stdenv: add no-broken-symlinks hook

[ConnorBaker]

Adds a setup hook which checks for broken symlinks; a symlink is considered broken if it's dangling (target doesn't exist) or reflexive (it refers to itself).

In my experience, outputs with broken symlinks are generally errors, and so we should provide a hook which can catch and report them.

The hook can be disabled by setting dontCheckForBrokenSymlinks.

Future work

Fixup PRs:

• apple-sdk: set dontCheckForBrokenSymlinks #376043
• cc-wrapper: set dontCheckForBrokenSymlinks #376202
• bluez: set dontCheckForBrokenSymlinks #376210 (superseded by no-broken-symlinks: restrict checks to symlinks pointing inside the store #376261)
• systemd: set dontCheckForBrokenSymlinks #376218 (superseded by no-broken-symlinks: restrict checks to symlinks pointing inside the store #376261)
• no-broken-symlinks: restrict checks to symlinks pointing inside the store #376261

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[K900]

Conceptually LGTM, bash looks roughly OK and I don't trust myself to comment any further than that. Has anyone tried running the data on the number of broken symlinks in the current Hydra outputs?

[philiptaron]

As with @K900, this looks good to me in theory and I support the idea that a dangling or reflexive symlink is more often than not a bug.

I'd love a test. Could you write a few using testBuildFailure, showing:

1. Reflexive symlink fails
2. Dangling symlink fails
3. They don't fail if dontCheckForBrokenSymlinks is specified.

[nix-owners]

The PR's base branch is set to staging, but 4 commits from the master branch are included. Make sure you know the right base branch for your changes, then:

• If the changes should go to the master branch, change the base branch to master
• If the changes should go to the staging branch, rebase your PR onto the merge base with the staging branch:

  # git rebase --onto $(git merge-base upstream/staging HEAD) $(git merge-base upstream/master HEAD)
  git rebase --onto eac5f2caf93e16315194c6227cab4937af4b74e3 db0f0fb937b73c4585444925e17446726836a405
  git push --force-with-lease

[ConnorBaker]

Added docs and tests, force-pushed and rebased!

@K900 and @philiptaron would you mind taking another look?

[jhargraveiii]

I couldn't find an issue logged for cudaPackaes.tensorrt - I can try to create one if needed.

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/still-cant-print-after-6-months-canon-mf445dw-at-the-end-of-my-rope/24665/26

[athas]

mlkit was also broken by this change: #385089

I think it is not great that a cosmetic improvement breaks previously working derivations, without any automation for dealing with it.

[DavHau]

Where is the documentation for this feature? I don't think something like this should be merged without docs.

[RossComputerGuy]

Where is the documentation for this feature?

Right here: https://github.com/NixOS/nixpkgs/pull/370750/files#diff-f5fe95f260cb2cfb8edfaf1588832dc7686f8132220a6e664c2feae66c99ad26R1374-R1383

https://nixos.org/manual/nixpkgs/unstable/#no-broken-symlinks.sh

I don't think something like this should be merged without docs.

That is true but was already done.

[DavHau]

Oops, I should have checked the PR's changes.

Unfortunately the manual failed me here. If I encounter an error like ERROR: noBrokenSymlinks: my instinct is to search the manual for noBrokenSymlinks. But the manual doesn't contain this string.
Optimally the error message would be changed or the manual adapted.