From 75f2fddb65c0d0b7659282a1e210bd2ddb3abefa Mon Sep 17 00:00:00 2001 From: tv Date: Fri, 13 Nov 2026 21:10:04 +0000 Subject: populate: stop if a flake's URL can't be found The URLs of flakes went into nix flake lock's and nix flake metadata's arguments as command substitutions, whose failure doesn't stop a script under set -e. After "error: source p is not a directory", nix flake lock ran with an empty URL, which Nix takes for the current directory: on a remote target, the login directory, which ended up in the world-readable store, .ssh included. URLs get assigned first now, so failing to find one stops populate. A phase's unexpected lists what populate is expected not to print, whether it succeeds or not; notdir expects populate not to go on locking. --- tests/scenarios.nix | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'tests/scenarios.nix') diff --git a/tests/scenarios.nix b/tests/scenarios.nix index 43b63b4..e01c5a9 100644 --- a/tests/scenarios.nix +++ b/tests/scenarios.nix @@ -109,10 +109,12 @@ let # evaluation fail. env sets environment variables for populate, as # arguments of env. interrupt ends populate after that many seconds, # which it's expected not to finish before. output lists what a - # succeeding populate is expected to print. + # succeeding populate is expected to print, and unexpected what populate + # is expected not to print, succeeding or not. phase = { sources, backup ? false, prune ? false, deploy ? null, targetPath ? path, env ? "", interrupt ? null, output ? [], + unexpected ? [], expect ? "success", control ? null, controlTargetPath ? null, check ? "", mutate ? null, checkDeployer ? null, mutateDeployer ? null, }: let @@ -147,7 +149,7 @@ let null else { populate = toString (command sources targetPath); - inherit env interrupt output; + inherit env interrupt output unexpected; expect = if expect == "success" then null else expect.fail; # No phase gets around checking the canaries. check = script (check + "\ncanary_check\n"); @@ -1258,6 +1260,9 @@ assert !(krops.isLocalTarget (targets.remote "/")); p.pipe = "/fixtures/pipe"; }; expect.fail = "error: source p is not a directory"; + # Locking the flake with an empty URL would lock the current + # directory, the login directory on a remote target. + unexpected = [ "while fetching the input" ]; }]; }) (s "noinput-nested" { -- cgit v1.3.1