How to test the result of a build in a "pure" environment?

I was using a package that was not running properly on my machine because it depended on the file which was missing. After a nix-env -iA nixos.file, it worked. But I tried and fixed the package to add file as a dependency, and wrapped the problematic executable to add the path to the file executable in the nixos-store to the PATH environment variable with something like:

wrapProgram the_executable --prefix PATH : ${lib.makeBinPath [ file ]}

Now, after building with nix-build -A my_package, I run the resulting result/bin/the_executable and everything works (and I made a pull request).

However, that made me realize that my user environment had an impact on the behavior of the_executable in the original package. How can I make sure that the executable does not depend on other executables or environment variables in my current user or system environment?

Can I run the build result in a environment where only the package’s dependencies are available, and none of my system or user environment is visible, to ensure that the build is reproducible? Something like nix-shell --pure the_package, but where the package was built, and not only it’s dependencies?

I know about nix-shell -p the_package, which makes the package available, but it only loads the old version of the package. I couldn’t figure out how to make it load my fixed package in my nixpkgs branch.

If you have a checkout of the nixpkgs repo locally, you can do:

NIX_PATH=nixpkgs=$PWD nix-shell --pure -p the_package

or, you can use any arbitrary nix expression, although I think this is unintentional:

nix-shell --pure -p "with import ./. { }; the_package"
3 Likes