nix.ci name isn't used much anymore, right? (even though occasionally referenced)

The whole .ci TLD has broken DNSSEC right now, so it isn't accessible by default to some users. (vast majority in some countries, small minority in others)

nix.ci name isn't used much anymore, right? (even though occasionally referenced)

The whole .ci TLD has broken DNSSEC right now, so it isn't accessible by default to some users. (vast majority in some countries, small minority in others, and minority globally as well I think)

---- nix::tests::strict_sandboxing stdout ----
thread 'nix::tests::strict_sandboxing' panicked at '

The run was expected to Fail, but did not.

   | this derivation will be built:
   |   /nix/store/ih4kj08w3x1vavdy40n08qis00ilrbjy-sandbox-violation.drv
   | building '/nix/store/ih4kj08w3x1vavdy40n08qis00ilrbjy-sandbox-violation.drv'...
   | hi
   | /nix/store/002bqs9cx1zavfag41xngiih1f2ari27-sandbox-violation


0 out of 2 required lines matched.

 - Err("access to absolute path")
 - Err("is forbidden in restricted mode")
', ofborg/src/nix.rs:545:13
stack backtrace:
   0: rust_begin_unwind
   1: core::panicking::panic_fmt
   2: core::panicking::panic_display
             at /build/rustc-1.72.0-src/library/core/src/panicking.rs:150:5
   3: ofborg::nix::tests::assert_run
             at ./src/nix.rs:545:13
   4: ofborg::nix::tests::strict_sandboxing
             at ./src/nix.rs:848:9
   5: ofborg::nix::tests::strict_sandboxing::{{closure}}
             at ./src/nix.rs:841:28
   6: core::ops::function::FnOnce::call_once
             at /build/rustc-1.72.0-src/library/core/src/ops/function.rs:250:5
note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.

Can't the non-failure with

derivation {
  name = "sandbox-violation";
  system = builtins.currentSystem;
  src = ./../../../lib;
  builder = builtins.storePath <bash>;
  args = [ "-c" "echo hi; echo ${toString builtins.currentTime} > $out" ];
}

in depth0/depth1/depth3/default.nix in nixpkgs

$ nix shell "nixpkgs#nixVersions.nix_2_16" --command nix-build depth0/depth1/depth3/default.nix -I "bash=$(command -v bash)" --option restrict-eval true
error: access to absolute path '/home/artturin/nixgits/my-nixpkgs/depth0/depth1/depth3/default.nix' is forbidden in restricted mode

Can't repro the non-failure with

derivation {
  name = "sandbox-violation";
  system = builtins.currentSystem;
  src = ./../../../lib;
  builder = builtins.storePath <bash>;
  args = [ "-c" "echo hi; echo ${toString builtins.currentTime} > $out" ];
}

in depth0/depth1/depth3/default.nix in nixpkgs

$ nix shell "nixpkgs#nixVersions.nix_2_16" --command nix-build depth0/depth1/depth3/default.nix -I "bash=$(command -v bash)" --option restrict-eval true
error: access to absolute path '/home/artturin/nixgits/my-nixpkgs/depth0/depth1/depth3/default.nix' is forbidden in restricted mode

In reply to @hexa:lossy.network
https://github.com/NixOS/nixpkgs/pull/263041/checks?check_run_id=17994139695