From 05624e48e28d1243aed7b0282f0cfdd9d988a8fd Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 20 Oct 2024 18:31:12 +0300
Subject: [PATCH] substituteAll: validate arguments

So no one can repeat my mistakes.
---
 .../substitute/substitute-all.nix             | 32 ++++++++++++-------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/pkgs/build-support/substitute/substitute-all.nix b/pkgs/build-support/substitute/substitute-all.nix
index f49d56041f7e..c6fc688d50e6 100644
--- a/pkgs/build-support/substitute/substitute-all.nix
+++ b/pkgs/build-support/substitute/substitute-all.nix
@@ -1,12 +1,22 @@
-{ stdenvNoCC }:
-
-args:
-
+{ lib, stdenvNoCC }:
 # see the substituteAll in the nixpkgs documentation for usage and constraints
-stdenvNoCC.mkDerivation ({
-  name = if args ? name then args.name else baseNameOf (toString args.src);
-  builder = ./substitute-all.sh;
-  inherit (args) src;
-  preferLocalBuild = true;
-  allowSubstitutes = false;
-} // args)
+args:
+let
+  # keep this in sync with substituteAll
+  isInvalidArgName = x: builtins.match "^[a-z][a-zA-Z0-9_]*$" x == null;
+  invalidArgs = builtins.filter isInvalidArgName (builtins.attrNames args);
+in
+  if invalidArgs == [] then
+    stdenvNoCC.mkDerivation ({
+      name = if args ? name then args.name else baseNameOf (toString args.src);
+      builder = ./substitute-all.sh;
+      inherit (args) src;
+      preferLocalBuild = true;
+      allowSubstitutes = false;
+    } // args)
+  else throw ''
+    Argument names for `pkgs.substituteAll` must:
+      - start with a lower case ASCII letter
+      - only contain ASCII letters, digits and underscores
+    Found invalid argument names: ${lib.concatStringsSep ", " invalidArgs}.
+  ''