diff options
author | Artturin <Artturin@artturin.com> | 2022-12-01 18:49:48 +0200 |
---|---|---|
committer | Artturin <Artturin@artturin.com> | 2022-12-02 21:15:24 +0200 |
commit | a34d7b67fd8366edaff9e558ac3711d3d8623e47 (patch) | |
tree | 91657ca2a0e09ea5f581855cdd84026b190724f4 /nixos/modules/system | |
parent | 2abf40d9b5bfaa49898af7b18b69a86247c29f2c (diff) |
nixos/top-level.nix: add forbiddenDependenciesRegex option
useful for making sure that there's no dev outputs in the system
Diffstat (limited to 'nixos/modules/system')
-rw-r--r-- | nixos/modules/system/activation/test.nix | 27 | ||||
-rw-r--r-- | nixos/modules/system/activation/top-level.nix | 32 |
2 files changed, 58 insertions, 1 deletions
diff --git a/nixos/modules/system/activation/test.nix b/nixos/modules/system/activation/test.nix new file mode 100644 index 0000000000000..8cf000451c6e3 --- /dev/null +++ b/nixos/modules/system/activation/test.nix @@ -0,0 +1,27 @@ +{ lib +, nixos +, expect +, testers +}: +let + node-forbiddenDependencies-fail = nixos ({ ... }: { + system.forbiddenDependenciesRegex = "-dev$"; + environment.etc."dev-dependency" = { + text = "${expect.dev}"; + }; + documentation.enable = false; + fileSystems."/".device = "ignore-root-device"; + boot.loader.grub.enable = false; + }); + node-forbiddenDependencies-succeed = nixos ({ ... }: { + system.forbiddenDependenciesRegex = "-dev$"; + system.extraDependencies = [ expect.dev ]; + documentation.enable = false; + fileSystems."/".device = "ignore-root-device"; + boot.loader.grub.enable = false; + }); +in +lib.recurseIntoAttrs { + test-forbiddenDependencies-fail = testers.testBuildFailure node-forbiddenDependencies-fail.config.system.build.toplevel; + test-forbiddenDependencies-succeed = node-forbiddenDependencies-succeed.config.system.build.toplevel; +} diff --git a/nixos/modules/system/activation/top-level.nix b/nixos/modules/system/activation/top-level.nix index 55ff98db53829..64e97b510b067 100644 --- a/nixos/modules/system/activation/top-level.nix +++ b/nixos/modules/system/activation/top-level.nix @@ -77,7 +77,7 @@ let ${config.system.systemBuilderCommands} - echo -n "${toString config.system.extraDependencies}" > $out/extra-dependencies + echo -n "$extraDependencies" > $out/extra-dependencies ${config.system.extraSystemBuilderCmds} ''; @@ -105,6 +105,8 @@ let dryActivationScript = config.system.dryActivationScript; nixosLabel = config.system.nixos.label; + inherit (config.system) extraDependencies; + # Needed by switch-to-configuration. perl = pkgs.perl.withPackages (p: with p; [ ConfigIniFiles FileSlurp ]); } // config.system.systemBuilderArgs); @@ -223,6 +225,16 @@ in ''; }; + system.forbiddenDependenciesRegex = mkOption { + default = ""; + example = "-dev$"; + type = types.str; + description = lib.mdDoc '' + A POSIX Extended Regular Expression that matches store paths that + should not appear in the system closure, with the exception of {option}`system.extraDependencies`, which is not checked. + ''; + }; + system.extraSystemBuilderCmds = mkOption { type = types.lines; internal = true; @@ -298,8 +310,26 @@ in config.system.copySystemConfiguration ''ln -s '${import ../../../lib/from-env.nix "NIXOS_CONFIG" <nixos-config>}' \ "$out/configuration.nix" + '' + + optionalString + (config.system.forbiddenDependenciesRegex != "") + '' + if [[ $forbiddenDependenciesRegex != "" && -n $closureInfo ]]; then + if forbiddenPaths="$(grep -E -- "$forbiddenDependenciesRegex" $closureInfo/store-paths)"; then + echo -e "System closure $out contains the following disallowed paths:\n$forbiddenPaths" + exit 1 + fi + fi ''; + system.systemBuilderArgs = lib.optionalAttrs (config.system.forbiddenDependenciesRegex != "") { + inherit (config.system) forbiddenDependenciesRegex; + closureInfo = pkgs.closureInfo { rootPaths = [ + # override to avoid infinite recursion (and to allow using extraDependencies to add forbidden dependencies) + (config.system.build.toplevel.overrideAttrs (_: { extraDependencies = []; closureInfo = null; })) + ]; }; + }; + system.build.toplevel = system; }; |