Derivation: src with symbolic link behaves strange

[ck3d]

I defined a derivation where src is a path to a symbolic link which itself points to a directory.
I tried to use a symbolic link to keep the Nix expression untouched, while I am able to change src path with normal command line tools.

By using this mechanism you get following behavior:

• the build is performed in src path. Patches are applied in your source folder and the intermediate build output is stored also there.
• once a build was successful, no re-build can be triggered, although the content of that src path changed. Nix do use the path as drv input.
• in multi-user Nix store mode, the build is performed by nix-daemon, which needs full access to that path to perform building the derivation

Resolving the symbolic link with Nix functions is not possible (as far I understand).

[ck3d]

Some related issues are #145 and #897 .

[ck3d]

The following minimal derivation realization shows on a multi-user nix store that the symbolic link is copied and not the directory it self:

$ ln -s $(mktemp -d) symlink
$ nix-store -r $(nix-instantiate -E 'derivation {name="test-symlink"; src=./symlink; builder="/bin/sh"; args = ["-xec" "cd $src"]; system=builtins.currentSystem; }')
warning: you did not specify ‘--add-root’; the result might be removed by the garbage collector
these derivations will be built:
  /nix/store/q5jh7c3wzcsa07cld77dnj52xbcssi78-test-symlink.drv
building path(s) ‘/nix/store/qilsbhimnj83wyvxgwys7j5lz0i7r0p9-test-symlink’
+ cd /nix/store/98ndpdd41ccp3373bc3sxs74hm9d8hzb-symlink
sh: line 0: cd: /nix/store/98ndpdd41ccp3373bc3sxs74hm9d8hzb-symlink: Permission denied
builder for ‘/nix/store/q5jh7c3wzcsa07cld77dnj52xbcssi78-test-symlink.drv’ failed with exit code 1
error: build of ‘/nix/store/q5jh7c3wzcsa07cld77dnj52xbcssi78-test-symlink.drv’ failed

The cd command can not be performed, because /nix/store/98ndpdd41ccp3373bc3sxs74hm9d8hzb-symlink is a symbolic link to the created temp directory which is exclusively owned by the calling user.

[TomSmeets]

This issue is annoys me a lot.
The target directory of symbolic links should be copied directly to the store.

[lheckemann]

I'm pretty sure allowing symlinks pointing out of the store is intended — it allow referring to paths outside the store for programs that rely on being able to modify parts of their working directories, like gitlab does. Admittedly this is far from being a beautiful solution…

[zimbatm]

I am using this trick in a few private packages as well. Rails and Java apps.

At build time, it's too late to resolve symlinks. The build sandbox is not supposed to be able to go outside.

[ck3d]

This issue is still valid for nix version 2.2.2 .

[nixos-discourse]

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/how-to-stop-nix-from-unpacking-a-directory/6866/4

[stale]

I marked this as stale due to inactivity. → More info

[fricklerhandwerk]

This could partially alleviated by documenting the behavior.