fix(3p/nix): apply all clang-tidy fixes r/1495

Change-Id: I265e763393422ee1881653527c91024458060825
Reviewed-on: https://cl.tvl.fyi/c/depot/+/1432
Tested-by: BuildkiteCI
Reviewed-by: tazjin <mail@tazj.in>

22 files changed, 215 insertions, 171 deletions

diff --git a/third_party/nix/src/libstore/binary-cache-store.cc b/third_party/nix/src/libstore/binary-cache-store.cc
index b862ea0058..677500a011 100644
--- a/third_party/nix/src/libstore/binary-cache-store.cc
+++ b/third_party/nix/src/libstore/binary-cache-store.cc
@@ -87,7 +87,7 @@ void BinaryCacheStore::getFile(const std::string& path, Sink& sink) {
             }
           }});
   auto data = promise.get_future().get();
-  sink((unsigned char*)data->data(), data->size());
+  sink(reinterpret_cast<unsigned char*>(data->data()), data->size());
 }
 
 std::shared_ptr<std::string> BinaryCacheStore::getFile(
@@ -205,7 +205,9 @@ void BinaryCacheStore::addToStore(const ValidPathInfo& info,
           .count();
   DLOG(INFO) << "copying path '" << narInfo->path << "' (" << narInfo->narSize
              << " bytes, compressed "
-             << ((1.0 - (double)narCompressed->size() / nar->size()) * 100.0)
+             << ((1.0 -
+                  static_cast<double>(narCompressed->size()) / nar->size()) *
+                 100.0)
              << "% in " << duration << "ms) to binary cache";
 
   /* Atomically write the NAR file. */
@@ -287,9 +289,8 @@ void BinaryCacheStore::queryPathInfoUncached(
 
               stats.narInfoRead++;
 
-              (*callbackPtr)(
-                  (std::shared_ptr<ValidPathInfo>)std::make_shared<NarInfo>(
-                      *this, *data, narInfoFile));
+              (*callbackPtr)(std::shared_ptr<ValidPathInfo>(
+                  std::make_shared<NarInfo>(*this, *data, narInfoFile)));
 
             } catch (...) {
               callbackPtr->rethrow();
@@ -353,7 +354,9 @@ void BinaryCacheStore::addSignatures(const Path& storePath,
      when addSignatures() is called sequentially on a path, because
      S3 might return an outdated cached version. */
 
-  auto narInfo = make_ref<NarInfo>((NarInfo&)*queryPathInfo(storePath));
+  // TODO(kanepyork): what is going on here
+  auto narInfo = make_ref<NarInfo>(const_cast<NarInfo&>(
+      dynamic_cast<const NarInfo&>(*queryPathInfo(storePath))));
 
   narInfo->sigs.insert(sigs.begin(), sigs.end());
 
diff --git a/third_party/nix/src/libstore/build.cc b/third_party/nix/src/libstore/build.cc
index 74db67e862..13a8b21dd1 100644
--- a/third_party/nix/src/libstore/build.cc
+++ b/third_party/nix/src/libstore/build.cc
@@ -185,10 +185,10 @@ using steady_time_point = std::chrono::time_point<std::chrono::steady_clock>;
    path creation commands. */
 struct Child {
   WeakGoalPtr goal;
-  Goal* goal2;  // ugly hackery
+  Goal* goal2{};  // ugly hackery
   std::set<int> fds;
-  bool respectTimeouts;
-  bool inBuildSlot;
+  bool respectTimeouts = false;
+  bool inBuildSlot = false;
   steady_time_point lastOutput; /* time we last got output on stdout/stderr */
   steady_time_point timeStarted;
 };
@@ -732,7 +732,7 @@ class SubstitutionGoal;
 class DerivationGoal : public Goal {
  private:
   /* Whether to use an on-disk .drv file. */
-  bool useDerivation;
+  bool useDerivation = false;
 
   /* The path of the derivation. */
   Path drvPath;
@@ -746,7 +746,7 @@ class DerivationGoal : public Goal {
 
   /* Whether to retry substituting the outputs after building the
      inputs. */
-  bool retrySubstitution;
+  bool retrySubstitution = false;
 
   /* The derivation stored at drvPath. */
   std::unique_ptr<BasicDerivation> drv;
@@ -789,7 +789,7 @@ class DerivationGoal : public Goal {
   std::shared_ptr<BufferedSink> logFileSink, logSink;
 
   /* Number of bytes received from the builder's stdout/stderr. */
-  unsigned long logSize;
+  unsigned long logSize = 0;
 
   /* The most recent log lines. */
   std::list<std::string> logTail;
@@ -817,7 +817,7 @@ class DerivationGoal : public Goal {
   std::shared_ptr<AutoDelete> autoDelChroot;
 
   /* Whether this is a fixed-output derivation. */
-  bool fixedOutput;
+  bool fixedOutput = false;
 
   /* Whether to run the build in a private network namespace. */
   bool privateNetwork = false;
@@ -856,7 +856,7 @@ class DerivationGoal : public Goal {
   /* The current round, if we're building multiple times. */
   size_t curRound = 1;
 
-  size_t nrRounds;
+  size_t nrRounds = 0;
 
   /* Path registration info from the previous round, if we're
      building multiple times. Since this contains the hash, it
@@ -1585,13 +1585,15 @@ MakeError(NotDeterministic, BuildError)
 #if HAVE_STATVFS
       unsigned long long required =
           8ULL * 1024 * 1024;  // FIXME: make configurable
-      struct statvfs st;
+      struct statvfs st {};
       if (statvfs(worker.store.realStoreDir.c_str(), &st) == 0 &&
-          (unsigned long long)st.f_bavail * st.f_bsize < required) {
+          static_cast<unsigned long long>(st.f_bavail) * st.f_bsize <
+              required) {
         diskFull = true;
       }
       if (statvfs(tmpDir.c_str(), &st) == 0 &&
-          (unsigned long long)st.f_bavail * st.f_bsize < required) {
+          static_cast<unsigned long long>(st.f_bavail) * st.f_bsize <
+              required) {
         diskFull = true;
       }
 #endif
@@ -1830,7 +1832,7 @@ void chmod_(const Path& path, mode_t mode) {
 }
 
 int childEntry(void* arg) {
-  ((DerivationGoal*)arg)->runChild();
+  (static_cast<DerivationGoal*>(arg))->runChild();
   return 1;
 }
 
@@ -2135,7 +2137,7 @@ void DerivationGoal::startBuilder() {
 
     for (auto& i : inputPaths) {
       Path r = worker.store.toRealPath(i);
-      struct stat st;
+      struct stat st {};
       if (lstat(r.c_str(), &st) != 0) {
         throw SysError(format("getting attributes of path '%1%'") % i);
       }
@@ -2284,7 +2286,7 @@ void DerivationGoal::startBuilder() {
   }
 
   // Put the pt into raw mode to prevent \n -> \r\n translation.
-  struct termios term;
+  struct termios term {};
   if (tcgetattr(builderOut.writeSide.get(), &term) != 0) {
     throw SysError("getting pseudoterminal attributes");
   }
@@ -2357,9 +2359,9 @@ void DerivationGoal::startBuilder() {
           }
 
           size_t stackSize = 1 * 1024 * 1024;
-          char* stack =
-              (char*)mmap(nullptr, stackSize, PROT_WRITE | PROT_READ,
-                          MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0);
+          char* stack = static_cast<char*>(
+              mmap(nullptr, stackSize, PROT_WRITE | PROT_READ,
+                   MAP_PRIVATE | MAP_ANONYMOUS | MAP_STACK, -1, 0));
           if (stack == MAP_FAILED) {
             throw SysError("allocating stack");
           }
@@ -2412,7 +2414,7 @@ void DerivationGoal::startBuilder() {
 
     userNamespaceSync.readSide = -1;
 
-    pid_t tmp;
+    pid_t tmp = 0;
     if (!absl::SimpleAtoi(readLine(builderOut.readSide.get()), &tmp)) {
       abort();
     }
@@ -2709,7 +2711,7 @@ void setupSeccomp() {
     return;
   }
 #if HAVE_SECCOMP
-  scmp_filter_ctx ctx;
+  scmp_filter_ctx ctx = nullptr;
 
   if ((ctx = seccomp_init(SCMP_ACT_ALLOW)) == nullptr) {
     throw SysError("unable to initialize seccomp mode 2");
@@ -2829,7 +2831,7 @@ void DerivationGoal::runChild() {
           throw SysError("cannot open IP socket");
         }
 
-        struct ifreq ifr;
+        struct ifreq ifr {};
         strncpy(ifr.ifr_name, "lo", sizeof("lo"));
         ifr.ifr_flags = IFF_UP | IFF_LOOPBACK | IFF_RUNNING;
         if (ioctl(fd.get(), SIOCSIFFLAGS, &ifr) == -1) {
@@ -2918,7 +2920,7 @@ void DerivationGoal::runChild() {
       auto doBind = [&](const Path& source, const Path& target,
                         bool optional = false) {
         DLOG(INFO) << "bind mounting '" << source << "' to '" << target << "'";
-        struct stat st;
+        struct stat st {};
         if (stat(source.c_str(), &st) == -1) {
           if (optional && errno == ENOENT) {
             return;
@@ -3035,7 +3037,7 @@ void DerivationGoal::runChild() {
 #if __linux__
     /* Change the personality to 32-bit if we're doing an
        i686-linux build on an x86_64-linux machine. */
-    struct utsname utsbuf;
+    struct utsname utsbuf {};
     uname(&utsbuf);
     if (drv->platform == "i686-linux" &&
         (settings.thisSystem == "x86_64-linux" ||
@@ -3247,7 +3249,7 @@ void DerivationGoal::registerOutputs() {
       }
     }
 
-    struct stat st;
+    struct stat st {};
     if (lstat(actualPath.c_str(), &st) == -1) {
       if (errno == ENOENT) {
         throw BuildError(
@@ -3296,7 +3298,7 @@ void DerivationGoal::registerOutputs() {
        outputs (i.e., the content hash should match the specified
        hash). */
     if (fixedOutput) {
-      bool recursive;
+      bool recursive = 0;
       Hash h;
       i.second.parseHashInfo(recursive, h);
 
@@ -4451,7 +4453,7 @@ void Worker::waitForInput() {
      terminated. */
 
   bool useTimeout = false;
-  struct timeval timeout;
+  struct timeval timeout {};
   timeout.tv_usec = 0;
   auto before = steady_time_point::clock::now();
 
@@ -4478,9 +4480,9 @@ void Worker::waitForInput() {
   }
   if (nearest != steady_time_point::max()) {
     timeout.tv_sec = std::max(
-        1L,
-        (long)std::chrono::duration_cast<std::chrono::seconds>(nearest - before)
-            .count());
+        1L, static_cast<long>(std::chrono::duration_cast<std::chrono::seconds>(
+                                  nearest - before)
+                                  .count()));
     useTimeout = true;
   }
 
@@ -4495,10 +4497,11 @@ void Worker::waitForInput() {
       lastWokenUp = before;
     }
     timeout.tv_sec = std::max(
-        1L,
-        (long)std::chrono::duration_cast<std::chrono::seconds>(
-            lastWokenUp + std::chrono::seconds(settings.pollInterval) - before)
-            .count());
+        1L, static_cast<long>(std::chrono::duration_cast<std::chrono::seconds>(
+                                  lastWokenUp +
+                                  std::chrono::seconds(settings.pollInterval) -
+                                  before)
+                                  .count()));
   } else {
     lastWokenUp = steady_time_point::min();
   }
@@ -4563,7 +4566,7 @@ void Worker::waitForInput() {
           }
         } else {
           DLOG(INFO) << goal->getName() << ": read " << rd << " bytes";
-          std::string data((char*)buffer.data(), rd);
+          std::string data(reinterpret_cast<char*>(buffer.data()), rd);
           j->lastOutput = after;
           goal->handleChildOutput(k, data);
         }
@@ -4638,7 +4641,7 @@ bool Worker::pathContentsGood(const Path& path) {
   }
   LOG(INFO) << "checking path '" << path << "'...";
   auto info = store.queryPathInfo(path);
-  bool res;
+  bool res = 0;
   if (!pathExists(path)) {
     res = false;
   } else {
@@ -4663,8 +4666,8 @@ static void primeCache(Store& store, const PathSet& paths) {
   PathSet willBuild;
   PathSet willSubstitute;
   PathSet unknown;
-  unsigned long long downloadSize;
-  unsigned long long narSize;
+  unsigned long long downloadSize = 0;
+  unsigned long long narSize = 0;
   store.queryMissing(paths, willBuild, willSubstitute, unknown, downloadSize,
                      narSize);
 
diff --git a/third_party/nix/src/libstore/builtins/buildenv.cc b/third_party/nix/src/libstore/builtins/buildenv.cc
index 95f915227b..9413c4b036 100644
--- a/third_party/nix/src/libstore/builtins/buildenv.cc
+++ b/third_party/nix/src/libstore/builtins/buildenv.cc
@@ -35,15 +35,17 @@ static void createLinks(const Path& srcDir, const Path& dstDir, int priority) {
   }
 
   for (const auto& ent : srcFiles) {
-    if (ent.name[0] == '.') /* not matched by glob */
+    if (ent.name[0] == '.') { /* not matched by glob */
       continue;
+    }
     auto srcFile = srcDir + "/" + ent.name;
     auto dstFile = dstDir + "/" + ent.name;
 
-    struct stat srcSt;
+    struct stat srcSt {};
     try {
-      if (stat(srcFile.c_str(), &srcSt) == -1)
+      if (stat(srcFile.c_str(), &srcSt) == -1) {
         throw SysError("getting status of '%1%'", srcFile);
+      }
     } catch (SysError& e) {
       if (e.errNo == ENOENT || e.errNo == ENOTDIR) {
         LOG(ERROR) << "warning: skipping dangling symlink '" << dstFile << "'";
@@ -61,11 +63,12 @@ static void createLinks(const Path& srcDir, const Path& dstDir, int priority) {
     if (absl::EndsWith(srcFile, "/propagated-build-inputs") ||
         absl::EndsWith(srcFile, "/nix-support") ||
         absl::EndsWith(srcFile, "/perllocal.pod") ||
-        absl::EndsWith(srcFile, "/info/dir") || absl::EndsWith(srcFile, "/log"))
+        absl::EndsWith(srcFile, "/info/dir") ||
+        absl::EndsWith(srcFile, "/log")) {
       continue;
 
-    else if (S_ISDIR(srcSt.st_mode)) {
-      struct stat dstSt;
+    } else if (S_ISDIR(srcSt.st_mode)) {
+      struct stat dstSt {};
       auto res = lstat(dstFile.c_str(), &dstSt);
       if (res == 0) {
         if (S_ISDIR(dstSt.st_mode)) {
@@ -73,45 +76,53 @@ static void createLinks(const Path& srcDir, const Path& dstDir, int priority) {
           continue;
         } else if (S_ISLNK(dstSt.st_mode)) {
           auto target = canonPath(dstFile, true);
-          if (!S_ISDIR(lstat(target).st_mode))
+          if (!S_ISDIR(lstat(target).st_mode)) {
             throw Error("collision between '%1%' and non-directory '%2%'",
                         srcFile, target);
-          if (unlink(dstFile.c_str()) == -1)
+          }
+          if (unlink(dstFile.c_str()) == -1) {
             throw SysError(format("unlinking '%1%'") % dstFile);
-          if (mkdir(dstFile.c_str(), 0755) == -1)
+          }
+          if (mkdir(dstFile.c_str(), 0755) == -1) {
             throw SysError(format("creating directory '%1%'"));
+          }
           createLinks(target, dstFile, priorities[dstFile]);
           createLinks(srcFile, dstFile, priority);
           continue;
         }
-      } else if (errno != ENOENT)
+      } else if (errno != ENOENT) {
         throw SysError(format("getting status of '%1%'") % dstFile);
+      }
     }
 
     else {
-      struct stat dstSt;
+      struct stat dstSt {};
       auto res = lstat(dstFile.c_str(), &dstSt);
       if (res == 0) {
         if (S_ISLNK(dstSt.st_mode)) {
           auto prevPriority = priorities[dstFile];
-          if (prevPriority == priority)
+          if (prevPriority == priority) {
             throw Error(
                 "packages '%1%' and '%2%' have the same priority %3%; "
                 "use 'nix-env --set-flag priority NUMBER INSTALLED_PKGNAME' "
                 "to change the priority of one of the conflicting packages"
                 " (0 being the highest priority)",
                 srcFile, readLink(dstFile), priority);
+          }
           if (prevPriority < priority) {
             continue;
           }
-          if (unlink(dstFile.c_str()) == -1)
+          if (unlink(dstFile.c_str()) == -1) {
             throw SysError(format("unlinking '%1%'") % dstFile);
-        } else if (S_ISDIR(dstSt.st_mode))
+          }
+        } else if (S_ISDIR(dstSt.st_mode)) {
           throw Error(
               "collision between non-directory '%1%' and directory '%2%'",
               srcFile, dstFile);
-      } else if (errno != ENOENT)
+        }
+      } else if (errno != ENOENT) {
         throw SysError(format("getting status of '%1%'") % dstFile);
+      }
     }
 
     createSymlink(srcFile, dstFile);
@@ -201,10 +212,11 @@ void builtinBuildenv(const BasicDerivation& drv) {
     return a.priority < b.priority ||
            (a.priority == b.priority && a.path < b.path);
   });
-  for (const auto& pkg : pkgs)
+  for (const auto& pkg : pkgs) {
     if (pkg.active) {
       addPkg(pkg.path, pkg.priority);
     }
+  }
 
   /* Symlink to the packages that have been "propagated" by packages
    * installed by the user (i.e., package X declares that it wants Y
diff --git a/third_party/nix/src/libstore/builtins/fetchurl.cc b/third_party/nix/src/libstore/builtins/fetchurl.cc
index 867a120e8d..f7857b543d 100644
--- a/third_party/nix/src/libstore/builtins/fetchurl.cc
+++ b/third_party/nix/src/libstore/builtins/fetchurl.cc
@@ -20,8 +20,9 @@ void builtinFetchurl(const BasicDerivation& drv, const std::string& netrcData) {
 
   auto getAttr = [&](const std::string& name) {
     auto i = drv.env.find(name);
-    if (i == drv.env.end())
+    if (i == drv.env.end()) {
       throw Error(format("attribute '%s' missing") % name);
+    }
     return i->second;
   };
 
@@ -47,21 +48,24 @@ void builtinFetchurl(const BasicDerivation& drv, const std::string& netrcData) {
       decompressor->finish();
     });
 
-    if (unpack)
+    if (unpack) {
       restorePath(storePath, *source);
-    else
+    } else {
       writeFile(storePath, *source);
+    }
 
     auto executable = drv.env.find("executable");
     if (executable != drv.env.end() && executable->second == "1") {
-      if (chmod(storePath.c_str(), 0755) == -1)
+      if (chmod(storePath.c_str(), 0755) == -1) {
         throw SysError(format("making '%1%' executable") % storePath);
+      }
     }
   };
 
   /* Try the hashed mirrors first. */
-  if (getAttr("outputHashMode") == "flat")
-    for (auto hashedMirror : settings.hashedMirrors.get()) try {
+  if (getAttr("outputHashMode") == "flat") {
+    for (auto hashedMirror : settings.hashedMirrors.get()) {
+      try {
         if (!absl::EndsWith(hashedMirror, "/")) {
           hashedMirror += '/';
         }
@@ -73,6 +77,8 @@ void builtinFetchurl(const BasicDerivation& drv, const std::string& netrcData) {
       } catch (Error& e) {
         LOG(ERROR) << e.what();
       }
+    }
+  }
 
   /* Otherwise try the specified URL. */
   fetch(mainUrl);
diff --git a/third_party/nix/src/libstore/crypto.cc b/third_party/nix/src/libstore/crypto.cc
index bec0b08c67..2a03f825a7 100644
--- a/third_party/nix/src/libstore/crypto.cc
+++ b/third_party/nix/src/libstore/crypto.cc
@@ -54,10 +54,11 @@ SecretKey::SecretKey(const std::string& s) : Key(s) {
 std::string SecretKey::signDetached(const std::string& data) const {
 #if HAVE_SODIUM
   unsigned char sig[crypto_sign_BYTES];
-  unsigned long long sigLen;
+  unsigned long long sigLen = 0;
   crypto_sign_detached(sig, &sigLen, (unsigned char*)data.data(), data.size(),
                        (unsigned char*)key.data());
-  return name + ":" + absl::Base64Escape(std::string((char*)sig, sigLen));
+  return name + ":" +
+         absl::Base64Escape(std::string(reinterpret_cast<char*>(sig), sigLen));
 #else
   noSodium();
 #endif
@@ -67,7 +68,8 @@ PublicKey SecretKey::toPublicKey() const {
 #if HAVE_SODIUM
   unsigned char pk[crypto_sign_PUBLICKEYBYTES];
   crypto_sign_ed25519_sk_to_pk(pk, (unsigned char*)key.data());
-  return PublicKey(name, std::string((char*)pk, crypto_sign_PUBLICKEYBYTES));
+  return PublicKey(name, std::string(reinterpret_cast<char*>(pk),
+                                     crypto_sign_PUBLICKEYBYTES));
 #else
   noSodium();
 #endif
@@ -101,8 +103,9 @@ bool verifyDetached(const std::string& data, const std::string& sig,
   }
 
   return crypto_sign_verify_detached(
-             (unsigned char*)sig2.data(), (unsigned char*)data.data(),
-             data.size(), (unsigned char*)key->second.key.data()) == 0;
+             reinterpret_cast<unsigned char*>(sig2.data()),
+             (unsigned char*)data.data(), data.size(),
+             (unsigned char*)key->second.key.data()) == 0;
 #else
   noSodium();
 #endif
diff --git a/third_party/nix/src/libstore/derivations.cc b/third_party/nix/src/libstore/derivations.cc
index 18b313385c..208e7e981c 100644
--- a/third_party/nix/src/libstore/derivations.cc
+++ b/third_party/nix/src/libstore/derivations.cc
@@ -94,7 +94,7 @@ static void expect(std::istream& str, const std::string& s) {
 static std::string parseString(std::istream& str) {
   std::string res;
   expect(str, "\"");
-  int c;
+  int c = 0;
   while ((c = str.get()) != '"') {
     if (c == '\\') {
       c = str.get();
@@ -105,10 +105,10 @@ static std::string parseString(std::istream& str) {
       } else if (c == 't') {
         res += '\t';
       } else {
-        res += c;
+        res += std::to_string(c);
       }
     } else {
-      res += c;
+      res += std::to_string(c);
     }
   }
   return res;
diff --git a/third_party/nix/src/libstore/download.cc b/third_party/nix/src/libstore/download.cc
index e73181e731..dfa72e3eb0 100644
--- a/third_party/nix/src/libstore/download.cc
+++ b/third_party/nix/src/libstore/download.cc
@@ -160,7 +160,7 @@ struct CurlDownloader : public Downloader {
           decompressionSink = makeDecompressionSink(encoding, finalSink);
         }
 
-        (*decompressionSink)((unsigned char*)contents, realSize);
+        (*decompressionSink)(static_cast<unsigned char*>(contents), realSize);
 
         return realSize;
       } catch (...) {
@@ -171,12 +171,13 @@ struct CurlDownloader : public Downloader {
 
     static size_t writeCallbackWrapper(void* contents, size_t size,
                                        size_t nmemb, void* userp) {
-      return ((DownloadItem*)userp)->writeCallback(contents, size, nmemb);
+      return (static_cast<DownloadItem*>(userp))
+          ->writeCallback(contents, size, nmemb);
     }
 
     size_t headerCallback(void* contents, size_t size, size_t nmemb) {
       size_t realSize = size * nmemb;
-      std::string line((char*)contents, realSize);
+      std::string line(static_cast<char*>(contents), realSize);
       DLOG(INFO) << "got header for '" << request.uri
                  << "': " << absl::StripAsciiWhitespace(line);
       if (line.compare(0, 5, "HTTP/") == 0) {  // new response starts
@@ -218,7 +219,8 @@ struct CurlDownloader : public Downloader {
 
     static size_t headerCallbackWrapper(void* contents, size_t size,
                                         size_t nmemb, void* userp) {
-      return ((DownloadItem*)userp)->headerCallback(contents, size, nmemb);
+      return (static_cast<DownloadItem*>(userp))
+          ->headerCallback(contents, size, nmemb);
     }
 
     static int debugCallback(CURL* handle, curl_infotype type, char* data,
@@ -245,7 +247,8 @@ struct CurlDownloader : public Downloader {
 
     static size_t readCallbackWrapper(char* buffer, size_t size, size_t nitems,
                                       void* userp) {
-      return ((DownloadItem*)userp)->readCallback(buffer, size, nitems);
+      return (static_cast<DownloadItem*>(userp))
+          ->readCallback(buffer, size, nitems);
     }
 
     void init() {
@@ -337,7 +340,7 @@ struct CurlDownloader : public Downloader {
       long httpStatus = 0;
       curl_easy_getinfo(req, CURLINFO_RESPONSE_CODE, &httpStatus);
 
-      char* effectiveUriCStr;
+      char* effectiveUriCStr = nullptr;
       curl_easy_getinfo(req, CURLINFO_EFFECTIVE_URL, &effectiveUriCStr);
       if (effectiveUriCStr != nullptr) {
         result.effectiveUri = effectiveUriCStr;
@@ -546,7 +549,7 @@ struct CurlDownloader : public Downloader {
       checkInterrupt();
 
       /* Let curl do its thing. */
-      int running;
+      int running = 0;
       CURLMcode mc = curl_multi_perform(curlm, &running);
       if (mc != CURLM_OK) {
         throw nix::Error(
@@ -555,8 +558,8 @@ struct CurlDownloader : public Downloader {
       }
 
       /* Set the promises of any finished requests. */
-      CURLMsg* msg;
-      int left;
+      CURLMsg* msg = nullptr;
+      int left = 0;
       while ((msg = curl_multi_info_read(curlm, &left)) != nullptr) {
         if (msg->msg == CURLMSG_DONE) {
           auto i = items.find(msg->easy_handle);
@@ -579,9 +582,10 @@ struct CurlDownloader : public Downloader {
           nextWakeup != std::chrono::steady_clock::time_point()
               ? std::max(
                     0,
-                    (int)std::chrono::duration_cast<std::chrono::milliseconds>(
-                        nextWakeup - std::chrono::steady_clock::now())
-                        .count())
+                    static_cast<int>(
+                        std::chrono::duration_cast<std::chrono::milliseconds>(
+                            nextWakeup - std::chrono::steady_clock::now())
+                            .count()))
               : maxSleepTimeMs;
       DLOG(INFO) << "download thread waiting for " << sleepTimeMs << " ms";
       mc = curl_multi_wait(curlm, extraFDs, 1, sleepTimeMs, &numfds);
@@ -844,7 +848,7 @@ void Downloader::download(DownloadRequest&& request, Sink& sink) {
        if it's blocked on a full buffer. We don't hold the state
        lock while doing this to prevent blocking the download
        thread if sink() takes a long time. */
-    sink((unsigned char*)chunk.data(), chunk.size());
+    sink(reinterpret_cast<unsigned char*>(chunk.data()), chunk.size());
   }
 }
 
@@ -898,9 +902,10 @@ CachedDownloadResult Downloader::downloadCached(
       std::vector<std::string> ss =
           absl::StrSplit(readFile(dataFile), absl::ByChar('\n'));
       if (ss.size() >= 3 && ss[0] == url) {
-        time_t lastChecked;
+        time_t lastChecked = 0;
         if (absl::SimpleAtoi(ss[2], &lastChecked) &&
-            (uint64_t)lastChecked + request.ttl >= (uint64_t)time(nullptr)) {
+            static_cast<uint64_t>(lastChecked) + request.ttl >=
+                static_cast<uint64_t>(time(nullptr))) {
           skip = true;
           result.effectiveUri = request.uri;
           result.etag = ss[1];
diff --git a/third_party/nix/src/libstore/gc.cc b/third_party/nix/src/libstore/gc.cc
index 9a6d97eb73..85f7f1dba9 100644
--- a/third_party/nix/src/libstore/gc.cc
+++ b/third_party/nix/src/libstore/gc.cc
@@ -167,7 +167,7 @@ void LocalStore::addTempRoot(const Path& path) {
 
       /* Check whether the garbage collector didn't get in our
          way. */
-      struct stat st;
+      struct stat st {};
       if (fstat(state->fdTempRoots.get(), &st) == -1) {
         throw SysError(format("statting '%1%'") % fnTempRoots);
       }
@@ -239,9 +239,10 @@ void LocalStore::findTempRoots(FDs& fds, Roots& tempRoots, bool censor) {
 
     /* Extract the roots. */
     std::string::size_type pos = 0;
-    std::string::size_type end;
+    std::string::size_type end = 0;
 
-    while ((end = contents.find((char)0, pos)) != std::string::npos) {
+    while ((end = contents.find(static_cast<char>(0), pos)) !=
+           std::string::npos) {
       Path root(contents, pos, end - pos);
       DLOG(INFO) << "got temporary root " << root;
       assertStorePath(root);
@@ -387,7 +388,7 @@ void LocalStore::findRuntimeRoots(Roots& roots, bool censor) {
 
   auto procDir = AutoCloseDir{opendir("/proc")};
   if (procDir) {
-    struct dirent* ent;
+    struct dirent* ent = nullptr;
     auto digitsRegex = std::regex(R"(^\d+$)");
     auto mapRegex =
         std::regex(R"(^\s*\S+\s+\S+\s+\S+\s+\S+\s+\S+\s+(/\S+)\s*$)");
@@ -407,7 +408,7 @@ void LocalStore::findRuntimeRoots(Roots& roots, bool censor) {
           }
           throw SysError(format("opening %1%") % fdStr);
         }
-        struct dirent* fd_ent;
+        struct dirent* fd_ent = nullptr;
         while (errno = 0, fd_ent = readdir(fdDir.get())) {
           if (fd_ent->d_name[0] != '.') {
             readProcLink(fmt("%s/%s", fdStr, fd_ent->d_name), unchecked);
@@ -481,11 +482,11 @@ struct LocalStore::GCState {
   PathSet tempRoots;
   PathSet dead;
   PathSet alive;
-  bool gcKeepOutputs;
-  bool gcKeepDerivations;
+  bool gcKeepOutputs{};
+  bool gcKeepDerivations{};
   unsigned long long bytesInvalidated;
   bool moveToTrash = true;
-  bool shouldDelete;
+  bool shouldDelete{};
   explicit GCState(GCResults& results_)
       : results(results_), bytesInvalidated(0) {}
 };
@@ -498,7 +499,7 @@ bool LocalStore::isActiveTempFile(const GCState& state, const Path& path,
 }
 
 void LocalStore::deleteGarbage(GCState& state, const Path& path) {
-  unsigned long long bytesFreed;
+  unsigned long long bytesFreed = 0;
   deletePath(path, bytesFreed);
   state.results.bytesFreed += bytesFreed;
 }
@@ -522,7 +523,7 @@ void LocalStore::deletePathRecursive(GCState& state, const Path& path) {
 
   Path realPath = realStoreDir + "/" + baseNameOf(path);
 
-  struct stat st;
+  struct stat st {};
   if (lstat(realPath.c_str(), &st) != 0) {
     if (errno == ENOENT) {
       return;
@@ -697,7 +698,7 @@ void LocalStore::removeUnusedLinks(const GCState& state) {
   long long actualSize = 0;
   long long unsharedSize = 0;
 
-  struct dirent* dirent;
+  struct dirent* dirent = nullptr;
   while (errno = 0, dirent = readdir(dir.get())) {
     checkInterrupt();
     std::string name = dirent->d_name;
@@ -706,7 +707,7 @@ void LocalStore::removeUnusedLinks(const GCState& state) {
     }
     Path path = linksDir + "/" + name;
 
-    struct stat st;
+    struct stat st {};
     if (lstat(path.c_str(), &st) == -1) {
       throw SysError(format("statting '%1%'") % path);
     }
@@ -726,7 +727,7 @@ void LocalStore::removeUnusedLinks(const GCState& state) {
     state.results.bytesFreed += st.st_size;
   }
 
-  struct stat st;
+  struct stat st {};
   if (stat(linksDir.c_str(), &st) == -1) {
     throw SysError(format("statting '%1%'") % linksDir);
   }
@@ -840,7 +841,7 @@ void LocalStore::collectGarbage(const GCOptions& options, GCResults& results) {
          again.  We don't use readDirectory() here so that GCing
          can start faster. */
       Paths entries;
-      struct dirent* dirent;
+      struct dirent* dirent = nullptr;
       while (errno = 0, dirent = readdir(dir.get())) {
         checkInterrupt();
         std::string name = dirent->d_name;
@@ -911,12 +912,12 @@ void LocalStore::autoGC(bool sync) {
       return std::stoll(readFile(fakeFreeSpaceFile));
     }
 
-    struct statvfs st;
+    struct statvfs st {};
     if (statvfs(realStoreDir.c_str(), &st) != 0) {
       throw SysError("getting filesystem info about '%s'", realStoreDir);
     }
 
-    return (uint64_t)st.f_bavail * st.f_bsize;
+    return static_cast<uint64_t>(st.f_bavail) * st.f_bsize;
   };
 
   std::shared_future<void> future;
diff --git a/third_party/nix/src/libstore/legacy-ssh-store.cc b/third_party/nix/src/libstore/legacy-ssh-store.cc
index 332f6676b2..abff734efc 100644
--- a/third_party/nix/src/libstore/legacy-ssh-store.cc
+++ b/third_party/nix/src/libstore/legacy-ssh-store.cc
@@ -34,7 +34,7 @@ struct LegacySSHStore : public Store {
     std::unique_ptr<SSHMaster::Connection> sshConn;
     FdSink to;
     FdSource from;
-    int remoteVersion;
+    int remoteVersion{};
     bool good = true;
   };
 
@@ -209,7 +209,7 @@ struct LegacySSHStore : public Store {
     conn->to.flush();
 
     BuildResult status;
-    status.status = (BuildResult::Status)readInt(conn->from);
+    status.status = static_cast<BuildResult::Status>(readInt(conn->from));
     conn->from >> status.errorMsg;
 
     if (GET_PROTOCOL_MINOR(conn->remoteVersion) >= 3) {
diff --git a/third_party/nix/src/libstore/local-fs-store.cc b/third_party/nix/src/libstore/local-fs-store.cc
index 2dd09093d5..8e5d3e2119 100644
--- a/third_party/nix/src/libstore/local-fs-store.cc
+++ b/third_party/nix/src/libstore/local-fs-store.cc
@@ -26,7 +26,7 @@ struct LocalStoreAccessor : public FSAccessor {
   FSAccessor::Stat stat(const Path& path) override {
     auto realPath = toRealPath(path);
 
-    struct stat st;
+    struct stat st {};
     if (lstat(realPath.c_str(), &st) != 0) {
       if (errno == ENOENT || errno == ENOTDIR) {
         return {Type::tMissing, 0, false};
@@ -41,7 +41,7 @@ struct LocalStoreAccessor : public FSAccessor {
     return {S_ISREG(st.st_mode)
                 ? Type::tRegular
                 : S_ISLNK(st.st_mode) ? Type::tSymlink : Type::tDirectory,
-            S_ISREG(st.st_mode) ? (uint64_t)st.st_size : 0,
+            S_ISREG(st.st_mode) ? static_cast<uint64_t>(st.st_size) : 0,
             S_ISREG(st.st_mode) && ((st.st_mode & S_IXUSR) != 0u)};
   }
 
diff --git a/third_party/nix/src/libstore/local-store.cc b/third_party/nix/src/libstore/local-store.cc
index 8c0a28a616..c513e3ac4e 100644
--- a/third_party/nix/src/libstore/local-store.cc
+++ b/third_party/nix/src/libstore/local-store.cc
@@ -88,7 +88,7 @@ LocalStore::LocalStore(const Params& params)
       LOG(ERROR) << "warning: the group '" << settings.buildUsersGroup
                  << "' specified in 'build-users-group' does not exist";
     } else {
-      struct stat st;
+      struct stat st {};
       if (stat(realStoreDir.c_str(), &st) != 0) {
         throw SysError(format("getting attributes of path '%1%'") %
                        realStoreDir);
@@ -111,7 +111,7 @@ LocalStore::LocalStore(const Params& params)
   /* Ensure that the store and its parents are not symlinks. */
   if (getEnv("NIX_IGNORE_SYMLINK_STORE") != "1") {
     Path path = realStoreDir;
-    struct stat st;
+    struct stat st {};
     while (path != "/") {
       if (lstat(path.c_str(), &st) != 0) {
         throw SysError(format("getting status of '%1%'") % path);
@@ -131,7 +131,7 @@ LocalStore::LocalStore(const Params& params)
      needed, we reserve some dummy space that we can free just
      before doing a garbage collection. */
   try {
-    struct stat st;
+    struct stat st {};
     if (stat(reservedPath.c_str(), &st) == -1 ||
         st.st_size != settings.reservedSize) {
       AutoCloseFD fd =
@@ -349,7 +349,8 @@ void LocalStore::openDB(State& state, bool create) {
     if (sqlite3_step(stmt) != SQLITE_ROW) {
       throwSQLiteError(db, "querying journal mode");
     }
-    prevMode = std::string((const char*)sqlite3_column_text(stmt, 0));
+    prevMode = std::string(
+        reinterpret_cast<const char*>(sqlite3_column_text(stmt, 0)));
   }
   if (prevMode != mode &&
       sqlite3_exec(db, ("pragma main.journal_mode = " + mode + ";").c_str(),
@@ -378,7 +379,7 @@ void LocalStore::makeStoreWritable() {
     return;
   }
   /* Check if /nix/store is on a read-only mount. */
-  struct statvfs stat;
+  struct statvfs stat {};
   if (statvfs(realStoreDir.c_str(), &stat) != 0) {
     throw SysError("getting info about the Nix store mount point");
   }
@@ -432,7 +433,7 @@ static void canonicaliseTimestampAndPermissions(const Path& path,
 }  // namespace nix
 
 void canonicaliseTimestampAndPermissions(const Path& path) {
-  struct stat st;
+  struct stat st {};
   if (lstat(path.c_str(), &st) != 0) {
     throw SysError(format("getting attributes of path '%1%'") % path);
   }
@@ -443,7 +444,7 @@ static void canonicalisePathMetaData_(const Path& path, uid_t fromUid,
                                       InodesSeen& inodesSeen) {
   checkInterrupt();
 
-  struct stat st;
+  struct stat st {};
   if (lstat(path.c_str(), &st) != 0) {
     throw SysError(format("getting attributes of path '%1%'") % path);
   }
@@ -488,7 +489,7 @@ static void canonicalisePathMetaData_(const Path& path, uid_t fromUid,
      However, ignore files that we chown'ed ourselves previously to
      ensure that we don't fail on hard links within the same build
      (i.e. "touch $out/foo; ln $out/foo $out/bar"). */
-  if (fromUid != (uid_t)-1 && st.st_uid != fromUid) {
+  if (fromUid != static_cast<uid_t>(-1) && st.st_uid != fromUid) {
     if (S_ISDIR(st.st_mode)) {
       throw BuildError(format("invalid file '%1%': is a directory") % path);
     }
@@ -543,7 +544,7 @@ void canonicalisePathMetaData(const Path& path, uid_t fromUid,
 
   /* On platforms that don't have lchown(), the top-level path can't
      be a symlink, since we can't change its ownership. */
-  struct stat st;
+  struct stat st {};
   if (lstat(path.c_str(), &st) != 0) {
     throw SysError(format("getting attributes of path '%1%'") % path);
   }
@@ -573,7 +574,7 @@ void LocalStore::checkDerivationOutputs(const Path& drvPath,
           drvPath);
     }
 
-    bool recursive;
+    bool recursive = 0;
     Hash h;
     out->second.parseHashInfo(recursive, h);
     Path outPath = makeFixedOutputPath(recursive, h, drvName);
@@ -688,7 +689,8 @@ void LocalStore::queryPathInfoUncached(
 
       info->registrationTime = useQueryPathInfo.getInt(2);
 
-      auto s = (const char*)sqlite3_column_text(state->stmtQueryPathInfo, 3);
+      auto s = reinterpret_cast<const char*>(
+          sqlite3_column_text(state->stmtQueryPathInfo, 3));
       if (s != nullptr) {
         info->deriver = s;
       }
@@ -698,12 +700,14 @@ void LocalStore::queryPathInfoUncached(
 
       info->ultimate = useQueryPathInfo.getInt(5) == 1;
 
-      s = (const char*)sqlite3_column_text(state->stmtQueryPathInfo, 6);
+      s = reinterpret_cast<const char*>(
+          sqlite3_column_text(state->stmtQueryPathInfo, 6));
       if (s != nullptr) {
         info->sigs = absl::StrSplit(s, absl::ByChar(' '));
       }
 
-      s = (const char*)sqlite3_column_text(state->stmtQueryPathInfo, 7);
+      s = reinterpret_cast<const char*>(
+          sqlite3_column_text(state->stmtQueryPathInfo, 7));
       if (s != nullptr) {
         info->ca = s;
       }
@@ -858,8 +862,8 @@ Path LocalStore::queryPathFromHashPart(const std::string& hashPart) {
       return "";
     }
 
-    const char* s =
-        (const char*)sqlite3_column_text(state->stmtQueryPathFromHashPart, 0);
+    const char* s = reinterpret_cast<const char*>(
+        sqlite3_column_text(state->stmtQueryPathFromHashPart, 0));
     return (s != nullptr) &&
                    prefix.compare(0, prefix.size(), s, prefix.size()) == 0
                ? s
diff --git a/third_party/nix/src/libstore/nar-accessor.cc b/third_party/nix/src/libstore/nar-accessor.cc
index 49fa1bd1d6..cfd3d50b32 100644
--- a/third_party/nix/src/libstore/nar-accessor.cc
+++ b/third_party/nix/src/libstore/nar-accessor.cc
@@ -76,7 +76,7 @@ struct NarAccessor : public FSAccessor {
     void preallocateContents(unsigned long long size) override {
       currentStart = std::string(s, pos, 16);
       assert(size <= std::numeric_limits<size_t>::max());
-      parents.top()->size = (size_t)size;
+      parents.top()->size = static_cast<size_t>(size);
       parents.top()->start = pos;
     }
 
diff --git a/third_party/nix/src/libstore/nar-info-disk-cache.cc b/third_party/nix/src/libstore/nar-info-disk-cache.cc
index be2ad8f2da..8f723a8109 100644
--- a/third_party/nix/src/libstore/nar-info-disk-cache.cc
+++ b/third_party/nix/src/libstore/nar-info-disk-cache.cc
@@ -55,10 +55,10 @@ class NarInfoDiskCacheImpl final : public NarInfoDiskCache {
   const int purgeInterval = 24 * 3600;
 
   struct Cache {
-    int id;
+    int id{};
     Path storeDir;
-    bool wantMassQuery;
-    int priority;
+    bool wantMassQuery{};
+    int priority{};
   };
 
   struct State {
@@ -164,8 +164,9 @@ class NarInfoDiskCacheImpl final : public NarInfoDiskCache {
               static_cast<int64_t>(wantMassQuery))(priority)
           .exec();
       assert(sqlite3_changes(state->db) == 1);
-      state->caches[uri] = Cache{(int)sqlite3_last_insert_rowid(state->db),
-                                 storeDir, wantMassQuery, priority};
+      state->caches[uri] =
+          Cache{static_cast<int>(sqlite3_last_insert_rowid(state->db)),
+                storeDir, wantMassQuery, priority};
     });
   }
 
@@ -181,8 +182,9 @@ class NarInfoDiskCacheImpl final : public NarInfoDiskCache {
           return false;
         }
         state->caches.emplace(
-            uri, Cache{(int)queryCache.getInt(0), queryCache.getStr(1),
-                       queryCache.getInt(2) != 0, (int)queryCache.getInt(3)});
+            uri, Cache{static_cast<int>(queryCache.getInt(0)),
+                       queryCache.getStr(1), queryCache.getInt(2) != 0,
+                       static_cast<int>(queryCache.getInt(3))});
       }
 
       auto& cache(getCache(*state, uri));
diff --git a/third_party/nix/src/libstore/optimise-store.cc b/third_party/nix/src/libstore/optimise-store.cc
index eb24633c18..af67d5e19a 100644
--- a/third_party/nix/src/libstore/optimise-store.cc
+++ b/third_party/nix/src/libstore/optimise-store.cc
@@ -17,7 +17,7 @@
 namespace nix {
 
 static void makeWritable(const Path& path) {
-  struct stat st;
+  struct stat st {};
   if (lstat(path.c_str(), &st) != 0) {
     throw SysError(format("getting attributes of path '%1%'") % path);
   }
@@ -50,7 +50,7 @@ LocalStore::InodeHash LocalStore::loadInodeHash() {
     throw SysError(format("opening directory '%1%'") % linksDir);
   }
 
-  struct dirent* dirent;
+  struct dirent* dirent = nullptr;
   while (errno = 0, dirent = readdir(dir.get())) { /* sic */
     checkInterrupt();
     // We don't care if we hit non-hash files, anything goes
@@ -74,7 +74,7 @@ Strings LocalStore::readDirectoryIgnoringInodes(const Path& path,
     throw SysError(format("opening directory '%1%'") % path);
   }
 
-  struct dirent* dirent;
+  struct dirent* dirent = nullptr;
   while (errno = 0, dirent = readdir(dir.get())) { /* sic */
     checkInterrupt();
 
@@ -100,7 +100,7 @@ void LocalStore::optimisePath_(OptimiseStats& stats, const Path& path,
                                InodeHash& inodeHash) {
   checkInterrupt();
 
-  struct stat st;
+  struct stat st {};
   if (lstat(path.c_str(), &st) != 0) {
     throw SysError(format("getting attributes of path '%1%'") % path);
   }
@@ -183,7 +183,7 @@ retry:
 
   /* Yes!  We've seen a file with the same contents.  Replace the
      current file with a hard link to that file. */
-  struct stat stLink;
+  struct stat stLink {};
   if (lstat(linkPath.c_str(), &stLink) != 0) {
     throw SysError(format("getting attributes of path '%1%'") % linkPath);
   }
diff --git a/third_party/nix/src/libstore/pathlocks.cc b/third_party/nix/src/libstore/pathlocks.cc
index 4b153856d2..7c528e876e 100644
--- a/third_party/nix/src/libstore/pathlocks.cc
+++ b/third_party/nix/src/libstore/pathlocks.cc
@@ -37,7 +37,7 @@ void deleteLockFile(const Path& path, int fd) {
 }
 
 bool lockFile(int fd, LockType lockType, bool wait) {
-  int type;
+  int type = 0;
   if (lockType == ltRead) {
     type = LOCK_SH;
   } else if (lockType == ltWrite) {
@@ -119,7 +119,7 @@ bool PathLocks::lockPaths(const PathSet& paths, const std::string& waitMsg,
 
       /* Check that the lock file hasn't become stale (i.e.,
          hasn't been unlinked). */
-      struct stat st;
+      struct stat st {};
       if (fstat(fd.get(), &st) == -1) {
         throw SysError(format("statting lock file '%1%'") % lockPath);
       }
diff --git a/third_party/nix/src/libstore/profiles.cc b/third_party/nix/src/libstore/profiles.cc
index 0d44c60cc4..c2a965e2ed 100644
--- a/third_party/nix/src/libstore/profiles.cc
+++ b/third_party/nix/src/libstore/profiles.cc
@@ -30,7 +30,7 @@ static int parseName(absl::string_view profileName, absl::string_view name) {
     return -1;
   }
 
-  int n;
+  int n = 0;
   if (!absl::SimpleAtoi(name, &n) || n < 0) {
     return -1;
   }
@@ -45,12 +45,12 @@ Generations findGenerations(const Path& profile, int& curGen) {
   std::string profileName = baseNameOf(profile);
 
   for (auto& i : readDirectory(profileDir)) {
-    int n;
+    int n = 0;
     if ((n = parseName(profileName, i.name)) != -1) {
       Generation gen;
       gen.path = profileDir + "/" + i.name;
       gen.number = n;
-      struct stat st;
+      struct stat st {};
       if (lstat(gen.path.c_str(), &st) != 0) {
         throw SysError(format("statting '%1%'") % gen.path);
       }
@@ -75,10 +75,10 @@ Path createGeneration(const ref<LocalFSStore>& store, const Path& profile,
                       const Path& outPath) {
   /* The new generation number should be higher than old the
      previous ones. */
-  int dummy;
+  int dummy = 0;
   Generations gens = findGenerations(profile, dummy);
 
-  unsigned int num;
+  unsigned int num = 0;
   if (!gens.empty()) {
     Generation last = gens.back();
 
@@ -138,7 +138,7 @@ void deleteGenerations(const Path& profile,
   PathLocks lock;
   lockProfile(lock, profile);
 
-  int curGen;
+  int curGen = 0;
   Generations gens = findGenerations(profile, curGen);
 
   if (gensToDelete.find(curGen) != gensToDelete.end()) {
@@ -158,7 +158,7 @@ void deleteGenerationsGreaterThan(const Path& profile, int max, bool dryRun) {
   PathLocks lock;
   lockProfile(lock, profile);
 
-  int curGen;
+  int curGen = 0;
   bool fromCurGen = false;
   Generations gens = findGenerations(profile, curGen);
   for (auto i = gens.rbegin(); i != gens.rend(); ++i) {
@@ -181,7 +181,7 @@ void deleteOldGenerations(const Path& profile, bool dryRun) {
   PathLocks lock;
   lockProfile(lock, profile);
 
-  int curGen;
+  int curGen = 0;
   Generations gens = findGenerations(profile, curGen);
 
   for (auto& i : gens) {
@@ -195,7 +195,7 @@ void deleteGenerationsOlderThan(const Path& profile, time_t t, bool dryRun) {
   PathLocks lock;
   lockProfile(lock, profile);
 
-  int curGen;
+  int curGen = 0;
   Generations gens = findGenerations(profile, curGen);
 
   bool canDelete = false;
@@ -219,7 +219,7 @@ void deleteGenerationsOlderThan(const Path& profile,
                                 const std::string& timeSpec, bool dryRun) {
   time_t curTime = time(nullptr);
   std::string strDays = std::string(timeSpec, 0, timeSpec.size() - 1);
-  int days;
+  int days = 0;
 
   if (!absl::SimpleAtoi(strDays, &days) || days < 1) {
     throw Error(format("invalid number of days specifier '%1%'") % timeSpec);
diff --git a/third_party/nix/src/libstore/references.cc b/third_party/nix/src/libstore/references.cc
index ea9ce44275..b70d282e8d 100644
--- a/third_party/nix/src/libstore/references.cc
+++ b/third_party/nix/src/libstore/references.cc
@@ -22,16 +22,16 @@ static void search(const unsigned char* s, size_t len, StringSet& hashes,
       i = false;
     }
     for (char base32Char : base32Chars) {
-      isBase32[(unsigned char)base32Char] = true;
+      isBase32[static_cast<unsigned char>(base32Char)] = true;
     }
     initialised = true;
   }
 
   for (size_t i = 0; i + refLength <= len;) {
-    int j;
+    int j = 0;
     bool match = true;
     for (j = refLength - 1; j >= 0; --j) {
-      if (!isBase32[(unsigned char)s[i + j]]) {
+      if (!isBase32[s[i + j]]) {
         i += j + 1;
         match = false;
         break;
@@ -40,7 +40,7 @@ static void search(const unsigned char* s, size_t len, StringSet& hashes,
     if (!match) {
       continue;
     }
-    std::string ref((const char*)s + i, refLength);
+    std::string ref(reinterpret_cast<const char*>(s) + i, refLength);
     if (hashes.find(ref) != hashes.end()) {
       DLOG(INFO) << "found reference to '" << ref << "' at offset " << i;
       seen.insert(ref);
@@ -68,17 +68,19 @@ void RefScanSink::operator()(const unsigned char* data, size_t len) {
   /* It's possible that a reference spans the previous and current
      fragment, so search in the concatenation of the tail of the
      previous fragment and the start of the current fragment. */
-  std::string s =
-      tail + std::string((const char*)data, len > refLength ? refLength : len);
-  search((const unsigned char*)s.data(), s.size(), hashes, seen);
+  std::string s = tail + std::string(reinterpret_cast<const char*>(data),
+                                     len > refLength ? refLength : len);
+  search(reinterpret_cast<const unsigned char*>(s.data()), s.size(), hashes,
+         seen);
 
   search(data, len, hashes, seen);
 
   size_t tailLen = len <= refLength ? len : refLength;
-  tail = std::string(tail, tail.size() < refLength - tailLen
-                               ? 0
-                               : tail.size() - (refLength - tailLen)) +
-         std::string((const char*)data + len - tailLen, tailLen);
+  tail =
+      std::string(tail, tail.size() < refLength - tailLen
+                            ? 0
+                            : tail.size() - (refLength - tailLen)) +
+      std::string(reinterpret_cast<const char*>(data) + len - tailLen, tailLen);
 }
 
 PathSet scanForReferences(const std::string& path, const PathSet& refs,
diff --git a/third_party/nix/src/libstore/remote-fs-accessor.cc b/third_party/nix/src/libstore/remote-fs-accessor.cc
index 2917f01f79..d5b2028847 100644
--- a/third_party/nix/src/libstore/remote-fs-accessor.cc
+++ b/third_party/nix/src/libstore/remote-fs-accessor.cc
@@ -75,12 +75,14 @@ std::pair<ref<FSAccessor>, Path> RemoteFSAccessor::fetch(const Path& path_) {
               throw SysError("opening NAR cache file '%s'", cacheFile);
             }
 
-            if (lseek(fd.get(), offset, SEEK_SET) != (off_t)offset) {
+            if (lseek(fd.get(), offset, SEEK_SET) !=
+                static_cast<off_t>(offset)) {
               throw SysError("seeking in '%s'", cacheFile);
             }
 
             std::string buf(length, 0);
-            readFull(fd.get(), (unsigned char*)buf.data(), length);
+            readFull(fd.get(), reinterpret_cast<unsigned char*>(buf.data()),
+                     length);
 
             return buf;
           });
diff --git a/third_party/nix/src/libstore/remote-store.cc b/third_party/nix/src/libstore/remote-store.cc
index 33a6ec310a..b2e660dc2a 100644
--- a/third_party/nix/src/libstore/remote-store.cc
+++ b/third_party/nix/src/libstore/remote-store.cc
@@ -97,7 +97,7 @@ ref<RemoteStore::Connection> UDSRemoteStore::openConnection() {
 
   std::string socketPath = path ? *path : settings.nixDaemonSocketFile;
 
-  struct sockaddr_un addr;
+  struct sockaddr_un addr {};
   addr.sun_family = AF_UNIX;
   strncpy(addr.sun_path, socketPath.c_str(), sizeof(addr.sun_path));
   if (addr.sun_path[sizeof(addr.sun_path) - 1] != '\0') {
@@ -347,7 +347,7 @@ void RemoteStore::queryPathInfoUncached(
         throw;
       }
       if (GET_PROTOCOL_MINOR(conn->daemonVersion) >= 17) {
-        bool valid;
+        bool valid = 0;
         conn->from >> valid;
         if (!valid) {
           throw InvalidPath(format("path '%s' is not valid") % path);
@@ -543,9 +543,9 @@ BuildResult RemoteStore::buildDerivation(const Path& drvPath,
   conn->to << wopBuildDerivation << drvPath << drv << buildMode;
   conn.processStderr();
   BuildResult res;
-  unsigned int status;
+  unsigned int status = 0;
   conn->from >> status >> res.errorMsg;
-  res.status = (BuildResult::Status)status;
+  res.status = static_cast<BuildResult::Status>(status);
   return res;
 }
 
diff --git a/third_party/nix/src/libstore/sqlite.cc b/third_party/nix/src/libstore/sqlite.cc
index b6ecfce924..0ed77a51bf 100644
--- a/third_party/nix/src/libstore/sqlite.cc
+++ b/third_party/nix/src/libstore/sqlite.cc
@@ -133,7 +133,7 @@ bool SQLiteStmt::Use::next() {
 }
 
 std::string SQLiteStmt::Use::getStr(int col) {
-  auto s = (const char*)sqlite3_column_text(stmt, col);
+  auto s = reinterpret_cast<const char*>(sqlite3_column_text(stmt, col));
   assert(s);
   return s;
 }
@@ -186,7 +186,7 @@ void handleSQLiteBusy(const SQLiteBusy& e) {
   /* Sleep for a while since retrying the transaction right away
      is likely to fail again. */
   checkInterrupt();
-  struct timespec t;
+  struct timespec t {};
   t.tv_sec = 0;
   t.tv_nsec = (random() % 100) * 1000 * 1000; /* <= 0.1s */
   nanosleep(&t, nullptr);
diff --git a/third_party/nix/src/libstore/ssh.cc b/third_party/nix/src/libstore/ssh.cc
index e84944c4c9..d28e44e138 100644
--- a/third_party/nix/src/libstore/ssh.cc
+++ b/third_party/nix/src/libstore/ssh.cc
@@ -110,7 +110,7 @@ Path SSHMaster::startMaster() {
   state->tmpDir =
       std::make_unique<AutoDelete>(createTempDir("", "nix", true, true, 0700));
 
-  state->socketPath = (Path)*state->tmpDir + "/ssh.sock";
+  state->socketPath = Path(*state->tmpDir) + "/ssh.sock";
 
   Pipe out;
   out.create();
diff --git a/third_party/nix/src/libstore/store-api.cc b/third_party/nix/src/libstore/store-api.cc
index 12c60dffca..f6fef4b912 100644
--- a/third_party/nix/src/libstore/store-api.cc
+++ b/third_party/nix/src/libstore/store-api.cc
@@ -262,7 +262,7 @@ Path Store::makeFixedOutputPath(bool recursive, const Hash& hash,
                    "output:out",
                    hashString(
                        htSHA256,
-                       "fixed:out:" + (recursive ? (std::string) "r:" : "") +
+                       "fixed:out:" + (recursive ? std::string("r:") : "") +
                            hash.to_string(Base16) + ":"),
                    name);
 }
@@ -782,7 +782,7 @@ ValidPathInfo decodeValidPathInfo(std::istream& str, bool hashGiven) {
   }
   getline(str, info.deriver);
   std::string s;
-  int n;
+  int n = 0;
   getline(str, s);
   if (!absl::SimpleAtoi(s, &n)) {
     throw Error("number expected");
@@ -880,7 +880,7 @@ Strings ValidPathInfo::shortRefs() const {
 }
 
 std::string makeFixedOutputCA(bool recursive, const Hash& hash) {
-  return "fixed:" + (recursive ? (std::string) "r:" : "") + hash.to_string();
+  return "fixed:" + (recursive ? std::string("r:") : "") + hash.to_string();
 }
 
 void Store::addToStore(const ValidPathInfo& info, Source& narSource,
@@ -926,7 +926,8 @@ std::pair<std::string, Store::Params> splitUriAndParams(
               throw Error("invalid URI parameter '%s'", value);
             }
             try {
-              decoded += std::stoul(std::string(value, i + 1, 2), nullptr, 16);
+              decoded += std::to_string(
+                  std::stoul(std::string(value, i + 1, 2), nullptr, 16));
               i += 3;
             } catch (...) {
               throw Error("invalid URI parameter '%s'", value);