build-support/fetchpijul: Add cacert dependency, set impureEnvVars, and enable strictDeps

[nrabulinski]

Description of changes

Closes #270252
We now properly set SSL_CERT_FILE and the proxy variables. I also added strictDeps = true so that pijul doesn't need to be fetched when using sources obtained with fetchpijul.

cc @2xsaiko

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.05 Release Notes (or backporting 23.05 and 23.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-ready-for-review/3032/3055

[2xsaiko]

Thanks, this indeed fixes the error!

[SuperSandro2000]

I also added strictDeps = true so that pijul doesn't need to be fetched when using sources obtained with fetchpijul.

Why was that the case before? This is unexpected to me.

[nrabulinski]

I also added strictDeps = true so that pijul doesn't need to be fetched when using sources obtained with fetchpijul.

Why was that the case before? This is unexpected to me.

Pijul is a build-time dependency and without strictDeps we don't differentiate between build- and run-time dependencies so anything that references a derivation produced with fetchpijul depends on pijul at "runtime".
There's no runtime per se with sources, but you get what I mean, it could be that you already have the source fetched but nix will still fetch pijul when you try to use said source because it depends on it at runtime.

And if you're asking why it wasn't enabled before - I didn't know about it and none of the reviewers told me about it 😄

[2xsaiko]

Pijul is a build-time dependency and without strictDeps we don't differentiate between build- and run-time dependencies so anything that references a derivation produced with fetchpijul depends on pijul at "runtime". There's no runtime per se with sources, but you get what I mean, it could be that you already have the source fetched but nix will still fetch pijul when you try to use said source because it depends on it at runtime.

I can't really say for certain because the manual seems to support what you're saying but I also don't really understand that section, but I thought runtime dependencies were always strictly decided by references to which inputs are contained in the output paths of the derivation. It seems kinda weird for that not to be the case for the non-cross case (as per the manual).

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-ready-for-review/3032/3145

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-ready-for-review/3032/3191