Evaluation dependence on external tools: docs, purity, fallbacks

dtzWill commented 6 years ago

Various functionality provided by Nix tools and builtins relies on the presence and "correct" functionality of external tools.

This seems... unfortunate :innocent: .

The biggest issue is one of simple usability: evaluation failures due to missing tools are a bad experience and it's not always obvious, trivial, or convenient to manipulate the environment of the Nix-based process you're interacting with to properly resolve them.

As an example, nix-based services (such as the auto-upgrader) will fail to evaluate expressions using builtins.fetchGit and fixing it requires modifying the service configuration to add required tools to the service's PATH.

Additional related issues:

The full list of tools required to make use of builtin Nix functionality is not available AFAICT (although this is easily fixed)
Reliance on these tools makes Nix evaluation "brittle" in a very (IMHO) non-Nix way--consider attempting to use Nix itself in a sandbox.
Reliability and purity: tools found may have different behavior than those expected and tested against (newer, older, bugged, malicious replacements).

I'm not sure of the best solution here, especially considering concerns about closure size and ease of deployment (being self-contained is rather useful here).

It's not perfect but best proposal I have is to replace all external programs with use of (mandatory?) libraries.

Thoughts? :)

lheckemann commented 6 years ago

As a sort of compromise, maybe we could produce wrappers for nix that set add the appropriate tools to PATH, and make the default nix in nixpkgs such a wrapped one? This would allow a reduced closure size while enabling all the functionality to work by default.

copumpkin commented 6 years ago

I submitted this a while back, which could be relevant: https://github.com/NixOS/nix/pull/1345

copumpkin commented 6 years ago

One thing that might be nice is a first-class building block for optional external dependencies in Nix code, that would let us enumerate them and detect early if they're available or not, to emit warnings/errors.

stale[bot] commented 3 years ago

I marked this as stale due to inactivity. → More info

NixOS / nix

Evaluation dependence on external tools: docs, purity, fallbacks #1833