no-broken-symlinks: fail on links to /build (#411775)

Changed files
+9 -1
doc
nixos
doc
manual
release-notes
pkgs
build-support
setup-hooks
+1 -1
doc/stdenv/stdenv.chapter.md
···
This hook can be disabled by setting `dontCheckForBrokenSymlinks`.
::: {.note}
-
The hook only considers symlinks with targets inside the Nix store.
+
The hook only considers symlinks with targets inside the Nix store or $TMPDIR directory (typically /nix/store and /build in the builder environment, the later being where build is executed).
:::
::: {.note}
+2
nixos/doc/manual/release-notes/rl-2511.section.md
···
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
+
- The `no-broken-symlink` build hook now also fails builds whose output derivation contains links to $TMPDIR (typically /build, which contains the build directory).
+
- The `services.polipo` module has been removed as `polipo` is unmaintained and archived upstream.
- The Pocket ID module ([`services.pocket-id`][#opt-services.pocket-id.enable]) and package (`pocket-id`) has been updated to 1.0.0. Some environment variables have been changed or removed, see the [migration guide](https://pocket-id.org/docs/setup/migrate-to-v1/).
+6
pkgs/build-support/setup-hooks/no-broken-symlinks.sh
···
symlinkTarget="$(realpath --no-symlinks --canonicalize-missing "$pathParent/$symlinkTarget")"
fi
+
# use $TMPDIR like audit-tmpdir.sh
+
if [[ $symlinkTarget = "$TMPDIR"/* ]]; then
+
nixErrorLog "the symlink $path points to $TMPDIR directory: $symlinkTarget"
+
numDanglingSymlinks+=1
+
continue
+
fi
if [[ $symlinkTarget != "$NIX_STORE"/* ]]; then
nixInfoLog "symlink $path points outside the Nix store; ignoring"
continue