Skip to content

Fine-grained impurity #8865

@figsoda

Description

@figsoda

Is your feature request related to a problem? Please describe.

I found myself needing to use --impure with flakes just to give it access to NIXPKGS_ALLOW_UNFREE or the current directory. This is fine, but this is dangerous with untrusted nix code, and having to use --impure with flakes just doesn't feel good.

Describe the solution you'd like

Not everything has to be implemented, but this is what I imagine it would look like

nix build --expr "..." \
    --impure-for currentSystem # allow access to `builtins.currentSystem`
    --impure-for env:NIXPKGS_ALLOW_UNFREE=1 \ # allow evaluating unfree packages
    --impure-for env:NIXPKGS_ALLOW_UNFREE \ # pass through $NIXPKGS_ALLOW_UNFREE
    --impure-for ./. \ # allow access to the current directory
    --impure-for flake:nixpkgs # allow access to `builtins.getFlake "nixpkgs"`

Describe alternatives you've considered

Additional context

Not sure if this is a duplicate, because I don't know what to search in the issue tracker.

Priorities

Add 👍 to issues you find important.

Metadata

Metadata

Assignees

No one assigned

    Labels

    featureFeature request or proposal
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions