fetchClosure: Require a CA path in pure mode

1 files changed, 11 insertions, 4 deletions

diff --git a/src/libexpr/primops/fetchClosure.cc b/src/libexpr/primops/fetchClosure.cc
index 4bcc716db..22a4649a4 100644
--- a/src/libexpr/primops/fetchClosure.cc
+++ b/src/libexpr/primops/fetchClosure.cc
@@ -43,12 +43,19 @@ static void prim_fetchClosure(EvalState & state, const Pos & pos, Value * * args
 
     copyClosure(*srcStore, *state.store, RealisedPath::Set { *storePath });
 
-    auto storePathS = state.store->printStorePath(*storePath);
+    /* In pure mode, require a CA path. */
+    if (evalSettings.pureEval) {
+        auto info = state.store->queryPathInfo(*storePath);
+        if (!info->isContentAddressed(*state.store))
+            throw Error({
+                .msg = hintfmt("in pure mode, 'fetchClosure' requires a content-addressed path, which '%s' isn't",
+                    state.store->printStorePath(*storePath)),
+                .errPos = pos
+            });
+    }
 
+    auto storePathS = state.store->printStorePath(*storePath);
     v.mkString(storePathS, {storePathS});
-
-    // FIXME: in pure mode, require a CA path or a NAR hash of the
-    // top-level path.
 }
 
 static RegisterPrimOp primop_fetchClosure({