From 12d47e9bbef05c69c5b49f53eb8d73e53124af63 Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Tue, 2 May 2023 20:52:13 +0300
Subject: [PATCH] minimal-bootstrap: work towards making it independant of a
 initialized nixpkgs

dont use top-level newScope to prevent accidentally using top-level attrs
---
 pkgs/os-specific/linux/minimal-bootstrap/default.nix  | 11 ++++++-----
 .../linux/minimal-bootstrap/stage0-posix/utils.nix    |  9 +++------
 pkgs/top-level/all-packages.nix                       |  2 +-
 3 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/pkgs/os-specific/linux/minimal-bootstrap/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
index fd1693e761b..6f6c5852576 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@@ -1,11 +1,12 @@
-{ lib
-, newScope
-, stdenv
+{ buildPlatform
+, hostPlatform
+, config
+, lib ? import ../../lib
 }:

-lib.makeScope newScope (self: with self; {
+lib.makeScope (extra: lib.callPackageWith ({ inherit lib config buildPlatform hostPlatform; } // extra)) (self: with self; {
   fetchurl = import ../../../build-support/fetchurl/boot.nix {
-    inherit (stdenv.buildPlatform) system;
+    inherit (buildPlatform) system;
   };

   inherit (callPackage ./stage0-posix { }) kaem m2libc mescc-tools mescc-tools-extra writeTextFile writeText runCommand;
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/utils.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/utils.nix
index 239d17e4fbc..4d44b7447fb 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/utils.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/utils.nix
@@ -1,7 +1,6 @@
 { lib
-, stdenv
+, buildPlatform
 , callPackage
-, fetchurl
 , kaem
 , kaem-unwrapped
 , mescc-tools
@@ -9,9 +8,7 @@
 }:

 let
-  checkMeta = callPackage ../../../../stdenv/generic/check-meta.nix {
-    inherit (stdenv) hostPlatform;
-  };
+  checkMeta = callPackage ../../../../stdenv/generic/check-meta.nix { };
 in
 rec {
   derivationWithMeta = attrs:
@@ -24,7 +21,7 @@ rec {
       validity.handled
       ({ inherit meta passthru; } // passthru)
       (derivation ({
-        inherit (stdenv.buildPlatform) system;
+        inherit (buildPlatform) system;
         inherit (meta) name;
       } // (builtins.removeAttrs attrs [ "meta" "passthru" ])));

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index dfdc90afaa8..efa5d3a7cac 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -26943,7 +26943,7 @@ with pkgs;

   metastore = callPackage ../os-specific/linux/metastore { };

-  minimal-bootstrap = recurseIntoAttrs (callPackage ../os-specific/linux/minimal-bootstrap { });
+  minimal-bootstrap = recurseIntoAttrs (import ../os-specific/linux/minimal-bootstrap { inherit (stdenv) buildPlatform hostPlatform; inherit config lib; });

   mingetty = callPackage ../os-specific/linux/mingetty { };

--
2.40.0

In reply to @emilytrau:matrix.org
Artturin: heya. love this change for preventing accidental leaks thank you! i hadn't considered uses of minimal-bootstrap outside of nixpkgs, and in the near future will likely draw in some top-level packages after constructing stdenv. is this a use case you're after?

$ nix build --impure --expr "with import ./. { config = { structuredAttrsByDefault = true; }; }; stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.libxcrypt"
this derivation will be built:
  /nix/store/994qfy50ylyafndz12zh8zq1a73gi5ll-libxcrypt-4.4.35.drv
building '/nix/store/994qfy50ylyafndz12zh8zq1a73gi5ll-libxcrypt-4.4.35.drv'...
libxcrypt> structuredAttrs is enabled
libxcrypt> unpacking sources
libxcrypt> unpacking source archive /nix/store/spzw99ag9wq184zd9il0n66937m30dzl-libxcrypt-4.4.35.tar.xz
libxcrypt> source root is libxcrypt-4.4.35
libxcrypt> setting SOURCE_DATE_EPOCH to timestamp 1686071870 of file libxcrypt-4.4.35/config.h.in
libxcrypt> patching sources
libxcrypt> updateAutotoolsGnuConfigScriptsPhase
libxcrypt> Updating Autotools / GNU config script to a newer upstream version: ./build-aux/m4-autogen/config.sub
libxcrypt> cp: cannot stat '@gnu_config@/config.sub': No such file or directory

$ nix path-info -r --impure --expr "with import ./. { config = { structuredAttrsByDefault = true; }; }; stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.stdenv.__bootPackages.libxcrypt" --derivation
/nix/store/00qr10y7z2fcvrp9b2m46710nkjvj55z-update-autotools-gnu-config-scripts.sh
/nix/store/2195bmvj8zqjj8kfc61r4iwc9llpwnfh-cc-wrapper.sh
...

/nix/store/2195bmvj8zqjj8kfc61r4iwc9llpwnfh-cc-wrapper.sh contains unsubstituted variables

if [[ -n "@coreutils_bin@" && -n "@gnugrep_bin@" ]]; then
    PATH="@coreutils_bin@/bin:@gnugrep_bin@/bin"
fi

source @out@/nix-support/utils.bash