getFlake: In pure mode, check that the argument is an immutable flakeref

1 files changed, 6 insertions, 1 deletions

diff --git a/src/libexpr/flake/flake.cc b/src/libexpr/flake/flake.cc
index 59362c018..313f3bdbd 100644
--- a/src/libexpr/flake/flake.cc
+++ b/src/libexpr/flake/flake.cc
@@ -628,8 +628,13 @@ void callFlake(EvalState & state,
 
 static void prim_getFlake(EvalState & state, const Pos & pos, Value * * args, Value & v)
 {
+    auto flakeRefS = state.forceStringNoCtx(*args[0], pos);
+    auto flakeRef = parseFlakeRef(flakeRefS);
+    if (evalSettings.pureEval && !flakeRef.input->isImmutable())
+        throw Error("cannot call 'getFlake' on mutable flake reference '%s', at %s (use --impure to override)", flakeRefS, pos);
+
     callFlake(state,
-        lockFlake(state, parseFlakeRef(state.forceStringNoCtx(*args[0], pos)),
+        lockFlake(state, flakeRef,
             LockFlags {
                 .updateLockFile = false,
                 .useRegistries = !evalSettings.pureEval,