aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--doc/manual/custom.css4
-rw-r--r--doc/manual/src/command-ref/env-common.md13
-rw-r--r--doc/manual/src/language/index.md2
-rw-r--r--flake.nix2
-rw-r--r--scripts/install-multi-user.sh2
-rw-r--r--scripts/install-nix-from-closure.sh8
-rw-r--r--scripts/nix-profile-daemon.sh.in31
-rw-r--r--scripts/nix-profile.sh.in30
-rw-r--r--src/libexpr/eval.cc2
-rw-r--r--src/libstore/globals.hh21
-rw-r--r--src/libstore/profiles.cc4
-rw-r--r--src/libstore/profiles.hh5
-rw-r--r--src/libutil/util.cc13
-rw-r--r--src/libutil/util.hh6
-rwxr-xr-xsrc/nix-channel/nix-channel.cc4
-rw-r--r--src/nix-env/nix-env.cc7
-rw-r--r--src/nix/daemon.cc10
-rw-r--r--tests/common.sh.in6
-rw-r--r--tests/nix-channel.sh13
-rw-r--r--tests/nix-profile.sh8
-rw-r--r--tests/nixos/authorization.nix79
21 files changed, 244 insertions, 26 deletions
diff --git a/doc/manual/custom.css b/doc/manual/custom.css
index 69d48d4a7..b90f5423f 100644
--- a/doc/manual/custom.css
+++ b/doc/manual/custom.css
@@ -5,3 +5,7 @@ h1:not(:first-of-type) {
h2 {
margin-top: 1em;
}
+
+.hljs-meta {
+ user-select: none;
+}
diff --git a/doc/manual/src/command-ref/env-common.md b/doc/manual/src/command-ref/env-common.md
index bb85a6b07..c5d38db47 100644
--- a/doc/manual/src/command-ref/env-common.md
+++ b/doc/manual/src/command-ref/env-common.md
@@ -91,3 +91,16 @@ Most Nix commands interpret the following environment variables:
variable sets the initial size of the heap in bytes. It defaults to
384 MiB. Setting it to a low value reduces memory consumption, but
will increase runtime due to the overhead of garbage collection.
+
+## XDG Base Directory
+
+New Nix commands conform to the [XDG Base Directory Specification], and use the following environment variables to determine locations of various state and configuration files:
+
+- [`XDG_CONFIG_HOME`]{#env-XDG_CONFIG_HOME} (default `~/.config`)
+- [`XDG_STATE_HOME`]{#env-XDG_STATE_HOME} (default `~/.local/state`)
+- [`XDG_CACHE_HOME`]{#env-XDG_CACHE_HOME} (default `~/.cache`)
+
+Classic Nix commands can also be made to follow this standard using the [`use-xdg-base-directories`] configuration option.
+
+[XDG Base Directory Specification]: https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
+[`use-xdg-base-directories`]: ../command-ref/conf-file.md#conf-use-xdg-base-directories \ No newline at end of file
diff --git a/doc/manual/src/language/index.md b/doc/manual/src/language/index.md
index 31300631c..3eabe1a02 100644
--- a/doc/manual/src/language/index.md
+++ b/doc/manual/src/language/index.md
@@ -91,7 +91,7 @@ This is an incomplete overview of language features, by example.
<tr>
<td>
- `"hello ${ { a = "world" }.a }"`
+ `"hello ${ { a = "world"; }.a }"`
`"1 2 ${toString 3}"`
diff --git a/flake.nix b/flake.nix
index 0325f33b1..7f0b738f8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -499,6 +499,8 @@
};
# System tests.
+ tests.authorization = runNixOSTestFor "x86_64-linux" ./tests/nixos/authorization.nix;
+
tests.remoteBuilds = runNixOSTestFor "x86_64-linux" ./tests/nixos/remote-builds.nix;
tests.nix-copy-closure = runNixOSTestFor "x86_64-linux" ./tests/nixos/nix-copy-closure.nix;
diff --git a/scripts/install-multi-user.sh b/scripts/install-multi-user.sh
index f149ea0d7..7c66538b0 100644
--- a/scripts/install-multi-user.sh
+++ b/scripts/install-multi-user.sh
@@ -136,7 +136,7 @@ EOF
cat <<EOF
$step. Delete the files Nix added to your system:
- sudo rm -rf /etc/nix $NIX_ROOT $ROOT_HOME/.nix-profile $ROOT_HOME/.nix-defexpr $ROOT_HOME/.nix-channels $HOME/.nix-profile $HOME/.nix-defexpr $HOME/.nix-channels
+ sudo rm -rf "/etc/nix" "$NIX_ROOT" "$ROOT_HOME/.nix-profile" "$ROOT_HOME/.nix-defexpr" "$ROOT_HOME/.nix-channels" "$ROOT_HOME/.local/state/nix" "$ROOT_HOME/.cache/nix" "$HOME/.nix-profile" "$HOME/.nix-defexpr" "$HOME/.nix-channels" "$HOME/.local/state/nix" "$HOME/.cache/nix"
and that is it.
diff --git a/scripts/install-nix-from-closure.sh b/scripts/install-nix-from-closure.sh
index ccd19e1a8..794622530 100644
--- a/scripts/install-nix-from-closure.sh
+++ b/scripts/install-nix-from-closure.sh
@@ -188,6 +188,8 @@ fi
# shellcheck source=./nix-profile.sh.in
. "$nix/etc/profile.d/nix.sh"
+NIX_LINK="$HOME/.nix-profile"
+
if ! "$nix/bin/nix-env" -i "$nix"; then
echo "$0: unable to install Nix into your default profile" >&2
exit 1
@@ -196,7 +198,7 @@ fi
# Install an SSL certificate bundle.
if [ -z "$NIX_SSL_CERT_FILE" ] || ! [ -f "$NIX_SSL_CERT_FILE" ]; then
"$nix/bin/nix-env" -i "$cacert"
- export NIX_SSL_CERT_FILE="$HOME/.nix-profile/etc/ssl/certs/ca-bundle.crt"
+ export NIX_SSL_CERT_FILE="$NIX_LINK/etc/ssl/certs/ca-bundle.crt"
fi
# Subscribe the user to the Nixpkgs channel and fetch it.
@@ -214,8 +216,8 @@ fi
added=
p=
-p_sh=$HOME/.nix-profile/etc/profile.d/nix.sh
-p_fish=$HOME/.nix-profile/etc/profile.d/nix.fish
+p_sh=$NIX_LINK/etc/profile.d/nix.sh
+p_fish=$NIX_LINK/etc/profile.d/nix.fish
if [ -z "$NIX_INSTALLER_NO_MODIFY_PROFILE" ]; then
# Make the shell source nix.sh during login.
for i in .bash_profile .bash_login .profile; do
diff --git a/scripts/nix-profile-daemon.sh.in b/scripts/nix-profile-daemon.sh.in
index 0a47571ac..235536c65 100644
--- a/scripts/nix-profile-daemon.sh.in
+++ b/scripts/nix-profile-daemon.sh.in
@@ -2,7 +2,33 @@
if [ -n "${__ETC_PROFILE_NIX_SOURCED:-}" ]; then return; fi
__ETC_PROFILE_NIX_SOURCED=1
-export NIX_PROFILES="@localstatedir@/nix/profiles/default $HOME/.nix-profile"
+NIX_LINK=$HOME/.nix-profile
+if [ -n "$XDG_STATE_HOME" ]; then
+ NIX_LINK_NEW="$XDG_STATE_HOME/nix/profile"
+else
+ NIX_LINK_NEW=$HOME/.local/state/nix/profile
+fi
+if ! [ -e "$NIX_LINK" ]; then
+ NIX_LINK="$NIX_LINK_NEW"
+else
+ if [ -t 2 ] && [ -e "$NIX_LINK_NEW" ]; then
+ warning="\033[1;35mwarning:\033[0m"
+ printf "$warning Both %s and legacy %s exist; using the latter.\n" "$NIX_LINK_NEW" "$NIX_LINK" 1>&2
+ if [ "$(realpath "$NIX_LINK")" = "$(realpath "$NIX_LINK_NEW")" ]; then
+ printf " Since the profiles match, you can safely delete either of them.\n" 1>&2
+ else
+ # This should be an exceptionally rare occasion: the only way to get it would be to
+ # 1. Update to newer Nix;
+ # 2. Remove .nix-profile;
+ # 3. Set the $NIX_LINK_NEW to something other than the default user profile;
+ # 4. Roll back to older Nix.
+ # If someone did all that, they can probably figure out how to migrate the profile.
+ printf "$warning Profiles do not match. You should manually migrate from %s to %s.\n" "$NIX_LINK" "$NIX_LINK_NEW" 1>&2
+ fi
+ fi
+fi
+
+export NIX_PROFILES="@localstatedir@/nix/profiles/default $NIX_LINK"
# Set $NIX_SSL_CERT_FILE so that Nixpkgs applications like curl work.
if [ -n "${NIX_SSL_CERT_FILE:-}" ]; then
@@ -34,4 +60,5 @@ else
unset -f check_nix_profiles
fi
-export PATH="$HOME/.nix-profile/bin:@localstatedir@/nix/profiles/default/bin:$PATH"
+export PATH="$NIX_LINK/bin:@localstatedir@/nix/profiles/default/bin:$PATH"
+unset NIX_LINK
diff --git a/scripts/nix-profile.sh.in b/scripts/nix-profile.sh.in
index 5636085d4..264d9a8e2 100644
--- a/scripts/nix-profile.sh.in
+++ b/scripts/nix-profile.sh.in
@@ -2,11 +2,35 @@ if [ -n "$HOME" ] && [ -n "$USER" ]; then
# Set up the per-user profile.
- NIX_LINK=$HOME/.nix-profile
+ NIX_LINK="$HOME/.nix-profile"
+ if [ -n "$XDG_STATE_HOME" ]; then
+ NIX_LINK_NEW="$XDG_STATE_HOME/nix/profile"
+ else
+ NIX_LINK_NEW="$HOME/.local/state/nix/profile"
+ fi
+ if ! [ -e "$NIX_LINK" ]; then
+ NIX_LINK="$NIX_LINK_NEW"
+ else
+ if [ -t 2 ] && [ -e "$NIX_LINK_NEW" ]; then
+ warning="\033[1;35mwarning:\033[0m"
+ printf "$warning Both %s and legacy %s exist; using the latter.\n" "$NIX_LINK_NEW" "$NIX_LINK" 1>&2
+ if [ "$(realpath "$NIX_LINK")" = "$(realpath "$NIX_LINK_NEW")" ]; then
+ printf " Since the profiles match, you can safely delete either of them.\n" 1>&2
+ else
+ # This should be an exceptionally rare occasion: the only way to get it would be to
+ # 1. Update to newer Nix;
+ # 2. Remove .nix-profile;
+ # 3. Set the $NIX_LINK_NEW to something other than the default user profile;
+ # 4. Roll back to older Nix.
+ # If someone did all that, they can probably figure out how to migrate the profile.
+ printf "$warning Profiles do not match. You should manually migrate from %s to %s.\n" "$NIX_LINK" "$NIX_LINK_NEW" 1>&2
+ fi
+ fi
+ fi
# Set up environment.
# This part should be kept in sync with nixpkgs:nixos/modules/programs/environment.nix
- export NIX_PROFILES="@localstatedir@/nix/profiles/default $HOME/.nix-profile"
+ export NIX_PROFILES="@localstatedir@/nix/profiles/default $NIX_LINK"
# Set $NIX_SSL_CERT_FILE so that Nixpkgs applications like curl work.
if [ -e /etc/ssl/certs/ca-certificates.crt ]; then # NixOS, Ubuntu, Debian, Gentoo, Arch
@@ -31,5 +55,5 @@ if [ -n "$HOME" ] && [ -n "$USER" ]; then
fi
export PATH="$NIX_LINK/bin:$PATH"
- unset NIX_LINK
+ unset NIX_LINK NIX_LINK_NEW
fi
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index a48968656..3e37c7f60 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -2496,7 +2496,7 @@ Strings EvalSettings::getDefaultNixPath()
res.push_back(s ? *s + "=" + p : p);
};
- add(getHome() + "/.nix-defexpr/channels");
+ add(settings.useXDGBaseDirectories ? getStateDir() + "/nix/defexpr/channels" : getHome() + "/.nix-defexpr/channels");
add(settings.nixStateDir + "/profiles/per-user/root/channels/nixpkgs", "nixpkgs");
add(settings.nixStateDir + "/profiles/per-user/root/channels");
diff --git a/src/libstore/globals.hh b/src/libstore/globals.hh
index 42981219d..0a4912f67 100644
--- a/src/libstore/globals.hh
+++ b/src/libstore/globals.hh
@@ -945,6 +945,27 @@ public:
resolves to a different location from that of the build machine. You
can enable this setting if you are sure you're not going to do that.
)"};
+
+ Setting<bool> useXDGBaseDirectories{
+ this, false, "use-xdg-base-directories",
+ R"(
+ If set to `true`, Nix will conform to the [XDG Base Directory Specification] for files in `$HOME`.
+ The environment variables used to implement this are documented in the [Environment Variables section](@docroot@/installation/env-variables.md).
+
+ [XDG Base Directory Specification]: https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
+
+ > **Warning**
+ > This changes the location of some well-known symlinks that Nix creates, which might break tools that rely on the old, non-XDG-conformant locations.
+
+ In particular, the following locations change:
+
+ | Old | New |
+ |-------------------|--------------------------------|
+ | `~/.nix-profile` | `$XDG_STATE_HOME/nix/profile` |
+ | `~/.nix-defexpr` | `$XDG_STATE_HOME/nix/defexpr` |
+ | `~/.nix-channels` | `$XDG_STATE_HOME/nix/channels` |
+ )"
+ };
};
diff --git a/src/libstore/profiles.cc b/src/libstore/profiles.cc
index b202351ce..c551c5f3e 100644
--- a/src/libstore/profiles.cc
+++ b/src/libstore/profiles.cc
@@ -282,7 +282,7 @@ std::string optimisticLockProfile(const Path & profile)
Path profilesDir()
{
- auto profileRoot = getDataDir() + "/nix/profiles";
+ auto profileRoot = createNixStateDir() + "/profiles";
createDirs(profileRoot);
return profileRoot;
}
@@ -290,7 +290,7 @@ Path profilesDir()
Path getDefaultProfile()
{
- Path profileLink = getHome() + "/.nix-profile";
+ Path profileLink = settings.useXDGBaseDirectories ? createNixStateDir() + "/profile" : getHome() + "/.nix-profile";
try {
auto profile =
getuid() == 0
diff --git a/src/libstore/profiles.hh b/src/libstore/profiles.hh
index 73667a798..fbf95b850 100644
--- a/src/libstore/profiles.hh
+++ b/src/libstore/profiles.hh
@@ -72,8 +72,9 @@ std::string optimisticLockProfile(const Path & profile);
profiles. */
Path profilesDir();
-/* Resolve ~/.nix-profile. If ~/.nix-profile doesn't exist yet, create
- it. */
+/* Resolve the default profile (~/.nix-profile by default, $XDG_STATE_HOME/
+ nix/profile if XDG Base Directory Support is enabled), and create if doesn't
+ exist */
Path getDefaultProfile();
}
diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 795b66dc3..885bae69c 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -609,6 +609,19 @@ Path getDataDir()
return dataDir ? *dataDir : getHome() + "/.local/share";
}
+Path getStateDir()
+{
+ auto stateDir = getEnv("XDG_STATE_HOME");
+ return stateDir ? *stateDir : getHome() + "/.local/state";
+}
+
+Path createNixStateDir()
+{
+ Path dir = getStateDir() + "/nix";
+ createDirs(dir);
+ return dir;
+}
+
std::optional<Path> getSelfExe()
{
diff --git a/src/libutil/util.hh b/src/libutil/util.hh
index 95562280e..b5625ecef 100644
--- a/src/libutil/util.hh
+++ b/src/libutil/util.hh
@@ -158,6 +158,12 @@ Path getDataDir();
/* Return the path of the current executable. */
std::optional<Path> getSelfExe();
+/* Return $XDG_STATE_HOME or $HOME/.local/state. */
+Path getStateDir();
+
+/* Create the Nix state directory and return the path to it. */
+Path createNixStateDir();
+
/* Create a directory and all its parents, if necessary. Returns the
list of created directories, in order of creation. */
Paths createDirs(const Path & path);
diff --git a/src/nix-channel/nix-channel.cc b/src/nix-channel/nix-channel.cc
index 263d85eea..338a7d18e 100755
--- a/src/nix-channel/nix-channel.cc
+++ b/src/nix-channel/nix-channel.cc
@@ -164,8 +164,8 @@ static int main_nix_channel(int argc, char ** argv)
{
// Figure out the name of the `.nix-channels' file to use
auto home = getHome();
- channelsList = home + "/.nix-channels";
- nixDefExpr = home + "/.nix-defexpr";
+ channelsList = settings.useXDGBaseDirectories ? createNixStateDir() + "/channels" : home + "/.nix-channels";
+ nixDefExpr = settings.useXDGBaseDirectories ? createNixStateDir() + "/defexpr" : home + "/.nix-defexpr";
// Figure out the name of the channels profile.
profile = profilesDir() + "/channels";
diff --git a/src/nix-env/nix-env.cc b/src/nix-env/nix-env.cc
index 406e548c0..0daf374de 100644
--- a/src/nix-env/nix-env.cc
+++ b/src/nix-env/nix-env.cc
@@ -1289,7 +1289,7 @@ static void opSwitchProfile(Globals & globals, Strings opFlags, Strings opArgs)
throw UsageError("exactly one argument expected");
Path profile = absPath(opArgs.front());
- Path profileLink = getHome() + "/.nix-profile";
+ Path profileLink = settings.useXDGBaseDirectories ? createNixStateDir() + "/profile" : getHome() + "/.nix-profile";
switchLink(profileLink, profile);
}
@@ -1393,7 +1393,10 @@ static int main_nix_env(int argc, char * * argv)
Globals globals;
globals.instSource.type = srcUnknown;
- globals.instSource.nixExprPath = getHome() + "/.nix-defexpr";
+ {
+ Path nixExprPath = settings.useXDGBaseDirectories ? createNixStateDir() + "/defexpr" : getHome() + "/.nix-defexpr";
+ globals.instSource.nixExprPath = nixExprPath;
+ }
globals.instSource.systemFilter = "*";
if (!pathExists(globals.instSource.nixExprPath)) {
diff --git a/src/nix/daemon.cc b/src/nix/daemon.cc
index 2ba56ee26..a22bccba1 100644
--- a/src/nix/daemon.cc
+++ b/src/nix/daemon.cc
@@ -34,7 +34,7 @@
using namespace nix;
using namespace nix::daemon;
-struct UserSettings : Config {
+struct AuthorizationSettings : Config {
Setting<Strings> trustedUsers{
this, {"root"}, "trusted-users",
@@ -67,9 +67,9 @@ struct UserSettings : Config {
)"};
};
-UserSettings userSettings;
+AuthorizationSettings authorizationSettings;
-static GlobalConfig::Register rSettings(&userSettings);
+static GlobalConfig::Register rSettings(&authorizationSettings);
#ifndef __linux__
#define SPLICE_F_MOVE 0
@@ -240,8 +240,8 @@ static void daemonLoop()
struct group * gr = peer.gidKnown ? getgrgid(peer.gid) : 0;
std::string group = gr ? gr->gr_name : std::to_string(peer.gid);
- Strings trustedUsers = userSettings.trustedUsers;
- Strings allowedUsers = userSettings.allowedUsers;
+ Strings trustedUsers = authorizationSettings.trustedUsers;
+ Strings allowedUsers = authorizationSettings.allowedUsers;
if (matchUser(user, group, trustedUsers))
trusted = Trusted;
diff --git a/tests/common.sh.in b/tests/common.sh.in
index 74bbbc8ca..bbe97da68 100644
--- a/tests/common.sh.in
+++ b/tests/common.sh.in
@@ -27,6 +27,8 @@ export NIX_REMOTE=$NIX_REMOTE_
unset NIX_PATH
export TEST_HOME=$TEST_ROOT/test-home
export HOME=$TEST_HOME
+unset XDG_STATE_HOME
+unset XDG_DATA_HOME
unset XDG_CONFIG_HOME
unset XDG_CONFIG_DIRS
unset XDG_CACHE_HOME
@@ -62,8 +64,8 @@ readLink() {
}
clearProfiles() {
- profiles="$HOME"/.local/share/nix/profiles
- rm -rf $profiles
+ profiles="$HOME"/.local/state/nix/profiles
+ rm -rf "$profiles"
}
clearStore() {
diff --git a/tests/nix-channel.sh b/tests/nix-channel.sh
index 54b8f5979..b64283f48 100644
--- a/tests/nix-channel.sh
+++ b/tests/nix-channel.sh
@@ -12,6 +12,19 @@ nix-channel --remove xyzzy
[ -e $TEST_HOME/.nix-channels ]
[ "$(cat $TEST_HOME/.nix-channels)" = '' ]
+# Test the XDG Base Directories support
+
+export NIX_CONFIG="use-xdg-base-directories = true"
+
+nix-channel --add http://foo/bar xyzzy
+nix-channel --list | grep -q http://foo/bar
+nix-channel --remove xyzzy
+
+unset NIX_CONFIG
+
+[ -e $TEST_HOME/.local/state/nix/channels ]
+[ "$(cat $TEST_HOME/.local/state/nix/channels)" = '' ]
+
# Create a channel.
rm -rf $TEST_ROOT/foo
mkdir -p $TEST_ROOT/foo
diff --git a/tests/nix-profile.sh b/tests/nix-profile.sh
index 7ba3235fa..266dc9e49 100644
--- a/tests/nix-profile.sh
+++ b/tests/nix-profile.sh
@@ -56,6 +56,14 @@ nix profile history
nix profile history | grep "packages.$system.default: ∅ -> 1.0"
nix profile diff-closures | grep 'env-manifest.nix: ε → ∅'
+# Test XDG Base Directories support
+
+export NIX_CONFIG="use-xdg-base-directories = true"
+nix profile remove 1
+nix profile install $flake1Dir
+[[ $($TEST_HOME/.local/state/nix/profile/bin/hello) = "Hello World" ]]
+unset NIX_CONFIG
+
# Test upgrading a package.
printf NixOS > $flake1Dir/who
printf 2.0 > $flake1Dir/version
diff --git a/tests/nixos/authorization.nix b/tests/nixos/authorization.nix
new file mode 100644
index 000000000..7e8744dd9
--- /dev/null
+++ b/tests/nixos/authorization.nix
@@ -0,0 +1,79 @@
+{
+ name = "authorization";
+
+ nodes.machine = {
+ virtualisation.writableStore = true;
+ # TODO add a test without allowed-users setting. allowed-users is uncommon among NixOS users.
+ nix.settings.allowed-users = ["alice" "bob"];
+ nix.settings.trusted-users = ["alice"];
+
+ users.users.alice.isNormalUser = true;
+ users.users.bob.isNormalUser = true;
+ users.users.mallory.isNormalUser = true;
+
+ nix.settings.experimental-features = "nix-command";
+ };
+
+ testScript =
+ let
+ pathFour = "/nix/store/20xfy868aiic0r0flgzq4n5dq1yvmxkn-four";
+ in
+ ''
+ machine.wait_for_unit("multi-user.target")
+ machine.succeed("""
+ exec 1>&2
+ echo kSELDhobKaF8/VdxIxdP7EQe+Q > one
+ diff $(nix store add-file one) one
+ """)
+ machine.succeed("""
+ su --login alice -c '
+ set -x
+ cd ~
+ echo ehHtmfuULXYyBV6NBk6QUi8iE0 > two
+ ls
+ diff $(echo $(nix store add-file two)) two' 1>&2
+ """)
+ machine.succeed("""
+ su --login bob -c '
+ set -x
+ cd ~
+ echo 0Jw8RNp7cK0W2AdNbcquofcOVk > three
+ diff $(nix store add-file three) three
+ ' 1>&2
+ """)
+
+ # We're going to check that a path is not created
+ machine.succeed("""
+ ! [[ -e ${pathFour} ]]
+ """)
+ machine.succeed("""
+ su --login mallory -c '
+ set -x
+ cd ~
+ echo 5mgtDj0ohrWkT50TLR0f4tIIxY > four;
+ (! nix store add-file four 2>&1) | grep -F "cannot open connection to remote store"
+ (! nix store add-file four 2>&1) | grep -F "Connection reset by peer"
+ ! [[ -e ${pathFour} ]]
+ ' 1>&2
+ """)
+
+ # Check that the file _can_ be added, and matches the expected path we were checking
+ machine.succeed("""
+ exec 1>&2
+ echo 5mgtDj0ohrWkT50TLR0f4tIIxY > four
+ four="$(nix store add-file four)"
+ diff $four four
+ diff <(echo $four) <(echo ${pathFour})
+ """)
+
+ machine.succeed("""
+ su --login alice -c 'nix-store --verify --repair'
+ """)
+
+ machine.succeed("""
+ set -x
+ su --login bob -c '(! nix-store --verify --repair 2>&1)' | tee diag 1>&2
+ grep -F "you are not privileged to repair paths" diag
+ """)
+ '';
+}
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-22 17:10:55 +0000