[Nix-dev] What does "output is not allowed to refer to path ..." mean?

[Eelco Dolstra]

On 17/12/11 00:38, Peter Simons wrote:

> why does nixos-rebuild generate an error message such as the following one?
> 
>   output is not allowed to refer to path `/nix/store/qccjhn063cfv171rcaxvxh0yk96zf7l2-cryptsetup-1.4.1'
>   cannot build derivation `/nix/store/svqdc9jf8qqn89lv93pxqwgky00cylj2-stage-1-init.sh.drv': 1 dependencies couldn't be built
>   cannot build derivation `/nix/store/k9lgzyb92qq3hjy1bqxxf1mmjqbsgxpr-initrd.drv': 1 dependencies couldn't be built
>   killing process 7263
>   cannot build derivation `/nix/store/xyjdb6yvxi32lkf0amm84i50742y6rx3-system.drv': 1 dependencies couldn't be built
>   error: build of `/nix/store/xyjdb6yvxi32lkf0amm84i50742y6rx3-system.drv' failed
> 
> What does that error mean?

This probably comes from extraUtils in nixos/modules/system/boot/stage-1.nix,
specifically the line

  allowedReferences = [ "out" modulesClosure ]; # prevent accidents like glibc
being included in the initrd

This says that the output of the extraUtils derivation can only refer to itself
or to ‘modulesClosure’.  So it's not allowed to depend on cryptsetup.

Not sure why this happens.  The extraUtils builder calls the nuke-refs function
to get rid of external references, so the copied cryptsetup binaries (in
luksroot.nix) shouldn't cause a problem.

-- 
Eelco Dolstra | http://www.st.ewi.tudelft.nl/~dolstra/