noogle/scripts/data/derivation-doc.txt

# Derivations\n\nThe most important built-in function is `derivation`, which is used to\ndescribe a single derivation (a build task). It takes as input a set,\nthe attributes of which specify the inputs of the build.\n\n  - There must be an attribute named [`system`]{#attr-system} whose value must be a\n    string specifying a Nix system type, such as `\"i686-linux\"` or\n    `\"x86_64-darwin\"`. (To figure out your system type, run `nix -vv\n    --version`.) The build can only be performed on a machine and\n    operating system matching the system type. (Nix can automatically\n    [forward builds for other\n    platforms](../advanced-topics/distributed-builds.md) by forwarding\n    them to other machines.)\n\n  - There must be an attribute named `name` whose value must be a\n    string. This is used as a symbolic name for the package by\n    `nix-env`, and it is appended to the output paths of the derivation.\n\n  - There must be an attribute named `builder` that identifies the\n    program that is executed to perform the build. It can be either a\n    derivation or a source (a local file reference, e.g.,\n    `./builder.sh`).\n\n  - Every attribute is passed as an environment variable to the builder.\n    Attribute values are translated to environment variables as follows:\n    \n      - Strings and numbers are just passed verbatim.\n    \n      - A *path* (e.g., `../foo/sources.tar`) causes the referenced file\n        to be copied to the store; its location in the store is put in\n        the environment variable. The idea is that all sources should\n        reside in the Nix store, since all inputs to a derivation should\n        reside in the Nix store.\n    \n      - A *derivation* causes that derivation to be built prior to the\n        present derivation; its default output path is put in the\n        environment variable.\n    \n      - Lists of the previous types are also allowed. They are simply\n        concatenated, separated by spaces.\n    \n      - `true` is passed as the string `1`, `false` and `null` are\n        passed as an empty string.\n\n  - The optional attribute `args` specifies command-line arguments to be\n    passed to the builder. It should be a list.\n\n  - The optional attribute `outputs` specifies a list of symbolic\n    outputs of the derivation. By default, a derivation produces a\n    single output path, denoted as `out`. However, derivations can\n    produce multiple output paths. This is useful because it allows\n    outputs to be downloaded or garbage-collected separately. For\n    instance, imagine a library package that provides a dynamic library,\n    header files, and documentation. A program that links against the\n    library doesn’t need the header files and documentation at runtime,\n    and it doesn’t need the documentation at build time. Thus, the\n    library package could specify:\n    \n    ```nix\n    outputs = [ \"lib\" \"headers\" \"doc\" ];\n    ```\n    \n    This will cause Nix to pass environment variables `lib`, `headers`\n    and `doc` to the builder containing the intended store paths of each\n    output. The builder would typically do something like\n    \n    ```bash\n    ./configure \\n      --libdir=$lib/lib \\n      --includedir=$headers/include \\n      --docdir=$doc/share/doc\n    ```\n    \n    for an Autoconf-style package. You can refer to each output of a\n    derivation by selecting it as an attribute, e.g.\n    \n    ```nix\n    buildInputs = [ pkg.lib pkg.headers ];\n    ```\n    \n    The first element of `outputs` determines the *default output*.\n    Thus, you could also write\n    \n    ```nix\n    buildInputs = [ pkg pkg.headers ];\n    ```\n    \n    since `pkg` is equivalent to `pkg.lib`.\n\nThe function `mkDerivation` in the Nixpkgs standard environment is a\nwrapper around `derivation` that adds a default value for `system` and\nalways uses Bash as the builder, to which the supplied builder is passed\nas a command-line argument. See the Nixpkgs manual for details.\n\nThe builder is executed as follows:\n\n  - A temporary directory is created under the directory specified by\n    `TMPDIR` (default `/tmp`) where the build will take place. The\n    current directory is changed to this directory.\n\n  - The environment is cleared and set to the derivation attributes, as\n    specified above.\n\n  - In addition, the following variables are set:\n    \n      - `NIX_BUILD_TOP` contains the path of the temporary directory for\n        this build.\n    \n      - Also, `TMPDIR`, `TEMPDIR`, `TMP`, `TEMP` are set to point to the\n        temporary directory. This is to prevent the builder from\n        accidentally writing temporary files anywhere else. Doing so\n        might cause interference by other processes.\n    \n      - `PATH` is set to `/path-not-set` to prevent shells from\n        initialising it to their built-in default value.\n    \n      - `HOME` is set to `/homeless-shelter` to prevent programs from\n        using `/etc/passwd` or the like to find the user's home\n        directory, which could cause impurity. Usually, when `HOME` is\n        set, it is used as the location of the home directory, even if\n        it points to a non-existent path.\n    \n      - `NIX_STORE` is set to the path of the top-level Nix store\n        directory (typically, `/nix/store`).\n    \n      - For each output declared in `outputs`, the corresponding\n        environment variable is set to point to the intended path in the\n        Nix store for that output. Each output path is a concatenation\n        of the cryptographic hash of all build inputs, the `name`\n        attribute and the output name. (The output name is omitted if\n        it’s `out`.)\n\n  - If an output path already exists, it is removed. Also, locks are\n    acquired to prevent multiple Nix instances from performing the same\n    build at the same time.\n\n  - A log of the combined standard output and error is written to\n    `/nix/var/log/nix`.\n\n  - The builder is executed with the arguments specified by the\n    attribute `args`. If it exits with exit code 0, it is considered to\n    have succeeded.\n\n  - The temporary directory is removed (unless the `-K` option was\n    specified).\n\n  - If the build was successful, Nix scans each output path for\n    references to input paths by looking for the hash parts of the input\n    paths. Since these are potential runtime dependencies, Nix registers\n    them as dependencies of the output paths.\n\n  - After the build, Nix sets the last-modified timestamp on all files\n    in the build result to 1 (00:00:01 1/1/1970 UTC), sets the group to\n    the default group, and sets the mode of the file to 0444 or 0555\n    (i.e., read-only, with execute permission enabled if the file was\n    originally executable). Note that possible `setuid` and `setgid`\n    bits are cleared. Setuid and setgid programs are not currently\n    supported by Nix. This is because the Nix archives used in\n    deployment have no concept of ownership information, and because it\n    makes the build result dependent on the user performing the build.