feat(3p/nix): add --trace-file-access to nix-instantiate r/1603

This builds on edef's work with depot-scan by adding a dedicated
flag to the command. We piggyback on upstream's restricted-mode
implementation, the checkSourcePath function.

Change-Id: I52bb613549f40dbca1e8caa036635910c1a3d6d0
Reviewed-on: https://cl.tvl.fyi/c/depot/+/1654
Tested-by: BuildkiteCI
Reviewed-by: glittershark <grfn@gws.fyi>

1 files changed, 14 insertions, 0 deletions

diff --git a/third_party/nix/src/nix-instantiate/nix-instantiate.cc b/third_party/nix/src/nix-instantiate/nix-instantiate.cc
index be96943b12..7b8d6dd3d6 100644
--- a/third_party/nix/src/nix-instantiate/nix-instantiate.cc
+++ b/third_party/nix/src/nix-instantiate/nix-instantiate.cc
@@ -96,6 +96,7 @@ static int _main(int argc, char** argv) {
     bool findFile = false;
     bool evalOnly = false;
     bool parseOnly = false;
+    bool traceFileAccess = false;
     OutputKind outputKind = okPlain;
     bool xmlOutputSourceLocation = true;
     bool strict = false;
@@ -143,6 +144,14 @@ static int _main(int argc, char** argv) {
                       repair = Repair;
                     } else if (*arg == "--dry-run") {
                       settings.readOnlyMode = true;
+                    } else if (*arg == "--trace-file-access") {
+                      traceFileAccess = true;
+                    } else if (*arg == "--trace-file-access=true") {
+                      traceFileAccess = true;
+                    } else if (*arg == "--trace-file-access=false") {
+                      traceFileAccess = false;
+                    } else if (*arg == "--notrace-file-access") {
+                      traceFileAccess = false;
                     } else if (*arg != "" && arg->at(0) == '-') {
                       return false;
                     } else {
@@ -161,6 +170,11 @@ static int _main(int argc, char** argv) {
 
     auto state = std::make_unique<EvalState>(myArgs.searchPath, store);
     state->repair = repair;
+    if (traceFileAccess) {
+      state->EnableFileAccessTracing([](const Path& path) {
+        std::cerr << "trace: depot-scan: " << path << "\n";
+      });
+    }
 
     Bindings& autoArgs = *myArgs.getAutoArgs(*state);