Merge remote-tracking branch 'upstream/master' into lfs

tests/functional/flakes/flake-in-submodule.sh

@@ -76,3 +76,21 @@ git -C "$rootRepo" commit -m "Add flake.nix"
 
 storePath=$(nix flake metadata --json "$rootRepo?submodules=1" | jq -r .path)
 [[ -e "$storePath/submodule" ]]
+
+# The root repo may use the submodule repo as an input
+# through the relative path. This may change in the future;
+# see: https://discourse.nixos.org/t/57783 and #9708.
+cat > "$rootRepo"/flake.nix <<EOF
+{
+    inputs.subRepo.url = "git+file:./submodule";
+    outputs = { ... }: { };
+}
+EOF
+git -C "$rootRepo" add flake.nix
+git -C "$rootRepo" commit -m "Add subRepo input"
+(
+  cd "$rootRepo"
+  # The submodule must be locked to the relative path,
+  # _not_ the absolute path:
+  [[ $(nix flake metadata --json | jq -r .locks.nodes.subRepo.locked.url) = "file:./submodule" ]]
+)

tests/functional/flakes/flakes.sh

@@ -97,6 +97,9 @@ nix build -o "$TEST_ROOT/result" flake1
 
 nix build -o "$TEST_ROOT/result" "$flake1Dir"
 nix build -o "$TEST_ROOT/result" "git+file://$flake1Dir"
+(cd "$flake1Dir" && nix build -o "$TEST_ROOT/result" ".")
+(cd "$flake1Dir" && nix build -o "$TEST_ROOT/result" "path:.")
+(cd "$flake1Dir" && nix build -o "$TEST_ROOT/result" "git+file:.")
 
 # Test explicit packages.default.
 nix build -o "$TEST_ROOT/result" "$flake1Dir#default"
@@ -106,6 +109,15 @@ nix build -o "$TEST_ROOT/result" "git+file://$flake1Dir#default"
 nix build -o "$TEST_ROOT/result" "$flake1Dir?ref=HEAD#default"
 nix build -o "$TEST_ROOT/result" "git+file://$flake1Dir?ref=HEAD#default"
 
+# Check that relative paths are allowed for git flakes.
+# This may change in the future once git submodule support is refined.
+# See: https://discourse.nixos.org/t/57783 and #9708.
+(
+  # This `cd` should not be required and is indicative of aforementioned bug.
+  cd "$flake1Dir/.."
+  nix build -o "$TEST_ROOT/result" "git+file:./$(basename "$flake1Dir")"
+)
+
 # Check that store symlinks inside a flake are not interpreted as flakes.
 nix build -o "$flake1Dir/result" "git+file://$flake1Dir"
 nix path-info "$flake1Dir/result"

tests/functional/flakes/follow-paths.sh

@@ -2,9 +2,6 @@
 
 source ./common.sh
 
-# FIXME: this test is disabled because relative path flakes are broken. Re-enable this in #10089.
-exit 0
-
 requireGit
 
 flakeFollowsA=$TEST_ROOT/follows/flakeA
@@ -120,7 +117,7 @@ nix flake lock $flakeFollowsA
 [[ $(jq -c .nodes.B.inputs.foobar $flakeFollowsA/flake.lock) = '"foobar"' ]]
 jq -r -c '.nodes | keys | .[]' $flakeFollowsA/flake.lock | grep "^foobar$"
 
-# Ensure a relative path is not allowed to go outside the store path
+# Check that path: inputs cannot escape from their root.
 cat > $flakeFollowsA/flake.nix <<EOF
 {
     description = "Flake A";
@@ -133,7 +130,28 @@ EOF
 
 git -C $flakeFollowsA add flake.nix
 
-expect 1 nix flake lock $flakeFollowsA 2>&1 | grep 'points outside'
+expect 1 nix flake lock $flakeFollowsA 2>&1 | grep '/flakeB.*is forbidden in pure evaluation mode'
+expect 1 nix flake lock --impure $flakeFollowsA 2>&1 | grep '/flakeB.*does not exist'
+
+# Test relative non-flake inputs.
+cat > $flakeFollowsA/flake.nix <<EOF
+{
+    description = "Flake A";
+    inputs = {
+        E.flake = false;
+        E.url = "./foo.nix"; # test relative paths without 'path:'
+    };
+    outputs = { E, ... }: { e = import E; };
+}
+EOF
+
+echo 123 > $flakeFollowsA/foo.nix
+
+git -C $flakeFollowsA add flake.nix foo.nix
+
+nix flake lock $flakeFollowsA
+
+[[ $(nix eval --json $flakeFollowsA#e) = 123 ]]
 
 # Non-existant follows should print a warning.
 cat >$flakeFollowsA/flake.nix <<EOF
@@ -338,6 +356,6 @@ json=$(nix flake metadata "$flakeFollowsCustomUrlA" --json)
 rm "$flakeFollowsCustomUrlA"/flake.lock
 
 # if override-input is specified, lock "original" entry should contain original url
-json=$(nix flake metadata "$flakeFollowsCustomUrlA" --override-input B/C "path:./flakeB/flakeD" --json)
+json=$(nix flake metadata "$flakeFollowsCustomUrlA" --override-input B/C "$flakeFollowsCustomUrlD" --json)
 echo "$json" | jq .locks.nodes.C.original
 [[ $(echo "$json" | jq -r .locks.nodes.C.original.path) = './flakeC' ]]

tests/functional/flakes/meson.build

@@ -27,6 +27,7 @@ suites += {
     'shebang.sh',
     'commit-lock-file-summary.sh',
     'non-flake-inputs.sh',
+    'relative-paths.sh',
   ],
   'workdir': meson.current_source_dir(),
 }

tests/functional/flakes/relative-paths.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+
+source ./common.sh
+
+requireGit
+
+rootFlake="$TEST_ROOT/flake1"
+subflake0="$rootFlake/sub0"
+subflake1="$rootFlake/sub1"
+subflake2="$rootFlake/sub2"
+
+rm -rf "$rootFlake"
+mkdir -p "$rootFlake" "$subflake0" "$subflake1" "$subflake2"
+
+cat > "$rootFlake/flake.nix" <<EOF
+{
+  inputs.sub0.url = ./sub0;
+  outputs = { self, sub0 }: {
+    x = 2;
+    y = self.x * sub0.x;
+  };
+}
+EOF
+
+cat > "$subflake0/flake.nix" <<EOF
+{
+  outputs = { self }: {
+    x = 7;
+  };
+}
+EOF
+
+[[ $(nix eval "$rootFlake#x") = 2 ]]
+[[ $(nix eval "$rootFlake#y") = 14 ]]
+
+cat > "$subflake1/flake.nix" <<EOF
+{
+  inputs.root.url = "../";
+  outputs = { self, root }: {
+    x = 3;
+    y = self.x * root.x;
+  };
+}
+EOF
+
+[[ $(nix eval "$rootFlake?dir=sub1#y") = 6 ]]
+
+git init "$rootFlake"
+git -C "$rootFlake" add flake.nix sub0/flake.nix sub1/flake.nix
+
+[[ $(nix eval "$subflake1#y") = 6 ]]
+
+cat > "$subflake2/flake.nix" <<EOF
+{
+  inputs.root.url = ./..;
+  inputs.sub1.url = "../sub1";
+  outputs = { self, root, sub1 }: {
+    x = 5;
+    y = self.x * sub1.x;
+  };
+}
+EOF
+
+git -C "$rootFlake" add flake.nix sub2/flake.nix
+
+[[ $(nix eval "$subflake2#y") = 15 ]]
+
+# Make sure that this still works after commiting the lock file.
+git -C "$rootFlake" add sub2/flake.lock
+[[ $(nix eval "$subflake2#y") = 15 ]]
+
+# Make sure there are no content locks for relative path flakes.
+(! grep "$TEST_ROOT" "$subflake2/flake.lock")
+if ! isTestOnNixOS; then
+    (! grep "$NIX_STORE_DIR" "$subflake2/flake.lock")
+fi
+(! grep narHash "$subflake2/flake.lock")
+
+# Test circular relative path flakes. FIXME: doesn't work at the moment.
+if false; then
+
+cat > "$rootFlake/flake.nix" <<EOF
+{
+  inputs.sub1.url = "./sub1";
+  inputs.sub2.url = "./sub1";
+  outputs = { self, sub1, sub2 }: {
+    x = 2;
+    y = self.x * sub1.x * sub2.x;
+    z = sub1.y * sub2.y;
+  };
+}
+EOF
+
+[[ $(nix eval "$rootFlake#x") = 30 ]]
+[[ $(nix eval "$rootFlake#z") = 90 ]]
+
+fi

tests/functional/flakes/unlocked-override.sh

@@ -31,5 +31,14 @@ echo 456 > "$flake1Dir"/x.nix
 
 [[ $(nix eval --json "$flake2Dir#x" --override-input flake1 "$TEST_ROOT/flake1") = 456 ]]
 
+# Dirty overrides require --allow-dirty-locks.
 expectStderr 1 nix flake lock "$flake2Dir" --override-input flake1 "$TEST_ROOT/flake1" |
-  grepQuiet "cannot write lock file.*because it has an unlocked input"
+  grepQuiet "Will not write lock file.*because it has an unlocked input"
+
+nix flake lock "$flake2Dir" --override-input flake1 "$TEST_ROOT/flake1" --allow-dirty-locks
+
+# Using a lock file with a dirty lock requires --allow-dirty-locks as well.
+expectStderr 1 nix eval "$flake2Dir#x" |
+  grepQuiet "Lock file contains unlocked input"
+
+[[ $(nix eval "$flake2Dir#x" --allow-dirty-locks) = 456 ]]

tests/functional/user-envs-test-case.sh

@@ -173,13 +173,21 @@ nix-env -q '*' | grepQuiet bar-0.1.1
 
 # Test priorities: foo-0.1 has a lower priority than foo-1.0, so it
 # should be possible to install both without a collision.  Also test
-# ‘--set-flag priority’ to manually override the declared priorities.
+# '-i --priority' and  '--set-flag priority' to manually override the
+# declared priorities.
 nix-env -e '*'
 nix-env -i foo-0.1 foo-1.0
 [ "$($profiles/test/bin/foo)" = "foo-1.0" ]
 nix-env --set-flag priority 1 foo-0.1
 [ "$($profiles/test/bin/foo)" = "foo-0.1" ]
 
+# Priorities can be overridden with the --priority flag
+nix-env -e '*'
+nix-env -i foo-1.0
+[ "$($profiles/test/bin/foo)" = "foo-1.0" ]
+nix-env -i --priority 1 foo-0.1
+[ "$($profiles/test/bin/foo)" = "foo-0.1" ]
+
 # Test nix-env --set.
 nix-env --set $outPath10
 [ "$(nix-store -q --resolve $profiles/test)" = $outPath10 ]

tests/nixos/git-submodules.nix

@@ -39,11 +39,14 @@
       client.succeed("chmod 600 /root/.ssh/id_ed25519")
 
       # Install the SSH key on the builders.
-      client.wait_for_unit("network.target")
+      client.wait_for_unit("network-online.target")
 
       remote.succeed("mkdir -p -m 700 /root/.ssh")
       remote.copy_from_host("key.pub", "/root/.ssh/authorized_keys")
       remote.wait_for_unit("sshd")
+      remote.wait_for_unit("multi-user.target")
+      remote.wait_for_unit("network-online.target")
+      client.wait_for_unit("network-online.target")
       client.succeed(f"ssh -o StrictHostKeyChecking=no {remote.name} 'echo hello world'")
 
       remote.succeed("""

tests/nixos/github-flakes.nix

@@ -161,7 +161,9 @@ in
          github.succeed("cat /var/log/httpd/*.log >&2")
 
     github.wait_for_unit("httpd.service")
+    github.wait_for_unit("network-online.target")
 
+    client.wait_for_unit("network-online.target")
     client.succeed("curl -v https://github.com/ >&2")
     out = client.succeed("nix registry list")
     print(out)

tests/nixos/nix-copy-closure.nix

@@ -48,7 +48,10 @@ in {
     server.succeed("mkdir -m 700 /root/.ssh")
     server.copy_from_host("key.pub", "/root/.ssh/authorized_keys")
     server.wait_for_unit("sshd")
-    client.wait_for_unit("network.target")
+    server.wait_for_unit("multi-user.target")
+    server.wait_for_unit("network-online.target")
+
+    client.wait_for_unit("network-online.target")
     client.succeed(f"ssh -o StrictHostKeyChecking=no {server.name} 'echo hello world'")
 
     # Copy the closure of package A from the client to the server.

tests/nixos/nix-copy.nix

@@ -56,7 +56,10 @@ in {
     start_all()
 
     server.wait_for_unit("sshd")
-    client.wait_for_unit("network.target")
+    server.wait_for_unit("multi-user.target")
+    server.wait_for_unit("network-online.target")
+
+    client.wait_for_unit("network-online.target")
     client.wait_for_unit("getty@tty1.service")
     # Either the prompt: ]#
     # or an OCR misreading of it: 1#

tests/nixos/nix-docker.nix

@@ -37,6 +37,7 @@ in {
 
   testScript = { nodes }: ''
     cache.wait_for_unit("harmonia.service")
+    cache.wait_for_unit("network-online.target")
 
     machine.succeed("mkdir -p /etc/containers")
     machine.succeed("""echo '{"default":[{"type":"insecureAcceptAnything"}]}' > /etc/containers/policy.json""")

tests/nixos/nss-preload.nix

@@ -102,6 +102,7 @@ in
   };
 
   testScript = { nodes, ... }: ''
+    http_dns.wait_for_unit("network-online.target")
     http_dns.wait_for_unit("nginx")
     http_dns.wait_for_open_port(80)
     http_dns.wait_for_unit("unbound")
@@ -109,6 +110,7 @@ in
 
     client.start()
     client.wait_for_unit('multi-user.target')
+    client.wait_for_unit('network-online.target')
 
     with subtest("can fetch data from a remote server outside sandbox"):
         client.succeed("nix --version >&2")

tests/nixos/remote-builds-ssh-ng.nix

@@ -89,10 +89,13 @@ in
       client.succeed("chmod 600 /root/.ssh/id_ed25519")
 
       # Install the SSH key on the builder.
-      client.wait_for_unit("network.target")
+      client.wait_for_unit("network-online.target")
       builder.succeed("mkdir -p -m 700 /root/.ssh")
       builder.copy_from_host("key.pub", "/root/.ssh/authorized_keys")
       builder.wait_for_unit("sshd")
+      builder.wait_for_unit("multi-user.target")
+      builder.wait_for_unit("network-online.target")
+
       client.succeed(f"ssh -o StrictHostKeyChecking=no {builder.name} 'echo hello world'")
 
       # Perform a build

tests/nixos/remote-builds.nix

@@ -112,11 +112,12 @@ in
       client.succeed("chmod 600 /root/.ssh/id_ed25519")
 
       # Install the SSH key on the builders.
-      client.wait_for_unit("network.target")
+      client.wait_for_unit("network-online.target")
       for builder in [builder1, builder2]:
         builder.succeed("mkdir -p -m 700 /root/.ssh")
         builder.copy_from_host("key.pub", "/root/.ssh/authorized_keys")
         builder.wait_for_unit("sshd")
+        builder.wait_for_unit("network-online.target")
         # Make sure the builder can handle our login correctly
         builder.wait_for_unit("multi-user.target")
         # Make sure there's no funny business on the client either

tests/nixos/s3-binary-cache-store.nix

@@ -52,12 +52,15 @@ in {
 
     # Create a binary cache.
     server.wait_for_unit("minio")
+    server.wait_for_unit("network-online.target")
 
     server.succeed("mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4")
     server.succeed("mc mb minio/my-cache")
 
     server.succeed("${env} nix copy --to '${storeUrl}' ${pkgA}")
 
+    client.wait_for_unit("network-online.target")
+
     # Test fetchurl on s3:// URLs while we're at it.
     client.succeed("${env} nix eval --impure --expr 'builtins.fetchurl { name = \"foo\"; url = \"s3://my-cache/nix-cache-info?endpoint=http://server:9000&region=eu-west-1\"; }'")
 

tests/nixos/sourcehut-flakes.nix

@@ -122,6 +122,8 @@ in
       start_all()
 
       sourcehut.wait_for_unit("httpd.service")
+      sourcehut.wait_for_unit("network-online.target")
+      client.wait_for_unit("network-online.target")
 
       client.succeed("curl -v https://git.sr.ht/ >&2")
       client.succeed("nix registry list | grep nixpkgs")