Open endgame opened 2 months ago
This issue has been mentioned on NixOS Discourse. There might be relevant details there:
https://discourse.nixos.org/t/2024-07-03-nix-team-meeting-minutes-158/49097/1
Triaged 2024-07-03:
This may be an IFD-related problem, considering this import in nix-freeze-tree
Could also be caused by recent-ish changes in EvalState
to use Source
- / InputAccessor
for allow-listing the accessible paths.
Maybe it's only allowing the direct references to the imported outputs; should be allowing whole closures.
Or maybe we should require
builtins.storePath
. Bugs aside, if you don't use that, and just havea /nix/store/....
path literal, that won't work with a chroot store. Two flakes is not necessary. One flake is enough to reproduce.
Call chain is realisePath -> realiseContext -> addPath -> addPathPrefix
; no computeFSClosure or similar. It should compute the closure.
This was not previously discovered because a lot of IFD only looks at the output, ignoring references.
Affected releases (non-exhaustive): Nix 2.20.6, Nix 2.21.2, Nix 2.22.1 Last unaffected release: Nix 2.19.4
It appears that recent versions of Nix have tightened pure evaluation mode. In the flake below, I pass a store path to a function from another flake, which used to work in older versions of Nix.
To reproduce, run
nix build
on the following flake:You should see
error: access to absolute path '/nix/store/bhgy1rz0hi7b9anbnyr6zjgp0jh5dwrg-step1' is forbidden in pure evaluation mode (use '--impure' to override)
.