6 files changed, 93 insertions, 3 deletions
diff --git a/tests/check-refs.nix b/tests/check-refs.nix
index 63791fe16094..9d90b0920542 100644
--- a/tests/check-refs.nix
+++ b/tests/check-refs.nix
@@ -55,4 +55,16 @@ rec {
     inherit dep;
   };
 
+  test9 = makeTest 9 {
+    builder = builtins.toFile "builder.sh" "mkdir $out; ln -s $dep $out/link";
+    inherit dep;
+    disallowedReferences = [dep];
+  };
+
+  test10 = makeTest 10 {
+    builder = builtins.toFile "builder.sh" "mkdir $out; echo $test5; ln -s $dep $out/link";
+    inherit dep test5;
+    disallowedReferences = [test5];
+  };
+
 }
diff --git a/tests/check-refs.sh b/tests/check-refs.sh
index 9e103664a3a7..34ee22cfc8f7 100644
--- a/tests/check-refs.sh
+++ b/tests/check-refs.sh
@@ -32,3 +32,9 @@ nix-build -o $RESULT check-refs.nix -A test7
 
 # test8 should fail (toFile depending on derivation output).
 (! nix-build -o $RESULT check-refs.nix -A test8)
+
+# test9 should fail (disallowed reference).
+(! nix-build -o $RESULT check-refs.nix -A test9)
+
+# test10 should succeed (no disallowed references).
+nix-build -o $RESULT check-refs.nix -A test10
diff --git a/tests/check-reqs.nix b/tests/check-reqs.nix
new file mode 100644
index 000000000000..41436cb48e08
--- /dev/null
+++ b/tests/check-reqs.nix
@@ -0,0 +1,57 @@
+with import ./config.nix;
+
+rec {
+  dep1 = mkDerivation {
+    name = "check-reqs-dep1";
+    builder = builtins.toFile "builder.sh" "mkdir $out; touch $out/file1";
+  };
+
+  dep2 = mkDerivation {
+    name = "check-reqs-dep2";
+    builder = builtins.toFile "builder.sh" "mkdir $out; touch $out/file2";
+  };
+
+  deps = mkDerivation {
+    name = "check-reqs-deps";
+    dep1 = dep1;
+    dep2 = dep2;
+    builder = builtins.toFile "builder.sh" ''
+      mkdir $out
+      ln -s $dep1/file1 $out/file1
+      ln -s $dep2/file2 $out/file2
+    '';
+  };
+
+  makeTest = nr: allowreqs: mkDerivation {
+    name = "check-reqs-" + toString nr;
+    inherit deps;
+    builder = builtins.toFile "builder.sh" ''
+      mkdir $out
+      ln -s $deps $out/depdir1
+    '';
+    allowedRequisites = allowreqs;
+  };
+
+  # When specifying all the requisites, the build succeeds.
+  test1 = makeTest 1 [ dep1 dep2 deps ];
+
+  # But missing anything it fails.
+  test2 = makeTest 2 [ dep2 deps ];
+  test3 = makeTest 3 [ dep1 deps ];
+  test4 = makeTest 4 [ deps ];
+  test5 = makeTest 5 [];
+
+  test6 = mkDerivation {
+    name = "check-reqs";
+    inherit deps;
+    builder = builtins.toFile "builder.sh" "mkdir $out; ln -s $deps $out/depdir1";
+    disallowedRequisites = [dep1];
+  };
+
+  test7 = mkDerivation {
+    name = "check-reqs";
+    inherit deps;
+    builder = builtins.toFile "builder.sh" "mkdir $out; ln -s $deps $out/depdir1";
+    disallowedRequisites = [test1];
+  };
+}
diff --git a/tests/check-reqs.sh b/tests/check-reqs.sh
new file mode 100644
index 000000000000..8b2454915a52
--- /dev/null
+++ b/tests/check-reqs.sh
@@ -0,0 +1,13 @@
+source common.sh
+
+RESULT=$TEST_ROOT/result
+
+nix-build -o $RESULT check-reqs.nix -A test1
+
+(! nix-build -o $RESULT check-reqs.nix -A test2)
+(! nix-build -o $RESULT check-reqs.nix -A test3)
+(! nix-build -o $RESULT check-reqs.nix -A test4)
+(! nix-build -o $RESULT check-reqs.nix -A test5)
+(! nix-build -o $RESULT check-reqs.nix -A test6)
+
+nix-build -o $RESULT check-reqs.nix -A test7
diff --git a/tests/local.mk b/tests/local.mk
index 65aa12637055..69a227495d94 100644
--- a/tests/local.mk
+++ b/tests/local.mk
@@ -10,7 +10,8 @@ nix_tests = \
   remote-store.sh export.sh export-graph.sh negative-caching.sh \
   binary-patching.sh timeout.sh secure-drv-outputs.sh nix-channel.sh \
   multiple-outputs.sh import-derivation.sh fetchurl.sh optimise-store.sh \
-  binary-cache.sh nix-profile.sh repair.sh dump-db.sh case-hack.sh
+  binary-cache.sh nix-profile.sh repair.sh dump-db.sh case-hack.sh \
+  check-reqs.sh
   # parallel.sh
 
 install-tests += $(foreach x, $(nix_tests), tests/$(x))
diff --git a/tests/remote-builds.nix b/tests/remote-builds.nix
index 81b81b87c115..5e2688d1adcf 100644
--- a/tests/remote-builds.nix
+++ b/tests/remote-builds.nix
@@ -60,6 +60,7 @@ in
           virtualisation.pathsInNixDB = [ config.system.build.extraUtils ];
           nix.package = nix;
           nix.binaryCaches = [ ];
+          programs.ssh.extraConfig = "ConnectTimeout 30";
         };
     };
 
@@ -69,14 +70,14 @@ in
 
       # Create an SSH key on the client.
       my $key = `${pkgs.openssh}/bin/ssh-keygen -t dsa -f key -N ""`;
-      $client->succeed("mkdir -m 700 /root/.ssh");
+      $client->succeed("mkdir -p -m 700 /root/.ssh");
       $client->copyFileFromHost("key", "/root/.ssh/id_dsa");
       $client->succeed("chmod 600 /root/.ssh/id_dsa");
 
       # Install the SSH key on the slaves.
       $client->waitForUnit("network.target");
       foreach my $slave ($slave1, $slave2) {
-          $slave->succeed("mkdir -m 700 /root/.ssh");
+          $slave->succeed("mkdir -p -m 700 /root/.ssh");
           $slave->copyFileFromHost("key.pub", "/root/.ssh/authorized_keys");
           $slave->waitForUnit("sshd");
           $client->succeed("ssh -o StrictHostKeyChecking=no " . $slave->name() . " 'echo hello world'");