trivial-builders: disallow sub in requireFile

[matthewbauer]

The requireFile call was being substituted from the binary cache. We
do not want this to happen as the user needs to download the file
themselves.

Note that there is stil an issue where nix-serve can provide these files if you request them.

[layus]

In the same fashion as @eadwu in eadwu/nixos-configuration@953304c I disabled this "feature" with an overlay

final: prev: { 
  requireFile = args: (prev.requireFile args).overrideAttrs (_: { allowSubstitutes = true; });
})

I question the need for allowSubstitutes = false; here. Surely, if the file cannot and should not be downloaded automatically, it should never land in binary caches. I would argue that this setup creates confusion above anything else. Because when the path is in the cache, it can still be substituted with nix-store --realise /the/path anyway. AFAIK, we have no way to prevent anyone from downloading a file from a binary cache, we just have to ensure that it is no sent there at all.

[layus]

Another option is to create a second trivial builder with a different name to disambiguate the semantics. requireFile can be very useful as a way to describe a file that can be obtained from a binary cache only, because it was built non-reproducibly by some user of the system. (I know it is not an ideal setup, but it is handy sometimes, if not the only option). requireFile name does not carry the meaning that nix is not allowed to fetch it for you.

[wucke13]

I just searched for ~45 minutes looking for the bug in my nix-serve setup. Eventually I found this issue, and a quick overlay fixed the issue.

{
  pkgs = import nixpkgs {
    inherit system;
    overlays = [
      (final: prev: {
        requireFile = args: (prev.requireFile args).overrideAttrs (_: { allowSubstitutes = true; });
      })
    ];
  };
}

I'm strongly in favour of fixing this upstream, the current behavior is just surprising in a bad, potentially time wasting way.