Nixpkgs: nix-copy-closure has a hidden dependency on ssh

[Nadrieril]

The nix-copy-closure script included in nix uses ssh to copy closures around.
Since the calls to ssh are hidden in perl system calls (see e.g. https://github.com/NixOS/nix/blob/master/perl/lib/Nix/SSH.pm#L90), the dependency is not detected when nix is built via nix.
So on a system where ssh is not installed globally, nix-copy-closure fails.

A simple solution would be to add the ssh dependency and wrap the perl scripts as needed, but that would make nix as a whole depend on ssh, which may not be desirable.
Instead, I think nix-copy-closure should be a separate derivation.
If nix-copy-closure is too tightly coupled with nix, maybe at least the nixpkgs nix package could have an option to add the dependency or not.

I would be glad to help solving this, though I am not familiar with how nix injects dependencies.

[volth]

It might be intentional, in a way like parted has hidden dependencies on too many filesystem-specific packages and it just does not support the filesystems which utilities are not installed.

[Nadrieril]

I see the comparison, but this kind of solution is very contrary to the purpose of nix, and IMHO should only be used in cases like parted where it would be too complicated to add all the optional dependencies to the nixpkgs package.
Here, I don't see why adding an optional dependency on openssh would be too hard.

Also, I forgot to mention but nixos-rebuild fails to work when used with both --build-host and --target-host because of this missing dependency.

[4z3]

FWIW, the issue can be reproduced using nix-shell, e.g. like this:

$ nix-shell --pure -p nix --run 'NIX_REMOTE=daemon nix-copy-closure localhost /nix/store/derpderp'
sh: line 0: exec: ssh: not found
unable to connect to ‘localhost’; falling back to old closure copying method
path â/nix/store/derpderpâ is not valid at /nix/store/5s702qd8a7n6byk3wlh2777g3j67cl06-nix-1.11.13/lib/perl5/site_perl/5.22.3/x86_64-linux-thread-multi/Nix/CopyClosure.pm line 77.

[Nadrieril]

In the meantime, for anyone blocked by this issue (as I was), I have made the following dirty wrapper around nix that adds ssh to the PATH of nix-copy-closure: https://github.com/Nadrieril/dotfiles/blob/67061b004fa5c3c1f7f498f200b9bddfb6bee11c/.config/nixpkgs/overlays/11-nix-wrapper.nix

[stale[bot]]

Thank you for your contributions.

This has been automatically marked as stale because it has had no activity for 180 days.

If this is still important to you, we ask that you leave a comment below. Your comment can be as simple as "still important to me". This lets people see that at least one person still cares about this. Someone will have to do this at most twice a year if there is no other activity.

Here are suggestions that might help resolve this more quickly:

1. Search for maintainers and people that previously touched the related code and @ mention them in a comment.
2. Ask on the NixOS Discourse.
3. Ask on the #nixos channel on irc.freenode.net.

[davidak]

Is this still an issue?

The output looks different:

[davidak@gaming:~]$ nix-shell --pure -p nix --run 'NIX_REMOTE=daemon nix-copy-closure localhost /nix/store/derpderp'
these paths will be fetched (0.15 MiB download, 0.74 MiB unpacked):
  /nix/store/22lm9jbc6m8za9030k2p4k52l5pa0m3i-nix-2.3.6-dev
  /nix/store/38dq3mnjmxk7c9gpsjayir0ccg7fvpyg-boehm-gc-8.0.4-dev
  /nix/store/wqfv04xz2rpl2326ijghn1f2qgiyplb4-bash-interactive-4.4-p23-dev
copying path '/nix/store/wqfv04xz2rpl2326ijghn1f2qgiyplb4-bash-interactive-4.4-p23-dev' from 'https://cache.nixos.org'...
copying path '/nix/store/38dq3mnjmxk7c9gpsjayir0ccg7fvpyg-boehm-gc-8.0.4-dev' from 'https://cache.nixos.org'...
copying path '/nix/store/22lm9jbc6m8za9030k2p4k52l5pa0m3i-nix-2.3.6-dev' from 'https://cache.nixos.org'...
error: path '/nix/store/derpderp' is not in the Nix store

And _nix-copy-closure_ is no longer a perl script.

[davidak@gaming:~]$ file /nix/store/csrmkvlyfikij2h0kdqsgbkmqlsjspwg-nix-2.3.6/bin/nix-copy-closure
/nix/store/csrmkvlyfikij2h0kdqsgbkmqlsjspwg-nix-2.3.6/bin/nix-copy-closure: symbolic link to nix

[davidak@gaming:~]$ ll /nix/store/csrmkvlyfikij2h0kdqsgbkmqlsjspwg-nix-2.3.6/bin/
total 1776
-r-xr-xr-x 1 root root 1816736 Jan  1  1970 nix
lrwxrwxrwx 1 root root       3 Jan  1  1970 nix-build -> nix
lrwxrwxrwx 1 root root       3 Jan  1  1970 nix-channel -> nix
lrwxrwxrwx 1 root root       3 Jan  1  1970 nix-collect-garbage -> nix
lrwxrwxrwx 1 root root       3 Jan  1  1970 nix-copy-closure -> nix
lrwxrwxrwx 1 root root       3 Jan  1  1970 nix-daemon -> nix
lrwxrwxrwx 1 root root       3 Jan  1  1970 nix-env -> nix
lrwxrwxrwx 1 root root       3 Jan  1  1970 nix-hash -> nix
lrwxrwxrwx 1 root root       3 Jan  1  1970 nix-instantiate -> nix
lrwxrwxrwx 1 root root       3 Jan  1  1970 nix-prefetch-url -> nix
lrwxrwxrwx 1 root root       3 Jan  1  1970 nix-shell -> nix
lrwxrwxrwx 1 root root       3 Jan  1  1970 nix-store -> nix

[davidak@gaming:~]$ file /nix/store/csrmkvlyfikij2h0kdqsgbkmqlsjspwg-nix-2.3.6/bin/nix
/nix/store/csrmkvlyfikij2h0kdqsgbkmqlsjspwg-nix-2.3.6/bin/nix: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /nix/store/xg6ilb9g9zhi2zg1dpi4zcp288rhnvns-glibc-2.30/lib/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=c4d6609a3510b047c9ef08fcd9c330d5f29f257b, not stripped

[Nadrieril]

Then it looks fixed! I'll close this and someone can message if they still have this problem