Try to realise CA derivations during queryMissing

This enables nix to correctly report what will be fetched in the case
that everything is a cache hit.

Note however that if an intermediate build of something which is not
cached could still cause products to end up being substituted if the
intermediate build results in a CA path which is in the cache.

Fixes #8615.

Signed-off-by: Peter Waller <p@pwaller.net>

tests/ca/build-cache.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+source common.sh
+
+# The substituters didn't work prior to this time.
+requireDaemonNewerThan "2.18.0pre20230808"
+
+drv=$(nix-instantiate ./content-addressed.nix -A rootCA --arg seed 1)^out
+nix derivation show "$drv" --arg seed 1
+
+buildAttr () {
+    local derivationPath=$1
+    local seedValue=$2
+    shift; shift
+    local args=("./content-addressed.nix" "-A" "$derivationPath" --arg seed "$seedValue" "--no-out-link")
+    args+=("$@")
+    nix-build "${args[@]}"
+}
+
+copyAttr () {
+    local derivationPath=$1
+    local seedValue=$2
+    shift; shift
+    local args=("-f" "./content-addressed.nix" "$derivationPath" --arg seed "$seedValue")
+    args+=("$@")
+    # Note: to copy CA derivations, we need to copy the realisations, which
+    # currently requires naming the installables, not just the derivation output
+    # path.
+    nix copy --to file://$cacheDir "${args[@]}"
+}
+
+testRemoteCacheFor () {
+    local derivationPath=$1
+    clearCache
+    copyAttr "$derivationPath" 1
+    clearStore
+    # Check nothing gets built.
+    buildAttr "$derivationPath" 1 --option substituters file://$cacheDir --no-require-sigs |& grepQuietInverse " will be built:"
+}
+
+testRemoteCache () {
+    testRemoteCacheFor rootCA
+    testRemoteCacheFor dependentCA
+    testRemoteCacheFor dependentNonCA
+    testRemoteCacheFor dependentFixedOutput
+    testRemoteCacheFor dependentForBuildCA
+    testRemoteCacheFor dependentForBuildNonCA
+}
+
+clearStore
+testRemoteCache

tests/ca/build.sh

@@ -2,7 +2,7 @@
 
 source common.sh
 
-drv=$(nix-instantiate ./content-addressed.nix -A rootCA --arg seed 1)
+drv=$(nix-instantiate ./content-addressed.nix -A rootCA --arg seed 1)^out
 nix derivation show "$drv" --arg seed 1
 
 buildAttr () {
@@ -14,14 +14,6 @@ buildAttr () {
     nix-build "${args[@]}"
 }
 
-testRemoteCache () {
-    clearCache
-    local outPath=$(buildAttr dependentNonCA 1)
-    nix copy --to file://$cacheDir $outPath
-    clearStore
-    buildAttr dependentNonCA 1 --option substituters file://$cacheDir --no-require-sigs |& grepQuietInverse "building dependent-non-ca"
-}
-
 testDeterministicCA () {
     [[ $(buildAttr rootCA 1) = $(buildAttr rootCA 2) ]]
 }
@@ -66,8 +58,6 @@ testNormalization () {
     test "$(stat -c %Y $outPath)" -eq 1
 }
 
-# Disabled until we have it properly working
-# testRemoteCache
 clearStore
 testNormalization
 testDeterministicCA

tests/ca/content-addressed.nix

@@ -61,6 +61,24 @@ rec {
       echo ${rootCA}/non-ca-hello > $out/dep
     '';
   };
+  dependentForBuildCA = mkCADerivation {
+    name = "dependent-for-build-ca";
+    buildCommand = ''
+      echo "Depends on rootCA for building only"
+      mkdir -p $out
+      echo ${rootCA}
+      touch $out
+    '';
+  };
+  dependentForBuildNonCA = mkDerivation {
+    name = "dependent-for-build-non-ca";
+    buildCommand = ''
+      echo "Depends on rootCA for building only"
+      mkdir -p $out
+      echo ${rootCA}
+      touch $out
+    '';
+  };
   dependentFixedOutput = mkDerivation {
     name = "dependent-fixed-output";
     outputHashMode = "recursive";

tests/ca/local.mk

@@ -1,6 +1,7 @@
 ca-tests := \
   $(d)/build-with-garbage-path.sh \
   $(d)/build.sh \
+  $(d)/build-cache.sh \
   $(d)/concurrent-builds.sh \
   $(d)/derivation-json.sh \
   $(d)/duplicate-realisation-in-closure.sh \