about summary refs log tree commit diff
diff options
context:
space:
mode:
authorVincent Ambo <tazjin@google.com>2020-05-19T17·55+0100
committerVincent Ambo <tazjin@google.com>2020-05-19T17·55+0100
commit867055133d3f487e52dd44149f76347c2c28bf10 (patch)
treec367803ad94f024b0052727a2c7a037af169169a
parentc6a31838cd7e88ebcb01422b329a499d04ab4b6b (diff)
style(3p/nix): Add braces around single-line conditionals r/771
These were not caught by the previous clang-tidy invocation, but were
instead sorted out using amber[0] as such:

    ambr --regex 'if (\(.+\))\s([a-z].*;)' 'if $1 { $2 }'

[0]: https://github.com/dalance/amber
-rw-r--r--third_party/nix/src/build-remote/build-remote.cc16
-rw-r--r--third_party/nix/src/libexpr/attr-path.cc12
-rw-r--r--third_party/nix/src/libexpr/attr-set.hh4
-rw-r--r--third_party/nix/src/libexpr/eval-inline.hh4
-rw-r--r--third_party/nix/src/libexpr/eval.cc132
-rw-r--r--third_party/nix/src/libexpr/get-drvs.cc52
-rw-r--r--third_party/nix/src/libexpr/json-to-value.cc28
-rw-r--r--third_party/nix/src/libexpr/lexer.l8
-rw-r--r--third_party/nix/src/libexpr/names.cc12
-rw-r--r--third_party/nix/src/libexpr/nixexpr.cc36
-rw-r--r--third_party/nix/src/libexpr/parser.y20
-rw-r--r--third_party/nix/src/libexpr/primops.cc104
-rw-r--r--third_party/nix/src/libexpr/primops/context.cc12
-rw-r--r--third_party/nix/src/libexpr/primops/fetchGit.cc12
-rw-r--r--third_party/nix/src/libexpr/primops/fetchMercurial.cc8
-rw-r--r--third_party/nix/src/libexpr/value-to-xml.cc8
-rw-r--r--third_party/nix/src/libmain/common-args.cc4
-rw-r--r--third_party/nix/src/libmain/shared.cc40
-rw-r--r--third_party/nix/src/libmain/shared.hh4
-rw-r--r--third_party/nix/src/libmain/stack.cc16
-rw-r--r--third_party/nix/src/libstore/binary-cache-store.cc32
-rw-r--r--third_party/nix/src/libstore/build.cc324
-rw-r--r--third_party/nix/src/libstore/builtins/buildenv.cc24
-rw-r--r--third_party/nix/src/libstore/builtins/fetchurl.cc4
-rw-r--r--third_party/nix/src/libstore/crypto.cc16
-rw-r--r--third_party/nix/src/libstore/download.cc44
-rw-r--r--third_party/nix/src/libstore/export-import.cc12
-rw-r--r--third_party/nix/src/libstore/gc.cc104
-rw-r--r--third_party/nix/src/libstore/globals.cc8
-rw-r--r--third_party/nix/src/libstore/http-binary-cache-store.cc8
-rw-r--r--third_party/nix/src/libstore/legacy-ssh-store.cc8
-rw-r--r--third_party/nix/src/libstore/local-fs-store.cc8
-rw-r--r--third_party/nix/src/libstore/local-store.cc108
-rw-r--r--third_party/nix/src/libstore/machines.cc4
-rw-r--r--third_party/nix/src/libstore/misc.cc64
-rw-r--r--third_party/nix/src/libstore/nar-accessor.cc24
-rw-r--r--third_party/nix/src/libstore/nar-info-disk-cache.cc20
-rw-r--r--third_party/nix/src/libstore/nar-info.cc56
-rw-r--r--third_party/nix/src/libstore/optimise-store.cc12
-rw-r--r--third_party/nix/src/libstore/parsed-derivations.cc4
-rw-r--r--third_party/nix/src/libstore/pathlocks.cc12
-rw-r--r--third_party/nix/src/libstore/profiles.cc24
-rw-r--r--third_party/nix/src/libstore/references.cc12
-rw-r--r--third_party/nix/src/libstore/remote-fs-accessor.cc12
-rw-r--r--third_party/nix/src/libstore/remote-store.cc72
-rw-r--r--third_party/nix/src/libstore/s3-binary-cache-store.cc16
-rw-r--r--third_party/nix/src/libstore/ssh-store.cc4
-rw-r--r--third_party/nix/src/libstore/ssh.cc18
-rw-r--r--third_party/nix/src/libstore/store-api.cc92
-rw-r--r--third_party/nix/src/libstore/store-api.hh4
-rw-r--r--third_party/nix/src/libutil/archive.cc36
-rw-r--r--third_party/nix/src/libutil/args.cc40
-rw-r--r--third_party/nix/src/libutil/compression.cc12
-rw-r--r--third_party/nix/src/libutil/config.cc24
-rw-r--r--third_party/nix/src/libutil/hash.cc24
-rw-r--r--third_party/nix/src/libutil/json.cc8
-rw-r--r--third_party/nix/src/libutil/lazy.hh4
-rw-r--r--third_party/nix/src/libutil/lru-cache.hh12
-rw-r--r--third_party/nix/src/libutil/monitor-fd.hh8
-rw-r--r--third_party/nix/src/libutil/pool.hh12
-rw-r--r--third_party/nix/src/libutil/ref.hh8
-rw-r--r--third_party/nix/src/libutil/serialise.cc44
-rw-r--r--third_party/nix/src/libutil/thread-pool.cc24
-rw-r--r--third_party/nix/src/libutil/thread-pool.hh12
-rw-r--r--third_party/nix/src/libutil/util.cc256
-rw-r--r--third_party/nix/src/libutil/util.hh4
-rw-r--r--third_party/nix/src/libutil/xml-writer.cc16
-rw-r--r--third_party/nix/src/nix-build/nix-build.cc40
-rw-r--r--third_party/nix/src/nix-channel/nix-channel.cc12
-rw-r--r--third_party/nix/src/nix-collect-garbage/nix-collect-garbage.cc12
-rw-r--r--third_party/nix/src/nix-copy-closure/nix-copy-closure.cc4
-rw-r--r--third_party/nix/src/nix-daemon/nix-daemon.cc92
-rw-r--r--third_party/nix/src/nix-env/nix-env.cc108
-rw-r--r--third_party/nix/src/nix-env/user-env.cc16
-rw-r--r--third_party/nix/src/nix-instantiate/nix-instantiate.cc12
-rw-r--r--third_party/nix/src/nix-prefetch-url/nix-prefetch-url.cc36
-rw-r--r--third_party/nix/src/nix-store/dotgraph.cc6
-rw-r--r--third_party/nix/src/nix-store/graphml.cc4
-rw-r--r--third_party/nix/src/nix-store/nix-store.cc168
-rw-r--r--third_party/nix/src/nix/add-to-store.cc8
-rw-r--r--third_party/nix/src/nix/build.cc8
-rw-r--r--third_party/nix/src/nix/command.cc8
-rw-r--r--third_party/nix/src/nix/command.hh4
-rw-r--r--third_party/nix/src/nix/hash.cc4
-rw-r--r--third_party/nix/src/nix/installables.cc12
-rw-r--r--third_party/nix/src/nix/log.cc8
-rw-r--r--third_party/nix/src/nix/main.cc24
-rw-r--r--third_party/nix/src/nix/path-info.cc16
-rw-r--r--third_party/nix/src/nix/repl.cc56
-rw-r--r--third_party/nix/src/nix/run.cc24
-rw-r--r--third_party/nix/src/nix/search.cc4
-rw-r--r--third_party/nix/src/nix/show-derivation.cc4
-rw-r--r--third_party/nix/src/nix/sigs.cc4
-rw-r--r--third_party/nix/src/nix/upgrade-nix.cc4
-rw-r--r--third_party/nix/src/nix/verify.cc12
-rw-r--r--third_party/nix/src/nix/why-depends.cc16
-rw-r--r--third_party/nix/src/resolve-system-dependencies/resolve-system-dependencies.cc24
97 files changed, 2223 insertions, 753 deletions
diff --git a/third_party/nix/src/build-remote/build-remote.cc b/third_party/nix/src/build-remote/build-remote.cc
index cba4e969a767..dd7aea967923 100644
--- a/third_party/nix/src/build-remote/build-remote.cc
+++ b/third_party/nix/src/build-remote/build-remote.cc
@@ -40,7 +40,9 @@ static AutoCloseFD openSlotLock(const Machine& m, unsigned long long slot) {
 
 static bool allSupportedLocally(const std::set<std::string>& requiredFeatures) {
   for (auto& feature : requiredFeatures)
-    if (!settings.systemFeatures.get().count(feature)) return false;
+    if (!settings.systemFeatures.get().count(feature)) {
+      return false;
+    }
   return true;
 }
 
@@ -50,7 +52,9 @@ static int _main(int argc, char** argv) {
     unsetenv("DISPLAY");
     unsetenv("SSH_ASKPASS");
 
-    if (argc != 2) throw UsageError("called without required arguments");
+    if (argc != 2) {
+      throw UsageError("called without required arguments");
+    }
 
     FdSource source(STDIN_FILENO);
 
@@ -88,7 +92,9 @@ static int _main(int argc, char** argv) {
     while (true) {
       try {
         auto s = readString(source);
-        if (s != "try") return 0;
+        if (s != "try") {
+          return 0;
+        }
       } catch (EndOfFile&) {
         return 0;
       }
@@ -254,7 +260,9 @@ static int _main(int argc, char** argv) {
 
     PathSet missing;
     for (auto& path : outputs)
-      if (!store->isValidPath(path)) missing.insert(path);
+      if (!store->isValidPath(path)) {
+        missing.insert(path);
+      }
 
     if (!missing.empty()) {
       DLOG(INFO) << "copying outputs from '" << storeUri << "'";
diff --git a/third_party/nix/src/libexpr/attr-path.cc b/third_party/nix/src/libexpr/attr-path.cc
index 584f49d124ef..edab0b6df97f 100644
--- a/third_party/nix/src/libexpr/attr-path.cc
+++ b/third_party/nix/src/libexpr/attr-path.cc
@@ -19,14 +19,18 @@ static Strings parseAttrPath(const string& s) {
         if (i == s.end())
           throw Error(format("missing closing quote in selection path '%1%'") %
                       s);
-        if (*i == '"') break;
+        if (*i == '"') {
+          break;
+        }
         cur.push_back(*i++);
       }
     } else
       cur.push_back(*i);
     ++i;
   }
-  if (!cur.empty()) res.push_back(cur);
+  if (!cur.empty()) {
+    res.push_back(cur);
+  }
   return res;
 }
 
@@ -44,7 +48,9 @@ Value* findAlongAttrPath(EvalState& state, const string& attrPath,
     /* Is i an index (integer) or a normal attribute name? */
     enum { apAttr, apIndex } apType = apAttr;
     unsigned int attrIndex;
-    if (string2Int(attr, attrIndex)) apType = apIndex;
+    if (string2Int(attr, attrIndex)) {
+      apType = apIndex;
+    }
 
     /* Evaluate the expression. */
     Value* vNew = state.allocValue();
diff --git a/third_party/nix/src/libexpr/attr-set.hh b/third_party/nix/src/libexpr/attr-set.hh
index e5a888d7e981..74a41a7e5d94 100644
--- a/third_party/nix/src/libexpr/attr-set.hh
+++ b/third_party/nix/src/libexpr/attr-set.hh
@@ -51,7 +51,9 @@ class Bindings {
   iterator find(const Symbol& name) {
     Attr key(name, 0);
     iterator i = std::lower_bound(begin(), end(), key);
-    if (i != end() && i->name == name) return i;
+    if (i != end() && i->name == name) {
+      return i;
+    }
     return end();
   }
 
diff --git a/third_party/nix/src/libexpr/eval-inline.hh b/third_party/nix/src/libexpr/eval-inline.hh
index d92614ca7ca6..ca0cf2a3607a 100644
--- a/third_party/nix/src/libexpr/eval-inline.hh
+++ b/third_party/nix/src/libexpr/eval-inline.hh
@@ -81,7 +81,9 @@ inline void* allocBytes(size_t n) {
 #else
   p = calloc(n, 1);
 #endif
-  if (!p) throw std::bad_alloc();
+  if (!p) {
+    throw std::bad_alloc();
+  }
   return p;
 }
 
diff --git a/third_party/nix/src/libexpr/eval.cc b/third_party/nix/src/libexpr/eval.cc
index 5d6f30c07d0c..a1965e08052b 100644
--- a/third_party/nix/src/libexpr/eval.cc
+++ b/third_party/nix/src/libexpr/eval.cc
@@ -37,7 +37,9 @@ static char* dupString(const char* s) {
 #else
   t = strdup(s);
 #endif
-  if (!t) throw std::bad_alloc();
+  if (!t) {
+    throw std::bad_alloc();
+  }
   return t;
 }
 
@@ -201,7 +203,9 @@ static Symbol getName(const AttrName& name, EvalState& state, Env& env) {
 static bool gcInitialised = false;
 
 void initGC() {
-  if (gcInitialised) return;
+  if (gcInitialised) {
+    return;
+  }
 
 #if HAVE_BOEHMGC
   /* Initialise the Boehm garbage collector. */
@@ -233,8 +237,12 @@ void initGC() {
     size_t maxSize = 384 * 1024 * 1024;
     long pageSize = sysconf(_SC_PAGESIZE);
     long pages = sysconf(_SC_PHYS_PAGES);
-    if (pageSize != -1) size = (pageSize * pages) / 4;  // 25% of RAM
-    if (size > maxSize) size = maxSize;
+    if (pageSize != -1) {
+      size = (pageSize * pages) / 4;
+    }  // 25% of RAM
+    if (size > maxSize) {
+      size = maxSize;
+    }
 #endif
     DLOG(INFO) << "setting initial heap size to " << size << " bytes";
     GC_expand_hp(size);
@@ -257,12 +265,16 @@ static Strings parseNixPath(const string& s) {
     auto start2 = p;
 
     while (p != s.end() && *p != ':') {
-      if (*p == '=') start2 = p + 1;
+      if (*p == '=') {
+        start2 = p + 1;
+      }
       ++p;
     }
 
     if (p == s.end()) {
-      if (p != start) res.push_back(std::string(start, p));
+      if (p != start) {
+        res.push_back(std::string(start, p));
+      }
       break;
     }
 
@@ -272,7 +284,9 @@ static Strings parseNixPath(const string& s) {
         while (p != s.end() && *p != ':') ++p;
       }
       res.push_back(std::string(start, p));
-      if (p == s.end()) break;
+      if (p == s.end()) {
+        break;
+      }
     }
 
     ++p;
@@ -331,7 +345,9 @@ EvalState::EvalState(const Strings& _searchPath, ref<Store> store)
 
     for (auto& i : searchPath) {
       auto r = resolveSearchPathElem(i);
-      if (!r.first) continue;
+      if (!r.first) {
+        continue;
+      }
 
       auto path = r.second;
 
@@ -354,10 +370,14 @@ EvalState::EvalState(const Strings& _searchPath, ref<Store> store)
 EvalState::~EvalState() {}
 
 Path EvalState::checkSourcePath(const Path& path_) {
-  if (!allowedPaths) return path_;
+  if (!allowedPaths) {
+    return path_;
+  }
 
   auto i = resolvedPaths.find(path_);
-  if (i != resolvedPaths.end()) return i->second;
+  if (i != resolvedPaths.end()) {
+    return i->second;
+  }
 
   bool found = false;
 
@@ -394,7 +414,9 @@ Path EvalState::checkSourcePath(const Path& path_) {
 }
 
 void EvalState::checkURI(const std::string& uri) {
-  if (!evalSettings.restrictEval) return;
+  if (!evalSettings.restrictEval) {
+    return;
+  }
 
   /* 'uri' should be equal to a prefix, or in a subdirectory of a
      prefix. Thus, the prefix https://github.co does not permit
@@ -565,7 +587,9 @@ inline Value* EvalState::lookupVar(Env* env, const ExprVar& var, bool noEval) {
     }
     Bindings::iterator j = env->values[0]->attrs->find(var.name);
     if (j != env->values[0]->attrs->end()) {
-      if (countCalls && j->pos) attrSelects[*j->pos]++;
+      if (countCalls && j->pos) {
+        attrSelects[*j->pos]++;
+      }
       return j->value;
     }
     if (!env->prevWith)
@@ -703,7 +727,9 @@ void EvalState::evalFile(const Path& path_, Value& v) {
   Expr* e = nullptr;
 
   auto j = fileParseCache.find(path2);
-  if (j != fileParseCache.end()) e = j->second;
+  if (j != fileParseCache.end()) {
+    e = j->second;
+  }
 
   if (!e) {
     e = parseExprFromFile(checkSourcePath(path2));
@@ -719,7 +745,9 @@ void EvalState::evalFile(const Path& path_, Value& v) {
   }
 
   fileEvalCache[path2] = v;
-  if (path != path2) fileEvalCache[path] = v;
+  if (path != path2) {
+    fileEvalCache[path] = v;
+  }
 }
 
 void EvalState::resetFileCache() {
@@ -831,7 +859,9 @@ void ExprAttrs::eval(EvalState& state, Env& env, Value& v) {
     Value nameVal;
     i.nameExpr->eval(state, *dynamicEnv, nameVal);
     state.forceValue(nameVal, i.pos);
-    if (nameVal.type == tNull) continue;
+    if (nameVal.type == tNull) {
+      continue;
+    }
     state.forceStringNoCtx(nameVal);
     Symbol nameSym = state.symbols.create(nameVal.string.s);
     Bindings::iterator j = v.attrs->find(nameSym);
@@ -923,7 +953,9 @@ void ExprSelect::eval(EvalState& state, Env& env, Value& v) {
       }
       vAttrs = j->value;
       pos2 = j->pos;
-      if (state.countCalls && pos2) state.attrSelects[*pos2]++;
+      if (state.countCalls && pos2) {
+        state.attrSelects[*pos2]++;
+      }
     }
 
     state.forceValue(*vAttrs, (pos2 != NULL ? *pos2 : this->pos));
@@ -999,7 +1031,9 @@ void EvalState::callPrimOp(Value& fun, Value& arg, Value& v, const Pos& pos) {
 
     /* And call the primop. */
     nrPrimOpCalls++;
-    if (countCalls) primOpCalls[primOp->primOp->name]++;
+    if (countCalls) {
+      primOpCalls[primOp->primOp->name]++;
+    }
     primOp->primOp->fun(*this, pos, vArgs, v);
   } else {
     Value* fun2 = allocValue();
@@ -1059,7 +1093,9 @@ void EvalState::callFunction(Value& fun, Value& arg, Value& v, const Pos& pos) {
   } else {
     forceAttrs(arg, pos);
 
-    if (!lambda.arg.empty()) env2.values[displ++] = &arg;
+    if (!lambda.arg.empty()) {
+      env2.values[displ++] = &arg;
+    }
 
     /* For each formal argument, get the actual argument.  If
        there is no matching actual argument but the formal
@@ -1283,7 +1319,9 @@ void EvalState::concatLists(Value& v, size_t nrLists, Value** lists,
   auto out = v.listElems();
   for (size_t n = 0, pos = 0; n < nrLists; ++n) {
     auto l = lists[n]->listSize();
-    if (l) memcpy(out + pos, lists[n]->listElems(), l * sizeof(Value*));
+    if (l) {
+      memcpy(out + pos, lists[n]->listElems(), l * sizeof(Value*));
+    }
     pos += l;
   }
 }
@@ -1361,7 +1399,9 @@ void EvalState::forceValueDeep(Value& v) {
   std::function<void(Value & v)> recurse;
 
   recurse = [&](Value& v) {
-    if (seen.find(&v) != seen.end()) return;
+    if (seen.find(&v) != seen.end()) {
+      return;
+    }
     seen.insert(&v);
 
     forceValue(v);
@@ -1526,11 +1566,21 @@ string EvalState::coerceToString(const Pos& pos, Value& v, PathSet& context,
   if (coerceMore) {
     /* Note that `false' is represented as an empty string for
        shell scripting convenience, just like `null'. */
-    if (v.type == tBool && v.boolean) return "1";
-    if (v.type == tBool && !v.boolean) return "";
-    if (v.type == tInt) return std::to_string(v.integer);
-    if (v.type == tFloat) return std::to_string(v.fpoint);
-    if (v.type == tNull) return "";
+    if (v.type == tBool && v.boolean) {
+      return "1";
+    }
+    if (v.type == tBool && !v.boolean) {
+      return "";
+    }
+    if (v.type == tInt) {
+      return std::to_string(v.integer);
+    }
+    if (v.type == tFloat) {
+      return std::to_string(v.fpoint);
+    }
+    if (v.type == tNull) {
+      return "";
+    }
 
     if (v.isList()) {
       string result;
@@ -1654,7 +1704,9 @@ bool EvalState::eqValues(Value& v1, Value& v2) {
       Bindings::iterator i, j;
       for (i = v1.attrs->begin(), j = v2.attrs->begin(); i != v1.attrs->end();
            ++i, ++j) {
-        if (i->name != j->name || !eqValues(*i->value, *j->value)) return false;
+        if (i->name != j->name || !eqValues(*i->value, *j->value)) {
+          return false;
+        }
       }
 
       return true;
@@ -1697,7 +1749,9 @@ void EvalState::printStats() {
   if (showStats) {
     auto outPath = getEnv("NIX_SHOW_STATS_PATH", "-");
     std::fstream fs;
-    if (outPath != "-") fs.open(outPath, std::fstream::out);
+    if (outPath != "-") {
+      fs.open(outPath, std::fstream::out);
+    }
     JSONObject topObj(outPath == "-" ? std::cerr : fs, true);
     topObj.attr("cpuTime", cpuTime);
     {
@@ -1796,7 +1850,9 @@ size_t valueSize(Value& v) {
   std::set<const void*> seen;
 
   auto doString = [&](const char* s) -> size_t {
-    if (seen.find(s) != seen.end()) return 0;
+    if (seen.find(s) != seen.end()) {
+      return 0;
+    }
     seen.insert(s);
     return strlen(s) + 1;
   };
@@ -1805,7 +1861,9 @@ size_t valueSize(Value& v) {
   std::function<size_t(Env & v)> doEnv;
 
   doValue = [&](Value& v) -> size_t {
-    if (seen.find(&v) != seen.end()) return 0;
+    if (seen.find(&v) != seen.end()) {
+      return 0;
+    }
     seen.insert(&v);
 
     size_t sz = sizeof(Value);
@@ -1851,7 +1909,9 @@ size_t valueSize(Value& v) {
         sz += doValue(*v.primOpApp.right);
         break;
       case tExternal:
-        if (seen.find(v.external) != seen.end()) break;
+        if (seen.find(v.external) != seen.end()) {
+          break;
+        }
         seen.insert(v.external);
         sz += v.external->valueSize(seen);
         break;
@@ -1862,16 +1922,22 @@ size_t valueSize(Value& v) {
   };
 
   doEnv = [&](Env& env) -> size_t {
-    if (seen.find(&env) != seen.end()) return 0;
+    if (seen.find(&env) != seen.end()) {
+      return 0;
+    }
     seen.insert(&env);
 
     size_t sz = sizeof(Env) + sizeof(Value*) * env.size;
 
     if (env.type != Env::HasWithExpr)
       for (size_t i = 0; i < env.size; ++i)
-        if (env.values[i]) sz += doValue(*env.values[i]);
+        if (env.values[i]) {
+          sz += doValue(*env.values[i]);
+        }
 
-    if (env.up) sz += doEnv(*env.up);
+    if (env.up) {
+      sz += doEnv(*env.up);
+    }
 
     return sz;
   };
diff --git a/third_party/nix/src/libexpr/get-drvs.cc b/third_party/nix/src/libexpr/get-drvs.cc
index ad7211eaea5b..ccbb09951f81 100644
--- a/third_party/nix/src/libexpr/get-drvs.cc
+++ b/third_party/nix/src/libexpr/get-drvs.cc
@@ -44,7 +44,9 @@ DrvInfo::DrvInfo(EvalState& state, ref<Store> store,
 string DrvInfo::queryName() const {
   if (name == "" && attrs) {
     auto i = attrs->find(state->sName);
-    if (i == attrs->end()) throw TypeError("derivation name missing");
+    if (i == attrs->end()) {
+      throw TypeError("derivation name missing");
+    }
     name = state->forceStringNoCtx(*i->value);
   }
   return name;
@@ -122,13 +124,19 @@ DrvInfo::Outputs DrvInfo::queryOutputs(bool onlyOutputsToInstall) {
   }
   const auto errMsg = Error("this derivation has bad 'meta.outputsToInstall'");
   /* ^ this shows during `nix-env -i` right under the bad derivation */
-  if (!outTI->isList()) throw errMsg;
+  if (!outTI->isList()) {
+    throw errMsg;
+  }
   Outputs result;
   for (auto i = outTI->listElems(); i != outTI->listElems() + outTI->listSize();
        ++i) {
-    if ((*i)->type != tString) throw errMsg;
+    if ((*i)->type != tString) {
+      throw errMsg;
+    }
     auto out = outputs.find((*i)->string.s);
-    if (out == outputs.end()) throw errMsg;
+    if (out == outputs.end()) {
+      throw errMsg;
+    }
     result.insert(*out);
   }
   return result;
@@ -206,7 +214,9 @@ Value* DrvInfo::queryMeta(const string& name) {
 
 string DrvInfo::queryMetaString(const string& name) {
   Value* v = queryMeta(name);
-  if (!v || v->type != tString) return "";
+  if (!v || v->type != tString) {
+    return "";
+  }
   return v->string.s;
 }
 
@@ -222,7 +232,9 @@ NixInt DrvInfo::queryMetaInt(const string& name, NixInt def) {
     /* Backwards compatibility with before we had support for
        integer meta fields. */
     NixInt n;
-    if (string2Int(v->string.s, n)) return n;
+    if (string2Int(v->string.s, n)) {
+      return n;
+    }
   }
   return def;
 }
@@ -239,7 +251,9 @@ NixFloat DrvInfo::queryMetaFloat(const string& name, NixFloat def) {
     /* Backwards compatibility with before we had support for
        float meta fields. */
     NixFloat n;
-    if (string2Float(v->string.s, n)) return n;
+    if (string2Float(v->string.s, n)) {
+      return n;
+    }
   }
   return def;
 }
@@ -255,8 +269,12 @@ bool DrvInfo::queryMetaBool(const string& name, bool def) {
   if (v->type == tString) {
     /* Backwards compatibility with before we had support for
        Boolean meta fields. */
-    if (strcmp(v->string.s, "true") == 0) return true;
-    if (strcmp(v->string.s, "false") == 0) return false;
+    if (strcmp(v->string.s, "true") == 0) {
+      return true;
+    }
+    if (strcmp(v->string.s, "false") == 0) {
+      return false;
+    }
   }
   return def;
 }
@@ -268,7 +286,9 @@ void DrvInfo::setMeta(const string& name, Value* v) {
   Symbol sym = state->symbols.create(name);
   if (old) {
     for (auto i : *old) {
-      if (i.name != sym) meta->push_back(i);
+      if (i.name != sym) {
+        meta->push_back(i);
+      }
     }
   }
   if (v) {
@@ -295,7 +315,9 @@ static bool getDerivation(EvalState& state, Value& v, const string& attrPath,
 
     /* Remove spurious duplicates (e.g., a set like `rec { x =
        derivation {...}; y = x;}'. */
-    if (done.find(v.attrs) != done.end()) return false;
+    if (done.find(v.attrs) != done.end()) {
+      return false;
+    }
     done.insert(v.attrs);
 
     DrvInfo drv(state, attrPath, v.attrs);
@@ -319,7 +341,9 @@ std::optional<DrvInfo> getDerivation(EvalState& state, Value& v,
   Done done;
   DrvInfos drvs;
   getDerivation(state, v, "", drvs, done, ignoreAssertionFailures);
-  if (drvs.size() != 1) return {};
+  if (drvs.size() != 1) {
+    return {};
+  }
   return std::move(drvs.front());
 }
 
@@ -354,7 +378,9 @@ static void getDerivations(EvalState& state, Value& vIn,
        precedence). */
     for (auto& i : v.attrs->lexicographicOrder()) {
       DLOG(INFO) << "evaluating attribute '" << i->name << "'";
-      if (!std::regex_match(std::string(i->name), attrRegex)) continue;
+      if (!std::regex_match(std::string(i->name), attrRegex)) {
+        continue;
+      }
       string pathPrefix2 = addToPath(pathPrefix, i->name);
       if (combineChannels)
         getDerivations(state, *i->value, pathPrefix2, autoArgs, drvs, done,
diff --git a/third_party/nix/src/libexpr/json-to-value.cc b/third_party/nix/src/libexpr/json-to-value.cc
index 8d84a5ac6901..a7d9c4904c8e 100644
--- a/third_party/nix/src/libexpr/json-to-value.cc
+++ b/third_party/nix/src/libexpr/json-to-value.cc
@@ -12,9 +12,13 @@ static void skipWhitespace(const char*& s) {
 
 static string parseJSONString(const char*& s) {
   string res;
-  if (*s++ != '"') throw JSONParseError("expected JSON string");
+  if (*s++ != '"') {
+    throw JSONParseError("expected JSON string");
+  }
   while (*s != '"') {
-    if (!*s) throw JSONParseError("got end-of-string in JSON string");
+    if (!*s) {
+      throw JSONParseError("got end-of-string in JSON string");
+    }
     if (*s == '\\') {
       s++;
       if (*s == '"')
@@ -52,7 +56,9 @@ static string parseJSONString(const char*& s) {
 static void parseJSON(EvalState& state, const char*& s, Value& v) {
   skipWhitespace(s);
 
-  if (!*s) throw JSONParseError("expected JSON value");
+  if (!*s) {
+    throw JSONParseError("expected JSON value");
+  }
 
   if (*s == '[') {
     s++;
@@ -60,7 +66,9 @@ static void parseJSON(EvalState& state, const char*& s, Value& v) {
     values.reserve(128);
     skipWhitespace(s);
     while (1) {
-      if (values.empty() && *s == ']') break;
+      if (values.empty() && *s == ']') {
+        break;
+      }
       Value* v2 = state.allocValue();
       parseJSON(state, s, *v2);
       values.push_back(v2);
@@ -82,10 +90,14 @@ static void parseJSON(EvalState& state, const char*& s, Value& v) {
     ValueMap attrs;
     while (1) {
       skipWhitespace(s);
-      if (attrs.empty() && *s == '}') break;
+      if (attrs.empty() && *s == '}') {
+        break;
+      }
       string name = parseJSONString(s);
       skipWhitespace(s);
-      if (*s != ':') throw JSONParseError("expected ':' in JSON object");
+      if (*s != ':') {
+        throw JSONParseError("expected ':' in JSON object");
+      }
       s++;
       Value* v2 = state.allocValue();
       parseJSON(state, s, *v2);
@@ -114,7 +126,9 @@ static void parseJSON(EvalState& state, const char*& s, Value& v) {
     ValueType number_type = tInt;
 
     while (isdigit(*s) || *s == '-' || *s == '.' || *s == 'e' || *s == 'E') {
-      if (*s == '.' || *s == 'e' || *s == 'E') number_type = tFloat;
+      if (*s == '.' || *s == 'e' || *s == 'E') {
+        number_type = tFloat;
+      }
       tmp_number += *s++;
     }
 
diff --git a/third_party/nix/src/libexpr/lexer.l b/third_party/nix/src/libexpr/lexer.l
index c34e5c383923..a0d6bd7e163c 100644
--- a/third_party/nix/src/libexpr/lexer.l
+++ b/third_party/nix/src/libexpr/lexer.l
@@ -60,15 +60,15 @@ static Expr * unescapeStr(SymbolTable & symbols, const char * s, size_t length)
         if (c == '\\') {
             assert(*s);
             c = *s++;
-            if (c == 'n') t += '\n';
-            else if (c == 'r') t += '\r';
-            else if (c == 't') t += '\t';
+            if (c == 'n') { t += '\n'; }
+            else if (c == 'r') { t += '\r'; }
+            else if (c == 't') { t += '\t'; }
             else t += c;
         }
         else if (c == '\r') {
             /* Normalise CR and CR/LF into LF. */
             t += '\n';
-            if (*s == '\n') s++; /* cr/lf */
+            if (*s == '\n') { s++; } /* cr/lf */
         }
         else t += c;
     }
diff --git a/third_party/nix/src/libexpr/names.cc b/third_party/nix/src/libexpr/names.cc
index f7752f2bf804..92bd06308c69 100644
--- a/third_party/nix/src/libexpr/names.cc
+++ b/third_party/nix/src/libexpr/names.cc
@@ -28,9 +28,13 @@ bool DrvName::matches(DrvName& n) {
     if (!regex)
       regex = std::unique_ptr<std::regex>(
           new std::regex(name, std::regex::extended));
-    if (!std::regex_match(n.name, *regex)) return false;
+    if (!std::regex_match(n.name, *regex)) {
+      return false;
+    }
+  }
+  if (version != "" && version != n.version) {
+    return false;
   }
-  if (version != "" && version != n.version) return false;
   return true;
 }
 
@@ -39,7 +43,9 @@ string nextComponent(string::const_iterator& p,
   /* Skip any dots and dashes (component separators). */
   while (p != end && (*p == '.' || *p == '-')) ++p;
 
-  if (p == end) return "";
+  if (p == end) {
+    return "";
+  }
 
   /* If the first character is a digit, consume the longest sequence
      of digits.  Otherwise, consume the longest sequence of
diff --git a/third_party/nix/src/libexpr/nixexpr.cc b/third_party/nix/src/libexpr/nixexpr.cc
index 9c25530efdba..4c0536f35cc1 100644
--- a/third_party/nix/src/libexpr/nixexpr.cc
+++ b/third_party/nix/src/libexpr/nixexpr.cc
@@ -70,7 +70,9 @@ void ExprVar::show(std::ostream& str) const { str << name; }
 
 void ExprSelect::show(std::ostream& str) const {
   str << "(" << *e << ")." << showAttrPath(attrPath);
-  if (def) str << " or (" << *def << ")";
+  if (def) {
+    str << " or (" << *def << ")";
+  }
 }
 
 void ExprOpHasAttr::show(std::ostream& str) const {
@@ -78,7 +80,9 @@ void ExprOpHasAttr::show(std::ostream& str) const {
 }
 
 void ExprAttrs::show(std::ostream& str) const {
-  if (recursive) str << "rec ";
+  if (recursive) {
+    str << "rec ";
+  }
   str << "{ ";
   for (auto& i : attrs)
     if (i.second.inherited)
@@ -108,16 +112,24 @@ void ExprLambda::show(std::ostream& str) const {
       else
         str << ", ";
       str << i.name;
-      if (i.def) str << " ? " << *i.def;
+      if (i.def) {
+        str << " ? " << *i.def;
+      }
     }
     if (formals->ellipsis) {
-      if (!first) str << ", ";
+      if (!first) {
+        str << ", ";
+      }
       str << "...";
     }
     str << " }";
-    if (!arg.empty()) str << " @ ";
+    if (!arg.empty()) {
+      str << " @ ";
+    }
+  }
+  if (!arg.empty()) {
+    str << arg;
   }
-  if (!arg.empty()) str << arg;
   str << ": " << *body << ")";
 }
 
@@ -239,13 +251,17 @@ void ExprSelect::bindVars(const StaticEnv& env) {
     def->bindVars(env);
   }
   for (auto& i : attrPath)
-    if (!i.symbol.set()) i.expr->bindVars(env);
+    if (!i.symbol.set()) {
+      i.expr->bindVars(env);
+    }
 }
 
 void ExprOpHasAttr::bindVars(const StaticEnv& env) {
   e->bindVars(env);
   for (auto& i : attrPath)
-    if (!i.symbol.set()) i.expr->bindVars(env);
+    if (!i.symbol.set()) {
+      i.expr->bindVars(env);
+    }
 }
 
 void ExprAttrs::bindVars(const StaticEnv& env) {
@@ -296,7 +312,9 @@ void ExprLambda::bindVars(const StaticEnv& env) {
     }
 
     for (auto& i : formals->formals)
-      if (i.def) i.def->bindVars(newEnv);
+      if (i.def) {
+        i.def->bindVars(newEnv);
+      }
   }
 
   body->bindVars(newEnv);
diff --git a/third_party/nix/src/libexpr/parser.y b/third_party/nix/src/libexpr/parser.y
index ddcd1a4dae74..5aa38bf2b82c 100644
--- a/third_party/nix/src/libexpr/parser.y
+++ b/third_party/nix/src/libexpr/parser.y
@@ -89,7 +89,7 @@ static void addAttr(ExprAttrs * attrs, AttrPath & attrPath,
             if (j != attrs->attrs.end()) {
                 if (!j->second.inherited) {
                     ExprAttrs * attrs2 = dynamic_cast<ExprAttrs *>(j->second.e);
-                    if (!attrs2) dupAttr(attrPath, pos, j->second.pos);
+                    if (!attrs2) { dupAttr(attrPath, pos, j->second.pos); }
                     attrs = attrs2;
                 } else
                     dupAttr(attrPath, pos, j->second.pos);
@@ -148,7 +148,7 @@ static void addFormal(const Pos & pos, Formals * formals, const Formal & formal)
 
 static Expr * stripIndentation(const Pos & pos, SymbolTable & symbols, vector<Expr *> & es)
 {
-    if (es.empty()) return new ExprString(symbols.create(""));
+    if (es.empty()) { return new ExprString(symbols.create("")); }
 
     /* Figure out the minimum indentation.  Note that by design
        whitespace-only final lines are not taken into account.  (So
@@ -162,7 +162,7 @@ static Expr * stripIndentation(const Pos & pos, SymbolTable & symbols, vector<Ex
             /* Anti-quotations end the current start-of-line whitespace. */
             if (atStartOfLine) {
                 atStartOfLine = false;
-                if (curIndent < minIndent) minIndent = curIndent;
+                if (curIndent < minIndent) { minIndent = curIndent; }
             }
             continue;
         }
@@ -176,7 +176,7 @@ static Expr * stripIndentation(const Pos & pos, SymbolTable & symbols, vector<Ex
                     curIndent = 0;
                 } else {
                     atStartOfLine = false;
-                    if (curIndent < minIndent) minIndent = curIndent;
+                    if (curIndent < minIndent) { minIndent = curIndent; }
                 }
             } else if (e->s[j] == '\n') {
                 atStartOfLine = true;
@@ -216,7 +216,7 @@ static Expr * stripIndentation(const Pos & pos, SymbolTable & symbols, vector<Ex
                 }
             } else {
                 s2 += e->s[j];
-                if (e->s[j] == '\n') atStartOfLine = true;
+                if (e->s[j] == '\n') { atStartOfLine = true; }
             }
         }
 
@@ -559,7 +559,7 @@ Expr * EvalState::parse(const char * text,
     int res = yyparse(scanner, &data);
     yylex_destroy(scanner);
 
-    if (res) throw ParseError(data.error);
+    if (res) { throw ParseError(data.error); }
 
     data.result->bindVars(staticEnv);
 
@@ -577,7 +577,7 @@ Path resolveExprPath(Path path)
     while (true) {
         if (lstat(path.c_str(), &st))
             throw SysError(format("getting status of '%1%'") % path);
-        if (!S_ISLNK(st.st_mode)) break;
+        if (!S_ISLNK(st.st_mode)) { break; }
         path = absPath(readLink(path), dirOf(path));
     }
 
@@ -656,9 +656,9 @@ Path EvalState::findFile(SearchPath & searchPath, const string & path, const Pos
             suffix = path.size() == s ? "" : "/" + string(path, s);
         }
         auto r = resolveSearchPathElem(i);
-        if (!r.first) continue;
+        if (!r.first) { continue; }
         Path res = r.second + suffix;
-        if (pathExists(res)) return canonPath(res);
+        if (pathExists(res)) { return canonPath(res); }
     }
     format f = format(
         "file '%1%' was not found in the Nix search path (add it using $NIX_PATH or -I)"
@@ -671,7 +671,7 @@ Path EvalState::findFile(SearchPath & searchPath, const string & path, const Pos
 std::pair<bool, std::string> EvalState::resolveSearchPathElem(const SearchPathElem & elem)
 {
     auto i = searchPathResolved.find(elem.second);
-    if (i != searchPathResolved.end()) return i->second;
+    if (i != searchPathResolved.end()) { return i->second; }
 
     std::pair<bool, std::string> res;
 
diff --git a/third_party/nix/src/libexpr/primops.cc b/third_party/nix/src/libexpr/primops.cc
index 3e11d6589f6a..dfcfdeae431c 100644
--- a/third_party/nix/src/libexpr/primops.cc
+++ b/third_party/nix/src/libexpr/primops.cc
@@ -51,7 +51,9 @@ void EvalState::realiseContext(const PathSet& context) {
     std::pair<string, string> decoded = decodeContext(i);
     Path ctx = decoded.first;
     assert(store->isStorePath(ctx));
-    if (!store->isValidPath(ctx)) throw InvalidPathError(ctx);
+    if (!store->isValidPath(ctx)) {
+      throw InvalidPathError(ctx);
+    }
     if (!decoded.second.empty() && nix::isDerivation(ctx)) {
       drvs.insert(decoded.first + "!" + decoded.second);
 
@@ -68,7 +70,9 @@ void EvalState::realiseContext(const PathSet& context) {
     }
   }
 
-  if (drvs.empty()) return;
+  if (drvs.empty()) {
+    return;
+  }
 
   if (!evalSettings.enableImportFromDerivation)
     throw EvalError(format("attempted to realize '%1%' during evaluation but "
@@ -417,7 +421,9 @@ static void prim_genericClosure(EvalState& state, const Pos& pos, Value** args,
       throw EvalError(format("attribute 'key' required, at %1%") % pos);
     state.forceValue(*key->value);
 
-    if (doneKeys.find(key->value) != doneKeys.end()) continue;
+    if (doneKeys.find(key->value) != doneKeys.end()) {
+      continue;
+    }
     doneKeys.insert(key->value);
     res.push_back(e);
 
@@ -583,7 +589,9 @@ static void prim_derivationStrict(EvalState& state, const Pos& pos,
   outputs.insert("out");
 
   for (auto& i : args[0]->attrs->lexicographicOrder()) {
-    if (i->name == state.sIgnoreNulls) continue;
+    if (i->name == state.sIgnoreNulls) {
+      continue;
+    }
     const string& key = i->name;
 
     auto handleHashMode = [&](const std::string& s) {
@@ -623,7 +631,9 @@ static void prim_derivationStrict(EvalState& state, const Pos& pos,
     try {
       if (ignoreNulls) {
         state.forceValue(*i->value);
-        if (i->value->type == tNull) continue;
+        if (i->value->type == tNull) {
+          continue;
+        }
       }
 
       /* The `args' attribute is special: it supplies the
@@ -641,7 +651,9 @@ static void prim_derivationStrict(EvalState& state, const Pos& pos,
          the environment. */
       else {
         if (jsonObject) {
-          if (i->name == state.sStructuredAttrs) continue;
+          if (i->name == state.sStructuredAttrs) {
+            continue;
+          }
 
           auto placeholder(jsonObject->placeholder(key));
           printValueAsJSON(state, true, *i->value, placeholder, context);
@@ -758,7 +770,9 @@ static void prim_derivationStrict(EvalState& state, const Pos& pos,
 
     Path outPath =
         state.store->makeFixedOutputPath(outputHashRecursive, h, drvName);
-    if (!jsonObject) drv.env["out"] = outPath;
+    if (!jsonObject) {
+      drv.env["out"] = outPath;
+    }
     drv.outputs["out"] = DerivationOutput(
         outPath, (outputHashRecursive ? "r:" : "") + printHashType(h.type),
         h.to_string(Base16, false));
@@ -771,7 +785,9 @@ static void prim_derivationStrict(EvalState& state, const Pos& pos,
        an empty value.  This ensures that changes in the set of
        output names do get reflected in the hash. */
     for (auto& i : outputs) {
-      if (!jsonObject) drv.env[i] = "";
+      if (!jsonObject) {
+        drv.env[i] = "";
+      }
       drv.outputs[i] = DerivationOutput("", "", "");
     }
 
@@ -782,7 +798,9 @@ static void prim_derivationStrict(EvalState& state, const Pos& pos,
     for (auto& i : drv.outputs)
       if (i.second.path == "") {
         Path outPath = state.store->makeOutputPath(i.first, h, drvName);
-        if (!jsonObject) drv.env[i.first] = outPath;
+        if (!jsonObject) {
+          drv.env[i.first] = outPath;
+        }
         i.second.path = outPath;
       }
   }
@@ -845,12 +863,16 @@ static void prim_storePath(EvalState& state, const Pos& pos, Value** args,
   /* Resolve symlinks in ‘path’, unless ‘path’ itself is a symlink
      directly in the store.  The latter condition is necessary so
      e.g. nix-push does the right thing. */
-  if (!state.store->isStorePath(path)) path = canonPath(path, true);
+  if (!state.store->isStorePath(path)) {
+    path = canonPath(path, true);
+  }
   if (!state.store->isInStore(path))
     throw EvalError(format("path '%1%' is not in the Nix store, at %2%") %
                     path % pos);
   Path path2 = state.store->toStorePath(path);
-  if (!settings.readOnlyMode) state.store->ensurePath(path2);
+  if (!settings.readOnlyMode) {
+    state.store->ensurePath(path2);
+  }
   context.insert(path2);
   mkString(v, path, context);
 }
@@ -936,7 +958,9 @@ static void prim_findFile(EvalState& state, const Pos& pos, Value** args,
 
     string prefix;
     Bindings::iterator i = v2.attrs->find(state.symbols.create("prefix"));
-    if (i != v2.attrs->end()) prefix = state.forceStringNoCtx(*i->value, pos);
+    if (i != v2.attrs->end()) {
+      prefix = state.forceStringNoCtx(*i->value, pos);
+    }
 
     i = v2.attrs->find(state.symbols.create("path"));
     if (i == v2.attrs->end())
@@ -995,7 +1019,9 @@ static void prim_readDir(EvalState& state, const Pos& pos, Value** args,
 
   for (auto& ent : entries) {
     Value* ent_val = state.allocAttr(v, state.symbols.create(ent.name));
-    if (ent.type == DT_UNKNOWN) ent.type = getFileType(path + "/" + ent.name);
+    if (ent.type == DT_UNKNOWN) {
+      ent.type = getFileType(path + "/" + ent.name);
+    }
     mkStringNoCopy(*ent_val,
                    ent.type == DT_REG
                        ? "regular"
@@ -1178,8 +1204,12 @@ static void prim_path(EvalState& state, const Pos& pos, Value** args,
           format("unsupported argument '%1%' to 'addPath', at %2%") %
           attr.name % *attr.pos);
   }
-  if (path.empty()) throw EvalError(format("'path' required, at %1%") % pos);
-  if (name.empty()) name = baseNameOf(path);
+  if (path.empty()) {
+    throw EvalError(format("'path' required, at %1%") % pos);
+  }
+  if (name.empty()) {
+    name = baseNameOf(path);
+  }
 
   addPath(state, pos, name, path, filterFun, recursive, expectedHash, v);
 }
@@ -1236,7 +1266,9 @@ void prim_getAttr(EvalState& state, const Pos& pos, Value** args, Value& v) {
   if (i == args[1]->attrs->end())
     throw EvalError(format("attribute '%1%' missing, at %2%") % attr % pos);
   // !!! add to stack trace?
-  if (state.countCalls && i->pos) state.attrSelects[*i->pos]++;
+  if (state.countCalls && i->pos) {
+    state.attrSelects[*i->pos]++;
+  }
   state.forceValue(*i->value);
   v = *i->value;
 }
@@ -1287,7 +1319,9 @@ static void prim_removeAttrs(EvalState& state, const Pos& pos, Value** args,
      vector. */
   state.mkAttrs(v, args[0]->attrs->size());
   for (auto& i : *args[0]->attrs) {
-    if (names.find(i.name) == names.end()) v.attrs->push_back(i);
+    if (names.find(i.name) == names.end()) {
+      v.attrs->push_back(i);
+    }
   }
 }
 
@@ -1673,12 +1707,16 @@ static void prim_partition(EvalState& state, const Pos& pos, Value** args,
   Value* vRight = state.allocAttr(v, state.sRight);
   auto rsize = right.size();
   state.mkList(*vRight, rsize);
-  if (rsize) memcpy(vRight->listElems(), right.data(), sizeof(Value*) * rsize);
+  if (rsize) {
+    memcpy(vRight->listElems(), right.data(), sizeof(Value*) * rsize);
+  }
 
   Value* vWrong = state.allocAttr(v, state.sWrong);
   auto wsize = wrong.size();
   state.mkList(*vWrong, wsize);
-  if (wsize) memcpy(vWrong->listElems(), wrong.data(), sizeof(Value*) * wsize);
+  if (wsize) {
+    memcpy(vWrong->listElems(), wrong.data(), sizeof(Value*) * wsize);
+  }
 
   v.attrs->sort();
 }
@@ -1705,7 +1743,9 @@ static void prim_concatMap(EvalState& state, const Pos& pos, Value** args,
   auto out = v.listElems();
   for (unsigned int n = 0, pos = 0; n < nrLists; ++n) {
     auto l = lists[n].listSize();
-    if (l) memcpy(out + pos, lists[n].listElems(), l * sizeof(Value*));
+    if (l) {
+      memcpy(out + pos, lists[n].listElems(), l * sizeof(Value*));
+    }
     pos += l;
   }
 }
@@ -1752,7 +1792,9 @@ static void prim_div(EvalState& state, const Pos& pos, Value** args, Value& v) {
   state.forceValue(*args[1], pos);
 
   NixFloat f2 = state.forceFloat(*args[1], pos);
-  if (f2 == 0) throw EvalError(format("division by zero, at %1%") % pos);
+  if (f2 == 0) {
+    throw EvalError(format("division by zero, at %1%") % pos);
+  }
 
   if (args[0]->type == tFloat || args[1]->type == tFloat) {
     mkFloat(v,
@@ -2012,7 +2054,9 @@ static void prim_replaceStrings(EvalState& state, const Pos& pos, Value** args,
         found = true;
         res += j->first;
         if (i->empty()) {
-          if (p < s.size()) res += s[p];
+          if (p < s.size()) {
+            res += s[p];
+          }
           p++;
         } else {
           p += i->size();
@@ -2022,7 +2066,9 @@ static void prim_replaceStrings(EvalState& state, const Pos& pos, Value** args,
         break;
       }
     if (!found) {
-      if (p < s.size()) res += s[p];
+      if (p < s.size()) {
+        res += s[p];
+      }
       p++;
     }
   }
@@ -2059,7 +2105,9 @@ static void prim_splitVersion(EvalState& state, const Pos& pos, Value** args,
   Strings components;
   while (iter != version.cend()) {
     auto component = nextComponent(iter, version.cend());
-    if (component.empty()) break;
+    if (component.empty()) {
+      break;
+    }
     components.emplace_back(std::move(component));
   }
   state.mkList(v, components.size());
@@ -2114,7 +2162,9 @@ void fetch(EvalState& state, const Pos& pos, Value** args, Value& v,
 
   auto res = getDownloader()->downloadCached(state.store, request);
 
-  if (state.allowedPaths) state.allowedPaths->insert(res.path);
+  if (state.allowedPaths) {
+    state.allowedPaths->insert(res.path);
+  }
 
   mkString(v, res.storePath, PathSet({res.storePath}));
 }
@@ -2136,7 +2186,9 @@ static void prim_fetchTarball(EvalState& state, const Pos& pos, Value** args,
 RegisterPrimOp::PrimOps* RegisterPrimOp::primOps;
 
 RegisterPrimOp::RegisterPrimOp(std::string name, size_t arity, PrimOpFun fun) {
-  if (!primOps) primOps = new PrimOps;
+  if (!primOps) {
+    primOps = new PrimOps;
+  }
   primOps->emplace_back(name, arity, fun);
 }
 
diff --git a/third_party/nix/src/libexpr/primops/context.cc b/third_party/nix/src/libexpr/primops/context.cc
index 13faeef8ce9c..1ae3219f2c61 100644
--- a/third_party/nix/src/libexpr/primops/context.cc
+++ b/third_party/nix/src/libexpr/primops/context.cc
@@ -111,7 +111,9 @@ static void prim_getContext(EvalState& state, const Pos& pos, Value** args,
   for (const auto& info : contextInfos) {
     auto& infoVal = *state.allocAttr(v, state.symbols.create(info.first));
     state.mkAttrs(infoVal, 3);
-    if (info.second.path) mkBool(*state.allocAttr(infoVal, sPath), true);
+    if (info.second.path) {
+      mkBool(*state.allocAttr(infoVal, sPath), true);
+    }
     if (info.second.allOutputs)
       mkBool(*state.allocAttr(infoVal, sAllOutputs), true);
     if (!info.second.outputs.empty()) {
@@ -147,11 +149,15 @@ static void prim_appendContext(EvalState& state, const Pos& pos, Value** args,
     if (!state.store->isStorePath(i.name))
       throw EvalError("Context key '%s' is not a store path, at %s", i.name,
                       i.pos);
-    if (!settings.readOnlyMode) state.store->ensurePath(i.name);
+    if (!settings.readOnlyMode) {
+      state.store->ensurePath(i.name);
+    }
     state.forceAttrs(*i.value, *i.pos);
     auto iter = i.value->attrs->find(sPath);
     if (iter != i.value->attrs->end()) {
-      if (state.forceBool(*iter->value, *iter->pos)) context.insert(i.name);
+      if (state.forceBool(*iter->value, *iter->pos)) {
+        context.insert(i.name);
+      }
     }
 
     iter = i.value->attrs->find(sAllOutputs);
diff --git a/third_party/nix/src/libexpr/primops/fetchGit.cc b/third_party/nix/src/libexpr/primops/fetchGit.cc
index 7fbd4dc92cf0..818a475f5ecd 100644
--- a/third_party/nix/src/libexpr/primops/fetchGit.cc
+++ b/third_party/nix/src/libexpr/primops/fetchGit.cc
@@ -37,7 +37,9 @@ GitInfo exportGit(ref<Store> store, const std::string& uri,
       runProgram("git", true,
                  {"-C", uri, "diff-index", "--quiet", "HEAD", "--"});
     } catch (ExecError& e) {
-      if (!WIFEXITED(e.status) || WEXITSTATUS(e.status) != 1) throw;
+      if (!WIFEXITED(e.status) || WEXITSTATUS(e.status) != 1) {
+        throw;
+      }
       clean = false;
     }
 
@@ -78,7 +80,9 @@ GitInfo exportGit(ref<Store> store, const std::string& uri,
     ref = "HEAD"s;
   }
 
-  if (!ref) ref = "HEAD"s;
+  if (!ref) {
+    ref = "HEAD"s;
+  }
 
   if (rev != "" && !std::regex_match(rev, revRegex))
     throw Error("invalid Git revision '%s'", rev);
@@ -166,7 +170,9 @@ GitInfo exportGit(ref<Store> store, const std::string& uri,
     }
 
   } catch (SysError& e) {
-    if (e.errNo != ENOENT) throw;
+    if (e.errNo != ENOENT) {
+      throw;
+    }
   }
 
   // FIXME: should pipe this, or find some better way to extract a
diff --git a/third_party/nix/src/libexpr/primops/fetchMercurial.cc b/third_party/nix/src/libexpr/primops/fetchMercurial.cc
index 3de42fe770dc..392dbcb00837 100644
--- a/third_party/nix/src/libexpr/primops/fetchMercurial.cc
+++ b/third_party/nix/src/libexpr/primops/fetchMercurial.cc
@@ -73,7 +73,9 @@ HgInfo exportMercurial(ref<Store> store, const std::string& uri,
     }
   }
 
-  if (rev == "") rev = "default";
+  if (rev == "") {
+    rev = "default";
+  }
 
   Path cacheDir = fmt("%s/nix/hg/%s", getCacheDir(),
                       hashString(htSHA256, uri).to_string(Base32, false));
@@ -149,7 +151,9 @@ HgInfo exportMercurial(ref<Store> store, const std::string& uri,
     }
 
   } catch (SysError& e) {
-    if (e.errNo != ENOENT) throw;
+    if (e.errNo != ENOENT) {
+      throw;
+    }
   }
 
   Path tmpDir = createTempDir();
diff --git a/third_party/nix/src/libexpr/value-to-xml.cc b/third_party/nix/src/libexpr/value-to-xml.cc
index 6247d25b9c34..0e955c4ce267 100644
--- a/third_party/nix/src/libexpr/value-to-xml.cc
+++ b/third_party/nix/src/libexpr/value-to-xml.cc
@@ -36,7 +36,9 @@ static void showAttrs(EvalState& state, bool strict, bool location,
 
     XMLAttrs xmlAttrs;
     xmlAttrs["name"] = i;
-    if (location && a.pos != &noPos) posToXML(xmlAttrs, *a.pos);
+    if (location && a.pos != &noPos) {
+      posToXML(xmlAttrs, *a.pos);
+    }
 
     XMLOpenElement _(doc, "attr", xmlAttrs);
     printValueAsXML(state, strict, location, *a.value, doc, context, drvsSeen);
@@ -132,7 +134,9 @@ static void printValueAsXML(EvalState& state, bool strict, bool location,
 
     case tLambda: {
       XMLAttrs xmlAttrs;
-      if (location) posToXML(xmlAttrs, v.lambda.fun->pos);
+      if (location) {
+        posToXML(xmlAttrs, v.lambda.fun->pos);
+      }
       XMLOpenElement _(doc, "function", xmlAttrs);
 
       if (v.lambda.fun->matchAttrs) {
diff --git a/third_party/nix/src/libmain/common-args.cc b/third_party/nix/src/libmain/common-args.cc
index 9863eda63bf1..9d6f6445c0e7 100644
--- a/third_party/nix/src/libmain/common-args.cc
+++ b/third_party/nix/src/libmain/common-args.cc
@@ -32,7 +32,9 @@ MixCommonArgs::MixCommonArgs(const string& programName)
   globalConfig.convertToArgs(*this, cat);
 
   // Backward compatibility hack: nix-env already had a --system flag.
-  if (programName == "nix-env") longFlags.erase("system");
+  if (programName == "nix-env") {
+    longFlags.erase("system");
+  }
 
   hiddenCategories.insert(cat);
 }
diff --git a/third_party/nix/src/libmain/shared.cc b/third_party/nix/src/libmain/shared.cc
index dfa5be08979e..3df83733ad08 100644
--- a/third_party/nix/src/libmain/shared.cc
+++ b/third_party/nix/src/libmain/shared.cc
@@ -128,11 +128,15 @@ void initNix() {
   sigemptyset(&act.sa_mask);
   act.sa_handler = SIG_DFL;
   act.sa_flags = 0;
-  if (sigaction(SIGCHLD, &act, 0)) throw SysError("resetting SIGCHLD");
+  if (sigaction(SIGCHLD, &act, 0)) {
+    throw SysError("resetting SIGCHLD");
+  }
 
   /* Install a dummy SIGUSR1 handler for use with pthread_kill(). */
   act.sa_handler = sigHandler;
-  if (sigaction(SIGUSR1, &act, 0)) throw SysError("handling SIGUSR1");
+  if (sigaction(SIGUSR1, &act, 0)) {
+    throw SysError("handling SIGUSR1");
+  }
 
 #if __APPLE__
   /* HACK: on darwin, we need can’t use sigprocmask with SIGWINCH.
@@ -140,7 +144,9 @@ void initNix() {
    * can handle the rest. */
   struct sigaction sa;
   sa.sa_handler = sigHandler;
-  if (sigaction(SIGWINCH, &sa, 0)) throw SysError("handling SIGWINCH");
+  if (sigaction(SIGWINCH, &sa, 0)) {
+    throw SysError("handling SIGWINCH");
+  }
 #endif
 
   /* Register a SIGSEGV handler to detect stack overflows. */
@@ -223,14 +229,18 @@ LegacyArgs::LegacyArgs(
 }
 
 bool LegacyArgs::processFlag(Strings::iterator& pos, Strings::iterator end) {
-  if (MixCommonArgs::processFlag(pos, end)) return true;
+  if (MixCommonArgs::processFlag(pos, end)) {
+    return true;
+  }
   bool res = parseArg(pos, end);
   if (res) ++pos;
   return res;
 }
 
 bool LegacyArgs::processArgs(const Strings& args, bool finish) {
-  if (args.empty()) return true;
+  if (args.empty()) {
+    return true;
+  }
   assert(args.size() == 1);
   Strings ss(args);
   auto pos = ss.begin();
@@ -321,10 +331,16 @@ int handleExceptions(const string& programName, std::function<void()> fun) {
 }
 
 RunPager::RunPager() {
-  if (!isatty(STDOUT_FILENO)) return;
+  if (!isatty(STDOUT_FILENO)) {
+    return;
+  }
   char* pager = getenv("NIX_PAGER");
-  if (!pager) pager = getenv("PAGER");
-  if (pager && ((string)pager == "" || (string)pager == "cat")) return;
+  if (!pager) {
+    pager = getenv("PAGER");
+  }
+  if (pager && ((string)pager == "" || (string)pager == "cat")) {
+    return;
+  }
 
   Pipe toPager;
   toPager.create();
@@ -332,9 +348,13 @@ RunPager::RunPager() {
   pid = startProcess([&]() {
     if (dup2(toPager.readSide.get(), STDIN_FILENO) == -1)
       throw SysError("dupping stdin");
-    if (!getenv("LESS")) setenv("LESS", "FRSXMK", 1);
+    if (!getenv("LESS")) {
+      setenv("LESS", "FRSXMK", 1);
+    }
     restoreSignals();
-    if (pager) execl("/bin/sh", "sh", "-c", pager, nullptr);
+    if (pager) {
+      execl("/bin/sh", "sh", "-c", pager, nullptr);
+    }
     execlp("pager", "pager", nullptr);
     execlp("less", "less", nullptr);
     execlp("more", "more", nullptr);
diff --git a/third_party/nix/src/libmain/shared.hh b/third_party/nix/src/libmain/shared.hh
index e5f4bec6482e..db236a701778 100644
--- a/third_party/nix/src/libmain/shared.hh
+++ b/third_party/nix/src/libmain/shared.hh
@@ -53,7 +53,9 @@ template <class N>
 N getIntArg(const string& opt, Strings::iterator& i,
             const Strings::iterator& end, bool allowUnit) {
   ++i;
-  if (i == end) throw UsageError(format("'%1%' requires an argument") % opt);
+  if (i == end) {
+    throw UsageError(format("'%1%' requires an argument") % opt);
+  }
   string s = *i;
   N multiplier = 1;
   if (allowUnit && !s.empty()) {
diff --git a/third_party/nix/src/libmain/stack.cc b/third_party/nix/src/libmain/stack.cc
index 39866bb48248..0d5b91c163c7 100644
--- a/third_party/nix/src/libmain/stack.cc
+++ b/third_party/nix/src/libmain/stack.cc
@@ -25,7 +25,9 @@ static void sigsegvHandler(int signo, siginfo_t* info, void* ctx) {
 
   if (haveSP) {
     ptrdiff_t diff = (char*)info->si_addr - sp;
-    if (diff < 0) diff = -diff;
+    if (diff < 0) {
+      diff = -diff;
+    }
     if (diff < 4096) {
       char msg[] = "error: stack overflow (possible infinite recursion)\n";
       [[gnu::unused]] auto res = write(2, msg, strlen(msg));
@@ -38,7 +40,9 @@ static void sigsegvHandler(int signo, siginfo_t* info, void* ctx) {
   sigfillset(&act.sa_mask);
   act.sa_handler = SIG_DFL;
   act.sa_flags = 0;
-  if (sigaction(SIGSEGV, &act, 0)) abort();
+  if (sigaction(SIGSEGV, &act, 0)) {
+    abort();
+  }
 }
 
 void detectStackOverflow() {
@@ -50,7 +54,9 @@ void detectStackOverflow() {
   stack.ss_size = 4096 * 4 + MINSIGSTKSZ;
   static auto stackBuf = std::make_unique<std::vector<char>>(stack.ss_size);
   stack.ss_sp = stackBuf->data();
-  if (!stack.ss_sp) throw Error("cannot allocate alternative stack");
+  if (!stack.ss_sp) {
+    throw Error("cannot allocate alternative stack");
+  }
   stack.ss_flags = 0;
   if (sigaltstack(&stack, 0) == -1)
     throw SysError("cannot set alternative stack");
@@ -59,7 +65,9 @@ void detectStackOverflow() {
   sigfillset(&act.sa_mask);
   act.sa_sigaction = sigsegvHandler;
   act.sa_flags = SA_SIGINFO | SA_ONSTACK;
-  if (sigaction(SIGSEGV, &act, 0)) throw SysError("resetting SIGSEGV");
+  if (sigaction(SIGSEGV, &act, 0)) {
+    throw SysError("resetting SIGSEGV");
+  }
 #endif
 }
 
diff --git a/third_party/nix/src/libstore/binary-cache-store.cc b/third_party/nix/src/libstore/binary-cache-store.cc
index a1bcd3c0cf80..625ea1e11eae 100644
--- a/third_party/nix/src/libstore/binary-cache-store.cc
+++ b/third_party/nix/src/libstore/binary-cache-store.cc
@@ -38,7 +38,9 @@ void BinaryCacheStore::init() {
   } else {
     for (auto& line : tokenizeString<Strings>(*cacheInfo, "\n")) {
       size_t colon = line.find(':');
-      if (colon == std::string::npos) continue;
+      if (colon == std::string::npos) {
+        continue;
+      }
       auto name = line.substr(0, colon);
       auto value = trim(line.substr(colon + 1, std::string::npos));
       if (name == "StoreDir") {
@@ -115,12 +117,16 @@ void BinaryCacheStore::addToStore(const ValidPathInfo& info,
                                   const ref<std::string>& nar,
                                   RepairFlag repair, CheckSigsFlag checkSigs,
                                   std::shared_ptr<FSAccessor> accessor) {
-  if (!repair && isValidPath(info.path)) return;
+  if (!repair && isValidPath(info.path)) {
+    return;
+  }
 
   /* Verify that all references are valid. This may do some .narinfo
      reads, but typically they'll already be cached. */
   for (auto& ref : info.references) try {
-      if (ref != info.path) queryPathInfo(ref);
+      if (ref != info.path) {
+        queryPathInfo(ref);
+      }
     } catch (InvalidPath&) {
       throw Error(format("cannot add '%s' to the binary cache because the "
                          "reference '%s' is not valid") %
@@ -152,7 +158,9 @@ void BinaryCacheStore::addToStore(const ValidPathInfo& info,
 
       auto narAccessor = makeNarAccessor(nar);
 
-      if (accessor_) accessor_->addToCache(info.path, *nar, narAccessor);
+      if (accessor_) {
+        accessor_->addToCache(info.path, *nar, narAccessor);
+      }
 
       {
         auto res = jsonRoot.placeholder("root");
@@ -165,7 +173,9 @@ void BinaryCacheStore::addToStore(const ValidPathInfo& info,
   }
 
   else {
-    if (accessor_) accessor_->addToCache(info.path, *nar, makeNarAccessor(nar));
+    if (accessor_) {
+      accessor_->addToCache(info.path, *nar, makeNarAccessor(nar));
+    }
   }
 
   /* Compress the NAR. */
@@ -201,7 +211,9 @@ void BinaryCacheStore::addToStore(const ValidPathInfo& info,
   stats.narWriteCompressionTimeMs += duration;
 
   /* Atomically write the NAR info file.*/
-  if (secretKey) narInfo->sign(*secretKey);
+  if (secretKey) {
+    narInfo->sign(*secretKey);
+  }
 
   writeNarInfo(narInfo);
 
@@ -254,7 +266,9 @@ void BinaryCacheStore::queryPathInfoUncached(
             try {
               auto data = fut.get();
 
-              if (!data) return (*callbackPtr)(nullptr);
+              if (!data) {
+                return (*callbackPtr)(nullptr);
+              }
 
               stats.narInfoRead++;
 
@@ -341,7 +355,9 @@ std::shared_ptr<std::string> BinaryCacheStore::getBuildLog(const Path& path) {
     try {
       auto info = queryPathInfo(path);
       // FIXME: add a "Log" field to .narinfo
-      if (info->deriver == "") return nullptr;
+      if (info->deriver == "") {
+        return nullptr;
+      }
       drvPath = info->deriver;
     } catch (InvalidPath&) {
       return nullptr;
diff --git a/third_party/nix/src/libstore/build.cc b/third_party/nix/src/libstore/build.cc
index 8257d7aff158..ff13271e668a 100644
--- a/third_party/nix/src/libstore/build.cc
+++ b/third_party/nix/src/libstore/build.cc
@@ -334,7 +334,9 @@ void addToWeakGoals(WeakGoals& goals, GoalPtr p) {
   // FIXME: necessary?
   // FIXME: O(n)
   for (auto& i : goals)
-    if (i.lock() == p) return;
+    if (i.lock() == p) {
+      return;
+    }
   goals.push_back(p);
 }
 
@@ -368,7 +370,9 @@ void Goal::waiteeDone(GoalPtr waitee, ExitCode result) {
     for (auto& goal : waitees) {
       WeakGoals waiters2;
       for (auto& j : goal->waiters)
-        if (j.lock() != shared_from_this()) waiters2.push_back(j);
+        if (j.lock() != shared_from_this()) {
+          waiters2.push_back(j);
+        }
       goal->waiters = waiters2;
     }
     waitees.clear();
@@ -385,7 +389,9 @@ void Goal::amDone(ExitCode result) {
   exitCode = result;
   for (auto& i : waiters) {
     GoalPtr goal = i.lock();
-    if (goal) goal->waiteeDone(shared_from_this(), result);
+    if (goal) {
+      goal->waiteeDone(shared_from_this(), result);
+    }
   }
   waiters.clear();
   worker.removeGoal(shared_from_this());
@@ -405,7 +411,9 @@ static void commonChildInit(Pipe& logPipe) {
      process group) so that it has no controlling terminal (meaning
      that e.g. ssh cannot open /dev/tty) and it doesn't receive
      terminal signals. */
-  if (setsid() == -1) throw SysError(format("creating a new session"));
+  if (setsid() == -1) {
+    throw SysError(format("creating a new session"));
+  }
 
   /* Dup the write side of the logger pipe into stderr. */
   if (dup2(logPipe.writeSide.get(), STDERR_FILENO) == -1)
@@ -539,7 +547,9 @@ UserLock::UserLock() {
     try {
       AutoCloseFD fd =
           open(fnUserLock.c_str(), O_RDWR | O_CREAT | O_CLOEXEC, 0600);
-      if (!fd) throw SysError(format("opening user lock '%1%'") % fnUserLock);
+      if (!fd) {
+        throw SysError(format("opening user lock '%1%'") % fnUserLock);
+      }
 
       if (lockFile(fd.get(), ltWrite, false)) {
         fdUserLock = std::move(fd);
@@ -671,7 +681,9 @@ HookInstance::HookInstance() {
 HookInstance::~HookInstance() {
   try {
     toHook.writeSide = -1;
-    if (pid != -1) pid.kill();
+    if (pid != -1) {
+      pid.kill();
+    }
   } catch (...) {
     ignoreException();
   }
@@ -1051,7 +1063,9 @@ void DerivationGoal::work() { (this->*state)(); }
 
 void DerivationGoal::addWantedOutputs(const StringSet& outputs) {
   /* If we already want all outputs, there is nothing to do. */
-  if (wantedOutputs.empty()) return;
+  if (wantedOutputs.empty()) {
+    return;
+  }
 
   if (outputs.empty()) {
     wantedOutputs.clear();
@@ -1192,7 +1206,9 @@ void DerivationGoal::outputsSubstituted() {
           i.first, i.second, buildMode == bmRepair ? bmRepair : bmNormal));
 
   for (auto& i : drv->inputSrcs) {
-    if (worker.store.isValidPath(i)) continue;
+    if (worker.store.isValidPath(i)) {
+      continue;
+    }
     if (!settings.useSubstitutes)
       throw Error(format("dependency '%1%' of '%2%' does not exist, and "
                          "substitution is disabled") %
@@ -1215,7 +1231,9 @@ void DerivationGoal::repairClosure() {
   /* Get the output closure. */
   PathSet outputClosure;
   for (auto& i : drv->outputs) {
-    if (!wantOutput(i.first, wantedOutputs)) continue;
+    if (!wantOutput(i.first, wantedOutputs)) {
+      continue;
+    }
     worker.store.computeFSClosure(i.second.path, outputClosure);
   }
 
@@ -1226,7 +1244,9 @@ void DerivationGoal::repairClosure() {
      derivation is responsible for which path in the output
      closure. */
   PathSet inputClosure;
-  if (useDerivation) worker.store.computeFSClosure(drvPath, inputClosure);
+  if (useDerivation) {
+    worker.store.computeFSClosure(drvPath, inputClosure);
+  }
   std::map<Path, Path> outputsToDrv;
   for (auto& i : inputClosure)
     if (isDerivation(i)) {
@@ -1237,7 +1257,9 @@ void DerivationGoal::repairClosure() {
   /* Check each path (slow!). */
   PathSet broken;
   for (auto& i : outputClosure) {
-    if (worker.pathContentsGood(i)) continue;
+    if (worker.pathContentsGood(i)) {
+      continue;
+    }
     LOG(ERROR) << "found corrupted or missing path '" << i
                << "' in the output closure of '" << drvPath << "'";
     Path drvPath2 = outputsToDrv[i];
@@ -1373,7 +1395,9 @@ void DerivationGoal::tryToBuild() {
      them. */
   for (auto& i : drv->outputs) {
     Path path = i.second.path;
-    if (worker.store.isValidPath(path)) continue;
+    if (worker.store.isValidPath(path)) {
+      continue;
+    }
     DLOG(INFO) << "removing invalid path " << path;
     deletePath(worker.store.toRealPath(path));
   }
@@ -1459,7 +1483,9 @@ void replaceValidPath(const Path& storePath, const Path tmpPath) {
      we're repairing (say) Glibc, we end up with a broken system. */
   Path oldPath =
       (format("%1%.old-%2%-%3%") % storePath % getpid() % random()).str();
-  if (pathExists(storePath)) rename(storePath.c_str(), oldPath.c_str());
+  if (pathExists(storePath)) {
+    rename(storePath.c_str(), oldPath.c_str());
+  }
   if (rename(tmpPath.c_str(), storePath.c_str()) == -1)
     throw SysError(format("moving '%1%' to '%2%'") % tmpPath % storePath);
   deletePath(oldPath);
@@ -1504,7 +1530,9 @@ MakeError(NotDeterministic, BuildError)
      malicious user from leaving behind a process that keeps files
      open and modifies them after they have been chown'ed to
      root. */
-  if (buildUser) buildUser->kill();
+  if (buildUser) {
+    buildUser->kill();
+  }
 
   bool diskFull = false;
 
@@ -1670,7 +1698,9 @@ HookReply DerivationGoal::tryBuildHook() {
     return rpDecline;
   }
 
-  if (!worker.hook) worker.hook = std::make_unique<HookInstance>();
+  if (!worker.hook) {
+    worker.hook = std::make_unique<HookInstance>();
+  }
 
   try {
     /* Send the request to the hook. */
@@ -1808,7 +1838,9 @@ static void preloadNSS() {
 
     if (getaddrinfo("this.pre-initializes.the.dns.resolvers.invalid.", "http",
                     NULL, &res) != 0) {
-      if (res) freeaddrinfo(res);
+      if (res) {
+        freeaddrinfo(res);
+      }
     }
   });
 }
@@ -1823,7 +1855,9 @@ void DerivationGoal::startBuilder() {
         concatStringsSep(", ", parsedDrv->getRequiredSystemFeatures()), drvPath,
         settings.thisSystem, concatStringsSep(", ", settings.systemFeatures));
 
-  if (drv->isBuiltin()) preloadNSS();
+  if (drv->isBuiltin()) {
+    preloadNSS();
+  }
 
 #if __APPLE__
   additionalSandboxProfile =
@@ -1930,7 +1964,9 @@ void DerivationGoal::startBuilder() {
     dirsInChroot.clear();
 
     for (auto i : dirs) {
-      if (i.empty()) continue;
+      if (i.empty()) {
+        continue;
+      }
       bool optional = false;
       if (i[i.size() - 1] == '?') {
         optional = true;
@@ -2161,7 +2197,9 @@ void DerivationGoal::startBuilder() {
   // builderOut.create();
 
   builderOut.readSide = posix_openpt(O_RDWR | O_NOCTTY);
-  if (!builderOut.readSide) throw SysError("opening pseudoterminal master");
+  if (!builderOut.readSide) {
+    throw SysError("opening pseudoterminal master");
+  }
 
   std::string slaveName(ptsname(builderOut.readSide.get()));
 
@@ -2187,7 +2225,9 @@ void DerivationGoal::startBuilder() {
     throw SysError("unlocking pseudoterminal");
 
   builderOut.writeSide = open(slaveName.c_str(), O_RDWR | O_NOCTTY);
-  if (!builderOut.writeSide) throw SysError("opening pseudoterminal slave");
+  if (!builderOut.writeSide) {
+    throw SysError("opening pseudoterminal slave");
+  }
 
   // Put the pt into raw mode to prevent \n -> \r\n translation.
   struct termios term;
@@ -2265,11 +2305,15 @@ void DerivationGoal::startBuilder() {
           char* stack =
               (char*)mmap(0, stackSize, PROT_WRITE | PROT_READ,
                           MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0);
-          if (stack == MAP_FAILED) throw SysError("allocating stack");
+          if (stack == MAP_FAILED) {
+            throw SysError("allocating stack");
+          }
 
           int flags = CLONE_NEWUSER | CLONE_NEWPID | CLONE_NEWNS |
                       CLONE_NEWIPC | CLONE_NEWUTS | CLONE_PARENT | SIGCHLD;
-          if (privateNetwork) flags |= CLONE_NEWNET;
+          if (privateNetwork) {
+            flags |= CLONE_NEWNET;
+          }
 
           pid_t child = clone(childEntry, stack + stackSize, flags, this);
           if (child == -1 && errno == EINVAL) {
@@ -2292,7 +2336,9 @@ void DerivationGoal::startBuilder() {
           if (child == -1 && (errno == EPERM || errno == EINVAL) &&
               settings.sandboxFallback)
             _exit(1);
-          if (child == -1) throw SysError("cloning builder process");
+          if (child == -1) {
+            throw SysError("cloning builder process");
+          }
 
           writeFull(builderOut.writeSide.get(), std::to_string(child) + "\n");
           _exit(0);
@@ -2310,7 +2356,9 @@ void DerivationGoal::startBuilder() {
     userNamespaceSync.readSide = -1;
 
     pid_t tmp;
-    if (!string2Int<pid_t>(readLine(builderOut.readSide.get()), tmp)) abort();
+    if (!string2Int<pid_t>(readLine(builderOut.readSide.get()), tmp)) {
+      abort();
+    }
     pid = tmp;
 
     /* Set the UID/GID mapping of the builder's user namespace
@@ -2350,7 +2398,9 @@ void DerivationGoal::startBuilder() {
   while (true) {
     string msg = readLine(builderOut.readSide.get());
     if (string(msg, 0, 1) == "\1") {
-      if (msg.size() == 1) break;
+      if (msg.size() == 1) {
+        break;
+      }
       throw Error(string(msg, 1));
     }
     DLOG(INFO) << msg;
@@ -2435,7 +2485,9 @@ void DerivationGoal::initEnv() {
      derivation, tell the builder, so that for instance `fetchurl'
      can skip checking the output.  On older Nixes, this environment
      variable won't be set, so `fetchurl' will do the check. */
-  if (fixedOutput) env["NIX_OUTPUT_CHECKED"] = "1";
+  if (fixedOutput) {
+    env["NIX_OUTPUT_CHECKED"] = "1";
+  }
 
   /* *Only* if this is a fixed-output derivation, propagate the
      values of the environment variables specified in the
@@ -2465,7 +2517,9 @@ static std::regex shVarName("[A-Za-z_][A-Za-z0-9_]*");
 
 void DerivationGoal::writeStructuredAttrs() {
   auto& structuredAttrs = parsedDrv->getStructuredAttrs();
-  if (!structuredAttrs) return;
+  if (!structuredAttrs) {
+    return;
+  }
 
   auto json = *structuredAttrs;
 
@@ -2503,14 +2557,20 @@ void DerivationGoal::writeStructuredAttrs() {
 
   auto handleSimpleType =
       [](const nlohmann::json& value) -> std::optional<std::string> {
-    if (value.is_string()) return shellEscape(value);
+    if (value.is_string()) {
+      return shellEscape(value);
+    }
 
     if (value.is_number()) {
       auto f = value.get<float>();
-      if (std::ceil(f) == f) return std::to_string(value.get<int>());
+      if (std::ceil(f) == f) {
+        return std::to_string(value.get<int>());
+      }
     }
 
-    if (value.is_null()) return std::string("''");
+    if (value.is_null()) {
+      return std::string("''");
+    }
 
     if (value.is_boolean())
       return value.get<bool>() ? std::string("1") : std::string("");
@@ -2521,7 +2581,9 @@ void DerivationGoal::writeStructuredAttrs() {
   std::string jsonSh;
 
   for (auto i = json.begin(); i != json.end(); ++i) {
-    if (!std::regex_match(i.key(), shVarName)) continue;
+    if (!std::regex_match(i.key(), shVarName)) {
+      continue;
+    }
 
     auto& value = i.value();
 
@@ -2543,7 +2605,9 @@ void DerivationGoal::writeStructuredAttrs() {
         s2 += ' ';
       }
 
-      if (good) jsonSh += fmt("declare -a %s=(%s)\n", i.key(), s2);
+      if (good) {
+        jsonSh += fmt("declare -a %s=(%s)\n", i.key(), s2);
+      }
     }
 
     else if (value.is_object()) {
@@ -2559,7 +2623,9 @@ void DerivationGoal::writeStructuredAttrs() {
         s2 += fmt("[%s]=%s ", shellEscape(i.key()), *s3);
       }
 
-      if (good) jsonSh += fmt("declare -A %s=(%s)\n", i.key(), s2);
+      if (good) {
+        jsonSh += fmt("declare -A %s=(%s)\n", i.key(), s2);
+      }
     }
   }
 
@@ -2568,14 +2634,18 @@ void DerivationGoal::writeStructuredAttrs() {
 }
 
 void DerivationGoal::chownToBuilder(const Path& path) {
-  if (!buildUser) return;
+  if (!buildUser) {
+    return;
+  }
   if (chown(path.c_str(), buildUser->getUID(), buildUser->getGID()) == -1)
     throw SysError(format("cannot change ownership of '%1%'") % path);
 }
 
 void setupSeccomp() {
 #if __linux__
-  if (!settings.filterSyscalls) return;
+  if (!settings.filterSyscalls) {
+    return;
+  }
 #if HAVE_SECCOMP
   scmp_filter_ctx ctx;
 
@@ -2653,7 +2723,9 @@ void DerivationGoal::runChild() {
     try {
       setupSeccomp();
     } catch (...) {
-      if (buildUser) throw;
+      if (buildUser) {
+        throw;
+      }
     }
 
     bool setUser = true;
@@ -2679,7 +2751,9 @@ void DerivationGoal::runChild() {
       if (privateNetwork) {
         /* Initialise the loopback interface. */
         AutoCloseFD fd(socket(PF_INET, SOCK_DGRAM, IPPROTO_IP));
-        if (!fd) throw SysError("cannot open IP socket");
+        if (!fd) {
+          throw SysError("cannot open IP socket");
+        }
 
         struct ifreq ifr;
         strcpy(ifr.ifr_name, "lo");
@@ -2782,7 +2856,9 @@ void DerivationGoal::runChild() {
       };
 
       for (auto& i : dirsInChroot) {
-        if (i.second.source == "/proc") continue;  // backwards compatibility
+        if (i.second.source == "/proc") {
+          continue;
+        }  // backwards compatibility
         doBind(i.second.source, chrootRootDir + i.first, i.second.optional);
       }
 
@@ -2813,7 +2889,9 @@ void DerivationGoal::runChild() {
              Linux versions, it is created with permissions 0.  */
           chmod_(chrootRootDir + "/dev/pts/ptmx", 0666);
         } else {
-          if (errno != EINVAL) throw SysError("mounting /dev/pts");
+          if (errno != EINVAL) {
+            throw SysError("mounting /dev/pts");
+          }
           doBind("/dev/pts", chrootRootDir + "/dev/pts");
           doBind("/dev/ptmx", chrootRootDir + "/dev/ptmx");
         }
@@ -2844,8 +2922,12 @@ void DerivationGoal::runChild() {
       /* Switch to the sandbox uid/gid in the user namespace,
          which corresponds to the build user or calling user in
          the parent namespace. */
-      if (setgid(sandboxGid) == -1) throw SysError("setgid failed");
-      if (setuid(sandboxUid) == -1) throw SysError("setuid failed");
+      if (setgid(sandboxGid) == -1) {
+        throw SysError("setgid failed");
+      }
+      if (setuid(sandboxUid) == -1) {
+        throw SysError("setuid failed");
+      }
 
       setUser = false;
     }
@@ -2875,13 +2957,17 @@ void DerivationGoal::runChild() {
     if ((drv->platform == "i686-linux" || drv->platform == "x86_64-linux") &&
         settings.impersonateLinux26) {
       int cur = personality(0xffffffff);
-      if (cur != -1) personality(cur | 0x0020000 /* == UNAME26 */);
+      if (cur != -1) {
+        personality(cur | 0x0020000 /* == UNAME26 */);
+      }
     }
 
     /* Disable address space randomization for improved
        determinism. */
     int cur = personality(0xffffffff);
-    if (cur != -1) personality(cur | ADDR_NO_RANDOMIZE);
+    if (cur != -1) {
+      personality(cur | ADDR_NO_RANDOMIZE);
+    }
 #endif
 
     /* Disable core dumps by default. */
@@ -2972,7 +3058,9 @@ void DerivationGoal::runChild() {
 
         sandboxProfile += "(import \"sandbox-defaults.sb\")\n";
 
-        if (fixedOutput) sandboxProfile += "(import \"sandbox-network.sb\")\n";
+        if (fixedOutput) {
+          sandboxProfile += "(import \"sandbox-network.sb\")\n";
+        }
 
         /* Our rwx outputs */
         sandboxProfile += "(allow file-read* file-write* process-exec\n";
@@ -3001,7 +3089,9 @@ void DerivationGoal::runChild() {
           string path = i.first;
           struct stat st;
           if (lstat(path.c_str(), &st)) {
-            if (i.second.optional && errno == ENOENT) continue;
+            if (i.second.optional && errno == ENOENT) {
+              continue;
+            }
             throw SysError(format("getting attributes of path '%1%'") % path);
           }
           if (S_ISDIR(st.st_mode))
@@ -3040,7 +3130,9 @@ void DerivationGoal::runChild() {
       Path globalTmpDir = canonPath(getEnv("TMPDIR", "/tmp"), true);
 
       /* They don't like trailing slashes on subpath directives */
-      if (globalTmpDir.back() == '/') globalTmpDir.pop_back();
+      if (globalTmpDir.back() == '/') {
+        globalTmpDir.pop_back();
+      }
 
       builder = "/usr/bin/sandbox-exec";
       args.push_back("sandbox-exec");
@@ -3127,7 +3219,9 @@ void DerivationGoal::registerOutputs() {
   if (hook) {
     bool allValid = true;
     for (auto& i : drv->outputs)
-      if (!worker.store.isValidPath(i.second.path)) allValid = false;
+      if (!worker.store.isValidPath(i.second.path)) {
+        allValid = false;
+      }
     if (allValid) {
       return;
     }
@@ -3150,7 +3244,9 @@ void DerivationGoal::registerOutputs() {
      output paths read-only. */
   for (auto& i : drv->outputs) {
     Path path = i.second.path;
-    if (missingPaths.find(path) == missingPaths.end()) continue;
+    if (missingPaths.find(path) == missingPaths.end()) {
+      continue;
+    }
 
     ValidPathInfo info;
 
@@ -3168,7 +3264,9 @@ void DerivationGoal::registerOutputs() {
                                 "the Nix store") %
                          path);
       }
-      if (buildMode != bmCheck) actualPath = worker.store.toRealPath(path);
+      if (buildMode != bmCheck) {
+        actualPath = worker.store.toRealPath(path);
+      }
     }
 
     if (needsHashRewrite()) {
@@ -3177,7 +3275,9 @@ void DerivationGoal::registerOutputs() {
           redirectedBadOutputs.find(path) != redirectedBadOutputs.end() &&
           pathExists(redirected))
         replaceValidPath(path, redirected);
-      if (buildMode == bmCheck && redirected != "") actualPath = redirected;
+      if (buildMode == bmCheck && redirected != "") {
+        actualPath = redirected;
+      }
     }
 
     struct stat st;
@@ -3293,7 +3393,9 @@ void DerivationGoal::registerOutputs() {
     PathSet references = scanForReferences(actualPath, allPaths, hash);
 
     if (buildMode == bmCheck) {
-      if (!worker.store.isValidPath(path)) continue;
+      if (!worker.store.isValidPath(path)) {
+        continue;
+      }
       auto info = *worker.store.queryPathInfo(path);
       if (hash.first != info.narHash) {
         worker.checkMismatch = true;
@@ -3353,7 +3455,9 @@ void DerivationGoal::registerOutputs() {
     info.ultimate = true;
     worker.store.signPathInfo(info);
 
-    if (!info.references.empty()) info.ca.clear();
+    if (!info.references.empty()) {
+      info.ca.clear();
+    }
 
     infos[i.first] = info;
   }
@@ -3434,7 +3538,9 @@ void DerivationGoal::registerOutputs() {
 
   /* In case of a fixed-output derivation hash mismatch, throw an
      exception now that we have registered the output as valid. */
-  if (delayedException) std::rethrow_exception(delayedException);
+  if (delayedException) {
+    std::rethrow_exception(delayedException);
+  }
 }
 
 void DerivationGoal::checkOutputs(
@@ -3466,7 +3572,9 @@ void DerivationGoal::checkOutputs(
       while (!pathsLeft.empty()) {
         auto path = pathsLeft.front();
         pathsLeft.pop();
-        if (!pathsDone.insert(path).second) continue;
+        if (!pathsDone.insert(path).second) {
+          continue;
+        }
 
         auto i = outputsByPath.find(path);
         if (i != outputsByPath.end()) {
@@ -3499,22 +3607,30 @@ void DerivationGoal::checkOutputs(
 
       auto checkRefs = [&](const std::optional<Strings>& value, bool allowed,
                            bool recursive) {
-        if (!value) return;
+        if (!value) {
+          return;
+        }
 
         PathSet spec = parseReferenceSpecifiers(worker.store, *drv, *value);
 
         PathSet used =
             recursive ? getClosure(info.path).first : info.references;
 
-        if (recursive && checks.ignoreSelfRefs) used.erase(info.path);
+        if (recursive && checks.ignoreSelfRefs) {
+          used.erase(info.path);
+        }
 
         PathSet badPaths;
 
         for (auto& i : used)
           if (allowed) {
-            if (!spec.count(i)) badPaths.insert(i);
+            if (!spec.count(i)) {
+              badPaths.insert(i);
+            }
           } else {
-            if (spec.count(i)) badPaths.insert(i);
+            if (spec.count(i)) {
+              badPaths.insert(i);
+            }
           }
 
         if (!badPaths.empty()) {
@@ -3595,7 +3711,9 @@ void DerivationGoal::checkOutputs(
 Path DerivationGoal::openLogFile() {
   logSize = 0;
 
-  if (!settings.keepLog) return "";
+  if (!settings.keepLog) {
+    return "";
+  }
 
   string baseName = baseNameOf(drvPath);
 
@@ -3625,8 +3743,12 @@ Path DerivationGoal::openLogFile() {
 
 void DerivationGoal::closeLogFile() {
   auto logSink2 = std::dynamic_pointer_cast<CompressionSink>(logSink);
-  if (logSink2) logSink2->finish();
-  if (logFileSink) logFileSink->flush();
+  if (logSink2) {
+    logSink2->finish();
+  }
+  if (logFileSink) {
+    logFileSink->flush();
+  }
   logSink = logFileSink = 0;
   fdLogFile = -1;
 }
@@ -3682,7 +3804,9 @@ void DerivationGoal::handleChildOutput(int fd, const string& data) {
 }
 
 void DerivationGoal::handleEOF(int fd) {
-  if (!currentLogLine.empty()) flushLine();
+  if (!currentLogLine.empty()) {
+    flushLine();
+  }
   worker.wakeUp(shared_from_this());
 }
 
@@ -3691,7 +3815,9 @@ void DerivationGoal::flushLine() {
     LOG(INFO) << currentLogLine;
   else {
     logTail.push_back(currentLogLine);
-    if (logTail.size() > settings.logLines) logTail.pop_front();
+    if (logTail.size() > settings.logLines) {
+      logTail.pop_front();
+    }
   }
 
   currentLogLine = "";
@@ -3732,7 +3858,9 @@ void DerivationGoal::done(BuildResult::Status status, const string& msg) {
   result.status = status;
   result.errorMsg = msg;
   amDone(result.success() ? ecSuccess : ecFailed);
-  if (result.status == BuildResult::TimedOut) worker.timedOut = true;
+  if (result.status == BuildResult::TimedOut) {
+    worker.timedOut = true;
+  }
   if (result.status == BuildResult::PermanentFailure)
     worker.permanentFailure = true;
 
@@ -3740,9 +3868,13 @@ void DerivationGoal::done(BuildResult::Status status, const string& msg) {
   mcRunningBuilds.reset();
 
   if (result.success()) {
-    if (status == BuildResult::Built) worker.doneBuilds++;
+    if (status == BuildResult::Built) {
+      worker.doneBuilds++;
+    }
   } else {
-    if (status != BuildResult::DependencyFailed) worker.failedBuilds++;
+    if (status != BuildResult::DependencyFailed) {
+      worker.failedBuilds++;
+    }
   }
 }
 
@@ -4068,7 +4200,9 @@ void SubstitutionGoal::finished() {
 void SubstitutionGoal::handleChildOutput(int fd, const string& data) {}
 
 void SubstitutionGoal::handleEOF(int fd) {
-  if (fd == outPipe.readSide.get()) worker.wakeUp(shared_from_this());
+  if (fd == outPipe.readSide.get()) {
+    worker.wakeUp(shared_from_this());
+  }
 }
 
 //////////////////////////////////////////////////////////////////////
@@ -4077,7 +4211,9 @@ static bool working = false;
 
 Worker::Worker(LocalStore& store) : store(store) {
   /* Debugging: prevent recursive workers. */
-  if (working) abort();
+  if (working) {
+    abort();
+  }
   working = true;
   nrLocalBuilds = 0;
   lastWokenUp = steady_time_point::min();
@@ -4160,7 +4296,9 @@ void Worker::removeGoal(GoalPtr goal) {
   /* Wake up goals waiting for any goal to finish. */
   for (auto& i : waitingForAnyGoal) {
     GoalPtr goal = i.lock();
-    if (goal) wakeUp(goal);
+    if (goal) {
+      wakeUp(goal);
+    }
   }
 
   waitingForAnyGoal.clear();
@@ -4192,7 +4330,9 @@ void Worker::childTerminated(Goal* goal, bool wakeSleepers) {
   auto i =
       std::find_if(children.begin(), children.end(),
                    [&](const Child& child) { return child.goal2 == goal; });
-  if (i == children.end()) return;
+  if (i == children.end()) {
+    return;
+  }
 
   if (i->inBuildSlot) {
     assert(nrLocalBuilds > 0);
@@ -4205,7 +4345,9 @@ void Worker::childTerminated(Goal* goal, bool wakeSleepers) {
     /* Wake up goals waiting for a build slot. */
     for (auto& j : wantingToBuild) {
       GoalPtr goal = j.lock();
-      if (goal) wakeUp(goal);
+      if (goal) {
+        wakeUp(goal);
+      }
     }
 
     wantingToBuild.clear();
@@ -4246,17 +4388,23 @@ void Worker::run(const Goals& _topGoals) {
       Goals awake2;
       for (auto& i : awake) {
         GoalPtr goal = i.lock();
-        if (goal) awake2.insert(goal);
+        if (goal) {
+          awake2.insert(goal);
+        }
       }
       awake.clear();
       for (auto& goal : awake2) {
         checkInterrupt();
         goal->work();
-        if (topGoals.empty()) break;  // stuff may have been cancelled
+        if (topGoals.empty()) {
+          break;
+        }  // stuff may have been cancelled
       }
     }
 
-    if (topGoals.empty()) break;
+    if (topGoals.empty()) {
+      break;
+    }
 
     /* Wait for input. */
     if (!children.empty() || !waitingForAWhile.empty())
@@ -4300,7 +4448,9 @@ void Worker::waitForInput() {
     // Periodicallty wake up to see if we need to run the garbage collector.
     nearest = before + std::chrono::seconds(10);
   for (auto& i : children) {
-    if (!i.respectTimeouts) continue;
+    if (!i.respectTimeouts) {
+      continue;
+    }
     if (0 != settings.maxSilentTime)
       nearest = std::min(
           nearest, i.lastOutput + std::chrono::seconds(settings.maxSilentTime));
@@ -4344,14 +4494,20 @@ void Worker::waitForInput() {
   int fdMax = 0;
   for (auto& i : children) {
     for (auto& j : i.fds) {
-      if (j >= FD_SETSIZE) throw Error("reached FD_SETSIZE limit");
+      if (j >= FD_SETSIZE) {
+        throw Error("reached FD_SETSIZE limit");
+      }
       FD_SET(j, &fds);
-      if (j >= fdMax) fdMax = j + 1;
+      if (j >= fdMax) {
+        fdMax = j + 1;
+      }
     }
   }
 
   if (select(fdMax, &fds, 0, 0, useTimeout ? &timeout : 0) == -1) {
-    if (errno == EINTR) return;
+    if (errno == EINTR) {
+      return;
+    }
     throw SysError("waiting for input");
   }
 
@@ -4414,7 +4570,9 @@ void Worker::waitForInput() {
     lastWokenUp = after;
     for (auto& i : waitingForAWhile) {
       GoalPtr goal = i.lock();
-      if (goal) wakeUp(goal);
+      if (goal) {
+        wakeUp(goal);
+      }
     }
     waitingForAWhile.clear();
   }
@@ -4452,7 +4610,9 @@ unsigned int Worker::exitStatus() {
 
 bool Worker::pathContentsGood(const Path& path) {
   std::map<Path, bool>::iterator i = pathContentsGoodCache.find(path);
-  if (i != pathContentsGoodCache.end()) return i->second;
+  if (i != pathContentsGoodCache.end()) {
+    return i->second;
+  }
   LOG(INFO) << "checking path '" << path << "'...";
   auto info = store.queryPathInfo(path);
   bool res;
@@ -4543,7 +4703,9 @@ BuildResult LocalStore::buildDerivation(const Path& drvPath,
 
 void LocalStore::ensurePath(const Path& path) {
   /* If the path is already valid, we're done. */
-  if (isValidPath(path)) return;
+  if (isValidPath(path)) {
+    return;
+  }
 
   primeCache(*this, {path});
 
diff --git a/third_party/nix/src/libstore/builtins/buildenv.cc b/third_party/nix/src/libstore/builtins/buildenv.cc
index fd7d7e979f30..e9a96a8cca15 100644
--- a/third_party/nix/src/libstore/builtins/buildenv.cc
+++ b/third_party/nix/src/libstore/builtins/buildenv.cc
@@ -99,7 +99,9 @@ static void createLinks(const Path& srcDir, const Path& dstDir, int priority) {
                 "to change the priority of one of the conflicting packages"
                 " (0 being the highest priority)",
                 srcFile, readLink(dstFile), priority);
-          if (prevPriority < priority) continue;
+          if (prevPriority < priority) {
+            continue;
+          }
           if (unlink(dstFile.c_str()) == -1)
             throw SysError(format("unlinking '%1%'") % dstFile);
         } else if (S_ISDIR(dstSt.st_mode))
@@ -124,7 +126,9 @@ static FileProp postponed = FileProp{};
 static Path out;
 
 static void addPkg(const Path& pkgDir, int priority) {
-  if (done.count(pkgDir)) return;
+  if (done.count(pkgDir)) {
+    return;
+  }
   done.insert(pkgDir);
   createLinks(pkgDir, out, priority);
 
@@ -132,9 +136,13 @@ static void addPkg(const Path& pkgDir, int priority) {
     for (const auto& p : tokenizeString<std::vector<string>>(
              readFile(pkgDir + "/nix-support/propagated-user-env-packages"),
              " \n"))
-      if (!done.count(p)) postponed.insert(p);
+      if (!done.count(p)) {
+        postponed.insert(p);
+      }
   } catch (SysError& e) {
-    if (e.errNo != ENOENT && e.errNo != ENOTDIR) throw;
+    if (e.errNo != ENOENT && e.errNo != ENOTDIR) {
+      throw;
+    }
   }
 }
 
@@ -151,7 +159,9 @@ typedef std::vector<Package> Packages;
 void builtinBuildenv(const BasicDerivation& drv) {
   auto getAttr = [&](const string& name) {
     auto i = drv.env.find(name);
-    if (i == drv.env.end()) throw Error("attribute '%s' missing", name);
+    if (i == drv.env.end()) {
+      throw Error("attribute '%s' missing", name);
+    }
     return i->second;
   };
 
@@ -187,7 +197,9 @@ void builtinBuildenv(const BasicDerivation& drv) {
            (a.priority == b.priority && a.path < b.path);
   });
   for (const auto& pkg : pkgs)
-    if (pkg.active) addPkg(pkg.path, pkg.priority);
+    if (pkg.active) {
+      addPkg(pkg.path, pkg.priority);
+    }
 
   /* Symlink to the packages that have been "propagated" by packages
    * installed by the user (i.e., package X declares that it wants Y
diff --git a/third_party/nix/src/libstore/builtins/fetchurl.cc b/third_party/nix/src/libstore/builtins/fetchurl.cc
index f3ef77fbd612..c3f38a943f57 100644
--- a/third_party/nix/src/libstore/builtins/fetchurl.cc
+++ b/third_party/nix/src/libstore/builtins/fetchurl.cc
@@ -61,7 +61,9 @@ void builtinFetchurl(const BasicDerivation& drv, const std::string& netrcData) {
   /* Try the hashed mirrors first. */
   if (getAttr("outputHashMode") == "flat")
     for (auto hashedMirror : settings.hashedMirrors.get()) try {
-        if (!hasSuffix(hashedMirror, "/")) hashedMirror += '/';
+        if (!hasSuffix(hashedMirror, "/")) {
+          hashedMirror += '/';
+        }
         auto ht = parseHashType(getAttr("outputHashAlgo"));
         auto h = Hash(getAttr("outputHash"), ht);
         fetch(hashedMirror + printHashType(h.type) + "/" +
diff --git a/third_party/nix/src/libstore/crypto.cc b/third_party/nix/src/libstore/crypto.cc
index 44c512d33b92..7a169107c116 100644
--- a/third_party/nix/src/libstore/crypto.cc
+++ b/third_party/nix/src/libstore/crypto.cc
@@ -11,7 +11,9 @@ namespace nix {
 
 static std::pair<std::string, std::string> split(const string& s) {
   size_t colon = s.find(':');
-  if (colon == std::string::npos || colon == 0) return {"", ""};
+  if (colon == std::string::npos || colon == 0) {
+    return {"", ""};
+  }
   return {std::string(s, 0, colon), std::string(s, colon + 1)};
 }
 
@@ -21,7 +23,9 @@ Key::Key(const string& s) {
   name = ss.first;
   key = ss.second;
 
-  if (name == "" || key == "") throw Error("secret key is corrupt");
+  if (name == "" || key == "") {
+    throw Error("secret key is corrupt");
+  }
 
   key = base64Decode(key);
 }
@@ -76,10 +80,14 @@ bool verifyDetached(const std::string& data, const std::string& sig,
   auto ss = split(sig);
 
   auto key = publicKeys.find(ss.first);
-  if (key == publicKeys.end()) return false;
+  if (key == publicKeys.end()) {
+    return false;
+  }
 
   auto sig2 = base64Decode(ss.second);
-  if (sig2.size() != crypto_sign_BYTES) throw Error("signature is not valid");
+  if (sig2.size() != crypto_sign_BYTES) {
+    throw Error("signature is not valid");
+  }
 
   return crypto_sign_verify_detached(
              (unsigned char*)sig2.data(), (unsigned char*)data.data(),
diff --git a/third_party/nix/src/libstore/download.cc b/third_party/nix/src/libstore/download.cc
index d408a208db76..fbc2069c086d 100644
--- a/third_party/nix/src/libstore/download.cc
+++ b/third_party/nix/src/libstore/download.cc
@@ -232,7 +232,9 @@ struct CurlDownloader : public Downloader {
 
     size_t readOffset = 0;
     size_t readCallback(char* buffer, size_t size, size_t nitems) {
-      if (readOffset == request.data->length()) return 0;
+      if (readOffset == request.data->length()) {
+        return 0;
+      }
       auto count = std::min(size * nitems, request.data->length() - readOffset);
       assert(count);
       memcpy(buffer, request.data->data() + readOffset, count);
@@ -291,7 +293,9 @@ struct CurlDownloader : public Downloader {
 
       curl_easy_setopt(req, CURLOPT_HTTPHEADER, requestHeaders);
 
-      if (request.head) curl_easy_setopt(req, CURLOPT_NOBODY, 1);
+      if (request.head) {
+        curl_easy_setopt(req, CURLOPT_NOBODY, 1);
+      }
 
       if (request.data) {
         curl_easy_setopt(req, CURLOPT_UPLOAD, 1L);
@@ -336,7 +340,9 @@ struct CurlDownloader : public Downloader {
 
       char* effectiveUriCStr;
       curl_easy_getinfo(req, CURLINFO_EFFECTIVE_URL, &effectiveUriCStr);
-      if (effectiveUriCStr) result.effectiveUri = effectiveUriCStr;
+      if (effectiveUriCStr) {
+        result.effectiveUri = effectiveUriCStr;
+      }
 
       DLOG(INFO) << "finished " << request.verb() << " of " << request.uri
                  << "; curl status = " << code
@@ -664,7 +670,9 @@ struct CurlDownloader : public Downloader {
     auto [path, params] = splitUriAndParams(uri);
 
     auto slash = path.find('/', 5);  // 5 is the length of "s3://" prefix
-    if (slash == std::string::npos) throw nix::Error("bad S3 URI '%s'", path);
+    if (slash == std::string::npos) {
+      throw nix::Error("bad S3 URI '%s'", path);
+    }
 
     std::string bucketName(path, 5, slash - 5);
     std::string key(path, slash + 1);
@@ -766,7 +774,9 @@ void Downloader::download(DownloadRequest&& request, Sink& sink) {
   request.dataCallback = [_state](char* buf, size_t len) {
     auto state(_state->lock());
 
-    if (state->quit) return;
+    if (state->quit) {
+      return;
+    }
 
     /* If the buffer is full, then go to sleep until the calling
        thread wakes us up (i.e. when it has removed data from the
@@ -808,7 +818,9 @@ void Downloader::download(DownloadRequest&& request, Sink& sink) {
 
       while (state->data.empty()) {
         if (state->quit) {
-          if (state->exc) std::rethrow_exception(state->exc);
+          if (state->exc) {
+            std::rethrow_exception(state->exc);
+          }
           return;
         }
 
@@ -835,7 +847,9 @@ CachedDownloadResult Downloader::downloadCached(
   auto name = request.name;
   if (name == "") {
     auto p = url.rfind('/');
-    if (p != string::npos) name = string(url, p + 1);
+    if (p != string::npos) {
+      name = string(url, p + 1);
+    }
   }
 
   Path expectedStorePath;
@@ -919,7 +933,9 @@ CachedDownloadResult Downloader::downloadCached(
       writeFile(dataFile,
                 url + "\n" + res.etag + "\n" + std::to_string(time(0)) + "\n");
     } catch (DownloadError& e) {
-      if (storePath.empty()) throw;
+      if (storePath.empty()) {
+        throw;
+      }
       LOG(WARNING) << e.msg() << "; using cached result";
       result.etag = expectedETag;
     }
@@ -933,7 +949,9 @@ CachedDownloadResult Downloader::downloadCached(
     if (pathExists(unpackedLink)) {
       unpackedStorePath = readLink(unpackedLink);
       store->addTempRoot(unpackedStorePath);
-      if (!store->isValidPath(unpackedStorePath)) unpackedStorePath = "";
+      if (!store->isValidPath(unpackedStorePath)) {
+        unpackedStorePath = "";
+      }
     }
     if (unpackedStorePath.empty()) {
       LOG(INFO) << "unpacking '" << url << "' ...";
@@ -970,9 +988,13 @@ CachedDownloadResult Downloader::downloadCached(
 }
 
 bool isUri(const string& s) {
-  if (s.compare(0, 8, "channel:") == 0) return true;
+  if (s.compare(0, 8, "channel:") == 0) {
+    return true;
+  }
   size_t pos = s.find("://");
-  if (pos == string::npos) return false;
+  if (pos == string::npos) {
+    return false;
+  }
   string scheme(s, 0, pos);
   return scheme == "http" || scheme == "https" || scheme == "file" ||
          scheme == "channel" || scheme == "git" || scheme == "s3" ||
diff --git a/third_party/nix/src/libstore/export-import.cc b/third_party/nix/src/libstore/export-import.cc
index f0af044355ff..930ff90d269e 100644
--- a/third_party/nix/src/libstore/export-import.cc
+++ b/third_party/nix/src/libstore/export-import.cc
@@ -59,7 +59,9 @@ Paths Store::importPaths(Source& source, std::shared_ptr<FSAccessor> accessor,
   Paths res;
   while (true) {
     auto n = readNum<uint64_t>(source);
-    if (n == 0) break;
+    if (n == 0) {
+      break;
+    }
     if (n != 1)
       throw Error(
           "input doesn't look like something created by 'nix-store --export'");
@@ -82,13 +84,17 @@ Paths Store::importPaths(Source& source, std::shared_ptr<FSAccessor> accessor,
     info.references = readStorePaths<PathSet>(*this, source);
 
     info.deriver = readString(source);
-    if (info.deriver != "") assertStorePath(info.deriver);
+    if (info.deriver != "") {
+      assertStorePath(info.deriver);
+    }
 
     info.narHash = hashString(htSHA256, *tee.source.data);
     info.narSize = tee.source.data->size();
 
     // Ignore optional legacy signature.
-    if (readInt(source) == 1) readString(source);
+    if (readInt(source) == 1) {
+      readString(source);
+    }
 
     addToStore(info, tee.source.data, NoRepair, checkSigs, accessor);
 
diff --git a/third_party/nix/src/libstore/gc.cc b/third_party/nix/src/libstore/gc.cc
index 19de00143c8b..8e092f4814ae 100644
--- a/third_party/nix/src/libstore/gc.cc
+++ b/third_party/nix/src/libstore/gc.cc
@@ -161,7 +161,9 @@ void LocalStore::addTempRoot(const Path& path) {
       struct stat st;
       if (fstat(state->fdTempRoots.get(), &st) == -1)
         throw SysError(format("statting '%1%'") % fnTempRoots);
-      if (st.st_size == 0) break;
+      if (st.st_size == 0) {
+        break;
+      }
 
       /* The garbage collector deleted this file before we could
          get a lock.  (It won't delete the file after we get a
@@ -196,13 +198,15 @@ void LocalStore::findTempRoots(FDs& fds, Roots& tempRoots, bool censor) {
     FDPtr fd(new AutoCloseFD(open(path.c_str(), O_CLOEXEC | O_RDWR, 0666)));
     if (!*fd) {
       /* It's okay if the file has disappeared. */
-      if (errno == ENOENT) continue;
+      if (errno == ENOENT) {
+        continue;
+      }
       throw SysError(format("opening temporary roots file '%1%'") % path);
     }
 
     /* This should work, but doesn't, for some reason. */
     // FDPtr fd(new AutoCloseFD(openLockFile(path, false)));
-    // if (*fd == -1) continue;
+    // if (*fd == -1) { continue; }
 
     /* Try to acquire a write lock without blocking.  This can
        only succeed if the owning process has died.  In that case
@@ -249,7 +253,9 @@ void LocalStore::findRoots(const Path& path, unsigned char type, Roots& roots) {
   };
 
   try {
-    if (type == DT_UNKNOWN) type = getFileType(path);
+    if (type == DT_UNKNOWN) {
+      type = getFileType(path);
+    }
 
     if (type == DT_DIR) {
       for (auto& i : readDirectory(path))
@@ -258,7 +264,9 @@ void LocalStore::findRoots(const Path& path, unsigned char type, Roots& roots) {
 
     else if (type == DT_LNK) {
       Path target = readLink(path);
-      if (isInStore(target)) foundRoot(path, target);
+      if (isInStore(target)) {
+        foundRoot(path, target);
+      }
 
       /* Handle indirect roots. */
       else {
@@ -271,9 +279,13 @@ void LocalStore::findRoots(const Path& path, unsigned char type, Roots& roots) {
           }
         } else {
           struct stat st2 = lstat(target);
-          if (!S_ISLNK(st2.st_mode)) return;
+          if (!S_ISLNK(st2.st_mode)) {
+            return;
+          }
           Path target2 = readLink(target);
-          if (isInStore(target2)) foundRoot(target, target2);
+          if (isInStore(target2)) {
+            foundRoot(target, target2);
+          }
         }
       }
     }
@@ -376,7 +388,9 @@ void LocalStore::findRuntimeRoots(Roots& roots, bool censor) {
         auto fdStr = fmt("/proc/%s/fd", ent->d_name);
         auto fdDir = AutoCloseDir(opendir(fdStr.c_str()));
         if (!fdDir) {
-          if (errno == ENOENT || errno == EACCES) continue;
+          if (errno == ENOENT || errno == EACCES) {
+            continue;
+          }
           throw SysError(format("opening %1%") % fdStr);
         }
         struct dirent* fd_ent;
@@ -385,7 +399,9 @@ void LocalStore::findRuntimeRoots(Roots& roots, bool censor) {
             readProcLink(fmt("%s/%s", fdStr, fd_ent->d_name), unchecked);
         }
         if (errno) {
-          if (errno == ESRCH) continue;
+          if (errno == ESRCH) {
+            continue;
+          }
           throw SysError(format("iterating /proc/%1%/fd") % ent->d_name);
         }
         fdDir.reset();
@@ -408,12 +424,16 @@ void LocalStore::findRuntimeRoots(Roots& roots, bool censor) {
                i != env_end; ++i)
             unchecked[i->str()].emplace(envFile);
         } catch (SysError& e) {
-          if (errno == ENOENT || errno == EACCES || errno == ESRCH) continue;
+          if (errno == ENOENT || errno == EACCES || errno == ESRCH) {
+            continue;
+          }
           throw;
         }
       }
     }
-    if (errno) throw SysError("iterating /proc");
+    if (errno) {
+      throw SysError("iterating /proc");
+    }
   }
 
 #if !defined(__linux__)
@@ -495,7 +515,9 @@ void LocalStore::deletePathRecursive(GCState& state, const Path& path) {
     PathSet referrers;
     queryReferrers(path, referrers);
     for (auto& i : referrers)
-      if (i != path) deletePathRecursive(state, i);
+      if (i != path) {
+        deletePathRecursive(state, i);
+      }
     size = queryPathInfo(path)->narSize;
     invalidatePathChecked(path);
   }
@@ -504,7 +526,9 @@ void LocalStore::deletePathRecursive(GCState& state, const Path& path) {
 
   struct stat st;
   if (lstat(realPath.c_str(), &st)) {
-    if (errno == ENOENT) return;
+    if (errno == ENOENT) {
+      return;
+    }
     throw SysError(format("getting status of %1%") % realPath);
   }
 
@@ -549,11 +573,17 @@ void LocalStore::deletePathRecursive(GCState& state, const Path& path) {
 
 bool LocalStore::canReachRoot(GCState& state, PathSet& visited,
                               const Path& path) {
-  if (visited.count(path)) return false;
+  if (visited.count(path)) {
+    return false;
+  }
 
-  if (state.alive.count(path)) return true;
+  if (state.alive.count(path)) {
+    return true;
+  }
 
-  if (state.dead.count(path)) return false;
+  if (state.dead.count(path)) {
+    return false;
+  }
 
   if (state.roots.count(path)) {
     DLOG(INFO) << "cannot delete '" << path << "' because it's a root";
@@ -563,7 +593,9 @@ bool LocalStore::canReachRoot(GCState& state, PathSet& visited,
 
   visited.insert(path);
 
-  if (!isStorePath(path) || !isValidPath(path)) return false;
+  if (!isStorePath(path) || !isValidPath(path)) {
+    return false;
+  }
 
   PathSet incoming;
 
@@ -600,7 +632,9 @@ void LocalStore::tryToDelete(GCState& state, const Path& path) {
   checkInterrupt();
 
   auto realPath = realStoreDir + "/" + baseNameOf(path);
-  if (realPath == linksDir || realPath == trashDir) return;
+  if (realPath == linksDir || realPath == trashDir) {
+    return;
+  }
 
   // Activity act(*logger, lvlDebug, format("considering whether to delete
   // '%1%'") % path);
@@ -608,16 +642,22 @@ void LocalStore::tryToDelete(GCState& state, const Path& path) {
   if (!isStorePath(path) || !isValidPath(path)) {
     /* A lock file belonging to a path that we're building right
        now isn't garbage. */
-    if (isActiveTempFile(state, path, ".lock")) return;
+    if (isActiveTempFile(state, path, ".lock")) {
+      return;
+    }
 
     /* Don't delete .chroot directories for derivations that are
        currently being built. */
-    if (isActiveTempFile(state, path, ".chroot")) return;
+    if (isActiveTempFile(state, path, ".chroot")) {
+      return;
+    }
 
     /* Don't delete .check directories for derivations that are
        currently being built, because we may need to run
        diff-hook. */
-    if (isActiveTempFile(state, path, ".check")) return;
+    if (isActiveTempFile(state, path, ".check")) {
+      return;
+    }
   }
 
   PathSet visited;
@@ -653,7 +693,9 @@ void LocalStore::removeUnusedLinks(const GCState& state) {
   while (errno = 0, dirent = readdir(dir.get())) {
     checkInterrupt();
     string name = dirent->d_name;
-    if (name == "." || name == "..") continue;
+    if (name == "." || name == "..") {
+      continue;
+    }
     Path path = linksDir + "/" + name;
 
     struct stat st;
@@ -789,7 +831,9 @@ void LocalStore::collectGarbage(const GCOptions& options, GCResults& results) {
       while (errno = 0, dirent = readdir(dir.get())) {
         checkInterrupt();
         string name = dirent->d_name;
-        if (name == "." || name == "..") continue;
+        if (name == "." || name == "..") {
+          continue;
+        }
         Path path = storeDir + "/" + name;
         if (isStorePath(path) && isValidPath(path))
           entries.push_back(path);
@@ -840,7 +884,7 @@ void LocalStore::collectGarbage(const GCOptions& options, GCResults& results) {
   }
 
   /* While we're at it, vacuum the database. */
-  // if (options.action == GCOptions::gcDeleteDead) vacuumDB();
+  // if (options.action == GCOptions::gcDeleteDead) { vacuumDB(); }
 }
 
 void LocalStore::autoGC(bool sync) {
@@ -879,9 +923,13 @@ void LocalStore::autoGC(bool sync) {
 
     state->lastGCCheck = now;
 
-    if (avail >= settings.minFree || avail >= settings.maxFree) return;
+    if (avail >= settings.minFree || avail >= settings.maxFree) {
+      return;
+    }
 
-    if (avail > state->availAfterGC * 0.97) return;
+    if (avail > state->availAfterGC * 0.97) {
+      return;
+    }
 
     state->gcRunning = true;
 
@@ -919,7 +967,9 @@ void LocalStore::autoGC(bool sync) {
 
 sync:
   // Wait for the future outside of the state lock.
-  if (sync) future.get();
+  if (sync) {
+    future.get();
+  }
 }
 
 }  // namespace nix
diff --git a/third_party/nix/src/libstore/globals.cc b/third_party/nix/src/libstore/globals.cc
index bbcf63a6f5e4..4d502c0adeae 100644
--- a/third_party/nix/src/libstore/globals.cc
+++ b/third_party/nix/src/libstore/globals.cc
@@ -98,7 +98,9 @@ StringSet Settings::getDefaultSystemFeatures() {
   StringSet features{"nixos-test", "benchmark", "big-parallel"};
 
 #if __linux__
-  if (access("/dev/kvm", R_OK | W_OK) == 0) features.insert("kvm");
+  if (access("/dev/kvm", R_OK | W_OK) == 0) {
+    features.insert("kvm");
+  }
 #endif
 
   return features;
@@ -171,7 +173,9 @@ void initPlugins() {
       for (const auto& ent : ents)
         pluginFiles.emplace_back(pluginFile + "/" + ent.name);
     } catch (SysError& e) {
-      if (e.errNo != ENOTDIR) throw;
+      if (e.errNo != ENOTDIR) {
+        throw;
+      }
       pluginFiles.emplace_back(pluginFile);
     }
     for (const auto& file : pluginFiles) {
diff --git a/third_party/nix/src/libstore/http-binary-cache-store.cc b/third_party/nix/src/libstore/http-binary-cache-store.cc
index cdef7ca03837..2482b02c61bd 100644
--- a/third_party/nix/src/libstore/http-binary-cache-store.cc
+++ b/third_party/nix/src/libstore/http-binary-cache-store.cc
@@ -23,7 +23,9 @@ class HttpBinaryCacheStore : public BinaryCacheStore {
  public:
   HttpBinaryCacheStore(const Params& params, const Path& _cacheUri)
       : BinaryCacheStore(params), cacheUri(_cacheUri) {
-    if (cacheUri.back() == '/') cacheUri.pop_back();
+    if (cacheUri.back() == '/') {
+      cacheUri.pop_back();
+    }
 
     diskCache = getNarInfoDiskCache();
   }
@@ -57,7 +59,9 @@ class HttpBinaryCacheStore : public BinaryCacheStore {
 
   void checkEnabled() {
     auto state(_state.lock());
-    if (state->enabled) return;
+    if (state->enabled) {
+      return;
+    }
     if (std::chrono::steady_clock::now() > state->disabledUntil) {
       state->enabled = true;
       DLOG(INFO) << "re-enabling binary cache '" << getUri() << "'";
diff --git a/third_party/nix/src/libstore/legacy-ssh-store.cc b/third_party/nix/src/libstore/legacy-ssh-store.cc
index 893b454ac6f9..8510895d0bfe 100644
--- a/third_party/nix/src/libstore/legacy-ssh-store.cc
+++ b/third_party/nix/src/libstore/legacy-ssh-store.cc
@@ -99,7 +99,9 @@ struct LegacySSHStore : public Store {
 
       auto info = std::make_shared<ValidPathInfo>();
       conn->from >> info->path;
-      if (info->path.empty()) return callback(nullptr);
+      if (info->path.empty()) {
+        return callback(nullptr);
+      }
       assert(path == info->path);
 
       PathSet references;
@@ -253,7 +255,9 @@ struct LegacySSHStore : public Store {
 static RegisterStoreImplementation regStore(
     [](const std::string& uri,
        const Store::Params& params) -> std::shared_ptr<Store> {
-      if (std::string(uri, 0, uriScheme.size()) != uriScheme) return 0;
+      if (std::string(uri, 0, uriScheme.size()) != uriScheme) {
+        return 0;
+      }
       return std::make_shared<LegacySSHStore>(
           std::string(uri, uriScheme.size()), params);
     });
diff --git a/third_party/nix/src/libstore/local-fs-store.cc b/third_party/nix/src/libstore/local-fs-store.cc
index 3dd63498b2dc..c1efbb76d827 100644
--- a/third_party/nix/src/libstore/local-fs-store.cc
+++ b/third_party/nix/src/libstore/local-fs-store.cc
@@ -68,7 +68,9 @@ ref<FSAccessor> LocalFSStore::getFSAccessor() {
 }
 
 void LocalFSStore::narFromPath(const Path& path, Sink& sink) {
-  if (!isValidPath(path)) throw Error(format("path '%s' is not valid") % path);
+  if (!isValidPath(path)) {
+    throw Error(format("path '%s' is not valid") % path);
+  }
   dumpPath(getRealStoreDir() + std::string(path, storeDir.size()), sink);
 }
 
@@ -85,7 +87,9 @@ std::shared_ptr<std::string> LocalFSStore::getBuildLog(const Path& path_) {
     } catch (InvalidPath&) {
       return nullptr;
     }
-    if (path == "") return nullptr;
+    if (path == "") {
+      return nullptr;
+    }
   }
 
   string baseName = baseNameOf(path);
diff --git a/third_party/nix/src/libstore/local-store.cc b/third_party/nix/src/libstore/local-store.cc
index 1e49ab88c260..057bafd6f617 100644
--- a/third_party/nix/src/libstore/local-store.cc
+++ b/third_party/nix/src/libstore/local-store.cc
@@ -268,7 +268,9 @@ LocalStore::~LocalStore() {
 
   {
     auto state(_state.lock());
-    if (state->gcRunning) future = state->gcFuture;
+    if (state->gcRunning) {
+      future = state->gcFuture;
+    }
   }
 
   if (future.valid()) {
@@ -375,7 +377,9 @@ void LocalStore::openDB(State& state, bool create) {
    bind mount.  So make the Nix store writable for this process. */
 void LocalStore::makeStoreWritable() {
 #if __linux__
-  if (getuid() != 0) return;
+  if (getuid() != 0) {
+    return;
+  }
   /* Check if /nix/store is on a read-only mount. */
   struct statvfs stat;
   if (statvfs(realStoreDir.c_str(), &stat) != 0)
@@ -469,7 +473,9 @@ static void canonicalisePathMetaData_(const Path& path, uid_t fromUid,
              std::string(eaBuf.data(), eaSize), std::string("\000", 1))) {
       /* Ignore SELinux security labels since these cannot be
          removed even by root. */
-      if (eaName == "security.selinux") continue;
+      if (eaName == "security.selinux") {
+        continue;
+      }
       if (lremovexattr(path.c_str(), eaName.c_str()) == -1)
         throw SysError("removing extended attribute '%s' from '%s'", eaName,
                        path);
@@ -654,7 +660,9 @@ void LocalStore::queryPathInfoUncached(
       /* Get the path info. */
       auto useQueryPathInfo(state->stmtQueryPathInfo.use()(path));
 
-      if (!useQueryPathInfo.next()) return std::shared_ptr<ValidPathInfo>();
+      if (!useQueryPathInfo.next()) {
+        return std::shared_ptr<ValidPathInfo>();
+      }
 
       info->id = useQueryPathInfo.getInt(0);
 
@@ -667,7 +675,9 @@ void LocalStore::queryPathInfoUncached(
       info->registrationTime = useQueryPathInfo.getInt(2);
 
       auto s = (const char*)sqlite3_column_text(state->stmtQueryPathInfo, 3);
-      if (s) info->deriver = s;
+      if (s) {
+        info->deriver = s;
+      }
 
       /* Note that narSize = NULL yields 0. */
       info->narSize = useQueryPathInfo.getInt(4);
@@ -675,10 +685,14 @@ void LocalStore::queryPathInfoUncached(
       info->ultimate = useQueryPathInfo.getInt(5) == 1;
 
       s = (const char*)sqlite3_column_text(state->stmtQueryPathInfo, 6);
-      if (s) info->sigs = tokenizeString<StringSet>(s, " ");
+      if (s) {
+        info->sigs = tokenizeString<StringSet>(s, " ");
+      }
 
       s = (const char*)sqlite3_column_text(state->stmtQueryPathInfo, 7);
-      if (s) info->ca = s;
+      if (s) {
+        info->ca = s;
+      }
 
       /* Get the references. */
       auto useQueryReferences(state->stmtQueryReferences.use()(info->id));
@@ -706,7 +720,9 @@ void LocalStore::updatePathInfo(State& state, const ValidPathInfo& info) {
 
 uint64_t LocalStore::queryValidPathId(State& state, const Path& path) {
   auto use(state.stmtQueryPathInfo.use()(path));
-  if (!use.next()) throw Error(format("path '%1%' is not valid") % path);
+  if (!use.next()) {
+    throw Error(format("path '%1%' is not valid") % path);
+  }
   return use.getInt(0);
 }
 
@@ -725,7 +741,9 @@ PathSet LocalStore::queryValidPaths(const PathSet& paths,
                                     SubstituteFlag maybeSubstitute) {
   PathSet res;
   for (auto& i : paths)
-    if (isValidPath(i)) res.insert(i);
+    if (isValidPath(i)) {
+      res.insert(i);
+    }
   return res;
 }
 
@@ -802,7 +820,9 @@ StringSet LocalStore::queryDerivationOutputNames(const Path& path) {
 }
 
 Path LocalStore::queryPathFromHashPart(const string& hashPart) {
-  if (hashPart.size() != storePathHashLen) throw Error("invalid hash part");
+  if (hashPart.size() != storePathHashLen) {
+    throw Error("invalid hash part");
+  }
 
   Path prefix = storeDir + "/" + hashPart;
 
@@ -812,7 +832,9 @@ Path LocalStore::queryPathFromHashPart(const string& hashPart) {
     auto useQueryPathFromHashPart(
         state->stmtQueryPathFromHashPart.use()(prefix));
 
-    if (!useQueryPathFromHashPart.next()) return "";
+    if (!useQueryPathFromHashPart.next()) {
+      return "";
+    }
 
     const char* s =
         (const char*)sqlite3_column_text(state->stmtQueryPathFromHashPart, 0);
@@ -822,15 +844,23 @@ Path LocalStore::queryPathFromHashPart(const string& hashPart) {
 }
 
 PathSet LocalStore::querySubstitutablePaths(const PathSet& paths) {
-  if (!settings.useSubstitutes) return PathSet();
+  if (!settings.useSubstitutes) {
+    return PathSet();
+  }
 
   auto remaining = paths;
   PathSet res;
 
   for (auto& sub : getDefaultSubstituters()) {
-    if (remaining.empty()) break;
-    if (sub->storeDir != storeDir) continue;
-    if (!sub->wantMassQuery()) continue;
+    if (remaining.empty()) {
+      break;
+    }
+    if (sub->storeDir != storeDir) {
+      continue;
+    }
+    if (!sub->wantMassQuery()) {
+      continue;
+    }
 
     auto valid = sub->queryValidPaths(remaining);
 
@@ -849,11 +879,17 @@ PathSet LocalStore::querySubstitutablePaths(const PathSet& paths) {
 
 void LocalStore::querySubstitutablePathInfos(const PathSet& paths,
                                              SubstitutablePathInfos& infos) {
-  if (!settings.useSubstitutes) return;
+  if (!settings.useSubstitutes) {
+    return;
+  }
   for (auto& sub : getDefaultSubstituters()) {
-    if (sub->storeDir != storeDir) continue;
+    if (sub->storeDir != storeDir) {
+      continue;
+    }
     for (auto& path : paths) {
-      if (infos.count(path)) continue;
+      if (infos.count(path)) {
+        continue;
+      }
       DLOG(INFO) << "checking substituter '" << sub->getUri() << "' for path '"
                  << path << "'";
       try {
@@ -887,7 +923,9 @@ void LocalStore::registerValidPaths(const ValidPathInfos& infos) {
      be fsync-ed.  So some may want to fsync them before registering
      the validity, at the expense of some speed of the path
      registering operation. */
-  if (settings.syncBeforeRegistering) sync();
+  if (settings.syncBeforeRegistering) {
+    sync();
+  }
 
   return retrySQLite<void>([&]() {
     auto state(_state.lock());
@@ -979,7 +1017,9 @@ void LocalStore::addToStore(const ValidPathInfo& info, Source& source,
     /* Lock the output path.  But don't lock if we're being called
        from a build hook (whose parent process already acquired a
        lock on this path). */
-    if (!locksHeld.count(info.path)) outputLock.lockPaths({realPath});
+    if (!locksHeld.count(info.path)) {
+      outputLock.lockPaths({realPath});
+    }
 
     if (repair || !isValidPath(info.path)) {
       deletePath(realPath);
@@ -1289,7 +1329,9 @@ void LocalStore::verifyPath(const Path& path, const PathSet& store,
     for (auto& i : referrers)
       if (i != path) {
         verifyPath(i, store, done, validPaths, repair, errors);
-        if (validPaths.find(i) != validPaths.end()) canInvalidate = false;
+        if (validPaths.find(i) != validPaths.end()) {
+          canInvalidate = false;
+        }
       }
 
     if (canInvalidate) {
@@ -1328,7 +1370,9 @@ static void makeMutable(const Path& path) {
 
   struct stat st = lstat(path);
 
-  if (!S_ISDIR(st.st_mode) && !S_ISREG(st.st_mode)) return;
+  if (!S_ISDIR(st.st_mode) && !S_ISREG(st.st_mode)) {
+    return;
+  }
 
   if (S_ISDIR(st.st_mode)) {
     for (auto& i : readDirectory(path)) makeMutable(path + "/" + i.name);
@@ -1339,7 +1383,9 @@ static void makeMutable(const Path& path) {
      security hole). */
   AutoCloseFD fd = open(path.c_str(), O_RDONLY | O_NOFOLLOW | O_CLOEXEC);
   if (fd == -1) {
-    if (errno == ELOOP) return;  // it's a symlink
+    if (errno == ELOOP) {
+      return;
+    }  // it's a symlink
     throw SysError(format("opening file '%1%'") % path);
   }
 
@@ -1347,16 +1393,24 @@ static void makeMutable(const Path& path) {
 
   /* Silently ignore errors getting/setting the immutable flag so
      that we work correctly on filesystems that don't support it. */
-  if (ioctl(fd, FS_IOC_GETFLAGS, &flags)) return;
+  if (ioctl(fd, FS_IOC_GETFLAGS, &flags)) {
+    return;
+  }
   old = flags;
   flags &= ~FS_IMMUTABLE_FL;
-  if (old == flags) return;
-  if (ioctl(fd, FS_IOC_SETFLAGS, &flags)) return;
+  if (old == flags) {
+    return;
+  }
+  if (ioctl(fd, FS_IOC_SETFLAGS, &flags)) {
+    return;
+  }
 }
 
 /* Upgrade from schema 6 (Nix 0.15) to schema 7 (Nix >= 1.3). */
 void LocalStore::upgradeStore7() {
-  if (getuid() != 0) return;
+  if (getuid() != 0) {
+    return;
+  }
   printError(
       "removing immutable bits from the Nix store (this may take a while)...");
   makeMutable(realStoreDir);
diff --git a/third_party/nix/src/libstore/machines.cc b/third_party/nix/src/libstore/machines.cc
index 99a32f653b8d..480d533e6099 100644
--- a/third_party/nix/src/libstore/machines.cc
+++ b/third_party/nix/src/libstore/machines.cc
@@ -50,7 +50,9 @@ void parseMachines(const std::string& s, Machines& machines) {
   for (auto line : tokenizeString<std::vector<string>>(s, "\n;")) {
     trim(line);
     line.erase(std::find(line.begin(), line.end(), '#'), line.end());
-    if (line.empty()) continue;
+    if (line.empty()) {
+      continue;
+    }
 
     if (line[0] == '@') {
       auto file = trim(std::string(line, 1));
diff --git a/third_party/nix/src/libstore/misc.cc b/third_party/nix/src/libstore/misc.cc
index 60b5a9d078b1..a907bcac97c5 100644
--- a/third_party/nix/src/libstore/misc.cc
+++ b/third_party/nix/src/libstore/misc.cc
@@ -27,8 +27,12 @@ void Store::computeFSClosure(const PathSet& startPaths, PathSet& paths_,
   enqueue = [&](const Path& path) -> void {
     {
       auto state(state_.lock());
-      if (state->exc) return;
-      if (state->paths.count(path)) return;
+      if (state->exc) {
+        return;
+      }
+      if (state->paths.count(path)) {
+        return;
+      }
       state->paths.insert(path);
       state->pending++;
     }
@@ -44,7 +48,9 @@ void Store::computeFSClosure(const PathSet& startPaths, PathSet& paths_,
               PathSet referrers;
               queryReferrers(path, referrers);
               for (auto& ref : referrers)
-                if (ref != path) enqueue(ref);
+                if (ref != path) {
+                  enqueue(ref);
+                }
 
               if (includeOutputs)
                 for (auto& i : queryValidDerivers(path)) enqueue(i);
@@ -56,11 +62,15 @@ void Store::computeFSClosure(const PathSet& startPaths, PathSet& paths_,
 
             } else {
               for (auto& ref : info->references)
-                if (ref != path) enqueue(ref);
+                if (ref != path) {
+                  enqueue(ref);
+                }
 
               if (includeOutputs && isDerivation(path))
                 for (auto& i : queryDerivationOutputs(path))
-                  if (isValidPath(i)) enqueue(i);
+                  if (isValidPath(i)) {
+                    enqueue(i);
+                  }
 
               if (includeDerivers && isValidPath(info->deriver))
                 enqueue(info->deriver);
@@ -69,14 +79,20 @@ void Store::computeFSClosure(const PathSet& startPaths, PathSet& paths_,
             {
               auto state(state_.lock());
               assert(state->pending);
-              if (!--state->pending) done.notify_one();
+              if (!--state->pending) {
+                done.notify_one();
+              }
             }
 
           } catch (...) {
             auto state(state_.lock());
-            if (!state->exc) state->exc = std::current_exception();
+            if (!state->exc) {
+              state->exc = std::current_exception();
+            }
             assert(state->pending);
-            if (!--state->pending) done.notify_one();
+            if (!--state->pending) {
+              done.notify_one();
+            }
           };
         }});
   };
@@ -86,7 +102,9 @@ void Store::computeFSClosure(const PathSet& startPaths, PathSet& paths_,
   {
     auto state(state_.lock());
     while (state->pending) state.wait(done);
-    if (state->exc) std::rethrow_exception(state->exc);
+    if (state->exc) {
+      std::rethrow_exception(state->exc);
+    }
   }
 }
 
@@ -139,7 +157,9 @@ void Store::queryMissing(const PathSet& targets, PathSet& willBuild_,
 
   auto checkOutput = [&](const Path& drvPath, ref<Derivation> drv,
                          const Path& outPath, ref<Sync<DrvState>> drvState_) {
-    if (drvState_->lock()->done) return;
+    if (drvState_->lock()->done) {
+      return;
+    }
 
     SubstitutablePathInfos infos;
     querySubstitutablePathInfos({outPath}, infos);
@@ -150,7 +170,9 @@ void Store::queryMissing(const PathSet& targets, PathSet& willBuild_,
     } else {
       {
         auto drvState(drvState_->lock());
-        if (drvState->done) return;
+        if (drvState->done) {
+          return;
+        }
         assert(drvState->left);
         drvState->left--;
         drvState->outPaths.insert(outPath);
@@ -165,7 +187,9 @@ void Store::queryMissing(const PathSet& targets, PathSet& willBuild_,
   doPath = [&](const Path& path) {
     {
       auto state(state_.lock());
-      if (state->done.count(path)) return;
+      if (state->done.count(path)) {
+        return;
+      }
       state->done.insert(path);
     }
 
@@ -186,7 +210,9 @@ void Store::queryMissing(const PathSet& targets, PathSet& willBuild_,
       for (auto& j : drv.outputs)
         if (wantOutput(j.first, i2.second) && !isValidPath(j.second.path))
           invalid.insert(j.second.path);
-      if (invalid.empty()) return;
+      if (invalid.empty()) {
+        return;
+      }
 
       if (settings.useSubstitutes && parsedDrv.substitutesAllowed()) {
         auto drvState = make_ref<Sync<DrvState>>(DrvState(invalid.size()));
@@ -197,7 +223,9 @@ void Store::queryMissing(const PathSet& targets, PathSet& willBuild_,
         mustBuildDrv(i2.first, drv);
 
     } else {
-      if (isValidPath(path)) return;
+      if (isValidPath(path)) {
+        return;
+      }
 
       SubstitutablePathInfos infos;
       querySubstitutablePathInfos({path}, infos);
@@ -240,7 +268,9 @@ Paths Store::topoSortPaths(const PathSet& paths) {
           format("cycle detected in the references of '%1%' from '%2%'") %
           path % *parent);
 
-    if (visited.find(path) != visited.end()) return;
+    if (visited.find(path) != visited.end()) {
+      return;
+    }
     visited.insert(path);
     parents.insert(path);
 
@@ -253,7 +283,9 @@ Paths Store::topoSortPaths(const PathSet& paths) {
     for (auto& i : references)
       /* Don't traverse into paths that don't exist.  That can
          happen due to substitutes for non-existent paths. */
-      if (i != path && paths.find(i) != paths.end()) dfsVisit(i, &path);
+      if (i != path && paths.find(i) != paths.end()) {
+        dfsVisit(i, &path);
+      }
 
     sorted.push_front(path);
     parents.erase(path);
diff --git a/third_party/nix/src/libstore/nar-accessor.cc b/third_party/nix/src/libstore/nar-accessor.cc
index b36f75401bd3..0214561da456 100644
--- a/third_party/nix/src/libstore/nar-accessor.cc
+++ b/third_party/nix/src/libstore/nar-accessor.cc
@@ -133,7 +133,9 @@ struct NarAccessor : public FSAccessor {
     for (auto it = path.begin(); it != end;) {
       // because it != end, the remaining component is non-empty so we need
       // a directory
-      if (current->type != FSAccessor::Type::tDirectory) return nullptr;
+      if (current->type != FSAccessor::Type::tDirectory) {
+        return nullptr;
+      }
 
       // skip slash (canonPath above ensures that this is always a slash)
       assert(*it == '/');
@@ -142,7 +144,9 @@ struct NarAccessor : public FSAccessor {
       // lookup current component
       auto next = std::find(it, end, '/');
       auto child = current->children.find(std::string(it, next));
-      if (child == current->children.end()) return nullptr;
+      if (child == current->children.end()) {
+        return nullptr;
+      }
       current = &child->second;
 
       it = next;
@@ -160,7 +164,9 @@ struct NarAccessor : public FSAccessor {
 
   Stat stat(const Path& path) override {
     auto i = find(path);
-    if (i == nullptr) return {FSAccessor::Type::tMissing, 0, false};
+    if (i == nullptr) {
+      return {FSAccessor::Type::tMissing, 0, false};
+    }
     return {i->type, i->size, i->isExecutable, i->start};
   }
 
@@ -183,7 +189,9 @@ struct NarAccessor : public FSAccessor {
       throw Error(format("path '%1%' inside NAR file is not a regular file") %
                   path);
 
-    if (getNarBytes) return getNarBytes(i.start, i.size);
+    if (getNarBytes) {
+      return getNarBytes(i.start, i.size);
+    }
 
     assert(nar);
     return std::string(*nar, i.start, i.size);
@@ -216,8 +224,12 @@ void listNar(JSONPlaceholder& res, ref<FSAccessor> accessor, const Path& path,
     case FSAccessor::Type::tRegular:
       obj.attr("type", "regular");
       obj.attr("size", st.fileSize);
-      if (st.isExecutable) obj.attr("executable", true);
-      if (st.narOffset) obj.attr("narOffset", st.narOffset);
+      if (st.isExecutable) {
+        obj.attr("executable", true);
+      }
+      if (st.narOffset) {
+        obj.attr("narOffset", st.narOffset);
+      }
       break;
     case FSAccessor::Type::tDirectory:
       obj.attr("type", "directory");
diff --git a/third_party/nix/src/libstore/nar-info-disk-cache.cc b/third_party/nix/src/libstore/nar-info-disk-cache.cc
index 6d40f4abc6a8..6d9aeb129d22 100644
--- a/third_party/nix/src/libstore/nar-info-disk-cache.cc
+++ b/third_party/nix/src/libstore/nar-info-disk-cache.cc
@@ -143,7 +143,9 @@ class NarInfoDiskCacheImpl : public NarInfoDiskCache {
 
   Cache& getCache(State& state, const std::string& uri) {
     auto i = state.caches.find(uri);
-    if (i == state.caches.end()) abort();
+    if (i == state.caches.end()) {
+      abort();
+    }
     return i->second;
   }
 
@@ -170,7 +172,9 @@ class NarInfoDiskCacheImpl : public NarInfoDiskCache {
       auto i = state->caches.find(uri);
       if (i == state->caches.end()) {
         auto queryCache(state->queryCache.use()(uri));
-        if (!queryCache.next()) return false;
+        if (!queryCache.next()) {
+          return false;
+        }
         state->caches.emplace(
             uri, Cache{(int)queryCache.getInt(0), queryCache.getStr(1),
                        queryCache.getInt(2) != 0, (int)queryCache.getInt(3)});
@@ -199,9 +203,13 @@ class NarInfoDiskCacheImpl : public NarInfoDiskCache {
               now - settings.ttlNegativeNarInfoCache)(
               now - settings.ttlPositiveNarInfoCache));
 
-          if (!queryNAR.next()) return {oUnknown, 0};
+          if (!queryNAR.next()) {
+            return {oUnknown, 0};
+          }
 
-          if (!queryNAR.getInt(0)) return {oInvalid, 0};
+          if (!queryNAR.getInt(0)) {
+            return {oInvalid, 0};
+          }
 
           auto narInfo = make_ref<NarInfo>();
 
@@ -210,7 +218,9 @@ class NarInfoDiskCacheImpl : public NarInfoDiskCache {
                           (namePart.empty() ? "" : "-" + namePart);
           narInfo->url = queryNAR.getStr(2);
           narInfo->compression = queryNAR.getStr(3);
-          if (!queryNAR.isNull(4)) narInfo->fileHash = Hash(queryNAR.getStr(4));
+          if (!queryNAR.isNull(4)) {
+            narInfo->fileHash = Hash(queryNAR.getStr(4));
+          }
           narInfo->fileSize = queryNAR.getInt(5);
           narInfo->narHash = Hash(queryNAR.getStr(6));
           narInfo->narSize = queryNAR.getInt(7);
diff --git a/third_party/nix/src/libstore/nar-info.cc b/third_party/nix/src/libstore/nar-info.cc
index 492ccc08daf8..cbc922a7daca 100644
--- a/third_party/nix/src/libstore/nar-info.cc
+++ b/third_party/nix/src/libstore/nar-info.cc
@@ -22,17 +22,23 @@ NarInfo::NarInfo(const Store& store, const std::string& s,
   size_t pos = 0;
   while (pos < s.size()) {
     size_t colon = s.find(':', pos);
-    if (colon == std::string::npos) corrupt();
+    if (colon == std::string::npos) {
+      corrupt();
+    }
 
     std::string name(s, pos, colon - pos);
 
     size_t eol = s.find('\n', colon + 2);
-    if (eol == std::string::npos) corrupt();
+    if (eol == std::string::npos) {
+      corrupt();
+    }
 
     std::string value(s, colon + 2, eol - colon - 2);
 
     if (name == "StorePath") {
-      if (!store.isStorePath(value)) corrupt();
+      if (!store.isStorePath(value)) {
+        corrupt();
+      }
       path = value;
     } else if (name == "URL")
       url = value;
@@ -41,23 +47,33 @@ NarInfo::NarInfo(const Store& store, const std::string& s,
     else if (name == "FileHash")
       fileHash = parseHashField(value);
     else if (name == "FileSize") {
-      if (!string2Int(value, fileSize)) corrupt();
+      if (!string2Int(value, fileSize)) {
+        corrupt();
+      }
     } else if (name == "NarHash")
       narHash = parseHashField(value);
     else if (name == "NarSize") {
-      if (!string2Int(value, narSize)) corrupt();
+      if (!string2Int(value, narSize)) {
+        corrupt();
+      }
     } else if (name == "References") {
       auto refs = tokenizeString<Strings>(value, " ");
-      if (!references.empty()) corrupt();
+      if (!references.empty()) {
+        corrupt();
+      }
       for (auto& r : refs) {
         auto r2 = store.storeDir + "/" + r;
-        if (!store.isStorePath(r2)) corrupt();
+        if (!store.isStorePath(r2)) {
+          corrupt();
+        }
         references.insert(r2);
       }
     } else if (name == "Deriver") {
       if (value != "unknown-deriver") {
         auto p = store.storeDir + "/" + value;
-        if (!store.isStorePath(p)) corrupt();
+        if (!store.isStorePath(p)) {
+          corrupt();
+        }
         deriver = p;
       }
     } else if (name == "System")
@@ -65,16 +81,22 @@ NarInfo::NarInfo(const Store& store, const std::string& s,
     else if (name == "Sig")
       sigs.insert(value);
     else if (name == "CA") {
-      if (!ca.empty()) corrupt();
+      if (!ca.empty()) {
+        corrupt();
+      }
       ca = value;
     }
 
     pos = eol + 1;
   }
 
-  if (compression == "") compression = "bzip2";
+  if (compression == "") {
+    compression = "bzip2";
+  }
 
-  if (path.empty() || url.empty() || narSize == 0 || !narHash) corrupt();
+  if (path.empty() || url.empty() || narSize == 0 || !narHash) {
+    corrupt();
+  }
 }
 
 std::string NarInfo::to_string() const {
@@ -92,13 +114,19 @@ std::string NarInfo::to_string() const {
 
   res += "References: " + concatStringsSep(" ", shortRefs()) + "\n";
 
-  if (!deriver.empty()) res += "Deriver: " + baseNameOf(deriver) + "\n";
+  if (!deriver.empty()) {
+    res += "Deriver: " + baseNameOf(deriver) + "\n";
+  }
 
-  if (!system.empty()) res += "System: " + system + "\n";
+  if (!system.empty()) {
+    res += "System: " + system + "\n";
+  }
 
   for (auto sig : sigs) res += "Sig: " + sig + "\n";
 
-  if (!ca.empty()) res += "CA: " + ca + "\n";
+  if (!ca.empty()) {
+    res += "CA: " + ca + "\n";
+  }
 
   return res;
 }
diff --git a/third_party/nix/src/libstore/optimise-store.cc b/third_party/nix/src/libstore/optimise-store.cc
index d5629c880573..450f31c59f10 100644
--- a/third_party/nix/src/libstore/optimise-store.cc
+++ b/third_party/nix/src/libstore/optimise-store.cc
@@ -29,7 +29,9 @@ struct MakeReadOnly {
   ~MakeReadOnly() {
     try {
       /* This will make the path read-only. */
-      if (path != "") canonicaliseTimestampAndPermissions(path);
+      if (path != "") {
+        canonicaliseTimestampAndPermissions(path);
+      }
     } catch (...) {
       ignoreException();
     }
@@ -79,7 +81,9 @@ Strings LocalStore::readDirectoryIgnoringInodes(const Path& path,
     }
 
     string name = dirent->d_name;
-    if (name == "." || name == "..") continue;
+    if (name == "." || name == "..") {
+      continue;
+    }
     names.push_back(name);
   }
   if (errno) {
@@ -261,7 +265,9 @@ void LocalStore::optimiseStore(OptimiseStats& stats) {
 
   for (auto& i : paths) {
     addTempRoot(i);
-    if (!isValidPath(i)) continue; /* path was GC'ed, probably */
+    if (!isValidPath(i)) {
+      continue;
+    } /* path was GC'ed, probably */
     {
       LOG(INFO) << "optimising path '" << i << "'";
       optimisePath_(stats, realStoreDir + "/" + baseNameOf(i), inodeHash);
diff --git a/third_party/nix/src/libstore/parsed-derivations.cc b/third_party/nix/src/libstore/parsed-derivations.cc
index 6a8c235a0c17..29133664fd76 100644
--- a/third_party/nix/src/libstore/parsed-derivations.cc
+++ b/third_party/nix/src/libstore/parsed-derivations.cc
@@ -100,7 +100,9 @@ bool ParsedDerivation::canBuildLocally() const {
     return false;
 
   for (auto& feature : getRequiredSystemFeatures())
-    if (!settings.systemFeatures.get().count(feature)) return false;
+    if (!settings.systemFeatures.get().count(feature)) {
+      return false;
+    }
 
   return true;
 }
diff --git a/third_party/nix/src/libstore/pathlocks.cc b/third_party/nix/src/libstore/pathlocks.cc
index d71717e73ed2..ffec3d7d7ea6 100644
--- a/third_party/nix/src/libstore/pathlocks.cc
+++ b/third_party/nix/src/libstore/pathlocks.cc
@@ -57,8 +57,12 @@ bool lockFile(int fd, LockType lockType, bool wait) {
   } else {
     while (flock(fd, type | LOCK_NB) != 0) {
       checkInterrupt();
-      if (errno == EWOULDBLOCK) return false;
-      if (errno != EINTR) throw SysError(format("acquiring/releasing lock"));
+      if (errno == EWOULDBLOCK) {
+        return false;
+      }
+      if (errno != EINTR) {
+        throw SysError(format("acquiring/releasing lock"));
+      }
     }
   }
 
@@ -143,7 +147,9 @@ PathLocks::~PathLocks() {
 
 void PathLocks::unlock() {
   for (auto& i : fds) {
-    if (deletePaths) deleteLockFile(i.second, i.first);
+    if (deletePaths) {
+      deleteLockFile(i.second, i.first);
+    }
 
     if (close(i.first) == -1) {
       LOG(WARNING) << "cannot close lock file on '" << i.second << "'";
diff --git a/third_party/nix/src/libstore/profiles.cc b/third_party/nix/src/libstore/profiles.cc
index 3e7126bb3343..38d0972e4400 100644
--- a/third_party/nix/src/libstore/profiles.cc
+++ b/third_party/nix/src/libstore/profiles.cc
@@ -19,10 +19,14 @@ static bool cmpGensByNumber(const Generation& a, const Generation& b) {
 /* Parse a generation name of the format
    `<profilename>-<number>-link'. */
 static int parseName(const string& profileName, const string& name) {
-  if (string(name, 0, profileName.size() + 1) != profileName + "-") return -1;
+  if (string(name, 0, profileName.size() + 1) != profileName + "-") {
+    return -1;
+  }
   string s = string(name, profileName.size() + 1);
   string::size_type p = s.find("-link");
-  if (p == string::npos) return -1;
+  if (p == string::npos) {
+    return -1;
+  }
   int n;
   if (string2Int(string(s, 0, p), n) && n >= 0)
     return n;
@@ -135,7 +139,9 @@ void deleteGenerations(const Path& profile,
                 profile);
 
   for (auto& i : gens) {
-    if (gensToDelete.find(i.number) == gensToDelete.end()) continue;
+    if (gensToDelete.find(i.number) == gensToDelete.end()) {
+      continue;
+    }
     deleteGeneration2(profile, i.number, dryRun);
   }
 }
@@ -171,7 +177,9 @@ void deleteOldGenerations(const Path& profile, bool dryRun) {
   Generations gens = findGenerations(profile, curGen);
 
   for (auto& i : gens)
-    if (i.number != curGen) deleteGeneration2(profile, i.number, dryRun);
+    if (i.number != curGen) {
+      deleteGeneration2(profile, i.number, dryRun);
+    }
 }
 
 void deleteGenerationsOlderThan(const Path& profile, time_t t, bool dryRun) {
@@ -185,7 +193,9 @@ void deleteGenerationsOlderThan(const Path& profile, time_t t, bool dryRun) {
   for (auto i = gens.rbegin(); i != gens.rend(); ++i)
     if (canDelete) {
       assert(i->creationTime < t);
-      if (i->number != curGen) deleteGeneration2(profile, i->number, dryRun);
+      if (i->number != curGen) {
+        deleteGeneration2(profile, i->number, dryRun);
+      }
     } else if (i->creationTime < t) {
       /* We may now start deleting generations, but we don't
          delete this generation yet, because this generation was
@@ -211,7 +221,9 @@ void deleteGenerationsOlderThan(const Path& profile, const string& timeSpec,
 
 void switchLink(Path link, Path target) {
   /* Hacky. */
-  if (dirOf(target) == dirOf(link)) target = baseNameOf(target);
+  if (dirOf(target) == dirOf(link)) {
+    target = baseNameOf(target);
+  }
 
   replaceSymlink(target, link);
 }
diff --git a/third_party/nix/src/libstore/references.cc b/third_party/nix/src/libstore/references.cc
index 63cd284732a6..a46bdc758fbf 100644
--- a/third_party/nix/src/libstore/references.cc
+++ b/third_party/nix/src/libstore/references.cc
@@ -35,7 +35,9 @@ static void search(const unsigned char* s, size_t len, StringSet& hashes,
         match = false;
         break;
       }
-    if (!match) continue;
+    if (!match) {
+      continue;
+    }
     string ref((const char*)s + i, refLength);
     if (hashes.find(ref) != hashes.end()) {
       DLOG(INFO) << "found reference to '" << ref << "' at offset " << i;
@@ -88,7 +90,9 @@ PathSet scanForReferences(const string& path, const PathSet& refs,
   for (auto& i : refs) {
     string baseName = baseNameOf(i);
     string::size_type pos = baseName.find('-');
-    if (pos == string::npos) throw Error(format("bad reference '%1%'") % i);
+    if (pos == string::npos) {
+      throw Error(format("bad reference '%1%'") % i);
+    }
     string s = string(baseName, 0, pos);
     assert(s.size() == refLength);
     assert(backMap.find(s) == backMap.end());
@@ -104,7 +108,9 @@ PathSet scanForReferences(const string& path, const PathSet& refs,
   PathSet found;
   for (auto& i : sink.seen) {
     std::map<string, Path>::iterator j;
-    if ((j = backMap.find(i)) == backMap.end()) abort();
+    if ((j = backMap.find(i)) == backMap.end()) {
+      abort();
+    }
     found.insert(j->second);
   }
 
diff --git a/third_party/nix/src/libstore/remote-fs-accessor.cc b/third_party/nix/src/libstore/remote-fs-accessor.cc
index 63a0f58fda51..0b9bb805ebce 100644
--- a/third_party/nix/src/libstore/remote-fs-accessor.cc
+++ b/third_party/nix/src/libstore/remote-fs-accessor.cc
@@ -11,7 +11,9 @@ namespace nix {
 
 RemoteFSAccessor::RemoteFSAccessor(ref<Store> store, const Path& cacheDir)
     : store(store), cacheDir(cacheDir) {
-  if (cacheDir != "") createDirs(cacheDir);
+  if (cacheDir != "") {
+    createDirs(cacheDir);
+  }
 }
 
 Path RemoteFSAccessor::makeCacheFile(const Path& storePath,
@@ -51,7 +53,9 @@ std::pair<ref<FSAccessor>, Path> RemoteFSAccessor::fetch(const Path& path_) {
                       storePath);
 
   auto i = nars.find(storePath);
-  if (i != nars.end()) return {i->second, restPath};
+  if (i != nars.end()) {
+    return {i->second, restPath};
+  }
 
   StringSink sink;
   std::string listing;
@@ -65,7 +69,9 @@ std::pair<ref<FSAccessor>, Path> RemoteFSAccessor::fetch(const Path& path_) {
       auto narAccessor = makeLazyNarAccessor(
           listing, [cacheFile](uint64_t offset, uint64_t length) {
             AutoCloseFD fd = open(cacheFile.c_str(), O_RDONLY | O_CLOEXEC);
-            if (!fd) throw SysError("opening NAR cache file '%s'", cacheFile);
+            if (!fd) {
+              throw SysError("opening NAR cache file '%s'", cacheFile);
+            }
 
             if (lseek(fd.get(), offset, SEEK_SET) != (off_t)offset)
               throw SysError("seeking in '%s'", cacheFile);
diff --git a/third_party/nix/src/libstore/remote-store.cc b/third_party/nix/src/libstore/remote-store.cc
index a4cb98fe7f10..e53720b37d03 100644
--- a/third_party/nix/src/libstore/remote-store.cc
+++ b/third_party/nix/src/libstore/remote-store.cc
@@ -96,7 +96,9 @@ ref<RemoteStore::Connection> UDSRemoteStore::openConnection() {
 #endif
                     ,
                     0);
-  if (!conn->fd) throw SysError("cannot create Unix domain socket");
+  if (!conn->fd) {
+    throw SysError("cannot create Unix domain socket");
+  }
   closeOnExec(conn->fd.get());
 
   string socketPath = path ? *path : settings.nixDaemonSocketFile;
@@ -126,7 +128,9 @@ void RemoteStore::initConnection(Connection& conn) {
     conn.to << WORKER_MAGIC_1;
     conn.to.flush();
     unsigned int magic = readInt(conn.from);
-    if (magic != WORKER_MAGIC_2) throw Error("protocol mismatch");
+    if (magic != WORKER_MAGIC_2) {
+      throw Error("protocol mismatch");
+    }
 
     conn.from >> conn.daemonVersion;
     if (GET_PROTOCOL_MAJOR(conn.daemonVersion) !=
@@ -144,10 +148,14 @@ void RemoteStore::initConnection(Connection& conn) {
         conn.to << 0;
     }
 
-    if (GET_PROTOCOL_MINOR(conn.daemonVersion) >= 11) conn.to << false;
+    if (GET_PROTOCOL_MINOR(conn.daemonVersion) >= 11) {
+      conn.to << false;
+    }
 
     auto ex = conn.processStderr();
-    if (ex) std::rethrow_exception(ex);
+    if (ex) {
+      std::rethrow_exception(ex);
+    }
   } catch (Error& e) {
     throw Error("cannot open connection to remote store '%s': %s", getUri(),
                 e.what());
@@ -185,7 +193,9 @@ void RemoteStore::setOptions(Connection& conn) {
   }
 
   auto ex = conn.processStderr();
-  if (ex) std::rethrow_exception(ex);
+  if (ex) {
+    std::rethrow_exception(ex);
+  }
 }
 
 /* A wrapper around Pool<RemoteStore::Connection>::Handle that marks
@@ -238,7 +248,9 @@ PathSet RemoteStore::queryValidPaths(const PathSet& paths,
   if (GET_PROTOCOL_MINOR(conn->daemonVersion) < 12) {
     PathSet res;
     for (auto& i : paths)
-      if (isValidPath(i)) res.insert(i);
+      if (isValidPath(i)) {
+        res.insert(i);
+      }
     return res;
   } else {
     conn->to << wopQueryValidPaths << paths;
@@ -261,7 +273,9 @@ PathSet RemoteStore::querySubstitutablePaths(const PathSet& paths) {
     for (auto& i : paths) {
       conn->to << wopHasSubstitutes << i;
       conn.processStderr();
-      if (readInt(conn->from)) res.insert(i);
+      if (readInt(conn->from)) {
+        res.insert(i);
+      }
     }
     return res;
   } else {
@@ -273,7 +287,9 @@ PathSet RemoteStore::querySubstitutablePaths(const PathSet& paths) {
 
 void RemoteStore::querySubstitutablePathInfos(const PathSet& paths,
                                               SubstitutablePathInfos& infos) {
-  if (paths.empty()) return;
+  if (paths.empty()) {
+    return;
+  }
 
   auto conn(getConnection());
 
@@ -283,9 +299,13 @@ void RemoteStore::querySubstitutablePathInfos(const PathSet& paths,
       conn->to << wopQuerySubstitutablePathInfo << i;
       conn.processStderr();
       unsigned int reply = readInt(conn->from);
-      if (reply == 0) continue;
+      if (reply == 0) {
+        continue;
+      }
       info.deriver = readString(conn->from);
-      if (info.deriver != "") assertStorePath(info.deriver);
+      if (info.deriver != "") {
+        assertStorePath(info.deriver);
+      }
       info.references = readStorePaths<PathSet>(*this, conn->from);
       info.downloadSize = readLongLong(conn->from);
       info.narSize = readLongLong(conn->from);
@@ -300,7 +320,9 @@ void RemoteStore::querySubstitutablePathInfos(const PathSet& paths,
       Path path = readStorePath(*this, conn->from);
       SubstitutablePathInfo& info(infos[path]);
       info.deriver = readString(conn->from);
-      if (info.deriver != "") assertStorePath(info.deriver);
+      if (info.deriver != "") {
+        assertStorePath(info.deriver);
+      }
       info.references = readStorePaths<PathSet>(*this, conn->from);
       info.downloadSize = readLongLong(conn->from);
       info.narSize = readLongLong(conn->from);
@@ -327,12 +349,16 @@ void RemoteStore::queryPathInfoUncached(
       if (GET_PROTOCOL_MINOR(conn->daemonVersion) >= 17) {
         bool valid;
         conn->from >> valid;
-        if (!valid) throw InvalidPath(format("path '%s' is not valid") % path);
+        if (!valid) {
+          throw InvalidPath(format("path '%s' is not valid") % path);
+        }
       }
       info = std::make_shared<ValidPathInfo>();
       info->path = path;
       info->deriver = readString(conn->from);
-      if (info->deriver != "") assertStorePath(info->deriver);
+      if (info->deriver != "") {
+        assertStorePath(info->deriver);
+      }
       info->narHash = Hash(readString(conn->from), htSHA256);
       info->references = readStorePaths<PathSet>(*this, conn->from);
       conn->from >> info->registrationTime >> info->narSize;
@@ -382,7 +408,9 @@ Path RemoteStore::queryPathFromHashPart(const string& hashPart) {
   conn->to << wopQueryPathFromHashPart << hashPart;
   conn.processStderr();
   Path path = readString(conn->from);
-  if (!path.empty()) assertStorePath(path);
+  if (!path.empty()) {
+    assertStorePath(path);
+  }
   return path;
 }
 
@@ -416,7 +444,9 @@ void RemoteStore::addToStore(const ValidPathInfo& info, Source& source,
              << info.registrationTime << info.narSize << info.ultimate
              << info.sigs << info.ca << repair << !checkSigs;
     bool tunnel = GET_PROTOCOL_MINOR(conn->daemonVersion) >= 21;
-    if (!tunnel) copyNAR(source, conn->to);
+    if (!tunnel) {
+      copyNAR(source, conn->to);
+    }
     conn.processStderr(0, tunnel ? &source : nullptr);
   }
 }
@@ -647,12 +677,16 @@ std::exception_ptr RemoteStore::Connection::processStderr(Sink* sink,
 
     if (msg == STDERR_WRITE) {
       string s = readString(from);
-      if (!sink) throw Error("no sink");
+      if (!sink) {
+        throw Error("no sink");
+      }
       (*sink)(s);
     }
 
     else if (msg == STDERR_READ) {
-      if (!source) throw Error("no source");
+      if (!source) {
+        throw Error("no source");
+      }
       size_t len = readNum<size_t>(from);
       auto buf = std::make_unique<unsigned char[]>(len);
       writeString(buf.get(), source->read(buf.get(), len), to);
@@ -690,7 +724,9 @@ static std::string uriScheme = "unix://";
 static RegisterStoreImplementation regStore(
     [](const std::string& uri,
        const Store::Params& params) -> std::shared_ptr<Store> {
-      if (std::string(uri, 0, uriScheme.size()) != uriScheme) return 0;
+      if (std::string(uri, 0, uriScheme.size()) != uriScheme) {
+        return 0;
+      }
       return std::make_shared<UDSRemoteStore>(
           std::string(uri, uriScheme.size()), params);
     });
diff --git a/third_party/nix/src/libstore/s3-binary-cache-store.cc b/third_party/nix/src/libstore/s3-binary-cache-store.cc
index 1249a92d3f58..483ddc19a3aa 100644
--- a/third_party/nix/src/libstore/s3-binary-cache-store.cc
+++ b/third_party/nix/src/libstore/s3-binary-cache-store.cc
@@ -153,7 +153,9 @@ S3Helper::DownloadResult S3Helper::getObject(const std::string& bucketName,
                    dynamic_cast<std::stringstream&>(result.GetBody()).str());
 
   } catch (S3Error& e) {
-    if (e.err != Aws::S3::S3Errors::NO_SUCH_KEY) throw;
+    if (e.err != Aws::S3::S3Errors::NO_SUCH_KEY) {
+      throw;
+    }
   }
 
   auto now2 = std::chrono::steady_clock::now();
@@ -315,7 +317,9 @@ struct S3BinaryCacheStoreImpl : public S3BinaryCacheStore {
 
       request.SetContentType(mimeType);
 
-      if (contentEncoding != "") request.SetContentEncoding(contentEncoding);
+      if (contentEncoding != "") {
+        request.SetContentEncoding(contentEncoding);
+      }
 
       auto stream = std::make_shared<istringstream_nocopy>(data);
 
@@ -394,7 +398,9 @@ struct S3BinaryCacheStoreImpl : public S3BinaryCacheStore {
 
       for (auto object : contents) {
         auto& key = object.GetKey();
-        if (key.size() != 40 || !hasSuffix(key, ".narinfo")) continue;
+        if (key.size() != 40 || !hasSuffix(key, ".narinfo")) {
+          continue;
+        }
         paths.insert(storeDir + "/" + key.substr(0, key.size() - 8));
       }
 
@@ -408,7 +414,9 @@ struct S3BinaryCacheStoreImpl : public S3BinaryCacheStore {
 static RegisterStoreImplementation regStore(
     [](const std::string& uri,
        const Store::Params& params) -> std::shared_ptr<Store> {
-      if (std::string(uri, 0, 5) != "s3://") return 0;
+      if (std::string(uri, 0, 5) != "s3://") {
+        return 0;
+      }
       auto store =
           std::make_shared<S3BinaryCacheStoreImpl>(params, std::string(uri, 5));
       store->init();
diff --git a/third_party/nix/src/libstore/ssh-store.cc b/third_party/nix/src/libstore/ssh-store.cc
index f11acc7b80ae..7728e00ec80c 100644
--- a/third_party/nix/src/libstore/ssh-store.cc
+++ b/third_party/nix/src/libstore/ssh-store.cc
@@ -77,7 +77,9 @@ ref<RemoteStore::Connection> SSHStore::openConnection() {
 static RegisterStoreImplementation regStore([](const std::string& uri,
                                                const Store::Params& params)
                                                 -> std::shared_ptr<Store> {
-  if (std::string(uri, 0, uriScheme.size()) != uriScheme) return 0;
+  if (std::string(uri, 0, uriScheme.size()) != uriScheme) {
+    return 0;
+  }
   return std::make_shared<SSHStore>(std::string(uri, uriScheme.size()), params);
 });
 
diff --git a/third_party/nix/src/libstore/ssh.cc b/third_party/nix/src/libstore/ssh.cc
index 6a2eee59655e..20add33c0046 100644
--- a/third_party/nix/src/libstore/ssh.cc
+++ b/third_party/nix/src/libstore/ssh.cc
@@ -17,8 +17,12 @@ SSHMaster::SSHMaster(const std::string& host, const std::string& keyFile,
 void SSHMaster::addCommonSSHOpts(Strings& args) {
   for (auto& i : tokenizeString<Strings>(getEnv("NIX_SSHOPTS")))
     args.push_back(i);
-  if (!keyFile.empty()) args.insert(args.end(), {"-i", keyFile});
-  if (compress) args.push_back("-C");
+  if (!keyFile.empty()) {
+    args.insert(args.end(), {"-i", keyFile});
+  }
+  if (compress) {
+    args.push_back("-C");
+  }
 }
 
 std::unique_ptr<SSHMaster::Connection> SSHMaster::startCommand(
@@ -81,11 +85,15 @@ std::unique_ptr<SSHMaster::Connection> SSHMaster::startCommand(
 }
 
 Path SSHMaster::startMaster() {
-  if (!useMaster) return "";
+  if (!useMaster) {
+    return "";
+  }
 
   auto state(state_.lock());
 
-  if (state->sshMaster != -1) return state->socketPath;
+  if (state->sshMaster != -1) {
+    return state->socketPath;
+  }
 
   state->tmpDir =
       std::make_unique<AutoDelete>(createTempDir("", "nix", true, true, 0700));
@@ -112,7 +120,7 @@ Path SSHMaster::startMaster() {
                         "-S",  state->socketPath,
                         "-o",  "LocalCommand=echo started",
                         "-o",  "PermitLocalCommand=yes"};
-        // if (verbosity >= lvlChatty) args.push_back("-v");
+        // if (verbosity >= lvlChatty) { args.push_back("-v"); }
         addCommonSSHOpts(args);
         execvp(args.begin()->c_str(), stringsToCharPtrs(args).data());
 
diff --git a/third_party/nix/src/libstore/store-api.cc b/third_party/nix/src/libstore/store-api.cc
index 736970e8db99..41eb84a81294 100644
--- a/third_party/nix/src/libstore/store-api.cc
+++ b/third_party/nix/src/libstore/store-api.cc
@@ -342,7 +342,9 @@ void Store::queryPathInfo(const Path& storePath,
         try {
           auto info = fut.get();
 
-          if (diskCache) diskCache->upsertNarInfo(getUri(), hashPart, info);
+          if (diskCache) {
+            diskCache->upsertNarInfo(getUri(), hashPart, info);
+          }
 
           {
             auto state_(state.lock());
@@ -388,7 +390,9 @@ PathSet Store::queryValidPaths(const PathSet& paths,
             state->exc = std::current_exception();
           }
           assert(state->left);
-          if (!--state->left) wakeup.notify_one();
+          if (!--state->left) {
+            wakeup.notify_one();
+          }
         }});
   };
 
@@ -399,7 +403,9 @@ PathSet Store::queryValidPaths(const PathSet& paths,
   while (true) {
     auto state(state_.lock());
     if (!state->left) {
-      if (state->exc) std::rethrow_exception(state->exc);
+      if (state->exc) {
+        std::rethrow_exception(state->exc);
+      }
       return state->valid;
     }
     state.wait(wakeup);
@@ -455,7 +461,9 @@ void Store::pathInfoToJSON(JSONPlaceholder& jsonOut, const PathSet& storePaths,
         for (auto& ref : info->references) jsonRefs.elem(ref);
       }
 
-      if (info->ca != "") jsonPath.attr("ca", info->ca);
+      if (info->ca != "") {
+        jsonPath.attr("ca", info->ca);
+      }
 
       std::pair<uint64_t, uint64_t> closureSizes;
 
@@ -465,12 +473,16 @@ void Store::pathInfoToJSON(JSONPlaceholder& jsonOut, const PathSet& storePaths,
       }
 
       if (includeImpureInfo) {
-        if (info->deriver != "") jsonPath.attr("deriver", info->deriver);
+        if (info->deriver != "") {
+          jsonPath.attr("deriver", info->deriver);
+        }
 
         if (info->registrationTime)
           jsonPath.attr("registrationTime", info->registrationTime);
 
-        if (info->ultimate) jsonPath.attr("ultimate", info->ultimate);
+        if (info->ultimate) {
+          jsonPath.attr("ultimate", info->ultimate);
+        }
 
         if (!info->sigs.empty()) {
           auto jsonSigs = jsonPath.list("signatures");
@@ -481,7 +493,9 @@ void Store::pathInfoToJSON(JSONPlaceholder& jsonOut, const PathSet& storePaths,
             std::shared_ptr<const ValidPathInfo>(info));
 
         if (narInfo) {
-          if (!narInfo->url.empty()) jsonPath.attr("url", narInfo->url);
+          if (!narInfo->url.empty()) {
+            jsonPath.attr("url", narInfo->url);
+          }
           if (narInfo->fileHash)
             jsonPath.attr("downloadHash", narInfo->fileHash.to_string());
           if (narInfo->fileSize)
@@ -506,7 +520,9 @@ std::pair<uint64_t, uint64_t> Store::getClosureSize(const Path& storePath) {
     totalNarSize += info->narSize;
     auto narInfo = std::dynamic_pointer_cast<const NarInfo>(
         std::shared_ptr<const ValidPathInfo>(info));
-    if (narInfo) totalDownloadSize += narInfo->fileSize;
+    if (narInfo) {
+      totalDownloadSize += narInfo->fileSize;
+    }
   }
   return {totalNarSize, totalDownloadSize};
 }
@@ -521,9 +537,13 @@ const Store::Stats& Store::getStats() {
 
 void Store::buildPaths(const PathSet& paths, BuildMode buildMode) {
   for (auto& path : paths)
-    if (isDerivation(path)) unsupported("buildPaths");
+    if (isDerivation(path)) {
+      unsupported("buildPaths");
+    }
 
-  if (queryValidPaths(paths).size() != paths.size()) unsupported("buildPaths");
+  if (queryValidPaths(paths).size() != paths.size()) {
+    unsupported("buildPaths");
+  }
 }
 
 void copyStorePath(ref<Store> srcStore, ref<Store> dstStore,
@@ -552,8 +572,12 @@ void copyStorePath(ref<Store> srcStore, ref<Store> dstStore,
     srcStore->narFromPath({storePath}, sink);
     auto info2 = make_ref<ValidPathInfo>(*info);
     info2->narHash = hashString(htSHA256, *sink.s);
-    if (!info->narSize) info2->narSize = sink.s->size();
-    if (info->ultimate) info2->ultimate = false;
+    if (!info->narSize) {
+      info2->narSize = sink.s->size();
+    }
+    if (info->ultimate) {
+      info2->ultimate = false;
+    }
     info = info2;
 
     StringSource source(*sink.s);
@@ -590,9 +614,13 @@ void copyPaths(ref<Store> srcStore, ref<Store> dstStore,
 
   PathSet missing;
   for (auto& path : storePaths)
-    if (!valid.count(path)) missing.insert(path);
+    if (!valid.count(path)) {
+      missing.insert(path);
+    }
 
-  if (missing.empty()) return;
+  if (missing.empty()) {
+    return;
+  }
 
   LOG(INFO) << "copying " << missing.size() << " paths";
 
@@ -628,7 +656,9 @@ void copyPaths(ref<Store> srcStore, ref<Store> dstStore,
             copyStorePath(srcStore, dstStore, storePath, repair, checkSigs);
           } catch (Error& e) {
             nrFailed++;
-            if (!settings.keepGoing) throw e;
+            if (!settings.keepGoing) {
+              throw e;
+            }
             LOG(ERROR) << "could not copy " << storePath << ": " << e.what();
             return;
           }
@@ -658,25 +688,33 @@ ValidPathInfo decodeValidPathInfo(std::istream& str, bool hashGiven) {
     getline(str, s);
     info.narHash = Hash(s, htSHA256);
     getline(str, s);
-    if (!string2Int(s, info.narSize)) throw Error("number expected");
+    if (!string2Int(s, info.narSize)) {
+      throw Error("number expected");
+    }
   }
   getline(str, info.deriver);
   string s;
   int n;
   getline(str, s);
-  if (!string2Int(s, n)) throw Error("number expected");
+  if (!string2Int(s, n)) {
+    throw Error("number expected");
+  }
   while (n--) {
     getline(str, s);
     info.references.insert(s);
   }
-  if (!str || str.eof()) throw Error("missing input");
+  if (!str || str.eof()) {
+    throw Error("missing input");
+  }
   return info;
 }
 
 string showPaths(const PathSet& paths) {
   string s;
   for (auto& i : paths) {
-    if (s.size() != 0) s += ", ";
+    if (s.size() != 0) {
+      s += ", ";
+    }
     s += "'" + i + "'";
   }
   return s;
@@ -725,11 +763,15 @@ bool ValidPathInfo::isContentAddressed(const Store& store) const {
 
 size_t ValidPathInfo::checkSignatures(const Store& store,
                                       const PublicKeys& publicKeys) const {
-  if (isContentAddressed(store)) return maxSigs;
+  if (isContentAddressed(store)) {
+    return maxSigs;
+  }
 
   size_t good = 0;
   for (auto& sig : sigs)
-    if (checkSignature(publicKeys, sig)) good++;
+    if (checkSignature(publicKeys, sig)) {
+      good++;
+    }
   return good;
 }
 
@@ -848,7 +890,9 @@ static RegisterStoreImplementation regStore([](const std::string& uri,
       return std::shared_ptr<Store>(std::make_shared<UDSRemoteStore>(params));
     case tLocal: {
       Store::Params params2 = params;
-      if (hasPrefix(uri, "/")) params2["root"] = uri;
+      if (hasPrefix(uri, "/")) {
+        params2["root"] = uri;
+      }
       return std::shared_ptr<Store>(std::make_shared<LocalStore>(params2));
     }
     default:
@@ -863,7 +907,9 @@ std::list<ref<Store>> getDefaultSubstituters() {
     StringSet done;
 
     auto addStore = [&](const std::string& uri) {
-      if (done.count(uri)) return;
+      if (done.count(uri)) {
+        return;
+      }
       done.insert(uri);
       try {
         stores.push_back(openStore(uri));
diff --git a/third_party/nix/src/libstore/store-api.hh b/third_party/nix/src/libstore/store-api.hh
index d4e207128bc2..e8c78b7a64e7 100644
--- a/third_party/nix/src/libstore/store-api.hh
+++ b/third_party/nix/src/libstore/store-api.hh
@@ -747,7 +747,9 @@ struct RegisterStoreImplementation {
   static Implementations* implementations;
 
   RegisterStoreImplementation(OpenStore fun) {
-    if (!implementations) implementations = new Implementations;
+    if (!implementations) {
+      implementations = new Implementations;
+    }
     implementations->push_back(fun);
   }
 };
diff --git a/third_party/nix/src/libutil/archive.cc b/third_party/nix/src/libutil/archive.cc
index c6ee5fcb2a93..a86170b315e6 100644
--- a/third_party/nix/src/libutil/archive.cc
+++ b/third_party/nix/src/libutil/archive.cc
@@ -46,7 +46,9 @@ static void dumpContents(const Path& path, size_t size, Sink& sink) {
   sink << "contents" << size;
 
   AutoCloseFD fd = open(path.c_str(), O_RDONLY | O_CLOEXEC);
-  if (!fd) throw SysError(format("opening file '%1%'") % path);
+  if (!fd) {
+    throw SysError(format("opening file '%1%'") % path);
+  }
 
   std::vector<unsigned char> buf(65536);
   size_t left = size;
@@ -162,7 +164,9 @@ static void parseContents(ParseSink& sink, Source& source, const Path& path) {
   while (left) {
     checkInterrupt();
     auto n = buf.size();
-    if ((unsigned long long)n > left) n = left;
+    if ((unsigned long long)n > left) {
+      n = left;
+    }
     source(buf.data(), n);
     sink.receiveContents(buf.data(), n);
     left -= n;
@@ -181,7 +185,9 @@ static void parse(ParseSink& sink, Source& source, const Path& path) {
   string s;
 
   s = readString(source);
-  if (s != "(") throw badArchive("expected open tag");
+  if (s != "(") {
+    throw badArchive("expected open tag");
+  }
 
   enum { tpUnknown, tpRegular, tpDirectory, tpSymlink } type = tpUnknown;
 
@@ -197,7 +203,9 @@ static void parse(ParseSink& sink, Source& source, const Path& path) {
     }
 
     else if (s == "type") {
-      if (type != tpUnknown) throw badArchive("multiple type fields");
+      if (type != tpUnknown) {
+        throw badArchive("multiple type fields");
+      }
       string t = readString(source);
 
       if (t == "regular") {
@@ -225,7 +233,9 @@ static void parse(ParseSink& sink, Source& source, const Path& path) {
 
     else if (s == "executable" && type == tpRegular) {
       auto s = readString(source);
-      if (s != "") throw badArchive("executable marker has non-empty value");
+      if (s != "") {
+        throw badArchive("executable marker has non-empty value");
+      }
       sink.isExecutable();
     }
 
@@ -233,7 +243,9 @@ static void parse(ParseSink& sink, Source& source, const Path& path) {
       string name, prevName;
 
       s = readString(source);
-      if (s != "(") throw badArchive("expected open tag");
+      if (s != "(") {
+        throw badArchive("expected open tag");
+      }
 
       while (1) {
         checkInterrupt();
@@ -248,7 +260,9 @@ static void parse(ParseSink& sink, Source& source, const Path& path) {
               name.find('/') != string::npos ||
               name.find((char)0) != string::npos)
             throw Error(format("NAR contains invalid file name '%1%'") % name);
-          if (name <= prevName) throw Error("NAR directory is not sorted");
+          if (name <= prevName) {
+            throw Error("NAR directory is not sorted");
+          }
           prevName = name;
           if (archiveSettings.useCaseHack) {
             auto i = names.find(name);
@@ -306,12 +320,16 @@ struct RestoreSink : ParseSink {
   void createRegularFile(const Path& path) {
     Path p = dstPath + path;
     fd = open(p.c_str(), O_CREAT | O_EXCL | O_WRONLY | O_CLOEXEC, 0666);
-    if (!fd) throw SysError(format("creating file '%1%'") % p);
+    if (!fd) {
+      throw SysError(format("creating file '%1%'") % p);
+    }
   }
 
   void isExecutable() {
     struct stat st;
-    if (fstat(fd.get(), &st) == -1) throw SysError("fstat");
+    if (fstat(fd.get(), &st) == -1) {
+      throw SysError("fstat");
+    }
     if (fchmod(fd.get(), st.st_mode | (S_IXUSR | S_IXGRP | S_IXOTH)) == -1)
       throw SysError("fchmod");
   }
diff --git a/third_party/nix/src/libutil/args.cc b/third_party/nix/src/libutil/args.cc
index 2199099e7cba..cfe68ad6a055 100644
--- a/third_party/nix/src/libutil/args.cc
+++ b/third_party/nix/src/libutil/args.cc
@@ -9,7 +9,9 @@ Args::FlagMaker Args::mkFlag() { return FlagMaker(*this); }
 Args::FlagMaker::~FlagMaker() {
   assert(flag->longName != "");
   args.longFlags[flag->longName] = flag;
-  if (flag->shortName) args.shortFlags[flag->shortName] = flag;
+  if (flag->shortName) {
+    args.shortFlags[flag->shortName] = flag;
+  }
 }
 
 void Args::parseCmdline(const Strings& _cmdline) {
@@ -46,7 +48,9 @@ void Args::parseCmdline(const Strings& _cmdline) {
         throw UsageError(format("unrecognised flag '%1%'") % arg);
     } else {
       pendingArgs.push_back(*pos++);
-      if (processArgs(pendingArgs, false)) pendingArgs.clear();
+      if (processArgs(pendingArgs, false)) {
+        pendingArgs.clear();
+      }
     }
   }
 
@@ -58,13 +62,19 @@ void Args::printHelp(const string& programName, std::ostream& out) {
   for (auto& exp : expectedArgs) {
     std::cout << renderLabels({exp.label});
     // FIXME: handle arity > 1
-    if (exp.arity == 0) std::cout << "...";
-    if (exp.optional) std::cout << "?";
+    if (exp.arity == 0) {
+      std::cout << "...";
+    }
+    if (exp.optional) {
+      std::cout << "?";
+    }
   }
   std::cout << "\n";
 
   auto s = description();
-  if (s != "") std::cout << "\nSummary: " << s << ".\n";
+  if (s != "") {
+    std::cout << "\nSummary: " << s << ".\n";
+  }
 
   if (longFlags.size()) {
     std::cout << "\n";
@@ -76,7 +86,9 @@ void Args::printHelp(const string& programName, std::ostream& out) {
 void Args::printFlags(std::ostream& out) {
   Table2 table;
   for (auto& flag : longFlags) {
-    if (hiddenCategories.count(flag.second->category)) continue;
+    if (hiddenCategories.count(flag.second->category)) {
+      continue;
+    }
     table.push_back(std::make_pair(
         (flag.second->shortName
              ? std::string("-") + flag.second->shortName + ", "
@@ -95,7 +107,9 @@ bool Args::processFlag(Strings::iterator& pos, Strings::iterator end) {
     std::vector<std::string> args;
     for (size_t n = 0; n < flag.arity; ++n) {
       if (pos == end) {
-        if (flag.arity == ArityAny) break;
+        if (flag.arity == ArityAny) {
+          break;
+        }
         throw UsageError(format("flag '%1%' requires %2% argument(s)") % name %
                          flag.arity);
       }
@@ -107,14 +121,18 @@ bool Args::processFlag(Strings::iterator& pos, Strings::iterator end) {
 
   if (string(*pos, 0, 2) == "--") {
     auto i = longFlags.find(string(*pos, 2));
-    if (i == longFlags.end()) return false;
+    if (i == longFlags.end()) {
+      return false;
+    }
     return process("--" + i->first, *i->second);
   }
 
   if (string(*pos, 0, 1) == "-" && pos->size() == 2) {
     auto c = (*pos)[1];
     auto i = shortFlags.find(c);
-    if (i == shortFlags.end()) return false;
+    if (i == shortFlags.end()) {
+      return false;
+    }
     return process(std::string("-") + c, *i->second);
   }
 
@@ -153,7 +171,9 @@ Args::FlagMaker& Args::FlagMaker::mkHashTypeFlag(HashType* ht) {
   description("hash algorithm ('md5', 'sha1', 'sha256', or 'sha512')");
   handler([ht](std::string s) {
     *ht = parseHashType(s);
-    if (*ht == htUnknown) throw UsageError("unknown hash type '%1%'", s);
+    if (*ht == htUnknown) {
+      throw UsageError("unknown hash type '%1%'", s);
+    }
   });
   return *this;
 }
diff --git a/third_party/nix/src/libutil/compression.cc b/third_party/nix/src/libutil/compression.cc
index b025e33683c8..219d9046fa65 100644
--- a/third_party/nix/src/libutil/compression.cc
+++ b/third_party/nix/src/libutil/compression.cc
@@ -138,7 +138,9 @@ struct BrotliDecompressionSink : ChunkedCompressionSink {
 
   BrotliDecompressionSink(Sink& nextSink) : nextSink(nextSink) {
     state = BrotliDecoderCreateInstance(nullptr, nullptr, nullptr);
-    if (!state) throw CompressionError("unable to initialize brotli decoder");
+    if (!state) {
+      throw CompressionError("unable to initialize brotli decoder");
+    }
   }
 
   ~BrotliDecompressionSink() { BrotliDecoderDestroyInstance(state); }
@@ -214,7 +216,9 @@ struct XzCompressionSink : CompressionSink {
       mt_options.check = LZMA_CHECK_CRC64;
       mt_options.threads = lzma_cputhreads();
       mt_options.block_size = 0;
-      if (mt_options.threads == 0) mt_options.threads = 1;
+      if (mt_options.threads == 0) {
+        mt_options.threads = 1;
+      }
       // FIXME: maybe use lzma_stream_encoder_mt_memusage() to control the
       // number of threads.
       ret = lzma_stream_encoder_mt(&strm, &mt_options);
@@ -322,7 +326,9 @@ struct BrotliCompressionSink : ChunkedCompressionSink {
 
   BrotliCompressionSink(Sink& nextSink) : nextSink(nextSink) {
     state = BrotliEncoderCreateInstance(nullptr, nullptr, nullptr);
-    if (!state) throw CompressionError("unable to initialise brotli encoder");
+    if (!state) {
+      throw CompressionError("unable to initialise brotli encoder");
+    }
   }
 
   ~BrotliCompressionSink() { BrotliEncoderDestroyInstance(state); }
diff --git a/third_party/nix/src/libutil/config.cc b/third_party/nix/src/libutil/config.cc
index 83dbf8b6e54f..dbb703750f36 100644
--- a/third_party/nix/src/libutil/config.cc
+++ b/third_party/nix/src/libutil/config.cc
@@ -11,7 +11,9 @@ namespace nix {
 
 bool Config::set(const std::string& name, const std::string& value) {
   auto i = _settings.find(name);
-  if (i == _settings.end()) return false;
+  if (i == _settings.end()) {
+    return false;
+  }
   i->second.setting->set(value);
   i->second.setting->overriden = true;
   return true;
@@ -84,10 +86,14 @@ void AbstractConfig::applyConfigFile(const Path& path) {
       pos++;
 
       string::size_type hash = line.find('#');
-      if (hash != string::npos) line = string(line, 0, hash);
+      if (hash != string::npos) {
+        line = string(line, 0, hash);
+      }
 
       vector<string> tokens = tokenizeString<vector<string> >(line);
-      if (tokens.empty()) continue;
+      if (tokens.empty()) {
+        continue;
+      }
 
       if (tokens.size() < 2)
         throw UsageError("illegal configuration line '%1%' in '%2%'", line,
@@ -147,7 +153,9 @@ void Config::toJSON(JSONObject& out) {
 
 void Config::convertToArgs(Args& args, const std::string& category) {
   for (auto& s : _settings)
-    if (!s.second.isAlias) s.second.setting->convertToArg(args, category);
+    if (!s.second.isAlias) {
+      s.second.setting->convertToArg(args, category);
+    }
 }
 
 AbstractSetting::AbstractSetting(const std::string& name,
@@ -284,7 +292,9 @@ void PathSetting::set(const std::string& str) {
 
 bool GlobalConfig::set(const std::string& name, const std::string& value) {
   for (auto& config : *configRegistrations)
-    if (config->set(name, value)) return true;
+    if (config->set(name, value)) {
+      return true;
+    }
 
   unknownSettings.emplace(name, value);
 
@@ -315,7 +325,9 @@ GlobalConfig globalConfig;
 GlobalConfig::ConfigRegistrations* GlobalConfig::configRegistrations;
 
 GlobalConfig::Register::Register(Config* config) {
-  if (!configRegistrations) configRegistrations = new ConfigRegistrations;
+  if (!configRegistrations) {
+    configRegistrations = new ConfigRegistrations;
+  }
   configRegistrations->emplace_back(config);
 }
 
diff --git a/third_party/nix/src/libutil/hash.cc b/third_party/nix/src/libutil/hash.cc
index d303a4f5b97d..0a0869dd4e8c 100644
--- a/third_party/nix/src/libutil/hash.cc
+++ b/third_party/nix/src/libutil/hash.cc
@@ -139,7 +139,9 @@ Hash::Hash(const std::string& s, HashType type) : type(type) {
   if (sep != string::npos) {
     string hts = string(s, 0, sep);
     this->type = parseHashType(hts);
-    if (this->type == htUnknown) throw BadHash("unknown hash type '%s'", hts);
+    if (this->type == htUnknown) {
+      throw BadHash("unknown hash type '%s'", hts);
+    }
     if (type != htUnknown && type != this->type)
       throw BadHash("hash '%s' should have type '%s'", s, printHashType(type));
     pos = sep + 1;
@@ -174,8 +176,12 @@ Hash::Hash(const std::string& s, HashType type) : type(type) {
       char c = s[pos + size - n - 1];
       unsigned char digit;
       for (digit = 0; digit < base32Chars.size(); ++digit) /* !!! slow */
-        if (base32Chars[digit] == c) break;
-      if (digit >= 32) throw BadHash("invalid base-32 hash '%s'", s);
+        if (base32Chars[digit] == c) {
+          break;
+        }
+      if (digit >= 32) {
+        throw BadHash("invalid base-32 hash '%s'", s);
+      }
       unsigned int b = n * 5;
       unsigned int i = b / 8;
       unsigned int j = b % 8;
@@ -184,7 +190,9 @@ Hash::Hash(const std::string& s, HashType type) : type(type) {
       if (i < hashSize - 1) {
         hash[i + 1] |= digit >> (8 - j);
       } else {
-        if (digit >> (8 - j)) throw BadHash("invalid base-32 hash '%s'", s);
+        if (digit >> (8 - j)) {
+          throw BadHash("invalid base-32 hash '%s'", s);
+        }
       }
     }
   }
@@ -258,13 +266,17 @@ Hash hashFile(HashType ht, const Path& path) {
   start(ht, ctx);
 
   AutoCloseFD fd = open(path.c_str(), O_RDONLY | O_CLOEXEC);
-  if (!fd) throw SysError(format("opening file '%1%'") % path);
+  if (!fd) {
+    throw SysError(format("opening file '%1%'") % path);
+  }
 
   std::vector<unsigned char> buf(8192);
   ssize_t n;
   while ((n = read(fd.get(), buf.data(), buf.size()))) {
     checkInterrupt();
-    if (n == -1) throw SysError(format("reading file '%1%'") % path);
+    if (n == -1) {
+      throw SysError(format("reading file '%1%'") % path);
+    }
     update(ht, ctx, buf.data(), n);
   }
 
diff --git a/third_party/nix/src/libutil/json.cc b/third_party/nix/src/libutil/json.cc
index 8746ca9a6947..7965f4725ba4 100644
--- a/third_party/nix/src/libutil/json.cc
+++ b/third_party/nix/src/libutil/json.cc
@@ -91,7 +91,9 @@ JSONWriter::~JSONWriter() {
   if (state) {
     assertActive();
     state->stack--;
-    if (state->stack == 0) delete state;
+    if (state->stack == 0) {
+      delete state;
+    }
   }
 }
 
@@ -158,7 +160,9 @@ void JSONObject::attr(const std::string& s) {
   comma();
   toJSON(state->str, s);
   state->str << ':';
-  if (state->indent) state->str << ' ';
+  if (state->indent) {
+    state->str << ' ';
+  }
 }
 
 JSONList JSONObject::list(const std::string& name) {
diff --git a/third_party/nix/src/libutil/lazy.hh b/third_party/nix/src/libutil/lazy.hh
index 9807b7540620..b564b481fc38 100644
--- a/third_party/nix/src/libutil/lazy.hh
+++ b/third_party/nix/src/libutil/lazy.hh
@@ -35,7 +35,9 @@ class Lazy {
         ex = std::current_exception();
       }
     });
-    if (ex) std::rethrow_exception(ex);
+    if (ex) {
+      std::rethrow_exception(ex);
+    }
     return value;
   }
 };
diff --git a/third_party/nix/src/libutil/lru-cache.hh b/third_party/nix/src/libutil/lru-cache.hh
index bf7263243c31..f6fcdaf82ebd 100644
--- a/third_party/nix/src/libutil/lru-cache.hh
+++ b/third_party/nix/src/libutil/lru-cache.hh
@@ -31,7 +31,9 @@ class LRUCache {
 
   /* Insert or upsert an item in the cache. */
   void upsert(const Key& key, const Value& value) {
-    if (capacity == 0) return;
+    if (capacity == 0) {
+      return;
+    }
 
     erase(key);
 
@@ -53,7 +55,9 @@ class LRUCache {
 
   bool erase(const Key& key) {
     auto i = data.find(key);
-    if (i == data.end()) return false;
+    if (i == data.end()) {
+      return false;
+    }
     lru.erase(i->second.first.it);
     data.erase(i);
     return true;
@@ -63,7 +67,9 @@ class LRUCache {
      recently used item. */
   std::optional<Value> get(const Key& key) {
     auto i = data.find(key);
-    if (i == data.end()) return {};
+    if (i == data.end()) {
+      return {};
+    }
 
     /* Move this item to the back of the LRU list. */
     lru.erase(i->second.first.it);
diff --git a/third_party/nix/src/libutil/monitor-fd.hh b/third_party/nix/src/libutil/monitor-fd.hh
index 54e9de848a13..c818c5826116 100644
--- a/third_party/nix/src/libutil/monitor-fd.hh
+++ b/third_party/nix/src/libutil/monitor-fd.hh
@@ -28,7 +28,9 @@ class MonitorFdHup {
         */
         fds[0].events = POLLHUP;
         auto count = poll(fds, 1, -1);
-        if (count == -1) abort();  // can't happen
+        if (count == -1) {
+          abort();
+        }  // can't happen
         /* This shouldn't happen, but can on macOS due to a bug.
            See rdar://37550628.
 
@@ -36,7 +38,9 @@ class MonitorFdHup {
            coordination with the main thread if spinning proves
            too harmful.
          */
-        if (count == 0) continue;
+        if (count == 0) {
+          continue;
+        }
         assert(fds[0].revents & POLLHUP);
         triggerInterrupt();
         break;
diff --git a/third_party/nix/src/libutil/pool.hh b/third_party/nix/src/libutil/pool.hh
index e25d82d8ec11..6d70795d35ac 100644
--- a/third_party/nix/src/libutil/pool.hh
+++ b/third_party/nix/src/libutil/pool.hh
@@ -99,10 +99,14 @@ class Pool {
     Handle(const Handle& l) = delete;
 
     ~Handle() {
-      if (!r) return;
+      if (!r) {
+        return;
+      }
       {
         auto state_(pool.state.lock());
-        if (!bad) state_->idle.push_back(ref<R>(r));
+        if (!bad) {
+          state_->idle.push_back(ref<R>(r));
+        }
         assert(state_->inUse);
         state_->inUse--;
       }
@@ -160,7 +164,9 @@ class Pool {
     auto state_(state.lock());
     std::vector<ref<R>> left;
     for (auto& p : state_->idle)
-      if (validator(p)) left.push_back(p);
+      if (validator(p)) {
+        left.push_back(p);
+      }
     std::swap(state_->idle, left);
   }
 };
diff --git a/third_party/nix/src/libutil/ref.hh b/third_party/nix/src/libutil/ref.hh
index 5f0d7db4b6a1..063e6b327c22 100644
--- a/third_party/nix/src/libutil/ref.hh
+++ b/third_party/nix/src/libutil/ref.hh
@@ -17,11 +17,15 @@ class ref {
   ref<T>(const ref<T>& r) : p(r.p) {}
 
   explicit ref<T>(const std::shared_ptr<T>& p) : p(p) {
-    if (!p) throw std::invalid_argument("null pointer cast to ref");
+    if (!p) {
+      throw std::invalid_argument("null pointer cast to ref");
+    }
   }
 
   explicit ref<T>(T* p) : p(p) {
-    if (!p) throw std::invalid_argument("null pointer cast to ref");
+    if (!p) {
+      throw std::invalid_argument("null pointer cast to ref");
+    }
   }
 
   T* operator->() const { return &*p; }
diff --git a/third_party/nix/src/libutil/serialise.cc b/third_party/nix/src/libutil/serialise.cc
index 079b88c1cfc4..760d19ed4cf3 100644
--- a/third_party/nix/src/libutil/serialise.cc
+++ b/third_party/nix/src/libutil/serialise.cc
@@ -11,7 +11,9 @@
 namespace nix {
 
 void BufferedSink::operator()(const unsigned char* data, size_t len) {
-  if (!buffer) buffer = decltype(buffer)(new unsigned char[bufSize]);
+  if (!buffer) {
+    buffer = decltype(buffer)(new unsigned char[bufSize]);
+  }
 
   while (len) {
     /* Optimisation: bypass the buffer if the data exceeds the
@@ -28,12 +30,16 @@ void BufferedSink::operator()(const unsigned char* data, size_t len) {
     data += n;
     bufPos += n;
     len -= n;
-    if (bufPos == bufSize) flush();
+    if (bufPos == bufSize) {
+      flush();
+    }
   }
 }
 
 void BufferedSink::flush() {
-  if (bufPos == 0) return;
+  if (bufPos == 0) {
+    return;
+  }
   size_t n = bufPos;
   bufPos = 0;  // don't trigger the assert() in ~BufferedSink()
   write(buffer.get(), n);
@@ -97,15 +103,21 @@ std::string Source::drain() {
 }
 
 size_t BufferedSource::read(unsigned char* data, size_t len) {
-  if (!buffer) buffer = decltype(buffer)(new unsigned char[bufSize]);
+  if (!buffer) {
+    buffer = decltype(buffer)(new unsigned char[bufSize]);
+  }
 
-  if (!bufPosIn) bufPosIn = readUnbuffered(buffer.get(), bufSize);
+  if (!bufPosIn) {
+    bufPosIn = readUnbuffered(buffer.get(), bufSize);
+  }
 
   /* Copy out the data in the buffer. */
   size_t n = len > bufPosIn - bufPosOut ? bufPosIn - bufPosOut : len;
   memcpy(data, buffer.get() + bufPosOut, n);
   bufPosOut += n;
-  if (bufPosIn == bufPosOut) bufPosIn = bufPosOut = 0;
+  if (bufPosIn == bufPosOut) {
+    bufPosIn = bufPosOut = 0;
+  }
   return n;
 }
 
@@ -132,7 +144,9 @@ size_t FdSource::readUnbuffered(unsigned char* data, size_t len) {
 bool FdSource::good() { return _good; }
 
 size_t StringSource::read(unsigned char* data, size_t len) {
-  if (pos == s.size()) throw EndOfFile("end of string reached");
+  if (pos == s.size()) {
+    throw EndOfFile("end of string reached");
+  }
   size_t n = s.copy((char*)data, len, pos);
   pos += n;
   return n;
@@ -162,7 +176,9 @@ std::unique_ptr<Source> sinkToSource(std::function<void(Sink&)> fun,
       if (!coro)
         coro = coro_t::pull_type([&](coro_t::push_type& yield) {
           LambdaSink sink([&](const unsigned char* data, size_t len) {
-            if (len) yield(std::string((const char*)data, len));
+            if (len) {
+              yield(std::string((const char*)data, len));
+            }
           });
           fun(sink);
         });
@@ -232,13 +248,17 @@ void readPadding(size_t len, Source& source) {
     size_t n = 8 - (len % 8);
     source(zero, n);
     for (unsigned int i = 0; i < n; i++)
-      if (zero[i]) throw SerialisationError("non-zero padding");
+      if (zero[i]) {
+        throw SerialisationError("non-zero padding");
+      }
   }
 }
 
 size_t readString(unsigned char* buf, size_t max, Source& source) {
   auto len = readNum<size_t>(source);
-  if (len > max) throw SerialisationError("string is too long");
+  if (len > max) {
+    throw SerialisationError("string is too long");
+  }
   source(buf, len);
   readPadding(len, source);
   return len;
@@ -246,7 +266,9 @@ size_t readString(unsigned char* buf, size_t max, Source& source) {
 
 string readString(Source& source, size_t max) {
   auto len = readNum<size_t>(source);
-  if (len > max) throw SerialisationError("string is too long");
+  if (len > max) {
+    throw SerialisationError("string is too long");
+  }
   std::string res(len, 0);
   source((unsigned char*)res.data(), len);
   readPadding(len, source);
diff --git a/third_party/nix/src/libutil/thread-pool.cc b/third_party/nix/src/libutil/thread-pool.cc
index ee727aacd02a..a16f4c2b6033 100644
--- a/third_party/nix/src/libutil/thread-pool.cc
+++ b/third_party/nix/src/libutil/thread-pool.cc
@@ -10,7 +10,9 @@ ThreadPool::ThreadPool(size_t _maxThreads) : maxThreads(_maxThreads) {
 
   if (!maxThreads) {
     maxThreads = std::thread::hardware_concurrency();
-    if (!maxThreads) maxThreads = 1;
+    if (!maxThreads) {
+      maxThreads = 1;
+    }
   }
 
   DLOG(INFO) << "starting pool of " << maxThreads - 1 << " threads";
@@ -26,7 +28,9 @@ void ThreadPool::shutdown() {
     std::swap(workers, state->workers);
   }
 
-  if (workers.empty()) return;
+  if (workers.empty()) {
+    return;
+  }
 
   DLOG(INFO) << "reaping " << workers.size() << " worker threads";
 
@@ -62,7 +66,9 @@ void ThreadPool::process() {
 
     assert(quit);
 
-    if (state->exception) std::rethrow_exception(state->exception);
+    if (state->exception) {
+      std::rethrow_exception(state->exception);
+    }
 
   } catch (...) {
     /* In the exceptional case, some workers may still be
@@ -76,7 +82,9 @@ void ThreadPool::process() {
 }
 
 void ThreadPool::doWork(bool mainThread) {
-  if (!mainThread) interruptCheck = [&]() { return (bool)quit; };
+  if (!mainThread) {
+    interruptCheck = [&]() { return (bool)quit; };
+  }
 
   bool didWork = false;
   std::exception_ptr exc;
@@ -114,9 +122,13 @@ void ThreadPool::doWork(bool mainThread) {
       /* Wait until a work item is available or we're asked to
          quit. */
       while (true) {
-        if (quit) return;
+        if (quit) {
+          return;
+        }
 
-        if (!state->pending.empty()) break;
+        if (!state->pending.empty()) {
+          break;
+        }
 
         /* If there are no active or pending items, and the
            main thread is running process(), then no new items
diff --git a/third_party/nix/src/libutil/thread-pool.hh b/third_party/nix/src/libutil/thread-pool.hh
index d709c9dbc855..114dae40eec9 100644
--- a/third_party/nix/src/libutil/thread-pool.hh
+++ b/third_party/nix/src/libutil/thread-pool.hh
@@ -78,7 +78,9 @@ void processGraph(ThreadPool& pool, const std::set<T>& nodes,
     {
       auto graph(graph_.lock());
       auto i = graph->refs.find(node);
-      if (i == graph->refs.end()) goto getRefs;
+      if (i == graph->refs.end()) {
+        goto getRefs;
+      }
       goto doWork;
     }
 
@@ -93,7 +95,9 @@ void processGraph(ThreadPool& pool, const std::set<T>& nodes,
           graph->refs[node].insert(ref);
           graph->rrefs[ref].insert(node);
         }
-      if (graph->refs[node].empty()) goto doWork;
+      if (graph->refs[node].empty()) {
+        goto doWork;
+      }
     }
   }
 
@@ -111,7 +115,9 @@ void processGraph(ThreadPool& pool, const std::set<T>& nodes,
         auto i = refs.find(node);
         assert(i != refs.end());
         refs.erase(i);
-        if (refs.empty()) pool.enqueue(std::bind(worker, rref));
+        if (refs.empty()) {
+          pool.enqueue(std::bind(worker, rref));
+        }
       }
       graph->left.erase(node);
       graph->refs.erase(node);
diff --git a/third_party/nix/src/libutil/util.cc b/third_party/nix/src/libutil/util.cc
index 1740d1f256d0..0a2887501c8e 100644
--- a/third_party/nix/src/libutil/util.cc
+++ b/third_party/nix/src/libutil/util.cc
@@ -107,7 +107,9 @@ Path canonPath(const Path& path, bool resolveSymlinks) {
 
   string s;
 
-  if (path[0] != '/') throw Error(format("not an absolute path: '%1%'") % path);
+  if (path[0] != '/') {
+    throw Error(format("not an absolute path: '%1%'") % path);
+  }
 
   string::const_iterator i = path.begin(), end = path.end();
   string temp;
@@ -119,15 +121,21 @@ Path canonPath(const Path& path, bool resolveSymlinks) {
   while (1) {
     /* Skip slashes. */
     while (i != end && *i == '/') i++;
-    if (i == end) break;
+    if (i == end) {
+      break;
+    }
 
     /* Ignore `.'. */
-    if (*i == '.' && (i + 1 == end || i[1] == '/')) i++;
+    if (*i == '.' && (i + 1 == end || i[1] == '/')) {
+      i++;
+    }
 
     /* If `..', delete the last component. */
     else if (*i == '.' && i + 1 < end && i[1] == '.' &&
              (i + 2 == end || i[2] == '/')) {
-      if (!s.empty()) s.erase(s.rfind('/'));
+      if (!s.empty()) {
+        s.erase(s.rfind('/'));
+      }
       i += 2;
     }
 
@@ -155,15 +163,21 @@ Path canonPath(const Path& path, bool resolveSymlinks) {
 
 Path dirOf(const Path& path) {
   Path::size_type pos = path.rfind('/');
-  if (pos == string::npos) return ".";
+  if (pos == string::npos) {
+    return ".";
+  }
   return pos == 0 ? "/" : Path(path, 0, pos);
 }
 
 string baseNameOf(const Path& path) {
-  if (path.empty()) return "";
+  if (path.empty()) {
+    return "";
+  }
 
   Path::size_type last = path.length() - 1;
-  if (path[last] == '/' && last > 0) last -= 1;
+  if (path[last] == '/' && last > 0) {
+    last -= 1;
+  }
 
   Path::size_type pos = path.rfind('/', last);
   if (pos == string::npos)
@@ -228,13 +242,17 @@ DirEntries readDirectory(const Path& path) {
   entries.reserve(64);
 
   AutoCloseDir dir(opendir(path.c_str()));
-  if (!dir) throw SysError(format("opening directory '%1%'") % path);
+  if (!dir) {
+    throw SysError(format("opening directory '%1%'") % path);
+  }
 
   struct dirent* dirent;
   while (errno = 0, dirent = readdir(dir.get())) { /* sic */
     checkInterrupt();
     string name = dirent->d_name;
-    if (name == "." || name == "..") continue;
+    if (name == "." || name == "..") {
+      continue;
+    }
     entries.emplace_back(name, dirent->d_ino,
 #ifdef HAVE_STRUCT_DIRENT_D_TYPE
                          dirent->d_type
@@ -243,22 +261,32 @@ DirEntries readDirectory(const Path& path) {
 #endif
     );
   }
-  if (errno) throw SysError(format("reading directory '%1%'") % path);
+  if (errno) {
+    throw SysError(format("reading directory '%1%'") % path);
+  }
 
   return entries;
 }
 
 unsigned char getFileType(const Path& path) {
   struct stat st = lstat(path);
-  if (S_ISDIR(st.st_mode)) return DT_DIR;
-  if (S_ISLNK(st.st_mode)) return DT_LNK;
-  if (S_ISREG(st.st_mode)) return DT_REG;
+  if (S_ISDIR(st.st_mode)) {
+    return DT_DIR;
+  }
+  if (S_ISLNK(st.st_mode)) {
+    return DT_LNK;
+  }
+  if (S_ISREG(st.st_mode)) {
+    return DT_REG;
+  }
   return DT_UNKNOWN;
 }
 
 string readFile(int fd) {
   struct stat st;
-  if (fstat(fd, &st) == -1) throw SysError("statting file");
+  if (fstat(fd, &st) == -1) {
+    throw SysError("statting file");
+  }
 
   std::vector<unsigned char> buf(st.st_size);
   readFull(fd, buf.data(), st.st_size);
@@ -268,27 +296,35 @@ string readFile(int fd) {
 
 string readFile(const Path& path, bool drain) {
   AutoCloseFD fd = open(path.c_str(), O_RDONLY | O_CLOEXEC);
-  if (!fd) throw SysError(format("opening file '%1%'") % path);
+  if (!fd) {
+    throw SysError(format("opening file '%1%'") % path);
+  }
   return drain ? drainFD(fd.get()) : readFile(fd.get());
 }
 
 void readFile(const Path& path, Sink& sink) {
   AutoCloseFD fd = open(path.c_str(), O_RDONLY | O_CLOEXEC);
-  if (!fd) throw SysError("opening file '%s'", path);
+  if (!fd) {
+    throw SysError("opening file '%s'", path);
+  }
   drainFD(fd.get(), sink);
 }
 
 void writeFile(const Path& path, const string& s, mode_t mode) {
   AutoCloseFD fd =
       open(path.c_str(), O_WRONLY | O_TRUNC | O_CREAT | O_CLOEXEC, mode);
-  if (!fd) throw SysError(format("opening file '%1%'") % path);
+  if (!fd) {
+    throw SysError(format("opening file '%1%'") % path);
+  }
   writeFull(fd.get(), s);
 }
 
 void writeFile(const Path& path, Source& source, mode_t mode) {
   AutoCloseFD fd =
       open(path.c_str(), O_WRONLY | O_TRUNC | O_CREAT | O_CLOEXEC, mode);
-  if (!fd) throw SysError(format("opening file '%1%'") % path);
+  if (!fd) {
+    throw SysError(format("opening file '%1%'") % path);
+  }
 
   std::vector<unsigned char> buf(64 * 1024);
 
@@ -310,11 +346,15 @@ string readLine(int fd) {
     // FIXME: inefficient
     ssize_t rd = read(fd, &ch, 1);
     if (rd == -1) {
-      if (errno != EINTR) throw SysError("reading a line");
+      if (errno != EINTR) {
+        throw SysError("reading a line");
+      }
     } else if (rd == 0)
       throw EndOfFile("unexpected EOF reading a line");
     else {
-      if (ch == '\n') return s;
+      if (ch == '\n') {
+        return s;
+      }
       s += ch;
     }
   }
@@ -330,11 +370,15 @@ static void _deletePath(const Path& path, unsigned long long& bytesFreed) {
 
   struct stat st;
   if (lstat(path.c_str(), &st) == -1) {
-    if (errno == ENOENT) return;
+    if (errno == ENOENT) {
+      return;
+    }
     throw SysError(format("getting status of '%1%'") % path);
   }
 
-  if (!S_ISDIR(st.st_mode) && st.st_nlink == 1) bytesFreed += st.st_size;
+  if (!S_ISDIR(st.st_mode) && st.st_nlink == 1) {
+    bytesFreed += st.st_size;
+  }
 
   if (S_ISDIR(st.st_mode)) {
     /* Make the directory accessible. */
@@ -349,7 +393,9 @@ static void _deletePath(const Path& path, unsigned long long& bytesFreed) {
   }
 
   if (remove(path.c_str()) == -1) {
-    if (errno == ENOENT) return;
+    if (errno == ENOENT) {
+      return;
+    }
     throw SysError(format("cannot unlink '%1%'") % path);
   }
 }
@@ -409,7 +455,9 @@ Path createTempDir(const Path& tmpRoot, const Path& prefix, bool includePid,
 std::string getUserName() {
   auto pw = getpwuid(geteuid());
   std::string name = pw ? pw->pw_name : getEnv("USER", "");
-  if (name.empty()) throw Error("cannot figure out user name");
+  if (name.empty()) {
+    throw Error("cannot figure out user name");
+  }
   return name;
 }
 
@@ -431,13 +479,17 @@ Path getHome() { return getHome2(); }
 
 Path getCacheDir() {
   Path cacheDir = getEnv("XDG_CACHE_HOME");
-  if (cacheDir.empty()) cacheDir = getHome() + "/.cache";
+  if (cacheDir.empty()) {
+    cacheDir = getHome() + "/.cache";
+  }
   return cacheDir;
 }
 
 Path getConfigDir() {
   Path configDir = getEnv("XDG_CONFIG_HOME");
-  if (configDir.empty()) configDir = getHome() + "/.config";
+  if (configDir.empty()) {
+    configDir = getHome() + "/.config";
+  }
   return configDir;
 }
 
@@ -452,13 +504,17 @@ std::vector<Path> getConfigDirs() {
 
 Path getDataDir() {
   Path dataDir = getEnv("XDG_DATA_HOME");
-  if (dataDir.empty()) dataDir = getHome() + "/.local/share";
+  if (dataDir.empty()) {
+    dataDir = getHome() + "/.local/share";
+  }
   return dataDir;
 }
 
 Paths createDirs(const Path& path) {
   Paths created;
-  if (path == "/") return created;
+  if (path == "/") {
+    return created;
+  }
 
   struct stat st;
   if (lstat(path.c_str(), &st) == -1) {
@@ -491,7 +547,9 @@ void replaceSymlink(const Path& target, const Path& link) {
     try {
       createSymlink(target, tmp);
     } catch (SysError& e) {
-      if (e.errNo == EEXIST) continue;
+      if (e.errNo == EEXIST) {
+        continue;
+      }
       throw;
     }
 
@@ -507,10 +565,14 @@ void readFull(int fd, unsigned char* buf, size_t count) {
     checkInterrupt();
     ssize_t res = read(fd, (char*)buf, count);
     if (res == -1) {
-      if (errno == EINTR) continue;
+      if (errno == EINTR) {
+        continue;
+      }
       throw SysError("reading from file");
     }
-    if (res == 0) throw EndOfFile("unexpected end-of-file");
+    if (res == 0) {
+      throw EndOfFile("unexpected end-of-file");
+    }
     count -= res;
     buf += res;
   }
@@ -519,9 +581,13 @@ void readFull(int fd, unsigned char* buf, size_t count) {
 void writeFull(int fd, const unsigned char* buf, size_t count,
                bool allowInterrupts) {
   while (count) {
-    if (allowInterrupts) checkInterrupt();
+    if (allowInterrupts) {
+      checkInterrupt();
+    }
     ssize_t res = write(fd, (char*)buf, count);
-    if (res == -1 && errno != EINTR) throw SysError("writing to file");
+    if (res == -1 && errno != EINTR) {
+      throw SysError("writing to file");
+    }
     if (res > 0) {
       count -= res;
       buf += res;
@@ -560,8 +626,12 @@ void drainFD(int fd, Sink& sink, bool block) {
     checkInterrupt();
     ssize_t rd = read(fd, buf.data(), buf.size());
     if (rd == -1) {
-      if (!block && (errno == EAGAIN || errno == EWOULDBLOCK)) break;
-      if (errno != EINTR) throw SysError("reading from file");
+      if (!block && (errno == EAGAIN || errno == EWOULDBLOCK)) {
+        break;
+      }
+      if (errno != EINTR) {
+        throw SysError("reading from file");
+      }
     } else if (rd == 0)
       break;
     else
@@ -644,9 +714,13 @@ int AutoCloseFD::release() {
 void Pipe::create() {
   int fds[2];
 #if HAVE_PIPE2
-  if (pipe2(fds, O_CLOEXEC) != 0) throw SysError("creating pipe");
+  if (pipe2(fds, O_CLOEXEC) != 0) {
+    throw SysError("creating pipe");
+  }
 #else
-  if (pipe(fds) != 0) throw SysError("creating pipe");
+  if (pipe(fds) != 0) {
+    throw SysError("creating pipe");
+  }
   closeOnExec(fds[0]);
   closeOnExec(fds[1]);
 #endif
@@ -661,11 +735,15 @@ Pid::Pid() {}
 Pid::Pid(pid_t pid) : pid(pid) {}
 
 Pid::~Pid() {
-  if (pid != -1) kill();
+  if (pid != -1) {
+    kill();
+  }
 }
 
 void Pid::operator=(pid_t pid) {
-  if (this->pid != -1 && this->pid != pid) kill();
+  if (this->pid != -1 && this->pid != pid) {
+    kill();
+  }
   this->pid = pid;
   killSignal = SIGKILL;  // reset signal to default
 }
@@ -744,11 +822,17 @@ void killUser(uid_t uid) {
              calling process. In the OSX libc, it's set to true,
              which means "follow POSIX", which we don't want here
                */
-          if (syscall(SYS_kill, -1, SIGKILL, false) == 0) break;
+          if (syscall(SYS_kill, -1, SIGKILL, false) == 0) {
+            break;
+          }
 #else
-          if (kill(-1, SIGKILL) == 0) break;
+          if (kill(-1, SIGKILL) == 0) {
+            break;
+          }
 #endif
-          if (errno == ESRCH) break; /* no more processes */
+          if (errno == ESRCH) {
+            break;
+          } /* no more processes */
           if (errno != EINTR)
             throw SysError(format("cannot kill processes for uid '%1%'") % uid);
         }
@@ -780,7 +864,9 @@ static pid_t doFork(bool allowVfork, std::function<void()> fun) {
 #else
   pid_t pid = fork();
 #endif
-  if (pid != 0) return pid;
+  if (pid != 0) {
+    return pid;
+  }
   fun();
   abort();
 }
@@ -808,7 +894,9 @@ pid_t startProcess(std::function<void()> fun, const ProcessOptions& options) {
   };
 
   pid_t pid = doFork(options.allowVfork, wrapper);
-  if (pid == -1) throw SysError("unable to fork");
+  if (pid == -1) {
+    throw SysError("unable to fork");
+  }
 
   return pid;
 }
@@ -866,19 +954,27 @@ void runProgram2(const RunOptions& options) {
 
   /* Create a pipe. */
   Pipe out, in;
-  if (options.standardOut) out.create();
-  if (source) in.create();
+  if (options.standardOut) {
+    out.create();
+  }
+  if (source) {
+    in.create();
+  }
 
   ProcessOptions processOptions;
   // vfork implies that the environment of the main process and the fork will
   // be shared (technically this is undefined, but in practice that's the
   // case), so we can't use it if we alter the environment
-  if (options.environment) processOptions.allowVfork = false;
+  if (options.environment) {
+    processOptions.allowVfork = false;
+  }
 
   /* Fork. */
   Pid pid = startProcess(
       [&]() {
-        if (options.environment) replaceEnv(*options.environment);
+        if (options.environment) {
+          replaceEnv(*options.environment);
+        }
         if (options.standardOut &&
             dup2(out.writeSide.get(), STDOUT_FILENO) == -1)
           throw SysError("dupping stdout");
@@ -919,7 +1015,9 @@ void runProgram2(const RunOptions& options) {
   std::promise<void> promise;
 
   Finally doJoin([&]() {
-    if (writerThread.joinable()) writerThread.join();
+    if (writerThread.joinable()) {
+      writerThread.join();
+    }
   });
 
   if (source) {
@@ -944,13 +1042,17 @@ void runProgram2(const RunOptions& options) {
     });
   }
 
-  if (options.standardOut) drainFD(out.readSide.get(), *options.standardOut);
+  if (options.standardOut) {
+    drainFD(out.readSide.get(), *options.standardOut);
+  }
 
   /* Wait for the child to finish. */
   int status = pid.wait();
 
   /* Wait for the writer thread to finish. */
-  if (source) promise.get_future().get();
+  if (source) {
+    promise.get_future().get();
+  }
 
   if (status)
     throw ExecError(status, fmt("program '%1%' %2%", options.program,
@@ -975,7 +1077,9 @@ void closeMostFDs(const set<int>& exceptions) {
   int maxFD = 0;
   maxFD = sysconf(_SC_OPEN_MAX);
   for (int fd = 0; fd < maxFD; ++fd)
-    if (!exceptions.count(fd)) close(fd); /* ignore result */
+    if (!exceptions.count(fd)) {
+      close(fd);
+    } /* ignore result */
 }
 
 void closeOnExec(int fd) {
@@ -1012,7 +1116,9 @@ C tokenizeString(const string& s, const string& separators) {
   string::size_type pos = s.find_first_not_of(separators, 0);
   while (pos != string::npos) {
     string::size_type end = s.find_first_of(separators, pos + 1);
-    if (end == string::npos) end = s.size();
+    if (end == string::npos) {
+      end = s.size();
+    }
     string token(s, pos, end - pos);
     result.insert(result.end(), token);
     pos = s.find_first_not_of(separators, end);
@@ -1028,7 +1134,9 @@ template vector<string> tokenizeString(const string& s,
 string concatStringsSep(const string& sep, const Strings& ss) {
   string s;
   for (auto& i : ss) {
-    if (s.size() != 0) s += sep;
+    if (s.size() != 0) {
+      s += sep;
+    }
     s += i;
   }
   return s;
@@ -1037,7 +1145,9 @@ string concatStringsSep(const string& sep, const Strings& ss) {
 string concatStringsSep(const string& sep, const StringSet& ss) {
   string s;
   for (auto& i : ss) {
-    if (s.size() != 0) s += sep;
+    if (s.size() != 0) {
+      s += sep;
+    }
     s += i;
   }
   return s;
@@ -1050,14 +1160,18 @@ string chomp(const string& s) {
 
 string trim(const string& s, const string& whitespace) {
   auto i = s.find_first_not_of(whitespace);
-  if (i == string::npos) return "";
+  if (i == string::npos) {
+    return "";
+  }
   auto j = s.find_last_not_of(whitespace);
   return string(s, i, j == string::npos ? j : j - i + 1);
 }
 
 string replaceStrings(const std::string& s, const std::string& from,
                       const std::string& to) {
-  if (from.empty()) return s;
+  if (from.empty()) {
+    return s;
+  }
   string res = s;
   size_t pos = 0;
   while ((pos = res.find(from, pos)) != std::string::npos) {
@@ -1143,12 +1257,18 @@ std::string filterANSIEscapes(const std::string& s, bool filterAll,
         // eat intermediate bytes
         while (i != s.end() && *i >= 0x20 && *i <= 0x2f) e += *i++;
         // eat final byte
-        if (i != s.end() && *i >= 0x40 && *i <= 0x7e) e += last = *i++;
+        if (i != s.end() && *i >= 0x40 && *i <= 0x7e) {
+          e += last = *i++;
+        }
       } else {
-        if (i != s.end() && *i >= 0x40 && *i <= 0x5f) e += *i++;
+        if (i != s.end() && *i >= 0x40 && *i <= 0x5f) {
+          e += *i++;
+        }
       }
 
-      if (!filterAll && last == 'm') t += e;
+      if (!filterAll && last == 'm') {
+        t += e;
+      }
     }
 
     else if (*i == '\t') {
@@ -1190,7 +1310,9 @@ string base64Encode(const string& s) {
     }
   }
 
-  if (nbits) res.push_back(base64Chars[data << (6 - nbits) & 0x3f]);
+  if (nbits) {
+    res.push_back(base64Chars[data << (6 - nbits) & 0x3f]);
+  }
   while (res.size() % 4) res.push_back('=');
 
   return res;
@@ -1212,11 +1334,17 @@ string base64Decode(const string& s) {
   unsigned int d = 0, bits = 0;
 
   for (char c : s) {
-    if (c == '=') break;
-    if (c == '\n') continue;
+    if (c == '=') {
+      break;
+    }
+    if (c == '\n') {
+      continue;
+    }
 
     char digit = decode[(unsigned char)c];
-    if (digit == -1) throw Error("invalid character in Base64 string");
+    if (digit == -1) {
+      throw Error("invalid character in Base64 string");
+    }
 
     bits += 6;
     d = d << 6 | digit;
diff --git a/third_party/nix/src/libutil/util.hh b/third_party/nix/src/libutil/util.hh
index 3ebe18f54837..a7e9b20fd560 100644
--- a/third_party/nix/src/libutil/util.hh
+++ b/third_party/nix/src/libutil/util.hh
@@ -416,7 +416,9 @@ class Callback {
 
   Callback(Callback&& callback) : fun(std::move(callback.fun)) {
     auto prev = callback.done.test_and_set();
-    if (prev) done.test_and_set();
+    if (prev) {
+      done.test_and_set();
+    }
   }
 
   void operator()(T&& t) noexcept {
diff --git a/third_party/nix/src/libutil/xml-writer.cc b/third_party/nix/src/libutil/xml-writer.cc
index 8bc4e187779f..e07dd92f021e 100644
--- a/third_party/nix/src/libutil/xml-writer.cc
+++ b/third_party/nix/src/libutil/xml-writer.cc
@@ -33,7 +33,9 @@ void XMLWriter::openElement(const string& name, const XMLAttrs& attrs) {
   output << "<" << name;
   writeAttrs(attrs);
   output << ">";
-  if (indent) output << std::endl;
+  if (indent) {
+    output << std::endl;
+  }
   pendingElems.push_back(name);
 }
 
@@ -41,9 +43,13 @@ void XMLWriter::closeElement() {
   assert(!pendingElems.empty());
   indent_(pendingElems.size() - 1);
   output << "</" << pendingElems.back() << ">";
-  if (indent) output << std::endl;
+  if (indent) {
+    output << std::endl;
+  }
   pendingElems.pop_back();
-  if (pendingElems.empty()) closed = true;
+  if (pendingElems.empty()) {
+    closed = true;
+  }
 }
 
 void XMLWriter::writeEmptyElement(const string& name, const XMLAttrs& attrs) {
@@ -52,7 +58,9 @@ void XMLWriter::writeEmptyElement(const string& name, const XMLAttrs& attrs) {
   output << "<" << name;
   writeAttrs(attrs);
   output << " />";
-  if (indent) output << std::endl;
+  if (indent) {
+    output << std::endl;
+  }
 }
 
 void XMLWriter::writeAttrs(const XMLAttrs& attrs) {
diff --git a/third_party/nix/src/nix-build/nix-build.cc b/third_party/nix/src/nix-build/nix-build.cc
index f6845351ee3b..8fcfbe78d8d2 100644
--- a/third_party/nix/src/nix-build/nix-build.cc
+++ b/third_party/nix/src/nix-build/nix-build.cc
@@ -62,7 +62,9 @@ std::vector<string> shellwords(const string& s) {
     }
   }
   cur.append(begin, it);
-  if (!cur.empty()) res.push_back(cur);
+  if (!cur.empty()) {
+    res.push_back(cur);
+  }
   return res;
 }
 
@@ -172,7 +174,9 @@ static void _main(int argc, char** argv) {
           runEnv = true;
 
         else if (*arg == "--command" || *arg == "--run") {
-          if (*arg == "--run") interactive = false;
+          if (*arg == "--run") {
+            interactive = false;
+          }
           envCommand = getArg(*arg, arg, end) + "\nexit";
         }
 
@@ -261,11 +265,17 @@ static void _main(int argc, char** argv) {
     fromArgs = true;
     left = {joined.str()};
   } else if (!fromArgs) {
-    if (left.empty() && runEnv && pathExists("shell.nix")) left = {"shell.nix"};
-    if (left.empty()) left = {"default.nix"};
+    if (left.empty() && runEnv && pathExists("shell.nix")) {
+      left = {"shell.nix"};
+    }
+    if (left.empty()) {
+      left = {"default.nix"};
+    }
   }
 
-  if (runEnv) setenv("IN_NIX_SHELL", pure ? "pure" : "impure", 1);
+  if (runEnv) {
+    setenv("IN_NIX_SHELL", pure ? "pure" : "impure", 1);
+  }
 
   DrvInfos drvs;
 
@@ -299,7 +309,9 @@ static void _main(int argc, char** argv) {
     }
 
   /* Evaluate them into derivations. */
-  if (attrPaths.empty()) attrPaths = {""};
+  if (attrPaths.empty()) {
+    attrPaths = {""};
+  }
 
   for (auto e : exprs) {
     Value vRoot;
@@ -326,7 +338,9 @@ static void _main(int argc, char** argv) {
       printMissing(ref<Store>(store), willBuild, willSubstitute, unknown,
                    downloadSize, narSize);
 
-    if (!dryRun) store->buildPaths(paths, buildMode);
+    if (!dryRun) {
+      store->buildPaths(paths, buildMode);
+    }
   };
 
   if (runEnv) {
@@ -391,7 +405,9 @@ static void _main(int argc, char** argv) {
     if (pure) {
       decltype(env) newEnv;
       for (auto& i : env)
-        if (keepVars.count(i.first)) newEnv.emplace(i);
+        if (keepVars.count(i.first)) {
+          newEnv.emplace(i);
+        }
       env = newEnv;
       // NixOS hack: prevent /etc/bashrc from sourcing /etc/profile.
       env["__ETC_PROFILE_SOURCED"] = "1";
@@ -490,12 +506,16 @@ static void _main(int argc, char** argv) {
         drvPrefix = i->second;
       else {
         drvPrefix = outLink;
-        if (drvPrefixes.size()) drvPrefix += fmt("-%d", drvPrefixes.size() + 1);
+        if (drvPrefixes.size()) {
+          drvPrefix += fmt("-%d", drvPrefixes.size() + 1);
+        }
         drvPrefixes[drvPath] = drvPrefix;
       }
 
       std::string symlink = drvPrefix;
-      if (outputName != "out") symlink += "-" + outputName;
+      if (outputName != "out") {
+        symlink += "-" + outputName;
+      }
 
       resultSymlinks[symlink] = outPath;
       outPaths.push_back(outPath);
diff --git a/third_party/nix/src/nix-channel/nix-channel.cc b/third_party/nix/src/nix-channel/nix-channel.cc
index 767682c0c30d..eca31a53384a 100644
--- a/third_party/nix/src/nix-channel/nix-channel.cc
+++ b/third_party/nix/src/nix-channel/nix-channel.cc
@@ -26,7 +26,9 @@ static void readChannels() {
   for (const auto& line :
        tokenizeString<std::vector<string>>(channelsFile, "\n")) {
     chomp(line);
-    if (std::regex_search(line, std::regex("^\\s*\\#"))) continue;
+    if (std::regex_search(line, std::regex("^\\s*\\#"))) {
+      continue;
+    }
     auto split = tokenizeString<std::vector<string>>(line, " ");
     auto url = std::regex_replace(split[0], std::regex("/*$"), "");
     auto name = split.size() > 1 ? split[1] : baseNameOf(url);
@@ -80,7 +82,9 @@ static void update(const StringSet& channelNames) {
   for (const auto& channel : channels) {
     auto name = channel.first;
     auto url = channel.second;
-    if (!(channelNames.empty() || channelNames.count(name))) continue;
+    if (!(channelNames.empty() || channelNames.count(name))) {
+      continue;
+    }
 
     // We want to download the url to a file to see if it's a tarball while also
     // checking if we got redirected in the process, so that we can grab the
@@ -225,7 +229,9 @@ static int _main(int argc, char** argv) {
         removeChannel(args[0]);
         break;
       case cList:
-        if (!args.empty()) throw UsageError("'--list' expects no arguments");
+        if (!args.empty()) {
+          throw UsageError("'--list' expects no arguments");
+        }
         readChannels();
         for (const auto& channel : channels)
           std::cout << channel.first << ' ' << channel.second << '\n';
diff --git a/third_party/nix/src/nix-collect-garbage/nix-collect-garbage.cc b/third_party/nix/src/nix-collect-garbage/nix-collect-garbage.cc
index ac6565203619..1b20386ff139 100644
--- a/third_party/nix/src/nix-collect-garbage/nix-collect-garbage.cc
+++ b/third_party/nix/src/nix-collect-garbage/nix-collect-garbage.cc
@@ -19,7 +19,9 @@ bool dryRun = false;
  * impossible. */
 
 void removeOldGenerations(std::string dir) {
-  if (access(dir.c_str(), R_OK) != 0) return;
+  if (access(dir.c_str(), R_OK) != 0) {
+    return;
+  }
 
   bool canWrite = access(dir.c_str(), W_OK) == 0;
 
@@ -34,7 +36,9 @@ void removeOldGenerations(std::string dir) {
       try {
         link = readLink(path);
       } catch (SysError& e) {
-        if (e.errNo == ENOENT) continue;
+        if (e.errNo == ENOENT) {
+          continue;
+        }
       }
       if (link.find("link") != string::npos) {
         LOG(INFO) << "removing old generations of profile " << path;
@@ -79,7 +83,9 @@ static int _main(int argc, char** argv) {
     initPlugins();
 
     auto profilesDir = settings.nixStateDir + "/profiles";
-    if (removeOld) removeOldGenerations(profilesDir);
+    if (removeOld) {
+      removeOldGenerations(profilesDir);
+    }
 
     // Run the actual garbage collector.
     if (!dryRun) {
diff --git a/third_party/nix/src/nix-copy-closure/nix-copy-closure.cc b/third_party/nix/src/nix-copy-closure/nix-copy-closure.cc
index 46b326a918ed..2ec6a021368b 100644
--- a/third_party/nix/src/nix-copy-closure/nix-copy-closure.cc
+++ b/third_party/nix/src/nix-copy-closure/nix-copy-closure.cc
@@ -49,7 +49,9 @@ static int _main(int argc, char** argv) {
 
     initPlugins();
 
-    if (sshHost.empty()) throw UsageError("no host name specified");
+    if (sshHost.empty()) {
+      throw UsageError("no host name specified");
+    }
 
     auto remoteUri = "ssh://" + sshHost + (gzip ? "?compress=true" : "");
     auto to = toMode ? openStore(remoteUri) : openStore();
diff --git a/third_party/nix/src/nix-daemon/nix-daemon.cc b/third_party/nix/src/nix-daemon/nix-daemon.cc
index dde1c8457108..e416cbcd7ecf 100644
--- a/third_party/nix/src/nix-daemon/nix-daemon.cc
+++ b/third_party/nix/src/nix-daemon/nix-daemon.cc
@@ -42,12 +42,16 @@ static ssize_t splice(int fd_in, void* off_in, int fd_out, void* off_out,
    * syscall */
   std::vector<char> buf(8192);
   auto read_count = read(fd_in, buf.data(), buf.size());
-  if (read_count == -1) return read_count;
+  if (read_count == -1) {
+    return read_count;
+  }
   auto write_count = decltype(read_count)(0);
   while (write_count < read_count) {
     auto res =
         write(fd_out, buf.data() + write_count, read_count - write_count);
-    if (res == -1) return res;
+    if (res == -1) {
+      return res;
+    }
     write_count += res;
   }
   return read_count;
@@ -121,7 +125,9 @@ struct TunnelLogger {
       to << STDERR_LAST;
     } else {
       to << STDERR_ERROR << msg;
-      if (status != 0) to << status;
+      if (status != 0) {
+        to << status;
+      }
     }
   }
 
@@ -157,7 +163,9 @@ struct TunnelSource : BufferedSource {
     to << STDERR_READ << len;
     to.flush();
     size_t n = readString(data, len, from);
-    if (n == 0) throw EndOfFile("unexpected end-of-file");
+    if (n == 0) {
+      throw EndOfFile("unexpected end-of-file");
+    }
     return n;
   }
 };
@@ -309,10 +317,14 @@ static void performOp(TunnelLogger* logger, ref<Store> store, bool trusted,
       }
 
       logger->startWork();
-      if (!savedRegular.regular) throw Error("regular file expected");
+      if (!savedRegular.regular) {
+        throw Error("regular file expected");
+      }
 
       auto store2 = store.dynamic_pointer_cast<LocalStore>();
-      if (!store2) throw Error("operation is only supported by LocalStore");
+      if (!store2) {
+        throw Error("operation is only supported by LocalStore");
+      }
 
       Path path = store2->addToStoreFromDump(
           recursive ? *savedNAR.data : savedRegular.s, baseName, recursive,
@@ -381,7 +393,9 @@ static void performOp(TunnelLogger* logger, ref<Store> store, bool trusted,
       readDerivation(from, *store, drv);
       BuildMode buildMode = (BuildMode)readInt(from);
       logger->startWork();
-      if (!trusted) throw Error("you are not privileged to build derivations");
+      if (!trusted) {
+        throw Error("you are not privileged to build derivations");
+      }
       auto res = store->buildDerivation(drvPath, drv, buildMode);
       logger->stopWork();
       to << res.status << res.errorMsg;
@@ -493,7 +507,9 @@ static void performOp(TunnelLogger* logger, ref<Store> store, bool trusted,
         auto& value(i.second);
 
         auto setSubstituters = [&](Setting<Strings>& res) {
-          if (name != res.name && res.aliases.count(name) == 0) return false;
+          if (name != res.name && res.aliases.count(name) == 0) {
+            return false;
+          }
           StringSet trusted = settings.trustedSubstituters;
           for (auto& s : settings.substituters.get()) trusted.insert(s);
           Strings subs;
@@ -582,7 +598,9 @@ static void performOp(TunnelLogger* logger, ref<Store> store, bool trusted,
       }
       logger->stopWork();
       if (info) {
-        if (GET_PROTOCOL_MINOR(clientVersion) >= 17) to << 1;
+        if (GET_PROTOCOL_MINOR(clientVersion) >= 17) {
+          to << 1;
+        }
         to << info->deriver << info->narHash.to_string(Base16, false)
            << info->references << info->registrationTime << info->narSize;
         if (GET_PROTOCOL_MINOR(clientVersion) >= 16) {
@@ -618,7 +636,9 @@ static void performOp(TunnelLogger* logger, ref<Store> store, bool trusted,
       Path path = readStorePath(*store, from);
       StringSet sigs = readStrings<StringSet>(from);
       logger->startWork();
-      if (!trusted) throw Error("you are not privileged to add signatures");
+      if (!trusted) {
+        throw Error("you are not privileged to add signatures");
+      }
       store->addSignatures(path, sigs);
       logger->stopWork();
       to << 1;
@@ -638,7 +658,9 @@ static void performOp(TunnelLogger* logger, ref<Store> store, bool trusted,
       ValidPathInfo info;
       info.path = readStorePath(*store, from);
       from >> info.deriver;
-      if (!info.deriver.empty()) store->assertStorePath(info.deriver);
+      if (!info.deriver.empty()) {
+        store->assertStorePath(info.deriver);
+      }
       info.narHash = Hash(readString(from), htSHA256);
       info.references = readStorePaths<PathSet>(*store, from);
       from >> info.registrationTime >> info.narSize >> info.ultimate;
@@ -695,12 +717,16 @@ static void processConnection(bool trusted, const std::string& userName,
 
   /* Exchange the greeting. */
   unsigned int magic = readInt(from);
-  if (magic != WORKER_MAGIC_1) throw Error("protocol mismatch");
+  if (magic != WORKER_MAGIC_1) {
+    throw Error("protocol mismatch");
+  }
   to << WORKER_MAGIC_2 << PROTOCOL_VERSION;
   to.flush();
   unsigned int clientVersion = readInt(from);
 
-  if (clientVersion < 0x10a) throw Error("the Nix client version is too old");
+  if (clientVersion < 0x10a) {
+    throw Error("the Nix client version is too old");
+  }
 
   auto tunnelLogger = new TunnelLogger(clientVersion);
   // logger = tunnelLogger;
@@ -804,17 +830,27 @@ static void setSigChldAction(bool autoReap) {
 }
 
 bool matchUser(const string& user, const string& group, const Strings& users) {
-  if (find(users.begin(), users.end(), "*") != users.end()) return true;
+  if (find(users.begin(), users.end(), "*") != users.end()) {
+    return true;
+  }
 
-  if (find(users.begin(), users.end(), user) != users.end()) return true;
+  if (find(users.begin(), users.end(), user) != users.end()) {
+    return true;
+  }
 
   for (auto& i : users)
     if (string(i, 0, 1) == "@") {
-      if (group == string(i, 1)) return true;
+      if (group == string(i, 1)) {
+        return true;
+      }
       struct group* gr = getgrnam(i.c_str() + 1);
-      if (!gr) continue;
+      if (!gr) {
+        continue;
+      }
       for (char** mem = gr->gr_mem; *mem; mem++)
-        if (user == string(*mem)) return true;
+        if (user == string(*mem)) {
+          return true;
+        }
     }
 
   return false;
@@ -861,7 +897,9 @@ static PeerInfo getPeerInfo(int remote) {
 #define SD_LISTEN_FDS_START 3
 
 static void daemonLoop(char** argv) {
-  if (chdir("/") == -1) throw SysError("cannot change current directory");
+  if (chdir("/") == -1) {
+    throw SysError("cannot change current directory");
+  }
 
   /* Get rid of children automatically; don't let them become
      zombies. */
@@ -881,7 +919,9 @@ static void daemonLoop(char** argv) {
   else {
     /* Create and bind to a Unix domain socket. */
     fdSocket = socket(PF_UNIX, SOCK_STREAM, 0);
-    if (!fdSocket) throw SysError("cannot create Unix domain socket");
+    if (!fdSocket) {
+      throw SysError("cannot create Unix domain socket");
+    }
 
     string socketPath = settings.nixDaemonSocketFile;
 
@@ -931,7 +971,9 @@ static void daemonLoop(char** argv) {
           accept(fdSocket.get(), (struct sockaddr*)&remoteAddr, &remoteAddrLen);
       checkInterrupt();
       if (!remote) {
-        if (errno == EINTR) continue;
+        if (errno == EINTR) {
+          continue;
+        }
         throw SysError("accepting connection");
       }
 
@@ -949,7 +991,9 @@ static void daemonLoop(char** argv) {
       Strings trustedUsers = settings.trustedUsers;
       Strings allowedUsers = settings.allowedUsers;
 
-      if (matchUser(user, group, trustedUsers)) trusted = true;
+      if (matchUser(user, group, trustedUsers)) {
+        trusted = true;
+      }
 
       if ((!trusted && !matchUser(user, group, allowedUsers)) ||
           group == settings.buildUsersGroup) {
@@ -1030,7 +1074,9 @@ static int _main(int argc, char** argv) {
         /* Forward on this connection to the real daemon */
         auto socketPath = settings.nixDaemonSocketFile;
         auto s = socket(PF_UNIX, SOCK_STREAM, 0);
-        if (s == -1) throw SysError("creating Unix domain socket");
+        if (s == -1) {
+          throw SysError("creating Unix domain socket");
+        }
 
         auto socketDir = dirOf(socketPath);
         if (chdir(socketDir.c_str()) == -1)
diff --git a/third_party/nix/src/nix-env/nix-env.cc b/third_party/nix/src/nix-env/nix-env.cc
index 6e329e8a2b65..c7f044aaa532 100644
--- a/third_party/nix/src/nix-env/nix-env.cc
+++ b/third_party/nix/src/nix-env/nix-env.cc
@@ -93,7 +93,9 @@ static void getAllExprs(EvalState& state, const Path& path, StringSet& attrs,
     /* Ignore the manifest.nix used by profiles.  This is
        necessary to prevent it from showing up in channels (which
        are implemented using profiles). */
-    if (i == "manifest.nix") continue;
+    if (i == "manifest.nix") {
+      continue;
+    }
 
     Path path2 = path + "/" + i;
 
@@ -136,7 +138,9 @@ static void loadSourceExpr(EvalState& state, const Path& path, Value& v) {
   if (stat(path.c_str(), &st) == -1)
     throw SysError(format("getting information about '%1%'") % path);
 
-  if (isNixExpr(path, st)) state.evalFile(path, v);
+  if (isNixExpr(path, st)) {
+    state.evalFile(path, v);
+  }
 
   /* The path is a directory.  Put the Nix expressions in the
      directory in a set, with the file name of each expression as
@@ -172,7 +176,9 @@ static void loadDerivations(EvalState& state, Path nixExprPath,
   for (DrvInfos::iterator i = elems.begin(), j; i != elems.end(); i = j) {
     j = i;
     j++;
-    if (systemFilter != "*" && i->querySystem() != systemFilter) elems.erase(i);
+    if (systemFilter != "*" && i->querySystem() != systemFilter) {
+      elems.erase(i);
+    }
   }
 }
 
@@ -188,7 +194,9 @@ static long comparePriorities(EvalState& state, DrvInfo& drv1, DrvInfo& drv2) {
 // at a time.
 static bool isPrebuilt(EvalState& state, DrvInfo& elem) {
   Path path = elem.queryOutPath();
-  if (state.store->isValidPath(path)) return true;
+  if (state.store->isValidPath(path)) {
+    return true;
+  }
   PathSet ps = state.store->querySubstitutablePaths({path});
   return ps.find(path) != ps.end();
 }
@@ -203,7 +211,9 @@ static void checkSelectorUse(DrvNames& selectors) {
 static DrvInfos filterBySelector(EvalState& state, const DrvInfos& allElems,
                                  const Strings& args, bool newestOnly) {
   DrvNames selectors = drvNamesFromArgs(args);
-  if (selectors.empty()) selectors.push_back(DrvName("*"));
+  if (selectors.empty()) {
+    selectors.push_back(DrvName("*"));
+  }
 
   DrvInfos elems;
   set<unsigned int> done;
@@ -248,7 +258,9 @@ static DrvInfos filterBySelector(EvalState& state, const DrvInfos& allElems,
                         : k->second.first.querySystem() == settings.thisSystem
                               ? -1
                               : 0;
-          if (d == 0) d = comparePriorities(state, j.first, k->second.first);
+          if (d == 0) {
+            d = comparePriorities(state, j.first, k->second.first);
+          }
           if (d == 0)
             d = compareVersions(drvName.version,
                                 DrvName(k->second.first.queryName()).version);
@@ -343,7 +355,9 @@ static void queryInstSources(EvalState& state, InstallSourceInfo& instSource,
 
         string name = baseNameOf(path);
         string::size_type dash = name.find('-');
-        if (dash != string::npos) name = string(name, dash + 1);
+        if (dash != string::npos) {
+          name = string(name, dash + 1);
+        }
 
         DrvInfo elem(state, "", nullptr);
         elem.setName(name);
@@ -419,7 +433,9 @@ static void installDerivations(Globals& globals, const Strings& args,
        one-click installs, namely those where the name used in the
        path is not the one we want (e.g., `java-front' versus
        `java-front-0.9pre15899'). */
-    if (globals.forceName != "") i.setName(globals.forceName);
+    if (globals.forceName != "") {
+      i.setName(globals.forceName);
+    }
     newNames.insert(DrvName(i.queryName()).name);
   }
 
@@ -517,7 +533,9 @@ static void upgradeDerivations(Globals& globals, const Strings& args,
         DrvInfos::iterator bestElem = availElems.end();
         string bestVersion;
         for (auto j = availElems.begin(); j != availElems.end(); ++j) {
-          if (comparePriorities(*globals.state, i, *j) > 0) continue;
+          if (comparePriorities(*globals.state, i, *j) > 0) {
+            continue;
+          }
           DrvName newName(j->queryName());
           if (newName.name == drvName.name) {
             int d = compareVersions(drvName.version, newName.version);
@@ -527,7 +545,9 @@ static void upgradeDerivations(Globals& globals, const Strings& args,
               long d2 = -1;
               if (bestElem != availElems.end()) {
                 d2 = comparePriorities(*globals.state, *bestElem, *j);
-                if (d2 == 0) d2 = compareVersions(bestVersion, newName.version);
+                if (d2 == 0) {
+                  d2 = compareVersions(bestVersion, newName.version);
+                }
               }
               if (d2 < 0 &&
                   (!globals.prebuiltOnly || isPrebuilt(*globals.state, *j))) {
@@ -636,7 +656,9 @@ static void opSetFlag(Globals& globals, Strings opFlags, Strings opArgs) {
 
 static void opSet(Globals& globals, Strings opFlags, Strings opArgs) {
   auto store2 = globals.state->store.dynamic_pointer_cast<LocalFSStore>();
-  if (!store2) throw Error("--set is not supported for this Nix store");
+  if (!store2) {
+    throw Error("--set is not supported for this Nix store");
+  }
 
   for (Strings::iterator i = opFlags.begin(); i != opFlags.end();) {
     string arg = *i++;
@@ -649,11 +671,15 @@ static void opSet(Globals& globals, Strings opFlags, Strings opArgs) {
   DrvInfos elems;
   queryInstSources(*globals.state, globals.instSource, opArgs, elems, true);
 
-  if (elems.size() != 1) throw Error("--set requires exactly one derivation");
+  if (elems.size() != 1) {
+    throw Error("--set requires exactly one derivation");
+  }
 
   DrvInfo& drv(elems.front());
 
-  if (globals.forceName != "") drv.setName(globals.forceName);
+  if (globals.forceName != "") {
+    drv.setName(globals.forceName);
+  }
 
   if (drv.queryDrvPath() != "") {
     PathSet paths = {drv.queryDrvPath()};
@@ -699,7 +725,9 @@ static void uninstallDerivations(Globals& globals, Strings& selectors,
           found = true;
           break;
         }
-      if (!found) newElems.push_back(i);
+      if (!found) {
+        newElems.push_back(i);
+      }
     }
 
     if (globals.dryRun) {
@@ -740,7 +768,9 @@ void printTable(Table& table) {
     Strings::iterator j;
     size_t column;
     for (j = i.begin(), column = 0; j != i.end(); ++j, ++column)
-      if (j->size() > widths[column]) widths[column] = j->size();
+      if (j->size() > widths[column]) {
+        widths[column] = j->size();
+      }
   }
 
   for (auto& i : table) {
@@ -939,7 +969,9 @@ static void opQuery(Globals& globals, Strings opFlags, Strings opArgs) {
 
   for (auto& i : elems) {
     try {
-      if (i.hasFailed()) continue;
+      if (i.hasFailed()) {
+        continue;
+      }
 
       // Activity act(*logger, lvlDebug, format("outputting query result '%1%'")
       // % i.attrPath);
@@ -1024,14 +1056,18 @@ static void opQuery(Globals& globals, Strings opFlags, Strings opArgs) {
       }
 
       if (xmlOutput) {
-        if (i.querySystem() != "") attrs["system"] = i.querySystem();
+        if (i.querySystem() != "") {
+          attrs["system"] = i.querySystem();
+        }
       } else if (printSystem)
         columns.push_back(i.querySystem());
 
       if (printDrvPath) {
         string drvPath = i.queryDrvPath();
         if (xmlOutput) {
-          if (drvPath != "") attrs["drvPath"] = drvPath;
+          if (drvPath != "") {
+            attrs["drvPath"] = drvPath;
+          }
         } else
           columns.push_back(drvPath == "" ? "-" : drvPath);
       }
@@ -1040,7 +1076,9 @@ static void opQuery(Globals& globals, Strings opFlags, Strings opArgs) {
         DrvInfo::Outputs outputs = i.queryOutputs();
         string s;
         for (auto& j : outputs) {
-          if (!s.empty()) s += ';';
+          if (!s.empty()) {
+            s += ';';
+          }
           if (j.first != "out") {
             s += j.first;
             s += "=";
@@ -1053,7 +1091,9 @@ static void opQuery(Globals& globals, Strings opFlags, Strings opArgs) {
       if (printDescription) {
         string descr = i.queryMetaString("description");
         if (xmlOutput) {
-          if (descr != "") attrs["description"] = descr;
+          if (descr != "") {
+            attrs["description"] = descr;
+          }
         } else
           columns.push_back(descr);
       }
@@ -1100,7 +1140,9 @@ static void opQuery(Globals& globals, Strings opFlags, Strings opArgs) {
                   attrs2["type"] = "strings";
                   XMLOpenElement m(xml, "meta", attrs2);
                   for (unsigned int j = 0; j < v->listSize(); ++j) {
-                    if (v->listElems()[j]->type != tString) continue;
+                    if (v->listElems()[j]->type != tString) {
+                      continue;
+                    }
                     XMLAttrs attrs3;
                     attrs3["value"] = v->listElems()[j]->string.s;
                     xml.writeEmptyElement("string", attrs3);
@@ -1111,7 +1153,9 @@ static void opQuery(Globals& globals, Strings opFlags, Strings opArgs) {
                   Bindings& attrs = *v->attrs;
                   for (auto& i : attrs) {
                     Attr& a(*attrs.find(i.name));
-                    if (a.value->type != tString) continue;
+                    if (a.value->type != tString) {
+                      continue;
+                    }
                     XMLAttrs attrs3;
                     attrs3["type"] = i.name;
                     attrs3["value"] = a.value->string.s;
@@ -1204,7 +1248,9 @@ static void opSwitchGeneration(Globals& globals, Strings opFlags,
 static void opRollback(Globals& globals, Strings opFlags, Strings opArgs) {
   if (opFlags.size() > 0)
     throw UsageError(format("unknown flag '%1%'") % opFlags.front());
-  if (opArgs.size() != 0) throw UsageError(format("no arguments expected"));
+  if (opArgs.size() != 0) {
+    throw UsageError(format("no arguments expected"));
+  }
 
   switchGeneration(globals, prevGen);
 }
@@ -1213,7 +1259,9 @@ static void opListGenerations(Globals& globals, Strings opFlags,
                               Strings opArgs) {
   if (opFlags.size() > 0)
     throw UsageError(format("unknown flag '%1%'") % opFlags.front());
-  if (opArgs.size() != 0) throw UsageError(format("no arguments expected"));
+  if (opArgs.size() != 0) {
+    throw UsageError(format("no arguments expected"));
+  }
 
   PathLocks lock;
   lockProfile(lock, globals.profile);
@@ -1225,7 +1273,9 @@ static void opListGenerations(Globals& globals, Strings opFlags,
 
   for (auto& i : gens) {
     tm t;
-    if (!localtime_r(&i.creationTime, &t)) throw Error("cannot convert time");
+    if (!localtime_r(&i.creationTime, &t)) {
+      throw Error("cannot convert time");
+    }
     cout << format("%|4|   %|4|-%|02|-%|02| %|02|:%|02|:%|02|   %||\n") %
                 i.number % (t.tm_year + 1900) % (t.tm_mon + 1) % t.tm_mday %
                 t.tm_hour % t.tm_min % t.tm_sec %
@@ -1369,7 +1419,9 @@ static int _main(int argc, char** argv) {
 
     initPlugins();
 
-    if (!op) throw UsageError("no operation specified");
+    if (!op) {
+      throw UsageError("no operation specified");
+    }
 
     auto store = openStore();
 
@@ -1382,7 +1434,9 @@ static int _main(int argc, char** argv) {
 
     globals.instSource.autoArgs = myArgs.getAutoArgs(*globals.state);
 
-    if (globals.profile == "") globals.profile = getEnv("NIX_PROFILE", "");
+    if (globals.profile == "") {
+      globals.profile = getEnv("NIX_PROFILE", "");
+    }
 
     if (globals.profile == "") {
       Path profileLink = getHome() + "/.nix-profile";
diff --git a/third_party/nix/src/nix-env/user-env.cc b/third_party/nix/src/nix-env/user-env.cc
index c35959c5329b..0719c8a51d52 100644
--- a/third_party/nix/src/nix-env/user-env.cc
+++ b/third_party/nix/src/nix-env/user-env.cc
@@ -31,7 +31,9 @@ bool createUserEnv(EvalState& state, DrvInfos& elems, const Path& profile,
      exist already. */
   PathSet drvsToBuild;
   for (auto& i : elems)
-    if (i.queryDrvPath() != "") drvsToBuild.insert(i.queryDrvPath());
+    if (i.queryDrvPath() != "") {
+      drvsToBuild.insert(i.queryDrvPath());
+    }
 
   DLOG(INFO) << "building user environment dependencies";
   state.store->buildPaths(drvsToBuild, state.repair ? bmRepair : bmNormal);
@@ -54,7 +56,9 @@ bool createUserEnv(EvalState& state, DrvInfos& elems, const Path& profile,
     mkString(*state.allocAttr(v, state.sType), "derivation");
     mkString(*state.allocAttr(v, state.sName), i.queryName());
     auto system = i.querySystem();
-    if (!system.empty()) mkString(*state.allocAttr(v, state.sSystem), system);
+    if (!system.empty()) {
+      mkString(*state.allocAttr(v, state.sSystem), system);
+    }
     mkString(*state.allocAttr(v, state.sOutPath), i.queryOutPath());
     if (drvPath != "")
       mkString(*state.allocAttr(v, state.sDrvPath), i.queryDrvPath());
@@ -84,13 +88,17 @@ bool createUserEnv(EvalState& state, DrvInfos& elems, const Path& profile,
     StringSet metaNames = i.queryMetaNames();
     for (auto& j : metaNames) {
       Value* v = i.queryMeta(j);
-      if (!v) continue;
+      if (!v) {
+        continue;
+      }
       vMeta.attrs->push_back(Attr(state.symbols.create(j), v));
     }
     vMeta.attrs->sort();
     v.attrs->sort();
 
-    if (drvPath != "") references.insert(drvPath);
+    if (drvPath != "") {
+      references.insert(drvPath);
+    }
   }
 
   /* Also write a copy of the list of user environment elements to
diff --git a/third_party/nix/src/nix-instantiate/nix-instantiate.cc b/third_party/nix/src/nix-instantiate/nix-instantiate.cc
index 2630f5f9ebfc..20dcd7f42df8 100644
--- a/third_party/nix/src/nix-instantiate/nix-instantiate.cc
+++ b/third_party/nix/src/nix-instantiate/nix-instantiate.cc
@@ -49,7 +49,9 @@ void processExpr(EvalState& state, const Strings& attrPaths, bool parseOnly,
       else if (output == okJSON)
         printValueAsJSON(state, strict, vRes, std::cout, context);
       else {
-        if (strict) state.forceValueDeep(vRes);
+        if (strict) {
+          state.forceValueDeep(vRes);
+        }
         std::cout << vRes << std::endl;
       }
     } else {
@@ -69,7 +71,9 @@ void processExpr(EvalState& state, const Strings& attrPaths, bool parseOnly,
           printGCWarning();
         else {
           Path rootName = indirectRoot ? absPath(gcRoot) : gcRoot;
-          if (++rootNr > 1) rootName += "-" + std::to_string(rootNr);
+          if (++rootNr > 1) {
+            rootName += "-" + std::to_string(rootNr);
+          }
           auto store2 = state.store.dynamic_pointer_cast<LocalFSStore>();
           if (store2)
             drvPath = store2->addPermRoot(drvPath, rootName, indirectRoot);
@@ -158,7 +162,9 @@ static int _main(int argc, char** argv) {
 
     Bindings& autoArgs = *myArgs.getAutoArgs(*state);
 
-    if (attrPaths.empty()) attrPaths = {""};
+    if (attrPaths.empty()) {
+      attrPaths = {""};
+    }
 
     if (findFile) {
       for (auto& i : files) {
diff --git a/third_party/nix/src/nix-prefetch-url/nix-prefetch-url.cc b/third_party/nix/src/nix-prefetch-url/nix-prefetch-url.cc
index d1a34842bc7a..96d8540958fc 100644
--- a/third_party/nix/src/nix-prefetch-url/nix-prefetch-url.cc
+++ b/third_party/nix/src/nix-prefetch-url/nix-prefetch-url.cc
@@ -21,11 +21,15 @@ using namespace nix;
 /* If ‘uri’ starts with ‘mirror://’, then resolve it using the list of
    mirrors defined in Nixpkgs. */
 string resolveMirrorUri(EvalState& state, string uri) {
-  if (string(uri, 0, 9) != "mirror://") return uri;
+  if (string(uri, 0, 9) != "mirror://") {
+    return uri;
+  }
 
   string s(uri, 9);
   auto p = s.find('/');
-  if (p == string::npos) throw Error("invalid mirror URI");
+  if (p == string::npos) {
+    throw Error("invalid mirror URI");
+  }
   string mirrorName(s, 0, p);
 
   Value vMirrors;
@@ -92,7 +96,9 @@ static int _main(int argc, char** argv) {
 
     initPlugins();
 
-    if (args.size() > 2) throw UsageError("too many arguments");
+    if (args.size() > 2) {
+      throw UsageError("too many arguments");
+    }
 
     auto store = openStore();
     auto state = std::make_unique<EvalState>(myArgs.searchPath, store);
@@ -103,7 +109,9 @@ static int _main(int argc, char** argv) {
        expression. */
     string uri;
     if (!fromExpr) {
-      if (args.empty()) throw UsageError("you must specify a URI");
+      if (args.empty()) {
+        throw UsageError("you must specify a URI");
+      }
       uri = args[0];
     } else {
       Path path =
@@ -118,7 +126,9 @@ static int _main(int argc, char** argv) {
       if (attr == v.attrs->end())
         throw Error("attribute set does not contain a 'urls' attribute");
       state->forceList(*attr->value);
-      if (attr->value->listSize() < 1) throw Error("'urls' list is empty");
+      if (attr->value->listSize() < 1) {
+        throw Error("'urls' list is empty");
+      }
       uri = state->forceString(*attr->value->listElems()[0]);
 
       /* Extract the hash mode. */
@@ -131,12 +141,16 @@ static int _main(int argc, char** argv) {
       /* Extract the name. */
       if (name.empty()) {
         attr = v.attrs->find(state->symbols.create("name"));
-        if (attr != v.attrs->end()) name = state->forceString(*attr->value);
+        if (attr != v.attrs->end()) {
+          name = state->forceString(*attr->value);
+        }
       }
     }
 
     /* Figure out a name in the Nix store. */
-    if (name.empty()) name = baseNameOf(uri);
+    if (name.empty()) {
+      name = baseNameOf(uri);
+    }
     if (name.empty())
       throw Error(format("cannot figure out file name for '%1%'") % uri);
 
@@ -163,7 +177,9 @@ static int _main(int argc, char** argv) {
       {
         AutoCloseFD fd =
             open(tmpFile.c_str(), O_WRONLY | O_CREAT | O_EXCL, 0600);
-        if (!fd) throw SysError("creating temporary file '%s'", tmpFile);
+        if (!fd) {
+          throw SysError("creating temporary file '%s'", tmpFile);
+        }
 
         FdSink sink(fd.get());
 
@@ -213,7 +229,9 @@ static int _main(int argc, char** argv) {
     }
 
     std::cout << printHash16or32(hash) << std::endl;
-    if (printPath) std::cout << storePath << std::endl;
+    if (printPath) {
+      std::cout << storePath << std::endl;
+    }
 
     return 0;
   }
diff --git a/third_party/nix/src/nix-store/dotgraph.cc b/third_party/nix/src/nix-store/dotgraph.cc
index 710d781c7edb..259ecbd74a5e 100644
--- a/third_party/nix/src/nix-store/dotgraph.cc
+++ b/third_party/nix/src/nix-store/dotgraph.cc
@@ -89,7 +89,9 @@ void printDotGraph(ref<Store> store, const PathSet& roots) {
     Path path = *(workList.begin());
     workList.erase(path);
 
-    if (doneSet.find(path) != doneSet.end()) continue;
+    if (doneSet.find(path) != doneSet.end()) {
+      continue;
+    }
     doneSet.insert(path);
 
     cout << makeNode(path, symbolicName(path), "#ff0000");
@@ -118,7 +120,7 @@ void printDotGraph(ref<Store> store, const PathSet& roots) {
             colour = "#00ff00";
             for (StringPairs::iterator i = ne.derivation.env.begin();
                  i != ne.derivation.env.end(); ++i)
-                if (i->first == "name") label = i->second;
+                if (i->first == "name") { label = i->second; }
         }
 
         else if (ne.type == StoreExpr::neClosure) {
diff --git a/third_party/nix/src/nix-store/graphml.cc b/third_party/nix/src/nix-store/graphml.cc
index a48b19bf9636..07116cda930a 100644
--- a/third_party/nix/src/nix-store/graphml.cc
+++ b/third_party/nix/src/nix-store/graphml.cc
@@ -58,7 +58,9 @@ void printGraphML(ref<Store> store, const PathSet& roots) {
     workList.erase(path);
 
     ret = doneSet.insert(path);
-    if (ret.second == false) continue;
+    if (ret.second == false) {
+      continue;
+    }
 
     ValidPathInfo info = *(store->queryPathInfo(path));
     cout << makeNode(info);
diff --git a/third_party/nix/src/nix-store/nix-store.cc b/third_party/nix/src/nix-store/nix-store.cc
index 14ad5364cd46..3de536a6c4a6 100644
--- a/third_party/nix/src/nix-store/nix-store.cc
+++ b/third_party/nix/src/nix-store/nix-store.cc
@@ -44,7 +44,9 @@ ref<LocalStore> ensureLocalStore() {
 }
 
 static Path useDeriver(Path path) {
-  if (isDerivation(path)) return path;
+  if (isDerivation(path)) {
+    return path;
+  }
   Path drvPath = store->queryPathInfo(path)->deriver;
   if (drvPath == "")
     throw Error(format("deriver of path '%1%' is not known") % path);
@@ -59,7 +61,9 @@ static PathSet realisePath(Path path, bool build = true) {
   auto store2 = std::dynamic_pointer_cast<LocalFSStore>(store);
 
   if (isDerivation(p.first)) {
-    if (build) store->buildPaths({path});
+    if (build) {
+      store->buildPaths({path});
+    }
     Derivation drv = store->derivationFromPath(p.first);
     rootNr++;
 
@@ -79,8 +83,12 @@ static PathSet realisePath(Path path, bool build = true) {
           printGCWarning();
         else {
           Path rootName = gcRoot;
-          if (rootNr > 1) rootName += "-" + std::to_string(rootNr);
-          if (i->first != "out") rootName += "-" + i->first;
+          if (rootNr > 1) {
+            rootName += "-" + std::to_string(rootNr);
+          }
+          if (i->first != "out") {
+            rootName += "-" + i->first;
+          }
           outPath = store2->addPermRoot(outPath, rootName, indirectRoot);
         }
       }
@@ -101,7 +109,9 @@ static PathSet realisePath(Path path, bool build = true) {
       else {
         Path rootName = gcRoot;
         rootNr++;
-        if (rootNr > 1) rootName += "-" + std::to_string(rootNr);
+        if (rootNr > 1) {
+          rootName += "-" + std::to_string(rootNr);
+        }
         path = store2->addPermRoot(path, rootName, indirectRoot);
       }
     }
@@ -142,7 +152,9 @@ static void opRealise(Strings opFlags, Strings opArgs) {
   if (ignoreUnknown) {
     Paths paths2;
     for (auto& i : paths)
-      if (unknown.find(i) == unknown.end()) paths2.push_back(i);
+      if (unknown.find(i) == unknown.end()) {
+        paths2.push_back(i);
+      }
     paths = paths2;
     unknown = PathSet();
   }
@@ -168,7 +180,9 @@ static void opRealise(Strings opFlags, Strings opArgs) {
 
 /* Add files to the Nix store and print the resulting paths. */
 static void opAdd(Strings opFlags, Strings opArgs) {
-  if (!opFlags.empty()) throw UsageError("unknown flag");
+  if (!opFlags.empty()) {
+    throw UsageError("unknown flag");
+  }
 
   for (auto& i : opArgs)
     cout << format("%1%\n") % store->addToStore(baseNameOf(i), i);
@@ -185,7 +199,9 @@ static void opAddFixed(Strings opFlags, Strings opArgs) {
     else
       throw UsageError(format("unknown flag '%1%'") % i);
 
-  if (opArgs.empty()) throw UsageError("first argument must be hash algorithm");
+  if (opArgs.empty()) {
+    throw UsageError("first argument must be hash algorithm");
+  }
 
   HashType hashAlgo = parseHashType(opArgs.front());
   opArgs.pop_front();
@@ -307,7 +323,9 @@ static void opQuery(Strings opFlags, Strings opArgs) {
     else if (i == "--deriver" || i == "-d")
       query = qDeriver;
     else if (i == "--binding" || i == "-b") {
-      if (opArgs.size() == 0) throw UsageError("expected binding name");
+      if (opArgs.size() == 0) {
+        throw UsageError("expected binding name");
+      }
       bindingName = opArgs.front();
       opArgs.pop_front();
       query = qBinding;
@@ -348,7 +366,9 @@ static void opQuery(Strings opFlags, Strings opArgs) {
     case qOutputs: {
       for (auto& i : opArgs) {
         i = store->followLinksToStorePath(i);
-        if (forceRealise) realisePath(i);
+        if (forceRealise) {
+          realisePath(i);
+        }
         Derivation drv = store->derivationFromPath(i);
         for (auto& j : drv.outputs) cout << format("%1%\n") % j.second.path;
       }
@@ -476,7 +496,9 @@ static void opQuery(Strings opFlags, Strings opArgs) {
 }
 
 static void opPrintEnv(Strings opFlags, Strings opArgs) {
-  if (!opFlags.empty()) throw UsageError("unknown flag");
+  if (!opFlags.empty()) {
+    throw UsageError("unknown flag");
+  }
   if (opArgs.size() != 1)
     throw UsageError("'--print-env' requires one derivation store path");
 
@@ -493,7 +515,9 @@ static void opPrintEnv(Strings opFlags, Strings opArgs) {
   cout << "export _args; _args='";
   bool first = true;
   for (auto& i : drv.args) {
-    if (!first) cout << ' ';
+    if (!first) {
+      cout << ' ';
+    }
     first = false;
     cout << shellEscape(i);
   }
@@ -501,7 +525,9 @@ static void opPrintEnv(Strings opFlags, Strings opArgs) {
 }
 
 static void opReadLog(Strings opFlags, Strings opArgs) {
-  if (!opFlags.empty()) throw UsageError("unknown flag");
+  if (!opFlags.empty()) {
+    throw UsageError("unknown flag");
+  }
 
   RunPager pager;
 
@@ -515,7 +541,9 @@ static void opReadLog(Strings opFlags, Strings opArgs) {
 }
 
 static void opDumpDB(Strings opFlags, Strings opArgs) {
-  if (!opFlags.empty()) throw UsageError("unknown flag");
+  if (!opFlags.empty()) {
+    throw UsageError("unknown flag");
+  }
   if (!opArgs.empty()) {
     for (auto& i : opArgs) i = store->followLinksToStorePath(i);
     for (auto& i : opArgs)
@@ -533,10 +561,14 @@ static void registerValidity(bool reregister, bool hashGiven,
 
   while (1) {
     ValidPathInfo info = decodeValidPathInfo(cin, hashGiven);
-    if (info.path == "") break;
+    if (info.path == "") {
+      break;
+    }
     if (!store->isValidPath(info.path) || reregister) {
       /* !!! races */
-      if (canonicalise) canonicalisePathMetaData(info.path, -1);
+      if (canonicalise) {
+        canonicalisePathMetaData(info.path, -1);
+      }
       if (!hashGiven) {
         HashResult hash = hashPath(htSHA256, info.path);
         info.narHash = hash.first;
@@ -550,8 +582,12 @@ static void registerValidity(bool reregister, bool hashGiven,
 }
 
 static void opLoadDB(Strings opFlags, Strings opArgs) {
-  if (!opFlags.empty()) throw UsageError("unknown flag");
-  if (!opArgs.empty()) throw UsageError("no arguments expected");
+  if (!opFlags.empty()) {
+    throw UsageError("unknown flag");
+  }
+  if (!opArgs.empty()) {
+    throw UsageError("no arguments expected");
+  }
   registerValidity(true, true, false);
 }
 
@@ -567,7 +603,9 @@ static void opRegisterValidity(Strings opFlags, Strings opArgs) {
     else
       throw UsageError(format("unknown flag '%1%'") % i);
 
-  if (!opArgs.empty()) throw UsageError("no arguments expected");
+  if (!opArgs.empty()) {
+    throw UsageError("no arguments expected");
+  }
 
   registerValidity(reregister, hashGiven, true);
 }
@@ -615,7 +653,9 @@ static void opGC(Strings opFlags, Strings opArgs) {
     } else
       throw UsageError(format("bad sub-operation '%1%' in GC") % *i);
 
-  if (!opArgs.empty()) throw UsageError("no arguments expected");
+  if (!opArgs.empty()) {
+    throw UsageError("no arguments expected");
+  }
 
   if (printRoots) {
     Roots roots = store->findRoots(false);
@@ -660,8 +700,12 @@ static void opDelete(Strings opFlags, Strings opArgs) {
 /* Dump a path as a Nix archive.  The archive is written to standard
    output. */
 static void opDump(Strings opFlags, Strings opArgs) {
-  if (!opFlags.empty()) throw UsageError("unknown flag");
-  if (opArgs.size() != 1) throw UsageError("only one argument allowed");
+  if (!opFlags.empty()) {
+    throw UsageError("unknown flag");
+  }
+  if (opArgs.size() != 1) {
+    throw UsageError("only one argument allowed");
+  }
 
   FdSink sink(STDOUT_FILENO);
   string path = *opArgs.begin();
@@ -672,8 +716,12 @@ static void opDump(Strings opFlags, Strings opArgs) {
 /* Restore a value from a Nix archive.  The archive is read from
    standard input. */
 static void opRestore(Strings opFlags, Strings opArgs) {
-  if (!opFlags.empty()) throw UsageError("unknown flag");
-  if (opArgs.size() != 1) throw UsageError("only one argument allowed");
+  if (!opFlags.empty()) {
+    throw UsageError("unknown flag");
+  }
+  if (opArgs.size() != 1) {
+    throw UsageError("only one argument allowed");
+  }
 
   FdSource source(STDIN_FILENO);
   restorePath(*opArgs.begin(), source);
@@ -692,7 +740,9 @@ static void opExport(Strings opFlags, Strings opArgs) {
 static void opImport(Strings opFlags, Strings opArgs) {
   for (auto& i : opFlags) throw UsageError(format("unknown flag '%1%'") % i);
 
-  if (!opArgs.empty()) throw UsageError("no arguments expected");
+  if (!opArgs.empty()) {
+    throw UsageError("no arguments expected");
+  }
 
   FdSource source(STDIN_FILENO);
   Paths paths = store->importPaths(source, nullptr, NoCheckSigs);
@@ -702,15 +752,21 @@ static void opImport(Strings opFlags, Strings opArgs) {
 
 /* Initialise the Nix databases. */
 static void opInit(Strings opFlags, Strings opArgs) {
-  if (!opFlags.empty()) throw UsageError("unknown flag");
-  if (!opArgs.empty()) throw UsageError("no arguments expected");
+  if (!opFlags.empty()) {
+    throw UsageError("unknown flag");
+  }
+  if (!opArgs.empty()) {
+    throw UsageError("no arguments expected");
+  }
   /* Doesn't do anything right now; database tables are initialised
      automatically. */
 }
 
 /* Verify the consistency of the Nix environment. */
 static void opVerify(Strings opFlags, Strings opArgs) {
-  if (!opArgs.empty()) throw UsageError("no arguments expected");
+  if (!opArgs.empty()) {
+    throw UsageError("no arguments expected");
+  }
 
   bool checkContents = false;
   RepairFlag repair = NoRepair;
@@ -731,7 +787,9 @@ static void opVerify(Strings opFlags, Strings opArgs) {
 
 /* Verify whether the contents of the given store path have not changed. */
 static void opVerifyPath(Strings opFlags, Strings opArgs) {
-  if (!opFlags.empty()) throw UsageError("no flags expected");
+  if (!opFlags.empty()) {
+    throw UsageError("no flags expected");
+  }
 
   int status = 0;
 
@@ -756,7 +814,9 @@ static void opVerifyPath(Strings opFlags, Strings opArgs) {
 /* Repair the contents of the given path by redownloading it using a
    substituter (if available). */
 static void opRepairPath(Strings opFlags, Strings opArgs) {
-  if (!opFlags.empty()) throw UsageError("no flags expected");
+  if (!opFlags.empty()) {
+    throw UsageError("no flags expected");
+  }
 
   for (auto& i : opArgs) {
     Path path = store->followLinksToStorePath(i);
@@ -782,14 +842,18 @@ static void opServe(Strings opFlags, Strings opArgs) {
     else
       throw UsageError(format("unknown flag '%1%'") % i);
 
-  if (!opArgs.empty()) throw UsageError("no arguments expected");
+  if (!opArgs.empty()) {
+    throw UsageError("no arguments expected");
+  }
 
   FdSource in(STDIN_FILENO);
   FdSink out(STDOUT_FILENO);
 
   /* Exchange the greeting. */
   unsigned int magic = readInt(in);
-  if (magic != SERVE_MAGIC_1) throw Error("protocol mismatch");
+  if (magic != SERVE_MAGIC_1) {
+    throw Error("protocol mismatch");
+  }
   out << SERVE_MAGIC_2 << SERVE_PROTOCOL_VERSION;
   out.flush();
   unsigned int clientVersion = readInt(in);
@@ -834,7 +898,9 @@ static void opServe(Strings opFlags, Strings opArgs) {
           /* Filter out .drv files (we don't want to build anything). */
           PathSet paths2;
           for (auto& path : paths)
-            if (!isDerivation(path)) paths2.insert(path);
+            if (!isDerivation(path)) {
+              paths2.insert(path);
+            }
           unsigned long long downloadSize, narSize;
           PathSet willBuild, willSubstitute, unknown;
           store->queryMissing(PathSet(paths2.begin(), paths2.end()), willBuild,
@@ -877,7 +943,9 @@ static void opServe(Strings opFlags, Strings opArgs) {
         break;
 
       case cmdImportPaths: {
-        if (!writeAllowed) throw Error("importing paths is not allowed");
+        if (!writeAllowed) {
+          throw Error("importing paths is not allowed");
+        }
         store->importPaths(in, nullptr,
                            NoCheckSigs);  // FIXME: should we skip sig checking?
         out << 1;                         // indicate success
@@ -891,7 +959,9 @@ static void opServe(Strings opFlags, Strings opArgs) {
       }
 
       case cmdBuildPaths: {
-        if (!writeAllowed) throw Error("building paths is not allowed");
+        if (!writeAllowed) {
+          throw Error("building paths is not allowed");
+        }
         PathSet paths = readStorePaths<PathSet>(*store, in);
 
         getBuildSettings();
@@ -909,7 +979,9 @@ static void opServe(Strings opFlags, Strings opArgs) {
 
       case cmdBuildDerivation: { /* Used by hydra-queue-runner. */
 
-        if (!writeAllowed) throw Error("building paths is not allowed");
+        if (!writeAllowed) {
+          throw Error("building paths is not allowed");
+        }
 
         Path drvPath = readStorePath(*store, in);  // informational only
         BasicDerivation drv;
@@ -939,12 +1011,16 @@ static void opServe(Strings opFlags, Strings opArgs) {
       }
 
       case cmdAddToStoreNar: {
-        if (!writeAllowed) throw Error("importing paths is not allowed");
+        if (!writeAllowed) {
+          throw Error("importing paths is not allowed");
+        }
 
         ValidPathInfo info;
         info.path = readStorePath(*store, in);
         in >> info.deriver;
-        if (!info.deriver.empty()) store->assertStorePath(info.deriver);
+        if (!info.deriver.empty()) {
+          store->assertStorePath(info.deriver);
+        }
         info.narHash = Hash(readString(in), htSHA256);
         info.references = readStorePaths<PathSet>(*store, in);
         in >> info.registrationTime >> info.narSize >> info.ultimate;
@@ -978,18 +1054,24 @@ static void opServe(Strings opFlags, Strings opArgs) {
 static void opGenerateBinaryCacheKey(Strings opFlags, Strings opArgs) {
   for (auto& i : opFlags) throw UsageError(format("unknown flag '%1%'") % i);
 
-  if (opArgs.size() != 3) throw UsageError("three arguments expected");
+  if (opArgs.size() != 3) {
+    throw UsageError("three arguments expected");
+  }
   auto i = opArgs.begin();
   string keyName = *i++;
   string secretKeyFile = *i++;
   string publicKeyFile = *i++;
 
 #if HAVE_SODIUM
-  if (sodium_init() == -1) throw Error("could not initialise libsodium");
+  if (sodium_init() == -1) {
+    throw Error("could not initialise libsodium");
+  }
 
   unsigned char pk[crypto_sign_PUBLICKEYBYTES];
   unsigned char sk[crypto_sign_SECRETKEYBYTES];
-  if (crypto_sign_keypair(pk, sk) != 0) throw Error("key generation failed");
+  if (crypto_sign_keypair(pk, sk) != 0) {
+    throw Error("key generation failed");
+  }
 
   writeFile(publicKeyFile,
             keyName + ":" +
@@ -1095,7 +1177,9 @@ static int _main(int argc, char** argv) {
 
     initPlugins();
 
-    if (!op) throw UsageError("no operation specified");
+    if (!op) {
+      throw UsageError("no operation specified");
+    }
 
     if (op != opDump && op != opRestore) /* !!! hack */
       store = openStore();
diff --git a/third_party/nix/src/nix/add-to-store.cc b/third_party/nix/src/nix/add-to-store.cc
index cc85cc02ea6e..b7fda9c9d390 100644
--- a/third_party/nix/src/nix/add-to-store.cc
+++ b/third_party/nix/src/nix/add-to-store.cc
@@ -27,7 +27,9 @@ struct CmdAddToStore : MixDryRun, StoreCommand {
   Examples examples() override { return {}; }
 
   void run(ref<Store> store) override {
-    if (!namePart) namePart = baseNameOf(path);
+    if (!namePart) {
+      namePart = baseNameOf(path);
+    }
 
     StringSink sink;
     dumpPath(path, sink);
@@ -38,7 +40,9 @@ struct CmdAddToStore : MixDryRun, StoreCommand {
     info.path = store->makeFixedOutputPath(true, info.narHash, *namePart);
     info.ca = makeFixedOutputCA(true, info.narHash);
 
-    if (!dryRun) store->addToStore(info, sink.s);
+    if (!dryRun) {
+      store->addToStore(info, sink.s);
+    }
 
     std::cout << fmt("%s\n", info.path);
   }
diff --git a/third_party/nix/src/nix/build.cc b/third_party/nix/src/nix/build.cc
index 41d8e6f0d075..806be2b37ab4 100644
--- a/third_party/nix/src/nix/build.cc
+++ b/third_party/nix/src/nix/build.cc
@@ -51,8 +51,12 @@ struct CmdBuild : MixDryRun, InstallablesCommand {
         for (auto& output : b.outputs)
           if (auto store2 = store.dynamic_pointer_cast<LocalFSStore>()) {
             std::string symlink = outLink;
-            if (i) symlink += fmt("-%d", i);
-            if (output.first != "out") symlink += fmt("-%s", output.first);
+            if (i) {
+              symlink += fmt("-%d", i);
+            }
+            if (output.first != "out") {
+              symlink += fmt("-%s", output.first);
+            }
             store2->addPermRoot(output.second, absPath(symlink), true);
           }
     }
diff --git a/third_party/nix/src/nix/command.cc b/third_party/nix/src/nix/command.cc
index cf109c441612..1825bb6136be 100644
--- a/third_party/nix/src/nix/command.cc
+++ b/third_party/nix/src/nix/command.cc
@@ -62,8 +62,12 @@ void MultiCommand::printHelp(const string& programName, std::ostream& out) {
 }
 
 bool MultiCommand::processFlag(Strings::iterator& pos, Strings::iterator end) {
-  if (Args::processFlag(pos, end)) return true;
-  if (command && command->processFlag(pos, end)) return true;
+  if (Args::processFlag(pos, end)) {
+    return true;
+  }
+  if (command && command->processFlag(pos, end)) {
+    return true;
+  }
   return false;
 }
 
diff --git a/third_party/nix/src/nix/command.hh b/third_party/nix/src/nix/command.hh
index cc82c4b1aadd..a86f4782133f 100644
--- a/third_party/nix/src/nix/command.hh
+++ b/third_party/nix/src/nix/command.hh
@@ -163,7 +163,9 @@ struct RegisterCommand {
   static Commands* commands;
 
   RegisterCommand(ref<Command> command) {
-    if (!commands) commands = new Commands;
+    if (!commands) {
+      commands = new Commands;
+    }
     commands->emplace(command->name(), command);
   }
 };
diff --git a/third_party/nix/src/nix/hash.cc b/third_party/nix/src/nix/hash.cc
index e3278ea77a59..77be77cfcdc0 100644
--- a/third_party/nix/src/nix/hash.cc
+++ b/third_party/nix/src/nix/hash.cc
@@ -36,7 +36,9 @@ struct CmdHash : Command {
   void run() override {
     for (auto path : paths) {
       Hash h = mode == mFile ? hashFile(ht, path) : hashPath(ht, path).first;
-      if (truncate && h.hashSize > 20) h = compressHash(h, 20);
+      if (truncate && h.hashSize > 20) {
+        h = compressHash(h, 20);
+      }
       std::cout << format("%1%\n") % h.to_string(base, base == SRI);
     }
   }
diff --git a/third_party/nix/src/nix/installables.cc b/third_party/nix/src/nix/installables.cc
index 2378a4b16a52..7ba916f4a6a2 100644
--- a/third_party/nix/src/nix/installables.cc
+++ b/third_party/nix/src/nix/installables.cc
@@ -45,8 +45,12 @@ Value* SourceExprCommand::getSourceExpr(EvalState& state) {
     std::unordered_set<std::string> seen;
 
     auto addEntry = [&](const std::string& name) {
-      if (name == "") return;
-      if (!seen.insert(name).second) return;
+      if (name == "") {
+        return;
+      }
+      if (!seen.insert(name).second) {
+        return;
+      }
       Value* v1 = state.allocValue();
       mkPrimOpApp(*v1, state.getBuiltin("findFile"),
                   state.getBuiltin("nixPath"));
@@ -189,7 +193,9 @@ static std::vector<std::shared_ptr<Installable>> parseInstallables(
   std::vector<std::shared_ptr<Installable>> result;
 
   if (ss.empty() && useDefaultInstallables) {
-    if (cmd.file == "") cmd.file = ".";
+    if (cmd.file == "") {
+      cmd.file = ".";
+    }
     ss = {""};
   }
 
diff --git a/third_party/nix/src/nix/log.cc b/third_party/nix/src/nix/log.cc
index 0a10924cad7b..29107bbdcdff 100644
--- a/third_party/nix/src/nix/log.cc
+++ b/third_party/nix/src/nix/log.cc
@@ -42,10 +42,14 @@ struct CmdLog : InstallableCommand {
     for (auto& sub : subs) {
       auto log = b.drvPath != "" ? sub->getBuildLog(b.drvPath) : nullptr;
       for (auto& output : b.outputs) {
-        if (log) break;
+        if (log) {
+          break;
+        }
         log = sub->getBuildLog(output.second);
       }
-      if (!log) continue;
+      if (!log) {
+        continue;
+      }
       LOG(INFO) << "got build log for '" << installable->what() << "' from '"
                 << sub->getUri() << "'";
       std::cout << *log;
diff --git a/third_party/nix/src/nix/main.cc b/third_party/nix/src/nix/main.cc
index 6e4db63cce0a..9dbe9b155bf2 100644
--- a/third_party/nix/src/nix/main.cc
+++ b/third_party/nix/src/nix/main.cc
@@ -27,12 +27,16 @@ namespace nix {
 static bool haveInternet() {
   struct ifaddrs* addrs;
 
-  if (getifaddrs(&addrs)) return true;
+  if (getifaddrs(&addrs)) {
+    return true;
+  }
 
   Finally free([&]() { freeifaddrs(addrs); });
 
   for (auto i = addrs; i; i = i->ifa_next) {
-    if (!i->ifa_addr) continue;
+    if (!i->ifa_addr) {
+      continue;
+    }
     if (i->ifa_addr->sa_family == AF_INET) {
       if (ntohl(((sockaddr_in*)i->ifa_addr)->sin_addr.s_addr) !=
           INADDR_LOOPBACK) {
@@ -127,7 +131,9 @@ void mainWrapped(int argc, char** argv) {
 
   {
     auto legacy = (*RegisterLegacyCommand::commands)[programName];
-    if (legacy) return legacy(argc, argv);
+    if (legacy) {
+      return legacy(argc, argv);
+    }
   }
 
   settings.verboseBuild = false;
@@ -138,7 +144,9 @@ void mainWrapped(int argc, char** argv) {
 
   initPlugins();
 
-  if (!args.command) args.showHelpAndExit();
+  if (!args.command) {
+    args.showHelpAndExit();
+  }
 
   if (args.useNet && !haveInternet()) {
     LOG(WARNING) << "you don't have Internet access; "
@@ -148,10 +156,14 @@ void mainWrapped(int argc, char** argv) {
 
   if (!args.useNet) {
     // FIXME: should check for command line overrides only.
-    if (!settings.useSubstitutes.overriden) settings.useSubstitutes = false;
+    if (!settings.useSubstitutes.overriden) {
+      settings.useSubstitutes = false;
+    }
     if (!settings.tarballTtl.overriden)
       settings.tarballTtl = std::numeric_limits<unsigned int>::max();
-    if (!downloadSettings.tries.overriden) downloadSettings.tries = 0;
+    if (!downloadSettings.tries.overriden) {
+      downloadSettings.tries = 0;
+    }
     if (!downloadSettings.connectTimeout.overriden)
       downloadSettings.connectTimeout = 1;
   }
diff --git a/third_party/nix/src/nix/path-info.cc b/third_party/nix/src/nix/path-info.cc
index 31f2897a81c8..4920a8c4d792 100644
--- a/third_party/nix/src/nix/path-info.cc
+++ b/third_party/nix/src/nix/path-info.cc
@@ -97,15 +97,23 @@ struct CmdPathInfo : StorePathsCommand, MixJSON {
           std::cout << std::string(
               std::max(0, (int)pathLen - (int)storePath.size()), ' ');
 
-        if (showSize) printSize(info->narSize);
+        if (showSize) {
+          printSize(info->narSize);
+        }
 
-        if (showClosureSize) printSize(store->getClosureSize(storePath).first);
+        if (showClosureSize) {
+          printSize(store->getClosureSize(storePath).first);
+        }
 
         if (showSigs) {
           std::cout << '\t';
           Strings ss;
-          if (info->ultimate) ss.push_back("ultimate");
-          if (info->ca != "") ss.push_back("ca:" + info->ca);
+          if (info->ultimate) {
+            ss.push_back("ultimate");
+          }
+          if (info->ca != "") {
+            ss.push_back("ca:" + info->ca);
+          }
           for (auto& sig : info->sigs) ss.push_back(sig);
           std::cout << concatStringsSep(" ", ss);
         }
diff --git a/third_party/nix/src/nix/repl.cc b/third_party/nix/src/nix/repl.cc
index 2d7188740515..0297cca84854 100644
--- a/third_party/nix/src/nix/repl.cc
+++ b/third_party/nix/src/nix/repl.cc
@@ -123,7 +123,9 @@ void printHelp() {
 string removeWhitespace(string s) {
   s = chomp(s);
   size_t n = s.find_first_not_of(" \n\r\t");
-  if (n != string::npos) s = string(s, n);
+  if (n != string::npos) {
+    s = string(s, n);
+  }
   return s;
 }
 
@@ -143,13 +145,17 @@ static char* completionCallback(char* s, int* match) {
   if (possible.size() == 1) {
     *match = 1;
     auto* res = strdup(possible.begin()->c_str() + strlen(s));
-    if (!res) throw Error("allocation failure");
+    if (!res) {
+      throw Error("allocation failure");
+    }
     return res;
   } else if (possible.size() > 1) {
     auto checkAllHaveSameAt = [&](size_t pos) {
       auto& first = *possible.begin();
       for (auto& p : possible) {
-        if (p.size() <= pos || p[pos] != first[pos]) return false;
+        if (p.size() <= pos || p[pos] != first[pos]) {
+          return false;
+        }
       }
       return true;
     };
@@ -161,7 +167,9 @@ static char* completionCallback(char* s, int* match) {
     if (len > 0) {
       *match = 1;
       auto* res = strdup(std::string(*possible.begin(), start, len).c_str());
-      if (!res) throw Error("allocation failure");
+      if (!res) {
+        throw Error("allocation failure");
+      }
       return res;
     }
   }
@@ -216,7 +224,9 @@ void NixRepl::mainLoop(const std::vector<std::string>& files) {
   for (auto& i : files) loadedFiles.push_back(i);
 
   reloadFiles();
-  if (!loadedFiles.empty()) std::cout << std::endl;
+  if (!loadedFiles.empty()) {
+    std::cout << std::endl;
+  }
 
   // Allow nix-repl specific settings in .inputrc
   rl_readline_name = "nix-repl";
@@ -236,10 +246,14 @@ void NixRepl::mainLoop(const std::vector<std::string>& files) {
   while (true) {
     // When continuing input from previous lines, don't print a prompt, just
     // align to the same number of chars as the prompt.
-    if (!getLine(input, input.empty() ? "nix-repl> " : "          ")) break;
+    if (!getLine(input, input.empty() ? "nix-repl> " : "          ")) {
+      break;
+    }
 
     try {
-      if (!removeWhitespace(input).empty() && !processLine(input)) return;
+      if (!removeWhitespace(input).empty() && !processLine(input)) {
+        return;
+      }
     } catch (ParseError& e) {
       if (e.msg().find("unexpected $end") != std::string::npos) {
         // For parse errors on incomplete input, we continue waiting for the
@@ -334,7 +348,9 @@ StringSet NixRepl::completePrefix(string prefix) {
     /* This is a variable name; look it up in the current scope. */
     StringSet::iterator i = varNames.lower_bound(cur);
     while (i != varNames.end()) {
-      if (string(*i, 0, cur.size()) != cur) break;
+      if (string(*i, 0, cur.size()) != cur) {
+        break;
+      }
       completions.insert(prev + *i);
       i++;
     }
@@ -353,7 +369,9 @@ StringSet NixRepl::completePrefix(string prefix) {
 
       for (auto& i : *v.attrs) {
         string name = i.name;
-        if (string(name, 0, cur2.size()) != cur2) continue;
+        if (string(name, 0, cur2.size()) != cur2) {
+          continue;
+        }
         completions.insert(prev + expr + "." + name);
       }
 
@@ -375,7 +393,9 @@ static int runProgram(const string& program, const Strings& args) {
 
   Pid pid;
   pid = fork();
-  if (pid == -1) throw SysError("forking");
+  if (pid == -1) {
+    throw SysError("forking");
+  }
   if (pid == 0) {
     restoreAffinity();
     execvp(program.c_str(), stringsToCharPtrs(args2).data());
@@ -386,7 +406,9 @@ static int runProgram(const string& program, const Strings& args) {
 }
 
 bool isVarName(const string& s) {
-  if (s.size() == 0) return false;
+  if (s.size() == 0) {
+    return false;
+  }
   char c = s[0];
   if ((c >= '0' && c <= '9') || c == '-' || c == '\'') {
     return false;
@@ -410,14 +432,18 @@ Path NixRepl::getDerivationPath(Value& v) {
 }
 
 bool NixRepl::processLine(string line) {
-  if (line == "") return true;
+  if (line == "") {
+    return true;
+  }
 
   string command, arg;
 
   if (line[0] == ':') {
     size_t p = line.find_first_of(" \n\r\t");
     command = string(line, 0, p);
-    if (p != string::npos) arg = removeWhitespace(string(line, p));
+    if (p != string::npos) {
+      arg = removeWhitespace(string(line, p));
+    }
   } else {
     arg = line;
   }
@@ -561,7 +587,9 @@ void NixRepl::reloadFiles() {
 
   bool first = true;
   for (auto& i : old) {
-    if (!first) std::cout << std::endl;
+    if (!first) {
+      std::cout << std::endl;
+    }
     first = false;
     std::cout << format("Loading '%1%'...") % i << std::endl;
     loadFile(i);
diff --git a/third_party/nix/src/nix/run.cc b/third_party/nix/src/nix/run.cc
index 0b5a2648f9fb..c246767ceddd 100644
--- a/third_party/nix/src/nix/run.cc
+++ b/third_party/nix/src/nix/run.cc
@@ -94,7 +94,9 @@ struct CmdRun : InstallablesCommand {
       std::map<std::string, std::string> kept;
       for (auto& var : keep) {
         auto s = getenv(var.c_str());
-        if (s) kept[var] = s;
+        if (s) {
+          kept[var] = s;
+        }
       }
 
       clearEnv();
@@ -118,9 +120,13 @@ struct CmdRun : InstallablesCommand {
     while (!todo.empty()) {
       Path path = todo.front();
       todo.pop();
-      if (!done.insert(path).second) continue;
+      if (!done.insert(path).second) {
+        continue;
+      }
 
-      if (true) unixPath.push_front(path + "/bin");
+      if (true) {
+        unixPath.push_front(path + "/bin");
+      }
 
       auto propPath = path + "/nix-support/propagated-user-env-packages";
       if (accessor->stat(propPath).type == FSAccessor::tRegular) {
@@ -206,9 +212,13 @@ void chrootHelper(int argc, char** argv) {
     for (auto entry : readDirectory("/")) {
       auto src = "/" + entry.name;
       auto st = lstat(src);
-      if (!S_ISDIR(st.st_mode)) continue;
+      if (!S_ISDIR(st.st_mode)) {
+        continue;
+      }
       Path dst = tmpDir + "/" + entry.name;
-      if (pathExists(dst)) continue;
+      if (pathExists(dst)) {
+        continue;
+      }
       if (mkdir(dst.c_str(), 0700) == -1)
         throw SysError("creating directory '%s'", dst);
       if (mount(src.c_str(), dst.c_str(), "", MS_BIND | MS_REC, 0) == -1)
@@ -216,7 +226,9 @@ void chrootHelper(int argc, char** argv) {
     }
 
     char* cwd = getcwd(0, 0);
-    if (!cwd) throw SysError("getting current directory");
+    if (!cwd) {
+      throw SysError("getting current directory");
+    }
     Finally freeCwd([&]() { free(cwd); });
 
     if (chroot(tmpDir.c_str()) == -1)
diff --git a/third_party/nix/src/nix/search.cc b/third_party/nix/src/nix/search.cc
index b7cb586b0f4d..f44269eee5c1 100644
--- a/third_party/nix/src/nix/search.cc
+++ b/third_party/nix/src/nix/search.cc
@@ -244,7 +244,9 @@ struct CmdSearch : SourceExprCommand, MixJSON {
         /* Fun fact: catching std::ios::failure does not work
            due to C++11 ABI shenanigans.
            https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66145 */
-        if (!jsonCacheFile) throw Error("error writing to %s", tmpFile);
+        if (!jsonCacheFile) {
+          throw Error("error writing to %s", tmpFile);
+        }
         throw;
       }
 
diff --git a/third_party/nix/src/nix/show-derivation.cc b/third_party/nix/src/nix/show-derivation.cc
index 44e33cef4c98..c7722b6428b5 100644
--- a/third_party/nix/src/nix/show-derivation.cc
+++ b/third_party/nix/src/nix/show-derivation.cc
@@ -50,7 +50,9 @@ struct CmdShowDerivation : InstallablesCommand {
       JSONObject jsonRoot(std::cout, true);
 
       for (auto& drvPath : drvPaths) {
-        if (!isDerivation(drvPath)) continue;
+        if (!isDerivation(drvPath)) {
+          continue;
+        }
 
         auto drvObj(jsonRoot.object(drvPath));
 
diff --git a/third_party/nix/src/nix/sigs.cc b/third_party/nix/src/nix/sigs.cc
index cc9d579909e2..d548f5445fe3 100644
--- a/third_party/nix/src/nix/sigs.cc
+++ b/third_party/nix/src/nix/sigs.cc
@@ -67,7 +67,9 @@ struct CmdCopySigs : StorePathsCommand {
             continue;
 
           for (auto& sig : info2->sigs)
-            if (!info->sigs.count(sig)) newSigs.insert(sig);
+            if (!info->sigs.count(sig)) {
+              newSigs.insert(sig);
+            }
         } catch (InvalidPath&) {
         }
       }
diff --git a/third_party/nix/src/nix/upgrade-nix.cc b/third_party/nix/src/nix/upgrade-nix.cc
index 49f8db3b5b5f..277d761ec581 100644
--- a/third_party/nix/src/nix/upgrade-nix.cc
+++ b/third_party/nix/src/nix/upgrade-nix.cc
@@ -52,7 +52,9 @@ struct CmdUpgradeNix : MixDryRun, StoreCommand {
   void run(ref<Store> store) override {
     evalSettings.pureEval = true;
 
-    if (profileDir == "") profileDir = getProfileDir(store);
+    if (profileDir == "") {
+      profileDir = getProfileDir(store);
+    }
 
     LOG(INFO) << "upgrading Nix in profile '" << profileDir << "'";
 
diff --git a/third_party/nix/src/nix/verify.cc b/third_party/nix/src/nix/verify.cc
index 67128d866858..5cac3c9802a7 100644
--- a/third_party/nix/src/nix/verify.cc
+++ b/third_party/nix/src/nix/verify.cc
@@ -102,7 +102,9 @@ struct CmdVerify : StorePathsCommand {
 
             auto doSigs = [&](StringSet sigs) {
               for (auto sig : sigs) {
-                if (sigsSeen.count(sig)) continue;
+                if (sigsSeen.count(sig)) {
+                  continue;
+                }
                 sigsSeen.insert(sig);
                 if (validSigs < ValidPathInfo::maxSigs &&
                     info->checkSignature(publicKeys, sig))
@@ -116,7 +118,9 @@ struct CmdVerify : StorePathsCommand {
             doSigs(info->sigs);
 
             for (auto& store2 : substituters) {
-              if (validSigs >= actualSigsNeeded) break;
+              if (validSigs >= actualSigsNeeded) {
+                break;
+              }
               try {
                 auto info2 = store2->queryPathInfo(info->path);
                 if (info2->isContentAddressed(*store))
@@ -128,7 +132,9 @@ struct CmdVerify : StorePathsCommand {
               }
             }
 
-            if (validSigs >= actualSigsNeeded) good = true;
+            if (validSigs >= actualSigsNeeded) {
+              good = true;
+            }
           }
 
           if (!good) {
diff --git a/third_party/nix/src/nix/why-depends.cc b/third_party/nix/src/nix/why-depends.cc
index 88e1e357f4b4..b0271d41992d 100644
--- a/third_party/nix/src/nix/why-depends.cc
+++ b/third_party/nix/src/nix/why-depends.cc
@@ -145,7 +145,9 @@ struct CmdWhyDepends : SourceExprCommand {
       if (node.path == dependencyPath && !all && packagePath != dependencyPath)
         throw BailOut();
 
-      if (node.visited) return;
+      if (node.visited) {
+        return;
+      }
       node.visited = true;
 
       /* Sort the references by distance to `dependency` to
@@ -154,9 +156,13 @@ struct CmdWhyDepends : SourceExprCommand {
       std::set<std::string> hashes;
 
       for (auto& ref : node.refs) {
-        if (ref == node.path && packagePath != dependencyPath) continue;
+        if (ref == node.path && packagePath != dependencyPath) {
+          continue;
+        }
         auto& node2 = graph.at(ref);
-        if (node2.dist == inf) continue;
+        if (node2.dist == inf) {
+          continue;
+        }
         refs.emplace(node2.dist, &node2);
         hashes.insert(storePathToHash(node2.path));
       }
@@ -228,7 +234,9 @@ struct CmdWhyDepends : SourceExprCommand {
                     << (first ? (last ? treeLast : treeConn)
                               : (last ? treeNull : treeLine))
                     << hit;
-          if (!all) break;
+          if (!all) {
+            break;
+          }
         }
 
         printNode(*ref.second, tailPad + (last ? treeNull : treeLine),
diff --git a/third_party/nix/src/resolve-system-dependencies/resolve-system-dependencies.cc b/third_party/nix/src/resolve-system-dependencies/resolve-system-dependencies.cc
index f6c01e3ec184..7bdb417f621d 100644
--- a/third_party/nix/src/resolve-system-dependencies/resolve-system-dependencies.cc
+++ b/third_party/nix/src/resolve-system-dependencies/resolve-system-dependencies.cc
@@ -30,10 +30,14 @@ std::set<string> readCacheFile(const Path& file) {
 
 std::set<std::string> runResolver(const Path& filename) {
   AutoCloseFD fd = open(filename.c_str(), O_RDONLY);
-  if (!fd) throw SysError("opening '%s'", filename);
+  if (!fd) {
+    throw SysError("opening '%s'", filename);
+  }
 
   struct stat st;
-  if (fstat(fd.get(), &st)) throw SysError("statting '%s'", filename);
+  if (fstat(fd.get(), &st)) {
+    throw SysError("statting '%s'", filename);
+  }
 
   if (!S_ISREG(st.st_mode)) {
     printError("file '%s' is not a regular file", filename);
@@ -46,7 +50,9 @@ std::set<std::string> runResolver(const Path& filename) {
   }
 
   char* obj = (char*)mmap(NULL, st.st_size, PROT_READ, MAP_SHARED, fd.get(), 0);
-  if (!obj) throw SysError("mmapping '%s'", filename);
+  if (!obj) {
+    throw SysError("mmapping '%s'", filename);
+  }
 
   ptrdiff_t mach64_offset = 0;
 
@@ -115,7 +121,9 @@ Path resolveSymlink(const Path& path) {
 
 std::set<string> resolveTree(const Path& path, PathSet& deps) {
   std::set<string> results;
-  if (deps.count(path)) return {};
+  if (deps.count(path)) {
+    return {};
+  }
   deps.insert(path);
   for (auto& lib : runResolver(path)) {
     results.insert(lib);
@@ -127,10 +135,14 @@ std::set<string> resolveTree(const Path& path, PathSet& deps) {
 }
 
 std::set<string> getPath(const Path& path) {
-  if (hasPrefix(path, "/dev")) return {};
+  if (hasPrefix(path, "/dev")) {
+    return {};
+  }
 
   Path cacheFile = resolveCacheFile(path);
-  if (pathExists(cacheFile)) return readCacheFile(cacheFile);
+  if (pathExists(cacheFile)) {
+    return readCacheFile(cacheFile);
+  }
 
   std::set<string> deps, paths;
   paths.insert(path);