Allow remote builds without sending the derivation closure

Previously, to build a derivation remotely, we had to copy the entire
closure of the .drv file to the remote machine, even though we only
need the top-level derivation. This is very wasteful: the closure can
contain thousands of store paths, and in some Hydra use cases, include
source paths that are very large (e.g. Git/Mercurial checkouts).

So now there is a new operation, StoreAPI::buildDerivation(), that
performs a build from an in-memory representation of a derivation
(BasicDerivation) rather than from a on-disk .drv file. The only files
that need to be in the Nix store are the sources of the derivation
(drv.inputSrcs), and the needed output paths of the dependencies (as
described by drv.inputDrvs). "nix-store --serve" exposes this
interface.

Note that this is a privileged operation, because you can construct a
derivation that builds any store path whatsoever. Fixing this will
require changing the hashing scheme (i.e., the output paths should be
computed from the other fields in BasicDerivation, allowing them to be
verified without access to other derivations). However, this would be
quite nice because it would allow .drv-free building (e.g. "nix-env
-i" wouldn't have to write any .drv files to disk).

Fixes #173.

2 files changed, 33 insertions, 10 deletions

diff --git a/src/nix-store/nix-store.cc b/src/nix-store/nix-store.cc
index 23b97ca9e5aa..434aefba488f 100644
--- a/src/nix-store/nix-store.cc
+++ b/src/nix-store/nix-store.cc
@@ -862,6 +862,16 @@ static void opServe(Strings opFlags, Strings opArgs)
     out.flush();
     readInt(in); // Client version, unused for now
 
+    auto getBuildSettings = [&]() {
+        // FIXME: changing options here doesn't work if we're
+        // building through the daemon.
+        verbosity = lvlError;
+        settings.keepLog = false;
+        settings.useSubstitutes = false;
+        settings.maxSilentTime = readInt(in);
+        settings.buildTimeout = readInt(in);
+    };
+
     while (true) {
         ServeCommand cmd;
         try {
@@ -943,19 +953,12 @@ static void opServe(Strings opFlags, Strings opArgs)
                 break;
             }
 
-            case cmdBuildPaths: {
+            case cmdBuildPaths: { /* Used by build-remote.pl. */
 
-                /* Used by build-remote.pl. */
                 if (!writeAllowed) throw Error("building paths is not allowed");
                 PathSet paths = readStorePaths<PathSet>(in);
 
-                // FIXME: changing options here doesn't work if we're
-                // building through the daemon.
-                verbosity = lvlError;
-                settings.keepLog = false;
-                settings.useSubstitutes = false;
-                settings.maxSilentTime = readInt(in);
-                settings.buildTimeout = readInt(in);
+                getBuildSettings();
 
                 try {
                     MonitorFdHup monitor(in.fd);
@@ -969,6 +972,25 @@ static void opServe(Strings opFlags, Strings opArgs)
                 break;
             }
 
+            case cmdBuildDerivation: { /* Used by hydra-queue-runner. */
+
+                if (!writeAllowed) throw Error("building paths is not allowed");
+
+                Path drvPath = readStorePath(in); // informational only
+                BasicDerivation drv;
+                in >> drv;
+
+                getBuildSettings();
+
+                MonitorFdHup monitor(in.fd);
+                auto status = store->buildDerivation(drvPath, drv);
+
+                writeInt(status.status, out);
+                writeString(status.errorMsg, out);
+
+                break;
+            }
+
             case cmdQueryClosure: {
                 bool includeOutputs = readInt(in);
                 PathSet paths = readStorePaths<PathSet>(in);
diff --git a/src/nix-store/serve-protocol.hh b/src/nix-store/serve-protocol.hh
index 741b622beb17..f7f151d4603f 100644
--- a/src/nix-store/serve-protocol.hh
+++ b/src/nix-store/serve-protocol.hh
@@ -5,7 +5,7 @@ namespace nix {
 #define SERVE_MAGIC_1 0x390c9deb
 #define SERVE_MAGIC_2 0x5452eecb
 
-#define SERVE_PROTOCOL_VERSION 0x200
+#define SERVE_PROTOCOL_VERSION 0x201
 #define GET_PROTOCOL_MAJOR(x) ((x) & 0xff00)
 #define GET_PROTOCOL_MINOR(x) ((x) & 0x00ff)
 
@@ -17,6 +17,7 @@ typedef enum {
     cmdExportPaths = 5,
     cmdBuildPaths = 6,
     cmdQueryClosure = 7,
+    cmdBuildDerivation = 8,
 } ServeCommand;
 
 }