Merge remote-tracking branch 'origin/master' into handle-missing-gc-socket

tests/eval-store.sh

@@ -1,30 +0,0 @@
-source common.sh
-
-# Using `--eval-store` with the daemon will eventually copy everything
-# to the build store, invalidating most of the tests here
-needLocalStore "“--eval-store” doesn't achieve much with the daemon"
-
-eval_store=$TEST_ROOT/eval-store
-
-clearStore
-rm -rf "$eval_store"
-
-nix build -f dependencies.nix --eval-store "$eval_store" -o "$TEST_ROOT/result"
-[[ -e $TEST_ROOT/result/foobar ]]
-(! ls $NIX_STORE_DIR/*.drv)
-ls $eval_store/nix/store/*.drv
-
-clearStore
-rm -rf "$eval_store"
-
-nix-instantiate dependencies.nix --eval-store "$eval_store"
-(! ls $NIX_STORE_DIR/*.drv)
-ls $eval_store/nix/store/*.drv
-
-clearStore
-rm -rf "$eval_store"
-
-nix-build dependencies.nix --eval-store "$eval_store" -o "$TEST_ROOT/result"
-[[ -e $TEST_ROOT/result/foobar ]]
-(! ls $NIX_STORE_DIR/*.drv)
-ls $eval_store/nix/store/*.drv

tests/fetchClosure.sh

@@ -1,79 +0,0 @@
-source common.sh
-
-enableFeatures "fetch-closure"
-
-clearStore
-clearCacheCache
-
-# Old daemons don't properly zero out the self-references when
-# calculating the CA hashes, so this breaks `nix store
-# make-content-addressed` which expects the client and the daemon to
-# compute the same hash
-requireDaemonNewerThan "2.16.0pre20230524"
-
-# Initialize binary cache.
-nonCaPath=$(nix build --json --file ./dependencies.nix --no-link | jq -r .[].outputs.out)
-caPath=$(nix store make-content-addressed --json $nonCaPath | jq -r '.rewrites | map(.) | .[]')
-nix copy --to file://$cacheDir $nonCaPath
-
-# Test basic fetchClosure rewriting from non-CA to CA.
-clearStore
-
-[ ! -e $nonCaPath ]
-[ ! -e $caPath ]
-
-[[ $(nix eval -v --raw --expr "
-  builtins.fetchClosure {
-    fromStore = \"file://$cacheDir\";
-    fromPath = $nonCaPath;
-    toPath = $caPath;
-  }
-") = $caPath ]]
-
-[ ! -e $nonCaPath ]
-[ -e $caPath ]
-
-if [[ "$NIX_REMOTE" != "daemon" ]]; then
-
-    # In impure mode, we can use non-CA paths.
-    [[ $(nix eval --raw --no-require-sigs --impure --expr "
-      builtins.fetchClosure {
-        fromStore = \"file://$cacheDir\";
-        fromPath = $nonCaPath;
-      }
-    ") = $nonCaPath ]]
-
-    [ -e $nonCaPath ]
-
-fi
-
-# 'toPath' set to empty string should fail but print the expected path.
-expectStderr 1 nix eval -v --json --expr "
-  builtins.fetchClosure {
-    fromStore = \"file://$cacheDir\";
-    fromPath = $nonCaPath;
-    toPath = \"\";
-  }
-" | grep "error: rewriting.*$nonCaPath.*yielded.*$caPath"
-
-# If fromPath is CA, then toPath isn't needed.
-nix copy --to file://$cacheDir $caPath
-
-[[ $(nix eval -v --raw --expr "
-  builtins.fetchClosure {
-    fromStore = \"file://$cacheDir\";
-    fromPath = $caPath;
-  }
-") = $caPath ]]
-
-# Check that URL query parameters aren't allowed.
-clearStore
-narCache=$TEST_ROOT/nar-cache
-rm -rf $narCache
-(! nix eval -v --raw --expr "
-  builtins.fetchClosure {
-    fromStore = \"file://$cacheDir?local-nar-cache=$narCache\";
-    fromPath = $caPath;
-  }
-")
-(! [ -e $narCache ])

tests/flakes/flakes.sh

@@ -1,506 +0,0 @@
-source ./common.sh
-
-requireGit
-
-clearStore
-rm -rf $TEST_HOME/.cache $TEST_HOME/.config
-
-flake1Dir=$TEST_ROOT/flake1
-flake2Dir=$TEST_ROOT/flake2
-flake3Dir=$TEST_ROOT/flake3
-flake5Dir=$TEST_ROOT/flake5
-flake7Dir=$TEST_ROOT/flake7
-nonFlakeDir=$TEST_ROOT/nonFlake
-badFlakeDir=$TEST_ROOT/badFlake
-flakeGitBare=$TEST_ROOT/flakeGitBare
-
-for repo in $flake1Dir $flake2Dir $flake3Dir $flake7Dir $nonFlakeDir; do
-    # Give one repo a non-main initial branch.
-    extraArgs=
-    if [[ $repo == $flake2Dir ]]; then
-      extraArgs="--initial-branch=main"
-    fi
-
-    createGitRepo "$repo" "$extraArgs"
-done
-
-createSimpleGitFlake $flake1Dir
-
-cat > $flake2Dir/flake.nix <<EOF
-{
-  description = "Fnord";
-
-  outputs = { self, flake1 }: rec {
-    packages.$system.bar = flake1.packages.$system.foo;
-  };
-}
-EOF
-
-git -C $flake2Dir add flake.nix
-git -C $flake2Dir commit -m 'Initial'
-
-cat > $flake3Dir/flake.nix <<EOF
-{
-  description = "Fnord";
-
-  outputs = { self, flake2 }: rec {
-    packages.$system.xyzzy = flake2.packages.$system.bar;
-
-    checks = {
-      xyzzy = packages.$system.xyzzy;
-    };
-  };
-}
-EOF
-
-cat > $flake3Dir/default.nix <<EOF
-{ x = 123; }
-EOF
-
-git -C $flake3Dir add flake.nix default.nix
-git -C $flake3Dir commit -m 'Initial'
-
-cat > $nonFlakeDir/README.md <<EOF
-FNORD
-EOF
-
-git -C $nonFlakeDir add README.md
-git -C $nonFlakeDir commit -m 'Initial'
-
-# Construct a custom registry, additionally test the --registry flag
-nix registry add --registry $registry flake1 git+file://$flake1Dir
-nix registry add --registry $registry flake2 git+file://$flake2Dir
-nix registry add --registry $registry flake3 git+file://$flake3Dir
-nix registry add --registry $registry flake4 flake3
-nix registry add --registry $registry nixpkgs flake1
-
-# Test 'nix registry list'.
-[[ $(nix registry list | wc -l) == 5 ]]
-nix registry list | grep        '^global'
-nix registry list | grepInverse '^user' # nothing in user registry
-
-# Test 'nix flake metadata'.
-nix flake metadata flake1
-nix flake metadata flake1 | grepQuiet 'Locked URL:.*flake1.*'
-
-# Test 'nix flake metadata' on a local flake.
-(cd $flake1Dir && nix flake metadata) | grepQuiet 'URL:.*flake1.*'
-(cd $flake1Dir && nix flake metadata .) | grepQuiet 'URL:.*flake1.*'
-nix flake metadata $flake1Dir | grepQuiet 'URL:.*flake1.*'
-
-# Test 'nix flake metadata --json'.
-json=$(nix flake metadata flake1 --json | jq .)
-[[ $(echo "$json" | jq -r .description) = 'Bla bla' ]]
-[[ -d $(echo "$json" | jq -r .path) ]]
-[[ $(echo "$json" | jq -r .lastModified) = $(git -C $flake1Dir log -n1 --format=%ct) ]]
-hash1=$(echo "$json" | jq -r .revision)
-
-echo -n '# foo' >> $flake1Dir/flake.nix
-flake1OriginalCommit=$(git -C $flake1Dir rev-parse HEAD)
-git -C $flake1Dir commit -a -m 'Foo'
-flake1NewCommit=$(git -C $flake1Dir rev-parse HEAD)
-hash2=$(nix flake metadata flake1 --json --refresh | jq -r .revision)
-[[ $hash1 != $hash2 ]]
-
-# Test 'nix build' on a flake.
-nix build -o $TEST_ROOT/result flake1#foo
-[[ -e $TEST_ROOT/result/hello ]]
-
-# Test packages.default.
-nix build -o $TEST_ROOT/result flake1
-[[ -e $TEST_ROOT/result/hello ]]
-
-nix build -o $TEST_ROOT/result $flake1Dir
-nix build -o $TEST_ROOT/result git+file://$flake1Dir
-
-# Check that store symlinks inside a flake are not interpreted as flakes.
-nix build -o $flake1Dir/result git+file://$flake1Dir
-nix path-info $flake1Dir/result
-
-# 'getFlake' on an unlocked flakeref should fail in pure mode, but
-# succeed in impure mode.
-(! nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"$flake1Dir\").packages.$system.default")
-nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"$flake1Dir\").packages.$system.default" --impure
-
-# 'getFlake' on a locked flakeref should succeed even in pure mode.
-nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"git+file://$flake1Dir?rev=$hash2\").packages.$system.default"
-
-# Building a flake with an unlocked dependency should fail in pure mode.
-(! nix build -o $TEST_ROOT/result flake2#bar --no-registries)
-(! nix build -o $TEST_ROOT/result flake2#bar --no-use-registries)
-(! nix eval --expr "builtins.getFlake \"$flake2Dir\"")
-
-# But should succeed in impure mode.
-(! nix build -o $TEST_ROOT/result flake2#bar --impure)
-nix build -o $TEST_ROOT/result flake2#bar --impure --no-write-lock-file
-nix eval --expr "builtins.getFlake \"$flake2Dir\"" --impure
-
-# Building a local flake with an unlocked dependency should fail with --no-update-lock-file.
-expect 1 nix build -o $TEST_ROOT/result $flake2Dir#bar --no-update-lock-file 2>&1 | grep 'requires lock file changes'
-
-# But it should succeed without that flag.
-nix build -o $TEST_ROOT/result $flake2Dir#bar --no-write-lock-file
-expect 1 nix build -o $TEST_ROOT/result $flake2Dir#bar --no-update-lock-file 2>&1 | grep 'requires lock file changes'
-nix build -o $TEST_ROOT/result $flake2Dir#bar --commit-lock-file
-[[ -e $flake2Dir/flake.lock ]]
-[[ -z $(git -C $flake2Dir diff main || echo failed) ]]
-
-# Rerunning the build should not change the lockfile.
-nix build -o $TEST_ROOT/result $flake2Dir#bar
-[[ -z $(git -C $flake2Dir diff main || echo failed) ]]
-
-# Building with a lockfile should not require a fetch of the registry.
-nix build -o $TEST_ROOT/result --flake-registry file:///no-registry.json $flake2Dir#bar --refresh
-nix build -o $TEST_ROOT/result --no-registries $flake2Dir#bar --refresh
-nix build -o $TEST_ROOT/result --no-use-registries $flake2Dir#bar --refresh
-
-# Updating the flake should not change the lockfile.
-nix flake lock $flake2Dir
-[[ -z $(git -C $flake2Dir diff main || echo failed) ]]
-
-# Now we should be able to build the flake in pure mode.
-nix build -o $TEST_ROOT/result flake2#bar
-
-# Or without a registry.
-nix build -o $TEST_ROOT/result --no-registries git+file://$flake2Dir#bar --refresh
-nix build -o $TEST_ROOT/result --no-use-registries git+file://$flake2Dir#bar --refresh
-
-# Test whether indirect dependencies work.
-nix build -o $TEST_ROOT/result $flake3Dir#xyzzy
-git -C $flake3Dir add flake.lock
-
-# Add dependency to flake3.
-rm $flake3Dir/flake.nix
-
-cat > $flake3Dir/flake.nix <<EOF
-{
-  description = "Fnord";
-
-  outputs = { self, flake1, flake2 }: rec {
-    packages.$system.xyzzy = flake2.packages.$system.bar;
-    packages.$system."sth sth" = flake1.packages.$system.foo;
-  };
-}
-EOF
-
-git -C $flake3Dir add flake.nix
-git -C $flake3Dir commit -m 'Update flake.nix'
-
-# Check whether `nix build` works with an incomplete lockfile
-nix build -o $TEST_ROOT/result $flake3Dir#"sth sth"
-nix build -o $TEST_ROOT/result $flake3Dir#"sth%20sth"
-
-# Check whether it saved the lockfile
-[[ -n $(git -C $flake3Dir diff master) ]]
-
-git -C $flake3Dir add flake.lock
-
-git -C $flake3Dir commit -m 'Add lockfile'
-
-# Test whether registry caching works.
-nix registry list --flake-registry file://$registry | grepQuiet flake3
-mv $registry $registry.tmp
-nix store gc
-nix registry list --flake-registry file://$registry --refresh | grepQuiet flake3
-mv $registry.tmp $registry
-
-# Test whether flakes are registered as GC roots for offline use.
-# FIXME: use tarballs rather than git.
-rm -rf $TEST_HOME/.cache
-nix store gc # get rid of copies in the store to ensure they get fetched to our git cache
-_NIX_FORCE_HTTP=1 nix build -o $TEST_ROOT/result git+file://$flake2Dir#bar
-mv $flake1Dir $flake1Dir.tmp
-mv $flake2Dir $flake2Dir.tmp
-nix store gc
-_NIX_FORCE_HTTP=1 nix build -o $TEST_ROOT/result git+file://$flake2Dir#bar
-_NIX_FORCE_HTTP=1 nix build -o $TEST_ROOT/result git+file://$flake2Dir#bar --refresh
-mv $flake1Dir.tmp $flake1Dir
-mv $flake2Dir.tmp $flake2Dir
-
-# Add nonFlakeInputs to flake3.
-rm $flake3Dir/flake.nix
-
-cat > $flake3Dir/flake.nix <<EOF
-{
-  inputs = {
-    flake1 = {};
-    flake2 = {};
-    nonFlake = {
-      url = git+file://$nonFlakeDir;
-      flake = false;
-    };
-    nonFlakeFile = {
-      url = path://$nonFlakeDir/README.md;
-      flake = false;
-    };
-    nonFlakeFile2 = {
-      url = "$nonFlakeDir/README.md";
-      flake = false;
-    };
-  };
-
-  description = "Fnord";
-
-  outputs = inputs: rec {
-    packages.$system.xyzzy = inputs.flake2.packages.$system.bar;
-    packages.$system.sth = inputs.flake1.packages.$system.foo;
-    packages.$system.fnord =
-      with import ./config.nix;
-      mkDerivation {
-        inherit system;
-        name = "fnord";
-        dummy = builtins.readFile (builtins.path { name = "source"; path = ./.; filter = path: type: baseNameOf path == "config.nix"; } + "/config.nix");
-        dummy2 = builtins.readFile (builtins.path { name = "source"; path = inputs.flake1; filter = path: type: baseNameOf path == "simple.nix"; } + "/simple.nix");
-        buildCommand = ''
-          cat \${inputs.nonFlake}/README.md > \$out
-          [[ \$(cat \${inputs.nonFlake}/README.md) = \$(cat \${inputs.nonFlakeFile}) ]]
-          [[ \${inputs.nonFlakeFile} = \${inputs.nonFlakeFile2} ]]
-        '';
-      };
-  };
-}
-EOF
-
-cp ../config.nix $flake3Dir
-
-git -C $flake3Dir add flake.nix config.nix
-git -C $flake3Dir commit -m 'Add nonFlakeInputs'
-
-# Check whether `nix build` works with a lockfile which is missing a
-# nonFlakeInputs.
-nix build -o $TEST_ROOT/result $flake3Dir#sth --commit-lock-file
-
-nix build -o $TEST_ROOT/result flake3#fnord
-[[ $(cat $TEST_ROOT/result) = FNORD ]]
-
-# Check whether flake input fetching is lazy: flake3#sth does not
-# depend on flake2, so this shouldn't fail.
-rm -rf $TEST_HOME/.cache
-clearStore
-mv $flake2Dir $flake2Dir.tmp
-mv $nonFlakeDir $nonFlakeDir.tmp
-nix build -o $TEST_ROOT/result flake3#sth
-(! nix build -o $TEST_ROOT/result flake3#xyzzy)
-(! nix build -o $TEST_ROOT/result flake3#fnord)
-mv $flake2Dir.tmp $flake2Dir
-mv $nonFlakeDir.tmp $nonFlakeDir
-nix build -o $TEST_ROOT/result flake3#xyzzy flake3#fnord
-
-# Test doing multiple `lookupFlake`s
-nix build -o $TEST_ROOT/result flake4#xyzzy
-
-# Test 'nix flake update' and --override-flake.
-nix flake lock $flake3Dir
-[[ -z $(git -C $flake3Dir diff master || echo failed) ]]
-
-nix flake update $flake3Dir --override-flake flake2 nixpkgs
-[[ ! -z $(git -C $flake3Dir diff master || echo failed) ]]
-
-# Make branch "removeXyzzy" where flake3 doesn't have xyzzy anymore
-git -C $flake3Dir checkout -b removeXyzzy
-rm $flake3Dir/flake.nix
-
-cat > $flake3Dir/flake.nix <<EOF
-{
-  inputs = {
-    nonFlake = {
-      url = "$nonFlakeDir";
-      flake = false;
-    };
-  };
-
-  description = "Fnord";
-
-  outputs = { self, flake1, flake2, nonFlake }: rec {
-    packages.$system.sth = flake1.packages.$system.foo;
-    packages.$system.fnord =
-      with import ./config.nix;
-      mkDerivation {
-        inherit system;
-        name = "fnord";
-        buildCommand = ''
-          cat \${nonFlake}/README.md > \$out
-        '';
-      };
-  };
-}
-EOF
-nix flake lock $flake3Dir
-git -C $flake3Dir add flake.nix flake.lock
-git -C $flake3Dir commit -m 'Remove packages.xyzzy'
-git -C $flake3Dir checkout master
-
-# Test whether fuzzy-matching works for registry entries.
-(! nix build -o $TEST_ROOT/result flake4/removeXyzzy#xyzzy)
-nix build -o $TEST_ROOT/result flake4/removeXyzzy#sth
-
-# Testing the nix CLI
-nix registry add flake1 flake3
-[[ $(nix registry list | wc -l) == 6 ]]
-nix registry pin flake1
-[[ $(nix registry list | wc -l) == 6 ]]
-nix registry pin flake1 flake3
-[[ $(nix registry list | wc -l) == 6 ]]
-nix registry remove flake1
-[[ $(nix registry list | wc -l) == 5 ]]
-
-# Test 'nix registry list' with a disabled global registry.
-nix registry add user-flake1 git+file://$flake1Dir
-nix registry add user-flake2 git+file://$flake2Dir
-[[ $(nix --flake-registry "" registry list | wc -l) == 2 ]]
-nix --flake-registry "" registry list | grepQuietInverse '^global' # nothing in global registry
-nix --flake-registry "" registry list | grepQuiet '^user'
-nix registry remove user-flake1
-nix registry remove user-flake2
-[[ $(nix registry list | wc -l) == 5 ]]
-
-# Test 'nix flake clone'.
-rm -rf $TEST_ROOT/flake1-v2
-nix flake clone flake1 --dest $TEST_ROOT/flake1-v2
-[ -e $TEST_ROOT/flake1-v2/flake.nix ]
-
-# Test 'follows' inputs.
-cat > $flake3Dir/flake.nix <<EOF
-{
-  inputs.foo = {
-    type = "indirect";
-    id = "flake1";
-  };
-  inputs.bar.follows = "foo";
-
-  outputs = { self, foo, bar }: {
-  };
-}
-EOF
-
-nix flake lock $flake3Dir
-[[ $(jq -c .nodes.root.inputs.bar $flake3Dir/flake.lock) = '["foo"]' ]]
-
-cat > $flake3Dir/flake.nix <<EOF
-{
-  inputs.bar.follows = "flake2/flake1";
-
-  outputs = { self, flake2, bar }: {
-  };
-}
-EOF
-
-nix flake lock $flake3Dir
-[[ $(jq -c .nodes.root.inputs.bar $flake3Dir/flake.lock) = '["flake2","flake1"]' ]]
-
-cat > $flake3Dir/flake.nix <<EOF
-{
-  inputs.bar.follows = "flake2";
-
-  outputs = { self, flake2, bar }: {
-  };
-}
-EOF
-
-nix flake lock $flake3Dir
-[[ $(jq -c .nodes.root.inputs.bar $flake3Dir/flake.lock) = '["flake2"]' ]]
-
-# Test overriding inputs of inputs.
-writeTrivialFlake $flake7Dir
-git -C $flake7Dir add flake.nix
-git -C $flake7Dir commit -m 'Initial'
-
-cat > $flake3Dir/flake.nix <<EOF
-{
-  inputs.flake2.inputs.flake1 = {
-    type = "git";
-    url = file://$flake7Dir;
-  };
-
-  outputs = { self, flake2 }: {
-  };
-}
-EOF
-
-nix flake lock $flake3Dir
-[[ $(jq .nodes.flake1.locked.url $flake3Dir/flake.lock) =~ flake7 ]]
-
-cat > $flake3Dir/flake.nix <<EOF
-{
-  inputs.flake2.inputs.flake1.follows = "foo";
-  inputs.foo.url = git+file://$flake7Dir;
-
-  outputs = { self, flake2 }: {
-  };
-}
-EOF
-
-nix flake update $flake3Dir
-[[ $(jq -c .nodes.flake2.inputs.flake1 $flake3Dir/flake.lock) =~ '["foo"]' ]]
-[[ $(jq .nodes.foo.locked.url $flake3Dir/flake.lock) =~ flake7 ]]
-
-# Test git+file with bare repo.
-rm -rf $flakeGitBare
-git clone --bare $flake1Dir $flakeGitBare
-nix build -o $TEST_ROOT/result git+file://$flakeGitBare
-
-# Test path flakes.
-mkdir -p $flake5Dir
-writeDependentFlake $flake5Dir
-nix flake lock path://$flake5Dir
-
-# Test tarball flakes.
-tar cfz $TEST_ROOT/flake.tar.gz -C $TEST_ROOT flake5
-
-nix build -o $TEST_ROOT/result file://$TEST_ROOT/flake.tar.gz
-
-# Building with a tarball URL containing a SRI hash should also work.
-url=$(nix flake metadata --json file://$TEST_ROOT/flake.tar.gz | jq -r .url)
-[[ $url =~ sha256- ]]
-
-nix build -o $TEST_ROOT/result $url
-
-# Building with an incorrect SRI hash should fail.
-expectStderr 102 nix build -o $TEST_ROOT/result "file://$TEST_ROOT/flake.tar.gz?narHash=sha256-qQ2Zz4DNHViCUrp6gTS7EE4+RMqFQtUfWF2UNUtJKS0=" | grep 'NAR hash mismatch'
-
-# Test --override-input.
-git -C $flake3Dir reset --hard
-nix flake lock $flake3Dir --override-input flake2/flake1 file://$TEST_ROOT/flake.tar.gz -vvvvv
-[[ $(jq .nodes.flake1_2.locked.url $flake3Dir/flake.lock) =~ flake.tar.gz ]]
-
-nix flake lock $flake3Dir --override-input flake2/flake1 flake1
-[[ $(jq -r .nodes.flake1_2.locked.rev $flake3Dir/flake.lock) =~ $hash2 ]]
-
-nix flake lock $flake3Dir --override-input flake2/flake1 flake1/master/$hash1
-[[ $(jq -r .nodes.flake1_2.locked.rev $flake3Dir/flake.lock) =~ $hash1 ]]
-
-# Test --update-input.
-nix flake lock $flake3Dir
-[[ $(jq -r .nodes.flake1_2.locked.rev $flake3Dir/flake.lock) = $hash1 ]]
-
-nix flake lock $flake3Dir --update-input flake2/flake1
-[[ $(jq -r .nodes.flake1_2.locked.rev $flake3Dir/flake.lock) =~ $hash2 ]]
-
-# Test 'nix flake metadata --json'.
-nix flake metadata $flake3Dir --json | jq .
-
-# Test flake in store does not evaluate.
-rm -rf $badFlakeDir
-mkdir $badFlakeDir
-echo INVALID > $badFlakeDir/flake.nix
-nix store delete $(nix store add-path $badFlakeDir)
-
-[[ $(nix path-info      $(nix store add-path $flake1Dir)) =~ flake1 ]]
-[[ $(nix path-info path:$(nix store add-path $flake1Dir)) =~ simple ]]
-
-# Test fetching flakerefs in the legacy CLI.
-[[ $(nix-instantiate --eval flake:flake3 -A x) = 123 ]]
-[[ $(nix-instantiate --eval flake:git+file://$flake3Dir -A x) = 123 ]]
-[[ $(nix-instantiate -I flake3=flake:flake3 --eval '<flake3>' -A x) = 123 ]]
-[[ $(NIX_PATH=flake3=flake:flake3 nix-instantiate --eval '<flake3>' -A x) = 123 ]]
-
-# Test alternate lockfile paths.
-nix flake lock $flake2Dir --output-lock-file $TEST_ROOT/flake2.lock
-cmp $flake2Dir/flake.lock $TEST_ROOT/flake2.lock >/dev/null # lockfiles should be identical, since we're referencing flake2's original one
-
-nix flake lock $flake2Dir --output-lock-file $TEST_ROOT/flake2-overridden.lock --override-input flake1 git+file://$flake1Dir?rev=$flake1OriginalCommit
-expectStderr 1 cmp $flake2Dir/flake.lock $TEST_ROOT/flake2-overridden.lock
-nix flake metadata $flake2Dir --reference-lock-file $TEST_ROOT/flake2-overridden.lock | grepQuiet $flake1OriginalCommit
-
-# reference-lock-file can only be used if allow-dirty is set.
-expectStderr 1 nix flake metadata $flake2Dir --no-allow-dirty --reference-lock-file $TEST_ROOT/flake2-overridden.lock

tests/flakes/follow-paths.sh

@@ -1,150 +0,0 @@
-source ./common.sh
-
-requireGit
-
-flakeFollowsA=$TEST_ROOT/follows/flakeA
-flakeFollowsB=$TEST_ROOT/follows/flakeA/flakeB
-flakeFollowsC=$TEST_ROOT/follows/flakeA/flakeB/flakeC
-flakeFollowsD=$TEST_ROOT/follows/flakeA/flakeD
-flakeFollowsE=$TEST_ROOT/follows/flakeA/flakeE
-
-# Test following path flakerefs.
-createGitRepo $flakeFollowsA
-mkdir -p $flakeFollowsB
-mkdir -p $flakeFollowsC
-mkdir -p $flakeFollowsD
-mkdir -p $flakeFollowsE
-
-cat > $flakeFollowsA/flake.nix <<EOF
-{
-    description = "Flake A";
-    inputs = {
-        B = {
-            url = "path:./flakeB";
-            inputs.foobar.follows = "foobar";
-        };
-
-        foobar.url = "path:$flakeFollowsA/flakeE";
-    };
-    outputs = { ... }: {};
-}
-EOF
-
-cat > $flakeFollowsB/flake.nix <<EOF
-{
-    description = "Flake B";
-    inputs = {
-        foobar.url = "path:$flakeFollowsA/flakeE";
-        goodoo.follows = "C/goodoo";
-        C = {
-            url = "path:./flakeC";
-            inputs.foobar.follows = "foobar";
-        };
-    };
-    outputs = { ... }: {};
-}
-EOF
-
-cat > $flakeFollowsC/flake.nix <<EOF
-{
-    description = "Flake C";
-    inputs = {
-        foobar.url = "path:$flakeFollowsA/flakeE";
-        goodoo.follows = "foobar";
-    };
-    outputs = { ... }: {};
-}
-EOF
-
-cat > $flakeFollowsD/flake.nix <<EOF
-{
-    description = "Flake D";
-    inputs = {};
-    outputs = { ... }: {};
-}
-EOF
-
-cat > $flakeFollowsE/flake.nix <<EOF
-{
-    description = "Flake E";
-    inputs = {};
-    outputs = { ... }: {};
-}
-EOF
-
-git -C $flakeFollowsA add flake.nix flakeB/flake.nix \
-  flakeB/flakeC/flake.nix flakeD/flake.nix flakeE/flake.nix
-
-nix flake metadata $flakeFollowsA
-
-nix flake update $flakeFollowsA
-
-nix flake lock $flakeFollowsA
-
-oldLock="$(cat "$flakeFollowsA/flake.lock")"
-
-# Ensure that locking twice doesn't change anything
-
-nix flake lock $flakeFollowsA
-
-newLock="$(cat "$flakeFollowsA/flake.lock")"
-
-diff <(echo "$newLock") <(echo "$oldLock")
-
-[[ $(jq -c .nodes.B.inputs.C $flakeFollowsA/flake.lock) = '"C"' ]]
-[[ $(jq -c .nodes.B.inputs.foobar $flakeFollowsA/flake.lock) = '["foobar"]' ]]
-[[ $(jq -c .nodes.C.inputs.foobar $flakeFollowsA/flake.lock) = '["B","foobar"]' ]]
-
-# Ensure removing follows from flake.nix removes them from the lockfile
-
-cat > $flakeFollowsA/flake.nix <<EOF
-{
-    description = "Flake A";
-    inputs = {
-        B = {
-            url = "path:./flakeB";
-        };
-        D.url = "path:./flakeD";
-    };
-    outputs = { ... }: {};
-}
-EOF
-
-nix flake lock $flakeFollowsA
-
-[[ $(jq -c .nodes.B.inputs.foobar $flakeFollowsA/flake.lock) = '"foobar"' ]]
-jq -r -c '.nodes | keys | .[]' $flakeFollowsA/flake.lock | grep "^foobar$"
-
-# Ensure a relative path is not allowed to go outside the store path
-cat > $flakeFollowsA/flake.nix <<EOF
-{
-    description = "Flake A";
-    inputs = {
-        B.url = "path:../flakeB";
-    };
-    outputs = { ... }: {};
-}
-EOF
-
-git -C $flakeFollowsA add flake.nix
-
-expect 1 nix flake lock $flakeFollowsA 2>&1 | grep 'points outside'
-
-# Non-existant follows should print a warning.
-cat >$flakeFollowsA/flake.nix <<EOF
-{
-    description = "Flake A";
-    inputs.B = {
-        url = "path:./flakeB";
-        inputs.invalid.follows = "D";
-        inputs.invalid2.url = "path:./flakeD";
-    };
-    inputs.D.url = "path:./flakeD";
-    outputs = { ... }: {};
-}
-EOF
-
-git -C $flakeFollowsA add flake.nix
-
-nix flake lock $flakeFollowsA 2>&1 | grep "warning: input 'B' has an override for a non-existent input 'invalid'"
-nix flake lock $flakeFollowsA 2>&1 | grep "warning: input 'B' has an override for a non-existent input 'invalid2'"

tests/functional/add.sh

@@ -26,3 +26,20 @@ hash2=$(nix-hash --type sha256 --base32 ./dummy)
 echo $hash2
 
 test "$hash1" = "sha256:$hash2"
+
+#### New style commands
+
+clearStore
+
+(
+    path1=$(nix store add ./dummy)
+    path2=$(nix store add --mode nar ./dummy)
+    path3=$(nix store add-path ./dummy)
+    [[ "$path1" == "$path2" ]]
+    [[ "$path1" == "$path3" ]]
+)
+(
+    path1=$(nix store add --mode flat ./dummy)
+    path2=$(nix store add-file ./dummy)
+    [[ "$path1" == "$path2" ]]
+)

tests/functional/bash-profile.sh

@@ -1,6 +1,6 @@
 source common.sh
 
-sed -e "s|@localstatedir@|$TEST_ROOT/profile-var|g" -e "s|@coreutils@|$coreutils|g" < ../scripts/nix-profile.sh.in > $TEST_ROOT/nix-profile.sh
+sed -e "s|@localstatedir@|$TEST_ROOT/profile-var|g" -e "s|@coreutils@|$coreutils|g" < ../../scripts/nix-profile.sh.in > $TEST_ROOT/nix-profile.sh
 
 user=$(whoami)
 rm -rf $TEST_HOME $TEST_ROOT/profile-var

tests/functional/build-hook-ca-fixed.nix

@@ -8,7 +8,10 @@ let
     derivation ({
       inherit system;
       builder = busybox;
-      args = ["sh" "-e" args.builder or (builtins.toFile "builder-${args.name}.sh" "if [ -e .attrs.sh ]; then source .attrs.sh; fi; eval \"$buildCommand\"")];
+      args = ["sh" "-e" args.builder or (builtins.toFile "builder-${args.name}.sh" ''
+        if [ -e "$NIX_ATTRS_SH_FILE" ]; then source $NIX_ATTRS_SH_FILE; fi;
+        eval "$buildCommand"
+      '')];
       outputHashMode = "recursive";
       outputHashAlgo = "sha256";
     } // removeAttrs args ["builder" "meta" "passthru"])

tests/functional/build-hook.nix

@@ -14,7 +14,10 @@ let
     derivation ({
       inherit system;
       builder = busybox;
-      args = ["sh" "-e" args.builder or (builtins.toFile "builder-${args.name}.sh" "if [ -e .attrs.sh ]; then source .attrs.sh; fi; eval \"$buildCommand\"")];
+      args = ["sh" "-e" args.builder or (builtins.toFile "builder-${args.name}.sh" ''
+        if [ -e "$NIX_ATTRS_SH_FILE" ]; then source $NIX_ATTRS_SH_FILE; fi;
+        eval "$buildCommand"
+      '')];
     } // removeAttrs args ["builder" "meta" "passthru"]
     // caArgs)
     // { meta = args.meta or {}; passthru = args.passthru or {}; };

tests/functional/build-remote-trustless-should-fail-0.sh

@@ -4,6 +4,7 @@ enableFeatures "daemon-trust-override"
 
 restartDaemon
 
+requireSandboxSupport
 [[ $busybox =~ busybox ]] || skipTest "no busybox"
 
 unset NIX_STORE_DIR

tests/functional/build-remote-trustless.sh

@@ -6,7 +6,7 @@ unset NIX_STATE_DIR
 
 remoteDir=$TEST_ROOT/remote
 
-# Note: ssh{-ng}://localhost bypasses ssh. See tests/build-remote.sh for
+# Note: ssh{-ng}://localhost bypasses ssh. See tests/functional/build-remote.sh for
 # more details.
 nix-build $file -o $TEST_ROOT/result --max-jobs 0 \
   --arg busybox $busybox \

tests/functional/build-remote-with-mounted-ssh-ng.sh

@@ -0,0 +1,22 @@
+source common.sh
+
+requireSandboxSupport
+[[ $busybox =~ busybox ]] || skipTest "no busybox"
+
+enableFeatures mounted-ssh-store
+
+nix build -Lvf simple.nix \
+  --arg busybox $busybox \
+  --out-link $TEST_ROOT/result-from-remote \
+  --store mounted-ssh-ng://localhost
+
+nix build -Lvf simple.nix \
+  --arg busybox $busybox \
+  --out-link $TEST_ROOT/result-from-remote-new-cli \
+  --store 'mounted-ssh-ng://localhost?remote-program=nix daemon'
+
+# This verifies that the out link was actually created and valid. The ability
+# to create out links (permanent gc roots) is the distinguishing feature of
+# the mounted-ssh-ng store.
+cat $TEST_ROOT/result-from-remote/hello | grepQuiet 'Hello World!'
+cat $TEST_ROOT/result-from-remote-new-cli/hello | grepQuiet 'Hello World!'

tests/functional/build-remote.sh

@@ -1,6 +1,7 @@
 requireSandboxSupport
 [[ $busybox =~ busybox ]] || skipTest "no busybox"
 
+# Avoid store dir being inside sandbox build-dir
 unset NIX_STORE_DIR
 unset NIX_STATE_DIR
 

tests/functional/build.sh

@@ -78,7 +78,7 @@ expectStderr 1 nix build --impure --expr 'with (import ./multiple-outputs.nix).e
   | grepQuiet "has 2 entries in its context. It should only have exactly one entry"
 
 nix build --impure --json --expr 'builtins.unsafeDiscardOutputDependency (import ./multiple-outputs.nix).e.a_a.drvPath' --no-link | jq --exit-status '
-  (.[0] | .path | match(".*multiple-outputs-e.drv"))
+  (.[0] | match(".*multiple-outputs-e.drv"))
 '
 
 # Test building from raw store path to drv not expression.

tests/functional/ca/build-cache.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+source common.sh
+
+# The substituters didn't work prior to this time.
+requireDaemonNewerThan "2.18.0pre20230808"
+
+drv=$(nix-instantiate ./content-addressed.nix -A rootCA --arg seed 1)^out
+nix derivation show "$drv" --arg seed 1
+
+buildAttr () {
+    local derivationPath=$1
+    local seedValue=$2
+    shift; shift
+    local args=("./content-addressed.nix" "-A" "$derivationPath" --arg seed "$seedValue" "--no-out-link")
+    args+=("$@")
+    nix-build "${args[@]}"
+}
+
+copyAttr () {
+    local derivationPath=$1
+    local seedValue=$2
+    shift; shift
+    local args=("-f" "./content-addressed.nix" "$derivationPath" --arg seed "$seedValue")
+    args+=("$@")
+    # Note: to copy CA derivations, we need to copy the realisations, which
+    # currently requires naming the installables, not just the derivation output
+    # path.
+    nix copy --to file://$cacheDir "${args[@]}"
+}
+
+testRemoteCacheFor () {
+    local derivationPath=$1
+    clearCache
+    copyAttr "$derivationPath" 1
+    clearStore
+    # Check nothing gets built.
+    buildAttr "$derivationPath" 1 --option substituters file://$cacheDir --no-require-sigs |& grepQuietInverse " will be built:"
+}
+
+testRemoteCache () {
+    testRemoteCacheFor rootCA
+    testRemoteCacheFor dependentCA
+    testRemoteCacheFor dependentNonCA
+    testRemoteCacheFor dependentFixedOutput
+    testRemoteCacheFor dependentForBuildCA
+    testRemoteCacheFor dependentForBuildNonCA
+}
+
+clearStore
+testRemoteCache

tests/functional/ca/build.sh

@@ -2,7 +2,7 @@
 
 source common.sh
 
-drv=$(nix-instantiate ./content-addressed.nix -A rootCA --arg seed 1)
+drv=$(nix-instantiate ./content-addressed.nix -A rootCA --arg seed 1)^out
 nix derivation show "$drv" --arg seed 1
 
 buildAttr () {
@@ -14,14 +14,6 @@ buildAttr () {
     nix-build "${args[@]}"
 }
 
-testRemoteCache () {
-    clearCache
-    local outPath=$(buildAttr dependentNonCA 1)
-    nix copy --to file://$cacheDir $outPath
-    clearStore
-    buildAttr dependentNonCA 1 --option substituters file://$cacheDir --no-require-sigs |& grepQuietInverse "building dependent-non-ca"
-}
-
 testDeterministicCA () {
     [[ $(buildAttr rootCA 1) = $(buildAttr rootCA 2) ]]
 }
@@ -66,8 +58,6 @@ testNormalization () {
     test "$(stat -c %Y $outPath)" -eq 1
 }
 
-# Disabled until we have it properly working
-# testRemoteCache
 clearStore
 testNormalization
 testDeterministicCA

tests/functional/ca/content-addressed.nix

@@ -61,6 +61,24 @@ rec {
       echo ${rootCA}/non-ca-hello > $out/dep
     '';
   };
+  dependentForBuildCA = mkCADerivation {
+    name = "dependent-for-build-ca";
+    buildCommand = ''
+      echo "Depends on rootCA for building only"
+      mkdir -p $out
+      echo ${rootCA}
+      touch $out
+    '';
+  };
+  dependentForBuildNonCA = mkDerivation {
+    name = "dependent-for-build-non-ca";
+    buildCommand = ''
+      echo "Depends on rootCA for building only"
+      mkdir -p $out
+      echo ${rootCA}
+      touch $out
+    '';
+  };
   dependentFixedOutput = mkDerivation {
     name = "dependent-fixed-output";
     outputHashMode = "recursive";

tests/functional/ca/eval-store.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+# Ensure that garbage collection works properly with ca derivations
+
+source common.sh
+
+export NIX_TESTS_CA_BY_DEFAULT=1
+
+cd ..
+source eval-store.sh

tests/functional/ca/local.mk

@@ -0,0 +1,29 @@
+ca-tests := \
+  $(d)/build-with-garbage-path.sh \
+  $(d)/build.sh \
+  $(d)/build-cache.sh \
+  $(d)/concurrent-builds.sh \
+  $(d)/derivation-json.sh \
+  $(d)/duplicate-realisation-in-closure.sh \
+  $(d)/eval-store.sh \
+  $(d)/gc.sh \
+  $(d)/import-derivation.sh \
+  $(d)/new-build-cmd.sh \
+  $(d)/nix-copy.sh \
+  $(d)/nix-run.sh \
+  $(d)/nix-shell.sh \
+  $(d)/post-hook.sh \
+  $(d)/recursive.sh \
+  $(d)/repl.sh \
+  $(d)/selfref-gc.sh \
+  $(d)/signatures.sh \
+  $(d)/substitute.sh \
+  $(d)/why-depends.sh
+
+install-tests-groups += ca
+
+clean-files += \
+  $(d)/config.nix
+
+test-deps += \
+  tests/functional/ca/config.nix

tests/functional/check-refs.nix

@@ -2,7 +2,7 @@ with import ./config.nix;
 
 rec {
 
-  dep = import ./dependencies.nix;
+  dep = import ./dependencies.nix {};
 
   makeTest = nr: args: mkDerivation ({
     name = "check-refs-" + toString nr;

tests/functional/check-refs.sh

@@ -42,8 +42,10 @@ nix-build -o $RESULT check-refs.nix -A test7
 nix-build -o $RESULT check-refs.nix -A test10
 
 if isDaemonNewer 2.12pre20230103; then
-    enableFeatures discard-references
-    restartDaemon
+    if ! isDaemonNewer 2.16.0; then
+        enableFeatures discard-references
+        restartDaemon
+    fi
 
     # test11 should succeed.
     test11=$(nix-build -o $RESULT check-refs.nix -A test11)

tests/functional/check.sh

@@ -18,6 +18,9 @@ clearStore
 nix-build dependencies.nix --no-out-link
 nix-build dependencies.nix --no-out-link --check
 
+# Build failure exit codes (100, 104, etc.) are from
+# doc/manual/src/command-ref/status-build-failure.md
+
 # check for dangling temporary build directories
 # only retain if build fails and --keep-failed is specified, or...
 # ...build is non-deterministic and --check and --keep-failed are both specified

tests/functional/common.sh

@@ -4,7 +4,7 @@ if [[ -z "${COMMON_SH_SOURCED-}" ]]; then
 
 COMMON_SH_SOURCED=1
 
-source "$(readlink -f "$(dirname "${BASH_SOURCE[0]}")")/common/vars-and-functions.sh"
+source "$(readlink -f "$(dirname "${BASH_SOURCE[0]-$0}")")/common/vars-and-functions.sh"
 if [[ -n "${NIX_DAEMON_PACKAGE:-}" ]]; then
     startDaemon
 fi

tests/functional/common/vars-and-functions.sh.in

@@ -4,9 +4,9 @@ if [[ -z "${COMMON_VARS_AND_FUNCTIONS_SH_SOURCED-}" ]]; then
 
 COMMON_VARS_AND_FUNCTIONS_SH_SOURCED=1
 
-export PS4='+(${BASH_SOURCE[0]}:$LINENO) '
+set +x
 
-export TEST_ROOT=$(realpath ${TMPDIR:-/tmp}/nix-test)/${TEST_NAME:-default}
+export TEST_ROOT=$(realpath ${TMPDIR:-/tmp}/nix-test)/${TEST_NAME:-default/tests\/functional//}
 export NIX_STORE_DIR
 if ! NIX_STORE_DIR=$(readlink -f $TEST_ROOT/store 2> /dev/null); then
     # Maybe the build directory is symlinked.
@@ -195,7 +195,7 @@ expect() {
     shift
     "$@" && res=0 || res="$?"
     if [[ $res -ne $expected ]]; then
-        echo "Expected '$expected' but got '$res' while running '${*@Q}'" >&2
+        echo "Expected exit code '$expected' but got '$res' from command ${*@Q}" >&2
         return 1
     fi
     return 0
@@ -209,7 +209,7 @@ expectStderr() {
     shift
     "$@" 2>&1 && res=0 || res="$?"
     if [[ $res -ne $expected ]]; then
-        echo "Expected '$expected' but got '$res' while running '${*@Q}'" >&2
+        echo "Expected exit code '$expected' but got '$res' from command ${*@Q}" >&2
         return 1
     fi
     return 0

tests/functional/completions.sh

@@ -44,13 +44,18 @@ EOF
 # Input override completion
 [[ "$(NIX_GET_COMPLETIONS=4 nix build ./foo --override-input '')" == $'normal\na\t' ]]
 [[ "$(NIX_GET_COMPLETIONS=5 nix flake show ./foo --override-input '')" == $'normal\na\t' ]]
+cd ./foo
+[[ "$(NIX_GET_COMPLETIONS=3 nix flake update '')" == $'normal\na\t' ]]
+cd ..
+[[ "$(NIX_GET_COMPLETIONS=5 nix flake update --flake './foo' '')" == $'normal\na\t' ]]
 ## With multiple input flakes
 [[ "$(NIX_GET_COMPLETIONS=5 nix build ./foo ./bar --override-input '')" == $'normal\na\t\nb\t' ]]
 ## With tilde expansion
 [[ "$(HOME=$PWD NIX_GET_COMPLETIONS=4 nix build '~/foo' --override-input '')" == $'normal\na\t' ]]
+[[ "$(HOME=$PWD NIX_GET_COMPLETIONS=5 nix flake update --flake '~/foo' '')" == $'normal\na\t' ]]
 ## Out of order
-[[ "$(NIX_GET_COMPLETIONS=3 nix build --update-input '' ./foo)" == $'normal\na\t' ]]
-[[ "$(NIX_GET_COMPLETIONS=4 nix build ./foo --update-input '' ./bar)" == $'normal\na\t\nb\t' ]]
+[[ "$(NIX_GET_COMPLETIONS=3 nix build --override-input '' '' ./foo)" == $'normal\na\t' ]]
+[[ "$(NIX_GET_COMPLETIONS=4 nix build ./foo --override-input '' '' ./bar)" == $'normal\na\t\nb\t' ]]
 
 # Cli flag completion
 NIX_GET_COMPLETIONS=2 nix build --log-form | grep -- "--log-format"

tests/functional/config.nix.in

@@ -20,7 +20,10 @@ rec {
     derivation ({
       inherit system;
       builder = shell;
-      args = ["-e" args.builder or (builtins.toFile "builder-${args.name}.sh" "if [ -e .attrs.sh ]; then source .attrs.sh; fi; eval \"$buildCommand\"")];
+      args = ["-e" args.builder or (builtins.toFile "builder-${args.name}.sh" ''
+        if [ -e "$NIX_ATTRS_SH_FILE" ]; then source $NIX_ATTRS_SH_FILE; fi;
+        eval "$buildCommand"
+      '')];
       PATH = path;
     } // caArgs // removeAttrs args ["builder" "meta"])
     // { meta = args.meta or {}; };

tests/functional/config.sh

@@ -40,19 +40,20 @@ files=$(nix-build --verbose --version | grep "User config" | cut -d ':' -f2- | x
 # Test that it's possible to load the config from a custom location
 here=$(readlink -f "$(dirname "${BASH_SOURCE[0]}")")
 export NIX_USER_CONF_FILES=$here/config/nix-with-substituters.conf
-var=$(nix show-config | grep '^substituters =' | cut -d '=' -f 2 | xargs)
+var=$(nix config show | grep '^substituters =' | cut -d '=' -f 2 | xargs)
 [[ $var == https://example.com ]]
 
 # Test that it's possible to load config from the environment
-prev=$(nix show-config | grep '^cores' | cut -d '=' -f 2 | xargs)
+prev=$(nix config show | grep '^cores' | cut -d '=' -f 2 | xargs)
 export NIX_CONFIG="cores = 4242"$'\n'"experimental-features = nix-command flakes"
-exp_cores=$(nix show-config | grep '^cores' | cut -d '=' -f 2 | xargs)
-exp_features=$(nix show-config | grep '^experimental-features' | cut -d '=' -f 2 | xargs)
+exp_cores=$(nix config show | grep '^cores' | cut -d '=' -f 2 | xargs)
+exp_features=$(nix config show | grep '^experimental-features' | cut -d '=' -f 2 | xargs)
 [[ $prev != $exp_cores ]]
 [[ $exp_cores == "4242" ]]
-[[ $exp_features == "flakes nix-command" ]]
+# flakes implies fetch-tree
+[[ $exp_features == "fetch-tree flakes nix-command" ]]
 
 # Test that it's possible to retrieve a single setting's value
-val=$(nix show-config | grep '^warn-dirty' | cut -d '=' -f  2 | xargs)
-val2=$(nix show-config warn-dirty)
+val=$(nix config show | grep '^warn-dirty' | cut -d '=' -f  2 | xargs)
+val2=$(nix config show warn-dirty)
 [[ $val == $val2 ]]

tests/functional/dependencies.nix

@@ -1,3 +1,4 @@
+{ hashInvalidator ? "" }:
 with import ./config.nix;
 
 let {
@@ -21,6 +22,17 @@ let {
     '';
   };
 
+  fod_input = mkDerivation {
+    name = "fod-input";
+    buildCommand = ''
+      echo ${hashInvalidator}
+      echo FOD > $out
+    '';
+    outputHashMode = "flat";
+    outputHashAlgo = "sha256";
+    outputHash = "1dq9p0hnm1y75q2x40fws5887bq1r840hzdxak0a9djbwvx0b16d";
+  };
+
   body = mkDerivation {
     name = "dependencies-top";
     builder = ./dependencies.builder0.sh + "/FOOBAR/../.";
@@ -29,6 +41,7 @@ let {
     input1_drv = input1;
     input2_drv = input2;
     input0_drv = input0;
+    fod_input_drv = fod_input;
     meta.description = "Random test package";
   };
 

tests/functional/dependencies.sh

@@ -15,6 +15,9 @@ if test -n "$dot"; then
     $dot < $TEST_ROOT/graph
 fi
 
+# Test GraphML graph generation
+nix-store -q --graphml "$drvPath" > $TEST_ROOT/graphml
+
 outPath=$(nix-store -rvv "$drvPath") || fail "build failed"
 
 # Test Graphviz graph generation.
@@ -50,3 +53,20 @@ nix-store -q --referrers-closure "$input2OutPath" | grep "$outPath"
 # Check that the derivers are set properly.
 test $(nix-store -q --deriver "$outPath") = "$drvPath"
 nix-store -q --deriver "$input2OutPath" | grepQuiet -- "-input-2.drv"
+
+# --valid-derivers returns the currently single valid .drv file
+test "$(nix-store -q --valid-derivers "$outPath")" = "$drvPath"
+
+# instantiate a different drv with the same output
+drvPath2=$(nix-instantiate dependencies.nix --argstr hashInvalidator yay)
+
+# now --valid-derivers returns both
+test "$(nix-store -q --valid-derivers "$outPath" | sort)" = "$(sort <<< "$drvPath"$'\n'"$drvPath2")"
+
+# check that nix-store --valid-derivers only returns existing drv
+nix-store --delete "$drvPath"
+test "$(nix-store -q --valid-derivers "$outPath")" = "$drvPath2"
+
+# check that --valid-derivers returns nothing when there are no valid derivers
+nix-store --delete "$drvPath2"
+test -z "$(nix-store -q --valid-derivers "$outPath")"

tests/functional/dyn-drv/build-built-drv.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+source common.sh
+
+# In the corresponding nix file, we have two derivations: the first, named `hello`,
+# is a normal recursive derivation, while the second, named dependent, has the
+# new outputHashMode "text". Note that in "dependent", we don't refer to the
+# build output of `hello`, but only to the path of the drv file. For this reason,
+# we only need to:
+#
+# - instantiate `hello`
+# - build `producingDrv`
+# - check that the path of the output coincides with that of the original derivation
+
+out1=$(nix build -f ./text-hashed-output.nix hello --no-link)
+
+clearStore
+
+drvDep=$(nix-instantiate ./text-hashed-output.nix -A producingDrv)
+
+expectStderr 1 nix build "${drvDep}^out^out" --no-link | grepQuiet "Building dynamic derivations in one shot is not yet implemented"

tests/functional/dyn-drv/dep-built-drv.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+source common.sh
+
+out1=$(nix-build ./text-hashed-output.nix -A hello --no-out-link)
+
+clearStore
+
+expectStderr 1 nix-build ./text-hashed-output.nix -A wrapper --no-out-link | grepQuiet "Building dynamic derivations in one shot is not yet implemented"
+
+# diff -r $out1 $out2

tests/functional/dyn-drv/eval-outputOf.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+
+source ./common.sh
+
+# Without the dynamic-derivations XP feature, we don't have the builtin.
+nix --experimental-features 'nix-command' eval --impure  --expr \
+    'assert ! (builtins ? outputOf); ""'
+
+# Test that a string is required.
+#
+# We currently require a string to be passed, rather than a derivation
+# object that could be coerced to a string. We might liberalise this in
+# the future so it does work, but there are some design questions to
+# resolve first. Adding a test so we don't liberalise it by accident.
+expectStderr 1 nix --experimental-features 'nix-command dynamic-derivations' eval --impure --expr \
+    'builtins.outputOf (import ../dependencies.nix {}) "out"' \
+    | grepQuiet "value is a set while a string was expected"
+
+# Test that "DrvDeep" string contexts are not supported at this time
+#
+# Like the above, this is a restriction we could relax later.
+expectStderr 1 nix --experimental-features 'nix-command dynamic-derivations' eval --impure --expr \
+    'builtins.outputOf (import ../dependencies.nix {}).drvPath "out"' \
+    | grepQuiet "has a context which refers to a complete source and binary closure. This is not supported at this time"
+
+# Test using `builtins.outputOf` with static derivations
+testStaticHello () {
+    nix eval --impure --expr \
+        'with (import ./text-hashed-output.nix); let
+           a = hello.outPath;
+           b = builtins.outputOf (builtins.unsafeDiscardOutputDependency hello.drvPath) "out";
+         in builtins.trace a
+           (builtins.trace b
+             (assert a == b; null))'
+}
+
+# Test with a regular old input-addresed derivation
+#
+# `builtins.outputOf` works without ca-derivations and doesn't create a
+# placeholder but just returns the output path.
+testStaticHello
+
+# Test with content addressed derivation.
+NIX_TESTS_CA_BY_DEFAULT=1 testStaticHello
+
+# Test with derivation-producing derivation
+#
+# This is hardly different from the preceding cases, except that we're
+# only taking 1 outputOf out of 2 possible outputOfs. Note that
+# `.outPath` could be defined as `outputOf drvPath`, which is what we're
+# testing here. The other `outputOf` that we're not testing here is the
+# use of _dynamic_ derivations.
+nix eval --impure --expr \
+    'with (import ./text-hashed-output.nix); let
+       a = producingDrv.outPath;
+       b = builtins.outputOf (builtins.builtins.unsafeDiscardOutputDependency producingDrv.drvPath) "out";
+     in builtins.trace a
+       (builtins.trace b
+         (assert a == b; null))'
+
+# Test with unbuilt output of derivation-producing derivation.
+#
+# This function similar to `testStaticHello` used above, but instead of
+# checking the property on a constant derivation, we check it on a
+# derivation that's from another derivation's output (outPath).
+testDynamicHello () {
+    nix eval --impure --expr \
+        'with (import ./text-hashed-output.nix); let
+           a = builtins.outputOf producingDrv.outPath "out";
+           b = builtins.outputOf (builtins.outputOf (builtins.unsafeDiscardOutputDependency producingDrv.drvPath) "out") "out";
+         in builtins.trace a
+           (builtins.trace b
+             (assert a == b; null))'
+}
+
+# inner dynamic derivation is input-addressed
+testDynamicHello
+
+# inner dynamic derivation is content-addressed
+NIX_TESTS_CA_BY_DEFAULT=1 testDynamicHello

tests/functional/dyn-drv/local.mk

@@ -0,0 +1,15 @@
+dyn-drv-tests := \
+  $(d)/text-hashed-output.sh \
+  $(d)/recursive-mod-json.sh \
+  $(d)/build-built-drv.sh \
+  $(d)/eval-outputOf.sh \
+  $(d)/dep-built-drv.sh \
+  $(d)/old-daemon-error-hack.sh
+
+install-tests-groups += dyn-drv
+
+clean-files += \
+  $(d)/config.nix
+
+test-deps += \
+  tests/functional/dyn-drv/config.nix

tests/functional/dyn-drv/old-daemon-error-hack.nix

@@ -0,0 +1,20 @@
+with import ./config.nix;
+
+# A simple content-addressed derivation.
+# The derivation can be arbitrarily modified by passing a different `seed`,
+# but the output will always be the same
+rec {
+  stub = mkDerivation {
+    name = "stub";
+    buildCommand = ''
+      echo stub > $out
+    '';
+  };
+  wrapper = mkDerivation {
+    name = "has-dynamic-drv-dep";
+    buildCommand = ''
+      exit 1 # we're not building this derivation
+      ${builtins.outputOf stub.outPath "out"}
+    '';
+  };
+}

tests/functional/dyn-drv/old-daemon-error-hack.sh

@@ -0,0 +1,11 @@
+# Purposely bypassing our usual common for this subgroup
+source ../common.sh
+
+# Need backend to support text-hashing too
+isDaemonNewer "2.18.0pre20230906" && skipTest "Daemon is too new"
+
+enableFeatures "ca-derivations dynamic-derivations"
+
+restartDaemon
+
+expectStderr 1 nix-instantiate --read-write-mode ./old-daemon-error-hack.nix | grepQuiet "the daemon is too old to understand dependencies on dynamic derivations"

tests/functional/dyn-drv/recursive-mod-json.sh

@@ -3,6 +3,8 @@ source common.sh
 # FIXME
 if [[ $(uname) != Linux ]]; then skipTest "Not running Linux"; fi
 
+export NIX_TESTS_CA_BY_DEFAULT=1
+
 enableFeatures 'recursive-nix'
 restartDaemon
 

tests/functional/dyn-drv/text-hashed-output.nix

@@ -12,9 +12,6 @@ rec {
       mkdir -p $out
       echo "Hello World" > $out/hello
     '';
-    __contentAddressed = true;
-    outputHashMode = "recursive";
-    outputHashAlgo = "sha256";
   };
   producingDrv = mkDerivation {
     name = "hello.drv";
@@ -26,4 +23,11 @@ rec {
     outputHashMode = "text";
     outputHashAlgo = "sha256";
   };
+  wrapper = mkDerivation {
+    name = "use-dynamic-drv-in-non-dynamic-drv";
+    buildCommand = ''
+      echo "Copying the output of the dynamic derivation"
+      cp -r ${builtins.outputOf producingDrv.outPath "out"} $out
+    '';
+  };
 }

tests/functional/eval-store.sh

@@ -0,0 +1,50 @@
+source common.sh
+
+# Using `--eval-store` with the daemon will eventually copy everything
+# to the build store, invalidating most of the tests here
+needLocalStore "“--eval-store” doesn't achieve much with the daemon"
+
+eval_store=$TEST_ROOT/eval-store
+
+clearStore
+rm -rf "$eval_store"
+
+nix build -f dependencies.nix --eval-store "$eval_store" -o "$TEST_ROOT/result"
+[[ -e $TEST_ROOT/result/foobar ]]
+if [[ ! -n "${NIX_TESTS_CA_BY_DEFAULT:-}" ]]; then
+    # Resolved CA derivations are written to store for building
+    #
+    # TODO when we something more systematic
+    # (https://github.com/NixOS/nix/issues/5025) that distinguishes
+    # between scratch storage for building and the final destination
+    # store, we'll be able to make this unconditional again -- resolved
+    # derivations should only appear in the scratch store.
+    (! ls $NIX_STORE_DIR/*.drv)
+fi
+ls $eval_store/nix/store/*.drv
+
+clearStore
+rm -rf "$eval_store"
+
+nix-instantiate dependencies.nix --eval-store "$eval_store"
+(! ls $NIX_STORE_DIR/*.drv)
+ls $eval_store/nix/store/*.drv
+
+clearStore
+rm -rf "$eval_store"
+
+nix-build dependencies.nix --eval-store "$eval_store" -o "$TEST_ROOT/result"
+[[ -e $TEST_ROOT/result/foobar ]]
+if [[ ! -n "${NIX_TESTS_CA_BY_DEFAULT:-}" ]]; then
+    # See above
+    (! ls $NIX_STORE_DIR/*.drv)
+fi
+ls $eval_store/nix/store/*.drv
+
+clearStore
+rm -rf "$eval_store"
+
+# Confirm that import-from-derivation builds on the build store
+[[ $(nix eval --eval-store "$eval_store?require-sigs=false" --impure --raw --file ./ifd.nix) = hi ]]
+ls $NIX_STORE_DIR/*dependencies-top/foobar
+(! ls $eval_store/nix/store/*dependencies-top/foobar)

tests/functional/experimental-features.sh

@@ -31,7 +31,7 @@ source common.sh
 NIX_CONFIG='
   experimental-features = nix-command
   accept-flake-config = true
-' nix show-config accept-flake-config 1>$TEST_ROOT/stdout 2>$TEST_ROOT/stderr
+' nix config show accept-flake-config 1>$TEST_ROOT/stdout 2>$TEST_ROOT/stderr
 grepQuiet "false" $TEST_ROOT/stdout
 grepQuiet "Ignoring setting 'accept-flake-config' because experimental feature 'flakes' is not enabled" $TEST_ROOT/stderr
 
@@ -39,7 +39,7 @@ grepQuiet "Ignoring setting 'accept-flake-config' because experimental feature '
 NIX_CONFIG='
   accept-flake-config = true
   experimental-features = nix-command
-' nix show-config accept-flake-config 1>$TEST_ROOT/stdout 2>$TEST_ROOT/stderr
+' nix config show accept-flake-config 1>$TEST_ROOT/stdout 2>$TEST_ROOT/stderr
 grepQuiet "false" $TEST_ROOT/stdout
 grepQuiet "Ignoring setting 'accept-flake-config' because experimental feature 'flakes' is not enabled" $TEST_ROOT/stderr
 
@@ -47,7 +47,7 @@ grepQuiet "Ignoring setting 'accept-flake-config' because experimental feature '
 NIX_CONFIG='
   experimental-features = nix-command flakes
   accept-flake-config = true
-' nix show-config accept-flake-config 1>$TEST_ROOT/stdout 2>$TEST_ROOT/stderr
+' nix config show accept-flake-config 1>$TEST_ROOT/stdout 2>$TEST_ROOT/stderr
 grepQuiet "true" $TEST_ROOT/stdout
 grepQuietInverse "Ignoring setting 'accept-flake-config'" $TEST_ROOT/stderr
 
@@ -55,7 +55,7 @@ grepQuietInverse "Ignoring setting 'accept-flake-config'" $TEST_ROOT/stderr
 NIX_CONFIG='
   accept-flake-config = true
   experimental-features = nix-command flakes
-' nix show-config accept-flake-config 1>$TEST_ROOT/stdout 2>$TEST_ROOT/stderr
+' nix config show accept-flake-config 1>$TEST_ROOT/stdout 2>$TEST_ROOT/stderr
 grepQuiet "true" $TEST_ROOT/stdout
 grepQuietInverse "Ignoring setting 'accept-flake-config'" $TEST_ROOT/stderr
 

tests/functional/export-graph.nix

@@ -17,13 +17,13 @@ rec {
   foo."bar.runtimeGraph" = mkDerivation {
     name = "dependencies";
     builder = builtins.toFile "build-graph-builder" "${printRefs}";
-    exportReferencesGraph = ["refs" (import ./dependencies.nix)];
+    exportReferencesGraph = ["refs" (import ./dependencies.nix {})];
   };
 
   foo."bar.buildGraph" = mkDerivation {
     name = "dependencies";
     builder = builtins.toFile "build-graph-builder" "${printRefs}";
-    exportReferencesGraph = ["refs" (import ./dependencies.nix).drvPath];
+    exportReferencesGraph = ["refs" (import ./dependencies.nix {}).drvPath];
   };
 
 }