nix/tests/functional/hermetic.nix

{ busybox
, seed
# If we want the final derivation output to have references to its
# dependencies. Some tests need/want this, other don't.
, withFinalRefs ? false
}:

with import ./config.nix;

let
  contentAddressedByDefault = builtins.getEnv "NIX_TESTS_CA_BY_DEFAULT" == "1";
  caArgs = if contentAddressedByDefault then {
    __contentAddressed = true;
    outputHashMode = "recursive";
    outputHashAlgo = "sha256";
  } else {};

  mkDerivation = args:
    derivation ({
      inherit system;
      builder = busybox;
      args = ["sh" "-e" args.builder or (builtins.toFile "builder-${args.name}.sh" ''
        if [ -e "$NIX_ATTRS_SH_FILE" ]; then source $NIX_ATTRS_SH_FILE; fi;
        eval "$buildCommand"
      '')];
    } // removeAttrs args ["builder" "meta" "passthru"]
    // caArgs)
    // { meta = args.meta or {}; passthru = args.passthru or {}; };

  input1 = mkDerivation {
    shell = busybox;
    name = "hermetic-input-1";
    buildCommand = "echo hi-input1 seed=${toString seed}; echo FOO > $out";
  };

  input2 = mkDerivation {
    shell = busybox;
    name = "hermetic-input-2";
    buildCommand = "echo hi; echo BAR > $out";
  };

  input3 = mkDerivation {
    shell = busybox;
    name = "hermetic-input-3";
    buildCommand = ''
      echo hi-input3
      read x < ${input2}
      echo ${input2} $x BAZ > $out
    '';
  };

in

  mkDerivation {
    shell = busybox;
    name = "hermetic";
    passthru = { inherit input1 input2 input3; };
    buildCommand =
      ''
        read x < ${input1}
        read y < ${input3}
        echo ${if (builtins.trace withFinalRefs withFinalRefs) then "${input1} ${input3}" else ""} "$x $y" > $out
      '';
  }