refactor(tvix/eval): implement clearer mechanism for globals r/4592

The set of things that can leak out of `builtins` into the global
scope is statically known (it is what Nix 2.3 leaks there,
essentially).

This is a mild change over the previous mechanism, where instead at
the point where the `builtins` set is constructed we "lift" the
globals out of there (if they exist).

This way users will still eventually be able to add additional
builtins, HOWEVER they will not be able to leak them into the global
scope.

Note that upstream Nix technically leaks _all_ builtins into the
global scope using the `__*` prefix, but we are trying to avoid this
in Tvix if it is not required in nixpkgs.

Change-Id: Ie9dec2ce33740134f3b2464eba3749f421dd5953
Reviewed-on: https://cl.tvl.fyi/c/depot/+/6258
Tested-by: BuildkiteCI
Reviewed-by: sterni <sternenseemann@systemli.org>

1 files changed, 8 insertions, 0 deletions

diff --git a/tvix/eval/src/value/attrs.rs b/tvix/eval/src/value/attrs.rs
index 319f6bdfa9bb..4109691992ca 100644
--- a/tvix/eval/src/value/attrs.rs
+++ b/tvix/eval/src/value/attrs.rs
@@ -259,6 +259,14 @@ impl NixAttrs {
 
         Ok(attrs)
     }
+
+    /// Construct an attribute set directly from a BTreeMap
+    /// representation. This is only visible inside of the crate, as
+    /// it is intended exclusively for use with the construction of
+    /// global sets for the compiler.
+    pub(crate) fn from_map(map: BTreeMap<NixString, Value>) -> Self {
+        NixAttrs(AttrsRep::Map(map))
+    }
 }
 
 // In Nix, name/value attribute pairs are frequently constructed from