···134134 "__darwinAllowLocalNetworking"
135135 "__impureHostDeps" "__propagatedImpureHostDeps"
136136 "sandboxProfile" "propagatedSandboxProfile"
137137+ "disallowedReferences" "disallowedRequisites"
138138+ "allowedReferences" "allowedRequisites"
137139 ];
138140139141 # Turn a derivation into its outPath without a string context attached.
···142144 if isDerivation drv && (!drv.__contentAddressed or false)
143145 then builtins.unsafeDiscardStringContext drv.outPath
144146 else drv;
147147+148148+ makeOutputChecks = attrs:
149149+ # If we use derivations directly here, they end up as build-time dependencies.
150150+ # This is especially problematic in the case of disallowed*, since the disallowed
151151+ # derivations will be built by nix as build-time dependencies, while those
152152+ # derivations might take a very long time to build, or might not even build
153153+ # successfully on the platform used.
154154+ # We can improve on this situation by instead passing only the outPath,
155155+ # without an attached string context, to nix. The out path will be a placeholder
156156+ # which will be replaced by the actual out path if the derivation in question
157157+ # is part of the final closure (and thus needs to be built). If it is not
158158+ # part of the final closure, then the placeholder will be passed along,
159159+ # but in that case we know for a fact that the derivation is not part of the closure.
160160+ # This means that passing the out path to nix does the right thing in either
161161+ # case, both for disallowed and allowed references/requisites, and we won't
162162+ # build the derivation if it wouldn't be part of the closure, saving time and resources.
163163+ # While the problem is less severe for allowed*, since we want the derivation
164164+ # to be built eventually, we would still like to get the error early and without
165165+ # having to wait while nix builds a derivation that might not be used.
166166+ # See also https://github.com/NixOS/nix/issues/4629
167167+ optionalAttrs (attrs ? disallowedReferences) {
168168+ disallowedReferences =
169169+ map unsafeDerivationToUntrackedOutpath attrs.disallowedReferences;
170170+ } //
171171+ optionalAttrs (attrs ? disallowedRequisites) {
172172+ disallowedRequisites =
173173+ map unsafeDerivationToUntrackedOutpath attrs.disallowedRequisites;
174174+ } //
175175+ optionalAttrs (attrs ? allowedReferences) {
176176+ allowedReferences =
177177+ mapNullable unsafeDerivationToUntrackedOutpath attrs.allowedReferences;
178178+ } //
179179+ optionalAttrs (attrs ? allowedRequisites) {
180180+ allowedRequisites =
181181+ mapNullable unsafeDerivationToUntrackedOutpath attrs.allowedRequisites;
182182+ };
145183146184 makeDerivationArgument =
147185···455493 "/bin/sh"
456494 ];
457495 __propagatedImpureHostDeps = computedPropagatedImpureHostDeps ++ __propagatedImpureHostDeps;
458458- }) //
459459- # If we use derivations directly here, they end up as build-time dependencies.
460460- # This is especially problematic in the case of disallowed*, since the disallowed
461461- # derivations will be built by nix as build-time dependencies, while those
462462- # derivations might take a very long time to build, or might not even build
463463- # successfully on the platform used.
464464- # We can improve on this situation by instead passing only the outPath,
465465- # without an attached string context, to nix. The out path will be a placeholder
466466- # which will be replaced by the actual out path if the derivation in question
467467- # is part of the final closure (and thus needs to be built). If it is not
468468- # part of the final closure, then the placeholder will be passed along,
469469- # but in that case we know for a fact that the derivation is not part of the closure.
470470- # This means that passing the out path to nix does the right thing in either
471471- # case, both for disallowed and allowed references/requisites, and we won't
472472- # build the derivation if it wouldn't be part of the closure, saving time and resources.
473473- # While the problem is less severe for allowed*, since we want the derivation
474474- # to be built eventually, we would still like to get the error early and without
475475- # having to wait while nix builds a derivation that might not be used.
476476- # See also https://github.com/NixOS/nix/issues/4629
477477- optionalAttrs (attrs ? disallowedReferences) {
478478- disallowedReferences =
479479- map unsafeDerivationToUntrackedOutpath attrs.disallowedReferences;
480480- } //
481481- optionalAttrs (attrs ? disallowedRequisites) {
482482- disallowedRequisites =
483483- map unsafeDerivationToUntrackedOutpath attrs.disallowedRequisites;
484484- } //
485485- optionalAttrs (attrs ? allowedReferences) {
486486- allowedReferences =
487487- mapNullable unsafeDerivationToUntrackedOutpath attrs.allowedReferences;
488488- } //
489489- optionalAttrs (attrs ? allowedRequisites) {
490490- allowedRequisites =
491491- mapNullable unsafeDerivationToUntrackedOutpath attrs.allowedRequisites;
496496+ }) // lib.optionalAttrs (!__structuredAttrs) (
497497+ makeOutputChecks attrs
498498+ ) // lib.optionalAttrs (__structuredAttrs) {
499499+ outputChecks = builtins.listToAttrs (map (name: {
500500+ inherit name;
501501+ value = lib.zipAttrsWith (_: builtins.concatLists) [
502502+ (makeOutputChecks attrs)
503503+ (makeOutputChecks attrs.outputChecks.${name} or {})
504504+ ];
505505+ }) outputs);
492506 };
493507494508in