nix: deduplicate home-manager merging

This becomes a problem when extraHomeConfig defines nixos module options.

Signed-off-by: Ophestra <cat@gensokyo.uk>

cmd/fsu/package.nix

@@ -10,7 +10,7 @@ buildGoModule {
 
   src = ./.;
   inherit (fortify) vendorHash;
-  CGO_ENABLED = 0;
+  env.CGO_ENABLED = 0;
 
   preBuild = ''
     go mod init fsu >& /dev/null

dbus/dbus_test.go

@@ -90,9 +90,9 @@ func testProxyFinaliseStartWaitCloseString(t *testing.T, useSandbox bool) {
 
 	t.Run("invalid start", func(t *testing.T) {
 		if !useSandbox {
-			p = dbus.NewDirect(context.TODO(), nil, nil)
+			p = dbus.NewDirect(t.Context(), nil, nil)
 		} else {
-			p = dbus.New(context.TODO(), nil, nil)
+			p = dbus.New(t.Context(), nil, nil)
 		}
 
 		if err := p.Start(); !errors.Is(err, syscall.ENOTRECOVERABLE) {
@@ -120,7 +120,7 @@ func testProxyFinaliseStartWaitCloseString(t *testing.T, useSandbox bool) {
 				}
 			})
 
-			ctx, cancel := context.WithTimeout(context.TODO(), 5*time.Second)
+			ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
 			defer cancel()
 			if !useSandbox {
 				p = dbus.NewDirect(ctx, final, nil)

flake.lock

@@ -7,32 +7,32 @@
         ]
       },
       "locked": {
-        "lastModified": 1746171682,
-        "narHash": "sha256-EyXUNSa+H+YvGVuQJP1nZskXAowxKYp79RNUsNdQTj4=",
+        "lastModified": 1748665073,
+        "narHash": "sha256-RMhjnPKWtCoIIHiuR9QKD7xfsKb3agxzMfJY8V9MOew=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "50eee705bbdbac942074a8c120e8194185633675",
+        "rev": "282e1e029cb6ab4811114fc85110613d72771dea",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-24.11",
+        "ref": "release-25.05",
         "repo": "home-manager",
         "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746557022,
-        "narHash": "sha256-QkNoyEf6TbaTW5UZYX0OkwIJ/ZMeKSSoOMnSDPQuol0=",
+        "lastModified": 1749024892,
+        "narHash": "sha256-OGcDEz60TXQC+gVz5sdtgGJdKVYr6rwdzQKuZAJQpCA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1d3aeb5a193b9ff13f63f4d9cc169fb88129f860",
+        "rev": "8f1b52b04f2cb6e5ead50bd28d76528a2f0380ef",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.11",
+        "ref": "nixos-25.05",
         "repo": "nixpkgs",
         "type": "github"
       }

flake.nix

@@ -2,10 +2,10 @@
   description = "fortify sandbox tool and nixos module";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
 
     home-manager = {
-      url = "github:nix-community/home-manager/release-24.11";
+      url = "github:nix-community/home-manager/release-25.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };

helper/cmd_test.go

@@ -13,7 +13,7 @@ import (
 
 func TestCmd(t *testing.T) {
 	t.Run("start non-existent helper path", func(t *testing.T) {
-		h := helper.NewDirect(context.Background(), "/proc/nonexistent", argsWt, false, argF, nil, nil)
+		h := helper.NewDirect(t.Context(), "/proc/nonexistent", argsWt, false, argF, nil, nil)
 
 		if err := h.Start(); !errors.Is(err, os.ErrNotExist) {
 			t.Errorf("Start: error = %v, wantErr %v",
@@ -22,7 +22,7 @@ func TestCmd(t *testing.T) {
 	})
 
 	t.Run("valid new helper nil check", func(t *testing.T) {
-		if got := helper.NewDirect(context.TODO(), "fortify", argsWt, false, argF, nil, nil); got == nil {
+		if got := helper.NewDirect(t.Context(), "fortify", argsWt, false, argF, nil, nil); got == nil {
 			t.Errorf("NewDirect(%q, %q) got nil",
 				argsWt, "fortify")
 			return

helper/container_test.go

@@ -15,7 +15,7 @@ import (
 
 func TestContainer(t *testing.T) {
 	t.Run("start empty container", func(t *testing.T) {
-		h := helper.New(context.Background(), "/nonexistent", argsWt, false, argF, nil, nil)
+		h := helper.New(t.Context(), "/nonexistent", argsWt, false, argF, nil, nil)
 
 		wantErr := "sandbox: starting an empty container"
 		if err := h.Start(); err == nil || err.Error() != wantErr {
@@ -25,7 +25,7 @@ func TestContainer(t *testing.T) {
 	})
 
 	t.Run("valid new helper nil check", func(t *testing.T) {
-		if got := helper.New(context.TODO(), "fortify", argsWt, false, argF, nil, nil); got == nil {
+		if got := helper.New(t.Context(), "fortify", argsWt, false, argF, nil, nil); got == nil {
 			t.Errorf("New(%q, %q) got nil",
 				argsWt, "fortify")
 			return

helper/helper_test.go

@@ -55,7 +55,7 @@ func testHelper(t *testing.T, createHelper func(ctx context.Context, setOutput f
 	t.Cleanup(func() { helper.WaitDelay = oldWaitDelay })
 
 	t.Run("start helper with status channel and wait", func(t *testing.T) {
-		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
 		stdout := new(strings.Builder)
 		h := createHelper(ctx, func(stdoutP, stderrP *io.Writer) { *stdoutP, *stderrP = stdout, os.Stderr }, true)
 
@@ -109,7 +109,7 @@ func testHelper(t *testing.T, createHelper func(ctx context.Context, setOutput f
 	})
 
 	t.Run("start helper and wait", func(t *testing.T) {
-		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
 		defer cancel()
 		stdout := new(strings.Builder)
 		h := createHelper(ctx, func(stdoutP, stderrP *io.Writer) { *stdoutP, *stderrP = stdout, os.Stderr }, false)

nixos.nix

@@ -9,6 +9,7 @@ packages:
 let
   inherit (lib)
     lists
+    attrsets
     mkMerge
     mkIf
     mapAttrs
@@ -238,15 +239,22 @@ in
             ++ foldlAttrs (
               acc': _: app:
               acc'
-              ++ [
-                {
-                  ${getsubname fid app.identity} = mkMerge [
-                    cfg.extraHomeConfig
-                    app.extraConfig
-                    { home.packages = app.packages; }
-                  ];
-                }
-              ]
+              ++ (
+                let
+                  key = getsubname fid app.identity;
+                in
+                [
+                  {
+                    ${key} = mkMerge (
+                      [
+                        cfg.extraHomeConfig
+                        { home.packages = app.packages; }
+                      ]
+                      ++ (if (attrsets.hasAttrByPath [ key ] acc) then (if !app.shareUid then throw "unexpected username collision" else [ ]) else [ app.extraConfig ])
+                    );
+                  }
+                ]
+              )
             ) [ { ${getsubname fid 0} = cfg.extraHomeConfig; } ] cfg.apps
           ) [ privPackages ] cfg.users
         );

package.nix

@@ -33,13 +33,34 @@ buildGoModule rec {
   pname = "fortify";
   version = "0.4.1";
 
-  src = builtins.path {
+  srcFiltered = builtins.path {
     name = "${pname}-src";
     path = lib.cleanSource ./.;
     filter = path: type: !(type == "regular" && (lib.hasSuffix ".nix" path || lib.hasSuffix ".py" path)) && !(type == "directory" && lib.hasSuffix "/test" path) && !(type == "directory" && lib.hasSuffix "/cmd/fsu" path);
   };
   vendorHash = null;
 
+  src = stdenv.mkDerivation {
+    name = "${pname}-src-full";
+    inherit version;
+    enableParallelBuilding = true;
+    src = srcFiltered;
+
+    buildInputs = [
+      wayland
+      wayland-protocols
+    ];
+
+    nativeBuildInputs = [
+      go
+      pkg-config
+      wayland-scanner
+    ];
+
+    buildPhase = "GOCACHE=$(mktemp -d) go generate ./...";
+    installPhase = "cp -r . $out";
+  };
+
   ldflags =
     lib.attrsets.foldlAttrs
       (
@@ -67,7 +88,6 @@ buildGoModule rec {
       libseccomp
       acl
       wayland
-      wayland-protocols
     ]
     ++ (with xorg; [
       libxcb
@@ -77,14 +97,9 @@ buildGoModule rec {
 
   nativeBuildInputs = [
     pkg-config
-    wayland-scanner
     makeBinaryWrapper
   ];
 
-  preBuild = ''
-    HOME="$(mktemp -d)" PATH="${pkg-config}/bin:$PATH" go generate ./...
-  '';
-
   postInstall =
     let
       appPackages = [
@@ -120,6 +135,10 @@ buildGoModule rec {
       gcc
       xorg.xorgproto
       util-linux
+
+      # for go generate
+      wayland-protocols
+      wayland-scanner
     ]
     ++ buildInputs
     ++ nativeBuildInputs;

sandbox/container_test.go

@@ -70,7 +70,7 @@ func TestContainer(t *testing.T) {
 
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
-			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			ctx, cancel := context.WithTimeout(t.Context(), 5*time.Second)
 			defer cancel()
 
 			container := sandbox.New(ctx, "/usr/bin/sandbox.test", "-test.v",
@@ -162,7 +162,7 @@ func e(root, target, vfsOptstr, fsType, source, fsOptstr string) *vfs.MountInfoE
 }
 
 func TestContainerString(t *testing.T) {
-	container := sandbox.New(context.TODO(), "ldd", "/usr/bin/env")
+	container := sandbox.New(t.Context(), "ldd", "/usr/bin/env")
 	container.Flags |= sandbox.FAllowDevel
 	container.Seccomp |= seccomp.FilterMultiarch
 	want := `argv: ["ldd" "/usr/bin/env"], flags: 0x2, seccomp: 0x2e`

test/configuration.nix

@@ -96,13 +96,19 @@
     users.alice = 0;
 
     extraHomeConfig = {
-      home.stateVersion = "23.05";
+      # To test merge deduplication:
+      options._fortify.noop = lib.mkEnableOption "nothing";
+
+      config = {
+        home.stateVersion = "23.05";
+      };
     };
 
     apps = {
       "cat.gensokyo.extern.foot.noEnablements" = {
         name = "ne-foot";
         identity = 1;
+        shareUid = true;
         verbose = true;
         share = pkgs.foot;
         packages = with pkgs; [
@@ -130,7 +136,8 @@
 
       "cat.gensokyo.extern.Alacritty.x11" = {
         name = "x11-alacritty";
-        identity = 3;
+        identity = 1;
+        shareUid = true;
         verbose = true;
         share = pkgs.alacritty;
         packages = with pkgs; [

test/default.nix

@@ -31,14 +31,13 @@ nixosTest {
     {
       environment.systemPackages = [
         # For go tests:
-        (writeShellScriptBin "fortify-go-test" ''
-          set -e
-          WORK="$(mktemp -ud)"
-          cp -r "${self.packages.${system}.fortify.src}" "$WORK"
-          chmod -R +w "$WORK"
-          cd "$WORK"
+        (writeShellScriptBin "fortify-test" ''
+          cd ${self.packages.${system}.fortify.src}
           ${fhs}/bin/fortify-fhs -c \
-            'go generate ./... && go test ${if withRace then "-race" else "-count 16"} ./... && touch /tmp/go-test-ok'
+            'go test ${if withRace then "-race" else "-count 16"} ./...' \
+            &> /tmp/fortify-test.log && \
+            touch /tmp/fortify-test-ok
+          touch /tmp/fortify-test-done
         '')
       ];
 

test/sandbox/case/device.nix

@@ -35,6 +35,7 @@
         "NIXOS" = fs "80001ff" null null;
         "X11" = fs "80001ff" null null;
         "alsa" = fs "80001ff" null null;
+        "bash_logout" = fs "80001ff" null null;
         "bashrc" = fs "80001ff" null null;
         "binfmt.d" = fs "80001ff" null null;
         "dbus-1" = fs "80001ff" null null;
@@ -148,7 +149,15 @@
                   } null;
                 } null;
                 ".local" = fs "800001ed" {
+                  share = fs "800001ed" {
+                    dbus-1 = fs "800001ed" {
+                      services = fs "800001ed" {
+                        "ca.desrt.dconf.service" = fs "80001ff" null null;
+                      } null;
+                    } null;
+                  } null;
                   state = fs "800001ed" {
+                    ".keep" = fs "80001ff" null "";
                     home-manager = fs "800001ed" { gcroots = fs "800001ed" { current-home = fs "80001ff" null null; } null; } null;
                     nix = fs "800001ed" {
                       profiles = fs "800001ed" {

test/sandbox/case/mapuid.nix

@@ -59,6 +59,7 @@
         "NIXOS" = fs "80001ff" null null;
         "X11" = fs "80001ff" null null;
         "alsa" = fs "80001ff" null null;
+        "bash_logout" = fs "80001ff" null null;
         "bashrc" = fs "80001ff" null null;
         "binfmt.d" = fs "80001ff" null null;
         "dbus-1" = fs "80001ff" null null;
@@ -172,7 +173,15 @@
                   } null;
                 } null;
                 ".local" = fs "800001ed" {
+                  share = fs "800001ed" {
+                    dbus-1 = fs "800001ed" {
+                      services = fs "800001ed" {
+                        "ca.desrt.dconf.service" = fs "80001ff" null null;
+                      } null;
+                    } null;
+                  } null;
                   state = fs "800001ed" {
+                    ".keep" = fs "80001ff" null "";
                     home-manager = fs "800001ed" { gcroots = fs "800001ed" { current-home = fs "80001ff" null null; } null; } null;
                     nix = fs "800001ed" {
                       profiles = fs "800001ed" {

test/sandbox/case/preset.nix

@@ -59,6 +59,7 @@
         "NIXOS" = fs "80001ff" null null;
         "X11" = fs "80001ff" null null;
         "alsa" = fs "80001ff" null null;
+        "bash_logout" = fs "80001ff" null null;
         "bashrc" = fs "80001ff" null null;
         "binfmt.d" = fs "80001ff" null null;
         "dbus-1" = fs "80001ff" null null;
@@ -172,7 +173,15 @@
                   } null;
                 } null;
                 ".local" = fs "800001ed" {
+                  share = fs "800001ed" {
+                    dbus-1 = fs "800001ed" {
+                      services = fs "800001ed" {
+                        "ca.desrt.dconf.service" = fs "80001ff" null null;
+                      } null;
+                    } null;
+                  } null;
                   state = fs "800001ed" {
+                    ".keep" = fs "80001ff" null "";
                     home-manager = fs "800001ed" { gcroots = fs "800001ed" { current-home = fs "80001ff" null null; } null; } null;
                     nix = fs "800001ed" {
                       profiles = fs "800001ed" {

test/sandbox/case/tty.nix

@@ -60,6 +60,7 @@
         "NIXOS" = fs "80001ff" null null;
         "X11" = fs "80001ff" null null;
         "alsa" = fs "80001ff" null null;
+        "bash_logout" = fs "80001ff" null null;
         "bashrc" = fs "80001ff" null null;
         "binfmt.d" = fs "80001ff" null null;
         "dbus-1" = fs "80001ff" null null;
@@ -173,7 +174,15 @@
                   } null;
                 } null;
                 ".local" = fs "800001ed" {
+                  share = fs "800001ed" {
+                    dbus-1 = fs "800001ed" {
+                      services = fs "800001ed" {
+                        "ca.desrt.dconf.service" = fs "80001ff" null null;
+                      } null;
+                    } null;
+                  } null;
                   state = fs "800001ed" {
+                    ".keep" = fs "80001ff" null "";
                     home-manager = fs "800001ed" { gcroots = fs "800001ed" { current-home = fs "80001ff" null null; } null; } null;
                     nix = fs "800001ed" {
                       profiles = fs "800001ed" {

test/test.py

@@ -80,9 +80,6 @@ def fortify(command):
 start_all()
 machine.wait_for_unit("multi-user.target")
 
-# Run fortify Go tests outside of nix build in the background:
-machine.succeed("sudo -u untrusted -i fortify-go-test &> /tmp/go-test &")
-
 # To check fortify's version:
 print(machine.succeed("sudo -u alice -i fortify version"))
 
@@ -90,6 +87,9 @@ print(machine.succeed("sudo -u alice -i fortify version"))
 machine.wait_for_file("/run/user/1000/wayland-1")
 machine.wait_for_file("/tmp/sway-ipc.sock")
 
+# Run fortify Go tests outside of nix build in the background:
+swaymsg("exec fortify-test")
+
 # Deny unmapped uid:
 denyOutput = machine.fail("sudo -u untrusted -i fortify run &>/dev/stdout")
 print(denyOutput)
@@ -206,9 +206,9 @@ machine.wait_until_fails("pgrep foot", timeout=5)
 
 # Test XWayland (foot does not support X):
 swaymsg("exec x11-alacritty")
-wait_for_window(f"u0_a{aid(2)}@machine")
+wait_for_window(f"u0_a{aid(0)}@machine")
 machine.send_chars("clear; glinfo && touch /tmp/x11-ok\n")
-machine.wait_for_file(tmpdir_path(2, "x11-ok"), timeout=15)
+machine.wait_for_file(tmpdir_path(0, "x11-ok"), timeout=15)
 collect_state_ui("alacritty_x11")
 check_state("x11-alacritty", 2)
 machine.send_chars("exit\n")
@@ -255,6 +255,6 @@ machine.wait_for_file("/tmp/sway-exit-ok")
 print(machine.succeed("find /run/user/1000/fortify"))
 
 # Verify go test status:
-machine.wait_for_file("/tmp/go-test", timeout=5)
-print(machine.succeed("cat /tmp/go-test"))
-machine.wait_for_file("/tmp/go-test-ok", timeout=5)
+machine.wait_for_file("/tmp/fortify-test-done")
+print(machine.succeed("cat /tmp/fortify-test.log"))
+machine.wait_for_file("/tmp/fortify-test-ok", timeout=2)