tvl-depot/tvix/nix-compat/src/derivation/mod.rs

use crate::{
    nixhash::HashAlgo,
    store_path::{self, StorePath},
};
use serde::{Deserialize, Serialize};
use sha2::{Digest, Sha256};
use std::collections::{BTreeMap, BTreeSet};

mod errors;
mod output;
mod string_escape;
mod utils;
mod validate;
mod write;

#[cfg(test)]
mod tests;

// Public API of the crate.
pub use crate::nixhash::{NixHash, NixHashWithMode};
pub use errors::{DerivationError, OutputError};
pub use output::Output;
pub use utils::path_with_references;

#[derive(Clone, Debug, Default, Eq, PartialEq, Serialize, Deserialize)]
pub struct Derivation {
    #[serde(rename = "args")]
    pub arguments: Vec<String>,

    pub builder: String,

    #[serde(rename = "env")]
    pub environment: BTreeMap<String, String>,

    #[serde(rename = "inputDrvs")]
    pub input_derivations: BTreeMap<String, BTreeSet<String>>,

    #[serde(rename = "inputSrcs")]
    pub input_sources: BTreeSet<String>,

    pub outputs: BTreeMap<String, Output>,

    pub system: String,
}

impl Derivation {
    /// write the Derivation to the given [std::fmt::Write], in ATerm format.
    ///
    /// The only errors returns are these when writing to the passed writer.
    pub fn serialize(&self, writer: &mut impl std::fmt::Write) -> Result<(), std::fmt::Error> {
        writer.write_str(write::DERIVATION_PREFIX)?;
        writer.write_char(write::PAREN_OPEN)?;

        write::write_outputs(writer, &self.outputs)?;
        write::write_input_derivations(writer, &self.input_derivations)?;
        write::write_input_sources(writer, &self.input_sources)?;
        write::write_system(writer, &self.system)?;
        write::write_builder(writer, &self.builder)?;
        write::write_arguments(writer, &self.arguments)?;
        write::write_enviroment(writer, &self.environment)?;

        writer.write_char(write::PAREN_CLOSE)?;

        Ok(())
    }

    /// return the ATerm serialization as a string.
    pub fn to_aterm_string(&self) -> String {
        let mut buffer = String::new();

        // invoke serialize and write to the buffer.
        // Note we only propagate errors writing to the writer in serialize,
        // which won't panic for the string we write to.
        self.serialize(&mut buffer).unwrap();

        buffer
    }

    /// Returns the fixed output path and its [NixHashWithMode]
    /// (if the Derivation is fixed output), or None if there is no fixed output.
    /// This takes some shortcuts in case more than one output exists, as this
    /// can't be a valid fixed-output Derivation.
    pub fn get_fixed_output(&self) -> Option<(&String, &NixHashWithMode)> {
        if self.outputs.len() != 1 {
            return None;
        }

        if let Some(out_output) = self.outputs.get("out") {
            if let Some(out_output_hash) = &out_output.hash_with_mode {
                return Some((&out_output.path, out_output_hash));
            }
            // There has to be a hash, otherwise it would not be FOD
        }
        None
    }

    /// Returns the drv path of a Derivation struct.
    ///
    /// The drv path is calculated like this:
    ///   - Write the fingerprint of the Derivation to the sha256 hash function.
    ///     This is: `text:`,
    ///     all d.InputDerivations and d.InputSources (sorted, separated by a `:`),
    ///     a `:`,
    ///     the nix string representation of the sha256 sum of the ATerm representation
    ///     a `:`,
    ///     the storeDir, followed by a `:`,
    ///     the name of a derivation,
    ///     a `.drv`.
    ///   - Write the .drv A-Term contents to a hash function
    ///   - Take the digest, run hash.CompressHash(digest, 20) on it.
    ///   - Encode it with nixbase32
    ///   - Use it (and the name) to construct a [StorePath].
    pub fn calculate_derivation_path(&self, name: &str) -> Result<StorePath, DerivationError> {
        let mut s = String::from("text:");

        // collect the list of paths from input_sources and input_derivations
        // into a (sorted, guaranteed by BTreeSet) list, and join them by :
        let concat_inputs: BTreeSet<String> = {
            let mut inputs = self.input_sources.clone();
            let input_derivation_keys: Vec<String> =
                self.input_derivations.keys().cloned().collect();
            inputs.extend(input_derivation_keys);
            inputs
        };

        for input in concat_inputs {
            s.push_str(&input);
            s.push(':');
        }

        // calculate the sha256 hash of the ATerm representation, and represent
        // it as a hex-encoded string (prefixed with sha256:).
        let aterm_digest = {
            let mut derivation_hasher = Sha256::new();
            derivation_hasher.update(self.to_aterm_string());
            derivation_hasher.finalize()
        };

        let h = NixHash::new(crate::nixhash::HashAlgo::Sha256, aterm_digest.to_vec());

        s.push_str(&format!(
            "{}:{}:{}.drv",
            h.to_nix_hash_string(),
            store_path::STORE_DIR,
            name,
        ));

        utils::build_store_path(true, &s, name)
    }

    /// Calculates the hash of a derivation modulo fixed-output subderivations.
    ///
    /// This is called `hashDerivationModulo` in nixcpp.
    ///
    /// It returns a [NixHash], created by calculating the sha256 digest of
    /// the derivation ATerm representation, except that:
    ///  -  any input derivation paths have beed replaced "by the result of a
    ///     recursive call to this function" and that
    ///  - for fixed-output derivations the special
    ///    `fixed:out:${algo}:${digest}:${fodPath}` string is hashed instead of
    ///    the A-Term.
    ///
    /// If the derivation is not a fixed derivation, it's up to the caller of
    /// this function to provide a lookup function to lookup these calculation
    /// results of parent derivations at `fn_get_hash_derivation_modulo` (by
    /// drv path).
    pub fn derivation_or_fod_hash<F>(&self, fn_get_derivation_or_fod_hash: F) -> NixHash
    where
        F: Fn(&str) -> NixHash,
    {
        let mut hasher = Sha256::new();
        let digest = match self.get_fixed_output() {
            // Fixed-output derivations return a fixed hash
            Some((fixed_output_path, fixed_output_hash)) => {
                hasher.update(format!(
                    "fixed:out:{}:{}",
                    fixed_output_hash.to_nix_hash_string(),
                    fixed_output_path
                ));
                hasher.finalize()
            }
            // Non-Fixed-output derivations return a hash of the ATerm notation, but with all
            // input_derivation paths replaced by a recursive call to this function.
            // We use fn_get_derivation_or_fod_hash here, so callers can precompute this.
            None => {
                // This is a new map from derivation_or_fod_hash.digest (as lowerhex)
                // to list of output names
                let mut replaced_input_derivations: BTreeMap<String, BTreeSet<String>> =
                    BTreeMap::new();

                // For each input_derivation, look up the
                // derivation_or_fod_hash, and replace the derivation path with it's HEXLOWER
                // digest.
                // This is not the [NixHash::to_nix_hash_string], but without the sha256: prefix).
                for (drv_path, output_names) in &self.input_derivations {
                    replaced_input_derivations.insert(
                        data_encoding::HEXLOWER
                            .encode(&fn_get_derivation_or_fod_hash(drv_path).digest),
                        output_names.clone(),
                    );
                }

                // construct a new derivation struct with these replaced input derivation strings
                let replaced_derivation = Derivation {
                    input_derivations: replaced_input_derivations,
                    ..self.clone()
                };

                // write the ATerm of that to the hash function
                hasher.update(replaced_derivation.to_aterm_string());

                hasher.finalize()
            }
        };
        NixHash::new(crate::nixhash::HashAlgo::Sha256, digest.to_vec())
    }

    /// This calculates all output paths of a Derivation and updates the struct.
    /// It requires the struct to be initially without output paths.
    /// This means, self.outputs[$outputName].path needs to be an empty string,
    /// and self.environment[$outputName] needs to be an empty string.
    ///
    /// Output path calculation requires knowledge of the
    /// derivation_or_fod_hash [NixHash], which (in case of non-fixed-output
    /// derivations) also requires knowledge of other hash_derivation_modulo
    /// [NixHash]es.
    ///
    /// We solve this by asking the caller of this function to provide the
    /// hash_derivation_modulo of the current Derivation.
    ///
    /// On completion, self.environment[$outputName] and
    /// self.outputs[$outputName].path are set to the calculated output path for all
    /// outputs.
    pub fn calculate_output_paths(
        &mut self,
        name: &str,
        derivation_or_fod_hash: &NixHash,
    ) -> Result<(), DerivationError> {
        // Check if the Derivation is fixed output, because they cause
        // different fingerprints to be hashed.
        match self.get_fixed_output() {
            None => {
                // The fingerprint and hash differs per output
                for (output_name, output) in self.outputs.iter_mut() {
                    // Assert that outputs are not yet populated, to avoid using this function wrongly.
                    // We don't also go over self.environment, but it's a sufficient
                    // footgun prevention mechanism.
                    assert!(output.path.is_empty());

                    // calculate the output_name_path, which is the part of the NixPath after the digest.
                    let mut output_path_name = name.to_string();
                    if output_name != "out" {
                        output_path_name.push('-');
                        output_path_name.push_str(output_name);
                    }

                    let fp = &format!(
                        "output:{}:{}:{}:{}",
                        output_name,
                        derivation_or_fod_hash.to_nix_hash_string(),
                        store_path::STORE_DIR,
                        output_path_name,
                    );

                    let abs_store_path =
                        utils::build_store_path(false, fp, &output_path_name)?.to_absolute_path();

                    output.path = abs_store_path.clone();
                    self.environment
                        .insert(output_name.to_string(), abs_store_path);
                }
            }
            Some((fixed_output_path, fixed_output_hash)) => {
                // Assert that outputs are not yet populated, to avoid using this function wrongly.
                // We don't also go over self.environment, but it's a sufficient
                // footgun prevention mechanism.
                assert!(fixed_output_path.is_empty());

                let fp = {
                    let mut fp = String::new();
                    // Fixed-output derivation.
                    // There's two different hashing strategies in place,
                    // depending on whether the hash is recursive AND sha256 or anything else.
                    // This code is _weird_ but it is what Nix is doing. See:
                    // https://github.com/NixOS/nix/blob/1385b2007804c8a0370f2a6555045a00e34b07c7/src/libstore/store-api.cc#L178-L196
                    if let NixHashWithMode::Recursive(recursive_hash) = fixed_output_hash {
                        if recursive_hash.algo == HashAlgo::Sha256 {
                            fp.push_str(&format!("source:{}", recursive_hash.to_nix_hash_string()));
                        } else {
                            // This is similar to the FOD case, with an empty fixed_output_path.
                            fp.push_str(&format!(
                                "output:out:{}",
                                derivation_or_fod_hash.to_nix_hash_string(),
                            ));
                        }
                    } else {
                        // This is similar to the FOD case, with an empty fixed_output_path.
                        fp.push_str(&format!(
                            "output:out:{}",
                            derivation_or_fod_hash.to_nix_hash_string(),
                        ));
                    }
                    fp.push_str(&format!(":{}:{}", store_path::STORE_DIR, name));
                    fp
                };

                let abs_store_path = utils::build_store_path(false, &fp, name)?.to_absolute_path();

                self.outputs.insert(
                    "out".to_string(),
                    Output {
                        path: abs_store_path.clone(),
                        hash_with_mode: Some(fixed_output_hash.clone()),
                    },
                );
                self.environment.insert("out".to_string(), abs_store_path);
            }
        };

        Ok(())
    }
}