In pure mode, set builtins.nixVersion to a constant

[edolstra]

This prevents issues like
NixOS/nixpkgs#156527. Eventually we should do
this in impure mode as well.

Issue #5970.

Depends on #8330

[thufschmitt]

I’m not sure it’s a good idea. Granted it’s a source of impurity, but so is builtins ? whatever. And it can be useful in some cases (nix-community/poetry2nix@5c06704 which is linked from the related issue is indeed a good example)

[edolstra]

Yes, but expressions like builtins ? whatever are unlikely to end up embedded in strings like in NixOS/nixpkgs#156527.

[roberth]

Adding a nixVersionAtLeast function seems like a good compromise. It produces a boolean, so it's unlikely to end up in a build like that.

[thufschmitt]

Adding a nixVersionAtLeast function seems like a good compromise. It produces a boolean, so it's unlikely to end up in a build like that.

Yes, that sounds like a fairly good one

(and maybe just deprecating builtins.nixVersion for the time being to avoid breaking stuff too badly)

[roberth]

Let's not forget about builtins.langVersion.

[roberth]

Adding a nixVersionAtLeast function seems like a good compromise.

This does make error messages less informative. Another solution is to poison the string context, similar to what we could do for secret strings, but slightly different allowed usages. String context poisoning has its own issue now:

• Poison pill string context #8388

[fricklerhandwerk]

Discussed in the Nix team meeting 2023-06-05:

• @roberth proposes to add a comparison function instead and encourage its use, so version strings won't end up in builds
  • should deprecate nixVersion eventually of course
  • could be impureNixVersionAtLeast to signal
• @edolstra: could ask what's the use case of knowing the version. usually to determine if a primop is available. but that's what ? is used
  • @roberth: in case we happen to release a buggy builtin, it my
• @fricklerhandwerk: should the constant be something yelling "don't use"?
  • @edolstra: could stop incrementing it at 2.16
• @Ericson2314: what speaks against removing it in pure eval?
  • @edolstra: might break lots of consumers
  • @fricklerhandwerk: does Nixpkgs build in pure eval?
    • @edolstra: no, but possibly in restricted eval
    • @roberth: also flakes
• conclusion: merge Automatically document builtin constants #8330 first so we can document nixVersion to be discouraged, pin output 2.16

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/2023-06-05-nix-team-meeting-minutes-60/28933/1

[dpulls]

🎉 All dependencies have been resolved !