builtin:";
+    return builder.substr(0, 8) == "builtin:";
 }
 
 
@@ -104,19 +104,19 @@ StorePath writeDerivation(Store & store,
 
 
 /* Read string `s' from stream `str'. */
-static void expect(std::istream & str, const string & s)
+static void expect(std::istream & str, std::string_view s)
 {
     char s2[s.size()];
     str.read(s2, s.size());
-    if (string(s2, s.size()) != s)
+    if (std::string(s2, s.size()) != s)
         throw FormatError("expected string '%1%'", s);
 }
 
 
 /* Read a C-style string from stream `str'. */
-static string parseString(std::istream & str)
+static std::string parseString(std::istream & str)
 {
-    string res;
+    std::string res;
     expect(str, "\"");
     int c;
     while ((c = str.get()) != '"')
@@ -172,7 +172,7 @@ static DerivationOutput parseDerivationOutput(const Store & store,
 {
     if (hashAlgo != "") {
         auto method = FileIngestionMethod::Flat;
-        if (string(hashAlgo, 0, 2) == "r:") {
+        if (hashAlgo.substr(0, 2) == "r:") {
             method = FileIngestionMethod::Recursive;
             hashAlgo = hashAlgo.substr(2);
         }
@@ -260,8 +260,8 @@ Derivation parseDerivation(const Store & store, std::string && s, std::string_vi
     /* Parse the environment variables. */
     expect(str, ",[");
     while (!endOfList(str)) {
-        expect(str, "("); string name = parseString(str);
-        expect(str, ","); string value = parseString(str);
+        expect(str, "("); auto name = parseString(str);
+        expect(str, ","); auto value = parseString(str);
         expect(str, ")");
         drv.env[name] = value;
     }
@@ -271,7 +271,7 @@ Derivation parseDerivation(const Store & store, std::string && s, std::string_vi
 }
 
 
-static void printString(string & res, std::string_view s)
+static void printString(std::string & res, std::string_view s)
 {
     boost::container::small_vector<char, 64 * 1024> buffer;
     buffer.reserve(s.size() * 2 + 2);
@@ -289,7 +289,7 @@ static void printString(string & res, std::string_view s)
 }
 
 
-static void printUnquotedString(string & res, std::string_view s)
+static void printUnquotedString(std::string & res, std::string_view s)
 {
     res += '"';
     res.append(s);
@@ -298,7 +298,7 @@ static void printUnquotedString(string & res, std::string_view s)
 
 
 template<class ForwardIterator>
-static void printStrings(string & res, ForwardIterator i, ForwardIterator j)
+static void printStrings(std::string & res, ForwardIterator i, ForwardIterator j)
 {
     res += '[';
     bool first = true;
@@ -311,7 +311,7 @@ static void printStrings(string & res, ForwardIterator i, ForwardIterator j)
 
 
 template<class ForwardIterator>
-static void printUnquotedStrings(string & res, ForwardIterator i, ForwardIterator j)
+static void printUnquotedStrings(std::string & res, ForwardIterator i, ForwardIterator j)
 {
     res += '[';
     bool first = true;
@@ -323,10 +323,10 @@ static void printUnquotedStrings(string & res, ForwardIterator i, ForwardIterato
 }
 
 
-string Derivation::unparse(const Store & store, bool maskOutputs,
+std::string Derivation::unparse(const Store & store, bool maskOutputs,
     std::map<std::string, StringSet> * actualInputs) const
 {
-    string s;
+    std::string s;
     s.reserve(65536);
     s += "Derive([";
 
@@ -401,7 +401,7 @@ string Derivation::unparse(const Store & store, bool maskOutputs,
 
 
 // FIXME: remove
-bool isDerivation(const string & fileName)
+bool isDerivation(const std::string & fileName)
 {
     return hasSuffix(fileName, drvExtension);
 }
@@ -593,7 +593,7 @@ std::map<std::string, Hash> staticOutputHashes(Store & store, const Derivation &
 }
 
 
-bool wantOutput(const string & output, const std::set<string> & wanted)
+bool wantOutput(const std::string & output, const std::set<std::string> & wanted)
 {
     return wanted.empty() || wanted.find(output) != wanted.end();
 }
diff --git a/src/libstore/derivations.hh b/src/libstore/derivations.hh
index a644cec60..132de82b6 100644
--- a/src/libstore/derivations.hh
+++ b/src/libstore/derivations.hh
@@ -59,21 +59,19 @@ struct DerivationOutput
     std::optional<StorePath> path(const Store & store, std::string_view drvName, std::string_view outputName) const;
 };
 
-typedef std::map<string, DerivationOutput> DerivationOutputs;
+typedef std::map<std::string, DerivationOutput> DerivationOutputs;
 
 /* These are analogues to the previous DerivationOutputs data type, but they
    also contains, for each output, the (optional) store path in which it would
    be written. To calculate values of these types, see the corresponding
    functions in BasicDerivation */
-typedef std::map<string, std::pair<DerivationOutput, std::optional<StorePath>>>
+typedef std::map<std::string, std::pair<DerivationOutput, std::optional<StorePath>>>
   DerivationOutputsAndOptPaths;
 
 /* For inputs that are sub-derivations, we specify exactly which
    output IDs we are interested in. */
 typedef std::map<StorePath, StringSet> DerivationInputs;
 
-typedef std::map<string, string> StringPairs;
-
 enum struct DerivationType : uint8_t {
     InputAddressed,
     DeferredInputAddressed,
@@ -103,7 +101,7 @@ struct BasicDerivation
 {
     DerivationOutputs outputs; /* keyed on symbolic IDs */
     StorePathSet inputSrcs; /* inputs that are sources */
-    string platform;
+    std::string platform;
     Path builder;
     Strings args;
     StringPairs env;
@@ -164,7 +162,7 @@ StorePath writeDerivation(Store & store,
 Derivation parseDerivation(const Store & store, std::string && s, std::string_view name);
 
 // FIXME: remove
-bool isDerivation(const string & fileName);
+bool isDerivation(const std::string & fileName);
 
 /* Calculate the name that will be used for the store path for this
    output.
@@ -222,7 +220,7 @@ typedef std::map<StorePath, DrvHashModulo> DrvHashes;
 // FIXME: global, though at least thread-safe.
 extern Sync<DrvHashes> drvHashes;
 
-bool wantOutput(const string & output, const std::set<string> & wanted);
+bool wantOutput(const std::string & output, const std::set<std::string> & wanted);
 
 struct Source;
 struct Sink;
diff --git a/src/libstore/derived-path.cc b/src/libstore/derived-path.cc
index 3d188e981..194489580 100644
--- a/src/libstore/derived-path.cc
+++ b/src/libstore/derived-path.cc
@@ -75,9 +75,9 @@ DerivedPath::Built DerivedPath::Built::parse(const Store & store, std::string_vi
     assert(n != s.npos);
     auto drvPath = store.parseStorePath(s.substr(0, n));
     auto outputsS = s.substr(n + 1);
-    std::set<string> outputs;
+    std::set<std::string> outputs;
     if (outputsS != "*")
-        outputs = tokenizeString<std::set<string>>(outputsS, ",");
+        outputs = tokenizeString<std::set<std::string>>(outputsS, ",");
     return {drvPath, outputs};
 }
 
diff --git a/src/libstore/dummy-store.cc b/src/libstore/dummy-store.cc
index 62dc21c59..b4fbe0b70 100644
--- a/src/libstore/dummy-store.cc
+++ b/src/libstore/dummy-store.cc
@@ -21,7 +21,7 @@ struct DummyStore : public virtual DummyStoreConfig, public virtual Store
         , Store(params)
     { }
 
-    string getUri() override
+    std::string getUri() override
     {
         return *uriSchemes().begin();
     }
@@ -43,8 +43,11 @@ struct DummyStore : public virtual DummyStoreConfig, public virtual Store
         RepairFlag repair, CheckSigsFlag checkSigs) override
     { unsupported("addToStore"); }
 
-    StorePath addTextToStore(const string & name, const string & s,
-        const StorePathSet & references, RepairFlag repair) override
+    StorePath addTextToStore(
+        std::string_view name,
+        std::string_view s,
+        const StorePathSet & references,
+        RepairFlag repair) override
     { unsupported("addTextToStore"); }
 
     void narFromPath(const StorePath & path, Sink & sink) override
diff --git a/src/libstore/filetransfer.cc b/src/libstore/filetransfer.cc
index 76fed11db..255b42c49 100644
--- a/src/libstore/filetransfer.cc
+++ b/src/libstore/filetransfer.cc
@@ -33,12 +33,12 @@ FileTransferSettings fileTransferSettings;
 
 static GlobalConfig::Register rFileTransferSettings(&fileTransferSettings);
 
-std::string resolveUri(const std::string & uri)
+std::string resolveUri(std::string_view uri)
 {
     if (uri.compare(0, 8, "channel:") == 0)
-        return "https://nixos.org/channels/" + std::string(uri, 8) + "/nixexprs.tar.xz";
+        return "https://nixos.org/channels/" + std::string(uri.substr(8)) + "/nixexprs.tar.xz";
     else
-        return uri;
+        return std::string(uri);
 }
 
 struct curlFileTransfer : public FileTransfer
@@ -197,15 +197,15 @@ struct curlFileTransfer : public FileTransfer
                 result.etag = "";
                 result.data.clear();
                 result.bodySize = 0;
-                statusMsg = trim(match[1]);
+                statusMsg = trim((std::string &) match[1]);
                 acceptRanges = false;
                 encoding = "";
             } else {
                 auto i = line.find(':');
-                if (i != string::npos) {
-                    string name = toLower(trim(string(line, 0, i)));
+                if (i != std::string::npos) {
+                    std::string name = toLower(trim(line.substr(0, i)));
                     if (name == "etag") {
-                        result.etag = trim(string(line, i + 1));
+                        result.etag = trim(line.substr(i + 1));
                         /* Hack to work around a GitHub bug: it sends
                            ETags, but ignores If-None-Match. So if we get
                            the expected ETag on a 200 response, then shut
@@ -218,8 +218,8 @@ struct curlFileTransfer : public FileTransfer
                             return 0;
                         }
                     } else if (name == "content-encoding")
-                        encoding = trim(string(line, i + 1));
-                    else if (name == "accept-ranges" && toLower(trim(std::string(line, i + 1))) == "bytes")
+                        encoding = trim(line.substr(i + 1));
+                    else if (name == "accept-ranges" && toLower(trim(line.substr(i + 1))) == "bytes")
                         acceptRanges = true;
                 }
             }
@@ -866,18 +866,18 @@ FileTransferError::FileTransferError(FileTransfer::Error error, std::optional<st
     // FIXME: Due to https://github.com/NixOS/nix/issues/3841 we don't know how
     // to print different messages for different verbosity levels. For now
     // we add some heuristics for detecting when we want to show the response.
-    if (response && (response->size() < 1024 || response->find("<html>") != string::npos))
+    if (response && (response->size() < 1024 || response->find("<html>") != std::string::npos))
         err.msg = hintfmt("%1%\n\nresponse body:\n\n%2%", normaltxt(hf.str()), chomp(*response));
     else
         err.msg = hf;
 }
 
-bool isUri(const string & s)
+bool isUri(std::string_view s)
 {
     if (s.compare(0, 8, "channel:") == 0) return true;
     size_t pos = s.find("://");
-    if (pos == string::npos) return false;
-    string scheme(s, 0, pos);
+    if (pos == std::string::npos) return false;
+    std::string scheme(s, 0, pos);
     return scheme == "http" || scheme == "https" || scheme == "file" || scheme == "channel" || scheme == "git" || scheme == "s3" || scheme == "ssh";
 }
 
diff --git a/src/libstore/filetransfer.hh b/src/libstore/filetransfer.hh
index 3e61b23b1..ca61e3937 100644
--- a/src/libstore/filetransfer.hh
+++ b/src/libstore/filetransfer.hh
@@ -119,17 +119,17 @@ class FileTransferError : public Error
 {
 public:
     FileTransfer::Error error;
-    std::optional<string> response; // intentionally optional
+    std::optional<std::string> response; // intentionally optional
 
     template<typename... Args>
-    FileTransferError(FileTransfer::Error error, std::optional<string> response, const Args & ... args);
+    FileTransferError(FileTransfer::Error error, std::optional<std::string> response, const Args & ... args);
 
     virtual const char* sname() const override { return "FileTransferError"; }
 };
 
-bool isUri(const string & s);
+bool isUri(std::string_view s);
 
 /* Resolve deprecated 'channel:<foo>' URLs. */
-std::string resolveUri(const std::string & uri);
+std::string resolveUri(std::string_view uri);
 
 }
diff --git a/src/libstore/gc.cc b/src/libstore/gc.cc
index e35199b3d..fd38b731c 100644
--- a/src/libstore/gc.cc
+++ b/src/libstore/gc.cc
@@ -47,9 +47,8 @@ static void makeSymlink(const Path & link, const Path & target)
 
 void LocalStore::addIndirectRoot(const Path & path)
 {
-    string hash = hashString(htSHA1, path).to_string(Base32, false);
-    Path realRoot = canonPath((format("%1%/%2%/auto/%3%")
-        % stateDir % gcRootsDir % hash).str());
+    std::string hash = hashString(htSHA1, path).to_string(Base32, false);
+    Path realRoot = canonPath(fmt("%1%/%2%/auto/%3%", stateDir, gcRootsDir, hash));
     makeSymlink(realRoot, path);
 }
 
@@ -162,7 +161,7 @@ void LocalStore::addTempRoot(const StorePath & path)
     }
 
     /* Append the store path to the temporary roots file. */
-    string s = printStorePath(path) + '\0';
+    auto s = printStorePath(path) + '\0';
     writeFull(state->fdTempRoots.get(), s);
 }
 
@@ -203,12 +202,12 @@ void LocalStore::findTempRoots(Roots & tempRoots, bool censor)
         }
 
         /* Read the entire file. */
-        string contents = readFile(fd.get());
+        auto contents = readFile(fd.get());
 
         /* Extract the roots. */
-        string::size_type pos = 0, end;
+        std::string::size_type pos = 0, end;
 
-        while ((end = contents.find((char) 0, pos)) != string::npos) {
+        while ((end = contents.find((char) 0, pos)) != std::string::npos) {
             Path root(contents, pos, end - pos);
             debug("got temporary root '%s'", root);
             tempRoots[parseStorePath(root)].emplace(censor ? censored : fmt("{temp:%d}", pid));
@@ -305,7 +304,7 @@ Roots LocalStore::findRoots(bool censor)
 
 typedef std::unordered_map<Path, std::unordered_set<std::string>> UncheckedRoots;
 
-static void readProcLink(const string & file, UncheckedRoots & roots)
+static void readProcLink(const std::string & file, UncheckedRoots & roots)
 {
     /* 64 is the starting buffer size gnu readlink uses... */
     auto bufsiz = ssize_t{64};
@@ -328,7 +327,7 @@ try_again:
             .emplace(file);
 }
 
-static string quoteRegexChars(const string & raw)
+static std::string quoteRegexChars(const std::string & raw)
 {
     static auto specialRegex = std::regex(R"([.^$\\*+?()\[\]{}|])");
     return std::regex_replace(raw, specialRegex, R"(\$&)");
@@ -383,7 +382,7 @@ void LocalStore::findRuntimeRoots(Roots & roots, bool censor)
 
                 try {
                     auto mapFile = fmt("/proc/%s/maps", ent->d_name);
-                    auto mapLines = tokenizeString<std::vector<string>>(readFile(mapFile), "\n");
+                    auto mapLines = tokenizeString<std::vector<std::string>>(readFile(mapFile), "\n");
                     for (const auto & line : mapLines) {
                         auto match = std::smatch{};
                         if (std::regex_match(line, match, mapRegex))
@@ -784,7 +783,7 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
             struct dirent * dirent;
             while (errno = 0, dirent = readdir(dir.get())) {
                 checkInterrupt();
-                string name = dirent->d_name;
+                std::string name = dirent->d_name;
                 if (name == "." || name == ".." || name == linksName) continue;
 
                 if (auto storePath = maybeParseStorePath(storeDir + "/" + name))
@@ -825,7 +824,7 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
         struct dirent * dirent;
         while (errno = 0, dirent = readdir(dir.get())) {
             checkInterrupt();
-            string name = dirent->d_name;
+            std::string name = dirent->d_name;
             if (name == "." || name == "..") continue;
             Path path = linksDir + "/" + name;
 
diff --git a/src/libstore/globals.cc b/src/libstore/globals.cc
index 81ca9cc0f..cc009a026 100644
--- a/src/libstore/globals.cc
+++ b/src/libstore/globals.cc
@@ -100,7 +100,7 @@ std::vector<Path> getUserConfigFiles()
     // Use the paths specified in NIX_USER_CONF_FILES if it has been defined
     auto nixConfFiles = getEnv("NIX_USER_CONF_FILES");
     if (nixConfFiles.has_value()) {
-        return tokenizeString<std::vector<string>>(nixConfFiles.value(), ":");
+        return tokenizeString<std::vector<std::string>>(nixConfFiles.value(), ":");
     }
 
     // Use the paths specified by the XDG spec
@@ -181,7 +181,7 @@ bool Settings::isWSL1()
     return hasSuffix(utsbuf.release, "-Microsoft");
 }
 
-const string nixVersion = PACKAGE_VERSION;
+const std::string nixVersion = PACKAGE_VERSION;
 
 NLOHMANN_JSON_SERIALIZE_ENUM(SandboxMode, {
     {SandboxMode::smEnabled, true},
diff --git a/src/libstore/globals.hh b/src/libstore/globals.hh
index 4a78729e9..b31a2e8dc 100644
--- a/src/libstore/globals.hh
+++ b/src/libstore/globals.hh
@@ -988,6 +988,6 @@ void loadConfFile();
 // Used by the Settings constructor
 std::vector<Path> getUserConfigFiles();
 
-extern const string nixVersion;
+extern const std::string nixVersion;
 
 }
diff --git a/src/libstore/legacy-ssh-store.cc b/src/libstore/legacy-ssh-store.cc
index f8b2662af..6b3daae7f 100644
--- a/src/libstore/legacy-ssh-store.cc
+++ b/src/libstore/legacy-ssh-store.cc
@@ -48,7 +48,7 @@ struct LegacySSHStore : public virtual LegacySSHStoreConfig, public virtual Stor
 
     static std::set<std::string> uriSchemes() { return {"ssh"}; }
 
-    LegacySSHStore(const string & scheme, const string & host, const Params & params)
+    LegacySSHStore(const std::string & scheme, const std::string & host, const Params & params)
         : StoreConfig(params)
         , LegacySSHStoreConfig(params)
         , Store(params)
@@ -107,7 +107,7 @@ struct LegacySSHStore : public virtual LegacySSHStoreConfig, public virtual Stor
         return conn;
     };
 
-    string getUri() override
+    std::string getUri() override
     {
         return *uriSchemes().begin() + "://" + host;
     }
@@ -225,13 +225,21 @@ struct LegacySSHStore : public virtual LegacySSHStoreConfig, public virtual Stor
     std::optional<StorePath> queryPathFromHashPart(const std::string & hashPart) override
     { unsupported("queryPathFromHashPart"); }
 
-    StorePath addToStore(const string & name, const Path & srcPath,
-        FileIngestionMethod method, HashType hashAlgo,
-        PathFilter & filter, RepairFlag repair, const StorePathSet & references) override
+    StorePath addToStore(
+        std::string_view name,
+        const Path & srcPath,
+        FileIngestionMethod method,
+        HashType hashAlgo,
+        PathFilter & filter,
+        RepairFlag repair,
+        const StorePathSet & references) override
     { unsupported("addToStore"); }
 
-    StorePath addTextToStore(const string & name, const string & s,
-        const StorePathSet & references, RepairFlag repair) override
+    StorePath addTextToStore(
+        std::string_view name,
+        std::string_view s,
+        const StorePathSet & references,
+        RepairFlag repair) override
     { unsupported("addTextToStore"); }
 
 private:
diff --git a/src/libstore/local-fs-store.cc b/src/libstore/local-fs-store.cc
index c933251db..c5ae7536f 100644
--- a/src/libstore/local-fs-store.cc
+++ b/src/libstore/local-fs-store.cc
@@ -85,7 +85,7 @@ void LocalFSStore::narFromPath(const StorePath & path, Sink & sink)
     dumpPath(getRealStoreDir() + std::string(printStorePath(path), storeDir.size()), sink);
 }
 
-const string LocalFSStore::drvsLogDir = "drvs";
+const std::string LocalFSStore::drvsLogDir = "drvs";
 
 std::optional<std::string> LocalFSStore::getBuildLog(const StorePath & path_)
 {
diff --git a/src/libstore/local-fs-store.hh b/src/libstore/local-fs-store.hh
index e44b27cc2..d34f0cb62 100644
--- a/src/libstore/local-fs-store.hh
+++ b/src/libstore/local-fs-store.hh
@@ -27,7 +27,7 @@ class LocalFSStore : public virtual LocalFSStoreConfig, public virtual Store
 {
 public:
 
-    const static string drvsLogDir;
+    const static std::string drvsLogDir;
 
     LocalFSStore(const Params & params);
 
diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index 1a02b916a..1ee71b1c0 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -70,7 +70,7 @@ int getSchema(Path schemaPath)
 {
     int curSchema = 0;
     if (pathExists(schemaPath)) {
-        string s = readFile(schemaPath);
+        auto s = readFile(schemaPath);
         auto n = string2Int<int>(s);
         if (!n)
             throw Error("'%1%' is corrupt", schemaPath);
@@ -239,7 +239,7 @@ LocalStore::LocalStore(const Params & params)
             res = posix_fallocate(fd.get(), 0, settings.reservedSize);
 #endif
             if (res == -1) {
-                writeFull(fd.get(), string(settings.reservedSize, 'X'));
+                writeFull(fd.get(), std::string(settings.reservedSize, 'X'));
                 [[gnu::unused]] auto res2 = ftruncate(fd.get(), settings.reservedSize);
             }
         }
@@ -450,7 +450,7 @@ void LocalStore::openDB(State & state, bool create)
         throw SysError("Nix database directory '%1%' is not writable", dbDir);
 
     /* Open the Nix database. */
-    string dbPath = dbDir + "/db.sqlite";
+    std::string dbPath = dbDir + "/db.sqlite";
     auto & db(state.db);
     state.db = SQLite(dbPath, create);
 
@@ -471,19 +471,19 @@ void LocalStore::openDB(State & state, bool create)
        should be safe enough.  If the user asks for it, don't sync at
        all.  This can cause database corruption if the system
        crashes. */
-    string syncMode = settings.fsyncMetadata ? "normal" : "off";
+    std::string syncMode = settings.fsyncMetadata ? "normal" : "off";
     db.exec("pragma synchronous = " + syncMode);
 
     /* Set the SQLite journal mode.  WAL mode is fastest, so it's the
        default. */
-    string mode = settings.useSQLiteWAL ? "wal" : "truncate";
-    string prevMode;
+    std::string mode = settings.useSQLiteWAL ? "wal" : "truncate";
+    std::string prevMode;
     {
         SQLiteStmt stmt;
         stmt.create(db, "pragma main.journal_mode;");
         if (sqlite3_step(stmt) != SQLITE_ROW)
             throwSQLiteError(db, "querying journal mode");
-        prevMode = string((const char *) sqlite3_column_text(stmt, 0));
+        prevMode = std::string((const char *) sqlite3_column_text(stmt, 0));
     }
     if (prevMode != mode &&
         sqlite3_exec(db, ("pragma main.journal_mode = " + mode + ";").c_str(), 0, 0, 0) != SQLITE_OK)
@@ -679,7 +679,7 @@ void LocalStore::checkDerivationOutputs(const StorePath & drvPath, const Derivat
 {
     assert(drvPath.isDerivation());
     std::string drvName(drvPath.name());
-    drvName = string(drvName, 0, drvName.size() - drvExtension.size());
+    drvName = drvName.substr(0, drvName.size() - drvExtension.size());
 
     auto envHasRightPath = [&](const StorePath & actual, const std::string & varName)
     {
@@ -786,7 +786,11 @@ void LocalStore::registerDrvOutput(const Realisation & info)
     });
 }
 
-void LocalStore::cacheDrvOutputMapping(State & state, const uint64_t deriver, const string & outputName, const StorePath & output)
+void LocalStore::cacheDrvOutputMapping(
+    State & state,
+    const uint64_t deriver,
+    const std::string & outputName,
+    const StorePath & output)
 {
     retrySQLite<void>([&]() {
         state.stmts->AddDerivationOutput.use()
@@ -795,7 +799,6 @@ void LocalStore::cacheDrvOutputMapping(State & state, const uint64_t deriver, co
             (printStorePath(output))
             .exec();
     });
-
 }
 
 
@@ -1436,7 +1439,9 @@ StorePath LocalStore::addToStoreFromDump(Source & source0, std::string_view name
 }
 
 
-StorePath LocalStore::addTextToStore(const string & name, const string & s,
+StorePath LocalStore::addTextToStore(
+    std::string_view name,
+    std::string_view s,
     const StorePathSet & references, RepairFlag repair)
 {
     auto hash = hashString(htSHA256, s);
@@ -1548,7 +1553,7 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
         for (auto & link : readDirectory(linksDir)) {
             printMsg(lvlTalkative, "checking contents of '%s'", link.name);
             Path linkPath = linksDir + "/" + link.name;
-            string hash = hashPath(htSHA256, linkPath).first.to_string(Base32, false);
+            std::string hash = hashPath(htSHA256, linkPath).first.to_string(Base32, false);
             if (hash != link.name) {
                 printError("link '%s' was modified! expected hash '%s', got '%s'",
                     linkPath, link.name, hash);
diff --git a/src/libstore/local-store.hh b/src/libstore/local-store.hh
index a9c7475ac..1a278c9a8 100644
--- a/src/libstore/local-store.hh
+++ b/src/libstore/local-store.hh
@@ -147,8 +147,11 @@ public:
     StorePath addToStoreFromDump(Source & dump, std::string_view name,
         FileIngestionMethod method, HashType hashAlgo, RepairFlag repair, const StorePathSet & references) override;
 
-    StorePath addTextToStore(const string & name, const string & s,
-        const StorePathSet & references, RepairFlag repair) override;
+    StorePath addTextToStore(
+        std::string_view name,
+        std::string_view s,
+        const StorePathSet & references,
+        RepairFlag repair) override;
 
     void addTempRoot(const StorePath & path) override;
 
@@ -204,7 +207,11 @@ public:
        derivation 'deriver'. */
     void registerDrvOutput(const Realisation & info) override;
     void registerDrvOutput(const Realisation & info, CheckSigsFlag checkSigs) override;
-    void cacheDrvOutputMapping(State & state, const uint64_t deriver, const string & outputName, const StorePath & output);
+    void cacheDrvOutputMapping(
+        State & state,
+        const uint64_t deriver,
+        const std::string & outputName,
+        const StorePath & output);
 
     std::optional<const Realisation> queryRealisation_(State & state, const DrvOutput & id);
     std::optional<std::pair<int64_t, Realisation>> queryRealisationCore_(State & state, const DrvOutput & id);
diff --git a/src/libstore/lock.hh b/src/libstore/lock.hh
index 8fbb67ddc..3d29a7b5b 100644
--- a/src/libstore/lock.hh
+++ b/src/libstore/lock.hh
@@ -13,7 +13,7 @@ private:
     AutoCloseFD fdUserLock;
 
     bool isEnabled = false;
-    string user;
+    std::string user;
     uid_t uid = 0;
     gid_t gid = 0;
     std::vector<gid_t> supplementaryGIDs;
@@ -23,7 +23,7 @@ public:
 
     void kill();
 
-    string getUser() { return user; }
+    std::string getUser() { return user; }
     uid_t getUID() { assert(uid); return uid; }
     uid_t getGID() { assert(gid); return gid; }
     std::vector<gid_t> getSupplementaryGIDs() { return supplementaryGIDs; }
diff --git a/src/libstore/machines.cc b/src/libstore/machines.cc
index b6270a81b..e87f46980 100644
--- a/src/libstore/machines.cc
+++ b/src/libstore/machines.cc
@@ -39,19 +39,19 @@ Machine::Machine(decltype(storeUri) storeUri,
     sshPublicHostKey(sshPublicHostKey)
 {}
 
-bool Machine::allSupported(const std::set<string> & features) const
+bool Machine::allSupported(const std::set<std::string> & features) const
 {
     return std::all_of(features.begin(), features.end(),
-        [&](const string & feature) {
+        [&](const std::string & feature) {
             return supportedFeatures.count(feature) ||
                 mandatoryFeatures.count(feature);
         });
 }
 
-bool Machine::mandatoryMet(const std::set<string> & features) const
+bool Machine::mandatoryMet(const std::set<std::string> & features) const
 {
     return std::all_of(mandatoryFeatures.begin(), mandatoryFeatures.end(),
-        [&](const string & feature) {
+        [&](const std::string & feature) {
             return features.count(feature);
         });
 }
@@ -89,7 +89,7 @@ ref<Store> Machine::openStore() const
 static std::vector<std::string> expandBuilderLines(const std::string & builders)
 {
     std::vector<std::string> result;
-    for (auto line : tokenizeString<std::vector<string>>(builders, "\n;")) {
+    for (auto line : tokenizeString<std::vector<std::string>>(builders, "\n;")) {
         trim(line);
         line.erase(std::find(line.begin(), line.end(), '#'), line.end());
         if (line.empty()) continue;
@@ -117,7 +117,7 @@ static std::vector<std::string> expandBuilderLines(const std::string & builders)
 
 static Machine parseBuilderLine(const std::string & line)
 {
-    const auto tokens = tokenizeString<std::vector<string>>(line);
+    const auto tokens = tokenizeString<std::vector<std::string>>(line);
 
     auto isSet = [&](size_t fieldIndex) {
         return tokens.size() > fieldIndex && tokens[fieldIndex] != "" && tokens[fieldIndex] != "-";
@@ -146,17 +146,18 @@ static Machine parseBuilderLine(const std::string & line)
 
     return {
         tokens[0],
-        isSet(1) ? tokenizeString<std::vector<string>>(tokens[1], ",") : std::vector<string>{settings.thisSystem},
+        isSet(1) ? tokenizeString<std::vector<std::string>>(tokens[1], ",") : std::vector<std::string>{settings.thisSystem},
         isSet(2) ? tokens[2] : "",
         isSet(3) ? parseUnsignedIntField(3) : 1U,
         isSet(4) ? parseUnsignedIntField(4) : 1U,
-        isSet(5) ? tokenizeString<std::set<string>>(tokens[5], ",") : std::set<string>{},
-        isSet(6) ? tokenizeString<std::set<string>>(tokens[6], ",") : std::set<string>{},
+        isSet(5) ? tokenizeString<std::set<std::string>>(tokens[5], ",") : std::set<std::string>{},
+        isSet(6) ? tokenizeString<std::set<std::string>>(tokens[6], ",") : std::set<std::string>{},
         isSet(7) ? ensureBase64(7) : ""
     };
 }
 
-static Machines parseBuilderLines(const std::vector<std::string>& builders) {
+static Machines parseBuilderLines(const std::vector<std::string> & builders)
+{
     Machines result;
     std::transform(builders.begin(), builders.end(), std::back_inserter(result), parseBuilderLine);
     return result;
diff --git a/src/libstore/nar-accessor.cc b/src/libstore/nar-accessor.cc
index 7d27d7667..72d41cc94 100644
--- a/src/libstore/nar-accessor.cc
+++ b/src/libstore/nar-accessor.cc
@@ -90,7 +90,7 @@ struct NarAccessor : public FSAccessor
         void receiveContents(std::string_view data) override
         { }
 
-        void createSymlink(const Path & path, const string & target) override
+        void createSymlink(const Path & path, const std::string & target) override
         {
             createMember(path,
                 NarMember{FSAccessor::Type::tSymlink, false, 0, 0, target});
diff --git a/src/libstore/nar-info.cc b/src/libstore/nar-info.cc
index 49079388a..2d75e7a82 100644
--- a/src/libstore/nar-info.cc
+++ b/src/libstore/nar-info.cc
@@ -11,7 +11,7 @@ NarInfo::NarInfo(const Store & store, const std::string & s, const std::string &
         return Error("NAR info file '%1%' is corrupt", whence);
     };
 
-    auto parseHashField = [&](const string & s) {
+    auto parseHashField = [&](const std::string & s) {
         try {
             return Hash::parseAnyPrefixed(s);
         } catch (BadHash &) {
diff --git a/src/libstore/optimise-store.cc b/src/libstore/optimise-store.cc
index 13cb142f8..8af9b1dde 100644
--- a/src/libstore/optimise-store.cc
+++ b/src/libstore/optimise-store.cc
@@ -77,7 +77,7 @@ Strings LocalStore::readDirectoryIgnoringInodes(const Path & path, const InodeHa
             continue;
         }
 
-        string name = dirent->d_name;
+        std::string name = dirent->d_name;
         if (name == "." || name == "..") continue;
         names.push_back(name);
     }
diff --git a/src/libstore/path-with-outputs.cc b/src/libstore/path-with-outputs.cc
index e5a121e00..97aa01b57 100644
--- a/src/libstore/path-with-outputs.cc
+++ b/src/libstore/path-with-outputs.cc
@@ -49,9 +49,9 @@ std::pair<std::string_view, StringSet> parsePathWithOutputs(std::string_view s)
 {
     size_t n = s.find("!");
     return n == s.npos
-        ? std::make_pair(s, std::set<string>())
+        ? std::make_pair(s, std::set<std::string>())
         : std::make_pair(((std::string_view) s).substr(0, n),
-            tokenizeString<std::set<string>>(((std::string_view) s).substr(n + 1), ","));
+            tokenizeString<std::set<std::string>>(((std::string_view) s).substr(n + 1), ","));
 }
 
 
diff --git a/src/libstore/path.hh b/src/libstore/path.hh
index 06ba0663b..e65fee622 100644
--- a/src/libstore/path.hh
+++ b/src/libstore/path.hh
@@ -62,7 +62,7 @@ public:
 
 typedef std::set<StorePath> StorePathSet;
 typedef std::vector<StorePath> StorePaths;
-typedef std::map<string, StorePath> OutputPathMap;
+typedef std::map<std::string, StorePath> OutputPathMap;
 
 typedef std::map<StorePath, std::optional<ContentAddress>> StorePathCAMap;
 
diff --git a/src/libstore/pathlocks.cc b/src/libstore/pathlocks.cc
index 2da74e262..42023cd0a 100644
--- a/src/libstore/pathlocks.cc
+++ b/src/libstore/pathlocks.cc
@@ -74,7 +74,7 @@ PathLocks::PathLocks()
 }
 
 
-PathLocks::PathLocks(const PathSet & paths, const string & waitMsg)
+PathLocks::PathLocks(const PathSet & paths, const std::string & waitMsg)
     : deletePaths(false)
 {
     lockPaths(paths, waitMsg);
@@ -82,7 +82,7 @@ PathLocks::PathLocks(const PathSet & paths, const string & waitMsg)
 
 
 bool PathLocks::lockPaths(const PathSet & paths,
-    const string & waitMsg, bool wait)
+    const std::string & waitMsg, bool wait)
 {
     assert(fds.empty());
 
diff --git a/src/libstore/pathlocks.hh b/src/libstore/pathlocks.hh
index 759b9a584..5e3a734b4 100644
--- a/src/libstore/pathlocks.hh
+++ b/src/libstore/pathlocks.hh
@@ -26,9 +26,9 @@ private:
 public:
     PathLocks();
     PathLocks(const PathSet & paths,
-        const string & waitMsg = "");
+        const std::string & waitMsg = "");
     bool lockPaths(const PathSet & _paths,
-        const string & waitMsg = "",
+        const std::string & waitMsg = "",
         bool wait = true);
     ~PathLocks();
     void unlock();
diff --git a/src/libstore/profiles.cc b/src/libstore/profiles.cc
index 73163424c..3e4188188 100644
--- a/src/libstore/profiles.cc
+++ b/src/libstore/profiles.cc
@@ -15,12 +15,12 @@ namespace nix {
 
 /* Parse a generation name of the format
    `<profilename>-<number>-link'. */
-static std::optional<GenerationNumber> parseName(const string & profileName, const string & name)
+static std::optional<GenerationNumber> parseName(const std::string & profileName, const std::string & name)
 {
-    if (string(name, 0, profileName.size() + 1) != profileName + "-") return {};
-    string s = string(name, profileName.size() + 1);
-    string::size_type p = s.find("-link");
-    if (p == string::npos) return {};
+    if (name.substr(0, profileName.size() + 1) != profileName + "-") return {};
+    auto s = name.substr(profileName.size() + 1);
+    auto p = s.find("-link");
+    if (p == std::string::npos) return {};
     if (auto n = string2Int<unsigned int>(s.substr(0, p)))
         return *n;
     else
@@ -209,13 +209,13 @@ void deleteGenerationsOlderThan(const Path & profile, time_t t, bool dryRun)
 }
 
 
-void deleteGenerationsOlderThan(const Path & profile, const string & timeSpec, bool dryRun)
+void deleteGenerationsOlderThan(const Path & profile, std::string_view timeSpec, bool dryRun)
 {
     if (timeSpec.empty() || timeSpec[timeSpec.size() - 1] != 'd')
         throw UsageError("invalid number of days specifier '%1%', expected something like '14d'", timeSpec);
 
     time_t curTime = time(0);
-    string strDays = string(timeSpec, 0, timeSpec.size() - 1);
+    auto strDays = timeSpec.substr(0, timeSpec.size() - 1);
     auto days = string2Int<int>(strDays);
 
     if (!days || *days < 1)
@@ -274,7 +274,7 @@ void lockProfile(PathLocks & lock, const Path & profile)
 }
 
 
-string optimisticLockProfile(const Path & profile)
+std::string optimisticLockProfile(const Path & profile)
 {
     return pathExists(profile) ? readLink(profile) : "";
 }
diff --git a/src/libstore/profiles.hh b/src/libstore/profiles.hh
index d100c970c..408ca039c 100644
--- a/src/libstore/profiles.hh
+++ b/src/libstore/profiles.hh
@@ -42,7 +42,7 @@ void deleteOldGenerations(const Path & profile, bool dryRun);
 
 void deleteGenerationsOlderThan(const Path & profile, time_t t, bool dryRun);
 
-void deleteGenerationsOlderThan(const Path & profile, const string & timeSpec, bool dryRun);
+void deleteGenerationsOlderThan(const Path & profile, std::string_view timeSpec, bool dryRun);
 
 void switchLink(Path link, Path target);
 
@@ -66,7 +66,7 @@ void lockProfile(PathLocks & lock, const Path & profile);
    generally cheap, since the build results are still in the Nix
    store.  Most of the time, only the user environment has to be
    rebuilt. */
-string optimisticLockProfile(const Path & profile);
+std::string optimisticLockProfile(const Path & profile);
 
 /* Resolve ~/.nix-profile. If ~/.nix-profile doesn't exist yet, create
    it. */
diff --git a/src/libstore/references.cc b/src/libstore/references.cc
index 91b3fc142..34dce092c 100644
--- a/src/libstore/references.cc
+++ b/src/libstore/references.cc
@@ -68,7 +68,7 @@ void RefScanSink::operator () (std::string_view data)
 
 
 std::pair<StorePathSet, HashResult> scanForReferences(
-    const string & path,
+    const std::string & path,
     const StorePathSet & refs)
 {
     HashSink hashSink { htSHA256 };
@@ -121,7 +121,7 @@ void RewritingSink::operator () (std::string_view data)
     s.append(data);
 
     size_t j = 0;
-    while ((j = s.find(from, j)) != string::npos) {
+    while ((j = s.find(from, j)) != std::string::npos) {
         matches.push_back(pos + j);
         s.replace(j, from.size(), to);
     }
diff --git a/src/libstore/remote-store.cc b/src/libstore/remote-store.cc
index c6f083dea..e7ffa6595 100644
--- a/src/libstore/remote-store.cc
+++ b/src/libstore/remote-store.cc
@@ -661,8 +661,11 @@ void RemoteStore::addMultipleToStore(
 }
 
 
-StorePath RemoteStore::addTextToStore(const string & name, const string & s,
-    const StorePathSet & references, RepairFlag repair)
+StorePath RemoteStore::addTextToStore(
+    std::string_view name,
+    std::string_view s,
+    const StorePathSet & references,
+    RepairFlag repair)
 {
     StringSource source(s);
     return addCAToStore(source, name, TextHashMethod{}, references, repair)->path;
@@ -1000,7 +1003,7 @@ std::exception_ptr RemoteStore::Connection::processStderr(Sink * sink, Source *
         auto msg = readNum<uint64_t>(from);
 
         if (msg == STDERR_WRITE) {
-            string s = readString(from);
+            auto s = readString(from);
             if (!sink) throw Error("no sink");
             (*sink)(s);
         }
@@ -1017,7 +1020,7 @@ std::exception_ptr RemoteStore::Connection::processStderr(Sink * sink, Source *
             if (GET_PROTOCOL_MINOR(daemonVersion) >= 26) {
                 return std::make_exception_ptr(readError(from));
             } else {
-                string error = readString(from);
+                auto error = readString(from);
                 unsigned int status = readInt(from);
                 return std::make_exception_ptr(Error(status, error));
             }
diff --git a/src/libstore/remote-store.hh b/src/libstore/remote-store.hh
index 55cfd5cc6..b94216d31 100644
--- a/src/libstore/remote-store.hh
+++ b/src/libstore/remote-store.hh
@@ -83,8 +83,11 @@ public:
         RepairFlag repair,
         CheckSigsFlag checkSigs) override;
 
-    StorePath addTextToStore(const string & name, const string & s,
-        const StorePathSet & references, RepairFlag repair) override;
+    StorePath addTextToStore(
+        std::string_view name,
+        std::string_view s,
+        const StorePathSet & references,
+        RepairFlag repair) override;
 
     void registerDrvOutput(const Realisation & info) override;
 
diff --git a/src/libstore/s3-binary-cache-store.cc b/src/libstore/s3-binary-cache-store.cc
index a024e971d..844553ad3 100644
--- a/src/libstore/s3-binary-cache-store.cc
+++ b/src/libstore/s3-binary-cache-store.cc
@@ -87,7 +87,11 @@ static void initAWS()
     });
 }
 
-S3Helper::S3Helper(const string & profile, const string & region, const string & scheme, const string & endpoint)
+S3Helper::S3Helper(
+    const std::string & profile,
+    const std::string & region,
+    const std::string & scheme,
+    const std::string & endpoint)
     : config(makeConfig(region, scheme, endpoint))
     , client(make_ref<Aws::S3::S3Client>(
             profile == ""
@@ -121,7 +125,10 @@ class RetryStrategy : public Aws::Client::DefaultRetryStrategy
     }
 };
 
-ref<Aws::Client::ClientConfiguration> S3Helper::makeConfig(const string & region, const string & scheme, const string & endpoint)
+ref<Aws::Client::ClientConfiguration> S3Helper::makeConfig(
+    const std::string & region,
+    const std::string & scheme,
+    const std::string & endpoint)
 {
     initAWS();
     auto res = make_ref<Aws::Client::ClientConfiguration>();
diff --git a/src/libstore/sqlite.cc b/src/libstore/sqlite.cc
index 1d6baf02d..e6ecadd7f 100644
--- a/src/libstore/sqlite.cc
+++ b/src/libstore/sqlite.cc
@@ -71,7 +71,7 @@ uint64_t SQLite::getLastInsertedRowId()
     return sqlite3_last_insert_rowid(db);
 }
 
-void SQLiteStmt::create(sqlite3 * db, const string & sql)
+void SQLiteStmt::create(sqlite3 * db, const std::string & sql)
 {
     checkInterrupt();
     assert(!stmt);
diff --git a/src/libstore/ssh.cc b/src/libstore/ssh.cc
index 93f72675d..1bbad71f2 100644
--- a/src/libstore/ssh.cc
+++ b/src/libstore/ssh.cc
@@ -29,7 +29,7 @@ void SSHMaster::addCommonSSHOpts(Strings & args)
     if (!sshPublicHostKey.empty()) {
         Path fileName = (Path) *state->tmpDir + "/host-key";
         auto p = host.rfind("@");
-        string thost = p != string::npos ? string(host, p + 1) : host;
+        std::string thost = p != std::string::npos ? std::string(host, p + 1) : host;
         writeFile(fileName, thost + " " + base64Decode(sshPublicHostKey) + "\n");
         args.insert(args.end(), {"-oUserKnownHostsFile=" + fileName});
     }
diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index 8fcdc8b57..86fa6a211 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -39,7 +39,7 @@ Path Store::followLinksToStore(std::string_view _path) const
     Path path = absPath(std::string(_path));
     while (!isInStore(path)) {
         if (!isLink(path)) break;
-        string target = readLink(path);
+        auto target = readLink(path);
         path = absPath(target, dirOf(path));
     }
     if (!isInStore(path))
@@ -138,8 +138,8 @@ StorePath Store::makeStorePath(std::string_view type,
     std::string_view hash, std::string_view name) const
 {
     /* e.g., "source:sha256:1abc...:/nix/store:foo.tar.gz" */
-    string s = std::string { type } + ":" + std::string { hash }
-        + ":" + storeDir + ":" + std::string { name };
+    auto s = std::string(type) + ":" + std::string(hash)
+        + ":" + storeDir + ":" + std::string(name);
     auto h = compressHash(hashString(htSHA256, s), 20);
     return StorePath(h, name);
 }
@@ -161,7 +161,7 @@ StorePath Store::makeOutputPath(std::string_view id,
 
 static std::string makeType(
     const Store & store,
-    string && type,
+    std::string && type,
     const StorePathSet & references,
     bool hasSelfReference = false)
 {
@@ -229,15 +229,23 @@ std::pair<StorePath, Hash> Store::computeStorePathForPath(std::string_view name,
 }
 
 
-StorePath Store::computeStorePathForText(const string & name, const string & s,
+StorePath Store::computeStorePathForText(
+    std::string_view name,
+    std::string_view s,
     const StorePathSet & references) const
 {
     return makeTextPath(name, hashString(htSHA256, s), references);
 }
 
 
-StorePath Store::addToStore(const string & name, const Path & _srcPath,
-    FileIngestionMethod method, HashType hashAlgo, PathFilter & filter, RepairFlag repair, const StorePathSet & references)
+StorePath Store::addToStore(
+    std::string_view name,
+    const Path & _srcPath,
+    FileIngestionMethod method,
+    HashType hashAlgo,
+    PathFilter & filter,
+    RepairFlag repair,
+    const StorePathSet & references)
 {
     Path srcPath(absPath(_srcPath));
     auto source = sinkToSource([&](Sink & sink) {
@@ -688,10 +696,10 @@ StorePathSet Store::queryValidPaths(const StorePathSet & paths, SubstituteFlag m
 /* Return a string accepted by decodeValidPathInfo() that
    registers the specified paths as valid.  Note: it's the
    responsibility of the caller to provide a closure. */
-string Store::makeValidityRegistration(const StorePathSet & paths,
+std::string Store::makeValidityRegistration(const StorePathSet & paths,
     bool showDerivers, bool showHash)
 {
-    string s = "";
+    std::string s = "";
 
     for (auto & i : paths) {
         s += printStorePath(i) + "\n";
@@ -1131,7 +1139,7 @@ std::optional<ValidPathInfo> decodeValidPathInfo(const Store & store, std::istre
     getline(str, path);
     if (str.eof()) { return {}; }
     if (!hashGiven) {
-        string s;
+        std::string s;
         getline(str, s);
         auto narHash = Hash::parseAny(s, htSHA256);
         getline(str, s);
@@ -1144,7 +1152,7 @@ std::optional<ValidPathInfo> decodeValidPathInfo(const Store & store, std::istre
     std::string deriver;
     getline(str, deriver);
     if (deriver != "") info.deriver = store.parseStorePath(deriver);
-    string s;
+    std::string s;
     getline(str, s);
     auto n = string2Int<int>(s);
     if (!n) throw Error("number expected");
@@ -1168,7 +1176,7 @@ std::string Store::showPaths(const StorePathSet & paths)
 }
 
 
-string showPaths(const PathSet & paths)
+std::string showPaths(const PathSet & paths)
 {
     return concatStringsSep(", ", quoteStrings(paths));
 }
diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
index 90d2e93ed..e4fb1f1fd 100644
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@@ -352,7 +352,9 @@ public:
        simply yield a different store path, so other users wouldn't be
        affected), but it has some backwards compatibility issues (the
        hashing scheme changes), so I'm not doing that for now. */
-    StorePath computeStorePathForText(const string & name, const string & s,
+    StorePath computeStorePathForText(
+        std::string_view name,
+        std::string_view s,
         const StorePathSet & references) const;
 
     /* Check whether a path is valid. */
@@ -482,9 +484,14 @@ public:
        validity the resulting path.  The resulting path is returned.
        The function object `filter' can be used to exclude files (see
        libutil/archive.hh). */
-    virtual StorePath addToStore(const string & name, const Path & srcPath,
-        FileIngestionMethod method = FileIngestionMethod::Recursive, HashType hashAlgo = htSHA256,
-        PathFilter & filter = defaultPathFilter, RepairFlag repair = NoRepair, const StorePathSet & references = StorePathSet());
+    virtual StorePath addToStore(
+        std::string_view name,
+        const Path & srcPath,
+        FileIngestionMethod method = FileIngestionMethod::Recursive,
+        HashType hashAlgo = htSHA256,
+        PathFilter & filter = defaultPathFilter,
+        RepairFlag repair = NoRepair,
+        const StorePathSet & references = StorePathSet());
 
     /* Copy the contents of a path to the store and register the
        validity the resulting path, using a constant amount of
@@ -506,8 +513,11 @@ public:
 
     /* Like addToStore, but the contents written to the output path is
        a regular file containing the given string. */
-    virtual StorePath addTextToStore(const string & name, const string & s,
-        const StorePathSet & references, RepairFlag repair = NoRepair) = 0;
+    virtual StorePath addTextToStore(
+        std::string_view name,
+        std::string_view s,
+        const StorePathSet & references,
+        RepairFlag repair = NoRepair) = 0;
 
     /**
      * Add a mapping indicating that `deriver!outputName` maps to the output path
@@ -608,7 +618,7 @@ public:
     /* Return a string representing information about the path that
        can be loaded into the database using `nix-store --load-db' or
        `nix-store --register-validity'. */
-    string makeValidityRegistration(const StorePathSet & paths,
+    std::string makeValidityRegistration(const StorePathSet & paths,
         bool showDerivers, bool showHash);
 
     /* Write a JSON representation of store path metadata, such as the
@@ -910,7 +920,7 @@ struct RegisterStoreImplementation
 
 /* Display a set of paths in human-readable form (i.e., between quotes
    and separated by commas). */
-string showPaths(const PathSet & paths);
+std::string showPaths(const PathSet & paths);
 
 
 std::optional<ValidPathInfo> decodeValidPathInfo(
diff --git a/src/libutil/archive.cc b/src/libutil/archive.cc
index fdee643b1..eda004756 100644
--- a/src/libutil/archive.cc
+++ b/src/libutil/archive.cc
@@ -37,7 +37,7 @@ static GlobalConfig::Register rArchiveSettings(&archiveSettings);
 
 const std::string narVersionMagic1 = "nix-archive-1";
 
-static string caseHackSuffix = "~nix~case~hack~";
+static std::string caseHackSuffix = "~nix~case~hack~";
 
 PathFilter defaultPathFilter = [](const Path &) { return true; };
 
@@ -84,12 +84,12 @@ static void dump(const Path & path, Sink & sink, PathFilter & filter)
 
         /* If we're on a case-insensitive system like macOS, undo
            the case hack applied by restorePath(). */
-        std::map<string, string> unhacked;
+        std::map<std::string, std::string> unhacked;
         for (auto & i : readDirectory(path))
             if (archiveSettings.useCaseHack) {
-                string name(i.name);
+                std::string name(i.name);
                 size_t pos = i.name.find(caseHackSuffix);
-                if (pos != string::npos) {
+                if (pos != std::string::npos) {
                     debug(format("removing case hack suffix from '%1%'") % (path + "/" + i.name));
                     name.erase(pos);
                 }
@@ -124,13 +124,13 @@ void dumpPath(const Path & path, Sink & sink, PathFilter & filter)
 }
 
 
-void dumpString(const std::string & s, Sink & sink)
+void dumpString(std::string_view s, Sink & sink)
 {
     sink << narVersionMagic1 << "(" << "type" << "regular" << "contents" << s << ")";
 }
 
 
-static SerialisationError badArchive(string s)
+static SerialisationError badArchive(const std::string & s)
 {
     return SerialisationError("bad archive: " + s);
 }
@@ -171,7 +171,7 @@ static void parseContents(ParseSink & sink, Source & source, const Path & path)
 
 struct CaseInsensitiveCompare
 {
-    bool operator() (const string & a, const string & b) const
+    bool operator() (const std::string & a, const std::string & b) const
     {
         return strcasecmp(a.c_str(), b.c_str()) < 0;
     }
@@ -180,7 +180,7 @@ struct CaseInsensitiveCompare
 
 static void parse(ParseSink & sink, Source & source, const Path & path)
 {
-    string s;
+    std::string s;
 
     s = readString(source);
     if (s != "(") throw badArchive("expected open tag");
@@ -201,7 +201,7 @@ static void parse(ParseSink & sink, Source & source, const Path & path)
         else if (s == "type") {
             if (type != tpUnknown)
                 throw badArchive("multiple type fields");
-            string t = readString(source);
+            std::string t = readString(source);
 
             if (t == "regular") {
                 type = tpRegular;
@@ -232,7 +232,7 @@ static void parse(ParseSink & sink, Source & source, const Path & path)
         }
 
         else if (s == "entry" && type == tpDirectory) {
-            string name, prevName;
+            std::string name, prevName;
 
             s = readString(source);
             if (s != "(") throw badArchive("expected open tag");
@@ -246,7 +246,7 @@ static void parse(ParseSink & sink, Source & source, const Path & path)
                     break;
                 } else if (s == "name") {
                     name = readString(source);
-                    if (name.empty() || name == "." || name == ".." || name.find('/') != string::npos || name.find((char) 0) != string::npos)
+                    if (name.empty() || name == "." || name == ".." || name.find('/') != std::string::npos || name.find((char) 0) != std::string::npos)
                         throw Error("NAR contains invalid file name '%1%'", name);
                     if (name <= prevName)
                         throw Error("NAR directory is not sorted");
@@ -269,7 +269,7 @@ static void parse(ParseSink & sink, Source & source, const Path & path)
         }
 
         else if (s == "target" && type == tpSymlink) {
-            string target = readString(source);
+            std::string target = readString(source);
             sink.createSymlink(path, target);
         }
 
@@ -281,7 +281,7 @@ static void parse(ParseSink & sink, Source & source, const Path & path)
 
 void parseDump(ParseSink & sink, Source & source)
 {
-    string version;
+    std::string version;
     try {
         version = readString(source, narVersionMagic1.size());
     } catch (SerialisationError & e) {
@@ -345,7 +345,7 @@ struct RestoreSink : ParseSink
         writeFull(fd.get(), data);
     }
 
-    void createSymlink(const Path & path, const string & target) override
+    void createSymlink(const Path & path, const std::string & target) override
     {
         Path p = dstPath + path;
         nix::createSymlink(target, p);
diff --git a/src/libutil/archive.hh b/src/libutil/archive.hh
index 9e9e11b1a..fca351605 100644
--- a/src/libutil/archive.hh
+++ b/src/libutil/archive.hh
@@ -48,7 +48,7 @@ namespace nix {
 void dumpPath(const Path & path, Sink & sink,
     PathFilter & filter = defaultPathFilter);
 
-void dumpString(const std::string & s, Sink & sink);
+void dumpString(std::string_view s, Sink & sink);
 
 /* FIXME: fix this API, it sucks. */
 struct ParseSink
@@ -60,7 +60,7 @@ struct ParseSink
     virtual void preallocateContents(uint64_t size) { };
     virtual void receiveContents(std::string_view data) { };
 
-    virtual void createSymlink(const Path & path, const string & target) { };
+    virtual void createSymlink(const Path & path, const std::string & target) { };
 };
 
 /* If the NAR archive contains a single file at top-level, then save
@@ -82,7 +82,7 @@ struct RetrieveRegularNARSink : ParseSink
         sink(data);
     }
 
-    void createSymlink(const Path & path, const string & target) override
+    void createSymlink(const Path & path, const std::string & target) override
     {
         regular = false;
     }
diff --git a/src/libutil/args.cc b/src/libutil/args.cc
index a739d6b4e..f970c0e9e 100644
--- a/src/libutil/args.cc
+++ b/src/libutil/args.cc
@@ -76,13 +76,13 @@ void Args::parseCmdline(const Strings & _cmdline)
         /* Expand compound dash options (i.e., `-qlf' -> `-q -l -f',
            `-j3` -> `-j 3`). */
         if (!dashDash && arg.length() > 2 && arg[0] == '-' && arg[1] != '-' && isalpha(arg[1])) {
-            *pos = (string) "-" + arg[1];
+            *pos = (std::string) "-" + arg[1];
             auto next = pos; ++next;
             for (unsigned int j = 2; j < arg.length(); j++)
                 if (isalpha(arg[j]))
-                    cmdline.insert(next, (string) "-" + arg[j]);
+                    cmdline.insert(next, (std::string) "-" + arg[j]);
                 else {
-                    cmdline.insert(next, string(arg, j));
+                    cmdline.insert(next, std::string(arg, j));
                     break;
                 }
             arg = *pos;
@@ -139,7 +139,7 @@ bool Args::processFlag(Strings::iterator & pos, Strings::iterator end)
         return true;
     };
 
-    if (string(*pos, 0, 2) == "--") {
+    if (std::string(*pos, 0, 2) == "--") {
         if (auto prefix = needsCompletion(*pos)) {
             for (auto & [name, flag] : longFlags) {
                 if (!hiddenCategories.count(flag->category)
@@ -147,12 +147,12 @@ bool Args::processFlag(Strings::iterator & pos, Strings::iterator end)
                     completions->add("--" + name, flag->description);
             }
         }
-        auto i = longFlags.find(string(*pos, 2));
+        auto i = longFlags.find(std::string(*pos, 2));
         if (i == longFlags.end()) return false;
         return process("--" + i->first, *i->second);
     }
 
-    if (string(*pos, 0, 1) == "-" && pos->size() == 2) {
+    if (std::string(*pos, 0, 1) == "-" && pos->size() == 2) {
         auto c = (*pos)[1];
         auto i = shortFlags.find(c);
         if (i == shortFlags.end()) return false;
diff --git a/src/libutil/args.hh b/src/libutil/args.hh
index 76b1cfe92..fdd036f9a 100644
--- a/src/libutil/args.hh
+++ b/src/libutil/args.hh
@@ -158,7 +158,7 @@ public:
     }
 
     /* Expect a string argument. */
-    void expectArg(const std::string & label, string * dest, bool optional = false)
+    void expectArg(const std::string & label, std::string * dest, bool optional = false)
     {
         expectArgs({
             .label = label,
diff --git a/src/libutil/config.cc b/src/libutil/config.cc
index 8e05f1765..9bb412b4f 100644
--- a/src/libutil/config.cc
+++ b/src/libutil/config.cc
@@ -81,16 +81,16 @@ void AbstractConfig::applyConfig(const std::string & contents, const std::string
     unsigned int pos = 0;
 
     while (pos < contents.size()) {
-        string line;
+        std::string line;
         while (pos < contents.size() && contents[pos] != '\n')
             line += contents[pos++];
         pos++;
 
-        string::size_type hash = line.find('#');
-        if (hash != string::npos)
-            line = string(line, 0, hash);
+        auto hash = line.find('#');
+        if (hash != std::string::npos)
+            line = std::string(line, 0, hash);
 
-        auto tokens = tokenizeString<std::vector<string>>(line);
+        auto tokens = tokenizeString<std::vector<std::string>>(line);
         if (tokens.empty()) continue;
 
         if (tokens.size() < 2)
@@ -120,7 +120,7 @@ void AbstractConfig::applyConfig(const std::string & contents, const std::string
         if (tokens[1] != "=")
             throw UsageError("illegal configuration line '%1%' in '%2%'", line, path);
 
-        string name = tokens[0];
+        std::string name = tokens[0];
 
         auto i = tokens.begin();
         advance(i, 2);
@@ -132,7 +132,7 @@ void AbstractConfig::applyConfig(const std::string & contents, const std::string
 void AbstractConfig::applyConfigFile(const Path & path)
 {
     try {
-        string contents = readFile(path);
+        std::string contents = readFile(path);
         applyConfig(contents, path);
     } catch (SysError &) { }
 }
diff --git a/src/libutil/error.cc b/src/libutil/error.cc
index dd9678ee7..dcd2f82a5 100644
--- a/src/libutil/error.cc
+++ b/src/libutil/error.cc
@@ -17,7 +17,7 @@ BaseError & BaseError::addTrace(std::optional<ErrPos> e, hintformat hint)
 
 // c++ std::exception descendants must have a 'const char* what()' function.
 // This stringifies the error and caches it for use by what(), or similarly by msg().
-const string & BaseError::calcWhat() const
+const std::string & BaseError::calcWhat() const
 {
     if (what_.has_value())
         return *what_;
@@ -32,14 +32,14 @@ const string & BaseError::calcWhat() const
     }
 }
 
-std::optional<string> ErrorInfo::programName = std::nullopt;
+std::optional<std::string> ErrorInfo::programName = std::nullopt;
 
 std::ostream & operator<<(std::ostream & os, const hintformat & hf)
 {
     return os << hf.str();
 }
 
-string showErrPos(const ErrPos & errPos)
+std::string showErrPos(const ErrPos & errPos)
 {
     if (errPos.line > 0) {
         if (errPos.column > 0) {
@@ -68,7 +68,7 @@ std::optional<LinesOfCode> getCodeLines(const ErrPos & errPos)
 
             // count the newlines.
             int count = 0;
-            string line;
+            std::string line;
             int pl = errPos.line - 1;
             do
             {
@@ -100,7 +100,7 @@ std::optional<LinesOfCode> getCodeLines(const ErrPos & errPos)
         std::istringstream iss(errPos.file);
         // count the newlines.
         int count = 0;
-        string line;
+        std::string line;
         int pl = errPos.line - 1;
 
         LinesOfCode loc;
@@ -132,7 +132,7 @@ std::optional<LinesOfCode> getCodeLines(const ErrPos & errPos)
 
 // print lines of code to the ostream, indicating the error column.
 void printCodeLines(std::ostream & out,
-    const string & prefix,
+    const std::string & prefix,
     const ErrPos & errPos,
     const LinesOfCode & loc)
 {
diff --git a/src/libutil/error.hh b/src/libutil/error.hh
index 6fe5e4857..d55e1d701 100644
--- a/src/libutil/error.hh
+++ b/src/libutil/error.hh
@@ -61,16 +61,16 @@ typedef enum {
 
 // the lines of code surrounding an error.
 struct LinesOfCode {
-    std::optional<string> prevLineOfCode;
-    std::optional<string> errLineOfCode;
-    std::optional<string> nextLineOfCode;
+    std::optional<std::string> prevLineOfCode;
+    std::optional<std::string> errLineOfCode;
+    std::optional<std::string> nextLineOfCode;
 };
 
 // ErrPos indicates the location of an error in a nix file.
 struct ErrPos {
     int line = 0;
     int column = 0;
-    string file;
+    std::string file;
     FileOrigin origin;
 
     operator bool() const
@@ -80,7 +80,7 @@ struct ErrPos {
 
     // convert from the Pos struct, found in libexpr.
     template <class P>
-    ErrPos& operator=(const P &pos)
+    ErrPos & operator=(const P & pos)
     {
         origin = pos.origin;
         line = pos.line;
@@ -94,7 +94,7 @@ struct ErrPos {
     }
 
     template <class P>
-    ErrPos(const P &p)
+    ErrPos(const P & p)
     {
         *this = p;
     }
@@ -107,15 +107,15 @@ struct Trace {
 
 struct ErrorInfo {
     Verbosity level;
-    string name; // FIXME: rename
+    std::string name; // FIXME: rename
     hintformat msg;
     std::optional<ErrPos> errPos;
     std::list<Trace> traces;
 
-    static std::optional<string> programName;
+    static std::optional<std::string> programName;
 };
 
-std::ostream& showErrorInfo(std::ostream &out, const ErrorInfo &einfo, bool showTrace);
+std::ostream & showErrorInfo(std::ostream & out, const ErrorInfo & einfo, bool showTrace);
 
 /* BaseError should generally not be caught, as it has Interrupted as
    a subclass. Catch Error instead. */
@@ -124,8 +124,8 @@ class BaseError : public std::exception
 protected:
     mutable ErrorInfo err;
 
-    mutable std::optional<string> what_;
-    const string& calcWhat() const;
+    mutable std::optional<std::string> what_;
+    const std::string & calcWhat() const;
 
 public:
     unsigned int status = 1; // exit status
@@ -162,11 +162,11 @@ public:
     const char * what() const noexcept override { return calcWhat().c_str(); }
 #endif
 
-    const string & msg() const { return calcWhat(); }
+    const std::string & msg() const { return calcWhat(); }
     const ErrorInfo & info() const { calcWhat(); return err; }
 
     template<typename... Args>
-    BaseError & addTrace(std::optional<ErrPos> e, const string &fs, const Args & ... args)
+    BaseError & addTrace(std::optional<ErrPos> e, const std::string & fs, const Args & ... args)
     {
         return addTrace(e, hintfmt(fs, args...));
     }
diff --git a/src/libutil/fmt.hh b/src/libutil/fmt.hh
index a7126fb65..0821b3b74 100644
--- a/src/libutil/fmt.hh
+++ b/src/libutil/fmt.hh
@@ -10,7 +10,6 @@ namespace nix {
 
 
 /* Inherit some names from other namespaces for convenience. */
-using std::string;
 using boost::format;
 
 
@@ -21,8 +20,8 @@ struct nop { template<typename... T> nop(T...) {} };
 
 struct FormatOrString
 {
-    string s;
-    FormatOrString(const string & s) : s(s) { };
+    std::string s;
+    FormatOrString(std::string s) : s(std::move(s)) { };
     template<class F>
     FormatOrString(const F & f) : s(f.str()) { };
     FormatOrString(const char * s) : s(s) { };
@@ -102,7 +101,7 @@ std::ostream & operator<<(std::ostream & out, const normaltxt<T> & y)
 class hintformat
 {
 public:
-    hintformat(const string & format) : fmt(format)
+    hintformat(const std::string & format) : fmt(format)
     {
         fmt.exceptions(boost::io::all_error_bits ^
                        boost::io::too_many_args_bit ^
diff --git a/src/libutil/hash.cc b/src/libutil/hash.cc
index 6ed00d43c..a4d632161 100644
--- a/src/libutil/hash.cc
+++ b/src/libutil/hash.cc
@@ -66,31 +66,31 @@ bool Hash::operator < (const Hash & h) const
 }
 
 
-const string base16Chars = "0123456789abcdef";
+const std::string base16Chars = "0123456789abcdef";
 
 
-static string printHash16(const Hash & hash)
+static std::string printHash16(const Hash & hash)
 {
     char buf[hash.hashSize * 2];
     for (unsigned int i = 0; i < hash.hashSize; i++) {
         buf[i * 2] = base16Chars[hash.hash[i] >> 4];
         buf[i * 2 + 1] = base16Chars[hash.hash[i] & 0x0f];
     }
-    return string(buf, hash.hashSize * 2);
+    return std::string(buf, hash.hashSize * 2);
 }
 
 
 // omitted: E O U T
-const string base32Chars = "0123456789abcdfghijklmnpqrsvwxyz";
+const std::string base32Chars = "0123456789abcdfghijklmnpqrsvwxyz";
 
 
-static string printHash32(const Hash & hash)
+static std::string printHash32(const Hash & hash)
 {
     assert(hash.hashSize);
     size_t len = hash.base32Len();
     assert(len);
 
-    string s;
+    std::string s;
     s.reserve(len);
 
     for (int n = (int) len - 1; n >= 0; n--) {
@@ -107,7 +107,7 @@ static string printHash32(const Hash & hash)
 }
 
 
-string printHash16or32(const Hash & hash)
+std::string printHash16or32(const Hash & hash)
 {
     assert(hash.type);
     return hash.to_string(hash.type == htMD5 ? Base16 : Base32, false);
@@ -151,7 +151,8 @@ Hash Hash::parseSRI(std::string_view original) {
 }
 
 // Mutates the string to eliminate the prefixes when found
-static std::pair<std::optional<HashType>, bool> getParsedTypeAndSRI(std::string_view & rest) {
+static std::pair<std::optional<HashType>, bool> getParsedTypeAndSRI(std::string_view & rest)
+{
     bool isSRI = false;
 
     // Parse the has type before the separater, if there was one.
@@ -402,7 +403,7 @@ HashType parseHashType(std::string_view s)
         throw UsageError("unknown hash algorithm '%1%'", s);
 }
 
-string printHashType(HashType ht)
+std::string printHashType(HashType ht)
 {
     switch (ht) {
     case htMD5: return "md5";
diff --git a/src/libutil/hash.hh b/src/libutil/hash.hh
index dff46542f..56b5938b3 100644
--- a/src/libutil/hash.hh
+++ b/src/libutil/hash.hh
@@ -20,7 +20,7 @@ const int sha512HashSize = 64;
 
 extern std::set<std::string> hashTypes;
 
-extern const string base32Chars;
+extern const std::string base32Chars;
 
 enum Base : int { Base64, Base32, Base16, SRI };
 
@@ -110,7 +110,7 @@ public:
 Hash newHashAllowEmpty(std::string_view hashStr, std::optional<HashType> ht);
 
 /* Print a hash in base-16 if it's MD5, or base-32 otherwise. */
-string printHash16or32(const Hash & hash);
+std::string printHash16or32(const Hash & hash);
 
 /* Compute the hash of the given string. */
 Hash hashString(HashType ht, std::string_view s);
@@ -135,7 +135,7 @@ HashType parseHashType(std::string_view s);
 std::optional<HashType> parseHashTypeOpt(std::string_view s);
 
 /* And the reverse. */
-string printHashType(HashType ht);
+std::string printHashType(HashType ht);
 
 
 union Ctx;
diff --git a/src/libutil/logging.cc b/src/libutil/logging.cc
index f8a121ed1..74ee2f063 100644
--- a/src/libutil/logging.cc
+++ b/src/libutil/logging.cc
@@ -113,7 +113,7 @@ void warnOnce(bool & haveWarned, const FormatOrString & fs)
     }
 }
 
-void writeToStderr(const string & s)
+void writeToStderr(std::string_view s)
 {
     try {
         writeFull(STDERR_FILENO, s, false);
diff --git a/src/libutil/logging.hh b/src/libutil/logging.hh
index 5560d2bed..bd28036ae 100644
--- a/src/libutil/logging.hh
+++ b/src/libutil/logging.hh
@@ -216,6 +216,6 @@ inline void warn(const std::string & fs, const Args & ... args)
 
 void warnOnce(bool & haveWarned, const FormatOrString & fs);
 
-void writeToStderr(const string & s);
+void writeToStderr(std::string_view s);
 
 }
diff --git a/src/libutil/serialise.cc b/src/libutil/serialise.cc
index fe703de06..6445b3f1b 100644
--- a/src/libutil/serialise.cc
+++ b/src/libutil/serialise.cc
@@ -391,7 +391,7 @@ size_t readString(char * buf, size_t max, Source & source)
 }
 
 
-string readString(Source & source, size_t max)
+std::string readString(Source & source, size_t max)
 {
     auto len = readNum<size_t>(source);
     if (len > max) throw SerialisationError("string is too long");
@@ -401,7 +401,7 @@ string readString(Source & source, size_t max)
     return res;
 }
 
-Source & operator >> (Source & in, string & s)
+Source & operator >> (Source & in, std::string & s)
 {
     s = readString(in);
     return in;
diff --git a/src/libutil/serialise.hh b/src/libutil/serialise.hh
index fdd35aa00..13da26c6a 100644
--- a/src/libutil/serialise.hh
+++ b/src/libutil/serialise.hh
@@ -364,10 +364,10 @@ inline uint64_t readLongLong(Source & source)
 
 void readPadding(size_t len, Source & source);
 size_t readString(char * buf, size_t max, Source & source);
-string readString(Source & source, size_t max = std::numeric_limits<size_t>::max());
+std::string readString(Source & source, size_t max = std::numeric_limits<size_t>::max());
 template<class T> T readStrings(Source & source);
 
-Source & operator >> (Source & in, string & s);
+Source & operator >> (Source & in, std::string & s);
 
 template<typename T>
 Source & operator >> (Source & in, T & n)
diff --git a/src/libutil/tests/url.cc b/src/libutil/tests/url.cc
index aff58e9ee..f20e2dc41 100644
--- a/src/libutil/tests/url.cc
+++ b/src/libutil/tests/url.cc
@@ -5,9 +5,9 @@ namespace nix {
 
 /* ----------- tests for url.hh --------------------------------------------------*/
 
-    string print_map(std::map<string, string> m) {
-        std::map<string, string>::iterator it;
-        string s = "{ ";
+    std::string print_map(std::map<std::string, std::string> m) {
+        std::map<std::string, std::string>::iterator it;
+        std::string s = "{ ";
         for (it = m.begin(); it != m.end(); ++it) {
             s += "{ ";
             s += it->first;
@@ -262,21 +262,21 @@ namespace nix {
      * --------------------------------------------------------------------------*/
 
     TEST(percentDecode, decodesUrlEncodedString) {
-        string s = "==@==";
-        string d = percentDecode("%3D%3D%40%3D%3D");
+        std::string s = "==@==";
+        std::string d = percentDecode("%3D%3D%40%3D%3D");
         ASSERT_EQ(d, s);
     }
 
     TEST(percentDecode, multipleDecodesAreIdempotent) {
-        string once = percentDecode("%3D%3D%40%3D%3D");
-        string twice = percentDecode(once);
+        std::string once = percentDecode("%3D%3D%40%3D%3D");
+        std::string twice = percentDecode(once);
 
         ASSERT_EQ(once, twice);
     }
 
     TEST(percentDecode, trailingPercent) {
-        string s = "==@==%";
-        string d = percentDecode("%3D%3D%40%3D%3D%25");
+        std::string s = "==@==%";
+        std::string d = percentDecode("%3D%3D%40%3D%3D%25");
 
         ASSERT_EQ(d, s);
     }
diff --git a/src/libutil/types.hh b/src/libutil/types.hh
index bea2673ca..00ba567c6 100644
--- a/src/libutil/types.hh
+++ b/src/libutil/types.hh
@@ -14,6 +14,7 @@ namespace nix {
 typedef std::list<std::string> Strings;
 typedef std::set<std::string> StringSet;
 typedef std::map<std::string, std::string> StringMap;
+typedef std::map<std::string, std::string> StringPairs;
 
 /* Paths are just strings. */
 typedef std::string Path;
diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index b172e0554..88c5ae806 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -110,13 +110,13 @@ Path canonPath(PathView path, bool resolveSymlinks)
 {
     assert(path != "");
 
-    string s;
+    std::string s;
     s.reserve(256);
 
     if (path[0] != '/')
         throw Error("not an absolute path: '%1%'", path);
 
-    string temp;
+    std::string temp;
 
     /* Count the number of times we follow a symlink and stop at some
        arbitrary (but high) limit to prevent infinite loops. */
@@ -142,7 +142,7 @@ Path canonPath(PathView path, bool resolveSymlinks)
         /* Normal component; copy it. */
         else {
             s += '/';
-            if (const auto slash = path.find('/'); slash == string::npos) {
+            if (const auto slash = path.find('/'); slash == std::string::npos) {
                 s += path;
                 path = {};
             } else {
@@ -175,7 +175,7 @@ Path canonPath(PathView path, bool resolveSymlinks)
 Path dirOf(const PathView path)
 {
     Path::size_type pos = path.rfind('/');
-    if (pos == string::npos)
+    if (pos == std::string::npos)
         return ".";
     return pos == 0 ? "/" : Path(path, 0, pos);
 }
@@ -191,7 +191,7 @@ std::string_view baseNameOf(std::string_view path)
         last -= 1;
 
     auto pos = path.rfind('/', last);
-    if (pos == string::npos)
+    if (pos == std::string::npos)
         pos = 0;
     else
         pos += 1;
@@ -249,7 +249,7 @@ Path readLink(const Path & path)
             else
                 throw SysError("reading symbolic link '%1%'", path);
         else if (rlSize < bufSize)
-            return string(buf.data(), rlSize);
+            return std::string(buf.data(), rlSize);
     }
 }
 
@@ -269,7 +269,7 @@ DirEntries readDirectory(DIR *dir, const Path & path)
     struct dirent * dirent;
     while (errno = 0, dirent = readdir(dir)) { /* sic */
         checkInterrupt();
-        string name = dirent->d_name;
+        std::string name = dirent->d_name;
         if (name == "." || name == "..") continue;
         entries.emplace_back(name, dirent->d_ino,
 #ifdef HAVE_STRUCT_DIRENT_D_TYPE
@@ -303,7 +303,7 @@ unsigned char getFileType(const Path & path)
 }
 
 
-string readFile(int fd)
+std::string readFile(int fd)
 {
     struct stat st;
     if (fstat(fd, &st) == -1)
@@ -313,7 +313,7 @@ string readFile(int fd)
 }
 
 
-string readFile(const Path & path)
+std::string readFile(const Path & path)
 {
     AutoCloseFD fd = open(path.c_str(), O_RDONLY | O_CLOEXEC);
     if (!fd)
@@ -366,9 +366,9 @@ void writeFile(const Path & path, Source & source, mode_t mode)
     }
 }
 
-string readLine(int fd)
+std::string readLine(int fd)
 {
-    string s;
+    std::string s;
     while (1) {
         checkInterrupt();
         char ch;
@@ -387,7 +387,7 @@ string readLine(int fd)
 }
 
 
-void writeLine(int fd, string s)
+void writeLine(int fd, std::string s)
 {
     s += '\n';
     writeFull(fd, s);
@@ -398,7 +398,7 @@ static void _deletePath(int parentfd, const Path & path, uint64_t & bytesFreed)
 {
     checkInterrupt();
 
-    string name(baseNameOf(path));
+    std::string name(baseNameOf(path));
 
     struct stat st;
     if (fstatat(parentfd, name.c_str(), &st, AT_SYMLINK_NOFOLLOW) == -1) {
@@ -566,8 +566,8 @@ Path getConfigDir()
 std::vector<Path> getConfigDirs()
 {
     Path configHome = getConfigDir();
-    string configDirs = getEnv("XDG_CONFIG_DIRS").value_or("/etc/xdg");
-    std::vector<Path> result = tokenizeString<std::vector<string>>(configDirs, ":");
+    auto configDirs = getEnv("XDG_CONFIG_DIRS").value_or("/etc/xdg");
+    std::vector<Path> result = tokenizeString<std::vector<std::string>>(configDirs, ":");
     result.insert(result.begin(), configHome);
     return result;
 }
@@ -670,7 +670,7 @@ void writeFull(int fd, std::string_view s, bool allowInterrupts)
 }
 
 
-string drainFD(int fd, bool block, const size_t reserveSize)
+std::string drainFD(int fd, bool block, const size_t reserveSize)
 {
     // the parser needs two extra bytes to append terminating characters, other users will
     // not care very much about the extra memory.
@@ -719,7 +719,7 @@ void drainFD(int fd, Sink & sink, bool block)
 
 AutoDelete::AutoDelete() : del{false} {}
 
-AutoDelete::AutoDelete(const string & p, bool recursive) : path(p)
+AutoDelete::AutoDelete(const std::string & p, bool recursive) : path(p)
 {
     del = true;
     this->recursive = recursive;
@@ -1036,7 +1036,7 @@ std::vector<char *> stringsToCharPtrs(const Strings & ss)
     return res;
 }
 
-string runProgram(Path program, bool searchPath, const Strings & args,
+std::string runProgram(Path program, bool searchPath, const Strings & args,
     const std::optional<std::string> & input)
 {
     auto res = runProgram(RunOptions {.program = program, .searchPath = searchPath, .args = args, .input = input});
@@ -1238,11 +1238,11 @@ void _interrupted()
 template<class C> C tokenizeString(std::string_view s, std::string_view separators)
 {
     C result;
-    string::size_type pos = s.find_first_not_of(separators, 0);
-    while (pos != string::npos) {
-        string::size_type end = s.find_first_of(separators, pos + 1);
-        if (end == string::npos) end = s.size();
-        result.insert(result.end(), string(s, pos, end - pos));
+    auto pos = s.find_first_not_of(separators, 0);
+    while (pos != std::string::npos) {
+        auto end = s.find_first_of(separators, pos + 1);
+        if (end == std::string::npos) end = s.size();
+        result.insert(result.end(), std::string(s, pos, end - pos));
         pos = s.find_first_not_of(separators, end);
     }
     return result;
@@ -1250,29 +1250,30 @@ template<class C> C tokenizeString(std::string_view s, std::string_view separato
 
 template Strings tokenizeString(std::string_view s, std::string_view separators);
 template StringSet tokenizeString(std::string_view s, std::string_view separators);
-template std::vector<string> tokenizeString(std::string_view s, std::string_view separators);
+template std::vector<std::string> tokenizeString(std::string_view s, std::string_view separators);
 
 
-string chomp(std::string_view s)
+std::string chomp(std::string_view s)
 {
     size_t i = s.find_last_not_of(" \n\r\t");
-    return i == string::npos ? "" : string(s, 0, i + 1);
+    return i == std::string_view::npos ? "" : std::string(s, 0, i + 1);
 }
 
 
-string trim(const string & s, const string & whitespace)
+std::string trim(std::string_view s, std::string_view whitespace)
 {
     auto i = s.find_first_not_of(whitespace);
-    if (i == string::npos) return "";
+    if (i == std::string_view::npos) return "";
     auto j = s.find_last_not_of(whitespace);
-    return string(s, i, j == string::npos ? j : j - i + 1);
+    return std::string(s, i, j == std::string::npos ? j : j - i + 1);
 }
 
 
-string replaceStrings(std::string_view s,
-    const std::string & from, const std::string & to)
+std::string replaceStrings(
+    std::string res,
+    std::string_view from,
+    std::string_view to)
 {
-    string res(s);
     if (from.empty()) return res;
     size_t pos = 0;
     while ((pos = res.find(from, pos)) != std::string::npos) {
@@ -1283,20 +1284,19 @@ string replaceStrings(std::string_view s,
 }
 
 
-std::string rewriteStrings(const std::string & _s, const StringMap & rewrites)
+std::string rewriteStrings(std::string s, const StringMap & rewrites)
 {
-    auto s = _s;
     for (auto & i : rewrites) {
         if (i.first == i.second) continue;
         size_t j = 0;
-        while ((j = s.find(i.first, j)) != string::npos)
+        while ((j = s.find(i.first, j)) != std::string::npos)
             s.replace(j, i.first.size(), i.second);
     }
     return s;
 }
 
 
-string statusToString(int status)
+std::string statusToString(int status)
 {
     if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) {
         if (WIFEXITED(status))
@@ -1448,9 +1448,9 @@ std::string filterANSIEscapes(const std::string & s, bool filterAll, unsigned in
 
 constexpr char base64Chars[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 
-string base64Encode(std::string_view s)
+std::string base64Encode(std::string_view s)
 {
-    string res;
+    std::string res;
     int data = 0, nbits = 0;
 
     for (char c : s) {
@@ -1469,7 +1469,7 @@ string base64Encode(std::string_view s)
 }
 
 
-string base64Decode(std::string_view s)
+std::string base64Decode(std::string_view s)
 {
     constexpr char npos = -1;
     constexpr std::array<char, 256> base64DecodeChars = [&]() {
@@ -1481,7 +1481,7 @@ string base64Decode(std::string_view s)
         return result;
     }();
 
-    string res;
+    std::string res;
     unsigned int d = 0, bits = 0;
 
     for (char c : s) {
@@ -1835,7 +1835,7 @@ void connect(int fd, const std::string & path)
 }
 
 
-string showBytes(uint64_t bytes)
+std::string showBytes(uint64_t bytes)
 {
     return fmt("%.2f MiB", bytes / (1024.0 * 1024.0));
 }
@@ -1846,7 +1846,7 @@ void commonChildInit(Pipe & logPipe)
 {
     logger = makeSimpleLogger();
 
-    const static string pathNullDevice = "/dev/null";
+    const static std::string pathNullDevice = "/dev/null";
     restoreProcessContext(false);
 
     /* Put the child in a separate session (and thus a separate
diff --git a/src/libutil/util.hh b/src/libutil/util.hh
index a949e6424..20591952d 100644
--- a/src/libutil/util.hh
+++ b/src/libutil/util.hh
@@ -92,11 +92,11 @@ bool isLink(const Path & path);
    removed. */
 struct DirEntry
 {
-    string name;
+    std::string name;
     ino_t ino;
     unsigned char type; // one of DT_*
-    DirEntry(const string & name, ino_t ino, unsigned char type)
-        : name(name), ino(ino), type(type) { }
+    DirEntry(std::string name, ino_t ino, unsigned char type)
+        : name(std::move(name)), ino(ino), type(type) { }
 };
 
 typedef std::vector<DirEntry> DirEntries;
@@ -106,8 +106,8 @@ DirEntries readDirectory(const Path & path);
 unsigned char getFileType(const Path & path);
 
 /* Read the contents of a file into a string. */
-string readFile(int fd);
-string readFile(const Path & path);
+std::string readFile(int fd);
+std::string readFile(const Path & path);
 void readFile(const Path & path, Sink & sink);
 
 /* Write a string to a file. */
@@ -116,10 +116,10 @@ void writeFile(const Path & path, std::string_view s, mode_t mode = 0666);
 void writeFile(const Path & path, Source & source, mode_t mode = 0666);
 
 /* Read a line from a file descriptor. */
-string readLine(int fd);
+std::string readLine(int fd);
 
 /* Write a line to a file descriptor. */
-void writeLine(int fd, string s);
+void writeLine(int fd, std::string s);
 
 /* Delete a path; i.e., in the case of a directory, it is deleted
    recursively. It's not an error if the path does not exist. The
@@ -170,7 +170,7 @@ MakeError(EndOfFile, Error);
 
 
 /* Read a file descriptor until EOF occurs. */
-string drainFD(int fd, bool block = true, const size_t reserveSize=0);
+std::string drainFD(int fd, bool block = true, const size_t reserveSize=0);
 
 void drainFD(int fd, Sink & sink, bool block = true);
 
@@ -268,7 +268,7 @@ void killUser(uid_t uid);
    pid to the caller. */
 struct ProcessOptions
 {
-    string errorPrefix = "";
+    std::string errorPrefix = "";
     bool dieWithParent = true;
     bool runExitHandlers = false;
     bool allowVfork = false;
@@ -279,7 +279,7 @@ pid_t startProcess(std::function<void()> fun, const ProcessOptions & options = P
 
 /* Run a program and return its stdout in a string (i.e., like the
    shell backtick operator). */
-string runProgram(Path program, bool searchPath = false,
+std::string runProgram(Path program, bool searchPath = false,
     const Strings & args = Strings(),
     const std::optional<std::string> & input = {});
 
@@ -378,12 +378,12 @@ template<class C> C tokenizeString(std::string_view s, std::string_view separato
 /* Concatenate the given strings with a separator between the
    elements. */
 template<class C>
-string concatStringsSep(const std::string_view sep, const C & ss)
+std::string concatStringsSep(const std::string_view sep, const C & ss)
 {
     size_t size = 0;
     // need a cast to string_view since this is also called with Symbols
     for (const auto & s : ss) size += sep.size() + std::string_view(s).size();
-    string s;
+    std::string s;
     s.reserve(size);
     for (auto & i : ss) {
         if (s.size() != 0) s += sep;
@@ -394,7 +394,7 @@ string concatStringsSep(const std::string_view sep, const C & ss)
 
 template<class ... Parts>
 auto concatStrings(Parts && ... parts)
-    -> std::enable_if_t<(... && std::is_convertible_v<Parts, std::string_view>), string>
+    -> std::enable_if_t<(... && std::is_convertible_v<Parts, std::string_view>), std::string>
 {
     std::string_view views[sizeof...(parts)] = { parts... };
     return concatStringsSep({}, views);
@@ -413,24 +413,26 @@ template<class C> Strings quoteStrings(const C & c)
 
 /* Remove trailing whitespace from a string. FIXME: return
    std::string_view. */
-string chomp(std::string_view s);
+std::string chomp(std::string_view s);
 
 
 /* Remove whitespace from the start and end of a string. */
-string trim(const string & s, const string & whitespace = " \n\r\t");
+std::string trim(std::string_view s, std::string_view whitespace = " \n\r\t");
 
 
 /* Replace all occurrences of a string inside another string. */
-string replaceStrings(std::string_view s,
-    const std::string & from, const std::string & to);
+std::string replaceStrings(
+    std::string s,
+    std::string_view from,
+    std::string_view to);
 
 
-std::string rewriteStrings(const std::string & s, const StringMap & rewrites);
+std::string rewriteStrings(std::string s, const StringMap & rewrites);
 
 
 /* Convert the exit status of a child as returned by wait() into an
    error string. */
-string statusToString(int status);
+std::string statusToString(int status);
 
 bool statusOk(int status);
 
@@ -525,8 +527,8 @@ std::string filterANSIEscapes(const std::string & s,
 
 
 /* Base64 encoding/decoding. */
-string base64Encode(std::string_view s);
-string base64Decode(std::string_view s);
+std::string base64Encode(std::string_view s);
+std::string base64Decode(std::string_view s);
 
 
 /* Remove common leading whitespace from the lines in the string
diff --git a/src/nix-build/nix-build.cc b/src/nix-build/nix-build.cc
index aeabdcdd4..3d189f934 100755
--- a/src/nix-build/nix-build.cc
+++ b/src/nix-build/nix-build.cc
@@ -32,11 +32,11 @@ extern char * * environ __attribute__((weak));
 /* Recreate the effect of the perl shellwords function, breaking up a
  * string into arguments like a shell word, including escapes
  */
-std::vector<string> shellwords(const string & s)
+static std::vector<std::string> shellwords(const std::string & s)
 {
     std::regex whitespace("^(\\s+).*");
     auto begin = s.cbegin();
-    std::vector<string> res;
+    std::vector<std::string> res;
     std::string cur;
     enum state {
         sBegin,
@@ -96,14 +96,14 @@ static void main_nix_build(int argc, char * * argv)
 
     auto inShebang = false;
     std::string script;
-    std::vector<string> savedArgs;
+    std::vector<std::string> savedArgs;
 
     AutoDelete tmpDir(createTempDir("", myName));
 
     std::string outLink = "./result";
 
     // List of environment variables kept for --pure
-    std::set<string> keepVars{
+    std::set<std::string> keepVars{
         "HOME", "XDG_RUNTIME_DIR", "USER", "LOGNAME", "DISPLAY",
         "WAYLAND_DISPLAY", "WAYLAND_SOCKET", "PATH", "TERM", "IN_NIX_SHELL",
         "NIX_SHELL_PRESERVE_PROMPT", "TZ", "PAGER", "NIX_BUILD_SHELL", "SHLVL",
@@ -384,7 +384,9 @@ static void main_nix_build(int argc, char * * argv)
         // Build or fetch all dependencies of the derivation.
         for (const auto & input : drv.inputDrvs)
             if (std::all_of(envExclude.cbegin(), envExclude.cend(),
-                    [&](const string & exclude) { return !std::regex_search(store->printStorePath(input.first), std::regex(exclude)); }))
+                    [&](const std::string & exclude) {
+                        return !std::regex_search(store->printStorePath(input.first), std::regex(exclude));
+                    }))
             {
                 pathsToBuild.push_back({input.first, input.second});
                 pathsToCopy.insert(input.first);
@@ -437,7 +439,7 @@ static void main_nix_build(int argc, char * * argv)
         for (auto & var : drv.env)
             if (passAsFile.count(var.first)) {
                 keepTmp = true;
-                string fn = ".attr-" + std::to_string(fileNr++);
+                auto fn = ".attr-" + std::to_string(fileNr++);
                 Path p = (Path) tmpDir + "/" + fn;
                 writeFile(p, var.second);
                 env[var.first + "Path"] = p;
@@ -514,7 +516,7 @@ static void main_nix_build(int argc, char * * argv)
                 (pure ? "" : "PATH=$PATH:$p; unset p; "),
                 shellEscape(dirOf(*shell)),
                 shellEscape(*shell),
-                (getenv("TZ") ? (string("export TZ=") + shellEscape(getenv("TZ")) + "; ") : ""),
+                (getenv("TZ") ? (std::string("export TZ=") + shellEscape(getenv("TZ")) + "; ") : ""),
                 envCommand);
         vomit("Sourcing nix-shell with file %s and contents:\n%s", rcfile, rc);
         writeFile(rcfile, rc);
diff --git a/src/nix-channel/nix-channel.cc b/src/nix-channel/nix-channel.cc
index eae15885a..f46b90b90 100755
--- a/src/nix-channel/nix-channel.cc
+++ b/src/nix-channel/nix-channel.cc
@@ -11,7 +11,7 @@
 
 using namespace nix;
 
-typedef std::map<string,string> Channels;
+typedef std::map<std::string, std::string> Channels;
 
 static Channels channels;
 static Path channelsList;
@@ -22,11 +22,11 @@ static void readChannels()
     if (!pathExists(channelsList)) return;
     auto channelsFile = readFile(channelsList);
 
-    for (const auto & line : tokenizeString<std::vector<string>>(channelsFile, "\n")) {
+    for (const auto & line : tokenizeString<std::vector<std::string>>(channelsFile, "\n")) {
         chomp(line);
         if (std::regex_search(line, std::regex("^\\s*\\#")))
             continue;
-        auto split = tokenizeString<std::vector<string>>(line, " ");
+        auto split = tokenizeString<std::vector<std::string>>(line, " ");
         auto url = std::regex_replace(split[0], std::regex("/*$"), "");
         auto name = split.size() > 1 ? split[1] : std::string(baseNameOf(url));
         channels[name] = url;
@@ -44,7 +44,7 @@ static void writeChannels()
 }
 
 // Adds a channel.
-static void addChannel(const string & url, const string & name)
+static void addChannel(const std::string & url, const std::string & name)
 {
     if (!regex_search(url, std::regex("^(file|http|https)://")))
         throw Error("invalid channel URL '%1%'", url);
@@ -58,7 +58,7 @@ static void addChannel(const string & url, const string & name)
 static Path profile;
 
 // Remove a channel.
-static void removeChannel(const string & name)
+static void removeChannel(const std::string & name)
 {
     readChannels();
     channels.erase(name);
@@ -96,7 +96,7 @@ static void update(const StringSet & channelNames)
         std::smatch match;
         auto urlBase = std::string(baseNameOf(url));
         if (std::regex_search(urlBase, match, std::regex("(-\\d.*)$")))
-            cname = cname + (string) match[1];
+            cname = cname + (std::string) match[1];
 
         std::string extraAttrs;
 
@@ -176,7 +176,7 @@ static int main_nix_channel(int argc, char ** argv)
             cUpdate,
             cRollback
         } cmd = cNone;
-        std::vector<string> args;
+        std::vector<std::string> args;
         parseCmdLine(argc, argv, [&](Strings::iterator & arg, const Strings::iterator & end) {
             if (*arg == "--help") {
                 showManPage("nix-channel");
diff --git a/src/nix-collect-garbage/nix-collect-garbage.cc b/src/nix-collect-garbage/nix-collect-garbage.cc
index 4f953fab4..48c030b18 100644
--- a/src/nix-collect-garbage/nix-collect-garbage.cc
+++ b/src/nix-collect-garbage/nix-collect-garbage.cc
@@ -36,7 +36,7 @@ void removeOldGenerations(std::string dir)
             } catch (SysError & e) {
                 if (e.errNo == ENOENT) continue;
             }
-            if (link.find("link") != string::npos) {
+            if (link.find("link") != std::string::npos) {
                 printInfo(format("removing old generations of profile %1%") % path);
                 if (deleteOlderThan != "")
                     deleteGenerationsOlderThan(path, deleteOlderThan, dryRun);
diff --git a/src/nix-env/nix-env.cc b/src/nix-env/nix-env.cc
index f83edb6a1..12e08bbe1 100644
--- a/src/nix-env/nix-env.cc
+++ b/src/nix-env/nix-env.cc
@@ -46,7 +46,7 @@ struct InstallSourceInfo
     InstallSourceType type;
     Path nixExprPath; /* for srcNixExprDrvs, srcNixExprs */
     Path profile; /* for srcProfile */
-    string systemFilter; /* for srcNixExprDrvs */
+    std::string systemFilter; /* for srcNixExprDrvs */
     Bindings * autoArgs;
 };
 
@@ -59,7 +59,7 @@ struct Globals
     bool dryRun;
     bool preserveInstalled;
     bool removeAll;
-    string forceName;
+    std::string forceName;
     bool prebuiltOnly;
 };
 
@@ -68,8 +68,8 @@ typedef void (* Operation) (Globals & globals,
     Strings opFlags, Strings opArgs);
 
 
-static string needArg(Strings::iterator & i,
-    Strings & args, const string & arg)
+static std::string needArg(Strings::iterator & i,
+    Strings & args, const std::string & arg)
 {
     if (i == args.end()) throw UsageError("'%1%' requires an argument", arg);
     return *i++;
@@ -77,7 +77,7 @@ static string needArg(Strings::iterator & i,
 
 
 static bool parseInstallSourceOptions(Globals & globals,
-    Strings::iterator & i, Strings & args, const string & arg)
+    Strings::iterator & i, Strings & args, const std::string & arg)
 {
     if (arg == "--from-expression" || arg == "-E")
         globals.instSource.type = srcNixExprs;
@@ -124,9 +124,9 @@ static void getAllExprs(EvalState & state,
                otherwise the attribute cannot be selected with the
                `-A' option.  Useful if you want to stick a Nix
                expression directly in ~/.nix-defexpr. */
-            string attrName = i;
+            std::string attrName = i;
             if (hasSuffix(attrName, ".nix"))
-                attrName = string(attrName, 0, attrName.size() - 4);
+                attrName = std::string(attrName, 0, attrName.size() - 4);
             if (!seen.insert(attrName).second) {
                 printError("warning: name collision in input Nix expressions, skipping '%1%'", path2);
                 continue;
@@ -175,8 +175,8 @@ static void loadSourceExpr(EvalState & state, const Path & path, Value & v)
 
 
 static void loadDerivations(EvalState & state, Path nixExprPath,
-    string systemFilter, Bindings & autoArgs,
-    const string & pathPrefix, DrvInfos & elems)
+    std::string systemFilter, Bindings & autoArgs,
+    const std::string & pathPrefix, DrvInfos & elems)
 {
     Value vRoot;
     loadSourceExpr(state, nixExprPath, vRoot);
@@ -343,9 +343,9 @@ static DrvInfos filterBySelector(EvalState & state, const DrvInfos & allElems,
 
         if (selector.hits == 0 && selector.fullName != "*") {
             const auto prefixHits = searchByPrefix(allElems, selector.name);
-            
+
             if (prefixHits.empty()) {
-                throw Error("selector '%1%' matches no derivations", selector.fullName);    
+                throw Error("selector '%1%' matches no derivations", selector.fullName);
             } else {
                 std::string suggestionMessage = ", maybe you meant:";
                 for (const auto & drvName : prefixHits) {
@@ -360,9 +360,9 @@ static DrvInfos filterBySelector(EvalState & state, const DrvInfos & allElems,
 }
 
 
-static bool isPath(const string & s)
+static bool isPath(std::string_view s)
 {
-    return s.find('/') != string::npos;
+    return s.find('/') != std::string_view::npos;
 }
 
 
@@ -433,8 +433,8 @@ static void queryInstSources(EvalState & state,
                     auto outputs = state.store->queryDerivationOutputMap(path);
                     elem.setOutPath(state.store->printStorePath(outputs.at("out")));
                     if (name.size() >= drvExtension.size() &&
-                        string(name, name.size() - drvExtension.size()) == drvExtension)
-                        name = string(name, 0, name.size() - drvExtension.size());
+                        std::string(name, name.size() - drvExtension.size()) == drvExtension)
+                        name = name.substr(0, name.size() - drvExtension.size());
                 }
                 else elem.setOutPath(state.store->printStorePath(path));
 
@@ -515,7 +515,7 @@ static void installDerivations(Globals & globals,
 
 
     while (true) {
-        string lockToken = optimisticLockProfile(profile);
+        auto lockToken = optimisticLockProfile(profile);
 
         DrvInfos allElems(newElems);
 
@@ -551,7 +551,7 @@ static void installDerivations(Globals & globals,
 static void opInstall(Globals & globals, Strings opFlags, Strings opArgs)
 {
     for (Strings::iterator i = opFlags.begin(); i != opFlags.end(); ) {
-        string arg = *i++;
+        auto arg = *i++;
         if (parseInstallSourceOptions(globals, i, opFlags, arg)) ;
         else if (arg == "--preserve-installed" || arg == "-P")
             globals.preserveInstalled = true;
@@ -578,7 +578,7 @@ static void upgradeDerivations(Globals & globals,
        name and a higher version number. */
 
     while (true) {
-        string lockToken = optimisticLockProfile(globals.profile);
+        auto lockToken = optimisticLockProfile(globals.profile);
 
         DrvInfos installedElems = queryInstalled(*globals.state, globals.profile);
 
@@ -606,7 +606,7 @@ static void upgradeDerivations(Globals & globals,
                    take the one with the highest version.
                    Do not upgrade if it would decrease the priority. */
                 DrvInfos::iterator bestElem = availElems.end();
-                string bestVersion;
+                std::string bestVersion;
                 for (auto j = availElems.begin(); j != availElems.end(); ++j) {
                     if (comparePriorities(*globals.state, i, *j) > 0)
                         continue;
@@ -662,7 +662,7 @@ static void opUpgrade(Globals & globals, Strings opFlags, Strings opArgs)
 {
     UpgradeType upgradeType = utLt;
     for (Strings::iterator i = opFlags.begin(); i != opFlags.end(); ) {
-        string arg = *i++;
+        std::string arg = *i++;
         if (parseInstallSourceOptions(globals, i, opFlags, arg)) ;
         else if (arg == "--lt") upgradeType = utLt;
         else if (arg == "--leq") upgradeType = utLeq;
@@ -676,7 +676,7 @@ static void opUpgrade(Globals & globals, Strings opFlags, Strings opArgs)
 
 
 static void setMetaFlag(EvalState & state, DrvInfo & drv,
-    const string & name, const string & value)
+    const std::string & name, const std::string & value)
 {
     auto v = state.allocValue();
     v->mkString(value);
@@ -692,12 +692,12 @@ static void opSetFlag(Globals & globals, Strings opFlags, Strings opArgs)
         throw UsageError("not enough arguments to '--set-flag'");
 
     Strings::iterator arg = opArgs.begin();
-    string flagName = *arg++;
-    string flagValue = *arg++;
+    std::string flagName = *arg++;
+    std::string flagValue = *arg++;
     DrvNames selectors = drvNamesFromArgs(Strings(arg, opArgs.end()));
 
     while (true) {
-        string lockToken = optimisticLockProfile(globals.profile);
+        std::string lockToken = optimisticLockProfile(globals.profile);
 
         DrvInfos installedElems = queryInstalled(*globals.state, globals.profile);
 
@@ -728,7 +728,7 @@ static void opSet(Globals & globals, Strings opFlags, Strings opArgs)
     if (!store2) throw Error("--set is not supported for this Nix store");
 
     for (Strings::iterator i = opFlags.begin(); i != opFlags.end(); ) {
-        string arg = *i++;
+        std::string arg = *i++;
         if (parseInstallSourceOptions(globals, i, opFlags, arg)) ;
         else throw UsageError("unknown flag '%1%'", arg);
     }
@@ -769,7 +769,7 @@ static void uninstallDerivations(Globals & globals, Strings & selectors,
     Path & profile)
 {
     while (true) {
-        string lockToken = optimisticLockProfile(profile);
+        auto lockToken = optimisticLockProfile(profile);
 
         DrvInfos workingElems = queryInstalled(*globals.state, profile);
 
@@ -855,11 +855,11 @@ void printTable(Table & table)
         Strings::iterator j;
         size_t column;
         for (j = i.begin(), column = 0; j != i.end(); ++j, ++column) {
-            string s = *j;
+            std::string s = *j;
             replace(s.begin(), s.end(), '\n', ' ');
             cout << s;
             if (column < nrColumns - 1)
-                cout << string(widths[column] - s.size() + 2, ' ');
+                cout << std::string(widths[column] - s.size() + 2, ' ');
         }
         cout << std::endl;
     }
@@ -876,7 +876,7 @@ void printTable(Table & table)
 typedef enum { cvLess, cvEqual, cvGreater, cvUnavail } VersionDiff;
 
 static VersionDiff compareVersionAgainstSet(
-    const DrvInfo & elem, const DrvInfos & elems, string & version)
+    const DrvInfo & elem, const DrvInfos & elems, std::string & version)
 {
     DrvName name(elem.queryName());
 
@@ -958,7 +958,7 @@ static void queryJSON(Globals & globals, std::vector<DrvInfo> & elems, bool prin
 static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
 {
     Strings remaining;
-    string attrPath;
+    std::string attrPath;
 
     bool printStatus = false;
     bool printName = true;
@@ -977,7 +977,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
     settings.readOnlyMode = true; /* makes evaluation a bit faster */
 
     for (Strings::iterator i = opFlags.begin(); i != opFlags.end(); ) {
-        string arg = *i++;
+        auto arg = *i++;
         if (arg == "--status" || arg == "-s") printStatus = true;
         else if (arg == "--no-name") printName = false;
         else if (arg == "--system") printSystem = true;
@@ -1094,7 +1094,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
                     attrs["substitutable"] = hasSubs ? "1" : "0";
                 } else
                     columns.push_back(
-                        (string) (isInstalled ? "I" : "-")
+                        (std::string) (isInstalled ? "I" : "-")
                         + (isValid ? "P" : "-")
                         + (hasSubs ? "S" : "-"));
             }
@@ -1118,7 +1118,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
                    same named packages in either the set of available
                    elements, or the set of installed elements.  !!!
                    This is O(N * M), should be O(N * lg M). */
-                string version;
+                std::string version;
                 VersionDiff diff = compareVersionAgainstSet(i, otherElems, version);
 
                 char ch;
@@ -1136,7 +1136,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
                         attrs["maxComparedVersion"] = version;
                     }
                 } else {
-                    string column = (string) "" + ch + " " + version;
+                    auto column = (std::string) "" + ch + " " + version;
                     if (diff == cvGreater && tty)
                         column = ANSI_RED + column + ANSI_NORMAL;
                     columns.push_back(column);
@@ -1150,7 +1150,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
                 columns.push_back(i.querySystem());
 
             if (printDrvPath) {
-                string drvPath = i.queryDrvPath();
+                auto drvPath = i.queryDrvPath();
                 if (xmlOutput) {
                     if (drvPath != "") attrs["drvPath"] = drvPath;
                 } else
@@ -1159,7 +1159,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
 
             if (printOutPath && !xmlOutput) {
                 DrvInfo::Outputs outputs = i.queryOutputs();
-                string s;
+                std::string s;
                 for (auto & j : outputs) {
                     if (!s.empty()) s += ';';
                     if (j.first != "out") { s += j.first; s += "="; }
@@ -1169,7 +1169,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
             }
 
             if (printDescription) {
-                string descr = i.queryMetaString("description");
+                auto descr = i.queryMetaString("description");
                 if (xmlOutput) {
                     if (descr != "") attrs["description"] = descr;
                 } else
@@ -1331,12 +1331,12 @@ static void opDeleteGenerations(Globals & globals, Strings opFlags, Strings opAr
 
     if (opArgs.size() == 1 && opArgs.front() == "old") {
         deleteOldGenerations(globals.profile, globals.dryRun);
-    } else if (opArgs.size() == 1 && opArgs.front().find('d') != string::npos) {
+    } else if (opArgs.size() == 1 && opArgs.front().find('d') != std::string::npos) {
         deleteGenerationsOlderThan(globals.profile, opArgs.front(), globals.dryRun);
-    } else if (opArgs.size() == 1 && opArgs.front().find('+') != string::npos) {
+    } else if (opArgs.size() == 1 && opArgs.front().find('+') != std::string::npos) {
         if (opArgs.front().size() < 2)
             throw Error("invalid number of generations '%1%'", opArgs.front());
-        string str_max = string(opArgs.front(), 1, opArgs.front().size());
+        auto str_max = opArgs.front().substr(1);
         auto max = string2Int<GenerationNumber>(str_max);
         if (!max || *max == 0)
             throw Error("invalid number of generations to keep '%1%'", opArgs.front());
@@ -1366,7 +1366,7 @@ static int main_nix_env(int argc, char * * argv)
         Strings opFlags, opArgs;
         Operation op = 0;
         RepairFlag repair = NoRepair;
-        string file;
+        std::string file;
 
         Globals globals;
 
diff --git a/src/nix-env/user-env.cc b/src/nix-env/user-env.cc
index 5842e6501..37e4086cb 100644
--- a/src/nix-env/user-env.cc
+++ b/src/nix-env/user-env.cc
@@ -32,7 +32,7 @@ DrvInfos queryInstalled(EvalState & state, const Path & userEnv)
 
 bool createUserEnv(EvalState & state, DrvInfos & elems,
     const Path & profile, bool keepDerivations,
-    const string & lockToken)
+    const std::string & lockToken)
 {
     /* Build the components in the user environment, if they don't
        exist already. */
diff --git a/src/nix-env/user-env.hh b/src/nix-env/user-env.hh
index f188efe9b..10646f713 100644
--- a/src/nix-env/user-env.hh
+++ b/src/nix-env/user-env.hh
@@ -8,6 +8,6 @@ DrvInfos queryInstalled(EvalState & state, const Path & userEnv);
 
 bool createUserEnv(EvalState & state, DrvInfos & elems,
     const Path & profile, bool keepDerivations,
-    const string & lockToken);
+    const std::string & lockToken);
 
 }
diff --git a/src/nix-instantiate/nix-instantiate.cc b/src/nix-instantiate/nix-instantiate.cc
index a08683be1..12fc8baf9 100644
--- a/src/nix-instantiate/nix-instantiate.cc
+++ b/src/nix-instantiate/nix-instantiate.cc
@@ -64,7 +64,7 @@ void processExpr(EvalState & state, const Strings & attrPaths,
                 Path drvPath = i.queryDrvPath();
 
                 /* What output do we want? */
-                string outputName = i.queryOutputName();
+                std::string outputName = i.queryOutputName();
                 if (outputName == "")
                     throw Error("derivation '%1%' lacks an 'outputName' attribute ", drvPath);
 
diff --git a/src/nix-store/dotgraph.cc b/src/nix-store/dotgraph.cc
index 8b699f39b..577cadceb 100644
--- a/src/nix-store/dotgraph.cc
+++ b/src/nix-store/dotgraph.cc
@@ -10,37 +10,35 @@ using std::cout;
 namespace nix {
 
 
-static string dotQuote(std::string_view s)
+static std::string dotQuote(std::string_view s)
 {
     return "\"" + std::string(s) + "\"";
 }
 
 
-static string nextColour()
+static const std::string & nextColour()
 {
     static int n = 0;
-    static string colours[] =
+    static std::vector<std::string> colours
         { "black", "red", "green", "blue"
         , "magenta", "burlywood" };
-    return colours[n++ % (sizeof(colours) / sizeof(string))];
+    return colours[n++ % colours.size()];
 }
 
 
-static string makeEdge(const string & src, const string & dst)
+static std::string makeEdge(std::string_view src, std::string_view dst)
 {
-    format f = format("%1% -> %2% [color = %3%];\n")
-        % dotQuote(src) % dotQuote(dst) % dotQuote(nextColour());
-    return f.str();
+    return fmt("%1% -> %2% [color = %3%];\n",
+        dotQuote(src), dotQuote(dst), dotQuote(nextColour()));
 }
 
 
-static string makeNode(const string & id, std::string_view label,
-    const string & colour)
+static std::string makeNode(std::string_view id, std::string_view label,
+    std::string_view colour)
 {
-    format f = format("%1% [label = %2%, shape = box, "
-        "style = filled, fillcolor = %3%];\n")
-        % dotQuote(id) % dotQuote(label) % dotQuote(colour);
-    return f.str();
+    return fmt("%1% [label = %2%, shape = box, "
+        "style = filled, fillcolor = %3%];\n",
+        dotQuote(id), dotQuote(label), dotQuote(colour));
 }
 
 
diff --git a/src/nix-store/graphml.cc b/src/nix-store/graphml.cc
index 8ca5c9c8d..425d61e53 100644
--- a/src/nix-store/graphml.cc
+++ b/src/nix-store/graphml.cc
@@ -19,20 +19,20 @@ static inline std::string_view xmlQuote(std::string_view s)
 }
 
 
-static string symbolicName(const std::string & p)
+static std::string symbolicName(std::string_view p)
 {
-    return string(p, p.find('-') + 1);
+    return std::string(p.substr(0, p.find('-') + 1));
 }
 
 
-static string makeEdge(std::string_view src, std::string_view dst)
+static std::string makeEdge(std::string_view src, std::string_view dst)
 {
     return fmt("  <edge source=\"%1%\" target=\"%2%\"/>\n",
         xmlQuote(src), xmlQuote(dst));
 }
 
 
-static string makeNode(const ValidPathInfo & info)
+static std::string makeNode(const ValidPathInfo & info)
 {
     return fmt(
         "  <node id=\"%1%\">\n"
diff --git a/src/nix-store/nix-store.cc b/src/nix-store/nix-store.cc
index f0ce0368a..ecd7279e9 100644
--- a/src/nix-store/nix-store.cc
+++ b/src/nix-store/nix-store.cc
@@ -208,8 +208,8 @@ static void opPrintFixedPath(Strings opFlags, Strings opArgs)
 
     Strings::iterator i = opArgs.begin();
     HashType hashAlgo = parseHashType(*i++);
-    string hash = *i++;
-    string name = *i++;
+    std::string hash = *i++;
+    std::string name = *i++;
 
     cout << fmt("%s\n", store->printStorePath(store->makeFixedOutputPath(recursive, Hash::parseAny(hash, hashAlgo), name)));
 }
@@ -238,7 +238,7 @@ static StorePathSet maybeUseOutputs(const StorePath & storePath, bool useOutput,
    graph.  Topological sorting is used to keep the tree relatively
    flat. */
 static void printTree(const StorePath & path,
-    const string & firstPad, const string & tailPad, StorePathSet & done)
+    const std::string & firstPad, const std::string & tailPad, StorePathSet & done)
 {
     if (!done.insert(path).second) {
         cout << fmt("%s%s [...]\n", firstPad, store->printStorePath(path));
@@ -277,7 +277,7 @@ static void opQuery(Strings opFlags, Strings opArgs)
     bool useOutput = false;
     bool includeOutputs = false;
     bool forceRealise = false;
-    string bindingName;
+    std::string bindingName;
 
     for (auto & i : opFlags) {
         QueryType prev = query;
@@ -637,7 +637,7 @@ static void opDump(Strings opFlags, Strings opArgs)
     if (opArgs.size() != 1) throw UsageError("only one argument allowed");
 
     FdSink sink(STDOUT_FILENO);
-    string path = *opArgs.begin();
+    std::string path = *opArgs.begin();
     dumpPath(path, sink);
     sink.flush();
 }
@@ -975,9 +975,9 @@ static void opGenerateBinaryCacheKey(Strings opFlags, Strings opArgs)
 
     if (opArgs.size() != 3) throw UsageError("three arguments expected");
     auto i = opArgs.begin();
-    string keyName = *i++;
-    string secretKeyFile = *i++;
-    string publicKeyFile = *i++;
+    std::string keyName = *i++;
+    std::string secretKeyFile = *i++;
+    std::string publicKeyFile = *i++;
 
     auto secretKey = SecretKey::generate(keyName);
 
diff --git a/src/nix/daemon.cc b/src/nix/daemon.cc
index 6a40a0bd3..940923d3b 100644
--- a/src/nix/daemon.cc
+++ b/src/nix/daemon.cc
@@ -76,7 +76,7 @@ static void setSigChldAction(bool autoReap)
 }
 
 
-bool matchUser(const string & user, const string & group, const Strings & users)
+bool matchUser(const std::string & user, const std::string & group, const Strings & users)
 {
     if (find(users.begin(), users.end(), "*") != users.end())
         return true;
@@ -85,12 +85,12 @@ bool matchUser(const string & user, const string & group, const Strings & users)
         return true;
 
     for (auto & i : users)
-        if (string(i, 0, 1) == "@") {
-            if (group == string(i, 1)) return true;
+        if (i.substr(0, 1) == "@") {
+            if (group == i.substr(1)) return true;
             struct group * gr = getgrnam(i.c_str() + 1);
             if (!gr) continue;
             for (char * * mem = gr->gr_mem; *mem; mem++)
-                if (user == string(*mem)) return true;
+                if (user == std::string(*mem)) return true;
         }
 
     return false;
@@ -198,10 +198,10 @@ static void daemonLoop()
             PeerInfo peer = getPeerInfo(remote.get());
 
             struct passwd * pw = peer.uidKnown ? getpwuid(peer.uid) : 0;
-            string user = pw ? pw->pw_name : std::to_string(peer.uid);
+            std::string user = pw ? pw->pw_name : std::to_string(peer.uid);
 
             struct group * gr = peer.gidKnown ? getgrgid(peer.gid) : 0;
-            string group = gr ? gr->gr_name : std::to_string(peer.gid);
+            std::string group = gr ? gr->gr_name : std::to_string(peer.gid);
 
             Strings trustedUsers = settings.trustedUsers;
             Strings allowedUsers = settings.allowedUsers;
@@ -212,7 +212,7 @@ static void daemonLoop()
             if ((!trusted && !matchUser(user, group, allowedUsers)) || group == settings.buildUsersGroup)
                 throw Error("user '%1%' is not allowed to connect to the Nix daemon", user);
 
-            printInfo(format((string) "accepted connection from pid %1%, user %2%" + (trusted ? " (trusted)" : ""))
+            printInfo(format((std::string) "accepted connection from pid %1%, user %2%" + (trusted ? " (trusted)" : ""))
                 % (peer.pidKnown ? std::to_string(peer.pid) : "<unknown>")
                 % (peer.uidKnown ? user : "<unknown>"));
 
@@ -234,7 +234,7 @@ static void daemonLoop()
 
                 //  For debugging, stuff the pid into argv[1].
                 if (peer.pidKnown && savedArgv[1]) {
-                    string processName = std::to_string(peer.pid);
+                    auto processName = std::to_string(peer.pid);
                     strncpy(savedArgv[1], processName.c_str(), strlen(savedArgv[1]));
                 }
 
diff --git a/src/nix/hash.cc b/src/nix/hash.cc
index 4535e4ab0..60d9593a7 100644
--- a/src/nix/hash.cc
+++ b/src/nix/hash.cc
@@ -177,7 +177,7 @@ static int compatNixHash(int argc, char * * argv)
         else if (*arg == "--base32") base32 = true;
         else if (*arg == "--truncate") truncate = true;
         else if (*arg == "--type") {
-            string s = getArg(*arg, arg, end);
+            std::string s = getArg(*arg, arg, end);
             ht = parseHashType(s);
         }
         else if (*arg == "--to-base16") op = opTo16;
diff --git a/src/nix/prefetch.cc b/src/nix/prefetch.cc
index 094d2a519..f2dd44ba4 100644
--- a/src/nix/prefetch.cc
+++ b/src/nix/prefetch.cc
@@ -16,7 +16,7 @@ using namespace nix;
 
 /* If ‘url’ starts with ‘mirror://’, then resolve it using the list of
    mirrors defined in Nixpkgs. */
-string resolveMirrorUrl(EvalState & state, string url)
+std::string resolveMirrorUrl(EvalState & state, const std::string & url)
 {
     if (url.substr(0, 9) != "mirror://") return url;
 
@@ -38,8 +38,8 @@ string resolveMirrorUrl(EvalState & state, string url)
     if (mirrorList->value->listSize() < 1)
         throw Error("mirror URL '%s' did not expand to anything", url);
 
-    string mirror(state.forceString(*mirrorList->value->listElems()[0]));
-    return mirror + (hasSuffix(mirror, "/") ? "" : "/") + string(s, p + 1);
+    std::string mirror(state.forceString(*mirrorList->value->listElems()[0]));
+    return mirror + (hasSuffix(mirror, "/") ? "" : "/") + s.substr(p + 1);
 }
 
 std::tuple<StorePath, Hash> prefetchFile(
@@ -128,10 +128,10 @@ static int main_nix_prefetch_url(int argc, char * * argv)
 {
     {
         HashType ht = htSHA256;
-        std::vector<string> args;
+        std::vector<std::string> args;
         bool printPath = getEnv("PRINT_PATH") == "1";
         bool fromExpr = false;
-        string attrPath;
+        std::string attrPath;
         bool unpack = false;
         bool executable = false;
         std::optional<std::string> name;
@@ -147,7 +147,7 @@ static int main_nix_prefetch_url(int argc, char * * argv)
             else if (*arg == "--version")
                 printVersion("nix-prefetch-url");
             else if (*arg == "--type") {
-                string s = getArg(*arg, arg, end);
+                auto s = getArg(*arg, arg, end);
                 ht = parseHashType(s);
             }
             else if (*arg == "--print-path")
@@ -186,7 +186,7 @@ static int main_nix_prefetch_url(int argc, char * * argv)
 
         /* If -A is given, get the URL from the specified Nix
            expression. */
-        string url;
+        std::string url;
         if (!fromExpr) {
             if (args.empty())
                 throw UsageError("you must specify a URL");
diff --git a/src/nix/repl.cc b/src/nix/repl.cc
index 575eb0c4c..731337004 100644
--- a/src/nix/repl.cc
+++ b/src/nix/repl.cc
@@ -45,7 +45,7 @@ struct NixRepl
     : gc
     #endif
 {
-    string curDir;
+    std::string curDir;
     std::unique_ptr<EvalState> state;
     Bindings * autoArgs;
 
@@ -62,18 +62,18 @@ struct NixRepl
     NixRepl(const Strings & searchPath, nix::ref<Store> store);
     ~NixRepl();
     void mainLoop(const std::vector<std::string> & files);
-    StringSet completePrefix(string prefix);
-    bool getLine(string & input, const std::string &prompt);
+    StringSet completePrefix(const std::string & prefix);
+    bool getLine(std::string & input, const std::string &prompt);
     StorePath getDerivationPath(Value & v);
-    bool processLine(string line);
+    bool processLine(std::string line);
     void loadFile(const Path & path);
     void loadFlake(const std::string & flakeRef);
     void initEnv();
     void reloadFiles();
     void addAttrsToScope(Value & attrs);
     void addVarToScope(const Symbol & name, Value & v);
-    Expr * parseString(string s);
-    void evalString(string s, Value & v);
+    Expr * parseString(std::string s);
+    void evalString(std::string s, Value & v);
 
     typedef std::set<Value *> ValuesSeen;
     std::ostream &  printValue(std::ostream & str, Value & v, unsigned int maxDepth);
@@ -81,11 +81,11 @@ struct NixRepl
 };
 
 
-string removeWhitespace(string s)
+std::string removeWhitespace(std::string s)
 {
     s = chomp(s);
     size_t n = s.find_first_not_of(" \n\r\t");
-    if (n != string::npos) s = string(s, n);
+    if (n != std::string::npos) s = std::string(s, n);
     return s;
 }
 
@@ -104,7 +104,7 @@ NixRepl::~NixRepl()
     write_history(historyFile.c_str());
 }
 
-string runNix(Path program, const Strings & args,
+std::string runNix(Path program, const Strings & args,
     const std::optional<std::string> & input = {})
 {
     auto subprocessEnv = getEnv();
@@ -198,7 +198,7 @@ namespace {
 
 void NixRepl::mainLoop(const std::vector<std::string> & files)
 {
-    string error = ANSI_RED "error:" ANSI_NORMAL " ";
+    std::string error = ANSI_RED "error:" ANSI_NORMAL " ";
     notice("Welcome to Nix " + nixVersion + ". Type :? for help.\n");
 
     for (auto & i : files)
@@ -252,7 +252,7 @@ void NixRepl::mainLoop(const std::vector<std::string> & files)
 }
 
 
-bool NixRepl::getLine(string & input, const std::string &prompt)
+bool NixRepl::getLine(std::string & input, const std::string & prompt)
 {
     struct sigaction act, old;
     sigset_t savedSignalMask, set;
@@ -297,7 +297,7 @@ bool NixRepl::getLine(string & input, const std::string &prompt)
 }
 
 
-StringSet NixRepl::completePrefix(string prefix)
+StringSet NixRepl::completePrefix(const std::string & prefix)
 {
     StringSet completions;
 
@@ -313,7 +313,7 @@ StringSet NixRepl::completePrefix(string prefix)
 
     size_t slash, dot;
 
-    if ((slash = cur.rfind('/')) != string::npos) {
+    if ((slash = cur.rfind('/')) != std::string::npos) {
         try {
             auto dir = std::string(cur, 0, slash);
             auto prefix2 = std::string(cur, slash + 1);
@@ -323,11 +323,11 @@ StringSet NixRepl::completePrefix(string prefix)
             }
         } catch (Error &) {
         }
-    } else if ((dot = cur.rfind('.')) == string::npos) {
+    } else if ((dot = cur.rfind('.')) == std::string::npos) {
         /* This is a variable name; look it up in the current scope. */
         StringSet::iterator i = varNames.lower_bound(cur);
         while (i != varNames.end()) {
-            if (string(*i, 0, cur.size()) != cur) break;
+            if (i->substr(0, cur.size()) != cur) break;
             completions.insert(prev + *i);
             i++;
         }
@@ -336,8 +336,8 @@ StringSet NixRepl::completePrefix(string prefix)
             /* This is an expression that should evaluate to an
                attribute set.  Evaluate it to get the names of the
                attributes. */
-            string expr(cur, 0, dot);
-            string cur2 = string(cur, dot + 1);
+            auto expr = cur.substr(0, dot);
+            auto cur2 = cur.substr(dot + 1);
 
             Expr * e = parseString(expr);
             Value v;
@@ -345,8 +345,8 @@ StringSet NixRepl::completePrefix(string prefix)
             state->forceAttrs(v, noPos);
 
             for (auto & i : *v.attrs) {
-                string name = i.name;
-                if (string(name, 0, cur2.size()) != cur2) continue;
+                std::string name = i.name;
+                if (name.substr(0, cur2.size()) != cur2) continue;
                 completions.insert(prev + expr + "." + name);
             }
 
@@ -365,7 +365,7 @@ StringSet NixRepl::completePrefix(string prefix)
 }
 
 
-bool isVarName(const string & s)
+static bool isVarName(std::string_view s)
 {
     if (s.size() == 0) return false;
     char c = s[0];
@@ -394,18 +394,18 @@ StorePath NixRepl::getDerivationPath(Value & v) {
 }
 
 
-bool NixRepl::processLine(string line)
+bool NixRepl::processLine(std::string line)
 {
     if (line == "") return true;
 
     _isInterrupted = false;
 
-    string command, arg;
+    std::string command, arg;
 
     if (line[0] == ':') {
         size_t p = line.find_first_of(" \n\r\t");
-        command = string(line, 0, p);
-        if (p != string::npos) arg = removeWhitespace(string(line, p));
+        command = line.substr(0, p);
+        if (p != std::string::npos) arg = removeWhitespace(line.substr(p));
     } else {
         arg = line;
     }
@@ -590,13 +590,13 @@ bool NixRepl::processLine(string line)
 
     else {
         size_t p = line.find('=');
-        string name;
-        if (p != string::npos &&
+        std::string name;
+        if (p != std::string::npos &&
             p < line.size() &&
             line[p + 1] != '=' &&
-            isVarName(name = removeWhitespace(string(line, 0, p))))
+            isVarName(name = removeWhitespace(line.substr(0, p))))
         {
-            Expr * e = parseString(string(line, p + 1));
+            Expr * e = parseString(line.substr(p + 1));
             Value & v(*state->allocValue());
             v.mkThunk(env, e);
             addVarToScope(state->symbols.create(name), v);
@@ -683,7 +683,7 @@ void NixRepl::addAttrsToScope(Value & attrs)
     for (auto & i : *attrs.attrs) {
         staticEnv.vars.emplace_back(i.name, displ);
         env->values[displ++] = i.value;
-        varNames.insert((string) i.name);
+        varNames.insert((std::string) i.name);
     }
     staticEnv.sort();
     staticEnv.deduplicate();
@@ -700,18 +700,18 @@ void NixRepl::addVarToScope(const Symbol & name, Value & v)
     staticEnv.vars.emplace_back(name, displ);
     staticEnv.sort();
     env->values[displ++] = &v;
-    varNames.insert((string) name);
+    varNames.insert((std::string) name);
 }
 
 
-Expr * NixRepl::parseString(string s)
+Expr * NixRepl::parseString(std::string s)
 {
     Expr * e = state->parseExprFromString(std::move(s), curDir, staticEnv);
     return e;
 }
 
 
-void NixRepl::evalString(string s, Value & v)
+void NixRepl::evalString(std::string s, Value & v)
 {
     Expr * e = parseString(s);
     e->eval(*state, *env, v);
@@ -787,7 +787,7 @@ std::ostream & NixRepl::printValue(std::ostream & str, Value & v, unsigned int m
         else if (maxDepth > 0) {
             str << "{ ";
 
-            typedef std::map<string, Value *> Sorted;
+            typedef std::map<std::string, Value *> Sorted;
             Sorted sorted;
             for (auto & i : *v.attrs)
                 sorted[i.name] = i.value;
diff --git a/src/nix/why-depends.cc b/src/nix/why-depends.cc
index 657df30d7..cc05deda0 100644
--- a/src/nix/why-depends.cc
+++ b/src/nix/why-depends.cc
@@ -157,11 +157,11 @@ struct CmdWhyDepends : SourceExprCommand
            closure (i.e., that have a non-infinite distance to
            'dependency'). Print every edge on a path between `package`
            and `dependency`. */
-        std::function<void(Node &, const string &, const string &)> printNode;
+        std::function<void(Node &, const std::string &, const std::string &)> printNode;
 
         struct BailOut { };
 
-        printNode = [&](Node & node, const string & firstPad, const string & tailPad) {
+        printNode = [&](Node & node, const std::string & firstPad, const std::string & tailPad) {
             auto pathS = store->printStorePath(node.path);
 
             assert(node.dist != inf);

From 947d4761b35ffa5f689ad22d631696d35d28b941 Mon Sep 17 00:00:00 2001
From: toonn <toonn@toonn.io>
Date: Sat, 26 Feb 2022 14:16:35 +0100
Subject: [PATCH 068/251] doc: Add removal of darwin-store LaunchDaemon

The uninstall instructions used to accidentally remove the nix-darwin
LaunchDaemon, this was dropped. However, the original intent was to
remove the Store volume mounting LaunchDaemon.
---
 doc/manual/src/installation/installing-binary.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/doc/manual/src/installation/installing-binary.md b/doc/manual/src/installation/installing-binary.md
index eb184c07b..e5fb50088 100644
--- a/doc/manual/src/installation/installing-binary.md
+++ b/doc/manual/src/installation/installing-binary.md
@@ -131,6 +131,8 @@ and `/etc/zshrc` which you may remove.
    ```console
    sudo launchctl unload /Library/LaunchDaemons/org.nixos.nix-daemon.plist
    sudo rm /Library/LaunchDaemons/org.nixos.nix-daemon.plist
+   sudo launchctl unload /Library/LaunchDaemons/org.nixos.darwin-store.plist
+   sudo rm /Library/LaunchDaemons/org.nixos.darwin-store.plist
    ```
 
    This stops the Nix daemon and prevents it from being started next time you

From a949673a5b4a08429e9866bc8558e961bb8fe130 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 28 Feb 2022 15:21:03 +0100
Subject: [PATCH 069/251] Fix Darwin build

Fixes #6169
---
 src/libstore/build/local-derivation-goal.cc | 4 ++--
 src/libstore/build/local-derivation-goal.hh | 2 +-
 src/libstore/gc.cc                          | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index 220f80602..a2a52e8f9 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -1933,7 +1933,7 @@ void LocalDerivationGoal::runChild()
                             "can't map '%1%' to '%2%': mismatched impure paths not supported on Darwin",
                             i.first, i.second.source);
 
-                    string path = i.first;
+                    std::string path = i.first;
                     struct stat st;
                     if (lstat(path.c_str(), &st)) {
                         if (i.second.optional && errno == ENOENT)
@@ -1985,7 +1985,7 @@ void LocalDerivationGoal::runChild()
                 args.push_back("IMPORT_DIR=" + settings.nixDataDir + "/nix/sandbox/");
                 if (allowLocalNetworking) {
                     args.push_back("-D");
-                    args.push_back(string("_ALLOW_LOCAL_NETWORKING=1"));
+                    args.push_back(std::string("_ALLOW_LOCAL_NETWORKING=1"));
                 }
                 args.push_back(drv->builder);
             } else {
diff --git a/src/libstore/build/local-derivation-goal.hh b/src/libstore/build/local-derivation-goal.hh
index 2d1222d2f..95692c60d 100644
--- a/src/libstore/build/local-derivation-goal.hh
+++ b/src/libstore/build/local-derivation-goal.hh
@@ -62,7 +62,7 @@ struct LocalDerivationGoal : public DerivationGoal
     Environment env;
 
 #if __APPLE__
-    typedef string SandboxProfile;
+    typedef std::string SandboxProfile;
     SandboxProfile additionalSandboxProfile;
 #endif
 
diff --git a/src/libstore/gc.cc b/src/libstore/gc.cc
index fd38b731c..024da66c1 100644
--- a/src/libstore/gc.cc
+++ b/src/libstore/gc.cc
@@ -413,7 +413,7 @@ void LocalStore::findRuntimeRoots(Roots & roots, bool censor)
         try {
             std::regex lsofRegex(R"(^n(/.*)$)");
             auto lsofLines =
-                tokenizeString<std::vector<string>>(runProgram(LSOF, true, { "-n", "-w", "-F", "n" }), "\n");
+                tokenizeString<std::vector<std::string>>(runProgram(LSOF, true, { "-n", "-w", "-F", "n" }), "\n");
             for (const auto & line : lsofLines) {
                 std::smatch match;
                 if (std::regex_match(line, match, lsofRegex))

From b91500a14e5f1bab33cd9dccbe9a85ad2832062a Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 28 Feb 2022 15:24:24 +0100
Subject: [PATCH 070/251] Fix clang warning

---
 src/libstore/build/local-derivation-goal.cc | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index a2a52e8f9..7e69d4145 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -2383,14 +2383,10 @@ void LocalDerivationGoal::registerOutputs()
             [&](DerivationOutputCAFloating dof) {
                 return newInfoFromCA(dof);
             },
-                [&](DerivationOutputDeferred) {
+            [&](DerivationOutputDeferred) -> ValidPathInfo {
                 // No derivation should reach that point without having been
                 // rewritten first
                 assert(false);
-                // Ugly, but the compiler insists on having this return a value
-                // of type `ValidPathInfo` despite the `assert(false)`, so
-                // let's provide it
-                return *(ValidPathInfo*)0;
             },
         }, output.output);
 

From b8f8aef9d3d026af474a4f7ef8f09678c3e5a7d4 Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Mon, 28 Feb 2022 14:41:09 +0100
Subject: [PATCH 071/251] tests: Fix the start of the daemon
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Make sure that it starts even without the `nix-command` xp feature
- Fail if it doesn’t manage to start

This fixes a 30s wait for every test in `init.sh` as the daemon couldn’t
start, but the code was just waiting 30s and continuing as if everything
was all right.
---
 tests/common.sh.in | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/tests/common.sh.in b/tests/common.sh.in
index 49068f1c3..e485329ba 100644
--- a/tests/common.sh.in
+++ b/tests/common.sh.in
@@ -90,12 +90,18 @@ startDaemon() {
     # Start the daemon, wait for the socket to appear.  !!!
     # ‘nix-daemon’ should have an option to fork into the background.
     rm -f $NIX_DAEMON_SOCKET_PATH
-    PATH=$DAEMON_PATH nix daemon &
+    PATH=$DAEMON_PATH nix-daemon&
+    pidDaemon=$!
     for ((i = 0; i < 300; i++)); do
-        if [[ -S $NIX_DAEMON_SOCKET_PATH ]]; then break; fi
+        if [[ -S $NIX_DAEMON_SOCKET_PATH ]]; then
+          DAEMON_STARTED=1
+          break;
+        fi
         sleep 0.1
     done
-    pidDaemon=$!
+    if [[ -z ${DAEMON_STARTED+x} ]]; then
+      fail "Didn’t manage to start the daemon"
+    fi
     trap "killDaemon" EXIT
     export NIX_REMOTE=daemon
 }

From 7a04839ea53986a0175bf085e7d061ab8a32d59b Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Mon, 31 Jan 2022 22:05:28 +0100
Subject: [PATCH 072/251] ssh-ng: also store build logs to make them accessible
 by `nix log`

Right now when building a derivation remotely via

    $ nix build -j0 -f . hello -L --builders 'ssh://builder'

it's possible later to read through the entire build-log by running
`nix log -f . hello`. This isn't possible however when using `ssh-ng`
rather than `ssh`.

The reason for that is that there are two different ways to transfer
logs in Nix through e.g. an SSH tunnel (that are used by `ssh`/`ssh-ng`
respectively):

* `ssh://` receives its logs from the fd pointing to `builderOut`. This
  is directly passed to the "log-sink" (and to the logger on each `\n`),
  hence `nix log` works here.
* `ssh-ng://` however expects JSON-like messages (i.e. `@nix {log data
  in here}`) and passes it directly to the logger without doing anything
  with the `logSink`. However it's certainly possible to extract
  log-lines from this format as these have their own message-type in the
  JSON payload (i.e. `resBuildLogLine`).

  This is basically what I changed in this patch: if the code-path for
  `builderOut` is not reached and a `logSink` is initialized, the
  message was successfully processed by the JSON logger (i.e. it's in
  the expected format) and the line is of the expected type (i.e.
  `resBuildLogLine`), the line will be written to the log-sink as well.

Closes #5079
---
 src/libstore/build/derivation-goal.cc | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index 95da1841d..ef1135601 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -1175,10 +1175,10 @@ bool DerivationGoal::isReadDesc(int fd)
     return fd == hook->builderOut.readSide.get();
 }
 
-
 void DerivationGoal::handleChildOutput(int fd, std::string_view data)
 {
-    if (isReadDesc(fd))
+    auto isWrittenToLog = isReadDesc(fd);
+    if (isWrittenToLog)
     {
         logSize += data.size();
         if (settings.maxLogSize && logSize > settings.maxLogSize) {
@@ -1207,7 +1207,14 @@ void DerivationGoal::handleChildOutput(int fd, std::string_view data)
     if (hook && fd == hook->fromHook.readSide.get()) {
         for (auto c : data)
             if (c == '\n') {
-                handleJSONLogMessage(currentHookLine, worker.act, hook->activities, true);
+                auto s = handleJSONLogMessage(currentHookLine, worker.act, hook->activities, true);
+                if (s && !isWrittenToLog && logSink) {
+                    auto json = nlohmann::json::parse(std::string(currentHookLine, 5));
+                    if (json["type"] == resBuildLogLine) {
+                        auto f = json["fields"];
+                        (*logSink)((f.size() > 0 ? f.at(0).get<std::string>() : "") + "\n");
+                    }
+                }
                 currentHookLine.clear();
             } else
                 currentHookLine += c;

From cd92ea588504db697103d3ff56166fe61e6da131 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sat, 19 Feb 2022 22:34:50 +0100
Subject: [PATCH 073/251] libstore/derivation-goal: avoid double-parsing of
 JSON messages

To avoid that JSON messages are parsed twice in case of
remote builds with `ssh-ng://`, I split up the original
`handleJSONLogMessage` into three parts:

* `parseJSONMessage(const std::string&)` checks if it's a message in the
  form of `@nix {...}` and tries to parse it (and prints an error if the
  parsing fails).
* `handleJSONLogMessage(nlohmann::json&, ...)` reads the fields from the
  message and passes them to the logger.
* `handleJSONLogMessage(const std::string&, ...)` behaves as before, but
  uses the two functions mentioned above as implementation.

In case of `ssh-ng://`-logs the first two methods are invoked manually.
---
 src/libstore/build/derivation-goal.cc | 14 +++--
 src/libutil/logging.cc                | 84 +++++++++++++++------------
 src/libutil/logging.hh                |  8 +++
 3 files changed, 64 insertions(+), 42 deletions(-)

diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index ef1135601..c49be5e79 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -1207,12 +1207,14 @@ void DerivationGoal::handleChildOutput(int fd, std::string_view data)
     if (hook && fd == hook->fromHook.readSide.get()) {
         for (auto c : data)
             if (c == '\n') {
-                auto s = handleJSONLogMessage(currentHookLine, worker.act, hook->activities, true);
-                if (s && !isWrittenToLog && logSink) {
-                    auto json = nlohmann::json::parse(std::string(currentHookLine, 5));
-                    if (json["type"] == resBuildLogLine) {
-                        auto f = json["fields"];
-                        (*logSink)((f.size() > 0 ? f.at(0).get<std::string>() : "") + "\n");
+                auto json = parseJSONMessage(currentHookLine);
+                if (json) {
+                    auto s = handleJSONLogMessage(*json, worker.act, hook->activities, true);
+                    if (s && !isWrittenToLog && logSink) {
+                        if ((*json)["type"] == resBuildLogLine) {
+                            auto f = (*json)["fields"];
+                            (*logSink)((f.size() > 0 ? f.at(0).get<std::string>() : "") + "\n");
+                        }
                     }
                 }
                 currentHookLine.clear();
diff --git a/src/libutil/logging.cc b/src/libutil/logging.cc
index 74ee2f063..cb2b15b41 100644
--- a/src/libutil/logging.cc
+++ b/src/libutil/logging.cc
@@ -266,51 +266,63 @@ static Logger::Fields getFields(nlohmann::json & json)
     return fields;
 }
 
-bool handleJSONLogMessage(const std::string & msg,
-    const Activity & act, std::map<ActivityId, Activity> & activities, bool trusted)
+std::optional<nlohmann::json> parseJSONMessage(const std::string & msg)
 {
-    if (!hasPrefix(msg, "@nix ")) return false;
-
+    if (!hasPrefix(msg, "@nix ")) return std::nullopt;
     try {
-        auto json = nlohmann::json::parse(std::string(msg, 5));
-
-        std::string action = json["action"];
-
-        if (action == "start") {
-            auto type = (ActivityType) json["type"];
-            if (trusted || type == actFileTransfer)
-                activities.emplace(std::piecewise_construct,
-                    std::forward_as_tuple(json["id"]),
-                    std::forward_as_tuple(*logger, (Verbosity) json["level"], type,
-                        json["text"], getFields(json["fields"]), act.id));
-        }
-
-        else if (action == "stop")
-            activities.erase((ActivityId) json["id"]);
-
-        else if (action == "result") {
-            auto i = activities.find((ActivityId) json["id"]);
-            if (i != activities.end())
-                i->second.result((ResultType) json["type"], getFields(json["fields"]));
-        }
-
-        else if (action == "setPhase") {
-            std::string phase = json["phase"];
-            act.result(resSetPhase, phase);
-        }
-
-        else if (action == "msg") {
-            std::string msg = json["msg"];
-            logger->log((Verbosity) json["level"], msg);
-        }
-
+        return nlohmann::json::parse(std::string(msg, 5));
     } catch (std::exception & e) {
         printError("bad JSON log message from builder: %s", e.what());
     }
+    return std::nullopt;
+}
+
+bool handleJSONLogMessage(nlohmann::json & json,
+    const Activity & act, std::map<ActivityId, Activity> & activities,
+    bool trusted)
+{
+    std::string action = json["action"];
+
+    if (action == "start") {
+        auto type = (ActivityType) json["type"];
+        if (trusted || type == actFileTransfer)
+            activities.emplace(std::piecewise_construct,
+                std::forward_as_tuple(json["id"]),
+                std::forward_as_tuple(*logger, (Verbosity) json["level"], type,
+                    json["text"], getFields(json["fields"]), act.id));
+    }
+
+    else if (action == "stop")
+        activities.erase((ActivityId) json["id"]);
+
+    else if (action == "result") {
+        auto i = activities.find((ActivityId) json["id"]);
+        if (i != activities.end())
+            i->second.result((ResultType) json["type"], getFields(json["fields"]));
+    }
+
+    else if (action == "setPhase") {
+        std::string phase = json["phase"];
+        act.result(resSetPhase, phase);
+    }
+
+    else if (action == "msg") {
+        std::string msg = json["msg"];
+        logger->log((Verbosity) json["level"], msg);
+    }
 
     return true;
 }
 
+bool handleJSONLogMessage(const std::string & msg,
+    const Activity & act, std::map<ActivityId, Activity> & activities, bool trusted)
+{
+    auto json = parseJSONMessage(msg);
+    if (!json) return false;
+
+    return handleJSONLogMessage(*json, act, activities, trusted);
+}
+
 Activity::~Activity()
 {
     try {
diff --git a/src/libutil/logging.hh b/src/libutil/logging.hh
index bd28036ae..9ab2091c7 100644
--- a/src/libutil/logging.hh
+++ b/src/libutil/logging.hh
@@ -4,6 +4,8 @@
 #include "error.hh"
 #include "config.hh"
 
+#include <nlohmann/json.hpp>
+
 namespace nix {
 
 typedef enum {
@@ -166,6 +168,12 @@ Logger * makeSimpleLogger(bool printBuildLogs = true);
 
 Logger * makeJSONLogger(Logger & prevLogger);
 
+std::optional<nlohmann::json> parseJSONMessage(const std::string & msg);
+
+bool handleJSONLogMessage(nlohmann::json & json,
+    const Activity & act, std::map<ActivityId, Activity> & activities,
+    bool trusted);
+
 bool handleJSONLogMessage(const std::string & msg,
     const Activity & act, std::map<ActivityId, Activity> & activities,
     bool trusted);

From 287642f132d8141269bd7c23b0bc7c1ee512b171 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 20 Feb 2022 15:56:22 +0100
Subject: [PATCH 074/251] tests: implement test for `nix log` with `ssh-ng://`
 builds

A few notes:

* The `echo hi` is needed to make sure that a file that can be read by
  `nix log` is properly created (i.e. some output is needed). This is
  known and to be fixed in #6051.
* We explicitly ignore the floating-CA case here: the `$out` of `input3`
  depends on `$out` of `input2`. This means that there are actually two
  derivations - I assume that this is because at eval time (i.e.
  `nix-instantiate -A`) the hash of `input2` isn't known yet and the
  other .drv is created as soon as `input2` was built. This is another
  issue on its own, so we ignore the case here explicitly.
---
 tests/build-hook-ca-fixed.nix | 10 ++++++----
 tests/build-hook.nix          | 10 ++++++----
 tests/build-remote.sh         |  8 ++++++++
 3 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/tests/build-hook-ca-fixed.nix b/tests/build-hook-ca-fixed.nix
index ec7171ac9..899b610a8 100644
--- a/tests/build-hook-ca-fixed.nix
+++ b/tests/build-hook-ca-fixed.nix
@@ -11,13 +11,13 @@ let
       args = ["sh" "-e" args.builder or (builtins.toFile "builder-${args.name}.sh" "if [ -e .attrs.sh ]; then source .attrs.sh; fi; eval \"$buildCommand\"")];
       outputHashMode = "recursive";
       outputHashAlgo = "sha256";
-    } // removeAttrs args ["builder" "meta"])
-    // { meta = args.meta or {}; };
+    } // removeAttrs args ["builder" "meta" "passthru"])
+    // { meta = args.meta or {}; passthru = args.passthru or {}; };
 
   input1 = mkDerivation {
     shell = busybox;
     name = "build-remote-input-1";
-    buildCommand = "echo FOO > $out";
+    buildCommand = "echo hi; echo FOO > $out";
     requiredSystemFeatures = ["foo"];
     outputHash = "sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc=";
   };
@@ -25,7 +25,7 @@ let
   input2 = mkDerivation {
     shell = busybox;
     name = "build-remote-input-2";
-    buildCommand = "echo BAR > $out";
+    buildCommand = "echo hi; echo BAR > $out";
     requiredSystemFeatures = ["bar"];
     outputHash = "sha256-XArauVH91AVwP9hBBQNlkX9ccuPpSYx9o0zeIHb6e+Q=";
   };
@@ -34,6 +34,7 @@ let
     shell = busybox;
     name = "build-remote-input-3";
     buildCommand = ''
+      echo hi
       read x < ${input2}
       echo $x BAZ > $out
     '';
@@ -46,6 +47,7 @@ in
   mkDerivation {
     shell = busybox;
     name = "build-remote";
+    passthru = { inherit input1 input2 input3; };
     buildCommand =
       ''
         read x < ${input1}
diff --git a/tests/build-hook.nix b/tests/build-hook.nix
index eb16676f0..3c83e0475 100644
--- a/tests/build-hook.nix
+++ b/tests/build-hook.nix
@@ -9,20 +9,20 @@ let
       inherit system;
       builder = busybox;
       args = ["sh" "-e" args.builder or (builtins.toFile "builder-${args.name}.sh" "if [ -e .attrs.sh ]; then source .attrs.sh; fi; eval \"$buildCommand\"")];
-    } // removeAttrs args ["builder" "meta"])
-    // { meta = args.meta or {}; };
+    } // removeAttrs args ["builder" "meta" "passthru"])
+    // { meta = args.meta or {}; passthru = args.passthru or {}; };
 
   input1 = mkDerivation {
     shell = busybox;
     name = "build-remote-input-1";
-    buildCommand = "echo FOO > $out";
+    buildCommand = "echo hi; echo FOO > $out";
     requiredSystemFeatures = ["foo"];
   };
 
   input2 = mkDerivation {
     shell = busybox;
     name = "build-remote-input-2";
-    buildCommand = "echo BAR > $out";
+    buildCommand = "echo hi; echo BAR > $out";
     requiredSystemFeatures = ["bar"];
   };
 
@@ -30,6 +30,7 @@ let
     shell = busybox;
     name = "build-remote-input-3";
     buildCommand = ''
+      echo hi
       read x < ${input2}
       echo $x BAZ > $out
     '';
@@ -41,6 +42,7 @@ in
   mkDerivation {
     shell = busybox;
     name = "build-remote";
+    passthru = { inherit input1 input2 input3; };
     buildCommand =
       ''
         read x < ${input1}
diff --git a/tests/build-remote.sh b/tests/build-remote.sh
index 806c6d261..4ecc788a3 100644
--- a/tests/build-remote.sh
+++ b/tests/build-remote.sh
@@ -54,6 +54,14 @@ nix path-info --store $TEST_ROOT/machine3 --all \
   | grep -v builder-build-remote-input-2.sh \
   | grep builder-build-remote-input-3.sh
 
+
+if [[ -z "$CONTENT_ADDRESSED" ]]; then
+  for i in input1 input3; do
+    drv="$(nix-instantiate $file -A passthru.$i --store $TEST_ROOT/machine0 --arg busybox $busybox)"
+    nix log --store $TEST_ROOT/machine0 "$drv"
+  done
+fi
+
 # Behavior of keep-failed
 out="$(nix-build 2>&1 failing.nix \
   --builders "$(join_by '; ' "${builders[@]}")"  \

From 102cb390864f8a142ad6730d3456784e2778a493 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 20 Feb 2022 16:02:44 +0100
Subject: [PATCH 075/251] libstore/build: add a few explanatory comments;
 simplify

---
 src/libstore/build/derivation-goal.cc | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index c49be5e79..ae250ffaf 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -1177,6 +1177,7 @@ bool DerivationGoal::isReadDesc(int fd)
 
 void DerivationGoal::handleChildOutput(int fd, std::string_view data)
 {
+    // local & `ssh://`-builds are dealt with here.
     auto isWrittenToLog = isReadDesc(fd);
     if (isWrittenToLog)
     {
@@ -1210,11 +1211,11 @@ void DerivationGoal::handleChildOutput(int fd, std::string_view data)
                 auto json = parseJSONMessage(currentHookLine);
                 if (json) {
                     auto s = handleJSONLogMessage(*json, worker.act, hook->activities, true);
-                    if (s && !isWrittenToLog && logSink) {
-                        if ((*json)["type"] == resBuildLogLine) {
-                            auto f = (*json)["fields"];
-                            (*logSink)((f.size() > 0 ? f.at(0).get<std::string>() : "") + "\n");
-                        }
+                    // ensure that logs from a builder using `ssh-ng://` as protocol
+                    // are also available to `nix log`.
+                    if (s && !isWrittenToLog && logSink && (*json)["type"] == resBuildLogLine) {
+                        auto f = (*json)["fields"];
+                        (*logSink)((f.size() > 0 ? f.at(0).get<std::string>() : "") + "\n");
                     }
                 }
                 currentHookLine.clear();

From 6a8f1b548fc85af7e065feee93920839ec94fa40 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Mon, 28 Feb 2022 16:05:21 +0100
Subject: [PATCH 076/251] logging.hh: json.hpp -> json_fwd.hpp

---
 src/libutil/logging.hh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libutil/logging.hh b/src/libutil/logging.hh
index 9ab2091c7..6f81b92de 100644
--- a/src/libutil/logging.hh
+++ b/src/libutil/logging.hh
@@ -4,7 +4,7 @@
 #include "error.hh"
 #include "config.hh"
 
-#include <nlohmann/json.hpp>
+#include <nlohmann/json_fwd.hpp>
 
 namespace nix {
 

From 158280d8e9b9d7fbf1ccee9cef829081859810e6 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 27 Feb 2022 15:25:22 +0100
Subject: [PATCH 077/251] fetchTree: Do not re-fetch paths already present

---
 src/libexpr/primops/fetchTree.cc | 28 ++++++++++++++++++++++++----
 tests/fetchurl.sh                |  4 ++++
 tests/tarball.sh                 |  4 ++++
 3 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index f3e3e70d8..ea416d2d9 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -185,6 +185,13 @@ static void prim_fetchTree(EvalState & state, const Pos & pos, Value * * args, V
 // FIXME: document
 static RegisterPrimOp primop_fetchTree("fetchTree", 1, prim_fetchTree);
 
+static void setStorePath(EvalState &state, const StorePath &storePath, Value &v) {
+    state.allowPath(storePath);
+
+    auto path = state.store->printStorePath(storePath);
+    v.mkString(path, PathSet({path}));
+}
+
 static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
     const std::string & who, bool unpack, std::string name)
 {
@@ -203,6 +210,8 @@ static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
                 url = state.forceStringNoCtx(*attr.value, *attr.pos);
             else if (n == "sha256")
                 expectedHash = newHashAllowEmpty(state.forceStringNoCtx(*attr.value, *attr.pos), htSHA256);
+            else if (n == "narHash")
+                expectedHash = newHashAllowEmpty(state.forceStringNoCtx(*attr.value, *attr.pos), htSHA256);
             else if (n == "name")
                 name = state.forceStringNoCtx(*attr.value, *attr.pos);
             else
@@ -230,6 +239,20 @@ static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
     if (evalSettings.pureEval && !expectedHash)
         throw Error("in pure evaluation mode, '%s' requires a 'sha256' argument", who);
 
+    // early exit if pinned and already in the store
+    if (expectedHash && expectedHash->type == htSHA256) {
+        auto expectedPath =
+            unpack
+            ? state.store->makeFixedOutputPath(FileIngestionMethod::Recursive, *expectedHash, name, {})
+            : state.store->makeFixedOutputPath(FileIngestionMethod::Flat, *expectedHash, name, {});
+
+        auto validPaths = state.store->queryValidPaths({expectedPath}, NoSubstitute);
+        if (!validPaths.empty()) {
+            setStorePath(state, expectedPath, v);
+            return;
+        }
+    }
+
     auto storePath =
         unpack
         ? fetchers::downloadTarball(state.store, *url, name, (bool) expectedHash).first.storePath
@@ -244,10 +267,7 @@ static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
                 *url, expectedHash->to_string(Base32, true), hash.to_string(Base32, true));
     }
 
-    state.allowPath(storePath);
-
-    auto path = state.store->printStorePath(storePath);
-    v.mkString(path, PathSet({path}));
+    setStorePath(state, storePath, v);
 }
 
 static void prim_fetchurl(EvalState & state, const Pos & pos, Value * * args, Value & v)
diff --git a/tests/fetchurl.sh b/tests/fetchurl.sh
index 3d1685f43..b41d8c4b7 100644
--- a/tests/fetchurl.sh
+++ b/tests/fetchurl.sh
@@ -9,6 +9,10 @@ outPath=$(nix-build -vvvvv --expr 'import <nix/fetchurl.nix>' --argstr url file:
 
 cmp $outPath fetchurl.sh
 
+# Do not re-fetch paths already present.
+outPath2=$(nix-build -vvvvv --expr 'import <nix/fetchurl.nix>' --argstr url file:///does-not-exist/must-remain-unused/fetchurl.sh --argstr sha256 $hash --no-out-link)
+test "$outPath" == "$outPath2"
+
 # Now using a base-64 hash.
 clearStore
 
diff --git a/tests/tarball.sh b/tests/tarball.sh
index 1301922a5..d5cab879c 100644
--- a/tests/tarball.sh
+++ b/tests/tarball.sh
@@ -26,10 +26,14 @@ test_tarball() {
     nix-build -o $TEST_ROOT/result '<foo>' -I foo=file://$tarball
 
     nix-build -o $TEST_ROOT/result -E "import (fetchTarball file://$tarball)"
+    # Do not re-fetch paths already present
+    nix-build  -o $TEST_ROOT/result -E "import (fetchTarball { url = file:///does-not-exist/must-remain-unused/$tarball; sha256 = \"$hash\"; })"
 
     nix-build  -o $TEST_ROOT/result -E "import (fetchTree file://$tarball)"
     nix-build  -o $TEST_ROOT/result -E "import (fetchTree { type = \"tarball\"; url = file://$tarball; })"
     nix-build  -o $TEST_ROOT/result -E "import (fetchTree { type = \"tarball\"; url = file://$tarball; narHash = \"$hash\"; })"
+    # Do not re-fetch paths already present
+    nix-build  -o $TEST_ROOT/result -E "import (fetchTree { type = \"tarball\"; url = file:///does-not-exist/must-remain-unused/$tarball; narHash = \"$hash\"; })"
     nix-build  -o $TEST_ROOT/result -E "import (fetchTree { type = \"tarball\"; url = file://$tarball; narHash = \"sha256-xdKv2pq/IiwLSnBBJXW8hNowI4MrdZfW+SYqDQs7Tzc=\"; })" 2>&1 | grep 'NAR hash mismatch in input'
 
     nix-instantiate --strict --eval -E "!((import (fetchTree { type = \"tarball\"; url = file://$tarball; narHash = \"$hash\"; })) ? submodules)" >&2

From ee019d0afce63f5145a043b025a37dfc39444a3d Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 27 Feb 2022 15:59:34 +0100
Subject: [PATCH 078/251] Add EvalState::allowAndSetStorePathString helper

This switches addPath from `printStorePath` to `toRealPath`.
---
 src/libexpr/eval.cc              |  8 ++++++++
 src/libexpr/eval.hh              |  3 +++
 src/libexpr/primops.cc           | 15 +++++----------
 src/libexpr/primops/fetchTree.cc | 11 ++---------
 4 files changed, 18 insertions(+), 19 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 60f0bf08c..d94afbb99 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -517,6 +517,14 @@ void EvalState::allowPath(const StorePath & storePath)
         allowedPaths->insert(store->toRealPath(storePath));
 }
 
+void EvalState::allowAndSetStorePathString(const StorePath &storePath, Value &v)
+{
+    allowPath(storePath);
+
+    auto path = store->printStorePath(storePath);
+    v.mkString(path, PathSet({path}));
+}
+
 Path EvalState::checkSourcePath(const Path & path_)
 {
     if (!allowedPaths) return path_;
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index 1f0e97b2e..9324961f7 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -161,6 +161,9 @@ public:
        the real store path if `store` is a chroot store. */
     void allowPath(const StorePath & storePath);
 
+    /* Allow access to a store path and return it as a string. */
+    void allowAndSetStorePathString(const StorePath & storePath, Value &v);
+
     /* Check whether access to a path is allowed and throw an error if
        not. Otherwise return the canonicalised path. */
     Path checkSourcePath(const Path & path);
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index aa22c3b61..3124025aa 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1919,20 +1919,15 @@ static void addPath(
         if (expectedHash)
             expectedStorePath = state.store->makeFixedOutputPath(method, *expectedHash, name);
 
-        Path dstPath;
         if (!expectedHash || !state.store->isValidPath(*expectedStorePath)) {
-            dstPath = state.store->printStorePath(settings.readOnlyMode
+            StorePath dstPath = settings.readOnlyMode
                 ? state.store->computeStorePathForPath(name, path, method, htSHA256, filter).first
-                : state.store->addToStore(name, path, method, htSHA256, filter, state.repair, refs));
-            if (expectedHash && expectedStorePath != state.store->parseStorePath(dstPath))
+                : state.store->addToStore(name, path, method, htSHA256, filter, state.repair, refs);
+            if (expectedHash && expectedStorePath != dstPath)
                 throw Error("store path mismatch in (possibly filtered) path added from '%s'", path);
+            state.allowAndSetStorePathString(dstPath, v);
         } else
-            dstPath = state.store->printStorePath(*expectedStorePath);
-
-        v.mkString(dstPath, {dstPath});
-
-        state.allowPath(dstPath);
-
+            state.allowAndSetStorePathString(*expectedStorePath, v);
     } catch (Error & e) {
         e.addTrace(pos, "while adding path '%s'", path);
         throw;
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index ea416d2d9..2eeee7173 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -185,13 +185,6 @@ static void prim_fetchTree(EvalState & state, const Pos & pos, Value * * args, V
 // FIXME: document
 static RegisterPrimOp primop_fetchTree("fetchTree", 1, prim_fetchTree);
 
-static void setStorePath(EvalState &state, const StorePath &storePath, Value &v) {
-    state.allowPath(storePath);
-
-    auto path = state.store->printStorePath(storePath);
-    v.mkString(path, PathSet({path}));
-}
-
 static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
     const std::string & who, bool unpack, std::string name)
 {
@@ -248,7 +241,7 @@ static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
 
         auto validPaths = state.store->queryValidPaths({expectedPath}, NoSubstitute);
         if (!validPaths.empty()) {
-            setStorePath(state, expectedPath, v);
+            state.allowAndSetStorePathString(expectedPath, v);
             return;
         }
     }
@@ -267,7 +260,7 @@ static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
                 *url, expectedHash->to_string(Base32, true), hash.to_string(Base32, true));
     }
 
-    setStorePath(state, storePath, v);
+    state.allowAndSetStorePathString(storePath, v);
 }
 
 static void prim_fetchurl(EvalState & state, const Pos & pos, Value * * args, Value & v)

From ea71da395fe23fc0b4adb6fe5075742441e8baf8 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 1 Mar 2022 01:29:34 +0000
Subject: [PATCH 079/251] Move some stuff from `Settings` to a new
 `FetchSettings`.

Starting work on #5638

The exact boundary between `FetchSettings` and `EvalSettings` is not
clear to me, but that's fine. First lets clean out `libstore`, and then
worry about what, if anything, should be the separation between those
two.
---
 src/libexpr/flake/config.cc       |  3 +-
 src/libexpr/flake/flake.cc        |  9 +--
 src/libfetchers/fetch-settings.cc | 13 +++++
 src/libfetchers/fetch-settings.hh | 93 +++++++++++++++++++++++++++++++
 src/libfetchers/git.cc            |  6 +-
 src/libfetchers/github.cc         |  6 +-
 src/libfetchers/mercurial.cc      |  6 +-
 src/libfetchers/registry.cc       |  4 +-
 src/libstore/globals.hh           | 71 -----------------------
 9 files changed, 128 insertions(+), 83 deletions(-)
 create mode 100644 src/libfetchers/fetch-settings.cc
 create mode 100644 src/libfetchers/fetch-settings.hh

diff --git a/src/libexpr/flake/config.cc b/src/libexpr/flake/config.cc
index 7ecd61816..a811e59a1 100644
--- a/src/libexpr/flake/config.cc
+++ b/src/libexpr/flake/config.cc
@@ -1,5 +1,6 @@
 #include "flake.hh"
 #include "globals.hh"
+#include "fetch-settings.hh"
 
 #include <nlohmann/json.hpp>
 
@@ -53,7 +54,7 @@ void ConfigFile::apply()
             auto trustedList = readTrustedList();
 
             bool trusted = false;
-            if (nix::settings.acceptFlakeConfig){
+            if (nix::fetchSettings.acceptFlakeConfig){
                 trusted = true;
             } else if (auto saved = get(get(trustedList, name).value_or(std::map<std::string, bool>()), valueS)) {
                 trusted = *saved;
diff --git a/src/libexpr/flake/flake.cc b/src/libexpr/flake/flake.cc
index ad0881641..6a1aca40d 100644
--- a/src/libexpr/flake/flake.cc
+++ b/src/libexpr/flake/flake.cc
@@ -6,6 +6,7 @@
 #include "store-api.hh"
 #include "fetchers.hh"
 #include "finally.hh"
+#include "fetch-settings.hh"
 
 namespace nix {
 
@@ -315,7 +316,7 @@ LockedFlake lockFlake(
 
     FlakeCache flakeCache;
 
-    auto useRegistries = lockFlags.useRegistries.value_or(settings.useRegistries);
+    auto useRegistries = lockFlags.useRegistries.value_or(fetchSettings.useRegistries);
 
     auto flake = getFlake(state, topRef, useRegistries, flakeCache);
 
@@ -591,7 +592,7 @@ LockedFlake lockFlake(
             if (lockFlags.writeLockFile) {
                 if (auto sourcePath = topRef.input.getSourcePath()) {
                     if (!newLockFile.isImmutable()) {
-                        if (settings.warnDirty)
+                        if (fetchSettings.warnDirty)
                             warn("will not write lock file of flake '%s' because it has a mutable input", topRef);
                     } else {
                         if (!lockFlags.updateLockFile)
@@ -618,7 +619,7 @@ LockedFlake lockFlake(
                         if (lockFlags.commitLockFile) {
                             std::string cm;
 
-                            cm = settings.commitLockFileSummary.get();
+                            cm = fetchSettings.commitLockFileSummary.get();
 
                             if (cm == "") {
                                 cm = fmt("%s: %s", relPath, lockFileExists ? "Update" : "Add");
@@ -716,7 +717,7 @@ static void prim_getFlake(EvalState & state, const Pos & pos, Value * * args, Va
         lockFlake(state, flakeRef,
             LockFlags {
                 .updateLockFile = false,
-                .useRegistries = !evalSettings.pureEval && settings.useRegistries,
+                .useRegistries = !evalSettings.pureEval && fetchSettings.useRegistries,
                 .allowMutable  = !evalSettings.pureEval,
             }),
         v);
diff --git a/src/libfetchers/fetch-settings.cc b/src/libfetchers/fetch-settings.cc
new file mode 100644
index 000000000..e7d5244dc
--- /dev/null
+++ b/src/libfetchers/fetch-settings.cc
@@ -0,0 +1,13 @@
+#include "fetch-settings.hh"
+
+namespace nix {
+
+FetchSettings::FetchSettings()
+{
+}
+
+FetchSettings fetchSettings;
+
+static GlobalConfig::Register rFetchSettings(&fetchSettings);
+
+}
diff --git a/src/libfetchers/fetch-settings.hh b/src/libfetchers/fetch-settings.hh
new file mode 100644
index 000000000..58a2aded3
--- /dev/null
+++ b/src/libfetchers/fetch-settings.hh
@@ -0,0 +1,93 @@
+#pragma once
+
+#include "types.hh"
+#include "config.hh"
+#include "util.hh"
+
+#include <map>
+#include <limits>
+
+#include <sys/types.h>
+
+namespace nix {
+
+struct FetchSettings : public Config
+{
+    FetchSettings();
+
+    Setting<StringMap> accessTokens{this, {}, "access-tokens",
+        R"(
+          Access tokens used to access protected GitHub, GitLab, or
+          other locations requiring token-based authentication.
+
+          Access tokens are specified as a string made up of
+          space-separated `host=token` values.  The specific token
+          used is selected by matching the `host` portion against the
+          "host" specification of the input. The actual use of the
+          `token` value is determined by the type of resource being
+          accessed:
+
+          * Github: the token value is the OAUTH-TOKEN string obtained
+            as the Personal Access Token from the Github server (see
+            https://docs.github.com/en/developers/apps/authorizing-oath-apps).
+
+          * Gitlab: the token value is either the OAuth2 token or the
+            Personal Access Token (these are different types tokens
+            for gitlab, see
+            https://docs.gitlab.com/12.10/ee/api/README.html#authentication).
+            The `token` value should be `type:tokenstring` where
+            `type` is either `OAuth2` or `PAT` to indicate which type
+            of token is being specified.
+
+          Example `~/.config/nix/nix.conf`:
+
+          ```
+          access-tokens = github.com=23ac...b289 gitlab.mycompany.com=PAT:A123Bp_Cd..EfG gitlab.com=OAuth2:1jklw3jk
+          ```
+
+          Example `~/code/flake.nix`:
+
+          ```nix
+          input.foo = {
+            type = "gitlab";
+            host = "gitlab.mycompany.com";
+            owner = "mycompany";
+            repo = "pro";
+          };
+          ```
+
+          This example specifies three tokens, one each for accessing
+          github.com, gitlab.mycompany.com, and sourceforge.net.
+
+          The `input.foo` uses the "gitlab" fetcher, which might
+          requires specifying the token type along with the token
+          value.
+          )"};
+
+    Setting<bool> allowDirty{this, true, "allow-dirty",
+        "Whether to allow dirty Git/Mercurial trees."};
+
+    Setting<bool> warnDirty{this, true, "warn-dirty",
+        "Whether to warn about dirty Git/Mercurial trees."};
+
+    Setting<std::string> flakeRegistry{this, "https://github.com/NixOS/flake-registry/raw/master/flake-registry.json", "flake-registry",
+        "Path or URI of the global flake registry."};
+
+    Setting<bool> useRegistries{this, true, "use-registries",
+        "Whether to use flake registries to resolve flake references."};
+
+    Setting<bool> acceptFlakeConfig{this, false, "accept-flake-config",
+        "Whether to accept nix configuration from a flake without prompting."};
+
+    Setting<std::string> commitLockFileSummary{
+        this, "", "commit-lockfile-summary",
+        R"(
+          The commit summary to use when committing changed flake lock files. If
+          empty, the summary is generated based on the action performed.
+        )"};
+};
+
+// FIXME: don't use a global variable.
+extern FetchSettings fetchSettings;
+
+}
diff --git a/src/libfetchers/git.cc b/src/libfetchers/git.cc
index 7f65c1533..c0beca2f2 100644
--- a/src/libfetchers/git.cc
+++ b/src/libfetchers/git.cc
@@ -6,6 +6,8 @@
 #include "url-parts.hh"
 #include "pathlocks.hh"
 
+#include "fetch-settings.hh"
+
 #include <sys/time.h>
 #include <sys/wait.h>
 
@@ -246,10 +248,10 @@ struct GitInputScheme : InputScheme
 
                 /* This is an unclean working tree. So copy all tracked files. */
 
-                if (!settings.allowDirty)
+                if (!fetchSettings.allowDirty)
                     throw Error("Git tree '%s' is dirty", actualUrl);
 
-                if (settings.warnDirty)
+                if (fetchSettings.warnDirty)
                     warn("Git tree '%s' is dirty", actualUrl);
 
                 auto gitOpts = Strings({ "-C", actualUrl, "ls-files", "-z" });
diff --git a/src/libfetchers/github.cc b/src/libfetchers/github.cc
index 70622bf79..a1430f087 100644
--- a/src/libfetchers/github.cc
+++ b/src/libfetchers/github.cc
@@ -1,11 +1,13 @@
 #include "filetransfer.hh"
 #include "cache.hh"
-#include "fetchers.hh"
 #include "globals.hh"
 #include "store-api.hh"
 #include "types.hh"
 #include "url-parts.hh"
 
+#include "fetchers.hh"
+#include "fetch-settings.hh"
+
 #include <optional>
 #include <nlohmann/json.hpp>
 #include <fstream>
@@ -157,7 +159,7 @@ struct GitArchiveInputScheme : InputScheme
 
     std::optional<std::string> getAccessToken(const std::string & host) const
     {
-        auto tokens = settings.accessTokens.get();
+        auto tokens = fetchSettings.accessTokens.get();
         if (auto token = get(tokens, host))
             return *token;
         return {};
diff --git a/src/libfetchers/mercurial.cc b/src/libfetchers/mercurial.cc
index 12cdecbc1..8b82e9daa 100644
--- a/src/libfetchers/mercurial.cc
+++ b/src/libfetchers/mercurial.cc
@@ -5,6 +5,8 @@
 #include "store-api.hh"
 #include "url-parts.hh"
 
+#include "fetch-settings.hh"
+
 #include <sys/time.h>
 
 using namespace std::string_literals;
@@ -165,10 +167,10 @@ struct MercurialInputScheme : InputScheme
                 /* This is an unclean working tree. So copy all tracked
                    files. */
 
-                if (!settings.allowDirty)
+                if (!fetchSettings.allowDirty)
                     throw Error("Mercurial tree '%s' is unclean", actualUrl);
 
-                if (settings.warnDirty)
+                if (fetchSettings.warnDirty)
                     warn("Mercurial tree '%s' is unclean", actualUrl);
 
                 input.attrs.insert_or_assign("ref", chomp(runHg({ "branch", "-R", actualUrl })));
diff --git a/src/libfetchers/registry.cc b/src/libfetchers/registry.cc
index f35359d4b..acd1ff866 100644
--- a/src/libfetchers/registry.cc
+++ b/src/libfetchers/registry.cc
@@ -5,6 +5,8 @@
 #include "store-api.hh"
 #include "local-fs-store.hh"
 
+#include "fetch-settings.hh"
+
 #include <nlohmann/json.hpp>
 
 namespace nix::fetchers {
@@ -150,7 +152,7 @@ void overrideRegistry(
 static std::shared_ptr<Registry> getGlobalRegistry(ref<Store> store)
 {
     static auto reg = [&]() {
-        auto path = settings.flakeRegistry.get();
+        auto path = fetchSettings.flakeRegistry.get();
 
         if (!hasPrefix(path, "/")) {
             auto storePath = downloadFile(store, path, "flake-registry.json", false).storePath;
diff --git a/src/libstore/globals.hh b/src/libstore/globals.hh
index b31a2e8dc..feb6899cd 100644
--- a/src/libstore/globals.hh
+++ b/src/libstore/globals.hh
@@ -880,55 +880,6 @@ public:
           are loaded as plugins (non-recursively).
         )"};
 
-    Setting<StringMap> accessTokens{this, {}, "access-tokens",
-        R"(
-          Access tokens used to access protected GitHub, GitLab, or
-          other locations requiring token-based authentication.
-
-          Access tokens are specified as a string made up of
-          space-separated `host=token` values.  The specific token
-          used is selected by matching the `host` portion against the
-          "host" specification of the input. The actual use of the
-          `token` value is determined by the type of resource being
-          accessed:
-
-          * Github: the token value is the OAUTH-TOKEN string obtained
-            as the Personal Access Token from the Github server (see
-            https://docs.github.com/en/developers/apps/authorizing-oath-apps).
-
-          * Gitlab: the token value is either the OAuth2 token or the
-            Personal Access Token (these are different types tokens
-            for gitlab, see
-            https://docs.gitlab.com/12.10/ee/api/README.html#authentication).
-            The `token` value should be `type:tokenstring` where
-            `type` is either `OAuth2` or `PAT` to indicate which type
-            of token is being specified.
-
-          Example `~/.config/nix/nix.conf`:
-
-          ```
-          access-tokens = github.com=23ac...b289 gitlab.mycompany.com=PAT:A123Bp_Cd..EfG gitlab.com=OAuth2:1jklw3jk
-          ```
-
-          Example `~/code/flake.nix`:
-
-          ```nix
-          input.foo = {
-            type = "gitlab";
-            host = "gitlab.mycompany.com";
-            owner = "mycompany";
-            repo = "pro";
-          };
-          ```
-
-          This example specifies three tokens, one each for accessing
-          github.com, gitlab.mycompany.com, and sourceforge.net.
-
-          The `input.foo` uses the "gitlab" fetcher, which might
-          requires specifying the token type along with the token
-          value.
-          )"};
-
     Setting<std::set<ExperimentalFeature>> experimentalFeatures{this, {}, "experimental-features",
         "Experimental Nix features to enable."};
 
@@ -936,18 +887,9 @@ public:
 
     void requireExperimentalFeature(const ExperimentalFeature &);
 
-    Setting<bool> allowDirty{this, true, "allow-dirty",
-        "Whether to allow dirty Git/Mercurial trees."};
-
-    Setting<bool> warnDirty{this, true, "warn-dirty",
-        "Whether to warn about dirty Git/Mercurial trees."};
-
     Setting<size_t> narBufferSize{this, 32 * 1024 * 1024, "nar-buffer-size",
         "Maximum size of NARs before spilling them to disk."};
 
-    Setting<std::string> flakeRegistry{this, "https://github.com/NixOS/flake-registry/raw/master/flake-registry.json", "flake-registry",
-        "Path or URI of the global flake registry."};
-
     Setting<bool> allowSymlinkedStore{
         this, false, "allow-symlinked-store",
         R"(
@@ -960,19 +902,6 @@ public:
           resolves to a different location from that of the build machine. You
           can enable this setting if you are sure you're not going to do that.
         )"};
-
-    Setting<bool> useRegistries{this, true, "use-registries",
-        "Whether to use flake registries to resolve flake references."};
-
-    Setting<bool> acceptFlakeConfig{this, false, "accept-flake-config",
-        "Whether to accept nix configuration from a flake without prompting."};
-
-    Setting<std::string> commitLockFileSummary{
-        this, "", "commit-lockfile-summary",
-        R"(
-          The commit summary to use when committing changed flake lock files. If
-          empty, the summary is generated based on the action performed.
-        )"};
 };
 
 

From d974d2ad59d1cc8aee63e2a18124e58c1084ff65 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 1 Mar 2022 11:29:19 +0100
Subject: [PATCH 080/251] fetch{url,Tarball}: Remove 'narHash' attribute

This was introduced in #6174. However fetch{url,Tarball} are legacy
and we shouldn't have an undocumented attribute that does the same
thing as one that already exists ('sha256').
---
 src/libexpr/eval.cc              | 2 +-
 src/libexpr/eval.hh              | 2 +-
 src/libexpr/primops/fetchTree.cc | 2 --
 3 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index d94afbb99..8c5888497 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -517,7 +517,7 @@ void EvalState::allowPath(const StorePath & storePath)
         allowedPaths->insert(store->toRealPath(storePath));
 }
 
-void EvalState::allowAndSetStorePathString(const StorePath &storePath, Value &v)
+void EvalState::allowAndSetStorePathString(const StorePath &storePath, Value & v)
 {
     allowPath(storePath);
 
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index 9324961f7..36a53729a 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -162,7 +162,7 @@ public:
     void allowPath(const StorePath & storePath);
 
     /* Allow access to a store path and return it as a string. */
-    void allowAndSetStorePathString(const StorePath & storePath, Value &v);
+    void allowAndSetStorePathString(const StorePath & storePath, Value & v);
 
     /* Check whether access to a path is allowed and throw an error if
        not. Otherwise return the canonicalised path. */
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index 2eeee7173..cb929b99a 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -203,8 +203,6 @@ static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
                 url = state.forceStringNoCtx(*attr.value, *attr.pos);
             else if (n == "sha256")
                 expectedHash = newHashAllowEmpty(state.forceStringNoCtx(*attr.value, *attr.pos), htSHA256);
-            else if (n == "narHash")
-                expectedHash = newHashAllowEmpty(state.forceStringNoCtx(*attr.value, *attr.pos), htSHA256);
             else if (n == "name")
                 name = state.forceStringNoCtx(*attr.value, *attr.pos);
             else

From b6deca7c0dcf6e5f0da1d186dc1a1288325e1d88 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 1 Mar 2022 12:11:10 +0100
Subject: [PATCH 081/251] fetchTree: Use isValidPath, add comment

---
 src/libexpr/primops/fetchTree.cc | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index 2eeee7173..892c59fba 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -239,13 +239,14 @@ static void fetch(EvalState & state, const Pos & pos, Value * * args, Value & v,
             ? state.store->makeFixedOutputPath(FileIngestionMethod::Recursive, *expectedHash, name, {})
             : state.store->makeFixedOutputPath(FileIngestionMethod::Flat, *expectedHash, name, {});
 
-        auto validPaths = state.store->queryValidPaths({expectedPath}, NoSubstitute);
-        if (!validPaths.empty()) {
+        if (state.store->isValidPath(expectedPath)) {
             state.allowAndSetStorePathString(expectedPath, v);
             return;
         }
     }
 
+    // TODO: fetching may fail, yet the path may be substitutable.
+    //       https://github.com/NixOS/nix/issues/4313
     auto storePath =
         unpack
         ? fetchers::downloadTarball(state.store, *url, name, (bool) expectedHash).first.storePath

From c511134a94d1ff85251da155b6773574bcff53fe Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Tue, 1 Mar 2022 14:59:12 +0100
Subject: [PATCH 082/251] Acknowledge that the macOS tests are flaky

Restart the tests (at most once) on `unexpected EOF` errors.

This is truly ugly, but might prevent half of the CI runs to fail
because of https://github.com/NixOS/nix/issues/3605
---
 mk/run_test.sh | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/mk/run_test.sh b/mk/run_test.sh
index 3783d3bf7..b876859f8 100755
--- a/mk/run_test.sh
+++ b/mk/run_test.sh
@@ -14,9 +14,27 @@ if [ -t 1 ]; then
     yellow=""
     normal=""
 fi
-(cd tests && env ${TESTS_ENVIRONMENT} init.sh 2>/dev/null > /dev/null)
-log="$(cd $(dirname $1) && env ${TESTS_ENVIRONMENT} $(basename $1) 2>&1)"
-status=$?
+
+run_test () {
+    (cd tests && env ${TESTS_ENVIRONMENT} init.sh 2>/dev/null > /dev/null)
+    log="$(cd $(dirname $1) && env ${TESTS_ENVIRONMENT} $(basename $1) 2>&1)"
+    status=$?
+}
+
+run_test "$1"
+
+# Hack: Retry the test if it fails with “unexpected EOF reading a line” as these
+# appear randomly without anyone knowing why.
+# See https://github.com/NixOS/nix/issues/3605 for more info
+if [[ $status -ne 0 && $status -ne 99 && \
+    "$(uname)" == "Darwin" && \
+    "$log" =~ "unexpected EOF reading a line"
+]]; then
+    echo "$post_run_msg [${yellow}FAIL$normal] (possibly flaky, so will be retried)"
+    echo "$log" | sed 's/^/    /'
+    run_test "$1"
+fi
+
 if [ $status -eq 0 ]; then
   echo "$post_run_msg [${green}PASS$normal]"
 elif [ $status -eq 99 ]; then

From f4d57aa4907515802301dc6e540abc08809d311c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B8rn=20Forsman?= <bjorn.forsman@gmail.com>
Date: Thu, 10 Dec 2020 12:16:22 +0100
Subject: [PATCH 083/251] installer: allow overriding nix user GID and UIDs

Needed to resolve conflict in case the default GID and UIDs are in use.
---
 scripts/install-multi-user.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/install-multi-user.sh b/scripts/install-multi-user.sh
index d3ed53d09..5f2c93b7f 100644
--- a/scripts/install-multi-user.sh
+++ b/scripts/install-multi-user.sh
@@ -23,10 +23,10 @@ readonly RED='\033[31m'
 # installer allows overriding build user count to speed up installation
 # as creating each user takes non-trivial amount of time on macos
 readonly NIX_USER_COUNT=${NIX_USER_COUNT:-32}
-readonly NIX_BUILD_GROUP_ID="30000"
+readonly NIX_BUILD_GROUP_ID="${NIX_BUILD_GROUP_ID:-30000}"
 readonly NIX_BUILD_GROUP_NAME="nixbld"
 # darwin installer needs to override these
-NIX_FIRST_BUILD_UID="30001"
+NIX_FIRST_BUILD_UID="${NIX_FIRST_BUILD_UID:-30001}"
 NIX_BUILD_USER_NAME_TEMPLATE="nixbld%d"
 # Please don't change this. We don't support it, because the
 # default shell profile that comes with Nix doesn't support it.

From e862833ec662c1bffbe31b9a229147de391e801a Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 1 Mar 2022 19:43:07 +0000
Subject: [PATCH 084/251] Move `BuildResult` defintion to its own header

Just like we did for `ValidPathInfo` in
d92d4f85a5c8a2a2385c084500a8b6bd54b54e6c.
---
 src/build-remote/build-remote.cc      |  1 +
 src/libstore/build-result.hh          | 77 +++++++++++++++++++++++++++
 src/libstore/build/derivation-goal.hh |  1 +
 src/libstore/daemon.cc                |  1 +
 src/libstore/legacy-ssh-store.cc      |  1 +
 src/libstore/remote-store.cc          |  1 +
 src/libstore/store-api.hh             | 66 +----------------------
 src/nix-store/nix-store.cc            |  1 +
 8 files changed, 84 insertions(+), 65 deletions(-)
 create mode 100644 src/libstore/build-result.hh

diff --git a/src/build-remote/build-remote.cc b/src/build-remote/build-remote.cc
index 9d2eacb54..8c9133c17 100644
--- a/src/build-remote/build-remote.cc
+++ b/src/build-remote/build-remote.cc
@@ -14,6 +14,7 @@
 #include "pathlocks.hh"
 #include "globals.hh"
 #include "serialise.hh"
+#include "build-result.hh"
 #include "store-api.hh"
 #include "derivations.hh"
 #include "local-store.hh"
diff --git a/src/libstore/build-result.hh b/src/libstore/build-result.hh
new file mode 100644
index 000000000..018ba31b3
--- /dev/null
+++ b/src/libstore/build-result.hh
@@ -0,0 +1,77 @@
+#pragma once
+
+#include "realisation.hh"
+
+#include <string>
+#include <chrono>
+
+
+namespace nix {
+
+struct BuildResult
+{
+    /* Note: don't remove status codes, and only add new status codes
+       at the end of the list, to prevent client/server
+       incompatibilities in the nix-store --serve protocol. */
+    enum Status {
+        Built = 0,
+        Substituted,
+        AlreadyValid,
+        PermanentFailure,
+        InputRejected,
+        OutputRejected,
+        TransientFailure, // possibly transient
+        CachedFailure, // no longer used
+        TimedOut,
+        MiscFailure,
+        DependencyFailed,
+        LogLimitExceeded,
+        NotDeterministic,
+        ResolvesToAlreadyValid,
+    } status = MiscFailure;
+    std::string errorMsg;
+
+    std::string toString() const {
+        auto strStatus = [&]() {
+            switch (status) {
+                case Built: return "Built";
+                case Substituted: return "Substituted";
+                case AlreadyValid: return "AlreadyValid";
+                case PermanentFailure: return "PermanentFailure";
+                case InputRejected: return "InputRejected";
+                case OutputRejected: return "OutputRejected";
+                case TransientFailure: return "TransientFailure";
+                case CachedFailure: return "CachedFailure";
+                case TimedOut: return "TimedOut";
+                case MiscFailure: return "MiscFailure";
+                case DependencyFailed: return "DependencyFailed";
+                case LogLimitExceeded: return "LogLimitExceeded";
+                case NotDeterministic: return "NotDeterministic";
+                case ResolvesToAlreadyValid: return "ResolvesToAlreadyValid";
+                default: return "Unknown";
+            };
+        }();
+        return strStatus + ((errorMsg == "") ? "" : " : " + errorMsg);
+    }
+
+    /* How many times this build was performed. */
+    unsigned int timesBuilt = 0;
+
+    /* If timesBuilt > 1, whether some builds did not produce the same
+       result. (Note that 'isNonDeterministic = false' does not mean
+       the build is deterministic, just that we don't have evidence of
+       non-determinism.) */
+    bool isNonDeterministic = false;
+
+    DrvOutputs builtOutputs;
+
+    /* The start/stop times of the build (or one of the rounds, if it
+       was repeated). */
+    time_t startTime = 0, stopTime = 0;
+
+    bool success() {
+        return status == Built || status == Substituted || status == AlreadyValid || status == ResolvesToAlreadyValid;
+    }
+};
+
+}
diff --git a/src/libstore/build/derivation-goal.hh b/src/libstore/build/derivation-goal.hh
index d947482ef..6f158bdbf 100644
--- a/src/libstore/build/derivation-goal.hh
+++ b/src/libstore/build/derivation-goal.hh
@@ -2,6 +2,7 @@
 
 #include "parsed-derivations.hh"
 #include "lock.hh"
+#include "build-result.hh"
 #include "store-api.hh"
 #include "pathlocks.hh"
 #include "goal.hh"
diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index 2ba03f0dd..9d4f6b4a4 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -1,6 +1,7 @@
 #include "daemon.hh"
 #include "monitor-fd.hh"
 #include "worker-protocol.hh"
+#include "build-result.hh"
 #include "store-api.hh"
 #include "path-with-outputs.hh"
 #include "finally.hh"
diff --git a/src/libstore/legacy-ssh-store.cc b/src/libstore/legacy-ssh-store.cc
index 6b3daae7f..16c2b90c6 100644
--- a/src/libstore/legacy-ssh-store.cc
+++ b/src/libstore/legacy-ssh-store.cc
@@ -2,6 +2,7 @@
 #include "pool.hh"
 #include "remote-store.hh"
 #include "serve-protocol.hh"
+#include "build-result.hh"
 #include "store-api.hh"
 #include "path-with-outputs.hh"
 #include "worker-protocol.hh"
diff --git a/src/libstore/remote-store.cc b/src/libstore/remote-store.cc
index e7ffa6595..cbcb75c00 100644
--- a/src/libstore/remote-store.cc
+++ b/src/libstore/remote-store.cc
@@ -2,6 +2,7 @@
 #include "util.hh"
 #include "path-with-outputs.hh"
 #include "remote-fs-accessor.hh"
+#include "build-result.hh"
 #include "remote-store.hh"
 #include "worker-protocol.hh"
 #include "archive.hh"
diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
index e4fb1f1fd..8c57596d0 100644
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@@ -131,72 +131,8 @@ struct GCResults
 
 enum BuildMode { bmNormal, bmRepair, bmCheck };
 
+struct BuildResult;
 
-struct BuildResult
-{
-    /* Note: don't remove status codes, and only add new status codes
-       at the end of the list, to prevent client/server
-       incompatibilities in the nix-store --serve protocol. */
-    enum Status {
-        Built = 0,
-        Substituted,
-        AlreadyValid,
-        PermanentFailure,
-        InputRejected,
-        OutputRejected,
-        TransientFailure, // possibly transient
-        CachedFailure, // no longer used
-        TimedOut,
-        MiscFailure,
-        DependencyFailed,
-        LogLimitExceeded,
-        NotDeterministic,
-        ResolvesToAlreadyValid,
-    } status = MiscFailure;
-    std::string errorMsg;
-
-    std::string toString() const {
-        auto strStatus = [&]() {
-            switch (status) {
-                case Built: return "Built";
-                case Substituted: return "Substituted";
-                case AlreadyValid: return "AlreadyValid";
-                case PermanentFailure: return "PermanentFailure";
-                case InputRejected: return "InputRejected";
-                case OutputRejected: return "OutputRejected";
-                case TransientFailure: return "TransientFailure";
-                case CachedFailure: return "CachedFailure";
-                case TimedOut: return "TimedOut";
-                case MiscFailure: return "MiscFailure";
-                case DependencyFailed: return "DependencyFailed";
-                case LogLimitExceeded: return "LogLimitExceeded";
-                case NotDeterministic: return "NotDeterministic";
-                case ResolvesToAlreadyValid: return "ResolvesToAlreadyValid";
-                default: return "Unknown";
-            };
-        }();
-        return strStatus + ((errorMsg == "") ? "" : " : " + errorMsg);
-    }
-
-    /* How many times this build was performed. */
-    unsigned int timesBuilt = 0;
-
-    /* If timesBuilt > 1, whether some builds did not produce the same
-       result. (Note that 'isNonDeterministic = false' does not mean
-       the build is deterministic, just that we don't have evidence of
-       non-determinism.) */
-    bool isNonDeterministic = false;
-
-    DrvOutputs builtOutputs;
-
-    /* The start/stop times of the build (or one of the rounds, if it
-       was repeated). */
-    time_t startTime = 0, stopTime = 0;
-
-    bool success() {
-        return status == Built || status == Substituted || status == AlreadyValid || status == ResolvesToAlreadyValid;
-    }
-};
 
 struct StoreConfig : public Config
 {
diff --git a/src/nix-store/nix-store.cc b/src/nix-store/nix-store.cc
index ecd7279e9..1ebc177f5 100644
--- a/src/nix-store/nix-store.cc
+++ b/src/nix-store/nix-store.cc
@@ -2,6 +2,7 @@
 #include "derivations.hh"
 #include "dotgraph.hh"
 #include "globals.hh"
+#include "build-result.hh"
 #include "local-store.hh"
 #include "monitor-fd.hh"
 #include "serve-protocol.hh"

From b5cd3e2d5c330b62cd1d162fd6ad841bf2a8d32b Mon Sep 17 00:00:00 2001
From: Anders Kaseorg <andersk@mit.edu>
Date: Tue, 1 Mar 2022 15:08:36 -0800
Subject: [PATCH 085/251] filterANSIEscapes: Ignore BEL character

GCC is not as good at music as it seems to think it is.  Fixes #4546.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
---
 src/libutil/util.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 88c5ae806..229bebbe6 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1412,7 +1412,7 @@ std::string filterANSIEscapes(const std::string & s, bool filterAll, unsigned in
             }
         }
 
-        else if (*i == '\r')
+        else if (*i == '\r' || *i == '\a')
             // do nothing for now
             i++;
 

From 010ffc31f8e215a348fb77d99086bf854bf32b0c Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 11:20:32 +0100
Subject: [PATCH 086/251] Remove stray debug line

---
 src/libmain/shared.cc | 2 --
 1 file changed, 2 deletions(-)

diff --git a/src/libmain/shared.cc b/src/libmain/shared.cc
index 47fc7ab2e..a0b0f4cb3 100644
--- a/src/libmain/shared.cc
+++ b/src/libmain/shared.cc
@@ -227,8 +227,6 @@ LegacyArgs::LegacyArgs(const std::string & programName,
     std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg)
     : MixCommonArgs(programName), parseArg(parseArg)
 {
-    printError("FOO %s", programName);
-    
     addFlag({
         .longName = "no-build-output",
         .shortName = 'Q',

From c10865a46e6e3083ceb2c6a450568fa2df91ec99 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 11:14:31 +0100
Subject: [PATCH 087/251] tests: Rename nix-profile.sh -> bash-profile.sh

---
 tests/{nix-profile.sh => bash-profile.sh} | 0
 tests/local.mk                            | 2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename tests/{nix-profile.sh => bash-profile.sh} (100%)

diff --git a/tests/nix-profile.sh b/tests/bash-profile.sh
similarity index 100%
rename from tests/nix-profile.sh
rename to tests/bash-profile.sh
diff --git a/tests/local.mk b/tests/local.mk
index 53a9179a3..aba5aa651 100644
--- a/tests/local.mk
+++ b/tests/local.mk
@@ -89,7 +89,7 @@ nix_tests = \
   build.sh \
   ca/nix-run.sh \
   db-migration.sh \
-  nix-profile.sh \
+  bash-profile.sh \
   pass-as-file.sh \
   describe-stores.sh \
   store-ping.sh

From b39ef074140485c528cab29064318c8fe1254f6b Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 11:46:15 +0100
Subject: [PATCH 088/251] Style

---
 src/nix/profile.cc | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index 0e8dc4380..82507db2c 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -373,15 +373,15 @@ struct CmdProfileRemove : virtual EvalCommand, MixDefaultProfile, MixProfileElem
 
         if (removedCount == 0) {
             for (auto matcher: matchers) {
-                if (const size_t* index = std::get_if<size_t>(&matcher)){
-                    warn("'%d' is not a valid index in profile", *index);
-                } else if (const Path* path = std::get_if<Path>(&matcher)){
-                    warn("'%s' does not match any paths in profile", *path);
-                } else if (const RegexPattern* regex = std::get_if<RegexPattern>(&matcher)){
-                    warn("'%s' does not match any packages in profile", regex->pattern);
+                if (const size_t * index = std::get_if<size_t>(&matcher)){
+                    warn("'%d' is not a valid index", *index);
+                } else if (const Path * path = std::get_if<Path>(&matcher)){
+                    warn("'%s' does not match any paths", *path);
+                } else if (const RegexPattern * regex = std::get_if<RegexPattern>(&matcher)){
+                    warn("'%s' does not match any packages", regex->pattern);
                 }
             }
-            warn ("Try `nix profile list` to see the current profile.");
+            warn ("Use 'nix profile list' to see the current profile.");
         }
         updateProfile(newManifest.build(store));
     }
@@ -454,12 +454,12 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
 
         if (upgradedCount == 0) {
             for (auto & matcher : matchers) {
-                if (const size_t* index = std::get_if<size_t>(&matcher)){
-                    warn("'%d' is not a valid index in profile", *index);
-                } else if (const Path* path = std::get_if<Path>(&matcher)){
-                    warn("'%s' does not match any paths in profile", *path);
-                } else if (const RegexPattern* regex = std::get_if<RegexPattern>(&matcher)){
-                    warn("'%s' does not match any packages in profile", regex->pattern);
+                if (const size_t * index = std::get_if<size_t>(&matcher)){
+                    warn("'%d' is not a valid index", *index);
+                } else if (const Path * path = std::get_if<Path>(&matcher)){
+                    warn("'%s' does not match any paths", *path);
+                } else if (const RegexPattern * regex = std::get_if<RegexPattern>(&matcher)){
+                    warn("'%s' does not match any packages", regex->pattern);
                 }
             }
             warn ("Use 'nix profile list' to see the current profile.");

From 5850fd17b4aff50ac9f6b5f8570acc5cf4f43226 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 11:46:24 +0100
Subject: [PATCH 089/251] Add basic tests for 'nix profile'

Fixes #6193.
---
 tests/local.mk       |  3 +-
 tests/nix-profile.sh | 68 ++++++++++++++++++++++++++++++++++++++++++++
 tests/user-envs.sh   |  1 -
 3 files changed, 70 insertions(+), 2 deletions(-)
 create mode 100644 tests/nix-profile.sh

diff --git a/tests/local.mk b/tests/local.mk
index aba5aa651..c3a6aa1fc 100644
--- a/tests/local.mk
+++ b/tests/local.mk
@@ -92,7 +92,8 @@ nix_tests = \
   bash-profile.sh \
   pass-as-file.sh \
   describe-stores.sh \
-  store-ping.sh
+  store-ping.sh \
+  nix-profile.sh
 
 ifeq ($(HAVE_LIBCPUID), 1)
 	nix_tests += compute-levels.sh
diff --git a/tests/nix-profile.sh b/tests/nix-profile.sh
new file mode 100644
index 000000000..f134d70a4
--- /dev/null
+++ b/tests/nix-profile.sh
@@ -0,0 +1,68 @@
+source common.sh
+
+clearStore
+clearProfiles
+
+# Make a flake.
+flake1Dir=$TEST_ROOT/flake1
+mkdir -p $flake1Dir
+
+cat > $flake1Dir/flake.nix <<EOF
+{
+  description = "Bla bla";
+
+  outputs = { self }: with import ./config.nix; rec {
+    packages.$system.default = mkDerivation {
+      name = "simple-\${builtins.readFile ./version}";
+      builder = builtins.toFile "builder.sh"
+        ''
+          mkdir -p \$out/bin
+          cat > \$out/bin/hello <<EOF
+          #! ${shell}
+          echo Hello \${builtins.readFile ./who}
+          EOF
+          chmod +x \$out/bin/hello
+        '';
+    };
+  };
+}
+EOF
+
+printf World > $flake1Dir/who
+printf 1.0 > $flake1Dir/version
+
+cp ./config.nix $flake1Dir/
+
+# Test upgrading from nix-env.
+nix-env -f ./user-envs.nix -i foo-1.0
+nix profile list | grep '0 - - .*-foo-1.0'
+nix profile install $flake1Dir -L
+[[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello World" ]]
+nix profile history
+nix profile history | grep "packages.$system.default: ∅ -> 1.0"
+nix profile diff-closures | grep 'env-manifest.nix: ε → ∅'
+
+# Test upgrading a package.
+printf NixOS > $flake1Dir/who
+printf 2.0 > $flake1Dir/version
+nix profile upgrade 1
+[[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello NixOS" ]]
+nix profile history | grep "packages.$system.default: 1.0 -> 2.0"
+
+# Test 'history', 'diff-closures'.
+nix profile diff-closures
+
+# Test rollback.
+nix profile rollback
+[[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello World" ]]
+
+# Test uninstall.
+[ -e $TEST_HOME/.nix-profile/bin/foo ]
+nix profile remove 0
+(! [ -e $TEST_HOME/.nix-profile/bin/foo ])
+nix profile history | grep 'foo: 1.0 -> ∅'
+nix profile diff-closures | grep 'Version 3 -> 4'
+
+# Test wipe-history.
+nix profile wipe-history
+[[ $(nix profile history | grep Version | wc -l) -eq 1 ]]
diff --git a/tests/user-envs.sh b/tests/user-envs.sh
index aebf6a2a2..430688de1 100644
--- a/tests/user-envs.sh
+++ b/tests/user-envs.sh
@@ -9,7 +9,6 @@ clearProfiles
 # Query installed: should be empty.
 test "$(nix-env -p $profiles/test -q '*' | wc -l)" -eq 0
 
-mkdir -p $TEST_HOME
 nix-env --switch-profile $profiles/test
 
 # Query available: should contain several.

From 54888b92ded6c242ce4914628553d8b2c9c55d10 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 13:54:08 +0100
Subject: [PATCH 090/251] Move installables-related operations

---
 src/libcmd/command.cc      |  2 +-
 src/libcmd/command.hh      | 54 ----------------------------------
 src/libcmd/installables.cc | 14 ++++-----
 src/libcmd/installables.hh | 60 ++++++++++++++++++++++++++++++++++++++
 src/nix/app.cc             |  2 +-
 src/nix/build.cc           |  2 +-
 src/nix/develop.cc         |  7 +++--
 src/nix/diff-closures.cc   |  4 +--
 src/nix/profile.cc         |  2 +-
 src/nix/run.cc             |  2 +-
 src/nix/show-derivation.cc |  2 +-
 src/nix/why-depends.cc     |  4 +--
 12 files changed, 81 insertions(+), 74 deletions(-)

diff --git a/src/libcmd/command.cc b/src/libcmd/command.cc
index 6d183dfad..dc8fa9e5a 100644
--- a/src/libcmd/command.cc
+++ b/src/libcmd/command.cc
@@ -153,7 +153,7 @@ void BuiltPathsCommand::run(ref<Store> store)
         for (auto & p : store->queryAllValidPaths())
             paths.push_back(BuiltPath::Opaque{p});
     } else {
-        paths = toBuiltPaths(getEvalStore(), store, realiseMode, operateOn, installables);
+        paths = Installable::toBuiltPaths(getEvalStore(), store, realiseMode, operateOn, installables);
         if (recursive) {
             // XXX: This only computes the store path closure, ignoring
             // intermediate realisations
diff --git a/src/libcmd/command.hh b/src/libcmd/command.hh
index bd2a0a7ee..0f6125f11 100644
--- a/src/libcmd/command.hh
+++ b/src/libcmd/command.hh
@@ -5,7 +5,6 @@
 #include "common-eval-args.hh"
 #include "path.hh"
 #include "flake/lockfile.hh"
-#include "store-api.hh"
 
 #include <optional>
 
@@ -82,14 +81,6 @@ struct MixFlakeOptions : virtual Args, EvalCommand
     { return {}; }
 };
 
-/* How to handle derivations in commands that operate on store paths. */
-enum class OperateOn {
-    /* Operate on the output path. */
-    Output,
-    /* Operate on the .drv path. */
-    Derivation
-};
-
 struct SourceExprCommand : virtual Args, MixFlakeOptions
 {
     std::optional<Path> file;
@@ -113,19 +104,6 @@ struct SourceExprCommand : virtual Args, MixFlakeOptions
     void completeInstallable(std::string_view prefix);
 };
 
-enum class Realise {
-    /* Build the derivation. Postcondition: the
-       derivation outputs exist. */
-    Outputs,
-    /* Don't build the derivation. Postcondition: the store derivation
-       exists. */
-    Derivation,
-    /* Evaluate in dry-run mode. Postcondition: nothing. */
-    // FIXME: currently unused, but could be revived if we can
-    // evaluate derivations in-memory.
-    Nothing
-};
-
 /* A command that operates on a list of "installables", which can be
    store paths, attribute paths, Nix expressions, etc. */
 struct InstallablesCommand : virtual Args, SourceExprCommand
@@ -238,38 +216,6 @@ static RegisterCommand registerCommand2(std::vector<std::string> && name)
     return RegisterCommand(std::move(name), [](){ return make_ref<T>(); });
 }
 
-BuiltPaths build(
-    ref<Store> evalStore,
-    ref<Store> store, Realise mode,
-    const std::vector<std::shared_ptr<Installable>> & installables,
-    BuildMode bMode = bmNormal);
-
-std::set<StorePath> toStorePaths(
-    ref<Store> evalStore,
-    ref<Store> store,
-    Realise mode,
-    OperateOn operateOn,
-    const std::vector<std::shared_ptr<Installable>> & installables);
-
-StorePath toStorePath(
-    ref<Store> evalStore,
-    ref<Store> store,
-    Realise mode,
-    OperateOn operateOn,
-    std::shared_ptr<Installable> installable);
-
-std::set<StorePath> toDerivations(
-    ref<Store> store,
-    const std::vector<std::shared_ptr<Installable>> & installables,
-    bool useDeriver = false);
-
-BuiltPaths toBuiltPaths(
-    ref<Store> evalStore,
-    ref<Store> store,
-    Realise mode,
-    OperateOn operateOn,
-    const std::vector<std::shared_ptr<Installable>> & installables);
-
 /* Helper function to generate args that invoke $EDITOR on
    filename:lineno. */
 Strings editorFor(const Pos & pos);
diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index c07e39628..b9afe5105 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -787,7 +787,7 @@ BuiltPaths getBuiltPaths(ref<Store> evalStore, ref<Store> store, const DerivedPa
     return res;
 }
 
-BuiltPaths build(
+BuiltPaths Installable::build(
     ref<Store> evalStore,
     ref<Store> store,
     Realise mode,
@@ -812,7 +812,7 @@ BuiltPaths build(
     return getBuiltPaths(evalStore, store, pathsToBuild);
 }
 
-BuiltPaths toBuiltPaths(
+BuiltPaths Installable::toBuiltPaths(
     ref<Store> evalStore,
     ref<Store> store,
     Realise mode,
@@ -820,19 +820,19 @@ BuiltPaths toBuiltPaths(
     const std::vector<std::shared_ptr<Installable>> & installables)
 {
     if (operateOn == OperateOn::Output)
-        return build(evalStore, store, mode, installables);
+        return Installable::build(evalStore, store, mode, installables);
     else {
         if (mode == Realise::Nothing)
             settings.readOnlyMode = true;
 
         BuiltPaths res;
-        for (auto & drvPath : toDerivations(store, installables, true))
+        for (auto & drvPath : Installable::toDerivations(store, installables, true))
             res.push_back(BuiltPath::Opaque{drvPath});
         return res;
     }
 }
 
-StorePathSet toStorePaths(
+StorePathSet Installable::toStorePaths(
     ref<Store> evalStore,
     ref<Store> store,
     Realise mode, OperateOn operateOn,
@@ -846,7 +846,7 @@ StorePathSet toStorePaths(
     return outPaths;
 }
 
-StorePath toStorePath(
+StorePath Installable::toStorePath(
     ref<Store> evalStore,
     ref<Store> store,
     Realise mode, OperateOn operateOn,
@@ -860,7 +860,7 @@ StorePath toStorePath(
     return *paths.begin();
 }
 
-StorePathSet toDerivations(
+StorePathSet Installable::toDerivations(
     ref<Store> store,
     const std::vector<std::shared_ptr<Installable>> & installables,
     bool useDeriver)
diff --git a/src/libcmd/installables.hh b/src/libcmd/installables.hh
index 3d2563e4b..f296434c5 100644
--- a/src/libcmd/installables.hh
+++ b/src/libcmd/installables.hh
@@ -5,6 +5,7 @@
 #include "path-with-outputs.hh"
 #include "derived-path.hh"
 #include "eval.hh"
+#include "store-api.hh"
 #include "flake/flake.hh"
 
 #include <optional>
@@ -29,6 +30,27 @@ struct UnresolvedApp
     App resolve(ref<Store> evalStore, ref<Store> store);
 };
 
+enum class Realise {
+    /* Build the derivation. Postcondition: the
+       derivation outputs exist. */
+    Outputs,
+    /* Don't build the derivation. Postcondition: the store derivation
+       exists. */
+    Derivation,
+    /* Evaluate in dry-run mode. Postcondition: nothing. */
+    // FIXME: currently unused, but could be revived if we can
+    // evaluate derivations in-memory.
+    Nothing
+};
+
+/* How to handle derivations in commands that operate on store paths. */
+enum class OperateOn {
+    /* Operate on the output path. */
+    Output,
+    /* Operate on the .drv path. */
+    Derivation
+};
+
 struct Installable
 {
     virtual ~Installable() { }
@@ -68,6 +90,39 @@ struct Installable
     {
         return FlakeRef::fromAttrs({{"type","indirect"}, {"id", "nixpkgs"}});
     }
+
+    static BuiltPaths build(
+        ref<Store> evalStore,
+        ref<Store> store,
+        Realise mode,
+        const std::vector<std::shared_ptr<Installable>> & installables,
+        BuildMode bMode = bmNormal);
+
+    static std::set<StorePath> toStorePaths(
+        ref<Store> evalStore,
+        ref<Store> store,
+        Realise mode,
+        OperateOn operateOn,
+        const std::vector<std::shared_ptr<Installable>> & installables);
+
+    static StorePath toStorePath(
+        ref<Store> evalStore,
+        ref<Store> store,
+        Realise mode,
+        OperateOn operateOn,
+        std::shared_ptr<Installable> installable);
+
+    static std::set<StorePath> toDerivations(
+        ref<Store> store,
+        const std::vector<std::shared_ptr<Installable>> & installables,
+        bool useDeriver = false);
+
+    static BuiltPaths toBuiltPaths(
+        ref<Store> evalStore,
+        ref<Store> store,
+        Realise mode,
+        OperateOn operateOn,
+        const std::vector<std::shared_ptr<Installable>> & installables);
 };
 
 struct InstallableValue : Installable
@@ -131,4 +186,9 @@ ref<eval_cache::EvalCache> openEvalCache(
     EvalState & state,
     std::shared_ptr<flake::LockedFlake> lockedFlake);
 
+BuiltPaths getBuiltPaths(
+    ref<Store> evalStore,
+    ref<Store> store,
+    const DerivedPaths & hopefullyBuiltPaths);
+
 }
diff --git a/src/nix/app.cc b/src/nix/app.cc
index e104cc9c1..2563180fb 100644
--- a/src/nix/app.cc
+++ b/src/nix/app.cc
@@ -114,7 +114,7 @@ App UnresolvedApp::resolve(ref<Store> evalStore, ref<Store> store)
         installableContext.push_back(
             std::make_shared<InstallableDerivedPath>(store, ctxElt.toDerivedPath()));
 
-    auto builtContext = build(evalStore, store, Realise::Outputs, installableContext);
+    auto builtContext = Installable::build(evalStore, store, Realise::Outputs, installableContext);
     res.program = resolveString(*store, unresolved.program, builtContext);
     if (!store->isInStore(res.program))
         throw Error("app program '%s' is not in the Nix store", res.program);
diff --git a/src/nix/build.cc b/src/nix/build.cc
index 6e31757a2..680db1c60 100644
--- a/src/nix/build.cc
+++ b/src/nix/build.cc
@@ -52,7 +52,7 @@ struct CmdBuild : InstallablesCommand, MixDryRun, MixJSON, MixProfile
 
     void run(ref<Store> store) override
     {
-        auto buildables = build(
+        auto buildables = Installable::build(
             getEvalStore(), store,
             dryRun ? Realise::Derivation : Realise::Outputs,
             installables, buildMode);
diff --git a/src/nix/develop.cc b/src/nix/develop.cc
index 92e31599a..8af5da9d0 100644
--- a/src/nix/develop.cc
+++ b/src/nix/develop.cc
@@ -307,7 +307,7 @@ struct Common : InstallableCommand, MixProfile
         for (auto & [installable_, dir_] : redirects) {
             auto dir = absPath(dir_);
             auto installable = parseInstallable(store, installable_);
-            auto builtPaths = toStorePaths(
+            auto builtPaths = Installable::toStorePaths(
                 getEvalStore(), store, Realise::Nothing, OperateOn::Output, {installable});
             for (auto & path: builtPaths) {
                 auto from = store->printStorePath(path);
@@ -347,7 +347,7 @@ struct Common : InstallableCommand, MixProfile
         if (path && hasSuffix(path->to_string(), "-env"))
             return *path;
         else {
-            auto drvs = toDerivations(store, {installable});
+            auto drvs = Installable::toDerivations(store, {installable});
 
             if (drvs.size() != 1)
                 throw Error("'%s' needs to evaluate to a single derivation, but it evaluated to %d derivations",
@@ -511,7 +511,8 @@ struct CmdDevelop : Common, MixEnvironment
                 nixpkgsLockFlags);
 
             shell = store->printStorePath(
-                toStorePath(getEvalStore(), store, Realise::Outputs, OperateOn::Output, bashInstallable)) + "/bin/bash";
+                Installable::toStorePath(getEvalStore(), store, Realise::Outputs, OperateOn::Output, bashInstallable))
+                + "/bin/bash";
         } catch (Error &) {
             ignoreException();
         }
diff --git a/src/nix/diff-closures.cc b/src/nix/diff-closures.cc
index 734c41e0e..0621d662c 100644
--- a/src/nix/diff-closures.cc
+++ b/src/nix/diff-closures.cc
@@ -131,9 +131,9 @@ struct CmdDiffClosures : SourceExprCommand
     void run(ref<Store> store) override
     {
         auto before = parseInstallable(store, _before);
-        auto beforePath = toStorePath(getEvalStore(), store, Realise::Outputs, operateOn, before);
+        auto beforePath = Installable::toStorePath(getEvalStore(), store, Realise::Outputs, operateOn, before);
         auto after = parseInstallable(store, _after);
-        auto afterPath = toStorePath(getEvalStore(), store, Realise::Outputs, operateOn, after);
+        auto afterPath = Installable::toStorePath(getEvalStore(), store, Realise::Outputs, operateOn, after);
         printClosureDiff(store, beforePath, afterPath, "");
     }
 };
diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index 82507db2c..c1bf62357 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -252,7 +252,7 @@ struct CmdProfileInstall : InstallablesCommand, MixDefaultProfile
 
                 manifest.elements.emplace_back(std::move(element));
             } else {
-                auto buildables = build(getEvalStore(), store, Realise::Outputs, {installable}, bmNormal);
+                auto buildables = Installable::build(getEvalStore(), store, Realise::Outputs, {installable}, bmNormal);
 
                 for (auto & buildable : buildables) {
                     ProfileElement element;
diff --git a/src/nix/run.cc b/src/nix/run.cc
index a67c23bcb..033263c36 100644
--- a/src/nix/run.cc
+++ b/src/nix/run.cc
@@ -91,7 +91,7 @@ struct CmdShell : InstallablesCommand, MixEnvironment
 
     void run(ref<Store> store) override
     {
-        auto outPaths = toStorePaths(getEvalStore(), store, Realise::Outputs, OperateOn::Output, installables);
+        auto outPaths = Installable::toStorePaths(getEvalStore(), store, Realise::Outputs, OperateOn::Output, installables);
 
         auto accessor = store->getFSAccessor();
 
diff --git a/src/nix/show-derivation.cc b/src/nix/show-derivation.cc
index c614be68d..61a02c9b3 100644
--- a/src/nix/show-derivation.cc
+++ b/src/nix/show-derivation.cc
@@ -40,7 +40,7 @@ struct CmdShowDerivation : InstallablesCommand
 
     void run(ref<Store> store) override
     {
-        auto drvPaths = toDerivations(store, installables, true);
+        auto drvPaths = Installable::toDerivations(store, installables, true);
 
         if (recursive) {
             StorePathSet closure;
diff --git a/src/nix/why-depends.cc b/src/nix/why-depends.cc
index f7a3ec3a0..1d9ab28ba 100644
--- a/src/nix/why-depends.cc
+++ b/src/nix/why-depends.cc
@@ -82,9 +82,9 @@ struct CmdWhyDepends : SourceExprCommand
     void run(ref<Store> store) override
     {
         auto package = parseInstallable(store, _package);
-        auto packagePath = toStorePath(getEvalStore(), store, Realise::Outputs, operateOn, package);
+        auto packagePath = Installable::toStorePath(getEvalStore(), store, Realise::Outputs, operateOn, package);
         auto dependency = parseInstallable(store, _dependency);
-        auto dependencyPath = toStorePath(getEvalStore(), store, Realise::Derivation, operateOn, dependency);
+        auto dependencyPath = Installable::toStorePath(getEvalStore(), store, Realise::Derivation, operateOn, dependency);
         auto dependencyPathHash = dependencyPath.hashPart();
 
         StorePathSet closure;

From 161f798aa13b56c5f71120a8cb5788409d9ab815 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 20:37:46 +0100
Subject: [PATCH 091/251] nix profile: Support CA derivations

---
 src/libcmd/installables.cc |  4 +-
 src/libcmd/installables.hh |  1 -
 src/nix/profile.cc         | 95 ++++++++++++++++++--------------------
 tests/nix-profile.sh       | 19 ++++++++
 4 files changed, 66 insertions(+), 53 deletions(-)

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index b9afe5105..f18be5287 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -470,7 +470,6 @@ std::vector<InstallableValue::DerivationInfo> InstallableAttrPath::toDerivations
     for (auto & drvInfo : drvInfos) {
         res.push_back({
             state->store->parseStorePath(drvInfo.queryDrvPath()),
-            state->store->maybeParseStorePath(drvInfo.queryOutPath()),
             drvInfo.queryOutputName()
         });
     }
@@ -584,9 +583,8 @@ std::tuple<std::string, FlakeRef, InstallableValue::DerivationInfo> InstallableF
 
         auto drvPath = attr->forceDerivation();
 
-        auto drvInfo = DerivationInfo{
+        auto drvInfo = DerivationInfo {
             std::move(drvPath),
-            state->store->maybeParseStorePath(attr->getAttr(state->sOutPath)->getString()),
             attr->getAttr(state->sOutputName)->getString()
         };
 
diff --git a/src/libcmd/installables.hh b/src/libcmd/installables.hh
index f296434c5..e172b71b0 100644
--- a/src/libcmd/installables.hh
+++ b/src/libcmd/installables.hh
@@ -134,7 +134,6 @@ struct InstallableValue : Installable
     struct DerivationInfo
     {
         StorePath drvPath;
-        std::optional<StorePath> outPath;
         std::string outputName;
     };
 
diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index c1bf62357..48834d15b 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -61,6 +61,27 @@ struct ProfileElement
     {
         return std::tuple(describe(), storePaths) < std::tuple(other.describe(), other.storePaths);
     }
+
+    void updateStorePaths(ref<Store> evalStore, ref<Store> store, Installable & installable)
+    {
+        // FIXME: respect meta.outputsToInstall
+        storePaths.clear();
+        for (auto & buildable : getBuiltPaths(evalStore, store, installable.toDerivedPaths())) {
+            std::visit(overloaded {
+                [&](const BuiltPath::Opaque & bo) {
+                    storePaths.insert(bo.path);
+                },
+                [&](const BuiltPath::Built & bfd) {
+                    // TODO: Why are we querying if we know the output
+                    // names already? Is it just to figure out what the
+                    // default one is?
+                    for (auto & output : store->queryDerivationOutputMap(bfd.drvPath)) {
+                        storePaths.insert(output.second);
+                    }
+                },
+            }, buildable.raw());
+        }
+    }
 };
 
 struct ProfileManifest
@@ -232,53 +253,25 @@ struct CmdProfileInstall : InstallablesCommand, MixDefaultProfile
     {
         ProfileManifest manifest(*getEvalState(), *profile);
 
-        std::vector<DerivedPath> pathsToBuild;
+        auto builtPaths = Installable::build(getEvalStore(), store, Realise::Outputs, installables, bmNormal);
 
         for (auto & installable : installables) {
-            if (auto installable2 = std::dynamic_pointer_cast<InstallableFlake>(installable)) {
-                auto [attrPath, resolvedRef, drv] = installable2->toDerivation();
+            ProfileElement element;
 
-                ProfileElement element;
-                if (!drv.outPath)
-                    throw UnimplementedError("CA derivations are not yet supported by 'nix profile'");
-                element.storePaths = {*drv.outPath}; // FIXME
+            if (auto installable2 = std::dynamic_pointer_cast<InstallableFlake>(installable)) {
+                // FIXME: make build() return this?
+                auto [attrPath, resolvedRef, drv] = installable2->toDerivation();
                 element.source = ProfileElementSource{
                     installable2->flakeRef,
                     resolvedRef,
                     attrPath,
                 };
-
-                pathsToBuild.push_back(DerivedPath::Built{drv.drvPath, StringSet{drv.outputName}});
-
-                manifest.elements.emplace_back(std::move(element));
-            } else {
-                auto buildables = Installable::build(getEvalStore(), store, Realise::Outputs, {installable}, bmNormal);
-
-                for (auto & buildable : buildables) {
-                    ProfileElement element;
-
-                    std::visit(overloaded {
-                        [&](const BuiltPath::Opaque & bo) {
-                            pathsToBuild.push_back(bo);
-                            element.storePaths.insert(bo.path);
-                        },
-                        [&](const BuiltPath::Built & bfd) {
-                            // TODO: Why are we querying if we know the output
-                            // names already? Is it just to figure out what the
-                            // default one is?
-                            for (auto & output : store->queryDerivationOutputMap(bfd.drvPath)) {
-                                pathsToBuild.push_back(DerivedPath::Built{bfd.drvPath, {output.first}});
-                                element.storePaths.insert(output.second);
-                            }
-                        },
-                    }, buildable.raw());
-
-                    manifest.elements.emplace_back(std::move(element));
-                }
             }
-        }
 
-        store->buildPaths(pathsToBuild);
+            element.updateStorePaths(getEvalStore(), store, *installable);
+
+            manifest.elements.push_back(std::move(element));
+        }
 
         updateProfile(manifest.build(store));
     }
@@ -407,8 +400,8 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
 
         auto matchers = getMatchers(store);
 
-        // FIXME: code duplication
-        std::vector<DerivedPath> pathsToBuild;
+        std::vector<std::shared_ptr<Installable>> installables;
+        std::vector<size_t> indices;
 
         auto upgradedCount = 0;
 
@@ -423,32 +416,30 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
                 Activity act(*logger, lvlChatty, actUnknown,
                     fmt("checking '%s' for updates", element.source->attrPath));
 
-                InstallableFlake installable(
+                auto installable = std::make_shared<InstallableFlake>(
                     this,
                     getEvalState(),
                     FlakeRef(element.source->originalRef),
                     "",
-                    {element.source->attrPath},
-                    {},
+                    Strings{element.source->attrPath},
+                    Strings{},
                     lockFlags);
 
-                auto [attrPath, resolvedRef, drv] = installable.toDerivation();
+                auto [attrPath, resolvedRef, drv] = installable->toDerivation();
 
                 if (element.source->resolvedRef == resolvedRef) continue;
 
                 printInfo("upgrading '%s' from flake '%s' to '%s'",
                     element.source->attrPath, element.source->resolvedRef, resolvedRef);
 
-                if (!drv.outPath)
-                    throw UnimplementedError("CA derivations are not yet supported by 'nix profile'");
-                element.storePaths = {*drv.outPath}; // FIXME
                 element.source = ProfileElementSource{
-                    installable.flakeRef,
+                    installable->flakeRef,
                     resolvedRef,
                     attrPath,
                 };
 
-                pathsToBuild.push_back(DerivedPath::Built{drv.drvPath, {drv.outputName}});
+                installables.push_back(installable);
+                indices.push_back(i);
             }
         }
 
@@ -465,7 +456,13 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
             warn ("Use 'nix profile list' to see the current profile.");
         }
 
-        store->buildPaths(pathsToBuild);
+        auto builtPaths = Installable::build(getEvalStore(), store, Realise::Outputs, installables, bmNormal);
+
+        for (size_t i = 0; i < installables.size(); ++i) {
+            auto & installable = installables.at(i);
+            auto & element = manifest.elements[indices.at(i)];
+            element.updateStorePaths(getEvalStore(), store, *installable);
+        }
 
         updateProfile(manifest.build(store));
     }
diff --git a/tests/nix-profile.sh b/tests/nix-profile.sh
index f134d70a4..0ab69db22 100644
--- a/tests/nix-profile.sh
+++ b/tests/nix-profile.sh
@@ -22,7 +22,11 @@ cat > $flake1Dir/flake.nix <<EOF
           echo Hello \${builtins.readFile ./who}
           EOF
           chmod +x \$out/bin/hello
+          echo DONE
         '';
+      __contentAddressed = import ./ca.nix;
+      outputHashMode = "recursive";
+      outputHashAlgo = "sha256";
     };
   };
 }
@@ -30,6 +34,7 @@ EOF
 
 printf World > $flake1Dir/who
 printf 1.0 > $flake1Dir/version
+printf false > $flake1Dir/ca.nix
 
 cp ./config.nix $flake1Dir/
 
@@ -66,3 +71,17 @@ nix profile diff-closures | grep 'Version 3 -> 4'
 # Test wipe-history.
 nix profile wipe-history
 [[ $(nix profile history | grep Version | wc -l) -eq 1 ]]
+
+# Test upgrade to CA package.
+printf true > $flake1Dir/ca.nix
+printf 3.0 > $flake1Dir/version
+nix profile upgrade --extra-experimental-features ca-derivations 0
+nix profile history | grep "packages.$system.default: 1.0 -> 3.0"
+
+# Test new install of CA package.
+nix profile remove 0
+printf 4.0 > $flake1Dir/version
+printf Utrecht > $flake1Dir/who
+nix profile install --extra-experimental-features ca-derivations $flake1Dir
+[[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello Utrecht" ]]
+[[ $(nix path-info --json $(realpath $TEST_HOME/.nix-profile/bin/hello) | jq -r .[].ca) =~ fixed:r:sha256: ]]

From f9375778aedf365436de8200a97c0c292df65ea3 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 20:56:40 +0100
Subject: [PATCH 092/251] nix profile: Add a test for non-flake packages

---
 tests/nix-profile.sh | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/tests/nix-profile.sh b/tests/nix-profile.sh
index 0ab69db22..549840767 100644
--- a/tests/nix-profile.sh
+++ b/tests/nix-profile.sh
@@ -13,7 +13,7 @@ cat > $flake1Dir/flake.nix <<EOF
 
   outputs = { self }: with import ./config.nix; rec {
     packages.$system.default = mkDerivation {
-      name = "simple-\${builtins.readFile ./version}";
+      name = "profile-test-\${builtins.readFile ./version}";
       builder = builtins.toFile "builder.sh"
         ''
           mkdir -p \$out/bin
@@ -68,6 +68,13 @@ nix profile remove 0
 nix profile history | grep 'foo: 1.0 -> ∅'
 nix profile diff-closures | grep 'Version 3 -> 4'
 
+# Test installing a non-flake package.
+nix profile install --file ./simple.nix ''
+[[ $(cat $TEST_HOME/.nix-profile/hello) = "Hello World!" ]]
+nix profile remove 1
+nix profile install $(nix-build --no-out-link ./simple.nix)
+[[ $(cat $TEST_HOME/.nix-profile/hello) = "Hello World!" ]]
+
 # Test wipe-history.
 nix profile wipe-history
 [[ $(nix profile history | grep Version | wc -l) -eq 1 ]]

From 5d208cbe416ed38693cd33643731fd001135a582 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 21:36:46 +0100
Subject: [PATCH 093/251] mk/run_test.sh: Add missing backslash

---
 mk/run_test.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mk/run_test.sh b/mk/run_test.sh
index b876859f8..7e95df2ac 100755
--- a/mk/run_test.sh
+++ b/mk/run_test.sh
@@ -28,7 +28,7 @@ run_test "$1"
 # See https://github.com/NixOS/nix/issues/3605 for more info
 if [[ $status -ne 0 && $status -ne 99 && \
     "$(uname)" == "Darwin" && \
-    "$log" =~ "unexpected EOF reading a line"
+    "$log" =~ "unexpected EOF reading a line" \
 ]]; then
     echo "$post_run_msg [${yellow}FAIL$normal] (possibly flaky, so will be retried)"
     echo "$log" | sed 's/^/    /'

From d2586188fe8745c34e5a97032d045f8b74100a98 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 21:48:25 +0100
Subject: [PATCH 094/251] tests/common.sh.in: Add enableFeatures helper

---
 tests/build-remote-content-addressed-floating.sh | 2 +-
 tests/ca/build.sh                                | 2 +-
 tests/ca/common.sh                               | 2 +-
 tests/ca/duplicate-realisation-in-closure.sh     | 2 --
 tests/ca/nix-copy.sh                             | 3 ---
 tests/ca/nix-run.sh                              | 2 --
 tests/ca/nix-shell.sh                            | 2 --
 tests/ca/post-hook.sh                            | 2 --
 tests/ca/recursive.sh                            | 2 --
 tests/ca/signatures.sh                           | 3 ---
 tests/common.sh.in                               | 7 ++++++-
 tests/nix-profile.sh                             | 6 ++++--
 12 files changed, 13 insertions(+), 22 deletions(-)

diff --git a/tests/build-remote-content-addressed-floating.sh b/tests/build-remote-content-addressed-floating.sh
index 13ef47d2d..1f474dde0 100644
--- a/tests/build-remote-content-addressed-floating.sh
+++ b/tests/build-remote-content-addressed-floating.sh
@@ -2,7 +2,7 @@ source common.sh
 
 file=build-hook-ca-floating.nix
 
-sed -i 's/experimental-features .*/& ca-derivations/' "$NIX_CONF_DIR"/nix.conf
+enableFeatures "ca-derivations ca-references"
 
 CONTENT_ADDRESSED=true
 
diff --git a/tests/ca/build.sh b/tests/ca/build.sh
index c8877f87f..92f8b429a 100644
--- a/tests/ca/build.sh
+++ b/tests/ca/build.sh
@@ -37,7 +37,7 @@ testCutoffFor () {
 }
 
 testCutoff () {
-    # Don't directly build depenentCA, that way we'll make sure we dodn't rely on
+    # Don't directly build dependentCA, that way we'll make sure we don't rely on
     # dependent derivations always being already built.
     #testDerivation dependentCA
     testCutoffFor transitivelyDependentCA
diff --git a/tests/ca/common.sh b/tests/ca/common.sh
index c5aa34334..b9d415863 100644
--- a/tests/ca/common.sh
+++ b/tests/ca/common.sh
@@ -1,5 +1,5 @@
 source ../common.sh
 
-sed -i 's/experimental-features .*/& ca-derivations ca-references/' "$NIX_CONF_DIR"/nix.conf
+enableFeatures "ca-derivations ca-references"
 
 restartDaemon
diff --git a/tests/ca/duplicate-realisation-in-closure.sh b/tests/ca/duplicate-realisation-in-closure.sh
index 74c5d25fd..da9cd8fb4 100644
--- a/tests/ca/duplicate-realisation-in-closure.sh
+++ b/tests/ca/duplicate-realisation-in-closure.sh
@@ -2,8 +2,6 @@ source ./common.sh
 
 requireDaemonNewerThan "2.4pre20210625"
 
-sed -i 's/experimental-features .*/& ca-derivations ca-references/' "$NIX_CONF_DIR"/nix.conf
-
 export REMOTE_STORE_DIR="$TEST_ROOT/remote_store"
 export REMOTE_STORE="file://$REMOTE_STORE_DIR"
 
diff --git a/tests/ca/nix-copy.sh b/tests/ca/nix-copy.sh
index 2e0dea2d2..7a8307a4e 100755
--- a/tests/ca/nix-copy.sh
+++ b/tests/ca/nix-copy.sh
@@ -2,9 +2,6 @@
 
 source common.sh
 
-# Globally enable the ca derivations experimental flag
-sed -i 's/experimental-features = .*/& ca-derivations ca-references/' "$NIX_CONF_DIR/nix.conf"
-
 export REMOTE_STORE_DIR="$TEST_ROOT/remote_store"
 export REMOTE_STORE="file://$REMOTE_STORE_DIR"
 
diff --git a/tests/ca/nix-run.sh b/tests/ca/nix-run.sh
index 81402af10..5f46518e8 100755
--- a/tests/ca/nix-run.sh
+++ b/tests/ca/nix-run.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-sed -i 's/experimental-features .*/& ca-derivations ca-references nix-command flakes/' "$NIX_CONF_DIR"/nix.conf
-
 FLAKE_PATH=path:$PWD
 
 nix run --no-write-lock-file $FLAKE_PATH#runnable
diff --git a/tests/ca/nix-shell.sh b/tests/ca/nix-shell.sh
index 7f1a3a73e..1c5a6639f 100755
--- a/tests/ca/nix-shell.sh
+++ b/tests/ca/nix-shell.sh
@@ -2,8 +2,6 @@
 
 source common.sh
 
-sed -i 's/experimental-features .*/& ca-derivations ca-references nix-command flakes/' "$NIX_CONF_DIR"/nix.conf
-
 CONTENT_ADDRESSED=true
 cd ..
 source ./nix-shell.sh
diff --git a/tests/ca/post-hook.sh b/tests/ca/post-hook.sh
index 1c9d4f700..705bde9d4 100755
--- a/tests/ca/post-hook.sh
+++ b/tests/ca/post-hook.sh
@@ -4,8 +4,6 @@ source common.sh
 
 requireDaemonNewerThan "2.4pre20210626"
 
-sed -i 's/experimental-features .*/& ca-derivations ca-references nix-command flakes/' "$NIX_CONF_DIR"/nix.conf
-
 export NIX_TESTS_CA_BY_DEFAULT=1
 cd ..
 source ./post-hook.sh
diff --git a/tests/ca/recursive.sh b/tests/ca/recursive.sh
index 648bf0a91..0354d23b4 100755
--- a/tests/ca/recursive.sh
+++ b/tests/ca/recursive.sh
@@ -4,8 +4,6 @@ source common.sh
 
 requireDaemonNewerThan "2.4pre20210623"
 
-sed -i 's/experimental-features .*/& ca-derivations ca-references nix-command flakes/' "$NIX_CONF_DIR"/nix.conf
-
 export NIX_TESTS_CA_BY_DEFAULT=1
 cd ..
 source ./recursive.sh
diff --git a/tests/ca/signatures.sh b/tests/ca/signatures.sh
index 0c7d974ea..eb18a4130 100644
--- a/tests/ca/signatures.sh
+++ b/tests/ca/signatures.sh
@@ -1,8 +1,5 @@
 source common.sh
 
-# Globally enable the ca derivations experimental flag
-sed -i 's/experimental-features = .*/& ca-derivations ca-references/' "$NIX_CONF_DIR/nix.conf"
-
 clearStore
 clearCache
 
diff --git a/tests/common.sh.in b/tests/common.sh.in
index e485329ba..d12aebdad 100644
--- a/tests/common.sh.in
+++ b/tests/common.sh.in
@@ -173,10 +173,15 @@ needLocalStore() {
 }
 
 # Just to make it easy to find which tests should be fixed
-buggyNeedLocalStore () {
+buggyNeedLocalStore() {
   needLocalStore
 }
 
+enableFeatures() {
+    local features="$1"
+    sed -i 's/experimental-features .*/& '"$features"'/' "$NIX_CONF_DIR"/nix.conf
+}
+
 set -x
 
 if [[ -n "${NIX_DAEMON_PACKAGE:-}" ]]; then
diff --git a/tests/nix-profile.sh b/tests/nix-profile.sh
index 549840767..be80e089a 100644
--- a/tests/nix-profile.sh
+++ b/tests/nix-profile.sh
@@ -3,6 +3,8 @@ source common.sh
 clearStore
 clearProfiles
 
+enableFeatures "ca-derivations ca-references"
+
 # Make a flake.
 flake1Dir=$TEST_ROOT/flake1
 mkdir -p $flake1Dir
@@ -82,13 +84,13 @@ nix profile wipe-history
 # Test upgrade to CA package.
 printf true > $flake1Dir/ca.nix
 printf 3.0 > $flake1Dir/version
-nix profile upgrade --extra-experimental-features ca-derivations 0
+nix profile upgrade 0
 nix profile history | grep "packages.$system.default: 1.0 -> 3.0"
 
 # Test new install of CA package.
 nix profile remove 0
 printf 4.0 > $flake1Dir/version
 printf Utrecht > $flake1Dir/who
-nix profile install --extra-experimental-features ca-derivations $flake1Dir
+nix profile install $flake1Dir
 [[ $($TEST_HOME/.nix-profile/bin/hello) = "Hello Utrecht" ]]
 [[ $(nix path-info --json $(realpath $TEST_HOME/.nix-profile/bin/hello) | jq -r .[].ca) =~ fixed:r:sha256: ]]

From b0d65b3d11496b81ed00616ce5d8e4db1229bb8c Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 22:22:23 +0100
Subject: [PATCH 095/251] Silence kill output

---
 tests/common.sh.in | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/common.sh.in b/tests/common.sh.in
index d12aebdad..b341993f7 100644
--- a/tests/common.sh.in
+++ b/tests/common.sh.in
@@ -109,10 +109,10 @@ startDaemon() {
 killDaemon() {
     kill $pidDaemon
     for i in {0..100}; do
-        kill -0 $pidDaemon || break
+        kill -0 $pidDaemon 2> /dev/null || break
         sleep 0.1
     done
-    kill -9 $pidDaemon || true
+    kill -9 $pidDaemon 2> /dev/null || true
     wait $pidDaemon || true
     trap "" EXIT
 }

From 3a3821bcd7c71e27ad1f6861e0d37d322f721b2b Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 22:22:55 +0100
Subject: [PATCH 096/251] Remove obsolete todo

---
 tests/common.sh.in | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tests/common.sh.in b/tests/common.sh.in
index b341993f7..8ce28d318 100644
--- a/tests/common.sh.in
+++ b/tests/common.sh.in
@@ -87,8 +87,7 @@ startDaemon() {
     if [[ "$NIX_REMOTE" == daemon ]]; then
       return
     fi
-    # Start the daemon, wait for the socket to appear.  !!!
-    # ‘nix-daemon’ should have an option to fork into the background.
+    # Start the daemon, wait for the socket to appear.
     rm -f $NIX_DAEMON_SOCKET_PATH
     PATH=$DAEMON_PATH nix-daemon&
     pidDaemon=$!

From d4538034b7fba772a5f87c2efa66dbbd76760142 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 23:08:49 +0100
Subject: [PATCH 097/251] nix profile test: Restart daemon

Fixes

  nix-daemon: src/libstore/sqlite.cc:97: nix::SQLiteStmt::Use::Use(nix::SQLiteStmt&): Assertion `stmt.stmt' failed.

which happens because the daemon doesn't properly handle the case
where ca-derivations isn't enabled at daemon startup.
---
 tests/nix-profile.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/nix-profile.sh b/tests/nix-profile.sh
index be80e089a..a7a4d4fa2 100644
--- a/tests/nix-profile.sh
+++ b/tests/nix-profile.sh
@@ -4,6 +4,7 @@ clearStore
 clearProfiles
 
 enableFeatures "ca-derivations ca-references"
+restartDaemon
 
 # Make a flake.
 flake1Dir=$TEST_ROOT/flake1

From b55d79728ccbd2581fa3aa7b2ec7f498aa2285d6 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 2 Mar 2022 10:57:19 +0100
Subject: [PATCH 098/251] Add EvalState::coerceToStorePath() helper

This is useful whenever we want to evaluate something to a store path
(e.g. in get-drvs.cc).

Extracted from the lazy-trees branch (where we can require that a
store path must come from a store source tree accessor).
---
 src/libcmd/installables.cc             |  8 +--
 src/libexpr/eval.cc                    | 12 +++++
 src/libexpr/eval.hh                    |  3 ++
 src/libexpr/get-drvs.cc                | 33 +++++++-----
 src/libexpr/get-drvs.hh                | 16 +++---
 src/nix-build/nix-build.cc             | 11 ++--
 src/nix-env/nix-env.cc                 | 75 +++++++++++++-------------
 src/nix-env/user-env.cc                | 29 +++++-----
 src/nix-instantiate/nix-instantiate.cc |  9 ++--
 src/nix/bundle.cc                      |  4 +-
 src/nix/flake.cc                       |  2 +-
 src/nix/profile.cc                     |  2 +-
 src/nix/repl.cc                        | 20 +++----
 13 files changed, 123 insertions(+), 101 deletions(-)

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index f18be5287..3209456bf 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -468,10 +468,10 @@ std::vector<InstallableValue::DerivationInfo> InstallableAttrPath::toDerivations
 
     std::vector<DerivationInfo> res;
     for (auto & drvInfo : drvInfos) {
-        res.push_back({
-            state->store->parseStorePath(drvInfo.queryDrvPath()),
-            drvInfo.queryOutputName()
-        });
+        auto drvPath = drvInfo.queryDrvPath();
+        if (!drvPath)
+            throw Error("'%s' is not a derivation", what());
+        res.push_back({ *drvPath, drvInfo.queryOutputName() });
     }
 
     return res;
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 8c5888497..193358161 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -2058,6 +2058,18 @@ Path EvalState::coerceToPath(const Pos & pos, Value & v, PathSet & context)
 }
 
 
+StorePath EvalState::coerceToStorePath(const Pos & pos, Value & v, PathSet & context)
+{
+    auto path = coerceToString(pos, v, context, false, false).toOwned();
+    if (auto storePath = store->maybeParseStorePath(path))
+        return *storePath;
+    throw EvalError({
+        .msg = hintfmt("path '%1%' is not in the Nix store", path),
+        .errPos = pos
+    });
+}
+
+
 bool EvalState::eqValues(Value & v1, Value & v2)
 {
     forceValue(v1, noPos);
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index 36a53729a..800b00eef 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -272,6 +272,9 @@ public:
        path.  Nothing is copied to the store. */
     Path coerceToPath(const Pos & pos, Value & v, PathSet & context);
 
+    /* Like coerceToPath, but the result must be a store path. */
+    StorePath coerceToStorePath(const Pos & pos, Value & v, PathSet & context);
+
 public:
 
     /* The base environment, containing the builtin functions and
diff --git a/src/libexpr/get-drvs.cc b/src/libexpr/get-drvs.cc
index 8393e4225..7630c5ff4 100644
--- a/src/libexpr/get-drvs.cc
+++ b/src/libexpr/get-drvs.cc
@@ -22,7 +22,7 @@ DrvInfo::DrvInfo(EvalState & state, ref<Store> store, const std::string & drvPat
 {
     auto [drvPath, selectedOutputs] = parsePathWithOutputs(*store, drvPathWithOutputs);
 
-    this->drvPath = store->printStorePath(drvPath);
+    this->drvPath = drvPath;
 
     auto drv = store->derivationFromPath(drvPath);
 
@@ -41,9 +41,7 @@ DrvInfo::DrvInfo(EvalState & state, ref<Store> store, const std::string & drvPat
         throw Error("derivation '%s' does not have output '%s'", store->printStorePath(drvPath), outputName);
     auto & [outputName, output] = *i;
 
-    auto optStorePath = output.path(*store, drv.name, outputName);
-    if (optStorePath)
-        outPath = store->printStorePath(*optStorePath);
+    outPath = {output.path(*store, drv.name, outputName)};
 }
 
 
@@ -68,24 +66,35 @@ std::string DrvInfo::querySystem() const
 }
 
 
-std::string DrvInfo::queryDrvPath() const
+std::optional<StorePath> DrvInfo::queryDrvPath() const
 {
-    if (drvPath == "" && attrs) {
+    if (!drvPath && attrs) {
         Bindings::iterator i = attrs->find(state->sDrvPath);
         PathSet context;
-        drvPath = i != attrs->end() ? state->coerceToPath(*i->pos, *i->value, context) : "";
+        if (i == attrs->end())
+            drvPath = {std::nullopt};
+        else
+            drvPath = {state->coerceToStorePath(*i->pos, *i->value, context)};
     }
-    return drvPath;
+    return drvPath.value_or(std::nullopt);
 }
 
 
-std::string DrvInfo::queryOutPath() const
+StorePath DrvInfo::requireDrvPath() const
+{
+    if (auto drvPath = queryDrvPath())
+        return *drvPath;
+    throw Error("derivation does not contain a 'drvPath' attribute");
+}
+
+
+StorePath DrvInfo::queryOutPath() const
 {
     if (!outPath && attrs) {
         Bindings::iterator i = attrs->find(state->sOutPath);
         PathSet context;
         if (i != attrs->end())
-            outPath = state->coerceToPath(*i->pos, *i->value, context);
+            outPath = state->coerceToStorePath(*i->pos, *i->value, context);
     }
     if (!outPath)
         throw UnimplementedError("CA derivations are not yet supported");
@@ -113,10 +122,10 @@ DrvInfo::Outputs DrvInfo::queryOutputs(bool onlyOutputsToInstall)
                 Bindings::iterator outPath = out->value->attrs->find(state->sOutPath);
                 if (outPath == out->value->attrs->end()) continue; // FIXME: throw error?
                 PathSet context;
-                outputs[name] = state->coerceToPath(*outPath->pos, *outPath->value, context);
+                outputs.emplace(name, state->coerceToStorePath(*outPath->pos, *outPath->value, context));
             }
         } else
-            outputs["out"] = queryOutPath();
+            outputs.emplace("out", queryOutPath());
     }
     if (!onlyOutputsToInstall || !attrs)
         return outputs;
diff --git a/src/libexpr/get-drvs.hh b/src/libexpr/get-drvs.hh
index d13847785..3ca6f1fca 100644
--- a/src/libexpr/get-drvs.hh
+++ b/src/libexpr/get-drvs.hh
@@ -1,6 +1,7 @@
 #pragma once
 
 #include "eval.hh"
+#include "path.hh"
 
 #include <string>
 #include <map>
@@ -12,15 +13,15 @@ namespace nix {
 struct DrvInfo
 {
 public:
-    typedef std::map<std::string, Path> Outputs;
+    typedef std::map<std::string, StorePath> Outputs;
 
 private:
     EvalState * state;
 
     mutable std::string name;
     mutable std::string system;
-    mutable std::string drvPath;
-    mutable std::optional<std::string> outPath;
+    mutable std::optional<std::optional<StorePath>> drvPath;
+    mutable std::optional<StorePath> outPath;
     mutable std::string outputName;
     Outputs outputs;
 
@@ -41,8 +42,9 @@ public:
 
     std::string queryName() const;
     std::string querySystem() const;
-    std::string queryDrvPath() const;
-    std::string queryOutPath() const;
+    std::optional<StorePath> queryDrvPath() const;
+    StorePath requireDrvPath() const;
+    StorePath queryOutPath() const;
     std::string queryOutputName() const;
     /** Return the list of outputs. The "outputs to install" are determined by `meta.outputsToInstall`. */
     Outputs queryOutputs(bool onlyOutputsToInstall = false);
@@ -61,8 +63,8 @@ public:
     */
 
     void setName(const std::string & s) { name = s; }
-    void setDrvPath(const std::string & s) { drvPath = s; }
-    void setOutPath(const std::string & s) { outPath = s; }
+    void setDrvPath(StorePath path) { drvPath = {{std::move(path)}}; }
+    void setOutPath(StorePath path) { outPath = {{std::move(path)}}; }
 
     void setFailed() { failed = true; };
     bool hasFailed() { return failed; };
diff --git a/src/nix-build/nix-build.cc b/src/nix-build/nix-build.cc
index 3d189f934..795a4f7bd 100755
--- a/src/nix-build/nix-build.cc
+++ b/src/nix-build/nix-build.cc
@@ -346,7 +346,7 @@ static void main_nix_build(int argc, char * * argv)
             throw UsageError("nix-shell requires a single derivation");
 
         auto & drvInfo = drvs.front();
-        auto drv = evalStore->derivationFromPath(evalStore->parseStorePath(drvInfo.queryDrvPath()));
+        auto drv = evalStore->derivationFromPath(drvInfo.requireDrvPath());
 
         std::vector<StorePathWithOutputs> pathsToBuild;
         RealisedPath::Set pathsToCopy;
@@ -369,7 +369,7 @@ static void main_nix_build(int argc, char * * argv)
                 if (!drv)
                     throw Error("the 'bashInteractive' attribute in <nixpkgs> did not evaluate to a derivation");
 
-                auto bashDrv = store->parseStorePath(drv->queryDrvPath());
+                auto bashDrv = drv->requireDrvPath();
                 pathsToBuild.push_back({bashDrv});
                 pathsToCopy.insert(bashDrv);
                 shellDrv = bashDrv;
@@ -458,10 +458,7 @@ static void main_nix_build(int argc, char * * argv)
                 }
             }
 
-            ParsedDerivation parsedDrv(
-                StorePath(store->parseStorePath(drvInfo.queryDrvPath())),
-                drv
-            );
+            ParsedDerivation parsedDrv(drvInfo.requireDrvPath(), drv);
 
             if (auto structAttrs = parsedDrv.prepareStructuredAttrs(*store, inputs)) {
                 auto json = structAttrs.value();
@@ -553,7 +550,7 @@ static void main_nix_build(int argc, char * * argv)
         std::map<StorePath, std::pair<size_t, StringSet>> drvMap;
 
         for (auto & drvInfo : drvs) {
-            auto drvPath = store->parseStorePath(drvInfo.queryDrvPath());
+            auto drvPath = drvInfo.requireDrvPath();
 
             auto outputName = drvInfo.queryOutputName();
             if (outputName == "")
diff --git a/src/nix-env/nix-env.cc b/src/nix-env/nix-env.cc
index 12e08bbe1..24f2d2bf3 100644
--- a/src/nix-env/nix-env.cc
+++ b/src/nix-env/nix-env.cc
@@ -211,7 +211,7 @@ static long comparePriorities(EvalState & state, DrvInfo & drv1, DrvInfo & drv2)
 // at a time.
 static bool isPrebuilt(EvalState & state, DrvInfo & elem)
 {
-    auto path = state.store->parseStorePath(elem.queryOutPath());
+    auto path = elem.queryOutPath();
     if (state.store->isValidPath(path)) return true;
     return state.store->querySubstitutablePaths({path}).count(path);
 }
@@ -429,14 +429,15 @@ static void queryInstSources(EvalState & state,
                 elem.setName(name);
 
                 if (path.isDerivation()) {
-                    elem.setDrvPath(state.store->printStorePath(path));
+                    elem.setDrvPath(path);
                     auto outputs = state.store->queryDerivationOutputMap(path);
-                    elem.setOutPath(state.store->printStorePath(outputs.at("out")));
+                    elem.setOutPath(outputs.at("out"));
                     if (name.size() >= drvExtension.size() &&
                         std::string(name, name.size() - drvExtension.size()) == drvExtension)
                         name = name.substr(0, name.size() - drvExtension.size());
                 }
-                else elem.setOutPath(state.store->printStorePath(path));
+                else
+                    elem.setOutPath(path);
 
                 elems.push_back(elem);
             }
@@ -470,13 +471,11 @@ static void queryInstSources(EvalState & state,
 static void printMissing(EvalState & state, DrvInfos & elems)
 {
     std::vector<DerivedPath> targets;
-    for (auto & i : elems) {
-        Path drvPath = i.queryDrvPath();
-        if (drvPath != "")
-            targets.push_back(DerivedPath::Built{state.store->parseStorePath(drvPath)});
+    for (auto & i : elems)
+        if (auto drvPath = i.queryDrvPath())
+            targets.push_back(DerivedPath::Built{*drvPath});
         else
-            targets.push_back(DerivedPath::Opaque{state.store->parseStorePath(i.queryOutPath())});
-    }
+            targets.push_back(DerivedPath::Opaque{i.queryOutPath()});
 
     printMissing(state.store, targets);
 }
@@ -744,14 +743,11 @@ static void opSet(Globals & globals, Strings opFlags, Strings opArgs)
     if (globals.forceName != "")
         drv.setName(globals.forceName);
 
+    auto drvPath = drv.queryDrvPath();
     std::vector<DerivedPath> paths {
-        (drv.queryDrvPath() != "")
-        ? (DerivedPath) (DerivedPath::Built {
-                globals.state->store->parseStorePath(drv.queryDrvPath())
-            })
-        : (DerivedPath) (DerivedPath::Opaque {
-                globals.state->store->parseStorePath(drv.queryOutPath())
-            }),
+        drvPath
+        ? (DerivedPath) (DerivedPath::Built { *drvPath })
+        : (DerivedPath) (DerivedPath::Opaque { drv.queryOutPath() }),
     };
     printMissing(globals.state->store, paths);
     if (globals.dryRun) return;
@@ -759,8 +755,9 @@ static void opSet(Globals & globals, Strings opFlags, Strings opArgs)
 
     debug(format("switching to new user environment"));
     Path generation = createGeneration(
-        ref<LocalFSStore>(store2), globals.profile,
-        store2->parseStorePath(drv.queryOutPath()));
+        ref<LocalFSStore>(store2),
+        globals.profile,
+        drv.queryOutPath());
     switchLink(globals.profile, generation);
 }
 
@@ -780,7 +777,7 @@ static void uninstallDerivations(Globals & globals, Strings & selectors,
                 split = std::partition(
                     workingElems.begin(), workingElems.end(),
                     [&selectorStorePath, globals](auto &elem) {
-                        return selectorStorePath != globals.state->store->parseStorePath(elem.queryOutPath());
+                        return selectorStorePath != elem.queryOutPath();
                     }
                 );
             } else {
@@ -925,9 +922,8 @@ static void queryJSON(Globals & globals, std::vector<DrvInfo> & elems, bool prin
             if (printOutPath) {
                 DrvInfo::Outputs outputs = i.queryOutputs();
                 JSONObject outputObj = pkgObj.object("outputs");
-                for (auto & j : outputs) {
-                    outputObj.attr(j.first, j.second);
-                }
+                for (auto & j : outputs)
+                    outputObj.attr(j.first, globals.state->store->printStorePath(j.second));
             }
 
             if (printMeta) {
@@ -957,6 +953,8 @@ static void queryJSON(Globals & globals, std::vector<DrvInfo> & elems, bool prin
 
 static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
 {
+    auto & store(*globals.state->store);
+
     Strings remaining;
     std::string attrPath;
 
@@ -1027,12 +1025,11 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
 
     /* We only need to know the installed paths when we are querying
        the status of the derivation. */
-    PathSet installed; /* installed paths */
+    StorePathSet installed; /* installed paths */
 
-    if (printStatus) {
+    if (printStatus)
         for (auto & i : installedElems)
             installed.insert(i.queryOutPath());
-    }
 
 
     /* Query which paths have substitutes. */
@@ -1042,13 +1039,13 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
         StorePathSet paths;
         for (auto & i : elems)
             try {
-                paths.insert(globals.state->store->parseStorePath(i.queryOutPath()));
+                paths.insert(i.queryOutPath());
             } catch (AssertionError & e) {
                 printMsg(lvlTalkative, "skipping derivation named '%s' which gives an assertion failure", i.queryName());
                 i.setFailed();
             }
-        validPaths = globals.state->store->queryValidPaths(paths);
-        substitutablePaths = globals.state->store->querySubstitutablePaths(paths);
+        validPaths = store.queryValidPaths(paths);
+        substitutablePaths = store.querySubstitutablePaths(paths);
     }
 
 
@@ -1073,8 +1070,8 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
             //Activity act(*logger, lvlDebug, format("outputting query result '%1%'") % i.attrPath);
 
             if (globals.prebuiltOnly &&
-                !validPaths.count(globals.state->store->parseStorePath(i.queryOutPath())) &&
-                !substitutablePaths.count(globals.state->store->parseStorePath(i.queryOutPath())))
+                !validPaths.count(i.queryOutPath()) &&
+                !substitutablePaths.count(i.queryOutPath()))
                 continue;
 
             /* For table output. */
@@ -1084,10 +1081,10 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
             XMLAttrs attrs;
 
             if (printStatus) {
-                Path outPath = i.queryOutPath();
-                bool hasSubs = substitutablePaths.count(globals.state->store->parseStorePath(outPath));
-                bool isInstalled = installed.find(outPath) != installed.end();
-                bool isValid = validPaths.count(globals.state->store->parseStorePath(outPath));
+                auto outPath = i.queryOutPath();
+                bool hasSubs = substitutablePaths.count(outPath);
+                bool isInstalled = installed.count(outPath);
+                bool isValid = validPaths.count(outPath);
                 if (xmlOutput) {
                     attrs["installed"] = isInstalled ? "1" : "0";
                     attrs["valid"] = isValid ? "1" : "0";
@@ -1152,9 +1149,9 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
             if (printDrvPath) {
                 auto drvPath = i.queryDrvPath();
                 if (xmlOutput) {
-                    if (drvPath != "") attrs["drvPath"] = drvPath;
+                    if (drvPath) attrs["drvPath"] = store.printStorePath(*drvPath);
                 } else
-                    columns.push_back(drvPath == "" ? "-" : drvPath);
+                    columns.push_back(drvPath ? store.printStorePath(*drvPath) : "-");
             }
 
             if (printOutPath && !xmlOutput) {
@@ -1163,7 +1160,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
                 for (auto & j : outputs) {
                     if (!s.empty()) s += ';';
                     if (j.first != "out") { s += j.first; s += "="; }
-                    s += j.second;
+                    s += store.printStorePath(j.second);
                 }
                 columns.push_back(s);
             }
@@ -1184,7 +1181,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
                         for (auto & j : outputs) {
                             XMLAttrs attrs2;
                             attrs2["name"] = j.first;
-                            attrs2["path"] = j.second;
+                            attrs2["path"] = store.printStorePath(j.second);
                             xml.writeEmptyElement("output", attrs2);
                         }
                     }
diff --git a/src/nix-env/user-env.cc b/src/nix-env/user-env.cc
index 37e4086cb..af4f350ff 100644
--- a/src/nix-env/user-env.cc
+++ b/src/nix-env/user-env.cc
@@ -38,8 +38,8 @@ bool createUserEnv(EvalState & state, DrvInfos & elems,
        exist already. */
     std::vector<StorePathWithOutputs> drvsToBuild;
     for (auto & i : elems)
-        if (i.queryDrvPath() != "")
-            drvsToBuild.push_back({state.store->parseStorePath(i.queryDrvPath())});
+        if (auto drvPath = i.queryDrvPath())
+            drvsToBuild.push_back({*drvPath});
 
     debug(format("building user environment dependencies"));
     state.store->buildPaths(
@@ -55,7 +55,7 @@ bool createUserEnv(EvalState & state, DrvInfos & elems,
         /* Create a pseudo-derivation containing the name, system,
            output paths, and optionally the derivation path, as well
            as the meta attributes. */
-        Path drvPath = keepDerivations ? i.queryDrvPath() : "";
+        std::optional<StorePath> drvPath = keepDerivations ? i.queryDrvPath() : std::nullopt;
         DrvInfo::Outputs outputs = i.queryOutputs(true);
         StringSet metaNames = i.queryMetaNames();
 
@@ -66,9 +66,9 @@ bool createUserEnv(EvalState & state, DrvInfos & elems,
         auto system = i.querySystem();
         if (!system.empty())
             attrs.alloc(state.sSystem).mkString(system);
-        attrs.alloc(state.sOutPath).mkString(i.queryOutPath());
-        if (drvPath != "")
-            attrs.alloc(state.sDrvPath).mkString(i.queryDrvPath());
+        attrs.alloc(state.sOutPath).mkString(state.store->printStorePath(i.queryOutPath()));
+        if (drvPath)
+            attrs.alloc(state.sDrvPath).mkString(state.store->printStorePath(*drvPath));
 
         // Copy each output meant for installation.
         auto & vOutputs = attrs.alloc(state.sOutputs);
@@ -76,15 +76,15 @@ bool createUserEnv(EvalState & state, DrvInfos & elems,
         for (const auto & [m, j] : enumerate(outputs)) {
             (vOutputs.listElems()[m] = state.allocValue())->mkString(j.first);
             auto outputAttrs = state.buildBindings(2);
-            outputAttrs.alloc(state.sOutPath).mkString(j.second);
+            outputAttrs.alloc(state.sOutPath).mkString(state.store->printStorePath(j.second));
             attrs.alloc(j.first).mkAttrs(outputAttrs);
 
             /* This is only necessary when installing store paths, e.g.,
                `nix-env -i /nix/store/abcd...-foo'. */
-            state.store->addTempRoot(state.store->parseStorePath(j.second));
-            state.store->ensurePath(state.store->parseStorePath(j.second));
+            state.store->addTempRoot(j.second);
+            state.store->ensurePath(j.second);
 
-            references.insert(state.store->parseStorePath(j.second));
+            references.insert(j.second);
         }
 
         // Copy the meta attributes.
@@ -99,7 +99,7 @@ bool createUserEnv(EvalState & state, DrvInfos & elems,
 
         (manifest.listElems()[n++] = state.allocValue())->mkAttrs(attrs);
 
-        if (drvPath != "") references.insert(state.store->parseStorePath(drvPath));
+        if (drvPath) references.insert(*drvPath);
     }
 
     /* Also write a copy of the list of user environment elements to
@@ -132,9 +132,9 @@ bool createUserEnv(EvalState & state, DrvInfos & elems,
     state.forceValue(topLevel, [&]() { return topLevel.determinePos(noPos); });
     PathSet context;
     Attr & aDrvPath(*topLevel.attrs->find(state.sDrvPath));
-    auto topLevelDrv = state.store->parseStorePath(state.coerceToPath(*aDrvPath.pos, *aDrvPath.value, context));
+    auto topLevelDrv = state.coerceToStorePath(*aDrvPath.pos, *aDrvPath.value, context);
     Attr & aOutPath(*topLevel.attrs->find(state.sOutPath));
-    Path topLevelOut = state.coerceToPath(*aOutPath.pos, *aOutPath.value, context);
+    auto topLevelOut = state.coerceToStorePath(*aOutPath.pos, *aOutPath.value, context);
 
     /* Realise the resulting store expression. */
     debug("building user environment");
@@ -158,8 +158,7 @@ bool createUserEnv(EvalState & state, DrvInfos & elems,
         }
 
         debug(format("switching to new user environment"));
-        Path generation = createGeneration(ref<LocalFSStore>(store2), profile,
-            store2->parseStorePath(topLevelOut));
+        Path generation = createGeneration(ref<LocalFSStore>(store2), profile, topLevelOut);
         switchLink(profile, generation);
     }
 
diff --git a/src/nix-instantiate/nix-instantiate.cc b/src/nix-instantiate/nix-instantiate.cc
index 12fc8baf9..3ec0e6e7c 100644
--- a/src/nix-instantiate/nix-instantiate.cc
+++ b/src/nix-instantiate/nix-instantiate.cc
@@ -61,12 +61,13 @@ void processExpr(EvalState & state, const Strings & attrPaths,
             DrvInfos drvs;
             getDerivations(state, v, "", autoArgs, drvs, false);
             for (auto & i : drvs) {
-                Path drvPath = i.queryDrvPath();
+                auto drvPath = i.requireDrvPath();
+                auto drvPathS = state.store->printStorePath(drvPath);
 
                 /* What output do we want? */
                 std::string outputName = i.queryOutputName();
                 if (outputName == "")
-                    throw Error("derivation '%1%' lacks an 'outputName' attribute ", drvPath);
+                    throw Error("derivation '%1%' lacks an 'outputName' attribute", drvPathS);
 
                 if (gcRoot == "")
                     printGCWarning();
@@ -75,9 +76,9 @@ void processExpr(EvalState & state, const Strings & attrPaths,
                     if (++rootNr > 1) rootName += "-" + std::to_string(rootNr);
                     auto store2 = state.store.dynamic_pointer_cast<LocalFSStore>();
                     if (store2)
-                        drvPath = store2->addPermRoot(store2->parseStorePath(drvPath), rootName);
+                        drvPathS = store2->addPermRoot(drvPath, rootName);
                 }
-                std::cout << fmt("%s%s\n", drvPath, (outputName != "out" ? "!" + outputName : ""));
+                std::cout << fmt("%s%s\n", drvPathS, (outputName != "out" ? "!" + outputName : ""));
             }
         }
     }
diff --git a/src/nix/bundle.cc b/src/nix/bundle.cc
index 6b891a6ee..7ed558dee 100644
--- a/src/nix/bundle.cc
+++ b/src/nix/bundle.cc
@@ -97,13 +97,13 @@ struct CmdBundle : InstallableCommand
             throw Error("the bundler '%s' does not produce a derivation", bundler.what());
 
         PathSet context2;
-        StorePath drvPath = store->parseStorePath(evalState->coerceToPath(*attr1->pos, *attr1->value, context2));
+        auto drvPath = evalState->coerceToStorePath(*attr1->pos, *attr1->value, context2);
 
         auto attr2 = vRes->attrs->get(evalState->sOutPath);
         if (!attr2)
             throw Error("the bundler '%s' does not produce a derivation", bundler.what());
 
-        StorePath outPath = store->parseStorePath(evalState->coerceToPath(*attr2->pos, *attr2->value, context2));
+        auto outPath = evalState->coerceToStorePath(*attr2->pos, *attr2->value, context2);
 
         store->buildPaths({ DerivedPath::Built { drvPath } });
 
diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 14a235501..144f8f886 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -327,7 +327,7 @@ struct CmdFlakeCheck : FlakeCommand
                 if (!drvInfo)
                     throw Error("flake attribute '%s' is not a derivation", attrPath);
                 // FIXME: check meta attributes
-                return std::make_optional(store->parseStorePath(drvInfo->queryDrvPath()));
+                return drvInfo->queryDrvPath();
             } catch (Error & e) {
                 e.addTrace(pos, hintfmt("while checking the derivation '%s'", attrPath));
                 reportError(e);
diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index 48834d15b..a8ff9c78a 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -126,7 +126,7 @@ struct ProfileManifest
 
             for (auto & drvInfo : drvInfos) {
                 ProfileElement element;
-                element.storePaths = {state.store->parseStorePath(drvInfo.queryOutPath())};
+                element.storePaths = {drvInfo.queryOutPath()};
                 elements.emplace_back(std::move(element));
             }
         }
diff --git a/src/nix/repl.cc b/src/nix/repl.cc
index 731337004..5c0d44c68 100644
--- a/src/nix/repl.cc
+++ b/src/nix/repl.cc
@@ -384,13 +384,12 @@ StorePath NixRepl::getDerivationPath(Value & v) {
     auto drvInfo = getDerivation(*state, v, false);
     if (!drvInfo)
         throw Error("expression does not evaluate to a derivation, so I can't build it");
-    Path drvPathRaw = drvInfo->queryDrvPath();
-    if (drvPathRaw == "")
-        throw Error("expression did not evaluate to a valid derivation (no drv path)");
-    StorePath drvPath = state->store->parseStorePath(drvPathRaw);
-    if (!state->store->isValidPath(drvPath))
-        throw Error("expression did not evaluate to a valid derivation (invalid drv path)");
-    return drvPath;
+    auto drvPath = drvInfo->queryDrvPath();
+    if (!drvPath)
+        throw Error("expression did not evaluate to a valid derivation (no 'drvPath' attribute)");
+    if (!state->store->isValidPath(*drvPath))
+        throw Error("expression evaluated to invalid derivation '%s'", state->store->printStorePath(*drvPath));
+    return *drvPath;
 }
 
 
@@ -780,8 +779,11 @@ std::ostream & NixRepl::printValue(std::ostream & str, Value & v, unsigned int m
             str << "«derivation ";
             Bindings::iterator i = v.attrs->find(state->sDrvPath);
             PathSet context;
-            Path drvPath = i != v.attrs->end() ? state->coerceToPath(*i->pos, *i->value, context) : "???";
-            str << drvPath << "»";
+            if (i != v.attrs->end())
+                str << state->store->printStorePath(state->coerceToStorePath(*i->pos, *i->value, context));
+            else
+                str << "???";
+            str << "»";
         }
 
         else if (maxDepth > 0) {

From a7c835e9cb95ed573924f6f4a0ab0083058d6000 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 3 Mar 2022 10:02:11 +0100
Subject: [PATCH 099/251] Use C++11-style initializer

Co-authored-by: John Ericson <git@JohnEricson.me>
---
 src/nix-env/nix-env.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/nix-env/nix-env.cc b/src/nix-env/nix-env.cc
index 24f2d2bf3..40c3c5d65 100644
--- a/src/nix-env/nix-env.cc
+++ b/src/nix-env/nix-env.cc
@@ -953,7 +953,7 @@ static void queryJSON(Globals & globals, std::vector<DrvInfo> & elems, bool prin
 
 static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
 {
-    auto & store(*globals.state->store);
+    auto & store { *globals.state->store };
 
     Strings remaining;
     std::string attrPath;

From 609779086301a600f4282a629d586bba6b6a485c Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 3 Mar 2022 11:11:16 +0100
Subject: [PATCH 100/251] Fix segfault in headerCallback()

https://hydra.nixos.org/build/168594664
---
 src/libexpr/flake/flakeref.cc  | 6 +++---
 src/libstore/filetransfer.cc   | 2 +-
 src/libutil/util.cc            | 4 ++--
 src/nix-channel/nix-channel.cc | 2 +-
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/libexpr/flake/flakeref.cc b/src/libexpr/flake/flakeref.cc
index 930ed9ccd..c1eae413f 100644
--- a/src/libexpr/flake/flakeref.cc
+++ b/src/libexpr/flake/flakeref.cc
@@ -98,7 +98,7 @@ std::pair<FlakeRef, std::string> parseFlakeRefWithFragment(
     if (std::regex_match(url, match, flakeRegex)) {
         auto parsedURL = ParsedURL{
             .url = url,
-            .base = "flake:" + std::string(match[1]),
+            .base = "flake:" + match.str(1),
             .scheme = "flake",
             .authority = "",
             .path = match[1],
@@ -106,12 +106,12 @@ std::pair<FlakeRef, std::string> parseFlakeRefWithFragment(
 
         return std::make_pair(
             FlakeRef(Input::fromURL(parsedURL), ""),
-            percentDecode(std::string(match[6])));
+            percentDecode(match.str(6)));
     }
 
     else if (std::regex_match(url, match, pathUrlRegex)) {
         std::string path = match[1];
-        std::string fragment = percentDecode(std::string(match[3]));
+        std::string fragment = percentDecode(match.str(3));
 
         if (baseDir) {
             /* Check if 'url' is a path (either absolute or relative
diff --git a/src/libstore/filetransfer.cc b/src/libstore/filetransfer.cc
index 255b42c49..c46262299 100644
--- a/src/libstore/filetransfer.cc
+++ b/src/libstore/filetransfer.cc
@@ -197,7 +197,7 @@ struct curlFileTransfer : public FileTransfer
                 result.etag = "";
                 result.data.clear();
                 result.bodySize = 0;
-                statusMsg = trim((std::string &) match[1]);
+                statusMsg = trim(match.str(1));
                 acceptRanges = false;
                 encoding = "";
             } else {
diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 229bebbe6..b833038a9 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1263,9 +1263,9 @@ std::string chomp(std::string_view s)
 std::string trim(std::string_view s, std::string_view whitespace)
 {
     auto i = s.find_first_not_of(whitespace);
-    if (i == std::string_view::npos) return "";
+    if (i == s.npos) return "";
     auto j = s.find_last_not_of(whitespace);
-    return std::string(s, i, j == std::string::npos ? j : j - i + 1);
+    return std::string(s, i, j == s.npos ? j : j - i + 1);
 }
 
 
diff --git a/src/nix-channel/nix-channel.cc b/src/nix-channel/nix-channel.cc
index f46b90b90..cf52b03b4 100755
--- a/src/nix-channel/nix-channel.cc
+++ b/src/nix-channel/nix-channel.cc
@@ -96,7 +96,7 @@ static void update(const StringSet & channelNames)
         std::smatch match;
         auto urlBase = std::string(baseNameOf(url));
         if (std::regex_search(urlBase, match, std::regex("(-\\d.*)$")))
-            cname = cname + (std::string) match[1];
+            cname = cname + match.str(1);
 
         std::string extraAttrs;
 

From ecff9d969acef5a08d3963d16eac83a5210de86e Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 3 Mar 2022 13:07:50 +0100
Subject: [PATCH 101/251] printValue(): Don't show repeated values

Fixes #6157.
---
 src/libexpr/eval.cc  | 25 +++++++++++++------------
 src/libexpr/value.hh |  4 ++--
 src/nix/repl.cc      |  2 +-
 3 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 193358161..d9d36fab2 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -86,15 +86,10 @@ RootValue allocRootValue(Value * v)
 }
 
 
-void printValue(std::ostream & str, std::set<const Value *> & active, const Value & v)
+void printValue(std::ostream & str, std::set<const Value *> & seen, const Value & v)
 {
     checkInterrupt();
 
-    if (!active.insert(&v).second) {
-        str << "<CYCLE>";
-        return;
-    }
-
     switch (v.internalType) {
     case tInt:
         str << v.integer;
@@ -120,10 +115,14 @@ void printValue(std::ostream & str, std::set<const Value *> & active, const Valu
         str << "null";
         break;
     case tAttrs: {
+        seen.insert(&v);
         str << "{ ";
         for (auto & i : v.attrs->lexicographicOrder()) {
             str << i->name << " = ";
-            printValue(str, active, *i->value);
+            if (seen.count(i->value))
+                str << "<REPEAT>";
+            else
+                printValue(str, seen, *i->value);
             str << "; ";
         }
         str << "}";
@@ -132,9 +131,13 @@ void printValue(std::ostream & str, std::set<const Value *> & active, const Valu
     case tList1:
     case tList2:
     case tListN:
+        seen.insert(&v);
         str << "[ ";
         for (auto v2 : v.listItems()) {
-            printValue(str, active, *v2);
+            if (seen.count(v2))
+                str << "<REPEAT>";
+            else
+                printValue(str, seen, *v2);
             str << " ";
         }
         str << "]";
@@ -161,15 +164,13 @@ void printValue(std::ostream & str, std::set<const Value *> & active, const Valu
     default:
         abort();
     }
-
-    active.erase(&v);
 }
 
 
 std::ostream & operator << (std::ostream & str, const Value & v)
 {
-    std::set<const Value *> active;
-    printValue(str, active, v);
+    std::set<const Value *> seen;
+    printValue(str, seen, v);
     return str;
 }
 
diff --git a/src/libexpr/value.hh b/src/libexpr/value.hh
index 3fdff71a5..84c4d09f8 100644
--- a/src/libexpr/value.hh
+++ b/src/libexpr/value.hh
@@ -114,8 +114,8 @@ struct Value
 private:
     InternalType internalType;
 
-friend std::string showType(const Value & v);
-friend void printValue(std::ostream & str, std::set<const Value *> & active, const Value & v);
+    friend std::string showType(const Value & v);
+    friend void printValue(std::ostream & str, std::set<const Value *> & seen, const Value & v);
 
 public:
 
diff --git a/src/nix/repl.cc b/src/nix/repl.cc
index 5c0d44c68..3a51a13e6 100644
--- a/src/nix/repl.cc
+++ b/src/nix/repl.cc
@@ -800,7 +800,7 @@ std::ostream & NixRepl::printValue(std::ostream & str, Value & v, unsigned int m
                 else
                     printStringValue(str, i.first.c_str());
                 str << " = ";
-                if (seen.find(i.second) != seen.end())
+                if (seen.count(i.second))
                     str << "«repeated»";
                 else
                     try {

From e9c04c3351b4b3acae2d154b9aba808c3600054f Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 3 Mar 2022 13:29:14 +0100
Subject: [PATCH 102/251] Be more aggressive in hiding repeated values

We now memoize on Bindings / list element vectors rather than Values,
so that e.g. two Values that point to the same Bindings will be
printed only once.
---
 src/libexpr/eval.cc  | 38 +++++++++++++++++++-------------------
 src/libexpr/value.hh |  2 +-
 2 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index d9d36fab2..2d7309738 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -86,7 +86,7 @@ RootValue allocRootValue(Value * v)
 }
 
 
-void printValue(std::ostream & str, std::set<const Value *> & seen, const Value & v)
+void printValue(std::ostream & str, std::set<const void *> & seen, const Value & v)
 {
     checkInterrupt();
 
@@ -115,32 +115,32 @@ void printValue(std::ostream & str, std::set<const Value *> & seen, const Value
         str << "null";
         break;
     case tAttrs: {
-        seen.insert(&v);
-        str << "{ ";
-        for (auto & i : v.attrs->lexicographicOrder()) {
-            str << i->name << " = ";
-            if (seen.count(i->value))
-                str << "<REPEAT>";
-            else
+        if (!v.attrs->empty() && !seen.insert(v.attrs).second)
+            str << "<REPEAT>";
+        else {
+            str << "{ ";
+            for (auto & i : v.attrs->lexicographicOrder()) {
+                str << i->name << " = ";
                 printValue(str, seen, *i->value);
-            str << "; ";
+                str << "; ";
+            }
+            str << "}";
         }
-        str << "}";
         break;
     }
     case tList1:
     case tList2:
     case tListN:
-        seen.insert(&v);
-        str << "[ ";
-        for (auto v2 : v.listItems()) {
-            if (seen.count(v2))
-                str << "<REPEAT>";
-            else
+        if (v.listSize() && !seen.insert(v.listElems()).second)
+            str << "<REPEAT>";
+        else {
+            str << "[ ";
+            for (auto v2 : v.listItems()) {
                 printValue(str, seen, *v2);
-            str << " ";
+                str << " ";
+            }
+            str << "]";
         }
-        str << "]";
         break;
     case tThunk:
     case tApp:
@@ -169,7 +169,7 @@ void printValue(std::ostream & str, std::set<const Value *> & seen, const Value
 
 std::ostream & operator << (std::ostream & str, const Value & v)
 {
-    std::set<const Value *> seen;
+    std::set<const void *> seen;
     printValue(str, seen, v);
     return str;
 }
diff --git a/src/libexpr/value.hh b/src/libexpr/value.hh
index 84c4d09f8..d0fa93e92 100644
--- a/src/libexpr/value.hh
+++ b/src/libexpr/value.hh
@@ -115,7 +115,7 @@ private:
     InternalType internalType;
 
     friend std::string showType(const Value & v);
-    friend void printValue(std::ostream & str, std::set<const Value *> & seen, const Value & v);
+    friend void printValue(std::ostream & str, std::set<const void *> & seen, const Value & v);
 
 public:
 

From 6636202356b94ca4128462493770e7fedf997b0e Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 1 Mar 2022 18:31:36 +0000
Subject: [PATCH 103/251] Factor out a `GcStore` interface

Starts progress on #5729.

The idea is that we should not have these default methods throwing
"unimplemented". This is a small step in that direction.

I kept `addTempRoot` because it is a no-op, rather than failure. Also,
as a practical matter, it is called all over the place, while doing
other tasks, so the downcasting would be annoying.

Maybe in the future I could move the "real" `addTempRoot` to `GcStore`,
and the existing usecases use a `tryAddTempRoot` wrapper to downcast or
do nothing, but I wasn't sure whether that was a good idea so with a
bias to less churn I didn't do it yet.
---
 src/libmain/shared.cc                         |  1 +
 src/libstore/build/local-derivation-goal.cc   |  3 +-
 src/libstore/daemon.cc                        | 12 ++-
 src/libstore/gc-store.cc                      | 13 +++
 src/libstore/gc-store.hh                      | 84 +++++++++++++++++++
 src/libstore/local-fs-store.hh                |  3 +-
 src/libstore/local-store.hh                   |  3 +-
 src/libstore/path-with-outputs.cc             |  6 +-
 src/libstore/remote-store.cc                  |  1 +
 src/libstore/remote-store.hh                  |  3 +-
 src/libstore/store-api.hh                     | 73 ----------------
 src/libutil/tests/logging.cc                  |  2 +-
 .../nix-collect-garbage.cc                    |  4 +-
 src/nix-store/nix-store.cc                    | 18 ++--
 src/nix/store-delete.cc                       |  5 +-
 src/nix/store-gc.cc                           |  5 +-
 16 files changed, 143 insertions(+), 93 deletions(-)
 create mode 100644 src/libstore/gc-store.cc
 create mode 100644 src/libstore/gc-store.hh

diff --git a/src/libmain/shared.cc b/src/libmain/shared.cc
index a0b0f4cb3..562d1b414 100644
--- a/src/libmain/shared.cc
+++ b/src/libmain/shared.cc
@@ -1,6 +1,7 @@
 #include "globals.hh"
 #include "shared.hh"
 #include "store-api.hh"
+#include "gc-store.hh"
 #include "util.hh"
 #include "loggers.hh"
 
diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index 7e69d4145..581d63d0e 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -1,4 +1,5 @@
 #include "local-derivation-goal.hh"
+#include "gc-store.hh"
 #include "hook-instance.hh"
 #include "worker.hh"
 #include "builtins.hh"
@@ -1127,7 +1128,7 @@ struct RestrictedStoreConfig : virtual LocalFSStoreConfig
 /* A wrapper around LocalStore that only allows building/querying of
    paths that are in the input closures of the build or were added via
    recursive Nix calls. */
-struct RestrictedStore : public virtual RestrictedStoreConfig, public virtual LocalFSStore
+struct RestrictedStore : public virtual RestrictedStoreConfig, public virtual LocalFSStore, public virtual GcStore
 {
     ref<LocalStore> next;
 
diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index 9d4f6b4a4..89d9487da 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -3,6 +3,7 @@
 #include "worker-protocol.hh"
 #include "build-result.hh"
 #include "store-api.hh"
+#include "gc-store.hh"
 #include "path-with-outputs.hh"
 #include "finally.hh"
 #include "archive.hh"
@@ -623,9 +624,12 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
 
     case wopAddIndirectRoot: {
         Path path = absPath(readString(from));
+
         logger->startWork();
-        store->addIndirectRoot(path);
+        auto & gcStore = requireGcStore(*store);
+        gcStore.addIndirectRoot(path);
         logger->stopWork();
+
         to << 1;
         break;
     }
@@ -640,7 +644,8 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
 
     case wopFindRoots: {
         logger->startWork();
-        Roots roots = store->findRoots(!trusted);
+        auto & gcStore = requireGcStore(*store);
+        Roots roots = gcStore.findRoots(!trusted);
         logger->stopWork();
 
         size_t size = 0;
@@ -671,7 +676,8 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         logger->startWork();
         if (options.ignoreLiveness)
             throw Error("you are not allowed to ignore liveness");
-        store->collectGarbage(options, results);
+        auto & gcStore = requireGcStore(*store);
+        gcStore.collectGarbage(options, results);
         logger->stopWork();
 
         to << results.paths << results.bytesFreed << 0 /* obsolete */;
diff --git a/src/libstore/gc-store.cc b/src/libstore/gc-store.cc
new file mode 100644
index 000000000..3dbdec53b
--- /dev/null
+++ b/src/libstore/gc-store.cc
@@ -0,0 +1,13 @@
+#include "gc-store.hh"
+
+namespace nix {
+
+GcStore & requireGcStore(Store & store)
+{
+    auto * gcStore = dynamic_cast<GcStore *>(&store);
+    if (!gcStore)
+        throw UsageError("Garbage collection not supported by this store");
+    return *gcStore;
+}
+
+}
diff --git a/src/libstore/gc-store.hh b/src/libstore/gc-store.hh
new file mode 100644
index 000000000..829f70dc4
--- /dev/null
+++ b/src/libstore/gc-store.hh
@@ -0,0 +1,84 @@
+#pragma once
+
+#include "store-api.hh"
+
+
+namespace nix {
+
+
+typedef std::unordered_map<StorePath, std::unordered_set<std::string>> Roots;
+
+
+struct GCOptions
+{
+    /* Garbage collector operation:
+
+       - `gcReturnLive': return the set of paths reachable from
+         (i.e. in the closure of) the roots.
+
+       - `gcReturnDead': return the set of paths not reachable from
+         the roots.
+
+       - `gcDeleteDead': actually delete the latter set.
+
+       - `gcDeleteSpecific': delete the paths listed in
+          `pathsToDelete', insofar as they are not reachable.
+    */
+    typedef enum {
+        gcReturnLive,
+        gcReturnDead,
+        gcDeleteDead,
+        gcDeleteSpecific,
+    } GCAction;
+
+    GCAction action{gcDeleteDead};
+
+    /* If `ignoreLiveness' is set, then reachability from the roots is
+       ignored (dangerous!).  However, the paths must still be
+       unreferenced *within* the store (i.e., there can be no other
+       store paths that depend on them). */
+    bool ignoreLiveness{false};
+
+    /* For `gcDeleteSpecific', the paths to delete. */
+    StorePathSet pathsToDelete;
+
+    /* Stop after at least `maxFreed' bytes have been freed. */
+    uint64_t maxFreed{std::numeric_limits<uint64_t>::max()};
+};
+
+
+struct GCResults
+{
+    /* Depending on the action, the GC roots, or the paths that would
+       be or have been deleted. */
+    PathSet paths;
+
+    /* For `gcReturnDead', `gcDeleteDead' and `gcDeleteSpecific', the
+       number of bytes that would be or was freed. */
+    uint64_t bytesFreed = 0;
+};
+
+
+struct GcStore : public virtual Store
+{
+    /* Add an indirect root, which is merely a symlink to `path' from
+       /nix/var/nix/gcroots/auto/<hash of `path'>.  `path' is supposed
+       to be a symlink to a store path.  The garbage collector will
+       automatically remove the indirect root when it finds that
+       `path' has disappeared. */
+    virtual void addIndirectRoot(const Path & path) = 0;
+
+    /* Find the roots of the garbage collector.  Each root is a pair
+       (link, storepath) where `link' is the path of the symlink
+       outside of the Nix store that point to `storePath'. If
+       'censor' is true, privacy-sensitive information about roots
+       found in /proc is censored. */
+    virtual Roots findRoots(bool censor) = 0;
+
+    /* Perform a garbage collection. */
+    virtual void collectGarbage(const GCOptions & options, GCResults & results) = 0;
+};
+
+GcStore & requireGcStore(Store & store);
+
+}
diff --git a/src/libstore/local-fs-store.hh b/src/libstore/local-fs-store.hh
index d34f0cb62..fbd49dc2c 100644
--- a/src/libstore/local-fs-store.hh
+++ b/src/libstore/local-fs-store.hh
@@ -1,6 +1,7 @@
 #pragma once
 
 #include "store-api.hh"
+#include "gc-store.hh"
 
 namespace nix {
 
@@ -23,7 +24,7 @@ struct LocalFSStoreConfig : virtual StoreConfig
         "physical path to the Nix store"};
 };
 
-class LocalFSStore : public virtual LocalFSStoreConfig, public virtual Store
+class LocalFSStore : public virtual LocalFSStoreConfig, public virtual Store, virtual GcStore
 {
 public:
 
diff --git a/src/libstore/local-store.hh b/src/libstore/local-store.hh
index 1a278c9a8..70d225be3 100644
--- a/src/libstore/local-store.hh
+++ b/src/libstore/local-store.hh
@@ -5,6 +5,7 @@
 #include "pathlocks.hh"
 #include "store-api.hh"
 #include "local-fs-store.hh"
+#include "gc-store.hh"
 #include "sync.hh"
 #include "util.hh"
 
@@ -43,7 +44,7 @@ struct LocalStoreConfig : virtual LocalFSStoreConfig
 };
 
 
-class LocalStore : public virtual LocalStoreConfig, public virtual LocalFSStore
+class LocalStore : public virtual LocalStoreConfig, public virtual LocalFSStore, public virtual GcStore
 {
 private:
 
diff --git a/src/libstore/path-with-outputs.cc b/src/libstore/path-with-outputs.cc
index 97aa01b57..078c117bd 100644
--- a/src/libstore/path-with-outputs.cc
+++ b/src/libstore/path-with-outputs.cc
@@ -22,9 +22,9 @@ DerivedPath StorePathWithOutputs::toDerivedPath() const
 
 std::vector<DerivedPath> toDerivedPaths(const std::vector<StorePathWithOutputs> ss)
 {
-	std::vector<DerivedPath> reqs;
-	for (auto & s : ss) reqs.push_back(s.toDerivedPath());
-	return reqs;
+    std::vector<DerivedPath> reqs;
+    for (auto & s : ss) reqs.push_back(s.toDerivedPath());
+    return reqs;
 }
 
 
diff --git a/src/libstore/remote-store.cc b/src/libstore/remote-store.cc
index cbcb75c00..a25398ef2 100644
--- a/src/libstore/remote-store.cc
+++ b/src/libstore/remote-store.cc
@@ -1,6 +1,7 @@
 #include "serialise.hh"
 #include "util.hh"
 #include "path-with-outputs.hh"
+#include "gc-store.hh"
 #include "remote-fs-accessor.hh"
 #include "build-result.hh"
 #include "remote-store.hh"
diff --git a/src/libstore/remote-store.hh b/src/libstore/remote-store.hh
index b94216d31..2628206b1 100644
--- a/src/libstore/remote-store.hh
+++ b/src/libstore/remote-store.hh
@@ -4,6 +4,7 @@
 #include <string>
 
 #include "store-api.hh"
+#include "gc-store.hh"
 
 
 namespace nix {
@@ -29,7 +30,7 @@ struct RemoteStoreConfig : virtual StoreConfig
 
 /* FIXME: RemoteStore is a misnomer - should be something like
    DaemonStore. */
-class RemoteStore : public virtual RemoteStoreConfig, public virtual Store
+class RemoteStore : public virtual RemoteStoreConfig, public virtual Store, public virtual GcStore
 {
 public:
 
diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
index 8c57596d0..7bd21519c 100644
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@@ -76,59 +76,6 @@ enum AllowInvalidFlag : bool { DisallowInvalid = false, AllowInvalid = true };
 const uint32_t exportMagic = 0x4558494e;
 
 
-typedef std::unordered_map<StorePath, std::unordered_set<std::string>> Roots;
-
-
-struct GCOptions
-{
-    /* Garbage collector operation:
-
-       - `gcReturnLive': return the set of paths reachable from
-         (i.e. in the closure of) the roots.
-
-       - `gcReturnDead': return the set of paths not reachable from
-         the roots.
-
-       - `gcDeleteDead': actually delete the latter set.
-
-       - `gcDeleteSpecific': delete the paths listed in
-          `pathsToDelete', insofar as they are not reachable.
-    */
-    typedef enum {
-        gcReturnLive,
-        gcReturnDead,
-        gcDeleteDead,
-        gcDeleteSpecific,
-    } GCAction;
-
-    GCAction action{gcDeleteDead};
-
-    /* If `ignoreLiveness' is set, then reachability from the roots is
-       ignored (dangerous!).  However, the paths must still be
-       unreferenced *within* the store (i.e., there can be no other
-       store paths that depend on them). */
-    bool ignoreLiveness{false};
-
-    /* For `gcDeleteSpecific', the paths to delete. */
-    StorePathSet pathsToDelete;
-
-    /* Stop after at least `maxFreed' bytes have been freed. */
-    uint64_t maxFreed{std::numeric_limits<uint64_t>::max()};
-};
-
-
-struct GCResults
-{
-    /* Depending on the action, the GC roots, or the paths that would
-       be or have been deleted. */
-    PathSet paths;
-
-    /* For `gcReturnDead', `gcDeleteDead' and `gcDeleteSpecific', the
-       number of bytes that would be or was freed. */
-    uint64_t bytesFreed = 0;
-};
-
-
 enum BuildMode { bmNormal, bmRepair, bmCheck };
 
 struct BuildResult;
@@ -531,26 +478,6 @@ public:
     virtual void addTempRoot(const StorePath & path)
     { debug("not creating temporary root, store doesn't support GC"); }
 
-    /* Add an indirect root, which is merely a symlink to `path' from
-       /nix/var/nix/gcroots/auto/<hash of `path'>.  `path' is supposed
-       to be a symlink to a store path.  The garbage collector will
-       automatically remove the indirect root when it finds that
-       `path' has disappeared. */
-    virtual void addIndirectRoot(const Path & path)
-    { unsupported("addIndirectRoot"); }
-
-    /* Find the roots of the garbage collector.  Each root is a pair
-       (link, storepath) where `link' is the path of the symlink
-       outside of the Nix store that point to `storePath'. If
-       'censor' is true, privacy-sensitive information about roots
-       found in /proc is censored. */
-    virtual Roots findRoots(bool censor)
-    { unsupported("findRoots"); }
-
-    /* Perform a garbage collection. */
-    virtual void collectGarbage(const GCOptions & options, GCResults & results)
-    { unsupported("collectGarbage"); }
-
     /* Return a string representing information about the path that
        can be loaded into the database using `nix-store --load-db' or
        `nix-store --register-validity'. */
diff --git a/src/libutil/tests/logging.cc b/src/libutil/tests/logging.cc
index cef3bd481..2ffdc2e9b 100644
--- a/src/libutil/tests/logging.cc
+++ b/src/libutil/tests/logging.cc
@@ -359,7 +359,7 @@ namespace nix {
 
       // constructing without access violation.
       ErrPos ep(invalid);
-    
+
       // assignment without access violation.
       ep = invalid;
 
diff --git a/src/nix-collect-garbage/nix-collect-garbage.cc b/src/nix-collect-garbage/nix-collect-garbage.cc
index 48c030b18..4b28ea6a4 100644
--- a/src/nix-collect-garbage/nix-collect-garbage.cc
+++ b/src/nix-collect-garbage/nix-collect-garbage.cc
@@ -1,4 +1,5 @@
 #include "store-api.hh"
+#include "gc-store.hh"
 #include "profiles.hh"
 #include "shared.hh"
 #include "globals.hh"
@@ -80,10 +81,11 @@ static int main_nix_collect_garbage(int argc, char * * argv)
         // Run the actual garbage collector.
         if (!dryRun) {
             auto store = openStore();
+            auto & gcStore = requireGcStore(*store);
             options.action = GCOptions::gcDeleteDead;
             GCResults results;
             PrintFreed freed(true, results);
-            store->collectGarbage(options, results);
+            gcStore.collectGarbage(options, results);
         }
 
         return 0;
diff --git a/src/nix-store/nix-store.cc b/src/nix-store/nix-store.cc
index 1ebc177f5..8ebaf9387 100644
--- a/src/nix-store/nix-store.cc
+++ b/src/nix-store/nix-store.cc
@@ -3,6 +3,7 @@
 #include "dotgraph.hh"
 #include "globals.hh"
 #include "build-result.hh"
+#include "gc-store.hh"
 #include "local-store.hh"
 #include "monitor-fd.hh"
 #include "serve-protocol.hh"
@@ -428,11 +429,12 @@ static void opQuery(Strings opFlags, Strings opArgs)
             store->computeFSClosure(
                 args, referrers, true, settings.gcKeepOutputs, settings.gcKeepDerivations);
 
-            Roots roots = store->findRoots(false);
+            auto & gcStore = requireGcStore(*store);
+            Roots roots = gcStore.findRoots(false);
             for (auto & [target, links] : roots)
                 if (referrers.find(target) != referrers.end())
                     for (auto & link : links)
-                        cout << fmt("%1% -> %2%\n", link, store->printStorePath(target));
+                        cout << fmt("%1% -> %2%\n", link, gcStore.printStorePath(target));
             break;
         }
 
@@ -588,20 +590,22 @@ static void opGC(Strings opFlags, Strings opArgs)
 
     if (!opArgs.empty()) throw UsageError("no arguments expected");
 
+    auto & gcStore = requireGcStore(*store);
+
     if (printRoots) {
-        Roots roots = store->findRoots(false);
+        Roots roots = gcStore.findRoots(false);
         std::set<std::pair<Path, StorePath>> roots2;
         // Transpose and sort the roots.
         for (auto & [target, links] : roots)
             for (auto & link : links)
                 roots2.emplace(link, target);
         for (auto & [link, target] : roots2)
-            std::cout << link << " -> " << store->printStorePath(target) << "\n";
+            std::cout << link << " -> " << gcStore.printStorePath(target) << "\n";
     }
 
     else {
         PrintFreed freed(options.action == GCOptions::gcDeleteDead, results);
-        store->collectGarbage(options, results);
+        gcStore.collectGarbage(options, results);
 
         if (options.action != GCOptions::gcDeleteDead)
             for (auto & i : results.paths)
@@ -625,9 +629,11 @@ static void opDelete(Strings opFlags, Strings opArgs)
     for (auto & i : opArgs)
         options.pathsToDelete.insert(store->followLinksToStorePath(i));
 
+    auto & gcStore = requireGcStore(*store);
+
     GCResults results;
     PrintFreed freed(true, results);
-    store->collectGarbage(options, results);
+    gcStore.collectGarbage(options, results);
 }
 
 
diff --git a/src/nix/store-delete.cc b/src/nix/store-delete.cc
index e4a3cb554..aa7a8b12f 100644
--- a/src/nix/store-delete.cc
+++ b/src/nix/store-delete.cc
@@ -2,6 +2,7 @@
 #include "common-args.hh"
 #include "shared.hh"
 #include "store-api.hh"
+#include "gc-store.hh"
 
 using namespace nix;
 
@@ -32,12 +33,14 @@ struct CmdStoreDelete : StorePathsCommand
 
     void run(ref<Store> store, std::vector<StorePath> && storePaths) override
     {
+        auto & gcStore = requireGcStore(*store);
+
         for (auto & path : storePaths)
             options.pathsToDelete.insert(path);
 
         GCResults results;
         PrintFreed freed(true, results);
-        store->collectGarbage(options, results);
+        gcStore.collectGarbage(options, results);
     }
 };
 
diff --git a/src/nix/store-gc.cc b/src/nix/store-gc.cc
index a2d74066e..21718dc0c 100644
--- a/src/nix/store-gc.cc
+++ b/src/nix/store-gc.cc
@@ -2,6 +2,7 @@
 #include "common-args.hh"
 #include "shared.hh"
 #include "store-api.hh"
+#include "gc-store.hh"
 
 using namespace nix;
 
@@ -33,10 +34,12 @@ struct CmdStoreGC : StoreCommand, MixDryRun
 
     void run(ref<Store> store) override
     {
+        auto & gcStore = requireGcStore(*store);
+
         options.action = dryRun ? GCOptions::gcReturnDead : GCOptions::gcDeleteDead;
         GCResults results;
         PrintFreed freed(options.action == GCOptions::gcDeleteDead, results);
-        store->collectGarbage(options, results);
+        gcStore.collectGarbage(options, results);
     }
 };
 

From 697d1dac0164001a10ab990a382ad83f2e7628d4 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 4 Mar 2022 16:58:27 +0100
Subject: [PATCH 104/251] tests: grep for string in nix log for remote-builds

---
 tests/build-hook-ca-fixed.nix | 4 ++--
 tests/build-hook.nix          | 4 ++--
 tests/build-remote.sh         | 3 +--
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/tests/build-hook-ca-fixed.nix b/tests/build-hook-ca-fixed.nix
index 899b610a8..4cb9e85d1 100644
--- a/tests/build-hook-ca-fixed.nix
+++ b/tests/build-hook-ca-fixed.nix
@@ -17,7 +17,7 @@ let
   input1 = mkDerivation {
     shell = busybox;
     name = "build-remote-input-1";
-    buildCommand = "echo hi; echo FOO > $out";
+    buildCommand = "echo hi-input1; echo FOO > $out";
     requiredSystemFeatures = ["foo"];
     outputHash = "sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc=";
   };
@@ -34,7 +34,7 @@ let
     shell = busybox;
     name = "build-remote-input-3";
     buildCommand = ''
-      echo hi
+      echo hi-input3
       read x < ${input2}
       echo $x BAZ > $out
     '';
diff --git a/tests/build-hook.nix b/tests/build-hook.nix
index 3c83e0475..643334caa 100644
--- a/tests/build-hook.nix
+++ b/tests/build-hook.nix
@@ -15,7 +15,7 @@ let
   input1 = mkDerivation {
     shell = busybox;
     name = "build-remote-input-1";
-    buildCommand = "echo hi; echo FOO > $out";
+    buildCommand = "echo hi-input1; echo FOO > $out";
     requiredSystemFeatures = ["foo"];
   };
 
@@ -30,7 +30,7 @@ let
     shell = busybox;
     name = "build-remote-input-3";
     buildCommand = ''
-      echo hi
+      echo hi-input3
       read x < ${input2}
       echo $x BAZ > $out
     '';
diff --git a/tests/build-remote.sh b/tests/build-remote.sh
index 4ecc788a3..a2c3b9ce7 100644
--- a/tests/build-remote.sh
+++ b/tests/build-remote.sh
@@ -57,8 +57,7 @@ nix path-info --store $TEST_ROOT/machine3 --all \
 
 if [[ -z "$CONTENT_ADDRESSED" ]]; then
   for i in input1 input3; do
-    drv="$(nix-instantiate $file -A passthru.$i --store $TEST_ROOT/machine0 --arg busybox $busybox)"
-    nix log --store $TEST_ROOT/machine0 "$drv"
+    nix log --store $TEST_ROOT/machine0 --file "$file" --arg busybox $busybox passthru."$i" | grep hi-$i
   done
 fi
 

From 314852a10e3e741e84510f90f5db75f797145f0a Mon Sep 17 00:00:00 2001
From: Nicholas Sielicki <sielicki@yandex.com>
Date: Sun, 6 Mar 2022 17:01:14 -0600
Subject: [PATCH 105/251] Point to new github oauth docs url

Previous URL was 404'ing.
---
 src/libfetchers/fetch-settings.hh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libfetchers/fetch-settings.hh b/src/libfetchers/fetch-settings.hh
index 58a2aded3..04c9feda0 100644
--- a/src/libfetchers/fetch-settings.hh
+++ b/src/libfetchers/fetch-settings.hh
@@ -29,7 +29,7 @@ struct FetchSettings : public Config
 
           * Github: the token value is the OAUTH-TOKEN string obtained
             as the Personal Access Token from the Github server (see
-            https://docs.github.com/en/developers/apps/authorizing-oath-apps).
+            https://docs.github.com/en/developers/apps/building-oauth-apps/authorizing-oauth-apps).
 
           * Gitlab: the token value is either the OAuth2 token or the
             Personal Access Token (these are different types tokens

From 860016bcbf1ea91289ebc5d495eccfe43f22ac62 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9ophane=20Hufschmitt?=
 <7226587+thufschmitt@users.noreply.github.com>
Date: Mon, 7 Mar 2022 09:15:34 +0100
Subject: [PATCH 106/251] Explain why the log tests are disabled for CA
 derivations

---
 tests/build-remote.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/build-remote.sh b/tests/build-remote.sh
index a2c3b9ce7..094366872 100644
--- a/tests/build-remote.sh
+++ b/tests/build-remote.sh
@@ -55,6 +55,7 @@ nix path-info --store $TEST_ROOT/machine3 --all \
   | grep builder-build-remote-input-3.sh
 
 
+# Temporarily disabled because of https://github.com/NixOS/nix/issues/6209
 if [[ -z "$CONTENT_ADDRESSED" ]]; then
   for i in input1 input3; do
     nix log --store $TEST_ROOT/machine0 --file "$file" --arg busybox $busybox passthru."$i" | grep hi-$i

From c0792b1546ceed1c02a02ca1286ead55f79d5798 Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Thu, 3 Mar 2022 10:50:35 +0100
Subject: [PATCH 107/251] Implement a suggestions mechanism

Each `Error` class now includes a set of suggestions, and these are printed by
the top-level handler.
---
 src/libcmd/installables.cc |  11 +++-
 src/libexpr/attr-path.cc   |  10 +++-
 src/libutil/args.cc        |   9 ++-
 src/libutil/error.cc       |   7 +++
 src/libutil/error.hh       |   8 +++
 src/libutil/suggestions.cc | 111 +++++++++++++++++++++++++++++++++++++
 src/libutil/suggestions.hh |  41 ++++++++++++++
 7 files changed, 191 insertions(+), 6 deletions(-)
 create mode 100644 src/libutil/suggestions.cc
 create mode 100644 src/libutil/suggestions.hh

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index 3209456bf..888d863ff 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -610,17 +610,24 @@ std::pair<Value *, Pos> InstallableFlake::toValue(EvalState & state)
 
     auto emptyArgs = state.allocBindings(0);
 
+    Suggestions suggestions;
+
     for (auto & attrPath : getActualAttrPaths()) {
         try {
             auto [v, pos] = findAlongAttrPath(state, attrPath, *emptyArgs, *vOutputs);
             state.forceValue(*v, pos);
             return {v, pos};
         } catch (AttrPathNotFound & e) {
+            suggestions += e.info().suggestions;
         }
     }
 
-    throw Error("flake '%s' does not provide attribute %s",
-        flakeRef, showAttrPaths(getActualAttrPaths()));
+    throw Error(
+        suggestions,
+        "flake '%s' does not provide attribute %s",
+        flakeRef,
+        showAttrPaths(getActualAttrPaths())
+    );
 }
 
 std::vector<std::pair<std::shared_ptr<eval_cache::AttrCursor>, std::string>>
diff --git a/src/libexpr/attr-path.cc b/src/libexpr/attr-path.cc
index eb0e706c7..32deecfae 100644
--- a/src/libexpr/attr-path.cc
+++ b/src/libexpr/attr-path.cc
@@ -74,8 +74,14 @@ std::pair<Value *, Pos> findAlongAttrPath(EvalState & state, const std::string &
                 throw Error("empty attribute name in selection path '%1%'", attrPath);
 
             Bindings::iterator a = v->attrs->find(state.symbols.create(attr));
-            if (a == v->attrs->end())
-                throw AttrPathNotFound("attribute '%1%' in selection path '%2%' not found", attr, attrPath);
+            if (a == v->attrs->end()) {
+                std::set<std::string> attrNames;
+                for (auto & attr : *v->attrs)
+                    attrNames.insert(attr.name);
+
+                auto suggestions = Suggestions::bestMatches(attrNames, attr);
+                throw AttrPathNotFound(suggestions, "attribute '%1%' in selection path '%2%' not found", attr, attrPath);
+            }
             v = &*a->value;
             pos = *a->pos;
         }
diff --git a/src/libutil/args.cc b/src/libutil/args.cc
index f970c0e9e..69aa0d094 100644
--- a/src/libutil/args.cc
+++ b/src/libutil/args.cc
@@ -328,8 +328,13 @@ MultiCommand::MultiCommand(const Commands & commands_)
                         completions->add(name);
             }
             auto i = commands.find(s);
-            if (i == commands.end())
-                throw UsageError("'%s' is not a recognised command", s);
+            if (i == commands.end()) {
+                std::set<std::string> commandNames;
+                for (auto & [name, _] : commands)
+                    commandNames.insert(name);
+                auto suggestions = Suggestions::bestMatches(commandNames, s);
+                throw UsageError(suggestions, "'%s' is not a recognised command", s);
+            }
             command = {s, i->second()};
             command->second->parent = this;
         }}
diff --git a/src/libutil/error.cc b/src/libutil/error.cc
index dcd2f82a5..15ae7a759 100644
--- a/src/libutil/error.cc
+++ b/src/libutil/error.cc
@@ -282,6 +282,13 @@ std::ostream & showErrorInfo(std::ostream & out, const ErrorInfo & einfo, bool s
         }
     }
 
+    auto suggestions = einfo.suggestions.trim();
+    if (! suggestions.suggestions.empty()){
+        oss << "Did you mean " <<
+            suggestions.trim().pretty_print() <<
+            "?" << std::endl;
+    }
+
     // traces
     if (showTrace && !einfo.traces.empty()) {
         for (auto iter = einfo.traces.rbegin(); iter != einfo.traces.rend(); ++iter) {
diff --git a/src/libutil/error.hh b/src/libutil/error.hh
index d55e1d701..600e94888 100644
--- a/src/libutil/error.hh
+++ b/src/libutil/error.hh
@@ -1,5 +1,6 @@
 #pragma once
 
+#include "suggestions.hh"
 #include "ref.hh"
 #include "types.hh"
 #include "fmt.hh"
@@ -112,6 +113,8 @@ struct ErrorInfo {
     std::optional<ErrPos> errPos;
     std::list<Trace> traces;
 
+    Suggestions suggestions;
+
     static std::optional<std::string> programName;
 };
 
@@ -141,6 +144,11 @@ public:
         : err { .level = lvlError, .msg = hintfmt(fs, args...) }
     { }
 
+    template<typename... Args>
+    BaseError(const Suggestions & sug, const Args & ... args)
+        : err { .level = lvlError, .msg = hintfmt(args...), .suggestions = sug }
+    { }
+
     BaseError(hintformat hint)
         : err { .level = lvlError, .msg = hint }
     { }
diff --git a/src/libutil/suggestions.cc b/src/libutil/suggestions.cc
new file mode 100644
index 000000000..96b48416b
--- /dev/null
+++ b/src/libutil/suggestions.cc
@@ -0,0 +1,111 @@
+#include "suggestions.hh"
+#include "ansicolor.hh"
+#include "util.hh"
+#include <algorithm>
+
+namespace nix {
+
+/**
+ * Return `some(distance)` where distance is an integer representing some
+ * notion of distance between both arguments.
+ *
+ * If the distance is too big, return none
+ */
+int distanceBetween(std::string_view first, std::string_view second)
+{
+    // Levenshtein distance.
+    // Implementation borrowed from
+    // https://en.wikipedia.org/wiki/Levenshtein_distance#Iterative_with_two_matrix_rows
+
+    int m = first.size();
+    int n = second.size();
+
+    auto v0 = std::vector<int>(n+1);
+    auto v1 = std::vector<int>(n+1);
+
+    for (auto i = 0; i <= n; i++)
+        v0[i] = i;
+
+    for (auto i = 0; i < m; i++) {
+        v1[0] = i+1;
+
+        for (auto j = 0; j < n; j++) {
+            auto deletionCost = v0[j+1] + 1;
+            auto insertionCost = v1[j] + 1;
+            auto substitutionCost = first[i] == second[j] ? v0[j] : v0[j] + 1;
+            v1[j+1] = std::min({deletionCost, insertionCost, substitutionCost});
+        }
+
+        std::swap(v0, v1);
+    }
+
+    return v0[n];
+}
+
+Suggestions Suggestions::bestMatches (
+    std::set<std::string> allMatches,
+    std::string query)
+{
+    std::set<Suggestion> res;
+    for (const auto & possibleMatch : allMatches) {
+        res.insert(Suggestion {
+            .distance = distanceBetween(query, possibleMatch),
+            .suggestion = possibleMatch,
+        });
+    }
+    return Suggestions { res };
+}
+
+Suggestions Suggestions::trim(int limit, int maxDistance) const
+{
+    std::set<Suggestion> res;
+
+    int count = 0;
+
+    for (auto & elt : suggestions) {
+        if (count >= limit || elt.distance >= maxDistance)
+            break;
+        count++;
+        res.insert(elt);
+    }
+
+    return Suggestions{res};
+}
+
+std::string Suggestion::pretty_print() const
+{
+    return ANSI_WARNING + filterANSIEscapes(suggestion) + ANSI_NORMAL;
+}
+
+std::string Suggestions::pretty_print() const
+{
+    switch (suggestions.size()) {
+        case 0:
+            return "";
+        case 1:
+            return suggestions.begin()->pretty_print();
+        default: {
+            std::string res = "one of ";
+            auto iter = suggestions.begin();
+            res += iter->pretty_print(); // Iter can’t be end() because the container isn’t null
+            iter++;
+            auto last = suggestions.end(); last--;
+            for ( ; iter != suggestions.end() ; iter++) {
+                res += (iter == last) ? " or " : ", ";
+                res += iter->pretty_print();
+            }
+            return res;
+        }
+    }
+}
+
+Suggestions & Suggestions::operator+=(const Suggestions & other)
+{
+    suggestions.insert(
+            other.suggestions.begin(),
+            other.suggestions.end()
+    );
+    return *this;
+}
+
+}
diff --git a/src/libutil/suggestions.hh b/src/libutil/suggestions.hh
new file mode 100644
index 000000000..3caed487a
--- /dev/null
+++ b/src/libutil/suggestions.hh
@@ -0,0 +1,41 @@
+#pragma once
+
+#include "comparator.hh"
+#include "types.hh"
+#include <set>
+
+namespace nix {
+
+/**
+ * A potential suggestion for the cli interface.
+ */
+class Suggestion {
+public:
+    int distance; // The smaller the better
+    std::string suggestion;
+
+    std::string pretty_print() const;
+
+    GENERATE_CMP(Suggestion, me->distance, me->suggestion)
+};
+
+class Suggestions {
+public:
+    std::set<Suggestion> suggestions;
+
+    std::string pretty_print() const;
+
+    Suggestions trim(
+        int limit = 5,
+        int maxDistance = 2
+    ) const;
+
+    static Suggestions bestMatches (
+        std::set<std::string> allMatches,
+        std::string query
+    );
+
+    Suggestions& operator+=(const Suggestions & other);
+};
+
+}

From 2405bbbb5edd204d6031edcd470a2057f4a25782 Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Thu, 3 Mar 2022 13:12:27 +0100
Subject: [PATCH 108/251] Add some tests for the suggestions

---
 src/libutil/suggestions.cc       | 13 +++-------
 src/libutil/suggestions.hh       |  2 ++
 src/libutil/tests/suggestions.cc | 43 ++++++++++++++++++++++++++++++++
 3 files changed, 48 insertions(+), 10 deletions(-)
 create mode 100644 src/libutil/tests/suggestions.cc

diff --git a/src/libutil/suggestions.cc b/src/libutil/suggestions.cc
index 96b48416b..bcd93aa6b 100644
--- a/src/libutil/suggestions.cc
+++ b/src/libutil/suggestions.cc
@@ -5,15 +5,8 @@
 
 namespace nix {
 
-/**
- * Return `some(distance)` where distance is an integer representing some
- * notion of distance between both arguments.
- *
- * If the distance is too big, return none
- */
-int distanceBetween(std::string_view first, std::string_view second)
+int levenshteinDistance(std::string_view first, std::string_view second)
 {
-    // Levenshtein distance.
     // Implementation borrowed from
     // https://en.wikipedia.org/wiki/Levenshtein_distance#Iterative_with_two_matrix_rows
 
@@ -49,7 +42,7 @@ Suggestions Suggestions::bestMatches (
     std::set<Suggestion> res;
     for (const auto & possibleMatch : allMatches) {
         res.insert(Suggestion {
-            .distance = distanceBetween(query, possibleMatch),
+            .distance = levenshteinDistance(query, possibleMatch),
             .suggestion = possibleMatch,
         });
     }
@@ -63,7 +56,7 @@ Suggestions Suggestions::trim(int limit, int maxDistance) const
     int count = 0;
 
     for (auto & elt : suggestions) {
-        if (count >= limit || elt.distance >= maxDistance)
+        if (count >= limit || elt.distance > maxDistance)
             break;
         count++;
         res.insert(elt);
diff --git a/src/libutil/suggestions.hh b/src/libutil/suggestions.hh
index 3caed487a..76063a261 100644
--- a/src/libutil/suggestions.hh
+++ b/src/libutil/suggestions.hh
@@ -6,6 +6,8 @@
 
 namespace nix {
 
+int levenshteinDistance(std::string_view first, std::string_view second);
+
 /**
  * A potential suggestion for the cli interface.
  */
diff --git a/src/libutil/tests/suggestions.cc b/src/libutil/tests/suggestions.cc
new file mode 100644
index 000000000..279994abc
--- /dev/null
+++ b/src/libutil/tests/suggestions.cc
@@ -0,0 +1,43 @@
+#include "suggestions.hh"
+#include <gtest/gtest.h>
+
+namespace nix {
+
+    struct LevenshteinDistanceParam {
+        std::string s1, s2;
+        int distance;
+    };
+
+    class LevenshteinDistanceTest :
+        public testing::TestWithParam<LevenshteinDistanceParam> {
+    };
+
+    TEST_P(LevenshteinDistanceTest, CorrectlyComputed) {
+        auto params = GetParam();
+
+        ASSERT_EQ(levenshteinDistance(params.s1, params.s2), params.distance);
+        ASSERT_EQ(levenshteinDistance(params.s2, params.s1), params.distance);
+    }
+
+    INSTANTIATE_TEST_SUITE_P(LevenshteinDistance, LevenshteinDistanceTest,
+            testing::Values(
+                LevenshteinDistanceParam{"foo", "foo", 0},
+                LevenshteinDistanceParam{"foo", "", 3},
+                LevenshteinDistanceParam{"", "", 0},
+                LevenshteinDistanceParam{"foo", "fo", 1},
+                LevenshteinDistanceParam{"foo", "oo", 1},
+                LevenshteinDistanceParam{"foo", "fao", 1},
+                LevenshteinDistanceParam{"foo", "abc", 3}
+            )
+    );
+
+    TEST(Suggestions, Trim) {
+        auto suggestions = Suggestions::bestMatches({"foooo", "bar", "fo", "gao"}, "foo");
+        auto onlyOne = suggestions.trim(1);
+        ASSERT_EQ(onlyOne.suggestions.size(), 1);
+        ASSERT_TRUE(onlyOne.suggestions.begin()->suggestion == "fo");
+
+        auto closest = suggestions.trim(999, 2);
+        ASSERT_EQ(closest.suggestions.size(), 3);
+    }
+}

From 98e361ad4c1a26d4ffe4762a6f33bb9e39321a39 Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Fri, 4 Mar 2022 09:44:00 +0100
Subject: [PATCH 109/251] Also display suggestions for the commands using the
 eval cache

Make `nix build .#nix-armv8l-linux` work for example
---
 src/libcmd/installables.cc | 19 +++++++++----
 src/libexpr/eval-cache.cc  | 35 +++++++++++++++++------
 src/libexpr/eval-cache.hh  |  8 ++++--
 src/libutil/suggestions.hh | 58 ++++++++++++++++++++++++++++++++++++++
 4 files changed, 103 insertions(+), 17 deletions(-)

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index 888d863ff..03f3bd409 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -272,9 +272,9 @@ void completeFlakeRefWithFragment(
                 auto attr = root->findAlongAttrPath(attrPath);
                 if (!attr) continue;
 
-                for (auto & attr2 : attr->getAttrs()) {
+                for (auto & attr2 : (*attr)->getAttrs()) {
                     if (hasPrefix(attr2, lastAttr)) {
-                        auto attrPath2 = attr->getAttrPath(attr2);
+                        auto attrPath2 = (*attr)->getAttrPath(attr2);
                         /* Strip the attrpath prefix. */
                         attrPath2.erase(attrPath2.begin(), attrPath2.begin() + attrPathPrefix.size());
                         completions->add(flakeRefS + "#" + concatStringsSep(".", attrPath2));
@@ -568,15 +568,22 @@ std::tuple<std::string, FlakeRef, InstallableValue::DerivationInfo> InstallableF
     auto cache = openEvalCache(*state, lockedFlake);
     auto root = cache->getRoot();
 
+    Suggestions suggestions;
+
     for (auto & attrPath : getActualAttrPaths()) {
         debug("trying flake output attribute '%s'", attrPath);
 
-        auto attr = root->findAlongAttrPath(
+        auto attrOrSuggestions = root->findAlongAttrPath(
             parseAttrPath(*state, attrPath),
             true
         );
 
-        if (!attr) continue;
+        if (!attrOrSuggestions) {
+            suggestions += attrOrSuggestions.getSuggestions();
+            continue;
+        }
+
+        auto attr = *attrOrSuggestions;
 
         if (!attr->isDerivation())
             throw Error("flake output attribute '%s' is not a derivation", attrPath);
@@ -591,7 +598,7 @@ std::tuple<std::string, FlakeRef, InstallableValue::DerivationInfo> InstallableF
         return {attrPath, lockedFlake->flake.lockedRef, std::move(drvInfo)};
     }
 
-    throw Error("flake '%s' does not provide attribute %s",
+    throw Error(suggestions, "flake '%s' does not provide attribute %s",
         flakeRef, showAttrPaths(getActualAttrPaths()));
 }
 
@@ -642,7 +649,7 @@ InstallableFlake::getCursors(EvalState & state)
 
     for (auto & attrPath : getActualAttrPaths()) {
         auto attr = root->findAlongAttrPath(parseAttrPath(state, attrPath));
-        if (attr) res.push_back({attr, attrPath});
+        if (attr) res.push_back({*attr, attrPath});
     }
 
     return res;
diff --git a/src/libexpr/eval-cache.cc b/src/libexpr/eval-cache.cc
index 00d0749f9..188223957 100644
--- a/src/libexpr/eval-cache.cc
+++ b/src/libexpr/eval-cache.cc
@@ -406,6 +406,16 @@ Value & AttrCursor::forceValue()
     return v;
 }
 
+Suggestions AttrCursor::getSuggestionsForAttr(Symbol name)
+{
+    auto attrNames = getAttrs();
+    std::set<std::string> strAttrNames;
+    for (auto & name : attrNames)
+        strAttrNames.insert(std::string(name));
+
+    return Suggestions::bestMatches(strAttrNames, name);
+}
+
 std::shared_ptr<AttrCursor> AttrCursor::maybeGetAttr(Symbol name, bool forceErrors)
 {
     if (root->db) {
@@ -446,6 +456,11 @@ std::shared_ptr<AttrCursor> AttrCursor::maybeGetAttr(Symbol name, bool forceErro
         return nullptr;
         //throw TypeError("'%s' is not an attribute set", getAttrPathStr());
 
+    for (auto & attr : *v.attrs) {
+        if (root->db)
+            root->db->setPlaceholder({cachedValue->first, attr.name});
+    }
+
     auto attr = v.attrs->get(name);
 
     if (!attr) {
@@ -464,7 +479,7 @@ std::shared_ptr<AttrCursor> AttrCursor::maybeGetAttr(Symbol name, bool forceErro
         cachedValue2 = {root->db->setPlaceholder({cachedValue->first, name}), placeholder_t()};
     }
 
-    return std::make_shared<AttrCursor>(
+    return make_ref<AttrCursor>(
         root, std::make_pair(shared_from_this(), name), attr->value, std::move(cachedValue2));
 }
 
@@ -473,27 +488,31 @@ std::shared_ptr<AttrCursor> AttrCursor::maybeGetAttr(std::string_view name)
     return maybeGetAttr(root->state.symbols.create(name));
 }
 
-std::shared_ptr<AttrCursor> AttrCursor::getAttr(Symbol name, bool forceErrors)
+ref<AttrCursor> AttrCursor::getAttr(Symbol name, bool forceErrors)
 {
     auto p = maybeGetAttr(name, forceErrors);
     if (!p)
         throw Error("attribute '%s' does not exist", getAttrPathStr(name));
-    return p;
+    return ref(p);
 }
 
-std::shared_ptr<AttrCursor> AttrCursor::getAttr(std::string_view name)
+ref<AttrCursor> AttrCursor::getAttr(std::string_view name)
 {
     return getAttr(root->state.symbols.create(name));
 }
 
-std::shared_ptr<AttrCursor> AttrCursor::findAlongAttrPath(const std::vector<Symbol> & attrPath, bool force)
+OrSuggestions<ref<AttrCursor>> AttrCursor::findAlongAttrPath(const std::vector<Symbol> & attrPath, bool force)
 {
     auto res = shared_from_this();
     for (auto & attr : attrPath) {
-        res = res->maybeGetAttr(attr, force);
-        if (!res) return {};
+        auto child = res->maybeGetAttr(attr, force);
+        if (!child) {
+            auto suggestions = res->getSuggestionsForAttr(attr);
+            return OrSuggestions<ref<AttrCursor>>::failed(suggestions);
+        }
+        res = child;
     }
-    return res;
+    return ref(res);
 }
 
 std::string AttrCursor::getString()
diff --git a/src/libexpr/eval-cache.hh b/src/libexpr/eval-cache.hh
index 43b34ebcb..40f1d4ffc 100644
--- a/src/libexpr/eval-cache.hh
+++ b/src/libexpr/eval-cache.hh
@@ -94,15 +94,17 @@ public:
 
     std::string getAttrPathStr(Symbol name) const;
 
+    Suggestions getSuggestionsForAttr(Symbol name);
+
     std::shared_ptr<AttrCursor> maybeGetAttr(Symbol name, bool forceErrors = false);
 
     std::shared_ptr<AttrCursor> maybeGetAttr(std::string_view name);
 
-    std::shared_ptr<AttrCursor> getAttr(Symbol name, bool forceErrors = false);
+    ref<AttrCursor> getAttr(Symbol name, bool forceErrors = false);
 
-    std::shared_ptr<AttrCursor> getAttr(std::string_view name);
+    ref<AttrCursor> getAttr(std::string_view name);
 
-    std::shared_ptr<AttrCursor> findAlongAttrPath(const std::vector<Symbol> & attrPath, bool force = false);
+    OrSuggestions<ref<AttrCursor>> findAlongAttrPath(const std::vector<Symbol> & attrPath, bool force = false);
 
     std::string getString();
 
diff --git a/src/libutil/suggestions.hh b/src/libutil/suggestions.hh
index 76063a261..63426259d 100644
--- a/src/libutil/suggestions.hh
+++ b/src/libutil/suggestions.hh
@@ -40,4 +40,62 @@ public:
     Suggestions& operator+=(const Suggestions & other);
 };
 
+// Either a value of type `T`, or some suggestions
+template<typename T>
+class OrSuggestions {
+public:
+    using Raw = std::variant<T, Suggestions>;
+
+    Raw raw;
+
+    T* operator ->()
+    {
+        return &**this;
+    }
+
+    T& operator *()
+    {
+        if (auto elt = std::get_if<T>(&raw))
+            return *elt;
+        throw Error("Invalid access to a failed value");
+    }
+
+    operator bool() const noexcept
+    {
+        return std::holds_alternative<T>(raw);
+    }
+
+    OrSuggestions(T t)
+        : raw(t)
+    {
+    }
+
+    OrSuggestions()
+        : raw(Suggestions{})
+    {
+    }
+
+    static OrSuggestions<T> failed(const Suggestions & s)
+    {
+        auto res = OrSuggestions<T>();
+        res.raw = s;
+        return res;
+    }
+
+    static OrSuggestions<T> failed()
+    {
+        return OrSuggestions<T>::failed(Suggestions{});
+    }
+
+    const Suggestions & get_suggestions()
+    {
+        static Suggestions noSuggestions;
+        if (const auto & suggestions = std::get_if<Suggestions>(&raw))
+            return *suggestions;
+        else
+            return noSuggestions;
+    }
+
+};
+
 }

From 91635206c0d33f9862b788487aa8a056a791af94 Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Fri, 4 Mar 2022 10:29:48 +0100
Subject: [PATCH 110/251] Add some end-to-end tests for the suggestions

---
 tests/local.mk       |  5 +++--
 tests/suggestions.sh | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+), 2 deletions(-)
 create mode 100644 tests/suggestions.sh

diff --git a/tests/local.mk b/tests/local.mk
index c3a6aa1fc..8032fc38a 100644
--- a/tests/local.mk
+++ b/tests/local.mk
@@ -92,8 +92,9 @@ nix_tests = \
   bash-profile.sh \
   pass-as-file.sh \
   describe-stores.sh \
-  store-ping.sh \
-  nix-profile.sh
+  nix-profile.sh \
+  suggestions.sh \
+  store-ping.sh
 
 ifeq ($(HAVE_LIBCPUID), 1)
 	nix_tests += compute-levels.sh
diff --git a/tests/suggestions.sh b/tests/suggestions.sh
new file mode 100644
index 000000000..16a5a7004
--- /dev/null
+++ b/tests/suggestions.sh
@@ -0,0 +1,36 @@
+source common.sh
+
+clearStore
+
+cd "$TEST_HOME"
+
+cat <<EOF > flake.nix
+{
+    outputs = a: {
+       packages.$system = {
+         foo = 1;
+         fo1 = 1;
+         fo2 = 1;
+         fooo = 1;
+         foooo = 1;
+         fooooo = 1;
+         fooooo1 = 1;
+         fooooo2 = 1;
+         fooooo3 = 1;
+         fooooo4 = 1;
+         fooooo5 = 1;
+         fooooo6 = 1;
+       };
+    };
+}
+EOF
+
+# Probable typo in the requested attribute path. Suggest some close possibilities
+NIX_BUILD_STDERR_WITH_SUGGESTIONS=$(! nix build .\#fob 2>&1 1>/dev/null)
+[[ "$NIX_BUILD_STDERR_WITH_SUGGESTIONS" =~ "Did you mean one of fo1, fo2, foo or fooo?" ]] || \
+    fail "The nix build stderr should suggest the three closest possiblities"
+
+# None of the possible attributes is close to `bar`, so shouldn’t suggest anything
+NIX_BUILD_STDERR_WITH_NO_CLOSE_SUGGESTION=$(! nix build .\#bar 2>&1 1>/dev/null)
+[[ ! "$NIX_BUILD_STDERR_WITH_NO_CLOSE_SUGGESTION" =~ "Did you mean" ]] || \
+    fail "The nix build stderr shouldn’t suggest anything if there’s nothing relevant to suggest"

From b44cebd1fd68f89bbc2317e2b7978042309e17bb Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Fri, 4 Mar 2022 10:47:58 +0100
Subject: [PATCH 111/251] Add a release-notes entry for the cli suggestions

---
 doc/manual/src/release-notes/rl-next.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/doc/manual/src/release-notes/rl-next.md b/doc/manual/src/release-notes/rl-next.md
index 7dd8387d8..1a74dec95 100644
--- a/doc/manual/src/release-notes/rl-next.md
+++ b/doc/manual/src/release-notes/rl-next.md
@@ -26,3 +26,6 @@
 
 * Templates can now define a `welcomeText` attribute, which is printed out by
   `nix flake {init,new} --template <template>`.
+
+* Nix will now helpfully suggest some valid inputs when the user mistypes
+  something on the command-line

From fd45d85b4149a4d153d9c60f7f77244b3cf29ae3 Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Fri, 4 Mar 2022 13:42:43 +0100
Subject: [PATCH 112/251] Move OrSuggestions to its own header

Prevents a recursive inclusion
---
 src/libexpr/eval-cache.hh     |  1 +
 src/libutil/or-suggestions.hh | 64 +++++++++++++++++++++++++++++++++++
 src/libutil/suggestions.hh    | 59 --------------------------------
 3 files changed, 65 insertions(+), 59 deletions(-)
 create mode 100644 src/libutil/or-suggestions.hh

diff --git a/src/libexpr/eval-cache.hh b/src/libexpr/eval-cache.hh
index 40f1d4ffc..c0ca76bcf 100644
--- a/src/libexpr/eval-cache.hh
+++ b/src/libexpr/eval-cache.hh
@@ -3,6 +3,7 @@
 #include "sync.hh"
 #include "hash.hh"
 #include "eval.hh"
+#include "or-suggestions.hh"
 
 #include <functional>
 #include <variant>
diff --git a/src/libutil/or-suggestions.hh b/src/libutil/or-suggestions.hh
new file mode 100644
index 000000000..cb152a1e4
--- /dev/null
+++ b/src/libutil/or-suggestions.hh
@@ -0,0 +1,64 @@
+#include "suggestions.hh"
+#include "error.hh"
+
+namespace nix {
+
+// Either a value of type `T`, or some suggestions
+template<typename T>
+class OrSuggestions {
+public:
+    using Raw = std::variant<T, Suggestions>;
+
+    Raw raw;
+
+    T* operator ->()
+    {
+        return &**this;
+    }
+
+    T& operator *()
+    {
+        if (auto elt = std::get_if<T>(&raw))
+            return *elt;
+        throw Error("Invalid access to a failed value");
+    }
+
+    operator bool() const noexcept
+    {
+        return std::holds_alternative<T>(raw);
+    }
+
+    OrSuggestions(T t)
+        : raw(t)
+    {
+    }
+
+    OrSuggestions()
+        : raw(Suggestions{})
+    {
+    }
+
+    static OrSuggestions<T> failed(const Suggestions & s)
+    {
+        auto res = OrSuggestions<T>();
+        res.raw = s;
+        return res;
+    }
+
+    static OrSuggestions<T> failed()
+    {
+        return OrSuggestions<T>::failed(Suggestions{});
+    }
+
+    const Suggestions & getSuggestions()
+    {
+        static Suggestions noSuggestions;
+        if (const auto & suggestions = std::get_if<Suggestions>(&raw))
+            return *suggestions;
+        else
+            return noSuggestions;
+    }
+
+};
+
+}
diff --git a/src/libutil/suggestions.hh b/src/libutil/suggestions.hh
index 63426259d..705b4cd1c 100644
--- a/src/libutil/suggestions.hh
+++ b/src/libutil/suggestions.hh
@@ -39,63 +39,4 @@ public:
 
     Suggestions& operator+=(const Suggestions & other);
 };
-
-// Either a value of type `T`, or some suggestions
-template<typename T>
-class OrSuggestions {
-public:
-    using Raw = std::variant<T, Suggestions>;
-
-    Raw raw;
-
-    T* operator ->()
-    {
-        return &**this;
-    }
-
-    T& operator *()
-    {
-        if (auto elt = std::get_if<T>(&raw))
-            return *elt;
-        throw Error("Invalid access to a failed value");
-    }
-
-    operator bool() const noexcept
-    {
-        return std::holds_alternative<T>(raw);
-    }
-
-    OrSuggestions(T t)
-        : raw(t)
-    {
-    }
-
-    OrSuggestions()
-        : raw(Suggestions{})
-    {
-    }
-
-    static OrSuggestions<T> failed(const Suggestions & s)
-    {
-        auto res = OrSuggestions<T>();
-        res.raw = s;
-        return res;
-    }
-
-    static OrSuggestions<T> failed()
-    {
-        return OrSuggestions<T>::failed(Suggestions{});
-    }
-
-    const Suggestions & get_suggestions()
-    {
-        static Suggestions noSuggestions;
-        if (const auto & suggestions = std::get_if<Suggestions>(&raw))
-            return *suggestions;
-        else
-            return noSuggestions;
-    }
-
-};
-
 }

From 313bbc07a8ae9d72c5f728fde490f3cddcc5087b Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Mon, 7 Mar 2022 10:04:57 +0100
Subject: [PATCH 113/251] Implement `operator<<` for Suggestions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

That way there’s no need to explicitely convert it to a string when
printing it
---
 src/libutil/error.cc       |  2 +-
 src/libutil/suggestions.cc | 20 +++++++++++++++-----
 src/libutil/suggestions.hh |  7 +++++--
 3 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/src/libutil/error.cc b/src/libutil/error.cc
index 15ae7a759..b2dfb35b2 100644
--- a/src/libutil/error.cc
+++ b/src/libutil/error.cc
@@ -285,7 +285,7 @@ std::ostream & showErrorInfo(std::ostream & out, const ErrorInfo & einfo, bool s
     auto suggestions = einfo.suggestions.trim();
     if (! suggestions.suggestions.empty()){
         oss << "Did you mean " <<
-            suggestions.trim().pretty_print() <<
+            suggestions.trim() <<
             "?" << std::endl;
     }
 
diff --git a/src/libutil/suggestions.cc b/src/libutil/suggestions.cc
index bcd93aa6b..9510a5f0c 100644
--- a/src/libutil/suggestions.cc
+++ b/src/libutil/suggestions.cc
@@ -65,27 +65,27 @@ Suggestions Suggestions::trim(int limit, int maxDistance) const
     return Suggestions{res};
 }
 
-std::string Suggestion::pretty_print() const
+std::string Suggestion::to_string() const
 {
     return ANSI_WARNING + filterANSIEscapes(suggestion) + ANSI_NORMAL;
 }
 
-std::string Suggestions::pretty_print() const
+std::string Suggestions::to_string() const
 {
     switch (suggestions.size()) {
         case 0:
             return "";
         case 1:
-            return suggestions.begin()->pretty_print();
+            return suggestions.begin()->to_string();
         default: {
             std::string res = "one of ";
             auto iter = suggestions.begin();
-            res += iter->pretty_print(); // Iter can’t be end() because the container isn’t null
+            res += iter->to_string(); // Iter can’t be end() because the container isn’t null
             iter++;
             auto last = suggestions.end(); last--;
             for ( ; iter != suggestions.end() ; iter++) {
                 res += (iter == last) ? " or " : ", ";
-                res += iter->pretty_print();
+                res += iter->to_string();
             }
             return res;
         }
@@ -101,4 +101,14 @@ Suggestions & Suggestions::operator+=(const Suggestions & other)
     return *this;
 }
 
+std::ostream & operator<<(std::ostream & str, const Suggestion & suggestion)
+{
+    return str << suggestion.to_string();
+}
+
+std::ostream & operator<<(std::ostream & str, const Suggestions & suggestions)
+{
+    return str << suggestions.to_string();
+}
+
 }
diff --git a/src/libutil/suggestions.hh b/src/libutil/suggestions.hh
index 705b4cd1c..d8f36cb24 100644
--- a/src/libutil/suggestions.hh
+++ b/src/libutil/suggestions.hh
@@ -16,7 +16,7 @@ public:
     int distance; // The smaller the better
     std::string suggestion;
 
-    std::string pretty_print() const;
+    std::string to_string() const;
 
     GENERATE_CMP(Suggestion, me->distance, me->suggestion)
 };
@@ -25,7 +25,7 @@ class Suggestions {
 public:
     std::set<Suggestion> suggestions;
 
-    std::string pretty_print() const;
+    std::string to_string() const;
 
     Suggestions trim(
         int limit = 5,
@@ -39,4 +39,7 @@ public:
 
     Suggestions& operator+=(const Suggestions & other);
 };
+
+std::ostream & operator<<(std::ostream & str, const Suggestion &);
+std::ostream & operator<<(std::ostream & str, const Suggestions &);
 }

From c28e2b1b2982451bafee9afede094affb08ea130 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 7 Mar 2022 11:30:40 +0100
Subject: [PATCH 114/251] Tweak release notes

---
 doc/manual/src/release-notes/rl-next.md | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/doc/manual/src/release-notes/rl-next.md b/doc/manual/src/release-notes/rl-next.md
index 7dd8387d8..80a20278e 100644
--- a/doc/manual/src/release-notes/rl-next.md
+++ b/doc/manual/src/release-notes/rl-next.md
@@ -13,10 +13,11 @@
   The old flake output attributes still work, but `nix flake check`
   will warn about them.
 
-* `nix bundle` breaking API change now supports bundlers of the form
-  `bundler.<system>.<name>= derivation: another-derivation;`. This supports
-  additional functionality to inspect evaluation information during bundling. A
-  new [repository](https://github.com/NixOS/bundlers) has various bundlers
+* Breaking API change: `nix bundle` now supports bundlers of the form
+  `bundler.<system>.<name>= derivation: another-derivation;`. This
+  supports additional functionality to inspect evaluation information
+  during bundling. A new
+  [repository](https://github.com/NixOS/bundlers) has various bundlers
   implemented.
 
 * `nix store ping` now reports the version of the remote Nix daemon.

From 1b978596b575bda096a9e896a5cc3502943e5a60 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 26 Feb 2022 02:30:11 +0100
Subject: [PATCH 115/251] Value::mkString: Avoid crash from null string_view

---
 src/libexpr/eval.cc | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 2d7309738..b954e7bd9 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -805,7 +805,13 @@ LocalNoInline(void addErrorTrace(Error & e, const Pos & pos, const char * s, con
 
 void Value::mkString(std::string_view s)
 {
-    mkString(dupStringWithLen(s.data(), s.size()));
+    if (s.size() == 0) {
+        // s.data() may not be valid and we don't need to allocate.
+        mkString("");
+    }
+    else {
+        mkString(dupStringWithLen(s.data(), s.size()));
+    }
 }
 
 

From bbf55383e7a9914cf79b8879e234f444cc774bfa Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 26 Feb 2022 02:30:29 +0100
Subject: [PATCH 116/251] Value::mkPath: Avoid potential crash from null
 string_view

---
 src/libexpr/eval.cc | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index b954e7bd9..7f82aa5f4 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -842,7 +842,14 @@ void Value::mkStringMove(const char * s, const PathSet & context)
 
 void Value::mkPath(std::string_view s)
 {
-    mkPath(dupStringWithLen(s.data(), s.size()));
+    if (s.size() == 0) {
+        // Pathological, but better than crashing in dupStringWithLen, as
+        // s.data() may be null.
+        mkPath("");
+    }
+    else {
+        mkPath(dupStringWithLen(s.data(), s.size()));
+    }
 }
 
 

From da260f579d5f4a66d6d0d0e1297b69666d049d03 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 27 Feb 2022 12:50:18 +0100
Subject: [PATCH 117/251] dupStringWithLen -> makeImmutableString

Refactor the `size == 0` logic into a new helper function that
replaces dupStringWithLen.
The name had to change, because unlike a `dup`-function, it does
not always allocate a new string.
---
 src/libexpr/eval.cc | 29 +++++++++++++----------------
 1 file changed, 13 insertions(+), 16 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 7f82aa5f4..5bf161cc0 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -63,9 +63,15 @@ static char * dupString(const char * s)
 }
 
 
-static char * dupStringWithLen(const char * s, size_t size)
+// When there's no need to write to the string, we can optimize away empty
+// string allocations.
+// This function handles makeImmutableStringWithLen(null, 0) by returning the
+// empty string.
+static const char * makeImmutableStringWithLen(const char * s, size_t size)
 {
     char * t;
+    if (size == 0)
+        return "";
 #if HAVE_BOEHMGC
     t = GC_STRNDUP(s, size);
 #else
@@ -75,6 +81,10 @@ static char * dupStringWithLen(const char * s, size_t size)
     return t;
 }
 
+static inline const char * makeImmutableString(std::string_view s) {
+    return makeImmutableStringWithLen(s.data(), s.size());
+}
+
 
 RootValue allocRootValue(Value * v)
 {
@@ -805,13 +815,7 @@ LocalNoInline(void addErrorTrace(Error & e, const Pos & pos, const char * s, con
 
 void Value::mkString(std::string_view s)
 {
-    if (s.size() == 0) {
-        // s.data() may not be valid and we don't need to allocate.
-        mkString("");
-    }
-    else {
-        mkString(dupStringWithLen(s.data(), s.size()));
-    }
+    mkString(makeImmutableString(s));
 }
 
 
@@ -842,14 +846,7 @@ void Value::mkStringMove(const char * s, const PathSet & context)
 
 void Value::mkPath(std::string_view s)
 {
-    if (s.size() == 0) {
-        // Pathological, but better than crashing in dupStringWithLen, as
-        // s.data() may be null.
-        mkPath("");
-    }
-    else {
-        mkPath(dupStringWithLen(s.data(), s.size()));
-    }
+    mkPath(makeImmutableString(s));
 }
 
 

From dcf4f77fac8bc214afd4851b367ce386f0a34658 Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Mon, 7 Mar 2022 17:45:35 +0100
Subject: [PATCH 118/251] Merge `or-suggestions.hh` into `suggestions.hh`

No real need for keeping a separate header for such a simple class.

This requires changing a bit `OrSuggestions<T>::operator*` to not throw
an `Error` to prevent a cyclic dependency. But since this error is only
thrown on programmer error, we can replace the whole method by a direct
call to `std::get` which will raise its own assertion if needs be.
---
 src/libexpr/eval-cache.hh     |  1 -
 src/libutil/or-suggestions.hh | 64 -----------------------------------
 src/libutil/suggestions.hh    | 57 +++++++++++++++++++++++++++++++
 3 files changed, 57 insertions(+), 65 deletions(-)
 delete mode 100644 src/libutil/or-suggestions.hh

diff --git a/src/libexpr/eval-cache.hh b/src/libexpr/eval-cache.hh
index c0ca76bcf..40f1d4ffc 100644
--- a/src/libexpr/eval-cache.hh
+++ b/src/libexpr/eval-cache.hh
@@ -3,7 +3,6 @@
 #include "sync.hh"
 #include "hash.hh"
 #include "eval.hh"
-#include "or-suggestions.hh"
 
 #include <functional>
 #include <variant>
diff --git a/src/libutil/or-suggestions.hh b/src/libutil/or-suggestions.hh
deleted file mode 100644
index cb152a1e4..000000000
--- a/src/libutil/or-suggestions.hh
+++ /dev/null
@@ -1,64 +0,0 @@
-#include "suggestions.hh"
-#include "error.hh"
-
-namespace nix {
-
-// Either a value of type `T`, or some suggestions
-template<typename T>
-class OrSuggestions {
-public:
-    using Raw = std::variant<T, Suggestions>;
-
-    Raw raw;
-
-    T* operator ->()
-    {
-        return &**this;
-    }
-
-    T& operator *()
-    {
-        if (auto elt = std::get_if<T>(&raw))
-            return *elt;
-        throw Error("Invalid access to a failed value");
-    }
-
-    operator bool() const noexcept
-    {
-        return std::holds_alternative<T>(raw);
-    }
-
-    OrSuggestions(T t)
-        : raw(t)
-    {
-    }
-
-    OrSuggestions()
-        : raw(Suggestions{})
-    {
-    }
-
-    static OrSuggestions<T> failed(const Suggestions & s)
-    {
-        auto res = OrSuggestions<T>();
-        res.raw = s;
-        return res;
-    }
-
-    static OrSuggestions<T> failed()
-    {
-        return OrSuggestions<T>::failed(Suggestions{});
-    }
-
-    const Suggestions & getSuggestions()
-    {
-        static Suggestions noSuggestions;
-        if (const auto & suggestions = std::get_if<Suggestions>(&raw))
-            return *suggestions;
-        else
-            return noSuggestions;
-    }
-
-};
-
-}
diff --git a/src/libutil/suggestions.hh b/src/libutil/suggestions.hh
index d8f36cb24..d54dd8e31 100644
--- a/src/libutil/suggestions.hh
+++ b/src/libutil/suggestions.hh
@@ -42,4 +42,61 @@ public:
 
 std::ostream & operator<<(std::ostream & str, const Suggestion &);
 std::ostream & operator<<(std::ostream & str, const Suggestions &);
+
+// Either a value of type `T`, or some suggestions
+template<typename T>
+class OrSuggestions {
+public:
+    using Raw = std::variant<T, Suggestions>;
+
+    Raw raw;
+
+    T* operator ->()
+    {
+        return &**this;
+    }
+
+    T& operator *()
+    {
+        return std::get<T>(raw);
+    }
+
+    operator bool() const noexcept
+    {
+        return std::holds_alternative<T>(raw);
+    }
+
+    OrSuggestions(T t)
+        : raw(t)
+    {
+    }
+
+    OrSuggestions()
+        : raw(Suggestions{})
+    {
+    }
+
+    static OrSuggestions<T> failed(const Suggestions & s)
+    {
+        auto res = OrSuggestions<T>();
+        res.raw = s;
+        return res;
+    }
+
+    static OrSuggestions<T> failed()
+    {
+        return OrSuggestions<T>::failed(Suggestions{});
+    }
+
+    const Suggestions & getSuggestions()
+    {
+        static Suggestions noSuggestions;
+        if (const auto & suggestions = std::get_if<Suggestions>(&raw))
+            return *suggestions;
+        else
+            return noSuggestions;
+    }
+
+};
+
 }

From 436c6e900f59a40dd6224c209417333265e641e7 Mon Sep 17 00:00:00 2001
From: Guillaume Desforges <guillaume.desforges.pro@gmail.com>
Date: Mon, 7 Mar 2022 17:57:52 +0100
Subject: [PATCH 119/251] Explicit error in flake init/new when not in store

---
 src/nix/flake.cc | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 144f8f886..6d5ee61be 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -706,9 +706,15 @@ struct CmdFlakeInitCommon : virtual Args, EvalCommand
 
         auto [cursor, attrPath] = installable.getCursor(*evalState);
 
-        auto templateDir = cursor->getAttr("path")->getString();
+        auto templateDirAttr = cursor->getAttr("path");
+        auto templateDir = templateDirAttr->getString();
 
-        assert(store->isInStore(templateDir));
+        if (!store->isInStore(templateDir)) {
+            throw TypeError(
+                std::string("'%s' was not found in the Nix store\n") +
+                "If you've set '%s' to a string, try using a path instead.",
+                templateDir, templateDirAttr->getAttrPathStr());
+        }
 
         std::vector<Path> files;
 

From 0123b9aec8fe83738f0bf7625119a20e347a7366 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 7 Mar 2022 19:56:10 +0100
Subject: [PATCH 120/251] Tweak release notes

---
 doc/manual/src/release-notes/rl-next.md | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/doc/manual/src/release-notes/rl-next.md b/doc/manual/src/release-notes/rl-next.md
index ae37ac3be..aacbdc86e 100644
--- a/doc/manual/src/release-notes/rl-next.md
+++ b/doc/manual/src/release-notes/rl-next.md
@@ -1,5 +1,9 @@
 # Release X.Y (202?-??-??)
 
+* Nix will now make some helpful suggestions when you mistype
+  something on the command line. For instance, if you type `nix build
+  nixpkgs#thunderbrd`, it will suggest `thunderbird`.
+
 * A number of "default" flake output attributes have been
   renamed. These are:
 
@@ -27,6 +31,3 @@
 
 * Templates can now define a `welcomeText` attribute, which is printed out by
   `nix flake {init,new} --template <template>`.
-
-* Nix will now helpfully suggest some valid inputs when the user mistypes
-  something on the command-line

From 504e3b2a8f726227cfbc7cad1781e6848510e26d Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 7 Mar 2022 20:07:43 +0100
Subject: [PATCH 121/251] Style

---
 src/nix/flake.cc | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 6d5ee61be..47a380238 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -709,12 +709,11 @@ struct CmdFlakeInitCommon : virtual Args, EvalCommand
         auto templateDirAttr = cursor->getAttr("path");
         auto templateDir = templateDirAttr->getString();
 
-        if (!store->isInStore(templateDir)) {
+        if (!store->isInStore(templateDir))
             throw TypeError(
-                std::string("'%s' was not found in the Nix store\n") +
+                "'%s' was not found in the Nix store\n"
                 "If you've set '%s' to a string, try using a path instead.",
                 templateDir, templateDirAttr->getAttrPathStr());
-        }
 
         std::vector<Path> files;
 

From ad7c99ef20dff74a65d6c8ac2a2c42f538e0a1dd Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 7 Mar 2022 20:10:18 +0100
Subject: [PATCH 122/251] Move rl-next.md to rl-2.7.md

---
 doc/manual/src/SUMMARY.md.in            |  1 +
 doc/manual/src/release-notes/rl-2.7.md  | 33 +++++++++++++++++++++++++
 doc/manual/src/release-notes/rl-next.md | 32 ------------------------
 3 files changed, 34 insertions(+), 32 deletions(-)
 create mode 100644 doc/manual/src/release-notes/rl-2.7.md

diff --git a/doc/manual/src/SUMMARY.md.in b/doc/manual/src/SUMMARY.md.in
index 4e2afa20e..f0f9457d2 100644
--- a/doc/manual/src/SUMMARY.md.in
+++ b/doc/manual/src/SUMMARY.md.in
@@ -72,6 +72,7 @@
   - [CLI guideline](contributing/cli-guideline.md)
 - [Release Notes](release-notes/release-notes.md)
   - [Release X.Y (202?-??-??)](release-notes/rl-next.md)
+  - [Release 2.7 (2022-03-07)](release-notes/rl-2.7.md)
   - [Release 2.6 (2022-01-24)](release-notes/rl-2.6.md)
   - [Release 2.5 (2021-12-13)](release-notes/rl-2.5.md)
   - [Release 2.4 (2021-11-01)](release-notes/rl-2.4.md)
diff --git a/doc/manual/src/release-notes/rl-2.7.md b/doc/manual/src/release-notes/rl-2.7.md
new file mode 100644
index 000000000..dc92a9cde
--- /dev/null
+++ b/doc/manual/src/release-notes/rl-2.7.md
@@ -0,0 +1,33 @@
+# Release X.Y (2022-03-07)
+
+* Nix will now make some helpful suggestions when you mistype
+  something on the command line. For instance, if you type `nix build
+  nixpkgs#thunderbrd`, it will suggest `thunderbird`.
+
+* A number of "default" flake output attributes have been
+  renamed. These are:
+
+  * `defaultPackage.<system>` → `packages.<system>.default`
+  * `defaultApps.<system>` → `apps.<system>.default`
+  * `defaultTemplate` → `templates.default`
+  * `defaultBundler.<system>` → `bundlers.<system>.default`
+  * `overlay` → `overlays.default`
+  * `devShell.<system>` → `devShells.<system>.default`
+
+  The old flake output attributes still work, but `nix flake check`
+  will warn about them.
+
+* Breaking API change: `nix bundle` now supports bundlers of the form
+  `bundler.<system>.<name>= derivation: another-derivation;`. This
+  supports additional functionality to inspect evaluation information
+  during bundling. A new
+  [repository](https://github.com/NixOS/bundlers) has various bundlers
+  implemented.
+
+* `nix store ping` now reports the version of the remote Nix daemon.
+
+* `nix flake {init,new}` now display information about which files have been
+  created.
+
+* Templates can now define a `welcomeText` attribute, which is printed out by
+  `nix flake {init,new} --template <template>`.
diff --git a/doc/manual/src/release-notes/rl-next.md b/doc/manual/src/release-notes/rl-next.md
index aacbdc86e..c869b5e2f 100644
--- a/doc/manual/src/release-notes/rl-next.md
+++ b/doc/manual/src/release-notes/rl-next.md
@@ -1,33 +1 @@
 # Release X.Y (202?-??-??)
-
-* Nix will now make some helpful suggestions when you mistype
-  something on the command line. For instance, if you type `nix build
-  nixpkgs#thunderbrd`, it will suggest `thunderbird`.
-
-* A number of "default" flake output attributes have been
-  renamed. These are:
-
-  * `defaultPackage.<system>` → `packages.<system>.default`
-  * `defaultApps.<system>` → `apps.<system>.default`
-  * `defaultTemplate` → `templates.default`
-  * `defaultBundler.<system>` → `bundlers.<system>.default`
-  * `overlay` → `overlays.default`
-  * `devShell.<system>` → `devShells.<system>.default`
-
-  The old flake output attributes still work, but `nix flake check`
-  will warn about them.
-
-* Breaking API change: `nix bundle` now supports bundlers of the form
-  `bundler.<system>.<name>= derivation: another-derivation;`. This
-  supports additional functionality to inspect evaluation information
-  during bundling. A new
-  [repository](https://github.com/NixOS/bundlers) has various bundlers
-  implemented.
-
-* `nix store ping` now reports the version of the remote Nix daemon.
-
-* `nix flake {init,new}` now display information about which files have been
-  created.
-
-* Templates can now define a `welcomeText` attribute, which is printed out by
-  `nix flake {init,new} --template <template>`.

From 92b8d4d8861b908a7ec500526a84155c597d6d2b Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 7 Mar 2022 20:12:35 +0100
Subject: [PATCH 123/251] Bump version

---
 .version | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.version b/.version
index 9aa34646d..6533b6687 100644
--- a/.version
+++ b/.version
@@ -1 +1 @@
-2.7.0
\ No newline at end of file
+2.8.0
\ No newline at end of file

From 0c6e46e34965ba0db4e0b755ee473868a4fef21f Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Tue, 8 Mar 2022 06:16:51 +0100
Subject: [PATCH 124/251] Add some suggestions to the evaluator
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Make the evaluator show some suggestions when trying to access an
invalid field from an attrset.

```console
$ nix eval --expr '{ foo = 1; }.foa'
error: attribute 'foa' missing

       at «string»:1:1:

            1| { foo = 1; }.foa
             | ^
       Did you mean foo?
```
---
 src/libexpr/eval.cc  | 20 ++++++++++++++++++--
 tests/suggestions.sh |  4 ++++
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 5bf161cc0..1d88e8709 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -727,6 +727,15 @@ LocalNoInlineNoReturn(void throwEvalError(const char * s, const std::string & s2
     throw EvalError(s, s2);
 }
 
+LocalNoInlineNoReturn(void throwEvalError(const Pos & pos, const Suggestions & suggestions, const char * s, const std::string & s2))
+{
+    throw EvalError({
+        .msg = hintfmt(s, s2),
+        .errPos = pos,
+        .suggestions = suggestions,
+    });
+}
+
 LocalNoInlineNoReturn(void throwEvalError(const Pos & pos, const char * s, const std::string & s2))
 {
     throw EvalError({
@@ -1281,8 +1290,15 @@ void ExprSelect::eval(EvalState & state, Env & env, Value & v)
                 }
             } else {
                 state.forceAttrs(*vAttrs, pos);
-                if ((j = vAttrs->attrs->find(name)) == vAttrs->attrs->end())
-                    throwEvalError(pos, "attribute '%1%' missing", name);
+                if ((j = vAttrs->attrs->find(name)) == vAttrs->attrs->end()) {
+                    std::set<std::string> allAttrNames;
+                    for (auto & attr : *vAttrs->attrs)
+                        allAttrNames.insert(attr.name);
+                    throwEvalError(
+                        pos,
+                        Suggestions::bestMatches(allAttrNames, name),
+                        "attribute '%1%' missing", name);
+                }
             }
             vAttrs = j->value;
             pos2 = j->pos;
diff --git a/tests/suggestions.sh b/tests/suggestions.sh
index 16a5a7004..29d5b364b 100644
--- a/tests/suggestions.sh
+++ b/tests/suggestions.sh
@@ -34,3 +34,7 @@ NIX_BUILD_STDERR_WITH_SUGGESTIONS=$(! nix build .\#fob 2>&1 1>/dev/null)
 NIX_BUILD_STDERR_WITH_NO_CLOSE_SUGGESTION=$(! nix build .\#bar 2>&1 1>/dev/null)
 [[ ! "$NIX_BUILD_STDERR_WITH_NO_CLOSE_SUGGESTION" =~ "Did you mean" ]] || \
     fail "The nix build stderr shouldn’t suggest anything if there’s nothing relevant to suggest"
+
+NIX_EVAL_STDERR_WITH_SUGGESTIONS=$(! nix build --impure --expr '(builtins.getFlake (builtins.toPath ./.)).packages.'$system'.fob' 2>&1 1>/dev/null)
+[[ "$NIX_EVAL_STDERR_WITH_SUGGESTIONS" =~ "Did you mean one of fo1, fo2, foo or fooo?" ]] || \
+    fail "The evaluator should suggest the three closest possiblities"

From 33b7514035a967df2ab61ab9770627157aa4f5c5 Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Tue, 8 Mar 2022 16:07:17 +0100
Subject: [PATCH 125/251] Try and make the darwin build happy

---
 src/libexpr/eval.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 1d88e8709..3bfb82b16 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -729,7 +729,7 @@ LocalNoInlineNoReturn(void throwEvalError(const char * s, const std::string & s2
 
 LocalNoInlineNoReturn(void throwEvalError(const Pos & pos, const Suggestions & suggestions, const char * s, const std::string & s2))
 {
-    throw EvalError({
+    throw EvalError(ErrorInfo {
         .msg = hintfmt(s, s2),
         .errPos = pos,
         .suggestions = suggestions,
@@ -738,7 +738,7 @@ LocalNoInlineNoReturn(void throwEvalError(const Pos & pos, const Suggestions & s
 
 LocalNoInlineNoReturn(void throwEvalError(const Pos & pos, const char * s, const std::string & s2))
 {
-    throw EvalError({
+    throw EvalError(ErrorInfo {
         .msg = hintfmt(s, s2),
         .errPos = pos
     });

From f6078e474d5fc41c8a7f683865d60490bf0c7040 Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Tue, 8 Mar 2022 16:20:01 +0100
Subject: [PATCH 126/251] Also display some suggestions for invalid formal
 arguments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

```console
$ nix eval --expr '({ foo ? 1 }: foo) { fob = 2; }'
error: anonymous function at (string):1:2 called with unexpected argument 'fob'

       at «string»:1:1:

            1| ({ foo ? 1 }: foo) { fob = 2; }
             | ^
       Did you mean foo?
```

Not that because Nix will first check for _missing_ arguments before
checking for extra arguments, `({ foo }: foo) { fob = 1; }` will
complain about the missing `foo` argument (rather than extra `fob`) and
so won’t display a suggestion.
---
 src/libexpr/eval.cc  | 23 +++++++++++++++++++++--
 tests/suggestions.sh |  4 ++++
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 3bfb82b16..a5e9dc286 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -782,6 +782,16 @@ LocalNoInlineNoReturn(void throwTypeError(const Pos & pos, const char * s, const
     });
 }
 
+LocalNoInlineNoReturn(void throwTypeError(const Pos & pos, const Suggestions & suggestions, const char * s, const ExprLambda & fun, const Symbol & s2))
+{
+    throw TypeError(ErrorInfo {
+        .msg = hintfmt(s, fun.showNamePos(), s2),
+        .errPos = pos,
+        .suggestions = suggestions,
+    });
+}
+
+
 LocalNoInlineNoReturn(void throwTypeError(const char * s, const Value & v))
 {
     throw TypeError(s, showType(v));
@@ -1414,8 +1424,17 @@ void EvalState::callFunction(Value & fun, size_t nrArgs, Value * * args, Value &
                     /* Nope, so show the first unexpected argument to the
                        user. */
                     for (auto & i : *args[0]->attrs)
-                        if (!lambda.formals->has(i.name))
-                            throwTypeError(pos, "%1% called with unexpected argument '%2%'", lambda, i.name);
+                        if (!lambda.formals->has(i.name)) {
+                            std::set<std::string> formalNames;
+                            for (auto & formal : lambda.formals->formals)
+                                formalNames.insert(formal.name);
+                            throwTypeError(
+                                pos,
+                                Suggestions::bestMatches(formalNames, i.name),
+                                "%1% called with unexpected argument '%2%'",
+                                lambda,
+                                i.name);
+                        }
                     abort(); // can't happen
                 }
             }
diff --git a/tests/suggestions.sh b/tests/suggestions.sh
index 29d5b364b..f18fefef9 100644
--- a/tests/suggestions.sh
+++ b/tests/suggestions.sh
@@ -38,3 +38,7 @@ NIX_BUILD_STDERR_WITH_NO_CLOSE_SUGGESTION=$(! nix build .\#bar 2>&1 1>/dev/null)
 NIX_EVAL_STDERR_WITH_SUGGESTIONS=$(! nix build --impure --expr '(builtins.getFlake (builtins.toPath ./.)).packages.'$system'.fob' 2>&1 1>/dev/null)
 [[ "$NIX_EVAL_STDERR_WITH_SUGGESTIONS" =~ "Did you mean one of fo1, fo2, foo or fooo?" ]] || \
     fail "The evaluator should suggest the three closest possiblities"
+
+NIX_EVAL_STDERR_WITH_SUGGESTIONS=$(! nix build --impure --expr '({ foo }: foo) { foo = 1; fob = 2; }' 2>&1 1>/dev/null)
+[[ "$NIX_EVAL_STDERR_WITH_SUGGESTIONS" =~ "Did you mean foo?" ]] || \
+    fail "The evaluator should suggest the three closest possiblities"

From a4604f19284254ac98f19a13ff7c2216de7fe176 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 8 Mar 2022 19:50:46 +0100
Subject: [PATCH 127/251] Add Store::buildPathsWithResults()

This function is like buildPaths(), except that it returns a vector of
BuildResults containing the exact statuses and output paths of each
derivation / substitution. This is convenient for functions like
Installable::build(), because they then don't need to do another
series of calls to get the outputs of CA derivations. It's also a
precondition to impure derivations, where we *can't* query the output
of those derivations since they're not stored in the Nix database.

Note that PathSubstitutionGoal can now also return a BuildStatus.
---
 src/libcmd/installables.cc                    |  33 +++-
 src/libstore/build-result.hh                  |  14 +-
 src/libstore/build/derivation-goal.cc         | 177 +++++++++---------
 src/libstore/build/derivation-goal.hh         |  31 ++-
 .../build/drv-output-substitution-goal.cc     |   4 +-
 src/libstore/build/entry-points.cc            |  51 ++---
 src/libstore/build/goal.hh                    |   4 +
 src/libstore/build/local-derivation-goal.cc   |  94 ++++++----
 src/libstore/build/local-derivation-goal.hh   |   2 +-
 src/libstore/build/substitution-goal.cc       |  18 +-
 src/libstore/build/substitution-goal.hh       |   2 +
 src/libstore/daemon.cc                        |  19 ++
 src/libstore/remote-store.cc                  | 126 ++++++++++++-
 src/libstore/remote-store.hh                  |   8 +
 src/libstore/store-api.hh                     |  10 +
 src/libstore/worker-protocol.hh               |   4 +-
 16 files changed, 411 insertions(+), 186 deletions(-)

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index 03f3bd409..d1ed19acf 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -12,6 +12,7 @@
 #include "eval-cache.hh"
 #include "url.hh"
 #include "registry.hh"
+#include "build-result.hh"
 
 #include <regex>
 #include <queue>
@@ -769,8 +770,7 @@ BuiltPaths getBuiltPaths(ref<Store> evalStore, ref<Store> store, const DerivedPa
                             throw Error(
                                 "the derivation '%s' doesn't have an output named '%s'",
                                 store->printStorePath(bfd.drvPath), output);
-                        if (settings.isExperimentalFeatureEnabled(
-                                Xp::CaDerivations)) {
+                        if (settings.isExperimentalFeatureEnabled(Xp::CaDerivations)) {
                             auto outputId =
                                 DrvOutput{outputHashes.at(output), output};
                             auto realisation =
@@ -816,12 +816,31 @@ BuiltPaths Installable::build(
         pathsToBuild.insert(pathsToBuild.end(), b.begin(), b.end());
     }
 
-    if (mode == Realise::Nothing || mode == Realise::Derivation)
+    switch (mode) {
+    case Realise::Nothing:
+    case Realise::Derivation:
         printMissing(store, pathsToBuild, lvlError);
-    else if (mode == Realise::Outputs)
-        store->buildPaths(pathsToBuild, bMode, evalStore);
-
-    return getBuiltPaths(evalStore, store, pathsToBuild);
+        return getBuiltPaths(evalStore, store, pathsToBuild);
+    case Realise::Outputs: {
+        BuiltPaths res;
+        for (auto & buildResult : store->buildPathsWithResults(pathsToBuild, bMode, evalStore)) {
+            if (!buildResult.success())
+                buildResult.rethrow();
+            if (buildResult.drvPath) {
+                std::map<std::string, StorePath> outputs;
+                for (auto & path : buildResult.builtOutputs)
+                    outputs.emplace(path.first.outputName, path.second.outPath);
+                res.push_back(BuiltPath::Built{*buildResult.drvPath, outputs});
+            } else if (buildResult.outPath) {
+                res.push_back(BuiltPath::Opaque{*buildResult.outPath});
+            } else
+                abort();
+        }
+        return res;
+    }
+    default:
+        assert(false);
+    }
 }
 
 BuiltPaths Installable::toBuiltPaths(
diff --git a/src/libstore/build-result.hh b/src/libstore/build-result.hh
index 018ba31b3..c16027808 100644
--- a/src/libstore/build-result.hh
+++ b/src/libstore/build-result.hh
@@ -28,6 +28,7 @@ struct BuildResult
         LogLimitExceeded,
         NotDeterministic,
         ResolvesToAlreadyValid,
+        NoSubstituters,
     } status = MiscFailure;
     std::string errorMsg;
 
@@ -63,15 +64,26 @@ struct BuildResult
        non-determinism.) */
     bool isNonDeterministic = false;
 
+    /* For derivations, the derivation path and the wanted outputs. */
+    std::optional<StorePath> drvPath;
     DrvOutputs builtOutputs;
 
+    /* For substitutions, the substituted path. */
+    std::optional<StorePath> outPath;
+
     /* The start/stop times of the build (or one of the rounds, if it
        was repeated). */
     time_t startTime = 0, stopTime = 0;
 
-    bool success() {
+    bool success()
+    {
         return status == Built || status == Substituted || status == AlreadyValid || status == ResolvesToAlreadyValid;
     }
+
+    void rethrow()
+    {
+        throw Error("%s", errorMsg);
+    }
 };
 
 }
diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index ae250ffaf..cd582bb01 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -135,7 +135,7 @@ void DerivationGoal::killChild()
 void DerivationGoal::timedOut(Error && ex)
 {
     killChild();
-    done(BuildResult::TimedOut, ex);
+    done(BuildResult::TimedOut, {}, ex);
 }
 
 
@@ -182,7 +182,7 @@ void DerivationGoal::loadDerivation()
     trace("loading derivation");
 
     if (nrFailed != 0) {
-        done(BuildResult::MiscFailure, Error("cannot build missing derivation '%s'", worker.store.printStorePath(drvPath)));
+        done(BuildResult::MiscFailure, {}, Error("cannot build missing derivation '%s'", worker.store.printStorePath(drvPath)));
         return;
     }
 
@@ -215,28 +215,20 @@ void DerivationGoal::haveDerivation()
 
     auto outputHashes = staticOutputHashes(worker.evalStore, *drv);
     for (auto & [outputName, outputHash] : outputHashes)
-      initialOutputs.insert({
+        initialOutputs.insert({
             outputName,
-            InitialOutput{
+            InitialOutput {
                 .wanted = true, // Will be refined later
                 .outputHash = outputHash
             }
-          });
+        });
 
     /* Check what outputs paths are not already valid. */
-    checkPathValidity();
-    bool allValid = true;
-    for (auto & [_, status] : initialOutputs) {
-        if (!status.wanted) continue;
-        if (!status.known || !status.known->isValid()) {
-            allValid = false;
-            break;
-        }
-    }
+    auto [allValid, validOutputs] = checkPathValidity();
 
     /* If they are all valid, then we're done. */
     if (allValid && buildMode == bmNormal) {
-        done(BuildResult::AlreadyValid);
+        done(BuildResult::AlreadyValid, std::move(validOutputs));
         return;
     }
 
@@ -277,7 +269,7 @@ void DerivationGoal::outputsSubstitutionTried()
     trace("all outputs substituted (maybe)");
 
     if (nrFailed > 0 && nrFailed > nrNoSubstituters + nrIncompleteClosure && !settings.tryFallback) {
-        done(BuildResult::TransientFailure,
+        done(BuildResult::TransientFailure, {},
             Error("some substitutes for the outputs of derivation '%s' failed (usually happens due to networking issues); try '--fallback' to build derivation from source ",
                 worker.store.printStorePath(drvPath)));
         return;
@@ -301,23 +293,17 @@ void DerivationGoal::outputsSubstitutionTried()
         return;
     }
 
-    checkPathValidity();
-    size_t nrInvalid = 0;
-    for (auto & [_, status] : initialOutputs) {
-        if (!status.wanted) continue;
-        if (!status.known || !status.known->isValid())
-            nrInvalid++;
-    }
+    auto [allValid, validOutputs] = checkPathValidity();
 
-    if (buildMode == bmNormal && nrInvalid == 0) {
-        done(BuildResult::Substituted);
+    if (buildMode == bmNormal && allValid) {
+        done(BuildResult::Substituted, std::move(validOutputs));
         return;
     }
-    if (buildMode == bmRepair && nrInvalid == 0) {
+    if (buildMode == bmRepair && allValid) {
         repairClosure();
         return;
     }
-    if (buildMode == bmCheck && nrInvalid > 0)
+    if (buildMode == bmCheck && !allValid)
         throw Error("some outputs of '%s' are not valid, so checking is not possible",
             worker.store.printStorePath(drvPath));
 
@@ -409,7 +395,7 @@ void DerivationGoal::repairClosure()
     }
 
     if (waitees.empty()) {
-        done(BuildResult::AlreadyValid);
+        done(BuildResult::AlreadyValid, assertPathValidity());
         return;
     }
 
@@ -423,7 +409,7 @@ void DerivationGoal::closureRepaired()
     if (nrFailed > 0)
         throw Error("some paths in the output closure of derivation '%s' could not be repaired",
             worker.store.printStorePath(drvPath));
-    done(BuildResult::AlreadyValid);
+    done(BuildResult::AlreadyValid, assertPathValidity());
 }
 
 
@@ -434,7 +420,7 @@ void DerivationGoal::inputsRealised()
     if (nrFailed != 0) {
         if (!useDerivation)
             throw Error("some dependencies of '%s' are missing", worker.store.printStorePath(drvPath));
-        done(BuildResult::DependencyFailed, Error(
+        done(BuildResult::DependencyFailed, {}, Error(
                 "%s dependencies of derivation '%s' failed to build",
                 nrFailed, worker.store.printStorePath(drvPath)));
         return;
@@ -523,10 +509,11 @@ void DerivationGoal::inputsRealised()
     state = &DerivationGoal::tryToBuild;
     worker.wakeUp(shared_from_this());
 
-    result = BuildResult();
+    buildResult = BuildResult();
 }
 
-void DerivationGoal::started() {
+void DerivationGoal::started()
+{
     auto msg = fmt(
         buildMode == bmRepair ? "repairing outputs of '%s'" :
         buildMode == bmCheck ? "checking outputs of '%s'" :
@@ -588,19 +575,12 @@ void DerivationGoal::tryToBuild()
        omitted, but that would be less efficient.)  Note that since we
        now hold the locks on the output paths, no other process can
        build this derivation, so no further checks are necessary. */
-    checkPathValidity();
-    bool allValid = true;
-    for (auto & [_, status] : initialOutputs) {
-        if (!status.wanted) continue;
-        if (!status.known || !status.known->isValid()) {
-            allValid = false;
-            break;
-        }
-    }
+    auto [allValid, validOutputs] = checkPathValidity();
+
     if (buildMode != bmCheck && allValid) {
         debug("skipping build of derivation '%s', someone beat us to it", worker.store.printStorePath(drvPath));
         outputLocks.setDeletion(true);
-        done(BuildResult::AlreadyValid);
+        done(BuildResult::AlreadyValid, std::move(validOutputs));
         return;
     }
 
@@ -626,7 +606,7 @@ void DerivationGoal::tryToBuild()
                 /* Yes, it has started doing so.  Wait until we get
                    EOF from the hook. */
                 actLock.reset();
-                result.startTime = time(0); // inexact
+                buildResult.startTime = time(0); // inexact
                 state = &DerivationGoal::buildDone;
                 started();
                 return;
@@ -830,8 +810,8 @@ void DerivationGoal::buildDone()
 
     debug("builder process for '%s' finished", worker.store.printStorePath(drvPath));
 
-    result.timesBuilt++;
-    result.stopTime = time(0);
+    buildResult.timesBuilt++;
+    buildResult.stopTime = time(0);
 
     /* So the child is gone now. */
     worker.childTerminated(this);
@@ -876,11 +856,11 @@ void DerivationGoal::buildDone()
 
         /* Compute the FS closure of the outputs and register them as
            being valid. */
-        registerOutputs();
+        auto builtOutputs = registerOutputs();
 
         StorePathSet outputPaths;
-        for (auto & [_, path] : finalOutputs)
-            outputPaths.insert(path);
+        for (auto & [_, output] : buildResult.builtOutputs)
+            outputPaths.insert(output.outPath);
         runPostBuildHook(
             worker.store,
             *logger,
@@ -890,7 +870,7 @@ void DerivationGoal::buildDone()
 
         if (buildMode == bmCheck) {
             cleanupPostOutputsRegisteredModeCheck();
-            done(BuildResult::Built);
+            done(BuildResult::Built, std::move(builtOutputs));
             return;
         }
 
@@ -911,6 +891,8 @@ void DerivationGoal::buildDone()
         outputLocks.setDeletion(true);
         outputLocks.unlock();
 
+        done(BuildResult::Built, std::move(builtOutputs));
+
     } catch (BuildError & e) {
         outputLocks.unlock();
 
@@ -930,14 +912,13 @@ void DerivationGoal::buildDone()
                 BuildResult::PermanentFailure;
         }
 
-        done(st, e);
+        done(st, {}, e);
         return;
     }
-
-    done(BuildResult::Built);
 }
 
-void DerivationGoal::resolvedFinished() {
+void DerivationGoal::resolvedFinished()
+{
     assert(resolvedDrvGoal);
     auto resolvedDrv = *resolvedDrvGoal->drv;
 
@@ -950,11 +931,13 @@ void DerivationGoal::resolvedFinished() {
     if (realWantedOutputs.empty())
         realWantedOutputs = resolvedDrv.outputNames();
 
+    DrvOutputs builtOutputs;
+
     for (auto & wantedOutput : realWantedOutputs) {
         assert(initialOutputs.count(wantedOutput) != 0);
         assert(resolvedHashes.count(wantedOutput) != 0);
         auto realisation = worker.store.queryRealisation(
-                DrvOutput{resolvedHashes.at(wantedOutput), wantedOutput}
+            DrvOutput{resolvedHashes.at(wantedOutput), wantedOutput}
         );
         // We've just built it, but maybe the build failed, in which case the
         // realisation won't be there
@@ -966,10 +949,11 @@ void DerivationGoal::resolvedFinished() {
             signRealisation(newRealisation);
             worker.store.registerDrvOutput(newRealisation);
             outputPaths.insert(realisation->outPath);
+            builtOutputs.emplace(realisation->id, *realisation);
         } else {
             // If we don't have a realisation, then it must mean that something
             // failed when building the resolved drv
-            assert(!result.success());
+            assert(!buildResult.success());
         }
     }
 
@@ -981,7 +965,7 @@ void DerivationGoal::resolvedFinished() {
     );
 
     auto status = [&]() {
-        auto resolvedResult = resolvedDrvGoal->getResult();
+        auto & resolvedResult = resolvedDrvGoal->buildResult;
         switch (resolvedResult.status) {
             case BuildResult::AlreadyValid:
                 return BuildResult::ResolvesToAlreadyValid;
@@ -990,7 +974,7 @@ void DerivationGoal::resolvedFinished() {
         }
     }();
 
-    done(status);
+    done(status, std::move(builtOutputs));
 }
 
 HookReply DerivationGoal::tryBuildHook()
@@ -1100,7 +1084,7 @@ HookReply DerivationGoal::tryBuildHook()
 }
 
 
-void DerivationGoal::registerOutputs()
+DrvOutputs DerivationGoal::registerOutputs()
 {
     /* When using a build hook, the build hook can register the output
        as valid (by doing `nix-store --import').  If so we don't have
@@ -1109,21 +1093,7 @@ void DerivationGoal::registerOutputs()
        We can only early return when the outputs are known a priori. For
        floating content-addressed derivations this isn't the case.
      */
-    for (auto & [outputName, optOutputPath] : worker.store.queryPartialDerivationOutputMap(drvPath)) {
-        if (!wantOutput(outputName, wantedOutputs))
-            continue;
-        if (!optOutputPath)
-            throw BuildError(
-                "output '%s' from derivation '%s' does not have a known output path",
-                outputName, worker.store.printStorePath(drvPath));
-        auto & outputPath = *optOutputPath;
-        if (!worker.store.isValidPath(outputPath))
-            throw BuildError(
-                "output '%s' from derivation '%s' is supposed to be at '%s' but that path is not valid",
-                outputName, worker.store.printStorePath(drvPath), worker.store.printStorePath(outputPath));
-
-        finalOutputs.insert_or_assign(outputName, outputPath);
-    }
+    return assertPathValidity();
 }
 
 Path DerivationGoal::openLogFile()
@@ -1185,7 +1155,7 @@ void DerivationGoal::handleChildOutput(int fd, std::string_view data)
         if (settings.maxLogSize && logSize > settings.maxLogSize) {
             killChild();
             done(
-                BuildResult::LogLimitExceeded,
+                BuildResult::LogLimitExceeded, {},
                 Error("%s killed after writing more than %d bytes of log output",
                     getName(), settings.maxLogSize));
             return;
@@ -1274,10 +1244,12 @@ OutputPathMap DerivationGoal::queryDerivationOutputMap()
 }
 
 
-void DerivationGoal::checkPathValidity()
+std::pair<bool, DrvOutputs> DerivationGoal::checkPathValidity()
 {
     bool checkHash = buildMode == bmRepair;
     auto wantedOutputsLeft = wantedOutputs;
+    DrvOutputs validOutputs;
+
     for (auto & i : queryPartialDerivationOutputMap()) {
         InitialOutput & info = initialOutputs.at(i.first);
         info.wanted = wantOutput(i.first, wantedOutputs);
@@ -1294,26 +1266,28 @@ void DerivationGoal::checkPathValidity()
                     : PathStatus::Corrupt,
             };
         }
+        auto drvOutput = DrvOutput{initialOutputs.at(i.first).outputHash, i.first};
         if (settings.isExperimentalFeatureEnabled(Xp::CaDerivations)) {
-            auto drvOutput = DrvOutput{initialOutputs.at(i.first).outputHash, i.first};
             if (auto real = worker.store.queryRealisation(drvOutput)) {
                 info.known = {
                     .path = real->outPath,
                     .status = PathStatus::Valid,
                 };
-            } else if (info.known && info.known->status == PathStatus::Valid) {
-                // We know the output because it' a static output of the
+            } else if (info.known && info.known->isValid()) {
+                // We know the output because it's a static output of the
                 // derivation, and the output path is valid, but we don't have
                 // its realisation stored (probably because it has been built
-                // without the `ca-derivations` experimental flag)
+                // without the `ca-derivations` experimental flag).
                 worker.store.registerDrvOutput(
-                    Realisation{
+                    Realisation {
                         drvOutput,
                         info.known->path,
                     }
                 );
             }
         }
+        if (info.wanted && info.known && info.known->isValid())
+            validOutputs.emplace(drvOutput, Realisation { drvOutput, info.known->path });
     }
     // If we requested all the outputs via the empty set, we are always fine.
     // If we requested specific elements, the loop above removes all the valid
@@ -1322,24 +1296,51 @@ void DerivationGoal::checkPathValidity()
         throw Error("derivation '%s' does not have wanted outputs %s",
             worker.store.printStorePath(drvPath),
             concatStringsSep(", ", quoteStrings(wantedOutputsLeft)));
+
+    bool allValid = true;
+    for (auto & [_, status] : initialOutputs) {
+        if (!status.wanted) continue;
+        if (!status.known || !status.known->isValid()) {
+            allValid = false;
+            break;
+        }
+    }
+
+    return { allValid, validOutputs };
 }
 
 
-void DerivationGoal::done(BuildResult::Status status, std::optional<Error> ex)
+DrvOutputs DerivationGoal::assertPathValidity()
 {
-    result.status = status;
+    auto [allValid, validOutputs] = checkPathValidity();
+    if (!allValid)
+        throw Error("some outputs are unexpectedly invalid");
+    return validOutputs;
+}
+
+
+void DerivationGoal::done(
+    BuildResult::Status status,
+    DrvOutputs builtOutputs,
+    std::optional<Error> ex)
+{
+    buildResult.drvPath = drvPath;
+    buildResult.status = status;
     if (ex)
-        result.errorMsg = ex->what();
-    amDone(result.success() ? ecSuccess : ecFailed, ex);
-    if (result.status == BuildResult::TimedOut)
+        // FIXME: strip: "error: "
+        buildResult.errorMsg = ex->what();
+    amDone(buildResult.success() ? ecSuccess : ecFailed, ex);
+    if (buildResult.status == BuildResult::TimedOut)
         worker.timedOut = true;
-    if (result.status == BuildResult::PermanentFailure)
+    if (buildResult.status == BuildResult::PermanentFailure)
         worker.permanentFailure = true;
 
     mcExpectedBuilds.reset();
     mcRunningBuilds.reset();
 
-    if (result.success()) {
+    if (buildResult.success()) {
+        assert(!builtOutputs.empty());
+        buildResult.builtOutputs = std::move(builtOutputs);
         if (status == BuildResult::Built)
             worker.doneBuilds++;
     } else {
@@ -1353,7 +1354,7 @@ void DerivationGoal::done(BuildResult::Status status, std::optional<Error> ex)
     if (traceBuiltOutputsFile != "") {
         std::fstream fs;
         fs.open(traceBuiltOutputsFile, std::fstream::out);
-        fs << worker.store.printStorePath(drvPath) << "\t" << result.toString() << std::endl;
+        fs << worker.store.printStorePath(drvPath) << "\t" << buildResult.toString() << std::endl;
     }
 }
 
diff --git a/src/libstore/build/derivation-goal.hh b/src/libstore/build/derivation-goal.hh
index 6f158bdbf..ea2db89b2 100644
--- a/src/libstore/build/derivation-goal.hh
+++ b/src/libstore/build/derivation-goal.hh
@@ -2,7 +2,6 @@
 
 #include "parsed-derivations.hh"
 #include "lock.hh"
-#include "build-result.hh"
 #include "store-api.hh"
 #include "pathlocks.hh"
 #include "goal.hh"
@@ -105,20 +104,8 @@ struct DerivationGoal : public Goal
     typedef void (DerivationGoal::*GoalState)();
     GoalState state;
 
-    /* The final output paths of the build.
-
-       - For input-addressed derivations, always the precomputed paths
-
-       - For content-addressed derivations, calcuated from whatever the hash
-         ends up being. (Note that fixed outputs derivations that produce the
-         "wrong" output still install that data under its true content-address.)
-     */
-    OutputPathMap finalOutputs;
-
     BuildMode buildMode;
 
-    BuildResult result;
-
     /* The current round, if we're building multiple times. */
     size_t curRound = 1;
 
@@ -153,8 +140,6 @@ struct DerivationGoal : public Goal
     /* Add wanted outputs to an already existing derivation goal. */
     void addWantedOutputs(const StringSet & outputs);
 
-    BuildResult getResult() { return result; }
-
     /* The states. */
     void getDerivation();
     void loadDerivation();
@@ -176,7 +161,7 @@ struct DerivationGoal : public Goal
 
     /* Check that the derivation outputs all exist and register them
        as valid. */
-    virtual void registerOutputs();
+    virtual DrvOutputs registerOutputs();
 
     /* Open a log file and a pipe to it. */
     Path openLogFile();
@@ -211,8 +196,17 @@ struct DerivationGoal : public Goal
     std::map<std::string, std::optional<StorePath>> queryPartialDerivationOutputMap();
     OutputPathMap queryDerivationOutputMap();
 
-    /* Return the set of (in)valid paths. */
-    void checkPathValidity();
+    /* Update 'initialOutputs' to determine the current status of the
+       outputs of the derivation. Also returns a Boolean denoting
+       whether all outputs are valid and non-corrupt, and a
+       'DrvOutputs' structure containing the valid and wanted
+       outputs. */
+    std::pair<bool, DrvOutputs> checkPathValidity();
+
+    /* Aborts if any output is not valid or corrupt, and otherwise
+       returns a 'DrvOutputs' structure containing the wanted
+       outputs. */
+    DrvOutputs assertPathValidity();
 
     /* Forcibly kill the child process, if any. */
     virtual void killChild();
@@ -223,6 +217,7 @@ struct DerivationGoal : public Goal
 
     void done(
         BuildResult::Status status,
+        DrvOutputs builtOutputs = {},
         std::optional<Error> ex = {});
 
     StorePathSet exportReferences(const StorePathSet & storePaths);
diff --git a/src/libstore/build/drv-output-substitution-goal.cc b/src/libstore/build/drv-output-substitution-goal.cc
index e6e810cdd..946ec1aff 100644
--- a/src/libstore/build/drv-output-substitution-goal.cc
+++ b/src/libstore/build/drv-output-substitution-goal.cc
@@ -32,7 +32,7 @@ void DrvOutputSubstitutionGoal::init()
 
 void DrvOutputSubstitutionGoal::tryNext()
 {
-    trace("Trying next substituter");
+    trace("trying next substituter");
 
     if (subs.size() == 0) {
         /* None left.  Terminate this goal and let someone else deal
@@ -119,7 +119,7 @@ void DrvOutputSubstitutionGoal::realisationFetched()
 void DrvOutputSubstitutionGoal::outPathValid()
 {
     assert(outputInfo);
-    trace("Output path substituted");
+    trace("output path substituted");
 
     if (nrFailed > 0) {
         debug("The output path of the derivation output '%s' could not be substituted", id.to_string());
diff --git a/src/libstore/build/entry-points.cc b/src/libstore/build/entry-points.cc
index 9b4cfd835..b2f87aa82 100644
--- a/src/libstore/build/entry-points.cc
+++ b/src/libstore/build/entry-points.cc
@@ -47,6 +47,35 @@ void Store::buildPaths(const std::vector<DerivedPath> & reqs, BuildMode buildMod
     }
 }
 
+std::vector<BuildResult> Store::buildPathsWithResults(
+    const std::vector<DerivedPath> & reqs,
+    BuildMode buildMode,
+    std::shared_ptr<Store> evalStore)
+{
+    Worker worker(*this, evalStore ? *evalStore : *this);
+
+    Goals goals;
+    for (const auto & br : reqs) {
+        std::visit(overloaded {
+            [&](const DerivedPath::Built & bfd) {
+                goals.insert(worker.makeDerivationGoal(bfd.drvPath, bfd.outputs, buildMode));
+            },
+            [&](const DerivedPath::Opaque & bo) {
+                goals.insert(worker.makePathSubstitutionGoal(bo.path, buildMode == bmRepair ? Repair : NoRepair));
+            },
+        }, br.raw());
+    }
+
+    worker.run(goals);
+
+    std::vector<BuildResult> results;
+
+    for (auto & i : goals)
+        results.push_back(i->buildResult);
+
+    return results;
+}
+
 BuildResult Store::buildDerivation(const StorePath & drvPath, const BasicDerivation & drv,
     BuildMode buildMode)
 {
@@ -57,31 +86,11 @@ BuildResult Store::buildDerivation(const StorePath & drvPath, const BasicDerivat
 
     try {
         worker.run(Goals{goal});
-        result = goal->getResult();
+        result = goal->buildResult;
     } catch (Error & e) {
         result.status = BuildResult::MiscFailure;
         result.errorMsg = e.msg();
     }
-    // XXX: Should use `goal->queryPartialDerivationOutputMap()` once it's
-    // extended to return the full realisation for each output
-    auto staticDrvOutputs = drv.outputsAndOptPaths(*this);
-    auto outputHashes = staticOutputHashes(*this, drv);
-    for (auto & [outputName, staticOutput] : staticDrvOutputs) {
-        auto outputId = DrvOutput{outputHashes.at(outputName), outputName};
-        if (staticOutput.second)
-            result.builtOutputs.insert_or_assign(
-                    outputId,
-                    Realisation{ outputId, *staticOutput.second}
-                    );
-        if (settings.isExperimentalFeatureEnabled(Xp::CaDerivations) && !derivationHasKnownOutputPaths(drv.type())) {
-            auto realisation = this->queryRealisation(outputId);
-            if (realisation)
-                result.builtOutputs.insert_or_assign(
-                        outputId,
-                        *realisation
-                        );
-        }
-    }
 
     return result;
 }
diff --git a/src/libstore/build/goal.hh b/src/libstore/build/goal.hh
index 68e08bdf9..fcf3d0084 100644
--- a/src/libstore/build/goal.hh
+++ b/src/libstore/build/goal.hh
@@ -2,6 +2,7 @@
 
 #include "types.hh"
 #include "store-api.hh"
+#include "build-result.hh"
 
 namespace nix {
 
@@ -55,6 +56,9 @@ struct Goal : public std::enable_shared_from_this<Goal>
     /* Whether the goal is finished. */
     ExitCode exitCode;
 
+    /* Build result. */
+    BuildResult buildResult;
+
     /* Exception containing an error message, if any. */
     std::optional<Error> ex;
 
diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index 581d63d0e..a372728f5 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -194,7 +194,7 @@ void LocalDerivationGoal::tryLocalBuild() {
         outputLocks.unlock();
         buildUser.reset();
         worker.permanentFailure = true;
-        done(BuildResult::InputRejected, e);
+        done(BuildResult::InputRejected, {}, e);
         return;
     }
 
@@ -756,7 +756,7 @@ void LocalDerivationGoal::startBuilder()
     if (tcsetattr(builderOut.writeSide.get(), TCSANOW, &term))
         throw SysError("putting pseudoterminal into raw mode");
 
-    result.startTime = time(0);
+    buildResult.startTime = time(0);
 
     /* Fork a child to build the package. */
 
@@ -1260,6 +1260,16 @@ struct RestrictedStore : public virtual RestrictedStoreConfig, public virtual Lo
     }
 
     void buildPaths(const std::vector<DerivedPath> & paths, BuildMode buildMode, std::shared_ptr<Store> evalStore) override
+    {
+        for (auto & result : buildPathsWithResults(paths, buildMode, evalStore))
+            if (!result.success())
+                result.rethrow();
+    }
+
+    std::vector<BuildResult> buildPathsWithResults(
+        const std::vector<DerivedPath> & paths,
+        BuildMode buildMode = bmNormal,
+        std::shared_ptr<Store> evalStore = nullptr) override
     {
         assert(!evalStore);
 
@@ -1273,26 +1283,13 @@ struct RestrictedStore : public virtual RestrictedStoreConfig, public virtual Lo
                 throw InvalidPath("cannot build '%s' in recursive Nix because path is unknown", req.to_string(*next));
         }
 
-        next->buildPaths(paths, buildMode);
+        auto results = next->buildPathsWithResults(paths, buildMode);
 
-        for (auto & path : paths) {
-            auto p =  std::get_if<DerivedPath::Built>(&path);
-            if (!p) continue;
-            auto & bfd = *p;
-            auto drv = readDerivation(bfd.drvPath);
-            auto drvHashes = staticOutputHashes(*this, drv);
-            auto outputs = next->queryDerivationOutputMap(bfd.drvPath);
-            for (auto & [outputName, outputPath] : outputs)
-                if (wantOutput(outputName, bfd.outputs)) {
-                    newPaths.insert(outputPath);
-                    if (settings.isExperimentalFeatureEnabled(Xp::CaDerivations)) {
-                        auto thisRealisation = next->queryRealisation(
-                            DrvOutput{drvHashes.at(outputName), outputName}
-                        );
-                        assert(thisRealisation);
-                        newRealisations.insert(*thisRealisation);
-                    }
-                }
+        for (auto & result : results) {
+            for (auto & [outputName, output] : result.builtOutputs) {
+                newPaths.insert(output.outPath);
+                newRealisations.insert(output);
+            }
         }
 
         StorePathSet closure;
@@ -1301,6 +1298,8 @@ struct RestrictedStore : public virtual RestrictedStoreConfig, public virtual Lo
             goal.addDependency(path);
         for (auto & real : Realisation::closure(*next, newRealisations))
             goal.addedDrvOutputs.insert(real.id);
+
+        return results;
     }
 
     BuildResult buildDerivation(const StorePath & drvPath, const BasicDerivation & drv,
@@ -2069,7 +2068,7 @@ void LocalDerivationGoal::runChild()
 }
 
 
-void LocalDerivationGoal::registerOutputs()
+DrvOutputs LocalDerivationGoal::registerOutputs()
 {
     /* When using a build hook, the build hook can register the output
        as valid (by doing `nix-store --import').  If so we don't have
@@ -2078,10 +2077,8 @@ void LocalDerivationGoal::registerOutputs()
        We can only early return when the outputs are known a priori. For
        floating content-addressed derivations this isn't the case.
      */
-    if (hook) {
-        DerivationGoal::registerOutputs();
-        return;
-    }
+    if (hook)
+        return DerivationGoal::registerOutputs();
 
     std::map<std::string, ValidPathInfo> infos;
 
@@ -2204,6 +2201,8 @@ void LocalDerivationGoal::registerOutputs()
 
     std::reverse(sortedOutputNames.begin(), sortedOutputNames.end());
 
+    OutputPathMap finalOutputs;
+
     for (auto & outputName : sortedOutputNames) {
         auto output = drv->outputs.at(outputName);
         auto & scratchPath = scratchOutputs.at(outputName);
@@ -2340,6 +2339,7 @@ void LocalDerivationGoal::registerOutputs()
         };
 
         ValidPathInfo newInfo = std::visit(overloaded {
+
             [&](const DerivationOutputInputAddressed & output) {
                 /* input-addressed case */
                 auto requiredFinalPath = output.path;
@@ -2359,6 +2359,7 @@ void LocalDerivationGoal::registerOutputs()
                     newInfo0.references.insert(newInfo0.path);
                 return newInfo0;
             },
+
             [&](const DerivationOutputCAFixed & dof) {
                 auto newInfo0 = newInfoFromCA(DerivationOutputCAFloating {
                     .method = dof.hash.method,
@@ -2381,14 +2382,17 @@ void LocalDerivationGoal::registerOutputs()
                 }
                 return newInfo0;
             },
-            [&](DerivationOutputCAFloating dof) {
+
+            [&](DerivationOutputCAFloating & dof) {
                 return newInfoFromCA(dof);
             },
+
             [&](DerivationOutputDeferred) -> ValidPathInfo {
                 // No derivation should reach that point without having been
                 // rewritten first
                 assert(false);
             },
+
         }, output.output);
 
         /* FIXME: set proper permissions in restorePath() so
@@ -2499,11 +2503,12 @@ void LocalDerivationGoal::registerOutputs()
     }
 
     if (buildMode == bmCheck) {
-        // In case of FOD mismatches on `--check` an error must be thrown as this is also
-        // a source for non-determinism.
+        /* In case of fixed-output derivations, if there are
+           mismatches on `--check` an error must be thrown as this is
+           also a source for non-determinism. */
         if (delayedException)
             std::rethrow_exception(delayedException);
-        return;
+        return assertPathValidity();
     }
 
     /* Apply output checks. */
@@ -2515,7 +2520,7 @@ void LocalDerivationGoal::registerOutputs()
         assert(prevInfos.size() == infos.size());
         for (auto i = prevInfos.begin(), j = infos.begin(); i != prevInfos.end(); ++i, ++j)
             if (!(*i == *j)) {
-                result.isNonDeterministic = true;
+                buildResult.isNonDeterministic = true;
                 Path prev = worker.store.printStorePath(i->second.path) + checkSuffix;
                 bool prevExists = keepPreviousRound && pathExists(prev);
                 hintformat hint = prevExists
@@ -2553,7 +2558,7 @@ void LocalDerivationGoal::registerOutputs()
 
     if (curRound < nrRounds) {
         prevInfos = std::move(infos);
-        return;
+        return {};
     }
 
     /* Remove the .check directories if we're done. FIXME: keep them
@@ -2588,17 +2593,24 @@ void LocalDerivationGoal::registerOutputs()
        means it's safe to link the derivation to the output hash. We must do
        that for floating CA derivations, which otherwise couldn't be cached,
        but it's fine to do in all cases. */
+    DrvOutputs builtOutputs;
 
-    if (settings.isExperimentalFeatureEnabled(Xp::CaDerivations)) {
-        for (auto& [outputName, newInfo] : infos) {
-            auto thisRealisation = Realisation{
-                .id = DrvOutput{initialOutputs.at(outputName).outputHash,
-                                outputName},
-                .outPath = newInfo.path};
+    for (auto & [outputName, newInfo] : infos) {
+        auto thisRealisation = Realisation {
+            .id = DrvOutput {
+                initialOutputs.at(outputName).outputHash,
+                outputName
+            },
+            .outPath = newInfo.path
+        };
+        if (settings.isExperimentalFeatureEnabled(Xp::CaDerivations)) {
             signRealisation(thisRealisation);
             worker.store.registerDrvOutput(thisRealisation);
         }
+        builtOutputs.emplace(thisRealisation.id, thisRealisation);
     }
+
+    return builtOutputs;
 }
 
 void LocalDerivationGoal::signRealisation(Realisation & realisation)
@@ -2607,7 +2619,7 @@ void LocalDerivationGoal::signRealisation(Realisation & realisation)
 }
 
 
-void LocalDerivationGoal::checkOutputs(const std::map<Path, ValidPathInfo> & outputs)
+void LocalDerivationGoal::checkOutputs(const std::map<std::string, ValidPathInfo> & outputs)
 {
     std::map<Path, const ValidPathInfo &> outputsByPath;
     for (auto & output : outputs)
@@ -2679,8 +2691,8 @@ void LocalDerivationGoal::checkOutputs(const std::map<Path, ValidPathInfo> & out
                 for (auto & i : *value) {
                     if (worker.store.isStorePath(i))
                         spec.insert(worker.store.parseStorePath(i));
-                    else if (finalOutputs.count(i))
-                        spec.insert(finalOutputs.at(i));
+                    else if (outputs.count(i))
+                        spec.insert(outputs.at(i).path);
                     else throw BuildError("derivation contains an illegal reference specifier '%s'", i);
                 }
 
diff --git a/src/libstore/build/local-derivation-goal.hh b/src/libstore/build/local-derivation-goal.hh
index 95692c60d..d456e9cae 100644
--- a/src/libstore/build/local-derivation-goal.hh
+++ b/src/libstore/build/local-derivation-goal.hh
@@ -169,7 +169,7 @@ struct LocalDerivationGoal : public DerivationGoal
 
     /* Check that the derivation outputs all exist and register them
        as valid. */
-    void registerOutputs() override;
+    DrvOutputs registerOutputs() override;
 
     void signRealisation(Realisation &) override;
 
diff --git a/src/libstore/build/substitution-goal.cc b/src/libstore/build/substitution-goal.cc
index c1bb1941d..ec500baf8 100644
--- a/src/libstore/build/substitution-goal.cc
+++ b/src/libstore/build/substitution-goal.cc
@@ -24,6 +24,14 @@ PathSubstitutionGoal::~PathSubstitutionGoal()
 }
 
 
+void PathSubstitutionGoal::done(ExitCode result, BuildResult::Status status)
+{
+    buildResult.outPath = storePath;
+    buildResult.status = status;
+    amDone(result);
+}
+
+
 void PathSubstitutionGoal::work()
 {
     (this->*state)();
@@ -38,7 +46,7 @@ void PathSubstitutionGoal::init()
 
     /* If the path already exists we're done. */
     if (!repair && worker.store.isValidPath(storePath)) {
-        amDone(ecSuccess);
+        done(ecSuccess, BuildResult::AlreadyValid);
         return;
     }
 
@@ -65,7 +73,7 @@ void PathSubstitutionGoal::tryNext()
         /* Hack: don't indicate failure if there were no substituters.
            In that case the calling derivation should just do a
            build. */
-        amDone(substituterFailed ? ecFailed : ecNoSubstituters);
+        done(substituterFailed ? ecFailed : ecNoSubstituters, BuildResult::NoSubstituters);
 
         if (substituterFailed) {
             worker.failedSubstitutions++;
@@ -163,7 +171,9 @@ void PathSubstitutionGoal::referencesValid()
 
     if (nrFailed > 0) {
         debug("some references of path '%s' could not be realised", worker.store.printStorePath(storePath));
-        amDone(nrNoSubstituters > 0 || nrIncompleteClosure > 0 ? ecIncompleteClosure : ecFailed);
+        done(
+            nrNoSubstituters > 0 || nrIncompleteClosure > 0 ? ecIncompleteClosure : ecFailed,
+            BuildResult::DependencyFailed);
         return;
     }
 
@@ -268,7 +278,7 @@ void PathSubstitutionGoal::finished()
 
     worker.updateProgress();
 
-    amDone(ecSuccess);
+    done(ecSuccess, BuildResult::Substituted);
 }
 
 
diff --git a/src/libstore/build/substitution-goal.hh b/src/libstore/build/substitution-goal.hh
index d8399d2a8..946f13841 100644
--- a/src/libstore/build/substitution-goal.hh
+++ b/src/libstore/build/substitution-goal.hh
@@ -53,6 +53,8 @@ struct PathSubstitutionGoal : public Goal
     /* Content address for recomputing store path */
     std::optional<ContentAddress> ca;
 
+    void done(ExitCode result, BuildResult::Status status);
+
 public:
     PathSubstitutionGoal(const StorePath & storePath, Worker & worker, RepairFlag repair = NoRepair, std::optional<ContentAddress> ca = std::nullopt);
     ~PathSubstitutionGoal();
diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index 89d9487da..e6760664c 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -532,6 +532,25 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         break;
     }
 
+    case wopBuildPathsWithResults: {
+        auto drvs = readDerivedPaths(*store, clientVersion, from);
+        BuildMode mode = bmNormal;
+        mode = (BuildMode) readInt(from);
+
+        /* Repairing is not atomic, so disallowed for "untrusted"
+           clients.  */
+        if (mode == bmRepair && !trusted)
+            throw Error("repairing is not allowed because you are not in 'trusted-users'");
+
+        logger->startWork();
+        auto results = store->buildPathsWithResults(drvs, mode);
+        logger->stopWork();
+
+        worker_proto::write(*store, to, results);
+
+        break;
+    }
+
     case wopBuildDerivation: {
         auto drvPath = store->parseStorePath(readString(from));
         BasicDerivation drv;
diff --git a/src/libstore/remote-store.cc b/src/libstore/remote-store.cc
index a25398ef2..a0883db11 100644
--- a/src/libstore/remote-store.cc
+++ b/src/libstore/remote-store.cc
@@ -91,6 +91,37 @@ void write(const Store & store, Sink & out, const DrvOutput & drvOutput)
 }
 
 
+BuildResult read(const Store & store, Source & from, Phantom<BuildResult> _)
+{
+    BuildResult res;
+    res.status = (BuildResult::Status) readInt(from);
+    from
+        >> res.errorMsg
+        >> res.timesBuilt
+        >> res.isNonDeterministic
+        >> res.startTime
+        >> res.stopTime;
+    res.drvPath = worker_proto::read(store, from, Phantom<std::optional<StorePath>> {});
+    res.builtOutputs = worker_proto::read(store, from, Phantom<DrvOutputs> {});
+    res.outPath = worker_proto::read(store, from, Phantom<std::optional<StorePath>> {});
+    return res;
+}
+
+void write(const Store & store, Sink & to, const BuildResult & res)
+{
+    to
+        << res.status
+        << res.errorMsg
+        << res.timesBuilt
+        << res.isNonDeterministic
+        << res.startTime
+        << res.stopTime;
+    worker_proto::write(store, to, res.drvPath);
+    worker_proto::write(store, to, res.builtOutputs);
+    worker_proto::write(store, to, res.outPath);
+}
+
+
 std::optional<StorePath> read(const Store & store, Source & from, Phantom<std::optional<StorePath>> _)
 {
     auto s = readString(from);
@@ -747,17 +778,24 @@ static void writeDerivedPaths(RemoteStore & store, ConnectionHandle & conn, cons
     }
 }
 
-void RemoteStore::buildPaths(const std::vector<DerivedPath> & drvPaths, BuildMode buildMode, std::shared_ptr<Store> evalStore)
+void RemoteStore::copyDrvsFromEvalStore(
+    const std::vector<DerivedPath> & paths,
+    std::shared_ptr<Store> evalStore)
 {
     if (evalStore && evalStore.get() != this) {
         /* The remote doesn't have a way to access evalStore, so copy
            the .drvs. */
         RealisedPath::Set drvPaths2;
-        for (auto & i : drvPaths)
+        for (auto & i : paths)
             if (auto p = std::get_if<DerivedPath::Built>(&i))
                 drvPaths2.insert(p->drvPath);
         copyClosure(*evalStore, *this, drvPaths2);
     }
+}
+
+void RemoteStore::buildPaths(const std::vector<DerivedPath> & drvPaths, BuildMode buildMode, std::shared_ptr<Store> evalStore)
+{
+    copyDrvsFromEvalStore(drvPaths, evalStore);
 
     auto conn(getConnection());
     conn->to << wopBuildPaths;
@@ -774,6 +812,90 @@ void RemoteStore::buildPaths(const std::vector<DerivedPath> & drvPaths, BuildMod
     readInt(conn->from);
 }
 
+std::vector<BuildResult> RemoteStore::buildPathsWithResults(
+    const std::vector<DerivedPath> & paths,
+    BuildMode buildMode,
+    std::shared_ptr<Store> evalStore)
+{
+    copyDrvsFromEvalStore(paths, evalStore);
+
+    std::optional<ConnectionHandle> conn_(getConnection());
+    auto & conn = *conn_;
+
+    if (GET_PROTOCOL_MINOR(conn->daemonVersion) >= 34) {
+        conn->to << wopBuildPathsWithResults;
+        writeDerivedPaths(*this, conn, paths);
+        conn->to << buildMode;
+        conn.processStderr();
+        return worker_proto::read(*this, conn->from, Phantom<std::vector<BuildResult>> {});
+    } else {
+        // Avoid deadlock.
+        conn_.reset();
+
+        // Note: this throws an exception if a build/substitution
+        // fails, but meh.
+        buildPaths(paths, buildMode, evalStore);
+
+        std::vector<BuildResult> results;
+
+        for (auto & path : paths) {
+            std::visit(
+                overloaded {
+                    [&](const DerivedPath::Opaque & bo) {
+                        BuildResult res;
+                        res.status = BuildResult::Substituted;
+                        res.outPath = bo.path;
+                        results.push_back(res);
+                    },
+                    [&](const DerivedPath::Built & bfd) {
+                        BuildResult res;
+                        res.status = BuildResult::Built;
+                        res.drvPath = bfd.drvPath;
+
+                        OutputPathMap outputs;
+                        auto drv = evalStore->readDerivation(bfd.drvPath);
+                        auto outputHashes = staticOutputHashes(*evalStore, drv); // FIXME: expensive
+                        auto drvOutputs = drv.outputsAndOptPaths(*this);
+                        for (auto & output : bfd.outputs) {
+                            if (!outputHashes.count(output))
+                                throw Error(
+                                    "the derivation '%s' doesn't have an output named '%s'",
+                                    printStorePath(bfd.drvPath), output);
+                            auto outputId =
+                                DrvOutput{outputHashes.at(output), output};
+                            if (settings.isExperimentalFeatureEnabled(Xp::CaDerivations)) {
+                                auto realisation =
+                                    queryRealisation(outputId);
+                                if (!realisation)
+                                    throw Error(
+                                        "cannot operate on an output of unbuilt "
+                                        "content-addressed derivation '%s'",
+                                        outputId.to_string());
+                                res.builtOutputs.emplace(realisation->id, *realisation);
+                            } else {
+                                // If ca-derivations isn't enabled, assume that
+                                // the output path is statically known.
+                                assert(drvOutputs.count(output));
+                                assert(drvOutputs.at(output).second);
+                                res.builtOutputs.emplace(
+                                    outputId,
+                                    Realisation {
+                                        .id = outputId,
+                                        .outPath = *drvOutputs.at(output).second
+                                    });
+                            }
+                        }
+
+                        results.push_back(res);
+                    }
+                },
+                path.raw());
+        }
+
+        return results;
+    }
+}
+
 
 BuildResult RemoteStore::buildDerivation(const StorePath & drvPath, const BasicDerivation & drv,
     BuildMode buildMode)
diff --git a/src/libstore/remote-store.hh b/src/libstore/remote-store.hh
index 2628206b1..9f6f50593 100644
--- a/src/libstore/remote-store.hh
+++ b/src/libstore/remote-store.hh
@@ -97,6 +97,11 @@ public:
 
     void buildPaths(const std::vector<DerivedPath> & paths, BuildMode buildMode, std::shared_ptr<Store> evalStore) override;
 
+    std::vector<BuildResult> buildPathsWithResults(
+        const std::vector<DerivedPath> & paths,
+        BuildMode buildMode,
+        std::shared_ptr<Store> evalStore) override;
+
     BuildResult buildDerivation(const StorePath & drvPath, const BasicDerivation & drv,
         BuildMode buildMode) override;
 
@@ -171,6 +176,9 @@ private:
 
     std::atomic_bool failed{false};
 
+    void copyDrvsFromEvalStore(
+        const std::vector<DerivedPath> & paths,
+        std::shared_ptr<Store> evalStore);
 };
 
 
diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
index 7bd21519c..e99a3f2cb 100644
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@@ -432,6 +432,16 @@ public:
         BuildMode buildMode = bmNormal,
         std::shared_ptr<Store> evalStore = nullptr);
 
+    /* Like `buildPaths()`, but return a vector of `BuildResult`s
+       corresponding to each element in `paths`. Note that in case of
+       a build/substitution error, this function won't throw an
+       exception, but return a `BuildResult` containing an error
+       message. */
+    virtual std::vector<BuildResult> buildPathsWithResults(
+        const std::vector<DerivedPath> & paths,
+        BuildMode buildMode = bmNormal,
+        std::shared_ptr<Store> evalStore = nullptr);
+
     /* Build a single non-materialized derivation (i.e. not from an
        on-disk .drv file).
 
diff --git a/src/libstore/worker-protocol.hh b/src/libstore/worker-protocol.hh
index c8332afe6..87088a3ac 100644
--- a/src/libstore/worker-protocol.hh
+++ b/src/libstore/worker-protocol.hh
@@ -9,7 +9,7 @@ namespace nix {
 #define WORKER_MAGIC_1 0x6e697863
 #define WORKER_MAGIC_2 0x6478696f
 
-#define PROTOCOL_VERSION (1 << 8 | 33)
+#define PROTOCOL_VERSION (1 << 8 | 34)
 #define GET_PROTOCOL_MAJOR(x) ((x) & 0xff00)
 #define GET_PROTOCOL_MINOR(x) ((x) & 0x00ff)
 
@@ -57,6 +57,7 @@ typedef enum {
     wopQueryRealisation = 43,
     wopAddMultipleToStore = 44,
     wopAddBuildLog = 45,
+    wopBuildPathsWithResults = 46,
 } WorkerOp;
 
 
@@ -91,6 +92,7 @@ MAKE_WORKER_PROTO(, ContentAddress);
 MAKE_WORKER_PROTO(, DerivedPath);
 MAKE_WORKER_PROTO(, Realisation);
 MAKE_WORKER_PROTO(, DrvOutput);
+MAKE_WORKER_PROTO(, BuildResult);
 
 MAKE_WORKER_PROTO(template<typename T>, std::vector<T>);
 MAKE_WORKER_PROTO(template<typename T>, std::set<T>);

From 4b2b0d3a5528133898a15f3210c79162ec993823 Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Wed, 29 Dec 2021 01:28:58 +0100
Subject: [PATCH 128/251] remove GC_PTR_STORE_AND_DIRTY
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

turns out it's only necessary for MANUAL_VDB, which nix doesn't use. omitting
them gives a slight performance improvement on eval.

before:

  Benchmark 1: nix flakes search --no-eval-cache --offline ../nixpkgs hello
    Time (mean ± σ):      6.988 s ±  0.061 s    [User: 5.935 s, System: 0.845 s]
    Range (min … max):    6.865 s …  7.075 s    20 runs

  Benchmark 2: nix flakes eval -f ../nixpkgs/pkgs/development/haskell-modules/hackage-packages.nix
    Time (mean ± σ):     332.6 ms ±   3.9 ms    [User: 299.6 ms, System: 32.9 ms]
    Range (min … max):   328.1 ms … 339.1 ms    20 runs

  Benchmark 3: nix eval --raw --impure --expr 'with import <nixpkgs/nixos> {}; system'
    Time (mean ± σ):      2.681 s ±  0.049 s    [User: 2.382 s, System: 0.228 s]
    Range (min … max):    2.607 s …  2.776 s    20 runs

after:

  Benchmark 1: nix flakes search --no-eval-cache --offline ../nixpkgs hello
    Time (mean ± σ):      6.946 s ±  0.041 s    [User: 5.875 s, System: 0.835 s]
    Range (min … max):    6.834 s …  7.005 s    20 runs

  Benchmark 2: nix flakes eval -f ../nixpkgs/pkgs/development/haskell-modules/hackage-packages.nix
    Time (mean ± σ):     330.3 ms ±   2.5 ms    [User: 299.2 ms, System: 30.9 ms]
    Range (min … max):   327.5 ms … 337.7 ms    20 runs

  Benchmark 3: nix eval --raw --impure --expr 'with import <nixpkgs/nixos> {}; system'
    Time (mean ± σ):      2.671 s ±  0.035 s    [User: 2.370 s, System: 0.232 s]
    Range (min … max):    2.597 s …  2.749 s    20 runs
---
 src/libexpr/eval.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 193358161..777f6a4ec 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -879,7 +879,7 @@ Value * EvalState::allocValue()
     /* GC_NEXT is a convenience macro for accessing the first word of an object.
        Take the first list item, advance the list to the next item, and clear the next pointer. */
     void * p = *valueAllocCache;
-    GC_PTR_STORE_AND_DIRTY(&*valueAllocCache, GC_NEXT(p));
+    *valueAllocCache = GC_NEXT(p);
     GC_NEXT(p) = nullptr;
 
     nrValues++;

From 60ed4e908a59f258f82356a9dd47e43361d39f2f Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Sun, 26 Dec 2021 19:32:08 +0100
Subject: [PATCH 129/251] cache singleton Envs just like Values
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

vast majority of envs is this size.

before:

  Benchmark 1: nix flakes search --no-eval-cache --offline ../nixpkgs hello
    Time (mean ± σ):      6.946 s ±  0.041 s    [User: 5.875 s, System: 0.835 s]
    Range (min … max):    6.834 s …  7.005 s    20 runs

  Benchmark 2: nix flakes eval -f ../nixpkgs/pkgs/development/haskell-modules/hackage-packages.nix
    Time (mean ± σ):     330.3 ms ±   2.5 ms    [User: 299.2 ms, System: 30.9 ms]
    Range (min … max):   327.5 ms … 337.7 ms    20 runs

  Benchmark 3: nix eval --raw --impure --expr 'with import <nixpkgs/nixos> {}; system'
    Time (mean ± σ):      2.671 s ±  0.035 s    [User: 2.370 s, System: 0.232 s]
    Range (min … max):    2.597 s …  2.749 s    20 runs

after:

  Benchmark 1: nix flakes search --no-eval-cache --offline ../nixpkgs hello
    Time (mean ± σ):      6.935 s ±  0.052 s    [User: 5.852 s, System: 0.853 s]
    Range (min … max):    6.808 s …  7.026 s    20 runs

  Benchmark 2: nix flakes eval -f ../nixpkgs/pkgs/development/haskell-modules/hackage-packages.nix
    Time (mean ± σ):     329.8 ms ±   2.7 ms    [User: 299.0 ms, System: 30.8 ms]
    Range (min … max):   326.6 ms … 336.5 ms    20 runs

  Benchmark 3: nix flakes eval --raw --impure --file expr.nix
    Time (mean ± σ):      2.655 s ±  0.038 s    [User: 2.364 s, System: 0.220 s]
    Range (min … max):    2.574 s …  2.737 s    20 runs
---
 src/libexpr/eval.cc | 21 ++++++++++++++++++++-
 src/libexpr/eval.hh |  3 +++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 777f6a4ec..ddbbdeaa6 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -438,8 +438,10 @@ EvalState::EvalState(
     , regexCache(makeRegexCache())
 #if HAVE_BOEHMGC
     , valueAllocCache(std::allocate_shared<void *>(traceable_allocator<void *>(), nullptr))
+    , env1AllocCache(std::allocate_shared<void *>(traceable_allocator<void *>(), nullptr))
 #else
     , valueAllocCache(std::make_shared<void *>(nullptr))
+    , env1AllocCache(std::make_shared<void *>(nullptr))
 #endif
     , baseEnv(allocEnv(128))
     , staticBaseEnv(false, 0)
@@ -892,7 +894,24 @@ Env & EvalState::allocEnv(size_t size)
 {
     nrEnvs++;
     nrValuesInEnvs += size;
-    Env * env = (Env *) allocBytes(sizeof(Env) + size * sizeof(Value *));
+
+    Env * env;
+
+    if (size != 1)
+        env = (Env *) allocBytes(sizeof(Env) + size * sizeof(Value *));
+    else {
+        /* see allocValue for explanations. */
+        if (!*env1AllocCache) {
+            *env1AllocCache = GC_malloc_many(sizeof(Env) + sizeof(Value *));
+            if (!*env1AllocCache) throw std::bad_alloc();
+        }
+
+        void * p = *env1AllocCache;
+        *env1AllocCache = GC_NEXT(p);
+        GC_NEXT(p) = nullptr;
+        env = (Env *) p;
+    }
+
     env->type = Env::Plain;
 
     /* We assume that env->values has been cleared by the allocator; maybeThunk() and lookupVar fromWith expect this. */
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index 800b00eef..41384f044 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -136,6 +136,9 @@ private:
     /* Allocation cache for GC'd Value objects. */
     std::shared_ptr<void *> valueAllocCache;
 
+    /* Allocation cache for size-1 Env objects. */
+    std::shared_ptr<void *> env1AllocCache;
+
 public:
 
     EvalState(

From c96460f3520862d52b7bf3108f609e20384878e7 Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Tue, 28 Dec 2021 19:18:17 +0100
Subject: [PATCH 130/251] force-inline a few much-used functions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

these functions are called a whole lot, and they're all comparatively small.
always inlining them gives ~0.7% performance boost on eval.

before:

  Benchmark 1: nix flakes search --no-eval-cache --offline ../nixpkgs hello
    Time (mean ± σ):      6.935 s ±  0.052 s    [User: 5.852 s, System: 0.853 s]
    Range (min … max):    6.808 s …  7.026 s    20 runs

  Benchmark 2: nix flakes eval -f ../nixpkgs/pkgs/development/haskell-modules/hackage-packages.nix
    Time (mean ± σ):     329.8 ms ±   2.7 ms    [User: 299.0 ms, System: 30.8 ms]
    Range (min … max):   326.6 ms … 336.5 ms    20 runs

  Benchmark 3: nix flakes eval --raw --impure --file expr.nix
    Time (mean ± σ):      2.655 s ±  0.038 s    [User: 2.364 s, System: 0.220 s]
    Range (min … max):    2.574 s …  2.737 s    20 runs

after:

  Benchmark 1: nix flakes search --no-eval-cache --offline ../nixpkgs hello
    Time (mean ± σ):      6.912 s ±  0.036 s    [User: 5.823 s, System: 0.856 s]
    Range (min … max):    6.849 s …  6.980 s    20 runs

  Benchmark 2: nix flakes eval -f ../nixpkgs/pkgs/development/haskell-modules/hackage-packages.nix
    Time (mean ± σ):     325.1 ms ±   2.5 ms    [User: 293.2 ms, System: 31.8 ms]
    Range (min … max):   322.2 ms … 332.8 ms    20 runs

  Benchmark 3: nix flakes eval --raw --impure --file expr.nix
    Time (mean ± σ):      2.636 s ±  0.024 s    [User: 2.352 s, System: 0.226 s]
    Range (min … max):    2.574 s …  2.681 s    20 runs
---
 src/libexpr/eval-inline.hh | 86 ++++++++++++++++++++++++++++++++------
 src/libexpr/eval.cc        | 53 -----------------------
 src/libexpr/eval.hh        |  6 ++-
 3 files changed, 77 insertions(+), 68 deletions(-)

diff --git a/src/libexpr/eval-inline.hh b/src/libexpr/eval-inline.hh
index aef1f6351..3331a7643 100644
--- a/src/libexpr/eval-inline.hh
+++ b/src/libexpr/eval-inline.hh
@@ -24,6 +24,76 @@ LocalNoInlineNoReturn(void throwTypeError(const Pos & pos, const char * s, const
 }
 
 
+/* Note: Various places expect the allocated memory to be zeroed. */
+[[gnu::always_inline]]
+inline void * allocBytes(size_t n)
+{
+    void * p;
+#if HAVE_BOEHMGC
+    p = GC_MALLOC(n);
+#else
+    p = calloc(n, 1);
+#endif
+    if (!p) throw std::bad_alloc();
+    return p;
+}
+
+
+[[gnu::always_inline]]
+Value * EvalState::allocValue()
+{
+    /* We use the boehm batch allocator to speed up allocations of Values (of which there are many).
+       GC_malloc_many returns a linked list of objects of the given size, where the first word
+       of each object is also the pointer to the next object in the list. This also means that we
+       have to explicitly clear the first word of every object we take. */
+    if (!*valueAllocCache) {
+        *valueAllocCache = GC_malloc_many(sizeof(Value));
+        if (!*valueAllocCache) throw std::bad_alloc();
+    }
+
+    /* GC_NEXT is a convenience macro for accessing the first word of an object.
+       Take the first list item, advance the list to the next item, and clear the next pointer. */
+    void * p = *valueAllocCache;
+    *valueAllocCache = GC_NEXT(p);
+    GC_NEXT(p) = nullptr;
+
+    nrValues++;
+    return (Value *) p;
+}
+
+
+[[gnu::always_inline]]
+Env & EvalState::allocEnv(size_t size)
+{
+    nrEnvs++;
+    nrValuesInEnvs += size;
+
+    Env * env;
+
+    if (size != 1)
+        env = (Env *) allocBytes(sizeof(Env) + size * sizeof(Value *));
+    else {
+        /* see allocValue for explanations. */
+        if (!*env1AllocCache) {
+            *env1AllocCache = GC_malloc_many(sizeof(Env) + sizeof(Value *));
+            if (!*env1AllocCache) throw std::bad_alloc();
+        }
+
+        void * p = *env1AllocCache;
+        *env1AllocCache = GC_NEXT(p);
+        GC_NEXT(p) = nullptr;
+        env = (Env *) p;
+    }
+
+    env->type = Env::Plain;
+
+    /* We assume that env->values has been cleared by the allocator; maybeThunk() and lookupVar fromWith expect this. */
+
+    return *env;
+}
+
+
+[[gnu::always_inline]]
 void EvalState::forceValue(Value & v, const Pos & pos)
 {
     forceValue(v, [&]() { return pos; });
@@ -52,6 +122,7 @@ void EvalState::forceValue(Value & v, Callable getPos)
 }
 
 
+[[gnu::always_inline]]
 inline void EvalState::forceAttrs(Value & v, const Pos & pos)
 {
     forceAttrs(v, [&]() { return pos; });
@@ -59,6 +130,7 @@ inline void EvalState::forceAttrs(Value & v, const Pos & pos)
 
 
 template <typename Callable>
+[[gnu::always_inline]]
 inline void EvalState::forceAttrs(Value & v, Callable getPos)
 {
     forceValue(v, getPos);
@@ -67,6 +139,7 @@ inline void EvalState::forceAttrs(Value & v, Callable getPos)
 }
 
 
+[[gnu::always_inline]]
 inline void EvalState::forceList(Value & v, const Pos & pos)
 {
     forceValue(v, pos);
@@ -74,18 +147,5 @@ inline void EvalState::forceList(Value & v, const Pos & pos)
         throwTypeError(pos, "value is %1% while a list was expected", v);
 }
 
-/* Note: Various places expect the allocated memory to be zeroed. */
-inline void * allocBytes(size_t n)
-{
-    void * p;
-#if HAVE_BOEHMGC
-    p = GC_MALLOC(n);
-#else
-    p = calloc(n, 1);
-#endif
-    if (!p) throw std::bad_alloc();
-    return p;
-}
-
 
 }
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index ddbbdeaa6..038b6bb7c 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -867,59 +867,6 @@ inline Value * EvalState::lookupVar(Env * env, const ExprVar & var, bool noEval)
 }
 
 
-Value * EvalState::allocValue()
-{
-    /* We use the boehm batch allocator to speed up allocations of Values (of which there are many).
-       GC_malloc_many returns a linked list of objects of the given size, where the first word
-       of each object is also the pointer to the next object in the list. This also means that we
-       have to explicitly clear the first word of every object we take. */
-    if (!*valueAllocCache) {
-        *valueAllocCache = GC_malloc_many(sizeof(Value));
-        if (!*valueAllocCache) throw std::bad_alloc();
-    }
-
-    /* GC_NEXT is a convenience macro for accessing the first word of an object.
-       Take the first list item, advance the list to the next item, and clear the next pointer. */
-    void * p = *valueAllocCache;
-    *valueAllocCache = GC_NEXT(p);
-    GC_NEXT(p) = nullptr;
-
-    nrValues++;
-    auto v = (Value *) p;
-    return v;
-}
-
-
-Env & EvalState::allocEnv(size_t size)
-{
-    nrEnvs++;
-    nrValuesInEnvs += size;
-
-    Env * env;
-
-    if (size != 1)
-        env = (Env *) allocBytes(sizeof(Env) + size * sizeof(Value *));
-    else {
-        /* see allocValue for explanations. */
-        if (!*env1AllocCache) {
-            *env1AllocCache = GC_malloc_many(sizeof(Env) + sizeof(Value *));
-            if (!*env1AllocCache) throw std::bad_alloc();
-        }
-
-        void * p = *env1AllocCache;
-        *env1AllocCache = GC_NEXT(p);
-        GC_NEXT(p) = nullptr;
-        env = (Env *) p;
-    }
-
-    env->type = Env::Plain;
-
-    /* We assume that env->values has been cleared by the allocator; maybeThunk() and lookupVar fromWith expect this. */
-
-    return *env;
-}
-
-
 void EvalState::mkList(Value & v, size_t size)
 {
     v.mkList(size);
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index 41384f044..d2efe8a47 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -350,8 +350,8 @@ public:
     void autoCallFunction(Bindings & args, Value & fun, Value & res);
 
     /* Allocation primitives. */
-    Value * allocValue();
-    Env & allocEnv(size_t size);
+    inline Value * allocValue();
+    inline Env & allocEnv(size_t size);
 
     Value * allocAttr(Value & vAttrs, const Symbol & name);
     Value * allocAttr(Value & vAttrs, std::string_view name);
@@ -512,3 +512,5 @@ extern EvalSettings evalSettings;
 static const std::string corepkgsPrefix{"/__corepkgs__/"};
 
 }
+
+#include "eval-inline.hh"

From 47baa9d43c0339b0a738b9b75c5ddcfb07d7131d Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Sat, 1 Jan 2022 19:24:20 +0100
Subject: [PATCH 131/251] make Pos smaller

reduces peak hep memory use on eval of our test system from 264.4MB to 242.3MB,
possibly also a slight performance boost.

theoretically memory use could be cut down by another eight bytes per Pos on
average by turning it into a tuple containing an index into a global base
position table with row and column offsets, but that doesn't seem worth the
effort at this point.
---
 src/libexpr/nixexpr.hh | 13 ++++++-------
 src/libutil/error.hh   |  1 +
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/libexpr/nixexpr.hh b/src/libexpr/nixexpr.hh
index 12b54b8eb..4dbe31510 100644
--- a/src/libexpr/nixexpr.hh
+++ b/src/libexpr/nixexpr.hh
@@ -23,14 +23,13 @@ MakeError(RestrictedPathError, Error);
 
 struct Pos
 {
-    FileOrigin origin;
     Symbol file;
-    unsigned int line, column;
-
-    Pos() : origin(foString), line(0), column(0) { }
-    Pos(FileOrigin origin, const Symbol & file, unsigned int line, unsigned int column)
-        : origin(origin), file(file), line(line), column(column) { }
-
+    uint32_t line;
+    FileOrigin origin:2;
+    uint32_t column:30;
+    Pos() : line(0), origin(foString), column(0) { };
+    Pos(FileOrigin origin, const Symbol & file, uint32_t line, uint32_t column)
+        : file(file), line(line), origin(origin), column(column) { };
     operator bool() const
     {
         return line != 0;
diff --git a/src/libutil/error.hh b/src/libutil/error.hh
index d55e1d701..bb43aa53b 100644
--- a/src/libutil/error.hh
+++ b/src/libutil/error.hh
@@ -53,6 +53,7 @@ typedef enum {
     lvlVomit
 } Verbosity;
 
+/* adjust Pos::origin bit width when adding stuff here */
 typedef enum {
     foFile,
     foStdin,

From 8e2eaaaf69d9e216fce3ca6f7913bd0e2048e4b2 Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Fri, 31 Dec 2021 00:50:23 +0100
Subject: [PATCH 132/251] make Finally more local

no need for function<> with c++17 deduction. this saves allocations and virtual
calls, but has the same semantics otherwise. not going through function has the
side effect of giving compilers more insight into the cleanup code, so we need a
few local warning disables.
---
 src/libutil/finally.hh |  7 +++----
 src/libutil/util.cc    | 15 ++++++++-------
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/src/libutil/finally.hh b/src/libutil/finally.hh
index 7760cfe9a..dee2e8d2f 100644
--- a/src/libutil/finally.hh
+++ b/src/libutil/finally.hh
@@ -1,14 +1,13 @@
 #pragma once
 
-#include <functional>
-
 /* A trivial class to run a function at the end of a scope. */
+template<typename Fn>
 class Finally
 {
 private:
-    std::function<void()> fun;
+    Fn fun;
 
 public:
-    Finally(std::function<void()> fun) : fun(fun) { }
+    Finally(Fn fun) : fun(std::move(fun)) { }
     ~Finally() { fun(); }
 };
diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index b833038a9..9f13d5f02 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -682,7 +682,14 @@ std::string drainFD(int fd, bool block, const size_t reserveSize)
 
 void drainFD(int fd, Sink & sink, bool block)
 {
-    int saved;
+    // silence GCC maybe-uninitialized warning in finally
+    int saved = 0;
+
+    if (!block) {
+        saved = fcntl(fd, F_GETFL);
+        if (fcntl(fd, F_SETFL, saved | O_NONBLOCK) == -1)
+            throw SysError("making file descriptor non-blocking");
+    }
 
     Finally finally([&]() {
         if (!block) {
@@ -691,12 +698,6 @@ void drainFD(int fd, Sink & sink, bool block)
         }
     });
 
-    if (!block) {
-        saved = fcntl(fd, F_GETFL);
-        if (fcntl(fd, F_SETFL, saved | O_NONBLOCK) == -1)
-            throw SysError("making file descriptor non-blocking");
-    }
-
     std::vector<unsigned char> buf(64 * 1024);
     while (1) {
         checkInterrupt();

From 4d629c4f7abbbe58dfe6d9d2b37541cdf2331606 Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Wed, 5 Jan 2022 01:48:26 +0100
Subject: [PATCH 133/251] add HAVE_BOEHMGC guards to batched allocation
 functions

---
 src/libexpr/eval-inline.hh | 13 +++++++++----
 src/libexpr/eval.hh        |  2 ++
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/src/libexpr/eval-inline.hh b/src/libexpr/eval-inline.hh
index 3331a7643..08a419923 100644
--- a/src/libexpr/eval-inline.hh
+++ b/src/libexpr/eval-inline.hh
@@ -42,6 +42,7 @@ inline void * allocBytes(size_t n)
 [[gnu::always_inline]]
 Value * EvalState::allocValue()
 {
+#if HAVE_BOEHMGC
     /* We use the boehm batch allocator to speed up allocations of Values (of which there are many).
        GC_malloc_many returns a linked list of objects of the given size, where the first word
        of each object is also the pointer to the next object in the list. This also means that we
@@ -56,6 +57,9 @@ Value * EvalState::allocValue()
     void * p = *valueAllocCache;
     *valueAllocCache = GC_NEXT(p);
     GC_NEXT(p) = nullptr;
+#else
+    void * p = allocBytes(sizeof(Value));
+#endif
 
     nrValues++;
     return (Value *) p;
@@ -70,9 +74,8 @@ Env & EvalState::allocEnv(size_t size)
 
     Env * env;
 
-    if (size != 1)
-        env = (Env *) allocBytes(sizeof(Env) + size * sizeof(Value *));
-    else {
+#if HAVE_BOEHMGC
+    if (size == 1) {
         /* see allocValue for explanations. */
         if (!*env1AllocCache) {
             *env1AllocCache = GC_malloc_many(sizeof(Env) + sizeof(Value *));
@@ -83,7 +86,9 @@ Env & EvalState::allocEnv(size_t size)
         *env1AllocCache = GC_NEXT(p);
         GC_NEXT(p) = nullptr;
         env = (Env *) p;
-    }
+    } else
+#endif
+        env = (Env *) allocBytes(sizeof(Env) + size * sizeof(Value *));
 
     env->type = Env::Plain;
 
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index d2efe8a47..f1e00bae7 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -133,11 +133,13 @@ private:
     /* Cache used by prim_match(). */
     std::shared_ptr<RegexCache> regexCache;
 
+#if HAVE_BOEHMGC
     /* Allocation cache for GC'd Value objects. */
     std::shared_ptr<void *> valueAllocCache;
 
     /* Allocation cache for size-1 Env objects. */
     std::shared_ptr<void *> env1AllocCache;
+#endif
 
 public:
 

From 761242afa08d5c9280ba6bd63a310b4334b83bb2 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 9 Mar 2022 12:25:35 +0100
Subject: [PATCH 134/251] BuildResult: Use DerivedPath

---
 src/libcmd/installables.cc                    | 20 ++++++++-------
 src/libstore/build-result.hh                  |  6 ++---
 src/libstore/build/derivation-goal.cc         |  6 ++---
 .../build/drv-output-substitution-goal.cc     |  8 ++++--
 src/libstore/build/entry-points.cc            | 15 ++++++-----
 src/libstore/build/goal.hh                    |  4 ++-
 src/libstore/build/substitution-goal.cc       |  3 +--
 src/libstore/legacy-ssh-store.cc              |  4 +--
 src/libstore/remote-store.cc                  | 25 +++++++++----------
 9 files changed, 48 insertions(+), 43 deletions(-)

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index d1ed19acf..b7623d4ba 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -826,15 +826,17 @@ BuiltPaths Installable::build(
         for (auto & buildResult : store->buildPathsWithResults(pathsToBuild, bMode, evalStore)) {
             if (!buildResult.success())
                 buildResult.rethrow();
-            if (buildResult.drvPath) {
-                std::map<std::string, StorePath> outputs;
-                for (auto & path : buildResult.builtOutputs)
-                    outputs.emplace(path.first.outputName, path.second.outPath);
-                res.push_back(BuiltPath::Built{*buildResult.drvPath, outputs});
-            } else if (buildResult.outPath) {
-                res.push_back(BuiltPath::Opaque{*buildResult.outPath});
-            } else
-                abort();
+            std::visit(overloaded {
+                [&](const DerivedPath::Built & bfd) {
+                    std::map<std::string, StorePath> outputs;
+                    for (auto & path : buildResult.builtOutputs)
+                        outputs.emplace(path.first.outputName, path.second.outPath);
+                    res.push_back(BuiltPath::Built { bfd.drvPath, outputs });
+                },
+                [&](const DerivedPath::Opaque & bo) {
+                    res.push_back(BuiltPath::Opaque { bo.path });
+                },
+            }, buildResult.path.raw());
         }
         return res;
     }
diff --git a/src/libstore/build-result.hh b/src/libstore/build-result.hh
index c16027808..d39d23a76 100644
--- a/src/libstore/build-result.hh
+++ b/src/libstore/build-result.hh
@@ -64,13 +64,13 @@ struct BuildResult
        non-determinism.) */
     bool isNonDeterministic = false;
 
+    /* The derivation we built or the store path we substituted. */
+    DerivedPath path;
+
     /* For derivations, the derivation path and the wanted outputs. */
     std::optional<StorePath> drvPath;
     DrvOutputs builtOutputs;
 
-    /* For substitutions, the substituted path. */
-    std::optional<StorePath> outPath;
-
     /* The start/stop times of the build (or one of the rounds, if it
        was repeated). */
     time_t startTime = 0, stopTime = 0;
diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index cd582bb01..325635e2e 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -66,7 +66,7 @@ namespace nix {
 
 DerivationGoal::DerivationGoal(const StorePath & drvPath,
     const StringSet & wantedOutputs, Worker & worker, BuildMode buildMode)
-    : Goal(worker)
+    : Goal(worker, DerivedPath::Built { .drvPath = drvPath, .outputs = wantedOutputs })
     , useDerivation(true)
     , drvPath(drvPath)
     , wantedOutputs(wantedOutputs)
@@ -85,7 +85,7 @@ DerivationGoal::DerivationGoal(const StorePath & drvPath,
 
 DerivationGoal::DerivationGoal(const StorePath & drvPath, const BasicDerivation & drv,
     const StringSet & wantedOutputs, Worker & worker, BuildMode buildMode)
-    : Goal(worker)
+    : Goal(worker, DerivedPath::Built { .drvPath = drvPath, .outputs = wantedOutputs })
     , useDerivation(false)
     , drvPath(drvPath)
     , wantedOutputs(wantedOutputs)
@@ -509,7 +509,7 @@ void DerivationGoal::inputsRealised()
     state = &DerivationGoal::tryToBuild;
     worker.wakeUp(shared_from_this());
 
-    buildResult = BuildResult();
+    buildResult = BuildResult { .path = buildResult.path };
 }
 
 void DerivationGoal::started()
diff --git a/src/libstore/build/drv-output-substitution-goal.cc b/src/libstore/build/drv-output-substitution-goal.cc
index 946ec1aff..e50292c1e 100644
--- a/src/libstore/build/drv-output-substitution-goal.cc
+++ b/src/libstore/build/drv-output-substitution-goal.cc
@@ -6,8 +6,12 @@
 
 namespace nix {
 
-DrvOutputSubstitutionGoal::DrvOutputSubstitutionGoal(const DrvOutput& id, Worker & worker, RepairFlag repair, std::optional<ContentAddress> ca)
-    : Goal(worker)
+DrvOutputSubstitutionGoal::DrvOutputSubstitutionGoal(
+    const DrvOutput & id,
+    Worker & worker,
+    RepairFlag repair,
+    std::optional<ContentAddress> ca)
+    : Goal(worker, DerivedPath::Opaque { StorePath::dummy })
     , id(id)
 {
     state = &DrvOutputSubstitutionGoal::init;
diff --git a/src/libstore/build/entry-points.cc b/src/libstore/build/entry-points.cc
index b2f87aa82..bea7363db 100644
--- a/src/libstore/build/entry-points.cc
+++ b/src/libstore/build/entry-points.cc
@@ -82,17 +82,16 @@ BuildResult Store::buildDerivation(const StorePath & drvPath, const BasicDerivat
     Worker worker(*this, *this);
     auto goal = worker.makeBasicDerivationGoal(drvPath, drv, {}, buildMode);
 
-    BuildResult result;
-
     try {
         worker.run(Goals{goal});
-        result = goal->buildResult;
+        return goal->buildResult;
     } catch (Error & e) {
-        result.status = BuildResult::MiscFailure;
-        result.errorMsg = e.msg();
-    }
-
-    return result;
+        return BuildResult {
+            .status = BuildResult::MiscFailure,
+            .errorMsg = e.msg(),
+            .path = DerivedPath::Built { .drvPath = drvPath },
+        };
+    };
 }
 
 
diff --git a/src/libstore/build/goal.hh b/src/libstore/build/goal.hh
index fcf3d0084..07c752bb9 100644
--- a/src/libstore/build/goal.hh
+++ b/src/libstore/build/goal.hh
@@ -62,7 +62,9 @@ struct Goal : public std::enable_shared_from_this<Goal>
     /* Exception containing an error message, if any. */
     std::optional<Error> ex;
 
-    Goal(Worker & worker) : worker(worker)
+    Goal(Worker & worker, DerivedPath path)
+        : worker(worker)
+        , buildResult { .path = std::move(path) }
     {
         nrFailed = nrNoSubstituters = nrIncompleteClosure = 0;
         exitCode = ecBusy;
diff --git a/src/libstore/build/substitution-goal.cc b/src/libstore/build/substitution-goal.cc
index ec500baf8..31e6dbc9f 100644
--- a/src/libstore/build/substitution-goal.cc
+++ b/src/libstore/build/substitution-goal.cc
@@ -6,7 +6,7 @@
 namespace nix {
 
 PathSubstitutionGoal::PathSubstitutionGoal(const StorePath & storePath, Worker & worker, RepairFlag repair, std::optional<ContentAddress> ca)
-    : Goal(worker)
+    : Goal(worker, DerivedPath::Opaque { storePath })
     , storePath(storePath)
     , repair(repair)
     , ca(ca)
@@ -26,7 +26,6 @@ PathSubstitutionGoal::~PathSubstitutionGoal()
 
 void PathSubstitutionGoal::done(ExitCode result, BuildResult::Status status)
 {
-    buildResult.outPath = storePath;
     buildResult.status = status;
     amDone(result);
 }
diff --git a/src/libstore/legacy-ssh-store.cc b/src/libstore/legacy-ssh-store.cc
index 16c2b90c6..dd34b19c6 100644
--- a/src/libstore/legacy-ssh-store.cc
+++ b/src/libstore/legacy-ssh-store.cc
@@ -279,7 +279,7 @@ public:
 
         conn->to.flush();
 
-        BuildResult status;
+        BuildResult status { .path = DerivedPath::Built { .drvPath = drvPath } };
         status.status = (BuildResult::Status) readInt(conn->from);
         conn->from >> status.errorMsg;
 
@@ -317,7 +317,7 @@ public:
 
         conn->to.flush();
 
-        BuildResult result;
+        BuildResult result { .path = DerivedPath::Opaque { StorePath::dummy } };
         result.status = (BuildResult::Status) readInt(conn->from);
 
         if (!result.success()) {
diff --git a/src/libstore/remote-store.cc b/src/libstore/remote-store.cc
index a0883db11..347e32094 100644
--- a/src/libstore/remote-store.cc
+++ b/src/libstore/remote-store.cc
@@ -93,7 +93,8 @@ void write(const Store & store, Sink & out, const DrvOutput & drvOutput)
 
 BuildResult read(const Store & store, Source & from, Phantom<BuildResult> _)
 {
-    BuildResult res;
+    auto path = worker_proto::read(store, from, Phantom<DerivedPath> {});
+    BuildResult res { .path = path };
     res.status = (BuildResult::Status) readInt(from);
     from
         >> res.errorMsg
@@ -101,14 +102,13 @@ BuildResult read(const Store & store, Source & from, Phantom<BuildResult> _)
         >> res.isNonDeterministic
         >> res.startTime
         >> res.stopTime;
-    res.drvPath = worker_proto::read(store, from, Phantom<std::optional<StorePath>> {});
     res.builtOutputs = worker_proto::read(store, from, Phantom<DrvOutputs> {});
-    res.outPath = worker_proto::read(store, from, Phantom<std::optional<StorePath>> {});
     return res;
 }
 
 void write(const Store & store, Sink & to, const BuildResult & res)
 {
+    worker_proto::write(store, to, res.path);
     to
         << res.status
         << res.errorMsg
@@ -116,9 +116,7 @@ void write(const Store & store, Sink & to, const BuildResult & res)
         << res.isNonDeterministic
         << res.startTime
         << res.stopTime;
-    worker_proto::write(store, to, res.drvPath);
     worker_proto::write(store, to, res.builtOutputs);
-    worker_proto::write(store, to, res.outPath);
 }
 
 
@@ -842,15 +840,16 @@ std::vector<BuildResult> RemoteStore::buildPathsWithResults(
             std::visit(
                 overloaded {
                     [&](const DerivedPath::Opaque & bo) {
-                        BuildResult res;
-                        res.status = BuildResult::Substituted;
-                        res.outPath = bo.path;
-                        results.push_back(res);
+                        results.push_back(BuildResult {
+                            .status = BuildResult::Substituted,
+                            .path = bo,
+                        });
                     },
                     [&](const DerivedPath::Built & bfd) {
-                        BuildResult res;
-                        res.status = BuildResult::Built;
-                        res.drvPath = bfd.drvPath;
+                        BuildResult res {
+                            .status = BuildResult::Built,
+                            .path = bfd,
+                        };
 
                         OutputPathMap outputs;
                         auto drv = evalStore->readDerivation(bfd.drvPath);
@@ -905,7 +904,7 @@ BuildResult RemoteStore::buildDerivation(const StorePath & drvPath, const BasicD
     writeDerivation(conn->to, *this, drv);
     conn->to << buildMode;
     conn.processStderr();
-    BuildResult res;
+    BuildResult res { .path = DerivedPath::Built { .drvPath = drvPath } };
     res.status = (BuildResult::Status) readInt(conn->from);
     conn->from >> res.errorMsg;
     if (GET_PROTOCOL_MINOR(conn->daemonVersion) >= 29) {

From 4d98143914120d0163f5c50f30ce8a5289433f8f Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 9 Mar 2022 20:31:50 +0100
Subject: [PATCH 135/251] BuildResult: Remove unused drvPath field

---
 src/libstore/build-result.hh          | 4 ++--
 src/libstore/build/derivation-goal.cc | 1 -
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/libstore/build-result.hh b/src/libstore/build-result.hh
index d39d23a76..cb6d19b8e 100644
--- a/src/libstore/build-result.hh
+++ b/src/libstore/build-result.hh
@@ -67,8 +67,8 @@ struct BuildResult
     /* The derivation we built or the store path we substituted. */
     DerivedPath path;
 
-    /* For derivations, the derivation path and the wanted outputs. */
-    std::optional<StorePath> drvPath;
+    /* For derivations, a mapping from the names of the wanted outputs
+       to actual paths. */
     DrvOutputs builtOutputs;
 
     /* The start/stop times of the build (or one of the rounds, if it
diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index 325635e2e..afed9bf16 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -1324,7 +1324,6 @@ void DerivationGoal::done(
     DrvOutputs builtOutputs,
     std::optional<Error> ex)
 {
-    buildResult.drvPath = drvPath;
     buildResult.status = status;
     if (ex)
         // FIXME: strip: "error: "

From 167766b65ca203238f733efd0b5df92d28ab66c4 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 11 Mar 2022 11:19:21 +0100
Subject: [PATCH 136/251] Style

---
 src/libfetchers/git.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/libfetchers/git.cc b/src/libfetchers/git.cc
index 6884e8de7..d75c5d3ae 100644
--- a/src/libfetchers/git.cc
+++ b/src/libfetchers/git.cc
@@ -239,13 +239,13 @@ struct GitInputScheme : InputScheme
             auto errorMessage = result.second;
 
             if (errorMessage.find("fatal: not a git repository") != std::string::npos) {
-                throw Error("'%s' is not a git repository.", actualUrl);
+                throw Error("'%s' is not a Git repository", actualUrl);
             } else if (errorMessage.find("fatal: Needed a single revision") != std::string::npos) {
                 // indicates that the repo does not have any commits
                 // we want to proceed and will consider it dirty later
             } else if (exitCode != 0) {
                 // any other errors should lead to a failure
-                throw Error("Getting the HEAD of the git tree '%s' failed with exit code %d:\n%s", actualUrl, exitCode, errorMessage);
+                throw Error("getting the HEAD of the Git tree '%s' failed with exit code %d:\n%s", actualUrl, exitCode, errorMessage);
             }
 
             bool hasHead = exitCode == 0;

From 073e134de6260de7d90b135b7e173157741d4853 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 8 Mar 2022 17:45:19 +0000
Subject: [PATCH 137/251] Rename `requireGcStore` to `GcStore::require`

I should have done this to begin with. This will be nicer once more
Store sub-interfaces exist too, to illustrate the pattern.
---
 src/libstore/daemon.cc                         | 6 +++---
 src/libstore/gc-store.cc                       | 2 +-
 src/libstore/gc-store.hh                       | 4 ++--
 src/nix-collect-garbage/nix-collect-garbage.cc | 2 +-
 src/nix-store/nix-store.cc                     | 6 +++---
 src/nix/store-delete.cc                        | 2 +-
 src/nix/store-gc.cc                            | 2 +-
 7 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index e6760664c..ffc605410 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -645,7 +645,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         Path path = absPath(readString(from));
 
         logger->startWork();
-        auto & gcStore = requireGcStore(*store);
+        auto & gcStore = GcStore::require(*store);
         gcStore.addIndirectRoot(path);
         logger->stopWork();
 
@@ -663,7 +663,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
 
     case wopFindRoots: {
         logger->startWork();
-        auto & gcStore = requireGcStore(*store);
+        auto & gcStore = GcStore::require(*store);
         Roots roots = gcStore.findRoots(!trusted);
         logger->stopWork();
 
@@ -695,7 +695,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         logger->startWork();
         if (options.ignoreLiveness)
             throw Error("you are not allowed to ignore liveness");
-        auto & gcStore = requireGcStore(*store);
+        auto & gcStore = GcStore::require(*store);
         gcStore.collectGarbage(options, results);
         logger->stopWork();
 
diff --git a/src/libstore/gc-store.cc b/src/libstore/gc-store.cc
index 3dbdec53b..4516cc744 100644
--- a/src/libstore/gc-store.cc
+++ b/src/libstore/gc-store.cc
@@ -2,7 +2,7 @@
 
 namespace nix {
 
-GcStore & requireGcStore(Store & store)
+GcStore & GcStore::require(Store & store)
 {
     auto * gcStore = dynamic_cast<GcStore *>(&store);
     if (!gcStore)
diff --git a/src/libstore/gc-store.hh b/src/libstore/gc-store.hh
index 829f70dc4..462cc097b 100644
--- a/src/libstore/gc-store.hh
+++ b/src/libstore/gc-store.hh
@@ -77,8 +77,8 @@ struct GcStore : public virtual Store
 
     /* Perform a garbage collection. */
     virtual void collectGarbage(const GCOptions & options, GCResults & results) = 0;
+
+    static GcStore & require(Store & store);
 };
 
-GcStore & requireGcStore(Store & store);
-
 }
diff --git a/src/nix-collect-garbage/nix-collect-garbage.cc b/src/nix-collect-garbage/nix-collect-garbage.cc
index 4b28ea6a4..b61f0e640 100644
--- a/src/nix-collect-garbage/nix-collect-garbage.cc
+++ b/src/nix-collect-garbage/nix-collect-garbage.cc
@@ -81,7 +81,7 @@ static int main_nix_collect_garbage(int argc, char * * argv)
         // Run the actual garbage collector.
         if (!dryRun) {
             auto store = openStore();
-            auto & gcStore = requireGcStore(*store);
+            auto & gcStore = GcStore::require(*store);
             options.action = GCOptions::gcDeleteDead;
             GCResults results;
             PrintFreed freed(true, results);
diff --git a/src/nix-store/nix-store.cc b/src/nix-store/nix-store.cc
index 8ebaf9387..33493500c 100644
--- a/src/nix-store/nix-store.cc
+++ b/src/nix-store/nix-store.cc
@@ -429,7 +429,7 @@ static void opQuery(Strings opFlags, Strings opArgs)
             store->computeFSClosure(
                 args, referrers, true, settings.gcKeepOutputs, settings.gcKeepDerivations);
 
-            auto & gcStore = requireGcStore(*store);
+            auto & gcStore = GcStore::require(*store);
             Roots roots = gcStore.findRoots(false);
             for (auto & [target, links] : roots)
                 if (referrers.find(target) != referrers.end())
@@ -590,7 +590,7 @@ static void opGC(Strings opFlags, Strings opArgs)
 
     if (!opArgs.empty()) throw UsageError("no arguments expected");
 
-    auto & gcStore = requireGcStore(*store);
+    auto & gcStore = GcStore::require(*store);
 
     if (printRoots) {
         Roots roots = gcStore.findRoots(false);
@@ -629,7 +629,7 @@ static void opDelete(Strings opFlags, Strings opArgs)
     for (auto & i : opArgs)
         options.pathsToDelete.insert(store->followLinksToStorePath(i));
 
-    auto & gcStore = requireGcStore(*store);
+    auto & gcStore = GcStore::require(*store);
 
     GCResults results;
     PrintFreed freed(true, results);
diff --git a/src/nix/store-delete.cc b/src/nix/store-delete.cc
index aa7a8b12f..0de7efaba 100644
--- a/src/nix/store-delete.cc
+++ b/src/nix/store-delete.cc
@@ -33,7 +33,7 @@ struct CmdStoreDelete : StorePathsCommand
 
     void run(ref<Store> store, std::vector<StorePath> && storePaths) override
     {
-        auto & gcStore = requireGcStore(*store);
+        auto & gcStore = GcStore::require(*store);
 
         for (auto & path : storePaths)
             options.pathsToDelete.insert(path);
diff --git a/src/nix/store-gc.cc b/src/nix/store-gc.cc
index 21718dc0c..515f4ffdb 100644
--- a/src/nix/store-gc.cc
+++ b/src/nix/store-gc.cc
@@ -34,7 +34,7 @@ struct CmdStoreGC : StoreCommand, MixDryRun
 
     void run(ref<Store> store) override
     {
-        auto & gcStore = requireGcStore(*store);
+        auto & gcStore = GcStore::require(*store);
 
         options.action = dryRun ? GCOptions::gcReturnDead : GCOptions::gcDeleteDead;
         GCResults results;

From 89effe9d4abde2ea8970736f79e0a6a499777692 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 8 Mar 2022 18:28:29 +0000
Subject: [PATCH 138/251] `GcStore::resolve` should print the URI

---
 src/libstore/gc-store.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libstore/gc-store.cc b/src/libstore/gc-store.cc
index 4516cc744..dc2b82166 100644
--- a/src/libstore/gc-store.cc
+++ b/src/libstore/gc-store.cc
@@ -6,7 +6,7 @@ GcStore & GcStore::require(Store & store)
 {
     auto * gcStore = dynamic_cast<GcStore *>(&store);
     if (!gcStore)
-        throw UsageError("Garbage collection not supported by this store");
+        throw UsageError("Garbage collection not supported by store '%s'", store.getUri());
     return *gcStore;
 }
 

From 678d1c2aa0f499466c723d3461277dc197515f57 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 8 Mar 2022 18:20:39 +0000
Subject: [PATCH 139/251] Factor out a `LogStore` interface

Continue progress on #5729.

Just as I hoped, this uncovered an issue: the daemon protocol is missing
a way to query build logs. This doesn't effect `unix://`, but does
effect `ssh://`. A FIXME is left for this, so we come back to it later.
---
 src/libstore/binary-cache-store.hh          |  5 ++++-
 src/libstore/build/local-derivation-goal.cc |  6 ++++++
 src/libstore/daemon.cc                      |  4 +++-
 src/libstore/local-fs-store.hh              |  6 +++++-
 src/libstore/log-store.cc                   | 13 +++++++++++++
 src/libstore/log-store.hh                   | 19 +++++++++++++++++++
 src/libstore/remote-store.hh                |  6 +++++-
 src/libstore/ssh-store.cc                   |  4 ++++
 src/libstore/store-api.hh                   |  8 --------
 src/nix-store/nix-store.cc                  |  9 ++++++---
 src/nix/log.cc                              | 14 +++++++++++---
 src/nix/repl.cc                             | 12 ++++++++++--
 src/nix/store-copy-log.cc                   |  8 ++++++--
 13 files changed, 92 insertions(+), 22 deletions(-)
 create mode 100644 src/libstore/log-store.cc
 create mode 100644 src/libstore/log-store.hh

diff --git a/src/libstore/binary-cache-store.hh b/src/libstore/binary-cache-store.hh
index 9603a8caa..ca538b3cb 100644
--- a/src/libstore/binary-cache-store.hh
+++ b/src/libstore/binary-cache-store.hh
@@ -2,6 +2,7 @@
 
 #include "crypto.hh"
 #include "store-api.hh"
+#include "log-store.hh"
 
 #include "pool.hh"
 
@@ -28,7 +29,9 @@ struct BinaryCacheStoreConfig : virtual StoreConfig
         "other than -1 which we reserve to indicate Nix defaults should be used"};
 };
 
-class BinaryCacheStore : public virtual BinaryCacheStoreConfig, public virtual Store
+class BinaryCacheStore : public virtual BinaryCacheStoreConfig,
+    public virtual Store,
+    public virtual LogStore
 {
 
 private:
diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index a372728f5..4e763e570 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -1340,6 +1340,12 @@ struct RestrictedStore : public virtual RestrictedStoreConfig, public virtual Lo
         next->queryMissing(allowed, willBuild, willSubstitute,
             unknown, downloadSize, narSize);
     }
+
+    virtual std::optional<std::string> getBuildLog(const StorePath & path) override
+    { return std::nullopt; }
+
+    virtual void addBuildLog(const StorePath & path, std::string_view log) override
+    { unsupported("addBuildLog"); }
 };
 
 
diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index ffc605410..1e24a1c79 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -4,6 +4,7 @@
 #include "build-result.hh"
 #include "store-api.hh"
 #include "gc-store.hh"
+#include "log-store.hh"
 #include "path-with-outputs.hh"
 #include "finally.hh"
 #include "archive.hh"
@@ -953,11 +954,12 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         logger->startWork();
         if (!trusted)
             throw Error("you are not privileged to add logs");
+        auto & logStore = LogStore::require(*store);
         {
             FramedSource source(from);
             StringSink sink;
             source.drainInto(sink);
-            store->addBuildLog(path, sink.s);
+            logStore.addBuildLog(path, sink.s);
         }
         logger->stopWork();
         to << 1;
diff --git a/src/libstore/local-fs-store.hh b/src/libstore/local-fs-store.hh
index fbd49dc2c..e6fb3201a 100644
--- a/src/libstore/local-fs-store.hh
+++ b/src/libstore/local-fs-store.hh
@@ -2,6 +2,7 @@
 
 #include "store-api.hh"
 #include "gc-store.hh"
+#include "log-store.hh"
 
 namespace nix {
 
@@ -24,7 +25,10 @@ struct LocalFSStoreConfig : virtual StoreConfig
         "physical path to the Nix store"};
 };
 
-class LocalFSStore : public virtual LocalFSStoreConfig, public virtual Store, virtual GcStore
+class LocalFSStore : public virtual LocalFSStoreConfig,
+    public virtual Store,
+    public virtual GcStore,
+    public virtual LogStore
 {
 public:
 
diff --git a/src/libstore/log-store.cc b/src/libstore/log-store.cc
new file mode 100644
index 000000000..56aec91f2
--- /dev/null
+++ b/src/libstore/log-store.cc
@@ -0,0 +1,13 @@
+#include "log-store.hh"
+
+namespace nix {
+
+LogStore & LogStore::require(Store & store)
+{
+    auto * gcStore = dynamic_cast<LogStore *>(&store);
+    if (!gcStore)
+        throw UsageError("Build log storage and retrieval not supported by store '%s'", store.getUri());
+    return *gcStore;
+}
+
+}
diff --git a/src/libstore/log-store.hh b/src/libstore/log-store.hh
new file mode 100644
index 000000000..ad17cbe6e
--- /dev/null
+++ b/src/libstore/log-store.hh
@@ -0,0 +1,19 @@
+#pragma once
+
+#include "store-api.hh"
+
+
+namespace nix {
+
+struct LogStore : public virtual Store
+{
+    /* Return the build log of the specified store path, if available,
+       or null otherwise. */
+    virtual std::optional<std::string> getBuildLog(const StorePath & path) = 0;
+
+    virtual void addBuildLog(const StorePath & path, std::string_view log) = 0;
+
+    static LogStore & require(Store & store);
+};
+
+}
diff --git a/src/libstore/remote-store.hh b/src/libstore/remote-store.hh
index 9f6f50593..8493be6fc 100644
--- a/src/libstore/remote-store.hh
+++ b/src/libstore/remote-store.hh
@@ -5,6 +5,7 @@
 
 #include "store-api.hh"
 #include "gc-store.hh"
+#include "log-store.hh"
 
 
 namespace nix {
@@ -30,7 +31,10 @@ struct RemoteStoreConfig : virtual StoreConfig
 
 /* FIXME: RemoteStore is a misnomer - should be something like
    DaemonStore. */
-class RemoteStore : public virtual RemoteStoreConfig, public virtual Store, public virtual GcStore
+class RemoteStore : public virtual RemoteStoreConfig,
+    public virtual Store,
+    public virtual GcStore,
+    public virtual LogStore
 {
 public:
 
diff --git a/src/libstore/ssh-store.cc b/src/libstore/ssh-store.cc
index bb03daef4..62daa838c 100644
--- a/src/libstore/ssh-store.cc
+++ b/src/libstore/ssh-store.cc
@@ -52,6 +52,10 @@ public:
     bool sameMachine() override
     { return false; }
 
+    // FIXME extend daemon protocol, move implementation to RemoteStore
+    std::optional<std::string> getBuildLog(const StorePath & path) override
+    { unsupported("getBuildLog"); }
+
 private:
 
     struct Connection : RemoteStore::Connection
diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
index e99a3f2cb..635a82a2a 100644
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@@ -605,14 +605,6 @@ public:
      */
     StorePathSet exportReferences(const StorePathSet & storePaths, const StorePathSet & inputPaths);
 
-    /* Return the build log of the specified store path, if available,
-       or null otherwise. */
-    virtual std::optional<std::string> getBuildLog(const StorePath & path)
-    { return std::nullopt; }
-
-    virtual void addBuildLog(const StorePath & path, std::string_view log)
-    { unsupported("addBuildLog"); }
-
     /* Hack to allow long-running processes like hydra-queue-runner to
        occasionally flush their path info cache. */
     void clearPathInfoCache()
diff --git a/src/nix-store/nix-store.cc b/src/nix-store/nix-store.cc
index 33493500c..b3f28bcc2 100644
--- a/src/nix-store/nix-store.cc
+++ b/src/nix-store/nix-store.cc
@@ -4,6 +4,7 @@
 #include "globals.hh"
 #include "build-result.hh"
 #include "gc-store.hh"
+#include "log-store.hh"
 #include "local-store.hh"
 #include "monitor-fd.hh"
 #include "serve-protocol.hh"
@@ -474,13 +475,15 @@ static void opReadLog(Strings opFlags, Strings opArgs)
 {
     if (!opFlags.empty()) throw UsageError("unknown flag");
 
+    auto & logStore = LogStore::require(*store);
+
     RunPager pager;
 
     for (auto & i : opArgs) {
-        auto path = store->followLinksToStorePath(i);
-        auto log = store->getBuildLog(path);
+        auto path = logStore.followLinksToStorePath(i);
+        auto log = logStore.getBuildLog(path);
         if (!log)
-            throw Error("build log of derivation '%s' is not available", store->printStorePath(path));
+            throw Error("build log of derivation '%s' is not available", logStore.printStorePath(path));
         std::cout << *log;
     }
 }
diff --git a/src/nix/log.cc b/src/nix/log.cc
index fd3c1d787..72d02ef11 100644
--- a/src/nix/log.cc
+++ b/src/nix/log.cc
@@ -2,6 +2,7 @@
 #include "common-args.hh"
 #include "shared.hh"
 #include "store-api.hh"
+#include "log-store.hh"
 #include "progress-bar.hh"
 
 using namespace nix;
@@ -34,17 +35,24 @@ struct CmdLog : InstallableCommand
 
         RunPager pager;
         for (auto & sub : subs) {
+            auto * logSubP = dynamic_cast<LogStore *>(&*sub);
+            if (!logSubP) {
+                printInfo("Skipped '%s' which does not support retrieving build logs", sub->getUri());
+                continue;
+            }
+            auto & logSub = *logSubP;
+
             auto log = std::visit(overloaded {
                 [&](const DerivedPath::Opaque & bo) {
-                    return sub->getBuildLog(bo.path);
+                    return logSub.getBuildLog(bo.path);
                 },
                 [&](const DerivedPath::Built & bfd) {
-                    return sub->getBuildLog(bfd.drvPath);
+                    return logSub.getBuildLog(bfd.drvPath);
                 },
             }, b.raw());
             if (!log) continue;
             stopProgressBar();
-            printInfo("got build log for '%s' from '%s'", installable->what(), sub->getUri());
+            printInfo("got build log for '%s' from '%s'", installable->what(), logSub.getUri());
             std::cout << *log;
             return;
         }
diff --git a/src/nix/repl.cc b/src/nix/repl.cc
index 3a51a13e6..916353d8c 100644
--- a/src/nix/repl.cc
+++ b/src/nix/repl.cc
@@ -25,6 +25,7 @@ extern "C" {
 #include "eval-inline.hh"
 #include "attr-path.hh"
 #include "store-api.hh"
+#include "log-store.hh"
 #include "common-eval-args.hh"
 #include "get-drvs.hh"
 #include "derivations.hh"
@@ -526,9 +527,16 @@ bool NixRepl::processLine(std::string line)
             bool foundLog = false;
             RunPager pager;
             for (auto & sub : subs) {
-                auto log = sub->getBuildLog(drvPath);
+                auto * logSubP = dynamic_cast<LogStore *>(&*sub);
+                if (!logSubP) {
+                    printInfo("Skipped '%s' which does not support retrieving build logs", sub->getUri());
+                    continue;
+                }
+                auto & logSub = *logSubP;
+
+                auto log = logSub.getBuildLog(drvPath);
                 if (log) {
-                    printInfo("got build log for '%s' from '%s'", drvPathRaw, sub->getUri());
+                    printInfo("got build log for '%s' from '%s'", drvPathRaw, logSub.getUri());
                     logger->writeToStdout(*log);
                     foundLog = true;
                     break;
diff --git a/src/nix/store-copy-log.cc b/src/nix/store-copy-log.cc
index 079cd6b3e..22b3980c0 100644
--- a/src/nix/store-copy-log.cc
+++ b/src/nix/store-copy-log.cc
@@ -1,6 +1,7 @@
 #include "command.hh"
 #include "shared.hh"
 #include "store-api.hh"
+#include "log-store.hh"
 #include "sync.hh"
 #include "thread-pool.hh"
 
@@ -26,7 +27,10 @@ struct CmdCopyLog : virtual CopyCommand, virtual InstallablesCommand
 
     void run(ref<Store> srcStore) override
     {
+        auto & srcLogStore = LogStore::require(*srcStore);
+
         auto dstStore = getDstStore();
+        auto & dstLogStore = LogStore::require(*dstStore);
 
         StorePathSet drvPaths;
 
@@ -35,8 +39,8 @@ struct CmdCopyLog : virtual CopyCommand, virtual InstallablesCommand
                 drvPaths.insert(drvPath);
 
         for (auto & drvPath : drvPaths) {
-            if (auto log = srcStore->getBuildLog(drvPath))
-                dstStore->addBuildLog(drvPath, *log);
+            if (auto log = srcLogStore.getBuildLog(drvPath))
+                dstLogStore.addBuildLog(drvPath, *log);
             else
                 throw Error("build log for '%s' is not available", srcStore->printStorePath(drvPath));
         }

From a03b1fd7f60788304f358d5f4dc063c7c9e650a9 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 9 Mar 2022 15:27:48 +0000
Subject: [PATCH 140/251] Deduplicate the Store downcasting with a template

---
 src/libstore/daemon.cc                         |  9 +++++----
 src/libstore/gc-store.cc                       | 13 -------------
 src/libstore/gc-store.hh                       |  4 ++--
 src/libstore/log-store.cc                      | 13 -------------
 src/libstore/log-store.hh                      |  2 ++
 src/libstore/store-cast.hh                     | 16 ++++++++++++++++
 src/nix-collect-garbage/nix-collect-garbage.cc |  3 ++-
 src/nix-store/nix-store.cc                     |  9 +++++----
 src/nix/store-copy-log.cc                      |  5 +++--
 src/nix/store-delete.cc                        |  3 ++-
 src/nix/store-gc.cc                            |  3 ++-
 11 files changed, 39 insertions(+), 41 deletions(-)
 delete mode 100644 src/libstore/gc-store.cc
 delete mode 100644 src/libstore/log-store.cc
 create mode 100644 src/libstore/store-cast.hh

diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index 1e24a1c79..9f21ecf36 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -3,6 +3,7 @@
 #include "worker-protocol.hh"
 #include "build-result.hh"
 #include "store-api.hh"
+#include "store-cast.hh"
 #include "gc-store.hh"
 #include "log-store.hh"
 #include "path-with-outputs.hh"
@@ -646,7 +647,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         Path path = absPath(readString(from));
 
         logger->startWork();
-        auto & gcStore = GcStore::require(*store);
+        auto & gcStore = require<GcStore>(*store);
         gcStore.addIndirectRoot(path);
         logger->stopWork();
 
@@ -664,7 +665,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
 
     case wopFindRoots: {
         logger->startWork();
-        auto & gcStore = GcStore::require(*store);
+        auto & gcStore = require<GcStore>(*store);
         Roots roots = gcStore.findRoots(!trusted);
         logger->stopWork();
 
@@ -696,7 +697,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         logger->startWork();
         if (options.ignoreLiveness)
             throw Error("you are not allowed to ignore liveness");
-        auto & gcStore = GcStore::require(*store);
+        auto & gcStore = require<GcStore>(*store);
         gcStore.collectGarbage(options, results);
         logger->stopWork();
 
@@ -954,7 +955,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         logger->startWork();
         if (!trusted)
             throw Error("you are not privileged to add logs");
-        auto & logStore = LogStore::require(*store);
+        auto & logStore = require<LogStore>(*store);
         {
             FramedSource source(from);
             StringSink sink;
diff --git a/src/libstore/gc-store.cc b/src/libstore/gc-store.cc
deleted file mode 100644
index dc2b82166..000000000
--- a/src/libstore/gc-store.cc
+++ /dev/null
@@ -1,13 +0,0 @@
-#include "gc-store.hh"
-
-namespace nix {
-
-GcStore & GcStore::require(Store & store)
-{
-    auto * gcStore = dynamic_cast<GcStore *>(&store);
-    if (!gcStore)
-        throw UsageError("Garbage collection not supported by store '%s'", store.getUri());
-    return *gcStore;
-}
-
-}
diff --git a/src/libstore/gc-store.hh b/src/libstore/gc-store.hh
index 462cc097b..b3cbbad74 100644
--- a/src/libstore/gc-store.hh
+++ b/src/libstore/gc-store.hh
@@ -61,6 +61,8 @@ struct GCResults
 
 struct GcStore : public virtual Store
 {
+    inline static std::string operationName = "Garbage collection";
+
     /* Add an indirect root, which is merely a symlink to `path' from
        /nix/var/nix/gcroots/auto/<hash of `path'>.  `path' is supposed
        to be a symlink to a store path.  The garbage collector will
@@ -77,8 +79,6 @@ struct GcStore : public virtual Store
 
     /* Perform a garbage collection. */
     virtual void collectGarbage(const GCOptions & options, GCResults & results) = 0;
-
-    static GcStore & require(Store & store);
 };
 
 }
diff --git a/src/libstore/log-store.cc b/src/libstore/log-store.cc
deleted file mode 100644
index 56aec91f2..000000000
--- a/src/libstore/log-store.cc
+++ /dev/null
@@ -1,13 +0,0 @@
-#include "log-store.hh"
-
-namespace nix {
-
-LogStore & LogStore::require(Store & store)
-{
-    auto * gcStore = dynamic_cast<LogStore *>(&store);
-    if (!gcStore)
-        throw UsageError("Build log storage and retrieval not supported by store '%s'", store.getUri());
-    return *gcStore;
-}
-
-}
diff --git a/src/libstore/log-store.hh b/src/libstore/log-store.hh
index ad17cbe6e..ff1b92e17 100644
--- a/src/libstore/log-store.hh
+++ b/src/libstore/log-store.hh
@@ -7,6 +7,8 @@ namespace nix {
 
 struct LogStore : public virtual Store
 {
+    inline static std::string operationName = "Build log storage and retrieval";
+
     /* Return the build log of the specified store path, if available,
        or null otherwise. */
     virtual std::optional<std::string> getBuildLog(const StorePath & path) = 0;
diff --git a/src/libstore/store-cast.hh b/src/libstore/store-cast.hh
new file mode 100644
index 000000000..ff62fc359
--- /dev/null
+++ b/src/libstore/store-cast.hh
@@ -0,0 +1,16 @@
+#pragma once
+
+#include "store-api.hh"
+
+namespace nix {
+
+template<typename T>
+T & require(Store & store)
+{
+    auto * castedStore = dynamic_cast<T *>(&store);
+    if (!castedStore)
+        throw UsageError("%s not supported by store '%s'", T::operationName, store.getUri());
+    return *castedStore;
+}
+
+}
diff --git a/src/nix-collect-garbage/nix-collect-garbage.cc b/src/nix-collect-garbage/nix-collect-garbage.cc
index b61f0e640..af6f1c88c 100644
--- a/src/nix-collect-garbage/nix-collect-garbage.cc
+++ b/src/nix-collect-garbage/nix-collect-garbage.cc
@@ -1,4 +1,5 @@
 #include "store-api.hh"
+#include "store-cast.hh"
 #include "gc-store.hh"
 #include "profiles.hh"
 #include "shared.hh"
@@ -81,7 +82,7 @@ static int main_nix_collect_garbage(int argc, char * * argv)
         // Run the actual garbage collector.
         if (!dryRun) {
             auto store = openStore();
-            auto & gcStore = GcStore::require(*store);
+            auto & gcStore = require<GcStore>(*store);
             options.action = GCOptions::gcDeleteDead;
             GCResults results;
             PrintFreed freed(true, results);
diff --git a/src/nix-store/nix-store.cc b/src/nix-store/nix-store.cc
index b3f28bcc2..153b84137 100644
--- a/src/nix-store/nix-store.cc
+++ b/src/nix-store/nix-store.cc
@@ -3,6 +3,7 @@
 #include "dotgraph.hh"
 #include "globals.hh"
 #include "build-result.hh"
+#include "store-cast.hh"
 #include "gc-store.hh"
 #include "log-store.hh"
 #include "local-store.hh"
@@ -430,7 +431,7 @@ static void opQuery(Strings opFlags, Strings opArgs)
             store->computeFSClosure(
                 args, referrers, true, settings.gcKeepOutputs, settings.gcKeepDerivations);
 
-            auto & gcStore = GcStore::require(*store);
+            auto & gcStore = require<GcStore>(*store);
             Roots roots = gcStore.findRoots(false);
             for (auto & [target, links] : roots)
                 if (referrers.find(target) != referrers.end())
@@ -475,7 +476,7 @@ static void opReadLog(Strings opFlags, Strings opArgs)
 {
     if (!opFlags.empty()) throw UsageError("unknown flag");
 
-    auto & logStore = LogStore::require(*store);
+    auto & logStore = require<LogStore>(*store);
 
     RunPager pager;
 
@@ -593,7 +594,7 @@ static void opGC(Strings opFlags, Strings opArgs)
 
     if (!opArgs.empty()) throw UsageError("no arguments expected");
 
-    auto & gcStore = GcStore::require(*store);
+    auto & gcStore = require<GcStore>(*store);
 
     if (printRoots) {
         Roots roots = gcStore.findRoots(false);
@@ -632,7 +633,7 @@ static void opDelete(Strings opFlags, Strings opArgs)
     for (auto & i : opArgs)
         options.pathsToDelete.insert(store->followLinksToStorePath(i));
 
-    auto & gcStore = GcStore::require(*store);
+    auto & gcStore = require<GcStore>(*store);
 
     GCResults results;
     PrintFreed freed(true, results);
diff --git a/src/nix/store-copy-log.cc b/src/nix/store-copy-log.cc
index 22b3980c0..2e288f743 100644
--- a/src/nix/store-copy-log.cc
+++ b/src/nix/store-copy-log.cc
@@ -1,6 +1,7 @@
 #include "command.hh"
 #include "shared.hh"
 #include "store-api.hh"
+#include "store-cast.hh"
 #include "log-store.hh"
 #include "sync.hh"
 #include "thread-pool.hh"
@@ -27,10 +28,10 @@ struct CmdCopyLog : virtual CopyCommand, virtual InstallablesCommand
 
     void run(ref<Store> srcStore) override
     {
-        auto & srcLogStore = LogStore::require(*srcStore);
+        auto & srcLogStore = require<LogStore>(*srcStore);
 
         auto dstStore = getDstStore();
-        auto & dstLogStore = LogStore::require(*dstStore);
+        auto & dstLogStore = require<LogStore>(*dstStore);
 
         StorePathSet drvPaths;
 
diff --git a/src/nix/store-delete.cc b/src/nix/store-delete.cc
index 0de7efaba..ca43f1530 100644
--- a/src/nix/store-delete.cc
+++ b/src/nix/store-delete.cc
@@ -2,6 +2,7 @@
 #include "common-args.hh"
 #include "shared.hh"
 #include "store-api.hh"
+#include "store-cast.hh"
 #include "gc-store.hh"
 
 using namespace nix;
@@ -33,7 +34,7 @@ struct CmdStoreDelete : StorePathsCommand
 
     void run(ref<Store> store, std::vector<StorePath> && storePaths) override
     {
-        auto & gcStore = GcStore::require(*store);
+        auto & gcStore = require<GcStore>(*store);
 
         for (auto & path : storePaths)
             options.pathsToDelete.insert(path);
diff --git a/src/nix/store-gc.cc b/src/nix/store-gc.cc
index 515f4ffdb..8b9b5d164 100644
--- a/src/nix/store-gc.cc
+++ b/src/nix/store-gc.cc
@@ -2,6 +2,7 @@
 #include "common-args.hh"
 #include "shared.hh"
 #include "store-api.hh"
+#include "store-cast.hh"
 #include "gc-store.hh"
 
 using namespace nix;
@@ -34,7 +35,7 @@ struct CmdStoreGC : StoreCommand, MixDryRun
 
     void run(ref<Store> store) override
     {
-        auto & gcStore = GcStore::require(*store);
+        auto & gcStore = require<GcStore>(*store);
 
         options.action = dryRun ? GCOptions::gcReturnDead : GCOptions::gcDeleteDead;
         GCResults results;

From 015d2ad507959b06987ba7ed4566689aba316766 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 11 Mar 2022 14:42:09 +0000
Subject: [PATCH 141/251] Desugar `StorePathWithOutputs` in nix-build
 implementation

`DerivedPath` has replaced `StorePathWithOutputs` internally, so
shrinking the usage of `StorePathWithOutputs` to just the boundary is
good.
---
 src/nix-build/nix-build.cc | 31 ++++++++++++++++++++-----------
 1 file changed, 20 insertions(+), 11 deletions(-)

diff --git a/src/nix-build/nix-build.cc b/src/nix-build/nix-build.cc
index 795a4f7bd..faa8c078f 100755
--- a/src/nix-build/nix-build.cc
+++ b/src/nix-build/nix-build.cc
@@ -325,8 +325,7 @@ static void main_nix_build(int argc, char * * argv)
 
     state->printStats();
 
-    auto buildPaths = [&](const std::vector<StorePathWithOutputs> & paths0) {
-        auto paths = toDerivedPaths(paths0);
+    auto buildPaths = [&](const std::vector<DerivedPath> & paths) {
         /* Note: we do this even when !printMissing to efficiently
            fetch binary cache data. */
         uint64_t downloadSize, narSize;
@@ -348,7 +347,7 @@ static void main_nix_build(int argc, char * * argv)
         auto & drvInfo = drvs.front();
         auto drv = evalStore->derivationFromPath(drvInfo.requireDrvPath());
 
-        std::vector<StorePathWithOutputs> pathsToBuild;
+        std::vector<DerivedPath> pathsToBuild;
         RealisedPath::Set pathsToCopy;
 
         /* Figure out what bash shell to use. If $NIX_BUILD_SHELL
@@ -370,7 +369,10 @@ static void main_nix_build(int argc, char * * argv)
                     throw Error("the 'bashInteractive' attribute in <nixpkgs> did not evaluate to a derivation");
 
                 auto bashDrv = drv->requireDrvPath();
-                pathsToBuild.push_back({bashDrv});
+                pathsToBuild.push_back(DerivedPath::Built {
+                    .drvPath = bashDrv,
+                    .outputs = {},
+                });
                 pathsToCopy.insert(bashDrv);
                 shellDrv = bashDrv;
 
@@ -382,17 +384,24 @@ static void main_nix_build(int argc, char * * argv)
         }
 
         // Build or fetch all dependencies of the derivation.
-        for (const auto & input : drv.inputDrvs)
+        for (const auto & [inputDrv0, inputOutputs] : drv.inputDrvs) {
+            // To get around lambda capturing restrictions in the
+            // standard.
+            const auto & inputDrv = inputDrv0;
             if (std::all_of(envExclude.cbegin(), envExclude.cend(),
                     [&](const std::string & exclude) {
-                        return !std::regex_search(store->printStorePath(input.first), std::regex(exclude));
+                        return !std::regex_search(store->printStorePath(inputDrv), std::regex(exclude));
                     }))
             {
-                pathsToBuild.push_back({input.first, input.second});
-                pathsToCopy.insert(input.first);
+                pathsToBuild.push_back(DerivedPath::Built {
+                    .drvPath = inputDrv,
+                    .outputs = inputOutputs
+                });
+                pathsToCopy.insert(inputDrv);
             }
+        }
         for (const auto & src : drv.inputSrcs) {
-            pathsToBuild.push_back({src});
+            pathsToBuild.push_back(DerivedPath::Opaque{src});
             pathsToCopy.insert(src);
         }
 
@@ -543,7 +552,7 @@ static void main_nix_build(int argc, char * * argv)
 
     else {
 
-        std::vector<StorePathWithOutputs> pathsToBuild;
+        std::vector<DerivedPath> pathsToBuild;
         std::vector<std::pair<StorePath, std::string>> pathsToBuildOrdered;
         RealisedPath::Set drvsToCopy;
 
@@ -556,7 +565,7 @@ static void main_nix_build(int argc, char * * argv)
             if (outputName == "")
                 throw Error("derivation '%s' lacks an 'outputName' attribute", store->printStorePath(drvPath));
 
-            pathsToBuild.push_back({drvPath, {outputName}});
+            pathsToBuild.push_back(DerivedPath::Built{drvPath, {outputName}});
             pathsToBuildOrdered.push_back({drvPath, {outputName}});
             drvsToCopy.insert(drvPath);
 

From 0948b8e94dfbf87ed2a695c6c7d8dac250e2c293 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 1 Oct 2021 18:05:53 +0000
Subject: [PATCH 142/251] Reduce variants for derivation hash modulo

This changes was taken from dynamic derivation (#4628). It` somewhat
undoes the refactors I first did for floating CA derivations, as the
benefit of hindsight + requirements of dynamic derivations made me
reconsider some things.

They aren't to consequential, but I figured they might be good to land
first, before the more profound changes @thufschmitt has in the works.
---
 src/libexpr/primops.cc      |  45 ++++++++-------
 src/libstore/derivations.cc | 111 ++++++++++++++++++++++--------------
 src/libstore/derivations.hh |  40 +++++++++++--
 src/libstore/local-store.cc |   4 +-
 src/nix/develop.cc          |   3 +-
 5 files changed, 131 insertions(+), 72 deletions(-)

diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 3124025aa..0980e75f4 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1207,32 +1207,37 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
         // hash per output.
         auto hashModulo = hashDerivationModulo(*state.store, Derivation(drv), true);
         std::visit(overloaded {
-            [&](Hash & h) {
-                for (auto & i : outputs) {
-                    auto outPath = state.store->makeOutputPath(i, h, drvName);
-                    drv.env[i] = state.store->printStorePath(outPath);
-                    drv.outputs.insert_or_assign(i,
-                        DerivationOutput {
-                            .output = DerivationOutputInputAddressed {
-                                .path = std::move(outPath),
-                            },
-                        });
+            [&](const DrvHash & drvHash) {
+                auto & h = drvHash.hash;
+                switch (drvHash.kind) {
+                case DrvHash::Kind::Deferred:
+                    for (auto & i : outputs) {
+                        drv.outputs.insert_or_assign(i,
+                            DerivationOutput {
+                                .output = DerivationOutputDeferred{},
+                            });
+                    }
+                    break;
+                case DrvHash::Kind::Regular:
+                    for (auto & i : outputs) {
+                        auto outPath = state.store->makeOutputPath(i, h, drvName);
+                        drv.env[i] = state.store->printStorePath(outPath);
+                        drv.outputs.insert_or_assign(i,
+                            DerivationOutput {
+                                .output = DerivationOutputInputAddressed {
+                                    .path = std::move(outPath),
+                                },
+                            });
+                    }
+                    break;
                 }
             },
-            [&](CaOutputHashes &) {
+            [&](const CaOutputHashes &) {
                 // Shouldn't happen as the toplevel derivation is not CA.
                 assert(false);
             },
-            [&](DeferredHash &) {
-                for (auto & i : outputs) {
-                    drv.outputs.insert_or_assign(i,
-                        DerivationOutput {
-                            .output = DerivationOutputDeferred{},
-                        });
-                }
-            },
         },
-        hashModulo);
+        hashModulo.raw());
 
     }
 
diff --git a/src/libstore/derivations.cc b/src/libstore/derivations.cc
index a49be0057..1fe45bd87 100644
--- a/src/libstore/derivations.cc
+++ b/src/libstore/derivations.cc
@@ -510,7 +510,7 @@ static const DrvHashModulo pathDerivationModulo(Store & store, const StorePath &
  */
 DrvHashModulo hashDerivationModulo(Store & store, const Derivation & drv, bool maskOutputs)
 {
-    bool isDeferred = false;
+    auto kind = DrvHash::Kind::Regular;
     /* Return a fixed hash for fixed-output derivations. */
     switch (drv.type()) {
     case DerivationType::CAFixed: {
@@ -526,7 +526,7 @@ DrvHashModulo hashDerivationModulo(Store & store, const Derivation & drv, bool m
         return outputHashes;
     }
     case DerivationType::CAFloating:
-        isDeferred = true;
+        kind = DrvHash::Kind::Deferred;
         break;
     case DerivationType::InputAddressed:
         break;
@@ -537,21 +537,20 @@ DrvHashModulo hashDerivationModulo(Store & store, const Derivation & drv, bool m
     /* For other derivations, replace the inputs paths with recursive
        calls to this function. */
     std::map<std::string, StringSet> inputs2;
-    for (auto & i : drv.inputDrvs) {
-        const auto & res = pathDerivationModulo(store, i.first);
+    for (auto & [drvPath, inputOutputs0] : drv.inputDrvs) {
+        // Avoid lambda capture restriction with standard / Clang
+        auto & inputOutputs = inputOutputs0;
+        const auto & res = pathDerivationModulo(store, drvPath);
         std::visit(overloaded {
             // Regular non-CA derivation, replace derivation
-            [&](const Hash & drvHash) {
-                inputs2.insert_or_assign(drvHash.to_string(Base16, false), i.second);
-            },
-            [&](const DeferredHash & deferredHash) {
-                isDeferred = true;
-                inputs2.insert_or_assign(deferredHash.hash.to_string(Base16, false), i.second);
+            [&](const DrvHash & drvHash) {
+                kind |= drvHash.kind;
+                inputs2.insert_or_assign(drvHash.hash.to_string(Base16, false), inputOutputs);
             },
             // CA derivation's output hashes
             [&](const CaOutputHashes & outputHashes) {
                 std::set<std::string> justOut = { "out" };
-                for (auto & output : i.second) {
+                for (auto & output : inputOutputs) {
                     /* Put each one in with a single "out" output.. */
                     const auto h = outputHashes.at(output);
                     inputs2.insert_or_assign(
@@ -559,15 +558,24 @@ DrvHashModulo hashDerivationModulo(Store & store, const Derivation & drv, bool m
                         justOut);
                 }
             },
-        }, res);
+        }, res.raw());
     }
 
     auto hash = hashString(htSHA256, drv.unparse(store, maskOutputs, &inputs2));
 
-    if (isDeferred)
-        return DeferredHash { hash };
-    else
-        return hash;
+    return DrvHash { .hash = hash, .kind = kind };
+}
+
+
+void operator |= (DrvHash::Kind & self, const DrvHash::Kind & other) noexcept
+{
+    switch (other) {
+    case DrvHash::Kind::Regular:
+        break;
+    case DrvHash::Kind::Deferred:
+        self = other;
+        break;
+    }
 }
 
 
@@ -575,20 +583,15 @@ std::map<std::string, Hash> staticOutputHashes(Store & store, const Derivation &
 {
     std::map<std::string, Hash> res;
     std::visit(overloaded {
-        [&](const Hash & drvHash) {
+        [&](const DrvHash & drvHash) {
             for (auto & outputName : drv.outputNames()) {
-                res.insert({outputName, drvHash});
-            }
-        },
-        [&](const DeferredHash & deferredHash) {
-            for (auto & outputName : drv.outputNames()) {
-                res.insert({outputName, deferredHash.hash});
+                res.insert({outputName, drvHash.hash});
             }
         },
         [&](const CaOutputHashes & outputHashes) {
             res = outputHashes;
         },
-    }, hashDerivationModulo(store, drv, true));
+    }, hashDerivationModulo(store, drv, true).raw());
     return res;
 }
 
@@ -738,7 +741,7 @@ static void rewriteDerivation(Store & store, BasicDerivation & drv, const String
     auto hashModulo = hashDerivationModulo(store, Derivation(drv), true);
     for (auto & [outputName, output] : drv.outputs) {
         if (std::holds_alternative<DerivationOutputDeferred>(output.output)) {
-            Hash h = std::get<Hash>(hashModulo);
+            auto & h = hashModulo.requireNoFixedNonDeferred();
             auto outPath = store.makeOutputPath(outputName, h, drv.name);
             drv.env[outputName] = store.printStorePath(outPath);
             output = DerivationOutput {
@@ -751,31 +754,51 @@ static void rewriteDerivation(Store & store, BasicDerivation & drv, const String
 
 }
 
+const Hash & DrvHashModulo::requireNoFixedNonDeferred() const {
+    auto * drvHashOpt = std::get_if<DrvHash>(&raw());
+    assert(drvHashOpt);
+    assert(drvHashOpt->kind == DrvHash::Kind::Regular);
+    return drvHashOpt->hash;
+}
+
+static bool tryResolveInput(
+    Store & store, StorePathSet & inputSrcs, StringMap & inputRewrites,
+    const StorePath & inputDrv, const StringSet & inputOutputs)
+{
+    auto inputDrvOutputs = store.queryPartialDerivationOutputMap(inputDrv);
+
+    auto getOutput = [&](const std::string & outputName) {
+        auto & actualPathOpt = inputDrvOutputs.at(outputName);
+        if (!actualPathOpt)
+            warn("output %s of input %s missing, aborting the resolving",
+                outputName,
+                store.printStorePath(inputDrv)
+            );
+        return actualPathOpt;
+    };
+
+    for (auto & outputName : inputOutputs) {
+        auto actualPathOpt = getOutput(outputName);
+        if (!actualPathOpt) return false;
+        auto actualPath = *actualPathOpt;
+        inputRewrites.emplace(
+            downstreamPlaceholder(store, inputDrv, outputName),
+            store.printStorePath(actualPath));
+        inputSrcs.insert(std::move(actualPath));
+    }
+
+    return true;
+}
+
 std::optional<BasicDerivation> Derivation::tryResolve(Store & store) {
     BasicDerivation resolved { *this };
 
     // Input paths that we'll want to rewrite in the derivation
     StringMap inputRewrites;
 
-    for (auto & input : inputDrvs) {
-        auto inputDrvOutputs = store.queryPartialDerivationOutputMap(input.first);
-        StringSet newOutputNames;
-        for (auto & outputName : input.second) {
-            auto actualPathOpt = inputDrvOutputs.at(outputName);
-            if (!actualPathOpt) {
-                warn("output %s of input %s missing, aborting the resolving",
-                    outputName,
-                    store.printStorePath(input.first)
-                );
-                return std::nullopt;
-            }
-            auto actualPath = *actualPathOpt;
-            inputRewrites.emplace(
-                downstreamPlaceholder(store, input.first, outputName),
-                store.printStorePath(actualPath));
-            resolved.inputSrcs.insert(std::move(actualPath));
-        }
-    }
+    for (auto & [inputDrv, inputOutputs] : inputDrvs)
+        if (!tryResolveInput(store, resolved.inputSrcs, inputRewrites, inputDrv, inputOutputs))
+            return std::nullopt;
 
     rewriteDerivation(store, resolved, inputRewrites);
 
diff --git a/src/libstore/derivations.hh b/src/libstore/derivations.hh
index 132de82b6..2fb18d7f7 100644
--- a/src/libstore/derivations.hh
+++ b/src/libstore/derivations.hh
@@ -175,13 +175,43 @@ std::string outputPathName(std::string_view drvName, std::string_view outputName
 // whose output hashes are always known since they are fixed up-front.
 typedef std::map<std::string, Hash> CaOutputHashes;
 
-struct DeferredHash { Hash hash; };
+struct DrvHash {
+    Hash hash;
+
+    enum struct Kind {
+        // Statically determined derivations.
+        // This hash will be directly used to compute the output paths
+        Regular,
+        // Floating-output derivations (and their dependencies).
+        Deferred,
+    };
+
+    Kind kind;
+};
+
+void operator |= (DrvHash::Kind & self, const DrvHash::Kind & other) noexcept;
 
 typedef std::variant<
-    Hash, // regular DRV normalized hash
-    CaOutputHashes, // Fixed-output derivation hashes
-    DeferredHash // Deferred hashes for floating outputs drvs and their dependencies
-> DrvHashModulo;
+    // Regular normalized derivation hash, and whether it was deferred (because
+    // an ancestor derivation is a floating content addressed derivation).
+    DrvHash,
+    // Fixed-output derivation hashes
+    CaOutputHashes
+> DrvHashModuloRaw;
+
+struct DrvHashModulo : DrvHashModuloRaw {
+    using Raw = DrvHashModuloRaw;
+    using Raw::Raw;
+
+    /* Get hash, throwing if it is per-output CA hashes or a
+       deferred Drv hash.
+     */
+    const Hash & requireNoFixedNonDeferred() const;
+
+    inline const Raw & raw() const {
+        return static_cast<const Raw &>(*this);
+    }
+};
 
 /* Returns hashes with the details of fixed-output subderivations
    expunged.
diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index 1ee71b1c0..9230be15a 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -701,8 +701,8 @@ void LocalStore::checkDerivationOutputs(const StorePath & drvPath, const Derivat
             [&](const DerivationOutputInputAddressed & doia) {
                 if (!h) {
                     // somewhat expensive so we do lazily
-                    auto temp = hashDerivationModulo(*this, drv, true);
-                    h = std::get<Hash>(temp);
+                    auto h0 = hashDerivationModulo(*this, drv, true);
+                    h = h0.requireNoFixedNonDeferred();
                 }
                 StorePath recomputed = makeOutputPath(i.first, *h, drvName);
                 if (doia.path != recomputed)
diff --git a/src/nix/develop.cc b/src/nix/develop.cc
index 8af5da9d0..dafcafd79 100644
--- a/src/nix/develop.cc
+++ b/src/nix/develop.cc
@@ -206,7 +206,8 @@ static StorePath getDerivationEnvironment(ref<Store> store, ref<Store> evalStore
             output.second = { .output = DerivationOutputInputAddressed { .path = StorePath::dummy } };
             drv.env[output.first] = "";
         }
-        Hash h = std::get<0>(hashDerivationModulo(*evalStore, drv, true));
+        auto h0 = hashDerivationModulo(*evalStore, drv, true);
+        const Hash & h = h0.requireNoFixedNonDeferred();
 
         for (auto & output : drv.outputs) {
             auto outPath = store->makeOutputPath(output.first, h, drv.name);

From 91adfb8894b4b8183c2948712d56a97bb9d93d9f Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 10 Mar 2021 02:20:32 +0000
Subject: [PATCH 143/251] Create some type aliases for string Contexts

---
 src/libexpr/eval-cache.cc      | 2 +-
 src/libexpr/eval-cache.hh      | 2 +-
 src/libexpr/eval.cc            | 6 +++---
 src/libexpr/eval.hh            | 2 +-
 src/libexpr/primops/context.cc | 2 +-
 src/libexpr/value.hh           | 4 +++-
 6 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/src/libexpr/eval-cache.cc b/src/libexpr/eval-cache.cc
index 188223957..7e5b5c9c4 100644
--- a/src/libexpr/eval-cache.cc
+++ b/src/libexpr/eval-cache.cc
@@ -254,7 +254,7 @@ struct AttrDb
                 return {{rowId, attrs}};
             }
             case AttrType::String: {
-                std::vector<std::pair<Path, std::string>> context;
+                NixStringContext context;
                 if (!queryAttribute.isNull(3))
                     for (auto & s : tokenizeString<std::vector<std::string>>(queryAttribute.getStr(3), ";"))
                         context.push_back(decodeContext(s));
diff --git a/src/libexpr/eval-cache.hh b/src/libexpr/eval-cache.hh
index 40f1d4ffc..c9a9bf471 100644
--- a/src/libexpr/eval-cache.hh
+++ b/src/libexpr/eval-cache.hh
@@ -52,7 +52,7 @@ struct misc_t {};
 struct failed_t {};
 typedef uint64_t AttrId;
 typedef std::pair<AttrId, Symbol> AttrKey;
-typedef std::pair<std::string, std::vector<std::pair<Path, std::string>>> string_t;
+typedef std::pair<std::string, NixStringContext> string_t;
 
 typedef std::variant<
     std::vector<Symbol>,
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index c65ef9738..126e0af8c 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -1903,7 +1903,7 @@ std::string_view EvalState::forceString(Value & v, const Pos & pos)
 
 /* Decode a context string ‘!<name>!<path>’ into a pair <path,
    name>. */
-std::pair<std::string, std::string> decodeContext(std::string_view s)
+NixStringContextElem decodeContext(std::string_view s)
 {
     if (s.at(0) == '!') {
         size_t index = s.find("!", 1);
@@ -1921,9 +1921,9 @@ void copyContext(const Value & v, PathSet & context)
 }
 
 
-std::vector<std::pair<Path, std::string>> Value::getContext()
+NixStringContext Value::getContext()
 {
-    std::vector<std::pair<Path, std::string>> res;
+    NixStringContext res;
     assert(internalType == tString);
     if (string.context)
         for (const char * * p = string.context; *p; ++p)
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index f1e00bae7..18480f290 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -430,7 +430,7 @@ std::string showType(const Value & v);
 
 /* Decode a context string ‘!<name>!<path>’ into a pair <path,
    name>. */
-std::pair<std::string, std::string> decodeContext(std::string_view s);
+NixStringContextElem decodeContext(std::string_view s);
 
 /* If `path' refers to a directory, then append "/default.nix". */
 Path resolveExprPath(Path path);
diff --git a/src/libexpr/primops/context.cc b/src/libexpr/primops/context.cc
index 3701bd442..ad4de3840 100644
--- a/src/libexpr/primops/context.cc
+++ b/src/libexpr/primops/context.cc
@@ -82,7 +82,7 @@ static void prim_getContext(EvalState & state, const Pos & pos, Value * * args,
             drv = std::string(p, 1);
             path = &drv;
         } else if (p.at(0) == '!') {
-            std::pair<std::string, std::string> ctx = decodeContext(p);
+            NixStringContextElem ctx = decodeContext(p);
             drv = ctx.first;
             output = ctx.second;
             path = &drv;
diff --git a/src/libexpr/value.hh b/src/libexpr/value.hh
index d0fa93e92..ee9cb832a 100644
--- a/src/libexpr/value.hh
+++ b/src/libexpr/value.hh
@@ -64,6 +64,8 @@ class JSONPlaceholder;
 
 typedef int64_t NixInt;
 typedef double NixFloat;
+typedef std::pair<Path, std::string> NixStringContextElem;
+typedef std::vector<NixStringContextElem> NixStringContext;
 
 /* External values must descend from ExternalValueBase, so that
  * type-agnostic nix functions (e.g. showType) can be implemented
@@ -368,7 +370,7 @@ public:
        non-trivial. */
     bool isTrivial() const;
 
-    std::vector<std::pair<Path, std::string>> getContext();
+    NixStringContext getContext();
 
     auto listItems()
     {

From cb1a76112eb77883038ebad8d3b0e39330bdf1b3 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Sat, 12 Mar 2022 23:58:29 +0200
Subject: [PATCH 144/251] nix-env: Add a suggestion for when there's a name
 collision in channels

help new users find a solution to their problem

./result/bin/nix-env -qa hello
warning: name collision in input Nix expressions, skipping '/home/artturin/.nix-defexpr/channels_root/master'
suggestion: remove 'master' from either the root channels or the user channels
hello-2.12
hello-2.12
---
 src/nix-env/nix-env.cc | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/nix-env/nix-env.cc b/src/nix-env/nix-env.cc
index 40c3c5d65..eb5fbc08f 100644
--- a/src/nix-env/nix-env.cc
+++ b/src/nix-env/nix-env.cc
@@ -128,7 +128,12 @@ static void getAllExprs(EvalState & state,
             if (hasSuffix(attrName, ".nix"))
                 attrName = std::string(attrName, 0, attrName.size() - 4);
             if (!seen.insert(attrName).second) {
-                printError("warning: name collision in input Nix expressions, skipping '%1%'", path2);
+                std::string suggestionMessage = "";
+                if (path2.find("channels") != std::string::npos && path.find("channels") != std::string::npos) {
+                    suggestionMessage = fmt("\nsuggestion: remove '%s' from either the root channels or the user channels", attrName);
+                }
+                printError("warning: name collision in input Nix expressions, skipping '%1%'"
+                            "%2%", path2, suggestionMessage);
                 continue;
             }
             /* Load the expression on demand. */

From 6b1872312f1b505334acb67b8bf7990b0a0fdbd8 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 12 Mar 2022 21:56:08 +0000
Subject: [PATCH 145/251] nix store gc: account for auto-optimised store

Before the change on a system with `auto-optimise-store = true`:

    $ nix store gc --verbose --max 1

deleted all the paths instead of one path (we requested 1 byte limit).

It happens because every file in `auto-optimise-store = true` has at
least 2 links: file itself and a link in /nix/store/.links/ directory.

The change conservatively assumes that any file that has one (as before)
or two links (assume auto-potimise mode) will free space.

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
---
 src/libstore/gc.cc  |  3 ++-
 src/libutil/util.cc | 25 +++++++++++++++++++++++--
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/src/libstore/gc.cc b/src/libstore/gc.cc
index 024da66c1..69755bd19 100644
--- a/src/libstore/gc.cc
+++ b/src/libstore/gc.cc
@@ -841,7 +841,8 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
             if (unlink(path.c_str()) == -1)
                 throw SysError("deleting '%1%'", path);
 
-            results.bytesFreed += st.st_size;
+            /* Do not accound for deleted file here. Rely on deletePath()
+               accounting.  */
         }
 
         struct stat st;
diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 9f13d5f02..70eaf4f9c 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -406,8 +406,29 @@ static void _deletePath(int parentfd, const Path & path, uint64_t & bytesFreed)
         throw SysError("getting status of '%1%'", path);
     }
 
-    if (!S_ISDIR(st.st_mode) && st.st_nlink == 1)
-        bytesFreed += st.st_size;
+    if (!S_ISDIR(st.st_mode)) {
+        /* We are about to delete a file. Will it likely free space? */
+
+        switch (st.st_nlink) {
+            /* Yes: last link. */
+            case 1:
+                bytesFreed += st.st_size;
+                break;
+            /* Maybe: yes, if 'auto-optimise-store' or manual optimisation
+               was performed. Instead of checking for real let's assume
+               it's an optimised file and space will be freed.
+
+               In worst case we will double count on freed space for files
+               with exactly two hardlinks for unoptimised packages.
+             */
+            case 2:
+                bytesFreed += st.st_size;
+                break;
+            /* No: 3+ links. */
+            default:
+                break;
+        }
+    }
 
     if (S_ISDIR(st.st_mode)) {
         /* Make the directory accessible. */

From e06b264f944226cfede0b3fc0394a9c3bbde4a78 Mon Sep 17 00:00:00 2001
From: thkoch2001 <94641+thkoch2001@users.noreply.github.com>
Date: Sun, 13 Mar 2022 18:42:26 +0200
Subject: [PATCH 146/251] Add documentation= entry to systemd unit file

Closes: #6246
---
 misc/systemd/nix-daemon.service.in | 1 +
 1 file changed, 1 insertion(+)

diff --git a/misc/systemd/nix-daemon.service.in b/misc/systemd/nix-daemon.service.in
index 25655204d..b4badf2ba 100644
--- a/misc/systemd/nix-daemon.service.in
+++ b/misc/systemd/nix-daemon.service.in
@@ -1,5 +1,6 @@
 [Unit]
 Description=Nix Daemon
+Documentation=man:nix-daemon https://nixos.org/manual
 RequiresMountsFor=@storedir@
 RequiresMountsFor=@localstatedir@
 ConditionPathIsReadWrite=@localstatedir@/nix/daemon-socket

From 34e20c164cd512c10af99803215e32889a6d965b Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 18 Feb 2022 16:56:35 +0100
Subject: [PATCH 147/251] libfetchers/path: set `lastModified` to path's mtime

When importing e.g. a local `nixpkgs` in a flake to test a change like

    {
      inputs.nixpkgs.url = path:/home/ma27/Projects/nixpkgs;
      outputs = /* ... */
    }

then the input is missing a `lastModified`-field that's e.g. used in
`nixpkgs.lib.nixosSystem`. Due to the missing `lastMoified`-field, the
mtime is set to 19700101:

    result -> /nix/store/b7dg1lmmsill2rsgyv2w7b6cnmixkvc1-nixos-system-nixos-22.05.19700101.dirty

With this change, the `path`-fetcher now sets a `lastModified` attribute
to the `mtime` just like it's the case in the `tarball`-fetcher already.
When building NixOS systems with `nixpkgs` being a `path`-input and this
patch, the output-path now looks like this:

    result -> /nix/store/ld2qf9c1s98dxmiwcaq5vn9k5ylzrm1s-nixos-system-nixos-22.05.20220217.dirty
---
 src/libfetchers/path.cc | 15 ++++++++++++---
 src/libutil/archive.cc  | 19 +++++++++++++++----
 src/libutil/archive.hh  |  4 ++++
 3 files changed, 31 insertions(+), 7 deletions(-)

diff --git a/src/libfetchers/path.cc b/src/libfetchers/path.cc
index 59e228e97..2d5d7d58d 100644
--- a/src/libfetchers/path.cc
+++ b/src/libfetchers/path.cc
@@ -1,5 +1,7 @@
 #include "fetchers.hh"
 #include "store-api.hh"
+#include <filesystem>
+#include "archive.hh"
 
 namespace nix::fetchers {
 
@@ -80,8 +82,9 @@ struct PathInputScheme : InputScheme
         // nothing to do
     }
 
-    std::pair<StorePath, Input> fetch(ref<Store> store, const Input & input) override
+    std::pair<StorePath, Input> fetch(ref<Store> store, const Input & _input) override
     {
+        Input input(_input);
         std::string absPath;
         auto path = getStrAttr(input.attrs, "path");
 
@@ -111,9 +114,15 @@ struct PathInputScheme : InputScheme
         if (storePath)
             store->addTempRoot(*storePath);
 
-        if (!storePath || storePath->name() != "source" || !store->isValidPath(*storePath))
+        time_t mtime = 0;
+        if (!storePath || storePath->name() != "source" || !store->isValidPath(*storePath)) {
             // FIXME: try to substitute storePath.
-            storePath = store->addToStore("source", absPath);
+            auto src = sinkToSource([&](Sink & sink) {
+                mtime = dumpPathAndGetMtime(absPath, sink, defaultPathFilter);
+            });
+            storePath = store->addToStoreFromDump(*src, "source");
+        }
+        input.attrs.insert_or_assign("lastModified", uint64_t(mtime));
 
         return {std::move(*storePath), input};
     }
diff --git a/src/libutil/archive.cc b/src/libutil/archive.cc
index eda004756..30b471af5 100644
--- a/src/libutil/archive.cc
+++ b/src/libutil/archive.cc
@@ -64,11 +64,12 @@ static void dumpContents(const Path & path, off_t size,
 }
 
 
-static void dump(const Path & path, Sink & sink, PathFilter & filter)
+static time_t dump(const Path & path, Sink & sink, PathFilter & filter)
 {
     checkInterrupt();
 
     auto st = lstat(path);
+    time_t result = st.st_mtime;
 
     sink << "(";
 
@@ -103,7 +104,10 @@ static void dump(const Path & path, Sink & sink, PathFilter & filter)
         for (auto & i : unhacked)
             if (filter(path + "/" + i.first)) {
                 sink << "entry" << "(" << "name" << i.first << "node";
-                dump(path + "/" + i.second, sink, filter);
+                auto tmp_mtime = dump(path + "/" + i.second, sink, filter);
+                if (tmp_mtime > result) {
+                    result = tmp_mtime;
+                }
                 sink << ")";
             }
     }
@@ -114,13 +118,20 @@ static void dump(const Path & path, Sink & sink, PathFilter & filter)
     else throw Error("file '%1%' has an unsupported type", path);
 
     sink << ")";
+
+    return result;
 }
 
 
-void dumpPath(const Path & path, Sink & sink, PathFilter & filter)
+time_t dumpPathAndGetMtime(const Path & path, Sink & sink, PathFilter & filter)
 {
     sink << narVersionMagic1;
-    dump(path, sink, filter);
+    return dump(path, sink, filter);
+}
+
+void dumpPath(const Path & path, Sink & sink, PathFilter & filter)
+{
+    dumpPathAndGetMtime(path, sink, filter);
 }
 
 
diff --git a/src/libutil/archive.hh b/src/libutil/archive.hh
index fca351605..79ce08df0 100644
--- a/src/libutil/archive.hh
+++ b/src/libutil/archive.hh
@@ -48,6 +48,10 @@ namespace nix {
 void dumpPath(const Path & path, Sink & sink,
     PathFilter & filter = defaultPathFilter);
 
+/* Same as `void dumpPath()`, but returns the last modified date of the path */
+time_t dumpPathAndGetMtime(const Path & path, Sink & sink,
+    PathFilter & filter = defaultPathFilter);
+
 void dumpString(std::string_view s, Sink & sink);
 
 /* FIXME: fix this API, it sucks. */

From 244baff2c7bc287b83377f1ed807a861fc705dac Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Mon, 28 Feb 2022 11:56:50 +0100
Subject: [PATCH 148/251] libfetchers: remove obsolete filesystem #include

---
 src/libfetchers/path.cc | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/libfetchers/path.cc b/src/libfetchers/path.cc
index 2d5d7d58d..f0ef97da5 100644
--- a/src/libfetchers/path.cc
+++ b/src/libfetchers/path.cc
@@ -1,6 +1,5 @@
 #include "fetchers.hh"
 #include "store-api.hh"
-#include <filesystem>
 #include "archive.hh"
 
 namespace nix::fetchers {

From 975bade7f0adb0d122eabeeca6ad44bf1d1f4366 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 15 Mar 2022 12:55:32 +0100
Subject: [PATCH 149/251] Implement simple test for `path`-fetcher setting a
 correct `lastModifiedDate`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Théophane Hufschmitt <7226587+thufschmitt@users.noreply.github.com>
---
 tests/fetchPath.sh | 6 ++++++
 tests/local.mk     | 1 +
 2 files changed, 7 insertions(+)
 create mode 100644 tests/fetchPath.sh

diff --git a/tests/fetchPath.sh b/tests/fetchPath.sh
new file mode 100644
index 000000000..0cfdf68cf
--- /dev/null
+++ b/tests/fetchPath.sh
@@ -0,0 +1,6 @@
+source common.sh
+
+touch foo -t 222211111111
+# We only check whether 2222-11-1* **:**:** is the last modified date since
+# `lastModified` is transformed into UTC in `builtins.fetchTarball`.
+[[ "$(nix eval --impure --raw --expr "(builtins.fetchTree \"path://$PWD/foo\").lastModifiedDate")" =~ 2222111.* ]]
diff --git a/tests/local.mk b/tests/local.mk
index 8032fc38a..b69fb9391 100644
--- a/tests/local.mk
+++ b/tests/local.mk
@@ -21,6 +21,7 @@ nix_tests = \
   tarball.sh \
   fetchGit.sh \
   fetchurl.sh \
+  fetchPath.sh \
   simple.sh \
   referrers.sh \
   optimise-store.sh \

From 2d5c43f210694033eb0d1ddfb0131e18a159b790 Mon Sep 17 00:00:00 2001
From: regnat <rg@regnat.ovh>
Date: Tue, 15 Mar 2022 21:05:01 +0100
Subject: [PATCH 150/251] Fix the tests on 32bits machines

year 2222 is too much for a 32 bit timestamp. So replace it by something
smaller
---
 tests/fetchPath.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/fetchPath.sh b/tests/fetchPath.sh
index 0cfdf68cf..0e065cae2 100644
--- a/tests/fetchPath.sh
+++ b/tests/fetchPath.sh
@@ -1,6 +1,6 @@
 source common.sh
 
-touch foo -t 222211111111
+touch foo -t 202211111111
 # We only check whether 2222-11-1* **:**:** is the last modified date since
 # `lastModified` is transformed into UTC in `builtins.fetchTarball`.
-[[ "$(nix eval --impure --raw --expr "(builtins.fetchTree \"path://$PWD/foo\").lastModifiedDate")" =~ 2222111.* ]]
+[[ "$(nix eval --impure --raw --expr "(builtins.fetchTree \"path://$PWD/foo\").lastModifiedDate")" =~ 2022111.* ]]

From 3cea6f569e300c92d23e46eb4e2039302f58518f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9ophane=20Hufschmitt?=
 <7226587+thufschmitt@users.noreply.github.com>
Date: Wed, 16 Mar 2022 08:56:01 +0100
Subject: [PATCH 151/251] =?UTF-8?q?Fix=20the=20date=20in=20the=20comment?=
 =?UTF-8?q?=20of=20fetchPath=E2=80=99s=20test?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: pennae <82953136+pennae@users.noreply.github.com>
---
 tests/fetchPath.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/fetchPath.sh b/tests/fetchPath.sh
index 0e065cae2..8f17638e9 100644
--- a/tests/fetchPath.sh
+++ b/tests/fetchPath.sh
@@ -1,6 +1,6 @@
 source common.sh
 
 touch foo -t 202211111111
-# We only check whether 2222-11-1* **:**:** is the last modified date since
+# We only check whether 2022-11-1* **:**:** is the last modified date since
 # `lastModified` is transformed into UTC in `builtins.fetchTarball`.
 [[ "$(nix eval --impure --raw --expr "(builtins.fetchTree \"path://$PWD/foo\").lastModifiedDate")" =~ 2022111.* ]]

From af013281c9212e49709ef4ecb429a4307f48bea0 Mon Sep 17 00:00:00 2001
From: Joachim Breitner <mail@joachim-breitner.de>
Date: Wed, 16 Mar 2022 12:53:38 +0100
Subject: [PATCH 152/251] distributed-builds.md: fixing typo of the most minor
 sort

---
 doc/manual/src/advanced-topics/distributed-builds.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/manual/src/advanced-topics/distributed-builds.md b/doc/manual/src/advanced-topics/distributed-builds.md
index c4c60db15..b0d7fbf1a 100644
--- a/doc/manual/src/advanced-topics/distributed-builds.md
+++ b/doc/manual/src/advanced-topics/distributed-builds.md
@@ -110,7 +110,7 @@ default, set it to `-`.
 7.  A comma-separated list of *mandatory features*. A machine will only
     be used to build a derivation if all of the machine’s mandatory
     features appear in the derivation’s `requiredSystemFeatures`
-    attribute..
+    attribute.
 
 8.  The (base64-encoded) public host key of the remote machine. If omitted, SSH
     will use its regular known-hosts file. Specifically, the field is calculated

From a5c969db496843b9a42b3aee494a02714ee9ca78 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Wed, 16 Mar 2022 20:48:50 +0200
Subject: [PATCH 153/251] nix: allow using --file - to read from stdin

---
 doc/manual/src/release-notes/rl-next.md | 2 ++
 src/libcmd/installables.cc              | 9 +++++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/doc/manual/src/release-notes/rl-next.md b/doc/manual/src/release-notes/rl-next.md
index c869b5e2f..c9753f9aa 100644
--- a/doc/manual/src/release-notes/rl-next.md
+++ b/doc/manual/src/release-notes/rl-next.md
@@ -1 +1,3 @@
 # Release X.Y (202?-??-??)
+
+* Various nix commands can now read expressions from stdin with `--file -`.
diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index b7623d4ba..784117569 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -134,7 +134,9 @@ SourceExprCommand::SourceExprCommand()
     addFlag({
         .longName = "file",
         .shortName = 'f',
-        .description = "Interpret installables as attribute paths relative to the Nix expression stored in *file*.",
+        .description =
+            "Interpret installables as attribute paths relative to the Nix expression stored in *file*. "
+            "If *file* is the character -, then a Nix expression will be read from standard input.",
         .category = installablesCategory,
         .labels = {"file"},
         .handler = {&file},
@@ -695,7 +697,10 @@ std::vector<std::shared_ptr<Installable>> SourceExprCommand::parseInstallables(
         auto state = getEvalState();
         auto vFile = state->allocValue();
 
-        if (file)
+        if (file == "-") {
+            auto e = state->parseStdin();
+            state->eval(e, *vFile);
+        } else if (file)
             state->evalFile(lookupFileArg(*state, *file), *vFile);
         else {
             auto e = state->parseExprFromString(*expr, absPath("."));

From 4f8ad41d4eb2012f01cd09ad745e78c5b8d8bee6 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Wed, 16 Mar 2022 20:57:18 +0200
Subject: [PATCH 154/251] add tests for nix eval and nix-instantiate

---
 tests/eval.nix |  5 +++++
 tests/eval.sh  | 29 +++++++++++++++++++++++++++++
 tests/local.mk |  1 +
 3 files changed, 35 insertions(+)
 create mode 100644 tests/eval.nix
 create mode 100644 tests/eval.sh

diff --git a/tests/eval.nix b/tests/eval.nix
new file mode 100644
index 000000000..befbd17a9
--- /dev/null
+++ b/tests/eval.nix
@@ -0,0 +1,5 @@
+{
+  int = 123;
+  str = "foo";
+  attr.foo = "bar";
+}
diff --git a/tests/eval.sh b/tests/eval.sh
new file mode 100644
index 000000000..2e5ceb969
--- /dev/null
+++ b/tests/eval.sh
@@ -0,0 +1,29 @@
+source common.sh
+
+clearStore
+
+testStdinHeredoc=$(nix eval -f - <<EOF
+{
+  bar = 3 + 1;
+  foo = 2 + 2;
+}
+EOF
+)
+[[ $testStdinHeredoc == '{ bar = 4; foo = 4; }' ]]
+
+nix eval --expr 'assert 1 + 2 == 3; true'
+
+[[ $(nix eval int -f "./eval.nix") == 123 ]]
+[[ $(nix eval str -f "./eval.nix") == '"foo"' ]]
+[[ $(nix eval str --raw -f "./eval.nix") == 'foo' ]]
+[[ $(nix eval attr -f "./eval.nix") == '{ foo = "bar"; }' ]]
+[[ $(nix eval attr --json -f "./eval.nix") == '{"foo":"bar"}' ]]
+[[ $(nix eval int -f - < "./eval.nix") == 123 ]]
+
+
+nix-instantiate --eval -E 'assert 1 + 2 == 3; true'
+[[ $(nix-instantiate -A int --eval "./eval.nix") == 123 ]]
+[[ $(nix-instantiate -A str --eval "./eval.nix") == '"foo"' ]]
+[[ $(nix-instantiate -A attr --eval "./eval.nix") == '{ foo = "bar"; }' ]]
+[[ $(nix-instantiate -A attr --eval --json "./eval.nix") == '{"foo":"bar"}' ]]
+[[ $(nix-instantiate -A int --eval - < "./eval.nix") == 123 ]]
diff --git a/tests/local.mk b/tests/local.mk
index 8032fc38a..f84c20fc7 100644
--- a/tests/local.mk
+++ b/tests/local.mk
@@ -52,6 +52,7 @@ nix_tests = \
   build-remote-content-addressed-floating.sh \
   nar-access.sh \
   pure-eval.sh \
+  eval.sh \
   ca/post-hook.sh \
   repl.sh \
   ca/repl.sh \

From 57366619229c62ed182514d9ad71ef3aea93d5d6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Sat, 12 Mar 2022 13:47:01 +0100
Subject: [PATCH 155/251] nix-env: always print output names in JSON and XML

The current `--out-path` flag has two disadvantages when one is only
concerned with querying the names of outputs:
- it requires evaluating every output's `outPath`, which takes
  significantly more resources and runs into more failures
- it destroys the information of the order of outputs so we can't tell
  which one is the main output

This patch makes the output names always present (replacing paths with
`null` in JSON if `--out-path` isn't given), and adds an `outputName`
field.
---
 src/libexpr/get-drvs.cc |  28 +++++----
 src/libexpr/get-drvs.hh |   7 ++-
 src/nix-env/nix-env.cc  | 136 +++++++++++++++++++++-------------------
 src/nix-env/user-env.cc |  10 +--
 4 files changed, 95 insertions(+), 86 deletions(-)

diff --git a/src/libexpr/get-drvs.cc b/src/libexpr/get-drvs.cc
index 7630c5ff4..7f2ecb4f7 100644
--- a/src/libexpr/get-drvs.cc
+++ b/src/libexpr/get-drvs.cc
@@ -102,7 +102,7 @@ StorePath DrvInfo::queryOutPath() const
 }
 
 
-DrvInfo::Outputs DrvInfo::queryOutputs(bool onlyOutputsToInstall)
+DrvInfo::Outputs DrvInfo::queryOutputs(bool withPaths, bool onlyOutputsToInstall)
 {
     if (outputs.empty()) {
         /* Get the ‘outputs’ list. */
@@ -112,20 +112,24 @@ DrvInfo::Outputs DrvInfo::queryOutputs(bool onlyOutputsToInstall)
 
             /* For each output... */
             for (auto elem : i->value->listItems()) {
-                /* Evaluate the corresponding set. */
-                std::string name(state->forceStringNoCtx(*elem, *i->pos));
-                Bindings::iterator out = attrs->find(state->symbols.create(name));
-                if (out == attrs->end()) continue; // FIXME: throw error?
-                state->forceAttrs(*out->value, *i->pos);
+                std::string output(state->forceStringNoCtx(*elem, *i->pos));
 
-                /* And evaluate its ‘outPath’ attribute. */
-                Bindings::iterator outPath = out->value->attrs->find(state->sOutPath);
-                if (outPath == out->value->attrs->end()) continue; // FIXME: throw error?
-                PathSet context;
-                outputs.emplace(name, state->coerceToStorePath(*outPath->pos, *outPath->value, context));
+                if (withPaths) {
+                    /* Evaluate the corresponding set. */
+                    Bindings::iterator out = attrs->find(state->symbols.create(output));
+                    if (out == attrs->end()) continue; // FIXME: throw error?
+                    state->forceAttrs(*out->value, *i->pos);
+
+                    /* And evaluate its ‘outPath’ attribute. */
+                    Bindings::iterator outPath = out->value->attrs->find(state->sOutPath);
+                    if (outPath == out->value->attrs->end()) continue; // FIXME: throw error?
+                    PathSet context;
+                    outputs.emplace(output, state->coerceToStorePath(*outPath->pos, *outPath->value, context));
+                } else
+                    outputs.emplace(output, std::nullopt);
             }
         } else
-            outputs.emplace("out", queryOutPath());
+            outputs.emplace("out", withPaths ? std::optional{queryOutPath()} : std::nullopt);
     }
     if (!onlyOutputsToInstall || !attrs)
         return outputs;
diff --git a/src/libexpr/get-drvs.hh b/src/libexpr/get-drvs.hh
index 3ca6f1fca..7cc1abef2 100644
--- a/src/libexpr/get-drvs.hh
+++ b/src/libexpr/get-drvs.hh
@@ -13,7 +13,7 @@ namespace nix {
 struct DrvInfo
 {
 public:
-    typedef std::map<std::string, StorePath> Outputs;
+    typedef std::map<std::string, std::optional<StorePath>> Outputs;
 
 private:
     EvalState * state;
@@ -46,8 +46,9 @@ public:
     StorePath requireDrvPath() const;
     StorePath queryOutPath() const;
     std::string queryOutputName() const;
-    /** Return the list of outputs. The "outputs to install" are determined by `meta.outputsToInstall`. */
-    Outputs queryOutputs(bool onlyOutputsToInstall = false);
+    /** Return the unordered map of output names to (optional) output paths.
+     * The "outputs to install" are determined by `meta.outputsToInstall`. */
+    Outputs queryOutputs(bool withPaths = true, bool onlyOutputsToInstall = false);
 
     StringSet queryMetaNames();
     Value * queryMeta(const std::string & name);
diff --git a/src/nix-env/nix-env.cc b/src/nix-env/nix-env.cc
index 40c3c5d65..e68218d1c 100644
--- a/src/nix-env/nix-env.cc
+++ b/src/nix-env/nix-env.cc
@@ -918,12 +918,17 @@ static void queryJSON(Globals & globals, std::vector<DrvInfo> & elems, bool prin
             pkgObj.attr("pname", drvName.name);
             pkgObj.attr("version", drvName.version);
             pkgObj.attr("system", i.querySystem());
+            pkgObj.attr("outputName", i.queryOutputName());
 
-            if (printOutPath) {
-                DrvInfo::Outputs outputs = i.queryOutputs();
+            {
+                DrvInfo::Outputs outputs = i.queryOutputs(printOutPath);
                 JSONObject outputObj = pkgObj.object("outputs");
-                for (auto & j : outputs)
-                    outputObj.attr(j.first, globals.state->store->printStorePath(j.second));
+                for (auto & j : outputs) {
+                    if (j.second)
+                        outputObj.attr(j.first, globals.state->store->printStorePath(*j.second));
+                    else
+                        outputObj.attr(j.first, nullptr);
+                }
             }
 
             if (printMeta) {
@@ -1154,13 +1159,16 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
                     columns.push_back(drvPath ? store.printStorePath(*drvPath) : "-");
             }
 
+            if (xmlOutput)
+                attrs["outputName"] = i.queryOutputName();
+
             if (printOutPath && !xmlOutput) {
                 DrvInfo::Outputs outputs = i.queryOutputs();
                 std::string s;
                 for (auto & j : outputs) {
                     if (!s.empty()) s += ';';
                     if (j.first != "out") { s += j.first; s += "="; }
-                    s += store.printStorePath(j.second);
+                    s += store.printStorePath(*j.second);
                 }
                 columns.push_back(s);
             }
@@ -1174,71 +1182,67 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
             }
 
             if (xmlOutput) {
-                if (printOutPath || printMeta) {
-                    XMLOpenElement item(xml, "item", attrs);
-                    if (printOutPath) {
-                        DrvInfo::Outputs outputs = i.queryOutputs();
-                        for (auto & j : outputs) {
-                            XMLAttrs attrs2;
-                            attrs2["name"] = j.first;
-                            attrs2["path"] = store.printStorePath(j.second);
-                            xml.writeEmptyElement("output", attrs2);
-                        }
-                    }
-                    if (printMeta) {
-                        StringSet metaNames = i.queryMetaNames();
-                        for (auto & j : metaNames) {
-                            XMLAttrs attrs2;
-                            attrs2["name"] = j;
-                            Value * v = i.queryMeta(j);
-                            if (!v)
-                                printError(
-                                    "derivation '%s' has invalid meta attribute '%s'",
-                                    i.queryName(), j);
-                            else {
-                                if (v->type() == nString) {
-                                    attrs2["type"] = "string";
-                                    attrs2["value"] = v->string.s;
-                                    xml.writeEmptyElement("meta", attrs2);
-                                } else if (v->type() == nInt) {
-                                    attrs2["type"] = "int";
-                                    attrs2["value"] = (format("%1%") % v->integer).str();
-                                    xml.writeEmptyElement("meta", attrs2);
-                                } else if (v->type() == nFloat) {
-                                    attrs2["type"] = "float";
-                                    attrs2["value"] = (format("%1%") % v->fpoint).str();
-                                    xml.writeEmptyElement("meta", attrs2);
-                                } else if (v->type() == nBool) {
-                                    attrs2["type"] = "bool";
-                                    attrs2["value"] = v->boolean ? "true" : "false";
-                                    xml.writeEmptyElement("meta", attrs2);
-                                } else if (v->type() == nList) {
-                                    attrs2["type"] = "strings";
-                                    XMLOpenElement m(xml, "meta", attrs2);
-                                    for (auto elem : v->listItems()) {
-                                        if (elem->type() != nString) continue;
-                                        XMLAttrs attrs3;
-                                        attrs3["value"] = elem->string.s;
-                                        xml.writeEmptyElement("string", attrs3);
-                                    }
-                              } else if (v->type() == nAttrs) {
-                                  attrs2["type"] = "strings";
-                                  XMLOpenElement m(xml, "meta", attrs2);
-                                  Bindings & attrs = *v->attrs;
-                                  for (auto &i : attrs) {
-                                      Attr & a(*attrs.find(i.name));
-                                      if(a.value->type() != nString) continue;
-                                      XMLAttrs attrs3;
-                                      attrs3["type"] = i.name;
-                                      attrs3["value"] = a.value->string.s;
-                                      xml.writeEmptyElement("string", attrs3);
+                XMLOpenElement item(xml, "item", attrs);
+                DrvInfo::Outputs outputs = i.queryOutputs(printOutPath);
+                for (auto & j : outputs) {
+                    XMLAttrs attrs2;
+                    attrs2["name"] = j.first;
+                    if (j.second)
+                        attrs2["path"] = store.printStorePath(*j.second);
+                    xml.writeEmptyElement("output", attrs2);
+                }
+                if (printMeta) {
+                    StringSet metaNames = i.queryMetaNames();
+                    for (auto & j : metaNames) {
+                        XMLAttrs attrs2;
+                        attrs2["name"] = j;
+                        Value * v = i.queryMeta(j);
+                        if (!v)
+                            printError(
+                                "derivation '%s' has invalid meta attribute '%s'",
+                                i.queryName(), j);
+                        else {
+                            if (v->type() == nString) {
+                                attrs2["type"] = "string";
+                                attrs2["value"] = v->string.s;
+                                xml.writeEmptyElement("meta", attrs2);
+                            } else if (v->type() == nInt) {
+                                attrs2["type"] = "int";
+                                attrs2["value"] = (format("%1%") % v->integer).str();
+                                xml.writeEmptyElement("meta", attrs2);
+                            } else if (v->type() == nFloat) {
+                                attrs2["type"] = "float";
+                                attrs2["value"] = (format("%1%") % v->fpoint).str();
+                                xml.writeEmptyElement("meta", attrs2);
+                            } else if (v->type() == nBool) {
+                                attrs2["type"] = "bool";
+                                attrs2["value"] = v->boolean ? "true" : "false";
+                                xml.writeEmptyElement("meta", attrs2);
+                            } else if (v->type() == nList) {
+                                attrs2["type"] = "strings";
+                                XMLOpenElement m(xml, "meta", attrs2);
+                                for (auto elem : v->listItems()) {
+                                    if (elem->type() != nString) continue;
+                                    XMLAttrs attrs3;
+                                    attrs3["value"] = elem->string.s;
+                                    xml.writeEmptyElement("string", attrs3);
                                 }
-                              }
+                            } else if (v->type() == nAttrs) {
+                                attrs2["type"] = "strings";
+                                XMLOpenElement m(xml, "meta", attrs2);
+                                Bindings & attrs = *v->attrs;
+                                for (auto &i : attrs) {
+                                    Attr & a(*attrs.find(i.name));
+                                    if(a.value->type() != nString) continue;
+                                    XMLAttrs attrs3;
+                                    attrs3["type"] = i.name;
+                                    attrs3["value"] = a.value->string.s;
+                                    xml.writeEmptyElement("string", attrs3);
+                            }
                             }
                         }
                     }
-                } else
-                    xml.writeEmptyElement("item", attrs);
+                }
             } else
                 table.push_back(columns);
 
diff --git a/src/nix-env/user-env.cc b/src/nix-env/user-env.cc
index af4f350ff..bcc7736ac 100644
--- a/src/nix-env/user-env.cc
+++ b/src/nix-env/user-env.cc
@@ -56,7 +56,7 @@ bool createUserEnv(EvalState & state, DrvInfos & elems,
            output paths, and optionally the derivation path, as well
            as the meta attributes. */
         std::optional<StorePath> drvPath = keepDerivations ? i.queryDrvPath() : std::nullopt;
-        DrvInfo::Outputs outputs = i.queryOutputs(true);
+        DrvInfo::Outputs outputs = i.queryOutputs(true, true);
         StringSet metaNames = i.queryMetaNames();
 
         auto attrs = state.buildBindings(7 + outputs.size());
@@ -76,15 +76,15 @@ bool createUserEnv(EvalState & state, DrvInfos & elems,
         for (const auto & [m, j] : enumerate(outputs)) {
             (vOutputs.listElems()[m] = state.allocValue())->mkString(j.first);
             auto outputAttrs = state.buildBindings(2);
-            outputAttrs.alloc(state.sOutPath).mkString(state.store->printStorePath(j.second));
+            outputAttrs.alloc(state.sOutPath).mkString(state.store->printStorePath(*j.second));
             attrs.alloc(j.first).mkAttrs(outputAttrs);
 
             /* This is only necessary when installing store paths, e.g.,
                `nix-env -i /nix/store/abcd...-foo'. */
-            state.store->addTempRoot(j.second);
-            state.store->ensurePath(j.second);
+            state.store->addTempRoot(*j.second);
+            state.store->ensurePath(*j.second);
 
-            references.insert(j.second);
+            references.insert(*j.second);
         }
 
         // Copy the meta attributes.

From 8dcecc07387e6a782b4831dcc0d846eceb396191 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Wed, 16 Mar 2022 16:15:11 +0100
Subject: [PATCH 156/251] nix-env: print a final newline after JSON

---
 src/nix-env/nix-env.cc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/nix-env/nix-env.cc b/src/nix-env/nix-env.cc
index e68218d1c..a1cd8fd40 100644
--- a/src/nix-env/nix-env.cc
+++ b/src/nix-env/nix-env.cc
@@ -1057,6 +1057,7 @@ static void opQuery(Globals & globals, Strings opFlags, Strings opArgs)
     /* Print the desired columns, or XML output. */
     if (jsonOutput) {
         queryJSON(globals, elems, printOutPath, printMeta);
+        cout << '\n';
         return;
     }
 

From c20e07763d84c9dc6f8d06993335c765ba514aca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9ophane=20Hufschmitt?= <theophane@hufschmitt.net>
Date: Wed, 16 Mar 2022 18:39:46 +0100
Subject: [PATCH 157/251] Add some tests for `nix-env -q --json`

---
 tests/user-envs.sh | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/tests/user-envs.sh b/tests/user-envs.sh
index 430688de1..d63fe780a 100644
--- a/tests/user-envs.sh
+++ b/tests/user-envs.sh
@@ -17,6 +17,16 @@ outPath10=$(nix-env -f ./user-envs.nix -qa --out-path --no-name '*' | grep foo-1
 drvPath10=$(nix-env -f ./user-envs.nix -qa --drv-path --no-name '*' | grep foo-1.0)
 [ -n "$outPath10" -a -n "$drvPath10" ]
 
+# Query with json
+nix-env -f ./user-envs.nix -qa --json | jq -e '.[] | select(.name == "bar-0.1") | [
+    .outputName == "out",
+    .outputs.out == null
+] | all'
+nix-env -f ./user-envs.nix -qa --json --out-path | jq -e '.[] | select(.name == "bar-0.1") | [
+    .outputName == "out",
+    (.outputs.out | test("'$NIX_STORE_DIR'.*-0\\.1"))
+] | all'
+
 # Query descriptions.
 nix-env -f ./user-envs.nix -qa '*' --description | grep -q silly
 rm -rf $HOME/.nix-defexpr

From 3fc4c612fbde332d66b78dcc5b17b7d0d5235484 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9ophane=20Hufschmitt?= <theophane@hufschmitt.net>
Date: Thu, 17 Mar 2022 11:34:31 +0100
Subject: [PATCH 158/251] Fix `nix build --dry-run` with CA derivations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Don’t try and assume that we know the output paths when we’ve just built
with `--dry-run`. Instead make `--dry-run` follow a different code path
that won’t assume the knowledge of the output paths at all.

Fix #6275
---
 src/libstore/derived-path.cc | 31 ++++++++++++++++++++++++++-----
 src/libstore/derived-path.hh |  2 ++
 src/nix/build.cc             | 17 ++++++++++++++---
 tests/build-dry.sh           | 19 +++++++++++++++++++
 tests/ca/build-dry.sh        |  6 ++++++
 5 files changed, 67 insertions(+), 8 deletions(-)
 create mode 100644 tests/ca/build-dry.sh

diff --git a/src/libstore/derived-path.cc b/src/libstore/derived-path.cc
index 194489580..0183bda35 100644
--- a/src/libstore/derived-path.cc
+++ b/src/libstore/derived-path.cc
@@ -11,6 +11,21 @@ nlohmann::json DerivedPath::Opaque::toJSON(ref<Store> store) const {
     return res;
 }
 
+nlohmann::json DerivedPath::Built::toJSON(ref<Store> store) const {
+    nlohmann::json res;
+    res["drvPath"] = store->printStorePath(drvPath);
+    // Fallback for the input-addressed derivation case: We expect to always be
+    // able to print the output paths, so let’s do it
+    auto knownOutputs = store->queryPartialDerivationOutputMap(drvPath);
+    for (const auto& output : outputs) {
+        if (knownOutputs.at(output))
+            res["outputs"][output] = store->printStorePath(knownOutputs.at(output).value());
+        else
+            res["outputs"][output] = nullptr;
+    }
+    return res;
+}
+
 nlohmann::json BuiltPath::Built::toJSON(ref<Store> store) const {
     nlohmann::json res;
     res["drvPath"] = store->printStorePath(drvPath);
@@ -35,16 +50,22 @@ StorePathSet BuiltPath::outPaths() const
     );
 }
 
-nlohmann::json derivedPathsWithHintsToJSON(const BuiltPaths & buildables, ref<Store> store) {
+template<typename T>
+nlohmann::json stuffToJSON(const std::vector<T> & ts, ref<Store> store) {
     auto res = nlohmann::json::array();
-    for (const BuiltPath & buildable : buildables) {
-        std::visit([&res, store](const auto & buildable) {
-            res.push_back(buildable.toJSON(store));
-        }, buildable.raw());
+    for (const T & t : ts) {
+        std::visit([&res, store](const auto & t) {
+            res.push_back(t.toJSON(store));
+        }, t.raw());
     }
     return res;
 }
 
+nlohmann::json derivedPathsWithHintsToJSON(const BuiltPaths & buildables, ref<Store> store)
+{ return stuffToJSON<BuiltPath>(buildables, store); }
+nlohmann::json derivedPathsToJSON(const DerivedPaths & paths, ref<Store> store)
+{ return stuffToJSON<DerivedPath>(paths, store); }
+
 
 std::string DerivedPath::Opaque::to_string(const Store & store) const {
     return store.printStorePath(path);
diff --git a/src/libstore/derived-path.hh b/src/libstore/derived-path.hh
index 9d6ace069..8ca0882a4 100644
--- a/src/libstore/derived-path.hh
+++ b/src/libstore/derived-path.hh
@@ -45,6 +45,7 @@ struct DerivedPathBuilt {
 
     std::string to_string(const Store & store) const;
     static DerivedPathBuilt parse(const Store & store, std::string_view);
+    nlohmann::json toJSON(ref<Store> store) const;
 };
 
 using _DerivedPathRaw = std::variant<
@@ -119,5 +120,6 @@ typedef std::vector<DerivedPath> DerivedPaths;
 typedef std::vector<BuiltPath> BuiltPaths;
 
 nlohmann::json derivedPathsWithHintsToJSON(const BuiltPaths & buildables, ref<Store> store);
+nlohmann::json derivedPathsToJSON(const DerivedPaths & , ref<Store> store);
 
 }
diff --git a/src/nix/build.cc b/src/nix/build.cc
index 680db1c60..840c7ca38 100644
--- a/src/nix/build.cc
+++ b/src/nix/build.cc
@@ -52,15 +52,26 @@ struct CmdBuild : InstallablesCommand, MixDryRun, MixJSON, MixProfile
 
     void run(ref<Store> store) override
     {
+        if (dryRun) {
+            std::vector<DerivedPath> pathsToBuild;
+
+            for (auto & i : installables) {
+                auto b = i->toDerivedPaths();
+                pathsToBuild.insert(pathsToBuild.end(), b.begin(), b.end());
+            }
+            printMissing(store, pathsToBuild, lvlError);
+            if (json)
+                logger->cout("%s", derivedPathsToJSON(pathsToBuild, store).dump());
+            return;
+        }
+
         auto buildables = Installable::build(
             getEvalStore(), store,
-            dryRun ? Realise::Derivation : Realise::Outputs,
+            Realise::Outputs,
             installables, buildMode);
 
         if (json) logger->cout("%s", derivedPathsWithHintsToJSON(buildables, store).dump());
 
-        if (dryRun) return;
-
         if (outLink != "")
             if (auto store2 = store.dynamic_pointer_cast<LocalFSStore>())
                 for (const auto & [_i, buildable] : enumerate(buildables)) {
diff --git a/tests/build-dry.sh b/tests/build-dry.sh
index e72533e70..f0f38e9a0 100644
--- a/tests/build-dry.sh
+++ b/tests/build-dry.sh
@@ -50,3 +50,22 @@ nix build -f dependencies.nix -o $RESULT --dry-run
 nix build -f dependencies.nix -o $RESULT
 
 [[ -h $RESULT ]]
+
+###################################################
+# Check the JSON output
+clearStore
+clearCache
+
+RES=$(nix build -f dependencies.nix --dry-run --json)
+
+if [[ -z "$NIX_TESTS_CA_BY_DEFAULT" ]]; then
+    echo "$RES" | jq '.[0] | [
+        (.drvPath | test("'$NIX_STORE_DIR'.*\\.drv")),
+        (.outputs.out | test("'$NIX_STORE_DIR'"))
+    ] | all'
+else
+    echo "$RES" | jq '.[0] | [
+        (.drvPath | test("'$NIX_STORE_DIR'.*\\.drv")),
+        .outputs.out == null
+    ] | all'
+fi
diff --git a/tests/ca/build-dry.sh b/tests/ca/build-dry.sh
new file mode 100644
index 000000000..9a72075ec
--- /dev/null
+++ b/tests/ca/build-dry.sh
@@ -0,0 +1,6 @@
+source common.sh
+
+export NIX_TESTS_CA_BY_DEFAULT=1
+
+cd .. && source build-dry.sh
+

From d58453f72ea584cac2e3362fd6a73fcf0e3b615e Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 17 Mar 2022 18:36:45 +0000
Subject: [PATCH 159/251] gc: don't visit implicit referrers on garbage
 collection

Before the change garbage collector was not considering
`.drv` and outputs as alive even if configuration says otherwise.
As a result `nix store gc --dry-run` could visit (and parse)
`.drv` files multiple times (worst case it's quadratic).

It happens because `alive` set was populating only runtime closure
without regard for actual configuration. The change fixes it.

Benchmark: my system has about 139MB, 40K `.drv` files.

Performance before the change:

    $ time nix store gc --dry-run
    real    4m22,148s

Performance after the change:

    $ time nix store gc --dry-run
    real    0m14,178s
---
 src/libstore/gc.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/libstore/gc.cc b/src/libstore/gc.cc
index 69755bd19..f65fb1b2e 100644
--- a/src/libstore/gc.cc
+++ b/src/libstore/gc.cc
@@ -678,7 +678,8 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
                 alive.insert(start);
                 try {
                     StorePathSet closure;
-                    computeFSClosure(*path, closure);
+                    computeFSClosure(*path, closure,
+                        /* flipDirection */ false, gcKeepOutputs, gcKeepDerivations);
                     for (auto & p : closure)
                         alive.insert(p);
                 } catch (InvalidPath &) { }

From 197feed51dd770929ba8f6f12aec50ed8597a747 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 17 Mar 2022 22:29:15 +0000
Subject: [PATCH 160/251] Clean up `DerivationOutput`, and headers

1. `DerivationOutput` now as the `std::variant` as a base class. And the
   variants are given hierarchical names under `DerivationOutput`.

   In 8e0d0689be797f9e42f9b43b06f50c1af7f20b4a @matthewbauer and I
   didn't know a better idiom, and so we made it a field. But this sort
   of "newtype" is anoying for literals downstream.

   Since then we leaned the base class, inherit the constructors trick,
   e.g. used in `DerivedPath`. Switching to use that makes this more
   ergonomic, and consistent.

2. `store-api.hh` and `derivations.hh` are now independent.

   In bcde5456cc3295061a0726881c3e441444dd6680 I swapped the dependency,
   but I now know it is better to just keep on using incomplete types as
   much as possible for faster compilation and good separation of
   concerns.
---
 src/libexpr/get-drvs.cc                     |  1 +
 src/libexpr/primops.cc                      | 36 ++++------
 src/libexpr/primops/context.cc              |  1 +
 src/libstore/build/local-derivation-goal.cc | 14 ++--
 src/libstore/derivations.cc                 | 80 +++++++++------------
 src/libstore/derivations.hh                 | 35 +++++----
 src/libstore/derived-path.cc                |  1 +
 src/libstore/local-store.cc                 | 10 +--
 src/libstore/misc.cc                        |  2 +-
 src/libstore/parsed-derivations.hh          |  1 +
 src/libstore/repair-flag.hh                 |  7 ++
 src/libstore/store-api.cc                   |  1 +
 src/libstore/store-api.hh                   |  4 +-
 src/nix/app.cc                              |  1 +
 src/nix/develop.cc                          | 12 ++--
 src/nix/show-derivation.cc                  | 10 +--
 16 files changed, 113 insertions(+), 103 deletions(-)
 create mode 100644 src/libstore/repair-flag.hh

diff --git a/src/libexpr/get-drvs.cc b/src/libexpr/get-drvs.cc
index 7f2ecb4f7..bb7e77b61 100644
--- a/src/libexpr/get-drvs.cc
+++ b/src/libexpr/get-drvs.cc
@@ -1,6 +1,7 @@
 #include "get-drvs.hh"
 #include "util.hh"
 #include "eval-inline.hh"
+#include "derivations.hh"
 #include "store-api.hh"
 #include "path-with-outputs.hh"
 
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 0980e75f4..4f9b6f0e0 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1163,26 +1163,24 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
 
         auto outPath = state.store->makeFixedOutputPath(ingestionMethod, h, drvName);
         drv.env["out"] = state.store->printStorePath(outPath);
-        drv.outputs.insert_or_assign("out", DerivationOutput {
-                .output = DerivationOutputCAFixed {
-                    .hash = FixedOutputHash {
-                        .method = ingestionMethod,
-                        .hash = std::move(h),
-                    },
+        drv.outputs.insert_or_assign("out",
+            DerivationOutput::CAFixed {
+                .hash = FixedOutputHash {
+                    .method = ingestionMethod,
+                    .hash = std::move(h),
                 },
-        });
+            });
     }
 
     else if (contentAddressed) {
         HashType ht = parseHashType(outputHashAlgo);
         for (auto & i : outputs) {
             drv.env[i] = hashPlaceholder(i);
-            drv.outputs.insert_or_assign(i, DerivationOutput {
-                .output = DerivationOutputCAFloating {
+            drv.outputs.insert_or_assign(i,
+                DerivationOutput::CAFloating {
                     .method = ingestionMethod,
                     .hashType = ht,
-                },
-            });
+                });
         }
     }
 
@@ -1196,10 +1194,8 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
         for (auto & i : outputs) {
             drv.env[i] = "";
             drv.outputs.insert_or_assign(i,
-                DerivationOutput {
-                    .output = DerivationOutputInputAddressed {
-                        .path = StorePath::dummy,
-                    },
+                DerivationOutput::InputAddressed {
+                    .path = StorePath::dummy,
                 });
         }
 
@@ -1213,9 +1209,7 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
                 case DrvHash::Kind::Deferred:
                     for (auto & i : outputs) {
                         drv.outputs.insert_or_assign(i,
-                            DerivationOutput {
-                                .output = DerivationOutputDeferred{},
-                            });
+                            DerivationOutput::Deferred { });
                     }
                     break;
                 case DrvHash::Kind::Regular:
@@ -1223,10 +1217,8 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
                         auto outPath = state.store->makeOutputPath(i, h, drvName);
                         drv.env[i] = state.store->printStorePath(outPath);
                         drv.outputs.insert_or_assign(i,
-                            DerivationOutput {
-                                .output = DerivationOutputInputAddressed {
-                                    .path = std::move(outPath),
-                                },
+                            DerivationOutput::InputAddressed {
+                                .path = std::move(outPath),
                             });
                     }
                     break;
diff --git a/src/libexpr/primops/context.cc b/src/libexpr/primops/context.cc
index 3701bd442..324394d10 100644
--- a/src/libexpr/primops/context.cc
+++ b/src/libexpr/primops/context.cc
@@ -1,5 +1,6 @@
 #include "primops.hh"
 #include "eval-inline.hh"
+#include "derivations.hh"
 #include "store-api.hh"
 
 namespace nix {
diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index 4e763e570..8a301d4ac 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -2279,7 +2279,7 @@ DrvOutputs LocalDerivationGoal::registerOutputs()
             return res;
         };
 
-        auto newInfoFromCA = [&](const DerivationOutputCAFloating outputHash) -> ValidPathInfo {
+        auto newInfoFromCA = [&](const DerivationOutput::CAFloating outputHash) -> ValidPathInfo {
             auto & st = outputStats.at(outputName);
             if (outputHash.method == FileIngestionMethod::Flat) {
                 /* The output path should be a regular file without execute permission. */
@@ -2346,7 +2346,7 @@ DrvOutputs LocalDerivationGoal::registerOutputs()
 
         ValidPathInfo newInfo = std::visit(overloaded {
 
-            [&](const DerivationOutputInputAddressed & output) {
+            [&](const DerivationOutput::InputAddressed & output) {
                 /* input-addressed case */
                 auto requiredFinalPath = output.path;
                 /* Preemptively add rewrite rule for final hash, as that is
@@ -2366,8 +2366,8 @@ DrvOutputs LocalDerivationGoal::registerOutputs()
                 return newInfo0;
             },
 
-            [&](const DerivationOutputCAFixed & dof) {
-                auto newInfo0 = newInfoFromCA(DerivationOutputCAFloating {
+            [&](const DerivationOutput::CAFixed & dof) {
+                auto newInfo0 = newInfoFromCA(DerivationOutput::CAFloating {
                     .method = dof.hash.method,
                     .hashType = dof.hash.hash.type,
                 });
@@ -2389,17 +2389,17 @@ DrvOutputs LocalDerivationGoal::registerOutputs()
                 return newInfo0;
             },
 
-            [&](DerivationOutputCAFloating & dof) {
+            [&](const DerivationOutput::CAFloating & dof) {
                 return newInfoFromCA(dof);
             },
 
-            [&](DerivationOutputDeferred) -> ValidPathInfo {
+            [&](const DerivationOutput::Deferred &) -> ValidPathInfo {
                 // No derivation should reach that point without having been
                 // rewritten first
                 assert(false);
             },
 
-        }, output.output);
+        }, output.raw());
 
         /* FIXME: set proper permissions in restorePath() so
             we don't have to do another traversal. */
diff --git a/src/libstore/derivations.cc b/src/libstore/derivations.cc
index 1fe45bd87..3dd3a78d8 100644
--- a/src/libstore/derivations.cc
+++ b/src/libstore/derivations.cc
@@ -11,25 +11,25 @@ namespace nix {
 std::optional<StorePath> DerivationOutput::path(const Store & store, std::string_view drvName, std::string_view outputName) const
 {
     return std::visit(overloaded {
-        [](const DerivationOutputInputAddressed & doi) -> std::optional<StorePath> {
+        [](const DerivationOutput::InputAddressed & doi) -> std::optional<StorePath> {
             return { doi.path };
         },
-        [&](const DerivationOutputCAFixed & dof) -> std::optional<StorePath> {
+        [&](const DerivationOutput::CAFixed & dof) -> std::optional<StorePath> {
             return {
                 dof.path(store, drvName, outputName)
             };
         },
-        [](const DerivationOutputCAFloating & dof) -> std::optional<StorePath> {
+        [](const DerivationOutput::CAFloating & dof) -> std::optional<StorePath> {
             return std::nullopt;
         },
-        [](const DerivationOutputDeferred &) -> std::optional<StorePath> {
+        [](const DerivationOutput::Deferred &) -> std::optional<StorePath> {
             return std::nullopt;
         },
-    }, output);
+    }, raw());
 }
 
 
-StorePath DerivationOutputCAFixed::path(const Store & store, std::string_view drvName, std::string_view outputName) const {
+StorePath DerivationOutput::CAFixed::path(const Store & store, std::string_view drvName, std::string_view outputName) const {
     return store.makeFixedOutputPath(
         hash.method, hash.hash,
         outputPathName(drvName, outputName));
@@ -179,35 +179,27 @@ static DerivationOutput parseDerivationOutput(const Store & store,
         const auto hashType = parseHashType(hashAlgo);
         if (hash != "") {
             validatePath(pathS);
-            return DerivationOutput {
-                .output = DerivationOutputCAFixed {
-                    .hash = FixedOutputHash {
-                        .method = std::move(method),
-                        .hash = Hash::parseNonSRIUnprefixed(hash, hashType),
-                    },
+            return DerivationOutput::CAFixed {
+                .hash = FixedOutputHash {
+                    .method = std::move(method),
+                    .hash = Hash::parseNonSRIUnprefixed(hash, hashType),
                 },
             };
         } else {
             settings.requireExperimentalFeature(Xp::CaDerivations);
             assert(pathS == "");
-            return DerivationOutput {
-                .output = DerivationOutputCAFloating {
-                    .method = std::move(method),
-                    .hashType = std::move(hashType),
-                },
+            return DerivationOutput::CAFloating {
+                .method = std::move(method),
+                .hashType = std::move(hashType),
             };
         }
     } else {
         if (pathS == "") {
-            return DerivationOutput {
-                .output = DerivationOutputDeferred { }
-            };
+            return DerivationOutput::Deferred { };
         }
         validatePath(pathS);
-        return DerivationOutput {
-            .output = DerivationOutputInputAddressed {
-                .path = store.parseStorePath(pathS),
-            }
+        return DerivationOutput::InputAddressed {
+            .path = store.parseStorePath(pathS),
         };
     }
 }
@@ -335,27 +327,27 @@ std::string Derivation::unparse(const Store & store, bool maskOutputs,
         if (first) first = false; else s += ',';
         s += '('; printUnquotedString(s, i.first);
         std::visit(overloaded {
-            [&](const DerivationOutputInputAddressed & doi) {
+            [&](const DerivationOutput::InputAddressed & doi) {
                 s += ','; printUnquotedString(s, maskOutputs ? "" : store.printStorePath(doi.path));
                 s += ','; printUnquotedString(s, "");
                 s += ','; printUnquotedString(s, "");
             },
-            [&](const DerivationOutputCAFixed & dof) {
+            [&](const DerivationOutput::CAFixed & dof) {
                 s += ','; printUnquotedString(s, maskOutputs ? "" : store.printStorePath(dof.path(store, name, i.first)));
                 s += ','; printUnquotedString(s, dof.hash.printMethodAlgo());
                 s += ','; printUnquotedString(s, dof.hash.hash.to_string(Base16, false));
             },
-            [&](const DerivationOutputCAFloating & dof) {
+            [&](const DerivationOutput::CAFloating & dof) {
                 s += ','; printUnquotedString(s, "");
                 s += ','; printUnquotedString(s, makeFileIngestionPrefix(dof.method) + printHashType(dof.hashType));
                 s += ','; printUnquotedString(s, "");
             },
-            [&](const DerivationOutputDeferred &) {
+            [&](const DerivationOutput::Deferred &) {
                 s += ','; printUnquotedString(s, "");
                 s += ','; printUnquotedString(s, "");
                 s += ','; printUnquotedString(s, "");
             }
-        }, i.second.output);
+        }, i.second.raw());
         s += ')';
     }
 
@@ -423,13 +415,13 @@ DerivationType BasicDerivation::type() const
     std::optional<HashType> floatingHashType;
     for (auto & i : outputs) {
         std::visit(overloaded {
-            [&](const DerivationOutputInputAddressed &) {
+            [&](const DerivationOutput::InputAddressed &) {
                inputAddressedOutputs.insert(i.first);
             },
-            [&](const DerivationOutputCAFixed &) {
+            [&](const DerivationOutput::CAFixed &) {
                 fixedCAOutputs.insert(i.first);
             },
-            [&](const DerivationOutputCAFloating & dof) {
+            [&](const DerivationOutput::CAFloating & dof) {
                 floatingCAOutputs.insert(i.first);
                 if (!floatingHashType) {
                     floatingHashType = dof.hashType;
@@ -438,10 +430,10 @@ DerivationType BasicDerivation::type() const
                         throw Error("All floating outputs must use the same hash type");
                 }
             },
-            [&](const DerivationOutputDeferred &) {
+            [&](const DerivationOutput::Deferred &) {
                deferredIAOutputs.insert(i.first);
             },
-        }, i.second.output);
+        }, i.second.raw());
     }
 
     if (inputAddressedOutputs.empty() && fixedCAOutputs.empty() && floatingCAOutputs.empty() && deferredIAOutputs.empty()) {
@@ -516,7 +508,7 @@ DrvHashModulo hashDerivationModulo(Store & store, const Derivation & drv, bool m
     case DerivationType::CAFixed: {
         std::map<std::string, Hash> outputHashes;
         for (const auto & i : drv.outputs) {
-            auto & dof = std::get<DerivationOutputCAFixed>(i.second.output);
+            auto & dof = std::get<DerivationOutput::CAFixed>(i.second.raw());
             auto hash = hashString(htSHA256, "fixed:out:"
                 + dof.hash.printMethodAlgo() + ":"
                 + dof.hash.hash.to_string(Base16, false) + ":"
@@ -672,27 +664,27 @@ void writeDerivation(Sink & out, const Store & store, const BasicDerivation & dr
     for (auto & i : drv.outputs) {
         out << i.first;
         std::visit(overloaded {
-            [&](const DerivationOutputInputAddressed & doi) {
+            [&](const DerivationOutput::InputAddressed & doi) {
                 out << store.printStorePath(doi.path)
                     << ""
                     << "";
             },
-            [&](const DerivationOutputCAFixed & dof) {
+            [&](const DerivationOutput::CAFixed & dof) {
                 out << store.printStorePath(dof.path(store, drv.name, i.first))
                     << dof.hash.printMethodAlgo()
                     << dof.hash.hash.to_string(Base16, false);
             },
-            [&](const DerivationOutputCAFloating & dof) {
+            [&](const DerivationOutput::CAFloating & dof) {
                 out << ""
                     << (makeFileIngestionPrefix(dof.method) + printHashType(dof.hashType))
                     << "";
             },
-            [&](const DerivationOutputDeferred &) {
+            [&](const DerivationOutput::Deferred &) {
                 out << ""
                     << ""
                     << "";
             },
-        }, i.second.output);
+        }, i.second.raw());
     }
     worker_proto::write(store, out, drv.inputSrcs);
     out << drv.platform << drv.builder << drv.args;
@@ -740,14 +732,12 @@ static void rewriteDerivation(Store & store, BasicDerivation & drv, const String
 
     auto hashModulo = hashDerivationModulo(store, Derivation(drv), true);
     for (auto & [outputName, output] : drv.outputs) {
-        if (std::holds_alternative<DerivationOutputDeferred>(output.output)) {
+        if (std::holds_alternative<DerivationOutput::Deferred>(output.raw())) {
             auto & h = hashModulo.requireNoFixedNonDeferred();
             auto outPath = store.makeOutputPath(outputName, h, drv.name);
             drv.env[outputName] = store.printStorePath(outPath);
-            output = DerivationOutput {
-                .output = DerivationOutputInputAddressed {
-                    .path = std::move(outPath),
-                },
+            output = DerivationOutput::InputAddressed {
+                .path = std::move(outPath),
             };
         }
     }
diff --git a/src/libstore/derivations.hh b/src/libstore/derivations.hh
index 2fb18d7f7..6b92b2f21 100644
--- a/src/libstore/derivations.hh
+++ b/src/libstore/derivations.hh
@@ -4,6 +4,7 @@
 #include "types.hh"
 #include "hash.hh"
 #include "content-address.hh"
+#include "repair-flag.hh"
 #include "sync.hh"
 
 #include <map>
@@ -44,19 +45,31 @@ struct DerivationOutputCAFloating
  */
 struct DerivationOutputDeferred {};
 
-struct DerivationOutput
+typedef std::variant<
+    DerivationOutputInputAddressed,
+    DerivationOutputCAFixed,
+    DerivationOutputCAFloating,
+    DerivationOutputDeferred
+> _DerivationOutputRaw;
+
+struct DerivationOutput : _DerivationOutputRaw
 {
-    std::variant<
-        DerivationOutputInputAddressed,
-        DerivationOutputCAFixed,
-        DerivationOutputCAFloating,
-        DerivationOutputDeferred
-    > output;
+    using Raw = _DerivationOutputRaw;
+    using Raw::Raw;
+
+    using InputAddressed = DerivationOutputInputAddressed;
+    using CAFixed = DerivationOutputCAFixed;
+    using CAFloating = DerivationOutputCAFloating;
+    using Deferred = DerivationOutputDeferred;
 
     /* Note, when you use this function you should make sure that you're passing
        the right derivation name. When in doubt, you should use the safer
        interface provided by BasicDerivation::outputsAndOptPaths */
     std::optional<StorePath> path(const Store & store, std::string_view drvName, std::string_view outputName) const;
+
+    inline const Raw & raw() const {
+        return static_cast<const Raw &>(*this);
+    }
 };
 
 typedef std::map<std::string, DerivationOutput> DerivationOutputs;
@@ -150,8 +163,6 @@ struct Derivation : BasicDerivation
 
 class Store;
 
-enum RepairFlag : bool { NoRepair = false, Repair = true };
-
 /* Write a derivation to the Nix store, and return its path. */
 StorePath writeDerivation(Store & store,
     const Derivation & drv,
@@ -197,10 +208,10 @@ typedef std::variant<
     DrvHash,
     // Fixed-output derivation hashes
     CaOutputHashes
-> DrvHashModuloRaw;
+> _DrvHashModuloRaw;
 
-struct DrvHashModulo : DrvHashModuloRaw {
-    using Raw = DrvHashModuloRaw;
+struct DrvHashModulo : _DrvHashModuloRaw {
+    using Raw = _DrvHashModuloRaw;
     using Raw::Raw;
 
     /* Get hash, throwing if it is per-output CA hashes or a
diff --git a/src/libstore/derived-path.cc b/src/libstore/derived-path.cc
index 0183bda35..319b1c790 100644
--- a/src/libstore/derived-path.cc
+++ b/src/libstore/derived-path.cc
@@ -1,4 +1,5 @@
 #include "derived-path.hh"
+#include "derivations.hh"
 #include "store-api.hh"
 
 #include <nlohmann/json.hpp>
diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index 9230be15a..75726a1ab 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -698,7 +698,7 @@ void LocalStore::checkDerivationOutputs(const StorePath & drvPath, const Derivat
     std::optional<Hash> h;
     for (auto & i : drv.outputs) {
         std::visit(overloaded {
-            [&](const DerivationOutputInputAddressed & doia) {
+            [&](const DerivationOutput::InputAddressed & doia) {
                 if (!h) {
                     // somewhat expensive so we do lazily
                     auto h0 = hashDerivationModulo(*this, drv, true);
@@ -710,16 +710,16 @@ void LocalStore::checkDerivationOutputs(const StorePath & drvPath, const Derivat
                         printStorePath(drvPath), printStorePath(doia.path), printStorePath(recomputed));
                 envHasRightPath(doia.path, i.first);
             },
-            [&](const DerivationOutputCAFixed & dof) {
+            [&](const DerivationOutput::CAFixed & dof) {
                 StorePath path = makeFixedOutputPath(dof.hash.method, dof.hash.hash, drvName);
                 envHasRightPath(path, i.first);
             },
-            [&](const DerivationOutputCAFloating &) {
+            [&](const DerivationOutput::CAFloating &) {
                 /* Nothing to check */
             },
-            [&](const DerivationOutputDeferred &) {
+            [&](const DerivationOutput::Deferred &) {
             },
-        }, i.second.output);
+        }, i.second.raw());
     }
 }
 
diff --git a/src/libstore/misc.cc b/src/libstore/misc.cc
index 6409874ff..1f0bae7fe 100644
--- a/src/libstore/misc.cc
+++ b/src/libstore/misc.cc
@@ -87,7 +87,7 @@ std::optional<ContentAddress> getDerivationCA(const BasicDerivation & drv)
 {
     auto out = drv.outputs.find("out");
     if (out != drv.outputs.end()) {
-        if (auto v = std::get_if<DerivationOutputCAFixed>(&out->second.output))
+        if (const auto * v = std::get_if<DerivationOutput::CAFixed>(&out->second.raw()))
             return v->hash;
     }
     return std::nullopt;
diff --git a/src/libstore/parsed-derivations.hh b/src/libstore/parsed-derivations.hh
index effcf099d..95bec21e8 100644
--- a/src/libstore/parsed-derivations.hh
+++ b/src/libstore/parsed-derivations.hh
@@ -1,5 +1,6 @@
 #pragma once
 
+#include "derivations.hh"
 #include "store-api.hh"
 
 #include <nlohmann/json_fwd.hpp>
diff --git a/src/libstore/repair-flag.hh b/src/libstore/repair-flag.hh
new file mode 100644
index 000000000..a13cda312
--- /dev/null
+++ b/src/libstore/repair-flag.hh
@@ -0,0 +1,7 @@
+#pragma once
+
+namespace nix {
+
+enum RepairFlag : bool { NoRepair = false, Repair = true };
+
+}
diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index 86fa6a211..59937be4d 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -1,6 +1,7 @@
 #include "crypto.hh"
 #include "fs-accessor.hh"
 #include "globals.hh"
+#include "derivations.hh"
 #include "store-api.hh"
 #include "util.hh"
 #include "nar-info-disk-cache.hh"
diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
index 635a82a2a..0c8a4db56 100644
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@@ -10,8 +10,8 @@
 #include "sync.hh"
 #include "globals.hh"
 #include "config.hh"
-#include "derivations.hh"
 #include "path-info.hh"
+#include "repair-flag.hh"
 
 #include <atomic>
 #include <limits>
@@ -62,6 +62,8 @@ MakeError(BadStorePath, Error);
 
 MakeError(InvalidStoreURI, Error);
 
+struct BasicDerivation;
+struct Derivation;
 class FSAccessor;
 class NarInfoDiskCache;
 class Store;
diff --git a/src/nix/app.cc b/src/nix/app.cc
index 2563180fb..30e138a96 100644
--- a/src/nix/app.cc
+++ b/src/nix/app.cc
@@ -4,6 +4,7 @@
 #include "eval-cache.hh"
 #include "names.hh"
 #include "command.hh"
+#include "derivations.hh"
 
 namespace nix {
 
diff --git a/src/nix/develop.cc b/src/nix/develop.cc
index dafcafd79..6baf539c3 100644
--- a/src/nix/develop.cc
+++ b/src/nix/develop.cc
@@ -196,14 +196,14 @@ static StorePath getDerivationEnvironment(ref<Store> store, ref<Store> evalStore
     drv.inputSrcs.insert(std::move(getEnvShPath));
     if (settings.isExperimentalFeatureEnabled(Xp::CaDerivations)) {
         for (auto & output : drv.outputs) {
-            output.second = {
-                .output = DerivationOutputDeferred{},
-            };
+            output.second = DerivationOutput::Deferred {},
             drv.env[output.first] = hashPlaceholder(output.first);
         }
     } else {
         for (auto & output : drv.outputs) {
-            output.second = { .output = DerivationOutputInputAddressed { .path = StorePath::dummy } };
+            output.second = DerivationOutput::InputAddressed {
+                .path = StorePath::dummy,
+            };
             drv.env[output.first] = "";
         }
         auto h0 = hashDerivationModulo(*evalStore, drv, true);
@@ -211,7 +211,9 @@ static StorePath getDerivationEnvironment(ref<Store> store, ref<Store> evalStore
 
         for (auto & output : drv.outputs) {
             auto outPath = store->makeOutputPath(output.first, h, drv.name);
-            output.second = { .output = DerivationOutputInputAddressed { .path = outPath } };
+            output.second = DerivationOutput::InputAddressed {
+                .path = outPath,
+            };
             drv.env[output.first] = store->printStorePath(outPath);
         }
     }
diff --git a/src/nix/show-derivation.cc b/src/nix/show-derivation.cc
index 61a02c9b3..0d9655732 100644
--- a/src/nix/show-derivation.cc
+++ b/src/nix/show-derivation.cc
@@ -65,19 +65,19 @@ struct CmdShowDerivation : InstallablesCommand
                     auto & outputName = _outputName; // work around clang bug
                     auto outputObj { outputsObj.object(outputName) };
                     std::visit(overloaded {
-                        [&](const DerivationOutputInputAddressed & doi) {
+                        [&](const DerivationOutput::InputAddressed & doi) {
                             outputObj.attr("path", store->printStorePath(doi.path));
                         },
-                        [&](const DerivationOutputCAFixed & dof) {
+                        [&](const DerivationOutput::CAFixed & dof) {
                             outputObj.attr("path", store->printStorePath(dof.path(*store, drv.name, outputName)));
                             outputObj.attr("hashAlgo", dof.hash.printMethodAlgo());
                             outputObj.attr("hash", dof.hash.hash.to_string(Base16, false));
                         },
-                        [&](const DerivationOutputCAFloating & dof) {
+                        [&](const DerivationOutput::CAFloating & dof) {
                             outputObj.attr("hashAlgo", makeFileIngestionPrefix(dof.method) + printHashType(dof.hashType));
                         },
-                        [&](const DerivationOutputDeferred &) {},
-                    }, output.output);
+                        [&](const DerivationOutput::Deferred &) {},
+                    }, output.raw());
                 }
             }
 

From 8496be7defed3584c9fcd3b5d905fb84a9515d6f Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 18 Mar 2022 02:07:31 +0000
Subject: [PATCH 161/251] Use Deferred when building an input-addressed drv

Easier than using dummy path with input addressed.
---
 src/libexpr/primops.cc | 22 ++++++++--------------
 src/nix/develop.cc     |  4 +---
 2 files changed, 9 insertions(+), 17 deletions(-)

diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 4f9b6f0e0..489bee826 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1194,9 +1194,7 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
         for (auto & i : outputs) {
             drv.env[i] = "";
             drv.outputs.insert_or_assign(i,
-                DerivationOutput::InputAddressed {
-                    .path = StorePath::dummy,
-                });
+                DerivationOutput::Deferred { });
         }
 
         // Regular, non-CA derivation should always return a single hash and not
@@ -1207,19 +1205,15 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
                 auto & h = drvHash.hash;
                 switch (drvHash.kind) {
                 case DrvHash::Kind::Deferred:
-                    for (auto & i : outputs) {
-                        drv.outputs.insert_or_assign(i,
-                            DerivationOutput::Deferred { });
-                    }
+                    /* Outputs already deferred, nothing to do */
                     break;
                 case DrvHash::Kind::Regular:
-                    for (auto & i : outputs) {
-                        auto outPath = state.store->makeOutputPath(i, h, drvName);
-                        drv.env[i] = state.store->printStorePath(outPath);
-                        drv.outputs.insert_or_assign(i,
-                            DerivationOutput::InputAddressed {
-                                .path = std::move(outPath),
-                            });
+                    for (auto & [outputName, output] : drv.outputs) {
+                        auto outPath = state.store->makeOutputPath(outputName, h, drvName);
+                        drv.env[outputName] = state.store->printStorePath(outPath);
+                        output = DerivationOutput::InputAddressed {
+                            .path = std::move(outPath),
+                        };
                     }
                     break;
                 }
diff --git a/src/nix/develop.cc b/src/nix/develop.cc
index 6baf539c3..d2f9b5a6a 100644
--- a/src/nix/develop.cc
+++ b/src/nix/develop.cc
@@ -201,9 +201,7 @@ static StorePath getDerivationEnvironment(ref<Store> store, ref<Store> evalStore
         }
     } else {
         for (auto & output : drv.outputs) {
-            output.second = DerivationOutput::InputAddressed {
-                .path = StorePath::dummy,
-            };
+            output.second = DerivationOutput::Deferred { };
             drv.env[output.first] = "";
         }
         auto h0 = hashDerivationModulo(*evalStore, drv, true);

From 049fae155a18784ca59d194bf3e579fadbc3b48f Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 18 Mar 2022 02:15:32 +0000
Subject: [PATCH 162/251] Avoid some pointless copying of drvs

---
 src/libexpr/primops.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 489bee826..2dc33103d 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1199,7 +1199,7 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
 
         // Regular, non-CA derivation should always return a single hash and not
         // hash per output.
-        auto hashModulo = hashDerivationModulo(*state.store, Derivation(drv), true);
+        auto hashModulo = hashDerivationModulo(*state.store, drv, true);
         std::visit(overloaded {
             [&](const DrvHash & drvHash) {
                 auto & h = drvHash.hash;
@@ -1240,7 +1240,7 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
        However, we don't bother doing this for floating CA derivations because
        their "hash modulo" is indeterminate until built. */
     if (drv.type() != DerivationType::CAFloating) {
-        auto h = hashDerivationModulo(*state.store, Derivation(drv), false);
+        auto h = hashDerivationModulo(*state.store, drv, false);
         drvHashes.lock()->insert_or_assign(drvPath, h);
     }
 

From a544ed7684bdf5fa3c0b78d40913f5be3f73f5a7 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 18 Mar 2022 00:36:52 +0000
Subject: [PATCH 163/251] Generalize `DerivationType` in preparation for impure
 derivations

---
 src/build-remote/build-remote.cc            |   2 +-
 src/libexpr/primops.cc                      |   7 +-
 src/libstore/build/derivation-goal.cc       |  35 ++++--
 src/libstore/build/local-derivation-goal.cc |  14 +--
 src/libstore/daemon.cc                      |   8 +-
 src/libstore/derivations.cc                 | 112 +++++++++++---------
 src/libstore/derivations.hh                 |  62 +++++++----
 src/libstore/local-store.cc                 |   1 +
 src/libstore/parsed-derivations.cc          |   2 +-
 9 files changed, 148 insertions(+), 95 deletions(-)

diff --git a/src/build-remote/build-remote.cc b/src/build-remote/build-remote.cc
index 8c9133c17..ff8ba2724 100644
--- a/src/build-remote/build-remote.cc
+++ b/src/build-remote/build-remote.cc
@@ -300,7 +300,7 @@ connected:
 
         std::set<Realisation> missingRealisations;
         StorePathSet missingPaths;
-        if (settings.isExperimentalFeatureEnabled(Xp::CaDerivations) && !derivationHasKnownOutputPaths(drv.type())) {
+        if (settings.isExperimentalFeatureEnabled(Xp::CaDerivations) && !drv.type().hasKnownOutputPaths()) {
             for (auto & outputName : wantedOutputs) {
                 auto thisOutputHash = outputHashes.at(outputName);
                 auto thisOutputId = DrvOutput{ thisOutputHash, outputName };
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 2dc33103d..bfa18f898 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1235,11 +1235,8 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
 
     /* Optimisation, but required in read-only mode! because in that
        case we don't actually write store derivations, so we can't
-       read them later.
-
-       However, we don't bother doing this for floating CA derivations because
-       their "hash modulo" is indeterminate until built. */
-    if (drv.type() != DerivationType::CAFloating) {
+       read them later. */
+    {
         auto h = hashDerivationModulo(*state.store, drv, false);
         drvHashes.lock()->insert_or_assign(drvPath, h);
     }
diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index afed9bf16..40c445836 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -204,7 +204,7 @@ void DerivationGoal::haveDerivation()
 {
     trace("have derivation");
 
-    if (drv->type() == DerivationType::CAFloating)
+    if (!drv->type().hasKnownOutputPaths())
         settings.requireExperimentalFeature(Xp::CaDerivations);
 
     retrySubstitution = false;
@@ -440,9 +440,28 @@ void DerivationGoal::inputsRealised()
     if (useDerivation) {
         auto & fullDrv = *dynamic_cast<Derivation *>(drv.get());
 
-        if (settings.isExperimentalFeatureEnabled(Xp::CaDerivations) &&
-            ((!fullDrv.inputDrvs.empty() && derivationIsCA(fullDrv.type()))
-            || fullDrv.type() == DerivationType::DeferredInputAddressed)) {
+        auto drvType = fullDrv.type();
+        bool resolveDrv = std::visit(overloaded {
+            [&](const DerivationType::InputAddressed & ia) {
+                /* must resolve if deferred. */
+                return ia.deferred;
+            },
+            [&](const DerivationType::ContentAddressed & ca) {
+                return !fullDrv.inputDrvs.empty() && (
+                    ca.fixed
+                    /* Can optionally resolve if fixed, which is good
+                       for avoiding unnecessary rebuilds. */
+                    ? settings.isExperimentalFeatureEnabled(Xp::CaDerivations)
+                    /* Must resolve if floating and there are any inputs
+                       drvs. */
+                    : true);
+            },
+        }, drvType.raw());
+
+        if (resolveDrv)
+        {
+            settings.requireExperimentalFeature(Xp::CaDerivations);
+
             /* We are be able to resolve this derivation based on the
                now-known results of dependencies. If so, we become a stub goal
                aliasing that resolved derivation goal */
@@ -501,7 +520,7 @@ void DerivationGoal::inputsRealised()
 
     /* Don't repeat fixed-output derivations since they're already
        verified by their output hash.*/
-    nrRounds = derivationIsFixed(derivationType) ? 1 : settings.buildRepeat + 1;
+    nrRounds = derivationType.isFixed() ? 1 : settings.buildRepeat + 1;
 
     /* Okay, try to build.  Note that here we don't wait for a build
        slot to become available, since we don't need one if there is a
@@ -908,7 +927,7 @@ void DerivationGoal::buildDone()
             st =
                 dynamic_cast<NotDeterministic*>(&e) ? BuildResult::NotDeterministic :
                 statusOk(status) ? BuildResult::OutputRejected :
-                derivationIsImpure(derivationType) || diskFull ? BuildResult::TransientFailure :
+                derivationType.isImpure() || diskFull ? BuildResult::TransientFailure :
                 BuildResult::PermanentFailure;
         }
 
@@ -1221,7 +1240,7 @@ void DerivationGoal::flushLine()
 
 std::map<std::string, std::optional<StorePath>> DerivationGoal::queryPartialDerivationOutputMap()
 {
-    if (!useDerivation || drv->type() != DerivationType::CAFloating) {
+    if (!useDerivation || drv->type().hasKnownOutputPaths()) {
         std::map<std::string, std::optional<StorePath>> res;
         for (auto & [name, output] : drv->outputs)
             res.insert_or_assign(name, output.path(worker.store, drv->name, name));
@@ -1233,7 +1252,7 @@ std::map<std::string, std::optional<StorePath>> DerivationGoal::queryPartialDeri
 
 OutputPathMap DerivationGoal::queryDerivationOutputMap()
 {
-    if (!useDerivation || drv->type() != DerivationType::CAFloating) {
+    if (!useDerivation || drv->type().hasKnownOutputPaths()) {
         OutputPathMap res;
         for (auto & [name, output] : drv->outputsAndOptPaths(worker.store))
             res.insert_or_assign(name, *output.second);
diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index 8a301d4ac..75e7e6ca3 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -395,7 +395,7 @@ void LocalDerivationGoal::startBuilder()
         else if (settings.sandboxMode == smDisabled)
             useChroot = false;
         else if (settings.sandboxMode == smRelaxed)
-            useChroot = !(derivationIsImpure(derivationType)) && !noChroot;
+            useChroot = !(derivationType.isImpure()) && !noChroot;
     }
 
     auto & localStore = getLocalStore();
@@ -608,7 +608,7 @@ void LocalDerivationGoal::startBuilder()
                 "nogroup:x:65534:\n", sandboxGid()));
 
         /* Create /etc/hosts with localhost entry. */
-        if (!(derivationIsImpure(derivationType)))
+        if (!(derivationType.isImpure()))
             writeFile(chrootRootDir + "/etc/hosts", "127.0.0.1 localhost\n::1 localhost\n");
 
         /* Make the closure of the inputs available in the chroot,
@@ -796,7 +796,7 @@ void LocalDerivationGoal::startBuilder()
            us.
         */
 
-        if (!(derivationIsImpure(derivationType)))
+        if (!(derivationType.isImpure()))
             privateNetwork = true;
 
         userNamespaceSync.create();
@@ -1049,7 +1049,7 @@ void LocalDerivationGoal::initEnv()
        derivation, tell the builder, so that for instance `fetchurl'
        can skip checking the output.  On older Nixes, this environment
        variable won't be set, so `fetchurl' will do the check. */
-    if (derivationIsFixed(derivationType)) env["NIX_OUTPUT_CHECKED"] = "1";
+    if (derivationType.isFixed()) env["NIX_OUTPUT_CHECKED"] = "1";
 
     /* *Only* if this is a fixed-output derivation, propagate the
        values of the environment variables specified in the
@@ -1060,7 +1060,7 @@ void LocalDerivationGoal::initEnv()
        to the builder is generally impure, but the output of
        fixed-output derivations is by definition pure (since we
        already know the cryptographic hash of the output). */
-    if (derivationIsImpure(derivationType)) {
+    if (derivationType.isImpure()) {
         for (auto & i : parsedDrv->getStringsAttr("impureEnvVars").value_or(Strings()))
             env[i] = getEnv(i).value_or("");
     }
@@ -1674,7 +1674,7 @@ void LocalDerivationGoal::runChild()
             /* Fixed-output derivations typically need to access the
                network, so give them access to /etc/resolv.conf and so
                on. */
-            if (derivationIsImpure(derivationType)) {
+            if (derivationType.isImpure()) {
                 // Only use nss functions to resolve hosts and
                 // services. Don’t use it for anything else that may
                 // be configured for this system. This limits the
@@ -1918,7 +1918,7 @@ void LocalDerivationGoal::runChild()
 
                 sandboxProfile += "(import \"sandbox-defaults.sb\")\n";
 
-                if (derivationIsImpure(derivationType))
+                if (derivationType.isImpure())
                     sandboxProfile += "(import \"sandbox-network.sb\")\n";
 
                 /* Add the output paths we'll use at build-time to the chroot */
diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index 9f21ecf36..de69b50ee 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -560,6 +560,8 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         BuildMode buildMode = (BuildMode) readInt(from);
         logger->startWork();
 
+        auto drvType = drv.type();
+
         /* Content-addressed derivations are trustless because their output paths
            are verified by their content alone, so any derivation is free to
            try to produce such a path.
@@ -592,12 +594,12 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
            derivations, we throw out the precomputed output paths and just
            store the hashes, so there aren't two competing sources of truth an
            attacker could exploit. */
-        if (drv.type() == DerivationType::InputAddressed && !trusted)
+        if (!(drvType.isCA() || trusted))
             throw Error("you are not privileged to build input-addressed derivations");
 
         /* Make sure that the non-input-addressed derivations that got this far
            are in fact content-addressed if we don't trust them. */
-        assert(derivationIsCA(drv.type()) || trusted);
+        assert(drvType.isCA() || trusted);
 
         /* Recompute the derivation path when we cannot trust the original. */
         if (!trusted) {
@@ -606,7 +608,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
                original not-necessarily-resolved derivation to verify the drv
                derivation as adequate claim to the input-addressed output
                paths. */
-            assert(derivationIsCA(drv.type()));
+            assert(drvType.isCA());
 
             Derivation drv2;
             static_cast<BasicDerivation &>(drv2) = drv;
diff --git a/src/libstore/derivations.cc b/src/libstore/derivations.cc
index 3dd3a78d8..7fed80387 100644
--- a/src/libstore/derivations.cc
+++ b/src/libstore/derivations.cc
@@ -36,47 +36,46 @@ StorePath DerivationOutput::CAFixed::path(const Store & store, std::string_view
 }
 
 
-bool derivationIsCA(DerivationType dt) {
-    switch (dt) {
-    case DerivationType::InputAddressed: return false;
-    case DerivationType::CAFixed: return true;
-    case DerivationType::CAFloating: return true;
-    case DerivationType::DeferredInputAddressed: return false;
-    };
-    // Since enums can have non-variant values, but making a `default:` would
-    // disable exhaustiveness warnings.
-    assert(false);
+bool DerivationType::isCA() const {
+    /* Normally we do the full `std::visit` to make sure we have
+       exhaustively handled all variants, but so long as there is a
+       variant called `ContentAddressed`, it must be the only one for
+       which `isCA` is true for this to make sense!. */
+    return std::holds_alternative<ContentAddressed>(raw());
 }
 
-bool derivationIsFixed(DerivationType dt) {
-    switch (dt) {
-    case DerivationType::InputAddressed: return false;
-    case DerivationType::CAFixed: return true;
-    case DerivationType::CAFloating: return false;
-    case DerivationType::DeferredInputAddressed: return false;
-    };
-    assert(false);
+bool DerivationType::isFixed() const {
+    return std::visit(overloaded {
+        [](const InputAddressed & ia) {
+            return false;
+        },
+        [](const ContentAddressed & ca) {
+            return ca.fixed;
+        },
+    }, raw());
 }
 
-bool derivationHasKnownOutputPaths(DerivationType dt) {
-    switch (dt) {
-    case DerivationType::InputAddressed: return true;
-    case DerivationType::CAFixed: return true;
-    case DerivationType::CAFloating: return false;
-    case DerivationType::DeferredInputAddressed: return false;
-    };
-    assert(false);
+bool DerivationType::hasKnownOutputPaths() const {
+    return std::visit(overloaded {
+        [](const InputAddressed & ia) {
+            return !ia.deferred;
+        },
+        [](const ContentAddressed & ca) {
+            return ca.fixed;
+        },
+    }, raw());
 }
 
 
-bool derivationIsImpure(DerivationType dt) {
-    switch (dt) {
-    case DerivationType::InputAddressed: return false;
-    case DerivationType::CAFixed: return true;
-    case DerivationType::CAFloating: return false;
-    case DerivationType::DeferredInputAddressed: return false;
-    };
-    assert(false);
+bool DerivationType::isImpure() const {
+    return std::visit(overloaded {
+        [](const InputAddressed & ia) {
+            return false;
+        },
+        [](const ContentAddressed & ca) {
+            return !ca.pure;
+        },
+    }, raw());
 }
 
 
@@ -439,18 +438,28 @@ DerivationType BasicDerivation::type() const
     if (inputAddressedOutputs.empty() && fixedCAOutputs.empty() && floatingCAOutputs.empty() && deferredIAOutputs.empty()) {
         throw Error("Must have at least one output");
     } else if (! inputAddressedOutputs.empty() && fixedCAOutputs.empty() && floatingCAOutputs.empty() && deferredIAOutputs.empty()) {
-        return DerivationType::InputAddressed;
+        return DerivationType::InputAddressed {
+            .deferred = false,
+        };
     } else if (inputAddressedOutputs.empty() && ! fixedCAOutputs.empty() && floatingCAOutputs.empty() && deferredIAOutputs.empty()) {
         if (fixedCAOutputs.size() > 1)
             // FIXME: Experimental feature?
             throw Error("Only one fixed output is allowed for now");
         if (*fixedCAOutputs.begin() != "out")
             throw Error("Single fixed output must be named \"out\"");
-        return DerivationType::CAFixed;
+        return DerivationType::ContentAddressed {
+            .pure = false,
+            .fixed = true,
+        };
     } else if (inputAddressedOutputs.empty() && fixedCAOutputs.empty() && ! floatingCAOutputs.empty() && deferredIAOutputs.empty()) {
-        return DerivationType::CAFloating;
+        return DerivationType::ContentAddressed {
+            .pure = true,
+            .fixed = false,
+        };
     } else if (inputAddressedOutputs.empty() && fixedCAOutputs.empty() && floatingCAOutputs.empty() && !deferredIAOutputs.empty()) {
-        return DerivationType::DeferredInputAddressed;
+        return DerivationType::InputAddressed {
+            .deferred = true,
+        };
     } else {
         throw Error("Can't mix derivation output types");
     }
@@ -502,10 +511,10 @@ static const DrvHashModulo pathDerivationModulo(Store & store, const StorePath &
  */
 DrvHashModulo hashDerivationModulo(Store & store, const Derivation & drv, bool maskOutputs)
 {
-    auto kind = DrvHash::Kind::Regular;
+    auto type = drv.type();
+
     /* Return a fixed hash for fixed-output derivations. */
-    switch (drv.type()) {
-    case DerivationType::CAFixed: {
+    if (type.isFixed()) {
         std::map<std::string, Hash> outputHashes;
         for (const auto & i : drv.outputs) {
             auto & dof = std::get<DerivationOutput::CAFixed>(i.second.raw());
@@ -517,14 +526,19 @@ DrvHashModulo hashDerivationModulo(Store & store, const Derivation & drv, bool m
         }
         return outputHashes;
     }
-    case DerivationType::CAFloating:
-        kind = DrvHash::Kind::Deferred;
-        break;
-    case DerivationType::InputAddressed:
-        break;
-    case DerivationType::DeferredInputAddressed:
-        break;
-    }
+
+    auto kind = std::visit(overloaded {
+        [](const DerivationType::InputAddressed & ia) {
+            /* This might be a "pesimistically" deferred output, so we don't
+               "taint" the kind yet. */
+            return DrvHash::Kind::Regular;
+        },
+        [](const DerivationType::ContentAddressed & ca) {
+            return ca.fixed
+                ? DrvHash::Kind::Regular
+                : DrvHash::Kind::Deferred;
+        },
+    }, drv.type().raw());
 
     /* For other derivations, replace the inputs paths with recursive
        calls to this function. */
diff --git a/src/libstore/derivations.hh b/src/libstore/derivations.hh
index 6b92b2f21..8dea90abf 100644
--- a/src/libstore/derivations.hh
+++ b/src/libstore/derivations.hh
@@ -85,30 +85,50 @@ typedef std::map<std::string, std::pair<DerivationOutput, std::optional<StorePat
    output IDs we are interested in. */
 typedef std::map<StorePath, StringSet> DerivationInputs;
 
-enum struct DerivationType : uint8_t {
-    InputAddressed,
-    DeferredInputAddressed,
-    CAFixed,
-    CAFloating,
+struct DerivationType_InputAddressed {
+    bool deferred;
 };
 
-/* Do the outputs of the derivation have paths calculated from their content,
-   or from the derivation itself? */
-bool derivationIsCA(DerivationType);
+struct DerivationType_ContentAddressed {
+    bool pure;
+    bool fixed;
+};
 
-/* Is the content of the outputs fixed a-priori via a hash? Never true for
-   non-CA derivations. */
-bool derivationIsFixed(DerivationType);
+typedef std::variant<
+    DerivationType_InputAddressed,
+    DerivationType_ContentAddressed
+> _DerivationTypeRaw;
 
-/* Is the derivation impure and needs to access non-deterministic resources, or
-   pure and can be sandboxed? Note that whether or not we actually sandbox the
-   derivation is controlled separately. Never true for non-CA derivations. */
-bool derivationIsImpure(DerivationType);
+struct DerivationType : _DerivationTypeRaw {
+    using Raw = _DerivationTypeRaw;
+    using Raw::Raw;
+    using InputAddressed = DerivationType_InputAddressed;
+    using ContentAddressed = DerivationType_ContentAddressed;
 
-/* Does the derivation knows its own output paths?
- * Only true when there's no floating-ca derivation involved in the closure.
- */
-bool derivationHasKnownOutputPaths(DerivationType);
+
+    /* Do the outputs of the derivation have paths calculated from their content,
+       or from the derivation itself? */
+    bool isCA() const;
+
+    /* Is the content of the outputs fixed a-priori via a hash? Never true for
+       non-CA derivations. */
+    bool isFixed() const;
+
+    /* Is the derivation impure and needs to access non-deterministic resources, or
+       pure and can be sandboxed? Note that whether or not we actually sandbox the
+       derivation is controlled separately. Never true for non-CA derivations. */
+    bool isImpure() const;
+
+    /* Does the derivation knows its own output paths?
+       Only true when there's no floating-ca derivation involved in the
+       closure, or if fixed output.
+     */
+    bool hasKnownOutputPaths() const;
+
+    inline const Raw & raw() const {
+        return static_cast<const Raw &>(*this);
+    }
+};
 
 struct BasicDerivation
 {
@@ -189,11 +209,11 @@ typedef std::map<std::string, Hash> CaOutputHashes;
 struct DrvHash {
     Hash hash;
 
-    enum struct Kind {
+    enum struct Kind: bool {
         // Statically determined derivations.
         // This hash will be directly used to compute the output paths
         Regular,
-        // Floating-output derivations (and their dependencies).
+        // Floating-output derivations (and their reverse dependencies).
         Deferred,
     };
 
diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index 75726a1ab..46a547db1 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -718,6 +718,7 @@ void LocalStore::checkDerivationOutputs(const StorePath & drvPath, const Derivat
                 /* Nothing to check */
             },
             [&](const DerivationOutput::Deferred &) {
+                /* Nothing to check */
             },
         }, i.second.raw());
     }
diff --git a/src/libstore/parsed-derivations.cc b/src/libstore/parsed-derivations.cc
index 8c65053e4..f2288a04e 100644
--- a/src/libstore/parsed-derivations.cc
+++ b/src/libstore/parsed-derivations.cc
@@ -93,7 +93,7 @@ StringSet ParsedDerivation::getRequiredSystemFeatures() const
     StringSet res;
     for (auto & i : getStringsAttr("requiredSystemFeatures").value_or(Strings()))
         res.insert(i);
-    if (!derivationHasKnownOutputPaths(drv.type()))
+    if (!drv.type().hasKnownOutputPaths())
         res.insert("ca-derivations");
     return res;
 }

From d60f3cf6e9c904912199ea64156fea295494430a Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Thu, 17 Mar 2022 22:59:43 +0100
Subject: [PATCH 164/251] nix-daemon.conf.in: add tmpfiles file to create
 nix/daemon-socket directory

nix-daemon.socket is used to socket-activate nix-daemon.service when
/nix/var/nix/daemon-socket/socket is accessed.

In container usecases, sometimes /nix/var/nix/daemon-socket is
bind-mounted read-only into the container.

In these cases, we want to skip starting nix-daemon.socket.

However, since systemd 250, `ConditionPathIsReadWrite` is also not met
if /nix/var/nix/daemon-socket doesn't exist at all. This means, a
regular NixOS system will skip starting nix-daemon.socket:

> [  237.187747] systemd[1]: Nix Daemon Socket was skipped because of a failed condition check (ConditionPathIsReadWrite=/nix/var/nix/daemon-socket).

To prevent this from happening, ship a tmpfiles file that'll cause the
directory to be created if it doesn't exist already.

In the case of NixOS, we can just add Nix to `systemd.tmpfiles.packages`
and have these files picked up automatically.
---
 misc/systemd/local.mk           | 3 ++-
 misc/systemd/nix-daemon.conf.in | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)
 create mode 100644 misc/systemd/nix-daemon.conf.in

diff --git a/misc/systemd/local.mk b/misc/systemd/local.mk
index 1fa037485..76121a0f9 100644
--- a/misc/systemd/local.mk
+++ b/misc/systemd/local.mk
@@ -1,7 +1,8 @@
 ifdef HOST_LINUX
 
   $(foreach n, nix-daemon.socket nix-daemon.service, $(eval $(call install-file-in, $(d)/$(n), $(prefix)/lib/systemd/system, 0644)))
+  $(foreach n, nix-daemon.conf, $(eval $(call install-file-in, $(d)/$(n), $(prefix)/lib/tmpfiles.d, 0644)))
 
-  clean-files += $(d)/nix-daemon.socket $(d)/nix-daemon.service
+  clean-files += $(d)/nix-daemon.socket $(d)/nix-daemon.service $(d)/nix-daemon.conf
 
 endif
diff --git a/misc/systemd/nix-daemon.conf.in b/misc/systemd/nix-daemon.conf.in
new file mode 100644
index 000000000..e7b264234
--- /dev/null
+++ b/misc/systemd/nix-daemon.conf.in
@@ -0,0 +1 @@
+d @localstatedir@/nix/daemon-socket 0755 root root - -

From 4d6a3806d24b54f06ddc0cf234ac993db028cf29 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Sat, 12 Mar 2022 00:28:00 +0000
Subject: [PATCH 165/251] Decode string context straight to using `StorePath`s

I gather decoding happens on demand, so I hope don't think this should
have any perf implications one way or the other.
---
 src/libexpr/eval-cache.cc      | 19 +++++++++++--------
 src/libexpr/eval.cc            | 19 ++++++++++++++-----
 src/libexpr/eval.hh            |  4 ++--
 src/libexpr/primops.cc         |  8 ++++----
 src/libexpr/primops/context.cc |  4 ++--
 src/libexpr/value.hh           |  6 ++++--
 src/nix/app.cc                 |  2 +-
 7 files changed, 38 insertions(+), 24 deletions(-)

diff --git a/src/libexpr/eval-cache.cc b/src/libexpr/eval-cache.cc
index 7e5b5c9c4..54fa9b741 100644
--- a/src/libexpr/eval-cache.cc
+++ b/src/libexpr/eval-cache.cc
@@ -21,6 +21,8 @@ struct AttrDb
 {
     std::atomic_bool failed{false};
 
+    const Store & cfg;
+
     struct State
     {
         SQLite db;
@@ -33,8 +35,9 @@ struct AttrDb
 
     std::unique_ptr<Sync<State>> _state;
 
-    AttrDb(const Hash & fingerprint)
-        : _state(std::make_unique<Sync<State>>())
+    AttrDb(const Store & cfg, const Hash & fingerprint)
+        : cfg(cfg)
+        , _state(std::make_unique<Sync<State>>())
     {
         auto state(_state->lock());
 
@@ -257,7 +260,7 @@ struct AttrDb
                 NixStringContext context;
                 if (!queryAttribute.isNull(3))
                     for (auto & s : tokenizeString<std::vector<std::string>>(queryAttribute.getStr(3), ";"))
-                        context.push_back(decodeContext(s));
+                        context.push_back(decodeContext(cfg, s));
                 return {{rowId, string_t{queryAttribute.getStr(2), context}}};
             }
             case AttrType::Bool:
@@ -274,10 +277,10 @@ struct AttrDb
     }
 };
 
-static std::shared_ptr<AttrDb> makeAttrDb(const Hash & fingerprint)
+static std::shared_ptr<AttrDb> makeAttrDb(const Store & cfg, const Hash & fingerprint)
 {
     try {
-        return std::make_shared<AttrDb>(fingerprint);
+        return std::make_shared<AttrDb>(cfg, fingerprint);
     } catch (SQLiteError &) {
         ignoreException();
         return nullptr;
@@ -288,7 +291,7 @@ EvalCache::EvalCache(
     std::optional<std::reference_wrapper<const Hash>> useCache,
     EvalState & state,
     RootLoader rootLoader)
-    : db(useCache ? makeAttrDb(*useCache) : nullptr)
+    : db(useCache ? makeAttrDb(*state.store, *useCache) : nullptr)
     , state(state)
     , rootLoader(rootLoader)
 {
@@ -546,7 +549,7 @@ string_t AttrCursor::getStringWithContext()
             if (auto s = std::get_if<string_t>(&cachedValue->second)) {
                 bool valid = true;
                 for (auto & c : s->second) {
-                    if (!root->state.store->isValidPath(root->state.store->parseStorePath(c.first))) {
+                    if (!root->state.store->isValidPath(c.first)) {
                         valid = false;
                         break;
                     }
@@ -563,7 +566,7 @@ string_t AttrCursor::getStringWithContext()
     auto & v = forceValue();
 
     if (v.type() == nString)
-        return {v.string.s, v.getContext()};
+        return {v.string.s, v.getContext(*root->state.store)};
     else if (v.type() == nPath)
         return {v.path, {}};
     else
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 126e0af8c..f7911e32b 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -1903,13 +1903,22 @@ std::string_view EvalState::forceString(Value & v, const Pos & pos)
 
 /* Decode a context string ‘!<name>!<path>’ into a pair <path,
    name>. */
-NixStringContextElem decodeContext(std::string_view s)
+NixStringContextElem decodeContext(const Store & store, std::string_view s)
 {
     if (s.at(0) == '!') {
         size_t index = s.find("!", 1);
-        return {std::string(s.substr(index + 1)), std::string(s.substr(1, index - 1))};
+        return {
+            store.parseStorePath(s.substr(index + 1)),
+            std::string(s.substr(1, index - 1)),
+        };
     } else
-        return {s.at(0) == '/' ? std::string(s) : std::string(s.substr(1)), ""};
+        return {
+            store.parseStorePath(
+                s.at(0) == '/'
+                ? s
+                : s.substr(1)),
+            "",
+        };
 }
 
 
@@ -1921,13 +1930,13 @@ void copyContext(const Value & v, PathSet & context)
 }
 
 
-NixStringContext Value::getContext()
+NixStringContext Value::getContext(const Store & store)
 {
     NixStringContext res;
     assert(internalType == tString);
     if (string.context)
         for (const char * * p = string.context; *p; ++p)
-            res.push_back(decodeContext(*p));
+            res.push_back(decodeContext(store, *p));
     return res;
 }
 
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index 18480f290..198a62ad2 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -17,7 +17,7 @@
 namespace nix {
 
 
-class Store;
+struct Store;
 class EvalState;
 class StorePath;
 enum RepairFlag : bool;
@@ -430,7 +430,7 @@ std::string showType(const Value & v);
 
 /* Decode a context string ‘!<name>!<path>’ into a pair <path,
    name>. */
-NixStringContextElem decodeContext(std::string_view s);
+NixStringContextElem decodeContext(const Store & store, std::string_view s);
 
 /* If `path' refers to a directory, then append "/default.nix". */
 Path resolveExprPath(Path path);
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 3124025aa..566cbdfdb 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -43,8 +43,8 @@ StringMap EvalState::realiseContext(const PathSet & context)
     StringMap res;
 
     for (auto & i : context) {
-        auto [ctxS, outputName] = decodeContext(i);
-        auto ctx = store->parseStorePath(ctxS);
+        auto [ctx, outputName] = decodeContext(*store, i);
+        auto ctxS = store->printStorePath(ctx);
         if (!store->isValidPath(ctx))
             throw InvalidPathError(store->printStorePath(ctx));
         if (!outputName.empty() && ctx.isDerivation()) {
@@ -1118,8 +1118,8 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
 
         /* Handle derivation outputs of the form ‘!<name>!<path>’. */
         else if (path.at(0) == '!') {
-            auto ctx = decodeContext(path);
-            drv.inputDrvs[state.store->parseStorePath(ctx.first)].insert(ctx.second);
+            auto ctx = decodeContext(*state.store, path);
+            drv.inputDrvs[ctx.first].insert(ctx.second);
         }
 
         /* Otherwise it's a source file. */
diff --git a/src/libexpr/primops/context.cc b/src/libexpr/primops/context.cc
index ad4de3840..6ec5e4a74 100644
--- a/src/libexpr/primops/context.cc
+++ b/src/libexpr/primops/context.cc
@@ -82,8 +82,8 @@ static void prim_getContext(EvalState & state, const Pos & pos, Value * * args,
             drv = std::string(p, 1);
             path = &drv;
         } else if (p.at(0) == '!') {
-            NixStringContextElem ctx = decodeContext(p);
-            drv = ctx.first;
+            NixStringContextElem ctx = decodeContext(*state.store, p);
+            drv = state.store->printStorePath(ctx.first);
             output = ctx.second;
             path = &drv;
         }
diff --git a/src/libexpr/value.hh b/src/libexpr/value.hh
index ee9cb832a..d413060f9 100644
--- a/src/libexpr/value.hh
+++ b/src/libexpr/value.hh
@@ -57,6 +57,8 @@ struct ExprLambda;
 struct PrimOp;
 class Symbol;
 struct Pos;
+class StorePath;
+class Store;
 class EvalState;
 class XMLWriter;
 class JSONPlaceholder;
@@ -64,7 +66,7 @@ class JSONPlaceholder;
 
 typedef int64_t NixInt;
 typedef double NixFloat;
-typedef std::pair<Path, std::string> NixStringContextElem;
+typedef std::pair<StorePath, std::string> NixStringContextElem;
 typedef std::vector<NixStringContextElem> NixStringContext;
 
 /* External values must descend from ExternalValueBase, so that
@@ -370,7 +372,7 @@ public:
        non-trivial. */
     bool isTrivial() const;
 
-    NixStringContext getContext();
+    NixStringContext getContext(const Store &);
 
     auto listItems()
     {
diff --git a/src/nix/app.cc b/src/nix/app.cc
index 2563180fb..a4e0df06a 100644
--- a/src/nix/app.cc
+++ b/src/nix/app.cc
@@ -70,7 +70,7 @@ UnresolvedApp Installable::toApp(EvalState & state)
 
         std::vector<StorePathWithOutputs> context2;
         for (auto & [path, name] : context)
-            context2.push_back({state.store->parseStorePath(path), {name}});
+            context2.push_back({path, {name}});
 
         return UnresolvedApp{App {
             .context = std::move(context2),

From 345a8ee0cb56775c57c3b7da99b0726290241e18 Mon Sep 17 00:00:00 2001
From: Gabriel Fontes <eu@misterio.me>
Date: Sat, 19 Mar 2022 10:56:13 -0300
Subject: [PATCH 166/251] Fix sourcehut tag ref resolving

---
 src/libfetchers/github.cc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/libfetchers/github.cc b/src/libfetchers/github.cc
index a1430f087..d52ea649d 100644
--- a/src/libfetchers/github.cc
+++ b/src/libfetchers/github.cc
@@ -390,7 +390,7 @@ struct SourceHutInputScheme : GitArchiveInputScheme
 
             ref_uri = line.substr(ref_index+5, line.length()-1);
         } else
-            ref_uri = fmt("refs/heads/%s", ref);
+            ref_uri = fmt("refs/(heads|tags)/%s", ref);
 
         auto file = store->toRealPath(
             downloadFile(store, fmt("%s/info/refs", base_url), "source", false, headers).storePath);
@@ -399,9 +399,9 @@ struct SourceHutInputScheme : GitArchiveInputScheme
         std::string line;
         std::string id;
         while(getline(is, line)) {
-            auto index = line.find(ref_uri);
-            if (index != std::string::npos) {
-                id = line.substr(0, index-1);
+            std::regex pattern(ref_uri);
+            if (std::regex_search(line, pattern)) {
+                id = line.substr(0, line.find('\t'));
                 break;
             }
         }

From 9720797f695f7646744e9cd020fa79679441814f Mon Sep 17 00:00:00 2001
From: Gabriel Fontes <eu@misterio.me>
Date: Sat, 19 Mar 2022 11:04:04 -0300
Subject: [PATCH 167/251] Don't partial match sourcehut refs

---
 src/libfetchers/github.cc | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/libfetchers/github.cc b/src/libfetchers/github.cc
index d52ea649d..58b6e7c04 100644
--- a/src/libfetchers/github.cc
+++ b/src/libfetchers/github.cc
@@ -399,7 +399,9 @@ struct SourceHutInputScheme : GitArchiveInputScheme
         std::string line;
         std::string id;
         while(getline(is, line)) {
-            std::regex pattern(ref_uri);
+            // Append $ to avoid partial name matches
+            std::regex pattern(fmt("%s$", ref_uri));
+
             if (std::regex_search(line, pattern)) {
                 id = line.substr(0, line.find('\t'));
                 break;

From 31544b93ffa985661541309ec2360dfb7b527a80 Mon Sep 17 00:00:00 2001
From: Gabriel Fontes <eu@misterio.me>
Date: Sat, 19 Mar 2022 11:38:45 -0300
Subject: [PATCH 168/251] Fix sourcehut integration test

The new implementation relies on tab separting the hash and ref (this is how sourcehut does it). This fixes the integration test to use a tab instead of a space.
---
 tests/sourcehut-flakes.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/sourcehut-flakes.nix b/tests/sourcehut-flakes.nix
index d1d89d149..6a1930904 100644
--- a/tests/sourcehut-flakes.nix
+++ b/tests/sourcehut-flakes.nix
@@ -59,7 +59,7 @@ let
       echo 'ref: refs/heads/master' > $out/HEAD
 
       mkdir -p $out/info
-      echo '${nixpkgs.rev} refs/heads/master' > $out/info/refs
+      echo -e '${nixpkgs.rev}\trefs/heads/master' > $out/info/refs
     '';
 
 in

From 0b42afe02794a446d20066c0e9931b9c759d36e2 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 22 Mar 2022 10:48:02 +0100
Subject: [PATCH 169/251] buildProfile(): Ignore manifest.{nix,json}

If a package installs a file named manifest.json, it caused nix-env to
consider the profile a new-style profile created by 'nix
profile'. Fixes #6032.
---
 src/libstore/builtins/buildenv.cc | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/libstore/builtins/buildenv.cc b/src/libstore/builtins/buildenv.cc
index 25d015cb9..6f6ad57cb 100644
--- a/src/libstore/builtins/buildenv.cc
+++ b/src/libstore/builtins/buildenv.cc
@@ -47,9 +47,9 @@ static void createLinks(State & state, const Path & srcDir, const Path & dstDir,
             throw;
         }
 
-        /* The files below are special-cased to that they don't show up
-         * in user profiles, either because they are useless, or
-         * because they would cauase pointless collisions (e.g., each
+        /* The files below are special-cased to that they don't show
+         * up in user profiles, either because they are useless, or
+         * because they would cause pointless collisions (e.g., each
          * Python package brings its own
          * `$out/lib/pythonX.Y/site-packages/easy-install.pth'.)
          */
@@ -57,7 +57,9 @@ static void createLinks(State & state, const Path & srcDir, const Path & dstDir,
             hasSuffix(srcFile, "/nix-support") ||
             hasSuffix(srcFile, "/perllocal.pod") ||
             hasSuffix(srcFile, "/info/dir") ||
-            hasSuffix(srcFile, "/log"))
+            hasSuffix(srcFile, "/log") ||
+            hasSuffix(srcFile, "/manifest.nix") ||
+            hasSuffix(srcFile, "/manifest.json"))
             continue;
 
         else if (S_ISDIR(srcSt.st_mode)) {

From 732296ddc078f9cce8ffeb3131fef8898330b6ae Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 22 Mar 2022 13:00:27 +0100
Subject: [PATCH 170/251] =?UTF-8?q?printValue():=20<REPEAT>=20->=20=C2=ABr?=
 =?UTF-8?q?epeated=C2=BB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This ensures that it doesn't get parsed as a valid Nix expression.
---
 src/libexpr/eval.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index f7911e32b..333ad68eb 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -126,7 +126,7 @@ void printValue(std::ostream & str, std::set<const void *> & seen, const Value &
         break;
     case tAttrs: {
         if (!v.attrs->empty() && !seen.insert(v.attrs).second)
-            str << "<REPEAT>";
+            str << "«repeated»";
         else {
             str << "{ ";
             for (auto & i : v.attrs->lexicographicOrder()) {
@@ -142,7 +142,7 @@ void printValue(std::ostream & str, std::set<const void *> & seen, const Value &
     case tList2:
     case tListN:
         if (v.listSize() && !seen.insert(v.listElems()).second)
-            str << "<REPEAT>";
+            str << "«repeated»";
         else {
             str << "[ ";
             for (auto v2 : v.listItems()) {

From a0259a21a416301573d9d6b994d6b5fb62a1bcf3 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 22 Mar 2022 13:18:11 +0100
Subject: [PATCH 171/251] Don't hide repeated values while generating
 manifest.nix

Fixes #6243.
---
 src/libexpr/eval.cc     | 38 ++++++++++++++++++++++----------------
 src/libexpr/value.hh    |  5 ++++-
 src/nix-env/user-env.cc |  4 +++-
 tests/user-envs.nix     |  3 +++
 4 files changed, 32 insertions(+), 18 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 333ad68eb..3ec5ed202 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -96,20 +96,20 @@ RootValue allocRootValue(Value * v)
 }
 
 
-void printValue(std::ostream & str, std::set<const void *> & seen, const Value & v)
+void Value::print(std::ostream & str, std::set<const void *> * seen) const
 {
     checkInterrupt();
 
-    switch (v.internalType) {
+    switch (internalType) {
     case tInt:
-        str << v.integer;
+        str << integer;
         break;
     case tBool:
-        str << (v.boolean ? "true" : "false");
+        str << (boolean ? "true" : "false");
         break;
     case tString:
         str << "\"";
-        for (const char * i = v.string.s; *i; i++)
+        for (const char * i = string.s; *i; i++)
             if (*i == '\"' || *i == '\\') str << "\\" << *i;
             else if (*i == '\n') str << "\\n";
             else if (*i == '\r') str << "\\r";
@@ -119,19 +119,19 @@ void printValue(std::ostream & str, std::set<const void *> & seen, const Value &
         str << "\"";
         break;
     case tPath:
-        str << v.path; // !!! escaping?
+        str << path; // !!! escaping?
         break;
     case tNull:
         str << "null";
         break;
     case tAttrs: {
-        if (!v.attrs->empty() && !seen.insert(v.attrs).second)
+        if (seen && !attrs->empty() && !seen->insert(attrs).second)
             str << "«repeated»";
         else {
             str << "{ ";
-            for (auto & i : v.attrs->lexicographicOrder()) {
+            for (auto & i : attrs->lexicographicOrder()) {
                 str << i->name << " = ";
-                printValue(str, seen, *i->value);
+                i->value->print(str, seen);
                 str << "; ";
             }
             str << "}";
@@ -141,12 +141,12 @@ void printValue(std::ostream & str, std::set<const void *> & seen, const Value &
     case tList1:
     case tList2:
     case tListN:
-        if (v.listSize() && !seen.insert(v.listElems()).second)
+        if (seen && listSize() && !seen->insert(listElems()).second)
             str << "«repeated»";
         else {
             str << "[ ";
-            for (auto v2 : v.listItems()) {
-                printValue(str, seen, *v2);
+            for (auto v2 : listItems()) {
+                v2->print(str, seen);
                 str << " ";
             }
             str << "]";
@@ -166,10 +166,10 @@ void printValue(std::ostream & str, std::set<const void *> & seen, const Value &
         str << "<PRIMOP-APP>";
         break;
     case tExternal:
-        str << *v.external;
+        str << *external;
         break;
     case tFloat:
-        str << v.fpoint;
+        str << fpoint;
         break;
     default:
         abort();
@@ -177,10 +177,16 @@ void printValue(std::ostream & str, std::set<const void *> & seen, const Value &
 }
 
 
-std::ostream & operator << (std::ostream & str, const Value & v)
+void Value::print(std::ostream & str, bool showRepeated) const
 {
     std::set<const void *> seen;
-    printValue(str, seen, v);
+    print(str, showRepeated ? nullptr : &seen);
+}
+
+
+std::ostream & operator << (std::ostream & str, const Value & v)
+{
+    v.print(str, false);
     return str;
 }
 
diff --git a/src/libexpr/value.hh b/src/libexpr/value.hh
index d413060f9..3d07c3198 100644
--- a/src/libexpr/value.hh
+++ b/src/libexpr/value.hh
@@ -119,10 +119,13 @@ private:
     InternalType internalType;
 
     friend std::string showType(const Value & v);
-    friend void printValue(std::ostream & str, std::set<const void *> & seen, const Value & v);
+
+    void print(std::ostream & str, std::set<const void *> * seen) const;
 
 public:
 
+    void print(std::ostream & str, bool showRepeated = false) const;
+
     // Functions needed to distinguish the type
     // These should be removed eventually, by putting the functionality that's
     // needed by callers into methods of this type
diff --git a/src/nix-env/user-env.cc b/src/nix-env/user-env.cc
index bcc7736ac..78692b9c6 100644
--- a/src/nix-env/user-env.cc
+++ b/src/nix-env/user-env.cc
@@ -105,8 +105,10 @@ bool createUserEnv(EvalState & state, DrvInfos & elems,
     /* Also write a copy of the list of user environment elements to
        the store; we need it for future modifications of the
        environment. */
+    std::ostringstream str;
+    manifest.print(str, true);
     auto manifestFile = state.store->addTextToStore("env-manifest.nix",
-        fmt("%s", manifest), references);
+        str.str(), references);
 
     /* Get the environment builder expression. */
     Value envBuilder;
diff --git a/tests/user-envs.nix b/tests/user-envs.nix
index 6ac896ed8..46f8b51dd 100644
--- a/tests/user-envs.nix
+++ b/tests/user-envs.nix
@@ -8,6 +8,8 @@ assert foo == "foo";
 
 let
 
+  platforms = let x = "foobar"; in [ x x ];
+
   makeDrv = name: progName: (mkDerivation {
     name = assert progName != "fail"; name;
     inherit progName system;
@@ -15,6 +17,7 @@ let
   } // {
     meta = {
       description = "A silly test package with some \${escaped anti-quotation} in it";
+      inherit platforms;
     };
   });
 

From 3b776cb0a7574bf11c20fe0a1d91ec1d21d8ebeb Mon Sep 17 00:00:00 2001
From: Hideaki Kawai <kayhide@gmail.com>
Date: Tue, 22 Mar 2022 23:18:02 +0900
Subject: [PATCH 172/251] nix edit: support kakoune

---
 src/libcmd/command.cc | 3 ++-
 src/nix/edit.md       | 6 +++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/libcmd/command.cc b/src/libcmd/command.cc
index dc8fa9e5a..a53b029b7 100644
--- a/src/libcmd/command.cc
+++ b/src/libcmd/command.cc
@@ -204,7 +204,8 @@ Strings editorFor(const Pos & pos)
     if (pos.line > 0 && (
         editor.find("emacs") != std::string::npos ||
         editor.find("nano") != std::string::npos ||
-        editor.find("vim") != std::string::npos))
+        editor.find("vim") != std::string::npos ||
+        editor.find("kak") != std::string::npos))
         args.push_back(fmt("+%d", pos.line));
     args.push_back(pos.file);
     return args;
diff --git a/src/nix/edit.md b/src/nix/edit.md
index 80563d06b..89bd09abf 100644
--- a/src/nix/edit.md
+++ b/src/nix/edit.md
@@ -24,8 +24,8 @@ this attribute to the location of the definition of the
 `meta.description`, `version` or `name` derivation attributes.
 
 The editor to invoke is specified by the `EDITOR` environment
-variable. It defaults to `cat`. If the editor is `emacs`, `nano` or
-`vim`, it is passed the line number of the derivation using the
-argument `+<lineno>`.
+variable. It defaults to `cat`. If the editor is `emacs`, `nano`,
+`vim` or `kak`, it is passed the line number of the derivation using
+the argument `+<lineno>`.
 
 )""

From 67af5f7eda1dade544cc15397a7d0d35d0913cb2 Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Tue, 22 Mar 2022 17:06:09 +0100
Subject: [PATCH 173/251] scripts/install-systemd-multi-user.sh: install
 /etc/tmpfiles.d/nix-daemon.conf, too

While `create_directories()` from install-multi-user.sh seems to already
create parts of the directory structure, it's marked as deprecated, and
it won't hurt also copying over the tmpfiles config and have it execute
once.
---
 scripts/install-systemd-multi-user.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/scripts/install-systemd-multi-user.sh b/scripts/install-systemd-multi-user.sh
index f4a2dfc5d..24884a023 100755
--- a/scripts/install-systemd-multi-user.sh
+++ b/scripts/install-systemd-multi-user.sh
@@ -9,6 +9,8 @@ readonly SERVICE_DEST=/etc/systemd/system/nix-daemon.service
 readonly SOCKET_SRC=/lib/systemd/system/nix-daemon.socket
 readonly SOCKET_DEST=/etc/systemd/system/nix-daemon.socket
 
+readonly TMPFILES_SRC=/lib/tmpfiles.d/nix-daemon.conf
+readonly TMPFILES_DEST=/etc/tmpfiles.d/nix-daemon.conf
 
 # Path for the systemd override unit file to contain the proxy settings
 readonly SERVICE_OVERRIDE=${SERVICE_DEST}.d/override.conf
@@ -83,6 +85,13 @@ EOF
 poly_configure_nix_daemon_service() {
     if [ -e /run/systemd/system ]; then
         task "Setting up the nix-daemon systemd service"
+
+        _sudo "to create the nix-daemon tmpfiles config" \
+              ln -sfn /nix/var/nix/profiles/default/$TMPFILES_SRC $TMPFILES_DEST
+
+        _sudo "to run systemd-tmpfiles once to pick that path up" \
+             sytemd-tmpfiles create --prefix=/nix/var/nix
+
         _sudo "to set up the nix-daemon service" \
               systemctl link "/nix/var/nix/profiles/default$SERVICE_SRC"
 

From 9174d884d750b7b49a571bd55275f0883c2dabda Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Thu, 24 Mar 2022 08:10:33 +0000
Subject: [PATCH 174/251] lexer: add error location to lexer errors

Before the change lexter errors did not report the location:

    $ nix build -f. mc
    error: path has a trailing slash
    (use '--show-trace' to show detailed location information)

Note that it's not clear what file generates the error.

After the change location is reported:

    $ src/nix/nix --extra-experimental-features nix-command build -f ~/nm mc
    error: path has a trailing slash

           at .../pkgs/development/libraries/glib/default.nix:54:18:

               53|   };
               54|   src = /tmp/foo/;
                 |                  ^
               55|
    (use '--show-trace' to show detailed location information)

Here we see both problematic file and the string itself.
---
 src/libexpr/lexer.l | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/src/libexpr/lexer.l b/src/libexpr/lexer.l
index e276b0467..d574121b0 100644
--- a/src/libexpr/lexer.l
+++ b/src/libexpr/lexer.l
@@ -28,6 +28,13 @@ using namespace nix;
 
 namespace nix {
 
+static inline Pos makeCurPos(const YYLTYPE & loc, ParseData * data)
+{
+    return Pos(data->origin, data->file, loc.first_line, loc.first_column);
+}
+
+#define CUR_POS makeCurPos(*yylloc, data)
+
 // backup to recover from yyless(0)
 YYLTYPE prev_yylloc;
 
@@ -37,7 +44,6 @@ static void initLoc(YYLTYPE * loc)
     loc->first_column = loc->last_column = 1;
 }
 
-
 static void adjustLoc(YYLTYPE * loc, const char * s, size_t len)
 {
     prev_yylloc = *loc;
@@ -147,14 +153,20 @@ or          { return OR_KW; }
               try {
                   yylval->n = boost::lexical_cast<int64_t>(yytext);
               } catch (const boost::bad_lexical_cast &) {
-                  throw ParseError("invalid integer '%1%'", yytext);
+                  throw ParseError({
+                      .msg = hintfmt("invalid integer '%1%'", yytext),
+                      .errPos = CUR_POS,
+                  });
               }
               return INT;
             }
 {FLOAT}     { errno = 0;
               yylval->nf = strtod(yytext, 0);
               if (errno != 0)
-                  throw ParseError("invalid float '%1%'", yytext);
+                  throw ParseError({
+                      .msg = hintfmt("invalid float '%1%'", yytext),
+                      .errPos = CUR_POS,
+                  });
               return FLOAT;
             }
 
@@ -280,7 +292,10 @@ or          { return OR_KW; }
 
 <INPATH_SLASH>{ANY} |
 <INPATH_SLASH><<EOF>> {
-  throw ParseError("path has a trailing slash");
+  throw ParseError({
+      .msg = hintfmt("path has a trailing slash"),
+      .errPos = CUR_POS,
+  });
 }
 
 {SPATH}     { yylval->path = {yytext, (size_t) yyleng}; return SPATH; }

From 4546a007a46fe12b77a49ae8753ab186d0b55fdd Mon Sep 17 00:00:00 2001
From: Rok Garbas <rok@garbas.si>
Date: Thu, 24 Mar 2022 12:28:38 +0100
Subject: [PATCH 175/251] Fix flake profile use of originalUrl vs. originalUri

Fixes #5872
---
 src/nix/profile.cc | 5 +++--
 src/nix/profile.md | 6 +++---
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index a8ff9c78a..da990ddc8 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -107,8 +107,9 @@ struct ProfileManifest
                     element.storePaths.insert(state.store->parseStorePath((std::string) p));
                 element.active = e["active"];
                 if (e.value("uri", "") != "") {
+                    auto originalUrl = e.value("originalUrl", e["originalUri"]);
                     element.source = ProfileElementSource{
-                        parseFlakeRef(e["originalUri"]),
+                        parseFlakeRef(originalUrl),
                         parseFlakeRef(e["uri"]),
                         e["attrPath"]
                     };
@@ -143,7 +144,7 @@ struct ProfileManifest
             obj["storePaths"] = paths;
             obj["active"] = element.active;
             if (element.source) {
-                obj["originalUri"] = element.source->originalRef.to_string();
+                obj["originalUrl"] = element.source->originalRef.to_string();
                 obj["uri"] = element.source->resolvedRef.to_string();
                 obj["attrPath"] = element.source->attrPath;
             }
diff --git a/src/nix/profile.md b/src/nix/profile.md
index 0a4ff2fa9..8dade051d 100644
--- a/src/nix/profile.md
+++ b/src/nix/profile.md
@@ -70,7 +70,7 @@ are installed in this version of the profile. It looks like this:
     {
       "active": true,
       "attrPath": "legacyPackages.x86_64-linux.zoom-us",
-      "originalUri": "flake:nixpkgs",
+      "originalUrl": "flake:nixpkgs",
       "storePaths": [
         "/nix/store/wbhg2ga8f3h87s9h5k0slxk0m81m4cxl-zoom-us-5.3.469451.0927"
       ],
@@ -84,11 +84,11 @@ are installed in this version of the profile. It looks like this:
 Each object in the array `elements` denotes an installed package and
 has the following fields:
 
-* `originalUri`: The [flake reference](./nix3-flake.md) specified by
+* `originalUrl`: The [flake reference](./nix3-flake.md) specified by
   the user at the time of installation (e.g. `nixpkgs`). This is also
   the flake reference that will be used by `nix profile upgrade`.
 
-* `uri`: The immutable flake reference to which `originalUri`
+* `uri`: The immutable flake reference to which `originalUrl`
   resolved.
 
 * `attrPath`: The flake output attribute that provided this

From bb0c4b9f25b6d064d91aedd71940f14b1b624291 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 24 Mar 2022 12:46:46 +0100
Subject: [PATCH 176/251] install-multi-user.sh: Preserve symlinks

We need to pass -P to ensure that symlinks are copied correctly. Fixes #6303.
---
 scripts/install-multi-user.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/install-multi-user.sh b/scripts/install-multi-user.sh
index 5f2c93b7f..69b6676ea 100644
--- a/scripts/install-multi-user.sh
+++ b/scripts/install-multi-user.sh
@@ -739,7 +739,7 @@ install_from_extracted_nix() {
         cd "$EXTRACTED_NIX_PATH"
 
         _sudo "to copy the basic Nix files to the new store at $NIX_ROOT/store" \
-              cp -RLp ./store/* "$NIX_ROOT/store/"
+              cp -RPp ./store/* "$NIX_ROOT/store/"
 
         _sudo "to make the new store non-writable at $NIX_ROOT/store" \
               chmod -R ugo-w "$NIX_ROOT/store/"

From 0736f3651d56d3e0c3b742fe0d90958c90e9c968 Mon Sep 17 00:00:00 2001
From: Tom Bereknyei <tomberek@gmail.com>
Date: Wed, 23 Mar 2022 22:54:43 -0400
Subject: [PATCH 177/251] docs: genericClosure

---
 src/libexpr/primops.cc | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index bfa18f898..e7e224b3a 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -694,7 +694,32 @@ static void prim_genericClosure(EvalState & state, const Pos & pos, Value * * ar
 
 static RegisterPrimOp primop_genericClosure(RegisterPrimOp::Info {
     .name = "__genericClosure",
+    .args = {"attrset"},
     .arity = 1,
+    .doc = R"(
+      Take an *attrset* with values named `startSet` and `operator` in order to
+      return a *list of attrsets* by starting with the `startSet`, recursively
+      applying the `operator` function to each element. The *attrsets* in the
+      `startSet` and produced by the `operator` must each contain value named
+      `key` which are comparable to each other. The result is produced by
+      repeatedly calling the operator for each element encountered with a
+      unique key, terminating when no new elements are produced. For example,
+
+      ```
+      builtins.genericClosure {
+        startSet = [ {key = 5;} ];
+        operator = item: [{
+          key = if (item.key / 2 ) * 2 == item.key
+               then item.key / 2
+               else 3 * item.key + 1;
+        }];
+      }
+      ```
+      evaluates to
+      ```
+      [ { key = 5; } { key = 16; } { key = 8; } { key = 4; } { key = 2; } { key = 1; } ]
+      ```
+      )",
     .fun = prim_genericClosure,
 });
 

From f4bafc412fac79ce07c89f8d3ab9bd1c32f7b9cd Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 21 Mar 2022 11:31:01 +0100
Subject: [PATCH 178/251] Add builtins.fetchClosure

This allows closures to be imported at evaluation time, without
requiring the user to configure substituters. E.g.

  builtins.fetchClosure {
    storePath = /nix/store/f89g6yi63m1ywfxj96whv5sxsm74w5ka-python3.9-sqlparse-0.4.2;
    from = "https://cache.ngi0.nixos.org";
  }
---
 src/libexpr/primops/fetchClosure.cc | 62 +++++++++++++++++++++++++++++
 src/libexpr/primops/fetchTree.cc    |  4 +-
 2 files changed, 64 insertions(+), 2 deletions(-)
 create mode 100644 src/libexpr/primops/fetchClosure.cc

diff --git a/src/libexpr/primops/fetchClosure.cc b/src/libexpr/primops/fetchClosure.cc
new file mode 100644
index 000000000..4bcc716db
--- /dev/null
+++ b/src/libexpr/primops/fetchClosure.cc
@@ -0,0 +1,62 @@
+#include "primops.hh"
+#include "store-api.hh"
+
+namespace nix {
+
+static void prim_fetchClosure(EvalState & state, const Pos & pos, Value * * args, Value & v)
+{
+    state.forceAttrs(*args[0], pos);
+
+    std::optional<StorePath> storePath;
+    std::optional<std::string> from;
+
+    for (auto & attr : *args[0]->attrs) {
+        if (attr.name == "storePath") {
+            PathSet context;
+            storePath = state.coerceToStorePath(*attr.pos, *attr.value, context);
+        }
+
+        else if (attr.name == "from")
+            from = state.forceStringNoCtx(*attr.value, *attr.pos);
+
+        else
+            throw Error({
+                .msg = hintfmt("attribute '%s' isn't supported in call to 'fetchClosure'", attr.name),
+                .errPos = pos
+            });
+    }
+
+    if (!storePath)
+        throw Error({
+            .msg = hintfmt("attribute '%s' is missing in call to 'fetchClosure'", "storePath"),
+            .errPos = pos
+        });
+
+    if (!from)
+        throw Error({
+            .msg = hintfmt("attribute '%s' is missing in call to 'fetchClosure'", "from"),
+            .errPos = pos
+        });
+
+    // FIXME: only allow some "trusted" store types (like BinaryCacheStore).
+    auto srcStore = openStore(*from);
+
+    copyClosure(*srcStore, *state.store, RealisedPath::Set { *storePath });
+
+    auto storePathS = state.store->printStorePath(*storePath);
+
+    v.mkString(storePathS, {storePathS});
+
+    // FIXME: in pure mode, require a CA path or a NAR hash of the
+    // top-level path.
+}
+
+static RegisterPrimOp primop_fetchClosure({
+    .name = "__fetchClosure",
+    .args = {"args"},
+    .doc = R"(
+    )",
+    .fun = prim_fetchClosure,
+});
+
+}
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index 9c2da2178..42c98e312 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -145,7 +145,7 @@ static void fetchTree(
         if (!params.allowNameArgument)
             if (auto nameIter = attrs.find("name"); nameIter != attrs.end())
                 throw Error({
-                    .msg = hintfmt("attribute 'name' isn’t supported in call to 'fetchTree'"),
+                    .msg = hintfmt("attribute 'name' isn't supported in call to 'fetchTree'"),
                     .errPos = pos
                 });
 
@@ -329,7 +329,7 @@ static RegisterPrimOp primop_fetchTarball({
     .fun = prim_fetchTarball,
 });
 
-static void prim_fetchGit(EvalState &state, const Pos &pos, Value **args, Value &v)
+static void prim_fetchGit(EvalState & state, const Pos & pos, Value * * args, Value & v)
 {
     fetchTree(state, pos, args, v, "git", FetchTreeParams { .emptyRevFallback = true, .allowNameArgument = true });
 }

From 41659418cfeb7a33fc76716a1847f79ae13d9b0c Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 21 Mar 2022 14:00:54 +0100
Subject: [PATCH 179/251] fetchClosure: Require a CA path in pure mode

---
 src/libexpr/primops/fetchClosure.cc | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/src/libexpr/primops/fetchClosure.cc b/src/libexpr/primops/fetchClosure.cc
index 4bcc716db..22a4649a4 100644
--- a/src/libexpr/primops/fetchClosure.cc
+++ b/src/libexpr/primops/fetchClosure.cc
@@ -43,12 +43,19 @@ static void prim_fetchClosure(EvalState & state, const Pos & pos, Value * * args
 
     copyClosure(*srcStore, *state.store, RealisedPath::Set { *storePath });
 
+    /* In pure mode, require a CA path. */
+    if (evalSettings.pureEval) {
+        auto info = state.store->queryPathInfo(*storePath);
+        if (!info->isContentAddressed(*state.store))
+            throw Error({
+                .msg = hintfmt("in pure mode, 'fetchClosure' requires a content-addressed path, which '%s' isn't",
+                    state.store->printStorePath(*storePath)),
+                .errPos = pos
+            });
+    }
+
     auto storePathS = state.store->printStorePath(*storePath);
-
     v.mkString(storePathS, {storePathS});
-
-    // FIXME: in pure mode, require a CA path or a NAR hash of the
-    // top-level path.
 }
 
 static RegisterPrimOp primop_fetchClosure({

From 7f6fe8ca1d41bceef32790aa0313aa62ae2b65fb Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 21 Mar 2022 14:34:45 +0100
Subject: [PATCH 180/251] Rename

---
 src/libexpr/primops/fetchClosure.cc | 32 ++++++++++++++---------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/src/libexpr/primops/fetchClosure.cc b/src/libexpr/primops/fetchClosure.cc
index 22a4649a4..8e60b2ccc 100644
--- a/src/libexpr/primops/fetchClosure.cc
+++ b/src/libexpr/primops/fetchClosure.cc
@@ -7,17 +7,17 @@ static void prim_fetchClosure(EvalState & state, const Pos & pos, Value * * args
 {
     state.forceAttrs(*args[0], pos);
 
-    std::optional<StorePath> storePath;
-    std::optional<std::string> from;
+    std::optional<std::string> fromStoreUrl;
+    std::optional<StorePath> fromPath;
 
     for (auto & attr : *args[0]->attrs) {
-        if (attr.name == "storePath") {
+        if (attr.name == "fromPath") {
             PathSet context;
-            storePath = state.coerceToStorePath(*attr.pos, *attr.value, context);
+            fromPath = state.coerceToStorePath(*attr.pos, *attr.value, context);
         }
 
-        else if (attr.name == "from")
-            from = state.forceStringNoCtx(*attr.value, *attr.pos);
+        else if (attr.name == "fromStore")
+            fromStoreUrl = state.forceStringNoCtx(*attr.value, *attr.pos);
 
         else
             throw Error({
@@ -26,36 +26,36 @@ static void prim_fetchClosure(EvalState & state, const Pos & pos, Value * * args
             });
     }
 
-    if (!storePath)
+    if (!fromPath)
         throw Error({
-            .msg = hintfmt("attribute '%s' is missing in call to 'fetchClosure'", "storePath"),
+            .msg = hintfmt("attribute '%s' is missing in call to 'fetchClosure'", "fromPath"),
             .errPos = pos
         });
 
-    if (!from)
+    if (!fromStoreUrl)
         throw Error({
-            .msg = hintfmt("attribute '%s' is missing in call to 'fetchClosure'", "from"),
+            .msg = hintfmt("attribute '%s' is missing in call to 'fetchClosure'", "fromStore"),
             .errPos = pos
         });
 
     // FIXME: only allow some "trusted" store types (like BinaryCacheStore).
-    auto srcStore = openStore(*from);
+    auto fromStore = openStore(*fromStoreUrl);
 
-    copyClosure(*srcStore, *state.store, RealisedPath::Set { *storePath });
+    copyClosure(*fromStore, *state.store, RealisedPath::Set { *fromPath });
 
     /* In pure mode, require a CA path. */
     if (evalSettings.pureEval) {
-        auto info = state.store->queryPathInfo(*storePath);
+        auto info = state.store->queryPathInfo(*fromPath);
         if (!info->isContentAddressed(*state.store))
             throw Error({
                 .msg = hintfmt("in pure mode, 'fetchClosure' requires a content-addressed path, which '%s' isn't",
-                    state.store->printStorePath(*storePath)),
+                    state.store->printStorePath(*fromPath)),
                 .errPos = pos
             });
     }
 
-    auto storePathS = state.store->printStorePath(*storePath);
-    v.mkString(storePathS, {storePathS});
+    auto fromPathS = state.store->printStorePath(*fromPath);
+    v.mkString(fromPathS, {fromPathS});
 }
 
 static RegisterPrimOp primop_fetchClosure({

From 545c2d0d8cbac86c169a6dd049c1ed9c3913774d Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 22 Mar 2022 21:14:58 +0100
Subject: [PATCH 181/251] fetchClosure: Allow a path to be rewritten to CA on
 the fly

The advantage is that the resulting closure doesn't need to be signed,
so you don't need to configure any binary cache keys on the client.
---
 src/libexpr/primops/fetchClosure.cc    | 46 ++++++++++++--
 src/libstore/make-content-addressed.cc | 79 ++++++++++++++++++++++++
 src/libstore/make-content-addressed.hh | 12 ++++
 src/nix/make-content-addressable.cc    | 85 ++++++--------------------
 4 files changed, 150 insertions(+), 72 deletions(-)
 create mode 100644 src/libstore/make-content-addressed.cc
 create mode 100644 src/libstore/make-content-addressed.hh

diff --git a/src/libexpr/primops/fetchClosure.cc b/src/libexpr/primops/fetchClosure.cc
index 8e60b2ccc..56fd53ed5 100644
--- a/src/libexpr/primops/fetchClosure.cc
+++ b/src/libexpr/primops/fetchClosure.cc
@@ -1,5 +1,6 @@
 #include "primops.hh"
 #include "store-api.hh"
+#include "make-content-addressed.hh"
 
 namespace nix {
 
@@ -9,6 +10,8 @@ static void prim_fetchClosure(EvalState & state, const Pos & pos, Value * * args
 
     std::optional<std::string> fromStoreUrl;
     std::optional<StorePath> fromPath;
+    bool toCA = false;
+    std::optional<StorePath> toPath;
 
     for (auto & attr : *args[0]->attrs) {
         if (attr.name == "fromPath") {
@@ -16,6 +19,15 @@ static void prim_fetchClosure(EvalState & state, const Pos & pos, Value * * args
             fromPath = state.coerceToStorePath(*attr.pos, *attr.value, context);
         }
 
+        else if (attr.name == "toPath") {
+            state.forceValue(*attr.value, *attr.pos);
+            toCA = true;
+            if (attr.value->type() != nString || attr.value->string.s != std::string("")) {
+                PathSet context;
+                toPath = state.coerceToStorePath(*attr.pos, *attr.value, context);
+            }
+        }
+
         else if (attr.name == "fromStore")
             fromStoreUrl = state.forceStringNoCtx(*attr.value, *attr.pos);
 
@@ -41,21 +53,45 @@ static void prim_fetchClosure(EvalState & state, const Pos & pos, Value * * args
     // FIXME: only allow some "trusted" store types (like BinaryCacheStore).
     auto fromStore = openStore(*fromStoreUrl);
 
-    copyClosure(*fromStore, *state.store, RealisedPath::Set { *fromPath });
+    if (toCA) {
+        auto remappings = makeContentAddressed(*fromStore, *state.store, { *fromPath });
+        auto i = remappings.find(*fromPath);
+        assert(i != remappings.end());
+        if (toPath && *toPath != i->second)
+            throw Error({
+                .msg = hintfmt("rewriting '%s' to content-addressed form yielded '%s', while '%s' was expected",
+                    state.store->printStorePath(*fromPath),
+                    state.store->printStorePath(i->second),
+                    state.store->printStorePath(*toPath)),
+                .errPos = pos
+            });
+        if (!toPath)
+            throw Error({
+                .msg = hintfmt(
+                    "rewriting '%s' to content-addressed form yielded '%s'; "
+                    "please set this in the 'toPath' attribute passed to 'fetchClosure'",
+                    state.store->printStorePath(*fromPath),
+                    state.store->printStorePath(i->second)),
+                .errPos = pos
+            });
+    } else {
+        copyClosure(*fromStore, *state.store, RealisedPath::Set { *fromPath });
+        toPath = fromPath;
+    }
 
     /* In pure mode, require a CA path. */
     if (evalSettings.pureEval) {
-        auto info = state.store->queryPathInfo(*fromPath);
+        auto info = state.store->queryPathInfo(*toPath);
         if (!info->isContentAddressed(*state.store))
             throw Error({
                 .msg = hintfmt("in pure mode, 'fetchClosure' requires a content-addressed path, which '%s' isn't",
-                    state.store->printStorePath(*fromPath)),
+                    state.store->printStorePath(*toPath)),
                 .errPos = pos
             });
     }
 
-    auto fromPathS = state.store->printStorePath(*fromPath);
-    v.mkString(fromPathS, {fromPathS});
+    auto toPathS = state.store->printStorePath(*toPath);
+    v.mkString(toPathS, {toPathS});
 }
 
 static RegisterPrimOp primop_fetchClosure({
diff --git a/src/libstore/make-content-addressed.cc b/src/libstore/make-content-addressed.cc
new file mode 100644
index 000000000..0b95ff37c
--- /dev/null
+++ b/src/libstore/make-content-addressed.cc
@@ -0,0 +1,79 @@
+#include "make-content-addressed.hh"
+#include "references.hh"
+
+namespace nix {
+
+std::map<StorePath, StorePath> makeContentAddressed(
+    Store & srcStore,
+    Store & dstStore,
+    const StorePathSet & storePaths)
+{
+    // FIXME: use closure of storePaths.
+
+    auto paths = srcStore.topoSortPaths(storePaths);
+
+    std::reverse(paths.begin(), paths.end());
+
+    std::map<StorePath, StorePath> remappings;
+
+    for (auto & path : paths) {
+        auto pathS = srcStore.printStorePath(path);
+        auto oldInfo = srcStore.queryPathInfo(path);
+        std::string oldHashPart(path.hashPart());
+
+        StringSink sink;
+        srcStore.narFromPath(path, sink);
+
+        StringMap rewrites;
+
+        StorePathSet references;
+        bool hasSelfReference = false;
+        for (auto & ref : oldInfo->references) {
+            if (ref == path)
+                hasSelfReference = true;
+            else {
+                auto i = remappings.find(ref);
+                auto replacement = i != remappings.end() ? i->second : ref;
+                // FIXME: warn about unremapped paths?
+                if (replacement != ref)
+                    rewrites.insert_or_assign(srcStore.printStorePath(ref), srcStore.printStorePath(replacement));
+                references.insert(std::move(replacement));
+            }
+        }
+
+        sink.s = rewriteStrings(sink.s, rewrites);
+
+        HashModuloSink hashModuloSink(htSHA256, oldHashPart);
+        hashModuloSink(sink.s);
+
+        auto narHash = hashModuloSink.finish().first;
+
+        ValidPathInfo info {
+            dstStore.makeFixedOutputPath(FileIngestionMethod::Recursive, narHash, path.name(), references, hasSelfReference),
+            narHash,
+        };
+        info.references = std::move(references);
+        if (hasSelfReference) info.references.insert(info.path);
+        info.narSize = sink.s.size();
+        info.ca = FixedOutputHash {
+            .method = FileIngestionMethod::Recursive,
+            .hash = info.narHash,
+        };
+
+        printInfo("rewrote '%s' to '%s'", pathS, srcStore.printStorePath(info.path));
+
+        auto source = sinkToSource([&](Sink & nextSink) {
+            RewritingSink rsink2(oldHashPart, std::string(info.path.hashPart()), nextSink);
+            rsink2(sink.s);
+            rsink2.flush();
+        });
+
+        dstStore.addToStore(info, *source);
+
+        remappings.insert_or_assign(std::move(path), std::move(info.path));
+    }
+
+    return remappings;
+}
+
+}
diff --git a/src/libstore/make-content-addressed.hh b/src/libstore/make-content-addressed.hh
new file mode 100644
index 000000000..c4a66ed41
--- /dev/null
+++ b/src/libstore/make-content-addressed.hh
@@ -0,0 +1,12 @@
+#pragma once
+
+#include "store-api.hh"
+
+namespace nix {
+
+std::map<StorePath, StorePath> makeContentAddressed(
+    Store & srcStore,
+    Store & dstStore,
+    const StorePathSet & storePaths);
+
+}
diff --git a/src/nix/make-content-addressable.cc b/src/nix/make-content-addressable.cc
index 2e75a3b61..a8579ea7c 100644
--- a/src/nix/make-content-addressable.cc
+++ b/src/nix/make-content-addressable.cc
@@ -1,6 +1,6 @@
 #include "command.hh"
 #include "store-api.hh"
-#include "references.hh"
+#include "make-content-addressed.hh"
 #include "common-args.hh"
 #include "json.hh"
 
@@ -27,74 +27,25 @@ struct CmdMakeContentAddressable : StorePathsCommand, MixJSON
 
     void run(ref<Store> store, StorePaths && storePaths) override
     {
-        auto paths = store->topoSortPaths(StorePathSet(storePaths.begin(), storePaths.end()));
+        auto remappings = makeContentAddressed(*store, *store,
+            StorePathSet(storePaths.begin(), storePaths.end()));
 
-        std::reverse(paths.begin(), paths.end());
-
-        std::map<StorePath, StorePath> remappings;
-
-        auto jsonRoot = json ? std::make_unique<JSONObject>(std::cout) : nullptr;
-        auto jsonRewrites = json ? std::make_unique<JSONObject>(jsonRoot->object("rewrites")) : nullptr;
-
-        for (auto & path : paths) {
-            auto pathS = store->printStorePath(path);
-            auto oldInfo = store->queryPathInfo(path);
-            std::string oldHashPart(path.hashPart());
-
-            StringSink sink;
-            store->narFromPath(path, sink);
-
-            StringMap rewrites;
-
-            StorePathSet references;
-            bool hasSelfReference = false;
-            for (auto & ref : oldInfo->references) {
-                if (ref == path)
-                    hasSelfReference = true;
-                else {
-                    auto i = remappings.find(ref);
-                    auto replacement = i != remappings.end() ? i->second : ref;
-                    // FIXME: warn about unremapped paths?
-                    if (replacement != ref)
-                        rewrites.insert_or_assign(store->printStorePath(ref), store->printStorePath(replacement));
-                    references.insert(std::move(replacement));
-                }
+        if (json) {
+            JSONObject jsonRoot(std::cout);
+            JSONObject jsonRewrites(jsonRoot.object("rewrites"));
+            for (auto & path : storePaths) {
+                auto i = remappings.find(path);
+                assert(i != remappings.end());
+                jsonRewrites.attr(store->printStorePath(path), store->printStorePath(i->second));
+            }
+        } else {
+            for (auto & path : storePaths) {
+                auto i = remappings.find(path);
+                assert(i != remappings.end());
+                notice("rewrote '%s' to '%s'",
+                    store->printStorePath(path),
+                    store->printStorePath(i->second));
             }
-
-            sink.s = rewriteStrings(sink.s, rewrites);
-
-            HashModuloSink hashModuloSink(htSHA256, oldHashPart);
-            hashModuloSink(sink.s);
-
-            auto narHash = hashModuloSink.finish().first;
-
-            ValidPathInfo info {
-                store->makeFixedOutputPath(FileIngestionMethod::Recursive, narHash, path.name(), references, hasSelfReference),
-                narHash,
-            };
-            info.references = std::move(references);
-            if (hasSelfReference) info.references.insert(info.path);
-            info.narSize = sink.s.size();
-            info.ca = FixedOutputHash {
-                .method = FileIngestionMethod::Recursive,
-                .hash = info.narHash,
-            };
-
-            if (!json)
-                notice("rewrote '%s' to '%s'", pathS, store->printStorePath(info.path));
-
-            auto source = sinkToSource([&](Sink & nextSink) {
-                RewritingSink rsink2(oldHashPart, std::string(info.path.hashPart()), nextSink);
-                rsink2(sink.s);
-                rsink2.flush();
-            });
-
-            store->addToStore(info, *source);
-
-            if (json)
-                jsonRewrites->attr(store->printStorePath(path), store->printStorePath(info.path));
-
-            remappings.insert_or_assign(std::move(path), std::move(info.path));
         }
     }
 };

From f18607549ce38545b1d754ed93f3b7c5417970d8 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 22 Mar 2022 21:47:50 +0100
Subject: [PATCH 182/251] Fix makeContentAddressed() on self-references

LocalStore::addToStore() since
79ae9e4558cbefd743f28a5e73110c2303b03a85 expects a regular NAR hash,
rather than a NAR hash modulo self-references. Fixes #6300.

Also, makeContentAddressed() now rewrites the entire closure (so 'nix
store make-content-addressable' no longer needs '-r'). See #6301.
---
 src/libstore/make-content-addressed.cc | 35 +++++++++++++-------------
 1 file changed, 18 insertions(+), 17 deletions(-)

diff --git a/src/libstore/make-content-addressed.cc b/src/libstore/make-content-addressed.cc
index 0b95ff37c..fc11fcb27 100644
--- a/src/libstore/make-content-addressed.cc
+++ b/src/libstore/make-content-addressed.cc
@@ -8,9 +8,10 @@ std::map<StorePath, StorePath> makeContentAddressed(
     Store & dstStore,
     const StorePathSet & storePaths)
 {
-    // FIXME: use closure of storePaths.
+    StorePathSet closure;
+    srcStore.computeFSClosure(storePaths, closure);
 
-    auto paths = srcStore.topoSortPaths(storePaths);
+    auto paths = srcStore.topoSortPaths(closure);
 
     std::reverse(paths.begin(), paths.end());
 
@@ -46,29 +47,29 @@ std::map<StorePath, StorePath> makeContentAddressed(
         HashModuloSink hashModuloSink(htSHA256, oldHashPart);
         hashModuloSink(sink.s);
 
-        auto narHash = hashModuloSink.finish().first;
+        auto narModuloHash = hashModuloSink.finish().first;
 
-        ValidPathInfo info {
-            dstStore.makeFixedOutputPath(FileIngestionMethod::Recursive, narHash, path.name(), references, hasSelfReference),
-            narHash,
-        };
+        auto dstPath = dstStore.makeFixedOutputPath(
+            FileIngestionMethod::Recursive, narModuloHash, path.name(), references, hasSelfReference);
+
+        printInfo("rewroting '%s' to '%s'", pathS, srcStore.printStorePath(dstPath));
+
+        StringSink sink2;
+        RewritingSink rsink2(oldHashPart, std::string(dstPath.hashPart()), sink2);
+        rsink2(sink.s);
+        rsink2.flush();
+
+        ValidPathInfo info { dstPath, hashString(htSHA256, sink2.s) };
         info.references = std::move(references);
         if (hasSelfReference) info.references.insert(info.path);
         info.narSize = sink.s.size();
         info.ca = FixedOutputHash {
             .method = FileIngestionMethod::Recursive,
-            .hash = info.narHash,
+            .hash = narModuloHash,
         };
 
-        printInfo("rewrote '%s' to '%s'", pathS, srcStore.printStorePath(info.path));
-
-        auto source = sinkToSource([&](Sink & nextSink) {
-            RewritingSink rsink2(oldHashPart, std::string(info.path.hashPart()), nextSink);
-            rsink2(sink.s);
-            rsink2.flush();
-        });
-
-        dstStore.addToStore(info, *source);
+        StringSource source(sink2.s);
+        dstStore.addToStore(info, source);
 
         remappings.insert_or_assign(std::move(path), std::move(info.path));
     }

From 5acaf13d3564f689e5461f29a9cc5958809d5e93 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 22 Mar 2022 21:54:49 +0100
Subject: [PATCH 183/251] Rename 'nix store make-content-addressable' to 'nix
 store make-content-addressed'

---
 doc/manual/src/release-notes/rl-next.md                   | 3 +++
 src/nix/main.cc                                           | 2 +-
 ...e-content-addressable.cc => make-content-addressed.cc} | 8 ++++----
 ...e-content-addressable.md => make-content-addressed.md} | 4 ++--
 4 files changed, 10 insertions(+), 7 deletions(-)
 rename src/nix/{make-content-addressable.cc => make-content-addressed.cc} (83%)
 rename src/nix/{make-content-addressable.md => make-content-addressed.md} (94%)

diff --git a/doc/manual/src/release-notes/rl-next.md b/doc/manual/src/release-notes/rl-next.md
index c9753f9aa..8fbc605e7 100644
--- a/doc/manual/src/release-notes/rl-next.md
+++ b/doc/manual/src/release-notes/rl-next.md
@@ -1,3 +1,6 @@
 # Release X.Y (202?-??-??)
 
 * Various nix commands can now read expressions from stdin with `--file -`.
+
+* `nix store make-content-addressable` has been renamed to `nix store
+  make-content-addressed`.
diff --git a/src/nix/main.cc b/src/nix/main.cc
index b923f2535..9bc6c15fa 100644
--- a/src/nix/main.cc
+++ b/src/nix/main.cc
@@ -117,7 +117,7 @@ struct NixArgs : virtual MultiCommand, virtual MixCommonArgs
         {"hash-path", {"hash", "path"}},
         {"ls-nar", {"nar", "ls"}},
         {"ls-store", {"store", "ls"}},
-        {"make-content-addressable", {"store", "make-content-addressable"}},
+        {"make-content-addressable", {"store", "make-content-addressed"}},
         {"optimise-store", {"store", "optimise"}},
         {"ping-store", {"store", "ping"}},
         {"sign-paths", {"store", "sign"}},
diff --git a/src/nix/make-content-addressable.cc b/src/nix/make-content-addressed.cc
similarity index 83%
rename from src/nix/make-content-addressable.cc
rename to src/nix/make-content-addressed.cc
index a8579ea7c..dc0447cb8 100644
--- a/src/nix/make-content-addressable.cc
+++ b/src/nix/make-content-addressed.cc
@@ -6,9 +6,9 @@
 
 using namespace nix;
 
-struct CmdMakeContentAddressable : StorePathsCommand, MixJSON
+struct CmdMakeContentAddressed : StorePathsCommand, MixJSON
 {
-    CmdMakeContentAddressable()
+    CmdMakeContentAddressed()
     {
         realiseMode = Realise::Outputs;
     }
@@ -21,7 +21,7 @@ struct CmdMakeContentAddressable : StorePathsCommand, MixJSON
     std::string doc() override
     {
         return
-          #include "make-content-addressable.md"
+          #include "make-content-addressed.md"
           ;
     }
 
@@ -50,4 +50,4 @@ struct CmdMakeContentAddressable : StorePathsCommand, MixJSON
     }
 };
 
-static auto rCmdMakeContentAddressable = registerCommand2<CmdMakeContentAddressable>({"store", "make-content-addressable"});
+static auto rCmdMakeContentAddressed = registerCommand2<CmdMakeContentAddressed>({"store", "make-content-addressed"});
diff --git a/src/nix/make-content-addressable.md b/src/nix/make-content-addressed.md
similarity index 94%
rename from src/nix/make-content-addressable.md
rename to src/nix/make-content-addressed.md
index 3dd847edc..215683e6d 100644
--- a/src/nix/make-content-addressable.md
+++ b/src/nix/make-content-addressed.md
@@ -5,7 +5,7 @@ R""(
 * Create a content-addressed representation of the closure of GNU Hello:
 
   ```console
-  # nix store make-content-addressable -r nixpkgs#hello
+  # nix store make-content-addressed nixpkgs#hello
   …
   rewrote '/nix/store/v5sv61sszx301i0x6xysaqzla09nksnd-hello-2.10' to '/nix/store/5skmmcb9svys5lj3kbsrjg7vf2irid63-hello-2.10'
   ```
@@ -29,7 +29,7 @@ R""(
   system closure:
 
   ```console
-  # nix store make-content-addressable -r /run/current-system
+  # nix store make-content-addressed /run/current-system
   ```
 
 # Description

From 7ffda0af6effbf32c8668f34cc3f0448c58bc3c1 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 22 Mar 2022 22:01:20 +0100
Subject: [PATCH 184/251] fetchClosure: Skip makeContentAddressed() if toPath
 is already valid

---
 src/libexpr/primops/fetchClosure.cc | 42 +++++++++++++++--------------
 1 file changed, 22 insertions(+), 20 deletions(-)

diff --git a/src/libexpr/primops/fetchClosure.cc b/src/libexpr/primops/fetchClosure.cc
index 56fd53ed5..c3f07b6d6 100644
--- a/src/libexpr/primops/fetchClosure.cc
+++ b/src/libexpr/primops/fetchClosure.cc
@@ -54,26 +54,28 @@ static void prim_fetchClosure(EvalState & state, const Pos & pos, Value * * args
     auto fromStore = openStore(*fromStoreUrl);
 
     if (toCA) {
-        auto remappings = makeContentAddressed(*fromStore, *state.store, { *fromPath });
-        auto i = remappings.find(*fromPath);
-        assert(i != remappings.end());
-        if (toPath && *toPath != i->second)
-            throw Error({
-                .msg = hintfmt("rewriting '%s' to content-addressed form yielded '%s', while '%s' was expected",
-                    state.store->printStorePath(*fromPath),
-                    state.store->printStorePath(i->second),
-                    state.store->printStorePath(*toPath)),
-                .errPos = pos
-            });
-        if (!toPath)
-            throw Error({
-                .msg = hintfmt(
-                    "rewriting '%s' to content-addressed form yielded '%s'; "
-                    "please set this in the 'toPath' attribute passed to 'fetchClosure'",
-                    state.store->printStorePath(*fromPath),
-                    state.store->printStorePath(i->second)),
-                .errPos = pos
-            });
+        if (!toPath || !state.store->isValidPath(*toPath)) {
+            auto remappings = makeContentAddressed(*fromStore, *state.store, { *fromPath });
+            auto i = remappings.find(*fromPath);
+            assert(i != remappings.end());
+            if (toPath && *toPath != i->second)
+                throw Error({
+                    .msg = hintfmt("rewriting '%s' to content-addressed form yielded '%s', while '%s' was expected",
+                        state.store->printStorePath(*fromPath),
+                        state.store->printStorePath(i->second),
+                        state.store->printStorePath(*toPath)),
+                    .errPos = pos
+                });
+            if (!toPath)
+                throw Error({
+                    .msg = hintfmt(
+                        "rewriting '%s' to content-addressed form yielded '%s'; "
+                        "please set this in the 'toPath' attribute passed to 'fetchClosure'",
+                        state.store->printStorePath(*fromPath),
+                        state.store->printStorePath(i->second)),
+                    .errPos = pos
+                });
+        }
     } else {
         copyClosure(*fromStore, *state.store, RealisedPath::Set { *fromPath });
         toPath = fromPath;

From 4120930ac19ab7296818fdc1d1389e7799168867 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 22 Mar 2022 22:47:33 +0100
Subject: [PATCH 185/251] fetchClosure: Only allow some "safe" store types

---
 src/libexpr/primops/fetchClosure.cc | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/libexpr/primops/fetchClosure.cc b/src/libexpr/primops/fetchClosure.cc
index c3f07b6d6..247bceb07 100644
--- a/src/libexpr/primops/fetchClosure.cc
+++ b/src/libexpr/primops/fetchClosure.cc
@@ -1,6 +1,7 @@
 #include "primops.hh"
 #include "store-api.hh"
 #include "make-content-addressed.hh"
+#include "url.hh"
 
 namespace nix {
 
@@ -50,8 +51,15 @@ static void prim_fetchClosure(EvalState & state, const Pos & pos, Value * * args
             .errPos = pos
         });
 
-    // FIXME: only allow some "trusted" store types (like BinaryCacheStore).
-    auto fromStore = openStore(*fromStoreUrl);
+    auto parsedURL = parseURL(*fromStoreUrl);
+
+    if (parsedURL.scheme != "http" && parsedURL.scheme != "https")
+        throw Error({
+            .msg = hintfmt("'fetchClosure' only supports http:// and https:// stores"),
+            .errPos = pos
+        });
+
+    auto fromStore = openStore(parsedURL.to_string());
 
     if (toCA) {
         if (!toPath || !state.store->isValidPath(*toPath)) {

From 28186b7044dca513e6e07c3e66b7de2143543ae4 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 22 Mar 2022 23:19:21 +0100
Subject: [PATCH 186/251] Add a test for fetchClosure and 'nix store
 make-content-addressed'

---
 src/libexpr/primops/fetchClosure.cc    |  4 +-
 src/libstore/make-content-addressed.cc |  2 +-
 tests/binary-cache.sh                  |  2 +-
 tests/fetchClosure.sh                  | 57 ++++++++++++++++++++++++++
 tests/local.mk                         |  3 +-
 5 files changed, 64 insertions(+), 4 deletions(-)
 create mode 100644 tests/fetchClosure.sh

diff --git a/src/libexpr/primops/fetchClosure.cc b/src/libexpr/primops/fetchClosure.cc
index 247bceb07..47e2d2bf2 100644
--- a/src/libexpr/primops/fetchClosure.cc
+++ b/src/libexpr/primops/fetchClosure.cc
@@ -53,7 +53,9 @@ static void prim_fetchClosure(EvalState & state, const Pos & pos, Value * * args
 
     auto parsedURL = parseURL(*fromStoreUrl);
 
-    if (parsedURL.scheme != "http" && parsedURL.scheme != "https")
+    if (parsedURL.scheme != "http" &&
+        parsedURL.scheme != "https" &&
+        !(getEnv("_NIX_IN_TEST").has_value() && parsedURL.scheme == "file"))
         throw Error({
             .msg = hintfmt("'fetchClosure' only supports http:// and https:// stores"),
             .errPos = pos
diff --git a/src/libstore/make-content-addressed.cc b/src/libstore/make-content-addressed.cc
index fc11fcb27..64d172918 100644
--- a/src/libstore/make-content-addressed.cc
+++ b/src/libstore/make-content-addressed.cc
@@ -52,7 +52,7 @@ std::map<StorePath, StorePath> makeContentAddressed(
         auto dstPath = dstStore.makeFixedOutputPath(
             FileIngestionMethod::Recursive, narModuloHash, path.name(), references, hasSelfReference);
 
-        printInfo("rewroting '%s' to '%s'", pathS, srcStore.printStorePath(dstPath));
+        printInfo("rewriting '%s' to '%s'", pathS, srcStore.printStorePath(dstPath));
 
         StringSink sink2;
         RewritingSink rsink2(oldHashPart, std::string(dstPath.hashPart()), sink2);
diff --git a/tests/binary-cache.sh b/tests/binary-cache.sh
index 2368884f7..0361ac6a8 100644
--- a/tests/binary-cache.sh
+++ b/tests/binary-cache.sh
@@ -1,6 +1,6 @@
 source common.sh
 
-needLocalStore "“--no-require-sigs” can’t be used with the daemon"
+needLocalStore "'--no-require-sigs' can’t be used with the daemon"
 
 # We can produce drvs directly into the binary cache
 clearStore
diff --git a/tests/fetchClosure.sh b/tests/fetchClosure.sh
new file mode 100644
index 000000000..811d44af9
--- /dev/null
+++ b/tests/fetchClosure.sh
@@ -0,0 +1,57 @@
+source common.sh
+
+needLocalStore "'--no-require-sigs' can’t be used with the daemon"
+
+clearStore
+clearCacheCache
+
+# Initialize binary cache.
+nonCaPath=$(nix build --json --file ./dependencies.nix | jq -r .[].outputs.out)
+caPath=$(nix store make-content-addressed --json $nonCaPath | jq -r '.rewrites | map(.) | .[]')
+nix copy --to file://$cacheDir $nonCaPath
+
+# Test basic fetchClosure rewriting from non-CA to CA.
+clearStore
+
+[ ! -e $nonCaPath ]
+[ ! -e $caPath ]
+
+[[ $(nix eval -v --raw --expr "
+  builtins.fetchClosure {
+    fromStore = \"file://$cacheDir\";
+    fromPath = $nonCaPath;
+    toPath = $caPath;
+  }
+") = $caPath ]]
+
+[ ! -e $nonCaPath ]
+[ -e $caPath ]
+
+# In impure mode, we can use non-CA paths.
+[[ $(nix eval --raw --no-require-sigs --impure --expr "
+  builtins.fetchClosure {
+    fromStore = \"file://$cacheDir\";
+    fromPath = $nonCaPath;
+  }
+") = $nonCaPath ]]
+
+[ -e $nonCaPath ]
+
+# 'toPath' set to empty string should fail but print the expected path.
+nix eval -v --json --expr "
+  builtins.fetchClosure {
+    fromStore = \"file://$cacheDir\";
+    fromPath = $nonCaPath;
+    toPath = \"\";
+  }
+" 2>&1 | grep "error: rewriting.*$nonCaPath.*yielded.*$caPath"
+
+# If fromPath is CA, then toPath isn't needed.
+nix copy --to file://$cacheDir $caPath
+
+[[ $(nix eval -v --raw --expr "
+  builtins.fetchClosure {
+    fromStore = \"file://$cacheDir\";
+    fromPath = $caPath;
+  }
+") = $caPath ]]
diff --git a/tests/local.mk b/tests/local.mk
index c686be049..97971dd76 100644
--- a/tests/local.mk
+++ b/tests/local.mk
@@ -96,7 +96,8 @@ nix_tests = \
   describe-stores.sh \
   nix-profile.sh \
   suggestions.sh \
-  store-ping.sh
+  store-ping.sh \
+  fetchClosure.sh
 
 ifeq ($(HAVE_LIBCPUID), 1)
 	nix_tests += compute-levels.sh

From 98658ae9d25e5e715f9349fbbb79d0ba31bb810c Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 22 Mar 2022 23:31:48 +0100
Subject: [PATCH 187/251] Document fetchClosure

---
 doc/manual/src/release-notes/rl-next.md |  7 ++++++
 src/libexpr/primops/fetchClosure.cc     | 33 +++++++++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/doc/manual/src/release-notes/rl-next.md b/doc/manual/src/release-notes/rl-next.md
index 8fbc605e7..33eaa8a2c 100644
--- a/doc/manual/src/release-notes/rl-next.md
+++ b/doc/manual/src/release-notes/rl-next.md
@@ -4,3 +4,10 @@
 
 * `nix store make-content-addressable` has been renamed to `nix store
   make-content-addressed`.
+
+* New builtin function `builtins.fetchClosure` that copies a closure
+  from a binary cache at evaluation time and rewrites it to
+  content-addressed form (if it isn't already). Like
+  `builtins.storePath`, this allows importing pre-built store paths;
+  the difference is that it doesn't require the user to configure
+  binary caches and trusted public keys.
diff --git a/src/libexpr/primops/fetchClosure.cc b/src/libexpr/primops/fetchClosure.cc
index 47e2d2bf2..045e97dbd 100644
--- a/src/libexpr/primops/fetchClosure.cc
+++ b/src/libexpr/primops/fetchClosure.cc
@@ -110,6 +110,39 @@ static RegisterPrimOp primop_fetchClosure({
     .name = "__fetchClosure",
     .args = {"args"},
     .doc = R"(
+      Fetch a Nix store closure from a binary cache, rewriting it into
+      content-addressed form. For example,
+
+      ```nix
+      builtins.fetchClosure {
+        fromStore = "https://cache.nixos.org";
+        fromPath = /nix/store/r2jd6ygnmirm2g803mksqqjm4y39yi6i-git-2.33.1;
+        toPath = /nix/store/ldbhlwhh39wha58rm61bkiiwm6j7211j-git-2.33.1;
+      }
+      ```
+
+      fetches `/nix/store/r2jd...` from the specified binary cache,
+      and rewrites it into the content-addressed store path
+      `/nix/store/ldbh...`.
+
+      If `fromPath` is already content-addressed, or if you are
+      allowing impure evaluation (`--impure`), then `toPath` may be
+      omitted.
+
+      To find out the correct value for `toPath` given a `fromPath`,
+      you can use `nix store make-content-addressed`:
+
+      ```console
+      # nix store make-content-addressed /nix/store/r2jd6ygnmirm2g803mksqqjm4y39yi6i-git-2.33.1
+      rewrote '/nix/store/r2jd6ygnmirm2g803mksqqjm4y39yi6i-git-2.33.1' to '/nix/store/ldbhlwhh39wha58rm61bkiiwm6j7211j-git-2.33.1'
+      ```
+
+      This function is similar to `builtins.storePath` in that it
+      allows you to use a previously built store path in a Nix
+      expression. However, it is more reproducible because it requires
+      specifying a binary cache from which the path can be fetched.
+      Also, requiring a content-addressed final store path avoids the
+      need for users to configure binary cache public keys.
     )",
     .fun = prim_fetchClosure,
 });

From e5f7029ba49a486c1b0c8011be79b8b41be20935 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 22 Mar 2022 23:40:04 +0100
Subject: [PATCH 188/251] nix store make-content-addressed: Support --from /
 --to

---
 src/libexpr/primops/fetchClosure.cc |  2 +-
 src/nix/make-content-addressed.cc   | 14 ++++++++------
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/src/libexpr/primops/fetchClosure.cc b/src/libexpr/primops/fetchClosure.cc
index 045e97dbd..3e07d1d18 100644
--- a/src/libexpr/primops/fetchClosure.cc
+++ b/src/libexpr/primops/fetchClosure.cc
@@ -133,7 +133,7 @@ static RegisterPrimOp primop_fetchClosure({
       you can use `nix store make-content-addressed`:
 
       ```console
-      # nix store make-content-addressed /nix/store/r2jd6ygnmirm2g803mksqqjm4y39yi6i-git-2.33.1
+      # nix store make-content-addressed --from https://cache.nixos.org /nix/store/r2jd6ygnmirm2g803mksqqjm4y39yi6i-git-2.33.1
       rewrote '/nix/store/r2jd6ygnmirm2g803mksqqjm4y39yi6i-git-2.33.1' to '/nix/store/ldbhlwhh39wha58rm61bkiiwm6j7211j-git-2.33.1'
       ```
 
diff --git a/src/nix/make-content-addressed.cc b/src/nix/make-content-addressed.cc
index dc0447cb8..34860c38f 100644
--- a/src/nix/make-content-addressed.cc
+++ b/src/nix/make-content-addressed.cc
@@ -6,7 +6,7 @@
 
 using namespace nix;
 
-struct CmdMakeContentAddressed : StorePathsCommand, MixJSON
+struct CmdMakeContentAddressed : virtual CopyCommand, virtual StorePathsCommand, MixJSON
 {
     CmdMakeContentAddressed()
     {
@@ -25,9 +25,11 @@ struct CmdMakeContentAddressed : StorePathsCommand, MixJSON
           ;
     }
 
-    void run(ref<Store> store, StorePaths && storePaths) override
+    void run(ref<Store> srcStore, StorePaths && storePaths) override
     {
-        auto remappings = makeContentAddressed(*store, *store,
+        auto dstStore = dstUri.empty() ? openStore() : openStore(dstUri);
+
+        auto remappings = makeContentAddressed(*srcStore, *dstStore,
             StorePathSet(storePaths.begin(), storePaths.end()));
 
         if (json) {
@@ -36,15 +38,15 @@ struct CmdMakeContentAddressed : StorePathsCommand, MixJSON
             for (auto & path : storePaths) {
                 auto i = remappings.find(path);
                 assert(i != remappings.end());
-                jsonRewrites.attr(store->printStorePath(path), store->printStorePath(i->second));
+                jsonRewrites.attr(srcStore->printStorePath(path), srcStore->printStorePath(i->second));
             }
         } else {
             for (auto & path : storePaths) {
                 auto i = remappings.find(path);
                 assert(i != remappings.end());
                 notice("rewrote '%s' to '%s'",
-                    store->printStorePath(path),
-                    store->printStorePath(i->second));
+                    srcStore->printStorePath(path),
+                    srcStore->printStorePath(i->second));
             }
         }
     }

From f902f3c2cbfa1a78bec8d135297abe244452e794 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 24 Mar 2022 21:33:20 +0100
Subject: [PATCH 189/251] Add experimental feature 'fetch-closure'

---
 src/libexpr/primops/fetchClosure.cc  | 2 ++
 src/libutil/experimental-features.cc | 1 +
 src/libutil/experimental-features.hh | 3 ++-
 tests/fetchClosure.sh                | 1 +
 4 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/libexpr/primops/fetchClosure.cc b/src/libexpr/primops/fetchClosure.cc
index 3e07d1d18..47f40ef33 100644
--- a/src/libexpr/primops/fetchClosure.cc
+++ b/src/libexpr/primops/fetchClosure.cc
@@ -7,6 +7,8 @@ namespace nix {
 
 static void prim_fetchClosure(EvalState & state, const Pos & pos, Value * * args, Value & v)
 {
+    settings.requireExperimentalFeature(Xp::FetchClosure);
+
     state.forceAttrs(*args[0], pos);
 
     std::optional<std::string> fromStoreUrl;
diff --git a/src/libutil/experimental-features.cc b/src/libutil/experimental-features.cc
index b49f47e1d..01f318fa3 100644
--- a/src/libutil/experimental-features.cc
+++ b/src/libutil/experimental-features.cc
@@ -11,6 +11,7 @@ std::map<ExperimentalFeature, std::string> stringifiedXpFeatures = {
     { Xp::NixCommand, "nix-command" },
     { Xp::RecursiveNix, "recursive-nix" },
     { Xp::NoUrlLiterals, "no-url-literals" },
+    { Xp::FetchClosure, "fetch-closure" },
 };
 
 const std::optional<ExperimentalFeature> parseExperimentalFeature(const std::string_view & name)
diff --git a/src/libutil/experimental-features.hh b/src/libutil/experimental-features.hh
index 291a58e32..b5140dcfe 100644
--- a/src/libutil/experimental-features.hh
+++ b/src/libutil/experimental-features.hh
@@ -19,7 +19,8 @@ enum struct ExperimentalFeature
     Flakes,
     NixCommand,
     RecursiveNix,
-    NoUrlLiterals
+    NoUrlLiterals,
+    FetchClosure,
 };
 
 /**
diff --git a/tests/fetchClosure.sh b/tests/fetchClosure.sh
index 811d44af9..0c905ac43 100644
--- a/tests/fetchClosure.sh
+++ b/tests/fetchClosure.sh
@@ -1,5 +1,6 @@
 source common.sh
 
+enableFeatures "fetch-closure"
 needLocalStore "'--no-require-sigs' can’t be used with the daemon"
 
 clearStore

From c85467a1b65d2a8907fcab3303572f76c071776d Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 6 Feb 2022 14:47:07 +0100
Subject: [PATCH 190/251] Revert "TarArchive: Small refactoring"

This reverts commit 50a35860ee9237d341948437c5f70a7f0987d393.

With this change Nix fails to open bzip2 logfiles that were created from
builds with no stdout/stderr.
---
 src/libutil/tarfile.cc | 26 ++++++++++++++------------
 src/libutil/tarfile.hh |  3 ---
 2 files changed, 14 insertions(+), 15 deletions(-)

diff --git a/src/libutil/tarfile.cc b/src/libutil/tarfile.cc
index 790bc943a..a7db58559 100644
--- a/src/libutil/tarfile.cc
+++ b/src/libutil/tarfile.cc
@@ -39,30 +39,32 @@ void TarArchive::check(int err, const std::string & reason)
         throw Error(reason, archive_error_string(this->archive));
 }
 
-TarArchive::TarArchive(Source & source, bool raw)
-    : source(&source), buffer(4096)
+TarArchive::TarArchive(Source & source, bool raw) : buffer(4096)
 {
-    init();
-    if (!raw)
+    this->archive = archive_read_new();
+    this->source = &source;
+
+    if (!raw) {
+        archive_read_support_filter_all(archive);
         archive_read_support_format_all(archive);
-    else
+    } else {
+        archive_read_support_filter_all(archive);
         archive_read_support_format_raw(archive);
+        archive_read_support_format_empty(archive);
+    }
     check(archive_read_open(archive, (void *)this, callback_open, callback_read, callback_close), "Failed to open archive (%s)");
 }
 
+
 TarArchive::TarArchive(const Path & path)
 {
-    init();
+    this->archive = archive_read_new();
+
+    archive_read_support_filter_all(archive);
     archive_read_support_format_all(archive);
     check(archive_read_open_filename(archive, path.c_str(), 16384), "failed to open archive: %s");
 }
 
-void TarArchive::init()
-{
-    archive = archive_read_new();
-    archive_read_support_filter_all(archive);
-}
-
 void TarArchive::close()
 {
     check(archive_read_close(this->archive), "Failed to close archive (%s)");
diff --git a/src/libutil/tarfile.hh b/src/libutil/tarfile.hh
index f107a7e2e..4d9141fd4 100644
--- a/src/libutil/tarfile.hh
+++ b/src/libutil/tarfile.hh
@@ -17,13 +17,10 @@ struct TarArchive {
     // disable copy constructor
     TarArchive(const TarArchive &) = delete;
 
-    void init();
-
     void close();
 
     ~TarArchive();
 };
-
 void unpackTarfile(Source & source, const Path & destDir);
 
 void unpackTarfile(const Path & tarFile, const Path & destDir);

From d02e34ef06e24f98404d7a50130ddced15a12279 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 6 Feb 2022 14:52:04 +0100
Subject: [PATCH 191/251] Implement regression test for empty logs loaded via
 `nix log`

---
 tests/logging.sh | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/tests/logging.sh b/tests/logging.sh
index c894ad3ff..1481b9b36 100644
--- a/tests/logging.sh
+++ b/tests/logging.sh
@@ -13,3 +13,14 @@ rm -rf $NIX_LOG_DIR
 (! nix-store -l $path)
 nix-build dependencies.nix --no-out-link --compress-build-log
 [ "$(nix-store -l $path)" = FOO ]
+
+# test whether empty logs work fine with `nix log`.
+builder="$(mktemp)"
+echo -e "#!/bin/sh\nmkdir \$out" > "$builder"
+outp="$(nix-build -E \
+    'with import ./config.nix; mkDerivation { name = "fnord"; builder = '"$builder"'; }' \
+    --out-link "$(mktemp -d)/result")"
+
+test -d "$outp"
+
+nix log "$outp"

From 175c78591b1877c280936cc663b76e47f207dd77 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 24 Mar 2022 23:09:43 +0100
Subject: [PATCH 192/251] Random cleanup

---
 src/libstore/build/goal.hh | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/src/libstore/build/goal.hh b/src/libstore/build/goal.hh
index 07c752bb9..35121c5d9 100644
--- a/src/libstore/build/goal.hh
+++ b/src/libstore/build/goal.hh
@@ -40,21 +40,21 @@ struct Goal : public std::enable_shared_from_this<Goal>
     WeakGoals waiters;
 
     /* Number of goals we are/were waiting for that have failed. */
-    unsigned int nrFailed;
+    size_t nrFailed = 0;
 
     /* Number of substitution goals we are/were waiting for that
        failed because there are no substituters. */
-    unsigned int nrNoSubstituters;
+    size_t nrNoSubstituters = 0;
 
     /* Number of substitution goals we are/were waiting for that
        failed because they had unsubstitutable references. */
-    unsigned int nrIncompleteClosure;
+    size_t nrIncompleteClosure = 0;
 
     /* Name of this goal for debugging purposes. */
     std::string name;
 
     /* Whether the goal is finished. */
-    ExitCode exitCode;
+    ExitCode exitCode = ecBusy;
 
     /* Build result. */
     BuildResult buildResult;
@@ -65,10 +65,7 @@ struct Goal : public std::enable_shared_from_this<Goal>
     Goal(Worker & worker, DerivedPath path)
         : worker(worker)
         , buildResult { .path = std::move(path) }
-    {
-        nrFailed = nrNoSubstituters = nrIncompleteClosure = 0;
-        exitCode = ecBusy;
-    }
+    { }
 
     virtual ~Goal()
     {

From 09796c026376b49a8bc5bb3a2865db015d3dfb06 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 24 Mar 2022 23:24:10 +0100
Subject: [PATCH 193/251] Random cleanup

---
 src/libstore/build/goal.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libstore/build/goal.cc b/src/libstore/build/goal.cc
index d2420b107..58e805f55 100644
--- a/src/libstore/build/goal.cc
+++ b/src/libstore/build/goal.cc
@@ -28,7 +28,7 @@ void Goal::addWaitee(GoalPtr waitee)
 
 void Goal::waiteeDone(GoalPtr waitee, ExitCode result)
 {
-    assert(waitees.find(waitee) != waitees.end());
+    assert(waitees.count(waitee));
     waitees.erase(waitee);
 
     trace(fmt("waitee '%s' done; %d left", waitee->name, waitees.size()));

From fe5509df9a58359a67da8c72ed8721cb3a33371d Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 24 Mar 2022 23:24:48 +0100
Subject: [PATCH 194/251] Only return wanted outputs

---
 src/libstore/build/derivation-goal.cc       | 5 +----
 src/libstore/build/local-derivation-goal.cc | 3 ++-
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index 40c445836..7dc5737fb 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -311,14 +311,11 @@ void DerivationGoal::outputsSubstitutionTried()
     gaveUpOnSubstitution();
 }
 
+
 /* At least one of the output paths could not be
    produced using a substitute.  So we have to build instead. */
 void DerivationGoal::gaveUpOnSubstitution()
 {
-    /* Make sure checkPathValidity() from now on checks all
-       outputs. */
-    wantedOutputs.clear();
-
     /* The inputs must be built before we can build this goal. */
     if (useDerivation)
         for (auto & i : dynamic_cast<Derivation *>(drv.get())->inputDrvs)
diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index 75e7e6ca3..ed83c4770 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -2613,7 +2613,8 @@ DrvOutputs LocalDerivationGoal::registerOutputs()
             signRealisation(thisRealisation);
             worker.store.registerDrvOutput(thisRealisation);
         }
-        builtOutputs.emplace(thisRealisation.id, thisRealisation);
+        if (wantedOutputs.empty() || wantedOutputs.count(outputName))
+            builtOutputs.emplace(thisRealisation.id, thisRealisation);
     }
 
     return builtOutputs;

From 540d7e33d879e21d34de0935292a65bf27f5e312 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 24 Mar 2022 23:25:12 +0100
Subject: [PATCH 195/251] Retry substitution after an incomplete closure only
 once

This avoids an infinite loop in the final test in
tests/binary-cache.sh. I think this was only not triggered previously
by accident (because we were clearing wantedOutputs in between).
---
 src/libstore/build/derivation-goal.cc | 5 ++---
 src/libstore/build/derivation-goal.hh | 8 ++++++--
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index 7dc5737fb..3d1c4fbc1 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -207,8 +207,6 @@ void DerivationGoal::haveDerivation()
     if (!drv->type().hasKnownOutputPaths())
         settings.requireExperimentalFeature(Xp::CaDerivations);
 
-    retrySubstitution = false;
-
     for (auto & i : drv->outputsAndOptPaths(worker.store))
         if (i.second.second)
             worker.store.addTempRoot(*i.second.second);
@@ -423,7 +421,8 @@ void DerivationGoal::inputsRealised()
         return;
     }
 
-    if (retrySubstitution) {
+    if (retrySubstitution && !retriedSubstitution) {
+        retriedSubstitution = true;
         haveDerivation();
         return;
     }
diff --git a/src/libstore/build/derivation-goal.hh b/src/libstore/build/derivation-goal.hh
index ea2db89b2..f556b6f25 100644
--- a/src/libstore/build/derivation-goal.hh
+++ b/src/libstore/build/derivation-goal.hh
@@ -61,8 +61,12 @@ struct DerivationGoal : public Goal
     bool needRestart = false;
 
     /* Whether to retry substituting the outputs after building the
-       inputs. */
-    bool retrySubstitution;
+       inputs. This is done in case of an incomplete closure. */
+    bool retrySubstitution = false;
+
+    /* Whether we've retried substitution, in which case we won't try
+       again. */
+    bool retriedSubstitution = false;
 
     /* The derivation stored at drvPath. */
     std::unique_ptr<Derivation> drv;

From 187dc080a2ab3403c1b1b47b3face205a4a67fb4 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 24 Mar 2022 23:36:14 +0100
Subject: [PATCH 196/251] tests/build.sh: Test that 'nix build' only prints
 wanted outputs

---
 tests/build.sh | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/tests/build.sh b/tests/build.sh
index c77f620f7..13a0f42be 100644
--- a/tests/build.sh
+++ b/tests/build.sh
@@ -1,15 +1,27 @@
 source common.sh
 
-expectedJSONRegex='\[\{"drvPath":".*multiple-outputs-a.drv","outputs":\{"first":".*multiple-outputs-a-first","second":".*multiple-outputs-a-second"}},\{"drvPath":".*multiple-outputs-b.drv","outputs":\{"out":".*multiple-outputs-b"}}]'
+clearStore
+
+# Make sure that 'nix build' only returns the outputs we asked for.
+nix build -f multiple-outputs.nix --json a --no-link | jq --exit-status '
+  (.[0] |
+    (.drvPath | match(".*multiple-outputs-a.drv")) and
+    (.outputs | keys | length == 1) and
+    (.outputs.first | match(".*multiple-outputs-a-first")))
+'
+
 nix build -f multiple-outputs.nix --json a.all b.all --no-link | jq --exit-status '
   (.[0] |
     (.drvPath | match(".*multiple-outputs-a.drv")) and
+    (.outputs | keys | length == 2) and
     (.outputs.first | match(".*multiple-outputs-a-first")) and
     (.outputs.second | match(".*multiple-outputs-a-second")))
   and (.[1] |
     (.drvPath | match(".*multiple-outputs-b.drv")) and
+    (.outputs | keys | length == 1) and
     (.outputs.out | match(".*multiple-outputs-b")))
 '
+
 testNormalization () {
     clearStore
     outPath=$(nix-build ./simple.nix --no-out-link)

From cbcb69a39ce7ceb300d5a5588258b7f8c0c0664d Mon Sep 17 00:00:00 2001
From: polykernel <81340136+polykernel@users.noreply.github.com>
Date: Sun, 20 Mar 2022 11:39:36 -0400
Subject: [PATCH 197/251] nix: allow whitespace characters before command in
 repl

Before this change, processLine always uses the first character
as the start of the line. This cause whitespaces to matter at the
beginning of the line whereas it does not matter anywhere else.

This commit trims leading white spaces of the string line so that
subsequent operations can be performed on the string without explicitly
tracking starting and ending indices of the string.
---
 src/nix/repl.cc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/nix/repl.cc b/src/nix/repl.cc
index 916353d8c..1f9d4fb4e 100644
--- a/src/nix/repl.cc
+++ b/src/nix/repl.cc
@@ -396,6 +396,7 @@ StorePath NixRepl::getDerivationPath(Value & v) {
 
 bool NixRepl::processLine(std::string line)
 {
+    line = trim(line);
     if (line == "") return true;
 
     _isInterrupted = false;

From 50c229ad9aeece3b4728fedb741d8ef7adb2b2c1 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 25 Mar 2022 08:02:49 +0100
Subject: [PATCH 198/251] Use wantOutput

Co-authored-by: John Ericson <git@JohnEricson.me>
---
 src/libstore/build/local-derivation-goal.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index ed83c4770..b176f318b 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -2613,7 +2613,7 @@ DrvOutputs LocalDerivationGoal::registerOutputs()
             signRealisation(thisRealisation);
             worker.store.registerDrvOutput(thisRealisation);
         }
-        if (wantedOutputs.empty() || wantedOutputs.count(outputName))
+        if (wantOutput(outputName, wantedOutputs))
             builtOutputs.emplace(thisRealisation.id, thisRealisation);
     }
 

From 86b05ccd54f2e98ac2b5cef3bcecb29ed6ec4fd8 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 25 Mar 2022 14:04:18 +0100
Subject: [PATCH 199/251] Only provide builtin.{getFlake,fetchClosure} is the
 corresponding experimental feature is enabled

This allows writing fallback code like

  if builtins ? fetchClosure then
    builtins.fetchClose { ... }
  else
    builtins.storePath ...
---
 doc/manual/src/release-notes/rl-next.md |  9 ++++++---
 src/libexpr/eval.cc                     | 17 -----------------
 src/libexpr/eval.hh                     |  6 ------
 src/libexpr/flake/flake.cc              |  9 ++++++---
 src/libexpr/primops.cc                  | 20 ++++++++++++--------
 src/libexpr/primops.hh                  |  2 ++
 src/libexpr/primops/fetchClosure.cc     |  6 ++++--
 src/nix/main.cc                         |  1 +
 8 files changed, 31 insertions(+), 39 deletions(-)

diff --git a/doc/manual/src/release-notes/rl-next.md b/doc/manual/src/release-notes/rl-next.md
index 33eaa8a2c..2ec864ee4 100644
--- a/doc/manual/src/release-notes/rl-next.md
+++ b/doc/manual/src/release-notes/rl-next.md
@@ -5,9 +5,12 @@
 * `nix store make-content-addressable` has been renamed to `nix store
   make-content-addressed`.
 
-* New builtin function `builtins.fetchClosure` that copies a closure
-  from a binary cache at evaluation time and rewrites it to
-  content-addressed form (if it isn't already). Like
+* New experimental builtin function `builtins.fetchClosure` that
+  copies a closure from a binary cache at evaluation time and rewrites
+  it to content-addressed form (if it isn't already). Like
   `builtins.storePath`, this allows importing pre-built store paths;
   the difference is that it doesn't require the user to configure
   binary caches and trusted public keys.
+
+  This function is only available if you enable the experimental
+  feature `fetch-closure`.
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 3ec5ed202..437c7fc53 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -507,23 +507,6 @@ EvalState::~EvalState()
 }
 
 
-void EvalState::requireExperimentalFeatureOnEvaluation(
-    const ExperimentalFeature & feature,
-    const std::string_view fName,
-    const Pos & pos)
-{
-    if (!settings.isExperimentalFeatureEnabled(feature)) {
-        throw EvalError({
-            .msg = hintfmt(
-                "Cannot call '%2%' because experimental Nix feature '%1%' is disabled. You can enable it via '--extra-experimental-features %1%'.",
-                feature,
-                fName
-            ),
-            .errPos = pos
-        });
-    }
-}
-
 void EvalState::allowPath(const Path & path)
 {
     if (allowedPaths)
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index 198a62ad2..ab46b448c 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -149,12 +149,6 @@ public:
         std::shared_ptr<Store> buildStore = nullptr);
     ~EvalState();
 
-    void requireExperimentalFeatureOnEvaluation(
-        const ExperimentalFeature &,
-        const std::string_view fName,
-        const Pos & pos
-    );
-
     void addToSearchPath(const std::string & s);
 
     SearchPath getSearchPath() { return searchPath; }
diff --git a/src/libexpr/flake/flake.cc b/src/libexpr/flake/flake.cc
index 6a1aca40d..fdcfb18d7 100644
--- a/src/libexpr/flake/flake.cc
+++ b/src/libexpr/flake/flake.cc
@@ -706,8 +706,6 @@ void callFlake(EvalState & state,
 
 static void prim_getFlake(EvalState & state, const Pos & pos, Value * * args, Value & v)
 {
-    state.requireExperimentalFeatureOnEvaluation(Xp::Flakes, "builtins.getFlake", pos);
-
     std::string flakeRefS(state.forceStringNoCtx(*args[0], pos));
     auto flakeRef = parseFlakeRef(flakeRefS, {}, true);
     if (evalSettings.pureEval && !flakeRef.input.isLocked())
@@ -723,7 +721,12 @@ static void prim_getFlake(EvalState & state, const Pos & pos, Value * * args, Va
         v);
 }
 
-static RegisterPrimOp r2("__getFlake", 1, prim_getFlake);
+static RegisterPrimOp r2({
+    .name =  "__getFlake",
+    .args = {"args"},
+    .fun = prim_getFlake,
+    .experimentalFeature = Xp::Flakes,
+});
 
 }
 
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index f5d9aa9ae..f3eb5e925 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -3814,7 +3814,7 @@ RegisterPrimOp::RegisterPrimOp(std::string name, size_t arity, PrimOpFun fun)
         .name = name,
         .args = {},
         .arity = arity,
-        .fun = fun
+        .fun = fun,
     });
 }
 
@@ -3886,13 +3886,17 @@ void EvalState::createBaseEnv()
 
     if (RegisterPrimOp::primOps)
         for (auto & primOp : *RegisterPrimOp::primOps)
-            addPrimOp({
-                .fun = primOp.fun,
-                .arity = std::max(primOp.args.size(), primOp.arity),
-                .name = symbols.create(primOp.name),
-                .args = primOp.args,
-                .doc = primOp.doc,
-            });
+            if (!primOp.experimentalFeature
+                || settings.isExperimentalFeatureEnabled(*primOp.experimentalFeature))
+            {
+                addPrimOp({
+                    .fun = primOp.fun,
+                    .arity = std::max(primOp.args.size(), primOp.arity),
+                    .name = symbols.create(primOp.name),
+                    .args = primOp.args,
+                    .doc = primOp.doc,
+                });
+            }
 
     /* Add a wrapper around the derivation primop that computes the
        `drvPath' and `outPath' attributes lazily. */
diff --git a/src/libexpr/primops.hh b/src/libexpr/primops.hh
index 5b16e075f..905bd0366 100644
--- a/src/libexpr/primops.hh
+++ b/src/libexpr/primops.hh
@@ -16,6 +16,7 @@ struct RegisterPrimOp
         size_t arity = 0;
         const char * doc;
         PrimOpFun fun;
+        std::optional<ExperimentalFeature> experimentalFeature;
     };
 
     typedef std::vector<Info> PrimOps;
@@ -35,6 +36,7 @@ struct RegisterPrimOp
 /* These primops are disabled without enableNativeCode, but plugins
    may wish to use them in limited contexts without globally enabling
    them. */
+
 /* Load a ValueInitializer from a DSO and return whatever it initializes */
 void prim_importNative(EvalState & state, const Pos & pos, Value * * args, Value & v);
 
diff --git a/src/libexpr/primops/fetchClosure.cc b/src/libexpr/primops/fetchClosure.cc
index 47f40ef33..efeb93daf 100644
--- a/src/libexpr/primops/fetchClosure.cc
+++ b/src/libexpr/primops/fetchClosure.cc
@@ -7,8 +7,6 @@ namespace nix {
 
 static void prim_fetchClosure(EvalState & state, const Pos & pos, Value * * args, Value & v)
 {
-    settings.requireExperimentalFeature(Xp::FetchClosure);
-
     state.forceAttrs(*args[0], pos);
 
     std::optional<std::string> fromStoreUrl;
@@ -145,8 +143,12 @@ static RegisterPrimOp primop_fetchClosure({
       specifying a binary cache from which the path can be fetched.
       Also, requiring a content-addressed final store path avoids the
       need for users to configure binary cache public keys.
+
+      This function is only available if you enable the experimental
+      feature `fetch-closure`.
     )",
     .fun = prim_fetchClosure,
+    .experimentalFeature = Xp::FetchClosure,
 });
 
 }
diff --git a/src/nix/main.cc b/src/nix/main.cc
index 9bc6c15fa..6198681e7 100644
--- a/src/nix/main.cc
+++ b/src/nix/main.cc
@@ -289,6 +289,7 @@ void mainWrapped(int argc, char * * argv)
     }
 
     if (argc == 2 && std::string(argv[1]) == "__dump-builtins") {
+        settings.experimentalFeatures = {Xp::Flakes, Xp::FetchClosure};
         evalSettings.pureEval = false;
         EvalState state({}, openStore("dummy://"));
         auto res = nlohmann::json::object();

From 8c363eb3eb3db96287a10eb5fcde23986a96164f Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 25 Mar 2022 14:19:55 +0100
Subject: [PATCH 200/251] Document getFlake

Fixes #5523.
---
 src/libexpr/flake/flake.cc | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/libexpr/flake/flake.cc b/src/libexpr/flake/flake.cc
index fdcfb18d7..22257c6b3 100644
--- a/src/libexpr/flake/flake.cc
+++ b/src/libexpr/flake/flake.cc
@@ -724,6 +724,24 @@ static void prim_getFlake(EvalState & state, const Pos & pos, Value * * args, Va
 static RegisterPrimOp r2({
     .name =  "__getFlake",
     .args = {"args"},
+    .doc = R"(
+      Fetch a flake from a flake reference, and return its output attributes and some metadata. For example:
+
+      ```nix
+      (builtins.getFlake "nix/55bc52401966fbffa525c574c14f67b00bc4fb3a").packages.x86_64-linux.nix
+      ```
+
+      Unless impure evaluation is allowed (`--impure`), the flake reference
+      must be "locked", e.g. contain a Git revision or content hash. An
+      example of an unlocked usage is:
+
+      ```nix
+      (builtins.getFlake "github:edolstra/dwarffs").rev
+      ```
+
+      This function is only available if you enable the experimental feature
+      `flakes`.
+    )",
     .fun = prim_getFlake,
     .experimentalFeature = Xp::Flakes,
 });

From fc35b11a7cde047cd799a6c83b0da312b713e0fb Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 25 Mar 2022 15:22:22 +0100
Subject: [PATCH 201/251] Fix mismatched tag warning on clang

---
 src/libexpr/eval.hh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index ab46b448c..e7915dd99 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -17,7 +17,7 @@
 namespace nix {
 
 
-struct Store;
+class Store;
 class EvalState;
 class StorePath;
 enum RepairFlag : bool;

From 247d2cb661218762a8a1fc0ee475a8ca856fcf17 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Sat, 26 Mar 2022 00:58:19 +0200
Subject: [PATCH 202/251] scripts/install-systemd-multi-user.sh: fix typo

sytemd-tmpfiles -> systemd-tmpfiles
---
 scripts/install-systemd-multi-user.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/install-systemd-multi-user.sh b/scripts/install-systemd-multi-user.sh
index 24884a023..1d92c5388 100755
--- a/scripts/install-systemd-multi-user.sh
+++ b/scripts/install-systemd-multi-user.sh
@@ -90,7 +90,7 @@ poly_configure_nix_daemon_service() {
               ln -sfn /nix/var/nix/profiles/default/$TMPFILES_SRC $TMPFILES_DEST
 
         _sudo "to run systemd-tmpfiles once to pick that path up" \
-             sytemd-tmpfiles create --prefix=/nix/var/nix
+             systemd-tmpfiles create --prefix=/nix/var/nix
 
         _sudo "to set up the nix-daemon service" \
               systemctl link "/nix/var/nix/profiles/default$SERVICE_SRC"

From 057f9ee1900312f42efe6c5cebb02b07b4ff2131 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 28 Mar 2022 14:21:35 +0200
Subject: [PATCH 203/251] nix profile install: Don't use
 queryDerivationOutputMap()

Instead get the outputs from Installable::build(). This will also
allow 'nix profile install' to support impure derivations.

Fixes #6286.
---
 src/libcmd/installables.cc   | 139 ++++++++++++++++++++---------------
 src/libcmd/installables.hh   |  12 +--
 src/libstore/derived-path.hh |   6 ++
 src/nix/profile.cc           |  35 ++++++---
 4 files changed, 116 insertions(+), 76 deletions(-)

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index 784117569..955bbe6fb 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -756,55 +756,20 @@ std::shared_ptr<Installable> SourceExprCommand::parseInstallable(
     return installables.front();
 }
 
-BuiltPaths getBuiltPaths(ref<Store> evalStore, ref<Store> store, const DerivedPaths & hopefullyBuiltPaths)
+BuiltPaths Installable::build(
+    ref<Store> evalStore,
+    ref<Store> store,
+    Realise mode,
+    const std::vector<std::shared_ptr<Installable>> & installables,
+    BuildMode bMode)
 {
     BuiltPaths res;
-    for (const auto & b : hopefullyBuiltPaths)
-        std::visit(
-            overloaded{
-                [&](const DerivedPath::Opaque & bo) {
-                    res.push_back(BuiltPath::Opaque{bo.path});
-                },
-                [&](const DerivedPath::Built & bfd) {
-                    OutputPathMap outputs;
-                    auto drv = evalStore->readDerivation(bfd.drvPath);
-                    auto outputHashes = staticOutputHashes(*evalStore, drv); // FIXME: expensive
-                    auto drvOutputs = drv.outputsAndOptPaths(*store);
-                    for (auto & output : bfd.outputs) {
-                        if (!outputHashes.count(output))
-                            throw Error(
-                                "the derivation '%s' doesn't have an output named '%s'",
-                                store->printStorePath(bfd.drvPath), output);
-                        if (settings.isExperimentalFeatureEnabled(Xp::CaDerivations)) {
-                            auto outputId =
-                                DrvOutput{outputHashes.at(output), output};
-                            auto realisation =
-                                store->queryRealisation(outputId);
-                            if (!realisation)
-                                throw Error(
-                                    "cannot operate on an output of unbuilt "
-                                    "content-addressed derivation '%s'",
-                                    outputId.to_string());
-                            outputs.insert_or_assign(
-                                output, realisation->outPath);
-                        } else {
-                            // If ca-derivations isn't enabled, assume that
-                            // the output path is statically known.
-                            assert(drvOutputs.count(output));
-                            assert(drvOutputs.at(output).second);
-                            outputs.insert_or_assign(
-                                output, *drvOutputs.at(output).second);
-                        }
-                    }
-                    res.push_back(BuiltPath::Built{bfd.drvPath, outputs});
-                },
-            },
-            b.raw());
-
+    for (auto & [_, builtPath] : build2(evalStore, store, mode, installables, bMode))
+        res.push_back(builtPath);
     return res;
 }
 
-BuiltPaths Installable::build(
+std::vector<std::pair<std::shared_ptr<Installable>, BuiltPath>> Installable::build2(
     ref<Store> evalStore,
     ref<Store> store,
     Realise mode,
@@ -815,39 +780,93 @@ BuiltPaths Installable::build(
         settings.readOnlyMode = true;
 
     std::vector<DerivedPath> pathsToBuild;
+    std::map<DerivedPath, std::vector<std::shared_ptr<Installable>>> backmap;
 
     for (auto & i : installables) {
-        auto b = i->toDerivedPaths();
-        pathsToBuild.insert(pathsToBuild.end(), b.begin(), b.end());
+        for (auto b : i->toDerivedPaths()) {
+            pathsToBuild.push_back(b);
+            backmap[b].push_back(i);
+        }
     }
 
+    std::vector<std::pair<std::shared_ptr<Installable>, BuiltPath>> res;
+
     switch (mode) {
+
     case Realise::Nothing:
     case Realise::Derivation:
         printMissing(store, pathsToBuild, lvlError);
-        return getBuiltPaths(evalStore, store, pathsToBuild);
+
+        for (auto & path : pathsToBuild) {
+            for (auto & installable : backmap[path]) {
+                std::visit(overloaded {
+                    [&](const DerivedPath::Built & bfd) {
+                        OutputPathMap outputs;
+                        auto drv = evalStore->readDerivation(bfd.drvPath);
+                        auto outputHashes = staticOutputHashes(*evalStore, drv); // FIXME: expensive
+                        auto drvOutputs = drv.outputsAndOptPaths(*store);
+                        for (auto & output : bfd.outputs) {
+                            if (!outputHashes.count(output))
+                                throw Error(
+                                    "the derivation '%s' doesn't have an output named '%s'",
+                                    store->printStorePath(bfd.drvPath), output);
+                            if (settings.isExperimentalFeatureEnabled(Xp::CaDerivations)) {
+                                DrvOutput outputId { outputHashes.at(output), output };
+                                auto realisation = store->queryRealisation(outputId);
+                                if (!realisation)
+                                    throw Error(
+                                        "cannot operate on an output of unbuilt "
+                                        "content-addressed derivation '%s'",
+                                        outputId.to_string());
+                                outputs.insert_or_assign(output, realisation->outPath);
+                            } else {
+                                // If ca-derivations isn't enabled, assume that
+                                // the output path is statically known.
+                                assert(drvOutputs.count(output));
+                                assert(drvOutputs.at(output).second);
+                                outputs.insert_or_assign(
+                                    output, *drvOutputs.at(output).second);
+                            }
+                        }
+                        res.push_back({installable, BuiltPath::Built { bfd.drvPath, outputs }});
+                    },
+                    [&](const DerivedPath::Opaque & bo) {
+                        res.push_back({installable, BuiltPath::Opaque { bo.path }});
+                    },
+                }, path.raw());
+            }
+        }
+
+        break;
+
     case Realise::Outputs: {
-        BuiltPaths res;
         for (auto & buildResult : store->buildPathsWithResults(pathsToBuild, bMode, evalStore)) {
             if (!buildResult.success())
                 buildResult.rethrow();
-            std::visit(overloaded {
-                [&](const DerivedPath::Built & bfd) {
-                    std::map<std::string, StorePath> outputs;
-                    for (auto & path : buildResult.builtOutputs)
-                        outputs.emplace(path.first.outputName, path.second.outPath);
-                    res.push_back(BuiltPath::Built { bfd.drvPath, outputs });
-                },
-                [&](const DerivedPath::Opaque & bo) {
-                    res.push_back(BuiltPath::Opaque { bo.path });
-                },
-            }, buildResult.path.raw());
+
+            for (auto & installable : backmap[buildResult.path]) {
+                std::visit(overloaded {
+                    [&](const DerivedPath::Built & bfd) {
+                        std::map<std::string, StorePath> outputs;
+                        for (auto & path : buildResult.builtOutputs)
+                            outputs.emplace(path.first.outputName, path.second.outPath);
+                        res.push_back({installable, BuiltPath::Built { bfd.drvPath, outputs }});
+                    },
+                    [&](const DerivedPath::Opaque & bo) {
+                        res.push_back({installable, BuiltPath::Opaque { bo.path }});
+                    },
+                }, buildResult.path.raw());
+            }
         }
-        return res;
+
+        break;
     }
+
     default:
         assert(false);
     }
+
+    return res;
 }
 
 BuiltPaths Installable::toBuiltPaths(
diff --git a/src/libcmd/installables.hh b/src/libcmd/installables.hh
index e172b71b0..f4bf0d406 100644
--- a/src/libcmd/installables.hh
+++ b/src/libcmd/installables.hh
@@ -98,6 +98,13 @@ struct Installable
         const std::vector<std::shared_ptr<Installable>> & installables,
         BuildMode bMode = bmNormal);
 
+    static std::vector<std::pair<std::shared_ptr<Installable>, BuiltPath>> build2(
+        ref<Store> evalStore,
+        ref<Store> store,
+        Realise mode,
+        const std::vector<std::shared_ptr<Installable>> & installables,
+        BuildMode bMode = bmNormal);
+
     static std::set<StorePath> toStorePaths(
         ref<Store> evalStore,
         ref<Store> store,
@@ -185,9 +192,4 @@ ref<eval_cache::EvalCache> openEvalCache(
     EvalState & state,
     std::shared_ptr<flake::LockedFlake> lockedFlake);
 
-BuiltPaths getBuiltPaths(
-    ref<Store> evalStore,
-    ref<Store> store,
-    const DerivedPaths & hopefullyBuiltPaths);
-
 }
diff --git a/src/libstore/derived-path.hh b/src/libstore/derived-path.hh
index 8ca0882a4..24a0ae773 100644
--- a/src/libstore/derived-path.hh
+++ b/src/libstore/derived-path.hh
@@ -25,6 +25,9 @@ struct DerivedPathOpaque {
     nlohmann::json toJSON(ref<Store> store) const;
     std::string to_string(const Store & store) const;
     static DerivedPathOpaque parse(const Store & store, std::string_view);
+
+    bool operator < (const DerivedPathOpaque & b) const
+    { return path < b.path; }
 };
 
 /**
@@ -46,6 +49,9 @@ struct DerivedPathBuilt {
     std::string to_string(const Store & store) const;
     static DerivedPathBuilt parse(const Store & store, std::string_view);
     nlohmann::json toJSON(ref<Store> store) const;
+
+    bool operator < (const DerivedPathBuilt & b) const
+    { return std::make_pair(drvPath, outputs) < std::make_pair(b.drvPath, b.outputs); }
 };
 
 using _DerivedPathRaw = std::variant<
diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index da990ddc8..f35947ddb 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -62,22 +62,21 @@ struct ProfileElement
         return std::tuple(describe(), storePaths) < std::tuple(other.describe(), other.storePaths);
     }
 
-    void updateStorePaths(ref<Store> evalStore, ref<Store> store, Installable & installable)
+    void updateStorePaths(
+        ref<Store> evalStore,
+        ref<Store> store,
+        const BuiltPaths & builtPaths)
     {
         // FIXME: respect meta.outputsToInstall
         storePaths.clear();
-        for (auto & buildable : getBuiltPaths(evalStore, store, installable.toDerivedPaths())) {
+        for (auto & buildable : builtPaths) {
             std::visit(overloaded {
                 [&](const BuiltPath::Opaque & bo) {
                     storePaths.insert(bo.path);
                 },
                 [&](const BuiltPath::Built & bfd) {
-                    // TODO: Why are we querying if we know the output
-                    // names already? Is it just to figure out what the
-                    // default one is?
-                    for (auto & output : store->queryDerivationOutputMap(bfd.drvPath)) {
+                    for (auto & output : bfd.outputs)
                         storePaths.insert(output.second);
-                    }
                 },
             }, buildable.raw());
         }
@@ -236,6 +235,16 @@ struct ProfileManifest
     }
 };
 
+static std::map<Installable *, BuiltPaths>
+builtPathsPerInstallable(
+    const std::vector<std::pair<std::shared_ptr<Installable>, BuiltPath>> & builtPaths)
+{
+    std::map<Installable *, BuiltPaths> res;
+    for (auto & [installable, builtPath] : builtPaths)
+        res[installable.get()].push_back(builtPath);
+    return res;
+}
+
 struct CmdProfileInstall : InstallablesCommand, MixDefaultProfile
 {
     std::string description() override
@@ -254,7 +263,9 @@ struct CmdProfileInstall : InstallablesCommand, MixDefaultProfile
     {
         ProfileManifest manifest(*getEvalState(), *profile);
 
-        auto builtPaths = Installable::build(getEvalStore(), store, Realise::Outputs, installables, bmNormal);
+        auto builtPaths = builtPathsPerInstallable(
+            Installable::build2(
+                getEvalStore(), store, Realise::Outputs, installables, bmNormal));
 
         for (auto & installable : installables) {
             ProfileElement element;
@@ -269,7 +280,7 @@ struct CmdProfileInstall : InstallablesCommand, MixDefaultProfile
                 };
             }
 
-            element.updateStorePaths(getEvalStore(), store, *installable);
+            element.updateStorePaths(getEvalStore(), store, builtPaths[installable.get()]);
 
             manifest.elements.push_back(std::move(element));
         }
@@ -457,12 +468,14 @@ struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProf
             warn ("Use 'nix profile list' to see the current profile.");
         }
 
-        auto builtPaths = Installable::build(getEvalStore(), store, Realise::Outputs, installables, bmNormal);
+        auto builtPaths = builtPathsPerInstallable(
+            Installable::build2(
+                getEvalStore(), store, Realise::Outputs, installables, bmNormal));
 
         for (size_t i = 0; i < installables.size(); ++i) {
             auto & installable = installables.at(i);
             auto & element = manifest.elements[indices.at(i)];
-            element.updateStorePaths(getEvalStore(), store, *installable);
+            element.updateStorePaths(getEvalStore(), store, builtPaths[installable.get()]);
         }
 
         updateProfile(manifest.build(store));

From b266fd53dda9c303c55ceb55752c2117011fce69 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 28 Mar 2022 14:58:38 +0200
Subject: [PATCH 204/251] nix {run,shell}: Print a better error message if the
 store is not local

Closes #6317
---
 src/nix/run.cc | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/nix/run.cc b/src/nix/run.cc
index 033263c36..23e893fbf 100644
--- a/src/nix/run.cc
+++ b/src/nix/run.cc
@@ -38,9 +38,12 @@ void runProgramInStore(ref<Store> store,
        unshare(CLONE_NEWUSER) doesn't work in a multithreaded program
        (which "nix" is), so we exec() a single-threaded helper program
        (chrootHelper() below) to do the work. */
-    auto store2 = store.dynamic_pointer_cast<LocalStore>();
+    auto store2 = store.dynamic_pointer_cast<LocalFSStore>();
 
-    if (store2 && store->storeDir != store2->getRealStoreDir()) {
+    if (!store2)
+        throw Error("store '%s' is not a local store so it does not support command execution", store->getUri());
+
+    if (store->storeDir != store2->getRealStoreDir()) {
         Strings helperArgs = { chrootHelperName, store->storeDir, store2->getRealStoreDir(), program };
         for (auto & arg : args) helperArgs.push_back(arg);
 

From 390269ed8784b1a73a3310e63eb96a4b62861654 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9ophane=20Hufschmitt?= <theophane@hufschmitt.net>
Date: Wed, 16 Mar 2022 14:21:09 +0100
Subject: [PATCH 205/251] Simplify the handling of the hash modulo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rather than having four different but very similar types of hashes, make
only one, with a tag indicating whether it corresponds to a regular of
deferred derivation.

This implies a slight logical change: The original Nix+multiple-outputs
model assumed only one hash-modulo per derivation. Adding
multiple-outputs CA derivations changed this as these have one
hash-modulo per output. This change is now treating each derivation as
having one hash modulo per output.
This obviously means that we internally loose the guaranty that
all the outputs of input-addressed derivations have the same hash
modulo. But it turns out that it doesn’t matter because there’s nothing
in the code taking advantage of that fact (and it probably shouldn’t
anyways).

The upside is that it is now much easier to work with these hashes, and
we can get rid of a lot of useless `std::visit{ overloaded`.

Co-authored-by: John Ericson <John.Ericson@Obsidian.Systems>
---
 src/libexpr/primops.cc      | 48 ++++++++++-------------
 src/libstore/derivations.cc | 77 +++++++++++--------------------------
 src/libstore/derivations.hh | 36 ++++-------------
 src/libstore/local-store.cc |  9 ++---
 src/nix/develop.cc          |  4 +-
 5 files changed, 56 insertions(+), 118 deletions(-)

diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index f3eb5e925..9f549e52f 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1222,34 +1222,26 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
                 DerivationOutput::Deferred { });
         }
 
-        // Regular, non-CA derivation should always return a single hash and not
-        // hash per output.
-        auto hashModulo = hashDerivationModulo(*state.store, drv, true);
-        std::visit(overloaded {
-            [&](const DrvHash & drvHash) {
-                auto & h = drvHash.hash;
-                switch (drvHash.kind) {
-                case DrvHash::Kind::Deferred:
-                    /* Outputs already deferred, nothing to do */
-                    break;
-                case DrvHash::Kind::Regular:
-                    for (auto & [outputName, output] : drv.outputs) {
-                        auto outPath = state.store->makeOutputPath(outputName, h, drvName);
-                        drv.env[outputName] = state.store->printStorePath(outPath);
-                        output = DerivationOutput::InputAddressed {
-                            .path = std::move(outPath),
-                        };
-                    }
-                    break;
-                }
-            },
-            [&](const CaOutputHashes &) {
-                // Shouldn't happen as the toplevel derivation is not CA.
-                assert(false);
-            },
-        },
-        hashModulo.raw());
-
+        auto hashModulo = hashDerivationModulo(*state.store, Derivation(drv), true);
+        switch (hashModulo.kind) {
+        case DrvHash::Kind::Regular:
+            for (auto & i : outputs) {
+                auto h = hashModulo.hashes.at(i);
+                auto outPath = state.store->makeOutputPath(i, h, drvName);
+                drv.env[i] = state.store->printStorePath(outPath);
+                drv.outputs.insert_or_assign(
+                    i,
+                    DerivationOutputInputAddressed {
+                        .path = std::move(outPath),
+                    });
+            }
+            break;
+            ;
+        case DrvHash::Kind::Deferred:
+            for (auto & i : outputs) {
+                drv.outputs.insert_or_assign(i, DerivationOutputDeferred {});
+            }
+        }
     }
 
     /* Write the resulting term into the Nix store directory. */
diff --git a/src/libstore/derivations.cc b/src/libstore/derivations.cc
index 7fed80387..85d75523f 100644
--- a/src/libstore/derivations.cc
+++ b/src/libstore/derivations.cc
@@ -474,7 +474,7 @@ Sync<DrvHashes> drvHashes;
 /* Look up the derivation by value and memoize the
    `hashDerivationModulo` call.
  */
-static const DrvHashModulo pathDerivationModulo(Store & store, const StorePath & drvPath)
+static const DrvHash pathDerivationModulo(Store & store, const StorePath & drvPath)
 {
     {
         auto hashes = drvHashes.lock();
@@ -509,7 +509,7 @@ static const DrvHashModulo pathDerivationModulo(Store & store, const StorePath &
    don't leak the provenance of fixed outputs, reducing pointless cache
    misses as the build itself won't know this.
  */
-DrvHashModulo hashDerivationModulo(Store & store, const Derivation & drv, bool maskOutputs)
+DrvHash hashDerivationModulo(Store & store, const Derivation & drv, bool maskOutputs)
 {
     auto type = drv.type();
 
@@ -524,7 +524,10 @@ DrvHashModulo hashDerivationModulo(Store & store, const Derivation & drv, bool m
                 + store.printStorePath(dof.path(store, drv.name, i.first)));
             outputHashes.insert_or_assign(i.first, std::move(hash));
         }
-        return outputHashes;
+        return DrvHash{
+            .hashes = outputHashes,
+            .kind = DrvHash::Kind::Regular,
+        };
     }
 
     auto kind = std::visit(overloaded {
@@ -540,65 +543,36 @@ DrvHashModulo hashDerivationModulo(Store & store, const Derivation & drv, bool m
         },
     }, drv.type().raw());
 
-    /* For other derivations, replace the inputs paths with recursive
-       calls to this function. */
     std::map<std::string, StringSet> inputs2;
     for (auto & [drvPath, inputOutputs0] : drv.inputDrvs) {
         // Avoid lambda capture restriction with standard / Clang
         auto & inputOutputs = inputOutputs0;
         const auto & res = pathDerivationModulo(store, drvPath);
-        std::visit(overloaded {
-            // Regular non-CA derivation, replace derivation
-            [&](const DrvHash & drvHash) {
-                kind |= drvHash.kind;
-                inputs2.insert_or_assign(drvHash.hash.to_string(Base16, false), inputOutputs);
-            },
-            // CA derivation's output hashes
-            [&](const CaOutputHashes & outputHashes) {
-                std::set<std::string> justOut = { "out" };
-                for (auto & output : inputOutputs) {
-                    /* Put each one in with a single "out" output.. */
-                    const auto h = outputHashes.at(output);
-                    inputs2.insert_or_assign(
-                        h.to_string(Base16, false),
-                        justOut);
-                }
-            },
-        }, res.raw());
+        if (res.kind == DrvHash::Kind::Deferred)
+            kind = DrvHash::Kind::Deferred;
+        for (auto & outputName : inputOutputs) {
+            const auto h = res.hashes.at(outputName);
+            inputs2[h.to_string(Base16, false)].insert(outputName);
+        }
     }
 
     auto hash = hashString(htSHA256, drv.unparse(store, maskOutputs, &inputs2));
 
-    return DrvHash { .hash = hash, .kind = kind };
-}
-
-
-void operator |= (DrvHash::Kind & self, const DrvHash::Kind & other) noexcept
-{
-    switch (other) {
-    case DrvHash::Kind::Regular:
-        break;
-    case DrvHash::Kind::Deferred:
-        self = other;
-        break;
+    std::map<std::string, Hash> outputHashes;
+    for (const auto & [outputName, _] : drv.outputs) {
+        outputHashes.insert_or_assign(outputName, hash);
     }
+
+    return DrvHash {
+        .hashes = outputHashes,
+        .kind = kind,
+    };
 }
 
 
 std::map<std::string, Hash> staticOutputHashes(Store & store, const Derivation & drv)
 {
-    std::map<std::string, Hash> res;
-    std::visit(overloaded {
-        [&](const DrvHash & drvHash) {
-            for (auto & outputName : drv.outputNames()) {
-                res.insert({outputName, drvHash.hash});
-            }
-        },
-        [&](const CaOutputHashes & outputHashes) {
-            res = outputHashes;
-        },
-    }, hashDerivationModulo(store, drv, true).raw());
-    return res;
+    return hashDerivationModulo(store, drv, true).hashes;
 }
 
 
@@ -747,7 +721,7 @@ static void rewriteDerivation(Store & store, BasicDerivation & drv, const String
     auto hashModulo = hashDerivationModulo(store, Derivation(drv), true);
     for (auto & [outputName, output] : drv.outputs) {
         if (std::holds_alternative<DerivationOutput::Deferred>(output.raw())) {
-            auto & h = hashModulo.requireNoFixedNonDeferred();
+            auto & h = hashModulo.hashes.at(outputName);
             auto outPath = store.makeOutputPath(outputName, h, drv.name);
             drv.env[outputName] = store.printStorePath(outPath);
             output = DerivationOutput::InputAddressed {
@@ -758,13 +732,6 @@ static void rewriteDerivation(Store & store, BasicDerivation & drv, const String
 
 }
 
-const Hash & DrvHashModulo::requireNoFixedNonDeferred() const {
-    auto * drvHashOpt = std::get_if<DrvHash>(&raw());
-    assert(drvHashOpt);
-    assert(drvHashOpt->kind == DrvHash::Kind::Regular);
-    return drvHashOpt->hash;
-}
-
 static bool tryResolveInput(
     Store & store, StorePathSet & inputSrcs, StringMap & inputRewrites,
     const StorePath & inputDrv, const StringSet & inputOutputs)
diff --git a/src/libstore/derivations.hh b/src/libstore/derivations.hh
index 8dea90abf..63ea5ef76 100644
--- a/src/libstore/derivations.hh
+++ b/src/libstore/derivations.hh
@@ -202,12 +202,14 @@ bool isDerivation(const std::string & fileName);
    the output name is "out". */
 std::string outputPathName(std::string_view drvName, std::string_view outputName);
 
-// known CA drv's output hashes, current just for fixed-output derivations
-// whose output hashes are always known since they are fixed up-front.
-typedef std::map<std::string, Hash> CaOutputHashes;
 
+// The hashes modulo of a derivation.
+//
+// Each output is given a hash, although in practice only the content-addressed
+// derivations (fixed-output or not) will have a different hash for each
+// output.
 struct DrvHash {
-    Hash hash;
+    std::map<std::string, Hash> hashes;
 
     enum struct Kind: bool {
         // Statically determined derivations.
@@ -222,28 +224,6 @@ struct DrvHash {
 
 void operator |= (DrvHash::Kind & self, const DrvHash::Kind & other) noexcept;
 
-typedef std::variant<
-    // Regular normalized derivation hash, and whether it was deferred (because
-    // an ancestor derivation is a floating content addressed derivation).
-    DrvHash,
-    // Fixed-output derivation hashes
-    CaOutputHashes
-> _DrvHashModuloRaw;
-
-struct DrvHashModulo : _DrvHashModuloRaw {
-    using Raw = _DrvHashModuloRaw;
-    using Raw::Raw;
-
-    /* Get hash, throwing if it is per-output CA hashes or a
-       deferred Drv hash.
-     */
-    const Hash & requireNoFixedNonDeferred() const;
-
-    inline const Raw & raw() const {
-        return static_cast<const Raw &>(*this);
-    }
-};
-
 /* Returns hashes with the details of fixed-output subderivations
    expunged.
 
@@ -267,7 +247,7 @@ struct DrvHashModulo : _DrvHashModuloRaw {
    ATerm, after subderivations have been likewise expunged from that
    derivation.
  */
-DrvHashModulo hashDerivationModulo(Store & store, const Derivation & drv, bool maskOutputs);
+DrvHash hashDerivationModulo(Store & store, const Derivation & drv, bool maskOutputs);
 
 /*
    Return a map associating each output to a hash that uniquely identifies its
@@ -276,7 +256,7 @@ DrvHashModulo hashDerivationModulo(Store & store, const Derivation & drv, bool m
 std::map<std::string, Hash> staticOutputHashes(Store& store, const Derivation& drv);
 
 /* Memoisation of hashDerivationModulo(). */
-typedef std::map<StorePath, DrvHashModulo> DrvHashes;
+typedef std::map<StorePath, DrvHash> DrvHashes;
 
 // FIXME: global, though at least thread-safe.
 extern Sync<DrvHashes> drvHashes;
diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index 46a547db1..60fe53af1 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -695,16 +695,15 @@ void LocalStore::checkDerivationOutputs(const StorePath & drvPath, const Derivat
     // combinations that are currently prohibited.
     drv.type();
 
-    std::optional<Hash> h;
+    std::optional<DrvHash> hashesModulo;
     for (auto & i : drv.outputs) {
         std::visit(overloaded {
             [&](const DerivationOutput::InputAddressed & doia) {
-                if (!h) {
+                if (!hashesModulo) {
                     // somewhat expensive so we do lazily
-                    auto h0 = hashDerivationModulo(*this, drv, true);
-                    h = h0.requireNoFixedNonDeferred();
+                    hashesModulo = hashDerivationModulo(*this, drv, true);
                 }
-                StorePath recomputed = makeOutputPath(i.first, *h, drvName);
+                StorePath recomputed = makeOutputPath(i.first, hashesModulo->hashes.at(i.first), drvName);
                 if (doia.path != recomputed)
                     throw Error("derivation '%s' has incorrect output '%s', should be '%s'",
                         printStorePath(drvPath), printStorePath(doia.path), printStorePath(recomputed));
diff --git a/src/nix/develop.cc b/src/nix/develop.cc
index d2f9b5a6a..7fc74d34e 100644
--- a/src/nix/develop.cc
+++ b/src/nix/develop.cc
@@ -204,10 +204,10 @@ static StorePath getDerivationEnvironment(ref<Store> store, ref<Store> evalStore
             output.second = DerivationOutput::Deferred { };
             drv.env[output.first] = "";
         }
-        auto h0 = hashDerivationModulo(*evalStore, drv, true);
-        const Hash & h = h0.requireNoFixedNonDeferred();
+        auto hashesModulo = hashDerivationModulo(*evalStore, drv, true);
 
         for (auto & output : drv.outputs) {
+            Hash h = hashesModulo.hashes.at(output.first);
             auto outPath = store->makeOutputPath(output.first, h, drv.name);
             output.second = DerivationOutput::InputAddressed {
                 .path = outPath,

From 3b26dd51ff0d7b51ec90141bfe2d05b52a4ecfd4 Mon Sep 17 00:00:00 2001
From: Graham Christensen <graham@grahamc.com>
Date: Tue, 29 Mar 2022 21:05:57 -0400
Subject: [PATCH 206/251] nix-daemon.service: require mounts for
 /nix/var/nix/db

Users may want to mount a filesystem just for the Nix database, with
the filesystem's parameters specially tuned for sqlite. For example, on
ZFS you might set the recordsize to 64k after changing the database's
page size to 65536.
---
 misc/systemd/nix-daemon.service.in | 1 +
 1 file changed, 1 insertion(+)

diff --git a/misc/systemd/nix-daemon.service.in b/misc/systemd/nix-daemon.service.in
index b4badf2ba..24d894898 100644
--- a/misc/systemd/nix-daemon.service.in
+++ b/misc/systemd/nix-daemon.service.in
@@ -3,6 +3,7 @@ Description=Nix Daemon
 Documentation=man:nix-daemon https://nixos.org/manual
 RequiresMountsFor=@storedir@
 RequiresMountsFor=@localstatedir@
+RequiresMountsFor=@localstatedir@/nix/db
 ConditionPathIsReadWrite=@localstatedir@/nix/daemon-socket
 
 [Service]

From 8dee15cd31f634183c32649e9e62e576e12e5cfc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9ophane=20Hufschmitt?= <theophane@hufschmitt.net>
Date: Wed, 30 Mar 2022 11:42:47 +0200
Subject: [PATCH 207/251] =?UTF-8?q?Don=E2=80=99t=20create=20a=20file=20in?=
 =?UTF-8?q?=20the=20worktree=20in=20the=20fetchPath=20test?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tests/fetchPath.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/fetchPath.sh b/tests/fetchPath.sh
index 8f17638e9..29be38ce2 100644
--- a/tests/fetchPath.sh
+++ b/tests/fetchPath.sh
@@ -1,6 +1,6 @@
 source common.sh
 
-touch foo -t 202211111111
+touch $TEST_ROOT/foo -t 202211111111
 # We only check whether 2022-11-1* **:**:** is the last modified date since
 # `lastModified` is transformed into UTC in `builtins.fetchTarball`.
-[[ "$(nix eval --impure --raw --expr "(builtins.fetchTree \"path://$PWD/foo\").lastModifiedDate")" =~ 2022111.* ]]
+[[ "$(nix eval --impure --raw --expr "(builtins.fetchTree \"path://$TEST_ROOT/foo\").lastModifiedDate")" =~ 2022111.* ]]

From 87f867ef62e7c391955fb1ca3f78bfd532e6666b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9ophane=20Hufschmitt?= <theophane@hufschmitt.net>
Date: Wed, 30 Mar 2022 11:43:08 +0200
Subject: [PATCH 208/251] Gitignore the generated systemd nix-daemon conf file

---
 .gitignore | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitignore b/.gitignore
index 4b290425a..58e7377fb 100644
--- a/.gitignore
+++ b/.gitignore
@@ -90,6 +90,7 @@ perl/Makefile.config
 
 /misc/systemd/nix-daemon.service
 /misc/systemd/nix-daemon.socket
+/misc/systemd/nix-daemon.conf
 /misc/upstart/nix-daemon.conf
 
 /src/resolve-system-dependencies/resolve-system-dependencies

From fa83b865a2cfd21d7e63eedb206c1e07c8178965 Mon Sep 17 00:00:00 2001
From: Daniel Pauls <daniel1708.de+git@gmail.com>
Date: Wed, 30 Mar 2022 15:41:25 +0200
Subject: [PATCH 209/251] libexpr: Throw the correct error in toJSON

BaseError::addTrace(...) returns a BaseError, but we want to
throw a TypeError instead.

Fixes #6336.
---
 src/libexpr/value-to-json.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/libexpr/value-to-json.cc b/src/libexpr/value-to-json.cc
index 517da4c01..7b35abca2 100644
--- a/src/libexpr/value-to-json.cc
+++ b/src/libexpr/value-to-json.cc
@@ -84,7 +84,8 @@ void printValueAsJSON(EvalState & state, bool strict,
                 .msg = hintfmt("cannot convert %1% to JSON", showType(v)),
                 .errPos = v.determinePos(pos)
             });
-            throw e.addTrace(pos, hintfmt("message for the trace"));
+            e.addTrace(pos, hintfmt("message for the trace"));
+            throw e;
     }
 }
 

From 629edd43ba7550be835660fe5df3b65cc4a515c7 Mon Sep 17 00:00:00 2001
From: Daniel Pauls <daniel1708.de+git@gmail.com>
Date: Wed, 30 Mar 2022 17:30:47 +0200
Subject: [PATCH 210/251] libutil: Change return value of addTrace to void

The return value of BaseError::addTrace(...) is never used and
error-prone as subclasses calling it will return a BaseError instead of
the subclass.
This commit changes its return value to be void.
---
 src/libutil/error.cc | 3 +--
 src/libutil/error.hh | 6 +++---
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/src/libutil/error.cc b/src/libutil/error.cc
index b2dfb35b2..02bc5caa5 100644
--- a/src/libutil/error.cc
+++ b/src/libutil/error.cc
@@ -9,10 +9,9 @@ namespace nix {
 
 const std::string nativeSystem = SYSTEM;
 
-BaseError & BaseError::addTrace(std::optional<ErrPos> e, hintformat hint)
+void BaseError::addTrace(std::optional<ErrPos> e, hintformat hint)
 {
     err.traces.push_front(Trace { .pos = e, .hint = hint });
-    return *this;
 }
 
 // c++ std::exception descendants must have a 'const char* what()' function.
diff --git a/src/libutil/error.hh b/src/libutil/error.hh
index 93b789f0b..6a757f9ad 100644
--- a/src/libutil/error.hh
+++ b/src/libutil/error.hh
@@ -175,12 +175,12 @@ public:
     const ErrorInfo & info() const { calcWhat(); return err; }
 
     template<typename... Args>
-    BaseError & addTrace(std::optional<ErrPos> e, const std::string & fs, const Args & ... args)
+    void addTrace(std::optional<ErrPos> e, const std::string & fs, const Args & ... args)
     {
-        return addTrace(e, hintfmt(fs, args...));
+        addTrace(e, hintfmt(fs, args...));
     }
 
-    BaseError & addTrace(std::optional<ErrPos> e, hintformat hint);
+    void addTrace(std::optional<ErrPos> e, hintformat hint);
 
     bool hasTrace() const { return !err.traces.empty(); }
 };

From d77823b502ebc358d33a7719375677fed92291c8 Mon Sep 17 00:00:00 2001
From: Tom Bereknyei <tomberek@gmail.com>
Date: Wed, 30 Mar 2022 16:10:42 -0400
Subject: [PATCH 211/251] bundler: update default bundler to support new
 bundler API

---
 src/nix/bundle.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/nix/bundle.cc b/src/nix/bundle.cc
index 7ed558dee..81fb8464a 100644
--- a/src/nix/bundle.cc
+++ b/src/nix/bundle.cc
@@ -9,7 +9,7 @@ using namespace nix;
 
 struct CmdBundle : InstallableCommand
 {
-    std::string bundler = "github:matthewbauer/nix-bundle";
+    std::string bundler = "github:NixOS/bundlers";
     std::optional<Path> outLink;
 
     CmdBundle()

From 50f9f335c92a88e8c9bd3421e6befbcd06cac4ec Mon Sep 17 00:00:00 2001
From: Tom Bereknyei <tomberek@gmail.com>
Date: Wed, 30 Mar 2022 16:35:26 -0400
Subject: [PATCH 212/251] profile!: consistent use of url/uri. create new
 version

---
 src/nix/profile.cc | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index f35947ddb..b151e48d6 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -97,19 +97,30 @@ struct ProfileManifest
             auto json = nlohmann::json::parse(readFile(manifestPath));
 
             auto version = json.value("version", 0);
-            if (version != 1)
-                throw Error("profile manifest '%s' has unsupported version %d", manifestPath, version);
+            std::string sUrl;
+            std::string sOriginalUrl;
+            switch(version){
+                case 1:
+                    sUrl = "uri";
+                    sOriginalUrl = "originalUri";
+                    break;
+                case 2:
+                    sUrl = "url";
+                    sOriginalUrl = "originalUrl";
+                    break;
+                default:
+                    throw Error("profile manifest '%s' has unsupported version %d", manifestPath, version);
+            }
 
             for (auto & e : json["elements"]) {
                 ProfileElement element;
                 for (auto & p : e["storePaths"])
                     element.storePaths.insert(state.store->parseStorePath((std::string) p));
                 element.active = e["active"];
-                if (e.value("uri", "") != "") {
-                    auto originalUrl = e.value("originalUrl", e["originalUri"]);
+                if (e.value(sUrl,"") != "") {
                     element.source = ProfileElementSource{
-                        parseFlakeRef(originalUrl),
-                        parseFlakeRef(e["uri"]),
+                        parseFlakeRef(e[sOriginalUrl]),
+                        parseFlakeRef(e[sUrl]),
                         e["attrPath"]
                     };
                 }
@@ -144,13 +155,13 @@ struct ProfileManifest
             obj["active"] = element.active;
             if (element.source) {
                 obj["originalUrl"] = element.source->originalRef.to_string();
-                obj["uri"] = element.source->resolvedRef.to_string();
+                obj["url"] = element.source->resolvedRef.to_string();
                 obj["attrPath"] = element.source->attrPath;
             }
             array.push_back(obj);
         }
         nlohmann::json json;
-        json["version"] = 1;
+        json["version"] = 2;
         json["elements"] = array;
         return json.dump();
     }

From 28309352d991f50c9d8b54a5a0ee99995a1a5297 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 31 Mar 2022 10:39:53 +0200
Subject: [PATCH 213/251] replaceEnv(): Pass newEnv by reference

---
 src/libutil/util.cc | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 70eaf4f9c..59e3aad6d 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -71,13 +71,11 @@ void clearEnv()
         unsetenv(name.first.c_str());
 }
 
-void replaceEnv(std::map<std::string, std::string> newEnv)
+void replaceEnv(const std::map<std::string, std::string> & newEnv)
 {
     clearEnv();
-    for (auto newEnvVar : newEnv)
-    {
+    for (auto & newEnvVar : newEnv)
         setenv(newEnvVar.first.c_str(), newEnvVar.second.c_str(), 1);
-    }
 }
 
 

From 5cd72598feaff3c4bbcc7304a4844768f64a1ee0 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 30 Mar 2022 16:31:01 +0200
Subject: [PATCH 214/251] Add support for impure derivations

Impure derivations are derivations that can produce a different result
every time they're built. Example:

  stdenv.mkDerivation {
    name = "impure";
    __impure = true; # marks this derivation as impure
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
    buildCommand = "date > $out";
  };

Some important characteristics:

* This requires the 'impure-derivations' experimental feature.

* Impure derivations are not "cached". Thus, running "nix-build" on
  the example above multiple times will cause a rebuild every time.

* They are implemented similar to CA derivations, i.e. the output is
  moved to a content-addressed path in the store. The difference is
  that we don't register a realisation in the Nix database.

* Pure derivations are not allowed to depend on impure derivations. In
  the future fixed-output derivations will be allowed to depend on
  impure derivations, thus forming an "impurity barrier" in the
  dependency graph.

* When sandboxing is enabled, impure derivations can access the
  network in the same way as fixed-output derivations. In relaxed
  sandboxing mode, they can access the local filesystem.
---
 src/libexpr/eval.cc                         |   1 +
 src/libexpr/eval.hh                         |   2 +-
 src/libexpr/primops.cc                      |  32 ++-
 src/libstore/build/derivation-goal.cc       | 182 +++++++++------
 src/libstore/build/derivation-goal.hh       |   7 +
 src/libstore/build/local-derivation-goal.cc |  21 +-
 src/libstore/derivations.cc                 | 235 +++++++++++++++-----
 src/libstore/derivations.hh                 |  52 ++++-
 src/libstore/local-store.cc                 |   3 +
 src/libstore/path.cc                        |   9 +
 src/libstore/path.hh                        |   2 +
 src/libutil/experimental-features.cc        |   1 +
 src/libutil/experimental-features.hh        |   1 +
 src/nix/show-derivation.cc                  |   4 +
 tests/impure-derivations.nix                |  46 ++++
 tests/impure-derivations.sh                 |  39 ++++
 tests/local.mk                              |   3 +-
 17 files changed, 486 insertions(+), 154 deletions(-)
 create mode 100644 tests/impure-derivations.nix
 create mode 100644 tests/impure-derivations.sh

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 437c7fc53..b87e06ef5 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -436,6 +436,7 @@ EvalState::EvalState(
     , sBuilder(symbols.create("builder"))
     , sArgs(symbols.create("args"))
     , sContentAddressed(symbols.create("__contentAddressed"))
+    , sImpure(symbols.create("__impure"))
     , sOutputHash(symbols.create("outputHash"))
     , sOutputHashAlgo(symbols.create("outputHashAlgo"))
     , sOutputHashMode(symbols.create("outputHashMode"))
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index e7915dd99..7ed376e8d 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -78,7 +78,7 @@ public:
         sSystem, sOverrides, sOutputs, sOutputName, sIgnoreNulls,
         sFile, sLine, sColumn, sFunctor, sToString,
         sRight, sWrong, sStructuredAttrs, sBuilder, sArgs,
-        sContentAddressed,
+        sContentAddressed, sImpure,
         sOutputHash, sOutputHashAlgo, sOutputHashMode,
         sRecurseForDerivations,
         sDescription, sSelf, sEpsilon, sStartSet, sOperator, sKey, sPath,
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 9f549e52f..eaf04320e 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -989,6 +989,7 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
     PathSet context;
 
     bool contentAddressed = false;
+    bool isImpure = false;
     std::optional<std::string> outputHash;
     std::string outputHashAlgo;
     auto ingestionMethod = FileIngestionMethod::Flat;
@@ -1051,6 +1052,12 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
                     settings.requireExperimentalFeature(Xp::CaDerivations);
             }
 
+            else if (i->name == state.sImpure) {
+                isImpure = state.forceBool(*i->value, pos);
+                if (isImpure)
+                    settings.requireExperimentalFeature(Xp::ImpureDerivations);
+            }
+
             /* The `args' attribute is special: it supplies the
                command-line arguments to the builder. */
             else if (i->name == state.sArgs) {
@@ -1197,15 +1204,28 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
             });
     }
 
-    else if (contentAddressed) {
+    else if (contentAddressed || isImpure) {
+        if (contentAddressed && isImpure)
+            throw EvalError({
+                .msg = hintfmt("derivation cannot be both content-addressed and impure"),
+                .errPos = posDrvName
+            });
+
         HashType ht = parseHashType(outputHashAlgo);
         for (auto & i : outputs) {
             drv.env[i] = hashPlaceholder(i);
-            drv.outputs.insert_or_assign(i,
-                DerivationOutput::CAFloating {
-                    .method = ingestionMethod,
-                    .hashType = ht,
-                });
+            if (isImpure)
+                drv.outputs.insert_or_assign(i,
+                    DerivationOutput::Impure {
+                        .method = ingestionMethod,
+                        .hashType = ht,
+                    });
+            else
+                drv.outputs.insert_or_assign(i,
+                    DerivationOutput::CAFloating {
+                        .method = ingestionMethod,
+                        .hashType = ht,
+                    });
         }
     }
 
diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index 3d1c4fbc1..2f3490829 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -204,9 +204,34 @@ void DerivationGoal::haveDerivation()
 {
     trace("have derivation");
 
+    parsedDrv = std::make_unique<ParsedDerivation>(drvPath, *drv);
+
     if (!drv->type().hasKnownOutputPaths())
         settings.requireExperimentalFeature(Xp::CaDerivations);
 
+    if (!drv->type().isPure()) {
+        settings.requireExperimentalFeature(Xp::ImpureDerivations);
+
+        for (auto & [outputName, output] : drv->outputs) {
+            auto randomPath = StorePath::random(outputPathName(drv->name, outputName));
+            assert(!worker.store.isValidPath(randomPath));
+            initialOutputs.insert({
+                outputName,
+                InitialOutput {
+                    .wanted = true,
+                    .outputHash = impureOutputHash,
+                    .known = InitialOutputStatus {
+                        .path = randomPath,
+                        .status = PathStatus::Absent
+                    }
+                }
+            });
+        }
+
+        gaveUpOnSubstitution();
+        return;
+    }
+
     for (auto & i : drv->outputsAndOptPaths(worker.store))
         if (i.second.second)
             worker.store.addTempRoot(*i.second.second);
@@ -230,9 +255,6 @@ void DerivationGoal::haveDerivation()
         return;
     }
 
-    parsedDrv = std::make_unique<ParsedDerivation>(drvPath, *drv);
-
-
     /* We are first going to try to create the invalid output paths
        through substitutes.  If that doesn't work, we'll build
        them. */
@@ -266,6 +288,8 @@ void DerivationGoal::outputsSubstitutionTried()
 {
     trace("all outputs substituted (maybe)");
 
+    assert(drv->type().isPure());
+
     if (nrFailed > 0 && nrFailed > nrNoSubstituters + nrIncompleteClosure && !settings.tryFallback) {
         done(BuildResult::TransientFailure, {},
             Error("some substitutes for the outputs of derivation '%s' failed (usually happens due to networking issues); try '--fallback' to build derivation from source ",
@@ -315,9 +339,21 @@ void DerivationGoal::outputsSubstitutionTried()
 void DerivationGoal::gaveUpOnSubstitution()
 {
     /* The inputs must be built before we can build this goal. */
+    inputDrvOutputs.clear();
     if (useDerivation)
-        for (auto & i : dynamic_cast<Derivation *>(drv.get())->inputDrvs)
+        for (auto & i : dynamic_cast<Derivation *>(drv.get())->inputDrvs) {
+            /* Ensure that pure derivations don't depend on impure
+               derivations. */
+            if (drv->type().isPure()) {
+                auto inputDrv = worker.evalStore.readDerivation(i.first);
+                if (!inputDrv.type().isPure())
+                    throw Error("pure derivation '%s' depends on impure derivation '%s'",
+                        worker.store.printStorePath(drvPath),
+                        worker.store.printStorePath(i.first));
+            }
+
             addWaitee(worker.makeDerivationGoal(i.first, i.second, buildMode == bmRepair ? bmRepair : bmNormal));
+        }
 
     /* Copy the input sources from the eval store to the build
        store. */
@@ -345,6 +381,8 @@ void DerivationGoal::gaveUpOnSubstitution()
 
 void DerivationGoal::repairClosure()
 {
+    assert(drv->type().isPure());
+
     /* If we're repairing, we now know that our own outputs are valid.
        Now check whether the other paths in the outputs closure are
        good.  If not, then start derivation goals for the derivations
@@ -452,22 +490,24 @@ void DerivationGoal::inputsRealised()
                        drvs. */
                     : true);
             },
+            [&](const DerivationType::Impure &) {
+                return true;
+            }
         }, drvType.raw());
 
-        if (resolveDrv)
-        {
+        if (resolveDrv && !fullDrv.inputDrvs.empty()) {
             settings.requireExperimentalFeature(Xp::CaDerivations);
 
             /* We are be able to resolve this derivation based on the
-               now-known results of dependencies. If so, we become a stub goal
-               aliasing that resolved derivation goal */
-            std::optional attempt = fullDrv.tryResolve(worker.store);
+               now-known results of dependencies. If so, we become a
+               stub goal aliasing that resolved derivation goal. */
+            std::optional attempt = fullDrv.tryResolve(worker.store, inputDrvOutputs);
             assert(attempt);
             Derivation drvResolved { *std::move(attempt) };
 
             auto pathResolved = writeDerivation(worker.store, drvResolved);
 
-            auto msg = fmt("Resolved derivation: '%s' -> '%s'",
+            auto msg = fmt("resolved derivation: '%s' -> '%s'",
                 worker.store.printStorePath(drvPath),
                 worker.store.printStorePath(pathResolved));
             act = std::make_unique<Activity>(*logger, lvlInfo, actBuildWaiting, msg,
@@ -488,21 +528,13 @@ void DerivationGoal::inputsRealised()
             /* Add the relevant output closures of the input derivation
                `i' as input paths.  Only add the closures of output paths
                that are specified as inputs. */
-            assert(worker.evalStore.isValidPath(drvPath));
-            auto outputs = worker.evalStore.queryPartialDerivationOutputMap(depDrvPath);
-            for (auto & j : wantedDepOutputs) {
-                if (outputs.count(j) > 0) {
-                    auto optRealizedInput = outputs.at(j);
-                    if (!optRealizedInput)
-                        throw Error(
-                            "derivation '%s' requires output '%s' from input derivation '%s', which is supposedly realized already, yet we still don't know what path corresponds to that output",
-                            worker.store.printStorePath(drvPath), j, worker.store.printStorePath(depDrvPath));
-                    worker.store.computeFSClosure(*optRealizedInput, inputPaths);
-                } else
+            for (auto & j : wantedDepOutputs)
+                if (auto outPath = get(inputDrvOutputs, { depDrvPath, j }))
+                    worker.store.computeFSClosure(*outPath, inputPaths);
+                else
                     throw Error(
                         "derivation '%s' requires non-existent output '%s' from input derivation '%s'",
                         worker.store.printStorePath(drvPath), j, worker.store.printStorePath(depDrvPath));
-            }
         }
     }
 
@@ -923,7 +955,7 @@ void DerivationGoal::buildDone()
             st =
                 dynamic_cast<NotDeterministic*>(&e) ? BuildResult::NotDeterministic :
                 statusOk(status) ? BuildResult::OutputRejected :
-                derivationType.isImpure() || diskFull ? BuildResult::TransientFailure :
+                derivationType.needsNetworkAccess() || diskFull ? BuildResult::TransientFailure :
                 BuildResult::PermanentFailure;
         }
 
@@ -934,60 +966,52 @@ void DerivationGoal::buildDone()
 
 void DerivationGoal::resolvedFinished()
 {
+    trace("resolved derivation finished");
+
     assert(resolvedDrvGoal);
     auto resolvedDrv = *resolvedDrvGoal->drv;
-
-    auto resolvedHashes = staticOutputHashes(worker.store, resolvedDrv);
-
-    StorePathSet outputPaths;
-
-    // `wantedOutputs` might be empty, which means “all the outputs”
-    auto realWantedOutputs = wantedOutputs;
-    if (realWantedOutputs.empty())
-        realWantedOutputs = resolvedDrv.outputNames();
+    auto & resolvedResult = resolvedDrvGoal->buildResult;
 
     DrvOutputs builtOutputs;
 
-    for (auto & wantedOutput : realWantedOutputs) {
-        assert(initialOutputs.count(wantedOutput) != 0);
-        assert(resolvedHashes.count(wantedOutput) != 0);
-        auto realisation = worker.store.queryRealisation(
-            DrvOutput{resolvedHashes.at(wantedOutput), wantedOutput}
-        );
-        // We've just built it, but maybe the build failed, in which case the
-        // realisation won't be there
-        if (realisation) {
-            auto newRealisation = *realisation;
-            newRealisation.id = DrvOutput{initialOutputs.at(wantedOutput).outputHash, wantedOutput};
-            newRealisation.signatures.clear();
-            newRealisation.dependentRealisations = drvOutputReferences(worker.store, *drv, realisation->outPath);
-            signRealisation(newRealisation);
-            worker.store.registerDrvOutput(newRealisation);
-            outputPaths.insert(realisation->outPath);
-            builtOutputs.emplace(realisation->id, *realisation);
-        } else {
-            // If we don't have a realisation, then it must mean that something
-            // failed when building the resolved drv
-            assert(!buildResult.success());
+    if (resolvedResult.success()) {
+        auto resolvedHashes = staticOutputHashes(worker.store, resolvedDrv);
+
+        StorePathSet outputPaths;
+
+        // `wantedOutputs` might be empty, which means “all the outputs”
+        auto realWantedOutputs = wantedOutputs;
+        if (realWantedOutputs.empty())
+            realWantedOutputs = resolvedDrv.outputNames();
+
+        for (auto & wantedOutput : realWantedOutputs) {
+            assert(initialOutputs.count(wantedOutput) != 0);
+            assert(resolvedHashes.count(wantedOutput) != 0);
+            auto realisation = resolvedResult.builtOutputs.at(
+                DrvOutput { resolvedHashes.at(wantedOutput), wantedOutput });
+            if (drv->type().isPure()) {
+                auto newRealisation = realisation;
+                newRealisation.id = DrvOutput { initialOutputs.at(wantedOutput).outputHash, wantedOutput };
+                newRealisation.signatures.clear();
+                newRealisation.dependentRealisations = drvOutputReferences(worker.store, *drv, realisation.outPath);
+                signRealisation(newRealisation);
+                worker.store.registerDrvOutput(newRealisation);
+            }
+            outputPaths.insert(realisation.outPath);
+            builtOutputs.emplace(realisation.id, realisation);
         }
+
+        runPostBuildHook(
+            worker.store,
+            *logger,
+            drvPath,
+            outputPaths
+        );
     }
 
-    runPostBuildHook(
-        worker.store,
-        *logger,
-        drvPath,
-        outputPaths
-    );
-
-    auto status = [&]() {
-        auto & resolvedResult = resolvedDrvGoal->buildResult;
-        switch (resolvedResult.status) {
-            case BuildResult::AlreadyValid:
-                return BuildResult::ResolvesToAlreadyValid;
-            default:
-                return resolvedResult.status;
-        }
-    }();
+    auto status = resolvedResult.status;
+    if (status == BuildResult::AlreadyValid)
+        status = BuildResult::ResolvesToAlreadyValid;
 
     done(status, std::move(builtOutputs));
 }
@@ -1236,6 +1260,7 @@ void DerivationGoal::flushLine()
 
 std::map<std::string, std::optional<StorePath>> DerivationGoal::queryPartialDerivationOutputMap()
 {
+    assert(drv->type().isPure());
     if (!useDerivation || drv->type().hasKnownOutputPaths()) {
         std::map<std::string, std::optional<StorePath>> res;
         for (auto & [name, output] : drv->outputs)
@@ -1248,6 +1273,7 @@ std::map<std::string, std::optional<StorePath>> DerivationGoal::queryPartialDeri
 
 OutputPathMap DerivationGoal::queryDerivationOutputMap()
 {
+    assert(drv->type().isPure());
     if (!useDerivation || drv->type().hasKnownOutputPaths()) {
         OutputPathMap res;
         for (auto & [name, output] : drv->outputsAndOptPaths(worker.store))
@@ -1261,6 +1287,8 @@ OutputPathMap DerivationGoal::queryDerivationOutputMap()
 
 std::pair<bool, DrvOutputs> DerivationGoal::checkPathValidity()
 {
+    if (!drv->type().isPure()) return { false, {} };
+
     bool checkHash = buildMode == bmRepair;
     auto wantedOutputsLeft = wantedOutputs;
     DrvOutputs validOutputs;
@@ -1304,6 +1332,7 @@ std::pair<bool, DrvOutputs> DerivationGoal::checkPathValidity()
         if (info.wanted && info.known && info.known->isValid())
             validOutputs.emplace(drvOutput, Realisation { drvOutput, info.known->path });
     }
+
     // If we requested all the outputs via the empty set, we are always fine.
     // If we requested specific elements, the loop above removes all the valid
     // ones, so any that are left must be invalid.
@@ -1343,7 +1372,6 @@ void DerivationGoal::done(
     if (ex)
         // FIXME: strip: "error: "
         buildResult.errorMsg = ex->what();
-    amDone(buildResult.success() ? ecSuccess : ecFailed, ex);
     if (buildResult.status == BuildResult::TimedOut)
         worker.timedOut = true;
     if (buildResult.status == BuildResult::PermanentFailure)
@@ -1370,7 +1398,21 @@ void DerivationGoal::done(
         fs.open(traceBuiltOutputsFile, std::fstream::out);
         fs << worker.store.printStorePath(drvPath) << "\t" << buildResult.toString() << std::endl;
     }
+
+    amDone(buildResult.success() ? ecSuccess : ecFailed, ex);
 }
 
 
+void DerivationGoal::waiteeDone(GoalPtr waitee, ExitCode result)
+{
+    Goal::waiteeDone(waitee, result);
+
+    if (waitee->buildResult.success())
+        if (auto bfd = std::get_if<DerivedPath::Built>(&waitee->buildResult.path))
+            for (auto & [output, realisation] : waitee->buildResult.builtOutputs)
+                inputDrvOutputs.insert_or_assign(
+                    { bfd->drvPath, output.outputName },
+                    realisation.outPath);
+}
+
 }
diff --git a/src/libstore/build/derivation-goal.hh b/src/libstore/build/derivation-goal.hh
index f556b6f25..2d8bfd592 100644
--- a/src/libstore/build/derivation-goal.hh
+++ b/src/libstore/build/derivation-goal.hh
@@ -57,6 +57,11 @@ struct DerivationGoal : public Goal
        them. */
     StringSet wantedOutputs;
 
+    /* Mapping from input derivations + output names to actual store
+       paths. This is filled in by waiteeDone() as each dependency
+       finishes, before inputsRealised() is reached, */
+    std::map<std::pair<StorePath, std::string>, StorePath> inputDrvOutputs;
+
     /* Whether additional wanted outputs have been added. */
     bool needRestart = false;
 
@@ -224,6 +229,8 @@ struct DerivationGoal : public Goal
         DrvOutputs builtOutputs = {},
         std::optional<Error> ex = {});
 
+    void waiteeDone(GoalPtr waitee, ExitCode result) override;
+
     StorePathSet exportReferences(const StorePathSet & storePaths);
 };
 
diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index b176f318b..a6c07314f 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -395,7 +395,7 @@ void LocalDerivationGoal::startBuilder()
         else if (settings.sandboxMode == smDisabled)
             useChroot = false;
         else if (settings.sandboxMode == smRelaxed)
-            useChroot = !(derivationType.isImpure()) && !noChroot;
+            useChroot = !derivationType.needsNetworkAccess() && !noChroot;
     }
 
     auto & localStore = getLocalStore();
@@ -608,7 +608,7 @@ void LocalDerivationGoal::startBuilder()
                 "nogroup:x:65534:\n", sandboxGid()));
 
         /* Create /etc/hosts with localhost entry. */
-        if (!(derivationType.isImpure()))
+        if (!derivationType.needsNetworkAccess())
             writeFile(chrootRootDir + "/etc/hosts", "127.0.0.1 localhost\n::1 localhost\n");
 
         /* Make the closure of the inputs available in the chroot,
@@ -796,7 +796,7 @@ void LocalDerivationGoal::startBuilder()
            us.
         */
 
-        if (!(derivationType.isImpure()))
+        if (!derivationType.needsNetworkAccess())
             privateNetwork = true;
 
         userNamespaceSync.create();
@@ -1060,7 +1060,7 @@ void LocalDerivationGoal::initEnv()
        to the builder is generally impure, but the output of
        fixed-output derivations is by definition pure (since we
        already know the cryptographic hash of the output). */
-    if (derivationType.isImpure()) {
+    if (derivationType.needsNetworkAccess()) {
         for (auto & i : parsedDrv->getStringsAttr("impureEnvVars").value_or(Strings()))
             env[i] = getEnv(i).value_or("");
     }
@@ -1674,7 +1674,7 @@ void LocalDerivationGoal::runChild()
             /* Fixed-output derivations typically need to access the
                network, so give them access to /etc/resolv.conf and so
                on. */
-            if (derivationType.isImpure()) {
+            if (derivationType.needsNetworkAccess()) {
                 // Only use nss functions to resolve hosts and
                 // services. Don’t use it for anything else that may
                 // be configured for this system. This limits the
@@ -2399,6 +2399,13 @@ DrvOutputs LocalDerivationGoal::registerOutputs()
                 assert(false);
             },
 
+            [&](const DerivationOutput::Impure & doi) {
+                return newInfoFromCA(DerivationOutput::CAFloating {
+                    .method = doi.method,
+                    .hashType = doi.hashType,
+                });
+            },
+
         }, output.raw());
 
         /* FIXME: set proper permissions in restorePath() so
@@ -2609,7 +2616,9 @@ DrvOutputs LocalDerivationGoal::registerOutputs()
             },
             .outPath = newInfo.path
         };
-        if (settings.isExperimentalFeatureEnabled(Xp::CaDerivations)) {
+        if (settings.isExperimentalFeatureEnabled(Xp::CaDerivations)
+            && drv->type().isPure())
+        {
             signRealisation(thisRealisation);
             worker.store.registerDrvOutput(thisRealisation);
         }
diff --git a/src/libstore/derivations.cc b/src/libstore/derivations.cc
index 85d75523f..75e0178bb 100644
--- a/src/libstore/derivations.cc
+++ b/src/libstore/derivations.cc
@@ -25,26 +25,42 @@ std::optional<StorePath> DerivationOutput::path(const Store & store, std::string
         [](const DerivationOutput::Deferred &) -> std::optional<StorePath> {
             return std::nullopt;
         },
+        [](const DerivationOutput::Impure &) -> std::optional<StorePath> {
+            return std::nullopt;
+        },
     }, raw());
 }
 
 
-StorePath DerivationOutput::CAFixed::path(const Store & store, std::string_view drvName, std::string_view outputName) const {
+StorePath DerivationOutput::CAFixed::path(const Store & store, std::string_view drvName, std::string_view outputName) const
+{
     return store.makeFixedOutputPath(
         hash.method, hash.hash,
         outputPathName(drvName, outputName));
 }
 
 
-bool DerivationType::isCA() const {
+bool DerivationType::isCA() const
+{
     /* Normally we do the full `std::visit` to make sure we have
        exhaustively handled all variants, but so long as there is a
        variant called `ContentAddressed`, it must be the only one for
        which `isCA` is true for this to make sense!. */
-    return std::holds_alternative<ContentAddressed>(raw());
+    return std::visit(overloaded {
+        [](const InputAddressed & ia) {
+            return false;
+        },
+        [](const ContentAddressed & ca) {
+            return true;
+        },
+        [](const Impure &) {
+            return true;
+        },
+    }, raw());
 }
 
-bool DerivationType::isFixed() const {
+bool DerivationType::isFixed() const
+{
     return std::visit(overloaded {
         [](const InputAddressed & ia) {
             return false;
@@ -52,10 +68,14 @@ bool DerivationType::isFixed() const {
         [](const ContentAddressed & ca) {
             return ca.fixed;
         },
+        [](const Impure &) {
+            return false;
+        },
     }, raw());
 }
 
-bool DerivationType::hasKnownOutputPaths() const {
+bool DerivationType::hasKnownOutputPaths() const
+{
     return std::visit(overloaded {
         [](const InputAddressed & ia) {
             return !ia.deferred;
@@ -63,11 +83,15 @@ bool DerivationType::hasKnownOutputPaths() const {
         [](const ContentAddressed & ca) {
             return ca.fixed;
         },
+        [](const Impure &) {
+            return false;
+        },
     }, raw());
 }
 
 
-bool DerivationType::isImpure() const {
+bool DerivationType::needsNetworkAccess() const
+{
     return std::visit(overloaded {
         [](const InputAddressed & ia) {
             return false;
@@ -75,6 +99,25 @@ bool DerivationType::isImpure() const {
         [](const ContentAddressed & ca) {
             return !ca.pure;
         },
+        [](const Impure &) {
+            return true;
+        },
+    }, raw());
+}
+
+
+bool DerivationType::isPure() const
+{
+    return std::visit(overloaded {
+        [](const InputAddressed & ia) {
+            return true;
+        },
+        [](const ContentAddressed & ca) {
+            return true;
+        },
+        [](const Impure &) {
+            return false;
+        },
     }, raw());
 }
 
@@ -176,7 +219,16 @@ static DerivationOutput parseDerivationOutput(const Store & store,
             hashAlgo = hashAlgo.substr(2);
         }
         const auto hashType = parseHashType(hashAlgo);
-        if (hash != "") {
+        if (hash == "impure") {
+            settings.requireExperimentalFeature(Xp::ImpureDerivations);
+            assert(pathS == "");
+            return DerivationOutput {
+                .output = DerivationOutputImpure {
+                    .method = std::move(method),
+                    .hashType = std::move(hashType),
+                },
+            };
+        } else if (hash != "") {
             validatePath(pathS);
             return DerivationOutput::CAFixed {
                 .hash = FixedOutputHash {
@@ -345,6 +397,12 @@ std::string Derivation::unparse(const Store & store, bool maskOutputs,
                 s += ','; printUnquotedString(s, "");
                 s += ','; printUnquotedString(s, "");
                 s += ','; printUnquotedString(s, "");
+            },
+            [&](const DerivationOutputImpure & doi) {
+                // FIXME
+                s += ','; printUnquotedString(s, "");
+                s += ','; printUnquotedString(s, makeFileIngestionPrefix(doi.method) + printHashType(doi.hashType));
+                s += ','; printUnquotedString(s, "impure");
             }
         }, i.second.raw());
         s += ')';
@@ -410,8 +468,14 @@ std::string outputPathName(std::string_view drvName, std::string_view outputName
 
 DerivationType BasicDerivation::type() const
 {
-    std::set<std::string_view> inputAddressedOutputs, fixedCAOutputs, floatingCAOutputs, deferredIAOutputs;
+    std::set<std::string_view>
+        inputAddressedOutputs,
+        fixedCAOutputs,
+        floatingCAOutputs,
+        deferredIAOutputs,
+        impureOutputs;
     std::optional<HashType> floatingHashType;
+
     for (auto & i : outputs) {
         std::visit(overloaded {
             [&](const DerivationOutput::InputAddressed &) {
@@ -426,43 +490,78 @@ DerivationType BasicDerivation::type() const
                     floatingHashType = dof.hashType;
                 } else {
                     if (*floatingHashType != dof.hashType)
-                        throw Error("All floating outputs must use the same hash type");
+                        throw Error("all floating outputs must use the same hash type");
                 }
             },
             [&](const DerivationOutput::Deferred &) {
-               deferredIAOutputs.insert(i.first);
+                deferredIAOutputs.insert(i.first);
+            },
+            [&](const DerivationOutput::Impure &) {
+                impureOutputs.insert(i.first);
             },
         }, i.second.raw());
     }
 
-    if (inputAddressedOutputs.empty() && fixedCAOutputs.empty() && floatingCAOutputs.empty() && deferredIAOutputs.empty()) {
-        throw Error("Must have at least one output");
-    } else if (! inputAddressedOutputs.empty() && fixedCAOutputs.empty() && floatingCAOutputs.empty() && deferredIAOutputs.empty()) {
+    if (inputAddressedOutputs.empty()
+        && fixedCAOutputs.empty()
+        && floatingCAOutputs.empty()
+        && deferredIAOutputs.empty()
+        && impureOutputs.empty())
+        throw Error("must have at least one output");
+
+    if (!inputAddressedOutputs.empty()
+        && fixedCAOutputs.empty()
+        && floatingCAOutputs.empty()
+        && deferredIAOutputs.empty()
+        && impureOutputs.empty())
         return DerivationType::InputAddressed {
             .deferred = false,
         };
-    } else if (inputAddressedOutputs.empty() && ! fixedCAOutputs.empty() && floatingCAOutputs.empty() && deferredIAOutputs.empty()) {
+
+    if (inputAddressedOutputs.empty()
+        && !fixedCAOutputs.empty()
+        && floatingCAOutputs.empty()
+        && deferredIAOutputs.empty()
+        && impureOutputs.empty())
+    {
         if (fixedCAOutputs.size() > 1)
             // FIXME: Experimental feature?
-            throw Error("Only one fixed output is allowed for now");
+            throw Error("only one fixed output is allowed for now");
         if (*fixedCAOutputs.begin() != "out")
-            throw Error("Single fixed output must be named \"out\"");
+            throw Error("single fixed output must be named \"out\"");
         return DerivationType::ContentAddressed {
             .pure = false,
             .fixed = true,
         };
-    } else if (inputAddressedOutputs.empty() && fixedCAOutputs.empty() && ! floatingCAOutputs.empty() && deferredIAOutputs.empty()) {
+    }
+
+    if (inputAddressedOutputs.empty()
+        && fixedCAOutputs.empty()
+        && !floatingCAOutputs.empty()
+        && deferredIAOutputs.empty()
+        && impureOutputs.empty())
         return DerivationType::ContentAddressed {
             .pure = true,
             .fixed = false,
         };
-    } else if (inputAddressedOutputs.empty() && fixedCAOutputs.empty() && floatingCAOutputs.empty() && !deferredIAOutputs.empty()) {
+
+    if (inputAddressedOutputs.empty()
+        && fixedCAOutputs.empty()
+        && floatingCAOutputs.empty()
+        && !deferredIAOutputs.empty()
+        && impureOutputs.empty())
         return DerivationType::InputAddressed {
             .deferred = true,
         };
-    } else {
-        throw Error("Can't mix derivation output types");
-    }
+
+    if (inputAddressedOutputs.empty()
+        && fixedCAOutputs.empty()
+        && floatingCAOutputs.empty()
+        && deferredIAOutputs.empty()
+        && !impureOutputs.empty())
+        return DerivationType::Impure { };
+
+    throw Error("can't mix derivation output types");
 }
 
 
@@ -524,12 +623,22 @@ DrvHash hashDerivationModulo(Store & store, const Derivation & drv, bool maskOut
                 + store.printStorePath(dof.path(store, drv.name, i.first)));
             outputHashes.insert_or_assign(i.first, std::move(hash));
         }
-        return DrvHash{
+        return DrvHash {
             .hashes = outputHashes,
             .kind = DrvHash::Kind::Regular,
         };
     }
 
+    if (!type.isPure()) {
+        std::map<std::string, Hash> outputHashes;
+        for (const auto & [outputName, _] : drv.outputs)
+            outputHashes.insert_or_assign(outputName, impureOutputHash);
+        return DrvHash {
+            .hashes = outputHashes,
+            .kind = DrvHash::Kind::Deferred,
+        };
+    }
+
     auto kind = std::visit(overloaded {
         [](const DerivationType::InputAddressed & ia) {
             /* This might be a "pesimistically" deferred output, so we don't
@@ -541,6 +650,9 @@ DrvHash hashDerivationModulo(Store & store, const Derivation & drv, bool maskOut
                 ? DrvHash::Kind::Regular
                 : DrvHash::Kind::Deferred;
         },
+        [](const DerivationType::Impure &) -> DrvHash::Kind {
+            assert(false);
+        }
     }, drv.type().raw());
 
     std::map<std::string, StringSet> inputs2;
@@ -599,7 +711,8 @@ StringSet BasicDerivation::outputNames() const
     return names;
 }
 
-DerivationOutputsAndOptPaths BasicDerivation::outputsAndOptPaths(const Store & store) const {
+DerivationOutputsAndOptPaths BasicDerivation::outputsAndOptPaths(const Store & store) const
+{
     DerivationOutputsAndOptPaths outsAndOptPaths;
     for (auto output : outputs)
         outsAndOptPaths.insert(std::make_pair(
@@ -610,7 +723,8 @@ DerivationOutputsAndOptPaths BasicDerivation::outputsAndOptPaths(const Store & s
     return outsAndOptPaths;
 }
 
-std::string_view BasicDerivation::nameFromPath(const StorePath & drvPath) {
+std::string_view BasicDerivation::nameFromPath(const StorePath & drvPath)
+{
     auto nameWithSuffix = drvPath.name();
     constexpr std::string_view extension = ".drv";
     assert(hasSuffix(nameWithSuffix, extension));
@@ -672,6 +786,11 @@ void writeDerivation(Sink & out, const Store & store, const BasicDerivation & dr
                     << ""
                     << "";
             },
+            [&](const DerivationOutput::Impure & doi) {
+                out << ""
+                    << (makeFileIngestionPrefix(doi.method) + printHashType(doi.hashType))
+                    << "impure";
+            },
         }, i.second.raw());
     }
     worker_proto::write(store, out, drv.inputSrcs);
@@ -697,21 +816,19 @@ std::string downstreamPlaceholder(const Store & store, const StorePath & drvPath
 }
 
 
-static void rewriteDerivation(Store & store, BasicDerivation & drv, const StringMap & rewrites) {
-
-    debug("Rewriting the derivation");
-
-    for (auto &rewrite: rewrites) {
+static void rewriteDerivation(Store & store, BasicDerivation & drv, const StringMap & rewrites)
+{
+    for (auto & rewrite : rewrites) {
         debug("rewriting %s as %s", rewrite.first, rewrite.second);
     }
 
     drv.builder = rewriteStrings(drv.builder, rewrites);
-    for (auto & arg: drv.args) {
+    for (auto & arg : drv.args) {
         arg = rewriteStrings(arg, rewrites);
     }
 
     StringPairs newEnv;
-    for (auto & envVar: drv.env) {
+    for (auto & envVar : drv.env) {
         auto envName = rewriteStrings(envVar.first, rewrites);
         auto envValue = rewriteStrings(envVar.second, rewrites);
         newEnv.emplace(envName, envValue);
@@ -732,48 +849,48 @@ static void rewriteDerivation(Store & store, BasicDerivation & drv, const String
 
 }
 
-static bool tryResolveInput(
-    Store & store, StorePathSet & inputSrcs, StringMap & inputRewrites,
-    const StorePath & inputDrv, const StringSet & inputOutputs)
+std::optional<BasicDerivation> Derivation::tryResolve(Store & store) const
 {
-    auto inputDrvOutputs = store.queryPartialDerivationOutputMap(inputDrv);
+    std::map<std::pair<StorePath, std::string>, StorePath> inputDrvOutputs;
 
-    auto getOutput = [&](const std::string & outputName) {
-        auto & actualPathOpt = inputDrvOutputs.at(outputName);
-        if (!actualPathOpt)
-            warn("output %s of input %s missing, aborting the resolving",
-                outputName,
-                store.printStorePath(inputDrv)
-            );
-        return actualPathOpt;
-    };
+    for (auto & input : inputDrvs)
+        for (auto & [outputName, outputPath] : store.queryPartialDerivationOutputMap(input.first))
+            if (outputPath)
+                inputDrvOutputs.insert_or_assign({input.first, outputName}, *outputPath);
 
-    for (auto & outputName : inputOutputs) {
-        auto actualPathOpt = getOutput(outputName);
-        if (!actualPathOpt) return false;
-        auto actualPath = *actualPathOpt;
-        inputRewrites.emplace(
-            downstreamPlaceholder(store, inputDrv, outputName),
-            store.printStorePath(actualPath));
-        inputSrcs.insert(std::move(actualPath));
-    }
-
-    return true;
+    return tryResolve(store, inputDrvOutputs);
 }
 
-std::optional<BasicDerivation> Derivation::tryResolve(Store & store) {
+std::optional<BasicDerivation> Derivation::tryResolve(
+    Store & store,
+    const std::map<std::pair<StorePath, std::string>, StorePath> & inputDrvOutputs) const
+{
     BasicDerivation resolved { *this };
 
     // Input paths that we'll want to rewrite in the derivation
     StringMap inputRewrites;
 
-    for (auto & [inputDrv, inputOutputs] : inputDrvs)
-        if (!tryResolveInput(store, resolved.inputSrcs, inputRewrites, inputDrv, inputOutputs))
-            return std::nullopt;
+    for (auto & [inputDrv, inputOutputs] : inputDrvs) {
+        for (auto & outputName : inputOutputs) {
+            if (auto actualPath = get(inputDrvOutputs, { inputDrv, outputName })) {
+                inputRewrites.emplace(
+                    downstreamPlaceholder(store, inputDrv, outputName),
+                    store.printStorePath(*actualPath));
+                resolved.inputSrcs.insert(*actualPath);
+            } else {
+                warn("output '%s' of input '%s' missing, aborting the resolving",
+                    outputName,
+                    store.printStorePath(inputDrv));
+                return {};
+            }
+        }
+    }
 
     rewriteDerivation(store, resolved, inputRewrites);
 
     return resolved;
 }
 
+const Hash impureOutputHash = hashString(htSHA256, "impure");
+
 }
diff --git a/src/libstore/derivations.hh b/src/libstore/derivations.hh
index 63ea5ef76..b62e40786 100644
--- a/src/libstore/derivations.hh
+++ b/src/libstore/derivations.hh
@@ -41,15 +41,26 @@ struct DerivationOutputCAFloating
 };
 
 /* Input-addressed output which depends on a (CA) derivation whose hash isn't
- * known atm
+ * known yet.
  */
 struct DerivationOutputDeferred {};
 
+/* Impure output which is moved to a content-addressed location (like
+   CAFloating) but isn't registered as a realization.
+ */
+struct DerivationOutputImpure
+{
+    /* information used for expected hash computation */
+    FileIngestionMethod method;
+    HashType hashType;
+};
+
 typedef std::variant<
     DerivationOutputInputAddressed,
     DerivationOutputCAFixed,
     DerivationOutputCAFloating,
-    DerivationOutputDeferred
+    DerivationOutputDeferred,
+    DerivationOutputImpure
 > _DerivationOutputRaw;
 
 struct DerivationOutput : _DerivationOutputRaw
@@ -61,6 +72,7 @@ struct DerivationOutput : _DerivationOutputRaw
     using CAFixed = DerivationOutputCAFixed;
     using CAFloating = DerivationOutputCAFloating;
     using Deferred = DerivationOutputDeferred;
+    using Impure = DerivationOutputImpure;
 
     /* Note, when you use this function you should make sure that you're passing
        the right derivation name. When in doubt, you should use the safer
@@ -94,9 +106,13 @@ struct DerivationType_ContentAddressed {
     bool fixed;
 };
 
+struct DerivationType_Impure {
+};
+
 typedef std::variant<
     DerivationType_InputAddressed,
-    DerivationType_ContentAddressed
+    DerivationType_ContentAddressed,
+    DerivationType_Impure
 > _DerivationTypeRaw;
 
 struct DerivationType : _DerivationTypeRaw {
@@ -104,7 +120,7 @@ struct DerivationType : _DerivationTypeRaw {
     using Raw::Raw;
     using InputAddressed = DerivationType_InputAddressed;
     using ContentAddressed = DerivationType_ContentAddressed;
-
+    using Impure = DerivationType_Impure;
 
     /* Do the outputs of the derivation have paths calculated from their content,
        or from the derivation itself? */
@@ -114,10 +130,13 @@ struct DerivationType : _DerivationTypeRaw {
        non-CA derivations. */
     bool isFixed() const;
 
-    /* Is the derivation impure and needs to access non-deterministic resources, or
-       pure and can be sandboxed? Note that whether or not we actually sandbox the
-       derivation is controlled separately. Never true for non-CA derivations. */
-    bool isImpure() const;
+    /* Whether the derivation needs to access the network. Note that
+       whether or not we actually sandbox the derivation is controlled
+       separately. Never true for non-CA derivations. */
+    bool needsNetworkAccess() const;
+
+    /* FIXME */
+    bool isPure() const;
 
     /* Does the derivation knows its own output paths?
        Only true when there's no floating-ca derivation involved in the
@@ -173,7 +192,14 @@ struct Derivation : BasicDerivation
           added directly to input sources.
 
        2. Input placeholders are replaced with realized input store paths. */
-    std::optional<BasicDerivation> tryResolve(Store & store);
+    std::optional<BasicDerivation> tryResolve(Store & store) const;
+
+    /* Like the above, but instead of querying the Nix database for
+       realisations, uses a given mapping from input derivation paths
+       + output names to actual output store paths. */
+    std::optional<BasicDerivation> tryResolve(
+        Store & store,
+        const std::map<std::pair<StorePath, std::string>, StorePath> & inputDrvOutputs) const;
 
     Derivation() = default;
     Derivation(const BasicDerivation & bd) : BasicDerivation(bd) { }
@@ -211,7 +237,7 @@ std::string outputPathName(std::string_view drvName, std::string_view outputName
 struct DrvHash {
     std::map<std::string, Hash> hashes;
 
-    enum struct Kind: bool {
+    enum struct Kind : bool {
         // Statically determined derivations.
         // This hash will be directly used to compute the output paths
         Regular,
@@ -252,8 +278,10 @@ DrvHash hashDerivationModulo(Store & store, const Derivation & drv, bool maskOut
 /*
    Return a map associating each output to a hash that uniquely identifies its
    derivation (modulo the self-references).
+
+   FIXME: what is the Hash in this map?
  */
-std::map<std::string, Hash> staticOutputHashes(Store& store, const Derivation& drv);
+std::map<std::string, Hash> staticOutputHashes(Store & store, const Derivation & drv);
 
 /* Memoisation of hashDerivationModulo(). */
 typedef std::map<StorePath, DrvHash> DrvHashes;
@@ -286,4 +314,6 @@ std::string hashPlaceholder(const std::string_view outputName);
    dependency which is a CA derivation. */
 std::string downstreamPlaceholder(const Store & store, const StorePath & drvPath, std::string_view outputName);
 
+extern const Hash impureOutputHash;
+
 }
diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index 60fe53af1..d77fff963 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -719,6 +719,9 @@ void LocalStore::checkDerivationOutputs(const StorePath & drvPath, const Derivat
             [&](const DerivationOutput::Deferred &) {
                 /* Nothing to check */
             },
+            [&](const DerivationOutput::Impure &) {
+                /* Nothing to check */
+            },
         }, i.second.raw());
     }
 }
diff --git a/src/libstore/path.cc b/src/libstore/path.cc
index e642abcd5..392db225e 100644
--- a/src/libstore/path.cc
+++ b/src/libstore/path.cc
@@ -1,5 +1,7 @@
 #include "store-api.hh"
 
+#include <sodium.h>
+
 namespace nix {
 
 static void checkName(std::string_view path, std::string_view name)
@@ -41,6 +43,13 @@ bool StorePath::isDerivation() const
 
 StorePath StorePath::dummy("ffffffffffffffffffffffffffffffff-x");
 
+StorePath StorePath::random(std::string_view name)
+{
+    Hash hash(htSHA1);
+    randombytes_buf(hash.hash, hash.hashSize);
+    return StorePath(hash, name);
+}
+
 StorePath Store::parseStorePath(std::string_view path) const
 {
     auto p = canonPath(std::string(path));
diff --git a/src/libstore/path.hh b/src/libstore/path.hh
index e65fee622..77fd0f8dc 100644
--- a/src/libstore/path.hh
+++ b/src/libstore/path.hh
@@ -58,6 +58,8 @@ public:
     }
 
     static StorePath dummy;
+
+    static StorePath random(std::string_view name);
 };
 
 typedef std::set<StorePath> StorePathSet;
diff --git a/src/libutil/experimental-features.cc b/src/libutil/experimental-features.cc
index 01f318fa3..e033a4116 100644
--- a/src/libutil/experimental-features.cc
+++ b/src/libutil/experimental-features.cc
@@ -7,6 +7,7 @@ namespace nix {
 
 std::map<ExperimentalFeature, std::string> stringifiedXpFeatures = {
     { Xp::CaDerivations, "ca-derivations" },
+    { Xp::ImpureDerivations, "impure-derivations" },
     { Xp::Flakes, "flakes" },
     { Xp::NixCommand, "nix-command" },
     { Xp::RecursiveNix, "recursive-nix" },
diff --git a/src/libutil/experimental-features.hh b/src/libutil/experimental-features.hh
index b5140dcfe..3a254b423 100644
--- a/src/libutil/experimental-features.hh
+++ b/src/libutil/experimental-features.hh
@@ -16,6 +16,7 @@ namespace nix {
 enum struct ExperimentalFeature
 {
     CaDerivations,
+    ImpureDerivations,
     Flakes,
     NixCommand,
     RecursiveNix,
diff --git a/src/nix/show-derivation.cc b/src/nix/show-derivation.cc
index 0d9655732..fb46b4dbf 100644
--- a/src/nix/show-derivation.cc
+++ b/src/nix/show-derivation.cc
@@ -77,6 +77,10 @@ struct CmdShowDerivation : InstallablesCommand
                             outputObj.attr("hashAlgo", makeFileIngestionPrefix(dof.method) + printHashType(dof.hashType));
                         },
                         [&](const DerivationOutput::Deferred &) {},
+                        [&](const DerivationOutput::Impure & doi) {
+                            outputObj.attr("hashAlgo", makeFileIngestionPrefix(doi.method) + printHashType(doi.hashType));
+                            outputObj.attr("impure", true);
+                        },
                     }, output.raw());
                 }
             }
diff --git a/tests/impure-derivations.nix b/tests/impure-derivations.nix
new file mode 100644
index 000000000..ba7d53146
--- /dev/null
+++ b/tests/impure-derivations.nix
@@ -0,0 +1,46 @@
+with import ./config.nix;
+
+rec {
+
+  impure = mkDerivation {
+    name = "impure";
+    outputs = [ "out" "stuff" ];
+    buildCommand =
+      ''
+        x=$(< $TEST_ROOT/counter)
+        mkdir $out $stuff
+        echo $x > $out/n
+        ln -s $out/n $stuff/bla
+        printf $((x + 1)) > $TEST_ROOT/counter
+      '';
+    __impure = true;
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+    impureEnvVars = [ "TEST_ROOT" ];
+  };
+
+  impureOnImpure = mkDerivation {
+    name = "impure-on-impure";
+    buildCommand =
+      ''
+        x=$(< ${impure}/n)
+        mkdir $out
+        printf X$x > $out/n
+        ln -s ${impure.stuff} $out/symlink
+        ln -s $out $out/self
+      '';
+    __impure = true;
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+  };
+
+  # This is not allowed.
+  inputAddressed = mkDerivation {
+    name = "input-addressed";
+    buildCommand =
+      ''
+        cat ${impure} > $out
+      '';
+  };
+
+}
diff --git a/tests/impure-derivations.sh b/tests/impure-derivations.sh
new file mode 100644
index 000000000..cb1eaf84a
--- /dev/null
+++ b/tests/impure-derivations.sh
@@ -0,0 +1,39 @@
+source common.sh
+
+requireDaemonNewerThan "2.8pre20220311"
+
+enableFeatures "ca-derivations ca-references impure-derivations"
+
+clearStore
+
+# Basic test of impure derivations: building one a second time should not use the previous result.
+printf 0 > $TEST_ROOT/counter
+
+json=$(nix build -L --no-link --json --file ./impure-derivations.nix impure)
+path1=$(echo $json | jq -r .[].outputs.out)
+path1_stuff=$(echo $json | jq -r .[].outputs.stuff)
+[[ $(< $path1/n) = 0 ]]
+[[ $(< $path1_stuff/bla) = 0 ]]
+
+[[ $(nix path-info --json $path1 | jq .[].ca) =~ fixed:r:sha256: ]]
+
+path2=$(nix build -L --no-link --json --file ./impure-derivations.nix impure | jq -r .[].outputs.out)
+[[ $(< $path2/n) = 1 ]]
+
+# Test impure derivations that depend on impure derivations.
+path3=$(nix build -L --no-link --json --file ./impure-derivations.nix impureOnImpure -vvvvv | jq -r .[].outputs.out)
+[[ $(< $path3/n) = X2 ]]
+
+path4=$(nix build -L --no-link --json --file ./impure-derivations.nix impureOnImpure -vvvvv | jq -r .[].outputs.out)
+[[ $(< $path4/n) = X3 ]]
+
+# Test that (self-)references work.
+[[ $(< $path4/symlink/bla) = 3 ]]
+[[ $(< $path4/self/n) = X3 ]]
+
+# Input-addressed derivations cannot depend on impure derivations directly.
+nix build -L --no-link --json --file ./impure-derivations.nix inputAddressed 2>&1 | grep 'depends on impure derivation'
+
+drvPath=$(nix eval --json --file ./impure-derivations.nix impure.drvPath | jq -r .)
+[[ $(nix show-derivation $drvPath | jq ".[\"$drvPath\"].outputs.out.impure") = true ]]
+[[ $(nix show-derivation $drvPath | jq ".[\"$drvPath\"].outputs.stuff.impure") = true ]]
diff --git a/tests/local.mk b/tests/local.mk
index 97971dd76..668b34500 100644
--- a/tests/local.mk
+++ b/tests/local.mk
@@ -97,7 +97,8 @@ nix_tests = \
   nix-profile.sh \
   suggestions.sh \
   store-ping.sh \
-  fetchClosure.sh
+  fetchClosure.sh \
+  impure-derivations.sh
 
 ifeq ($(HAVE_LIBCPUID), 1)
 	nix_tests += compute-levels.sh

From 18935e8b9f152f18705e738d4b8cc6fce97c8b02 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 11 Mar 2022 13:23:23 +0100
Subject: [PATCH 215/251] Support fixed-output derivations depending on impure
 derivations

---
 src/libstore/build/derivation-goal.cc |  9 +++++----
 src/libstore/misc.cc                  |  7 ++++---
 tests/impure-derivations.nix          | 22 ++++++++++++++++++++++
 tests/impure-derivations.sh           | 19 +++++++++++++++++--
 4 files changed, 48 insertions(+), 9 deletions(-)

diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index 2f3490829..542a6f6ea 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -342,9 +342,9 @@ void DerivationGoal::gaveUpOnSubstitution()
     inputDrvOutputs.clear();
     if (useDerivation)
         for (auto & i : dynamic_cast<Derivation *>(drv.get())->inputDrvs) {
-            /* Ensure that pure derivations don't depend on impure
-               derivations. */
-            if (drv->type().isPure()) {
+            /* Ensure that pure, non-fixed-output derivations don't
+               depend on impure derivations. */
+            if (drv->type().isPure() && !drv->type().isFixed()) {
                 auto inputDrv = worker.evalStore.readDerivation(i.first);
                 if (!inputDrv.type().isPure())
                     throw Error("pure derivation '%s' depends on impure derivation '%s'",
@@ -993,7 +993,8 @@ void DerivationGoal::resolvedFinished()
                 auto newRealisation = realisation;
                 newRealisation.id = DrvOutput { initialOutputs.at(wantedOutput).outputHash, wantedOutput };
                 newRealisation.signatures.clear();
-                newRealisation.dependentRealisations = drvOutputReferences(worker.store, *drv, realisation.outPath);
+                if (!drv->type().isFixed())
+                    newRealisation.dependentRealisations = drvOutputReferences(worker.store, *drv, realisation.outPath);
                 signRealisation(newRealisation);
                 worker.store.registerDrvOutput(newRealisation);
             }
diff --git a/src/libstore/misc.cc b/src/libstore/misc.cc
index 1f0bae7fe..2bbd7aa70 100644
--- a/src/libstore/misc.cc
+++ b/src/libstore/misc.cc
@@ -277,15 +277,15 @@ std::map<DrvOutput, StorePath> drvOutputReferences(
 {
     std::set<Realisation> inputRealisations;
 
-    for (const auto& [inputDrv, outputNames] : drv.inputDrvs) {
+    for (const auto & [inputDrv, outputNames] : drv.inputDrvs) {
         auto outputHashes =
             staticOutputHashes(store, store.readDerivation(inputDrv));
-        for (const auto& outputName : outputNames) {
+        for (const auto & outputName : outputNames) {
             auto thisRealisation = store.queryRealisation(
                 DrvOutput{outputHashes.at(outputName), outputName});
             if (!thisRealisation)
                 throw Error(
-                    "output '%s' of derivation '%s' isn’t built", outputName,
+                    "output '%s' of derivation '%s' isn't built", outputName,
                     store.printStorePath(inputDrv));
             inputRealisations.insert(*thisRealisation);
         }
@@ -295,4 +295,5 @@ std::map<DrvOutput, StorePath> drvOutputReferences(
 
     return drvOutputReferences(Realisation::closure(store, inputRealisations), info->references);
 }
+
 }
diff --git a/tests/impure-derivations.nix b/tests/impure-derivations.nix
index ba7d53146..2fed56fe7 100644
--- a/tests/impure-derivations.nix
+++ b/tests/impure-derivations.nix
@@ -7,6 +7,7 @@ rec {
     outputs = [ "out" "stuff" ];
     buildCommand =
       ''
+        echo impure
         x=$(< $TEST_ROOT/counter)
         mkdir $out $stuff
         echo $x > $out/n
@@ -23,6 +24,7 @@ rec {
     name = "impure-on-impure";
     buildCommand =
       ''
+        echo impure-on-impure
         x=$(< ${impure}/n)
         mkdir $out
         printf X$x > $out/n
@@ -43,4 +45,24 @@ rec {
       '';
   };
 
+  contentAddressed = mkDerivation {
+    name = "content-addressed";
+    buildCommand =
+      ''
+        echo content-addressed
+        x=$(< ${impureOnImpure}/n)
+        printf ''${x:0:1} > $out
+      '';
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+    outputHash = "sha256-eBYxcgkuWuiqs4cKNgKwkb3vY/HR0vVsJnqe8itJGcQ=";
+  };
+
+  inputAddressedAfterCA = mkDerivation {
+    name = "input-addressed-after-ca";
+    buildCommand =
+      ''
+        cat ${contentAddressed} > $out
+      '';
+  };
 }
diff --git a/tests/impure-derivations.sh b/tests/impure-derivations.sh
index cb1eaf84a..85e3e09cc 100644
--- a/tests/impure-derivations.sh
+++ b/tests/impure-derivations.sh
@@ -21,10 +21,10 @@ path2=$(nix build -L --no-link --json --file ./impure-derivations.nix impure | j
 [[ $(< $path2/n) = 1 ]]
 
 # Test impure derivations that depend on impure derivations.
-path3=$(nix build -L --no-link --json --file ./impure-derivations.nix impureOnImpure -vvvvv | jq -r .[].outputs.out)
+path3=$(nix build -L --no-link --json --file ./impure-derivations.nix impureOnImpure | jq -r .[].outputs.out)
 [[ $(< $path3/n) = X2 ]]
 
-path4=$(nix build -L --no-link --json --file ./impure-derivations.nix impureOnImpure -vvvvv | jq -r .[].outputs.out)
+path4=$(nix build -L --no-link --json --file ./impure-derivations.nix impureOnImpure | jq -r .[].outputs.out)
 [[ $(< $path4/n) = X3 ]]
 
 # Test that (self-)references work.
@@ -37,3 +37,18 @@ nix build -L --no-link --json --file ./impure-derivations.nix inputAddressed 2>&
 drvPath=$(nix eval --json --file ./impure-derivations.nix impure.drvPath | jq -r .)
 [[ $(nix show-derivation $drvPath | jq ".[\"$drvPath\"].outputs.out.impure") = true ]]
 [[ $(nix show-derivation $drvPath | jq ".[\"$drvPath\"].outputs.stuff.impure") = true ]]
+
+# Fixed-output derivations *can* depend on impure derivations.
+path5=$(nix build -L --no-link --json --file ./impure-derivations.nix contentAddressed | jq -r .[].outputs.out)
+[[ $(< $path5) = X ]]
+[[ $(< $TEST_ROOT/counter) = 5 ]]
+
+# And they should not be rebuilt.
+path5=$(nix build -L --no-link --json --file ./impure-derivations.nix contentAddressed | jq -r .[].outputs.out)
+[[ $(< $path5) = X ]]
+[[ $(< $TEST_ROOT/counter) = 5 ]]
+
+# Input-addressed derivations can depend on fixed-output derivations that depend on impure derivations.
+path6=$(nix build -L --no-link --json --file ./impure-derivations.nix inputAddressedAfterCA | jq -r .[].outputs.out)
+[[ $(< $path6) = X ]]
+[[ $(< $TEST_ROOT/counter) = 5 ]]

From b2ae922747adfe187d02c1bfca8231c2d8bceb75 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 11 Mar 2022 15:56:22 +0100
Subject: [PATCH 216/251] tests/impure-derivations.sh: Restart daemon

---
 tests/impure-derivations.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/impure-derivations.sh b/tests/impure-derivations.sh
index 85e3e09cc..1b33a785c 100644
--- a/tests/impure-derivations.sh
+++ b/tests/impure-derivations.sh
@@ -3,6 +3,7 @@ source common.sh
 requireDaemonNewerThan "2.8pre20220311"
 
 enableFeatures "ca-derivations ca-references impure-derivations"
+restartDaemon
 
 clearStore
 

From 162beb25955adcedeed76e97510feb577d4f86db Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 30 Mar 2022 17:01:32 +0200
Subject: [PATCH 217/251] Fix test

---
 tests/impure-derivations.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/impure-derivations.sh b/tests/impure-derivations.sh
index 1b33a785c..aab5cb61a 100644
--- a/tests/impure-derivations.sh
+++ b/tests/impure-derivations.sh
@@ -10,7 +10,7 @@ clearStore
 # Basic test of impure derivations: building one a second time should not use the previous result.
 printf 0 > $TEST_ROOT/counter
 
-json=$(nix build -L --no-link --json --file ./impure-derivations.nix impure)
+json=$(nix build -L --no-link --json --file ./impure-derivations.nix impure.all)
 path1=$(echo $json | jq -r .[].outputs.out)
 path1_stuff=$(echo $json | jq -r .[].outputs.stuff)
 [[ $(< $path1/n) = 0 ]]

From d7fc33c8426768040b322a060b5a50433b3a78e6 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 31 Mar 2022 15:59:14 +0200
Subject: [PATCH 218/251] Fix macOS build

---
 src/libstore/build/local-derivation-goal.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index a6c07314f..108c661c0 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -1918,7 +1918,7 @@ void LocalDerivationGoal::runChild()
 
                 sandboxProfile += "(import \"sandbox-defaults.sb\")\n";
 
-                if (derivationType.isImpure())
+                if (derivationType.needsNetworkAccess())
                     sandboxProfile += "(import \"sandbox-network.sb\")\n";
 
                 /* Add the output paths we'll use at build-time to the chroot */

From 4e043c2f32af3d3d49c53a2d06746e2fd6967836 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 31 Mar 2022 16:01:50 +0200
Subject: [PATCH 219/251] Document isPure()

---
 src/libstore/derivations.hh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/libstore/derivations.hh b/src/libstore/derivations.hh
index b62e40786..98e59b64e 100644
--- a/src/libstore/derivations.hh
+++ b/src/libstore/derivations.hh
@@ -135,7 +135,10 @@ struct DerivationType : _DerivationTypeRaw {
        separately. Never true for non-CA derivations. */
     bool needsNetworkAccess() const;
 
-    /* FIXME */
+    /* Whether the derivation is expected to produce the same result
+       every time, and therefore it only needs to be built once. This
+       is only false for derivations that have the attribute '__impure
+       = true'. */
     bool isPure() const;
 
     /* Does the derivation knows its own output paths?

From e279fbb16a99896101006ec00277a5d9d50f5040 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 31 Mar 2022 16:06:40 +0200
Subject: [PATCH 220/251] needsNetworkAccess() -> isSandboxed()

---
 src/libstore/build/derivation-goal.cc       |  2 +-
 src/libstore/build/local-derivation-goal.cc | 12 ++++++------
 src/libstore/derivations.cc                 |  8 ++++----
 src/libstore/derivations.hh                 | 10 ++++++----
 4 files changed, 17 insertions(+), 15 deletions(-)

diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index 542a6f6ea..6582497bd 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -955,7 +955,7 @@ void DerivationGoal::buildDone()
             st =
                 dynamic_cast<NotDeterministic*>(&e) ? BuildResult::NotDeterministic :
                 statusOk(status) ? BuildResult::OutputRejected :
-                derivationType.needsNetworkAccess() || diskFull ? BuildResult::TransientFailure :
+                !derivationType.isSandboxed() || diskFull ? BuildResult::TransientFailure :
                 BuildResult::PermanentFailure;
         }
 
diff --git a/src/libstore/build/local-derivation-goal.cc b/src/libstore/build/local-derivation-goal.cc
index 108c661c0..40ef706a6 100644
--- a/src/libstore/build/local-derivation-goal.cc
+++ b/src/libstore/build/local-derivation-goal.cc
@@ -395,7 +395,7 @@ void LocalDerivationGoal::startBuilder()
         else if (settings.sandboxMode == smDisabled)
             useChroot = false;
         else if (settings.sandboxMode == smRelaxed)
-            useChroot = !derivationType.needsNetworkAccess() && !noChroot;
+            useChroot = derivationType.isSandboxed() && !noChroot;
     }
 
     auto & localStore = getLocalStore();
@@ -608,7 +608,7 @@ void LocalDerivationGoal::startBuilder()
                 "nogroup:x:65534:\n", sandboxGid()));
 
         /* Create /etc/hosts with localhost entry. */
-        if (!derivationType.needsNetworkAccess())
+        if (derivationType.isSandboxed())
             writeFile(chrootRootDir + "/etc/hosts", "127.0.0.1 localhost\n::1 localhost\n");
 
         /* Make the closure of the inputs available in the chroot,
@@ -796,7 +796,7 @@ void LocalDerivationGoal::startBuilder()
            us.
         */
 
-        if (!derivationType.needsNetworkAccess())
+        if (derivationType.isSandboxed())
             privateNetwork = true;
 
         userNamespaceSync.create();
@@ -1060,7 +1060,7 @@ void LocalDerivationGoal::initEnv()
        to the builder is generally impure, but the output of
        fixed-output derivations is by definition pure (since we
        already know the cryptographic hash of the output). */
-    if (derivationType.needsNetworkAccess()) {
+    if (!derivationType.isSandboxed()) {
         for (auto & i : parsedDrv->getStringsAttr("impureEnvVars").value_or(Strings()))
             env[i] = getEnv(i).value_or("");
     }
@@ -1674,7 +1674,7 @@ void LocalDerivationGoal::runChild()
             /* Fixed-output derivations typically need to access the
                network, so give them access to /etc/resolv.conf and so
                on. */
-            if (derivationType.needsNetworkAccess()) {
+            if (!derivationType.isSandboxed()) {
                 // Only use nss functions to resolve hosts and
                 // services. Don’t use it for anything else that may
                 // be configured for this system. This limits the
@@ -1918,7 +1918,7 @@ void LocalDerivationGoal::runChild()
 
                 sandboxProfile += "(import \"sandbox-defaults.sb\")\n";
 
-                if (derivationType.needsNetworkAccess())
+                if (!derivationType.isSandboxed())
                     sandboxProfile += "(import \"sandbox-network.sb\")\n";
 
                 /* Add the output paths we'll use at build-time to the chroot */
diff --git a/src/libstore/derivations.cc b/src/libstore/derivations.cc
index 75e0178bb..b4fb77f9f 100644
--- a/src/libstore/derivations.cc
+++ b/src/libstore/derivations.cc
@@ -90,17 +90,17 @@ bool DerivationType::hasKnownOutputPaths() const
 }
 
 
-bool DerivationType::needsNetworkAccess() const
+bool DerivationType::isSandboxed() const
 {
     return std::visit(overloaded {
         [](const InputAddressed & ia) {
-            return false;
+            return true;
         },
         [](const ContentAddressed & ca) {
-            return !ca.pure;
+            return ca.pure;
         },
         [](const Impure &) {
-            return true;
+            return false;
         },
     }, raw());
 }
diff --git a/src/libstore/derivations.hh b/src/libstore/derivations.hh
index 98e59b64e..489948c30 100644
--- a/src/libstore/derivations.hh
+++ b/src/libstore/derivations.hh
@@ -130,10 +130,12 @@ struct DerivationType : _DerivationTypeRaw {
        non-CA derivations. */
     bool isFixed() const;
 
-    /* Whether the derivation needs to access the network. Note that
-       whether or not we actually sandbox the derivation is controlled
-       separately. Never true for non-CA derivations. */
-    bool needsNetworkAccess() const;
+    /* Whether the derivation is fully sandboxed. If false, the
+       sandbox is opened up, e.g. the derivation has access to the
+       network. Note that whether or not we actually sandbox the
+       derivation is controlled separately. Always true for non-CA
+       derivations. */
+    bool isSandboxed() const;
 
     /* Whether the derivation is expected to produce the same result
        every time, and therefore it only needs to be built once. This

From 6051cc954b990fa57a6d3b75bd4b0aaaceb0ca82 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 31 Mar 2022 16:12:25 +0200
Subject: [PATCH 221/251] Rename 'pure' -> 'sandboxed' for consistency

---
 src/libstore/derivations.cc | 6 +++---
 src/libstore/derivations.hh | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/libstore/derivations.cc b/src/libstore/derivations.cc
index b4fb77f9f..cc04119c3 100644
--- a/src/libstore/derivations.cc
+++ b/src/libstore/derivations.cc
@@ -97,7 +97,7 @@ bool DerivationType::isSandboxed() const
             return true;
         },
         [](const ContentAddressed & ca) {
-            return ca.pure;
+            return ca.sandboxed;
         },
         [](const Impure &) {
             return false;
@@ -530,7 +530,7 @@ DerivationType BasicDerivation::type() const
         if (*fixedCAOutputs.begin() != "out")
             throw Error("single fixed output must be named \"out\"");
         return DerivationType::ContentAddressed {
-            .pure = false,
+            .sandboxed = false,
             .fixed = true,
         };
     }
@@ -541,7 +541,7 @@ DerivationType BasicDerivation::type() const
         && deferredIAOutputs.empty()
         && impureOutputs.empty())
         return DerivationType::ContentAddressed {
-            .pure = true,
+            .sandboxed = true,
             .fixed = false,
         };
 
diff --git a/src/libstore/derivations.hh b/src/libstore/derivations.hh
index 489948c30..af198a767 100644
--- a/src/libstore/derivations.hh
+++ b/src/libstore/derivations.hh
@@ -102,7 +102,7 @@ struct DerivationType_InputAddressed {
 };
 
 struct DerivationType_ContentAddressed {
-    bool pure;
+    bool sandboxed;
     bool fixed;
 };
 

From a99af85a770df462985b621c4c3dd710b8487f44 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 31 Mar 2022 16:39:18 +0200
Subject: [PATCH 222/251] Fix macOS build

---
 src/libstore/derivations.cc | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/src/libstore/derivations.cc b/src/libstore/derivations.cc
index cc04119c3..1c695de82 100644
--- a/src/libstore/derivations.cc
+++ b/src/libstore/derivations.cc
@@ -222,11 +222,9 @@ static DerivationOutput parseDerivationOutput(const Store & store,
         if (hash == "impure") {
             settings.requireExperimentalFeature(Xp::ImpureDerivations);
             assert(pathS == "");
-            return DerivationOutput {
-                .output = DerivationOutputImpure {
-                    .method = std::move(method),
-                    .hashType = std::move(hashType),
-                },
+            return DerivationOutput::Impure {
+                .method = std::move(method),
+                .hashType = std::move(hashType),
             };
         } else if (hash != "") {
             validatePath(pathS);

From 75370972847a1b992055085f39b38f1f659e5275 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 31 Mar 2022 16:56:44 +0200
Subject: [PATCH 223/251] Provide default values for outputHashAlgo and
 outputHashMode

---
 src/libexpr/primops.cc       | 19 +++++++++++--------
 tests/impure-derivations.nix |  5 -----
 2 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index eaf04320e..969391725 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -991,8 +991,8 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
     bool contentAddressed = false;
     bool isImpure = false;
     std::optional<std::string> outputHash;
-    std::string outputHashAlgo;
-    auto ingestionMethod = FileIngestionMethod::Flat;
+    std::optional<std::string> outputHashAlgo;
+    std::optional<FileIngestionMethod> ingestionMethod;
 
     StringSet outputs;
     outputs.insert("out");
@@ -1190,15 +1190,16 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
                 .errPos = posDrvName
             });
 
-        std::optional<HashType> ht = parseHashTypeOpt(outputHashAlgo);
+        std::optional<HashType> ht = parseHashTypeOpt(outputHashAlgo.value_or("sha256"));
         Hash h = newHashAllowEmpty(*outputHash, ht);
 
-        auto outPath = state.store->makeFixedOutputPath(ingestionMethod, h, drvName);
+        auto method = ingestionMethod.value_or(FileIngestionMethod::Flat);
+        auto outPath = state.store->makeFixedOutputPath(method, h, drvName);
         drv.env["out"] = state.store->printStorePath(outPath);
         drv.outputs.insert_or_assign("out",
             DerivationOutput::CAFixed {
                 .hash = FixedOutputHash {
-                    .method = ingestionMethod,
+                    .method = method,
                     .hash = std::move(h),
                 },
             });
@@ -1211,19 +1212,21 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
                 .errPos = posDrvName
             });
 
-        HashType ht = parseHashType(outputHashAlgo);
+        auto ht = parseHashType(outputHashAlgo.value_or("sha256"));
+        auto method = ingestionMethod.value_or(FileIngestionMethod::Recursive);
+
         for (auto & i : outputs) {
             drv.env[i] = hashPlaceholder(i);
             if (isImpure)
                 drv.outputs.insert_or_assign(i,
                     DerivationOutput::Impure {
-                        .method = ingestionMethod,
+                        .method = method,
                         .hashType = ht,
                     });
             else
                 drv.outputs.insert_or_assign(i,
                     DerivationOutput::CAFloating {
-                        .method = ingestionMethod,
+                        .method = method,
                         .hashType = ht,
                     });
         }
diff --git a/tests/impure-derivations.nix b/tests/impure-derivations.nix
index 2fed56fe7..98547e6c1 100644
--- a/tests/impure-derivations.nix
+++ b/tests/impure-derivations.nix
@@ -15,8 +15,6 @@ rec {
         printf $((x + 1)) > $TEST_ROOT/counter
       '';
     __impure = true;
-    outputHashAlgo = "sha256";
-    outputHashMode = "recursive";
     impureEnvVars = [ "TEST_ROOT" ];
   };
 
@@ -32,8 +30,6 @@ rec {
         ln -s $out $out/self
       '';
     __impure = true;
-    outputHashAlgo = "sha256";
-    outputHashMode = "recursive";
   };
 
   # This is not allowed.
@@ -53,7 +49,6 @@ rec {
         x=$(< ${impureOnImpure}/n)
         printf ''${x:0:1} > $out
       '';
-    outputHashAlgo = "sha256";
     outputHashMode = "recursive";
     outputHash = "sha256-eBYxcgkuWuiqs4cKNgKwkb3vY/HR0vVsJnqe8itJGcQ=";
   };

From d63a5f5dd3b47e629295eb68264b4a6aadc65aa7 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 31 Mar 2022 17:33:06 +0200
Subject: [PATCH 224/251] Update release notes

---
 doc/manual/src/release-notes/rl-next.md | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/doc/manual/src/release-notes/rl-next.md b/doc/manual/src/release-notes/rl-next.md
index 2ec864ee4..4f3c9ce41 100644
--- a/doc/manual/src/release-notes/rl-next.md
+++ b/doc/manual/src/release-notes/rl-next.md
@@ -14,3 +14,21 @@
 
   This function is only available if you enable the experimental
   feature `fetch-closure`.
+
+* New experimental feature: *impure derivations*. These are
+  derivations that can produce a different result every time they're
+  built. Here is an example:
+
+  ```nix
+  stdenv.mkDerivation {
+    name = "impure";
+    __impure = true; # marks this derivation as impure
+    buildCommand = "date > $out";
+  }
+  ```
+
+  Running `nix build` twice on this expression will build the
+  derivation twice, producing two different content-addressed store
+  paths. Like fixed-output derivations, impure derivations have access
+  to the network. Only fixed-output derivations and impure derivations
+  can depend on an impure derivation.

From 6377442c983f4399d0a997238b898298e349fc1b Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 31 Mar 2022 17:38:15 +0200
Subject: [PATCH 225/251] tests/impure-derivations.sh: Ensure that
 inputAddressed build fails

---
 tests/impure-derivations.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/impure-derivations.sh b/tests/impure-derivations.sh
index aab5cb61a..35ae3f5d3 100644
--- a/tests/impure-derivations.sh
+++ b/tests/impure-derivations.sh
@@ -5,6 +5,8 @@ requireDaemonNewerThan "2.8pre20220311"
 enableFeatures "ca-derivations ca-references impure-derivations"
 restartDaemon
 
+set -o pipefail
+
 clearStore
 
 # Basic test of impure derivations: building one a second time should not use the previous result.
@@ -33,7 +35,7 @@ path4=$(nix build -L --no-link --json --file ./impure-derivations.nix impureOnIm
 [[ $(< $path4/self/n) = X3 ]]
 
 # Input-addressed derivations cannot depend on impure derivations directly.
-nix build -L --no-link --json --file ./impure-derivations.nix inputAddressed 2>&1 | grep 'depends on impure derivation'
+(! nix build -L --no-link --json --file ./impure-derivations.nix inputAddressed 2>&1) | grep 'depends on impure derivation'
 
 drvPath=$(nix eval --json --file ./impure-derivations.nix impure.drvPath | jq -r .)
 [[ $(nix show-derivation $drvPath | jq ".[\"$drvPath\"].outputs.out.impure") = true ]]

From 7492030ed7d1d570b71e832b610150054a9f095b Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Thu, 31 Mar 2022 22:14:53 +0300
Subject: [PATCH 226/251] scripts/install-systemd-multi-user.sh: fix another
 typo

---
 scripts/install-systemd-multi-user.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/install-systemd-multi-user.sh b/scripts/install-systemd-multi-user.sh
index 1d92c5388..62397127a 100755
--- a/scripts/install-systemd-multi-user.sh
+++ b/scripts/install-systemd-multi-user.sh
@@ -90,7 +90,7 @@ poly_configure_nix_daemon_service() {
               ln -sfn /nix/var/nix/profiles/default/$TMPFILES_SRC $TMPFILES_DEST
 
         _sudo "to run systemd-tmpfiles once to pick that path up" \
-             systemd-tmpfiles create --prefix=/nix/var/nix
+             systemd-tmpfiles --create --prefix=/nix/var/nix
 
         _sudo "to set up the nix-daemon service" \
               systemctl link "/nix/var/nix/profiles/default$SERVICE_SRC"

From fdfe737867920ed0ec29ba8ffb7d19854d8658bb Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 1 Apr 2022 12:40:49 +0200
Subject: [PATCH 227/251] Fix handling of outputHash when outputHashAlgo is not
 specified

https://hydra.nixos.org/build/171351131
---
 src/libexpr/primops.cc         | 7 +++----
 tests/ca/content-addressed.nix | 3 +--
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 969391725..73817dbdd 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -991,7 +991,7 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
     bool contentAddressed = false;
     bool isImpure = false;
     std::optional<std::string> outputHash;
-    std::optional<std::string> outputHashAlgo;
+    std::string outputHashAlgo;
     std::optional<FileIngestionMethod> ingestionMethod;
 
     StringSet outputs;
@@ -1190,8 +1190,7 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
                 .errPos = posDrvName
             });
 
-        std::optional<HashType> ht = parseHashTypeOpt(outputHashAlgo.value_or("sha256"));
-        Hash h = newHashAllowEmpty(*outputHash, ht);
+        auto h = newHashAllowEmpty(*outputHash, parseHashTypeOpt(outputHashAlgo));
 
         auto method = ingestionMethod.value_or(FileIngestionMethod::Flat);
         auto outPath = state.store->makeFixedOutputPath(method, h, drvName);
@@ -1212,7 +1211,7 @@ static void prim_derivationStrict(EvalState & state, const Pos & pos, Value * *
                 .errPos = posDrvName
             });
 
-        auto ht = parseHashType(outputHashAlgo.value_or("sha256"));
+        auto ht = parseHashTypeOpt(outputHashAlgo).value_or(htSHA256);
         auto method = ingestionMethod.value_or(FileIngestionMethod::Recursive);
 
         for (auto & i : outputs) {
diff --git a/tests/ca/content-addressed.nix b/tests/ca/content-addressed.nix
index d328fc92c..1be3eeb6e 100644
--- a/tests/ca/content-addressed.nix
+++ b/tests/ca/content-addressed.nix
@@ -64,8 +64,7 @@ rec {
   dependentFixedOutput = mkDerivation {
     name = "dependent-fixed-output";
     outputHashMode = "recursive";
-    outputHashAlgo = "sha256";
-    outputHash = "sha256-QvtAMbUl/uvi+LCObmqOhvNOapHdA2raiI4xG5zI5pA=";
+    outputHash = "sha512-7aJcmSuEuYP5tGKcmGY8bRr/lrCjJlOxP2mIUjO/vMQeg6gx/65IbzRWES8EKiPDOs9z+wF30lEfcwxM/cT4pw==";
     buildCommand = ''
       cat ${dependentCA}/dep
       echo foo > $out

From 435848cef12d065b209c82c96ce3a8bfa5e6a051 Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@nix.build>
Date: Fri, 1 Apr 2022 09:23:43 -0700
Subject: [PATCH 228/251] libutil: Fix restoring mount namespace

I regularly pass around simple scripts by using nix-shell as the script
interpreter, eg. like this:

    #!/usr/bin/env nix-shell
    #!nix-shell -p dd_rescue coreutils bash -i bash

While this works most of the time, I recently had one occasion where it
would not and the above would result in the following:

    $ sudo ./myscript.sh
    bash: ./myscript.sh: No such file or directory

Note the "sudo" here, because this error only occurs if we're root.

The reason for the latter is because running Nix as root means that we
can directly access the store, which makes sure we use a filesystem
namespace to make the store writable. XXX - REWORD!

So when stracing the process, I stumbled on the following sequence:

    openat(AT_FDCWD, "/proc/self/ns/mnt", O_RDONLY) = 3
    unshare(CLONE_NEWNS)                            = 0
    ... later ...
    getcwd("/the/real/cwd", 4096)                   = 14
    setns(3, CLONE_NEWNS)                           = 0
    getcwd("/", 4096)                               = 2

In the whole strace output there are no calls to chdir() whatsoever, so
I decided to look into the kernel source to see what else could change
directories and found this[1]:

    /* Update the pwd and root */
    set_fs_pwd(fs, &root);
    set_fs_root(fs, &root);

The set_fs_pwd() call is roughly equivalent to a chdir() syscall and
this is called when the setns() syscall is invoked[2].

[1]: https://github.com/torvalds/linux/blob/b14ffae378aa1db993e62b01392e70d1e585fb23/fs/namespace.c#L4659
[2]: https://github.com/torvalds/linux/blob/b14ffae378aa1db993e62b01392e70d1e585fb23/kernel/nsproxy.c#L346
---
 src/libutil/util.cc | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 59e3aad6d..e62672717 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -10,6 +10,7 @@
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
+#include <filesystem>
 #include <future>
 #include <iostream>
 #include <mutex>
@@ -1688,13 +1689,17 @@ void setStackSize(size_t stackSize)
     #endif
 }
 
+#if __linux__
 static AutoCloseFD fdSavedMountNamespace;
+std::optional<std::filesystem::path> savedCwd;
+#endif
 
 void saveMountNamespace()
 {
 #if __linux__
     static std::once_flag done;
     std::call_once(done, []() {
+        savedCwd.emplace(std::filesystem::current_path());
         AutoCloseFD fd = open("/proc/self/ns/mnt", O_RDONLY);
         if (!fd)
             throw SysError("saving parent mount namespace");
@@ -1712,6 +1717,12 @@ void restoreMountNamespace()
     } catch (Error & e) {
         debug(e.msg());
     }
+    try {
+        if (savedCwd)
+            std::filesystem::current_path(*savedCwd);
+    } catch (std::filesystem::filesystem_error const &e) {
+        debug(e.what());
+    }
 #endif
 }
 

From 7f5caaa7c0f151520d05d4662415ac09d4cf34b0 Mon Sep 17 00:00:00 2001
From: Cole Helbling <cole.e.helbling@outlook.com>
Date: Fri, 1 Apr 2022 10:24:31 -0700
Subject: [PATCH 229/251] libutil: Don't use std::filesystem

Just in case making libutil depend on std::filesystem is unacceptable,
here is the non-filesystem approach.
---
 src/libutil/util.cc | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index e62672717..0b18f1027 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -10,7 +10,6 @@
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
-#include <filesystem>
 #include <future>
 #include <iostream>
 #include <mutex>
@@ -1691,7 +1690,7 @@ void setStackSize(size_t stackSize)
 
 #if __linux__
 static AutoCloseFD fdSavedMountNamespace;
-std::optional<std::filesystem::path> savedCwd;
+std::optional<Path> savedCwd;
 #endif
 
 void saveMountNamespace()
@@ -1699,7 +1698,11 @@ void saveMountNamespace()
 #if __linux__
     static std::once_flag done;
     std::call_once(done, []() {
-        savedCwd.emplace(std::filesystem::current_path());
+        char* cwd = getcwd(NULL, 0);
+        if (cwd == NULL) throw SysError("getting cwd");
+        savedCwd.emplace(cwd);
+        free(cwd);
+
         AutoCloseFD fd = open("/proc/self/ns/mnt", O_RDONLY);
         if (!fd)
             throw SysError("saving parent mount namespace");
@@ -1717,11 +1720,8 @@ void restoreMountNamespace()
     } catch (Error & e) {
         debug(e.msg());
     }
-    try {
-        if (savedCwd)
-            std::filesystem::current_path(*savedCwd);
-    } catch (std::filesystem::filesystem_error const &e) {
-        debug(e.what());
+    if (savedCwd && chdir(savedCwd->c_str()) == -1) {
+        throw SysError("restoring cwd");
     }
 #endif
 }

From 2a45cf54e4201a894254604676dcb51f4c1a471c Mon Sep 17 00:00:00 2001
From: Cole Helbling <cole.e.helbling@outlook.com>
Date: Fri, 1 Apr 2022 12:20:34 -0700
Subject: [PATCH 230/251] libutil: Properly guard self-allocating getcwd on GNU

It's a GNU extension, as pointed out by pennae.
---
 src/libutil/util.cc | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 0b18f1027..28ab77adc 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1698,10 +1698,19 @@ void saveMountNamespace()
 #if __linux__
     static std::once_flag done;
     std::call_once(done, []() {
-        char* cwd = getcwd(NULL, 0);
-        if (cwd == NULL) throw SysError("getting cwd");
+#ifdef __GNU__
+        // getcwd allocating its return value is a GNU extension.
+        char *cwd = getcwd(NULL, 0);
+        if (cwd == NULL)
+#else
+        char cwd[PATH_MAX];
+        if (!getcwd(cwd, sizeof(cwd)))
+#endif
+            throw SysError("getting cwd");
         savedCwd.emplace(cwd);
+#ifdef __GNU__
         free(cwd);
+#endif
 
         AutoCloseFD fd = open("/proc/self/ns/mnt", O_RDONLY);
         if (!fd)

From c1e2ce4515c12ff0b4b1c3ab6d1e057507104979 Mon Sep 17 00:00:00 2001
From: Tom Bereknyei <tomberek@gmail.com>
Date: Thu, 31 Mar 2022 20:30:53 -0400
Subject: [PATCH 231/251] fix(run): set applyNixConfig lockFlag

---
 src/nix/run.cc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/nix/run.cc b/src/nix/run.cc
index 23e893fbf..25a8fa8d3 100644
--- a/src/nix/run.cc
+++ b/src/nix/run.cc
@@ -182,6 +182,7 @@ struct CmdRun : InstallableCommand
     {
         auto state = getEvalState();
 
+        lockFlags.applyNixConfig = true;
         auto app = installable->toApp(*state).resolve(getEvalStore(), store);
 
         Strings allArgs{app.program};

From a4a1de69dcc3c6e0c40a093d67b5f20568a5f31e Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 4 Apr 2022 16:49:39 +0200
Subject: [PATCH 232/251] Add missing #include

---
 src/libstore/build-result.hh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/libstore/build-result.hh b/src/libstore/build-result.hh
index cb6d19b8e..7f9bcce6d 100644
--- a/src/libstore/build-result.hh
+++ b/src/libstore/build-result.hh
@@ -1,6 +1,7 @@
 #pragma once
 
 #include "realisation.hh"
+#include "derived-path.hh"
 
 #include <string>
 #include <chrono>

From e5b70d47aa656833e4609106f9f1ef48b67664cc Mon Sep 17 00:00:00 2001
From: Cole Helbling <cole.e.helbling@outlook.com>
Date: Mon, 4 Apr 2022 08:19:49 -0700
Subject: [PATCH 233/251] libutil: cleanup savedCwd logic

Co-authored-by: Eelco Dolstra <edolstra@gmail.com>
---
 src/libutil/util.cc | 15 +--------------
 1 file changed, 1 insertion(+), 14 deletions(-)

diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 28ab77adc..9b34d5d72 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1698,20 +1698,7 @@ void saveMountNamespace()
 #if __linux__
     static std::once_flag done;
     std::call_once(done, []() {
-#ifdef __GNU__
-        // getcwd allocating its return value is a GNU extension.
-        char *cwd = getcwd(NULL, 0);
-        if (cwd == NULL)
-#else
-        char cwd[PATH_MAX];
-        if (!getcwd(cwd, sizeof(cwd)))
-#endif
-            throw SysError("getting cwd");
-        savedCwd.emplace(cwd);
-#ifdef __GNU__
-        free(cwd);
-#endif
-
+        savedCwd = absPath(".");
         AutoCloseFD fd = open("/proc/self/ns/mnt", O_RDONLY);
         if (!fd)
             throw SysError("saving parent mount namespace");

From e135d223f66f77f2b03a11b979d714e582364013 Mon Sep 17 00:00:00 2001
From: Cole Helbling <cole.e.helbling@outlook.com>
Date: Mon, 4 Apr 2022 08:32:45 -0700
Subject: [PATCH 234/251] libutil: save fd to cwd instead of cwd itself

---
 src/libutil/util.cc | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 9b34d5d72..a00a03978 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1690,7 +1690,7 @@ void setStackSize(size_t stackSize)
 
 #if __linux__
 static AutoCloseFD fdSavedMountNamespace;
-std::optional<Path> savedCwd;
+static AutoCloseFD fdSavedCwd;
 #endif
 
 void saveMountNamespace()
@@ -1698,11 +1698,15 @@ void saveMountNamespace()
 #if __linux__
     static std::once_flag done;
     std::call_once(done, []() {
-        savedCwd = absPath(".");
         AutoCloseFD fd = open("/proc/self/ns/mnt", O_RDONLY);
         if (!fd)
             throw SysError("saving parent mount namespace");
         fdSavedMountNamespace = std::move(fd);
+
+        fd = open("/proc/self/cwd", O_RDONLY);
+        if (!fd)
+            throw SysError("saving cwd");
+        fdSavedCwd = std::move(fd);
     });
 #endif
 }
@@ -1716,7 +1720,7 @@ void restoreMountNamespace()
     } catch (Error & e) {
         debug(e.msg());
     }
-    if (savedCwd && chdir(savedCwd->c_str()) == -1) {
+    if (fdSavedCwd && fchdir(fdSavedCwd.get()) == -1) {
         throw SysError("restoring cwd");
     }
 #endif

From f89b0f7846f2177b65eebdbff7f24a255d66819e Mon Sep 17 00:00:00 2001
From: Cole Helbling <cole.e.helbling@outlook.com>
Date: Mon, 4 Apr 2022 08:33:59 -0700
Subject: [PATCH 235/251] libutil: `try` restoring the cwd from fdSavedCwd

---
 src/libutil/util.cc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index a00a03978..1f800f3f4 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1717,12 +1717,12 @@ void restoreMountNamespace()
     try {
         if (fdSavedMountNamespace && setns(fdSavedMountNamespace.get(), CLONE_NEWNS) == -1)
             throw SysError("restoring parent mount namespace");
+        if (fdSavedCwd && fchdir(fdSavedCwd.get()) == -1) {
+            throw SysError("restoring cwd");
+        }
     } catch (Error & e) {
         debug(e.msg());
     }
-    if (fdSavedCwd && fchdir(fdSavedCwd.get()) == -1) {
-        throw SysError("restoring cwd");
-    }
 #endif
 }
 

From 10b9c1b2b269b96dcb8b3d298491fa143d1663e8 Mon Sep 17 00:00:00 2001
From: Cole Helbling <cole.e.helbling@outlook.com>
Date: Mon, 4 Apr 2022 10:16:30 -0700
Subject: [PATCH 236/251] libutil: save cwd fd in restoreMountNamespace
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This doesn't work very well (maybe I'm misunderstanding the desired
implementation):

    : ~/w/vc/nix ; doas outputs/out/bin/nix --experimental-features 'nix-command flakes' develop -c pwd
    pwd: couldn't find directory entry in ‘../../../..’ with matching i-node
---
 src/libutil/util.cc | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 1f800f3f4..701545589 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1690,7 +1690,6 @@ void setStackSize(size_t stackSize)
 
 #if __linux__
 static AutoCloseFD fdSavedMountNamespace;
-static AutoCloseFD fdSavedCwd;
 #endif
 
 void saveMountNamespace()
@@ -1702,11 +1701,6 @@ void saveMountNamespace()
         if (!fd)
             throw SysError("saving parent mount namespace");
         fdSavedMountNamespace = std::move(fd);
-
-        fd = open("/proc/self/cwd", O_RDONLY);
-        if (!fd)
-            throw SysError("saving cwd");
-        fdSavedCwd = std::move(fd);
     });
 #endif
 }
@@ -1715,6 +1709,10 @@ void restoreMountNamespace()
 {
 #if __linux__
     try {
+        AutoCloseFD fdSavedCwd = open("/proc/self/cwd", O_RDONLY);
+        if (!fdSavedCwd) {
+            throw SysError("saving cwd");
+        }
         if (fdSavedMountNamespace && setns(fdSavedMountNamespace.get(), CLONE_NEWNS) == -1)
             throw SysError("restoring parent mount namespace");
         if (fdSavedCwd && fchdir(fdSavedCwd.get()) == -1) {

From 56009b2639dc878be11f94d096fae56ac14dcd1d Mon Sep 17 00:00:00 2001
From: Cole Helbling <cole.e.helbling@outlook.com>
Date: Mon, 4 Apr 2022 10:21:56 -0700
Subject: [PATCH 237/251] libutil: don't save cwd fd, use path instead
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Saving the cwd fd didn't actually work well -- prior to this commit, the
following would happen:

    : ~/w/vc/nix ; doas outputs/out/bin/nix --experimental-features 'nix-command flakes' run nixpkgs#coreutils -- --coreutils-prog=pwd
    pwd: couldn't find directory entry in ‘../../../..’ with matching i-node
    : ~/w/vc/nix ; doas outputs/out/bin/nix --experimental-features 'nix-command flakes' develop -c pwd
    pwd: couldn't find directory entry in ‘../../../..’ with matching i-node
---
 src/libutil/util.cc | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 701545589..3132e7161 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1709,13 +1709,11 @@ void restoreMountNamespace()
 {
 #if __linux__
     try {
-        AutoCloseFD fdSavedCwd = open("/proc/self/cwd", O_RDONLY);
-        if (!fdSavedCwd) {
-            throw SysError("saving cwd");
-        }
+        auto savedCwd = absPath(".");
+
         if (fdSavedMountNamespace && setns(fdSavedMountNamespace.get(), CLONE_NEWNS) == -1)
             throw SysError("restoring parent mount namespace");
-        if (fdSavedCwd && fchdir(fdSavedCwd.get()) == -1) {
+        if (chdir(savedCwd.c_str()) == -1) {
             throw SysError("restoring cwd");
         }
     } catch (Error & e) {

From 5abe3f4aa61f33ac2124a624763e067257541871 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9ophane=20Hufschmitt?= <theophane@hufschmitt.net>
Date: Tue, 5 Apr 2022 11:03:43 +0200
Subject: [PATCH 238/251] Allow `welcomeText` when checking a flake template

Fix https://github.com/NixOS/nix/issues/6321
---
 src/nix/flake.cc | 2 +-
 tests/flakes.sh  | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 47a380238..ce7dc101a 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -463,7 +463,7 @@ struct CmdFlakeCheck : FlakeCommand
 
                 for (auto & attr : *v.attrs) {
                     std::string name(attr.name);
-                    if (name != "path" && name != "description")
+                    if (name != "path" && name != "description" && name != "welcomeText")
                         throw Error("template '%s' has unsupported attribute '%s'", attrPath, name);
                 }
             } catch (Error & e) {
diff --git a/tests/flakes.sh b/tests/flakes.sh
index ea629ae70..46e6a7982 100644
--- a/tests/flakes.sh
+++ b/tests/flakes.sh
@@ -376,6 +376,9 @@ cat > $templatesDir/flake.nix <<EOF
       trivial = {
         path = ./trivial;
         description = "A trivial flake";
+        welcomeText = ''
+            Welcome to my trivial flake
+        '';
       };
       default = trivial;
     };

From 660c19eb492d834c238bcdde02ba0a7e3c4f0c40 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9ophane=20Hufschmitt?= <theophane@hufschmitt.net>
Date: Tue, 5 Apr 2022 13:34:25 +0200
Subject: [PATCH 239/251] manual: Add some anchor targets for the nix.conf
 options
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For each `nix.conf` option, add an empty html node with a unique `id`
that can be used as an anchor target. Also make the name of the option
be a link to that target so that it’s easily discoverable.

We can’t rewrite the whole list as an html definition list like it’s
done for the builtins because these options also appear in a man page,
and the manpage renderer (lowdown) can’t render arbitrary html. But the
hack here allows to keep the manpage and have the links in the html
version.

Fix https://github.com/NixOS/nix/issues/5745
---
 doc/manual/generate-options.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/manual/generate-options.nix b/doc/manual/generate-options.nix
index 84d90beb6..2d586fa1b 100644
--- a/doc/manual/generate-options.nix
+++ b/doc/manual/generate-options.nix
@@ -6,7 +6,8 @@ options:
 concatStrings (map
   (name:
     let option = options.${name}; in
-    "  - `${name}`  \n\n"
+    "  - [`${name}`](#conf-${name})"
+    + "<p id=\"conf-${name}\"></p>\n\n"
     + concatStrings (map (s: "    ${s}\n") (splitLines option.description)) + "\n\n"
     + (if option.documentDefault
        then "    **Default:** " + (

From 9a640afc1e63bed28926cb44fe85137fb7d2d2d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9ophane=20Hufschmitt?= <theophane@hufschmitt.net>
Date: Tue, 5 Apr 2022 11:33:46 +0200
Subject: [PATCH 240/251] doctor: Always show the output

Fix https://github.com/NixOS/nix/issues/6342
---
 src/nix/doctor.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/nix/doctor.cc b/src/nix/doctor.cc
index 4f3003448..ea87e3d87 100644
--- a/src/nix/doctor.cc
+++ b/src/nix/doctor.cc
@@ -24,12 +24,12 @@ std::string formatProtocol(unsigned int proto)
 }
 
 bool checkPass(const std::string & msg) {
-    logger->log(ANSI_GREEN "[PASS] " ANSI_NORMAL + msg);
+    notice(ANSI_GREEN "[PASS] " ANSI_NORMAL + msg);
     return true;
 }
 
 bool checkFail(const std::string & msg) {
-    logger->log(ANSI_RED "[FAIL] " ANSI_NORMAL + msg);
+    notice(ANSI_RED "[FAIL] " ANSI_NORMAL + msg);
     return false;
 }
 

From f98d76ff1aeaaf18ea68a86f9eb91dd73b2d6ce4 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 5 Apr 2022 14:13:26 +0200
Subject: [PATCH 241/251] rl-2.7.md: Fix title

---
 doc/manual/src/release-notes/rl-2.7.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/manual/src/release-notes/rl-2.7.md b/doc/manual/src/release-notes/rl-2.7.md
index dc92a9cde..2f3879422 100644
--- a/doc/manual/src/release-notes/rl-2.7.md
+++ b/doc/manual/src/release-notes/rl-2.7.md
@@ -1,4 +1,4 @@
-# Release X.Y (2022-03-07)
+# Release 2.7 (2022-03-07)
 
 * Nix will now make some helpful suggestions when you mistype
   something on the command line. For instance, if you type `nix build

From 8d6c937d6a233106dcf9c3e0f0e1c60148b7a71e Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 5 Apr 2022 16:41:40 +0200
Subject: [PATCH 242/251] flake.lock: Update
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Flake lock file updates:

• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/82891b5e2c2359d7e58d08849e4c89511ab94234' (2021-09-28)
  → 'github:NixOS/nixpkgs/530a53dcbc9437363471167a5e4762c5fcfa34a1' (2022-02-19)
---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 61eccb73c..cd79fa85e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -18,11 +18,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1632864508,
-        "narHash": "sha256-d127FIvGR41XbVRDPVvozUPQ/uRHbHwvfyKHwEt5xFM=",
+        "lastModified": 1645296114,
+        "narHash": "sha256-y53N7TyIkXsjMpOG7RhvqJFGDacLs9HlyHeSTBioqYU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "82891b5e2c2359d7e58d08849e4c89511ab94234",
+        "rev": "530a53dcbc9437363471167a5e4762c5fcfa34a1",
         "type": "github"
       },
       "original": {

From 1fa03934791189f02208e1807d822128b216f087 Mon Sep 17 00:00:00 2001
From: Daniel Pauls <daniel1708.de+git@gmail.com>
Date: Tue, 5 Apr 2022 21:16:11 +0200
Subject: [PATCH 243/251] libutil: Reserve memory when en/decoding base64

The size of the output when encoding to and decoding from base64 is
(roughly) known so we can allocate it in advance to prevent
reallocation.
---
 src/libutil/util.cc | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 59e3aad6d..cca66d5bf 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1471,6 +1471,7 @@ constexpr char base64Chars[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuv
 std::string base64Encode(std::string_view s)
 {
     std::string res;
+    res.reserve((s.size() + 2) / 3 * 4);
     int data = 0, nbits = 0;
 
     for (char c : s) {
@@ -1502,6 +1503,9 @@ std::string base64Decode(std::string_view s)
     }();
 
     std::string res;
+    // Some sequences are missing the padding consisting of up to two '='.
+    //                    vvv
+    res.reserve((s.size() + 2) / 4 * 3);
     unsigned int d = 0, bits = 0;
 
     for (char c : s) {

From 513652d5947c1923a004318ea453cab786cabda1 Mon Sep 17 00:00:00 2001
From: Daniel Pauls <daniel1708.de+git@gmail.com>
Date: Tue, 5 Apr 2022 22:13:45 +0200
Subject: [PATCH 244/251] tokenizeString: Fix semantic mistake

`string_view::find_first_not_of(...)` and
`string_view::find_first_of(...)` return `string_view::npos` on error
not `string::npos`.
---
 src/libutil/util.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 59e3aad6d..8ab385837 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -1259,9 +1259,9 @@ template<class C> C tokenizeString(std::string_view s, std::string_view separato
 {
     C result;
     auto pos = s.find_first_not_of(separators, 0);
-    while (pos != std::string::npos) {
+    while (pos != std::string_view::npos) {
         auto end = s.find_first_of(separators, pos + 1);
-        if (end == std::string::npos) end = s.size();
+        if (end == std::string_view::npos) end = s.size();
         result.insert(result.end(), std::string(s, pos, end - pos));
         pos = s.find_first_not_of(separators, end);
     }

From 589f6f267b009bc2856597995db360f910e69a6f Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 6 Apr 2022 11:52:51 +0200
Subject: [PATCH 245/251] fetchClosure: Don't allow URL query parameters

Allowing this is a potential security hole, since it allows the user
to specify parameters like 'local-nar-cache'.
---
 src/libexpr/primops/fetchClosure.cc |  9 ++++++++-
 tests/fetchClosure.sh               | 12 ++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/src/libexpr/primops/fetchClosure.cc b/src/libexpr/primops/fetchClosure.cc
index efeb93daf..821eba698 100644
--- a/src/libexpr/primops/fetchClosure.cc
+++ b/src/libexpr/primops/fetchClosure.cc
@@ -61,6 +61,12 @@ static void prim_fetchClosure(EvalState & state, const Pos & pos, Value * * args
             .errPos = pos
         });
 
+    if (!parsedURL.query.empty())
+        throw Error({
+            .msg = hintfmt("'fetchClosure' does not support URL query parameters (in '%s')", *fromStoreUrl),
+            .errPos = pos
+        });
+
     auto fromStore = openStore(parsedURL.to_string());
 
     if (toCA) {
@@ -87,7 +93,8 @@ static void prim_fetchClosure(EvalState & state, const Pos & pos, Value * * args
                 });
         }
     } else {
-        copyClosure(*fromStore, *state.store, RealisedPath::Set { *fromPath });
+        if (!state.store->isValidPath(*fromPath))
+            copyClosure(*fromStore, *state.store, RealisedPath::Set { *fromPath });
         toPath = fromPath;
     }
 
diff --git a/tests/fetchClosure.sh b/tests/fetchClosure.sh
index 0c905ac43..96e4bb741 100644
--- a/tests/fetchClosure.sh
+++ b/tests/fetchClosure.sh
@@ -56,3 +56,15 @@ nix copy --to file://$cacheDir $caPath
     fromPath = $caPath;
   }
 ") = $caPath ]]
+
+# Check that URL query parameters aren't allowed.
+clearStore
+narCache=$TEST_ROOT/nar-cache
+rm -rf $narCache
+(! nix eval -v --raw --expr "
+  builtins.fetchClosure {
+    fromStore = \"file://$cacheDir?local-nar-cache=$narCache\";
+    fromPath = $caPath;
+  }
+")
+(! [ -e $narCache ])

From 318936366d5198123ae9ba0292538529f706dce8 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 6 Apr 2022 12:41:18 +0200
Subject: [PATCH 246/251] Fix empty 'nix copy' error message

This was caused by SubstitutionGoal not setting the errorMsg field in
its BuildResult. We now get a more descriptive message than in 2.7.0, e.g.

  error: path '/nix/store/13mh...' is required, but there is no substituter that can build it

instead of the misleading (since there was no build)

  error: build of '/nix/store/13mh...' failed

Fixes #6295.
---
 .../build/drv-output-substitution-goal.cc     |  2 +-
 src/libstore/build/substitution-goal.cc       | 19 ++++++++++++++-----
 src/libstore/build/substitution-goal.hh       |  5 ++++-
 3 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/src/libstore/build/drv-output-substitution-goal.cc b/src/libstore/build/drv-output-substitution-goal.cc
index e50292c1e..b7f7b5ab1 100644
--- a/src/libstore/build/drv-output-substitution-goal.cc
+++ b/src/libstore/build/drv-output-substitution-goal.cc
@@ -41,7 +41,7 @@ void DrvOutputSubstitutionGoal::tryNext()
     if (subs.size() == 0) {
         /* None left.  Terminate this goal and let someone else deal
            with it. */
-        debug("drv output '%s' is required, but there is no substituter that can provide it", id.to_string());
+        debug("derivation output '%s' is required, but there is no substituter that can provide it", id.to_string());
 
         /* Hack: don't indicate failure if there were no substituters.
            In that case the calling derivation should just do a
diff --git a/src/libstore/build/substitution-goal.cc b/src/libstore/build/substitution-goal.cc
index 31e6dbc9f..ca5218627 100644
--- a/src/libstore/build/substitution-goal.cc
+++ b/src/libstore/build/substitution-goal.cc
@@ -24,9 +24,16 @@ PathSubstitutionGoal::~PathSubstitutionGoal()
 }
 
 
-void PathSubstitutionGoal::done(ExitCode result, BuildResult::Status status)
+void PathSubstitutionGoal::done(
+    ExitCode result,
+    BuildResult::Status status,
+    std::optional<std::string> errorMsg)
 {
     buildResult.status = status;
+    if (errorMsg) {
+        debug(*errorMsg);
+        buildResult.errorMsg = *errorMsg;
+    }
     amDone(result);
 }
 
@@ -67,12 +74,14 @@ void PathSubstitutionGoal::tryNext()
     if (subs.size() == 0) {
         /* None left.  Terminate this goal and let someone else deal
            with it. */
-        debug("path '%s' is required, but there is no substituter that can build it", worker.store.printStorePath(storePath));
 
         /* Hack: don't indicate failure if there were no substituters.
            In that case the calling derivation should just do a
            build. */
-        done(substituterFailed ? ecFailed : ecNoSubstituters, BuildResult::NoSubstituters);
+        done(
+            substituterFailed ? ecFailed : ecNoSubstituters,
+            BuildResult::NoSubstituters,
+            fmt("path '%s' is required, but there is no substituter that can build it", worker.store.printStorePath(storePath)));
 
         if (substituterFailed) {
             worker.failedSubstitutions++;
@@ -169,10 +178,10 @@ void PathSubstitutionGoal::referencesValid()
     trace("all references realised");
 
     if (nrFailed > 0) {
-        debug("some references of path '%s' could not be realised", worker.store.printStorePath(storePath));
         done(
             nrNoSubstituters > 0 || nrIncompleteClosure > 0 ? ecIncompleteClosure : ecFailed,
-            BuildResult::DependencyFailed);
+            BuildResult::DependencyFailed,
+            fmt("some references of path '%s' could not be realised", worker.store.printStorePath(storePath)));
         return;
     }
 
diff --git a/src/libstore/build/substitution-goal.hh b/src/libstore/build/substitution-goal.hh
index 946f13841..a73f8e666 100644
--- a/src/libstore/build/substitution-goal.hh
+++ b/src/libstore/build/substitution-goal.hh
@@ -53,7 +53,10 @@ struct PathSubstitutionGoal : public Goal
     /* Content address for recomputing store path */
     std::optional<ContentAddress> ca;
 
-    void done(ExitCode result, BuildResult::Status status);
+    void done(
+        ExitCode result,
+        BuildResult::Status status,
+        std::optional<std::string> errorMsg = {});
 
 public:
     PathSubstitutionGoal(const StorePath & storePath, Worker & worker, RepairFlag repair = NoRepair, std::optional<ContentAddress> ca = std::nullopt);

From a7b12c6bd90cd44432bdaf45cb32b0af916d499c Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 6 Apr 2022 13:34:25 +0200
Subject: [PATCH 247/251] curl: Use --fail to catch errors

---
 scripts/check-hydra-status.sh | 2 +-
 scripts/install.in            | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/check-hydra-status.sh b/scripts/check-hydra-status.sh
index 5e2f03429..e62705e94 100644
--- a/scripts/check-hydra-status.sh
+++ b/scripts/check-hydra-status.sh
@@ -14,7 +14,7 @@ curl -sS -H 'Accept: application/json' https://hydra.nixos.org/jobset/nix/master
 someBuildFailed=0
 
 for buildId in $BUILDS_FOR_LATEST_EVAL; do
-  buildInfo=$(curl -sS -H 'Accept: application/json' "https://hydra.nixos.org/build/$buildId")
+  buildInfo=$(curl --fail -sS -H 'Accept: application/json' "https://hydra.nixos.org/build/$buildId")
 
   finished=$(echo "$buildInfo" | jq -r '.finished')
 
diff --git a/scripts/install.in b/scripts/install.in
index 38d1fb36f..af5f71080 100755
--- a/scripts/install.in
+++ b/scripts/install.in
@@ -82,7 +82,7 @@ if [ "$(uname -s)" != "Darwin" ]; then
 fi
 
 if command -v curl > /dev/null 2>&1; then
-    fetch() { curl -L "$1" -o "$2"; }
+    fetch() { curl --fail -L "$1" -o "$2"; }
 elif command -v wget > /dev/null 2>&1; then
     fetch() { wget "$1" -O "$2"; }
 else

From 1e1cd6e7a926097683da366983cc362c2430867d Mon Sep 17 00:00:00 2001
From: Daniel Pauls <daniel1708.de+git@gmail.com>
Date: Wed, 6 Apr 2022 17:33:23 +0200
Subject: [PATCH 248/251] libfetchers: Fix assertion

The filter expects all paths to have a prefix of the raw `actualUrl`, but
`Store::addToStore(...)` provides absolute canonicalized paths.
To fix this create an absolute and canonicalized path from the `actualUrl` and
use it instead.

Fixes #6195.
---
 src/libfetchers/git.cc | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/libfetchers/git.cc b/src/libfetchers/git.cc
index d75c5d3ae..f8433bc28 100644
--- a/src/libfetchers/git.cc
+++ b/src/libfetchers/git.cc
@@ -285,9 +285,11 @@ struct GitInputScheme : InputScheme
                 auto files = tokenizeString<std::set<std::string>>(
                     runProgram("git", true, gitOpts), "\0"s);
 
+                Path actualPath(absPath(actualUrl));
+
                 PathFilter filter = [&](const Path & p) -> bool {
-                    assert(hasPrefix(p, actualUrl));
-                    std::string file(p, actualUrl.size() + 1);
+                    assert(hasPrefix(p, actualPath));
+                    std::string file(p, actualPath.size() + 1);
 
                     auto st = lstat(p);
 
@@ -300,13 +302,13 @@ struct GitInputScheme : InputScheme
                     return files.count(file);
                 };
 
-                auto storePath = store->addToStore(input.getName(), actualUrl, FileIngestionMethod::Recursive, htSHA256, filter);
+                auto storePath = store->addToStore(input.getName(), actualPath, FileIngestionMethod::Recursive, htSHA256, filter);
 
                 // FIXME: maybe we should use the timestamp of the last
                 // modified dirty file?
                 input.attrs.insert_or_assign(
                     "lastModified",
-                    hasHead ? std::stoull(runProgram("git", true, { "-C", actualUrl, "log", "-1", "--format=%ct", "--no-show-signature", "HEAD" })) : 0);
+                    hasHead ? std::stoull(runProgram("git", true, { "-C", actualPath, "log", "-1", "--format=%ct", "--no-show-signature", "HEAD" })) : 0);
 
                 return {std::move(storePath), input};
             }

From b9c969a86667a7b16a7efa1df0e3d090ef2ead72 Mon Sep 17 00:00:00 2001
From: Rehno Lindeque <errantkid@gmail.com>
Date: Wed, 6 Apr 2022 12:20:39 -0400
Subject: [PATCH 249/251] nix flake check: Warn about deprecated nixosModule
 output

---
 src/nix/flake.cc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index ce7dc101a..a876bb3af 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -508,6 +508,7 @@ struct CmdFlakeCheck : FlakeCommand
                             name == "defaultBundler" ? "bundlers.<system>.default" :
                             name == "overlay" ? "overlays.default" :
                             name == "devShell" ? "devShells.<system>.default" :
+                            name == "nixosModule" ? "nixosModules.default" :
                             "";
                         if (replacement != "")
                             warn("flake output attribute '%s' is deprecated; use '%s' instead", name, replacement);

From 5ff4c42608bdf54d6f889f196f59a6c20c1631d6 Mon Sep 17 00:00:00 2001
From: Rehno Lindeque <errantkid@gmail.com>
Date: Wed, 6 Apr 2022 12:24:35 -0400
Subject: [PATCH 250/251] Update release notes

---
 doc/manual/src/release-notes/rl-next.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/doc/manual/src/release-notes/rl-next.md b/doc/manual/src/release-notes/rl-next.md
index 4f3c9ce41..8c8c0fd41 100644
--- a/doc/manual/src/release-notes/rl-next.md
+++ b/doc/manual/src/release-notes/rl-next.md
@@ -32,3 +32,11 @@
   paths. Like fixed-output derivations, impure derivations have access
   to the network. Only fixed-output derivations and impure derivations
   can depend on an impure derivation.
+
+* The `nixosModule` flake output attribute has been renamed consistent
+  with the `.default` renames in nix 2.7.
+
+  * `nixosModule` → `nixosModules.default`
+
+  As before, the old output will continue to work, but `nix flake check` will
+  issue a warning about it.

From 305d3a0ec3c7d53a5ceffee239c6cd4949f99423 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9ophane=20Hufschmitt?= <theophane@hufschmitt.net>
Date: Thu, 7 Apr 2022 17:31:12 +0200
Subject: [PATCH 251/251] Test fetchgit with path containing a `.` segment

---
 tests/fetchGit.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/fetchGit.sh b/tests/fetchGit.sh
index ac23be5c0..9179e2071 100644
--- a/tests/fetchGit.sh
+++ b/tests/fetchGit.sh
@@ -7,7 +7,9 @@ fi
 
 clearStore
 
-repo=$TEST_ROOT/git
+# Intentionally not in a canonical form
+# See https://github.com/NixOS/nix/issues/6195
+repo=$TEST_ROOT/./git
 
 export _NIX_FORCE_HTTP=1