Fix InstallableCommand

macOS doesn't have GLOB_ONLYDIR.

.github/workflows/test.yml

@@ -10,5 +10,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - uses: actions/checkout@v2
+      with:
+        fetch-depth: 0
     - uses: cachix/install-nix-action@v8
-    - run: nix-build release.nix --arg nix '{ outPath = ./.; revCount = 123; shortRev = "abcdefgh"; }' --arg systems '[ builtins.currentSystem ]' -A installerScript -A perlBindings
+    #- run: nix flake check
+    - run: nix-build -A checks.$(if [[ `uname` = Linux ]]; then echo x86_64-linux; else echo x86_64-darwin; fi)

Makefile

@@ -11,6 +11,7 @@ makefiles = \
   src/resolve-system-dependencies/local.mk \
   scripts/local.mk \
   corepkgs/local.mk \
+  misc/bash/local.mk \
   misc/systemd/local.mk \
   misc/launchd/local.mk \
   misc/upstart/local.mk \

configure.ac

@@ -123,6 +123,7 @@ AC_PATH_PROG(flex, flex, false)
 AC_PATH_PROG(bison, bison, false)
 AC_PATH_PROG(dot, dot)
 AC_PATH_PROG(lsof, lsof, lsof)
+NEED_PROG(jq, jq)
 
 
 AC_SUBST(coreutils, [$(dirname $(type -p cat))])

default.nix

@@ -0,0 +1,3 @@
+(import (fetchTarball https://github.com/edolstra/flake-compat/archive/master.tar.gz) {
+  src = builtins.fetchGit ./.;
+}).defaultNix

flake.lock

@@ -0,0 +1,28 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "info": {
+        "lastModified": 1585405475,
+        "narHash": "sha256-bESW0n4KgPmZ0luxvwJ+UyATrC6iIltVCsGdLiphVeE="
+      },
+      "locked": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b88ff468e9850410070d4e0ccd68c7011f15b2be",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-20.03-small",
+        "type": "indirect"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 5
+}

flake.nix

@@ -0,0 +1,510 @@
+{
+  description = "The purely functional package manager";
+
+  edition = 201909; # FIXME: remove
+
+  inputs.nixpkgs.url = "nixpkgs/nixos-20.03-small";
+
+  outputs = { self, nixpkgs }:
+
+    let
+
+      version = builtins.readFile ./.version + versionSuffix;
+      versionSuffix =
+        if officialRelease
+        then ""
+        else "pre${builtins.substring 0 8 (self.lastModifiedDate or self.lastModified)}_${self.shortRev or "dirty"}";
+
+      officialRelease = false;
+
+      systems = [ "x86_64-linux" "i686-linux" "x86_64-darwin" "aarch64-linux" ];
+
+      forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f system);
+
+      # Memoize nixpkgs for different platforms for efficiency.
+      nixpkgsFor = forAllSystems (system:
+        import nixpkgs {
+          inherit system;
+          overlays = [ self.overlay ];
+        }
+      );
+
+      commonDeps = pkgs: with pkgs; rec {
+        # Use "busybox-sandbox-shell" if present,
+        # if not (legacy) fallback and hope it's sufficient.
+        sh = pkgs.busybox-sandbox-shell or (busybox.override {
+          useMusl = true;
+          enableStatic = true;
+          enableMinimal = true;
+          extraConfig = ''
+            CONFIG_FEATURE_FANCY_ECHO y
+            CONFIG_FEATURE_SH_MATH y
+            CONFIG_FEATURE_SH_MATH_64 y
+
+            CONFIG_ASH y
+            CONFIG_ASH_OPTIMIZE_FOR_SIZE y
+
+            CONFIG_ASH_ALIAS y
+            CONFIG_ASH_BASH_COMPAT y
+            CONFIG_ASH_CMDCMD y
+            CONFIG_ASH_ECHO y
+            CONFIG_ASH_GETOPTS y
+            CONFIG_ASH_INTERNAL_GLOB y
+            CONFIG_ASH_JOB_CONTROL y
+            CONFIG_ASH_PRINTF y
+            CONFIG_ASH_TEST y
+          '';
+        });
+
+        configureFlags =
+          lib.optionals stdenv.isLinux [
+            "--with-sandbox-shell=${sh}/bin/busybox"
+          ];
+
+        buildDeps =
+          [ bison
+            flex
+            libxml2
+            libxslt
+            docbook5
+            docbook_xsl_ns
+            autoconf-archive
+            autoreconfHook
+
+            curl
+            bzip2 xz brotli zlib editline
+            openssl pkgconfig sqlite
+            libarchive
+            boost
+            (if lib.versionAtLeast lib.version "20.03pre"
+             then nlohmann_json
+             else nlohmann_json.override { multipleHeaders = true; })
+            nlohmann_json
+            rustc cargo
+
+            # Tests
+            git
+            mercurial
+            jq
+          ]
+          ++ lib.optionals stdenv.isLinux [libseccomp utillinuxMinimal]
+          ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
+          ++ lib.optional (stdenv.isLinux || stdenv.isDarwin)
+            (aws-sdk-cpp.override {
+              apis = ["s3" "transfer"];
+              customMemoryManagement = false;
+            });
+
+        propagatedDeps =
+          [ (boehmgc.override { enableLargeConfig = true; })
+          ];
+
+        perlDeps =
+          [ perl
+            perlPackages.DBDSQLite
+          ];
+      };
+
+    in {
+
+      # A Nixpkgs overlay that overrides the 'nix' and
+      # 'nix.perl-bindings' packages.
+      overlay = final: prev: {
+
+        nix = with final; with commonDeps pkgs; (stdenv.mkDerivation {
+          name = "nix-${version}";
+
+          src = self;
+
+          VERSION_SUFFIX = versionSuffix;
+
+          outputs = [ "out" "dev" "doc" ];
+
+          buildInputs = buildDeps;
+
+          propagatedBuildInputs = propagatedDeps;
+
+          preConfigure =
+            ''
+              # Copy libboost_context so we don't get all of Boost in our closure.
+              # https://github.com/NixOS/nixpkgs/issues/45462
+              mkdir -p $out/lib
+              cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib
+              rm -f $out/lib/*.a
+              ${lib.optionalString stdenv.isLinux ''
+                chmod u+w $out/lib/*.so.*
+                patchelf --set-rpath $out/lib:${stdenv.cc.cc.lib}/lib $out/lib/libboost_thread.so.*
+              ''}
+
+              ln -sfn ${final.nixVendoredCrates}/vendor/ nix-rust/vendor
+            '';
+
+          configureFlags = configureFlags ++
+            [ "--sysconfdir=/etc" ];
+
+          enableParallelBuilding = true;
+
+          makeFlags = "profiledir=$(out)/etc/profile.d";
+
+          doCheck = true;
+
+          installFlags = "sysconfdir=$(out)/etc";
+
+          doInstallCheck = true;
+          installCheckFlags = "sysconfdir=$(out)/etc";
+
+          separateDebugInfo = true;
+
+          preDist = ''
+            mkdir -p $doc/nix-support
+            echo "doc manual $doc/share/doc/nix/manual" >> $doc/nix-support/hydra-build-products
+          '';
+        }) // {
+
+          perl-bindings = with final; stdenv.mkDerivation {
+            name = "nix-perl-${version}";
+
+            src = self;
+
+            buildInputs =
+              [ autoconf-archive
+                autoreconfHook
+                nix
+                curl
+                bzip2
+                xz
+                pkgconfig
+                pkgs.perl
+                boost
+              ]
+              ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium;
+
+            configureFlags = ''
+              --with-dbi=${perlPackages.DBI}/${pkgs.perl.libPrefix}
+              --with-dbd-sqlite=${perlPackages.DBDSQLite}/${pkgs.perl.libPrefix}
+            '';
+
+            enableParallelBuilding = true;
+
+            postUnpack = "sourceRoot=$sourceRoot/perl";
+          };
+
+        };
+
+        # Create a "vendor" directory that contains the crates listed in
+        # Cargo.lock, and include it in the Nix tarball. This allows Nix
+        # to be built without network access.
+        nixVendoredCrates =
+          let
+            lockFile = builtins.fromTOML (builtins.readFile nix-rust/Cargo.lock);
+
+            files = map (pkg: import <nix/fetchurl.nix> {
+              url = "https://crates.io/api/v1/crates/${pkg.name}/${pkg.version}/download";
+              sha256 = lockFile.metadata."checksum ${pkg.name} ${pkg.version} (registry+https://github.com/rust-lang/crates.io-index)";
+            }) (builtins.filter (pkg: pkg.source or "" == "registry+https://github.com/rust-lang/crates.io-index") lockFile.package);
+
+          in final.runCommand "cargo-vendor-dir" {}
+            ''
+              mkdir -p $out/vendor
+
+              cat > $out/vendor/config <<EOF
+              [source.crates-io]
+              replace-with = "vendored-sources"
+
+              [source.vendored-sources]
+              directory = "vendor"
+              EOF
+
+              ${toString (builtins.map (file: ''
+                mkdir $out/vendor/tmp
+                tar xvf ${file} -C $out/vendor/tmp
+                dir=$(echo $out/vendor/tmp/*)
+
+                # Add just enough metadata to keep Cargo happy.
+                printf '{"files":{},"package":"${file.outputHash}"}' > "$dir/.cargo-checksum.json"
+
+                # Clean up some cruft from the winapi crates. FIXME: find
+                # a way to remove winapi* from our dependencies.
+                if [[ $dir =~ /winapi ]]; then
+                  find $dir -name "*.a" -print0 | xargs -0 rm -f --
+                fi
+
+                mv "$dir" $out/vendor/
+
+                rm -rf $out/vendor/tmp
+              '') files)}
+            '';
+
+      };
+
+      hydraJobs = {
+
+        vendoredCrates =
+          with nixpkgsFor.x86_64-linux;
+
+          runCommand "vendored-crates" {}
+            ''
+              mkdir -p $out/nix-support
+              name=nix-vendored-crates-${version}
+              fn=$out/$name.tar.xz
+              tar cvfJ $fn -C ${nixVendoredCrates} vendor \
+                --owner=0 --group=0 --mode=u+rw,uga+r \
+                --transform "s,vendor,$name,"
+              echo "file crates-tarball $fn" >> $out/nix-support/hydra-build-products
+            '';
+
+        # Binary package for various platforms.
+        build = nixpkgs.lib.genAttrs systems (system: nixpkgsFor.${system}.nix);
+
+        # Perl bindings for various platforms.
+        perlBindings = nixpkgs.lib.genAttrs systems (system: nixpkgsFor.${system}.nix.perl-bindings);
+
+        # Binary tarball for various platforms, containing a Nix store
+        # with the closure of 'nix' package, and the second half of
+        # the installation script.
+        binaryTarball = nixpkgs.lib.genAttrs systems (system:
+
+          with nixpkgsFor.${system};
+
+          let
+            installerClosureInfo = closureInfo { rootPaths = [ nix cacert ]; };
+          in
+
+          runCommand "nix-binary-tarball-${version}"
+            { #nativeBuildInputs = lib.optional (system != "aarch64-linux") shellcheck;
+              meta.description = "Distribution-independent Nix bootstrap binaries for ${system}";
+            }
+            ''
+              cp ${installerClosureInfo}/registration $TMPDIR/reginfo
+              substitute ${./scripts/install-nix-from-closure.sh} $TMPDIR/install \
+                --subst-var-by nix ${nix} \
+                --subst-var-by cacert ${cacert}
+
+              substitute ${./scripts/install-darwin-multi-user.sh} $TMPDIR/install-darwin-multi-user.sh \
+                --subst-var-by nix ${nix} \
+                --subst-var-by cacert ${cacert}
+              substitute ${./scripts/install-systemd-multi-user.sh} $TMPDIR/install-systemd-multi-user.sh \
+                --subst-var-by nix ${nix} \
+                --subst-var-by cacert ${cacert}
+              substitute ${./scripts/install-multi-user.sh} $TMPDIR/install-multi-user \
+                --subst-var-by nix ${nix} \
+                --subst-var-by cacert ${cacert}
+
+              if type -p shellcheck; then
+                # SC1090: Don't worry about not being able to find
+                #         $nix/etc/profile.d/nix.sh
+                shellcheck --exclude SC1090 $TMPDIR/install
+                shellcheck $TMPDIR/install-darwin-multi-user.sh
+                shellcheck $TMPDIR/install-systemd-multi-user.sh
+
+                # SC1091: Don't panic about not being able to source
+                #         /etc/profile
+                # SC2002: Ignore "useless cat" "error", when loading
+                #         .reginfo, as the cat is a much cleaner
+                #         implementation, even though it is "useless"
+                # SC2116: Allow ROOT_HOME=$(echo ~root) for resolving
+                #         root's home directory
+                shellcheck --external-sources \
+                  --exclude SC1091,SC2002,SC2116 $TMPDIR/install-multi-user
+              fi
+
+              chmod +x $TMPDIR/install
+              chmod +x $TMPDIR/install-darwin-multi-user.sh
+              chmod +x $TMPDIR/install-systemd-multi-user.sh
+              chmod +x $TMPDIR/install-multi-user
+              dir=nix-${version}-${system}
+              fn=$out/$dir.tar.xz
+              mkdir -p $out/nix-support
+              echo "file binary-dist $fn" >> $out/nix-support/hydra-build-products
+              tar cvfJ $fn \
+                --owner=0 --group=0 --mode=u+rw,uga+r \
+                --absolute-names \
+                --hard-dereference \
+                --transform "s,$TMPDIR/install,$dir/install," \
+                --transform "s,$TMPDIR/reginfo,$dir/.reginfo," \
+                --transform "s,$NIX_STORE,$dir/store,S" \
+                $TMPDIR/install $TMPDIR/install-darwin-multi-user.sh \
+                $TMPDIR/install-systemd-multi-user.sh \
+                $TMPDIR/install-multi-user $TMPDIR/reginfo \
+                $(cat ${installerClosureInfo}/store-paths)
+            '');
+
+        # The first half of the installation script. This is uploaded
+        # to https://nixos.org/nix/install. It downloads the binary
+        # tarball for the user's system and calls the second half of the
+        # installation script.
+        installerScript =
+          with nixpkgsFor.x86_64-linux;
+          runCommand "installer-script"
+            { buildInputs = [ nix ];
+            }
+            ''
+              mkdir -p $out/nix-support
+
+              substitute ${./scripts/install.in} $out/install \
+                ${pkgs.lib.concatMapStrings
+                  (system: "--replace '@binaryTarball_${system}@' $(nix --experimental-features nix-command hash-file --base16 --type sha256 ${self.hydraJobs.binaryTarball.${system}}/*.tar.xz) ")
+                  [ "x86_64-linux" "i686-linux" "x86_64-darwin" "aarch64-linux" ]
+                } \
+                --replace '@nixVersion@' ${version}
+
+              echo "file installer $out/install" >> $out/nix-support/hydra-build-products
+            '';
+
+        # Line coverage analysis.
+        coverage =
+          with nixpkgsFor.x86_64-linux;
+          with commonDeps pkgs;
+
+          releaseTools.coverageAnalysis {
+            name = "nix-coverage-${version}";
+
+            src = self;
+
+            preConfigure =
+              ''
+                ln -sfn ${nixVendoredCrates}/vendor/ nix-rust/vendor
+              '';
+
+            enableParallelBuilding = true;
+
+            buildInputs = buildDeps ++ propagatedDeps;
+
+            dontInstall = false;
+
+            doInstallCheck = true;
+
+            lcovFilter = [ "*/boost/*" "*-tab.*" ];
+
+            # We call `dot', and even though we just use it to
+            # syntax-check generated dot files, it still requires some
+            # fonts.  So provide those.
+            FONTCONFIG_FILE = texFunctions.fontsConf;
+
+            # To test building without precompiled headers.
+            makeFlagsArray = [ "PRECOMPILE_HEADERS=0" ];
+          };
+
+        # System tests.
+        tests.remoteBuilds = import ./tests/remote-builds.nix {
+          system = "x86_64-linux";
+          inherit nixpkgs;
+          inherit (self) overlay;
+        };
+
+        tests.nix-copy-closure = import ./tests/nix-copy-closure.nix {
+          system = "x86_64-linux";
+          inherit nixpkgs;
+          inherit (self) overlay;
+        };
+
+        tests.githubFlakes = (import ./tests/github-flakes.nix rec {
+          system = "x86_64-linux";
+          inherit nixpkgs;
+          inherit (self) overlay;
+        });
+
+        tests.setuid = nixpkgs.lib.genAttrs
+          ["i686-linux" "x86_64-linux"]
+          (system:
+            import ./tests/setuid.nix rec {
+              inherit nixpkgs system;
+              inherit (self) overlay;
+            });
+
+        # Test whether the binary tarball works in an Ubuntu system.
+        tests.binaryTarball =
+          with nixpkgsFor.x86_64-linux;
+          vmTools.runInLinuxImage (runCommand "nix-binary-tarball-test"
+            { diskImage = vmTools.diskImages.ubuntu1204x86_64;
+            }
+            ''
+              set -x
+              useradd -m alice
+              su - alice -c 'tar xf ${self.hydraJobs.binaryTarball.x86_64-linux}/*.tar.*'
+              mkdir /dest-nix
+              mount -o bind /dest-nix /nix # Provide a writable /nix.
+              chown alice /nix
+              su - alice -c '_NIX_INSTALLER_TEST=1 ./nix-*/install'
+              su - alice -c 'nix-store --verify'
+              su - alice -c 'PAGER= nix-store -qR ${self.hydraJobs.build.x86_64-linux}'
+
+              # Check whether 'nix upgrade-nix' works.
+              cat > /tmp/paths.nix <<EOF
+              {
+                x86_64-linux = "${self.hydraJobs.build.x86_64-linux}";
+              }
+              EOF
+              su - alice -c 'nix --experimental-features nix-command upgrade-nix -vvv --nix-store-paths-url file:///tmp/paths.nix'
+              (! [ -L /home/alice/.profile-1-link ])
+              su - alice -c 'PAGER= nix-store -qR ${self.hydraJobs.build.x86_64-linux}'
+
+              mkdir -p $out/nix-support
+              touch $out/nix-support/hydra-build-products
+              umount /nix
+            '');
+
+        /*
+        # Check whether we can still evaluate all of Nixpkgs.
+        tests.evalNixpkgs =
+          import (nixpkgs + "/pkgs/top-level/make-tarball.nix") {
+            # FIXME: fix pkgs/top-level/make-tarball.nix in NixOS to not require a revCount.
+            inherit nixpkgs;
+            pkgs = nixpkgsFor.x86_64-linux;
+            officialRelease = false;
+          };
+
+        # Check whether we can still evaluate NixOS.
+        tests.evalNixOS =
+          with nixpkgsFor.x86_64-linux;
+          runCommand "eval-nixos" { buildInputs = [ nix ]; }
+            ''
+              export NIX_STATE_DIR=$TMPDIR
+
+              nix-instantiate ${nixpkgs}/nixos/release-combined.nix -A tested --dry-run \
+                --arg nixpkgs '{ outPath = ${nixpkgs}; revCount = 123; shortRev = "abcdefgh"; }'
+
+              touch $out
+            '';
+        */
+
+      };
+
+      checks = forAllSystems (system: {
+        binaryTarball = self.hydraJobs.binaryTarball.${system};
+        perlBindings = self.hydraJobs.perlBindings.${system};
+      });
+
+      packages = forAllSystems (system: {
+        inherit (nixpkgsFor.${system}) nix;
+      });
+
+      defaultPackage = forAllSystems (system: self.packages.${system}.nix);
+
+      devShell = forAllSystems (system:
+        with nixpkgsFor.${system};
+        with commonDeps pkgs;
+
+        stdenv.mkDerivation {
+          name = "nix";
+
+          buildInputs = buildDeps ++ propagatedDeps ++ perlDeps ++ [ pkgs.rustfmt ];
+
+          inherit configureFlags;
+
+          enableParallelBuilding = true;
+
+          installFlags = "sysconfdir=$(out)/etc";
+
+          shellHook =
+            ''
+              export prefix=$(pwd)/inst
+              configureFlags+=" --prefix=$prefix"
+              PKG_CONFIG_PATH=$prefix/lib/pkgconfig:$PKG_CONFIG_PATH
+              PATH=$prefix/bin:$PATH
+              unset PYTHONPATH
+            '';
+        });
+
+  };
+}

local.mk

@@ -8,7 +8,7 @@ clean-files += Makefile.config
 
 GLOBAL_CXXFLAGS += -Wno-deprecated-declarations
 
-$(foreach i, config.h $(call rwildcard, src/lib*, *.hh), \
+$(foreach i, config.h $(wildcard src/lib*/*.hh), \
   $(eval $(call install-file-in, $(i), $(includedir)/nix, 0644)))
 
 $(GCH) $(PCH): src/libutil/util.hh config.h

misc/bash/completion.sh

@@ -0,0 +1,19 @@
+function _complete_nix {
+    local -a words
+    local cword cur
+    _get_comp_words_by_ref -n ':=&' words cword cur
+    local have_type
+    while IFS= read -r line; do
+        if [[ -z $have_type ]]; then
+            have_type=1
+            if [[ $line = filenames ]]; then
+                compopt -o filenames
+            fi
+        else
+            COMPREPLY+=("$line")
+        fi
+    done < <(NIX_GET_COMPLETIONS=$cword "${words[@]}")
+    __ltrim_colon_completions "$cur"
+}
+
+complete -F _complete_nix nix

misc/bash/local.mk

@@ -0,0 +1 @@
+$(eval $(call install-file-as, $(d)/completion.sh, $(datarootdir)/bash-completion/completions/_nix3, 0644))

release-common.nix

@@ -1,82 +0,0 @@
-{ pkgs }:
-
-with pkgs;
-
-rec {
-  # Use "busybox-sandbox-shell" if present,
-  # if not (legacy) fallback and hope it's sufficient.
-  sh = pkgs.busybox-sandbox-shell or (busybox.override {
-    useMusl = true;
-    enableStatic = true;
-    enableMinimal = true;
-    extraConfig = ''
-      CONFIG_FEATURE_FANCY_ECHO y
-      CONFIG_FEATURE_SH_MATH y
-      CONFIG_FEATURE_SH_MATH_64 y
-
-      CONFIG_ASH y
-      CONFIG_ASH_OPTIMIZE_FOR_SIZE y
-
-      CONFIG_ASH_ALIAS y
-      CONFIG_ASH_BASH_COMPAT y
-      CONFIG_ASH_CMDCMD y
-      CONFIG_ASH_ECHO y
-      CONFIG_ASH_GETOPTS y
-      CONFIG_ASH_INTERNAL_GLOB y
-      CONFIG_ASH_JOB_CONTROL y
-      CONFIG_ASH_PRINTF y
-      CONFIG_ASH_TEST y
-    '';
-  });
-
-  configureFlags =
-    lib.optionals stdenv.isLinux [
-      "--with-sandbox-shell=${sh}/bin/busybox"
-    ];
-
-  buildDeps =
-    [ bison
-      flex
-      libxml2
-      libxslt
-      docbook5
-      docbook_xsl_ns
-      autoconf-archive
-      autoreconfHook
-
-      curl
-      bzip2 xz brotli zlib editline
-      openssl pkgconfig sqlite
-      libarchive
-      boost
-      nlohmann_json
-      rustc cargo
-
-      # Tests
-      git
-      mercurial
-    ]
-    ++ lib.optionals stdenv.isLinux [libseccomp utillinuxMinimal]
-    ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium
-    ++ lib.optional (stdenv.isLinux || stdenv.isDarwin)
-      ((aws-sdk-cpp.override {
-        apis = ["s3" "transfer"];
-        customMemoryManagement = false;
-      }).overrideDerivation (args: {
-        /*
-        patches = args.patches or [] ++ [ (fetchpatch {
-          url = https://github.com/edolstra/aws-sdk-cpp/commit/3e07e1f1aae41b4c8b340735ff9e8c735f0c063f.patch;
-          sha256 = "1pij0v449p166f9l29x7ppzk8j7g9k9mp15ilh5qxp29c7fnvxy2";
-        }) ];
-        */
-      }));
-
-  propagatedDeps =
-    [ (boehmgc.override { enableLargeConfig = true; })
-    ];
-
-  perlDeps =
-    [ perl
-      perlPackages.DBDSQLite
-    ];
-}

release.nix

@@ -1,360 +0,0 @@
-{ nix ? builtins.fetchGit ./.
-, nixpkgs ? builtins.fetchTarball https://github.com/NixOS/nixpkgs/archive/nixos-20.03-small.tar.gz
-, officialRelease ? false
-, systems ? [ "x86_64-linux" "i686-linux" "x86_64-darwin" "aarch64-linux" ]
-}:
-
-let
-
-  pkgs = import nixpkgs { system = builtins.currentSystem or "x86_64-linux"; };
-
-  version =
-    builtins.readFile ./.version
-    + (if officialRelease then "" else "pre${toString nix.revCount}_${nix.shortRev}");
-
-  # Create a "vendor" directory that contains the crates listed in
-  # Cargo.lock. This allows Nix to be built without network access.
-  vendoredCrates' =
-    let
-      lockFile = builtins.fromTOML (builtins.readFile nix-rust/Cargo.lock);
-
-      files = map (pkg: import <nix/fetchurl.nix> {
-        url = "https://crates.io/api/v1/crates/${pkg.name}/${pkg.version}/download";
-        sha256 = lockFile.metadata."checksum ${pkg.name} ${pkg.version} (registry+https://github.com/rust-lang/crates.io-index)";
-      }) (builtins.filter (pkg: pkg.source or "" == "registry+https://github.com/rust-lang/crates.io-index") lockFile.package);
-
-    in pkgs.runCommand "cargo-vendor-dir" {}
-      ''
-        mkdir -p $out/vendor
-
-        cat > $out/vendor/config <<EOF
-        [source.crates-io]
-        replace-with = "vendored-sources"
-
-        [source.vendored-sources]
-        directory = "vendor"
-        EOF
-
-        ${toString (builtins.map (file: ''
-          mkdir $out/vendor/tmp
-          tar xvf ${file} -C $out/vendor/tmp
-          dir=$(echo $out/vendor/tmp/*)
-
-          # Add just enough metadata to keep Cargo happy.
-          printf '{"files":{},"package":"${file.outputHash}"}' > "$dir/.cargo-checksum.json"
-
-          # Clean up some cruft from the winapi crates. FIXME: find
-          # a way to remove winapi* from our dependencies.
-          if [[ $dir =~ /winapi ]]; then
-            find $dir -name "*.a" -print0 | xargs -0 rm -f --
-          fi
-
-          mv "$dir" $out/vendor/
-
-          rm -rf $out/vendor/tmp
-        '') files)}
-      '';
-
-  jobs = rec {
-
-    vendoredCrates =
-      with pkgs;
-      runCommand "vendored-crates" {}
-        ''
-          mkdir -p $out/nix-support
-          name=nix-vendored-crates-${version}
-          fn=$out/$name.tar.xz
-            tar cvfJ $fn -C ${vendoredCrates'} vendor \
-              --owner=0 --group=0 --mode=u+rw,uga+r \
-              --transform "s,vendor,$name,"
-            echo "file crates-tarball $fn" >> $out/nix-support/hydra-build-products
-        '';
-
-    build = pkgs.lib.genAttrs systems (system:
-
-      let pkgs = import nixpkgs { inherit system; }; in
-
-      with pkgs;
-
-      with import ./release-common.nix { inherit pkgs; };
-
-      stdenv.mkDerivation {
-        name = "nix-${version}";
-
-        src = nix;
-
-        outputs = [ "out" "dev" "doc" ];
-
-        buildInputs = buildDeps;
-
-        propagatedBuildInputs = propagatedDeps;
-
-        preConfigure =
-          ''
-            # Copy libboost_context so we don't get all of Boost in our closure.
-            # https://github.com/NixOS/nixpkgs/issues/45462
-            mkdir -p $out/lib
-            cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib
-            rm -f $out/lib/*.a
-            ${lib.optionalString stdenv.isLinux ''
-              chmod u+w $out/lib/*.so.*
-              patchelf --set-rpath $out/lib:${stdenv.cc.cc.lib}/lib $out/lib/libboost_thread.so.*
-            ''}
-
-            ln -sfn ${vendoredCrates'}/vendor/ nix-rust/vendor
-
-            (cd perl; autoreconf --install --force --verbose)
-          '';
-
-        configureFlags = configureFlags ++
-          [ "--sysconfdir=/etc" ];
-
-        enableParallelBuilding = true;
-
-        makeFlags = "profiledir=$(out)/etc/profile.d";
-
-        installFlags = "sysconfdir=$(out)/etc";
-
-        doCheck = true;
-
-        doInstallCheck = true;
-        installCheckFlags = "sysconfdir=$(out)/etc";
-
-        separateDebugInfo = true;
-
-        preDist = ''
-          mkdir -p $doc/nix-support
-          echo "doc manual $doc/share/doc/nix/manual" >> $doc/nix-support/hydra-build-products
-        '';
-      });
-
-
-    perlBindings = pkgs.lib.genAttrs systems (system:
-
-      let pkgs = import nixpkgs { inherit system; }; in with pkgs;
-
-      releaseTools.nixBuild {
-        name = "nix-perl-${version}";
-
-        src = nix;
-
-        buildInputs =
-          [ autoconf-archive
-            autoreconfHook
-            jobs.build.${system}
-            curl
-            bzip2
-            xz
-            pkgconfig
-            pkgs.perl
-            boost
-          ]
-          ++ lib.optional (stdenv.isLinux || stdenv.isDarwin) libsodium;
-
-        configureFlags = ''
-          --with-dbi=${perlPackages.DBI}/${pkgs.perl.libPrefix}
-          --with-dbd-sqlite=${perlPackages.DBDSQLite}/${pkgs.perl.libPrefix}
-        '';
-
-        enableParallelBuilding = true;
-
-        postUnpack = "sourceRoot=$sourceRoot/perl";
-      });
-
-
-    binaryTarball = pkgs.lib.genAttrs systems (system:
-
-      with import nixpkgs { inherit system; };
-
-      let
-        toplevel = builtins.getAttr system jobs.build;
-        installerClosureInfo = closureInfo { rootPaths = [ toplevel cacert ]; };
-      in
-
-      runCommand "nix-binary-tarball-${version}"
-        { #nativeBuildInputs = lib.optional (system != "aarch64-linux") shellcheck;
-          meta.description = "Distribution-independent Nix bootstrap binaries for ${system}";
-        }
-        ''
-          cp ${installerClosureInfo}/registration $TMPDIR/reginfo
-          substitute ${./scripts/install-nix-from-closure.sh} $TMPDIR/install \
-            --subst-var-by nix ${toplevel} \
-            --subst-var-by cacert ${cacert}
-
-          substitute ${./scripts/install-darwin-multi-user.sh} $TMPDIR/install-darwin-multi-user.sh \
-            --subst-var-by nix ${toplevel} \
-            --subst-var-by cacert ${cacert}
-          substitute ${./scripts/install-systemd-multi-user.sh} $TMPDIR/install-systemd-multi-user.sh \
-            --subst-var-by nix ${toplevel} \
-            --subst-var-by cacert ${cacert}
-          substitute ${./scripts/install-multi-user.sh} $TMPDIR/install-multi-user \
-            --subst-var-by nix ${toplevel} \
-            --subst-var-by cacert ${cacert}
-
-          if type -p shellcheck; then
-            # SC1090: Don't worry about not being able to find
-            #         $nix/etc/profile.d/nix.sh
-            shellcheck --exclude SC1090 $TMPDIR/install
-            shellcheck $TMPDIR/install-darwin-multi-user.sh
-            shellcheck $TMPDIR/install-systemd-multi-user.sh
-
-            # SC1091: Don't panic about not being able to source
-            #         /etc/profile
-            # SC2002: Ignore "useless cat" "error", when loading
-            #         .reginfo, as the cat is a much cleaner
-            #         implementation, even though it is "useless"
-            # SC2116: Allow ROOT_HOME=$(echo ~root) for resolving
-            #         root's home directory
-            shellcheck --external-sources \
-              --exclude SC1091,SC2002,SC2116 $TMPDIR/install-multi-user
-          fi
-
-          chmod +x $TMPDIR/install
-          chmod +x $TMPDIR/install-darwin-multi-user.sh
-          chmod +x $TMPDIR/install-systemd-multi-user.sh
-          chmod +x $TMPDIR/install-multi-user
-          dir=nix-${version}-${system}
-          fn=$out/$dir.tar.xz
-          mkdir -p $out/nix-support
-          echo "file binary-dist $fn" >> $out/nix-support/hydra-build-products
-          tar cvfJ $fn \
-            --owner=0 --group=0 --mode=u+rw,uga+r \
-            --absolute-names \
-            --hard-dereference \
-            --transform "s,$TMPDIR/install,$dir/install," \
-            --transform "s,$TMPDIR/reginfo,$dir/.reginfo," \
-            --transform "s,$NIX_STORE,$dir/store,S" \
-            $TMPDIR/install $TMPDIR/install-darwin-multi-user.sh \
-            $TMPDIR/install-systemd-multi-user.sh \
-            $TMPDIR/install-multi-user $TMPDIR/reginfo \
-            $(cat ${installerClosureInfo}/store-paths)
-        '');
-
-
-    coverage =
-      with pkgs;
-
-      with import ./release-common.nix { inherit pkgs; };
-
-      releaseTools.coverageAnalysis {
-        name = "nix-coverage-${version}";
-
-        src = nix;
-
-        preConfigure =
-          ''
-            ln -sfn ${vendoredCrates'}/vendor/ nix-rust/vendor
-          '';
-
-        enableParallelBuilding = true;
-
-        buildInputs = buildDeps ++ propagatedDeps;
-
-        dontInstall = false;
-
-        doInstallCheck = true;
-
-        lcovFilter = [ "*/boost/*" "*-tab.*" ];
-
-        # We call `dot', and even though we just use it to
-        # syntax-check generated dot files, it still requires some
-        # fonts.  So provide those.
-        FONTCONFIG_FILE = texFunctions.fontsConf;
-
-        # To test building without precompiled headers.
-        makeFlagsArray = [ "PRECOMPILE_HEADERS=0" ];
-      };
-
-
-    # System tests.
-    tests.remoteBuilds = (import ./tests/remote-builds.nix rec {
-      inherit nixpkgs;
-      nix = build.x86_64-linux; system = "x86_64-linux";
-    });
-
-    tests.nix-copy-closure = (import ./tests/nix-copy-closure.nix rec {
-      inherit nixpkgs;
-      nix = build.x86_64-linux; system = "x86_64-linux";
-    });
-
-    tests.setuid = pkgs.lib.genAttrs
-      ["i686-linux" "x86_64-linux"]
-      (system:
-        import ./tests/setuid.nix rec {
-          inherit nixpkgs;
-          nix = build.${system}; inherit system;
-        });
-
-    tests.binaryTarball =
-      with import nixpkgs { system = "x86_64-linux"; };
-      vmTools.runInLinuxImage (runCommand "nix-binary-tarball-test"
-        { diskImage = vmTools.diskImages.ubuntu1204x86_64;
-        }
-        ''
-          set -x
-          useradd -m alice
-          su - alice -c 'tar xf ${binaryTarball.x86_64-linux}/*.tar.*'
-          mkdir /dest-nix
-          mount -o bind /dest-nix /nix # Provide a writable /nix.
-          chown alice /nix
-          su - alice -c '_NIX_INSTALLER_TEST=1 ./nix-*/install'
-          su - alice -c 'nix-store --verify'
-          su - alice -c 'PAGER= nix-store -qR ${build.x86_64-linux}'
-
-          # Check whether 'nix upgrade-nix' works.
-          cat > /tmp/paths.nix <<EOF
-          {
-            x86_64-linux = "${build.x86_64-linux}";
-          }
-          EOF
-          su - alice -c 'nix --experimental-features nix-command upgrade-nix -vvv --nix-store-paths-url file:///tmp/paths.nix'
-          (! [ -L /home/alice/.profile-1-link ])
-          su - alice -c 'PAGER= nix-store -qR ${build.x86_64-linux}'
-
-          mkdir -p $out/nix-support
-          touch $out/nix-support/hydra-build-products
-          umount /nix
-        ''); # */
-
-    /*
-    tests.evalNixpkgs =
-      import (nixpkgs + "/pkgs/top-level/make-tarball.nix") {
-        inherit nixpkgs;
-        inherit pkgs;
-        nix = build.x86_64-linux;
-        officialRelease = false;
-      };
-
-    tests.evalNixOS =
-      pkgs.runCommand "eval-nixos" { buildInputs = [ build.x86_64-linux ]; }
-        ''
-          export NIX_STATE_DIR=$TMPDIR
-
-          nix-instantiate ${nixpkgs}/nixos/release-combined.nix -A tested --dry-run \
-            --arg nixpkgs '{ outPath = ${nixpkgs}; revCount = 123; shortRev = "abcdefgh"; }'
-
-          touch $out
-        '';
-    */
-
-
-    installerScript =
-      pkgs.runCommand "installer-script"
-        { buildInputs = [ build.${builtins.currentSystem or "x86_64-linux"} ]; }
-        ''
-          mkdir -p $out/nix-support
-
-          substitute ${./scripts/install.in} $out/install \
-            ${pkgs.lib.concatMapStrings
-              (system: "--replace '@binaryTarball_${system}@' $(nix --experimental-features nix-command hash-file --base16 --type sha256 ${binaryTarball.${system}}/*.tar.xz) ")
-              systems
-            } \
-            --replace '@nixVersion@' ${version}
-
-          echo "file installer $out/install" >> $out/nix-support/hydra-build-products
-        '';
-
-  };
-
-
-in jobs

shell.nix

@@ -1,25 +1,3 @@
-{ useClang ? false }:
-
-with import (builtins.fetchTarball https://github.com/NixOS/nixpkgs/archive/nixos-20.03-small.tar.gz) {};
-
-with import ./release-common.nix { inherit pkgs; };
-
-(if useClang then clangStdenv else stdenv).mkDerivation {
-  name = "nix";
-
-  buildInputs = buildDeps ++ propagatedDeps ++ perlDeps ++ [ pkgs.rustfmt ];
-
-  inherit configureFlags;
-
-  enableParallelBuilding = true;
-
-  installFlags = "sysconfdir=$(out)/etc";
-
-  shellHook =
-    ''
-      export prefix=$(pwd)/inst
-      configureFlags+=" --prefix=$prefix"
-      PKG_CONFIG_PATH=$prefix/lib/pkgconfig:$PKG_CONFIG_PATH
-      PATH=$prefix/bin:$PATH
-    '';
-}
+(import (fetchTarball https://github.com/edolstra/flake-compat/archive/master.tar.gz) {
+  src = builtins.fetchGit ./.;
+}).shellNix

src/libexpr/attr-path.cc

@@ -6,11 +6,11 @@
 namespace nix {
 
 
-static Strings parseAttrPath(const string & s)
+static Strings parseAttrPath(std::string_view s)
 {
     Strings res;
     string cur;
-    string::const_iterator i = s.begin();
+    auto i = s.begin();
     while (i != s.end()) {
         if (*i == '.') {
             res.push_back(cur);
@@ -32,6 +32,15 @@ static Strings parseAttrPath(const string & s)
 }
 
 
+std::vector<Symbol> parseAttrPath(EvalState & state, std::string_view s)
+{
+    std::vector<Symbol> res;
+    for (auto & a : parseAttrPath(s))
+        res.push_back(state.symbols.create(a));
+    return res;
+}
+
+
 std::pair<Value *, Pos> findAlongAttrPath(EvalState & state, const string & attrPath,
     Bindings & autoArgs, Value & vIn)
 {

src/libexpr/attr-path.hh

@@ -16,4 +16,6 @@ std::pair<Value *, Pos> findAlongAttrPath(EvalState & state, const string & attr
 /* Heuristic to find the filename and lineno or a nix value. */
 Pos findDerivationFilename(EvalState & state, Value & v, std::string what);
 
+std::vector<Symbol> parseAttrPath(EvalState & state, std::string_view s);
+
 }

src/libexpr/common-eval-args.cc

@@ -4,6 +4,8 @@
 #include "util.hh"
 #include "eval.hh"
 #include "fetchers.hh"
+#include "registry.hh"
+#include "flake/flakeref.hh"
 #include "store-api.hh"
 
 namespace nix {
@@ -31,6 +33,27 @@ MixEvalArgs::MixEvalArgs()
         .labels = {"path"},
         .handler = {[&](std::string s) { searchPath.push_back(s); }}
     });
+
+    addFlag({
+        .longName = "impure",
+        .description = "allow access to mutable paths and repositories",
+        .handler = {[&]() {
+            evalSettings.pureEval = false;
+        }},
+    });
+
+    addFlag({
+        .longName = "override-flake",
+        .description = "override a flake registry value",
+        .labels = {"original-ref", "resolved-ref"},
+        .handler = {[&](std::string _from, std::string _to) {
+            auto from = parseFlakeRef(_from, absPath("."));
+            auto to = parseFlakeRef(_to, absPath("."));
+            fetchers::Attrs extraAttrs;
+            if (to.subdir != "") extraAttrs["dir"] = to.subdir;
+            fetchers::overrideRegistry(from.input, to.input, extraAttrs);
+        }}
+    });
 }
 
 Bindings * MixEvalArgs::getAutoArgs(EvalState & state)

src/libexpr/eval-cache.cc

@@ -0,0 +1,503 @@
+#include "eval-cache.hh"
+#include "sqlite.hh"
+#include "eval.hh"
+#include "eval-inline.hh"
+
+namespace nix::eval_cache {
+
+static const char * schema = R"sql(
+create table if not exists Attributes (
+    parent      integer not null,
+    name        text,
+    type        integer not null,
+    value       text,
+    primary key (parent, name)
+);
+)sql";
+
+struct AttrDb
+{
+    struct State
+    {
+        SQLite db;
+        SQLiteStmt insertAttribute;
+        SQLiteStmt queryAttribute;
+        SQLiteStmt queryAttributes;
+        std::unique_ptr<SQLiteTxn> txn;
+    };
+
+    std::unique_ptr<Sync<State>> _state;
+
+    AttrDb(const Hash & fingerprint)
+        : _state(std::make_unique<Sync<State>>())
+    {
+        auto state(_state->lock());
+
+        Path cacheDir = getCacheDir() + "/nix/eval-cache-v1";
+        createDirs(cacheDir);
+
+        Path dbPath = cacheDir + "/" + fingerprint.to_string(Base16, false) + ".sqlite";
+
+        state->db = SQLite(dbPath);
+        state->db.isCache();
+        state->db.exec(schema);
+
+        state->insertAttribute.create(state->db,
+            "insert or replace into Attributes(parent, name, type, value) values (?, ?, ?, ?)");
+
+        state->queryAttribute.create(state->db,
+            "select rowid, type, value from Attributes where parent = ? and name = ?");
+
+        state->queryAttributes.create(state->db,
+            "select name from Attributes where parent = ?");
+
+        state->txn = std::make_unique<SQLiteTxn>(state->db);
+    }
+
+    ~AttrDb()
+    {
+        try {
+            auto state(_state->lock());
+            state->txn->commit();
+            state->txn.reset();
+        } catch (...) {
+            ignoreException();
+        }
+    }
+
+    AttrId setAttrs(
+        AttrKey key,
+        const std::vector<Symbol> & attrs)
+    {
+        auto state(_state->lock());
+
+        state->insertAttribute.use()
+            (key.first)
+            (key.second)
+            (AttrType::FullAttrs)
+            (0, false).exec();
+
+        AttrId rowId = state->db.getLastInsertedRowId();
+        assert(rowId);
+
+        for (auto & attr : attrs)
+            state->insertAttribute.use()
+                (rowId)
+                (attr)
+                (AttrType::Placeholder)
+                (0, false).exec();
+
+        return rowId;
+    }
+
+    AttrId setString(
+        AttrKey key,
+        std::string_view s)
+    {
+        auto state(_state->lock());
+
+        state->insertAttribute.use()
+            (key.first)
+            (key.second)
+            (AttrType::String)
+            (s).exec();
+
+        return state->db.getLastInsertedRowId();
+    }
+
+    AttrId setBool(
+        AttrKey key,
+        bool b)
+    {
+        auto state(_state->lock());
+
+        state->insertAttribute.use()
+            (key.first)
+            (key.second)
+            (AttrType::Bool)
+            (b ? 1 : 0).exec();
+
+        return state->db.getLastInsertedRowId();
+    }
+
+    AttrId setPlaceholder(AttrKey key)
+    {
+        auto state(_state->lock());
+
+        state->insertAttribute.use()
+            (key.first)
+            (key.second)
+            (AttrType::Placeholder)
+            (0, false).exec();
+
+        return state->db.getLastInsertedRowId();
+    }
+
+    AttrId setMissing(AttrKey key)
+    {
+        auto state(_state->lock());
+
+        state->insertAttribute.use()
+            (key.first)
+            (key.second)
+            (AttrType::Missing)
+            (0, false).exec();
+
+        return state->db.getLastInsertedRowId();
+    }
+
+    AttrId setMisc(AttrKey key)
+    {
+        auto state(_state->lock());
+
+        state->insertAttribute.use()
+            (key.first)
+            (key.second)
+            (AttrType::Misc)
+            (0, false).exec();
+
+        return state->db.getLastInsertedRowId();
+    }
+
+    AttrId setFailed(AttrKey key)
+    {
+        auto state(_state->lock());
+
+        state->insertAttribute.use()
+            (key.first)
+            (key.second)
+            (AttrType::Failed)
+            (0, false).exec();
+
+        return state->db.getLastInsertedRowId();
+    }
+
+    std::optional<std::pair<AttrId, AttrValue>> getAttr(
+        AttrKey key,
+        SymbolTable & symbols)
+    {
+        auto state(_state->lock());
+
+        auto queryAttribute(state->queryAttribute.use()(key.first)(key.second));
+        if (!queryAttribute.next()) return {};
+
+        auto rowId = (AttrType) queryAttribute.getInt(0);
+        auto type = (AttrType) queryAttribute.getInt(1);
+
+        switch (type) {
+            case AttrType::Placeholder:
+                return {{rowId, placeholder_t()}};
+            case AttrType::FullAttrs: {
+                // FIXME: expensive, should separate this out.
+                std::vector<Symbol> attrs;
+                auto queryAttributes(state->queryAttributes.use()(rowId));
+                while (queryAttributes.next())
+                    attrs.push_back(symbols.create(queryAttributes.getStr(0)));
+                return {{rowId, attrs}};
+            }
+            case AttrType::String:
+                return {{rowId, queryAttribute.getStr(2)}};
+            case AttrType::Bool:
+                return {{rowId, queryAttribute.getInt(2) != 0}};
+            case AttrType::Missing:
+                return {{rowId, missing_t()}};
+            case AttrType::Misc:
+                return {{rowId, misc_t()}};
+            case AttrType::Failed:
+                return {{rowId, failed_t()}};
+            default:
+                throw Error("unexpected type in evaluation cache");
+        }
+    }
+};
+
+EvalCache::EvalCache(
+    bool useCache,
+    const Hash & fingerprint,
+    EvalState & state,
+    RootLoader rootLoader)
+    : db(useCache ? std::make_shared<AttrDb>(fingerprint) : nullptr)
+    , state(state)
+    , rootLoader(rootLoader)
+{
+}
+
+Value * EvalCache::getRootValue()
+{
+    if (!value) {
+        debug("getting root value");
+        value = allocRootValue(rootLoader());
+    }
+    return *value;
+}
+
+std::shared_ptr<AttrCursor> EvalCache::getRoot()
+{
+    return std::make_shared<AttrCursor>(ref(shared_from_this()), std::nullopt);
+}
+
+AttrCursor::AttrCursor(
+    ref<EvalCache> root,
+    Parent parent,
+    Value * value,
+    std::optional<std::pair<AttrId, AttrValue>> && cachedValue)
+    : root(root), parent(parent), cachedValue(std::move(cachedValue))
+{
+    if (value)
+        _value = allocRootValue(value);
+}
+
+AttrKey AttrCursor::getKey()
+{
+    if (!parent)
+        return {0, root->state.sEpsilon};
+    if (!parent->first->cachedValue) {
+        parent->first->cachedValue = root->db->getAttr(
+            parent->first->getKey(), root->state.symbols);
+        assert(parent->first->cachedValue);
+    }
+    return {parent->first->cachedValue->first, parent->second};
+}
+
+Value & AttrCursor::getValue()
+{
+    if (!_value) {
+        if (parent) {
+            auto & vParent = parent->first->getValue();
+            root->state.forceAttrs(vParent);
+            auto attr = vParent.attrs->get(parent->second);
+            if (!attr)
+                throw Error("attribute '%s' is unexpectedly missing", getAttrPathStr());
+            _value = allocRootValue(attr->value);
+        } else
+            _value = allocRootValue(root->getRootValue());
+    }
+    return **_value;
+}
+
+std::vector<Symbol> AttrCursor::getAttrPath() const
+{
+    if (parent) {
+        auto attrPath = parent->first->getAttrPath();
+        attrPath.push_back(parent->second);
+        return attrPath;
+    } else
+        return {};
+}
+
+std::vector<Symbol> AttrCursor::getAttrPath(Symbol name) const
+{
+    auto attrPath = getAttrPath();
+    attrPath.push_back(name);
+    return attrPath;
+}
+
+std::string AttrCursor::getAttrPathStr() const
+{
+    return concatStringsSep(".", getAttrPath());
+}
+
+std::string AttrCursor::getAttrPathStr(Symbol name) const
+{
+    return concatStringsSep(".", getAttrPath(name));
+}
+
+Value & AttrCursor::forceValue()
+{
+    debug("evaluating uncached attribute %s", getAttrPathStr());
+
+    auto & v = getValue();
+
+    try {
+        root->state.forceValue(v);
+    } catch (EvalError &) {
+        debug("setting '%s' to failed", getAttrPathStr());
+        if (root->db)
+            cachedValue = {root->db->setFailed(getKey()), failed_t()};
+        throw;
+    }
+
+    if (root->db && (!cachedValue || std::get_if<placeholder_t>(&cachedValue->second))) {
+        if (v.type == tString)
+            cachedValue = {root->db->setString(getKey(), v.string.s), v.string.s};
+        else if (v.type == tBool)
+            cachedValue = {root->db->setBool(getKey(), v.boolean), v.boolean};
+        else if (v.type == tAttrs)
+            ; // FIXME: do something?
+        else
+            cachedValue = {root->db->setMisc(getKey()), misc_t()};
+    }
+
+    return v;
+}
+
+std::shared_ptr<AttrCursor> AttrCursor::maybeGetAttr(Symbol name)
+{
+    if (root->db) {
+        if (!cachedValue)
+            cachedValue = root->db->getAttr(getKey(), root->state.symbols);
+
+        if (cachedValue) {
+            if (auto attrs = std::get_if<std::vector<Symbol>>(&cachedValue->second)) {
+                for (auto & attr : *attrs)
+                    if (attr == name)
+                        return std::make_shared<AttrCursor>(root, std::make_pair(shared_from_this(), name));
+                return nullptr;
+            } else if (std::get_if<placeholder_t>(&cachedValue->second)) {
+                auto attr = root->db->getAttr({cachedValue->first, name}, root->state.symbols);
+                if (attr) {
+                    if (std::get_if<missing_t>(&attr->second))
+                        return nullptr;
+                    else if (std::get_if<failed_t>(&attr->second))
+                        throw EvalError("cached failure of attribute '%s'", getAttrPathStr(name));
+                    else
+                        return std::make_shared<AttrCursor>(root,
+                            std::make_pair(shared_from_this(), name), nullptr, std::move(attr));
+                }
+                // Incomplete attrset, so need to fall thru and
+                // evaluate to see whether 'name' exists
+            } else
+                return nullptr;
+                //throw TypeError("'%s' is not an attribute set", getAttrPathStr());
+        }
+    }
+
+    auto & v = forceValue();
+
+    if (v.type != tAttrs)
+        return nullptr;
+        //throw TypeError("'%s' is not an attribute set", getAttrPathStr());
+
+    auto attr = v.attrs->get(name);
+
+    if (!attr) {
+        if (root->db) {
+            if (!cachedValue)
+                cachedValue = {root->db->setPlaceholder(getKey()), placeholder_t()};
+            root->db->setMissing({cachedValue->first, name});
+        }
+        return nullptr;
+    }
+
+    std::optional<std::pair<AttrId, AttrValue>> cachedValue2;
+    if (root->db) {
+        if (!cachedValue)
+            cachedValue = {root->db->setPlaceholder(getKey()), placeholder_t()};
+        cachedValue2 = {root->db->setPlaceholder({cachedValue->first, name}), placeholder_t()};
+    }
+
+    return std::make_shared<AttrCursor>(
+        root, std::make_pair(shared_from_this(), name), attr->value, std::move(cachedValue2));
+}
+
+std::shared_ptr<AttrCursor> AttrCursor::maybeGetAttr(std::string_view name)
+{
+    return maybeGetAttr(root->state.symbols.create(name));
+}
+
+std::shared_ptr<AttrCursor> AttrCursor::getAttr(Symbol name)
+{
+    auto p = maybeGetAttr(name);
+    if (!p)
+        throw Error("attribute '%s' does not exist", getAttrPathStr(name));
+    return p;
+}
+
+std::shared_ptr<AttrCursor> AttrCursor::getAttr(std::string_view name)
+{
+    return getAttr(root->state.symbols.create(name));
+}
+
+std::shared_ptr<AttrCursor> AttrCursor::findAlongAttrPath(const std::vector<Symbol> & attrPath)
+{
+    auto res = shared_from_this();
+    for (auto & attr : attrPath) {
+        res = res->maybeGetAttr(attr);
+        if (!res) return {};
+    }
+    return res;
+}
+
+std::string AttrCursor::getString()
+{
+    if (root->db) {
+        if (!cachedValue)
+            cachedValue = root->db->getAttr(getKey(), root->state.symbols);
+        if (cachedValue && !std::get_if<placeholder_t>(&cachedValue->second)) {
+            if (auto s = std::get_if<std::string>(&cachedValue->second)) {
+                debug("using cached string attribute '%s'", getAttrPathStr());
+                return *s;
+            } else
+                throw TypeError("'%s' is not a string", getAttrPathStr());
+        }
+    }
+
+    auto & v = forceValue();
+
+    if (v.type != tString)
+        throw TypeError("'%s' is not a string", getAttrPathStr());
+
+    return v.string.s;
+}
+
+bool AttrCursor::getBool()
+{
+    if (root->db) {
+        if (!cachedValue)
+            cachedValue = root->db->getAttr(getKey(), root->state.symbols);
+        if (cachedValue && !std::get_if<placeholder_t>(&cachedValue->second)) {
+            if (auto b = std::get_if<bool>(&cachedValue->second)) {
+                debug("using cached Boolean attribute '%s'", getAttrPathStr());
+                return *b;
+            } else
+                throw TypeError("'%s' is not a Boolean", getAttrPathStr());
+        }
+    }
+
+    auto & v = forceValue();
+
+    if (v.type != tBool)
+        throw TypeError("'%s' is not a Boolean", getAttrPathStr());
+
+    return v.boolean;
+}
+
+std::vector<Symbol> AttrCursor::getAttrs()
+{
+    if (root->db) {
+        if (!cachedValue)
+            cachedValue = root->db->getAttr(getKey(), root->state.symbols);
+        if (cachedValue && !std::get_if<placeholder_t>(&cachedValue->second)) {
+            if (auto attrs = std::get_if<std::vector<Symbol>>(&cachedValue->second)) {
+                debug("using cached attrset attribute '%s'", getAttrPathStr());
+                return *attrs;
+            } else
+                throw TypeError("'%s' is not an attribute set", getAttrPathStr());
+        }
+    }
+
+    auto & v = forceValue();
+
+    if (v.type != tAttrs)
+        throw TypeError("'%s' is not an attribute set", getAttrPathStr());
+
+    std::vector<Symbol> attrs;
+    for (auto & attr : *getValue().attrs)
+        attrs.push_back(attr.name);
+    std::sort(attrs.begin(), attrs.end(), [](const Symbol & a, const Symbol & b) {
+        return (const string &) a < (const string &) b;
+    });
+
+    if (root->db)
+        cachedValue = {root->db->setAttrs(getKey(), attrs), attrs};
+
+    return attrs;
+}
+
+bool AttrCursor::isDerivation()
+{
+    auto aType = maybeGetAttr("type");
+    return aType && aType->getString() == "derivation";
+}
+
+}

src/libexpr/eval-cache.hh

@@ -0,0 +1,106 @@
+#pragma once
+
+#include "sync.hh"
+#include "hash.hh"
+#include "eval.hh"
+
+#include <variant>
+
+namespace nix::eval_cache {
+
+class AttrDb;
+class AttrCursor;
+
+class EvalCache : public std::enable_shared_from_this<EvalCache>
+{
+    friend class AttrCursor;
+
+    std::shared_ptr<AttrDb> db;
+    EvalState & state;
+    typedef std::function<Value *()> RootLoader;
+    RootLoader rootLoader;
+    RootValue value;
+
+    Value * getRootValue();
+
+public:
+
+    EvalCache(
+        bool useCache,
+        const Hash & fingerprint,
+        EvalState & state,
+        RootLoader rootLoader);
+
+    std::shared_ptr<AttrCursor> getRoot();
+};
+
+enum AttrType {
+    Placeholder = 0,
+    FullAttrs = 1,
+    String = 2,
+    Missing = 3,
+    Misc = 4,
+    Failed = 5,
+    Bool = 6,
+};
+
+struct placeholder_t {};
+struct missing_t {};
+struct misc_t {};
+struct failed_t {};
+typedef uint64_t AttrId;
+typedef std::pair<AttrId, Symbol> AttrKey;
+typedef std::variant<std::vector<Symbol>, std::string, placeholder_t, missing_t, misc_t, failed_t, bool> AttrValue;
+
+class AttrCursor : public std::enable_shared_from_this<AttrCursor>
+{
+    friend class EvalCache;
+
+    ref<EvalCache> root;
+    typedef std::optional<std::pair<std::shared_ptr<AttrCursor>, Symbol>> Parent;
+    Parent parent;
+    RootValue _value;
+    std::optional<std::pair<AttrId, AttrValue>> cachedValue;
+
+    AttrKey getKey();
+
+    Value & getValue();
+
+public:
+
+    AttrCursor(
+        ref<EvalCache> root,
+        Parent parent,
+        Value * value = nullptr,
+        std::optional<std::pair<AttrId, AttrValue>> && cachedValue = {});
+
+    std::vector<Symbol> getAttrPath() const;
+
+    std::vector<Symbol> getAttrPath(Symbol name) const;
+
+    std::string getAttrPathStr() const;
+
+    std::string getAttrPathStr(Symbol name) const;
+
+    std::shared_ptr<AttrCursor> maybeGetAttr(Symbol name);
+
+    std::shared_ptr<AttrCursor> maybeGetAttr(std::string_view name);
+
+    std::shared_ptr<AttrCursor> getAttr(Symbol name);
+
+    std::shared_ptr<AttrCursor> getAttr(std::string_view name);
+
+    std::shared_ptr<AttrCursor> findAlongAttrPath(const std::vector<Symbol> & attrPath);
+
+    std::string getString();
+
+    bool getBool();
+
+    std::vector<Symbol> getAttrs();
+
+    bool isDerivation();
+
+    Value & forceValue();
+};
+
+}

src/libexpr/eval.cc

@@ -8,6 +8,7 @@
 #include "filetransfer.hh"
 #include "json.hh"
 #include "function-trace.hh"
+#include "flake/flake.hh"
 
 #include <algorithm>
 #include <chrono>
@@ -161,12 +162,12 @@ const Value *getPrimOp(const Value &v) {
 }
 
 
-string showType(const Value & v)
+string showType(ValueType type)
 {
-    switch (v.type) {
+    switch (type) {
         case tInt: return "an integer";
-        case tBool: return "a boolean";
-        case tString: return v.string.context ? "a string with context" : "a string";
+        case tBool: return "a Boolean";
+        case tString: return "a string";
         case tPath: return "a path";
         case tNull: return "null";
         case tAttrs: return "a set";
@@ -175,14 +176,39 @@ string showType(const Value & v)
         case tApp: return "a function application";
         case tLambda: return "a function";
         case tBlackhole: return "a black hole";
+        case tPrimOp: return "a built-in function";
+        case tPrimOpApp: return "a partially applied built-in function";
+        case tExternal: return "an external value";
+        case tFloat: return "a float";
+    }
+    abort();
+}
+
+
+string showType(const Value & v)
+{
+    switch (v.type) {
+        case tString: return v.string.context ? "a string with context" : "a string";
         case tPrimOp:
             return fmt("the built-in function '%s'", string(v.primOp->name));
         case tPrimOpApp:
             return fmt("the partially applied built-in function '%s'", string(getPrimOp(v)->primOp->name));
         case tExternal: return v.external->showType();
-        case tFloat: return "a float";
+    default:
+        return showType(v.type);
     }
-    abort();
+}
+
+
+bool Value::isTrivial() const
+{
+    return
+        type != tApp
+        && type != tPrimOpApp
+        && (type != tThunk
+            || (dynamic_cast<ExprAttrs *>(thunk.expr)
+                && ((ExprAttrs *) thunk.expr)->dynamicAttrs.empty())
+            || dynamic_cast<ExprLambda *>(thunk.expr));
 }
 
 
@@ -323,6 +349,10 @@ EvalState::EvalState(const Strings & _searchPath, ref<Store> store)
     , sOutputHash(symbols.create("outputHash"))
     , sOutputHashAlgo(symbols.create("outputHashAlgo"))
     , sOutputHashMode(symbols.create("outputHashMode"))
+    , sDescription(symbols.create("description"))
+    , sSelf(symbols.create("self"))
+    , sEpsilon(symbols.create(""))
+    , sRecurseForDerivations(symbols.create("recurseForDerivations"))
     , repair(NoRepair)
     , store(store)
     , baseEnv(allocEnv(128))
@@ -471,14 +501,21 @@ Value * EvalState::addConstant(const string & name, Value & v)
 Value * EvalState::addPrimOp(const string & name,
     size_t arity, PrimOpFun primOp)
 {
+    auto name2 = string(name, 0, 2) == "__" ? string(name, 2) : name;
+    Symbol sym = symbols.create(name2);
+
+    /* Hack to make constants lazy: turn them into a application of
+       the primop to a dummy value. */
     if (arity == 0) {
+        auto vPrimOp = allocValue();
+        vPrimOp->type = tPrimOp;
+        vPrimOp->primOp = new PrimOp(primOp, 1, sym);
         Value v;
-        primOp(*this, noPos, nullptr, v);
+        mkApp(v, *vPrimOp, *vPrimOp);
         return addConstant(name, v);
     }
+
     Value * v = allocValue();
-    string name2 = string(name, 0, 2) == "__" ? string(name, 2) : name;
-    Symbol sym = symbols.create(name2);
     v->type = tPrimOp;
     v->primOp = new PrimOp(primOp, arity, sym);
     staticBaseEnv.vars[symbols.create(name)] = baseEnvDispl;
@@ -744,7 +781,7 @@ Value * ExprPath::maybeThunk(EvalState & state, Env & env)
 }
 
 
-void EvalState::evalFile(const Path & path_, Value & v)
+void EvalState::evalFile(const Path & path_, Value & v, bool mustBeTrivial)
 {
     auto path = checkSourcePath(path_);
 
@@ -773,6 +810,11 @@ void EvalState::evalFile(const Path & path_, Value & v)
     fileParseCache[path2] = e;
 
     try {
+        // Enforce that 'flake.nix' is a direct attrset, not a
+        // computation.
+        if (mustBeTrivial &&
+            !(dynamic_cast<ExprAttrs *>(e)))
+            throw Error("file '%s' must be an attribute set", path);
         eval(e, v);
     } catch (Error & e) {
         addErrorPrefix(e, "while evaluating the file '%1%':\n", path2);

src/libexpr/eval.hh

@@ -4,13 +4,13 @@
 #include "value.hh"
 #include "nixexpr.hh"
 #include "symbol-table.hh"
-#include "hash.hh"
 #include "config.hh"
 
 #include <regex>
 #include <map>
 #include <optional>
 #include <unordered_map>
+#include <mutex>
 
 
 namespace nix {
@@ -74,7 +74,8 @@ public:
         sSystem, sOverrides, sOutputs, sOutputName, sIgnoreNulls,
         sFile, sLine, sColumn, sFunctor, sToString,
         sRight, sWrong, sStructuredAttrs, sBuilder, sArgs,
-        sOutputHash, sOutputHashAlgo, sOutputHashMode;
+        sOutputHash, sOutputHashAlgo, sOutputHashMode,
+        sDescription, sSelf, sEpsilon, sRecurseForDerivations;
     Symbol sDerivationNix;
 
     /* If set, force copying files to the Nix store even if they
@@ -89,6 +90,7 @@ public:
 
     const ref<Store> store;
 
+
 private:
     SrcToStore srcToStore;
 
@@ -151,8 +153,9 @@ public:
     Expr * parseStdin();
 
     /* Evaluate an expression read from the given file to normal
-       form. */
-    void evalFile(const Path & path, Value & v);
+       form. Optionally enforce that the top-level expression is
+       trivial (i.e. doesn't require arbitrary computation). */
+    void evalFile(const Path & path, Value & v, bool mustBeTrivial = false);
 
     void resetFileCache();
 
@@ -324,6 +327,7 @@ private:
 
 
 /* Return a string representing the type of the value `v'. */
+string showType(ValueType type);
 string showType(const Value & v);
 
 /* Decode a context string ‘!<name>!<path>’ into a pair <path,

src/libexpr/flake/call-flake.nix

@@ -0,0 +1,29 @@
+lockFileStr: rootSrc: rootSubdir:
+
+let
+
+  lockFile = builtins.fromJSON lockFileStr;
+
+  allNodes =
+    builtins.mapAttrs
+      (key: node:
+        let
+          sourceInfo =
+            if key == lockFile.root
+            then rootSrc
+            else fetchTree ({ inherit (node.info) narHash; } // removeAttrs node.locked ["dir"]);
+          subdir = if key == lockFile.root then rootSubdir else node.locked.dir or "";
+          flake = import (sourceInfo + (if subdir != "" then "/" else "") + subdir + "/flake.nix");
+          inputs = builtins.mapAttrs (inputName: key: allNodes.${key}) (node.inputs or {});
+          outputs = flake.outputs (inputs // { self = result; });
+          result = outputs // sourceInfo // { inherit inputs; inherit outputs; inherit sourceInfo; };
+        in
+          if node.flake or true then
+            assert builtins.isFunction flake.outputs;
+            result
+          else
+            sourceInfo
+      )
+      lockFile.nodes;
+
+in allNodes.${lockFile.root}

src/libexpr/flake/flake.cc

@@ -0,0 +1,660 @@
+#include "flake.hh"
+#include "lockfile.hh"
+#include "primops.hh"
+#include "eval-inline.hh"
+#include "store-api.hh"
+#include "fetchers.hh"
+#include "finally.hh"
+
+namespace nix {
+
+using namespace flake;
+
+namespace flake {
+
+/* If 'allowLookup' is true, then resolve 'flakeRef' using the
+   registries. */
+static FlakeRef maybeLookupFlake(
+    ref<Store> store,
+    const FlakeRef & flakeRef,
+    bool allowLookup)
+{
+    if (!flakeRef.input->isDirect()) {
+        if (allowLookup)
+            return flakeRef.resolve(store);
+        else
+            throw Error("'%s' is an indirect flake reference, but registry lookups are not allowed", flakeRef);
+    } else
+        return flakeRef;
+}
+
+typedef std::vector<std::pair<FlakeRef, FlakeRef>> FlakeCache;
+
+static FlakeRef lookupInFlakeCache(
+    const FlakeCache & flakeCache,
+    const FlakeRef & flakeRef)
+{
+    // FIXME: inefficient.
+    for (auto & i : flakeCache) {
+        if (flakeRef == i.first) {
+            debug("mapping '%s' to previously seen input '%s' -> '%s",
+                flakeRef, i.first, i.second);
+            return i.second;
+        }
+    }
+
+    return flakeRef;
+}
+
+static std::tuple<fetchers::Tree, FlakeRef, FlakeRef> fetchOrSubstituteTree(
+    EvalState & state,
+    const FlakeRef & originalRef,
+    std::optional<TreeInfo> treeInfo,
+    bool allowLookup,
+    FlakeCache & flakeCache)
+{
+    /* The tree may already be in the Nix store, or it could be
+       substituted (which is often faster than fetching from the
+       original source). So check that. */
+    if (treeInfo && originalRef.input->isDirect() && originalRef.input->isImmutable()) {
+        try {
+            auto storePath = treeInfo->computeStorePath(*state.store);
+
+            state.store->ensurePath(storePath);
+
+            debug("using substituted/cached input '%s' in '%s'",
+                originalRef, state.store->printStorePath(storePath));
+
+            auto actualPath = state.store->toRealPath(storePath);
+
+            if (state.allowedPaths)
+                state.allowedPaths->insert(actualPath);
+
+            return {
+                Tree {
+                    .actualPath = actualPath,
+                    .storePath = std::move(storePath),
+                    .info = *treeInfo,
+                },
+                originalRef,
+                originalRef
+            };
+        } catch (Error & e) {
+            debug("substitution of input '%s' failed: %s", originalRef, e.what());
+        }
+    }
+
+    auto resolvedRef = lookupInFlakeCache(flakeCache,
+        maybeLookupFlake(state.store,
+            lookupInFlakeCache(flakeCache, originalRef), allowLookup));
+
+    auto [tree, lockedRef] = resolvedRef.fetchTree(state.store);
+
+    debug("got tree '%s' from '%s'",
+        state.store->printStorePath(tree.storePath), lockedRef);
+
+    flakeCache.push_back({originalRef, lockedRef});
+    flakeCache.push_back({resolvedRef, lockedRef});
+
+    if (state.allowedPaths)
+        state.allowedPaths->insert(tree.actualPath);
+
+    if (treeInfo)
+        assert(tree.storePath == treeInfo->computeStorePath(*state.store));
+
+    return {std::move(tree), resolvedRef, lockedRef};
+}
+
+static void expectType(EvalState & state, ValueType type,
+    Value & value, const Pos & pos)
+{
+    if (value.type == tThunk && value.isTrivial())
+        state.forceValue(value, pos);
+    if (value.type != type)
+        throw Error("expected %s but got %s at %s",
+            showType(type), showType(value.type), pos);
+}
+
+static std::map<FlakeId, FlakeInput> parseFlakeInputs(
+    EvalState & state, Value * value, const Pos & pos);
+
+static FlakeInput parseFlakeInput(EvalState & state,
+    const std::string & inputName, Value * value, const Pos & pos)
+{
+    expectType(state, tAttrs, *value, pos);
+
+    FlakeInput input {
+        .ref = FlakeRef::fromAttrs({{"type", "indirect"}, {"id", inputName}})
+    };
+
+    auto sInputs = state.symbols.create("inputs");
+    auto sUrl = state.symbols.create("url");
+    auto sFlake = state.symbols.create("flake");
+    auto sFollows = state.symbols.create("follows");
+
+    fetchers::Attrs attrs;
+    std::optional<std::string> url;
+
+    for (nix::Attr attr : *(value->attrs)) {
+        try {
+            if (attr.name == sUrl) {
+                expectType(state, tString, *attr.value, *attr.pos);
+                url = attr.value->string.s;
+                attrs.emplace("url", *url);
+            } else if (attr.name == sFlake) {
+                expectType(state, tBool, *attr.value, *attr.pos);
+                input.isFlake = attr.value->boolean;
+            } else if (attr.name == sInputs) {
+                input.overrides = parseFlakeInputs(state, attr.value, *attr.pos);
+            } else if (attr.name == sFollows) {
+                expectType(state, tString, *attr.value, *attr.pos);
+                input.follows = parseInputPath(attr.value->string.s);
+            } else {
+                state.forceValue(*attr.value);
+                if (attr.value->type == tString)
+                    attrs.emplace(attr.name, attr.value->string.s);
+                else
+                    throw TypeError("flake input attribute '%s' is %s while a string is expected",
+                        attr.name, showType(*attr.value));
+            }
+        } catch (Error & e) {
+            e.addPrefix(fmt("in flake attribute '%s' at '%s':\n", attr.name, *attr.pos));
+            throw;
+        }
+    }
+
+    if (attrs.count("type"))
+        try {
+            input.ref = FlakeRef::fromAttrs(attrs);
+        } catch (Error & e) {
+            e.addPrefix(fmt("in flake input at '%s':\n", pos));
+            throw;
+        }
+    else {
+        attrs.erase("url");
+        if (!attrs.empty())
+            throw Error("unexpected flake input attribute '%s', at %s", attrs.begin()->first, pos);
+        if (url)
+            input.ref = parseFlakeRef(*url, {}, true);
+    }
+
+    return input;
+}
+
+static std::map<FlakeId, FlakeInput> parseFlakeInputs(
+    EvalState & state, Value * value, const Pos & pos)
+{
+    std::map<FlakeId, FlakeInput> inputs;
+
+    expectType(state, tAttrs, *value, pos);
+
+    for (nix::Attr & inputAttr : *(*value).attrs) {
+        inputs.emplace(inputAttr.name,
+            parseFlakeInput(state,
+                inputAttr.name,
+                inputAttr.value,
+                *inputAttr.pos));
+    }
+
+    return inputs;
+}
+
+static Flake getFlake(
+    EvalState & state,
+    const FlakeRef & originalRef,
+    std::optional<TreeInfo> treeInfo,
+    bool allowLookup,
+    FlakeCache & flakeCache)
+{
+    auto [sourceInfo, resolvedRef, lockedRef] = fetchOrSubstituteTree(
+        state, originalRef, treeInfo, allowLookup, flakeCache);
+
+    // Guard against symlink attacks.
+    auto flakeFile = canonPath(sourceInfo.actualPath + "/" + lockedRef.subdir + "/flake.nix");
+    if (!isInDir(flakeFile, sourceInfo.actualPath))
+        throw Error("'flake.nix' file of flake '%s' escapes from '%s'",
+            lockedRef, state.store->printStorePath(sourceInfo.storePath));
+
+    Flake flake {
+        .originalRef = originalRef,
+        .resolvedRef = resolvedRef,
+        .lockedRef = lockedRef,
+        .sourceInfo = std::make_shared<fetchers::Tree>(std::move(sourceInfo))
+    };
+
+    if (!pathExists(flakeFile))
+        throw Error("source tree referenced by '%s' does not contain a '%s/flake.nix' file", lockedRef, lockedRef.subdir);
+
+    Value vInfo;
+    state.evalFile(flakeFile, vInfo, true); // FIXME: symlink attack
+
+    expectType(state, tAttrs, vInfo, Pos(state.symbols.create(flakeFile), 0, 0));
+
+    auto sEdition = state.symbols.create("edition"); // FIXME: remove soon
+
+    if (vInfo.attrs->get(sEdition))
+        warn("flake '%s' has deprecated attribute 'edition'", lockedRef);
+
+    if (auto description = vInfo.attrs->get(state.sDescription)) {
+        expectType(state, tString, *description->value, *description->pos);
+        flake.description = description->value->string.s;
+    }
+
+    auto sInputs = state.symbols.create("inputs");
+
+    if (auto inputs = vInfo.attrs->get(sInputs))
+        flake.inputs = parseFlakeInputs(state, inputs->value, *inputs->pos);
+
+    auto sOutputs = state.symbols.create("outputs");
+
+    if (auto outputs = vInfo.attrs->get(sOutputs)) {
+        expectType(state, tLambda, *outputs->value, *outputs->pos);
+        flake.vOutputs = allocRootValue(outputs->value);
+
+        if ((*flake.vOutputs)->lambda.fun->matchAttrs) {
+            for (auto & formal : (*flake.vOutputs)->lambda.fun->formals->formals) {
+                if (formal.name != state.sSelf)
+                    flake.inputs.emplace(formal.name, FlakeInput {
+                        .ref = parseFlakeRef(formal.name)
+                    });
+            }
+        }
+
+    } else
+        throw Error("flake '%s' lacks attribute 'outputs'", lockedRef);
+
+    for (auto & attr : *vInfo.attrs) {
+        if (attr.name != sEdition &&
+            attr.name != state.sDescription &&
+            attr.name != sInputs &&
+            attr.name != sOutputs)
+            throw Error("flake '%s' has an unsupported attribute '%s', at %s",
+                lockedRef, attr.name, *attr.pos);
+    }
+
+    return flake;
+}
+
+Flake getFlake(EvalState & state, const FlakeRef & originalRef, bool allowLookup)
+{
+    FlakeCache flakeCache;
+    return getFlake(state, originalRef, {}, allowLookup, flakeCache);
+}
+
+/* Compute an in-memory lock file for the specified top-level flake,
+   and optionally write it to file, it the flake is writable. */
+LockedFlake lockFlake(
+    EvalState & state,
+    const FlakeRef & topRef,
+    const LockFlags & lockFlags)
+{
+    settings.requireExperimentalFeature("flakes");
+
+    FlakeCache flakeCache;
+
+    auto flake = getFlake(state, topRef, {}, lockFlags.useRegistries, flakeCache);
+
+    // FIXME: symlink attack
+    auto oldLockFile = LockFile::read(
+        flake.sourceInfo->actualPath + "/" + flake.lockedRef.subdir + "/flake.lock");
+
+    debug("old lock file: %s", oldLockFile);
+
+    // FIXME: check whether all overrides are used.
+    std::map<InputPath, FlakeInput> overrides;
+    std::set<InputPath> overridesUsed, updatesUsed;
+
+    for (auto & i : lockFlags.inputOverrides)
+        overrides.insert_or_assign(i.first, FlakeInput { .ref = i.second });
+
+    LockFile newLockFile;
+
+    std::vector<FlakeRef> parents;
+    std::map<InputPath, InputPath> follows;
+
+    std::function<void(
+        const FlakeInputs & flakeInputs,
+        std::shared_ptr<Node> node,
+        const InputPath & inputPathPrefix,
+        std::shared_ptr<const Node> oldNode)>
+        computeLocks;
+
+    computeLocks = [&](
+        const FlakeInputs & flakeInputs,
+        std::shared_ptr<Node> node,
+        const InputPath & inputPathPrefix,
+        std::shared_ptr<const Node> oldNode)
+    {
+        debug("computing lock file node '%s'", concatStringsSep("/", inputPathPrefix));
+
+        /* Get the overrides (i.e. attributes of the form
+           'inputs.nixops.inputs.nixpkgs.url = ...'). */
+        // FIXME: check this
+        for (auto & [id, input] : flake.inputs) {
+            for (auto & [idOverride, inputOverride] : input.overrides) {
+                auto inputPath(inputPathPrefix);
+                inputPath.push_back(id);
+                inputPath.push_back(idOverride);
+                overrides.insert_or_assign(inputPath, inputOverride);
+            }
+        }
+
+        /* Go over the flake inputs, resolve/fetch them if
+           necessary (i.e. if they're new or the flakeref changed
+           from what's in the lock file). */
+        for (auto & [id, input2] : flakeInputs) {
+            auto inputPath(inputPathPrefix);
+            inputPath.push_back(id);
+            auto inputPathS = concatStringsSep("/", inputPath);
+            debug("computing input '%s'", concatStringsSep("/", inputPath));
+
+            /* Do we have an override for this input from one of the
+               ancestors? */
+            auto i = overrides.find(inputPath);
+            bool hasOverride = i != overrides.end();
+            if (hasOverride) overridesUsed.insert(inputPath);
+            auto & input = hasOverride ? i->second : input2;
+
+            /* Resolve 'follows' later (since it may refer to an input
+               path we haven't processed yet. */
+            if (input.follows) {
+                if (hasOverride)
+                    /* 'follows' from an override is relative to the
+                       root of the graph. */
+                    follows.insert_or_assign(inputPath, *input.follows);
+                else {
+                    /* Otherwise, it's relative to the current flake. */
+                    InputPath path(inputPathPrefix);
+                    for (auto & i : *input.follows) path.push_back(i);
+                    follows.insert_or_assign(inputPath, path);
+                }
+                continue;
+            }
+
+            /* Do we have an entry in the existing lock file? And we
+               don't have a --update-input flag for this input? */
+            std::shared_ptr<const LockedNode> oldLock;
+
+            updatesUsed.insert(inputPath);
+
+            if (oldNode && !lockFlags.inputUpdates.count(inputPath)) {
+                auto oldLockIt = oldNode->inputs.find(id);
+                if (oldLockIt != oldNode->inputs.end())
+                    oldLock = std::dynamic_pointer_cast<const LockedNode>(oldLockIt->second);
+            }
+
+            if (oldLock
+                && oldLock->originalRef == input.ref
+                && !hasOverride)
+            {
+                debug("keeping existing input '%s'", inputPathS);
+
+                /* Copy the input from the old lock since its flakeref
+                   didn't change and there is no override from a
+                   higher level flake. */
+                auto childNode = std::make_shared<LockedNode>(
+                    oldLock->lockedRef, oldLock->originalRef, oldLock->info, oldLock->isFlake);
+
+                node->inputs.insert_or_assign(id, childNode);
+
+                /* If we have an --update-input flag for an input
+                   of this input, then we must fetch the flake to
+                   to update it. */
+                auto lb = lockFlags.inputUpdates.lower_bound(inputPath);
+
+                auto hasChildUpdate =
+                    lb != lockFlags.inputUpdates.end()
+                    && lb->size() > inputPath.size()
+                    && std::equal(inputPath.begin(), inputPath.end(), lb->begin());
+
+                if (hasChildUpdate) {
+                    auto inputFlake = getFlake(
+                        state, oldLock->lockedRef, oldLock->info, false, flakeCache);
+                    computeLocks(inputFlake.inputs, childNode, inputPath, oldLock);
+                } else {
+                    /* No need to fetch this flake, we can be
+                       lazy. However there may be new overrides on the
+                       inputs of this flake, so we need to check
+                       those. */
+                    FlakeInputs fakeInputs;
+
+                    for (auto & i : oldLock->inputs) {
+                        auto lockedNode = std::dynamic_pointer_cast<LockedNode>(i.second);
+                        // Note: this node is not locked in case
+                        // of a circular reference back to the root.
+                        if (lockedNode)
+                            fakeInputs.emplace(i.first, FlakeInput {
+                                .ref = lockedNode->originalRef
+                            });
+                        else {
+                            InputPath path(inputPath);
+                            path.push_back(i.first);
+                            follows.insert_or_assign(path, InputPath());
+                        }
+                    }
+
+                    computeLocks(fakeInputs, childNode, inputPath, oldLock);
+                }
+
+            } else {
+                /* We need to create a new lock file entry. So fetch
+                   this input. */
+
+                if (!lockFlags.allowMutable && !input.ref.input->isImmutable())
+                    throw Error("cannot update flake input '%s' in pure mode", inputPathS);
+
+                if (input.isFlake) {
+                    auto inputFlake = getFlake(state, input.ref, {}, lockFlags.useRegistries, flakeCache);
+
+                    /* Note: in case of an --override-input, we use
+                       the *original* ref (input2.ref) for the
+                       "original" field, rather than the
+                       override. This ensures that the override isn't
+                       nuked the next time we update the lock
+                       file. That is, overrides are sticky unless you
+                       use --no-write-lock-file. */
+                    auto childNode = std::make_shared<LockedNode>(
+                        inputFlake.lockedRef, input2.ref, inputFlake.sourceInfo->info);
+
+                    node->inputs.insert_or_assign(id, childNode);
+
+                    /* Guard against circular flake imports. */
+                    for (auto & parent : parents)
+                        if (parent == input.ref)
+                            throw Error("found circular import of flake '%s'", parent);
+                    parents.push_back(input.ref);
+                    Finally cleanup([&]() { parents.pop_back(); });
+
+                    /* Recursively process the inputs of this
+                       flake. Also, unless we already have this flake
+                       in the top-level lock file, use this flake's
+                       own lock file. */
+                    computeLocks(
+                        inputFlake.inputs, childNode, inputPath,
+                        oldLock
+                        ? std::dynamic_pointer_cast<const Node>(oldLock)
+                        : LockFile::read(
+                            inputFlake.sourceInfo->actualPath + "/" + inputFlake.lockedRef.subdir + "/flake.lock").root);
+                }
+
+                else {
+                    auto [sourceInfo, resolvedRef, lockedRef] = fetchOrSubstituteTree(
+                        state, input.ref, {}, lockFlags.useRegistries, flakeCache);
+                    node->inputs.insert_or_assign(id,
+                        std::make_shared<LockedNode>(lockedRef, input.ref, sourceInfo.info, false));
+                }
+            }
+        }
+    };
+
+    computeLocks(
+        flake.inputs, newLockFile.root, {},
+        lockFlags.recreateLockFile ? nullptr : oldLockFile.root);
+
+    /* Insert edges for 'follows' overrides. */
+    for (auto & [from, to] : follows) {
+        debug("adding 'follows' node from '%s' to '%s'",
+            concatStringsSep("/", from),
+            concatStringsSep("/", to));
+
+        assert(!from.empty());
+
+        InputPath fromParent(from);
+        fromParent.pop_back();
+
+        auto fromParentNode = newLockFile.root->findInput(fromParent);
+        assert(fromParentNode);
+
+        auto toNode = newLockFile.root->findInput(to);
+        if (!toNode)
+            throw Error("flake input '%s' follows non-existent flake input '%s'",
+                concatStringsSep("/", from),
+                concatStringsSep("/", to));
+
+        fromParentNode->inputs.insert_or_assign(from.back(), toNode);
+    }
+
+    for (auto & i : lockFlags.inputOverrides)
+        if (!overridesUsed.count(i.first))
+            warn("the flag '--override-input %s %s' does not match any input",
+                concatStringsSep("/", i.first), i.second);
+
+    for (auto & i : lockFlags.inputUpdates)
+        if (!updatesUsed.count(i))
+            warn("the flag '--update-input %s' does not match any input", concatStringsSep("/", i));
+
+    debug("new lock file: %s", newLockFile);
+
+    /* Check whether we need to / can write the new lock file. */
+    if (!(newLockFile == oldLockFile)) {
+
+        auto diff = diffLockFiles(oldLockFile, newLockFile);
+
+        if (!(oldLockFile == LockFile()))
+            printInfo("inputs of flake '%s' changed:\n%s", topRef, chomp(diff));
+
+        if (lockFlags.writeLockFile) {
+            if (auto sourcePath = topRef.input->getSourcePath()) {
+                if (!newLockFile.isImmutable()) {
+                    if (settings.warnDirty)
+                        warn("will not write lock file of flake '%s' because it has a mutable input", topRef);
+                } else {
+                    if (!lockFlags.updateLockFile)
+                        throw Error("flake '%s' requires lock file changes but they're not allowed due to '--no-update-lock-file'", topRef);
+
+                    auto relPath = (topRef.subdir == "" ? "" : topRef.subdir + "/") + "flake.lock";
+
+                    auto path = *sourcePath + "/" + relPath;
+
+                    bool lockFileExists = pathExists(path);
+
+                    if (lockFileExists)
+                        warn("updating lock file '%s'", path);
+                    else
+                        warn("creating lock file '%s'", path);
+
+                    newLockFile.write(path);
+
+                    topRef.input->markChangedFile(
+                        (topRef.subdir == "" ? "" : topRef.subdir + "/") + "flake.lock",
+                        lockFlags.commitLockFile
+                        ? std::optional<std::string>(fmt("%s: %s\n\nFlake input changes:\n\n%s",
+                                relPath, lockFileExists ? "Update" : "Add", diff))
+                        : std::nullopt);
+
+                    /* Rewriting the lockfile changed the top-level
+                       repo, so we should re-read it. FIXME: we could
+                       also just clear the 'rev' field... */
+                    auto prevLockedRef = flake.lockedRef;
+                    FlakeCache dummyCache;
+                    flake = getFlake(state, topRef, {}, lockFlags.useRegistries, dummyCache);
+
+                    if (lockFlags.commitLockFile &&
+                        flake.lockedRef.input->getRev() &&
+                        prevLockedRef.input->getRev() != flake.lockedRef.input->getRev())
+                        warn("committed new revision '%s'", flake.lockedRef.input->getRev()->gitRev());
+
+                    /* Make sure that we picked up the change,
+                       i.e. the tree should usually be dirty
+                       now. Corner case: we could have reverted from a
+                       dirty to a clean tree! */
+                    if (flake.lockedRef.input == prevLockedRef.input
+                        && !flake.lockedRef.input->isImmutable())
+                        throw Error("'%s' did not change after I updated its 'flake.lock' file; is 'flake.lock' under version control?", flake.originalRef);
+                }
+            } else
+                throw Error("cannot write modified lock file of flake '%s' (use '--no-write-lock-file' to ignore)", topRef);
+        } else
+            warn("not writing modified lock file of flake '%s'", topRef);
+    }
+
+    return LockedFlake { .flake = std::move(flake), .lockFile = std::move(newLockFile) };
+}
+
+void callFlake(EvalState & state,
+    const LockedFlake & lockedFlake,
+    Value & vRes)
+{
+    auto vLocks = state.allocValue();
+    auto vRootSrc = state.allocValue();
+    auto vRootSubdir = state.allocValue();
+    auto vTmp1 = state.allocValue();
+    auto vTmp2 = state.allocValue();
+
+    mkString(*vLocks, lockedFlake.lockFile.to_string());
+
+    emitTreeAttrs(state, *lockedFlake.flake.sourceInfo, lockedFlake.flake.lockedRef.input, *vRootSrc);
+
+    mkString(*vRootSubdir, lockedFlake.flake.lockedRef.subdir);
+
+    static RootValue vCallFlake = nullptr;
+
+    if (!vCallFlake) {
+        vCallFlake = allocRootValue(state.allocValue());
+        state.eval(state.parseExprFromString(
+            #include "call-flake.nix.gen.hh"
+            , "/"), **vCallFlake);
+    }
+
+    state.callFunction(**vCallFlake, *vLocks, *vTmp1, noPos);
+    state.callFunction(*vTmp1, *vRootSrc, *vTmp2, noPos);
+    state.callFunction(*vTmp2, *vRootSubdir, vRes, noPos);
+}
+
+static void prim_getFlake(EvalState & state, const Pos & pos, Value * * args, Value & v)
+{
+    auto flakeRefS = state.forceStringNoCtx(*args[0], pos);
+    auto flakeRef = parseFlakeRef(flakeRefS, {}, true);
+    if (evalSettings.pureEval && !flakeRef.input->isImmutable())
+        throw Error("cannot call 'getFlake' on mutable flake reference '%s', at %s (use --impure to override)", flakeRefS, pos);
+
+    callFlake(state,
+        lockFlake(state, flakeRef,
+            LockFlags {
+                .updateLockFile = false,
+                .useRegistries = !evalSettings.pureEval,
+                .allowMutable  = !evalSettings.pureEval,
+            }),
+        v);
+}
+
+static RegisterPrimOp r2("getFlake", 1, prim_getFlake);
+
+}
+
+Fingerprint LockedFlake::getFingerprint() const
+{
+    // FIXME: as an optimization, if the flake contains a lock file
+    // and we haven't changed it, then it's sufficient to use
+    // flake.sourceInfo.storePath for the fingerprint.
+    return hashString(htSHA256,
+        fmt("%s;%d;%d;%s",
+            flake.sourceInfo->storePath.to_string(),
+            flake.sourceInfo->info.revCount.value_or(0),
+            flake.sourceInfo->info.lastModified.value_or(0),
+            lockFile));
+}
+
+Flake::~Flake() { }
+
+}

src/libexpr/flake/flake.hh

@@ -0,0 +1,110 @@
+#pragma once
+
+#include "types.hh"
+#include "flakeref.hh"
+#include "lockfile.hh"
+#include "value.hh"
+
+namespace nix {
+
+class EvalState;
+
+namespace fetchers { struct Tree; }
+
+namespace flake {
+
+struct FlakeInput;
+
+typedef std::map<FlakeId, FlakeInput> FlakeInputs;
+
+struct FlakeInput
+{
+    FlakeRef ref;
+    bool isFlake = true;
+    std::optional<InputPath> follows;
+    FlakeInputs overrides;
+};
+
+struct Flake
+{
+    FlakeRef originalRef;
+    FlakeRef resolvedRef;
+    FlakeRef lockedRef;
+    std::optional<std::string> description;
+    std::shared_ptr<const fetchers::Tree> sourceInfo;
+    FlakeInputs inputs;
+    RootValue vOutputs;
+    ~Flake();
+};
+
+Flake getFlake(EvalState & state, const FlakeRef & flakeRef, bool allowLookup);
+
+/* Fingerprint of a locked flake; used as a cache key. */
+typedef Hash Fingerprint;
+
+struct LockedFlake
+{
+    Flake flake;
+    LockFile lockFile;
+
+    Fingerprint getFingerprint() const;
+};
+
+struct LockFlags
+{
+    /* Whether to ignore the existing lock file, creating a new one
+       from scratch. */
+    bool recreateLockFile = false;
+
+    /* Whether to update the lock file at all. If set to false, if any
+       change to the lock file is needed (e.g. when an input has been
+       added to flake.nix), you get a fatal error. */
+    bool updateLockFile = true;
+
+    /* Whether to write the lock file to disk. If set to true, if the
+       any changes to the lock file are needed and the flake is not
+       writable (i.e. is not a local Git working tree or similar), you
+       get a fatal error. If set to false, Nix will use the modified
+       lock file in memory only, without writing it to disk. */
+    bool writeLockFile = true;
+
+    /* Whether to use the registries to lookup indirect flake
+       references like 'nixpkgs'. */
+    bool useRegistries = true;
+
+    /* Whether mutable flake references (i.e. those without a Git
+       revision or similar) without a corresponding lock are
+       allowed. Mutable flake references with a lock are always
+       allowed. */
+    bool allowMutable = true;
+
+    /* Whether to commit changes to flake.lock. */
+    bool commitLockFile = false;
+
+    /* Flake inputs to be overriden. */
+    std::map<InputPath, FlakeRef> inputOverrides;
+
+    /* Flake inputs to be updated. This means that any existing lock
+       for those inputs will be ignored. */
+    std::set<InputPath> inputUpdates;
+};
+
+LockedFlake lockFlake(
+    EvalState & state,
+    const FlakeRef & flakeRef,
+    const LockFlags & lockFlags);
+
+void callFlake(
+    EvalState & state,
+    const LockedFlake & lockedFlake,
+    Value & v);
+
+}
+
+void emitTreeAttrs(
+    EvalState & state,
+    const fetchers::Tree & tree,
+    std::shared_ptr<const fetchers::Input> input,
+    Value & v);
+
+}

src/libexpr/flake/flakeref.cc

@@ -0,0 +1,196 @@
+#include "flakeref.hh"
+#include "store-api.hh"
+#include "url.hh"
+#include "fetchers.hh"
+#include "registry.hh"
+
+namespace nix {
+
+#if 0
+// 'dir' path elements cannot start with a '.'. We also reject
+// potentially dangerous characters like ';'.
+const static std::string subDirElemRegex = "(?:[a-zA-Z0-9_-]+[a-zA-Z0-9._-]*)";
+const static std::string subDirRegex = subDirElemRegex + "(?:/" + subDirElemRegex + ")*";
+#endif
+
+std::string FlakeRef::to_string() const
+{
+    auto url = input->toURL();
+    if (subdir != "")
+        url.query.insert_or_assign("dir", subdir);
+    return url.to_string();
+}
+
+fetchers::Attrs FlakeRef::toAttrs() const
+{
+    auto attrs = input->toAttrs();
+    if (subdir != "")
+        attrs.emplace("dir", subdir);
+    return attrs;
+}
+
+std::ostream & operator << (std::ostream & str, const FlakeRef & flakeRef)
+{
+    str << flakeRef.to_string();
+    return str;
+}
+
+bool FlakeRef::operator ==(const FlakeRef & other) const
+{
+    return *input == *other.input && subdir == other.subdir;
+}
+
+FlakeRef FlakeRef::resolve(ref<Store> store) const
+{
+    auto [input2, extraAttrs] = lookupInRegistries(store, input);
+    return FlakeRef(input2, fetchers::maybeGetStrAttr(extraAttrs, "dir").value_or(subdir));
+}
+
+FlakeRef parseFlakeRef(
+    const std::string & url, const std::optional<Path> & baseDir, bool allowMissing)
+{
+    auto [flakeRef, fragment] = parseFlakeRefWithFragment(url, baseDir, allowMissing);
+    if (fragment != "")
+        throw Error("unexpected fragment '%s' in flake reference '%s'", fragment, url);
+    return flakeRef;
+}
+
+std::optional<FlakeRef> maybeParseFlakeRef(
+    const std::string & url, const std::optional<Path> & baseDir)
+{
+    try {
+        return parseFlakeRef(url, baseDir);
+    } catch (Error &) {
+        return {};
+    }
+}
+
+std::pair<FlakeRef, std::string> parseFlakeRefWithFragment(
+    const std::string & url, const std::optional<Path> & baseDir, bool allowMissing)
+{
+    using namespace fetchers;
+
+    static std::string fnRegex = "[0-9a-zA-Z-._~!$&'\"()*+,;=]+";
+
+    static std::regex pathUrlRegex(
+        "(/?" + fnRegex + "(?:/" + fnRegex + ")*/?)"
+        + "(?:\\?(" + queryRegex + "))?"
+        + "(?:#(" + queryRegex + "))?",
+        std::regex::ECMAScript);
+
+    static std::regex flakeRegex(
+        "((" + flakeIdRegexS + ")(?:/(?:" + refAndOrRevRegex + "))?)"
+        + "(?:#(" + queryRegex + "))?",
+        std::regex::ECMAScript);
+
+    std::smatch match;
+
+    /* Check if 'url' is a flake ID. This is an abbreviated syntax for
+       'flake:<flake-id>?ref=<ref>&rev=<rev>'. */
+
+    if (std::regex_match(url, match, flakeRegex)) {
+        auto parsedURL = ParsedURL{
+            .url = url,
+            .base = "flake:" + std::string(match[1]),
+            .scheme = "flake",
+            .authority = "",
+            .path = match[1],
+        };
+
+        return std::make_pair(
+            FlakeRef(inputFromURL(parsedURL), ""),
+            percentDecode(std::string(match[6])));
+    }
+
+    /* Check if 'url' is a path (either absolute or relative to
+       'baseDir'). If so, search upward to the root of the repo
+       (i.e. the directory containing .git). */
+
+    else if (std::regex_match(url, match, pathUrlRegex)) {
+        std::string path = match[1];
+        if (!baseDir && !hasPrefix(path, "/"))
+            throw BadURL("flake reference '%s' is not an absolute path", url);
+        path = absPath(path, baseDir, true);
+
+        if (!S_ISDIR(lstat(path).st_mode))
+            throw BadURL("path '%s' is not a flake (because it's not a directory)", path);
+
+        if (!allowMissing && !pathExists(path + "/flake.nix"))
+            throw BadURL("path '%s' is not a flake (because it doesn't contain a 'flake.nix' file)", path);
+
+        auto fragment = percentDecode(std::string(match[3]));
+
+        auto flakeRoot = path;
+        std::string subdir;
+
+        while (flakeRoot != "/") {
+            if (pathExists(flakeRoot + "/.git")) {
+                auto base = std::string("git+file://") + flakeRoot;
+
+                auto parsedURL = ParsedURL{
+                    .url = base, // FIXME
+                    .base = base,
+                    .scheme = "git+file",
+                    .authority = "",
+                    .path = flakeRoot,
+                    .query = decodeQuery(match[2]),
+                };
+
+                if (subdir != "") {
+                    if (parsedURL.query.count("dir"))
+                        throw Error("flake URL '%s' has an inconsistent 'dir' parameter", url);
+                    parsedURL.query.insert_or_assign("dir", subdir);
+                }
+
+                return std::make_pair(
+                    FlakeRef(inputFromURL(parsedURL), get(parsedURL.query, "dir").value_or("")),
+                    fragment);
+            }
+
+            subdir = std::string(baseNameOf(flakeRoot)) + (subdir.empty() ? "" : "/" + subdir);
+            flakeRoot = dirOf(flakeRoot);
+        }
+
+        fetchers::Attrs attrs;
+        attrs.insert_or_assign("type", "path");
+        attrs.insert_or_assign("path", path);
+
+        return std::make_pair(FlakeRef(inputFromAttrs(attrs), ""), fragment);
+    }
+
+    else {
+        auto parsedURL = parseURL(url);
+        std::string fragment;
+        std::swap(fragment, parsedURL.fragment);
+        return std::make_pair(
+            FlakeRef(inputFromURL(parsedURL), get(parsedURL.query, "dir").value_or("")),
+            fragment);
+    }
+}
+
+std::optional<std::pair<FlakeRef, std::string>> maybeParseFlakeRefWithFragment(
+    const std::string & url, const std::optional<Path> & baseDir)
+{
+    try {
+        return parseFlakeRefWithFragment(url, baseDir);
+    } catch (Error & e) {
+        return {};
+    }
+}
+
+FlakeRef FlakeRef::fromAttrs(const fetchers::Attrs & attrs)
+{
+    auto attrs2(attrs);
+    attrs2.erase("dir");
+    return FlakeRef(
+        fetchers::inputFromAttrs(attrs2),
+        fetchers::maybeGetStrAttr(attrs, "dir").value_or(""));
+}
+
+std::pair<fetchers::Tree, FlakeRef> FlakeRef::fetchTree(ref<Store> store) const
+{
+    auto [tree, lockedInput] = input->fetchTree(store);
+    return {std::move(tree), FlakeRef(lockedInput, subdir)};
+}
+
+}

src/libexpr/flake/flakeref.hh

@@ -0,0 +1,55 @@
+#pragma once
+
+#include "types.hh"
+#include "hash.hh"
+#include "fetchers.hh"
+
+#include <variant>
+
+namespace nix {
+
+class Store;
+
+typedef std::string FlakeId;
+
+struct FlakeRef
+{
+    std::shared_ptr<const fetchers::Input> input;
+
+    Path subdir;
+
+    bool operator==(const FlakeRef & other) const;
+
+    FlakeRef(const std::shared_ptr<const fetchers::Input> & input, const Path & subdir)
+        : input(input), subdir(subdir)
+    {
+        assert(input);
+    }
+
+    // FIXME: change to operator <<.
+    std::string to_string() const;
+
+    fetchers::Attrs toAttrs() const;
+
+    FlakeRef resolve(ref<Store> store) const;
+
+    static FlakeRef fromAttrs(const fetchers::Attrs & attrs);
+
+    std::pair<fetchers::Tree, FlakeRef> fetchTree(ref<Store> store) const;
+};
+
+std::ostream & operator << (std::ostream & str, const FlakeRef & flakeRef);
+
+FlakeRef parseFlakeRef(
+    const std::string & url, const std::optional<Path> & baseDir = {}, bool allowMissing = false);
+
+std::optional<FlakeRef> maybeParseFlake(
+    const std::string & url, const std::optional<Path> & baseDir = {});
+
+std::pair<FlakeRef, std::string> parseFlakeRefWithFragment(
+    const std::string & url, const std::optional<Path> & baseDir = {}, bool allowMissing = false);
+
+std::optional<std::pair<FlakeRef, std::string>> maybeParseFlakeRefWithFragment(
+    const std::string & url, const std::optional<Path> & baseDir = {});
+
+}

src/libexpr/flake/lockfile.cc

@@ -0,0 +1,256 @@
+#include "lockfile.hh"
+#include "store-api.hh"
+
+#include <nlohmann/json.hpp>
+
+namespace nix::flake {
+
+FlakeRef flakeRefFromJson(const nlohmann::json & json)
+{
+    return FlakeRef::fromAttrs(jsonToAttrs(json));
+}
+
+FlakeRef getFlakeRef(
+    const nlohmann::json & json,
+    const char * attr)
+{
+    auto i = json.find(attr);
+    if (i != json.end())
+        return flakeRefFromJson(*i);
+
+    throw Error("attribute '%s' missing in lock file", attr);
+}
+
+LockedNode::LockedNode(const nlohmann::json & json)
+    : lockedRef(getFlakeRef(json, "locked"))
+    , originalRef(getFlakeRef(json, "original"))
+    , info(TreeInfo::fromJson(json))
+    , isFlake(json.find("flake") != json.end() ? (bool) json["flake"] : true)
+{
+    if (!lockedRef.input->isImmutable())
+        throw Error("lockfile contains mutable flakeref '%s'", lockedRef);
+}
+
+StorePath LockedNode::computeStorePath(Store & store) const
+{
+    return info.computeStorePath(store);
+}
+
+std::shared_ptr<Node> Node::findInput(const InputPath & path)
+{
+    auto pos = shared_from_this();
+
+    for (auto & elem : path) {
+        auto i = pos->inputs.find(elem);
+        if (i == pos->inputs.end())
+            return {};
+        pos = i->second;
+    }
+
+    return pos;
+}
+
+LockFile::LockFile(const nlohmann::json & json, const Path & path)
+{
+    auto version = json.value("version", 0);
+    if (version != 5)
+        throw Error("lock file '%s' has unsupported version %d", path, version);
+
+    std::unordered_map<std::string, std::shared_ptr<Node>> nodeMap;
+
+    std::function<void(Node & node, const nlohmann::json & jsonNode)> getInputs;
+
+    getInputs = [&](Node & node, const nlohmann::json & jsonNode)
+    {
+        if (jsonNode.find("inputs") == jsonNode.end()) return;
+        for (auto & i : jsonNode["inputs"].items()) {
+            std::string inputKey = i.value();
+            auto k = nodeMap.find(inputKey);
+            if (k == nodeMap.end()) {
+                auto jsonNode2 = json["nodes"][inputKey];
+                auto input = std::make_shared<LockedNode>(jsonNode2);
+                k = nodeMap.insert_or_assign(inputKey, input).first;
+                getInputs(*input, jsonNode2);
+            }
+            node.inputs.insert_or_assign(i.key(), k->second);
+        }
+    };
+
+    std::string rootKey = json["root"];
+    nodeMap.insert_or_assign(rootKey, root);
+    getInputs(*root, json["nodes"][rootKey]);
+}
+
+nlohmann::json LockFile::toJson() const
+{
+    nlohmann::json nodes;
+    std::unordered_map<std::shared_ptr<const Node>, std::string> nodeKeys;
+    std::unordered_set<std::string> keys;
+
+    std::function<std::string(const std::string & key, std::shared_ptr<const Node> node)> dumpNode;
+
+    dumpNode = [&](std::string key, std::shared_ptr<const Node> node) -> std::string
+    {
+        auto k = nodeKeys.find(node);
+        if (k != nodeKeys.end())
+            return k->second;
+
+        if (!keys.insert(key).second) {
+            for (int n = 2; ; ++n) {
+                auto k = fmt("%s_%d", key, n);
+                if (keys.insert(k).second) {
+                    key = k;
+                    break;
+                }
+            }
+        }
+
+        nodeKeys.insert_or_assign(node, key);
+
+        auto n = nlohmann::json::object();
+
+        if (!node->inputs.empty()) {
+            auto inputs = nlohmann::json::object();
+            for (auto & i : node->inputs)
+                inputs[i.first] = dumpNode(i.first, i.second);
+            n["inputs"] = std::move(inputs);
+        }
+
+        if (auto lockedNode = std::dynamic_pointer_cast<const LockedNode>(node)) {
+            n["original"] = fetchers::attrsToJson(lockedNode->originalRef.toAttrs());
+            n["locked"] = fetchers::attrsToJson(lockedNode->lockedRef.toAttrs());
+            n["info"] = lockedNode->info.toJson();
+            if (!lockedNode->isFlake) n["flake"] = false;
+        }
+
+        nodes[key] = std::move(n);
+
+        return key;
+    };
+
+    nlohmann::json json;
+    json["version"] = 5;
+    json["root"] = dumpNode("root", root);
+    json["nodes"] = std::move(nodes);
+
+    return json;
+}
+
+std::string LockFile::to_string() const
+{
+    return toJson().dump(2);
+}
+
+LockFile LockFile::read(const Path & path)
+{
+    if (!pathExists(path)) return LockFile();
+    return LockFile(nlohmann::json::parse(readFile(path)), path);
+}
+
+std::ostream & operator <<(std::ostream & stream, const LockFile & lockFile)
+{
+    stream << lockFile.toJson().dump(2);
+    return stream;
+}
+
+void LockFile::write(const Path & path) const
+{
+    createDirs(dirOf(path));
+    writeFile(path, fmt("%s\n", *this));
+}
+
+bool LockFile::isImmutable() const
+{
+    std::unordered_set<std::shared_ptr<const Node>> nodes;
+
+    std::function<void(std::shared_ptr<const Node> node)> visit;
+
+    visit = [&](std::shared_ptr<const Node> node)
+    {
+        if (!nodes.insert(node).second) return;
+        for (auto & i : node->inputs) visit(i.second);
+    };
+
+    visit(root);
+
+    for (auto & i : nodes) {
+        if (i == root) continue;
+        auto lockedNode = std::dynamic_pointer_cast<const LockedNode>(i);
+        if (lockedNode && !lockedNode->lockedRef.input->isImmutable()) return false;
+    }
+
+    return true;
+}
+
+bool LockFile::operator ==(const LockFile & other) const
+{
+    // FIXME: slow
+    return toJson() == other.toJson();
+}
+
+InputPath parseInputPath(std::string_view s)
+{
+    InputPath path;
+
+    for (auto & elem : tokenizeString<std::vector<std::string>>(s, "/")) {
+        if (!std::regex_match(elem, flakeIdRegex))
+            throw Error("invalid flake input path element '%s'", elem);
+        path.push_back(elem);
+    }
+
+    return path;
+}
+
+static void flattenLockFile(
+    std::shared_ptr<const Node> node,
+    const InputPath & prefix,
+    std::unordered_set<std::shared_ptr<const Node>> & done,
+    std::map<InputPath, std::shared_ptr<const LockedNode>> & res)
+{
+    if (!done.insert(node).second) return;
+
+    for (auto &[id, input] : node->inputs) {
+        auto inputPath(prefix);
+        inputPath.push_back(id);
+        if (auto lockedInput = std::dynamic_pointer_cast<const LockedNode>(input))
+            res.emplace(inputPath, lockedInput);
+        flattenLockFile(input, inputPath, done, res);
+    }
+}
+
+std::string diffLockFiles(const LockFile & oldLocks, const LockFile & newLocks)
+{
+    std::unordered_set<std::shared_ptr<const Node>> done;
+    std::map<InputPath, std::shared_ptr<const LockedNode>> oldFlat, newFlat;
+    flattenLockFile(oldLocks.root, {}, done, oldFlat);
+    done.clear();
+    flattenLockFile(newLocks.root, {}, done, newFlat);
+
+    auto i = oldFlat.begin();
+    auto j = newFlat.begin();
+    std::string res;
+
+    while (i != oldFlat.end() || j != newFlat.end()) {
+        if (j != newFlat.end() && (i == oldFlat.end() || i->first > j->first)) {
+            res += fmt("* Added '%s': '%s'\n", concatStringsSep("/", j->first), j->second->lockedRef);
+            ++j;
+        } else if (i != oldFlat.end() && (j == newFlat.end() || i->first < j->first)) {
+            res += fmt("* Removed '%s'\n", concatStringsSep("/", i->first));
+            ++i;
+        } else {
+            if (!(i->second->lockedRef == j->second->lockedRef)) {
+                assert(i->second->lockedRef.to_string() != j->second->lockedRef.to_string());
+                res += fmt("* Updated '%s': '%s' -> '%s'\n",
+                    concatStringsSep("/", i->first),
+                    i->second->lockedRef,
+                    j->second->lockedRef);
+            }
+            ++i;
+            ++j;
+        }
+    }
+
+    return res;
+}
+
+}

src/libexpr/flake/lockfile.hh

@@ -0,0 +1,77 @@
+#pragma once
+
+#include "flakeref.hh"
+
+#include <nlohmann/json_fwd.hpp>
+
+namespace nix {
+class Store;
+struct StorePath;
+}
+
+namespace nix::flake {
+
+using namespace fetchers;
+
+typedef std::vector<FlakeId> InputPath;
+
+/* A node in the lock file. It has outgoing edges to other nodes (its
+   inputs). Only the root node has this type; all other nodes have
+   type LockedNode. */
+struct Node : std::enable_shared_from_this<Node>
+{
+    std::map<FlakeId, std::shared_ptr<Node>> inputs;
+
+    virtual ~Node() { }
+
+    std::shared_ptr<Node> findInput(const InputPath & path);
+};
+
+/* A non-root node in the lock file. */
+struct LockedNode : Node
+{
+    FlakeRef lockedRef, originalRef;
+    TreeInfo info;
+    bool isFlake = true;
+
+    LockedNode(
+        const FlakeRef & lockedRef,
+        const FlakeRef & originalRef,
+        const TreeInfo & info,
+        bool isFlake = true)
+        : lockedRef(lockedRef), originalRef(originalRef), info(info), isFlake(isFlake)
+    { }
+
+    LockedNode(const nlohmann::json & json);
+
+    StorePath computeStorePath(Store & store) const;
+};
+
+struct LockFile
+{
+    std::shared_ptr<Node> root = std::make_shared<Node>();
+
+    LockFile() {};
+    LockFile(const nlohmann::json & json, const Path & path);
+
+    nlohmann::json toJson() const;
+
+    std::string to_string() const;
+
+    static LockFile read(const Path & path);
+
+    void write(const Path & path) const;
+
+    bool isImmutable() const;
+
+    bool operator ==(const LockFile & other) const;
+};
+
+std::ostream & operator <<(std::ostream & stream, const LockFile & lockFile);
+
+InputPath parseInputPath(std::string_view s);
+
+std::string diffLockFiles(const LockFile & oldLocks, const LockFile & newLocks);
+
+}
+

src/libexpr/get-drvs.cc

@@ -348,7 +348,7 @@ static void getDerivations(EvalState & state, Value & vIn,
                    should we recurse into it?  => Only if it has a
                    `recurseForDerivations = true' attribute. */
                 if (i->value->type == tAttrs) {
-                    Bindings::iterator j = i->value->attrs->find(state.symbols.create("recurseForDerivations"));
+                    Bindings::iterator j = i->value->attrs->find(state.sRecurseForDerivations);
                     if (j != i->value->attrs->end() && state.forceBool(*j->value, *j->pos))
                         getDerivations(state, *i->value, pathPrefix2, autoArgs, drvs, done, ignoreAssertionFailures);
                 }

src/libexpr/local.mk

@@ -4,7 +4,12 @@ libexpr_NAME = libnixexpr
 
 libexpr_DIR := $(d)
 
-libexpr_SOURCES := $(wildcard $(d)/*.cc) $(wildcard $(d)/primops/*.cc) $(d)/lexer-tab.cc $(d)/parser-tab.cc
+libexpr_SOURCES := \
+  $(wildcard $(d)/*.cc) \
+  $(wildcard $(d)/primops/*.cc) \
+  $(wildcard $(d)/flake/*.cc) \
+  $(d)/lexer-tab.cc \
+  $(d)/parser-tab.cc
 
 libexpr_CXXFLAGS += -I src/libutil -I src/libstore -I src/libfetchers -I src/libmain -I src/libexpr
 
@@ -34,4 +39,9 @@ dist-files += $(d)/parser-tab.cc $(d)/parser-tab.hh $(d)/lexer-tab.cc $(d)/lexer
 
 $(eval $(call install-file-in, $(d)/nix-expr.pc, $(prefix)/lib/pkgconfig, 0644))
 
+$(foreach i, $(wildcard src/libexpr/flake/*.hh), \
+  $(eval $(call install-file-in, $(i), $(includedir)/nix/flake, 0644)))
+
 $(d)/primops.cc: $(d)/imported-drv-to-derivation.nix.gen.hh
+
+$(d)/flake/flake.cc: $(d)/flake/call-flake.nix.gen.hh

src/libexpr/primops.cc

@@ -50,20 +50,20 @@ void EvalState::realiseContext(const PathSet & context)
     std::vector<StorePathWithOutputs> drvs;
 
     for (auto & i : context) {
-        std::pair<string, string> decoded = decodeContext(i);
-        auto ctx = store->parseStorePath(decoded.first);
+        auto [ctxS, outputName] = decodeContext(i);
+        auto ctx = store->parseStorePath(ctxS);
         if (!store->isValidPath(ctx))
             throw InvalidPathError(store->printStorePath(ctx));
-        if (!decoded.second.empty() && ctx.isDerivation()) {
-            drvs.push_back(StorePathWithOutputs{ctx.clone(), {decoded.second}});
+        if (!outputName.empty() && ctx.isDerivation()) {
+            drvs.push_back(StorePathWithOutputs{ctx.clone(), {outputName}});
 
             /* Add the output of this derivation to the allowed
                paths. */
             if (allowedPaths) {
-                auto drv = store->derivationFromPath(store->parseStorePath(decoded.first));
-                DerivationOutputs::iterator i = drv.outputs.find(decoded.second);
+                auto drv = store->derivationFromPath(ctx);
+                DerivationOutputs::iterator i = drv.outputs.find(outputName);
                 if (i == drv.outputs.end())
-                    throw Error("derivation '%s' does not have an output named '%s'", decoded.first, decoded.second);
+                    throw Error("derivation '%s' does not have an output named '%s'", ctxS, outputName);
                 allowedPaths->insert(store->printStorePath(i->second.path));
             }
         }
@@ -79,6 +79,7 @@ void EvalState::realiseContext(const PathSet & context)
     StorePathSet willBuild, willSubstitute, unknown;
     unsigned long long downloadSize, narSize;
     store->queryMissing(drvs, willBuild, willSubstitute, unknown, downloadSize, narSize);
+
     store->buildPaths(drvs);
 }
 

src/libexpr/primops/fetchTree.cc

@@ -3,6 +3,7 @@
 #include "store-api.hh"
 #include "fetchers.hh"
 #include "filetransfer.hh"
+#include "registry.hh"
 
 #include <ctime>
 #include <iomanip>
@@ -33,9 +34,11 @@ void emitTreeAttrs(
     if (tree.info.revCount)
         mkInt(*state.allocAttr(v, state.symbols.create("revCount")), *tree.info.revCount);
 
-    if (tree.info.lastModified)
-        mkString(*state.allocAttr(v, state.symbols.create("lastModified")),
+    if (tree.info.lastModified) {
+        mkInt(*state.allocAttr(v, state.symbols.create("lastModified")), *tree.info.lastModified);
+        mkString(*state.allocAttr(v, state.symbols.create("lastModifiedDate")),
             fmt("%s", std::put_time(std::gmtime(&*tree.info.lastModified), "%Y%m%d%H%M%S")));
+    }
 
     v.attrs->sort();
 }
@@ -60,8 +63,10 @@ static void prim_fetchTree(EvalState & state, const Pos & pos, Value * * args, V
                 attrs.emplace(attr.name, attr.value->string.s);
             else if (attr.value->type == tBool)
                 attrs.emplace(attr.name, attr.value->boolean);
+            else if (attr.value->type == tInt)
+                attrs.emplace(attr.name, attr.value->integer);
             else
-                throw TypeError("fetchTree argument '%s' is %s while a string or Boolean is expected",
+                throw TypeError("fetchTree argument '%s' is %s while a string, Boolean or integer is expected",
                     attr.name, showType(*attr.value));
         }
 
@@ -72,8 +77,11 @@ static void prim_fetchTree(EvalState & state, const Pos & pos, Value * * args, V
     } else
         input = fetchers::inputFromURL(state.coerceToString(pos, *args[0], context, false, false));
 
+    if (!evalSettings.pureEval && !input->isDirect())
+        input = lookupInRegistries(state.store, input).first;
+
     if (evalSettings.pureEval && !input->isImmutable())
-        throw Error("in pure evaluation mode, 'fetchTree' requires an immutable input");
+        throw Error("in pure evaluation mode, 'fetchTree' requires an immutable input, at %s", pos);
 
     // FIXME: use fetchOrSubstituteTree
     auto [tree, input2] = input->fetchTree(state.store);

src/libexpr/symbol-table.hh

@@ -28,6 +28,12 @@ public:
         return s == s2.s;
     }
 
+    // FIXME: remove
+    bool operator == (std::string_view s2) const
+    {
+        return s->compare(s2) == 0;
+    }
+
     bool operator != (const Symbol & s2) const
     {
         return s != s2.s;
@@ -68,9 +74,10 @@ private:
     Symbols symbols;
 
 public:
-    Symbol create(const string & s)
+    Symbol create(std::string_view s)
     {
-        std::pair<Symbols::iterator, bool> res = symbols.insert(s);
+        // FIXME: avoid allocation if 's' already exists in the symbol table.
+        std::pair<Symbols::iterator, bool> res = symbols.emplace(std::string(s));
         return Symbol(&*res.first);
     }
 

src/libexpr/value.hh

@@ -166,6 +166,11 @@ struct Value
     {
         return type == tList1 ? 1 : type == tList2 ? 2 : bigList.size;
     }
+
+    /* Check whether forcing this value requires a trivial amount of
+       computation. In particular, function applications are
+       non-trivial. */
+    bool isTrivial() const;
 };
 
 

src/libfetchers/fetchers.cc

@@ -72,4 +72,15 @@ std::pair<Tree, std::shared_ptr<const Input>> Input::fetchTree(ref<Store> store)
     return {std::move(tree), input};
 }
 
+std::shared_ptr<const Input> Input::applyOverrides(
+    std::optional<std::string> ref,
+    std::optional<Hash> rev) const
+{
+    if (ref)
+        throw Error("don't know how to apply '%s' to '%s'", *ref, to_string());
+    if (rev)
+        throw Error("don't know how to apply '%s' to '%s'", rev->to_string(Base16, false), to_string());
+    return shared_from_this();
+}
+
 }

src/libfetchers/fetchers.hh

@@ -57,6 +57,22 @@ struct Input : std::enable_shared_from_this<Input>
 
     std::pair<Tree, std::shared_ptr<const Input>> fetchTree(ref<Store> store) const;
 
+    virtual std::shared_ptr<const Input> applyOverrides(
+        std::optional<std::string> ref,
+        std::optional<Hash> rev) const;
+
+    virtual std::optional<Path> getSourcePath() const { return {}; }
+
+    virtual void markChangedFile(
+        std::string_view file,
+        std::optional<std::string> commitMsg) const
+    { assert(false); }
+
+    virtual void clone(const Path & destDir) const
+    {
+        throw Error("do not know how to clone input '%s'", to_string());
+    }
+
 private:
 
     virtual std::pair<Tree, std::shared_ptr<const Input>> fetchTreeInternal(ref<Store> store) const = 0;

src/libfetchers/git.cc

@@ -79,6 +79,63 @@ struct GitInput : Input
         return attrs;
     }
 
+    void clone(const Path & destDir) const override
+    {
+        auto [isLocal, actualUrl] = getActualUrl();
+
+        Strings args = {"clone"};
+
+        args.push_back(actualUrl);
+
+        if (ref) {
+            args.push_back("--branch");
+            args.push_back(*ref);
+        }
+
+        if (rev) throw Error("cloning a specific revision is not implemented");
+
+        args.push_back(destDir);
+
+        runProgram("git", true, args);
+    }
+
+    std::shared_ptr<const Input> applyOverrides(
+        std::optional<std::string> ref,
+        std::optional<Hash> rev) const override
+    {
+        if (!ref && !rev) return shared_from_this();
+
+        auto res = std::make_shared<GitInput>(*this);
+
+        if (ref) res->ref = ref;
+        if (rev) res->rev = rev;
+
+        if (!res->ref && res->rev)
+            throw Error("Git input '%s' has a commit hash but no branch/tag name", res->to_string());
+
+        return res;
+    }
+
+    std::optional<Path> getSourcePath() const override
+    {
+        if (url.scheme == "file" && !ref && !rev)
+            return url.path;
+        return {};
+    }
+
+    void markChangedFile(std::string_view file, std::optional<std::string> commitMsg) const override
+    {
+        auto sourcePath = getSourcePath();
+        assert(sourcePath);
+
+        runProgram("git", true,
+            { "-C", *sourcePath, "add", "--force", "--intent-to-add", std::string(file) });
+
+        if (commitMsg)
+            runProgram("git", true,
+                { "-C", *sourcePath, "commit", std::string(file), "-m", *commitMsg });
+    }
+
     std::pair<bool, std::string> getActualUrl() const
     {
         // Don't clone file:// URIs (but otherwise treat them the

src/libfetchers/github.cc

@@ -64,6 +64,13 @@ struct GitHubInput : Input
         return attrs;
     }
 
+    void clone(const Path & destDir) const override
+    {
+        std::shared_ptr<const Input> input = inputFromURL(fmt("git+ssh://git@github.com/%s/%s.git", owner, repo));
+        input = input->applyOverrides(ref.value_or("master"), rev);
+        input->clone(destDir);
+    }
+
     std::pair<Tree, std::shared_ptr<const Input>> fetchTreeInternal(nix::ref<Store> store) const override
     {
         auto rev = this->rev;
@@ -126,6 +133,20 @@ struct GitHubInput : Input
 
         return {std::move(tree), input};
     }
+
+    std::shared_ptr<const Input> applyOverrides(
+        std::optional<std::string> ref,
+        std::optional<Hash> rev) const override
+    {
+        if (!ref && !rev) return shared_from_this();
+
+        auto res = std::make_shared<GitHubInput>(*this);
+
+        if (ref) res->ref = ref;
+        if (rev) res->rev = rev;
+
+        return res;
+    }
 };
 
 struct GitHubInputScheme : InputScheme

src/libfetchers/indirect.cc

@@ -0,0 +1,140 @@
+#include "fetchers.hh"
+
+namespace nix::fetchers {
+
+std::regex flakeRegex("[a-zA-Z][a-zA-Z0-9_-]*", std::regex::ECMAScript);
+
+struct IndirectInput : Input
+{
+    std::string id;
+    std::optional<Hash> rev;
+    std::optional<std::string> ref;
+
+    std::string type() const override { return "indirect"; }
+
+    bool operator ==(const Input & other) const override
+    {
+        auto other2 = dynamic_cast<const IndirectInput *>(&other);
+        return
+            other2
+            && id == other2->id
+            && rev == other2->rev
+            && ref == other2->ref;
+    }
+
+    bool isDirect() const override
+    {
+        return false;
+    }
+
+    std::optional<std::string> getRef() const override { return ref; }
+
+    std::optional<Hash> getRev() const override { return rev; }
+
+    bool contains(const Input & other) const override
+    {
+        auto other2 = dynamic_cast<const IndirectInput *>(&other);
+        return
+            other2
+            && id == other2->id
+            && (!ref || ref == other2->ref)
+            && (!rev || rev == other2->rev);
+    }
+
+    ParsedURL toURL() const override
+    {
+        ParsedURL url;
+        url.scheme = "flake";
+        url.path = id;
+        if (ref) { url.path += '/'; url.path += *ref; };
+        if (rev) { url.path += '/'; url.path += rev->gitRev(); };
+        return url;
+    }
+
+    Attrs toAttrsInternal() const override
+    {
+        Attrs attrs;
+        attrs.emplace("id", id);
+        if (ref)
+            attrs.emplace("ref", *ref);
+        if (rev)
+            attrs.emplace("rev", rev->gitRev());
+        return attrs;
+    }
+
+    std::shared_ptr<const Input> applyOverrides(
+        std::optional<std::string> ref,
+        std::optional<Hash> rev) const override
+    {
+        if (!ref && !rev) return shared_from_this();
+
+        auto res = std::make_shared<IndirectInput>(*this);
+
+        if (ref) res->ref = ref;
+        if (rev) res->rev = rev;
+
+        return res;
+    }
+
+    std::pair<Tree, std::shared_ptr<const Input>> fetchTreeInternal(nix::ref<Store> store) const override
+    {
+        throw Error("indirect input '%s' cannot be fetched directly", to_string());
+    }
+};
+
+struct IndirectInputScheme : InputScheme
+{
+    std::unique_ptr<Input> inputFromURL(const ParsedURL & url) override
+    {
+        if (url.scheme != "flake") return nullptr;
+
+        auto path = tokenizeString<std::vector<std::string>>(url.path, "/");
+        auto input = std::make_unique<IndirectInput>();
+
+        if (path.size() == 1) {
+        } else if (path.size() == 2) {
+            if (std::regex_match(path[1], revRegex))
+                input->rev = Hash(path[1], htSHA1);
+            else if (std::regex_match(path[1], refRegex))
+                input->ref = path[1];
+            else
+                throw BadURL("in flake URL '%s', '%s' is not a commit hash or branch/tag name", url.url, path[1]);
+        } else if (path.size() == 3) {
+            if (!std::regex_match(path[1], refRegex))
+                throw BadURL("in flake URL '%s', '%s' is not a branch/tag name", url.url, path[1]);
+            input->ref = path[1];
+            if (!std::regex_match(path[2], revRegex))
+                throw BadURL("in flake URL '%s', '%s' is not a commit hash", url.url, path[2]);
+            input->rev = Hash(path[2], htSHA1);
+        } else
+            throw BadURL("GitHub URL '%s' is invalid", url.url);
+
+        // FIXME: forbid query params?
+
+        input->id = path[0];
+        if (!std::regex_match(input->id, flakeRegex))
+            throw BadURL("'%s' is not a valid flake ID", input->id);
+
+        return input;
+    }
+
+    std::unique_ptr<Input> inputFromAttrs(const Attrs & attrs) override
+    {
+        if (maybeGetStrAttr(attrs, "type") != "indirect") return {};
+
+        for (auto & [name, value] : attrs)
+            if (name != "type" && name != "id" && name != "ref" && name != "rev")
+                throw Error("unsupported indirect input attribute '%s'", name);
+
+        auto input = std::make_unique<IndirectInput>();
+        input->id = getStrAttr(attrs, "id");
+        input->ref = maybeGetStrAttr(attrs, "ref");
+        if (auto rev = maybeGetStrAttr(attrs, "rev"))
+            input->rev = Hash(*rev, htSHA1);
+        return input;
+    }
+};
+
+static auto r1 = OnStartup([] { registerInputScheme(std::make_unique<IndirectInputScheme>()); });
+
+}

src/libfetchers/mercurial.cc

@@ -60,6 +60,41 @@ struct MercurialInput : Input
         return attrs;
     }
 
+    std::shared_ptr<const Input> applyOverrides(
+        std::optional<std::string> ref,
+        std::optional<Hash> rev) const override
+    {
+        if (!ref && !rev) return shared_from_this();
+
+        auto res = std::make_shared<MercurialInput>(*this);
+
+        if (ref) res->ref = ref;
+        if (rev) res->rev = rev;
+
+        return res;
+    }
+
+    std::optional<Path> getSourcePath() const
+    {
+        if (url.scheme == "file" && !ref && !rev)
+            return url.path;
+        return {};
+    }
+
+    void markChangedFile(std::string_view file, std::optional<std::string> commitMsg) const override
+    {
+        auto sourcePath = getSourcePath();
+        assert(sourcePath);
+
+        // FIXME: shut up if file is already tracked.
+        runProgram("hg", true,
+            { "add", *sourcePath + "/" + std::string(file) });
+
+        if (commitMsg)
+            runProgram("hg", true,
+                { "commit", *sourcePath + "/" + std::string(file), "-m", *commitMsg });
+    }
+
     std::pair<bool, std::string> getActualUrl() const
     {
         bool isLocal = url.scheme == "file";

src/libfetchers/path.cc

@@ -32,7 +32,7 @@ struct PathInput : Input
 
     bool isImmutable() const override
     {
-        return (bool) narHash;
+        return narHash || rev;
     }
 
     ParsedURL toURL() const override
@@ -56,9 +56,20 @@ struct PathInput : Input
             attrs.emplace("revCount", *revCount);
         if (lastModified)
             attrs.emplace("lastModified", *lastModified);
+        if (!rev && narHash)
+            attrs.emplace("narHash", narHash->to_string(SRI));
         return attrs;
     }
 
+    std::optional<Path> getSourcePath() const override
+    {
+        return path;
+    }
+
+    void markChangedFile(std::string_view file, std::optional<std::string> commitMsg) const override
+    {
+    }
+
     std::pair<Tree, std::shared_ptr<const Input>> fetchTreeInternal(nix::ref<Store> store) const override
     {
         auto input = std::make_shared<PathInput>(*this);
@@ -74,6 +85,8 @@ struct PathInput : Input
             // FIXME: try to substitute storePath.
             storePath = store->addToStore("source", path);
 
+        input->narHash = store->queryPathInfo(*storePath)->narHash;
+
         return
             {
                 Tree {
@@ -99,6 +112,9 @@ struct PathInputScheme : InputScheme
         auto input = std::make_unique<PathInput>();
         input->path = url.path;
 
+        if (url.authority && *url.authority != "")
+            throw Error("path URL '%s' should not have an authority ('%s')", url.url, *url.authority);
+
         for (auto & [name, value] : url.query)
             if (name == "rev")
                 input->rev = Hash(value, htSHA1);
@@ -114,6 +130,9 @@ struct PathInputScheme : InputScheme
                     throw Error("path URL '%s' has invalid parameter '%s'", url.to_string(), name);
                 input->lastModified = lastModified;
             }
+            else if (name == "narHash")
+                // FIXME: require SRI hash.
+                input->narHash = Hash(value);
             else
                 throw Error("path URL '%s' has unsupported parameter '%s'", url.to_string(), name);
 
@@ -134,6 +153,9 @@ struct PathInputScheme : InputScheme
                 input->revCount = getIntAttr(attrs, "revCount");
             else if (name == "lastModified")
                 input->lastModified = getIntAttr(attrs, "lastModified");
+            else if (name == "narHash")
+                // FIXME: require SRI hash.
+                input->narHash = Hash(getStrAttr(attrs, "narHash"));
             else if (name == "type" || name == "path")
                 ;
             else

src/libfetchers/registry.cc

@@ -0,0 +1,222 @@
+#include "registry.hh"
+#include "fetchers.hh"
+#include "util.hh"
+#include "globals.hh"
+#include "store-api.hh"
+
+#include <nlohmann/json.hpp>
+
+namespace nix::fetchers {
+
+std::shared_ptr<Registry> Registry::read(
+    const Path & path, RegistryType type)
+{
+    auto registry = std::make_shared<Registry>(type);
+
+    if (!pathExists(path))
+        return std::make_shared<Registry>(type);
+
+    try {
+
+        auto json = nlohmann::json::parse(readFile(path));
+
+        auto version = json.value("version", 0);
+
+        // FIXME: remove soon
+        if (version == 1) {
+            auto flakes = json["flakes"];
+            for (auto i = flakes.begin(); i != flakes.end(); ++i) {
+                auto url = i->value("url", i->value("uri", ""));
+                if (url.empty())
+                    throw Error("flake registry '%s' lacks a 'url' attribute for entry '%s'",
+                        path, i.key());
+                registry->entries.push_back(
+                    {inputFromURL(i.key()), inputFromURL(url), {}});
+            }
+        }
+
+        else if (version == 2) {
+            for (auto & i : json["flakes"]) {
+                auto toAttrs = jsonToAttrs(i["to"]);
+                Attrs extraAttrs;
+                auto j = toAttrs.find("dir");
+                if (j != toAttrs.end()) {
+                    extraAttrs.insert(*j);
+                    toAttrs.erase(j);
+                }
+                auto exact = i.find("exact");
+                registry->entries.push_back(
+                    Entry {
+                        .from = inputFromAttrs(jsonToAttrs(i["from"])),
+                        .to = inputFromAttrs(toAttrs),
+                        .extraAttrs = extraAttrs,
+                        .exact = exact != i.end() && exact.value()
+                    });
+            }
+        }
+
+        else
+            throw Error("flake registry '%s' has unsupported version %d", path, version);
+
+    } catch (nlohmann::json::exception & e) {
+        warn("cannot parse flake registry '%s': %s", path, e.what());
+    } catch (Error & e) {
+        warn("cannot read flake registry '%s': %s", path, e.what());
+    }
+
+    return registry;
+}
+
+void Registry::write(const Path & path)
+{
+    nlohmann::json arr;
+    for (auto & entry : entries) {
+        nlohmann::json obj;
+        obj["from"] = attrsToJson(entry.from->toAttrs());
+        obj["to"] = attrsToJson(entry.to->toAttrs());
+        if (!entry.extraAttrs.empty())
+            obj["to"].update(attrsToJson(entry.extraAttrs));
+        if (entry.exact)
+            obj["exact"] = true;
+        arr.emplace_back(std::move(obj));
+    }
+
+    nlohmann::json json;
+    json["version"] = 2;
+    json["flakes"] = std::move(arr);
+
+    createDirs(dirOf(path));
+    writeFile(path, json.dump(2));
+}
+
+void Registry::add(
+    const std::shared_ptr<const Input> & from,
+    const std::shared_ptr<const Input> & to,
+    const Attrs & extraAttrs)
+{
+    entries.emplace_back(
+        Entry {
+            .from = from,
+            .to = to,
+            .extraAttrs = extraAttrs
+        });
+}
+
+void Registry::remove(const std::shared_ptr<const Input> & input)
+{
+    // FIXME: use C++20 std::erase.
+    for (auto i = entries.begin(); i != entries.end(); )
+        if (*i->from == *input)
+            i = entries.erase(i);
+        else
+            ++i;
+}
+
+static Path getSystemRegistryPath()
+{
+    return settings.nixConfDir + "/registry.json";
+}
+
+static std::shared_ptr<Registry> getSystemRegistry()
+{
+    static auto systemRegistry =
+        Registry::read(getSystemRegistryPath(), Registry::System);
+    return systemRegistry;
+}
+
+Path getUserRegistryPath()
+{
+    return getHome() + "/.config/nix/registry.json";
+}
+
+std::shared_ptr<Registry> getUserRegistry()
+{
+    static auto userRegistry =
+        Registry::read(getUserRegistryPath(), Registry::User);
+    return userRegistry;
+}
+
+static std::shared_ptr<Registry> flagRegistry =
+    std::make_shared<Registry>(Registry::Flag);
+
+std::shared_ptr<Registry> getFlagRegistry()
+{
+    return flagRegistry;
+}
+
+void overrideRegistry(
+    const std::shared_ptr<const Input> & from,
+    const std::shared_ptr<const Input> & to,
+    const Attrs & extraAttrs)
+{
+    flagRegistry->add(from, to, extraAttrs);
+}
+
+static std::shared_ptr<Registry> getGlobalRegistry(ref<Store> store)
+{
+    static auto reg = [&]() {
+        auto path = settings.flakeRegistry.get();
+
+        if (!hasPrefix(path, "/")) {
+            auto storePath = downloadFile(store, path, "flake-registry.json", false).storePath;
+            if (auto store2 = store.dynamic_pointer_cast<LocalFSStore>())
+                store2->addPermRoot(storePath, getCacheDir() + "/nix/flake-registry.json", true);
+            path = store->toRealPath(storePath);
+        }
+
+        return Registry::read(path, Registry::Global);
+    }();
+
+    return reg;
+}
+
+Registries getRegistries(ref<Store> store)
+{
+    Registries registries;
+    registries.push_back(getFlagRegistry());
+    registries.push_back(getUserRegistry());
+    registries.push_back(getSystemRegistry());
+    registries.push_back(getGlobalRegistry(store));
+    return registries;
+}
+
+std::pair<std::shared_ptr<const Input>, Attrs> lookupInRegistries(
+    ref<Store> store,
+    std::shared_ptr<const Input> input)
+{
+    Attrs extraAttrs;
+    int n = 0;
+
+ restart:
+
+    n++;
+    if (n > 100) throw Error("cycle detected in flake registr for '%s'", input);
+
+    for (auto & registry : getRegistries(store)) {
+        // FIXME: O(n)
+        for (auto & entry : registry->entries) {
+            if (entry.exact) {
+                if (*entry.from == *input) {
+                    input = entry.to;
+                    extraAttrs = entry.extraAttrs;
+                    goto restart;
+                }
+            } else {
+                if (entry.from->contains(*input)) {
+                    input = entry.to->applyOverrides(
+                        !entry.from->getRef() && input->getRef() ? input->getRef() : std::optional<std::string>(),
+                        !entry.from->getRev() && input->getRev() ? input->getRev() : std::optional<Hash>());
+                    extraAttrs = entry.extraAttrs;
+                    goto restart;
+                }
+            }
+        }
+    }
+
+    if (!input->isDirect())
+        throw Error("cannot find flake '%s' in the flake registries", input->to_string());
+
+    return {input, extraAttrs};
+}
+
+}

src/libfetchers/registry.hh

@@ -0,0 +1,65 @@
+#pragma once
+
+#include "types.hh"
+#include "fetchers.hh"
+
+namespace nix { class Store; }
+
+namespace nix::fetchers {
+
+struct Registry
+{
+    enum RegistryType {
+        Flag = 0,
+        User = 1,
+        System = 2,
+        Global = 3,
+    };
+
+    RegistryType type;
+
+    struct Entry
+    {
+        std::shared_ptr<const Input> from;
+        std::shared_ptr<const Input> to;
+        Attrs extraAttrs;
+        bool exact = false;
+    };
+
+    std::vector<Entry> entries;
+
+    Registry(RegistryType type)
+        : type(type)
+    { }
+
+    static std::shared_ptr<Registry> read(
+        const Path & path, RegistryType type);
+
+    void write(const Path & path);
+
+    void add(
+        const std::shared_ptr<const Input> & from,
+        const std::shared_ptr<const Input> & to,
+        const Attrs & extraAttrs);
+
+    void remove(const std::shared_ptr<const Input> & input);
+};
+
+typedef std::vector<std::shared_ptr<Registry>> Registries;
+
+std::shared_ptr<Registry> getUserRegistry();
+
+Path getUserRegistryPath();
+
+Registries getRegistries(ref<Store> store);
+
+void overrideRegistry(
+    const std::shared_ptr<const Input> & from,
+    const std::shared_ptr<const Input> & to,
+    const Attrs & extraAttrs);
+
+std::pair<std::shared_ptr<const Input>, Attrs> lookupInRegistries(
+    ref<Store> store,
+    std::shared_ptr<const Input> input);
+
+}

src/libfetchers/tree-info.cc

@@ -11,4 +11,50 @@ StorePath TreeInfo::computeStorePath(Store & store) const
     return store.makeFixedOutputPath(true, narHash, "source");
 }
 
+TreeInfo TreeInfo::fromJson(const nlohmann::json & json)
+{
+    TreeInfo info;
+
+    auto i = json.find("info");
+    if (i != json.end()) {
+        const nlohmann::json & i2(*i);
+
+        auto j = i2.find("narHash");
+        if (j != i2.end())
+            info.narHash = Hash((std::string) *j);
+        else
+            throw Error("attribute 'narHash' missing in lock file");
+
+        j = i2.find("revCount");
+        if (j != i2.end())
+            info.revCount = *j;
+
+        j = i2.find("lastModified");
+        if (j != i2.end())
+            info.lastModified = *j;
+
+        return info;
+    }
+
+    i = json.find("narHash");
+    if (i != json.end()) {
+        info.narHash = Hash((std::string) *i);
+        return info;
+    }
+
+    throw Error("attribute 'info' missing in lock file");
+}
+
+nlohmann::json TreeInfo::toJson() const
+{
+    nlohmann::json json;
+    assert(narHash);
+    json["narHash"] = narHash.to_string(SRI);
+    if (revCount)
+        json["revCount"] = *revCount;
+    if (lastModified)
+        json["lastModified"] = *lastModified;
+    return json;
+}
+
 }

src/libfetchers/tree-info.hh

@@ -24,6 +24,10 @@ struct TreeInfo
     }
 
     StorePath computeStorePath(Store & store) const;
+
+    static TreeInfo fromJson(const nlohmann::json & json);
+
+    nlohmann::json toJson() const;
 };
 
 }

src/libmain/common-args.cc

@@ -33,9 +33,19 @@ MixCommonArgs::MixCommonArgs(const string & programName)
             try {
                 globalConfig.set(name, value);
             } catch (UsageError & e) {
-                warn(e.what());
+                if (!completions)
+                    warn(e.what());
             }
         }},
+        .completer = [](size_t index, std::string_view prefix) {
+            if (index == 0) {
+                std::map<std::string, Config::SettingInfo> settings;
+                globalConfig.getSettings(settings);
+                for (auto & s : settings)
+                    if (hasPrefix(s.first, prefix))
+                        completions->insert(s.first);
+            }
+        }
     });
 
     addFlag({

src/libstore/builtins/buildenv.hh

@@ -9,7 +9,7 @@ struct Package {
     Path path;
     bool active;
     int priority;
-    Package(Path path, bool active, int priority) : path{path}, active{active}, priority{priority} {}
+    Package(const Path & path, bool active, int priority) : path{path}, active{active}, priority{priority} {}
 };
 
 typedef std::vector<Package> Packages;

src/libstore/globals.hh

@@ -369,6 +369,9 @@ public:
 
     Setting<bool> warnDirty{this, true, "warn-dirty",
         "Whether to warn about dirty Git/Mercurial trees."};
+
+    Setting<std::string> flakeRegistry{this, "https://github.com/NixOS/flake-registry/raw/master/flake-registry.json", "flake-registry",
+        "Path or URI of the global flake registry."};
 };
 
 

src/libstore/local-store.cc

@@ -588,7 +588,7 @@ uint64_t LocalStore::addValidPath(State & state,
         (concatStringsSep(" ", info.sigs), !info.sigs.empty())
         (info.ca, !info.ca.empty())
         .exec();
-    uint64_t id = sqlite3_last_insert_rowid(state.db);
+    uint64_t id = state.db.getLastInsertedRowId();
 
     /* If this is a derivation, then store the derivation outputs in
        the database.  This is useful for the garbage collector: it can

src/libstore/local.mk

@@ -61,3 +61,6 @@ $(d)/build.cc:
 clean-files += $(d)/schema.sql.gen.hh
 
 $(eval $(call install-file-in, $(d)/nix-store.pc, $(prefix)/lib/pkgconfig, 0644))
+
+$(foreach i, $(wildcard src/libstore/builtins/*.hh), \
+  $(eval $(call install-file-in, $(i), $(includedir)/nix/builtins, 0644)))

src/libstore/sqlite.cc

@@ -61,6 +61,11 @@ void SQLite::exec(const std::string & stmt)
     });
 }
 
+uint64_t SQLite::getLastInsertedRowId()
+{
+    return sqlite3_last_insert_rowid(db);
+}
+
 void SQLiteStmt::create(sqlite3 * db, const string & sql)
 {
     checkInterrupt();
@@ -95,10 +100,10 @@ SQLiteStmt::Use::~Use()
     sqlite3_reset(stmt);
 }
 
-SQLiteStmt::Use & SQLiteStmt::Use::operator () (const std::string & value, bool notNull)
+SQLiteStmt::Use & SQLiteStmt::Use::operator () (std::string_view value, bool notNull)
 {
     if (notNull) {
-        if (sqlite3_bind_text(stmt, curArg++, value.c_str(), -1, SQLITE_TRANSIENT) != SQLITE_OK)
+        if (sqlite3_bind_text(stmt, curArg++, value.data(), -1, SQLITE_TRANSIENT) != SQLITE_OK)
             throwSQLiteError(stmt.db, "binding argument");
     } else
         bind();

src/libstore/sqlite.hh

@@ -26,6 +26,8 @@ struct SQLite
     void isCache();
 
     void exec(const std::string & stmt);
+
+    uint64_t getLastInsertedRowId();
 };
 
 /* RAII wrapper to create and destroy SQLite prepared statements. */
@@ -54,7 +56,7 @@ struct SQLiteStmt
         ~Use();
 
         /* Bind the next parameter. */
-        Use & operator () (const std::string & value, bool notNull = true);
+        Use & operator () (std::string_view value, bool notNull = true);
         Use & operator () (const unsigned char * data, size_t len, bool notNull = true);
         Use & operator () (int64_t value, bool notNull = true);
         Use & bind(); // null

src/libutil/args.cc

@@ -1,6 +1,8 @@
 #include "args.hh"
 #include "hash.hh"
 
+#include <glob.h>
+
 namespace nix {
 
 void Args::addFlag(Flag && flag_)
@@ -13,6 +15,20 @@ void Args::addFlag(Flag && flag_)
     if (flag->shortName) shortFlags[flag->shortName] = flag;
 }
 
+bool pathCompletions = false;
+std::shared_ptr<std::set<std::string>> completions;
+
+std::string completionMarker = "___COMPLETE___";
+
+std::optional<std::string> needsCompletion(std::string_view s)
+{
+    if (!completions) return {};
+    auto i = s.find(completionMarker);
+    if (i != std::string::npos)
+        return std::string(s.begin(), i);
+    return {};
+}
+
 void Args::parseCmdline(const Strings & _cmdline)
 {
     Strings pendingArgs;
@@ -20,6 +36,14 @@ void Args::parseCmdline(const Strings & _cmdline)
 
     Strings cmdline(_cmdline);
 
+    if (auto s = getEnv("NIX_GET_COMPLETIONS")) {
+        size_t n = std::stoi(*s);
+        assert(n > 0 && n <= cmdline.size());
+        *std::next(cmdline.begin(), n - 1) += completionMarker;
+        completions = std::make_shared<decltype(completions)::element_type>();
+        verbosity = lvlError;
+    }
+
     for (auto pos = cmdline.begin(); pos != cmdline.end(); ) {
 
         auto arg = *pos;
@@ -63,7 +87,7 @@ void Args::printHelp(const string & programName, std::ostream & out)
     for (auto & exp : expectedArgs) {
         std::cout << renderLabels({exp.label});
         // FIXME: handle arity > 1
-        if (exp.arity == 0) std::cout << "...";
+        if (exp.handler.arity == ArityAny) std::cout << "...";
         if (exp.optional) std::cout << "?";
     }
     std::cout << "\n";
@@ -104,6 +128,9 @@ bool Args::processFlag(Strings::iterator & pos, Strings::iterator end)
                 if (flag.handler.arity == ArityAny) break;
                 throw UsageError("flag '%s' requires %d argument(s)", name, flag.handler.arity);
             }
+            if (flag.completer)
+                if (auto prefix = needsCompletion(*pos))
+                    flag.completer(n, *prefix);
             args.push_back(*pos++);
         }
         flag.handler.fun(std::move(args));
@@ -111,6 +138,13 @@ bool Args::processFlag(Strings::iterator & pos, Strings::iterator end)
     };
 
     if (string(*pos, 0, 2) == "--") {
+        if (auto prefix = needsCompletion(*pos)) {
+            for (auto & [name, flag] : longFlags) {
+                if (!hiddenCategories.count(flag->category)
+                    && hasPrefix(name, std::string(*prefix, 2)))
+                    completions->insert("--" + name);
+            }
+        }
         auto i = longFlags.find(string(*pos, 2));
         if (i == longFlags.end()) return false;
         return process("--" + i->first, *i->second);
@@ -123,6 +157,14 @@ bool Args::processFlag(Strings::iterator & pos, Strings::iterator end)
         return process(std::string("-") + c, *i->second);
     }
 
+    if (auto prefix = needsCompletion(*pos)) {
+        if (prefix == "-") {
+            completions->insert("--");
+            for (auto & [flag, _] : shortFlags)
+                completions->insert(std::string("-") + flag);
+        }
+    }
+
     return false;
 }
 
@@ -138,12 +180,17 @@ bool Args::processArgs(const Strings & args, bool finish)
 
     bool res = false;
 
-    if ((exp.arity == 0 && finish) ||
-        (exp.arity > 0 && args.size() == exp.arity))
+    if ((exp.handler.arity == ArityAny && finish) ||
+        (exp.handler.arity != ArityAny && args.size() == exp.handler.arity))
     {
         std::vector<std::string> ss;
-        for (auto & s : args) ss.push_back(s);
-        exp.handler(std::move(ss));
+        for (const auto &[n, s] : enumerate(args)) {
+            ss.push_back(s);
+            if (exp.completer)
+                if (auto prefix = needsCompletion(s))
+                    exp.completer(n, *prefix);
+        }
+        exp.handler.fun(ss);
         expectedArgs.pop_front();
         res = true;
     }
@@ -164,10 +211,46 @@ Args::Flag Args::Flag::mkHashTypeFlag(std::string && longName, HashType * ht)
             *ht = parseHashType(s);
             if (*ht == htUnknown)
                 throw UsageError("unknown hash type '%1%'", s);
-        }}
+        }},
+        .completer = [](size_t index, std::string_view prefix) {
+            for (auto & type : hashTypes)
+                if (hasPrefix(type, prefix))
+                    completions->insert(type);
+        }
     };
 }
 
+static void completePath(std::string_view prefix, bool onlyDirs)
+{
+    pathCompletions = true;
+    glob_t globbuf;
+    int flags = GLOB_NOESCAPE | GLOB_TILDE;
+    #ifdef GLOB_ONLYDIR
+    if (onlyDirs)
+        flags |= GLOB_ONLYDIR;
+    #endif
+    if (glob((std::string(prefix) + "*").c_str(), flags, nullptr, &globbuf) == 0) {
+        for (size_t i = 0; i < globbuf.gl_pathc; ++i) {
+            if (onlyDirs) {
+                auto st = lstat(globbuf.gl_pathv[i]);
+                if (!S_ISDIR(st.st_mode)) continue;
+            }
+            completions->insert(globbuf.gl_pathv[i]);
+        }
+        globfree(&globbuf);
+    }
+}
+
+void completePath(size_t, std::string_view prefix)
+{
+    completePath(prefix, false);
+}
+
+void completeDir(size_t, std::string_view prefix)
+{
+    completePath(prefix, true);
+}
+
 Strings argvToStrings(int argc, char * * argv)
 {
     Strings args;
@@ -215,13 +298,22 @@ void Command::printHelp(const string & programName, std::ostream & out)
 MultiCommand::MultiCommand(const Commands & commands)
     : commands(commands)
 {
-    expectedArgs.push_back(ExpectedArg{"command", 1, true, [=](std::vector<std::string> ss) {
-        assert(!command);
-        auto i = commands.find(ss[0]);
-        if (i == commands.end())
-            throw UsageError("'%s' is not a recognised command", ss[0]);
-        command = {ss[0], i->second()};
-    }});
+    expectArgs({
+        .label = "command",
+        .optional = true,
+        .handler = {[=](std::string s) {
+            assert(!command);
+            if (auto prefix = needsCompletion(s)) {
+                for (auto & [name, command] : commands)
+                    if (hasPrefix(name, *prefix))
+                        completions->insert(name);
+            }
+            auto i = commands.find(s);
+            if (i == commands.end())
+                throw UsageError("'%s' is not a recognised command", s);
+            command = {s, i->second()};
+        }}
+    });
 
     categories[Command::catDefault] = "Available commands";
 }

src/libutil/args.hh

@@ -28,61 +28,67 @@ protected:
 
     static const size_t ArityAny = std::numeric_limits<size_t>::max();
 
+    struct Handler
+    {
+        std::function<void(std::vector<std::string>)> fun;
+        size_t arity;
+
+        Handler() {}
+
+        Handler(std::function<void(std::vector<std::string>)> && fun)
+            : fun(std::move(fun))
+            , arity(ArityAny)
+        { }
+
+        Handler(std::function<void()> && handler)
+            : fun([handler{std::move(handler)}](std::vector<std::string>) { handler(); })
+            , arity(0)
+        { }
+
+        Handler(std::function<void(std::string)> && handler)
+            : fun([handler{std::move(handler)}](std::vector<std::string> ss) {
+                handler(std::move(ss[0]));
+              })
+            , arity(1)
+        { }
+
+        Handler(std::function<void(std::string, std::string)> && handler)
+            : fun([handler{std::move(handler)}](std::vector<std::string> ss) {
+                handler(std::move(ss[0]), std::move(ss[1]));
+              })
+            , arity(2)
+        { }
+
+        Handler(std::vector<std::string> * dest)
+            : fun([=](std::vector<std::string> ss) { *dest = ss; })
+            , arity(ArityAny)
+        { }
+
+        template<class T>
+        Handler(T * dest)
+            : fun([=](std::vector<std::string> ss) { *dest = ss[0]; })
+            , arity(1)
+        { }
+
+        template<class T>
+        Handler(T * dest, const T & val)
+            : fun([=](std::vector<std::string> ss) { *dest = val; })
+            , arity(0)
+        { }
+    };
+
     /* Flags. */
     struct Flag
     {
         typedef std::shared_ptr<Flag> ptr;
 
-        struct Handler
-        {
-            std::function<void(std::vector<std::string>)> fun;
-            size_t arity;
-
-            Handler() {}
-
-            Handler(std::function<void(std::vector<std::string>)> && fun)
-                : fun(std::move(fun))
-                , arity(ArityAny)
-            { }
-
-            Handler(std::function<void()> && handler)
-                : fun([handler{std::move(handler)}](std::vector<std::string>) { handler(); })
-                , arity(0)
-            { }
-
-            Handler(std::function<void(std::string)> && handler)
-                : fun([handler{std::move(handler)}](std::vector<std::string> ss) {
-                    handler(std::move(ss[0]));
-                  })
-                , arity(1)
-            { }
-
-            Handler(std::function<void(std::string, std::string)> && handler)
-                : fun([handler{std::move(handler)}](std::vector<std::string> ss) {
-                    handler(std::move(ss[0]), std::move(ss[1]));
-                  })
-                , arity(2)
-            { }
-
-            template<class T>
-            Handler(T * dest)
-                : fun([=](std::vector<std::string> ss) { *dest = ss[0]; })
-                , arity(1)
-            { }
-
-            template<class T>
-            Handler(T * dest, const T & val)
-                : fun([=](std::vector<std::string> ss) { *dest = val; })
-                , arity(0)
-            { }
-        };
-
         std::string longName;
         char shortName = 0;
         std::string description;
         std::string category;
         Strings labels;
         Handler handler;
+        std::function<void(size_t, std::string_view)> completer;
 
         static Flag mkHashTypeFlag(std::string && longName, HashType * ht);
     };
@@ -98,9 +104,9 @@ protected:
     struct ExpectedArg
     {
         std::string label;
-        size_t arity; // 0 = any
-        bool optional;
-        std::function<void(std::vector<std::string>)> handler;
+        bool optional = false;
+        Handler handler;
+        std::function<void(size_t, std::string_view)> completer;
     };
 
     std::list<ExpectedArg> expectedArgs;
@@ -174,20 +180,28 @@ public:
         });
     }
 
+    void expectArgs(ExpectedArg && arg)
+    {
+        expectedArgs.emplace_back(std::move(arg));
+    }
+
     /* Expect a string argument. */
     void expectArg(const std::string & label, string * dest, bool optional = false)
     {
-        expectedArgs.push_back(ExpectedArg{label, 1, optional, [=](std::vector<std::string> ss) {
-            *dest = ss[0];
-        }});
+        expectArgs({
+            .label = label,
+            .optional = true,
+            .handler = {dest}
+        });
     }
 
     /* Expect 0 or more arguments. */
     void expectArgs(const std::string & label, std::vector<std::string> * dest)
     {
-        expectedArgs.push_back(ExpectedArg{label, 0, false, [=](std::vector<std::string> ss) {
-            *dest = std::move(ss);
-        }});
+        expectArgs({
+            .label = label,
+            .handler = {dest}
+        });
     }
 
     friend class MultiCommand;
@@ -256,4 +270,13 @@ typedef std::vector<std::pair<std::string, std::string>> Table2;
 
 void printTable(std::ostream & out, const Table2 & table);
 
+extern std::shared_ptr<std::set<std::string>> completions;
+extern bool pathCompletions;
+
+std::optional<std::string> needsCompletion(std::string_view s);
+
+void completePath(size_t, std::string_view prefix);
+
+void completeDir(size_t, std::string_view prefix);
+
 }

src/libutil/hash.cc

@@ -16,6 +16,9 @@
 namespace nix {
 
 
+std::set<std::string> hashTypes = { "md5", "sha1", "sha256", "sha512" };
+
+
 void Hash::init()
 {
     if (type == htMD5) hashSize = md5HashSize;

src/libutil/hash.hh

@@ -18,6 +18,8 @@ const int sha1HashSize = 20;
 const int sha256HashSize = 32;
 const int sha512HashSize = 64;
 
+extern std::set<std::string> hashTypes;
+
 extern const string base32Chars;
 
 enum Base : int { Base64, Base32, Base16, SRI };

src/libutil/util.cc

@@ -23,6 +23,7 @@
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <sys/wait.h>
+#include <sys/time.h>
 #include <sys/un.h>
 #include <unistd.h>
 
@@ -97,7 +98,7 @@ void replaceEnv(std::map<std::string, std::string> newEnv)
 }
 
 
-Path absPath(Path path, std::optional<Path> dir)
+Path absPath(Path path, std::optional<Path> dir, bool resolveSymlinks)
 {
     if (path[0] != '/') {
         if (!dir) {
@@ -118,7 +119,7 @@ Path absPath(Path path, std::optional<Path> dir)
         }
         path = *dir + "/" + path;
     }
-    return canonPath(path);
+    return canonPath(path, resolveSymlinks);
 }
 
 
@@ -362,7 +363,6 @@ void writeFile(const Path & path, Source & source, mode_t mode)
     }
 }
 
-
 string readLine(int fd)
 {
     string s;
@@ -598,20 +598,31 @@ Paths createDirs(const Path & path)
 }
 
 
-void createSymlink(const Path & target, const Path & link)
+void createSymlink(const Path & target, const Path & link,
+    std::optional<time_t> mtime)
 {
     if (symlink(target.c_str(), link.c_str()))
         throw SysError(format("creating symlink from '%1%' to '%2%'") % link % target);
+    if (mtime) {
+        struct timeval times[2];
+        times[0].tv_sec = *mtime;
+        times[0].tv_usec = 0;
+        times[1].tv_sec = *mtime;
+        times[1].tv_usec = 0;
+        if (lutimes(link.c_str(), times))
+            throw SysError("setting time of symlink '%s'", link);
+    }
 }
 
 
-void replaceSymlink(const Path & target, const Path & link)
+void replaceSymlink(const Path & target, const Path & link,
+    std::optional<time_t> mtime)
 {
     for (unsigned int n = 0; true; n++) {
         Path tmp = canonPath(fmt("%s/.%d_%s", dirOf(link), n, baseNameOf(link)));
 
         try {
-            createSymlink(target, tmp);
+            createSymlink(target, tmp, mtime);
         } catch (SysError & e) {
             if (e.errNo == EEXIST) continue;
             throw;
@@ -1023,12 +1034,14 @@ std::vector<char *> stringsToCharPtrs(const Strings & ss)
     return res;
 }
 
-
+// Output = "standard out" output stream
 string runProgram(Path program, bool searchPath, const Strings & args,
     const std::optional<std::string> & input)
 {
     RunOptions opts(program, args);
     opts.searchPath = searchPath;
+    // This allows you to refer to a program with a pathname relative to the
+    // PATH variable.
     opts.input = input;
 
     auto res = runProgram(opts);
@@ -1039,6 +1052,7 @@ string runProgram(Path program, bool searchPath, const Strings & args,
     return res.second;
 }
 
+// Output = error code + "standard out" output stream
 std::pair<int, std::string> runProgram(const RunOptions & options_)
 {
     RunOptions options(options_);
@@ -1111,6 +1125,8 @@ void runProgram2(const RunOptions & options)
 
         if (options.searchPath)
             execvp(options.program.c_str(), stringsToCharPtrs(args_).data());
+            // This allows you to refer to a program with a pathname relative
+            // to the PATH variable.
         else
             execv(options.program.c_str(), stringsToCharPtrs(args_).data());
 
@@ -1314,7 +1330,7 @@ bool statusOk(int status)
 }
 
 
-bool hasPrefix(const string & s, const string & prefix)
+bool hasPrefix(std::string_view s, std::string_view prefix)
 {
     return s.compare(0, prefix.size(), prefix) == 0;
 }

src/libutil/util.hh

@@ -48,7 +48,9 @@ void clearEnv();
 /* Return an absolutized path, resolving paths relative to the
    specified directory, or the current directory otherwise.  The path
    is also canonicalised. */
-Path absPath(Path path, std::optional<Path> dir = {});
+Path absPath(Path path,
+    std::optional<Path> dir = {},
+    bool resolveSymlinks = false);
 
 /* Canonicalise a path by removing all `.' or `..' components and
    double or trailing slashes.  Optionally resolves all symlink
@@ -146,10 +148,12 @@ Path getDataDir();
 Paths createDirs(const Path & path);
 
 /* Create a symlink. */
-void createSymlink(const Path & target, const Path & link);
+void createSymlink(const Path & target, const Path & link,
+    std::optional<time_t> mtime = {});
 
 /* Atomically create or replace a symlink. */
-void replaceSymlink(const Path & target, const Path & link);
+void replaceSymlink(const Path & target, const Path & link,
+    std::optional<time_t> mtime = {});
 
 
 /* Wrappers arount read()/write() that read/write exactly the
@@ -427,7 +431,7 @@ template<class N> bool string2Float(const string & s, N & n)
 
 
 /* Return true iff `s' starts with `prefix'. */
-bool hasPrefix(const string & s, const string & prefix);
+bool hasPrefix(std::string_view s, std::string_view prefix);
 
 
 /* Return true iff `s' ends in `suffix'. */

src/nix/build.cc

@@ -1,3 +1,4 @@
+#include "eval.hh"
 #include "command.hh"
 #include "common-args.hh"
 #include "shared.hh"
@@ -17,6 +18,7 @@ struct CmdBuild : InstallablesCommand, MixDryRun, MixProfile
             .description = "path of the symlink to the build result",
             .labels = {"path"},
             .handler = {&outLink},
+            .completer = completePath
         });
 
         addFlag({
@@ -44,7 +46,7 @@ struct CmdBuild : InstallablesCommand, MixDryRun, MixProfile
             },
             Example{
                 "To make a profile point at GNU Hello:",
-                "nix build --profile /tmp/profile nixpkgs.hello"
+                "nix build --profile /tmp/profile nixpkgs#hello"
             },
         };
     }

src/nix/cat.cc

@@ -25,7 +25,11 @@ struct CmdCatStore : StoreCommand, MixCat
 {
     CmdCatStore()
     {
-        expectArg("path", &path);
+        expectArgs({
+            .label = "path",
+            .handler = {&path},
+            .completer = completePath
+        });
     }
 
     std::string description() override
@@ -47,7 +51,11 @@ struct CmdCatNar : StoreCommand, MixCat
 
     CmdCatNar()
     {
-        expectArg("nar", &narPath);
+        expectArgs({
+            .label = "nar",
+            .handler = {&narPath},
+            .completer = completePath
+        });
         expectArg("path", &path);
     }
 

src/nix/command.cc

@@ -108,6 +108,7 @@ MixProfile::MixProfile()
         .description = "profile to update",
         .labels = {"path"},
         .handler = {&profile},
+        .completer = completePath
     });
 }
 

src/nix/command.hh

@@ -4,12 +4,18 @@
 #include "args.hh"
 #include "common-eval-args.hh"
 #include "path.hh"
-#include "eval.hh"
+#include "flake/lockfile.hh"
+
+#include <optional>
 
 namespace nix {
 
 extern std::string programPath;
 
+class EvalState;
+struct Pos;
+class Store;
+
 static constexpr Command::Category catSecondary = 100;
 static constexpr Command::Category catUtility = 101;
 static constexpr Command::Category catNixInstallation = 102;
@@ -27,25 +33,40 @@ private:
     std::shared_ptr<Store> _store;
 };
 
-struct SourceExprCommand : virtual StoreCommand, MixEvalArgs
+struct EvalCommand : virtual StoreCommand, MixEvalArgs
 {
-    Path file;
-
-    SourceExprCommand();
-
-    /* Return a value representing the Nix expression from which we
-       are installing. This is either the file specified by ‘--file’,
-       or an attribute set constructed from $NIX_PATH, e.g. ‘{ nixpkgs
-       = import ...; bla = import ...; }’. */
-    Value * getSourceExpr(EvalState & state);
-
     ref<EvalState> getEvalState();
 
-private:
-
     std::shared_ptr<EvalState> evalState;
 
-    RootValue vSourceExpr;
+    void completeFlakeRef(std::string_view prefix);
+};
+
+struct MixFlakeOptions : virtual Args
+{
+    flake::LockFlags lockFlags;
+
+    MixFlakeOptions();
+};
+
+struct SourceExprCommand : virtual Args, EvalCommand, MixFlakeOptions
+{
+    std::optional<Path> file;
+    std::optional<std::string> expr;
+
+    SourceExprCommand();
+
+    std::vector<std::shared_ptr<Installable>> parseInstallables(
+        ref<Store> store, std::vector<std::string> ss);
+
+    std::shared_ptr<Installable> parseInstallable(
+        ref<Store> store, const std::string & installable);
+
+    virtual Strings getDefaultFlakeAttrPaths();
+
+    virtual Strings getDefaultFlakeAttrPathPrefixes();
+
+    void completeInstallable(std::string_view prefix);
 };
 
 enum RealiseMode { Build, NoBuild, DryRun };
@@ -56,10 +77,7 @@ struct InstallablesCommand : virtual Args, SourceExprCommand
 {
     std::vector<std::shared_ptr<Installable>> installables;
 
-    InstallablesCommand()
-    {
-        expectArgs("installables", &_installables);
-    }
+    InstallablesCommand();
 
     void prepare() override;
 
@@ -75,16 +93,13 @@ struct InstallableCommand : virtual Args, SourceExprCommand
 {
     std::shared_ptr<Installable> installable;
 
-    InstallableCommand()
-    {
-        expectArg("installable", &_installable);
-    }
+    InstallableCommand();
 
     void prepare() override;
 
 private:
 
-    std::string _installable;
+    std::string _installable{"."};
 };
 
 /* A command that operates on zero or more store paths. */
@@ -141,10 +156,6 @@ static RegisterCommand registerCommand(const std::string & name)
     return RegisterCommand(name, [](){ return make_ref<T>(); });
 }
 
-std::shared_ptr<Installable> parseInstallable(
-    SourceExprCommand & cmd, ref<Store> store, const std::string & installable,
-    bool useDefaultInstallables);
-
 Buildables build(ref<Store> store, RealiseMode mode,
     std::vector<std::shared_ptr<Installable>> installables);
 

src/nix/copy.cc

@@ -45,6 +45,8 @@ struct CmdCopy : StorePathsCommand
             .description = "whether to try substitutes on the destination store (only supported by SSH)",
             .handler = {&substitute, Substitute},
         });
+
+        realiseMode = Build;
     }
 
     std::string description() override
@@ -87,11 +89,16 @@ struct CmdCopy : StorePathsCommand
         return srcUri.empty() ? StoreCommand::createStore() : openStore(srcUri);
     }
 
-    void run(ref<Store> srcStore, StorePaths storePaths) override
+    void run(ref<Store> store) override
     {
         if (srcUri.empty() && dstUri.empty())
             throw UsageError("you must pass '--from' and/or '--to'");
 
+        StorePathsCommand::run(store);
+    }
+
+    void run(ref<Store> srcStore, StorePaths storePaths) override
+    {
         ref<Store> dstStore = dstUri.empty() ? openStore() : openStore(dstUri);
 
         copyPaths(srcStore, dstStore, storePathsToSet(storePaths),

src/nix/dev-shell.cc

@@ -201,6 +201,11 @@ struct Common : InstallableCommand, MixProfile
         out << "eval \"$shellHook\"\n";
     }
 
+    Strings getDefaultFlakeAttrPaths() override
+    {
+        return {"devShell." + settings.thisSystem.get(), "defaultPackage." + settings.thisSystem.get()};
+    }
+
     StorePath getShellOutPath(ref<Store> store)
     {
         auto path = installable->getStorePath();
@@ -259,11 +264,15 @@ struct CmdDevShell : Common, MixEnvironment
         return {
             Example{
                 "To get the build environment of GNU hello:",
-                "nix dev-shell nixpkgs.hello"
+                "nix dev-shell nixpkgs#hello"
+            },
+            Example{
+                "To get the build environment of the default package of flake in the current directory:",
+                "nix dev-shell"
             },
             Example{
                 "To store the build environment in a profile:",
-                "nix dev-shell --profile /tmp/my-shell nixpkgs.hello"
+                "nix dev-shell --profile /tmp/my-shell nixpkgs#hello"
             },
             Example{
                 "To use a build environment previously recorded in a profile:",
@@ -323,7 +332,7 @@ struct CmdPrintDevEnv : Common
         return {
             Example{
                 "To apply the build environment of GNU hello to the current shell:",
-                ". <(nix print-dev-env nixpkgs.hello)"
+                ". <(nix print-dev-env nixpkgs#hello)"
             },
         };
     }

src/nix/eval.cc

@@ -28,7 +28,7 @@ struct CmdEval : MixJSON, InstallableCommand
         return {
             Example{
                 "To evaluate a Nix expression given on the command line:",
-                "nix eval '(1 + 2)'"
+                "nix eval --expr '1 + 2'"
             },
             Example{
                 "To evaluate a Nix expression from a file or URI:",

src/nix/flake-template.nix

@@ -0,0 +1,11 @@
+{
+  description = "A flake for building Hello World";
+
+  outputs = { self, nixpkgs }: {
+
+    packages.x86_64-linux.hello = nixpkgs.legacyPackages.x86_64-linux.hello;
+
+    defaultPackage.x86_64-linux = self.packages.x86_64-linux.hello;
+
+  };
+}

src/nix/flake.cc

@@ -0,0 +1,874 @@
+#include "command.hh"
+#include "common-args.hh"
+#include "shared.hh"
+#include "eval.hh"
+#include "eval-inline.hh"
+#include "flake/flake.hh"
+#include "get-drvs.hh"
+#include "store-api.hh"
+#include "derivations.hh"
+#include "attr-path.hh"
+#include "fetchers.hh"
+#include "registry.hh"
+#include "json.hh"
+#include "eval-cache.hh"
+
+#include <nlohmann/json.hpp>
+#include <queue>
+#include <iomanip>
+
+using namespace nix;
+using namespace nix::flake;
+
+class FlakeCommand : virtual Args, public EvalCommand, public MixFlakeOptions
+{
+    std::string flakeUrl = ".";
+
+public:
+
+    FlakeCommand()
+    {
+        expectArgs({
+            .label = "flake-url",
+            .optional = true,
+            .handler = {&flakeUrl},
+            .completer = {[&](size_t, std::string_view prefix) {
+                completeFlakeRef(prefix);
+            }}
+        });
+    }
+
+    FlakeRef getFlakeRef()
+    {
+        return parseFlakeRef(flakeUrl, absPath(".")); //FIXME
+    }
+
+    Flake getFlake()
+    {
+        auto evalState = getEvalState();
+        return flake::getFlake(*evalState, getFlakeRef(), lockFlags.useRegistries);
+    }
+
+    LockedFlake lockFlake()
+    {
+        return flake::lockFlake(*getEvalState(), getFlakeRef(), lockFlags);
+    }
+};
+
+struct CmdFlakeList : EvalCommand
+{
+    std::string description() override
+    {
+        return "list available Nix flakes";
+    }
+
+    void run(nix::ref<nix::Store> store) override
+    {
+        using namespace fetchers;
+
+        auto registries = getRegistries(store);
+
+        for (auto & registry : registries) {
+            for (auto & entry : registry->entries) {
+                // FIXME: format nicely
+                logger->stdout("%s %s %s",
+                    registry->type == Registry::Flag   ? "flags " :
+                    registry->type == Registry::User   ? "user  " :
+                    registry->type == Registry::System ? "system" :
+                    "global",
+                    entry.from->to_string(),
+                    entry.to->to_string());
+            }
+        }
+    }
+};
+
+static void printFlakeInfo(const Store & store, const Flake & flake)
+{
+    logger->stdout("Resolved URL:  %s", flake.resolvedRef.to_string());
+    logger->stdout("Locked URL:    %s", flake.lockedRef.to_string());
+    if (flake.description)
+        logger->stdout("Description:   %s", *flake.description);
+    logger->stdout("Path:          %s", store.printStorePath(flake.sourceInfo->storePath));
+    if (auto rev = flake.lockedRef.input->getRev())
+        logger->stdout("Revision:      %s", rev->to_string(Base16, false));
+    if (flake.sourceInfo->info.revCount)
+        logger->stdout("Revisions:     %s", *flake.sourceInfo->info.revCount);
+    if (flake.sourceInfo->info.lastModified)
+        logger->stdout("Last modified: %s",
+            std::put_time(std::localtime(&*flake.sourceInfo->info.lastModified), "%F %T"));
+}
+
+static nlohmann::json flakeToJson(const Store & store, const Flake & flake)
+{
+    nlohmann::json j;
+    if (flake.description)
+        j["description"] = *flake.description;
+    j["originalUrl"] = flake.originalRef.to_string();
+    j["original"] = attrsToJson(flake.originalRef.toAttrs());
+    j["resolvedUrl"] = flake.resolvedRef.to_string();
+    j["resolved"] = attrsToJson(flake.resolvedRef.toAttrs());
+    j["url"] = flake.lockedRef.to_string(); // FIXME: rename to lockedUrl
+    j["locked"] = attrsToJson(flake.lockedRef.toAttrs());
+    j["info"] = flake.sourceInfo->info.toJson();
+    if (auto rev = flake.lockedRef.input->getRev())
+        j["revision"] = rev->to_string(Base16, false);
+    if (flake.sourceInfo->info.revCount)
+        j["revCount"] = *flake.sourceInfo->info.revCount;
+    if (flake.sourceInfo->info.lastModified)
+        j["lastModified"] = *flake.sourceInfo->info.lastModified;
+    j["path"] = store.printStorePath(flake.sourceInfo->storePath);
+    return j;
+}
+
+struct CmdFlakeUpdate : FlakeCommand
+{
+    std::string description() override
+    {
+        return "update flake lock file";
+    }
+
+    void run(nix::ref<nix::Store> store) override
+    {
+        /* Use --refresh by default for 'nix flake update'. */
+        settings.tarballTtl = 0;
+
+        lockFlake();
+    }
+};
+
+static void enumerateOutputs(EvalState & state, Value & vFlake,
+    std::function<void(const std::string & name, Value & vProvide, const Pos & pos)> callback)
+{
+    state.forceAttrs(vFlake);
+
+    auto aOutputs = vFlake.attrs->get(state.symbols.create("outputs"));
+    assert(aOutputs);
+
+    state.forceAttrs(*aOutputs->value);
+
+    for (auto & attr : *aOutputs->value->attrs)
+        callback(attr.name, *attr.value, *attr.pos);
+}
+
+struct CmdFlakeInfo : FlakeCommand, MixJSON
+{
+    std::string description() override
+    {
+        return "list info about a given flake";
+    }
+
+    void run(nix::ref<nix::Store> store) override
+    {
+        auto flake = getFlake();
+
+        if (json) {
+            auto json = flakeToJson(*store, flake);
+            logger->stdout("%s", json.dump());
+        } else
+            printFlakeInfo(*store, flake);
+    }
+};
+
+struct CmdFlakeListInputs : FlakeCommand, MixJSON
+{
+    std::string description() override
+    {
+        return "list flake inputs";
+    }
+
+    void run(nix::ref<nix::Store> store) override
+    {
+        auto flake = lockFlake();
+
+        if (json)
+            logger->stdout("%s", flake.lockFile.toJson());
+        else {
+            logger->stdout("%s", flake.flake.lockedRef);
+
+            std::function<void(const Node & node, const std::string & prefix)> recurse;
+
+            recurse = [&](const Node & node, const std::string & prefix)
+            {
+                for (const auto & [i, input] : enumerate(node.inputs)) {
+                    //auto tree2 = tree.child(i + 1 == inputs.inputs.size());
+                    bool last = i + 1 == node.inputs.size();
+                    logger->stdout("%s" ANSI_BOLD "%s" ANSI_NORMAL ": %s",
+                        prefix + (last ? treeLast : treeConn), input.first,
+                        std::dynamic_pointer_cast<const LockedNode>(input.second)->lockedRef);
+                    recurse(*input.second, prefix + (last ? treeNull : treeLine));
+                }
+            };
+
+            recurse(*flake.lockFile.root, "");
+        }
+    }
+};
+
+struct CmdFlakeCheck : FlakeCommand
+{
+    bool build = true;
+
+    CmdFlakeCheck()
+    {
+        addFlag({
+            .longName = "no-build",
+            .description = "do not build checks",
+            .handler = {&build, false}
+        });
+    }
+
+    std::string description() override
+    {
+        return "check whether the flake evaluates and run its tests";
+    }
+
+    void run(nix::ref<nix::Store> store) override
+    {
+        settings.readOnlyMode = !build;
+
+        auto state = getEvalState();
+        auto flake = lockFlake();
+
+        auto checkSystemName = [&](const std::string & system, const Pos & pos) {
+            // FIXME: what's the format of "system"?
+            if (system.find('-') == std::string::npos)
+                throw Error("'%s' is not a valid system type, at %s", system, pos);
+        };
+
+        auto checkDerivation = [&](const std::string & attrPath, Value & v, const Pos & pos) {
+            try {
+                auto drvInfo = getDerivation(*state, v, false);
+                if (!drvInfo)
+                    throw Error("flake attribute '%s' is not a derivation", attrPath);
+                // FIXME: check meta attributes
+                return store->parseStorePath(drvInfo->queryDrvPath());
+            } catch (Error & e) {
+                e.addPrefix(fmt("while checking the derivation '" ANSI_BOLD "%s" ANSI_NORMAL "' at %s:\n", attrPath, pos));
+                throw;
+            }
+        };
+
+        std::vector<StorePathWithOutputs> drvPaths;
+
+        auto checkApp = [&](const std::string & attrPath, Value & v, const Pos & pos) {
+            try {
+                auto app = App(*state, v);
+                for (auto & i : app.context) {
+                    auto [drvPathS, outputName] = decodeContext(i);
+                    auto drvPath = store->parseStorePath(drvPathS);
+                    if (!outputName.empty() && drvPath.isDerivation())
+                        drvPaths.emplace_back(drvPath);
+                }
+            } catch (Error & e) {
+                e.addPrefix(fmt("while checking the app definition '" ANSI_BOLD "%s" ANSI_NORMAL "' at %s:\n", attrPath, pos));
+                throw;
+            }
+        };
+
+        auto checkOverlay = [&](const std::string & attrPath, Value & v, const Pos & pos) {
+            try {
+                state->forceValue(v, pos);
+                if (v.type != tLambda || v.lambda.fun->matchAttrs || std::string(v.lambda.fun->arg) != "final")
+                    throw Error("overlay does not take an argument named 'final'");
+                auto body = dynamic_cast<ExprLambda *>(v.lambda.fun->body);
+                if (!body || body->matchAttrs || std::string(body->arg) != "prev")
+                    throw Error("overlay does not take an argument named 'prev'");
+                // FIXME: if we have a 'nixpkgs' input, use it to
+                // evaluate the overlay.
+            } catch (Error & e) {
+                e.addPrefix(fmt("while checking the overlay '" ANSI_BOLD "%s" ANSI_NORMAL "' at %s:\n", attrPath, pos));
+                throw;
+            }
+        };
+
+        auto checkModule = [&](const std::string & attrPath, Value & v, const Pos & pos) {
+            try {
+                state->forceValue(v, pos);
+                if (v.type == tLambda) {
+                    if (!v.lambda.fun->matchAttrs || !v.lambda.fun->formals->ellipsis)
+                        throw Error("module must match an open attribute set ('{ config, ... }')");
+                } else if (v.type == tAttrs) {
+                    for (auto & attr : *v.attrs)
+                        try {
+                            state->forceValue(*attr.value, *attr.pos);
+                        } catch (Error & e) {
+                            e.addPrefix(fmt("while evaluating the option '" ANSI_BOLD "%s" ANSI_NORMAL "' at %s:\n", attr.name, *attr.pos));
+                            throw;
+                        }
+                } else
+                    throw Error("module must be a function or an attribute set");
+                // FIXME: if we have a 'nixpkgs' input, use it to
+                // check the module.
+            } catch (Error & e) {
+                e.addPrefix(fmt("while checking the NixOS module '" ANSI_BOLD "%s" ANSI_NORMAL "' at %s:\n", attrPath, pos));
+                throw;
+            }
+        };
+
+        std::function<void(const std::string & attrPath, Value & v, const Pos & pos)> checkHydraJobs;
+
+        checkHydraJobs = [&](const std::string & attrPath, Value & v, const Pos & pos) {
+            try {
+                state->forceAttrs(v, pos);
+
+                if (state->isDerivation(v))
+                    throw Error("jobset should not be a derivation at top-level");
+
+                for (auto & attr : *v.attrs) {
+                    state->forceAttrs(*attr.value, *attr.pos);
+                    if (!state->isDerivation(*attr.value))
+                        checkHydraJobs(attrPath + "." + (std::string) attr.name,
+                            *attr.value, *attr.pos);
+                }
+
+            } catch (Error & e) {
+                e.addPrefix(fmt("while checking the Hydra jobset '" ANSI_BOLD "%s" ANSI_NORMAL "' at %s:\n", attrPath, pos));
+                throw;
+            }
+        };
+
+        auto checkNixOSConfiguration = [&](const std::string & attrPath, Value & v, const Pos & pos) {
+            try {
+                Activity act(*logger, lvlChatty, actUnknown,
+                    fmt("checking NixOS configuration '%s'", attrPath));
+                Bindings & bindings(*state->allocBindings(0));
+                auto vToplevel = findAlongAttrPath(*state, "config.system.build.toplevel", bindings, v).first;
+                state->forceAttrs(*vToplevel, pos);
+                if (!state->isDerivation(*vToplevel))
+                    throw Error("attribute 'config.system.build.toplevel' is not a derivation");
+            } catch (Error & e) {
+                e.addPrefix(fmt("while checking the NixOS configuration '" ANSI_BOLD "%s" ANSI_NORMAL "' at %s:\n", attrPath, pos));
+                throw;
+            }
+        };
+
+        {
+            Activity act(*logger, lvlInfo, actUnknown, "evaluating flake");
+
+            auto vFlake = state->allocValue();
+            flake::callFlake(*state, flake, *vFlake);
+
+            enumerateOutputs(*state,
+                *vFlake,
+                [&](const std::string & name, Value & vOutput, const Pos & pos) {
+                    Activity act(*logger, lvlChatty, actUnknown,
+                        fmt("checking flake output '%s'", name));
+
+                    try {
+                        state->forceValue(vOutput, pos);
+
+                        if (name == "checks") {
+                            state->forceAttrs(vOutput, pos);
+                            for (auto & attr : *vOutput.attrs) {
+                                checkSystemName(attr.name, *attr.pos);
+                                state->forceAttrs(*attr.value, *attr.pos);
+                                for (auto & attr2 : *attr.value->attrs) {
+                                    auto drvPath = checkDerivation(
+                                        fmt("%s.%s.%s", name, attr.name, attr2.name),
+                                        *attr2.value, *attr2.pos);
+                                    if ((std::string) attr.name == settings.thisSystem.get())
+                                        drvPaths.emplace_back(drvPath);
+                                }
+                            }
+                        }
+
+                        else if (name == "packages") {
+                            state->forceAttrs(vOutput, pos);
+                            for (auto & attr : *vOutput.attrs) {
+                                checkSystemName(attr.name, *attr.pos);
+                                state->forceAttrs(*attr.value, *attr.pos);
+                                for (auto & attr2 : *attr.value->attrs)
+                                    checkDerivation(
+                                        fmt("%s.%s.%s", name, attr.name, attr2.name),
+                                        *attr2.value, *attr2.pos);
+                            }
+                        }
+
+                        else if (name == "apps") {
+                            state->forceAttrs(vOutput, pos);
+                            for (auto & attr : *vOutput.attrs) {
+                                checkSystemName(attr.name, *attr.pos);
+                                state->forceAttrs(*attr.value, *attr.pos);
+                                for (auto & attr2 : *attr.value->attrs)
+                                    checkApp(
+                                        fmt("%s.%s.%s", name, attr.name, attr2.name),
+                                        *attr2.value, *attr2.pos);
+                            }
+                        }
+
+                        else if (name == "defaultPackage" || name == "devShell") {
+                            state->forceAttrs(vOutput, pos);
+                            for (auto & attr : *vOutput.attrs) {
+                                checkSystemName(attr.name, *attr.pos);
+                                checkDerivation(
+                                    fmt("%s.%s", name, attr.name),
+                                    *attr.value, *attr.pos);
+                            }
+                        }
+
+                        else if (name == "defaultApp") {
+                            state->forceAttrs(vOutput, pos);
+                            for (auto & attr : *vOutput.attrs) {
+                                checkSystemName(attr.name, *attr.pos);
+                                checkApp(
+                                    fmt("%s.%s", name, attr.name),
+                                    *attr.value, *attr.pos);
+                            }
+                        }
+
+                        else if (name == "legacyPackages") {
+                            state->forceAttrs(vOutput, pos);
+                            for (auto & attr : *vOutput.attrs) {
+                                checkSystemName(attr.name, *attr.pos);
+                                // FIXME: do getDerivations?
+                            }
+                        }
+
+                        else if (name == "overlay")
+                            checkOverlay(name, vOutput, pos);
+
+                        else if (name == "overlays") {
+                            state->forceAttrs(vOutput, pos);
+                            for (auto & attr : *vOutput.attrs)
+                                checkOverlay(fmt("%s.%s", name, attr.name),
+                                    *attr.value, *attr.pos);
+                        }
+
+                        else if (name == "nixosModule")
+                            checkModule(name, vOutput, pos);
+
+                        else if (name == "nixosModules") {
+                            state->forceAttrs(vOutput, pos);
+                            for (auto & attr : *vOutput.attrs)
+                                checkModule(fmt("%s.%s", name, attr.name),
+                                    *attr.value, *attr.pos);
+                        }
+
+                        else if (name == "nixosConfigurations") {
+                            state->forceAttrs(vOutput, pos);
+                            for (auto & attr : *vOutput.attrs)
+                                checkNixOSConfiguration(fmt("%s.%s", name, attr.name),
+                                    *attr.value, *attr.pos);
+                        }
+
+                        else if (name == "hydraJobs")
+                            checkHydraJobs(name, vOutput, pos);
+
+                        else
+                            warn("unknown flake output '%s'", name);
+
+                    } catch (Error & e) {
+                        e.addPrefix(fmt("while checking flake output '" ANSI_BOLD "%s" ANSI_NORMAL "':\n", name));
+                        throw;
+                    }
+                });
+        }
+
+        if (build && !drvPaths.empty()) {
+            Activity act(*logger, lvlInfo, actUnknown, "running flake checks");
+            store->buildPaths(drvPaths);
+        }
+    }
+};
+
+struct CmdFlakeAdd : MixEvalArgs, Command
+{
+    std::string fromUrl, toUrl;
+
+    std::string description() override
+    {
+        return "upsert flake in user flake registry";
+    }
+
+    CmdFlakeAdd()
+    {
+        expectArg("from-url", &fromUrl);
+        expectArg("to-url", &toUrl);
+    }
+
+    void run() override
+    {
+        auto fromRef = parseFlakeRef(fromUrl);
+        auto toRef = parseFlakeRef(toUrl);
+        fetchers::Attrs extraAttrs;
+        if (toRef.subdir != "") extraAttrs["dir"] = toRef.subdir;
+        auto userRegistry = fetchers::getUserRegistry();
+        userRegistry->remove(fromRef.input);
+        userRegistry->add(fromRef.input, toRef.input, extraAttrs);
+        userRegistry->write(fetchers::getUserRegistryPath());
+    }
+};
+
+struct CmdFlakeRemove : virtual Args, MixEvalArgs, Command
+{
+    std::string url;
+
+    std::string description() override
+    {
+        return "remove flake from user flake registry";
+    }
+
+    CmdFlakeRemove()
+    {
+        expectArg("url", &url);
+    }
+
+    void run() override
+    {
+        auto userRegistry = fetchers::getUserRegistry();
+        userRegistry->remove(parseFlakeRef(url).input);
+        userRegistry->write(fetchers::getUserRegistryPath());
+    }
+};
+
+struct CmdFlakePin : virtual Args, EvalCommand
+{
+    std::string url;
+
+    std::string description() override
+    {
+        return "pin a flake to its current version in user flake registry";
+    }
+
+    CmdFlakePin()
+    {
+        expectArg("url", &url);
+    }
+
+    void run(nix::ref<nix::Store> store) override
+    {
+        auto ref = parseFlakeRef(url);
+        auto userRegistry = fetchers::getUserRegistry();
+        userRegistry->remove(ref.input);
+        auto [tree, resolved] = ref.resolve(store).input->fetchTree(store);
+        fetchers::Attrs extraAttrs;
+        if (ref.subdir != "") extraAttrs["dir"] = ref.subdir;
+        userRegistry->add(ref.input, resolved, extraAttrs);
+    }
+};
+
+struct CmdFlakeInit : virtual Args, Command
+{
+    std::string description() override
+    {
+        return "create a skeleton 'flake.nix' file in the current directory";
+    }
+
+    void run() override
+    {
+        Path flakeDir = absPath(".");
+
+        Path flakePath = flakeDir + "/flake.nix";
+
+        if (pathExists(flakePath))
+            throw Error("file '%s' already exists", flakePath);
+
+        writeFile(flakePath,
+          #include "flake-template.nix.gen.hh"
+        );
+
+        if (pathExists(flakeDir + "/.git"))
+            runProgram("git", true,
+                { "-C", flakeDir, "add", "--intent-to-add", "flake.nix" });
+    }
+};
+
+struct CmdFlakeClone : FlakeCommand
+{
+    Path destDir;
+
+    std::string description() override
+    {
+        return "clone flake repository";
+    }
+
+    CmdFlakeClone()
+    {
+        addFlag({
+            .longName = "dest",
+            .shortName = 'f',
+            .description = "destination path",
+            .labels = {"path"},
+            .handler = {&destDir}
+        });
+    }
+
+    void run(nix::ref<nix::Store> store) override
+    {
+        if (destDir.empty())
+            throw Error("missing flag '--dest'");
+
+        getFlakeRef().resolve(store).input->clone(destDir);
+    }
+};
+
+struct CmdFlakeArchive : FlakeCommand, MixJSON, MixDryRun
+{
+    std::string dstUri;
+
+    CmdFlakeArchive()
+    {
+        addFlag({
+            .longName = "to",
+            .description = "URI of the destination Nix store",
+            .labels = {"store-uri"},
+            .handler = {&dstUri}
+        });
+    }
+
+    std::string description() override
+    {
+        return "copy a flake and all its inputs to a store";
+    }
+
+    Examples examples() override
+    {
+        return {
+            Example{
+                "To copy the dwarffs flake and its dependencies to a binary cache:",
+                "nix flake archive --to file:///tmp/my-cache dwarffs"
+            },
+            Example{
+                "To fetch the dwarffs flake and its dependencies to the local Nix store:",
+                "nix flake archive dwarffs"
+            },
+            Example{
+                "To print the store paths of the flake sources of NixOps without fetching them:",
+                "nix flake archive --json --dry-run nixops"
+            },
+        };
+    }
+
+    void run(nix::ref<nix::Store> store) override
+    {
+        auto flake = lockFlake();
+
+        auto jsonRoot = json ? std::optional<JSONObject>(std::cout) : std::nullopt;
+
+        StorePathSet sources;
+
+        sources.insert(flake.flake.sourceInfo->storePath.clone());
+        if (jsonRoot)
+            jsonRoot->attr("path", store->printStorePath(flake.flake.sourceInfo->storePath));
+
+        // FIXME: use graph output, handle cycles.
+        std::function<void(const Node & node, std::optional<JSONObject> & jsonObj)> traverse;
+        traverse = [&](const Node & node, std::optional<JSONObject> & jsonObj)
+        {
+            auto jsonObj2 = jsonObj ? jsonObj->object("inputs") : std::optional<JSONObject>();
+            for (auto & input : node.inputs) {
+                auto lockedInput = std::dynamic_pointer_cast<const LockedNode>(input.second);
+                assert(lockedInput);
+                auto jsonObj3 = jsonObj2 ? jsonObj2->object(input.first) : std::optional<JSONObject>();
+                if (!dryRun)
+                    lockedInput->lockedRef.input->fetchTree(store);
+                auto storePath = lockedInput->computeStorePath(*store);
+                if (jsonObj3)
+                    jsonObj3->attr("path", store->printStorePath(storePath));
+                sources.insert(std::move(storePath));
+                traverse(*lockedInput, jsonObj3);
+            }
+        };
+
+        traverse(*flake.lockFile.root, jsonRoot);
+
+        if (!dryRun && !dstUri.empty()) {
+            ref<Store> dstStore = dstUri.empty() ? openStore() : openStore(dstUri);
+            copyPaths(store, dstStore, sources);
+        }
+    }
+};
+
+struct CmdFlakeShow : FlakeCommand
+{
+    bool showLegacy = false;
+    bool useEvalCache = true;
+
+    CmdFlakeShow()
+    {
+        addFlag({
+            .longName = "legacy",
+            .description = "show the contents of the 'legacyPackages' output",
+            .handler = {&showLegacy, true}
+        });
+
+        addFlag({
+            .longName = "no-eval-cache",
+            .description = "do not use the flake evaluation cache",
+            .handler = {[&]() { useEvalCache = false; }}
+        });
+    }
+
+    std::string description() override
+    {
+        return "show the outputs provided by a flake";
+    }
+
+    void run(nix::ref<nix::Store> store) override
+    {
+        auto state = getEvalState();
+        auto flake = std::make_shared<LockedFlake>(lockFlake());
+
+        std::function<void(eval_cache::AttrCursor & visitor, const std::vector<Symbol> & attrPath, const std::string & headerPrefix, const std::string & nextPrefix)> visit;
+
+        visit = [&](eval_cache::AttrCursor & visitor, const std::vector<Symbol> & attrPath, const std::string & headerPrefix, const std::string & nextPrefix)
+        {
+            Activity act(*logger, lvlInfo, actUnknown,
+                fmt("evaluating '%s'", concatStringsSep(".", attrPath)));
+            try {
+                auto recurse = [&]()
+                {
+                    logger->stdout("%s", headerPrefix);
+                    auto attrs = visitor.getAttrs();
+                    for (const auto & [i, attr] : enumerate(attrs)) {
+                        bool last = i + 1 == attrs.size();
+                        auto visitor2 = visitor.getAttr(attr);
+                        auto attrPath2(attrPath);
+                        attrPath2.push_back(attr);
+                        visit(*visitor2, attrPath2,
+                            fmt(ANSI_GREEN "%s%s" ANSI_NORMAL ANSI_BOLD "%s" ANSI_NORMAL, nextPrefix, last ? treeLast : treeConn, attr),
+                            nextPrefix + (last ? treeNull : treeLine));
+                    }
+                };
+
+                auto showDerivation = [&]()
+                {
+                    auto name = visitor.getAttr(state->sName)->getString();
+
+                    /*
+                    std::string description;
+
+                    if (auto aMeta = visitor.maybeGetAttr("meta")) {
+                        if (auto aDescription = aMeta->maybeGetAttr("description"))
+                            description = aDescription->getString();
+                    }
+                    */
+
+                    logger->stdout("%s: %s '%s'",
+                        headerPrefix,
+                        attrPath.size() == 2 && attrPath[0] == "devShell" ? "development environment" :
+                        attrPath.size() == 3 && attrPath[0] == "checks" ? "derivation" :
+                        attrPath.size() >= 1 && attrPath[0] == "hydraJobs" ? "derivation" :
+                        "package",
+                        name);
+                };
+
+                if (attrPath.size() == 0
+                    || (attrPath.size() == 1 && (
+                            attrPath[0] == "defaultPackage"
+                            || attrPath[0] == "devShell"
+                            || attrPath[0] == "nixosConfigurations"
+                            || attrPath[0] == "nixosModules"
+                            || attrPath[0] == "defaultApp"))
+                    || ((attrPath.size() == 1 || attrPath.size() == 2)
+                        && (attrPath[0] == "checks"
+                            || attrPath[0] == "packages"
+                            || attrPath[0] == "apps"))
+                    )
+                {
+                    recurse();
+                }
+
+                else if (
+                    (attrPath.size() == 2 && (attrPath[0] == "defaultPackage" || attrPath[0] == "devShell"))
+                    || (attrPath.size() == 3 && (attrPath[0] == "checks" || attrPath[0] == "packages"))
+                    )
+                {
+                    if (visitor.isDerivation())
+                        showDerivation();
+                    else
+                        throw Error("expected a derivation");
+                }
+
+                else if (attrPath.size() > 0 && attrPath[0] == "hydraJobs") {
+                    if (visitor.isDerivation())
+                        showDerivation();
+                    else
+                        recurse();
+                }
+
+                else if (attrPath.size() > 0 && attrPath[0] == "legacyPackages") {
+                    if (attrPath.size() == 1)
+                        recurse();
+                    else if (!showLegacy)
+                        logger->stdout("%s: " ANSI_YELLOW "omitted" ANSI_NORMAL " (use '--legacy' to show)", headerPrefix);
+                    else {
+                        if (visitor.isDerivation())
+                            showDerivation();
+                        else if (attrPath.size() <= 2)
+                            // FIXME: handle recurseIntoAttrs
+                            recurse();
+                    }
+                }
+
+                else if (
+                    (attrPath.size() == 2 && attrPath[0] == "defaultApp") ||
+                    (attrPath.size() == 3 && attrPath[0] == "apps"))
+                {
+                    auto aType = visitor.maybeGetAttr("type");
+                    if (!aType || aType->getString() != "app")
+                        throw EvalError("not an app definition");
+                    logger->stdout("%s: app", headerPrefix);
+                }
+
+                else {
+                    logger->stdout("%s: %s",
+                        headerPrefix,
+                        attrPath.size() == 1 && attrPath[0] == "overlay" ? "Nixpkgs overlay" :
+                        attrPath.size() == 2 && attrPath[0] == "nixosConfigurations" ? "NixOS configuration" :
+                        attrPath.size() == 2 && attrPath[0] == "nixosModules" ? "NixOS module" :
+                        ANSI_YELLOW "unknown" ANSI_NORMAL);
+                }
+            } catch (EvalError & e) {
+                if (!(attrPath.size() > 0 && attrPath[0] == "legacyPackages"))
+                    throw;
+            }
+        };
+
+        auto cache = openEvalCache(*state, flake, useEvalCache);
+
+        visit(*cache->getRoot(), {}, fmt(ANSI_BOLD "%s" ANSI_NORMAL, flake->flake.lockedRef), "");
+    }
+};
+
+struct CmdFlake : virtual MultiCommand, virtual Command
+{
+    CmdFlake()
+        : MultiCommand({
+                {"list", []() { return make_ref<CmdFlakeList>(); }},
+                {"update", []() { return make_ref<CmdFlakeUpdate>(); }},
+                {"info", []() { return make_ref<CmdFlakeInfo>(); }},
+                {"list-inputs", []() { return make_ref<CmdFlakeListInputs>(); }},
+                {"check", []() { return make_ref<CmdFlakeCheck>(); }},
+                {"add", []() { return make_ref<CmdFlakeAdd>(); }},
+                {"remove", []() { return make_ref<CmdFlakeRemove>(); }},
+                {"pin", []() { return make_ref<CmdFlakePin>(); }},
+                {"init", []() { return make_ref<CmdFlakeInit>(); }},
+                {"clone", []() { return make_ref<CmdFlakeClone>(); }},
+                {"archive", []() { return make_ref<CmdFlakeArchive>(); }},
+                {"show", []() { return make_ref<CmdFlakeShow>(); }},
+            })
+    {
+    }
+
+    std::string description() override
+    {
+        return "manage Nix flakes";
+    }
+
+    void run() override
+    {
+        if (!command)
+            throw UsageError("'nix flake' requires a sub-command.");
+        command->second->prepare();
+        command->second->run();
+    }
+
+    void printHelp(const string & programName, std::ostream & out) override
+    {
+        MultiCommand::printHelp(programName, out);
+    }
+};
+
+static auto r1 = registerCommand<CmdFlake>("flake");

src/nix/hash.cc

@@ -31,7 +31,11 @@ struct CmdHash : Command
             .labels({"modulus"})
             .dest(&modulus);
         #endif
-        expectArgs("paths", &paths);
+        expectArgs({
+            .label = "paths",
+            .handler = {&paths},
+            .completer = completePath
+        });
     }
 
     std::string description() override

src/nix/installables.cc

@@ -1,3 +1,4 @@
+#include "installables.hh"
 #include "command.hh"
 #include "attr-path.hh"
 #include "common-eval-args.hh"
@@ -7,11 +8,68 @@
 #include "get-drvs.hh"
 #include "store-api.hh"
 #include "shared.hh"
+#include "flake/flake.hh"
+#include "eval-cache.hh"
+#include "url.hh"
+#include "registry.hh"
 
 #include <regex>
+#include <queue>
 
 namespace nix {
 
+MixFlakeOptions::MixFlakeOptions()
+{
+    addFlag({
+        .longName = "recreate-lock-file",
+        .description = "recreate lock file from scratch",
+        .handler = {&lockFlags.recreateLockFile, true}
+    });
+
+    addFlag({
+        .longName = "no-update-lock-file",
+        .description = "do not allow any updates to the lock file",
+        .handler = {&lockFlags.updateLockFile, false}
+    });
+
+    addFlag({
+        .longName = "no-write-lock-file",
+        .description = "do not write the newly generated lock file",
+        .handler = {&lockFlags.writeLockFile, false}
+    });
+
+    addFlag({
+        .longName = "no-registries",
+        .description = "don't use flake registries",
+        .handler = {&lockFlags.useRegistries, false}
+    });
+
+    addFlag({
+        .longName = "commit-lock-file",
+        .description = "commit changes to the lock file",
+        .handler = {&lockFlags.commitLockFile, true}
+    });
+
+    addFlag({
+        .longName = "update-input",
+        .description = "update a specific flake input",
+        .labels = {"input-path"},
+        .handler = {[&](std::string s) {
+            lockFlags.inputUpdates.insert(flake::parseInputPath(s));
+        }}
+    });
+
+    addFlag({
+        .longName = "override-input",
+        .description = "override a specific flake input (e.g. 'dwarffs/nixpkgs')",
+        .labels = {"input-path", "flake-url"},
+        .handler = {[&](std::string inputPath, std::string flakeRef) {
+            lockFlags.inputOverrides.insert_or_assign(
+                flake::parseInputPath(inputPath),
+                parseFlakeRef(flakeRef, absPath(".")));
+        }}
+    });
+}
 
 SourceExprCommand::SourceExprCommand()
 {
@@ -20,67 +78,135 @@ SourceExprCommand::SourceExprCommand()
         .shortName = 'f',
         .description = "evaluate FILE rather than the default",
         .labels = {"file"},
-        .handler = {&file}
+        .handler = {&file},
+        .completer = completePath
+    });
+
+    addFlag({
+        .longName ="expr",
+        .description = "evaluate attributes from EXPR",
+        .labels = {"expr"},
+        .handler = {&expr}
     });
 }
 
-Value * SourceExprCommand::getSourceExpr(EvalState & state)
+Strings SourceExprCommand::getDefaultFlakeAttrPaths()
 {
-    if (vSourceExpr) return *vSourceExpr;
-
-    auto sToplevel = state.symbols.create("_toplevel");
-
-    vSourceExpr = allocRootValue(state.allocValue());
-
-    if (file != "")
-        state.evalFile(lookupFileArg(state, file), **vSourceExpr);
-
-    else {
-
-        /* Construct the installation source from $NIX_PATH. */
-
-        auto searchPath = state.getSearchPath();
-
-        state.mkAttrs(**vSourceExpr, 1024);
-
-        mkBool(*state.allocAttr(**vSourceExpr, sToplevel), true);
-
-        std::unordered_set<std::string> seen;
-
-        auto addEntry = [&](const std::string & name) {
-            if (name == "") return;
-            if (!seen.insert(name).second) return;
-            Value * v1 = state.allocValue();
-            mkPrimOpApp(*v1, state.getBuiltin("findFile"), state.getBuiltin("nixPath"));
-            Value * v2 = state.allocValue();
-            mkApp(*v2, *v1, mkString(*state.allocValue(), name));
-            mkApp(*state.allocAttr(**vSourceExpr, state.symbols.create(name)),
-                state.getBuiltin("import"), *v2);
-        };
-
-        for (auto & i : searchPath)
-            /* Hack to handle channels. */
-            if (i.first.empty() && pathExists(i.second + "/manifest.nix")) {
-                for (auto & j : readDirectory(i.second))
-                    if (j.name != "manifest.nix"
-                        && pathExists(fmt("%s/%s/default.nix", i.second, j.name)))
-                        addEntry(j.name);
-            } else
-                addEntry(i.first);
-
-        (*vSourceExpr)->attrs->sort();
-    }
-
-    return *vSourceExpr;
+    return {"defaultPackage." + settings.thisSystem.get()};
 }
 
-ref<EvalState> SourceExprCommand::getEvalState()
+Strings SourceExprCommand::getDefaultFlakeAttrPathPrefixes()
+{
+    return {
+        // As a convenience, look for the attribute in
+        // 'outputs.packages'.
+        "packages." + settings.thisSystem.get() + ".",
+        // As a temporary hack until Nixpkgs is properly converted
+        // to provide a clean 'packages' set, look in 'legacyPackages'.
+        "legacyPackages." + settings.thisSystem.get() + "."
+    };
+}
+
+void SourceExprCommand::completeInstallable(std::string_view prefix)
+{
+    if (file) return; // FIXME
+
+    /* Look for flake output attributes that match the
+       prefix. */
+    try {
+        auto hash = prefix.find('#');
+        if (hash != std::string::npos) {
+            auto fragment = prefix.substr(hash + 1);
+            auto flakeRefS = std::string(prefix.substr(0, hash));
+            // FIXME: do tilde expansion.
+            auto flakeRef = parseFlakeRef(flakeRefS, absPath("."));
+
+            auto state = getEvalState();
+
+            auto evalCache = openEvalCache(*state,
+                std::make_shared<flake::LockedFlake>(lockFlake(*state, flakeRef, lockFlags)),
+                true);
+
+            auto root = evalCache->getRoot();
+
+            /* Complete 'fragment' relative to all the
+               attrpath prefixes as well as the root of the
+               flake. */
+            auto attrPathPrefixes = getDefaultFlakeAttrPathPrefixes();
+            attrPathPrefixes.push_back("");
+
+            for (auto & attrPathPrefixS : attrPathPrefixes) {
+                auto attrPathPrefix = parseAttrPath(*state, attrPathPrefixS);
+                auto attrPathS = attrPathPrefixS + std::string(fragment);
+                auto attrPath = parseAttrPath(*state, attrPathS);
+
+                std::string lastAttr;
+                if (!attrPath.empty() && !hasSuffix(attrPathS, ".")) {
+                    lastAttr = attrPath.back();
+                    attrPath.pop_back();
+                }
+
+                auto attr = root->findAlongAttrPath(attrPath);
+                if (!attr) continue;
+
+                auto attrs = attr->getAttrs();
+                for (auto & attr2 : attrs) {
+                    if (hasPrefix(attr2, lastAttr)) {
+                        auto attrPath2 = attr->getAttrPath(attr2);
+                        /* Strip the attrpath prefix. */
+                        attrPath2.erase(attrPath2.begin(), attrPath2.begin() + attrPathPrefix.size());
+                        completions->insert(flakeRefS + "#" + concatStringsSep(".", attrPath2));
+                    }
+                }
+            }
+
+            /* And add an empty completion for the default
+               attrpaths. */
+            if (fragment.empty()) {
+                for (auto & attrPath : getDefaultFlakeAttrPaths()) {
+                    auto attr = root->findAlongAttrPath(parseAttrPath(*state, attrPath));
+                    if (!attr) continue;
+                    completions->insert(flakeRefS + "#");
+                }
+            }
+        }
+    } catch (Error & e) {
+        warn(e.msg());
+    }
+
+    completeFlakeRef(prefix);
+}
+
+ref<EvalState> EvalCommand::getEvalState()
 {
     if (!evalState)
         evalState = std::make_shared<EvalState>(searchPath, getStore());
     return ref<EvalState>(evalState);
 }
 
+void EvalCommand::completeFlakeRef(std::string_view prefix)
+{
+    if (prefix == "")
+        completions->insert(".");
+
+    completeDir(0, prefix);
+
+    /* Look for registry entries that match the prefix. */
+    for (auto & registry : fetchers::getRegistries(getStore())) {
+        for (auto & entry : registry->entries) {
+            auto from = entry.from->to_string();
+            if (!hasPrefix(prefix, "flake:") && hasPrefix(from, "flake:")) {
+                std::string from2(from, 6);
+                if (hasPrefix(from2, prefix))
+                    completions->insert(from2);
+            } else {
+                if (hasPrefix(from, prefix))
+                    completions->insert(from);
+            }
+        }
+    }
+}
+
 Buildable Installable::toBuildable()
 {
     auto buildables = toBuildables();
@@ -89,6 +215,36 @@ Buildable Installable::toBuildable()
     return std::move(buildables[0]);
 }
 
+App::App(EvalState & state, Value & vApp)
+{
+    state.forceAttrs(vApp);
+
+    auto aType = vApp.attrs->need(state.sType);
+    if (state.forceStringNoCtx(*aType.value, *aType.pos) != "app")
+        throw Error("value does not have type 'app', at %s", *aType.pos);
+
+    auto aProgram = vApp.attrs->need(state.symbols.create("program"));
+    program = state.forceString(*aProgram.value, context, *aProgram.pos);
+
+    // FIXME: check that 'program' is in the closure of 'context'.
+    if (!state.store->isInStore(program))
+        throw Error("app program '%s' is not in the Nix store", program);
+}
+
+App Installable::toApp(EvalState & state)
+{
+    return App(state, *toValue(state).first);
+}
+
+std::vector<std::pair<std::shared_ptr<eval_cache::AttrCursor>, std::string>>
+Installable::getCursor(EvalState & state, bool useEvalCache)
+{
+    auto evalCache =
+        std::make_shared<nix::eval_cache::EvalCache>(false, Hash(), state,
+            [&]() { return toValue(state).first; });
+    return {{evalCache->getRoot(), ""}};
+}
+
 struct InstallableStorePath : Installable
 {
     ref<Store> store;
@@ -118,54 +274,63 @@ struct InstallableStorePath : Installable
     }
 };
 
-struct InstallableValue : Installable
+std::vector<InstallableValue::DerivationInfo> InstallableValue::toDerivations()
 {
-    SourceExprCommand & cmd;
+    auto state = cmd.getEvalState();
 
-    InstallableValue(SourceExprCommand & cmd) : cmd(cmd) { }
+    auto v = toValue(*state).first;
 
-    Buildables toBuildables() override
-    {
-        auto state = cmd.getEvalState();
+    Bindings & autoArgs = *cmd.getAutoArgs(*state);
 
-        auto v = toValue(*state).first;
+    DrvInfos drvInfos;
+    getDerivations(*state, *v, "", autoArgs, drvInfos, false);
 
-        Bindings & autoArgs = *cmd.getAutoArgs(*state);
-
-        DrvInfos drvs;
-        getDerivations(*state, *v, "", autoArgs, drvs, false);
-
-        Buildables res;
-
-        StorePathSet drvPaths;
-
-        for (auto & drv : drvs) {
-            Buildable b{.drvPath = state->store->parseStorePath(drv.queryDrvPath())};
-            drvPaths.insert(b.drvPath->clone());
-
-            auto outputName = drv.queryOutputName();
-            if (outputName == "")
-                throw Error("derivation '%s' lacks an 'outputName' attribute", state->store->printStorePath(*b.drvPath));
-
-            b.outputs.emplace(outputName, state->store->parseStorePath(drv.queryOutPath()));
-
-            res.push_back(std::move(b));
-        }
-
-        // Hack to recognize .all: if all drvs have the same drvPath,
-        // merge the buildables.
-        if (drvPaths.size() == 1) {
-            Buildable b{.drvPath = drvPaths.begin()->clone()};
-            for (auto & b2 : res)
-                for (auto & output : b2.outputs)
-                    b.outputs.insert_or_assign(output.first, output.second.clone());
-            Buildables bs;
-            bs.push_back(std::move(b));
-            return bs;
-        } else
-            return res;
+    std::vector<DerivationInfo> res;
+    for (auto & drvInfo : drvInfos) {
+        res.push_back({
+            state->store->parseStorePath(drvInfo.queryDrvPath()),
+            state->store->parseStorePath(drvInfo.queryOutPath()),
+            drvInfo.queryOutputName()
+        });
     }
-};
+
+    return res;
+}
+
+Buildables InstallableValue::toBuildables()
+{
+    auto state = cmd.getEvalState();
+
+    Buildables res;
+
+    StorePathSet drvPaths;
+
+    for (auto & drv : toDerivations()) {
+        Buildable b{.drvPath = drv.drvPath.clone()};
+        drvPaths.insert(drv.drvPath.clone());
+
+        auto outputName = drv.outputName;
+        if (outputName == "")
+            throw Error("derivation '%s' lacks an 'outputName' attribute", state->store->printStorePath(*b.drvPath));
+
+        b.outputs.emplace(outputName, drv.outPath.clone());
+
+        res.push_back(std::move(b));
+    }
+
+    // Hack to recognize .all: if all drvs have the same drvPath,
+    // merge the buildables.
+    if (drvPaths.size() == 1) {
+        Buildable b{.drvPath = drvPaths.begin()->clone()};
+        for (auto & b2 : res)
+            for (auto & output : b2.outputs)
+                b.outputs.insert_or_assign(output.first, output.second.clone());
+        Buildables bs;
+        bs.push_back(std::move(b));
+        return bs;
+    } else
+        return res;
+}
 
 struct InstallableExpr : InstallableValue
 {
@@ -186,70 +351,237 @@ struct InstallableExpr : InstallableValue
 
 struct InstallableAttrPath : InstallableValue
 {
+    RootValue v;
     std::string attrPath;
 
-    InstallableAttrPath(SourceExprCommand & cmd, const std::string & attrPath)
-        : InstallableValue(cmd), attrPath(attrPath)
+    InstallableAttrPath(SourceExprCommand & cmd, Value * v, const std::string & attrPath)
+        : InstallableValue(cmd), v(allocRootValue(v)), attrPath(attrPath)
     { }
 
     std::string what() override { return attrPath; }
 
     std::pair<Value *, Pos> toValue(EvalState & state) override
     {
-        auto source = cmd.getSourceExpr(state);
-
-        Bindings & autoArgs = *cmd.getAutoArgs(state);
-
-        auto v = findAlongAttrPath(state, attrPath, autoArgs, *source).first;
-        state.forceValue(*v);
-
-        return {v, noPos};
+        auto [vRes, pos] = findAlongAttrPath(state, attrPath, *cmd.getAutoArgs(state), **v);
+        state.forceValue(*vRes);
+        return {vRes, pos};
     }
 };
 
-// FIXME: extend
-std::string attrRegex = R"([A-Za-z_][A-Za-z0-9-_+]*)";
-static std::regex attrPathRegex(fmt(R"(%1%(\.%1%)*)", attrRegex));
+std::vector<std::string> InstallableFlake::getActualAttrPaths()
+{
+    std::vector<std::string> res;
 
-static std::vector<std::shared_ptr<Installable>> parseInstallables(
-    SourceExprCommand & cmd, ref<Store> store, std::vector<std::string> ss, bool useDefaultInstallables)
+    for (auto & prefix : prefixes)
+        res.push_back(prefix + *attrPaths.begin());
+
+    for (auto & s : attrPaths)
+        res.push_back(s);
+
+    return res;
+}
+
+Value * InstallableFlake::getFlakeOutputs(EvalState & state, const flake::LockedFlake & lockedFlake)
+{
+    auto vFlake = state.allocValue();
+
+    callFlake(state, lockedFlake, *vFlake);
+
+    auto aOutputs = vFlake->attrs->get(state.symbols.create("outputs"));
+    assert(aOutputs);
+
+    state.forceValue(*aOutputs->value);
+
+    return aOutputs->value;
+}
+
+ref<eval_cache::EvalCache> openEvalCache(
+    EvalState & state,
+    std::shared_ptr<flake::LockedFlake> lockedFlake,
+    bool useEvalCache)
+{
+    return ref(std::make_shared<nix::eval_cache::EvalCache>(
+        useEvalCache,
+        lockedFlake->getFingerprint(),
+        state,
+        [&state, lockedFlake]()
+        {
+            /* For testing whether the evaluation cache is
+               complete. */
+            if (getEnv("NIX_ALLOW_EVAL").value_or("1") == "0")
+                throw Error("not everything is cached, but evaluation is not allowed");
+
+            auto vFlake = state.allocValue();
+            flake::callFlake(state, *lockedFlake, *vFlake);
+
+            state.forceAttrs(*vFlake);
+
+            auto aOutputs = vFlake->attrs->get(state.symbols.create("outputs"));
+            assert(aOutputs);
+
+            return aOutputs->value;
+        }));
+}
+
+std::tuple<std::string, FlakeRef, InstallableValue::DerivationInfo> InstallableFlake::toDerivation()
+{
+    auto state = cmd.getEvalState();
+
+    auto lockedFlake = std::make_shared<flake::LockedFlake>(
+        lockFlake(*state, flakeRef, cmd.lockFlags));
+
+    auto cache = openEvalCache(*state, lockedFlake, true);
+    auto root = cache->getRoot();
+
+    for (auto & attrPath : getActualAttrPaths()) {
+        auto attr = root->findAlongAttrPath(parseAttrPath(*state, attrPath));
+        if (!attr) continue;
+
+        if (!attr->isDerivation())
+            throw Error("flake output attribute '%s' is not a derivation", attrPath);
+
+        auto aDrvPath = attr->getAttr(state->sDrvPath);
+        auto drvPath = state->store->parseStorePath(aDrvPath->getString());
+        if (!state->store->isValidPath(drvPath) && !settings.readOnlyMode) {
+            /* The eval cache contains 'drvPath', but the actual path
+               has been garbage-collected. So force it to be
+               regenerated. */
+            aDrvPath->forceValue();
+            if (!state->store->isValidPath(drvPath))
+                throw Error("don't know how to recreate store derivation '%s'!",
+                    state->store->printStorePath(drvPath));
+        }
+
+        auto drvInfo = DerivationInfo{
+            std::move(drvPath),
+            state->store->parseStorePath(attr->getAttr(state->sOutPath)->getString()),
+            attr->getAttr(state->sOutputName)->getString()
+        };
+
+        return {attrPath, lockedFlake->flake.lockedRef, std::move(drvInfo)};
+    }
+
+    throw Error("flake '%s' does not provide attribute %s",
+        flakeRef, concatStringsSep(", ", quoteStrings(attrPaths)));
+}
+
+std::vector<InstallableValue::DerivationInfo> InstallableFlake::toDerivations()
+{
+    std::vector<DerivationInfo> res;
+    res.push_back(std::get<2>(toDerivation()));
+    return res;
+}
+
+std::pair<Value *, Pos> InstallableFlake::toValue(EvalState & state)
+{
+    auto lockedFlake = lockFlake(state, flakeRef, cmd.lockFlags);
+
+    auto vOutputs = getFlakeOutputs(state, lockedFlake);
+
+    auto emptyArgs = state.allocBindings(0);
+
+    for (auto & attrPath : getActualAttrPaths()) {
+        try {
+            auto [v, pos] = findAlongAttrPath(state, attrPath, *emptyArgs, *vOutputs);
+            state.forceValue(*v);
+            return {v, pos};
+        } catch (AttrPathNotFound & e) {
+        }
+    }
+
+    throw Error("flake '%s' does not provide attribute %s",
+        flakeRef, concatStringsSep(", ", quoteStrings(attrPaths)));
+}
+
+std::vector<std::pair<std::shared_ptr<eval_cache::AttrCursor>, std::string>>
+InstallableFlake::getCursor(EvalState & state, bool useEvalCache)
+{
+    auto evalCache = openEvalCache(state,
+        std::make_shared<flake::LockedFlake>(lockFlake(state, flakeRef, cmd.lockFlags)),
+        useEvalCache);
+
+    auto root = evalCache->getRoot();
+
+    std::vector<std::pair<std::shared_ptr<eval_cache::AttrCursor>, std::string>> res;
+
+    for (auto & attrPath : getActualAttrPaths()) {
+        auto attr = root->findAlongAttrPath(parseAttrPath(state, attrPath));
+        if (attr) res.push_back({attr, attrPath});
+    }
+
+    return res;
+}
+
+std::vector<std::shared_ptr<Installable>> SourceExprCommand::parseInstallables(
+    ref<Store> store, std::vector<std::string> ss)
 {
     std::vector<std::shared_ptr<Installable>> result;
 
-    if (ss.empty() && useDefaultInstallables) {
-        if (cmd.file == "")
-            cmd.file = ".";
-        ss = {""};
-    }
+    if (file || expr) {
+        if (file && expr)
+            throw UsageError("'--file' and '--expr' are exclusive");
 
-    for (auto & s : ss) {
+        // FIXME: backward compatibility hack
+        if (file) evalSettings.pureEval = false;
 
-        if (s.compare(0, 1, "(") == 0)
-            result.push_back(std::make_shared<InstallableExpr>(cmd, s));
+        auto state = getEvalState();
+        auto vFile = state->allocValue();
 
-        else if (s.find("/") != std::string::npos) {
-
-            auto path = store->toStorePath(store->followLinksToStore(s));
-
-            if (store->isStorePath(path))
-                result.push_back(std::make_shared<InstallableStorePath>(store, path));
+        if (file)
+            state->evalFile(lookupFileArg(*state, *file), *vFile);
+        else {
+            auto e = state->parseExprFromString(*expr, absPath("."));
+            state->eval(e, *vFile);
         }
 
-        else if (s == "" || std::regex_match(s, attrPathRegex))
-            result.push_back(std::make_shared<InstallableAttrPath>(cmd, s));
+        for (auto & s : ss)
+            result.push_back(std::make_shared<InstallableAttrPath>(*this, vFile, s == "." ? "" : s));
 
-        else
-            throw UsageError("don't know what to do with argument '%s'", s);
+    } else {
+
+        for (auto & s : ss) {
+            std::exception_ptr ex;
+
+            try {
+                auto [flakeRef, fragment] = parseFlakeRefWithFragment(s, absPath("."));
+                result.push_back(std::make_shared<InstallableFlake>(
+                        *this, std::move(flakeRef),
+                        fragment == "" ? getDefaultFlakeAttrPaths() : Strings{fragment},
+                        getDefaultFlakeAttrPathPrefixes()));
+                continue;
+            } catch (...) {
+                ex = std::current_exception();
+            }
+
+            if (s.find('/') != std::string::npos) {
+                try {
+                    result.push_back(std::make_shared<InstallableStorePath>(store, store->printStorePath(store->followLinksToStorePath(s))));
+                    continue;
+                } catch (NotInStore &) {
+                } catch (...) {
+                    if (!ex)
+                        ex = std::current_exception();
+                }
+            }
+
+            std::rethrow_exception(ex);
+
+            /*
+            throw Error(
+                pathExists(s)
+                ? "path '%s' is not a flake or a store path"
+                : "don't know how to handle argument '%s'", s);
+            */
+        }
     }
 
     return result;
 }
 
-std::shared_ptr<Installable> parseInstallable(
-    SourceExprCommand & cmd, ref<Store> store, const std::string & installable,
-    bool useDefaultInstallables)
+std::shared_ptr<Installable> SourceExprCommand::parseInstallable(
+    ref<Store> store, const std::string & installable)
 {
-    auto installables = parseInstallables(cmd, store, {installable}, false);
+    auto installables = parseInstallables(store, {installable});
     assert(installables.size() == 1);
     return installables.front();
 }
@@ -304,7 +636,7 @@ StorePath toStorePath(ref<Store> store, RealiseMode mode,
     auto paths = toStorePaths(store, mode, {installable});
 
     if (paths.size() != 1)
-            throw Error("argument '%s' should evaluate to one store path", installable->what());
+        throw Error("argument '%s' should evaluate to one store path", installable->what());
 
     return paths.begin()->clone();
 }
@@ -333,14 +665,41 @@ StorePathSet toDerivations(ref<Store> store,
     return drvPaths;
 }
 
+InstallablesCommand::InstallablesCommand()
+{
+    expectArgs({
+        .label = "installables",
+        .handler = {&_installables},
+        .completer = {[&](size_t, std::string_view prefix) {
+            completeInstallable(prefix);
+        }}
+    });
+}
+
 void InstallablesCommand::prepare()
 {
-    installables = parseInstallables(*this, getStore(), _installables, useDefaultInstallables());
+    if (_installables.empty() && useDefaultInstallables())
+        // FIXME: commands like "nix install" should not have a
+        // default, probably.
+        _installables.push_back(".");
+    installables = parseInstallables(getStore(), _installables);
+}
+
+InstallableCommand::InstallableCommand()
+{
+    expectArgs({
+        .label = "installable",
+        .optional = true,
+        .handler = {&_installable},
+        .completer = {[&](size_t, std::string_view prefix) {
+            completeInstallable(prefix);
+        }}
+    });
 }
 
 void InstallableCommand::prepare()
 {
-    installable = parseInstallable(*this, getStore(), _installable, false);
+    installable = parseInstallable(getStore(), _installable);
 }
 
 }

src/nix/installables.hh

@@ -3,11 +3,17 @@
 #include "util.hh"
 #include "path.hh"
 #include "eval.hh"
+#include "flake/flake.hh"
 
 #include <optional>
 
 namespace nix {
 
+struct DrvInfo;
+struct SourceExprCommand;
+
+namespace eval_cache { class EvalCache; class AttrCursor; }
+
 struct Buildable
 {
     std::optional<StorePath> drvPath;
@@ -16,6 +22,15 @@ struct Buildable
 
 typedef std::vector<Buildable> Buildables;
 
+struct App
+{
+    PathSet context;
+    Path program;
+    // FIXME: add args, sandbox settings, metadata, ...
+
+    App(EvalState & state, Value & vApp);
+};
+
 struct Installable
 {
     virtual ~Installable() { }
@@ -29,6 +44,8 @@ struct Installable
 
     Buildable toBuildable();
 
+    App toApp(EvalState & state);
+
     virtual std::pair<Value *, Pos> toValue(EvalState & state)
     {
         throw Error("argument '%s' cannot be evaluated", what());
@@ -40,6 +57,60 @@ struct Installable
     {
         return {};
     }
+
+    virtual std::vector<std::pair<std::shared_ptr<eval_cache::AttrCursor>, std::string>>
+    getCursor(EvalState & state, bool useEvalCache);
 };
 
+struct InstallableValue : Installable
+{
+    SourceExprCommand & cmd;
+
+    InstallableValue(SourceExprCommand & cmd) : cmd(cmd) { }
+
+    struct DerivationInfo
+    {
+        StorePath drvPath;
+        StorePath outPath;
+        std::string outputName;
+    };
+
+    virtual std::vector<DerivationInfo> toDerivations();
+
+    Buildables toBuildables() override;
+};
+
+struct InstallableFlake : InstallableValue
+{
+    FlakeRef flakeRef;
+    Strings attrPaths;
+    Strings prefixes;
+
+    InstallableFlake(SourceExprCommand & cmd, FlakeRef && flakeRef,
+        Strings && attrPaths, Strings && prefixes)
+        : InstallableValue(cmd), flakeRef(flakeRef), attrPaths(attrPaths),
+          prefixes(prefixes)
+    { }
+
+    std::string what() override { return flakeRef.to_string() + "#" + *attrPaths.begin(); }
+
+    std::vector<std::string> getActualAttrPaths();
+
+    Value * getFlakeOutputs(EvalState & state, const flake::LockedFlake & lockedFlake);
+
+    std::tuple<std::string, FlakeRef, DerivationInfo> toDerivation();
+
+    std::vector<DerivationInfo> toDerivations() override;
+
+    std::pair<Value *, Pos> toValue(EvalState & state) override;
+
+    std::vector<std::pair<std::shared_ptr<eval_cache::AttrCursor>, std::string>>
+    getCursor(EvalState & state, bool useEvalCache) override;
+};
+
+ref<eval_cache::EvalCache> openEvalCache(
+    EvalState & state,
+    std::shared_ptr<flake::LockedFlake> lockedFlake,
+    bool useEvalCache);
+
 }

src/nix/local.mk

@@ -29,3 +29,5 @@ $(eval $(call install-symlink, $(bindir)/nix, $(libexecdir)/nix/build-remote))
 src/nix-env/user-env.cc: src/nix-env/buildenv.nix.gen.hh
 
 src/nix/dev-shell.cc: src/nix/get-env.sh.gen.hh
+
+$(d)/flake.cc: $(d)/flake-template.nix.gen.hh

src/nix/ls.cc

@@ -85,7 +85,11 @@ struct CmdLsStore : StoreCommand, MixLs
 {
     CmdLsStore()
     {
-        expectArg("path", &path);
+        expectArgs({
+            .label = "path",
+            .handler = {&path},
+            .completer = completePath
+        });
     }
 
     Examples examples() override
@@ -117,7 +121,11 @@ struct CmdLsNar : Command, MixLs
 
     CmdLsNar()
     {
-        expectArg("nar", &narPath);
+        expectArgs({
+            .label = "nar",
+            .handler = {&narPath},
+            .completer = completePath
+        });
         expectArg("path", &path);
     }
 

src/nix/main.cc

@@ -68,7 +68,7 @@ struct NixArgs : virtual MultiCommand, virtual MixCommonArgs
         addFlag({
             .longName = "help",
             .description = "show usage information",
-            .handler = {[&]() { showHelpAndExit(); }},
+            .handler = {[&]() { if (!completions) showHelpAndExit(); }},
         });
 
         addFlag({
@@ -96,7 +96,7 @@ struct NixArgs : virtual MultiCommand, virtual MixCommonArgs
         addFlag({
             .longName = "version",
             .description = "show version information",
-            .handler = {[&]() { printVersion(programName); }},
+            .handler = {[&]() { if (!completions) printVersion(programName); }},
         });
 
         addFlag({
@@ -162,10 +162,26 @@ void mainWrapped(int argc, char * * argv)
 
     verbosity = lvlWarn;
     settings.verboseBuild = false;
+    evalSettings.pureEval = true;
 
     NixArgs args;
 
-    args.parseCmdline(argvToStrings(argc, argv));
+    Finally printCompletions([&]()
+    {
+        if (completions) {
+            std::cout << (pathCompletions ? "filenames\n" : "no-filenames\n");
+            for (auto & s : *completions)
+                std::cout << s << "\n";
+        }
+    });
+
+    try {
+        args.parseCmdline(argvToStrings(argc, argv));
+    } catch (UsageError &) {
+        if (!completions) throw;
+    }
+
+    if (completions) return;
 
     settings.requireExperimentalFeature("nix-command");
 

src/nix/profile.cc

@@ -0,0 +1,427 @@
+#include "command.hh"
+#include "common-args.hh"
+#include "shared.hh"
+#include "store-api.hh"
+#include "derivations.hh"
+#include "archive.hh"
+#include "builtins/buildenv.hh"
+#include "flake/flakeref.hh"
+#include "../nix-env/user-env.hh"
+
+#include <nlohmann/json.hpp>
+#include <regex>
+
+using namespace nix;
+
+struct ProfileElementSource
+{
+    FlakeRef originalRef;
+    // FIXME: record original attrpath.
+    FlakeRef resolvedRef;
+    std::string attrPath;
+    // FIXME: output names
+};
+
+struct ProfileElement
+{
+    StorePathSet storePaths;
+    std::optional<ProfileElementSource> source;
+    bool active = true;
+    // FIXME: priority
+};
+
+struct ProfileManifest
+{
+    std::vector<ProfileElement> elements;
+
+    ProfileManifest() { }
+
+    ProfileManifest(EvalState & state, const Path & profile)
+    {
+        auto manifestPath = profile + "/manifest.json";
+
+        if (pathExists(manifestPath)) {
+            auto json = nlohmann::json::parse(readFile(manifestPath));
+
+            auto version = json.value("version", 0);
+            if (version != 1)
+                throw Error("profile manifest '%s' has unsupported version %d", manifestPath, version);
+
+            for (auto & e : json["elements"]) {
+                ProfileElement element;
+                for (auto & p : e["storePaths"])
+                    element.storePaths.insert(state.store->parseStorePath((std::string) p));
+                element.active = e["active"];
+                if (e.value("uri", "") != "") {
+                    element.source = ProfileElementSource{
+                        parseFlakeRef(e["originalUri"]),
+                        parseFlakeRef(e["uri"]),
+                        e["attrPath"]
+                    };
+                }
+                elements.emplace_back(std::move(element));
+            }
+        }
+
+        else if (pathExists(profile + "/manifest.nix")) {
+            // FIXME: needed because of pure mode; ugly.
+            if (state.allowedPaths) {
+                state.allowedPaths->insert(state.store->followLinksToStore(profile));
+                state.allowedPaths->insert(state.store->followLinksToStore(profile + "/manifest.nix"));
+            }
+
+            auto drvInfos = queryInstalled(state, state.store->followLinksToStore(profile));
+
+            for (auto & drvInfo : drvInfos) {
+                ProfileElement element;
+                element.storePaths = singleton(state.store->parseStorePath(drvInfo.queryOutPath()));
+                elements.emplace_back(std::move(element));
+            }
+        }
+    }
+
+    std::string toJSON(Store & store) const
+    {
+        auto array = nlohmann::json::array();
+        for (auto & element : elements) {
+            auto paths = nlohmann::json::array();
+            for (auto & path : element.storePaths)
+                paths.push_back(store.printStorePath(path));
+            nlohmann::json obj;
+            obj["storePaths"] = paths;
+            obj["active"] = element.active;
+            if (element.source) {
+                obj["originalUri"] = element.source->originalRef.to_string();
+                obj["uri"] = element.source->resolvedRef.to_string();
+                obj["attrPath"] = element.source->attrPath;
+            }
+            array.push_back(obj);
+        }
+        nlohmann::json json;
+        json["version"] = 1;
+        json["elements"] = array;
+        return json.dump();
+    }
+
+    StorePath build(ref<Store> store)
+    {
+        auto tempDir = createTempDir();
+
+        StorePathSet references;
+
+        Packages pkgs;
+        for (auto & element : elements) {
+            for (auto & path : element.storePaths) {
+                if (element.active)
+                    pkgs.emplace_back(store->printStorePath(path), true, 5);
+                references.insert(path.clone());
+            }
+        }
+
+        buildProfile(tempDir, std::move(pkgs));
+
+        writeFile(tempDir + "/manifest.json", toJSON(*store));
+
+        /* Add the symlink tree to the store. */
+        StringSink sink;
+        dumpPath(tempDir, sink);
+
+        auto narHash = hashString(htSHA256, *sink.s);
+
+        ValidPathInfo info(store->makeFixedOutputPath(true, narHash, "profile", references));
+        info.references = std::move(references);
+        info.narHash = narHash;
+        info.narSize = sink.s->size();
+        info.ca = makeFixedOutputCA(true, info.narHash);
+
+        store->addToStore(info, sink.s);
+
+        return std::move(info.path);
+    }
+};
+
+struct CmdProfileInstall : InstallablesCommand, MixDefaultProfile
+{
+    std::string description() override
+    {
+        return "install a package into a profile";
+    }
+
+    Examples examples() override
+    {
+        return {
+            Example{
+                "To install a package from Nixpkgs:",
+                "nix profile install nixpkgs#hello"
+            },
+            Example{
+                "To install a package from a specific branch of Nixpkgs:",
+                "nix profile install nixpkgs/release-19.09#hello"
+            },
+            Example{
+                "To install a package from a specific revision of Nixpkgs:",
+                "nix profile install nixpkgs/1028bb33859f8dfad7f98e1c8d185f3d1aaa7340#hello"
+            },
+        };
+    }
+
+    void run(ref<Store> store) override
+    {
+        ProfileManifest manifest(*getEvalState(), *profile);
+
+        std::vector<StorePathWithOutputs> pathsToBuild;
+
+        for (auto & installable : installables) {
+            if (auto installable2 = std::dynamic_pointer_cast<InstallableFlake>(installable)) {
+                auto [attrPath, resolvedRef, drv] = installable2->toDerivation();
+
+                ProfileElement element;
+                element.storePaths = singleton(drv.outPath.clone()); // FIXME
+                element.source = ProfileElementSource{
+                    installable2->flakeRef,
+                    resolvedRef,
+                    attrPath,
+                };
+
+                pathsToBuild.emplace_back(drv.drvPath.clone(), StringSet{"out"}); // FIXME
+
+                manifest.elements.emplace_back(std::move(element));
+            } else
+                throw Error("'nix profile install' does not support argument '%s'", installable->what());
+        }
+
+        store->buildPaths(pathsToBuild);
+
+        updateProfile(manifest.build(store));
+    }
+};
+
+class MixProfileElementMatchers : virtual Args
+{
+    std::vector<std::string> _matchers;
+
+public:
+
+    MixProfileElementMatchers()
+    {
+        expectArgs("elements", &_matchers);
+    }
+
+    typedef std::variant<size_t, Path, std::regex> Matcher;
+
+    std::vector<Matcher> getMatchers(ref<Store> store)
+    {
+        std::vector<Matcher> res;
+
+        for (auto & s : _matchers) {
+            size_t n;
+            if (string2Int(s, n))
+                res.push_back(n);
+            else if (store->isStorePath(s))
+                res.push_back(s);
+            else
+                res.push_back(std::regex(s, std::regex::extended | std::regex::icase));
+        }
+
+        return res;
+    }
+
+    bool matches(const Store & store, const ProfileElement & element, size_t pos, const std::vector<Matcher> & matchers)
+    {
+        for (auto & matcher : matchers) {
+            if (auto n = std::get_if<size_t>(&matcher)) {
+                if (*n == pos) return true;
+            } else if (auto path = std::get_if<Path>(&matcher)) {
+                if (element.storePaths.count(store.parseStorePath(*path))) return true;
+            } else if (auto regex = std::get_if<std::regex>(&matcher)) {
+                if (element.source
+                    && std::regex_match(element.source->attrPath, *regex))
+                    return true;
+            }
+        }
+
+        return false;
+    }
+};
+
+struct CmdProfileRemove : virtual EvalCommand, MixDefaultProfile, MixProfileElementMatchers
+{
+    std::string description() override
+    {
+        return "remove packages from a profile";
+    }
+
+    Examples examples() override
+    {
+        return {
+            Example{
+                "To remove a package by attribute path:",
+                "nix profile remove packages.x86_64-linux.hello"
+            },
+            Example{
+                "To remove all packages:",
+                "nix profile remove '.*'"
+            },
+            Example{
+                "To remove a package by store path:",
+                "nix profile remove /nix/store/rr3y0c6zyk7kjjl8y19s4lsrhn4aiq1z-hello-2.10"
+            },
+            Example{
+                "To remove a package by position:",
+                "nix profile remove 3"
+            },
+        };
+    }
+
+    void run(ref<Store> store) override
+    {
+        ProfileManifest oldManifest(*getEvalState(), *profile);
+
+        auto matchers = getMatchers(store);
+
+        ProfileManifest newManifest;
+
+        for (size_t i = 0; i < oldManifest.elements.size(); ++i) {
+            auto & element(oldManifest.elements[i]);
+            if (!matches(*store, element, i, matchers))
+                newManifest.elements.push_back(std::move(element));
+        }
+
+        // FIXME: warn about unused matchers?
+
+        printInfo("removed %d packages, kept %d packages",
+            oldManifest.elements.size() - newManifest.elements.size(),
+            newManifest.elements.size());
+
+        updateProfile(newManifest.build(store));
+    }
+};
+
+struct CmdProfileUpgrade : virtual SourceExprCommand, MixDefaultProfile, MixProfileElementMatchers
+{
+    std::string description() override
+    {
+        return "upgrade packages using their most recent flake";
+    }
+
+    Examples examples() override
+    {
+        return {
+            Example{
+                "To upgrade all packages that were installed using a mutable flake reference:",
+                "nix profile upgrade '.*'"
+            },
+            Example{
+                "To upgrade a specific package:",
+                "nix profile upgrade packages.x86_64-linux.hello"
+            },
+        };
+    }
+
+    void run(ref<Store> store) override
+    {
+        ProfileManifest manifest(*getEvalState(), *profile);
+
+        auto matchers = getMatchers(store);
+
+        // FIXME: code duplication
+        std::vector<StorePathWithOutputs> pathsToBuild;
+
+        for (size_t i = 0; i < manifest.elements.size(); ++i) {
+            auto & element(manifest.elements[i]);
+            if (element.source
+                && !element.source->originalRef.input->isImmutable()
+                && matches(*store, element, i, matchers))
+            {
+                Activity act(*logger, lvlChatty, actUnknown,
+                    fmt("checking '%s' for updates", element.source->attrPath));
+
+                InstallableFlake installable(*this, FlakeRef(element.source->originalRef), {element.source->attrPath}, {});
+
+                auto [attrPath, resolvedRef, drv] = installable.toDerivation();
+
+                if (element.source->resolvedRef == resolvedRef) continue;
+
+                printInfo("upgrading '%s' from flake '%s' to '%s'",
+                    element.source->attrPath, element.source->resolvedRef, resolvedRef);
+
+                element.storePaths = singleton(drv.outPath.clone()); // FIXME
+                element.source = ProfileElementSource{
+                    installable.flakeRef,
+                    resolvedRef,
+                    attrPath,
+                };
+
+                pathsToBuild.emplace_back(drv.drvPath, StringSet{"out"}); // FIXME
+            }
+        }
+
+        store->buildPaths(pathsToBuild);
+
+        updateProfile(manifest.build(store));
+    }
+};
+
+struct CmdProfileInfo : virtual EvalCommand, virtual StoreCommand, MixDefaultProfile
+{
+    std::string description() override
+    {
+        return "list installed packages";
+    }
+
+    Examples examples() override
+    {
+        return {
+            Example{
+                "To show what packages are installed in the default profile:",
+                "nix profile info"
+            },
+        };
+    }
+
+    void run(ref<Store> store) override
+    {
+        ProfileManifest manifest(*getEvalState(), *profile);
+
+        for (size_t i = 0; i < manifest.elements.size(); ++i) {
+            auto & element(manifest.elements[i]);
+            logger->stdout("%d %s %s %s", i,
+                element.source ? element.source->originalRef.to_string() + "#" + element.source->attrPath : "-",
+                element.source ? element.source->resolvedRef.to_string() + "#" + element.source->attrPath : "-",
+                concatStringsSep(" ", store->printStorePathSet(element.storePaths)));
+        }
+    }
+};
+
+struct CmdProfile : virtual MultiCommand, virtual Command
+{
+    CmdProfile()
+        : MultiCommand({
+              {"install", []() { return make_ref<CmdProfileInstall>(); }},
+              {"remove", []() { return make_ref<CmdProfileRemove>(); }},
+              {"upgrade", []() { return make_ref<CmdProfileUpgrade>(); }},
+              {"info", []() { return make_ref<CmdProfileInfo>(); }},
+          })
+    { }
+
+    std::string description() override
+    {
+        return "manage Nix profiles";
+    }
+
+    void run() override
+    {
+        if (!command)
+            throw UsageError("'nix profile' requires a sub-command.");
+        command->second->prepare();
+        command->second->run();
+    }
+
+    void printHelp(const string & programName, std::ostream & out) override
+    {
+        MultiCommand::printHelp(programName, out);
+    }
+};
+
+static auto r1 = registerCommand<CmdProfile>("profile");
+

src/nix/progress-bar.cc

@@ -113,8 +113,10 @@ public:
         state->active = false;
         std::string status = getStatus(*state);
         writeToStderr("\r\e[K");
+        /*
         if (status != "")
             writeToStderr("[" + status + "]\n");
+        */
         updateCV.notify_one();
         quitCV.notify_one();
     }

src/nix/repl.cc

@@ -767,7 +767,11 @@ struct CmdRepl : StoreCommand, MixEvalArgs
 
     CmdRepl()
     {
-        expectArgs("files", &files);
+        expectArgs({
+            .label = "files",
+            .handler = {&files},
+            .completer = completePath
+        });
     }
 
     std::string description() override
@@ -787,6 +791,7 @@ struct CmdRepl : StoreCommand, MixEvalArgs
 
     void run(ref<Store> store) override
     {
+        evalSettings.pureEval = false;
         auto repl = std::make_unique<NixRepl>(searchPath, openStore());
         repl->autoArgs = getAutoArgs(*repl->state);
         repl->mainLoop(files);

src/nix/run.cc

@@ -84,20 +84,20 @@ struct CmdShell : InstallablesCommand, RunCommon, MixEnvironment
     {
         return {
             Example{
-                "To start a shell providing GNU Hello from NixOS 17.03:",
-                "nix shell -f channel:nixos-17.03 hello"
+                "To start a shell providing GNU Hello from NixOS 20.03:",
+                "nix shell nixpkgs/nixos-20.03#hello"
             },
             Example{
                 "To start a shell providing youtube-dl from your 'nixpkgs' channel:",
-                "nix shell nixpkgs.youtube-dl"
+                "nix shell nixpkgs#youtube-dl"
             },
             Example{
                 "To run GNU Hello:",
-                "nix shell nixpkgs.hello -c hello --greeting 'Hi everybody!'"
+                "nix shell nixpkgs#hello -c hello --greeting 'Hi everybody!'"
             },
             Example{
                 "To run GNU Hello in a chroot store:",
-                "nix shell --store ~/my-nix nixpkgs.hello -c hello"
+                "nix shell --store ~/my-nix nixpkgs#hello -c hello"
             },
         };
     }
@@ -143,6 +143,61 @@ struct CmdShell : InstallablesCommand, RunCommon, MixEnvironment
 
 static auto r1 = registerCommand<CmdShell>("shell");
 
+struct CmdRun : InstallableCommand, RunCommon
+{
+    std::vector<std::string> args;
+
+    CmdRun()
+    {
+        expectArgs({
+            .label = "args",
+            .handler = {&args},
+            .completer = completePath
+        });
+    }
+
+    std::string description() override
+    {
+        return "run a Nix application";
+    }
+
+    Examples examples() override
+    {
+        return {
+            Example{
+                "To run Blender:",
+                "nix run blender-bin"
+            },
+        };
+    }
+
+    Strings getDefaultFlakeAttrPaths() override
+    {
+        return {"defaultApp." + settings.thisSystem.get()};
+    }
+
+    Strings getDefaultFlakeAttrPathPrefixes() override
+    {
+        return {"apps." + settings.thisSystem.get() + "."};
+    }
+
+    void run(ref<Store> store) override
+    {
+        auto state = getEvalState();
+
+        auto app = installable->toApp(*state);
+
+        state->realiseContext(app.context);
+
+        Strings allArgs{app.program};
+        for (auto & i : args) allArgs.push_back(i);
+
+        runProgram(store, app.program, allArgs);
+    }
+};
+
+static auto r2 = registerCommand<CmdRun>("run");
+
 void chrootHelper(int argc, char * * argv)
 {
     int p = 1;

src/nix/search.cc

@@ -6,8 +6,9 @@
 #include "get-drvs.hh"
 #include "common-args.hh"
 #include "json.hh"
-#include "json-to-value.hh"
 #include "shared.hh"
+#include "eval-cache.hh"
+#include "attr-path.hh"
 
 #include <regex>
 #include <fstream>
@@ -25,33 +26,17 @@ std::string hilite(const std::string & s, const std::smatch & m, std::string pos
         m.empty()
         ? s
         : std::string(m.prefix())
-          + ANSI_RED + std::string(m.str()) + postfix
+          + ANSI_GREEN + std::string(m.str()) + postfix
           + std::string(m.suffix());
 }
 
-struct CmdSearch : SourceExprCommand, MixJSON
+struct CmdSearch : InstallableCommand, MixJSON
 {
     std::vector<std::string> res;
 
-    bool writeCache = true;
-    bool useCache = true;
-
     CmdSearch()
     {
         expectArgs("regex", &res);
-
-        addFlag({
-            .longName = "update-cache",
-            .shortName = 'u',
-            .description = "update the package search cache",
-            .handler = {[&]() { writeCache = true; useCache = false; }}
-        });
-
-        addFlag({
-            .longName = "no-cache",
-            .description = "do not use or update the package search cache",
-            .handler = {[&]() { writeCache = false; useCache = false; }}
-        });
     }
 
     std::string description() override
@@ -63,24 +48,32 @@ struct CmdSearch : SourceExprCommand, MixJSON
     {
         return {
             Example{
-                "To show all available packages:",
+                "To show all packages in the flake in the current directory:",
                 "nix search"
             },
             Example{
-                "To show any packages containing 'blender' in its name or description:",
-                "nix search blender"
+                "To show packages in the 'nixpkgs' flake containing 'blender' in its name or description:",
+                "nix search nixpkgs blender"
             },
             Example{
                 "To search for Firefox or Chromium:",
-                "nix search 'firefox|chromium'"
+                "nix search nixpkgs 'firefox|chromium'"
             },
             Example{
-                "To search for git and frontend or gui:",
-                "nix search git 'frontend|gui'"
+                "To search for packages containing 'git' and either 'frontend' or 'gui':",
+                "nix search nixpkgs git 'frontend|gui'"
             }
         };
     }
 
+    Strings getDefaultFlakeAttrPaths() override
+    {
+        return {
+            "packages." + settings.thisSystem.get() + ".",
+            "legacyPackages." + settings.thisSystem.get() + "."
+        };
+    }
+
     void run(ref<Store> store) override
     {
         settings.readOnlyMode = true;
@@ -88,189 +81,107 @@ struct CmdSearch : SourceExprCommand, MixJSON
         // Empty search string should match all packages
         // Use "^" here instead of ".*" due to differences in resulting highlighting
         // (see #1893 -- libc++ claims empty search string is not in POSIX grammar)
-        if (res.empty()) {
+        if (res.empty())
             res.push_back("^");
-        }
 
         std::vector<std::regex> regexes;
         regexes.reserve(res.size());
 
-        for (auto &re : res) {
+        for (auto & re : res)
             regexes.push_back(std::regex(re, std::regex::extended | std::regex::icase));
-        }
 
         auto state = getEvalState();
 
         auto jsonOut = json ? std::make_unique<JSONObject>(std::cout) : nullptr;
 
-        auto sToplevel = state->symbols.create("_toplevel");
-        auto sRecurse = state->symbols.create("recurseForDerivations");
+        uint64_t results = 0;
 
-        bool fromCache = false;
-
-        std::map<std::string, std::string> results;
-
-        std::function<void(Value *, std::string, bool, JSONObject *)> doExpr;
-
-        doExpr = [&](Value * v, std::string attrPath, bool toplevel, JSONObject * cache) {
-            debug("at attribute '%s'", attrPath);
+        std::function<void(eval_cache::AttrCursor & cursor, const std::vector<Symbol> & attrPath)> visit;
 
+        visit = [&](eval_cache::AttrCursor & cursor, const std::vector<Symbol> & attrPath)
+        {
+            Activity act(*logger, lvlInfo, actUnknown,
+                fmt("evaluating '%s'", concatStringsSep(".", attrPath)));
             try {
-                uint found = 0;
+                auto recurse = [&]()
+                {
+                    for (const auto & attr : cursor.getAttrs()) {
+                        auto cursor2 = cursor.getAttr(attr);
+                        auto attrPath2(attrPath);
+                        attrPath2.push_back(attr);
+                        visit(*cursor2, attrPath2);
+                    }
+                };
 
-                state->forceValue(*v);
+                if (cursor.isDerivation()) {
+                    size_t found = 0;
 
-                if (v->type == tLambda && toplevel) {
-                    Value * v2 = state->allocValue();
-                    state->autoCallFunction(*state->allocBindings(1), *v, *v2);
-                    v = v2;
-                    state->forceValue(*v);
-                }
+                    DrvName name(cursor.getAttr("name")->getString());
 
-                if (state->isDerivation(*v)) {
+                    auto aMeta = cursor.maybeGetAttr("meta");
+                    auto aDescription = aMeta ? aMeta->maybeGetAttr("description") : nullptr;
+                    auto description = aDescription ? aDescription->getString() : "";
+                    std::replace(description.begin(), description.end(), '\n', ' ');
+                    auto attrPath2 = concatStringsSep(".", attrPath);
 
-                    DrvInfo drv(*state, attrPath, v->attrs);
-                    std::string description;
                     std::smatch attrPathMatch;
                     std::smatch descriptionMatch;
                     std::smatch nameMatch;
-                    std::string name;
 
-                    DrvName parsed(drv.queryName());
-
-                    for (auto &regex : regexes) {
-                        std::regex_search(attrPath, attrPathMatch, regex);
-
-                        name = parsed.name;
-                        std::regex_search(name, nameMatch, regex);
-
-                        description = drv.queryMetaString("description");
-                        std::replace(description.begin(), description.end(), '\n', ' ');
+                    for (auto & regex : regexes) {
+                        std::regex_search(attrPath2, attrPathMatch, regex);
+                        std::regex_search(name.name, nameMatch, regex);
                         std::regex_search(description, descriptionMatch, regex);
-
                         if (!attrPathMatch.empty()
                             || !nameMatch.empty()
                             || !descriptionMatch.empty())
-                        {
                             found++;
-                        }
                     }
 
                     if (found == res.size()) {
+                        results++;
                         if (json) {
-
-                            auto jsonElem = jsonOut->object(attrPath);
-
-                            jsonElem.attr("pkgName", parsed.name);
-                            jsonElem.attr("version", parsed.version);
+                            auto jsonElem = jsonOut->object(attrPath2);
+                            jsonElem.attr("pname", name.name);
+                            jsonElem.attr("version", name.version);
                             jsonElem.attr("description", description);
-
                         } else {
-                            auto name = hilite(parsed.name, nameMatch, "\e[0;2m")
-                                + std::string(parsed.fullName, parsed.name.length());
-                            results[attrPath] = fmt(
-                                "* %s (%s)\n  %s\n",
-                                wrap("\e[0;1m", hilite(attrPath, attrPathMatch, "\e[0;1m")),
-                                wrap("\e[0;2m", hilite(name, nameMatch, "\e[0;2m")),
-                                hilite(description, descriptionMatch, ANSI_NORMAL));
-                        }
-                    }
-
-                    if (cache) {
-                        cache->attr("type", "derivation");
-                        cache->attr("name", drv.queryName());
-                        cache->attr("system", drv.querySystem());
-                        if (description != "") {
-                            auto meta(cache->object("meta"));
-                            meta.attr("description", description);
+                            auto name2 = hilite(name.name, nameMatch, "\e[0;2m");
+                            if (results > 1) logger->stdout("");
+                            logger->stdout(
+                                "* %s%s",
+                                wrap("\e[0;1m", hilite(attrPath2, attrPathMatch, "\e[0;1m")),
+                                name.version != "" ? " (" + name.version + ")" : "");
+                            if (description != "")
+                                logger->stdout(
+                                    "  %s", hilite(description, descriptionMatch, ANSI_NORMAL));
                         }
                     }
                 }
 
-                else if (v->type == tAttrs) {
+                else if (
+                    attrPath.size() == 0
+                    || (attrPath[0] == "legacyPackages" && attrPath.size() <= 2)
+                    || (attrPath[0] == "packages" && attrPath.size() <= 2))
+                    recurse();
 
-                    if (!toplevel) {
-                        auto attrs = v->attrs;
-                        Bindings::iterator j = attrs->find(sRecurse);
-                        if (j == attrs->end() || !state->forceBool(*j->value, *j->pos)) {
-                            debug("skip attribute '%s'", attrPath);
-                            return;
-                        }
-                    }
-
-                    bool toplevel2 = false;
-                    if (!fromCache) {
-                        Bindings::iterator j = v->attrs->find(sToplevel);
-                        toplevel2 = j != v->attrs->end() && state->forceBool(*j->value, *j->pos);
-                    }
-
-                    for (auto & i : *v->attrs) {
-                        auto cache2 =
-                            cache ? std::make_unique<JSONObject>(cache->object(i.name)) : nullptr;
-                        doExpr(i.value,
-                            attrPath == "" ? (std::string) i.name : attrPath + "." + (std::string) i.name,
-                            toplevel2 || fromCache, cache2 ? cache2.get() : nullptr);
-                    }
+                else if (attrPath[0] == "legacyPackages" && attrPath.size() > 2) {
+                    auto attr = cursor.maybeGetAttr(state->sRecurseForDerivations);
+                    if (attr && attr->getBool())
+                        recurse();
                 }
 
-            } catch (AssertionError & e) {
-            } catch (Error & e) {
-                if (!toplevel) {
-                    e.addPrefix(fmt("While evaluating the attribute '%s':\n", attrPath));
+            } catch (EvalError & e) {
+                if (!(attrPath.size() > 0 && attrPath[0] == "legacyPackages"))
                     throw;
-                }
             }
         };
 
-        Path jsonCacheFileName = getCacheDir() + "/nix/package-search.json";
+        for (auto & [cursor, prefix] : installable->getCursor(*state, true))
+            visit(*cursor, parseAttrPath(*state, prefix));
 
-        if (useCache && pathExists(jsonCacheFileName)) {
-
-            warn("using cached results; pass '-u' to update the cache");
-
-            Value vRoot;
-            parseJSON(*state, readFile(jsonCacheFileName), vRoot);
-
-            fromCache = true;
-
-            doExpr(&vRoot, "", true, nullptr);
-        }
-
-        else {
-            createDirs(dirOf(jsonCacheFileName));
-
-            Path tmpFile = fmt("%s.tmp.%d", jsonCacheFileName, getpid());
-
-            std::ofstream jsonCacheFile;
-
-            try {
-                // iostream considered harmful
-                jsonCacheFile.exceptions(std::ofstream::failbit);
-                jsonCacheFile.open(tmpFile);
-
-                auto cache = writeCache ? std::make_unique<JSONObject>(jsonCacheFile, false) : nullptr;
-
-                doExpr(getSourceExpr(*state), "", true, cache.get());
-
-            } catch (std::exception &) {
-                /* Fun fact: catching std::ios::failure does not work
-                   due to C++11 ABI shenanigans.
-                   https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66145 */
-                if (!jsonCacheFile)
-                    throw Error("error writing to %s", tmpFile);
-                throw;
-            }
-
-            if (writeCache && rename(tmpFile.c_str(), jsonCacheFileName.c_str()) == -1)
-                throw SysError("cannot rename '%s' to '%s'", tmpFile, jsonCacheFileName);
-        }
-
-        if (!json && results.size() == 0)
+        if (!json && !results)
             throw Error("no results for the given search term(s)!");
-
-        RunPager pager;
-        for (auto el : results) std::cout << el.second << "\n";
-
     }
 };
 

src/nix/sigs.cc

@@ -105,7 +105,8 @@ struct CmdSignPaths : StorePathsCommand
             .shortName = 'k',
             .description = "file containing the secret signing key",
             .labels = {"file"},
-            .handler = {&secretKeyFile}
+            .handler = {&secretKeyFile},
+            .completer = completePath
         });
     }
 

src/nix/why-depends.cc

@@ -72,9 +72,9 @@ struct CmdWhyDepends : SourceExprCommand
 
     void run(ref<Store> store) override
     {
-        auto package = parseInstallable(*this, store, _package, false);
+        auto package = parseInstallable(store, _package);
         auto packagePath = toStorePath(store, Build, package);
-        auto dependency = parseInstallable(*this, store, _dependency, false);
+        auto dependency = parseInstallable(store, _dependency);
         auto dependencyPath = toStorePath(store, NoBuild, dependency);
         auto dependencyPathHash = storePathToHash(store->printStorePath(dependencyPath));
 

tests/fetchGit.sh

@@ -31,44 +31,44 @@ rev2=$(git -C $repo rev-parse HEAD)
 
 # Fetch a worktree
 unset _NIX_FORCE_HTTP
-path0=$(nix eval --raw "(builtins.fetchGit file://$TEST_ROOT/worktree).outPath")
+path0=$(nix eval --impure --raw --expr "(builtins.fetchGit file://$TEST_ROOT/worktree).outPath")
 export _NIX_FORCE_HTTP=1
 [[ $(tail -n 1 $path0/hello) = "hello" ]]
 
 # Fetch the default branch.
-path=$(nix eval --raw "(builtins.fetchGit file://$repo).outPath")
+path=$(nix eval --impure --raw --expr "(builtins.fetchGit file://$repo).outPath")
 [[ $(cat $path/hello) = world ]]
 
 # In pure eval mode, fetchGit without a revision should fail.
-[[ $(nix eval --raw "(builtins.readFile (fetchGit file://$repo + \"/hello\"))") = world ]]
-(! nix eval --pure-eval --raw "(builtins.readFile (fetchGit file://$repo + \"/hello\"))")
+[[ $(nix eval --impure --raw --expr "builtins.readFile (fetchGit file://$repo + \"/hello\")") = world ]]
+(! nix eval --raw --expr "builtins.readFile (fetchGit file://$repo + \"/hello\")")
 
 # Fetch using an explicit revision hash.
-path2=$(nix eval --raw "(builtins.fetchGit { url = file://$repo; rev = \"$rev2\"; }).outPath")
+path2=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$repo; rev = \"$rev2\"; }).outPath")
 [[ $path = $path2 ]]
 
 # In pure eval mode, fetchGit with a revision should succeed.
-[[ $(nix eval --pure-eval --raw "(builtins.readFile (fetchGit { url = file://$repo; rev = \"$rev2\"; } + \"/hello\"))") = world ]]
+[[ $(nix eval --raw --expr "builtins.readFile (fetchGit { url = file://$repo; rev = \"$rev2\"; } + \"/hello\")") = world ]]
 
 # Fetch again. This should be cached.
 mv $repo ${repo}-tmp
-path2=$(nix eval --raw "(builtins.fetchGit file://$repo).outPath")
+path2=$(nix eval --impure --raw --expr "(builtins.fetchGit file://$repo).outPath")
 [[ $path = $path2 ]]
 
-[[ $(nix eval "(builtins.fetchGit file://$repo).revCount") = 2 ]]
-[[ $(nix eval --raw "(builtins.fetchGit file://$repo).rev") = $rev2 ]]
+[[ $(nix eval --impure --expr "(builtins.fetchGit file://$repo).revCount") = 2 ]]
+[[ $(nix eval --impure --raw --expr "(builtins.fetchGit file://$repo).rev") = $rev2 ]]
 
 # Fetching with a explicit hash should succeed.
-path2=$(nix eval --tarball-ttl 0 --raw "(builtins.fetchGit { url = file://$repo; rev = \"$rev2\"; }).outPath")
+path2=$(nix eval --refresh --raw --expr "(builtins.fetchGit { url = file://$repo; rev = \"$rev2\"; }).outPath")
 [[ $path = $path2 ]]
 
-path2=$(nix eval --tarball-ttl 0 --raw "(builtins.fetchGit { url = file://$repo; rev = \"$rev1\"; }).outPath")
+path2=$(nix eval --refresh --raw --expr "(builtins.fetchGit { url = file://$repo; rev = \"$rev1\"; }).outPath")
 [[ $(cat $path2/hello) = utrecht ]]
 
 mv ${repo}-tmp $repo
 
 # Using a clean working tree should produce the same result.
-path2=$(nix eval --raw "(builtins.fetchGit $repo).outPath")
+path2=$(nix eval --impure --raw --expr "(builtins.fetchGit $repo).outPath")
 [[ $path = $path2 ]]
 
 # Using an unclean tree should yield the tracked but uncommitted changes.
@@ -80,26 +80,26 @@ git -C $repo add dir1/foo
 git -C $repo rm hello
 
 unset _NIX_FORCE_HTTP
-path2=$(nix eval --raw "(builtins.fetchGit $repo).outPath")
+path2=$(nix eval --impure --raw --expr "(builtins.fetchGit $repo).outPath")
 [ ! -e $path2/hello ]
 [ ! -e $path2/bar ]
 [ ! -e $path2/dir2/bar ]
 [ ! -e $path2/.git ]
 [[ $(cat $path2/dir1/foo) = foo ]]
 
-[[ $(nix eval --raw "(builtins.fetchGit $repo).rev") = 0000000000000000000000000000000000000000 ]]
+[[ $(nix eval --impure --raw --expr "(builtins.fetchGit $repo).rev") = 0000000000000000000000000000000000000000 ]]
 
 # ... unless we're using an explicit ref or rev.
-path3=$(nix eval --raw "(builtins.fetchGit { url = $repo; ref = \"master\"; }).outPath")
+path3=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = $repo; ref = \"master\"; }).outPath")
 [[ $path = $path3 ]]
 
-path3=$(nix eval --raw "(builtins.fetchGit { url = $repo; rev = \"$rev2\"; }).outPath")
+path3=$(nix eval --raw --expr "(builtins.fetchGit { url = $repo; rev = \"$rev2\"; }).outPath")
 [[ $path = $path3 ]]
 
 # Committing should not affect the store path.
 git -C $repo commit -m 'Bla3' -a
 
-path4=$(nix eval --tarball-ttl 0 --raw "(builtins.fetchGit file://$repo).outPath")
+path4=$(nix eval --impure --refresh --raw --expr "(builtins.fetchGit file://$repo).outPath")
 [[ $path2 = $path4 ]]
 
 # tarball-ttl should be ignored if we specify a rev
@@ -107,32 +107,32 @@ echo delft > $repo/hello
 git -C $repo add hello
 git -C $repo commit -m 'Bla4'
 rev3=$(git -C $repo rev-parse HEAD)
-nix eval --tarball-ttl 3600 "(builtins.fetchGit { url = $repo; rev = \"$rev3\"; })" >/dev/null
+nix eval --tarball-ttl 3600 --expr "builtins.fetchGit { url = $repo; rev = \"$rev3\"; }" >/dev/null
 
 # Update 'path' to reflect latest master
-path=$(nix eval --raw "(builtins.fetchGit file://$repo).outPath")
+path=$(nix eval --impure --raw --expr "(builtins.fetchGit file://$repo).outPath")
 
 # Check behavior when non-master branch is used
 git -C $repo checkout $rev2 -b dev
 echo dev > $repo/hello
 
 # File URI uses dirty tree unless specified otherwise
-path2=$(nix eval --raw "(builtins.fetchGit file://$repo).outPath")
+path2=$(nix eval --impure --raw --expr "(builtins.fetchGit file://$repo).outPath")
 [ $(cat $path2/hello) = dev ]
 
 # Using local path with branch other than 'master' should work when clean or dirty
-path3=$(nix eval --raw "(builtins.fetchGit $repo).outPath")
+path3=$(nix eval --impure --raw --expr "(builtins.fetchGit $repo).outPath")
 # (check dirty-tree handling was used)
-[[ $(nix eval --raw "(builtins.fetchGit $repo).rev") = 0000000000000000000000000000000000000000 ]]
+[[ $(nix eval --impure --raw --expr "(builtins.fetchGit $repo).rev") = 0000000000000000000000000000000000000000 ]]
 
 # Committing shouldn't change store path, or switch to using 'master'
 git -C $repo commit -m 'Bla5' -a
-path4=$(nix eval --raw "(builtins.fetchGit $repo).outPath")
+path4=$(nix eval --impure --raw --expr "(builtins.fetchGit $repo).outPath")
 [[ $(cat $path4/hello) = dev ]]
 [[ $path3 = $path4 ]]
 
 # Confirm same as 'dev' branch
-path5=$(nix eval --raw "(builtins.fetchGit { url = $repo; ref = \"dev\"; }).outPath")
+path5=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = $repo; ref = \"dev\"; }).outPath")
 [[ $path3 = $path5 ]]
 
 
@@ -141,19 +141,18 @@ rm -rf $TEST_HOME/.cache/nix
 
 # Try again, but without 'git' on PATH. This should fail.
 NIX=$(command -v nix)
-# This should fail
-(! PATH= $NIX eval --raw "(builtins.fetchGit { url = $repo; ref = \"dev\"; }).outPath" )
+(! PATH= $NIX eval --impure --raw --expr "(builtins.fetchGit { url = $repo; ref = \"dev\"; }).outPath" )
 
 # Try again, with 'git' available.  This should work.
-path5=$(nix eval --raw "(builtins.fetchGit { url = $repo; ref = \"dev\"; }).outPath")
+path5=$(nix eval --impure --raw --expr "(builtins.fetchGit { url = $repo; ref = \"dev\"; }).outPath")
 [[ $path3 = $path5 ]]
 
 # Fetching a shallow repo shouldn't work by default, because we can't
 # return a revCount.
 git clone --depth 1 file://$repo $TEST_ROOT/shallow
-(! nix eval --raw "(builtins.fetchGit { url = $TEST_ROOT/shallow; ref = \"dev\"; }).outPath")
+(! nix eval --impure --raw --expr "(builtins.fetchGit { url = $TEST_ROOT/shallow; ref = \"dev\"; }).outPath")
 
 # But you can request a shallow clone, which won't return a revCount.
-path6=$(nix eval --raw "(builtins.fetchTree { type = \"git\"; url = \"file://$TEST_ROOT/shallow\"; ref = \"dev\"; shallow = true; }).outPath")
+path6=$(nix eval --impure --raw --expr "(builtins.fetchTree { type = \"git\"; url = \"file://$TEST_ROOT/shallow\"; ref = \"dev\"; shallow = true; }).outPath")
 [[ $path3 = $path6 ]]
-[[ $(nix eval "(builtins.fetchTree { type = \"git\"; url = \"file://$TEST_ROOT/shallow\"; ref = \"dev\"; shallow = true; }).revCount or 123") == 123 ]]
+[[ $(nix eval --impure --expr "(builtins.fetchTree { type = \"git\"; url = \"file://$TEST_ROOT/shallow\"; ref = \"dev\"; shallow = true; }).revCount or 123") == 123 ]]

tests/fetchGitSubmodules.sh

@@ -38,18 +38,18 @@ git -C $rootRepo commit -m "Add submodule"
 
 rev=$(git -C $rootRepo rev-parse HEAD)
 
-r1=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; }).outPath")
-r2=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; submodules = false; }).outPath")
-r3=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; submodules = true; }).outPath")
+r1=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; }).outPath")
+r2=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; submodules = false; }).outPath")
+r3=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; submodules = true; }).outPath")
 
 [[ $r1 == $r2 ]]
 [[ $r2 != $r3 ]]
 
-r4=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; ref = \"master\"; rev = \"$rev\"; }).outPath")
-r5=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; ref = \"master\"; rev = \"$rev\"; submodules = false; }).outPath")
-r6=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; ref = \"master\"; rev = \"$rev\"; submodules = true; }).outPath")
-r7=$(nix eval --raw "(builtins.fetchGit { url = $rootRepo; ref = \"master\"; rev = \"$rev\"; submodules = true; }).outPath")
-r8=$(nix eval --raw "(builtins.fetchGit { url = $rootRepo; rev = \"$rev\"; submodules = true; }).outPath")
+r4=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; ref = \"master\"; rev = \"$rev\"; }).outPath")
+r5=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; ref = \"master\"; rev = \"$rev\"; submodules = false; }).outPath")
+r6=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; ref = \"master\"; rev = \"$rev\"; submodules = true; }).outPath")
+r7=$(nix eval --raw --expr "(builtins.fetchGit { url = $rootRepo; ref = \"master\"; rev = \"$rev\"; submodules = true; }).outPath")
+r8=$(nix eval --raw --expr "(builtins.fetchGit { url = $rootRepo; rev = \"$rev\"; submodules = true; }).outPath")
 
 [[ $r1 == $r4 ]]
 [[ $r4 == $r5 ]]
@@ -57,19 +57,19 @@ r8=$(nix eval --raw "(builtins.fetchGit { url = $rootRepo; rev = \"$rev\"; submo
 [[ $r6 == $r7 ]]
 [[ $r7 == $r8 ]]
 
-have_submodules=$(nix eval "(builtins.fetchGit { url = $rootRepo; rev = \"$rev\"; }).submodules")
+have_submodules=$(nix eval --expr "(builtins.fetchGit { url = $rootRepo; rev = \"$rev\"; }).submodules")
 [[ $have_submodules == false ]]
 
-have_submodules=$(nix eval "(builtins.fetchGit { url = $rootRepo; rev = \"$rev\"; submodules = false; }).submodules")
+have_submodules=$(nix eval --expr "(builtins.fetchGit { url = $rootRepo; rev = \"$rev\"; submodules = false; }).submodules")
 [[ $have_submodules == false ]]
 
-have_submodules=$(nix eval "(builtins.fetchGit { url = $rootRepo; rev = \"$rev\"; submodules = true; }).submodules")
+have_submodules=$(nix eval --expr "(builtins.fetchGit { url = $rootRepo; rev = \"$rev\"; submodules = true; }).submodules")
 [[ $have_submodules == true ]]
 
-pathWithoutSubmodules=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; }).outPath")
-pathWithSubmodules=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; submodules = true; }).outPath")
-pathWithSubmodulesAgain=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; submodules = true; }).outPath")
-pathWithSubmodulesAgainWithRef=$(nix eval --raw "(builtins.fetchGit { url = file://$rootRepo; ref = \"master\"; rev = \"$rev\"; submodules = true; }).outPath")
+pathWithoutSubmodules=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; }).outPath")
+pathWithSubmodules=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; submodules = true; }).outPath")
+pathWithSubmodulesAgain=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; rev = \"$rev\"; submodules = true; }).outPath")
+pathWithSubmodulesAgainWithRef=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$rootRepo; ref = \"master\"; rev = \"$rev\"; submodules = true; }).outPath")
 
 # The resulting store path cannot be the same.
 [[ $pathWithoutSubmodules != $pathWithSubmodules ]]
@@ -91,7 +91,7 @@ test "$(find "$pathWithSubmodules" -name .git)" = ""
 
 # Git repos without submodules can be fetched with submodules = true.
 subRev=$(git -C $subRepo rev-parse HEAD)
-noSubmoduleRepoBaseline=$(nix eval --raw "(builtins.fetchGit { url = file://$subRepo; rev = \"$subRev\"; }).outPath")
-noSubmoduleRepo=$(nix eval --raw "(builtins.fetchGit { url = file://$subRepo; rev = \"$subRev\"; submodules = true; }).outPath")
+noSubmoduleRepoBaseline=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$subRepo; rev = \"$subRev\"; }).outPath")
+noSubmoduleRepo=$(nix eval --raw --expr "(builtins.fetchGit { url = file://$subRepo; rev = \"$subRev\"; submodules = true; }).outPath")
 
 [[ $noSubmoduleRepoBaseline == $noSubmoduleRepo ]]

tests/fetchMercurial.sh

@@ -9,7 +9,7 @@ clearStore
 
 repo=$TEST_ROOT/hg
 
-rm -rf $repo ${repo}-tmp $TEST_HOME/.cache/nix/hg
+rm -rf $repo ${repo}-tmp $TEST_HOME/.cache/nix
 
 hg init $repo
 echo '[ui]' >> $repo/.hg/hgrc
@@ -26,43 +26,43 @@ hg commit --cwd $repo -m 'Bla2'
 rev2=$(hg log --cwd $repo -r tip --template '{node}')
 
 # Fetch the default branch.
-path=$(nix eval --raw "(builtins.fetchMercurial file://$repo).outPath")
+path=$(nix eval --impure --raw --expr "(builtins.fetchMercurial file://$repo).outPath")
 [[ $(cat $path/hello) = world ]]
 
 # In pure eval mode, fetchGit without a revision should fail.
-[[ $(nix eval --raw "(builtins.readFile (fetchMercurial file://$repo + \"/hello\"))") = world ]]
-(! nix eval --pure-eval --raw "(builtins.readFile (fetchMercurial file://$repo + \"/hello\"))")
+[[ $(nix eval --impure --raw --expr "(builtins.readFile (fetchMercurial file://$repo + \"/hello\"))") = world ]]
+(! nix eval --raw --expr "builtins.readFile (fetchMercurial file://$repo + \"/hello\")")
 
 # Fetch using an explicit revision hash.
-path2=$(nix eval --raw "(builtins.fetchMercurial { url = file://$repo; rev = \"$rev2\"; }).outPath")
+path2=$(nix eval --impure --raw --expr "(builtins.fetchMercurial { url = file://$repo; rev = \"$rev2\"; }).outPath")
 [[ $path = $path2 ]]
 
 # In pure eval mode, fetchGit with a revision should succeed.
-[[ $(nix eval --pure-eval --raw "(builtins.readFile (fetchMercurial { url = file://$repo; rev = \"$rev2\"; } + \"/hello\"))") = world ]]
+[[ $(nix eval --raw --expr "builtins.readFile (fetchMercurial { url = file://$repo; rev = \"$rev2\"; } + \"/hello\")") = world ]]
 
 # Fetch again. This should be cached.
 mv $repo ${repo}-tmp
-path2=$(nix eval --raw "(builtins.fetchMercurial file://$repo).outPath")
+path2=$(nix eval --impure --raw --expr "(builtins.fetchMercurial file://$repo).outPath")
 [[ $path = $path2 ]]
 
-[[ $(nix eval --raw "(builtins.fetchMercurial file://$repo).branch") = default ]]
-[[ $(nix eval "(builtins.fetchMercurial file://$repo).revCount") = 1 ]]
-[[ $(nix eval --raw "(builtins.fetchMercurial file://$repo).rev") = $rev2 ]]
+[[ $(nix eval --impure --raw --expr "(builtins.fetchMercurial file://$repo).branch") = default ]]
+[[ $(nix eval --impure --expr "(builtins.fetchMercurial file://$repo).revCount") = 1 ]]
+[[ $(nix eval --impure --raw --expr "(builtins.fetchMercurial file://$repo).rev") = $rev2 ]]
 
 # But with TTL 0, it should fail.
-(! nix eval --tarball-ttl 0 "(builtins.fetchMercurial file://$repo)")
+(! nix eval --impure --refresh --expr "builtins.fetchMercurial file://$repo")
 
 # Fetching with a explicit hash should succeed.
-path2=$(nix eval --tarball-ttl 0 --raw "(builtins.fetchMercurial { url = file://$repo; rev = \"$rev2\"; }).outPath")
+path2=$(nix eval --refresh --raw --expr "(builtins.fetchMercurial { url = file://$repo; rev = \"$rev2\"; }).outPath")
 [[ $path = $path2 ]]
 
-path2=$(nix eval --tarball-ttl 0 --raw "(builtins.fetchMercurial { url = file://$repo; rev = \"$rev1\"; }).outPath")
+path2=$(nix eval --refresh --raw --expr "(builtins.fetchMercurial { url = file://$repo; rev = \"$rev1\"; }).outPath")
 [[ $(cat $path2/hello) = utrecht ]]
 
 mv ${repo}-tmp $repo
 
 # Using a clean working tree should produce the same result.
-path2=$(nix eval --raw "(builtins.fetchMercurial $repo).outPath")
+path2=$(nix eval --impure --raw --expr "(builtins.fetchMercurial $repo).outPath")
 [[ $path = $path2 ]]
 
 # Using an unclean tree should yield the tracked but uncommitted changes.
@@ -73,21 +73,21 @@ echo bar > $repo/dir2/bar
 hg add --cwd $repo dir1/foo
 hg rm --cwd $repo hello
 
-path2=$(nix eval --raw "(builtins.fetchMercurial $repo).outPath")
+path2=$(nix eval --impure --raw --expr "(builtins.fetchMercurial $repo).outPath")
 [ ! -e $path2/hello ]
 [ ! -e $path2/bar ]
 [ ! -e $path2/dir2/bar ]
 [ ! -e $path2/.hg ]
 [[ $(cat $path2/dir1/foo) = foo ]]
 
-[[ $(nix eval --raw "(builtins.fetchMercurial $repo).rev") = 0000000000000000000000000000000000000000 ]]
+[[ $(nix eval --impure --raw --expr "(builtins.fetchMercurial $repo).rev") = 0000000000000000000000000000000000000000 ]]
 
-# ... unless we're using an explicit rev.
-path3=$(nix eval --raw "(builtins.fetchMercurial { url = $repo; rev = \"default\"; }).outPath")
+# ... unless we're using an explicit ref.
+path3=$(nix eval --impure --raw --expr "(builtins.fetchMercurial { url = $repo; rev = \"default\"; }).outPath")
 [[ $path = $path3 ]]
 
 # Committing should not affect the store path.
 hg commit --cwd $repo -m 'Bla3'
 
-path4=$(nix eval --tarball-ttl 0 --raw "(builtins.fetchMercurial file://$repo).outPath")
+path4=$(nix eval --impure --refresh --raw --expr "(builtins.fetchMercurial file://$repo).outPath")
 [[ $path2 = $path4 ]]

tests/flakes.sh

@@ -0,0 +1,663 @@
+source common.sh
+
+if [[ -z $(type -p git) ]]; then
+    echo "Git not installed; skipping flake tests"
+    exit 99
+fi
+
+if [[ -z $(type -p hg) ]]; then
+    echo "Mercurial not installed; skipping flake tests"
+    exit 99
+fi
+
+clearStore
+rm -rf $TEST_HOME/.cache $TEST_HOME/.config
+
+registry=$TEST_ROOT/registry.json
+
+flake1Dir=$TEST_ROOT/flake1
+flake2Dir=$TEST_ROOT/flake2
+flake3Dir=$TEST_ROOT/flake3
+flake4Dir=$TEST_ROOT/flake4
+flake5Dir=$TEST_ROOT/flake5
+flake7Dir=$TEST_ROOT/flake7
+nonFlakeDir=$TEST_ROOT/nonFlake
+flakeA=$TEST_ROOT/flakeA
+flakeB=$TEST_ROOT/flakeB
+
+for repo in $flake1Dir $flake2Dir $flake3Dir $flake7Dir $nonFlakeDir $flakeA $flakeB; do
+    rm -rf $repo $repo.tmp
+    mkdir $repo
+    git -C $repo init
+    git -C $repo config user.email "foobar@example.com"
+    git -C $repo config user.name "Foobar"
+done
+
+cat > $flake1Dir/flake.nix <<EOF
+{
+  description = "Bla bla";
+
+  outputs = inputs: rec {
+    packages.$system.foo = import ./simple.nix;
+    defaultPackage.$system = packages.$system.foo;
+
+    # To test "nix flake init".
+    legacyPackages.x86_64-linux.hello = import ./simple.nix;
+  };
+}
+EOF
+
+cp ./simple.nix ./simple.builder.sh ./config.nix $flake1Dir/
+git -C $flake1Dir add flake.nix simple.nix simple.builder.sh config.nix
+git -C $flake1Dir commit -m 'Initial'
+
+cat > $flake2Dir/flake.nix <<EOF
+{
+  description = "Fnord";
+
+  outputs = { self, flake1 }: rec {
+    packages.$system.bar = flake1.packages.$system.foo;
+  };
+}
+EOF
+
+git -C $flake2Dir add flake.nix
+git -C $flake2Dir commit -m 'Initial'
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  description = "Fnord";
+
+  outputs = { self, flake2 }: rec {
+    packages.$system.xyzzy = flake2.packages.$system.bar;
+
+    checks = {
+      xyzzy = packages.$system.xyzzy;
+    };
+  };
+}
+EOF
+
+git -C $flake3Dir add flake.nix
+git -C $flake3Dir commit -m 'Initial'
+
+cat > $nonFlakeDir/README.md <<EOF
+FNORD
+EOF
+
+git -C $nonFlakeDir add README.md
+git -C $nonFlakeDir commit -m 'Initial'
+
+cat > $registry <<EOF
+{
+  "version": 2,
+  "flakes": [
+    { "from": {
+        "type": "indirect",
+        "id": "flake1"
+      },
+      "to": {
+        "type": "git",
+        "url": "file://$flake1Dir"
+      }
+    },
+    { "from": {
+        "type": "indirect",
+        "id": "flake2"
+      },
+      "to": {
+        "type": "git",
+        "url": "file://$flake2Dir"
+      }
+    },
+    { "from": {
+        "type": "indirect",
+        "id": "flake3"
+      },
+      "to": {
+        "type": "git",
+        "url": "file://$flake3Dir"
+      }
+    },
+    { "from": {
+        "type": "indirect",
+        "id": "flake4"
+      },
+      "to": {
+        "type": "indirect",
+        "id": "flake3"
+      }
+    },
+    { "from": {
+        "type": "indirect",
+        "id": "flake5"
+      },
+      "to": {
+        "type": "hg",
+        "url": "file://$flake5Dir"
+      }
+    },
+    { "from": {
+        "type": "indirect",
+        "id": "nixpkgs"
+      },
+      "to": {
+        "type": "indirect",
+        "id": "flake1"
+      }
+    }
+  ]
+}
+EOF
+
+# Test 'nix flake list'.
+[[ $(nix flake list | wc -l) == 6 ]]
+
+# Test 'nix flake info'.
+nix flake info flake1 | grep -q 'URL: .*flake1.*'
+
+# Test 'nix flake info' on a local flake.
+(cd $flake1Dir && nix flake info) | grep -q 'URL: .*flake1.*'
+(cd $flake1Dir && nix flake info .) | grep -q 'URL: .*flake1.*'
+nix flake info $flake1Dir | grep -q 'URL: .*flake1.*'
+
+# Test 'nix flake info --json'.
+json=$(nix flake info flake1 --json | jq .)
+[[ $(echo "$json" | jq -r .description) = 'Bla bla' ]]
+[[ -d $(echo "$json" | jq -r .path) ]]
+[[ $(echo "$json" | jq -r .lastModified) = $(git -C $flake1Dir log -n1 --format=%ct) ]]
+hash1=$(echo "$json" | jq -r .revision)
+
+echo -n '# foo' >> $flake1Dir/flake.nix
+git -C $flake1Dir commit -a -m 'Foo'
+hash2=$(nix flake info flake1 --json --refresh | jq -r .revision)
+[[ $hash1 != $hash2 ]]
+
+# Test 'nix build' on a flake.
+nix build -o $TEST_ROOT/result flake1#foo
+[[ -e $TEST_ROOT/result/hello ]]
+
+# Test defaultPackage.
+nix build -o $TEST_ROOT/result flake1
+[[ -e $TEST_ROOT/result/hello ]]
+
+nix build -o $TEST_ROOT/result $flake1Dir
+nix build -o $TEST_ROOT/result git+file://$flake1Dir
+
+# Check that store symlinks inside a flake are not interpreted as flakes.
+nix build -o $flake1Dir/result git+file://$flake1Dir
+nix path-info $flake1Dir/result
+
+# 'getFlake' on a mutable flakeref should fail in pure mode, but succeed in impure mode.
+(! nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"$flake1Dir\").defaultPackage.$system")
+nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"$flake1Dir\").defaultPackage.$system" --impure
+
+# 'getFlake' on an immutable flakeref should succeed even in pure mode.
+nix build -o $TEST_ROOT/result --expr "(builtins.getFlake \"git+file://$flake1Dir?rev=$hash2\").defaultPackage.$system"
+
+# Building a flake with an unlocked dependency should fail in pure mode.
+(! nix build -o $TEST_ROOT/result flake2#bar --no-registries)
+(! nix eval --expr "builtins.getFlake \"$flake2Dir\"")
+
+# But should succeed in impure mode.
+(! nix build -o $TEST_ROOT/result flake2#bar --impure)
+nix build -o $TEST_ROOT/result flake2#bar --impure --no-write-lock-file
+
+# Building a local flake with an unlocked dependency should fail with --no-update-lock-file.
+nix build -o $TEST_ROOT/result $flake2Dir#bar --no-update-lock-file 2>&1 | grep 'requires lock file changes'
+
+# But it should succeed without that flag.
+nix build -o $TEST_ROOT/result $flake2Dir#bar --no-write-lock-file
+nix build -o $TEST_ROOT/result $flake2Dir#bar --no-update-lock-file 2>&1 | grep 'requires lock file changes'
+nix build -o $TEST_ROOT/result $flake2Dir#bar --commit-lock-file
+[[ -e $flake2Dir/flake.lock ]]
+[[ -z $(git -C $flake2Dir diff master) ]]
+
+# Rerunning the build should not change the lockfile.
+nix build -o $TEST_ROOT/result $flake2Dir#bar
+[[ -z $(git -C $flake2Dir diff master) ]]
+
+# Building with a lockfile should not require a fetch of the registry.
+nix build -o $TEST_ROOT/result --flake-registry file:///no-registry.json $flake2Dir#bar --refresh
+nix build -o $TEST_ROOT/result --no-registries $flake2Dir#bar --refresh
+
+# Updating the flake should not change the lockfile.
+nix flake update $flake2Dir
+[[ -z $(git -C $flake2Dir diff master) ]]
+
+# Now we should be able to build the flake in pure mode.
+nix build -o $TEST_ROOT/result flake2#bar
+
+# Or without a registry.
+nix build -o $TEST_ROOT/result --no-registries git+file://$flake2Dir#bar --refresh
+
+# Test whether indirect dependencies work.
+nix build -o $TEST_ROOT/result $flake3Dir#xyzzy
+git -C $flake3Dir add flake.lock
+
+# Add dependency to flake3.
+rm $flake3Dir/flake.nix
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  description = "Fnord";
+
+  outputs = { self, flake1, flake2 }: rec {
+    packages.$system.xyzzy = flake2.packages.$system.bar;
+    packages.$system."sth sth" = flake1.packages.$system.foo;
+  };
+}
+EOF
+
+git -C $flake3Dir add flake.nix
+git -C $flake3Dir commit -m 'Update flake.nix'
+
+# Check whether `nix build` works with an incomplete lockfile
+nix build -o $TEST_ROOT/result $flake3Dir#"sth sth"
+nix build -o $TEST_ROOT/result $flake3Dir#"sth%20sth"
+
+# Check whether it saved the lockfile
+(! [[ -z $(git -C $flake3Dir diff master) ]])
+
+git -C $flake3Dir add flake.lock
+
+git -C $flake3Dir commit -m 'Add lockfile'
+
+# Test whether registry caching works.
+nix flake list --flake-registry file://$registry | grep -q flake3
+mv $registry $registry.tmp
+nix-store --gc
+nix flake list --flake-registry file://$registry --refresh | grep -q flake3
+mv $registry.tmp $registry
+
+# Test whether flakes are registered as GC roots for offline use.
+# FIXME: use tarballs rather than git.
+rm -rf $TEST_HOME/.cache
+nix-store --gc # get rid of copies in the store to ensure they get fetched to our git cache
+_NIX_FORCE_HTTP=1 nix build -o $TEST_ROOT/result git+file://$flake2Dir#bar
+mv $flake1Dir $flake1Dir.tmp
+mv $flake2Dir $flake2Dir.tmp
+nix-store --gc
+_NIX_FORCE_HTTP=1 nix build -o $TEST_ROOT/result git+file://$flake2Dir#bar
+_NIX_FORCE_HTTP=1 nix build -o $TEST_ROOT/result git+file://$flake2Dir#bar --refresh
+mv $flake1Dir.tmp $flake1Dir
+mv $flake2Dir.tmp $flake2Dir
+
+# Add nonFlakeInputs to flake3.
+rm $flake3Dir/flake.nix
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  inputs = {
+    flake1 = {};
+    flake2 = {};
+    nonFlake = {
+      url = git+file://$nonFlakeDir;
+      flake = false;
+    };
+  };
+
+  description = "Fnord";
+
+  outputs = inputs: rec {
+    packages.$system.xyzzy = inputs.flake2.packages.$system.bar;
+    packages.$system.sth = inputs.flake1.packages.$system.foo;
+    packages.$system.fnord =
+      with import ./config.nix;
+      mkDerivation {
+        inherit system;
+        name = "fnord";
+        buildCommand = ''
+          cat \${inputs.nonFlake}/README.md > \$out
+        '';
+      };
+  };
+}
+EOF
+
+cp ./config.nix $flake3Dir
+
+git -C $flake3Dir add flake.nix config.nix
+git -C $flake3Dir commit -m 'Add nonFlakeInputs'
+
+# Check whether `nix build` works with a lockfile which is missing a
+# nonFlakeInputs.
+nix build -o $TEST_ROOT/result $flake3Dir#sth --commit-lock-file
+
+nix build -o $TEST_ROOT/result flake3#fnord
+[[ $(cat $TEST_ROOT/result) = FNORD ]]
+
+# Check whether flake input fetching is lazy: flake3#sth does not
+# depend on flake2, so this shouldn't fail.
+rm -rf $TEST_HOME/.cache
+clearStore
+mv $flake2Dir $flake2Dir.tmp
+mv $nonFlakeDir $nonFlakeDir.tmp
+nix build -o $TEST_ROOT/result flake3#sth
+(! nix build -o $TEST_ROOT/result flake3#xyzzy)
+(! nix build -o $TEST_ROOT/result flake3#fnord)
+mv $flake2Dir.tmp $flake2Dir
+mv $nonFlakeDir.tmp $nonFlakeDir
+nix build -o $TEST_ROOT/result flake3#xyzzy flake3#fnord
+
+# Test doing multiple `lookupFlake`s
+nix build -o $TEST_ROOT/result flake4#xyzzy
+
+# Test 'nix flake update' and --override-flake.
+nix flake update $flake3Dir
+[[ -z $(git -C $flake3Dir diff master) ]]
+
+nix flake update $flake3Dir --recreate-lock-file --override-flake flake2 nixpkgs
+[[ ! -z $(git -C $flake3Dir diff master) ]]
+
+# Make branch "removeXyzzy" where flake3 doesn't have xyzzy anymore
+git -C $flake3Dir checkout -b removeXyzzy
+rm $flake3Dir/flake.nix
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  inputs = {
+    nonFlake = {
+      url = "$nonFlakeDir";
+      flake = false;
+    };
+  };
+
+  description = "Fnord";
+
+  outputs = { self, flake1, flake2, nonFlake }: rec {
+    packages.$system.sth = flake1.packages.$system.foo;
+    packages.$system.fnord =
+      with import ./config.nix;
+      mkDerivation {
+        inherit system;
+        name = "fnord";
+        buildCommand = ''
+          cat \${nonFlake}/README.md > \$out
+        '';
+      };
+  };
+}
+EOF
+git -C $flake3Dir add flake.nix
+git -C $flake3Dir commit -m 'Remove packages.xyzzy'
+git -C $flake3Dir checkout master
+
+# Test whether fuzzy-matching works for IsAlias
+(! nix build -o $TEST_ROOT/result flake4/removeXyzzy#xyzzy)
+
+# Test whether fuzzy-matching works for IsGit
+(! nix build -o $TEST_ROOT/result flake4/removeXyzzy#xyzzy)
+nix build -o $TEST_ROOT/result flake4/removeXyzzy#sth
+
+# Testing the nix CLI
+nix flake add flake1 flake3
+[[ $(nix flake list | wc -l) == 7 ]]
+nix flake pin flake1
+[[ $(nix flake list | wc -l) == 7 ]]
+nix flake remove flake1
+[[ $(nix flake list | wc -l) == 6 ]]
+
+# Test 'nix flake init'.
+(cd $flake7Dir && nix flake init)
+git -C $flake7Dir add flake.nix
+nix flake check $flake7Dir
+git -C $flake7Dir commit -a -m 'Initial'
+
+# Test 'nix flake clone'.
+rm -rf $TEST_ROOT/flake1-v2
+nix flake clone flake1 --dest $TEST_ROOT/flake1-v2
+[ -e $TEST_ROOT/flake1-v2/flake.nix ]
+
+# More 'nix flake check' tests.
+cat > $flake3Dir/flake.nix <<EOF
+{
+  outputs = { flake1, self }: {
+    overlay = final: prev: {
+    };
+  };
+}
+EOF
+
+nix flake check $flake3Dir
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  outputs = { flake1, self }: {
+    overlay = finalll: prev: {
+    };
+  };
+}
+EOF
+
+(! nix flake check $flake3Dir)
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  outputs = { flake1, self }: {
+    nixosModules.foo = {
+      a.b.c = 123;
+      foo = true;
+    };
+  };
+}
+EOF
+
+nix flake check $flake3Dir
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  outputs = { flake1, self }: {
+    nixosModules.foo = {
+      a.b.c = 123;
+      foo = assert false; true;
+    };
+  };
+}
+EOF
+
+(! nix flake check $flake3Dir)
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  outputs = { flake1, self }: {
+    nixosModule = { config, pkgs, ... }: {
+      a.b.c = 123;
+    };
+  };
+}
+EOF
+
+nix flake check $flake3Dir
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  outputs = { flake1, self }: {
+    nixosModule = { config, pkgs }: {
+      a.b.c = 123;
+    };
+  };
+}
+EOF
+
+(! nix flake check $flake3Dir)
+
+# Test 'follows' inputs.
+cat > $flake3Dir/flake.nix <<EOF
+{
+  inputs.foo = {
+    type = "indirect";
+    id = "flake1";
+  };
+  inputs.bar.follows = "foo";
+
+  outputs = { self, foo, bar }: {
+  };
+}
+EOF
+
+nix flake update $flake3Dir
+[[ $(jq .nodes.root.inputs.foo $flake3Dir/flake.lock) = $(jq .nodes.root.inputs.bar $flake3Dir/flake.lock) ]]
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  inputs.bar.follows = "flake2/flake1";
+
+  outputs = { self, flake2, bar }: {
+  };
+}
+EOF
+
+nix flake update $flake3Dir
+[[ $(jq .nodes.bar.locked.url $flake3Dir/flake.lock) =~ flake1 ]]
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  inputs.bar.follows = "flake2";
+
+  outputs = { self, flake2, bar }: {
+  };
+}
+EOF
+
+nix flake update $flake3Dir
+[[ $(jq .nodes.bar.locked.url $flake3Dir/flake.lock) =~ flake2 ]]
+
+# Test overriding inputs of inputs.
+cat > $flake3Dir/flake.nix <<EOF
+{
+  inputs.flake2.inputs.flake1 = {
+    type = "git";
+    url = file://$flake7Dir;
+  };
+
+  outputs = { self, flake2 }: {
+  };
+}
+EOF
+
+nix flake update $flake3Dir
+[[ $(jq .nodes.flake1.locked.url $flake3Dir/flake.lock) =~ flake7 ]]
+
+cat > $flake3Dir/flake.nix <<EOF
+{
+  inputs.flake2.inputs.flake1.follows = "foo";
+  inputs.foo.url = git+file://$flake7Dir;
+
+  outputs = { self, flake2 }: {
+  };
+}
+EOF
+
+nix flake update $flake3Dir --recreate-lock-file
+[[ $(jq .nodes.flake1.locked.url $flake3Dir/flake.lock) =~ flake7 ]]
+
+# Test Mercurial flakes.
+rm -rf $flake5Dir
+hg init $flake5Dir
+
+cat > $flake5Dir/flake.nix <<EOF
+{
+  outputs = { self, flake1 }: {
+    defaultPackage.$system = flake1.defaultPackage.$system;
+
+    expr = assert builtins.pathExists ./flake.lock; 123;
+  };
+}
+EOF
+
+hg add $flake5Dir/flake.nix
+hg commit --config ui.username=foobar@example.org $flake5Dir -m 'Initial commit'
+
+nix build -o $TEST_ROOT/result hg+file://$flake5Dir
+[[ -e $TEST_ROOT/result/hello ]]
+
+(! nix flake info --json hg+file://$flake5Dir | jq -e -r .revision)
+
+nix eval hg+file://$flake5Dir#expr
+
+nix eval hg+file://$flake5Dir#expr
+
+(! nix eval hg+file://$flake5Dir#expr --no-allow-dirty)
+
+(! nix flake info --json hg+file://$flake5Dir | jq -e -r .revision)
+
+hg commit --config ui.username=foobar@example.org $flake5Dir -m 'Add lock file'
+
+nix flake info --json hg+file://$flake5Dir --refresh | jq -e -r .revision
+nix flake info --json hg+file://$flake5Dir
+[[ $(nix flake info --json hg+file://$flake5Dir | jq -e -r .revCount) = 1 ]]
+
+nix build -o $TEST_ROOT/result hg+file://$flake5Dir --no-registries --no-allow-dirty
+
+# Test tarball flakes
+tar cfz $TEST_ROOT/flake.tar.gz -C $TEST_ROOT --exclude .hg flake5
+
+nix build -o $TEST_ROOT/result file://$TEST_ROOT/flake.tar.gz
+
+# Building with a tarball URL containing a SRI hash should also work.
+url=$(nix flake info --json file://$TEST_ROOT/flake.tar.gz | jq -r .url)
+[[ $url =~ sha256- ]]
+
+nix build -o $TEST_ROOT/result $url
+
+# Building with an incorrect SRI hash should fail.
+nix build -o $TEST_ROOT/result "file://$TEST_ROOT/flake.tar.gz?narHash=sha256-qQ2Zz4DNHViCUrp6gTS7EE4+RMqFQtUfWF2UNUtJKS0=" 2>&1 | grep 'NAR hash mismatch'
+
+# Test --override-input.
+git -C $flake3Dir reset --hard
+nix flake update $flake3Dir --override-input flake2/flake1 flake5 -vvvvv
+[[ $(jq .nodes.flake1_2.locked.url $flake3Dir/flake.lock) =~ flake5 ]]
+
+nix flake update $flake3Dir --override-input flake2/flake1 flake1
+[[ $(jq -r .nodes.flake1_2.locked.rev $flake3Dir/flake.lock) =~ $hash2 ]]
+
+nix flake update $flake3Dir --override-input flake2/flake1 flake1/master/$hash1
+[[ $(jq -r .nodes.flake1_2.locked.rev $flake3Dir/flake.lock) =~ $hash1 ]]
+
+# Test --update-input.
+nix flake update $flake3Dir
+[[ $(jq -r .nodes.flake1_2.locked.rev $flake3Dir/flake.lock) = $hash1 ]]
+
+nix flake update $flake3Dir --update-input flake2/flake1
+[[ $(jq -r .nodes.flake1_2.locked.rev $flake3Dir/flake.lock) =~ $hash2 ]]
+
+# Test 'nix flake list-inputs'.
+[[ $(nix flake list-inputs $flake3Dir | wc -l) == 5 ]]
+nix flake list-inputs $flake3Dir --json | jq .
+
+# Test circular flake dependencies.
+cat > $flakeA/flake.nix <<EOF
+{
+  inputs.b.url = git+file://$flakeB;
+  inputs.b.inputs.a.follows = "/";
+
+  outputs = { self, nixpkgs, b }: {
+    foo = 123 + b.bar;
+    xyzzy = 1000;
+  };
+}
+EOF
+
+git -C $flakeA add flake.nix
+
+cat > $flakeB/flake.nix <<EOF
+{
+  inputs.a.url = git+file://$flakeA;
+
+  outputs = { self, nixpkgs, a }: {
+    bar = 456 + a.xyzzy;
+  };
+}
+EOF
+
+git -C $flakeB add flake.nix
+git -C $flakeB commit -a -m 'Foo'
+
+[[ $(nix eval $flakeA#foo) = 1579 ]]
+[[ $(nix eval $flakeA#foo) = 1579 ]]
+
+sed -i $flakeB/flake.nix -e 's/456/789/'
+git -C $flakeB commit -a -m 'Foo'
+
+[[ $(nix eval --update-input b $flakeA#foo) = 1912 ]]

tests/gc-auto.sh

@@ -57,11 +57,11 @@ with import ./config.nix; mkDerivation {
 EOF
 )
 
-nix build -v -o $TEST_ROOT/result-A -L "($expr)" \
+nix build --impure -v -o $TEST_ROOT/result-A -L --expr "$expr" \
     --min-free 1000 --max-free 2000 --min-free-check-interval 1 &
 pid=$!
 
-nix build -v -o $TEST_ROOT/result-B -L "($expr2)" \
+nix build --impure -v -o $TEST_ROOT/result-B -L --expr "$expr2" \
     --min-free 1000 --max-free 2000 --min-free-check-interval 1
 
 wait "$pid"

tests/github-flakes.nix

@@ -0,0 +1,140 @@
+{ nixpkgs, system, overlay }:
+
+with import (nixpkgs + "/nixos/lib/testing.nix") {
+  inherit system;
+  extraConfigurations = [ { nixpkgs.overlays = [ overlay ]; } ];
+};
+
+let
+
+  # Generate a fake root CA and a fake github.com certificate.
+  cert = pkgs.runCommand "cert" { buildInputs = [ pkgs.openssl ]; }
+    ''
+      mkdir -p $out
+
+      openssl genrsa -out ca.key 2048
+      openssl req -new -x509 -days 36500 -key ca.key \
+        -subj "/C=NL/ST=Denial/L=Springfield/O=Dis/CN=Root CA" -out $out/ca.crt
+
+      openssl req -newkey rsa:2048 -nodes -keyout $out/server.key \
+        -subj "/C=CN/ST=Denial/L=Springfield/O=Dis/CN=github.com" -out server.csr
+      openssl x509 -req -extfile <(printf "subjectAltName=DNS:api.github.com,DNS:github.com,DNS:raw.githubusercontent.com") \
+        -days 36500 -in server.csr -CA $out/ca.crt -CAkey ca.key -CAcreateserial -out $out/server.crt
+    '';
+
+  registry = pkgs.writeTextFile {
+    name = "registry";
+    text = ''
+      {
+        "flakes": {
+          "flake:nixpkgs": {
+            "uri": "github:NixOS/nixpkgs"
+          }
+        },
+        "version": 1
+      }
+    '';
+    destination = "/flake-registry.json";
+  };
+
+  api = pkgs.runCommand "nixpkgs-flake" {}
+    ''
+      mkdir -p $out/tarball
+
+      dir=NixOS-nixpkgs-${nixpkgs.shortRev}
+      cp -prd ${nixpkgs} $dir
+      # Set the correct timestamp in the tarball.
+      find $dir -print0 | xargs -0 touch -t ${builtins.substring 0 12 nixpkgs.lastModifiedDate}.${builtins.substring 12 2 nixpkgs.lastModifiedDate} --
+      tar cfz $out/tarball/${nixpkgs.rev} $dir --hard-dereference
+
+      mkdir -p $out/commits
+      echo '{"sha": "${nixpkgs.rev}"}' > $out/commits/master
+    '';
+
+in
+
+makeTest (
+
+{
+
+  nodes =
+    { # Impersonate github.com and api.github.com.
+      github =
+        { config, pkgs, ... }:
+        { networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+          services.httpd.enable = true;
+          services.httpd.adminAddr = "foo@example.org";
+          services.httpd.extraConfig = ''
+            ErrorLog syslog:local6
+          '';
+          services.httpd.virtualHosts."github.com" =
+            { forceSSL = true;
+              sslServerKey = "${cert}/server.key";
+              sslServerCert = "${cert}/server.crt";
+              servedDirs =
+                [ { urlPath = "/NixOS/flake-registry/raw/master";
+                    dir = registry;
+                  }
+                ];
+            };
+          services.httpd.virtualHosts."api.github.com" =
+            { forceSSL = true;
+              sslServerKey = "${cert}/server.key";
+              sslServerCert = "${cert}/server.crt";
+              servedDirs =
+                [ { urlPath = "/repos/NixOS/nixpkgs";
+                    dir = api;
+                  }
+                ];
+            };
+        };
+
+      client =
+        { config, lib, pkgs, nodes, ... }:
+        { virtualisation.writableStore = true;
+          virtualisation.diskSize = 2048;
+          virtualisation.pathsInNixDB = [ pkgs.hello pkgs.fuse ];
+          virtualisation.memorySize = 4096;
+          nix.binaryCaches = lib.mkForce [ ];
+          nix.extraOptions = "experimental-features = nix-command flakes";
+          environment.systemPackages = [ pkgs.jq ];
+          networking.hosts.${(builtins.head nodes.github.config.networking.interfaces.eth1.ipv4.addresses).address} =
+            [ "github.com" "api.github.com" "raw.githubusercontent.com" ];
+          security.pki.certificateFiles = [ "${cert}/ca.crt" ];
+        };
+    };
+
+  testScript = { nodes }:
+    ''
+      use POSIX qw(strftime);
+
+      startAll;
+
+      $github->waitForUnit("httpd.service");
+
+      $client->succeed("curl -v https://github.com/ >&2");
+
+      $client->succeed("nix flake list | grep nixpkgs");
+
+      $client->succeed("nix flake info nixpkgs --json | jq -r .revision") eq "${nixpkgs.rev}\n"
+        or die "revision mismatch";
+
+      $client->succeed("nix flake pin nixpkgs");
+
+      $client->succeed("nix flake info nixpkgs --tarball-ttl 0 >&2");
+
+      # Shut down the web server. The flake should be cached on the client.
+      $github->succeed("systemctl stop httpd.service");
+
+      my $date = $client->succeed("nix flake info nixpkgs --json | jq -M .lastModified");
+      strftime("%Y%m%d%H%M%S", gmtime($date)) eq "${nixpkgs.lastModifiedDate}" or die "time mismatch";
+
+      $client->succeed("nix build nixpkgs#hello");
+
+      # The build shouldn't fail even with --tarball-ttl 0 (the server
+      # being down should not be a fatal error).
+      $client->succeed("nix build nixpkgs#fuse --tarball-ttl 0");
+    '';
+
+})

tests/init.sh

@@ -18,6 +18,7 @@ build-users-group =
 keep-derivations = false
 sandbox = false
 experimental-features = nix-command flakes
+flake-registry = $TEST_ROOT/registry.json
 include nix.conf.extra
 EOF
 

tests/local.mk

@@ -30,13 +30,14 @@ nix_tests = \
   nix-copy-ssh.sh \
   post-hook.sh \
   function-trace.sh \
-  recursive.sh
+  recursive.sh \
+  flakes.sh
   # parallel.sh
 
 install-tests += $(foreach x, $(nix_tests), tests/$(x))
 
 tests-environment = NIX_REMOTE= $(bash) -e
 
-clean-files += $(d)/common.sh
+clean-files += $(d)/common.sh $(d)/config.nix
 
 installcheck: $(d)/common.sh $(d)/config.nix $(d)/plugins/libplugintest.$(SO_EXT)

tests/nix-copy-closure.nix

@@ -1,8 +1,11 @@
 # Test ‘nix-copy-closure’.
 
-{ nixpkgs, system, nix }:
+{ nixpkgs, system, overlay }:
 
-with import (nixpkgs + "/nixos/lib/testing.nix") { inherit system; };
+with import (nixpkgs + "/nixos/lib/testing.nix") {
+  inherit system;
+  extraConfigurations = [ { nixpkgs.overlays = [ overlay ]; } ];
+};
 
 makeTest (let pkgA = pkgs.cowsay; pkgB = pkgs.wget; pkgC = pkgs.hello; in {
 
@@ -11,7 +14,6 @@ makeTest (let pkgA = pkgs.cowsay; pkgB = pkgs.wget; pkgC = pkgs.hello; in {
         { config, lib, pkgs, ... }:
         { virtualisation.writableStore = true;
           virtualisation.pathsInNixDB = [ pkgA ];
-          nix.package = nix;
           nix.binaryCaches = lib.mkForce [ ];
         };
 
@@ -20,7 +22,6 @@ makeTest (let pkgA = pkgs.cowsay; pkgB = pkgs.wget; pkgC = pkgs.hello; in {
         { services.openssh.enable = true;
           virtualisation.writableStore = true;
           virtualisation.pathsInNixDB = [ pkgB pkgC ];
-          nix.package = nix;
         };
     };
 

tests/plugins.sh

@@ -2,6 +2,6 @@ source common.sh
 
 set -o pipefail
 
-res=$(nix eval '(builtins.anotherNull)' --option setting-set true --option plugin-files $PWD/plugins/libplugintest*)
+res=$(nix eval --expr builtins.anotherNull --option setting-set true --option plugin-files $PWD/plugins/libplugintest*)
 
 [ "$res"x = "nullx" ]

tests/pure-eval.sh

@@ -2,17 +2,17 @@ source common.sh
 
 clearStore
 
-nix eval --pure-eval '(assert 1 + 2 == 3; true)'
+nix eval --expr 'assert 1 + 2 == 3; true'
 
-[[ $(nix eval '(builtins.readFile ./pure-eval.sh)') =~ clearStore ]]
+[[ $(nix eval --impure --expr 'builtins.readFile ./pure-eval.sh') =~ clearStore ]]
 
-(! nix eval --pure-eval '(builtins.readFile ./pure-eval.sh)')
+(! nix eval --expr 'builtins.readFile ./pure-eval.sh')
 
-(! nix eval --pure-eval '(builtins.currentTime)')
-(! nix eval --pure-eval '(builtins.currentSystem)')
+(! nix eval --expr builtins.currentTime)
+(! nix eval --expr builtins.currentSystem)
 
 (! nix-instantiate --pure-eval ./simple.nix)
 
-[[ $(nix eval "((import (builtins.fetchurl { url = file://$(pwd)/pure-eval.nix; })).x)") == 123 ]]
-(! nix eval --pure-eval "((import (builtins.fetchurl { url = file://$(pwd)/pure-eval.nix; })).x)")
-nix eval --pure-eval "((import (builtins.fetchurl { url = file://$(pwd)/pure-eval.nix; sha256 = \"$(nix hash-file pure-eval.nix --type sha256)\"; })).x)"
+[[ $(nix eval --impure --expr "(import (builtins.fetchurl { url = file://$(pwd)/pure-eval.nix; })).x") == 123 ]]
+(! nix eval --expr "(import (builtins.fetchurl { url = file://$(pwd)/pure-eval.nix; })).x")
+nix eval --expr "(import (builtins.fetchurl { url = file://$(pwd)/pure-eval.nix; sha256 = \"$(nix hash-file pure-eval.nix --type sha256)\"; })).x"

tests/recursive.sh

@@ -7,7 +7,7 @@ clearStore
 
 export unreachable=$(nix add-to-store ./recursive.sh)
 
-nix --experimental-features 'nix-command recursive-nix' build -o $TEST_ROOT/result -L '(
+nix --experimental-features 'nix-command recursive-nix' build -o $TEST_ROOT/result -L --impure --expr '
   with import ./config.nix;
   with import <nix/config.nix>;
   mkDerivation {
@@ -47,7 +47,7 @@ nix --experimental-features 'nix-command recursive-nix' build -o $TEST_ROOT/resu
       [[ $(nix $opts path-info --all | wc -l) -eq 3 ]]
 
       # Build a derivation.
-      nix $opts build -L '\''(
+      nix $opts build -L --impure --expr '\''
         derivation {
           name = "inner1";
           builder = builtins.getEnv "SHELL";
@@ -55,13 +55,13 @@ nix --experimental-features 'nix-command recursive-nix' build -o $TEST_ROOT/resu
           fnord = builtins.toFile "fnord" "fnord";
           args = [ "-c" "echo $fnord blaat > $out" ];
         }
-      )'\''
+      '\''
 
       [[ $(nix $opts path-info --json ./result) =~ fnord ]]
 
       ln -s $(nix $opts path-info ./result) $out/inner1
     '\'\'';
-  })
+  }
 '
 
 [[ $(cat $TEST_ROOT/result/inner1) =~ blaat ]]

tests/remote-builds.nix

@@ -1,8 +1,11 @@
 # Test Nix's remote build feature.
 
-{ nixpkgs, system, nix }:
+{ nixpkgs, system, overlay }:
 
-with import (nixpkgs + "/nixos/lib/testing.nix") { inherit system; };
+with import (nixpkgs + "/nixos/lib/testing.nix") {
+  inherit system;
+  extraConfigurations = [ { nixpkgs.overlays = [ overlay ]; } ];
+};
 
 makeTest (
 
@@ -13,7 +16,6 @@ let
     { config, pkgs, ... }:
     { services.openssh.enable = true;
       virtualisation.writableStore = true;
-      nix.package = nix;
       nix.useSandbox = true;
     };
 
@@ -59,7 +61,6 @@ in
             ];
           virtualisation.writableStore = true;
           virtualisation.pathsInNixDB = [ config.system.build.extraUtils ];
-          nix.package = nix;
           nix.binaryCaches = lib.mkForce [ ];
           programs.ssh.extraConfig = "ConnectTimeout 30";
         };

tests/restricted.sh

@@ -17,18 +17,18 @@ nix-instantiate --restrict-eval --eval -E 'builtins.readDir ../src/nix-channel'
 (! nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in <foo>')
 nix-instantiate --restrict-eval --eval -E 'let __nixPath = [ { prefix = "foo"; path = ./.; } ]; in <foo>' -I src=.
 
-p=$(nix eval --raw "(builtins.fetchurl file://$(pwd)/restricted.sh)" --restrict-eval --allowed-uris "file://$(pwd)")
+p=$(nix eval --raw --expr "builtins.fetchurl file://$(pwd)/restricted.sh" --impure --restrict-eval --allowed-uris "file://$(pwd)")
 cmp $p restricted.sh
 
-(! nix eval --raw "(builtins.fetchurl file://$(pwd)/restricted.sh)" --restrict-eval)
+(! nix eval --raw --expr "builtins.fetchurl file://$(pwd)/restricted.sh" --impure --restrict-eval)
 
-(! nix eval --raw "(builtins.fetchurl file://$(pwd)/restricted.sh)" --restrict-eval --allowed-uris "file://$(pwd)/restricted.sh/")
+(! nix eval --raw --expr "builtins.fetchurl file://$(pwd)/restricted.sh" --impure --restrict-eval --allowed-uris "file://$(pwd)/restricted.sh/")
 
-nix eval --raw "(builtins.fetchurl file://$(pwd)/restricted.sh)" --restrict-eval --allowed-uris "file://$(pwd)/restricted.sh"
+nix eval --raw --expr "builtins.fetchurl file://$(pwd)/restricted.sh" --impure --restrict-eval --allowed-uris "file://$(pwd)/restricted.sh"
 
-(! nix eval --raw "(builtins.fetchurl https://github.com/NixOS/patchelf/archive/master.tar.gz)" --restrict-eval)
-(! nix eval --raw "(builtins.fetchTarball https://github.com/NixOS/patchelf/archive/master.tar.gz)" --restrict-eval)
-(! nix eval --raw "(fetchGit git://github.com/NixOS/patchelf.git)" --restrict-eval)
+(! nix eval --raw --expr "builtins.fetchurl https://github.com/NixOS/patchelf/archive/master.tar.gz" --impure --restrict-eval)
+(! nix eval --raw --expr "builtins.fetchTarball https://github.com/NixOS/patchelf/archive/master.tar.gz" --impure --restrict-eval)
+(! nix eval --raw --expr "fetchGit git://github.com/NixOS/patchelf.git" --impure --restrict-eval)
 
 ln -sfn $(pwd)/restricted.nix $TEST_ROOT/restricted.nix
 [[ $(nix-instantiate --eval $TEST_ROOT/restricted.nix) == 3 ]]
@@ -37,7 +37,7 @@ ln -sfn $(pwd)/restricted.nix $TEST_ROOT/restricted.nix
 (! nix-instantiate --eval --restrict-eval $TEST_ROOT/restricted.nix -I .)
 nix-instantiate --eval --restrict-eval $TEST_ROOT/restricted.nix -I $TEST_ROOT -I .
 
-[[ $(nix eval --raw --restrict-eval -I . '(builtins.readFile "${import ./simple.nix}/hello")') == 'Hello World!' ]]
+[[ $(nix eval --raw --impure --restrict-eval -I . --expr 'builtins.readFile "${import ./simple.nix}/hello"') == 'Hello World!' ]]
 
 # Check whether we can leak symlink information through directory traversal.
 traverseDir="$(pwd)/restricted-traverse-me"
@@ -45,7 +45,7 @@ ln -sfn "$(pwd)/restricted-secret" "$(pwd)/restricted-innocent"
 mkdir -p "$traverseDir"
 goUp="..$(echo "$traverseDir" | sed -e 's,[^/]\+,..,g')"
 output="$(nix eval --raw --restrict-eval -I "$traverseDir" \
-    "(builtins.readFile \"$traverseDir/$goUp$(pwd)/restricted-innocent\")" \
+    --expr "builtins.readFile \"$traverseDir/$goUp$(pwd)/restricted-innocent\"" \
     2>&1 || :)"
 echo "$output" | grep "is forbidden"
 ! echo "$output" | grep -F restricted-secret

tests/search.sh

@@ -3,41 +3,23 @@ source common.sh
 clearStore
 clearCache
 
-# No packages
-(( $(NIX_PATH= nix search -u|wc -l) == 0 ))
-
-# Haven't updated cache, still nothing
-(( $(nix search -f search.nix hello|wc -l) == 0 ))
-(( $(nix search -f search.nix |wc -l) == 0 ))
-
-# Update cache, search should work
-(( $(nix search -f search.nix -u hello|wc -l) > 0 ))
-
-# Use cache
-(( $(nix search -f search.nix foo|wc -l) > 0 ))
-(( $(nix search foo|wc -l) > 0 ))
-
-# Test --no-cache works
-# No results from cache
-(( $(nix search --no-cache foo |wc -l) == 0 ))
-# Does find results from file pointed at
-(( $(nix search -f search.nix --no-cache foo |wc -l) > 0 ))
+(( $(nix search -f search.nix '' hello | wc -l) > 0 ))
 
 # Check descriptions are searched
-(( $(nix search broken | wc -l) > 0 ))
+(( $(nix search -f search.nix '' broken | wc -l) > 0 ))
 
 # Check search that matches nothing
-(( $(nix search nosuchpackageexists | wc -l) == 0 ))
+(( $(nix search -f search.nix '' nosuchpackageexists | wc -l) == 0 ))
 
 # Search for multiple arguments
-(( $(nix search hello empty | wc -l) == 3 ))
+(( $(nix search -f search.nix '' hello empty | wc -l) == 2 ))
 
 # Multiple arguments will not exist
-(( $(nix search hello broken | wc -l) == 0 ))
+(( $(nix search -f search.nix '' hello broken | wc -l) == 0 ))
 
 ## Search expressions
 
 # Check that empty search string matches all
-nix search|grep -q foo
-nix search|grep -q bar
-nix search|grep -q hello
+nix search -f search.nix '' |grep -q foo
+nix search -f search.nix '' |grep -q bar
+nix search -f search.nix '' |grep -q hello

tests/setuid.nix

@@ -1,15 +1,17 @@
 # Verify that Linux builds cannot create setuid or setgid binaries.
 
-{ nixpkgs, system, nix }:
+{ nixpkgs, system, overlay }:
 
-with import (nixpkgs + "/nixos/lib/testing.nix") { inherit system; };
+with import (nixpkgs + "/nixos/lib/testing.nix") {
+  inherit system;
+  extraConfigurations = [ { nixpkgs.overlays = [ overlay ]; } ];
+};
 
 makeTest {
 
   machine =
     { config, lib, pkgs, ... }:
     { virtualisation.writableStore = true;
-      nix.package = nix;
       nix.binaryCaches = lib.mkForce [ ];
       nix.nixPath = [ "nixpkgs=${lib.cleanSource pkgs.path}" ];
       virtualisation.pathsInNixDB = [ pkgs.stdenv pkgs.pkgsi686Linux.stdenv ];