CA-derivations aren’t compatible with IFD

[thufschmitt]

Describe the bug

Using IFD on a CA derivation (or depends on a ca derivation) fails with a cryptic error message like error: access to absolute path '/0vfggackkifmvxhxpaapx26lswwg5xcr54dk1cmdgg90j4jw9njc' is forbidden in pure eval mode (use '--impure' to override) or error: getting status of '/1ix2zgscfhpnx492z7i2fr62fmipxcnw2ssjrhj0i802vliq88jv': No such file or directory

Steps To Reproduce

$ cat <<EOF > default.nix
let pkgs = import <nixpkgs> { config.contentAddressedByDefault = true; }; in

let
  drvToImport = pkgs.writeText "foo.nix" ''
    let pkgs = import <nixpkgs> {}; in pkgs.hello
  '';
in
import drvToImport
EOF
$ nix-build
error: getting status of '/1ix2zgscfhpnx492z7i2fr62fmipxcnw2ssjrhj0i802vliq88jv': No such file or directory

Expected behavior

Should work

Additional context

IFD works because import (and I guess readFile) have some magic to realise the context of their string argument before being called. But this isn’t enough with CA derivations because these strings don’t contain the output paths of the realisations they refer to, but only their placeholder (the /<bigHash> thing above). Hence the cryptic error.

It should be possible (and hopefully not too hard) to rewrite these strings before passing them to the primops

[nixos-discourse]

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/content-addressed-nix-call-for-testers/12881/148