Support builtins.path with disallow-copy-paths

NixOS · Oct 24, 2024 · e95a4ba · e95a4ba
1 parent c7cd714
commit e95a4ba
Show file tree

Hide file tree

Showing 4 changed files with 50 additions and 9 deletions.
diff --git a/src/libexpr/eval-settings.hh b/src/libexpr/eval-settings.hh
@@ -255,6 +255,8 @@ struct EvalSettings : Config
           This is useful for finding expressions which copy sources, which can slow down evaluation.
           You may find copied sources by running `nix` commands with increased verbosity, such as `nix build -vvvv 2>&1 | grep /nix/store`.
           After identifying one more more paths, run `nix build --option disallow-copy-paths /nix/store/... --show-trace` to find the expression that copies the path, or add `--debugger`.
+
+          A filtering copy is always allowed, such as `builtins.filterSource` or `builtins.path { filter = ...; }`.
         )"};
 };
 

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
@@ -2390,7 +2390,8 @@ StorePath EvalState::fetchToStore(
     PathFilter * filter,
     RepairFlag repair)
 {
-    checkDisallowCopyPath(path);
+    if (!filter)
+        checkDisallowCopyPath(path);
     return ::nix::fetchToStore(*store, path, mode, name, method, filter, repair);
 }
 

diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
@@ -2486,8 +2486,12 @@ static void addPath(
                     path
                 ).atPos(pos).debugThrow();
             state.allowAndSetStorePathString(dstPath, v);
-        } else
+        } else {
+            if (!filterFun)
+                state.checkDisallowCopyPath(path);
+
             state.allowAndSetStorePathString(*expectedStorePath, v);
+        }
     } catch (Error & e) {
         e.addTrace(state.positions[pos], "while adding path '%s'", path);
         throw;

diff --git a/tests/functional/disallow-copy-paths.sh b/tests/functional/disallow-copy-paths.sh
@@ -7,10 +7,44 @@ clearStoreIfPossible
 # shellcheck disable=SC2016
 path="$(nix eval --raw --impure --expr '"${./disallow-copy-paths.sh}"')"
 
-# shellcheck disable=SC2016
-expectStderr 1 nix-instantiate \
-  --disallow-copy-paths "$path" \
-  --expr --strict \
-  --argstr path "$path" \
-  '{ path }: "${/. + path}" + "bla bla"' \
-  | grepQuiet "error.*not allowed to copy.*$path.* due to option.*disallow-copy-paths"
+all_tests() {
+
+  # shellcheck disable=SC2016
+  expectStderr 1 nix-instantiate \
+    --disallow-copy-paths "$path" \
+    --expr --strict \
+    --argstr path "$path" \
+    '{ path }: "${/. + path}" + "bla bla"' \
+    "$@" \
+    | grepQuiet "error.*not allowed to copy.*$path.* due to option.*disallow-copy-paths"
+
+  # shellcheck disable=SC2016
+  expectStderr 1 nix-instantiate \
+    --disallow-copy-paths "$path" \
+    --expr --strict \
+    --argstr path "$path" \
+    "$@" \
+    '{ path }: builtins.path { path = /. + path; name = "source"; } + "bla bla"' \
+    | grepQuiet "error.*not allowed to copy.*$path.* due to option.*disallow-copy-paths"
+
+  # shellcheck disable=SC2016
+  expectStderr 1 nix-instantiate \
+    --disallow-copy-paths "$path" \
+    --expr --strict \
+    --argstr path "$path" \
+    "$@" \
+    '{ path }: builtins.path { path = path; name = "source"; } + "bla bla"' \
+    | grepQuiet "error.*not allowed to copy.*$path.* due to option.*disallow-copy-paths"
+
+  # shellcheck disable=SC2016
+  nix-instantiate \
+    --disallow-copy-paths "$path" \
+    --expr --eval --strict \
+    "$@" \
+    --argstr path "$path" \
+    '{ path }: builtins.path { path = path; name = "source"; filter = _: _: true; } + "bla bla"' \
+
+}
+
+all_tests
+all_tests --readonly-mode