{"action":"opened","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/13532","repository_url":"https://api.github.com/repos/NixOS/nixpkgs","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/13532/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/13532/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/13532/events","html_url":"https://github.com/NixOS/nixpkgs/issues/13532","id":137005612,"number":13532,"title":"NIX_ENFORCE_PURITY breaks `ekam` in hard to diagnose ways","user":{"login":"timbertson","id":14172,"avatar_url":"https://avatars.githubusercontent.com/u/14172?v=3","gravatar_id":"","url":"https://api.github.com/users/timbertson","html_url":"https://github.com/timbertson","followers_url":"https://api.github.com/users/timbertson/followers","following_url":"https://api.github.com/users/timbertson/following{/other_user}","gists_url":"https://api.github.com/users/timbertson/gists{/gist_id}","starred_url":"https://api.github.com/users/timbertson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timbertson/subscriptions","organizations_url":"https://api.github.com/users/timbertson/orgs","repos_url":"https://api.github.com/users/timbertson/repos","events_url":"https://api.github.com/users/timbertson/events{/privacy}","received_events_url":"https://api.github.com/users/timbertson/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-28T04:26:41Z","updated_at":"2016-02-28T04:26:41Z","closed_at":null,"body":"## Basic info\r\n\r\nTo make sure that we are on the same page:\r\n\r\n* Kernel: `Linux meep 4.3.5-300.fc23.x86_64 #1 SMP Mon Feb 1 03:18:41 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux`\r\n* System: Fedora release 23\r\n* Nix version: nix-env (Nix) 1.10\r\n* Nixpkgs version: 16.03pre76763.be0abb3\r\n\r\nI had a lot of trouble trying to build [ekam](https://github.com/sandstorm-io/ekam) in a nix expression recently. In a `nix-build` it would fail, but everything I did to reproduce that outside of a `nix-build` worked:\r\n\r\n - copy the `src` directory from the store and build with my system compiler\r\n - copy the `src` directory from the store and compile inside `nix-shell --pure`\r\n\r\nThe `nix-shell` step was the best I could do to reproduce the nix build environment, but I was _still_ unable to reproduce the failure.\r\n\r\nI suspected the problem boiled down to include paths being missing, because ekam is rather novel in its use of virtual paths like `/ekam-provider/c++header/capnp/generated-header-support.h` (which is resolved to a real path by ekam's injected LD_PRELOAD library)\r\n\r\nSo on a hunch I dug into the `g++` wrapper script. The NIX_ENFORCE_PURITY logic jumped out as something that could be skipping non-nix paths. So I tried adding `NIX_ENFORCE_PURITY = \"0\";\r\n` to my derivation. This still didn't work. I had to grep nixpkgs to see how to turn this off, and it's apparently done with `preHook = \"unset NIX_ENFORCE_PURITY\";`.\r\n\r\nSo to summarize:\r\n\r\n - `nix-shell --pure` didn't set NIX_ENFORCE_PURITY, which seems like a bug to me. This would have made debugging much easier.\r\n - setting `NIX_ENFORCE_PURITY=\"0\"` in my derivation did nothing, I had to override the `preHook`. This doesn't seem like it needs to be special (but maybe there's a good reason for it?)\r\n - I didn't get any indication that my include paths were being skipped. This would have been printed if I'd enabled `$NIX_DEBUG` but I didn't know about that flag. I'm not sure what could be improved here, since presumably this causes a _lot_ of noise given how often the compiler is invoked.\r\n - Would it be OK to allow include paths outside the nix store, _as long as they don't exist_ at build time? This is admittedly a pretty weird thing to do on ekim's part, but I don't think it would lead to impurity.\r\n"}}