aboutsummaryrefslogtreecommitdiff
path: root/src/libexpr/flake
diff options
context:
space:
mode:
Diffstat (limited to 'src/libexpr/flake')
-rw-r--r--src/libexpr/flake/eval-cache.cc116
-rw-r--r--src/libexpr/flake/eval-cache.hh39
-rw-r--r--src/libexpr/flake/flake.cc696
-rw-r--r--src/libexpr/flake/flake.hh114
-rw-r--r--src/libexpr/flake/flakeref.cc285
-rw-r--r--src/libexpr/flake/flakeref.hh200
-rw-r--r--src/libexpr/flake/lockfile.cc91
-rw-r--r--src/libexpr/flake/lockfile.hh85
8 files changed, 1626 insertions, 0 deletions
diff --git a/src/libexpr/flake/eval-cache.cc b/src/libexpr/flake/eval-cache.cc
new file mode 100644
index 000000000..b32d502f7
--- /dev/null
+++ b/src/libexpr/flake/eval-cache.cc
@@ -0,0 +1,116 @@
+#include "eval-cache.hh"
+#include "sqlite.hh"
+#include "eval.hh"
+
+#include <set>
+
+namespace nix::flake {
+
+static const char * schema = R"sql(
+
+create table if not exists Fingerprints (
+ fingerprint blob primary key not null,
+ timestamp integer not null
+);
+
+create table if not exists Attributes (
+ fingerprint blob not null,
+ attrPath text not null,
+ type integer,
+ value text,
+ primary key (fingerprint, attrPath),
+ foreign key (fingerprint) references Fingerprints(fingerprint) on delete cascade
+);
+)sql";
+
+struct EvalCache::State
+{
+ SQLite db;
+ SQLiteStmt insertFingerprint;
+ SQLiteStmt insertAttribute;
+ SQLiteStmt queryAttribute;
+ std::set<Fingerprint> fingerprints;
+};
+
+EvalCache::EvalCache()
+ : _state(std::make_unique<Sync<State>>())
+{
+ auto state(_state->lock());
+
+ Path dbPath = getCacheDir() + "/nix/eval-cache-v1.sqlite";
+ createDirs(dirOf(dbPath));
+
+ state->db = SQLite(dbPath);
+ state->db.isCache();
+ state->db.exec(schema);
+
+ state->insertFingerprint.create(state->db,
+ "insert or ignore into Fingerprints(fingerprint, timestamp) values (?, ?)");
+
+ state->insertAttribute.create(state->db,
+ "insert or replace into Attributes(fingerprint, attrPath, type, value) values (?, ?, ?, ?)");
+
+ state->queryAttribute.create(state->db,
+ "select type, value from Attributes where fingerprint = ? and attrPath = ?");
+}
+
+enum ValueType {
+ Derivation = 1,
+};
+
+void EvalCache::addDerivation(
+ const Fingerprint & fingerprint,
+ const std::string & attrPath,
+ const Derivation & drv)
+{
+ if (!evalSettings.pureEval) return;
+
+ auto state(_state->lock());
+
+ if (state->fingerprints.insert(fingerprint).second)
+ // FIXME: update timestamp
+ state->insertFingerprint.use()
+ (fingerprint.hash, fingerprint.hashSize)
+ (time(0)).exec();
+
+ state->insertAttribute.use()
+ (fingerprint.hash, fingerprint.hashSize)
+ (attrPath)
+ (ValueType::Derivation)
+ (drv.drvPath + " " + drv.outPath + " " + drv.outputName).exec();
+}
+
+std::optional<EvalCache::Derivation> EvalCache::getDerivation(
+ const Fingerprint & fingerprint,
+ const std::string & attrPath)
+{
+ if (!evalSettings.pureEval) return {};
+
+ auto state(_state->lock());
+
+ auto queryAttribute(state->queryAttribute.use()
+ (fingerprint.hash, fingerprint.hashSize)
+ (attrPath));
+ if (!queryAttribute.next()) return {};
+
+ // FIXME: handle negative results
+
+ auto type = (ValueType) queryAttribute.getInt(0);
+ auto s = queryAttribute.getStr(1);
+
+ if (type != ValueType::Derivation) return {};
+
+ auto ss = tokenizeString<std::vector<std::string>>(s, " ");
+
+ debug("evaluation cache hit for '%s'", attrPath);
+
+ return Derivation { ss[0], ss[1], ss[2] };
+}
+
+EvalCache & EvalCache::singleton()
+{
+ static std::unique_ptr<EvalCache> evalCache(new EvalCache());
+ return *evalCache;
+}
+
+}
diff --git a/src/libexpr/flake/eval-cache.hh b/src/libexpr/flake/eval-cache.hh
new file mode 100644
index 000000000..03aea142e
--- /dev/null
+++ b/src/libexpr/flake/eval-cache.hh
@@ -0,0 +1,39 @@
+#pragma once
+
+#include "sync.hh"
+#include "flake.hh"
+
+namespace nix { struct SQLite; struct SQLiteStmt; }
+
+namespace nix::flake {
+
+class EvalCache
+{
+ struct State;
+
+ std::unique_ptr<Sync<State>> _state;
+
+ EvalCache();
+
+public:
+
+ struct Derivation
+ {
+ Path drvPath;
+ Path outPath;
+ std::string outputName;
+ };
+
+ void addDerivation(
+ const Fingerprint & fingerprint,
+ const std::string & attrPath,
+ const Derivation & drv);
+
+ std::optional<Derivation> getDerivation(
+ const Fingerprint & fingerprint,
+ const std::string & attrPath);
+
+ static EvalCache & singleton();
+};
+
+}
diff --git a/src/libexpr/flake/flake.cc b/src/libexpr/flake/flake.cc
new file mode 100644
index 000000000..80726a257
--- /dev/null
+++ b/src/libexpr/flake/flake.cc
@@ -0,0 +1,696 @@
+#include "flake.hh"
+#include "lockfile.hh"
+#include "primops.hh"
+#include "eval-inline.hh"
+#include "primops/fetchGit.hh"
+#include "download.hh"
+#include "args.hh"
+
+#include <iostream>
+#include <queue>
+#include <regex>
+#include <ctime>
+#include <iomanip>
+#include <nlohmann/json.hpp>
+
+namespace nix {
+
+using namespace flake;
+
+namespace flake {
+
+/* Read a registry. */
+std::shared_ptr<FlakeRegistry> readRegistry(const Path & path)
+{
+ auto registry = std::make_shared<FlakeRegistry>();
+
+ if (!pathExists(path))
+ return std::make_shared<FlakeRegistry>();
+
+ auto json = nlohmann::json::parse(readFile(path));
+
+ auto version = json.value("version", 0);
+ if (version != 1)
+ throw Error("flake registry '%s' has unsupported version %d", path, version);
+
+ auto flakes = json["flakes"];
+ for (auto i = flakes.begin(); i != flakes.end(); ++i) {
+ // FIXME: remove 'uri' soon.
+ auto url = i->value("url", i->value("uri", ""));
+ if (url.empty())
+ throw Error("flake registry '%s' lacks a 'url' attribute for entry '%s'",
+ path, i.key());
+ registry->entries.emplace(i.key(), url);
+ }
+
+ return registry;
+}
+
+/* Write a registry to a file. */
+void writeRegistry(const FlakeRegistry & registry, const Path & path)
+{
+ nlohmann::json json;
+ json["version"] = 1;
+ for (auto elem : registry.entries)
+ json["flakes"][elem.first.to_string()] = { {"url", elem.second.to_string()} };
+ createDirs(dirOf(path));
+ writeFile(path, json.dump(4)); // The '4' is the number of spaces used in the indentation in the json file.
+}
+
+Path getUserRegistryPath()
+{
+ return getHome() + "/.config/nix/registry.json";
+}
+
+std::shared_ptr<FlakeRegistry> getUserRegistry()
+{
+ return readRegistry(getUserRegistryPath());
+}
+
+std::shared_ptr<FlakeRegistry> getFlagRegistry(RegistryOverrides registryOverrides)
+{
+ auto flagRegistry = std::make_shared<FlakeRegistry>();
+ for (auto const & x : registryOverrides) {
+ flagRegistry->entries.insert_or_assign(FlakeRef(x.first), FlakeRef(x.second));
+ }
+ return flagRegistry;
+}
+
+static FlakeRef lookupFlake(EvalState & state, const FlakeRef & flakeRef, const Registries & registries,
+ std::vector<FlakeRef> pastSearches = {});
+
+FlakeRef updateFlakeRef(EvalState & state, const FlakeRef & newRef, const Registries & registries, std::vector<FlakeRef> pastSearches)
+{
+ std::string errorMsg = "found cycle in flake registries: ";
+ for (FlakeRef oldRef : pastSearches) {
+ errorMsg += oldRef.to_string();
+ if (oldRef == newRef)
+ throw Error(errorMsg);
+ errorMsg += " - ";
+ }
+ pastSearches.push_back(newRef);
+ return lookupFlake(state, newRef, registries, pastSearches);
+}
+
+static FlakeRef lookupFlake(EvalState & state, const FlakeRef & flakeRef, const Registries & registries,
+ std::vector<FlakeRef> pastSearches)
+{
+ for (std::shared_ptr<FlakeRegistry> registry : registries) {
+ auto i = registry->entries.find(flakeRef);
+ if (i != registry->entries.end()) {
+ auto newRef = i->second;
+ return updateFlakeRef(state, newRef, registries, pastSearches);
+ }
+
+ auto j = registry->entries.find(flakeRef.baseRef());
+ if (j != registry->entries.end()) {
+ auto newRef = j->second;
+ newRef.ref = flakeRef.ref;
+ newRef.rev = flakeRef.rev;
+ newRef.subdir = flakeRef.subdir;
+ return updateFlakeRef(state, newRef, registries, pastSearches);
+ }
+ }
+
+ if (!flakeRef.isDirect())
+ throw Error("could not resolve flake reference '%s'", flakeRef);
+
+ return flakeRef;
+}
+
+/* If 'allowLookup' is true, then resolve 'flakeRef' using the
+ registries. */
+static FlakeRef maybeLookupFlake(
+ EvalState & state,
+ const FlakeRef & flakeRef,
+ bool allowLookup)
+{
+ if (!flakeRef.isDirect()) {
+ if (allowLookup)
+ return lookupFlake(state, flakeRef, state.getFlakeRegistries());
+ else
+ throw Error("'%s' is an indirect flake reference, but registry lookups are not allowed", flakeRef);
+ } else
+ return flakeRef;
+}
+
+typedef std::vector<std::pair<FlakeRef, FlakeRef>> RefMap;
+
+static FlakeRef lookupInRefMap(
+ const RefMap & refMap,
+ const FlakeRef & flakeRef)
+{
+ // FIXME: inefficient.
+ for (auto & i : refMap) {
+ if (flakeRef.contains(i.first)) {
+ debug("mapping '%s' to previously seen input '%s' -> '%s",
+ flakeRef, i.first, i.second);
+ return i.second;
+ }
+ }
+
+ return flakeRef;
+}
+
+static SourceInfo fetchInput(EvalState & state, const FlakeRef & resolvedRef)
+{
+ assert(resolvedRef.isDirect());
+
+ auto doGit = [&](const GitInfo & gitInfo) {
+ FlakeRef ref(resolvedRef.baseRef());
+ ref.ref = gitInfo.ref;
+ ref.rev = gitInfo.rev;
+ SourceInfo info(ref);
+ info.storePath = gitInfo.storePath;
+ info.revCount = gitInfo.revCount;
+ info.narHash = state.store->queryPathInfo(info.storePath)->narHash;
+ info.lastModified = gitInfo.lastModified;
+ return info;
+ };
+
+ // This only downloads one revision of the repo, not the entire history.
+ if (auto refData = std::get_if<FlakeRef::IsGitHub>(&resolvedRef.data)) {
+ return doGit(exportGitHub(state.store, refData->owner, refData->repo, resolvedRef.ref, resolvedRef.rev));
+ }
+
+ // This downloads the entire git history.
+ else if (auto refData = std::get_if<FlakeRef::IsGit>(&resolvedRef.data)) {
+ return doGit(exportGit(state.store, refData->uri, resolvedRef.ref, resolvedRef.rev, "source"));
+ }
+
+ else if (auto refData = std::get_if<FlakeRef::IsPath>(&resolvedRef.data)) {
+ if (!pathExists(refData->path + "/.git"))
+ throw Error("flake '%s' does not reference a Git repository", refData->path);
+ return doGit(exportGit(state.store, refData->path, resolvedRef.ref, resolvedRef.rev, "source"));
+ }
+
+ else abort();
+}
+
+static void expectType(EvalState & state, ValueType type,
+ Value & value, const Pos & pos)
+{
+ if (value.type == tThunk && value.isTrivial())
+ state.forceValue(value, pos);
+ if (value.type != type)
+ throw Error("expected %s but got %s at %s",
+ showType(type), showType(value.type), pos);
+}
+
+static Flake getFlake(EvalState & state, const FlakeRef & originalRef,
+ bool allowLookup, RefMap & refMap)
+{
+ auto flakeRef = lookupInRefMap(refMap,
+ maybeLookupFlake(state,
+ lookupInRefMap(refMap, originalRef), allowLookup));
+
+ SourceInfo sourceInfo = fetchInput(state, flakeRef);
+ debug("got flake source '%s' with flakeref %s", sourceInfo.storePath, sourceInfo.resolvedRef.to_string());
+
+ FlakeRef resolvedRef = sourceInfo.resolvedRef;
+
+ refMap.push_back({originalRef, resolvedRef});
+ refMap.push_back({flakeRef, resolvedRef});
+
+ state.store->assertStorePath(sourceInfo.storePath);
+
+ if (state.allowedPaths)
+ state.allowedPaths->insert(state.store->toRealPath(sourceInfo.storePath));
+
+ // Guard against symlink attacks.
+ Path flakeFile = canonPath(sourceInfo.storePath + "/" + resolvedRef.subdir + "/flake.nix");
+ Path realFlakeFile = state.store->toRealPath(flakeFile);
+ if (!isInDir(realFlakeFile, state.store->toRealPath(sourceInfo.storePath)))
+ throw Error("'flake.nix' file of flake '%s' escapes from '%s'", resolvedRef, sourceInfo.storePath);
+
+ Flake flake(originalRef, sourceInfo);
+
+ if (!pathExists(realFlakeFile))
+ throw Error("source tree referenced by '%s' does not contain a '%s/flake.nix' file", resolvedRef, resolvedRef.subdir);
+
+ Value vInfo;
+ state.evalFile(realFlakeFile, vInfo, true); // FIXME: symlink attack
+
+ expectType(state, tAttrs, vInfo, Pos(state.symbols.create(realFlakeFile), 0, 0));
+
+ auto sEdition = state.symbols.create("edition");
+ auto sEpoch = state.symbols.create("epoch"); // FIXME: remove soon
+
+ auto edition = vInfo.attrs->get(sEdition);
+ if (!edition)
+ edition = vInfo.attrs->get(sEpoch);
+
+ if (edition) {
+ expectType(state, tInt, *(**edition).value, *(**edition).pos);
+ flake.edition = (**edition).value->integer;
+ if (flake.edition > 201909)
+ throw Error("flake '%s' requires unsupported edition %d; please upgrade Nix", flakeRef, flake.edition);
+ if (flake.edition < 201909)
+ throw Error("flake '%s' has illegal edition %d", flakeRef, flake.edition);
+ } else
+ throw Error("flake '%s' lacks attribute 'edition'", flakeRef);
+
+ if (auto description = vInfo.attrs->get(state.sDescription)) {
+ expectType(state, tString, *(**description).value, *(**description).pos);
+ flake.description = (**description).value->string.s;
+ }
+
+ auto sInputs = state.symbols.create("inputs");
+ auto sUrl = state.symbols.create("url");
+ auto sUri = state.symbols.create("uri"); // FIXME: remove soon
+ auto sFlake = state.symbols.create("flake");
+
+ if (std::optional<Attr *> inputs = vInfo.attrs->get(sInputs)) {
+ expectType(state, tAttrs, *(**inputs).value, *(**inputs).pos);
+
+ for (Attr inputAttr : *(*(**inputs).value).attrs) {
+ expectType(state, tAttrs, *inputAttr.value, *inputAttr.pos);
+
+ FlakeInput input(FlakeRef(inputAttr.name));
+
+ for (Attr attr : *(inputAttr.value->attrs)) {
+ if (attr.name == sUrl || attr.name == sUri) {
+ expectType(state, tString, *attr.value, *attr.pos);
+ input.ref = std::string(attr.value->string.s);
+ } else if (attr.name == sFlake) {
+ expectType(state, tBool, *attr.value, *attr.pos);
+ input.isFlake = attr.value->boolean;
+ } else
+ throw Error("flake input '%s' has an unsupported attribute '%s', at %s",
+ inputAttr.name, attr.name, *attr.pos);
+ }
+
+ flake.inputs.emplace(inputAttr.name, input);
+ }
+ }
+
+ auto sOutputs = state.symbols.create("outputs");
+
+ if (auto outputs = vInfo.attrs->get(sOutputs)) {
+ expectType(state, tLambda, *(**outputs).value, *(**outputs).pos);
+ flake.vOutputs = (**outputs).value;
+
+ if (flake.vOutputs->lambda.fun->matchAttrs) {
+ for (auto & formal : flake.vOutputs->lambda.fun->formals->formals) {
+ if (formal.name != state.sSelf)
+ flake.inputs.emplace(formal.name, FlakeInput(FlakeRef(formal.name)));
+ }
+ }
+
+ } else
+ throw Error("flake '%s' lacks attribute 'outputs'", flakeRef);
+
+ for (auto & attr : *vInfo.attrs) {
+ if (attr.name != sEdition &&
+ attr.name != sEpoch &&
+ attr.name != state.sDescription &&
+ attr.name != sInputs &&
+ attr.name != sOutputs)
+ throw Error("flake '%s' has an unsupported attribute '%s', at %s",
+ flakeRef, attr.name, *attr.pos);
+ }
+
+ return flake;
+}
+
+Flake getFlake(EvalState & state, const FlakeRef & originalRef, bool allowLookup)
+{
+ RefMap refMap;
+ return getFlake(state, originalRef, allowLookup, refMap);
+}
+
+static SourceInfo getNonFlake(EvalState & state, const FlakeRef & originalRef,
+ bool allowLookup, RefMap & refMap)
+{
+ auto flakeRef = lookupInRefMap(refMap,
+ maybeLookupFlake(state,
+ lookupInRefMap(refMap, originalRef), allowLookup));
+
+ auto sourceInfo = fetchInput(state, flakeRef);
+ debug("got non-flake source '%s' with flakeref %s", sourceInfo.storePath, sourceInfo.resolvedRef.to_string());
+
+ FlakeRef resolvedRef = sourceInfo.resolvedRef;
+
+ refMap.push_back({originalRef, resolvedRef});
+ refMap.push_back({flakeRef, resolvedRef});
+
+ state.store->assertStorePath(sourceInfo.storePath);
+
+ if (state.allowedPaths)
+ state.allowedPaths->insert(sourceInfo.storePath);
+
+ return sourceInfo;
+}
+
+bool allowedToWrite(HandleLockFile handle)
+{
+ return handle == UpdateLockFile || handle == RecreateLockFile;
+}
+
+bool recreateLockFile(HandleLockFile handle)
+{
+ return handle == RecreateLockFile || handle == UseNewLockFile;
+}
+
+bool allowedToUseRegistries(HandleLockFile handle, bool isTopRef)
+{
+ if (handle == AllPure) return false;
+ else if (handle == TopRefUsesRegistries) return isTopRef;
+ else if (handle == UpdateLockFile) return true;
+ else if (handle == UseUpdatedLockFile) return true;
+ else if (handle == RecreateLockFile) return true;
+ else if (handle == UseNewLockFile) return true;
+ else assert(false);
+}
+
+/* Given a flakeref and its subtree of the lockfile, return an updated
+ subtree of the lockfile. That is, if the 'flake.nix' of the
+ referenced flake has inputs that don't have a corresponding entry
+ in the lockfile, they're added to the lockfile; conversely, any
+ lockfile entries that don't have a corresponding entry in flake.nix
+ are removed.
+
+ Note that this is lazy: we only recursively fetch inputs that are
+ not in the lockfile yet. */
+static std::pair<Flake, LockedInput> updateLocks(
+ RefMap & refMap,
+ const std::string & inputPath,
+ EvalState & state,
+ const Flake & flake,
+ HandleLockFile handleLockFile,
+ const LockedInputs & oldEntry,
+ bool topRef)
+{
+ LockedInput newEntry(
+ flake.sourceInfo.resolvedRef,
+ flake.originalRef,
+ flake.sourceInfo.narHash);
+
+ std::vector<std::function<void()>> postponed;
+
+ for (auto & [id, input] : flake.inputs) {
+ auto inputPath2 = (inputPath.empty() ? "" : inputPath + "/") + id;
+ auto i = oldEntry.inputs.find(id);
+ if (i != oldEntry.inputs.end() && i->second.originalRef == input.ref) {
+ newEntry.inputs.insert_or_assign(id, i->second);
+ } else {
+ if (handleLockFile == AllPure || handleLockFile == TopRefUsesRegistries)
+ throw Error("cannot update flake input '%s' in pure mode", id);
+
+ auto warn = [&](const SourceInfo & sourceInfo) {
+ if (i == oldEntry.inputs.end())
+ printInfo("mapped flake input '%s' to '%s'",
+ inputPath2, sourceInfo.resolvedRef);
+ else
+ printMsg(lvlWarn, "updated flake input '%s' from '%s' to '%s'",
+ inputPath2, i->second.originalRef, sourceInfo.resolvedRef);
+ };
+
+ if (input.isFlake) {
+ auto actualInput = getFlake(state, input.ref,
+ allowedToUseRegistries(handleLockFile, false), refMap);
+ warn(actualInput.sourceInfo);
+ postponed.push_back([&, id{id}, inputPath2, actualInput]() {
+ newEntry.inputs.insert_or_assign(id,
+ updateLocks(refMap, inputPath2, state, actualInput, handleLockFile, {}, false).second);
+ });
+ } else {
+ auto sourceInfo = getNonFlake(state, input.ref,
+ allowedToUseRegistries(handleLockFile, false), refMap);
+ warn(sourceInfo);
+ newEntry.inputs.insert_or_assign(id,
+ LockedInput(sourceInfo.resolvedRef, input.ref, sourceInfo.narHash));
+ }
+ }
+ }
+
+ for (auto & f : postponed) f();
+
+ return {flake, newEntry};
+}
+
+/* Compute an in-memory lockfile for the specified top-level flake,
+ and optionally write it to file, it the flake is writable. */
+ResolvedFlake resolveFlake(EvalState & state, const FlakeRef & topRef, HandleLockFile handleLockFile)
+{
+ settings.requireExperimentalFeature("flakes");
+
+ auto flake = getFlake(state, topRef,
+ allowedToUseRegistries(handleLockFile, true));
+
+ LockFile oldLockFile;
+
+ if (!recreateLockFile(handleLockFile)) {
+ // If recreateLockFile, start with an empty lockfile
+ // FIXME: symlink attack
+ oldLockFile = LockFile::read(
+ state.store->toRealPath(flake.sourceInfo.storePath)
+ + "/" + flake.sourceInfo.resolvedRef.subdir + "/flake.lock");
+ }
+
+ debug("old lock file: %s", oldLockFile);
+
+ RefMap refMap;
+
+ LockFile lockFile(updateLocks(
+ refMap, "", state, flake, handleLockFile, oldLockFile, true).second);
+
+ debug("new lock file: %s", lockFile);
+
+ if (!(lockFile == oldLockFile)) {
+ if (allowedToWrite(handleLockFile)) {
+ if (auto refData = std::get_if<FlakeRef::IsPath>(&topRef.data)) {
+ if (lockFile.isDirty()) {
+ if (evalSettings.warnDirty)
+ warn("will not write lock file of flake '%s' because it has a dirty input", topRef);
+ } else {
+ lockFile.write(refData->path + (topRef.subdir == "" ? "" : "/" + topRef.subdir) + "/flake.lock");
+
+ // Hack: Make sure that flake.lock is visible to Git, so it ends up in the Nix store.
+ runProgram("git", true,
+ { "-C", refData->path, "add",
+ "--force",
+ "--intent-to-add",
+ (topRef.subdir == "" ? "" : topRef.subdir + "/") + "flake.lock" });
+ }
+ } else
+ warn("cannot write lock file of remote flake '%s'", topRef);
+ } else if (handleLockFile != AllPure && handleLockFile != TopRefUsesRegistries)
+ warn("using updated lock file without writing it to file");
+ }
+
+ return ResolvedFlake(std::move(flake), std::move(lockFile));
+}
+
+void updateLockFile(EvalState & state, const FlakeRef & flakeRef, bool recreateLockFile)
+{
+ resolveFlake(state, flakeRef, recreateLockFile ? RecreateLockFile : UpdateLockFile);
+}
+
+static void emitSourceInfoAttrs(EvalState & state, const SourceInfo & sourceInfo, Value & vAttrs)
+{
+ auto & path = sourceInfo.storePath;
+ assert(state.store->isValidPath(path));
+ mkString(*state.allocAttr(vAttrs, state.sOutPath), path, {path});
+
+ if (sourceInfo.resolvedRef.rev) {
+ mkString(*state.allocAttr(vAttrs, state.symbols.create("rev")),
+ sourceInfo.resolvedRef.rev->gitRev());
+ mkString(*state.allocAttr(vAttrs, state.symbols.create("shortRev")),
+ sourceInfo.resolvedRef.rev->gitShortRev());
+ }
+
+ if (sourceInfo.revCount)
+ mkInt(*state.allocAttr(vAttrs, state.symbols.create("revCount")), *sourceInfo.revCount);
+
+ if (sourceInfo.lastModified)
+ mkString(*state.allocAttr(vAttrs, state.symbols.create("lastModified")),
+ fmt("%s",
+ std::put_time(std::gmtime(&*sourceInfo.lastModified), "%Y%m%d%H%M%S")));
+}
+
+struct LazyInput
+{
+ bool isFlake;
+ LockedInput lockedInput;
+};
+
+/* Helper primop to make callFlake (below) fetch/call its inputs
+ lazily. Note that this primop cannot be called by user code since
+ it doesn't appear in 'builtins'. */
+static void prim_callFlake(EvalState & state, const Pos & pos, Value * * args, Value & v)
+{
+ auto lazyInput = (LazyInput *) args[0]->attrs;
+
+ assert(lazyInput->lockedInput.ref.isImmutable());
+
+ if (lazyInput->isFlake) {
+ auto flake = getFlake(state, lazyInput->lockedInput.ref, false);
+
+ if (flake.sourceInfo.narHash != lazyInput->lockedInput.narHash)
+ throw Error("the content hash of flake '%s' doesn't match the hash recorded in the referring lockfile",
+ lazyInput->lockedInput.ref);
+
+ callFlake(state, flake, lazyInput->lockedInput, v);
+ } else {
+ RefMap refMap;
+ auto sourceInfo = getNonFlake(state, lazyInput->lockedInput.ref, false, refMap);
+
+ if (sourceInfo.narHash != lazyInput->lockedInput.narHash)
+ throw Error("the content hash of repository '%s' doesn't match the hash recorded in the referring lockfile",
+ lazyInput->lockedInput.ref);
+
+ state.mkAttrs(v, 8);
+
+ assert(state.store->isValidPath(sourceInfo.storePath));
+
+ mkString(*state.allocAttr(v, state.sOutPath),
+ sourceInfo.storePath, {sourceInfo.storePath});
+
+ emitSourceInfoAttrs(state, sourceInfo, v);
+
+ v.attrs->sort();
+ }
+}
+
+void callFlake(EvalState & state,
+ const Flake & flake,
+ const LockedInputs & lockedInputs,
+ Value & vResFinal)
+{
+ auto & vRes = *state.allocValue();
+ auto & vInputs = *state.allocValue();
+
+ state.mkAttrs(vInputs, flake.inputs.size() + 1);
+
+ for (auto & [inputId, input] : flake.inputs) {
+ auto vFlake = state.allocAttr(vInputs, inputId);
+ auto vPrimOp = state.allocValue();
+ static auto primOp = new PrimOp(prim_callFlake, 1, state.symbols.create("callFlake"));
+ vPrimOp->type = tPrimOp;
+ vPrimOp->primOp = primOp;
+ auto vArg = state.allocValue();
+ vArg->type = tNull;
+ auto lockedInput = lockedInputs.inputs.find(inputId);
+ assert(lockedInput != lockedInputs.inputs.end());
+ // FIXME: leak
+ vArg->attrs = (Bindings *) new LazyInput{input.isFlake, lockedInput->second};
+ mkApp(*vFlake, *vPrimOp, *vArg);
+ }
+
+ auto & vSourceInfo = *state.allocValue();
+ state.mkAttrs(vSourceInfo, 8);
+ emitSourceInfoAttrs(state, flake.sourceInfo, vSourceInfo);
+ vSourceInfo.attrs->sort();
+
+ vInputs.attrs->push_back(Attr(state.sSelf, &vRes));
+
+ vInputs.attrs->sort();
+
+ /* For convenience, put the outputs directly in the result, so you
+ can refer to an output of an input as 'inputs.foo.bar' rather
+ than 'inputs.foo.outputs.bar'. */
+ auto vCall = *state.allocValue();
+ state.eval(state.parseExprFromString(
+ "outputsFun: inputs: sourceInfo: let outputs = outputsFun inputs; in "
+ "outputs // sourceInfo // { inherit inputs; inherit outputs; inherit sourceInfo; }", "/"), vCall);
+
+ auto vCall2 = *state.allocValue();
+ auto vCall3 = *state.allocValue();
+ state.callFunction(vCall, *flake.vOutputs, vCall2, noPos);
+ state.callFunction(vCall2, vInputs, vCall3, noPos);
+ state.callFunction(vCall3, vSourceInfo, vRes, noPos);
+
+ vResFinal = vRes;
+}
+
+void callFlake(EvalState & state,
+ const ResolvedFlake & resFlake,
+ Value & v)
+{
+ callFlake(state, resFlake.flake, resFlake.lockFile, v);
+}
+
+// This function is exposed to be used in nix files.
+static void prim_getFlake(EvalState & state, const Pos & pos, Value * * args, Value & v)
+{
+ callFlake(state, resolveFlake(state, state.forceStringNoCtx(*args[0], pos),
+ evalSettings.pureEval ? AllPure : UseUpdatedLockFile), v);
+}
+
+static RegisterPrimOp r2("getFlake", 1, prim_getFlake);
+
+void gitCloneFlake(FlakeRef flakeRef, EvalState & state, Registries registries, const Path & destDir)
+{
+ flakeRef = lookupFlake(state, flakeRef, registries);
+
+ std::string uri;
+
+ Strings args = {"clone"};
+
+ if (auto refData = std::get_if<FlakeRef::IsGitHub>(&flakeRef.data)) {
+ uri = "git@github.com:" + refData->owner + "/" + refData->repo + ".git";
+ args.push_back(uri);
+ if (flakeRef.ref) {
+ args.push_back("--branch");
+ args.push_back(*flakeRef.ref);
+ }
+ } else if (auto refData = std::get_if<FlakeRef::IsGit>(&flakeRef.data)) {
+ args.push_back(refData->uri);
+ if (flakeRef.ref) {
+ args.push_back("--branch");
+ args.push_back(*flakeRef.ref);
+ }
+ }
+
+ if (destDir != "")
+ args.push_back(destDir);
+
+ runProgram("git", true, args);
+}
+
+}
+
+std::shared_ptr<flake::FlakeRegistry> EvalState::getGlobalFlakeRegistry()
+{
+ std::call_once(_globalFlakeRegistryInit, [&]() {
+ auto path = evalSettings.flakeRegistry;
+
+ if (!hasPrefix(path, "/")) {
+ CachedDownloadRequest request(evalSettings.flakeRegistry);
+ request.name = "flake-registry.json";
+ request.gcRoot = true;
+ path = getDownloader()->downloadCached(store, request).path;
+ }
+
+ _globalFlakeRegistry = readRegistry(path);
+ });
+
+ return _globalFlakeRegistry;
+}
+
+// This always returns a vector with flakeReg, userReg, globalReg.
+// If one of them doesn't exist, the registry is left empty but does exist.
+const Registries EvalState::getFlakeRegistries()
+{
+ Registries registries;
+ registries.push_back(getFlagRegistry(registryOverrides));
+ registries.push_back(getUserRegistry());
+ registries.push_back(getGlobalFlakeRegistry());
+ return registries;
+}
+
+Fingerprint ResolvedFlake::getFingerprint() const
+{
+ // FIXME: as an optimization, if the flake contains a lock file
+ // and we haven't changed it, then it's sufficient to use
+ // flake.sourceInfo.storePath for the fingerprint.
+ return hashString(htSHA256,
+ fmt("%s;%d;%d;%s",
+ flake.sourceInfo.storePath,
+ flake.sourceInfo.revCount.value_or(0),
+ flake.sourceInfo.lastModified.value_or(0),
+ lockFile));
+}
+
+}
diff --git a/src/libexpr/flake/flake.hh b/src/libexpr/flake/flake.hh
new file mode 100644
index 000000000..63d848889
--- /dev/null
+++ b/src/libexpr/flake/flake.hh
@@ -0,0 +1,114 @@
+#pragma once
+
+#include "types.hh"
+#include "flakeref.hh"
+#include "lockfile.hh"
+
+namespace nix {
+
+struct Value;
+class EvalState;
+
+namespace flake {
+
+static const size_t FLAG_REGISTRY = 0;
+static const size_t USER_REGISTRY = 1;
+static const size_t GLOBAL_REGISTRY = 2;
+
+struct FlakeRegistry
+{
+ std::map<FlakeRef, FlakeRef> entries;
+};
+
+typedef std::vector<std::shared_ptr<FlakeRegistry>> Registries;
+
+std::shared_ptr<FlakeRegistry> readRegistry(const Path &);
+
+void writeRegistry(const FlakeRegistry &, const Path &);
+
+Path getUserRegistryPath();
+
+enum HandleLockFile : unsigned int
+ { AllPure // Everything is handled 100% purely
+ , TopRefUsesRegistries // The top FlakeRef uses the registries, apart from that, everything happens 100% purely
+ , UpdateLockFile // Update the existing lockfile and write it to file
+ , UseUpdatedLockFile // `UpdateLockFile` without writing to file
+ , RecreateLockFile // Recreate the lockfile from scratch and write it to file
+ , UseNewLockFile // `RecreateLockFile` without writing to file
+ };
+
+struct SourceInfo
+{
+ // Immutable flakeref that this source tree was obtained from.
+ FlakeRef resolvedRef;
+
+ Path storePath;
+
+ // Number of ancestors of the most recent commit.
+ std::optional<uint64_t> revCount;
+
+ // NAR hash of the store path.
+ Hash narHash;
+
+ // A stable timestamp of this source tree. For Git and GitHub
+ // flakes, the commit date (not author date!) of the most recent
+ // commit.
+ std::optional<time_t> lastModified;
+
+ SourceInfo(const FlakeRef & resolvRef) : resolvedRef(resolvRef) {};
+};
+
+struct FlakeInput
+{
+ FlakeRef ref;
+ bool isFlake = true;
+ FlakeInput(const FlakeRef & ref) : ref(ref) {};
+};
+
+struct Flake
+{
+ FlakeRef originalRef;
+ std::string description;
+ SourceInfo sourceInfo;
+ std::map<FlakeId, FlakeInput> inputs;
+ Value * vOutputs; // FIXME: gc
+ unsigned int edition;
+
+ Flake(const FlakeRef & origRef, const SourceInfo & sourceInfo)
+ : originalRef(origRef), sourceInfo(sourceInfo) {};
+};
+
+Flake getFlake(EvalState & state, const FlakeRef & flakeRef, bool allowLookup);
+
+/* Fingerprint of a locked flake; used as a cache key. */
+typedef Hash Fingerprint;
+
+struct ResolvedFlake
+{
+ Flake flake;
+ LockFile lockFile;
+
+ ResolvedFlake(Flake && flake, LockFile && lockFile)
+ : flake(flake), lockFile(lockFile) {}
+
+ Fingerprint getFingerprint() const;
+};
+
+ResolvedFlake resolveFlake(EvalState &, const FlakeRef &, HandleLockFile);
+
+void callFlake(EvalState & state,
+ const Flake & flake,
+ const LockedInputs & inputs,
+ Value & v);
+
+void callFlake(EvalState & state,
+ const ResolvedFlake & resFlake,
+ Value & v);
+
+void updateLockFile(EvalState &, const FlakeRef & flakeRef, bool recreateLockFile);
+
+void gitCloneFlake(FlakeRef flakeRef, EvalState &, Registries, const Path & destDir);
+
+}
+
+}
diff --git a/src/libexpr/flake/flakeref.cc b/src/libexpr/flake/flakeref.cc
new file mode 100644
index 000000000..8e90e5989
--- /dev/null
+++ b/src/libexpr/flake/flakeref.cc
@@ -0,0 +1,285 @@
+#include "flakeref.hh"
+#include "store-api.hh"
+
+#include <regex>
+
+namespace nix {
+
+// A Git ref (i.e. branch or tag name).
+const static std::string refRegex = "[a-zA-Z0-9][a-zA-Z0-9_.-]*"; // FIXME: check
+
+// A Git revision (a SHA-1 commit hash).
+const static std::string revRegexS = "[0-9a-fA-F]{40}";
+std::regex revRegex(revRegexS, std::regex::ECMAScript);
+
+// A Git ref or revision.
+const static std::string revOrRefRegex = "(?:(" + revRegexS + ")|(" + refRegex + "))";
+
+// A rev ("e72daba8250068216d79d2aeef40d4d95aff6666"), or a ref
+// optionally followed by a rev (e.g. "master" or
+// "master/e72daba8250068216d79d2aeef40d4d95aff6666").
+const static std::string refAndOrRevRegex = "(?:(" + revRegexS + ")|(?:(" + refRegex + ")(?:/(" + revRegexS + "))?))";
+
+const static std::string flakeId = "[a-zA-Z][a-zA-Z0-9_-]*";
+
+// GitHub references.
+const static std::string ownerRegex = "[a-zA-Z][a-zA-Z0-9_-]*";
+const static std::string repoRegex = "[a-zA-Z][a-zA-Z0-9_-]*";
+
+// URI stuff.
+const static std::string schemeRegex = "[a-z+]+";
+const static std::string authorityRegex = "[a-zA-Z0-9._~-]*";
+const static std::string segmentRegex = "[a-zA-Z0-9._~-]+";
+const static std::string pathRegex = "/?" + segmentRegex + "(?:/" + segmentRegex + ")*";
+
+// 'dir' path elements cannot start with a '.'. We also reject
+// potentially dangerous characters like ';'.
+const static std::string subDirElemRegex = "(?:[a-zA-Z0-9_-]+[a-zA-Z0-9._-]*)";
+const static std::string subDirRegex = subDirElemRegex + "(?:/" + subDirElemRegex + ")*";
+
+
+FlakeRef::FlakeRef(const std::string & uri_, bool allowRelative)
+{
+ // FIXME: could combine this into one regex.
+
+ static std::regex flakeRegex(
+ "(?:flake:)?(" + flakeId + ")(?:/(?:" + refAndOrRevRegex + "))?",
+ std::regex::ECMAScript);
+
+ static std::regex githubRegex(
+ "github:(" + ownerRegex + ")/(" + repoRegex + ")(?:/" + revOrRefRegex + ")?",
+ std::regex::ECMAScript);
+
+ static std::regex uriRegex(
+ "((" + schemeRegex + "):" +
+ "(?://(" + authorityRegex + "))?" +
+ "(" + pathRegex + "))",
+ std::regex::ECMAScript);
+
+ static std::regex refRegex2(refRegex, std::regex::ECMAScript);
+
+ static std::regex subDirRegex2(subDirRegex, std::regex::ECMAScript);
+
+ auto [uri2, params] = splitUriAndParams(uri_);
+ std::string uri(uri2);
+
+ auto handleSubdir = [&](const std::string & name, const std::string & value) {
+ if (name == "dir") {
+ if (value != "" && !std::regex_match(value, subDirRegex2))
+ throw BadFlakeRef("flake '%s' has invalid subdirectory '%s'", uri, value);
+ subdir = value;
+ return true;
+ } else
+ return false;
+ };
+
+ auto handleGitParams = [&](const std::string & name, const std::string & value) {
+ if (name == "rev") {
+ if (!std::regex_match(value, revRegex))
+ throw BadFlakeRef("invalid Git revision '%s'", value);
+ rev = Hash(value, htSHA1);
+ } else if (name == "ref") {
+ if (!std::regex_match(value, refRegex2))
+ throw BadFlakeRef("invalid Git ref '%s'", value);
+ ref = value;
+ } else if (handleSubdir(name, value))
+ ;
+ else return false;
+ return true;
+ };
+
+ std::smatch match;
+ if (std::regex_match(uri, match, flakeRegex)) {
+ IsId d;
+ d.id = match[1];
+ if (match[2].matched)
+ rev = Hash(match[2], htSHA1);
+ else if (match[3].matched) {
+ ref = match[3];
+ if (match[4].matched)
+ rev = Hash(match[4], htSHA1);
+ }
+ data = d;
+ }
+
+ else if (std::regex_match(uri, match, githubRegex)) {
+ IsGitHub d;
+ d.owner = match[1];
+ d.repo = match[2];
+ if (match[3].matched)
+ rev = Hash(match[3], htSHA1);
+ else if (match[4].matched) {
+ ref = match[4];
+ }
+ for (auto & param : params) {
+ if (handleSubdir(param.first, param.second))
+ ;
+ else
+ throw BadFlakeRef("invalid Git flakeref parameter '%s', in '%s'", param.first, uri);
+ }
+ data = d;
+ }
+
+ else if (std::regex_match(uri, match, uriRegex)) {
+ auto & scheme = match[2];
+ if (scheme == "git" ||
+ scheme == "git+http" ||
+ scheme == "git+https" ||
+ scheme == "git+ssh" ||
+ scheme == "git+file" ||
+ scheme == "file")
+ {
+ IsGit d;
+ d.uri = match[1];
+ for (auto & param : params) {
+ if (handleGitParams(param.first, param.second))
+ ;
+ else
+ // FIXME: should probably pass through unknown parameters
+ throw BadFlakeRef("invalid Git flakeref parameter '%s', in '%s'", param.first, uri);
+ }
+ if (rev && !ref)
+ throw BadFlakeRef("flake URI '%s' lacks a Git ref", uri);
+ data = d;
+ } else
+ throw BadFlakeRef("unsupported URI scheme '%s' in flake reference '%s'", scheme, uri);
+ }
+
+ else if ((hasPrefix(uri, "/") || (allowRelative && (hasPrefix(uri, "./") || hasPrefix(uri, "../") || uri == ".")))
+ && uri.find(':') == std::string::npos)
+ {
+ IsPath d;
+ if (allowRelative) {
+ d.path = absPath(uri);
+ try {
+ if (!S_ISDIR(lstat(d.path).st_mode))
+ throw MissingFlake("path '%s' is not a flake (sub)directory", d.path);
+ } catch (SysError & e) {
+ if (e.errNo == ENOENT || e.errNo == EISDIR)
+ throw MissingFlake("flake '%s' does not exist", d.path);
+ throw;
+ }
+ while (true) {
+ if (pathExists(d.path + "/.git")) break;
+ subdir = baseNameOf(d.path) + (subdir.empty() ? "" : "/" + subdir);
+ d.path = dirOf(d.path);
+ if (d.path == "/")
+ throw MissingFlake("path '%s' is not a flake (because it does not reference a Git repository)", uri);
+ }
+ } else
+ d.path = canonPath(uri);
+ data = d;
+ for (auto & param : params) {
+ if (handleGitParams(param.first, param.second))
+ ;
+ else
+ throw BadFlakeRef("invalid Git flakeref parameter '%s', in '%s'", param.first, uri);
+ }
+ }
+
+ else
+ throw BadFlakeRef("'%s' is not a valid flake reference", uri);
+}
+
+std::string FlakeRef::to_string() const
+{
+ std::string string;
+ bool first = true;
+
+ auto addParam =
+ [&](const std::string & name, std::string value) {
+ string += first ? '?' : '&';
+ first = false;
+ string += name;
+ string += '=';
+ string += value; // FIXME: escaping
+ };
+
+ if (auto refData = std::get_if<FlakeRef::IsId>(&data)) {
+ string = refData->id;
+ if (ref) string += '/' + *ref;
+ if (rev) string += '/' + rev->gitRev();
+ }
+
+ else if (auto refData = std::get_if<FlakeRef::IsPath>(&data)) {
+ string = refData->path;
+ if (ref) addParam("ref", *ref);
+ if (rev) addParam("rev", rev->gitRev());
+ if (subdir != "") addParam("dir", subdir);
+ }
+
+ else if (auto refData = std::get_if<FlakeRef::IsGitHub>(&data)) {
+ assert(!(ref && rev));
+ string = "github:" + refData->owner + "/" + refData->repo;
+ if (ref) { string += '/'; string += *ref; }
+ if (rev) { string += '/'; string += rev->gitRev(); }
+ if (subdir != "") addParam("dir", subdir);
+ }
+
+ else if (auto refData = std::get_if<FlakeRef::IsGit>(&data)) {
+ assert(!rev || ref);
+ string = refData->uri;
+
+ if (ref) {
+ addParam("ref", *ref);
+ if (rev)
+ addParam("rev", rev->gitRev());
+ }
+
+ if (subdir != "") addParam("dir", subdir);
+ }
+
+ else abort();
+
+ assert(FlakeRef(string) == *this);
+
+ return string;
+}
+
+std::ostream & operator << (std::ostream & str, const FlakeRef & flakeRef)
+{
+ str << flakeRef.to_string();
+ return str;
+}
+
+bool FlakeRef::isImmutable() const
+{
+ return (bool) rev;
+}
+
+FlakeRef FlakeRef::baseRef() const // Removes the ref and rev from a FlakeRef.
+{
+ FlakeRef result(*this);
+ result.ref = std::nullopt;
+ result.rev = std::nullopt;
+ return result;
+}
+
+bool FlakeRef::contains(const FlakeRef & other) const
+{
+ if (!(data == other.data))
+ return false;
+
+ if (ref && ref != other.ref)
+ return false;
+
+ if (rev && rev != other.rev)
+ return false;
+
+ if (subdir != other.subdir)
+ return false;
+
+ return true;
+}
+
+std::optional<FlakeRef> parseFlakeRef(
+ const std::string & uri, bool allowRelative)
+{
+ try {
+ return FlakeRef(uri, allowRelative);
+ } catch (BadFlakeRef & e) {
+ return {};
+ }
+}
+
+}
diff --git a/src/libexpr/flake/flakeref.hh b/src/libexpr/flake/flakeref.hh
new file mode 100644
index 000000000..addf5449f
--- /dev/null
+++ b/src/libexpr/flake/flakeref.hh
@@ -0,0 +1,200 @@
+#pragma once
+
+#include "types.hh"
+#include "hash.hh"
+
+#include <variant>
+
+namespace nix {
+
+/* Flake references are a URI-like syntax to specify a flake.
+
+ Examples:
+
+ * <flake-id>(/rev-or-ref(/rev)?)?
+
+ Look up a flake by ID in the flake lock file or in the flake
+ registry. These must specify an actual location for the flake
+ using the formats listed below. Note that in pure evaluation
+ mode, the flake registry is empty.
+
+ Optionally, the rev or ref from the dereferenced flake can be
+ overriden. For example,
+
+ nixpkgs/19.09
+
+ uses the "19.09" branch of the nixpkgs' flake GitHub repository,
+ while
+
+ nixpkgs/98a2a5b5370c1e2092d09cb38b9dcff6d98a109f
+
+ uses the specified revision. For Git (rather than GitHub)
+ repositories, both the rev and ref must be given, e.g.
+
+ nixpkgs/19.09/98a2a5b5370c1e2092d09cb38b9dcff6d98a109f
+
+ * github:<owner>/<repo>(/<rev-or-ref>)?
+
+ A repository on GitHub. These differ from Git references in that
+ they're downloaded in a efficient way (via the tarball mechanism)
+ and that they support downloading a specific revision without
+ specifying a branch. <rev-or-ref> is either a commit hash ("rev")
+ or a branch or tag name ("ref"). The default is: "master" if none
+ is specified. Note that in pure evaluation mode, a commit hash
+ must be used.
+
+ Flakes fetched in this manner expose "rev" and "lastModified"
+ attributes, but not "revCount".
+
+ Examples:
+
+ github:edolstra/dwarffs
+ github:edolstra/dwarffs/unstable
+ github:edolstra/dwarffs/41c0c1bf292ea3ac3858ff393b49ca1123dbd553
+
+ * git+https://<server>/<path>(\?attr(&attr)*)?
+ git+ssh://<server>/<path>(\?attr(&attr)*)?
+ git://<server>/<path>(\?attr(&attr)*)?
+ file:///<path>(\?attr(&attr)*)?
+
+ where 'attr' is one of:
+ rev=<rev>
+ ref=<ref>
+
+ A Git repository fetched through https. The default for "ref" is
+ "master".
+
+ Examples:
+
+ git+https://example.org/my/repo.git
+ git+https://example.org/my/repo.git?ref=release-1.2.3
+ git+https://example.org/my/repo.git?rev=e72daba8250068216d79d2aeef40d4d95aff6666
+ git://github.com/edolstra/dwarffs.git?ref=flake&rev=2efca4bc9da70fb001b26c3dc858c6397d3c4817
+
+ * /path(\?attr(&attr)*)?
+
+ Like file://path, but if no "ref" or "rev" is specified, the
+ (possibly dirty) working tree will be used. Using a working tree
+ is not allowed in pure evaluation mode.
+
+ Examples:
+
+ /path/to/my/repo
+ /path/to/my/repo?ref=develop
+ /path/to/my/repo?rev=e72daba8250068216d79d2aeef40d4d95aff6666
+
+ * https://<server>/<path>.tar.xz(?hash=<sri-hash>)
+ file:///<path>.tar.xz(?hash=<sri-hash>)
+
+ A flake distributed as a tarball. In pure evaluation mode, an SRI
+ hash is mandatory. It exposes a "lastModified" attribute, being
+ the newest file inside the tarball.
+
+ Example:
+
+ https://releases.nixos.org/nixos/unstable/nixos-19.03pre167858.f2a1a4e93be/nixexprs.tar.xz
+ https://releases.nixos.org/nixos/unstable/nixos-19.03pre167858.f2a1a4e93be/nixexprs.tar.xz?hash=sha256-56bbc099995ea8581ead78f22832fee7dbcb0a0b6319293d8c2d0aef5379397c
+
+ Note: currently, there can be only one flake per Git repository, and
+ it must be at top-level. In the future, we may want to add a field
+ (e.g. "dir=<dir>") to specify a subdirectory inside the repository.
+*/
+
+typedef std::string FlakeId;
+typedef std::string FlakeUri;
+
+struct FlakeRef
+{
+ struct IsId
+ {
+ FlakeId id;
+ bool operator<(const IsId & b) const { return id < b.id; };
+ bool operator==(const IsId & b) const { return id == b.id; };
+ };
+
+ struct IsGitHub {
+ std::string owner, repo;
+ bool operator<(const IsGitHub & b) const {
+ return std::make_tuple(owner, repo) < std::make_tuple(b.owner, b.repo);
+ }
+ bool operator==(const IsGitHub & b) const {
+ return owner == b.owner && repo == b.repo;
+ }
+ };
+
+ // Git, Tarball
+ struct IsGit
+ {
+ std::string uri;
+ bool operator<(const IsGit & b) const { return uri < b.uri; }
+ bool operator==(const IsGit & b) const { return uri == b.uri; }
+ };
+
+ struct IsPath
+ {
+ Path path;
+ bool operator<(const IsPath & b) const { return path < b.path; }
+ bool operator==(const IsPath & b) const { return path == b.path; }
+ };
+
+ // Git, Tarball
+
+ std::variant<IsId, IsGitHub, IsGit, IsPath> data;
+
+ std::optional<std::string> ref;
+ std::optional<Hash> rev;
+ Path subdir = ""; // This is a relative path pointing at the flake.nix file's directory, relative to the git root.
+
+ bool operator<(const FlakeRef & flakeRef) const
+ {
+ return std::make_tuple(data, ref, rev, subdir) <
+ std::make_tuple(flakeRef.data, flakeRef.ref, flakeRef.rev, subdir);
+ }
+
+ bool operator==(const FlakeRef & flakeRef) const
+ {
+ return std::make_tuple(data, ref, rev, subdir) ==
+ std::make_tuple(flakeRef.data, flakeRef.ref, flakeRef.rev, flakeRef.subdir);
+ }
+
+ // Parse a flake URI.
+ FlakeRef(const std::string & uri, bool allowRelative = false);
+
+ // FIXME: change to operator <<.
+ std::string to_string() const;
+
+ /* Check whether this is a "direct" flake reference, that is, not
+ a flake ID, which requires a lookup in the flake registry. */
+ bool isDirect() const
+ {
+ return !std::get_if<FlakeRef::IsId>(&data);
+ }
+
+ /* Check whether this is an "immutable" flake reference, that is,
+ one that contains a commit hash or content hash. */
+ bool isImmutable() const;
+
+ FlakeRef baseRef() const;
+
+ bool isDirty() const
+ {
+ return std::get_if<FlakeRef::IsPath>(&data)
+ && rev == Hash(rev->type);
+ }
+
+ /* Return true if 'other' is not less specific than 'this'. For
+ example, 'nixpkgs' contains 'nixpkgs/release-19.03', and both
+ 'nixpkgs' and 'nixpkgs/release-19.03' contain
+ 'nixpkgs/release-19.03/<hash>'. */
+ bool contains(const FlakeRef & other) const;
+};
+
+std::ostream & operator << (std::ostream & str, const FlakeRef & flakeRef);
+
+MakeError(BadFlakeRef, Error);
+MakeError(MissingFlake, BadFlakeRef);
+
+std::optional<FlakeRef> parseFlakeRef(
+ const std::string & uri, bool allowRelative = false);
+
+}
diff --git a/src/libexpr/flake/lockfile.cc b/src/libexpr/flake/lockfile.cc
new file mode 100644
index 000000000..5693e57dc
--- /dev/null
+++ b/src/libexpr/flake/lockfile.cc
@@ -0,0 +1,91 @@
+#include "lockfile.hh"
+#include "store-api.hh"
+
+#include <nlohmann/json.hpp>
+
+namespace nix::flake {
+
+LockedInput::LockedInput(const nlohmann::json & json)
+ : LockedInputs(json)
+ , ref(json.value("url", json.value("uri", "")))
+ , originalRef(json.value("originalUrl", json.value("originalUri", "")))
+ , narHash(Hash((std::string) json["narHash"]))
+{
+ if (!ref.isImmutable())
+ throw Error("lockfile contains mutable flakeref '%s'", ref);
+}
+
+nlohmann::json LockedInput::toJson() const
+{
+ auto json = LockedInputs::toJson();
+ json["url"] = ref.to_string();
+ json["originalUrl"] = originalRef.to_string();
+ json["narHash"] = narHash.to_string(SRI);
+ return json;
+}
+
+Path LockedInput::computeStorePath(Store & store) const
+{
+ return store.makeFixedOutputPath(true, narHash, "source");
+}
+
+LockedInputs::LockedInputs(const nlohmann::json & json)
+{
+ for (auto & i : json["inputs"].items())
+ inputs.insert_or_assign(i.key(), LockedInput(i.value()));
+}
+
+nlohmann::json LockedInputs::toJson() const
+{
+ nlohmann::json json;
+ {
+ auto j = nlohmann::json::object();
+ for (auto & i : inputs)
+ j[i.first] = i.second.toJson();
+ json["inputs"] = std::move(j);
+ }
+ return json;
+}
+
+bool LockedInputs::isDirty() const
+{
+ for (auto & i : inputs)
+ if (i.second.ref.isDirty() || i.second.isDirty()) return true;
+
+ return false;
+}
+
+nlohmann::json LockFile::toJson() const
+{
+ auto json = LockedInputs::toJson();
+ json["version"] = 3;
+ return json;
+}
+
+LockFile LockFile::read(const Path & path)
+{
+ if (pathExists(path)) {
+ auto json = nlohmann::json::parse(readFile(path));
+
+ auto version = json.value("version", 0);
+ if (version != 3)
+ throw Error("lock file '%s' has unsupported version %d", path, version);
+
+ return LockFile(json);
+ } else
+ return LockFile();
+}
+
+std::ostream & operator <<(std::ostream & stream, const LockFile & lockFile)
+{
+ stream << lockFile.toJson().dump(4); // '4' = indentation in json file
+ return stream;
+}
+
+void LockFile::write(const Path & path) const
+{
+ createDirs(dirOf(path));
+ writeFile(path, fmt("%s\n", *this));
+}
+
+}
diff --git a/src/libexpr/flake/lockfile.hh b/src/libexpr/flake/lockfile.hh
new file mode 100644
index 000000000..757c37989
--- /dev/null
+++ b/src/libexpr/flake/lockfile.hh
@@ -0,0 +1,85 @@
+#pragma once
+
+#include "flakeref.hh"
+
+#include <nlohmann/json_fwd.hpp>
+
+namespace nix {
+class Store;
+}
+
+namespace nix::flake {
+
+struct LockedInput;
+
+/* Lock file information about the dependencies of a flake. */
+struct LockedInputs
+{
+ std::map<FlakeId, LockedInput> inputs;
+
+ LockedInputs() {};
+ LockedInputs(const nlohmann::json & json);
+
+ nlohmann::json toJson() const;
+
+ /* A lock file is dirty if it contains a dirty flakeref
+ (i.e. reference to a dirty working tree). */
+ bool isDirty() const;
+};
+
+/* Lock file information about a flake input. */
+struct LockedInput : LockedInputs
+{
+ FlakeRef ref, originalRef;
+ Hash narHash;
+
+ LockedInput(const FlakeRef & ref, const FlakeRef & originalRef, const Hash & narHash)
+ : ref(ref), originalRef(originalRef), narHash(narHash)
+ {
+ assert(ref.isImmutable());
+ };
+
+ LockedInput(const nlohmann::json & json);
+
+ bool operator ==(const LockedInput & other) const
+ {
+ return
+ ref == other.ref
+ && narHash == other.narHash
+ && inputs == other.inputs;
+ }
+
+ nlohmann::json toJson() const;
+
+ Path computeStorePath(Store & store) const;
+};
+
+/* An entire lock file. Note that this cannot be a FlakeInput for the
+ top-level flake, because then the lock file would need to contain
+ the hash of the top-level flake, but committing the lock file
+ would invalidate that hash. */
+struct LockFile : LockedInputs
+{
+ bool operator ==(const LockFile & other) const
+ {
+ return inputs == other.inputs;
+ }
+
+ LockFile() {}
+ LockFile(const nlohmann::json & json) : LockedInputs(json) {}
+ LockFile(LockedInput && dep)
+ {
+ inputs = std::move(dep.inputs);
+ }
+
+ nlohmann::json toJson() const;
+
+ static LockFile read(const Path & path);
+
+ void write(const Path & path) const;
+};
+
+std::ostream & operator <<(std::ostream & stream, const LockFile & lockFile);
+
+}
+
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-23 12:45:15 +0000