commit f2f50aa985d168643a7ef0fb799e6aced6a63448 · pyrox.dev/nixpkgs

lib/lists.nix

···

       477
       477
        
         */

     

       478
       478
        
         subtractLists = e: filter (x: !(elem x e));

     

       479
       479
        
       

     

       480
       480
       +
         /* Test if two lists have no common element.

     

       481
       481
       +
            It should be slightly more efficient than (intersectLists a b == [])

     

       482
       482
       +
         */

     

       483
       483
       +
         mutuallyExclusive = a: b:

     

       484
       484
       +
           (builtins.length a) == 0 ||

     

       485
       485
       +
           (!(builtins.elem (builtins.head a) b) &&

     

       486
       486
       +
            mutuallyExclusive (builtins.tail a) b);

     

       487
       487
       +
       

     

       480
       488
        
       }

+197

pkgs/stdenv/generic/check-meta.nix

···

       1
       1
       +
       # Extend a derivation with checks for brokenness, license, etc.  Throw a

     

       2
       2
       +
       # descriptive error when the check fails; return `derivationArg` otherwise.

     

       3
       3
       +
       # Note: no dependencies are checked in this step.

     

       4
       4
       +
       

     

       5
       5
       +
       { lib, config, system, meta, derivationArg, mkDerivationArg }:

     

       6
       6
       +
       

     

       7
       7
       +
       let

     

       8
       8
       +
         attrs = mkDerivationArg; # TODO: probably get rid of passing this one

     

       9
       9
       +
       

     

       10
       10
       +
         # See discussion at https://github.com/NixOS/nixpkgs/pull/25304#issuecomment-298385426

     

       11
       11
       +
         # for why this defaults to false, but I (@copumpkin) want to default it to true soon.

     

       12
       12
       +
         shouldCheckMeta = config.checkMeta or false;

     

       13
       13
       +
       

     

       14
       14
       +
         allowUnfree = config.allowUnfree or false || builtins.getEnv "NIXPKGS_ALLOW_UNFREE" == "1";

     

       15
       15
       +
       

     

       16
       16
       +
         whitelist = config.whitelistedLicenses or [];

     

       17
       17
       +
         blacklist = config.blacklistedLicenses or [];

     

       18
       18
       +
       

     

       19
       19
       +
         onlyLicenses = list:

     

       20
       20
       +
           lib.lists.all (license:

     

       21
       21
       +
             let l = lib.licenses.${license.shortName or "BROKEN"} or false; in

     

       22
       22
       +
             if license == l then true else

     

       23
       23
       +
               throw ''‘${showLicense license}’ is not an attribute of lib.licenses''

     

       24
       24
       +
           ) list;

     

       25
       25
       +
       

     

       26
       26
       +
         areLicenseListsValid =

     

       27
       27
       +
           if lib.mutuallyExclusive whitelist blacklist then

     

       28
       28
       +
             assert onlyLicenses whitelist; assert onlyLicenses blacklist; true

     

       29
       29
       +
           else

     

       30
       30
       +
             throw "whitelistedLicenses and blacklistedLicenses are not mutually exclusive.";

     

       31
       31
       +
       

     

       32
       32
       +
         hasLicense = attrs:

     

       33
       33
       +
           attrs ? meta.license;

     

       34
       34
       +
       

     

       35
       35
       +
         hasWhitelistedLicense = assert areLicenseListsValid; attrs:

     

       36
       36
       +
           hasLicense attrs && builtins.elem attrs.meta.license whitelist;

     

       37
       37
       +
       

     

       38
       38
       +
         hasBlacklistedLicense = assert areLicenseListsValid; attrs:

     

       39
       39
       +
           hasLicense attrs && builtins.elem attrs.meta.license blacklist;

     

       40
       40
       +
       

     

       41
       41
       +
         allowBroken = config.allowBroken or false || builtins.getEnv "NIXPKGS_ALLOW_BROKEN" == "1";

     

       42
       42
       +
       

     

       43
       43
       +
         isUnfree = licenses: lib.lists.any (l:

     

       44
       44
       +
           !l.free or true || l == "unfree" || l == "unfree-redistributable") licenses;

     

       45
       45
       +
       

     

       46
       46
       +
         # Alow granular checks to allow only some unfree packages

     

       47
       47
       +
         # Example:

     

       48
       48
       +
         # {pkgs, ...}:

     

       49
       49
       +
         # {

     

       50
       50
       +
         #   allowUnfree = false;

     

       51
       51
       +
         #   allowUnfreePredicate = (x: pkgs.lib.hasPrefix "flashplayer-" x.name);

     

       52
       52
       +
         # }

     

       53
       53
       +
         allowUnfreePredicate = config.allowUnfreePredicate or (x: false);

     

       54
       54
       +
       

     

       55
       55
       +
         # Check whether unfree packages are allowed and if not, whether the

     

       56
       56
       +
         # package has an unfree license and is not explicitely allowed by the

     

       57
       57
       +
         # `allowUNfreePredicate` function.

     

       58
       58
       +
         hasDeniedUnfreeLicense = attrs:

     

       59
       59
       +
           !allowUnfree &&

     

       60
       60
       +
           hasLicense attrs &&

     

       61
       61
       +
           isUnfree (lib.lists.toList attrs.meta.license) &&

     

       62
       62
       +
           !allowUnfreePredicate attrs;

     

       63
       63
       +
       

     

       64
       64
       +
         allowInsecureDefaultPredicate = x: builtins.elem x.name (config.permittedInsecurePackages or []);

     

       65
       65
       +
         allowInsecurePredicate = x: (config.allowUnfreePredicate or allowInsecureDefaultPredicate) x;

     

       66
       66
       +
       

     

       67
       67
       +
         hasAllowedInsecure = attrs:

     

       68
       68
       +
           (attrs.meta.knownVulnerabilities or []) == [] ||

     

       69
       69
       +
           allowInsecurePredicate attrs ||

     

       70
       70
       +
           builtins.getEnv "NIXPKGS_ALLOW_INSECURE" == "1";

     

       71
       71
       +
       

     

       72
       72
       +
         showLicense = license: license.shortName or "unknown";

     

       73
       73
       +
       

     

       74
       74
       +
         pos_str = meta.position or "«unknown-file»";

     

       75
       75
       +
       

     

       76
       76
       +
         remediation = {

     

       77
       77
       +
           unfree = remediate_whitelist "Unfree";

     

       78
       78
       +
           broken = remediate_whitelist "Broken";

     

       79
       79
       +
           blacklisted = x: "";

     

       80
       80
       +
           insecure = remediate_insecure;

     

       81
       81
       +
           unknown-meta = x: "";

     

       82
       82
       +
         };

     

       83
       83
       +
         remediate_whitelist = allow_attr: attrs:

     

       84
       84
       +
           ''

     

       85
       85
       +
             a) For `nixos-rebuild` you can set

     

       86
       86
       +
               { nixpkgs.config.allow${allow_attr} = true; }

     

       87
       87
       +
             in configuration.nix to override this.

     

       88
       88
       +
       

     

       89
       89
       +
             b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add

     

       90
       90
       +
               { allow${allow_attr} = true; }

     

       91
       91
       +
             to ~/.config/nixpkgs/config.nix.

     

       92
       92
       +
           '';

     

       93
       93
       +
       

     

       94
       94
       +
         remediate_insecure = attrs:

     

       95
       95
       +
           ''

     

       96
       96
       +
       

     

       97
       97
       +
             Known issues:

     

       98
       98
       +
       

     

       99
       99
       +
           '' + (lib.fold (issue: default: "${default} - ${issue}\n") "" attrs.meta.knownVulnerabilities) + ''

     

       100
       100
       +
       

     

       101
       101
       +
               You can install it anyway by whitelisting this package, using the

     

       102
       102
       +
               following methods:

     

       103
       103
       +
       

     

       104
       104
       +
               a) for `nixos-rebuild` you can add ‘${attrs.name or "«name-missing»"}’ to

     

       105
       105
       +
                  `nixpkgs.config.permittedInsecurePackages` in the configuration.nix,

     

       106
       106
       +
                  like so:

     

       107
       107
       +
       

     

       108
       108
       +
                    {

     

       109
       109
       +
                      nixpkgs.config.permittedInsecurePackages = [

     

       110
       110
       +
                        "${attrs.name or "«name-missing»"}"

     

       111
       111
       +
                      ];

     

       112
       112
       +
                    }

     

       113
       113
       +
       

     

       114
       114
       +
               b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add

     

       115
       115
       +
               ‘${attrs.name or "«name-missing»"}’ to `permittedInsecurePackages` in

     

       116
       116
       +
               ~/.config/nixpkgs/config.nix, like so:

     

       117
       117
       +
       

     

       118
       118
       +
                    {

     

       119
       119
       +
                      permittedInsecurePackages = [

     

       120
       120
       +
                        "${attrs.name or "«name-missing»"}"

     

       121
       121
       +
                      ];

     

       122
       122
       +
                    }

     

       123
       123
       +
       

     

       124
       124
       +
             '';

     

       125
       125
       +
       

     

       126
       126
       +
         throwEvalHelp = { reason , errormsg ? "" }:

     

       127
       127
       +
           throw (''

     

       128
       128
       +
             Package ‘${attrs.name or "«name-missing»"}’ in ${pos_str} ${errormsg}, refusing to evaluate.

     

       129
       129
       +
       

     

       130
       130
       +
             '' + ((builtins.getAttr reason remediation) attrs));

     

       131
       131
       +
       

     

       132
       132
       +
         metaTypes = with lib.types; rec {

     

       133
       133
       +
           # These keys are documented

     

       134
       134
       +
           description = str;

     

       135
       135
       +
           longDescription = str;

     

       136
       136
       +
           branch = str;

     

       137
       137
       +
           homepage = str;

     

       138
       138
       +
           downloadPage = str;

     

       139
       139
       +
           license = either (listOf lib.types.attrs) (either lib.types.attrs str);

     

       140
       140
       +
           maintainers = listOf str;

     

       141
       141
       +
           priority = int;

     

       142
       142
       +
           platforms = listOf str;

     

       143
       143
       +
           hydraPlatforms = listOf str;

     

       144
       144
       +
           broken = bool;

     

       145
       145
       +
       

     

       146
       146
       +
           # Weirder stuff that doesn't appear in the documentation?

     

       147
       147
       +
           version = str;

     

       148
       148
       +
           tag = str;

     

       149
       149
       +
           updateWalker = bool;

     

       150
       150
       +
           executables = listOf str;

     

       151
       151
       +
           outputsToInstall = listOf str;

     

       152
       152
       +
           position = str;

     

       153
       153
       +
           repositories = attrsOf str;

     

       154
       154
       +
           isBuildPythonPackage = platforms;

     

       155
       155
       +
           schedulingPriority = str;

     

       156
       156
       +
           downloadURLRegexp = str;

     

       157
       157
       +
           isFcitxEngine = bool;

     

       158
       158
       +
           isIbusEngine = bool;

     

       159
       159
       +
         };

     

       160
       160
       +
       

     

       161
       161
       +
         checkMetaAttr = k: v:

     

       162
       162
       +
           if metaTypes?${k} then

     

       163
       163
       +
             if metaTypes.${k}.check v then null else "key '${k}' has a value ${v} of an invalid type ${builtins.typeOf v}; expected ${metaTypes.${k}.description}"

     

       164
       164
       +
           else "key '${k}' is unrecognized; expected one of: \n\t      [${lib.concatMapStringsSep ", " (x: "'${x}'") (lib.attrNames metaTypes)}]";

     

       165
       165
       +
         checkMeta = meta: if shouldCheckMeta then lib.remove null (lib.mapAttrsToList checkMetaAttr meta) else [];

     

       166
       166
       +
       

     

       167
       167
       +
         # Check if a derivation is valid, that is whether it passes checks for

     

       168
       168
       +
         # e.g brokenness or license.

     

       169
       169
       +
         #

     

       170
       170
       +
         # Return { valid: Bool } and additionally

     

       171
       171
       +
         # { reason: String; errormsg: String } if it is not valid, where

     

       172
       172
       +
         # reason is one of "unfree", "blacklisted" or "broken".

     

       173
       173
       +
         checkValidity = attrs:

     

       174
       174
       +
           if hasDeniedUnfreeLicense attrs && !(hasWhitelistedLicense attrs) then

     

       175
       175
       +
             { valid = false; reason = "unfree"; errormsg = "has an unfree license (‘${showLicense attrs.meta.license}’)"; }

     

       176
       176
       +
           else if hasBlacklistedLicense attrs then

     

       177
       177
       +
             { valid = false; reason = "blacklisted"; errormsg = "has a blacklisted license (‘${showLicense attrs.meta.license}’)"; }

     

       178
       178
       +
           else if !allowBroken && attrs.meta.broken or false then

     

       179
       179
       +
             { valid = false; reason = "broken"; errormsg = "is marked as broken"; }

     

       180
       180
       +
           else if !allowBroken && attrs.meta.platforms or null != null && !lib.lists.elem system attrs.meta.platforms then

     

       181
       181
       +
             { valid = false; reason = "broken"; errormsg = "is not supported on ‘${system}’"; }

     

       182
       182
       +
           else if !(hasAllowedInsecure attrs) then

     

       183
       183
       +
             { valid = false; reason = "insecure"; errormsg = "is marked as insecure"; }

     

       184
       184
       +
           else let res = checkMeta (attrs.meta or {}); in if res != [] then

     

       185
       185
       +
             { valid = false; reason = "unknown-meta"; errormsg = "has an invalid meta attrset:${lib.concatMapStrings (x: "\n\t - " + x) res}"; }

     

       186
       186
       +
           else { valid = true; };

     

       187
       187
       +
       

     

       188
       188
       +
         # Throw an error if trying to evaluate an non-valid derivation

     

       189
       189
       +
         validityCondition =

     

       190
       190
       +
                let v = checkValidity attrs;

     

       191
       191
       +
                in if !v.valid

     

       192
       192
       +
                  then throwEvalHelp (removeAttrs v ["valid"])

     

       193
       193
       +
                  else true;

     

       194
       194
       +
       

     

       195
       195
       +
       in

     

       196
       196
       +
         assert validityCondition;

     

       197
       197
       +
         derivationArg

+47 -231

pkgs/stdenv/generic/default.nix

···

       27
       27
        
       let

     

       28
       28
        
         inherit (targetPlatform) system;

     

       29
       29
        
       

     

       30
       30
       -
         # See discussion at https://github.com/NixOS/nixpkgs/pull/25304#issuecomment-298385426

     

       31
       31
       -
         # for why this defaults to false, but I (@copumpkin) want to default it to true soon.

     

       32
       32
       -
         shouldCheckMeta = config.checkMeta or false;

     

       33
       33
       -
       

     

       34
       34
       -
         allowUnfree = config.allowUnfree or false || builtins.getEnv "NIXPKGS_ALLOW_UNFREE" == "1";

     

       35
       35
       -
       

     

       36
       36
       -
         whitelist = config.whitelistedLicenses or [];

     

       37
       37
       -
         blacklist = config.blacklistedLicenses or [];

     

       38
       38
       -
       

     

       39
       30
        
         ifDarwin = attrs: if system == "x86_64-darwin" then attrs else {};

     

       40
       31
        
       

     

       41
       41
       -
         onlyLicenses = list:

     

       42
       42
       -
           lib.lists.all (license:

     

       43
       43
       -
             let l = lib.licenses.${license.shortName or "BROKEN"} or false; in

     

       44
       44
       -
             if license == l then true else

     

       45
       45
       -
               throw ''‘${showLicense license}’ is not an attribute of lib.licenses''

     

       46
       46
       -
           ) list;

     

       47
       47
       -
       

     

       48
       48
       -
         mutuallyExclusive = a: b:

     

       49
       49
       -
           (builtins.length a) == 0 ||

     

       50
       50
       -
           (!(builtins.elem (builtins.head a) b) &&

     

       51
       51
       -
            mutuallyExclusive (builtins.tail a) b);

     

       52
       52
       -
       

     

       53
       53
       -
         areLicenseListsValid =

     

       54
       54
       -
           if mutuallyExclusive whitelist blacklist then

     

       55
       55
       -
             assert onlyLicenses whitelist; assert onlyLicenses blacklist; true

     

       56
       56
       -
           else

     

       57
       57
       -
             throw "whitelistedLicenses and blacklistedLicenses are not mutually exclusive.";

     

       58
       58
       -
       

     

       59
       59
       -
         hasLicense = attrs:

     

       60
       60
       -
           attrs ? meta.license;

     

       61
       61
       -
       

     

       62
       62
       -
         hasWhitelistedLicense = assert areLicenseListsValid; attrs:

     

       63
       63
       -
           hasLicense attrs && builtins.elem attrs.meta.license whitelist;

     

       64
       64
       -
       

     

       65
       65
       -
         hasBlacklistedLicense = assert areLicenseListsValid; attrs:

     

       66
       66
       -
           hasLicense attrs && builtins.elem attrs.meta.license blacklist;

     

       67
       67
       -
       

     

       68
       68
       -
         allowBroken = config.allowBroken or false || builtins.getEnv "NIXPKGS_ALLOW_BROKEN" == "1";

     

       69
       69
       -
       

     

       70
       70
       -
         isUnfree = licenses: lib.lists.any (l:

     

       71
       71
       -
           !l.free or true || l == "unfree" || l == "unfree-redistributable") licenses;

     

       72
       72
       -
       

     

       73
       73
       -
         # Alow granular checks to allow only some unfree packages

     

       74
       74
       -
         # Example:

     

       75
       75
       -
         # {pkgs, ...}:

     

       76
       76
       -
         # {

     

       77
       77
       -
         #   allowUnfree = false;

     

       78
       78
       -
         #   allowUnfreePredicate = (x: pkgs.lib.hasPrefix "flashplayer-" x.name);

     

       79
       79
       -
         # }

     

       80
       80
       -
         allowUnfreePredicate = config.allowUnfreePredicate or (x: false);

     

       81
       81
       -
       

     

       82
       82
       -
         # Check whether unfree packages are allowed and if not, whether the

     

       83
       83
       -
         # package has an unfree license and is not explicitely allowed by the

     

       84
       84
       -
         # `allowUNfreePredicate` function.

     

       85
       85
       -
         hasDeniedUnfreeLicense = attrs:

     

       86
       86
       -
           !allowUnfree &&

     

       87
       87
       -
           hasLicense attrs &&

     

       88
       88
       -
           isUnfree (lib.lists.toList attrs.meta.license) &&

     

       89
       89
       -
           !allowUnfreePredicate attrs;

     

       90
       90
       -
       

     

       91
       91
       -
         allowInsecureDefaultPredicate = x: builtins.elem x.name (config.permittedInsecurePackages or []);

     

       92
       92
       -
         allowInsecurePredicate = x: (config.allowUnfreePredicate or allowInsecureDefaultPredicate) x;

     

       93
       93
       -
       

     

       94
       94
       -
         hasAllowedInsecure = attrs:

     

       95
       95
       -
           (attrs.meta.knownVulnerabilities or []) == [] ||

     

       96
       96
       -
           allowInsecurePredicate attrs ||

     

       97
       97
       -
           builtins.getEnv "NIXPKGS_ALLOW_INSECURE" == "1";

     

       98
       98
       -
       

     

       99
       99
       -
         showLicense = license: license.shortName or "unknown";

     

       100
       100
       -
       

     

       101
       32
        
         defaultNativeBuildInputs = extraBuildInputs ++

     

       102
       33
        
           [ ../../build-support/setup-hooks/move-docs.sh

     

       103
       34
        
             ../../build-support/setup-hooks/compress-man-pages.sh

     
···

       135
       66
        
           , crossConfig ? null

     

       136
       67
        
           , meta ? {}

     

       137
       68
        
           , passthru ? {}

     

       138
       138
       -
           , pos ? null # position used in error messages and for meta.position

     

       69
       69
       +
           , pos ? # position used in error messages and for meta.position

     

       70
       70
       +
               (if attrs.meta.description or null != null

     

       71
       71
       +
                 then builtins.unsafeGetAttrPos "description" attrs.meta

     

       72
       72
       +
                 else builtins.unsafeGetAttrPos "name" attrs)

     

       139
       73
        
           , separateDebugInfo ? false

     

       140
       74
        
           , outputs ? [ "out" ]

     

       141
       75
        
           , __impureHostDeps ? []

     
···

       153
       87
        
               (map (drv: drv.crossDrv or drv) propagatedBuildInputs)

     

       154
       88
        
             ];

     

       155
       89
        
           in let

     

       156
       156
       -
             pos' =

     

       157
       157
       -
               if pos != null then

     

       158
       158
       -
                 pos

     

       159
       159
       -
               else if attrs.meta.description or null != null then

     

       160
       160
       -
                 builtins.unsafeGetAttrPos "description" attrs.meta

     

       161
       161
       -
               else

     

       162
       162
       -
                 builtins.unsafeGetAttrPos "name" attrs;

     

       163
       163
       -
             pos'' = if pos' != null then "‘" + pos'.file + ":" + toString pos'.line + "’" else "«unknown-file»";

     

       164
       164
       -
       

     

       165
       165
       -
       

     

       166
       166
       -
             remediation = {

     

       167
       167
       -
               unfree = remediate_whitelist "Unfree";

     

       168
       168
       -
               broken = remediate_whitelist "Broken";

     

       169
       169
       -
               blacklisted = x: "";

     

       170
       170
       -
               insecure = remediate_insecure;

     

       171
       171
       -
               unknown-meta = x: "";

     

       172
       172
       -
             };

     

       173
       173
       -
             remediate_whitelist = allow_attr: attrs:

     

       174
       174
       -
               ''

     

       175
       175
       -
                 a) For `nixos-rebuild` you can set

     

       176
       176
       -
                   { nixpkgs.config.allow${allow_attr} = true; }

     

       177
       177
       -
                 in configuration.nix to override this.

     

       178
       178
       -
       

     

       179
       179
       -
                 b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add

     

       180
       180
       -
                   { allow${allow_attr} = true; }

     

       181
       181
       -
                 to ~/.config/nixpkgs/config.nix.

     

       182
       182
       -
               '';

     

       183
       183
       -
       

     

       184
       184
       -
             remediate_insecure = attrs:

     

       185
       185
       -
               ''

     

       186
       186
       -
       

     

       187
       187
       -
                 Known issues:

     

       188
       188
       -
       

     

       189
       189
       -
               '' + (lib.fold (issue: default: "${default} - ${issue}\n") "" attrs.meta.knownVulnerabilities) + ''

     

       190
       190
       -
       

     

       191
       191
       -
                 You can install it anyway by whitelisting this package, using the

     

       192
       192
       -
                 following methods:

     

       193
       193
       -
       

     

       194
       194
       -
                 a) for `nixos-rebuild` you can add ‘${attrs.name or "«name-missing»"}’ to

     

       195
       195
       -
                    `nixpkgs.config.permittedInsecurePackages` in the configuration.nix,

     

       196
       196
       -
                    like so:

     

       197
       197
       -
       

     

       198
       198
       -
                      {

     

       199
       199
       -
                        nixpkgs.config.permittedInsecurePackages = [

     

       200
       200
       -
                          "${attrs.name or "«name-missing»"}"

     

       201
       201
       -
                        ];

     

       202
       202
       -
                      }

     

       203
       203
       -
       

     

       204
       204
       -
                 b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add

     

       205
       205
       -
                 ‘${attrs.name or "«name-missing»"}’ to `permittedInsecurePackages` in

     

       206
       206
       -
                 ~/.config/nixpkgs/config.nix, like so:

     

       207
       207
       -
       

     

       208
       208
       -
                      {

     

       209
       209
       -
                        permittedInsecurePackages = [

     

       210
       210
       -
                          "${attrs.name or "«name-missing»"}"

     

       211
       211
       -
                        ];

     

       212
       212
       -
                      }

     

       213
       213
       -
       

     

       214
       214
       -
               '';

     

       215
       215
       -
       

     

       216
       216
       -
       

     

       217
       217
       -
             throwEvalHelp = { reason , errormsg ? "" }:

     

       218
       218
       -
               throw (''

     

       219
       219
       -
                 Package ‘${attrs.name or "«name-missing»"}’ in ${pos''} ${errormsg}, refusing to evaluate.

     

       220
       220
       -
       

     

       221
       221
       -
                 '' + ((builtins.getAttr reason remediation) attrs));

     

       222
       222
       -
       

     

       223
       223
       -
             metaTypes = with lib.types; rec {

     

       224
       224
       -
               # These keys are documented

     

       225
       225
       -
               description = str;

     

       226
       226
       -
               longDescription = str;

     

       227
       227
       -
               branch = str;

     

       228
       228
       -
               homepage = str;

     

       229
       229
       -
               downloadPage = str;

     

       230
       230
       -
               license = either (listOf lib.types.attrs) (either lib.types.attrs str);

     

       231
       231
       -
               maintainers = listOf str;

     

       232
       232
       -
               priority = int;

     

       233
       233
       -
               platforms = listOf str;

     

       234
       234
       -
               hydraPlatforms = listOf str;

     

       235
       235
       -
               broken = bool;

     

       236
       236
       -
       

     

       237
       237
       -
               # Weirder stuff that doesn't appear in the documentation?

     

       238
       238
       -
               version = str;

     

       239
       239
       -
               tag = str;

     

       240
       240
       -
               updateWalker = bool;

     

       241
       241
       -
               executables = listOf str;

     

       242
       242
       -
               outputsToInstall = listOf str;

     

       243
       243
       -
               position = str;

     

       244
       244
       -
               repositories = attrsOf str;

     

       245
       245
       -
               isBuildPythonPackage = platforms;

     

       246
       246
       -
               schedulingPriority = str;

     

       247
       247
       -
               downloadURLRegexp = str;

     

       248
       248
       -
               isFcitxEngine = bool;

     

       249
       249
       -
               isIbusEngine = bool;

     

       250
       250
       -
             };

     

       251
       251
       -
       

     

       252
       252
       -
             checkMetaAttr = k: v:

     

       253
       253
       -
               if metaTypes?${k} then

     

       254
       254
       -
                 if metaTypes.${k}.check v then null else "key '${k}' has a value ${v} of an invalid type ${builtins.typeOf v}; expected ${metaTypes.${k}.description}"

     

       255
       255
       -
               else "key '${k}' is unrecognized; expected one of: \n\t      [${lib.concatMapStringsSep ", " (x: "'${x}'") (lib.attrNames metaTypes)}]";

     

       256
       256
       -
             checkMeta = meta: if shouldCheckMeta then lib.remove null (lib.mapAttrsToList checkMetaAttr meta) else [];

     

       257
       257
       -
       

     

       258
       258
       -
             # Check if a derivation is valid, that is whether it passes checks for

     

       259
       259
       -
             # e.g brokenness or license.

     

       260
       260
       -
             #

     

       261
       261
       -
             # Return { valid: Bool } and additionally

     

       262
       262
       -
             # { reason: String; errormsg: String } if it is not valid, where

     

       263
       263
       -
             # reason is one of "unfree", "blacklisted" or "broken".

     

       264
       264
       -
             checkValidity = attrs:

     

       265
       265
       -
               if hasDeniedUnfreeLicense attrs && !(hasWhitelistedLicense attrs) then

     

       266
       266
       -
                 { valid = false; reason = "unfree"; errormsg = "has an unfree license (‘${showLicense attrs.meta.license}’)"; }

     

       267
       267
       -
               else if hasBlacklistedLicense attrs then

     

       268
       268
       -
                 { valid = false; reason = "blacklisted"; errormsg = "has a blacklisted license (‘${showLicense attrs.meta.license}’)"; }

     

       269
       269
       -
               else if !allowBroken && attrs.meta.broken or false then

     

       270
       270
       -
                 { valid = false; reason = "broken"; errormsg = "is marked as broken"; }

     

       271
       271
       -
               else if !allowBroken && attrs.meta.platforms or null != null && !lib.lists.elem result.system attrs.meta.platforms then

     

       272
       272
       -
                 { valid = false; reason = "broken"; errormsg = "is not supported on ‘${result.system}’"; }

     

       273
       273
       -
               else if !(hasAllowedInsecure attrs) then

     

       274
       274
       -
                 { valid = false; reason = "insecure"; errormsg = "is marked as insecure"; }

     

       275
       275
       -
               else let res = checkMeta (attrs.meta or {}); in if res != [] then

     

       276
       276
       -
                 { valid = false; reason = "unknown-meta"; errormsg = "has an invalid meta attrset:${lib.concatMapStrings (x: "\n\t - " + x) res}"; }

     

       277
       277
       -
               else { valid = true; };

     

       278
       90
        
       

     

       279
       91
        
             outputs' =

     

       280
       92
        
               outputs ++

     
···

       290
       102
        
               in [ nativeBuildInputs buildInputs ];

     

       291
       103
        
       

     

       292
       104
        
             propagatedDependencies' = map lib.chooseDevOutputs propagatedDependencies;

     

       293
       293
       -
           in

     

       294
       105
        
       

     

       295
       295
       -
             # Throw an error if trying to evaluate an non-valid derivation

     

       296
       296
       -
             assert let v = checkValidity attrs;

     

       297
       297
       -
                    in if !v.valid

     

       298
       298
       -
                      then throwEvalHelp (removeAttrs v ["valid"])

     

       299
       299
       -
                      else true;

     

       300
       300
       -
       

     

       301
       301
       -
             lib.addPassthru (derivation (

     

       106
       106
       +
             derivationArg =

     

       302
       107
        
               (removeAttrs attrs

     

       303
       108
        
                 ["meta" "passthru" "crossAttrs" "pos"

     

       304
       109
        
                  "__impureHostDeps" "__propagatedImpureHostDeps"

     
···

       343
       148
        
                 __propagatedImpureHostDeps = computedPropagatedImpureHostDeps ++ __propagatedImpureHostDeps;

     

       344
       149
        
               } // (if outputs' != [ "out" ] then {

     

       345
       150
        
                 outputs = outputs';

     

       346
       346
       -
               } else { })))) (

     

       347
       347
       -
             {

     

       348
       348
       -
               overrideAttrs = f: mkDerivation (attrs // (f attrs));

     

       349
       349
       -
               # The meta attribute is passed in the resulting attribute set,

     

       350
       350
       -
               # but it's not part of the actual derivation, i.e., it's not

     

       351
       351
       -
               # passed to the builder and is not a dependency.  But since we

     

       352
       352
       -
               # include it in the result, it *is* available to nix-env for queries.

     

       353
       353
       -
               meta = { }

     

       354
       354
       -
                   # If the packager hasn't specified `outputsToInstall`, choose a default,

     

       355
       355
       -
                   # which is the name of `p.bin or p.out or p`;

     

       356
       356
       -
                   # if he has specified it, it will be overridden below in `// meta`.

     

       357
       357
       -
                   #   Note: This default probably shouldn't be globally configurable.

     

       358
       358
       -
                   #   Services and users should specify outputs explicitly,

     

       359
       359
       -
                   #   unless they are comfortable with this default.

     

       360
       360
       -
                 // { outputsToInstall =

     

       361
       361
       -
                   let

     

       362
       362
       -
                     outs = outputs'; # the value passed to derivation primitive

     

       363
       363
       -
                     hasOutput = out: builtins.elem out outs;

     

       364
       364
       -
                   in [( lib.findFirst hasOutput null (["bin" "out"] ++ outs) )];

     

       365
       365
       -
                 }

     

       366
       366
       -
                 // meta

     

       367
       367
       -
                   # Fill `meta.position` to identify the source location of the package.

     

       368
       368
       -
                 // lib.optionalAttrs (pos' != null)

     

       369
       369
       -
                   { position = pos'.file + ":" + toString pos'.line; }

     

       370
       370
       -
                 ;

     

       371
       371
       -
               inherit passthru;

     

       372
       372
       -
             } //

     

       373
       373
       -
             # Pass through extra attributes that are not inputs, but

     

       374
       374
       -
             # should be made available to Nix expressions using the

     

       375
       375
       -
             # derivation (e.g., in assertions).

     

       376
       376
       -
             passthru);

     

       151
       151
       +
               } else { }));

     

       152
       152
       +
       

     

       153
       153
       +
             # The meta attribute is passed in the resulting attribute set,

     

       154
       154
       +
             # but it's not part of the actual derivation, i.e., it's not

     

       155
       155
       +
             # passed to the builder and is not a dependency.  But since we

     

       156
       156
       +
             # include it in the result, it *is* available to nix-env for queries.

     

       157
       157
       +
             meta = { }

     

       158
       158
       +
                 # If the packager hasn't specified `outputsToInstall`, choose a default,

     

       159
       159
       +
                 # which is the name of `p.bin or p.out or p`;

     

       160
       160
       +
                 # if he has specified it, it will be overridden below in `// meta`.

     

       161
       161
       +
                 #   Note: This default probably shouldn't be globally configurable.

     

       162
       162
       +
                 #   Services and users should specify outputs explicitly,

     

       163
       163
       +
                 #   unless they are comfortable with this default.

     

       164
       164
       +
               // { outputsToInstall =

     

       165
       165
       +
                 let

     

       166
       166
       +
                   outs = outputs'; # the value passed to derivation primitive

     

       167
       167
       +
                   hasOutput = out: builtins.elem out outs;

     

       168
       168
       +
                 in [( lib.findFirst hasOutput null (["bin" "out"] ++ outs) )];

     

       169
       169
       +
               }

     

       170
       170
       +
               // attrs.meta or {}

     

       171
       171
       +
                 # Fill `meta.position` to identify the source location of the package.

     

       172
       172
       +
               // lib.optionalAttrs (pos != null)

     

       173
       173
       +
                 { position = pos.file + ":" + toString pos.line; }

     

       174
       174
       +
               ;

     

       175
       175
       +
       

     

       176
       176
       +
           in

     

       177
       177
       +
       

     

       178
       178
       +
             lib.addPassthru

     

       179
       179
       +
               (derivation (import ./check-meta.nix

     

       180
       180
       +
                 {

     

       181
       181
       +
                   inherit lib config meta derivationArg;

     

       182
       182
       +
                   mkDerivationArg = attrs;

     

       183
       183
       +
                   inherit system; # TODO: cross-compilation?

     

       184
       184
       +
                 }))

     

       185
       185
       +
               ( {

     

       186
       186
       +
                   overrideAttrs = f: mkDerivation (attrs // (f attrs));

     

       187
       187
       +
                   inherit meta passthru;

     

       188
       188
       +
                 } //

     

       189
       189
       +
                 # Pass through extra attributes that are not inputs, but

     

       190
       190
       +
                 # should be made available to Nix expressions using the

     

       191
       191
       +
                 # derivation (e.g., in assertions).

     

       192
       192
       +
                 passthru);

     

       377
       193
        
       

     

       378
       194
        
         # The stdenv that we are producing.

     

       379
       195
        
         result =