From 7bea56b4253a3232a44249b3dd7d2a82795ef7fc Mon Sep 17 00:00:00 2001 From: matthewcroughan Date: Sat, 13 Nov 2021 04:47:23 +0000 Subject: [PATCH] stdenv/check-meta: add note for Flake usage Flake users that use a command like `nix build nixpkgs#hello` on a broken/insecure package will not be able to use an environment variable to override that behavior, unless they pass `--impure` to the command. Co-authored-by: pkharvey --- pkgs/stdenv/generic/check-meta.nix | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix index 7a70accb723f..44caa6838e8d 100644 --- a/pkgs/stdenv/generic/check-meta.nix +++ b/pkgs/stdenv/generic/check-meta.nix @@ -119,13 +119,20 @@ let } ''; + # flakeNote will be printed in the remediation messages below. + flakeNote = " + Note: For `nix shell`, `nix build`, `nix develop` or any other Nix 2.4+ + (Flake) command, `--impure` must be passed in order to read this + environment variable. + "; + remediate_allowlist = allow_attr: rebuild_amendment: attrs: '' a) To temporarily allow ${remediation_phrase allow_attr}, you can use an environment variable for a single invocation of the nix tools. $ export ${remediation_env_var allow_attr}=1 - + ${flakeNote} b) For `nixos-rebuild` you can set { nixpkgs.config.allow${allow_attr} = true; } in configuration.nix to override this. @@ -148,7 +155,7 @@ let variable for a single invocation of the nix tools: $ export NIXPKGS_ALLOW_INSECURE=1 - + ${flakeNote} b) for `nixos-rebuild` you can add ‘${getName attrs}’ to `nixpkgs.config.permittedInsecurePackages` in the configuration.nix, like so: