mkBinaryCache: fix nixos/tests/binary-cache.nix

[thomasjm]

This fixes the test in nixos/tests/binary-cache.nix. It stopped working sometime between release-23.05 and release-23.11. I'm not sure exactly why, but I think it has something to do with the build sandbox being introduced. Currently, the test tries to build the binary cache on the VM, and a bunch of dependencies are not present, and it has no network access so it fails to download them.

The new approach is actually cleaner: we build the binary cache outside the VM, and then transfer it onto the VM. In order to ensure that we test building against the cache only and don't pollute the store with unnecessary paths, we encrypt the cache to defeat Nix reference scanning. (I considered using an FOD instead, but this seems more foolproof and cleaner.)

To test: nix-build -A nixosTests.binary-cache

In the course of testing this, I learned that doing nix-build -A nixosTests.binary-cache.driver && ./result/bin/nixos-test-driver actually works differently -- invoking the driver like this does not use the build sandbox, so is less isolated than the plain nix-build approach.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-ready-for-review/3032/5045

[thiagokokada]

@ofborg test binary-cache

[thomasjm]

Hi @thiagokokada, any chance you could finish this review?

[philiptaron]

Thanks for the ping. I was up early and was able to fetch and verify that the test now passes. Code looks good and I refrained from nitpicking.

[thomasjm]

Thanks @philiptaron!