fix(policy): normalize nix profile paths to tilde-style and add defexpr - #822
Conversation
marksisson
changed the title
There was a problem hiding this comment.
Pull request overview
This PR updates the embedded Nix runtime policy in nono-cli so home-relative Nix paths use a consistent tilde form and modern XDG state locations are covered alongside the legacy locations.
Changes:
- Replaced the Nix profiles entry from
$HOME/.local/state/nix/profilesto~/.local/state/nix/profiles. - Added
~/.local/state/nix/defexprnext to the existing legacy~/.nix-defexprentry. - Kept the rest of the
nix_runtimeread allowlist unchanged.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
marksisson
changed the title
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Nix read policy to include modern XDG-compliant directory paths and standardizes the use of the tilde character for home directory references. A review comment suggests adding the singular profile path to ensure complete support for the modern Nix directory layout.
|
I think this PR could also just have ~/.local/state/nix, and not specify the profiles and defexpr subdirectories. But without comments in the policy.json, I wonder if the intent/need for the allow read for ~/.local/state/nix would be clear? |
|
Some notes I am using... # user's current profile/generation
~/.nix-profile # default
~/.local/state/nix/profile # XDG
# user's current nix channel
~/.nix-defexpr # default
~/.local/state/nix/defexpr # XDG
# user's profile generations
/etc/profiles/per-user # default
~/.local/state/nix/profiles # XDG
# system's current profile/generation (./bin is system PATH environment)
/run/current-system/sw
# core profile storage (including system profile generations and root user profiles)
/nix/var/nix/profiles
## everything above is eventually symlinked to the following location
/nix/store # conanical artifact storage |
47fb651 to
9f3b179
Compare
|
Depends on #830 |
Replace $HOME/.local/state/nix/profiles with ~/.local/state/nix/profiles for consistency with the other tilde-style paths in the nix group, and add ~/.local/state/nix/defexpr alongside ~/.nix-defexpr to cover the modern nix-command profile layout. Signed-off-by: Mark Sisson <5761292+marksisson@users.noreply.github.com>
Replace $HOME/.local/state/nix/profiles with ~/.local/state/nix/profiles for consistency with the other tilde-style paths in the nix group, and add ~/.local/state/nix/defexpr alongside ~/.nix-defexpr to cover the modern XDG directory profile layout.