puck/lix
0
0
Fork 0
forked from lix-project/lix
Code Pull requests Activity

Improve error message for fixed-outputs with references.

Browse source 
This codepath is possible, e.g. with a dockerTools.pullImage of an image with a Nix store.
This commit is contained in:
Shea Levy 2023-12-24 06:44:56 -05:00
parent e23983db82
commit eeb2f083c5
No known key found for this signature in database
GPG key ID: 5C0BD6957D86FE27
3 changed files with 16 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/libstore/store-api.cc
View file

@ -194,7 +194,10 @@ StorePath StoreDirConfig::makeFixedOutputPath(std::string_view name, const Fixed
if (info.hash.algo == HashAlgorithm::SHA256 && info.method == FileIngestionMethod::Recursive) { if (info.hash.algo == HashAlgorithm::SHA256 && info.method == FileIngestionMethod::Recursive) {
return makeStorePath(makeType(*this, "source", info.references), info.hash, name); return makeStorePath(makeType(*this, "source", info.references), info.hash, name);
} else { } else {
assert(info.references.size() == 0); if (!info.references.empty()) {
throw Error("fixed output derivation '%s' is not allowed to refer to other store paths.\nYou may need to use the 'unsafeDiscardReferences' derivation attribute, see the manual for more details.",
name);
}
return makeStorePath("output:out", return makeStorePath("output:out",
hashString(HashAlgorithm::SHA256, hashString(HashAlgorithm::SHA256,
"fixed:out:" "fixed:out:"

9
tests/functional/fixed.nix
View file

@ -48,6 +48,15 @@ rec {
(f ./fixed.builder1.sh "flat" "md5" "ddd8be4b179a529afa5f2ffae4b9858") (f ./fixed.builder1.sh "flat" "md5" "ddd8be4b179a529afa5f2ffae4b9858")
]; ];
badReferences = mkDerivation rec {
name = "bad-hash";
builder = script;
script = builtins.toFile "installer.sh" "echo $script >$out";
outputHash = "1ixr6yd3297ciyp9im522dfxpqbkhcw0pylkb2aab915278fqaik";
outputHashAlgo = "sha256";
outputHashMode = "flat";
};
# Test for building two derivations in parallel that produce the # Test for building two derivations in parallel that produce the
# same output path because they're fixed-output derivations. # same output path because they're fixed-output derivations.
parallelSame = [ parallelSame = [

3
tests/functional/fixed.sh
View file

@ -26,6 +26,9 @@ nix-build fixed.nix -A good2 --no-out-link
echo 'testing reallyBad...' echo 'testing reallyBad...'
nix-instantiate fixed.nix -A reallyBad && fail "should fail" nix-instantiate fixed.nix -A reallyBad && fail "should fail"
echo 'testing fixed with references...'
expectStderr 1 nix-build fixed.nix -A badReferences | grepQuiet "not allowed to refer to other store paths"
# While we're at it, check attribute selection a bit more. # While we're at it, check attribute selection a bit more.
echo 'testing attribute selection...' echo 'testing attribute selection...'
test $(nix-instantiate fixed.nix -A good.1 | wc -l) = 1 test $(nix-instantiate fixed.nix -A good.1 | wc -l) = 1